Imported WebKit commit bb52bf3c0119e8a128cd93afe5572413a8617de9 (http://svn.webkit.org/repository/webkit/trunk@108790)

2485 files changed, 128104 insertions, 29237 deletions

diff --git a/ChangeLog b/ChangeLog
index 88254b538..43bceb3ba 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,697 @@
+2012-02-23  Konrad Piascik  <kpiascik@rim.com>
+
+        Upstream BlackBerry Cookie Management Classes
+        https://bugs.webkit.org/show_bug.cgi?id=73654
+
+        Reviewed by Rob Buis.
+
+        Manual test to see in milliseconds how quickly 100 writes followed by 100 reads take.
+        This test is ran twice and the average read and write for each of the 2 runs is shown.
+
+        * ManualTests/cookieSpeedTest.html: Added.
+
+2012-02-23  Dave Tu  <dtu@chromium.org>
+
+        Add Chromium gpu_tests to the flakiness dashboard
+        https://bugs.webkit.org/show_bug.cgi?id=79300
+
+        Reviewed by Ojan Vafai.
+
+        * Tools/TestResultServer/static-dashboards/builders.js:
+        * Tools/TestResultServer/static-dashboards/dashboard_base.js:
+
+2012-02-23  Patrick Gansterer  <paroga@webkit.org>
+
+        [CMake] Add WEBKIT_INCLUDE_CONFIG_FILES_IF_EXISTS macro
+        https://bugs.webkit.org/show_bug.cgi?id=79371
+
+        Reviewed by Daniel Bates.
+
+        Add a new macro to handle the inclusion of the platform specific *.cmake files.
+        In the future this macro should get expanded to also handle feature specifc
+        files, like the UseJSC.cmake in WebCore we already have.
+
+        * Source/cmake/WebKitMacros.cmake:
+
+2012-02-23  Patrick Gansterer  <paroga@webkit.org>
+
+        [CMake] Add FindDirectX
+        https://bugs.webkit.org/show_bug.cgi?id=79344
+
+        Reviewed by Adam Roben.
+
+        * Source/cmake/FindDirectX.cmake: Added.
+
+2012-02-23  Patrick Gansterer  <paroga@webkit.org>
+
+        [CMake] Add FindQuickTimeSDK
+        https://bugs.webkit.org/show_bug.cgi?id=79345
+
+        Reviewed by Adam Roben.
+
+        * Source/cmake/FindQuickTimeSDK.cmake: Added.
+
+2012-02-22  Raphael Kubo da Costa  <kubo@profusion.mobi>
+
+        [CMake] Remove FindGDK.cmake and FindGDK-PixBuf.cmake
+        https://bugs.webkit.org/show_bug.cgi?id=79292
+
+        Reviewed by Daniel Bates.
+
+        These files were committed when the EFL port's buildsystem code
+        was upstreamed, but are currently not being used anywhere, as the EFL
+        port has not depended on GDK for a long time.
+
+        * Source/cmake/FindGDK-PixBuf.cmake: Removed.
+        * Source/cmake/FindGDK.cmake: Removed.
+
+2012-02-22  Martin Robinson  <mrobinson@igalia.com>
+
+        [GTK] Clean build is broken when using make -j
+        https://bugs.webkit.org/show_bug.cgi?id=76388
+
+        * GNUmakefile.am: Add new global source list variables.
+
+2012-02-20  Ryosuke Niwa  <rniwa@webkit.org>
+
+        perf-o-matic: Extract logic to generate JSON responses as classes to unit test
+        https://bugs.webkit.org/show_bug.cgi?id=79018
+
+        Rubber-stamped by Adam Barth.
+
+        Extracted DashboardJSONGenerator, ManifestJSONGenerator, and RunsJSONGenerator
+        into json_generators.py from DashboardHandler, ManifestHandler, and RunsHandler
+        and added unit tests for the former three classes.
+
+        Merged the latter three classes into controler.py since they have become too trivial
+        to have their own files.
+
+        * Websites/webkit-perf.appspot.com/controller.py:
+        (ManifestUpdateHandler):
+        (ManifestUpdateHandler.get):
+        (ManifestUpdateHandler.post):
+        (DashboardUpdateHandler):
+        (DashboardUpdateHandler.get):
+        (DashboardUpdateHandler.post):
+        (_get_test_branch_platform_ids):
+        (RunsUpdateHandler):
+        (RunsUpdateHandler.get):
+        (CachedRunsHandler.get):
+        * Websites/webkit-perf.appspot.com/dashboard_handler.py: Removed.
+        * Websites/webkit-perf.appspot.com/json_generators.py: Added.
+        (JSONGeneratorBase):
+        (JSONGeneratorBase.to_json):
+        (DashboardJSONGenerator):
+        (DashboardJSONGenerator.__init__):
+        (DashboardJSONGenerator.value):
+        (ManifestJSONGenerator):
+        (ManifestJSONGenerator.__init__):
+        (ManifestJSONGenerator.value):
+        (RunsJSONGenerator):
+        (RunsJSONGenerator.__init__):
+        (RunsJSONGenerator._generate_runs):
+        (RunsJSONGenerator._entry_from_build_and_result):
+        (RunsJSONGenerator.value):
+        * Websites/webkit-perf.appspot.com/json_generators_unittest.py: Added.
+        (_create_results):
+        (JSONGeneratorBaseTest):
+        (JSONGeneratorBaseTest.test_to_json):
+        (JSONGeneratorBaseTest.test_to_json.AJSONGenerator):
+        (JSONGeneratorBaseTest.test_to_json.AJSONGenerator.value):
+        (DashboardJSONGeneratorTest):
+        (DashboardJSONGeneratorTest.test_value_no_branch):
+        (DashboardJSONGeneratorTest.test_value_no_plaforms):
+        (DashboardJSONGeneratorTest.test_value_single_platform):
+        (DashboardJSONGeneratorTest.test_value_two_platforms):
+        (ManifestJSONGeneratorTest):
+        (ManifestJSONGeneratorTest.test_value_no_branch):
+        (ManifestJSONGeneratorTest.test_value_no_plaforms):
+        (ManifestJSONGeneratorTest._assert_single_test):
+        (ManifestJSONGeneratorTest.test_value_single_platform):
+        (ManifestJSONGeneratorTest.test_value_two_platforms):
+        (ManifestJSONGeneratorTest.test_value_two_tests):
+        (RunsJSONGeneratorTest):
+        (RunsJSONGeneratorTest._create_results):
+        (RunsJSONGeneratorTest.test_generate_runs):
+        (RunsJSONGeneratorTest.test_value_without_results):
+        (RunsJSONGeneratorTest.test_value_with_results):
+        (RunsJSONGeneratorTest._assert_entry):
+        (RunsJSONGeneratorTest.test_run_from_build_and_result):
+        (RunsJSONGeneratorTest.test_run_from_build_and_result.create_build):
+        * Websites/webkit-perf.appspot.com/main.py:
+        * Websites/webkit-perf.appspot.com/manifest_handler.py: Removed.
+        * Websites/webkit-perf.appspot.com/models.py:
+        (Test.update_or_insert.execute):
+        (Test):
+        (TestResult.get_or_insert_from_parsed_json):
+        * Websites/webkit-perf.appspot.com/models_unittest.py:
+        (TestModelTests.test_update_or_insert_to_update):
+        (TestResultTests.test_get_or_insert_stat_value):
+        * Websites/webkit-perf.appspot.com/runs_handler.py: Removed.
+
+2012-02-20  Martin Robinson  <mrobinson@igalia.com>
+
+        [GTK] Turn on requestAnimationFrame for release builds
+        https://bugs.webkit.org/show_bug.cgi?id=79038
+
+        Reviewed by Gustavo Noronha Silva.
+
+        * configure.ac: Turn on requestAnimationFrame by default.
+
+2012-02-20  Martin Robinson  <mrobinson@igalia.com>
+
+        [GTK] Geolocation support should be on by default
+        https://bugs.webkit.org/show_bug.cgi?id=79037
+
+        Reviewed by Gustavo Noronha Silva.
+
+        * configure.ac: Turn on geolocation support in release builds.
+
+2012-02-20  Kihong Kwon  <kihong.kwon@samsung.com>
+
+        Add a new API for the Vibration API(W3C).
+        https://bugs.webkit.org/show_bug.cgi?id=72010
+
+        Reviewed by Hajime Morita.
+
+        Add Implementation for the Vibration API to the WebKit-EFL port.
+        http://dev.w3.org/2009/dap/vibration/
+
+        * Source/cmake/OptionsEfl.cmake: Add ENABLE_VIBRATION feature.
+        * Source/cmakeconfig.h.cmake:
+
+2012-02-19  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Move more logic from handler classes to model classes and add unit tests
+        https://bugs.webkit.org/show_bug.cgi?id=78989
+
+        Reviewed by Hajime Morita.
+
+        Extracted various functions from CreateHandler, ReportHanlder, and RunsHanlder to model classes
+        in order to unit-test them, added DataStoreTestsBase to reduce the code duplication in tests,
+        and added a whole bunch of unit tests in models_unittest.py.
+
+        * Websites/webkit-perf.appspot.com/create_handler.py:
+        (CreateHandler._create_branch):
+        (CreateHandler._create_platform):
+        * Websites/webkit-perf.appspot.com/models.py:
+        (_create_if_possible):
+        (_create_if_possible.execute):
+        (Branch):
+        (Branch.create_if_possible):
+        (Platform):
+        (Platform.create_if_possible):
+        (Build):
+        (Build.get_or_insert_from_log):
+        (Test):
+        (Test.update_or_insert):
+        (Test.update_or_insert.execute):
+        (TestResult):
+        (TestResult.get_or_insert_from_parsed_json):
+        (TestResult.get_or_insert_from_parsed_json._float_or_none):
+        (TestResult.generate_runs):
+        * Websites/webkit-perf.appspot.com/models_unittest.py:
+        (DataStoreTestsBase):
+        (DataStoreTestsBase.assertThereIsNoInstanceOf):
+        (DataStoreTestsBase.assertOnlyInstance):
+        (DataStoreTestsBase.assertEqualUnorderedList):
+        (HelperTests):
+        (HelperTests.test_create_in_transaction_with_numeric_id_holder):
+        (HelperTests.test_failing_in_create_in_transaction_with_numeric_id_holder):
+        (HelperTests.test_raising_in_create_in_transaction_with_numeric_id_holder):
+        (HelperTests.test_delete_model_with_numeric_id_holder):
+        (BranchTests):
+        (BranchTests.test_create_if_possible):
+        (PlatformTests):
+        (PlatformTests.test_create_if_possible):
+        (BuilderTests):
+        (_create_some_builder):
+        (BuildTests):
+        (BuildTests.test_get_or_insert_from_log):
+        (TestModelTests):
+        (TestModelTests.test_update_or_insert):
+        (TestModelTests.test_update_or_insert_to_update):
+        (TestResultTests):
+        (TestResultTests._create_build):
+        (TestResultTests.test_get_or_insert_value):
+        (TestResultTests.test_get_or_insert_stat_value):
+        (TestResultTests._create_results):
+        (TestResultTests.test_generate_runs):
+        (ReportLogTests):
+        (ReportLogTests.test_branch):
+        (ReportLogTests.test_platform):
+        (PersistentCacheTests):
+        (PersistentCacheTests.setUp):
+        (PersistentCacheTests.test_set):
+        * Websites/webkit-perf.appspot.com/report_process_handler.py:
+        (ReportProcessHandler.post):
+        * Websites/webkit-perf.appspot.com/runs_handler.py:
+        (RunsHandler.get):
+        (RunsHandler.post):
+
+2012-02-20  Patrick Gansterer  <paroga@webkit.org>
+
+        [CMake] Fix PLATFORM() define for Windows.
+
+        Define WTF_PLATFORM_WIN instead of WTF_PLATFORM_WINDOWS.
+
+        * Source/cmake/OptionsWindows.cmake:
+
+2012-02-20  Martin Robinson  <mrobinson@igalia.com>
+
+        Fix WebKit2GTK+ for 'make distcheck'.
+
+        Instead of conditionally including WebKit2 GNUmakefiles, always
+        include them and conditionally activate the final targets.
+
+        * GNUmakefile.am:
+
+2012-02-19  Gyuyoung Kim  <gyuyoung.kim@samsung.com>
+
+        [CMAKE] Check gstreamer minimum required version.
+        https://bugs.webkit.org/show_bug.cgi?id=79005
+
+        Reviewed by Daniel Bates.
+
+        To enable video, Gstreamer version requires to be above 0.10.30.
+        This patch checks whether Gstreamer version is greater than 0.10.30.
+
+        * Source/cmake/FindGStreamer-App.cmake:
+        * Source/cmake/FindGStreamer-Base.cmake:
+        * Source/cmake/FindGStreamer-Interfaces.cmake:
+        * Source/cmake/FindGStreamer-Pbutils.cmake:
+        * Source/cmake/FindGStreamer-Plugins-Base.cmake:
+        * Source/cmake/FindGStreamer-Video.cmake:
+        * Source/cmake/FindGStreamer.cmake:
+
+2012-02-19  Gustavo Noronha Silva  <gns@gnome.org>
+
+        [GTK] Remove unused GSettings stuff
+        https://bugs.webkit.org/show_bug.cgi?id=78995
+
+        Reviewed by Martin Robinson.
+
+        * configure.ac: remove gsettings schema file creation.
+
+2012-02-19  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Perf-o-matic should show both WebKit and Chromium revisions
+        https://bugs.webkit.org/show_bug.cgi?id=78955
+
+        Reviewed by Andreas Kling.
+
+        Include Chromium revision numbers in runs responses when available.
+
+        * Websites/webkit-perf.appspot.com/js/config.js:
+        (urlForChangeset):
+        (urlForChangesetList):
+        * Websites/webkit-perf.appspot.com/runs_handler.py:
+        (RunsHandler.post):
+
+2012-02-18  Kevin Ollivier  <kevino@theolliviers.com>
+
+        [wx] Exclude a couple unused bindings files from the build
+        as they do not compile currently.
+
+        * wscript:
+
+2012-02-17  Ryosuke Niwa  <rniwa@webkit.org>
+
+        perf-o-matic needs model unit tests
+        https://bugs.webkit.org/show_bug.cgi?id=78885
+
+        Reviewed by Adam Barth.
+
+        Added unit tests for models.py.
+
+        Also renamed modelFromNumericId to model_from_numeric_id and moved set_persitent_cache and get_persistent_cache
+        from controller to PersistentCache.set_cache and PersistentCahce.set_cache respectively.
+
+        * Websites/webkit-perf.appspot.com/controller.py:
+        (cache_manifest):
+        (CachedManifestHandler.get):
+        (cache_dashboard):
+        (CachedDashboardHandler.get):
+        (cache_runs):
+        (CachedRunsHandler.get):
+        * Websites/webkit-perf.appspot.com/create_handler.py:
+        (CreateHandler._create_builder):
+        (CreateHandler._create_builder.execute):
+        * Websites/webkit-perf.appspot.com/models.py:
+        (create_in_transaction_with_numeric_id_holder):
+        (model_from_numeric_id):
+        (Builder):
+        (Builder.create):
+        (Builder.update_password):
+        (Builder._hashed_password):
+        (TestResult.key_name):
+        (ReportLog.get_value):
+        (ReportLog._integer_in_payload):
+        (ReportLog):
+        (ReportLog.timestamp):
+        (PersistentCache):
+        (PersistentCache.set_cache):
+        (PersistentCache.set_cache.execute):
+        (PersistentCache.get_cache):
+        * Websites/webkit-perf.appspot.com/models_unittest.py: Added.
+        (HelperTests):
+        (HelperTests.setUp):
+        (HelperTests.tearDown):
+        (HelperTests._assert_there_is_exactly_one_id_holder_and_matches):
+        (HelperTests.test_create_in_transaction_with_numeric_id_holder):
+        (HelperTests.test_create_in_transaction_with_numeric_id_holder.execute):
+        (HelperTests.test_failing_in_create_in_transaction_with_numeric_id_holder):
+        (HelperTests.test_failing_in_create_in_transaction_with_numeric_id_holder.execute):
+        (HelperTests.test_raising_in_create_in_transaction_with_numeric_id_holder):
+        (HelperTests.test_raising_in_create_in_transaction_with_numeric_id_holder.execute):
+        (HelperTests.test_delete_model_with_numeric_id_holder):
+        (HelperTests.test_delete_model_with_numeric_id_holder.execute):
+        (HelperTests.test_model_from_numeric_id):
+        (HelperTests.test_model_from_numeric_id.execute):
+        (BuilderTests):
+        (BuilderTests.setUp):
+        (BuilderTests.tearDown):
+        (BuilderTests.test_create):
+        (BuilderTests.test_update_password):
+        (BuilderTests.test_hashed_password):
+        (BuilderTests.test_authenticate):
+        (ReportLog):
+        (ReportLog.setUp):
+        (ReportLog.tearDown):
+        (ReportLog._create_log_with_payload):
+        (ReportLog.test_parsed_payload):
+        (ReportLog.test_get_value):
+        (ReportLog.test_results):
+        (ReportLog.test_builder):
+        (ReportLog.test_build_number):
+        (ReportLog.test_webkit_revision):
+        (ReportLog.chromium_revision):
+        (PersistentCacheTests):
+        (PersistentCacheTests.setUp):
+        (PersistentCacheTests.tearDown):
+        (PersistentCacheTests._assert_persistent_cache):
+        (PersistentCacheTests.test_set):
+        (PersistentCacheTests.test_get):
+        * Websites/webkit-perf.appspot.com/runs_handler.py:
+        (RunsHandler.post):
+
+2012-02-17  Carlos Garcia Campos  <cgarcia@igalia.com>
+
+        Unreviewed. Fix GTK+ build after r108003.
+
+        * Source/autotools/symbols.filter: Add missing symbol.
+
+2012-02-16  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        [Qt] Move event conversion functions from WebCore to WebKit
+        https://bugs.webkit.org/show_bug.cgi?id=78788
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        * Source/api.pri: Add new files to the build.
+
+2012-02-14  Raphael Kubo da Costa  <kubo@profusion.mobi>
+
+        [CMake] Remove unused PkgConfig module import from FindCFLite.cmake.
+        https://bugs.webkit.org/show_bug.cgi?id=78600
+
+        Reviewed by Adam Roben.
+
+        * Source/cmake/FindCFLite.cmake:
+
+2012-02-15  Roland Steiner  <rolandsteiner@chromium.org>
+
+        <style scoped>: Allow <style scoped> as a direct child of a ShadowRoot
+        https://bugs.webkit.org/show_bug.cgi?id=77853
+
+        numberOfScopedHTMLStyleChildren got moved from Element into Node.
+
+        Reviewed by Dimitri Glazkov.
+
+        * Source/autotools/symbols.filter:
+
+2012-02-13  Raphael Kubo da Costa  <kubo@profusion.mobi>
+
+        [CMake] Merge WebKitEfl.cmake into FindEFL.cmake.
+        https://bugs.webkit.org/show_bug.cgi?id=78566
+
+        Reviewed by Daniel Bates.
+
+        * Source/cmake/FindEFL.cmake: Move the code to find edje_cc here from
+        WebKitEfl.cmake.
+        * Source/cmake/WebKitEfl.cmake: Removed.
+
+2012-02-14  Shinya Kawanaka  <shinyak@google.com>
+
+        Use youngestShadowRoot and oldestShadowRoot instead of Element::shadowRoot().
+        https://bugs.webkit.org/show_bug.cgi?id=78455
+
+        Reviewed by Hajime Morita.
+
+        Exports necessary symbols.
+
+        * Source/autotools/symbols.filter:
+
+2012-02-13  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Yet another perf-o-matic build fix. It turns out that a task of the same name can't be
+        queued for days after the first task is completed. So don't use it. Updating persistent
+        caches more often than necessary is better than never updating them.
+
+        * Websites/webkit-perf.appspot.com/controller.py:
+        (schedule_manifest_update):
+        (schedule_dashboard_update):
+        (schedule_runs_update):
+
+2012-02-13  ChangSeok Oh  <shivamidow@gmail.com>
+
+        [GTK] Revise configuration for MHTML
+        https://bugs.webkit.org/show_bug.cgi?id=78364
+
+        Reviewed by Gustavo Noronha Silva.
+
+        Added some lines to show checking messages, whether mhtml is enabled or not
+        during configuration and the configuration result for mhtml.
+        MHTML is a web page archive format used to combine resources
+        that are typically represented by external links (such as images, Flash animations,
+        Java applets, audio files) together with HTML code into a single file.
+        http://en.wikipedia.org/wiki/MHTML
+
+        * configure.ac:
+
+2012-02-06  Raphael Kubo da Costa  <kubo@profusion.mobi>
+
+        [EFL] Drop support for the Curl network backend.
+        https://bugs.webkit.org/show_bug.cgi?id=77874
+
+        Reviewed by Eric Seidel.
+
+        Nobody seems to be maintaining the Curl backend in WebCore, the
+        EFL port developers all seem to be using the Soup backend and the
+        port itself has many features which are only implemented for the
+        latter.
+
+        * Source/cmake/OptionsEfl.cmake: Remove network backend selection
+        checks and unconditionally require Glib and Libsoup, bump the
+        required LibSoup version to the same one the GTK+ port looks for,
+        since we share the same network backend.
+
+2012-02-12  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Another perf-o-matic build fix.
+
+        * Websites/webkit-perf.appspot.com/report_process_handler.py:
+        (ReportProcessHandler._create_build_if_possible):
+
+2012-02-12  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Perf-o-matic build fix.
+
+        * Websites/webkit-perf.appspot.com/report_handler.py:
+        (ReportHandler.post):
+
+2012-02-10  Ryosuke Niwa  <rniwa@webkit.org>
+
+        REGRESSION: Perf-o-matic adds duplicated test results
+        https://bugs.webkit.org/show_bug.cgi?id=78373
+
+        Reviewed by Hajime Morita.
+
+        Add TestResult inside a transaction. We use high replication databsae but this should prevent
+        the duplication in the most of the time.
+
+        Also fixed random bugs in Controller and ReportHandler.
+
+        * Websites/webkit-perf.appspot.com/controller.py:
+        (get_persistent_cache):
+        * Websites/webkit-perf.appspot.com/report_handler.py:
+        (ReportHandler.post):
+        * Websites/webkit-perf.appspot.com/report_process_handler.py:
+        (ReportProcessHandler.post):
+        (ReportProcessHandler._add_test_if_needed):
+        (ReportProcessHandler):
+        (ReportProcessHandler._add_test_result_if_needed):
+        (ReportProcessHandler._add_test_result_if_needed._float_or_none):
+        (ReportProcessHandler._add_test_result_if_needed.execute):
+
+2012-02-12  Carlos Garcia Campos  <cgarcia@igalia.com>
+
+        Unreviewed. Fix GTK+ build after r107454.
+
+        * configure.ac: Disable Mutation observers build on GTK+ until it
+        can actually build.
+
+2012-02-10  Adam Klein  <adamk@chromium.org>
+
+        Enable MUTATION_OBSERVERS by default on all platforms
+        https://bugs.webkit.org/show_bug.cgi?id=78196
+
+        Reviewed by Ojan Vafai.
+
+        * configure.ac:
+
+2012-02-10  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Perf-o-matic build fix after r107386.
+
+        * Websites/webkit-perf.appspot.com/app.yaml:
+        * Websites/webkit-perf.appspot.com/controller.py:
+        (schedule_manifest_update):
+        (schedule_dashboard_update):
+        (schedule_runs_update):
+        * Websites/webkit-perf.appspot.com/merge_tests_handler.py:
+        (MergeTestsHandler.get):
+        * Websites/webkit-perf.appspot.com/report_logs_handler.py:
+        (ReportLogsHandler.get):
+        (ReportLogsHandler.post):
+
+2012-02-10  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Perf-o-matic should process reports in background
+        https://bugs.webkit.org/show_bug.cgi?id=78309
+
+        Reviewed by Hajime Morita.
+
+        Split the logic to create Build, Test, and TestResult objects from ReportHandler into ReportProcessHandler.
+        ReportHandler now merely creates ReportLog and schedules a task to process it.
+
+        Also added ReportLogHandler to manage stale ReportLogs.
+
+        * Websites/webkit-perf.appspot.com/app.yaml:
+        * Websites/webkit-perf.appspot.com/controller.py:
+        (schedule_manifest_update):
+        (schedule_dashboard_update):
+        (schedule_runs_update):
+        (CachedRunsHandler.get):
+        (schedule_report_process):
+        * Websites/webkit-perf.appspot.com/main.py:
+        * Websites/webkit-perf.appspot.com/merge_tests.html: Renamed from Websites/webkit-perf.appspot.com/merge_tests.yaml.
+        * Websites/webkit-perf.appspot.com/models.py:
+        (ReportLog):
+        (ReportLog._parsed_payload):
+        (ReportLog.get_value):
+        (ReportLog.results):
+        (ReportLog.builder):
+        (ReportLog.branch):
+        (ReportLog.platform):
+        (ReportLog.build_number):
+        (ReportLog.webkit_revision):
+        (ReportLog.chromium_revision):
+        (ReportLog._model_by_key_name_in_payload):
+        (ReportLog._integer_in_payload):
+        (ReportLog.timestamp):
+        * Websites/webkit-perf.appspot.com/report_handler.py:
+        (ReportHandler.post):
+        (ReportHandler._output):
+        (ReportHandler._results_are_valid):
+        (ReportHandler._results_are_valid._is_float_convertible):
+        (ReportHandler):
+        * Websites/webkit-perf.appspot.com/report_logs.html: Added.
+        * Websites/webkit-perf.appspot.com/report_logs_handler.py: Added.
+        (ReportLogsHandler):
+        (ReportLogsHandler.get):
+        (ReportLogsHandler.post):
+        (ReportLogsHandler._error):
+        * Websites/webkit-perf.appspot.com/report_process_handler.py: Copied from Websites/webkit-perf.appspot.com/report_handler.py.
+        (ReportProcessHandler):
+        (ReportProcessHandler.post):
+        (ReportProcessHandler._create_build_if_possible):
+        (ReportProcessHandler._create_build_if_possible.execute):
+        (ReportProcessHandler._add_test_if_needed):
+
+2012-02-09  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Perf-o-matic shouldn't rely on memcache to store cached JSON responses
+        https://bugs.webkit.org/show_bug.cgi?id=78306
+
+        Reviewed by Adam Barth.
+
+        Added PersistentCache model that stores the generated JSON responses.
+
+        * Websites/webkit-perf.appspot.com/controller.py:
+        (set_persistent_cache):
+        (set_persistent_cache.execute):
+        (get_persistent_cache):
+        (cache_manifest):
+        (CachedManifestHandler.get):
+        (cache_dashboard):
+        (CachedDashboardHandler.get):
+        (cache_runs):
+        (CachedRunsHandler.get):
+        * Websites/webkit-perf.appspot.com/models.py:
+        (TestResult):
+        (ReportLog):
+        (PersistentCache):
+
+2012-02-09  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Perf-o-matic should update memcache in taskqueue
+        https://bugs.webkit.org/show_bug.cgi?id=78209
+
+        Reviewed by Adam Barth.
+
+        Update dashboard, manifest, and runs memcaches in taskqueue.
+        Also centralized the management of caches in controller.py.
+
+        * Websites/webkit-perf.appspot.com/app.yaml:
+        * Websites/webkit-perf.appspot.com/controller.py: Added.
+        (cache_manifest):
+        (schedule_manifest_update):
+        (CachedManifestHandler):
+        (CachedManifestHandler.get):
+        (cache_dashboard):
+        (schedule_dashboard_update):
+        (CachedDashboardHandler):
+        (CachedDashboardHandler.get):
+        (cache_runs):
+        (schedule_runs_update):
+        (CachedRunsHandler):
+        (CachedRunsHandler.get):
+        * Websites/webkit-perf.appspot.com/create_handler.py:
+        (CreateHandler.post):
+        * Websites/webkit-perf.appspot.com/dashboard_handler.py:
+        (DashboardHandler.post):
+        * Websites/webkit-perf.appspot.com/main.py:
+        * Websites/webkit-perf.appspot.com/manifest_handler.py:
+        (ManifestHandler.post):
+        * Websites/webkit-perf.appspot.com/merge_tests_handler.py:
+        (MergeTestsHandler.post):
+        * Websites/webkit-perf.appspot.com/report_handler.py:
+        (ReportHandler.post):
+        * Websites/webkit-perf.appspot.com/runs_handler.py:
+        (RunsHandler.post):
+
+2012-02-09  Carlos Garcia Campos  <cgarcia@igalia.com>
+
+        [GTK] Add WebKitWebView::mouse-target-changed signal to WebKit2 GTK+ API
+        https://bugs.webkit.org/show_bug.cgi?id=78097
+
+        Reviewed by Martin Robinson.
+
+        * Source/autotools/symbols.filter: Add freeOwnedGPtr<_GdkEvent>
+        symbol to be able to use GOwnPtr<GdkEvent> in WebKit2 GTK+ unit
+        tests.
+
 2012-02-09  Kent Tamura  <tkent@chromium.org>
 
         Do not localize numbers in scientific notation
diff --git a/GNUmakefile.am b/GNUmakefile.am
index 4b3ed3b92..bb2163159 100644
--- a/GNUmakefile.am
+++ b/GNUmakefile.am
@@ -80,7 +80,9 @@ webkitgtk_cppflags :=
 webkitgtk_gdom_built_sources :=
 webkitgtk_built_sources :=
 webkitgtk_built_nosources :=
+webkit2_sources :=
 webkit2_built_sources :=
+webkit2_plugin_process_sources :=
 webkit2_plugin_process_built_sources :=
 webkittestrunner_built_sources :=
 libwebcoreinternals_built_sources :=
@@ -241,14 +243,12 @@ include Tools/GNUmakefile.am
 include Source/WebKit/gtk/po/GNUmakefile.am
 include Tools/DumpRenderTree/gtk/GNUmakefile.ImageDiff.am
 
-if ENABLE_WEBKIT2
 include Source/WebKit2/GNUmakefile.am
 include Source/WebKit2/UIProcess/API/gtk/tests/GNUmakefile.am
 include Tools/MiniBrowser/gtk/GNUmakefile.am
 include Tools/WebKitTestRunner/GNUmakefile.am
 # [GTK] Refactor the translations now that we have webkit2
 # https://bugs.webkit.org/show_bug.cgi?id=55153
-endif
 
 # Autogenerated sources
 BUILT_SOURCES += \
diff --git a/Source/JavaScriptCore/API/JSClassRef.cpp b/Source/JavaScriptCore/API/JSClassRef.cpp
index 0909e9975..298c734ea 100644
--- a/Source/JavaScriptCore/API/JSClassRef.cpp
+++ b/Source/JavaScriptCore/API/JSClassRef.cpp
@@ -222,7 +222,7 @@ JSObject* OpaqueJSClass::prototype(ExecState* exec)
 
     if (!jsClassData.cachedPrototype) {
         // Recursive, but should be good enough for our purposes
-        jsClassData.cachedPrototype.set(exec->globalData(), JSCallbackObject<JSNonFinalObject>::create(exec, exec->lexicalGlobalObject(), exec->lexicalGlobalObject()->callbackObjectStructure(), prototypeClass, &jsClassData), 0); // set jsClassData as the object's private data, so it can clear our reference on destruction
+        jsClassData.cachedPrototype = PassWeak<JSObject>(exec->globalData(), JSCallbackObject<JSNonFinalObject>::create(exec, exec->lexicalGlobalObject(), exec->lexicalGlobalObject()->callbackObjectStructure(), prototypeClass, &jsClassData), 0); // set jsClassData as the object's private data, so it can clear our reference on destruction
         if (parentClass) {
             if (JSObject* prototype = parentClass->prototype(exec))
                 jsClassData.cachedPrototype->setPrototype(exec->globalData(), prototype);
diff --git a/Source/JavaScriptCore/API/WebKitAvailability.h b/Source/JavaScriptCore/API/WebKitAvailability.h
index 0e4f091cc..7846058fa 100644
--- a/Source/JavaScriptCore/API/WebKitAvailability.h
+++ b/Source/JavaScriptCore/API/WebKitAvailability.h
@@ -901,4 +901,23 @@
 #endif
 
 
+
+
+
+
+/*
+ * AVAILABLE_AFTER_WEBKIT_VERSION_5_1
+ * 
+ * Used on functions introduced after WebKit 5.1
+ */
+#define AVAILABLE_AFTER_WEBKIT_VERSION_5_1
+
+/* AVAILABLE_WEBKIT_VERSION_1_3_AND_LATER_BUT_DEPRECATED_AFTER_WEBKIT_VERSION_5_1
+ *
+ * Used on declarations introduced in WebKit 1.3,
+ * but later deprecated after WebKit 5.1
+ */
+#define AVAILABLE_WEBKIT_VERSION_1_3_AND_LATER_BUT_DEPRECATED_AFTER_WEBKIT_VERSION_5_1
+
+
 #endif /* __WebKitAvailability__ */
diff --git a/Source/JavaScriptCore/CMakeLists.txt b/Source/JavaScriptCore/CMakeLists.txt
index eaa395e15..2afcbdc65 100644
--- a/Source/JavaScriptCore/CMakeLists.txt
+++ b/Source/JavaScriptCore/CMakeLists.txt
@@ -11,6 +11,7 @@ SET(JavaScriptCore_INCLUDE_DIRECTORIES
     "${JAVASCRIPTCORE_DIR}/debugger"
     "${JAVASCRIPTCORE_DIR}/interpreter"
     "${JAVASCRIPTCORE_DIR}/jit"
+    "${JAVASCRIPTCORE_DIR}/llint"
     "${JAVASCRIPTCORE_DIR}/parser"
     "${JAVASCRIPTCORE_DIR}/profiler"
     "${JAVASCRIPTCORE_DIR}/runtime"
@@ -41,23 +42,28 @@ SET(JavaScriptCore_SOURCES
     bytecode/DFGExitProfile.cpp
     bytecode/GetByIdStatus.cpp
     bytecode/JumpTable.cpp
+    bytecode/LazyOperandValueProfile.cpp
     bytecode/MethodCallLinkInfo.cpp
     bytecode/MethodCallLinkStatus.cpp
+    bytecode/MethodOfGettingAValueProfile.cpp
     bytecode/Opcode.cpp
+    bytecode/PolymorphicPutByIdList.cpp
     bytecode/PredictedType.cpp
     bytecode/PutByIdStatus.cpp
     bytecode/SamplingTool.cpp
     bytecode/StructureStubInfo.cpp
-    bytecode/ValueProfile.cpp
 
     bytecompiler/BytecodeGenerator.cpp
     bytecompiler/NodesCodegen.cpp
 
     dfg/DFGAbstractState.cpp
+    dfg/DFGArithNodeFlagsInferencePhase.cpp
     dfg/DFGAssemblyHelpers.cpp
     dfg/DFGByteCodeParser.cpp
     dfg/DFGCapabilities.cpp
+    dfg/DFGCFAPhase.cpp
     dfg/DFGCorrectableJumpPoint.cpp
+    dfg/DFGCSEPhase.cpp
     dfg/DFGDriver.cpp
     dfg/DFGGraph.cpp
     dfg/DFGJITCompiler.cpp
@@ -67,14 +73,16 @@ SET(JavaScriptCore_SOURCES
     dfg/DFGOSRExitCompiler32_64.cpp
     dfg/DFGOSRExitCompiler64.cpp
     dfg/DFGOperations.cpp
-    dfg/DFGPropagator.cpp
+    dfg/DFGPhase.cpp
+    dfg/DFGPredictionPropagationPhase.cpp
     dfg/DFGRepatch.cpp
     dfg/DFGSpeculativeJIT.cpp
     dfg/DFGSpeculativeJIT32_64.cpp
     dfg/DFGSpeculativeJIT64.cpp
     dfg/DFGThunks.cpp
+    dfg/DFGVirtualRegisterAllocationPhase.cpp
 
-    heap/BumpSpace.cpp
+    heap/CopiedSpace.cpp
     heap/DFGCodeBlocks.cpp
     heap/Heap.cpp
     heap/HandleHeap.cpp
@@ -96,6 +104,7 @@ SET(JavaScriptCore_SOURCES
     interpreter/RegisterFile.cpp
 
     jit/ExecutableAllocator.cpp
+    jit/HostCallReturnValue.cpp
     jit/JITArithmetic32_64.cpp
     jit/JITArithmetic.cpp
     jit/JITCall32_64.cpp
@@ -210,7 +219,6 @@ SET(JavaScriptCore_SOURCES
     yarr/YarrJIT.cpp
     yarr/YarrSyntaxChecker.cpp
 )
-SET(JavaScriptCore_HEADERS )
 
 SET(JavaScriptCore_LUT_FILES
     runtime/ArrayConstructor.cpp
@@ -281,7 +289,7 @@ ELSE ()
 ENDIF ()
 
 
-INCLUDE_IF_EXISTS(${JAVASCRIPTCORE_DIR}/Platform${PORT}.cmake)
+WEBKIT_INCLUDE_CONFIG_FILES_IF_EXISTS()
 
 
 ADD_SUBDIRECTORY(wtf)
diff --git a/Source/JavaScriptCore/ChangeLog b/Source/JavaScriptCore/ChangeLog
index bbef23628..87b921f0f 100644
--- a/Source/JavaScriptCore/ChangeLog
+++ b/Source/JavaScriptCore/ChangeLog
@@ -1,3 +1,3738 @@
+2012-02-24  Zoltan Herczeg  <zherczeg@webkit.org>
+
+        [Qt] Buildfix for "Zero out CopiedBlocks on initialization".
+        https://bugs.webkit.org/show_bug.cgi?id=79199
+
+        Ruber stamped by Csaba Osztrogonác.
+
+        Temporary fix since the new member wastes a little space on
+        64 bit systems. Although it is harmless, it is only needed
+        for 32 bit systems.
+
+        * heap/CopiedBlock.h:
+        (CopiedBlock):
+
+2012-02-24  Han Hojong  <hojong.han@samsung.com>
+
+        Remove useless jump instructions for short circuit
+        https://bugs.webkit.org/show_bug.cgi?id=75602
+
+        Reviewed by Michael Saboff.
+
+        Jump instruction is inserted to make short circuit, 
+        however it does nothing but moving to the next instruction.
+        Therefore useless jump instructions are removed, 
+        and jump list is moved into the case not for a short circuit,
+        so that only necessary instructions are added to JIT code
+        unless it has a 16 bit pattern character and an 8 bit string.
+
+        * yarr/YarrJIT.cpp:
+        (JSC::Yarr::YarrGenerator::generatePatternCharacterGreedy):
+        (JSC::Yarr::YarrGenerator::backtrackPatternCharacterNonGreedy):
+
+2012-02-24  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r108731.
+        http://trac.webkit.org/changeset/108731
+        https://bugs.webkit.org/show_bug.cgi?id=79464
+
+        Broke Chromium Win tests (Requested by bashi on #webkit).
+
+        * wtf/Platform.h:
+
+2012-02-24  Andrew Lo  <anlo@rim.com>
+
+        [BlackBerry] Enable requestAnimationFrame
+        https://bugs.webkit.org/show_bug.cgi?id=79408
+
+        Use timer implementation of requestAnimationFrame on BlackBerry.
+
+        Reviewed by Rob Buis.
+
+        * wtf/Platform.h:
+
+2012-02-24  Mathias Bynens  <mathias@qiwi.be>
+
+        `\u200c` and `\u200d` should be allowed in IdentifierPart, as per ES5
+        https://bugs.webkit.org/show_bug.cgi?id=78908
+
+        Add additional checks for zero-width non-joiner (0x200C) and
+        zero-width joiner (0x200D) characters.
+
+        Reviewed by Michael Saboff.
+
+        * parser/Lexer.cpp:
+        (JSC::isNonASCIIIdentPart)
+        * runtime/LiteralParser.cpp:
+        (JSC::::Lexer::lexIdentifier)
+
+2012-02-23  Kenichi Ishibashi  <bashi@chromium.org>
+
+        Adding WebSocket per-frame DEFLATE extension
+        https://bugs.webkit.org/show_bug.cgi?id=77522
+
+        Added USE(ZLIB) flag.
+
+        Reviewed by Kent Tamura.
+
+        * wtf/Platform.h:
+
+2012-02-23  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Zero out CopiedBlocks on initialization
+        https://bugs.webkit.org/show_bug.cgi?id=79199
+
+        Reviewed by Filip Pizlo.
+
+        Made CopyBlocks zero their payloads during construction. This allows 
+        JSArray to avoid having to manually clear its backing store upon allocation
+        and also alleviates any future pain with regard to the garbage collector trying 
+        to mark what it thinks are values in what is actually uninitialized memory.
+
+        * heap/CopiedBlock.h:
+        (JSC::CopiedBlock::CopiedBlock):
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::finishCreation):
+        (JSC::JSArray::tryFinishCreationUninitialized):
+        (JSC::JSArray::increaseVectorLength):
+        (JSC::JSArray::unshiftCountSlowCase):
+
+2012-02-23  Oliver Hunt  <oliver@apple.com>
+
+        Make Interpreter::getStackTrace be able to generate the line number for the top callframe if none is provided
+        https://bugs.webkit.org/show_bug.cgi?id=79407
+
+        Reviewed by Gavin Barraclough.
+
+        Outside of exception handling, we don't know what our source line number is.  This
+        change allows us to pass -1 is as the initial line number, and get the correct line
+        number in the resultant stack trace.  We can't completely elide the initial line
+        number (yet) due to some idiosyncrasies of the exception handling machinery.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::getLineNumberForCallFrame):
+        (JSC):
+        (JSC::Interpreter::getStackTrace):
+
+2012-02-22  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG OSR exit value profiling should have graceful handling of local variables and arguments
+        https://bugs.webkit.org/show_bug.cgi?id=79310
+
+        Reviewed by Gavin Barraclough.
+        
+        Previously, if we OSR exited because a prediction in a local was wrong, we'd
+        only realize what the true type of the local was if the regular value profiling
+        kicked in and told us. Unless the local was block-locally copy propagated, in
+        which case we'd know from an OSR exit profile.
+        
+        This patch adds OSR exit profiling to all locals and arguments. Now, if we OSR
+        exit because of a mispredicted local or argument type, we'll know what the type of
+        the local or argument should be immediately upon exiting.
+        
+        The way that local variable OSR exit profiling works is that we now have a lazily
+        added set of OSR-exit-only value profiles for exit sites that are BadType and that
+        cited a GetLocal as their value source. The value profiles are only added if the
+        OSR exit is taken, and are keyed by CodeBlock, bytecode index of the GetLocal, and
+        operand. The look-up is performed by querying the
+        CompressedLazyOperandValueProfileHolder in the CodeBlock, using a key that contains
+        the bytecode index and the operand. Because the value profiles are added at random
+        times, they are not sorted; instead they are just stored in an arbitrarily-ordered
+        SegmentedVector. Look-ups are made fast by "decompressing": the DFG::ByteCodeParser
+        creates a LazyOperandValueProfileParser, which turns the
+        CompressedLazyOperandValueProfileHolder's contents into a HashMap for the duration
+        of DFG parsing.
+        
+        Previously, OSR exits had a pointer to the ValueProfile that had the specFailBucket
+        into which values observed during OSR exit would be placed. Now it uses a lazy
+        thunk for a ValueProfile. I call this the MethodOfGettingAValueProfile. It may
+        either contain a ValueProfile inside it (which works for previous uses of OSR exit
+        profiling) or it may just have knowledge of how to go about creating the
+        LazyOperandValueProfile in the case that the OSR exit is actually taken. This
+        ensures that we never have to create NumOperands*NumBytecodeIndices*NumCodeBlocks
+        value profiling buckets unless we actually did OSR exit on every single operand,
+        in every single instruction, in each code block (that's probably unlikely).
+        
+        This appears to be neutral on the major benchmarks, but is a double-digit speed-up
+        on code deliberately written to have data flow that spans basic blocks and where
+        the code exhibits post-optimization polymorphism in a local variable.
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * Target.pri:
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::stronglyVisitStrongReferences):
+        * bytecode/CodeBlock.h:
+        (CodeBlock):
+        (JSC::CodeBlock::lazyOperandValueProfiles):
+        * bytecode/LazyOperandValueProfile.cpp: Added.
+        (JSC):
+        (JSC::CompressedLazyOperandValueProfileHolder::CompressedLazyOperandValueProfileHolder):
+        (JSC::CompressedLazyOperandValueProfileHolder::~CompressedLazyOperandValueProfileHolder):
+        (JSC::CompressedLazyOperandValueProfileHolder::computeUpdatedPredictions):
+        (JSC::CompressedLazyOperandValueProfileHolder::add):
+        (JSC::LazyOperandValueProfileParser::LazyOperandValueProfileParser):
+        (JSC::LazyOperandValueProfileParser::~LazyOperandValueProfileParser):
+        (JSC::LazyOperandValueProfileParser::getIfPresent):
+        (JSC::LazyOperandValueProfileParser::prediction):
+        * bytecode/LazyOperandValueProfile.h: Added.
+        (JSC):
+        (LazyOperandValueProfileKey):
+        (JSC::LazyOperandValueProfileKey::LazyOperandValueProfileKey):
+        (JSC::LazyOperandValueProfileKey::operator!):
+        (JSC::LazyOperandValueProfileKey::operator==):
+        (JSC::LazyOperandValueProfileKey::hash):
+        (JSC::LazyOperandValueProfileKey::bytecodeOffset):
+        (JSC::LazyOperandValueProfileKey::operand):
+        (JSC::LazyOperandValueProfileKey::isHashTableDeletedValue):
+        (JSC::LazyOperandValueProfileKeyHash::hash):
+        (JSC::LazyOperandValueProfileKeyHash::equal):
+        (LazyOperandValueProfileKeyHash):
+        (WTF):
+        (JSC::LazyOperandValueProfile::LazyOperandValueProfile):
+        (LazyOperandValueProfile):
+        (JSC::LazyOperandValueProfile::key):
+        (CompressedLazyOperandValueProfileHolder):
+        (LazyOperandValueProfileParser):
+        * bytecode/MethodOfGettingAValueProfile.cpp: Added.
+        (JSC):
+        (JSC::MethodOfGettingAValueProfile::fromLazyOperand):
+        (JSC::MethodOfGettingAValueProfile::getSpecFailBucket):
+        * bytecode/MethodOfGettingAValueProfile.h: Added.
+        (JSC):
+        (MethodOfGettingAValueProfile):
+        (JSC::MethodOfGettingAValueProfile::MethodOfGettingAValueProfile):
+        (JSC::MethodOfGettingAValueProfile::operator!):
+        * bytecode/ValueProfile.cpp: Removed.
+        * bytecode/ValueProfile.h:
+        (JSC):
+        (ValueProfileBase):
+        (JSC::ValueProfileBase::ValueProfileBase):
+        (JSC::ValueProfileBase::dump):
+        (JSC::ValueProfileBase::computeUpdatedPrediction):
+        (JSC::MinimalValueProfile::MinimalValueProfile):
+        (ValueProfileWithLogNumberOfBuckets):
+        (JSC::ValueProfileWithLogNumberOfBuckets::ValueProfileWithLogNumberOfBuckets):
+        (JSC::ValueProfile::ValueProfile):
+        (JSC::getValueProfileBytecodeOffset):
+        (JSC::getRareCaseProfileBytecodeOffset):
+        * dfg/DFGByteCodeParser.cpp:
+        (ByteCodeParser):
+        (JSC::DFG::ByteCodeParser::injectLazyOperandPrediction):
+        (JSC::DFG::ByteCodeParser::getLocal):
+        (JSC::DFG::ByteCodeParser::getArgument):
+        (InlineStackEntry):
+        (JSC::DFG::ByteCodeParser::fixVariableAccessPredictions):
+        (DFG):
+        (JSC::DFG::ByteCodeParser::InlineStackEntry::InlineStackEntry):
+        (JSC::DFG::ByteCodeParser::parse):
+        * dfg/DFGDriver.cpp:
+        (JSC::DFG::compile):
+        * dfg/DFGGraph.h:
+        (JSC::DFG::Graph::valueProfileFor):
+        (JSC::DFG::Graph::methodOfGettingAValueProfileFor):
+        (Graph):
+        * dfg/DFGNode.h:
+        (Node):
+        * dfg/DFGOSRExit.cpp:
+        (JSC::DFG::OSRExit::OSRExit):
+        * dfg/DFGOSRExit.h:
+        (OSRExit):
+        * dfg/DFGOSRExitCompiler32_64.cpp:
+        (JSC::DFG::OSRExitCompiler::compileExit):
+        * dfg/DFGOSRExitCompiler64.cpp:
+        (JSC::DFG::OSRExitCompiler::compileExit):
+        * dfg/DFGPhase.cpp:
+        (JSC::DFG::Phase::beginPhase):
+        (JSC::DFG::Phase::endPhase):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::checkArgumentTypes):
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::speculationCheck):
+        * dfg/DFGVariableAccessData.h:
+        (JSC::DFG::VariableAccessData::nonUnifiedPrediction):
+        (VariableAccessData):
+
+2012-02-23  Filip Pizlo  <fpizlo@apple.com>
+
+        Build fix.
+
+        * llint/LLIntOffsetsExtractor.cpp:
+
+2012-02-23  Kevin Ollivier  <kevino@theolliviers.com>
+
+        [wx] Build fix, disable LLINT for now and fix ENABLE defines for it.
+
+        * llint/LLIntOffsetsExtractor.cpp:
+        * wtf/Platform.h:
+
+2012-02-23  Kevin Ollivier  <kevino@theolliviers.com>
+
+        [wx] Build fix for non-Mac wx builds.
+
+        * runtime/DatePrototype.cpp:
+
+2012-02-22  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG's logic for emitting a Flush is too convoluted and contains an inaccurate comment
+        https://bugs.webkit.org/show_bug.cgi?id=79334
+
+        Reviewed by Oliver Hunt.
+
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::getLocal):
+        (JSC::DFG::ByteCodeParser::getArgument):
+        (JSC::DFG::ByteCodeParser::flush):
+
+2012-02-23  Gavin Barraclough  <barraclough@apple.com>
+
+        Object.isSealed / Object.isFrozen don't work for native objects
+        https://bugs.webkit.org/show_bug.cgi?id=79331
+
+        Reviewed by Sam Weinig.
+
+        Need to inspect all properties, including static ones.
+        This exposes a couple of bugs in Array & Arguments:
+            - getOwnPropertyDescriptor doesn't correctly report the writable attribute of array length.
+            - Arguments object's defineOwnProperty does not handle callee/caller/length correctly.
+
+        * runtime/Arguments.cpp:
+        (JSC::Arguments::defineOwnProperty):
+            - Add handling for callee/caller/length.
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::getOwnPropertyDescriptor):
+            - report length's writability correctly.
+        * runtime/ObjectConstructor.cpp:
+        (JSC::objectConstructorSeal):
+        (JSC::objectConstructorFreeze):
+        (JSC::objectConstructorIsSealed):
+        (JSC::objectConstructorIsFrozen):
+            - Add spec-based implementation for non-final objects.
+
+2012-02-23  Gavin Barraclough  <barraclough@apple.com>
+
+        pop of array hole should get from the prototype chain
+        https://bugs.webkit.org/show_bug.cgi?id=79338
+
+        Reviewed by Sam Weinig.
+
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::pop):
+            - If the fast fast vector case fails, more closely follow the spec.
+
+2012-02-23  Yong Li  <yoli@rim.com>
+
+        JSString::outOfMemory() should ASSERT(isRope()) rather than !isRope()
+        https://bugs.webkit.org/show_bug.cgi?id=79268
+
+        Reviewed by Michael Saboff.
+
+        resolveRope() is the only caller of outOfMemory(), and it calls outOfMemory()
+        after it fails to allocate a buffer for m_value. So outOfMemory() should assert
+        isRope() rather than !isRope().
+
+        * runtime/JSString.cpp:
+        (JSC::JSString::outOfMemory):
+
+2012-02-23  Patrick Gansterer  <paroga@webkit.org>
+
+        [CMake] Add WEBKIT_INCLUDE_CONFIG_FILES_IF_EXISTS macro
+        https://bugs.webkit.org/show_bug.cgi?id=79371
+
+        Reviewed by Daniel Bates.
+
+        * CMakeLists.txt:
+        * shell/CMakeLists.txt:
+        * wtf/CMakeLists.txt:
+
+2012-02-23  Aron Rosenberg  <arosenberg@logitech.com>
+
+        Fix the PRI macros used in WTF::String formatters to be compatible with Qt and Visual Studio 2005 and newer.
+        https://bugs.webkit.org/show_bug.cgi?id=76210
+
+        Add compile time check for Visual Studio 2005 or newer.
+
+        Reviewed by Simon Hausmann.
+
+        * os-win32/inttypes.h:
+
+2012-02-22  Gavin Barraclough  <barraclough@apple.com>
+
+        Implement [[DefineOwnProperty]] for the arguments object
+        https://bugs.webkit.org/show_bug.cgi?id=79309
+
+        Reviewed by Sam Weinig.
+
+        * runtime/Arguments.cpp:
+        (JSC::Arguments::deletePropertyByIndex):
+        (JSC::Arguments::deleteProperty):
+            - Deleting an argument should also delete the copy on the object, if any.
+        (JSC::Arguments::defineOwnProperty):
+            - Defining a property may override the live mapping.
+        * runtime/Arguments.h:
+        (Arguments):
+
+2012-02-22  Gavin Barraclough  <barraclough@apple.com>
+
+        Fix Object.freeze for non-final objects.
+        https://bugs.webkit.org/show_bug.cgi?id=79286
+
+        Reviewed by Oliver Hunt.
+
+        For vanilla objects we implement this with a single transition, for objects
+        with special properties we should just follow the spec defined algorithm.
+
+        * runtime/JSArray.cpp:
+        (JSC::SparseArrayValueMap::put):
+            - this does need to handle inextensible objects.
+        * runtime/ObjectConstructor.cpp:
+        (JSC::objectConstructorSeal):
+        (JSC::objectConstructorFreeze):
+            - Implement spec defined algorithm for non-final objects.
+        * runtime/Structure.cpp:
+        (JSC::Structure::Structure):
+        (JSC::Structure::freezeTransition):
+            - freeze should set m_hasReadOnlyOrGetterSetterPropertiesExcludingProto.
+        * runtime/Structure.h:
+        (JSC::Structure::hasReadOnlyOrGetterSetterPropertiesExcludingProto):
+        (JSC::Structure::setHasGetterSetterProperties):
+        (JSC::Structure::setContainsReadOnlyProperties):
+        (Structure):
+            - renamed m_hasReadOnlyOrGetterSetterPropertiesExcludingProto.
+
+2012-02-22  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Allocations from CopiedBlocks should always be 8-byte aligned
+        https://bugs.webkit.org/show_bug.cgi?id=79271
+
+        Reviewed by Geoffrey Garen.
+
+        * heap/CopiedAllocator.h:
+        (JSC::CopiedAllocator::allocate):
+        * heap/CopiedBlock.h: Changed to add padding so that the start of the payload is always 
+        guaranteed to be 8 byte aligned on both 64- and 32-bit platforms.
+        (CopiedBlock):
+        * heap/CopiedSpace.cpp: Changed all assertions of isPointerAligned to is8ByteAligned.
+        (JSC::CopiedSpace::tryAllocateOversize):
+        (JSC::CopiedSpace::getFreshBlock):
+        * heap/CopiedSpaceInlineMethods.h:
+        (JSC::CopiedSpace::allocateFromBlock):
+        * runtime/JSArray.h:
+        (ArrayStorage): Added padding for ArrayStorage to make sure that it is always 8 byte 
+        aligned on both 64- and 32-bit platforms.
+        * wtf/StdLibExtras.h:
+        (WTF::is8ByteAligned): Added new utility function that functions similarly to the 
+        way isPointerAligned does, but it just always checks for 8 byte alignment.
+        (WTF):
+
+2012-02-22  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r108456.
+        http://trac.webkit.org/changeset/108456
+        https://bugs.webkit.org/show_bug.cgi?id=79223
+
+        Broke fast/regex/pcre-test-4.html and cannot find anyone on
+        IRC (Requested by zherczeg on #webkit).
+
+        * yarr/YarrJIT.cpp:
+        (JSC::Yarr::YarrGenerator::backtrackPatternCharacterGreedy):
+
+2012-02-22  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r108468.
+        http://trac.webkit.org/changeset/108468
+        https://bugs.webkit.org/show_bug.cgi?id=79219
+
+        Broke Chromium Win release build (Requested by bashi on
+        #webkit).
+
+        * wtf/Platform.h:
+
+2012-02-22  Kenichi Ishibashi  <bashi@chromium.org>
+
+        Adding WebSocket per-frame DEFLATE extension
+        https://bugs.webkit.org/show_bug.cgi?id=77522
+
+        Added USE(ZLIB) flag.
+
+        Reviewed by Kent Tamura.
+
+        * wtf/Platform.h:
+
+2012-02-22  Hojong Han  <hojong.han@samsung.com>
+
+        Short circuit fixed for a 16 bt pattern character and an 8 bit string.
+        https://bugs.webkit.org/show_bug.cgi?id=75602
+
+        Reviewed by Gavin Barraclough.
+
+        * yarr/YarrJIT.cpp:
+        (JSC::Yarr::YarrGenerator::backtrackPatternCharacterGreedy):
+
+2012-02-21  Filip Pizlo  <fpizlo@apple.com>
+
+        Build fix for systems with case sensitive disks.
+
+        * llint/LLIntOfflineAsmConfig.h:
+
+2012-02-21  Filip Pizlo  <fpizlo@apple.com>
+
+        JSC should be a triple-tier VM
+        https://bugs.webkit.org/show_bug.cgi?id=75812
+        <rdar://problem/10079694>
+
+        Reviewed by Gavin Barraclough.
+        
+        Implemented an interpreter that uses the JIT's calling convention. This
+        interpreter is called LLInt, or the Low Level Interpreter. JSC will now
+        will start by executing code in LLInt and will only tier up to the old
+        JIT after the code is proven hot.
+        
+        LLInt is written in a modified form of our macro assembly. This new macro
+        assembly is compiled by an offline assembler (see offlineasm), which
+        implements many modern conveniences such as a Turing-complete CPS-based
+        macro language and direct access to relevant C++ type information
+        (basically offsets of fields and sizes of structs/classes).
+        
+        Code executing in LLInt appears to the rest of the JSC world "as if" it
+        were executing in the old JIT. Hence, things like exception handling and
+        cross-execution-engine calls just work and require pretty much no
+        additional overhead.
+        
+        This interpreter is 2-2.5x faster than our old interpreter on SunSpider,
+        V8, and Kraken. With triple-tiering turned on, we're neutral on SunSpider,
+        V8, and Kraken, but appear to get a double-digit improvement on real-world
+        websites due to a huge reduction in the amount of JIT'ing.
+        
+        * CMakeLists.txt:
+        * GNUmakefile.am:
+        * GNUmakefile.list.am:
+        * JavaScriptCore.pri:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreCommon.vsprops:
+        * JavaScriptCore.vcproj/JavaScriptCore/copy-files.cmd:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * Target.pri:
+        * assembler/LinkBuffer.h:
+        * assembler/MacroAssemblerCodeRef.h:
+        (MacroAssemblerCodePtr):
+        (JSC::MacroAssemblerCodePtr::createFromExecutableAddress):
+        * bytecode/BytecodeConventions.h: Added.
+        * bytecode/CallLinkStatus.cpp:
+        (JSC::CallLinkStatus::computeFromLLInt):
+        (JSC):
+        (JSC::CallLinkStatus::computeFor):
+        * bytecode/CallLinkStatus.h:
+        (JSC::CallLinkStatus::isSet):
+        (JSC::CallLinkStatus::operator!):
+        (CallLinkStatus):
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dump):
+        (JSC::CodeBlock::CodeBlock):
+        (JSC::CodeBlock::~CodeBlock):
+        (JSC::CodeBlock::finalizeUnconditionally):
+        (JSC::CodeBlock::stronglyVisitStrongReferences):
+        (JSC):
+        (JSC::CodeBlock::unlinkCalls):
+        (JSC::CodeBlock::unlinkIncomingCalls):
+        (JSC::CodeBlock::bytecodeOffset):
+        (JSC::ProgramCodeBlock::jettison):
+        (JSC::EvalCodeBlock::jettison):
+        (JSC::FunctionCodeBlock::jettison):
+        (JSC::ProgramCodeBlock::jitCompileImpl):
+        (JSC::EvalCodeBlock::jitCompileImpl):
+        (JSC::FunctionCodeBlock::jitCompileImpl):
+        * bytecode/CodeBlock.h:
+        (JSC):
+        (CodeBlock):
+        (JSC::CodeBlock::baselineVersion):
+        (JSC::CodeBlock::linkIncomingCall):
+        (JSC::CodeBlock::bytecodeOffset):
+        (JSC::CodeBlock::jitCompile):
+        (JSC::CodeBlock::hasOptimizedReplacement):
+        (JSC::CodeBlock::addPropertyAccessInstruction):
+        (JSC::CodeBlock::addGlobalResolveInstruction):
+        (JSC::CodeBlock::addLLIntCallLinkInfo):
+        (JSC::CodeBlock::addGlobalResolveInfo):
+        (JSC::CodeBlock::numberOfMethodCallLinkInfos):
+        (JSC::CodeBlock::valueProfilePredictionForBytecodeOffset):
+        (JSC::CodeBlock::likelyToTakeSlowCase):
+        (JSC::CodeBlock::couldTakeSlowCase):
+        (JSC::CodeBlock::likelyToTakeSpecialFastCase):
+        (JSC::CodeBlock::likelyToTakeDeepestSlowCase):
+        (JSC::CodeBlock::likelyToTakeAnySlowCase):
+        (JSC::CodeBlock::addFrequentExitSite):
+        (JSC::CodeBlock::dontJITAnytimeSoon):
+        (JSC::CodeBlock::jitAfterWarmUp):
+        (JSC::CodeBlock::jitSoon):
+        (JSC::CodeBlock::llintExecuteCounter):
+        (ProgramCodeBlock):
+        (EvalCodeBlock):
+        (FunctionCodeBlock):
+        * bytecode/GetByIdStatus.cpp:
+        (JSC::GetByIdStatus::computeFromLLInt):
+        (JSC):
+        (JSC::GetByIdStatus::computeFor):
+        * bytecode/GetByIdStatus.h:
+        (JSC::GetByIdStatus::GetByIdStatus):
+        (JSC::GetByIdStatus::wasSeenInJIT):
+        (GetByIdStatus):
+        * bytecode/Instruction.h:
+        (JSC):
+        (JSC::Instruction::Instruction):
+        (Instruction):
+        * bytecode/LLIntCallLinkInfo.h: Added.
+        (JSC):
+        (JSC::LLIntCallLinkInfo::LLIntCallLinkInfo):
+        (LLIntCallLinkInfo):
+        (JSC::LLIntCallLinkInfo::~LLIntCallLinkInfo):
+        (JSC::LLIntCallLinkInfo::isLinked):
+        (JSC::LLIntCallLinkInfo::unlink):
+        * bytecode/MethodCallLinkStatus.cpp:
+        (JSC::MethodCallLinkStatus::computeFor):
+        * bytecode/Opcode.cpp:
+        (JSC):
+        * bytecode/Opcode.h:
+        (JSC):
+        (JSC::padOpcodeName):
+        * bytecode/PutByIdStatus.cpp:
+        (JSC::PutByIdStatus::computeFromLLInt):
+        (JSC):
+        (JSC::PutByIdStatus::computeFor):
+        * bytecode/PutByIdStatus.h:
+        (PutByIdStatus):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitResolve):
+        (JSC::BytecodeGenerator::emitResolveWithBase):
+        (JSC::BytecodeGenerator::emitGetById):
+        (JSC::BytecodeGenerator::emitPutById):
+        (JSC::BytecodeGenerator::emitDirectPutById):
+        (JSC::BytecodeGenerator::emitCall):
+        (JSC::BytecodeGenerator::emitConstruct):
+        (JSC::BytecodeGenerator::emitCatch):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::getPredictionWithoutOSRExit):
+        (JSC::DFG::ByteCodeParser::handleInlining):
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * dfg/DFGCapabilities.h:
+        (JSC::DFG::canCompileOpcode):
+        * dfg/DFGOSRExitCompiler.cpp:
+        * dfg/DFGOperations.cpp:
+        * heap/Heap.h:
+        (JSC):
+        (JSC::Heap::firstAllocatorWithoutDestructors):
+        (Heap):
+        * heap/MarkStack.cpp:
+        (JSC::visitChildren):
+        * heap/MarkedAllocator.h:
+        (JSC):
+        (MarkedAllocator):
+        * heap/MarkedSpace.h:
+        (JSC):
+        (MarkedSpace):
+        (JSC::MarkedSpace::firstAllocator):
+        * interpreter/CallFrame.cpp:
+        (JSC):
+        (JSC::CallFrame::bytecodeOffsetForNonDFGCode):
+        (JSC::CallFrame::setBytecodeOffsetForNonDFGCode):
+        (JSC::CallFrame::currentVPC):
+        (JSC::CallFrame::setCurrentVPC):
+        (JSC::CallFrame::trueCallerFrame):
+        * interpreter/CallFrame.h:
+        (JSC::ExecState::hasReturnPC):
+        (JSC::ExecState::clearReturnPC):
+        (ExecState):
+        (JSC::ExecState::bytecodeOffsetForNonDFGCode):
+        (JSC::ExecState::currentVPC):
+        (JSC::ExecState::setCurrentVPC):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::Interpreter):
+        (JSC::Interpreter::~Interpreter):
+        (JSC):
+        (JSC::Interpreter::initialize):
+        (JSC::Interpreter::isOpcode):
+        (JSC::Interpreter::unwindCallFrame):
+        (JSC::getCallerInfo):
+        (JSC::Interpreter::privateExecute):
+        (JSC::Interpreter::retrieveLastCaller):
+        * interpreter/Interpreter.h:
+        (JSC):
+        (Interpreter):
+        (JSC::Interpreter::getOpcode):
+        (JSC::Interpreter::getOpcodeID):
+        (JSC::Interpreter::classicEnabled):
+        * interpreter/RegisterFile.h:
+        (JSC):
+        (RegisterFile):
+        * jit/ExecutableAllocator.h:
+        (JSC):
+        * jit/HostCallReturnValue.cpp: Added.
+        (JSC):
+        (JSC::getHostCallReturnValueWithExecState):
+        * jit/HostCallReturnValue.h: Added.
+        (JSC):
+        (JSC::initializeHostCallReturnValue):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        (JSC::JIT::privateCompileSlowCases):
+        (JSC::JIT::privateCompile):
+        * jit/JITCode.h:
+        (JSC::JITCode::isOptimizingJIT):
+        (JITCode):
+        (JSC::JITCode::isBaselineCode):
+        (JSC::JITCode::JITCode):
+        * jit/JITDriver.h:
+        (JSC::jitCompileIfAppropriate):
+        (JSC::jitCompileFunctionIfAppropriate):
+        * jit/JITExceptions.cpp:
+        (JSC::jitThrow):
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::updateTopCallFrame):
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        (JSC):
+        * jit/JITStubs.h:
+        (JSC):
+        * jit/JSInterfaceJIT.h:
+        * llint: Added.
+        * llint/LLIntCommon.h: Added.
+        * llint/LLIntData.cpp: Added.
+        (LLInt):
+        (JSC::LLInt::Data::Data):
+        (JSC::LLInt::Data::performAssertions):
+        (JSC::LLInt::Data::~Data):
+        * llint/LLIntData.h: Added.
+        (JSC):
+        (LLInt):
+        (Data):
+        (JSC::LLInt::Data::exceptionInstructions):
+        (JSC::LLInt::Data::opcodeMap):
+        (JSC::LLInt::Data::performAssertions):
+        * llint/LLIntEntrypoints.cpp: Added.
+        (LLInt):
+        (JSC::LLInt::getFunctionEntrypoint):
+        (JSC::LLInt::getEvalEntrypoint):
+        (JSC::LLInt::getProgramEntrypoint):
+        * llint/LLIntEntrypoints.h: Added.
+        (JSC):
+        (LLInt):
+        (JSC::LLInt::getEntrypoint):
+        * llint/LLIntExceptions.cpp: Added.
+        (LLInt):
+        (JSC::LLInt::interpreterThrowInCaller):
+        (JSC::LLInt::returnToThrowForThrownException):
+        (JSC::LLInt::returnToThrow):
+        (JSC::LLInt::callToThrow):
+        * llint/LLIntExceptions.h: Added.
+        (JSC):
+        (LLInt):
+        * llint/LLIntOfflineAsmConfig.h: Added.
+        * llint/LLIntOffsetsExtractor.cpp: Added.
+        (JSC):
+        (LLIntOffsetsExtractor):
+        (JSC::LLIntOffsetsExtractor::dummy):
+        (main):
+        * llint/LLIntSlowPaths.cpp: Added.
+        (LLInt):
+        (JSC::LLInt::llint_trace_operand):
+        (JSC::LLInt::llint_trace_value):
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
+        (JSC::LLInt::traceFunctionPrologue):
+        (JSC::LLInt::shouldJIT):
+        (JSC::LLInt::entryOSR):
+        (JSC::LLInt::resolveGlobal):
+        (JSC::LLInt::getByVal):
+        (JSC::LLInt::handleHostCall):
+        (JSC::LLInt::setUpCall):
+        (JSC::LLInt::genericCall):
+        * llint/LLIntSlowPaths.h: Added.
+        (JSC):
+        (LLInt):
+        * llint/LLIntThunks.cpp: Added.
+        (LLInt):
+        (JSC::LLInt::generateThunkWithJumpTo):
+        (JSC::LLInt::functionForCallEntryThunkGenerator):
+        (JSC::LLInt::functionForConstructEntryThunkGenerator):
+        (JSC::LLInt::functionForCallArityCheckThunkGenerator):
+        (JSC::LLInt::functionForConstructArityCheckThunkGenerator):
+        (JSC::LLInt::evalEntryThunkGenerator):
+        (JSC::LLInt::programEntryThunkGenerator):
+        * llint/LLIntThunks.h: Added.
+        (JSC):
+        (LLInt):
+        * llint/LowLevelInterpreter.asm: Added.
+        * llint/LowLevelInterpreter.cpp: Added.
+        * llint/LowLevelInterpreter.h: Added.
+        * offlineasm: Added.
+        * offlineasm/armv7.rb: Added.
+        * offlineasm/asm.rb: Added.
+        * offlineasm/ast.rb: Added.
+        * offlineasm/backends.rb: Added.
+        * offlineasm/generate_offset_extractor.rb: Added.
+        * offlineasm/instructions.rb: Added.
+        * offlineasm/offset_extractor_constants.rb: Added.
+        * offlineasm/offsets.rb: Added.
+        * offlineasm/opt.rb: Added.
+        * offlineasm/parser.rb: Added.
+        * offlineasm/registers.rb: Added.
+        * offlineasm/self_hash.rb: Added.
+        * offlineasm/settings.rb: Added.
+        * offlineasm/transform.rb: Added.
+        * offlineasm/x86.rb: Added.
+        * runtime/CodeSpecializationKind.h: Added.
+        (JSC):
+        * runtime/CommonSlowPaths.h:
+        (JSC::CommonSlowPaths::arityCheckFor):
+        (CommonSlowPaths):
+        * runtime/Executable.cpp:
+        (JSC::jettisonCodeBlock):
+        (JSC):
+        (JSC::EvalExecutable::jitCompile):
+        (JSC::samplingDescription):
+        (JSC::EvalExecutable::compileInternal):
+        (JSC::ProgramExecutable::jitCompile):
+        (JSC::ProgramExecutable::compileInternal):
+        (JSC::FunctionExecutable::baselineCodeBlockFor):
+        (JSC::FunctionExecutable::jitCompileForCall):
+        (JSC::FunctionExecutable::jitCompileForConstruct):
+        (JSC::FunctionExecutable::compileForCallInternal):
+        (JSC::FunctionExecutable::compileForConstructInternal):
+        * runtime/Executable.h:
+        (JSC):
+        (EvalExecutable):
+        (ProgramExecutable):
+        (FunctionExecutable):
+        (JSC::FunctionExecutable::jitCompileFor):
+        * runtime/ExecutionHarness.h: Added.
+        (JSC):
+        (JSC::prepareForExecution):
+        (JSC::prepareFunctionForExecution):
+        * runtime/JSArray.h:
+        (JSC):
+        (JSArray):
+        * runtime/JSCell.h:
+        (JSC):
+        (JSCell):
+        * runtime/JSFunction.h:
+        (JSC):
+        (JSFunction):
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::JSGlobalData):
+        * runtime/JSGlobalData.h:
+        (JSC):
+        (JSGlobalData):
+        * runtime/JSGlobalObject.h:
+        (JSC):
+        (JSGlobalObject):
+        * runtime/JSObject.h:
+        (JSC):
+        (JSObject):
+        (JSFinalObject):
+        * runtime/JSPropertyNameIterator.h:
+        (JSC):
+        (JSPropertyNameIterator):
+        * runtime/JSString.h:
+        (JSC):
+        (JSString):
+        * runtime/JSTypeInfo.h:
+        (JSC):
+        (TypeInfo):
+        * runtime/JSValue.cpp:
+        (JSC::JSValue::description):
+        * runtime/JSValue.h:
+        (LLInt):
+        (JSValue):
+        * runtime/JSVariableObject.h:
+        (JSC):
+        (JSVariableObject):
+        * runtime/Options.cpp:
+        (Options):
+        (JSC::Options::initializeOptions):
+        * runtime/Options.h:
+        (Options):
+        * runtime/ScopeChain.h:
+        (JSC):
+        (ScopeChainNode):
+        * runtime/Structure.cpp:
+        (JSC::Structure::addPropertyTransition):
+        * runtime/Structure.h:
+        (JSC):
+        (Structure):
+        * runtime/StructureChain.h:
+        (JSC):
+        (StructureChain):
+        * wtf/InlineASM.h:
+        * wtf/Platform.h:
+        * wtf/SentinelLinkedList.h:
+        (SentinelLinkedList):
+        (WTF::SentinelLinkedList::isEmpty):
+        * wtf/text/StringImpl.h:
+        (JSC):
+        (StringImpl):
+
+2012-02-21  Oliver Hunt  <oliver@apple.com>
+
+        Unbreak double-typed arrays on ARMv7
+        https://bugs.webkit.org/show_bug.cgi?id=79177
+
+        Reviewed by Gavin Barraclough.
+
+        The existing code had completely broken address arithmetic.
+
+        * JSCTypedArrayStubs.h:
+        (JSC):
+        * assembler/MacroAssemblerARMv7.h:
+        (JSC::MacroAssemblerARMv7::storeDouble):
+        (JSC::MacroAssemblerARMv7::storeFloat):
+
+2012-02-21  Gavin Barraclough  <barraclough@apple.com>
+
+        Should be able to reconfigure a non-configurable property as read-only
+        https://bugs.webkit.org/show_bug.cgi?id=79170
+
+        Reviewed by Sam Weinig.
+
+        See ES5.1 8.12.9 10.a.i - the spec prohibits making a read-only property writable,
+        but does not inhibit making a writable property read-only.
+
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::JSGlobalData):
+        * runtime/JSGlobalData.h:
+        (JSC::JSGlobalData::setInDefineOwnProperty):
+        (JSGlobalData):
+        (JSC::JSGlobalData::isInDefineOwnProperty):
+            - Added flag, tracking whether we are in JSObject::defineOwnProperty.
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::deleteProperty):
+        (DefineOwnPropertyScope):
+            - Always allow properties to be deleted by DefineOwnProperty - assume it knows what it is doing!
+        (JSC::DefineOwnPropertyScope::DefineOwnPropertyScope):
+        (JSC::DefineOwnPropertyScope::~DefineOwnPropertyScope):
+            - Added RAII helper.
+        (JSC::JSObject::defineOwnProperty):
+            - Track on the globalData when we are in this method.
+
+2012-02-21  Oliver Hunt  <oliver@apple.com>
+
+        Make TypedArrays be available in commandline jsc
+        https://bugs.webkit.org/show_bug.cgi?id=79163
+
+        Reviewed by Gavin Barraclough.
+
+        Adds a compile time option to have jsc support a basic implementation
+        of the TypedArrays available in WebCore.  This lets us test the typed
+        array logic in the JIT witout having to build webcore.
+
+        * JSCTypedArrayStubs.h: Added.
+        (JSC):
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * jsc.cpp:
+        (GlobalObject::finishCreation):
+        (GlobalObject):
+        (GlobalObject::addConstructableFunction):
+        * runtime/JSGlobalData.h:
+        (JSGlobalData):
+
+2012-02-21  Tom Sepez  <tsepez@chromium.org>
+
+        equalIgnoringNullity() only comparing half the bytes for equality
+        https://bugs.webkit.org/show_bug.cgi?id=79135
+
+        Reviewed by Adam Barth.
+
+        * wtf/text/StringImpl.h:
+        (WTF::equalIgnoringNullity):
+
+2012-02-21  Roland Takacs  <takacs.roland@stud.u-szeged.hu>
+
+        Unnecessary preprocessor macros in MainThread.h/cpp
+        https://bugs.webkit.org/show_bug.cgi?id=79083
+
+        Removed invalid/wrong PLATFORM(WINDOWS) preprocessor macro.
+
+        * wtf/MainThread.cpp:
+        (WTF):
+        * wtf/MainThread.h:
+        (WTF):
+
+2012-02-21  Sam Weinig  <sam@webkit.org>
+
+        Attempt to fix the Snow Leopard build.
+
+        * Configurations/Base.xcconfig:
+
+2012-02-21  Sam Weinig  <sam@webkit.org>
+
+        Use libc++ when building with Clang on Mac
+        https://bugs.webkit.org/show_bug.cgi?id=78981
+
+        Reviewed by Dan Bernstein.
+
+        * Configurations/Base.xcconfig:
+
+2012-02-21  Adam Roben  <aroben@apple.com>
+
+        Roll out r108309, r108323, and r108326
+
+        They broke the 32-bit Lion build.
+
+        Original bugs is <http://webkit.org/b/75812> <rdar://problem/10079694>.
+
+        * CMakeLists.txt:
+        * GNUmakefile.am:
+        * GNUmakefile.list.am:
+        * JavaScriptCore.pri:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreCommon.vsprops:
+        * JavaScriptCore.vcproj/JavaScriptCore/copy-files.cmd:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * Target.pri:
+        * assembler/LinkBuffer.h:
+        * assembler/MacroAssemblerCodeRef.h:
+        * bytecode/BytecodeConventions.h: Removed.
+        * bytecode/CallLinkStatus.cpp:
+        * bytecode/CallLinkStatus.h:
+        * bytecode/CodeBlock.cpp:
+        * bytecode/CodeBlock.h:
+        * bytecode/GetByIdStatus.cpp:
+        * bytecode/GetByIdStatus.h:
+        * bytecode/Instruction.h:
+        * bytecode/LLIntCallLinkInfo.h: Removed.
+        * bytecode/MethodCallLinkStatus.cpp:
+        * bytecode/Opcode.cpp:
+        * bytecode/Opcode.h:
+        * bytecode/PutByIdStatus.cpp:
+        * bytecode/PutByIdStatus.h:
+        * bytecompiler/BytecodeGenerator.cpp:
+        * dfg/DFGByteCodeParser.cpp:
+        * dfg/DFGCapabilities.h:
+        * dfg/DFGOSRExitCompiler.cpp:
+        * dfg/DFGOperations.cpp:
+        * heap/Heap.h:
+        * heap/MarkStack.cpp:
+        * heap/MarkedAllocator.h:
+        * heap/MarkedSpace.h:
+        * interpreter/CallFrame.cpp:
+        * interpreter/CallFrame.h:
+        * interpreter/Interpreter.cpp:
+        * interpreter/Interpreter.h:
+        * interpreter/RegisterFile.h:
+        * jit/ExecutableAllocator.h:
+        * jit/HostCallReturnValue.cpp: Removed.
+        * jit/HostCallReturnValue.h: Removed.
+        * jit/JIT.cpp:
+        * jit/JITCode.h:
+        * jit/JITDriver.h:
+        * jit/JITExceptions.cpp:
+        * jit/JITInlineMethods.h:
+        * jit/JITStubs.cpp:
+        * jit/JITStubs.h:
+        * jit/JSInterfaceJIT.h:
+        * llint/LLIntCommon.h: Removed.
+        * llint/LLIntData.cpp: Removed.
+        * llint/LLIntData.h: Removed.
+        * llint/LLIntEntrypoints.cpp: Removed.
+        * llint/LLIntEntrypoints.h: Removed.
+        * llint/LLIntExceptions.cpp: Removed.
+        * llint/LLIntExceptions.h: Removed.
+        * llint/LLIntOfflineAsmConfig.h: Removed.
+        * llint/LLIntOffsetsExtractor.cpp: Removed.
+        * llint/LLIntSlowPaths.cpp: Removed.
+        * llint/LLIntSlowPaths.h: Removed.
+        * llint/LLIntThunks.cpp: Removed.
+        * llint/LLIntThunks.h: Removed.
+        * llint/LowLevelInterpreter.asm: Removed.
+        * llint/LowLevelInterpreter.cpp: Removed.
+        * llint/LowLevelInterpreter.h: Removed.
+        * offlineasm/armv7.rb: Removed.
+        * offlineasm/asm.rb: Removed.
+        * offlineasm/ast.rb: Removed.
+        * offlineasm/backends.rb: Removed.
+        * offlineasm/generate_offset_extractor.rb: Removed.
+        * offlineasm/instructions.rb: Removed.
+        * offlineasm/offset_extractor_constants.rb: Removed.
+        * offlineasm/offsets.rb: Removed.
+        * offlineasm/opt.rb: Removed.
+        * offlineasm/parser.rb: Removed.
+        * offlineasm/registers.rb: Removed.
+        * offlineasm/self_hash.rb: Removed.
+        * offlineasm/settings.rb: Removed.
+        * offlineasm/transform.rb: Removed.
+        * offlineasm/x86.rb: Removed.
+        * runtime/CodeSpecializationKind.h: Removed.
+        * runtime/CommonSlowPaths.h:
+        * runtime/Executable.cpp:
+        * runtime/Executable.h:
+        * runtime/ExecutionHarness.h: Removed.
+        * runtime/JSArray.h:
+        * runtime/JSCell.h:
+        * runtime/JSFunction.h:
+        * runtime/JSGlobalData.cpp:
+        * runtime/JSGlobalData.h:
+        * runtime/JSGlobalObject.h:
+        * runtime/JSObject.h:
+        * runtime/JSPropertyNameIterator.h:
+        * runtime/JSString.h:
+        * runtime/JSTypeInfo.h:
+        * runtime/JSValue.cpp:
+        * runtime/JSValue.h:
+        * runtime/JSVariableObject.h:
+        * runtime/Options.cpp:
+        * runtime/Options.h:
+        * runtime/ScopeChain.h:
+        * runtime/Structure.cpp:
+        * runtime/Structure.h:
+        * runtime/StructureChain.h:
+        * wtf/InlineASM.h:
+        * wtf/Platform.h:
+        * wtf/SentinelLinkedList.h:
+        * wtf/text/StringImpl.h:
+
+2012-02-21  Gustavo Noronha Silva  <kov@debian.org> and Bob Tracy  <rct@frus.com>
+
+        Does not build on IA64, SPARC and Alpha
+        https://bugs.webkit.org/show_bug.cgi?id=79047
+
+        Rubber-stamped by Kent Tamura.
+
+        * wtf/dtoa/utils.h: these architectures also have correct double
+        operations, so add them to the appropriate side of the check.
+
+2012-02-21  Filip Pizlo  <fpizlo@apple.com>
+
+        Fix massive crashes in all tests introduced by previous build fix, and fix non-DFG build.
+        https://bugs.webkit.org/show_bug.cgi?id=75812
+
+        Reviewed by Csaba Osztrogonác.
+
+        * dfg/DFGOperations.cpp:
+        (JSC):
+        * jit/HostCallReturnValue.h:
+        (JSC::initializeHostCallReturnValue):
+
+2012-02-21  Filip Pizlo  <fpizlo@apple.com>
+
+        Attempted build fix for ELF platforms.
+
+        * dfg/DFGOperations.cpp:
+        (JSC):
+        (JSC::getHostCallReturnValueWithExecState):
+        * jit/HostCallReturnValue.cpp:
+        (JSC):
+        * jit/HostCallReturnValue.h:
+        (JSC::initializeHostCallReturnValue):
+
+2012-02-20  Filip Pizlo  <fpizlo@apple.com>
+
+        JSC should be a triple-tier VM
+        https://bugs.webkit.org/show_bug.cgi?id=75812
+        <rdar://problem/10079694>
+
+        Reviewed by Gavin Barraclough.
+        
+        Implemented an interpreter that uses the JIT's calling convention. This
+        interpreter is called LLInt, or the Low Level Interpreter. JSC will now
+        will start by executing code in LLInt and will only tier up to the old
+        JIT after the code is proven hot.
+        
+        LLInt is written in a modified form of our macro assembly. This new macro
+        assembly is compiled by an offline assembler (see offlineasm), which
+        implements many modern conveniences such as a Turing-complete CPS-based
+        macro language and direct access to relevant C++ type information
+        (basically offsets of fields and sizes of structs/classes).
+        
+        Code executing in LLInt appears to the rest of the JSC world "as if" it
+        were executing in the old JIT. Hence, things like exception handling and
+        cross-execution-engine calls just work and require pretty much no
+        additional overhead.
+        
+        This interpreter is 2-2.5x faster than our old interpreter on SunSpider,
+        V8, and Kraken. With triple-tiering turned on, we're neutral on SunSpider,
+        V8, and Kraken, but appear to get a double-digit improvement on real-world
+        websites due to a huge reduction in the amount of JIT'ing.
+        
+        * CMakeLists.txt:
+        * GNUmakefile.am:
+        * GNUmakefile.list.am:
+        * JavaScriptCore.pri:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreCommon.vsprops:
+        * JavaScriptCore.vcproj/JavaScriptCore/copy-files.cmd:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * Target.pri:
+        * assembler/LinkBuffer.h:
+        * assembler/MacroAssemblerCodeRef.h:
+        (MacroAssemblerCodePtr):
+        (JSC::MacroAssemblerCodePtr::createFromExecutableAddress):
+        * bytecode/BytecodeConventions.h: Added.
+        * bytecode/CallLinkStatus.cpp:
+        (JSC::CallLinkStatus::computeFromLLInt):
+        (JSC):
+        (JSC::CallLinkStatus::computeFor):
+        * bytecode/CallLinkStatus.h:
+        (JSC::CallLinkStatus::isSet):
+        (JSC::CallLinkStatus::operator!):
+        (CallLinkStatus):
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dump):
+        (JSC::CodeBlock::CodeBlock):
+        (JSC::CodeBlock::~CodeBlock):
+        (JSC::CodeBlock::finalizeUnconditionally):
+        (JSC::CodeBlock::stronglyVisitStrongReferences):
+        (JSC):
+        (JSC::CodeBlock::unlinkCalls):
+        (JSC::CodeBlock::unlinkIncomingCalls):
+        (JSC::CodeBlock::bytecodeOffset):
+        (JSC::ProgramCodeBlock::jettison):
+        (JSC::EvalCodeBlock::jettison):
+        (JSC::FunctionCodeBlock::jettison):
+        (JSC::ProgramCodeBlock::jitCompileImpl):
+        (JSC::EvalCodeBlock::jitCompileImpl):
+        (JSC::FunctionCodeBlock::jitCompileImpl):
+        * bytecode/CodeBlock.h:
+        (JSC):
+        (CodeBlock):
+        (JSC::CodeBlock::baselineVersion):
+        (JSC::CodeBlock::linkIncomingCall):
+        (JSC::CodeBlock::bytecodeOffset):
+        (JSC::CodeBlock::jitCompile):
+        (JSC::CodeBlock::hasOptimizedReplacement):
+        (JSC::CodeBlock::addPropertyAccessInstruction):
+        (JSC::CodeBlock::addGlobalResolveInstruction):
+        (JSC::CodeBlock::addLLIntCallLinkInfo):
+        (JSC::CodeBlock::addGlobalResolveInfo):
+        (JSC::CodeBlock::numberOfMethodCallLinkInfos):
+        (JSC::CodeBlock::valueProfilePredictionForBytecodeOffset):
+        (JSC::CodeBlock::likelyToTakeSlowCase):
+        (JSC::CodeBlock::couldTakeSlowCase):
+        (JSC::CodeBlock::likelyToTakeSpecialFastCase):
+        (JSC::CodeBlock::likelyToTakeDeepestSlowCase):
+        (JSC::CodeBlock::likelyToTakeAnySlowCase):
+        (JSC::CodeBlock::addFrequentExitSite):
+        (JSC::CodeBlock::dontJITAnytimeSoon):
+        (JSC::CodeBlock::jitAfterWarmUp):
+        (JSC::CodeBlock::jitSoon):
+        (JSC::CodeBlock::llintExecuteCounter):
+        (ProgramCodeBlock):
+        (EvalCodeBlock):
+        (FunctionCodeBlock):
+        * bytecode/GetByIdStatus.cpp:
+        (JSC::GetByIdStatus::computeFromLLInt):
+        (JSC):
+        (JSC::GetByIdStatus::computeFor):
+        * bytecode/GetByIdStatus.h:
+        (JSC::GetByIdStatus::GetByIdStatus):
+        (JSC::GetByIdStatus::wasSeenInJIT):
+        (GetByIdStatus):
+        * bytecode/Instruction.h:
+        (JSC):
+        (JSC::Instruction::Instruction):
+        (Instruction):
+        * bytecode/LLIntCallLinkInfo.h: Added.
+        (JSC):
+        (JSC::LLIntCallLinkInfo::LLIntCallLinkInfo):
+        (LLIntCallLinkInfo):
+        (JSC::LLIntCallLinkInfo::~LLIntCallLinkInfo):
+        (JSC::LLIntCallLinkInfo::isLinked):
+        (JSC::LLIntCallLinkInfo::unlink):
+        * bytecode/MethodCallLinkStatus.cpp:
+        (JSC::MethodCallLinkStatus::computeFor):
+        * bytecode/Opcode.cpp:
+        (JSC):
+        * bytecode/Opcode.h:
+        (JSC):
+        (JSC::padOpcodeName):
+        * bytecode/PutByIdStatus.cpp:
+        (JSC::PutByIdStatus::computeFromLLInt):
+        (JSC):
+        (JSC::PutByIdStatus::computeFor):
+        * bytecode/PutByIdStatus.h:
+        (PutByIdStatus):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitResolve):
+        (JSC::BytecodeGenerator::emitResolveWithBase):
+        (JSC::BytecodeGenerator::emitGetById):
+        (JSC::BytecodeGenerator::emitPutById):
+        (JSC::BytecodeGenerator::emitDirectPutById):
+        (JSC::BytecodeGenerator::emitCall):
+        (JSC::BytecodeGenerator::emitConstruct):
+        (JSC::BytecodeGenerator::emitCatch):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::getPredictionWithoutOSRExit):
+        (JSC::DFG::ByteCodeParser::handleInlining):
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * dfg/DFGCapabilities.h:
+        (JSC::DFG::canCompileOpcode):
+        * dfg/DFGOSRExitCompiler.cpp:
+        * dfg/DFGOperations.cpp:
+        * heap/Heap.h:
+        (JSC):
+        (JSC::Heap::firstAllocatorWithoutDestructors):
+        (Heap):
+        * heap/MarkStack.cpp:
+        (JSC::visitChildren):
+        * heap/MarkedAllocator.h:
+        (JSC):
+        (MarkedAllocator):
+        * heap/MarkedSpace.h:
+        (JSC):
+        (MarkedSpace):
+        (JSC::MarkedSpace::firstAllocator):
+        * interpreter/CallFrame.cpp:
+        (JSC):
+        (JSC::CallFrame::bytecodeOffsetForNonDFGCode):
+        (JSC::CallFrame::setBytecodeOffsetForNonDFGCode):
+        (JSC::CallFrame::currentVPC):
+        (JSC::CallFrame::setCurrentVPC):
+        (JSC::CallFrame::trueCallerFrame):
+        * interpreter/CallFrame.h:
+        (JSC::ExecState::hasReturnPC):
+        (JSC::ExecState::clearReturnPC):
+        (ExecState):
+        (JSC::ExecState::bytecodeOffsetForNonDFGCode):
+        (JSC::ExecState::currentVPC):
+        (JSC::ExecState::setCurrentVPC):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::Interpreter):
+        (JSC::Interpreter::~Interpreter):
+        (JSC):
+        (JSC::Interpreter::initialize):
+        (JSC::Interpreter::isOpcode):
+        (JSC::Interpreter::unwindCallFrame):
+        (JSC::getCallerInfo):
+        (JSC::Interpreter::privateExecute):
+        (JSC::Interpreter::retrieveLastCaller):
+        * interpreter/Interpreter.h:
+        (JSC):
+        (Interpreter):
+        (JSC::Interpreter::getOpcode):
+        (JSC::Interpreter::getOpcodeID):
+        (JSC::Interpreter::classicEnabled):
+        * interpreter/RegisterFile.h:
+        (JSC):
+        (RegisterFile):
+        * jit/ExecutableAllocator.h:
+        (JSC):
+        * jit/HostCallReturnValue.cpp: Added.
+        (JSC):
+        (JSC::getHostCallReturnValueWithExecState):
+        * jit/HostCallReturnValue.h: Added.
+        (JSC):
+        (JSC::initializeHostCallReturnValue):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        (JSC::JIT::privateCompileSlowCases):
+        (JSC::JIT::privateCompile):
+        * jit/JITCode.h:
+        (JSC::JITCode::isOptimizingJIT):
+        (JITCode):
+        (JSC::JITCode::isBaselineCode):
+        (JSC::JITCode::JITCode):
+        * jit/JITDriver.h:
+        (JSC::jitCompileIfAppropriate):
+        (JSC::jitCompileFunctionIfAppropriate):
+        * jit/JITExceptions.cpp:
+        (JSC::jitThrow):
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::updateTopCallFrame):
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        (JSC):
+        * jit/JITStubs.h:
+        (JSC):
+        * jit/JSInterfaceJIT.h:
+        * llint: Added.
+        * llint/LLIntCommon.h: Added.
+        * llint/LLIntData.cpp: Added.
+        (LLInt):
+        (JSC::LLInt::Data::Data):
+        (JSC::LLInt::Data::performAssertions):
+        (JSC::LLInt::Data::~Data):
+        * llint/LLIntData.h: Added.
+        (JSC):
+        (LLInt):
+        (Data):
+        (JSC::LLInt::Data::exceptionInstructions):
+        (JSC::LLInt::Data::opcodeMap):
+        (JSC::LLInt::Data::performAssertions):
+        * llint/LLIntEntrypoints.cpp: Added.
+        (LLInt):
+        (JSC::LLInt::getFunctionEntrypoint):
+        (JSC::LLInt::getEvalEntrypoint):
+        (JSC::LLInt::getProgramEntrypoint):
+        * llint/LLIntEntrypoints.h: Added.
+        (JSC):
+        (LLInt):
+        (JSC::LLInt::getEntrypoint):
+        * llint/LLIntExceptions.cpp: Added.
+        (LLInt):
+        (JSC::LLInt::interpreterThrowInCaller):
+        (JSC::LLInt::returnToThrowForThrownException):
+        (JSC::LLInt::returnToThrow):
+        (JSC::LLInt::callToThrow):
+        * llint/LLIntExceptions.h: Added.
+        (JSC):
+        (LLInt):
+        * llint/LLIntOfflineAsmConfig.h: Added.
+        * llint/LLIntOffsetsExtractor.cpp: Added.
+        (JSC):
+        (LLIntOffsetsExtractor):
+        (JSC::LLIntOffsetsExtractor::dummy):
+        (main):
+        * llint/LLIntSlowPaths.cpp: Added.
+        (LLInt):
+        (JSC::LLInt::llint_trace_operand):
+        (JSC::LLInt::llint_trace_value):
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
+        (JSC::LLInt::traceFunctionPrologue):
+        (JSC::LLInt::shouldJIT):
+        (JSC::LLInt::entryOSR):
+        (JSC::LLInt::resolveGlobal):
+        (JSC::LLInt::getByVal):
+        (JSC::LLInt::handleHostCall):
+        (JSC::LLInt::setUpCall):
+        (JSC::LLInt::genericCall):
+        * llint/LLIntSlowPaths.h: Added.
+        (JSC):
+        (LLInt):
+        * llint/LLIntThunks.cpp: Added.
+        (LLInt):
+        (JSC::LLInt::generateThunkWithJumpTo):
+        (JSC::LLInt::functionForCallEntryThunkGenerator):
+        (JSC::LLInt::functionForConstructEntryThunkGenerator):
+        (JSC::LLInt::functionForCallArityCheckThunkGenerator):
+        (JSC::LLInt::functionForConstructArityCheckThunkGenerator):
+        (JSC::LLInt::evalEntryThunkGenerator):
+        (JSC::LLInt::programEntryThunkGenerator):
+        * llint/LLIntThunks.h: Added.
+        (JSC):
+        (LLInt):
+        * llint/LowLevelInterpreter.asm: Added.
+        * llint/LowLevelInterpreter.cpp: Added.
+        * llint/LowLevelInterpreter.h: Added.
+        * offlineasm: Added.
+        * offlineasm/armv7.rb: Added.
+        * offlineasm/asm.rb: Added.
+        * offlineasm/ast.rb: Added.
+        * offlineasm/backends.rb: Added.
+        * offlineasm/generate_offset_extractor.rb: Added.
+        * offlineasm/instructions.rb: Added.
+        * offlineasm/offset_extractor_constants.rb: Added.
+        * offlineasm/offsets.rb: Added.
+        * offlineasm/opt.rb: Added.
+        * offlineasm/parser.rb: Added.
+        * offlineasm/registers.rb: Added.
+        * offlineasm/self_hash.rb: Added.
+        * offlineasm/settings.rb: Added.
+        * offlineasm/transform.rb: Added.
+        * offlineasm/x86.rb: Added.
+        * runtime/CodeSpecializationKind.h: Added.
+        (JSC):
+        * runtime/CommonSlowPaths.h:
+        (JSC::CommonSlowPaths::arityCheckFor):
+        (CommonSlowPaths):
+        * runtime/Executable.cpp:
+        (JSC::jettisonCodeBlock):
+        (JSC):
+        (JSC::EvalExecutable::jitCompile):
+        (JSC::samplingDescription):
+        (JSC::EvalExecutable::compileInternal):
+        (JSC::ProgramExecutable::jitCompile):
+        (JSC::ProgramExecutable::compileInternal):
+        (JSC::FunctionExecutable::baselineCodeBlockFor):
+        (JSC::FunctionExecutable::jitCompileForCall):
+        (JSC::FunctionExecutable::jitCompileForConstruct):
+        (JSC::FunctionExecutable::compileForCallInternal):
+        (JSC::FunctionExecutable::compileForConstructInternal):
+        * runtime/Executable.h:
+        (JSC):
+        (EvalExecutable):
+        (ProgramExecutable):
+        (FunctionExecutable):
+        (JSC::FunctionExecutable::jitCompileFor):
+        * runtime/ExecutionHarness.h: Added.
+        (JSC):
+        (JSC::prepareForExecution):
+        (JSC::prepareFunctionForExecution):
+        * runtime/JSArray.h:
+        (JSC):
+        (JSArray):
+        * runtime/JSCell.h:
+        (JSC):
+        (JSCell):
+        * runtime/JSFunction.h:
+        (JSC):
+        (JSFunction):
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::JSGlobalData):
+        * runtime/JSGlobalData.h:
+        (JSC):
+        (JSGlobalData):
+        * runtime/JSGlobalObject.h:
+        (JSC):
+        (JSGlobalObject):
+        * runtime/JSObject.h:
+        (JSC):
+        (JSObject):
+        (JSFinalObject):
+        * runtime/JSPropertyNameIterator.h:
+        (JSC):
+        (JSPropertyNameIterator):
+        * runtime/JSString.h:
+        (JSC):
+        (JSString):
+        * runtime/JSTypeInfo.h:
+        (JSC):
+        (TypeInfo):
+        * runtime/JSValue.cpp:
+        (JSC::JSValue::description):
+        * runtime/JSValue.h:
+        (LLInt):
+        (JSValue):
+        * runtime/JSVariableObject.h:
+        (JSC):
+        (JSVariableObject):
+        * runtime/Options.cpp:
+        (Options):
+        (JSC::Options::initializeOptions):
+        * runtime/Options.h:
+        (Options):
+        * runtime/ScopeChain.h:
+        (JSC):
+        (ScopeChainNode):
+        * runtime/Structure.cpp:
+        (JSC::Structure::addPropertyTransition):
+        * runtime/Structure.h:
+        (JSC):
+        (Structure):
+        * runtime/StructureChain.h:
+        (JSC):
+        (StructureChain):
+        * wtf/InlineASM.h:
+        * wtf/Platform.h:
+        * wtf/SentinelLinkedList.h:
+        (SentinelLinkedList):
+        (WTF::SentinelLinkedList::isEmpty):
+        * wtf/text/StringImpl.h:
+        (JSC):
+        (StringImpl):
+
+2012-02-20  Filip Pizlo  <fpizlo@apple.com>
+
+        Unreviewed, rolling out http://trac.webkit.org/changeset/108291
+        It completely broke the 32-bit JIT.
+
+        * heap/CopiedAllocator.h:
+        * heap/CopiedSpace.h:
+        (CopiedSpace):
+        * heap/Heap.h:
+        (JSC::Heap::allocatorForObjectWithDestructor):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileSlowCases):
+        * jit/JIT.h:
+        (JIT):
+        * jit/JITInlineMethods.h:
+        (JSC):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_new_array):
+        * runtime/JSArray.cpp:
+        (JSC::storageSize):
+        (JSC):
+        * runtime/JSArray.h:
+        (ArrayStorage):
+        (JSArray):
+
+2012-02-20  Gavin Barraclough  <barraclough@apple.com>
+
+        [[Put]] should throw if prototype chain contains a readonly property.
+        https://bugs.webkit.org/show_bug.cgi?id=79069
+
+        Reviewed by Oliver Hunt.
+
+        Currently we only check the base of the put, not the prototype chain.
+        Fold this check in with the test for accessors.
+
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::put):
+            - Updated to test all objects in the propotype chain for readonly properties.
+        (JSC::JSObject::putDirectAccessor):
+        (JSC::putDescriptor):
+            - Record the presence of readonly properties on the structure.
+        * runtime/Structure.cpp:
+        (JSC::Structure::Structure):
+            - hasGetterSetterPropertiesExcludingProto expanded to hasReadOnlyOrGetterSetterPropertiesExcludingProto.
+        * runtime/Structure.h:
+        (JSC::Structure::hasReadOnlyOrGetterSetterPropertiesExcludingProto):
+        (JSC::Structure::setHasGetterSetterProperties):
+            - hasGetterSetterPropertiesExcludingProto expanded to hasReadOnlyOrGetterSetterPropertiesExcludingProto.
+        (JSC::Structure::setContainsReadOnlyProperties):
+            - Added.
+
+2012-02-20  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Implement fast path for op_new_array in the baseline JIT
+        https://bugs.webkit.org/show_bug.cgi?id=78612
+
+        Reviewed by Filip Pizlo.
+
+        * heap/CopiedAllocator.h:
+        (CopiedAllocator): Friended the JIT to allow access to m_currentOffset.
+        * heap/CopiedSpace.h:
+        (CopiedSpace): Friended the JIT to allow access to 
+        (JSC::CopiedSpace::allocator):
+        * heap/Heap.h:
+        (JSC::Heap::storageAllocator): Added a getter for the CopiedAllocator class so the JIT
+        can use it for simple allocation i.e. when we can just bump the offset without having to 
+        do anything else.
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileSlowCases): Added new slow case for op_new_array for when
+        we have to bail out because the fast allocation path fails for whatever reason.
+        * jit/JIT.h:
+        (JIT):
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::emitAllocateBasicStorage): Added utility function that allows objects to 
+        allocate generic backing stores. This function is used by emitAllocateJSArray.
+        (JSC):
+        (JSC::JIT::emitAllocateJSArray): Added utility function that allows the client to 
+        more easily allocate JSArrays. This function is used by emit_op_new_array and I expect 
+        it will also be used for emit_op_new_array_buffer.
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_new_array): Changed to do inline allocation of JSArrays. Still does 
+        a stub call for oversize arrays.
+        (JSC):
+        (JSC::JIT::emitSlow_op_new_array): Just bails out to a stub call if we fail in any way on 
+        the fast path.
+        * runtime/JSArray.cpp:
+        (JSC):
+        * runtime/JSArray.h: Added lots of offset functions for all the fields that we need to 
+        initialize in the JIT.
+        (ArrayStorage):
+        (JSC::ArrayStorage::lengthOffset):
+        (JSC::ArrayStorage::numValuesInVectorOffset):
+        (JSC::ArrayStorage::allocBaseOffset):
+        (JSC::ArrayStorage::vectorOffset):
+        (JSArray):
+        (JSC::JSArray::sparseValueMapOffset):
+        (JSC::JSArray::subclassDataOffset):
+        (JSC::JSArray::indexBiasOffset):
+        (JSC):
+        (JSC::JSArray::storageSize): Moved this function from being a static function in the cpp file
+        to being a static function in the JSArray class. This move allows the JIT to call it to 
+        see what size it should allocate.
+
+2012-02-20  Gavin Barraclough  <barraclough@apple.com>
+
+        DefineOwnProperty fails with numeric properties & Object.prototype
+        https://bugs.webkit.org/show_bug.cgi?id=79059
+
+        Reviewed by Oliver Hunt.
+
+        ObjectPrototype caches whether it contains any numeric properties (m_hasNoPropertiesWithUInt32Names),
+        calls to defineOwnProperty need to update this cache.
+
+        * runtime/ObjectPrototype.cpp:
+        (JSC::ObjectPrototype::put):
+        (JSC::ObjectPrototype::defineOwnProperty):
+        (JSC):
+        (JSC::ObjectPrototype::getOwnPropertySlotByIndex):
+        * runtime/ObjectPrototype.h:
+        (ObjectPrototype):
+
+2012-02-20  Pino Toscano  <pino@debian.org>
+
+        Does not build on GNU Hurd
+        https://bugs.webkit.org/show_bug.cgi?id=79045
+
+        Reviewed by Gustavo Noronha Silva.
+
+        * wtf/Platform.h: define WTF_OS_HURD.
+        * wtf/ThreadIdentifierDataPthreads.cpp: adds a band-aid fix
+        for the lack of PTHREAD_KEYS_MAX definition, with a value which
+        should not cause issues.
+
+2012-02-20  Gavin Barraclough  <barraclough@apple.com>
+
+        Unreviewed windows build fix.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2012-02-20  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Undoing accidental changes
+
+        * heap/Heap.cpp:
+        (JSC::Heap::collectAllGarbage):
+
+2012-02-20  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Factor out allocation in CopySpace into a separate CopyAllocator
+        https://bugs.webkit.org/show_bug.cgi?id=78610
+
+        Reviewed by Oliver Hunt.
+
+        Added a new CopyAllocator class, which allows us to do allocations without 
+        having to load the current offset and store the current offset in the current 
+        block. This change will allow us to easily do inline assembly in the JIT for 
+        array allocations.
+
+        * GNUmakefile.list.am:
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * heap/CopiedAllocator.h: Added.
+        (JSC):
+        (CopiedAllocator):
+        (JSC::CopiedAllocator::currentBlock):
+        (JSC::CopiedAllocator::CopiedAllocator):
+        (JSC::CopiedAllocator::allocate):
+        (JSC::CopiedAllocator::fitsInCurrentBlock):
+        (JSC::CopiedAllocator::wasLastAllocation):
+        (JSC::CopiedAllocator::startedCopying):
+        (JSC::CopiedAllocator::resetCurrentBlock):
+        (JSC::CopiedAllocator::currentUtilization):
+        (JSC::CopiedAllocator::resetLastAllocation):
+        * heap/CopiedBlock.h:
+        (CopiedBlock):
+        * heap/CopiedSpace.cpp: Moved some stuff from CopiedSpaceInlineMethods to here because we 
+        weren't really getting any benefits from having such big functions in a header file.
+        (JSC::CopiedSpace::CopiedSpace):
+        (JSC):
+        (JSC::CopiedSpace::init):
+        (JSC::CopiedSpace::tryAllocateSlowCase):
+        (JSC::CopiedSpace::tryAllocateOversize):
+        (JSC::CopiedSpace::tryReallocate):
+        (JSC::CopiedSpace::tryReallocateOversize):
+        (JSC::CopiedSpace::doneFillingBlock):
+        (JSC::CopiedSpace::doneCopying):
+        (JSC::CopiedSpace::getFreshBlock):
+        * heap/CopiedSpace.h:
+        (CopiedSpace):
+        * heap/CopiedSpaceInlineMethods.h:
+        (JSC):
+        (JSC::CopiedSpace::startedCopying):
+        (JSC::CopiedSpace::addNewBlock):
+        (JSC::CopiedSpace::allocateNewBlock):
+        (JSC::CopiedSpace::fitsInBlock):
+        (JSC::CopiedSpace::tryAllocate):
+        (JSC::CopiedSpace::allocateFromBlock):
+        * heap/Heap.cpp:
+        (JSC::Heap::collectAllGarbage):
+        * heap/HeapBlock.h:
+        (HeapBlock):
+
+2012-02-20  Patrick Gansterer  <paroga@webkit.org>
+
+        Fix Visual Studio 2010 build.
+
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::PropertyListNode::emitBytecode):
+
+2012-02-16  Gavin Barraclough  <barraclough@apple.com>
+
+        Move special __proto__ property to Object.prototype
+        https://bugs.webkit.org/show_bug.cgi?id=78409
+
+        Reviewed by Oliver Hunt.
+
+        Re-implement this as a regular accessor property.  This has three key benefits:
+        1) It makes it possible for objects to be given properties named __proto__.
+        2) Object.prototype.__proto__ can be deleted, preventing object prototypes from being changed.
+        3) This largely removes the magic used the implement __proto__, it can just be made a regular accessor property.
+
+        * parser/Parser.cpp:
+        (JSC::::parseFunctionInfo):
+            - No need to prohibit functions named __proto__.
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::reset):
+            - Add __proto__ accessor to Object.prototype.
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::globalFuncProtoGetter):
+        (JSC::globalFuncProtoSetter):
+            - Definition of the __proto__ accessor functions.
+        * runtime/JSGlobalObjectFunctions.h:
+            - Declaration of the __proto__ accessor functions.
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::put):
+            - Remove the special handling for __proto__, there is still a check to allow for a fast guard for accessors excluding __proto__.
+        (JSC::JSObject::putDirectAccessor):
+            - Track on the structure whether an object contains accessors other than one for __proto__.
+        (JSC::JSObject::defineOwnProperty):
+            - No need to prohibit definition of own properties named __proto__.
+        * runtime/JSObject.h:
+        (JSC::JSObject::inlineGetOwnPropertySlot):
+            - Remove the special handling for __proto__.
+        (JSC::JSValue::get):
+            - Remove the special handling for __proto__.
+        * runtime/JSString.cpp:
+        (JSC::JSString::getOwnPropertySlot):
+            - Remove the special handling for __proto__.
+        * runtime/JSValue.h:
+        (JSValue):
+            - Made synthesizePrototype public (this may be needed by the __proto__ getter).
+        * runtime/ObjectConstructor.cpp:
+        (JSC::objectConstructorGetPrototypeOf):
+            - Perform the security check & call prototype() directly.
+        * runtime/Structure.cpp:
+        (JSC::Structure::Structure):
+            - Added 'ExcludingProto' variant of the 'hasGetterSetterProperties' state.
+        * runtime/Structure.h:
+        (JSC::Structure::hasGetterSetterPropertiesExcludingProto):
+        (JSC::Structure::setHasGetterSetterProperties):
+        (Structure):
+            - Added 'ExcludingProto' variant of the 'hasGetterSetterProperties' state.
+
+2012-02-20  Michael Saboff  <msaboff@apple.com>
+
+        Update toLower and toUpper tests for Unicode 6.1 changes
+        https://bugs.webkit.org/show_bug.cgi?id=78923
+
+        Reviewed by Oliver Hunt.
+
+        * tests/mozilla/ecma/String/15.5.4.11-2.js: Updated the test
+        to handle a third set of results for updated Unicode 6.1
+        changes.
+        (getTestCases):
+        (TestCaseMultiExpected):
+        (writeTestCaseResultMultiExpected):
+        (getTestCaseResultMultiExpected):
+        (test):
+        (GetUnicodeValues):
+        (DecimalToHexString):
+
+2012-02-20  Andy Wingo  <wingo@igalia.com>
+
+        Remove unused features from CodeFeatures
+        https://bugs.webkit.org/show_bug.cgi?id=78804
+
+        Reviewed by Gavin Barraclough.
+
+        * parser/Nodes.h:
+        * parser/ASTBuilder.h:
+        (JSC::ClosureFeature):
+        (JSC::ASTBuilder::createFunctionBody):
+        (JSC::ASTBuilder::usesClosures):
+        Remove "ClosureFeature".  Since we track captured variables more
+        precisely, this bit doesn't do us any good.
+
+        (JSC::AssignFeature):
+        (JSC::ASTBuilder::makeAssignNode):
+        (JSC::ASTBuilder::makePrefixNode):
+        (JSC::ASTBuilder::makePostfixNode):
+        (JSC::ASTBuilder::usesAssignment):
+        Similarly, remove AssignFeature.  It is unused.
+
+2012-02-19  Carlos Garcia Campos  <cgarcia@igalia.com>
+
+        Unreviewed. Fix make distcheck issues.
+
+        * GNUmakefile.list.am: Add missing files.
+
+2012-02-18  Sam Weinig  <sam@webkit.org>
+
+        Fix style issues in DFG Phase classes
+        https://bugs.webkit.org/show_bug.cgi?id=78983
+
+        Reviewed by Ryosuke Niwa.
+
+        * dfg/DFGArithNodeFlagsInferencePhase.cpp:
+        * dfg/DFGCFAPhase.cpp:
+        * dfg/DFGCSEPhase.cpp:
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        * dfg/DFGVirtualRegisterAllocationPhase.cpp:
+        Add a space before the colon in class declarations.
+
+2012-02-18  Filip Pizlo  <fpizlo@apple.com>
+
+        Attempt to fix Windows build.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2012-02-18  Sam Weinig  <sam@webkit.org>
+
+        Fix the libc++ build.
+
+        Reviewed by Anders Carlsson.
+
+        * heap/Weak.h:
+        Libc++'s nullptr emulation does not allow default construction
+        of the nullptr_t type. Work around this with the arguably clearer
+        just returning nullptr.
+
+2012-02-18  Filip Pizlo  <fpizlo@apple.com>
+
+        DFGPropagator.cpp has too many things
+        https://bugs.webkit.org/show_bug.cgi?id=78956
+
+        Reviewed by Oliver Hunt.
+        
+        Added the notion of a DFG::Phase. Removed DFG::Propagator, and took its
+        various things and put them into separate files. These new phases follow
+        the naming convention "DFG<name>Phase" where <name> is a noun. They are
+        called via functions of the form "perform<name>".
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * Target.pri:
+        * dfg/DFGArithNodeFlagsInferencePhase.cpp: Added.
+        (DFG):
+        (JSC::DFG::performArithNodeFlagsInference):
+        * dfg/DFGArithNodeFlagsInferencePhase.h: Added.
+        (DFG):
+        * dfg/DFGCFAPhase.cpp: Added.
+        (DFG):
+        (JSC::DFG::performCFA):
+        * dfg/DFGCFAPhase.h: Added.
+        (DFG):
+        * dfg/DFGCSEPhase.cpp: Added.
+        (DFG):
+        (JSC::DFG::performCSE):
+        * dfg/DFGCSEPhase.h: Added.
+        (DFG):
+        * dfg/DFGDriver.cpp:
+        (JSC::DFG::compile):
+        * dfg/DFGPhase.cpp: Added.
+        (DFG):
+        (JSC::DFG::Phase::beginPhase):
+        (JSC::DFG::Phase::endPhase):
+        * dfg/DFGPhase.h: Added.
+        (DFG):
+        (Phase):
+        (JSC::DFG::Phase::Phase):
+        (JSC::DFG::Phase::~Phase):
+        (JSC::DFG::Phase::globalData):
+        (JSC::DFG::Phase::codeBlock):
+        (JSC::DFG::Phase::profiledBlock):
+        (JSC::DFG::Phase::beginPhase):
+        (JSC::DFG::Phase::endPhase):
+        (JSC::DFG::runPhase):
+        * dfg/DFGPredictionPropagationPhase.cpp: Added.
+        (DFG):
+        (JSC::DFG::performPredictionPropagation):
+        * dfg/DFGPredictionPropagationPhase.h: Added.
+        (DFG):
+        * dfg/DFGPropagator.cpp: Removed.
+        * dfg/DFGPropagator.h: Removed.
+        * dfg/DFGVirtualRegisterAllocationPhase.cpp: Added.
+        (DFG):
+        (JSC::DFG::performVirtualRegisterAllocation):
+        * dfg/DFGVirtualRegisterAllocationPhase.h: Added.
+        (DFG):
+
+2012-02-17  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG::Graph should have references to JSGlobalData, the CodeBlock being compiled, and
+        the CodeBlock that was used for profiling
+        https://bugs.webkit.org/show_bug.cgi?id=78954
+
+        Reviewed by Gavin Barraclough.
+
+        * bytecode/CodeBlock.h:
+        (JSC::baselineCodeBlockForOriginAndBaselineCodeBlock):
+        (JSC):
+        * dfg/DFGAbstractState.cpp:
+        (JSC::DFG::AbstractState::AbstractState):
+        (JSC::DFG::AbstractState::execute):
+        * dfg/DFGAbstractState.h:
+        * dfg/DFGAssemblyHelpers.h:
+        (AssemblyHelpers):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::ByteCodeParser):
+        (JSC::DFG::ByteCodeParser::handleCall):
+        (JSC::DFG::parse):
+        * dfg/DFGByteCodeParser.h:
+        (DFG):
+        * dfg/DFGDriver.cpp:
+        (JSC::DFG::compile):
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::dump):
+        (JSC::DFG::Graph::predictArgumentTypes):
+        * dfg/DFGGraph.h:
+        (JSC::DFG::Graph::Graph):
+        (Graph):
+        (JSC::DFG::Graph::getJSConstantPrediction):
+        (JSC::DFG::Graph::addShouldSpeculateInteger):
+        (JSC::DFG::Graph::isInt32Constant):
+        (JSC::DFG::Graph::isDoubleConstant):
+        (JSC::DFG::Graph::isNumberConstant):
+        (JSC::DFG::Graph::isBooleanConstant):
+        (JSC::DFG::Graph::isFunctionConstant):
+        (JSC::DFG::Graph::valueOfJSConstant):
+        (JSC::DFG::Graph::valueOfInt32Constant):
+        (JSC::DFG::Graph::valueOfNumberConstant):
+        (JSC::DFG::Graph::valueOfBooleanConstant):
+        (JSC::DFG::Graph::valueOfFunctionConstant):
+        (JSC::DFG::Graph::baselineCodeBlockFor):
+        (JSC::DFG::Graph::valueProfileFor):
+        (JSC::DFG::Graph::addImmediateShouldSpeculateInteger):
+        * dfg/DFGJITCompiler.h:
+        (JSC::DFG::JITCompiler::JITCompiler):
+        (JITCompiler):
+        * dfg/DFGOSRExit.cpp:
+        (JSC::DFG::OSRExit::considerAddingAsFrequentExitSiteSlow):
+        * dfg/DFGPropagator.cpp:
+        (JSC::DFG::Propagator::Propagator):
+        (JSC::DFG::Propagator::isNotNegZero):
+        (JSC::DFG::Propagator::isNotZero):
+        (JSC::DFG::Propagator::propagateNodePredictions):
+        (JSC::DFG::Propagator::doRoundOfDoubleVoting):
+        (JSC::DFG::Propagator::globalCFA):
+        (JSC::DFG::propagate):
+        * dfg/DFGPropagator.h:
+        (DFG):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::computeValueRecoveryFor):
+        (JSC::DFG::SpeculativeJIT::compileAdd):
+        (JSC::DFG::SpeculativeJIT::compileArithSub):
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::isConstant):
+        (JSC::DFG::SpeculativeJIT::isJSConstant):
+        (JSC::DFG::SpeculativeJIT::isInt32Constant):
+        (JSC::DFG::SpeculativeJIT::isDoubleConstant):
+        (JSC::DFG::SpeculativeJIT::isNumberConstant):
+        (JSC::DFG::SpeculativeJIT::isBooleanConstant):
+        (JSC::DFG::SpeculativeJIT::isFunctionConstant):
+        (JSC::DFG::SpeculativeJIT::valueOfInt32Constant):
+        (JSC::DFG::SpeculativeJIT::valueOfNumberConstant):
+        (JSC::DFG::SpeculativeJIT::valueOfJSConstant):
+        (JSC::DFG::SpeculativeJIT::valueOfBooleanConstant):
+        (JSC::DFG::SpeculativeJIT::valueOfFunctionConstant):
+        (JSC::DFG::SpeculativeJIT::speculationCheck):
+        (JSC::DFG::SpeculativeJIT::SpeculativeJIT):
+
+2012-02-17  Ahmad Sharif  <asharif.tools@gmail.com>
+
+        There is a warning in memset in glibc that gets triggered through a
+        warndecl when the fill-value of memset is a non-zero constant and the
+        size is zero. This warning is enabled when building with
+        -D_FORTIFY_SOURCE=2. This patch fixes the warning.
+
+        https://bugs.webkit.org/show_bug.cgi?id=78513
+
+        Reviewed by Alexey Proskuryakov
+
+        * wtf/Vector.h:
+
+2012-02-17  Kalev Lember  <kalevlember@gmail.com>
+
+        Remove unused parameters from WTF threading API
+        https://bugs.webkit.org/show_bug.cgi?id=78389
+
+        Reviewed by Adam Roben.
+
+        waitForThreadCompletion() had an out param 'void **result' to get the
+        'void *' returned by ThreadFunction. However, the implementation in
+        ThreadingWin.cpp ignored the out param, not filling it in. This had
+        led to a situation where none of the client code made use of the param
+        and just ignored it.
+
+        To clean this up, the patch changes the signature of ThreadFunction to
+        return void instead of void* and drops the the unused 'void **result'
+        parameter from waitForThreadCompletion. Also, all client code is
+        updated for the API change.
+
+        As mentioned in https://bugs.webkit.org/show_bug.cgi?id=78389 , even
+        though the change only affects internal API, Safari is using it
+        directly and we'll need to keep the old versions around for ABI
+        compatibility. For this, the patch adds compatibility wrappers with
+        the old ABI.
+
+        * JavaScriptCore.order:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * bytecode/SamplingTool.cpp:
+        (JSC::SamplingThread::threadStartFunc):
+        (JSC::SamplingThread::stop):
+        * bytecode/SamplingTool.h:
+        (SamplingThread):
+        * heap/Heap.cpp:
+        (JSC::Heap::~Heap):
+        (JSC::Heap::blockFreeingThreadStartFunc):
+        * heap/Heap.h:
+        * heap/MarkStack.cpp:
+        (JSC::MarkStackThreadSharedData::markingThreadStartFunc):
+        (JSC::MarkStackThreadSharedData::~MarkStackThreadSharedData):
+        * heap/MarkStack.h:
+        (MarkStackThreadSharedData):
+        * wtf/ParallelJobsGeneric.cpp:
+        (WTF::ParallelEnvironment::ThreadPrivate::workerThread):
+        * wtf/ParallelJobsGeneric.h:
+        (ThreadPrivate):
+        * wtf/ThreadFunctionInvocation.h: Update the signature of
+        ThreadFunction.
+        (WTF):
+        * wtf/Threading.cpp:
+        (WTF::threadEntryPoint): Update for ThreadFunction signature change.
+        (WTF):
+        (WTF::ThreadFunctionWithReturnValueInvocation::ThreadFunctionWithReturnValueInvocation):
+        ABI compatibility function for Safari.
+        (ThreadFunctionWithReturnValueInvocation): Ditto.
+        (WTF::compatEntryPoint): Ditto.
+        (WTF::createThread): Ditto.
+        (WTF::waitForThreadCompletion): Ditto.
+        * wtf/Threading.h: Update the signature of ThreadFunction and
+        waitForThreadCompletion.
+        (WTF):
+        * wtf/ThreadingPthreads.cpp: Implement the new API.
+        (WTF::wtfThreadEntryPoint):
+        (WTF):
+        (WTF::createThreadInternal):
+        (WTF::waitForThreadCompletion):
+        * wtf/ThreadingWin.cpp: Implement the new API.
+        (WTF::wtfThreadEntryPoint):
+        (WTF::waitForThreadCompletion):
+
+2012-02-16  Oliver Hunt  <oliver@apple.com>
+
+        Implement Error.stack
+        https://bugs.webkit.org/show_bug.cgi?id=66994
+
+        Reviewed by Gavin Barraclough.
+
+        Implement support for stack traces on exception objects.  This is a rewrite
+        of the core portion of the last stack walking logic, but the mechanical work
+        of adding the information to an exception comes from the original work by
+        Juan Carlos Montemayor Elosua.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::getCallerInfo):
+        (JSC):
+        (JSC::getSourceURLFromCallFrame):
+        (JSC::getStackFrameCodeType):
+        (JSC::Interpreter::getStackTrace):
+        (JSC::Interpreter::throwException):
+        (JSC::Interpreter::privateExecute):
+        * interpreter/Interpreter.h:
+        (JSC):
+        (StackFrame):
+        (JSC::StackFrame::toString):
+        (Interpreter):
+        * jsc.cpp:
+        (GlobalObject::finishCreation):
+        (functionJSCStack):
+        * parser/Nodes.h:
+        (JSC::FunctionBodyNode::setInferredName):
+        * parser/Parser.h:
+        (JSC::::parse):
+        * runtime/CommonIdentifiers.h:
+        * runtime/Error.cpp:
+        (JSC::addErrorInfo):
+        * runtime/Error.h:
+        (JSC):
+
+2012-02-17  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Rename Bump* to Copy*
+        https://bugs.webkit.org/show_bug.cgi?id=78573
+
+        Reviewed by Geoffrey Garen.
+
+        Renamed anything with "Bump" in the name to have "Copied" instead.
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * Target.pri:
+        * heap/BumpBlock.h: Removed.
+        * heap/BumpSpace.cpp: Removed.
+        * heap/BumpSpace.h: Removed.
+        * heap/BumpSpaceInlineMethods.h: Removed.
+        * heap/ConservativeRoots.cpp:
+        (JSC::ConservativeRoots::ConservativeRoots):
+        (JSC::ConservativeRoots::genericAddPointer):
+        * heap/ConservativeRoots.h:
+        (ConservativeRoots):
+        * heap/CopiedBlock.h: Added.
+        (JSC):
+        (CopiedBlock):
+        (JSC::CopiedBlock::CopiedBlock):
+        * heap/CopiedSpace.cpp: Added.
+        (JSC):
+        (JSC::CopiedSpace::tryAllocateSlowCase):
+        * heap/CopiedSpace.h: Added.
+        (JSC):
+        (CopiedSpace):
+        (JSC::CopiedSpace::isInCopyPhase):
+        (JSC::CopiedSpace::totalMemoryAllocated):
+        (JSC::CopiedSpace::totalMemoryUtilized):
+        * heap/CopiedSpaceInlineMethods.h: Added.
+        (JSC):
+        (JSC::CopiedSpace::CopiedSpace):
+        (JSC::CopiedSpace::init):
+        (JSC::CopiedSpace::contains):
+        (JSC::CopiedSpace::pin):
+        (JSC::CopiedSpace::startedCopying):
+        (JSC::CopiedSpace::doneCopying):
+        (JSC::CopiedSpace::doneFillingBlock):
+        (JSC::CopiedSpace::recycleBlock):
+        (JSC::CopiedSpace::getFreshBlock):
+        (JSC::CopiedSpace::borrowBlock):
+        (JSC::CopiedSpace::addNewBlock):
+        (JSC::CopiedSpace::allocateNewBlock):
+        (JSC::CopiedSpace::fitsInBlock):
+        (JSC::CopiedSpace::fitsInCurrentBlock):
+        (JSC::CopiedSpace::tryAllocate):
+        (JSC::CopiedSpace::tryAllocateOversize):
+        (JSC::CopiedSpace::allocateFromBlock):
+        (JSC::CopiedSpace::tryReallocate):
+        (JSC::CopiedSpace::tryReallocateOversize):
+        (JSC::CopiedSpace::isOversize):
+        (JSC::CopiedSpace::isPinned):
+        (JSC::CopiedSpace::oversizeBlockFor):
+        (JSC::CopiedSpace::blockFor):
+        * heap/Heap.cpp:
+        * heap/Heap.h:
+        (JSC):
+        (Heap):
+        * heap/MarkStack.cpp:
+        (JSC::MarkStackThreadSharedData::MarkStackThreadSharedData):
+        (JSC::SlotVisitor::drainFromShared):
+        (JSC::SlotVisitor::startCopying):
+        (JSC::SlotVisitor::allocateNewSpace):
+        (JSC::SlotVisitor::doneCopying):
+        * heap/MarkStack.h:
+        (MarkStackThreadSharedData):
+        * heap/SlotVisitor.h:
+        (SlotVisitor):
+        * runtime/JSArray.cpp:
+        * runtime/JSObject.cpp:
+
+2012-02-16  Yuqiang Xian  <yuqiang.xian@intel.com>
+
+        Add JSC code profiling support on Linux x86
+        https://bugs.webkit.org/show_bug.cgi?id=78871
+
+        Reviewed by Gavin Barraclough.
+
+        We don't unwind the stack for now as we cannot guarantee all the
+        libraries are compiled without -fomit-frame-pointer.
+
+        * tools/CodeProfile.cpp:
+        (JSC::CodeProfile::sample):
+        * tools/CodeProfiling.cpp:
+        (JSC):
+        (JSC::profilingTimer):
+        (JSC::CodeProfiling::begin):
+        (JSC::CodeProfiling::end):
+
+2012-02-16  Csaba Osztrogonác  <ossy@webkit.org>
+
+        Unreviewed. Rolling out r107980, because it broke 32 bit platforms.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::throwException):
+        (JSC::Interpreter::privateExecute):
+        * interpreter/Interpreter.h:
+        (JSC):
+        (Interpreter):
+        * jsc.cpp:
+        (GlobalObject::finishCreation):
+        * parser/Nodes.h:
+        (JSC::FunctionBodyNode::setInferredName):
+        * parser/Parser.h:
+        (JSC::::parse):
+        * runtime/CommonIdentifiers.h:
+        * runtime/Error.cpp:
+        (JSC::addErrorInfo):
+        * runtime/Error.h:
+        (JSC):
+
+2012-02-16  Filip Pizlo  <fpizlo@apple.com>
+
+        ENABLE_INTERPRETER should be ENABLE_CLASSIC_INTERPRETER
+        https://bugs.webkit.org/show_bug.cgi?id=78791
+
+        Rubber stamped by Oliver Hunt.
+        
+        Just a renaming, nothing more. Also renamed COMPUTED_GOTO_INTERPRETER to
+        COMPUTED_GOTO_CLASSIC_INTERPRETER.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dump):
+        (JSC::CodeBlock::stronglyVisitStrongReferences):
+        (JSC):
+        (JSC::CodeBlock::shrinkToFit):
+        * bytecode/CodeBlock.h:
+        (CodeBlock):
+        * bytecode/Instruction.h:
+        (JSC::Instruction::Instruction):
+        * bytecode/Opcode.h:
+        (JSC::padOpcodeName):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitResolve):
+        (JSC::BytecodeGenerator::emitResolveWithBase):
+        (JSC::BytecodeGenerator::emitGetById):
+        (JSC::BytecodeGenerator::emitPutById):
+        (JSC::BytecodeGenerator::emitDirectPutById):
+        * interpreter/AbstractPC.cpp:
+        (JSC::AbstractPC::AbstractPC):
+        * interpreter/AbstractPC.h:
+        (AbstractPC):
+        * interpreter/CallFrame.h:
+        (ExecState):
+        * interpreter/Interpreter.cpp:
+        (JSC):
+        (JSC::Interpreter::initialize):
+        (JSC::Interpreter::isOpcode):
+        (JSC::Interpreter::unwindCallFrame):
+        (JSC::Interpreter::execute):
+        (JSC::Interpreter::privateExecute):
+        (JSC::Interpreter::retrieveLastCaller):
+        * interpreter/Interpreter.h:
+        (JSC::Interpreter::getOpcode):
+        (JSC::Interpreter::getOpcodeID):
+        (Interpreter):
+        * jit/ExecutableAllocatorFixedVMPool.cpp:
+        (JSC::FixedVMPoolExecutableAllocator::FixedVMPoolExecutableAllocator):
+        * runtime/Executable.cpp:
+        (JSC::EvalExecutable::compileInternal):
+        (JSC::ProgramExecutable::compileInternal):
+        (JSC::FunctionExecutable::compileForCallInternal):
+        (JSC::FunctionExecutable::compileForConstructInternal):
+        * runtime/Executable.h:
+        (NativeExecutable):
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::JSGlobalData):
+        (JSC::JSGlobalData::getHostFunction):
+        * runtime/JSGlobalData.h:
+        (JSGlobalData):
+        * wtf/OSAllocatorPosix.cpp:
+        (WTF::OSAllocator::reserveAndCommit):
+        * wtf/Platform.h:
+
+2012-02-15  Geoffrey Garen  <ggaren@apple.com>
+
+        Made Weak<T> single-owner, adding PassWeak<T>
+        https://bugs.webkit.org/show_bug.cgi?id=78740
+
+        Reviewed by Sam Weinig.
+
+        This works basically the same way as OwnPtr<T> and PassOwnPtr<T>.
+
+        This clarifies the semantics of finalizers: It's ambiguous and probably
+        a bug to copy a finalizer (i.e., it's a bug to run a C++ destructor
+        twice), so I've made Weak<T> non-copyable. Anywhere we used to copy a 
+        Weak<T>, we now use PassWeak<T>.
+
+        This also makes Weak<T> HashMaps more efficient.
+
+        * API/JSClassRef.cpp:
+        (OpaqueJSClass::prototype): Use PassWeak<T> instead of set(), since 
+        set() is gone now.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj: Export!
+
+        * heap/PassWeak.h: Added.
+        (JSC):
+        (PassWeak):
+        (JSC::PassWeak::PassWeak):
+        (JSC::PassWeak::~PassWeak):
+        (JSC::PassWeak::get):
+        (JSC::::leakHandle):
+        (JSC::adoptWeak):
+        (JSC::operator==):
+        (JSC::operator!=): This is the Weak<T> version of PassOwnPtr<T>.
+
+        * heap/Weak.h:
+        (Weak):
+        (JSC::Weak::Weak):
+        (JSC::Weak::release):
+        (JSC::Weak::hashTableDeletedValue):
+        (JSC::=):
+        (JSC): Changed to be non-copyable, removing a lot of copying-related
+        APIs. Added hash traits so hash maps still work.
+
+        * jit/JITStubs.cpp:
+        (JSC::JITThunks::hostFunctionStub):
+        * runtime/RegExpCache.cpp:
+        (JSC::RegExpCache::lookupOrCreate): Use PassWeak<T>, as required by
+        our new hash map API.
+
+2012-02-16  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Fix the broken viewport tests
+        https://bugs.webkit.org/show_bug.cgi?id=78774
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * wtf/text/WTFString.cpp:
+        (WTF):
+        (WTF::toDoubleType): Template-ized to allow other functions to specify whether they
+        want to allow trailing junk or not when calling strtod.
+        (WTF::charactersToDouble):
+        (WTF::charactersToFloat):
+        (WTF::charactersToFloatIgnoringJunk): Created new version of charactersToFloat that allows 
+        trailing junk.
+        * wtf/text/WTFString.h:
+        (WTF):
+
+2012-02-16  Oliver Hunt  <oliver@apple.com>
+
+        Implement Error.stack
+        https://bugs.webkit.org/show_bug.cgi?id=66994
+
+        Reviewed by Gavin Barraclough.
+
+        Implement support for stack traces on exception objects.  This is a rewrite
+        of the core portion of the last stack walking logic, but the mechanical work
+        of adding the information to an exception comes from the original work by
+        Juan Carlos Montemayor Elosua.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::getCallerInfo):
+        (JSC):
+        (JSC::getSourceURLFromCallFrame):
+        (JSC::getStackFrameCodeType):
+        (JSC::Interpreter::getStackTrace):
+        (JSC::Interpreter::throwException):
+        (JSC::Interpreter::privateExecute):
+        * interpreter/Interpreter.h:
+        (JSC):
+        (StackFrame):
+        (JSC::StackFrame::toString):
+        (Interpreter):
+        * jsc.cpp:
+        (GlobalObject::finishCreation):
+        (functionJSCStack):
+        * parser/Nodes.h:
+        (JSC::FunctionBodyNode::setInferredName):
+        * parser/Parser.h:
+        (JSC::::parse):
+        * runtime/CommonIdentifiers.h:
+        * runtime/Error.cpp:
+        (JSC::addErrorInfo):
+        * runtime/Error.h:
+        (JSC):
+
+2012-02-15  Gavin Barraclough  <barraclough@apple.com>
+
+        Numerous trivial bugs in Object.defineProperty
+        https://bugs.webkit.org/show_bug.cgi?id=78777
+
+        Reviewed by Sam Weinig.
+
+        There are a handful of really trivial bugs, related to Object.defineProperty:
+            * Redefining an accessor with different attributes changes the attributes, but not the get/set functions!
+            * Calling an undefined setter should only throw in strict mode.
+            * When redefining an accessor to a data decriptor, if writable is not specified we should default to false.
+            * Any attempt to redefine a non-configurable property of an array as configurable should be rejected.
+            * Object.defineProperties should call toObject on 'Properties' argument, rather than throwing if it is not an object.
+            * If preventExtensions has been called on an array, subsequent assignment beyond array bounds should fail.
+            * 'isFrozen' shouldn't be checking the ReadOnly bit for accessor descriptors (we presently always keep this bit as 'false').
+            * Should be able to redefine an non-writable, non-configurable property, with the same value and attributes.
+            * Should be able to define an non-configurable accessor.
+        These are mostly all one-line changes, e.g. inverted boolean checks, masking against wrong attribute.
+
+        * runtime/JSArray.cpp:
+        (JSC::SparseArrayValueMap::put):
+            - Added ASSERT.
+            - Calling an undefined setter should only throw in strict mode.
+        (JSC::JSArray::putDescriptor):
+            - Should be able to define an non-configurable accessor.
+        (JSC::JSArray::defineOwnNumericProperty):
+            - Any attempt to redefine a non-configurable property of an array as configurable should be rejected.
+        (JSC::JSArray::putByIndexBeyondVectorLength):
+            - If preventExtensions has been called on an array, subsequent assignment beyond array bounds should fail.
+        * runtime/JSArray.h:
+        (JSArray):
+            - made enterDictionaryMode public, called from JSObject.
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::put):
+            - Calling an undefined setter should only throw in strict mode.
+        (JSC::JSObject::preventExtensions):
+            - Put array objects into dictionary mode to handle this!
+        (JSC::JSObject::defineOwnProperty):
+            - Should be able to redefine an non-writable, non-configurable property, with the same value and attributes.
+            - Redefining an accessor with different attributes changes the attributes, but not the get/set functions!
+        * runtime/ObjectConstructor.cpp:
+        (JSC::objectConstructorDefineProperties):
+            - Object.defineProperties should call toObject on 'Properties' argument, rather than throwing if it is not an object.
+        * runtime/PropertyDescriptor.cpp:
+        (JSC::PropertyDescriptor::attributesWithOverride):
+            - When redefining an accessor to a data decriptor, if writable is not specified we should default to false.
+        (JSC::PropertyDescriptor::attributesOverridingCurrent):
+            - When redefining an accessor to a data decriptor, if writable is not specified we should default to false.
+        * runtime/Structure.cpp:
+        (JSC::Structure::freezeTransition):
+            - 'freezeTransition' shouldn't be setting the ReadOnly bit for accessor descriptors (we presently always keep this bit as 'false').
+        (JSC::Structure::isFrozen):
+            - 'isFrozen' shouldn't be checking the ReadOnly bit for accessor descriptors (we presently always keep this bit as 'false').
+
+2012-02-13  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG should not check the types of arguments that are dead
+        https://bugs.webkit.org/show_bug.cgi?id=78518
+
+        Reviewed by Geoff Garen.
+        
+        The argument checks are now elided if the corresponding SetArgument is dead,
+        and the abstract value of the argument is set to bottom (None, []). This is
+        performance neutral on the benchmarks we currently track.
+
+        * dfg/DFGAbstractState.cpp:
+        (JSC::DFG::AbstractState::initialize):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::checkArgumentTypes):
+
+2012-02-15  Oliver Hunt  <oliver@apple.com>
+
+        Ensure that the DFG JIT always plants a CodeOrigin when making calls
+        https://bugs.webkit.org/show_bug.cgi?id=78763
+
+        Reviewed by Gavin Barraclough.
+
+        Make all calls plant a CodeOrigin prior to the actual
+        call.  Also clobbers the Interpreter with logic to ensure
+        that the interpreter always plants a bytecode offset.
+
+        * dfg/DFGJITCompiler.cpp:
+        (JSC::DFG::JITCompiler::link):
+        (JSC::DFG::JITCompiler::compileFunction):
+        * dfg/DFGJITCompiler.h:
+        (CallBeginToken):
+        (JSC::DFG::JITCompiler::beginJSCall):
+        (JSC::DFG::JITCompiler::beginCall):
+        * dfg/DFGRepatch.cpp:
+        (JSC::DFG::tryBuildGetByIDList):
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::appendCallWithExceptionCheck):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::emitCall):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::emitCall):
+        * interpreter/AbstractPC.cpp:
+        (JSC::AbstractPC::AbstractPC):
+        * interpreter/CallFrame.cpp:
+        (JSC::CallFrame::trueCallFrame):
+        * interpreter/CallFrame.h:
+        (JSC::ExecState::bytecodeOffsetForNonDFGCode):
+        (ExecState):
+        (JSC::ExecState::setBytecodeOffsetForNonDFGCode):
+        (JSC::ExecState::codeOriginIndexForDFG):
+
+2012-02-14  Oliver Hunt  <oliver@apple.com>
+
+        Fix Interpreter.
+
+        * runtime/Executable.cpp:
+        (JSC):
+        * runtime/Executable.h:
+        (ExecutableBase):
+
+2012-02-14  Matt Lilek  <mrl@apple.com>
+
+        Don't ENABLE_DASHBOARD_SUPPORT unconditionally on all Mac platforms
+        https://bugs.webkit.org/show_bug.cgi?id=78629
+
+        Reviewed by David Kilzer.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2012-02-14  Filip Pizlo  <fpizlo@apple.com>
+
+        Unreviewed, build fix for non-DFG platforms.
+
+        * assembler/MacroAssembler.h:
+        (MacroAssembler):
+
+2012-02-14  Filip Pizlo  <fpizlo@apple.com>
+
+        Unreviewed, fix build and configuration goof.
+
+        * assembler/MacroAssembler.h:
+        (JSC::MacroAssembler::invert):
+        * dfg/DFGCommon.h:
+
+2012-02-13  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG should be able to emit code on control flow edges
+        https://bugs.webkit.org/show_bug.cgi?id=78515
+
+        Reviewed by Gavin Barraclough.
+        
+        This gets us a few steps closer to being able to perform global register allocation,
+        by allowing us to have landing pads on control flow edges. This will let us reshuffle
+        registers if it happens to be necessary due to different reg alloc decisions in
+        differen blocks.
+        
+        This also introduces the notion of a landing pad for OSR entry, which will allow us
+        to emit code that places data into registers when we're entering into the DFG from
+        the old JIT.
+        
+        Finally, this patch introduces a verification mode that checks that the landing pads
+        are actually emitted and do actually work as advertised. When verification is disabled,
+        this has no effect on behavior.
+
+        * assembler/MacroAssembler.h:
+        (MacroAssembler):
+        (JSC::MacroAssembler::invert):
+        (JSC::MacroAssembler::isInvertible):
+        * dfg/DFGCommon.h:
+        * dfg/DFGJITCompiler.cpp:
+        (JSC::DFG::JITCompiler::compile):
+        (JSC::DFG::JITCompiler::compileFunction):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compilePeepHoleDoubleBranch):
+        (JSC::DFG::SpeculativeJIT::compilePeepHoleObjectEquality):
+        (JSC::DFG::SpeculativeJIT::compilePeepHoleIntegerBranch):
+        (JSC::DFG::SpeculativeJIT::compile):
+        (JSC::DFG::SpeculativeJIT::createOSREntries):
+        (DFG):
+        (JSC::DFG::SpeculativeJIT::linkOSREntries):
+        (JSC::DFG::SpeculativeJIT::compileStrictEqForConstant):
+        * dfg/DFGSpeculativeJIT.h:
+        (SpeculativeJIT):
+        (JSC::DFG::SpeculativeJIT::branchDouble):
+        (JSC::DFG::SpeculativeJIT::branchDoubleNonZero):
+        (JSC::DFG::SpeculativeJIT::branch32):
+        (JSC::DFG::SpeculativeJIT::branchTest32):
+        (JSC::DFG::SpeculativeJIT::branchPtr):
+        (JSC::DFG::SpeculativeJIT::branchTestPtr):
+        (JSC::DFG::SpeculativeJIT::branchTest8):
+        (JSC::DFG::SpeculativeJIT::jump):
+        (JSC::DFG::SpeculativeJIT::haveEdgeCodeToEmit):
+        (JSC::DFG::SpeculativeJIT::emitEdgeCode):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::nonSpeculativePeepholeBranchNull):
+        (JSC::DFG::SpeculativeJIT::nonSpeculativePeepholeBranch):
+        (JSC::DFG::SpeculativeJIT::nonSpeculativePeepholeStrictEq):
+        (JSC::DFG::SpeculativeJIT::emitObjectOrOtherBranch):
+        (JSC::DFG::SpeculativeJIT::emitBranch):
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::nonSpeculativePeepholeBranchNull):
+        (JSC::DFG::SpeculativeJIT::nonSpeculativePeepholeBranch):
+        (JSC::DFG::SpeculativeJIT::nonSpeculativePeepholeStrictEq):
+        (JSC::DFG::SpeculativeJIT::emitObjectOrOtherBranch):
+        (JSC::DFG::SpeculativeJIT::emitBranch):
+        (JSC::DFG::SpeculativeJIT::compile):
+
+2012-02-14  Filip Pizlo  <fpizlo@apple.com>
+
+        Assertion failure under JSC::DFG::AbstractState::execute loading economist.com
+        https://bugs.webkit.org/show_bug.cgi?id=78153
+        <rdar://problem/10861712> <rdar://problem/10861947>
+
+        Reviewed by Oliver Hunt.
+
+        * dfg/DFGAbstractState.cpp:
+        (JSC::DFG::AbstractState::execute):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileAdd):
+
+2012-02-14  Eric Seidel  <eric@webkit.org>
+
+        Upstream Android's additions to Platform.h
+        https://bugs.webkit.org/show_bug.cgi?id=78536
+
+        Reviewed by Adam Barth.
+
+        * wtf/Platform.h:
+
+2012-02-12  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Replace old strtod with new strtod
+        https://bugs.webkit.org/show_bug.cgi?id=68044
+
+        Reviewed by Geoffrey Garen.
+
+        * parser/Lexer.cpp: Added template argument. This version allows junk after numbers.
+        (JSC::::lex):
+        * runtime/JSGlobalObjectFunctions.cpp: Ditto.
+        (JSC::parseInt):
+        (JSC::jsStrDecimalLiteral):
+        * runtime/LiteralParser.cpp: Ditto.
+        (JSC::::Lexer::lexNumber):
+        * wtf/dtoa.cpp: Replaced old strtod with a new version that uses the new StringToDoubleConverter.
+        It takes a template argument to allow clients to determine statically whether it should allow 
+        junk after the numbers or not.
+        (WTF):
+        (WTF::strtod):
+        * wtf/dtoa.h:
+        (WTF):
+        * wtf/text/WTFString.cpp: Added template argument. This version does not allow junk after numbers.
+        (WTF::toDoubleType):
+
+2012-02-13  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        More windows build fixing
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2012-02-13  Oliver Hunt  <oliver@apple.com>
+
+        Executing out of bounds in JSC::Yarr::YarrCodeBlock::execute / JSC::RegExp::match
+        https://bugs.webkit.org/show_bug.cgi?id=76315
+
+        Reviewed by Gavin Barraclough.
+
+        Perform a 3 byte compare using two comparisons, rather than trying to perform the
+        operation with a four byte load.
+
+        * yarr/YarrJIT.cpp:
+        (JSC::Yarr::YarrGenerator::generatePatternCharacterOnce):
+
+2012-02-13  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Windows build fix
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2012-02-12  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Replace old strtod with new strtod
+        https://bugs.webkit.org/show_bug.cgi?id=68044
+
+        Reviewed by Geoffrey Garen.
+
+        * parser/Lexer.cpp: Added template argument. This version allows junk after numbers.
+        (JSC::::lex):
+        * runtime/JSGlobalObjectFunctions.cpp: Ditto.
+        (JSC::parseInt):
+        (JSC::jsStrDecimalLiteral):
+        * runtime/LiteralParser.cpp: Ditto.
+        (JSC::::Lexer::lexNumber):
+        * wtf/dtoa.cpp: Replaced old strtod with a new version that uses the new StringToDoubleConverter.
+        It takes a template argument to allow clients to determine statically whether it should allow 
+        junk after the numbers or not.
+        (WTF):
+        (WTF::strtod):
+        * wtf/dtoa.h:
+        (WTF):
+        * wtf/text/WTFString.cpp: Added template argument. This version does not allow junk after numbers.
+        (WTF::toDoubleType):
+
+2012-02-13  Sam Weinig  <sam@webkit.org>
+
+        Move JSC related assertions out of Assertions.h and into their own header
+        https://bugs.webkit.org/show_bug.cgi?id=78508
+
+        Reviewed by Gavin Barraclough.
+
+        * GNUmakefile.list.am:
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        Add GCAssertions.h
+
+        * heap/GCAssertions.h: Added.
+        Move assertions here.
+
+        * runtime/WriteBarrier.h:
+        Add #include of GCAssertions.h
+
+        * wtf/Assertions.h:
+        Remove JSC related assertions.
+
+        * wtf/Compiler.h:
+        Add compiler check for __has_trivial_destructor.
+
+2012-02-13  Chao-ying Fu  <fu@mips.com>
+
+        Update MIPS patchOffsetGetByIdSlowCaseCall
+        https://bugs.webkit.org/show_bug.cgi?id=78392
+
+        Reviewed by Gavin Barraclough.
+
+        * jit/JIT.h:
+        (JIT):
+
+2012-02-13  Patrick Gansterer  <paroga@webkit.org>
+
+        Remove obsolete #if from ThreadSpecific.h
+        https://bugs.webkit.org/show_bug.cgi?id=78485
+
+        Reviewed by Adam Roben.
+
+        Since alle platform use either pthread or Win32 for threading,
+        we can remove all PLATFORM() preprocessor statements.
+
+        * wtf/ThreadSpecific.h:
+        (ThreadSpecific):
+
+2012-02-13  Jessie Berlin  <jberlin@apple.com>
+
+        Fix the Windows build.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2012-02-13  Sam Weinig  <sam@webkit.org>
+
+        Use C11's _Static_assert for COMPILE_ASSERT if it is available
+        https://bugs.webkit.org/show_bug.cgi?id=78506
+
+        Rubber-stamped by Antti Koivisto.
+
+        Use C11's _Static_assert for COMPILE_ASSERT if it is available to give slightly
+        better error messages.
+
+        * wtf/Assertions.h:
+        Use _Static_assert if it is available.
+
+        * wtf/Compiler.h:
+        Add COMPILER_SUPPORTS support for _Static_assert when using the LLVM Compiler.
+
+2012-02-13  Mario Sanchez Prada  <msanchez@igalia.com>
+
+        [GTK] Add GSList to the list of GObject types in GOwnPtr
+        https://bugs.webkit.org/show_bug.cgi?id=78487
+
+        Reviewed by Philippe Normand.
+
+        Handle the GSList type in GOwnPtr, by calling g_slist_free in the
+        implementation of the freeOwnedGPtr template function.
+
+        * wtf/gobject/GOwnPtr.cpp:
+        (WTF::GSList):
+        (WTF):
+        * wtf/gobject/GOwnPtr.h:
+        (WTF):
+        * wtf/gobject/GTypedefs.h:
+
+2012-02-06  Raphael Kubo da Costa  <kubo@profusion.mobi>
+
+        [EFL] Drop support for the Curl network backend.
+        https://bugs.webkit.org/show_bug.cgi?id=77874
+
+        Reviewed by Eric Seidel.
+
+        Nobody seems to be maintaining the Curl backend in WebCore, the
+        EFL port developers all seem to be using the Soup backend and the
+        port itself has many features which are only implemented for the
+        latter.
+
+        * wtf/PlatformEfl.cmake: Always build the gobject-dependent source
+        files.
+
+2012-02-13  Patrick Gansterer  <paroga@webkit.org>
+
+        Unreviewed. Build fix for !ENABLE(JIT) after r107485.
+
+        * bytecode/PolymorphicPutByIdList.cpp:
+
+2012-02-13  Gavin Barraclough  <barraclough@apple.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=78434
+        Unreviewed - temporarily reverting r107498 will I fix a couple of testcases.
+
+        * parser/Parser.cpp:
+        (JSC::::parseFunctionInfo):
+        * runtime/ClassInfo.h:
+        (MethodTable):
+        (JSC):
+        * runtime/JSCell.cpp:
+        (JSC):
+        * runtime/JSCell.h:
+        (JSCell):
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::reset):
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC):
+        * runtime/JSGlobalObjectFunctions.h:
+        (JSC):
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::put):
+        (JSC):
+        (JSC::JSObject::putDirectAccessor):
+        (JSC::JSObject::defineOwnProperty):
+        * runtime/JSObject.h:
+        (JSC::JSObject::inlineGetOwnPropertySlot):
+        (JSC::JSValue::get):
+        * runtime/JSString.cpp:
+        (JSC::JSString::getOwnPropertySlot):
+        * runtime/JSValue.h:
+        (JSValue):
+        * runtime/ObjectConstructor.cpp:
+        (JSC::objectConstructorGetPrototypeOf):
+        * runtime/Structure.cpp:
+        (JSC::Structure::Structure):
+        * runtime/Structure.h:
+        (JSC::Structure::setHasGetterSetterProperties):
+        (Structure):
+
+2012-02-12  Ashod Nakashian  <ashodnakashian@yahoo.com>
+
+        KeywordLookupGenerator.py script fails in some cases
+        https://bugs.webkit.org/show_bug.cgi?id=77886
+
+        Reviewed by Benjamin Poulain.
+
+        * parser/Keywords.table: Converted to LF-only.
+
+2012-02-12  Shinya Kawanaka  <shinyak@google.com>
+
+        Introduce ShadowRootList.
+        https://bugs.webkit.org/show_bug.cgi?id=78069
+
+        Reviewed by Hajime Morita.
+
+        DoublyLinkedList should have tail() method to take the last element.
+
+        * wtf/DoublyLinkedList.h:
+        (DoublyLinkedList):
+        (WTF::::tail):
+        (WTF):
+
+2012-02-12  Raphael Kubo da Costa  <kubo@profusion.mobi>
+
+        [CMake] Move source files in WTF_HEADERS to WTF_SOURCES.
+        https://bugs.webkit.org/show_bug.cgi?id=78436
+
+        Reviewed by Daniel Bates.
+
+        * wtf/CMakeLists.txt: Move .cpp files from WTF_HEADERS to WTF_SOURCES,
+        and correctly sort the files which start with 'M'.
+
+2012-02-12  Sam Weinig  <sam@webkit.org>
+
+        Move the NumberOfCores.h/cpp files into the WTF group of JavaScriptCore.xcodeproj.
+
+        Rubber-stamped by Anders Carlsson.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2012-02-12  Raphael Kubo da Costa  <kubo@profusion.mobi>
+
+        [CMake] Remove unused or empty variable definitions.
+        https://bugs.webkit.org/show_bug.cgi?id=78437
+
+        Reviewed by Daniel Bates.
+
+        * CMakeLists.txt: Remove unused JavaScriptCore_HEADERS definition.
+        * shell/CMakeLists.txt: Remove unused JSC_HEADERS definition.
+        * wtf/CMakeLists.txt: Remove empty WTF_LIBRARIES definition, it will
+        be defined later by Platform*.cmake via LIST(APPEND WTF_LIBRARIES).
+
+2012-02-12  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG::SpeculativeJIT calls fprintf() instead of dataLog in terminateSpeculativeExecution()
+        https://bugs.webkit.org/show_bug.cgi?id=78431
+
+        Reviewed by Gavin Barraclough.
+
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::terminateSpeculativeExecution):
+
+2012-02-11  Benjamin Poulain  <benjamin@webkit.org>
+
+        Add back WTFURL to WebKit
+        https://bugs.webkit.org/show_bug.cgi?id=77291
+
+        Reviewed by Adam Barth.
+
+        WTFURL was removed from WebKit in r86787.
+
+        This patch adds the code back to WTF with the following changes:
+        -Guard the feature with USE(WTFURL).
+        -Change the typename CHAR to CharacterType to follow recent WebKit conventions.
+        -Fix some coding style to make check-webkit-style happy.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * wtf/Platform.h:
+        * wtf/url/api/ParsedURL.cpp: Added.
+        (WTF):
+        (WTF::ParsedURL::ParsedURL):
+        (WTF::ParsedURL::scheme):
+        (WTF::ParsedURL::username):
+        (WTF::ParsedURL::password):
+        (WTF::ParsedURL::host):
+        (WTF::ParsedURL::port):
+        (WTF::ParsedURL::path):
+        (WTF::ParsedURL::query):
+        (WTF::ParsedURL::fragment):
+        (WTF::ParsedURL::segment):
+        * wtf/url/api/ParsedURL.h: Added.
+        (WTF):
+        (ParsedURL):
+        (WTF::ParsedURL::spec):
+        * wtf/url/api/URLString.h: Added.
+        (WTF):
+        (URLString):
+        (WTF::URLString::URLString):
+        (WTF::URLString::string):
+        * wtf/url/src/RawURLBuffer.h: Added.
+        (WTF):
+        (RawURLBuffer):
+        (WTF::RawURLBuffer::RawURLBuffer):
+        (WTF::RawURLBuffer::~RawURLBuffer):
+        (WTF::RawURLBuffer::resize):
+        * wtf/url/src/URLBuffer.h: Added.
+        (WTF):
+        (URLBuffer):
+        (WTF::URLBuffer::URLBuffer):
+        (WTF::URLBuffer::~URLBuffer):
+        (WTF::URLBuffer::at):
+        (WTF::URLBuffer::set):
+        (WTF::URLBuffer::capacity):
+        (WTF::URLBuffer::length):
+        (WTF::URLBuffer::data):
+        (WTF::URLBuffer::setLength):
+        (WTF::URLBuffer::append):
+        (WTF::URLBuffer::grow):
+        * wtf/url/src/URLCharacterTypes.cpp: Added.
+        (WTF):
+        ():
+        * wtf/url/src/URLCharacterTypes.h: Added.
+        (WTF):
+        (URLCharacterTypes):
+        (WTF::URLCharacterTypes::isQueryChar):
+        (WTF::URLCharacterTypes::isIPv4Char):
+        (WTF::URLCharacterTypes::isHexChar):
+        ():
+        (WTF::URLCharacterTypes::isCharOfType):
+        * wtf/url/src/URLComponent.h: Added.
+        (WTF):
+        (URLComponent):
+        (WTF::URLComponent::URLComponent):
+        (WTF::URLComponent::fromRange):
+        (WTF::URLComponent::isValid):
+        (WTF::URLComponent::isNonEmpty):
+        (WTF::URLComponent::isEmptyOrInvalid):
+        (WTF::URLComponent::reset):
+        (WTF::URLComponent::operator==):
+        (WTF::URLComponent::begin):
+        (WTF::URLComponent::setBegin):
+        (WTF::URLComponent::length):
+        (WTF::URLComponent::setLength):
+        (WTF::URLComponent::end):
+        * wtf/url/src/URLEscape.cpp: Added.
+        (WTF):
+        ():
+        * wtf/url/src/URLEscape.h: Added.
+        (WTF):
+        (WTF::appendURLEscapedCharacter):
+        * wtf/url/src/URLParser.h: Added.
+        (WTF):
+        (URLParser):
+        ():
+        (WTF::URLParser::isPossibleAuthorityTerminator):
+        (WTF::URLParser::parseAuthority):
+        (WTF::URLParser::extractScheme):
+        (WTF::URLParser::parseAfterScheme):
+        (WTF::URLParser::parseStandardURL):
+        (WTF::URLParser::parsePath):
+        (WTF::URLParser::parsePathURL):
+        (WTF::URLParser::parseMailtoURL):
+        (WTF::URLParser::parsePort):
+        (WTF::URLParser::extractFileName):
+        (WTF::URLParser::extractQueryKeyValue):
+        (WTF::URLParser::isURLSlash):
+        (WTF::URLParser::shouldTrimFromURL):
+        (WTF::URLParser::trimURL):
+        (WTF::URLParser::consecutiveSlashes):
+        (WTF::URLParser::isPortDigit):
+        (WTF::URLParser::nextAuthorityTerminator):
+        (WTF::URLParser::parseUserInfo):
+        (WTF::URLParser::parseServerInfo):
+        * wtf/url/src/URLQueryCanonicalizer.h: Added.
+        (WTF):
+        (URLQueryCanonicalizer):
+        (WTF::URLQueryCanonicalizer::canonicalize):
+        (WTF::URLQueryCanonicalizer::isAllASCII):
+        (WTF::URLQueryCanonicalizer::isRaw8Bit):
+        (WTF::URLQueryCanonicalizer::appendRaw8BitQueryString):
+        (WTF::URLQueryCanonicalizer::convertToQueryEncoding):
+        * wtf/url/src/URLSegments.cpp: Added.
+        (WTF):
+        (WTF::URLSegments::length):
+        (WTF::URLSegments::charactersBefore):
+        * wtf/url/src/URLSegments.h: Added.
+        (WTF):
+        (URLSegments):
+        ():
+        (WTF::URLSegments::URLSegments):
+
+2012-02-11  Filip Pizlo  <fpizlo@apple.com>
+
+        Old JIT put_by_id profiling counts every put_by_id_transition as taking slow path
+        https://bugs.webkit.org/show_bug.cgi?id=78430
+        <rdar://problem/10849469> <rdar://problem/10849684>
+
+        Reviewed by Gavin Barraclough.
+        
+        The old JIT's put_by_id transition caching involves repatching the slow call to
+        a generated stub. That means that the call is counted as "slow case". So, this
+        patch inserts code to decrement the slow case count if the stub succeeds.
+        
+        Looks like a ~1% speed-up on V8.
+
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::privateCompilePutByIdTransition):
+        * jit/JITPropertyAccess32_64.cpp:
+        (JSC::JIT::privateCompilePutByIdTransition):
+
+2012-02-11  Filip Pizlo  <fpizlo@apple.com>
+
+        Build fix for Qt.
+
+        * wtf/DataLog.h:
+
+2012-02-11  Filip Pizlo  <fpizlo@apple.com>
+
+        It should be possible to send all JSC debug logging to a file
+        https://bugs.webkit.org/show_bug.cgi?id=78418
+
+        Reviewed by Sam Weinig.
+        
+        Introduced wtf/DataLog, which defines WTF::dataFile, WTF::dataLog,
+        and WTF::dataLogV. Changed all debugging- and profiling-related printfs
+        to use WTF::dataLog() or one of its friends. By default, debug logging
+        goes to stderr, unless you change the setting in wtf/DataLog.cpp.
+
+        * GNUmakefile.list.am:
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.vcproj/WTF/WTF.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * assembler/LinkBuffer.h:
+        (JSC::LinkBuffer::dumpLinkStatistics):
+        (JSC::LinkBuffer::dumpCode):
+        * assembler/SH4Assembler.h:
+        (JSC::SH4Assembler::vprintfStdoutInstr):
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::printUnaryOp):
+        (JSC::CodeBlock::printBinaryOp):
+        (JSC::CodeBlock::printConditionalJump):
+        (JSC::CodeBlock::printGetByIdOp):
+        (JSC::CodeBlock::printCallOp):
+        (JSC::CodeBlock::printPutByIdOp):
+        (JSC::printGlobalResolveInfo):
+        (JSC::printStructureStubInfo):
+        (JSC::CodeBlock::printStructure):
+        (JSC::CodeBlock::printStructures):
+        (JSC::CodeBlock::dump):
+        (JSC::CodeBlock::dumpStatistics):
+        (JSC::CodeBlock::finalizeUnconditionally):
+        (JSC::CodeBlock::shouldOptimizeNow):
+        (JSC::CodeBlock::tallyFrequentExitSites):
+        (JSC::CodeBlock::dumpValueProfiles):
+        * bytecode/Opcode.cpp:
+        (JSC::OpcodeStats::~OpcodeStats):
+        * bytecode/SamplingTool.cpp:
+        (JSC::SamplingFlags::stop):
+        (JSC::SamplingRegion::dumpInternal):
+        (JSC::SamplingTool::dump):
+        * dfg/DFGAbstractState.cpp:
+        (JSC::DFG::AbstractState::endBasicBlock):
+        (JSC::DFG::AbstractState::mergeStateAtTail):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::getPredictionWithoutOSRExit):
+        (JSC::DFG::ByteCodeParser::makeSafe):
+        (JSC::DFG::ByteCodeParser::makeDivSafe):
+        (JSC::DFG::ByteCodeParser::handleCall):
+        (JSC::DFG::ByteCodeParser::handleInlining):
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        (JSC::DFG::ByteCodeParser::processPhiStack):
+        (JSC::DFG::ByteCodeParser::linkBlock):
+        (JSC::DFG::ByteCodeParser::parseCodeBlock):
+        (JSC::DFG::ByteCodeParser::parse):
+        * dfg/DFGCommon.h:
+        * dfg/DFGDriver.cpp:
+        (JSC::DFG::compile):
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::printWhiteSpace):
+        (JSC::DFG::Graph::dumpCodeOrigin):
+        (JSC::DFG::Graph::dump):
+        (JSC::DFG::Graph::predictArgumentTypes):
+        * dfg/DFGJITCompiler.cpp:
+        (JSC::DFG::JITCompiler::link):
+        * dfg/DFGOSREntry.cpp:
+        (JSC::DFG::prepareOSREntry):
+        * dfg/DFGOSRExitCompiler.cpp:
+        * dfg/DFGOSRExitCompiler32_64.cpp:
+        (JSC::DFG::OSRExitCompiler::compileExit):
+        * dfg/DFGOSRExitCompiler64.cpp:
+        (JSC::DFG::OSRExitCompiler::compileExit):
+        * dfg/DFGOperations.cpp:
+        * dfg/DFGPropagator.cpp:
+        (JSC::DFG::Propagator::fixpoint):
+        (JSC::DFG::Propagator::propagateArithNodeFlags):
+        (JSC::DFG::Propagator::propagateArithNodeFlagsForward):
+        (JSC::DFG::Propagator::propagateArithNodeFlagsBackward):
+        (JSC::DFG::Propagator::propagateNodePredictions):
+        (JSC::DFG::Propagator::propagatePredictionsForward):
+        (JSC::DFG::Propagator::propagatePredictionsBackward):
+        (JSC::DFG::Propagator::doRoundOfDoubleVoting):
+        (JSC::DFG::Propagator::fixupNode):
+        (JSC::DFG::Propagator::fixup):
+        (JSC::DFG::Propagator::startIndexForChildren):
+        (JSC::DFG::Propagator::endIndexForPureCSE):
+        (JSC::DFG::Propagator::setReplacement):
+        (JSC::DFG::Propagator::eliminate):
+        (JSC::DFG::Propagator::performNodeCSE):
+        (JSC::DFG::Propagator::localCSE):
+        (JSC::DFG::Propagator::allocateVirtualRegisters):
+        (JSC::DFG::Propagator::performBlockCFA):
+        (JSC::DFG::Propagator::performForwardCFA):
+        * dfg/DFGRegisterBank.h:
+        (JSC::DFG::RegisterBank::dump):
+        * dfg/DFGScoreBoard.h:
+        (JSC::DFG::ScoreBoard::dump):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::dump):
+        (JSC::DFG::SpeculativeJIT::checkConsistency):
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::fillSpeculateIntInternal):
+        (JSC::DFG::SpeculativeJIT::fillSpeculateDouble):
+        (JSC::DFG::SpeculativeJIT::fillSpeculateCell):
+        (JSC::DFG::SpeculativeJIT::fillSpeculateBoolean):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::fillSpeculateIntInternal):
+        (JSC::DFG::SpeculativeJIT::fillSpeculateDouble):
+        (JSC::DFG::SpeculativeJIT::fillSpeculateCell):
+        (JSC::DFG::SpeculativeJIT::fillSpeculateBoolean):
+        * heap/Heap.cpp:
+        (JSC::Heap::destroy):
+        * heap/MarkedBlock.h:
+        * interpreter/CallFrame.cpp:
+        (JSC::CallFrame::dumpCaller):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::dumpRegisters):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        (JSC::JIT::privateCompileSlowCases):
+        (JSC::JIT::privateCompile):
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        * profiler/Profile.cpp:
+        (JSC::Profile::debugPrintData):
+        (JSC::Profile::debugPrintDataSampleStyle):
+        * profiler/ProfileNode.cpp:
+        (JSC::ProfileNode::debugPrintData):
+        (JSC::ProfileNode::debugPrintDataSampleStyle):
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::dumpRegExpTrace):
+        * runtime/RegExp.cpp:
+        (JSC::RegExp::matchCompareWithInterpreter):
+        * runtime/SamplingCounter.cpp:
+        (JSC::AbstractSamplingCounter::dump):
+        * runtime/SamplingCounter.h:
+        (JSC::DeletableSamplingCounter::~DeletableSamplingCounter):
+        * runtime/ScopeChain.cpp:
+        (JSC::ScopeChainNode::print):
+        * runtime/Structure.cpp:
+        (JSC::Structure::dumpStatistics):
+        (JSC::PropertyMapStatisticsExitLogger::~PropertyMapStatisticsExitLogger):
+        * tools/CodeProfile.cpp:
+        (JSC::CodeProfile::report):
+        * tools/ProfileTreeNode.h:
+        (JSC::ProfileTreeNode::dumpInternal):
+        * wtf/CMakeLists.txt:
+        * wtf/DataLog.cpp: Added.
+        (WTF):
+        (WTF::initializeLogFileOnce):
+        (WTF::initializeLogFile):
+        (WTF::dataFile):
+        (WTF::dataLogV):
+        (WTF::dataLog):
+        * wtf/DataLog.h: Added.
+        (WTF):
+        * wtf/HashTable.cpp:
+        (WTF::HashTableStats::~HashTableStats):
+        * wtf/MetaAllocator.cpp:
+        (WTF::MetaAllocator::dumpProfile):
+        * wtf/text/WTFString.cpp:
+        (String::show):
+        * yarr/YarrInterpreter.cpp:
+        (JSC::Yarr::ByteCompiler::dumpDisjunction):
+
+2012-02-11  Gavin Barraclough  <barraclough@apple.com>
+
+        Move special __proto__ property to Object.prototype
+        https://bugs.webkit.org/show_bug.cgi?id=78409
+
+        Reviewed by Oliver Hunt.
+
+        Re-implement this as a regular accessor property.  This has three key benefits:
+        1) It makes it possible for objects to be given properties named __proto__.
+        2) Object.prototype.__proto__ can be deleted, preventing object prototypes from being changed.
+        3) This largely removes the magic used the implement __proto__, it can just be made a regular accessor property.
+
+        * parser/Parser.cpp:
+        (JSC::::parseFunctionInfo):
+            - No need to prohibit functions named __proto__.
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::reset):
+            - Add __proto__ accessor to Object.prototype.
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::globalFuncProtoGetter):
+        (JSC::globalFuncProtoSetter):
+            - Definition of the __proto__ accessor functions.
+        * runtime/JSGlobalObjectFunctions.h:
+            - Declaration of the __proto__ accessor functions.
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::put):
+            - Remove the special handling for __proto__, there is still a check to allow for a fast guard for accessors excluding __proto__.
+        (JSC::JSObject::putDirectAccessor):
+            - Track on the structure whether an object contains accessors other than one for __proto__.
+        (JSC::JSObject::defineOwnProperty):
+            - No need to prohibit definition of own properties named __proto__.
+        * runtime/JSObject.h:
+        (JSC::JSObject::inlineGetOwnPropertySlot):
+            - Remove the special handling for __proto__.
+        (JSC::JSValue::get):
+            - Remove the special handling for __proto__.
+        * runtime/JSString.cpp:
+        (JSC::JSString::getOwnPropertySlot):
+            - Remove the special handling for __proto__.
+        * runtime/JSValue.h:
+        (JSValue):
+            - Made synthesizePrototype public (this may be needed by the __proto__ getter).
+        * runtime/ObjectConstructor.cpp:
+        (JSC::objectConstructorGetPrototypeOf):
+            - Perform the security check & call prototype() directly.
+        * runtime/Structure.cpp:
+        (JSC::Structure::Structure):
+            - Added 'ExcludingProto' variant of the 'hasGetterSetterProperties' state.
+        * runtime/Structure.h:
+        (JSC::Structure::hasGetterSetterPropertiesExcludingProto):
+        (JSC::Structure::setHasGetterSetterProperties):
+        (Structure):
+            - Added 'ExcludingProto' variant of the 'hasGetterSetterProperties' state.
+
+2012-02-11  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG CFA assumes that a WeakJSConstant's structure is known
+        https://bugs.webkit.org/show_bug.cgi?id=78428
+        <rdar://problem/10849492> <rdar://problem/10849621>
+
+        Reviewed by Gavin Barraclough.
+
+        * dfg/DFGAbstractState.cpp:
+        (JSC::DFG::AbstractState::execute):
+
+2012-02-11  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Qt debug build fix
+
+        * heap/MarkedBlock.cpp:
+        (JSC::MarkedBlock::callDestructor): Platforms that don't use clang will allocate 
+        JSFinalObjects in the destuctor subspace, so we should remove this assert so it 
+        doesn't cause crashes.
+
+2012-02-11  Filip Pizlo  <fpizlo@apple.com>
+
+        Old 32_64 JIT should assert that its use of map() is consistent with the DFG
+        OSR exit's expectations
+        https://bugs.webkit.org/show_bug.cgi?id=78419
+        <rdar://problem/10817121>
+
+        Reviewed by Oliver Hunt.
+
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::map):
+
+2012-02-11  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Reduce the reentrancy limit of the interpreter for the iOS simulator
+        https://bugs.webkit.org/show_bug.cgi?id=78400
+
+        Reviewed by Gavin Barraclough.
+
+        * interpreter/Interpreter.h: Lowered the maximum reentrancy limit for large thread stacks.
+        (JSC):
+
+2012-02-11  Filip Pizlo  <fpizlo@apple.com>
+
+        [DFG] Misuse of WeakJSConstants in silentFillGPR code.
+        https://bugs.webkit.org/show_bug.cgi?id=78423
+        <rdar://problem/10849353> <rdar://problem/10804043>
+
+        Reviewed by Sam Weinig.
+        
+        The code was using Node::isConstant(), when it was supposed to use Node::hasConstant().
+        This patch is a surgical fix; the bigger problem is: why do we have isConstant() and
+        hasConstant() when hasConstant() is correct and isConstant() is almost always wrong?
+
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::silentFillGPR):
+
+2012-02-11  Sam Weinig  <sam@webkit.org>
+
+        Prepare JavaScriptCore to build with libc++
+        <rdar://problem/10426673>
+        https://bugs.webkit.org/show_bug.cgi?id=78424
+
+        Reviewed by Anders Carlsson.
+
+        * wtf/NullPtr.cpp:
+        * wtf/NullPtr.h:
+        libc++ provides std::nullptr emulation, so we don't have to.
+
+2012-02-07  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG should have polymorphic put_by_id caching
+        https://bugs.webkit.org/show_bug.cgi?id=78062
+        <rdar://problem/10326439> <rdar://problem/10824839>
+
+        Reviewed by Oliver Hunt.
+        
+        Implemented polymorphic put_by_id caching in the DFG, and added much of the
+        machinery that would be needed to implement it in the old JIT as well.
+        
+        I decided against using the old PolymorphicAccessStructureList mechanism as
+        this didn't quite fit with put_by_id. In particular, I wanted the ability to
+        have one list that captured all relevant cases (including proto put_by_id
+        if we ever decided to do it). And I wanted the code to have better
+        encapsulation. And I didn't want to get confused by the fact that the
+        original (non-list) put_by_id cache may itself consist of a stub routine.
+        
+        This code is still sub-optimal (for example adding a replace to a list whose
+        previous elements are all transitions should just repatch the original code,
+        but here it will generate a stub) but it already generates a >20% speed-up
+        on V8-splay, leading to a 2% win overall in splay. Neutral elsewhere.
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * Target.pri:
+        * bytecode/PolymorphicPutByIdList.cpp: Added.
+        (JSC):
+        (JSC::PutByIdAccess::fromStructureStubInfo):
+        (JSC::PutByIdAccess::visitWeak):
+        (JSC::PolymorphicPutByIdList::PolymorphicPutByIdList):
+        (JSC::PolymorphicPutByIdList::from):
+        (JSC::PolymorphicPutByIdList::~PolymorphicPutByIdList):
+        (JSC::PolymorphicPutByIdList::isFull):
+        (JSC::PolymorphicPutByIdList::isAlmostFull):
+        (JSC::PolymorphicPutByIdList::addAccess):
+        (JSC::PolymorphicPutByIdList::visitWeak):
+        * bytecode/PolymorphicPutByIdList.h: Added.
+        (JSC):
+        (PutByIdAccess):
+        (JSC::PutByIdAccess::PutByIdAccess):
+        (JSC::PutByIdAccess::transition):
+        (JSC::PutByIdAccess::replace):
+        (JSC::PutByIdAccess::isSet):
+        (JSC::PutByIdAccess::operator!):
+        (JSC::PutByIdAccess::type):
+        (JSC::PutByIdAccess::isTransition):
+        (JSC::PutByIdAccess::isReplace):
+        (JSC::PutByIdAccess::oldStructure):
+        (JSC::PutByIdAccess::structure):
+        (JSC::PutByIdAccess::newStructure):
+        (JSC::PutByIdAccess::chain):
+        (JSC::PutByIdAccess::stubRoutine):
+        (PolymorphicPutByIdList):
+        (JSC::PolymorphicPutByIdList::currentSlowPathTarget):
+        (JSC::PolymorphicPutByIdList::isEmpty):
+        (JSC::PolymorphicPutByIdList::size):
+        (JSC::PolymorphicPutByIdList::at):
+        (JSC::PolymorphicPutByIdList::operator[]):
+        (JSC::PolymorphicPutByIdList::kind):
+        * bytecode/PutKind.h: Added.
+        (JSC):
+        * bytecode/StructureStubInfo.cpp:
+        (JSC::StructureStubInfo::deref):
+        (JSC::StructureStubInfo::visitWeakReferences):
+        * bytecode/StructureStubInfo.h:
+        (JSC):
+        (JSC::isPutByIdAccess):
+        (JSC::StructureStubInfo::initPutByIdList):
+        (StructureStubInfo):
+        (JSC::StructureStubInfo::reset):
+        * dfg/DFGOperations.cpp:
+        * dfg/DFGOperations.h:
+        (DFG):
+        * dfg/DFGRepatch.cpp:
+        (JSC::DFG::appropriateGenericPutByIdFunction):
+        (JSC::DFG::appropriateListBuildingPutByIdFunction):
+        (DFG):
+        (JSC::DFG::emitPutReplaceStub):
+        (JSC::DFG::emitPutTransitionStub):
+        (JSC::DFG::tryCachePutByID):
+        (JSC::DFG::dfgRepatchPutByID):
+        (JSC::DFG::tryBuildPutByIdList):
+        (JSC::DFG::dfgBuildPutByIdList):
+        (JSC::DFG::dfgResetPutByID):
+        * dfg/DFGRepatch.h:
+        (DFG):
+        * runtime/WriteBarrier.h:
+        (WriteBarrierBase):
+        (JSC::WriteBarrierBase::copyFrom):
+
+2012-02-10  Vineet Chaudhary  <rgf748@motorola.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=72756
+        DOMHTMLElement’s accessKey property is declared as available in WebKit version that didn’t have it 
+
+        Reviewed by Timothy Hatcher.
+
+        * API/WebKitAvailability.h: Added AVAILABLE_AFTER_WEBKIT_VERSION_5_1 and
+          AVAILABLE_WEBKIT_VERSION_1_3_AND_LATER_BUT_DEPRECATED_AFTER_WEBKIT_VERSION_5_1 for the new versions.
+
+2012-02-10  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Fixing windows build
+
+        Unreviewed build fix
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2012-02-10  Adam Klein  <adamk@chromium.org>
+
+        Enable MUTATION_OBSERVERS by default on all platforms
+        https://bugs.webkit.org/show_bug.cgi?id=78196
+
+        Reviewed by Ojan Vafai.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2012-02-10  Yong Li  <yoli@rim.com>
+
+        ENABLE(ASSEMBLER_WX_EXCLUSIVE): LinkBuffer can leave pages not marked as executable.
+        https://bugs.webkit.org/show_bug.cgi?id=76724
+
+        Reviewed by Rob Buis.
+
+        This issue only exists when both ENABLE(ASSEMBLER_WX_EXCLUSIVE) and ENABLE(BRANCH_COMPACTION) are on.
+        The size used to call makeExecutable can be smaller than the one that was used for makeWritable.
+        So it can leave pages behind that are not set back to default flags. When an assembly on one of those
+        pages is executed or JIT returns to those pages in the case it was already executing from there, the
+        software will crash.
+
+        * assembler/LinkBuffer.h: Add m_initialSize and use it in performFinalization().
+        (JSC::LinkBuffer::LinkBuffer):
+        (JSC::LinkBuffer::linkCode):
+        (JSC::LinkBuffer::performFinalization):
+        (LinkBuffer):
+
+2012-02-10  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Split MarkedSpace into destructor and destructor-free subspaces
+        https://bugs.webkit.org/show_bug.cgi?id=77761
+
+        Reviewed by Geoffrey Garen.
+
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::emitAllocateJSFinalObject): Switched over to use destructor-free space.
+        * heap/Heap.h:
+        (JSC::Heap::allocatorForObjectWithoutDestructor): Added to give clients (e.g. the JIT) the ability to 
+        pick which subspace they want to allocate out of.
+        (JSC::Heap::allocatorForObjectWithDestructor): Ditto.
+        (Heap):
+        (JSC::Heap::allocateWithDestructor): Added private function for CellAllocator to use.
+        (JSC):
+        (JSC::Heap::allocateWithoutDestructor): Ditto.
+        * heap/MarkedAllocator.cpp: Added the cellsNeedDestruction flag to allocators so that they can allocate 
+        their MarkedBlocks correctly.
+        (JSC::MarkedAllocator::allocateBlock):
+        * heap/MarkedAllocator.h:
+        (JSC::MarkedAllocator::cellsNeedDestruction):
+        (MarkedAllocator):
+        (JSC::MarkedAllocator::MarkedAllocator):
+        (JSC):
+        (JSC::MarkedAllocator::init): Replaced custom set functions, which were only used upon initialization, with
+        an init function that does all of that stuff in fewer lines.
+        * heap/MarkedBlock.cpp:
+        (JSC::MarkedBlock::create):
+        (JSC::MarkedBlock::recycle):
+        (JSC::MarkedBlock::MarkedBlock):
+        (JSC::MarkedBlock::callDestructor): Templatized, along with specializedSweep and sweepHelper, to make 
+        checking the m_cellsNeedDestructor flag faster and cleaner looking.
+        (JSC):
+        (JSC::MarkedBlock::specializedSweep):
+        (JSC::MarkedBlock::sweep):
+        (JSC::MarkedBlock::sweepHelper):
+        * heap/MarkedBlock.h:
+        (MarkedBlock):
+        (JSC::MarkedBlock::cellsNeedDestruction):
+        (JSC):
+        * heap/MarkedSpace.cpp:
+        (JSC::MarkedSpace::MarkedSpace):
+        (JSC::MarkedSpace::resetAllocators):
+        (JSC::MarkedSpace::canonicalizeCellLivenessData):
+        (JSC::TakeIfUnmarked::operator()):
+        * heap/MarkedSpace.h:
+        (MarkedSpace):
+        (Subspace):
+        (JSC::MarkedSpace::allocatorFor): Needed function to differentiate between the two broad subspaces of 
+        allocators.
+        (JSC):
+        (JSC::MarkedSpace::destructorAllocatorFor): Ditto.
+        (JSC::MarkedSpace::allocateWithoutDestructor): Ditto.
+        (JSC::MarkedSpace::allocateWithDestructor): Ditto.
+        (JSC::MarkedSpace::forEachBlock):
+        * jit/JIT.h:
+        * jit/JITInlineMethods.h: Modified to use the proper allocator for JSFinalObjects and others.
+        (JSC::JIT::emitAllocateBasicJSObject):
+        (JSC::JIT::emitAllocateJSFinalObject):
+        (JSC::JIT::emitAllocateJSFunction):
+        * runtime/JSArray.cpp:
+        (JSC):
+        * runtime/JSArray.h:
+        (JSArray):
+        (JSC::JSArray::create):
+        (JSC):
+        (JSC::JSArray::tryCreateUninitialized):
+        * runtime/JSCell.h:
+        (JSCell):
+        (JSC):
+        (NeedsDestructor): Template struct that calculates at compile time whether the class in question requires 
+        destruction or not using the compiler type trait __has_trivial_destructor. allocateCell then checks this 
+        constant to decide whether to allocate in the destructor or destructor-free parts of the heap.
+        (JSC::allocateCell): 
+        * runtime/JSFunction.cpp:
+        (JSC):
+        * runtime/JSFunction.h:
+        (JSFunction):
+        * runtime/JSObject.cpp:
+        (JSC):
+        * runtime/JSObject.h:
+        (JSNonFinalObject):
+        (JSC):
+        (JSFinalObject):
+        (JSC::JSFinalObject::create):
+
+2012-02-10  Adrienne Walker  <enne@google.com>
+
+        Remove implicit copy constructor usage in HashMaps with OwnPtr
+        https://bugs.webkit.org/show_bug.cgi?id=78071
+
+        Reviewed by Darin Adler.
+
+        Change the return type of emptyValue() in PairHashTraits to be the
+        actual type returned rather than the trait type to avoid an implicit
+        generation of the OwnPtr copy constructor. This happens for hash
+        traits involving OwnPtr where the empty value is not zero and each
+        hash bucket needs to be initialized with emptyValue().
+
+        Also, update StructureTransitionTable to use default hash traits
+        rather than rolling its own, in order to update it to handle
+        EmptyValueType.
+
+        Test: patch from bug 74154 compiles on Clang with this patch
+
+        * runtime/StructureTransitionTable.h:
+        (StructureTransitionTable):
+        * wtf/HashTraits.h:
+        (GenericHashTraits):
+        (PairHashTraits):
+        (WTF::PairHashTraits::emptyValue):
+
+2012-02-10  Aron Rosenberg  <arosenberg@logitech.com>
+
+        [Qt] Fix compiler warning in Visual Studio 2010 about TR1
+        https://bugs.webkit.org/show_bug.cgi?id=63642
+
+        Reviewed by Simon Hausmann.
+
+        * JavaScriptCore.pri:
+
+2012-02-10  Michael Saboff  <msaboff@apple.com>
+
+        Yarr assert with regexp where alternative in *-quantified group matches empty
+        https://bugs.webkit.org/show_bug.cgi?id=67752        
+
+        Reviewed by Gavin Barraclough.
+
+        Added backtracking for the prior alternative if it matched
+        but didn't consume any input characters.
+
+        * yarr/YarrJIT.cpp:
+        (YarrOp): New jump.
+        (JSC::Yarr::YarrGenerator::generate): Emit conditional jump
+        when an alternative matches and no input was consumed.  Moved the
+        zero length match check for a set of alternatives to the alternative
+        code from the parentheses cases to the alternative end cases.
+        Converted the existing zero length checks in the parentheses cases
+        to runtime assertion checks.
+        (JSC::Yarr::YarrGenerator::backtrack): Link new jump to backtrack
+        to prior term.
+
+2012-02-10  Roland Takacs  <takacs.roland@stud.u-szeged.hu>
+
+        [Qt] GC should be parallel on Qt platform
+        https://bugs.webkit.org/show_bug.cgi?id=73309
+
+        Reviewed by Zoltan Herczeg.
+
+        These changes made the parallel gc feature available for Qt port.
+        The implementation of "registerGCThread" and "isMainThreadOrGCThread",
+        and a local static function [initializeGCThreads] is moved from
+        MainThreadMac.mm to the common MainThread.cpp to make them available
+        for other platforms.
+
+        Measurement results:
+        V8           speed-up:  1.025x as fast  [From: 663.4ms  To: 647.0ms ]
+        V8 Splay     speed-up:  1.185x as fast  [From: 138.4ms  To: 116.8ms ]
+
+        Tested on Intel(R) Core(TM) i5-2320 CPU @ 3.00GHz with 4-core.
+
+        * JavaScriptCore.order:
+        * wtf/MainThread.cpp:
+        (WTF::initializeMainThread):
+        (WTF):
+        (WTF::initializeGCThreads):
+        (WTF::registerGCThread):
+        (WTF::isMainThreadOrGCThread):
+        * wtf/MainThread.h:
+        (WTF):
+        * wtf/Platform.h:
+        * wtf/mac/MainThreadMac.mm:
+        (WTF):
+
+2012-02-09  Andy Wingo  <wingo@igalia.com>
+
+        Eliminate dead code in BytecodeGenerator::resolve()
+        https://bugs.webkit.org/show_bug.cgi?id=78242
+
+        Reviewed by Gavin Barraclough.
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::resolve):
+        BytecodeGenerator::shouldOptimizeLocals() is only true for
+        FunctionCode, and thus cannot be true for GlobalCode.
+
+2012-02-09  Andy Wingo  <wingo@igalia.com>
+
+        Remove BytecodeGenerator::isLocal
+        https://bugs.webkit.org/show_bug.cgi?id=78241
+
+        Minor refactor to BytecodeGenerator.
+
+        Reviewed by Gavin Barraclough.
+
+        * bytecompiler/BytecodeGenerator.h:
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::isLocal):
+        (JSC::BytecodeGenerator::isLocalConstant): Remove now-unused
+        methods.
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::ResolveNode::isPure): Use the ResolveResult mechanism
+        instead of isLocal.  This will recognize more resolve nodes as
+        being pure.
+        (JSC::PrefixResolveNode::emitBytecode): Use isReadOnly on the
+        location instead of isLocalConstant.
+
+2012-02-09  Oliver Hunt  <oliver@apple.com>
+
+        The JS Parser scope object needs a VectorTrait specialization
+        https://bugs.webkit.org/show_bug.cgi?id=78308
+
+        Reviewed by Gavin Barraclough.
+
+        This showed up as a periodic crash in various bits of generated code
+        originally, but I've added an assertion in the bytecode generator
+        that makes the effected code much more crash-happy should it go
+        wrong again.
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        (JSC::BytecodeGenerator::resolve):
+        * parser/Parser.cpp:
+        * parser/Parser.h:
+        (JSC):
+        * runtime/JSActivation.h:
+        (JSC::JSActivation::isValidScopedLookup):
+        (JSActivation):
+
 2012-02-08  Oliver Hunt  <oliver@apple.com>
 
         Whoops, fix the build.
diff --git a/Source/JavaScriptCore/Configurations/Base.xcconfig b/Source/JavaScriptCore/Configurations/Base.xcconfig
index e304bd1fb..40c11b647 100644
--- a/Source/JavaScriptCore/Configurations/Base.xcconfig
+++ b/Source/JavaScriptCore/Configurations/Base.xcconfig
@@ -73,6 +73,11 @@ WARNING_CFLAGS_macosx_ppc64 = $(WARNING_CFLAGS_BASE);
 WARNING_CFLAGS_macosx_x86_64 = $(WARNING_CFLAGS_BASE);
 HEADER_SEARCH_PATHS = . icu $(HEADER_SEARCH_PATHS);
 
+CLANG_CXX_LIBRARY = $(CLANG_CXX_LIBRARY_$(TARGET_MAC_OS_X_VERSION_MAJOR));
+CLANG_CXX_LIBRARY_1060 = libstdc++;
+CLANG_CXX_LIBRARY_1070 = libc++;
+CLANG_CXX_LIBRARY_1080 = libc++;
+CLANG_CXX_LIBRARY_1090 = libc++;
 
 REAL_PLATFORM_NAME = $(REAL_PLATFORM_NAME_$(PLATFORM_NAME));
 REAL_PLATFORM_NAME_ = $(REAL_PLATFORM_NAME_macosx);
diff --git a/Source/JavaScriptCore/Configurations/FeatureDefines.xcconfig b/Source/JavaScriptCore/Configurations/FeatureDefines.xcconfig
index 6447eb7ee..576e746ad 100644
--- a/Source/JavaScriptCore/Configurations/FeatureDefines.xcconfig
+++ b/Source/JavaScriptCore/Configurations/FeatureDefines.xcconfig
@@ -37,7 +37,8 @@ ENABLE_BLOB_macosx = ENABLE_BLOB;
 ENABLE_CLIENT_BASED_GEOLOCATION = $(ENABLE_CLIENT_BASED_GEOLOCATION_$(REAL_PLATFORM_NAME));
 ENABLE_CLIENT_BASED_GEOLOCATION_macosx = ENABLE_CLIENT_BASED_GEOLOCATION;
 
-ENABLE_DASHBOARD_SUPPORT = ENABLE_DASHBOARD_SUPPORT;
+ENABLE_DASHBOARD_SUPPORT = $(ENABLE_DASHBOARD_SUPPORT_$(REAL_PLATFORM_NAME));
+ENABLE_DASHBOARD_SUPPORT_macosx = ENABLE_DASHBOARD_SUPPORT;
 
 ENABLE_DATALIST = $(ENABLE_DATALIST_$(REAL_PLATFORM_NAME));
 ENABLE_DATALIST_macosx = ENABLE_DATALIST;
@@ -95,7 +96,7 @@ ENABLE_MEDIA_SOURCE = ;
 ENABLE_MEDIA_STATISTICS = ;
 ENABLE_METER_TAG = ENABLE_METER_TAG;
 ENABLE_MHTML = ;
-ENABLE_MUTATION_OBSERVERS = ;
+ENABLE_MUTATION_OBSERVERS = ENABLE_MUTATION_OBSERVERS;
 
 ENABLE_NOTIFICATIONS = $(ENABLE_NOTIFICATIONS_$(REAL_PLATFORM_NAME));
 ENABLE_NOTIFICATIONS_macosx = $(ENABLE_NOTIFICATIONS_macosx_$(TARGET_MAC_OS_X_VERSION_MAJOR));
diff --git a/Source/JavaScriptCore/Configurations/Version.xcconfig b/Source/JavaScriptCore/Configurations/Version.xcconfig
index 73fc62d56..7e3f57ea8 100644
--- a/Source/JavaScriptCore/Configurations/Version.xcconfig
+++ b/Source/JavaScriptCore/Configurations/Version.xcconfig
@@ -22,7 +22,7 @@
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
 
 MAJOR_VERSION = 535;
-MINOR_VERSION = 20;
+MINOR_VERSION = 23;
 TINY_VERSION = 0;
 FULL_VERSION = $(MAJOR_VERSION).$(MINOR_VERSION);
 
diff --git a/Source/JavaScriptCore/GNUmakefile.am b/Source/JavaScriptCore/GNUmakefile.am
index 654cd108e..8d6d252d4 100644
--- a/Source/JavaScriptCore/GNUmakefile.am
+++ b/Source/JavaScriptCore/GNUmakefile.am
@@ -57,6 +57,7 @@ javascriptcore_cppflags += \
 	-I$(srcdir)/Source/JavaScriptCore/interpreter \
 	-I$(srcdir)/Source/JavaScriptCore/jit \
 	-I$(srcdir)/Source/JavaScriptCore/jit \
+	-I$(srcdir)/Source/JavaScriptCore/llint \
 	-I$(srcdir)/Source/JavaScriptCore/parser \
 	-I$(srcdir)/Source/JavaScriptCore/profiler \
 	-I$(srcdir)/Source/JavaScriptCore/runtime \
diff --git a/Source/JavaScriptCore/GNUmakefile.list.am b/Source/JavaScriptCore/GNUmakefile.list.am
index 79c68326d..36b64a375 100644
--- a/Source/JavaScriptCore/GNUmakefile.list.am
+++ b/Source/JavaScriptCore/GNUmakefile.list.am
@@ -81,6 +81,7 @@ javascriptcore_sources += \
 	Source/JavaScriptCore/assembler/RepatchBuffer.h \
 	Source/JavaScriptCore/assembler/SH4Assembler.h \
 	Source/JavaScriptCore/assembler/X86Assembler.h \
+	Source/JavaScriptCore/bytecode/BytecodeConventions.h \
 	Source/JavaScriptCore/bytecode/CallLinkInfo.cpp \
 	Source/JavaScriptCore/bytecode/CallLinkInfo.h \
 	Source/JavaScriptCore/bytecode/CallLinkStatus.cpp \
@@ -102,24 +103,31 @@ javascriptcore_sources += \
 	Source/JavaScriptCore/bytecode/Instruction.h \
 	Source/JavaScriptCore/bytecode/JumpTable.cpp \
 	Source/JavaScriptCore/bytecode/JumpTable.h \
+	Source/JavaScriptCore/bytecode/LLIntCallLinkInfo.h \
+	Source/JavaScriptCore/bytecode/LazyOperandValueProfile.cpp \
+	Source/JavaScriptCore/bytecode/LazyOperandValueProfile.h \
 	Source/JavaScriptCore/bytecode/LineInfo.h \
 	Source/JavaScriptCore/bytecode/MethodCallLinkInfo.cpp \
 	Source/JavaScriptCore/bytecode/MethodCallLinkInfo.h \
 	Source/JavaScriptCore/bytecode/MethodCallLinkStatus.cpp \
 	Source/JavaScriptCore/bytecode/MethodCallLinkStatus.h \
+	Source/JavaScriptCore/bytecode/MethodOfGettingAValueProfile.cpp \
+	Source/JavaScriptCore/bytecode/MethodOfGettingAValueProfile.h \
 	Source/JavaScriptCore/bytecode/Opcode.cpp \
 	Source/JavaScriptCore/bytecode/Opcode.h \
+	Source/JavaScriptCore/bytecode/PolymorphicPutByIdList.cpp \
+	Source/JavaScriptCore/bytecode/PolymorphicPutByIdList.h \
 	Source/JavaScriptCore/bytecode/PredictedType.cpp \
 	Source/JavaScriptCore/bytecode/PredictedType.h \
 	Source/JavaScriptCore/bytecode/PredictionTracker.h \
 	Source/JavaScriptCore/bytecode/PutByIdStatus.cpp \
 	Source/JavaScriptCore/bytecode/PutByIdStatus.h \
+	Source/JavaScriptCore/bytecode/PutKind.h \
 	Source/JavaScriptCore/bytecode/SamplingTool.cpp \
 	Source/JavaScriptCore/bytecode/SamplingTool.h \
 	Source/JavaScriptCore/bytecode/StructureSet.h \
 	Source/JavaScriptCore/bytecode/StructureStubInfo.cpp \
 	Source/JavaScriptCore/bytecode/StructureStubInfo.h \
-	Source/JavaScriptCore/bytecode/ValueProfile.cpp \
 	Source/JavaScriptCore/bytecode/ValueProfile.h \
 	Source/JavaScriptCore/bytecode/ValueRecovery.h \
 	Source/JavaScriptCore/bytecode/VirtualRegister.h \
@@ -132,6 +140,8 @@ javascriptcore_sources += \
 	Source/JavaScriptCore/dfg/DFGAbstractState.cpp \
 	Source/JavaScriptCore/dfg/DFGAbstractState.h \
 	Source/JavaScriptCore/dfg/DFGAbstractValue.h \
+	Source/JavaScriptCore/dfg/DFGArithNodeFlagsInferencePhase.cpp \
+	Source/JavaScriptCore/dfg/DFGArithNodeFlagsInferencePhase.h \
 	Source/JavaScriptCore/dfg/DFGAssemblyHelpers.cpp \
 	Source/JavaScriptCore/dfg/DFGAssemblyHelpers.h \
 	Source/JavaScriptCore/dfg/DFGBasicBlock.h \
@@ -141,9 +151,13 @@ javascriptcore_sources += \
 	Source/JavaScriptCore/dfg/DFGCCallHelpers.h \
 	Source/JavaScriptCore/dfg/DFGCapabilities.cpp \
 	Source/JavaScriptCore/dfg/DFGCapabilities.h \
+	Source/JavaScriptCore/dfg/DFGCFAPhase.cpp \
+	Source/JavaScriptCore/dfg/DFGCFAPhase.h \
 	Source/JavaScriptCore/dfg/DFGCommon.h \
 	Source/JavaScriptCore/dfg/DFGCorrectableJumpPoint.cpp \
 	Source/JavaScriptCore/dfg/DFGCorrectableJumpPoint.h \
+	Source/JavaScriptCore/dfg/DFGCSEPhase.cpp \
+	Source/JavaScriptCore/dfg/DFGCSEPhase.h \
 	Source/JavaScriptCore/dfg/DFGDriver.cpp \
 	Source/JavaScriptCore/dfg/DFGDriver.h \
 	Source/JavaScriptCore/dfg/DFGFPRInfo.h \
@@ -167,8 +181,10 @@ javascriptcore_sources += \
 	Source/JavaScriptCore/dfg/DFGOSRExitCompiler.h \
 	Source/JavaScriptCore/dfg/DFGOSRExit.h \
 	Source/JavaScriptCore/dfg/DFGOSRExit.cpp \
-	Source/JavaScriptCore/dfg/DFGPropagator.cpp \
-	Source/JavaScriptCore/dfg/DFGPropagator.h \
+	Source/JavaScriptCore/dfg/DFGPhase.cpp \
+	Source/JavaScriptCore/dfg/DFGPhase.h \
+	Source/JavaScriptCore/dfg/DFGPredictionPropagationPhase.cpp \
+	Source/JavaScriptCore/dfg/DFGPredictionPropagationPhase.h \
 	Source/JavaScriptCore/dfg/DFGRegisterBank.h \
 	Source/JavaScriptCore/dfg/DFGRepatch.cpp \
 	Source/JavaScriptCore/dfg/DFGRepatch.h \
@@ -180,15 +196,19 @@ javascriptcore_sources += \
 	Source/JavaScriptCore/dfg/DFGThunks.cpp \
 	Source/JavaScriptCore/dfg/DFGThunks.h \
 	Source/JavaScriptCore/dfg/DFGVariableAccessData.h \
-	Source/JavaScriptCore/heap/BumpBlock.h \
-	Source/JavaScriptCore/heap/BumpSpace.cpp \
-	Source/JavaScriptCore/heap/BumpSpace.h \
-	Source/JavaScriptCore/heap/BumpSpaceInlineMethods.h \
+	Source/JavaScriptCore/dfg/DFGVirtualRegisterAllocationPhase.cpp \
+	Source/JavaScriptCore/dfg/DFGVirtualRegisterAllocationPhase.h \
+	Source/JavaScriptCore/heap/CopiedAllocator.h \
+	Source/JavaScriptCore/heap/CopiedBlock.h \
+	Source/JavaScriptCore/heap/CopiedSpace.cpp \
+	Source/JavaScriptCore/heap/CopiedSpace.h \
+	Source/JavaScriptCore/heap/CopiedSpaceInlineMethods.h \
 	Source/JavaScriptCore/heap/CardSet.h \
 	Source/JavaScriptCore/heap/ConservativeRoots.cpp \
 	Source/JavaScriptCore/heap/ConservativeRoots.h \
 	Source/JavaScriptCore/heap/DFGCodeBlocks.cpp \
 	Source/JavaScriptCore/heap/DFGCodeBlocks.h \
+	Source/JavaScriptCore/heap/GCAssertions.h \
 	Source/JavaScriptCore/heap/Handle.h \
 	Source/JavaScriptCore/heap/HandleHeap.cpp \
 	Source/JavaScriptCore/heap/HandleHeap.h \
@@ -207,14 +227,15 @@ javascriptcore_sources += \
 	Source/JavaScriptCore/heap/MarkStack.cpp \
 	Source/JavaScriptCore/heap/MarkStack.h \
 	Source/JavaScriptCore/heap/HeapRootVisitor.h \
-    Source/JavaScriptCore/heap/MarkedAllocator.cpp \
-    Source/JavaScriptCore/heap/MarkedAllocator.h \
+	Source/JavaScriptCore/heap/MarkedAllocator.cpp \
+	Source/JavaScriptCore/heap/MarkedAllocator.h \
 	Source/JavaScriptCore/heap/MarkedBlock.cpp \
 	Source/JavaScriptCore/heap/MarkedBlock.h \
 	Source/JavaScriptCore/heap/MarkedBlockSet.h \
 	Source/JavaScriptCore/heap/TinyBloomFilter.h \
 	Source/JavaScriptCore/heap/MarkedSpace.cpp \
 	Source/JavaScriptCore/heap/MarkedSpace.h \
+	Source/JavaScriptCore/heap/PassWeak.h \
 	Source/JavaScriptCore/heap/Strong.h \
 	Source/JavaScriptCore/heap/StrongInlines.h \
 	Source/JavaScriptCore/heap/UnconditionalFinalizer.h \
@@ -281,6 +302,8 @@ javascriptcore_sources += \
 	Source/JavaScriptCore/jit/CompactJITCodeMap.h \
 	Source/JavaScriptCore/jit/ExecutableAllocator.cpp \
 	Source/JavaScriptCore/jit/ExecutableAllocator.h \
+	Source/JavaScriptCore/jit/HostCallReturnValue.cpp \
+	Source/JavaScriptCore/jit/HostCallReturnValue.h \
 	Source/JavaScriptCore/jit/JITArithmetic32_64.cpp \
 	Source/JavaScriptCore/jit/JITArithmetic.cpp \
 	Source/JavaScriptCore/jit/JITCall32_64.cpp \
@@ -304,6 +327,7 @@ javascriptcore_sources += \
 	Source/JavaScriptCore/jit/SpecializedThunkJIT.h \
 	Source/JavaScriptCore/jit/ThunkGenerators.cpp \
 	Source/JavaScriptCore/jit/ThunkGenerators.h \
+	Source/JavaScriptCore/llint/LLIntData.h \
 	Source/JavaScriptCore/os-win32/stdbool.h \
 	Source/JavaScriptCore/os-win32/stdint.h \
 	Source/JavaScriptCore/parser/ASTBuilder.h \
@@ -354,6 +378,7 @@ javascriptcore_sources += \
 	Source/JavaScriptCore/runtime/CallData.cpp \
 	Source/JavaScriptCore/runtime/CallData.h \
 	Source/JavaScriptCore/runtime/ClassInfo.h \
+	Source/JavaScriptCore/runtime/CodeSpecializationKind.h \
 	Source/JavaScriptCore/runtime/CommonIdentifiers.cpp \
 	Source/JavaScriptCore/runtime/CommonIdentifiers.h \
 	Source/JavaScriptCore/runtime/CommonSlowPaths.h \
@@ -382,6 +407,7 @@ javascriptcore_sources += \
 	Source/JavaScriptCore/runtime/ExceptionHelpers.h \
 	Source/JavaScriptCore/runtime/Executable.cpp \
 	Source/JavaScriptCore/runtime/Executable.h \
+	Source/JavaScriptCore/runtime/ExecutionHarness.h \
 	Source/JavaScriptCore/runtime/FunctionConstructor.cpp \
 	Source/JavaScriptCore/runtime/FunctionConstructor.h \
 	Source/JavaScriptCore/runtime/FunctionPrototype.cpp \
@@ -564,6 +590,8 @@ javascriptcore_sources += \
 	Source/JavaScriptCore/wtf/CurrentTime.h \
 	Source/JavaScriptCore/wtf/DateMath.cpp \
 	Source/JavaScriptCore/wtf/DateMath.h \
+	Source/JavaScriptCore/wtf/DataLog.cpp \
+	Source/JavaScriptCore/wtf/DataLog.h \
 	Source/JavaScriptCore/wtf/DecimalNumber.cpp \
 	Source/JavaScriptCore/wtf/DecimalNumber.h \
 	Source/JavaScriptCore/wtf/Decoder.h \
diff --git a/Source/JavaScriptCore/JSCTypedArrayStubs.h b/Source/JavaScriptCore/JSCTypedArrayStubs.h
new file mode 100644
index 000000000..cda55fc9b
--- /dev/null
+++ b/Source/JavaScriptCore/JSCTypedArrayStubs.h
@@ -0,0 +1,202 @@
+/*
+ * Copyright (C) 2012 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef JSCTypedArrayStubs_h
+#define JSCTypedArrayStubs_h
+
+#include "Float32Array.h"
+#include "Float64Array.h"
+#include "Int16Array.h"
+#include "Int32Array.h"
+#include "Int8Array.h"
+#include "JSObject.h"
+#include "ObjectPrototype.h"
+#include "Uint16Array.h"
+#include "Uint32Array.h"
+#include "Uint8Array.h"
+
+namespace JSC {
+
+#define TYPED_ARRAY(name, type) \
+class JS##name##Array : public JSNonFinalObject { \
+public: \
+    typedef JSNonFinalObject Base; \
+    static JS##name##Array* create(JSC::Structure* structure, JSGlobalObject* globalObject, PassRefPtr<name##Array> impl) \
+    { \
+        JS##name##Array* ptr = new (NotNull, JSC::allocateCell<JS##name##Array>(globalObject->globalData().heap)) JS##name##Array(structure, globalObject, impl); \
+        ptr->finishCreation(globalObject->globalData()); \
+        return ptr; \
+    }\
+\
+    static bool getOwnPropertySlot(JSC::JSCell*, JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);\
+    static bool getOwnPropertyDescriptor(JSC::JSObject*, JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);\
+    static bool getOwnPropertySlotByIndex(JSC::JSCell*, JSC::ExecState*, unsigned propertyName, JSC::PropertySlot&);\
+    static void put(JSC::JSCell*, JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);\
+    static void putByIndex(JSC::JSCell*, JSC::ExecState*, unsigned propertyName, JSC::JSValue);\
+    static const JSC::ClassInfo s_info;\
+\
+    static JSC::Structure* createStructure(JSC::JSGlobalData& globalData, JSC::JSGlobalObject* globalObject, JSC::JSValue prototype)\
+    {\
+        return JSC::Structure::create(globalData, globalObject, prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), &s_info);\
+    }\
+\
+    static void getOwnPropertyNames(JSC::JSObject*, JSC::ExecState*, JSC::PropertyNameArray&, JSC::EnumerationMode mode = JSC::ExcludeDontEnumProperties);\
+    static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);\
+\
+    static const JSC::TypedArrayType TypedArrayStorageType = JSC::TypedArray##name;\
+    uint32_t m_storageLength;\
+    type* m_storage;\
+    RefPtr<name##Array> m_impl;\
+protected:\
+    JS##name##Array(JSC::Structure*, JSGlobalObject*, PassRefPtr<name##Array>);\
+    void finishCreation(JSC::JSGlobalData&);\
+    static const unsigned StructureFlags = JSC::OverridesGetPropertyNames | JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;\
+    JSC::JSValue getByIndex(JSC::ExecState*, unsigned index);\
+    void indexSetter(JSC::ExecState*, unsigned index, JSC::JSValue);\
+};\
+\
+const ClassInfo JS##name##Array::s_info = { #name "Array" , &Base::s_info, 0, 0, CREATE_METHOD_TABLE(JS##name##Array) };\
+\
+JS##name##Array::JS##name##Array(Structure* structure, JSGlobalObject* globalObject, PassRefPtr<name##Array> impl)\
+    : Base(globalObject->globalData(), structure)\
+    , m_impl(impl)\
+{\
+}\
+\
+void JS##name##Array::finishCreation(JSGlobalData& globalData)\
+{\
+    Base::finishCreation(globalData);\
+    TypedArrayDescriptor descriptor(&JS##name##Array::s_info, OBJECT_OFFSETOF(JS##name##Array, m_storage), OBJECT_OFFSETOF(JS##name##Array, m_storageLength));\
+    globalData.registerTypedArrayDescriptor(m_impl.get(), descriptor);\
+    m_storage = m_impl->data();\
+    m_storageLength = m_impl->length();\
+    putDirect(globalData, globalData.propertyNames->length, jsNumber(m_storageLength), DontDelete | ReadOnly | DontEnum); \
+    ASSERT(inherits(&s_info));\
+}\
+\
+bool JS##name##Array::getOwnPropertySlot(JSCell* cell, ExecState* exec, const Identifier& propertyName, PropertySlot& slot)\
+{\
+    JS##name##Array* thisObject = jsCast<JS##name##Array*>(cell);\
+    ASSERT_GC_OBJECT_INHERITS(thisObject, &s_info);\
+    bool ok;\
+    unsigned index = propertyName.toUInt32(ok);\
+    if (ok && index < thisObject->m_storageLength) {\
+        slot.setValue(thisObject->getByIndex(exec, index));\
+        return true;\
+    }\
+    return Base::getOwnPropertySlot(cell, exec, propertyName, slot);\
+}\
+\
+bool JS##name##Array::getOwnPropertyDescriptor(JSObject* object, ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)\
+{\
+    JS##name##Array* thisObject = jsCast<JS##name##Array*>(object);\
+    ASSERT_GC_OBJECT_INHERITS(thisObject, &s_info);\
+    bool ok;\
+    unsigned index = propertyName.toUInt32(ok);\
+    if (ok && index < thisObject->m_storageLength) {\
+        descriptor.setDescriptor(thisObject->getByIndex(exec, index), DontDelete);\
+        return true;\
+    }\
+    return Base::getOwnPropertyDescriptor(object, exec, propertyName, descriptor);\
+}\
+\
+bool JS##name##Array::getOwnPropertySlotByIndex(JSCell* cell, ExecState* exec, unsigned propertyName, PropertySlot& slot)\
+{\
+    JS##name##Array* thisObject = jsCast<JS##name##Array*>(cell);\
+    ASSERT_GC_OBJECT_INHERITS(thisObject, &s_info);\
+    if (propertyName < thisObject->m_storageLength) {\
+        slot.setValue(thisObject->getByIndex(exec, propertyName));\
+        return true;\
+    }\
+    return thisObject->methodTable()->getOwnPropertySlot(thisObject, exec, Identifier::from(exec, propertyName), slot);\
+}\
+\
+void JS##name##Array::put(JSCell* cell, ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)\
+{\
+    JS##name##Array* thisObject = jsCast<JS##name##Array*>(cell);\
+    ASSERT_GC_OBJECT_INHERITS(thisObject, &s_info);\
+    bool ok;\
+    unsigned index = propertyName.toUInt32(ok);\
+    if (ok) {\
+        thisObject->indexSetter(exec, index, value);\
+        return;\
+    }\
+    Base::put(thisObject, exec, propertyName, value, slot);\
+}\
+\
+void JS##name##Array::indexSetter(JSC::ExecState* exec, unsigned index, JSC::JSValue value) \
+{\
+    m_impl->set(index, value.toNumber(exec));\
+}\
+\
+void JS##name##Array::putByIndex(JSCell* cell, ExecState* exec, unsigned propertyName, JSValue value)\
+{\
+    JS##name##Array* thisObject = jsCast<JS##name##Array*>(cell);\
+    ASSERT_GC_OBJECT_INHERITS(thisObject, &s_info);\
+    thisObject->indexSetter(exec, propertyName, value);\
+    return;\
+}\
+\
+void JS##name##Array::getOwnPropertyNames(JSObject* object, ExecState* exec, PropertyNameArray& propertyNames, EnumerationMode mode)\
+{\
+    JS##name##Array* thisObject = jsCast<JS##name##Array*>(object);\
+    ASSERT_GC_OBJECT_INHERITS(thisObject, &s_info);\
+    for (unsigned i = 0; i < thisObject->m_storageLength; ++i)\
+        propertyNames.add(Identifier::from(exec, i));\
+    Base::getOwnPropertyNames(thisObject, exec, propertyNames, mode);\
+}\
+\
+JSValue JS##name##Array::getByIndex(ExecState*, unsigned index)\
+{\
+    ASSERT_GC_OBJECT_INHERITS(this, &s_info);\
+    type result = m_impl->item(index);\
+    if (isnan((double)result))\
+        return jsNaN();\
+    return JSValue(result);\
+}\
+static EncodedJSValue JSC_HOST_CALL constructJS##name##Array(ExecState* callFrame) { \
+    if (callFrame->argumentCount() < 1) \
+        return JSValue::encode(jsUndefined()); \
+    int32_t length = callFrame->argument(0).toInt32(callFrame); \
+    if (length < 0) \
+        return JSValue::encode(jsUndefined()); \
+    Structure* structure = JS##name##Array::createStructure(callFrame->globalData(), callFrame->lexicalGlobalObject(), callFrame->lexicalGlobalObject()->objectPrototype()); \
+    return JSValue::encode(JS##name##Array::create(structure, callFrame->lexicalGlobalObject(), name##Array::create(length)));\
+}
+
+#if ENABLE(COMMANDLINE_TYPEDARRAYS)
+TYPED_ARRAY(Uint8, uint8_t);
+TYPED_ARRAY(Uint16, uint16_t);
+TYPED_ARRAY(Uint32, uint32_t);
+TYPED_ARRAY(Int8, int8_t);
+TYPED_ARRAY(Int16, int16_t);
+TYPED_ARRAY(Int32, int32_t);
+TYPED_ARRAY(Float32, float);
+TYPED_ARRAY(Float64, double);
+#endif
+
+}
+
+#endif
diff --git a/Source/JavaScriptCore/JavaScriptCore.gypi b/Source/JavaScriptCore/JavaScriptCore.gypi
index b59be38d9..e19dfb67a 100644
--- a/Source/JavaScriptCore/JavaScriptCore.gypi
+++ b/Source/JavaScriptCore/JavaScriptCore.gypi
@@ -27,10 +27,12 @@
             'API/OpaqueJSString.h',
             'assembler/MacroAssemblerCodeRef.h',
             'bytecode/Opcode.h',
-            'heap/BumpBlock.h',
-            'heap/BumpSpace.h',
-            'heap/BumpSpaceInlineMethods.h',
+            'heap/CopiedAllocator.h',
+            'heap/CopiedBlock.h',
+            'heap/CopiedSpace.h',
+            'heap/CopiedSpaceInlineMethods.h',
             'heap/ConservativeRoots.h',
+            'heap/GCAssertions.h',
             'heap/Handle.h',
             'heap/HandleHeap.h',
             'heap/HeapBlock.h',
@@ -155,6 +157,7 @@
             'wtf/DateMath.h',
             'wtf/DecimalNumber.h',
             'wtf/Decoder.h',
+            'wtf/DataLog.h',
             'wtf/Deque.h',
             'wtf/DisallowCType.h',
             'wtf/DoublyLinkedList.h',
@@ -560,6 +563,7 @@
             'wtf/CurrentTime.cpp',
             'wtf/DateMath.cpp',
             'wtf/DecimalNumber.cpp',
+            'wtf/DataLog.cpp',
             'wtf/DynamicAnnotations.cpp',
             'wtf/DynamicAnnotations.h',
             'wtf/FastMalloc.cpp',
diff --git a/Source/JavaScriptCore/JavaScriptCore.order b/Source/JavaScriptCore/JavaScriptCore.order
index d8513d099..e1e1f231a 100644
--- a/Source/JavaScriptCore/JavaScriptCore.order
+++ b/Source/JavaScriptCore/JavaScriptCore.order
@@ -58,6 +58,7 @@ __ZN3WTF5Mutex6unlockEv
 __ZN3WTF10StringImpl12sharedBufferEv
 __ZN3WTF10StringImpl8endsWithEPS0_b
 __ZN3WTF12createThreadEPFPvS0_ES0_PKc
+__ZN3WTF12createThreadEPFvPvES0_PKc
 __ZN3WTF20createThreadInternalEPFPvS0_ES0_PKc
 __ZN3WTFL35establishIdentifierForPthreadHandleERKP17_opaque_pthread_t
 __ZN3WTF9HashTableIjSt4pairIjP17_opaque_pthread_tENS_18PairFirstExtractorIS4_EENS_7IntHashIjEENS_14PairHashTraitsINS_10HashTraitsIjEENSA_IS3_EEEESB_E6rehashEi
@@ -1144,6 +1145,7 @@ __ZNK3JSC8JSString8toNumberEPNS_9ExecStateE
 __ZN3JSC10jsToNumberERKNS_7UStringE
 __ZN3JSCL19jsStrDecimalLiteralERPKtS1_
 __ZN3WTF22cancelCallOnMainThreadEPFvPvES0_
+__ZN3WTF22isMainThreadOrGCThreadEv
 __ZNK3JSC8JSString9toBooleanEPNS_9ExecStateE
 __ZN3WTF10StringImpl4findEPFbtEj
 __ZN3WTF10StringImpl4findEPKcj
@@ -1152,6 +1154,7 @@ __ZN3WTF10fastStrDupEPKc
 __ZN3JSC10Identifier11addSlowCaseEPNS_12JSGlobalDataEPN3WTF10StringImplE
 _JSStringRetain
 ___initializeScavenger_block_invoke_1
+__ZN3WTF23waitForThreadCompletionEj
 __ZN3WTF23waitForThreadCompletionEjPPv
 _JSObjectCopyPropertyNames
 __ZN3JSC8JSObject16getPropertyNamesEPNS_9ExecStateERNS_17PropertyNameArrayENS_15EnumerationModeE
diff --git a/Source/JavaScriptCore/JavaScriptCore.pri b/Source/JavaScriptCore/JavaScriptCore.pri
index 4e2426f8f..eeace1764 100644
--- a/Source/JavaScriptCore/JavaScriptCore.pri
+++ b/Source/JavaScriptCore/JavaScriptCore.pri
@@ -20,6 +20,7 @@ INCLUDEPATH += \
     $$SOURCE_DIR/debugger \
     $$SOURCE_DIR/interpreter \
     $$SOURCE_DIR/jit \
+    $$SOURCE_DIR/llint \
     $$SOURCE_DIR/parser \
     $$SOURCE_DIR/profiler \
     $$SOURCE_DIR/runtime \
@@ -30,7 +31,6 @@ INCLUDEPATH += \
     $$JAVASCRIPTCORE_GENERATED_SOURCES_DIR
 
 win32-* {
-    DEFINES += _HAS_TR1=0
     LIBS += -lwinmm
 
     win32-g++* {
diff --git a/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def b/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def
index ad4c02634..acdf47b7c 100644
--- a/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def
+++ b/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def
@@ -1,5 +1,7 @@
 EXPORTS
 
+    ??$strtod@$00@WTF@@YANPBDPAPAD@Z
+    ??$strtod@$0A@@WTF@@YANPBDPAPAD@Z
     ??0ArrayBufferView@WTF@@IAE@V?$PassRefPtr@VArrayBuffer@WTF@@@1@I@Z
     ??0CString@WTF@@QAE@PBD@Z
     ??0CString@WTF@@QAE@PBDI@Z
@@ -122,6 +124,7 @@ EXPORTS
     ?createTable@HashTable@JSC@@ABEXPAVJSGlobalData@2@@Z
     ?createThread@WTF@@YAIP6APAXPAX@Z0@Z
     ?createThread@WTF@@YAIP6APAXPAX@Z0PBD@Z
+    ?createThread@WTF@@YAIP6AXPAX@Z0PBD@Z
     ?createTypeError@JSC@@YAPAVJSObject@1@PAVExecState@1@ABVUString@1@@Z
     ?cryptographicallyRandomNumber@WTF@@YAIXZ
     ?cryptographicallyRandomValues@WTF@@YAXPAXI@Z
@@ -129,6 +132,7 @@ EXPORTS
     ?currentThreadIsHoldingLock@JSLock@JSC@@SA_NXZ
     ?currentTime@WTF@@YANXZ
     ?data@CString@WTF@@QBEPBDXZ
+    ?dataLog@WTF@@YAXPBDZZ
     ?dateToDaysFrom1970@WTF@@YANHHH@Z
     ?dayInMonthFromDayInYear@WTF@@YAHH_N@Z
     ?dayInYear@WTF@@YAHNH@Z
@@ -150,8 +154,8 @@ EXPORTS
     ?despecifyFunctionTransition@Structure@JSC@@SAPAV12@AAVJSGlobalData@2@PAV12@ABVIdentifier@2@@Z
     ?destroy@Heap@JSC@@QAEXXZ
     ?destroy@JSByteArray@JSC@@SAXPAVJSCell@2@@Z
+    ?destroy@JSCell@JSC@@KAXPAV12@@Z
     ?destroy@JSGlobalObject@JSC@@SAXPAVJSCell@2@@Z
-    ?destroy@JSNonFinalObject@JSC@@SAXPAVJSCell@2@@Z
     ?detach@Debugger@JSC@@UAEXPAVJSGlobalObject@2@@Z
     ?detachThread@WTF@@YAXI@Z
     ?didTimeOut@TimeoutChecker@JSC@@QAE_NPAVExecState@2@@Z
@@ -189,6 +193,7 @@ EXPORTS
     ?functionName@DebuggerCallFrame@JSC@@QBEPBVUString@2@XZ
     ?get@Structure@JSC@@QAEIAAVJSGlobalData@2@ABVIdentifier@2@AAIAAPAVJSCell@2@@Z
     ?get@Structure@JSC@@QAEIAAVJSGlobalData@2@PAVStringImpl@WTF@@AAIAAPAVJSCell@2@@Z
+    ?getCalculatedDisplayName@JSC@@YA?AVUString@1@PAVExecState@1@PAVJSObject@1@@Z
     ?getCallData@JSCell@JSC@@SA?AW4CallType@2@PAV12@AATCallData@2@@Z
     ?getConstructData@JSCell@JSC@@SA?AW4ConstructType@2@PAV12@AATConstructData@2@@Z
     ?getObject@JSCell@JSC@@QAEPAVJSObject@2@XZ
@@ -206,6 +211,7 @@ EXPORTS
     ?getPropertyDescriptor@JSObject@JSC@@QAE_NPAVExecState@2@ABVIdentifier@2@AAVPropertyDescriptor@2@@Z
     ?getPropertyNames@JSObject@JSC@@SAXPAV12@PAVExecState@2@AAVPropertyNameArray@2@W4EnumerationMode@2@@Z
     ?getSlice@ArgList@JSC@@QBEXHAAV12@@Z
+    ?getStackTrace@Interpreter@JSC@@SAXPAVJSGlobalData@2@HAAV?$Vector@UStackFrame@JSC@@$0A@@WTF@@@Z
     ?getString@JSCell@JSC@@QBE?AVUString@2@PAVExecState@2@@Z
     ?getString@JSCell@JSC@@QBE_NPAVExecState@2@AAVUString@2@@Z
     ?getter@PropertyDescriptor@JSC@@QBE?AVJSValue@2@XZ
@@ -319,10 +325,9 @@ EXPORTS
     ?startSampling@JSGlobalData@JSC@@QAEXXZ
     ?stopProfiling@Profiler@JSC@@QAE?AV?$PassRefPtr@VProfile@JSC@@@WTF@@PAVExecState@2@ABVUString@2@@Z
     ?stopSampling@JSGlobalData@JSC@@QAEXXZ
-    ?strtod@WTF@@YANPBDPAPAD@Z
     ?substringSharingImpl@UString@JSC@@QBE?AV12@II@Z
     ?symbolTableGet@JSVariableObject@JSC@@IAE_NABVIdentifier@2@AAVPropertyDescriptor@2@@Z
-    ?synthesizePrototype@JSValue@JSC@@ABEPAVJSObject@2@PAVExecState@2@@Z
+    ?synthesizePrototype@JSValue@JSC@@QBEPAVJSObject@2@PAVExecState@2@@Z
     ?thisObject@DebuggerCallFrame@JSC@@QBEPAVJSObject@2@XZ
     ?throwError@JSC@@YA?AVJSValue@1@PAVExecState@1@V21@@Z
     ?throwError@JSC@@YAPAVJSObject@1@PAVExecState@1@PAV21@@Z
@@ -361,6 +366,7 @@ EXPORTS
     ?visitChildren@JSGlobalThis@JSC@@KAXPAVJSCell@2@AAVSlotVisitor@2@@Z
     ?visitChildren@JSObject@JSC@@SAXPAVJSCell@2@AAVSlotVisitor@2@@Z
     ?wait@ThreadCondition@WTF@@QAEXAAVMutex@2@@Z
+    ?waitForThreadCompletion@WTF@@YAHI@Z
     ?waitForThreadCompletion@WTF@@YAHIPAPAX@Z
     ?writable@PropertyDescriptor@JSC@@QBE_NXZ
     ?writeBarrier@HandleHeap@JSC@@QAEXPAVJSValue@2@ABV32@@Z
diff --git a/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj b/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj
index bee218833..b9e0f3152 100644
--- a/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj
+++ b/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj
@@ -1478,6 +1478,22 @@
 			Name="bytecode"
 			>
 			<File
+				RelativePath="..\..\bytecode\MethodOfGettingAValueProfile.cpp"
+				>
+			</File>
+			<File
+				RelativePath="..\..\bytecode\MethodOfGettingAValueProfile.h"
+				>
+			</File>
+			<File
+				RelativePath="..\..\bytecode\LazyOperandValueProfile.cpp"
+				>
+			</File>
+			<File
+				RelativePath="..\..\bytecode\LazyOperandValueProfile.h"
+				>
+			</File>
+			<File
 				RelativePath="..\..\bytecode\GetByIdStatus.h"
 				>
 			</File>
@@ -1586,6 +1602,10 @@
 				>
 			</File>
 			<File
+				RelativePath="..\..\bytecode\PolymorphicPutByIdList.cpp"
+				>
+			</File>
+			<File
 				RelativePath="..\..\bytecode\PredictedType.cpp"
 				>
 			</File>
@@ -1610,10 +1630,6 @@
 				>
 			</File>
 			<File
-				RelativePath="..\..\bytecode\ValueProfile.cpp"
-				>
-			</File>
-			<File
 				RelativePath="..\..\bytecode\ValueProfile.h"
 				>
 			</File>
@@ -1758,6 +1774,10 @@
 				>
 			</File>
 			<File
+				RelativePath="..\..\jit\HostCallReturnValue.cpp"
+				>
+			</File>
+			<File
 				RelativePath="..\..\jit\JIT.cpp"
 				>
 			</File>
@@ -1843,6 +1863,14 @@
 			</File>
 		</Filter>
 		<Filter
+			Name="llint"
+			>
+			<File
+				RelativePath="..\..\llint\LLIntData.h"
+				>
+			</File>
+		</Filter>
+		<Filter
 			Name="interpreter"
 			>
 			<File
@@ -2034,19 +2062,23 @@
 			Name="heap"
 			>
                             <File
-                                    RelativePath="..\..\heap\BumpBlock.h"
+                                    RelativePath="..\..\heap\CopiedAllocator.h"
+                                    >
+                            </File>
+                            <File
+                                    RelativePath="..\..\heap\CopiedBlock.h"
                                     >
                             </File>
                             <File
-                                    RelativePath="..\..\heap\BumpSpace.cpp"
+                                    RelativePath="..\..\heap\CopiedSpace.cpp"
                                     >
                             </File>
                             <File
-                                    RelativePath="..\..\heap\BumpSpace.h"
+                                    RelativePath="..\..\heap\CopiedSpace.h"
                                     >
                             </File>
                             <File
-                                    RelativePath="..\..\heap\BumpSpaceInlineMethods.h"
+                                    RelativePath="..\..\heap\CopiedSpaceInlineMethods.h"
                                     >
                             </File>
                             <File
@@ -2058,6 +2090,10 @@
                                     >
                             </File>
                             <File
+                                    RelativePath="..\..\heap\GCAssertions.h"
+                                    >
+                            </File>
+                            <File
                                     RelativePath="..\..\heap\MachineStackMarker.cpp"
                                     >
                             </File>
diff --git a/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreCommon.vsprops b/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreCommon.vsprops
index 33b53442a..b0b45d38d 100644
--- a/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreCommon.vsprops
+++ b/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreCommon.vsprops
@@ -6,7 +6,7 @@
 	>
 	<Tool
 		Name="VCCLCompilerTool"
-		AdditionalIncludeDirectories="&quot;$(ConfigurationBuildDir)\obj\JavaScriptCore\DerivedSources\&quot;;../../;../../API/;../../parser/;../../bytecompiler/;../../dfg/;../../jit/;../../runtime/;../../tools/;../../bytecode/;../../interpreter/;../../wtf/;../../profiler;../../assembler/;../../debugger/;../../heap/;&quot;$(WebKitLibrariesDir)\include&quot;;&quot;$(WebKitLibrariesDir)\include\private&quot;;&quot;$(ConfigurationBuildDir)\include&quot;;&quot;$(ConfigurationBuildDir)\include\JavaScriptCore&quot;;&quot;$(ConfigurationBuildDir)\include\private&quot;;&quot;$(WebKitLibrariesDir)\include\pthreads&quot;"
+		AdditionalIncludeDirectories="&quot;$(ConfigurationBuildDir)\obj\JavaScriptCore\DerivedSources\&quot;;../../;../../API/;../../parser/;../../bytecompiler/;../../dfg/;../../jit/;../../llint/;../../runtime/;../../tools/;../../bytecode/;../../interpreter/;../../wtf/;../../profiler;../../assembler/;../../debugger/;../../heap/;&quot;$(WebKitLibrariesDir)\include&quot;;&quot;$(WebKitLibrariesDir)\include\private&quot;;&quot;$(ConfigurationBuildDir)\include&quot;;&quot;$(ConfigurationBuildDir)\include\JavaScriptCore&quot;;&quot;$(ConfigurationBuildDir)\include\private&quot;;&quot;$(WebKitLibrariesDir)\include\pthreads&quot;"
 		PreprocessorDefinitions="__STD_C"
 		ForcedIncludeFiles="ICUVersion.h"
 	/>
diff --git a/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/copy-files.cmd b/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/copy-files.cmd
index 0ed8c63f5..2c0cfad02 100755
--- a/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/copy-files.cmd
+++ b/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/copy-files.cmd
@@ -43,6 +43,7 @@ for %%d in (
     debugger
     interpreter
     jit
+    llint
     parser
     profiler
     runtime
diff --git a/Source/JavaScriptCore/JavaScriptCore.vcproj/WTF/WTF.vcproj b/Source/JavaScriptCore/JavaScriptCore.vcproj/WTF/WTF.vcproj
index c914b22c1..5689b2608 100644
--- a/Source/JavaScriptCore/JavaScriptCore.vcproj/WTF/WTF.vcproj
+++ b/Source/JavaScriptCore/JavaScriptCore.vcproj/WTF/WTF.vcproj
@@ -733,6 +733,14 @@
 			>
 		</File>
 		<File
+			RelativePath="..\..\wtf\DataLog.cpp"
+			>
+		</File>
+		<File
+			RelativePath="..\..\wtf\DataLog.h"
+			>
+		</File>
+		<File
 			RelativePath="..\..\wtf\Deque.h"
 			>
 		</File>
diff --git a/Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj b/Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj
index 997b0bbf4..d9d8e1631 100644
--- a/Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj
+++ b/Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj
@@ -7,6 +7,15 @@
 	objects = {
 
 /* Begin PBXAggregateTarget section */
+		0F4680A914BA7FD900BFE272 /* LLInt Offsets */ = {
+			isa = PBXAggregateTarget;
+			buildConfigurationList = 0F4680AC14BA7FD900BFE272 /* Build configuration list for PBXAggregateTarget "LLInt Offsets" */;
+			buildPhases = (
+				0F4680AA14BA7FD900BFE272 /* Generate Derived Sources */,
+			);
+			name = "LLInt Offsets";
+			productName = "Derived Sources";
+		};
 		65FB3F6609D11E9100F49DEB /* Derived Sources */ = {
 			isa = PBXAggregateTarget;
 			buildConfigurationList = 65FB3F7709D11EBD00F49DEB /* Build configuration list for PBXAggregateTarget "Derived Sources" */;
@@ -14,6 +23,9 @@
 				65FB3F6509D11E9100F49DEB /* Generate Derived Sources */,
 				5D35DEE10C7C140B008648B2 /* Generate DTrace header */,
 			);
+			dependencies = (
+				0FF922D614F46B600041A24E /* PBXTargetDependency */,
+			);
 			name = "Derived Sources";
 			productName = "Derived Sources";
 		};
@@ -48,6 +60,10 @@
 		0BAC94A01338728400CF135B /* ThreadRestrictionVerifier.h in Headers */ = {isa = PBXBuildFile; fileRef = 0BAC949E1338728400CF135B /* ThreadRestrictionVerifier.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		0BCD83571485845200EA2003 /* TemporaryChange.h in Headers */ = {isa = PBXBuildFile; fileRef = 0BCD83541485841200EA2003 /* TemporaryChange.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		0BF28A2911A33DC300638F84 /* SizeLimits.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0BF28A2811A33DC300638F84 /* SizeLimits.cpp */; };
+		0F0B839A14BCF45D00885B4F /* LLIntEntrypoints.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F0B839514BCF45A00885B4F /* LLIntEntrypoints.cpp */; };
+		0F0B839B14BCF46000885B4F /* LLIntEntrypoints.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F0B839614BCF45A00885B4F /* LLIntEntrypoints.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0F0B839C14BCF46300885B4F /* LLIntThunks.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F0B839714BCF45A00885B4F /* LLIntThunks.cpp */; };
+		0F0B839D14BCF46600885B4F /* LLIntThunks.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F0B839814BCF45A00885B4F /* LLIntThunks.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		0F0B83A714BCF50700885B4F /* CodeType.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F0B83A514BCF50400885B4F /* CodeType.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		0F0B83A914BCF56200885B4F /* HandlerInfo.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F0B83A814BCF55E00885B4F /* HandlerInfo.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		0F0B83AB14BCF5BB00885B4F /* ExpressionRangeInfo.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F0B83AA14BCF5B900885B4F /* ExpressionRangeInfo.h */; settings = {ATTRIBUTES = (Private, ); }; };
@@ -58,9 +74,13 @@
 		0F0B83B514BCF86200885B4F /* MethodCallLinkInfo.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F0B83B314BCF85E00885B4F /* MethodCallLinkInfo.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		0F0B83B714BCF8E100885B4F /* GlobalResolveInfo.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F0B83B614BCF8DF00885B4F /* GlobalResolveInfo.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		0F0B83B914BCF95F00885B4F /* CallReturnOffsetToBytecodeOffset.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F0B83B814BCF95B00885B4F /* CallReturnOffsetToBytecodeOffset.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0F0FC45A14BD15F500B81154 /* LLIntCallLinkInfo.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F0FC45814BD15F100B81154 /* LLIntCallLinkInfo.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		0F15F15F14B7A73E005DE37D /* CommonSlowPaths.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F15F15D14B7A73A005DE37D /* CommonSlowPaths.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		0F16D726142C39C000CF784A /* BitVector.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F16D724142C39A200CF784A /* BitVector.cpp */; };
 		0F21C26814BE5F6800ADC64B /* JITDriver.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F21C26614BE5F5E00ADC64B /* JITDriver.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0F21C27C14BE727600ADC64B /* ExecutionHarness.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F21C27A14BE727300ADC64B /* ExecutionHarness.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0F21C27D14BE727A00ADC64B /* CodeSpecializationKind.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F21C27914BE727300ADC64B /* CodeSpecializationKind.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0F21C27F14BEAA8200ADC64B /* BytecodeConventions.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F21C27E14BEAA8000ADC64B /* BytecodeConventions.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		0F242DA713F3B1E8007ADD4C /* WeakReferenceHarvester.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F242DA513F3B1BB007ADD4C /* WeakReferenceHarvester.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		0F2C556F14738F3100121E4F /* DFGCodeBlocks.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F2C556E14738F2E00121E4F /* DFGCodeBlocks.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		0F2C557014738F3500121E4F /* DFGCodeBlocks.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F2C556D14738F2E00121E4F /* DFGCodeBlocks.cpp */; };
@@ -71,6 +91,18 @@
 		0F431738146BAC69007E3890 /* ListableHandler.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F431736146BAC65007E3890 /* ListableHandler.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		0F46808214BA572D00BFE272 /* JITExceptions.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F46808014BA572700BFE272 /* JITExceptions.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		0F46808314BA573100BFE272 /* JITExceptions.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F46807F14BA572700BFE272 /* JITExceptions.cpp */; };
+		0F4680A314BA7F8D00BFE272 /* LLIntExceptions.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F46809E14BA7F8200BFE272 /* LLIntExceptions.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0F4680A414BA7F8D00BFE272 /* LLIntSlowPaths.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F46809F14BA7F8200BFE272 /* LLIntSlowPaths.cpp */; settings = {COMPILER_FLAGS = "-Wno-unused-parameter"; }; };
+		0F4680A514BA7F8D00BFE272 /* LLIntSlowPaths.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F4680A014BA7F8200BFE272 /* LLIntSlowPaths.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0F4680A814BA7FAB00BFE272 /* LLIntExceptions.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F46809D14BA7F8200BFE272 /* LLIntExceptions.cpp */; };
+		0F4680CA14BBB16C00BFE272 /* LLIntCommon.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F4680C514BBB16900BFE272 /* LLIntCommon.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0F4680CB14BBB17200BFE272 /* LLIntOfflineAsmConfig.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F4680C614BBB16900BFE272 /* LLIntOfflineAsmConfig.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0F4680CC14BBB17A00BFE272 /* LowLevelInterpreter.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F4680C714BBB16900BFE272 /* LowLevelInterpreter.cpp */; };
+		0F4680CD14BBB17D00BFE272 /* LowLevelInterpreter.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F4680C814BBB16900BFE272 /* LowLevelInterpreter.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0F4680D214BBD16500BFE272 /* LLIntData.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F4680CE14BBB3D100BFE272 /* LLIntData.cpp */; };
+		0F4680D314BBD16700BFE272 /* LLIntData.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F4680CF14BBB3D100BFE272 /* LLIntData.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0F4680D414BBD24900BFE272 /* HostCallReturnValue.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F4680D014BBC5F800BFE272 /* HostCallReturnValue.cpp */; };
+		0F4680D514BBD24B00BFE272 /* HostCallReturnValue.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F4680D114BBC5F800BFE272 /* HostCallReturnValue.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		0F55F0F414D1063900AC7649 /* AbstractPC.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F55F0F114D1063600AC7649 /* AbstractPC.cpp */; };
 		0F55F0F514D1063C00AC7649 /* AbstractPC.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F55F0F214D1063600AC7649 /* AbstractPC.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		0F5F08CF146C7633000472A9 /* UnconditionalFinalizer.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F5F08CE146C762F000472A9 /* UnconditionalFinalizer.h */; settings = {ATTRIBUTES = (Private, ); }; };
@@ -102,6 +134,15 @@
 		0F963B2D13F854020002D9B2 /* MetaAllocator.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F963B2A13F853BD0002D9B2 /* MetaAllocator.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		0F963B2F13FC66BB0002D9B2 /* MetaAllocatorHandle.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F963B2E13FC66AE0002D9B2 /* MetaAllocatorHandle.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		0F963B3813FC6FE90002D9B2 /* ValueProfile.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F963B3613FC6FDE0002D9B2 /* ValueProfile.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0F9FC8C314E1B5FE00D52AE0 /* PolymorphicPutByIdList.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F9FC8BF14E1B5FB00D52AE0 /* PolymorphicPutByIdList.cpp */; };
+		0F9FC8C414E1B60000D52AE0 /* PolymorphicPutByIdList.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F9FC8C014E1B5FB00D52AE0 /* PolymorphicPutByIdList.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0F9FC8C514E1B60400D52AE0 /* PutKind.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F9FC8C114E1B5FB00D52AE0 /* PutKind.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0F9FC8D014E612D800D52AE0 /* DataLog.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F9FC8CD14E612D500D52AE0 /* DataLog.cpp */; };
+		0F9FC8D114E612DA00D52AE0 /* DataLog.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F9FC8CE14E612D500D52AE0 /* DataLog.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0FB5467714F59B5C002C2989 /* LazyOperandValueProfile.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FB5467614F59AD1002C2989 /* LazyOperandValueProfile.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0FB5467914F5C46B002C2989 /* LazyOperandValueProfile.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0FB5467814F5C468002C2989 /* LazyOperandValueProfile.cpp */; };
+		0FB5467B14F5C7E1002C2989 /* MethodOfGettingAValueProfile.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FB5467A14F5C7D4002C2989 /* MethodOfGettingAValueProfile.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0FB5467D14F5CFD6002C2989 /* MethodOfGettingAValueProfile.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0FB5467C14F5CFD3002C2989 /* MethodOfGettingAValueProfile.cpp */; };
 		0FBC0AE71496C7C400D4FBDD /* DFGExitProfile.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0FBC0AE41496C7C100D4FBDD /* DFGExitProfile.cpp */; };
 		0FBC0AE81496C7C700D4FBDD /* DFGExitProfile.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FBC0AE51496C7C100D4FBDD /* DFGExitProfile.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		0FBD7E691447999600481315 /* CodeOrigin.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FBD7E671447998F00481315 /* CodeOrigin.h */; settings = {ATTRIBUTES = (Private, ); }; };
@@ -121,9 +162,7 @@
 		0FC8150B14043C0E00CFA603 /* WriteBarrierSupport.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0FC8150814043BCA00CFA603 /* WriteBarrierSupport.cpp */; };
 		0FC815151405119B00CFA603 /* VTableSpectrum.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FC815141405118D00CFA603 /* VTableSpectrum.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		0FC81516140511B500CFA603 /* VTableSpectrum.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0FC815121405118600CFA603 /* VTableSpectrum.cpp */; };
-		0FD3C82514115D4000FD81CB /* DFGPropagator.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0FD3C82314115D1A00FD81CB /* DFGPropagator.cpp */; };
 		0FD3C82614115D4000FD81CB /* DFGDriver.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0FD3C82014115CF800FD81CB /* DFGDriver.cpp */; };
-		0FD3C82714115D4F00FD81CB /* DFGPropagator.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FD3C82414115D2200FD81CB /* DFGPropagator.h */; };
 		0FD3C82814115D4F00FD81CB /* DFGDriver.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FD3C82214115D0E00FD81CB /* DFGDriver.h */; };
 		0FD52AAE143035A00026DC9F /* UnionFind.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FD52AAC1430359D0026DC9F /* UnionFind.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		0FD82E2114172CE300179C94 /* DFGCapabilities.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0FD82E1E14172C2F00179C94 /* DFGCapabilities.cpp */; };
@@ -134,10 +173,22 @@
 		0FD82E57141DAF1000179C94 /* DFGOSREntry.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FD82E53141DAEDE00179C94 /* DFGOSREntry.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		0FD82E85141F3FE300179C94 /* BoundsCheckedPointer.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FD82E82141F3FC900179C94 /* BoundsCheckedPointer.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		0FD82E86141F3FF100179C94 /* PredictedType.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0FD82E84141F3FDA00179C94 /* PredictedType.cpp */; };
-		0FD82E9014207A5F00179C94 /* ValueProfile.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0FD82E8E14207A5100179C94 /* ValueProfile.cpp */; };
 		0FD82F4B142806A100179C94 /* BitVector.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FD82F491428069200179C94 /* BitVector.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		0FE228ED1436AB2700196C48 /* Options.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FE228EB1436AB2300196C48 /* Options.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		0FE228EE1436AB2C00196C48 /* Options.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0FE228EA1436AB2300196C48 /* Options.cpp */; };
+		0FF922D414F46B410041A24E /* LLIntOffsetsExtractor.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F4680A114BA7F8200BFE272 /* LLIntOffsetsExtractor.cpp */; };
+		0FFFC95514EF909A00C72532 /* DFGArithNodeFlagsInferencePhase.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0FFFC94914EF909500C72532 /* DFGArithNodeFlagsInferencePhase.cpp */; };
+		0FFFC95614EF909C00C72532 /* DFGArithNodeFlagsInferencePhase.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FFFC94A14EF909500C72532 /* DFGArithNodeFlagsInferencePhase.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0FFFC95714EF90A000C72532 /* DFGCFAPhase.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0FFFC94B14EF909500C72532 /* DFGCFAPhase.cpp */; };
+		0FFFC95814EF90A200C72532 /* DFGCFAPhase.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FFFC94C14EF909500C72532 /* DFGCFAPhase.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0FFFC95914EF90A600C72532 /* DFGCSEPhase.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0FFFC94D14EF909500C72532 /* DFGCSEPhase.cpp */; };
+		0FFFC95A14EF90A900C72532 /* DFGCSEPhase.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FFFC94E14EF909500C72532 /* DFGCSEPhase.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0FFFC95B14EF90AD00C72532 /* DFGPhase.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0FFFC94F14EF909500C72532 /* DFGPhase.cpp */; };
+		0FFFC95C14EF90AF00C72532 /* DFGPhase.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FFFC95014EF909500C72532 /* DFGPhase.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0FFFC95D14EF90B300C72532 /* DFGPredictionPropagationPhase.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0FFFC95114EF909500C72532 /* DFGPredictionPropagationPhase.cpp */; };
+		0FFFC95E14EF90B700C72532 /* DFGPredictionPropagationPhase.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FFFC95214EF909500C72532 /* DFGPredictionPropagationPhase.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0FFFC95F14EF90BB00C72532 /* DFGVirtualRegisterAllocationPhase.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0FFFC95314EF909500C72532 /* DFGVirtualRegisterAllocationPhase.cpp */; };
+		0FFFC96014EF90BD00C72532 /* DFGVirtualRegisterAllocationPhase.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FFFC95414EF909500C72532 /* DFGVirtualRegisterAllocationPhase.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		1400067712A6F7830064D123 /* OSAllocator.h in Headers */ = {isa = PBXBuildFile; fileRef = 1400067612A6F7830064D123 /* OSAllocator.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		1400069312A6F9E10064D123 /* OSAllocatorPosix.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 1400069212A6F9E10064D123 /* OSAllocatorPosix.cpp */; };
 		140566C4107EC255005DBC8D /* JSAPIValueWrapper.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC0894D50FAFBA2D00001865 /* JSAPIValueWrapper.cpp */; };
@@ -261,6 +312,7 @@
 		148F21B7107EC5470042EC2C /* Nodes.cpp in Sources */ = {isa = PBXBuildFile; fileRef = F692A86D0255597D01FF60F7 /* Nodes.cpp */; };
 		148F21BC107EC54D0042EC2C /* Parser.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 93F0B3A909BB4DC00068FCE3 /* Parser.cpp */; };
 		149559EE0DDCDDF700648087 /* DebuggerCallFrame.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 149559ED0DDCDDF700648087 /* DebuggerCallFrame.cpp */; };
+		1497209114EB831500FEB1B7 /* PassWeak.h in Headers */ = {isa = PBXBuildFile; fileRef = 1497209014EB831500FEB1B7 /* PassWeak.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		14A1563210966365006FA260 /* DateInstanceCache.h in Headers */ = {isa = PBXBuildFile; fileRef = 14A1563010966365006FA260 /* DateInstanceCache.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		14A23D750F4E1ABB0023CDAD /* JITStubs.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 14A23D6C0F4E19CE0023CDAD /* JITStubs.cpp */; };
 		14A42E3F0F4F60EE00599099 /* TimeoutChecker.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 14A42E3D0F4F60EE00599099 /* TimeoutChecker.cpp */; };
@@ -294,6 +346,20 @@
 		1A082779142168D70090CCAC /* BinarySemaphore.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 1A082777142168D70090CCAC /* BinarySemaphore.cpp */; };
 		1A08277A142168D70090CCAC /* BinarySemaphore.h in Headers */ = {isa = PBXBuildFile; fileRef = 1A082778142168D70090CCAC /* BinarySemaphore.h */; };
 		1AA9E5511498093500001A8A /* Functional.h in Headers */ = {isa = PBXBuildFile; fileRef = 1AA9E5501498093500001A8A /* Functional.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		2684B2D314D4A9B20072C0B6 /* ParsedURL.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 2684B2C414D4A9B20072C0B6 /* ParsedURL.cpp */; };
+		2684B2D414D4A9B20072C0B6 /* ParsedURL.h in Headers */ = {isa = PBXBuildFile; fileRef = 2684B2C514D4A9B20072C0B6 /* ParsedURL.h */; };
+		2684B2D514D4A9B20072C0B6 /* URLString.h in Headers */ = {isa = PBXBuildFile; fileRef = 2684B2C614D4A9B20072C0B6 /* URLString.h */; };
+		2684B2D614D4A9B20072C0B6 /* RawURLBuffer.h in Headers */ = {isa = PBXBuildFile; fileRef = 2684B2C814D4A9B20072C0B6 /* RawURLBuffer.h */; };
+		2684B2D714D4A9B20072C0B6 /* URLBuffer.h in Headers */ = {isa = PBXBuildFile; fileRef = 2684B2C914D4A9B20072C0B6 /* URLBuffer.h */; };
+		2684B2D814D4A9B20072C0B6 /* URLCharacterTypes.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 2684B2CA14D4A9B20072C0B6 /* URLCharacterTypes.cpp */; };
+		2684B2D914D4A9B20072C0B6 /* URLCharacterTypes.h in Headers */ = {isa = PBXBuildFile; fileRef = 2684B2CB14D4A9B20072C0B6 /* URLCharacterTypes.h */; };
+		2684B2DA14D4A9B20072C0B6 /* URLComponent.h in Headers */ = {isa = PBXBuildFile; fileRef = 2684B2CC14D4A9B20072C0B6 /* URLComponent.h */; };
+		2684B2DB14D4A9B20072C0B6 /* URLEscape.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 2684B2CD14D4A9B20072C0B6 /* URLEscape.cpp */; };
+		2684B2DC14D4A9B20072C0B6 /* URLEscape.h in Headers */ = {isa = PBXBuildFile; fileRef = 2684B2CE14D4A9B20072C0B6 /* URLEscape.h */; };
+		2684B2DD14D4A9B20072C0B6 /* URLParser.h in Headers */ = {isa = PBXBuildFile; fileRef = 2684B2CF14D4A9B20072C0B6 /* URLParser.h */; };
+		2684B2DE14D4A9B20072C0B6 /* URLQueryCanonicalizer.h in Headers */ = {isa = PBXBuildFile; fileRef = 2684B2D014D4A9B20072C0B6 /* URLQueryCanonicalizer.h */; };
+		2684B2DF14D4A9B20072C0B6 /* URLSegments.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 2684B2D114D4A9B20072C0B6 /* URLSegments.cpp */; };
+		2684B2E014D4A9B20072C0B6 /* URLSegments.h in Headers */ = {isa = PBXBuildFile; fileRef = 2684B2D214D4A9B20072C0B6 /* URLSegments.h */; };
 		2CFC5D1E12F45B48004914E2 /* CharacterNames.h in Headers */ = {isa = PBXBuildFile; fileRef = 2CFC5B7A12F44714004914E2 /* CharacterNames.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		41359CF30FDD89AD00206180 /* DateConversion.h in Headers */ = {isa = PBXBuildFile; fileRef = D21202290AD4310C00ED79B6 /* DateConversion.h */; };
 		41359CF60FDD89CB00206180 /* DateMath.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 41359CF40FDD89CB00206180 /* DateMath.cpp */; };
@@ -389,7 +455,7 @@
 		86B99AE3117E578100DF5A90 /* StringBuffer.h in Headers */ = {isa = PBXBuildFile; fileRef = 86B99AE1117E578100DF5A90 /* StringBuffer.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		86BB09C0138E381B0056702F /* DFGRepatch.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 86BB09BE138E381B0056702F /* DFGRepatch.cpp */; };
 		86BB09C1138E381B0056702F /* DFGRepatch.h in Headers */ = {isa = PBXBuildFile; fileRef = 86BB09BF138E381B0056702F /* DFGRepatch.h */; };
-		86C36EEA0EE1289D00B3DF59 /* MacroAssembler.h in Headers */ = {isa = PBXBuildFile; fileRef = 86C36EE90EE1289D00B3DF59 /* MacroAssembler.h */; };
+		86C36EEA0EE1289D00B3DF59 /* MacroAssembler.h in Headers */ = {isa = PBXBuildFile; fileRef = 86C36EE90EE1289D00B3DF59 /* MacroAssembler.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		86C568E011A213EE0007F7F0 /* MacroAssemblerARM.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 86C568DD11A213EE0007F7F0 /* MacroAssemblerARM.cpp */; };
 		86C568E111A213EE0007F7F0 /* MacroAssemblerMIPS.h in Headers */ = {isa = PBXBuildFile; fileRef = 86C568DE11A213EE0007F7F0 /* MacroAssemblerMIPS.h */; };
 		86C568E211A213EE0007F7F0 /* MIPSAssembler.h in Headers */ = {isa = PBXBuildFile; fileRef = 86C568DF11A213EE0007F7F0 /* MIPSAssembler.h */; };
@@ -687,6 +753,7 @@
 		BC87CDB910712AD4000614CF /* JSONObject.lut.h in Headers */ = {isa = PBXBuildFile; fileRef = BC87CDB810712ACA000614CF /* JSONObject.lut.h */; };
 		BC9041480EB9250900FE26FA /* StructureTransitionTable.h in Headers */ = {isa = PBXBuildFile; fileRef = BC9041470EB9250900FE26FA /* StructureTransitionTable.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		BC95437D0EBA70FD0072B6D3 /* PropertyMapHashTable.h in Headers */ = {isa = PBXBuildFile; fileRef = BC95437C0EBA70FD0072B6D3 /* PropertyMapHashTable.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		BCBE2CAE14E985AA000593AD /* GCAssertions.h in Headers */ = {isa = PBXBuildFile; fileRef = BCBE2CAD14E985AA000593AD /* GCAssertions.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		BCCF0D080EF0AAB900413C8F /* StructureStubInfo.h in Headers */ = {isa = PBXBuildFile; fileRef = BCCF0D070EF0AAB900413C8F /* StructureStubInfo.h */; };
 		BCCF0D0C0EF0B8A500413C8F /* StructureStubInfo.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BCCF0D0B0EF0B8A500413C8F /* StructureStubInfo.cpp */; };
 		BCD202C20E1706A7002C7E82 /* RegExpConstructor.h in Headers */ = {isa = PBXBuildFile; fileRef = BCD202BE0E1706A7002C7E82 /* RegExpConstructor.h */; };
@@ -722,14 +789,15 @@
 		C22C531313FAF6EF00B7DC0D /* strtod.cc in Sources */ = {isa = PBXBuildFile; fileRef = C22C52B913FAF6EF00B7DC0D /* strtod.cc */; };
 		C22C531413FAF6EF00B7DC0D /* strtod.h in Headers */ = {isa = PBXBuildFile; fileRef = C22C52BA13FAF6EF00B7DC0D /* strtod.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		C22C531513FAF6EF00B7DC0D /* utils.h in Headers */ = {isa = PBXBuildFile; fileRef = C22C52BB13FAF6EF00B7DC0D /* utils.h */; settings = {ATTRIBUTES = (Private, ); }; };
-		C240305514B404E60079EB64 /* BumpSpace.cpp in Sources */ = {isa = PBXBuildFile; fileRef = C240305314B404C90079EB64 /* BumpSpace.cpp */; };
+		C240305514B404E60079EB64 /* CopiedSpace.cpp in Sources */ = {isa = PBXBuildFile; fileRef = C240305314B404C90079EB64 /* CopiedSpace.cpp */; };
 		C2B916C214DA014E00CBAC86 /* MarkedAllocator.h in Headers */ = {isa = PBXBuildFile; fileRef = C2B916C114DA014E00CBAC86 /* MarkedAllocator.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		C2B916C514DA040C00CBAC86 /* MarkedAllocator.cpp in Sources */ = {isa = PBXBuildFile; fileRef = C2B916C414DA040C00CBAC86 /* MarkedAllocator.cpp */; };
-		C2C8D02D14A3C6E000578E65 /* BumpSpaceInlineMethods.h in Headers */ = {isa = PBXBuildFile; fileRef = C2C8D02B14A3C6B200578E65 /* BumpSpaceInlineMethods.h */; settings = {ATTRIBUTES = (Private, ); }; };
-		C2C8D03014A3CEFC00578E65 /* BumpBlock.h in Headers */ = {isa = PBXBuildFile; fileRef = C2C8D02E14A3CEFC00578E65 /* BumpBlock.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		C2C8D02D14A3C6E000578E65 /* CopiedSpaceInlineMethods.h in Headers */ = {isa = PBXBuildFile; fileRef = C2C8D02B14A3C6B200578E65 /* CopiedSpaceInlineMethods.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		C2C8D03014A3CEFC00578E65 /* CopiedBlock.h in Headers */ = {isa = PBXBuildFile; fileRef = C2C8D02E14A3CEFC00578E65 /* CopiedBlock.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		C2C8D03114A3CEFC00578E65 /* HeapBlock.h in Headers */ = {isa = PBXBuildFile; fileRef = C2C8D02F14A3CEFC00578E65 /* HeapBlock.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		C2D9CA1314BCC04600304B46 /* CheckedBoolean.h in Headers */ = {isa = PBXBuildFile; fileRef = C2D9CA1214BCC04600304B46 /* CheckedBoolean.h */; settings = {ATTRIBUTES = (Private, ); }; };
-		C2EAA3FA149A835E00FCE112 /* BumpSpace.h in Headers */ = {isa = PBXBuildFile; fileRef = C2EAA3F8149A830800FCE112 /* BumpSpace.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		C2EAA3FA149A835E00FCE112 /* CopiedSpace.h in Headers */ = {isa = PBXBuildFile; fileRef = C2EAA3F8149A830800FCE112 /* CopiedSpace.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		C2EAD2FC14F0249800A4B159 /* CopiedAllocator.h in Headers */ = {isa = PBXBuildFile; fileRef = C2EAD2FB14F0249800A4B159 /* CopiedAllocator.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		C2EE59A013FC973F009CEAFE /* DecimalNumber.h in Headers */ = {isa = PBXBuildFile; fileRef = C2EE599E13FC972A009CEAFE /* DecimalNumber.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		C2EE59A113FC9768009CEAFE /* DecimalNumber.cpp in Sources */ = {isa = PBXBuildFile; fileRef = C2EE599D13FC972A009CEAFE /* DecimalNumber.cpp */; };
 		D7A46A4F1338FFEA00ED695C /* DynamicAnnotations.h in Headers */ = {isa = PBXBuildFile; fileRef = D75AF59612F8CB9500FC0ADF /* DynamicAnnotations.h */; settings = {ATTRIBUTES = (Private, ); }; };
@@ -758,6 +826,20 @@
 /* End PBXBuildFile section */
 
 /* Begin PBXContainerItemProxy section */
+		0FF922D214F46B2F0041A24E /* PBXContainerItemProxy */ = {
+			isa = PBXContainerItemProxy;
+			containerPortal = 0867D690FE84028FC02AAC07 /* Project object */;
+			proxyType = 1;
+			remoteGlobalIDString = 0F4680A914BA7FD900BFE272;
+			remoteInfo = "LLInt Offsets";
+		};
+		0FF922D514F46B600041A24E /* PBXContainerItemProxy */ = {
+			isa = PBXContainerItemProxy;
+			containerPortal = 0867D690FE84028FC02AAC07 /* Project object */;
+			proxyType = 1;
+			remoteGlobalIDString = 0FF922C314F46B130041A24E;
+			remoteInfo = JSCLLIntOffsetsExtractor;
+		};
 		141214BE0A49190E00480255 /* PBXContainerItemProxy */ = {
 			isa = PBXContainerItemProxy;
 			containerPortal = 0867D690FE84028FC02AAC07 /* Project object */;
@@ -843,6 +925,10 @@
 		0BAC949E1338728400CF135B /* ThreadRestrictionVerifier.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ThreadRestrictionVerifier.h; sourceTree = "<group>"; };
 		0BCD83541485841200EA2003 /* TemporaryChange.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = TemporaryChange.h; sourceTree = "<group>"; };
 		0BF28A2811A33DC300638F84 /* SizeLimits.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = SizeLimits.cpp; sourceTree = "<group>"; };
+		0F0B839514BCF45A00885B4F /* LLIntEntrypoints.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = LLIntEntrypoints.cpp; path = llint/LLIntEntrypoints.cpp; sourceTree = "<group>"; };
+		0F0B839614BCF45A00885B4F /* LLIntEntrypoints.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = LLIntEntrypoints.h; path = llint/LLIntEntrypoints.h; sourceTree = "<group>"; };
+		0F0B839714BCF45A00885B4F /* LLIntThunks.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = LLIntThunks.cpp; path = llint/LLIntThunks.cpp; sourceTree = "<group>"; };
+		0F0B839814BCF45A00885B4F /* LLIntThunks.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = LLIntThunks.h; path = llint/LLIntThunks.h; sourceTree = "<group>"; };
 		0F0B83A514BCF50400885B4F /* CodeType.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = CodeType.h; sourceTree = "<group>"; };
 		0F0B83A814BCF55E00885B4F /* HandlerInfo.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = HandlerInfo.h; sourceTree = "<group>"; };
 		0F0B83AA14BCF5B900885B4F /* ExpressionRangeInfo.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ExpressionRangeInfo.h; sourceTree = "<group>"; };
@@ -853,9 +939,13 @@
 		0F0B83B314BCF85E00885B4F /* MethodCallLinkInfo.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = MethodCallLinkInfo.h; sourceTree = "<group>"; };
 		0F0B83B614BCF8DF00885B4F /* GlobalResolveInfo.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = GlobalResolveInfo.h; sourceTree = "<group>"; };
 		0F0B83B814BCF95B00885B4F /* CallReturnOffsetToBytecodeOffset.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = CallReturnOffsetToBytecodeOffset.h; sourceTree = "<group>"; };
+		0F0FC45814BD15F100B81154 /* LLIntCallLinkInfo.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = LLIntCallLinkInfo.h; sourceTree = "<group>"; };
 		0F15F15D14B7A73A005DE37D /* CommonSlowPaths.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = CommonSlowPaths.h; sourceTree = "<group>"; };
 		0F16D724142C39A200CF784A /* BitVector.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = BitVector.cpp; sourceTree = "<group>"; };
 		0F21C26614BE5F5E00ADC64B /* JITDriver.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JITDriver.h; sourceTree = "<group>"; };
+		0F21C27914BE727300ADC64B /* CodeSpecializationKind.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = CodeSpecializationKind.h; sourceTree = "<group>"; };
+		0F21C27A14BE727300ADC64B /* ExecutionHarness.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ExecutionHarness.h; sourceTree = "<group>"; };
+		0F21C27E14BEAA8000ADC64B /* BytecodeConventions.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = BytecodeConventions.h; sourceTree = "<group>"; };
 		0F242DA513F3B1BB007ADD4C /* WeakReferenceHarvester.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WeakReferenceHarvester.h; sourceTree = "<group>"; };
 		0F2C556D14738F2E00121E4F /* DFGCodeBlocks.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = DFGCodeBlocks.cpp; sourceTree = "<group>"; };
 		0F2C556E14738F2E00121E4F /* DFGCodeBlocks.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DFGCodeBlocks.h; sourceTree = "<group>"; };
@@ -866,6 +956,19 @@
 		0F431736146BAC65007E3890 /* ListableHandler.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ListableHandler.h; sourceTree = "<group>"; };
 		0F46807F14BA572700BFE272 /* JITExceptions.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JITExceptions.cpp; sourceTree = "<group>"; };
 		0F46808014BA572700BFE272 /* JITExceptions.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JITExceptions.h; sourceTree = "<group>"; };
+		0F46809D14BA7F8200BFE272 /* LLIntExceptions.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = LLIntExceptions.cpp; path = llint/LLIntExceptions.cpp; sourceTree = "<group>"; };
+		0F46809E14BA7F8200BFE272 /* LLIntExceptions.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = LLIntExceptions.h; path = llint/LLIntExceptions.h; sourceTree = "<group>"; };
+		0F46809F14BA7F8200BFE272 /* LLIntSlowPaths.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = LLIntSlowPaths.cpp; path = llint/LLIntSlowPaths.cpp; sourceTree = "<group>"; };
+		0F4680A014BA7F8200BFE272 /* LLIntSlowPaths.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = LLIntSlowPaths.h; path = llint/LLIntSlowPaths.h; sourceTree = "<group>"; };
+		0F4680A114BA7F8200BFE272 /* LLIntOffsetsExtractor.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = LLIntOffsetsExtractor.cpp; path = llint/LLIntOffsetsExtractor.cpp; sourceTree = "<group>"; };
+		0F4680C514BBB16900BFE272 /* LLIntCommon.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = LLIntCommon.h; path = llint/LLIntCommon.h; sourceTree = "<group>"; };
+		0F4680C614BBB16900BFE272 /* LLIntOfflineAsmConfig.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = LLIntOfflineAsmConfig.h; path = llint/LLIntOfflineAsmConfig.h; sourceTree = "<group>"; };
+		0F4680C714BBB16900BFE272 /* LowLevelInterpreter.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = LowLevelInterpreter.cpp; path = llint/LowLevelInterpreter.cpp; sourceTree = "<group>"; };
+		0F4680C814BBB16900BFE272 /* LowLevelInterpreter.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = LowLevelInterpreter.h; path = llint/LowLevelInterpreter.h; sourceTree = "<group>"; };
+		0F4680CE14BBB3D100BFE272 /* LLIntData.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = LLIntData.cpp; path = llint/LLIntData.cpp; sourceTree = "<group>"; };
+		0F4680CF14BBB3D100BFE272 /* LLIntData.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = LLIntData.h; path = llint/LLIntData.h; sourceTree = "<group>"; };
+		0F4680D014BBC5F800BFE272 /* HostCallReturnValue.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = HostCallReturnValue.cpp; sourceTree = "<group>"; };
+		0F4680D114BBC5F800BFE272 /* HostCallReturnValue.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = HostCallReturnValue.h; sourceTree = "<group>"; };
 		0F55F0F114D1063600AC7649 /* AbstractPC.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = AbstractPC.cpp; sourceTree = "<group>"; };
 		0F55F0F214D1063600AC7649 /* AbstractPC.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = AbstractPC.h; sourceTree = "<group>"; };
 		0F5F08CC146BE602000472A9 /* DFGByteCodeCache.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGByteCodeCache.h; path = dfg/DFGByteCodeCache.h; sourceTree = "<group>"; };
@@ -896,6 +999,15 @@
 		0F963B2B13F853C70002D9B2 /* MetaAllocator.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = MetaAllocator.cpp; sourceTree = "<group>"; };
 		0F963B2E13FC66AE0002D9B2 /* MetaAllocatorHandle.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = MetaAllocatorHandle.h; sourceTree = "<group>"; };
 		0F963B3613FC6FDE0002D9B2 /* ValueProfile.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ValueProfile.h; sourceTree = "<group>"; };
+		0F9FC8BF14E1B5FB00D52AE0 /* PolymorphicPutByIdList.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = PolymorphicPutByIdList.cpp; sourceTree = "<group>"; };
+		0F9FC8C014E1B5FB00D52AE0 /* PolymorphicPutByIdList.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = PolymorphicPutByIdList.h; sourceTree = "<group>"; };
+		0F9FC8C114E1B5FB00D52AE0 /* PutKind.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = PutKind.h; sourceTree = "<group>"; };
+		0F9FC8CD14E612D500D52AE0 /* DataLog.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = DataLog.cpp; sourceTree = "<group>"; };
+		0F9FC8CE14E612D500D52AE0 /* DataLog.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DataLog.h; sourceTree = "<group>"; };
+		0FB5467614F59AD1002C2989 /* LazyOperandValueProfile.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = LazyOperandValueProfile.h; sourceTree = "<group>"; };
+		0FB5467814F5C468002C2989 /* LazyOperandValueProfile.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = LazyOperandValueProfile.cpp; sourceTree = "<group>"; };
+		0FB5467A14F5C7D4002C2989 /* MethodOfGettingAValueProfile.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = MethodOfGettingAValueProfile.h; sourceTree = "<group>"; };
+		0FB5467C14F5CFD3002C2989 /* MethodOfGettingAValueProfile.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = MethodOfGettingAValueProfile.cpp; sourceTree = "<group>"; };
 		0FBC0AE41496C7C100D4FBDD /* DFGExitProfile.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = DFGExitProfile.cpp; sourceTree = "<group>"; };
 		0FBC0AE51496C7C100D4FBDD /* DFGExitProfile.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DFGExitProfile.h; sourceTree = "<group>"; };
 		0FBD7E671447998F00481315 /* CodeOrigin.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = CodeOrigin.h; sourceTree = "<group>"; };
@@ -918,8 +1030,6 @@
 		0FC815141405118D00CFA603 /* VTableSpectrum.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = VTableSpectrum.h; sourceTree = "<group>"; };
 		0FD3C82014115CF800FD81CB /* DFGDriver.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGDriver.cpp; path = dfg/DFGDriver.cpp; sourceTree = "<group>"; };
 		0FD3C82214115D0E00FD81CB /* DFGDriver.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGDriver.h; path = dfg/DFGDriver.h; sourceTree = "<group>"; };
-		0FD3C82314115D1A00FD81CB /* DFGPropagator.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGPropagator.cpp; path = dfg/DFGPropagator.cpp; sourceTree = "<group>"; };
-		0FD3C82414115D2200FD81CB /* DFGPropagator.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGPropagator.h; path = dfg/DFGPropagator.h; sourceTree = "<group>"; };
 		0FD52AAC1430359D0026DC9F /* UnionFind.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = UnionFind.h; sourceTree = "<group>"; };
 		0FD82E1E14172C2F00179C94 /* DFGCapabilities.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGCapabilities.cpp; path = dfg/DFGCapabilities.cpp; sourceTree = "<group>"; };
 		0FD82E1F14172C2F00179C94 /* DFGCapabilities.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGCapabilities.h; path = dfg/DFGCapabilities.h; sourceTree = "<group>"; };
@@ -930,10 +1040,22 @@
 		0FD82E53141DAEDE00179C94 /* DFGOSREntry.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGOSREntry.h; path = dfg/DFGOSREntry.h; sourceTree = "<group>"; };
 		0FD82E82141F3FC900179C94 /* BoundsCheckedPointer.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = BoundsCheckedPointer.h; sourceTree = "<group>"; };
 		0FD82E84141F3FDA00179C94 /* PredictedType.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = PredictedType.cpp; sourceTree = "<group>"; };
-		0FD82E8E14207A5100179C94 /* ValueProfile.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ValueProfile.cpp; sourceTree = "<group>"; };
 		0FD82F491428069200179C94 /* BitVector.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = BitVector.h; sourceTree = "<group>"; };
 		0FE228EA1436AB2300196C48 /* Options.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = Options.cpp; sourceTree = "<group>"; };
 		0FE228EB1436AB2300196C48 /* Options.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = Options.h; sourceTree = "<group>"; };
+		0FF922CF14F46B130041A24E /* JSCLLIntOffsetsExtractor */ = {isa = PBXFileReference; explicitFileType = "compiled.mach-o.executable"; includeInIndex = 0; path = JSCLLIntOffsetsExtractor; sourceTree = BUILT_PRODUCTS_DIR; };
+		0FFFC94914EF909500C72532 /* DFGArithNodeFlagsInferencePhase.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGArithNodeFlagsInferencePhase.cpp; path = dfg/DFGArithNodeFlagsInferencePhase.cpp; sourceTree = "<group>"; };
+		0FFFC94A14EF909500C72532 /* DFGArithNodeFlagsInferencePhase.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGArithNodeFlagsInferencePhase.h; path = dfg/DFGArithNodeFlagsInferencePhase.h; sourceTree = "<group>"; };
+		0FFFC94B14EF909500C72532 /* DFGCFAPhase.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGCFAPhase.cpp; path = dfg/DFGCFAPhase.cpp; sourceTree = "<group>"; };
+		0FFFC94C14EF909500C72532 /* DFGCFAPhase.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGCFAPhase.h; path = dfg/DFGCFAPhase.h; sourceTree = "<group>"; };
+		0FFFC94D14EF909500C72532 /* DFGCSEPhase.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGCSEPhase.cpp; path = dfg/DFGCSEPhase.cpp; sourceTree = "<group>"; };
+		0FFFC94E14EF909500C72532 /* DFGCSEPhase.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGCSEPhase.h; path = dfg/DFGCSEPhase.h; sourceTree = "<group>"; };
+		0FFFC94F14EF909500C72532 /* DFGPhase.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGPhase.cpp; path = dfg/DFGPhase.cpp; sourceTree = "<group>"; };
+		0FFFC95014EF909500C72532 /* DFGPhase.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGPhase.h; path = dfg/DFGPhase.h; sourceTree = "<group>"; };
+		0FFFC95114EF909500C72532 /* DFGPredictionPropagationPhase.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGPredictionPropagationPhase.cpp; path = dfg/DFGPredictionPropagationPhase.cpp; sourceTree = "<group>"; };
+		0FFFC95214EF909500C72532 /* DFGPredictionPropagationPhase.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGPredictionPropagationPhase.h; path = dfg/DFGPredictionPropagationPhase.h; sourceTree = "<group>"; };
+		0FFFC95314EF909500C72532 /* DFGVirtualRegisterAllocationPhase.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGVirtualRegisterAllocationPhase.cpp; path = dfg/DFGVirtualRegisterAllocationPhase.cpp; sourceTree = "<group>"; };
+		0FFFC95414EF909500C72532 /* DFGVirtualRegisterAllocationPhase.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGVirtualRegisterAllocationPhase.h; path = dfg/DFGVirtualRegisterAllocationPhase.h; sourceTree = "<group>"; };
 		1400067612A6F7830064D123 /* OSAllocator.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = OSAllocator.h; sourceTree = "<group>"; };
 		1400069212A6F9E10064D123 /* OSAllocatorPosix.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = OSAllocatorPosix.cpp; sourceTree = "<group>"; };
 		140D17D60E8AD4A9000CD17D /* JSBasePrivate.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSBasePrivate.h; sourceTree = "<group>"; };
@@ -1005,6 +1127,7 @@
 		148A1ECD0D10C23B0069A47C /* RefPtrHashMap.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = RefPtrHashMap.h; sourceTree = "<group>"; };
 		148CD1D7108CF902008163C6 /* JSContextRefPrivate.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSContextRefPrivate.h; sourceTree = "<group>"; };
 		149559ED0DDCDDF700648087 /* DebuggerCallFrame.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = DebuggerCallFrame.cpp; sourceTree = "<group>"; };
+		1497209014EB831500FEB1B7 /* PassWeak.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = PassWeak.h; sourceTree = "<group>"; };
 		149B24FF0D8AF6D1009CB8C7 /* Register.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = Register.h; sourceTree = "<group>"; };
 		149DAAF212EB559D0083B12B /* ConservativeRoots.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ConservativeRoots.h; sourceTree = "<group>"; };
 		14A1563010966365006FA260 /* DateInstanceCache.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DateInstanceCache.h; sourceTree = "<group>"; };
@@ -1054,6 +1177,20 @@
 		1C9051450BA9E8A70081E9D0 /* Base.xcconfig */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text.xcconfig; path = Base.xcconfig; sourceTree = "<group>"; };
 		1CAA8B4A0D32C39A0041BCFF /* JavaScript.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JavaScript.h; sourceTree = "<group>"; };
 		1CAA8B4B0D32C39A0041BCFF /* JavaScriptCore.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JavaScriptCore.h; sourceTree = "<group>"; };
+		2684B2C414D4A9B20072C0B6 /* ParsedURL.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ParsedURL.cpp; sourceTree = "<group>"; };
+		2684B2C514D4A9B20072C0B6 /* ParsedURL.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ParsedURL.h; sourceTree = "<group>"; };
+		2684B2C614D4A9B20072C0B6 /* URLString.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = URLString.h; sourceTree = "<group>"; };
+		2684B2C814D4A9B20072C0B6 /* RawURLBuffer.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = RawURLBuffer.h; sourceTree = "<group>"; };
+		2684B2C914D4A9B20072C0B6 /* URLBuffer.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = URLBuffer.h; sourceTree = "<group>"; };
+		2684B2CA14D4A9B20072C0B6 /* URLCharacterTypes.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = URLCharacterTypes.cpp; sourceTree = "<group>"; };
+		2684B2CB14D4A9B20072C0B6 /* URLCharacterTypes.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = URLCharacterTypes.h; sourceTree = "<group>"; };
+		2684B2CC14D4A9B20072C0B6 /* URLComponent.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = URLComponent.h; sourceTree = "<group>"; };
+		2684B2CD14D4A9B20072C0B6 /* URLEscape.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = URLEscape.cpp; sourceTree = "<group>"; };
+		2684B2CE14D4A9B20072C0B6 /* URLEscape.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = URLEscape.h; sourceTree = "<group>"; };
+		2684B2CF14D4A9B20072C0B6 /* URLParser.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = URLParser.h; sourceTree = "<group>"; };
+		2684B2D014D4A9B20072C0B6 /* URLQueryCanonicalizer.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = URLQueryCanonicalizer.h; sourceTree = "<group>"; };
+		2684B2D114D4A9B20072C0B6 /* URLSegments.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = URLSegments.cpp; sourceTree = "<group>"; };
+		2684B2D214D4A9B20072C0B6 /* URLSegments.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = URLSegments.h; sourceTree = "<group>"; };
 		2CFC5B7A12F44714004914E2 /* CharacterNames.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = CharacterNames.h; sourceTree = "<group>"; };
 		41359CF40FDD89CB00206180 /* DateMath.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = DateMath.cpp; sourceTree = "<group>"; };
 		41359CF50FDD89CB00206180 /* DateMath.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DateMath.h; sourceTree = "<group>"; };
@@ -1351,6 +1488,7 @@
 		A74DE1CB120B86D600D40D5B /* ARMv7Assembler.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ARMv7Assembler.cpp; sourceTree = "<group>"; };
 		A7521E121429169A003C8D0C /* CardSet.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = CardSet.h; sourceTree = "<group>"; };
 		A75706DD118A2BCF0057F88F /* JITArithmetic32_64.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JITArithmetic32_64.cpp; sourceTree = "<group>"; };
+		A767FF9F14F4502900789059 /* JSCTypedArrayStubs.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSCTypedArrayStubs.h; sourceTree = "<group>"; };
 		A76C51741182748D00715B05 /* JSInterfaceJIT.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSInterfaceJIT.h; sourceTree = "<group>"; };
 		A76F54A213B28AAB00EF2BCE /* JITWriteBarrier.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JITWriteBarrier.h; sourceTree = "<group>"; };
 		A781E358141970C700094D90 /* StorageBarrier.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = StorageBarrier.h; sourceTree = "<group>"; };
@@ -1462,6 +1600,7 @@
 		BC9BB95B0E19680600DF8855 /* InternalFunction.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = InternalFunction.cpp; sourceTree = "<group>"; };
 		BCA62DFE0E2826230004F30D /* CallData.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = CallData.cpp; sourceTree = "<group>"; };
 		BCA62DFF0E2826310004F30D /* ConstructData.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ConstructData.cpp; sourceTree = "<group>"; };
+		BCBE2CAD14E985AA000593AD /* GCAssertions.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = GCAssertions.h; sourceTree = "<group>"; };
 		BCCF0D070EF0AAB900413C8F /* StructureStubInfo.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = StructureStubInfo.h; sourceTree = "<group>"; };
 		BCCF0D0B0EF0B8A500413C8F /* StructureStubInfo.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = StructureStubInfo.cpp; sourceTree = "<group>"; };
 		BCD202BD0E1706A7002C7E82 /* RegExpConstructor.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = RegExpConstructor.cpp; sourceTree = "<group>"; };
@@ -1508,14 +1647,15 @@
 		C22C52B913FAF6EF00B7DC0D /* strtod.cc */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = strtod.cc; sourceTree = "<group>"; };
 		C22C52BA13FAF6EF00B7DC0D /* strtod.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = strtod.h; sourceTree = "<group>"; };
 		C22C52BB13FAF6EF00B7DC0D /* utils.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = utils.h; sourceTree = "<group>"; };
-		C240305314B404C90079EB64 /* BumpSpace.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = BumpSpace.cpp; sourceTree = "<group>"; };
+		C240305314B404C90079EB64 /* CopiedSpace.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = CopiedSpace.cpp; sourceTree = "<group>"; };
 		C2B916C114DA014E00CBAC86 /* MarkedAllocator.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = MarkedAllocator.h; sourceTree = "<group>"; };
 		C2B916C414DA040C00CBAC86 /* MarkedAllocator.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = MarkedAllocator.cpp; sourceTree = "<group>"; };
-		C2C8D02B14A3C6B200578E65 /* BumpSpaceInlineMethods.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = BumpSpaceInlineMethods.h; sourceTree = "<group>"; };
-		C2C8D02E14A3CEFC00578E65 /* BumpBlock.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = BumpBlock.h; sourceTree = "<group>"; };
+		C2C8D02B14A3C6B200578E65 /* CopiedSpaceInlineMethods.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = CopiedSpaceInlineMethods.h; sourceTree = "<group>"; };
+		C2C8D02E14A3CEFC00578E65 /* CopiedBlock.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = CopiedBlock.h; sourceTree = "<group>"; };
 		C2C8D02F14A3CEFC00578E65 /* HeapBlock.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = HeapBlock.h; sourceTree = "<group>"; };
 		C2D9CA1214BCC04600304B46 /* CheckedBoolean.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = CheckedBoolean.h; sourceTree = "<group>"; };
-		C2EAA3F8149A830800FCE112 /* BumpSpace.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = BumpSpace.h; sourceTree = "<group>"; };
+		C2EAA3F8149A830800FCE112 /* CopiedSpace.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = CopiedSpace.h; sourceTree = "<group>"; };
+		C2EAD2FB14F0249800A4B159 /* CopiedAllocator.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = CopiedAllocator.h; sourceTree = "<group>"; };
 		C2EE599D13FC972A009CEAFE /* DecimalNumber.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = DecimalNumber.cpp; sourceTree = "<group>"; };
 		C2EE599E13FC972A009CEAFE /* DecimalNumber.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DecimalNumber.h; sourceTree = "<group>"; };
 		D21202280AD4310C00ED79B6 /* DateConversion.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = DateConversion.cpp; sourceTree = "<group>"; };
@@ -1585,13 +1725,20 @@
 		F692A8850255597D01FF60F7 /* UString.cpp */ = {isa = PBXFileReference; fileEncoding = 30; indentWidth = 4; lastKnownFileType = sourcecode.cpp.cpp; path = UString.cpp; sourceTree = "<group>"; tabWidth = 8; };
 		F692A8860255597D01FF60F7 /* UString.h */ = {isa = PBXFileReference; fileEncoding = 30; indentWidth = 4; lastKnownFileType = sourcecode.c.h; path = UString.h; sourceTree = "<group>"; tabWidth = 8; };
 		F692A8870255597D01FF60F7 /* JSValue.cpp */ = {isa = PBXFileReference; fileEncoding = 30; indentWidth = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSValue.cpp; sourceTree = "<group>"; tabWidth = 8; };
-		F69E86C114C6E551002C2C62 /* NumberOfCores.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = NumberOfCores.cpp; path = wtf/NumberOfCores.cpp; sourceTree = "<group>"; };
-		F69E86C214C6E551002C2C62 /* NumberOfCores.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = NumberOfCores.h; path = wtf/NumberOfCores.h; sourceTree = "<group>"; };
+		F69E86C114C6E551002C2C62 /* NumberOfCores.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = NumberOfCores.cpp; sourceTree = "<group>"; };
+		F69E86C214C6E551002C2C62 /* NumberOfCores.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = NumberOfCores.h; sourceTree = "<group>"; };
 		FDA15C1612B03028003A583A /* Complex.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = Complex.h; sourceTree = "<group>"; };
 		FE1B44790ECCD73B004F4DD1 /* StdLibExtras.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = StdLibExtras.h; sourceTree = "<group>"; };
 /* End PBXFileReference section */
 
 /* Begin PBXFrameworksBuildPhase section */
+		0FF922C614F46B130041A24E /* Frameworks */ = {
+			isa = PBXFrameworksBuildPhase;
+			buildActionMask = 2147483647;
+			files = (
+			);
+			runOnlyForDeploymentPostprocessing = 0;
+		};
 		1412111E0A48793C00480255 /* Frameworks */ = {
 			isa = PBXFrameworksBuildPhase;
 			buildActionMask = 2147483647;
@@ -1650,6 +1797,7 @@
 				141211200A48793C00480255 /* minidom */,
 				14BD59BF0A3E8F9000BAF59C /* testapi */,
 				6511230514046A4C002B101D /* testRegExp */,
+				0FF922CF14F46B130041A24E /* JSCLLIntOffsetsExtractor */,
 			);
 			name = Products;
 			sourceTree = "<group>";
@@ -1667,8 +1815,6 @@
 		0867D691FE84028FC02AAC07 /* JavaScriptCore */ = {
 			isa = PBXGroup;
 			children = (
-				F69E86C114C6E551002C2C62 /* NumberOfCores.cpp */,
-				F69E86C214C6E551002C2C62 /* NumberOfCores.h */,
 				8604F4F2143A6C4400B295F5 /* ChangeLog */,
 				A718F8211178EB4B002465A7 /* create_regex_tables */,
 				937B63CC09E766D200A671DD /* DerivedSources.make */,
@@ -1676,7 +1822,9 @@
 				F692A8540255597D01FF60F7 /* create_hash_table */,
 				F5C290E60284F98E018635CA /* JavaScriptCorePrefix.h */,
 				45E12D8806A49B0F00E9DF84 /* jsc.cpp */,
+				A767FF9F14F4502900789059 /* JSCTypedArrayStubs.h */,
 				F68EBB8C0255D4C601FF60F7 /* config.h */,
+				0F46809C14BA7F4D00BFE272 /* llint */,
 				1432EBD70A34CAD400717B9F /* API */,
 				9688CB120ED12B4E001D649F /* assembler */,
 				969A078F0ED1D3AE00F1F681 /* bytecode */,
@@ -1716,6 +1864,28 @@
 			tabWidth = 4;
 			usesTabs = 0;
 		};
+		0F46809C14BA7F4D00BFE272 /* llint */ = {
+			isa = PBXGroup;
+			children = (
+				0F0B839514BCF45A00885B4F /* LLIntEntrypoints.cpp */,
+				0F0B839614BCF45A00885B4F /* LLIntEntrypoints.h */,
+				0F0B839714BCF45A00885B4F /* LLIntThunks.cpp */,
+				0F0B839814BCF45A00885B4F /* LLIntThunks.h */,
+				0F4680CE14BBB3D100BFE272 /* LLIntData.cpp */,
+				0F4680CF14BBB3D100BFE272 /* LLIntData.h */,
+				0F4680C514BBB16900BFE272 /* LLIntCommon.h */,
+				0F4680C614BBB16900BFE272 /* LLIntOfflineAsmConfig.h */,
+				0F4680C714BBB16900BFE272 /* LowLevelInterpreter.cpp */,
+				0F4680C814BBB16900BFE272 /* LowLevelInterpreter.h */,
+				0F46809D14BA7F8200BFE272 /* LLIntExceptions.cpp */,
+				0F46809E14BA7F8200BFE272 /* LLIntExceptions.h */,
+				0F46809F14BA7F8200BFE272 /* LLIntSlowPaths.cpp */,
+				0F4680A014BA7F8200BFE272 /* LLIntSlowPaths.h */,
+				0F4680A114BA7F8200BFE272 /* LLIntOffsetsExtractor.cpp */,
+			);
+			name = llint;
+			sourceTree = "<group>";
+		};
 		141211000A48772600480255 /* tests */ = {
 			isa = PBXGroup;
 			children = (
@@ -1750,6 +1920,8 @@
 		1429D92C0ED22D7000B89619 /* jit */ = {
 			isa = PBXGroup;
 			children = (
+				0F4680D014BBC5F800BFE272 /* HostCallReturnValue.cpp */,
+				0F4680D114BBC5F800BFE272 /* HostCallReturnValue.h */,
 				0F46807F14BA572700BFE272 /* JITExceptions.cpp */,
 				0F46808014BA572700BFE272 /* JITExceptions.h */,
 				0FD82E37141AB14200179C94 /* CompactJITCodeMap.h */,
@@ -1784,15 +1956,17 @@
 		142E312A134FF0A600AFADB5 /* heap */ = {
 			isa = PBXGroup;
 			children = (
-				C2C8D02E14A3CEFC00578E65 /* BumpBlock.h */,
-				C240305314B404C90079EB64 /* BumpSpace.cpp */,
-				C2EAA3F8149A830800FCE112 /* BumpSpace.h */,
-				C2C8D02B14A3C6B200578E65 /* BumpSpaceInlineMethods.h */,
+				C2EAD2FB14F0249800A4B159 /* CopiedAllocator.h */,
+				C2C8D02E14A3CEFC00578E65 /* CopiedBlock.h */,
+				C240305314B404C90079EB64 /* CopiedSpace.cpp */,
+				C2EAA3F8149A830800FCE112 /* CopiedSpace.h */,
+				C2C8D02B14A3C6B200578E65 /* CopiedSpaceInlineMethods.h */,
 				A7521E121429169A003C8D0C /* CardSet.h */,
 				146B14DB12EB5B12001BEC1B /* ConservativeRoots.cpp */,
 				149DAAF212EB559D0083B12B /* ConservativeRoots.h */,
 				0F2C556D14738F2E00121E4F /* DFGCodeBlocks.cpp */,
 				0F2C556E14738F2E00121E4F /* DFGCodeBlocks.h */,
+				BCBE2CAD14E985AA000593AD /* GCAssertions.h */,
 				142E312B134FF0A600AFADB5 /* Handle.h */,
 				142E312C134FF0A600AFADB5 /* HandleHeap.cpp */,
 				142E312D134FF0A600AFADB5 /* HandleHeap.h */,
@@ -1817,6 +1991,7 @@
 				14D2F3D9139F4BE200491031 /* MarkedSpace.h */,
 				142D6F0E13539A4100B02E86 /* MarkStack.cpp */,
 				142D6F0F13539A4100B02E86 /* MarkStack.h */,
+				1497209014EB831500FEB1B7 /* PassWeak.h */,
 				14BA78F013AAB88F005B7C2C /* SlotVisitor.h */,
 				142E3132134FF0A600AFADB5 /* Strong.h */,
 				145722851437E140005FDE26 /* StrongInlines.h */,
@@ -1938,6 +2113,43 @@
 			tabWidth = 4;
 			usesTabs = 0;
 		};
+		2684B2C214D4A9B20072C0B6 /* url */ = {
+			isa = PBXGroup;
+			children = (
+				2684B2C314D4A9B20072C0B6 /* api */,
+				2684B2C714D4A9B20072C0B6 /* src */,
+			);
+			path = url;
+			sourceTree = "<group>";
+		};
+		2684B2C314D4A9B20072C0B6 /* api */ = {
+			isa = PBXGroup;
+			children = (
+				2684B2C414D4A9B20072C0B6 /* ParsedURL.cpp */,
+				2684B2C514D4A9B20072C0B6 /* ParsedURL.h */,
+				2684B2C614D4A9B20072C0B6 /* URLString.h */,
+			);
+			path = api;
+			sourceTree = "<group>";
+		};
+		2684B2C714D4A9B20072C0B6 /* src */ = {
+			isa = PBXGroup;
+			children = (
+				2684B2C814D4A9B20072C0B6 /* RawURLBuffer.h */,
+				2684B2C914D4A9B20072C0B6 /* URLBuffer.h */,
+				2684B2CA14D4A9B20072C0B6 /* URLCharacterTypes.cpp */,
+				2684B2CB14D4A9B20072C0B6 /* URLCharacterTypes.h */,
+				2684B2CC14D4A9B20072C0B6 /* URLComponent.h */,
+				2684B2CD14D4A9B20072C0B6 /* URLEscape.cpp */,
+				2684B2CE14D4A9B20072C0B6 /* URLEscape.h */,
+				2684B2CF14D4A9B20072C0B6 /* URLParser.h */,
+				2684B2D014D4A9B20072C0B6 /* URLQueryCanonicalizer.h */,
+				2684B2D114D4A9B20072C0B6 /* URLSegments.cpp */,
+				2684B2D214D4A9B20072C0B6 /* URLSegments.h */,
+			);
+			path = src;
+			sourceTree = "<group>";
+		};
 		650FDF8D09D0FCA700769E54 /* Derived Sources */ = {
 			isa = PBXGroup;
 			children = (
@@ -1964,6 +2176,12 @@
 		65162EF108E6A21C007556CD /* wtf */ = {
 			isa = PBXGroup;
 			children = (
+				C22C524813FAF6EF00B7DC0D /* dtoa */,
+				06D358A00DAAD9C4003B174E /* mac */,
+				8656573E115BE35200291F40 /* text */,
+				1A082776142168D60090CCAC /* threads */,
+				E195678D09E7CF1200B89D13 /* unicode */,
+				2684B2C214D4A9B20072C0B6 /* url */,
 				A1D764511354448B00C5C7C0 /* Alignment.h */,
 				93AA4F770957251F0084B3A7 /* AlwaysInline.h */,
 				A73BE154148420520091204B /* ArrayBuffer.cpp */,
@@ -1985,12 +2203,15 @@
 				A7A1F7AA0F252B3C00E184E2 /* ByteArray.cpp */,
 				A7A1F7AB0F252B3C00E184E2 /* ByteArray.h */,
 				A7BC0C81140608B000B1BB71 /* CheckedArithmetic.h */,
+				C2D9CA1214BCC04600304B46 /* CheckedBoolean.h */,
 				BC66BAE213F4928F00C23FAE /* Compiler.h */,
 				FDA15C1612B03028003A583A /* Complex.h */,
 				97941A7C1302A098004A3447 /* CryptographicallyRandomNumber.cpp */,
 				97941A7D1302A098004A3447 /* CryptographicallyRandomNumber.h */,
 				180B9AEF0F16C569009BDBC5 /* CurrentTime.cpp */,
 				180B9AF00F16C569009BDBC5 /* CurrentTime.h */,
+				0F9FC8CD14E612D500D52AE0 /* DataLog.cpp */,
+				0F9FC8CE14E612D500D52AE0 /* DataLog.h */,
 				41359CF40FDD89CB00206180 /* DateMath.cpp */,
 				41359CF50FDD89CB00206180 /* DateMath.h */,
 				C2EE599D13FC972A009CEAFE /* DecimalNumber.cpp */,
@@ -1999,7 +2220,6 @@
 				5186111D0CC824830081412B /* Deque.h */,
 				938C4F6B0CA06BCE00D9310A /* DisallowCType.h */,
 				14456A311314657800212CA3 /* DoublyLinkedList.h */,
-				C22C524813FAF6EF00B7DC0D /* dtoa */,
 				651F6412039D5B5F0078395C /* dtoa.cpp */,
 				651F6413039D5B5F0078395C /* dtoa.h */,
 				D75AF59512F8CB9500FC0ADF /* DynamicAnnotations.cpp */,
@@ -2032,7 +2252,6 @@
 				657EB7450B708F540063461B /* ListHashSet.h */,
 				148A1626095D16BB00666D0D /* ListRefPtr.h */,
 				E1EE79270D6C964500FEA3BA /* Locker.h */,
-				06D358A00DAAD9C4003B174E /* mac */,
 				06D358A20DAAD9C4003B174E /* MainThread.cpp */,
 				06D358A30DAAD9C4003B174E /* MainThread.h */,
 				5DBD18AF0C5401A700C15EAE /* MallocZoneSupport.h */,
@@ -2048,6 +2267,8 @@
 				C0A2723F0E509F1E00E96E15 /* NotFound.h */,
 				93854A9912C93D3B00DAAF77 /* NullPtr.cpp */,
 				933F5CDB126922690049191E /* NullPtr.h */,
+				F69E86C114C6E551002C2C62 /* NumberOfCores.cpp */,
+				F69E86C214C6E551002C2C62 /* NumberOfCores.h */,
 				1400067612A6F7830064D123 /* OSAllocator.h */,
 				1400069212A6F9E10064D123 /* OSAllocatorPosix.cpp */,
 				97941A3F130299DB004A3447 /* OSRandomSource.cpp */,
@@ -2102,7 +2323,6 @@
 				6541BD7008E80A17002CBEE7 /* TCSystemAlloc.cpp */,
 				6541BD7108E80A17002CBEE7 /* TCSystemAlloc.h */,
 				0BCD83541485841200EA2003 /* TemporaryChange.h */,
-				8656573E115BE35200291F40 /* text */,
 				18BAB52710DADFCD000D945B /* ThreadIdentifierDataPthreads.cpp */,
 				18BAB52810DADFCD000D945B /* ThreadIdentifierDataPthreads.h */,
 				5D6A566A0F05995500266145 /* Threading.cpp */,
@@ -2110,7 +2330,6 @@
 				BC5F7BBC11823B590052C02C /* ThreadingPrimitives.h */,
 				E1EE793C0D6C9B9200FEA3BA /* ThreadingPthreads.cpp */,
 				0BAC949E1338728400CF135B /* ThreadRestrictionVerifier.h */,
-				1A082776142168D60090CCAC /* threads */,
 				BC5F7BBD11823B590052C02C /* ThreadSafeRefCounted.h */,
 				E1B7C8BD0DA3A3360074B0DC /* ThreadSpecific.h */,
 				A73BE17D148420840091204B /* TypedArrayBase.h */,
@@ -2120,7 +2339,6 @@
 				A73BE167148420520091204B /* Uint32Array.h */,
 				A73BE163148420520091204B /* Uint8Array.h */,
 				91A3905514C0F47200F67901 /* Uint8ClampedArray.h */,
-				E195678D09E7CF1200B89D13 /* unicode */,
 				0FD52AAC1430359D0026DC9F /* UnionFind.h */,
 				935AF46B09E9D9DB00ACD1D8 /* UnusedParam.h */,
 				E17FF770112131D200076A19 /* ValueCheck.h */,
@@ -2129,7 +2347,6 @@
 				96DD73780F9DA3100027FBCC /* VMTags.h */,
 				86D08D5111793613006E5ED0 /* WTFThreadData.cpp */,
 				86D08D5211793613006E5ED0 /* WTFThreadData.h */,
-				C2D9CA1214BCC04600304B46 /* CheckedBoolean.h */,
 			);
 			path = wtf;
 			sourceTree = "<group>";
@@ -2179,6 +2396,8 @@
 		7EF6E0BB0EB7A1EC0079AFAF /* runtime */ = {
 			isa = PBXGroup;
 			children = (
+				0F21C27914BE727300ADC64B /* CodeSpecializationKind.h */,
+				0F21C27A14BE727300ADC64B /* ExecutionHarness.h */,
 				0F15F15D14B7A73A005DE37D /* CommonSlowPaths.h */,
 				BCF605110E203EF800B9A64D /* ArgList.cpp */,
 				BCF605120E203EF800B9A64D /* ArgList.h */,
@@ -2437,6 +2656,8 @@
 		86EC9DB31328DF44002B2AD7 /* dfg */ = {
 			isa = PBXGroup;
 			children = (
+				0FFFC94914EF909500C72532 /* DFGArithNodeFlagsInferencePhase.cpp */,
+				0FFFC94A14EF909500C72532 /* DFGArithNodeFlagsInferencePhase.h */,
 				0F62016D143FCD2F0068B77C /* DFGAbstractState.cpp */,
 				0F62016E143FCD2F0068B77C /* DFGAbstractState.h */,
 				0F62016F143FCD2F0068B77C /* DFGAbstractValue.h */,
@@ -2447,6 +2668,10 @@
 				86EC9DB41328DF82002B2AD7 /* DFGByteCodeParser.cpp */,
 				86EC9DB51328DF82002B2AD7 /* DFGByteCodeParser.h */,
 				0F7B294814C3CD23007C3DB1 /* DFGCCallHelpers.h */,
+				0FFFC94B14EF909500C72532 /* DFGCFAPhase.cpp */,
+				0FFFC94C14EF909500C72532 /* DFGCFAPhase.h */,
+				0FFFC94D14EF909500C72532 /* DFGCSEPhase.cpp */,
+				0FFFC94E14EF909500C72532 /* DFGCSEPhase.h */,
 				0FD82E1E14172C2F00179C94 /* DFGCapabilities.cpp */,
 				0FD82E1F14172C2F00179C94 /* DFGCapabilities.h */,
 				0FC0977E1469EBC400CF2442 /* DFGCommon.h */,
@@ -2475,8 +2700,10 @@
 				0FC0976F14693AEF00CF2442 /* DFGOSRExitCompiler.h */,
 				0FC09775146943AD00CF2442 /* DFGOSRExitCompiler32_64.cpp */,
 				0FC0977014693AEF00CF2442 /* DFGOSRExitCompiler64.cpp */,
-				0FD3C82314115D1A00FD81CB /* DFGPropagator.cpp */,
-				0FD3C82414115D2200FD81CB /* DFGPropagator.h */,
+				0FFFC94F14EF909500C72532 /* DFGPhase.cpp */,
+				0FFFC95014EF909500C72532 /* DFGPhase.h */,
+				0FFFC95114EF909500C72532 /* DFGPredictionPropagationPhase.cpp */,
+				0FFFC95214EF909500C72532 /* DFGPredictionPropagationPhase.h */,
 				86EC9DC11328DF82002B2AD7 /* DFGRegisterBank.h */,
 				86BB09BE138E381B0056702F /* DFGRepatch.cpp */,
 				86BB09BF138E381B0056702F /* DFGRepatch.h */,
@@ -2488,6 +2715,8 @@
 				0FC0979F146B28C700CF2442 /* DFGThunks.cpp */,
 				0FC097A0146B28C700CF2442 /* DFGThunks.h */,
 				0F620172143FCD2F0068B77C /* DFGVariableAccessData.h */,
+				0FFFC95314EF909500C72532 /* DFGVirtualRegisterAllocationPhase.cpp */,
+				0FFFC95414EF909500C72532 /* DFGVirtualRegisterAllocationPhase.h */,
 			);
 			name = dfg;
 			sourceTree = "<group>";
@@ -2553,6 +2782,15 @@
 		969A078F0ED1D3AE00F1F681 /* bytecode */ = {
 			isa = PBXGroup;
 			children = (
+				0FB5467C14F5CFD3002C2989 /* MethodOfGettingAValueProfile.cpp */,
+				0FB5467A14F5C7D4002C2989 /* MethodOfGettingAValueProfile.h */,
+				0FB5467814F5C468002C2989 /* LazyOperandValueProfile.cpp */,
+				0FB5467614F59AD1002C2989 /* LazyOperandValueProfile.h */,
+				0F21C27E14BEAA8000ADC64B /* BytecodeConventions.h */,
+				0F0FC45814BD15F100B81154 /* LLIntCallLinkInfo.h */,
+				0F9FC8BF14E1B5FB00D52AE0 /* PolymorphicPutByIdList.cpp */,
+				0F9FC8C014E1B5FB00D52AE0 /* PolymorphicPutByIdList.h */,
+				0F9FC8C114E1B5FB00D52AE0 /* PutKind.h */,
 				0F93329314CA7DC10085F3C6 /* CallLinkStatus.cpp */,
 				0F93329414CA7DC10085F3C6 /* CallLinkStatus.h */,
 				0F93329514CA7DC10085F3C6 /* GetByIdStatus.cpp */,
@@ -2591,7 +2829,6 @@
 				1429D8840ED21C3D00B89619 /* SamplingTool.h */,
 				BCCF0D0B0EF0B8A500413C8F /* StructureStubInfo.cpp */,
 				BCCF0D070EF0AAB900413C8F /* StructureStubInfo.h */,
-				0FD82E8E14207A5100179C94 /* ValueProfile.cpp */,
 				0F963B3613FC6FDE0002D9B2 /* ValueProfile.h */,
 				0F426A451460CBAB00131F8F /* ValueRecovery.h */,
 				0F426A461460CBAB00131F8F /* VirtualRegister.h */,
@@ -2684,6 +2921,7 @@
 				A73BE169148420520091204B /* ArrayBuffer.h in Headers */,
 				C2D9CA1314BCC04600304B46 /* CheckedBoolean.h in Headers */,
 				A73BE16B148420520091204B /* ArrayBufferView.h in Headers */,
+				C2EAD2FC14F0249800A4B159 /* CopiedAllocator.h in Headers */,
 				C2B916C214DA014E00CBAC86 /* MarkedAllocator.h in Headers */,
 				BC18C3E60E16F5CD00B34460 /* ArrayConstructor.h in Headers */,
 				BC18C3E70E16F5CD00B34460 /* ArrayPrototype.h in Headers */,
@@ -2710,10 +2948,10 @@
 				E4D8CEFB12FC439600BC9F5A /* BloomFilter.h in Headers */,
 				BC18C3EC0E16F5CD00B34460 /* BooleanObject.h in Headers */,
 				0FD82E85141F3FE300179C94 /* BoundsCheckedPointer.h in Headers */,
-				C2C8D03014A3CEFC00578E65 /* BumpBlock.h in Headers */,
+				C2C8D03014A3CEFC00578E65 /* CopiedBlock.h in Headers */,
 				86676D5211FED9BC004B6863 /* BumpPointerAllocator.h in Headers */,
-				C2EAA3FA149A835E00FCE112 /* BumpSpace.h in Headers */,
-				C2C8D02D14A3C6E000578E65 /* BumpSpaceInlineMethods.h in Headers */,
+				C2EAA3FA149A835E00FCE112 /* CopiedSpace.h in Headers */,
+				C2C8D02D14A3C6E000578E65 /* CopiedSpaceInlineMethods.h in Headers */,
 				A7A1F7AD0F252B3C00E184E2 /* ByteArray.h in Headers */,
 				969A07230ED1CE3300F1F681 /* BytecodeGenerator.h in Headers */,
 				C22C52F613FAF6EF00B7DC0D /* cached-powers.h in Headers */,
@@ -2775,7 +3013,6 @@
 				0FD82E57141DAF1000179C94 /* DFGOSREntry.h in Headers */,
 				0FC0976A1468A6F700CF2442 /* DFGOSRExit.h in Headers */,
 				0FC0977114693AF500CF2442 /* DFGOSRExitCompiler.h in Headers */,
-				0FD3C82714115D4F00FD81CB /* DFGPropagator.h in Headers */,
 				86EC9DD11328DF82002B2AD7 /* DFGRegisterBank.h in Headers */,
 				86BB09C1138E381B0056702F /* DFGRepatch.h in Headers */,
 				86ECA3FA132DF25A002B2AD7 /* DFGScoreBoard.h in Headers */,
@@ -2963,6 +3200,7 @@
 				7934BB7D1361979400CB99A1 /* ParallelJobsGeneric.h in Headers */,
 				7934BB7E1361979400CB99A1 /* ParallelJobsLibdispatch.h in Headers */,
 				7934BB7F1361979400CB99A1 /* ParallelJobsOpenMP.h in Headers */,
+				2684B2D414D4A9B20072C0B6 /* ParsedURL.h in Headers */,
 				BC18C44B0E16F5CD00B34460 /* Parser.h in Headers */,
 				93052C350FB792190048FDC3 /* ParserArena.h in Headers */,
 				65303D641447B9E100D3F904 /* ParserTokens.h in Headers */,
@@ -2986,6 +3224,7 @@
 				147B84630E6DE6B1004775A4 /* PutPropertySlot.h in Headers */,
 				088FA5BC0EF76D4300578E6F /* RandomNumber.h in Headers */,
 				08E279E90EF83B10007DB523 /* RandomNumberSeed.h in Headers */,
+				2684B2D614D4A9B20072C0B6 /* RawURLBuffer.h in Headers */,
 				0F963B2713F753BB0002D9B2 /* RedBlackTree.h in Headers */,
 				BC18C4570E16F5CD00B34460 /* RefCounted.h in Headers */,
 				90D3469C0E285280009492EE /* RefCountedLeakCounter.h in Headers */,
@@ -3075,6 +3314,14 @@
 				BC18C4740E16F5CD00B34460 /* UnicodeIcu.h in Headers */,
 				0FD52AAE143035A00026DC9F /* UnionFind.h in Headers */,
 				BC18C4750E16F5CD00B34460 /* UnusedParam.h in Headers */,
+				2684B2D514D4A9B20072C0B6 /* URLString.h in Headers */,
+				2684B2D714D4A9B20072C0B6 /* URLBuffer.h in Headers */,
+				2684B2D914D4A9B20072C0B6 /* URLCharacterTypes.h in Headers */,
+				2684B2DA14D4A9B20072C0B6 /* URLComponent.h in Headers */,
+				2684B2DC14D4A9B20072C0B6 /* URLEscape.h in Headers */,
+				2684B2DD14D4A9B20072C0B6 /* URLParser.h in Headers */,
+				2684B2DE14D4A9B20072C0B6 /* URLQueryCanonicalizer.h in Headers */,
+				2684B2E014D4A9B20072C0B6 /* URLSegments.h in Headers */,
 				BC18C4760E16F5CD00B34460 /* UString.h in Headers */,
 				08DDA5C11264631700751732 /* UStringBuilder.h in Headers */,
 				BC18C4770E16F5CD00B34460 /* UTF8.h in Headers */,
@@ -3104,7 +3351,16 @@
 				86704B8A12DBA33700A9FE7B /* YarrPattern.h in Headers */,
 				86704B4312DB8A8100A9FE7B /* YarrSyntaxChecker.h in Headers */,
 				0F15F15F14B7A73E005DE37D /* CommonSlowPaths.h in Headers */,
+				0F4680A314BA7F8D00BFE272 /* LLIntExceptions.h in Headers */,
+				0F4680A514BA7F8D00BFE272 /* LLIntSlowPaths.h in Headers */,
 				0F46808214BA572D00BFE272 /* JITExceptions.h in Headers */,
+				0F4680CA14BBB16C00BFE272 /* LLIntCommon.h in Headers */,
+				0F4680CB14BBB17200BFE272 /* LLIntOfflineAsmConfig.h in Headers */,
+				0F4680CD14BBB17D00BFE272 /* LowLevelInterpreter.h in Headers */,
+				0F4680D314BBD16700BFE272 /* LLIntData.h in Headers */,
+				0F4680D514BBD24B00BFE272 /* HostCallReturnValue.h in Headers */,
+				0F0B839B14BCF46000885B4F /* LLIntEntrypoints.h in Headers */,
+				0F0B839D14BCF46600885B4F /* LLIntThunks.h in Headers */,
 				0F0B83A714BCF50700885B4F /* CodeType.h in Headers */,
 				0F0B83A914BCF56200885B4F /* HandlerInfo.h in Headers */,
 				0F0B83AB14BCF5BB00885B4F /* ExpressionRangeInfo.h in Headers */,
@@ -3113,7 +3369,11 @@
 				0F0B83B514BCF86200885B4F /* MethodCallLinkInfo.h in Headers */,
 				0F0B83B714BCF8E100885B4F /* GlobalResolveInfo.h in Headers */,
 				0F0B83B914BCF95F00885B4F /* CallReturnOffsetToBytecodeOffset.h in Headers */,
+				0F0FC45A14BD15F500B81154 /* LLIntCallLinkInfo.h in Headers */,
 				0F21C26814BE5F6800ADC64B /* JITDriver.h in Headers */,
+				0F21C27C14BE727600ADC64B /* ExecutionHarness.h in Headers */,
+				0F21C27D14BE727A00ADC64B /* CodeSpecializationKind.h in Headers */,
+				0F21C27F14BEAA8200ADC64B /* BytecodeConventions.h in Headers */,
 				0F7B294A14C3CD29007C3DB1 /* DFGCCallHelpers.h in Headers */,
 				0F7B294B14C3CD2F007C3DB1 /* DFGCapabilities.h in Headers */,
 				0F7B294C14C3CD43007C3DB1 /* DFGByteCodeCache.h in Headers */,
@@ -3128,12 +3388,43 @@
 				0F55F0F514D1063C00AC7649 /* AbstractPC.h in Headers */,
 				0F66E16B14DF3F1600B7B2E4 /* DFGNodeReferenceBlob.h in Headers */,
 				0F66E16C14DF3F1600B7B2E4 /* DFGNodeUse.h in Headers */,
+				0F9FC8D114E612DA00D52AE0 /* DataLog.h in Headers */,
+				0F9FC8C414E1B60000D52AE0 /* PolymorphicPutByIdList.h in Headers */,
+				0F9FC8C514E1B60400D52AE0 /* PutKind.h in Headers */,
+				BCBE2CAE14E985AA000593AD /* GCAssertions.h in Headers */,
+				0FFFC95614EF909C00C72532 /* DFGArithNodeFlagsInferencePhase.h in Headers */,
+				0FFFC95814EF90A200C72532 /* DFGCFAPhase.h in Headers */,
+				0FFFC95A14EF90A900C72532 /* DFGCSEPhase.h in Headers */,
+				0FFFC95C14EF90AF00C72532 /* DFGPhase.h in Headers */,
+				0FFFC95E14EF90B700C72532 /* DFGPredictionPropagationPhase.h in Headers */,
+				0FFFC96014EF90BD00C72532 /* DFGVirtualRegisterAllocationPhase.h in Headers */,
+				1497209114EB831500FEB1B7 /* PassWeak.h in Headers */,
+				0FB5467714F59B5C002C2989 /* LazyOperandValueProfile.h in Headers */,
+				0FB5467B14F5C7E1002C2989 /* MethodOfGettingAValueProfile.h in Headers */,
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 		};
 /* End PBXHeadersBuildPhase section */
 
 /* Begin PBXNativeTarget section */
+		0FF922C314F46B130041A24E /* JSCLLIntOffsetsExtractor */ = {
+			isa = PBXNativeTarget;
+			buildConfigurationList = 0FF922CA14F46B130041A24E /* Build configuration list for PBXNativeTarget "JSCLLIntOffsetsExtractor" */;
+			buildPhases = (
+				0FF922C414F46B130041A24E /* Sources */,
+				0FF922C614F46B130041A24E /* Frameworks */,
+			);
+			buildRules = (
+			);
+			dependencies = (
+				0FF922D314F46B2F0041A24E /* PBXTargetDependency */,
+			);
+			name = JSCLLIntOffsetsExtractor;
+			productInstallPath = /usr/local/bin;
+			productName = jsc;
+			productReference = 0FF922CF14F46B130041A24E /* JSCLLIntOffsetsExtractor */;
+			productType = "com.apple.product-type.tool";
+		};
 		1412111F0A48793C00480255 /* minidom */ = {
 			isa = PBXNativeTarget;
 			buildConfigurationList = 141211390A48798400480255 /* Build configuration list for PBXNativeTarget "minidom" */;
@@ -3260,11 +3551,29 @@
 				14BD59BE0A3E8F9000BAF59C /* testapi */,
 				932F5BDA0822A1C700736975 /* jsc */,
 				651122F714046A4C002B101D /* testRegExp */,
+				0F4680A914BA7FD900BFE272 /* LLInt Offsets */,
+				0FF922C314F46B130041A24E /* JSCLLIntOffsetsExtractor */,
 			);
 		};
 /* End PBXProject section */
 
 /* Begin PBXShellScriptBuildPhase section */
+		0F4680AA14BA7FD900BFE272 /* Generate Derived Sources */ = {
+			isa = PBXShellScriptBuildPhase;
+			buildActionMask = 2147483647;
+			files = (
+			);
+			inputPaths = (
+				"$(SRCROOT)/llint/LowLevelAssembler.asm",
+			);
+			name = "Generate Derived Sources";
+			outputPaths = (
+				"$(BUILT_PRODUCTS_DIR)/LLIntOffsets/LLIntDesiredOffsets.h",
+			);
+			runOnlyForDeploymentPostprocessing = 0;
+			shellPath = /bin/sh;
+			shellScript = "mkdir -p \"${BUILT_PRODUCTS_DIR}/LLIntOffsets/\"\n\n/usr/bin/env ruby \"${SRCROOT}/offlineasm/generate_offset_extractor.rb\" \"${SRCROOT}/llint/LowLevelInterpreter.asm\" \"${BUILT_PRODUCTS_DIR}/LLIntOffsets/LLIntDesiredOffsets.h\"\n";
+		};
 		3713F014142905240036387F /* Check For Inappropriate Objective-C Class Names */ = {
 			isa = PBXShellScriptBuildPhase;
 			buildActionMask = 2147483647;
@@ -3370,7 +3679,7 @@
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 			shellPath = /bin/sh;
-			shellScript = "mkdir -p \"${BUILT_PRODUCTS_DIR}/DerivedSources/JavaScriptCore/docs\"\ncd \"${BUILT_PRODUCTS_DIR}/DerivedSources/JavaScriptCore\"\n\n/bin/ln -sfh \"${SRCROOT}\" JavaScriptCore\nexport JavaScriptCore=\"JavaScriptCore\"\nexport BUILT_PRODUCTS_DIR=\"../..\"\n\nmake --no-builtin-rules -f \"JavaScriptCore/DerivedSources.make\" -j `/usr/sbin/sysctl -n hw.ncpu`\n";
+			shellScript = "mkdir -p \"${BUILT_PRODUCTS_DIR}/DerivedSources/JavaScriptCore/docs\"\ncd \"${BUILT_PRODUCTS_DIR}/DerivedSources/JavaScriptCore\"\n\n/bin/ln -sfh \"${SRCROOT}\" JavaScriptCore\nexport JavaScriptCore=\"JavaScriptCore\"\nexport BUILT_PRODUCTS_DIR=\"../..\"\n\nmake --no-builtin-rules -f \"JavaScriptCore/DerivedSources.make\" -j `/usr/sbin/sysctl -n hw.ncpu`\n\n/usr/bin/env ruby JavaScriptCore/offlineasm/asm.rb JavaScriptCore/llint/LowLevelInterpreter.asm ${BUILT_PRODUCTS_DIR}/JSCLLIntOffsetsExtractor LLIntAssembly.h\n";
 		};
 		9319586B09D9F91A00A56FD4 /* Check For Global Initializers */ = {
 			isa = PBXShellScriptBuildPhase;
@@ -3405,6 +3714,14 @@
 /* End PBXShellScriptBuildPhase section */
 
 /* Begin PBXSourcesBuildPhase section */
+		0FF922C414F46B130041A24E /* Sources */ = {
+			isa = PBXSourcesBuildPhase;
+			buildActionMask = 2147483647;
+			files = (
+				0FF922D414F46B410041A24E /* LLIntOffsetsExtractor.cpp in Sources */,
+			);
+			runOnlyForDeploymentPostprocessing = 0;
+		};
 		1412111D0A48793C00480255 /* Sources */ = {
 			isa = PBXSourcesBuildPhase;
 			buildActionMask = 2147483647;
@@ -3454,7 +3771,7 @@
 				14280863107EC11A0013E7B2 /* BooleanConstructor.cpp in Sources */,
 				14280864107EC11A0013E7B2 /* BooleanObject.cpp in Sources */,
 				14280865107EC11A0013E7B2 /* BooleanPrototype.cpp in Sources */,
-				C240305514B404E60079EB64 /* BumpSpace.cpp in Sources */,
+				C240305514B404E60079EB64 /* CopiedSpace.cpp in Sources */,
 				A7A1F7AC0F252B3C00E184E2 /* ByteArray.cpp in Sources */,
 				148F21AA107EC53A0042EC2C /* BytecodeGenerator.cpp in Sources */,
 				C22C52F513FAF6EF00B7DC0D /* cached-powers.cc in Sources */,
@@ -3495,7 +3812,6 @@
 				0FC09792146A6F7300CF2442 /* DFGOSRExitCompiler.cpp in Sources */,
 				0FC09776146943B000CF2442 /* DFGOSRExitCompiler32_64.cpp in Sources */,
 				0FC0977214693AF900CF2442 /* DFGOSRExitCompiler64.cpp in Sources */,
-				0FD3C82514115D4000FD81CB /* DFGPropagator.cpp in Sources */,
 				86BB09C0138E381B0056702F /* DFGRepatch.cpp in Sources */,
 				86EC9DD21328DF82002B2AD7 /* DFGSpeculativeJIT.cpp in Sources */,
 				86880F1F14328BB900B08D42 /* DFGSpeculativeJIT32_64.cpp in Sources */,
@@ -3606,6 +3922,7 @@
 				14FFF98C12BFFF7500795BB8 /* PageAllocationAligned.cpp in Sources */,
 				14B3EF0612BC24DD00D29EFF /* PageBlock.cpp in Sources */,
 				7934BB7C1361979400CB99A1 /* ParallelJobsGeneric.cpp in Sources */,
+				2684B2D314D4A9B20072C0B6 /* ParsedURL.cpp in Sources */,
 				148F21BC107EC54D0042EC2C /* Parser.cpp in Sources */,
 				93052C340FB792190048FDC3 /* ParserArena.cpp in Sources */,
 				0FD82E86141F3FF100179C94 /* PredictedType.cpp in Sources */,
@@ -3651,9 +3968,11 @@
 				A7386555118697B400540279 /* ThunkGenerators.cpp in Sources */,
 				14A42E3F0F4F60EE00599099 /* TimeoutChecker.cpp in Sources */,
 				0B330C270F38C62300692DE3 /* TypeTraits.cpp in Sources */,
+				2684B2D814D4A9B20072C0B6 /* URLCharacterTypes.cpp in Sources */,
+				2684B2DB14D4A9B20072C0B6 /* URLEscape.cpp in Sources */,
+				2684B2DF14D4A9B20072C0B6 /* URLSegments.cpp in Sources */,
 				14469DEE107EC7E700650446 /* UString.cpp in Sources */,
 				E1EF79AA0CE97BA60088D500 /* UTF8.cpp in Sources */,
-				0FD82E9014207A5F00179C94 /* ValueProfile.cpp in Sources */,
 				0FC81516140511B500CFA603 /* VTableSpectrum.cpp in Sources */,
 				0FC8150B14043C0E00CFA603 /* WriteBarrierSupport.cpp in Sources */,
 				868BFA17117CF19900B908B1 /* WTFString.cpp in Sources */,
@@ -3662,7 +3981,14 @@
 				86704B8612DBA33700A9FE7B /* YarrJIT.cpp in Sources */,
 				86704B8912DBA33700A9FE7B /* YarrPattern.cpp in Sources */,
 				86704B4212DB8A8100A9FE7B /* YarrSyntaxChecker.cpp in Sources */,
+				0F4680A414BA7F8D00BFE272 /* LLIntSlowPaths.cpp in Sources */,
+				0F4680A814BA7FAB00BFE272 /* LLIntExceptions.cpp in Sources */,
 				0F46808314BA573100BFE272 /* JITExceptions.cpp in Sources */,
+				0F4680CC14BBB17A00BFE272 /* LowLevelInterpreter.cpp in Sources */,
+				0F4680D214BBD16500BFE272 /* LLIntData.cpp in Sources */,
+				0F4680D414BBD24900BFE272 /* HostCallReturnValue.cpp in Sources */,
+				0F0B839A14BCF45D00885B4F /* LLIntEntrypoints.cpp in Sources */,
+				0F0B839C14BCF46300885B4F /* LLIntThunks.cpp in Sources */,
 				0F0B83B014BCF71600885B4F /* CallLinkInfo.cpp in Sources */,
 				0F0B83B414BCF86000885B4F /* MethodCallLinkInfo.cpp in Sources */,
 				F69E86C314C6E551002C2C62 /* NumberOfCores.cpp in Sources */,
@@ -3674,6 +4000,16 @@
 				86B5826714D2796C00A9C306 /* CodeProfile.cpp in Sources */,
 				86B5826914D2797000A9C306 /* CodeProfiling.cpp in Sources */,
 				C2B916C514DA040C00CBAC86 /* MarkedAllocator.cpp in Sources */,
+				0F9FC8D014E612D800D52AE0 /* DataLog.cpp in Sources */,
+				0F9FC8C314E1B5FE00D52AE0 /* PolymorphicPutByIdList.cpp in Sources */,
+				0FFFC95514EF909A00C72532 /* DFGArithNodeFlagsInferencePhase.cpp in Sources */,
+				0FFFC95714EF90A000C72532 /* DFGCFAPhase.cpp in Sources */,
+				0FFFC95914EF90A600C72532 /* DFGCSEPhase.cpp in Sources */,
+				0FFFC95B14EF90AD00C72532 /* DFGPhase.cpp in Sources */,
+				0FFFC95D14EF90B300C72532 /* DFGPredictionPropagationPhase.cpp in Sources */,
+				0FFFC95F14EF90BB00C72532 /* DFGVirtualRegisterAllocationPhase.cpp in Sources */,
+				0FB5467914F5C46B002C2989 /* LazyOperandValueProfile.cpp in Sources */,
+				0FB5467D14F5CFD6002C2989 /* MethodOfGettingAValueProfile.cpp in Sources */,
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 		};
@@ -3688,6 +4024,16 @@
 /* End PBXSourcesBuildPhase section */
 
 /* Begin PBXTargetDependency section */
+		0FF922D314F46B2F0041A24E /* PBXTargetDependency */ = {
+			isa = PBXTargetDependency;
+			target = 0F4680A914BA7FD900BFE272 /* LLInt Offsets */;
+			targetProxy = 0FF922D214F46B2F0041A24E /* PBXContainerItemProxy */;
+		};
+		0FF922D614F46B600041A24E /* PBXTargetDependency */ = {
+			isa = PBXTargetDependency;
+			target = 0FF922C314F46B130041A24E /* JSCLLIntOffsetsExtractor */;
+			targetProxy = 0FF922D514F46B600041A24E /* PBXContainerItemProxy */;
+		};
 		141214BF0A49190E00480255 /* PBXTargetDependency */ = {
 			isa = PBXTargetDependency;
 			target = 1412111F0A48793C00480255 /* minidom */;
@@ -3721,6 +4067,70 @@
 /* End PBXTargetDependency section */
 
 /* Begin XCBuildConfiguration section */
+		0F4680AD14BA7FD900BFE272 /* Debug */ = {
+			isa = XCBuildConfiguration;
+			buildSettings = {
+				PRODUCT_NAME = "Derived Sources copy";
+			};
+			name = Debug;
+		};
+		0F4680AE14BA7FD900BFE272 /* Release */ = {
+			isa = XCBuildConfiguration;
+			buildSettings = {
+				PRODUCT_NAME = "Derived Sources copy";
+			};
+			name = Release;
+		};
+		0F4680AF14BA7FD900BFE272 /* Profiling */ = {
+			isa = XCBuildConfiguration;
+			buildSettings = {
+				PRODUCT_NAME = "Derived Sources copy";
+			};
+			name = Profiling;
+		};
+		0F4680B014BA7FD900BFE272 /* Production */ = {
+			isa = XCBuildConfiguration;
+			buildSettings = {
+				PRODUCT_NAME = "Derived Sources copy";
+			};
+			name = Production;
+		};
+		0FF922CB14F46B130041A24E /* Debug */ = {
+			isa = XCBuildConfiguration;
+			baseConfigurationReference = 5DAFD6CB146B686300FBEFB4 /* JSC.xcconfig */;
+			buildSettings = {
+				PRODUCT_NAME = JSCLLIntOffsetsExtractor;
+				USER_HEADER_SEARCH_PATHS = ". icu $(HEADER_SEARCH_PATHS) $(BUILT_PRODUCTS_DIR)/LLIntOffsets";
+			};
+			name = Debug;
+		};
+		0FF922CC14F46B130041A24E /* Release */ = {
+			isa = XCBuildConfiguration;
+			baseConfigurationReference = 5DAFD6CB146B686300FBEFB4 /* JSC.xcconfig */;
+			buildSettings = {
+				PRODUCT_NAME = JSCLLIntOffsetsExtractor;
+				USER_HEADER_SEARCH_PATHS = ". icu $(HEADER_SEARCH_PATHS) $(BUILT_PRODUCTS_DIR)/LLIntOffsets";
+			};
+			name = Release;
+		};
+		0FF922CD14F46B130041A24E /* Profiling */ = {
+			isa = XCBuildConfiguration;
+			baseConfigurationReference = 5DAFD6CB146B686300FBEFB4 /* JSC.xcconfig */;
+			buildSettings = {
+				PRODUCT_NAME = JSCLLIntOffsetsExtractor;
+				USER_HEADER_SEARCH_PATHS = ". icu $(HEADER_SEARCH_PATHS) $(BUILT_PRODUCTS_DIR)/LLIntOffsets";
+			};
+			name = Profiling;
+		};
+		0FF922CE14F46B130041A24E /* Production */ = {
+			isa = XCBuildConfiguration;
+			baseConfigurationReference = 5DAFD6CB146B686300FBEFB4 /* JSC.xcconfig */;
+			buildSettings = {
+				PRODUCT_NAME = JSCLLIntOffsetsExtractor;
+				USER_HEADER_SEARCH_PATHS = ". icu $(HEADER_SEARCH_PATHS) $(BUILT_PRODUCTS_DIR)/LLIntOffsets";
+			};
+			name = Production;
+		};
 		1412113A0A48798400480255 /* Debug */ = {
 			isa = XCBuildConfiguration;
 			buildSettings = {
@@ -3962,6 +4372,28 @@
 /* End XCBuildConfiguration section */
 
 /* Begin XCConfigurationList section */
+		0F4680AC14BA7FD900BFE272 /* Build configuration list for PBXAggregateTarget "LLInt Offsets" */ = {
+			isa = XCConfigurationList;
+			buildConfigurations = (
+				0F4680AD14BA7FD900BFE272 /* Debug */,
+				0F4680AE14BA7FD900BFE272 /* Release */,
+				0F4680AF14BA7FD900BFE272 /* Profiling */,
+				0F4680B014BA7FD900BFE272 /* Production */,
+			);
+			defaultConfigurationIsVisible = 0;
+			defaultConfigurationName = Production;
+		};
+		0FF922CA14F46B130041A24E /* Build configuration list for PBXNativeTarget "JSCLLIntOffsetsExtractor" */ = {
+			isa = XCConfigurationList;
+			buildConfigurations = (
+				0FF922CB14F46B130041A24E /* Debug */,
+				0FF922CC14F46B130041A24E /* Release */,
+				0FF922CD14F46B130041A24E /* Profiling */,
+				0FF922CE14F46B130041A24E /* Production */,
+			);
+			defaultConfigurationIsVisible = 0;
+			defaultConfigurationName = Production;
+		};
 		141211390A48798400480255 /* Build configuration list for PBXNativeTarget "minidom" */ = {
 			isa = XCConfigurationList;
 			buildConfigurations = (
diff --git a/Source/JavaScriptCore/Target.pri b/Source/JavaScriptCore/Target.pri
index 155ee124d..8fa498c08 100644
--- a/Source/JavaScriptCore/Target.pri
+++ b/Source/JavaScriptCore/Target.pri
@@ -55,17 +55,19 @@ SOURCES += \
     bytecode/DFGExitProfile.cpp \
     bytecode/GetByIdStatus.cpp \
     bytecode/JumpTable.cpp \
+    bytecode/LazyOperandValueProfile.cpp \
     bytecode/MethodCallLinkInfo.cpp \
     bytecode/MethodCallLinkStatus.cpp \
+    bytecode/MethodOfGettingAValueProfile.cpp \
     bytecode/Opcode.cpp \
+    bytecode/PolymorphicPutByIdList.cpp \
     bytecode/PredictedType.cpp \
     bytecode/PutByIdStatus.cpp \
     bytecode/SamplingTool.cpp \
     bytecode/StructureStubInfo.cpp \
-    bytecode/ValueProfile.cpp \
     bytecompiler/BytecodeGenerator.cpp \
     bytecompiler/NodesCodegen.cpp \
-    heap/BumpSpace.cpp \
+    heap/CopiedSpace.cpp \
     heap/ConservativeRoots.cpp \
     heap/DFGCodeBlocks.cpp \
     heap/HandleHeap.cpp \
@@ -83,9 +85,12 @@ SOURCES += \
     debugger/Debugger.cpp \
     dfg/DFGAbstractState.cpp \
     dfg/DFGAssemblyHelpers.cpp \
+    dfg/DFGArithNodeFlagsInferencePhase.cpp \
     dfg/DFGByteCodeParser.cpp \
     dfg/DFGCapabilities.cpp \
+    dfg/DFGCFAPhase.cpp \
     dfg/DFGCorrectableJumpPoint.cpp \
+    dfg/DFGCSEPhase.cpp \
     dfg/DFGDriver.cpp \
     dfg/DFGGraph.cpp \
     dfg/DFGJITCompiler.cpp \
@@ -95,18 +100,21 @@ SOURCES += \
     dfg/DFGOSRExitCompiler.cpp \
     dfg/DFGOSRExitCompiler64.cpp \
     dfg/DFGOSRExitCompiler32_64.cpp \
-    dfg/DFGPropagator.cpp \
+    dfg/DFGPhase.cpp \
+    dfg/DFGPredictionPropagationPhase.cpp \
     dfg/DFGRepatch.cpp \
     dfg/DFGSpeculativeJIT.cpp \
     dfg/DFGSpeculativeJIT32_64.cpp \
     dfg/DFGSpeculativeJIT64.cpp \
     dfg/DFGThunks.cpp \
+    dfg/DFGVirtualRegisterAllocationPhase.cpp \
     interpreter/AbstractPC.cpp \
     interpreter/CallFrame.cpp \
     interpreter/Interpreter.cpp \
     interpreter/RegisterFile.cpp \
     jit/ExecutableAllocatorFixedVMPool.cpp \
     jit/ExecutableAllocator.cpp \
+    jit/HostCallReturnValue.cpp \
     jit/JITArithmetic.cpp \
     jit/JITArithmetic32_64.cpp \
     jit/JITCall.cpp \
diff --git a/Source/JavaScriptCore/assembler/LinkBuffer.h b/Source/JavaScriptCore/assembler/LinkBuffer.h
index e078024b1..2c07d13fc 100644
--- a/Source/JavaScriptCore/assembler/LinkBuffer.h
+++ b/Source/JavaScriptCore/assembler/LinkBuffer.h
@@ -34,7 +34,8 @@
 #define GLOBAL_THUNK_ID reinterpret_cast<void*>(static_cast<intptr_t>(-1))
 #define REGEXP_CODE_ID reinterpret_cast<void*>(static_cast<intptr_t>(-2))
 
-#include <MacroAssembler.h>
+#include "MacroAssembler.h"
+#include <wtf/DataLog.h>
 #include <wtf/Noncopyable.h>
 
 namespace JSC {
@@ -74,6 +75,9 @@ class LinkBuffer {
 public:
     LinkBuffer(JSGlobalData& globalData, MacroAssembler* masm, void* ownerUID)
         : m_size(0)
+#if ENABLE(BRANCH_COMPACTION)
+        , m_initialSize(0)
+#endif
         , m_code(0)
         , m_assembler(masm)
         , m_globalData(&globalData)
@@ -225,13 +229,13 @@ private:
         m_size = m_assembler->m_assembler.codeSize();
         ASSERT(m_code);
 #else
-        size_t initialSize = m_assembler->m_assembler.codeSize();
-        m_executableMemory = m_globalData->executableAllocator.allocate(*m_globalData, initialSize, ownerUID);
+        m_initialSize = m_assembler->m_assembler.codeSize();
+        m_executableMemory = m_globalData->executableAllocator.allocate(*m_globalData, m_initialSize, ownerUID);
         if (!m_executableMemory)
             return;
         m_code = (uint8_t*)m_executableMemory->start();
         ASSERT(m_code);
-        ExecutableAllocator::makeWritable(m_code, initialSize);
+        ExecutableAllocator::makeWritable(m_code, m_initialSize);
         uint8_t* inData = (uint8_t*)m_assembler->unlinkedCode();
         uint8_t* outData = reinterpret_cast<uint8_t*>(m_code);
         int readPtr = 0;
@@ -277,8 +281,8 @@ private:
             jumpsToLink[i].setFrom(writePtr);
         }
         // Copy everything after the last jump
-        memcpy(outData + writePtr, inData + readPtr, initialSize - readPtr);
-        m_assembler->recordLinkOffsets(readPtr, initialSize, readPtr - writePtr);
+        memcpy(outData + writePtr, inData + readPtr, m_initialSize - readPtr);
+        m_assembler->recordLinkOffsets(readPtr, m_initialSize, readPtr - writePtr);
         
         for (unsigned i = 0; i < jumpCount; ++i) {
             uint8_t* location = outData + jumpsToLink[i].from();
@@ -287,11 +291,11 @@ private:
         }
 
         jumpsToLink.clear();
-        m_size = writePtr + initialSize - readPtr;
+        m_size = writePtr + m_initialSize - readPtr;
         m_executableMemory->shrink(m_size);
 
 #if DUMP_LINK_STATISTICS
-        dumpLinkStatistics(m_code, initialSize, m_size);
+        dumpLinkStatistics(m_code, m_initialSize, m_size);
 #endif
 #if DUMP_CODE
         dumpCode(m_code, m_size);
@@ -306,7 +310,11 @@ private:
         m_completed = true;
 #endif
 
+#if ENABLE(BRANCH_COMPACTION)
+        ExecutableAllocator::makeExecutable(code(), m_initialSize);
+#else
         ExecutableAllocator::makeExecutable(code(), m_size);
+#endif
         ExecutableAllocator::cacheFlush(code(), m_size);
     }
 
@@ -319,13 +327,13 @@ private:
         linkCount++;
         totalInitialSize += initialSize;
         totalFinalSize += finalSize;
-        printf("link %p: orig %u, compact %u (delta %u, %.2f%%)\n", 
-               code, static_cast<unsigned>(initialSize), static_cast<unsigned>(finalSize),
-               static_cast<unsigned>(initialSize - finalSize),
-               100.0 * (initialSize - finalSize) / initialSize);
-        printf("\ttotal %u: orig %u, compact %u (delta %u, %.2f%%)\n", 
-               linkCount, totalInitialSize, totalFinalSize, totalInitialSize - totalFinalSize,
-               100.0 * (totalInitialSize - totalFinalSize) / totalInitialSize);
+        dataLog("link %p: orig %u, compact %u (delta %u, %.2f%%)\n", 
+                    code, static_cast<unsigned>(initialSize), static_cast<unsigned>(finalSize),
+                    static_cast<unsigned>(initialSize - finalSize),
+                    100.0 * (initialSize - finalSize) / initialSize);
+        dataLog("\ttotal %u: orig %u, compact %u (delta %u, %.2f%%)\n", 
+                    linkCount, totalInitialSize, totalFinalSize, totalInitialSize - totalFinalSize,
+                    100.0 * (totalInitialSize - totalFinalSize) / totalInitialSize);
     }
 #endif
     
@@ -342,23 +350,26 @@ private:
         size_t tsize = size / sizeof(short);
         char nameBuf[128];
         snprintf(nameBuf, sizeof(nameBuf), "_jsc_jit%u", codeCount++);
-        printf("\t.syntax unified\n"
-               "\t.section\t__TEXT,__text,regular,pure_instructions\n"
-               "\t.globl\t%s\n"
-               "\t.align 2\n"
-               "\t.code 16\n"
-               "\t.thumb_func\t%s\n"
-               "# %p\n"
-               "%s:\n", nameBuf, nameBuf, code, nameBuf);
+        dataLog("\t.syntax unified\n"
+                    "\t.section\t__TEXT,__text,regular,pure_instructions\n"
+                    "\t.globl\t%s\n"
+                    "\t.align 2\n"
+                    "\t.code 16\n"
+                    "\t.thumb_func\t%s\n"
+                    "# %p\n"
+                    "%s:\n", nameBuf, nameBuf, code, nameBuf);
         
         for (unsigned i = 0; i < tsize; i++)
-            printf("\t.short\t0x%x\n", tcode[i]);
+            dataLog("\t.short\t0x%x\n", tcode[i]);
 #endif
     }
 #endif
     
     RefPtr<ExecutableMemoryHandle> m_executableMemory;
     size_t m_size;
+#if ENABLE(BRANCH_COMPACTION)
+    size_t m_initialSize;
+#endif
     void* m_code;
     MacroAssembler* m_assembler;
     JSGlobalData* m_globalData;
diff --git a/Source/JavaScriptCore/assembler/MacroAssembler.h b/Source/JavaScriptCore/assembler/MacroAssembler.h
index cc11b5925..347cd0ea0 100644
--- a/Source/JavaScriptCore/assembler/MacroAssembler.h
+++ b/Source/JavaScriptCore/assembler/MacroAssembler.h
@@ -74,6 +74,67 @@ public:
     using MacroAssemblerBase::branchTestPtr;
 #endif
 
+    // Utilities used by the DFG JIT.
+#if ENABLE(DFG_JIT)
+    using MacroAssemblerBase::invert;
+    
+    static DoubleCondition invert(DoubleCondition cond)
+    {
+        switch (cond) {
+        case DoubleEqual:
+            return DoubleNotEqualOrUnordered;
+        case DoubleNotEqual:
+            return DoubleEqualOrUnordered;
+        case DoubleGreaterThan:
+            return DoubleLessThanOrEqualOrUnordered;
+        case DoubleGreaterThanOrEqual:
+            return DoubleLessThanOrUnordered;
+        case DoubleLessThan:
+            return DoubleGreaterThanOrEqualOrUnordered;
+        case DoubleLessThanOrEqual:
+            return DoubleGreaterThanOrUnordered;
+        case DoubleEqualOrUnordered:
+            return DoubleNotEqual;
+        case DoubleNotEqualOrUnordered:
+            return DoubleEqual;
+        case DoubleGreaterThanOrUnordered:
+            return DoubleLessThanOrEqual;
+        case DoubleGreaterThanOrEqualOrUnordered:
+            return DoubleLessThan;
+        case DoubleLessThanOrUnordered:
+            return DoubleGreaterThanOrEqual;
+        case DoubleLessThanOrEqualOrUnordered:
+            return DoubleGreaterThan;
+        default:
+            ASSERT_NOT_REACHED();
+            return DoubleEqual; // make compiler happy
+        }
+    }
+    
+    static bool isInvertible(ResultCondition cond)
+    {
+        switch (cond) {
+        case Zero:
+        case NonZero:
+            return true;
+        default:
+            return false;
+        }
+    }
+    
+    static ResultCondition invert(ResultCondition cond)
+    {
+        switch (cond) {
+        case Zero:
+            return NonZero;
+        case NonZero:
+            return Zero;
+        default:
+            ASSERT_NOT_REACHED();
+            return Zero; // Make compiler happy for release builds.
+        }
+    }
+#endif
 
     // Platform agnostic onvenience functions,
     // described in terms of other macro assembly methods.
diff --git a/Source/JavaScriptCore/assembler/MacroAssemblerARMv7.h b/Source/JavaScriptCore/assembler/MacroAssemblerARMv7.h
index 6cf2d081b..d883abf4f 100644
--- a/Source/JavaScriptCore/assembler/MacroAssemblerARMv7.h
+++ b/Source/JavaScriptCore/assembler/MacroAssemblerARMv7.h
@@ -796,14 +796,16 @@ public:
     void storeDouble(FPRegisterID src, BaseIndex address)
     {
         move(address.index, addressTempRegister);
-        mul32(TrustedImm32(address.scale), addressTempRegister, addressTempRegister);
+        mul32(TrustedImm32(1 << address.scale), addressTempRegister, addressTempRegister);
+        add32(address.base, addressTempRegister);
         storeDouble(src, Address(addressTempRegister, address.offset));
     }
     
     void storeFloat(FPRegisterID src, BaseIndex address)
     {
         move(address.index, addressTempRegister);
-        mul32(TrustedImm32(address.scale), addressTempRegister, addressTempRegister);
+        mul32(TrustedImm32(1 << address.scale), addressTempRegister, addressTempRegister);
+        add32(address.base, addressTempRegister);
         storeDouble(src, Address(addressTempRegister, address.offset));
     }
 
diff --git a/Source/JavaScriptCore/assembler/MacroAssemblerCodeRef.h b/Source/JavaScriptCore/assembler/MacroAssemblerCodeRef.h
index c59d1514a..3d7d84534 100644
--- a/Source/JavaScriptCore/assembler/MacroAssemblerCodeRef.h
+++ b/Source/JavaScriptCore/assembler/MacroAssemblerCodeRef.h
@@ -31,8 +31,6 @@
 #include "RefPtr.h"
 #include "UnusedParam.h"
 
-#if ENABLE(ASSEMBLER)
-
 // ASSERT_VALID_CODE_POINTER checks that ptr is a non-null pointer, and that it is a valid
 // instruction address on the platform (for example, check any alignment requirements).
 #if CPU(ARM_THUMB2)
@@ -273,6 +271,14 @@ public:
     {
         ASSERT_VALID_CODE_POINTER(m_value);
     }
+    
+    static MacroAssemblerCodePtr createFromExecutableAddress(void* value)
+    {
+        ASSERT_VALID_CODE_POINTER(value);
+        MacroAssemblerCodePtr result;
+        result.m_value = value;
+        return result;
+    }
 
     explicit MacroAssemblerCodePtr(ReturnAddressPtr ra)
         : m_value(ra.value())
@@ -360,6 +366,4 @@ private:
 
 } // namespace JSC
 
-#endif // ENABLE(ASSEMBLER)
-
 #endif // MacroAssemblerCodeRef_h
diff --git a/Source/JavaScriptCore/assembler/SH4Assembler.h b/Source/JavaScriptCore/assembler/SH4Assembler.h
index 0709588a5..280a5de85 100644
--- a/Source/JavaScriptCore/assembler/SH4Assembler.h
+++ b/Source/JavaScriptCore/assembler/SH4Assembler.h
@@ -35,6 +35,7 @@
 #include <stdint.h>
 #include <stdio.h>
 #include <wtf/Assertions.h>
+#include <wtf/DataLog.h>
 #include <wtf/Vector.h>
 
 #ifndef NDEBUG
@@ -2025,7 +2026,7 @@ public:
     static void vprintfStdoutInstr(const char* format, va_list args)
     {
         if (getenv("JavaScriptCoreDumpJIT"))
-            vfprintf(stdout, format, args);
+            WTF::dataLogV(format, args);
     }
 
     static void printBlockInstr(uint16_t* first, unsigned int offset, int nbInstr)
diff --git a/Source/JavaScriptCore/bytecode/BytecodeConventions.h b/Source/JavaScriptCore/bytecode/BytecodeConventions.h
new file mode 100644
index 000000000..f33b060f8
--- /dev/null
+++ b/Source/JavaScriptCore/bytecode/BytecodeConventions.h
@@ -0,0 +1,36 @@
+/*
+ * Copyright (C) 2012 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef BytecodeConventions_h
+#define BytecodeConventions_h
+
+// Register numbers used in bytecode operations have different meaning according to their ranges:
+//      0x80000000-0xFFFFFFFF  Negative indices from the CallFrame pointer are entries in the call frame, see RegisterFile.h.
+//      0x00000000-0x3FFFFFFF  Forwards indices from the CallFrame pointer are local vars and temporaries with the function's callframe.
+//      0x40000000-0x7FFFFFFF  Positive indices from 0x40000000 specify entries in the constant pool on the CodeBlock.
+static const int FirstConstantRegisterIndex = 0x40000000;
+
+#endif // BytecodeConventions_h
+
diff --git a/Source/JavaScriptCore/bytecode/CallLinkStatus.cpp b/Source/JavaScriptCore/bytecode/CallLinkStatus.cpp
index f3fd5bb27..7f9e9ee8a 100644
--- a/Source/JavaScriptCore/bytecode/CallLinkStatus.cpp
+++ b/Source/JavaScriptCore/bytecode/CallLinkStatus.cpp
@@ -27,17 +27,40 @@
 #include "CallLinkStatus.h"
 
 #include "CodeBlock.h"
+#include "LLIntCallLinkInfo.h"
 
 namespace JSC {
 
+CallLinkStatus CallLinkStatus::computeFromLLInt(CodeBlock* profiledBlock, unsigned bytecodeIndex)
+{
+    UNUSED_PARAM(profiledBlock);
+    UNUSED_PARAM(bytecodeIndex);
+#if ENABLE(LLINT)
+    Instruction* instruction = profiledBlock->instructions().begin() + bytecodeIndex;
+    LLIntCallLinkInfo* callLinkInfo = instruction[4].u.callLinkInfo;
+    
+    return CallLinkStatus(callLinkInfo->lastSeenCallee.get(), false);
+#else
+    return CallLinkStatus(0, false);
+#endif
+}
+
 CallLinkStatus CallLinkStatus::computeFor(CodeBlock* profiledBlock, unsigned bytecodeIndex)
 {
     UNUSED_PARAM(profiledBlock);
     UNUSED_PARAM(bytecodeIndex);
 #if ENABLE(JIT) && ENABLE(VALUE_PROFILER)
-    return CallLinkStatus(
-        profiledBlock->getCallLinkInfo(bytecodeIndex).lastSeenCallee.get(),
-        profiledBlock->couldTakeSlowCase(bytecodeIndex));
+    if (!profiledBlock->numberOfCallLinkInfos())
+        return computeFromLLInt(profiledBlock, bytecodeIndex);
+    
+    if (profiledBlock->couldTakeSlowCase(bytecodeIndex))
+        return CallLinkStatus(0, true);
+    
+    JSFunction* target = profiledBlock->getCallLinkInfo(bytecodeIndex).lastSeenCallee.get();
+    if (!target)
+        return computeFromLLInt(profiledBlock, bytecodeIndex);
+    
+    return CallLinkStatus(target, false);
 #else
     return CallLinkStatus(0, false);
 #endif
diff --git a/Source/JavaScriptCore/bytecode/CallLinkStatus.h b/Source/JavaScriptCore/bytecode/CallLinkStatus.h
index e1c741016..5f7201905 100644
--- a/Source/JavaScriptCore/bytecode/CallLinkStatus.h
+++ b/Source/JavaScriptCore/bytecode/CallLinkStatus.h
@@ -47,15 +47,17 @@ public:
     
     static CallLinkStatus computeFor(CodeBlock*, unsigned bytecodeIndex);
     
-    bool isSet() const { return !!m_callTarget; }
+    bool isSet() const { return !!m_callTarget || m_couldTakeSlowPath; }
     
-    bool operator!() const { return !m_callTarget; }
+    bool operator!() const { return !isSet(); }
     
     bool couldTakeSlowPath() const { return m_couldTakeSlowPath; }
     
     JSFunction* callTarget() const { return m_callTarget; }
     
 private:
+    static CallLinkStatus computeFromLLInt(CodeBlock*, unsigned bytecodeIndex);
+    
     JSFunction* m_callTarget;
     bool m_couldTakeSlowPath;
 };
diff --git a/Source/JavaScriptCore/bytecode/CodeBlock.cpp b/Source/JavaScriptCore/bytecode/CodeBlock.cpp
index 191fafd62..ab89ad965 100644
--- a/Source/JavaScriptCore/bytecode/CodeBlock.cpp
+++ b/Source/JavaScriptCore/bytecode/CodeBlock.cpp
@@ -42,6 +42,7 @@
 #include "JSFunction.h"
 #include "JSStaticScopeObject.h"
 #include "JSValue.h"
+#include "LowLevelInterpreter.h"
 #include "RepatchBuffer.h"
 #include "UStringConcatenate.h"
 #include <stdio.h>
@@ -154,7 +155,7 @@ void CodeBlock::printUnaryOp(ExecState* exec, int location, Vector<Instruction>:
     int r0 = (++it)->u.operand;
     int r1 = (++it)->u.operand;
 
-    printf("[%4d] %s\t\t %s, %s\n", location, op, registerName(exec, r0).data(), registerName(exec, r1).data());
+    dataLog("[%4d] %s\t\t %s, %s\n", location, op, registerName(exec, r0).data(), registerName(exec, r1).data());
 }
 
 void CodeBlock::printBinaryOp(ExecState* exec, int location, Vector<Instruction>::const_iterator& it, const char* op) const
@@ -162,14 +163,14 @@ void CodeBlock::printBinaryOp(ExecState* exec, int location, Vector<Instruction>
     int r0 = (++it)->u.operand;
     int r1 = (++it)->u.operand;
     int r2 = (++it)->u.operand;
-    printf("[%4d] %s\t\t %s, %s, %s\n", location, op, registerName(exec, r0).data(), registerName(exec, r1).data(), registerName(exec, r2).data());
+    dataLog("[%4d] %s\t\t %s, %s, %s\n", location, op, registerName(exec, r0).data(), registerName(exec, r1).data(), registerName(exec, r2).data());
 }
 
 void CodeBlock::printConditionalJump(ExecState* exec, const Vector<Instruction>::const_iterator&, Vector<Instruction>::const_iterator& it, int location, const char* op) const
 {
     int r0 = (++it)->u.operand;
     int offset = (++it)->u.operand;
-    printf("[%4d] %s\t\t %s, %d(->%d)\n", location, op, registerName(exec, r0).data(), offset, location + offset);
+    dataLog("[%4d] %s\t\t %s, %d(->%d)\n", location, op, registerName(exec, r0).data(), offset, location + offset);
 }
 
 void CodeBlock::printGetByIdOp(ExecState* exec, int location, Vector<Instruction>::const_iterator& it, const char* op) const
@@ -177,7 +178,7 @@ void CodeBlock::printGetByIdOp(ExecState* exec, int location, Vector<Instruction
     int r0 = (++it)->u.operand;
     int r1 = (++it)->u.operand;
     int id0 = (++it)->u.operand;
-    printf("[%4d] %s\t %s, %s, %s\n", location, op, registerName(exec, r0).data(), registerName(exec, r1).data(), idName(id0, m_identifiers[id0]).data());
+    dataLog("[%4d] %s\t %s, %s, %s\n", location, op, registerName(exec, r0).data(), registerName(exec, r1).data(), idName(id0, m_identifiers[id0]).data());
     it += 5;
 }
 
@@ -186,7 +187,7 @@ void CodeBlock::printCallOp(ExecState* exec, int location, Vector<Instruction>::
     int func = (++it)->u.operand;
     int argCount = (++it)->u.operand;
     int registerOffset = (++it)->u.operand;
-    printf("[%4d] %s\t %s, %d, %d\n", location, op, registerName(exec, func).data(), argCount, registerOffset);
+    dataLog("[%4d] %s\t %s, %d, %d\n", location, op, registerName(exec, func).data(), argCount, registerOffset);
     it += 2;
 }
 
@@ -195,7 +196,7 @@ void CodeBlock::printPutByIdOp(ExecState* exec, int location, Vector<Instruction
     int r0 = (++it)->u.operand;
     int id0 = (++it)->u.operand;
     int r1 = (++it)->u.operand;
-    printf("[%4d] %s\t %s, %s, %s\n", location, op, registerName(exec, r0).data(), idName(id0, m_identifiers[id0]).data(), registerName(exec, r1).data());
+    dataLog("[%4d] %s\t %s, %s, %s\n", location, op, registerName(exec, r0).data(), idName(id0, m_identifiers[id0]).data(), registerName(exec, r1).data());
     it += 5;
 }
 
@@ -243,48 +244,48 @@ static unsigned instructionOffsetForNth(ExecState* exec, const Vector<Instructio
 
 static void printGlobalResolveInfo(const GlobalResolveInfo& resolveInfo, unsigned instructionOffset)
 {
-    printf("  [%4d] %s: %s\n", instructionOffset, "resolve_global", pointerToSourceString(resolveInfo.structure).utf8().data());
+    dataLog("  [%4d] %s: %s\n", instructionOffset, "resolve_global", pointerToSourceString(resolveInfo.structure).utf8().data());
 }
 
 static void printStructureStubInfo(const StructureStubInfo& stubInfo, unsigned instructionOffset)
 {
     switch (stubInfo.accessType) {
     case access_get_by_id_self:
-        printf("  [%4d] %s: %s\n", instructionOffset, "get_by_id_self", pointerToSourceString(stubInfo.u.getByIdSelf.baseObjectStructure).utf8().data());
+        dataLog("  [%4d] %s: %s\n", instructionOffset, "get_by_id_self", pointerToSourceString(stubInfo.u.getByIdSelf.baseObjectStructure).utf8().data());
         return;
     case access_get_by_id_proto:
-        printf("  [%4d] %s: %s, %s\n", instructionOffset, "get_by_id_proto", pointerToSourceString(stubInfo.u.getByIdProto.baseObjectStructure).utf8().data(), pointerToSourceString(stubInfo.u.getByIdProto.prototypeStructure).utf8().data());
+        dataLog("  [%4d] %s: %s, %s\n", instructionOffset, "get_by_id_proto", pointerToSourceString(stubInfo.u.getByIdProto.baseObjectStructure).utf8().data(), pointerToSourceString(stubInfo.u.getByIdProto.prototypeStructure).utf8().data());
         return;
     case access_get_by_id_chain:
-        printf("  [%4d] %s: %s, %s\n", instructionOffset, "get_by_id_chain", pointerToSourceString(stubInfo.u.getByIdChain.baseObjectStructure).utf8().data(), pointerToSourceString(stubInfo.u.getByIdChain.chain).utf8().data());
+        dataLog("  [%4d] %s: %s, %s\n", instructionOffset, "get_by_id_chain", pointerToSourceString(stubInfo.u.getByIdChain.baseObjectStructure).utf8().data(), pointerToSourceString(stubInfo.u.getByIdChain.chain).utf8().data());
         return;
     case access_get_by_id_self_list:
-        printf("  [%4d] %s: %s (%d)\n", instructionOffset, "op_get_by_id_self_list", pointerToSourceString(stubInfo.u.getByIdSelfList.structureList).utf8().data(), stubInfo.u.getByIdSelfList.listSize);
+        dataLog("  [%4d] %s: %s (%d)\n", instructionOffset, "op_get_by_id_self_list", pointerToSourceString(stubInfo.u.getByIdSelfList.structureList).utf8().data(), stubInfo.u.getByIdSelfList.listSize);
         return;
     case access_get_by_id_proto_list:
-        printf("  [%4d] %s: %s (%d)\n", instructionOffset, "op_get_by_id_proto_list", pointerToSourceString(stubInfo.u.getByIdProtoList.structureList).utf8().data(), stubInfo.u.getByIdProtoList.listSize);
+        dataLog("  [%4d] %s: %s (%d)\n", instructionOffset, "op_get_by_id_proto_list", pointerToSourceString(stubInfo.u.getByIdProtoList.structureList).utf8().data(), stubInfo.u.getByIdProtoList.listSize);
         return;
     case access_put_by_id_transition_normal:
     case access_put_by_id_transition_direct:
-        printf("  [%4d] %s: %s, %s, %s\n", instructionOffset, "put_by_id_transition", pointerToSourceString(stubInfo.u.putByIdTransition.previousStructure).utf8().data(), pointerToSourceString(stubInfo.u.putByIdTransition.structure).utf8().data(), pointerToSourceString(stubInfo.u.putByIdTransition.chain).utf8().data());
+        dataLog("  [%4d] %s: %s, %s, %s\n", instructionOffset, "put_by_id_transition", pointerToSourceString(stubInfo.u.putByIdTransition.previousStructure).utf8().data(), pointerToSourceString(stubInfo.u.putByIdTransition.structure).utf8().data(), pointerToSourceString(stubInfo.u.putByIdTransition.chain).utf8().data());
         return;
     case access_put_by_id_replace:
-        printf("  [%4d] %s: %s\n", instructionOffset, "put_by_id_replace", pointerToSourceString(stubInfo.u.putByIdReplace.baseObjectStructure).utf8().data());
+        dataLog("  [%4d] %s: %s\n", instructionOffset, "put_by_id_replace", pointerToSourceString(stubInfo.u.putByIdReplace.baseObjectStructure).utf8().data());
         return;
     case access_unset:
-        printf("  [%4d] %s\n", instructionOffset, "unset");
+        dataLog("  [%4d] %s\n", instructionOffset, "unset");
         return;
     case access_get_by_id_generic:
-        printf("  [%4d] %s\n", instructionOffset, "op_get_by_id_generic");
+        dataLog("  [%4d] %s\n", instructionOffset, "op_get_by_id_generic");
         return;
     case access_put_by_id_generic:
-        printf("  [%4d] %s\n", instructionOffset, "op_put_by_id_generic");
+        dataLog("  [%4d] %s\n", instructionOffset, "op_put_by_id_generic");
         return;
     case access_get_array_length:
-        printf("  [%4d] %s\n", instructionOffset, "op_get_array_length");
+        dataLog("  [%4d] %s\n", instructionOffset, "op_get_array_length");
         return;
     case access_get_string_length:
-        printf("  [%4d] %s\n", instructionOffset, "op_get_string_length");
+        dataLog("  [%4d] %s\n", instructionOffset, "op_get_string_length");
         return;
     default:
         ASSERT_NOT_REACHED();
@@ -295,7 +296,7 @@ static void printStructureStubInfo(const StructureStubInfo& stubInfo, unsigned i
 void CodeBlock::printStructure(const char* name, const Instruction* vPC, int operand) const
 {
     unsigned instructionOffset = vPC - instructions().begin();
-    printf("  [%4d] %s: %s\n", instructionOffset, name, pointerToSourceString(vPC[operand].u.structure).utf8().data());
+    dataLog("  [%4d] %s: %s\n", instructionOffset, name, pointerToSourceString(vPC[operand].u.structure).utf8().data());
 }
 
 void CodeBlock::printStructures(const Instruction* vPC) const
@@ -312,15 +313,15 @@ void CodeBlock::printStructures(const Instruction* vPC) const
         return;
     }
     if (vPC[0].u.opcode == interpreter->getOpcode(op_get_by_id_proto)) {
-        printf("  [%4d] %s: %s, %s\n", instructionOffset, "get_by_id_proto", pointerToSourceString(vPC[4].u.structure).utf8().data(), pointerToSourceString(vPC[5].u.structure).utf8().data());
+        dataLog("  [%4d] %s: %s, %s\n", instructionOffset, "get_by_id_proto", pointerToSourceString(vPC[4].u.structure).utf8().data(), pointerToSourceString(vPC[5].u.structure).utf8().data());
         return;
     }
     if (vPC[0].u.opcode == interpreter->getOpcode(op_put_by_id_transition)) {
-        printf("  [%4d] %s: %s, %s, %s\n", instructionOffset, "put_by_id_transition", pointerToSourceString(vPC[4].u.structure).utf8().data(), pointerToSourceString(vPC[5].u.structure).utf8().data(), pointerToSourceString(vPC[6].u.structureChain).utf8().data());
+        dataLog("  [%4d] %s: %s, %s, %s\n", instructionOffset, "put_by_id_transition", pointerToSourceString(vPC[4].u.structure).utf8().data(), pointerToSourceString(vPC[5].u.structure).utf8().data(), pointerToSourceString(vPC[6].u.structureChain).utf8().data());
         return;
     }
     if (vPC[0].u.opcode == interpreter->getOpcode(op_get_by_id_chain)) {
-        printf("  [%4d] %s: %s, %s\n", instructionOffset, "get_by_id_chain", pointerToSourceString(vPC[4].u.structure).utf8().data(), pointerToSourceString(vPC[5].u.structureChain).utf8().data());
+        dataLog("  [%4d] %s: %s, %s\n", instructionOffset, "get_by_id_chain", pointerToSourceString(vPC[4].u.structure).utf8().data(), pointerToSourceString(vPC[5].u.structureChain).utf8().data());
         return;
     }
     if (vPC[0].u.opcode == interpreter->getOpcode(op_put_by_id)) {
@@ -347,7 +348,7 @@ void CodeBlock::printStructures(const Instruction* vPC) const
 void CodeBlock::dump(ExecState* exec) const
 {
     if (!m_instructions) {
-        printf("No instructions available.\n");
+        dataLog("No instructions available.\n");
         return;
     }
 
@@ -356,10 +357,10 @@ void CodeBlock::dump(ExecState* exec) const
     for (size_t i = 0; i < instructions().size(); i += opcodeLengths[exec->interpreter()->getOpcodeID(instructions()[i].u.opcode)])
         ++instructionCount;
 
-    printf("%lu m_instructions; %lu bytes at %p; %d parameter(s); %d callee register(s)\n\n",
+    dataLog("%lu m_instructions; %lu bytes at %p; %d parameter(s); %d callee register(s); %d variable(s)\n\n",
         static_cast<unsigned long>(instructionCount),
         static_cast<unsigned long>(instructions().size() * sizeof(Instruction)),
-        this, m_numParameters, m_numCalleeRegisters);
+        this, m_numParameters, m_numCalleeRegisters, m_numVars);
 
     Vector<Instruction>::const_iterator begin = instructions().begin();
     Vector<Instruction>::const_iterator end = instructions().end();
@@ -367,35 +368,35 @@ void CodeBlock::dump(ExecState* exec) const
         dump(exec, begin, it);
 
     if (!m_identifiers.isEmpty()) {
-        printf("\nIdentifiers:\n");
+        dataLog("\nIdentifiers:\n");
         size_t i = 0;
         do {
-            printf("  id%u = %s\n", static_cast<unsigned>(i), m_identifiers[i].ustring().utf8().data());
+            dataLog("  id%u = %s\n", static_cast<unsigned>(i), m_identifiers[i].ustring().utf8().data());
             ++i;
         } while (i != m_identifiers.size());
     }
 
     if (!m_constantRegisters.isEmpty()) {
-        printf("\nConstants:\n");
+        dataLog("\nConstants:\n");
         size_t i = 0;
         do {
-            printf("   k%u = %s\n", static_cast<unsigned>(i), valueToSourceString(exec, m_constantRegisters[i].get()).utf8().data());
+            dataLog("   k%u = %s\n", static_cast<unsigned>(i), valueToSourceString(exec, m_constantRegisters[i].get()).utf8().data());
             ++i;
         } while (i < m_constantRegisters.size());
     }
 
     if (m_rareData && !m_rareData->m_regexps.isEmpty()) {
-        printf("\nm_regexps:\n");
+        dataLog("\nm_regexps:\n");
         size_t i = 0;
         do {
-            printf("  re%u = %s\n", static_cast<unsigned>(i), regexpToSourceString(m_rareData->m_regexps[i].get()).utf8().data());
+            dataLog("  re%u = %s\n", static_cast<unsigned>(i), regexpToSourceString(m_rareData->m_regexps[i].get()).utf8().data());
             ++i;
         } while (i < m_rareData->m_regexps.size());
     }
 
 #if ENABLE(JIT)
     if (!m_globalResolveInfos.isEmpty() || !m_structureStubInfos.isEmpty())
-        printf("\nStructures:\n");
+        dataLog("\nStructures:\n");
 
     if (!m_globalResolveInfos.isEmpty()) {
         size_t i = 0;
@@ -412,9 +413,9 @@ void CodeBlock::dump(ExecState* exec) const
         } while (i < m_structureStubInfos.size());
     }
 #endif
-#if ENABLE(INTERPRETER)
+#if ENABLE(CLASSIC_INTERPRETER)
     if (!m_globalResolveInstructions.isEmpty() || !m_propertyAccessInstructions.isEmpty())
-        printf("\nStructures:\n");
+        dataLog("\nStructures:\n");
 
     if (!m_globalResolveInstructions.isEmpty()) {
         size_t i = 0;
@@ -433,36 +434,36 @@ void CodeBlock::dump(ExecState* exec) const
 #endif
 
     if (m_rareData && !m_rareData->m_exceptionHandlers.isEmpty()) {
-        printf("\nException Handlers:\n");
+        dataLog("\nException Handlers:\n");
         unsigned i = 0;
         do {
-            printf("\t %d: { start: [%4d] end: [%4d] target: [%4d] }\n", i + 1, m_rareData->m_exceptionHandlers[i].start, m_rareData->m_exceptionHandlers[i].end, m_rareData->m_exceptionHandlers[i].target);
+            dataLog("\t %d: { start: [%4d] end: [%4d] target: [%4d] }\n", i + 1, m_rareData->m_exceptionHandlers[i].start, m_rareData->m_exceptionHandlers[i].end, m_rareData->m_exceptionHandlers[i].target);
             ++i;
         } while (i < m_rareData->m_exceptionHandlers.size());
     }
     
     if (m_rareData && !m_rareData->m_immediateSwitchJumpTables.isEmpty()) {
-        printf("Immediate Switch Jump Tables:\n");
+        dataLog("Immediate Switch Jump Tables:\n");
         unsigned i = 0;
         do {
-            printf("  %1d = {\n", i);
+            dataLog("  %1d = {\n", i);
             int entry = 0;
             Vector<int32_t>::const_iterator end = m_rareData->m_immediateSwitchJumpTables[i].branchOffsets.end();
             for (Vector<int32_t>::const_iterator iter = m_rareData->m_immediateSwitchJumpTables[i].branchOffsets.begin(); iter != end; ++iter, ++entry) {
                 if (!*iter)
                     continue;
-                printf("\t\t%4d => %04d\n", entry + m_rareData->m_immediateSwitchJumpTables[i].min, *iter);
+                dataLog("\t\t%4d => %04d\n", entry + m_rareData->m_immediateSwitchJumpTables[i].min, *iter);
             }
-            printf("      }\n");
+            dataLog("      }\n");
             ++i;
         } while (i < m_rareData->m_immediateSwitchJumpTables.size());
     }
     
     if (m_rareData && !m_rareData->m_characterSwitchJumpTables.isEmpty()) {
-        printf("\nCharacter Switch Jump Tables:\n");
+        dataLog("\nCharacter Switch Jump Tables:\n");
         unsigned i = 0;
         do {
-            printf("  %1d = {\n", i);
+            dataLog("  %1d = {\n", i);
             int entry = 0;
             Vector<int32_t>::const_iterator end = m_rareData->m_characterSwitchJumpTables[i].branchOffsets.end();
             for (Vector<int32_t>::const_iterator iter = m_rareData->m_characterSwitchJumpTables[i].branchOffsets.begin(); iter != end; ++iter, ++entry) {
@@ -470,27 +471,27 @@ void CodeBlock::dump(ExecState* exec) const
                     continue;
                 ASSERT(!((i + m_rareData->m_characterSwitchJumpTables[i].min) & ~0xFFFF));
                 UChar ch = static_cast<UChar>(entry + m_rareData->m_characterSwitchJumpTables[i].min);
-                printf("\t\t\"%s\" => %04d\n", UString(&ch, 1).utf8().data(), *iter);
+                dataLog("\t\t\"%s\" => %04d\n", UString(&ch, 1).utf8().data(), *iter);
         }
-            printf("      }\n");
+            dataLog("      }\n");
             ++i;
         } while (i < m_rareData->m_characterSwitchJumpTables.size());
     }
     
     if (m_rareData && !m_rareData->m_stringSwitchJumpTables.isEmpty()) {
-        printf("\nString Switch Jump Tables:\n");
+        dataLog("\nString Switch Jump Tables:\n");
         unsigned i = 0;
         do {
-            printf("  %1d = {\n", i);
+            dataLog("  %1d = {\n", i);
             StringJumpTable::StringOffsetTable::const_iterator end = m_rareData->m_stringSwitchJumpTables[i].offsetTable.end();
             for (StringJumpTable::StringOffsetTable::const_iterator iter = m_rareData->m_stringSwitchJumpTables[i].offsetTable.begin(); iter != end; ++iter)
-                printf("\t\t\"%s\" => %04d\n", UString(iter->first).utf8().data(), iter->second.branchOffset);
-            printf("      }\n");
+                dataLog("\t\t\"%s\" => %04d\n", UString(iter->first).utf8().data(), iter->second.branchOffset);
+            dataLog("      }\n");
             ++i;
         } while (i < m_rareData->m_stringSwitchJumpTables.size());
     }
 
-    printf("\n");
+    dataLog("\n");
 }
 
 void CodeBlock::dump(ExecState* exec, const Vector<Instruction>::const_iterator& begin, Vector<Instruction>::const_iterator& it) const
@@ -498,73 +499,73 @@ void CodeBlock::dump(ExecState* exec, const Vector<Instruction>::const_iterator&
     int location = it - begin;
     switch (exec->interpreter()->getOpcodeID(it->u.opcode)) {
         case op_enter: {
-            printf("[%4d] enter\n", location);
+            dataLog("[%4d] enter\n", location);
             break;
         }
         case op_create_activation: {
             int r0 = (++it)->u.operand;
-            printf("[%4d] create_activation %s\n", location, registerName(exec, r0).data());
+            dataLog("[%4d] create_activation %s\n", location, registerName(exec, r0).data());
             break;
         }
         case op_create_arguments: {
             int r0 = (++it)->u.operand;
-            printf("[%4d] create_arguments\t %s\n", location, registerName(exec, r0).data());
+            dataLog("[%4d] create_arguments\t %s\n", location, registerName(exec, r0).data());
             break;
         }
         case op_init_lazy_reg: {
             int r0 = (++it)->u.operand;
-            printf("[%4d] init_lazy_reg\t %s\n", location, registerName(exec, r0).data());
+            dataLog("[%4d] init_lazy_reg\t %s\n", location, registerName(exec, r0).data());
             break;
         }
         case op_get_callee: {
             int r0 = (++it)->u.operand;
-            printf("[%4d] op_get_callee %s\n", location, registerName(exec, r0).data());
+            dataLog("[%4d] op_get_callee %s\n", location, registerName(exec, r0).data());
             break;
         }
         case op_create_this: {
             int r0 = (++it)->u.operand;
             int r1 = (++it)->u.operand;
-            printf("[%4d] create_this %s %s\n", location, registerName(exec, r0).data(), registerName(exec, r1).data());
+            dataLog("[%4d] create_this %s %s\n", location, registerName(exec, r0).data(), registerName(exec, r1).data());
             break;
         }
         case op_convert_this: {
             int r0 = (++it)->u.operand;
-            printf("[%4d] convert_this\t %s\n", location, registerName(exec, r0).data());
+            dataLog("[%4d] convert_this\t %s\n", location, registerName(exec, r0).data());
             break;
         }
         case op_new_object: {
             int r0 = (++it)->u.operand;
-            printf("[%4d] new_object\t %s\n", location, registerName(exec, r0).data());
+            dataLog("[%4d] new_object\t %s\n", location, registerName(exec, r0).data());
             break;
         }
         case op_new_array: {
             int dst = (++it)->u.operand;
             int argv = (++it)->u.operand;
             int argc = (++it)->u.operand;
-            printf("[%4d] new_array\t %s, %s, %d\n", location, registerName(exec, dst).data(), registerName(exec, argv).data(), argc);
+            dataLog("[%4d] new_array\t %s, %s, %d\n", location, registerName(exec, dst).data(), registerName(exec, argv).data(), argc);
             break;
         }
         case op_new_array_buffer: {
             int dst = (++it)->u.operand;
             int argv = (++it)->u.operand;
             int argc = (++it)->u.operand;
-            printf("[%4d] new_array_buffer %s, %d, %d\n", location, registerName(exec, dst).data(), argv, argc);
+            dataLog("[%4d] new_array_buffer %s, %d, %d\n", location, registerName(exec, dst).data(), argv, argc);
             break;
         }
         case op_new_regexp: {
             int r0 = (++it)->u.operand;
             int re0 = (++it)->u.operand;
-            printf("[%4d] new_regexp\t %s, ", location, registerName(exec, r0).data());
+            dataLog("[%4d] new_regexp\t %s, ", location, registerName(exec, r0).data());
             if (r0 >=0 && r0 < (int)numberOfRegExps())
-                printf("%s\n", regexpName(re0, regexp(re0)).data());
+                dataLog("%s\n", regexpName(re0, regexp(re0)).data());
             else
-                printf("bad_regexp(%d)\n", re0);
+                dataLog("bad_regexp(%d)\n", re0);
             break;
         }
         case op_mov: {
             int r0 = (++it)->u.operand;
             int r1 = (++it)->u.operand;
-            printf("[%4d] mov\t\t %s, %s\n", location, registerName(exec, r0).data(), registerName(exec, r1).data());
+            dataLog("[%4d] mov\t\t %s, %s\n", location, registerName(exec, r0).data(), registerName(exec, r1).data());
             break;
         }
         case op_not: {
@@ -613,12 +614,12 @@ void CodeBlock::dump(ExecState* exec, const Vector<Instruction>::const_iterator&
         }
         case op_pre_inc: {
             int r0 = (++it)->u.operand;
-            printf("[%4d] pre_inc\t\t %s\n", location, registerName(exec, r0).data());
+            dataLog("[%4d] pre_inc\t\t %s\n", location, registerName(exec, r0).data());
             break;
         }
         case op_pre_dec: {
             int r0 = (++it)->u.operand;
-            printf("[%4d] pre_dec\t\t %s\n", location, registerName(exec, r0).data());
+            dataLog("[%4d] pre_dec\t\t %s\n", location, registerName(exec, r0).data());
             break;
         }
         case op_post_inc: {
@@ -694,7 +695,7 @@ void CodeBlock::dump(ExecState* exec, const Vector<Instruction>::const_iterator&
         }
         case op_check_has_instance: {
             int base = (++it)->u.operand;
-            printf("[%4d] check_has_instance\t\t %s\n", location, registerName(exec, base).data());
+            dataLog("[%4d] check_has_instance\t\t %s\n", location, registerName(exec, base).data());
             break;
         }
         case op_instanceof: {
@@ -702,7 +703,7 @@ void CodeBlock::dump(ExecState* exec, const Vector<Instruction>::const_iterator&
             int r1 = (++it)->u.operand;
             int r2 = (++it)->u.operand;
             int r3 = (++it)->u.operand;
-            printf("[%4d] instanceof\t\t %s, %s, %s, %s\n", location, registerName(exec, r0).data(), registerName(exec, r1).data(), registerName(exec, r2).data(), registerName(exec, r3).data());
+            dataLog("[%4d] instanceof\t\t %s, %s, %s, %s\n", location, registerName(exec, r0).data(), registerName(exec, r1).data(), registerName(exec, r2).data(), registerName(exec, r3).data());
             break;
         }
         case op_typeof: {
@@ -740,7 +741,7 @@ void CodeBlock::dump(ExecState* exec, const Vector<Instruction>::const_iterator&
         case op_resolve: {
             int r0 = (++it)->u.operand;
             int id0 = (++it)->u.operand;
-            printf("[%4d] resolve\t\t %s, %s\n", location, registerName(exec, r0).data(), idName(id0, m_identifiers[id0]).data());
+            dataLog("[%4d] resolve\t\t %s, %s\n", location, registerName(exec, r0).data(), idName(id0, m_identifiers[id0]).data());
             it++;
             break;
         }
@@ -748,14 +749,14 @@ void CodeBlock::dump(ExecState* exec, const Vector<Instruction>::const_iterator&
             int r0 = (++it)->u.operand;
             int id0 = (++it)->u.operand;
             int skipLevels = (++it)->u.operand;
-            printf("[%4d] resolve_skip\t %s, %s, %d\n", location, registerName(exec, r0).data(), idName(id0, m_identifiers[id0]).data(), skipLevels);
+            dataLog("[%4d] resolve_skip\t %s, %s, %d\n", location, registerName(exec, r0).data(), idName(id0, m_identifiers[id0]).data(), skipLevels);
             it++;
             break;
         }
         case op_resolve_global: {
             int r0 = (++it)->u.operand;
             int id0 = (++it)->u.operand;
-            printf("[%4d] resolve_global\t %s, %s\n", location, registerName(exec, r0).data(), idName(id0, m_identifiers[id0]).data());
+            dataLog("[%4d] resolve_global\t %s, %s\n", location, registerName(exec, r0).data(), idName(id0, m_identifiers[id0]).data());
             it += 3;
             break;
         }
@@ -765,7 +766,7 @@ void CodeBlock::dump(ExecState* exec, const Vector<Instruction>::const_iterator&
             JSValue scope = JSValue((++it)->u.jsCell.get());
             ++it;
             int depth = (++it)->u.operand;
-            printf("[%4d] resolve_global_dynamic\t %s, %s, %s, %d\n", location, registerName(exec, r0).data(), valueToSourceString(exec, scope).utf8().data(), idName(id0, m_identifiers[id0]).data(), depth);
+            dataLog("[%4d] resolve_global_dynamic\t %s, %s, %s, %d\n", location, registerName(exec, r0).data(), valueToSourceString(exec, scope).utf8().data(), idName(id0, m_identifiers[id0]).data(), depth);
             ++it;
             break;
         }
@@ -773,7 +774,7 @@ void CodeBlock::dump(ExecState* exec, const Vector<Instruction>::const_iterator&
             int r0 = (++it)->u.operand;
             int index = (++it)->u.operand;
             int skipLevels = (++it)->u.operand;
-            printf("[%4d] get_scoped_var\t %s, %d, %d\n", location, registerName(exec, r0).data(), index, skipLevels);
+            dataLog("[%4d] get_scoped_var\t %s, %d, %d\n", location, registerName(exec, r0).data(), index, skipLevels);
             it++;
             break;
         }
@@ -781,41 +782,41 @@ void CodeBlock::dump(ExecState* exec, const Vector<Instruction>::const_iterator&
             int index = (++it)->u.operand;
             int skipLevels = (++it)->u.operand;
             int r0 = (++it)->u.operand;
-            printf("[%4d] put_scoped_var\t %d, %d, %s\n", location, index, skipLevels, registerName(exec, r0).data());
+            dataLog("[%4d] put_scoped_var\t %d, %d, %s\n", location, index, skipLevels, registerName(exec, r0).data());
             break;
         }
         case op_get_global_var: {
             int r0 = (++it)->u.operand;
             int index = (++it)->u.operand;
-            printf("[%4d] get_global_var\t %s, %d\n", location, registerName(exec, r0).data(), index);
+            dataLog("[%4d] get_global_var\t %s, %d\n", location, registerName(exec, r0).data(), index);
             it++;
             break;
         }
         case op_put_global_var: {
             int index = (++it)->u.operand;
             int r0 = (++it)->u.operand;
-            printf("[%4d] put_global_var\t %d, %s\n", location, index, registerName(exec, r0).data());
+            dataLog("[%4d] put_global_var\t %d, %s\n", location, index, registerName(exec, r0).data());
             break;
         }
         case op_resolve_base: {
             int r0 = (++it)->u.operand;
             int id0 = (++it)->u.operand;
             int isStrict = (++it)->u.operand;
-            printf("[%4d] resolve_base%s\t %s, %s\n", location, isStrict ? "_strict" : "", registerName(exec, r0).data(), idName(id0, m_identifiers[id0]).data());
+            dataLog("[%4d] resolve_base%s\t %s, %s\n", location, isStrict ? "_strict" : "", registerName(exec, r0).data(), idName(id0, m_identifiers[id0]).data());
             it++;
             break;
         }
         case op_ensure_property_exists: {
             int r0 = (++it)->u.operand;
             int id0 = (++it)->u.operand;
-            printf("[%4d] ensure_property_exists\t %s, %s\n", location, registerName(exec, r0).data(), idName(id0, m_identifiers[id0]).data());
+            dataLog("[%4d] ensure_property_exists\t %s, %s\n", location, registerName(exec, r0).data(), idName(id0, m_identifiers[id0]).data());
             break;
         }
         case op_resolve_with_base: {
             int r0 = (++it)->u.operand;
             int r1 = (++it)->u.operand;
             int id0 = (++it)->u.operand;
-            printf("[%4d] resolve_with_base %s, %s, %s\n", location, registerName(exec, r0).data(), registerName(exec, r1).data(), idName(id0, m_identifiers[id0]).data());
+            dataLog("[%4d] resolve_with_base %s, %s, %s\n", location, registerName(exec, r0).data(), registerName(exec, r1).data(), idName(id0, m_identifiers[id0]).data());
             it++;
             break;
         }
@@ -823,7 +824,7 @@ void CodeBlock::dump(ExecState* exec, const Vector<Instruction>::const_iterator&
             int r0 = (++it)->u.operand;
             int r1 = (++it)->u.operand;
             int id0 = (++it)->u.operand;
-            printf("[%4d] resolve_with_this %s, %s, %s\n", location, registerName(exec, r0).data(), registerName(exec, r1).data(), idName(id0, m_identifiers[id0]).data());
+            dataLog("[%4d] resolve_with_this %s, %s, %s\n", location, registerName(exec, r0).data(), registerName(exec, r1).data(), idName(id0, m_identifiers[id0]).data());
             it++;
             break;
         }
@@ -896,6 +897,14 @@ void CodeBlock::dump(ExecState* exec, const Vector<Instruction>::const_iterator&
             printPutByIdOp(exec, location, it, "put_by_id_transition");
             break;
         }
+        case op_put_by_id_transition_direct: {
+            printPutByIdOp(exec, location, it, "put_by_id_transition_direct");
+            break;
+        }
+        case op_put_by_id_transition_normal: {
+            printPutByIdOp(exec, location, it, "put_by_id_transition_normal");
+            break;
+        }
         case op_put_by_id_generic: {
             printPutByIdOp(exec, location, it, "put_by_id_generic");
             break;
@@ -905,25 +914,25 @@ void CodeBlock::dump(ExecState* exec, const Vector<Instruction>::const_iterator&
             int id0 = (++it)->u.operand;
             int r1 = (++it)->u.operand;
             int r2 = (++it)->u.operand;
-            printf("[%4d] put_getter_setter\t %s, %s, %s, %s\n", location, registerName(exec, r0).data(), idName(id0, m_identifiers[id0]).data(), registerName(exec, r1).data(), registerName(exec, r2).data());
+            dataLog("[%4d] put_getter_setter\t %s, %s, %s, %s\n", location, registerName(exec, r0).data(), idName(id0, m_identifiers[id0]).data(), registerName(exec, r1).data(), registerName(exec, r2).data());
             break;
         }
         case op_method_check: {
-            printf("[%4d] method_check\n", location);
+            dataLog("[%4d] method_check\n", location);
             break;
         }
         case op_del_by_id: {
             int r0 = (++it)->u.operand;
             int r1 = (++it)->u.operand;
             int id0 = (++it)->u.operand;
-            printf("[%4d] del_by_id\t %s, %s, %s\n", location, registerName(exec, r0).data(), registerName(exec, r1).data(), idName(id0, m_identifiers[id0]).data());
+            dataLog("[%4d] del_by_id\t %s, %s, %s\n", location, registerName(exec, r0).data(), registerName(exec, r1).data(), idName(id0, m_identifiers[id0]).data());
             break;
         }
         case op_get_by_val: {
             int r0 = (++it)->u.operand;
             int r1 = (++it)->u.operand;
             int r2 = (++it)->u.operand;
-            printf("[%4d] get_by_val\t %s, %s, %s\n", location, registerName(exec, r0).data(), registerName(exec, r1).data(), registerName(exec, r2).data());
+            dataLog("[%4d] get_by_val\t %s, %s, %s\n", location, registerName(exec, r0).data(), registerName(exec, r1).data(), registerName(exec, r2).data());
             it++;
             break;
         }
@@ -931,7 +940,7 @@ void CodeBlock::dump(ExecState* exec, const Vector<Instruction>::const_iterator&
             int r0 = (++it)->u.operand;
             int r1 = (++it)->u.operand;
             int r2 = (++it)->u.operand;
-            printf("[%4d] get_argument_by_val\t %s, %s, %s\n", location, registerName(exec, r0).data(), registerName(exec, r1).data(), registerName(exec, r2).data());
+            dataLog("[%4d] get_argument_by_val\t %s, %s, %s\n", location, registerName(exec, r0).data(), registerName(exec, r1).data(), registerName(exec, r2).data());
             ++it;
             break;
         }
@@ -942,38 +951,38 @@ void CodeBlock::dump(ExecState* exec, const Vector<Instruction>::const_iterator&
             int r3 = (++it)->u.operand;
             int r4 = (++it)->u.operand;
             int r5 = (++it)->u.operand;
-            printf("[%4d] get_by_pname\t %s, %s, %s, %s, %s, %s\n", location, registerName(exec, r0).data(), registerName(exec, r1).data(), registerName(exec, r2).data(), registerName(exec, r3).data(), registerName(exec, r4).data(), registerName(exec, r5).data());
+            dataLog("[%4d] get_by_pname\t %s, %s, %s, %s, %s, %s\n", location, registerName(exec, r0).data(), registerName(exec, r1).data(), registerName(exec, r2).data(), registerName(exec, r3).data(), registerName(exec, r4).data(), registerName(exec, r5).data());
             break;
         }
         case op_put_by_val: {
             int r0 = (++it)->u.operand;
             int r1 = (++it)->u.operand;
             int r2 = (++it)->u.operand;
-            printf("[%4d] put_by_val\t %s, %s, %s\n", location, registerName(exec, r0).data(), registerName(exec, r1).data(), registerName(exec, r2).data());
+            dataLog("[%4d] put_by_val\t %s, %s, %s\n", location, registerName(exec, r0).data(), registerName(exec, r1).data(), registerName(exec, r2).data());
             break;
         }
         case op_del_by_val: {
             int r0 = (++it)->u.operand;
             int r1 = (++it)->u.operand;
             int r2 = (++it)->u.operand;
-            printf("[%4d] del_by_val\t %s, %s, %s\n", location, registerName(exec, r0).data(), registerName(exec, r1).data(), registerName(exec, r2).data());
+            dataLog("[%4d] del_by_val\t %s, %s, %s\n", location, registerName(exec, r0).data(), registerName(exec, r1).data(), registerName(exec, r2).data());
             break;
         }
         case op_put_by_index: {
             int r0 = (++it)->u.operand;
             unsigned n0 = (++it)->u.operand;
             int r1 = (++it)->u.operand;
-            printf("[%4d] put_by_index\t %s, %u, %s\n", location, registerName(exec, r0).data(), n0, registerName(exec, r1).data());
+            dataLog("[%4d] put_by_index\t %s, %u, %s\n", location, registerName(exec, r0).data(), n0, registerName(exec, r1).data());
             break;
         }
         case op_jmp: {
             int offset = (++it)->u.operand;
-            printf("[%4d] jmp\t\t %d(->%d)\n", location, offset, location + offset);
+            dataLog("[%4d] jmp\t\t %d(->%d)\n", location, offset, location + offset);
             break;
         }
         case op_loop: {
             int offset = (++it)->u.operand;
-            printf("[%4d] loop\t\t %d(->%d)\n", location, offset, location + offset);
+            dataLog("[%4d] loop\t\t %d(->%d)\n", location, offset, location + offset);
             break;
         }
         case op_jtrue: {
@@ -1004,129 +1013,129 @@ void CodeBlock::dump(ExecState* exec, const Vector<Instruction>::const_iterator&
             int r0 = (++it)->u.operand;
             int r1 = (++it)->u.operand;
             int offset = (++it)->u.operand;
-            printf("[%4d] jneq_ptr\t\t %s, %s, %d(->%d)\n", location, registerName(exec, r0).data(), registerName(exec, r1).data(), offset, location + offset);
+            dataLog("[%4d] jneq_ptr\t\t %s, %s, %d(->%d)\n", location, registerName(exec, r0).data(), registerName(exec, r1).data(), offset, location + offset);
             break;
         }
         case op_jless: {
             int r0 = (++it)->u.operand;
             int r1 = (++it)->u.operand;
             int offset = (++it)->u.operand;
-            printf("[%4d] jless\t\t %s, %s, %d(->%d)\n", location, registerName(exec, r0).data(), registerName(exec, r1).data(), offset, location + offset);
+            dataLog("[%4d] jless\t\t %s, %s, %d(->%d)\n", location, registerName(exec, r0).data(), registerName(exec, r1).data(), offset, location + offset);
             break;
         }
         case op_jlesseq: {
             int r0 = (++it)->u.operand;
             int r1 = (++it)->u.operand;
             int offset = (++it)->u.operand;
-            printf("[%4d] jlesseq\t\t %s, %s, %d(->%d)\n", location, registerName(exec, r0).data(), registerName(exec, r1).data(), offset, location + offset);
+            dataLog("[%4d] jlesseq\t\t %s, %s, %d(->%d)\n", location, registerName(exec, r0).data(), registerName(exec, r1).data(), offset, location + offset);
             break;
         }
         case op_jgreater: {
             int r0 = (++it)->u.operand;
             int r1 = (++it)->u.operand;
             int offset = (++it)->u.operand;
-            printf("[%4d] jgreater\t\t %s, %s, %d(->%d)\n", location, registerName(exec, r0).data(), registerName(exec, r1).data(), offset, location + offset);
+            dataLog("[%4d] jgreater\t\t %s, %s, %d(->%d)\n", location, registerName(exec, r0).data(), registerName(exec, r1).data(), offset, location + offset);
             break;
         }
         case op_jgreatereq: {
             int r0 = (++it)->u.operand;
             int r1 = (++it)->u.operand;
             int offset = (++it)->u.operand;
-            printf("[%4d] jgreatereq\t\t %s, %s, %d(->%d)\n", location, registerName(exec, r0).data(), registerName(exec, r1).data(), offset, location + offset);
+            dataLog("[%4d] jgreatereq\t\t %s, %s, %d(->%d)\n", location, registerName(exec, r0).data(), registerName(exec, r1).data(), offset, location + offset);
             break;
         }
         case op_jnless: {
             int r0 = (++it)->u.operand;
             int r1 = (++it)->u.operand;
             int offset = (++it)->u.operand;
-            printf("[%4d] jnless\t\t %s, %s, %d(->%d)\n", location, registerName(exec, r0).data(), registerName(exec, r1).data(), offset, location + offset);
+            dataLog("[%4d] jnless\t\t %s, %s, %d(->%d)\n", location, registerName(exec, r0).data(), registerName(exec, r1).data(), offset, location + offset);
             break;
         }
         case op_jnlesseq: {
             int r0 = (++it)->u.operand;
             int r1 = (++it)->u.operand;
             int offset = (++it)->u.operand;
-            printf("[%4d] jnlesseq\t\t %s, %s, %d(->%d)\n", location, registerName(exec, r0).data(), registerName(exec, r1).data(), offset, location + offset);
+            dataLog("[%4d] jnlesseq\t\t %s, %s, %d(->%d)\n", location, registerName(exec, r0).data(), registerName(exec, r1).data(), offset, location + offset);
             break;
         }
         case op_jngreater: {
             int r0 = (++it)->u.operand;
             int r1 = (++it)->u.operand;
             int offset = (++it)->u.operand;
-            printf("[%4d] jngreater\t\t %s, %s, %d(->%d)\n", location, registerName(exec, r0).data(), registerName(exec, r1).data(), offset, location + offset);
+            dataLog("[%4d] jngreater\t\t %s, %s, %d(->%d)\n", location, registerName(exec, r0).data(), registerName(exec, r1).data(), offset, location + offset);
             break;
         }
         case op_jngreatereq: {
             int r0 = (++it)->u.operand;
             int r1 = (++it)->u.operand;
             int offset = (++it)->u.operand;
-            printf("[%4d] jngreatereq\t\t %s, %s, %d(->%d)\n", location, registerName(exec, r0).data(), registerName(exec, r1).data(), offset, location + offset);
+            dataLog("[%4d] jngreatereq\t\t %s, %s, %d(->%d)\n", location, registerName(exec, r0).data(), registerName(exec, r1).data(), offset, location + offset);
             break;
         }
         case op_loop_if_less: {
             int r0 = (++it)->u.operand;
             int r1 = (++it)->u.operand;
             int offset = (++it)->u.operand;
-            printf("[%4d] loop_if_less\t %s, %s, %d(->%d)\n", location, registerName(exec, r0).data(), registerName(exec, r1).data(), offset, location + offset);
+            dataLog("[%4d] loop_if_less\t %s, %s, %d(->%d)\n", location, registerName(exec, r0).data(), registerName(exec, r1).data(), offset, location + offset);
             break;
         }
         case op_loop_if_lesseq: {
             int r0 = (++it)->u.operand;
             int r1 = (++it)->u.operand;
             int offset = (++it)->u.operand;
-            printf("[%4d] loop_if_lesseq\t %s, %s, %d(->%d)\n", location, registerName(exec, r0).data(), registerName(exec, r1).data(), offset, location + offset);
+            dataLog("[%4d] loop_if_lesseq\t %s, %s, %d(->%d)\n", location, registerName(exec, r0).data(), registerName(exec, r1).data(), offset, location + offset);
             break;
         }
         case op_loop_if_greater: {
             int r0 = (++it)->u.operand;
             int r1 = (++it)->u.operand;
             int offset = (++it)->u.operand;
-            printf("[%4d] loop_if_greater\t %s, %s, %d(->%d)\n", location, registerName(exec, r0).data(), registerName(exec, r1).data(), offset, location + offset);
+            dataLog("[%4d] loop_if_greater\t %s, %s, %d(->%d)\n", location, registerName(exec, r0).data(), registerName(exec, r1).data(), offset, location + offset);
             break;
         }
         case op_loop_if_greatereq: {
             int r0 = (++it)->u.operand;
             int r1 = (++it)->u.operand;
             int offset = (++it)->u.operand;
-            printf("[%4d] loop_if_greatereq\t %s, %s, %d(->%d)\n", location, registerName(exec, r0).data(), registerName(exec, r1).data(), offset, location + offset);
+            dataLog("[%4d] loop_if_greatereq\t %s, %s, %d(->%d)\n", location, registerName(exec, r0).data(), registerName(exec, r1).data(), offset, location + offset);
             break;
         }
         case op_loop_hint: {
-            printf("[%4d] loop_hint\n", location);
+            dataLog("[%4d] loop_hint\n", location);
             break;
         }
         case op_switch_imm: {
             int tableIndex = (++it)->u.operand;
             int defaultTarget = (++it)->u.operand;
             int scrutineeRegister = (++it)->u.operand;
-            printf("[%4d] switch_imm\t %d, %d(->%d), %s\n", location, tableIndex, defaultTarget, location + defaultTarget, registerName(exec, scrutineeRegister).data());
+            dataLog("[%4d] switch_imm\t %d, %d(->%d), %s\n", location, tableIndex, defaultTarget, location + defaultTarget, registerName(exec, scrutineeRegister).data());
             break;
         }
         case op_switch_char: {
             int tableIndex = (++it)->u.operand;
             int defaultTarget = (++it)->u.operand;
             int scrutineeRegister = (++it)->u.operand;
-            printf("[%4d] switch_char\t %d, %d(->%d), %s\n", location, tableIndex, defaultTarget, location + defaultTarget, registerName(exec, scrutineeRegister).data());
+            dataLog("[%4d] switch_char\t %d, %d(->%d), %s\n", location, tableIndex, defaultTarget, location + defaultTarget, registerName(exec, scrutineeRegister).data());
             break;
         }
         case op_switch_string: {
             int tableIndex = (++it)->u.operand;
             int defaultTarget = (++it)->u.operand;
             int scrutineeRegister = (++it)->u.operand;
-            printf("[%4d] switch_string\t %d, %d(->%d), %s\n", location, tableIndex, defaultTarget, location + defaultTarget, registerName(exec, scrutineeRegister).data());
+            dataLog("[%4d] switch_string\t %d, %d(->%d), %s\n", location, tableIndex, defaultTarget, location + defaultTarget, registerName(exec, scrutineeRegister).data());
             break;
         }
         case op_new_func: {
             int r0 = (++it)->u.operand;
             int f0 = (++it)->u.operand;
             int shouldCheck = (++it)->u.operand;
-            printf("[%4d] new_func\t\t %s, f%d, %s\n", location, registerName(exec, r0).data(), f0, shouldCheck ? "<Checked>" : "<Unchecked>");
+            dataLog("[%4d] new_func\t\t %s, f%d, %s\n", location, registerName(exec, r0).data(), f0, shouldCheck ? "<Checked>" : "<Unchecked>");
             break;
         }
         case op_new_func_exp: {
             int r0 = (++it)->u.operand;
             int f0 = (++it)->u.operand;
-            printf("[%4d] new_func_exp\t %s, f%d\n", location, registerName(exec, r0).data(), f0);
+            dataLog("[%4d] new_func_exp\t %s, f%d\n", location, registerName(exec, r0).data(), f0);
             break;
         }
         case op_call: {
@@ -1142,35 +1151,35 @@ void CodeBlock::dump(ExecState* exec, const Vector<Instruction>::const_iterator&
             int thisValue = (++it)->u.operand;
             int arguments = (++it)->u.operand;
             int firstFreeRegister = (++it)->u.operand;
-            printf("[%4d] call_varargs\t %s, %s, %s, %d\n", location, registerName(exec, callee).data(), registerName(exec, thisValue).data(), registerName(exec, arguments).data(), firstFreeRegister);
+            dataLog("[%4d] call_varargs\t %s, %s, %s, %d\n", location, registerName(exec, callee).data(), registerName(exec, thisValue).data(), registerName(exec, arguments).data(), firstFreeRegister);
             break;
         }
         case op_tear_off_activation: {
             int r0 = (++it)->u.operand;
             int r1 = (++it)->u.operand;
-            printf("[%4d] tear_off_activation\t %s, %s\n", location, registerName(exec, r0).data(), registerName(exec, r1).data());
+            dataLog("[%4d] tear_off_activation\t %s, %s\n", location, registerName(exec, r0).data(), registerName(exec, r1).data());
             break;
         }
         case op_tear_off_arguments: {
             int r0 = (++it)->u.operand;
-            printf("[%4d] tear_off_arguments %s\n", location, registerName(exec, r0).data());
+            dataLog("[%4d] tear_off_arguments %s\n", location, registerName(exec, r0).data());
             break;
         }
         case op_ret: {
             int r0 = (++it)->u.operand;
-            printf("[%4d] ret\t\t %s\n", location, registerName(exec, r0).data());
+            dataLog("[%4d] ret\t\t %s\n", location, registerName(exec, r0).data());
             break;
         }
         case op_call_put_result: {
             int r0 = (++it)->u.operand;
-            printf("[%4d] op_call_put_result\t\t %s\n", location, registerName(exec, r0).data());
+            dataLog("[%4d] op_call_put_result\t\t %s\n", location, registerName(exec, r0).data());
             it++;
             break;
         }
         case op_ret_object_or_this: {
             int r0 = (++it)->u.operand;
             int r1 = (++it)->u.operand;
-            printf("[%4d] constructor_ret\t\t %s %s\n", location, registerName(exec, r0).data(), registerName(exec, r1).data());
+            dataLog("[%4d] constructor_ret\t\t %s %s\n", location, registerName(exec, r0).data(), registerName(exec, r1).data());
             break;
         }
         case op_construct: {
@@ -1181,13 +1190,13 @@ void CodeBlock::dump(ExecState* exec, const Vector<Instruction>::const_iterator&
             int r0 = (++it)->u.operand;
             int r1 = (++it)->u.operand;
             int count = (++it)->u.operand;
-            printf("[%4d] strcat\t\t %s, %s, %d\n", location, registerName(exec, r0).data(), registerName(exec, r1).data(), count);
+            dataLog("[%4d] strcat\t\t %s, %s, %d\n", location, registerName(exec, r0).data(), registerName(exec, r1).data(), count);
             break;
         }
         case op_to_primitive: {
             int r0 = (++it)->u.operand;
             int r1 = (++it)->u.operand;
-            printf("[%4d] to_primitive\t %s, %s\n", location, registerName(exec, r0).data(), registerName(exec, r1).data());
+            dataLog("[%4d] to_primitive\t %s, %s\n", location, registerName(exec, r0).data(), registerName(exec, r1).data());
             break;
         }
         case op_get_pnames: {
@@ -1196,7 +1205,7 @@ void CodeBlock::dump(ExecState* exec, const Vector<Instruction>::const_iterator&
             int r2 = it[3].u.operand;
             int r3 = it[4].u.operand;
             int offset = it[5].u.operand;
-            printf("[%4d] get_pnames\t %s, %s, %s, %s, %d(->%d)\n", location, registerName(exec, r0).data(), registerName(exec, r1).data(), registerName(exec, r2).data(), registerName(exec, r3).data(), offset, location + offset);
+            dataLog("[%4d] get_pnames\t %s, %s, %s, %s, %d(->%d)\n", location, registerName(exec, r0).data(), registerName(exec, r1).data(), registerName(exec, r2).data(), registerName(exec, r3).data(), offset, location + offset);
             it += OPCODE_LENGTH(op_get_pnames) - 1;
             break;
         }
@@ -1207,78 +1216,78 @@ void CodeBlock::dump(ExecState* exec, const Vector<Instruction>::const_iterator&
             int size = it[4].u.operand;
             int iter = it[5].u.operand;
             int offset = it[6].u.operand;
-            printf("[%4d] next_pname\t %s, %s, %s, %s, %s, %d(->%d)\n", location, registerName(exec, dest).data(), registerName(exec, base).data(), registerName(exec, i).data(), registerName(exec, size).data(), registerName(exec, iter).data(), offset, location + offset);
+            dataLog("[%4d] next_pname\t %s, %s, %s, %s, %s, %d(->%d)\n", location, registerName(exec, dest).data(), registerName(exec, base).data(), registerName(exec, i).data(), registerName(exec, size).data(), registerName(exec, iter).data(), offset, location + offset);
             it += OPCODE_LENGTH(op_next_pname) - 1;
             break;
         }
         case op_push_scope: {
             int r0 = (++it)->u.operand;
-            printf("[%4d] push_scope\t %s\n", location, registerName(exec, r0).data());
+            dataLog("[%4d] push_scope\t %s\n", location, registerName(exec, r0).data());
             break;
         }
         case op_pop_scope: {
-            printf("[%4d] pop_scope\n", location);
+            dataLog("[%4d] pop_scope\n", location);
             break;
         }
         case op_push_new_scope: {
             int r0 = (++it)->u.operand;
             int id0 = (++it)->u.operand;
             int r1 = (++it)->u.operand;
-            printf("[%4d] push_new_scope \t%s, %s, %s\n", location, registerName(exec, r0).data(), idName(id0, m_identifiers[id0]).data(), registerName(exec, r1).data());
+            dataLog("[%4d] push_new_scope \t%s, %s, %s\n", location, registerName(exec, r0).data(), idName(id0, m_identifiers[id0]).data(), registerName(exec, r1).data());
             break;
         }
         case op_jmp_scopes: {
             int scopeDelta = (++it)->u.operand;
             int offset = (++it)->u.operand;
-            printf("[%4d] jmp_scopes\t^%d, %d(->%d)\n", location, scopeDelta, offset, location + offset);
+            dataLog("[%4d] jmp_scopes\t^%d, %d(->%d)\n", location, scopeDelta, offset, location + offset);
             break;
         }
         case op_catch: {
             int r0 = (++it)->u.operand;
-            printf("[%4d] catch\t\t %s\n", location, registerName(exec, r0).data());
+            dataLog("[%4d] catch\t\t %s\n", location, registerName(exec, r0).data());
             break;
         }
         case op_throw: {
             int r0 = (++it)->u.operand;
-            printf("[%4d] throw\t\t %s\n", location, registerName(exec, r0).data());
+            dataLog("[%4d] throw\t\t %s\n", location, registerName(exec, r0).data());
             break;
         }
         case op_throw_reference_error: {
             int k0 = (++it)->u.operand;
-            printf("[%4d] throw_reference_error\t %s\n", location, constantName(exec, k0, getConstant(k0)).data());
+            dataLog("[%4d] throw_reference_error\t %s\n", location, constantName(exec, k0, getConstant(k0)).data());
             break;
         }
         case op_jsr: {
             int retAddrDst = (++it)->u.operand;
             int offset = (++it)->u.operand;
-            printf("[%4d] jsr\t\t %s, %d(->%d)\n", location, registerName(exec, retAddrDst).data(), offset, location + offset);
+            dataLog("[%4d] jsr\t\t %s, %d(->%d)\n", location, registerName(exec, retAddrDst).data(), offset, location + offset);
             break;
         }
         case op_sret: {
             int retAddrSrc = (++it)->u.operand;
-            printf("[%4d] sret\t\t %s\n", location, registerName(exec, retAddrSrc).data());
+            dataLog("[%4d] sret\t\t %s\n", location, registerName(exec, retAddrSrc).data());
             break;
         }
         case op_debug: {
             int debugHookID = (++it)->u.operand;
             int firstLine = (++it)->u.operand;
             int lastLine = (++it)->u.operand;
-            printf("[%4d] debug\t\t %s, %d, %d\n", location, debugHookName(debugHookID), firstLine, lastLine);
+            dataLog("[%4d] debug\t\t %s, %d, %d\n", location, debugHookName(debugHookID), firstLine, lastLine);
             break;
         }
         case op_profile_will_call: {
             int function = (++it)->u.operand;
-            printf("[%4d] profile_will_call %s\n", location, registerName(exec, function).data());
+            dataLog("[%4d] profile_will_call %s\n", location, registerName(exec, function).data());
             break;
         }
         case op_profile_did_call: {
             int function = (++it)->u.operand;
-            printf("[%4d] profile_did_call\t %s\n", location, registerName(exec, function).data());
+            dataLog("[%4d] profile_did_call\t %s\n", location, registerName(exec, function).data());
             break;
         }
         case op_end: {
             int r0 = (++it)->u.operand;
-            printf("[%4d] end\t\t %s\n", location, registerName(exec, r0).data());
+            dataLog("[%4d] end\t\t %s\n", location, registerName(exec, r0).data());
             break;
         }
     }
@@ -1382,29 +1391,29 @@ void CodeBlock::dumpStatistics()
     totalSize += symbolTableTotalSize;
     totalSize += (liveCodeBlockSet.size() * sizeof(CodeBlock));
 
-    printf("Number of live CodeBlocks: %d\n", liveCodeBlockSet.size());
-    printf("Size of a single CodeBlock [sizeof(CodeBlock)]: %zu\n", sizeof(CodeBlock));
-    printf("Size of all CodeBlocks: %zu\n", totalSize);
-    printf("Average size of a CodeBlock: %zu\n", totalSize / liveCodeBlockSet.size());
+    dataLog("Number of live CodeBlocks: %d\n", liveCodeBlockSet.size());
+    dataLog("Size of a single CodeBlock [sizeof(CodeBlock)]: %zu\n", sizeof(CodeBlock));
+    dataLog("Size of all CodeBlocks: %zu\n", totalSize);
+    dataLog("Average size of a CodeBlock: %zu\n", totalSize / liveCodeBlockSet.size());
 
-    printf("Number of FunctionCode CodeBlocks: %zu (%.3f%%)\n", isFunctionCode, static_cast<double>(isFunctionCode) * 100.0 / liveCodeBlockSet.size());
-    printf("Number of GlobalCode CodeBlocks: %zu (%.3f%%)\n", isGlobalCode, static_cast<double>(isGlobalCode) * 100.0 / liveCodeBlockSet.size());
-    printf("Number of EvalCode CodeBlocks: %zu (%.3f%%)\n", isEvalCode, static_cast<double>(isEvalCode) * 100.0 / liveCodeBlockSet.size());
+    dataLog("Number of FunctionCode CodeBlocks: %zu (%.3f%%)\n", isFunctionCode, static_cast<double>(isFunctionCode) * 100.0 / liveCodeBlockSet.size());
+    dataLog("Number of GlobalCode CodeBlocks: %zu (%.3f%%)\n", isGlobalCode, static_cast<double>(isGlobalCode) * 100.0 / liveCodeBlockSet.size());
+    dataLog("Number of EvalCode CodeBlocks: %zu (%.3f%%)\n", isEvalCode, static_cast<double>(isEvalCode) * 100.0 / liveCodeBlockSet.size());
 
-    printf("Number of CodeBlocks with rare data: %zu (%.3f%%)\n", hasRareData, static_cast<double>(hasRareData) * 100.0 / liveCodeBlockSet.size());
+    dataLog("Number of CodeBlocks with rare data: %zu (%.3f%%)\n", hasRareData, static_cast<double>(hasRareData) * 100.0 / liveCodeBlockSet.size());
 
-    #define PRINT_STATS(name) printf("Number of CodeBlocks with " #name ": %zu\n", name##IsNotEmpty); printf("Size of all " #name ": %zu\n", name##TotalSize); 
+    #define PRINT_STATS(name) dataLog("Number of CodeBlocks with " #name ": %zu\n", name##IsNotEmpty); dataLog("Size of all " #name ": %zu\n", name##TotalSize); 
         FOR_EACH_MEMBER_VECTOR(PRINT_STATS)
         FOR_EACH_MEMBER_VECTOR_RARE_DATA(PRINT_STATS)
     #undef PRINT_STATS
 
-    printf("Number of CodeBlocks with evalCodeCache: %zu\n", evalCodeCacheIsNotEmpty);
-    printf("Number of CodeBlocks with symbolTable: %zu\n", symbolTableIsNotEmpty);
+    dataLog("Number of CodeBlocks with evalCodeCache: %zu\n", evalCodeCacheIsNotEmpty);
+    dataLog("Number of CodeBlocks with symbolTable: %zu\n", symbolTableIsNotEmpty);
 
-    printf("Size of all symbolTables: %zu\n", symbolTableTotalSize);
+    dataLog("Size of all symbolTables: %zu\n", symbolTableTotalSize);
 
 #else
-    printf("Dumping CodeBlock statistics is not enabled.\n");
+    dataLog("Dumping CodeBlock statistics is not enabled.\n");
 #endif
 }
 
@@ -1453,6 +1462,7 @@ CodeBlock::CodeBlock(CopyParsedBlockTag, CodeBlock& other, SymbolTable* symTab)
 {
     setNumParameters(other.numParameters());
     optimizeAfterWarmUp();
+    jitAfterWarmUp();
     
     if (other.m_rareData) {
         createRareDataIfNecessary();
@@ -1501,6 +1511,7 @@ CodeBlock::CodeBlock(ScriptExecutable* ownerExecutable, CodeType codeType, JSGlo
     ASSERT(m_source);
     
     optimizeAfterWarmUp();
+    jitAfterWarmUp();
 
 #if DUMP_CODE_BLOCK_STATISTICS
     liveCodeBlockSet.add(this);
@@ -1518,7 +1529,11 @@ CodeBlock::~CodeBlock()
 #if ENABLE(VERBOSE_VALUE_PROFILE)
     dumpValueProfiles();
 #endif
-    
+
+#if ENABLE(LLINT)    
+    while (m_incomingLLIntCalls.begin() != m_incomingLLIntCalls.end())
+        m_incomingLLIntCalls.begin()->remove();
+#endif // ENABLE(LLINT)
 #if ENABLE(JIT)
     // We may be destroyed before any CodeBlocks that refer to us are destroyed.
     // Consider that two CodeBlocks become unreachable at the same time. There
@@ -1730,13 +1745,74 @@ void CodeBlock::finalizeUnconditionally()
 #else
     static const bool verboseUnlinking = false;
 #endif
-#endif
+#endif // ENABLE(JIT)
     
+#if ENABLE(LLINT)
+    Interpreter* interpreter = m_globalData->interpreter;
+    // interpreter->classicEnabled() returns true if the old C++ interpreter is enabled. If that's enabled
+    // then we're not using LLInt.
+    if (!interpreter->classicEnabled()) {
+        for (size_t size = m_propertyAccessInstructions.size(), i = 0; i < size; ++i) {
+            Instruction* curInstruction = &instructions()[m_propertyAccessInstructions[i]];
+            switch (interpreter->getOpcodeID(curInstruction[0].u.opcode)) {
+            case op_get_by_id:
+            case op_put_by_id:
+                if (!curInstruction[4].u.structure || Heap::isMarked(curInstruction[4].u.structure.get()))
+                    break;
+                if (verboseUnlinking)
+                    dataLog("Clearing LLInt property access with structure %p.\n", curInstruction[4].u.structure.get());
+                curInstruction[4].u.structure.clear();
+                curInstruction[5].u.operand = 0;
+                break;
+            case op_put_by_id_transition_direct:
+            case op_put_by_id_transition_normal:
+                if (Heap::isMarked(curInstruction[4].u.structure.get())
+                    && Heap::isMarked(curInstruction[6].u.structure.get())
+                    && Heap::isMarked(curInstruction[7].u.structureChain.get()))
+                    break;
+                if (verboseUnlinking) {
+                    dataLog("Clearing LLInt put transition with structures %p -> %p, chain %p.\n",
+                            curInstruction[4].u.structure.get(),
+                            curInstruction[6].u.structure.get(),
+                            curInstruction[7].u.structureChain.get());
+                }
+                curInstruction[4].u.structure.clear();
+                curInstruction[6].u.structure.clear();
+                curInstruction[7].u.structureChain.clear();
+                curInstruction[0].u.opcode = interpreter->getOpcode(op_put_by_id);
+                break;
+            default:
+                ASSERT_NOT_REACHED();
+            }
+        }
+        for (size_t size = m_globalResolveInstructions.size(), i = 0; i < size; ++i) {
+            Instruction* curInstruction = &instructions()[m_globalResolveInstructions[i]];
+            ASSERT(interpreter->getOpcodeID(curInstruction[0].u.opcode) == op_resolve_global
+                   || interpreter->getOpcodeID(curInstruction[0].u.opcode) == op_resolve_global_dynamic);
+            if (!curInstruction[3].u.structure || Heap::isMarked(curInstruction[3].u.structure.get()))
+                continue;
+            if (verboseUnlinking)
+                dataLog("Clearing LLInt global resolve cache with structure %p.\n", curInstruction[3].u.structure.get());
+            curInstruction[3].u.structure.clear();
+            curInstruction[4].u.operand = 0;
+        }
+        for (unsigned i = 0; i < m_llintCallLinkInfos.size(); ++i) {
+            if (m_llintCallLinkInfos[i].isLinked() && !Heap::isMarked(m_llintCallLinkInfos[i].callee.get())) {
+                if (verboseUnlinking)
+                    dataLog("Clearing LLInt call from %p.\n", this);
+                m_llintCallLinkInfos[i].unlink();
+            }
+            if (!!m_llintCallLinkInfos[i].lastSeenCallee && !Heap::isMarked(m_llintCallLinkInfos[i].lastSeenCallee.get()))
+                m_llintCallLinkInfos[i].lastSeenCallee.clear();
+        }
+    }
+#endif // ENABLE(LLINT)
+
 #if ENABLE(DFG_JIT)
     // Check if we're not live. If we are, then jettison.
     if (!(shouldImmediatelyAssumeLivenessDuringScan() || m_dfgData->livenessHasBeenProved)) {
         if (verboseUnlinking)
-            printf("Code block %p has dead weak references, jettisoning during GC.\n", this);
+            dataLog("Code block %p has dead weak references, jettisoning during GC.\n", this);
 
         // Make sure that the baseline JIT knows that it should re-warm-up before
         // optimizing.
@@ -1754,7 +1830,7 @@ void CodeBlock::finalizeUnconditionally()
         for (unsigned i = 0; i < numberOfCallLinkInfos(); ++i) {
             if (callLinkInfo(i).isLinked() && !Heap::isMarked(callLinkInfo(i).callee.get())) {
                 if (verboseUnlinking)
-                    printf("Clearing call from %p.\n", this);
+                    dataLog("Clearing call from %p to %p.\n", this, callLinkInfo(i).callee.get());
                 callLinkInfo(i).unlink(*m_globalData, repatchBuffer);
             }
             if (!!callLinkInfo(i).lastSeenCallee
@@ -1764,7 +1840,7 @@ void CodeBlock::finalizeUnconditionally()
         for (size_t size = m_globalResolveInfos.size(), i = 0; i < size; ++i) {
             if (m_globalResolveInfos[i].structure && !Heap::isMarked(m_globalResolveInfos[i].structure.get())) {
                 if (verboseUnlinking)
-                    printf("Clearing resolve info in %p.\n", this);
+                    dataLog("Clearing resolve info in %p.\n", this);
                 m_globalResolveInfos[i].structure.clear();
             }
         }
@@ -1778,7 +1854,7 @@ void CodeBlock::finalizeUnconditionally()
                 continue;
             
             if (verboseUnlinking)
-                printf("Clearing structure cache (kind %d) in %p.\n", stubInfo.accessType, this);
+                dataLog("Clearing structure cache (kind %d) in %p.\n", stubInfo.accessType, this);
             
             if (isGetByIdAccess(accessType)) {
                 if (getJITCode().jitType() == JITCode::DFGJIT)
@@ -1808,7 +1884,7 @@ void CodeBlock::finalizeUnconditionally()
                 || !Heap::isMarked(m_methodCallLinkInfos[i].cachedFunction.get())
                 || !Heap::isMarked(m_methodCallLinkInfos[i].cachedPrototype.get())) {
                 if (verboseUnlinking)
-                    printf("Clearing method call in %p.\n", this);
+                    dataLog("Clearing method call in %p.\n", this);
                 m_methodCallLinkInfos[i].reset(repatchBuffer, getJITType());
 
                 StructureStubInfo& stubInfo = getStubInfo(m_methodCallLinkInfos[i].bytecodeIndex);
@@ -1851,11 +1927,13 @@ void CodeBlock::stronglyVisitStrongReferences(SlotVisitor& visitor)
         visitor.append(&m_functionExprs[i]);
     for (size_t i = 0; i < m_functionDecls.size(); ++i)
         visitor.append(&m_functionDecls[i]);
-#if ENABLE(INTERPRETER)
-    for (size_t size = m_propertyAccessInstructions.size(), i = 0; i < size; ++i)
-        visitStructures(visitor, &instructions()[m_propertyAccessInstructions[i]]);
-    for (size_t size = m_globalResolveInstructions.size(), i = 0; i < size; ++i)
-        visitStructures(visitor, &instructions()[m_globalResolveInstructions[i]]);
+#if ENABLE(CLASSIC_INTERPRETER)
+    if (m_globalData->interpreter->classicEnabled()) {
+        for (size_t size = m_propertyAccessInstructions.size(), i = 0; i < size; ++i)
+            visitStructures(visitor, &instructions()[m_propertyAccessInstructions[i]]);
+        for (size_t size = m_globalResolveInstructions.size(), i = 0; i < size; ++i)
+            visitStructures(visitor, &instructions()[m_globalResolveInstructions[i]]);
+    }
 #endif
 
 #if ENABLE(DFG_JIT)
@@ -1863,10 +1941,13 @@ void CodeBlock::stronglyVisitStrongReferences(SlotVisitor& visitor)
         // Make sure that executables that we have inlined don't die.
         // FIXME: If they would have otherwise died, we should probably trigger recompilation.
         for (size_t i = 0; i < inlineCallFrames().size(); ++i) {
-            visitor.append(&inlineCallFrames()[i].executable);
-            visitor.append(&inlineCallFrames()[i].callee);
+            InlineCallFrame& inlineCallFrame = inlineCallFrames()[i];
+            visitor.append(&inlineCallFrame.executable);
+            visitor.append(&inlineCallFrame.callee);
         }
     }
+    
+    m_lazyOperandValueProfiles.computeUpdatedPredictions();
 #endif
 
 #if ENABLE(VALUE_PROFILER)
@@ -1976,7 +2057,7 @@ void CodeBlock::expressionRangeForBytecodeOffset(unsigned bytecodeOffset, int& d
     return;
 }
 
-#if ENABLE(INTERPRETER)
+#if ENABLE(CLASSIC_INTERPRETER)
 bool CodeBlock::hasGlobalResolveInstructionAtBytecodeOffset(unsigned bytecodeOffset)
 {
     if (m_globalResolveInstructions.isEmpty())
@@ -2023,7 +2104,7 @@ void CodeBlock::shrinkToFit()
 {
     instructions().shrinkToFit();
 
-#if ENABLE(INTERPRETER)
+#if ENABLE(CLASSIC_INTERPRETER)
     m_propertyAccessInstructions.shrinkToFit();
     m_globalResolveInstructions.shrinkToFit();
 #endif
@@ -2068,12 +2149,18 @@ unsigned CodeBlock::addOrFindConstant(JSValue v)
     }
     return addConstant(v);
 }
-    
+
 #if ENABLE(JIT)
 void CodeBlock::unlinkCalls()
 {
     if (!!m_alternative)
         m_alternative->unlinkCalls();
+#if ENABLE(LLINT)
+    for (size_t i = 0; i < m_llintCallLinkInfos.size(); ++i) {
+        if (m_llintCallLinkInfos[i].isLinked())
+            m_llintCallLinkInfos[i].unlink();
+    }
+#endif
     if (!(m_callLinkInfos.size() || m_methodCallLinkInfos.size()))
         return;
     if (!m_globalData->canUseJIT())
@@ -2088,10 +2175,62 @@ void CodeBlock::unlinkCalls()
 
 void CodeBlock::unlinkIncomingCalls()
 {
+#if ENABLE(LLINT)
+    while (m_incomingLLIntCalls.begin() != m_incomingLLIntCalls.end())
+        m_incomingLLIntCalls.begin()->unlink();
+#endif
+    if (m_incomingCalls.isEmpty())
+        return;
     RepatchBuffer repatchBuffer(this);
     while (m_incomingCalls.begin() != m_incomingCalls.end())
         m_incomingCalls.begin()->unlink(*m_globalData, repatchBuffer);
 }
+
+unsigned CodeBlock::bytecodeOffset(ExecState* exec, ReturnAddressPtr returnAddress)
+{
+#if ENABLE(LLINT)
+    if (returnAddress.value() >= bitwise_cast<void*>(&llint_begin)
+        && returnAddress.value() <= bitwise_cast<void*>(&llint_end)) {
+        ASSERT(exec->codeBlock());
+        ASSERT(exec->codeBlock() == this);
+        ASSERT(JITCode::isBaselineCode(getJITType()));
+        Instruction* instruction = exec->currentVPC();
+        ASSERT(instruction);
+        
+        // The LLInt stores the PC after the call instruction rather than the PC of
+        // the call instruction. This requires some correcting. We rely on the fact
+        // that the preceding instruction must be one of the call instructions, so
+        // either it's a call_varargs or it's a call, construct, or eval.
+        ASSERT(OPCODE_LENGTH(op_call_varargs) <= OPCODE_LENGTH(op_call));
+        ASSERT(OPCODE_LENGTH(op_call) == OPCODE_LENGTH(op_construct));
+        ASSERT(OPCODE_LENGTH(op_call) == OPCODE_LENGTH(op_call_eval));
+        if (instruction[-OPCODE_LENGTH(op_call_varargs)].u.pointer == bitwise_cast<void*>(llint_op_call_varargs)) {
+            // We know that the preceding instruction must be op_call_varargs because there is no way that
+            // the pointer to the call_varargs could be an operand to the call.
+            instruction -= OPCODE_LENGTH(op_call_varargs);
+            ASSERT(instruction[-OPCODE_LENGTH(op_call)].u.pointer != bitwise_cast<void*>(llint_op_call)
+                   && instruction[-OPCODE_LENGTH(op_call)].u.pointer != bitwise_cast<void*>(llint_op_construct)
+                   && instruction[-OPCODE_LENGTH(op_call)].u.pointer != bitwise_cast<void*>(llint_op_call_eval));
+        } else {
+            // Must be that the last instruction was some op_call.
+            ASSERT(instruction[-OPCODE_LENGTH(op_call)].u.pointer == bitwise_cast<void*>(llint_op_call)
+                   || instruction[-OPCODE_LENGTH(op_call)].u.pointer == bitwise_cast<void*>(llint_op_construct)
+                   || instruction[-OPCODE_LENGTH(op_call)].u.pointer == bitwise_cast<void*>(llint_op_call_eval));
+            instruction -= OPCODE_LENGTH(op_call);
+        }
+        
+        return bytecodeOffset(instruction);
+    }
+#else
+    UNUSED_PARAM(exec);
+#endif
+    if (!m_rareData)
+        return 1;
+    Vector<CallReturnOffsetToBytecodeOffset>& callIndices = m_rareData->m_callReturnIndexVector;
+    if (!callIndices.size())
+        return 1;
+    return binarySearch<CallReturnOffsetToBytecodeOffset, unsigned, getCallReturnOffset>(callIndices.begin(), callIndices.size(), getJITCode().offsetOf(returnAddress.value()))->bytecodeOffset;
+}
 #endif
 
 void CodeBlock::clearEvalCache()
@@ -2187,31 +2326,52 @@ bool FunctionCodeBlock::canCompileWithDFGInternal()
 
 void ProgramCodeBlock::jettison()
 {
-    ASSERT(getJITType() != JITCode::BaselineJIT);
+    ASSERT(JITCode::isOptimizingJIT(getJITType()));
     ASSERT(this == replacement());
     static_cast<ProgramExecutable*>(ownerExecutable())->jettisonOptimizedCode(*globalData());
 }
 
 void EvalCodeBlock::jettison()
 {
-    ASSERT(getJITType() != JITCode::BaselineJIT);
+    ASSERT(JITCode::isOptimizingJIT(getJITType()));
     ASSERT(this == replacement());
     static_cast<EvalExecutable*>(ownerExecutable())->jettisonOptimizedCode(*globalData());
 }
 
 void FunctionCodeBlock::jettison()
 {
-    ASSERT(getJITType() != JITCode::BaselineJIT);
+    ASSERT(JITCode::isOptimizingJIT(getJITType()));
     ASSERT(this == replacement());
     static_cast<FunctionExecutable*>(ownerExecutable())->jettisonOptimizedCodeFor(*globalData(), m_isConstructor ? CodeForConstruct : CodeForCall);
 }
+
+void ProgramCodeBlock::jitCompileImpl(JSGlobalData& globalData)
+{
+    ASSERT(getJITType() == JITCode::InterpreterThunk);
+    ASSERT(this == replacement());
+    return static_cast<ProgramExecutable*>(ownerExecutable())->jitCompile(globalData);
+}
+
+void EvalCodeBlock::jitCompileImpl(JSGlobalData& globalData)
+{
+    ASSERT(getJITType() == JITCode::InterpreterThunk);
+    ASSERT(this == replacement());
+    return static_cast<EvalExecutable*>(ownerExecutable())->jitCompile(globalData);
+}
+
+void FunctionCodeBlock::jitCompileImpl(JSGlobalData& globalData)
+{
+    ASSERT(getJITType() == JITCode::InterpreterThunk);
+    ASSERT(this == replacement());
+    return static_cast<FunctionExecutable*>(ownerExecutable())->jitCompileFor(globalData, m_isConstructor ? CodeForConstruct : CodeForCall);
+}
 #endif
 
 #if ENABLE(VALUE_PROFILER)
 bool CodeBlock::shouldOptimizeNow()
 {
 #if ENABLE(JIT_VERBOSE_OSR)
-    printf("Considering optimizing %p...\n", this);
+    dataLog("Considering optimizing %p...\n", this);
 #endif
 
 #if ENABLE(VERBOSE_VALUE_PROFILE)
@@ -2239,7 +2399,7 @@ bool CodeBlock::shouldOptimizeNow()
     }
 
 #if ENABLE(JIT_VERBOSE_OSR)
-    printf("Profile hotness: %lf, %lf\n", (double)numberOfLiveNonArgumentValueProfiles / numberOfValueProfiles(), (double)numberOfSamplesInProfiles / ValueProfile::numberOfBuckets / numberOfValueProfiles());
+    dataLog("Profile hotness: %lf, %lf\n", (double)numberOfLiveNonArgumentValueProfiles / numberOfValueProfiles(), (double)numberOfSamplesInProfiles / ValueProfile::numberOfBuckets / numberOfValueProfiles());
 #endif
 
     if ((!numberOfValueProfiles() || (double)numberOfLiveNonArgumentValueProfiles / numberOfValueProfiles() >= Options::desiredProfileLivenessRate)
@@ -2270,7 +2430,7 @@ void CodeBlock::tallyFrequentExitSites()
             continue;
         
 #if DFG_ENABLE(DEBUG_VERBOSE)
-        fprintf(stderr, "OSR exit #%u (bc#%u, @%u, %s) for code block %p occurred frequently; counting as frequent exit site.\n", i, exit.m_codeOrigin.bytecodeIndex, exit.m_nodeIndex, DFG::exitKindToString(exit.m_kind), this);
+        dataLog("OSR exit #%u (bc#%u, @%u, %s) for code block %p occurred frequently; counting as frequent exit site.\n", i, exit.m_codeOrigin.bytecodeIndex, exit.m_nodeIndex, DFG::exitKindToString(exit.m_kind), this);
 #endif
     }
 }
@@ -2279,30 +2439,30 @@ void CodeBlock::tallyFrequentExitSites()
 #if ENABLE(VERBOSE_VALUE_PROFILE)
 void CodeBlock::dumpValueProfiles()
 {
-    fprintf(stderr, "ValueProfile for %p:\n", this);
+    dataLog("ValueProfile for %p:\n", this);
     for (unsigned i = 0; i < totalNumberOfValueProfiles(); ++i) {
         ValueProfile* profile = getFromAllValueProfiles(i);
         if (profile->m_bytecodeOffset < 0) {
             ASSERT(profile->m_bytecodeOffset == -1);
-            fprintf(stderr, "   arg = %u: ", i);
+            dataLog("   arg = %u: ", i);
         } else
-            fprintf(stderr, "   bc = %d: ", profile->m_bytecodeOffset);
+            dataLog("   bc = %d: ", profile->m_bytecodeOffset);
         if (!profile->numberOfSamples() && profile->m_prediction == PredictNone) {
-            fprintf(stderr, "<empty>\n");
+            dataLog("<empty>\n");
             continue;
         }
-        profile->dump(stderr);
-        fprintf(stderr, "\n");
+        profile->dump(WTF::dataFile());
+        dataLog("\n");
     }
-    fprintf(stderr, "RareCaseProfile for %p:\n", this);
+    dataLog("RareCaseProfile for %p:\n", this);
     for (unsigned i = 0; i < numberOfRareCaseProfiles(); ++i) {
         RareCaseProfile* profile = rareCaseProfile(i);
-        fprintf(stderr, "   bc = %d: %u\n", profile->m_bytecodeOffset, profile->m_counter);
+        dataLog("   bc = %d: %u\n", profile->m_bytecodeOffset, profile->m_counter);
     }
-    fprintf(stderr, "SpecialFastCaseProfile for %p:\n", this);
+    dataLog("SpecialFastCaseProfile for %p:\n", this);
     for (unsigned i = 0; i < numberOfSpecialFastCaseProfiles(); ++i) {
         RareCaseProfile* profile = specialFastCaseProfile(i);
-        fprintf(stderr, "   bc = %d: %u\n", profile->m_bytecodeOffset, profile->m_counter);
+        dataLog("   bc = %d: %u\n", profile->m_bytecodeOffset, profile->m_counter);
     }
 }
 #endif
diff --git a/Source/JavaScriptCore/bytecode/CodeBlock.h b/Source/JavaScriptCore/bytecode/CodeBlock.h
index bc2feeb2a..195aa62ca 100644
--- a/Source/JavaScriptCore/bytecode/CodeBlock.h
+++ b/Source/JavaScriptCore/bytecode/CodeBlock.h
@@ -30,6 +30,7 @@
 #ifndef CodeBlock_h
 #define CodeBlock_h
 
+#include "BytecodeConventions.h"
 #include "CallLinkInfo.h"
 #include "CallReturnOffsetToBytecodeOffset.h"
 #include "CodeOrigin.h"
@@ -50,6 +51,8 @@
 #include "JITWriteBarrier.h"
 #include "JSGlobalObject.h"
 #include "JumpTable.h"
+#include "LLIntCallLinkInfo.h"
+#include "LazyOperandValueProfile.h"
 #include "LineInfo.h"
 #include "Nodes.h"
 #include "PredictionTracker.h"
@@ -65,16 +68,11 @@
 #include <wtf/Vector.h>
 #include "StructureStubInfo.h"
 
-// Register numbers used in bytecode operations have different meaning according to their ranges:
-//      0x80000000-0xFFFFFFFF  Negative indices from the CallFrame pointer are entries in the call frame, see RegisterFile.h.
-//      0x00000000-0x3FFFFFFF  Forwards indices from the CallFrame pointer are local vars and temporaries with the function's callframe.
-//      0x40000000-0x7FFFFFFF  Positive indices from 0x40000000 specify entries in the constant pool on the CodeBlock.
-static const int FirstConstantRegisterIndex = 0x40000000;
-
 namespace JSC {
 
-    class ExecState;
     class DFGCodeBlocks;
+    class ExecState;
+    class LLIntOffsetsExtractor;
 
     inline int unmodifiedArgumentsRegister(int argumentsRegister) { return argumentsRegister - 1; }
 
@@ -83,6 +81,7 @@ namespace JSC {
     class CodeBlock : public UnconditionalFinalizer, public WeakReferenceHarvester {
         WTF_MAKE_FAST_ALLOCATED;
         friend class JIT;
+        friend class LLIntOffsetsExtractor;
     public:
         enum CopyParsedBlockTag { CopyParsedBlock };
     protected:
@@ -123,7 +122,7 @@ namespace JSC {
             while (result->alternative())
                 result = result->alternative();
             ASSERT(result);
-            ASSERT(result->getJITType() == JITCode::BaselineJIT);
+            ASSERT(JITCode::isBaselineCode(result->getJITType()));
             return result;
         }
 #endif
@@ -192,15 +191,7 @@ namespace JSC {
             return *(binarySearch<MethodCallLinkInfo, unsigned, getMethodCallLinkInfoBytecodeIndex>(m_methodCallLinkInfos.begin(), m_methodCallLinkInfos.size(), bytecodeIndex));
         }
 
-        unsigned bytecodeOffset(ReturnAddressPtr returnAddress)
-        {
-            if (!m_rareData)
-                return 1;
-            Vector<CallReturnOffsetToBytecodeOffset>& callIndices = m_rareData->m_callReturnIndexVector;
-            if (!callIndices.size())
-                return 1;
-            return binarySearch<CallReturnOffsetToBytecodeOffset, unsigned, getCallReturnOffset>(callIndices.begin(), callIndices.size(), getJITCode().offsetOf(returnAddress.value()))->bytecodeOffset;
-        }
+        unsigned bytecodeOffset(ExecState*, ReturnAddressPtr);
 
         unsigned bytecodeOffsetForCallAtIndex(unsigned index)
         {
@@ -221,11 +212,17 @@ namespace JSC {
         {
             m_incomingCalls.push(incoming);
         }
+#if ENABLE(LLINT)
+        void linkIncomingCall(LLIntCallLinkInfo* incoming)
+        {
+            m_incomingLLIntCalls.push(incoming);
+        }
+#endif // ENABLE(LLINT)
         
         void unlinkIncomingCalls();
-#endif
+#endif // ENABLE(JIT)
 
-#if ENABLE(DFG_JIT)
+#if ENABLE(DFG_JIT) || ENABLE(LLINT)
         void setJITCodeMap(PassOwnPtr<CompactJITCodeMap> jitCodeMap)
         {
             m_jitCodeMap = jitCodeMap;
@@ -234,7 +231,9 @@ namespace JSC {
         {
             return m_jitCodeMap.get();
         }
+#endif
         
+#if ENABLE(DFG_JIT)
         void createDFGDataIfNecessary()
         {
             if (!!m_dfgData)
@@ -333,12 +332,11 @@ namespace JSC {
         }
 #endif
 
-#if ENABLE(INTERPRETER)
         unsigned bytecodeOffset(Instruction* returnAddress)
         {
+            ASSERT(returnAddress >= instructions().begin() && returnAddress < instructions().end());
             return static_cast<Instruction*>(returnAddress) - instructions().begin();
         }
-#endif
 
         void setIsNumericCompareFunction(bool isNumericCompareFunction) { m_isNumericCompareFunction = isNumericCompareFunction; }
         bool isNumericCompareFunction() { return m_isNumericCompareFunction; }
@@ -376,6 +374,20 @@ namespace JSC {
         ExecutableMemoryHandle* executableMemory() { return getJITCode().getExecutableMemory(); }
         virtual JSObject* compileOptimized(ExecState*, ScopeChainNode*) = 0;
         virtual void jettison() = 0;
+        bool jitCompile(JSGlobalData& globalData)
+        {
+            if (getJITType() != JITCode::InterpreterThunk) {
+                ASSERT(getJITType() == JITCode::BaselineJIT);
+                return false;
+            }
+#if ENABLE(JIT)
+            jitCompileImpl(globalData);
+            return true;
+#else
+            UNUSED_PARAM(globalData);
+            return false;
+#endif
+        }
         virtual CodeBlock* replacement() = 0;
 
         enum CompileWithDFGState {
@@ -395,13 +407,13 @@ namespace JSC {
 
         bool hasOptimizedReplacement()
         {
-            ASSERT(getJITType() == JITCode::BaselineJIT);
+            ASSERT(JITCode::isBaselineCode(getJITType()));
             bool result = replacement()->getJITType() > getJITType();
 #if !ASSERT_DISABLED
             if (result)
                 ASSERT(replacement()->getJITType() == JITCode::DFGJIT);
             else {
-                ASSERT(replacement()->getJITType() == JITCode::BaselineJIT);
+                ASSERT(JITCode::isBaselineCode(replacement()->getJITType()));
                 ASSERT(replacement() == this);
             }
 #endif
@@ -460,18 +472,21 @@ namespace JSC {
 
         void clearEvalCache();
 
-#if ENABLE(INTERPRETER)
         void addPropertyAccessInstruction(unsigned propertyAccessInstruction)
         {
-            if (!m_globalData->canUseJIT())
-                m_propertyAccessInstructions.append(propertyAccessInstruction);
+            m_propertyAccessInstructions.append(propertyAccessInstruction);
         }
         void addGlobalResolveInstruction(unsigned globalResolveInstruction)
         {
-            if (!m_globalData->canUseJIT())
-                m_globalResolveInstructions.append(globalResolveInstruction);
+            m_globalResolveInstructions.append(globalResolveInstruction);
         }
         bool hasGlobalResolveInstructionAtBytecodeOffset(unsigned bytecodeOffset);
+#if ENABLE(LLINT)
+        LLIntCallLinkInfo* addLLIntCallLinkInfo()
+        {
+            m_llintCallLinkInfos.append(LLIntCallLinkInfo());
+            return &m_llintCallLinkInfos.last();
+        }
 #endif
 #if ENABLE(JIT)
         void setNumberOfStructureStubInfos(size_t size) { m_structureStubInfos.grow(size); }
@@ -480,8 +495,7 @@ namespace JSC {
 
         void addGlobalResolveInfo(unsigned globalResolveInstruction)
         {
-            if (m_globalData->canUseJIT())
-                m_globalResolveInfos.append(GlobalResolveInfo(globalResolveInstruction));
+            m_globalResolveInfos.append(GlobalResolveInfo(globalResolveInstruction));
         }
         GlobalResolveInfo& globalResolveInfo(int index) { return m_globalResolveInfos[index]; }
         bool hasGlobalResolveInfoAtBytecodeOffset(unsigned bytecodeOffset);
@@ -492,6 +506,7 @@ namespace JSC {
 
         void addMethodCallLinkInfos(unsigned n) { ASSERT(m_globalData->canUseJIT()); m_methodCallLinkInfos.grow(n); }
         MethodCallLinkInfo& methodCallLinkInfo(int index) { return m_methodCallLinkInfos[index]; }
+        size_t numberOfMethodCallLinkInfos() { return m_methodCallLinkInfos.size(); }
 #endif
         
 #if ENABLE(VALUE_PROFILER)
@@ -533,6 +548,10 @@ namespace JSC {
                                    bytecodeOffset].u.opcode)) - 1].u.profile == result);
             return result;
         }
+        PredictedType valueProfilePredictionForBytecodeOffset(int bytecodeOffset)
+        {
+            return valueProfileForBytecodeOffset(bytecodeOffset)->computeUpdatedPrediction();
+        }
         
         unsigned totalNumberOfValueProfiles()
         {
@@ -559,12 +578,16 @@ namespace JSC {
         
         bool likelyToTakeSlowCase(int bytecodeOffset)
         {
+            if (!numberOfRareCaseProfiles())
+                return false;
             unsigned value = rareCaseProfileForBytecodeOffset(bytecodeOffset)->m_counter;
             return value >= Options::likelyToTakeSlowCaseMinimumCount && static_cast<double>(value) / m_executionEntryCount >= Options::likelyToTakeSlowCaseThreshold;
         }
         
         bool couldTakeSlowCase(int bytecodeOffset)
         {
+            if (!numberOfRareCaseProfiles())
+                return false;
             unsigned value = rareCaseProfileForBytecodeOffset(bytecodeOffset)->m_counter;
             return value >= Options::couldTakeSlowCaseMinimumCount && static_cast<double>(value) / m_executionEntryCount >= Options::couldTakeSlowCaseThreshold;
         }
@@ -583,12 +606,16 @@ namespace JSC {
         
         bool likelyToTakeSpecialFastCase(int bytecodeOffset)
         {
+            if (!numberOfRareCaseProfiles())
+                return false;
             unsigned specialFastCaseCount = specialFastCaseProfileForBytecodeOffset(bytecodeOffset)->m_counter;
             return specialFastCaseCount >= Options::likelyToTakeSlowCaseMinimumCount && static_cast<double>(specialFastCaseCount) / m_executionEntryCount >= Options::likelyToTakeSlowCaseThreshold;
         }
         
         bool likelyToTakeDeepestSlowCase(int bytecodeOffset)
         {
+            if (!numberOfRareCaseProfiles())
+                return false;
             unsigned slowCaseCount = rareCaseProfileForBytecodeOffset(bytecodeOffset)->m_counter;
             unsigned specialFastCaseCount = specialFastCaseProfileForBytecodeOffset(bytecodeOffset)->m_counter;
             unsigned value = slowCaseCount - specialFastCaseCount;
@@ -597,6 +624,8 @@ namespace JSC {
         
         bool likelyToTakeAnySlowCase(int bytecodeOffset)
         {
+            if (!numberOfRareCaseProfiles())
+                return false;
             unsigned slowCaseCount = rareCaseProfileForBytecodeOffset(bytecodeOffset)->m_counter;
             unsigned specialFastCaseCount = specialFastCaseProfileForBytecodeOffset(bytecodeOffset)->m_counter;
             unsigned value = slowCaseCount + specialFastCaseCount;
@@ -694,11 +723,16 @@ namespace JSC {
         
         bool addFrequentExitSite(const DFG::FrequentExitSite& site)
         {
-            ASSERT(getJITType() == JITCode::BaselineJIT);
+            ASSERT(JITCode::isBaselineCode(getJITType()));
             return m_exitProfile.add(site);
         }
 
         DFG::ExitProfile& exitProfile() { return m_exitProfile; }
+        
+        CompressedLazyOperandValueProfileHolder& lazyOperandValueProfiles()
+        {
+            return m_lazyOperandValueProfiles;
+        }
 #endif
 
         // Constant Pool
@@ -802,6 +836,29 @@ namespace JSC {
         void copyPostParseDataFrom(CodeBlock* alternative);
         void copyPostParseDataFromAlternative();
         
+        // Functions for controlling when JITting kicks in, in a mixed mode
+        // execution world.
+        
+        void dontJITAnytimeSoon()
+        {
+            m_llintExecuteCounter = Options::executionCounterValueForDontJITAnytimeSoon;
+        }
+        
+        void jitAfterWarmUp()
+        {
+            m_llintExecuteCounter = Options::executionCounterValueForJITAfterWarmUp;
+        }
+        
+        void jitSoon()
+        {
+            m_llintExecuteCounter = Options::executionCounterValueForJITSoon;
+        }
+        
+        int32_t llintExecuteCounter() const
+        {
+            return m_llintExecuteCounter;
+        }
+        
         // Functions for controlling when tiered compilation kicks in. This
         // controls both when the optimizing compiler is invoked and when OSR
         // entry happens. Two triggers exist: the loop trigger and the return
@@ -994,6 +1051,9 @@ namespace JSC {
         bool m_shouldDiscardBytecode;
 
     protected:
+#if ENABLE(JIT)
+        virtual void jitCompileImpl(JSGlobalData&) = 0;
+#endif
         virtual void visitWeakReferences(SlotVisitor&);
         virtual void finalizeUnconditionally();
         
@@ -1075,9 +1135,11 @@ namespace JSC {
         RefPtr<SourceProvider> m_source;
         unsigned m_sourceOffset;
 
-#if ENABLE(INTERPRETER)
         Vector<unsigned> m_propertyAccessInstructions;
         Vector<unsigned> m_globalResolveInstructions;
+#if ENABLE(LLINT)
+        SegmentedVector<LLIntCallLinkInfo, 8> m_llintCallLinkInfos;
+        SentinelLinkedList<LLIntCallLinkInfo, BasicRawSentinelNode<LLIntCallLinkInfo> > m_incomingLLIntCalls;
 #endif
 #if ENABLE(JIT)
         Vector<StructureStubInfo> m_structureStubInfos;
@@ -1088,9 +1150,10 @@ namespace JSC {
         MacroAssemblerCodePtr m_jitCodeWithArityCheck;
         SentinelLinkedList<CallLinkInfo, BasicRawSentinelNode<CallLinkInfo> > m_incomingCalls;
 #endif
-#if ENABLE(DFG_JIT)
+#if ENABLE(DFG_JIT) || ENABLE(LLINT)
         OwnPtr<CompactJITCodeMap> m_jitCodeMap;
-        
+#endif
+#if ENABLE(DFG_JIT)
         struct WeakReferenceTransition {
             WeakReferenceTransition() { }
             
@@ -1130,6 +1193,7 @@ namespace JSC {
         // This is relevant to non-DFG code blocks that serve as the profiled code block
         // for DFG code blocks.
         DFG::ExitProfile m_exitProfile;
+        CompressedLazyOperandValueProfileHolder m_lazyOperandValueProfiles;
 #endif
 #if ENABLE(VALUE_PROFILER)
         Vector<ValueProfile> m_argumentValueProfiles;
@@ -1153,12 +1217,14 @@ namespace JSC {
 
         OwnPtr<CodeBlock> m_alternative;
         
+        int32_t m_llintExecuteCounter;
+        
         int32_t m_jitExecuteCounter;
         uint32_t m_speculativeSuccessCounter;
         uint32_t m_speculativeFailCounter;
         uint8_t m_optimizationDelayCounter;
         uint8_t m_reoptimizationRetryCounter;
-
+        
         struct RareData {
            WTF_MAKE_FAST_ALLOCATED;
         public:
@@ -1234,6 +1300,7 @@ namespace JSC {
     protected:
         virtual JSObject* compileOptimized(ExecState*, ScopeChainNode*);
         virtual void jettison();
+        virtual void jitCompileImpl(JSGlobalData&);
         virtual CodeBlock* replacement();
         virtual bool canCompileWithDFGInternal();
 #endif
@@ -1268,6 +1335,7 @@ namespace JSC {
     protected:
         virtual JSObject* compileOptimized(ExecState*, ScopeChainNode*);
         virtual void jettison();
+        virtual void jitCompileImpl(JSGlobalData&);
         virtual CodeBlock* replacement();
         virtual bool canCompileWithDFGInternal();
 #endif
@@ -1305,6 +1373,7 @@ namespace JSC {
     protected:
         virtual JSObject* compileOptimized(ExecState*, ScopeChainNode*);
         virtual void jettison();
+        virtual void jitCompileImpl(JSGlobalData&);
         virtual CodeBlock* replacement();
         virtual bool canCompileWithDFGInternal();
 #endif
@@ -1331,6 +1400,17 @@ namespace JSC {
         bool m_oldValueOfShouldDiscardBytecode;
     };
 
+    inline CodeBlock* baselineCodeBlockForOriginAndBaselineCodeBlock(const CodeOrigin& codeOrigin, CodeBlock* baselineCodeBlock)
+    {
+        if (codeOrigin.inlineCallFrame) {
+            ExecutableBase* executable = codeOrigin.inlineCallFrame->executable.get();
+            ASSERT(executable->structure()->classInfo() == &FunctionExecutable::s_info);
+            return static_cast<FunctionExecutable*>(executable)->baselineCodeBlockFor(codeOrigin.inlineCallFrame->isCall ? CodeForCall : CodeForConstruct);
+        }
+        return baselineCodeBlock;
+    }
+    
+
     inline Register& ExecState::r(int index)
     {
         CodeBlock* codeBlock = this->codeBlock();
diff --git a/Source/JavaScriptCore/bytecode/GetByIdStatus.cpp b/Source/JavaScriptCore/bytecode/GetByIdStatus.cpp
index 5eff1d4a0..11aead3df 100644
--- a/Source/JavaScriptCore/bytecode/GetByIdStatus.cpp
+++ b/Source/JavaScriptCore/bytecode/GetByIdStatus.cpp
@@ -27,20 +27,49 @@
 #include "GetByIdStatus.h"
 
 #include "CodeBlock.h"
+#include "LowLevelInterpreter.h"
 
 namespace JSC {
 
+GetByIdStatus GetByIdStatus::computeFromLLInt(CodeBlock* profiledBlock, unsigned bytecodeIndex, Identifier& ident)
+{
+    UNUSED_PARAM(profiledBlock);
+    UNUSED_PARAM(bytecodeIndex);
+    UNUSED_PARAM(ident);
+#if ENABLE(LLINT)
+    Instruction* instruction = profiledBlock->instructions().begin() + bytecodeIndex;
+    
+    if (instruction[0].u.opcode == llint_op_method_check)
+        instruction++;
+
+    Structure* structure = instruction[4].u.structure.get();
+    if (!structure)
+        return GetByIdStatus(NoInformation, StructureSet(), notFound, false);
+    
+    size_t offset = structure->get(*profiledBlock->globalData(), ident);
+    if (offset == notFound)
+        return GetByIdStatus(NoInformation, StructureSet(), notFound, false);
+    
+    return GetByIdStatus(SimpleDirect, StructureSet(structure), offset, false);
+#else
+    return GetByIdStatus(NoInformation, StructureSet(), notFound, false);
+#endif
+}
+
 GetByIdStatus GetByIdStatus::computeFor(CodeBlock* profiledBlock, unsigned bytecodeIndex, Identifier& ident)
 {
     UNUSED_PARAM(profiledBlock);
     UNUSED_PARAM(bytecodeIndex);
     UNUSED_PARAM(ident);
 #if ENABLE(JIT) && ENABLE(VALUE_PROFILER)
+    if (!profiledBlock->numberOfStructureStubInfos())
+        return computeFromLLInt(profiledBlock, bytecodeIndex, ident);
+    
     // First check if it makes either calls, in which case we want to be super careful, or
     // if it's not set at all, in which case we punt.
     StructureStubInfo& stubInfo = profiledBlock->getStubInfo(bytecodeIndex);
     if (!stubInfo.seen)
-        return GetByIdStatus(NoInformation, StructureSet(), notFound);
+        return computeFromLLInt(profiledBlock, bytecodeIndex, ident);
     
     PolymorphicAccessStructureList* list;
     int listSize;
@@ -60,18 +89,19 @@ GetByIdStatus GetByIdStatus::computeFor(CodeBlock* profiledBlock, unsigned bytec
     }
     for (int i = 0; i < listSize; ++i) {
         if (!list->list[i].isDirect)
-            return GetByIdStatus(MakesCalls, StructureSet(), notFound);
+            return GetByIdStatus(MakesCalls, StructureSet(), notFound, true);
     }
     
     // Next check if it takes slow case, in which case we want to be kind of careful.
     if (profiledBlock->likelyToTakeSlowCase(bytecodeIndex))
-        return GetByIdStatus(TakesSlowPath, StructureSet(), notFound);
+        return GetByIdStatus(TakesSlowPath, StructureSet(), notFound, true);
     
     // Finally figure out if we can derive an access strategy.
     GetByIdStatus result;
+    result.m_wasSeenInJIT = true;
     switch (stubInfo.accessType) {
     case access_unset:
-        return GetByIdStatus(NoInformation, StructureSet(), notFound);
+        return computeFromLLInt(profiledBlock, bytecodeIndex, ident);
         
     case access_get_by_id_self: {
         Structure* structure = stubInfo.u.getByIdSelf.baseObjectStructure.get();
@@ -130,7 +160,7 @@ GetByIdStatus GetByIdStatus::computeFor(CodeBlock* profiledBlock, unsigned bytec
     
     return result;
 #else // ENABLE(JIT)
-    return GetByIdStatus(NoInformation, StructureSet(), notFound);
+    return GetByIdStatus(NoInformation, StructureSet(), notFound, false);
 #endif // ENABLE(JIT)
 }
 
diff --git a/Source/JavaScriptCore/bytecode/GetByIdStatus.h b/Source/JavaScriptCore/bytecode/GetByIdStatus.h
index 00e50e76d..39476c009 100644
--- a/Source/JavaScriptCore/bytecode/GetByIdStatus.h
+++ b/Source/JavaScriptCore/bytecode/GetByIdStatus.h
@@ -49,10 +49,11 @@ public:
     {
     }
     
-    GetByIdStatus(State state, const StructureSet& structureSet, size_t offset)
+    GetByIdStatus(State state, const StructureSet& structureSet, size_t offset, bool wasSeenInJIT)
         : m_state(state)
         , m_structureSet(structureSet)
         , m_offset(offset)
+        , m_wasSeenInJIT(wasSeenInJIT)
     {
         ASSERT((state == SimpleDirect) == (offset != notFound));
     }
@@ -70,10 +71,15 @@ public:
     const StructureSet& structureSet() const { return m_structureSet; }
     size_t offset() const { return m_offset; }
     
+    bool wasSeenInJIT() const { return m_wasSeenInJIT; }
+    
 private:
+    static GetByIdStatus computeFromLLInt(CodeBlock*, unsigned bytecodeIndex, Identifier&);
+    
     State m_state;
     StructureSet m_structureSet;
     size_t m_offset;
+    bool m_wasSeenInJIT;
 };
 
 } // namespace JSC
diff --git a/Source/JavaScriptCore/bytecode/Instruction.h b/Source/JavaScriptCore/bytecode/Instruction.h
index 92118eeb2..c4989d2db 100644
--- a/Source/JavaScriptCore/bytecode/Instruction.h
+++ b/Source/JavaScriptCore/bytecode/Instruction.h
@@ -48,6 +48,7 @@ namespace JSC {
     class JSCell;
     class Structure;
     class StructureChain;
+    struct LLIntCallLinkInfo;
     struct ValueProfile;
 
 #if ENABLE(JIT)
@@ -146,9 +147,14 @@ namespace JSC {
 #endif
 
     struct Instruction {
+        Instruction()
+        {
+            u.jsCell.clear();
+        }
+        
         Instruction(Opcode opcode)
         {
-#if !ENABLE(COMPUTED_GOTO_INTERPRETER)
+#if !ENABLE(COMPUTED_GOTO_CLASSIC_INTERPRETER)
             // We have to initialize one of the pointer members to ensure that
             // the entire struct is initialized, when opcode is not a pointer.
             u.jsCell.clear();
@@ -182,6 +188,8 @@ namespace JSC {
 
         Instruction(PropertySlot::GetValueFunc getterFunc) { u.getterFunc = getterFunc; }
         
+        Instruction(LLIntCallLinkInfo* callLinkInfo) { u.callLinkInfo = callLinkInfo; }
+        
         Instruction(ValueProfile* profile) { u.profile = profile; }
 
         union {
@@ -191,7 +199,9 @@ namespace JSC {
             WriteBarrierBase<StructureChain> structureChain;
             WriteBarrierBase<JSCell> jsCell;
             PropertySlot::GetValueFunc getterFunc;
+            LLIntCallLinkInfo* callLinkInfo;
             ValueProfile* profile;
+            void* pointer;
         } u;
         
     private:
diff --git a/Source/JavaScriptCore/bytecode/LLIntCallLinkInfo.h b/Source/JavaScriptCore/bytecode/LLIntCallLinkInfo.h
new file mode 100644
index 000000000..bfb951018
--- /dev/null
+++ b/Source/JavaScriptCore/bytecode/LLIntCallLinkInfo.h
@@ -0,0 +1,66 @@
+/*
+ * Copyright (C) 2012 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef LLIntCallLinkInfo_h
+#define LLIntCallLinkInfo_h
+
+#include "JSFunction.h"
+#include "MacroAssemblerCodeRef.h"
+#include <wtf/SentinelLinkedList.h>
+
+namespace JSC {
+
+struct Instruction;
+
+struct LLIntCallLinkInfo : public BasicRawSentinelNode<LLIntCallLinkInfo> {
+    LLIntCallLinkInfo()
+    {
+    }
+    
+    ~LLIntCallLinkInfo()
+    {
+        if (isOnList())
+            remove();
+    }
+    
+    bool isLinked() { return callee; }
+    
+    void unlink()
+    {
+        callee.clear();
+        machineCodeTarget = MacroAssemblerCodePtr();
+        if (isOnList())
+            remove();
+    }
+    
+    WriteBarrier<JSFunction> callee;
+    WriteBarrier<JSFunction> lastSeenCallee;
+    MacroAssemblerCodePtr machineCodeTarget;
+};
+
+} // namespace JSC
+
+#endif // LLIntCallLinkInfo_h
+
diff --git a/Source/JavaScriptCore/bytecode/LazyOperandValueProfile.cpp b/Source/JavaScriptCore/bytecode/LazyOperandValueProfile.cpp
new file mode 100644
index 000000000..f199b6923
--- /dev/null
+++ b/Source/JavaScriptCore/bytecode/LazyOperandValueProfile.cpp
@@ -0,0 +1,100 @@
+/*
+ * Copyright (C) 2012 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "LazyOperandValueProfile.h"
+
+#if ENABLE(VALUE_PROFILER)
+
+namespace JSC {
+
+CompressedLazyOperandValueProfileHolder::CompressedLazyOperandValueProfileHolder() { }
+CompressedLazyOperandValueProfileHolder::~CompressedLazyOperandValueProfileHolder() { }
+
+void CompressedLazyOperandValueProfileHolder::computeUpdatedPredictions()
+{
+    if (!m_data)
+        return;
+    
+    for (unsigned i = 0; i < m_data->size(); ++i)
+        m_data->at(i).computeUpdatedPrediction();
+}
+
+LazyOperandValueProfile* CompressedLazyOperandValueProfileHolder::add(
+    const LazyOperandValueProfileKey& key)
+{
+    if (!m_data)
+        m_data = adoptPtr(new LazyOperandValueProfile::List());
+    else {
+        for (unsigned i = 0; i < m_data->size(); ++i) {
+            if (m_data->at(i).key() == key)
+                return &m_data->at(i);
+        }
+    }
+    
+    m_data->append(LazyOperandValueProfile(key));
+    return &m_data->last();
+}
+
+LazyOperandValueProfileParser::LazyOperandValueProfileParser(
+    CompressedLazyOperandValueProfileHolder& holder)
+    : m_holder(holder)
+{
+    if (!m_holder.m_data)
+        return;
+    
+    LazyOperandValueProfile::List& data = *m_holder.m_data;
+    for (unsigned i = 0; i < data.size(); ++i)
+        m_map.add(data[i].key(), &data[i]);
+}
+
+LazyOperandValueProfileParser::~LazyOperandValueProfileParser() { }
+
+LazyOperandValueProfile* LazyOperandValueProfileParser::getIfPresent(
+    const LazyOperandValueProfileKey& key) const
+{
+    HashMap<LazyOperandValueProfileKey, LazyOperandValueProfile*>::const_iterator iter =
+        m_map.find(key);
+    
+    if (iter == m_map.end())
+        return 0;
+    
+    return iter->second;
+}
+
+PredictedType LazyOperandValueProfileParser::prediction(
+    const LazyOperandValueProfileKey& key) const
+{
+    LazyOperandValueProfile* profile = getIfPresent(key);
+    if (!profile)
+        return PredictNone;
+    
+    return profile->computeUpdatedPrediction();
+}
+
+} // namespace JSC
+
+#endif // ENABLE(VALUE_PROFILER)
+
diff --git a/Source/JavaScriptCore/bytecode/LazyOperandValueProfile.h b/Source/JavaScriptCore/bytecode/LazyOperandValueProfile.h
new file mode 100644
index 000000000..d0260f991
--- /dev/null
+++ b/Source/JavaScriptCore/bytecode/LazyOperandValueProfile.h
@@ -0,0 +1,189 @@
+/*
+ * Copyright (C) 2012 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef LazyOperandValueProfile_h
+#define LazyOperandValueProfile_h
+
+#include <wtf/Platform.h>
+
+#if ENABLE(VALUE_PROFILER)
+
+#include "ValueProfile.h"
+#include <wtf/HashMap.h>
+#include <wtf/Noncopyable.h>
+#include <wtf/OwnPtr.h>
+#include <wtf/SegmentedVector.h>
+
+namespace JSC {
+
+class ScriptExecutable;
+
+class LazyOperandValueProfileKey {
+public:
+    LazyOperandValueProfileKey()
+        : m_bytecodeOffset(0) // 0 = empty value
+        , m_operand(-1) // not a valid operand index in our current scheme
+    {
+    }
+    
+    LazyOperandValueProfileKey(WTF::HashTableDeletedValueType)
+        : m_bytecodeOffset(1) // 1 = deleted value
+        , m_operand(-1) // not a valid operand index in our current scheme
+    {
+    }
+    
+    LazyOperandValueProfileKey(unsigned bytecodeOffset, int operand)
+        : m_bytecodeOffset(bytecodeOffset)
+        , m_operand(operand)
+    {
+        ASSERT(operand != -1);
+    }
+    
+    bool operator!() const
+    {
+        return m_operand == -1;
+    }
+    
+    bool operator==(const LazyOperandValueProfileKey& other) const
+    {
+        return m_bytecodeOffset == other.m_bytecodeOffset
+            && m_operand == other.m_operand;
+    }
+    
+    unsigned hash() const
+    {
+        return WTF::intHash(m_bytecodeOffset) + m_operand;
+    }
+    
+    unsigned bytecodeOffset() const
+    {
+        ASSERT(!!*this);
+        return m_bytecodeOffset;
+    }
+    int operand() const
+    {
+        ASSERT(!!*this);
+        return m_operand;
+    }
+    
+    bool isHashTableDeletedValue() const
+    {
+        return m_operand == -1 && m_bytecodeOffset;
+    }
+private: 
+    unsigned m_bytecodeOffset;
+    int m_operand;
+};
+
+struct LazyOperandValueProfileKeyHash {
+    static unsigned hash(const LazyOperandValueProfileKey& key) { return key.hash(); }
+    static bool equal(
+        const LazyOperandValueProfileKey& a,
+        const LazyOperandValueProfileKey& b) { return a == b; }
+    static const bool safeToCompareToEmptyOrDeleted = true;
+};
+
+} // namespace JSC
+
+namespace WTF {
+
+template<typename T> struct DefaultHash;
+template<> struct DefaultHash<JSC::LazyOperandValueProfileKey> {
+    typedef JSC::LazyOperandValueProfileKeyHash Hash;
+};
+
+template<typename T> struct HashTraits;
+template<> struct HashTraits<JSC::LazyOperandValueProfileKey> : public GenericHashTraits<JSC::LazyOperandValueProfileKey> {
+    static void constructDeletedValue(JSC::LazyOperandValueProfileKey& slot) { new (NotNull, &slot) JSC::LazyOperandValueProfileKey(HashTableDeletedValue); }
+    static bool isDeletedValue(const JSC::LazyOperandValueProfileKey& value) { return value.isHashTableDeletedValue(); }
+};
+
+} // namespace WTF
+
+namespace JSC {
+
+struct LazyOperandValueProfile : public MinimalValueProfile {
+    LazyOperandValueProfile()
+        : MinimalValueProfile()
+        , m_operand(-1)
+    {
+    }
+    
+    explicit LazyOperandValueProfile(const LazyOperandValueProfileKey& key)
+        : MinimalValueProfile(key.bytecodeOffset())
+        , m_operand(key.operand())
+    {
+    }
+    
+    LazyOperandValueProfileKey key() const
+    {
+        return LazyOperandValueProfileKey(m_bytecodeOffset, m_operand);
+    }
+    
+    int m_operand;
+    
+    typedef SegmentedVector<LazyOperandValueProfile, 8> List;
+};
+
+class LazyOperandValueProfileParser;
+
+class CompressedLazyOperandValueProfileHolder {
+    WTF_MAKE_NONCOPYABLE(CompressedLazyOperandValueProfileHolder);
+public:
+    CompressedLazyOperandValueProfileHolder();
+    ~CompressedLazyOperandValueProfileHolder();
+    
+    void computeUpdatedPredictions();
+    
+    LazyOperandValueProfile* add(const LazyOperandValueProfileKey& key);
+    
+private:
+    friend class LazyOperandValueProfileParser;
+    OwnPtr<LazyOperandValueProfile::List> m_data;
+};
+
+class LazyOperandValueProfileParser {
+    WTF_MAKE_NONCOPYABLE(LazyOperandValueProfileParser);
+public:
+    explicit LazyOperandValueProfileParser(
+        CompressedLazyOperandValueProfileHolder& holder);
+    ~LazyOperandValueProfileParser();
+    
+    LazyOperandValueProfile* getIfPresent(
+        const LazyOperandValueProfileKey& key) const;
+    
+    PredictedType prediction(const LazyOperandValueProfileKey& key) const;
+private:
+    CompressedLazyOperandValueProfileHolder& m_holder;
+    HashMap<LazyOperandValueProfileKey, LazyOperandValueProfile*> m_map;
+};
+
+} // namespace JSC
+
+#endif // ENABLE(VALUE_PROFILER)
+
+#endif // LazyOperandValueProfile_h
+
+
diff --git a/Source/JavaScriptCore/bytecode/MethodCallLinkStatus.cpp b/Source/JavaScriptCore/bytecode/MethodCallLinkStatus.cpp
index e7d721c29..795b41b69 100644
--- a/Source/JavaScriptCore/bytecode/MethodCallLinkStatus.cpp
+++ b/Source/JavaScriptCore/bytecode/MethodCallLinkStatus.cpp
@@ -35,6 +35,11 @@ MethodCallLinkStatus MethodCallLinkStatus::computeFor(CodeBlock* profiledBlock,
     UNUSED_PARAM(profiledBlock);
     UNUSED_PARAM(bytecodeIndex);
 #if ENABLE(JIT) && ENABLE(VALUE_PROFILER)
+    // NOTE: This does not have an LLInt fall-back because LLInt does not do any method
+    // call link caching.
+    if (!profiledBlock->numberOfMethodCallLinkInfos())
+        return MethodCallLinkStatus();
+    
     MethodCallLinkInfo& methodCall = profiledBlock->getMethodCallLinkInfo(bytecodeIndex);
     
     if (!methodCall.seen || !methodCall.cachedStructure)
diff --git a/Source/JavaScriptCore/bytecode/MethodOfGettingAValueProfile.cpp b/Source/JavaScriptCore/bytecode/MethodOfGettingAValueProfile.cpp
new file mode 100644
index 000000000..857ed9c87
--- /dev/null
+++ b/Source/JavaScriptCore/bytecode/MethodOfGettingAValueProfile.cpp
@@ -0,0 +1,69 @@
+/*
+ * Copyright (C) 2012 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "MethodOfGettingAValueProfile.h"
+
+#if ENABLE(DFG_JIT)
+
+#include "CodeBlock.h"
+
+namespace JSC {
+
+MethodOfGettingAValueProfile MethodOfGettingAValueProfile::fromLazyOperand(
+    CodeBlock* codeBlock, const LazyOperandValueProfileKey& key)
+{
+    MethodOfGettingAValueProfile result;
+    result.m_kind = LazyOperand;
+    result.u.lazyOperand.codeBlock = codeBlock;
+    result.u.lazyOperand.bytecodeOffset = key.bytecodeOffset();
+    result.u.lazyOperand.operand = key.operand();
+    return result;
+}
+
+EncodedJSValue* MethodOfGettingAValueProfile::getSpecFailBucket(unsigned index) const
+{
+    switch (m_kind) {
+    case None:
+        return 0;
+        
+    case Ready:
+        return u.profile->specFailBucket(index);
+        
+    case LazyOperand:
+        return u.lazyOperand.codeBlock->lazyOperandValueProfiles().add(
+            LazyOperandValueProfileKey(
+                u.lazyOperand.bytecodeOffset, u.lazyOperand.operand))->specFailBucket(index);
+        
+    default:
+        ASSERT_NOT_REACHED();
+        return 0;
+    }
+}
+
+} // namespace JSC
+
+#endif // ENABLE(DFG_JIT)
+
diff --git a/Source/JavaScriptCore/bytecode/MethodOfGettingAValueProfile.h b/Source/JavaScriptCore/bytecode/MethodOfGettingAValueProfile.h
new file mode 100644
index 000000000..0f5c2be7b
--- /dev/null
+++ b/Source/JavaScriptCore/bytecode/MethodOfGettingAValueProfile.h
@@ -0,0 +1,99 @@
+/*
+ * Copyright (C) 2012 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef MethodOfGettingAValueProfile_h
+#define MethodOfGettingAValueProfile_h
+
+#include <wtf/Platform.h>
+
+// This is guarded by ENABLE_DFG_JIT only because it uses some value profiles
+// that are currently only used if the DFG is enabled (i.e. they are not
+// available in the profile-only configuration). Hopefully someday all of
+// these #if's will disappear...
+#if ENABLE(DFG_JIT)
+
+#include "JSValue.h"
+
+namespace JSC {
+
+class CodeBlock;
+class LazyOperandValueProfileKey;
+struct ValueProfile;
+
+class MethodOfGettingAValueProfile {
+public:
+    MethodOfGettingAValueProfile()
+        : m_kind(None)
+    {
+    }
+    
+    explicit MethodOfGettingAValueProfile(ValueProfile* profile)
+    {
+        if (profile) {
+            m_kind = Ready;
+            u.profile = profile;
+        } else
+            m_kind = None;
+    }
+    
+    static MethodOfGettingAValueProfile fromLazyOperand(
+        CodeBlock*, const LazyOperandValueProfileKey&);
+    
+    bool operator!() const { return m_kind == None; }
+    
+    // This logically has a pointer to a "There exists X such that
+    // ValueProfileBase<X>". But since C++ does not have existential
+    // templates, I cannot return it. So instead, for any methods that
+    // users of this class would like to call, we'll just have to provide
+    // a method here that does it through an indirection. Or we could
+    // possibly just make ValueProfile less template-based. But last I
+    // tried that, it felt more yucky than this class.
+    
+    EncodedJSValue* getSpecFailBucket(unsigned index) const;
+    
+private:
+    enum Kind {
+        None,
+        Ready,
+        LazyOperand
+    };
+    
+    Kind m_kind;
+    union {
+        ValueProfile* profile;
+        struct {
+            CodeBlock* codeBlock;
+            unsigned bytecodeOffset;
+            int operand;
+        } lazyOperand;
+    } u;
+};
+
+} // namespace JSC
+
+#endif // ENABLE(DFG_JIT)
+
+#endif // MethodOfGettingAValueProfile_h
+
diff --git a/Source/JavaScriptCore/bytecode/Opcode.cpp b/Source/JavaScriptCore/bytecode/Opcode.cpp
index 2490804cd..a27714026 100644
--- a/Source/JavaScriptCore/bytecode/Opcode.cpp
+++ b/Source/JavaScriptCore/bytecode/Opcode.cpp
@@ -39,16 +39,12 @@ using namespace std;
 
 namespace JSC {
 
-#if !defined(NDEBUG) || ENABLE(OPCODE_SAMPLING) || ENABLE(CODEBLOCK_SAMPLING) || ENABLE(OPCODE_STATS)
-
 const char* const opcodeNames[] = {
 #define OPCODE_NAME_ENTRY(opcode, size) #opcode,
     FOR_EACH_OPCODE_ID(OPCODE_NAME_ENTRY)
 #undef OPCODE_NAME_ENTRY
 };
 
-#endif
-
 #if ENABLE(OPCODE_STATS)
 
 long long OpcodeStats::opcodeCounts[numOpcodeIDs];
@@ -118,19 +114,19 @@ OpcodeStats::~OpcodeStats()
             *(currentPairIndex++) = make_pair(i, j);
     qsort(sortedPairIndices, numOpcodeIDs * numOpcodeIDs, sizeof(pair<int, int>), compareOpcodePairIndices);
     
-    printf("\nExecuted opcode statistics\n"); 
+    dataLog("\nExecuted opcode statistics\n"); 
     
-    printf("Total instructions executed: %lld\n\n", totalInstructions);
+    dataLog("Total instructions executed: %lld\n\n", totalInstructions);
 
-    printf("All opcodes by frequency:\n\n");
+    dataLog("All opcodes by frequency:\n\n");
 
     for (int i = 0; i < numOpcodeIDs; ++i) {
         int index = sortedIndices[i];
-        printf("%s:%s %lld - %.2f%%\n", opcodeNames[index], padOpcodeName((OpcodeID)index, 28), opcodeCounts[index], ((double) opcodeCounts[index]) / ((double) totalInstructions) * 100.0);    
+        dataLog("%s:%s %lld - %.2f%%\n", opcodeNames[index], padOpcodeName((OpcodeID)index, 28), opcodeCounts[index], ((double) opcodeCounts[index]) / ((double) totalInstructions) * 100.0);    
     }
     
-    printf("\n");
-    printf("2-opcode sequences by frequency: %lld\n\n", totalInstructions);
+    dataLog("\n");
+    dataLog("2-opcode sequences by frequency: %lld\n\n", totalInstructions);
     
     for (int i = 0; i < numOpcodeIDs * numOpcodeIDs; ++i) {
         pair<int, int> indexPair = sortedPairIndices[i];
@@ -139,11 +135,11 @@ OpcodeStats::~OpcodeStats()
         if (!count)
             break;
         
-        printf("%s%s %s:%s %lld %.2f%%\n", opcodeNames[indexPair.first], padOpcodeName((OpcodeID)indexPair.first, 28), opcodeNames[indexPair.second], padOpcodeName((OpcodeID)indexPair.second, 28), count, ((double) count) / ((double) totalInstructionPairs) * 100.0);
+        dataLog("%s%s %s:%s %lld %.2f%%\n", opcodeNames[indexPair.first], padOpcodeName((OpcodeID)indexPair.first, 28), opcodeNames[indexPair.second], padOpcodeName((OpcodeID)indexPair.second, 28), count, ((double) count) / ((double) totalInstructionPairs) * 100.0);
     }
     
-    printf("\n");
-    printf("Most common opcodes and sequences:\n");
+    dataLog("\n");
+    dataLog("Most common opcodes and sequences:\n");
 
     for (int i = 0; i < numOpcodeIDs; ++i) {
         int index = sortedIndices[i];
@@ -151,7 +147,7 @@ OpcodeStats::~OpcodeStats()
         double opcodeProportion = ((double) opcodeCount) / ((double) totalInstructions);
         if (opcodeProportion < 0.0001)
             break;
-        printf("\n%s:%s %lld - %.2f%%\n", opcodeNames[index], padOpcodeName((OpcodeID)index, 28), opcodeCount, opcodeProportion * 100.0);
+        dataLog("\n%s:%s %lld - %.2f%%\n", opcodeNames[index], padOpcodeName((OpcodeID)index, 28), opcodeCount, opcodeProportion * 100.0);
 
         for (int j = 0; j < numOpcodeIDs * numOpcodeIDs; ++j) {
             pair<int, int> indexPair = sortedPairIndices[j];
@@ -164,11 +160,11 @@ OpcodeStats::~OpcodeStats()
             if (indexPair.first != index && indexPair.second != index)
                 continue;
 
-            printf("    %s%s %s:%s %lld - %.2f%%\n", opcodeNames[indexPair.first], padOpcodeName((OpcodeID)indexPair.first, 28), opcodeNames[indexPair.second], padOpcodeName((OpcodeID)indexPair.second, 28), pairCount, pairProportion * 100.0);
+            dataLog("    %s%s %s:%s %lld - %.2f%%\n", opcodeNames[indexPair.first], padOpcodeName((OpcodeID)indexPair.first, 28), opcodeNames[indexPair.second], padOpcodeName((OpcodeID)indexPair.second, 28), pairCount, pairProportion * 100.0);
         }
         
     }
-    printf("\n");
+    dataLog("\n");
 }
 
 void OpcodeStats::recordInstruction(int opcode)
diff --git a/Source/JavaScriptCore/bytecode/Opcode.h b/Source/JavaScriptCore/bytecode/Opcode.h
index 57633a338..a47fa5e9b 100644
--- a/Source/JavaScriptCore/bytecode/Opcode.h
+++ b/Source/JavaScriptCore/bytecode/Opcode.h
@@ -123,6 +123,8 @@ namespace JSC {
         macro(op_get_arguments_length, 4) \
         macro(op_put_by_id, 9) \
         macro(op_put_by_id_transition, 9) \
+        macro(op_put_by_id_transition_direct, 9) \
+        macro(op_put_by_id_transition_normal, 9) \
         macro(op_put_by_id_replace, 9) \
         macro(op_put_by_id_generic, 9) \
         macro(op_del_by_id, 4) \
@@ -201,6 +203,7 @@ namespace JSC {
         typedef enum { FOR_EACH_OPCODE_ID(OPCODE_ID_ENUM) } OpcodeID;
     #undef OPCODE_ID_ENUM
 
+    const int maxOpcodeLength = 9;
     const int numOpcodeIDs = op_end + 1;
 
     #define OPCODE_ID_LENGTHS(id, length) const int id##_length = length;
@@ -217,7 +220,7 @@ namespace JSC {
         FOR_EACH_OPCODE_ID(VERIFY_OPCODE_ID);
     #undef VERIFY_OPCODE_ID
 
-#if ENABLE(COMPUTED_GOTO_INTERPRETER)
+#if ENABLE(COMPUTED_GOTO_CLASSIC_INTERPRETER) || ENABLE(LLINT)
 #if COMPILER(RVCT) || COMPILER(INTEL)
     typedef void* Opcode;
 #else
@@ -227,8 +230,6 @@ namespace JSC {
     typedef OpcodeID Opcode;
 #endif
 
-#if !defined(NDEBUG) || ENABLE(OPCODE_SAMPLING) || ENABLE(CODEBLOCK_SAMPLING) || ENABLE(OPCODE_STATS)
-
 #define PADDING_STRING "                                "
 #define PADDING_STRING_LENGTH static_cast<unsigned>(strlen(PADDING_STRING))
 
@@ -244,8 +245,6 @@ namespace JSC {
 #undef PADDING_STRING_LENGTH
 #undef PADDING_STRING
 
-#endif
-
 #if ENABLE(OPCODE_STATS)
 
     struct OpcodeStats {
diff --git a/Source/JavaScriptCore/bytecode/PolymorphicPutByIdList.cpp b/Source/JavaScriptCore/bytecode/PolymorphicPutByIdList.cpp
new file mode 100644
index 000000000..170615b73
--- /dev/null
+++ b/Source/JavaScriptCore/bytecode/PolymorphicPutByIdList.cpp
@@ -0,0 +1,148 @@
+/*
+ * Copyright (C) 2012 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "PolymorphicPutByIdList.h"
+
+#if ENABLE(JIT)
+
+#include "StructureStubInfo.h"
+
+namespace JSC {
+
+PutByIdAccess PutByIdAccess::fromStructureStubInfo(
+    StructureStubInfo& stubInfo,
+    MacroAssemblerCodePtr initialSlowPath)
+{
+    PutByIdAccess result;
+    
+    switch (stubInfo.accessType) {
+    case access_put_by_id_replace:
+        result.m_type = Replace;
+        result.m_oldStructure.copyFrom(stubInfo.u.putByIdReplace.baseObjectStructure);
+        result.m_stubRoutine = MacroAssemblerCodeRef::createSelfManagedCodeRef(initialSlowPath);
+        break;
+        
+    case access_put_by_id_transition_direct:
+    case access_put_by_id_transition_normal:
+        result.m_type = Transition;
+        result.m_oldStructure.copyFrom(stubInfo.u.putByIdTransition.previousStructure);
+        result.m_newStructure.copyFrom(stubInfo.u.putByIdTransition.structure);
+        result.m_chain.copyFrom(stubInfo.u.putByIdTransition.chain);
+        result.m_stubRoutine = stubInfo.stubRoutine;
+        break;
+        
+    default:
+        ASSERT_NOT_REACHED();
+    }
+    
+    return result;
+}
+
+bool PutByIdAccess::visitWeak() const
+{
+    switch (m_type) {
+    case Replace:
+        if (!Heap::isMarked(m_oldStructure.get()))
+            return false;
+        break;
+    case Transition:
+        if (!Heap::isMarked(m_oldStructure.get()))
+            return false;
+        if (!Heap::isMarked(m_newStructure.get()))
+            return false;
+        if (!Heap::isMarked(m_chain.get()))
+            return false;
+        break;
+    default:
+        ASSERT_NOT_REACHED();
+        return false;
+    }
+    return true;
+}
+
+PolymorphicPutByIdList::PolymorphicPutByIdList(
+    PutKind putKind,
+    StructureStubInfo& stubInfo,
+    MacroAssemblerCodePtr initialSlowPath)
+    : m_kind(putKind)
+{
+    m_list.append(PutByIdAccess::fromStructureStubInfo(stubInfo, initialSlowPath));
+}
+
+PolymorphicPutByIdList* PolymorphicPutByIdList::from(
+    PutKind putKind,
+    StructureStubInfo& stubInfo,
+    MacroAssemblerCodePtr initialSlowPath)
+{
+    if (stubInfo.accessType == access_put_by_id_list)
+        return stubInfo.u.putByIdList.list;
+    
+    ASSERT(stubInfo.accessType == access_put_by_id_replace
+           || stubInfo.accessType == access_put_by_id_transition_normal
+           || stubInfo.accessType == access_put_by_id_transition_direct);
+    
+    PolymorphicPutByIdList* result =
+        new PolymorphicPutByIdList(putKind, stubInfo, initialSlowPath);
+    
+    stubInfo.initPutByIdList(result);
+    
+    return result;
+}
+
+PolymorphicPutByIdList::~PolymorphicPutByIdList() { }
+
+bool PolymorphicPutByIdList::isFull() const
+{
+    ASSERT(size() <= POLYMORPHIC_LIST_CACHE_SIZE);
+    return size() == POLYMORPHIC_LIST_CACHE_SIZE;
+}
+
+bool PolymorphicPutByIdList::isAlmostFull() const
+{
+    ASSERT(size() <= POLYMORPHIC_LIST_CACHE_SIZE);
+    return size() >= POLYMORPHIC_LIST_CACHE_SIZE - 1;
+}
+
+void PolymorphicPutByIdList::addAccess(const PutByIdAccess& putByIdAccess)
+{
+    ASSERT(!isFull());
+    // Make sure that the resizing optimizes for space, not time.
+    m_list.resize(m_list.size() + 1);
+    m_list.last() = putByIdAccess;
+}
+
+bool PolymorphicPutByIdList::visitWeak() const
+{
+    for (unsigned i = 0; i < size(); ++i) {
+        if (!at(i).visitWeak())
+            return false;
+    }
+    return true;
+}
+
+} // namespace JSC
+
+#endif // ENABLE(JIT)
diff --git a/Source/JavaScriptCore/bytecode/PolymorphicPutByIdList.h b/Source/JavaScriptCore/bytecode/PolymorphicPutByIdList.h
new file mode 100644
index 000000000..60b632d52
--- /dev/null
+++ b/Source/JavaScriptCore/bytecode/PolymorphicPutByIdList.h
@@ -0,0 +1,190 @@
+/*
+ * Copyright (C) 2012 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef PolymorphicPutByIdList_h
+#define PolymorphicPutByIdList_h
+
+#include <wtf/Platform.h>
+
+#if ENABLE(JIT)
+
+#include "CodeOrigin.h"
+#include "MacroAssembler.h"
+#include "Opcode.h"
+#include "PutKind.h"
+#include "Structure.h"
+#include <wtf/Vector.h>
+
+namespace JSC {
+
+struct StructureStubInfo;
+
+class PutByIdAccess {
+public:
+    enum AccessType {
+        Invalid,
+        Transition,
+        Replace
+    };
+    
+    PutByIdAccess()
+        : m_type(Invalid)
+    {
+    }
+    
+    static PutByIdAccess transition(
+        JSGlobalData& globalData,
+        JSCell* owner,
+        Structure* oldStructure,
+        Structure* newStructure,
+        StructureChain* chain,
+        MacroAssemblerCodeRef stubRoutine)
+    {
+        PutByIdAccess result;
+        result.m_type = Transition;
+        result.m_oldStructure.set(globalData, owner, oldStructure);
+        result.m_newStructure.set(globalData, owner, newStructure);
+        result.m_chain.set(globalData, owner, chain);
+        result.m_stubRoutine = stubRoutine;
+        return result;
+    }
+    
+    static PutByIdAccess replace(
+        JSGlobalData& globalData,
+        JSCell* owner,
+        Structure* structure,
+        MacroAssemblerCodeRef stubRoutine)
+    {
+        PutByIdAccess result;
+        result.m_type = Replace;
+        result.m_oldStructure.set(globalData, owner, structure);
+        result.m_stubRoutine = stubRoutine;
+        return result;
+    }
+    
+    static PutByIdAccess fromStructureStubInfo(
+        StructureStubInfo&,
+        MacroAssemblerCodePtr initialSlowPath);
+    
+    bool isSet() const { return m_type != Invalid; }
+    bool operator!() const { return !isSet(); }
+    
+    AccessType type() const { return m_type; }
+    
+    bool isTransition() const { return m_type == Transition; }
+    bool isReplace() const { return m_type == Replace; }
+    
+    Structure* oldStructure() const
+    {
+        // Using this instead of isSet() to make this assertion robust against the possibility
+        // of additional access types being added.
+        ASSERT(isTransition() || isReplace());
+        
+        return m_oldStructure.get();
+    }
+    
+    Structure* structure() const
+    {
+        ASSERT(isReplace());
+        return m_oldStructure.get();
+    }
+    
+    Structure* newStructure() const
+    {
+        ASSERT(isTransition());
+        return m_newStructure.get();
+    }
+    
+    StructureChain* chain() const
+    {
+        ASSERT(isTransition());
+        return m_chain.get();
+    }
+    
+    MacroAssemblerCodeRef stubRoutine() const
+    {
+        ASSERT(isTransition() || isReplace());
+        return m_stubRoutine;
+    }
+    
+    bool visitWeak() const;
+    
+private:
+    AccessType m_type;
+    WriteBarrier<Structure> m_oldStructure;
+    WriteBarrier<Structure> m_newStructure;
+    WriteBarrier<StructureChain> m_chain;
+    MacroAssemblerCodeRef m_stubRoutine;
+};
+
+class PolymorphicPutByIdList {
+    WTF_MAKE_FAST_ALLOCATED;
+public:
+    // Initialize from a stub info; this will place one element in the list and it will
+    // be created by converting the stub info's put by id access information into our
+    // PutByIdAccess.
+    PolymorphicPutByIdList(
+        PutKind,
+        StructureStubInfo&,
+        MacroAssemblerCodePtr initialSlowPath);
+
+    // Either creates a new polymorphic put list, or returns the one that is already
+    // in place.
+    static PolymorphicPutByIdList* from(
+        PutKind,
+        StructureStubInfo&,
+        MacroAssemblerCodePtr initialSlowPath);
+    
+    ~PolymorphicPutByIdList();
+    
+    MacroAssemblerCodePtr currentSlowPathTarget() const
+    {
+        return m_list.last().stubRoutine().code();
+    }
+    
+    void addAccess(const PutByIdAccess&);
+    
+    bool isEmpty() const { return m_list.isEmpty(); }
+    unsigned size() const { return m_list.size(); }
+    bool isFull() const;
+    bool isAlmostFull() const; // True if adding an element would make isFull() true.
+    const PutByIdAccess& at(unsigned i) const { return m_list[i]; }
+    const PutByIdAccess& operator[](unsigned i) const { return m_list[i]; }
+    
+    PutKind kind() const { return m_kind; }
+    
+    bool visitWeak() const;
+    
+private:
+    Vector<PutByIdAccess, 2> m_list;
+    PutKind m_kind;
+};
+
+} // namespace JSC
+
+#endif // ENABLE(JIT)
+
+#endif // PolymorphicPutByIdList_h
+
diff --git a/Source/JavaScriptCore/bytecode/PredictedType.cpp b/Source/JavaScriptCore/bytecode/PredictedType.cpp
index a8118adf9..2b490c24e 100644
--- a/Source/JavaScriptCore/bytecode/PredictedType.cpp
+++ b/Source/JavaScriptCore/bytecode/PredictedType.cpp
@@ -29,6 +29,7 @@
 #include "config.h"
 #include "PredictedType.h"
 
+#include "JSArray.h"
 #include "JSByteArray.h"
 #include "JSFunction.h"
 #include "ValueProfile.h"
diff --git a/Source/JavaScriptCore/bytecode/PutByIdStatus.cpp b/Source/JavaScriptCore/bytecode/PutByIdStatus.cpp
index 45a5e614c..209d4cd5e 100644
--- a/Source/JavaScriptCore/bytecode/PutByIdStatus.cpp
+++ b/Source/JavaScriptCore/bytecode/PutByIdStatus.cpp
@@ -27,27 +27,69 @@
 #include "PutByIdStatus.h"
 
 #include "CodeBlock.h"
+#include "LowLevelInterpreter.h"
 #include "Structure.h"
 #include "StructureChain.h"
 
 namespace JSC {
 
+PutByIdStatus PutByIdStatus::computeFromLLInt(CodeBlock* profiledBlock, unsigned bytecodeIndex, Identifier& ident)
+{
+    UNUSED_PARAM(profiledBlock);
+    UNUSED_PARAM(bytecodeIndex);
+    UNUSED_PARAM(ident);
+#if ENABLE(LLINT)
+    Instruction* instruction = profiledBlock->instructions().begin() + bytecodeIndex;
+
+    Structure* structure = instruction[4].u.structure.get();
+    if (!structure)
+        return PutByIdStatus(NoInformation, 0, 0, 0, notFound);
+    
+    if (instruction[0].u.opcode == llint_op_put_by_id) {
+        size_t offset = structure->get(*profiledBlock->globalData(), ident);
+        if (offset == notFound)
+            return PutByIdStatus(NoInformation, 0, 0, 0, notFound);
+        
+        return PutByIdStatus(SimpleReplace, structure, 0, 0, offset);
+    }
+    
+    ASSERT(instruction[0].u.opcode == llint_op_put_by_id_transition_direct
+           || instruction[0].u.opcode == llint_op_put_by_id_transition_normal);
+    
+    Structure* newStructure = instruction[6].u.structure.get();
+    StructureChain* chain = instruction[7].u.structureChain.get();
+    ASSERT(newStructure);
+    ASSERT(chain);
+    
+    size_t offset = newStructure->get(*profiledBlock->globalData(), ident);
+    if (offset == notFound)
+        return PutByIdStatus(NoInformation, 0, 0, 0, notFound);
+    
+    return PutByIdStatus(SimpleTransition, structure, newStructure, chain, offset);
+#else
+    return PutByIdStatus(NoInformation, 0, 0, 0, notFound);
+#endif
+}
+
 PutByIdStatus PutByIdStatus::computeFor(CodeBlock* profiledBlock, unsigned bytecodeIndex, Identifier& ident)
 {
     UNUSED_PARAM(profiledBlock);
     UNUSED_PARAM(bytecodeIndex);
     UNUSED_PARAM(ident);
 #if ENABLE(JIT) && ENABLE(VALUE_PROFILER)
+    if (!profiledBlock->numberOfStructureStubInfos())
+        return computeFromLLInt(profiledBlock, bytecodeIndex, ident);
+    
     if (profiledBlock->likelyToTakeSlowCase(bytecodeIndex))
         return PutByIdStatus(TakesSlowPath, 0, 0, 0, notFound);
     
     StructureStubInfo& stubInfo = profiledBlock->getStubInfo(bytecodeIndex);
     if (!stubInfo.seen)
-        return PutByIdStatus(NoInformation, 0, 0, 0, notFound);
+        return computeFromLLInt(profiledBlock, bytecodeIndex, ident);
     
     switch (stubInfo.accessType) {
     case access_unset:
-        return PutByIdStatus(NoInformation, 0, 0, 0, notFound);
+        return computeFromLLInt(profiledBlock, bytecodeIndex, ident);
         
     case access_put_by_id_replace: {
         size_t offset = stubInfo.u.putByIdReplace.baseObjectStructure->get(
diff --git a/Source/JavaScriptCore/bytecode/PutByIdStatus.h b/Source/JavaScriptCore/bytecode/PutByIdStatus.h
index b33f4d09c..a6d95a449 100644
--- a/Source/JavaScriptCore/bytecode/PutByIdStatus.h
+++ b/Source/JavaScriptCore/bytecode/PutByIdStatus.h
@@ -93,6 +93,8 @@ public:
     size_t offset() const { return m_offset; }
     
 private:
+    static PutByIdStatus computeFromLLInt(CodeBlock*, unsigned bytecodeIndex, Identifier&);
+    
     State m_state;
     Structure* m_oldStructure;
     Structure* m_newStructure;
diff --git a/Source/JavaScriptCore/bytecode/PutKind.h b/Source/JavaScriptCore/bytecode/PutKind.h
new file mode 100644
index 000000000..7a1dd642e
--- /dev/null
+++ b/Source/JavaScriptCore/bytecode/PutKind.h
@@ -0,0 +1,36 @@
+/*
+ * Copyright (C) 2012 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef PutKind_h
+#define PutKind_h
+
+namespace JSC {
+
+enum PutKind { Direct, NotDirect };
+
+} // namespace JSC
+
+#endif // PutKind_h
+
diff --git a/Source/JavaScriptCore/bytecode/SamplingTool.cpp b/Source/JavaScriptCore/bytecode/SamplingTool.cpp
index 0dec25fb7..077f041f4 100644
--- a/Source/JavaScriptCore/bytecode/SamplingTool.cpp
+++ b/Source/JavaScriptCore/bytecode/SamplingTool.cpp
@@ -67,14 +67,14 @@ void SamplingFlags::stop()
         total += s_flagCounts[i];
 
     if (total) {
-        printf("\nSamplingFlags: sample counts with flags set: (%lld total)\n", total);
+        dataLog("\nSamplingFlags: sample counts with flags set: (%lld total)\n", total);
         for (unsigned i = 0; i <= 32; ++i) {
             if (s_flagCounts[i])
-                printf("  [ %02d ] : %lld\t\t(%03.2f%%)\n", i, s_flagCounts[i], (100.0 * s_flagCounts[i]) / total);
+                dataLog("  [ %02d ] : %lld\t\t(%03.2f%%)\n", i, s_flagCounts[i], (100.0 * s_flagCounts[i]) / total);
         }
-        printf("\n");
+        dataLog("\n");
     } else
-    printf("\nSamplingFlags: no samples.\n\n");
+    dataLog("\nSamplingFlags: no samples.\n\n");
 }
 uint64_t SamplingFlags::s_flagCounts[33];
 
@@ -151,7 +151,7 @@ void SamplingRegion::dump()
 void SamplingRegion::dumpInternal()
 {
     if (!s_spectrum) {
-        printf("\nSamplingRegion: was never sampled.\n\n");
+        dataLog("\nSamplingRegion: was never sampled.\n\n");
         return;
     }
     
@@ -161,10 +161,10 @@ void SamplingRegion::dumpInternal()
     for (unsigned i = list.size(); i--;)
         total += list[i].count;
     
-    printf("\nSamplingRegion: sample counts for regions: (%lu samples)\n", total);
+    dataLog("\nSamplingRegion: sample counts for regions: (%lu samples)\n", total);
 
     for (unsigned i = list.size(); i--;)
-        printf("    %3.2lf%%  %s\n", (100.0 * list[i].count) / total, list[i].key);
+        dataLog("    %3.2lf%%  %s\n", (100.0 * list[i].count) / total, list[i].key);
 }
 #else // ENABLE(SAMPLING_REGIONS)
 void SamplingRegion::dump() { }
@@ -210,7 +210,7 @@ bool SamplingThread::s_running = false;
 unsigned SamplingThread::s_hertz = 10000;
 ThreadIdentifier SamplingThread::s_samplingThread;
 
-void* SamplingThread::threadStartFunc(void*)
+void SamplingThread::threadStartFunc(void*)
 {
     while (s_running) {
         sleepForMicroseconds(hertz2us(s_hertz));
@@ -225,8 +225,6 @@ void* SamplingThread::threadStartFunc(void*)
         SamplingTool::sample();
 #endif
     }
-
-    return 0;
 }
 
 
@@ -243,7 +241,7 @@ void SamplingThread::stop()
 {
     ASSERT(s_running);
     s_running = false;
-    waitForThreadCompletion(s_samplingThread, 0);
+    waitForThreadCompletion(s_samplingThread);
 }
 
 
@@ -373,10 +371,10 @@ void SamplingTool::dump(ExecState* exec)
 
     // (2) Print Opcode sampling results.
 
-    printf("\nBytecode samples [*]\n");
-    printf("                             sample   %% of       %% of     |   cti     cti %%\n");
-    printf("opcode                       count     VM        total    |  count   of self\n");
-    printf("-------------------------------------------------------   |  ----------------\n");
+    dataLog("\nBytecode samples [*]\n");
+    dataLog("                             sample   %% of       %% of     |   cti     cti %%\n");
+    dataLog("opcode                       count     VM        total    |  count   of self\n");
+    dataLog("-------------------------------------------------------   |  ----------------\n");
 
     for (int i = 0; i < numOpcodeIDs; ++i) {
         long long count = opcodeSampleInfo[i].count;
@@ -391,18 +389,18 @@ void SamplingTool::dump(ExecState* exec)
         double percentOfTotal = (static_cast<double>(count) * 100) / m_sampleCount;
         long long countInCTIFunctions = opcodeSampleInfo[i].countInCTIFunctions;
         double percentInCTIFunctions = (static_cast<double>(countInCTIFunctions) * 100) / count;
-        fprintf(stdout, "%s:%s%-6lld %.3f%%\t%.3f%%\t  |   %-6lld %.3f%%\n", opcodeName, opcodePadding, count, percentOfVM, percentOfTotal, countInCTIFunctions, percentInCTIFunctions);
+        debugDebugPrintf("%s:%s%-6lld %.3f%%\t%.3f%%\t  |   %-6lld %.3f%%\n", opcodeName, opcodePadding, count, percentOfVM, percentOfTotal, countInCTIFunctions, percentInCTIFunctions);
     }
     
-    printf("\n[*] Samples inside host code are not charged to any Bytecode.\n\n");
-    printf("\tSamples inside VM:\t\t%lld / %lld (%.3f%%)\n", m_opcodeSampleCount, m_sampleCount, (static_cast<double>(m_opcodeSampleCount) * 100) / m_sampleCount);
-    printf("\tSamples inside host code:\t%lld / %lld (%.3f%%)\n\n", m_sampleCount - m_opcodeSampleCount, m_sampleCount, (static_cast<double>(m_sampleCount - m_opcodeSampleCount) * 100) / m_sampleCount);
-    printf("\tsample count:\tsamples inside this opcode\n");
-    printf("\t%% of VM:\tsample count / all opcode samples\n");
-    printf("\t%% of total:\tsample count / all samples\n");
-    printf("\t--------------\n");
-    printf("\tcti count:\tsamples inside a CTI function called by this opcode\n");
-    printf("\tcti %% of self:\tcti count / sample count\n");
+    dataLog("\n[*] Samples inside host code are not charged to any Bytecode.\n\n");
+    dataLog("\tSamples inside VM:\t\t%lld / %lld (%.3f%%)\n", m_opcodeSampleCount, m_sampleCount, (static_cast<double>(m_opcodeSampleCount) * 100) / m_sampleCount);
+    dataLog("\tSamples inside host code:\t%lld / %lld (%.3f%%)\n\n", m_sampleCount - m_opcodeSampleCount, m_sampleCount, (static_cast<double>(m_sampleCount - m_opcodeSampleCount) * 100) / m_sampleCount);
+    dataLog("\tsample count:\tsamples inside this opcode\n");
+    dataLog("\t%% of VM:\tsample count / all opcode samples\n");
+    dataLog("\t%% of total:\tsample count / all samples\n");
+    dataLog("\t--------------\n");
+    dataLog("\tcti count:\tsamples inside a CTI function called by this opcode\n");
+    dataLog("\tcti %% of self:\tcti count / sample count\n");
     
 #if ENABLE(CODEBLOCK_SAMPLING)
 
@@ -418,7 +416,7 @@ void SamplingTool::dump(ExecState* exec)
 
     // (4) Print data from 'codeBlockSamples' array.
 
-    printf("\nCodeBlock samples\n\n"); 
+    dataLog("\nCodeBlock samples\n\n"); 
 
     for (int i = 0; i < scopeCount; ++i) {
         ScriptSampleRecord* record = codeBlockSamples[i];
@@ -428,21 +426,21 @@ void SamplingTool::dump(ExecState* exec)
 
         if (blockPercent >= 1) {
             //Instruction* code = codeBlock->instructions().begin();
-            printf("#%d: %s:%d: %d / %lld (%.3f%%)\n", i + 1, record->m_executable->sourceURL().utf8().data(), codeBlock->lineNumberForBytecodeOffset(0), record->m_sampleCount, m_sampleCount, blockPercent);
+            dataLog("#%d: %s:%d: %d / %lld (%.3f%%)\n", i + 1, record->m_executable->sourceURL().utf8().data(), codeBlock->lineNumberForBytecodeOffset(0), record->m_sampleCount, m_sampleCount, blockPercent);
             if (i < 10) {
                 HashMap<unsigned,unsigned> lineCounts;
                 codeBlock->dump(exec);
 
-                printf("    Opcode and line number samples [*]\n\n");
+                dataLog("    Opcode and line number samples [*]\n\n");
                 for (unsigned op = 0; op < record->m_size; ++op) {
                     int count = record->m_samples[op];
                     if (count) {
-                        printf("    [% 4d] has sample count: % 4d\n", op, count);
+                        dataLog("    [% 4d] has sample count: % 4d\n", op, count);
                         unsigned line = codeBlock->lineNumberForBytecodeOffset(op);
                         lineCounts.set(line, (lineCounts.contains(line) ? lineCounts.get(line) : 0) + count);
                     }
                 }
-                printf("\n");
+                dataLog("\n");
 
                 int linesCount = lineCounts.size();
                 Vector<LineCountInfo> lineCountInfo(linesCount);
@@ -455,12 +453,12 @@ void SamplingTool::dump(ExecState* exec)
                 qsort(lineCountInfo.begin(), linesCount, sizeof(LineCountInfo), compareLineCountInfoSampling);
 
                 for (lineno = 0; lineno < linesCount; ++lineno) {
-                    printf("    Line #%d has sample count %d.\n", lineCountInfo[lineno].line, lineCountInfo[lineno].count);
+                    dataLog("    Line #%d has sample count %d.\n", lineCountInfo[lineno].line, lineCountInfo[lineno].count);
                 }
-                printf("\n");
-                printf("    [*] Samples inside host code are charged to the calling Bytecode.\n");
-                printf("        Samples on a call / return boundary are not charged to a specific opcode or line.\n\n");
-                printf("            Samples on a call / return boundary: %d / %d (%.3f%%)\n\n", record->m_sampleCount - record->m_opcodeSampleCount, record->m_sampleCount, (static_cast<double>(record->m_sampleCount - record->m_opcodeSampleCount) * 100) / record->m_sampleCount);
+                dataLog("\n");
+                dataLog("    [*] Samples inside host code are charged to the calling Bytecode.\n");
+                dataLog("        Samples on a call / return boundary are not charged to a specific opcode or line.\n\n");
+                dataLog("            Samples on a call / return boundary: %d / %d (%.3f%%)\n\n", record->m_sampleCount - record->m_opcodeSampleCount, record->m_sampleCount, (static_cast<double>(record->m_sampleCount - record->m_opcodeSampleCount) * 100) / record->m_sampleCount);
             }
         }
     }
diff --git a/Source/JavaScriptCore/bytecode/SamplingTool.h b/Source/JavaScriptCore/bytecode/SamplingTool.h
index 32a44ad69..28fd528d0 100644
--- a/Source/JavaScriptCore/bytecode/SamplingTool.h
+++ b/Source/JavaScriptCore/bytecode/SamplingTool.h
@@ -223,7 +223,7 @@ namespace JSC {
         JS_EXPORT_PRIVATE static void start(unsigned hertz=10000);
         JS_EXPORT_PRIVATE static void stop();
 
-        static void* threadStartFunc(void*);
+        static void threadStartFunc(void*);
     };
 
     class SamplingTool {
diff --git a/Source/JavaScriptCore/bytecode/StructureStubInfo.cpp b/Source/JavaScriptCore/bytecode/StructureStubInfo.cpp
index ec18782d5..f2657b785 100644
--- a/Source/JavaScriptCore/bytecode/StructureStubInfo.cpp
+++ b/Source/JavaScriptCore/bytecode/StructureStubInfo.cpp
@@ -27,6 +27,7 @@
 #include "StructureStubInfo.h"
 
 #include "JSObject.h"
+#include "PolymorphicPutByIdList.h"
 #include "ScopeChain.h"
 
 namespace JSC {
@@ -45,6 +46,9 @@ void StructureStubInfo::deref()
         delete polymorphicStructures;
         return;
     }
+    case access_put_by_id_list:
+        delete u.putByIdList.list;
+        return;
     case access_get_by_id_self:
     case access_get_by_id_proto:
     case access_get_by_id_chain:
@@ -82,18 +86,14 @@ bool StructureStubInfo::visitWeakReferences()
         break;
     case access_get_by_id_self_list: {
         PolymorphicAccessStructureList* polymorphicStructures = u.getByIdSelfList.structureList;
-        if (!polymorphicStructures->visitWeak(u.getByIdSelfList.listSize)) {
-            delete polymorphicStructures;
+        if (!polymorphicStructures->visitWeak(u.getByIdSelfList.listSize))
             return false;
-        }
         break;
     }
     case access_get_by_id_proto_list: {
         PolymorphicAccessStructureList* polymorphicStructures = u.getByIdProtoList.structureList;
-        if (!polymorphicStructures->visitWeak(u.getByIdSelfList.listSize)) {
-            delete polymorphicStructures;
+        if (!polymorphicStructures->visitWeak(u.getByIdSelfList.listSize))
             return false;
-        }
         break;
     }
     case access_put_by_id_transition_normal:
@@ -107,6 +107,10 @@ bool StructureStubInfo::visitWeakReferences()
         if (!Heap::isMarked(u.putByIdReplace.baseObjectStructure.get()))
             return false;
         break;
+    case access_put_by_id_list:
+        if (!u.putByIdList.list->visitWeak())
+            return false;
+        break;
     default:
         // The rest of the instructions don't require references, so there is no need to
         // do anything.
diff --git a/Source/JavaScriptCore/bytecode/StructureStubInfo.h b/Source/JavaScriptCore/bytecode/StructureStubInfo.h
index d6b6092d0..8fad5c0cc 100644
--- a/Source/JavaScriptCore/bytecode/StructureStubInfo.h
+++ b/Source/JavaScriptCore/bytecode/StructureStubInfo.h
@@ -26,6 +26,8 @@
 #ifndef StructureStubInfo_h
 #define StructureStubInfo_h
 
+#include <wtf/Platform.h>
+
 #if ENABLE(JIT)
 
 #include "CodeOrigin.h"
@@ -36,6 +38,8 @@
 
 namespace JSC {
 
+    class PolymorphicPutByIdList;
+
     enum AccessType {
         access_get_by_id_self,
         access_get_by_id_proto,
@@ -45,6 +49,7 @@ namespace JSC {
         access_put_by_id_transition_normal,
         access_put_by_id_transition_direct,
         access_put_by_id_replace,
+        access_put_by_id_list,
         access_unset,
         access_get_by_id_generic,
         access_put_by_id_generic,
@@ -75,6 +80,7 @@ namespace JSC {
         case access_put_by_id_transition_normal:
         case access_put_by_id_transition_direct:
         case access_put_by_id_replace:
+        case access_put_by_id_list:
         case access_put_by_id_generic:
             return true;
         default:
@@ -149,10 +155,16 @@ namespace JSC {
             u.putByIdReplace.baseObjectStructure.set(globalData, owner, baseObjectStructure);
         }
         
+        void initPutByIdList(PolymorphicPutByIdList* list)
+        {
+            accessType = access_put_by_id_list;
+            u.putByIdList.list = list;
+        }
+        
         void reset()
         {
             accessType = access_unset;
-            
+            deref();
             stubRoutine = MacroAssemblerCodeRef();
         }
 
@@ -227,6 +239,9 @@ namespace JSC {
             struct {
                 WriteBarrierBase<Structure> baseObjectStructure;
             } putByIdReplace;
+            struct {
+                PolymorphicPutByIdList* list;
+            } putByIdList;
         } u;
 
         MacroAssemblerCodeRef stubRoutine;
diff --git a/Source/JavaScriptCore/bytecode/ValueProfile.h b/Source/JavaScriptCore/bytecode/ValueProfile.h
index 02a1d6bf9..73e363a8b 100644
--- a/Source/JavaScriptCore/bytecode/ValueProfile.h
+++ b/Source/JavaScriptCore/bytecode/ValueProfile.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2011 Apple Inc. All rights reserved.
+ * Copyright (C) 2011, 2012 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -29,6 +29,10 @@
 #ifndef ValueProfile_h
 #define ValueProfile_h
 
+#include <wtf/Platform.h>
+
+#if ENABLE(VALUE_PROFILER)
+
 #include "JSArray.h"
 #include "PredictedType.h"
 #include "Structure.h"
@@ -36,15 +40,14 @@
 
 namespace JSC {
 
-#if ENABLE(VALUE_PROFILER)
-struct ValueProfile {
-    static const unsigned logNumberOfBuckets = 0; // 1 bucket
-    static const unsigned numberOfBuckets = 1 << logNumberOfBuckets;
+template<unsigned numberOfBucketsArgument>
+struct ValueProfileBase {
+    static const unsigned numberOfBuckets = numberOfBucketsArgument;
     static const unsigned numberOfSpecFailBuckets = 1;
     static const unsigned bucketIndexMask = numberOfBuckets - 1;
     static const unsigned totalNumberOfBuckets = numberOfBuckets + numberOfSpecFailBuckets;
     
-    ValueProfile()
+    ValueProfileBase()
         : m_bytecodeOffset(-1)
         , m_prediction(PredictNone)
         , m_numberOfSamplesInPrediction(0)
@@ -53,7 +56,7 @@ struct ValueProfile {
             m_buckets[i] = JSValue::encode(JSValue());
     }
     
-    ValueProfile(int bytecodeOffset)
+    ValueProfileBase(int bytecodeOffset)
         : m_bytecodeOffset(bytecodeOffset)
         , m_prediction(PredictNone)
         , m_numberOfSamplesInPrediction(0)
@@ -103,7 +106,6 @@ struct ValueProfile {
         return false;
     }
     
-#ifndef NDEBUG
     void dump(FILE* out)
     {
         fprintf(out,
@@ -123,10 +125,23 @@ struct ValueProfile {
             }
         }
     }
-#endif
     
     // Updates the prediction and returns the new one.
-    PredictedType computeUpdatedPrediction();
+    PredictedType computeUpdatedPrediction()
+    {
+        for (unsigned i = 0; i < totalNumberOfBuckets; ++i) {
+            JSValue value = JSValue::decode(m_buckets[i]);
+            if (!value)
+                continue;
+            
+            m_numberOfSamplesInPrediction++;
+            mergePrediction(m_prediction, predictionFromValue(value));
+            
+            m_buckets[i] = JSValue::encode(JSValue());
+        }
+        
+        return m_prediction;
+    }
     
     int m_bytecodeOffset; // -1 for prologue
     
@@ -136,7 +151,32 @@ struct ValueProfile {
     EncodedJSValue m_buckets[totalNumberOfBuckets];
 };
 
-inline int getValueProfileBytecodeOffset(ValueProfile* valueProfile)
+struct MinimalValueProfile : public ValueProfileBase<0> {
+    MinimalValueProfile(): ValueProfileBase<0>() { }
+    MinimalValueProfile(int bytecodeOffset): ValueProfileBase<0>(bytecodeOffset) { }
+};
+
+template<unsigned logNumberOfBucketsArgument>
+struct ValueProfileWithLogNumberOfBuckets : public ValueProfileBase<1 << logNumberOfBucketsArgument> {
+    static const unsigned logNumberOfBuckets = logNumberOfBucketsArgument;
+    
+    ValueProfileWithLogNumberOfBuckets()
+        : ValueProfileBase<1 << logNumberOfBucketsArgument>()
+    {
+    }
+    ValueProfileWithLogNumberOfBuckets(int bytecodeOffset)
+        : ValueProfileBase<1 << logNumberOfBucketsArgument>(bytecodeOffset)
+    {
+    }
+};
+
+struct ValueProfile : public ValueProfileWithLogNumberOfBuckets<0> {
+    ValueProfile(): ValueProfileWithLogNumberOfBuckets<0>() { }
+    ValueProfile(int bytecodeOffset): ValueProfileWithLogNumberOfBuckets<0>(bytecodeOffset) { }
+};
+
+template<typename T>
+inline int getValueProfileBytecodeOffset(T* valueProfile)
 {
     return valueProfile->m_bytecodeOffset;
 }
@@ -158,9 +198,10 @@ inline int getRareCaseProfileBytecodeOffset(RareCaseProfile* rareCaseProfile)
 {
     return rareCaseProfile->m_bytecodeOffset;
 }
-#endif
 
-}
+} // namespace JSC
+
+#endif // ENABLE(VALUE_PROFILER)
 
-#endif
+#endif // ValueProfile_h
 
diff --git a/Source/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp b/Source/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp
index 437dd53b0..6fa0ce96b 100644
--- a/Source/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp
+++ b/Source/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp
@@ -32,8 +32,10 @@
 #include "BytecodeGenerator.h"
 
 #include "BatchedTransitionOptimizer.h"
+#include "JSActivation.h"
 #include "JSFunction.h"
 #include "Interpreter.h"
+#include "LowLevelInterpreter.h"
 #include "ScopeChain.h"
 #include "StrongInlines.h"
 #include "UString.h"
@@ -413,7 +415,7 @@ BytecodeGenerator::BytecodeGenerator(FunctionBodyNode* functionBody, ScopeChainN
         if (!functionBody->captures(ident))
             addVar(ident, varStack[i].second & DeclarationStacks::IsConstant);
     }
-    
+
     if (m_shouldEmitDebugHooks)
         codeBlock->m_numCapturedVars = codeBlock->m_numVars;
 
@@ -560,19 +562,6 @@ RegisterID* BytecodeGenerator::createLazyRegisterIfNecessary(RegisterID* reg)
     return reg;
 }
 
-bool BytecodeGenerator::isLocal(const Identifier& ident)
-{
-    if (ident == propertyNames().thisIdentifier)
-        return true;
-    
-    return shouldOptimizeLocals() && symbolTable().contains(ident.impl());
-}
-
-bool BytecodeGenerator::isLocalConstant(const Identifier& ident)
-{
-    return symbolTable().get(ident.impl()).isReadOnly();
-}
-
 RegisterID* BytecodeGenerator::newRegister()
 {
     m_calleeRegisters.append(m_calleeRegisters.size());
@@ -1174,15 +1163,8 @@ ResolveResult BytecodeGenerator::resolve(const Identifier& property)
     }
 
     // Cases where we cannot statically optimize the lookup.
-    if (property == propertyNames().arguments || !canOptimizeNonLocals()) {
-        if (shouldOptimizeLocals() && m_codeType == GlobalCode) {
-            ScopeChainIterator iter = m_scopeChain->begin();
-            JSObject* globalObject = iter->get();
-            ASSERT((++iter) == m_scopeChain->end());
-            return ResolveResult::globalResolve(globalObject);
-        } else
-            return ResolveResult::dynamicResolve(0);
-    }
+    if (property == propertyNames().arguments || !canOptimizeNonLocals())
+        return ResolveResult::dynamicResolve(0);
 
     ScopeChainIterator iter = m_scopeChain->begin();
     ScopeChainIterator end = m_scopeChain->end();
@@ -1207,6 +1189,10 @@ ResolveResult BytecodeGenerator::resolve(const Identifier& property)
                     return ResolveResult::dynamicIndexedGlobalResolve(entry.getIndex(), depth, currentScope, flags);
                 return ResolveResult::indexedGlobalResolve(entry.getIndex(), currentScope, flags);
             }
+#if !ASSERT_DISABLED
+            if (JSActivation* activation = jsDynamicCast<JSActivation*>(currentVariableObject))
+                ASSERT(activation->isValidScopedLookup(entry.getIndex()));
+#endif
             return ResolveResult::lexicalResolve(entry.getIndex(), depth, flags);
         }
         bool scopeRequiresDynamicChecks = false;
@@ -1293,9 +1279,7 @@ RegisterID* BytecodeGenerator::emitResolve(RegisterID* dst, const ResolveResult&
 #if ENABLE(JIT)
         m_codeBlock->addGlobalResolveInfo(instructions().size());
 #endif
-#if ENABLE(INTERPRETER)
         m_codeBlock->addGlobalResolveInstruction(instructions().size());
-#endif
         bool dynamic = resolveResult.isDynamic() && resolveResult.depth();
         ValueProfile* profile = emitProfiledOpcode(dynamic ? op_resolve_global_dynamic : op_resolve_global);
         instructions().append(dst->index());
@@ -1387,7 +1371,7 @@ RegisterID* BytecodeGenerator::emitResolveWithBase(RegisterID* baseDst, Register
 #if ENABLE(JIT)
         m_codeBlock->addGlobalResolveInfo(instructions().size());
 #endif
-#if ENABLE(INTERPRETER)
+#if ENABLE(CLASSIC_INTERPRETER)
         m_codeBlock->addGlobalResolveInstruction(instructions().size());
 #endif
         ValueProfile* profile = emitProfiledOpcode(op_resolve_global);
@@ -1399,9 +1383,6 @@ RegisterID* BytecodeGenerator::emitResolveWithBase(RegisterID* baseDst, Register
         return baseDst;
     }
 
-
-
-
     ValueProfile* profile = emitProfiledOpcode(op_resolve_with_base);
     instructions().append(baseDst->index());
     instructions().append(propDst->index());
@@ -1509,9 +1490,7 @@ void BytecodeGenerator::emitMethodCheck()
 
 RegisterID* BytecodeGenerator::emitGetById(RegisterID* dst, RegisterID* base, const Identifier& property)
 {
-#if ENABLE(INTERPRETER)
     m_codeBlock->addPropertyAccessInstruction(instructions().size());
-#endif
 
     ValueProfile* profile = emitProfiledOpcode(op_get_by_id);
     instructions().append(dst->index());
@@ -1537,9 +1516,7 @@ RegisterID* BytecodeGenerator::emitGetArgumentsLength(RegisterID* dst, RegisterI
 
 RegisterID* BytecodeGenerator::emitPutById(RegisterID* base, const Identifier& property, RegisterID* value)
 {
-#if ENABLE(INTERPRETER)
     m_codeBlock->addPropertyAccessInstruction(instructions().size());
-#endif
 
     emitOpcode(op_put_by_id);
     instructions().append(base->index());
@@ -1555,9 +1532,7 @@ RegisterID* BytecodeGenerator::emitPutById(RegisterID* base, const Identifier& p
 
 RegisterID* BytecodeGenerator::emitDirectPutById(RegisterID* base, const Identifier& property, RegisterID* value)
 {
-#if ENABLE(INTERPRETER)
     m_codeBlock->addPropertyAccessInstruction(instructions().size());
-#endif
     
     emitOpcode(op_put_by_id);
     instructions().append(base->index());
@@ -1838,7 +1813,11 @@ RegisterID* BytecodeGenerator::emitCall(OpcodeID opcodeID, RegisterID* dst, Regi
     instructions().append(func->index()); // func
     instructions().append(callArguments.argumentCountIncludingThis()); // argCount
     instructions().append(callArguments.registerOffset()); // registerOffset
+#if ENABLE(LLINT)
+    instructions().append(m_codeBlock->addLLIntCallLinkInfo());
+#else
     instructions().append(0);
+#endif
     instructions().append(0);
     if (dst != ignoredResult()) {
         ValueProfile* profile = emitProfiledOpcode(op_call_put_result);
@@ -1942,7 +1921,11 @@ RegisterID* BytecodeGenerator::emitConstruct(RegisterID* dst, RegisterID* func,
     instructions().append(func->index()); // func
     instructions().append(callArguments.argumentCountIncludingThis()); // argCount
     instructions().append(callArguments.registerOffset()); // registerOffset
+#if ENABLE(LLINT)
+    instructions().append(m_codeBlock->addLLIntCallLinkInfo());
+#else
     instructions().append(0);
+#endif
     instructions().append(0);
     if (dst != ignoredResult()) {
         ValueProfile* profile = emitProfiledOpcode(op_call_put_result);
@@ -2203,7 +2186,11 @@ RegisterID* BytecodeGenerator::emitCatch(RegisterID* targetRegister, Label* star
 {
     m_usesExceptions = true;
 #if ENABLE(JIT)
+#if ENABLE(LLINT)
+    HandlerInfo info = { start->bind(0, 0), end->bind(0, 0), instructions().size(), m_dynamicScopeDepth + m_baseScopeDepth, CodeLocationLabel(MacroAssemblerCodePtr::createFromExecutableAddress(bitwise_cast<void*>(&llint_op_catch))) };
+#else
     HandlerInfo info = { start->bind(0, 0), end->bind(0, 0), instructions().size(), m_dynamicScopeDepth + m_baseScopeDepth, CodeLocationLabel() };
+#endif
 #else
     HandlerInfo info = { start->bind(0, 0), end->bind(0, 0), instructions().size(), m_dynamicScopeDepth + m_baseScopeDepth };
 #endif
diff --git a/Source/JavaScriptCore/bytecompiler/BytecodeGenerator.h b/Source/JavaScriptCore/bytecompiler/BytecodeGenerator.h
index c9ec5d852..d61b42b76 100644
--- a/Source/JavaScriptCore/bytecompiler/BytecodeGenerator.h
+++ b/Source/JavaScriptCore/bytecompiler/BytecodeGenerator.h
@@ -262,9 +262,6 @@ namespace JSC {
         // Returns the register storing "this"
         RegisterID* thisRegister() { return &m_thisRegister; }
 
-        bool isLocal(const Identifier&);
-        bool isLocalConstant(const Identifier&);
-
         // Returns the next available temporary register. Registers returned by
         // newTemporary require a modified form of reference counting: any
         // register with a refcount of 0 is considered "available", meaning that
diff --git a/Source/JavaScriptCore/bytecompiler/NodesCodegen.cpp b/Source/JavaScriptCore/bytecompiler/NodesCodegen.cpp
index 46ec698de..2d4181912 100644
--- a/Source/JavaScriptCore/bytecompiler/NodesCodegen.cpp
+++ b/Source/JavaScriptCore/bytecompiler/NodesCodegen.cpp
@@ -142,7 +142,7 @@ RegisterID* ThisNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst
 
 bool ResolveNode::isPure(BytecodeGenerator& generator) const
 {
-    return generator.isLocal(m_ident);
+    return generator.resolve(m_ident).isStatic();
 }
 
 RegisterID* ResolveNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
@@ -255,7 +255,7 @@ RegisterID* PropertyListNode::emitBytecode(BytecodeGenerator& generator, Registe
             if (node->m_type == PropertyNode::Constant)
                 continue;
 
-            GetterSetterPair pair(node, 0);
+            GetterSetterPair pair(node, static_cast<PropertyNode*>(0));
             std::pair<GetterSetterMap::iterator, bool> result = map.add(node->name().impl(), pair);
             if (!result.second)
                 result.first->second.second = node;
@@ -792,7 +792,7 @@ RegisterID* PrefixResolveNode::emitBytecode(BytecodeGenerator& generator, Regist
 {
     ResolveResult resolveResult = generator.resolve(m_ident);
     if (RegisterID* local = resolveResult.local()) {
-        if (generator.isLocalConstant(m_ident)) {
+        if (resolveResult.isReadOnly()) {
             if (dst == generator.ignoredResult())
                 return 0;
             RefPtr<RegisterID> r0 = generator.emitLoad(generator.finalDestination(dst), (m_operator == OpPlusPlus) ? 1.0 : -1.0);
diff --git a/Source/JavaScriptCore/dfg/DFGAbstractState.cpp b/Source/JavaScriptCore/dfg/DFGAbstractState.cpp
index 72c1759c7..ee0cc9ab7 100644
--- a/Source/JavaScriptCore/dfg/DFGAbstractState.cpp
+++ b/Source/JavaScriptCore/dfg/DFGAbstractState.cpp
@@ -48,10 +48,10 @@ namespace JSC { namespace DFG {
 #define FLAG_FOR_MERGE_TO_SUCCESSORS   20
 #define FLAG_FOR_STRUCTURE_CLOBBERING  21
 
-AbstractState::AbstractState(CodeBlock* codeBlock, Graph& graph)
-    : m_codeBlock(codeBlock)
+AbstractState::AbstractState(Graph& graph)
+    : m_codeBlock(graph.m_codeBlock)
     , m_graph(graph)
-    , m_variables(codeBlock->numParameters(), graph.m_localVars)
+    , m_variables(m_codeBlock->numParameters(), graph.m_localVars)
     , m_block(0)
 {
     size_t maxBlockSize = 0;
@@ -104,7 +104,16 @@ void AbstractState::initialize(Graph& graph)
     BasicBlock* root = graph.m_blocks[0].get();
     root->cfaShouldRevisit = true;
     for (size_t i = 0; i < root->valuesAtHead.numberOfArguments(); ++i) {
-        PredictedType prediction = graph[root->variablesAtHead.argument(i)].variableAccessData()->prediction();
+        Node& node = graph[root->variablesAtHead.argument(i)];
+        ASSERT(node.op == SetArgument);
+        if (!node.shouldGenerate()) {
+            // The argument is dead. We don't do any checks for such arguments, and so
+            // for the purpose of the analysis, they contain no value.
+            root->valuesAtHead.argument(i).clear();
+            continue;
+        }
+        
+        PredictedType prediction = node.variableAccessData()->prediction();
         if (isInt32Prediction(prediction))
             root->valuesAtHead.argument(i).set(PredictInt32);
         else if (isArrayPrediction(prediction))
@@ -153,14 +162,14 @@ bool AbstractState::endBasicBlock(MergeMode mergeMode)
     if (mergeMode != DontMerge || !ASSERT_DISABLED) {
         for (size_t argument = 0; argument < block->variablesAtTail.numberOfArguments(); ++argument) {
 #if DFG_ENABLE(DEBUG_PROPAGATION_VERBOSE)
-            printf("        Merging state for argument %zu.\n", argument);
+            dataLog("        Merging state for argument %zu.\n", argument);
 #endif
             changed |= mergeStateAtTail(block->valuesAtTail.argument(argument), m_variables.argument(argument), block->variablesAtTail.argument(argument));
         }
         
         for (size_t local = 0; local < block->variablesAtTail.numberOfLocals(); ++local) {
 #if DFG_ENABLE(DEBUG_PROPAGATION_VERBOSE)
-            printf("        Merging state for local %zu.\n", local);
+            dataLog("        Merging state for local %zu.\n", local);
 #endif
             changed |= mergeStateAtTail(block->valuesAtTail.local(local), m_variables.local(local), block->variablesAtTail.local(local));
         }
@@ -196,10 +205,13 @@ bool AbstractState::execute(NodeIndex nodeIndex)
     switch (node.op) {
     case JSConstant:
     case WeakJSConstant: {
-        JSValue value = m_graph.valueOfJSConstant(m_codeBlock, nodeIndex);
-        if (value.isCell())
-            m_haveStructures = true;
-        forNode(nodeIndex).set(value);
+        JSValue value = m_graph.valueOfJSConstant(nodeIndex);
+        // Have to be careful here! It's tempting to call set(value), but
+        // that would be wrong, since that would constitute a proof that this
+        // value will always have the same structure. The whole point of a value
+        // having a structure is that it may change in the future - for example
+        // between when we compile the code and when we run it.
+        forNode(nodeIndex).set(predictionFromValue(value));
         break;
     }
             
@@ -264,7 +276,7 @@ bool AbstractState::execute(NodeIndex nodeIndex)
             
     case ValueAdd:
     case ArithAdd: {
-        if (m_graph.addShouldSpeculateInteger(node, m_codeBlock)) {
+        if (m_graph.addShouldSpeculateInteger(node)) {
             forNode(node.child1()).filter(PredictInt32);
             forNode(node.child2()).filter(PredictInt32);
             forNode(nodeIndex).set(PredictInt32);
@@ -276,14 +288,18 @@ bool AbstractState::execute(NodeIndex nodeIndex)
             forNode(nodeIndex).set(PredictDouble);
             break;
         }
-        ASSERT(node.op == ValueAdd);
-        clobberStructures(nodeIndex);
-        forNode(nodeIndex).set(PredictString | PredictInt32 | PredictNumber);
+        if (node.op == ValueAdd) {
+            clobberStructures(nodeIndex);
+            forNode(nodeIndex).set(PredictString | PredictInt32 | PredictNumber);
+            break;
+        }
+        // We don't handle this yet. :-(
+        m_isValid = false;
         break;
     }
             
     case ArithSub: {
-        if (m_graph.addShouldSpeculateInteger(node, m_codeBlock)) {
+        if (m_graph.addShouldSpeculateInteger(node)) {
             forNode(node.child1()).filter(PredictInt32);
             forNode(node.child2()).filter(PredictInt32);
             forNode(nodeIndex).set(PredictInt32);
@@ -937,7 +953,7 @@ inline bool AbstractState::mergeStateAtTail(AbstractValue& destination, Abstract
         return false;
     
 #if DFG_ENABLE(DEBUG_PROPAGATION_VERBOSE)
-            printf("          It's live, node @%u.\n", nodeIndex);
+            dataLog("          It's live, node @%u.\n", nodeIndex);
 #endif
 
     switch (node.op) {
@@ -947,7 +963,7 @@ inline bool AbstractState::mergeStateAtTail(AbstractValue& destination, Abstract
         // The block transfers the value from head to tail.
         source = &inVariable;
 #if DFG_ENABLE(DEBUG_PROPAGATION_VERBOSE)
-        printf("          Transfering from head to tail.\n");
+        dataLog("          Transfering from head to tail.\n");
 #endif
         break;
             
@@ -955,7 +971,7 @@ inline bool AbstractState::mergeStateAtTail(AbstractValue& destination, Abstract
         // The block refines the value with additional speculations.
         source = &forNode(nodeIndex);
 #if DFG_ENABLE(DEBUG_PROPAGATION_VERBOSE)
-        printf("          Refining.\n");
+        dataLog("          Refining.\n");
 #endif
         break;
             
@@ -964,7 +980,7 @@ inline bool AbstractState::mergeStateAtTail(AbstractValue& destination, Abstract
         // before and after setting it.
         source = &forNode(node.child1());
 #if DFG_ENABLE(DEBUG_PROPAGATION_VERBOSE)
-        printf("          Setting.\n");
+        dataLog("          Setting.\n");
 #endif
         break;
         
@@ -978,7 +994,7 @@ inline bool AbstractState::mergeStateAtTail(AbstractValue& destination, Abstract
         // Abstract execution did not change the output value of the variable, for this
         // basic block, on this iteration.
 #if DFG_ENABLE(DEBUG_PROPAGATION_VERBOSE)
-        printf("          Not changed!\n");
+        dataLog("          Not changed!\n");
 #endif
         return false;
     }
@@ -988,7 +1004,7 @@ inline bool AbstractState::mergeStateAtTail(AbstractValue& destination, Abstract
     // true to indicate that the fixpoint must go on!
     destination = *source;
 #if DFG_ENABLE(DEBUG_PROPAGATION_VERBOSE)
-    printf("          Changed!\n");
+    dataLog("          Changed!\n");
 #endif
     return true;
 }
diff --git a/Source/JavaScriptCore/dfg/DFGAbstractState.h b/Source/JavaScriptCore/dfg/DFGAbstractState.h
index 015563485..256e7495f 100644
--- a/Source/JavaScriptCore/dfg/DFGAbstractState.h
+++ b/Source/JavaScriptCore/dfg/DFGAbstractState.h
@@ -92,7 +92,7 @@ public:
         MergeToSuccessors
     };
     
-    AbstractState(CodeBlock*, Graph&);
+    AbstractState(Graph&);
     
     ~AbstractState();
     
diff --git a/Source/JavaScriptCore/dfg/DFGArithNodeFlagsInferencePhase.cpp b/Source/JavaScriptCore/dfg/DFGArithNodeFlagsInferencePhase.cpp
new file mode 100644
index 000000000..f55533a61
--- /dev/null
+++ b/Source/JavaScriptCore/dfg/DFGArithNodeFlagsInferencePhase.cpp
@@ -0,0 +1,230 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "DFGArithNodeFlagsInferencePhase.h"
+
+#if ENABLE(DFG_JIT)
+
+#include "DFGGraph.h"
+#include "DFGPhase.h"
+
+namespace JSC { namespace DFG {
+
+class ArithNodeFlagsInferencePhase : public Phase {
+public:
+    ArithNodeFlagsInferencePhase(Graph& graph)
+        : Phase(graph, "arithmetic node flags inference")
+    {
+    }
+    
+    void run()
+    {
+#if DFG_ENABLE(DEBUG_PROPAGATION_VERBOSE)
+        m_count = 0;
+#endif
+        do {
+            m_changed = false;
+            
+            // Up here we start with a backward pass because we suspect that to be
+            // more profitable.
+            propagateBackward();
+            if (!m_changed)
+                break;
+            
+            m_changed = false;
+            propagateForward();
+        } while (m_changed);
+    }
+    
+private:
+    bool isNotNegZero(NodeIndex nodeIndex)
+    {
+        if (!m_graph.isNumberConstant(nodeIndex))
+            return false;
+        double value = m_graph.valueOfNumberConstant(nodeIndex);
+        return !value && 1.0 / value < 0.0;
+    }
+    
+    bool isNotZero(NodeIndex nodeIndex)
+    {
+        if (!m_graph.isNumberConstant(nodeIndex))
+            return false;
+        return !!m_graph.valueOfNumberConstant(nodeIndex);
+    }
+    
+    void propagate(Node& node)
+    {
+        if (!node.shouldGenerate())
+            return;
+        
+        NodeType op = node.op;
+        ArithNodeFlags flags = 0;
+        
+        if (node.hasArithNodeFlags())
+            flags = node.rawArithNodeFlags();
+        
+#if DFG_ENABLE(DEBUG_PROPAGATION_VERBOSE)
+        dataLog("   %s @%u: %s ", Graph::opName(op), m_compileIndex, arithNodeFlagsAsString(flags));
+#endif
+        
+        flags &= NodeUsedAsMask;
+        
+        bool changed = false;
+        
+        switch (op) {
+        case ValueToInt32:
+        case BitAnd:
+        case BitOr:
+        case BitXor:
+        case BitLShift:
+        case BitRShift:
+        case BitURShift: {
+            // These operations are perfectly happy with truncated integers,
+            // so we don't want to propagate anything.
+            break;
+        }
+            
+        case UInt32ToNumber: {
+            changed |= m_graph[node.child1()].mergeArithNodeFlags(flags);
+            break;
+        }
+            
+        case ArithAdd:
+        case ValueAdd: {
+            if (isNotNegZero(node.child1().index()) || isNotNegZero(node.child2().index()))
+                flags &= ~NodeNeedsNegZero;
+            
+            changed |= m_graph[node.child1()].mergeArithNodeFlags(flags);
+            changed |= m_graph[node.child2()].mergeArithNodeFlags(flags);
+            break;
+        }
+            
+        case ArithSub: {
+            if (isNotZero(node.child1().index()) || isNotZero(node.child2().index()))
+                flags &= ~NodeNeedsNegZero;
+            
+            changed |= m_graph[node.child1()].mergeArithNodeFlags(flags);
+            changed |= m_graph[node.child2()].mergeArithNodeFlags(flags);
+            break;
+        }
+            
+        case ArithMul:
+        case ArithDiv: {
+            // As soon as a multiply happens, we can easily end up in the part
+            // of the double domain where the point at which you do truncation
+            // can change the outcome. So, ArithMul always checks for overflow
+            // no matter what, and always forces its inputs to check as well.
+            
+            flags |= NodeUsedAsNumber | NodeNeedsNegZero;
+            changed |= m_graph[node.child1()].mergeArithNodeFlags(flags);
+            changed |= m_graph[node.child2()].mergeArithNodeFlags(flags);
+            break;
+        }
+            
+        case ArithMin:
+        case ArithMax: {
+            flags |= NodeUsedAsNumber;
+            changed |= m_graph[node.child1()].mergeArithNodeFlags(flags);
+            changed |= m_graph[node.child2()].mergeArithNodeFlags(flags);
+            break;
+        }
+            
+        case ArithAbs: {
+            flags &= ~NodeNeedsNegZero;
+            changed |= m_graph[node.child1()].mergeArithNodeFlags(flags);
+            break;
+        }
+            
+        case PutByVal: {
+            changed |= m_graph[node.child1()].mergeArithNodeFlags(flags | NodeUsedAsNumber | NodeNeedsNegZero);
+            changed |= m_graph[node.child2()].mergeArithNodeFlags(flags | NodeUsedAsNumber);
+            changed |= m_graph[node.child3()].mergeArithNodeFlags(flags | NodeUsedAsNumber | NodeNeedsNegZero);
+            break;
+        }
+            
+        case GetByVal: {
+            changed |= m_graph[node.child1()].mergeArithNodeFlags(flags | NodeUsedAsNumber | NodeNeedsNegZero);
+            changed |= m_graph[node.child2()].mergeArithNodeFlags(flags | NodeUsedAsNumber);
+            break;
+        }
+            
+        default:
+            flags |= NodeUsedAsNumber | NodeNeedsNegZero;
+            if (op & NodeHasVarArgs) {
+                for (unsigned childIdx = node.firstChild(); childIdx < node.firstChild() + node.numChildren(); childIdx++)
+                    changed |= m_graph[m_graph.m_varArgChildren[childIdx]].mergeArithNodeFlags(flags);
+            } else {
+                if (!node.child1())
+                    break;
+                changed |= m_graph[node.child1()].mergeArithNodeFlags(flags);
+                if (!node.child2())
+                    break;
+                changed |= m_graph[node.child2()].mergeArithNodeFlags(flags);
+                if (!node.child3())
+                    break;
+                changed |= m_graph[node.child3()].mergeArithNodeFlags(flags);
+            }
+            break;
+        }
+
+#if DFG_ENABLE(DEBUG_PROPAGATION_VERBOSE)
+        dataLog("%s\n", changed ? "CHANGED" : "");
+#endif
+        
+        m_changed |= changed;
+    }
+    
+    void propagateForward()
+    {
+#if DFG_ENABLE(DEBUG_PROPAGATION_VERBOSE)
+        dataLog("Propagating arithmetic node flags forward [%u]\n", ++m_count);
+#endif
+        for (m_compileIndex = 0; m_compileIndex < m_graph.size(); ++m_compileIndex)
+            propagate(m_graph[m_compileIndex]);
+    }
+    
+    void propagateBackward()
+    {
+#if DFG_ENABLE(DEBUG_PROPAGATION_VERBOSE)
+        dataLog("Propagating arithmetic node flags backward [%u]\n", ++m_count);
+#endif
+        for (m_compileIndex = m_graph.size(); m_compileIndex-- > 0;)
+            propagate(m_graph[m_compileIndex]);
+    }
+    
+    NodeIndex m_compileIndex;
+    bool m_changed;
+};
+
+void performArithNodeFlagsInference(Graph& graph)
+{
+    runPhase<ArithNodeFlagsInferencePhase>(graph);
+}
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
+
diff --git a/Source/JavaScriptCore/dfg/DFGArithNodeFlagsInferencePhase.h b/Source/JavaScriptCore/dfg/DFGArithNodeFlagsInferencePhase.h
new file mode 100644
index 000000000..64546e253
--- /dev/null
+++ b/Source/JavaScriptCore/dfg/DFGArithNodeFlagsInferencePhase.h
@@ -0,0 +1,51 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef DFGArithNodeFlagsInferencePhase_h
+#define DFGArithNodeFlagsInferencePhase_h
+
+#include <wtf/Platform.h>
+
+#if ENABLE(DFG_JIT)
+
+namespace JSC { namespace DFG {
+
+class Graph;
+
+// Determine which arithmetic nodes' results are only used in a context that
+// truncates to integer anyway. This is great for optimizing away checks for
+// overflow and negative zero. NB the way this phase integrates into the rest
+// of the DFG makes it non-optional. Instead of proving that a node is only
+// used in integer context, it actually does the opposite: finds nodes that
+// are used in non-integer contexts. Hence failing to run this phase will make
+// the compiler assume that all nodes are just used as integers!
+
+void performArithNodeFlagsInference(Graph&);
+
+} } // namespace JSC::DFG::Phase
+
+#endif // ENABLE(DFG_JIT)
+
+#endif // DFGArithNodeFlagsInferencePhase_h
diff --git a/Source/JavaScriptCore/dfg/DFGAssemblyHelpers.h b/Source/JavaScriptCore/dfg/DFGAssemblyHelpers.h
index 0d7dd3a27..00a226d4c 100644
--- a/Source/JavaScriptCore/dfg/DFGAssemblyHelpers.h
+++ b/Source/JavaScriptCore/dfg/DFGAssemblyHelpers.h
@@ -287,16 +287,6 @@ public:
         return codeOrigin.inlineCallFrame->callee->jsExecutable()->isStrictMode();
     }
     
-    static CodeBlock* baselineCodeBlockForOriginAndBaselineCodeBlock(const CodeOrigin& codeOrigin, CodeBlock* baselineCodeBlock)
-    {
-        if (codeOrigin.inlineCallFrame) {
-            ExecutableBase* executable = codeOrigin.inlineCallFrame->executable.get();
-            ASSERT(executable->structure()->classInfo() == &FunctionExecutable::s_info);
-            return static_cast<FunctionExecutable*>(executable)->baselineCodeBlockFor(codeOrigin.inlineCallFrame->isCall ? CodeForCall : CodeForConstruct);
-        }
-        return baselineCodeBlock;
-    }
-    
     CodeBlock* baselineCodeBlockFor(const CodeOrigin& codeOrigin)
     {
         return baselineCodeBlockForOriginAndBaselineCodeBlock(codeOrigin, baselineCodeBlock());
diff --git a/Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp b/Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp
index 2a5d249b3..0e575db4e 100644
--- a/Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp
+++ b/Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2011 Apple Inc. All rights reserved.
+ * Copyright (C) 2011, 2012 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -45,10 +45,10 @@ namespace JSC { namespace DFG {
 // This class is used to compile the dataflow graph from a CodeBlock.
 class ByteCodeParser {
 public:
-    ByteCodeParser(JSGlobalData* globalData, CodeBlock* codeBlock, CodeBlock* profiledBlock, Graph& graph)
-        : m_globalData(globalData)
-        , m_codeBlock(codeBlock)
-        , m_profiledBlock(profiledBlock)
+    ByteCodeParser(Graph& graph)
+        : m_globalData(&graph.m_globalData)
+        , m_codeBlock(graph.m_codeBlock)
+        , m_profiledBlock(graph.m_profiledBlock)
         , m_graph(graph)
         , m_currentBlock(0)
         , m_currentIndex(0)
@@ -57,10 +57,10 @@ public:
         , m_constantNull(UINT_MAX)
         , m_constantNaN(UINT_MAX)
         , m_constant1(UINT_MAX)
-        , m_constants(codeBlock->numberOfConstantRegisters())
-        , m_numArguments(codeBlock->numParameters())
-        , m_numLocals(codeBlock->m_numCalleeRegisters)
-        , m_preservedVars(codeBlock->m_numVars)
+        , m_constants(m_codeBlock->numberOfConstantRegisters())
+        , m_numArguments(m_codeBlock->numParameters())
+        , m_numLocals(m_codeBlock->m_numCalleeRegisters)
+        , m_preservedVars(m_codeBlock->m_numVars)
         , m_parameterSlots(0)
         , m_numPassedVarArgs(0)
         , m_globalResolveNumber(0)
@@ -69,7 +69,7 @@ public:
     {
         ASSERT(m_profiledBlock);
         
-        for (int i = 0; i < codeBlock->m_numVars; ++i)
+        for (int i = 0; i < m_codeBlock->m_numVars; ++i)
             m_preservedVars.set(i);
     }
     
@@ -108,6 +108,8 @@ private:
     };
     template<PhiStackType stackType>
     void processPhiStack();
+    
+    void fixVariableAccessPredictions();
     // Add spill locations to nodes.
     void allocateVirtualRegisters();
     
@@ -155,6 +157,22 @@ private:
     {
         setDirect(m_inlineStackTop->remapOperand(operand), value);
     }
+    
+    NodeIndex injectLazyOperandPrediction(NodeIndex nodeIndex)
+    {
+        Node& node = m_graph[nodeIndex];
+        ASSERT(node.op == GetLocal);
+        ASSERT(node.codeOrigin.bytecodeIndex == m_currentIndex);
+        PredictedType prediction = 
+            m_inlineStackTop->m_lazyOperands.prediction(
+                LazyOperandValueProfileKey(m_currentIndex, node.local()));
+#if DFG_ENABLE(DEBUG_VERBOSE)
+        dataLog("Lazy operand [@%u, bc#%u, r%d] prediction: %s\n",
+                nodeIndex, m_currentIndex, node.local(), predictionToString(prediction));
+#endif
+        node.variableAccessData()->predict(prediction);
+        return nodeIndex;
+    }
 
     // Used in implementing get/set, above, where the operand is a local variable.
     NodeIndex getLocal(unsigned operand)
@@ -170,12 +188,13 @@ private:
                 Node& flushChild = m_graph[nodePtr->child1()];
                 if (flushChild.op == Phi) {
                     VariableAccessData* variableAccessData = flushChild.variableAccessData();
-                    nodeIndex = addToGraph(GetLocal, OpInfo(variableAccessData), nodePtr->child1().index());
+                    nodeIndex = injectLazyOperandPrediction(addToGraph(GetLocal, OpInfo(variableAccessData), nodePtr->child1().index()));
                     m_currentBlock->variablesAtTail.local(operand) = nodeIndex;
                     return nodeIndex;
                 }
                 nodePtr = &flushChild;
             }
+            ASSERT(nodePtr->op != Flush);
             if (nodePtr->op == GetLocal)
                 return nodeIndex;
             ASSERT(nodePtr->op == SetLocal);
@@ -190,7 +209,7 @@ private:
         
         NodeIndex phi = addToGraph(Phi, OpInfo(variableAccessData));
         m_localPhiStack.append(PhiStackEntry(m_currentBlock, phi, operand));
-        nodeIndex = addToGraph(GetLocal, OpInfo(variableAccessData), phi);
+        nodeIndex = injectLazyOperandPrediction(addToGraph(GetLocal, OpInfo(variableAccessData), phi));
         m_currentBlock->variablesAtTail.local(operand) = nodeIndex;
         
         m_currentBlock->variablesAtHead.setLocalFirstTime(operand, nodeIndex);
@@ -219,17 +238,20 @@ private:
                 Node& flushChild = m_graph[nodePtr->child1()];
                 if (flushChild.op == Phi) {
                     VariableAccessData* variableAccessData = flushChild.variableAccessData();
-                    nodeIndex = addToGraph(GetLocal, OpInfo(variableAccessData), nodePtr->child1().index());
+                    nodeIndex = injectLazyOperandPrediction(addToGraph(GetLocal, OpInfo(variableAccessData), nodePtr->child1().index()));
                     m_currentBlock->variablesAtTail.local(operand) = nodeIndex;
                     return nodeIndex;
                 }
                 nodePtr = &flushChild;
             }
+            
+            ASSERT(nodePtr->op != Flush);
+            
             if (nodePtr->op == SetArgument) {
                 // We're getting an argument in the first basic block; link
                 // the GetLocal to the SetArgument.
                 ASSERT(nodePtr->local() == static_cast<VirtualRegister>(operand));
-                nodeIndex = addToGraph(GetLocal, OpInfo(nodePtr->variableAccessData()), nodeIndex);
+                nodeIndex = injectLazyOperandPrediction(addToGraph(GetLocal, OpInfo(nodePtr->variableAccessData()), nodeIndex));
                 m_currentBlock->variablesAtTail.argument(argument) = nodeIndex;
                 return nodeIndex;
             }
@@ -245,7 +267,7 @@ private:
 
         NodeIndex phi = addToGraph(Phi, OpInfo(variableAccessData));
         m_argumentPhiStack.append(PhiStackEntry(m_currentBlock, phi, argument));
-        nodeIndex = addToGraph(GetLocal, OpInfo(variableAccessData), phi);
+        nodeIndex = injectLazyOperandPrediction(addToGraph(GetLocal, OpInfo(variableAccessData), phi));
         m_currentBlock->variablesAtTail.argument(argument) = nodeIndex;
         
         m_currentBlock->variablesAtHead.setArgumentFirstTime(argument, nodeIndex);
@@ -282,13 +304,10 @@ private:
         
         if (nodeIndex != NoNode) {
             Node& node = m_graph[nodeIndex];
-            if (node.op == Flush || node.op == SetArgument) {
-                // If a local has already been flushed, or if it's an argument in the
-                // first basic block, then there is really no need to flush it. In fact
-                // emitting a Flush instruction could just confuse things, since the
-                // getArgument() code assumes that we never see a Flush of a SetArgument.
-                return;
-            }
+            if (node.op == Flush)
+                nodeIndex = node.child1().index();
+            
+            ASSERT(m_graph[nodeIndex].op != Flush);
         
             addToGraph(Flush, OpInfo(node.variableAccessData()), nodeIndex);
             return;
@@ -585,11 +604,9 @@ private:
     {
         UNUSED_PARAM(nodeIndex);
         
-        ValueProfile* profile = m_inlineStackTop->m_profiledBlock->valueProfileForBytecodeOffset(bytecodeIndex);
-        ASSERT(profile);
-        PredictedType prediction = profile->computeUpdatedPrediction();
+        PredictedType prediction = m_inlineStackTop->m_profiledBlock->valueProfilePredictionForBytecodeOffset(bytecodeIndex);
 #if DFG_ENABLE(DEBUG_VERBOSE)
-        printf("Dynamic [@%u, bc#%u] prediction: %s\n", nodeIndex, bytecodeIndex, predictionToString(prediction));
+        dataLog("Dynamic [@%u, bc#%u] prediction: %s\n", nodeIndex, bytecodeIndex, predictionToString(prediction));
 #endif
         
         return prediction;
@@ -626,7 +643,7 @@ private:
             return nodeIndex;
         
 #if DFG_ENABLE(DEBUG_VERBOSE)
-        printf("Making %s @%u safe at bc#%u because slow-case counter is at %u and exit profiles say %d, %d\n", Graph::opName(m_graph[nodeIndex].op), nodeIndex, m_currentIndex, m_inlineStackTop->m_profiledBlock->rareCaseProfileForBytecodeOffset(m_currentIndex)->m_counter, m_inlineStackTop->m_exitProfile.hasExitSite(m_currentIndex, Overflow), m_inlineStackTop->m_exitProfile.hasExitSite(m_currentIndex, NegativeZero));
+        dataLog("Making %s @%u safe at bc#%u because slow-case counter is at %u and exit profiles say %d, %d\n", Graph::opName(m_graph[nodeIndex].op), nodeIndex, m_currentIndex, m_inlineStackTop->m_profiledBlock->rareCaseProfileForBytecodeOffset(m_currentIndex)->m_counter, m_inlineStackTop->m_exitProfile.hasExitSite(m_currentIndex, Overflow), m_inlineStackTop->m_exitProfile.hasExitSite(m_currentIndex, NegativeZero));
 #endif
         
         switch (m_graph[nodeIndex].op) {
@@ -642,13 +659,13 @@ private:
             if (m_inlineStackTop->m_profiledBlock->likelyToTakeDeepestSlowCase(m_currentIndex)
                 || m_inlineStackTop->m_exitProfile.hasExitSite(m_currentIndex, Overflow)) {
 #if DFG_ENABLE(DEBUG_VERBOSE)
-                printf("Making ArithMul @%u take deepest slow case.\n", nodeIndex);
+                dataLog("Making ArithMul @%u take deepest slow case.\n", nodeIndex);
 #endif
                 m_graph[nodeIndex].mergeArithNodeFlags(NodeMayOverflow | NodeMayNegZero);
             } else if (m_inlineStackTop->m_profiledBlock->likelyToTakeSlowCase(m_currentIndex)
                        || m_inlineStackTop->m_exitProfile.hasExitSite(m_currentIndex, NegativeZero)) {
 #if DFG_ENABLE(DEBUG_VERBOSE)
-                printf("Making ArithMul @%u take faster slow case.\n", nodeIndex);
+                dataLog("Making ArithMul @%u take faster slow case.\n", nodeIndex);
 #endif
                 m_graph[nodeIndex].mergeArithNodeFlags(NodeMayNegZero);
             }
@@ -678,7 +695,7 @@ private:
             return nodeIndex;
         
 #if DFG_ENABLE(DEBUG_VERBOSE)
-        printf("Making %s @%u safe at bc#%u because special fast-case counter is at %u and exit profiles say %d, %d\n", Graph::opName(m_graph[nodeIndex].op), nodeIndex, m_currentIndex, m_inlineStackTop->m_profiledBlock->specialFastCaseProfileForBytecodeOffset(m_currentIndex)->m_counter, m_inlineStackTop->m_exitProfile.hasExitSite(m_currentIndex, Overflow), m_inlineStackTop->m_exitProfile.hasExitSite(m_currentIndex, NegativeZero));
+        dataLog("Making %s @%u safe at bc#%u because special fast-case counter is at %u and exit profiles say %d, %d\n", Graph::opName(m_graph[nodeIndex].op), nodeIndex, m_currentIndex, m_inlineStackTop->m_profiledBlock->specialFastCaseProfileForBytecodeOffset(m_currentIndex)->m_counter, m_inlineStackTop->m_exitProfile.hasExitSite(m_currentIndex, Overflow), m_inlineStackTop->m_exitProfile.hasExitSite(m_currentIndex, NegativeZero));
 #endif
         
         // FIXME: It might be possible to make this more granular. The DFG certainly can
@@ -850,6 +867,11 @@ private:
         
         VirtualRegister m_returnValue;
         
+        // Predictions about variable types collected from the profiled code block,
+        // which are based on OSR exit profiles that past DFG compilatins of this
+        // code block had gathered.
+        LazyOperandValueProfileParser m_lazyOperands;
+        
         // Did we see any returns? We need to handle the (uncommon but necessary)
         // case where a procedure that does not return was inlined.
         bool m_didReturn;
@@ -912,13 +934,13 @@ void ByteCodeParser::handleCall(Interpreter* interpreter, Instruction* currentIn
     enum { ConstantFunction, LinkedFunction, UnknownFunction } callType;
             
 #if DFG_ENABLE(DEBUG_VERBOSE)
-    printf("Slow case count for call at @%zu bc#%u: %u/%u; exit profile: %d.\n", m_graph.size(), m_currentIndex, m_inlineStackTop->m_profiledBlock->rareCaseProfileForBytecodeOffset(m_currentIndex)->m_counter, m_inlineStackTop->m_profiledBlock->executionEntryCount(), m_inlineStackTop->m_exitProfile.hasExitSite(m_currentIndex, BadCache));
+    dataLog("Slow case count for call at @%zu bc#%u: %u/%u; exit profile: %d.\n", m_graph.size(), m_currentIndex, m_inlineStackTop->m_profiledBlock->rareCaseProfileForBytecodeOffset(m_currentIndex)->m_counter, m_inlineStackTop->m_profiledBlock->executionEntryCount(), m_inlineStackTop->m_exitProfile.hasExitSite(m_currentIndex, BadCache));
 #endif
     
     CallLinkStatus callLinkStatus = CallLinkStatus::computeFor(
         m_inlineStackTop->m_profiledBlock, m_currentIndex);
     
-    if (m_graph.isFunctionConstant(m_codeBlock, callTarget))
+    if (m_graph.isFunctionConstant(callTarget))
         callType = ConstantFunction;
     else if (callLinkStatus.isSet() && !callLinkStatus.couldTakeSlowPath()
              && !m_inlineStackTop->m_exitProfile.hasExitSite(m_currentIndex, BadCache))
@@ -946,7 +968,7 @@ void ByteCodeParser::handleCall(Interpreter* interpreter, Instruction* currentIn
         Intrinsic intrinsic;
         bool certainAboutExpectedFunction;
         if (callType == ConstantFunction) {
-            expectedFunction = m_graph.valueOfFunctionConstant(m_codeBlock, callTarget);
+            expectedFunction = m_graph.valueOfFunctionConstant(callTarget);
             intrinsic = expectedFunction->executable()->intrinsicFor(kind);
             certainAboutExpectedFunction = true;
         } else {
@@ -1022,6 +1044,9 @@ bool ByteCodeParser::handleInlining(bool usesResult, int callTarget, NodeIndex c
     
     // If we get here then it looks like we should definitely inline this code. Proceed
     // with parsing the code to get bytecode, so that we can then parse the bytecode.
+    // Note that if LLInt is enabled, the bytecode will always be available. Also note
+    // that if LLInt is enabled, we may inline a code block that has never been JITted
+    // before!
     CodeBlock* codeBlock = m_codeBlockCache.get(CodeBlockKey(executable, kind), expectedFunction->scope());
     if (!codeBlock)
         return false;
@@ -1029,7 +1054,7 @@ bool ByteCodeParser::handleInlining(bool usesResult, int callTarget, NodeIndex c
     ASSERT(canInlineFunctionFor(codeBlock, kind));
 
 #if DFG_ENABLE(DEBUG_VERBOSE)
-    printf("Inlining executable %p.\n", executable);
+    dataLog("Inlining executable %p.\n", executable);
 #endif
     
     // Now we know without a doubt that we are committed to inlining. So begin the process
@@ -1110,7 +1135,7 @@ bool ByteCodeParser::handleInlining(bool usesResult, int callTarget, NodeIndex c
         // caller. It doesn't need to be linked to, but it needs outgoing links.
         if (!inlineStackEntry.m_unlinkedBlocks.isEmpty()) {
 #if DFG_ENABLE(DEBUG_VERBOSE)
-            printf("Reascribing bytecode index of block %p from bc#%u to bc#%u (inline return case).\n", lastBlock, lastBlock->bytecodeBegin, m_currentIndex);
+            dataLog("Reascribing bytecode index of block %p from bc#%u to bc#%u (inline return case).\n", lastBlock, lastBlock->bytecodeBegin, m_currentIndex);
 #endif
             // For debugging purposes, set the bytecodeBegin. Note that this doesn't matter
             // for release builds because this block will never serve as a potential target
@@ -1122,7 +1147,7 @@ bool ByteCodeParser::handleInlining(bool usesResult, int callTarget, NodeIndex c
         m_currentBlock = m_graph.m_blocks.last().get();
 
 #if DFG_ENABLE(DEBUG_VERBOSE)
-        printf("Done inlining executable %p, continuing code generation at epilogue.\n", executable);
+        dataLog("Done inlining executable %p, continuing code generation at epilogue.\n", executable);
 #endif
         return true;
     }
@@ -1149,7 +1174,7 @@ bool ByteCodeParser::handleInlining(bool usesResult, int callTarget, NodeIndex c
     // Need to create a new basic block for the continuation at the caller.
     OwnPtr<BasicBlock> block = adoptPtr(new BasicBlock(nextOffset, m_graph.size(), m_numArguments, m_numLocals));
 #if DFG_ENABLE(DEBUG_VERBOSE)
-    printf("Creating inline epilogue basic block %p, #%zu for %p bc#%u at inline depth %u.\n", block.get(), m_graph.m_blocks.size(), m_inlineStackTop->executable(), m_currentIndex, CodeOrigin::inlineDepthForCallFrame(m_inlineStackTop->m_inlineCallFrame));
+    dataLog("Creating inline epilogue basic block %p, #%zu for %p bc#%u at inline depth %u.\n", block.get(), m_graph.m_blocks.size(), m_inlineStackTop->executable(), m_currentIndex, CodeOrigin::inlineDepthForCallFrame(m_inlineStackTop->m_inlineCallFrame));
 #endif
     m_currentBlock = block.get();
     ASSERT(m_inlineStackTop->m_caller->m_blockLinkingTargets.isEmpty() || m_graph.m_blocks[m_inlineStackTop->m_caller->m_blockLinkingTargets.last()]->bytecodeBegin < nextOffset);
@@ -1161,7 +1186,7 @@ bool ByteCodeParser::handleInlining(bool usesResult, int callTarget, NodeIndex c
     // At this point we return and continue to generate code for the caller, but
     // in the new basic block.
 #if DFG_ENABLE(DEBUG_VERBOSE)
-    printf("Done inlining executable %p, continuing code generation in new block.\n", executable);
+    dataLog("Done inlining executable %p, continuing code generation in new block.\n", executable);
 #endif
     return true;
 }
@@ -1343,7 +1368,7 @@ bool ByteCodeParser::parseBlock(unsigned limit)
                 addToGraph(Jump, OpInfo(m_currentIndex));
             else {
 #if DFG_ENABLE(DEBUG_VERBOSE)
-                printf("Refusing to plant jump at limit %u because block %p is empty.\n", limit, m_currentBlock);
+                dataLog("Refusing to plant jump at limit %u because block %p is empty.\n", limit, m_currentBlock);
 #endif
             }
             return shouldContinueParsing;
@@ -1722,7 +1747,7 @@ bool ByteCodeParser::parseBlock(unsigned limit)
                 m_inlineStackTop->m_profiledBlock, m_currentIndex);
             
             if (methodCallStatus.isSet()
-                && !getByIdStatus.isSet()
+                && !getByIdStatus.wasSeenInJIT()
                 && !m_inlineStackTop->m_exitProfile.hasExitSite(m_currentIndex, BadCache)) {
                 // It's monomorphic as far as we can tell, since the method_check was linked
                 // but the slow path (i.e. the normal get_by_id) never fired.
@@ -1767,7 +1792,7 @@ bool ByteCodeParser::parseBlock(unsigned limit)
                 m_inlineStackTop->m_profiledBlock, m_currentIndex, identifier);
             
 #if DFG_ENABLE(DEBUG_VERBOSE)
-            printf("Slow case count for GetById @%zu bc#%u: %u; exit profile: %d\n", m_graph.size(), m_currentIndex, m_inlineStackTop->m_profiledBlock->rareCaseProfileForBytecodeOffset(m_currentIndex)->m_counter, m_inlineStackTop->m_exitProfile.hasExitSite(m_currentIndex, BadCache));
+            dataLog("Slow case count for GetById @%zu bc#%u: %u; exit profile: %d\n", m_graph.size(), m_currentIndex, m_inlineStackTop->m_profiledBlock->rareCaseProfileForBytecodeOffset(m_currentIndex)->m_counter, m_inlineStackTop->m_exitProfile.hasExitSite(m_currentIndex, BadCache));
 #endif
             
             if (getByIdStatus.isSimpleDirect()
@@ -1791,7 +1816,9 @@ bool ByteCodeParser::parseBlock(unsigned limit)
 
             NEXT_OPCODE(op_get_by_id);
         }
-        case op_put_by_id: {
+        case op_put_by_id:
+        case op_put_by_id_transition_direct:
+        case op_put_by_id_transition_normal: {
             NodeIndex value = get(currentInstruction[3].u.operand);
             NodeIndex base = get(currentInstruction[1].u.operand);
             unsigned identifierNumber = m_inlineStackTop->m_identifierRemap[currentInstruction[2].u.operand];
@@ -1807,7 +1834,7 @@ bool ByteCodeParser::parseBlock(unsigned limit)
             bool hasExitSite = m_inlineStackTop->m_exitProfile.hasExitSite(m_currentIndex, BadCache);
             
 #if DFG_ENABLE(DEBUG_VERBOSE)
-            printf("Slow case count for PutById @%zu bc#%u: %u; exit profile: %d\n", m_graph.size(), m_currentIndex, m_inlineStackTop->m_profiledBlock->rareCaseProfileForBytecodeOffset(m_currentIndex)->m_counter, m_inlineStackTop->m_exitProfile.hasExitSite(m_currentIndex, BadCache));
+            dataLog("Slow case count for PutById @%zu bc#%u: %u; exit profile: %d\n", m_graph.size(), m_currentIndex, m_inlineStackTop->m_profiledBlock->rareCaseProfileForBytecodeOffset(m_currentIndex)->m_counter, m_inlineStackTop->m_exitProfile.hasExitSite(m_currentIndex, BadCache));
 #endif            
 
             if (!hasExitSite && putByIdStatus.isSimpleReplace()) {
@@ -2186,12 +2213,12 @@ void ByteCodeParser::processPhiStack()
         VariableAccessData* dataForPhi = m_graph[entry.m_phi].variableAccessData();
 
 #if DFG_ENABLE(DEBUG_PROPAGATION_VERBOSE)
-        printf("   Handling phi entry for var %u, phi @%u.\n", entry.m_varNo, entry.m_phi);
+        dataLog("   Handling phi entry for var %u, phi @%u.\n", entry.m_varNo, entry.m_phi);
 #endif
 
         for (size_t i = 0; i < predecessors.size(); ++i) {
 #if DFG_ENABLE(DEBUG_PROPAGATION_VERBOSE)
-            printf("     Dealing with predecessor block %u.\n", predecessors[i]);
+            dataLog("     Dealing with predecessor block %u.\n", predecessors[i]);
 #endif
             
             BasicBlock* predecessorBlock = m_graph.m_blocks[predecessors[i]].get();
@@ -2201,7 +2228,7 @@ void ByteCodeParser::processPhiStack()
             NodeIndex valueInPredecessor = var;
             if (valueInPredecessor == NoNode) {
 #if DFG_ENABLE(DEBUG_PROPAGATION_VERBOSE)
-                printf("      Did not find node, adding phi.\n");
+                dataLog("      Did not find node, adding phi.\n");
 #endif
 
                 valueInPredecessor = addToGraph(Phi, OpInfo(newVariableAccessData(stackType == ArgumentPhiStack ? argumentToOperand(varNo) : static_cast<int>(varNo))));
@@ -2213,7 +2240,7 @@ void ByteCodeParser::processPhiStack()
                 phiStack.append(PhiStackEntry(predecessorBlock, valueInPredecessor, varNo));
             } else if (m_graph[valueInPredecessor].op == GetLocal) {
 #if DFG_ENABLE(DEBUG_PROPAGATION_VERBOSE)
-                printf("      Found GetLocal @%u.\n", valueInPredecessor);
+                dataLog("      Found GetLocal @%u.\n", valueInPredecessor);
 #endif
 
                 // We want to ensure that the VariableAccessDatas are identical between the
@@ -2225,7 +2252,7 @@ void ByteCodeParser::processPhiStack()
                 valueInPredecessor = m_graph[valueInPredecessor].child1().index();
             } else {
 #if DFG_ENABLE(DEBUG_PROPAGATION_VERBOSE)
-                printf("      Found @%u.\n", valueInPredecessor);
+                dataLog("      Found @%u.\n", valueInPredecessor);
 #endif
             }
             ASSERT(m_graph[valueInPredecessor].op == SetLocal || m_graph[valueInPredecessor].op == Phi || m_graph[valueInPredecessor].op == Flush || (m_graph[valueInPredecessor].op == SetArgument && stackType == ArgumentPhiStack));
@@ -2236,48 +2263,48 @@ void ByteCodeParser::processPhiStack()
 
             Node* phiNode = &m_graph[entry.m_phi];
 #if DFG_ENABLE(DEBUG_PROPAGATION_VERBOSE)
-            printf("      Ref count of @%u = %u.\n", entry.m_phi, phiNode->refCount());
+            dataLog("      Ref count of @%u = %u.\n", entry.m_phi, phiNode->refCount());
 #endif
             if (phiNode->refCount()) {
 #if DFG_ENABLE(DEBUG_PROPAGATION_VERBOSE)
-                printf("      Reffing @%u.\n", valueInPredecessor);
+                dataLog("      Reffing @%u.\n", valueInPredecessor);
 #endif
                 m_graph.ref(valueInPredecessor);
             }
 
             if (!phiNode->child1()) {
 #if DFG_ENABLE(DEBUG_PROPAGATION_VERBOSE)
-                printf("      Setting @%u->child1 = @%u.\n", entry.m_phi, valueInPredecessor);
+                dataLog("      Setting @%u->child1 = @%u.\n", entry.m_phi, valueInPredecessor);
 #endif
                 phiNode->children.setChild1(NodeUse(valueInPredecessor));
 #if DFG_ENABLE(DEBUG_PROPAGATION_VERBOSE)
-                printf("      Children of @%u: ", entry.m_phi);
-                phiNode->dumpChildren(stdout);
-                printf(".\n");
+                dataLog("      Children of @%u: ", entry.m_phi);
+                phiNode->dumpChildren(WTF::dataFile());
+                dataLog(".\n");
 #endif
                 continue;
             }
             if (!phiNode->child2()) {
 #if DFG_ENABLE(DEBUG_PROPAGATION_VERBOSE)
-                printf("      Setting @%u->child2 = @%u.\n", entry.m_phi, valueInPredecessor);
+                dataLog("      Setting @%u->child2 = @%u.\n", entry.m_phi, valueInPredecessor);
 #endif
                 phiNode->children.setChild2(NodeUse(valueInPredecessor));
 #if DFG_ENABLE(DEBUG_PROPAGATION_VERBOSE)
-                printf("      Children of @%u: ", entry.m_phi);
-                phiNode->dumpChildren(stdout);
-                printf(".\n");
+                dataLog("      Children of @%u: ", entry.m_phi);
+                phiNode->dumpChildren(WTF::dataFile());
+                dataLog(".\n");
 #endif
                 continue;
             }
             if (!phiNode->child3()) {
 #if DFG_ENABLE(DEBUG_PROPAGATION_VERBOSE)
-                printf("      Setting @%u->child3 = @%u.\n", entry.m_phi, valueInPredecessor);
+                dataLog("      Setting @%u->child3 = @%u.\n", entry.m_phi, valueInPredecessor);
 #endif
                 phiNode->children.setChild3(NodeUse(valueInPredecessor));
 #if DFG_ENABLE(DEBUG_PROPAGATION_VERBOSE)
-                printf("      Children of @%u: ", entry.m_phi);
-                phiNode->dumpChildren(stdout);
-                printf(".\n");
+                dataLog("      Children of @%u: ", entry.m_phi);
+                phiNode->dumpChildren(WTF::dataFile());
+                dataLog(".\n");
 #endif
                 continue;
             }
@@ -2285,7 +2312,7 @@ void ByteCodeParser::processPhiStack()
             NodeIndex newPhi = addToGraph(Phi, OpInfo(dataForPhi));
             
 #if DFG_ENABLE(DEBUG_PROPAGATION_VERBOSE)
-            printf("      Splitting @%u, created @%u.\n", entry.m_phi, newPhi);
+            dataLog("      Splitting @%u, created @%u.\n", entry.m_phi, newPhi);
 #endif
 
             phiNode = &m_graph[entry.m_phi]; // reload after vector resize
@@ -2296,22 +2323,30 @@ void ByteCodeParser::processPhiStack()
             newPhiNode.children = phiNode->children;
 
 #if DFG_ENABLE(DEBUG_PROPAGATION_VERBOSE)
-            printf("      Children of @%u: ", newPhi);
-            newPhiNode.dumpChildren(stdout);
-            printf(".\n");
+            dataLog("      Children of @%u: ", newPhi);
+            newPhiNode.dumpChildren(WTF::dataFile());
+            dataLog(".\n");
 #endif
 
             phiNode->children.initialize(newPhi, valueInPredecessor, NoNode);
 
 #if DFG_ENABLE(DEBUG_PROPAGATION_VERBOSE)
-            printf("      Children of @%u: ", entry.m_phi);
-            phiNode->dumpChildren(stdout);
-            printf(".\n");
+            dataLog("      Children of @%u: ", entry.m_phi);
+            phiNode->dumpChildren(WTF::dataFile());
+            dataLog(".\n");
 #endif
         }
     }
 }
 
+void ByteCodeParser::fixVariableAccessPredictions()
+{
+    for (unsigned i = 0; i < m_graph.m_variableAccessData.size(); ++i) {
+        VariableAccessData* data = &m_graph.m_variableAccessData[i];
+        data->find()->predict(data->nonUnifiedPrediction());
+    }
+}
+
 void ByteCodeParser::linkBlock(BasicBlock* block, Vector<BlockIndex>& possibleTargets)
 {
     ASSERT(block->end != NoNode);
@@ -2324,7 +2359,7 @@ void ByteCodeParser::linkBlock(BasicBlock* block, Vector<BlockIndex>& possibleTa
     case Jump:
         node.setTakenBlockIndex(m_graph.blockIndexForBytecodeOffset(possibleTargets, node.takenBytecodeOffsetDuringParsing()));
 #if DFG_ENABLE(DEBUG_VERBOSE)
-        printf("Linked basic block %p to %p, #%u.\n", block, m_graph.m_blocks[node.takenBlockIndex()].get(), node.takenBlockIndex());
+        dataLog("Linked basic block %p to %p, #%u.\n", block, m_graph.m_blocks[node.takenBlockIndex()].get(), node.takenBlockIndex());
 #endif
         break;
         
@@ -2332,13 +2367,13 @@ void ByteCodeParser::linkBlock(BasicBlock* block, Vector<BlockIndex>& possibleTa
         node.setTakenBlockIndex(m_graph.blockIndexForBytecodeOffset(possibleTargets, node.takenBytecodeOffsetDuringParsing()));
         node.setNotTakenBlockIndex(m_graph.blockIndexForBytecodeOffset(possibleTargets, node.notTakenBytecodeOffsetDuringParsing()));
 #if DFG_ENABLE(DEBUG_VERBOSE)
-        printf("Linked basic block %p to %p, #%u and %p, #%u.\n", block, m_graph.m_blocks[node.takenBlockIndex()].get(), node.takenBlockIndex(), m_graph.m_blocks[node.notTakenBlockIndex()].get(), node.notTakenBlockIndex());
+        dataLog("Linked basic block %p to %p, #%u and %p, #%u.\n", block, m_graph.m_blocks[node.takenBlockIndex()].get(), node.takenBlockIndex(), m_graph.m_blocks[node.notTakenBlockIndex()].get(), node.notTakenBlockIndex());
 #endif
         break;
         
     default:
 #if DFG_ENABLE(DEBUG_VERBOSE)
-        printf("Marking basic block %p as linked.\n", block);
+        dataLog("Marking basic block %p as linked.\n", block);
 #endif
         break;
     }
@@ -2414,6 +2449,7 @@ ByteCodeParser::InlineStackEntry::InlineStackEntry(ByteCodeParser* byteCodeParse
     , m_exitProfile(profiledBlock->exitProfile())
     , m_callsiteBlockHead(callsiteBlockHead)
     , m_returnValue(returnValueVR)
+    , m_lazyOperands(profiledBlock->lazyOperandValueProfiles())
     , m_didReturn(false)
     , m_didEarlyReturn(false)
     , m_caller(byteCodeParser->m_inlineStackTop)
@@ -2495,7 +2531,7 @@ void ByteCodeParser::parseCodeBlock()
         // The maximum bytecode offset to go into the current basicblock is either the next jump target, or the end of the instructions.
         unsigned limit = jumpTargetIndex < codeBlock->numberOfJumpTargets() ? codeBlock->jumpTarget(jumpTargetIndex) : codeBlock->instructions().size();
 #if DFG_ENABLE(DEBUG_VERBOSE)
-        printf("Parsing bytecode with limit %p bc#%u at inline depth %u.\n", m_inlineStackTop->executable(), limit, CodeOrigin::inlineDepthForCallFrame(m_inlineStackTop->m_inlineCallFrame));
+        dataLog("Parsing bytecode with limit %p bc#%u at inline depth %u.\n", m_inlineStackTop->executable(), limit, CodeOrigin::inlineDepthForCallFrame(m_inlineStackTop->m_inlineCallFrame));
 #endif
         ASSERT(m_currentIndex < limit);
 
@@ -2517,13 +2553,13 @@ void ByteCodeParser::parseCodeBlock()
                     // Change its bytecode begin and continue.
                     m_currentBlock = m_graph.m_blocks.last().get();
 #if DFG_ENABLE(DEBUG_VERBOSE)
-                    printf("Reascribing bytecode index of block %p from bc#%u to bc#%u (peephole case).\n", m_currentBlock, m_currentBlock->bytecodeBegin, m_currentIndex);
+                    dataLog("Reascribing bytecode index of block %p from bc#%u to bc#%u (peephole case).\n", m_currentBlock, m_currentBlock->bytecodeBegin, m_currentIndex);
 #endif
                     m_currentBlock->bytecodeBegin = m_currentIndex;
                 } else {
                     OwnPtr<BasicBlock> block = adoptPtr(new BasicBlock(m_currentIndex, m_graph.size(), m_numArguments, m_numLocals));
 #if DFG_ENABLE(DEBUG_VERBOSE)
-                    printf("Creating basic block %p, #%zu for %p bc#%u at inline depth %u.\n", block.get(), m_graph.m_blocks.size(), m_inlineStackTop->executable(), m_currentIndex, CodeOrigin::inlineDepthForCallFrame(m_inlineStackTop->m_inlineCallFrame));
+                    dataLog("Creating basic block %p, #%zu for %p bc#%u at inline depth %u.\n", block.get(), m_graph.m_blocks.size(), m_inlineStackTop->executable(), m_currentIndex, CodeOrigin::inlineDepthForCallFrame(m_inlineStackTop->m_inlineCallFrame));
 #endif
                     m_currentBlock = block.get();
                     ASSERT(m_inlineStackTop->m_unlinkedBlocks.isEmpty() || m_graph.m_blocks[m_inlineStackTop->m_unlinkedBlocks.last().m_blockIndex]->bytecodeBegin < m_currentIndex);
@@ -2571,17 +2607,19 @@ bool ByteCodeParser::parse()
     linkBlocks(inlineStackEntry.m_unlinkedBlocks, inlineStackEntry.m_blockLinkingTargets);
     determineReachability();
 #if DFG_ENABLE(DEBUG_PROPAGATION_VERBOSE)
-    printf("Processing local variable phis.\n");
+    dataLog("Processing local variable phis.\n");
 #endif
     
     m_currentProfilingIndex = m_currentIndex;
     
     processPhiStack<LocalPhiStack>();
 #if DFG_ENABLE(DEBUG_PROPAGATION_VERBOSE)
-    printf("Processing argument phis.\n");
+    dataLog("Processing argument phis.\n");
 #endif
     processPhiStack<ArgumentPhiStack>();
     
+    fixVariableAccessPredictions();
+    
     m_graph.m_preservedVars = m_preservedVars;
     m_graph.m_localVars = m_numLocals;
     m_graph.m_parameterSlots = m_parameterSlots;
@@ -2589,15 +2627,13 @@ bool ByteCodeParser::parse()
     return true;
 }
 
-bool parse(Graph& graph, JSGlobalData* globalData, CodeBlock* codeBlock)
+bool parse(Graph& graph)
 {
 #if DFG_DEBUG_LOCAL_DISBALE
     UNUSED_PARAM(graph);
-    UNUSED_PARAM(globalData);
-    UNUSED_PARAM(codeBlock);
     return false;
 #else
-    return ByteCodeParser(globalData, codeBlock, codeBlock->alternative(), graph).parse();
+    return ByteCodeParser(graph).parse();
 #endif
 }
 
diff --git a/Source/JavaScriptCore/dfg/DFGByteCodeParser.h b/Source/JavaScriptCore/dfg/DFGByteCodeParser.h
index d4efe61db..558cf0167 100644
--- a/Source/JavaScriptCore/dfg/DFGByteCodeParser.h
+++ b/Source/JavaScriptCore/dfg/DFGByteCodeParser.h
@@ -39,7 +39,7 @@ namespace DFG {
 
 // Populate the Graph with a basic block of code from the CodeBlock,
 // starting at the provided bytecode index.
-bool parse(Graph&, JSGlobalData*, CodeBlock*);
+bool parse(Graph&);
 
 } } // namespace JSC::DFG
 
diff --git a/Source/JavaScriptCore/dfg/DFGCFAPhase.cpp b/Source/JavaScriptCore/dfg/DFGCFAPhase.cpp
new file mode 100644
index 000000000..ac1e26c19
--- /dev/null
+++ b/Source/JavaScriptCore/dfg/DFGCFAPhase.cpp
@@ -0,0 +1,132 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "DFGCFAPhase.h"
+
+#if ENABLE(DFG_JIT)
+
+#include "DFGAbstractState.h"
+#include "DFGGraph.h"
+#include "DFGPhase.h"
+
+namespace JSC { namespace DFG {
+
+class CFAPhase : public Phase {
+public:
+    CFAPhase(Graph& graph)
+        : Phase(graph, "control flow analysis")
+        , m_state(graph)
+    {
+    }
+    
+    void run()
+    {
+#if DFG_ENABLE(DEBUG_PROPAGATION_VERBOSE)
+        m_count = 0;
+#endif
+        
+        // This implements a pseudo-worklist-based forward CFA, except that the visit order
+        // of blocks is the bytecode program order (which is nearly topological), and
+        // instead of a worklist we just walk all basic blocks checking if cfaShouldRevisit
+        // is set to true. This is likely to balance the efficiency properties of both
+        // worklist-based and forward fixpoint-based approaches. Like a worklist-based
+        // approach, it won't visit code if it's meaningless to do so (nothing changed at
+        // the head of the block or the predecessors have not been visited). Like a forward
+        // fixpoint-based approach, it has a high probability of only visiting a block
+        // after all predecessors have been visited. Only loops will cause this analysis to
+        // revisit blocks, and the amount of revisiting is proportional to loop depth.
+        
+        AbstractState::initialize(m_graph);
+        
+        do {
+            m_changed = false;
+            performForwardCFA();
+        } while (m_changed);
+    }
+    
+private:
+    void performBlockCFA(BlockIndex blockIndex)
+    {
+        BasicBlock* block = m_graph.m_blocks[blockIndex].get();
+        if (!block->cfaShouldRevisit)
+            return;
+#if DFG_ENABLE(DEBUG_PROPAGATION_VERBOSE)
+        dataLog("   Block #%u (bc#%u):\n", blockIndex, block->bytecodeBegin);
+#endif
+        m_state.beginBasicBlock(block);
+#if DFG_ENABLE(DEBUG_PROPAGATION_VERBOSE)
+        dataLog("      head vars: ");
+        dumpOperands(block->valuesAtHead, WTF::dataFile());
+        dataLog("\n");
+#endif
+        for (NodeIndex nodeIndex = block->begin; nodeIndex < block->end; ++nodeIndex) {
+            if (!m_graph[nodeIndex].shouldGenerate())
+                continue;
+#if DFG_ENABLE(DEBUG_PROPAGATION_VERBOSE)
+            dataLog("      %s @%u: ", Graph::opName(m_graph[nodeIndex].op), nodeIndex);
+            m_state.dump(WTF::dataFile());
+            dataLog("\n");
+#endif
+            if (!m_state.execute(nodeIndex))
+                break;
+        }
+#if DFG_ENABLE(DEBUG_PROPAGATION_VERBOSE)
+        dataLog("      tail regs: ");
+        m_state.dump(WTF::dataFile());
+        dataLog("\n");
+#endif
+        m_changed |= m_state.endBasicBlock(AbstractState::MergeToSuccessors);
+#if DFG_ENABLE(DEBUG_PROPAGATION_VERBOSE)
+        dataLog("      tail vars: ");
+        dumpOperands(block->valuesAtTail, WTF::dataFile());
+        dataLog("\n");
+#endif
+    }
+    
+    void performForwardCFA()
+    {
+#if DFG_ENABLE(DEBUG_PROPAGATION_VERBOSE)
+        dataLog("CFA [%u]\n", ++m_count);
+#endif
+        
+        for (BlockIndex block = 0; block < m_graph.m_blocks.size(); ++block)
+            performBlockCFA(block);
+    }
+
+private:
+    AbstractState m_state;
+    
+    bool m_changed;
+};
+
+void performCFA(Graph& graph)
+{
+    runPhase<CFAPhase>(graph);
+}
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
diff --git a/Source/JavaScriptCore/dfg/DFGCFAPhase.h b/Source/JavaScriptCore/dfg/DFGCFAPhase.h
new file mode 100644
index 000000000..2b626c81f
--- /dev/null
+++ b/Source/JavaScriptCore/dfg/DFGCFAPhase.h
@@ -0,0 +1,49 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef DFGCFAPhase_h
+#define DFGCFAPhase_h
+
+#include <wtf/Platform.h>
+
+#if ENABLE(DFG_JIT)
+
+namespace JSC { namespace DFG {
+
+class Graph;
+
+// Global control flow analysis. This phase transforms the combination of type
+// predictions and type guards into type proofs, and flows them globally within
+// the code block. It's also responsible for identifying dead code, and in the
+// future should be used as a hook for constant propagation.
+
+void performCFA(Graph&);
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
+
+#endif // DFGCFAPhase_h
+
diff --git a/Source/JavaScriptCore/dfg/DFGCSEPhase.cpp b/Source/JavaScriptCore/dfg/DFGCSEPhase.cpp
new file mode 100644
index 000000000..a3c27ebc1
--- /dev/null
+++ b/Source/JavaScriptCore/dfg/DFGCSEPhase.cpp
@@ -0,0 +1,733 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "DFGCSEPhase.h"
+
+#if ENABLE(DFG_JIT)
+
+#include "DFGGraph.h"
+#include "DFGPhase.h"
+
+namespace JSC { namespace DFG {
+
+class CSEPhase : public Phase {
+public:
+    CSEPhase(Graph& graph)
+        : Phase(graph, "common subexpression elimination")
+    {
+        // Replacements are used to implement local common subexpression elimination.
+        m_replacements.resize(m_graph.size());
+        
+        for (unsigned i = 0; i < m_graph.size(); ++i)
+            m_replacements[i] = NoNode;
+        
+        for (unsigned i = 0; i < LastNodeId; ++i)
+            m_lastSeen[i] = NoNode;
+    }
+    
+    void run()
+    {
+        for (unsigned block = 0; block < m_graph.m_blocks.size(); ++block)
+            performBlockCSE(*m_graph.m_blocks[block]);
+    }
+    
+private:
+    
+    NodeIndex canonicalize(NodeIndex nodeIndex)
+    {
+        if (nodeIndex == NoNode)
+            return NoNode;
+        
+        if (m_graph[nodeIndex].op == ValueToInt32)
+            nodeIndex = m_graph[nodeIndex].child1().index();
+        
+        return nodeIndex;
+    }
+    NodeIndex canonicalize(NodeUse nodeUse)
+    {
+        return canonicalize(nodeUse.indexUnchecked());
+    }
+    
+    // Computes where the search for a candidate for CSE should start. Don't call
+    // this directly; call startIndex() instead as it does logging in debug mode.
+    NodeIndex computeStartIndexForChildren(NodeIndex child1 = NoNode, NodeIndex child2 = NoNode, NodeIndex child3 = NoNode)
+    {
+        const unsigned limit = 300;
+        
+        NodeIndex start = m_start;
+        if (m_compileIndex - start > limit)
+            start = m_compileIndex - limit;
+        
+        ASSERT(start >= m_start);
+        
+        NodeIndex child = canonicalize(child1);
+        if (child == NoNode)
+            return start;
+        
+        if (start < child)
+            start = child;
+        
+        child = canonicalize(child2);
+        if (child == NoNode)
+            return start;
+        
+        if (start < child)
+            start = child;
+        
+        child = canonicalize(child3);
+        if (child == NoNode)
+            return start;
+        
+        if (start < child)
+            start = child;
+        
+        return start;
+    }
+    
+    NodeIndex startIndexForChildren(NodeIndex child1 = NoNode, NodeIndex child2 = NoNode, NodeIndex child3 = NoNode)
+    {
+        NodeIndex result = computeStartIndexForChildren(child1, child2, child3);
+#if DFG_ENABLE(DEBUG_PROPAGATION_VERBOSE)
+        dataLog("  lookback %u: ", result);
+#endif
+        return result;
+    }
+    
+    NodeIndex startIndex()
+    {
+        Node& node = m_graph[m_compileIndex];
+        return startIndexForChildren(
+            node.child1().indexUnchecked(),
+            node.child2().indexUnchecked(),
+            node.child3().indexUnchecked());
+    }
+    
+    NodeIndex endIndexForPureCSE()
+    {
+        NodeIndex result = m_lastSeen[m_graph[m_compileIndex].op & NodeIdMask];
+        if (result == NoNode)
+            result = 0;
+        else
+            result++;
+        ASSERT(result <= m_compileIndex);
+#if DFG_ENABLE(DEBUG_PROPAGATION_VERBOSE)
+        dataLog("  limit %u: ", result);
+#endif
+        return result;
+    }
+    
+    NodeIndex pureCSE(Node& node)
+    {
+        NodeIndex child1 = canonicalize(node.child1());
+        NodeIndex child2 = canonicalize(node.child2());
+        NodeIndex child3 = canonicalize(node.child3());
+        
+        NodeIndex start = startIndex();
+        for (NodeIndex index = endIndexForPureCSE(); index-- > start;) {
+            Node& otherNode = m_graph[index];
+            if (node.op != otherNode.op)
+                continue;
+            
+            if (node.arithNodeFlagsForCompare() != otherNode.arithNodeFlagsForCompare())
+                continue;
+            
+            NodeIndex otherChild = canonicalize(otherNode.child1());
+            if (otherChild == NoNode)
+                return index;
+            if (otherChild != child1)
+                continue;
+            
+            otherChild = canonicalize(otherNode.child2());
+            if (otherChild == NoNode)
+                return index;
+            if (otherChild != child2)
+                continue;
+            
+            otherChild = canonicalize(otherNode.child3());
+            if (otherChild == NoNode)
+                return index;
+            if (otherChild != child3)
+                continue;
+            
+            return index;
+        }
+        return NoNode;
+    }
+    
+    bool isPredictedNumerical(Node& node)
+    {
+        PredictedType left = m_graph[node.child1()].prediction();
+        PredictedType right = m_graph[node.child2()].prediction();
+        return isNumberPrediction(left) && isNumberPrediction(right);
+    }
+    
+    bool logicalNotIsPure(Node& node)
+    {
+        PredictedType prediction = m_graph[node.child1()].prediction();
+        return isBooleanPrediction(prediction) || !prediction;
+    }
+    
+    bool byValIsPure(Node& node)
+    {
+        return m_graph[node.child2()].shouldSpeculateInteger()
+            && ((node.op == PutByVal || node.op == PutByValAlias)
+                ? isActionableMutableArrayPrediction(m_graph[node.child1()].prediction())
+                : isActionableArrayPrediction(m_graph[node.child1()].prediction()));
+    }
+    
+    bool clobbersWorld(NodeIndex nodeIndex)
+    {
+        Node& node = m_graph[nodeIndex];
+        if (node.op & NodeClobbersWorld)
+            return true;
+        if (!(node.op & NodeMightClobber))
+            return false;
+        switch (node.op) {
+        case ValueAdd:
+        case CompareLess:
+        case CompareLessEq:
+        case CompareGreater:
+        case CompareGreaterEq:
+        case CompareEq:
+            return !isPredictedNumerical(node);
+        case LogicalNot:
+            return !logicalNotIsPure(node);
+        case GetByVal:
+            return !byValIsPure(node);
+        default:
+            ASSERT_NOT_REACHED();
+            return true; // If by some oddity we hit this case in release build it's safer to have CSE assume the worst.
+        }
+    }
+    
+    NodeIndex impureCSE(Node& node)
+    {
+        NodeIndex child1 = canonicalize(node.child1());
+        NodeIndex child2 = canonicalize(node.child2());
+        NodeIndex child3 = canonicalize(node.child3());
+        
+        NodeIndex start = startIndex();
+        for (NodeIndex index = m_compileIndex; index-- > start;) {
+            Node& otherNode = m_graph[index];
+            if (node.op == otherNode.op
+                && node.arithNodeFlagsForCompare() == otherNode.arithNodeFlagsForCompare()) {
+                NodeIndex otherChild = canonicalize(otherNode.child1());
+                if (otherChild == NoNode)
+                    return index;
+                if (otherChild == child1) {
+                    otherChild = canonicalize(otherNode.child2());
+                    if (otherChild == NoNode)
+                        return index;
+                    if (otherChild == child2) {
+                        otherChild = canonicalize(otherNode.child3());
+                        if (otherChild == NoNode)
+                            return index;
+                        if (otherChild == child3)
+                            return index;
+                    }
+                }
+            }
+            if (clobbersWorld(index))
+                break;
+        }
+        return NoNode;
+    }
+    
+    NodeIndex globalVarLoadElimination(unsigned varNumber, JSGlobalObject* globalObject)
+    {
+        NodeIndex start = startIndexForChildren();
+        for (NodeIndex index = m_compileIndex; index-- > start;) {
+            Node& node = m_graph[index];
+            switch (node.op) {
+            case GetGlobalVar:
+                if (node.varNumber() == varNumber && codeBlock()->globalObjectFor(node.codeOrigin) == globalObject)
+                    return index;
+                break;
+            case PutGlobalVar:
+                if (node.varNumber() == varNumber && codeBlock()->globalObjectFor(node.codeOrigin) == globalObject)
+                    return node.child1().index();
+                break;
+            default:
+                break;
+            }
+            if (clobbersWorld(index))
+                break;
+        }
+        return NoNode;
+    }
+    
+    NodeIndex getByValLoadElimination(NodeIndex child1, NodeIndex child2)
+    {
+        NodeIndex start = startIndexForChildren(child1, child2);
+        for (NodeIndex index = m_compileIndex; index-- > start;) {
+            Node& node = m_graph[index];
+            switch (node.op) {
+            case GetByVal:
+                if (!byValIsPure(node))
+                    return NoNode;
+                if (node.child1() == child1 && canonicalize(node.child2()) == canonicalize(child2))
+                    return index;
+                break;
+            case PutByVal:
+            case PutByValAlias:
+                if (!byValIsPure(node))
+                    return NoNode;
+                if (node.child1() == child1 && canonicalize(node.child2()) == canonicalize(child2))
+                    return node.child3().index();
+                // We must assume that the PutByVal will clobber the location we're getting from.
+                // FIXME: We can do better; if we know that the PutByVal is accessing an array of a
+                // different type than the GetByVal, then we know that they won't clobber each other.
+                return NoNode;
+            case PutStructure:
+            case PutByOffset:
+                // GetByVal currently always speculates that it's accessing an
+                // array with an integer index, which means that it's impossible
+                // for a structure change or a put to property storage to affect
+                // the GetByVal.
+                break;
+            case ArrayPush:
+                // A push cannot affect previously existing elements in the array.
+                break;
+            default:
+                if (clobbersWorld(index))
+                    return NoNode;
+                break;
+            }
+        }
+        return NoNode;
+    }
+
+    bool checkFunctionElimination(JSFunction* function, NodeIndex child1)
+    {
+        NodeIndex start = startIndexForChildren(child1);
+        for (NodeIndex index = endIndexForPureCSE(); index-- > start;) {
+            Node& node = m_graph[index];
+            if (node.op == CheckFunction && node.child1() == child1 && node.function() == function)
+                return true;
+        }
+        return false;
+    }
+
+    bool checkStructureLoadElimination(const StructureSet& structureSet, NodeIndex child1)
+    {
+        NodeIndex start = startIndexForChildren(child1);
+        for (NodeIndex index = m_compileIndex; index-- > start;) {
+            Node& node = m_graph[index];
+            switch (node.op) {
+            case CheckStructure:
+                if (node.child1() == child1
+                    && structureSet.isSupersetOf(node.structureSet()))
+                    return true;
+                break;
+                
+            case PutStructure:
+                if (node.child1() == child1
+                    && structureSet.contains(node.structureTransitionData().newStructure))
+                    return true;
+                if (structureSet.contains(node.structureTransitionData().previousStructure))
+                    return false;
+                break;
+                
+            case PutByOffset:
+                // Setting a property cannot change the structure.
+                break;
+                
+            case PutByVal:
+            case PutByValAlias:
+                if (byValIsPure(node)) {
+                    // If PutByVal speculates that it's accessing an array with an
+                    // integer index, then it's impossible for it to cause a structure
+                    // change.
+                    break;
+                }
+                return false;
+                
+            default:
+                if (clobbersWorld(index))
+                    return false;
+                break;
+            }
+        }
+        return false;
+    }
+    
+    NodeIndex getByOffsetLoadElimination(unsigned identifierNumber, NodeIndex child1)
+    {
+        NodeIndex start = startIndexForChildren(child1);
+        for (NodeIndex index = m_compileIndex; index-- > start;) {
+            Node& node = m_graph[index];
+            switch (node.op) {
+            case GetByOffset:
+                if (node.child1() == child1
+                    && m_graph.m_storageAccessData[node.storageAccessDataIndex()].identifierNumber == identifierNumber)
+                    return index;
+                break;
+                
+            case PutByOffset:
+                if (m_graph.m_storageAccessData[node.storageAccessDataIndex()].identifierNumber == identifierNumber) {
+                    if (node.child2() == child1)
+                        return node.child3().index();
+                    return NoNode;
+                }
+                break;
+                
+            case PutStructure:
+                // Changing the structure cannot change the outcome of a property get.
+                break;
+                
+            case PutByVal:
+            case PutByValAlias:
+                if (byValIsPure(node)) {
+                    // If PutByVal speculates that it's accessing an array with an
+                    // integer index, then it's impossible for it to cause a structure
+                    // change.
+                    break;
+                }
+                return NoNode;
+                
+            default:
+                if (clobbersWorld(index))
+                    return NoNode;
+                break;
+            }
+        }
+        return NoNode;
+    }
+    
+    NodeIndex getPropertyStorageLoadElimination(NodeIndex child1)
+    {
+        NodeIndex start = startIndexForChildren(child1);
+        for (NodeIndex index = m_compileIndex; index-- > start;) {
+            Node& node = m_graph[index];
+            switch (node.op) {
+            case GetPropertyStorage:
+                if (node.child1() == child1)
+                    return index;
+                break;
+                
+            case PutByOffset:
+            case PutStructure:
+                // Changing the structure or putting to the storage cannot
+                // change the property storage pointer.
+                break;
+                
+            case PutByVal:
+            case PutByValAlias:
+                if (byValIsPure(node)) {
+                    // If PutByVal speculates that it's accessing an array with an
+                    // integer index, then it's impossible for it to cause a structure
+                    // change.
+                    break;
+                }
+                return NoNode;
+                
+            default:
+                if (clobbersWorld(index))
+                    return NoNode;
+                break;
+            }
+        }
+        return NoNode;
+    }
+
+    NodeIndex getIndexedPropertyStorageLoadElimination(NodeIndex child1, bool hasIntegerIndexPrediction)
+    {
+        NodeIndex start = startIndexForChildren(child1);
+        for (NodeIndex index = m_compileIndex; index-- > start;) {
+            Node& node = m_graph[index];
+            switch (node.op) {
+            case GetIndexedPropertyStorage: {
+                PredictedType basePrediction = m_graph[node.child2()].prediction();
+                bool nodeHasIntegerIndexPrediction = !(!(basePrediction & PredictInt32) && basePrediction);
+                if (node.child1() == child1 && hasIntegerIndexPrediction == nodeHasIntegerIndexPrediction)
+                    return index;
+                break;
+            }
+
+            case PutByOffset:
+            case PutStructure:
+                // Changing the structure or putting to the storage cannot
+                // change the property storage pointer.
+                break;
+                
+            case PutByValAlias:
+                // PutByValAlias can't change the indexed storage pointer
+                break;
+                
+            case PutByVal:
+                if (isFixedIndexedStorageObjectPrediction(m_graph[node.child1()].prediction()) && byValIsPure(node))
+                    break;
+                return NoNode;
+
+            default:
+                if (clobbersWorld(index))
+                    return NoNode;
+                break;
+            }
+        }
+        return NoNode;
+    }
+    
+    NodeIndex getScopeChainLoadElimination(unsigned depth)
+    {
+        NodeIndex start = startIndexForChildren();
+        for (NodeIndex index = endIndexForPureCSE(); index-- > start;) {
+            Node& node = m_graph[index];
+            if (node.op == GetScopeChain
+                && node.scopeChainDepth() == depth)
+                return index;
+        }
+        return NoNode;
+    }
+    
+    void performSubstitution(NodeUse& child, bool addRef = true)
+    {
+        // Check if this operand is actually unused.
+        if (!child)
+            return;
+        
+        // Check if there is any replacement.
+        NodeIndex replacement = m_replacements[child.index()];
+        if (replacement == NoNode)
+            return;
+        
+        child.setIndex(replacement);
+        
+        // There is definitely a replacement. Assert that the replacement does not
+        // have a replacement.
+        ASSERT(m_replacements[child.index()] == NoNode);
+        
+        if (addRef)
+            m_graph[child].ref();
+    }
+    
+    void setReplacement(NodeIndex replacement)
+    {
+        if (replacement == NoNode)
+            return;
+        
+        // Be safe. Don't try to perform replacements if the predictions don't
+        // agree.
+        if (m_graph[m_compileIndex].prediction() != m_graph[replacement].prediction())
+            return;
+        
+#if DFG_ENABLE(DEBUG_PROPAGATION_VERBOSE)
+        dataLog("   Replacing @%u -> @%u", m_compileIndex, replacement);
+#endif
+        
+        Node& node = m_graph[m_compileIndex];
+        node.op = Phantom;
+        node.setRefCount(1);
+        
+        // At this point we will eliminate all references to this node.
+        m_replacements[m_compileIndex] = replacement;
+    }
+    
+    void eliminate()
+    {
+#if DFG_ENABLE(DEBUG_PROPAGATION_VERBOSE)
+        dataLog("   Eliminating @%u", m_compileIndex);
+#endif
+        
+        Node& node = m_graph[m_compileIndex];
+        ASSERT(node.refCount() == 1);
+        ASSERT(node.mustGenerate());
+        node.op = Phantom;
+    }
+    
+    void performNodeCSE(Node& node)
+    {
+        bool shouldGenerate = node.shouldGenerate();
+
+        if (node.op & NodeHasVarArgs) {
+            for (unsigned childIdx = node.firstChild(); childIdx < node.firstChild() + node.numChildren(); childIdx++)
+                performSubstitution(m_graph.m_varArgChildren[childIdx], shouldGenerate);
+        } else {
+            performSubstitution(node.children.child1(), shouldGenerate);
+            performSubstitution(node.children.child2(), shouldGenerate);
+            performSubstitution(node.children.child3(), shouldGenerate);
+        }
+        
+        if (!shouldGenerate)
+            return;
+        
+#if DFG_ENABLE(DEBUG_PROPAGATION_VERBOSE)
+        dataLog("   %s @%u: ", Graph::opName(m_graph[m_compileIndex].op), m_compileIndex);
+#endif
+        
+        // NOTE: there are some nodes that we deliberately don't CSE even though we
+        // probably could, like StrCat and ToPrimitive. That's because there is no
+        // evidence that doing CSE on these nodes would result in a performance
+        // progression. Hence considering these nodes in CSE would just mean that this
+        // code does more work with no win. Of course, we may want to reconsider this,
+        // since StrCat is trivially CSE-able. It's not trivially doable for
+        // ToPrimitive, but we could change that with some speculations if we really
+        // needed to.
+        
+        switch (node.op) {
+        
+        // Handle the pure nodes. These nodes never have any side-effects.
+        case BitAnd:
+        case BitOr:
+        case BitXor:
+        case BitRShift:
+        case BitLShift:
+        case BitURShift:
+        case ArithAdd:
+        case ArithSub:
+        case ArithMul:
+        case ArithMod:
+        case ArithDiv:
+        case ArithAbs:
+        case ArithMin:
+        case ArithMax:
+        case ArithSqrt:
+        case GetByteArrayLength:
+        case GetInt8ArrayLength:
+        case GetInt16ArrayLength:
+        case GetInt32ArrayLength:
+        case GetUint8ArrayLength:
+        case GetUint8ClampedArrayLength:
+        case GetUint16ArrayLength:
+        case GetUint32ArrayLength:
+        case GetFloat32ArrayLength:
+        case GetFloat64ArrayLength:
+        case GetCallee:
+        case GetStringLength:
+        case StringCharAt:
+        case StringCharCodeAt:
+            setReplacement(pureCSE(node));
+            break;
+            
+        case GetArrayLength:
+            setReplacement(impureCSE(node));
+            break;
+            
+        case GetScopeChain:
+            setReplacement(getScopeChainLoadElimination(node.scopeChainDepth()));
+            break;
+
+        // Handle nodes that are conditionally pure: these are pure, and can
+        // be CSE'd, so long as the prediction is the one we want.
+        case ValueAdd:
+        case CompareLess:
+        case CompareLessEq:
+        case CompareGreater:
+        case CompareGreaterEq:
+        case CompareEq: {
+            if (isPredictedNumerical(node)) {
+                NodeIndex replacementIndex = pureCSE(node);
+                if (replacementIndex != NoNode && isPredictedNumerical(m_graph[replacementIndex]))
+                    setReplacement(replacementIndex);
+            }
+            break;
+        }
+            
+        case LogicalNot: {
+            if (logicalNotIsPure(node)) {
+                NodeIndex replacementIndex = pureCSE(node);
+                if (replacementIndex != NoNode && logicalNotIsPure(m_graph[replacementIndex]))
+                    setReplacement(replacementIndex);
+            }
+            break;
+        }
+            
+        // Finally handle heap accesses. These are not quite pure, but we can still
+        // optimize them provided that some subtle conditions are met.
+        case GetGlobalVar:
+            setReplacement(globalVarLoadElimination(node.varNumber(), codeBlock()->globalObjectFor(node.codeOrigin)));
+            break;
+            
+        case GetByVal:
+            if (byValIsPure(node))
+                setReplacement(getByValLoadElimination(node.child1().index(), node.child2().index()));
+            break;
+            
+        case PutByVal:
+            if (byValIsPure(node) && getByValLoadElimination(node.child1().index(), node.child2().index()) != NoNode)
+                node.op = PutByValAlias;
+            break;
+            
+        case CheckStructure:
+            if (checkStructureLoadElimination(node.structureSet(), node.child1().index()))
+                eliminate();
+            break;
+
+        case CheckFunction:
+            if (checkFunctionElimination(node.function(), node.child1().index()))
+                eliminate();
+            break;
+                
+        case GetIndexedPropertyStorage: {
+            PredictedType basePrediction = m_graph[node.child2()].prediction();
+            bool nodeHasIntegerIndexPrediction = !(!(basePrediction & PredictInt32) && basePrediction);
+            setReplacement(getIndexedPropertyStorageLoadElimination(node.child1().index(), nodeHasIntegerIndexPrediction));
+            break;
+        }
+
+        case GetPropertyStorage:
+            setReplacement(getPropertyStorageLoadElimination(node.child1().index()));
+            break;
+
+        case GetByOffset:
+            setReplacement(getByOffsetLoadElimination(m_graph.m_storageAccessData[node.storageAccessDataIndex()].identifierNumber, node.child1().index()));
+            break;
+            
+        default:
+            // do nothing.
+            break;
+        }
+        
+        m_lastSeen[node.op & NodeIdMask] = m_compileIndex;
+#if DFG_ENABLE(DEBUG_PROPAGATION_VERBOSE)
+        dataLog("\n");
+#endif
+    }
+    
+    void performBlockCSE(BasicBlock& block)
+    {
+        m_start = block.begin;
+        NodeIndex end = block.end;
+        for (m_compileIndex = m_start; m_compileIndex < end; ++m_compileIndex)
+            performNodeCSE(m_graph[m_compileIndex]);
+    }
+    
+    NodeIndex m_start;
+    NodeIndex m_compileIndex;
+    Vector<NodeIndex, 16> m_replacements;
+    FixedArray<NodeIndex, LastNodeId> m_lastSeen;
+};
+
+void performCSE(Graph& graph)
+{
+    runPhase<CSEPhase>(graph);
+}
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
+
+
diff --git a/Source/JavaScriptCore/heap/BumpBlock.h b/Source/JavaScriptCore/dfg/DFGCSEPhase.h
index b9f271ca8..3f13f102b 100644
--- a/Source/JavaScriptCore/heap/BumpBlock.h
+++ b/Source/JavaScriptCore/dfg/DFGCSEPhase.h
@@ -23,31 +23,27 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
  */
 
-#ifndef BumpBlock_h
-#define BumpBlock_h
+#ifndef DFGCSEPhase_h
+#define DFGCSEPhase_h
 
-#include "HeapBlock.h"
+#include <wtf/Platform.h>
 
-namespace JSC {
+#if ENABLE(DFG_JIT)
 
-class BumpSpace;
+namespace JSC { namespace DFG {
 
-class BumpBlock : public HeapBlock {
-    friend class BumpSpace;
-public:
-    BumpBlock(PageAllocationAligned& allocation)
-        : HeapBlock(allocation)
-        , m_offset(m_payload)
-        , m_isPinned(false)
-    {
-    }
+class Graph;
 
-private:
-    void* m_offset;
-    uintptr_t m_isPinned;
-    char m_payload[1];
-};
+// Block-local common subexpression elimination. This is an optional phase, but
+// it is rather profitable. It has fairly accurate heap modeling and will match
+// a wide range of subexpression similarities. It's known to produce big wins
+// on a few benchmarks, and is relatively cheap to run.
 
-} // namespace JSC
+void performCSE(Graph&);
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
+
+#endif // DFGCSEPhase_h
 
-#endif
diff --git a/Source/JavaScriptCore/dfg/DFGCapabilities.h b/Source/JavaScriptCore/dfg/DFGCapabilities.h
index 2653c73b0..e339714e9 100644
--- a/Source/JavaScriptCore/dfg/DFGCapabilities.h
+++ b/Source/JavaScriptCore/dfg/DFGCapabilities.h
@@ -111,6 +111,8 @@ inline bool canCompileOpcode(OpcodeID opcodeID)
     case op_put_scoped_var:
     case op_get_by_id:
     case op_put_by_id:
+    case op_put_by_id_transition_direct:
+    case op_put_by_id_transition_normal:
     case op_get_global_var:
     case op_put_global_var:
     case op_jmp:
diff --git a/Source/JavaScriptCore/dfg/DFGCommon.h b/Source/JavaScriptCore/dfg/DFGCommon.h
index 14edff3a5..330504c3e 100644
--- a/Source/JavaScriptCore/dfg/DFGCommon.h
+++ b/Source/JavaScriptCore/dfg/DFGCommon.h
@@ -71,6 +71,8 @@
 #define DFG_ENABLE_SUCCESS_STATS 0
 // Used to enable conditionally supported opcodes that currently result in performance regressions.
 #define DFG_ENABLE_RESTRICTIONS 1
+// Enable verification that the DFG is able to insert code for control flow edges.
+#define DFG_ENABLE_EDGE_CODE_VERIFICATION 0
 
 namespace JSC { namespace DFG {
 
diff --git a/Source/JavaScriptCore/dfg/DFGDriver.cpp b/Source/JavaScriptCore/dfg/DFGDriver.cpp
index 27a0dab75..124d7e637 100644
--- a/Source/JavaScriptCore/dfg/DFGDriver.cpp
+++ b/Source/JavaScriptCore/dfg/DFGDriver.cpp
@@ -28,9 +28,13 @@
 
 #if ENABLE(DFG_JIT)
 
+#include "DFGArithNodeFlagsInferencePhase.h"
 #include "DFGByteCodeParser.h"
+#include "DFGCFAPhase.h"
+#include "DFGCSEPhase.h"
 #include "DFGJITCompiler.h"
-#include "DFGPropagator.h"
+#include "DFGPredictionPropagationPhase.h"
+#include "DFGVirtualRegisterAllocationPhase.h"
 
 namespace JSC { namespace DFG {
 
@@ -44,19 +48,28 @@ inline bool compile(CompileMode compileMode, JSGlobalData& globalData, CodeBlock
     ASSERT(codeBlock->alternative()->getJITType() == JITCode::BaselineJIT);
 
 #if DFG_ENABLE(DEBUG_VERBOSE)
-    fprintf(stderr, "DFG compiling code block %p(%p), number of instructions = %u.\n", codeBlock, codeBlock->alternative(), codeBlock->instructionCount());
+    dataLog("DFG compiling code block %p(%p), number of instructions = %u.\n", codeBlock, codeBlock->alternative(), codeBlock->instructionCount());
 #endif
     
-    Graph dfg;
-    if (!parse(dfg, &globalData, codeBlock))
+    Graph dfg(globalData, codeBlock);
+    if (!parse(dfg))
         return false;
     
     if (compileMode == CompileFunction)
-        dfg.predictArgumentTypes(codeBlock);
-    
-    propagate(dfg, &globalData, codeBlock);
+        dfg.predictArgumentTypes();
+
+    performArithNodeFlagsInference(dfg);
+    performPredictionPropagation(dfg);
+    performCSE(dfg);
+    performVirtualRegisterAllocation(dfg);
+    performCFA(dfg);
+
+#if DFG_ENABLE(DEBUG_VERBOSE)
+    dataLog("Graph after optimization:\n");
+    dfg.dump();
+#endif
     
-    JITCompiler dataFlowJIT(&globalData, dfg, codeBlock);
+    JITCompiler dataFlowJIT(dfg);
     if (compileMode == CompileFunction) {
         ASSERT(jitCodeWithArityCheck);
         
diff --git a/Source/JavaScriptCore/dfg/DFGGraph.cpp b/Source/JavaScriptCore/dfg/DFGGraph.cpp
index c304dc8e7..b8eec93c7 100644
--- a/Source/JavaScriptCore/dfg/DFGGraph.cpp
+++ b/Source/JavaScriptCore/dfg/DFGGraph.cpp
@@ -80,7 +80,7 @@ const char* Graph::nameOfVariableAccessData(VariableAccessData* variableAccessDa
 static void printWhiteSpace(unsigned amount)
 {
     while (amount-- > 0)
-        printf(" ");
+        dataLog(" ");
 }
 
 void Graph::dumpCodeOrigin(NodeIndex nodeIndex)
@@ -107,17 +107,17 @@ void Graph::dumpCodeOrigin(NodeIndex nodeIndex)
     // Print the pops.
     for (unsigned i = previousInlineStack.size(); i-- > indexOfDivergence;) {
         printWhiteSpace(i * 2);
-        printf("<-- %p\n", previousInlineStack[i].inlineCallFrame->executable.get());
+        dataLog("<-- %p\n", previousInlineStack[i].inlineCallFrame->executable.get());
     }
     
     // Print the pushes.
     for (unsigned i = indexOfDivergence; i < currentInlineStack.size(); ++i) {
         printWhiteSpace(i * 2);
-        printf("--> %p\n", currentInlineStack[i].inlineCallFrame->executable.get());
+        dataLog("--> %p\n", currentInlineStack[i].inlineCallFrame->executable.get());
     }
 }
 
-void Graph::dump(NodeIndex nodeIndex, CodeBlock* codeBlock)
+void Graph::dump(NodeIndex nodeIndex)
 {
     Node& node = at(nodeIndex);
     NodeType op = node.op;
@@ -150,64 +150,58 @@ void Graph::dump(NodeIndex nodeIndex, CodeBlock* codeBlock)
     //         $#   - the index in the CodeBlock of a constant { for numeric constants the value is displayed | for integers, in both decimal and hex }.
     //         id#  - the index in the CodeBlock of an identifier { if codeBlock is passed to dump(), the string representation is displayed }.
     //         var# - the index of a var on the global object, used by GetGlobalVar/PutGlobalVar operations.
-    printf("% 4d:%s<%c%u:", (int)nodeIndex, skipped ? "  skipped  " : "           ", mustGenerate ? '!' : ' ', refCount);
+    dataLog("% 4d:%s<%c%u:", (int)nodeIndex, skipped ? "  skipped  " : "           ", mustGenerate ? '!' : ' ', refCount);
     if (node.hasResult() && !skipped && node.hasVirtualRegister())
-        printf("%u", node.virtualRegister());
+        dataLog("%u", node.virtualRegister());
     else
-        printf("-");
-    printf(">\t%s(", opName(op));
+        dataLog("-");
+    dataLog(">\t%s(", opName(op));
     bool hasPrinted = false;
     if (op & NodeHasVarArgs) {
         for (unsigned childIdx = node.firstChild(); childIdx < node.firstChild() + node.numChildren(); childIdx++) {
             if (hasPrinted)
-                printf(", ");
+                dataLog(", ");
             else
                 hasPrinted = true;
-            printf("@%u", m_varArgChildren[childIdx].index());
+            dataLog("@%u", m_varArgChildren[childIdx].index());
         }
     } else {
         if (!!node.child1())
-            printf("@%u", node.child1().index());
+            dataLog("@%u", node.child1().index());
         if (!!node.child2())
-            printf(", @%u", node.child2().index());
+            dataLog(", @%u", node.child2().index());
         if (!!node.child3())
-            printf(", @%u", node.child3().index());
+            dataLog(", @%u", node.child3().index());
         hasPrinted = !!node.child1();
     }
 
     if (node.hasArithNodeFlags()) {
-        printf("%s%s", hasPrinted ? ", " : "", arithNodeFlagsAsString(node.rawArithNodeFlags()));
+        dataLog("%s%s", hasPrinted ? ", " : "", arithNodeFlagsAsString(node.rawArithNodeFlags()));
         hasPrinted = true;
     }
     if (node.hasVarNumber()) {
-        printf("%svar%u", hasPrinted ? ", " : "", node.varNumber());
+        dataLog("%svar%u", hasPrinted ? ", " : "", node.varNumber());
         hasPrinted = true;
     }
     if (node.hasIdentifier()) {
-        if (codeBlock)
-            printf("%sid%u{%s}", hasPrinted ? ", " : "", node.identifierNumber(), codeBlock->identifier(node.identifierNumber()).ustring().utf8().data());
-        else
-            printf("%sid%u", hasPrinted ? ", " : "", node.identifierNumber());
+        dataLog("%sid%u{%s}", hasPrinted ? ", " : "", node.identifierNumber(), m_codeBlock->identifier(node.identifierNumber()).ustring().utf8().data());
         hasPrinted = true;
     }
     if (node.hasStructureSet()) {
         for (size_t i = 0; i < node.structureSet().size(); ++i) {
-            printf("%sstruct(%p)", hasPrinted ? ", " : "", node.structureSet()[i]);
+            dataLog("%sstruct(%p)", hasPrinted ? ", " : "", node.structureSet()[i]);
             hasPrinted = true;
         }
     }
     if (node.hasStructureTransitionData()) {
-        printf("%sstruct(%p -> %p)", hasPrinted ? ", " : "", node.structureTransitionData().previousStructure, node.structureTransitionData().newStructure);
+        dataLog("%sstruct(%p -> %p)", hasPrinted ? ", " : "", node.structureTransitionData().previousStructure, node.structureTransitionData().newStructure);
         hasPrinted = true;
     }
     if (node.hasStorageAccessData()) {
         StorageAccessData& storageAccessData = m_storageAccessData[node.storageAccessDataIndex()];
-        if (codeBlock)
-            printf("%sid%u{%s}", hasPrinted ? ", " : "", storageAccessData.identifierNumber, codeBlock->identifier(storageAccessData.identifierNumber).ustring().utf8().data());
-        else
-            printf("%sid%u", hasPrinted ? ", " : "", storageAccessData.identifierNumber);
+        dataLog("%sid%u{%s}", hasPrinted ? ", " : "", storageAccessData.identifierNumber, m_codeBlock->identifier(storageAccessData.identifierNumber).ustring().utf8().data());
         
-        printf(", %lu", static_cast<unsigned long>(storageAccessData.offset));
+        dataLog(", %lu", static_cast<unsigned long>(storageAccessData.offset));
         hasPrinted = true;
     }
     ASSERT(node.hasVariableAccessData() == node.hasLocal());
@@ -215,85 +209,83 @@ void Graph::dump(NodeIndex nodeIndex, CodeBlock* codeBlock)
         VariableAccessData* variableAccessData = node.variableAccessData();
         int operand = variableAccessData->operand();
         if (operandIsArgument(operand))
-            printf("%sarg%u(%s)", hasPrinted ? ", " : "", operandToArgument(operand), nameOfVariableAccessData(variableAccessData));
+            dataLog("%sarg%u(%s)", hasPrinted ? ", " : "", operandToArgument(operand), nameOfVariableAccessData(variableAccessData));
         else
-            printf("%sr%u(%s)", hasPrinted ? ", " : "", operand, nameOfVariableAccessData(variableAccessData));
+            dataLog("%sr%u(%s)", hasPrinted ? ", " : "", operand, nameOfVariableAccessData(variableAccessData));
         hasPrinted = true;
     }
-    if (node.hasConstantBuffer() && codeBlock) {
+    if (node.hasConstantBuffer()) {
         if (hasPrinted)
-            printf(", ");
-        printf("%u:[", node.startConstant());
+            dataLog(", ");
+        dataLog("%u:[", node.startConstant());
         for (unsigned i = 0; i < node.numConstants(); ++i) {
             if (i)
-                printf(", ");
-            printf("%s", codeBlock->constantBuffer(node.startConstant())[i].description());
+                dataLog(", ");
+            dataLog("%s", m_codeBlock->constantBuffer(node.startConstant())[i].description());
         }
-        printf("]");
+        dataLog("]");
         hasPrinted = true;
     }
     if (op == JSConstant) {
-        printf("%s$%u", hasPrinted ? ", " : "", node.constantNumber());
-        if (codeBlock) {
-            JSValue value = valueOfJSConstant(codeBlock, nodeIndex);
-            printf(" = %s", value.description());
-        }
+        dataLog("%s$%u", hasPrinted ? ", " : "", node.constantNumber());
+        JSValue value = valueOfJSConstant(nodeIndex);
+        dataLog(" = %s", value.description());
         hasPrinted = true;
     }
     if (op == WeakJSConstant) {
-        printf("%s%p", hasPrinted ? ", " : "", node.weakConstant());
+        dataLog("%s%p", hasPrinted ? ", " : "", node.weakConstant());
         hasPrinted = true;
     }
     if  (node.isBranch() || node.isJump()) {
-        printf("%sT:#%u", hasPrinted ? ", " : "", node.takenBlockIndex());
+        dataLog("%sT:#%u", hasPrinted ? ", " : "", node.takenBlockIndex());
         hasPrinted = true;
     }
     if  (node.isBranch()) {
-        printf("%sF:#%u", hasPrinted ? ", " : "", node.notTakenBlockIndex());
+        dataLog("%sF:#%u", hasPrinted ? ", " : "", node.notTakenBlockIndex());
         hasPrinted = true;
     }
     (void)hasPrinted;
     
-    printf(")");
+    dataLog(")");
 
     if (!skipped) {
         if (node.hasVariableAccessData())
-            printf("  predicting %s, double ratio %lf%s", predictionToString(node.variableAccessData()->prediction()), node.variableAccessData()->doubleVoteRatio(), node.variableAccessData()->shouldUseDoubleFormat() ? ", forcing double" : "");
+            dataLog("  predicting %s, double ratio %lf%s", predictionToString(node.variableAccessData()->prediction()), node.variableAccessData()->doubleVoteRatio(), node.variableAccessData()->shouldUseDoubleFormat() ? ", forcing double" : "");
         else if (node.hasHeapPrediction())
-            printf("  predicting %s", predictionToString(node.getHeapPrediction()));
+            dataLog("  predicting %s", predictionToString(node.getHeapPrediction()));
         else if (node.hasVarNumber())
-            printf("  predicting %s", predictionToString(getGlobalVarPrediction(node.varNumber())));
+            dataLog("  predicting %s", predictionToString(getGlobalVarPrediction(node.varNumber())));
     }
     
-    printf("\n");
+    dataLog("\n");
 }
 
-void Graph::dump(CodeBlock* codeBlock)
+void Graph::dump()
 {
     for (size_t b = 0; b < m_blocks.size(); ++b) {
         BasicBlock* block = m_blocks[b].get();
-        printf("Block #%u (bc#%u): %s%s\n", (int)b, block->bytecodeBegin, block->isReachable ? "" : " (skipped)", block->isOSRTarget ? " (OSR target)" : "");
-        printf("  vars before: ");
+        dataLog("Block #%u (bc#%u): %s%s\n", (int)b, block->bytecodeBegin, block->isReachable ? "" : " (skipped)", block->isOSRTarget ? " (OSR target)" : "");
+        dataLog("  vars before: ");
         if (block->cfaHasVisited)
-            dumpOperands(block->valuesAtHead, stdout);
+            dumpOperands(block->valuesAtHead, WTF::dataFile());
         else
-            printf("<empty>");
-        printf("\n");
-        printf("  var links: ");
-        dumpOperands(block->variablesAtHead, stdout);
-        printf("\n");
+            dataLog("<empty>");
+        dataLog("\n");
+        dataLog("  var links: ");
+        dumpOperands(block->variablesAtHead, WTF::dataFile());
+        dataLog("\n");
         for (size_t i = block->begin; i < block->end; ++i)
-            dump(i, codeBlock);
-        printf("  vars after: ");
+            dump(i);
+        dataLog("  vars after: ");
         if (block->cfaHasVisited)
-            dumpOperands(block->valuesAtTail, stdout);
+            dumpOperands(block->valuesAtTail, WTF::dataFile());
         else
-            printf("<empty>");
-        printf("\n");
+            dataLog("<empty>");
+        dataLog("\n");
     }
-    printf("Phi Nodes:\n");
+    dataLog("Phi Nodes:\n");
     for (size_t i = m_blocks.last()->end; i < size(); ++i)
-        dump(i, codeBlock);
+        dump(i);
 }
 
 // FIXME: Convert this to be iterative, not recursive.
@@ -334,22 +326,18 @@ void Graph::derefChildren(NodeIndex op)
     DO_TO_CHILDREN(at(op), deref);
 }
 
-void Graph::predictArgumentTypes(CodeBlock* codeBlock)
+void Graph::predictArgumentTypes()
 {
-    ASSERT(codeBlock);
-    ASSERT(codeBlock->alternative());
-
-    CodeBlock* profiledCodeBlock = codeBlock->alternative();
-    ASSERT(codeBlock->numParameters() >= 1);
-    for (size_t arg = 0; arg < static_cast<size_t>(codeBlock->numParameters()); ++arg) {
-        ValueProfile* profile = profiledCodeBlock->valueProfileForArgument(arg);
+    ASSERT(m_codeBlock->numParameters() >= 1);
+    for (size_t arg = 0; arg < static_cast<size_t>(m_codeBlock->numParameters()); ++arg) {
+        ValueProfile* profile = m_profiledBlock->valueProfileForArgument(arg);
         if (!profile)
             continue;
         
         at(m_arguments[arg]).variableAccessData()->predict(profile->computeUpdatedPrediction());
         
 #if DFG_ENABLE(DEBUG_VERBOSE)
-        printf("Argument [%zu] prediction: %s\n", arg, predictionToString(at(m_arguments[arg]).variableAccessData()->prediction()));
+        dataLog("Argument [%zu] prediction: %s\n", arg, predictionToString(at(m_arguments[arg]).variableAccessData()->prediction()));
 #endif
     }
 }
diff --git a/Source/JavaScriptCore/dfg/DFGGraph.h b/Source/JavaScriptCore/dfg/DFGGraph.h
index ecd77b3a4..88d6a4eec 100644
--- a/Source/JavaScriptCore/dfg/DFGGraph.h
+++ b/Source/JavaScriptCore/dfg/DFGGraph.h
@@ -29,8 +29,10 @@
 #if ENABLE(DFG_JIT)
 
 #include "CodeBlock.h"
+#include "DFGAssemblyHelpers.h"
 #include "DFGBasicBlock.h"
 #include "DFGNode.h"
+#include "MethodOfGettingAValueProfile.h"
 #include "PredictionTracker.h"
 #include "RegisterFile.h"
 #include <wtf/BitVector.h>
@@ -71,6 +73,14 @@ struct ResolveGlobalData {
 // Nodes that are 'dead' remain in the vector with refCount 0.
 class Graph : public Vector<Node, 64> {
 public:
+    Graph(JSGlobalData& globalData, CodeBlock* codeBlock)
+        : m_globalData(globalData)
+        , m_codeBlock(codeBlock)
+        , m_profiledBlock(codeBlock->alternative())
+    {
+        ASSERT(m_profiledBlock);
+    }
+    
     using Vector<Node, 64>::operator[];
     using Vector<Node, 64>::at;
     
@@ -128,8 +138,8 @@ public:
     }
 
     // CodeBlock is optional, but may allow additional information to be dumped (e.g. Identifier names).
-    void dump(CodeBlock* = 0);
-    void dump(NodeIndex, CodeBlock* = 0);
+    void dump();
+    void dump(NodeIndex);
 
     // Dump the code origin of the given node as a diff from the code origin of the
     // preceding node.
@@ -147,12 +157,12 @@ public:
         return m_predictions.getGlobalVarPrediction(varNumber);
     }
     
-    PredictedType getJSConstantPrediction(Node& node, CodeBlock* codeBlock)
+    PredictedType getJSConstantPrediction(Node& node)
     {
-        return predictionFromValue(node.valueOfJSConstant(codeBlock));
+        return predictionFromValue(node.valueOfJSConstant(m_codeBlock));
     }
     
-    bool addShouldSpeculateInteger(Node& add, CodeBlock* codeBlock)
+    bool addShouldSpeculateInteger(Node& add)
     {
         ASSERT(add.op == ValueAdd || add.op == ArithAdd || add.op == ArithSub);
         
@@ -160,16 +170,16 @@ public:
         Node& right = at(add.child2());
         
         if (left.hasConstant())
-            return addImmediateShouldSpeculateInteger(codeBlock, add, right, left);
+            return addImmediateShouldSpeculateInteger(add, right, left);
         if (right.hasConstant())
-            return addImmediateShouldSpeculateInteger(codeBlock, add, left, right);
+            return addImmediateShouldSpeculateInteger(add, left, right);
         
         return Node::shouldSpeculateInteger(left, right) && add.canSpeculateInteger();
     }
     
-    bool addShouldSpeculateInteger(NodeIndex nodeIndex, CodeBlock* codeBlock)
+    bool addShouldSpeculateInteger(NodeIndex nodeIndex)
     {
-        return addShouldSpeculateInteger(at(nodeIndex), codeBlock);
+        return addShouldSpeculateInteger(at(nodeIndex));
     }
     
     // Helper methods to check nodes for constants.
@@ -181,50 +191,50 @@ public:
     {
         return at(nodeIndex).hasConstant();
     }
-    bool isInt32Constant(CodeBlock* codeBlock, NodeIndex nodeIndex)
+    bool isInt32Constant(NodeIndex nodeIndex)
     {
-        return at(nodeIndex).isInt32Constant(codeBlock);
+        return at(nodeIndex).isInt32Constant(m_codeBlock);
     }
-    bool isDoubleConstant(CodeBlock* codeBlock, NodeIndex nodeIndex)
+    bool isDoubleConstant(NodeIndex nodeIndex)
     {
-        return at(nodeIndex).isDoubleConstant(codeBlock);
+        return at(nodeIndex).isDoubleConstant(m_codeBlock);
     }
-    bool isNumberConstant(CodeBlock* codeBlock, NodeIndex nodeIndex)
+    bool isNumberConstant(NodeIndex nodeIndex)
     {
-        return at(nodeIndex).isNumberConstant(codeBlock);
+        return at(nodeIndex).isNumberConstant(m_codeBlock);
     }
-    bool isBooleanConstant(CodeBlock* codeBlock, NodeIndex nodeIndex)
+    bool isBooleanConstant(NodeIndex nodeIndex)
     {
-        return at(nodeIndex).isBooleanConstant(codeBlock);
+        return at(nodeIndex).isBooleanConstant(m_codeBlock);
     }
-    bool isFunctionConstant(CodeBlock* codeBlock, NodeIndex nodeIndex)
+    bool isFunctionConstant(NodeIndex nodeIndex)
     {
         if (!isJSConstant(nodeIndex))
             return false;
-        if (!getJSFunction(valueOfJSConstant(codeBlock, nodeIndex)))
+        if (!getJSFunction(valueOfJSConstant(nodeIndex)))
             return false;
         return true;
     }
     // Helper methods get constant values from nodes.
-    JSValue valueOfJSConstant(CodeBlock* codeBlock, NodeIndex nodeIndex)
+    JSValue valueOfJSConstant(NodeIndex nodeIndex)
     {
-        return at(nodeIndex).valueOfJSConstant(codeBlock);
+        return at(nodeIndex).valueOfJSConstant(m_codeBlock);
     }
-    int32_t valueOfInt32Constant(CodeBlock* codeBlock, NodeIndex nodeIndex)
+    int32_t valueOfInt32Constant(NodeIndex nodeIndex)
     {
-        return valueOfJSConstant(codeBlock, nodeIndex).asInt32();
+        return valueOfJSConstant(nodeIndex).asInt32();
     }
-    double valueOfNumberConstant(CodeBlock* codeBlock, NodeIndex nodeIndex)
+    double valueOfNumberConstant(NodeIndex nodeIndex)
     {
-        return valueOfJSConstant(codeBlock, nodeIndex).asNumber();
+        return valueOfJSConstant(nodeIndex).asNumber();
     }
-    bool valueOfBooleanConstant(CodeBlock* codeBlock, NodeIndex nodeIndex)
+    bool valueOfBooleanConstant(NodeIndex nodeIndex)
     {
-        return valueOfJSConstant(codeBlock, nodeIndex).asBoolean();
+        return valueOfJSConstant(nodeIndex).asBoolean();
     }
-    JSFunction* valueOfFunctionConstant(CodeBlock* codeBlock, NodeIndex nodeIndex)
+    JSFunction* valueOfFunctionConstant(NodeIndex nodeIndex)
     {
-        JSCell* function = getJSFunction(valueOfJSConstant(codeBlock, nodeIndex));
+        JSCell* function = getJSFunction(valueOfJSConstant(nodeIndex));
         ASSERT(function);
         return asFunction(function);
     }
@@ -234,7 +244,7 @@ public:
     // This is O(n), and should only be used for verbose dumps.
     const char* nameOfVariableAccessData(VariableAccessData*);
 
-    void predictArgumentTypes(CodeBlock*);
+    void predictArgumentTypes();
     
     StructureSet* addStructureSet(const StructureSet& structureSet)
     {
@@ -249,14 +259,20 @@ public:
         return &m_structureTransitionData.last();
     }
     
-    ValueProfile* valueProfileFor(NodeIndex nodeIndex, CodeBlock* profiledBlock)
+    CodeBlock* baselineCodeBlockFor(const CodeOrigin& codeOrigin)
+    {
+        return baselineCodeBlockForOriginAndBaselineCodeBlock(codeOrigin, m_profiledBlock);
+    }
+    
+    ValueProfile* valueProfileFor(NodeIndex nodeIndex)
     {
         if (nodeIndex == NoNode)
             return 0;
         
         Node& node = at(nodeIndex);
+        CodeBlock* profiledBlock = baselineCodeBlockFor(node.codeOrigin);
         
-        if (node.op == GetLocal) {
+        if (node.hasLocal()) {
             if (!operandIsArgument(node.local()))
                 return 0;
             int argument = operandToArgument(node.local());
@@ -270,6 +286,28 @@ public:
         
         return 0;
     }
+    
+    MethodOfGettingAValueProfile methodOfGettingAValueProfileFor(NodeIndex nodeIndex)
+    {
+        if (nodeIndex == NoNode)
+            return MethodOfGettingAValueProfile();
+        
+        Node& node = at(nodeIndex);
+        CodeBlock* profiledBlock = baselineCodeBlockFor(node.codeOrigin);
+        
+        if (node.op == GetLocal) {
+            return MethodOfGettingAValueProfile::fromLazyOperand(
+                profiledBlock,
+                LazyOperandValueProfileKey(
+                    node.codeOrigin.bytecodeIndex, node.local()));
+        }
+        
+        return MethodOfGettingAValueProfile(valueProfileFor(nodeIndex));
+    }
+    
+    JSGlobalData& m_globalData;
+    CodeBlock* m_codeBlock;
+    CodeBlock* m_profiledBlock;
 
     Vector< OwnPtr<BasicBlock> , 8> m_blocks;
     Vector<NodeUse, 16> m_varArgChildren;
@@ -284,11 +322,11 @@ public:
     unsigned m_parameterSlots;
 private:
     
-    bool addImmediateShouldSpeculateInteger(CodeBlock* codeBlock, Node& add, Node& variable, Node& immediate)
+    bool addImmediateShouldSpeculateInteger(Node& add, Node& variable, Node& immediate)
     {
         ASSERT(immediate.hasConstant());
         
-        JSValue immediateValue = immediate.valueOfJSConstant(codeBlock);
+        JSValue immediateValue = immediate.valueOfJSConstant(m_codeBlock);
         if (!immediateValue.isNumber())
             return false;
         
diff --git a/Source/JavaScriptCore/dfg/DFGJITCompiler.cpp b/Source/JavaScriptCore/dfg/DFGJITCompiler.cpp
index ac5f314a1..7b2bbc788 100644
--- a/Source/JavaScriptCore/dfg/DFGJITCompiler.cpp
+++ b/Source/JavaScriptCore/dfg/DFGJITCompiler.cpp
@@ -116,7 +116,7 @@ void JITCompiler::link(LinkBuffer& linkBuffer)
 {
     // Link the code, populate data in CodeBlock data structures.
 #if DFG_ENABLE(DEBUG_VERBOSE)
-    fprintf(stderr, "JIT code for %p start at [%p, %p). Size = %zu.\n", m_codeBlock, linkBuffer.debugAddress(), static_cast<char*>(linkBuffer.debugAddress()) + linkBuffer.debugSize(), linkBuffer.debugSize());
+    dataLog("JIT code for %p start at [%p, %p). Size = %zu.\n", m_codeBlock, linkBuffer.debugAddress(), static_cast<char*>(linkBuffer.debugAddress()) + linkBuffer.debugSize(), linkBuffer.debugSize());
 #endif
 
     // Link all calls out from the JIT code to their respective functions.
@@ -134,27 +134,16 @@ void JITCompiler::link(LinkBuffer& linkBuffer)
             m_codeBlock->callReturnIndexVector().append(CallReturnOffsetToBytecodeOffset(returnAddressOffset, exceptionInfo));
         }
     }
+
+    Vector<CodeOriginAtCallReturnOffset>& codeOrigins = m_codeBlock->codeOrigins();
+    codeOrigins.resize(m_exceptionChecks.size());
     
-    unsigned numCallsFromInlineCode = 0;
     for (unsigned i = 0; i < m_exceptionChecks.size(); ++i) {
-        if (m_exceptionChecks[i].m_codeOrigin.inlineCallFrame)
-            numCallsFromInlineCode++;
-    }
-
-    if (numCallsFromInlineCode) {
-        Vector<CodeOriginAtCallReturnOffset>& codeOrigins = m_codeBlock->codeOrigins();
-        codeOrigins.resize(numCallsFromInlineCode);
-        
-        for (unsigned i = 0, j = 0; i < m_exceptionChecks.size(); ++i) {
-            CallExceptionRecord& record = m_exceptionChecks[i];
-            if (record.m_codeOrigin.inlineCallFrame) {
-                unsigned returnAddressOffset = linkBuffer.returnAddressOffset(m_exceptionChecks[i].m_call);
-                codeOrigins[j].codeOrigin = record.m_codeOrigin;
-                codeOrigins[j].callReturnOffset = returnAddressOffset;
-                record.m_token.assertCodeOriginIndex(j);
-                j++;
-            }
-        }
+        CallExceptionRecord& record = m_exceptionChecks[i];
+        unsigned returnAddressOffset = linkBuffer.returnAddressOffset(m_exceptionChecks[i].m_call);
+        codeOrigins[i].codeOrigin = record.m_codeOrigin;
+        codeOrigins[i].callReturnOffset = returnAddressOffset;
+        record.m_token.assertCodeOriginIndex(i);
     }
     
     m_codeBlock->setNumberOfStructureStubInfos(m_propertyAccesses.size());
@@ -212,6 +201,9 @@ void JITCompiler::compile(JITCode& entry)
     SpeculativeJIT speculative(*this);
     compileBody(speculative);
 
+    // Create OSR entry trampolines if necessary.
+    speculative.createOSREntries();
+
     LinkBuffer linkBuffer(*m_globalData, this, m_codeBlock);
     link(linkBuffer);
     speculative.linkOSREntries(linkBuffer);
@@ -251,7 +243,10 @@ void JITCompiler::compileFunction(JITCode& entry, MacroAssemblerCodePtr& entryWi
     registerFileCheck.link(this);
     move(stackPointerRegister, GPRInfo::argumentGPR0);
     poke(GPRInfo::callFrameRegister, OBJECT_OFFSETOF(struct JITStackFrame, callFrame) / sizeof(void*));
+
+    CallBeginToken token = beginCall();
     Call callRegisterFileCheck = call();
+    notifyCall(callRegisterFileCheck, CodeOrigin(0), token);
     jump(fromRegisterFileCheck);
     
     // The fast entry point into a function does not check the correct number of arguments
@@ -266,9 +261,14 @@ void JITCompiler::compileFunction(JITCode& entry, MacroAssemblerCodePtr& entryWi
     branch32(AboveOrEqual, GPRInfo::regT1, Imm32(m_codeBlock->numParameters())).linkTo(fromArityCheck, this);
     move(stackPointerRegister, GPRInfo::argumentGPR0);
     poke(GPRInfo::callFrameRegister, OBJECT_OFFSETOF(struct JITStackFrame, callFrame) / sizeof(void*));
+    token = beginCall();
     Call callArityCheck = call();
+    notifyCall(callArityCheck, CodeOrigin(0), token);
     move(GPRInfo::regT0, GPRInfo::callFrameRegister);
     jump(fromArityCheck);
+    
+    // Create OSR entry trampolines if necessary.
+    speculative.createOSREntries();
 
 
     // === Link ===
diff --git a/Source/JavaScriptCore/dfg/DFGJITCompiler.h b/Source/JavaScriptCore/dfg/DFGJITCompiler.h
index 5596876fc..a0c68fe4b 100644
--- a/Source/JavaScriptCore/dfg/DFGJITCompiler.h
+++ b/Source/JavaScriptCore/dfg/DFGJITCompiler.h
@@ -92,11 +92,7 @@ public:
         ASSERT_UNUSED(codeOriginIndex, codeOriginIndex < UINT_MAX);
         ASSERT_UNUSED(codeOriginIndex, codeOriginIndex == m_codeOriginIndex);
     }
-    
-    void assertNoCodeOriginIndex() const
-    {
-        ASSERT(m_codeOriginIndex == UINT_MAX);
-    }
+
 private:
 #if !ASSERT_DISABLED
     unsigned m_codeOriginIndex;
@@ -191,8 +187,8 @@ struct PropertyAccessRecord {
 // call to be linked).
 class JITCompiler : public CCallHelpers {
 public:
-    JITCompiler(JSGlobalData* globalData, Graph& dfg, CodeBlock* codeBlock)
-        : CCallHelpers(globalData, codeBlock)
+    JITCompiler(Graph& dfg)
+        : CCallHelpers(&dfg.m_globalData, dfg.m_codeBlock)
         , m_graph(dfg)
         , m_currentCodeOriginIndex(0)
     {
@@ -205,22 +201,16 @@ public:
     Graph& graph() { return m_graph; }
     
     // Just get a token for beginning a call.
-    CallBeginToken nextCallBeginToken(CodeOrigin codeOrigin)
+    CallBeginToken beginJSCall()
     {
-        if (!codeOrigin.inlineCallFrame)
-            return CallBeginToken();
         return CallBeginToken(m_currentCodeOriginIndex++);
     }
     
     // Get a token for beginning a call, and set the current code origin index in
     // the call frame.
-    CallBeginToken beginCall(CodeOrigin codeOrigin)
+    CallBeginToken beginCall()
     {
-        unsigned codeOriginIndex;
-        if (!codeOrigin.inlineCallFrame)
-            codeOriginIndex = UINT_MAX;
-        else
-            codeOriginIndex = m_currentCodeOriginIndex++;
+        unsigned codeOriginIndex = m_currentCodeOriginIndex++;
         store32(TrustedImm32(codeOriginIndex), tagFor(static_cast<VirtualRegister>(RegisterFile::ArgumentCount)));
         return CallBeginToken(codeOriginIndex);
     }
@@ -254,21 +244,6 @@ public:
         m_exceptionChecks.append(CallExceptionRecord(functionCall, exceptionCheck, codeOrigin, token));
     }
     
-    // Helper methods to check nodes for constants.
-    bool isConstant(NodeIndex nodeIndex) { return graph().isConstant(nodeIndex); }
-    bool isJSConstant(NodeIndex nodeIndex) { return graph().isJSConstant(nodeIndex); }
-    bool isInt32Constant(NodeIndex nodeIndex) { return graph().isInt32Constant(codeBlock(), nodeIndex); }
-    bool isDoubleConstant(NodeIndex nodeIndex) { return graph().isDoubleConstant(codeBlock(), nodeIndex); }
-    bool isNumberConstant(NodeIndex nodeIndex) { return graph().isNumberConstant(codeBlock(), nodeIndex); }
-    bool isBooleanConstant(NodeIndex nodeIndex) { return graph().isBooleanConstant(codeBlock(), nodeIndex); }
-    bool isFunctionConstant(NodeIndex nodeIndex) { return graph().isFunctionConstant(codeBlock(), nodeIndex); }
-    // Helper methods get constant values from nodes.
-    JSValue valueOfJSConstant(NodeIndex nodeIndex) { return graph().valueOfJSConstant(codeBlock(), nodeIndex); }
-    int32_t valueOfInt32Constant(NodeIndex nodeIndex) { return graph().valueOfInt32Constant(codeBlock(), nodeIndex); }
-    double valueOfNumberConstant(NodeIndex nodeIndex) { return graph().valueOfNumberConstant(codeBlock(), nodeIndex); }
-    bool valueOfBooleanConstant(NodeIndex nodeIndex) { return graph().valueOfBooleanConstant(codeBlock(), nodeIndex); }
-    JSFunction* valueOfFunctionConstant(NodeIndex nodeIndex) { return graph().valueOfFunctionConstant(codeBlock(), nodeIndex); }
-    
     // Helper methods to get predictions
     PredictedType getPrediction(Node& node) { return node.prediction(); }
     PredictedType getPrediction(NodeIndex nodeIndex) { return getPrediction(graph()[nodeIndex]); }
@@ -277,7 +252,7 @@ public:
 #if USE(JSVALUE32_64)
     void* addressOfDoubleConstant(NodeIndex nodeIndex)
     {
-        ASSERT(isNumberConstant(nodeIndex));
+        ASSERT(m_graph.isNumberConstant(nodeIndex));
         unsigned constantIndex = graph()[nodeIndex].constantNumber();
         return &(codeBlock()->constantRegister(FirstConstantRegisterIndex + constantIndex));
     }
@@ -339,14 +314,6 @@ public:
 #endif
     }
 
-    ValueProfile* valueProfileFor(NodeIndex nodeIndex)
-    {
-        if (nodeIndex == NoNode)
-            return 0;
-        
-        return m_graph.valueProfileFor(nodeIndex, baselineCodeBlockFor(m_graph[nodeIndex].codeOrigin));
-    }
-    
 private:
     // Internal implementation to compile.
     void compileEntry();
diff --git a/Source/JavaScriptCore/dfg/DFGNode.h b/Source/JavaScriptCore/dfg/DFGNode.h
index 2b6ebdb7f..87dae7786 100644
--- a/Source/JavaScriptCore/dfg/DFGNode.h
+++ b/Source/JavaScriptCore/dfg/DFGNode.h
@@ -485,7 +485,7 @@ struct Node {
     {
         return variableAccessData()->local();
     }
-
+    
     bool hasIdentifier()
     {
         switch (op) {
diff --git a/Source/JavaScriptCore/dfg/DFGOSREntry.cpp b/Source/JavaScriptCore/dfg/DFGOSREntry.cpp
index cbcd1319a..65f4cfcdd 100644
--- a/Source/JavaScriptCore/dfg/DFGOSREntry.cpp
+++ b/Source/JavaScriptCore/dfg/DFGOSREntry.cpp
@@ -45,7 +45,7 @@ void* prepareOSREntry(ExecState* exec, CodeBlock* codeBlock, unsigned bytecodeIn
     ASSERT(codeBlock->numberOfDFGOSREntries());
 
 #if ENABLE(JIT_VERBOSE_OSR)
-    printf("OSR in %p(%p) from bc#%u\n", codeBlock, codeBlock->alternative(), bytecodeIndex);
+    dataLog("OSR in %p(%p) from bc#%u\n", codeBlock, codeBlock->alternative(), bytecodeIndex);
 #endif
     
     JSGlobalData* globalData = &exec->globalData();
@@ -80,9 +80,9 @@ void* prepareOSREntry(ExecState* exec, CodeBlock* codeBlock, unsigned bytecodeIn
     for (size_t argument = 0; argument < entry->m_expectedValues.numberOfArguments(); ++argument) {
         if (argument >= exec->argumentCountIncludingThis()) {
 #if ENABLE(JIT_VERBOSE_OSR)
-            printf("    OSR failed because argument %zu was not passed, expected ", argument);
-            entry->m_expectedValues.argument(argument).dump(stdout);
-            printf(".\n");
+            dataLog("    OSR failed because argument %zu was not passed, expected ", argument);
+            entry->m_expectedValues.argument(argument).dump(WTF::dataFile());
+            dataLog(".\n");
 #endif
             return 0;
         }
@@ -95,9 +95,9 @@ void* prepareOSREntry(ExecState* exec, CodeBlock* codeBlock, unsigned bytecodeIn
         
         if (!entry->m_expectedValues.argument(argument).validate(value)) {
 #if ENABLE(JIT_VERBOSE_OSR)
-            printf("    OSR failed because argument %zu is %s, expected ", argument, value.description());
-            entry->m_expectedValues.argument(argument).dump(stdout);
-            printf(".\n");
+            dataLog("    OSR failed because argument %zu is %s, expected ", argument, value.description());
+            entry->m_expectedValues.argument(argument).dump(WTF::dataFile());
+            dataLog(".\n");
 #endif
             return 0;
         }
@@ -107,7 +107,7 @@ void* prepareOSREntry(ExecState* exec, CodeBlock* codeBlock, unsigned bytecodeIn
         if (entry->m_localsForcedDouble.get(local)) {
             if (!exec->registers()[local].jsValue().isNumber()) {
 #if ENABLE(JIT_VERBOSE_OSR)
-                printf("    OSR failed because variable %zu is %s, expected number.\n", local, exec->registers()[local].jsValue().description());
+                dataLog("    OSR failed because variable %zu is %s, expected number.\n", local, exec->registers()[local].jsValue().description());
 #endif
                 return 0;
             }
@@ -115,9 +115,9 @@ void* prepareOSREntry(ExecState* exec, CodeBlock* codeBlock, unsigned bytecodeIn
         }
         if (!entry->m_expectedValues.local(local).validate(exec->registers()[local].jsValue())) {
 #if ENABLE(JIT_VERBOSE_OSR)
-            printf("    OSR failed because variable %zu is %s, expected ", local, exec->registers()[local].jsValue().description());
-            entry->m_expectedValues.local(local).dump(stdout);
-            printf(".\n");
+            dataLog("    OSR failed because variable %zu is %s, expected ", local, exec->registers()[local].jsValue().description());
+            entry->m_expectedValues.local(local).dump(WTF::dataFile());
+            dataLog(".\n");
 #endif
             return 0;
         }
@@ -132,13 +132,13 @@ void* prepareOSREntry(ExecState* exec, CodeBlock* codeBlock, unsigned bytecodeIn
     
     if (!globalData->interpreter->registerFile().grow(&exec->registers()[codeBlock->m_numCalleeRegisters])) {
 #if ENABLE(JIT_VERBOSE_OSR)
-        printf("    OSR failed because stack growth failed.\n");
+        dataLog("    OSR failed because stack growth failed.\n");
 #endif
         return 0;
     }
     
 #if ENABLE(JIT_VERBOSE_OSR)
-    printf("    OSR should succeed.\n");
+    dataLog("    OSR should succeed.\n");
 #endif
     
 #if USE(JSVALUE64)
@@ -158,7 +158,7 @@ void* prepareOSREntry(ExecState* exec, CodeBlock* codeBlock, unsigned bytecodeIn
     void* result = codeBlock->getJITCode().executableAddressAtOffset(entry->m_machineCodeOffset);
     
 #if ENABLE(JIT_VERBOSE_OSR)
-    printf("    OSR returning machine code address %p.\n", result);
+    dataLog("    OSR returning machine code address %p.\n", result);
 #endif
     
     return result;
diff --git a/Source/JavaScriptCore/dfg/DFGOSRExit.cpp b/Source/JavaScriptCore/dfg/DFGOSRExit.cpp
index 113f2ea0d..95e4d8bf2 100644
--- a/Source/JavaScriptCore/dfg/DFGOSRExit.cpp
+++ b/Source/JavaScriptCore/dfg/DFGOSRExit.cpp
@@ -33,7 +33,7 @@
 
 namespace JSC { namespace DFG {
 
-OSRExit::OSRExit(ExitKind kind, JSValueSource jsValueSource, ValueProfile* valueProfile, MacroAssembler::Jump check, SpeculativeJIT* jit, unsigned recoveryIndex)
+OSRExit::OSRExit(ExitKind kind, JSValueSource jsValueSource, MethodOfGettingAValueProfile valueProfile, MacroAssembler::Jump check, SpeculativeJIT* jit, unsigned recoveryIndex)
     : m_jsValueSource(jsValueSource)
     , m_valueProfile(valueProfile)
     , m_check(check)
@@ -67,7 +67,7 @@ bool OSRExit::considerAddingAsFrequentExitSiteSlow(CodeBlock* dfgCodeBlock, Code
     if (static_cast<double>(m_count) / dfgCodeBlock->speculativeFailCounter() <= Options::osrExitProminenceForFrequentExitSite)
         return false;
     
-    return AssemblyHelpers::baselineCodeBlockForOriginAndBaselineCodeBlock(m_codeOrigin, profiledCodeBlock)->addFrequentExitSite(FrequentExitSite(m_codeOrigin.bytecodeIndex, m_kind));
+    return baselineCodeBlockForOriginAndBaselineCodeBlock(m_codeOrigin, profiledCodeBlock)->addFrequentExitSite(FrequentExitSite(m_codeOrigin.bytecodeIndex, m_kind));
 }
 
 } } // namespace JSC::DFG
diff --git a/Source/JavaScriptCore/dfg/DFGOSRExit.h b/Source/JavaScriptCore/dfg/DFGOSRExit.h
index 8e3fa6a5d..c28f7cbef 100644
--- a/Source/JavaScriptCore/dfg/DFGOSRExit.h
+++ b/Source/JavaScriptCore/dfg/DFGOSRExit.h
@@ -37,6 +37,7 @@
 #include "DFGGPRInfo.h"
 #include "DFGOperands.h"
 #include "MacroAssembler.h"
+#include "MethodOfGettingAValueProfile.h"
 #include "ValueProfile.h"
 #include "ValueRecovery.h"
 #include <wtf/Vector.h>
@@ -82,12 +83,12 @@ private:
 // This structure describes how to exit the speculative path by
 // going into baseline code.
 struct OSRExit {
-    OSRExit(ExitKind, JSValueSource, ValueProfile*, MacroAssembler::Jump, SpeculativeJIT*, unsigned recoveryIndex = 0);
+    OSRExit(ExitKind, JSValueSource, MethodOfGettingAValueProfile, MacroAssembler::Jump, SpeculativeJIT*, unsigned recoveryIndex = 0);
     
     MacroAssemblerCodeRef m_code;
     
     JSValueSource m_jsValueSource;
-    ValueProfile* m_valueProfile;
+    MethodOfGettingAValueProfile m_valueProfile;
     
     CorrectableJumpPoint m_check;
     NodeIndex m_nodeIndex;
diff --git a/Source/JavaScriptCore/dfg/DFGOSRExitCompiler.cpp b/Source/JavaScriptCore/dfg/DFGOSRExitCompiler.cpp
index 1b88c4ffc..a195ee3ba 100644
--- a/Source/JavaScriptCore/dfg/DFGOSRExitCompiler.cpp
+++ b/Source/JavaScriptCore/dfg/DFGOSRExitCompiler.cpp
@@ -48,12 +48,27 @@ void compileOSRExit(ExecState* exec)
     uint32_t exitIndex = globalData->osrExitIndex;
     OSRExit& exit = codeBlock->osrExit(exitIndex);
     
+    // Make sure all code on our inline stack is JIT compiled. This is necessary since
+    // we may opt to inline a code block even before it had ever been compiled by the
+    // JIT, but our OSR exit infrastructure currently only works if the target of the
+    // OSR exit is JIT code. This could be changed since there is nothing particularly
+    // hard about doing an OSR exit into the interpreter, but for now this seems to make
+    // sense in that if we're OSR exiting from inlined code of a DFG code block, then
+    // probably it's a good sign that the thing we're exiting into is hot. Even more
+    // interestingly, since the code was inlined, it may never otherwise get JIT
+    // compiled since the act of inlining it may ensure that it otherwise never runs.
+    for (CodeOrigin codeOrigin = exit.m_codeOrigin; codeOrigin.inlineCallFrame; codeOrigin = codeOrigin.inlineCallFrame->caller) {
+        static_cast<FunctionExecutable*>(codeOrigin.inlineCallFrame->executable.get())
+            ->baselineCodeBlockFor(codeOrigin.inlineCallFrame->isCall ? CodeForCall : CodeForConstruct)
+            ->jitCompile(*globalData);
+    }
+    
     SpeculationRecovery* recovery = 0;
     if (exit.m_recoveryIndex)
         recovery = &codeBlock->speculationRecovery(exit.m_recoveryIndex - 1);
 
 #if DFG_ENABLE(DEBUG_VERBOSE)
-    fprintf(stderr, "Generating OSR exit #%u (bc#%u, @%u, %s) for code block %p.\n", exitIndex, exit.m_codeOrigin.bytecodeIndex, exit.m_nodeIndex, exitKindToString(exit.m_kind), codeBlock);
+    dataLog("Generating OSR exit #%u (bc#%u, @%u, %s) for code block %p.\n", exitIndex, exit.m_codeOrigin.bytecodeIndex, exit.m_nodeIndex, exitKindToString(exit.m_kind), codeBlock);
 #endif
 
     {
@@ -66,7 +81,7 @@ void compileOSRExit(ExecState* exec)
         exit.m_code = patchBuffer.finalizeCode();
 
 #if DFG_ENABLE(DEBUG_VERBOSE)
-        fprintf(stderr, "OSR exit code at [%p, %p).\n", patchBuffer.debugAddress(), static_cast<char*>(patchBuffer.debugAddress()) + patchBuffer.debugSize());
+        dataLog("OSR exit code at [%p, %p).\n", patchBuffer.debugAddress(), static_cast<char*>(patchBuffer.debugAddress()) + patchBuffer.debugSize());
 #endif
     }
     
diff --git a/Source/JavaScriptCore/dfg/DFGOSRExitCompiler32_64.cpp b/Source/JavaScriptCore/dfg/DFGOSRExitCompiler32_64.cpp
index 4e33d7b02..a672234a3 100644
--- a/Source/JavaScriptCore/dfg/DFGOSRExitCompiler32_64.cpp
+++ b/Source/JavaScriptCore/dfg/DFGOSRExitCompiler32_64.cpp
@@ -36,15 +36,15 @@ void OSRExitCompiler::compileExit(const OSRExit& exit, SpeculationRecovery* reco
 {
     // 1) Pro-forma stuff.
 #if DFG_ENABLE(DEBUG_VERBOSE)
-    fprintf(stderr, "OSR exit for Node @%d (", (int)exit.m_nodeIndex);
+    dataLog("OSR exit for Node @%d (", (int)exit.m_nodeIndex);
     for (CodeOrigin codeOrigin = exit.m_codeOrigin; ; codeOrigin = codeOrigin.inlineCallFrame->caller) {
-        fprintf(stderr, "bc#%u", codeOrigin.bytecodeIndex);
+        dataLog("bc#%u", codeOrigin.bytecodeIndex);
         if (!codeOrigin.inlineCallFrame)
             break;
-        fprintf(stderr, " -> %p ", codeOrigin.inlineCallFrame->executable.get());
+        dataLog(" -> %p ", codeOrigin.inlineCallFrame->executable.get());
     }
-    fprintf(stderr, ") at JIT offset 0x%x  ", m_jit.debugOffset());
-    exit.dump(stderr);
+    dataLog(") at JIT offset 0x%x  ", m_jit.debugOffset());
+    exit.dump(WTF::dataFile());
 #endif
 #if DFG_ENABLE(VERBOSE_SPECULATION_FAILURE)
     SpeculationFailureDebugInfo* debugInfo = new SpeculationFailureDebugInfo;
@@ -83,6 +83,8 @@ void OSRExitCompiler::compileExit(const OSRExit& exit, SpeculationRecovery* reco
     // 3) Refine some value profile, if appropriate.
     
     if (!!exit.m_jsValueSource && !!exit.m_valueProfile) {
+        EncodedJSValue* bucket = exit.m_valueProfile.getSpecFailBucket(0);
+        
         if (exit.m_jsValueSource.isAddress()) {
             // Save a register so we can use it.
             GPRReg scratch = GPRInfo::regT0;
@@ -91,16 +93,16 @@ void OSRExitCompiler::compileExit(const OSRExit& exit, SpeculationRecovery* reco
             EncodedJSValue* scratchBuffer = static_cast<EncodedJSValue*>(m_jit.globalData()->scratchBufferForSize(sizeof(uint32_t)));
             m_jit.store32(scratch, scratchBuffer);
             m_jit.load32(exit.m_jsValueSource.asAddress(OBJECT_OFFSETOF(EncodedValueDescriptor, asBits.tag)), scratch);
-            m_jit.store32(scratch, &bitwise_cast<EncodedValueDescriptor*>(exit.m_valueProfile->specFailBucket(0))->asBits.tag);
+            m_jit.store32(scratch, &bitwise_cast<EncodedValueDescriptor*>(bucket)->asBits.tag);
             m_jit.load32(exit.m_jsValueSource.asAddress(OBJECT_OFFSETOF(EncodedValueDescriptor, asBits.payload)), scratch);
-            m_jit.store32(scratch, &bitwise_cast<EncodedValueDescriptor*>(exit.m_valueProfile->specFailBucket(0))->asBits.payload);
+            m_jit.store32(scratch, &bitwise_cast<EncodedValueDescriptor*>(bucket)->asBits.payload);
             m_jit.load32(scratchBuffer, scratch);
         } else if (exit.m_jsValueSource.hasKnownTag()) {
-            m_jit.store32(AssemblyHelpers::Imm32(exit.m_jsValueSource.tag()), &bitwise_cast<EncodedValueDescriptor*>(exit.m_valueProfile->specFailBucket(0))->asBits.tag);
-            m_jit.store32(exit.m_jsValueSource.payloadGPR(), &bitwise_cast<EncodedValueDescriptor*>(exit.m_valueProfile->specFailBucket(0))->asBits.payload);
+            m_jit.store32(AssemblyHelpers::Imm32(exit.m_jsValueSource.tag()), &bitwise_cast<EncodedValueDescriptor*>(bucket)->asBits.tag);
+            m_jit.store32(exit.m_jsValueSource.payloadGPR(), &bitwise_cast<EncodedValueDescriptor*>(bucket)->asBits.payload);
         } else {
-            m_jit.store32(exit.m_jsValueSource.tagGPR(), &bitwise_cast<EncodedValueDescriptor*>(exit.m_valueProfile->specFailBucket(0))->asBits.tag);
-            m_jit.store32(exit.m_jsValueSource.payloadGPR(), &bitwise_cast<EncodedValueDescriptor*>(exit.m_valueProfile->specFailBucket(0))->asBits.payload);
+            m_jit.store32(exit.m_jsValueSource.tagGPR(), &bitwise_cast<EncodedValueDescriptor*>(bucket)->asBits.tag);
+            m_jit.store32(exit.m_jsValueSource.payloadGPR(), &bitwise_cast<EncodedValueDescriptor*>(bucket)->asBits.payload);
         }
     }
     
@@ -653,7 +655,7 @@ void OSRExitCompiler::compileExit(const OSRExit& exit, SpeculationRecovery* reco
     m_jit.jump(GPRInfo::regT2);
 
 #if DFG_ENABLE(DEBUG_VERBOSE)
-    fprintf(stderr, "   -> %p\n", jumpTarget);
+    dataLog("   -> %p\n", jumpTarget);
 #endif
 }
 
diff --git a/Source/JavaScriptCore/dfg/DFGOSRExitCompiler64.cpp b/Source/JavaScriptCore/dfg/DFGOSRExitCompiler64.cpp
index 98c891ac7..f5e03973c 100644
--- a/Source/JavaScriptCore/dfg/DFGOSRExitCompiler64.cpp
+++ b/Source/JavaScriptCore/dfg/DFGOSRExitCompiler64.cpp
@@ -36,15 +36,15 @@ void OSRExitCompiler::compileExit(const OSRExit& exit, SpeculationRecovery* reco
 {
     // 1) Pro-forma stuff.
 #if DFG_ENABLE(DEBUG_VERBOSE)
-    fprintf(stderr, "OSR exit for Node @%d (", (int)exit.m_nodeIndex);
+    dataLog("OSR exit for Node @%d (", (int)exit.m_nodeIndex);
     for (CodeOrigin codeOrigin = exit.m_codeOrigin; ; codeOrigin = codeOrigin.inlineCallFrame->caller) {
-        fprintf(stderr, "bc#%u", codeOrigin.bytecodeIndex);
+        dataLog("bc#%u", codeOrigin.bytecodeIndex);
         if (!codeOrigin.inlineCallFrame)
             break;
-        fprintf(stderr, " -> %p ", codeOrigin.inlineCallFrame->executable.get());
+        dataLog(" -> %p ", codeOrigin.inlineCallFrame->executable.get());
     }
-    fprintf(stderr, ")  ");
-    exit.dump(stderr);
+    dataLog(")  ");
+    exit.dump(WTF::dataFile());
 #endif
 #if DFG_ENABLE(VERBOSE_SPECULATION_FAILURE)
     SpeculationFailureDebugInfo* debugInfo = new SpeculationFailureDebugInfo;
@@ -88,14 +88,20 @@ void OSRExitCompiler::compileExit(const OSRExit& exit, SpeculationRecovery* reco
     // 3) Refine some value profile, if appropriate.
     
     if (!!exit.m_jsValueSource && !!exit.m_valueProfile) {
+        EncodedJSValue* bucket = exit.m_valueProfile.getSpecFailBucket(0);
+        
+#if DFG_ENABLE(VERBOSE_SPECULATION_FAILURE)
+        dataLog("  (have exit profile, bucket %p)  ", bucket);
+#endif
+            
         if (exit.m_jsValueSource.isAddress()) {
             // We can't be sure that we have a spare register. So use the tagTypeNumberRegister,
             // since we know how to restore it.
             m_jit.loadPtr(AssemblyHelpers::Address(exit.m_jsValueSource.asAddress()), GPRInfo::tagTypeNumberRegister);
-            m_jit.storePtr(GPRInfo::tagTypeNumberRegister, exit.m_valueProfile->specFailBucket(0));
+            m_jit.storePtr(GPRInfo::tagTypeNumberRegister, bucket);
             m_jit.move(AssemblyHelpers::TrustedImmPtr(bitwise_cast<void*>(TagTypeNumber)), GPRInfo::tagTypeNumberRegister);
         } else
-            m_jit.storePtr(exit.m_jsValueSource.gpr(), exit.m_valueProfile->specFailBucket(0));
+            m_jit.storePtr(exit.m_jsValueSource.gpr(), bucket);
     }
 
     // 4) Figure out how many scratch slots we'll need. We need one for every GPR/FPR
@@ -184,24 +190,24 @@ void OSRExitCompiler::compileExit(const OSRExit& exit, SpeculationRecovery* reco
     }
     
 #if DFG_ENABLE(DEBUG_VERBOSE)
-    fprintf(stderr, "  ");
+    dataLog("  ");
     if (numberOfPoisonedVirtualRegisters)
-        fprintf(stderr, "Poisoned=%u ", numberOfPoisonedVirtualRegisters);
+        dataLog("Poisoned=%u ", numberOfPoisonedVirtualRegisters);
     if (numberOfDisplacedVirtualRegisters)
-        fprintf(stderr, "Displaced=%u ", numberOfDisplacedVirtualRegisters);
+        dataLog("Displaced=%u ", numberOfDisplacedVirtualRegisters);
     if (haveUnboxedInt32s)
-        fprintf(stderr, "UnboxedInt32 ");
+        dataLog("UnboxedInt32 ");
     if (haveUnboxedDoubles)
-        fprintf(stderr, "UnboxedDoubles ");
+        dataLog("UnboxedDoubles ");
     if (haveUInt32s)
-        fprintf(stderr, "UInt32 ");
+        dataLog("UInt32 ");
     if (haveFPRs)
-        fprintf(stderr, "FPR ");
+        dataLog("FPR ");
     if (haveConstants)
-        fprintf(stderr, "Constants ");
+        dataLog("Constants ");
     if (haveUndefined)
-        fprintf(stderr, "Undefined ");
-    fprintf(stderr, " ");
+        dataLog("Undefined ");
+    dataLog(" ");
 #endif
     
     EncodedJSValue* scratchBuffer = static_cast<EncodedJSValue*>(m_jit.globalData()->scratchBufferForSize(sizeof(EncodedJSValue) * std::max(haveUInt32s ? 2u : 0u, numberOfPoisonedVirtualRegisters + (numberOfDisplacedVirtualRegisters <= GPRInfo::numberOfRegisters ? 0 : numberOfDisplacedVirtualRegisters))));
@@ -624,7 +630,7 @@ void OSRExitCompiler::compileExit(const OSRExit& exit, SpeculationRecovery* reco
     m_jit.jump(GPRInfo::regT1);
 
 #if DFG_ENABLE(DEBUG_VERBOSE)
-    fprintf(stderr, "-> %p\n", jumpTarget);
+    dataLog("-> %p\n", jumpTarget);
 #endif
 }
 
diff --git a/Source/JavaScriptCore/dfg/DFGOperations.cpp b/Source/JavaScriptCore/dfg/DFGOperations.cpp
index 569b4fe86..165a21416 100644
--- a/Source/JavaScriptCore/dfg/DFGOperations.cpp
+++ b/Source/JavaScriptCore/dfg/DFGOperations.cpp
@@ -26,11 +26,10 @@
 #include "config.h"
 #include "DFGOperations.h"
 
-#if ENABLE(DFG_JIT)
-
 #include "CodeBlock.h"
 #include "DFGOSRExit.h"
 #include "DFGRepatch.h"
+#include "HostCallReturnValue.h"
 #include "GetterSetter.h"
 #include "InlineASM.h"
 #include "Interpreter.h"
@@ -38,6 +37,8 @@
 #include "JSGlobalData.h"
 #include "Operations.h"
 
+#if ENABLE(DFG_JIT)
+
 #if CPU(X86_64)
 
 #define FUNCTION_WRAPPER_WITH_RETURN_ADDRESS(function, register) \
@@ -611,6 +612,70 @@ void DFG_OPERATION operationPutByIdDirectNonStrictOptimizeWithReturnAddress(Exec
         stubInfo.seen = true;
 }
 
+V_FUNCTION_WRAPPER_WITH_RETURN_ADDRESS_EJCI(operationPutByIdStrictBuildList);
+void DFG_OPERATION operationPutByIdStrictBuildListWithReturnAddress(ExecState* exec, EncodedJSValue encodedValue, JSCell* base, Identifier* propertyName, ReturnAddressPtr returnAddress)
+{
+    JSGlobalData* globalData = &exec->globalData();
+    NativeCallFrameTracer tracer(globalData, exec);
+    
+    JSValue value = JSValue::decode(encodedValue);
+    JSValue baseValue(base);
+    PutPropertySlot slot(true);
+    
+    baseValue.put(exec, *propertyName, value, slot);
+    
+    StructureStubInfo& stubInfo = exec->codeBlock()->getStubInfo(returnAddress);
+    dfgBuildPutByIdList(exec, baseValue, *propertyName, slot, stubInfo, NotDirect);
+}
+
+V_FUNCTION_WRAPPER_WITH_RETURN_ADDRESS_EJCI(operationPutByIdNonStrictBuildList);
+void DFG_OPERATION operationPutByIdNonStrictBuildListWithReturnAddress(ExecState* exec, EncodedJSValue encodedValue, JSCell* base, Identifier* propertyName, ReturnAddressPtr returnAddress)
+{
+    JSGlobalData* globalData = &exec->globalData();
+    NativeCallFrameTracer tracer(globalData, exec);
+    
+    JSValue value = JSValue::decode(encodedValue);
+    JSValue baseValue(base);
+    PutPropertySlot slot(false);
+    
+    baseValue.put(exec, *propertyName, value, slot);
+    
+    StructureStubInfo& stubInfo = exec->codeBlock()->getStubInfo(returnAddress);
+    dfgBuildPutByIdList(exec, baseValue, *propertyName, slot, stubInfo, NotDirect);
+}
+
+V_FUNCTION_WRAPPER_WITH_RETURN_ADDRESS_EJCI(operationPutByIdDirectStrictBuildList);
+void DFG_OPERATION operationPutByIdDirectStrictBuildListWithReturnAddress(ExecState* exec, EncodedJSValue encodedValue, JSCell* base, Identifier* propertyName, ReturnAddressPtr returnAddress)
+{
+    JSGlobalData* globalData = &exec->globalData();
+    NativeCallFrameTracer tracer(globalData, exec);
+    
+    JSValue value = JSValue::decode(encodedValue);
+    PutPropertySlot slot(true);
+    
+    ASSERT(base->isObject());
+    asObject(base)->putDirect(exec->globalData(), *propertyName, value, slot);
+    
+    StructureStubInfo& stubInfo = exec->codeBlock()->getStubInfo(returnAddress);
+    dfgBuildPutByIdList(exec, base, *propertyName, slot, stubInfo, Direct);
+}
+
+V_FUNCTION_WRAPPER_WITH_RETURN_ADDRESS_EJCI(operationPutByIdDirectNonStrictBuildList);
+void DFG_OPERATION operationPutByIdDirectNonStrictBuildListWithReturnAddress(ExecState* exec, EncodedJSValue encodedValue, JSCell* base, Identifier* propertyName, ReturnAddressPtr returnAddress)
+{
+    JSGlobalData* globalData = &exec->globalData();
+    NativeCallFrameTracer tracer(globalData, exec);
+    
+    JSValue value = JSValue::decode(encodedValue);
+    PutPropertySlot slot(false);
+    
+    ASSERT(base->isObject());
+    asObject(base)->putDirect(exec->globalData(), *propertyName, value, slot);
+    
+    StructureStubInfo& stubInfo = exec->codeBlock()->getStubInfo(returnAddress);
+    dfgBuildPutByIdList(exec, base, *propertyName, slot, stubInfo, Direct);
+}
+
 size_t DFG_OPERATION operationCompareLess(ExecState* exec, EncodedJSValue encodedOp1, EncodedJSValue encodedOp2)
 {
     JSGlobalData* globalData = &exec->globalData();
@@ -673,50 +738,6 @@ size_t DFG_OPERATION operationCompareStrictEq(ExecState* exec, EncodedJSValue en
     return JSValue::strictEqual(exec, JSValue::decode(encodedOp1), JSValue::decode(encodedOp2));
 }
 
-EncodedJSValue DFG_OPERATION getHostCallReturnValue();
-EncodedJSValue DFG_OPERATION getHostCallReturnValueWithExecState(ExecState*);
-
-#if CPU(X86_64)
-asm (
-".globl " SYMBOL_STRING(getHostCallReturnValue) "\n"
-HIDE_SYMBOL(getHostCallReturnValue) "\n"
-SYMBOL_STRING(getHostCallReturnValue) ":" "\n"
-    "mov -40(%r13), %r13\n"
-    "mov %r13, %rdi\n"
-    "jmp " SYMBOL_STRING_RELOCATION(getHostCallReturnValueWithExecState) "\n"
-);
-#elif CPU(X86)
-asm (
-".globl " SYMBOL_STRING(getHostCallReturnValue) "\n"
-HIDE_SYMBOL(getHostCallReturnValue) "\n"
-SYMBOL_STRING(getHostCallReturnValue) ":" "\n"
-    "mov -40(%edi), %edi\n"
-    "mov %edi, 4(%esp)\n"
-    "jmp " SYMBOL_STRING_RELOCATION(getHostCallReturnValueWithExecState) "\n"
-);
-#elif CPU(ARM_THUMB2)
-asm (
-".text" "\n"
-".align 2" "\n"
-".globl " SYMBOL_STRING(getHostCallReturnValue) "\n"
-HIDE_SYMBOL(getHostCallReturnValue) "\n"
-".thumb" "\n"
-".thumb_func " THUMB_FUNC_PARAM(getHostCallReturnValue) "\n"
-SYMBOL_STRING(getHostCallReturnValue) ":" "\n"
-    "ldr r5, [r5, #-40]" "\n"
-    "cpy r0, r5" "\n"
-    "b " SYMBOL_STRING_RELOCATION(getHostCallReturnValueWithExecState) "\n"
-);
-#endif
-
-EncodedJSValue DFG_OPERATION getHostCallReturnValueWithExecState(ExecState* exec)
-{
-    JSGlobalData* globalData = &exec->globalData();
-    NativeCallFrameTracer tracer(globalData, exec);
-    
-    return JSValue::encode(exec->globalData().hostCallReturnValue);
-}
-
 static void* handleHostCall(ExecState* execCallee, JSValue callee, CodeSpecializationKind kind)
 {
     ExecState* exec = execCallee->callerFrame();
@@ -724,6 +745,7 @@ static void* handleHostCall(ExecState* execCallee, JSValue callee, CodeSpecializ
 
     execCallee->setScopeChain(exec->scopeChain());
     execCallee->setCodeBlock(0);
+    execCallee->clearReturnPC();
 
     if (kind == CodeForCall) {
         CallData callData;
@@ -1021,7 +1043,7 @@ void DFG_OPERATION debugOperationPrintSpeculationFailure(ExecState* exec, void*
     SpeculationFailureDebugInfo* debugInfo = static_cast<SpeculationFailureDebugInfo*>(debugInfoRaw);
     CodeBlock* codeBlock = debugInfo->codeBlock;
     CodeBlock* alternative = codeBlock->alternative();
-    printf("Speculation failure in %p at @%u with executeCounter = %d, reoptimizationRetryCounter = %u, optimizationDelayCounter = %u, success/fail %u/%u\n", codeBlock, debugInfo->nodeIndex, alternative ? alternative->jitExecuteCounter() : 0, alternative ? alternative->reoptimizationRetryCounter() : 0, alternative ? alternative->optimizationDelayCounter() : 0, codeBlock->speculativeSuccessCounter(), codeBlock->speculativeFailCounter());
+    dataLog("Speculation failure in %p at @%u with executeCounter = %d, reoptimizationRetryCounter = %u, optimizationDelayCounter = %u, success/fail %u/%u\n", codeBlock, debugInfo->nodeIndex, alternative ? alternative->jitExecuteCounter() : 0, alternative ? alternative->reoptimizationRetryCounter() : 0, alternative ? alternative->optimizationDelayCounter() : 0, codeBlock->speculativeSuccessCounter(), codeBlock->speculativeFailCounter());
 }
 #endif
 
@@ -1029,3 +1051,52 @@ void DFG_OPERATION debugOperationPrintSpeculationFailure(ExecState* exec, void*
 } } // namespace JSC::DFG
 
 #endif
+
+#if COMPILER(GCC)
+
+namespace JSC {
+
+#if CPU(X86_64)
+asm (
+".globl " SYMBOL_STRING(getHostCallReturnValue) "\n"
+HIDE_SYMBOL(getHostCallReturnValue) "\n"
+SYMBOL_STRING(getHostCallReturnValue) ":" "\n"
+    "mov -40(%r13), %r13\n"
+    "mov %r13, %rdi\n"
+    "jmp " SYMBOL_STRING_RELOCATION(getHostCallReturnValueWithExecState) "\n"
+);
+#elif CPU(X86)
+asm (
+".globl " SYMBOL_STRING(getHostCallReturnValue) "\n"
+HIDE_SYMBOL(getHostCallReturnValue) "\n"
+SYMBOL_STRING(getHostCallReturnValue) ":" "\n"
+    "mov -40(%edi), %edi\n"
+    "mov %edi, 4(%esp)\n"
+    "jmp " SYMBOL_STRING_RELOCATION(getHostCallReturnValueWithExecState) "\n"
+);
+#elif CPU(ARM_THUMB2)
+asm (
+".text" "\n"
+".align 2" "\n"
+".globl " SYMBOL_STRING(getHostCallReturnValue) "\n"
+HIDE_SYMBOL(getHostCallReturnValue) "\n"
+".thumb" "\n"
+".thumb_func " THUMB_FUNC_PARAM(getHostCallReturnValue) "\n"
+SYMBOL_STRING(getHostCallReturnValue) ":" "\n"
+    "ldr r5, [r5, #-40]" "\n"
+    "cpy r0, r5" "\n"
+    "b " SYMBOL_STRING_RELOCATION(getHostCallReturnValueWithExecState) "\n"
+);
+#endif
+
+extern "C" EncodedJSValue HOST_CALL_RETURN_VALUE_OPTION getHostCallReturnValueWithExecState(ExecState* exec)
+{
+    if (!exec)
+        return JSValue::encode(JSValue());
+    return JSValue::encode(exec->globalData().hostCallReturnValue);
+}
+
+} // namespace JSC
+
+#endif // COMPILER(GCC)
+
diff --git a/Source/JavaScriptCore/dfg/DFGOperations.h b/Source/JavaScriptCore/dfg/DFGOperations.h
index 5de9d3af3..cdb88de27 100644
--- a/Source/JavaScriptCore/dfg/DFGOperations.h
+++ b/Source/JavaScriptCore/dfg/DFGOperations.h
@@ -28,7 +28,8 @@
 
 #if ENABLE(DFG_JIT)
 
-#include <dfg/DFGJITCompiler.h>
+#include "DFGJITCompiler.h"
+#include "PutKind.h"
 
 namespace JSC {
 
@@ -36,8 +37,6 @@ struct GlobalResolveInfo;
 
 namespace DFG {
 
-enum PutKind { Direct, NotDirect };
-
 extern "C" {
 
 #if CALLING_CONVENTION_IS_STDCALL
@@ -130,6 +129,10 @@ void DFG_OPERATION operationPutByIdStrictOptimize(ExecState*, EncodedJSValue enc
 void DFG_OPERATION operationPutByIdNonStrictOptimize(ExecState*, EncodedJSValue encodedValue, JSCell* base, Identifier*);
 void DFG_OPERATION operationPutByIdDirectStrictOptimize(ExecState*, EncodedJSValue encodedValue, JSCell* base, Identifier*);
 void DFG_OPERATION operationPutByIdDirectNonStrictOptimize(ExecState*, EncodedJSValue encodedValue, JSCell* base, Identifier*);
+void DFG_OPERATION operationPutByIdStrictBuildList(ExecState*, EncodedJSValue encodedValue, JSCell* base, Identifier*);
+void DFG_OPERATION operationPutByIdNonStrictBuildList(ExecState*, EncodedJSValue encodedValue, JSCell* base, Identifier*);
+void DFG_OPERATION operationPutByIdDirectStrictBuildList(ExecState*, EncodedJSValue encodedValue, JSCell* base, Identifier*);
+void DFG_OPERATION operationPutByIdDirectNonStrictBuildList(ExecState*, EncodedJSValue encodedValue, JSCell* base, Identifier*);
 // These comparisons return a boolean within a size_t such that the value is zero extended to fill the register.
 size_t DFG_OPERATION operationCompareLess(ExecState*, EncodedJSValue encodedOp1, EncodedJSValue encodedOp2);
 size_t DFG_OPERATION operationCompareLessEq(ExecState*, EncodedJSValue encodedOp1, EncodedJSValue encodedOp2);
diff --git a/Source/JavaScriptCore/dfg/DFGPropagator.h b/Source/JavaScriptCore/dfg/DFGPhase.cpp
index e24c06b2b..bc1eabff4 100644
--- a/Source/JavaScriptCore/dfg/DFGPropagator.h
+++ b/Source/JavaScriptCore/dfg/DFGPhase.cpp
@@ -23,24 +23,26 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
  */
 
-#ifndef DFGPropagator_h
-#define DFGPropagator_h
+#include "config.h"
+#include "DFGPhase.h"
 
 #if ENABLE(DFG_JIT)
 
-#include <dfg/DFGGraph.h>
+namespace JSC { namespace DFG {
 
-namespace JSC {
+#if DFG_ENABLE(DEBUG_PROPAGATION_VERBOSE)
+void Phase::beginPhase()
+{
+    dataLog("Beginning DFG phase %s.\n", m_name);
+    dataLog("Graph before %s:\n", m_name);
+    m_graph.dump(m_codeBlock);
+}
 
-class CodeBlock;
-class JSGlobalData;
-
-namespace DFG {
-
-// Propagate dynamic predictions from value sources to variables.
-void propagate(Graph&, JSGlobalData*, CodeBlock*);
+void Phase::endPhase()
+{
+}
+#endif
 
 } } // namespace JSC::DFG
 
-#endif
-#endif
+#endif // ENABLE(DFG_JIT)
diff --git a/Source/JavaScriptCore/dfg/DFGPhase.h b/Source/JavaScriptCore/dfg/DFGPhase.h
new file mode 100644
index 000000000..1d344c0c3
--- /dev/null
+++ b/Source/JavaScriptCore/dfg/DFGPhase.h
@@ -0,0 +1,87 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef DFGPhase_h
+#define DFGPhase_h
+
+#include <wtf/Platform.h>
+
+#if ENABLE(DFG_JIT)
+
+#include "DFGCommon.h"
+#include "DFGGraph.h"
+
+namespace JSC { namespace DFG {
+
+class Phase {
+public:
+    Phase(Graph& graph, const char* name)
+        : m_graph(graph)
+        , m_name(name)
+    {
+        beginPhase();
+    }
+    
+    ~Phase()
+    {
+        endPhase();
+    }
+    
+    // Each phase must have a run() method.
+    
+protected:
+    // Things you need to have a DFG compiler phase.
+    Graph& m_graph;
+    
+    JSGlobalData& globalData() { return m_graph.m_globalData; }
+    CodeBlock* codeBlock() { return m_graph.m_codeBlock; }
+    CodeBlock* profiledBlock() { return m_graph.m_profiledBlock; }
+    
+    const char* m_name;
+    
+private:
+    // Call these hooks when starting and finishing.
+#if DFG_ENABLE(DEBUG_PROPAGATION_VERBOSE)
+    void beginPhase();
+    void endPhase();
+#else // DFG_ENABLE(DEBUG_PROPAGATION_VERBOSE)
+    void beginPhase() { }
+    void endPhase() { }
+#endif // DFG_ENABLE(DEBUG_PROPAGATION_VERBOSE)
+};
+
+template<typename PhaseType>
+void runPhase(Graph& graph)
+{
+    PhaseType phase(graph);
+    phase.run();
+}
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
+
+#endif // DFGPhase_h
+
diff --git a/Source/JavaScriptCore/dfg/DFGPredictionPropagationPhase.cpp b/Source/JavaScriptCore/dfg/DFGPredictionPropagationPhase.cpp
new file mode 100644
index 000000000..b4c9e075a
--- /dev/null
+++ b/Source/JavaScriptCore/dfg/DFGPredictionPropagationPhase.cpp
@@ -0,0 +1,709 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "DFGPredictionPropagationPhase.h"
+
+#if ENABLE(DFG_JIT)
+
+#include "DFGGraph.h"
+#include "DFGPhase.h"
+
+namespace JSC { namespace DFG {
+
+class PredictionPropagationPhase : public Phase {
+public:
+    PredictionPropagationPhase(Graph& graph)
+        : Phase(graph, "prediction propagation")
+    {
+    }
+    
+    void run()
+    {
+#if DFG_ENABLE(DEBUG_PROPAGATION_VERBOSE)
+        m_count = 0;
+#endif
+        // Two stage process: first propagate predictions, then propagate while doing double voting.
+        
+        do {
+            m_changed = false;
+            
+            // Forward propagation is near-optimal for both topologically-sorted and
+            // DFS-sorted code.
+            propagateForward();
+            if (!m_changed)
+                break;
+            
+            // Backward propagation reduces the likelihood that pathological code will
+            // cause slowness. Loops (especially nested ones) resemble backward flow.
+            // This pass captures two cases: (1) it detects if the forward fixpoint
+            // found a sound solution and (2) short-circuits backward flow.
+            m_changed = false;
+            propagateBackward();
+        } while (m_changed);
+        
+        do {
+            m_changed = false;
+            doRoundOfDoubleVoting();
+            propagateForward();
+            if (!m_changed)
+                break;
+            
+            m_changed = false;
+            doRoundOfDoubleVoting();
+            propagateBackward();
+        } while (m_changed);
+        
+        fixup();
+    }
+    
+private:
+    bool setPrediction(PredictedType prediction)
+    {
+        ASSERT(m_graph[m_compileIndex].hasResult());
+        
+        // setPrediction() is used when we know that there is no way that we can change
+        // our minds about what the prediction is going to be. There is no semantic
+        // difference between setPrediction() and mergePrediction() other than the
+        // increased checking to validate this property.
+        ASSERT(m_graph[m_compileIndex].prediction() == PredictNone || m_graph[m_compileIndex].prediction() == prediction);
+        
+        return m_graph[m_compileIndex].predict(prediction);
+    }
+    
+    bool mergePrediction(PredictedType prediction)
+    {
+        ASSERT(m_graph[m_compileIndex].hasResult());
+        
+        return m_graph[m_compileIndex].predict(prediction);
+    }
+    
+    void propagate(Node& node)
+    {
+        if (!node.shouldGenerate())
+            return;
+        
+        NodeType op = node.op;
+
+#if DFG_ENABLE(DEBUG_PROPAGATION_VERBOSE)
+        dataLog("   %s @%u: ", Graph::opName(op), m_compileIndex);
+#endif
+        
+        bool changed = false;
+        
+        switch (op) {
+        case JSConstant:
+        case WeakJSConstant: {
+            changed |= setPrediction(predictionFromValue(m_graph.valueOfJSConstant(m_compileIndex)));
+            break;
+        }
+            
+        case GetLocal: {
+            PredictedType prediction = node.variableAccessData()->prediction();
+            if (prediction)
+                changed |= mergePrediction(prediction);
+            break;
+        }
+            
+        case SetLocal: {
+            changed |= node.variableAccessData()->predict(m_graph[node.child1()].prediction());
+            break;
+        }
+            
+        case BitAnd:
+        case BitOr:
+        case BitXor:
+        case BitRShift:
+        case BitLShift:
+        case BitURShift:
+        case ValueToInt32: {
+            changed |= setPrediction(PredictInt32);
+            break;
+        }
+            
+        case ArrayPop:
+        case ArrayPush: {
+            if (node.getHeapPrediction())
+                changed |= mergePrediction(node.getHeapPrediction());
+            break;
+        }
+
+        case StringCharCodeAt: {
+            changed |= mergePrediction(PredictInt32);
+            break;
+        }
+
+        case ArithMod: {
+            PredictedType left = m_graph[node.child1()].prediction();
+            PredictedType right = m_graph[node.child2()].prediction();
+            
+            if (left && right) {
+                if (isInt32Prediction(mergePredictions(left, right)) && nodeCanSpeculateInteger(node.arithNodeFlags()))
+                    changed |= mergePrediction(PredictInt32);
+                else
+                    changed |= mergePrediction(PredictDouble);
+            }
+            break;
+        }
+            
+        case UInt32ToNumber: {
+            if (nodeCanSpeculateInteger(node.arithNodeFlags()))
+                changed |= setPrediction(PredictInt32);
+            else
+                changed |= setPrediction(PredictNumber);
+            break;
+        }
+
+        case ValueAdd: {
+            PredictedType left = m_graph[node.child1()].prediction();
+            PredictedType right = m_graph[node.child2()].prediction();
+            
+            if (left && right) {
+                if (isNumberPrediction(left) && isNumberPrediction(right)) {
+                    if (m_graph.addShouldSpeculateInteger(node))
+                        changed |= mergePrediction(PredictInt32);
+                    else
+                        changed |= mergePrediction(PredictDouble);
+                } else if (!(left & PredictNumber) || !(right & PredictNumber)) {
+                    // left or right is definitely something other than a number.
+                    changed |= mergePrediction(PredictString);
+                } else
+                    changed |= mergePrediction(PredictString | PredictInt32 | PredictDouble);
+            }
+            break;
+        }
+            
+        case ArithAdd:
+        case ArithSub: {
+            PredictedType left = m_graph[node.child1()].prediction();
+            PredictedType right = m_graph[node.child2()].prediction();
+            
+            if (left && right) {
+                if (m_graph.addShouldSpeculateInteger(node))
+                    changed |= mergePrediction(PredictInt32);
+                else
+                    changed |= mergePrediction(PredictDouble);
+            }
+            break;
+        }
+            
+        case ArithMul:
+        case ArithMin:
+        case ArithMax:
+        case ArithDiv: {
+            PredictedType left = m_graph[node.child1()].prediction();
+            PredictedType right = m_graph[node.child2()].prediction();
+            
+            if (left && right) {
+                if (isInt32Prediction(mergePredictions(left, right)) && nodeCanSpeculateInteger(node.arithNodeFlags()))
+                    changed |= mergePrediction(PredictInt32);
+                else
+                    changed |= mergePrediction(PredictDouble);
+            }
+            break;
+        }
+            
+        case ArithSqrt: {
+            changed |= setPrediction(PredictDouble);
+            break;
+        }
+            
+        case ArithAbs: {
+            PredictedType child = m_graph[node.child1()].prediction();
+            if (child) {
+                if (nodeCanSpeculateInteger(node.arithNodeFlags()))
+                    changed |= mergePrediction(child);
+                else
+                    changed |= setPrediction(PredictDouble);
+            }
+            break;
+        }
+            
+        case LogicalNot:
+        case CompareLess:
+        case CompareLessEq:
+        case CompareGreater:
+        case CompareGreaterEq:
+        case CompareEq:
+        case CompareStrictEq:
+        case InstanceOf: {
+            changed |= setPrediction(PredictBoolean);
+            break;
+        }
+            
+        case GetById: {
+            if (node.getHeapPrediction())
+                changed |= mergePrediction(node.getHeapPrediction());
+            else if (codeBlock()->identifier(node.identifierNumber()) == globalData().propertyNames->length) {
+                // If there is no prediction from value profiles, check if we might be
+                // able to infer the type ourselves.
+                bool isArray = isArrayPrediction(m_graph[node.child1()].prediction());
+                bool isString = isStringPrediction(m_graph[node.child1()].prediction());
+                bool isByteArray = m_graph[node.child1()].shouldSpeculateByteArray();
+                bool isInt8Array = m_graph[node.child1()].shouldSpeculateInt8Array();
+                bool isInt16Array = m_graph[node.child1()].shouldSpeculateInt16Array();
+                bool isInt32Array = m_graph[node.child1()].shouldSpeculateInt32Array();
+                bool isUint8Array = m_graph[node.child1()].shouldSpeculateUint8Array();
+                bool isUint8ClampedArray = m_graph[node.child1()].shouldSpeculateUint8ClampedArray();
+                bool isUint16Array = m_graph[node.child1()].shouldSpeculateUint16Array();
+                bool isUint32Array = m_graph[node.child1()].shouldSpeculateUint32Array();
+                bool isFloat32Array = m_graph[node.child1()].shouldSpeculateFloat32Array();
+                bool isFloat64Array = m_graph[node.child1()].shouldSpeculateFloat64Array();
+                if (isArray || isString || isByteArray || isInt8Array || isInt16Array || isInt32Array || isUint8Array || isUint8ClampedArray || isUint16Array || isUint32Array || isFloat32Array || isFloat64Array)
+                    changed |= mergePrediction(PredictInt32);
+            }
+            break;
+        }
+            
+        case GetByIdFlush:
+            if (node.getHeapPrediction())
+                changed |= mergePrediction(node.getHeapPrediction());
+            break;
+            
+        case GetByVal: {
+            if (m_graph[node.child1()].shouldSpeculateUint32Array() || m_graph[node.child1()].shouldSpeculateFloat32Array() || m_graph[node.child1()].shouldSpeculateFloat64Array())
+                changed |= mergePrediction(PredictDouble);
+            else if (node.getHeapPrediction())
+                changed |= mergePrediction(node.getHeapPrediction());
+            break;
+        }
+            
+        case GetPropertyStorage: 
+        case GetIndexedPropertyStorage: {
+            changed |= setPrediction(PredictOther);
+            break;
+        }
+
+        case GetByOffset: {
+            if (node.getHeapPrediction())
+                changed |= mergePrediction(node.getHeapPrediction());
+            break;
+        }
+            
+        case Call:
+        case Construct: {
+            if (node.getHeapPrediction())
+                changed |= mergePrediction(node.getHeapPrediction());
+            break;
+        }
+            
+        case ConvertThis: {
+            PredictedType prediction = m_graph[node.child1()].prediction();
+            if (prediction) {
+                if (prediction & ~PredictObjectMask) {
+                    prediction &= PredictObjectMask;
+                    prediction = mergePredictions(prediction, PredictObjectOther);
+                }
+                changed |= mergePrediction(prediction);
+            }
+            break;
+        }
+            
+        case GetGlobalVar: {
+            PredictedType prediction = m_graph.getGlobalVarPrediction(node.varNumber());
+            if (prediction)
+                changed |= mergePrediction(prediction);
+            break;
+        }
+            
+        case PutGlobalVar: {
+            changed |= m_graph.predictGlobalVar(node.varNumber(), m_graph[node.child1()].prediction());
+            break;
+        }
+            
+        case GetScopedVar:
+        case Resolve:
+        case ResolveBase:
+        case ResolveBaseStrictPut:
+        case ResolveGlobal: {
+            PredictedType prediction = node.getHeapPrediction();
+            if (prediction)
+                changed |= mergePrediction(prediction);
+            break;
+        }
+            
+        case GetScopeChain: {
+            changed |= setPrediction(PredictCellOther);
+            break;
+        }
+            
+        case GetCallee: {
+            changed |= setPrediction(PredictFunction);
+            break;
+        }
+            
+        case CreateThis:
+        case NewObject: {
+            changed |= setPrediction(PredictFinalObject);
+            break;
+        }
+            
+        case NewArray:
+        case NewArrayBuffer: {
+            changed |= setPrediction(PredictArray);
+            break;
+        }
+            
+        case NewRegexp: {
+            changed |= setPrediction(PredictObjectOther);
+            break;
+        }
+        
+        case StringCharAt:
+        case StrCat: {
+            changed |= setPrediction(PredictString);
+            break;
+        }
+            
+        case ToPrimitive: {
+            PredictedType child = m_graph[node.child1()].prediction();
+            if (child) {
+                if (isObjectPrediction(child)) {
+                    // I'd love to fold this case into the case below, but I can't, because
+                    // removing PredictObjectMask from something that only has an object
+                    // prediction and nothing else means we have an ill-formed PredictedType
+                    // (strong predict-none). This should be killed once we remove all traces
+                    // of static (aka weak) predictions.
+                    changed |= mergePrediction(PredictString);
+                } else if (child & PredictObjectMask) {
+                    // Objects get turned into strings. So if the input has hints of objectness,
+                    // the output will have hinsts of stringiness.
+                    changed |= mergePrediction(mergePredictions(child & ~PredictObjectMask, PredictString));
+                } else
+                    changed |= mergePrediction(child);
+            }
+            break;
+        }
+            
+        case GetArrayLength:
+        case GetByteArrayLength:
+        case GetInt8ArrayLength:
+        case GetInt16ArrayLength:
+        case GetInt32ArrayLength:
+        case GetUint8ArrayLength:
+        case GetUint8ClampedArrayLength:
+        case GetUint16ArrayLength:
+        case GetUint32ArrayLength:
+        case GetFloat32ArrayLength:
+        case GetFloat64ArrayLength:
+        case GetStringLength: {
+            // This node should never be visible at this stage of compilation. It is
+            // inserted by fixup(), which follows this phase.
+            ASSERT_NOT_REACHED();
+            break;
+        }
+        
+#ifndef NDEBUG
+        // These get ignored because they don't return anything.
+        case PutScopedVar:
+        case DFG::Jump:
+        case Branch:
+        case Breakpoint:
+        case Return:
+        case CheckHasInstance:
+        case Phi:
+        case Flush:
+        case Throw:
+        case ThrowReferenceError:
+        case ForceOSRExit:
+        case SetArgument:
+        case PutByVal:
+        case PutByValAlias:
+        case PutById:
+        case PutByIdDirect:
+        case CheckStructure:
+        case CheckFunction:
+        case PutStructure:
+        case PutByOffset:
+            break;
+            
+        // These gets ignored because it doesn't do anything.
+        case Phantom:
+        case InlineStart:
+        case Nop:
+            break;
+#else
+        default:
+            break;
+#endif
+        }
+
+#if DFG_ENABLE(DEBUG_PROPAGATION_VERBOSE)
+        dataLog("%s\n", predictionToString(m_graph[m_compileIndex].prediction()));
+#endif
+        
+        m_changed |= changed;
+    }
+    
+    void propagateForward()
+    {
+#if DFG_ENABLE(DEBUG_PROPAGATION_VERBOSE)
+        dataLog("Propagating predictions forward [%u]\n", ++m_count);
+#endif
+        for (m_compileIndex = 0; m_compileIndex < m_graph.size(); ++m_compileIndex)
+            propagate(m_graph[m_compileIndex]);
+    }
+    
+    void propagateBackward()
+    {
+#if DFG_ENABLE(DEBUG_PROPAGATION_VERBOSE)
+        dataLog("Propagating predictions backward [%u]\n", ++m_count);
+#endif
+        for (m_compileIndex = m_graph.size(); m_compileIndex-- > 0;)
+            propagate(m_graph[m_compileIndex]);
+    }
+
+    void vote(NodeUse nodeUse, VariableAccessData::Ballot ballot)
+    {
+        switch (m_graph[nodeUse].op) {
+        case ValueToInt32:
+        case UInt32ToNumber:
+            nodeUse = m_graph[nodeUse].child1();
+            break;
+        default:
+            break;
+        }
+        
+        if (m_graph[nodeUse].op == GetLocal)
+            m_graph[nodeUse].variableAccessData()->vote(ballot);
+    }
+    
+    void vote(Node& node, VariableAccessData::Ballot ballot)
+    {
+        if (node.op & NodeHasVarArgs) {
+            for (unsigned childIdx = node.firstChild(); childIdx < node.firstChild() + node.numChildren(); childIdx++)
+                vote(m_graph.m_varArgChildren[childIdx], ballot);
+            return;
+        }
+        
+        if (!node.child1())
+            return;
+        vote(node.child1(), ballot);
+        if (!node.child2())
+            return;
+        vote(node.child2(), ballot);
+        if (!node.child3())
+            return;
+        vote(node.child3(), ballot);
+    }
+    
+    void doRoundOfDoubleVoting()
+    {
+#if DFG_ENABLE(DEBUG_PROPAGATION_VERBOSE)
+        dataLog("Voting on double uses of locals [%u]\n", m_count);
+#endif
+        for (unsigned i = 0; i < m_graph.m_variableAccessData.size(); ++i)
+            m_graph.m_variableAccessData[i].find()->clearVotes();
+        for (m_compileIndex = 0; m_compileIndex < m_graph.size(); ++m_compileIndex) {
+            Node& node = m_graph[m_compileIndex];
+            switch (node.op) {
+            case ValueAdd:
+            case ArithAdd:
+            case ArithSub: {
+                PredictedType left = m_graph[node.child1()].prediction();
+                PredictedType right = m_graph[node.child2()].prediction();
+                
+                VariableAccessData::Ballot ballot;
+                
+                if (isNumberPrediction(left) && isNumberPrediction(right)
+                    && !m_graph.addShouldSpeculateInteger(node))
+                    ballot = VariableAccessData::VoteDouble;
+                else
+                    ballot = VariableAccessData::VoteValue;
+                
+                vote(node.child1(), ballot);
+                vote(node.child2(), ballot);
+                break;
+            }
+                
+            case ArithMul:
+            case ArithMin:
+            case ArithMax:
+            case ArithMod:
+            case ArithDiv: {
+                PredictedType left = m_graph[node.child1()].prediction();
+                PredictedType right = m_graph[node.child2()].prediction();
+                
+                VariableAccessData::Ballot ballot;
+                
+                if (isNumberPrediction(left) && isNumberPrediction(right) && !(Node::shouldSpeculateInteger(m_graph[node.child1()], m_graph[node.child1()]) && node.canSpeculateInteger()))
+                    ballot = VariableAccessData::VoteDouble;
+                else
+                    ballot = VariableAccessData::VoteValue;
+                
+                vote(node.child1(), ballot);
+                vote(node.child2(), ballot);
+                break;
+            }
+                
+            case ArithAbs:
+                VariableAccessData::Ballot ballot;
+                if (!(m_graph[node.child1()].shouldSpeculateInteger() && node.canSpeculateInteger()))
+                    ballot = VariableAccessData::VoteDouble;
+                else
+                    ballot = VariableAccessData::VoteValue;
+                
+                vote(node.child1(), ballot);
+                break;
+                
+            case ArithSqrt:
+                vote(node.child1(), VariableAccessData::VoteDouble);
+                break;
+                
+            case SetLocal: {
+                PredictedType prediction = m_graph[node.child1()].prediction();
+                if (isDoublePrediction(prediction))
+                    node.variableAccessData()->vote(VariableAccessData::VoteDouble);
+                else if (!isNumberPrediction(prediction) || isInt32Prediction(prediction))
+                    node.variableAccessData()->vote(VariableAccessData::VoteValue);
+                break;
+            }
+                
+            default:
+                vote(node, VariableAccessData::VoteValue);
+                break;
+            }
+        }
+        for (unsigned i = 0; i < m_graph.m_variableAccessData.size(); ++i)
+            m_changed |= m_graph.m_variableAccessData[i].find()->tallyVotesForShouldUseDoubleFormat();
+    }
+    
+    void fixupNode(Node& node)
+    {
+        if (!node.shouldGenerate())
+            return;
+        
+        NodeType op = node.op;
+
+#if DFG_ENABLE(DEBUG_PROPAGATION_VERBOSE)
+        dataLog("   %s @%u: ", Graph::opName(op), m_compileIndex);
+#endif
+        
+        switch (op) {
+        case GetById: {
+            if (!isInt32Prediction(m_graph[m_compileIndex].prediction()))
+                break;
+            if (codeBlock()->identifier(node.identifierNumber()) != globalData().propertyNames->length)
+                break;
+            bool isArray = isArrayPrediction(m_graph[node.child1()].prediction());
+            bool isString = isStringPrediction(m_graph[node.child1()].prediction());
+            bool isByteArray = m_graph[node.child1()].shouldSpeculateByteArray();
+            bool isInt8Array = m_graph[node.child1()].shouldSpeculateInt8Array();
+            bool isInt16Array = m_graph[node.child1()].shouldSpeculateInt16Array();
+            bool isInt32Array = m_graph[node.child1()].shouldSpeculateInt32Array();
+            bool isUint8Array = m_graph[node.child1()].shouldSpeculateUint8Array();
+            bool isUint8ClampedArray = m_graph[node.child1()].shouldSpeculateUint8ClampedArray();
+            bool isUint16Array = m_graph[node.child1()].shouldSpeculateUint16Array();
+            bool isUint32Array = m_graph[node.child1()].shouldSpeculateUint32Array();
+            bool isFloat32Array = m_graph[node.child1()].shouldSpeculateFloat32Array();
+            bool isFloat64Array = m_graph[node.child1()].shouldSpeculateFloat64Array();
+            if (!isArray && !isString && !isByteArray && !isInt8Array && !isInt16Array && !isInt32Array && !isUint8Array && !isUint8ClampedArray && !isUint16Array && !isUint32Array && !isFloat32Array && !isFloat64Array)
+                break;
+            
+#if DFG_ENABLE(DEBUG_PROPAGATION_VERBOSE)
+            dataLog("  @%u -> %s", m_compileIndex, isArray ? "GetArrayLength" : "GetStringLength");
+#endif
+            if (isArray)
+                node.op = GetArrayLength;
+            else if (isString)
+                node.op = GetStringLength;
+            else if (isByteArray)
+                node.op = GetByteArrayLength;
+            else if (isInt8Array)
+                node.op = GetInt8ArrayLength;
+            else if (isInt16Array)
+                node.op = GetInt16ArrayLength;
+            else if (isInt32Array)
+                node.op = GetInt32ArrayLength;
+            else if (isUint8Array)
+                node.op = GetUint8ArrayLength;
+            else if (isUint8ClampedArray)
+                node.op = GetUint8ClampedArrayLength;
+            else if (isUint16Array)
+                node.op = GetUint16ArrayLength;
+            else if (isUint32Array)
+                node.op = GetUint32ArrayLength;
+            else if (isFloat32Array)
+                node.op = GetFloat32ArrayLength;
+            else if (isFloat64Array)
+                node.op = GetFloat64ArrayLength;
+            else
+                ASSERT_NOT_REACHED();
+            m_graph.deref(m_compileIndex); // No longer MustGenerate
+            break;
+        }
+        case GetIndexedPropertyStorage: {
+            PredictedType basePrediction = m_graph[node.child2()].prediction();
+            if (!(basePrediction & PredictInt32) && basePrediction) {
+                node.op = Nop;
+                m_graph.clearAndDerefChild1(node);
+                m_graph.clearAndDerefChild2(node);
+                m_graph.clearAndDerefChild3(node);
+                node.setRefCount(0);
+            }
+            break;
+        }
+        case GetByVal:
+        case StringCharAt:
+        case StringCharCodeAt: {
+            if (!!node.child3() && m_graph[node.child3()].op == Nop)
+                node.children.child3() = NodeUse();
+            break;
+        }
+        default:
+            break;
+        }
+
+#if DFG_ENABLE(DEBUG_PROPAGATION_VERBOSE)
+        dataLog("\n");
+#endif
+    }
+    
+    void fixup()
+    {
+#if DFG_ENABLE(DEBUG_PROPAGATION_VERBOSE)
+        dataLog("Performing Fixup\n");
+#endif
+        for (m_compileIndex = 0; m_compileIndex < m_graph.size(); ++m_compileIndex)
+            fixupNode(m_graph[m_compileIndex]);
+    }
+    
+    NodeIndex m_compileIndex;
+    bool m_changed;
+
+#if DFG_ENABLE(DEBUG_PROPAGATION_VERBOSE)
+    unsigned m_count;
+#endif
+};
+    
+void performPredictionPropagation(Graph& graph)
+{
+    runPhase<PredictionPropagationPhase>(graph);
+}
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
+
diff --git a/Source/JavaScriptCore/dfg/DFGPredictionPropagationPhase.h b/Source/JavaScriptCore/dfg/DFGPredictionPropagationPhase.h
new file mode 100644
index 000000000..fe127136a
--- /dev/null
+++ b/Source/JavaScriptCore/dfg/DFGPredictionPropagationPhase.h
@@ -0,0 +1,52 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef DFGPredictionPropagationPhase_h
+#define DFGPredictionPropagationPhase_h
+
+#include <wtf/Platform.h>
+
+#if ENABLE(DFG_JIT)
+
+namespace JSC { namespace DFG {
+
+class Graph;
+
+// Propagate predictions gathered at heap load sites by the value profiler, and
+// from slow path executions, to generate a prediction for each node in the graph.
+// This is a crucial phase of compilation, since before running this phase, we
+// have no idea what types any node (or most variables) could possibly have, unless
+// that node is either a heap load, a call, a GetLocal for an argument, or an
+// arithmetic op that had definitely taken slow path. Most nodes (even most
+// arithmetic nodes) do not qualify for any of these categories. But after running
+// this phase, we'll have full information for the expected type of each node.
+
+void performPredictionPropagation(Graph&);
+
+} } // namespace JSC::DFG::Phase
+
+#endif // ENABLE(DFG_JIT)
+
+#endif // DFGPredictionPropagationPhase_h
diff --git a/Source/JavaScriptCore/dfg/DFGPropagator.cpp b/Source/JavaScriptCore/dfg/DFGPropagator.cpp
deleted file mode 100644
index f00f13e96..000000000
--- a/Source/JavaScriptCore/dfg/DFGPropagator.cpp
+++ /dev/null
@@ -1,1743 +0,0 @@
-/*
- * Copyright (C) 2011 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#include "config.h"
-#include "DFGPropagator.h"
-
-#if ENABLE(DFG_JIT)
-
-#include "DFGAbstractState.h"
-#include "DFGGraph.h"
-#include "DFGScoreBoard.h"
-#include <wtf/FixedArray.h>
-
-namespace JSC { namespace DFG {
-
-class Propagator {
-public:
-    Propagator(Graph& graph, JSGlobalData& globalData, CodeBlock* codeBlock, CodeBlock* profiledBlock)
-        : m_graph(graph)
-        , m_globalData(globalData)
-        , m_codeBlock(codeBlock)
-        , m_profiledBlock(profiledBlock)
-    {
-        // Replacements are used to implement local common subexpression elimination.
-        m_replacements.resize(m_graph.size());
-        
-        for (unsigned i = 0; i < m_graph.size(); ++i)
-            m_replacements[i] = NoNode;
-        
-        for (unsigned i = 0; i < LastNodeId; ++i)
-            m_lastSeen[i] = NoNode;
-    }
-    
-    void fixpoint()
-    {
-#if DFG_ENABLE(DEBUG_PROPAGATION_VERBOSE)
-        m_graph.dump(m_codeBlock);
-#endif
-
-        propagateArithNodeFlags();
-        propagatePredictions();
-        fixup();
-        
-#if DFG_ENABLE(DEBUG_PROPAGATION_VERBOSE)
-        printf("Graph after propagation fixup:\n");
-        m_graph.dump(m_codeBlock);
-#endif
-
-        localCSE();
-
-#if DFG_ENABLE(DEBUG_PROPAGATION_VERBOSE)
-        printf("Graph after CSE:\n");
-        m_graph.dump(m_codeBlock);
-#endif
-
-        allocateVirtualRegisters();
-
-#if DFG_ENABLE(DEBUG_PROPAGATION_VERBOSE)
-        printf("Graph after virtual register allocation:\n");
-        m_graph.dump(m_codeBlock);
-#endif
-
-        globalCFA();
-
-#if DFG_ENABLE(DEBUG_VERBOSE)
-        printf("Graph after propagation:\n");
-        m_graph.dump(m_codeBlock);
-#endif
-    }
-    
-private:
-    bool isNotNegZero(NodeIndex nodeIndex)
-    {
-        if (!m_graph.isNumberConstant(m_codeBlock, nodeIndex))
-            return false;
-        double value = m_graph.valueOfNumberConstant(m_codeBlock, nodeIndex);
-        return !value && 1.0 / value < 0.0;
-    }
-    
-    bool isNotZero(NodeIndex nodeIndex)
-    {
-        if (!m_graph.isNumberConstant(m_codeBlock, nodeIndex))
-            return false;
-        return !!m_graph.valueOfNumberConstant(m_codeBlock, nodeIndex);
-    }
-    
-    void propagateArithNodeFlags(Node& node)
-    {
-        if (!node.shouldGenerate())
-            return;
-        
-        NodeType op = node.op;
-        ArithNodeFlags flags = 0;
-        
-        if (node.hasArithNodeFlags())
-            flags = node.rawArithNodeFlags();
-        
-#if DFG_ENABLE(DEBUG_PROPAGATION_VERBOSE)
-        printf("   %s @%u: %s ", Graph::opName(op), m_compileIndex, arithNodeFlagsAsString(flags));
-#endif
-        
-        flags &= NodeUsedAsMask;
-        
-        bool changed = false;
-        
-        switch (op) {
-        case ValueToInt32:
-        case BitAnd:
-        case BitOr:
-        case BitXor:
-        case BitLShift:
-        case BitRShift:
-        case BitURShift: {
-            // These operations are perfectly happy with truncated integers,
-            // so we don't want to propagate anything.
-            break;
-        }
-            
-        case UInt32ToNumber: {
-            changed |= m_graph[node.child1()].mergeArithNodeFlags(flags);
-            break;
-        }
-            
-        case ArithAdd:
-        case ValueAdd: {
-            if (isNotNegZero(node.child1().index()) || isNotNegZero(node.child2().index()))
-                flags &= ~NodeNeedsNegZero;
-            
-            changed |= m_graph[node.child1()].mergeArithNodeFlags(flags);
-            changed |= m_graph[node.child2()].mergeArithNodeFlags(flags);
-            break;
-        }
-            
-        case ArithSub: {
-            if (isNotZero(node.child1().index()) || isNotZero(node.child2().index()))
-                flags &= ~NodeNeedsNegZero;
-            
-            changed |= m_graph[node.child1()].mergeArithNodeFlags(flags);
-            changed |= m_graph[node.child2()].mergeArithNodeFlags(flags);
-            break;
-        }
-            
-        case ArithMul:
-        case ArithDiv: {
-            // As soon as a multiply happens, we can easily end up in the part
-            // of the double domain where the point at which you do truncation
-            // can change the outcome. So, ArithMul always checks for overflow
-            // no matter what, and always forces its inputs to check as well.
-            
-            flags |= NodeUsedAsNumber | NodeNeedsNegZero;
-            changed |= m_graph[node.child1()].mergeArithNodeFlags(flags);
-            changed |= m_graph[node.child2()].mergeArithNodeFlags(flags);
-            break;
-        }
-            
-        case ArithMin:
-        case ArithMax: {
-            flags |= NodeUsedAsNumber;
-            changed |= m_graph[node.child1()].mergeArithNodeFlags(flags);
-            changed |= m_graph[node.child2()].mergeArithNodeFlags(flags);
-            break;
-        }
-            
-        case ArithAbs: {
-            flags &= ~NodeNeedsNegZero;
-            changed |= m_graph[node.child1()].mergeArithNodeFlags(flags);
-            break;
-        }
-            
-        case PutByVal: {
-            changed |= m_graph[node.child1()].mergeArithNodeFlags(flags | NodeUsedAsNumber | NodeNeedsNegZero);
-            changed |= m_graph[node.child2()].mergeArithNodeFlags(flags | NodeUsedAsNumber);
-            changed |= m_graph[node.child3()].mergeArithNodeFlags(flags | NodeUsedAsNumber | NodeNeedsNegZero);
-            break;
-        }
-            
-        case GetByVal: {
-            changed |= m_graph[node.child1()].mergeArithNodeFlags(flags | NodeUsedAsNumber | NodeNeedsNegZero);
-            changed |= m_graph[node.child2()].mergeArithNodeFlags(flags | NodeUsedAsNumber);
-            break;
-        }
-            
-        default:
-            flags |= NodeUsedAsNumber | NodeNeedsNegZero;
-            if (op & NodeHasVarArgs) {
-                for (unsigned childIdx = node.firstChild(); childIdx < node.firstChild() + node.numChildren(); childIdx++)
-                    changed |= m_graph[m_graph.m_varArgChildren[childIdx]].mergeArithNodeFlags(flags);
-            } else {
-                if (!node.child1())
-                    break;
-                changed |= m_graph[node.child1()].mergeArithNodeFlags(flags);
-                if (!node.child2())
-                    break;
-                changed |= m_graph[node.child2()].mergeArithNodeFlags(flags);
-                if (!node.child3())
-                    break;
-                changed |= m_graph[node.child3()].mergeArithNodeFlags(flags);
-            }
-            break;
-        }
-
-#if DFG_ENABLE(DEBUG_PROPAGATION_VERBOSE)
-        printf("%s\n", changed ? "CHANGED" : "");
-#endif
-        
-        m_changed |= changed;
-    }
-    
-    void propagateArithNodeFlagsForward()
-    {
-#if DFG_ENABLE(DEBUG_PROPAGATION_VERBOSE)
-        printf("Propagating arithmetic node flags forward [%u]\n", ++m_count);
-#endif
-        for (m_compileIndex = 0; m_compileIndex < m_graph.size(); ++m_compileIndex)
-            propagateArithNodeFlags(m_graph[m_compileIndex]);
-    }
-    
-    void propagateArithNodeFlagsBackward()
-    {
-#if DFG_ENABLE(DEBUG_PROPAGATION_VERBOSE)
-        printf("Propagating arithmetic node flags backward [%u]\n", ++m_count);
-#endif
-        for (m_compileIndex = m_graph.size(); m_compileIndex-- > 0;)
-            propagateArithNodeFlags(m_graph[m_compileIndex]);
-    }
-    
-    void propagateArithNodeFlags()
-    {
-#if DFG_ENABLE(DEBUG_PROPAGATION_VERBOSE)
-        m_count = 0;
-#endif
-        do {
-            m_changed = false;
-            
-            // Up here we start with a backward pass because we suspect that to be
-            // more profitable.
-            propagateArithNodeFlagsBackward();
-            if (!m_changed)
-                break;
-            
-            m_changed = false;
-            propagateArithNodeFlagsForward();
-        } while (m_changed);
-    }
-    
-    bool setPrediction(PredictedType prediction)
-    {
-        ASSERT(m_graph[m_compileIndex].hasResult());
-        
-        // setPrediction() is used when we know that there is no way that we can change
-        // our minds about what the prediction is going to be. There is no semantic
-        // difference between setPrediction() and mergePrediction() other than the
-        // increased checking to validate this property.
-        ASSERT(m_graph[m_compileIndex].prediction() == PredictNone || m_graph[m_compileIndex].prediction() == prediction);
-        
-        return m_graph[m_compileIndex].predict(prediction);
-    }
-    
-    bool mergePrediction(PredictedType prediction)
-    {
-        ASSERT(m_graph[m_compileIndex].hasResult());
-        
-        return m_graph[m_compileIndex].predict(prediction);
-    }
-    
-    void propagateNodePredictions(Node& node)
-    {
-        if (!node.shouldGenerate())
-            return;
-        
-        NodeType op = node.op;
-
-#if DFG_ENABLE(DEBUG_PROPAGATION_VERBOSE)
-        printf("   %s @%u: ", Graph::opName(op), m_compileIndex);
-#endif
-        
-        bool changed = false;
-        
-        switch (op) {
-        case JSConstant:
-        case WeakJSConstant: {
-            changed |= setPrediction(predictionFromValue(m_graph.valueOfJSConstant(m_codeBlock, m_compileIndex)));
-            break;
-        }
-            
-        case GetLocal: {
-            PredictedType prediction = node.variableAccessData()->prediction();
-            if (prediction)
-                changed |= mergePrediction(prediction);
-            break;
-        }
-            
-        case SetLocal: {
-            changed |= node.variableAccessData()->predict(m_graph[node.child1()].prediction());
-            break;
-        }
-            
-        case BitAnd:
-        case BitOr:
-        case BitXor:
-        case BitRShift:
-        case BitLShift:
-        case BitURShift:
-        case ValueToInt32: {
-            changed |= setPrediction(PredictInt32);
-            break;
-        }
-            
-        case ArrayPop:
-        case ArrayPush: {
-            if (node.getHeapPrediction())
-                changed |= mergePrediction(node.getHeapPrediction());
-            break;
-        }
-
-        case StringCharCodeAt: {
-            changed |= mergePrediction(PredictInt32);
-            break;
-        }
-
-        case ArithMod: {
-            PredictedType left = m_graph[node.child1()].prediction();
-            PredictedType right = m_graph[node.child2()].prediction();
-            
-            if (left && right) {
-                if (isInt32Prediction(mergePredictions(left, right)) && nodeCanSpeculateInteger(node.arithNodeFlags()))
-                    changed |= mergePrediction(PredictInt32);
-                else
-                    changed |= mergePrediction(PredictDouble);
-            }
-            break;
-        }
-            
-        case UInt32ToNumber: {
-            if (nodeCanSpeculateInteger(node.arithNodeFlags()))
-                changed |= setPrediction(PredictInt32);
-            else
-                changed |= setPrediction(PredictNumber);
-            break;
-        }
-
-        case ValueAdd: {
-            PredictedType left = m_graph[node.child1()].prediction();
-            PredictedType right = m_graph[node.child2()].prediction();
-            
-            if (left && right) {
-                if (isNumberPrediction(left) && isNumberPrediction(right)) {
-                    if (m_graph.addShouldSpeculateInteger(node, m_codeBlock))
-                        changed |= mergePrediction(PredictInt32);
-                    else
-                        changed |= mergePrediction(PredictDouble);
-                } else if (!(left & PredictNumber) || !(right & PredictNumber)) {
-                    // left or right is definitely something other than a number.
-                    changed |= mergePrediction(PredictString);
-                } else
-                    changed |= mergePrediction(PredictString | PredictInt32 | PredictDouble);
-            }
-            break;
-        }
-            
-        case ArithAdd:
-        case ArithSub: {
-            PredictedType left = m_graph[node.child1()].prediction();
-            PredictedType right = m_graph[node.child2()].prediction();
-            
-            if (left && right) {
-                if (m_graph.addShouldSpeculateInteger(node, m_codeBlock))
-                    changed |= mergePrediction(PredictInt32);
-                else
-                    changed |= mergePrediction(PredictDouble);
-            }
-            break;
-        }
-            
-        case ArithMul:
-        case ArithMin:
-        case ArithMax:
-        case ArithDiv: {
-            PredictedType left = m_graph[node.child1()].prediction();
-            PredictedType right = m_graph[node.child2()].prediction();
-            
-            if (left && right) {
-                if (isInt32Prediction(mergePredictions(left, right)) && nodeCanSpeculateInteger(node.arithNodeFlags()))
-                    changed |= mergePrediction(PredictInt32);
-                else
-                    changed |= mergePrediction(PredictDouble);
-            }
-            break;
-        }
-            
-        case ArithSqrt: {
-            changed |= setPrediction(PredictDouble);
-            break;
-        }
-            
-        case ArithAbs: {
-            PredictedType child = m_graph[node.child1()].prediction();
-            if (child) {
-                if (nodeCanSpeculateInteger(node.arithNodeFlags()))
-                    changed |= mergePrediction(child);
-                else
-                    changed |= setPrediction(PredictDouble);
-            }
-            break;
-        }
-            
-        case LogicalNot:
-        case CompareLess:
-        case CompareLessEq:
-        case CompareGreater:
-        case CompareGreaterEq:
-        case CompareEq:
-        case CompareStrictEq:
-        case InstanceOf: {
-            changed |= setPrediction(PredictBoolean);
-            break;
-        }
-            
-        case GetById: {
-            if (node.getHeapPrediction())
-                changed |= mergePrediction(node.getHeapPrediction());
-            else if (m_codeBlock->identifier(node.identifierNumber()) == m_globalData.propertyNames->length) {
-                // If there is no prediction from value profiles, check if we might be
-                // able to infer the type ourselves.
-                bool isArray = isArrayPrediction(m_graph[node.child1()].prediction());
-                bool isString = isStringPrediction(m_graph[node.child1()].prediction());
-                bool isByteArray = m_graph[node.child1()].shouldSpeculateByteArray();
-                bool isInt8Array = m_graph[node.child1()].shouldSpeculateInt8Array();
-                bool isInt16Array = m_graph[node.child1()].shouldSpeculateInt16Array();
-                bool isInt32Array = m_graph[node.child1()].shouldSpeculateInt32Array();
-                bool isUint8Array = m_graph[node.child1()].shouldSpeculateUint8Array();
-                bool isUint8ClampedArray = m_graph[node.child1()].shouldSpeculateUint8ClampedArray();
-                bool isUint16Array = m_graph[node.child1()].shouldSpeculateUint16Array();
-                bool isUint32Array = m_graph[node.child1()].shouldSpeculateUint32Array();
-                bool isFloat32Array = m_graph[node.child1()].shouldSpeculateFloat32Array();
-                bool isFloat64Array = m_graph[node.child1()].shouldSpeculateFloat64Array();
-                if (isArray || isString || isByteArray || isInt8Array || isInt16Array || isInt32Array || isUint8Array || isUint8ClampedArray || isUint16Array || isUint32Array || isFloat32Array || isFloat64Array)
-                    changed |= mergePrediction(PredictInt32);
-            }
-            break;
-        }
-            
-        case GetByIdFlush:
-            if (node.getHeapPrediction())
-                changed |= mergePrediction(node.getHeapPrediction());
-            break;
-            
-        case GetByVal: {
-            if (m_graph[node.child1()].shouldSpeculateUint32Array() || m_graph[node.child1()].shouldSpeculateFloat32Array() || m_graph[node.child1()].shouldSpeculateFloat64Array())
-                changed |= mergePrediction(PredictDouble);
-            else if (node.getHeapPrediction())
-                changed |= mergePrediction(node.getHeapPrediction());
-            break;
-        }
-            
-        case GetPropertyStorage: 
-        case GetIndexedPropertyStorage: {
-            changed |= setPrediction(PredictOther);
-            break;
-        }
-
-        case GetByOffset: {
-            if (node.getHeapPrediction())
-                changed |= mergePrediction(node.getHeapPrediction());
-            break;
-        }
-            
-        case Call:
-        case Construct: {
-            if (node.getHeapPrediction())
-                changed |= mergePrediction(node.getHeapPrediction());
-            break;
-        }
-            
-        case ConvertThis: {
-            PredictedType prediction = m_graph[node.child1()].prediction();
-            if (prediction) {
-                if (prediction & ~PredictObjectMask) {
-                    prediction &= PredictObjectMask;
-                    prediction = mergePredictions(prediction, PredictObjectOther);
-                }
-                changed |= mergePrediction(prediction);
-            }
-            break;
-        }
-            
-        case GetGlobalVar: {
-            PredictedType prediction = m_graph.getGlobalVarPrediction(node.varNumber());
-            if (prediction)
-                changed |= mergePrediction(prediction);
-            break;
-        }
-            
-        case PutGlobalVar: {
-            changed |= m_graph.predictGlobalVar(node.varNumber(), m_graph[node.child1()].prediction());
-            break;
-        }
-            
-        case GetScopedVar:
-        case Resolve:
-        case ResolveBase:
-        case ResolveBaseStrictPut:
-        case ResolveGlobal: {
-            PredictedType prediction = node.getHeapPrediction();
-            if (prediction)
-                changed |= mergePrediction(prediction);
-            break;
-        }
-            
-        case GetScopeChain: {
-            changed |= setPrediction(PredictCellOther);
-            break;
-        }
-            
-        case GetCallee: {
-            changed |= setPrediction(PredictFunction);
-            break;
-        }
-            
-        case CreateThis:
-        case NewObject: {
-            changed |= setPrediction(PredictFinalObject);
-            break;
-        }
-            
-        case NewArray:
-        case NewArrayBuffer: {
-            changed |= setPrediction(PredictArray);
-            break;
-        }
-            
-        case NewRegexp: {
-            changed |= setPrediction(PredictObjectOther);
-            break;
-        }
-        
-        case StringCharAt:
-        case StrCat: {
-            changed |= setPrediction(PredictString);
-            break;
-        }
-            
-        case ToPrimitive: {
-            PredictedType child = m_graph[node.child1()].prediction();
-            if (child) {
-                if (isObjectPrediction(child)) {
-                    // I'd love to fold this case into the case below, but I can't, because
-                    // removing PredictObjectMask from something that only has an object
-                    // prediction and nothing else means we have an ill-formed PredictedType
-                    // (strong predict-none). This should be killed once we remove all traces
-                    // of static (aka weak) predictions.
-                    changed |= mergePrediction(PredictString);
-                } else if (child & PredictObjectMask) {
-                    // Objects get turned into strings. So if the input has hints of objectness,
-                    // the output will have hinsts of stringiness.
-                    changed |= mergePrediction(mergePredictions(child & ~PredictObjectMask, PredictString));
-                } else
-                    changed |= mergePrediction(child);
-            }
-            break;
-        }
-            
-        case GetArrayLength:
-        case GetByteArrayLength:
-        case GetInt8ArrayLength:
-        case GetInt16ArrayLength:
-        case GetInt32ArrayLength:
-        case GetUint8ArrayLength:
-        case GetUint8ClampedArrayLength:
-        case GetUint16ArrayLength:
-        case GetUint32ArrayLength:
-        case GetFloat32ArrayLength:
-        case GetFloat64ArrayLength:
-        case GetStringLength: {
-            // This node should never be visible at this stage of compilation. It is
-            // inserted by fixup(), which follows this phase.
-            ASSERT_NOT_REACHED();
-            break;
-        }
-        
-#ifndef NDEBUG
-        // These get ignored because they don't return anything.
-        case PutScopedVar:
-        case DFG::Jump:
-        case Branch:
-        case Breakpoint:
-        case Return:
-        case CheckHasInstance:
-        case Phi:
-        case Flush:
-        case Throw:
-        case ThrowReferenceError:
-        case ForceOSRExit:
-        case SetArgument:
-        case PutByVal:
-        case PutByValAlias:
-        case PutById:
-        case PutByIdDirect:
-        case CheckStructure:
-        case CheckFunction:
-        case PutStructure:
-        case PutByOffset:
-            break;
-            
-        // These gets ignored because it doesn't do anything.
-        case Phantom:
-        case InlineStart:
-        case Nop:
-            break;
-#else
-        default:
-            break;
-#endif
-        }
-
-#if DFG_ENABLE(DEBUG_PROPAGATION_VERBOSE)
-        printf("%s\n", predictionToString(m_graph[m_compileIndex].prediction()));
-#endif
-        
-        m_changed |= changed;
-    }
-    
-    void propagatePredictionsForward()
-    {
-#if DFG_ENABLE(DEBUG_PROPAGATION_VERBOSE)
-        printf("Propagating predictions forward [%u]\n", ++m_count);
-#endif
-        for (m_compileIndex = 0; m_compileIndex < m_graph.size(); ++m_compileIndex)
-            propagateNodePredictions(m_graph[m_compileIndex]);
-    }
-    
-    void propagatePredictionsBackward()
-    {
-#if DFG_ENABLE(DEBUG_PROPAGATION_VERBOSE)
-        printf("Propagating predictions backward [%u]\n", ++m_count);
-#endif
-        for (m_compileIndex = m_graph.size(); m_compileIndex-- > 0;)
-            propagateNodePredictions(m_graph[m_compileIndex]);
-    }
-    
-    void vote(NodeUse nodeUse, VariableAccessData::Ballot ballot)
-    {
-        switch (m_graph[nodeUse].op) {
-        case ValueToInt32:
-        case UInt32ToNumber:
-            nodeUse = m_graph[nodeUse].child1();
-            break;
-        default:
-            break;
-        }
-        
-        if (m_graph[nodeUse].op == GetLocal)
-            m_graph[nodeUse].variableAccessData()->vote(ballot);
-    }
-    
-    void vote(Node& node, VariableAccessData::Ballot ballot)
-    {
-        if (node.op & NodeHasVarArgs) {
-            for (unsigned childIdx = node.firstChild(); childIdx < node.firstChild() + node.numChildren(); childIdx++)
-                vote(m_graph.m_varArgChildren[childIdx], ballot);
-            return;
-        }
-        
-        if (!node.child1())
-            return;
-        vote(node.child1(), ballot);
-        if (!node.child2())
-            return;
-        vote(node.child2(), ballot);
-        if (!node.child3())
-            return;
-        vote(node.child3(), ballot);
-    }
-    
-    void doRoundOfDoubleVoting()
-    {
-#if DFG_ENABLE(DEBUG_PROPAGATION_VERBOSE)
-        printf("Voting on double uses of locals [%u]\n", m_count);
-#endif
-        for (unsigned i = 0; i < m_graph.m_variableAccessData.size(); ++i)
-            m_graph.m_variableAccessData[i].find()->clearVotes();
-        for (m_compileIndex = 0; m_compileIndex < m_graph.size(); ++m_compileIndex) {
-            Node& node = m_graph[m_compileIndex];
-            switch (node.op) {
-            case ValueAdd:
-            case ArithAdd:
-            case ArithSub: {
-                PredictedType left = m_graph[node.child1()].prediction();
-                PredictedType right = m_graph[node.child2()].prediction();
-                
-                VariableAccessData::Ballot ballot;
-                
-                if (isNumberPrediction(left) && isNumberPrediction(right)
-                    && !m_graph.addShouldSpeculateInteger(node, m_codeBlock))
-                    ballot = VariableAccessData::VoteDouble;
-                else
-                    ballot = VariableAccessData::VoteValue;
-                
-                vote(node.child1(), ballot);
-                vote(node.child2(), ballot);
-                break;
-            }
-                
-            case ArithMul:
-            case ArithMin:
-            case ArithMax:
-            case ArithMod:
-            case ArithDiv: {
-                PredictedType left = m_graph[node.child1()].prediction();
-                PredictedType right = m_graph[node.child2()].prediction();
-                
-                VariableAccessData::Ballot ballot;
-                
-                if (isNumberPrediction(left) && isNumberPrediction(right) && !(Node::shouldSpeculateInteger(m_graph[node.child1()], m_graph[node.child1()]) && node.canSpeculateInteger()))
-                    ballot = VariableAccessData::VoteDouble;
-                else
-                    ballot = VariableAccessData::VoteValue;
-                
-                vote(node.child1(), ballot);
-                vote(node.child2(), ballot);
-                break;
-            }
-                
-            case ArithAbs:
-                VariableAccessData::Ballot ballot;
-                if (!(m_graph[node.child1()].shouldSpeculateInteger() && node.canSpeculateInteger()))
-                    ballot = VariableAccessData::VoteDouble;
-                else
-                    ballot = VariableAccessData::VoteValue;
-                
-                vote(node.child1(), ballot);
-                break;
-                
-            case ArithSqrt:
-                vote(node.child1(), VariableAccessData::VoteDouble);
-                break;
-                
-            case SetLocal: {
-                PredictedType prediction = m_graph[node.child1()].prediction();
-                if (isDoublePrediction(prediction))
-                    node.variableAccessData()->vote(VariableAccessData::VoteDouble);
-                else if (!isNumberPrediction(prediction) || isInt32Prediction(prediction))
-                    node.variableAccessData()->vote(VariableAccessData::VoteValue);
-                break;
-            }
-                
-            default:
-                vote(node, VariableAccessData::VoteValue);
-                break;
-            }
-        }
-        for (unsigned i = 0; i < m_graph.m_variableAccessData.size(); ++i)
-            m_changed |= m_graph.m_variableAccessData[i].find()->tallyVotesForShouldUseDoubleFormat();
-    }
-    
-    void propagatePredictions()
-    {
-#if DFG_ENABLE(DEBUG_PROPAGATION_VERBOSE)
-        m_count = 0;
-#endif
-        // Two stage process: first propagate predictions, then propagate while doing double voting.
-        
-        do {
-            m_changed = false;
-            
-            // Forward propagation is near-optimal for both topologically-sorted and
-            // DFS-sorted code.
-            propagatePredictionsForward();
-            if (!m_changed)
-                break;
-            
-            // Backward propagation reduces the likelihood that pathological code will
-            // cause slowness. Loops (especially nested ones) resemble backward flow.
-            // This pass captures two cases: (1) it detects if the forward fixpoint
-            // found a sound solution and (2) short-circuits backward flow.
-            m_changed = false;
-            propagatePredictionsBackward();
-        } while (m_changed);
-        
-        do {
-            m_changed = false;
-            doRoundOfDoubleVoting();
-            propagatePredictionsForward();
-            if (!m_changed)
-                break;
-            
-            m_changed = false;
-            doRoundOfDoubleVoting();
-            propagatePredictionsBackward();
-        } while (m_changed);
-    }
-    
-    void fixupNode(Node& node)
-    {
-        if (!node.shouldGenerate())
-            return;
-        
-        NodeType op = node.op;
-
-#if DFG_ENABLE(DEBUG_PROPAGATION_VERBOSE)
-        printf("   %s @%u: ", Graph::opName(op), m_compileIndex);
-#endif
-        
-        switch (op) {
-        case GetById: {
-            if (!isInt32Prediction(m_graph[m_compileIndex].prediction()))
-                break;
-            if (m_codeBlock->identifier(node.identifierNumber()) != m_globalData.propertyNames->length)
-                break;
-            bool isArray = isArrayPrediction(m_graph[node.child1()].prediction());
-            bool isString = isStringPrediction(m_graph[node.child1()].prediction());
-            bool isByteArray = m_graph[node.child1()].shouldSpeculateByteArray();
-            bool isInt8Array = m_graph[node.child1()].shouldSpeculateInt8Array();
-            bool isInt16Array = m_graph[node.child1()].shouldSpeculateInt16Array();
-            bool isInt32Array = m_graph[node.child1()].shouldSpeculateInt32Array();
-            bool isUint8Array = m_graph[node.child1()].shouldSpeculateUint8Array();
-            bool isUint8ClampedArray = m_graph[node.child1()].shouldSpeculateUint8ClampedArray();
-            bool isUint16Array = m_graph[node.child1()].shouldSpeculateUint16Array();
-            bool isUint32Array = m_graph[node.child1()].shouldSpeculateUint32Array();
-            bool isFloat32Array = m_graph[node.child1()].shouldSpeculateFloat32Array();
-            bool isFloat64Array = m_graph[node.child1()].shouldSpeculateFloat64Array();
-            if (!isArray && !isString && !isByteArray && !isInt8Array && !isInt16Array && !isInt32Array && !isUint8Array && !isUint8ClampedArray && !isUint16Array && !isUint32Array && !isFloat32Array && !isFloat64Array)
-                break;
-            
-#if DFG_ENABLE(DEBUG_PROPAGATION_VERBOSE)
-            printf("  @%u -> %s", m_compileIndex, isArray ? "GetArrayLength" : "GetStringLength");
-#endif
-            if (isArray)
-                node.op = GetArrayLength;
-            else if (isString)
-                node.op = GetStringLength;
-            else if (isByteArray)
-                node.op = GetByteArrayLength;
-            else if (isInt8Array)
-                node.op = GetInt8ArrayLength;
-            else if (isInt16Array)
-                node.op = GetInt16ArrayLength;
-            else if (isInt32Array)
-                node.op = GetInt32ArrayLength;
-            else if (isUint8Array)
-                node.op = GetUint8ArrayLength;
-            else if (isUint8ClampedArray)
-                node.op = GetUint8ClampedArrayLength;
-            else if (isUint16Array)
-                node.op = GetUint16ArrayLength;
-            else if (isUint32Array)
-                node.op = GetUint32ArrayLength;
-            else if (isFloat32Array)
-                node.op = GetFloat32ArrayLength;
-            else if (isFloat64Array)
-                node.op = GetFloat64ArrayLength;
-            else
-                ASSERT_NOT_REACHED();
-            m_graph.deref(m_compileIndex); // No longer MustGenerate
-            break;
-        }
-        case GetIndexedPropertyStorage: {
-            PredictedType basePrediction = m_graph[node.child2()].prediction();
-            if (!(basePrediction & PredictInt32) && basePrediction) {
-                node.op = Nop;
-                m_graph.clearAndDerefChild1(node);
-                m_graph.clearAndDerefChild2(node);
-                m_graph.clearAndDerefChild3(node);
-                node.setRefCount(0);
-            }
-            break;
-        }
-        case GetByVal:
-        case StringCharAt:
-        case StringCharCodeAt: {
-            if (!!node.child3() && m_graph[node.child3()].op == Nop)
-                node.children.child3() = NodeUse();
-            break;
-        }
-        default:
-            break;
-        }
-
-#if DFG_ENABLE(DEBUG_PROPAGATION_VERBOSE)
-        printf("\n");
-#endif
-    }
-    
-    void fixup()
-    {
-#if DFG_ENABLE(DEBUG_PROPAGATION_VERBOSE)
-        printf("Performing Fixup\n");
-#endif
-        for (m_compileIndex = 0; m_compileIndex < m_graph.size(); ++m_compileIndex)
-            fixupNode(m_graph[m_compileIndex]);
-    }
-    
-    NodeIndex canonicalize(NodeIndex nodeIndex)
-    {
-        if (nodeIndex == NoNode)
-            return NoNode;
-        
-        if (m_graph[nodeIndex].op == ValueToInt32)
-            nodeIndex = m_graph[nodeIndex].child1().index();
-        
-        return nodeIndex;
-    }
-    NodeIndex canonicalize(NodeUse nodeUse)
-    {
-        return canonicalize(nodeUse.indexUnchecked());
-    }
-    
-    // Computes where the search for a candidate for CSE should start. Don't call
-    // this directly; call startIndex() instead as it does logging in debug mode.
-    NodeIndex computeStartIndexForChildren(NodeIndex child1 = NoNode, NodeIndex child2 = NoNode, NodeIndex child3 = NoNode)
-    {
-        const unsigned limit = 300;
-        
-        NodeIndex start = m_start;
-        if (m_compileIndex - start > limit)
-            start = m_compileIndex - limit;
-        
-        ASSERT(start >= m_start);
-        
-        NodeIndex child = canonicalize(child1);
-        if (child == NoNode)
-            return start;
-        
-        if (start < child)
-            start = child;
-        
-        child = canonicalize(child2);
-        if (child == NoNode)
-            return start;
-        
-        if (start < child)
-            start = child;
-        
-        child = canonicalize(child3);
-        if (child == NoNode)
-            return start;
-        
-        if (start < child)
-            start = child;
-        
-        return start;
-    }
-    
-    NodeIndex startIndexForChildren(NodeIndex child1 = NoNode, NodeIndex child2 = NoNode, NodeIndex child3 = NoNode)
-    {
-        NodeIndex result = computeStartIndexForChildren(child1, child2, child3);
-#if DFG_ENABLE(DEBUG_PROPAGATION_VERBOSE)
-        printf("  lookback %u: ", result);
-#endif
-        return result;
-    }
-    
-    NodeIndex startIndex()
-    {
-        Node& node = m_graph[m_compileIndex];
-        return startIndexForChildren(
-            node.child1().indexUnchecked(),
-            node.child2().indexUnchecked(),
-            node.child3().indexUnchecked());
-    }
-    
-    NodeIndex endIndexForPureCSE()
-    {
-        NodeIndex result = m_lastSeen[m_graph[m_compileIndex].op & NodeIdMask];
-        if (result == NoNode)
-            result = 0;
-        else
-            result++;
-        ASSERT(result <= m_compileIndex);
-#if DFG_ENABLE(DEBUG_PROPAGATION_VERBOSE)
-        printf("  limit %u: ", result);
-#endif
-        return result;
-    }
-    
-    NodeIndex pureCSE(Node& node)
-    {
-        NodeIndex child1 = canonicalize(node.child1());
-        NodeIndex child2 = canonicalize(node.child2());
-        NodeIndex child3 = canonicalize(node.child3());
-        
-        NodeIndex start = startIndex();
-        for (NodeIndex index = endIndexForPureCSE(); index-- > start;) {
-            Node& otherNode = m_graph[index];
-            if (node.op != otherNode.op)
-                continue;
-            
-            if (node.arithNodeFlagsForCompare() != otherNode.arithNodeFlagsForCompare())
-                continue;
-            
-            NodeIndex otherChild = canonicalize(otherNode.child1());
-            if (otherChild == NoNode)
-                return index;
-            if (otherChild != child1)
-                continue;
-            
-            otherChild = canonicalize(otherNode.child2());
-            if (otherChild == NoNode)
-                return index;
-            if (otherChild != child2)
-                continue;
-            
-            otherChild = canonicalize(otherNode.child3());
-            if (otherChild == NoNode)
-                return index;
-            if (otherChild != child3)
-                continue;
-            
-            return index;
-        }
-        return NoNode;
-    }
-    
-    bool isPredictedNumerical(Node& node)
-    {
-        PredictedType left = m_graph[node.child1()].prediction();
-        PredictedType right = m_graph[node.child2()].prediction();
-        return isNumberPrediction(left) && isNumberPrediction(right);
-    }
-    
-    bool logicalNotIsPure(Node& node)
-    {
-        PredictedType prediction = m_graph[node.child1()].prediction();
-        return isBooleanPrediction(prediction) || !prediction;
-    }
-    
-    bool byValIsPure(Node& node)
-    {
-        return m_graph[node.child2()].shouldSpeculateInteger()
-            && ((node.op == PutByVal || node.op == PutByValAlias)
-                ? isActionableMutableArrayPrediction(m_graph[node.child1()].prediction())
-                : isActionableArrayPrediction(m_graph[node.child1()].prediction()));
-    }
-    
-    bool clobbersWorld(NodeIndex nodeIndex)
-    {
-        Node& node = m_graph[nodeIndex];
-        if (node.op & NodeClobbersWorld)
-            return true;
-        if (!(node.op & NodeMightClobber))
-            return false;
-        switch (node.op) {
-        case ValueAdd:
-        case CompareLess:
-        case CompareLessEq:
-        case CompareGreater:
-        case CompareGreaterEq:
-        case CompareEq:
-            return !isPredictedNumerical(node);
-        case LogicalNot:
-            return !logicalNotIsPure(node);
-        case GetByVal:
-            return !byValIsPure(node);
-        default:
-            ASSERT_NOT_REACHED();
-            return true; // If by some oddity we hit this case in release build it's safer to have CSE assume the worst.
-        }
-    }
-    
-    NodeIndex impureCSE(Node& node)
-    {
-        NodeIndex child1 = canonicalize(node.child1());
-        NodeIndex child2 = canonicalize(node.child2());
-        NodeIndex child3 = canonicalize(node.child3());
-        
-        NodeIndex start = startIndex();
-        for (NodeIndex index = m_compileIndex; index-- > start;) {
-            Node& otherNode = m_graph[index];
-            if (node.op == otherNode.op
-                && node.arithNodeFlagsForCompare() == otherNode.arithNodeFlagsForCompare()) {
-                NodeIndex otherChild = canonicalize(otherNode.child1());
-                if (otherChild == NoNode)
-                    return index;
-                if (otherChild == child1) {
-                    otherChild = canonicalize(otherNode.child2());
-                    if (otherChild == NoNode)
-                        return index;
-                    if (otherChild == child2) {
-                        otherChild = canonicalize(otherNode.child3());
-                        if (otherChild == NoNode)
-                            return index;
-                        if (otherChild == child3)
-                            return index;
-                    }
-                }
-            }
-            if (clobbersWorld(index))
-                break;
-        }
-        return NoNode;
-    }
-    
-    NodeIndex globalVarLoadElimination(unsigned varNumber, JSGlobalObject* globalObject)
-    {
-        NodeIndex start = startIndexForChildren();
-        for (NodeIndex index = m_compileIndex; index-- > start;) {
-            Node& node = m_graph[index];
-            switch (node.op) {
-            case GetGlobalVar:
-                if (node.varNumber() == varNumber && m_codeBlock->globalObjectFor(node.codeOrigin) == globalObject)
-                    return index;
-                break;
-            case PutGlobalVar:
-                if (node.varNumber() == varNumber && m_codeBlock->globalObjectFor(node.codeOrigin) == globalObject)
-                    return node.child1().index();
-                break;
-            default:
-                break;
-            }
-            if (clobbersWorld(index))
-                break;
-        }
-        return NoNode;
-    }
-    
-    NodeIndex getByValLoadElimination(NodeIndex child1, NodeIndex child2)
-    {
-        NodeIndex start = startIndexForChildren(child1, child2);
-        for (NodeIndex index = m_compileIndex; index-- > start;) {
-            Node& node = m_graph[index];
-            switch (node.op) {
-            case GetByVal:
-                if (!byValIsPure(node))
-                    return NoNode;
-                if (node.child1() == child1 && canonicalize(node.child2()) == canonicalize(child2))
-                    return index;
-                break;
-            case PutByVal:
-            case PutByValAlias:
-                if (!byValIsPure(node))
-                    return NoNode;
-                if (node.child1() == child1 && canonicalize(node.child2()) == canonicalize(child2))
-                    return node.child3().index();
-                // We must assume that the PutByVal will clobber the location we're getting from.
-                // FIXME: We can do better; if we know that the PutByVal is accessing an array of a
-                // different type than the GetByVal, then we know that they won't clobber each other.
-                return NoNode;
-            case PutStructure:
-            case PutByOffset:
-                // GetByVal currently always speculates that it's accessing an
-                // array with an integer index, which means that it's impossible
-                // for a structure change or a put to property storage to affect
-                // the GetByVal.
-                break;
-            case ArrayPush:
-                // A push cannot affect previously existing elements in the array.
-                break;
-            default:
-                if (clobbersWorld(index))
-                    return NoNode;
-                break;
-            }
-        }
-        return NoNode;
-    }
-
-    bool checkFunctionElimination(JSFunction* function, NodeIndex child1)
-    {
-        NodeIndex start = startIndexForChildren(child1);
-        for (NodeIndex index = endIndexForPureCSE(); index-- > start;) {
-            Node& node = m_graph[index];
-            if (node.op == CheckFunction && node.child1() == child1 && node.function() == function)
-                return true;
-        }
-        return false;
-    }
-
-    bool checkStructureLoadElimination(const StructureSet& structureSet, NodeIndex child1)
-    {
-        NodeIndex start = startIndexForChildren(child1);
-        for (NodeIndex index = m_compileIndex; index-- > start;) {
-            Node& node = m_graph[index];
-            switch (node.op) {
-            case CheckStructure:
-                if (node.child1() == child1
-                    && structureSet.isSupersetOf(node.structureSet()))
-                    return true;
-                break;
-                
-            case PutStructure:
-                if (node.child1() == child1
-                    && structureSet.contains(node.structureTransitionData().newStructure))
-                    return true;
-                if (structureSet.contains(node.structureTransitionData().previousStructure))
-                    return false;
-                break;
-                
-            case PutByOffset:
-                // Setting a property cannot change the structure.
-                break;
-                
-            case PutByVal:
-            case PutByValAlias:
-                if (byValIsPure(node)) {
-                    // If PutByVal speculates that it's accessing an array with an
-                    // integer index, then it's impossible for it to cause a structure
-                    // change.
-                    break;
-                }
-                return false;
-                
-            default:
-                if (clobbersWorld(index))
-                    return false;
-                break;
-            }
-        }
-        return false;
-    }
-    
-    NodeIndex getByOffsetLoadElimination(unsigned identifierNumber, NodeIndex child1)
-    {
-        NodeIndex start = startIndexForChildren(child1);
-        for (NodeIndex index = m_compileIndex; index-- > start;) {
-            Node& node = m_graph[index];
-            switch (node.op) {
-            case GetByOffset:
-                if (node.child1() == child1
-                    && m_graph.m_storageAccessData[node.storageAccessDataIndex()].identifierNumber == identifierNumber)
-                    return index;
-                break;
-                
-            case PutByOffset:
-                if (m_graph.m_storageAccessData[node.storageAccessDataIndex()].identifierNumber == identifierNumber) {
-                    if (node.child2() == child1)
-                        return node.child3().index();
-                    return NoNode;
-                }
-                break;
-                
-            case PutStructure:
-                // Changing the structure cannot change the outcome of a property get.
-                break;
-                
-            case PutByVal:
-            case PutByValAlias:
-                if (byValIsPure(node)) {
-                    // If PutByVal speculates that it's accessing an array with an
-                    // integer index, then it's impossible for it to cause a structure
-                    // change.
-                    break;
-                }
-                return NoNode;
-                
-            default:
-                if (clobbersWorld(index))
-                    return NoNode;
-                break;
-            }
-        }
-        return NoNode;
-    }
-    
-    NodeIndex getPropertyStorageLoadElimination(NodeIndex child1)
-    {
-        NodeIndex start = startIndexForChildren(child1);
-        for (NodeIndex index = m_compileIndex; index-- > start;) {
-            Node& node = m_graph[index];
-            switch (node.op) {
-            case GetPropertyStorage:
-                if (node.child1() == child1)
-                    return index;
-                break;
-                
-            case PutByOffset:
-            case PutStructure:
-                // Changing the structure or putting to the storage cannot
-                // change the property storage pointer.
-                break;
-                
-            case PutByVal:
-            case PutByValAlias:
-                if (byValIsPure(node)) {
-                    // If PutByVal speculates that it's accessing an array with an
-                    // integer index, then it's impossible for it to cause a structure
-                    // change.
-                    break;
-                }
-                return NoNode;
-                
-            default:
-                if (clobbersWorld(index))
-                    return NoNode;
-                break;
-            }
-        }
-        return NoNode;
-    }
-
-    NodeIndex getIndexedPropertyStorageLoadElimination(NodeIndex child1, bool hasIntegerIndexPrediction)
-    {
-        NodeIndex start = startIndexForChildren(child1);
-        for (NodeIndex index = m_compileIndex; index-- > start;) {
-            Node& node = m_graph[index];
-            switch (node.op) {
-            case GetIndexedPropertyStorage: {
-                PredictedType basePrediction = m_graph[node.child2()].prediction();
-                bool nodeHasIntegerIndexPrediction = !(!(basePrediction & PredictInt32) && basePrediction);
-                if (node.child1() == child1 && hasIntegerIndexPrediction == nodeHasIntegerIndexPrediction)
-                    return index;
-                break;
-            }
-
-            case PutByOffset:
-            case PutStructure:
-                // Changing the structure or putting to the storage cannot
-                // change the property storage pointer.
-                break;
-                
-            case PutByValAlias:
-                // PutByValAlias can't change the indexed storage pointer
-                break;
-                
-            case PutByVal:
-                if (isFixedIndexedStorageObjectPrediction(m_graph[node.child1()].prediction()) && byValIsPure(node))
-                    break;
-                return NoNode;
-
-            default:
-                if (clobbersWorld(index))
-                    return NoNode;
-                break;
-            }
-        }
-        return NoNode;
-    }
-    
-    NodeIndex getScopeChainLoadElimination(unsigned depth)
-    {
-        NodeIndex start = startIndexForChildren();
-        for (NodeIndex index = endIndexForPureCSE(); index-- > start;) {
-            Node& node = m_graph[index];
-            if (node.op == GetScopeChain
-                && node.scopeChainDepth() == depth)
-                return index;
-        }
-        return NoNode;
-    }
-    
-    void performSubstitution(NodeUse& child, bool addRef = true)
-    {
-        // Check if this operand is actually unused.
-        if (!child)
-            return;
-        
-        // Check if there is any replacement.
-        NodeIndex replacement = m_replacements[child.index()];
-        if (replacement == NoNode)
-            return;
-        
-        child.setIndex(replacement);
-        
-        // There is definitely a replacement. Assert that the replacement does not
-        // have a replacement.
-        ASSERT(m_replacements[child.index()] == NoNode);
-        
-        if (addRef)
-            m_graph[child].ref();
-    }
-    
-    void setReplacement(NodeIndex replacement)
-    {
-        if (replacement == NoNode)
-            return;
-        
-        // Be safe. Don't try to perform replacements if the predictions don't
-        // agree.
-        if (m_graph[m_compileIndex].prediction() != m_graph[replacement].prediction())
-            return;
-        
-#if DFG_ENABLE(DEBUG_PROPAGATION_VERBOSE)
-        printf("   Replacing @%u -> @%u", m_compileIndex, replacement);
-#endif
-        
-        Node& node = m_graph[m_compileIndex];
-        node.op = Phantom;
-        node.setRefCount(1);
-        
-        // At this point we will eliminate all references to this node.
-        m_replacements[m_compileIndex] = replacement;
-    }
-    
-    void eliminate()
-    {
-#if DFG_ENABLE(DEBUG_PROPAGATION_VERBOSE)
-        printf("   Eliminating @%u", m_compileIndex);
-#endif
-        
-        Node& node = m_graph[m_compileIndex];
-        ASSERT(node.refCount() == 1);
-        ASSERT(node.mustGenerate());
-        node.op = Phantom;
-    }
-    
-    void performNodeCSE(Node& node)
-    {
-        bool shouldGenerate = node.shouldGenerate();
-
-        if (node.op & NodeHasVarArgs) {
-            for (unsigned childIdx = node.firstChild(); childIdx < node.firstChild() + node.numChildren(); childIdx++)
-                performSubstitution(m_graph.m_varArgChildren[childIdx], shouldGenerate);
-        } else {
-            performSubstitution(node.children.child1(), shouldGenerate);
-            performSubstitution(node.children.child2(), shouldGenerate);
-            performSubstitution(node.children.child3(), shouldGenerate);
-        }
-        
-        if (!shouldGenerate)
-            return;
-        
-#if DFG_ENABLE(DEBUG_PROPAGATION_VERBOSE)
-        printf("   %s @%u: ", Graph::opName(m_graph[m_compileIndex].op), m_compileIndex);
-#endif
-        
-        // NOTE: there are some nodes that we deliberately don't CSE even though we
-        // probably could, like StrCat and ToPrimitive. That's because there is no
-        // evidence that doing CSE on these nodes would result in a performance
-        // progression. Hence considering these nodes in CSE would just mean that this
-        // code does more work with no win. Of course, we may want to reconsider this,
-        // since StrCat is trivially CSE-able. It's not trivially doable for
-        // ToPrimitive, but we could change that with some speculations if we really
-        // needed to.
-        
-        switch (node.op) {
-        
-        // Handle the pure nodes. These nodes never have any side-effects.
-        case BitAnd:
-        case BitOr:
-        case BitXor:
-        case BitRShift:
-        case BitLShift:
-        case BitURShift:
-        case ArithAdd:
-        case ArithSub:
-        case ArithMul:
-        case ArithMod:
-        case ArithDiv:
-        case ArithAbs:
-        case ArithMin:
-        case ArithMax:
-        case ArithSqrt:
-        case GetByteArrayLength:
-        case GetInt8ArrayLength:
-        case GetInt16ArrayLength:
-        case GetInt32ArrayLength:
-        case GetUint8ArrayLength:
-        case GetUint8ClampedArrayLength:
-        case GetUint16ArrayLength:
-        case GetUint32ArrayLength:
-        case GetFloat32ArrayLength:
-        case GetFloat64ArrayLength:
-        case GetCallee:
-        case GetStringLength:
-        case StringCharAt:
-        case StringCharCodeAt:
-            setReplacement(pureCSE(node));
-            break;
-            
-        case GetArrayLength:
-            setReplacement(impureCSE(node));
-            break;
-            
-        case GetScopeChain:
-            setReplacement(getScopeChainLoadElimination(node.scopeChainDepth()));
-            break;
-
-        // Handle nodes that are conditionally pure: these are pure, and can
-        // be CSE'd, so long as the prediction is the one we want.
-        case ValueAdd:
-        case CompareLess:
-        case CompareLessEq:
-        case CompareGreater:
-        case CompareGreaterEq:
-        case CompareEq: {
-            if (isPredictedNumerical(node)) {
-                NodeIndex replacementIndex = pureCSE(node);
-                if (replacementIndex != NoNode && isPredictedNumerical(m_graph[replacementIndex]))
-                    setReplacement(replacementIndex);
-            }
-            break;
-        }
-            
-        case LogicalNot: {
-            if (logicalNotIsPure(node)) {
-                NodeIndex replacementIndex = pureCSE(node);
-                if (replacementIndex != NoNode && logicalNotIsPure(m_graph[replacementIndex]))
-                    setReplacement(replacementIndex);
-            }
-            break;
-        }
-            
-        // Finally handle heap accesses. These are not quite pure, but we can still
-        // optimize them provided that some subtle conditions are met.
-        case GetGlobalVar:
-            setReplacement(globalVarLoadElimination(node.varNumber(), m_codeBlock->globalObjectFor(node.codeOrigin)));
-            break;
-            
-        case GetByVal:
-            if (byValIsPure(node))
-                setReplacement(getByValLoadElimination(node.child1().index(), node.child2().index()));
-            break;
-            
-        case PutByVal:
-            if (byValIsPure(node) && getByValLoadElimination(node.child1().index(), node.child2().index()) != NoNode)
-                node.op = PutByValAlias;
-            break;
-            
-        case CheckStructure:
-            if (checkStructureLoadElimination(node.structureSet(), node.child1().index()))
-                eliminate();
-            break;
-
-        case CheckFunction:
-            if (checkFunctionElimination(node.function(), node.child1().index()))
-                eliminate();
-            break;
-                
-        case GetIndexedPropertyStorage: {
-            PredictedType basePrediction = m_graph[node.child2()].prediction();
-            bool nodeHasIntegerIndexPrediction = !(!(basePrediction & PredictInt32) && basePrediction);
-            setReplacement(getIndexedPropertyStorageLoadElimination(node.child1().index(), nodeHasIntegerIndexPrediction));
-            break;
-        }
-
-        case GetPropertyStorage:
-            setReplacement(getPropertyStorageLoadElimination(node.child1().index()));
-            break;
-
-        case GetByOffset:
-            setReplacement(getByOffsetLoadElimination(m_graph.m_storageAccessData[node.storageAccessDataIndex()].identifierNumber, node.child1().index()));
-            break;
-            
-        default:
-            // do nothing.
-            break;
-        }
-        
-        m_lastSeen[node.op & NodeIdMask] = m_compileIndex;
-#if DFG_ENABLE(DEBUG_PROPAGATION_VERBOSE)
-        printf("\n");
-#endif
-    }
-    
-    void performBlockCSE(BasicBlock& block)
-    {
-        m_start = block.begin;
-        NodeIndex end = block.end;
-        for (m_compileIndex = m_start; m_compileIndex < end; ++m_compileIndex)
-            performNodeCSE(m_graph[m_compileIndex]);
-    }
-    
-    void localCSE()
-    {
-#if DFG_ENABLE(DEBUG_PROPAGATION_VERBOSE)
-        printf("Performing local CSE:");
-#endif
-        for (unsigned block = 0; block < m_graph.m_blocks.size(); ++block)
-            performBlockCSE(*m_graph.m_blocks[block]);
-    }
-    
-    void allocateVirtualRegisters()
-    {
-#if DFG_ENABLE(DEBUG_VERBOSE)
-        printf("Preserved vars: ");
-        m_graph.m_preservedVars.dump(stdout);
-        printf("\n");
-#endif
-        ScoreBoard scoreBoard(m_graph, m_graph.m_preservedVars);
-        unsigned sizeExcludingPhiNodes = m_graph.m_blocks.last()->end;
-        for (size_t i = 0; i < sizeExcludingPhiNodes; ++i) {
-            Node& node = m_graph[i];
-        
-            if (!node.shouldGenerate())
-                continue;
-        
-            // GetLocal nodes are effectively phi nodes in the graph, referencing
-            // results from prior blocks.
-            if (node.op != GetLocal) {
-                // First, call use on all of the current node's children, then
-                // allocate a VirtualRegister for this node. We do so in this
-                // order so that if a child is on its last use, and a
-                // VirtualRegister is freed, then it may be reused for node.
-                if (node.op & NodeHasVarArgs) {
-                    for (unsigned childIdx = node.firstChild(); childIdx < node.firstChild() + node.numChildren(); childIdx++)
-                        scoreBoard.use(m_graph.m_varArgChildren[childIdx]);
-                } else {
-                    scoreBoard.use(node.child1());
-                    scoreBoard.use(node.child2());
-                    scoreBoard.use(node.child3());
-                }
-            }
-
-            if (!node.hasResult())
-                continue;
-
-            node.setVirtualRegister(scoreBoard.allocate());
-            // 'mustGenerate' nodes have their useCount artificially elevated,
-            // call use now to account for this.
-            if (node.mustGenerate())
-                scoreBoard.use(i);
-        }
-
-        // 'm_numCalleeRegisters' is the number of locals and temporaries allocated
-        // for the function (and checked for on entry). Since we perform a new and
-        // different allocation of temporaries, more registers may now be required.
-        unsigned calleeRegisters = scoreBoard.highWatermark() + m_graph.m_parameterSlots;
-        if ((unsigned)m_codeBlock->m_numCalleeRegisters < calleeRegisters)
-            m_codeBlock->m_numCalleeRegisters = calleeRegisters;
-#if DFG_ENABLE(DEBUG_VERBOSE)
-        printf("Num callee registers: %u\n", calleeRegisters);
-#endif
-    }
-    
-    void performBlockCFA(AbstractState& state, BlockIndex blockIndex)
-    {
-        BasicBlock* block = m_graph.m_blocks[blockIndex].get();
-        if (!block->cfaShouldRevisit)
-            return;
-#if DFG_ENABLE(DEBUG_PROPAGATION_VERBOSE)
-        printf("   Block #%u (bc#%u):\n", blockIndex, block->bytecodeBegin);
-#endif
-        state.beginBasicBlock(block);
-#if DFG_ENABLE(DEBUG_PROPAGATION_VERBOSE)
-        printf("      head vars: ");
-        dumpOperands(block->valuesAtHead, stdout);
-        printf("\n");
-#endif
-        for (NodeIndex nodeIndex = block->begin; nodeIndex < block->end; ++nodeIndex) {
-            if (!m_graph[nodeIndex].shouldGenerate())
-                continue;
-#if DFG_ENABLE(DEBUG_PROPAGATION_VERBOSE)
-            printf("      %s @%u: ", Graph::opName(m_graph[nodeIndex].op), nodeIndex);
-            state.dump(stdout);
-            printf("\n");
-#endif
-            if (!state.execute(nodeIndex))
-                break;
-        }
-#if DFG_ENABLE(DEBUG_PROPAGATION_VERBOSE)
-        printf("      tail regs: ");
-        state.dump(stdout);
-        printf("\n");
-#endif
-        m_changed |= state.endBasicBlock(AbstractState::MergeToSuccessors);
-#if DFG_ENABLE(DEBUG_PROPAGATION_VERBOSE)
-        printf("      tail vars: ");
-        dumpOperands(block->valuesAtTail, stdout);
-        printf("\n");
-#endif
-    }
-    
-    void performForwardCFA(AbstractState& state)
-    {
-#if DFG_ENABLE(DEBUG_PROPAGATION_VERBOSE)
-        printf("CFA [%u]\n", ++m_count);
-#endif
-        
-        for (BlockIndex block = 0; block < m_graph.m_blocks.size(); ++block)
-            performBlockCFA(state, block);
-    }
-    
-    void globalCFA()
-    {
-#if DFG_ENABLE(DEBUG_PROPAGATION_VERBOSE)
-        m_count = 0;
-#endif
-        
-        // This implements a pseudo-worklist-based forward CFA, except that the visit order
-        // of blocks is the bytecode program order (which is nearly topological), and
-        // instead of a worklist we just walk all basic blocks checking if cfaShouldRevisit
-        // is set to true. This is likely to balance the efficiency properties of both
-        // worklist-based and forward fixpoint-based approaches. Like a worklist-based
-        // approach, it won't visit code if it's meaningless to do so (nothing changed at
-        // the head of the block or the predecessors have not been visited). Like a forward
-        // fixpoint-based approach, it has a high probability of only visiting a block
-        // after all predecessors have been visited. Only loops will cause this analysis to
-        // revisit blocks, and the amount of revisiting is proportional to loop depth.
-        
-        AbstractState::initialize(m_graph);
-        
-        AbstractState state(m_codeBlock, m_graph);
-        
-        do {
-            m_changed = false;
-            performForwardCFA(state);
-        } while (m_changed);
-    }
-    
-    Graph& m_graph;
-    JSGlobalData& m_globalData;
-    CodeBlock* m_codeBlock;
-    CodeBlock* m_profiledBlock;
-    
-    NodeIndex m_start;
-    NodeIndex m_compileIndex;
-    
-#if DFG_ENABLE(DEBUG_PROPAGATION_VERBOSE)
-    unsigned m_count;
-#endif
-    
-    bool m_changed;
-
-    Vector<NodeIndex, 16> m_replacements;
-    FixedArray<NodeIndex, LastNodeId> m_lastSeen;
-};
-
-void propagate(Graph& graph, JSGlobalData* globalData, CodeBlock* codeBlock)
-{
-    ASSERT(codeBlock);
-    CodeBlock* profiledBlock = codeBlock->alternative();
-    ASSERT(profiledBlock);
-    
-    Propagator propagator(graph, *globalData, codeBlock, profiledBlock);
-    propagator.fixpoint();
-    
-}
-
-} } // namespace JSC::DFG
-
-#endif // ENABLE(DFG_JIT)
-
diff --git a/Source/JavaScriptCore/dfg/DFGRegisterBank.h b/Source/JavaScriptCore/dfg/DFGRegisterBank.h
index 11cc70931..85dc246f2 100644
--- a/Source/JavaScriptCore/dfg/DFGRegisterBank.h
+++ b/Source/JavaScriptCore/dfg/DFGRegisterBank.h
@@ -232,11 +232,11 @@ public:
         // For each register, print the VirtualRegister 'name'.
         for (uint32_t i =0; i < NUM_REGS; ++i) {
             if (m_data[i].name != InvalidVirtualRegister)
-                fprintf(stderr, "[%02d]", m_data[i].name);
+                dataLog("[%02d]", m_data[i].name);
             else
-                fprintf(stderr, "[--]");
+                dataLog("[--]");
         }
-        fprintf(stderr, "\n");
+        dataLog("\n");
     }
 #endif
 
diff --git a/Source/JavaScriptCore/dfg/DFGRepatch.cpp b/Source/JavaScriptCore/dfg/DFGRepatch.cpp
index f2928c290..edf3c9505 100644
--- a/Source/JavaScriptCore/dfg/DFGRepatch.cpp
+++ b/Source/JavaScriptCore/dfg/DFGRepatch.cpp
@@ -32,6 +32,7 @@
 #include "DFGSpeculativeJIT.h"
 #include "LinkBuffer.h"
 #include "Operations.h"
+#include "PolymorphicPutByIdList.h"
 #include "RepatchBuffer.h"
 
 namespace JSC { namespace DFG {
@@ -361,7 +362,7 @@ static bool tryBuildGetByIDList(ExecState* exec, JSValue baseValue, const Identi
             // place that we made it from. It just so happens to be the place that we are at
             // right now!
             stubJit.store32(
-                MacroAssembler::TrustedImm32(exec->codeOriginIndexForDFGWithInlining()),
+                MacroAssembler::TrustedImm32(exec->codeOriginIndexForDFG()),
                 CCallHelpers::tagFor(static_cast<VirtualRegister>(RegisterFile::ArgumentCount)));
             
             operationCall = stubJit.call();
@@ -492,7 +493,7 @@ void dfgBuildGetByIDProtoList(ExecState* exec, JSValue baseValue, const Identifi
         dfgRepatchCall(exec->codeBlock(), stubInfo.callReturnLocation, operationGetById);
 }
 
-static V_DFGOperation_EJCI appropriatePutByIdFunction(const PutPropertySlot &slot, PutKind putKind)
+static V_DFGOperation_EJCI appropriateGenericPutByIdFunction(const PutPropertySlot &slot, PutKind putKind)
 {
     if (slot.isStrictMode()) {
         if (putKind == Direct)
@@ -504,6 +505,18 @@ static V_DFGOperation_EJCI appropriatePutByIdFunction(const PutPropertySlot &slo
     return operationPutByIdNonStrict;
 }
 
+static V_DFGOperation_EJCI appropriateListBuildingPutByIdFunction(const PutPropertySlot &slot, PutKind putKind)
+{
+    if (slot.isStrictMode()) {
+        if (putKind == Direct)
+            return operationPutByIdDirectStrictBuildList;
+        return operationPutByIdStrictBuildList;
+    }
+    if (putKind == Direct)
+        return operationPutByIdDirectNonStrictBuildList;
+    return operationPutByIdNonStrictBuildList;
+}
+
 static void testPrototype(MacroAssembler &stubJit, GPRReg scratchGPR, JSValue prototype, MacroAssembler::JumpList& failureCases)
 {
     if (prototype.isNull())
@@ -515,7 +528,187 @@ static void testPrototype(MacroAssembler &stubJit, GPRReg scratchGPR, JSValue pr
     failureCases.append(stubJit.branchPtr(MacroAssembler::NotEqual, MacroAssembler::Address(scratchGPR, JSCell::structureOffset()), MacroAssembler::TrustedImmPtr(prototype.asCell()->structure())));
 }
 
-static bool tryCachePutByID(ExecState* exec, JSValue baseValue, const Identifier&, const PutPropertySlot& slot, StructureStubInfo& stubInfo, PutKind putKind)
+static void emitPutReplaceStub(
+    ExecState* exec,
+    JSValue,
+    const Identifier&,
+    const PutPropertySlot& slot,
+    StructureStubInfo& stubInfo,
+    PutKind,
+    Structure* structure,
+    CodeLocationLabel failureLabel,
+    MacroAssemblerCodeRef& stubRoutine)
+{
+    JSGlobalData* globalData = &exec->globalData();
+    GPRReg baseGPR = static_cast<GPRReg>(stubInfo.baseGPR);
+#if USE(JSVALUE32_64)
+    GPRReg valueTagGPR = static_cast<GPRReg>(stubInfo.valueTagGPR);
+#endif
+    GPRReg valueGPR = static_cast<GPRReg>(stubInfo.valueGPR);
+    GPRReg scratchGPR = static_cast<GPRReg>(stubInfo.scratchGPR);
+    bool needToRestoreScratch = false;
+#if ENABLE(GGC) || ENABLE(WRITE_BARRIER_PROFILING)
+    GPRReg scratchGPR2;
+    const bool writeBarrierNeeded = true;
+#else
+    const bool writeBarrierNeeded = false;
+#endif
+    
+    MacroAssembler stubJit;
+    
+    if (scratchGPR == InvalidGPRReg && (writeBarrierNeeded || !structure->isUsingInlineStorage())) {
+        scratchGPR = SpeculativeJIT::selectScratchGPR(baseGPR, valueGPR);
+        needToRestoreScratch = true;
+        stubJit.push(scratchGPR);
+    }
+
+    MacroAssembler::Jump badStructure = stubJit.branchPtr(
+        MacroAssembler::NotEqual,
+        MacroAssembler::Address(baseGPR, JSCell::structureOffset()),
+        MacroAssembler::TrustedImmPtr(structure));
+    
+#if ENABLE(GGC) || ENABLE(WRITE_BARRIER_PROFILING)
+    scratchGPR2 = SpeculativeJIT::selectScratchGPR(baseGPR, valueGPR, scratchGPR);
+    stubJit.push(scratchGPR2);
+    SpeculativeJIT::writeBarrier(stubJit, baseGPR, scratchGPR, scratchGPR2, WriteBarrierForPropertyAccess);
+    stubJit.pop(scratchGPR2);
+#endif
+    
+#if USE(JSVALUE64)
+    if (structure->isUsingInlineStorage())
+        stubJit.storePtr(valueGPR, MacroAssembler::Address(baseGPR, JSObject::offsetOfInlineStorage() + slot.cachedOffset() * sizeof(JSValue)));
+    else {
+        stubJit.loadPtr(MacroAssembler::Address(baseGPR, JSObject::offsetOfPropertyStorage()), scratchGPR);
+        stubJit.storePtr(valueGPR, MacroAssembler::Address(scratchGPR, slot.cachedOffset() * sizeof(JSValue)));
+    }
+#elif USE(JSVALUE32_64)
+    if (structure->isUsingInlineStorage()) {
+        stubJit.store32(valueGPR, MacroAssembler::Address(baseGPR, JSObject::offsetOfInlineStorage() + slot.cachedOffset() * sizeof(JSValue) + OBJECT_OFFSETOF(EncodedValueDescriptor, asBits.payload)));
+        stubJit.store32(valueTagGPR, MacroAssembler::Address(baseGPR, JSObject::offsetOfInlineStorage() + slot.cachedOffset() * sizeof(JSValue) + OBJECT_OFFSETOF(EncodedValueDescriptor, asBits.tag)));
+    } else {
+        stubJit.loadPtr(MacroAssembler::Address(baseGPR, JSObject::offsetOfPropertyStorage()), scratchGPR);
+        stubJit.store32(valueGPR, MacroAssembler::Address(scratchGPR, slot.cachedOffset() * sizeof(JSValue) + OBJECT_OFFSETOF(EncodedValueDescriptor, asBits.payload)));
+        stubJit.store32(valueTagGPR, MacroAssembler::Address(scratchGPR, slot.cachedOffset() * sizeof(JSValue) + OBJECT_OFFSETOF(EncodedValueDescriptor, asBits.tag)));
+    }
+#endif
+    
+    MacroAssembler::Jump success;
+    MacroAssembler::Jump failure;
+    
+    if (needToRestoreScratch) {
+        stubJit.pop(scratchGPR);
+        success = stubJit.jump();
+        
+        badStructure.link(&stubJit);
+        stubJit.pop(scratchGPR);
+        failure = stubJit.jump();
+    } else {
+        success = stubJit.jump();
+        failure = badStructure;
+    }
+    
+    LinkBuffer patchBuffer(*globalData, &stubJit, exec->codeBlock());
+    patchBuffer.link(success, stubInfo.callReturnLocation.labelAtOffset(stubInfo.deltaCallToDone));
+    patchBuffer.link(failure, failureLabel);
+            
+    stubRoutine = patchBuffer.finalizeCode();
+}
+
+static void emitPutTransitionStub(
+    ExecState* exec,
+    JSValue,
+    const Identifier&,
+    const PutPropertySlot& slot,
+    StructureStubInfo& stubInfo,
+    PutKind putKind,
+    Structure* structure,
+    Structure* oldStructure,
+    StructureChain* prototypeChain,
+    CodeLocationLabel failureLabel,
+    MacroAssemblerCodeRef& stubRoutine)
+{
+    JSGlobalData* globalData = &exec->globalData();
+
+    GPRReg baseGPR = static_cast<GPRReg>(stubInfo.baseGPR);
+#if USE(JSVALUE32_64)
+    GPRReg valueTagGPR = static_cast<GPRReg>(stubInfo.valueTagGPR);
+#endif
+    GPRReg valueGPR = static_cast<GPRReg>(stubInfo.valueGPR);
+    GPRReg scratchGPR = static_cast<GPRReg>(stubInfo.scratchGPR);
+    bool needToRestoreScratch = false;
+            
+    ASSERT(scratchGPR != baseGPR);
+            
+    MacroAssembler stubJit;
+            
+    MacroAssembler::JumpList failureCases;
+            
+    if (scratchGPR == InvalidGPRReg) {
+        scratchGPR = SpeculativeJIT::selectScratchGPR(baseGPR, valueGPR);
+        stubJit.push(scratchGPR);
+        needToRestoreScratch = true;
+    }
+    
+    failureCases.append(stubJit.branchPtr(MacroAssembler::NotEqual, MacroAssembler::Address(baseGPR, JSCell::structureOffset()), MacroAssembler::TrustedImmPtr(oldStructure)));
+            
+    testPrototype(stubJit, scratchGPR, oldStructure->storedPrototype(), failureCases);
+            
+    if (putKind == NotDirect) {
+        for (WriteBarrier<Structure>* it = prototypeChain->head(); *it; ++it)
+            testPrototype(stubJit, scratchGPR, (*it)->storedPrototype(), failureCases);
+    }
+
+#if ENABLE(GGC) || ENABLE(WRITE_BARRIER_PROFILING)
+    // Must always emit this write barrier as the structure transition itself requires it
+    GPRReg scratch2 = SpeculativeJIT::selectScratchGPR(baseGPR, valueGPR, scratchGPR);
+    stubJit.push(scratch2);
+    SpeculativeJIT::writeBarrier(stubJit, baseGPR, scratchGPR, scratch2, WriteBarrierForPropertyAccess);
+    stubJit.pop(scratch2);
+#endif
+
+    stubJit.storePtr(MacroAssembler::TrustedImmPtr(structure), MacroAssembler::Address(baseGPR, JSCell::structureOffset()));
+#if USE(JSVALUE64)
+    if (structure->isUsingInlineStorage())
+        stubJit.storePtr(valueGPR, MacroAssembler::Address(baseGPR, JSObject::offsetOfInlineStorage() + slot.cachedOffset() * sizeof(JSValue)));
+    else {
+        stubJit.loadPtr(MacroAssembler::Address(baseGPR, JSObject::offsetOfPropertyStorage()), scratchGPR);
+        stubJit.storePtr(valueGPR, MacroAssembler::Address(scratchGPR, slot.cachedOffset() * sizeof(JSValue)));
+    }
+#elif USE(JSVALUE32_64)
+    if (structure->isUsingInlineStorage()) {
+        stubJit.store32(valueGPR, MacroAssembler::Address(baseGPR, JSObject::offsetOfInlineStorage() + slot.cachedOffset() * sizeof(JSValue) + OBJECT_OFFSETOF(EncodedValueDescriptor, asBits.payload)));
+        stubJit.store32(valueTagGPR, MacroAssembler::Address(baseGPR, JSObject::offsetOfInlineStorage() + slot.cachedOffset() * sizeof(JSValue) + OBJECT_OFFSETOF(EncodedValueDescriptor, asBits.tag)));
+    } else {
+        stubJit.loadPtr(MacroAssembler::Address(baseGPR, JSObject::offsetOfPropertyStorage()), scratchGPR);
+        stubJit.store32(valueGPR, MacroAssembler::Address(scratchGPR, slot.cachedOffset() * sizeof(JSValue) + OBJECT_OFFSETOF(EncodedValueDescriptor, asBits.payload)));
+        stubJit.store32(valueTagGPR, MacroAssembler::Address(scratchGPR, slot.cachedOffset() * sizeof(JSValue) + OBJECT_OFFSETOF(EncodedValueDescriptor, asBits.tag)));
+    }
+#endif
+            
+    MacroAssembler::Jump success;
+    MacroAssembler::Jump failure;
+            
+    if (needToRestoreScratch) {
+        stubJit.pop(scratchGPR);
+        success = stubJit.jump();
+
+        failureCases.link(&stubJit);
+        stubJit.pop(scratchGPR);
+        failure = stubJit.jump();
+    } else
+        success = stubJit.jump();
+            
+    LinkBuffer patchBuffer(*globalData, &stubJit, exec->codeBlock());
+    patchBuffer.link(success, stubInfo.callReturnLocation.labelAtOffset(stubInfo.deltaCallToDone));
+    if (needToRestoreScratch)
+        patchBuffer.link(failure, failureLabel);
+    else
+        patchBuffer.link(failureCases, failureLabel);
+            
+    stubRoutine = patchBuffer.finalizeCode();
+}
+
+static bool tryCachePutByID(ExecState* exec, JSValue baseValue, const Identifier& ident, const PutPropertySlot& slot, StructureStubInfo& stubInfo, PutKind putKind)
 {
     CodeBlock* codeBlock = exec->codeBlock();
     JSGlobalData* globalData = &exec->globalData();
@@ -545,99 +738,26 @@ static bool tryCachePutByID(ExecState* exec, JSValue baseValue, const Identifier
             
             StructureChain* prototypeChain = structure->prototypeChain(exec);
             
-            GPRReg baseGPR = static_cast<GPRReg>(stubInfo.baseGPR);
-#if USE(JSVALUE32_64)
-            GPRReg valueTagGPR = static_cast<GPRReg>(stubInfo.valueTagGPR);
-#endif
-            GPRReg valueGPR = static_cast<GPRReg>(stubInfo.valueGPR);
-            GPRReg scratchGPR = static_cast<GPRReg>(stubInfo.scratchGPR);
-            bool needToRestoreScratch = false;
-            
-            ASSERT(scratchGPR != baseGPR);
-            
-            MacroAssembler stubJit;
-            
-            MacroAssembler::JumpList failureCases;
-            
-            if (scratchGPR == InvalidGPRReg) {
-                scratchGPR = SpeculativeJIT::selectScratchGPR(baseGPR, valueGPR);
-                stubJit.push(scratchGPR);
-                needToRestoreScratch = true;
-            }
-            
-            failureCases.append(stubJit.branchPtr(MacroAssembler::NotEqual, MacroAssembler::Address(baseGPR, JSCell::structureOffset()), MacroAssembler::TrustedImmPtr(oldStructure)));
-            
-            testPrototype(stubJit, scratchGPR, oldStructure->storedPrototype(), failureCases);
-            
-            if (putKind == NotDirect) {
-                for (WriteBarrier<Structure>* it = prototypeChain->head(); *it; ++it)
-                    testPrototype(stubJit, scratchGPR, (*it)->storedPrototype(), failureCases);
-            }
-
-#if ENABLE(GGC) || ENABLE(WRITE_BARRIER_PROFILING)
-            // Must always emit this write barrier as the structure transition itself requires it
-            GPRReg scratch2 = SpeculativeJIT::selectScratchGPR(baseGPR, valueGPR, scratchGPR);
-            stubJit.push(scratch2);
-            SpeculativeJIT::writeBarrier(stubJit, baseGPR, scratchGPR, scratch2, WriteBarrierForPropertyAccess);
-            stubJit.pop(scratch2);
-#endif
-
-            stubJit.storePtr(MacroAssembler::TrustedImmPtr(structure), MacroAssembler::Address(baseGPR, JSCell::structureOffset()));
-#if USE(JSVALUE64)
-            if (structure->isUsingInlineStorage())
-                stubJit.storePtr(valueGPR, MacroAssembler::Address(baseGPR, JSObject::offsetOfInlineStorage() + slot.cachedOffset() * sizeof(JSValue)));
-            else {
-                stubJit.loadPtr(MacroAssembler::Address(baseGPR, JSObject::offsetOfPropertyStorage()), scratchGPR);
-                stubJit.storePtr(valueGPR, MacroAssembler::Address(scratchGPR, slot.cachedOffset() * sizeof(JSValue)));
-            }
-#elif USE(JSVALUE32_64)
-            if (structure->isUsingInlineStorage()) {
-                stubJit.store32(valueGPR, MacroAssembler::Address(baseGPR, JSObject::offsetOfInlineStorage() + slot.cachedOffset() * sizeof(JSValue) + OBJECT_OFFSETOF(EncodedValueDescriptor, asBits.payload)));
-                stubJit.store32(valueTagGPR, MacroAssembler::Address(baseGPR, JSObject::offsetOfInlineStorage() + slot.cachedOffset() * sizeof(JSValue) + OBJECT_OFFSETOF(EncodedValueDescriptor, asBits.tag)));
-            } else {
-                stubJit.loadPtr(MacroAssembler::Address(baseGPR, JSObject::offsetOfPropertyStorage()), scratchGPR);
-                stubJit.store32(valueGPR, MacroAssembler::Address(scratchGPR, slot.cachedOffset() * sizeof(JSValue) + OBJECT_OFFSETOF(EncodedValueDescriptor, asBits.payload)));
-                stubJit.store32(valueTagGPR, MacroAssembler::Address(scratchGPR, slot.cachedOffset() * sizeof(JSValue) + OBJECT_OFFSETOF(EncodedValueDescriptor, asBits.tag)));
-            }
-#endif
-            
-            MacroAssembler::Jump success;
-            MacroAssembler::Jump failure;
-            
-            if (needToRestoreScratch) {
-                stubJit.pop(scratchGPR);
-                success = stubJit.jump();
-
-                failureCases.link(&stubJit);
-                stubJit.pop(scratchGPR);
-                failure = stubJit.jump();
-            } else
-                success = stubJit.jump();
-            
-            LinkBuffer patchBuffer(*globalData, &stubJit, codeBlock);
-            patchBuffer.link(success, stubInfo.callReturnLocation.labelAtOffset(stubInfo.deltaCallToDone));
-            if (needToRestoreScratch)
-                patchBuffer.link(failure, stubInfo.callReturnLocation.labelAtOffset(stubInfo.deltaCallToSlowCase));
-            else
-                patchBuffer.link(failureCases, stubInfo.callReturnLocation.labelAtOffset(stubInfo.deltaCallToSlowCase));
-            
-            stubInfo.stubRoutine = patchBuffer.finalizeCode();
+            emitPutTransitionStub(
+                exec, baseValue, ident, slot, stubInfo, putKind,
+                structure, oldStructure, prototypeChain,
+                stubInfo.callReturnLocation.labelAtOffset(stubInfo.deltaCallToSlowCase),
+                stubInfo.stubRoutine);
             
             RepatchBuffer repatchBuffer(codeBlock);
             repatchBuffer.relink(stubInfo.callReturnLocation.jumpAtOffset(stubInfo.deltaCallToStructCheck), CodeLocationLabel(stubInfo.stubRoutine.code()));
-            repatchBuffer.relink(stubInfo.callReturnLocation, appropriatePutByIdFunction(slot, putKind));
+            repatchBuffer.relink(stubInfo.callReturnLocation, appropriateListBuildingPutByIdFunction(slot, putKind));
             
             stubInfo.initPutByIdTransition(*globalData, codeBlock->ownerExecutable(), oldStructure, structure, prototypeChain, putKind == Direct);
             
             return true;
         }
 
-        dfgRepatchByIdSelfAccess(codeBlock, stubInfo, structure, slot.cachedOffset(), appropriatePutByIdFunction(slot, putKind), false);
+        dfgRepatchByIdSelfAccess(codeBlock, stubInfo, structure, slot.cachedOffset(), appropriateListBuildingPutByIdFunction(slot, putKind), false);
         stubInfo.initPutByIdReplace(*globalData, codeBlock->ownerExecutable(), structure);
         return true;
     }
 
-    // FIXME: should support the transition case!
     return false;
 }
 
@@ -645,7 +765,91 @@ void dfgRepatchPutByID(ExecState* exec, JSValue baseValue, const Identifier& pro
 {
     bool cached = tryCachePutByID(exec, baseValue, propertyName, slot, stubInfo, putKind);
     if (!cached)
-        dfgRepatchCall(exec->codeBlock(), stubInfo.callReturnLocation, appropriatePutByIdFunction(slot, putKind));
+        dfgRepatchCall(exec->codeBlock(), stubInfo.callReturnLocation, appropriateGenericPutByIdFunction(slot, putKind));
+}
+
+static bool tryBuildPutByIdList(ExecState* exec, JSValue baseValue, const Identifier& propertyName, const PutPropertySlot& slot, StructureStubInfo& stubInfo, PutKind putKind)
+{
+    CodeBlock* codeBlock = exec->codeBlock();
+    JSGlobalData* globalData = &exec->globalData();
+
+    if (!baseValue.isCell())
+        return false;
+    JSCell* baseCell = baseValue.asCell();
+    Structure* structure = baseCell->structure();
+    Structure* oldStructure = structure->previousID();
+    
+    if (!slot.isCacheable())
+        return false;
+    if (structure->isUncacheableDictionary())
+        return false;
+
+    // Optimize self access.
+    if (slot.base() == baseValue) {
+        PolymorphicPutByIdList* list;
+        MacroAssemblerCodeRef stubRoutine;
+        
+        if (slot.type() == PutPropertySlot::NewProperty) {
+            if (structure->isDictionary())
+                return false;
+            
+            // skip optimizing the case where we need a realloc
+            if (oldStructure->propertyStorageCapacity() != structure->propertyStorageCapacity())
+                return false;
+            
+            normalizePrototypeChain(exec, baseCell);
+            
+            StructureChain* prototypeChain = structure->prototypeChain(exec);
+            
+            // We're now committed to creating the stub. Mogrify the meta-data accordingly.
+            list = PolymorphicPutByIdList::from(
+                putKind, stubInfo,
+                stubInfo.callReturnLocation.labelAtOffset(stubInfo.deltaCallToSlowCase));
+            
+            emitPutTransitionStub(
+                exec, baseValue, propertyName, slot, stubInfo, putKind,
+                structure, oldStructure, prototypeChain,
+                CodeLocationLabel(list->currentSlowPathTarget()),
+                stubRoutine);
+            
+            list->addAccess(
+                PutByIdAccess::transition(
+                    *globalData, codeBlock->ownerExecutable(),
+                    oldStructure, structure, prototypeChain,
+                    stubRoutine));
+        } else {
+            // We're now committed to creating the stub. Mogrify the meta-data accordingly.
+            list = PolymorphicPutByIdList::from(
+                putKind, stubInfo,
+                stubInfo.callReturnLocation.labelAtOffset(stubInfo.deltaCallToSlowCase));
+            
+            emitPutReplaceStub(
+                exec, baseValue, propertyName, slot, stubInfo, putKind,
+                structure, CodeLocationLabel(list->currentSlowPathTarget()), stubRoutine);
+            
+            list->addAccess(
+                PutByIdAccess::replace(
+                    *globalData, codeBlock->ownerExecutable(),
+                    structure, stubRoutine));
+        }
+        
+        RepatchBuffer repatchBuffer(codeBlock);
+        repatchBuffer.relink(stubInfo.callReturnLocation.jumpAtOffset(stubInfo.deltaCallToStructCheck), CodeLocationLabel(stubRoutine.code()));
+        
+        if (list->isFull())
+            repatchBuffer.relink(stubInfo.callReturnLocation, appropriateGenericPutByIdFunction(slot, putKind));
+        
+        return true;
+    }
+    
+    return false;
+}
+
+void dfgBuildPutByIdList(ExecState* exec, JSValue baseValue, const Identifier& propertyName, const PutPropertySlot& slot, StructureStubInfo& stubInfo, PutKind putKind)
+{
+    bool cached = tryBuildPutByIdList(exec, baseValue, propertyName, slot, stubInfo, putKind);
+    if (!cached)
+        dfgRepatchCall(exec->codeBlock(), stubInfo.callReturnLocation, appropriateGenericPutByIdFunction(slot, putKind));
 }
 
 void dfgLinkFor(ExecState* exec, CallLinkInfo& callLinkInfo, CodeBlock* calleeCodeBlock, JSFunction* callee, MacroAssemblerCodePtr codePtr, CodeSpecializationKind kind)
@@ -687,14 +891,14 @@ void dfgResetPutByID(RepatchBuffer& repatchBuffer, StructureStubInfo& stubInfo)
 {
     V_DFGOperation_EJCI unoptimizedFunction = bitwise_cast<V_DFGOperation_EJCI>(MacroAssembler::readCallTarget(stubInfo.callReturnLocation).executableAddress());
     V_DFGOperation_EJCI optimizedFunction;
-    if (unoptimizedFunction == operationPutByIdStrict)
+    if (unoptimizedFunction == operationPutByIdStrict || unoptimizedFunction == operationPutByIdStrictBuildList)
         optimizedFunction = operationPutByIdStrictOptimize;
-    else if (unoptimizedFunction == operationPutByIdNonStrict)
+    else if (unoptimizedFunction == operationPutByIdNonStrict || unoptimizedFunction == operationPutByIdNonStrictBuildList)
         optimizedFunction = operationPutByIdNonStrictOptimize;
-    else if (unoptimizedFunction == operationPutByIdDirectStrict)
+    else if (unoptimizedFunction == operationPutByIdDirectStrict || unoptimizedFunction == operationPutByIdDirectStrictBuildList)
         optimizedFunction = operationPutByIdDirectStrictOptimize;
     else {
-        ASSERT(unoptimizedFunction == operationPutByIdDirectNonStrict);
+        ASSERT(unoptimizedFunction == operationPutByIdDirectNonStrict || unoptimizedFunction == operationPutByIdDirectNonStrictBuildList);
         optimizedFunction = operationPutByIdDirectNonStrictOptimize;
     }
     repatchBuffer.relink(stubInfo.callReturnLocation, optimizedFunction);
diff --git a/Source/JavaScriptCore/dfg/DFGRepatch.h b/Source/JavaScriptCore/dfg/DFGRepatch.h
index f146128fb..83d4e976d 100644
--- a/Source/JavaScriptCore/dfg/DFGRepatch.h
+++ b/Source/JavaScriptCore/dfg/DFGRepatch.h
@@ -26,10 +26,12 @@
 #ifndef DFGRepatch_h
 #define DFGRepatch_h
 
+#include <wtf/Platform.h>
+
 #if ENABLE(DFG_JIT)
 
-#include <dfg/DFGJITCompiler.h>
-#include <dfg/DFGOperations.h>
+#include "DFGJITCompiler.h"
+#include "DFGOperations.h"
 
 namespace JSC { namespace DFG {
 
@@ -37,6 +39,7 @@ void dfgRepatchGetByID(ExecState*, JSValue, const Identifier&, const PropertySlo
 void dfgBuildGetByIDList(ExecState*, JSValue, const Identifier&, const PropertySlot&, StructureStubInfo&);
 void dfgBuildGetByIDProtoList(ExecState*, JSValue, const Identifier&, const PropertySlot&, StructureStubInfo&);
 void dfgRepatchPutByID(ExecState*, JSValue, const Identifier&, const PutPropertySlot&, StructureStubInfo&, PutKind);
+void dfgBuildPutByIdList(ExecState*, JSValue, const Identifier&, const PutPropertySlot&, StructureStubInfo&, PutKind);
 void dfgLinkFor(ExecState*, CallLinkInfo&, CodeBlock*, JSFunction* callee, MacroAssemblerCodePtr, CodeSpecializationKind);
 void dfgResetGetByID(RepatchBuffer&, StructureStubInfo&);
 void dfgResetPutByID(RepatchBuffer&, StructureStubInfo&);
diff --git a/Source/JavaScriptCore/dfg/DFGScoreBoard.h b/Source/JavaScriptCore/dfg/DFGScoreBoard.h
index cc3272812..912b3e8fd 100644
--- a/Source/JavaScriptCore/dfg/DFGScoreBoard.h
+++ b/Source/JavaScriptCore/dfg/DFGScoreBoard.h
@@ -119,26 +119,26 @@ public:
 #ifndef NDEBUG
     void dump()
     {
-        printf("    USED: [ ");
+        dataLog("    USED: [ ");
         for (unsigned i = 0; i < m_used.size(); ++i) {
             if (!m_free.contains(i)) {
-                printf("%d:", i);
+                dataLog("%d:", i);
                 if (m_used[i] == max())
-                    printf("local ");
+                    dataLog("local ");
                 else
-                    printf("%d ", m_used[i]);
+                    dataLog("%d ", m_used[i]);
             }
         }
-        printf("]\n");
+        dataLog("]\n");
 
-        printf("    FREE: [ ");
+        dataLog("    FREE: [ ");
         for (unsigned i = 0; i < m_used.size(); ++i) {
             if (m_free.contains(i) && m_used[i] != max()) {
                 ASSERT(!m_used[i]);
-                printf("%d ", i);
+                dataLog("%d ", i);
             }
         }
-        printf("]\n");
+        dataLog("]\n");
     }
 
 #endif
diff --git a/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp b/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp
index 77b3e54b1..8578337f5 100644
--- a/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp
+++ b/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp
@@ -430,33 +430,33 @@ static const char* dataFormatString(DataFormat format)
 void SpeculativeJIT::dump(const char* label)
 {
     if (label)
-        fprintf(stderr, "<%s>\n", label);
+        dataLog("<%s>\n", label);
 
-    fprintf(stderr, "  gprs:\n");
+    dataLog("  gprs:\n");
     m_gprs.dump();
-    fprintf(stderr, "  fprs:\n");
+    dataLog("  fprs:\n");
     m_fprs.dump();
-    fprintf(stderr, "  VirtualRegisters:\n");
+    dataLog("  VirtualRegisters:\n");
     for (unsigned i = 0; i < m_generationInfo.size(); ++i) {
         GenerationInfo& info = m_generationInfo[i];
         if (info.alive())
-            fprintf(stderr, "    % 3d:%s%s", i, dataFormatString(info.registerFormat()), dataFormatString(info.spillFormat()));
+            dataLog("    % 3d:%s%s", i, dataFormatString(info.registerFormat()), dataFormatString(info.spillFormat()));
         else
-            fprintf(stderr, "    % 3d:[__][__]", i);
+            dataLog("    % 3d:[__][__]", i);
         if (info.registerFormat() == DataFormatDouble)
-            fprintf(stderr, ":fpr%d\n", info.fpr());
+            dataLog(":fpr%d\n", info.fpr());
         else if (info.registerFormat() != DataFormatNone
 #if USE(JSVALUE32_64)
             && !(info.registerFormat() & DataFormatJS)
 #endif
             ) {
             ASSERT(info.gpr() != InvalidGPRReg);
-            fprintf(stderr, ":%s\n", GPRInfo::debugName(info.gpr()));
+            dataLog(":%s\n", GPRInfo::debugName(info.gpr()));
         } else
-            fprintf(stderr, "\n");
+            dataLog("\n");
     }
     if (label)
-        fprintf(stderr, "</%s>\n", label);
+        dataLog("</%s>\n", label);
 }
 #endif
 
@@ -468,13 +468,13 @@ void SpeculativeJIT::checkConsistency()
 
     for (gpr_iterator iter = m_gprs.begin(); iter != m_gprs.end(); ++iter) {
         if (iter.isLocked()) {
-            fprintf(stderr, "DFG_CONSISTENCY_CHECK failed: gpr %s is locked.\n", iter.debugName());
+            dataLog("DFG_CONSISTENCY_CHECK failed: gpr %s is locked.\n", iter.debugName());
             failed = true;
         }
     }
     for (fpr_iterator iter = m_fprs.begin(); iter != m_fprs.end(); ++iter) {
         if (iter.isLocked()) {
-            fprintf(stderr, "DFG_CONSISTENCY_CHECK failed: fpr %s is locked.\n", iter.debugName());
+            dataLog("DFG_CONSISTENCY_CHECK failed: fpr %s is locked.\n", iter.debugName());
             failed = true;
         }
     }
@@ -502,7 +502,7 @@ void SpeculativeJIT::checkConsistency()
             GPRReg gpr = info.gpr();
             ASSERT(gpr != InvalidGPRReg);
             if (m_gprs.name(gpr) != virtualRegister) {
-                fprintf(stderr, "DFG_CONSISTENCY_CHECK failed: name mismatch for virtual register %d (gpr %s).\n", virtualRegister, GPRInfo::debugName(gpr));
+                dataLog("DFG_CONSISTENCY_CHECK failed: name mismatch for virtual register %d (gpr %s).\n", virtualRegister, GPRInfo::debugName(gpr));
                 failed = true;
             }
             break;
@@ -511,7 +511,7 @@ void SpeculativeJIT::checkConsistency()
             FPRReg fpr = info.fpr();
             ASSERT(fpr != InvalidFPRReg);
             if (m_fprs.name(fpr) != virtualRegister) {
-                fprintf(stderr, "DFG_CONSISTENCY_CHECK failed: name mismatch for virtual register %d (fpr %s).\n", virtualRegister, FPRInfo::debugName(fpr));
+                dataLog("DFG_CONSISTENCY_CHECK failed: name mismatch for virtual register %d (fpr %s).\n", virtualRegister, FPRInfo::debugName(fpr));
                 failed = true;
             }
             break;
@@ -527,18 +527,18 @@ void SpeculativeJIT::checkConsistency()
         GenerationInfo& info = m_generationInfo[virtualRegister];
 #if USE(JSVALUE64)
         if (iter.regID() != info.gpr()) {
-            fprintf(stderr, "DFG_CONSISTENCY_CHECK failed: name mismatch for gpr %s (virtual register %d).\n", iter.debugName(), virtualRegister);
+            dataLog("DFG_CONSISTENCY_CHECK failed: name mismatch for gpr %s (virtual register %d).\n", iter.debugName(), virtualRegister);
             failed = true;
         }
 #else
         if (!(info.registerFormat() & DataFormatJS)) {
             if (iter.regID() != info.gpr()) {
-                fprintf(stderr, "DFG_CONSISTENCY_CHECK failed: name mismatch for gpr %s (virtual register %d).\n", iter.debugName(), virtualRegister);
+                dataLog("DFG_CONSISTENCY_CHECK failed: name mismatch for gpr %s (virtual register %d).\n", iter.debugName(), virtualRegister);
                 failed = true;
             }
         } else {
             if (iter.regID() != info.tagGPR() && iter.regID() != info.payloadGPR()) {
-                fprintf(stderr, "DFG_CONSISTENCY_CHECK failed: name mismatch for gpr %s (virtual register %d).\n", iter.debugName(), virtualRegister);
+                dataLog("DFG_CONSISTENCY_CHECK failed: name mismatch for gpr %s (virtual register %d).\n", iter.debugName(), virtualRegister);
                 failed = true;
             }
         }
@@ -552,7 +552,7 @@ void SpeculativeJIT::checkConsistency()
 
         GenerationInfo& info = m_generationInfo[virtualRegister];
         if (iter.regID() != info.fpr()) {
-            fprintf(stderr, "DFG_CONSISTENCY_CHECK failed: name mismatch for fpr %s (virtual register %d).\n", iter.debugName(), virtualRegister);
+            dataLog("DFG_CONSISTENCY_CHECK failed: name mismatch for fpr %s (virtual register %d).\n", iter.debugName(), virtualRegister);
             failed = true;
         }
     }
@@ -803,10 +803,8 @@ void SpeculativeJIT::compilePeepHoleDoubleBranch(Node& node, NodeIndex branchNod
     SpeculateDoubleOperand op1(this, node.child1());
     SpeculateDoubleOperand op2(this, node.child2());
     
-    addBranch(m_jit.branchDouble(condition, op1.fpr(), op2.fpr()), taken);
-    
-    if (notTaken != (m_block + 1))
-        addBranch(m_jit.jump(), notTaken);
+    branchDouble(condition, op1.fpr(), op2.fpr(), taken);
+    jump(notTaken);
 }
 
 void SpeculativeJIT::compilePeepHoleObjectEquality(Node& node, NodeIndex branchNodeIndex, const ClassInfo* classInfo, PredictionChecker predictionCheck)
@@ -835,9 +833,8 @@ void SpeculativeJIT::compilePeepHoleObjectEquality(Node& node, NodeIndex branchN
     if (!predictionCheck(m_state.forNode(node.child2()).m_type))
         speculationCheck(BadType, JSValueSource::unboxedCell(op2GPR), node.child2().index(), m_jit.branchPtr(MacroAssembler::NotEqual, MacroAssembler::Address(op2GPR, JSCell::classInfoOffset()), MacroAssembler::TrustedImmPtr(classInfo)));
     
-    addBranch(m_jit.branchPtr(condition, op1GPR, op2GPR), taken);
-    if (notTaken != (m_block + 1))
-        addBranch(m_jit.jump(), notTaken);
+    branchPtr(condition, op1GPR, op2GPR, taken);
+    jump(notTaken);
 }
 
 void SpeculativeJIT::compilePeepHoleIntegerBranch(Node& node, NodeIndex branchNodeIndex, JITCompiler::RelationalCondition condition)
@@ -858,20 +855,18 @@ void SpeculativeJIT::compilePeepHoleIntegerBranch(Node& node, NodeIndex branchNo
     if (isInt32Constant(node.child1().index())) {
         int32_t imm = valueOfInt32Constant(node.child1().index());
         SpeculateIntegerOperand op2(this, node.child2());
-        addBranch(m_jit.branch32(condition, JITCompiler::Imm32(imm), op2.gpr()), taken);
+        branch32(condition, JITCompiler::Imm32(imm), op2.gpr(), taken);
     } else if (isInt32Constant(node.child2().index())) {
         SpeculateIntegerOperand op1(this, node.child1());
         int32_t imm = valueOfInt32Constant(node.child2().index());
-        addBranch(m_jit.branch32(condition, op1.gpr(), JITCompiler::Imm32(imm)), taken);
+        branch32(condition, op1.gpr(), JITCompiler::Imm32(imm), taken);
     } else {
         SpeculateIntegerOperand op1(this, node.child1());
         SpeculateIntegerOperand op2(this, node.child2());
-        addBranch(m_jit.branch32(condition, op1.gpr(), op2.gpr()), taken);
+        branch32(condition, op1.gpr(), op2.gpr(), taken);
     }
 
-    // Check for fall through, otherwise we need to jump.
-    if (notTaken != (m_block + 1))
-        addBranch(m_jit.jump(), notTaken);
+    jump(notTaken);
 }
 
 // Returns true if the compare is fused with a subsequent branch.
@@ -957,13 +952,20 @@ void SpeculativeJIT::compile(BasicBlock& block)
     
     m_lastSetOperand = std::numeric_limits<int>::max();
     m_codeOriginForOSR = CodeOrigin();
+    
+    if (DFG_ENABLE_EDGE_CODE_VERIFICATION) {
+        JITCompiler::Jump verificationSucceeded =
+            m_jit.branch32(JITCompiler::Equal, GPRInfo::regT0, Imm32(m_block));
+        m_jit.breakpoint();
+        verificationSucceeded.link(&m_jit);
+    }
 
     for (; m_compileIndex < block.end; ++m_compileIndex) {
         Node& node = at(m_compileIndex);
         m_codeOriginForOSR = node.codeOrigin;
         if (!node.shouldGenerate()) {
 #if DFG_ENABLE(DEBUG_VERBOSE)
-            fprintf(stderr, "SpeculativeJIT skipping Node @%d (bc#%u) at JIT offset 0x%x     ", (int)m_compileIndex, node.codeOrigin.bytecodeIndex, m_jit.debugOffset());
+            dataLog("SpeculativeJIT skipping Node @%d (bc#%u) at JIT offset 0x%x     ", (int)m_compileIndex, node.codeOrigin.bytecodeIndex, m_jit.debugOffset());
 #endif
             switch (node.op) {
             case SetLocal:
@@ -990,7 +992,7 @@ void SpeculativeJIT::compile(BasicBlock& block)
         } else {
             
 #if DFG_ENABLE(DEBUG_VERBOSE)
-            fprintf(stderr, "SpeculativeJIT generating Node @%d (bc#%u) at JIT offset 0x%x   ", (int)m_compileIndex, node.codeOrigin.bytecodeIndex, m_jit.debugOffset());
+            dataLog("SpeculativeJIT generating Node @%d (bc#%u) at JIT offset 0x%x   ", (int)m_compileIndex, node.codeOrigin.bytecodeIndex, m_jit.debugOffset());
 #endif
 #if DFG_ENABLE(JIT_BREAK_ON_EVERY_NODE)
             m_jit.breakpoint();
@@ -1011,20 +1013,20 @@ void SpeculativeJIT::compile(BasicBlock& block)
 #if DFG_ENABLE(DEBUG_VERBOSE)
             if (node.hasResult()) {
                 GenerationInfo& info = m_generationInfo[node.virtualRegister()];
-                fprintf(stderr, "-> %s, vr#%d", dataFormatToString(info.registerFormat()), (int)node.virtualRegister());
+                dataLog("-> %s, vr#%d", dataFormatToString(info.registerFormat()), (int)node.virtualRegister());
                 if (info.registerFormat() != DataFormatNone) {
                     if (info.registerFormat() == DataFormatDouble)
-                        fprintf(stderr, ", %s", FPRInfo::debugName(info.fpr()));
+                        dataLog(", %s", FPRInfo::debugName(info.fpr()));
 #if USE(JSVALUE32_64)
                     else if (info.registerFormat() & DataFormatJS)
-                        fprintf(stderr, ", %s %s", GPRInfo::debugName(info.tagGPR()), GPRInfo::debugName(info.payloadGPR()));
+                        dataLog(", %s %s", GPRInfo::debugName(info.tagGPR()), GPRInfo::debugName(info.payloadGPR()));
 #endif
                     else
-                        fprintf(stderr, ", %s", GPRInfo::debugName(info.gpr()));
+                        dataLog(", %s", GPRInfo::debugName(info.gpr()));
                 }
-                fprintf(stderr, "    ");
+                dataLog("    ");
             } else
-                fprintf(stderr, "    ");
+                dataLog("    ");
 #endif
         }
         
@@ -1032,14 +1034,14 @@ void SpeculativeJIT::compile(BasicBlock& block)
         for (size_t i = 0; i < m_arguments.size(); ++i)
             computeValueRecoveryFor(argumentToOperand(i)).dump(stderr);
         
-        fprintf(stderr, " : ");
+        dataLog(" : ");
         
         for (int operand = 0; operand < (int)m_variables.size(); ++operand)
             computeValueRecoveryFor(operand).dump(stderr);
 #endif
 
 #if DFG_ENABLE(DEBUG_VERBOSE)
-        fprintf(stderr, "\n");
+        dataLog("\n");
 #endif
         
         // Make sure that the abstract state is rematerialized for the next node.
@@ -1071,144 +1073,155 @@ void SpeculativeJIT::checkArgumentTypes()
         m_variables[i] = ValueSource(ValueInRegisterFile);
     
     for (int i = 0; i < m_jit.codeBlock()->numParameters(); ++i) {
-        VariableAccessData* variableAccessData = at(m_jit.graph().m_arguments[i]).variableAccessData();
+        NodeIndex nodeIndex = m_jit.graph().m_arguments[i];
+        Node& node = at(nodeIndex);
+        ASSERT(node.op == SetArgument);
+        if (!node.shouldGenerate()) {
+            // The argument is dead. We don't do any checks for such arguments.
+            continue;
+        }
+        
+        VariableAccessData* variableAccessData = node.variableAccessData();
         VirtualRegister virtualRegister = variableAccessData->local();
         PredictedType predictedType = variableAccessData->prediction();
+
+        JSValueSource valueSource = JSValueSource(JITCompiler::addressFor(virtualRegister));
+        
 #if USE(JSVALUE64)
         if (isInt32Prediction(predictedType))
-            speculationCheck(Uncountable, JSValueRegs(), NoNode, m_jit.branchPtr(MacroAssembler::Below, JITCompiler::addressFor(virtualRegister), GPRInfo::tagTypeNumberRegister));
+            speculationCheck(BadType, valueSource, nodeIndex, m_jit.branchPtr(MacroAssembler::Below, JITCompiler::addressFor(virtualRegister), GPRInfo::tagTypeNumberRegister));
         else if (isArrayPrediction(predictedType)) {
             GPRTemporary temp(this);
             m_jit.loadPtr(JITCompiler::addressFor(virtualRegister), temp.gpr());
-            speculationCheck(Uncountable, JSValueRegs(), NoNode, m_jit.branchTestPtr(MacroAssembler::NonZero, temp.gpr(), GPRInfo::tagMaskRegister));
-            speculationCheck(Uncountable, JSValueRegs(), NoNode, m_jit.branchPtr(MacroAssembler::NotEqual, MacroAssembler::Address(temp.gpr(), JSCell::classInfoOffset()), MacroAssembler::TrustedImmPtr(&JSArray::s_info)));
+            speculationCheck(BadType, valueSource, nodeIndex, m_jit.branchTestPtr(MacroAssembler::NonZero, temp.gpr(), GPRInfo::tagMaskRegister));
+            speculationCheck(BadType, valueSource, nodeIndex, m_jit.branchPtr(MacroAssembler::NotEqual, MacroAssembler::Address(temp.gpr(), JSCell::classInfoOffset()), MacroAssembler::TrustedImmPtr(&JSArray::s_info)));
         } else if (isByteArrayPrediction(predictedType)) {
             GPRTemporary temp(this);
             m_jit.loadPtr(JITCompiler::addressFor(virtualRegister), temp.gpr());
-            speculationCheck(Uncountable, JSValueRegs(), NoNode, m_jit.branchTestPtr(MacroAssembler::NonZero, temp.gpr(), GPRInfo::tagMaskRegister));
-            speculationCheck(Uncountable, JSValueRegs(), NoNode, m_jit.branchPtr(MacroAssembler::NotEqual, MacroAssembler::Address(temp.gpr(), JSCell::classInfoOffset()), MacroAssembler::TrustedImmPtr(&JSByteArray::s_info)));
+            speculationCheck(BadType, valueSource, nodeIndex, m_jit.branchTestPtr(MacroAssembler::NonZero, temp.gpr(), GPRInfo::tagMaskRegister));
+            speculationCheck(BadType, valueSource, nodeIndex, m_jit.branchPtr(MacroAssembler::NotEqual, MacroAssembler::Address(temp.gpr(), JSCell::classInfoOffset()), MacroAssembler::TrustedImmPtr(&JSByteArray::s_info)));
         } else if (isBooleanPrediction(predictedType)) {
             GPRTemporary temp(this);
             m_jit.loadPtr(JITCompiler::addressFor(virtualRegister), temp.gpr());
             m_jit.xorPtr(TrustedImm32(static_cast<int32_t>(ValueFalse)), temp.gpr());
-            speculationCheck(Uncountable, JSValueRegs(), NoNode, m_jit.branchTestPtr(MacroAssembler::NonZero, temp.gpr(), TrustedImm32(static_cast<int32_t>(~1))));
+            speculationCheck(BadType, valueSource, nodeIndex, m_jit.branchTestPtr(MacroAssembler::NonZero, temp.gpr(), TrustedImm32(static_cast<int32_t>(~1))));
         } else if (isInt8ArrayPrediction(predictedType)) {
             GPRTemporary temp(this);
             m_jit.loadPtr(JITCompiler::addressFor(virtualRegister), temp.gpr());
-            speculationCheck(Uncountable, JSValueRegs(), NoNode, m_jit.branchTestPtr(MacroAssembler::NonZero, temp.gpr(), GPRInfo::tagMaskRegister));
-            speculationCheck(Uncountable, JSValueRegs(), NoNode, m_jit.branchPtr(MacroAssembler::NotEqual, MacroAssembler::Address(temp.gpr(), JSCell::classInfoOffset()), MacroAssembler::TrustedImmPtr(m_jit.globalData()->int8ArrayDescriptor().m_classInfo)));
+            speculationCheck(BadType, valueSource, nodeIndex, m_jit.branchTestPtr(MacroAssembler::NonZero, temp.gpr(), GPRInfo::tagMaskRegister));
+            speculationCheck(BadType, valueSource, nodeIndex, m_jit.branchPtr(MacroAssembler::NotEqual, MacroAssembler::Address(temp.gpr(), JSCell::classInfoOffset()), MacroAssembler::TrustedImmPtr(m_jit.globalData()->int8ArrayDescriptor().m_classInfo)));
         } else if (isInt16ArrayPrediction(predictedType)) {
             GPRTemporary temp(this);
             m_jit.loadPtr(JITCompiler::addressFor(virtualRegister), temp.gpr());
-            speculationCheck(Uncountable, JSValueRegs(), NoNode, m_jit.branchTestPtr(MacroAssembler::NonZero, temp.gpr(), GPRInfo::tagMaskRegister));
-            speculationCheck(Uncountable, JSValueRegs(), NoNode, m_jit.branchPtr(MacroAssembler::NotEqual, MacroAssembler::Address(temp.gpr(), JSCell::classInfoOffset()), MacroAssembler::TrustedImmPtr(m_jit.globalData()->int16ArrayDescriptor().m_classInfo)));
+            speculationCheck(BadType, valueSource, nodeIndex, m_jit.branchTestPtr(MacroAssembler::NonZero, temp.gpr(), GPRInfo::tagMaskRegister));
+            speculationCheck(BadType, valueSource, nodeIndex, m_jit.branchPtr(MacroAssembler::NotEqual, MacroAssembler::Address(temp.gpr(), JSCell::classInfoOffset()), MacroAssembler::TrustedImmPtr(m_jit.globalData()->int16ArrayDescriptor().m_classInfo)));
         } else if (isInt32ArrayPrediction(predictedType)) {
             GPRTemporary temp(this);
             m_jit.loadPtr(JITCompiler::addressFor(virtualRegister), temp.gpr());
-            speculationCheck(Uncountable, JSValueRegs(), NoNode, m_jit.branchTestPtr(MacroAssembler::NonZero, temp.gpr(), GPRInfo::tagMaskRegister));
-            speculationCheck(Uncountable, JSValueRegs(), NoNode, m_jit.branchPtr(MacroAssembler::NotEqual, MacroAssembler::Address(temp.gpr(), JSCell::classInfoOffset()), MacroAssembler::TrustedImmPtr(m_jit.globalData()->int32ArrayDescriptor().m_classInfo)));
+            speculationCheck(BadType, valueSource, nodeIndex, m_jit.branchTestPtr(MacroAssembler::NonZero, temp.gpr(), GPRInfo::tagMaskRegister));
+            speculationCheck(BadType, valueSource, nodeIndex, m_jit.branchPtr(MacroAssembler::NotEqual, MacroAssembler::Address(temp.gpr(), JSCell::classInfoOffset()), MacroAssembler::TrustedImmPtr(m_jit.globalData()->int32ArrayDescriptor().m_classInfo)));
         } else if (isUint8ArrayPrediction(predictedType)) {
             GPRTemporary temp(this);
             m_jit.loadPtr(JITCompiler::addressFor(virtualRegister), temp.gpr());
-            speculationCheck(Uncountable, JSValueRegs(), NoNode, m_jit.branchTestPtr(MacroAssembler::NonZero, temp.gpr(), GPRInfo::tagMaskRegister));
-            speculationCheck(Uncountable, JSValueRegs(), NoNode, m_jit.branchPtr(MacroAssembler::NotEqual, MacroAssembler::Address(temp.gpr(), JSCell::classInfoOffset()), MacroAssembler::TrustedImmPtr(m_jit.globalData()->uint8ArrayDescriptor().m_classInfo)));
+            speculationCheck(BadType, valueSource, nodeIndex, m_jit.branchTestPtr(MacroAssembler::NonZero, temp.gpr(), GPRInfo::tagMaskRegister));
+            speculationCheck(BadType, valueSource, nodeIndex, m_jit.branchPtr(MacroAssembler::NotEqual, MacroAssembler::Address(temp.gpr(), JSCell::classInfoOffset()), MacroAssembler::TrustedImmPtr(m_jit.globalData()->uint8ArrayDescriptor().m_classInfo)));
         } else if (isUint8ClampedArrayPrediction(predictedType)) {
             GPRTemporary temp(this);
             m_jit.loadPtr(JITCompiler::addressFor(virtualRegister), temp.gpr());
-            speculationCheck(Uncountable, JSValueRegs(), NoNode, m_jit.branchTestPtr(MacroAssembler::NonZero, temp.gpr(), GPRInfo::tagMaskRegister));
-            speculationCheck(Uncountable, JSValueRegs(), NoNode, m_jit.branchPtr(MacroAssembler::NotEqual, MacroAssembler::Address(temp.gpr(), JSCell::classInfoOffset()), MacroAssembler::TrustedImmPtr(m_jit.globalData()->uint8ClampedArrayDescriptor().m_classInfo)));
+            speculationCheck(BadType, valueSource, nodeIndex, m_jit.branchTestPtr(MacroAssembler::NonZero, temp.gpr(), GPRInfo::tagMaskRegister));
+            speculationCheck(BadType, valueSource, nodeIndex, m_jit.branchPtr(MacroAssembler::NotEqual, MacroAssembler::Address(temp.gpr(), JSCell::classInfoOffset()), MacroAssembler::TrustedImmPtr(m_jit.globalData()->uint8ClampedArrayDescriptor().m_classInfo)));
         } else if (isUint16ArrayPrediction(predictedType)) {
             GPRTemporary temp(this);
             m_jit.loadPtr(JITCompiler::addressFor(virtualRegister), temp.gpr());
-            speculationCheck(Uncountable, JSValueRegs(), NoNode, m_jit.branchTestPtr(MacroAssembler::NonZero, temp.gpr(), GPRInfo::tagMaskRegister));
-            speculationCheck(Uncountable, JSValueRegs(), NoNode, m_jit.branchPtr(MacroAssembler::NotEqual, MacroAssembler::Address(temp.gpr(), JSCell::classInfoOffset()), MacroAssembler::TrustedImmPtr(m_jit.globalData()->uint16ArrayDescriptor().m_classInfo)));
+            speculationCheck(BadType, valueSource, nodeIndex, m_jit.branchTestPtr(MacroAssembler::NonZero, temp.gpr(), GPRInfo::tagMaskRegister));
+            speculationCheck(BadType, valueSource, nodeIndex, m_jit.branchPtr(MacroAssembler::NotEqual, MacroAssembler::Address(temp.gpr(), JSCell::classInfoOffset()), MacroAssembler::TrustedImmPtr(m_jit.globalData()->uint16ArrayDescriptor().m_classInfo)));
         } else if (isUint32ArrayPrediction(predictedType)) {
             GPRTemporary temp(this);
             m_jit.loadPtr(JITCompiler::addressFor(virtualRegister), temp.gpr());
-            speculationCheck(Uncountable, JSValueRegs(), NoNode, m_jit.branchTestPtr(MacroAssembler::NonZero, temp.gpr(), GPRInfo::tagMaskRegister));
-            speculationCheck(Uncountable, JSValueRegs(), NoNode, m_jit.branchPtr(MacroAssembler::NotEqual, MacroAssembler::Address(temp.gpr(), JSCell::classInfoOffset()), MacroAssembler::TrustedImmPtr(m_jit.globalData()->uint32ArrayDescriptor().m_classInfo)));
+            speculationCheck(BadType, valueSource, nodeIndex, m_jit.branchTestPtr(MacroAssembler::NonZero, temp.gpr(), GPRInfo::tagMaskRegister));
+            speculationCheck(BadType, valueSource, nodeIndex, m_jit.branchPtr(MacroAssembler::NotEqual, MacroAssembler::Address(temp.gpr(), JSCell::classInfoOffset()), MacroAssembler::TrustedImmPtr(m_jit.globalData()->uint32ArrayDescriptor().m_classInfo)));
         } else if (isFloat32ArrayPrediction(predictedType)) {
             GPRTemporary temp(this);
             m_jit.loadPtr(JITCompiler::addressFor(virtualRegister), temp.gpr());
-            speculationCheck(Uncountable, JSValueRegs(), NoNode, m_jit.branchTestPtr(MacroAssembler::NonZero, temp.gpr(), GPRInfo::tagMaskRegister));
-            speculationCheck(Uncountable, JSValueRegs(), NoNode, m_jit.branchPtr(MacroAssembler::NotEqual, MacroAssembler::Address(temp.gpr(), JSCell::classInfoOffset()), MacroAssembler::TrustedImmPtr(m_jit.globalData()->float32ArrayDescriptor().m_classInfo)));
+            speculationCheck(BadType, valueSource, nodeIndex, m_jit.branchTestPtr(MacroAssembler::NonZero, temp.gpr(), GPRInfo::tagMaskRegister));
+            speculationCheck(BadType, valueSource, nodeIndex, m_jit.branchPtr(MacroAssembler::NotEqual, MacroAssembler::Address(temp.gpr(), JSCell::classInfoOffset()), MacroAssembler::TrustedImmPtr(m_jit.globalData()->float32ArrayDescriptor().m_classInfo)));
         } else if (isFloat64ArrayPrediction(predictedType)) {
             GPRTemporary temp(this);
             m_jit.loadPtr(JITCompiler::addressFor(virtualRegister), temp.gpr());
-            speculationCheck(Uncountable, JSValueRegs(), NoNode, m_jit.branchTestPtr(MacroAssembler::NonZero, temp.gpr(), GPRInfo::tagMaskRegister));
-            speculationCheck(Uncountable, JSValueRegs(), NoNode, m_jit.branchPtr(MacroAssembler::NotEqual, MacroAssembler::Address(temp.gpr(), JSCell::classInfoOffset()), MacroAssembler::TrustedImmPtr(m_jit.globalData()->float64ArrayDescriptor().m_classInfo)));
+            speculationCheck(BadType, valueSource, nodeIndex, m_jit.branchTestPtr(MacroAssembler::NonZero, temp.gpr(), GPRInfo::tagMaskRegister));
+            speculationCheck(BadType, valueSource, nodeIndex, m_jit.branchPtr(MacroAssembler::NotEqual, MacroAssembler::Address(temp.gpr(), JSCell::classInfoOffset()), MacroAssembler::TrustedImmPtr(m_jit.globalData()->float64ArrayDescriptor().m_classInfo)));
         }
 #else
         if (isInt32Prediction(predictedType))
-            speculationCheck(Uncountable, JSValueRegs(), NoNode, m_jit.branch32(MacroAssembler::NotEqual, JITCompiler::tagFor(virtualRegister), TrustedImm32(JSValue::Int32Tag)));
+            speculationCheck(BadType, valueSource, nodeIndex, m_jit.branch32(MacroAssembler::NotEqual, JITCompiler::tagFor(virtualRegister), TrustedImm32(JSValue::Int32Tag)));
         else if (isArrayPrediction(predictedType)) {
             GPRTemporary temp(this);
             m_jit.load32(JITCompiler::tagFor(virtualRegister), temp.gpr());
-            speculationCheck(Uncountable, JSValueRegs(), NoNode, m_jit.branch32(MacroAssembler::NotEqual, temp.gpr(), TrustedImm32(JSValue::CellTag)));
+            speculationCheck(BadType, valueSource, nodeIndex, m_jit.branch32(MacroAssembler::NotEqual, temp.gpr(), TrustedImm32(JSValue::CellTag)));
             m_jit.load32(JITCompiler::payloadFor(virtualRegister), temp.gpr());
-            speculationCheck(Uncountable, JSValueRegs(), NoNode, m_jit.branchPtr(MacroAssembler::NotEqual, MacroAssembler::Address(temp.gpr(), JSCell::classInfoOffset()), MacroAssembler::TrustedImmPtr(&JSArray::s_info)));
+            speculationCheck(BadType, valueSource, nodeIndex, m_jit.branchPtr(MacroAssembler::NotEqual, MacroAssembler::Address(temp.gpr(), JSCell::classInfoOffset()), MacroAssembler::TrustedImmPtr(&JSArray::s_info)));
         } else if (isByteArrayPrediction(predictedType)) {
             GPRTemporary temp(this);
             m_jit.load32(JITCompiler::tagFor(virtualRegister), temp.gpr());
-            speculationCheck(Uncountable, JSValueRegs(), NoNode, m_jit.branch32(MacroAssembler::NotEqual, temp.gpr(), TrustedImm32(JSValue::CellTag)));
+            speculationCheck(BadType, valueSource, nodeIndex, m_jit.branch32(MacroAssembler::NotEqual, temp.gpr(), TrustedImm32(JSValue::CellTag)));
             m_jit.load32(JITCompiler::payloadFor(virtualRegister), temp.gpr());
-            speculationCheck(Uncountable, JSValueRegs(), NoNode, m_jit.branchPtr(MacroAssembler::NotEqual, MacroAssembler::Address(temp.gpr(), JSCell::classInfoOffset()), MacroAssembler::TrustedImmPtr(&JSByteArray::s_info)));
+            speculationCheck(BadType, valueSource, nodeIndex, m_jit.branchPtr(MacroAssembler::NotEqual, MacroAssembler::Address(temp.gpr(), JSCell::classInfoOffset()), MacroAssembler::TrustedImmPtr(&JSByteArray::s_info)));
         } else if (isBooleanPrediction(predictedType))
-            speculationCheck(Uncountable, JSValueRegs(), NoNode, m_jit.branch32(MacroAssembler::NotEqual, JITCompiler::tagFor(virtualRegister), TrustedImm32(JSValue::BooleanTag)));
+            speculationCheck(BadType, valueSource, nodeIndex, m_jit.branch32(MacroAssembler::NotEqual, JITCompiler::tagFor(virtualRegister), TrustedImm32(JSValue::BooleanTag)));
         else if (isInt8ArrayPrediction(predictedType)) {
             GPRTemporary temp(this);
             m_jit.load32(JITCompiler::tagFor(virtualRegister), temp.gpr());
-            speculationCheck(Uncountable, JSValueRegs(), NoNode, m_jit.branch32(MacroAssembler::NotEqual, temp.gpr(), TrustedImm32(JSValue::CellTag)));
+            speculationCheck(BadType, valueSource, nodeIndex, m_jit.branch32(MacroAssembler::NotEqual, temp.gpr(), TrustedImm32(JSValue::CellTag)));
             m_jit.load32(JITCompiler::payloadFor(virtualRegister), temp.gpr());
-            speculationCheck(Uncountable, JSValueRegs(), NoNode, m_jit.branchPtr(MacroAssembler::NotEqual, MacroAssembler::Address(temp.gpr(), JSCell::classInfoOffset()), MacroAssembler::TrustedImmPtr(m_jit.globalData()->int8ArrayDescriptor().m_classInfo)));
+            speculationCheck(BadType, valueSource, nodeIndex, m_jit.branchPtr(MacroAssembler::NotEqual, MacroAssembler::Address(temp.gpr(), JSCell::classInfoOffset()), MacroAssembler::TrustedImmPtr(m_jit.globalData()->int8ArrayDescriptor().m_classInfo)));
         } else if (isInt16ArrayPrediction(predictedType)) {
             GPRTemporary temp(this);
             m_jit.load32(JITCompiler::tagFor(virtualRegister), temp.gpr());
-            speculationCheck(Uncountable, JSValueRegs(), NoNode, m_jit.branch32(MacroAssembler::NotEqual, temp.gpr(), TrustedImm32(JSValue::CellTag)));
+            speculationCheck(BadType, valueSource, nodeIndex, m_jit.branch32(MacroAssembler::NotEqual, temp.gpr(), TrustedImm32(JSValue::CellTag)));
             m_jit.load32(JITCompiler::payloadFor(virtualRegister), temp.gpr());
-            speculationCheck(Uncountable, JSValueRegs(), NoNode, m_jit.branchPtr(MacroAssembler::NotEqual, MacroAssembler::Address(temp.gpr(), JSCell::classInfoOffset()), MacroAssembler::TrustedImmPtr(m_jit.globalData()->int16ArrayDescriptor().m_classInfo)));
+            speculationCheck(BadType, valueSource, nodeIndex, m_jit.branchPtr(MacroAssembler::NotEqual, MacroAssembler::Address(temp.gpr(), JSCell::classInfoOffset()), MacroAssembler::TrustedImmPtr(m_jit.globalData()->int16ArrayDescriptor().m_classInfo)));
         } else if (isInt32ArrayPrediction(predictedType)) {
             GPRTemporary temp(this);
             m_jit.load32(JITCompiler::tagFor(virtualRegister), temp.gpr());
-            speculationCheck(Uncountable, JSValueRegs(), NoNode, m_jit.branch32(MacroAssembler::NotEqual, temp.gpr(), TrustedImm32(JSValue::CellTag)));
+            speculationCheck(BadType, valueSource, nodeIndex, m_jit.branch32(MacroAssembler::NotEqual, temp.gpr(), TrustedImm32(JSValue::CellTag)));
             m_jit.load32(JITCompiler::payloadFor(virtualRegister), temp.gpr());
-            speculationCheck(Uncountable, JSValueRegs(), NoNode, m_jit.branchPtr(MacroAssembler::NotEqual, MacroAssembler::Address(temp.gpr(), JSCell::classInfoOffset()), MacroAssembler::TrustedImmPtr(m_jit.globalData()->int32ArrayDescriptor().m_classInfo)));
+            speculationCheck(BadType, valueSource, nodeIndex, m_jit.branchPtr(MacroAssembler::NotEqual, MacroAssembler::Address(temp.gpr(), JSCell::classInfoOffset()), MacroAssembler::TrustedImmPtr(m_jit.globalData()->int32ArrayDescriptor().m_classInfo)));
         } else if (isUint8ArrayPrediction(predictedType)) {
             GPRTemporary temp(this);
             m_jit.load32(JITCompiler::tagFor(virtualRegister), temp.gpr());
-            speculationCheck(Uncountable, JSValueRegs(), NoNode, m_jit.branch32(MacroAssembler::NotEqual, temp.gpr(), TrustedImm32(JSValue::CellTag)));
+            speculationCheck(BadType, valueSource, nodeIndex, m_jit.branch32(MacroAssembler::NotEqual, temp.gpr(), TrustedImm32(JSValue::CellTag)));
             m_jit.load32(JITCompiler::payloadFor(virtualRegister), temp.gpr());
-            speculationCheck(Uncountable, JSValueRegs(), NoNode, m_jit.branchPtr(MacroAssembler::NotEqual, MacroAssembler::Address(temp.gpr(), JSCell::classInfoOffset()), MacroAssembler::TrustedImmPtr(m_jit.globalData()->uint8ArrayDescriptor().m_classInfo)));
+            speculationCheck(BadType, valueSource, nodeIndex, m_jit.branchPtr(MacroAssembler::NotEqual, MacroAssembler::Address(temp.gpr(), JSCell::classInfoOffset()), MacroAssembler::TrustedImmPtr(m_jit.globalData()->uint8ArrayDescriptor().m_classInfo)));
         } else if (isUint8ClampedArrayPrediction(predictedType)) {
             GPRTemporary temp(this);
             m_jit.load32(JITCompiler::tagFor(virtualRegister), temp.gpr());
-            speculationCheck(Uncountable, JSValueRegs(), NoNode, m_jit.branch32(MacroAssembler::NotEqual, temp.gpr(), TrustedImm32(JSValue::CellTag)));
+            speculationCheck(BadType, valueSource, nodeIndex, m_jit.branch32(MacroAssembler::NotEqual, temp.gpr(), TrustedImm32(JSValue::CellTag)));
             m_jit.load32(JITCompiler::payloadFor(virtualRegister), temp.gpr());
-            speculationCheck(Uncountable, JSValueRegs(), NoNode, m_jit.branchPtr(MacroAssembler::NotEqual, MacroAssembler::Address(temp.gpr(), JSCell::classInfoOffset()), MacroAssembler::TrustedImmPtr(m_jit.globalData()->uint8ClampedArrayDescriptor().m_classInfo)));
+            speculationCheck(BadType, valueSource, nodeIndex, m_jit.branchPtr(MacroAssembler::NotEqual, MacroAssembler::Address(temp.gpr(), JSCell::classInfoOffset()), MacroAssembler::TrustedImmPtr(m_jit.globalData()->uint8ClampedArrayDescriptor().m_classInfo)));
         } else if (isUint16ArrayPrediction(predictedType)) {
             GPRTemporary temp(this);
             m_jit.load32(JITCompiler::tagFor(virtualRegister), temp.gpr());
-            speculationCheck(Uncountable, JSValueRegs(), NoNode, m_jit.branch32(MacroAssembler::NotEqual, temp.gpr(), TrustedImm32(JSValue::CellTag)));
+            speculationCheck(BadType, valueSource, nodeIndex, m_jit.branch32(MacroAssembler::NotEqual, temp.gpr(), TrustedImm32(JSValue::CellTag)));
             m_jit.load32(JITCompiler::payloadFor(virtualRegister), temp.gpr());
-            speculationCheck(Uncountable, JSValueRegs(), NoNode, m_jit.branchPtr(MacroAssembler::NotEqual, MacroAssembler::Address(temp.gpr(), JSCell::classInfoOffset()), MacroAssembler::TrustedImmPtr(m_jit.globalData()->uint16ArrayDescriptor().m_classInfo)));
+            speculationCheck(BadType, valueSource, nodeIndex, m_jit.branchPtr(MacroAssembler::NotEqual, MacroAssembler::Address(temp.gpr(), JSCell::classInfoOffset()), MacroAssembler::TrustedImmPtr(m_jit.globalData()->uint16ArrayDescriptor().m_classInfo)));
         }  else if (isUint32ArrayPrediction(predictedType)) {
             GPRTemporary temp(this);
             m_jit.load32(JITCompiler::tagFor(virtualRegister), temp.gpr());
-            speculationCheck(Uncountable, JSValueRegs(), NoNode, m_jit.branch32(MacroAssembler::NotEqual, temp.gpr(), TrustedImm32(JSValue::CellTag)));
+            speculationCheck(BadType, valueSource, nodeIndex, m_jit.branch32(MacroAssembler::NotEqual, temp.gpr(), TrustedImm32(JSValue::CellTag)));
             m_jit.load32(JITCompiler::payloadFor(virtualRegister), temp.gpr());
-            speculationCheck(Uncountable, JSValueRegs(), NoNode, m_jit.branchPtr(MacroAssembler::NotEqual, MacroAssembler::Address(temp.gpr(), JSCell::classInfoOffset()), MacroAssembler::TrustedImmPtr(m_jit.globalData()->uint32ArrayDescriptor().m_classInfo)));
+            speculationCheck(BadType, valueSource, nodeIndex, m_jit.branchPtr(MacroAssembler::NotEqual, MacroAssembler::Address(temp.gpr(), JSCell::classInfoOffset()), MacroAssembler::TrustedImmPtr(m_jit.globalData()->uint32ArrayDescriptor().m_classInfo)));
         }  else if (isFloat32ArrayPrediction(predictedType)) {
             GPRTemporary temp(this);
             m_jit.load32(JITCompiler::tagFor(virtualRegister), temp.gpr());
-            speculationCheck(Uncountable, JSValueRegs(), NoNode, m_jit.branch32(MacroAssembler::NotEqual, temp.gpr(), TrustedImm32(JSValue::CellTag)));
+            speculationCheck(BadType, valueSource, nodeIndex, m_jit.branch32(MacroAssembler::NotEqual, temp.gpr(), TrustedImm32(JSValue::CellTag)));
             m_jit.load32(JITCompiler::payloadFor(virtualRegister), temp.gpr());
-            speculationCheck(Uncountable, JSValueRegs(), NoNode, m_jit.branchPtr(MacroAssembler::NotEqual, MacroAssembler::Address(temp.gpr(), JSCell::classInfoOffset()), MacroAssembler::TrustedImmPtr(m_jit.globalData()->float32ArrayDescriptor().m_classInfo)));
+            speculationCheck(BadType, valueSource, nodeIndex, m_jit.branchPtr(MacroAssembler::NotEqual, MacroAssembler::Address(temp.gpr(), JSCell::classInfoOffset()), MacroAssembler::TrustedImmPtr(m_jit.globalData()->float32ArrayDescriptor().m_classInfo)));
         }   else if (isFloat64ArrayPrediction(predictedType)) {
             GPRTemporary temp(this);
             m_jit.load32(JITCompiler::tagFor(virtualRegister), temp.gpr());
-            speculationCheck(Uncountable, JSValueRegs(), NoNode, m_jit.branch32(MacroAssembler::NotEqual, temp.gpr(), TrustedImm32(JSValue::CellTag)));
+            speculationCheck(BadType, valueSource, nodeIndex, m_jit.branch32(MacroAssembler::NotEqual, temp.gpr(), TrustedImm32(JSValue::CellTag)));
             m_jit.load32(JITCompiler::payloadFor(virtualRegister), temp.gpr());
-            speculationCheck(Uncountable, JSValueRegs(), NoNode, m_jit.branchPtr(MacroAssembler::NotEqual, MacroAssembler::Address(temp.gpr(), JSCell::classInfoOffset()), MacroAssembler::TrustedImmPtr(m_jit.globalData()->float64ArrayDescriptor().m_classInfo)));
+            speculationCheck(BadType, valueSource, nodeIndex, m_jit.branchPtr(MacroAssembler::NotEqual, MacroAssembler::Address(temp.gpr(), JSCell::classInfoOffset()), MacroAssembler::TrustedImmPtr(m_jit.globalData()->float64ArrayDescriptor().m_classInfo)));
         } 
 #endif
     }
@@ -1218,6 +1231,9 @@ bool SpeculativeJIT::compile()
 {
     checkArgumentTypes();
 
+    if (DFG_ENABLE_EDGE_CODE_VERIFICATION)
+        m_jit.move(Imm32(0), GPRInfo::regT0);
+
     ASSERT(!m_compileIndex);
     for (m_block = 0; m_block < m_jit.graph().m_blocks.size(); ++m_block)
         compile(*m_jit.graph().m_blocks[m_block]);
@@ -1225,13 +1241,37 @@ bool SpeculativeJIT::compile()
     return true;
 }
 
+void SpeculativeJIT::createOSREntries()
+{
+    for (BlockIndex blockIndex = 0; blockIndex < m_jit.graph().m_blocks.size(); ++blockIndex) {
+        BasicBlock& block = *m_jit.graph().m_blocks[blockIndex];
+        if (!block.isOSRTarget)
+            continue;
+
+        // Currently we only need to create OSR entry trampolines when using edge code
+        // verification. But in the future, we'll need this for other things as well (like
+        // when we have global reg alloc).
+        // If we don't need OSR entry trampolin
+        if (!DFG_ENABLE_EDGE_CODE_VERIFICATION) {
+            m_osrEntryHeads.append(m_blockHeads[blockIndex]);
+            continue;
+        }
+        
+        m_osrEntryHeads.append(m_jit.label());
+        m_jit.move(Imm32(blockIndex), GPRInfo::regT0);
+        m_jit.jump().linkTo(m_blockHeads[blockIndex], &m_jit);
+    }
+}
+
 void SpeculativeJIT::linkOSREntries(LinkBuffer& linkBuffer)
 {
+    unsigned osrEntryIndex = 0;
     for (BlockIndex blockIndex = 0; blockIndex < m_jit.graph().m_blocks.size(); ++blockIndex) {
         BasicBlock& block = *m_jit.graph().m_blocks[blockIndex];
         if (block.isOSRTarget)
-            m_jit.noticeOSREntry(block, m_blockHeads[blockIndex], linkBuffer);
+            m_jit.noticeOSREntry(block, m_osrEntryHeads[osrEntryIndex++], linkBuffer);
     }
+    ASSERT(osrEntryIndex == m_osrEntryHeads.size());
 }
 
 ValueRecovery SpeculativeJIT::computeValueRecoveryFor(const ValueSource& valueSource)
@@ -1253,8 +1293,8 @@ ValueRecovery SpeculativeJIT::computeValueRecoveryFor(const ValueSource& valueSo
         return ValueRecovery::alreadyInRegisterFileAsUnboxedDouble();
 
     case HaveNode: {
-        if (m_jit.isConstant(valueSource.nodeIndex()))
-            return ValueRecovery::constant(m_jit.valueOfJSConstant(valueSource.nodeIndex()));
+        if (isConstant(valueSource.nodeIndex()))
+            return ValueRecovery::constant(valueOfJSConstant(valueSource.nodeIndex()));
     
         Node* nodePtr = &at(valueSource.nodeIndex());
         if (!nodePtr->shouldGenerate()) {
@@ -2184,7 +2224,7 @@ void SpeculativeJIT::compileSoftModulo(Node& node)
 
 void SpeculativeJIT::compileAdd(Node& node)
 {
-    if (m_jit.graph().addShouldSpeculateInteger(node, m_jit.codeBlock())) {
+    if (m_jit.graph().addShouldSpeculateInteger(node)) {
         if (isNumberConstant(node.child1().index())) {
             int32_t imm1 = valueOfNumberConstantAsInt32(node.child1().index());
             SpeculateIntegerOperand op2(this, node.child2());
@@ -2258,13 +2298,18 @@ void SpeculativeJIT::compileAdd(Node& node)
         return;
     }
 
-    ASSERT(node.op == ValueAdd);
-    compileValueAdd(node);
+    if (node.op == ValueAdd) {
+        compileValueAdd(node);
+        return;
+    }
+    
+    // We don't handle this yet. :-(
+    terminateSpeculativeExecution(Uncountable, JSValueRegs(), NoNode);
 }
 
 void SpeculativeJIT::compileArithSub(Node& node)
 {
-    if (m_jit.graph().addShouldSpeculateInteger(node, m_jit.codeBlock())) {
+    if (m_jit.graph().addShouldSpeculateInteger(node)) {
         if (isNumberConstant(node.child2().index())) {
             SpeculateIntegerOperand op1(this, node.child1());
             int32_t imm2 = valueOfNumberConstantAsInt32(node.child2().index());
@@ -2428,24 +2473,23 @@ bool SpeculativeJIT::compileStrictEqForConstant(Node& node, NodeUse value, JSVal
         }
 
 #if USE(JSVALUE64)
-        addBranch(m_jit.branchPtr(condition, op1.gpr(), MacroAssembler::TrustedImmPtr(bitwise_cast<void*>(JSValue::encode(constant)))), taken);
+        branchPtr(condition, op1.gpr(), MacroAssembler::TrustedImmPtr(bitwise_cast<void*>(JSValue::encode(constant))), taken);
 #else
         GPRReg payloadGPR = op1.payloadGPR();
         GPRReg tagGPR = op1.tagGPR();
         if (condition == MacroAssembler::Equal) {
             // Drop down if not equal, go elsewhere if equal.
             MacroAssembler::Jump notEqual = m_jit.branch32(MacroAssembler::NotEqual, tagGPR, MacroAssembler::Imm32(constant.tag()));
-            addBranch(m_jit.branch32(MacroAssembler::Equal, payloadGPR, MacroAssembler::Imm32(constant.payload())), taken);
+            branch32(MacroAssembler::Equal, payloadGPR, MacroAssembler::Imm32(constant.payload()), taken);
             notEqual.link(&m_jit);
         } else {
             // Drop down if equal, go elsehwere if not equal.
-            addBranch(m_jit.branch32(MacroAssembler::NotEqual, tagGPR, MacroAssembler::Imm32(constant.tag())), taken);
-            addBranch(m_jit.branch32(MacroAssembler::NotEqual, payloadGPR, MacroAssembler::Imm32(constant.payload())), taken);
+            branch32(MacroAssembler::NotEqual, tagGPR, MacroAssembler::Imm32(constant.tag()), taken);
+            branch32(MacroAssembler::NotEqual, payloadGPR, MacroAssembler::Imm32(constant.payload()), taken);
         }
 #endif
         
-        if (notTaken != (m_block + 1))
-            addBranch(m_jit.jump(), notTaken);
+        jump(notTaken);
         
         use(node.child1());
         use(node.child2());
diff --git a/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h b/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h
index cfb2189cf..5d95b064f 100644
--- a/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h
+++ b/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h
@@ -176,6 +176,7 @@ public:
     SpeculativeJIT(JITCompiler&);
 
     bool compile();
+    void createOSREntries();
     void linkOSREntries(LinkBuffer&);
 
     Node& at(NodeIndex nodeIndex)
@@ -462,7 +463,7 @@ private:
 
         if (registerFormat == DataFormatCell) {
             ASSERT(info.gpr() == target);
-            if (node.isConstant()) {
+            if (node.hasConstant()) {
                 JSValue value = valueOfJSConstant(nodeIndex);
                 ASSERT(value.isCell());
                 m_jit.move(ImmPtr(value.asCell()), target);
@@ -734,15 +735,15 @@ private:
     bool isKnownNotCell(NodeIndex);
     
     // Checks/accessors for constant values.
-    bool isConstant(NodeIndex nodeIndex) { return m_jit.isConstant(nodeIndex); }
-    bool isJSConstant(NodeIndex nodeIndex) { return m_jit.isJSConstant(nodeIndex); }
-    bool isInt32Constant(NodeIndex nodeIndex) { return m_jit.isInt32Constant(nodeIndex); }
-    bool isDoubleConstant(NodeIndex nodeIndex) { return m_jit.isDoubleConstant(nodeIndex); }
-    bool isNumberConstant(NodeIndex nodeIndex) { return m_jit.isNumberConstant(nodeIndex); }
-    bool isBooleanConstant(NodeIndex nodeIndex) { return m_jit.isBooleanConstant(nodeIndex); }
-    bool isFunctionConstant(NodeIndex nodeIndex) { return m_jit.isFunctionConstant(nodeIndex); }
-    int32_t valueOfInt32Constant(NodeIndex nodeIndex) { return m_jit.valueOfInt32Constant(nodeIndex); }
-    double valueOfNumberConstant(NodeIndex nodeIndex) { return m_jit.valueOfNumberConstant(nodeIndex); }
+    bool isConstant(NodeIndex nodeIndex) { return m_jit.graph().isConstant(nodeIndex); }
+    bool isJSConstant(NodeIndex nodeIndex) { return m_jit.graph().isJSConstant(nodeIndex); }
+    bool isInt32Constant(NodeIndex nodeIndex) { return m_jit.graph().isInt32Constant(nodeIndex); }
+    bool isDoubleConstant(NodeIndex nodeIndex) { return m_jit.graph().isDoubleConstant(nodeIndex); }
+    bool isNumberConstant(NodeIndex nodeIndex) { return m_jit.graph().isNumberConstant(nodeIndex); }
+    bool isBooleanConstant(NodeIndex nodeIndex) { return m_jit.graph().isBooleanConstant(nodeIndex); }
+    bool isFunctionConstant(NodeIndex nodeIndex) { return m_jit.graph().isFunctionConstant(nodeIndex); }
+    int32_t valueOfInt32Constant(NodeIndex nodeIndex) { return m_jit.graph().valueOfInt32Constant(nodeIndex); }
+    double valueOfNumberConstant(NodeIndex nodeIndex) { return m_jit.graph().valueOfNumberConstant(nodeIndex); }
     int32_t valueOfNumberConstantAsInt32(NodeIndex nodeIndex)
     {
         if (isInt32Constant(nodeIndex))
@@ -752,9 +753,9 @@ private:
 #if USE(JSVALUE32_64)
     void* addressOfDoubleConstant(NodeIndex nodeIndex) { return m_jit.addressOfDoubleConstant(nodeIndex); }
 #endif
-    JSValue valueOfJSConstant(NodeIndex nodeIndex) { return m_jit.valueOfJSConstant(nodeIndex); }
-    bool valueOfBooleanConstant(NodeIndex nodeIndex) { return m_jit.valueOfBooleanConstant(nodeIndex); }
-    JSFunction* valueOfFunctionConstant(NodeIndex nodeIndex) { return m_jit.valueOfFunctionConstant(nodeIndex); }
+    JSValue valueOfJSConstant(NodeIndex nodeIndex) { return m_jit.graph().valueOfJSConstant(nodeIndex); }
+    bool valueOfBooleanConstant(NodeIndex nodeIndex) { return m_jit.graph().valueOfBooleanConstant(nodeIndex); }
+    JSFunction* valueOfFunctionConstant(NodeIndex nodeIndex) { return m_jit.graph().valueOfFunctionConstant(nodeIndex); }
     bool isNullConstant(NodeIndex nodeIndex)
     {
         if (!isConstant(nodeIndex))
@@ -1407,7 +1408,7 @@ private:
     JITCompiler::Call appendCallWithExceptionCheck(const FunctionPtr& function)
     {
         CodeOrigin codeOrigin = at(m_compileIndex).codeOrigin;
-        CallBeginToken token = m_jit.beginCall(codeOrigin);
+        CallBeginToken token = m_jit.beginCall();
         JITCompiler::Call call = m_jit.appendCall(function);
         m_jit.addExceptionCheck(call, codeOrigin, token);
         return call;
@@ -1466,6 +1467,161 @@ private:
         return call;
     }
 #endif
+    
+    void branchDouble(JITCompiler::DoubleCondition cond, FPRReg left, FPRReg right, BlockIndex destination)
+    {
+        if (!haveEdgeCodeToEmit(destination))
+            return addBranch(m_jit.branchDouble(cond, left, right), destination);
+        
+        JITCompiler::Jump notTaken = m_jit.branchDouble(JITCompiler::invert(cond), left, right);
+        emitEdgeCode(destination);
+        addBranch(m_jit.jump(), destination);
+        notTaken.link(&m_jit);
+    }
+    
+    void branchDoubleNonZero(FPRReg value, FPRReg scratch, BlockIndex destination)
+    {
+        if (!haveEdgeCodeToEmit(destination))
+            return addBranch(m_jit.branchDoubleNonZero(value, scratch), destination);
+        
+        JITCompiler::Jump notTaken = m_jit.branchDoubleZeroOrNaN(value, scratch);
+        emitEdgeCode(destination);
+        addBranch(m_jit.jump(), destination);
+        notTaken.link(&m_jit);
+    }
+    
+    template<typename T, typename U>
+    void branch32(JITCompiler::RelationalCondition cond, T left, U right, BlockIndex destination)
+    {
+        if (!haveEdgeCodeToEmit(destination))
+            return addBranch(m_jit.branch32(cond, left, right), destination);
+        
+        JITCompiler::Jump notTaken = m_jit.branch32(JITCompiler::invert(cond), left, right);
+        emitEdgeCode(destination);
+        addBranch(m_jit.jump(), destination);
+        notTaken.link(&m_jit);
+    }
+    
+    template<typename T, typename U>
+    void branchTest32(JITCompiler::ResultCondition cond, T value, U mask, BlockIndex destination)
+    {
+        ASSERT(JITCompiler::isInvertible(cond));
+        
+        if (!haveEdgeCodeToEmit(destination))
+            return addBranch(m_jit.branchTest32(cond, value, mask), destination);
+        
+        JITCompiler::Jump notTaken = m_jit.branchTest32(JITCompiler::invert(cond), value, mask);
+        emitEdgeCode(destination);
+        addBranch(m_jit.jump(), destination);
+        notTaken.link(&m_jit);
+    }
+    
+    template<typename T>
+    void branchTest32(JITCompiler::ResultCondition cond, T value, BlockIndex destination)
+    {
+        ASSERT(JITCompiler::isInvertible(cond));
+        
+        if (!haveEdgeCodeToEmit(destination))
+            return addBranch(m_jit.branchTest32(cond, value), destination);
+        
+        JITCompiler::Jump notTaken = m_jit.branchTest32(JITCompiler::invert(cond), value);
+        emitEdgeCode(destination);
+        addBranch(m_jit.jump(), destination);
+        notTaken.link(&m_jit);
+    }
+    
+    template<typename T, typename U>
+    void branchPtr(JITCompiler::RelationalCondition cond, T left, U right, BlockIndex destination)
+    {
+        if (!haveEdgeCodeToEmit(destination))
+            return addBranch(m_jit.branchPtr(cond, left, right), destination);
+        
+        JITCompiler::Jump notTaken = m_jit.branchPtr(JITCompiler::invert(cond), left, right);
+        emitEdgeCode(destination);
+        addBranch(m_jit.jump(), destination);
+        notTaken.link(&m_jit);
+    }
+    
+    template<typename T, typename U>
+    void branchTestPtr(JITCompiler::ResultCondition cond, T value, U mask, BlockIndex destination)
+    {
+        ASSERT(JITCompiler::isInvertible(cond));
+        
+        if (!haveEdgeCodeToEmit(destination))
+            return addBranch(m_jit.branchTestPtr(cond, value, mask), destination);
+        
+        JITCompiler::Jump notTaken = m_jit.branchTestPtr(JITCompiler::invert(cond), value, mask);
+        emitEdgeCode(destination);
+        addBranch(m_jit.jump(), destination);
+        notTaken.link(&m_jit);
+    }
+    
+    template<typename T>
+    void branchTestPtr(JITCompiler::ResultCondition cond, T value, BlockIndex destination)
+    {
+        ASSERT(JITCompiler::isInvertible(cond));
+        
+        if (!haveEdgeCodeToEmit(destination))
+            return addBranch(m_jit.branchTestPtr(cond, value), destination);
+        
+        JITCompiler::Jump notTaken = m_jit.branchTestPtr(JITCompiler::invert(cond), value);
+        emitEdgeCode(destination);
+        addBranch(m_jit.jump(), destination);
+        notTaken.link(&m_jit);
+    }
+    
+    template<typename T, typename U>
+    void branchTest8(JITCompiler::ResultCondition cond, T value, U mask, BlockIndex destination)
+    {
+        ASSERT(JITCompiler::isInvertible(cond));
+        
+        if (!haveEdgeCodeToEmit(destination))
+            return addBranch(m_jit.branchTest8(cond, value, mask), destination);
+        
+        JITCompiler::Jump notTaken = m_jit.branchTest8(JITCompiler::invert(cond), value, mask);
+        emitEdgeCode(destination);
+        addBranch(m_jit.jump(), destination);
+        notTaken.link(&m_jit);
+    }
+    
+    template<typename T>
+    void branchTest8(JITCompiler::ResultCondition cond, T value, BlockIndex destination)
+    {
+        ASSERT(JITCompiler::isInvertible(cond));
+        
+        if (!haveEdgeCodeToEmit(destination))
+            return addBranch(m_jit.branchTest8(cond, value), destination);
+        
+        JITCompiler::Jump notTaken = m_jit.branchTest8(JITCompiler::invert(cond), value);
+        emitEdgeCode(destination);
+        addBranch(m_jit.jump(), destination);
+        notTaken.link(&m_jit);
+    }
+    
+    enum FallThroughMode {
+        AtFallThroughPoint,
+        ForceJump
+    };
+    void jump(BlockIndex destination, FallThroughMode fallThroughMode = AtFallThroughPoint)
+    {
+        if (haveEdgeCodeToEmit(destination))
+            emitEdgeCode(destination);
+        if (destination == m_block + 1
+            && fallThroughMode == AtFallThroughPoint)
+            return;
+        addBranch(m_jit.jump(), destination);
+    }
+    
+    inline bool haveEdgeCodeToEmit(BlockIndex)
+    {
+        return DFG_ENABLE_EDGE_CODE_VERIFICATION;
+    }
+    void emitEdgeCode(BlockIndex destination)
+    {
+        if (!DFG_ENABLE_EDGE_CODE_VERIFICATION)
+            return;
+        m_jit.move(Imm32(destination), GPRInfo::regT0);
+    }
 
     void addBranch(const MacroAssembler::Jump& jump, BlockIndex destination)
     {
@@ -1565,7 +1721,7 @@ private:
     template<typename T>
     void emitAllocateJSFinalObject(T structure, GPRReg resultGPR, GPRReg scratchGPR, MacroAssembler::JumpList& slowPath)
     {
-        MarkedAllocator* allocator = &m_jit.globalData()->heap.allocatorForObject(sizeof(JSFinalObject));
+        MarkedAllocator* allocator = &m_jit.globalData()->heap.allocatorForObjectWithoutDestructor(sizeof(JSFinalObject));
         
         m_jit.loadPtr(&allocator->m_firstFreeCell, resultGPR);
         slowPath.append(m_jit.branchTestPtr(MacroAssembler::Zero, resultGPR));
@@ -1603,7 +1759,7 @@ private:
     {
         if (!m_compileOkay)
             return;
-        m_jit.codeBlock()->appendOSRExit(OSRExit(kind, jsValueSource, m_jit.valueProfileFor(nodeIndex), jumpToFail, this));
+        m_jit.codeBlock()->appendOSRExit(OSRExit(kind, jsValueSource, m_jit.graph().methodOfGettingAValueProfileFor(nodeIndex), jumpToFail, this));
     }
     void speculationCheck(ExitKind kind, JSValueSource jsValueSource, NodeUse nodeUse, MacroAssembler::Jump jumpToFail)
     {
@@ -1626,7 +1782,7 @@ private:
         if (!m_compileOkay)
             return;
         m_jit.codeBlock()->appendSpeculationRecovery(recovery);
-        m_jit.codeBlock()->appendOSRExit(OSRExit(kind, jsValueSource, m_jit.valueProfileFor(nodeIndex), jumpToFail, this, m_jit.codeBlock()->numberOfSpeculationRecoveries()));
+        m_jit.codeBlock()->appendOSRExit(OSRExit(kind, jsValueSource, m_jit.graph().methodOfGettingAValueProfileFor(nodeIndex), jumpToFail, this, m_jit.codeBlock()->numberOfSpeculationRecoveries()));
     }
     void speculationCheck(ExitKind kind, JSValueSource jsValueSource, NodeUse nodeUse, MacroAssembler::Jump jumpToFail, const SpeculationRecovery& recovery)
     {
@@ -1637,7 +1793,7 @@ private:
     void terminateSpeculativeExecution(ExitKind kind, JSValueRegs jsValueRegs, NodeIndex nodeIndex)
     {
 #if DFG_ENABLE(DEBUG_VERBOSE)
-        fprintf(stderr, "SpeculativeJIT was terminated.\n");
+        dataLog("SpeculativeJIT was terminated.\n");
 #endif
         if (!m_compileOkay)
             return;
@@ -1699,6 +1855,8 @@ private:
     RegisterBank<FPRInfo> m_fprs;
 
     Vector<MacroAssembler::Label> m_blockHeads;
+    Vector<MacroAssembler::Label> m_osrEntryHeads;
+    
     struct BranchRecord {
         BranchRecord(MacroAssembler::Jump jump, BlockIndex destination)
             : jump(jump)
@@ -2329,7 +2487,7 @@ inline SpeculativeJIT::SpeculativeJIT(JITCompiler& jit)
     , m_arguments(jit.codeBlock()->numParameters())
     , m_variables(jit.graph().m_localVars)
     , m_lastSetOperand(std::numeric_limits<int>::max())
-    , m_state(m_jit.codeBlock(), m_jit.graph())
+    , m_state(m_jit.graph())
 {
 }
 
diff --git a/Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp b/Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp
index a2cdec086..8c4d8c030 100644
--- a/Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp
+++ b/Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp
@@ -634,21 +634,20 @@ void SpeculativeJIT::nonSpeculativePeepholeBranchNull(NodeUse operand, NodeIndex
         notCell = m_jit.branch32(MacroAssembler::NotEqual, argTagGPR, TrustedImm32(JSValue::CellTag));
     
     m_jit.loadPtr(JITCompiler::Address(argPayloadGPR, JSCell::structureOffset()), resultGPR);
-    addBranch(m_jit.branchTest8(invert ? JITCompiler::Zero : JITCompiler::NonZero, JITCompiler::Address(resultGPR, Structure::typeInfoFlagsOffset()), JITCompiler::TrustedImm32(MasqueradesAsUndefined)), taken);
+    branchTest8(invert ? JITCompiler::Zero : JITCompiler::NonZero, JITCompiler::Address(resultGPR, Structure::typeInfoFlagsOffset()), JITCompiler::TrustedImm32(MasqueradesAsUndefined), taken);
     
     if (!isKnownCell(operand.index())) {
-        addBranch(m_jit.jump(), notTaken);
+        jump(notTaken, ForceJump);
         
         notCell.link(&m_jit);
         // null or undefined?
         COMPILE_ASSERT((JSValue::UndefinedTag | 1) == JSValue::NullTag, UndefinedTag_OR_1_EQUALS_NullTag);
         m_jit.move(argTagGPR, resultGPR);
         m_jit.or32(TrustedImm32(1), resultGPR);
-        addBranch(m_jit.branch32(invert ? JITCompiler::NotEqual : JITCompiler::Equal, resultGPR, JITCompiler::TrustedImm32(JSValue::NullTag)), taken);
+        branch32(invert ? JITCompiler::NotEqual : JITCompiler::Equal, resultGPR, JITCompiler::TrustedImm32(JSValue::NullTag), taken);
     }
     
-    if (notTaken != (m_block + 1))
-        addBranch(m_jit.jump(), notTaken);
+    jump(notTaken);
 }
 
 bool SpeculativeJIT::nonSpeculativeCompareNull(Node& node, NodeUse operand, bool invert)
@@ -708,7 +707,7 @@ void SpeculativeJIT::nonSpeculativePeepholeBranch(Node& node, NodeIndex branchNo
         flushRegisters();
         callOperation(helperFunction, resultGPR, arg1TagGPR, arg1PayloadGPR, arg2TagGPR, arg2PayloadGPR);
 
-        addBranch(m_jit.branchTest32(callResultCondition, resultGPR), taken);
+        branchTest32(callResultCondition, resultGPR, taken);
     } else {
         GPRTemporary result(this);
         GPRReg resultGPR = result.gpr();
@@ -721,10 +720,10 @@ void SpeculativeJIT::nonSpeculativePeepholeBranch(Node& node, NodeIndex branchNo
         if (!isKnownInteger(node.child2().index()))
             slowPath.append(m_jit.branch32(MacroAssembler::NotEqual, arg2TagGPR, JITCompiler::TrustedImm32(JSValue::Int32Tag)));
     
-        addBranch(m_jit.branch32(cond, arg1PayloadGPR, arg2PayloadGPR), taken);
+        branch32(cond, arg1PayloadGPR, arg2PayloadGPR, taken);
     
         if (!isKnownInteger(node.child1().index()) || !isKnownInteger(node.child2().index())) {
-            addBranch(m_jit.jump(), notTaken);
+            jump(notTaken, ForceJump);
     
             slowPath.link(&m_jit);
     
@@ -732,12 +731,11 @@ void SpeculativeJIT::nonSpeculativePeepholeBranch(Node& node, NodeIndex branchNo
             callOperation(helperFunction, resultGPR, arg1TagGPR, arg1PayloadGPR, arg2TagGPR, arg2PayloadGPR);
             silentFillAllRegisters(resultGPR);
         
-            addBranch(m_jit.branchTest32(callResultCondition, resultGPR), taken);
+            branchTest32(callResultCondition, resultGPR, taken);
         }
     }
 
-    if (notTaken != (m_block + 1))
-        addBranch(m_jit.jump(), notTaken);
+    jump(notTaken);
 }
 
 void SpeculativeJIT::nonSpeculativeNonPeepholeCompare(Node& node, MacroAssembler::RelationalCondition cond, S_DFGOperation_EJJ helperFunction)
@@ -825,13 +823,13 @@ void SpeculativeJIT::nonSpeculativePeepholeStrictEq(Node& node, NodeIndex branch
     if (isKnownCell(node.child1().index()) && isKnownCell(node.child2().index())) {
         // see if we get lucky: if the arguments are cells and they reference the same
         // cell, then they must be strictly equal.
-        addBranch(m_jit.branchPtr(JITCompiler::Equal, arg1PayloadGPR, arg2PayloadGPR), invert ? notTaken : taken);
+        branchPtr(JITCompiler::Equal, arg1PayloadGPR, arg2PayloadGPR, invert ? notTaken : taken);
         
         silentSpillAllRegisters(resultPayloadGPR);
         callOperation(operationCompareStrictEqCell, resultPayloadGPR, arg1TagGPR, arg1PayloadGPR, arg2TagGPR, arg2PayloadGPR);
         silentFillAllRegisters(resultPayloadGPR);
         
-        addBranch(m_jit.branchTest32(invert ? JITCompiler::Zero : JITCompiler::NonZero, resultPayloadGPR), taken);
+        branchTest32(invert ? JITCompiler::Zero : JITCompiler::NonZero, resultPayloadGPR, taken);
     } else {
         // FIXME: Add fast paths for twoCells, number etc.
 
@@ -839,11 +837,10 @@ void SpeculativeJIT::nonSpeculativePeepholeStrictEq(Node& node, NodeIndex branch
         callOperation(operationCompareStrictEq, resultPayloadGPR, arg1TagGPR, arg1PayloadGPR, arg2TagGPR, arg2PayloadGPR);
         silentFillAllRegisters(resultPayloadGPR);
         
-        addBranch(m_jit.branchTest32(invert ? JITCompiler::Zero : JITCompiler::NonZero, resultPayloadGPR), taken);
+        branchTest32(invert ? JITCompiler::Zero : JITCompiler::NonZero, resultPayloadGPR, taken);
     }
     
-    if (notTaken != (m_block + 1))
-        addBranch(m_jit.jump(), notTaken);
+    jump(notTaken);
 }
 
 void SpeculativeJIT::nonSpeculativeNonPeepholeStrictEq(Node& node, bool invert)
@@ -953,7 +950,7 @@ void SpeculativeJIT::emitCall(Node& node)
     m_jit.addPtr(Imm32(m_jit.codeBlock()->m_numCalleeRegisters * sizeof(Register)), GPRInfo::callFrameRegister);
 
     CodeOrigin codeOrigin = at(m_compileIndex).codeOrigin;
-    CallBeginToken token = m_jit.nextCallBeginToken(codeOrigin);
+    CallBeginToken token = m_jit.beginJSCall();
     JITCompiler::Call fastCall = m_jit.nearCall();
     m_jit.notifyCall(fastCall, codeOrigin, token);
 
@@ -963,11 +960,11 @@ void SpeculativeJIT::emitCall(Node& node)
 
     m_jit.addPtr(Imm32(m_jit.codeBlock()->m_numCalleeRegisters * sizeof(Register)), GPRInfo::callFrameRegister, GPRInfo::argumentGPR0);
     m_jit.poke(GPRInfo::argumentGPR0);
-    token = m_jit.beginCall(codeOrigin);
+    token = m_jit.beginCall();
     JITCompiler::Call slowCall = m_jit.appendCall(slowCallFunction);
     m_jit.addFastExceptionCheck(slowCall, codeOrigin, token);
     m_jit.addPtr(Imm32(m_jit.codeBlock()->m_numCalleeRegisters * sizeof(Register)), GPRInfo::callFrameRegister);
-    token = m_jit.nextCallBeginToken(codeOrigin);
+    token = m_jit.beginJSCall();
     JITCompiler::Call theCall = m_jit.call(GPRInfo::returnValueGPR);
     m_jit.notifyCall(theCall, codeOrigin, token);
 
@@ -984,7 +981,7 @@ template<bool strict>
 GPRReg SpeculativeJIT::fillSpeculateIntInternal(NodeIndex nodeIndex, DataFormat& returnFormat)
 {
 #if DFG_ENABLE(DEBUG_VERBOSE)
-    fprintf(stderr, "SpecInt@%d   ", nodeIndex);
+    dataLog("SpecInt@%d   ", nodeIndex);
 #endif
     if (isKnownNotInteger(nodeIndex)) {
         terminateSpeculativeExecution(Uncountable, JSValueRegs(), NoNode);
@@ -1080,7 +1077,7 @@ GPRReg SpeculativeJIT::fillSpeculateIntStrict(NodeIndex nodeIndex)
 FPRReg SpeculativeJIT::fillSpeculateDouble(NodeIndex nodeIndex)
 {
 #if DFG_ENABLE(DEBUG_VERBOSE)
-    fprintf(stderr, "SpecDouble@%d   ", nodeIndex);
+    dataLog("SpecDouble@%d   ", nodeIndex);
 #endif
     if (isKnownNotNumber(nodeIndex)) {
         terminateSpeculativeExecution(Uncountable, JSValueRegs(), NoNode);
@@ -1210,7 +1207,7 @@ FPRReg SpeculativeJIT::fillSpeculateDouble(NodeIndex nodeIndex)
 GPRReg SpeculativeJIT::fillSpeculateCell(NodeIndex nodeIndex)
 {
 #if DFG_ENABLE(DEBUG_VERBOSE)
-    fprintf(stderr, "SpecCell@%d   ", nodeIndex);
+    dataLog("SpecCell@%d   ", nodeIndex);
 #endif
     if (isKnownNotCell(nodeIndex)) {
         terminateSpeculativeExecution(Uncountable, JSValueRegs(), NoNode);
@@ -1283,7 +1280,7 @@ GPRReg SpeculativeJIT::fillSpeculateCell(NodeIndex nodeIndex)
 GPRReg SpeculativeJIT::fillSpeculateBoolean(NodeIndex nodeIndex)
 {
 #if DFG_ENABLE(DEBUG_VERBOSE)
-     fprintf(stderr, "SpecBool@%d   ", nodeIndex);
+     dataLog("SpecBool@%d   ", nodeIndex);
 #endif
     if (isKnownNotBoolean(nodeIndex)) {
         terminateSpeculativeExecution(Uncountable, JSValueRegs(), NoNode);
@@ -1546,7 +1543,7 @@ void SpeculativeJIT::emitObjectOrOtherBranch(NodeUse nodeUse, BlockIndex taken,
     MacroAssembler::Jump notCell = m_jit.branch32(MacroAssembler::NotEqual, valueTagGPR, TrustedImm32(JSValue::CellTag));
     if (needSpeculationCheck)
         speculationCheck(BadType, JSValueRegs(valueTagGPR, valuePayloadGPR), nodeUse, m_jit.branchPtr(MacroAssembler::NotEqual, MacroAssembler::Address(valuePayloadGPR, JSCell::classInfoOffset()), MacroAssembler::TrustedImmPtr(classInfo)));
-    addBranch(m_jit.jump(), taken);
+    jump(taken, ForceJump);
     
     notCell.link(&m_jit);
     
@@ -1557,8 +1554,7 @@ void SpeculativeJIT::emitObjectOrOtherBranch(NodeUse nodeUse, BlockIndex taken,
         speculationCheck(BadType, JSValueRegs(valueTagGPR, valuePayloadGPR), nodeUse, m_jit.branch32(MacroAssembler::NotEqual, scratchGPR, TrustedImm32(JSValue::NullTag)));
     }
 
-    if (notTaken != (m_block + 1))
-        addBranch(m_jit.jump(), notTaken);
+    jump(notTaken);
     
     noResult(m_compileIndex);
 }
@@ -1579,9 +1575,8 @@ void SpeculativeJIT::emitBranch(Node& node)
             notTaken = tmp;
         }
 
-        addBranch(m_jit.branchTest32(condition, value.gpr(), TrustedImm32(1)), taken);
-        if (notTaken != (m_block + 1))
-            addBranch(m_jit.jump(), notTaken);
+        branchTest32(condition, value.gpr(), TrustedImm32(1), taken);
+        jump(notTaken);
 
         noResult(m_compileIndex);
     } else if (at(node.child1()).shouldSpeculateFinalObjectOrOther()) {
@@ -1600,15 +1595,14 @@ void SpeculativeJIT::emitBranch(Node& node)
             }
 
             SpeculateIntegerOperand value(this, node.child1());
-            addBranch(m_jit.branchTest32(invert ? MacroAssembler::Zero : MacroAssembler::NonZero, value.gpr()), taken);
+            branchTest32(invert ? MacroAssembler::Zero : MacroAssembler::NonZero, value.gpr(), taken);
         } else {
             SpeculateDoubleOperand value(this, node.child1());
             FPRTemporary scratch(this);
-            addBranch(m_jit.branchDoubleNonZero(value.fpr(), scratch.fpr()), taken);
+            branchDoubleNonZero(value.fpr(), scratch.fpr(), taken);
         }
         
-        if (notTaken != (m_block + 1))
-            addBranch(m_jit.jump(), notTaken);
+        jump(notTaken);
         
         noResult(m_compileIndex);
     } else {
@@ -1626,17 +1620,16 @@ void SpeculativeJIT::emitBranch(Node& node)
         JITCompiler::Jump slowPath = m_jit.branch32(JITCompiler::NotEqual, valueTagGPR, JITCompiler::TrustedImm32(JSValue::BooleanTag));
 
         fastPath.link(&m_jit);
-        addBranch(m_jit.branchTest32(JITCompiler::Zero, valuePayloadGPR), notTaken);
-        addBranch(m_jit.jump(), taken);
+        branchTest32(JITCompiler::Zero, valuePayloadGPR, notTaken);
+        jump(taken, ForceJump);
 
         slowPath.link(&m_jit);
         silentSpillAllRegisters(resultGPR);
         callOperation(dfgConvertJSValueToBoolean, resultGPR, valueTagGPR, valuePayloadGPR);
         silentFillAllRegisters(resultGPR);
     
-        addBranch(m_jit.branchTest32(JITCompiler::NonZero, resultGPR), taken);
-        if (notTaken != (m_block + 1))
-            addBranch(m_jit.jump(), notTaken);
+        branchTest32(JITCompiler::NonZero, resultGPR, taken);
+        jump(notTaken);
     
         noResult(m_compileIndex, UseChildrenCalledExplicitly);
     }
@@ -2600,8 +2593,7 @@ void SpeculativeJIT::compile(Node& node)
 
     case DFG::Jump: {
         BlockIndex taken = node.takenBlockIndex();
-        if (taken != (m_block + 1))
-            addBranch(m_jit.jump(), taken);
+        jump(taken);
         noResult(m_compileIndex);
         break;
     }
@@ -2622,9 +2614,8 @@ void SpeculativeJIT::compile(Node& node)
                 notTaken = tmp;
             }
             
-            addBranch(m_jit.branchTest32(condition, op.gpr()), taken);
-            if (notTaken != (m_block + 1))
-                addBranch(m_jit.jump(), notTaken);
+            branchTest32(condition, op.gpr(), taken);
+            jump(notTaken);
             
             noResult(m_compileIndex);
             break;
diff --git a/Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp b/Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp
index 0dc207f75..6d375f81f 100644
--- a/Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp
+++ b/Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp
@@ -611,20 +611,19 @@ void SpeculativeJIT::nonSpeculativePeepholeBranchNull(NodeUse operand, NodeIndex
         notCell = m_jit.branchTestPtr(MacroAssembler::NonZero, argGPR, GPRInfo::tagMaskRegister);
     
     m_jit.loadPtr(JITCompiler::Address(argGPR, JSCell::structureOffset()), resultGPR);
-    addBranch(m_jit.branchTest8(invert ? JITCompiler::Zero : JITCompiler::NonZero, JITCompiler::Address(resultGPR, Structure::typeInfoFlagsOffset()), JITCompiler::TrustedImm32(MasqueradesAsUndefined)), taken);
+    branchTest8(invert ? JITCompiler::Zero : JITCompiler::NonZero, JITCompiler::Address(resultGPR, Structure::typeInfoFlagsOffset()), JITCompiler::TrustedImm32(MasqueradesAsUndefined), taken);
     
     if (!isKnownCell(operand.index())) {
-        addBranch(m_jit.jump(), notTaken);
+        jump(notTaken, ForceJump);
         
         notCell.link(&m_jit);
         
         m_jit.move(argGPR, resultGPR);
         m_jit.andPtr(JITCompiler::TrustedImm32(~TagBitUndefined), resultGPR);
-        addBranch(m_jit.branchPtr(invert ? JITCompiler::NotEqual : JITCompiler::Equal, resultGPR, JITCompiler::TrustedImmPtr(reinterpret_cast<void*>(ValueNull))), taken);
+        branchPtr(invert ? JITCompiler::NotEqual : JITCompiler::Equal, resultGPR, JITCompiler::TrustedImmPtr(reinterpret_cast<void*>(ValueNull)), taken);
     }
     
-    if (notTaken != (m_block + 1))
-        addBranch(m_jit.jump(), notTaken);
+    jump(notTaken);
 }
 
 bool SpeculativeJIT::nonSpeculativeCompareNull(Node& node, NodeUse operand, bool invert)
@@ -682,7 +681,7 @@ void SpeculativeJIT::nonSpeculativePeepholeBranch(Node& node, NodeIndex branchNo
         flushRegisters();
         callOperation(helperFunction, resultGPR, arg1GPR, arg2GPR);
 
-        addBranch(m_jit.branchTest32(callResultCondition, resultGPR), taken);
+        branchTest32(callResultCondition, resultGPR, taken);
     } else {
         GPRTemporary result(this, arg2);
         GPRReg resultGPR = result.gpr();
@@ -695,10 +694,10 @@ void SpeculativeJIT::nonSpeculativePeepholeBranch(Node& node, NodeIndex branchNo
         if (!isKnownInteger(node.child2().index()))
             slowPath.append(m_jit.branchPtr(MacroAssembler::Below, arg2GPR, GPRInfo::tagTypeNumberRegister));
     
-        addBranch(m_jit.branch32(cond, arg1GPR, arg2GPR), taken);
+        branch32(cond, arg1GPR, arg2GPR, taken);
     
         if (!isKnownInteger(node.child1().index()) || !isKnownInteger(node.child2().index())) {
-            addBranch(m_jit.jump(), notTaken);
+            jump(notTaken, ForceJump);
     
             slowPath.link(&m_jit);
     
@@ -706,12 +705,11 @@ void SpeculativeJIT::nonSpeculativePeepholeBranch(Node& node, NodeIndex branchNo
             callOperation(helperFunction, resultGPR, arg1GPR, arg2GPR);
             silentFillAllRegisters(resultGPR);
         
-            addBranch(m_jit.branchTest32(callResultCondition, resultGPR), taken);
+            branchTest32(callResultCondition, resultGPR, taken);
         }
     }
 
-    if (notTaken != (m_block + 1))
-        addBranch(m_jit.jump(), notTaken);
+    jump(notTaken);
 }
 
 void SpeculativeJIT::nonSpeculativeNonPeepholeCompare(Node& node, MacroAssembler::RelationalCondition cond, S_DFGOperation_EJJ helperFunction)
@@ -798,13 +796,13 @@ void SpeculativeJIT::nonSpeculativePeepholeStrictEq(Node& node, NodeIndex branch
     if (isKnownCell(node.child1().index()) && isKnownCell(node.child2().index())) {
         // see if we get lucky: if the arguments are cells and they reference the same
         // cell, then they must be strictly equal.
-        addBranch(m_jit.branchPtr(JITCompiler::Equal, arg1GPR, arg2GPR), invert ? notTaken : taken);
+        branchPtr(JITCompiler::Equal, arg1GPR, arg2GPR, invert ? notTaken : taken);
         
         silentSpillAllRegisters(resultGPR);
         callOperation(operationCompareStrictEqCell, resultGPR, arg1GPR, arg2GPR);
         silentFillAllRegisters(resultGPR);
         
-        addBranch(m_jit.branchTest32(invert ? JITCompiler::Zero : JITCompiler::NonZero, resultGPR), taken);
+        branchTest32(invert ? JITCompiler::Zero : JITCompiler::NonZero, resultGPR, taken);
     } else {
         m_jit.orPtr(arg1GPR, arg2GPR, resultGPR);
         
@@ -812,11 +810,11 @@ void SpeculativeJIT::nonSpeculativePeepholeStrictEq(Node& node, NodeIndex branch
         
         JITCompiler::Jump numberCase = m_jit.branchTestPtr(JITCompiler::NonZero, resultGPR, GPRInfo::tagTypeNumberRegister);
         
-        addBranch(m_jit.branch32(invert ? JITCompiler::NotEqual : JITCompiler::Equal, arg1GPR, arg2GPR), taken);
-        addBranch(m_jit.jump(), notTaken);
+        branch32(invert ? JITCompiler::NotEqual : JITCompiler::Equal, arg1GPR, arg2GPR, taken);
+        jump(notTaken, ForceJump);
         
         twoCellsCase.link(&m_jit);
-        addBranch(m_jit.branchPtr(JITCompiler::Equal, arg1GPR, arg2GPR), invert ? notTaken : taken);
+        branchPtr(JITCompiler::Equal, arg1GPR, arg2GPR, invert ? notTaken : taken);
         
         numberCase.link(&m_jit);
         
@@ -824,11 +822,10 @@ void SpeculativeJIT::nonSpeculativePeepholeStrictEq(Node& node, NodeIndex branch
         callOperation(operationCompareStrictEq, resultGPR, arg1GPR, arg2GPR);
         silentFillAllRegisters(resultGPR);
         
-        addBranch(m_jit.branchTest32(invert ? JITCompiler::Zero : JITCompiler::NonZero, resultGPR), taken);
+        branchTest32(invert ? JITCompiler::Zero : JITCompiler::NonZero, resultGPR, taken);
     }
     
-    if (notTaken != (m_block + 1))
-        addBranch(m_jit.jump(), notTaken);
+    jump(notTaken);
 }
 
 void SpeculativeJIT::nonSpeculativeNonPeepholeStrictEq(Node& node, bool invert)
@@ -954,7 +951,7 @@ void SpeculativeJIT::emitCall(Node& node)
     m_jit.addPtr(Imm32(m_jit.codeBlock()->m_numCalleeRegisters * sizeof(Register)), GPRInfo::callFrameRegister);
     
     CodeOrigin codeOrigin = at(m_compileIndex).codeOrigin;
-    CallBeginToken token = m_jit.nextCallBeginToken(codeOrigin);
+    CallBeginToken token = m_jit.beginJSCall();
     JITCompiler::Call fastCall = m_jit.nearCall();
     m_jit.notifyCall(fastCall, codeOrigin, token);
     
@@ -963,11 +960,11 @@ void SpeculativeJIT::emitCall(Node& node)
     slowPath.link(&m_jit);
     
     m_jit.addPtr(Imm32(m_jit.codeBlock()->m_numCalleeRegisters * sizeof(Register)), GPRInfo::callFrameRegister, GPRInfo::argumentGPR0);
-    token = m_jit.beginCall(codeOrigin);
+    token = m_jit.beginCall();
     JITCompiler::Call slowCall = m_jit.appendCall(slowCallFunction);
     m_jit.addFastExceptionCheck(slowCall, codeOrigin, token);
     m_jit.addPtr(Imm32(m_jit.codeBlock()->m_numCalleeRegisters * sizeof(Register)), GPRInfo::callFrameRegister);
-    token = m_jit.nextCallBeginToken(codeOrigin);
+    token = m_jit.beginJSCall();
     JITCompiler::Call theCall = m_jit.call(GPRInfo::returnValueGPR);
     m_jit.notifyCall(theCall, codeOrigin, token);
     
@@ -984,7 +981,7 @@ template<bool strict>
 GPRReg SpeculativeJIT::fillSpeculateIntInternal(NodeIndex nodeIndex, DataFormat& returnFormat)
 {
 #if DFG_ENABLE(DEBUG_VERBOSE)
-    fprintf(stderr, "SpecInt@%d   ", nodeIndex);
+    dataLog("SpecInt@%d   ", nodeIndex);
 #endif
     Node& node = at(nodeIndex);
     VirtualRegister virtualRegister = node.virtualRegister();
@@ -1129,7 +1126,7 @@ GPRReg SpeculativeJIT::fillSpeculateIntStrict(NodeIndex nodeIndex)
 FPRReg SpeculativeJIT::fillSpeculateDouble(NodeIndex nodeIndex)
 {
 #if DFG_ENABLE(DEBUG_VERBOSE)
-    fprintf(stderr, "SpecDouble@%d   ", nodeIndex);
+    dataLog("SpecDouble@%d   ", nodeIndex);
 #endif
     Node& node = at(nodeIndex);
     VirtualRegister virtualRegister = node.virtualRegister();
@@ -1280,7 +1277,7 @@ FPRReg SpeculativeJIT::fillSpeculateDouble(NodeIndex nodeIndex)
 GPRReg SpeculativeJIT::fillSpeculateCell(NodeIndex nodeIndex)
 {
 #if DFG_ENABLE(DEBUG_VERBOSE)
-    fprintf(stderr, "SpecCell@%d   ", nodeIndex);
+    dataLog("SpecCell@%d   ", nodeIndex);
 #endif
     Node& node = at(nodeIndex);
     VirtualRegister virtualRegister = node.virtualRegister();
@@ -1353,7 +1350,7 @@ GPRReg SpeculativeJIT::fillSpeculateCell(NodeIndex nodeIndex)
 GPRReg SpeculativeJIT::fillSpeculateBoolean(NodeIndex nodeIndex)
 {
 #if DFG_ENABLE(DEBUG_VERBOSE)
-    fprintf(stderr, "SpecBool@%d   ", nodeIndex);
+    dataLog("SpecBool@%d   ", nodeIndex);
 #endif
     Node& node = at(nodeIndex);
     VirtualRegister virtualRegister = node.virtualRegister();
@@ -1633,7 +1630,7 @@ void SpeculativeJIT::emitObjectOrOtherBranch(NodeUse nodeUse, BlockIndex taken,
     MacroAssembler::Jump notCell = m_jit.branchTestPtr(MacroAssembler::NonZero, valueGPR, GPRInfo::tagMaskRegister);
     if (needSpeculationCheck)
         speculationCheck(BadType, JSValueRegs(valueGPR), nodeUse.index(), m_jit.branchPtr(MacroAssembler::NotEqual, MacroAssembler::Address(valueGPR, JSCell::classInfoOffset()), MacroAssembler::TrustedImmPtr(classInfo)));
-    addBranch(m_jit.jump(), taken);
+    jump(taken, ForceJump);
     
     notCell.link(&m_jit);
     
@@ -1642,8 +1639,7 @@ void SpeculativeJIT::emitObjectOrOtherBranch(NodeUse nodeUse, BlockIndex taken,
         m_jit.andPtr(MacroAssembler::TrustedImm32(~TagBitUndefined), scratchGPR);
         speculationCheck(BadType, JSValueRegs(valueGPR), nodeUse.index(), m_jit.branchPtr(MacroAssembler::NotEqual, scratchGPR, MacroAssembler::TrustedImmPtr(reinterpret_cast<void*>(ValueNull))));
     }
-    if (notTaken != (m_block + 1))
-        addBranch(m_jit.jump(), notTaken);
+    jump(notTaken);
     
     noResult(m_compileIndex);
 }
@@ -1666,9 +1662,8 @@ void SpeculativeJIT::emitBranch(Node& node)
             notTaken = tmp;
         }
         
-        addBranch(m_jit.branchTest32(condition, valueGPR, TrustedImm32(true)), taken);
-        if (notTaken != (m_block + 1))
-            addBranch(m_jit.jump(), notTaken);
+        branchTest32(condition, valueGPR, TrustedImm32(true), taken);
+        jump(notTaken);
         
         noResult(m_compileIndex);
     } else if (at(node.child1()).shouldSpeculateFinalObjectOrOther()) {
@@ -1687,15 +1682,14 @@ void SpeculativeJIT::emitBranch(Node& node)
             }
 
             SpeculateIntegerOperand value(this, node.child1());
-            addBranch(m_jit.branchTest32(invert ? MacroAssembler::Zero : MacroAssembler::NonZero, value.gpr()), taken);
+            branchTest32(invert ? MacroAssembler::Zero : MacroAssembler::NonZero, value.gpr(), taken);
         } else {
             SpeculateDoubleOperand value(this, node.child1());
             FPRTemporary scratch(this);
-            addBranch(m_jit.branchDoubleNonZero(value.fpr(), scratch.fpr()), taken);
+            branchDoubleNonZero(value.fpr(), scratch.fpr(), taken);
         }
         
-        if (notTaken != (m_block + 1))
-            addBranch(m_jit.jump(), notTaken);
+        jump(notTaken);
         
         noResult(m_compileIndex);
     } else {
@@ -1705,18 +1699,18 @@ void SpeculativeJIT::emitBranch(Node& node)
         bool predictBoolean = isBooleanPrediction(m_jit.getPrediction(node.child1()));
     
         if (predictBoolean) {
-            addBranch(m_jit.branchPtr(MacroAssembler::Equal, valueGPR, MacroAssembler::ImmPtr(JSValue::encode(jsBoolean(false)))), notTaken);
-            addBranch(m_jit.branchPtr(MacroAssembler::Equal, valueGPR, MacroAssembler::ImmPtr(JSValue::encode(jsBoolean(true)))), taken);
+            branchPtr(MacroAssembler::Equal, valueGPR, MacroAssembler::ImmPtr(JSValue::encode(jsBoolean(false))), notTaken);
+            branchPtr(MacroAssembler::Equal, valueGPR, MacroAssembler::ImmPtr(JSValue::encode(jsBoolean(true))), taken);
 
             speculationCheck(BadType, JSValueRegs(valueGPR), node.child1(), m_jit.jump());
             value.use();
         } else {
-            addBranch(m_jit.branchPtr(MacroAssembler::Equal, valueGPR, MacroAssembler::ImmPtr(JSValue::encode(jsNumber(0)))), notTaken);
-            addBranch(m_jit.branchPtr(MacroAssembler::AboveOrEqual, valueGPR, GPRInfo::tagTypeNumberRegister), taken);
+            branchPtr(MacroAssembler::Equal, valueGPR, MacroAssembler::ImmPtr(JSValue::encode(jsNumber(0))), notTaken);
+            branchPtr(MacroAssembler::AboveOrEqual, valueGPR, GPRInfo::tagTypeNumberRegister, taken);
     
             if (!predictBoolean) {
-                addBranch(m_jit.branchPtr(MacroAssembler::Equal, valueGPR, MacroAssembler::ImmPtr(JSValue::encode(jsBoolean(false)))), notTaken);
-                addBranch(m_jit.branchPtr(MacroAssembler::Equal, valueGPR, MacroAssembler::ImmPtr(JSValue::encode(jsBoolean(true)))), taken);
+                branchPtr(MacroAssembler::Equal, valueGPR, MacroAssembler::ImmPtr(JSValue::encode(jsBoolean(false))), notTaken);
+                branchPtr(MacroAssembler::Equal, valueGPR, MacroAssembler::ImmPtr(JSValue::encode(jsBoolean(true))), taken);
             }
     
             value.use();
@@ -1725,9 +1719,8 @@ void SpeculativeJIT::emitBranch(Node& node)
             callOperation(dfgConvertJSValueToBoolean, resultGPR, valueGPR);
             silentFillAllRegisters(resultGPR);
     
-            addBranch(m_jit.branchTest32(MacroAssembler::NonZero, resultGPR), taken);
-            if (notTaken != (m_block + 1))
-                addBranch(m_jit.jump(), notTaken);
+            branchTest32(MacroAssembler::NonZero, resultGPR, taken);
+            jump(notTaken);
         }
         
         noResult(m_compileIndex, UseChildrenCalledExplicitly);
@@ -2630,8 +2623,7 @@ void SpeculativeJIT::compile(Node& node)
 
     case DFG::Jump: {
         BlockIndex taken = node.takenBlockIndex();
-        if (taken != (m_block + 1))
-            addBranch(m_jit.jump(), taken);
+        jump(taken);
         noResult(m_compileIndex);
         break;
     }
@@ -2652,9 +2644,8 @@ void SpeculativeJIT::compile(Node& node)
                 notTaken = tmp;
             }
             
-            addBranch(m_jit.branchTest32(condition, op.gpr()), taken);
-            if (notTaken != (m_block + 1))
-                addBranch(m_jit.jump(), notTaken);
+            branchTest32(condition, op.gpr(), taken);
+            jump(notTaken);
             
             noResult(m_compileIndex);
             break;
diff --git a/Source/JavaScriptCore/dfg/DFGVariableAccessData.h b/Source/JavaScriptCore/dfg/DFGVariableAccessData.h
index 3cc53748a..bd626f9fb 100644
--- a/Source/JavaScriptCore/dfg/DFGVariableAccessData.h
+++ b/Source/JavaScriptCore/dfg/DFGVariableAccessData.h
@@ -70,6 +70,11 @@ public:
         return mergePrediction(find()->m_prediction, prediction);
     }
     
+    PredictedType nonUnifiedPrediction()
+    {
+        return m_prediction;
+    }
+    
     PredictedType prediction()
     {
         return find()->m_prediction;
diff --git a/Source/JavaScriptCore/dfg/DFGVirtualRegisterAllocationPhase.cpp b/Source/JavaScriptCore/dfg/DFGVirtualRegisterAllocationPhase.cpp
new file mode 100644
index 000000000..c0b9fae65
--- /dev/null
+++ b/Source/JavaScriptCore/dfg/DFGVirtualRegisterAllocationPhase.cpp
@@ -0,0 +1,104 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "DFGVirtualRegisterAllocationPhase.h"
+
+#if ENABLE(DFG_JIT)
+
+#include "DFGGraph.h"
+#include "DFGScoreBoard.h"
+
+namespace JSC { namespace DFG {
+
+class VirtualRegisterAllocationPhase : public Phase {
+public:
+    VirtualRegisterAllocationPhase(Graph& graph)
+        : Phase(graph, "virtual register allocation")
+    {
+    }
+    
+    void run()
+    {
+#if DFG_ENABLE(DEBUG_VERBOSE)
+        dataLog("Preserved vars: ");
+        m_graph.m_preservedVars.dump(WTF::dataFile());
+        dataLog("\n");
+#endif
+        ScoreBoard scoreBoard(m_graph, m_graph.m_preservedVars);
+        unsigned sizeExcludingPhiNodes = m_graph.m_blocks.last()->end;
+        for (size_t i = 0; i < sizeExcludingPhiNodes; ++i) {
+            Node& node = m_graph[i];
+        
+            if (!node.shouldGenerate())
+                continue;
+        
+            // GetLocal nodes are effectively phi nodes in the graph, referencing
+            // results from prior blocks.
+            if (node.op != GetLocal) {
+                // First, call use on all of the current node's children, then
+                // allocate a VirtualRegister for this node. We do so in this
+                // order so that if a child is on its last use, and a
+                // VirtualRegister is freed, then it may be reused for node.
+                if (node.op & NodeHasVarArgs) {
+                    for (unsigned childIdx = node.firstChild(); childIdx < node.firstChild() + node.numChildren(); childIdx++)
+                        scoreBoard.use(m_graph.m_varArgChildren[childIdx]);
+                } else {
+                    scoreBoard.use(node.child1());
+                    scoreBoard.use(node.child2());
+                    scoreBoard.use(node.child3());
+                }
+            }
+
+            if (!node.hasResult())
+                continue;
+
+            node.setVirtualRegister(scoreBoard.allocate());
+            // 'mustGenerate' nodes have their useCount artificially elevated,
+            // call use now to account for this.
+            if (node.mustGenerate())
+                scoreBoard.use(i);
+        }
+
+        // 'm_numCalleeRegisters' is the number of locals and temporaries allocated
+        // for the function (and checked for on entry). Since we perform a new and
+        // different allocation of temporaries, more registers may now be required.
+        unsigned calleeRegisters = scoreBoard.highWatermark() + m_graph.m_parameterSlots;
+        if ((unsigned)codeBlock()->m_numCalleeRegisters < calleeRegisters)
+            codeBlock()->m_numCalleeRegisters = calleeRegisters;
+#if DFG_ENABLE(DEBUG_VERBOSE)
+        dataLog("Num callee registers: %u\n", calleeRegisters);
+#endif
+    }
+};
+
+void performVirtualRegisterAllocation(Graph& graph)
+{
+    runPhase<VirtualRegisterAllocationPhase>(graph);
+}
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
diff --git a/Source/JavaScriptCore/heap/BumpSpace.cpp b/Source/JavaScriptCore/dfg/DFGVirtualRegisterAllocationPhase.h
index 4eb0284dd..abfa6ae64 100644
--- a/Source/JavaScriptCore/heap/BumpSpace.cpp
+++ b/Source/JavaScriptCore/dfg/DFGVirtualRegisterAllocationPhase.h
@@ -23,27 +23,30 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
  */
 
-#include "config.h"
-#include "BumpSpace.h"
-
-#include "BumpSpaceInlineMethods.h"
-
-namespace JSC {
-
-CheckedBoolean BumpSpace::tryAllocateSlowCase(size_t bytes, void** outPtr)
-{
-    if (isOversize(bytes))
-        return tryAllocateOversize(bytes, outPtr);
-    
-    m_totalMemoryUtilized += static_cast<size_t>(static_cast<char*>(m_currentBlock->m_offset) - m_currentBlock->m_payload);
-    if (!addNewBlock()) {
-        *outPtr = 0;
-        return false;
-    }
-    m_toSpaceFilter.add(reinterpret_cast<Bits>(m_currentBlock));
-    m_toSpaceSet.add(m_currentBlock);
-    *outPtr = allocateFromBlock(m_currentBlock, bytes);
-    return true;
-}
-
-} // namespace JSC
+#ifndef DFGVirtualRegisterAllocationPhase_h
+#define DFGVirtualRegisterAllocationPhase_h
+
+#include <wtf/Platform.h>
+
+#if ENABLE(DFG_JIT)
+
+#include "DFGPhase.h"
+
+namespace JSC { namespace DFG {
+
+class Graph;
+
+// Prior to running this phase, we have no idea where in the call frame nodes
+// will have their values spilled. This phase fixes that by giving each node
+// a spill slot. The spill slot index (i.e. the virtual register) is also used
+// for look-up tables for the linear scan register allocator that the backend
+// uses.
+
+void performVirtualRegisterAllocation(Graph&);
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
+
+#endif // DFGVirtualRegisterAllocationPhase_h
+
diff --git a/Source/JavaScriptCore/heap/ConservativeRoots.cpp b/Source/JavaScriptCore/heap/ConservativeRoots.cpp
index a509f06e1..d63faebf3 100644
--- a/Source/JavaScriptCore/heap/ConservativeRoots.cpp
+++ b/Source/JavaScriptCore/heap/ConservativeRoots.cpp
@@ -26,8 +26,8 @@
 #include "config.h"
 #include "ConservativeRoots.h"
 
-#include "BumpSpace.h"
-#include "BumpSpaceInlineMethods.h"
+#include "CopiedSpace.h"
+#include "CopiedSpaceInlineMethods.h"
 #include "CodeBlock.h"
 #include "DFGCodeBlocks.h"
 #include "JSCell.h"
@@ -36,12 +36,12 @@
 
 namespace JSC {
 
-ConservativeRoots::ConservativeRoots(const MarkedBlockSet* blocks, BumpSpace* bumpSpace)
+ConservativeRoots::ConservativeRoots(const MarkedBlockSet* blocks, CopiedSpace* copiedSpace)
     : m_roots(m_inlineRoots)
     , m_size(0)
     , m_capacity(inlineCapacity)
     , m_blocks(blocks)
-    , m_bumpSpace(bumpSpace)
+    , m_copiedSpace(copiedSpace)
 {
 }
 
@@ -72,9 +72,9 @@ inline void ConservativeRoots::genericAddPointer(void* p, TinyBloomFilter filter
 {
     markHook.mark(p);
     
-    BumpBlock* block;
-    if (m_bumpSpace->contains(p, block))
-        m_bumpSpace->pin(block);
+    CopiedBlock* block;
+    if (m_copiedSpace->contains(p, block))
+        m_copiedSpace->pin(block);
     
     MarkedBlock* candidate = MarkedBlock::blockFor(p);
     if (filter.ruleOut(reinterpret_cast<Bits>(candidate))) {
diff --git a/Source/JavaScriptCore/heap/ConservativeRoots.h b/Source/JavaScriptCore/heap/ConservativeRoots.h
index 40b0996d0..9d9e9ba0c 100644
--- a/Source/JavaScriptCore/heap/ConservativeRoots.h
+++ b/Source/JavaScriptCore/heap/ConservativeRoots.h
@@ -38,7 +38,7 @@ class Heap;
 
 class ConservativeRoots {
 public:
-    ConservativeRoots(const MarkedBlockSet*, BumpSpace*);
+    ConservativeRoots(const MarkedBlockSet*, CopiedSpace*);
     ~ConservativeRoots();
 
     void add(void* begin, void* end);
@@ -63,7 +63,7 @@ private:
     size_t m_size;
     size_t m_capacity;
     const MarkedBlockSet* m_blocks;
-    BumpSpace* m_bumpSpace;
+    CopiedSpace* m_copiedSpace;
     JSCell* m_inlineRoots[inlineCapacity];
 };
 
diff --git a/Source/JavaScriptCore/heap/CopiedAllocator.h b/Source/JavaScriptCore/heap/CopiedAllocator.h
new file mode 100644
index 000000000..c5ba50d78
--- /dev/null
+++ b/Source/JavaScriptCore/heap/CopiedAllocator.h
@@ -0,0 +1,106 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef CopiedAllocator_h
+#define CopiedAllocator_h
+
+#include "CopiedBlock.h"
+
+namespace JSC {
+
+class CopiedAllocator {
+public:
+    CopiedAllocator();
+    void* allocate(size_t);
+    bool fitsInCurrentBlock(size_t);
+    bool wasLastAllocation(void*, size_t);
+    void startedCopying();
+    void resetCurrentBlock(CopiedBlock*);
+    void resetLastAllocation(void*);
+    size_t currentUtilization();
+
+private:
+    CopiedBlock* currentBlock() { return m_currentBlock; }
+
+    char* m_currentOffset;
+    CopiedBlock* m_currentBlock; 
+};
+
+inline CopiedAllocator::CopiedAllocator()
+    : m_currentOffset(0)
+    , m_currentBlock(0)
+{
+}
+
+inline void* CopiedAllocator::allocate(size_t bytes)
+{
+    ASSERT(m_currentOffset);
+    ASSERT(is8ByteAligned(reinterpret_cast<void*>(bytes)));
+    ASSERT(fitsInCurrentBlock(bytes));
+    void* ptr = static_cast<void*>(m_currentOffset);
+    m_currentOffset += bytes;
+    ASSERT(is8ByteAligned(ptr));
+    return ptr;
+}
+
+inline bool CopiedAllocator::fitsInCurrentBlock(size_t bytes)
+{
+    return m_currentOffset + bytes < reinterpret_cast<char*>(m_currentBlock) + HeapBlock::s_blockSize && m_currentOffset + bytes > m_currentOffset;
+}
+
+inline bool CopiedAllocator::wasLastAllocation(void* ptr, size_t size)
+{
+    return static_cast<char*>(ptr) + size == m_currentOffset && ptr > m_currentBlock && ptr < reinterpret_cast<char*>(m_currentBlock) + HeapBlock::s_blockSize;
+}
+
+inline void CopiedAllocator::startedCopying()
+{
+    if (m_currentBlock)
+        m_currentBlock->m_offset = static_cast<void*>(m_currentOffset);
+    m_currentOffset = 0;
+    m_currentBlock = 0;
+}
+
+inline void CopiedAllocator::resetCurrentBlock(CopiedBlock* newBlock)
+{
+    if (m_currentBlock)
+        m_currentBlock->m_offset = static_cast<void*>(m_currentOffset);
+    m_currentBlock = newBlock;
+    m_currentOffset = static_cast<char*>(newBlock->m_offset);
+}
+
+inline size_t CopiedAllocator::currentUtilization()
+{
+    return static_cast<size_t>(m_currentOffset - m_currentBlock->m_payload);
+}
+
+inline void CopiedAllocator::resetLastAllocation(void* ptr)
+{
+    m_currentOffset = static_cast<char*>(ptr);
+}
+
+} // namespace JSC
+
+#endif
diff --git a/Source/JavaScriptCore/heap/CopiedBlock.h b/Source/JavaScriptCore/heap/CopiedBlock.h
new file mode 100644
index 000000000..a57c1150c
--- /dev/null
+++ b/Source/JavaScriptCore/heap/CopiedBlock.h
@@ -0,0 +1,67 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef CopiedBlock_h
+#define CopiedBlock_h
+
+#include "HeapBlock.h"
+#include "JSValue.h"
+#include "JSValueInlineMethods.h"
+
+namespace JSC {
+
+class CopiedSpace;
+
+class CopiedBlock : public HeapBlock {
+    friend class CopiedSpace;
+    friend class CopiedAllocator;
+public:
+    CopiedBlock(PageAllocationAligned& allocation)
+        : HeapBlock(allocation)
+        , m_offset(m_payload)
+        , m_isPinned(false)
+    {
+        ASSERT(is8ByteAligned(static_cast<void*>(m_payload)));
+#if USE(JSVALUE64)
+        memset(static_cast<void*>(m_payload), 0, static_cast<size_t>((reinterpret_cast<char*>(this) + allocation.size()) - m_payload));
+#else
+        JSValue emptyValue;
+        JSValue* limit = reinterpret_cast<JSValue*>(reinterpret_cast<char*>(this) + allocation.size());
+        for (JSValue* currentValue = reinterpret_cast<JSValue*>(m_payload); currentValue < limit; currentValue++)
+            *currentValue = emptyValue;
+#endif
+    }
+
+private:
+    void* m_offset;
+    uintptr_t m_isPinned;
+    uintptr_t m_padding;
+    uintptr_t m_dummy;
+    char m_payload[1];
+};
+
+} // namespace JSC
+
+#endif
diff --git a/Source/JavaScriptCore/heap/BumpSpaceInlineMethods.h b/Source/JavaScriptCore/heap/CopiedSpace.cpp
index 3454631b0..3310d2c58 100644
--- a/Source/JavaScriptCore/heap/BumpSpaceInlineMethods.h
+++ b/Source/JavaScriptCore/heap/CopiedSpace.cpp
@@ -23,21 +23,15 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
  */
 
-#ifndef BumpSpaceInlineMethods_h
-#define BumpSpaceInlineMethods_h
+#include "config.h"
+#include "CopiedSpace.h"
 
-#include "BumpBlock.h"
-#include "BumpSpace.h"
-#include "Heap.h"
-#include "HeapBlock.h"
-#include "JSGlobalData.h"
-#include <wtf/CheckedBoolean.h>
+#include "CopiedSpaceInlineMethods.h"
 
 namespace JSC {
 
-inline BumpSpace::BumpSpace(Heap* heap)
+CopiedSpace::CopiedSpace(Heap* heap)
     : m_heap(heap)
-    , m_currentBlock(0)
     , m_toSpace(0)
     , m_fromSpace(0)
     , m_totalMemoryAllocated(0)
@@ -47,92 +41,116 @@ inline BumpSpace::BumpSpace(Heap* heap)
 {
 }
 
-inline void BumpSpace::init()
+void CopiedSpace::init()
 {
     m_toSpace = &m_blocks1;
     m_fromSpace = &m_blocks2;
     
-    m_totalMemoryAllocated += s_blockSize * s_initialBlockNum;
+    m_totalMemoryAllocated += HeapBlock::s_blockSize * s_initialBlockNum;
 
     if (!addNewBlock())
         CRASH();
 }   
 
-inline bool BumpSpace::contains(void* ptr, BumpBlock*& result)
+CheckedBoolean CopiedSpace::tryAllocateSlowCase(size_t bytes, void** outPtr)
 {
-    BumpBlock* block = blockFor(ptr);
-    result = block;
-    return !m_toSpaceFilter.ruleOut(reinterpret_cast<Bits>(block)) && m_toSpaceSet.contains(block);
+    if (isOversize(bytes))
+        return tryAllocateOversize(bytes, outPtr);
+    
+    m_totalMemoryUtilized += m_allocator.currentUtilization();
+    if (!addNewBlock()) {
+        *outPtr = 0;
+        return false;
+    }
+    *outPtr = m_allocator.allocate(bytes);
+    ASSERT(*outPtr);
+    return true;
 }
 
-inline void BumpSpace::pin(BumpBlock* block)
+CheckedBoolean CopiedSpace::tryAllocateOversize(size_t bytes, void** outPtr)
 {
-    block->m_isPinned = true;
+    ASSERT(isOversize(bytes));
+    
+    size_t blockSize = WTF::roundUpToMultipleOf<s_pageSize>(sizeof(CopiedBlock) + bytes);
+    PageAllocationAligned allocation = PageAllocationAligned::allocate(blockSize, s_pageSize, OSAllocator::JSGCHeapPages);
+    if (!static_cast<bool>(allocation)) {
+        *outPtr = 0;
+        return false;
+    }
+    CopiedBlock* block = new (NotNull, allocation.base()) CopiedBlock(allocation);
+    m_oversizeBlocks.push(block);
+    ASSERT(is8ByteAligned(block->m_offset));
+
+    m_oversizeFilter.add(reinterpret_cast<Bits>(block));
+    
+    m_totalMemoryAllocated += blockSize;
+    m_totalMemoryUtilized += bytes;
+
+    *outPtr = block->m_offset;
+    return true;
 }
 
-inline void BumpSpace::startedCopying()
+CheckedBoolean CopiedSpace::tryReallocate(void** ptr, size_t oldSize, size_t newSize)
 {
-    DoublyLinkedList<HeapBlock>* temp = m_fromSpace;
-    m_fromSpace = m_toSpace;
-    m_toSpace = temp;
+    if (oldSize >= newSize)
+        return true;
+    
+    void* oldPtr = *ptr;
+    ASSERT(!m_heap->globalData()->isInitializingObject());
 
-    m_toSpaceFilter.reset();
+    if (isOversize(oldSize) || isOversize(newSize))
+        return tryReallocateOversize(ptr, oldSize, newSize);
 
-    m_totalMemoryUtilized = 0;
+    if (m_allocator.wasLastAllocation(oldPtr, oldSize)) {
+        m_allocator.resetLastAllocation(oldPtr);
+        if (m_allocator.fitsInCurrentBlock(newSize)) {
+            m_totalMemoryUtilized += newSize - oldSize;
+            return m_allocator.allocate(newSize);
+        }
+    }
+    m_totalMemoryUtilized -= oldSize;
 
-    ASSERT(!m_inCopyingPhase);
-    ASSERT(!m_numberOfLoanedBlocks);
-    m_inCopyingPhase = true;
+    void* result = 0;
+    if (!tryAllocate(newSize, &result)) {
+        *ptr = 0;
+        return false;
+    }
+    memcpy(result, oldPtr, oldSize);
+    *ptr = result;
+    return true;
 }
 
-inline void BumpSpace::doneCopying()
+CheckedBoolean CopiedSpace::tryReallocateOversize(void** ptr, size_t oldSize, size_t newSize)
 {
-    {
-        MutexLocker locker(m_loanedBlocksLock);
-        while (m_numberOfLoanedBlocks > 0)
-            m_loanedBlocksCondition.wait(m_loanedBlocksLock);
-    }
-
-    ASSERT(m_inCopyingPhase);
-    m_inCopyingPhase = false;
-    while (!m_fromSpace->isEmpty()) {
-        BumpBlock* block = static_cast<BumpBlock*>(m_fromSpace->removeHead());
-        if (block->m_isPinned) {
-            block->m_isPinned = false;
-            m_toSpace->push(block);
-            continue;
-        }
+    ASSERT(isOversize(oldSize) || isOversize(newSize));
+    ASSERT(newSize > oldSize);
 
-        m_toSpaceSet.remove(block);
-        {
-            MutexLocker locker(m_heap->m_freeBlockLock);
-            m_heap->m_freeBlocks.push(block);
-            m_heap->m_numberOfFreeBlocks++;
-        }
+    void* oldPtr = *ptr;
+    
+    void* newPtr = 0;
+    if (!tryAllocateOversize(newSize, &newPtr)) {
+        *ptr = 0;
+        return false;
     }
+    memcpy(newPtr, oldPtr, oldSize);
 
-    BumpBlock* curr = static_cast<BumpBlock*>(m_oversizeBlocks.head());
-    while (curr) {
-        BumpBlock* next = static_cast<BumpBlock*>(curr->next());
-        if (!curr->m_isPinned) {
-            m_oversizeBlocks.remove(curr);
-            m_totalMemoryAllocated -= curr->m_allocation.size();
-            m_totalMemoryUtilized -= curr->m_allocation.size() - sizeof(BumpBlock);
-            curr->m_allocation.deallocate();
-        } else
-            curr->m_isPinned = false;
-        curr = next;
+    if (isOversize(oldSize)) {
+        CopiedBlock* oldBlock = oversizeBlockFor(oldPtr);
+        m_oversizeBlocks.remove(oldBlock);
+        oldBlock->m_allocation.deallocate();
+        m_totalMemoryAllocated -= oldSize + sizeof(CopiedBlock);
     }
+    
+    m_totalMemoryUtilized -= oldSize;
 
-    if (!(m_currentBlock = static_cast<BumpBlock*>(m_toSpace->head())))
-        if (!addNewBlock())
-            CRASH();
+    *ptr = newPtr;
+    return true;
 }
 
-inline void BumpSpace::doneFillingBlock(BumpBlock* block)
+void CopiedSpace::doneFillingBlock(CopiedBlock* block)
 {
     ASSERT(block);
-    ASSERT(block->m_offset < reinterpret_cast<char*>(block) + s_blockSize);
+    ASSERT(block->m_offset < reinterpret_cast<char*>(block) + HeapBlock::s_blockSize);
     ASSERT(m_inCopyingPhase);
 
     if (block->m_offset == block->m_payload) {
@@ -161,27 +179,56 @@ inline void BumpSpace::doneFillingBlock(BumpBlock* block)
     }
 }
 
-inline void BumpSpace::recycleBlock(BumpBlock* block)
+void CopiedSpace::doneCopying()
 {
     {
-        MutexLocker locker(m_heap->m_freeBlockLock);
-        m_heap->m_freeBlocks.push(block);
-        m_heap->m_numberOfFreeBlocks++;
+        MutexLocker locker(m_loanedBlocksLock);
+        while (m_numberOfLoanedBlocks > 0)
+            m_loanedBlocksCondition.wait(m_loanedBlocksLock);
     }
 
-    {
-        MutexLocker locker(m_loanedBlocksLock);
-        ASSERT(m_numberOfLoanedBlocks > 0);
-        m_numberOfLoanedBlocks--;
-        if (!m_numberOfLoanedBlocks)
-            m_loanedBlocksCondition.signal();
+    ASSERT(m_inCopyingPhase);
+    m_inCopyingPhase = false;
+    while (!m_fromSpace->isEmpty()) {
+        CopiedBlock* block = static_cast<CopiedBlock*>(m_fromSpace->removeHead());
+        if (block->m_isPinned) {
+            block->m_isPinned = false;
+            m_toSpace->push(block);
+            continue;
+        }
+
+        m_toSpaceSet.remove(block);
+        {
+            MutexLocker locker(m_heap->m_freeBlockLock);
+            m_heap->m_freeBlocks.push(block);
+            m_heap->m_numberOfFreeBlocks++;
+        }
     }
+
+    CopiedBlock* curr = static_cast<CopiedBlock*>(m_oversizeBlocks.head());
+    while (curr) {
+        CopiedBlock* next = static_cast<CopiedBlock*>(curr->next());
+        if (!curr->m_isPinned) {
+            m_oversizeBlocks.remove(curr);
+            m_totalMemoryAllocated -= curr->m_allocation.size();
+            m_totalMemoryUtilized -= curr->m_allocation.size() - sizeof(CopiedBlock);
+            curr->m_allocation.deallocate();
+        } else
+            curr->m_isPinned = false;
+        curr = next;
+    }
+
+    if (!m_toSpace->head()) {
+        if (!addNewBlock())
+            CRASH();
+    } else
+        m_allocator.resetCurrentBlock(static_cast<CopiedBlock*>(m_toSpace->head()));
 }
 
-inline CheckedBoolean BumpSpace::getFreshBlock(AllocationEffort allocationEffort, BumpBlock** outBlock)
+CheckedBoolean CopiedSpace::getFreshBlock(AllocationEffort allocationEffort, CopiedBlock** outBlock)
 {
     HeapBlock* heapBlock = 0;
-    BumpBlock* block = 0;
+    CopiedBlock* block = 0;
     {
         MutexLocker locker(m_heap->m_freeBlockLock);
         if (!m_heap->m_freeBlocks.isEmpty()) {
@@ -190,7 +237,7 @@ inline CheckedBoolean BumpSpace::getFreshBlock(AllocationEffort allocationEffort
         }
     }
     if (heapBlock)
-        block = new (NotNull, heapBlock) BumpBlock(heapBlock->m_allocation);
+        block = new (NotNull, heapBlock) CopiedBlock(heapBlock->m_allocation);
     else if (allocationEffort == AllocationMustSucceed) {
         if (!allocateNewBlock(&block)) {
             *outBlock = 0;
@@ -209,192 +256,9 @@ inline CheckedBoolean BumpSpace::getFreshBlock(AllocationEffort allocationEffort
         }
     }
     ASSERT(block);
-    ASSERT(isPointerAligned(block->m_offset));
+    ASSERT(is8ByteAligned(block->m_offset));
     *outBlock = block;
     return true;
 }
 
-inline CheckedBoolean BumpSpace::borrowBlock(BumpBlock** outBlock)
-{
-    BumpBlock* block = 0;
-    if (!getFreshBlock(AllocationMustSucceed, &block)) {
-        *outBlock = 0;
-        return false;
-    }
-
-    ASSERT(m_inCopyingPhase);
-    MutexLocker locker(m_loanedBlocksLock);
-    m_numberOfLoanedBlocks++;
-
-    ASSERT(block->m_offset == block->m_payload);
-    *outBlock = block;
-    return true;
-}
-
-inline CheckedBoolean BumpSpace::addNewBlock()
-{
-    BumpBlock* block = 0;
-    if (!getFreshBlock(AllocationCanFail, &block))
-        return false;
-        
-    m_toSpace->push(block);
-    m_currentBlock = block;
-    return true;
-}
-
-inline CheckedBoolean BumpSpace::allocateNewBlock(BumpBlock** outBlock)
-{
-    PageAllocationAligned allocation = PageAllocationAligned::allocate(s_blockSize, s_blockSize, OSAllocator::JSGCHeapPages);
-    if (!static_cast<bool>(allocation)) {
-        *outBlock = 0;
-        return false;
-    }
-
-    {
-        MutexLocker locker(m_memoryStatsLock);
-        m_totalMemoryAllocated += s_blockSize;
-    }
-
-    *outBlock = new (NotNull, allocation.base()) BumpBlock(allocation);
-    return true;
-}
-
-inline bool BumpSpace::fitsInBlock(BumpBlock* block, size_t bytes)
-{
-    return static_cast<char*>(block->m_offset) + bytes < reinterpret_cast<char*>(block) + s_blockSize && static_cast<char*>(block->m_offset) + bytes > block->m_offset;
-}
-
-inline bool BumpSpace::fitsInCurrentBlock(size_t bytes)
-{
-    return fitsInBlock(m_currentBlock, bytes);
-}
-
-inline CheckedBoolean BumpSpace::tryAllocate(size_t bytes, void** outPtr)
-{
-    ASSERT(!m_heap->globalData()->isInitializingObject());
-
-    if (isOversize(bytes) || !fitsInCurrentBlock(bytes))
-        return tryAllocateSlowCase(bytes, outPtr);
-    
-    *outPtr = allocateFromBlock(m_currentBlock, bytes);
-    return true;
-}
-
-inline CheckedBoolean BumpSpace::tryAllocateOversize(size_t bytes, void** outPtr)
-{
-    ASSERT(isOversize(bytes));
-    
-    size_t blockSize = WTF::roundUpToMultipleOf<s_pageSize>(sizeof(BumpBlock) + bytes);
-    PageAllocationAligned allocation = PageAllocationAligned::allocate(blockSize, s_pageSize, OSAllocator::JSGCHeapPages);
-    if (!static_cast<bool>(allocation)) {
-        *outPtr = 0;
-        return false;
-    }
-    BumpBlock* block = new (NotNull, allocation.base()) BumpBlock(allocation);
-    m_oversizeBlocks.push(block);
-    ASSERT(isPointerAligned(block->m_offset));
-
-    m_oversizeFilter.add(reinterpret_cast<Bits>(block));
-    
-    m_totalMemoryAllocated += blockSize;
-    m_totalMemoryUtilized += bytes;
-
-    *outPtr = block->m_offset;
-    return true;
-}
-
-inline void* BumpSpace::allocateFromBlock(BumpBlock* block, size_t bytes)
-{
-    ASSERT(!isOversize(bytes));
-    ASSERT(fitsInBlock(block, bytes));
-    ASSERT(isPointerAligned(block->m_offset));
-    
-    void* ptr = block->m_offset;
-    ASSERT(block->m_offset >= block->m_payload && block->m_offset < reinterpret_cast<char*>(block) + s_blockSize);
-    block->m_offset = static_cast<void*>((static_cast<char*>(ptr) + bytes));
-    ASSERT(block->m_offset >= block->m_payload && block->m_offset < reinterpret_cast<char*>(block) + s_blockSize);
-
-    ASSERT(isPointerAligned(ptr));
-    return ptr;
-}
-
-inline CheckedBoolean BumpSpace::tryReallocate(void** ptr, size_t oldSize, size_t newSize)
-{
-    if (oldSize >= newSize)
-        return true;
-    
-    void* oldPtr = *ptr;
-    ASSERT(!m_heap->globalData()->isInitializingObject());
-
-    if (isOversize(oldSize) || isOversize(newSize))
-        return tryReallocateOversize(ptr, oldSize, newSize);
-
-    if (static_cast<char*>(oldPtr) + oldSize == m_currentBlock->m_offset && oldPtr > m_currentBlock && oldPtr < reinterpret_cast<char*>(m_currentBlock) + s_blockSize) {
-        m_currentBlock->m_offset = oldPtr;
-        if (fitsInCurrentBlock(newSize)) {
-            m_totalMemoryUtilized += newSize - oldSize;
-            return allocateFromBlock(m_currentBlock, newSize);
-        }
-    }
-    m_totalMemoryUtilized -= oldSize;
-
-    void* result = 0;
-    if (!tryAllocate(newSize, &result)) {
-        *ptr = 0;
-        return false;
-    }
-    memcpy(result, oldPtr, oldSize);
-    *ptr = result;
-    return true;
-}
-
-inline CheckedBoolean BumpSpace::tryReallocateOversize(void** ptr, size_t oldSize, size_t newSize)
-{
-    ASSERT(isOversize(oldSize) || isOversize(newSize));
-    ASSERT(newSize > oldSize);
-
-    void* oldPtr = *ptr;
-    
-    void* newPtr = 0;
-    if (!tryAllocateOversize(newSize, &newPtr)) {
-        *ptr = 0;
-        return false;
-    }
-    memcpy(newPtr, oldPtr, oldSize);
-
-    if (isOversize(oldSize)) {
-        BumpBlock* oldBlock = oversizeBlockFor(oldPtr);
-        m_oversizeBlocks.remove(oldBlock);
-        oldBlock->m_allocation.deallocate();
-        m_totalMemoryAllocated -= oldSize + sizeof(BumpBlock);
-    }
-    
-    m_totalMemoryUtilized -= oldSize;
-
-    *ptr = newPtr;
-    return true;
-}
-
-inline bool BumpSpace::isOversize(size_t bytes)
-{
-    return bytes > s_maxAllocationSize;
-}
-
-inline bool BumpSpace::isPinned(void* ptr)
-{
-    return blockFor(ptr)->m_isPinned;
-}
-
-inline BumpBlock* BumpSpace::oversizeBlockFor(void* ptr)
-{
-    return reinterpret_cast<BumpBlock*>(reinterpret_cast<size_t>(ptr) & s_pageMask);
-}
-
-inline BumpBlock* BumpSpace::blockFor(void* ptr)
-{
-    return reinterpret_cast<BumpBlock*>(reinterpret_cast<size_t>(ptr) & s_blockMask);
-}
-
 } // namespace JSC
-
-#endif
diff --git a/Source/JavaScriptCore/heap/BumpSpace.h b/Source/JavaScriptCore/heap/CopiedSpace.h
index 30e6b74fe..285e2b9a2 100644
--- a/Source/JavaScriptCore/heap/BumpSpace.h
+++ b/Source/JavaScriptCore/heap/CopiedSpace.h
@@ -23,9 +23,10 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
  */
 
-#ifndef BumpSpace_h
-#define BumpSpace_h
+#ifndef CopiedSpace_h
+#define CopiedSpace_h
 
+#include "CopiedAllocator.h"
 #include "HeapBlock.h"
 #include "TinyBloomFilter.h"
 #include <wtf/Assertions.h>
@@ -40,13 +41,13 @@
 namespace JSC {
 
 class Heap;
-class BumpBlock;
+class CopiedBlock;
 class HeapBlock;
 
-class BumpSpace {
+class CopiedSpace {
     friend class SlotVisitor;
 public:
-    BumpSpace(Heap*);
+    CopiedSpace(Heap*);
     void init();
 
     CheckedBoolean tryAllocate(size_t, void**);
@@ -56,42 +57,41 @@ public:
     void doneCopying();
     bool isInCopyPhase() { return m_inCopyingPhase; }
 
-    void pin(BumpBlock*);
+    void pin(CopiedBlock*);
     bool isPinned(void*);
 
-    bool contains(void*, BumpBlock*&);
+    bool contains(void*, CopiedBlock*&);
 
     size_t totalMemoryAllocated() { return m_totalMemoryAllocated; }
     size_t totalMemoryUtilized() { return m_totalMemoryUtilized; }
 
-    static BumpBlock* blockFor(void*);
+    static CopiedBlock* blockFor(void*);
 
 private:
     CheckedBoolean tryAllocateSlowCase(size_t, void**);
     CheckedBoolean addNewBlock();
-    CheckedBoolean allocateNewBlock(BumpBlock**);
-    bool fitsInCurrentBlock(size_t);
+    CheckedBoolean allocateNewBlock(CopiedBlock**);
     
-    static void* allocateFromBlock(BumpBlock*, size_t);
+    static void* allocateFromBlock(CopiedBlock*, size_t);
     CheckedBoolean tryAllocateOversize(size_t, void**);
     CheckedBoolean tryReallocateOversize(void**, size_t, size_t);
     
     static bool isOversize(size_t);
     
-    CheckedBoolean borrowBlock(BumpBlock**);
-    CheckedBoolean getFreshBlock(AllocationEffort, BumpBlock**);
-    void doneFillingBlock(BumpBlock*);
-    void recycleBlock(BumpBlock*);
-    static bool fitsInBlock(BumpBlock*, size_t);
-    static BumpBlock* oversizeBlockFor(void* ptr);
+    CheckedBoolean borrowBlock(CopiedBlock**);
+    CheckedBoolean getFreshBlock(AllocationEffort, CopiedBlock**);
+    void doneFillingBlock(CopiedBlock*);
+    void recycleBlock(CopiedBlock*);
+    static bool fitsInBlock(CopiedBlock*, size_t);
+    static CopiedBlock* oversizeBlockFor(void* ptr);
 
     Heap* m_heap;
 
-    BumpBlock* m_currentBlock;
+    CopiedAllocator m_allocator;
 
     TinyBloomFilter m_toSpaceFilter;
     TinyBloomFilter m_oversizeFilter;
-    HashSet<BumpBlock*> m_toSpaceSet;
+    HashSet<CopiedBlock*> m_toSpaceSet;
 
     Mutex m_toSpaceLock;
     Mutex m_memoryStatsLock;
@@ -112,12 +112,11 @@ private:
     ThreadCondition m_loanedBlocksCondition;
     size_t m_numberOfLoanedBlocks;
 
-    static const size_t s_blockSize = 64 * KB;
     static const size_t s_maxAllocationSize = 32 * KB;
     static const size_t s_pageSize = 4 * KB;
     static const size_t s_pageMask = ~(s_pageSize - 1);
     static const size_t s_initialBlockNum = 16;
-    static const size_t s_blockMask = ~(s_blockSize - 1);
+    static const size_t s_blockMask = ~(HeapBlock::s_blockSize - 1);
 };
 
 } // namespace JSC
diff --git a/Source/JavaScriptCore/heap/CopiedSpaceInlineMethods.h b/Source/JavaScriptCore/heap/CopiedSpaceInlineMethods.h
new file mode 100644
index 000000000..9a1f63cec
--- /dev/null
+++ b/Source/JavaScriptCore/heap/CopiedSpaceInlineMethods.h
@@ -0,0 +1,184 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef CopiedSpaceInlineMethods_h
+#define CopiedSpaceInlineMethods_h
+
+#include "CopiedBlock.h"
+#include "CopiedSpace.h"
+#include "Heap.h"
+#include "HeapBlock.h"
+#include "JSGlobalData.h"
+#include <wtf/CheckedBoolean.h>
+
+namespace JSC {
+
+inline bool CopiedSpace::contains(void* ptr, CopiedBlock*& result)
+{
+    CopiedBlock* block = blockFor(ptr);
+    result = block;
+    return !m_toSpaceFilter.ruleOut(reinterpret_cast<Bits>(block)) && m_toSpaceSet.contains(block);
+}
+
+inline void CopiedSpace::pin(CopiedBlock* block)
+{
+    block->m_isPinned = true;
+}
+
+inline void CopiedSpace::startedCopying()
+{
+    DoublyLinkedList<HeapBlock>* temp = m_fromSpace;
+    m_fromSpace = m_toSpace;
+    m_toSpace = temp;
+
+    m_toSpaceFilter.reset();
+    m_allocator.startedCopying();
+
+    m_totalMemoryUtilized = 0;
+
+    ASSERT(!m_inCopyingPhase);
+    ASSERT(!m_numberOfLoanedBlocks);
+    m_inCopyingPhase = true;
+}
+
+inline void CopiedSpace::recycleBlock(CopiedBlock* block)
+{
+    {
+        MutexLocker locker(m_heap->m_freeBlockLock);
+        m_heap->m_freeBlocks.push(block);
+        m_heap->m_numberOfFreeBlocks++;
+    }
+
+    {
+        MutexLocker locker(m_loanedBlocksLock);
+        ASSERT(m_numberOfLoanedBlocks > 0);
+        m_numberOfLoanedBlocks--;
+        if (!m_numberOfLoanedBlocks)
+            m_loanedBlocksCondition.signal();
+    }
+}
+
+inline CheckedBoolean CopiedSpace::borrowBlock(CopiedBlock** outBlock)
+{
+    CopiedBlock* block = 0;
+    if (!getFreshBlock(AllocationMustSucceed, &block)) {
+        *outBlock = 0;
+        return false;
+    }
+
+    ASSERT(m_inCopyingPhase);
+    MutexLocker locker(m_loanedBlocksLock);
+    m_numberOfLoanedBlocks++;
+
+    ASSERT(block->m_offset == block->m_payload);
+    *outBlock = block;
+    return true;
+}
+
+inline CheckedBoolean CopiedSpace::addNewBlock()
+{
+    CopiedBlock* block = 0;
+    if (!getFreshBlock(AllocationCanFail, &block))
+        return false;
+        
+    m_toSpace->push(block);
+    m_toSpaceFilter.add(reinterpret_cast<Bits>(block));
+    m_toSpaceSet.add(block);
+    m_allocator.resetCurrentBlock(block);
+    return true;
+}
+
+inline CheckedBoolean CopiedSpace::allocateNewBlock(CopiedBlock** outBlock)
+{
+    PageAllocationAligned allocation = PageAllocationAligned::allocate(HeapBlock::s_blockSize, HeapBlock::s_blockSize, OSAllocator::JSGCHeapPages);
+    if (!static_cast<bool>(allocation)) {
+        *outBlock = 0;
+        return false;
+    }
+
+    {
+        MutexLocker locker(m_memoryStatsLock);
+        m_totalMemoryAllocated += HeapBlock::s_blockSize;
+    }
+
+    *outBlock = new (NotNull, allocation.base()) CopiedBlock(allocation);
+    return true;
+}
+
+inline bool CopiedSpace::fitsInBlock(CopiedBlock* block, size_t bytes)
+{
+    return static_cast<char*>(block->m_offset) + bytes < reinterpret_cast<char*>(block) + HeapBlock::s_blockSize && static_cast<char*>(block->m_offset) + bytes > block->m_offset;
+}
+
+inline CheckedBoolean CopiedSpace::tryAllocate(size_t bytes, void** outPtr)
+{
+    ASSERT(!m_heap->globalData()->isInitializingObject());
+
+    if (isOversize(bytes) || !m_allocator.fitsInCurrentBlock(bytes))
+        return tryAllocateSlowCase(bytes, outPtr);
+    
+    *outPtr = m_allocator.allocate(bytes);
+    ASSERT(*outPtr);
+    return true;
+}
+
+inline void* CopiedSpace::allocateFromBlock(CopiedBlock* block, size_t bytes)
+{
+    ASSERT(!isOversize(bytes));
+    ASSERT(fitsInBlock(block, bytes));
+    ASSERT(is8ByteAligned(block->m_offset));
+    
+    void* ptr = block->m_offset;
+    ASSERT(block->m_offset >= block->m_payload && block->m_offset < reinterpret_cast<char*>(block) + HeapBlock::s_blockSize);
+    block->m_offset = static_cast<void*>((static_cast<char*>(ptr) + bytes));
+    ASSERT(block->m_offset >= block->m_payload && block->m_offset < reinterpret_cast<char*>(block) + HeapBlock::s_blockSize);
+
+    ASSERT(is8ByteAligned(ptr));
+    return ptr;
+}
+
+inline bool CopiedSpace::isOversize(size_t bytes)
+{
+    return bytes > s_maxAllocationSize;
+}
+
+inline bool CopiedSpace::isPinned(void* ptr)
+{
+    return blockFor(ptr)->m_isPinned;
+}
+
+inline CopiedBlock* CopiedSpace::oversizeBlockFor(void* ptr)
+{
+    return reinterpret_cast<CopiedBlock*>(reinterpret_cast<size_t>(ptr) & s_pageMask);
+}
+
+inline CopiedBlock* CopiedSpace::blockFor(void* ptr)
+{
+    return reinterpret_cast<CopiedBlock*>(reinterpret_cast<size_t>(ptr) & s_blockMask);
+}
+
+} // namespace JSC
+
+#endif
diff --git a/Source/JavaScriptCore/heap/GCAssertions.h b/Source/JavaScriptCore/heap/GCAssertions.h
new file mode 100644
index 000000000..f044df6f0
--- /dev/null
+++ b/Source/JavaScriptCore/heap/GCAssertions.h
@@ -0,0 +1,56 @@
+/*
+ * Copyright (C) 2012 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef GCAssertions_h
+#define GCAssertions_h
+
+#include "Assertions.h"
+
+#if ENABLE(GC_VALIDATION)
+#define ASSERT_GC_OBJECT_LOOKS_VALID(cell) do { \
+    if (!(cell))\
+        CRASH();\
+    if (cell->unvalidatedStructure()->unvalidatedStructure() != cell->unvalidatedStructure()->unvalidatedStructure()->unvalidatedStructure())\
+        CRASH();\
+} while (0)
+
+#define ASSERT_GC_OBJECT_INHERITS(object, classInfo) do {\
+    ASSERT_GC_OBJECT_LOOKS_VALID(object); \
+    if (!object->inherits(classInfo)) \
+        CRASH();\
+} while (0)
+
+#else
+#define ASSERT_GC_OBJECT_LOOKS_VALID(cell) do { (void)cell; } while (0)
+#define ASSERT_GC_OBJECT_INHERITS(object, classInfo) do { (void)object; (void)classInfo; } while (0)
+#endif
+
+#if COMPILER_SUPPORTS(HAS_TRIVIAL_DESTRUCTOR)
+#define ASSERT_HAS_TRIVIAL_DESTRUCTOR(klass) COMPILE_ASSERT(__has_trivial_destructor(klass), klass##_has_trivial_destructor_check)
+#else
+#define ASSERT_HAS_TRIVIAL_DESTRUCTOR(klass)
+#endif
+
+#endif // GCAssertions_h
diff --git a/Source/JavaScriptCore/heap/Heap.cpp b/Source/JavaScriptCore/heap/Heap.cpp
index 9f5094a58..1333c7b2c 100644
--- a/Source/JavaScriptCore/heap/Heap.cpp
+++ b/Source/JavaScriptCore/heap/Heap.cpp
@@ -21,8 +21,8 @@
 #include "config.h"
 #include "Heap.h"
 
-#include "BumpSpace.h"
-#include "BumpSpaceInlineMethods.h"
+#include "CopiedSpace.h"
+#include "CopiedSpaceInlineMethods.h"
 #include "CodeBlock.h"
 #include "ConservativeRoots.h"
 #include "GCActivityCallback.h"
@@ -77,7 +77,7 @@ struct GCTimer {
     }
     ~GCTimer()
     {
-        printf("%s: %.2lfms (avg. %.2lf, min. %.2lf, max. %.2lf)\n", m_name, m_time * 1000, m_time * 1000 / m_count, m_min*1000, m_max*1000);
+        dataLog("%s: %.2lfms (avg. %.2lf, min. %.2lf, max. %.2lf)\n", m_name, m_time * 1000, m_time * 1000 / m_count, m_min*1000, m_max*1000);
     }
     double m_time;
     double m_min;
@@ -127,7 +127,7 @@ struct GCCounter {
     }
     ~GCCounter()
     {
-        printf("%s: %zu values (avg. %zu, min. %zu, max. %zu)\n", m_name, m_total, m_total / m_count, m_min, m_max);
+        dataLog("%s: %zu values (avg. %zu, min. %zu, max. %zu)\n", m_name, m_total, m_total / m_count, m_min, m_max);
     }
     const char* m_name;
     size_t m_count;
@@ -345,7 +345,7 @@ Heap::~Heap()
         m_blockFreeingThreadShouldQuit = true;
         m_freeBlockCondition.broadcast();
     }
-    waitForThreadCompletion(m_blockFreeingThread, 0);
+    waitForThreadCompletion(m_blockFreeingThread);
 
     // The destroy function must already have been called, so assert this.
     ASSERT(!m_globalData);
@@ -381,8 +381,8 @@ void Heap::destroy()
     ASSERT(!size());
     
 #if ENABLE(SIMPLE_HEAP_PROFILING)
-    m_slotVisitor.m_visitedTypeCounts.dump(stderr, "Visited Type Counts");
-    m_destroyedTypeCounts.dump(stderr, "Destroyed Type Counts");
+    m_slotVisitor.m_visitedTypeCounts.dump(WTF::dataFile(), "Visited Type Counts");
+    m_destroyedTypeCounts.dump(WTF::dataFile(), "Destroyed Type Counts");
 #endif
     
     releaseFreeBlocks();
@@ -407,10 +407,9 @@ void Heap::waitForRelativeTime(double relative)
     waitForRelativeTimeWhileHoldingLock(relative);
 }
 
-void* Heap::blockFreeingThreadStartFunc(void* heap)
+void Heap::blockFreeingThreadStartFunc(void* heap)
 {
     static_cast<Heap*>(heap)->blockFreeingThreadMain();
-    return 0;
 }
 
 void Heap::blockFreeingThreadMain()
diff --git a/Source/JavaScriptCore/heap/Heap.h b/Source/JavaScriptCore/heap/Heap.h
index 1d0ac5407..bcacee6d5 100644
--- a/Source/JavaScriptCore/heap/Heap.h
+++ b/Source/JavaScriptCore/heap/Heap.h
@@ -40,7 +40,7 @@
 
 namespace JSC {
 
-    class BumpSpace;
+    class CopiedSpace;
     class CodeBlock;
     class GCActivityCallback;
     class GlobalCodeBlock;
@@ -50,6 +50,7 @@ namespace JSC {
     class JSGlobalData;
     class JSValue;
     class LiveObjectIterator;
+    class LLIntOffsetsExtractor;
     class MarkedArgumentBuffer;
     class RegisterFile;
     class UString;
@@ -95,8 +96,9 @@ namespace JSC {
         // true if an allocation or collection is in progress
         inline bool isBusy();
         
-        MarkedAllocator& allocatorForObject(size_t bytes) { return m_objectSpace.allocatorFor(bytes); }
-        void* allocate(size_t);
+        MarkedAllocator& firstAllocatorWithoutDestructors() { return m_objectSpace.firstAllocator(); }
+        MarkedAllocator& allocatorForObjectWithoutDestructor(size_t bytes) { return m_objectSpace.allocatorFor(bytes); }
+        MarkedAllocator& allocatorForObjectWithDestructor(size_t bytes) { return m_objectSpace.destructorAllocatorFor(bytes); }
         CheckedBoolean tryAllocateStorage(size_t, void**);
         CheckedBoolean tryReallocateStorage(void**, size_t, size_t);
 
@@ -136,12 +138,17 @@ namespace JSC {
         void getConservativeRegisterRoots(HashSet<JSCell*>& roots);
 
     private:
+        friend class CodeBlock;
+        friend class LLIntOffsetsExtractor;
         friend class MarkedSpace;
         friend class MarkedAllocator;
         friend class MarkedBlock;
-        friend class BumpSpace;
+        friend class CopiedSpace;
         friend class SlotVisitor;
-        friend class CodeBlock;
+        template<typename T> friend void* allocateCell(Heap&);
+
+        void* allocateWithDestructor(size_t);
+        void* allocateWithoutDestructor(size_t);
 
         size_t waterMark();
         size_t highWaterMark();
@@ -183,7 +190,7 @@ namespace JSC {
         void waitForRelativeTimeWhileHoldingLock(double relative);
         void waitForRelativeTime(double relative);
         void blockFreeingThreadMain();
-        static void* blockFreeingThreadStartFunc(void* heap);
+        static void blockFreeingThreadStartFunc(void* heap);
         
         const HeapSize m_heapSize;
         const size_t m_minBytesPerCycle;
@@ -193,7 +200,7 @@ namespace JSC {
         
         OperationInProgress m_operationInProgress;
         MarkedSpace m_objectSpace;
-        BumpSpace m_storageSpace;
+        CopiedSpace m_storageSpace;
 
         DoublyLinkedList<HeapBlock> m_freeBlocks;
         size_t m_numberOfFreeBlocks;
@@ -334,10 +341,16 @@ namespace JSC {
         return forEachProtectedCell(functor);
     }
 
-    inline void* Heap::allocate(size_t bytes)
+    inline void* Heap::allocateWithDestructor(size_t bytes)
+    {
+        ASSERT(isValidAllocation(bytes));
+        return m_objectSpace.allocateWithDestructor(bytes);
+    }
+    
+    inline void* Heap::allocateWithoutDestructor(size_t bytes)
     {
         ASSERT(isValidAllocation(bytes));
-        return m_objectSpace.allocate(bytes);
+        return m_objectSpace.allocateWithoutDestructor(bytes);
     }
     
     inline CheckedBoolean Heap::tryAllocateStorage(size_t bytes, void** outPtr)
diff --git a/Source/JavaScriptCore/heap/HeapBlock.h b/Source/JavaScriptCore/heap/HeapBlock.h
index b0ecb2059..591520d2b 100644
--- a/Source/JavaScriptCore/heap/HeapBlock.h
+++ b/Source/JavaScriptCore/heap/HeapBlock.h
@@ -28,6 +28,7 @@
 
 #include <wtf/DoublyLinkedList.h>
 #include <wtf/PageAllocationAligned.h>
+#include <wtf/StdLibExtras.h>
 
 namespace JSC {
 
@@ -47,6 +48,8 @@ public:
     HeapBlock* m_prev;
     HeapBlock* m_next;
     PageAllocationAligned m_allocation;
+    
+    static const size_t s_blockSize = 64 * KB;
 };
 
 } // namespace JSC
diff --git a/Source/JavaScriptCore/heap/MarkStack.cpp b/Source/JavaScriptCore/heap/MarkStack.cpp
index 9a3092396..129a7ab67 100644
--- a/Source/JavaScriptCore/heap/MarkStack.cpp
+++ b/Source/JavaScriptCore/heap/MarkStack.cpp
@@ -26,8 +26,8 @@
 #include "config.h"
 #include "MarkStack.h"
 
-#include "BumpSpace.h"
-#include "BumpSpaceInlineMethods.h"
+#include "CopiedSpace.h"
+#include "CopiedSpaceInlineMethods.h"
 #include "ConservativeRoots.h"
 #include "Heap.h"
 #include "Options.h"
@@ -226,16 +226,15 @@ void MarkStackThreadSharedData::markingThreadMain()
     slotVisitor.drainFromShared(SlotVisitor::SlaveDrain);
 }
 
-void* MarkStackThreadSharedData::markingThreadStartFunc(void* shared)
+void MarkStackThreadSharedData::markingThreadStartFunc(void* shared)
 {
     static_cast<MarkStackThreadSharedData*>(shared)->markingThreadMain();
-    return 0;
 }
 #endif
 
 MarkStackThreadSharedData::MarkStackThreadSharedData(JSGlobalData* globalData)
     : m_globalData(globalData)
-    , m_bumpSpace(&globalData->heap.m_storageSpace)
+    , m_copiedSpace(&globalData->heap.m_storageSpace)
     , m_sharedMarkStack(m_segmentAllocator)
     , m_numberOfActiveParallelMarkers(0)
     , m_parallelMarkersShouldExit(false)
@@ -258,7 +257,7 @@ MarkStackThreadSharedData::~MarkStackThreadSharedData()
         m_markingCondition.broadcast();
     }
     for (unsigned i = 0; i < m_markingThreads.size(); ++i)
-        waitForThreadCompletion(m_markingThreads[i], 0);
+        waitForThreadCompletion(m_markingThreads[i]);
 #endif
 }
     
@@ -304,7 +303,7 @@ ALWAYS_INLINE static void visitChildren(SlotVisitor& visitor, const JSCell* cell
 #endif
 
     ASSERT(Heap::isMarked(cell));
-
+    
     if (isJSString(cell)) {
         JSString::visitChildren(const_cast<JSCell*>(cell), visitor);
         return;
@@ -402,7 +401,7 @@ void SlotVisitor::drainFromShared(SharedDrainMode sharedDrainMode)
                 while (true) {
                     // Did we reach termination?
                     if (!m_shared.m_numberOfActiveParallelMarkers && m_shared.m_sharedMarkStack.isEmpty()) {
-                        // Let any sleeping slaves know it's time for them to give their private BumpBlocks back
+                        // Let any sleeping slaves know it's time for them to give their private CopiedBlocks back
                         m_shared.m_markingCondition.broadcast();
                         return;
                     }
@@ -459,32 +458,32 @@ void MarkStack::mergeOpaqueRoots()
 void SlotVisitor::startCopying()
 {
     ASSERT(!m_copyBlock);
-    if (!m_shared.m_bumpSpace->borrowBlock(&m_copyBlock))
+    if (!m_shared.m_copiedSpace->borrowBlock(&m_copyBlock))
         CRASH();
 }    
 
 void* SlotVisitor::allocateNewSpace(void* ptr, size_t bytes)
 {
-    if (BumpSpace::isOversize(bytes)) {
-        m_shared.m_bumpSpace->pin(BumpSpace::oversizeBlockFor(ptr));
+    if (CopiedSpace::isOversize(bytes)) {
+        m_shared.m_copiedSpace->pin(CopiedSpace::oversizeBlockFor(ptr));
         return 0;
     }
 
-    if (m_shared.m_bumpSpace->isPinned(ptr))
+    if (m_shared.m_copiedSpace->isPinned(ptr))
         return 0;
 
     // The only time it's possible to have a null copy block is if we have just started copying.
     if (!m_copyBlock)
         startCopying();
 
-    if (!BumpSpace::fitsInBlock(m_copyBlock, bytes)) {
+    if (!CopiedSpace::fitsInBlock(m_copyBlock, bytes)) {
         // We don't need to lock across these two calls because the master thread won't 
         // call doneCopying() because this thread is considered active.
-        m_shared.m_bumpSpace->doneFillingBlock(m_copyBlock);
-        if (!m_shared.m_bumpSpace->borrowBlock(&m_copyBlock))
+        m_shared.m_copiedSpace->doneFillingBlock(m_copyBlock);
+        if (!m_shared.m_copiedSpace->borrowBlock(&m_copyBlock))
             CRASH();
     }
-    return BumpSpace::allocateFromBlock(m_copyBlock, bytes);
+    return CopiedSpace::allocateFromBlock(m_copyBlock, bytes);
 }
 
 void SlotVisitor::copy(void** ptr, size_t bytes)
@@ -524,7 +523,7 @@ void SlotVisitor::doneCopying()
     if (!m_copyBlock)
         return;
 
-    m_shared.m_bumpSpace->doneFillingBlock(m_copyBlock);
+    m_shared.m_copiedSpace->doneFillingBlock(m_copyBlock);
 
     m_copyBlock = 0;
 }
diff --git a/Source/JavaScriptCore/heap/MarkStack.h b/Source/JavaScriptCore/heap/MarkStack.h
index 6923cdd8a..0695b1b32 100644
--- a/Source/JavaScriptCore/heap/MarkStack.h
+++ b/Source/JavaScriptCore/heap/MarkStack.h
@@ -26,7 +26,7 @@
 #ifndef MarkStack_h
 #define MarkStack_h
 
-#include "BumpSpace.h"
+#include "CopiedSpace.h"
 #include "HandleTypes.h"
 #include "Options.h"
 #include "JSValue.h"
@@ -178,11 +178,11 @@ namespace JSC {
 
 #if ENABLE(PARALLEL_GC)
         void markingThreadMain();
-        static void* markingThreadStartFunc(void* heap);
+        static void markingThreadStartFunc(void* heap);
 #endif
 
         JSGlobalData* m_globalData;
-        BumpSpace* m_bumpSpace;
+        CopiedSpace* m_copiedSpace;
         
         MarkStackSegmentAllocator m_segmentAllocator;
         
diff --git a/Source/JavaScriptCore/heap/MarkedAllocator.cpp b/Source/JavaScriptCore/heap/MarkedAllocator.cpp
index 8239fbaed..eb6d2c691 100644
--- a/Source/JavaScriptCore/heap/MarkedAllocator.cpp
+++ b/Source/JavaScriptCore/heap/MarkedAllocator.cpp
@@ -97,11 +97,11 @@ MarkedBlock* MarkedAllocator::allocateBlock(AllocationEffort allocationEffort)
             block = 0;
     }
     if (block)
-        block = MarkedBlock::recycle(block, m_heap, m_cellSize);
+        block = MarkedBlock::recycle(block, m_heap, m_cellSize, m_cellsNeedDestruction);
     else if (allocationEffort == AllocationCanFail)
         return 0;
     else
-        block = MarkedBlock::create(m_heap, m_cellSize);
+        block = MarkedBlock::create(m_heap, m_cellSize, m_cellsNeedDestruction);
     
     m_markedSpace->didAddBlock(block);
     
diff --git a/Source/JavaScriptCore/heap/MarkedAllocator.h b/Source/JavaScriptCore/heap/MarkedAllocator.h
index 5644c691b..1c6af77a2 100644
--- a/Source/JavaScriptCore/heap/MarkedAllocator.h
+++ b/Source/JavaScriptCore/heap/MarkedAllocator.h
@@ -8,6 +8,7 @@ namespace JSC {
 
 class Heap;
 class MarkedSpace;
+class LLIntOffsetsExtractor;
 
 namespace DFG {
 class SpeculativeJIT;
@@ -22,6 +23,7 @@ public:
     void reset();
     void zapFreeList();
     size_t cellSize() { return m_cellSize; }
+    bool cellsNeedDestruction() { return m_cellsNeedDestruction; }
     void* allocate();
     Heap* heap() { return m_heap; }
     
@@ -29,11 +31,11 @@ public:
     
     void addBlock(MarkedBlock*);
     void removeBlock(MarkedBlock*);
-    void setHeap(Heap* heap) { m_heap = heap; }
-    void setCellSize(size_t cellSize) { m_cellSize = cellSize; }
-    void setMarkedSpace(MarkedSpace* space) { m_markedSpace = space; }
+    void init(Heap*, MarkedSpace*, size_t cellSize, bool cellsNeedDestruction);
     
 private:
+    friend class LLIntOffsetsExtractor;
+    
     JS_EXPORT_PRIVATE void* allocateSlowCase();
     void* tryAllocate();
     void* tryAllocateHelper();
@@ -43,6 +45,7 @@ private:
     MarkedBlock* m_currentBlock;
     DoublyLinkedList<HeapBlock> m_blockList;
     size_t m_cellSize;
+    bool m_cellsNeedDestruction;
     Heap* m_heap;
     MarkedSpace* m_markedSpace;
 };
@@ -51,11 +54,20 @@ inline MarkedAllocator::MarkedAllocator()
     : m_firstFreeCell(0)
     , m_currentBlock(0)
     , m_cellSize(0)
+    , m_cellsNeedDestruction(true)
     , m_heap(0)
     , m_markedSpace(0)
 {
 }
-    
+
+inline void MarkedAllocator::init(Heap* heap, MarkedSpace* markedSpace, size_t cellSize, bool cellsNeedDestruction)
+{
+    m_heap = heap;
+    m_markedSpace = markedSpace;
+    m_cellSize = cellSize;
+    m_cellsNeedDestruction = cellsNeedDestruction;
+}
+
 inline void* MarkedAllocator::allocate()
 {
     MarkedBlock::FreeCell* firstFreeCell = m_firstFreeCell;
diff --git a/Source/JavaScriptCore/heap/MarkedBlock.cpp b/Source/JavaScriptCore/heap/MarkedBlock.cpp
index dd9233300..75c21e7dd 100644
--- a/Source/JavaScriptCore/heap/MarkedBlock.cpp
+++ b/Source/JavaScriptCore/heap/MarkedBlock.cpp
@@ -32,17 +32,17 @@
 
 namespace JSC {
 
-MarkedBlock* MarkedBlock::create(Heap* heap, size_t cellSize)
+MarkedBlock* MarkedBlock::create(Heap* heap, size_t cellSize, bool cellsNeedDestruction)
 {
     PageAllocationAligned allocation = PageAllocationAligned::allocate(blockSize, blockSize, OSAllocator::JSGCHeapPages);
     if (!static_cast<bool>(allocation))
         CRASH();
-    return new (NotNull, allocation.base()) MarkedBlock(allocation, heap, cellSize);
+    return new (NotNull, allocation.base()) MarkedBlock(allocation, heap, cellSize, cellsNeedDestruction);
 }
 
-MarkedBlock* MarkedBlock::recycle(MarkedBlock* block, Heap* heap, size_t cellSize)
+MarkedBlock* MarkedBlock::recycle(MarkedBlock* block, Heap* heap, size_t cellSize, bool cellsNeedDestruction)
 {
-    return new (NotNull, block) MarkedBlock(block->m_allocation, heap, cellSize);
+    return new (NotNull, block) MarkedBlock(block->m_allocation, heap, cellSize, cellsNeedDestruction);
 }
 
 void MarkedBlock::destroy(MarkedBlock* block)
@@ -50,10 +50,11 @@ void MarkedBlock::destroy(MarkedBlock* block)
     block->m_allocation.deallocate();
 }
 
-MarkedBlock::MarkedBlock(PageAllocationAligned& allocation, Heap* heap, size_t cellSize)
+MarkedBlock::MarkedBlock(PageAllocationAligned& allocation, Heap* heap, size_t cellSize, bool cellsNeedDestruction)
     : HeapBlock(allocation)
     , m_atomsPerCell((cellSize + atomSize - 1) / atomSize)
     , m_endAtom(atomsPerBlock - m_atomsPerCell + 1)
+    , m_cellsNeedDestruction(cellsNeedDestruction)
     , m_state(New) // All cells start out unmarked.
     , m_heap(heap)
 {
@@ -70,16 +71,16 @@ inline void MarkedBlock::callDestructor(JSCell* cell)
 #if ENABLE(SIMPLE_HEAP_PROFILING)
     m_heap->m_destroyedTypeCounts.countVPtr(vptr);
 #endif
-    if (cell->classInfo() != &JSFinalObject::s_info)
-        cell->methodTable()->destroy(cell);
+    cell->methodTable()->destroy(cell);
 
     cell->zap();
 }
 
-template<MarkedBlock::BlockState blockState, MarkedBlock::SweepMode sweepMode>
+template<MarkedBlock::BlockState blockState, MarkedBlock::SweepMode sweepMode, bool destructorCallNeeded>
 MarkedBlock::FreeCell* MarkedBlock::specializedSweep()
 {
     ASSERT(blockState != Allocated && blockState != FreeListed);
+    ASSERT(destructorCallNeeded || sweepMode != SweepOnly);
 
     // This produces a free list that is ordered in reverse through the block.
     // This is fine, since the allocation code makes no assumptions about the
@@ -93,7 +94,7 @@ MarkedBlock::FreeCell* MarkedBlock::specializedSweep()
         if (blockState == Zapped && !cell->isZapped())
             continue;
 
-        if (blockState != New)
+        if (destructorCallNeeded && blockState != New)
             callDestructor(cell);
 
         if (sweepMode == SweepToFreeList) {
@@ -111,10 +112,21 @@ MarkedBlock::FreeCell* MarkedBlock::sweep(SweepMode sweepMode)
 {
     HEAP_LOG_BLOCK_STATE_TRANSITION(this);
 
+    if (sweepMode == SweepOnly && !m_cellsNeedDestruction)
+        return 0;
+
+    if (m_cellsNeedDestruction)
+        return sweepHelper<true>(sweepMode);
+    return sweepHelper<false>(sweepMode);
+}
+
+template<bool destructorCallNeeded>
+MarkedBlock::FreeCell* MarkedBlock::sweepHelper(SweepMode sweepMode)
+{
     switch (m_state) {
     case New:
         ASSERT(sweepMode == SweepToFreeList);
-        return specializedSweep<New, SweepToFreeList>();
+        return specializedSweep<New, SweepToFreeList, destructorCallNeeded>();
     case FreeListed:
         // Happens when a block transitions to fully allocated.
         ASSERT(sweepMode == SweepToFreeList);
@@ -124,12 +136,12 @@ MarkedBlock::FreeCell* MarkedBlock::sweep(SweepMode sweepMode)
         return 0;
     case Marked:
         return sweepMode == SweepToFreeList
-            ? specializedSweep<Marked, SweepToFreeList>()
-            : specializedSweep<Marked, SweepOnly>();
+            ? specializedSweep<Marked, SweepToFreeList, destructorCallNeeded>()
+            : specializedSweep<Marked, SweepOnly, destructorCallNeeded>();
     case Zapped:
         return sweepMode == SweepToFreeList
-            ? specializedSweep<Zapped, SweepToFreeList>()
-            : specializedSweep<Zapped, SweepOnly>();
+            ? specializedSweep<Zapped, SweepToFreeList, destructorCallNeeded>()
+            : specializedSweep<Zapped, SweepOnly, destructorCallNeeded>();
     }
 
     ASSERT_NOT_REACHED();
diff --git a/Source/JavaScriptCore/heap/MarkedBlock.h b/Source/JavaScriptCore/heap/MarkedBlock.h
index 0a4ebe47e..5f70b69d4 100644
--- a/Source/JavaScriptCore/heap/MarkedBlock.h
+++ b/Source/JavaScriptCore/heap/MarkedBlock.h
@@ -26,6 +26,7 @@
 #include "HeapBlock.h"
 
 #include <wtf/Bitmap.h>
+#include <wtf/DataLog.h>
 #include <wtf/DoublyLinkedList.h>
 #include <wtf/HashFunctions.h>
 #include <wtf/PageAllocationAligned.h>
@@ -36,9 +37,11 @@
 #define HEAP_LOG_BLOCK_STATE_TRANSITIONS 0
 
 #if HEAP_LOG_BLOCK_STATE_TRANSITIONS
-#define HEAP_LOG_BLOCK_STATE_TRANSITION(block) do {                                  \
-        printf("%s:%d %s: block %s = %p, %d\n",                                      \
-               __FILE__, __LINE__, __FUNCTION__, #block, (block), (block)->m_state); \
+#define HEAP_LOG_BLOCK_STATE_TRANSITION(block) do {                     \
+        dataLog(                                                    \
+            "%s:%d %s: block %s = %p, %d\n",                            \
+            __FILE__, __LINE__, __FUNCTION__,                           \
+            #block, (block), (block)->m_state);                         \
     } while (false)
 #else
 #define HEAP_LOG_BLOCK_STATE_TRANSITION(block) ((void)0)
@@ -89,8 +92,8 @@ namespace JSC {
             void returnValue() { }
         };
 
-        static MarkedBlock* create(Heap*, size_t cellSize);
-        static MarkedBlock* recycle(MarkedBlock*, Heap*, size_t cellSize);
+        static MarkedBlock* create(Heap*, size_t cellSize, bool cellsNeedDestruction);
+        static MarkedBlock* recycle(MarkedBlock*, Heap*, size_t cellSize, bool cellsNeedDestruction);
         static void destroy(MarkedBlock*);
 
         static bool isAtomAligned(const void*);
@@ -115,6 +118,7 @@ namespace JSC {
         bool markCountIsZero(); // Faster than markCount().
 
         size_t cellSize();
+        bool cellsNeedDestruction();
 
         size_t size();
         size_t capacity();
@@ -159,14 +163,15 @@ namespace JSC {
         static const size_t atomAlignmentMask = atomSize - 1; // atomSize must be a power of two.
 
         enum BlockState { New, FreeListed, Allocated, Marked, Zapped };
+        template<bool destructorCallNeeded> FreeCell* sweepHelper(SweepMode = SweepOnly);
 
         typedef char Atom[atomSize];
 
-        MarkedBlock(PageAllocationAligned&, Heap*, size_t cellSize);
+        MarkedBlock(PageAllocationAligned&, Heap*, size_t cellSize, bool cellsNeedDestruction);
         Atom* atoms();
         size_t atomNumber(const void*);
         void callDestructor(JSCell*);
-        template<BlockState, SweepMode> FreeCell* specializedSweep();
+        template<BlockState, SweepMode, bool destructorCallNeeded> FreeCell* specializedSweep();
         
 #if ENABLE(GGC)
         CardSet<bytesPerCard, blockSize> m_cards;
@@ -179,6 +184,7 @@ namespace JSC {
 #else
         WTF::Bitmap<atomsPerBlock, WTF::BitmapNotAtomic> m_marks;
 #endif
+        bool m_cellsNeedDestruction;
         BlockState m_state;
         Heap* m_heap;
     };
@@ -243,6 +249,11 @@ namespace JSC {
         return m_atomsPerCell * atomSize;
     }
 
+    inline bool MarkedBlock::cellsNeedDestruction()
+    {
+        return m_cellsNeedDestruction; 
+    }
+
     inline size_t MarkedBlock::size()
     {
         return markCount() * cellSize();
diff --git a/Source/JavaScriptCore/heap/MarkedSpace.cpp b/Source/JavaScriptCore/heap/MarkedSpace.cpp
index 87dc0493d..bf839011d 100644
--- a/Source/JavaScriptCore/heap/MarkedSpace.cpp
+++ b/Source/JavaScriptCore/heap/MarkedSpace.cpp
@@ -36,15 +36,13 @@ MarkedSpace::MarkedSpace(Heap* heap)
     , m_heap(heap)
 {
     for (size_t cellSize = preciseStep; cellSize <= preciseCutoff; cellSize += preciseStep) {
-        allocatorFor(cellSize).setCellSize(cellSize);
-        allocatorFor(cellSize).setHeap(heap);
-        allocatorFor(cellSize).setMarkedSpace(this);
+        allocatorFor(cellSize).init(heap, this, cellSize, false);
+        destructorAllocatorFor(cellSize).init(heap, this, cellSize, true);
     }
 
     for (size_t cellSize = impreciseStep; cellSize <= impreciseCutoff; cellSize += impreciseStep) {
-        allocatorFor(cellSize).setCellSize(cellSize);
-        allocatorFor(cellSize).setHeap(heap);
-        allocatorFor(cellSize).setMarkedSpace(this);
+        allocatorFor(cellSize).init(heap, this, cellSize, false);
+        destructorAllocatorFor(cellSize).init(heap, this, cellSize, true);
     }
 }
 
@@ -53,20 +51,28 @@ void MarkedSpace::resetAllocators()
     m_waterMark = 0;
     m_nurseryWaterMark = 0;
 
-    for (size_t cellSize = preciseStep; cellSize <= preciseCutoff; cellSize += preciseStep)
+    for (size_t cellSize = preciseStep; cellSize <= preciseCutoff; cellSize += preciseStep) {
         allocatorFor(cellSize).reset();
+        destructorAllocatorFor(cellSize).reset();
+    }
 
-    for (size_t cellSize = impreciseStep; cellSize <= impreciseCutoff; cellSize += impreciseStep)
+    for (size_t cellSize = impreciseStep; cellSize <= impreciseCutoff; cellSize += impreciseStep) {
         allocatorFor(cellSize).reset();
+        destructorAllocatorFor(cellSize).reset();
+    }
 }
 
 void MarkedSpace::canonicalizeCellLivenessData()
 {
-    for (size_t cellSize = preciseStep; cellSize <= preciseCutoff; cellSize += preciseStep)
+    for (size_t cellSize = preciseStep; cellSize <= preciseCutoff; cellSize += preciseStep) {
         allocatorFor(cellSize).zapFreeList();
+        destructorAllocatorFor(cellSize).zapFreeList();
+    }
 
-    for (size_t cellSize = impreciseStep; cellSize <= impreciseCutoff; cellSize += impreciseStep)
+    for (size_t cellSize = impreciseStep; cellSize <= impreciseCutoff; cellSize += impreciseStep) {
         allocatorFor(cellSize).zapFreeList();
+        destructorAllocatorFor(cellSize).zapFreeList();
+    }
 }
 
 
@@ -107,7 +113,7 @@ inline void TakeIfUnmarked::operator()(MarkedBlock* block)
     if (!block->markCountIsZero())
         return;
     
-    m_markedSpace->allocatorFor(block->cellSize()).removeBlock(block);
+    m_markedSpace->allocatorFor(block).removeBlock(block);
     m_empties.append(block);
 }
 
diff --git a/Source/JavaScriptCore/heap/MarkedSpace.h b/Source/JavaScriptCore/heap/MarkedSpace.h
index 21a0b48de..cfcf3f8dc 100644
--- a/Source/JavaScriptCore/heap/MarkedSpace.h
+++ b/Source/JavaScriptCore/heap/MarkedSpace.h
@@ -41,6 +41,7 @@ namespace JSC {
 class Heap;
 class JSCell;
 class LiveObjectIterator;
+class LLIntOffsetsExtractor;
 class WeakGCHandle;
 class SlotVisitor;
 
@@ -51,8 +52,12 @@ public:
 
     MarkedSpace(Heap*);
 
+    MarkedAllocator& firstAllocator();
     MarkedAllocator& allocatorFor(size_t);
-    void* allocate(size_t);
+    MarkedAllocator& allocatorFor(MarkedBlock*);
+    MarkedAllocator& destructorAllocatorFor(size_t);
+    void* allocateWithDestructor(size_t);
+    void* allocateWithoutDestructor(size_t);
     
     void resetAllocators();
 
@@ -76,6 +81,8 @@ public:
     void didConsumeFreeList(MarkedBlock*);
 
 private:
+    friend class LLIntOffsetsExtractor;
+    
     // [ 32... 256 ]
     static const size_t preciseStep = MarkedBlock::atomSize;
     static const size_t preciseCutoff = 256;
@@ -86,8 +93,14 @@ private:
     static const size_t impreciseCutoff = maxCellSize;
     static const size_t impreciseCount = impreciseCutoff / impreciseStep;
 
-    FixedArray<MarkedAllocator, preciseCount> m_preciseSizeClasses;
-    FixedArray<MarkedAllocator, impreciseCount> m_impreciseSizeClasses;
+    struct Subspace {
+        FixedArray<MarkedAllocator, preciseCount> preciseAllocators;
+        FixedArray<MarkedAllocator, impreciseCount> impreciseAllocators;
+    };
+
+    Subspace m_destructorSpace;
+    Subspace m_normalSpace;
+
     size_t m_waterMark;
     size_t m_nurseryWaterMark;
     Heap* m_heap;
@@ -120,27 +133,54 @@ template<typename Functor> inline typename Functor::ReturnType MarkedSpace::forE
     return forEachCell(functor);
 }
 
+inline MarkedAllocator& MarkedSpace::firstAllocator()
+{
+    return m_normalSpace.preciseAllocators[0];
+}
+
 inline MarkedAllocator& MarkedSpace::allocatorFor(size_t bytes)
 {
     ASSERT(bytes && bytes <= maxCellSize);
     if (bytes <= preciseCutoff)
-        return m_preciseSizeClasses[(bytes - 1) / preciseStep];
-    return m_impreciseSizeClasses[(bytes - 1) / impreciseStep];
+        return m_normalSpace.preciseAllocators[(bytes - 1) / preciseStep];
+    return m_normalSpace.impreciseAllocators[(bytes - 1) / impreciseStep];
+}
+
+inline MarkedAllocator& MarkedSpace::allocatorFor(MarkedBlock* block)
+{
+    if (block->cellsNeedDestruction())
+        return destructorAllocatorFor(block->cellSize());
+    return allocatorFor(block->cellSize());
 }
 
-inline void* MarkedSpace::allocate(size_t bytes)
+inline MarkedAllocator& MarkedSpace::destructorAllocatorFor(size_t bytes)
+{
+    ASSERT(bytes && bytes <= maxCellSize);
+    if (bytes <= preciseCutoff)
+        return m_destructorSpace.preciseAllocators[(bytes - 1) / preciseStep];
+    return m_destructorSpace.impreciseAllocators[(bytes - 1) / impreciseStep];
+}
+
+inline void* MarkedSpace::allocateWithoutDestructor(size_t bytes)
 {
     return allocatorFor(bytes).allocate();
 }
 
+inline void* MarkedSpace::allocateWithDestructor(size_t bytes)
+{
+    return destructorAllocatorFor(bytes).allocate();
+}
+
 template <typename Functor> inline typename Functor::ReturnType MarkedSpace::forEachBlock(Functor& functor)
 {
     for (size_t i = 0; i < preciseCount; ++i) {
-        m_preciseSizeClasses[i].forEachBlock(functor);
+        m_normalSpace.preciseAllocators[i].forEachBlock(functor);
+        m_destructorSpace.preciseAllocators[i].forEachBlock(functor);
     }
 
     for (size_t i = 0; i < impreciseCount; ++i) {
-        m_impreciseSizeClasses[i].forEachBlock(functor);
+        m_normalSpace.impreciseAllocators[i].forEachBlock(functor);
+        m_destructorSpace.impreciseAllocators[i].forEachBlock(functor);
     }
 
     return functor.returnValue();
diff --git a/Source/JavaScriptCore/heap/PassWeak.h b/Source/JavaScriptCore/heap/PassWeak.h
new file mode 100644
index 000000000..b7aa7b10d
--- /dev/null
+++ b/Source/JavaScriptCore/heap/PassWeak.h
@@ -0,0 +1,147 @@
+/*
+ * Copyright (C) 2012 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef PassWeak_h
+#define PassWeak_h
+
+#include "Assertions.h"
+#include "Handle.h"
+#include "NullPtr.h"
+#include "TypeTraits.h"
+
+namespace JSC {
+
+template<typename T> class Weak;
+template<typename T> class PassWeak;
+template<typename T> PassWeak<T> adoptWeak(HandleSlot);
+
+template<typename T> class PassWeak : public Handle<T> {
+    using Handle<T>::slot;
+    using Handle<T>::setSlot;
+
+public:
+    typedef typename Handle<T>::ExternalType ExternalType;
+
+    PassWeak() : Handle<T>() { }
+    PassWeak(std::nullptr_t) : Handle<T>() { }
+
+    PassWeak(JSGlobalData& globalData, ExternalType externalType = ExternalType(), WeakHandleOwner* weakOwner = 0, void* context = 0)
+        : Handle<T>(globalData.heap.handleHeap()->allocate())
+    {
+        HandleHeap::heapFor(slot())->makeWeak(slot(), weakOwner, context);
+        JSValue value = HandleTypes<T>::toJSValue(externalType);
+        HandleHeap::heapFor(slot())->writeBarrier(slot(), value);
+        *slot() = value;
+    }
+
+    // It somewhat breaks the type system to allow transfer of ownership out of
+    // a const PassWeak. However, it makes it much easier to work with PassWeak
+    // temporaries, and we don't have a need to use real const PassWeaks anyway.
+    PassWeak(const PassWeak& o) : Handle<T>(o.leakHandle()) { }
+    template<typename U> PassWeak(const PassWeak<U>& o) : Handle<T>(o.leakHandle()) { }
+
+    ~PassWeak()
+    {
+        if (!slot())
+            return;
+        HandleHeap::heapFor(slot())->deallocate(slot());
+        setSlot(0);
+    }
+
+    ExternalType get() const { return  HandleTypes<T>::getFromSlot(slot()); }
+
+    HandleSlot leakHandle() const WARN_UNUSED_RETURN;
+
+private:
+    friend PassWeak adoptWeak<T>(HandleSlot);
+
+    explicit PassWeak(HandleSlot slot) : Handle<T>(slot) { }
+};
+
+template<typename T> inline HandleSlot PassWeak<T>::leakHandle() const
+{
+    HandleSlot slot = this->slot();
+    const_cast<PassWeak<T>*>(this)->setSlot(0);
+    return slot;
+}
+
+template<typename T> PassWeak<T> adoptWeak(HandleSlot slot)
+{
+    return PassWeak<T>(slot);
+}
+
+template<typename T, typename U> inline bool operator==(const PassWeak<T>& a, const PassWeak<U>& b) 
+{
+    return a.get() == b.get(); 
+}
+
+template<typename T, typename U> inline bool operator==(const PassWeak<T>& a, const Weak<U>& b) 
+{
+    return a.get() == b.get(); 
+}
+
+template<typename T, typename U> inline bool operator==(const Weak<T>& a, const PassWeak<U>& b) 
+{
+    return a.get() == b.get(); 
+}
+
+template<typename T, typename U> inline bool operator==(const PassWeak<T>& a, U* b) 
+{
+    return a.get() == b; 
+}
+
+template<typename T, typename U> inline bool operator==(T* a, const PassWeak<U>& b) 
+{
+    return a == b.get(); 
+}
+
+template<typename T, typename U> inline bool operator!=(const PassWeak<T>& a, const PassWeak<U>& b) 
+{
+    return a.get() != b.get(); 
+}
+
+template<typename T, typename U> inline bool operator!=(const PassWeak<T>& a, const Weak<U>& b) 
+{
+    return a.get() != b.get(); 
+}
+
+template<typename T, typename U> inline bool operator!=(const Weak<T>& a, const PassWeak<U>& b) 
+{
+    return a.get() != b.get(); 
+}
+
+template<typename T, typename U> inline bool operator!=(const PassWeak<T>& a, U* b)
+{
+    return a.get() != b; 
+}
+
+template<typename T, typename U> inline bool operator!=(T* a, const PassWeak<U>& b) 
+{
+    return a != b.get(); 
+}
+
+} // namespace JSC
+
+#endif // PassWeak_h
diff --git a/Source/JavaScriptCore/heap/SlotVisitor.h b/Source/JavaScriptCore/heap/SlotVisitor.h
index e49a9a637..6584db703 100644
--- a/Source/JavaScriptCore/heap/SlotVisitor.h
+++ b/Source/JavaScriptCore/heap/SlotVisitor.h
@@ -26,7 +26,7 @@
 #ifndef SlotVisitor_h
 #define SlotVisitor_h
 
-#include "BumpSpace.h"
+#include "CopiedSpace.h"
 #include "MarkStack.h"
 
 namespace JSC {
@@ -78,7 +78,7 @@ private:
         donateSlow();
     }
     
-    BumpBlock* m_copyBlock;
+    CopiedBlock* m_copyBlock;
 };
 
 inline SlotVisitor::SlotVisitor(MarkStackThreadSharedData& shared)
diff --git a/Source/JavaScriptCore/heap/Weak.h b/Source/JavaScriptCore/heap/Weak.h
index f0c028d71..96fe1b58c 100644
--- a/Source/JavaScriptCore/heap/Weak.h
+++ b/Source/JavaScriptCore/heap/Weak.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2009, 2012 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -30,11 +30,14 @@
 #include "Handle.h"
 #include "HandleHeap.h"
 #include "JSGlobalData.h"
+#include "PassWeak.h"
 
 namespace JSC {
 
 // A weakly referenced handle that becomes 0 when the value it points to is garbage collected.
 template <typename T> class Weak : public Handle<T> {
+    WTF_MAKE_NONCOPYABLE(Weak);
+
     using Handle<T>::slot;
     using Handle<T>::setSlot;
 
@@ -46,11 +49,18 @@ public:
     {
     }
 
-    Weak(JSGlobalData& globalData, ExternalType value = ExternalType(), WeakHandleOwner* weakOwner = 0, void* context = 0)
+    Weak(std::nullptr_t)
+        : Handle<T>()
+    {
+    }
+
+    Weak(JSGlobalData& globalData, ExternalType externalType = ExternalType(), WeakHandleOwner* weakOwner = 0, void* context = 0)
         : Handle<T>(globalData.heap.handleHeap()->allocate())
     {
         HandleHeap::heapFor(slot())->makeWeak(slot(), weakOwner, context);
-        set(value);
+        JSValue value = HandleTypes<T>::toJSValue(externalType);
+        HandleHeap::heapFor(slot())->writeBarrier(slot(), value);
+        *slot() = value;
     }
 
     enum AdoptTag { Adopt };
@@ -59,23 +69,7 @@ public:
     {
         validateCell(get());
     }
-    
-    Weak(const Weak& other)
-        : Handle<T>()
-    {
-        if (!other.slot())
-            return;
-        setSlot(HandleHeap::heapFor(other.slot())->copyWeak(other.slot()));
-    }
 
-    template <typename U> Weak(const Weak<U>& other)
-        : Handle<T>()
-    {
-        if (!other.slot())
-            return;
-        setSlot(HandleHeap::heapFor(other.slot())->copyWeak(other.slot()));
-    }
-    
     enum HashTableDeletedValueTag { HashTableDeletedValue };
     bool isHashTableDeletedValue() const { return slot() == hashTableDeletedValue(); }
     Weak(HashTableDeletedValueTag)
@@ -83,6 +77,11 @@ public:
     {
     }
 
+    template<typename U> Weak(const PassWeak<U>& other)
+        : Handle<T>(other.leakHandle())
+    {
+    }
+
     ~Weak()
     {
         clear();
@@ -93,8 +92,12 @@ public:
         Handle<T>::swap(other);
     }
 
+    Weak& operator=(const PassWeak<T>&);
+
     ExternalType get() const { return  HandleTypes<T>::getFromSlot(slot()); }
     
+    PassWeak<T> release() { PassWeak<T> tmp = adoptWeak<T>(slot()); setSlot(0); return tmp; }
+
     void clear()
     {
         if (!slot())
@@ -103,32 +106,6 @@ public:
         setSlot(0);
     }
     
-    void set(JSGlobalData& globalData, ExternalType value, WeakHandleOwner* weakOwner = 0, void* context = 0)
-    {
-        if (!slot()) {
-            setSlot(globalData.heap.handleHeap()->allocate());
-            HandleHeap::heapFor(slot())->makeWeak(slot(), weakOwner, context);
-        }
-        ASSERT(HandleHeap::heapFor(slot())->hasWeakOwner(slot(), weakOwner));
-        set(value);
-    }
-
-    template <typename U> Weak& operator=(const Weak<U>& other)
-    {
-        clear();
-        if (other.slot())
-            setSlot(HandleHeap::heapFor(other.slot())->copyWeak(other.slot()));
-        return *this;
-    }
-
-    Weak& operator=(const Weak& other)
-    {
-        clear();
-        if (other.slot())
-            setSlot(HandleHeap::heapFor(other.slot())->copyWeak(other.slot()));
-        return *this;
-    }
-    
     HandleSlot leakHandle()
     {
         ASSERT(HandleHeap::heapFor(slot())->hasFinalizer(slot()));
@@ -139,14 +116,6 @@ public:
 
 private:
     static HandleSlot hashTableDeletedValue() { return reinterpret_cast<HandleSlot>(-1); }
-
-    void set(ExternalType externalType)
-    {
-        ASSERT(slot());
-        JSValue value = HandleTypes<T>::toJSValue(externalType);
-        HandleHeap::heapFor(slot())->writeBarrier(slot(), value);
-        *slot() = value;
-    }
 };
 
 template<class T> inline void swap(Weak<T>& a, Weak<T>& b)
@@ -154,6 +123,13 @@ template<class T> inline void swap(Weak<T>& a, Weak<T>& b)
     a.swap(b);
 }
 
+template<typename T> inline Weak<T>& Weak<T>::operator=(const PassWeak<T>& o)
+{
+    clear();
+    setSlot(o.leakHandle());
+    return *this;
+}
+
 } // namespace JSC
 
 namespace WTF {
@@ -162,7 +138,23 @@ template<typename T> struct VectorTraits<JSC::Weak<T> > : SimpleClassVectorTrait
     static const bool canCompareWithMemcmp = false;
 };
 
-template<typename P> struct HashTraits<JSC::Weak<P> > : SimpleClassHashTraits<JSC::Weak<P> > { };
+template<typename T> struct HashTraits<JSC::Weak<T> > : SimpleClassHashTraits<JSC::Weak<T> > {
+    typedef JSC::Weak<T> StorageType;
+
+    typedef std::nullptr_t EmptyValueType;
+    static EmptyValueType emptyValue() { return nullptr; }
+
+    typedef JSC::PassWeak<T> PassInType;
+    static void store(PassInType value, StorageType& storage) { storage = value; }
+
+    typedef JSC::PassWeak<T> PassOutType;
+    static PassOutType passOut(StorageType& value) { return value.release(); }
+    static PassOutType passOut(EmptyValueType) { return PassOutType(); }
+
+    typedef typename StorageType::ExternalType PeekType;
+    static PeekType peek(const StorageType& value) { return value.get(); }
+    static PeekType peek(EmptyValueType) { return PeekType(); }
+};
 
 }
 
diff --git a/Source/JavaScriptCore/interpreter/AbstractPC.cpp b/Source/JavaScriptCore/interpreter/AbstractPC.cpp
index 863915bda..755a0e303 100644
--- a/Source/JavaScriptCore/interpreter/AbstractPC.cpp
+++ b/Source/JavaScriptCore/interpreter/AbstractPC.cpp
@@ -45,7 +45,8 @@ AbstractPC::AbstractPC(JSGlobalData& globalData, ExecState* exec)
     }
 #endif
     
-#if ENABLE(INTERPRETER)
+#if ENABLE(CLASSIC_INTERPRETER)
+    UNUSED_PARAM(globalData);
     m_pointer = exec->returnVPC();
     m_mode = Interpreter;
 #endif
diff --git a/Source/JavaScriptCore/interpreter/AbstractPC.h b/Source/JavaScriptCore/interpreter/AbstractPC.h
index dffaaf343..5ed74472e 100644
--- a/Source/JavaScriptCore/interpreter/AbstractPC.h
+++ b/Source/JavaScriptCore/interpreter/AbstractPC.h
@@ -60,7 +60,7 @@ public:
     }
 #endif
 
-#if ENABLE(INTERPRETER)
+#if ENABLE(CLASSIC_INTERPRETER)
     AbstractPC(Instruction* vPC)
         : m_pointer(vPC)
         , m_mode(Interpreter)
diff --git a/Source/JavaScriptCore/interpreter/CallFrame.cpp b/Source/JavaScriptCore/interpreter/CallFrame.cpp
index 3ef5bd26f..b0e5ea0f6 100644
--- a/Source/JavaScriptCore/interpreter/CallFrame.cpp
+++ b/Source/JavaScriptCore/interpreter/CallFrame.cpp
@@ -40,7 +40,7 @@ void CallFrame::dumpCaller()
     JSValue function;
     
     interpreter()->retrieveLastCaller(this, signedLineNumber, sourceID, urlString, function);
-    printf("Callpoint => %s:%d\n", urlString.utf8().data(), signedLineNumber);
+    dataLog("Callpoint => %s:%d\n", urlString.utf8().data(), signedLineNumber);
 }
 
 RegisterFile* CallFrame::registerFile()
@@ -50,6 +50,29 @@ RegisterFile* CallFrame::registerFile()
 
 #endif
 
+#if USE(JSVALUE32_64)
+unsigned CallFrame::bytecodeOffsetForNonDFGCode() const
+{
+    ASSERT(codeBlock());
+    return currentVPC() - codeBlock()->instructions().begin();
+}
+
+void CallFrame::setBytecodeOffsetForNonDFGCode(unsigned offset)
+{
+    ASSERT(codeBlock());
+    setCurrentVPC(codeBlock()->instructions().begin() + offset);
+}
+#else
+Instruction* CallFrame::currentVPC() const
+{
+    return codeBlock()->instructions().begin() + bytecodeOffsetForNonDFGCode();
+}
+void CallFrame::setCurrentVPC(Instruction* vpc)
+{
+    setBytecodeOffsetForNonDFGCode(vpc - codeBlock()->instructions().begin());
+}
+#endif
+    
 #if ENABLE(DFG_JIT)
 bool CallFrame::isInlineCallFrameSlow()
 {
@@ -96,15 +119,15 @@ CallFrame* CallFrame::trueCallFrame(AbstractPC pc)
     if (pc.isSet()) {
         ReturnAddressPtr currentReturnPC = pc.jitReturnAddress();
         
-        if (!machineCodeBlock->codeOriginForReturn(currentReturnPC, codeOrigin))
-            return this; // Not currently in inlined code.
+        bool hasCodeOrigin = machineCodeBlock->codeOriginForReturn(currentReturnPC, codeOrigin);
+        ASSERT_UNUSED(hasCodeOrigin, hasCodeOrigin);
     } else {
-        unsigned index = codeOriginIndexForDFGWithInlining();
-        if (index == UINT_MAX)
-            return this; // Not currently in inlined code.
-        
+        unsigned index = codeOriginIndexForDFG();
         codeOrigin = machineCodeBlock->codeOrigin(index);
     }
+
+    if (!codeOrigin.inlineCallFrame)
+        return this; // Not currently in inlined code.
     
     for (InlineCallFrame* inlineCallFrame = codeOrigin.inlineCallFrame; inlineCallFrame;) {
         InlineCallFrame* nextInlineCallFrame = inlineCallFrame->caller.inlineCallFrame;
@@ -140,10 +163,10 @@ CallFrame* CallFrame::trueCallerFrame()
     //
     // machineCaller -> The caller according to the machine, which may be zero or
     //    more frames above the true caller due to inlining.
-    
+
     // Am I an inline call frame? If so, we're done.
     if (isInlineCallFrame())
-        return callerFrame();
+        return callerFrame()->removeHostCallFrameFlag();
     
     // I am a machine call frame, so the question is: is my caller a machine call frame
     // that has inlines or a machine call frame that doesn't?
@@ -153,10 +176,10 @@ CallFrame* CallFrame::trueCallerFrame()
     ASSERT(!machineCaller->isInlineCallFrame());
     
     // Figure out how we want to get the current code location.
-    if (hasHostCallFrameFlag() || returnAddressIsInCtiTrampoline(returnPC()))
-        return machineCaller->trueCallFrameFromVMCode();
+    if (!hasReturnPC() || returnAddressIsInCtiTrampoline(returnPC()))
+        return machineCaller->trueCallFrameFromVMCode()->removeHostCallFrameFlag();
     
-    return machineCaller->trueCallFrame(returnPC());
+    return machineCaller->trueCallFrame(returnPC())->removeHostCallFrameFlag();
 }
 #endif
 
diff --git a/Source/JavaScriptCore/interpreter/CallFrame.h b/Source/JavaScriptCore/interpreter/CallFrame.h
index 4fadfab28..5bf2b9488 100644
--- a/Source/JavaScriptCore/interpreter/CallFrame.h
+++ b/Source/JavaScriptCore/interpreter/CallFrame.h
@@ -104,13 +104,30 @@ namespace JSC  {
         CallFrame* callerFrame() const { return this[RegisterFile::CallerFrame].callFrame(); }
 #if ENABLE(JIT)
         ReturnAddressPtr returnPC() const { return ReturnAddressPtr(this[RegisterFile::ReturnPC].vPC()); }
+        bool hasReturnPC() const { return !!this[RegisterFile::ReturnPC].vPC(); }
+        void clearReturnPC() { registers()[RegisterFile::ReturnPC] = static_cast<Instruction*>(0); }
 #endif
         AbstractPC abstractReturnPC(JSGlobalData& globalData) { return AbstractPC(globalData, this); }
-        unsigned bytecodeOffsetForBaselineJIT() { return this[RegisterFile::ArgumentCount].tag(); }
+#if USE(JSVALUE32_64)
+        unsigned bytecodeOffsetForNonDFGCode() const;
+        void setBytecodeOffsetForNonDFGCode(unsigned offset);
+#else
+        unsigned bytecodeOffsetForNonDFGCode() const
+        {
+            ASSERT(codeBlock());
+            return this[RegisterFile::ArgumentCount].tag();
+        }
+        
+        void setBytecodeOffsetForNonDFGCode(unsigned offset)
+        {
+            ASSERT(codeBlock());
+            this[RegisterFile::ArgumentCount].tag() = static_cast<int32_t>(offset);
+        }
+#endif
 
 #if ENABLE(DFG_JIT)
         InlineCallFrame* inlineCallFrame() const { return this[RegisterFile::ReturnPC].asInlineCallFrame(); }
-        unsigned codeOriginIndexForDFGWithInlining() const { return this[RegisterFile::ArgumentCount].tag(); }
+        unsigned codeOriginIndexForDFG() const { return this[RegisterFile::ArgumentCount].tag(); }
 #else
         // This will never be called if !ENABLE(DFG_JIT) since all calls should be guarded by
         // isInlineCallFrame(). But to make it easier to write code without having a bunch of
@@ -121,9 +138,22 @@ namespace JSC  {
             return 0;
         }
 #endif
-#if ENABLE(INTERPRETER)
+#if ENABLE(CLASSIC_INTERPRETER)
         Instruction* returnVPC() const { return this[RegisterFile::ReturnPC].vPC(); }
 #endif
+#if USE(JSVALUE32_64)
+        Instruction* currentVPC() const
+        {
+            return bitwise_cast<Instruction*>(this[RegisterFile::ArgumentCount].tag());
+        }
+        void setCurrentVPC(Instruction* vpc)
+        {
+            this[RegisterFile::ArgumentCount].tag() = bitwise_cast<int32_t>(vpc);
+        }
+#else
+        Instruction* currentVPC() const;
+        void setCurrentVPC(Instruction* vpc);
+#endif
 
         void setCallerFrame(CallFrame* callerFrame) { static_cast<Register*>(this)[RegisterFile::CallerFrame] = callerFrame; }
         void setScopeChain(ScopeChainNode* scopeChain) { static_cast<Register*>(this)[RegisterFile::ScopeChain] = scopeChain; }
diff --git a/Source/JavaScriptCore/interpreter/Interpreter.cpp b/Source/JavaScriptCore/interpreter/Interpreter.cpp
index d42e869f1..336f109c0 100644
--- a/Source/JavaScriptCore/interpreter/Interpreter.cpp
+++ b/Source/JavaScriptCore/interpreter/Interpreter.cpp
@@ -45,7 +45,6 @@
 #include "JSActivation.h"
 #include "JSArray.h"
 #include "JSByteArray.h"
-#include "JSFunction.h"
 #include "JSNotAnObject.h"
 #include "JSPropertyNameIterator.h"
 #include "LiteralParser.h"
@@ -60,6 +59,7 @@
 #include "Register.h"
 #include "SamplingTool.h"
 #include "StrictEvalActivation.h"
+#include "StrongInlines.h"
 #include "UStringConcatenate.h"
 #include <limits.h>
 #include <stdio.h>
@@ -69,7 +69,7 @@
 #include "JIT.h"
 #endif
 
-#define WTF_USE_GCC_COMPUTED_GOTO_WORKAROUND (ENABLE(COMPUTED_GOTO_INTERPRETER) && !defined(__llvm__))
+#define WTF_USE_GCC_COMPUTED_GOTO_WORKAROUND ((ENABLE(COMPUTED_GOTO_CLASSIC_INTERPRETER) || ENABLE(LLINT)) && !defined(__llvm__))
 
 using namespace std;
 
@@ -83,7 +83,7 @@ static int depth(CodeBlock* codeBlock, ScopeChainNode* sc)
     return sc->localDepth();
 }
 
-#if ENABLE(INTERPRETER) 
+#if ENABLE(CLASSIC_INTERPRETER) 
 static NEVER_INLINE JSValue concatenateStrings(ExecState* exec, Register* strings, unsigned count)
 {
     return jsString(exec, strings, count);
@@ -365,7 +365,7 @@ NEVER_INLINE bool Interpreter::resolveThisAndProperty(CallFrame* callFrame, Inst
     return false;
 }
 
-#endif // ENABLE(INTERPRETER)
+#endif // ENABLE(CLASSIC_INTERPRETER)
 
 ALWAYS_INLINE CallFrame* Interpreter::slideRegisterWindowForCall(CodeBlock* newCodeBlock, RegisterFile* registerFile, CallFrame* callFrame, size_t registerOffset, int argumentCountIncludingThis)
 {
@@ -394,7 +394,7 @@ ALWAYS_INLINE CallFrame* Interpreter::slideRegisterWindowForCall(CodeBlock* newC
     return newCallFrame;
 }
 
-#if ENABLE(INTERPRETER)
+#if ENABLE(CLASSIC_INTERPRETER)
 static NEVER_INLINE bool isInvalidParamForIn(CallFrame* callFrame, JSValue value, JSValue& exceptionData)
 {
     if (value.isObject())
@@ -543,36 +543,61 @@ Interpreter::Interpreter()
 #if !ASSERT_DISABLED
     , m_initialized(false)
 #endif
-    , m_enabled(false)
+    , m_classicEnabled(false)
+{
+}
+
+Interpreter::~Interpreter()
 {
+#if ENABLE(LLINT)
+    if (m_classicEnabled)
+        delete[] m_opcodeTable;
+#endif
 }
 
-void Interpreter::initialize(bool canUseJIT)
+void Interpreter::initialize(LLInt::Data* llintData, bool canUseJIT)
 {
-#if ENABLE(COMPUTED_GOTO_INTERPRETER)
+    UNUSED_PARAM(llintData);
+    UNUSED_PARAM(canUseJIT);
+#if ENABLE(COMPUTED_GOTO_CLASSIC_INTERPRETER) || ENABLE(LLINT)
+#if !ENABLE(COMPUTED_GOTO_CLASSIC_INTERPRETER)
+    // Having LLInt enabled, but not being able to use the JIT, and not having
+    // a computed goto interpreter, is not supported. Not because we cannot
+    // support it, but because I decided to draw the line at the number of
+    // permutations of execution engines that I wanted this code to grok.
+    ASSERT(canUseJIT);
+#endif
     if (canUseJIT) {
+#if ENABLE(LLINT)
+        m_opcodeTable = llintData->opcodeMap();
+        for (int i = 0; i < numOpcodeIDs; ++i)
+            m_opcodeIDTable.add(m_opcodeTable[i], static_cast<OpcodeID>(i));
+#else
         // If the JIT is present, don't use jump destinations for opcodes.
         
         for (int i = 0; i < numOpcodeIDs; ++i) {
             Opcode opcode = bitwise_cast<void*>(static_cast<uintptr_t>(i));
             m_opcodeTable[i] = opcode;
         }
+#endif
     } else {
+#if ENABLE(LLINT)
+        m_opcodeTable = new Opcode[numOpcodeIDs];
+#endif
         privateExecute(InitializeAndReturn, 0, 0);
         
         for (int i = 0; i < numOpcodeIDs; ++i)
             m_opcodeIDTable.add(m_opcodeTable[i], static_cast<OpcodeID>(i));
         
-        m_enabled = true;
+        m_classicEnabled = true;
     }
 #else
-    UNUSED_PARAM(canUseJIT);
-#if ENABLE(INTERPRETER)
-    m_enabled = true;
+#if ENABLE(CLASSIC_INTERPRETER)
+    m_classicEnabled = true;
 #else
-    m_enabled = false;
+    m_classicEnabled = false;
 #endif
-#endif // ENABLE(COMPUTED_GOTO_INTERPRETER)
+#endif // ENABLE(COMPUTED_GOTO_CLASSIC_INTERPRETER)
 #if !ASSERT_DISABLED
     m_initialized = true;
 #endif
@@ -592,10 +617,10 @@ void Interpreter::dumpCallFrame(CallFrame* callFrame)
 
 void Interpreter::dumpRegisters(CallFrame* callFrame)
 {
-    printf("Register frame: \n\n");
-    printf("-----------------------------------------------------------------------------\n");
-    printf("            use            |   address  |                value               \n");
-    printf("-----------------------------------------------------------------------------\n");
+    dataLog("Register frame: \n\n");
+    dataLog("-----------------------------------------------------------------------------\n");
+    dataLog("            use            |   address  |                value               \n");
+    dataLog("-----------------------------------------------------------------------------\n");
 
     CodeBlock* codeBlock = callFrame->codeBlock();
     const Register* it;
@@ -605,30 +630,30 @@ void Interpreter::dumpRegisters(CallFrame* callFrame)
     it = callFrame->registers() - RegisterFile::CallFrameHeaderSize - codeBlock->numParameters();
     v = (*it).jsValue();
 #if USE(JSVALUE32_64)
-    printf("[this]                     | %10p | %-16s 0x%llx \n", it, v.description(), JSValue::encode(v)); ++it;
+    dataLog("[this]                     | %10p | %-16s 0x%llx \n", it, v.description(), JSValue::encode(v)); ++it;
 #else
-    printf("[this]                     | %10p | %-16s %p \n", it, v.description(), JSValue::encode(v)); ++it;
+    dataLog("[this]                     | %10p | %-16s %p \n", it, v.description(), JSValue::encode(v)); ++it;
 #endif
     end = it + max(codeBlock->numParameters() - 1, 0); // - 1 to skip "this"
     if (it != end) {
         do {
             v = (*it).jsValue();
 #if USE(JSVALUE32_64)
-            printf("[param]                    | %10p | %-16s 0x%llx \n", it, v.description(), JSValue::encode(v));
+            dataLog("[param]                    | %10p | %-16s 0x%llx \n", it, v.description(), JSValue::encode(v));
 #else
-            printf("[param]                    | %10p | %-16s %p \n", it, v.description(), JSValue::encode(v));
+            dataLog("[param]                    | %10p | %-16s %p \n", it, v.description(), JSValue::encode(v));
 #endif
             ++it;
         } while (it != end);
     }
-    printf("-----------------------------------------------------------------------------\n");
-    printf("[CodeBlock]                | %10p | %p \n", it, (*it).codeBlock()); ++it;
-    printf("[ScopeChain]               | %10p | %p \n", it, (*it).scopeChain()); ++it;
-    printf("[CallerRegisters]          | %10p | %d \n", it, (*it).i()); ++it;
-    printf("[ReturnPC]                 | %10p | %p \n", it, (*it).vPC()); ++it;
-    printf("[ArgumentCount]            | %10p | %d \n", it, (*it).i()); ++it;
-    printf("[Callee]                   | %10p | %p \n", it, (*it).function()); ++it;
-    printf("-----------------------------------------------------------------------------\n");
+    dataLog("-----------------------------------------------------------------------------\n");
+    dataLog("[CodeBlock]                | %10p | %p \n", it, (*it).codeBlock()); ++it;
+    dataLog("[ScopeChain]               | %10p | %p \n", it, (*it).scopeChain()); ++it;
+    dataLog("[CallerRegisters]          | %10p | %d \n", it, (*it).i()); ++it;
+    dataLog("[ReturnPC]                 | %10p | %p \n", it, (*it).vPC()); ++it;
+    dataLog("[ArgumentCount]            | %10p | %d \n", it, (*it).i()); ++it;
+    dataLog("[Callee]                   | %10p | %p \n", it, (*it).function()); ++it;
+    dataLog("-----------------------------------------------------------------------------\n");
 
     int registerCount = 0;
 
@@ -637,39 +662,41 @@ void Interpreter::dumpRegisters(CallFrame* callFrame)
         do {
             v = (*it).jsValue();
 #if USE(JSVALUE32_64)
-            printf("[r%2d]                      | %10p | %-16s 0x%llx \n", registerCount, it, v.description(), JSValue::encode(v));
+            dataLog("[r%2d]                      | %10p | %-16s 0x%llx \n", registerCount, it, v.description(), JSValue::encode(v));
 #else
-            printf("[r%2d]                      | %10p | %-16s %p \n", registerCount, it, v.description(), JSValue::encode(v));
+            dataLog("[r%2d]                      | %10p | %-16s %p \n", registerCount, it, v.description(), JSValue::encode(v));
 #endif
             ++it;
             ++registerCount;
         } while (it != end);
     }
-    printf("-----------------------------------------------------------------------------\n");
+    dataLog("-----------------------------------------------------------------------------\n");
 
     end = it + codeBlock->m_numCalleeRegisters - codeBlock->m_numVars;
     if (it != end) {
         do {
             v = (*it).jsValue();
 #if USE(JSVALUE32_64)
-            printf("[r%2d]                      | %10p | %-16s 0x%llx \n", registerCount, it, v.description(), JSValue::encode(v));
+            dataLog("[r%2d]                      | %10p | %-16s 0x%llx \n", registerCount, it, v.description(), JSValue::encode(v));
 #else
-            printf("[r%2d]                      | %10p | %-16s %p \n", registerCount, it, v.description(), JSValue::encode(v));
+            dataLog("[r%2d]                      | %10p | %-16s %p \n", registerCount, it, v.description(), JSValue::encode(v));
 #endif
             ++it;
             ++registerCount;
         } while (it != end);
     }
-    printf("-----------------------------------------------------------------------------\n");
+    dataLog("-----------------------------------------------------------------------------\n");
 }
 
 #endif
 
 bool Interpreter::isOpcode(Opcode opcode)
 {
-#if ENABLE(COMPUTED_GOTO_INTERPRETER)
-    if (!m_enabled)
+#if ENABLE(COMPUTED_GOTO_CLASSIC_INTERPRETER) || ENABLE(LLINT)
+#if !ENABLE(LLINT)
+    if (!m_classicEnabled)
         return opcode >= 0 && static_cast<OpcodeID>(bitwise_cast<uintptr_t>(opcode)) <= op_end;
+#endif
     return opcode != HashTraits<Opcode>::emptyValue()
         && !HashTraits<Opcode>::isDeletedValue(opcode)
         && m_opcodeIDTable.contains(opcode);
@@ -724,13 +751,13 @@ NEVER_INLINE bool Interpreter::unwindCallFrame(CallFrame*& callFrame, JSValue ex
     // the beginning of next instruction to execute. To get an offset
     // inside the call instruction that triggered the exception we
     // have to subtract 1.
-#if ENABLE(JIT) && ENABLE(INTERPRETER)
+#if ENABLE(JIT) && ENABLE(CLASSIC_INTERPRETER)
     if (callerFrame->globalData().canUseJIT())
-        bytecodeOffset = codeBlock->bytecodeOffset(callFrame->returnPC());
+        bytecodeOffset = codeBlock->bytecodeOffset(callerFrame, callFrame->returnPC());
     else
         bytecodeOffset = codeBlock->bytecodeOffset(callFrame->returnVPC()) - 1;
 #elif ENABLE(JIT)
-    bytecodeOffset = codeBlock->bytecodeOffset(callFrame->returnPC());
+    bytecodeOffset = codeBlock->bytecodeOffset(callerFrame, callFrame->returnPC());
 #else
     bytecodeOffset = codeBlock->bytecodeOffset(callFrame->returnVPC()) - 1;
 #endif
@@ -790,6 +817,154 @@ static void appendSourceToError(CallFrame* callFrame, ErrorInstance* exception,
     exception->putDirect(*globalData, globalData->propertyNames->message, jsString(globalData, message));
 }
 
+static int getLineNumberForCallFrame(CallFrame* callFrame)
+{
+    callFrame = callFrame->removeHostCallFrameFlag();
+    CodeBlock* codeBlock = callFrame->codeBlock();
+    if (!codeBlock)
+        return -1;
+#if ENABLE(INTERPRETER)
+    if (!globalData->canUseJIT())
+        return codeBlock->lineNumberForBytecodeOffset(callFrame->bytecodeOffsetForNonDFGCode() - 1);
+#endif
+#if ENABLE(JIT)
+#if ENABLE(DFG_JIT)
+    if (codeBlock->getJITType() == JITCode::DFGJIT)
+        return codeBlock->lineNumberForBytecodeOffset(codeBlock->codeOrigin(callFrame->codeOriginIndexForDFG()).bytecodeIndex);
+#endif
+    return codeBlock->lineNumberForBytecodeOffset(callFrame->bytecodeOffsetForNonDFGCode());
+#endif
+}
+
+static CallFrame* getCallerInfo(JSGlobalData* globalData, CallFrame* callFrame, int& lineNumber)
+{
+    UNUSED_PARAM(globalData);
+    unsigned bytecodeOffset = 0;
+    lineNumber = -1;
+    ASSERT(!callFrame->hasHostCallFrameFlag());
+    CallFrame* callerFrame = callFrame->codeBlock() ? callFrame->trueCallerFrame() : 0;
+    bool callframeIsHost = callerFrame->addHostCallFrameFlag() == callFrame->callerFrame();
+    ASSERT(!callerFrame->hasHostCallFrameFlag());
+
+    if (callerFrame == CallFrame::noCaller() || !callerFrame || !callerFrame->codeBlock())
+        return callerFrame;
+
+    CodeBlock* callerCodeBlock = callerFrame->codeBlock();
+
+    if (callframeIsHost) {
+        // Don't need to deal with inline callframes here as by definition we haven't
+        // inlined a call with an intervening native call frame.
+#if ENABLE(INTERPRETER)
+        if (!globalData->canUseJIT()) {
+            bytecodeOffset = callerFrame->bytecodeOffsetForNonDFGCode();
+            lineNumber = callerCodeBlock->lineNumberForBytecodeOffset(bytecodeOffset - 1);
+            return callerFrame;
+        }
+#endif
+#if ENABLE(JIT)
+#if ENABLE(DFG_JIT)
+        if (callerCodeBlock && callerCodeBlock->getJITType() == JITCode::DFGJIT)
+            bytecodeOffset = callerCodeBlock->codeOrigin(callerFrame->codeOriginIndexForDFG()).bytecodeIndex;
+        else
+#endif
+            bytecodeOffset = callerFrame->bytecodeOffsetForNonDFGCode();
+#endif
+    } else {
+#if ENABLE(INTERPRETER)
+        if (!globalData->canUseJIT()) {
+            bytecodeOffset = callerCodeBlock->bytecodeOffset(callFrame->returnVPC());
+            lineNumber = callerCodeBlock->lineNumberForBytecodeOffset(bytecodeOffset - 1);
+            return callerFrame;
+        }
+#endif
+#if ENABLE(JIT)
+    #if ENABLE(DFG_JIT)
+        if (callFrame->isInlineCallFrame()) {
+            InlineCallFrame* icf = callFrame->inlineCallFrame();
+            bytecodeOffset = icf->caller.bytecodeIndex;
+            if (InlineCallFrame* parentCallFrame = icf->caller.inlineCallFrame) {
+                FunctionExecutable* executable = static_cast<FunctionExecutable*>(parentCallFrame->executable.get());
+                CodeBlock* newCodeBlock = executable->baselineCodeBlockFor(parentCallFrame->isCall ? CodeForCall : CodeForConstruct);
+                ASSERT(newCodeBlock);
+                ASSERT(newCodeBlock->instructionCount() > bytecodeOffset);
+                callerCodeBlock = newCodeBlock;
+            }
+        } else if (callerCodeBlock && callerCodeBlock->getJITType() == JITCode::DFGJIT) {
+            CodeOrigin origin;
+            if (!callerCodeBlock->codeOriginForReturn(callFrame->returnPC(), origin))
+                ASSERT_NOT_REACHED();
+            bytecodeOffset = origin.bytecodeIndex;
+            if (InlineCallFrame* icf = origin.inlineCallFrame) {
+                FunctionExecutable* executable = static_cast<FunctionExecutable*>(icf->executable.get());
+                CodeBlock* newCodeBlock = executable->baselineCodeBlockFor(icf->isCall ? CodeForCall : CodeForConstruct);
+                ASSERT(newCodeBlock);
+                ASSERT(newCodeBlock->instructionCount() > bytecodeOffset);
+                callerCodeBlock = newCodeBlock;
+            }
+        } else
+    #endif
+            bytecodeOffset = callerCodeBlock->bytecodeOffset(callerFrame, callFrame->returnPC());
+#endif
+    }
+
+    lineNumber = callerCodeBlock->lineNumberForBytecodeOffset(bytecodeOffset);
+    return callerFrame;
+}
+
+static ALWAYS_INLINE const UString getSourceURLFromCallFrame(CallFrame* callFrame) 
+{
+    ASSERT(!callFrame->hasHostCallFrameFlag());
+#if ENABLE(INTERPRETER)
+#if ENABLE(JIT)
+    if (callFrame->globalData().canUseJIT())
+        return callFrame->codeBlock()->ownerExecutable()->sourceURL();
+#endif
+    return callFrame->codeBlock()->source()->url();
+
+#else
+    return callFrame->codeBlock()->ownerExecutable()->sourceURL();
+#endif
+}
+
+static StackFrameCodeType getStackFrameCodeType(CallFrame* callFrame)
+{
+    ASSERT(!callFrame->hasHostCallFrameFlag());
+
+    switch (callFrame->codeBlock()->codeType()) {
+    case EvalCode:
+        return StackFrameEvalCode;
+    case FunctionCode:
+        return StackFrameFunctionCode;
+    case GlobalCode:
+        return StackFrameGlobalCode;
+    }
+    ASSERT_NOT_REACHED();
+    return StackFrameGlobalCode;
+}
+
+void Interpreter::getStackTrace(JSGlobalData* globalData, int line, Vector<StackFrame>& results)
+{
+    CallFrame* callFrame = globalData->topCallFrame->removeHostCallFrameFlag()->trueCallFrameFromVMCode();
+    if (!callFrame || callFrame == CallFrame::noCaller()) 
+        return;
+
+    if (line == -1)
+        line = getLineNumberForCallFrame(callFrame);
+    
+    while (callFrame && callFrame != CallFrame::noCaller()) {
+        UString sourceURL;
+        if (callFrame->codeBlock()) {
+            sourceURL = getSourceURLFromCallFrame(callFrame);
+            StackFrame s = { Strong<JSObject>(*globalData, callFrame->callee()), getStackFrameCodeType(callFrame), Strong<ExecutableBase>(*globalData, callFrame->codeBlock()->ownerExecutable()), line, sourceURL};
+            results.append(s);
+        } else {
+            StackFrame s = { Strong<JSObject>(*globalData, callFrame->callee()), StackFrameNativeCode, Strong<ExecutableBase>(), -1, UString()};
+            results.append(s);
+        }
+        callFrame = getCallerInfo(globalData, callFrame, line);
+    }
+}
+
 NEVER_INLINE HandlerInfo* Interpreter::throwException(CallFrame*& callFrame, JSValue& exceptionValue, unsigned bytecodeOffset)
 {
     CodeBlock* codeBlock = callFrame->codeBlock();
@@ -808,7 +983,9 @@ NEVER_INLINE HandlerInfo* Interpreter::throwException(CallFrame*& callFrame, JSV
 
             // FIXME: should only really be adding these properties to VM generated exceptions,
             // but the inspector currently requires these for all thrown objects.
-            addErrorInfo(callFrame, exception, codeBlock->lineNumberForBytecodeOffset(bytecodeOffset), codeBlock->ownerExecutable()->source());
+            Vector<StackFrame> stackTrace;
+            getStackTrace(&callFrame->globalData(), codeBlock->lineNumberForBytecodeOffset(bytecodeOffset), stackTrace);
+            addErrorInfo(callFrame, exception, codeBlock->lineNumberForBytecodeOffset(bytecodeOffset), codeBlock->ownerExecutable()->source(), stackTrace);
         }
 
         isInterrupt = isInterruptedExecutionException(exception) || isTerminatedExecutionException(exception);
@@ -1280,15 +1457,15 @@ JSValue Interpreter::execute(CallFrameClosure& closure)
         
         m_reentryDepth++;  
 #if ENABLE(JIT)
-#if ENABLE(INTERPRETER)
+#if ENABLE(CLASSIC_INTERPRETER)
         if (closure.newCallFrame->globalData().canUseJIT())
 #endif
             result = closure.functionExecutable->generatedJITCodeForCall().execute(&m_registerFile, closure.newCallFrame, closure.globalData);
-#if ENABLE(INTERPRETER)
+#if ENABLE(CLASSIC_INTERPRETER)
         else
 #endif
 #endif
-#if ENABLE(INTERPRETER)
+#if ENABLE(CLASSIC_INTERPRETER)
             result = privateExecute(Normal, &m_registerFile, closure.newCallFrame);
 #endif
         m_reentryDepth--;
@@ -1386,15 +1563,15 @@ JSValue Interpreter::execute(EvalExecutable* eval, CallFrame* callFrame, JSValue
         m_reentryDepth++;
         
 #if ENABLE(JIT)
-#if ENABLE(INTERPRETER)
+#if ENABLE(CLASSIC_INTERPRETER)
         if (callFrame->globalData().canUseJIT())
 #endif
             result = eval->generatedJITCode().execute(&m_registerFile, newCallFrame, scopeChain->globalData);
-#if ENABLE(INTERPRETER)
+#if ENABLE(CLASSIC_INTERPRETER)
         else
 #endif
 #endif
-#if ENABLE(INTERPRETER)
+#if ENABLE(CLASSIC_INTERPRETER)
             result = privateExecute(Normal, &m_registerFile, newCallFrame);
 #endif
         m_reentryDepth--;
@@ -1437,7 +1614,7 @@ NEVER_INLINE void Interpreter::debug(CallFrame* callFrame, DebugHookID debugHook
     }
 }
     
-#if ENABLE(INTERPRETER)
+#if ENABLE(CLASSIC_INTERPRETER)
 NEVER_INLINE ScopeChainNode* Interpreter::createExceptionScope(CallFrame* callFrame, const Instruction* vPC)
 {
     int dst = vPC[1].u.operand;
@@ -1669,35 +1846,35 @@ NEVER_INLINE void Interpreter::uncacheGetByID(CodeBlock*, Instruction* vPC)
     vPC[4] = 0;
 }
 
-#endif // ENABLE(INTERPRETER)
+#endif // ENABLE(CLASSIC_INTERPRETER)
 
 JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFile, CallFrame* callFrame)
 {
     // One-time initialization of our address tables. We have to put this code
     // here because our labels are only in scope inside this function.
     if (UNLIKELY(flag == InitializeAndReturn)) {
-        #if ENABLE(COMPUTED_GOTO_INTERPRETER)
+        #if ENABLE(COMPUTED_GOTO_CLASSIC_INTERPRETER)
             #define LIST_OPCODE_LABEL(id, length) &&id,
                 static Opcode labels[] = { FOR_EACH_OPCODE_ID(LIST_OPCODE_LABEL) };
                 for (size_t i = 0; i < WTF_ARRAY_LENGTH(labels); ++i)
                     m_opcodeTable[i] = labels[i];
             #undef LIST_OPCODE_LABEL
-        #endif // ENABLE(COMPUTED_GOTO_INTERPRETER)
+        #endif // ENABLE(COMPUTED_GOTO_CLASSIC_INTERPRETER)
         return JSValue();
     }
     
     ASSERT(m_initialized);
-    ASSERT(m_enabled);
+    ASSERT(m_classicEnabled);
     
 #if ENABLE(JIT)
-#if ENABLE(INTERPRETER)
+#if ENABLE(CLASSIC_INTERPRETER)
     // Mixing Interpreter + JIT is not supported.
     if (callFrame->globalData().canUseJIT())
 #endif
         ASSERT_NOT_REACHED();
 #endif
 
-#if !ENABLE(INTERPRETER)
+#if !ENABLE(CLASSIC_INTERPRETER)
     UNUSED_PARAM(registerFile);
     UNUSED_PARAM(callFrame);
     return JSValue();
@@ -1743,20 +1920,31 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
     #define SAMPLE(codeBlock, vPC)
 #endif
 
-#if ENABLE(COMPUTED_GOTO_INTERPRETER)
+#define UPDATE_BYTECODE_OFFSET() \
+    do {\
+        callFrame->setBytecodeOffsetForNonDFGCode(vPC - codeBlock->instructions().data() + 1);\
+    } while (0)
+
+#if ENABLE(COMPUTED_GOTO_CLASSIC_INTERPRETER)
     #define NEXT_INSTRUCTION() SAMPLE(codeBlock, vPC); goto *vPC->u.opcode
 #if ENABLE(OPCODE_STATS)
-    #define DEFINE_OPCODE(opcode) opcode: OpcodeStats::recordInstruction(opcode);
+    #define DEFINE_OPCODE(opcode) \
+        opcode:\
+            OpcodeStats::recordInstruction(opcode);\
+            UPDATE_BYTECODE_OFFSET();
 #else
-    #define DEFINE_OPCODE(opcode) opcode:
+    #define DEFINE_OPCODE(opcode) opcode: UPDATE_BYTECODE_OFFSET();
 #endif
     NEXT_INSTRUCTION();
 #else
     #define NEXT_INSTRUCTION() SAMPLE(codeBlock, vPC); goto interpreterLoopStart
 #if ENABLE(OPCODE_STATS)
-    #define DEFINE_OPCODE(opcode) case opcode: OpcodeStats::recordInstruction(opcode);
+    #define DEFINE_OPCODE(opcode) \
+        case opcode:\
+            OpcodeStats::recordInstruction(opcode);\
+            UPDATE_BYTECODE_OFFSET();
 #else
-    #define DEFINE_OPCODE(opcode) case opcode:
+    #define DEFINE_OPCODE(opcode) case opcode: UPDATE_BYTECODE_OFFSET();
 #endif
     while (1) { // iterator loop begins
     interpreterLoopStart:;
@@ -3327,6 +3515,8 @@ skip_id_custom_self:
 #if USE(GCC_COMPUTED_GOTO_WORKAROUND)
       skip_put_by_id:
 #endif
+    DEFINE_OPCODE(op_put_by_id_transition_direct)
+    DEFINE_OPCODE(op_put_by_id_transition_normal)
     DEFINE_OPCODE(op_put_by_id_transition) {
         /* op_put_by_id_transition base(r) property(id) value(r) oldStructure(sID) newStructure(sID) structureChain(chain) offset(n) direct(b)
          
@@ -4883,7 +5073,7 @@ skip_id_custom_self:
         vPC += target;
         NEXT_INSTRUCTION();
     }
-#if ENABLE(COMPUTED_GOTO_INTERPRETER)
+#if ENABLE(COMPUTED_GOTO_CLASSIC_INTERPRETER)
     // Appease GCC
     goto *(&&skip_new_scope);
 #endif
@@ -4899,7 +5089,7 @@ skip_id_custom_self:
         vPC += OPCODE_LENGTH(op_push_new_scope);
         NEXT_INSTRUCTION();
     }
-#if ENABLE(COMPUTED_GOTO_INTERPRETER)
+#if ENABLE(COMPUTED_GOTO_CLASSIC_INTERPRETER)
     skip_new_scope:
 #endif
     DEFINE_OPCODE(op_catch) {
@@ -5089,14 +5279,14 @@ skip_id_custom_self:
         NEXT_INSTRUCTION();
     }
     }
-#if !ENABLE(COMPUTED_GOTO_INTERPRETER)
+#if !ENABLE(COMPUTED_GOTO_CLASSIC_INTERPRETER)
     } // iterator loop ends
 #endif
     #undef NEXT_INSTRUCTION
     #undef DEFINE_OPCODE
     #undef CHECK_FOR_EXCEPTION
     #undef CHECK_FOR_TIMEOUT
-#endif // ENABLE(INTERPRETER)
+#endif // ENABLE(CLASSIC_INTERPRETER)
 }
 
 JSValue Interpreter::retrieveArgumentsFromVMCode(CallFrame* callFrame, JSFunction* function) const
@@ -5155,15 +5345,15 @@ void Interpreter::retrieveLastCaller(CallFrame* callFrame, int& lineNumber, intp
     if (!callerCodeBlock)
         return;
     unsigned bytecodeOffset = 0;
-#if ENABLE(INTERPRETER)
+#if ENABLE(CLASSIC_INTERPRETER)
     if (!callerFrame->globalData().canUseJIT())
         bytecodeOffset = callerCodeBlock->bytecodeOffset(callFrame->returnVPC());
 #if ENABLE(JIT)
     else
-        bytecodeOffset = callerCodeBlock->bytecodeOffset(callFrame->returnPC());
+        bytecodeOffset = callerCodeBlock->bytecodeOffset(callerFrame, callFrame->returnPC());
 #endif
 #else
-    bytecodeOffset = callerCodeBlock->bytecodeOffset(callFrame->returnPC());
+    bytecodeOffset = callerCodeBlock->bytecodeOffset(callerFrame, callFrame->returnPC());
 #endif
     lineNumber = callerCodeBlock->lineNumberForBytecodeOffset(bytecodeOffset - 1);
     sourceID = callerCodeBlock->ownerExecutable()->sourceID();
diff --git a/Source/JavaScriptCore/interpreter/Interpreter.h b/Source/JavaScriptCore/interpreter/Interpreter.h
index 884c4248e..51881a565 100644
--- a/Source/JavaScriptCore/interpreter/Interpreter.h
+++ b/Source/JavaScriptCore/interpreter/Interpreter.h
@@ -31,8 +31,10 @@
 
 #include "ArgList.h"
 #include "JSCell.h"
+#include "JSFunction.h"
 #include "JSValue.h"
 #include "JSObject.h"
+#include "LLIntData.h"
 #include "Opcode.h"
 #include "RegisterFile.h"
 
@@ -42,9 +44,10 @@ namespace JSC {
 
     class CodeBlock;
     class EvalExecutable;
+    class ExecutableBase;
     class FunctionExecutable;
-    class JSFunction;
     class JSGlobalObject;
+    class LLIntOffsetsExtractor;
     class ProgramExecutable;
     class Register;
     class ScopeChainNode;
@@ -62,6 +65,63 @@ namespace JSC {
         WillExecuteStatement
     };
 
+    enum StackFrameCodeType {
+        StackFrameGlobalCode,
+        StackFrameEvalCode,
+        StackFrameFunctionCode,
+        StackFrameNativeCode
+    };
+
+    struct StackFrame {
+        Strong<JSObject> callee;
+        StackFrameCodeType codeType;
+        Strong<ExecutableBase> executable;
+        int line;
+        UString sourceURL;
+        UString toString(CallFrame* callFrame) const
+        {
+            bool hasSourceURLInfo = !sourceURL.isNull() && !sourceURL.isEmpty();
+            bool hasLineInfo = line > -1;
+            String traceLine;
+            JSObject* stackFrameCallee = callee.get();
+
+            switch (codeType) {
+            case StackFrameEvalCode:
+                if (hasSourceURLInfo) {
+                    traceLine = hasLineInfo ? String::format("eval code@%s:%d", sourceURL.ascii().data(), line) 
+                                            : String::format("eval code@%s", sourceURL.ascii().data());
+                } else
+                    traceLine = String::format("eval code");
+                break;
+            case StackFrameNativeCode: {
+                if (callee) {
+                    UString functionName = getCalculatedDisplayName(callFrame, stackFrameCallee);
+                    traceLine = String::format("%s@[native code]", functionName.ascii().data());
+                } else
+                    traceLine = "[native code]";
+                break;
+            }
+            case StackFrameFunctionCode: {
+                UString functionName = getCalculatedDisplayName(callFrame, stackFrameCallee);
+                if (hasSourceURLInfo) {
+                    traceLine = hasLineInfo ? String::format("%s@%s:%d", functionName.ascii().data(), sourceURL.ascii().data(), line)
+                                            : String::format("%s@%s", functionName.ascii().data(), sourceURL.ascii().data());
+                } else
+                    traceLine = String::format("%s\n", functionName.ascii().data());
+                break;
+            }
+            case StackFrameGlobalCode:
+                if (hasSourceURLInfo) {
+                    traceLine = hasLineInfo ? String::format("global code@%s:%d", sourceURL.ascii().data(), line)
+                                            : String::format("global code@%s", sourceURL.ascii().data());
+                } else
+                    traceLine = String::format("global code");
+                    
+            }
+            return traceLine.impl();
+        }
+    };
+
     class TopCallFrameSetter {
     public:
         TopCallFrameSetter(JSGlobalData& global, CallFrame* callFrame)
@@ -90,29 +150,31 @@ namespace JSC {
         }
     };
 
-#if PLATFORM(IOS)
     // We use a smaller reentrancy limit on iPhone because of the high amount of
     // stack space required on the web thread.
-    enum { MaxLargeThreadReentryDepth = 93, MaxSmallThreadReentryDepth = 16 };
+#if PLATFORM(IOS)
+    enum { MaxLargeThreadReentryDepth = 64, MaxSmallThreadReentryDepth = 16 };
 #else
     enum { MaxLargeThreadReentryDepth = 256, MaxSmallThreadReentryDepth = 16 };
 #endif // PLATFORM(IOS)
 
     class Interpreter {
         WTF_MAKE_FAST_ALLOCATED;
-        friend class JIT;
         friend class CachedCall;
+        friend class LLIntOffsetsExtractor;
+        friend class JIT;
     public:
         Interpreter();
+        ~Interpreter();
         
-        void initialize(bool canUseJIT);
+        void initialize(LLInt::Data*, bool canUseJIT);
 
         RegisterFile& registerFile() { return m_registerFile; }
         
         Opcode getOpcode(OpcodeID id)
         {
             ASSERT(m_initialized);
-#if ENABLE(COMPUTED_GOTO_INTERPRETER)
+#if ENABLE(COMPUTED_GOTO_CLASSIC_INTERPRETER) || ENABLE(LLINT)
             return m_opcodeTable[id];
 #else
             return id;
@@ -122,9 +184,12 @@ namespace JSC {
         OpcodeID getOpcodeID(Opcode opcode)
         {
             ASSERT(m_initialized);
-#if ENABLE(COMPUTED_GOTO_INTERPRETER)
+#if ENABLE(LLINT)
+            ASSERT(isOpcode(opcode));
+            return m_opcodeIDTable.get(opcode);
+#elif ENABLE(COMPUTED_GOTO_CLASSIC_INTERPRETER)
             ASSERT(isOpcode(opcode));
-            if (!m_enabled)
+            if (!m_classicEnabled)
                 return static_cast<OpcodeID>(bitwise_cast<uintptr_t>(opcode));
 
             return m_opcodeIDTable.get(opcode);
@@ -132,6 +197,11 @@ namespace JSC {
             return opcode;
 #endif
         }
+        
+        bool classicEnabled()
+        {
+            return m_classicEnabled;
+        }
 
         bool isOpcode(Opcode);
 
@@ -151,6 +221,8 @@ namespace JSC {
 
         NEVER_INLINE HandlerInfo* throwException(CallFrame*&, JSValue&, unsigned bytecodeOffset);
         NEVER_INLINE void debug(CallFrame*, DebugHookID, int firstLine, int lastLine);
+        static const UString getTraceLine(CallFrame*, StackFrameCodeType, const UString&, int);
+        JS_EXPORT_PRIVATE static void getStackTrace(JSGlobalData*, int line, Vector<StackFrame>& results);
 
         void dumpSampleData(ExecState* exec);
         void startSampling();
@@ -162,7 +234,7 @@ namespace JSC {
         void endRepeatCall(CallFrameClosure&);
         JSValue execute(CallFrameClosure&);
 
-#if ENABLE(INTERPRETER)
+#if ENABLE(CLASSIC_INTERPRETER)
         NEVER_INLINE bool resolve(CallFrame*, Instruction*, JSValue& exceptionValue);
         NEVER_INLINE bool resolveSkip(CallFrame*, Instruction*, JSValue& exceptionValue);
         NEVER_INLINE bool resolveGlobal(CallFrame*, Instruction*, JSValue& exceptionValue);
@@ -176,7 +248,7 @@ namespace JSC {
         void uncacheGetByID(CodeBlock*, Instruction* vPC);
         void tryCachePutByID(CallFrame*, CodeBlock*, Instruction*, JSValue baseValue, const PutPropertySlot&);
         void uncachePutByID(CodeBlock*, Instruction* vPC);        
-#endif // ENABLE(INTERPRETER)
+#endif // ENABLE(CLASSIC_INTERPRETER)
 
         NEVER_INLINE bool unwindCallFrame(CallFrame*&, JSValue, unsigned& bytecodeOffset, CodeBlock*&);
 
@@ -199,7 +271,10 @@ namespace JSC {
 
         RegisterFile m_registerFile;
         
-#if ENABLE(COMPUTED_GOTO_INTERPRETER)
+#if ENABLE(LLINT)
+        Opcode* m_opcodeTable; // Maps OpcodeID => Opcode for compiling
+        HashMap<Opcode, OpcodeID> m_opcodeIDTable; // Maps Opcode => OpcodeID for decompiling
+#elif ENABLE(COMPUTED_GOTO_CLASSIC_INTERPRETER)
         Opcode m_opcodeTable[numOpcodeIDs]; // Maps OpcodeID => Opcode for compiling
         HashMap<Opcode, OpcodeID> m_opcodeIDTable; // Maps Opcode => OpcodeID for decompiling
 #endif
@@ -207,7 +282,7 @@ namespace JSC {
 #if !ASSERT_DISABLED
         bool m_initialized;
 #endif
-        bool m_enabled;
+        bool m_classicEnabled;
     };
 
     // This value must not be an object that would require this conversion (WebCore's global object).
diff --git a/Source/JavaScriptCore/interpreter/RegisterFile.h b/Source/JavaScriptCore/interpreter/RegisterFile.h
index e45b869a1..21ad7fbae 100644
--- a/Source/JavaScriptCore/interpreter/RegisterFile.h
+++ b/Source/JavaScriptCore/interpreter/RegisterFile.h
@@ -39,6 +39,7 @@ namespace JSC {
 
     class ConservativeRoots;
     class DFGCodeBlocks;
+    class LLIntOffsetsExtractor;
 
     class RegisterFile {
         WTF_MAKE_NONCOPYABLE(RegisterFile);
@@ -81,6 +82,8 @@ namespace JSC {
         }
 
     private:
+        friend class LLIntOffsetsExtractor;
+        
         bool growSlowCase(Register*);
         void releaseExcessCapacity();
         void addToCommittedByteCount(long);
diff --git a/Source/JavaScriptCore/jit/ExecutableAllocator.h b/Source/JavaScriptCore/jit/ExecutableAllocator.h
index bc8b816c8..7520913d0 100644
--- a/Source/JavaScriptCore/jit/ExecutableAllocator.h
+++ b/Source/JavaScriptCore/jit/ExecutableAllocator.h
@@ -89,12 +89,12 @@ inline size_t roundUpAllocationSize(size_t request, size_t granularity)
 
 }
 
-#if ENABLE(JIT) && ENABLE(ASSEMBLER)
-
 namespace JSC {
 
 typedef WTF::MetaAllocatorHandle ExecutableMemoryHandle;
 
+#if ENABLE(JIT) && ENABLE(ASSEMBLER)
+
 class ExecutableAllocator {
     enum ProtectionSetting { Writable, Executable };
 
@@ -235,8 +235,8 @@ private:
 #endif
 };
 
-} // namespace JSC
-
 #endif // ENABLE(JIT) && ENABLE(ASSEMBLER)
 
+} // namespace JSC
+
 #endif // !defined(ExecutableAllocator)
diff --git a/Source/JavaScriptCore/jit/ExecutableAllocatorFixedVMPool.cpp b/Source/JavaScriptCore/jit/ExecutableAllocatorFixedVMPool.cpp
index 3fe631e3b..37a57e8b7 100644
--- a/Source/JavaScriptCore/jit/ExecutableAllocatorFixedVMPool.cpp
+++ b/Source/JavaScriptCore/jit/ExecutableAllocatorFixedVMPool.cpp
@@ -59,7 +59,7 @@ public:
         : MetaAllocator(32) // round up all allocations to 32 bytes
     {
         m_reservation = PageReservation::reserveWithGuardPages(fixedPoolSize, OSAllocator::JSJITCodePages, EXECUTABLE_POOL_WRITABLE, true);
-#if !ENABLE(INTERPRETER)
+#if !ENABLE(CLASSIC_INTERPRETER)
         if (!m_reservation)
             CRASH();
 #endif
diff --git a/Source/JavaScriptCore/jit/HostCallReturnValue.cpp b/Source/JavaScriptCore/jit/HostCallReturnValue.cpp
new file mode 100644
index 000000000..924bc7671
--- /dev/null
+++ b/Source/JavaScriptCore/jit/HostCallReturnValue.cpp
@@ -0,0 +1,40 @@
+/*
+ * Copyright (C) 2012 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "HostCallReturnValue.h"
+
+#include "CallFrame.h"
+#include "InlineASM.h"
+#include "JSObject.h"
+#include "JSValueInlineMethods.h"
+#include "ScopeChain.h"
+
+namespace JSC {
+
+// Nothing to see here.
+
+} // namespace JSC
+
diff --git a/Source/JavaScriptCore/jit/HostCallReturnValue.h b/Source/JavaScriptCore/jit/HostCallReturnValue.h
new file mode 100644
index 000000000..12fe10b10
--- /dev/null
+++ b/Source/JavaScriptCore/jit/HostCallReturnValue.h
@@ -0,0 +1,67 @@
+/*
+ * Copyright (C) 2012 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef HostCallReturnValue_h
+#define HostCallReturnValue_h
+
+#include "JSValue.h"
+#include "MacroAssemblerCodeRef.h"
+#include <wtf/Platform.h>
+
+// Unfortunately this only works on GCC-like compilers. And it's currently only used
+// by LLInt and DFG, which also are restricted to GCC-like compilers. We should
+// probably fix that at some point.
+#if COMPILER(GCC)
+
+#if CALLING_CONVENTION_IS_STDCALL
+#define HOST_CALL_RETURN_VALUE_OPTION CDECL
+#else
+#define HOST_CALL_RETURN_VALUE_OPTION
+#endif
+
+namespace JSC {
+
+extern "C" EncodedJSValue HOST_CALL_RETURN_VALUE_OPTION getHostCallReturnValue();
+
+// This is a public declaration only to convince CLANG not to elide it.
+extern "C" EncodedJSValue HOST_CALL_RETURN_VALUE_OPTION getHostCallReturnValueWithExecState(ExecState*);
+
+inline void initializeHostCallReturnValue()
+{
+    getHostCallReturnValueWithExecState(0);
+}
+
+}
+
+#else // COMPILER(GCC)
+
+namespace JSC {
+inline void initializeHostCallReturnValue() { }
+}
+
+#endif // COMPILER(GCC)
+
+#endif // HostCallReturnValue_h
+
diff --git a/Source/JavaScriptCore/jit/JIT.cpp b/Source/JavaScriptCore/jit/JIT.cpp
index c8584a316..2adc596ce 100644
--- a/Source/JavaScriptCore/jit/JIT.cpp
+++ b/Source/JavaScriptCore/jit/JIT.cpp
@@ -219,7 +219,7 @@ void JIT::privateCompileMainPass()
         m_labels[m_bytecodeOffset] = label();
 
 #if ENABLE(JIT_VERBOSE)
-        printf("Old JIT emitting code for bc#%u at offset 0x%lx.\n", m_bytecodeOffset, (long)debugOffset());
+        dataLog("Old JIT emitting code for bc#%u at offset 0x%lx.\n", m_bytecodeOffset, (long)debugOffset());
 #endif
 
         switch (m_interpreter->getOpcodeID(currentInstruction->u.opcode)) {
@@ -325,6 +325,8 @@ void JIT::privateCompileMainPass()
         DEFINE_OP(op_profile_will_call)
         DEFINE_OP(op_push_new_scope)
         DEFINE_OP(op_push_scope)
+        case op_put_by_id_transition_direct:
+        case op_put_by_id_transition_normal:
         DEFINE_OP(op_put_by_id)
         DEFINE_OP(op_put_by_index)
         DEFINE_OP(op_put_by_val)
@@ -429,7 +431,7 @@ void JIT::privateCompileSlowCases()
 #endif
 
 #if ENABLE(JIT_VERBOSE)
-        printf("Old JIT emitting slow code for bc#%u at offset 0x%lx.\n", m_bytecodeOffset, (long)debugOffset());
+        dataLog("Old JIT emitting slow code for bc#%u at offset 0x%lx.\n", m_bytecodeOffset, (long)debugOffset());
 #endif
 
         switch (m_interpreter->getOpcodeID(currentInstruction->u.opcode)) {
@@ -486,6 +488,8 @@ void JIT::privateCompileSlowCases()
         DEFINE_SLOWCASE_OP(op_post_inc)
         DEFINE_SLOWCASE_OP(op_pre_dec)
         DEFINE_SLOWCASE_OP(op_pre_inc)
+        case op_put_by_id_transition_direct:
+        case op_put_by_id_transition_normal:
         DEFINE_SLOWCASE_OP(op_put_by_id)
         DEFINE_SLOWCASE_OP(op_put_by_val)
         DEFINE_SLOWCASE_OP(op_resolve_global)
@@ -525,6 +529,10 @@ void JIT::privateCompileSlowCases()
 
 JITCode JIT::privateCompile(CodePtr* functionEntryArityCheck)
 {
+#if ENABLE(JIT_VERBOSE_OSR)
+    printf("Compiling JIT code!\n");
+#endif
+    
 #if ENABLE(VALUE_PROFILER)
     m_canBeOptimized = m_codeBlock->canCompileWithDFG();
 #endif
@@ -693,8 +701,12 @@ JITCode JIT::privateCompile(CodePtr* functionEntryArityCheck)
         info.callReturnLocation = m_codeBlock->structureStubInfo(m_methodCallCompilationInfo[i].propertyAccessIndex).callReturnLocation;
     }
 
-#if ENABLE(DFG_JIT)
-    if (m_canBeOptimized) {
+#if ENABLE(DFG_JIT) || ENABLE(LLINT)
+    if (m_canBeOptimized
+#if ENABLE(LLINT)
+        || true
+#endif
+        ) {
         CompactJITCodeMap::Encoder jitCodeMapEncoder;
         for (unsigned bytecodeOffset = 0; bytecodeOffset < m_labels.size(); ++bytecodeOffset) {
             if (m_labels[bytecodeOffset].isSet())
@@ -710,7 +722,7 @@ JITCode JIT::privateCompile(CodePtr* functionEntryArityCheck)
     CodeRef result = patchBuffer.finalizeCode();
     
 #if ENABLE(JIT_VERBOSE)
-    printf("JIT generated code for %p at [%p, %p).\n", m_codeBlock, result.executableMemory()->start(), result.executableMemory()->end());
+    dataLog("JIT generated code for %p at [%p, %p).\n", m_codeBlock, result.executableMemory()->start(), result.executableMemory()->end());
 #endif
     
     return JITCode(result, JITCode::BaselineJIT);
diff --git a/Source/JavaScriptCore/jit/JIT.h b/Source/JavaScriptCore/jit/JIT.h
index 8dd332893..a2bc4272a 100644
--- a/Source/JavaScriptCore/jit/JIT.h
+++ b/Source/JavaScriptCore/jit/JIT.h
@@ -335,7 +335,7 @@ namespace JSC {
         void emitWriteBarrier(RegisterID owner, RegisterID valueTag, RegisterID scratch, RegisterID scratch2, WriteBarrierMode, WriteBarrierUseKind);
         void emitWriteBarrier(JSCell* owner, RegisterID value, RegisterID scratch, WriteBarrierMode, WriteBarrierUseKind);
 
-        template<typename ClassType, typename StructureType> void emitAllocateBasicJSObject(StructureType, RegisterID result, RegisterID storagePtr);
+        template<typename ClassType, bool destructor, typename StructureType> void emitAllocateBasicJSObject(StructureType, RegisterID result, RegisterID storagePtr);
         template<typename T> void emitAllocateJSFinalObject(T structure, RegisterID result, RegisterID storagePtr);
         void emitAllocateJSFunction(FunctionExecutable*, RegisterID scopeChain, RegisterID result, RegisterID storagePtr);
         
@@ -500,7 +500,7 @@ namespace JSC {
 #if ENABLE(OPCODE_SAMPLING)
         #error "OPCODE_SAMPLING is not yet supported"
 #else
-        static const int patchOffsetGetByIdSlowCaseCall = 56;
+        static const int patchOffsetGetByIdSlowCaseCall = 64;
 #endif
         static const int patchOffsetOpCallCompareToJump = 32;
         static const int patchOffsetMethodCheckProtoObj = 32;
@@ -518,7 +518,7 @@ namespace JSC {
 #if ENABLE(OPCODE_SAMPLING)
         #error "OPCODE_SAMPLING is not yet supported"
 #else
-        static const int patchOffsetGetByIdSlowCaseCall = 56;
+        static const int patchOffsetGetByIdSlowCaseCall = 64;
 #endif
         static const int patchOffsetOpCallCompareToJump = 32;
         static const int patchOffsetMethodCheckProtoObj = 32;
diff --git a/Source/JavaScriptCore/jit/JITCode.h b/Source/JavaScriptCore/jit/JITCode.h
index f63c4a1a8..3ae5ff234 100644
--- a/Source/JavaScriptCore/jit/JITCode.h
+++ b/Source/JavaScriptCore/jit/JITCode.h
@@ -48,7 +48,7 @@ namespace JSC {
         JITCode() { }
 #endif
     public:
-        enum JITType { HostCallThunk, BaselineJIT, DFGJIT };
+        enum JITType { None, HostCallThunk, InterpreterThunk, BaselineJIT, DFGJIT };
         
         static JITType bottomTierJIT()
         {
@@ -66,8 +66,19 @@ namespace JSC {
             return DFGJIT;
         }
         
+        static bool isOptimizingJIT(JITType jitType)
+        {
+            return jitType == DFGJIT;
+        }
+        
+        static bool isBaselineCode(JITType jitType)
+        {
+            return jitType == InterpreterThunk || jitType == BaselineJIT;
+        }
+        
 #if ENABLE(JIT)
         JITCode()
+            : m_jitType(None)
         {
         }
 
@@ -75,6 +86,7 @@ namespace JSC {
             : m_ref(ref)
             , m_jitType(jitType)
         {
+            ASSERT(jitType != None);
         }
         
         bool operator !() const
diff --git a/Source/JavaScriptCore/jit/JITDriver.h b/Source/JavaScriptCore/jit/JITDriver.h
index 4b8df4751..b204c7737 100644
--- a/Source/JavaScriptCore/jit/JITDriver.h
+++ b/Source/JavaScriptCore/jit/JITDriver.h
@@ -33,15 +33,21 @@
 #include "BytecodeGenerator.h"
 #include "DFGDriver.h"
 #include "JIT.h"
+#include "LLIntEntrypoints.h"
 
 namespace JSC {
 
 template<typename CodeBlockType>
 inline bool jitCompileIfAppropriate(JSGlobalData& globalData, OwnPtr<CodeBlockType>& codeBlock, JITCode& jitCode, JITCode::JITType jitType)
 {
+    if (jitType == codeBlock->getJITType())
+        return true;
+    
     if (!globalData.canUseJIT())
         return true;
     
+    codeBlock->unlinkIncomingCalls();
+    
     bool dfgCompiled = false;
     if (jitType == JITCode::DFGJIT)
         dfgCompiled = DFG::tryCompile(globalData, codeBlock.get(), jitCode);
@@ -62,9 +68,14 @@ inline bool jitCompileIfAppropriate(JSGlobalData& globalData, OwnPtr<CodeBlockTy
 
 inline bool jitCompileFunctionIfAppropriate(JSGlobalData& globalData, OwnPtr<FunctionCodeBlock>& codeBlock, JITCode& jitCode, MacroAssemblerCodePtr& jitCodeWithArityCheck, SharedSymbolTable*& symbolTable, JITCode::JITType jitType)
 {
+    if (jitType == codeBlock->getJITType())
+        return true;
+    
     if (!globalData.canUseJIT())
         return true;
     
+    codeBlock->unlinkIncomingCalls();
+    
     bool dfgCompiled = false;
     if (jitType == JITCode::DFGJIT)
         dfgCompiled = DFG::tryCompileFunction(globalData, codeBlock.get(), jitCode, jitCodeWithArityCheck);
@@ -79,7 +90,6 @@ inline bool jitCompileFunctionIfAppropriate(JSGlobalData& globalData, OwnPtr<Fun
         }
         jitCode = JIT::compile(&globalData, codeBlock.get(), &jitCodeWithArityCheck);
     }
-    
     codeBlock->setJITCode(jitCode, jitCodeWithArityCheck);
     
     return true;
diff --git a/Source/JavaScriptCore/jit/JITExceptions.cpp b/Source/JavaScriptCore/jit/JITExceptions.cpp
index 24baca41b..2edd3408f 100644
--- a/Source/JavaScriptCore/jit/JITExceptions.cpp
+++ b/Source/JavaScriptCore/jit/JITExceptions.cpp
@@ -64,7 +64,7 @@ ExceptionHandler genericThrow(JSGlobalData* globalData, ExecState* callFrame, JS
 
 ExceptionHandler jitThrow(JSGlobalData* globalData, ExecState* callFrame, JSValue exceptionValue, ReturnAddressPtr faultLocation)
 {
-    return genericThrow(globalData, callFrame, exceptionValue, callFrame->codeBlock()->bytecodeOffset(faultLocation));
+    return genericThrow(globalData, callFrame, exceptionValue, callFrame->codeBlock()->bytecodeOffset(callFrame, faultLocation));
 }
 
 }
diff --git a/Source/JavaScriptCore/jit/JITInlineMethods.h b/Source/JavaScriptCore/jit/JITInlineMethods.h
index dfcfbd499..e0310569d 100644
--- a/Source/JavaScriptCore/jit/JITInlineMethods.h
+++ b/Source/JavaScriptCore/jit/JITInlineMethods.h
@@ -265,8 +265,13 @@ ALWAYS_INLINE void JIT::restoreArgumentReference()
 ALWAYS_INLINE void JIT::updateTopCallFrame()
 {
     ASSERT(static_cast<int>(m_bytecodeOffset) >= 0);
-    if (m_bytecodeOffset)
+    if (m_bytecodeOffset) {
+#if USE(JSVALUE32_64)
+        storePtr(TrustedImmPtr(m_codeBlock->instructions().begin() + m_bytecodeOffset + 1), intTagFor(RegisterFile::ArgumentCount));
+#else
         store32(Imm32(m_bytecodeOffset + 1), intTagFor(RegisterFile::ArgumentCount));
+#endif
+    }
     storePtr(callFrameRegister, &m_globalData->topCallFrame);
 }
 
@@ -402,9 +407,13 @@ ALWAYS_INLINE bool JIT::isOperandConstantImmediateChar(unsigned src)
     return m_codeBlock->isConstantRegisterIndex(src) && getConstantOperand(src).isString() && asString(getConstantOperand(src).asCell())->length() == 1;
 }
 
-template <typename ClassType, typename StructureType> inline void JIT::emitAllocateBasicJSObject(StructureType structure, RegisterID result, RegisterID storagePtr)
+template <typename ClassType, bool destructor, typename StructureType> inline void JIT::emitAllocateBasicJSObject(StructureType structure, RegisterID result, RegisterID storagePtr)
 {
-    MarkedAllocator* allocator = &m_globalData->heap.allocatorForObject(sizeof(ClassType));
+    MarkedAllocator* allocator = 0;
+    if (destructor)
+        allocator = &m_globalData->heap.allocatorForObjectWithDestructor(sizeof(ClassType));
+    else
+        allocator = &m_globalData->heap.allocatorForObjectWithoutDestructor(sizeof(ClassType));
     loadPtr(&allocator->m_firstFreeCell, result);
     addSlowCase(branchTestPtr(Zero, result));
 
@@ -428,12 +437,12 @@ template <typename ClassType, typename StructureType> inline void JIT::emitAlloc
 
 template <typename T> inline void JIT::emitAllocateJSFinalObject(T structure, RegisterID result, RegisterID scratch)
 {
-    emitAllocateBasicJSObject<JSFinalObject>(structure, result, scratch);
+    emitAllocateBasicJSObject<JSFinalObject, false, T>(structure, result, scratch);
 }
 
 inline void JIT::emitAllocateJSFunction(FunctionExecutable* executable, RegisterID scopeChain, RegisterID result, RegisterID storagePtr)
 {
-    emitAllocateBasicJSObject<JSFunction>(TrustedImmPtr(m_codeBlock->globalObject()->namedFunctionStructure()), result, storagePtr);
+    emitAllocateBasicJSObject<JSFunction, true>(TrustedImmPtr(m_codeBlock->globalObject()->namedFunctionStructure()), result, storagePtr);
 
     // store the function's scope chain
     storePtr(scopeChain, Address(result, JSFunction::offsetOfScopeChain()));
@@ -676,6 +685,9 @@ inline void JIT::map(unsigned bytecodeOffset, int virtualRegisterIndex, Register
     m_mappedVirtualRegisterIndex = virtualRegisterIndex;
     m_mappedTag = tag;
     m_mappedPayload = payload;
+    
+    ASSERT(!canBeOptimized() || m_mappedPayload == regT0);
+    ASSERT(!canBeOptimized() || m_mappedTag == regT1);
 }
 
 inline void JIT::unmap(RegisterID registerID)
diff --git a/Source/JavaScriptCore/jit/JITOpcodes.cpp b/Source/JavaScriptCore/jit/JITOpcodes.cpp
index 8a2077e47..bc53d2cd8 100644
--- a/Source/JavaScriptCore/jit/JITOpcodes.cpp
+++ b/Source/JavaScriptCore/jit/JITOpcodes.cpp
@@ -80,7 +80,8 @@ PassRefPtr<ExecutableMemoryHandle> JIT::privateCompileCTIMachineTrampolines(JSGl
     // Also initialize ReturnPC for use by lazy linking and exceptions.
     preserveReturnAddressAfterCall(regT3);
     emitPutToCallFrameHeader(regT3, RegisterFile::ReturnPC);
-
+    
+    storePtr(callFrameRegister, &m_globalData->topCallFrame);
     restoreArgumentReference();
     Call callLazyLinkCall = call();
     restoreReturnAddressBeforeReturn(regT3);
@@ -99,7 +100,8 @@ PassRefPtr<ExecutableMemoryHandle> JIT::privateCompileCTIMachineTrampolines(JSGl
     // Also initialize ReturnPC for use by lazy linking and exeptions.
     preserveReturnAddressAfterCall(regT3);
     emitPutToCallFrameHeader(regT3, RegisterFile::ReturnPC);
-
+    
+    storePtr(callFrameRegister, &m_globalData->topCallFrame);
     restoreArgumentReference();
     Call callLazyLinkConstruct = call();
     restoreReturnAddressBeforeReturn(regT3);
@@ -118,6 +120,7 @@ PassRefPtr<ExecutableMemoryHandle> JIT::privateCompileCTIMachineTrampolines(JSGl
     loadPtr(Address(regT0, OBJECT_OFFSETOF(JSFunction, m_executable)), regT2);
     Jump hasCodeBlock1 = branch32(GreaterThanOrEqual, Address(regT2, OBJECT_OFFSETOF(FunctionExecutable, m_numParametersForCall)), TrustedImm32(0));
     preserveReturnAddressAfterCall(regT3);
+    storePtr(callFrameRegister, &m_globalData->topCallFrame);
     restoreArgumentReference();
     Call callCompileCall = call();
     restoreReturnAddressBeforeReturn(regT3);
@@ -140,6 +143,7 @@ PassRefPtr<ExecutableMemoryHandle> JIT::privateCompileCTIMachineTrampolines(JSGl
     loadPtr(Address(regT0, OBJECT_OFFSETOF(JSFunction, m_executable)), regT2);
     Jump hasCodeBlock2 = branch32(GreaterThanOrEqual, Address(regT2, OBJECT_OFFSETOF(FunctionExecutable, m_numParametersForConstruct)), TrustedImm32(0));
     preserveReturnAddressAfterCall(regT3);
+    storePtr(callFrameRegister, &m_globalData->topCallFrame);
     restoreArgumentReference();
     Call callCompileConstruct = call();
     restoreReturnAddressBeforeReturn(regT3);
diff --git a/Source/JavaScriptCore/jit/JITOpcodes32_64.cpp b/Source/JavaScriptCore/jit/JITOpcodes32_64.cpp
index 99594c3f1..1a09302cf 100644
--- a/Source/JavaScriptCore/jit/JITOpcodes32_64.cpp
+++ b/Source/JavaScriptCore/jit/JITOpcodes32_64.cpp
@@ -79,7 +79,8 @@ PassRefPtr<ExecutableMemoryHandle> JIT::privateCompileCTIMachineTrampolines(JSGl
     // Also initialize ReturnPC for use by lazy linking and exceptions.
     preserveReturnAddressAfterCall(regT3);
     emitPutToCallFrameHeader(regT3, RegisterFile::ReturnPC);
-
+    
+    storePtr(callFrameRegister, &m_globalData->topCallFrame);
     restoreArgumentReference();
     Call callLazyLinkCall = call();
     restoreReturnAddressBeforeReturn(regT3);
@@ -98,7 +99,8 @@ PassRefPtr<ExecutableMemoryHandle> JIT::privateCompileCTIMachineTrampolines(JSGl
     // Also initialize ReturnPC for use by lazy linking and exeptions.
     preserveReturnAddressAfterCall(regT3);
     emitPutToCallFrameHeader(regT3, RegisterFile::ReturnPC);
-
+    
+    storePtr(callFrameRegister, &m_globalData->topCallFrame);
     restoreArgumentReference();
     Call callLazyLinkConstruct = call();
     restoreReturnAddressBeforeReturn(regT3);
@@ -117,6 +119,8 @@ PassRefPtr<ExecutableMemoryHandle> JIT::privateCompileCTIMachineTrampolines(JSGl
     loadPtr(Address(regT0, OBJECT_OFFSETOF(JSFunction, m_executable)), regT2);
     Jump hasCodeBlock1 = branch32(GreaterThanOrEqual, Address(regT2, OBJECT_OFFSETOF(FunctionExecutable, m_numParametersForCall)), TrustedImm32(0));
     preserveReturnAddressAfterCall(regT3);
+    
+    storePtr(callFrameRegister, &m_globalData->topCallFrame);
     restoreArgumentReference();
     Call callCompileCall = call();
     restoreReturnAddressBeforeReturn(regT3);
@@ -139,6 +143,8 @@ PassRefPtr<ExecutableMemoryHandle> JIT::privateCompileCTIMachineTrampolines(JSGl
     loadPtr(Address(regT0, OBJECT_OFFSETOF(JSFunction, m_executable)), regT2);
     Jump hasCodeBlock2 = branch32(GreaterThanOrEqual, Address(regT2, OBJECT_OFFSETOF(FunctionExecutable, m_numParametersForConstruct)), TrustedImm32(0));
     preserveReturnAddressAfterCall(regT3);
+    
+    storePtr(callFrameRegister, &m_globalData->topCallFrame);
     restoreArgumentReference();
     Call callCompileConstruct = call();
     restoreReturnAddressBeforeReturn(regT3);
@@ -348,7 +354,8 @@ JIT::Label JIT::privateCompileCTINativeCall(JSGlobalData* globalData, bool isCon
     move(TrustedImmPtr(&globalData->exceptionLocation), regT2);
     storePtr(regT1, regT2);
     poke(callFrameRegister, OBJECT_OFFSETOF(struct JITStackFrame, callFrame) / sizeof(void*));
-
+    
+    storePtr(callFrameRegister, &m_globalData->topCallFrame);
     // Set the return address.
     move(TrustedImmPtr(FunctionPtr(ctiVMThrowTrampoline).value()), regT1);
     restoreReturnAddressBeforeReturn(regT1);
@@ -484,7 +491,8 @@ JIT::CodeRef JIT::privateCompileCTINativeCall(JSGlobalData* globalData, NativeFu
     move(TrustedImmPtr(&globalData->exceptionLocation), regT2);
     storePtr(regT1, regT2);
     poke(callFrameRegister, OBJECT_OFFSETOF(struct JITStackFrame, callFrame) / sizeof(void*));
-
+    
+    storePtr(callFrameRegister, &m_globalData->topCallFrame);
     // Set the return address.
     move(TrustedImmPtr(FunctionPtr(ctiVMThrowTrampoline).value()), regT1);
     restoreReturnAddressBeforeReturn(regT1);
diff --git a/Source/JavaScriptCore/jit/JITPropertyAccess.cpp b/Source/JavaScriptCore/jit/JITPropertyAccess.cpp
index 9fa29e2d9..99c038e55 100644
--- a/Source/JavaScriptCore/jit/JITPropertyAccess.cpp
+++ b/Source/JavaScriptCore/jit/JITPropertyAccess.cpp
@@ -526,8 +526,16 @@ void JIT::privateCompilePutByIdTransition(StructureStubInfo* stubInfo, Structure
         }
     }
 
-    Call callTarget;
-
+    // If we succeed in all of our checks, and the code was optimizable, then make sure we
+    // decrement the rare case counter.
+#if ENABLE(VALUE_PROFILER)
+    if (m_codeBlock->canCompileWithDFG()) {
+        sub32(
+            TrustedImm32(1),
+            AbsoluteAddress(&m_codeBlock->rareCaseProfileForBytecodeOffset(stubInfo->bytecodeIndex)->m_counter));
+    }
+#endif
+    
     // emit a call only if storage realloc is needed
     bool willNeedStorageRealloc = oldStructure->propertyStorageCapacity() != newStructure->propertyStorageCapacity();
     if (willNeedStorageRealloc) {
diff --git a/Source/JavaScriptCore/jit/JITPropertyAccess32_64.cpp b/Source/JavaScriptCore/jit/JITPropertyAccess32_64.cpp
index 2c81a5ff6..1ee2915dc 100644
--- a/Source/JavaScriptCore/jit/JITPropertyAccess32_64.cpp
+++ b/Source/JavaScriptCore/jit/JITPropertyAccess32_64.cpp
@@ -493,6 +493,16 @@ void JIT::privateCompilePutByIdTransition(StructureStubInfo* stubInfo, Structure
             testPrototype((*it)->storedPrototype(), failureCases);
     }
 
+    // If we succeed in all of our checks, and the code was optimizable, then make sure we
+    // decrement the rare case counter.
+#if ENABLE(VALUE_PROFILER)
+    if (m_codeBlock->canCompileWithDFG()) {
+        sub32(
+            TrustedImm32(1),
+            AbsoluteAddress(&m_codeBlock->rareCaseProfileForBytecodeOffset(stubInfo->bytecodeIndex)->m_counter));
+    }
+#endif
+    
     // Reallocate property storage if needed.
     Call callTarget;
     bool willNeedStorageRealloc = oldStructure->propertyStorageCapacity() != newStructure->propertyStorageCapacity();
diff --git a/Source/JavaScriptCore/jit/JITStubs.cpp b/Source/JavaScriptCore/jit/JITStubs.cpp
index 386d0dfa1..a0a816505 100644
--- a/Source/JavaScriptCore/jit/JITStubs.cpp
+++ b/Source/JavaScriptCore/jit/JITStubs.cpp
@@ -1446,6 +1446,7 @@ DEFINE_STUB_FUNCTION(void, op_put_by_id_direct)
     PutPropertySlot slot(callFrame->codeBlock()->isStrictMode());
     JSValue baseValue = stackFrame.args[0].jsValue();
     ASSERT(baseValue.isObject());
+    
     asObject(baseValue)->putDirect(callFrame->globalData(), ident, stackFrame.args[2].jsValue(), slot);
     
     CodeBlock* codeBlock = stackFrame.callFrame->codeBlock();
@@ -1931,16 +1932,16 @@ DEFINE_STUB_FUNCTION(void, optimize_from_loop)
     unsigned bytecodeIndex = stackFrame.args[0].int32();
 
 #if ENABLE(JIT_VERBOSE_OSR)
-    printf("Entered optimize_from_loop with executeCounter = %d, reoptimizationRetryCounter = %u, optimizationDelayCounter = %u\n", codeBlock->jitExecuteCounter(), codeBlock->reoptimizationRetryCounter(), codeBlock->optimizationDelayCounter());
+    dataLog("%p: Entered optimize_from_loop with executeCounter = %d, reoptimizationRetryCounter = %u, optimizationDelayCounter = %u\n", codeBlock, codeBlock->jitExecuteCounter(), codeBlock->reoptimizationRetryCounter(), codeBlock->optimizationDelayCounter());
 #endif
 
     if (codeBlock->hasOptimizedReplacement()) {
 #if ENABLE(JIT_VERBOSE_OSR)
-        printf("Considering loop OSR into %p(%p) with success/fail %u/%u.\n", codeBlock, codeBlock->replacement(), codeBlock->replacement()->speculativeSuccessCounter(), codeBlock->replacement()->speculativeFailCounter());
+        dataLog("Considering loop OSR into %p(%p) with success/fail %u/%u.\n", codeBlock, codeBlock->replacement(), codeBlock->replacement()->speculativeSuccessCounter(), codeBlock->replacement()->speculativeFailCounter());
 #endif
         if (codeBlock->replacement()->shouldReoptimizeFromLoopNow()) {
 #if ENABLE(JIT_VERBOSE_OSR)
-            printf("Triggering reoptimization of %p(%p) (in loop).\n", codeBlock, codeBlock->replacement());
+            dataLog("Triggering reoptimization of %p(%p) (in loop).\n", codeBlock, codeBlock->replacement());
 #endif
             codeBlock->reoptimize();
             return;
@@ -1948,7 +1949,7 @@ DEFINE_STUB_FUNCTION(void, optimize_from_loop)
     } else {
         if (!codeBlock->shouldOptimizeNow()) {
 #if ENABLE(JIT_VERBOSE_OSR)
-            printf("Delaying optimization for %p (in loop) because of insufficient profiling.\n", codeBlock);
+            dataLog("Delaying optimization for %p (in loop) because of insufficient profiling.\n", codeBlock);
 #endif
             return;
         }
@@ -1958,14 +1959,14 @@ DEFINE_STUB_FUNCTION(void, optimize_from_loop)
         JSObject* error = codeBlock->compileOptimized(callFrame, scopeChain);
 #if ENABLE(JIT_VERBOSE_OSR)
         if (error)
-            fprintf(stderr, "WARNING: optimized compilation from loop failed.\n");
+            dataLog("WARNING: optimized compilation from loop failed.\n");
 #else
         UNUSED_PARAM(error);
 #endif
         
         if (codeBlock->replacement() == codeBlock) {
 #if ENABLE(JIT_VERBOSE_OSR)
-            printf("Optimizing %p from loop failed.\n", codeBlock);
+            dataLog("Optimizing %p from loop failed.\n", codeBlock);
 #endif
             
             ASSERT(codeBlock->getJITType() == JITCode::BaselineJIT);
@@ -1979,7 +1980,7 @@ DEFINE_STUB_FUNCTION(void, optimize_from_loop)
     
     if (void* address = DFG::prepareOSREntry(callFrame, optimizedCodeBlock, bytecodeIndex)) {
 #if ENABLE(JIT_VERBOSE_OSR)
-        printf("Optimizing %p from loop succeeded, performing OSR after a delay of %u.\n", codeBlock, codeBlock->optimizationDelayCounter());
+        dataLog("Optimizing %p from loop succeeded, performing OSR after a delay of %u.\n", codeBlock, codeBlock->optimizationDelayCounter());
 #endif
 
         codeBlock->optimizeSoon();
@@ -1989,7 +1990,7 @@ DEFINE_STUB_FUNCTION(void, optimize_from_loop)
     }
     
 #if ENABLE(JIT_VERBOSE_OSR)
-    printf("Optimizing %p from loop succeeded, OSR failed, after a delay of %u.\n", codeBlock, codeBlock->optimizationDelayCounter());
+    dataLog("Optimizing %p from loop succeeded, OSR failed, after a delay of %u.\n", codeBlock, codeBlock->optimizationDelayCounter());
 #endif
 
     // Count the OSR failure as a speculation failure. If this happens a lot, then
@@ -1997,7 +1998,7 @@ DEFINE_STUB_FUNCTION(void, optimize_from_loop)
     optimizedCodeBlock->countSpeculationFailure();
     
 #if ENABLE(JIT_VERBOSE_OSR)
-    printf("Encountered loop OSR failure into %p(%p) with success/fail %u/%u.\n", codeBlock, codeBlock->replacement(), codeBlock->replacement()->speculativeSuccessCounter(), codeBlock->replacement()->speculativeFailCounter());
+    dataLog("Encountered loop OSR failure into %p(%p) with success/fail %u/%u.\n", codeBlock, codeBlock->replacement(), codeBlock->replacement()->speculativeSuccessCounter(), codeBlock->replacement()->speculativeFailCounter());
 #endif
 
     // We are a lot more conservative about triggering reoptimization after OSR failure than
@@ -2010,7 +2011,7 @@ DEFINE_STUB_FUNCTION(void, optimize_from_loop)
     // reoptimization trigger.
     if (optimizedCodeBlock->shouldReoptimizeNow()) {
 #if ENABLE(JIT_VERBOSE_OSR)
-        printf("Triggering reoptimization of %p(%p) (in loop after OSR fail).\n", codeBlock, codeBlock->replacement());
+        dataLog("Triggering reoptimization of %p(%p) (in loop after OSR fail).\n", codeBlock, codeBlock->replacement());
 #endif
         codeBlock->reoptimize();
         return;
@@ -2029,20 +2030,20 @@ DEFINE_STUB_FUNCTION(void, optimize_from_ret)
     CodeBlock* codeBlock = callFrame->codeBlock();
     
 #if ENABLE(JIT_VERBOSE_OSR)
-    printf("Entered optimize_from_ret with executeCounter = %d, reoptimizationRetryCounter = %u, optimizationDelayCounter = %u\n", codeBlock->jitExecuteCounter(), codeBlock->reoptimizationRetryCounter(), codeBlock->optimizationDelayCounter());
+    dataLog("Entered optimize_from_ret with executeCounter = %d, reoptimizationRetryCounter = %u, optimizationDelayCounter = %u\n", codeBlock->jitExecuteCounter(), codeBlock->reoptimizationRetryCounter(), codeBlock->optimizationDelayCounter());
 #endif
 
     if (codeBlock->hasOptimizedReplacement()) {
 #if ENABLE(JIT_VERBOSE_OSR)
-        printf("Returning from old JIT call frame with optimized replacement %p(%p), with success/fail %u/%u", codeBlock, codeBlock->replacement(), codeBlock->replacement()->speculativeSuccessCounter(), codeBlock->replacement()->speculativeFailCounter());
+        dataLog("Returning from old JIT call frame with optimized replacement %p(%p), with success/fail %u/%u", codeBlock, codeBlock->replacement(), codeBlock->replacement()->speculativeSuccessCounter(), codeBlock->replacement()->speculativeFailCounter());
         CallFrame* callerFrame = callFrame->callerFrame();
         if (callerFrame)
-            printf(", callerFrame = %p, returnPC = %p, caller code block = %p", callerFrame, callFrame->returnPC().value(), callerFrame->codeBlock());
-        printf("\n");
+            dataLog(", callerFrame = %p, returnPC = %p, caller code block = %p", callerFrame, callFrame->returnPC().value(), callerFrame->codeBlock());
+        dataLog("\n");
 #endif
         if (codeBlock->replacement()->shouldReoptimizeNow()) {
 #if ENABLE(JIT_VERBOSE_OSR)
-            printf("Triggering reoptimization of %p(%p) (in return).\n", codeBlock, codeBlock->replacement());
+            dataLog("Triggering reoptimization of %p(%p) (in return).\n", codeBlock, codeBlock->replacement());
 #endif
             codeBlock->reoptimize();
         }
@@ -2053,7 +2054,7 @@ DEFINE_STUB_FUNCTION(void, optimize_from_ret)
     
     if (!codeBlock->shouldOptimizeNow()) {
 #if ENABLE(JIT_VERBOSE_OSR)
-        printf("Delaying optimization for %p (in return) because of insufficient profiling.\n", codeBlock);
+        dataLog("Delaying optimization for %p (in return) because of insufficient profiling.\n", codeBlock);
 #endif
         return;
     }
@@ -2062,11 +2063,11 @@ DEFINE_STUB_FUNCTION(void, optimize_from_ret)
 
     JSObject* error = codeBlock->compileOptimized(callFrame, scopeChain);
     if (error)
-        fprintf(stderr, "WARNING: optimized compilation from ret failed.\n");
+        dataLog("WARNING: optimized compilation from ret failed.\n");
     
     if (codeBlock->replacement() == codeBlock) {
 #if ENABLE(JIT_VERBOSE_OSR)
-        printf("Optimizing %p from return failed.\n", codeBlock);
+        dataLog("Optimizing %p from return failed.\n", codeBlock);
 #endif
 
         ASSERT(codeBlock->getJITType() == JITCode::BaselineJIT);
@@ -2077,7 +2078,7 @@ DEFINE_STUB_FUNCTION(void, optimize_from_ret)
     ASSERT(codeBlock->replacement()->getJITType() == JITCode::DFGJIT);
 
 #if ENABLE(JIT_VERBOSE_OSR)
-    printf("Optimizing %p from return succeeded after a delay of %u.\n", codeBlock, codeBlock->optimizationDelayCounter());
+    dataLog("Optimizing %p from return succeeded after a delay of %u.\n", codeBlock, codeBlock->optimizationDelayCounter());
 #endif
     
     codeBlock->optimizeSoon();
@@ -2186,45 +2187,13 @@ DEFINE_STUB_FUNCTION(void*, op_construct_jitCompile)
     return result;
 }
 
-inline CallFrame* arityCheckFor(CallFrame* callFrame, RegisterFile* registerFile, CodeSpecializationKind kind)
-{
-    JSFunction* callee = asFunction(callFrame->callee());
-    ASSERT(!callee->isHostFunction());
-    CodeBlock* newCodeBlock = &callee->jsExecutable()->generatedBytecodeFor(kind);
-    int argumentCountIncludingThis = callFrame->argumentCountIncludingThis();
-
-    // This ensures enough space for the worst case scenario of zero arguments passed by the caller.
-    if (!registerFile->grow(callFrame->registers() + newCodeBlock->numParameters() + newCodeBlock->m_numCalleeRegisters))
-        return 0;
-
-    ASSERT(argumentCountIncludingThis < newCodeBlock->numParameters());
-
-    // Too few arguments -- copy call frame and arguments, then fill in missing arguments with undefined.
-    size_t delta = newCodeBlock->numParameters() - argumentCountIncludingThis;
-    Register* src = callFrame->registers();
-    Register* dst = callFrame->registers() + delta;
-
-    int i;
-    int end = -CallFrame::offsetFor(argumentCountIncludingThis);
-    for (i = -1; i >= end; --i)
-        dst[i] = src[i];
-
-    end -= delta;
-    for ( ; i >= end; --i)
-        dst[i] = jsUndefined();
-
-    CallFrame* newCallFrame = CallFrame::create(dst);
-    ASSERT((void*)newCallFrame <= registerFile->end());
-    return newCallFrame;
-}
-
 DEFINE_STUB_FUNCTION(void*, op_call_arityCheck)
 {
     STUB_INIT_STACK_FRAME(stackFrame);
 
     CallFrame* callFrame = stackFrame.callFrame;
 
-    CallFrame* newCallFrame = arityCheckFor(callFrame, stackFrame.registerFile, CodeForCall);
+    CallFrame* newCallFrame = CommonSlowPaths::arityCheckFor(callFrame, stackFrame.registerFile, CodeForCall);
     if (!newCallFrame)
         return throwExceptionFromOpCall<void*>(stackFrame, callFrame, STUB_RETURN_ADDRESS, createStackOverflowError(callFrame->callerFrame()));
 
@@ -2237,7 +2206,7 @@ DEFINE_STUB_FUNCTION(void*, op_construct_arityCheck)
 
     CallFrame* callFrame = stackFrame.callFrame;
 
-    CallFrame* newCallFrame = arityCheckFor(callFrame, stackFrame.registerFile, CodeForConstruct);
+    CallFrame* newCallFrame = CommonSlowPaths::arityCheckFor(callFrame, stackFrame.registerFile, CodeForConstruct);
     if (!newCallFrame)
         return throwExceptionFromOpCall<void*>(stackFrame, callFrame, STUB_RETURN_ADDRESS, createStackOverflowError(callFrame->callerFrame()));
 
@@ -2314,6 +2283,7 @@ DEFINE_STUB_FUNCTION(EncodedJSValue, op_call_NotJSFunction)
     STUB_INIT_STACK_FRAME(stackFrame);
 
     CallFrame* callFrame = stackFrame.callFrame;
+    
     JSValue callee = callFrame->calleeAsValue();
 
     CallData callData;
@@ -3600,15 +3570,15 @@ MacroAssemblerCodeRef JITThunks::ctiStub(JSGlobalData* globalData, ThunkGenerato
 
 NativeExecutable* JITThunks::hostFunctionStub(JSGlobalData* globalData, NativeFunction function, NativeFunction constructor)
 {
-    std::pair<HostFunctionStubMap::iterator, bool> entry = m_hostFunctionStubMap->add(function, Weak<NativeExecutable>());
-    if (!*entry.first->second)
-        entry.first->second.set(*globalData, NativeExecutable::create(*globalData, JIT::compileCTINativeCall(globalData, function), function, MacroAssemblerCodeRef::createSelfManagedCodeRef(ctiNativeConstruct()), constructor, NoIntrinsic));
-    return entry.first->second.get();
+    std::pair<HostFunctionStubMap::iterator, bool> result = m_hostFunctionStubMap->add(function, PassWeak<NativeExecutable>());
+    if (!result.first->second)
+        result.first->second = PassWeak<NativeExecutable>(*globalData, NativeExecutable::create(*globalData, JIT::compileCTINativeCall(globalData, function), function, MacroAssemblerCodeRef::createSelfManagedCodeRef(ctiNativeConstruct()), constructor, NoIntrinsic));
+    return result.first->second.get();
 }
 
 NativeExecutable* JITThunks::hostFunctionStub(JSGlobalData* globalData, NativeFunction function, ThunkGenerator generator, Intrinsic intrinsic)
 {
-    std::pair<HostFunctionStubMap::iterator, bool> entry = m_hostFunctionStubMap->add(function, Weak<NativeExecutable>());
+    std::pair<HostFunctionStubMap::iterator, bool> entry = m_hostFunctionStubMap->add(function, PassWeak<NativeExecutable>());
     if (!*entry.first->second) {
         MacroAssemblerCodeRef code;
         if (generator) {
@@ -3618,7 +3588,7 @@ NativeExecutable* JITThunks::hostFunctionStub(JSGlobalData* globalData, NativeFu
                 code = MacroAssemblerCodeRef();
         } else
             code = JIT::compileCTINativeCall(globalData, function);
-        entry.first->second.set(*globalData, NativeExecutable::create(*globalData, code, function, MacroAssemblerCodeRef::createSelfManagedCodeRef(ctiNativeConstruct()), callHostFunctionAsConstructor, intrinsic));
+        entry.first->second = PassWeak<NativeExecutable>(*globalData, NativeExecutable::create(*globalData, code, function, MacroAssemblerCodeRef::createSelfManagedCodeRef(ctiNativeConstruct()), callHostFunctionAsConstructor, intrinsic));
     }
     return entry.first->second.get();
 }
diff --git a/Source/JavaScriptCore/jit/JITStubs.h b/Source/JavaScriptCore/jit/JITStubs.h
index fe5f522e9..890d99747 100644
--- a/Source/JavaScriptCore/jit/JITStubs.h
+++ b/Source/JavaScriptCore/jit/JITStubs.h
@@ -37,8 +37,6 @@
 #include "ThunkGenerators.h"
 #include <wtf/HashMap.h>
 
-#if ENABLE(JIT)
-
 namespace JSC {
 
     struct StructureStubInfo;
@@ -263,6 +261,8 @@ namespace JSC {
 
 #define JITSTACKFRAME_ARGS_INDEX (OBJECT_OFFSETOF(JITStackFrame, args) / sizeof(void*))
 
+#if ENABLE(JIT)
+
 #define STUB_ARGS_DECLARATION void** args
 #define STUB_ARGS (args)
 
@@ -456,8 +456,8 @@ extern "C" {
     void* JIT_STUB cti_vm_throw(STUB_ARGS_DECLARATION);
 } // extern "C"
 
-} // namespace JSC
-
 #endif // ENABLE(JIT)
 
+} // namespace JSC
+
 #endif // JITStubs_h
diff --git a/Source/JavaScriptCore/jit/JSInterfaceJIT.h b/Source/JavaScriptCore/jit/JSInterfaceJIT.h
index d54dedc1a..05d1ce5ad 100644
--- a/Source/JavaScriptCore/jit/JSInterfaceJIT.h
+++ b/Source/JavaScriptCore/jit/JSInterfaceJIT.h
@@ -26,8 +26,10 @@
 #ifndef JSInterfaceJIT_h
 #define JSInterfaceJIT_h
 
+#include "BytecodeConventions.h"
 #include "JITCode.h"
 #include "JITStubs.h"
+#include "JSString.h"
 #include "JSValue.h"
 #include "MacroAssembler.h"
 #include "RegisterFile.h"
diff --git a/Source/JavaScriptCore/jsc.cpp b/Source/JavaScriptCore/jsc.cpp
index 47ec8c608..9f207c510 100644
--- a/Source/JavaScriptCore/jsc.cpp
+++ b/Source/JavaScriptCore/jsc.cpp
@@ -27,7 +27,9 @@
 #include "CurrentTime.h"
 #include "ExceptionHelpers.h"
 #include "InitializeThreading.h"
+#include "Interpreter.h"
 #include "JSArray.h"
+#include "JSCTypedArrayStubs.h"
 #include "JSFunction.h"
 #include "JSLock.h"
 #include "JSString.h"
@@ -78,6 +80,7 @@ static bool fillBufferWithContentsOfFile(const UString& fileName, Vector<char>&
 
 static EncodedJSValue JSC_HOST_CALL functionPrint(ExecState*);
 static EncodedJSValue JSC_HOST_CALL functionDebug(ExecState*);
+static EncodedJSValue JSC_HOST_CALL functionJSCStack(ExecState*);
 static EncodedJSValue JSC_HOST_CALL functionGC(ExecState*);
 #ifndef NDEBUG
 static EncodedJSValue JSC_HOST_CALL functionReleaseExecutableMemory(ExecState*);
@@ -184,12 +187,24 @@ protected:
         addFunction(globalData, "run", functionRun, 1);
         addFunction(globalData, "load", functionLoad, 1);
         addFunction(globalData, "checkSyntax", functionCheckSyntax, 1);
+        addFunction(globalData, "jscStack", functionJSCStack, 1);
         addFunction(globalData, "readline", functionReadline, 0);
         addFunction(globalData, "preciseTime", functionPreciseTime, 0);
 #if ENABLE(SAMPLING_FLAGS)
         addFunction(globalData, "setSamplingFlags", functionSetSamplingFlags, 1);
         addFunction(globalData, "clearSamplingFlags", functionClearSamplingFlags, 1);
 #endif
+        
+#if ENABLE(COMMANDLINE_TYPEDARRAYS)
+        addConstructableFunction(globalData, "Uint8Array", constructJSUint8Array, 1);
+        addConstructableFunction(globalData, "Uint16Array", constructJSUint16Array, 1);
+        addConstructableFunction(globalData, "Uint32Array", constructJSUint32Array, 1);
+        addConstructableFunction(globalData, "Int8Array", constructJSInt8Array, 1);
+        addConstructableFunction(globalData, "Int16Array", constructJSInt16Array, 1);
+        addConstructableFunction(globalData, "Int32Array", constructJSInt32Array, 1);
+        addConstructableFunction(globalData, "Float32Array", constructJSFloat32Array, 1);
+        addConstructableFunction(globalData, "Float64Array", constructJSFloat64Array, 1);
+#endif
 
         JSObject* array = constructEmptyArray(globalExec());
         for (size_t i = 0; i < arguments.size(); ++i)
@@ -202,6 +217,12 @@ protected:
         Identifier identifier(globalExec(), name);
         putDirect(globalData, identifier, JSFunction::create(globalExec(), this, arguments, identifier, function));
     }
+    
+    void addConstructableFunction(JSGlobalData& globalData, const char* name, NativeFunction function, unsigned arguments)
+    {
+        Identifier identifier(globalExec(), name);
+        putDirect(globalData, identifier, JSFunction::create(globalExec(), this, arguments, identifier, function, function));
+    }
 };
 COMPILE_ASSERT(!IsInteger<GlobalObject>::value, WTF_IsInteger_GlobalObject_false);
 ASSERT_CLASS_FITS_IN_CELL(GlobalObject);
@@ -252,6 +273,22 @@ EncodedJSValue JSC_HOST_CALL functionDebug(ExecState* exec)
     return JSValue::encode(jsUndefined());
 }
 
+EncodedJSValue JSC_HOST_CALL functionJSCStack(ExecState* exec)
+{
+    String trace = "--> Stack trace:\n";
+    Vector<StackFrame> stackTrace;
+    Interpreter::getStackTrace(&exec->globalData(), -1, stackTrace);
+    int i = 0;
+
+    for (Vector<StackFrame>::iterator iter = stackTrace.begin(); iter < stackTrace.end(); iter++) {
+        StackFrame level = *iter;
+        trace += String::format("    %i   %s\n", i, level.toString(exec).utf8().data());
+        i++;
+    }
+    fprintf(stderr, "%s", trace.utf8().data());
+    return JSValue::encode(jsUndefined());
+}
+
 EncodedJSValue JSC_HOST_CALL functionGC(ExecState* exec)
 {
     JSLock lock(SilenceAssertionsOnly);
diff --git a/Source/JavaScriptCore/llint/LLIntCommon.h b/Source/JavaScriptCore/llint/LLIntCommon.h
new file mode 100644
index 000000000..6b908eae2
--- /dev/null
+++ b/Source/JavaScriptCore/llint/LLIntCommon.h
@@ -0,0 +1,49 @@
+/*
+ * Copyright (C) 2012 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef LLIntCommon_h
+#define LLIntCommon_h
+
+// Print every instruction executed.
+#define LLINT_EXECUTION_TRACING 0
+
+// Print some information for some of the more subtle slow paths.
+#define LLINT_SLOW_PATH_TRACING 0
+
+// Disable inline allocation in the interpreter. This is great if you're changing
+// how the GC allocates.
+#define LLINT_ALWAYS_ALLOCATE_SLOW 0
+
+// Enable OSR into the JIT. Disabling this while the LLInt is enabled effectively
+// turns off all JIT'ing, since in LLInt's parlance, OSR subsumes any form of JIT
+// invocation.
+#if ENABLE(JIT)
+#define LLINT_OSR_TO_JIT 1
+#else
+#define LLINT_OSR_TO_JIT 0
+#endif
+
+#endif // LLIntCommon_h
+
diff --git a/Source/JavaScriptCore/llint/LLIntData.cpp b/Source/JavaScriptCore/llint/LLIntData.cpp
new file mode 100644
index 000000000..c0fe78142
--- /dev/null
+++ b/Source/JavaScriptCore/llint/LLIntData.cpp
@@ -0,0 +1,116 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "LLIntData.h"
+
+#if ENABLE(LLINT)
+
+#include "BytecodeConventions.h"
+#include "CodeType.h"
+#include "Instruction.h"
+#include "LowLevelInterpreter.h"
+#include "Opcode.h"
+
+namespace JSC { namespace LLInt {
+
+Data::Data()
+    : m_exceptionInstructions(new Instruction[maxOpcodeLength + 1])
+    , m_opcodeMap(new Opcode[numOpcodeIDs])
+{
+    for (int i = 0; i < maxOpcodeLength + 1; ++i)
+        m_exceptionInstructions[i].u.pointer = bitwise_cast<void*>(&llint_throw_from_slow_path_trampoline);
+#define OPCODE_ENTRY(opcode, length) m_opcodeMap[opcode] = bitwise_cast<void*>(&llint_##opcode);
+    FOR_EACH_OPCODE_ID(OPCODE_ENTRY);
+#undef OPCODE_ENTRY
+}
+
+#if COMPILER(CLANG)
+#pragma clang diagnostic push
+#pragma clang diagnostic ignored "-Wmissing-noreturn"
+#endif
+void Data::performAssertions(JSGlobalData& globalData)
+{
+    UNUSED_PARAM(globalData);
+    
+    // Assertions to match LowLevelInterpreter.asm.  If you change any of this code, be
+    // prepared to change LowLevelInterpreter.asm as well!!
+    ASSERT(RegisterFile::CallFrameHeaderSize * 8 == 48);
+    ASSERT(RegisterFile::ArgumentCount * 8 == -48);
+    ASSERT(RegisterFile::CallerFrame * 8 == -40);
+    ASSERT(RegisterFile::Callee * 8 == -32);
+    ASSERT(RegisterFile::ScopeChain * 8 == -24);
+    ASSERT(RegisterFile::ReturnPC * 8 == -16);
+    ASSERT(RegisterFile::CodeBlock * 8 == -8);
+    ASSERT(CallFrame::argumentOffsetIncludingThis(0) == -RegisterFile::CallFrameHeaderSize - 1);
+#if CPU(BIG_ENDIAN)
+    ASSERT(OBJECT_OFFSETOF(EncodedValueDescriptor, asBits.tag) == 0);
+    ASSERT(OBJECT_OFFSETOF(EncodedValueDescriptor, asBits.payload) == 4);
+#else
+    ASSERT(OBJECT_OFFSETOF(EncodedValueDescriptor, asBits.tag) == 4);
+    ASSERT(OBJECT_OFFSETOF(EncodedValueDescriptor, asBits.payload) == 0);
+#endif
+    ASSERT(JSValue::Int32Tag == -1);
+    ASSERT(JSValue::BooleanTag == -2);
+    ASSERT(JSValue::NullTag == -3);
+    ASSERT(JSValue::UndefinedTag == -4);
+    ASSERT(JSValue::CellTag == -5);
+    ASSERT(JSValue::EmptyValueTag == -6);
+    ASSERT(JSValue::DeletedValueTag == -7);
+    ASSERT(JSValue::LowestTag == -7);
+    ASSERT(StringType == 5);
+    ASSERT(ObjectType == 13);
+    ASSERT(MasqueradesAsUndefined == 1);
+    ASSERT(ImplementsHasInstance == 2);
+    ASSERT(ImplementsDefaultHasInstance == 8);
+    ASSERT(&globalData.heap.allocatorForObjectWithoutDestructor(sizeof(JSFinalObject)) - &globalData.heap.firstAllocatorWithoutDestructors() == 3);
+    ASSERT(FirstConstantRegisterIndex == 0x40000000);
+    ASSERT(GlobalCode == 0);
+    ASSERT(EvalCode == 1);
+    ASSERT(FunctionCode == 2);
+    
+    // FIXME: make these assertions less horrible.
+#if !ASSERT_DISABLED
+    Vector<int> testVector;
+    testVector.resize(42);
+    ASSERT(bitwise_cast<size_t*>(&testVector)[0] == 42);
+    ASSERT(bitwise_cast<int**>(&testVector)[1] == testVector.begin());
+#endif
+
+    ASSERT(StringImpl::s_hashFlag8BitBuffer == 64);
+}
+#if COMPILER(CLANG)
+#pragma clang diagnostic pop
+#endif
+
+Data::~Data()
+{
+    delete[] m_exceptionInstructions;
+    delete[] m_opcodeMap;
+}
+
+} } // namespace JSC::LLInt
+
+#endif // ENABLE(LLINT)
diff --git a/Source/JavaScriptCore/llint/LLIntData.h b/Source/JavaScriptCore/llint/LLIntData.h
new file mode 100644
index 000000000..ba8daedf1
--- /dev/null
+++ b/Source/JavaScriptCore/llint/LLIntData.h
@@ -0,0 +1,93 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef LLIntData_h
+#define LLIntData_h
+
+#include "Opcode.h"
+#include <wtf/Platform.h>
+
+namespace JSC {
+
+class JSGlobalData;
+struct Instruction;
+
+namespace LLInt {
+
+#if ENABLE(LLINT)
+class Data {
+public:
+    Data();
+    ~Data();
+    
+    void performAssertions(JSGlobalData&);
+    
+    Instruction* exceptionInstructions()
+    {
+        return m_exceptionInstructions;
+    }
+    
+    Opcode* opcodeMap()
+    {
+        return m_opcodeMap;
+    }
+private:
+    Instruction* m_exceptionInstructions;
+    Opcode* m_opcodeMap;
+};
+#else // ENABLE(LLINT)
+
+#if COMPILER(CLANG)
+#pragma clang diagnostic push
+#pragma clang diagnostic ignored "-Wmissing-noreturn"
+#endif
+
+class Data {
+public:
+    void performAssertions(JSGlobalData&) { }
+
+    Instruction* exceptionInstructions()
+    {
+        ASSERT_NOT_REACHED();
+        return 0;
+    }
+    
+    Opcode* opcodeMap()
+    {
+        ASSERT_NOT_REACHED();
+        return 0;
+    }
+};
+
+#if COMPILER(CLANG)
+#pragma clang diagnostic pop
+#endif
+
+#endif // ENABLE(LLINT)
+
+} } // namespace JSC::LLInt
+
+#endif // LLIntData_h
+
diff --git a/Source/JavaScriptCore/llint/LLIntEntrypoints.cpp b/Source/JavaScriptCore/llint/LLIntEntrypoints.cpp
new file mode 100644
index 000000000..f610f4b4c
--- /dev/null
+++ b/Source/JavaScriptCore/llint/LLIntEntrypoints.cpp
@@ -0,0 +1,86 @@
+/*
+ * Copyright (C) 2012 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "LLIntEntrypoints.h"
+
+#if ENABLE(LLINT)
+
+#include "JITCode.h"
+#include "JSGlobalData.h"
+#include "LLIntThunks.h"
+#include "LowLevelInterpreter.h"
+
+namespace JSC { namespace LLInt {
+
+void getFunctionEntrypoint(JSGlobalData& globalData, CodeSpecializationKind kind, JITCode& jitCode, MacroAssemblerCodePtr& arityCheck)
+{
+    if (!globalData.canUseJIT()) {
+        if (kind == CodeForCall) {
+            jitCode = JITCode::HostFunction(MacroAssemblerCodeRef::createSelfManagedCodeRef(MacroAssemblerCodePtr(bitwise_cast<void*>(&llint_function_for_call_prologue))));
+            arityCheck = MacroAssemblerCodePtr(bitwise_cast<void*>(&llint_function_for_call_arity_check));
+            return;
+        }
+
+        ASSERT(kind == CodeForConstruct);
+        jitCode = JITCode::HostFunction(MacroAssemblerCodeRef::createSelfManagedCodeRef(MacroAssemblerCodePtr(bitwise_cast<void*>(&llint_function_for_construct_prologue))));
+        arityCheck = MacroAssemblerCodePtr(bitwise_cast<void*>(&llint_function_for_construct_arity_check));
+        return;
+    }
+    
+    if (kind == CodeForCall) {
+        jitCode = JITCode(globalData.getCTIStub(functionForCallEntryThunkGenerator), JITCode::InterpreterThunk);
+        arityCheck = globalData.getCTIStub(functionForCallArityCheckThunkGenerator).code();
+        return;
+    }
+
+    ASSERT(kind == CodeForConstruct);
+    jitCode = JITCode(globalData.getCTIStub(functionForConstructEntryThunkGenerator), JITCode::InterpreterThunk);
+    arityCheck = globalData.getCTIStub(functionForConstructArityCheckThunkGenerator).code();
+}
+
+void getEvalEntrypoint(JSGlobalData& globalData, JITCode& jitCode)
+{
+    if (!globalData.canUseJIT()) {
+        jitCode = JITCode::HostFunction(MacroAssemblerCodeRef::createSelfManagedCodeRef(MacroAssemblerCodePtr(bitwise_cast<void*>(&llint_eval_prologue))));
+        return;
+    }
+    
+    jitCode = JITCode(globalData.getCTIStub(evalEntryThunkGenerator), JITCode::InterpreterThunk);
+}
+
+void getProgramEntrypoint(JSGlobalData& globalData, JITCode& jitCode)
+{
+    if (!globalData.canUseJIT()) {
+        jitCode = JITCode::HostFunction(MacroAssemblerCodeRef::createSelfManagedCodeRef(MacroAssemblerCodePtr(bitwise_cast<void*>(&llint_program_prologue))));
+        return;
+    }
+    
+    jitCode = JITCode(globalData.getCTIStub(programEntryThunkGenerator), JITCode::InterpreterThunk);
+}
+
+} } // namespace JSC::LLInt
+
+#endif // ENABLE(LLINT)
diff --git a/Source/JavaScriptCore/llint/LLIntEntrypoints.h b/Source/JavaScriptCore/llint/LLIntEntrypoints.h
new file mode 100644
index 000000000..dd7c27798
--- /dev/null
+++ b/Source/JavaScriptCore/llint/LLIntEntrypoints.h
@@ -0,0 +1,64 @@
+/*
+ * Copyright (C) 2012 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef LLIntEntrypoints_h
+#define LLIntEntrypoints_h
+
+#include <wtf/Platform.h>
+
+#if ENABLE(LLINT)
+
+#include "CodeSpecializationKind.h"
+
+namespace JSC {
+
+class EvalCodeBlock;
+class JITCode;
+class JSGlobalData;
+class MacroAssemblerCodePtr;
+class MacroAssemblerCodeRef;
+class ProgramCodeBlock;
+
+namespace LLInt {
+
+void getFunctionEntrypoint(JSGlobalData&, CodeSpecializationKind, JITCode&, MacroAssemblerCodePtr& arityCheck);
+void getEvalEntrypoint(JSGlobalData&, JITCode&);
+void getProgramEntrypoint(JSGlobalData&, JITCode&);
+
+inline void getEntrypoint(JSGlobalData& globalData, EvalCodeBlock*, JITCode& jitCode)
+{
+    getEvalEntrypoint(globalData, jitCode);
+}
+
+inline void getEntrypoint(JSGlobalData& globalData, ProgramCodeBlock*, JITCode& jitCode)
+{
+    getProgramEntrypoint(globalData, jitCode);
+}
+
+} } // namespace JSC::LLInt
+
+#endif // ENABLE(LLINT)
+
+#endif // LLIntEntrypoints_h
diff --git a/Source/JavaScriptCore/llint/LLIntExceptions.cpp b/Source/JavaScriptCore/llint/LLIntExceptions.cpp
new file mode 100644
index 000000000..a7d1a965a
--- /dev/null
+++ b/Source/JavaScriptCore/llint/LLIntExceptions.cpp
@@ -0,0 +1,80 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "LLIntExceptions.h"
+
+#if ENABLE(LLINT)
+
+#include "CallFrame.h"
+#include "CodeBlock.h"
+#include "Instruction.h"
+#include "JITExceptions.h"
+#include "LLIntCommon.h"
+#include "LowLevelInterpreter.h"
+
+namespace JSC { namespace LLInt {
+
+void interpreterThrowInCaller(ExecState* exec, ReturnAddressPtr pc)
+{
+    JSGlobalData* globalData = &exec->globalData();
+#if LLINT_SLOW_PATH_TRACING
+    dataLog("Throwing exception %s.\n", globalData->exception.description());
+#endif
+    genericThrow(
+        globalData, exec, globalData->exception,
+        exec->codeBlock()->bytecodeOffset(exec, pc));
+}
+
+Instruction* returnToThrowForThrownException(ExecState* exec)
+{
+    return exec->globalData().llintData.exceptionInstructions();
+}
+
+Instruction* returnToThrow(ExecState* exec, Instruction* pc)
+{
+    JSGlobalData* globalData = &exec->globalData();
+#if LLINT_SLOW_PATH_TRACING
+    dataLog("Throwing exception %s (returnToThrow).\n", globalData->exception.description());
+#endif
+    genericThrow(globalData, exec, globalData->exception, pc - exec->codeBlock()->instructions().begin());
+    
+    return globalData->llintData.exceptionInstructions();
+}
+
+void* callToThrow(ExecState* exec, Instruction* pc)
+{
+    JSGlobalData* globalData = &exec->globalData();
+#if LLINT_SLOW_PATH_TRACING
+    dataLog("Throwing exception %s (callToThrow).\n", globalData->exception.description());
+#endif
+    genericThrow(globalData, exec, globalData->exception, pc - exec->codeBlock()->instructions().begin());
+    
+    return bitwise_cast<void*>(&llint_throw_during_call_trampoline);
+}
+
+} } // namespace JSC::LLInt
+
+#endif // ENABLE(LLINT)
diff --git a/Source/JavaScriptCore/llint/LLIntExceptions.h b/Source/JavaScriptCore/llint/LLIntExceptions.h
new file mode 100644
index 000000000..3baa3f4a5
--- /dev/null
+++ b/Source/JavaScriptCore/llint/LLIntExceptions.h
@@ -0,0 +1,66 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef LLIntExceptions_h
+#define LLIntExceptions_h
+
+#include <wtf/Platform.h>
+#include <wtf/StdLibExtras.h>
+
+#if ENABLE(LLINT)
+
+#include "MacroAssemblerCodeRef.h"
+
+namespace JSC {
+
+class ExecState;
+struct Instruction;
+
+namespace LLInt {
+
+// Throw the currently active exception in the context of the caller's call frame.
+void interpreterThrowInCaller(ExecState* callerFrame, ReturnAddressPtr);
+
+// Tells you where to jump to if you want to return-to-throw, after you've already
+// set up all information needed to throw the exception.
+Instruction* returnToThrowForThrownException(ExecState*);
+
+// Saves the current PC in the global data for safe-keeping, and gives you a PC
+// that you can tell the interpreter to go to, which when advanced between 1
+// and 9 slots will give you an "instruction" that threads to the interpreter's
+// exception handler. Note that if you give it the PC for exception handling,
+// it's smart enough to just return that PC without doing anything else; this
+// lets you thread exception handling through common helper functions used by
+// other helpers.
+Instruction* returnToThrow(ExecState*, Instruction*);
+
+// Use this when you're throwing to a call thunk.
+void* callToThrow(ExecState*, Instruction*);
+
+} } // namespace JSC::LLInt
+
+#endif // ENABLE(LLINT)
+
+#endif // LLIntExceptions_h
diff --git a/Source/JavaScriptCore/llint/LLIntOfflineAsmConfig.h b/Source/JavaScriptCore/llint/LLIntOfflineAsmConfig.h
new file mode 100644
index 000000000..9fe86fac4
--- /dev/null
+++ b/Source/JavaScriptCore/llint/LLIntOfflineAsmConfig.h
@@ -0,0 +1,90 @@
+/*
+ * Copyright (C) 2012 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef LLIntOfflineAsmConfig_h
+#define LLIntOfflineAsmConfig_h
+
+#include "LLIntCommon.h"
+#include <wtf/Assertions.h>
+#include <wtf/InlineASM.h>
+#include <wtf/Platform.h>
+
+#if CPU(X86)
+#define OFFLINE_ASM_X86 1
+#else
+#define OFFLINE_ASM_X86 0
+#endif
+
+#if CPU(ARM_THUMB2)
+#define OFFLINE_ASM_ARMv7 1
+#else
+#define OFFLINE_ASM_ARMv7 0
+#endif
+
+#if !ASSERT_DISABLED
+#define OFFLINE_ASM_ASSERT_ENABLED 1
+#else
+#define OFFLINE_ASM_ASSERT_ENABLED 0
+#endif
+
+#if CPU(BIG_ENDIAN)
+#define OFFLINE_ASM_BIG_ENDIAN 1
+#else
+#define OFFLINE_ASM_BIG_ENDIAN 0
+#endif
+
+#if LLINT_OSR_TO_JIT
+#define OFFLINE_ASM_JIT_ENABLED 1
+#else
+#define OFFLINE_ASM_JIT_ENABLED 0
+#endif
+
+#if LLINT_EXECUTION_TRACING
+#define OFFLINE_ASM_EXECUTION_TRACING 1
+#else
+#define OFFLINE_ASM_EXECUTION_TRACING 0
+#endif
+
+#if LLINT_ALWAYS_ALLOCATE_SLOW
+#define OFFLINE_ASM_ALWAYS_ALLOCATE_SLOW 1
+#else
+#define OFFLINE_ASM_ALWAYS_ALLOCATE_SLOW 0
+#endif
+
+#if CPU(ARM_THUMB2)
+#define OFFLINE_ASM_GLOBAL_LABEL(label)          \
+    ".globl " SYMBOL_STRING(label) "\n"          \
+    HIDE_SYMBOL(name) "\n"                       \
+    ".thumb\n"                                   \
+    ".thumb_func " THUMB_FUNC_PARAM(label) "\n"  \
+    SYMBOL_STRING(label) ":\n"
+#else
+#define OFFLINE_ASM_GLOBAL_LABEL(label)         \
+    ".globl " SYMBOL_STRING(label) "\n"         \
+    HIDE_SYMBOL(name) "\n"                      \
+    SYMBOL_STRING(label) ":\n"
+#endif
+
+#endif // LLIntOfflineAsmConfig_h
diff --git a/Source/JavaScriptCore/llint/LLIntOffsetsExtractor.cpp b/Source/JavaScriptCore/llint/LLIntOffsetsExtractor.cpp
new file mode 100644
index 000000000..5b76cd521
--- /dev/null
+++ b/Source/JavaScriptCore/llint/LLIntOffsetsExtractor.cpp
@@ -0,0 +1,84 @@
+/*
+ * Copyright (C) 2012 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#include "CodeBlock.h"
+#include "Executable.h"
+#include "Heap.h"
+#include "Interpreter.h"
+#include "JITStubs.h"
+#include "JSArray.h"
+#include "JSCell.h"
+#include "JSFunction.h"
+#include "JSGlobalData.h"
+#include "JSGlobalObject.h"
+#include "JSObject.h"
+#include "JSPropertyNameIterator.h"
+#include "JSString.h"
+#include "JSTypeInfo.h"
+#include "JSVariableObject.h"
+#include "JumpTable.h"
+#include "LLIntOfflineAsmConfig.h"
+#include "MarkedSpace.h"
+#include "RegisterFile.h"
+#include "ScopeChain.h"
+#include "Structure.h"
+#include "StructureChain.h"
+#include "ValueProfile.h"
+#include <wtf/text/StringImpl.h>
+
+namespace JSC {
+
+#define OFFLINE_ASM_OFFSETOF(clazz, field) OBJECT_OFFSETOF(clazz, field)
+
+class LLIntOffsetsExtractor {
+public:
+    static const unsigned* dummy();
+};
+
+const unsigned* LLIntOffsetsExtractor::dummy()
+{
+// This is a file generated by offlineasm/generate_offsets_extractor.rb, and contains code
+// to create a table of offsets, sizes, and a header identifying what combination of
+// Platform.h macros we have set. We include it inside of a method on LLIntOffsetsExtractor
+// because the fields whose offsets we're extracting are mostly private. So we make their
+// classes friends with LLIntOffsetsExtractor, and include the header here, to get the C++
+// compiler to kindly step aside and yield to our best intentions.
+#include "LLIntDesiredOffsets.h"
+    return extractorTable;
+}
+
+} // namespace JSC
+
+int main(int, char**)
+{
+    // Out of an abundance of caution, make sure that LLIntOffsetsExtractor::dummy() is live,
+    // and the extractorTable is live, too.
+    printf("%p\n", JSC::LLIntOffsetsExtractor::dummy());
+    return 0;
+}
+
+
diff --git a/Source/JavaScriptCore/llint/LLIntSlowPaths.cpp b/Source/JavaScriptCore/llint/LLIntSlowPaths.cpp
new file mode 100644
index 000000000..3203d25d2
--- /dev/null
+++ b/Source/JavaScriptCore/llint/LLIntSlowPaths.cpp
@@ -0,0 +1,1558 @@
+/*
+ * Copyright (C) 2011, 2012 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "LLIntSlowPaths.h"
+
+#if ENABLE(LLINT)
+
+#include "Arguments.h"
+#include "CallFrame.h"
+#include "CommonSlowPaths.h"
+#include "GetterSetter.h"
+#include "HostCallReturnValue.h"
+#include "Interpreter.h"
+#include "JIT.h"
+#include "JITDriver.h"
+#include "JSActivation.h"
+#include "JSByteArray.h"
+#include "JSGlobalObjectFunctions.h"
+#include "JSPropertyNameIterator.h"
+#include "JSStaticScopeObject.h"
+#include "JSString.h"
+#include "JSValue.h"
+#include "LLIntCommon.h"
+#include "LLIntExceptions.h"
+#include "LowLevelInterpreter.h"
+#include "Operations.h"
+
+namespace JSC { namespace LLInt {
+
+#define LLINT_BEGIN_NO_SET_PC() \
+    JSGlobalData& globalData = exec->globalData();      \
+    NativeCallFrameTracer tracer(&globalData, exec)
+
+#define LLINT_SET_PC_FOR_STUBS() \
+    exec->setCurrentVPC(pc + 1)
+
+#define LLINT_BEGIN()                           \
+    LLINT_BEGIN_NO_SET_PC();                    \
+    LLINT_SET_PC_FOR_STUBS()
+
+#define LLINT_OP(index) (exec->uncheckedR(pc[index].u.operand))
+#define LLINT_OP_C(index) (exec->r(pc[index].u.operand))
+
+#define LLINT_RETURN_TWO(first, second) do {       \
+        union {                                    \
+            struct {                               \
+                void* a;                           \
+                void* b;                           \
+            } pair;                                \
+            int64_t i;                             \
+        } __rt_u;                                  \
+        __rt_u.pair.a = first;                     \
+        __rt_u.pair.b = second;                    \
+        return __rt_u.i;                           \
+    } while (false)
+
+#define LLINT_END_IMPL() LLINT_RETURN_TWO(pc, exec)
+
+#define LLINT_THROW(exceptionToThrow) do {                        \
+        globalData.exception = (exceptionToThrow);                \
+        pc = returnToThrow(exec, pc);                             \
+        LLINT_END_IMPL();                                         \
+    } while (false)
+
+#define LLINT_CHECK_EXCEPTION() do {                    \
+        if (UNLIKELY(globalData.exception)) {           \
+            pc = returnToThrow(exec, pc);               \
+            LLINT_END_IMPL();                           \
+        }                                               \
+    } while (false)
+
+#define LLINT_END() do {                        \
+        LLINT_CHECK_EXCEPTION();                \
+        LLINT_END_IMPL();                       \
+    } while (false)
+
+#define LLINT_BRANCH(opcode, condition) do {                      \
+        bool __b_condition = (condition);                         \
+        LLINT_CHECK_EXCEPTION();                                  \
+        if (__b_condition)                                        \
+            pc += pc[OPCODE_LENGTH(opcode) - 1].u.operand;        \
+        else                                                      \
+            pc += OPCODE_LENGTH(opcode);                          \
+        LLINT_END_IMPL();                                         \
+    } while (false)
+
+#define LLINT_RETURN(value) do {                \
+        JSValue __r_returnValue = (value);      \
+        LLINT_CHECK_EXCEPTION();                \
+        LLINT_OP(1) = __r_returnValue;          \
+        LLINT_END_IMPL();                       \
+    } while (false)
+
+#define LLINT_RETURN_PROFILED(opcode, value) do {               \
+        JSValue __rp_returnValue = (value);                     \
+        LLINT_CHECK_EXCEPTION();                                \
+        LLINT_OP(1) = __rp_returnValue;                         \
+        pc[OPCODE_LENGTH(opcode) - 1].u.profile->m_buckets[0] = \
+            JSValue::encode(__rp_returnValue);                  \
+        LLINT_END_IMPL();                                       \
+    } while (false)
+
+#define LLINT_CALL_END_IMPL(exec, callTarget) LLINT_RETURN_TWO((callTarget), (exec))
+
+#define LLINT_CALL_THROW(exec, pc, exceptionToThrow) do {               \
+        ExecState* __ct_exec = (exec);                                  \
+        Instruction* __ct_pc = (pc);                                    \
+        globalData.exception = (exceptionToThrow);                      \
+        LLINT_CALL_END_IMPL(__ct_exec, callToThrow(__ct_exec, __ct_pc)); \
+    } while (false)
+
+#define LLINT_CALL_CHECK_EXCEPTION(exec, pc) do {                       \
+        ExecState* __cce_exec = (exec);                                 \
+        Instruction* __cce_pc = (pc);                                   \
+        if (UNLIKELY(globalData.exception))                              \
+            LLINT_CALL_END_IMPL(__cce_exec, callToThrow(__cce_exec, __cce_pc)); \
+    } while (false)
+
+#define LLINT_CALL_RETURN(exec, pc, callTarget) do {                    \
+        ExecState* __cr_exec = (exec);                                  \
+        Instruction* __cr_pc = (pc);                                    \
+        void* __cr_callTarget = (callTarget);                           \
+        LLINT_CALL_CHECK_EXCEPTION(__cr_exec->callerFrame(), __cr_pc);  \
+        LLINT_CALL_END_IMPL(__cr_exec, __cr_callTarget);                \
+    } while (false)
+
+extern "C" SlowPathReturnType llint_trace_operand(ExecState* exec, Instruction* pc, int fromWhere, int operand)
+{
+    LLINT_BEGIN();
+    dataLog("%p / %p: executing bc#%zu, op#%u: Trace(%d): %d: %d\n",
+            exec->codeBlock(),
+            exec,
+            static_cast<intptr_t>(pc - exec->codeBlock()->instructions().begin()),
+            exec->globalData().interpreter->getOpcodeID(pc[0].u.opcode),
+            fromWhere,
+            operand,
+            pc[operand].u.operand);
+    LLINT_END();
+}
+
+extern "C" SlowPathReturnType llint_trace_value(ExecState* exec, Instruction* pc, int fromWhere, int operand)
+{
+    LLINT_BEGIN();
+    JSValue value = LLINT_OP_C(operand).jsValue();
+    union {
+        struct {
+            uint32_t tag;
+            uint32_t payload;
+        } bits;
+        EncodedJSValue asValue;
+    } u;
+    u.asValue = JSValue::encode(value);
+    dataLog("%p / %p: executing bc#%zu, op#%u: Trace(%d): %d: %d: %08x:%08x: %s\n",
+            exec->codeBlock(),
+            exec,
+            static_cast<intptr_t>(pc - exec->codeBlock()->instructions().begin()),
+            exec->globalData().interpreter->getOpcodeID(pc[0].u.opcode),
+            fromWhere,
+            operand,
+            pc[operand].u.operand,
+            u.bits.tag,
+            u.bits.payload,
+            value.description());
+    LLINT_END();
+}
+
+LLINT_SLOW_PATH_DECL(trace_prologue)
+{
+    LLINT_BEGIN();
+    dataLog("%p / %p: in prologue.\n", exec->codeBlock(), exec);
+    LLINT_END();
+}
+
+static void traceFunctionPrologue(ExecState* exec, const char* comment, CodeSpecializationKind kind)
+{
+    JSFunction* callee = asFunction(exec->callee());
+    FunctionExecutable* executable = callee->jsExecutable();
+    CodeBlock* codeBlock = &executable->generatedBytecodeFor(kind);
+    dataLog("%p / %p: in %s of function %p, executable %p; numVars = %u, numParameters = %u, numCalleeRegisters = %u, caller = %p.\n",
+            codeBlock, exec, comment, callee, executable,
+            codeBlock->m_numVars, codeBlock->numParameters(), codeBlock->m_numCalleeRegisters,
+            exec->callerFrame());
+}
+
+LLINT_SLOW_PATH_DECL(trace_prologue_function_for_call)
+{
+    LLINT_BEGIN();
+    traceFunctionPrologue(exec, "call prologue", CodeForCall);
+    LLINT_END();
+}
+
+LLINT_SLOW_PATH_DECL(trace_prologue_function_for_construct)
+{
+    LLINT_BEGIN();
+    traceFunctionPrologue(exec, "construct prologue", CodeForConstruct);
+    LLINT_END();
+}
+
+LLINT_SLOW_PATH_DECL(trace_arityCheck_for_call)
+{
+    LLINT_BEGIN();
+    traceFunctionPrologue(exec, "call arity check", CodeForCall);
+    LLINT_END();
+}
+
+LLINT_SLOW_PATH_DECL(trace_arityCheck_for_construct)
+{
+    LLINT_BEGIN();
+    traceFunctionPrologue(exec, "construct arity check", CodeForConstruct);
+    LLINT_END();
+}
+
+LLINT_SLOW_PATH_DECL(trace)
+{
+    LLINT_BEGIN();
+    dataLog("%p / %p: executing bc#%zu, %s, scope %p\n",
+            exec->codeBlock(),
+            exec,
+            static_cast<intptr_t>(pc - exec->codeBlock()->instructions().begin()),
+            opcodeNames[exec->globalData().interpreter->getOpcodeID(pc[0].u.opcode)],
+            exec->scopeChain());
+    LLINT_END();
+}
+
+LLINT_SLOW_PATH_DECL(special_trace)
+{
+    LLINT_BEGIN();
+    dataLog("%p / %p: executing special case bc#%zu, op#%u, return PC is %p\n",
+            exec->codeBlock(),
+            exec,
+            static_cast<intptr_t>(pc - exec->codeBlock()->instructions().begin()),
+            exec->globalData().interpreter->getOpcodeID(pc[0].u.opcode),
+            exec->returnPC().value());
+    LLINT_END();
+}
+
+inline bool shouldJIT(ExecState* exec)
+{
+    // You can modify this to turn off JITting without rebuilding the world.
+    return exec->globalData().canUseJIT();
+}
+
+enum EntryKind { Prologue, ArityCheck };
+static SlowPathReturnType entryOSR(ExecState* exec, Instruction* pc, CodeBlock* codeBlock, const char *name, EntryKind kind)
+{
+#if ENABLE(JIT_VERBOSE_OSR)
+    dataLog("%p: Entered %s with executeCounter = %d\n", codeBlock, name, codeBlock->llintExecuteCounter());
+#endif
+    
+    if (!shouldJIT(exec)) {
+        codeBlock->dontJITAnytimeSoon();
+        LLINT_RETURN_TWO(0, exec);
+    }
+    if (!codeBlock->jitCompile(exec->globalData())) {
+#if ENABLE(JIT_VERBOSE_OSR)
+        dataLog("    Code was already compiled.\n");
+#endif
+    }
+    codeBlock->jitSoon();
+    if (kind == Prologue)
+        LLINT_RETURN_TWO(codeBlock->getJITCode().executableAddressAtOffset(0), exec);
+    ASSERT(kind == ArityCheck);
+    LLINT_RETURN_TWO(codeBlock->getJITCodeWithArityCheck().executableAddress(), exec);
+}
+
+LLINT_SLOW_PATH_DECL(entry_osr)
+{
+    return entryOSR(exec, pc, exec->codeBlock(), "entry_osr", Prologue);
+}
+
+LLINT_SLOW_PATH_DECL(entry_osr_function_for_call)
+{
+    return entryOSR(exec, pc, &asFunction(exec->callee())->jsExecutable()->generatedBytecodeFor(CodeForCall), "entry_osr_function_for_call", Prologue);
+}
+
+LLINT_SLOW_PATH_DECL(entry_osr_function_for_construct)
+{
+    return entryOSR(exec, pc, &asFunction(exec->callee())->jsExecutable()->generatedBytecodeFor(CodeForConstruct), "entry_osr_function_for_construct", Prologue);
+}
+
+LLINT_SLOW_PATH_DECL(entry_osr_function_for_call_arityCheck)
+{
+    return entryOSR(exec, pc, &asFunction(exec->callee())->jsExecutable()->generatedBytecodeFor(CodeForCall), "entry_osr_function_for_call_arityCheck", ArityCheck);
+}
+
+LLINT_SLOW_PATH_DECL(entry_osr_function_for_construct_arityCheck)
+{
+    return entryOSR(exec, pc, &asFunction(exec->callee())->jsExecutable()->generatedBytecodeFor(CodeForConstruct), "entry_osr_function_for_construct_arityCheck", ArityCheck);
+}
+
+LLINT_SLOW_PATH_DECL(loop_osr)
+{
+    CodeBlock* codeBlock = exec->codeBlock();
+    
+#if ENABLE(JIT_VERBOSE_OSR)
+    dataLog("%p: Entered loop_osr with executeCounter = %d\n", codeBlock, codeBlock->llintExecuteCounter());
+#endif
+    
+    if (!shouldJIT(exec)) {
+        codeBlock->dontJITAnytimeSoon();
+        LLINT_RETURN_TWO(0, exec);
+    }
+    
+    if (!codeBlock->jitCompile(exec->globalData())) {
+#if ENABLE(JIT_VERBOSE_OSR)
+        dataLog("    Code was already compiled.\n");
+#endif
+    }
+    codeBlock->jitSoon();
+    
+    ASSERT(codeBlock->getJITType() == JITCode::BaselineJIT);
+    
+    Vector<BytecodeAndMachineOffset> map;
+    codeBlock->jitCodeMap()->decode(map);
+    BytecodeAndMachineOffset* mapping = binarySearch<BytecodeAndMachineOffset, unsigned, BytecodeAndMachineOffset::getBytecodeIndex>(map.begin(), map.size(), pc - codeBlock->instructions().begin());
+    ASSERT(mapping);
+    ASSERT(mapping->m_bytecodeIndex == static_cast<unsigned>(pc - codeBlock->instructions().begin()));
+    
+    void* jumpTarget = codeBlock->getJITCode().executableAddressAtOffset(mapping->m_machineCodeOffset);
+    ASSERT(jumpTarget);
+    
+    LLINT_RETURN_TWO(jumpTarget, exec);
+}
+
+LLINT_SLOW_PATH_DECL(replace)
+{
+    CodeBlock* codeBlock = exec->codeBlock();
+    
+#if ENABLE(JIT_VERBOSE_OSR)
+    dataLog("%p: Entered replace with executeCounter = %d\n", codeBlock, codeBlock->llintExecuteCounter());
+#endif
+    
+    if (shouldJIT(exec)) {
+        if (!codeBlock->jitCompile(exec->globalData())) {
+#if ENABLE(JIT_VERBOSE_OSR)
+            dataLog("    Code was already compiled.\n");
+#endif
+        }
+        codeBlock->jitSoon();
+    } else
+        codeBlock->dontJITAnytimeSoon();
+    LLINT_END_IMPL();
+}
+
+LLINT_SLOW_PATH_DECL(register_file_check)
+{
+    LLINT_BEGIN();
+#if LLINT_SLOW_PATH_TRACING
+    dataLog("Checking stack height with exec = %p.\n", exec);
+    dataLog("CodeBlock = %p.\n", exec->codeBlock());
+    dataLog("Num callee registers = %u.\n", exec->codeBlock()->m_numCalleeRegisters);
+    dataLog("Num vars = %u.\n", exec->codeBlock()->m_numVars);
+    dataLog("Current end is at %p.\n", exec->globalData().interpreter->registerFile().end());
+#endif
+    ASSERT(&exec->registers()[exec->codeBlock()->m_numCalleeRegisters] > exec->globalData().interpreter->registerFile().end());
+    if (UNLIKELY(!globalData.interpreter->registerFile().grow(&exec->registers()[exec->codeBlock()->m_numCalleeRegisters]))) {
+        ReturnAddressPtr returnPC = exec->returnPC();
+        exec = exec->callerFrame();
+        globalData.exception = createStackOverflowError(exec);
+        interpreterThrowInCaller(exec, returnPC);
+        pc = returnToThrowForThrownException(exec);
+    }
+    LLINT_END_IMPL();
+}
+
+LLINT_SLOW_PATH_DECL(slow_path_call_arityCheck)
+{
+    LLINT_BEGIN();
+    ExecState* newExec = CommonSlowPaths::arityCheckFor(exec, &globalData.interpreter->registerFile(), CodeForCall);
+    if (!newExec) {
+        ReturnAddressPtr returnPC = exec->returnPC();
+        exec = exec->callerFrame();
+        globalData.exception = createStackOverflowError(exec);
+        interpreterThrowInCaller(exec, returnPC);
+        LLINT_RETURN_TWO(bitwise_cast<void*>(static_cast<uintptr_t>(1)), exec);
+    }
+    LLINT_RETURN_TWO(0, newExec);
+}
+
+LLINT_SLOW_PATH_DECL(slow_path_construct_arityCheck)
+{
+    LLINT_BEGIN();
+    ExecState* newExec = CommonSlowPaths::arityCheckFor(exec, &globalData.interpreter->registerFile(), CodeForConstruct);
+    if (!newExec) {
+        ReturnAddressPtr returnPC = exec->returnPC();
+        exec = exec->callerFrame();
+        globalData.exception = createStackOverflowError(exec);
+        interpreterThrowInCaller(exec, returnPC);
+        LLINT_RETURN_TWO(bitwise_cast<void*>(static_cast<uintptr_t>(1)), exec);
+    }
+    LLINT_RETURN_TWO(0, newExec);
+}
+
+LLINT_SLOW_PATH_DECL(slow_path_create_activation)
+{
+    LLINT_BEGIN();
+#if LLINT_SLOW_PATH_TRACING
+    dataLog("Creating an activation, exec = %p!\n", exec);
+#endif
+    JSActivation* activation = JSActivation::create(globalData, exec, static_cast<FunctionExecutable*>(exec->codeBlock()->ownerExecutable()));
+    exec->setScopeChain(exec->scopeChain()->push(activation));
+    LLINT_RETURN(JSValue(activation));
+}
+
+LLINT_SLOW_PATH_DECL(slow_path_create_arguments)
+{
+    LLINT_BEGIN();
+    JSValue arguments = JSValue(Arguments::create(globalData, exec));
+    LLINT_CHECK_EXCEPTION();
+    exec->uncheckedR(pc[1].u.operand) = arguments;
+    exec->uncheckedR(unmodifiedArgumentsRegister(pc[1].u.operand)) = arguments;
+    LLINT_END();
+}
+
+LLINT_SLOW_PATH_DECL(slow_path_create_this)
+{
+    LLINT_BEGIN();
+    JSFunction* constructor = asFunction(exec->callee());
+    
+#if !ASSERT_DISABLED
+    ConstructData constructData;
+    ASSERT(constructor->methodTable()->getConstructData(constructor, constructData) == ConstructTypeJS);
+#endif
+    
+    Structure* structure;
+    JSValue proto = LLINT_OP(2).jsValue();
+    if (proto.isObject())
+        structure = asObject(proto)->inheritorID(globalData);
+    else
+        structure = constructor->scope()->globalObject->emptyObjectStructure();
+    
+    LLINT_RETURN(constructEmptyObject(exec, structure));
+}
+
+LLINT_SLOW_PATH_DECL(slow_path_convert_this)
+{
+    LLINT_BEGIN();
+    JSValue v1 = LLINT_OP(1).jsValue();
+    ASSERT(v1.isPrimitive());
+    LLINT_RETURN(v1.toThisObject(exec));
+}
+
+LLINT_SLOW_PATH_DECL(slow_path_new_object)
+{
+    LLINT_BEGIN();
+    LLINT_RETURN(constructEmptyObject(exec));
+}
+
+LLINT_SLOW_PATH_DECL(slow_path_new_array)
+{
+    LLINT_BEGIN();
+    LLINT_RETURN(constructArray(exec, bitwise_cast<JSValue*>(&LLINT_OP(2)), pc[3].u.operand));
+}
+
+LLINT_SLOW_PATH_DECL(slow_path_new_array_buffer)
+{
+    LLINT_BEGIN();
+    LLINT_RETURN(constructArray(exec, exec->codeBlock()->constantBuffer(pc[2].u.operand), pc[3].u.operand));
+}
+
+LLINT_SLOW_PATH_DECL(slow_path_new_regexp)
+{
+    LLINT_BEGIN();
+    RegExp* regExp = exec->codeBlock()->regexp(pc[2].u.operand);
+    if (!regExp->isValid())
+        LLINT_THROW(createSyntaxError(exec, "Invalid flag supplied to RegExp constructor."));
+    LLINT_RETURN(RegExpObject::create(globalData, exec->lexicalGlobalObject(), exec->lexicalGlobalObject()->regExpStructure(), regExp));
+}
+
+LLINT_SLOW_PATH_DECL(slow_path_not)
+{
+    LLINT_BEGIN();
+    LLINT_RETURN(jsBoolean(!LLINT_OP_C(2).jsValue().toBoolean(exec)));
+}
+
+LLINT_SLOW_PATH_DECL(slow_path_eq)
+{
+    LLINT_BEGIN();
+    LLINT_RETURN(jsBoolean(JSValue::equal(exec, LLINT_OP_C(2).jsValue(), LLINT_OP_C(3).jsValue())));
+}
+
+LLINT_SLOW_PATH_DECL(slow_path_neq)
+{
+    LLINT_BEGIN();
+    LLINT_RETURN(jsBoolean(!JSValue::equal(exec, LLINT_OP_C(2).jsValue(), LLINT_OP_C(3).jsValue())));
+}
+
+LLINT_SLOW_PATH_DECL(slow_path_stricteq)
+{
+    LLINT_BEGIN();
+    LLINT_RETURN(jsBoolean(JSValue::strictEqual(exec, LLINT_OP_C(2).jsValue(), LLINT_OP_C(3).jsValue())));
+}
+
+LLINT_SLOW_PATH_DECL(slow_path_nstricteq)
+{
+    LLINT_BEGIN();
+    LLINT_RETURN(jsBoolean(!JSValue::strictEqual(exec, LLINT_OP_C(2).jsValue(), LLINT_OP_C(3).jsValue())));
+}
+
+LLINT_SLOW_PATH_DECL(slow_path_less)
+{
+    LLINT_BEGIN();
+    LLINT_RETURN(jsBoolean(jsLess<true>(exec, LLINT_OP_C(2).jsValue(), LLINT_OP_C(3).jsValue())));
+}
+
+LLINT_SLOW_PATH_DECL(slow_path_lesseq)
+{
+    LLINT_BEGIN();
+    LLINT_RETURN(jsBoolean(jsLessEq<true>(exec, LLINT_OP_C(2).jsValue(), LLINT_OP_C(3).jsValue())));
+}
+
+LLINT_SLOW_PATH_DECL(slow_path_greater)
+{
+    LLINT_BEGIN();
+    LLINT_RETURN(jsBoolean(jsLess<false>(exec, LLINT_OP_C(3).jsValue(), LLINT_OP_C(2).jsValue())));
+}
+
+LLINT_SLOW_PATH_DECL(slow_path_greatereq)
+{
+    LLINT_BEGIN();
+    LLINT_RETURN(jsBoolean(jsLessEq<false>(exec, LLINT_OP_C(3).jsValue(), LLINT_OP_C(2).jsValue())));
+}
+
+LLINT_SLOW_PATH_DECL(slow_path_pre_inc)
+{
+    LLINT_BEGIN();
+    LLINT_RETURN(jsNumber(LLINT_OP(1).jsValue().toNumber(exec) + 1));
+}
+
+LLINT_SLOW_PATH_DECL(slow_path_pre_dec)
+{
+    LLINT_BEGIN();
+    LLINT_RETURN(jsNumber(LLINT_OP(1).jsValue().toNumber(exec) - 1));
+}
+
+LLINT_SLOW_PATH_DECL(slow_path_post_inc)
+{
+    LLINT_BEGIN();
+    double result = LLINT_OP(2).jsValue().toNumber(exec);
+    LLINT_OP(2) = jsNumber(result + 1);
+    LLINT_RETURN(jsNumber(result));
+}
+
+LLINT_SLOW_PATH_DECL(slow_path_post_dec)
+{
+    LLINT_BEGIN();
+    double result = LLINT_OP(2).jsValue().toNumber(exec);
+    LLINT_OP(2) = jsNumber(result - 1);
+    LLINT_RETURN(jsNumber(result));
+}
+
+LLINT_SLOW_PATH_DECL(slow_path_to_jsnumber)
+{
+    LLINT_BEGIN();
+    LLINT_RETURN(jsNumber(LLINT_OP_C(2).jsValue().toNumber(exec)));
+}
+
+LLINT_SLOW_PATH_DECL(slow_path_negate)
+{
+    LLINT_BEGIN();
+    LLINT_RETURN(jsNumber(-LLINT_OP_C(2).jsValue().toNumber(exec)));
+}
+
+LLINT_SLOW_PATH_DECL(slow_path_add)
+{
+    LLINT_BEGIN();
+    JSValue v1 = LLINT_OP_C(2).jsValue();
+    JSValue v2 = LLINT_OP_C(3).jsValue();
+    
+#if LLINT_SLOW_PATH_TRACING
+    dataLog("Trying to add %s", v1.description());
+    dataLog(" to %s.\n", v2.description());
+#endif
+    
+    if (v1.isString() && !v2.isObject())
+        LLINT_RETURN(jsString(exec, asString(v1), v2.toString(exec)));
+    
+    if (v1.isNumber() && v2.isNumber())
+        LLINT_RETURN(jsNumber(v1.asNumber() + v2.asNumber()));
+    
+    LLINT_RETURN(jsAddSlowCase(exec, v1, v2));
+}
+
+LLINT_SLOW_PATH_DECL(slow_path_mul)
+{
+    LLINT_BEGIN();
+    LLINT_RETURN(jsNumber(LLINT_OP_C(2).jsValue().toNumber(exec) * LLINT_OP_C(3).jsValue().toNumber(exec)));
+}
+
+LLINT_SLOW_PATH_DECL(slow_path_sub)
+{
+    LLINT_BEGIN();
+    LLINT_RETURN(jsNumber(LLINT_OP_C(2).jsValue().toNumber(exec) - LLINT_OP_C(3).jsValue().toNumber(exec)));
+}
+
+LLINT_SLOW_PATH_DECL(slow_path_div)
+{
+    LLINT_BEGIN();
+    LLINT_RETURN(jsNumber(LLINT_OP_C(2).jsValue().toNumber(exec) / LLINT_OP_C(3).jsValue().toNumber(exec)));
+}
+
+LLINT_SLOW_PATH_DECL(slow_path_mod)
+{
+    LLINT_BEGIN();
+    LLINT_RETURN(jsNumber(fmod(LLINT_OP_C(2).jsValue().toNumber(exec), LLINT_OP_C(3).jsValue().toNumber(exec))));
+}
+
+LLINT_SLOW_PATH_DECL(slow_path_lshift)
+{
+    LLINT_BEGIN();
+    LLINT_RETURN(jsNumber(LLINT_OP_C(2).jsValue().toInt32(exec) << (LLINT_OP_C(3).jsValue().toUInt32(exec) & 31)));
+}
+
+LLINT_SLOW_PATH_DECL(slow_path_rshift)
+{
+    LLINT_BEGIN();
+    LLINT_RETURN(jsNumber(LLINT_OP_C(2).jsValue().toInt32(exec) >> (LLINT_OP_C(3).jsValue().toUInt32(exec) & 31)));
+}
+
+LLINT_SLOW_PATH_DECL(slow_path_urshift)
+{
+    LLINT_BEGIN();
+    LLINT_RETURN(jsNumber(LLINT_OP_C(2).jsValue().toUInt32(exec) >> (LLINT_OP_C(3).jsValue().toUInt32(exec) & 31)));
+}
+
+LLINT_SLOW_PATH_DECL(slow_path_bitand)
+{
+    LLINT_BEGIN();
+    LLINT_RETURN(jsNumber(LLINT_OP_C(2).jsValue().toInt32(exec) & LLINT_OP_C(3).jsValue().toInt32(exec)));
+}
+
+LLINT_SLOW_PATH_DECL(slow_path_bitor)
+{
+    LLINT_BEGIN();
+    LLINT_RETURN(jsNumber(LLINT_OP_C(2).jsValue().toInt32(exec) | LLINT_OP_C(3).jsValue().toInt32(exec)));
+}
+
+LLINT_SLOW_PATH_DECL(slow_path_bitxor)
+{
+    LLINT_BEGIN();
+    LLINT_RETURN(jsNumber(LLINT_OP_C(2).jsValue().toInt32(exec) ^ LLINT_OP_C(3).jsValue().toInt32(exec)));
+}
+
+LLINT_SLOW_PATH_DECL(slow_path_bitnot)
+{
+    LLINT_BEGIN();
+    LLINT_RETURN(jsNumber(~LLINT_OP_C(2).jsValue().toInt32(exec)));
+}
+
+LLINT_SLOW_PATH_DECL(slow_path_check_has_instance)
+{
+    LLINT_BEGIN();
+    JSValue baseVal = LLINT_OP_C(1).jsValue();
+#ifndef NDEBUG
+    TypeInfo typeInfo(UnspecifiedType);
+    ASSERT(!baseVal.isObject()
+           || !(typeInfo = asObject(baseVal)->structure()->typeInfo()).implementsHasInstance());
+#endif
+    LLINT_THROW(createInvalidParamError(exec, "instanceof", baseVal));
+}
+
+LLINT_SLOW_PATH_DECL(slow_path_instanceof)
+{
+    LLINT_BEGIN();
+    LLINT_RETURN(jsBoolean(CommonSlowPaths::opInstanceOfSlow(exec, LLINT_OP_C(2).jsValue(), LLINT_OP_C(3).jsValue(), LLINT_OP_C(4).jsValue())));
+}
+
+LLINT_SLOW_PATH_DECL(slow_path_typeof)
+{
+    LLINT_BEGIN();
+    LLINT_RETURN(jsTypeStringForValue(exec, LLINT_OP_C(2).jsValue()));
+}
+
+LLINT_SLOW_PATH_DECL(slow_path_is_undefined)
+{
+    LLINT_BEGIN();
+    JSValue v = LLINT_OP_C(2).jsValue();
+    LLINT_RETURN(jsBoolean(v.isCell() ? v.asCell()->structure()->typeInfo().masqueradesAsUndefined() : v.isUndefined()));
+}
+
+LLINT_SLOW_PATH_DECL(slow_path_is_boolean)
+{
+    LLINT_BEGIN();
+    LLINT_RETURN(jsBoolean(LLINT_OP_C(2).jsValue().isBoolean()));
+}
+
+LLINT_SLOW_PATH_DECL(slow_path_is_number)
+{
+    LLINT_BEGIN();
+    LLINT_RETURN(jsBoolean(LLINT_OP_C(2).jsValue().isNumber()));
+}
+
+LLINT_SLOW_PATH_DECL(slow_path_is_string)
+{
+    LLINT_BEGIN();
+    LLINT_RETURN(jsBoolean(isJSString(LLINT_OP_C(2).jsValue())));
+}
+
+LLINT_SLOW_PATH_DECL(slow_path_is_object)
+{
+    LLINT_BEGIN();
+    LLINT_RETURN(jsBoolean(jsIsObjectType(LLINT_OP_C(2).jsValue())));
+}
+
+LLINT_SLOW_PATH_DECL(slow_path_is_function)
+{
+    LLINT_BEGIN();
+    LLINT_RETURN(jsBoolean(jsIsFunctionType(LLINT_OP_C(2).jsValue())));
+}
+
+LLINT_SLOW_PATH_DECL(slow_path_in)
+{
+    LLINT_BEGIN();
+    LLINT_RETURN(jsBoolean(CommonSlowPaths::opIn(exec, LLINT_OP_C(2).jsValue(), LLINT_OP_C(3).jsValue())));
+}
+
+LLINT_SLOW_PATH_DECL(slow_path_resolve)
+{
+    LLINT_BEGIN();
+    LLINT_RETURN_PROFILED(op_resolve, CommonSlowPaths::opResolve(exec, exec->codeBlock()->identifier(pc[2].u.operand)));
+}
+
+LLINT_SLOW_PATH_DECL(slow_path_resolve_skip)
+{
+    LLINT_BEGIN();
+    LLINT_RETURN_PROFILED(
+        op_resolve_skip,
+        CommonSlowPaths::opResolveSkip(
+            exec,
+            exec->codeBlock()->identifier(pc[2].u.operand),
+            pc[3].u.operand));
+}
+
+static JSValue resolveGlobal(ExecState* exec, Instruction* pc)
+{
+    CodeBlock* codeBlock = exec->codeBlock();
+    JSGlobalObject* globalObject = codeBlock->globalObject();
+    ASSERT(globalObject->isGlobalObject());
+    int property = pc[2].u.operand;
+    Structure* structure = pc[3].u.structure.get();
+    
+    ASSERT_UNUSED(structure, structure != globalObject->structure());
+    
+    Identifier& ident = codeBlock->identifier(property);
+    PropertySlot slot(globalObject);
+    
+    if (globalObject->getPropertySlot(exec, ident, slot)) {
+        JSValue result = slot.getValue(exec, ident);
+        if (slot.isCacheableValue() && !globalObject->structure()->isUncacheableDictionary()
+            && slot.slotBase() == globalObject) {
+            pc[3].u.structure.set(
+                exec->globalData(), codeBlock->ownerExecutable(), globalObject->structure());
+            pc[4] = slot.cachedOffset();
+        }
+        
+        return result;
+    }
+    
+    exec->globalData().exception = createUndefinedVariableError(exec, ident);
+    return JSValue();
+}
+
+LLINT_SLOW_PATH_DECL(slow_path_resolve_global)
+{
+    LLINT_BEGIN();
+    LLINT_RETURN_PROFILED(op_resolve_global, resolveGlobal(exec, pc));
+}
+
+LLINT_SLOW_PATH_DECL(slow_path_resolve_global_dynamic)
+{
+    LLINT_BEGIN();
+    LLINT_RETURN_PROFILED(op_resolve_global_dynamic, resolveGlobal(exec, pc));
+}
+
+LLINT_SLOW_PATH_DECL(slow_path_resolve_for_resolve_global_dynamic)
+{
+    LLINT_BEGIN();
+    LLINT_RETURN_PROFILED(op_resolve_global_dynamic, CommonSlowPaths::opResolve(exec, exec->codeBlock()->identifier(pc[2].u.operand)));
+}
+
+LLINT_SLOW_PATH_DECL(slow_path_resolve_base)
+{
+    LLINT_BEGIN();
+    Identifier& ident = exec->codeBlock()->identifier(pc[2].u.operand);
+    if (pc[3].u.operand) {
+        JSValue base = JSC::resolveBase(exec, ident, exec->scopeChain(), true);
+        if (!base)
+            LLINT_THROW(createErrorForInvalidGlobalAssignment(exec, ident.ustring()));
+        LLINT_RETURN(base);
+    }
+    
+    LLINT_RETURN_PROFILED(op_resolve_base, JSC::resolveBase(exec, ident, exec->scopeChain(), false));
+}
+
+LLINT_SLOW_PATH_DECL(slow_path_ensure_property_exists)
+{
+    LLINT_BEGIN();
+    JSObject* object = asObject(LLINT_OP(1).jsValue());
+    PropertySlot slot(object);
+    Identifier& ident = exec->codeBlock()->identifier(pc[2].u.operand);
+    if (!object->getPropertySlot(exec, ident, slot))
+        LLINT_THROW(createErrorForInvalidGlobalAssignment(exec, ident.ustring()));
+    LLINT_END();
+}
+
+LLINT_SLOW_PATH_DECL(slow_path_resolve_with_base)
+{
+    LLINT_BEGIN();
+    JSValue result = CommonSlowPaths::opResolveWithBase(exec, exec->codeBlock()->identifier(pc[3].u.operand), LLINT_OP(1));
+    LLINT_CHECK_EXCEPTION();
+    LLINT_OP(2) = result;
+    // FIXME: technically should have profiling, but we don't do it because the DFG won't use it.
+    LLINT_END();
+}
+
+LLINT_SLOW_PATH_DECL(slow_path_resolve_with_this)
+{
+    LLINT_BEGIN();
+    JSValue result = CommonSlowPaths::opResolveWithThis(exec, exec->codeBlock()->identifier(pc[3].u.operand), LLINT_OP(1));
+    LLINT_CHECK_EXCEPTION();
+    LLINT_OP(2) = result;
+    // FIXME: technically should have profiling, but we don't do it because the DFG won't use it.
+    LLINT_END();
+}
+
+LLINT_SLOW_PATH_DECL(slow_path_get_by_id)
+{
+    LLINT_BEGIN();
+    CodeBlock* codeBlock = exec->codeBlock();
+    Identifier& ident = codeBlock->identifier(pc[3].u.operand);
+    JSValue baseValue = LLINT_OP_C(2).jsValue();
+    PropertySlot slot(baseValue);
+
+    JSValue result = baseValue.get(exec, ident, slot);
+    LLINT_CHECK_EXCEPTION();
+    LLINT_OP(1) = result;
+
+    if (baseValue.isCell()
+        && slot.isCacheable()
+        && slot.slotBase() == baseValue
+        && slot.cachedPropertyType() == PropertySlot::Value) {
+        
+        JSCell* baseCell = baseValue.asCell();
+        Structure* structure = baseCell->structure();
+        
+        if (!structure->isUncacheableDictionary()
+            && !structure->typeInfo().prohibitsPropertyCaching()) {
+            pc[4].u.structure.set(
+                globalData, codeBlock->ownerExecutable(), structure);
+            pc[5].u.operand = slot.cachedOffset() * sizeof(JSValue);
+        }
+    }
+    
+    pc[OPCODE_LENGTH(op_get_by_id) - 1].u.profile->m_buckets[0] = JSValue::encode(result);
+    LLINT_END();
+}
+
+LLINT_SLOW_PATH_DECL(slow_path_get_arguments_length)
+{
+    LLINT_BEGIN();
+    CodeBlock* codeBlock = exec->codeBlock();
+    Identifier& ident = codeBlock->identifier(pc[3].u.operand);
+    JSValue baseValue = LLINT_OP(2).jsValue();
+    PropertySlot slot(baseValue);
+    LLINT_RETURN(baseValue.get(exec, ident, slot));
+}
+
+LLINT_SLOW_PATH_DECL(slow_path_put_by_id)
+{
+    LLINT_BEGIN();
+    CodeBlock* codeBlock = exec->codeBlock();
+    Identifier& ident = codeBlock->identifier(pc[2].u.operand);
+    
+    JSValue baseValue = LLINT_OP_C(1).jsValue();
+    PutPropertySlot slot(codeBlock->isStrictMode());
+    if (pc[8].u.operand)
+        asObject(baseValue)->putDirect(globalData, ident, LLINT_OP_C(3).jsValue(), slot);
+    else
+        baseValue.put(exec, ident, LLINT_OP_C(3).jsValue(), slot);
+    LLINT_CHECK_EXCEPTION();
+    
+    if (baseValue.isCell()
+        && slot.isCacheable()) {
+        
+        JSCell* baseCell = baseValue.asCell();
+        Structure* structure = baseCell->structure();
+        
+        if (!structure->isUncacheableDictionary()
+            && !structure->typeInfo().prohibitsPropertyCaching()
+            && baseCell == slot.base()) {
+            
+            if (slot.type() == PutPropertySlot::NewProperty) {
+                if (!structure->isDictionary() && structure->previousID()->propertyStorageCapacity() == structure->propertyStorageCapacity()) {
+                    // This is needed because some of the methods we call
+                    // below may GC.
+                    pc[0].u.opcode = bitwise_cast<void*>(&llint_op_put_by_id);
+
+                    normalizePrototypeChain(exec, baseCell);
+                    
+                    ASSERT(structure->previousID()->isObject());
+                    pc[4].u.structure.set(
+                        globalData, codeBlock->ownerExecutable(), structure->previousID());
+                    pc[5].u.operand = slot.cachedOffset() * sizeof(JSValue);
+                    pc[6].u.structure.set(
+                        globalData, codeBlock->ownerExecutable(), structure);
+                    StructureChain* chain = structure->prototypeChain(exec);
+                    ASSERT(chain);
+                    pc[7].u.structureChain.set(
+                        globalData, codeBlock->ownerExecutable(), chain);
+                    
+                    if (pc[8].u.operand)
+                        pc[0].u.opcode = bitwise_cast<void*>(&llint_op_put_by_id_transition_direct);
+                    else
+                        pc[0].u.opcode = bitwise_cast<void*>(&llint_op_put_by_id_transition_normal);
+                }
+            } else {
+                pc[0].u.opcode = bitwise_cast<void*>(&llint_op_put_by_id);
+                pc[4].u.structure.set(
+                    globalData, codeBlock->ownerExecutable(), structure);
+                pc[5].u.operand = slot.cachedOffset() * sizeof(JSValue);
+            }
+        }
+    }
+    
+    LLINT_END();
+}
+
+LLINT_SLOW_PATH_DECL(slow_path_del_by_id)
+{
+    LLINT_BEGIN();
+    CodeBlock* codeBlock = exec->codeBlock();
+    JSObject* baseObject = LLINT_OP_C(2).jsValue().toObject(exec);
+    bool couldDelete = baseObject->methodTable()->deleteProperty(baseObject, exec, codeBlock->identifier(pc[3].u.operand));
+    LLINT_CHECK_EXCEPTION();
+    if (!couldDelete && codeBlock->isStrictMode())
+        LLINT_THROW(createTypeError(exec, "Unable to delete property."));
+    LLINT_RETURN(jsBoolean(couldDelete));
+}
+
+inline JSValue getByVal(ExecState* exec, JSValue baseValue, JSValue subscript)
+{
+    if (LIKELY(baseValue.isCell() && subscript.isString())) {
+        if (JSValue result = baseValue.asCell()->fastGetOwnProperty(exec, asString(subscript)->value(exec)))
+            return result;
+    }
+    
+    if (subscript.isUInt32()) {
+        uint32_t i = subscript.asUInt32();
+        if (isJSString(baseValue) && asString(baseValue)->canGetIndex(i))
+            return asString(baseValue)->getIndex(exec, i);
+        
+        if (isJSByteArray(baseValue) && asByteArray(baseValue)->canAccessIndex(i))
+            return asByteArray(baseValue)->getIndex(exec, i);
+        
+        return baseValue.get(exec, i);
+    }
+    
+    Identifier property(exec, subscript.toString(exec)->value(exec));
+    return baseValue.get(exec, property);
+}
+
+LLINT_SLOW_PATH_DECL(slow_path_get_by_val)
+{
+    LLINT_BEGIN();
+    LLINT_RETURN_PROFILED(op_get_by_val, getByVal(exec, LLINT_OP_C(2).jsValue(), LLINT_OP_C(3).jsValue()));
+}
+
+LLINT_SLOW_PATH_DECL(slow_path_get_argument_by_val)
+{
+    LLINT_BEGIN();
+    JSValue arguments = LLINT_OP(2).jsValue();
+    if (!arguments) {
+        arguments = Arguments::create(globalData, exec);
+        LLINT_CHECK_EXCEPTION();
+        LLINT_OP(2) = arguments;
+        exec->uncheckedR(unmodifiedArgumentsRegister(pc[2].u.operand)) = arguments;
+    }
+    
+    LLINT_RETURN(getByVal(exec, arguments, LLINT_OP_C(3).jsValue()));
+}
+
+LLINT_SLOW_PATH_DECL(slow_path_get_by_pname)
+{
+    LLINT_BEGIN();
+    LLINT_RETURN(getByVal(exec, LLINT_OP(2).jsValue(), LLINT_OP(3).jsValue()));
+}
+
+LLINT_SLOW_PATH_DECL(slow_path_put_by_val)
+{
+    LLINT_BEGIN();
+    
+    JSValue baseValue = LLINT_OP_C(1).jsValue();
+    JSValue subscript = LLINT_OP_C(2).jsValue();
+    JSValue value = LLINT_OP_C(3).jsValue();
+    
+    if (LIKELY(subscript.isUInt32())) {
+        uint32_t i = subscript.asUInt32();
+        if (isJSArray(baseValue)) {
+            JSArray* jsArray = asArray(baseValue);
+            if (jsArray->canSetIndex(i))
+                jsArray->setIndex(globalData, i, value);
+            else
+                JSArray::putByIndex(jsArray, exec, i, value);
+            LLINT_END();
+        }
+        if (isJSByteArray(baseValue)
+            && asByteArray(baseValue)->canAccessIndex(i)) {
+            JSByteArray* jsByteArray = asByteArray(baseValue);
+            if (value.isInt32()) {
+                jsByteArray->setIndex(i, value.asInt32());
+                LLINT_END();
+            }
+            if (value.isNumber()) {
+                jsByteArray->setIndex(i, value.asNumber());
+                LLINT_END();
+            }
+        }
+        baseValue.put(exec, i, value);
+        LLINT_END();
+    }
+    
+    Identifier property(exec, subscript.toString(exec)->value(exec));
+    LLINT_CHECK_EXCEPTION();
+    PutPropertySlot slot(exec->codeBlock()->isStrictMode());
+    baseValue.put(exec, property, value, slot);
+    LLINT_END();
+}
+
+LLINT_SLOW_PATH_DECL(slow_path_del_by_val)
+{
+    LLINT_BEGIN();
+    JSValue baseValue = LLINT_OP_C(2).jsValue();
+    JSObject* baseObject = baseValue.toObject(exec);
+    
+    JSValue subscript = LLINT_OP_C(3).jsValue();
+    
+    bool couldDelete;
+    
+    uint32_t i;
+    if (subscript.getUInt32(i))
+        couldDelete = baseObject->methodTable()->deletePropertyByIndex(baseObject, exec, i);
+    else {
+        LLINT_CHECK_EXCEPTION();
+        Identifier property(exec, subscript.toString(exec)->value(exec));
+        LLINT_CHECK_EXCEPTION();
+        couldDelete = baseObject->methodTable()->deleteProperty(baseObject, exec, property);
+    }
+    
+    if (!couldDelete && exec->codeBlock()->isStrictMode())
+        LLINT_THROW(createTypeError(exec, "Unable to delete property."));
+    
+    LLINT_RETURN(jsBoolean(couldDelete));
+}
+
+LLINT_SLOW_PATH_DECL(slow_path_put_by_index)
+{
+    LLINT_BEGIN();
+    LLINT_OP_C(1).jsValue().put(exec, pc[2].u.operand, LLINT_OP_C(3).jsValue());
+    LLINT_END();
+}
+
+LLINT_SLOW_PATH_DECL(slow_path_put_getter_setter)
+{
+    LLINT_BEGIN();
+    ASSERT(LLINT_OP(1).jsValue().isObject());
+    JSObject* baseObj = asObject(LLINT_OP(1).jsValue());
+    
+    GetterSetter* accessor = GetterSetter::create(exec);
+    LLINT_CHECK_EXCEPTION();
+    
+    JSValue getter = LLINT_OP(3).jsValue();
+    JSValue setter = LLINT_OP(4).jsValue();
+    ASSERT(getter.isObject() || getter.isUndefined());
+    ASSERT(setter.isObject() || setter.isUndefined());
+    ASSERT(getter.isObject() || setter.isObject());
+    
+    if (!getter.isUndefined())
+        accessor->setGetter(globalData, asObject(getter));
+    if (!setter.isUndefined())
+        accessor->setSetter(globalData, asObject(setter));
+    baseObj->putDirectAccessor(
+        globalData,
+        exec->codeBlock()->identifier(pc[2].u.operand),
+        accessor, Accessor);
+    LLINT_END();
+}
+
+LLINT_SLOW_PATH_DECL(slow_path_jmp_scopes)
+{
+    LLINT_BEGIN();
+    unsigned count = pc[1].u.operand;
+    ScopeChainNode* tmp = exec->scopeChain();
+    while (count--)
+        tmp = tmp->pop();
+    exec->setScopeChain(tmp);
+    pc += pc[2].u.operand;
+    LLINT_END();
+}
+
+LLINT_SLOW_PATH_DECL(slow_path_jtrue)
+{
+    LLINT_BEGIN();
+    LLINT_BRANCH(op_jtrue, LLINT_OP_C(1).jsValue().toBoolean(exec));
+}
+
+LLINT_SLOW_PATH_DECL(slow_path_jfalse)
+{
+    LLINT_BEGIN();
+    LLINT_BRANCH(op_jfalse, !LLINT_OP_C(1).jsValue().toBoolean(exec));
+}
+
+LLINT_SLOW_PATH_DECL(slow_path_jless)
+{
+    LLINT_BEGIN();
+    LLINT_BRANCH(op_jless, jsLess<true>(exec, LLINT_OP_C(1).jsValue(), LLINT_OP_C(2).jsValue()));
+}
+
+LLINT_SLOW_PATH_DECL(slow_path_jnless)
+{
+    LLINT_BEGIN();
+    LLINT_BRANCH(op_jnless, !jsLess<true>(exec, LLINT_OP_C(1).jsValue(), LLINT_OP_C(2).jsValue()));
+}
+
+LLINT_SLOW_PATH_DECL(slow_path_jgreater)
+{
+    LLINT_BEGIN();
+    LLINT_BRANCH(op_jgreater, jsLess<false>(exec, LLINT_OP_C(2).jsValue(), LLINT_OP_C(1).jsValue()));
+}
+
+LLINT_SLOW_PATH_DECL(slow_path_jngreater)
+{
+    LLINT_BEGIN();
+    LLINT_BRANCH(op_jngreater, !jsLess<false>(exec, LLINT_OP_C(2).jsValue(), LLINT_OP_C(1).jsValue()));
+}
+
+LLINT_SLOW_PATH_DECL(slow_path_jlesseq)
+{
+    LLINT_BEGIN();
+    LLINT_BRANCH(op_jlesseq, jsLessEq<true>(exec, LLINT_OP_C(1).jsValue(), LLINT_OP_C(2).jsValue()));
+}
+
+LLINT_SLOW_PATH_DECL(slow_path_jnlesseq)
+{
+    LLINT_BEGIN();
+    LLINT_BRANCH(op_jnlesseq, !jsLessEq<true>(exec, LLINT_OP_C(1).jsValue(), LLINT_OP_C(2).jsValue()));
+}
+
+LLINT_SLOW_PATH_DECL(slow_path_jgreatereq)
+{
+    LLINT_BEGIN();
+    LLINT_BRANCH(op_jgreatereq, jsLessEq<false>(exec, LLINT_OP_C(2).jsValue(), LLINT_OP_C(1).jsValue()));
+}
+
+LLINT_SLOW_PATH_DECL(slow_path_jngreatereq)
+{
+    LLINT_BEGIN();
+    LLINT_BRANCH(op_jngreatereq, !jsLessEq<false>(exec, LLINT_OP_C(2).jsValue(), LLINT_OP_C(1).jsValue()));
+}
+
+LLINT_SLOW_PATH_DECL(slow_path_switch_imm)
+{
+    LLINT_BEGIN();
+    JSValue scrutinee = LLINT_OP_C(3).jsValue();
+    ASSERT(scrutinee.isDouble());
+    double value = scrutinee.asDouble();
+    int32_t intValue = static_cast<int32_t>(value);
+    int defaultOffset = pc[2].u.operand;
+    if (value == intValue) {
+        CodeBlock* codeBlock = exec->codeBlock();
+        pc += codeBlock->immediateSwitchJumpTable(pc[1].u.operand).offsetForValue(intValue, defaultOffset);
+    } else
+        pc += defaultOffset;
+    LLINT_END();
+}
+
+LLINT_SLOW_PATH_DECL(slow_path_switch_string)
+{
+    LLINT_BEGIN();
+    JSValue scrutinee = LLINT_OP_C(3).jsValue();
+    int defaultOffset = pc[2].u.operand;
+    if (!scrutinee.isString())
+        pc += defaultOffset;
+    else {
+        CodeBlock* codeBlock = exec->codeBlock();
+        pc += codeBlock->stringSwitchJumpTable(pc[1].u.operand).offsetForValue(asString(scrutinee)->value(exec).impl(), defaultOffset);
+    }
+    LLINT_END();
+}
+
+LLINT_SLOW_PATH_DECL(slow_path_new_func)
+{
+    LLINT_BEGIN();
+    CodeBlock* codeBlock = exec->codeBlock();
+    ASSERT(codeBlock->codeType() != FunctionCode
+           || !codeBlock->needsFullScopeChain()
+           || exec->uncheckedR(codeBlock->activationRegister()).jsValue());
+#if LLINT_SLOW_PATH_TRACING
+    dataLog("Creating function!\n");
+#endif
+    LLINT_RETURN(codeBlock->functionDecl(pc[2].u.operand)->make(exec, exec->scopeChain()));
+}
+
+LLINT_SLOW_PATH_DECL(slow_path_new_func_exp)
+{
+    LLINT_BEGIN();
+    CodeBlock* codeBlock = exec->codeBlock();
+    FunctionExecutable* function = codeBlock->functionExpr(pc[2].u.operand);
+    JSFunction* func = function->make(exec, exec->scopeChain());
+    
+    if (!function->name().isNull()) {
+        JSStaticScopeObject* functionScopeObject = JSStaticScopeObject::create(exec, function->name(), func, ReadOnly | DontDelete);
+        func->setScope(globalData, func->scope()->push(functionScopeObject));
+    }
+    
+    LLINT_RETURN(func);
+}
+
+static SlowPathReturnType handleHostCall(ExecState* execCallee, Instruction* pc, JSValue callee, CodeSpecializationKind kind)
+{
+    ExecState* exec = execCallee->callerFrame();
+    JSGlobalData& globalData = exec->globalData();
+    
+    execCallee->setScopeChain(exec->scopeChain());
+    execCallee->setCodeBlock(0);
+    execCallee->clearReturnPC();
+
+    if (kind == CodeForCall) {
+        CallData callData;
+        CallType callType = getCallData(callee, callData);
+    
+        ASSERT(callType != CallTypeJS);
+    
+        if (callType == CallTypeHost) {
+            globalData.hostCallReturnValue = JSValue::decode(callData.native.function(execCallee));
+            
+            LLINT_CALL_RETURN(execCallee, pc, reinterpret_cast<void*>(getHostCallReturnValue));
+        }
+        
+#if LLINT_SLOW_PATH_TRACING
+        dataLog("Call callee is not a function: %s\n", callee.description());
+#endif
+
+        ASSERT(callType == CallTypeNone);
+        LLINT_CALL_THROW(exec, pc, createNotAFunctionError(exec, callee));
+    }
+
+    ASSERT(kind == CodeForConstruct);
+    
+    ConstructData constructData;
+    ConstructType constructType = getConstructData(callee, constructData);
+    
+    ASSERT(constructType != ConstructTypeJS);
+    
+    if (constructType == ConstructTypeHost) {
+        globalData.hostCallReturnValue = JSValue::decode(constructData.native.function(execCallee));
+
+        LLINT_CALL_RETURN(execCallee, pc, reinterpret_cast<void*>(getHostCallReturnValue));
+    }
+    
+#if LLINT_SLOW_PATH_TRACING
+    dataLog("Constructor callee is not a function: %s\n", callee.description());
+#endif
+
+    ASSERT(constructType == ConstructTypeNone);
+    LLINT_CALL_THROW(exec, pc, createNotAConstructorError(exec, callee));
+}
+
+inline SlowPathReturnType setUpCall(ExecState* execCallee, Instruction* pc, CodeSpecializationKind kind, JSValue calleeAsValue, LLIntCallLinkInfo* callLinkInfo = 0)
+{
+#if LLINT_SLOW_PATH_TRACING
+    dataLog("Performing call with recorded PC = %p\n", execCallee->callerFrame()->currentVPC());
+#endif
+
+    JSCell* calleeAsFunctionCell = getJSFunction(calleeAsValue);
+    if (!calleeAsFunctionCell)
+        return handleHostCall(execCallee, pc, calleeAsValue, kind);
+    
+    JSFunction* callee = asFunction(calleeAsFunctionCell);
+    ScopeChainNode* scope = callee->scopeUnchecked();
+    JSGlobalData& globalData = *scope->globalData;
+    execCallee->setScopeChain(scope);
+    ExecutableBase* executable = callee->executable();
+    
+    MacroAssemblerCodePtr codePtr;
+    CodeBlock* codeBlock = 0;
+    if (executable->isHostFunction())
+        codePtr = executable->generatedJITCodeFor(kind).addressForCall();
+    else {
+        FunctionExecutable* functionExecutable = static_cast<FunctionExecutable*>(executable);
+        JSObject* error = functionExecutable->compileFor(execCallee, callee->scope(), kind);
+        if (error)
+            LLINT_CALL_THROW(execCallee->callerFrame(), pc, error);
+        codeBlock = &functionExecutable->generatedBytecodeFor(kind);
+        ASSERT(codeBlock);
+        if (execCallee->argumentCountIncludingThis() < static_cast<size_t>(codeBlock->numParameters()))
+            codePtr = functionExecutable->generatedJITCodeWithArityCheckFor(kind);
+        else
+            codePtr = functionExecutable->generatedJITCodeFor(kind).addressForCall();
+    }
+    
+    if (callLinkInfo) {
+        if (callLinkInfo->isOnList())
+            callLinkInfo->remove();
+        ExecState* execCaller = execCallee->callerFrame();
+        callLinkInfo->callee.set(globalData, execCaller->codeBlock()->ownerExecutable(), callee);
+        callLinkInfo->lastSeenCallee.set(globalData, execCaller->codeBlock()->ownerExecutable(), callee);
+        callLinkInfo->machineCodeTarget = codePtr;
+        if (codeBlock)
+            codeBlock->linkIncomingCall(callLinkInfo);
+    }
+    
+    LLINT_CALL_RETURN(execCallee, pc, codePtr.executableAddress());
+}
+
+inline SlowPathReturnType genericCall(ExecState* exec, Instruction* pc, CodeSpecializationKind kind)
+{
+    // This needs to:
+    // - Set up a call frame.
+    // - Figure out what to call and compile it if necessary.
+    // - If possible, link the call's inline cache.
+    // - Return a tuple of machine code address to call and the new call frame.
+    
+    JSValue calleeAsValue = LLINT_OP_C(1).jsValue();
+    
+    ExecState* execCallee = exec + pc[3].u.operand;
+    
+    execCallee->setArgumentCountIncludingThis(pc[2].u.operand);
+    execCallee->uncheckedR(RegisterFile::Callee) = calleeAsValue;
+    execCallee->setCallerFrame(exec);
+    
+    ASSERT(pc[4].u.callLinkInfo);
+    return setUpCall(execCallee, pc, kind, calleeAsValue, pc[4].u.callLinkInfo);
+}
+
+LLINT_SLOW_PATH_DECL(slow_path_call)
+{
+    LLINT_BEGIN_NO_SET_PC();
+    return genericCall(exec, pc, CodeForCall);
+}
+
+LLINT_SLOW_PATH_DECL(slow_path_construct)
+{
+    LLINT_BEGIN_NO_SET_PC();
+    return genericCall(exec, pc, CodeForConstruct);
+}
+
+LLINT_SLOW_PATH_DECL(slow_path_call_varargs)
+{
+    LLINT_BEGIN();
+    // This needs to:
+    // - Set up a call frame while respecting the variable arguments.
+    // - Figure out what to call and compile it if necessary.
+    // - Return a tuple of machine code address to call and the new call frame.
+    
+    JSValue calleeAsValue = LLINT_OP_C(1).jsValue();
+    
+    ExecState* execCallee = loadVarargs(
+        exec, &globalData.interpreter->registerFile(),
+        LLINT_OP_C(2).jsValue(), LLINT_OP_C(3).jsValue(), pc[4].u.operand);
+    LLINT_CALL_CHECK_EXCEPTION(exec, pc);
+    
+    execCallee->uncheckedR(RegisterFile::Callee) = calleeAsValue;
+    execCallee->setCallerFrame(exec);
+    exec->uncheckedR(RegisterFile::ArgumentCount).tag() = bitwise_cast<int32_t>(pc + OPCODE_LENGTH(op_call_varargs));
+    
+    return setUpCall(execCallee, pc, CodeForCall, calleeAsValue);
+}
+
+LLINT_SLOW_PATH_DECL(slow_path_call_eval)
+{
+    LLINT_BEGIN_NO_SET_PC();
+    JSValue calleeAsValue = LLINT_OP(1).jsValue();
+    
+    ExecState* execCallee = exec + pc[3].u.operand;
+    
+    execCallee->setArgumentCountIncludingThis(pc[2].u.operand);
+    execCallee->setCallerFrame(exec);
+    execCallee->uncheckedR(RegisterFile::Callee) = calleeAsValue;
+    execCallee->setScopeChain(exec->scopeChain());
+    execCallee->setReturnPC(bitwise_cast<Instruction*>(&llint_generic_return_point));
+    execCallee->setCodeBlock(0);
+    exec->uncheckedR(RegisterFile::ArgumentCount).tag() = bitwise_cast<int32_t>(pc + OPCODE_LENGTH(op_call_eval));
+    
+    if (!isHostFunction(calleeAsValue, globalFuncEval))
+        return setUpCall(execCallee, pc, CodeForCall, calleeAsValue);
+    
+    globalData.hostCallReturnValue = eval(execCallee);
+    LLINT_CALL_RETURN(execCallee, pc, reinterpret_cast<void*>(getHostCallReturnValue));
+}
+
+LLINT_SLOW_PATH_DECL(slow_path_tear_off_activation)
+{
+    LLINT_BEGIN();
+    ASSERT(exec->codeBlock()->needsFullScopeChain());
+    JSValue activationValue = LLINT_OP(1).jsValue();
+    if (!activationValue) {
+        if (JSValue v = exec->uncheckedR(unmodifiedArgumentsRegister(pc[2].u.operand)).jsValue()) {
+            if (!exec->codeBlock()->isStrictMode())
+                asArguments(v)->tearOff(exec);
+        }
+        LLINT_END();
+    }
+    JSActivation* activation = asActivation(activationValue);
+    activation->tearOff(globalData);
+    if (JSValue v = exec->uncheckedR(unmodifiedArgumentsRegister(pc[2].u.operand)).jsValue())
+        asArguments(v)->didTearOffActivation(globalData, activation);
+    LLINT_END();
+}
+
+LLINT_SLOW_PATH_DECL(slow_path_tear_off_arguments)
+{
+    LLINT_BEGIN();
+    ASSERT(exec->codeBlock()->usesArguments() && !exec->codeBlock()->needsFullScopeChain());
+    asArguments(exec->uncheckedR(unmodifiedArgumentsRegister(pc[1].u.operand)).jsValue())->tearOff(exec);
+    LLINT_END();
+}
+
+LLINT_SLOW_PATH_DECL(slow_path_strcat)
+{
+    LLINT_BEGIN();
+    LLINT_RETURN(jsString(exec, &LLINT_OP(2), pc[3].u.operand));
+}
+
+LLINT_SLOW_PATH_DECL(slow_path_to_primitive)
+{
+    LLINT_BEGIN();
+    LLINT_RETURN(LLINT_OP_C(2).jsValue().toPrimitive(exec));
+}
+
+LLINT_SLOW_PATH_DECL(slow_path_get_pnames)
+{
+    LLINT_BEGIN();
+    JSValue v = LLINT_OP(2).jsValue();
+    if (v.isUndefinedOrNull()) {
+        pc += pc[5].u.operand;
+        LLINT_END();
+    }
+    
+    JSObject* o = v.toObject(exec);
+    Structure* structure = o->structure();
+    JSPropertyNameIterator* jsPropertyNameIterator = structure->enumerationCache();
+    if (!jsPropertyNameIterator || jsPropertyNameIterator->cachedPrototypeChain() != structure->prototypeChain(exec))
+        jsPropertyNameIterator = JSPropertyNameIterator::create(exec, o);
+    
+    LLINT_OP(1) = JSValue(jsPropertyNameIterator);
+    LLINT_OP(2) = JSValue(o);
+    LLINT_OP(3) = Register::withInt(0);
+    LLINT_OP(4) = Register::withInt(jsPropertyNameIterator->size());
+    
+    pc += OPCODE_LENGTH(op_get_pnames);
+    LLINT_END();
+}
+
+LLINT_SLOW_PATH_DECL(slow_path_next_pname)
+{
+    LLINT_BEGIN();
+    JSObject* base = asObject(LLINT_OP(2).jsValue());
+    JSString* property = asString(LLINT_OP(1).jsValue());
+    if (base->hasProperty(exec, Identifier(exec, property->value(exec)))) {
+        // Go to target.
+        pc += pc[6].u.operand;
+    } // Else, don't change the PC, so the interpreter will reloop.
+    LLINT_END();
+}
+
+LLINT_SLOW_PATH_DECL(slow_path_push_scope)
+{
+    LLINT_BEGIN();
+    JSValue v = LLINT_OP(1).jsValue();
+    JSObject* o = v.toObject(exec);
+    LLINT_CHECK_EXCEPTION();
+    
+    LLINT_OP(1) = o;
+    exec->setScopeChain(exec->scopeChain()->push(o));
+    
+    LLINT_END();
+}
+
+LLINT_SLOW_PATH_DECL(slow_path_pop_scope)
+{
+    LLINT_BEGIN();
+    exec->setScopeChain(exec->scopeChain()->pop());
+    LLINT_END();
+}
+
+LLINT_SLOW_PATH_DECL(slow_path_push_new_scope)
+{
+    LLINT_BEGIN();
+    CodeBlock* codeBlock = exec->codeBlock();
+    JSObject* scope = JSStaticScopeObject::create(exec, codeBlock->identifier(pc[2].u.operand), LLINT_OP(3).jsValue(), DontDelete);
+    exec->setScopeChain(exec->scopeChain()->push(scope));
+    LLINT_RETURN(scope);
+}
+
+LLINT_SLOW_PATH_DECL(slow_path_throw)
+{
+    LLINT_BEGIN();
+    LLINT_THROW(LLINT_OP_C(1).jsValue());
+}
+
+LLINT_SLOW_PATH_DECL(slow_path_throw_reference_error)
+{
+    LLINT_BEGIN();
+    LLINT_THROW(createReferenceError(exec, LLINT_OP_C(1).jsValue().toString(exec)->value(exec)));
+}
+
+LLINT_SLOW_PATH_DECL(slow_path_debug)
+{
+    LLINT_BEGIN();
+    int debugHookID = pc[1].u.operand;
+    int firstLine = pc[2].u.operand;
+    int lastLine = pc[3].u.operand;
+    
+    globalData.interpreter->debug(exec, static_cast<DebugHookID>(debugHookID), firstLine, lastLine);
+    
+    LLINT_END();
+}
+
+LLINT_SLOW_PATH_DECL(slow_path_profile_will_call)
+{
+    LLINT_BEGIN();
+    (*Profiler::enabledProfilerReference())->willExecute(exec, LLINT_OP(1).jsValue());
+    LLINT_END();
+}
+
+LLINT_SLOW_PATH_DECL(slow_path_profile_did_call)
+{
+    LLINT_BEGIN();
+    (*Profiler::enabledProfilerReference())->didExecute(exec, LLINT_OP(1).jsValue());
+    LLINT_END();
+}
+
+} } // namespace JSC::LLInt
+
+#endif // ENABLE(LLINT)
diff --git a/Source/JavaScriptCore/llint/LLIntSlowPaths.h b/Source/JavaScriptCore/llint/LLIntSlowPaths.h
new file mode 100644
index 000000000..fe684d306
--- /dev/null
+++ b/Source/JavaScriptCore/llint/LLIntSlowPaths.h
@@ -0,0 +1,171 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef LLIntSlowPaths_h
+#define LLIntSlowPaths_h
+
+#include <wtf/Platform.h>
+#include <wtf/StdLibExtras.h>
+
+#if ENABLE(LLINT)
+
+namespace JSC {
+
+class ExecState;
+struct Instruction;
+
+namespace LLInt {
+
+typedef int64_t SlowPathReturnType;
+
+extern "C" SlowPathReturnType llint_trace_operand(ExecState*, Instruction*, int fromWhere, int operand);
+extern "C" SlowPathReturnType llint_trace_value(ExecState*, Instruction*, int fromWhere, int operand);
+
+#define LLINT_SLOW_PATH_DECL(name) \
+    extern "C" SlowPathReturnType llint_##name(ExecState* exec, Instruction* pc)
+
+LLINT_SLOW_PATH_DECL(trace_prologue);
+LLINT_SLOW_PATH_DECL(trace_prologue_function_for_call);
+LLINT_SLOW_PATH_DECL(trace_prologue_function_for_construct);
+LLINT_SLOW_PATH_DECL(trace_arityCheck_for_call);
+LLINT_SLOW_PATH_DECL(trace_arityCheck_for_construct);
+LLINT_SLOW_PATH_DECL(trace);
+LLINT_SLOW_PATH_DECL(special_trace);
+LLINT_SLOW_PATH_DECL(entry_osr);
+LLINT_SLOW_PATH_DECL(entry_osr_function_for_call);
+LLINT_SLOW_PATH_DECL(entry_osr_function_for_construct);
+LLINT_SLOW_PATH_DECL(entry_osr_function_for_call_arityCheck);
+LLINT_SLOW_PATH_DECL(entry_osr_function_for_construct_arityCheck);
+LLINT_SLOW_PATH_DECL(loop_osr);
+LLINT_SLOW_PATH_DECL(replace);
+LLINT_SLOW_PATH_DECL(register_file_check);
+LLINT_SLOW_PATH_DECL(slow_path_call_arityCheck);
+LLINT_SLOW_PATH_DECL(slow_path_construct_arityCheck);
+LLINT_SLOW_PATH_DECL(slow_path_create_activation);
+LLINT_SLOW_PATH_DECL(slow_path_create_arguments);
+LLINT_SLOW_PATH_DECL(slow_path_create_this);
+LLINT_SLOW_PATH_DECL(slow_path_convert_this);
+LLINT_SLOW_PATH_DECL(slow_path_new_object);
+LLINT_SLOW_PATH_DECL(slow_path_new_array);
+LLINT_SLOW_PATH_DECL(slow_path_new_array_buffer);
+LLINT_SLOW_PATH_DECL(slow_path_new_regexp);
+LLINT_SLOW_PATH_DECL(slow_path_not);
+LLINT_SLOW_PATH_DECL(slow_path_eq);
+LLINT_SLOW_PATH_DECL(slow_path_neq);
+LLINT_SLOW_PATH_DECL(slow_path_stricteq);
+LLINT_SLOW_PATH_DECL(slow_path_nstricteq);
+LLINT_SLOW_PATH_DECL(slow_path_less);
+LLINT_SLOW_PATH_DECL(slow_path_lesseq);
+LLINT_SLOW_PATH_DECL(slow_path_greater);
+LLINT_SLOW_PATH_DECL(slow_path_greatereq);
+LLINT_SLOW_PATH_DECL(slow_path_pre_inc);
+LLINT_SLOW_PATH_DECL(slow_path_pre_dec);
+LLINT_SLOW_PATH_DECL(slow_path_post_inc);
+LLINT_SLOW_PATH_DECL(slow_path_post_dec);
+LLINT_SLOW_PATH_DECL(slow_path_to_jsnumber);
+LLINT_SLOW_PATH_DECL(slow_path_negate);
+LLINT_SLOW_PATH_DECL(slow_path_add);
+LLINT_SLOW_PATH_DECL(slow_path_mul);
+LLINT_SLOW_PATH_DECL(slow_path_sub);
+LLINT_SLOW_PATH_DECL(slow_path_div);
+LLINT_SLOW_PATH_DECL(slow_path_mod);
+LLINT_SLOW_PATH_DECL(slow_path_lshift);
+LLINT_SLOW_PATH_DECL(slow_path_rshift);
+LLINT_SLOW_PATH_DECL(slow_path_urshift);
+LLINT_SLOW_PATH_DECL(slow_path_bitand);
+LLINT_SLOW_PATH_DECL(slow_path_bitor);
+LLINT_SLOW_PATH_DECL(slow_path_bitxor);
+LLINT_SLOW_PATH_DECL(slow_path_bitnot);
+LLINT_SLOW_PATH_DECL(slow_path_check_has_instance);
+LLINT_SLOW_PATH_DECL(slow_path_instanceof);
+LLINT_SLOW_PATH_DECL(slow_path_typeof);
+LLINT_SLOW_PATH_DECL(slow_path_is_undefined);
+LLINT_SLOW_PATH_DECL(slow_path_is_boolean);
+LLINT_SLOW_PATH_DECL(slow_path_is_number);
+LLINT_SLOW_PATH_DECL(slow_path_is_string);
+LLINT_SLOW_PATH_DECL(slow_path_is_object);
+LLINT_SLOW_PATH_DECL(slow_path_is_function);
+LLINT_SLOW_PATH_DECL(slow_path_in);
+LLINT_SLOW_PATH_DECL(slow_path_resolve);
+LLINT_SLOW_PATH_DECL(slow_path_resolve_skip);
+LLINT_SLOW_PATH_DECL(slow_path_resolve_global);
+LLINT_SLOW_PATH_DECL(slow_path_resolve_global_dynamic);
+LLINT_SLOW_PATH_DECL(slow_path_resolve_for_resolve_global_dynamic);
+LLINT_SLOW_PATH_DECL(slow_path_resolve_base);
+LLINT_SLOW_PATH_DECL(slow_path_ensure_property_exists);
+LLINT_SLOW_PATH_DECL(slow_path_resolve_with_base);
+LLINT_SLOW_PATH_DECL(slow_path_resolve_with_this);
+LLINT_SLOW_PATH_DECL(slow_path_get_by_id);
+LLINT_SLOW_PATH_DECL(slow_path_get_arguments_length);
+LLINT_SLOW_PATH_DECL(slow_path_put_by_id);
+LLINT_SLOW_PATH_DECL(slow_path_del_by_id);
+LLINT_SLOW_PATH_DECL(slow_path_get_by_val);
+LLINT_SLOW_PATH_DECL(slow_path_get_argument_by_val);
+LLINT_SLOW_PATH_DECL(slow_path_get_by_pname);
+LLINT_SLOW_PATH_DECL(slow_path_put_by_val);
+LLINT_SLOW_PATH_DECL(slow_path_del_by_val);
+LLINT_SLOW_PATH_DECL(slow_path_put_by_index);
+LLINT_SLOW_PATH_DECL(slow_path_put_getter_setter);
+LLINT_SLOW_PATH_DECL(slow_path_jmp_scopes);
+LLINT_SLOW_PATH_DECL(slow_path_jtrue);
+LLINT_SLOW_PATH_DECL(slow_path_jfalse);
+LLINT_SLOW_PATH_DECL(slow_path_jless);
+LLINT_SLOW_PATH_DECL(slow_path_jnless);
+LLINT_SLOW_PATH_DECL(slow_path_jgreater);
+LLINT_SLOW_PATH_DECL(slow_path_jngreater);
+LLINT_SLOW_PATH_DECL(slow_path_jlesseq);
+LLINT_SLOW_PATH_DECL(slow_path_jnlesseq);
+LLINT_SLOW_PATH_DECL(slow_path_jgreatereq);
+LLINT_SLOW_PATH_DECL(slow_path_jngreatereq);
+LLINT_SLOW_PATH_DECL(slow_path_switch_imm);
+LLINT_SLOW_PATH_DECL(slow_path_switch_char);
+LLINT_SLOW_PATH_DECL(slow_path_switch_string);
+LLINT_SLOW_PATH_DECL(slow_path_new_func);
+LLINT_SLOW_PATH_DECL(slow_path_new_func_exp);
+LLINT_SLOW_PATH_DECL(slow_path_call);
+LLINT_SLOW_PATH_DECL(slow_path_construct);
+LLINT_SLOW_PATH_DECL(slow_path_call_varargs);
+LLINT_SLOW_PATH_DECL(slow_path_call_eval);
+LLINT_SLOW_PATH_DECL(slow_path_tear_off_activation);
+LLINT_SLOW_PATH_DECL(slow_path_tear_off_arguments);
+LLINT_SLOW_PATH_DECL(slow_path_strcat);
+LLINT_SLOW_PATH_DECL(slow_path_to_primitive);
+LLINT_SLOW_PATH_DECL(slow_path_get_pnames);
+LLINT_SLOW_PATH_DECL(slow_path_next_pname);
+LLINT_SLOW_PATH_DECL(slow_path_push_scope);
+LLINT_SLOW_PATH_DECL(slow_path_pop_scope);
+LLINT_SLOW_PATH_DECL(slow_path_push_new_scope);
+LLINT_SLOW_PATH_DECL(slow_path_throw);
+LLINT_SLOW_PATH_DECL(slow_path_throw_reference_error);
+LLINT_SLOW_PATH_DECL(slow_path_debug);
+LLINT_SLOW_PATH_DECL(slow_path_profile_will_call);
+LLINT_SLOW_PATH_DECL(slow_path_profile_did_call);
+
+} } // namespace JSC::LLInt
+
+#endif // ENABLE(LLINT)
+
+#endif // LLIntSlowPaths_h
+
diff --git a/Source/JavaScriptCore/llint/LLIntThunks.cpp b/Source/JavaScriptCore/llint/LLIntThunks.cpp
new file mode 100644
index 000000000..ddb0c46c2
--- /dev/null
+++ b/Source/JavaScriptCore/llint/LLIntThunks.cpp
@@ -0,0 +1,81 @@
+/*
+ * Copyright (C) 2012 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "LLIntThunks.h"
+
+#if ENABLE(LLINT)
+
+#include "JSInterfaceJIT.h"
+#include "LinkBuffer.h"
+#include "LowLevelInterpreter.h"
+
+namespace JSC { namespace LLInt {
+
+static MacroAssemblerCodeRef generateThunkWithJumpTo(JSGlobalData* globalData, void (*target)())
+{
+    JSInterfaceJIT jit;
+    
+    // FIXME: there's probably a better way to do it on X86, but I'm not sure I care.
+    jit.move(JSInterfaceJIT::TrustedImmPtr(bitwise_cast<void*>(target)), JSInterfaceJIT::regT0);
+    jit.jump(JSInterfaceJIT::regT0);
+    
+    LinkBuffer patchBuffer(*globalData, &jit, GLOBAL_THUNK_ID);
+    return patchBuffer.finalizeCode();
+}
+
+MacroAssemblerCodeRef functionForCallEntryThunkGenerator(JSGlobalData* globalData)
+{
+    return generateThunkWithJumpTo(globalData, llint_function_for_call_prologue);
+}
+
+MacroAssemblerCodeRef functionForConstructEntryThunkGenerator(JSGlobalData* globalData)
+{
+    return generateThunkWithJumpTo(globalData, llint_function_for_construct_prologue);
+}
+
+MacroAssemblerCodeRef functionForCallArityCheckThunkGenerator(JSGlobalData* globalData)
+{
+    return generateThunkWithJumpTo(globalData, llint_function_for_call_arity_check);
+}
+
+MacroAssemblerCodeRef functionForConstructArityCheckThunkGenerator(JSGlobalData* globalData)
+{
+    return generateThunkWithJumpTo(globalData, llint_function_for_construct_arity_check);
+}
+
+MacroAssemblerCodeRef evalEntryThunkGenerator(JSGlobalData* globalData)
+{
+    return generateThunkWithJumpTo(globalData, llint_eval_prologue);
+}
+
+MacroAssemblerCodeRef programEntryThunkGenerator(JSGlobalData* globalData)
+{
+    return generateThunkWithJumpTo(globalData, llint_program_prologue);
+}
+
+} } // namespace JSC::LLInt
+
+#endif // ENABLE(LLINT)
diff --git a/Source/JavaScriptCore/llint/LLIntThunks.h b/Source/JavaScriptCore/llint/LLIntThunks.h
new file mode 100644
index 000000000..ee119e0b9
--- /dev/null
+++ b/Source/JavaScriptCore/llint/LLIntThunks.h
@@ -0,0 +1,52 @@
+/*
+ * Copyright (C) 2012 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef LLIntThunks_h
+#define LLIntThunks_h
+
+#include <wtf/Platform.h>
+
+#if ENABLE(LLINT)
+
+#include "MacroAssemblerCodeRef.h"
+
+namespace JSC {
+
+class JSGlobalData;
+
+namespace LLInt {
+
+MacroAssemblerCodeRef functionForCallEntryThunkGenerator(JSGlobalData*);
+MacroAssemblerCodeRef functionForConstructEntryThunkGenerator(JSGlobalData*);
+MacroAssemblerCodeRef functionForCallArityCheckThunkGenerator(JSGlobalData*);
+MacroAssemblerCodeRef functionForConstructArityCheckThunkGenerator(JSGlobalData*);
+MacroAssemblerCodeRef evalEntryThunkGenerator(JSGlobalData*);
+MacroAssemblerCodeRef programEntryThunkGenerator(JSGlobalData*);
+
+} } // namespace JSC::LLInt
+
+#endif // ENABLE(LLINT)
+
+#endif // LLIntThunks_h
diff --git a/Source/JavaScriptCore/llint/LowLevelInterpreter.asm b/Source/JavaScriptCore/llint/LowLevelInterpreter.asm
new file mode 100644
index 000000000..a9f83f680
--- /dev/null
+++ b/Source/JavaScriptCore/llint/LowLevelInterpreter.asm
@@ -0,0 +1,2390 @@
+# Copyright (C) 2011, 2012 Apple Inc. All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions
+# are met:
+# 1. Redistributions of source code must retain the above copyright
+#    notice, this list of conditions and the following disclaimer.
+# 2. Redistributions in binary form must reproduce the above copyright
+#    notice, this list of conditions and the following disclaimer in the
+#    documentation and/or other materials provided with the distribution.
+#
+# THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+# THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+# PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+# BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+# CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+# SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+# INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+# CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+# ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+# THE POSSIBILITY OF SUCH DAMAGE.
+
+
+# Crash course on the language that this is written in (which I just call
+# "assembly" even though it's more than that):
+#
+# - Mostly gas-style operand ordering. The last operand tends to be the
+#   destination. So "a := b" is written as "mov b, a". But unlike gas,
+#   comparisons are in-order, so "if (a < b)" is written as
+#   "bilt a, b, ...".
+#
+# - "b" = byte, "h" = 16-bit word, "i" = 32-bit word, "p" = pointer.
+#   Currently this is just 32-bit so "i" and "p" are interchangeable
+#   except when an op supports one but not the other.
+#
+# - In general, valid operands for macro invocations and instructions are
+#   registers (eg "t0"), addresses (eg "4[t0]"), base-index addresses
+#   (eg "7[t0, t1, 2]"), absolute addresses (eg "0xa0000000[]"), or labels
+#   (eg "_foo" or ".foo"). Macro invocations can also take anonymous
+#   macros as operands. Instructions cannot take anonymous macros.
+#
+# - Labels must have names that begin with either "_" or ".".  A "." label
+#   is local and gets renamed before code gen to minimize namespace
+#   pollution. A "_" label is an extern symbol (i.e. ".globl"). The "_"
+#   may or may not be removed during code gen depending on whether the asm
+#   conventions for C name mangling on the target platform mandate a "_"
+#   prefix.
+#
+# - A "macro" is a lambda expression, which may be either anonymous or
+#   named. But this has caveats. "macro" can take zero or more arguments,
+#   which may be macros or any valid operands, but it can only return
+#   code. But you can do Turing-complete things via continuation passing
+#   style: "macro foo (a, b) b(a) end foo(foo, foo)". Actually, don't do
+#   that, since you'll just crash the assembler.
+#
+# - An "if" is a conditional on settings. Any identifier supplied in the
+#   predicate of an "if" is assumed to be a #define that is available
+#   during code gen. So you can't use "if" for computation in a macro, but
+#   you can use it to select different pieces of code for different
+#   platforms.
+#
+# - Arguments to macros follow lexical scoping rather than dynamic scoping.
+#   Const's also follow lexical scoping and may override (hide) arguments
+#   or other consts. All variables (arguments and constants) can be bound
+#   to operands. Additionally, arguments (but not constants) can be bound
+#   to macros.
+
+
+# Below we have a bunch of constant declarations. Each constant must have
+# a corresponding ASSERT() in LLIntData.cpp.
+
+# These declarations must match interpreter/RegisterFile.h.
+const CallFrameHeaderSize = 48
+const ArgumentCount = -48
+const CallerFrame = -40
+const Callee = -32
+const ScopeChain = -24
+const ReturnPC = -16
+const CodeBlock = -8
+
+const ThisArgumentOffset = -CallFrameHeaderSize - 8
+
+# Declare some aliases for the registers we will use.
+const PC = t4
+
+# Offsets needed for reasoning about value representation.
+if BIG_ENDIAN
+    const TagOffset = 0
+    const PayloadOffset = 4
+else
+    const TagOffset = 4
+    const PayloadOffset = 0
+end
+
+# Value representation constants.
+const Int32Tag = -1
+const BooleanTag = -2
+const NullTag = -3
+const UndefinedTag = -4
+const CellTag = -5
+const EmptyValueTag = -6
+const DeletedValueTag = -7
+const LowestTag = DeletedValueTag
+
+# Type constants.
+const StringType = 5
+const ObjectType = 13
+
+# Type flags constants.
+const MasqueradesAsUndefined = 1
+const ImplementsHasInstance = 2
+const ImplementsDefaultHasInstance = 8
+
+# Heap allocation constants.
+const JSFinalObjectSizeClassIndex = 3
+
+# Bytecode operand constants.
+const FirstConstantRegisterIndex = 0x40000000
+
+# Code type constants.
+const GlobalCode = 0
+const EvalCode = 1
+const FunctionCode = 2
+
+# The interpreter steals the tag word of the argument count.
+const LLIntReturnPC = ArgumentCount + TagOffset
+
+# This must match wtf/Vector.h.
+const VectorSizeOffset = 0
+const VectorBufferOffset = 4
+
+# String flags.
+const HashFlags8BitBuffer = 64
+
+# Utilities
+macro crash()
+    storei 0, 0xbbadbeef[]
+    move 0, t0
+    call t0
+end
+
+macro assert(assertion)
+    if ASSERT_ENABLED
+        assertion(.ok)
+        crash()
+    .ok:
+    end
+end
+
+macro preserveReturnAddressAfterCall(destinationRegister)
+    if ARMv7
+        move lr, destinationRegister
+    elsif X86
+        pop destinationRegister
+    else
+        error
+    end
+end
+
+macro restoreReturnAddressBeforeReturn(sourceRegister)
+    if ARMv7
+        move sourceRegister, lr
+    elsif X86
+        push sourceRegister
+    else
+        error
+    end
+end
+
+macro dispatch(advance)
+    addp advance * 4, PC
+    jmp [PC]
+end
+
+macro dispatchBranchWithOffset(pcOffset)
+    lshifti 2, pcOffset
+    addp pcOffset, PC
+    jmp [PC]
+end
+
+macro dispatchBranch(pcOffset)
+    loadi pcOffset, t0
+    dispatchBranchWithOffset(t0)
+end
+
+macro dispatchAfterCall()
+    loadi ArgumentCount + TagOffset[cfr], PC
+    jmp [PC]
+end
+
+macro cCall2(function, arg1, arg2)
+    if ARMv7
+        move arg1, t0
+        move arg2, t1
+    elsif X86
+        poke arg1, 0
+        poke arg2, 1
+    else
+        error
+    end
+    call function
+end
+
+# This barely works. arg3 and arg4 should probably be immediates.
+macro cCall4(function, arg1, arg2, arg3, arg4)
+    if ARMv7
+        move arg1, t0
+        move arg2, t1
+        move arg3, t2
+        move arg4, t3
+    elsif X86
+        poke arg1, 0
+        poke arg2, 1
+        poke arg3, 2
+        poke arg4, 3
+    else
+        error
+    end
+    call function
+end
+
+macro callSlowPath(slow_path)
+    cCall2(slow_path, cfr, PC)
+    move t0, PC
+    move t1, cfr
+end
+
+# Debugging operation if you'd like to print an operand in the instruction stream. fromWhere
+# should be an immediate integer - any integer you like; use it to identify the place you're
+# debugging from. operand should likewise be an immediate, and should identify the operand
+# in the instruction stream you'd like to print out.
+macro traceOperand(fromWhere, operand)
+    cCall4(_llint_trace_operand, cfr, PC, fromWhere, operand)
+    move t0, PC
+    move t1, cfr
+end
+
+# Debugging operation if you'd like to print the value of an operand in the instruction
+# stream. Same as traceOperand(), but assumes that the operand is a register, and prints its
+# value.
+macro traceValue(fromWhere, operand)
+    cCall4(_llint_trace_value, cfr, PC, fromWhere, operand)
+    move t0, PC
+    move t1, cfr
+end
+
+macro traceExecution()
+    if EXECUTION_TRACING
+        callSlowPath(_llint_trace)
+    end
+end
+
+# Call a slow_path for call opcodes.
+macro callCallSlowPath(advance, slow_path, action)
+    addp advance * 4, PC, t0
+    storep t0, ArgumentCount + TagOffset[cfr]
+    cCall2(slow_path, cfr, PC)
+    move t1, cfr
+    action(t0)
+end
+
+macro slowPathForCall(advance, slow_path)
+    callCallSlowPath(
+        advance,
+        slow_path,
+        macro (callee)
+            call callee
+            dispatchAfterCall()
+        end)
+end
+
+macro checkSwitchToJIT(increment, action)
+    if JIT_ENABLED
+        loadp CodeBlock[cfr], t0
+        baddis increment, CodeBlock::m_llintExecuteCounter[t0], .continue
+        action()
+    .continue:
+    end
+end
+
+macro checkSwitchToJITForLoop()
+    checkSwitchToJIT(
+        1,
+        macro ()
+            storei PC, ArgumentCount + TagOffset[cfr]
+            cCall2(_llint_loop_osr, cfr, PC)
+            move t1, cfr
+            btpz t0, .recover
+            jmp t0
+        .recover:
+            loadi ArgumentCount + TagOffset[cfr], PC
+        end)
+end
+
+macro checkSwitchToJITForEpilogue()
+    checkSwitchToJIT(
+        10,
+        macro ()
+            callSlowPath(_llint_replace)
+        end)
+end
+
+macro assertNotConstant(index)
+    assert(macro (ok) bilt index, FirstConstantRegisterIndex, ok end)
+end
+
+# Index, tag, and payload must be different registers. Index is not
+# changed.
+macro loadConstantOrVariable(index, tag, payload)
+    bigteq index, FirstConstantRegisterIndex, .constant
+    loadi TagOffset[cfr, index, 8], tag
+    loadi PayloadOffset[cfr, index, 8], payload
+    jmp .done
+.constant:
+    loadp CodeBlock[cfr], payload
+    loadp CodeBlock::m_constantRegisters + VectorBufferOffset[payload], payload
+    # There is a bit of evil here: if the index contains a value >= FirstConstantRegisterIndex,
+    # then value << 3 will be equal to (value - FirstConstantRegisterIndex) << 3.
+    loadp TagOffset[payload, index, 8], tag
+    loadp PayloadOffset[payload, index, 8], payload
+.done:
+end
+
+# Index and payload may be the same register. Index may be clobbered.
+macro loadConstantOrVariable2Reg(index, tag, payload)
+    bigteq index, FirstConstantRegisterIndex, .constant
+    loadi TagOffset[cfr, index, 8], tag
+    loadi PayloadOffset[cfr, index, 8], payload
+    jmp .done
+.constant:
+    loadp CodeBlock[cfr], tag
+    loadp CodeBlock::m_constantRegisters + VectorBufferOffset[tag], tag
+    # There is a bit of evil here: if the index contains a value >= FirstConstantRegisterIndex,
+    # then value << 3 will be equal to (value - FirstConstantRegisterIndex) << 3.
+    lshifti 3, index
+    addp index, tag
+    loadp PayloadOffset[tag], payload
+    loadp TagOffset[tag], tag
+.done:
+end
+
+macro loadConstantOrVariablePayloadTagCustom(index, tagCheck, payload)
+    bigteq index, FirstConstantRegisterIndex, .constant
+    tagCheck(TagOffset[cfr, index, 8])
+    loadi PayloadOffset[cfr, index, 8], payload
+    jmp .done
+.constant:
+    loadp CodeBlock[cfr], payload
+    loadp CodeBlock::m_constantRegisters + VectorBufferOffset[payload], payload
+    # There is a bit of evil here: if the index contains a value >= FirstConstantRegisterIndex,
+    # then value << 3 will be equal to (value - FirstConstantRegisterIndex) << 3.
+    tagCheck(TagOffset[payload, index, 8])
+    loadp PayloadOffset[payload, index, 8], payload
+.done:
+end
+
+# Index and payload must be different registers. Index is not mutated. Use
+# this if you know what the tag of the variable should be. Doing the tag
+# test as part of loading the variable reduces register use, but may not
+# be faster than doing loadConstantOrVariable followed by a branch on the
+# tag.
+macro loadConstantOrVariablePayload(index, expectedTag, payload, slow)
+    loadConstantOrVariablePayloadTagCustom(
+        index,
+        macro (actualTag) bineq actualTag, expectedTag, slow end,
+        payload)
+end
+
+macro loadConstantOrVariablePayloadUnchecked(index, payload)
+    loadConstantOrVariablePayloadTagCustom(
+        index,
+        macro (actualTag) end,
+        payload)
+end
+
+macro writeBarrier(tag, payload)
+    # Nothing to do, since we don't have a generational or incremental collector.
+end
+
+macro valueProfile(tag, payload, profile)
+    if JIT_ENABLED
+        storei tag, ValueProfile::m_buckets + TagOffset[profile]
+        storei payload, ValueProfile::m_buckets + PayloadOffset[profile]
+    end
+end
+
+
+# Indicate the beginning of LLInt.
+_llint_begin:
+    crash()
+
+
+# Entrypoints into the interpreter
+
+macro functionForCallCodeBlockGetter(targetRegister)
+    loadp Callee[cfr], targetRegister
+    loadp JSFunction::m_executable[targetRegister], targetRegister
+    loadp FunctionExecutable::m_codeBlockForCall[targetRegister], targetRegister
+end
+
+macro functionForConstructCodeBlockGetter(targetRegister)
+    loadp Callee[cfr], targetRegister
+    loadp JSFunction::m_executable[targetRegister], targetRegister
+    loadp FunctionExecutable::m_codeBlockForConstruct[targetRegister], targetRegister
+end
+
+macro notFunctionCodeBlockGetter(targetRegister)
+    loadp CodeBlock[cfr], targetRegister
+end
+
+macro functionCodeBlockSetter(sourceRegister)
+    storep sourceRegister, CodeBlock[cfr]
+end
+
+macro notFunctionCodeBlockSetter(sourceRegister)
+    # Nothing to do!
+end
+
+# Do the bare minimum required to execute code. Sets up the PC, leave the CodeBlock*
+# in t1. May also trigger prologue entry OSR.
+macro prologue(codeBlockGetter, codeBlockSetter, osrSlowPath, traceSlowPath)
+    preserveReturnAddressAfterCall(t2)
+    
+    # Set up the call frame and check if we should OSR.
+    storep t2, ReturnPC[cfr]
+    if EXECUTION_TRACING
+        callSlowPath(traceSlowPath)
+    end
+    codeBlockGetter(t1)
+    if JIT_ENABLED
+        baddis 5, CodeBlock::m_llintExecuteCounter[t1], .continue
+        cCall2(osrSlowPath, cfr, PC)
+        move t1, cfr
+        btpz t0, .recover
+        loadp ReturnPC[cfr], t2
+        restoreReturnAddressBeforeReturn(t2)
+        jmp t0
+    .recover:
+        codeBlockGetter(t1)
+    .continue:
+    end
+    codeBlockSetter(t1)
+    
+    # Set up the PC.
+    loadp CodeBlock::m_instructions[t1], t0
+    loadp CodeBlock::Instructions::m_instructions + VectorBufferOffset[t0], PC
+end
+
+# Expects that CodeBlock is in t1, which is what prologue() leaves behind.
+# Must call dispatch(0) after calling this.
+macro functionInitialization(profileArgSkip)
+    if JIT_ENABLED
+        # Profile the arguments. Unfortunately, we have no choice but to do this. This
+        # code is pretty horrendous because of the difference in ordering between
+        # arguments and value profiles, the desire to have a simple loop-down-to-zero
+        # loop, and the desire to use only three registers so as to preserve the PC and
+        # the code block. It is likely that this code should be rewritten in a more
+        # optimal way for architectures that have more than five registers available
+        # for arbitrary use in the interpreter.
+        loadi CodeBlock::m_numParameters[t1], t0
+        addi -profileArgSkip, t0 # Use addi because that's what has the peephole
+        assert(macro (ok) bigteq t0, 0, ok end)
+        btiz t0, .argumentProfileDone
+        loadp CodeBlock::m_argumentValueProfiles + VectorBufferOffset[t1], t3
+        muli sizeof ValueProfile, t0, t2 # Aaaaahhhh! Need strength reduction!
+        negi t0
+        lshifti 3, t0
+        addp t2, t3
+    .argumentProfileLoop:
+        loadi ThisArgumentOffset + TagOffset + 8 - profileArgSkip * 8[cfr, t0], t2
+        subp sizeof ValueProfile, t3
+        storei t2, profileArgSkip * sizeof ValueProfile + ValueProfile::m_buckets + TagOffset[t3]
+        loadi ThisArgumentOffset + PayloadOffset + 8 - profileArgSkip * 8[cfr, t0], t2
+        storei t2, profileArgSkip * sizeof ValueProfile + ValueProfile::m_buckets + PayloadOffset[t3]
+        baddinz 8, t0, .argumentProfileLoop
+    .argumentProfileDone:
+    end
+        
+    # Check stack height.
+    loadi CodeBlock::m_numCalleeRegisters[t1], t0
+    loadp CodeBlock::m_globalData[t1], t2
+    loadp JSGlobalData::interpreter[t2], t2   # FIXME: Can get to the RegisterFile from the JITStackFrame
+    lshifti 3, t0
+    addp t0, cfr, t0
+    bpaeq Interpreter::m_registerFile + RegisterFile::m_end[t2], t0, .stackHeightOK
+
+    # Stack height check failed - need to call a slow_path.
+    callSlowPath(_llint_register_file_check)
+.stackHeightOK:
+end
+
+# Expects that CodeBlock is in t1, which is what prologue() leaves behind.
+macro functionArityCheck(doneLabel, slow_path)
+    loadi PayloadOffset + ArgumentCount[cfr], t0
+    biaeq t0, CodeBlock::m_numParameters[t1], doneLabel
+    cCall2(slow_path, cfr, PC)   # This slow_path has a simple protocol: t0 = 0 => no error, t0 != 0 => error
+    move t1, cfr
+    btiz t0, .continue
+    loadp JITStackFrame::globalData[sp], t1
+    loadp JSGlobalData::callFrameForThrow[t1], t0
+    jmp JSGlobalData::targetMachinePCForThrow[t1]
+.continue:
+    # Reload CodeBlock and PC, since the slow_path clobbered it.
+    loadp CodeBlock[cfr], t1
+    loadp CodeBlock::m_instructions[t1], t0
+    loadp CodeBlock::Instructions::m_instructions + VectorBufferOffset[t0], PC
+    jmp doneLabel
+end
+
+_llint_program_prologue:
+    prologue(notFunctionCodeBlockGetter, notFunctionCodeBlockSetter, _llint_entry_osr, _llint_trace_prologue)
+    dispatch(0)
+
+
+_llint_eval_prologue:
+    prologue(notFunctionCodeBlockGetter, notFunctionCodeBlockSetter, _llint_entry_osr, _llint_trace_prologue)
+    dispatch(0)
+
+
+_llint_function_for_call_prologue:
+    prologue(functionForCallCodeBlockGetter, functionCodeBlockSetter, _llint_entry_osr_function_for_call, _llint_trace_prologue_function_for_call)
+.functionForCallBegin:
+    functionInitialization(0)
+    dispatch(0)
+    
+
+_llint_function_for_construct_prologue:
+    prologue(functionForConstructCodeBlockGetter, functionCodeBlockSetter, _llint_entry_osr_function_for_construct, _llint_trace_prologue_function_for_construct)
+.functionForConstructBegin:
+    functionInitialization(1)
+    dispatch(0)
+    
+
+_llint_function_for_call_arity_check:
+    prologue(functionForCallCodeBlockGetter, functionCodeBlockSetter, _llint_entry_osr_function_for_call_arityCheck, _llint_trace_arityCheck_for_call)
+    functionArityCheck(.functionForCallBegin, _llint_slow_path_call_arityCheck)
+
+
+_llint_function_for_construct_arity_check:
+    prologue(functionForConstructCodeBlockGetter, functionCodeBlockSetter, _llint_entry_osr_function_for_construct_arityCheck, _llint_trace_arityCheck_for_construct)
+    functionArityCheck(.functionForConstructBegin, _llint_slow_path_construct_arityCheck)
+
+# Instruction implementations
+
+_llint_op_enter:
+    traceExecution()
+    loadp CodeBlock[cfr], t2
+    loadi CodeBlock::m_numVars[t2], t2
+    btiz t2, .opEnterDone
+    move UndefinedTag, t0
+    move 0, t1
+.opEnterLoop:
+    subi 1, t2
+    storei t0, TagOffset[cfr, t2, 8]
+    storei t1, PayloadOffset[cfr, t2, 8]
+    btinz t2, .opEnterLoop
+.opEnterDone:
+    dispatch(1)
+
+
+_llint_op_create_activation:
+    traceExecution()
+    loadi 4[PC], t0
+    bineq TagOffset[cfr, t0, 8], EmptyValueTag, .opCreateActivationDone
+    callSlowPath(_llint_slow_path_create_activation)
+.opCreateActivationDone:
+    dispatch(2)
+
+
+_llint_op_init_lazy_reg:
+    traceExecution()
+    loadi 4[PC], t0
+    storei EmptyValueTag, TagOffset[cfr, t0, 8]
+    storei 0, PayloadOffset[cfr, t0, 8]
+    dispatch(2)
+
+
+_llint_op_create_arguments:
+    traceExecution()
+    loadi 4[PC], t0
+    bineq TagOffset[cfr, t0, 8], EmptyValueTag, .opCreateArgumentsDone
+    callSlowPath(_llint_slow_path_create_arguments)
+.opCreateArgumentsDone:
+    dispatch(2)
+
+
+macro allocateBasicJSObject(sizeClassIndex, classInfoOffset, structure, result, scratch1, scratch2, slowCase)
+    if ALWAYS_ALLOCATE_SLOW
+        jmp slowCase
+    else
+        const offsetOfMySizeClass =
+            JSGlobalData::heap +
+            Heap::m_objectSpace +
+            MarkedSpace::m_normalSpace +
+            MarkedSpace::Subspace::preciseAllocators +
+            sizeClassIndex * sizeof MarkedAllocator
+        
+        # FIXME: we can get the global data in one load from the stack.
+        loadp CodeBlock[cfr], scratch1
+        loadp CodeBlock::m_globalData[scratch1], scratch1
+        
+        # Get the object from the free list.    
+        loadp offsetOfMySizeClass + MarkedAllocator::m_firstFreeCell[scratch1], result
+        btpz result, slowCase
+        
+        # Remove the object from the free list.
+        loadp [result], scratch2
+        storep scratch2, offsetOfMySizeClass + MarkedAllocator::m_firstFreeCell[scratch1]
+    
+        # Initialize the object.
+        loadp classInfoOffset[scratch1], scratch2
+        storep scratch2, [result]
+        storep structure, JSCell::m_structure[result]
+        storep 0, JSObject::m_inheritorID[result]
+        addp sizeof JSObject, result, scratch1
+        storep scratch1, JSObject::m_propertyStorage[result]
+    end
+end
+
+_llint_op_create_this:
+    traceExecution()
+    loadi 8[PC], t0
+    assertNotConstant(t0)
+    bineq TagOffset[cfr, t0, 8], CellTag, .opCreateThisSlow
+    loadi PayloadOffset[cfr, t0, 8], t0
+    loadp JSCell::m_structure[t0], t1
+    bbb Structure::m_typeInfo + TypeInfo::m_type[t1], ObjectType, .opCreateThisSlow
+    loadp JSObject::m_inheritorID[t0], t2
+    btpz t2, .opCreateThisSlow
+    allocateBasicJSObject(JSFinalObjectSizeClassIndex, JSGlobalData::jsFinalObjectClassInfo, t2, t0, t1, t3, .opCreateThisSlow)
+    loadi 4[PC], t1
+    storei CellTag, TagOffset[cfr, t1, 8]
+    storei t0, PayloadOffset[cfr, t1, 8]
+    dispatch(3)
+
+.opCreateThisSlow:
+    callSlowPath(_llint_slow_path_create_this)
+    dispatch(3)
+
+
+_llint_op_get_callee:
+    traceExecution()
+    loadi 4[PC], t0
+    loadp PayloadOffset + Callee[cfr], t1
+    storei CellTag, TagOffset[cfr, t0, 8]
+    storei t1, PayloadOffset[cfr, t0, 8]
+    dispatch(2)
+
+
+_llint_op_convert_this:
+    traceExecution()
+    loadi 4[PC], t0
+    bineq TagOffset[cfr, t0, 8], CellTag, .opConvertThisSlow
+    loadi PayloadOffset[cfr, t0, 8], t0
+    loadp JSCell::m_structure[t0], t0
+    bbb Structure::m_typeInfo + TypeInfo::m_type[t0], ObjectType, .opConvertThisSlow
+    dispatch(2)
+
+.opConvertThisSlow:
+    callSlowPath(_llint_slow_path_convert_this)
+    dispatch(2)
+
+
+_llint_op_new_object:
+    traceExecution()
+    loadp CodeBlock[cfr], t0
+    loadp CodeBlock::m_globalObject[t0], t0
+    loadp JSGlobalObject::m_emptyObjectStructure[t0], t1
+    allocateBasicJSObject(JSFinalObjectSizeClassIndex, JSGlobalData::jsFinalObjectClassInfo, t1, t0, t2, t3, .opNewObjectSlow)
+    loadi 4[PC], t1
+    storei CellTag, TagOffset[cfr, t1, 8]
+    storei t0, PayloadOffset[cfr, t1, 8]
+    dispatch(2)
+
+.opNewObjectSlow:
+    callSlowPath(_llint_slow_path_new_object)
+    dispatch(2)
+
+
+_llint_op_new_array:
+    traceExecution()
+    callSlowPath(_llint_slow_path_new_array)
+    dispatch(4)
+
+
+_llint_op_new_array_buffer:
+    traceExecution()
+    callSlowPath(_llint_slow_path_new_array_buffer)
+    dispatch(4)
+
+
+_llint_op_new_regexp:
+    traceExecution()
+    callSlowPath(_llint_slow_path_new_regexp)
+    dispatch(3)
+
+
+_llint_op_mov:
+    traceExecution()
+    loadi 8[PC], t1
+    loadi 4[PC], t0
+    loadConstantOrVariable(t1, t2, t3)
+    storei t2, TagOffset[cfr, t0, 8]
+    storei t3, PayloadOffset[cfr, t0, 8]
+    dispatch(3)
+
+
+_llint_op_not:
+    traceExecution()
+    loadi 8[PC], t0
+    loadi 4[PC], t1
+    loadConstantOrVariable(t0, t2, t3)
+    bineq t2, BooleanTag, .opNotSlow
+    xori 1, t3
+    storei t2, TagOffset[cfr, t1, 8]
+    storei t3, PayloadOffset[cfr, t1, 8]
+    dispatch(3)
+
+.opNotSlow:
+    callSlowPath(_llint_slow_path_not)
+    dispatch(3)
+
+
+_llint_op_eq:
+    traceExecution()
+    loadi 12[PC], t2
+    loadi 8[PC], t0
+    loadConstantOrVariable(t2, t3, t1)
+    loadConstantOrVariable2Reg(t0, t2, t0)
+    bineq t2, t3, .opEqSlow
+    bieq t2, CellTag, .opEqSlow
+    bib t2, LowestTag, .opEqSlow
+    loadi 4[PC], t2
+    cieq t0, t1, t0
+    storei BooleanTag, TagOffset[cfr, t2, 8]
+    storei t0, PayloadOffset[cfr, t2, 8]
+    dispatch(4)
+
+.opEqSlow:
+    callSlowPath(_llint_slow_path_eq)
+    dispatch(4)
+
+
+_llint_op_eq_null:
+    traceExecution()
+    loadi 8[PC], t0
+    loadi 4[PC], t3
+    assertNotConstant(t0)
+    loadi TagOffset[cfr, t0, 8], t1
+    loadi PayloadOffset[cfr, t0, 8], t0
+    bineq t1, CellTag, .opEqNullImmediate
+    loadp JSCell::m_structure[t0], t1
+    tbnz Structure::m_typeInfo + TypeInfo::m_flags[t1], MasqueradesAsUndefined, t1
+    jmp .opEqNullNotImmediate
+.opEqNullImmediate:
+    cieq t1, NullTag, t2
+    cieq t1, UndefinedTag, t1
+    ori t2, t1
+.opEqNullNotImmediate:
+    storei BooleanTag, TagOffset[cfr, t3, 8]
+    storei t1, PayloadOffset[cfr, t3, 8]
+    dispatch(3)
+
+
+_llint_op_neq:
+    traceExecution()
+    loadi 12[PC], t2
+    loadi 8[PC], t0
+    loadConstantOrVariable(t2, t3, t1)
+    loadConstantOrVariable2Reg(t0, t2, t0)
+    bineq t2, t3, .opNeqSlow
+    bieq t2, CellTag, .opNeqSlow
+    bib t2, LowestTag, .opNeqSlow
+    loadi 4[PC], t2
+    cineq t0, t1, t0
+    storei BooleanTag, TagOffset[cfr, t2, 8]
+    storei t0, PayloadOffset[cfr, t2, 8]
+    dispatch(4)
+
+.opNeqSlow:
+    callSlowPath(_llint_slow_path_neq)
+    dispatch(4)
+    
+
+_llint_op_neq_null:
+    traceExecution()
+    loadi 8[PC], t0
+    loadi 4[PC], t3
+    assertNotConstant(t0)
+    loadi TagOffset[cfr, t0, 8], t1
+    loadi PayloadOffset[cfr, t0, 8], t0
+    bineq t1, CellTag, .opNeqNullImmediate
+    loadp JSCell::m_structure[t0], t1
+    tbz Structure::m_typeInfo + TypeInfo::m_flags[t1], MasqueradesAsUndefined, t1
+    jmp .opNeqNullNotImmediate
+.opNeqNullImmediate:
+    cineq t1, NullTag, t2
+    cineq t1, UndefinedTag, t1
+    andi t2, t1
+.opNeqNullNotImmediate:
+    storei BooleanTag, TagOffset[cfr, t3, 8]
+    storei t1, PayloadOffset[cfr, t3, 8]
+    dispatch(3)
+
+
+macro strictEq(equalityOperation, slow_path)
+    loadi 12[PC], t2
+    loadi 8[PC], t0
+    loadConstantOrVariable(t2, t3, t1)
+    loadConstantOrVariable2Reg(t0, t2, t0)
+    bineq t2, t3, .slow
+    bib t2, LowestTag, .slow
+    bineq t2, CellTag, .notString
+    loadp JSCell::m_structure[t0], t2
+    loadp JSCell::m_structure[t1], t3
+    bbneq Structure::m_typeInfo + TypeInfo::m_type[t2], StringType, .notString
+    bbeq Structure::m_typeInfo + TypeInfo::m_type[t3], StringType, .slow
+.notString:
+    loadi 4[PC], t2
+    equalityOperation(t0, t1, t0)
+    storei BooleanTag, TagOffset[cfr, t2, 8]
+    storei t0, PayloadOffset[cfr, t2, 8]
+    dispatch(4)
+
+.slow:
+    callSlowPath(slow_path)
+    dispatch(4)
+end
+
+_llint_op_stricteq:
+    traceExecution()
+    strictEq(macro (left, right, result) cieq left, right, result end, _llint_slow_path_stricteq)
+
+
+_llint_op_nstricteq:
+    traceExecution()
+    strictEq(macro (left, right, result) cineq left, right, result end, _llint_slow_path_nstricteq)
+
+
+_llint_op_less:
+    traceExecution()
+    callSlowPath(_llint_slow_path_less)
+    dispatch(4)
+
+
+_llint_op_lesseq:
+    traceExecution()
+    callSlowPath(_llint_slow_path_lesseq)
+    dispatch(4)
+
+
+_llint_op_greater:
+    traceExecution()
+    callSlowPath(_llint_slow_path_greater)
+    dispatch(4)
+
+
+_llint_op_greatereq:
+    traceExecution()
+    callSlowPath(_llint_slow_path_greatereq)
+    dispatch(4)
+
+
+_llint_op_pre_inc:
+    traceExecution()
+    loadi 4[PC], t0
+    bineq TagOffset[cfr, t0, 8], Int32Tag, .opPreIncSlow
+    loadi PayloadOffset[cfr, t0, 8], t1
+    baddio 1, t1, .opPreIncSlow
+    storei t1, PayloadOffset[cfr, t0, 8]
+    dispatch(2)
+
+.opPreIncSlow:
+    callSlowPath(_llint_slow_path_pre_inc)
+    dispatch(2)
+
+
+_llint_op_pre_dec:
+    traceExecution()
+    loadi 4[PC], t0
+    bineq TagOffset[cfr, t0, 8], Int32Tag, .opPreDecSlow
+    loadi PayloadOffset[cfr, t0, 8], t1
+    bsubio 1, t1, .opPreDecSlow
+    storei t1, PayloadOffset[cfr, t0, 8]
+    dispatch(2)
+
+.opPreDecSlow:
+    callSlowPath(_llint_slow_path_pre_dec)
+    dispatch(2)
+
+
+_llint_op_post_inc:
+    traceExecution()
+    loadi 8[PC], t0
+    loadi 4[PC], t1
+    bineq TagOffset[cfr, t0, 8], Int32Tag, .opPostIncSlow
+    bieq t0, t1, .opPostIncDone
+    loadi PayloadOffset[cfr, t0, 8], t2
+    move t2, t3
+    baddio 1, t3, .opPostIncSlow
+    storei Int32Tag, TagOffset[cfr, t1, 8]
+    storei t2, PayloadOffset[cfr, t1, 8]
+    storei t3, PayloadOffset[cfr, t0, 8]
+.opPostIncDone:
+    dispatch(3)
+
+.opPostIncSlow:
+    callSlowPath(_llint_slow_path_post_inc)
+    dispatch(3)
+
+
+_llint_op_post_dec:
+    traceExecution()
+    loadi 8[PC], t0
+    loadi 4[PC], t1
+    bineq TagOffset[cfr, t0, 8], Int32Tag, .opPostDecSlow
+    bieq t0, t1, .opPostDecDone
+    loadi PayloadOffset[cfr, t0, 8], t2
+    move t2, t3
+    bsubio 1, t3, .opPostDecSlow
+    storei Int32Tag, TagOffset[cfr, t1, 8]
+    storei t2, PayloadOffset[cfr, t1, 8]
+    storei t3, PayloadOffset[cfr, t0, 8]
+.opPostDecDone:
+    dispatch(3)
+
+.opPostDecSlow:
+    callSlowPath(_llint_slow_path_post_dec)
+    dispatch(3)
+
+
+_llint_op_to_jsnumber:
+    traceExecution()
+    loadi 8[PC], t0
+    loadi 4[PC], t1
+    loadConstantOrVariable(t0, t2, t3)
+    bieq t2, Int32Tag, .opToJsnumberIsInt
+    biaeq t2, EmptyValueTag, .opToJsnumberSlow
+.opToJsnumberIsInt:
+    storei t2, TagOffset[cfr, t1, 8]
+    storei t3, PayloadOffset[cfr, t1, 8]
+    dispatch(3)
+
+.opToJsnumberSlow:
+    callSlowPath(_llint_slow_path_to_jsnumber)
+    dispatch(3)
+
+
+_llint_op_negate:
+    traceExecution()
+    loadi 8[PC], t0
+    loadi 4[PC], t3
+    loadConstantOrVariable(t0, t1, t2)
+    bineq t1, Int32Tag, .opNegateSrcNotInt
+    btiz t2, 0x7fffffff, .opNegateSlow
+    negi t2
+    storei Int32Tag, TagOffset[cfr, t3, 8]
+    storei t2, PayloadOffset[cfr, t3, 8]
+    dispatch(3)
+.opNegateSrcNotInt:
+    bia t1, LowestTag, .opNegateSlow
+    xori 0x80000000, t1
+    storei t1, TagOffset[cfr, t3, 8]
+    storei t2, PayloadOffset[cfr, t3, 8]
+    dispatch(3)
+
+.opNegateSlow:
+    callSlowPath(_llint_slow_path_negate)
+    dispatch(3)
+
+
+macro binaryOpCustomStore(integerOperationAndStore, doubleOperation, slow_path)
+    loadi 12[PC], t2
+    loadi 8[PC], t0
+    loadConstantOrVariable(t2, t3, t1)
+    loadConstantOrVariable2Reg(t0, t2, t0)
+    bineq t2, Int32Tag, .op1NotInt
+    bineq t3, Int32Tag, .op2NotInt
+    loadi 4[PC], t2
+    integerOperationAndStore(t3, t1, t0, .slow, t2)
+    dispatch(5)
+
+.op1NotInt:
+    # First operand is definitely not an int, the second operand could be anything.
+    bia t2, LowestTag, .slow
+    bib t3, LowestTag, .op1NotIntOp2Double
+    bineq t3, Int32Tag, .slow
+    ci2d t1, ft1
+    jmp .op1NotIntReady
+.op1NotIntOp2Double:
+    fii2d t1, t3, ft1
+.op1NotIntReady:
+    loadi 4[PC], t1
+    fii2d t0, t2, ft0
+    doubleOperation(ft1, ft0)
+    stored ft0, [cfr, t1, 8]
+    dispatch(5)
+
+.op2NotInt:
+    # First operand is definitely an int, the second operand is definitely not.
+    loadi 4[PC], t2
+    bia t3, LowestTag, .slow
+    ci2d t0, ft0
+    fii2d t1, t3, ft1
+    doubleOperation(ft1, ft0)
+    stored ft0, [cfr, t2, 8]
+    dispatch(5)
+
+.slow:
+    callSlowPath(slow_path)
+    dispatch(5)
+end
+
+macro binaryOp(integerOperation, doubleOperation, slow_path)
+    binaryOpCustomStore(
+        macro (int32Tag, left, right, slow, index)
+            integerOperation(left, right, slow)
+            storei int32Tag, TagOffset[cfr, index, 8]
+            storei right, PayloadOffset[cfr, index, 8]
+        end,
+        doubleOperation, slow_path)
+end
+
+_llint_op_add:
+    traceExecution()
+    binaryOp(
+        macro (left, right, slow) baddio left, right, slow end,
+        macro (left, right) addd left, right end,
+        _llint_slow_path_add)
+
+
+_llint_op_mul:
+    traceExecution()
+    binaryOpCustomStore(
+        macro (int32Tag, left, right, slow, index)
+            const scratch = int32Tag   # We know that we can reuse the int32Tag register since it has a constant.
+            move right, scratch
+            bmulio left, scratch, slow
+            btinz scratch, .done
+            bilt left, 0, slow
+            bilt right, 0, slow
+        .done:
+            storei Int32Tag, TagOffset[cfr, index, 8]
+            storei scratch, PayloadOffset[cfr, index, 8]
+        end,
+        macro (left, right) muld left, right end,
+        _llint_slow_path_mul)
+
+
+_llint_op_sub:
+    traceExecution()
+    binaryOp(
+        macro (left, right, slow) bsubio left, right, slow end,
+        macro (left, right) subd left, right end,
+        _llint_slow_path_sub)
+
+
+_llint_op_div:
+    traceExecution()
+    binaryOpCustomStore(
+        macro (int32Tag, left, right, slow, index)
+            ci2d left, ft0
+            ci2d right, ft1
+            divd ft0, ft1
+            bcd2i ft1, right, .notInt
+            storei int32Tag, TagOffset[cfr, index, 8]
+            storei right, PayloadOffset[cfr, index, 8]
+            jmp .done
+        .notInt:
+            stored ft1, [cfr, index, 8]
+        .done:
+        end,
+        macro (left, right) divd left, right end,
+        _llint_slow_path_div)
+
+
+_llint_op_mod:
+    traceExecution()
+    callSlowPath(_llint_slow_path_mod)
+    dispatch(4)
+
+
+macro bitOp(operation, slow_path, advance)
+    loadi 12[PC], t2
+    loadi 8[PC], t0
+    loadConstantOrVariable(t2, t3, t1)
+    loadConstantOrVariable2Reg(t0, t2, t0)
+    bineq t3, Int32Tag, .slow
+    bineq t2, Int32Tag, .slow
+    loadi 4[PC], t2
+    operation(t1, t0, .slow)
+    storei t3, TagOffset[cfr, t2, 8]
+    storei t0, PayloadOffset[cfr, t2, 8]
+    dispatch(advance)
+
+.slow:
+    callSlowPath(slow_path)
+    dispatch(advance)
+end
+
+_llint_op_lshift:
+    traceExecution()
+    bitOp(
+        macro (left, right, slow) lshifti left, right end,
+        _llint_slow_path_lshift,
+        4)
+
+
+_llint_op_rshift:
+    traceExecution()
+    bitOp(
+        macro (left, right, slow) rshifti left, right end,
+        _llint_slow_path_rshift,
+        4)
+
+
+_llint_op_urshift:
+    traceExecution()
+    bitOp(
+        macro (left, right, slow)
+            urshifti left, right
+            bilt right, 0, slow
+        end,
+        _llint_slow_path_urshift,
+        4)
+
+
+_llint_op_bitand:
+    traceExecution()
+    bitOp(
+        macro (left, right, slow) andi left, right end,
+        _llint_slow_path_bitand,
+        5)
+
+
+_llint_op_bitxor:
+    traceExecution()
+    bitOp(
+        macro (left, right, slow) xori left, right end,
+        _llint_slow_path_bitxor,
+        5)
+
+
+_llint_op_bitor:
+    traceExecution()
+    bitOp(
+        macro (left, right, slow) ori left, right end,
+        _llint_slow_path_bitor,
+        5)
+
+
+_llint_op_bitnot:
+    traceExecution()
+    loadi 8[PC], t1
+    loadi 4[PC], t0
+    loadConstantOrVariable(t1, t2, t3)
+    bineq t2, Int32Tag, .opBitnotSlow
+    noti t3
+    storei t2, TagOffset[cfr, t0, 8]
+    storei t3, PayloadOffset[cfr, t0, 8]
+    dispatch(3)
+
+.opBitnotSlow:
+    callSlowPath(_llint_slow_path_bitnot)
+    dispatch(3)
+
+
+_llint_op_check_has_instance:
+    traceExecution()
+    loadi 4[PC], t1
+    loadConstantOrVariablePayload(t1, CellTag, t0, .opCheckHasInstanceSlow)
+    loadp JSCell::m_structure[t0], t0
+    btbz Structure::m_typeInfo + TypeInfo::m_flags[t0], ImplementsHasInstance, .opCheckHasInstanceSlow
+    dispatch(2)
+
+.opCheckHasInstanceSlow:
+    callSlowPath(_llint_slow_path_check_has_instance)
+    dispatch(2)
+
+
+_llint_op_instanceof:
+    traceExecution()
+    # Check that baseVal implements the default HasInstance behavior.
+    # FIXME: This should be deprecated.
+    loadi 12[PC], t1
+    loadConstantOrVariablePayloadUnchecked(t1, t0)
+    loadp JSCell::m_structure[t0], t0
+    btbz Structure::m_typeInfo + TypeInfo::m_flags[t0], ImplementsDefaultHasInstance, .opInstanceofSlow
+    
+    # Actually do the work.
+    loadi 16[PC], t0
+    loadi 4[PC], t3
+    loadConstantOrVariablePayload(t0, CellTag, t1, .opInstanceofSlow)
+    loadp JSCell::m_structure[t1], t2
+    bbb Structure::m_typeInfo + TypeInfo::m_type[t2], ObjectType, .opInstanceofSlow
+    loadi 8[PC], t0
+    loadConstantOrVariablePayload(t0, CellTag, t2, .opInstanceofSlow)
+    
+    # Register state: t1 = prototype, t2 = value
+    move 1, t0
+.opInstanceofLoop:
+    loadp JSCell::m_structure[t2], t2
+    loadi Structure::m_prototype + PayloadOffset[t2], t2
+    bpeq t2, t1, .opInstanceofDone
+    btinz t2, .opInstanceofLoop
+
+    move 0, t0
+.opInstanceofDone:
+    storei BooleanTag, TagOffset[cfr, t3, 8]
+    storei t0, PayloadOffset[cfr, t3, 8]
+    dispatch(5)
+
+.opInstanceofSlow:
+    callSlowPath(_llint_slow_path_instanceof)
+    dispatch(5)
+
+
+_llint_op_typeof:
+    traceExecution()
+    callSlowPath(_llint_slow_path_typeof)
+    dispatch(3)
+
+
+_llint_op_is_undefined:
+    traceExecution()
+    callSlowPath(_llint_slow_path_is_undefined)
+    dispatch(3)
+
+
+_llint_op_is_boolean:
+    traceExecution()
+    callSlowPath(_llint_slow_path_is_boolean)
+    dispatch(3)
+
+
+_llint_op_is_number:
+    traceExecution()
+    callSlowPath(_llint_slow_path_is_number)
+    dispatch(3)
+
+
+_llint_op_is_string:
+    traceExecution()
+    callSlowPath(_llint_slow_path_is_string)
+    dispatch(3)
+
+
+_llint_op_is_object:
+    traceExecution()
+    callSlowPath(_llint_slow_path_is_object)
+    dispatch(3)
+
+
+_llint_op_is_function:
+    traceExecution()
+    callSlowPath(_llint_slow_path_is_function)
+    dispatch(3)
+
+
+_llint_op_in:
+    traceExecution()
+    callSlowPath(_llint_slow_path_in)
+    dispatch(4)
+
+
+_llint_op_resolve:
+    traceExecution()
+    callSlowPath(_llint_slow_path_resolve)
+    dispatch(4)
+
+
+_llint_op_resolve_skip:
+    traceExecution()
+    callSlowPath(_llint_slow_path_resolve_skip)
+    dispatch(5)
+
+
+macro resolveGlobal(size, slow)
+    # Operands are as follows:
+    # 4[PC]   Destination for the load.
+    # 8[PC]   Property identifier index in the code block.
+    # 12[PC]  Structure pointer, initialized to 0 by bytecode generator.
+    # 16[PC]  Offset in global object, initialized to 0 by bytecode generator.
+    loadp CodeBlock[cfr], t0
+    loadp CodeBlock::m_globalObject[t0], t0
+    loadp JSCell::m_structure[t0], t1
+    bpneq t1, 12[PC], slow
+    loadi 16[PC], t1
+    loadp JSObject::m_propertyStorage[t0], t0
+    loadi TagOffset[t0, t1, 8], t2
+    loadi PayloadOffset[t0, t1, 8], t3
+    loadi 4[PC], t0
+    storei t2, TagOffset[cfr, t0, 8]
+    storei t3, PayloadOffset[cfr, t0, 8]
+    loadi (size - 1) * 4[PC], t0
+    valueProfile(t2, t3, t0)
+end
+
+_llint_op_resolve_global:
+    traceExecution()
+    resolveGlobal(6, .opResolveGlobalSlow)
+    dispatch(6)
+
+.opResolveGlobalSlow:
+    callSlowPath(_llint_slow_path_resolve_global)
+    dispatch(6)
+
+
+# Gives you the scope in t0, while allowing you to optionally perform additional checks on the
+# scopes as they are traversed. scopeCheck() is called with two arguments: the register
+# holding the scope, and a register that can be used for scratch. Note that this does not
+# use t3, so you can hold stuff in t3 if need be.
+macro getScope(deBruijinIndexOperand, scopeCheck)
+    loadp ScopeChain + PayloadOffset[cfr], t0
+    loadi deBruijinIndexOperand, t2
+    
+    btiz t2, .done
+    
+    loadp CodeBlock[cfr], t1
+    bineq CodeBlock::m_codeType[t1], FunctionCode, .loop
+    btbz CodeBlock::m_needsFullScopeChain[t1], .loop
+    
+    loadi CodeBlock::m_activationRegister[t1], t1
+
+    # Need to conditionally skip over one scope.
+    bieq TagOffset[cfr, t1, 8], EmptyValueTag, .noActivation
+    scopeCheck(t0, t1)
+    loadp ScopeChainNode::next[t0], t0
+.noActivation:
+    subi 1, t2
+    
+    btiz t2, .done
+.loop:
+    scopeCheck(t0, t1)
+    loadp ScopeChainNode::next[t0], t0
+    subi 1, t2
+    btinz t2, .loop
+
+.done:
+end
+
+_llint_op_resolve_global_dynamic:
+    traceExecution()
+    loadp JITStackFrame::globalData[sp], t3
+    loadp JSGlobalData::activationStructure[t3], t3
+    getScope(
+        20[PC],
+        macro (scope, scratch)
+            loadp ScopeChainNode::object[scope], scratch
+            bpneq JSCell::m_structure[scratch], t3, .opResolveGlobalDynamicSuperSlow
+        end)
+    resolveGlobal(7, .opResolveGlobalDynamicSlow)
+    dispatch(7)
+
+.opResolveGlobalDynamicSuperSlow:
+    callSlowPath(_llint_slow_path_resolve_for_resolve_global_dynamic)
+    dispatch(7)
+
+.opResolveGlobalDynamicSlow:
+    callSlowPath(_llint_slow_path_resolve_global_dynamic)
+    dispatch(7)
+
+
+_llint_op_get_scoped_var:
+    traceExecution()
+    # Operands are as follows:
+    # 4[PC]   Destination for the load.
+    # 8[PC]   Index of register in the scope.
+    # 12[PC]  De Bruijin index.
+    getScope(12[PC], macro (scope, scratch) end)
+    loadi 4[PC], t1
+    loadi 8[PC], t2
+    loadp ScopeChainNode::object[t0], t0
+    loadp JSVariableObject::m_registers[t0], t0
+    loadi TagOffset[t0, t2, 8], t3
+    loadi PayloadOffset[t0, t2, 8], t0
+    storei t3, TagOffset[cfr, t1, 8]
+    storei t0, PayloadOffset[cfr, t1, 8]
+    loadi 16[PC], t1
+    valueProfile(t3, t0, t1)
+    dispatch(5)
+
+
+_llint_op_put_scoped_var:
+    traceExecution()
+    getScope(8[PC], macro (scope, scratch) end)
+    loadi 12[PC], t1
+    loadConstantOrVariable(t1, t3, t2)
+    loadi 4[PC], t1
+    writeBarrier(t3, t2)
+    loadp ScopeChainNode::object[t0], t0
+    loadp JSVariableObject::m_registers[t0], t0
+    storei t3, TagOffset[t0, t1, 8]
+    storei t2, PayloadOffset[t0, t1, 8]
+    dispatch(4)
+
+
+_llint_op_get_global_var:
+    traceExecution()
+    loadi 8[PC], t1
+    loadi 4[PC], t3
+    loadp CodeBlock[cfr], t0
+    loadp CodeBlock::m_globalObject[t0], t0
+    loadp JSGlobalObject::m_registers[t0], t0
+    loadi TagOffset[t0, t1, 8], t2
+    loadi PayloadOffset[t0, t1, 8], t1
+    storei t2, TagOffset[cfr, t3, 8]
+    storei t1, PayloadOffset[cfr, t3, 8]
+    loadi 12[PC], t3
+    valueProfile(t2, t1, t3)
+    dispatch(4)
+
+
+_llint_op_put_global_var:
+    traceExecution()
+    loadi 8[PC], t1
+    loadp CodeBlock[cfr], t0
+    loadp CodeBlock::m_globalObject[t0], t0
+    loadp JSGlobalObject::m_registers[t0], t0
+    loadConstantOrVariable(t1, t2, t3)
+    loadi 4[PC], t1
+    writeBarrier(t2, t3)
+    storei t2, TagOffset[t0, t1, 8]
+    storei t3, PayloadOffset[t0, t1, 8]
+    dispatch(3)
+
+
+_llint_op_resolve_base:
+    traceExecution()
+    callSlowPath(_llint_slow_path_resolve_base)
+    dispatch(5)
+
+
+_llint_op_ensure_property_exists:
+    traceExecution()
+    callSlowPath(_llint_slow_path_ensure_property_exists)
+    dispatch(3)
+
+
+_llint_op_resolve_with_base:
+    traceExecution()
+    callSlowPath(_llint_slow_path_resolve_with_base)
+    dispatch(5)
+
+
+_llint_op_resolve_with_this:
+    traceExecution()
+    callSlowPath(_llint_slow_path_resolve_with_this)
+    dispatch(5)
+
+
+_llint_op_get_by_id:
+    traceExecution()
+    # We only do monomorphic get_by_id caching for now, and we do not modify the
+    # opcode. We do, however, allow for the cache to change anytime if fails, since
+    # ping-ponging is free. At best we get lucky and the get_by_id will continue
+    # to take fast path on the new cache. At worst we take slow path, which is what
+    # we would have been doing anyway.
+    loadi 8[PC], t0
+    loadi 16[PC], t1
+    loadConstantOrVariablePayload(t0, CellTag, t3, .opGetByIdSlow)
+    loadi 20[PC], t2
+    loadp JSObject::m_propertyStorage[t3], t0
+    bpneq JSCell::m_structure[t3], t1, .opGetByIdSlow
+    loadi 4[PC], t1
+    loadi TagOffset[t0, t2], t3
+    loadi PayloadOffset[t0, t2], t2
+    storei t3, TagOffset[cfr, t1, 8]
+    storei t2, PayloadOffset[cfr, t1, 8]
+    loadi 32[PC], t1
+    valueProfile(t3, t2, t1)
+    dispatch(9)
+
+.opGetByIdSlow:
+    callSlowPath(_llint_slow_path_get_by_id)
+    dispatch(9)
+
+
+_llint_op_get_arguments_length:
+    traceExecution()
+    loadi 8[PC], t0
+    loadi 4[PC], t1
+    bineq TagOffset[cfr, t0, 8], EmptyValueTag, .opGetArgumentsLengthSlow
+    loadi ArgumentCount + PayloadOffset[cfr], t2
+    subi 1, t2
+    storei Int32Tag, TagOffset[cfr, t1, 8]
+    storei t2, PayloadOffset[cfr, t1, 8]
+    dispatch(4)
+
+.opGetArgumentsLengthSlow:
+    callSlowPath(_llint_slow_path_get_arguments_length)
+    dispatch(4)
+
+
+_llint_op_put_by_id:
+    traceExecution()
+    loadi 4[PC], t3
+    loadi 16[PC], t1
+    loadConstantOrVariablePayload(t3, CellTag, t0, .opPutByIdSlow)
+    loadi 12[PC], t2
+    loadp JSObject::m_propertyStorage[t0], t3
+    bpneq JSCell::m_structure[t0], t1, .opPutByIdSlow
+    loadi 20[PC], t1
+    loadConstantOrVariable2Reg(t2, t0, t2)
+    writeBarrier(t0, t2)
+    storei t0, TagOffset[t3, t1]
+    storei t2, PayloadOffset[t3, t1]
+    dispatch(9)
+
+.opPutByIdSlow:
+    callSlowPath(_llint_slow_path_put_by_id)
+    dispatch(9)
+
+
+macro putByIdTransition(additionalChecks)
+    traceExecution()
+    loadi 4[PC], t3
+    loadi 16[PC], t1
+    loadConstantOrVariablePayload(t3, CellTag, t0, .opPutByIdSlow)
+    loadi 12[PC], t2
+    bpneq JSCell::m_structure[t0], t1, .opPutByIdSlow
+    additionalChecks(t1, t3, .opPutByIdSlow)
+    loadi 20[PC], t1
+    loadp JSObject::m_propertyStorage[t0], t3
+    addp t1, t3
+    loadConstantOrVariable2Reg(t2, t1, t2)
+    writeBarrier(t1, t2)
+    storei t1, TagOffset[t3]
+    loadi 24[PC], t1
+    storei t2, PayloadOffset[t3]
+    storep t1, JSCell::m_structure[t0]
+    dispatch(9)
+end
+
+_llint_op_put_by_id_transition_direct:
+    putByIdTransition(macro (oldStructure, scratch, slow) end)
+
+
+_llint_op_put_by_id_transition_normal:
+    putByIdTransition(
+        macro (oldStructure, scratch, slow)
+            const protoCell = oldStructure   # Reusing the oldStructure register for the proto
+        
+            loadp 28[PC], scratch
+            assert(macro (ok) btpnz scratch, ok end)
+            loadp StructureChain::m_vector[scratch], scratch
+            assert(macro (ok) btpnz scratch, ok end)
+            bieq Structure::m_prototype + TagOffset[oldStructure], NullTag, .done
+        .loop:
+            loadi Structure::m_prototype + PayloadOffset[oldStructure], protoCell
+            loadp JSCell::m_structure[protoCell], oldStructure
+            bpneq oldStructure, [scratch], slow
+            addp 4, scratch
+            bineq Structure::m_prototype + TagOffset[oldStructure], NullTag, .loop
+        .done:
+        end)
+
+
+_llint_op_del_by_id:
+    traceExecution()
+    callSlowPath(_llint_slow_path_del_by_id)
+    dispatch(4)
+
+
+_llint_op_get_by_val:
+    traceExecution()
+    loadp CodeBlock[cfr], t1
+    loadi 8[PC], t2
+    loadi 12[PC], t3
+    loadp CodeBlock::m_globalData[t1], t1
+    loadConstantOrVariablePayload(t2, CellTag, t0, .opGetByValSlow)
+    loadp JSGlobalData::jsArrayClassInfo[t1], t2
+    loadConstantOrVariablePayload(t3, Int32Tag, t1, .opGetByValSlow)
+    bpneq [t0], t2, .opGetByValSlow
+    loadp JSArray::m_storage[t0], t3
+    biaeq t1, JSArray::m_vectorLength[t0], .opGetByValSlow
+    loadi 4[PC], t0
+    loadi ArrayStorage::m_vector + TagOffset[t3, t1, 8], t2
+    loadi ArrayStorage::m_vector + PayloadOffset[t3, t1, 8], t1
+    bieq t2, EmptyValueTag, .opGetByValSlow
+    storei t2, TagOffset[cfr, t0, 8]
+    storei t1, PayloadOffset[cfr, t0, 8]
+    loadi 16[PC], t0
+    valueProfile(t2, t1, t0)
+    dispatch(5)
+
+.opGetByValSlow:
+    callSlowPath(_llint_slow_path_get_by_val)
+    dispatch(5)
+
+
+_llint_op_get_argument_by_val:
+    traceExecution()
+    loadi 8[PC], t0
+    loadi 12[PC], t1
+    bineq TagOffset[cfr, t0, 8], EmptyValueTag, .opGetArgumentByValSlow
+    loadConstantOrVariablePayload(t1, Int32Tag, t2, .opGetArgumentByValSlow)
+    addi 1, t2
+    loadi ArgumentCount + PayloadOffset[cfr], t1
+    biaeq t2, t1, .opGetArgumentByValSlow
+    negi t2
+    loadi 4[PC], t3
+    loadi ThisArgumentOffset + TagOffset[cfr, t2, 8], t0
+    loadi ThisArgumentOffset + PayloadOffset[cfr, t2, 8], t1
+    storei t0, TagOffset[cfr, t3, 8]
+    storei t1, PayloadOffset[cfr, t3, 8]
+    dispatch(5)
+
+.opGetArgumentByValSlow:
+    callSlowPath(_llint_slow_path_get_argument_by_val)
+    dispatch(5)
+
+
+_llint_op_get_by_pname:
+    traceExecution()
+    loadi 12[PC], t0
+    loadConstantOrVariablePayload(t0, CellTag, t1, .opGetByPnameSlow)
+    loadi 16[PC], t0
+    bpneq t1, PayloadOffset[cfr, t0, 8], .opGetByPnameSlow
+    loadi 8[PC], t0
+    loadConstantOrVariablePayload(t0, CellTag, t2, .opGetByPnameSlow)
+    loadi 20[PC], t0
+    loadi PayloadOffset[cfr, t0, 8], t3
+    loadp JSCell::m_structure[t2], t0
+    bpneq t0, JSPropertyNameIterator::m_cachedStructure[t3], .opGetByPnameSlow
+    loadi 24[PC], t0
+    loadi [cfr, t0, 8], t0
+    subi 1, t0
+    biaeq t0, JSPropertyNameIterator::m_numCacheableSlots[t3], .opGetByPnameSlow
+    loadp JSObject::m_propertyStorage[t2], t2
+    loadi TagOffset[t2, t0, 8], t1
+    loadi PayloadOffset[t2, t0, 8], t3
+    loadi 4[PC], t0
+    storei t1, TagOffset[cfr, t0, 8]
+    storei t3, PayloadOffset[cfr, t0, 8]
+    dispatch(7)
+
+.opGetByPnameSlow:
+    callSlowPath(_llint_slow_path_get_by_pname)
+    dispatch(7)
+
+
+_llint_op_put_by_val:
+    traceExecution()
+    loadi 4[PC], t0
+    loadConstantOrVariablePayload(t0, CellTag, t1, .opPutByValSlow)
+    loadi 8[PC], t0
+    loadConstantOrVariablePayload(t0, Int32Tag, t2, .opPutByValSlow)
+    loadp CodeBlock[cfr], t0
+    loadp CodeBlock::m_globalData[t0], t0
+    loadp JSGlobalData::jsArrayClassInfo[t0], t0
+    bpneq [t1], t0, .opPutByValSlow
+    biaeq t2, JSArray::m_vectorLength[t1], .opPutByValSlow
+    loadp JSArray::m_storage[t1], t0
+    bieq ArrayStorage::m_vector + TagOffset[t0, t2, 8], EmptyValueTag, .opPutByValEmpty
+.opPutByValStoreResult:
+    loadi 12[PC], t3
+    loadConstantOrVariable2Reg(t3, t1, t3)
+    writeBarrier(t1, t3)
+    storei t1, ArrayStorage::m_vector + TagOffset[t0, t2, 8]
+    storei t3, ArrayStorage::m_vector + PayloadOffset[t0, t2, 8]
+    dispatch(4)
+
+.opPutByValEmpty:
+    addi 1, ArrayStorage::m_numValuesInVector[t0]
+    bib t2, ArrayStorage::m_length[t0], .opPutByValStoreResult
+    addi 1, t2, t1
+    storei t1, ArrayStorage::m_length[t0]
+    jmp .opPutByValStoreResult
+
+.opPutByValSlow:
+    callSlowPath(_llint_slow_path_put_by_val)
+    dispatch(4)
+
+
+_llint_op_del_by_val:
+    traceExecution()
+    callSlowPath(_llint_slow_path_del_by_val)
+    dispatch(4)
+
+
+_llint_op_put_by_index:
+    traceExecution()
+    callSlowPath(_llint_slow_path_put_by_index)
+    dispatch(4)
+
+
+_llint_op_put_getter_setter:
+    traceExecution()
+    callSlowPath(_llint_slow_path_put_getter_setter)
+    dispatch(5)
+
+
+_llint_op_loop:
+    nop
+_llint_op_jmp:
+    traceExecution()
+    dispatchBranch(4[PC])
+
+
+_llint_op_jmp_scopes:
+    traceExecution()
+    callSlowPath(_llint_slow_path_jmp_scopes)
+    dispatch(0)
+
+
+macro jumpTrueOrFalse(conditionOp, slow)
+    loadi 4[PC], t1
+    loadConstantOrVariablePayload(t1, BooleanTag, t0, .slow)
+    conditionOp(t0, .target)
+    dispatch(3)
+
+.target:
+    dispatchBranch(8[PC])
+
+.slow:
+    callSlowPath(slow)
+    dispatch(0)
+end
+
+_llint_op_loop_if_true:
+    nop
+_llint_op_jtrue:
+    traceExecution()
+    jumpTrueOrFalse(
+        macro (value, target) btinz value, target end,
+        _llint_slow_path_jtrue)
+
+
+_llint_op_loop_if_false:
+    nop
+_llint_op_jfalse:
+    traceExecution()
+    jumpTrueOrFalse(
+        macro (value, target) btiz value, target end,
+        _llint_slow_path_jfalse)
+
+
+macro equalNull(cellHandler, immediateHandler)
+    loadi 4[PC], t0
+    loadi TagOffset[cfr, t0, 8], t1
+    loadi PayloadOffset[cfr, t0, 8], t0
+    bineq t1, CellTag, .immediate
+    loadp JSCell::m_structure[t0], t2
+    cellHandler(Structure::m_typeInfo + TypeInfo::m_flags[t2], .target)
+    dispatch(3)
+
+.target:
+    dispatchBranch(8[PC])
+
+.immediate:
+    ori 1, t1
+    immediateHandler(t1, .target)
+    dispatch(3)
+end
+
+_llint_op_jeq_null:
+    traceExecution()
+    equalNull(
+        macro (value, target) btbnz value, MasqueradesAsUndefined, target end,
+        macro (value, target) bieq value, NullTag, target end)
+    
+
+_llint_op_jneq_null:
+    traceExecution()
+    equalNull(
+        macro (value, target) btbz value, MasqueradesAsUndefined, target end,
+        macro (value, target) bineq value, NullTag, target end)
+
+
+_llint_op_jneq_ptr:
+    traceExecution()
+    loadi 4[PC], t0
+    loadi 8[PC], t1
+    bineq TagOffset[cfr, t0, 8], CellTag, .opJneqPtrBranch
+    bpeq PayloadOffset[cfr, t0, 8], t1, .opJneqPtrFallThrough
+.opJneqPtrBranch:
+    dispatchBranch(12[PC])
+.opJneqPtrFallThrough:
+    dispatch(4)
+
+
+macro compare(integerCompare, doubleCompare, slow_path)
+    loadi 4[PC], t2
+    loadi 8[PC], t3
+    loadConstantOrVariable(t2, t0, t1)
+    loadConstantOrVariable2Reg(t3, t2, t3)
+    bineq t0, Int32Tag, .op1NotInt
+    bineq t2, Int32Tag, .op2NotInt
+    integerCompare(t1, t3, .jumpTarget)
+    dispatch(4)
+
+.op1NotInt:
+    bia t0, LowestTag, .slow
+    bib t2, LowestTag, .op1NotIntOp2Double
+    bineq t2, Int32Tag, .slow
+    ci2d t3, ft1
+    jmp .op1NotIntReady
+.op1NotIntOp2Double:
+    fii2d t3, t2, ft1
+.op1NotIntReady:
+    fii2d t1, t0, ft0
+    doubleCompare(ft0, ft1, .jumpTarget)
+    dispatch(4)
+
+.op2NotInt:
+    ci2d t1, ft0
+    bia t2, LowestTag, .slow
+    fii2d t3, t2, ft1
+    doubleCompare(ft0, ft1, .jumpTarget)
+    dispatch(4)
+
+.jumpTarget:
+    dispatchBranch(12[PC])
+
+.slow:
+    callSlowPath(slow_path)
+    dispatch(0)
+end
+
+_llint_op_loop_if_less:
+    nop
+_llint_op_jless:
+    traceExecution()
+    compare(
+        macro (left, right, target) bilt left, right, target end,
+        macro (left, right, target) bdlt left, right, target end,
+        _llint_slow_path_jless)
+
+
+_llint_op_jnless:
+    traceExecution()
+    compare(
+        macro (left, right, target) bigteq left, right, target end,
+        macro (left, right, target) bdgtequn left, right, target end,
+        _llint_slow_path_jnless)
+
+
+_llint_op_loop_if_greater:
+    nop
+_llint_op_jgreater:
+    traceExecution()
+    compare(
+        macro (left, right, target) bigt left, right, target end,
+        macro (left, right, target) bdgt left, right, target end,
+        _llint_slow_path_jgreater)
+
+
+_llint_op_jngreater:
+    traceExecution()
+    compare(
+        macro (left, right, target) bilteq left, right, target end,
+        macro (left, right, target) bdltequn left, right, target end,
+        _llint_slow_path_jngreater)
+
+
+_llint_op_loop_if_lesseq:
+    nop
+_llint_op_jlesseq:
+    traceExecution()
+    compare(
+        macro (left, right, target) bilteq left, right, target end,
+        macro (left, right, target) bdlteq left, right, target end,
+        _llint_slow_path_jlesseq)
+
+
+_llint_op_jnlesseq:
+    traceExecution()
+    compare(
+        macro (left, right, target) bigt left, right, target end,
+        macro (left, right, target) bdgtun left, right, target end,
+        _llint_slow_path_jnlesseq)
+
+
+_llint_op_loop_if_greatereq:
+    nop
+_llint_op_jgreatereq:
+    traceExecution()
+    compare(
+        macro (left, right, target) bigteq left, right, target end,
+        macro (left, right, target) bdgteq left, right, target end,
+        _llint_slow_path_jgreatereq)
+
+
+_llint_op_jngreatereq:
+    traceExecution()
+    compare(
+        macro (left, right, target) bilt left, right, target end,
+        macro (left, right, target) bdltun left, right, target end,
+        _llint_slow_path_jngreatereq)
+
+
+_llint_op_loop_hint:
+    traceExecution()
+    checkSwitchToJITForLoop()
+    dispatch(1)
+
+
+_llint_op_switch_imm:
+    traceExecution()
+    loadi 12[PC], t2
+    loadi 4[PC], t3
+    loadConstantOrVariable(t2, t1, t0)
+    loadp CodeBlock[cfr], t2
+    loadp CodeBlock::m_rareData[t2], t2
+    muli sizeof SimpleJumpTable, t3   # FIXME: would be nice to peephole this!
+    loadp CodeBlock::RareData::m_immediateSwitchJumpTables + VectorBufferOffset[t2], t2
+    addp t3, t2
+    bineq t1, Int32Tag, .opSwitchImmNotInt
+    subi SimpleJumpTable::min[t2], t0
+    biaeq t0, SimpleJumpTable::branchOffsets + VectorSizeOffset[t2], .opSwitchImmFallThrough
+    loadp SimpleJumpTable::branchOffsets + VectorBufferOffset[t2], t3
+    loadi [t3, t0, 4], t1
+    btiz t1, .opSwitchImmFallThrough
+    dispatchBranchWithOffset(t1)
+
+.opSwitchImmNotInt:
+    bib t1, LowestTag, .opSwitchImmSlow  # Go to slow path if it's a double.
+.opSwitchImmFallThrough:
+    dispatchBranch(8[PC])
+
+.opSwitchImmSlow:
+    callSlowPath(_llint_slow_path_switch_imm)
+    dispatch(0)
+
+
+_llint_op_switch_char:
+    traceExecution()
+    loadi 12[PC], t2
+    loadi 4[PC], t3
+    loadConstantOrVariable(t2, t1, t0)
+    loadp CodeBlock[cfr], t2
+    loadp CodeBlock::m_rareData[t2], t2
+    muli sizeof SimpleJumpTable, t3
+    loadp CodeBlock::RareData::m_characterSwitchJumpTables + VectorBufferOffset[t2], t2
+    addp t3, t2
+    bineq t1, CellTag, .opSwitchCharFallThrough
+    loadp JSCell::m_structure[t0], t1
+    bbneq Structure::m_typeInfo + TypeInfo::m_type[t1], StringType, .opSwitchCharFallThrough
+    loadp JSString::m_value[t0], t0
+    bineq StringImpl::m_length[t0], 1, .opSwitchCharFallThrough
+    loadp StringImpl::m_data8[t0], t1
+    btinz StringImpl::m_hashAndFlags[t0], HashFlags8BitBuffer, .opSwitchChar8Bit
+    loadh [t1], t0
+    jmp .opSwitchCharReady
+.opSwitchChar8Bit:
+    loadb [t1], t0
+.opSwitchCharReady:
+    subi SimpleJumpTable::min[t2], t0
+    biaeq t0, SimpleJumpTable::branchOffsets + VectorSizeOffset[t2], .opSwitchCharFallThrough
+    loadp SimpleJumpTable::branchOffsets + VectorBufferOffset[t2], t2
+    loadi [t2, t0, 4], t1
+    btiz t1, .opSwitchImmFallThrough
+    dispatchBranchWithOffset(t1)
+
+.opSwitchCharFallThrough:
+    dispatchBranch(8[PC])
+
+
+_llint_op_switch_string:
+    traceExecution()
+    callSlowPath(_llint_slow_path_switch_string)
+    dispatch(0)
+
+
+_llint_op_new_func:
+    traceExecution()
+    btiz 12[PC], .opNewFuncUnchecked
+    loadi 4[PC], t1
+    bineq TagOffset[cfr, t1, 8], EmptyValueTag, .opNewFuncDone
+.opNewFuncUnchecked:
+    callSlowPath(_llint_slow_path_new_func)
+.opNewFuncDone:
+    dispatch(4)
+
+
+_llint_op_new_func_exp:
+    traceExecution()
+    callSlowPath(_llint_slow_path_new_func_exp)
+    dispatch(3)
+
+
+macro doCall(slow_path)
+    loadi 4[PC], t0
+    loadi 16[PC], t1
+    loadp LLIntCallLinkInfo::callee[t1], t2
+    loadConstantOrVariablePayload(t0, CellTag, t3, .opCallSlow)
+    bineq t3, t2, .opCallSlow
+    loadi 12[PC], t3
+    addp 24, PC
+    lshifti 3, t3
+    addp cfr, t3  # t3 contains the new value of cfr
+    loadp JSFunction::m_scopeChain[t2], t0
+    storei t2, Callee + PayloadOffset[t3]
+    storei t0, ScopeChain + PayloadOffset[t3]
+    loadi 8 - 24[PC], t2
+    storei PC, ArgumentCount + TagOffset[cfr]
+    storep cfr, CallerFrame[t3]
+    storei t2, ArgumentCount + PayloadOffset[t3]
+    storei CellTag, Callee + TagOffset[t3]
+    storei CellTag, ScopeChain + TagOffset[t3]
+    move t3, cfr
+    call LLIntCallLinkInfo::machineCodeTarget[t1]
+    dispatchAfterCall()
+
+.opCallSlow:
+    slowPathForCall(6, slow_path)
+end
+
+_llint_op_call:
+    traceExecution()
+    doCall(_llint_slow_path_call)
+
+
+_llint_op_construct:
+    traceExecution()
+    doCall(_llint_slow_path_construct)
+
+
+_llint_op_call_varargs:
+    traceExecution()
+    slowPathForCall(6, _llint_slow_path_call_varargs)
+
+
+_llint_op_call_eval:
+    traceExecution()
+    
+    # Eval is executed in one of two modes:
+    #
+    # 1) We find that we're really invoking eval() in which case the
+    #    execution is perfomed entirely inside the slow_path, and it
+    #    returns the PC of a function that just returns the return value
+    #    that the eval returned.
+    #
+    # 2) We find that we're invoking something called eval() that is not
+    #    the real eval. Then the slow_path returns the PC of the thing to
+    #    call, and we call it.
+    #
+    # This allows us to handle two cases, which would require a total of
+    # up to four pieces of state that cannot be easily packed into two
+    # registers (C functions can return up to two registers, easily):
+    #
+    # - The call frame register. This may or may not have been modified
+    #   by the slow_path, but the convention is that it returns it. It's not
+    #   totally clear if that's necessary, since the cfr is callee save.
+    #   But that's our style in this here interpreter so we stick with it.
+    #
+    # - A bit to say if the slow_path successfully executed the eval and has
+    #   the return value, or did not execute the eval but has a PC for us
+    #   to call.
+    #
+    # - Either:
+    #   - The JS return value (two registers), or
+    #
+    #   - The PC to call.
+    #
+    # It turns out to be easier to just always have this return the cfr
+    # and a PC to call, and that PC may be a dummy thunk that just
+    # returns the JS value that the eval returned.
+    
+    slowPathForCall(4, _llint_slow_path_call_eval)
+
+
+_llint_generic_return_point:
+    dispatchAfterCall()
+
+
+_llint_op_tear_off_activation:
+    traceExecution()
+    loadi 4[PC], t0
+    loadi 8[PC], t1
+    bineq TagOffset[cfr, t0, 8], EmptyValueTag, .opTearOffActivationCreated
+    bieq TagOffset[cfr, t1, 8], EmptyValueTag, .opTearOffActivationNotCreated
+.opTearOffActivationCreated:
+    callSlowPath(_llint_slow_path_tear_off_activation)
+.opTearOffActivationNotCreated:
+    dispatch(3)
+
+
+_llint_op_tear_off_arguments:
+    traceExecution()
+    loadi 4[PC], t0
+    subi 1, t0   # Get the unmodifiedArgumentsRegister
+    bieq TagOffset[cfr, t0, 8], EmptyValueTag, .opTearOffArgumentsNotCreated
+    callSlowPath(_llint_slow_path_tear_off_arguments)
+.opTearOffArgumentsNotCreated:
+    dispatch(2)
+
+
+macro doReturn()
+    loadp ReturnPC[cfr], t2
+    loadp CallerFrame[cfr], cfr
+    restoreReturnAddressBeforeReturn(t2)
+    ret
+end
+
+_llint_op_ret:
+    traceExecution()
+    checkSwitchToJITForEpilogue()
+    loadi 4[PC], t2
+    loadConstantOrVariable(t2, t1, t0)
+    doReturn()
+
+
+_llint_op_call_put_result:
+    loadi 4[PC], t2
+    loadi 8[PC], t3
+    storei t1, TagOffset[cfr, t2, 8]
+    storei t0, PayloadOffset[cfr, t2, 8]
+    valueProfile(t1, t0, t3)
+    traceExecution() # Needs to be here because it would clobber t1, t0
+    dispatch(3)
+
+
+_llint_op_ret_object_or_this:
+    traceExecution()
+    checkSwitchToJITForEpilogue()
+    loadi 4[PC], t2
+    loadConstantOrVariable(t2, t1, t0)
+    bineq t1, CellTag, .opRetObjectOrThisNotObject
+    loadp JSCell::m_structure[t0], t2
+    bbb Structure::m_typeInfo + TypeInfo::m_type[t2], ObjectType, .opRetObjectOrThisNotObject
+    doReturn()
+
+.opRetObjectOrThisNotObject:
+    loadi 8[PC], t2
+    loadConstantOrVariable(t2, t1, t0)
+    doReturn()
+
+
+_llint_op_method_check:
+    traceExecution()
+    # We ignore method checks and use normal get_by_id optimizations.
+    dispatch(1)
+
+
+_llint_op_strcat:
+    traceExecution()
+    callSlowPath(_llint_slow_path_strcat)
+    dispatch(4)
+
+
+_llint_op_to_primitive:
+    traceExecution()
+    loadi 8[PC], t2
+    loadi 4[PC], t3
+    loadConstantOrVariable(t2, t1, t0)
+    bineq t1, CellTag, .opToPrimitiveIsImm
+    loadp JSCell::m_structure[t0], t2
+    bbneq Structure::m_typeInfo + TypeInfo::m_type[t2], StringType, .opToPrimitiveSlowCase
+.opToPrimitiveIsImm:
+    storei t1, TagOffset[cfr, t3, 8]
+    storei t0, PayloadOffset[cfr, t3, 8]
+    dispatch(3)
+
+.opToPrimitiveSlowCase:
+    callSlowPath(_llint_slow_path_to_primitive)
+    dispatch(3)
+
+
+_llint_op_get_pnames:
+    traceExecution()
+    callSlowPath(_llint_slow_path_get_pnames)
+    dispatch(0) # The slow_path either advances the PC or jumps us to somewhere else.
+
+
+_llint_op_next_pname:
+    traceExecution()
+    loadi 12[PC], t1
+    loadi 16[PC], t2
+    loadi PayloadOffset[cfr, t1, 8], t0
+    bieq t0, PayloadOffset[cfr, t2, 8], .opNextPnameEnd
+    loadi 20[PC], t2
+    loadi PayloadOffset[cfr, t2, 8], t2
+    loadp JSPropertyNameIterator::m_jsStrings[t2], t3
+    loadi [t3, t0, 8], t3
+    addi 1, t0
+    storei t0, PayloadOffset[cfr, t1, 8]
+    loadi 4[PC], t1
+    storei CellTag, TagOffset[cfr, t1, 8]
+    storei t3, PayloadOffset[cfr, t1, 8]
+    loadi 8[PC], t3
+    loadi PayloadOffset[cfr, t3, 8], t3
+    loadp JSCell::m_structure[t3], t1
+    bpneq t1, JSPropertyNameIterator::m_cachedStructure[t2], .opNextPnameSlow
+    loadp JSPropertyNameIterator::m_cachedPrototypeChain[t2], t0
+    loadp StructureChain::m_vector[t0], t0
+    btpz [t0], .opNextPnameTarget
+.opNextPnameCheckPrototypeLoop:
+    bieq Structure::m_prototype + TagOffset[t1], NullTag, .opNextPnameSlow
+    loadp Structure::m_prototype + PayloadOffset[t1], t2
+    loadp JSCell::m_structure[t2], t1
+    bpneq t1, [t0], .opNextPnameSlow
+    addp 4, t0
+    btpnz [t0], .opNextPnameCheckPrototypeLoop
+.opNextPnameTarget:
+    dispatchBranch(24[PC])
+
+.opNextPnameEnd:
+    dispatch(7)
+
+.opNextPnameSlow:
+    callSlowPath(_llint_slow_path_next_pname) # This either keeps the PC where it was (causing us to loop) or sets it to target.
+    dispatch(0)
+
+
+_llint_op_push_scope:
+    traceExecution()
+    callSlowPath(_llint_slow_path_push_scope)
+    dispatch(2)
+
+
+_llint_op_pop_scope:
+    traceExecution()
+    callSlowPath(_llint_slow_path_pop_scope)
+    dispatch(1)
+
+
+_llint_op_push_new_scope:
+    traceExecution()
+    callSlowPath(_llint_slow_path_push_new_scope)
+    dispatch(4)
+
+
+_llint_op_catch:
+    # This is where we end up from the JIT's throw trampoline (because the
+    # machine code return address will be set to _llint_op_catch), and from
+    # the interpreter's throw trampoline (see _llint_throw_trampoline).
+    # The JIT throwing protocol calls for the cfr to be in t0. The throwing
+    # code must have known that we were throwing to the interpreter, and have
+    # set JSGlobalData::targetInterpreterPCForThrow.
+    move t0, cfr
+    loadp JITStackFrame::globalData[sp], t3
+    loadi JSGlobalData::targetInterpreterPCForThrow[t3], PC
+    loadi JSGlobalData::exception + PayloadOffset[t3], t0
+    loadi JSGlobalData::exception + TagOffset[t3], t1
+    storei 0, JSGlobalData::exception + PayloadOffset[t3]
+    storei EmptyValueTag, JSGlobalData::exception + TagOffset[t3]       
+    loadi 4[PC], t2
+    storei t0, PayloadOffset[cfr, t2, 8]
+    storei t1, TagOffset[cfr, t2, 8]
+    traceExecution()  # This needs to be here because we don't want to clobber t0, t1, t2, t3 above.
+    dispatch(2)
+
+
+_llint_op_throw:
+    traceExecution()
+    callSlowPath(_llint_slow_path_throw)
+    dispatch(2)
+
+
+_llint_op_throw_reference_error:
+    traceExecution()
+    callSlowPath(_llint_slow_path_throw_reference_error)
+    dispatch(2)
+
+
+_llint_op_jsr:
+    traceExecution()
+    loadi 4[PC], t0
+    addi 3 * 4, PC, t1
+    storei t1, [cfr, t0, 8]
+    dispatchBranch(8[PC])
+
+
+_llint_op_sret:
+    traceExecution()
+    loadi 4[PC], t0
+    loadp [cfr, t0, 8], PC
+    dispatch(0)
+
+
+_llint_op_debug:
+    traceExecution()
+    callSlowPath(_llint_slow_path_debug)
+    dispatch(4)
+
+
+_llint_op_profile_will_call:
+    traceExecution()
+    loadp JITStackFrame::enabledProfilerReference[sp], t0
+    btpz [t0], .opProfileWillCallDone
+    callSlowPath(_llint_slow_path_profile_will_call)
+.opProfileWillCallDone:
+    dispatch(2)
+
+
+_llint_op_profile_did_call:
+    traceExecution()
+    loadp JITStackFrame::enabledProfilerReference[sp], t0
+    btpz [t0], .opProfileWillCallDone
+    callSlowPath(_llint_slow_path_profile_did_call)
+.opProfileDidCallDone:
+    dispatch(2)
+
+
+_llint_op_end:
+    traceExecution()
+    checkSwitchToJITForEpilogue()
+    loadi 4[PC], t0
+    loadi TagOffset[cfr, t0, 8], t1
+    loadi PayloadOffset[cfr, t0, 8], t0
+    doReturn()
+
+
+_llint_throw_from_slow_path_trampoline:
+    # When throwing from the interpreter (i.e. throwing from LLIntSlowPaths), so
+    # the throw target is not necessarily interpreted code, we come to here.
+    # This essentially emulates the JIT's throwing protocol.
+    loadp JITStackFrame::globalData[sp], t1
+    loadp JSGlobalData::callFrameForThrow[t1], t0
+    jmp JSGlobalData::targetMachinePCForThrow[t1]
+
+
+_llint_throw_during_call_trampoline:
+    preserveReturnAddressAfterCall(t2)
+    loadp JITStackFrame::globalData[sp], t1
+    loadp JSGlobalData::callFrameForThrow[t1], t0
+    jmp JSGlobalData::targetMachinePCForThrow[t1]
+
+
+# Lastly, make sure that we can link even though we don't support all opcodes.
+# These opcodes should never arise when using LLInt or either JIT. We assert
+# as much.
+
+macro notSupported()
+    if ASSERT_ENABLED
+        crash()
+    else
+        # We should use whatever the smallest possible instruction is, just to
+        # ensure that there is a gap between instruction labels. If multiple
+        # smallest instructions exist, we should pick the one that is most
+        # likely result in execution being halted. Currently that is the break
+        # instruction on all architectures we're interested in. (Break is int3
+        # on Intel, which is 1 byte, and bkpt on ARMv7, which is 2 bytes.)
+        break
+    end
+end
+
+_llint_op_get_array_length:
+    notSupported()
+
+_llint_op_get_by_id_chain:
+    notSupported()
+
+_llint_op_get_by_id_custom_chain:
+    notSupported()
+
+_llint_op_get_by_id_custom_proto:
+    notSupported()
+
+_llint_op_get_by_id_custom_self:
+    notSupported()
+
+_llint_op_get_by_id_generic:
+    notSupported()
+
+_llint_op_get_by_id_getter_chain:
+    notSupported()
+
+_llint_op_get_by_id_getter_proto:
+    notSupported()
+
+_llint_op_get_by_id_getter_self:
+    notSupported()
+
+_llint_op_get_by_id_proto:
+    notSupported()
+
+_llint_op_get_by_id_self:
+    notSupported()
+
+_llint_op_get_string_length:
+    notSupported()
+
+_llint_op_put_by_id_generic:
+    notSupported()
+
+_llint_op_put_by_id_replace:
+    notSupported()
+
+_llint_op_put_by_id_transition:
+    notSupported()
+
+
+# Indicate the end of LLInt.
+_llint_end:
+    crash()
+
diff --git a/Source/JavaScriptCore/llint/LowLevelInterpreter.cpp b/Source/JavaScriptCore/llint/LowLevelInterpreter.cpp
new file mode 100644
index 000000000..b95a50082
--- /dev/null
+++ b/Source/JavaScriptCore/llint/LowLevelInterpreter.cpp
@@ -0,0 +1,38 @@
+/*
+ * Copyright (C) 2012 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "LowLevelInterpreter.h"
+
+#if ENABLE(LLINT)
+
+#include "LLIntOfflineAsmConfig.h"
+#include <wtf/InlineASM.h>
+
+// This is a file generated by offlineasm, which contains all of the assembly code
+// for the interpreter, as compiled from LowLevelInterpreter.asm.
+#include "LLIntAssembly.h"
+
+#endif // ENABLE(LLINT)
diff --git a/Source/JavaScriptCore/llint/LowLevelInterpreter.h b/Source/JavaScriptCore/llint/LowLevelInterpreter.h
new file mode 100644
index 000000000..e5a54a45d
--- /dev/null
+++ b/Source/JavaScriptCore/llint/LowLevelInterpreter.h
@@ -0,0 +1,53 @@
+/*
+ * Copyright (C) 2012 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef LowLevelInterpreter_h
+#define LowLevelInterpreter_h
+
+#include <wtf/Platform.h>
+
+#if ENABLE(LLINT)
+
+#include "Opcode.h"
+
+#define LLINT_INSTRUCTION_DECL(opcode, length) extern "C" void llint_##opcode();
+    FOR_EACH_OPCODE_ID(LLINT_INSTRUCTION_DECL);
+#undef LLINT_INSTRUCTION_DECL
+
+extern "C" void llint_begin();
+extern "C" void llint_end();
+extern "C" void llint_program_prologue();
+extern "C" void llint_eval_prologue();
+extern "C" void llint_function_for_call_prologue();
+extern "C" void llint_function_for_construct_prologue();
+extern "C" void llint_function_for_call_arity_check();
+extern "C" void llint_function_for_construct_arity_check();
+extern "C" void llint_generic_return_point();
+extern "C" void llint_throw_from_slow_path_trampoline();
+extern "C" void llint_throw_during_call_trampoline();
+
+#endif // ENABLE(LLINT)
+
+#endif // LowLevelInterpreter_h
diff --git a/Source/JavaScriptCore/offlineasm/armv7.rb b/Source/JavaScriptCore/offlineasm/armv7.rb
new file mode 100644
index 000000000..eb8df6869
--- /dev/null
+++ b/Source/JavaScriptCore/offlineasm/armv7.rb
@@ -0,0 +1,1032 @@
+# Copyright (C) 2011 Apple Inc. All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions
+# are met:
+# 1. Redistributions of source code must retain the above copyright
+#    notice, this list of conditions and the following disclaimer.
+# 2. Redistributions in binary form must reproduce the above copyright
+#    notice, this list of conditions and the following disclaimer in the
+#    documentation and/or other materials provided with the distribution.
+#
+# THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+# THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+# PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+# BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+# CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+# SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+# INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+# CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+# ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+# THE POSSIBILITY OF SUCH DAMAGE.
+
+require "ast"
+require "opt"
+
+class Node
+    def armV7Single
+        doubleOperand = armV7Operand
+        raise "Bogus register name #{doubleOperand}" unless doubleOperand =~ /^d/
+        "s" + ($~.post_match.to_i * 2).to_s
+    end
+end
+
+class SpecialRegister < NoChildren
+    def initialize(name)
+        @name = name
+    end
+    
+    def armV7Operand
+        @name
+    end
+    
+    def address?
+        false
+    end
+    
+    def label?
+        false
+    end
+    
+    def immediate?
+        false
+    end
+    
+    def register?
+        true
+    end
+end
+
+ARMv7_EXTRA_GPRS = [SpecialRegister.new("r9"), SpecialRegister.new("r8"), SpecialRegister.new("r3")]
+ARMv7_EXTRA_FPRS = [SpecialRegister.new("d7")]
+ARMv7_SCRATCH_FPR = SpecialRegister.new("d8")
+
+def armV7MoveImmediate(value, register)
+    # Currently we only handle the simple cases, and fall back to mov/movt for the complex ones.
+    if value >= 0 && value < 256
+        $asm.puts "movw #{register.armV7Operand}, \##{value}"
+    elsif (~value) >= 0 && (~value) < 256
+        $asm.puts "mvn #{register.armV7Operand}, \##{~value}"
+    else
+        $asm.puts "movw #{register.armV7Operand}, \##{value & 0xffff}"
+        if (value & 0xffff0000) != 0
+            $asm.puts "movt #{register.armV7Operand}, \##{value >> 16}"
+        end
+    end
+end
+
+class RegisterID
+    def armV7Operand
+        case name
+        when "t0", "a0", "r0"
+            "r0"
+        when "t1", "a1", "r1"
+            "r1"
+        when "t2", "a2"
+            "r2"
+        when "a3"
+            "r3"
+        when "t3"
+            "r4"
+        when "t4"
+            "r7"
+        when "cfr"
+            "r5"
+        when "lr"
+            "lr"
+        when "sp"
+            "sp"
+        else
+            raise "Bad register #{name} for ARMv7 at #{codeOriginString}"
+        end
+    end
+end
+
+class FPRegisterID
+    def armV7Operand
+        case name
+        when "ft0", "fr"
+            "d0"
+        when "ft1"
+            "d1"
+        when "ft2"
+            "d2"
+        when "ft3"
+            "d3"
+        when "ft4"
+            "d4"
+        when "ft5"
+            "d5"
+        else
+            raise "Bad register #{name} for ARMv7 at #{codeOriginString}"
+        end
+    end
+end
+
+class Immediate
+    def armV7Operand
+        raise "Invalid immediate #{value} at #{codeOriginString}" if value < 0 or value > 255
+        "\##{value}"
+    end
+end
+
+class Address
+    def armV7Operand
+        raise "Bad offset at #{codeOriginString}" if offset.value < -0xff or offset.value > 0xfff
+        "[#{base.armV7Operand}, \##{offset.value}]"
+    end
+end
+
+class BaseIndex
+    def armV7Operand
+        raise "Bad offset at #{codeOriginString}" if offset.value != 0
+        "[#{base.armV7Operand}, #{index.armV7Operand}, lsl \##{scaleShift}]"
+    end
+end
+
+class AbsoluteAddress
+    def armV7Operand
+        raise "Unconverted absolute address at #{codeOriginString}"
+    end
+end
+
+#
+# Lowering of branch ops. For example:
+#
+# baddiz foo, bar, baz
+#
+# will become:
+#
+# addi foo, bar
+# bz baz
+#
+
+def armV7LowerBranchOps(list)
+    newList = []
+    list.each {
+        | node |
+        if node.is_a? Instruction
+            case node.opcode
+            when /^b(addi|subi|ori|addp)/
+                op = $1
+                branch = "b" + $~.post_match
+                
+                case op
+                when "addi", "addp"
+                    op = "addis"
+                when "subi"
+                    op = "subis"
+                when "ori"
+                    op = "oris"
+                end
+                
+                newList << Instruction.new(node.codeOrigin, op, node.operands[0..-2])
+                newList << Instruction.new(node.codeOrigin, branch, [node.operands[-1]])
+            when "bmulio"
+                tmp1 = Tmp.new(node.codeOrigin, :gpr)
+                tmp2 = Tmp.new(node.codeOrigin, :gpr)
+                newList << Instruction.new(node.codeOrigin, "smulli", [node.operands[0], node.operands[1], node.operands[1], tmp1])
+                newList << Instruction.new(node.codeOrigin, "rshifti", [node.operands[-2], Immediate.new(node.codeOrigin, 31), tmp2])
+                newList << Instruction.new(node.codeOrigin, "bineq", [tmp1, tmp2, node.operands[-1]])
+            when /^bmuli/
+                condition = $~.post_match
+                newList << Instruction.new(node.codeOrigin, "muli", node.operands[0..-2])
+                newList << Instruction.new(node.codeOrigin, "bti" + condition, [node.operands[-2], node.operands[-1]])
+            else
+                newList << node
+            end
+        else
+            newList << node
+        end
+    }
+    newList
+end
+
+#
+# Lowering of shift ops. For example:
+#
+# lshifti foo, bar
+#
+# will become:
+#
+# andi foo, 31, tmp
+# lshifti tmp, bar
+#
+
+def armV7SanitizeShift(operand, list)
+    return operand if operand.immediate?
+    
+    tmp = Tmp.new(operand.codeOrigin, :gpr)
+    list << Instruction.new(operand.codeOrigin, "andi", [operand, Immediate.new(operand.codeOrigin, 31), tmp])
+    tmp
+end
+
+def armV7LowerShiftOps(list)
+    newList = []
+    list.each {
+        | node |
+        if node.is_a? Instruction
+            case node.opcode
+            when "lshifti", "rshifti", "urshifti"
+                if node.operands.size == 2
+                    newList << Instruction.new(node.codeOrigin, node.opcode, [armV7SanitizeShift(node.operands[0], newList), node.operands[1]])
+                else
+                    newList << Instruction.new(node.codeOrigin, node.opcode, [node.operands[0], armV7SanitizeShift(node.operands[1], newList), node.operands[2]])
+                    raise "Wrong number of operands for shift at #{node.codeOriginString}" unless node.operands.size == 3
+                end
+            else
+                newList << node
+            end
+        else
+            newList << node
+        end
+    }
+    newList
+end
+
+#
+# Lowering of malformed addresses. For example:
+#
+# loadp 10000[foo], bar
+#
+# will become:
+#
+# move 10000, tmp
+# addp foo, tmp
+# loadp 0[tmp], bar
+#
+
+class Node
+    def armV7LowerMalformedAddressesRecurse(list)
+        mapChildren {
+            | node |
+            node.armV7LowerMalformedAddressesRecurse(list)
+        }
+    end
+end
+
+class Address
+    def armV7LowerMalformedAddressesRecurse(list)
+        if offset.value < -0xff or offset.value > 0xfff
+            tmp = Tmp.new(codeOrigin, :gpr)
+            list << Instruction.new(codeOrigin, "move", [offset, tmp])
+            list << Instruction.new(codeOrigin, "addp", [base, tmp])
+            Address.new(codeOrigin, tmp, Immediate.new(codeOrigin, 0))
+        else
+            self
+        end
+    end
+end
+
+class BaseIndex
+    def armV7LowerMalformedAddressesRecurse(list)
+        if offset.value != 0
+            tmp = Tmp.new(codeOrigin, :gpr)
+            list << Instruction.new(codeOrigin, "move", [offset, tmp])
+            list << Instruction.new(codeOrigin, "addp", [base, tmp])
+            BaseIndex.new(codeOrigin, tmp, index, scale, Immediate.new(codeOrigin, 0))
+        else
+            self
+        end
+    end
+end
+
+class AbsoluteAddress
+    def armV7LowerMalformedAddressesRecurse(list)
+        tmp = Tmp.new(codeOrigin, :gpr)
+        list << Instruction.new(codeOrigin, "move", [address, tmp])
+        Address.new(codeOrigin, tmp, Immediate.new(codeOrigin, 0))
+    end
+end
+
+def armV7LowerMalformedAddresses(list)
+    newList = []
+    list.each {
+        | node |
+        newList << node.armV7LowerMalformedAddressesRecurse(newList)
+    }
+    newList
+end
+
+#
+# Lowering of malformed addresses in double loads and stores. For example:
+#
+# loadd [foo, bar, 8], baz
+#
+# becomes:
+#
+# leap [foo, bar, 8], tmp
+# loadd [tmp], baz
+#
+
+class Node
+    def armV7DoubleAddress(list)
+        self
+    end
+end
+
+class BaseIndex
+    def armV7DoubleAddress(list)
+        tmp = Tmp.new(codeOrigin, :gpr)
+        list << Instruction.new(codeOrigin, "leap", [self, tmp])
+        Address.new(codeOrigin, tmp, Immediate.new(codeOrigin, 0))
+    end
+end
+
+def armV7LowerMalformedAddressesDouble(list)
+    newList = []
+    list.each {
+        | node |
+        if node.is_a? Instruction
+            case node.opcode
+            when "loadd"
+                newList << Instruction.new(node.codeOrigin, "loadd", [node.operands[0].armV7DoubleAddress(newList), node.operands[1]])
+            when "stored"
+                newList << Instruction.new(node.codeOrigin, "stored", [node.operands[0], node.operands[1].armV7DoubleAddress(newList)])
+            else
+                newList << node
+            end
+        else
+            newList << node
+        end
+    }
+    newList
+end
+
+#
+# Lowering of misplaced immediates. For example:
+#
+# storei 0, [foo]
+#
+# will become:
+#
+# move 0, tmp
+# storei tmp, [foo]
+#
+
+def armV7LowerMisplacedImmediates(list)
+    newList = []
+    list.each {
+        | node |
+        if node.is_a? Instruction
+            case node.opcode
+            when "storei", "storep"
+                operands = node.operands
+                newOperands = []
+                operands.each {
+                    | operand |
+                    if operand.is_a? Immediate
+                        tmp = Tmp.new(operand.codeOrigin, :gpr)
+                        newList << Instruction.new(operand.codeOrigin, "move", [operand, tmp])
+                        newOperands << tmp
+                    else
+                        newOperands << operand
+                    end
+                }
+                newList << Instruction.new(node.codeOrigin, node.opcode, newOperands)
+            else
+                newList << node
+            end
+        else
+            newList << node
+        end
+    }
+    newList
+end
+
+#
+# Lowering of malformed immediates except when used in a "move" instruction.
+# For example:
+#
+# addp 642641, foo
+#
+# will become:
+#
+# move 642641, tmp
+# addp tmp, foo
+#
+
+class Node
+    def armV7LowerMalformedImmediatesRecurse(list)
+        mapChildren {
+            | node |
+            node.armV7LowerMalformedImmediatesRecurse(list)
+        }
+    end
+end
+
+class Address
+    def armV7LowerMalformedImmediatesRecurse(list)
+        self
+    end
+end
+
+class BaseIndex
+    def armV7LowerMalformedImmediatesRecurse(list)
+        self
+    end
+end
+
+class AbsoluteAddress
+    def armV7LowerMalformedImmediatesRecurse(list)
+        self
+    end
+end
+
+class Immediate
+    def armV7LowerMalformedImmediatesRecurse(list)
+        if value < 0 or value > 255
+            tmp = Tmp.new(codeOrigin, :gpr)
+            list << Instruction.new(codeOrigin, "move", [self, tmp])
+            tmp
+        else
+            self
+        end
+    end
+end
+
+def armV7LowerMalformedImmediates(list)
+    newList = []
+    list.each {
+        | node |
+        if node.is_a? Instruction
+            case node.opcode
+            when "move"
+                newList << node
+            when "addi", "addp", "addis", "subi", "subp", "subis"
+                if node.operands[0].is_a? Immediate and
+                        node.operands[0].value < 0 and
+                        node.operands[0].value >= 255 and
+                        node.operands.size == 2
+                    if node.opcode =~ /add/
+                        newOpcode = "sub" + node.opcode[-1..-1]
+                    else
+                        newOpcode = "add" + node.opcode[-1..-1]
+                    end
+                    newList << Instruction.new(node.codeOrigin, newOpcode,
+                                               [Immediate.new(-node.operands[0].value)] + node.operands[1..-1])
+                else
+                    newList << node.armV7LowerMalformedImmediatesRecurse(newList)
+                end
+            when "muli"
+                if node.operands[0].is_a? Immediate
+                    tmp = Tmp.new(codeOrigin, :gpr)
+                    newList << Instruction.new(node.codeOrigin, "move", [node.operands[0], tmp])
+                    newList << Instruction.new(node.codeOrigin, "muli", [tmp] + node.operands[1..-1])
+                else
+                    newList << node.armV7LowerMalformedImmediatesRecurse(newList)
+                end
+            else
+                newList << node.armV7LowerMalformedImmediatesRecurse(newList)
+            end
+        else
+            newList << node
+        end
+    }
+    newList
+end
+
+#
+# Lowering of misplaced addresses. For example:
+#
+# addi foo, [bar]
+#
+# will become:
+#
+# loadi [bar], tmp
+# addi foo, tmp
+# storei tmp, [bar]
+#
+# Another example:
+#
+# addi [foo], bar
+#
+# will become:
+#
+# loadi [foo], tmp
+# addi tmp, bar
+#
+
+def armV7AsRegister(preList, postList, operand, suffix, needStore)
+    return operand unless operand.address?
+    
+    tmp = Tmp.new(operand.codeOrigin, if suffix == "d" then :fpr else :gpr end)
+    preList << Instruction.new(operand.codeOrigin, "load" + suffix, [operand, tmp])
+    if needStore
+        postList << Instruction.new(operand.codeOrigin, "store" + suffix, [tmp, operand])
+    end
+    tmp
+end
+
+def armV7AsRegisters(preList, postList, operands, suffix)
+    newOperands = []
+    operands.each_with_index {
+        | operand, index |
+        newOperands << armV7AsRegister(preList, postList, operand, suffix, index == operands.size - 1)
+    }
+    newOperands
+end
+
+def armV7LowerMisplacedAddresses(list)
+    newList = []
+    list.each {
+        | node |
+        if node.is_a? Instruction
+            postInstructions = []
+            case node.opcode
+            when "addi", "addp", "addis", "andi", "andp", "lshifti", "muli", "negi", "noti", "ori", "oris",
+                "orp", "rshifti", "urshifti", "subi", "subp", "subis", "xori", "xorp", /^bi/, /^bp/, /^bti/,
+                /^btp/, /^ci/, /^cp/, /^ti/
+                newList << Instruction.new(node.codeOrigin,
+                                           node.opcode,
+                                           armV7AsRegisters(newList, postInstructions, node.operands, "i"))
+            when "bbeq", "bbneq", "bba", "bbaeq", "bbb", "bbbeq", "btbo", "btbz", "btbnz", "tbz", "tbnz",
+                "tbo"
+                newList << Instruction.new(node.codeOrigin,
+                                           node.opcode,
+                                           armV7AsRegisters(newList, postInstructions, node.operands, "b"))
+            when "bbgt", "bbgteq", "bblt", "bblteq", "btbs", "tbs"
+                newList << Instruction.new(node.codeOrigin,
+                                           node.opcode,
+                                           armV7AsRegisters(newList, postInstructions, node.operands, "bs"))
+            when "addd", "divd", "subd", "muld", "sqrtd", /^bd/
+                newList << Instruction.new(node.codeOrigin,
+                                           node.opcode,
+                                           armV7AsRegisters(newList, postInstructions, node.operands, "d"))
+            when "jmp", "call"
+                newList << Instruction.new(node.codeOrigin,
+                                           node.opcode,
+                                           [armV7AsRegister(newList, postInstructions, node.operands[0], "p", false)])
+            else
+                newList << node
+            end
+            newList += postInstructions
+        else
+            newList << node
+        end
+    }
+    newList
+end
+
+#
+# Lowering of register reuse in compare instructions. For example:
+#
+# cieq t0, t1, t0
+#
+# will become:
+#
+# mov tmp, t0
+# cieq tmp, t1, t0
+#
+
+def armV7LowerRegisterReuse(list)
+    newList = []
+    list.each {
+        | node |
+        if node.is_a? Instruction
+            case node.opcode
+            when "cieq", "cineq", "cia", "ciaeq", "cib", "cibeq", "cigt", "cigteq", "cilt", "cilteq",
+                "cpeq", "cpneq", "cpa", "cpaeq", "cpb", "cpbeq", "cpgt", "cpgteq", "cplt", "cplteq",
+                "tio", "tis", "tiz", "tinz", "tbo", "tbs", "tbz", "tbnz"
+                if node.operands.size == 2
+                    if node.operands[0] == node.operands[1]
+                        tmp = Tmp.new(node.codeOrigin, :gpr)
+                        newList << Instruction.new(node.codeOrigin, "move", [node.operands[0], tmp])
+                        newList << Instruction.new(node.codeOrigin, node.opcode, [tmp, node.operands[1]])
+                    else
+                        newList << node
+                    end
+                else
+                    raise "Wrong number of arguments at #{node.codeOriginString}" unless node.operands.size == 3
+                    if node.operands[0] == node.operands[2]
+                        tmp = Tmp.new(node.codeOrigin, :gpr)
+                        newList << Instruction.new(node.codeOrigin, "move", [node.operands[0], tmp])
+                        newList << Instruction.new(node.codeOrigin, node.opcode, [tmp, node.operands[1], node.operands[2]])
+                    elsif node.operands[1] == node.operands[2]
+                        tmp = Tmp.new(node.codeOrigin, :gpr)
+                        newList << Instruction.new(node.codeOrigin, "move", [node.operands[1], tmp])
+                        newList << Instruction.new(node.codeOrigin, node.opcode, [node.operands[0], tmp, node.operands[2]])
+                    else
+                        newList << node
+                    end
+                end
+            else
+                newList << node
+            end
+        else
+            newList << node
+        end
+    }
+    newList
+end
+
+#
+# Lea support.
+#
+
+class Address
+    def armV7EmitLea(destination)
+        if destination == base
+            $asm.puts "adds #{destination.armV7Operand}, \##{offset.value}"
+        else
+            $asm.puts "adds #{destination.armV7Operand}, #{base.armV7Operand}, \##{offset.value}"
+        end
+    end
+end
+
+class BaseIndex
+    def armV7EmitLea(destination)
+        raise "Malformed BaseIndex, offset should be zero at #{codeOriginString}" unless offset.value == 0
+        $asm.puts "add.w #{destination.armV7Operand}, #{base.armV7Operand}, #{index.armV7Operand}, lsl \##{scaleShift}"
+    end
+end
+
+# FIXME: we could support AbsoluteAddress for lea, but we don't.
+
+#
+# Actual lowering code follows.
+#
+
+class Sequence
+    def lowerARMv7
+        myList = @list
+        
+        # Verify that we will only see instructions and labels.
+        myList.each {
+            | node |
+            unless node.is_a? Instruction or
+                    node.is_a? Label or
+                    node.is_a? LocalLabel or
+                    node.is_a? Skip
+                raise "Unexpected #{node.inspect} at #{node.codeOrigin}" 
+            end
+        }
+        
+        myList = armV7LowerBranchOps(myList)
+        myList = armV7LowerShiftOps(myList)
+        myList = armV7LowerMalformedAddresses(myList)
+        myList = armV7LowerMalformedAddressesDouble(myList)
+        myList = armV7LowerMisplacedImmediates(myList)
+        myList = armV7LowerMalformedImmediates(myList)
+        myList = armV7LowerMisplacedAddresses(myList)
+        myList = armV7LowerRegisterReuse(myList)
+        myList = assignRegistersToTemporaries(myList, :gpr, ARMv7_EXTRA_GPRS)
+        myList = assignRegistersToTemporaries(myList, :fpr, ARMv7_EXTRA_FPRS)
+        myList.each {
+            | node |
+            node.lower("ARMv7")
+        }
+    end
+end
+
+def armV7Operands(operands)
+    operands.map{|v| v.armV7Operand}.join(", ")
+end
+
+def armV7FlippedOperands(operands)
+    armV7Operands([operands[-1]] + operands[0..-2])
+end
+
+def emitArmV7Compact(opcode2, opcode3, operands)
+    if operands.size == 3
+        $asm.puts "#{opcode3} #{armV7FlippedOperands(operands)}"
+    else
+        raise unless operands.size == 2
+        raise unless operands[1].is_a? RegisterID
+        if operands[0].is_a? Immediate
+            $asm.puts "#{opcode3} #{operands[1].armV7Operand}, #{operands[1].armV7Operand}, #{operands[0].armV7Operand}"
+        else
+            $asm.puts "#{opcode2} #{armV7FlippedOperands(operands)}"
+        end
+    end
+end
+
+def emitArmV7(opcode, operands)
+    if operands.size == 3
+        $asm.puts "#{opcode} #{armV7FlippedOperands(operands)}"
+    else
+        raise unless operands.size == 2
+        $asm.puts "#{opcode} #{operands[1].armV7Operand}, #{operands[1].armV7Operand}, #{operands[0].armV7Operand}"
+    end
+end
+
+def emitArmV7DoubleBranch(branchOpcode, operands)
+    $asm.puts "vcmpe.f64 #{armV7Operands(operands[0..1])}"
+    $asm.puts "vmrs apsr_nzcv, fpscr"
+    $asm.puts "#{branchOpcode} #{operands[2].asmLabel}"
+end
+
+def emitArmV7Test(operands)
+    value = operands[0]
+    case operands.size
+    when 2
+        mask = Immediate.new(codeOrigin, -1)
+    when 3
+        mask = operands[1]
+    else
+        raise "Expected 2 or 3 operands but got #{operands.size} at #{codeOriginString}"
+    end
+    
+    if mask.is_a? Immediate and mask.value == -1
+        $asm.puts "tst #{value.armV7Operand}, #{value.armV7Operand}"
+    elsif mask.is_a? Immediate
+        $asm.puts "tst.w #{value.armV7Operand}, #{mask.armV7Operand}"
+    else
+        $asm.puts "tst #{value.armV7Operand}, #{mask.armV7Operand}"
+    end
+end
+
+def emitArmV7Compare(operands, code)
+    $asm.puts "movs #{operands[2].armV7Operand}, \#0"
+    $asm.puts "cmp #{operands[0].armV7Operand}, #{operands[1].armV7Operand}"
+    $asm.puts "it #{code}"
+    $asm.puts "mov#{code} #{operands[2].armV7Operand}, \#1"
+end
+
+def emitArmV7TestSet(operands, code)
+    $asm.puts "movs #{operands[-1].armV7Operand}, \#0"
+    emitArmV7Test(operands)
+    $asm.puts "it #{code}"
+    $asm.puts "mov#{code} #{operands[-1].armV7Operand}, \#1"
+end
+
+class Instruction
+    def lowerARMv7
+        $asm.comment codeOriginString
+        case opcode
+        when "addi", "addp", "addis"
+            if opcode == "addis"
+                suffix = "s"
+            else
+                suffix = ""
+            end
+            if operands.size == 3 and operands[0].is_a? Immediate
+                raise unless operands[1].is_a? RegisterID
+                raise unless operands[2].is_a? RegisterID
+                if operands[0].value == 0 and suffix.empty?
+                    unless operands[1] == operands[2]
+                        $asm.puts "mov #{operands[2].armV7Operand}, #{operands[1].armV7Operand}"
+                    end
+                else
+                    $asm.puts "adds #{operands[2].armV7Operand}, #{operands[1].armV7Operand}, #{operands[0].armV7Operand}"
+                end
+            elsif operands.size == 3 and operands[0].is_a? RegisterID
+                raise unless operands[1].is_a? RegisterID
+                raise unless operands[2].is_a? RegisterID
+                $asm.puts "adds #{armV7FlippedOperands(operands)}"
+            else
+                if operands[0].is_a? Immediate
+                    unless Immediate.new(nil, 0) == operands[0]
+                        $asm.puts "adds #{armV7FlippedOperands(operands)}"
+                    end
+                else
+                    $asm.puts "add#{suffix} #{armV7FlippedOperands(operands)}"
+                end
+            end
+        when "andi", "andp"
+            emitArmV7Compact("ands", "and", operands)
+        when "ori", "orp"
+            emitArmV7Compact("orrs", "orr", operands)
+        when "oris"
+            emitArmV7Compact("orrs", "orrs", operands)
+        when "xori", "xorp"
+            emitArmV7Compact("eors", "eor", operands)
+        when "lshifti"
+            emitArmV7Compact("lsls", "lsls", operands)
+        when "rshifti"
+            emitArmV7Compact("asrs", "asrs", operands)
+        when "urshifti"
+            emitArmV7Compact("lsrs", "lsrs", operands)
+        when "muli"
+            if operands.size == 2 or operands[0] == operands[2] or operands[1] == operands[2]
+                emitArmV7("muls", operands)
+            else
+                $asm.puts "mov #{operands[2].armV7Operand}, #{operands[0].armV7Operand}"
+                $asm.puts "muls #{operands[2].armV7Operand}, #{operands[2].armV7Operand}, #{operands[1].armV7Operand}"
+            end
+        when "subi", "subp", "subis"
+            emitArmV7Compact("subs", "subs", operands)
+        when "negi"
+            $asm.puts "rsbs #{operands[0].armV7Operand}, #{operands[0].armV7Operand}, \#0"
+        when "noti"
+            $asm.puts "mvns #{operands[0].armV7Operand}, #{operands[0].armV7Operand}"
+        when "loadi", "loadp"
+            $asm.puts "ldr #{armV7FlippedOperands(operands)}"
+        when "storei", "storep"
+            $asm.puts "str #{armV7Operands(operands)}"
+        when "loadb"
+            $asm.puts "ldrb #{armV7FlippedOperands(operands)}"
+        when "loadbs"
+            $asm.puts "ldrsb.w #{armV7FlippedOperands(operands)}"
+        when "storeb"
+            $asm.puts "strb #{armV7Operands(operands)}"
+        when "loadh"
+            $asm.puts "ldrh #{armV7FlippedOperands(operands)}"
+        when "loadhs"
+            $asm.puts "ldrsh.w #{armV7FlippedOperands(operands)}"
+        when "storeh"
+            $asm.puts "strh #{armV7Operands(operands)}"
+        when "loadd"
+            $asm.puts "vldr.64 #{armV7FlippedOperands(operands)}"
+        when "stored"
+            $asm.puts "vstr.64 #{armV7Operands(operands)}"
+        when "addd"
+            emitArmV7("vadd.f64", operands)
+        when "divd"
+            emitArmV7("vdiv.f64", operands)
+        when "subd"
+            emitArmV7("vsub.f64", operands)
+        when "muld"
+            emitArmV7("vmul.f64", operands)
+        when "sqrtd"
+            $asm.puts "vsqrt.f64 #{armV7FlippedOperands(operands)}"
+        when "ci2d"
+            $asm.puts "vmov #{operands[1].armV7Single}, #{operands[0].armV7Operand}"
+            $asm.puts "vcvt.f64.s32 #{operands[1].armV7Operand}, #{operands[1].armV7Single}"
+        when "bdeq"
+            emitArmV7DoubleBranch("beq", operands)
+        when "bdneq"
+            $asm.puts "vcmpe.f64 #{armV7Operands(operands[0..1])}"
+            $asm.puts "vmrs apsr_nzcv, fpscr"
+            isUnordered = LocalLabel.unique("bdneq")
+            $asm.puts "bvs #{LabelReference.new(codeOrigin, isUnordered).asmLabel}"
+            $asm.puts "bne #{operands[2].asmLabel}"
+            isUnordered.lower("ARMv7")
+        when "bdgt"
+            emitArmV7DoubleBranch("bgt", operands)
+        when "bdgteq"
+            emitArmV7DoubleBranch("bge", operands)
+        when "bdlt"
+            emitArmV7DoubleBranch("bmi", operands)
+        when "bdlteq"
+            emitArmV7DoubleBranch("bls", operands)
+        when "bdequn"
+            $asm.puts "vcmpe.f64 #{armV7Operands(operands[0..1])}"
+            $asm.puts "vmrs apsr_nzcv, fpscr"
+            $asm.puts "bvs #{operands[2].asmLabel}"
+            $asm.puts "beq #{operands[2].asmLabel}"
+        when "bdnequn"
+            emitArmV7DoubleBranch("bne", operands)
+        when "bdgtun"
+            emitArmV7DoubleBranch("bhi", operands)
+        when "bdgtequn"
+            emitArmV7DoubleBranch("bpl", operands)
+        when "bdltun"
+            emitArmV7DoubleBranch("blt", operands)
+        when "bdltequn"
+            emitArmV7DoubleBranch("ble", operands)
+        when "btd2i"
+            # FIXME: may be a good idea to just get rid of this instruction, since the interpreter
+            # currently does not use it.
+            raise "ARMv7 does not support this opcode yet, #{codeOrigin}"
+        when "td2i"
+            $asm.puts "vcvt.s32.f64 #{ARMv7_SCRATCH_FPR.armV7Single}, #{operands[0].armV7Operand}"
+            $asm.puts "vmov #{operands[1].armV7Operand}, #{ARMv7_SCRATCH_FPR.armV7Single}"
+        when "bcd2i"
+            $asm.puts "vcvt.s32.f64 #{ARMv7_SCRATCH_FPR.armV7Single}, #{operands[0].armV7Operand}"
+            $asm.puts "vmov #{operands[1].armV7Operand}, #{ARMv7_SCRATCH_FPR.armV7Single}"
+            $asm.puts "vcvt.f64.s32 #{ARMv7_SCRATCH_FPR.armV7Operand}, #{ARMv7_SCRATCH_FPR.armV7Single}"
+            emitArmV7DoubleBranch("bne", [ARMv7_SCRATCH_FPR, operands[0], operands[2]])
+            $asm.puts "tst #{operands[1].armV7Operand}, #{operands[1].armV7Operand}"
+            $asm.puts "beq #{operands[2].asmLabel}"
+        when "movdz"
+            # FIXME: either support this or remove it.
+            raise "ARMv7 does not support this opcode yet, #{codeOrigin}"
+        when "pop"
+            $asm.puts "pop #{operands[0].armV7Operand}"
+        when "push"
+            $asm.puts "push #{operands[0].armV7Operand}"
+        when "move", "sxi2p", "zxi2p"
+            if operands[0].is_a? Immediate
+                armV7MoveImmediate(operands[0].value, operands[1])
+            else
+                $asm.puts "mov #{armV7FlippedOperands(operands)}"
+            end
+        when "nop"
+            $asm.puts "nop"
+        when "bieq", "bpeq", "bbeq"
+            if Immediate.new(nil, 0) == operands[0]
+                $asm.puts "tst #{operands[1].armV7Operand}, #{operands[1].armV7Operand}"
+            elsif Immediate.new(nil, 0) == operands[1]
+                $asm.puts "tst #{operands[0].armV7Operand}, #{operands[0].armV7Operand}"
+            else
+                $asm.puts "cmp #{armV7Operands(operands[0..1])}"
+            end
+            $asm.puts "beq #{operands[2].asmLabel}"
+        when "bineq", "bpneq", "bbneq"
+            if Immediate.new(nil, 0) == operands[0]
+                $asm.puts "tst #{operands[1].armV7Operand}, #{operands[1].armV7Operand}"
+            elsif Immediate.new(nil, 0) == operands[1]
+                $asm.puts "tst #{operands[0].armV7Operand}, #{operands[0].armV7Operand}"
+            else
+                $asm.puts "cmp #{armV7Operands(operands[0..1])}"
+            end
+            $asm.puts "bne #{operands[2].asmLabel}"
+        when "bia", "bpa", "bba"
+            $asm.puts "cmp #{armV7Operands(operands[0..1])}"
+            $asm.puts "bhi #{operands[2].asmLabel}"
+        when "biaeq", "bpaeq", "bbaeq"
+            $asm.puts "cmp #{armV7Operands(operands[0..1])}"
+            $asm.puts "bhs #{operands[2].asmLabel}"
+        when "bib", "bpb", "bbb"
+            $asm.puts "cmp #{armV7Operands(operands[0..1])}"
+            $asm.puts "blo #{operands[2].asmLabel}"
+        when "bibeq", "bpbeq", "bbbeq"
+            $asm.puts "cmp #{armV7Operands(operands[0..1])}"
+            $asm.puts "bls #{operands[2].asmLabel}"
+        when "bigt", "bpgt", "bbgt"
+            $asm.puts "cmp #{armV7Operands(operands[0..1])}"
+            $asm.puts "bgt #{operands[2].asmLabel}"
+        when "bigteq", "bpgteq", "bbgteq"
+            $asm.puts "cmp #{armV7Operands(operands[0..1])}"
+            $asm.puts "bge #{operands[2].asmLabel}"
+        when "bilt", "bplt", "bblt"
+            $asm.puts "cmp #{armV7Operands(operands[0..1])}"
+            $asm.puts "blt #{operands[2].asmLabel}"
+        when "bilteq", "bplteq", "bblteq"
+            $asm.puts "cmp #{armV7Operands(operands[0..1])}"
+            $asm.puts "ble #{operands[2].asmLabel}"
+        when "btiz", "btpz", "btbz"
+            emitArmV7Test(operands)
+            $asm.puts "beq #{operands[-1].asmLabel}"
+        when "btinz", "btpnz", "btbnz"
+            emitArmV7Test(operands)
+            $asm.puts "bne #{operands[-1].asmLabel}"
+        when "btio", "btpo", "btbo"
+            emitArmV7Test(operands)
+            $asm.puts "bvs #{operands[-1].asmLabel}"
+        when "btis", "btps", "btbs"
+            emitArmV7Test(operands)
+            $asm.puts "bmi #{operands[-1].asmLabel}"
+        when "jmp"
+            if operands[0].label?
+                $asm.puts "b #{operands[0].asmLabel}"
+            else
+                $asm.puts "mov pc, #{operands[0].armV7Operand}"
+            end
+        when "call"
+            if operands[0].label?
+                $asm.puts "blx #{operands[0].asmLabel}"
+            else
+                $asm.puts "blx #{operands[0].armV7Operand}"
+            end
+        when "break"
+            $asm.puts "bkpt"
+        when "ret"
+            $asm.puts "bx lr"
+        when "cieq", "cpeq"
+            emitArmV7Compare(operands, "eq")
+        when "cineq", "cpneq"
+            emitArmV7Compare(operands, "ne")
+        when "cia", "cpa"
+            emitArmV7Compare(operands, "hi")
+        when "ciaeq", "cpaeq"
+            emitArmV7Compare(operands, "hs")
+        when "cib", "cpb"
+            emitArmV7Compare(operands, "lo")
+        when "cibeq", "cpbeq"
+            emitArmV7Compare(operands, "ls")
+        when "cigt", "cpgt"
+            emitArmV7Compare(operands, "gt")
+        when "cigteq", "cpgteq"
+            emitArmV7Compare(operands, "ge")
+        when "cilt", "cplt"
+            emitArmV7Compare(operands, "lt")
+        when "cilteq", "cplteq"
+            emitArmV7Compare(operands, "le")
+        when "tio", "tbo"
+            emitArmV7TestSet(operands, "vs")
+        when "tis", "tbs"
+            emitArmV7TestSet(operands, "mi")
+        when "tiz", "tbz"
+            emitArmV7TestSet(operands, "eq")
+        when "tinz", "tbnz"
+            emitArmV7TestSet(operands, "ne")
+        when "peek"
+            $asm.puts "ldr #{operands[1].armV7Operand}, [sp, \##{operands[0].value * 4}]"
+        when "poke"
+            $asm.puts "str #{operands[1].armV7Operand}, [sp, \##{operands[0].value * 4}]"
+        when "fii2d"
+            $asm.puts "vmov #{operands[2].armV7Operand}, #{operands[0].armV7Operand}, #{operands[1].armV7Operand}"
+        when "fd2ii"
+            $asm.puts "vmov #{operands[1].armV7Operand}, #{operands[2].armV7Operand}, #{operands[0].armV7Operand}"
+        when "bo"
+            $asm.puts "bvs #{operands[0].asmLabel}"
+        when "bs"
+            $asm.puts "bmi #{operands[0].asmLabel}"
+        when "bz"
+            $asm.puts "beq #{operands[0].asmLabel}"
+        when "bnz"
+            $asm.puts "bne #{operands[0].asmLabel}"
+        when "leai", "leap"
+            operands[0].armV7EmitLea(operands[1])
+        when "smulli"
+            raise "Wrong number of arguments to smull in #{self.inspect} at #{codeOriginString}" unless operands.length == 4
+            $asm.puts "smull #{operands[2].armV7Operand}, #{operands[3].armV7Operand}, #{operands[0].armV7Operand}, #{operands[1].armV7Operand}"
+        else
+            raise "Unhandled opcode #{opcode} at #{codeOriginString}"
+        end
+    end
+end
+
diff --git a/Source/JavaScriptCore/offlineasm/asm.rb b/Source/JavaScriptCore/offlineasm/asm.rb
new file mode 100644
index 000000000..a93a8c5dd
--- /dev/null
+++ b/Source/JavaScriptCore/offlineasm/asm.rb
@@ -0,0 +1,176 @@
+#!/usr/bin/env ruby
+
+# Copyright (C) 2011 Apple Inc. All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions
+# are met:
+# 1. Redistributions of source code must retain the above copyright
+#    notice, this list of conditions and the following disclaimer.
+# 2. Redistributions in binary form must reproduce the above copyright
+#    notice, this list of conditions and the following disclaimer in the
+#    documentation and/or other materials provided with the distribution.
+#
+# THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+# THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+# PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+# BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+# CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+# SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+# INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+# CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+# ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+# THE POSSIBILITY OF SUCH DAMAGE.
+
+$: << File.dirname(__FILE__)
+
+require "backends"
+require "digest/sha1"
+require "offsets"
+require "parser"
+require "self_hash"
+require "settings"
+require "transform"
+
+class Assembler
+    def initialize(outp)
+        @outp = outp
+        @state = :cpp
+        @commentState = :none
+        @comment = nil
+    end
+    
+    def enterAsm
+        @outp.puts "asm ("
+        @state = :asm
+    end
+    
+    def leaveAsm
+        putsLastComment
+        @outp.puts ");"
+        @state = :cpp
+    end
+    
+    def inAsm
+        enterAsm
+        yield
+        leaveAsm
+    end
+    
+    def lastComment
+        if @comment
+            result = "// #{@comment}"
+        else
+            result = ""
+        end
+        @commentState = :none
+        @comment = nil
+        result
+    end
+    
+    def putsLastComment
+        comment = lastComment
+        unless comment.empty?
+            @outp.puts comment
+        end
+    end
+    
+    def puts(*line)
+        raise unless @state == :asm
+        @outp.puts("\"\\t" + line.join('') + "\\n\" #{lastComment}")
+    end
+    
+    def print(line)
+        raise unless @state == :asm
+        @outp.print("\"" + line + "\"")
+    end
+    
+    def putsLabel(labelName)
+        raise unless @state == :asm
+        @outp.puts("OFFLINE_ASM_GLOBAL_LABEL(#{labelName}) #{lastComment}")
+    end
+    
+    def putsLocalLabel(labelName)
+        raise unless @state == :asm
+        @outp.puts("LOCAL_LABEL_STRING(#{labelName}) \":\\n\" #{lastComment}")
+    end
+    
+    def self.labelReference(labelName)
+        "\" SYMBOL_STRING(#{labelName}) \""
+    end
+    
+    def self.localLabelReference(labelName)
+        "\" LOCAL_LABEL_STRING(#{labelName}) \""
+    end
+    
+    def comment(text)
+        case @commentState
+        when :none
+            @comment = text
+            @commentState = :one
+        when :one
+            @outp.puts "// #{@comment}"
+            @outp.puts "// #{text}"
+            @comment = nil
+            @commentState = :many
+        when :many
+            @outp.puts "// #{text}"
+        else
+            raise
+        end
+    end
+end
+
+asmFile = ARGV.shift
+offsetsFile = ARGV.shift
+outputFlnm = ARGV.shift
+
+$stderr.puts "offlineasm: Parsing #{asmFile} and #{offsetsFile} and creating assembly file #{outputFlnm}."
+
+configurationList = offsetsAndConfigurationIndex(offsetsFile)
+inputData = IO::read(asmFile)
+
+inputHash =
+    "// offlineasm input hash: " + Digest::SHA1.hexdigest(inputData) +
+    " " + Digest::SHA1.hexdigest(configurationList.map{|v| (v[0] + [v[1]]).join(' ')}.join(' ')) +
+    " " + selfHash
+
+if FileTest.exist? outputFlnm
+    File.open(outputFlnm, "r") {
+        | inp |
+        firstLine = inp.gets
+        if firstLine and firstLine.chomp == inputHash
+            $stderr.puts "offlineasm: Nothing changed."
+            exit 0
+        end
+    }
+end
+
+File.open(outputFlnm, "w") {
+    | outp |
+    $output = outp
+    $output.puts inputHash
+    
+    $asm = Assembler.new($output)
+    
+    ast = parse(lex(inputData))
+    
+    configurationList.each {
+        | configuration |
+        offsetsList = configuration[0]
+        configIndex = configuration[1]
+        forSettings(computeSettingsCombinations(ast)[configIndex], ast) {
+            | concreteSettings, lowLevelAST, backend |
+            lowLevelAST = lowLevelAST.resolve(*buildOffsetsMap(lowLevelAST, offsetsList))
+            emitCodeInConfiguration(concreteSettings, lowLevelAST, backend) {
+                $asm.inAsm {
+                    lowLevelAST.lower(backend)
+                }
+            }
+        }
+    }
+}
+
+$stderr.puts "offlineasm: Assembly file #{outputFlnm} successfully generated."
+
diff --git a/Source/JavaScriptCore/offlineasm/ast.rb b/Source/JavaScriptCore/offlineasm/ast.rb
new file mode 100644
index 000000000..f67b0fc60
--- /dev/null
+++ b/Source/JavaScriptCore/offlineasm/ast.rb
@@ -0,0 +1,1039 @@
+# Copyright (C) 2011 Apple Inc. All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions
+# are met:
+# 1. Redistributions of source code must retain the above copyright
+#    notice, this list of conditions and the following disclaimer.
+# 2. Redistributions in binary form must reproduce the above copyright
+#    notice, this list of conditions and the following disclaimer in the
+#    documentation and/or other materials provided with the distribution.
+#
+# THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+# THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+# PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+# BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+# CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+# SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+# INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+# CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+# ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+# THE POSSIBILITY OF SUCH DAMAGE.
+
+#
+# Base utility types for the AST.
+#
+
+# Valid methods for Node:
+#
+# node.children -> Returns an array of immediate children.
+#
+# node.descendents -> Returns an array of all strict descendants (children
+#     and children of children, transitively).
+#
+# node.flatten -> Returns an array containing the strict descendants and
+#     the node itself.
+#
+# node.filter(type) -> Returns an array containing those elements in
+#     node.flatten that are of the given type (is_a? type returns true).
+#
+# node.mapChildren{|v| ...} -> Returns a new node with all children
+#     replaced according to the given block.
+#
+# Examples:
+#
+# node.filter(Setting).uniq -> Returns all of the settings that the AST's
+#     IfThenElse blocks depend on.
+#
+# node.filter(StructOffset).uniq -> Returns all of the structure offsets
+#     that the AST depends on.
+
+class Node
+    attr_reader :codeOrigin
+    
+    def initialize(codeOrigin)
+        @codeOrigin = codeOrigin
+    end
+    
+    def codeOriginString
+        "line number #{@codeOrigin}"
+    end
+    
+    def descendants
+        children.collect{|v| v.flatten}.flatten
+    end
+    
+    def flatten
+        [self] + descendants
+    end
+    
+    def filter(type)
+        flatten.select{|v| v.is_a? type}
+    end
+end
+
+class NoChildren < Node
+    def initialize(codeOrigin)
+        super(codeOrigin)
+    end
+    
+    def children
+        []
+    end
+    
+    def mapChildren
+        self
+    end
+end
+
+class StructOffsetKey
+    attr_reader :struct, :field
+    
+    def initialize(struct, field)
+        @struct = struct
+        @field = field
+    end
+    
+    def hash
+        @struct.hash + @field.hash * 3
+    end
+    
+    def eql?(other)
+        @struct == other.struct and @field == other.field
+    end
+end
+
+#
+# AST nodes.
+#
+
+class StructOffset < NoChildren
+    attr_reader :struct, :field
+    
+    def initialize(codeOrigin, struct, field)
+        super(codeOrigin)
+        @struct = struct
+        @field = field
+    end
+    
+    @@mapping = {}
+    
+    def self.forField(codeOrigin, struct, field)
+        key = StructOffsetKey.new(struct, field)
+        
+        unless @@mapping[key]
+            @@mapping[key] = StructOffset.new(codeOrigin, struct, field)
+        end
+        @@mapping[key]
+    end
+    
+    def dump
+        "#{struct}::#{field}"
+    end
+    
+    def <=>(other)
+        if @struct != other.struct
+            return @struct <=> other.struct
+        end
+        @field <=> other.field
+    end
+    
+    def address?
+        false
+    end
+    
+    def label?
+        false
+    end
+    
+    def immediate?
+        true
+    end
+    
+    def register?
+        false
+    end
+end
+
+class Sizeof < NoChildren
+    attr_reader :struct
+    
+    def initialize(codeOrigin, struct)
+        super(codeOrigin)
+        @struct = struct
+    end
+    
+    @@mapping = {}
+    
+    def self.forName(codeOrigin, struct)
+        unless @@mapping[struct]
+            @@mapping[struct] = Sizeof.new(codeOrigin, struct)
+        end
+        @@mapping[struct]
+    end
+    
+    def dump
+        "sizeof #{@struct}"
+    end
+    
+    def <=>(other)
+        @struct <=> other.struct
+    end
+    
+    def address?
+        false
+    end
+    
+    def label?
+        false
+    end
+    
+    def immediate?
+        true
+    end
+    
+    def register?
+        false
+    end
+end
+
+class Immediate < NoChildren
+    attr_reader :value
+    
+    def initialize(codeOrigin, value)
+        super(codeOrigin)
+        @value = value
+        raise "Bad immediate value #{value.inspect} at #{codeOriginString}" unless value.is_a? Integer
+    end
+    
+    def dump
+        "#{value}"
+    end
+    
+    def ==(other)
+        other.is_a? Immediate and other.value == @value
+    end
+    
+    def address?
+        false
+    end
+    
+    def label?
+        false
+    end
+    
+    def immediate?
+        true
+    end
+    
+    def register?
+        false
+    end
+end
+
+class AddImmediates < Node
+    attr_reader :left, :right
+    
+    def initialize(codeOrigin, left, right)
+        super(codeOrigin)
+        @left = left
+        @right = right
+    end
+    
+    def children
+        [@left, @right]
+    end
+    
+    def mapChildren
+        AddImmediates.new(codeOrigin, (yield @left), (yield @right))
+    end
+    
+    def dump
+        "(#{left.dump} + #{right.dump})"
+    end
+    
+    def address?
+        false
+    end
+    
+    def label?
+        false
+    end
+    
+    def immediate?
+        true
+    end
+    
+    def register?
+        false
+    end
+end
+
+class SubImmediates < Node
+    attr_reader :left, :right
+    
+    def initialize(codeOrigin, left, right)
+        super(codeOrigin)
+        @left = left
+        @right = right
+    end
+    
+    def children
+        [@left, @right]
+    end
+    
+    def mapChildren
+        SubImmediates.new(codeOrigin, (yield @left), (yield @right))
+    end
+    
+    def dump
+        "(#{left.dump} - #{right.dump})"
+    end
+    
+    def address?
+        false
+    end
+    
+    def label?
+        false
+    end
+    
+    def immediate?
+        true
+    end
+    
+    def register?
+        false
+    end
+end
+
+class MulImmediates < Node
+    attr_reader :left, :right
+    
+    def initialize(codeOrigin, left, right)
+        super(codeOrigin)
+        @left = left
+        @right = right
+    end
+    
+    def children
+        [@left, @right]
+    end
+    
+    def mapChildren
+        MulImmediates.new(codeOrigin, (yield @left), (yield @right))
+    end
+    
+    def dump
+        "(#{left.dump} * #{right.dump})"
+    end
+    
+    def address?
+        false
+    end
+    
+    def label?
+        false
+    end
+    
+    def immediate?
+        true
+    end
+    
+    def register?
+        false
+    end
+end
+
+class NegImmediate < Node
+    attr_reader :child
+    
+    def initialize(codeOrigin, child)
+        super(codeOrigin)
+        @child = child
+    end
+    
+    def children
+        [@child]
+    end
+    
+    def mapChildren
+        NegImmediate.new(codeOrigin, (yield @child))
+    end
+    
+    def dump
+        "(-#{@child.dump})"
+    end
+    
+    def address?
+        false
+    end
+    
+    def label?
+        false
+    end
+    
+    def immediate?
+        true
+    end
+    
+    def register?
+        false
+    end
+end
+
+class RegisterID < NoChildren
+    attr_reader :name
+    
+    def initialize(codeOrigin, name)
+        super(codeOrigin)
+        @name = name
+    end
+    
+    @@mapping = {}
+    
+    def self.forName(codeOrigin, name)
+        unless @@mapping[name]
+            @@mapping[name] = RegisterID.new(codeOrigin, name)
+        end
+        @@mapping[name]
+    end
+    
+    def dump
+        name
+    end
+    
+    def address?
+        false
+    end
+    
+    def label?
+        false
+    end
+    
+    def immediate?
+        false
+    end
+    
+    def register?
+        true
+    end
+end
+
+class FPRegisterID < NoChildren
+    attr_reader :name
+    
+    def initialize(codeOrigin, name)
+        super(codeOrigin)
+        @name = name
+    end
+    
+    @@mapping = {}
+    
+    def self.forName(codeOrigin, name)
+        unless @@mapping[name]
+            @@mapping[name] = FPRegisterID.new(codeOrigin, name)
+        end
+        @@mapping[name]
+    end
+    
+    def dump
+        name
+    end
+    
+    def address?
+        false
+    end
+    
+    def label?
+        false
+    end
+    
+    def immediate?
+        false
+    end
+    
+    def register?
+        true
+    end
+end
+
+class Variable < NoChildren
+    attr_reader :name
+    
+    def initialize(codeOrigin, name)
+        super(codeOrigin)
+        @name = name
+    end
+    
+    @@mapping = {}
+    
+    def self.forName(codeOrigin, name)
+        unless @@mapping[name]
+            @@mapping[name] = Variable.new(codeOrigin, name)
+        end
+        @@mapping[name]
+    end
+    
+    def dump
+        name
+    end
+end
+
+class Address < Node
+    attr_reader :base, :offset
+    
+    def initialize(codeOrigin, base, offset)
+        super(codeOrigin)
+        @base = base
+        @offset = offset
+        raise "Bad base for address #{base.inspect} at #{codeOriginString}" unless base.is_a? Variable or base.register?
+        raise "Bad offset for address #{offset.inspect} at #{codeOriginString}" unless offset.is_a? Variable or offset.immediate?
+    end
+    
+    def children
+        [@base, @offset]
+    end
+    
+    def mapChildren
+        Address.new(codeOrigin, (yield @base), (yield @offset))
+    end
+    
+    def dump
+        "#{offset.dump}[#{base.dump}]"
+    end
+    
+    def address?
+        true
+    end
+    
+    def label?
+        false
+    end
+    
+    def immediate?
+        false
+    end
+    
+    def register?
+        false
+    end
+end
+
+class BaseIndex < Node
+    attr_reader :base, :index, :scale, :offset
+    
+    def initialize(codeOrigin, base, index, scale, offset)
+        super(codeOrigin)
+        @base = base
+        @index = index
+        @scale = scale
+        raise unless [1, 2, 4, 8].member? @scale
+        @offset = offset
+    end
+    
+    def scaleShift
+        case scale
+        when 1
+            0
+        when 2
+            1
+        when 4
+            2
+        when 8
+            3
+        else
+            raise "Bad scale at #{codeOriginString}"
+        end
+    end
+    
+    def children
+        [@base, @index, @offset]
+    end
+    
+    def mapChildren
+        BaseIndex.new(codeOrigin, (yield @base), (yield @index), @scale, (yield @offset))
+    end
+    
+    def dump
+        "#{offset.dump}[#{base.dump}, #{index.dump}, #{scale}]"
+    end
+    
+    def address?
+        true
+    end
+    
+    def label?
+        false
+    end
+    
+    def immediate?
+        false
+    end
+    
+    def register?
+        false
+    end
+end
+
+class AbsoluteAddress < NoChildren
+    attr_reader :address
+    
+    def initialize(codeOrigin, address)
+        super(codeOrigin)
+        @address = address
+    end
+    
+    def dump
+        "#{address.dump}[]"
+    end
+    
+    def address?
+        true
+    end
+    
+    def label?
+        false
+    end
+    
+    def immediate?
+        false
+    end
+    
+    def register?
+        false
+    end
+end
+
+class Instruction < Node
+    attr_reader :opcode, :operands
+    
+    def initialize(codeOrigin, opcode, operands)
+        super(codeOrigin)
+        @opcode = opcode
+        @operands = operands
+    end
+    
+    def children
+        operands
+    end
+    
+    def mapChildren(&proc)
+        Instruction.new(codeOrigin, @opcode, @operands.map(&proc))
+    end
+    
+    def dump
+        "\t" + opcode.to_s + " " + operands.collect{|v| v.dump}.join(", ")
+    end
+end
+
+class Error < NoChildren
+    def initialize(codeOrigin)
+        super(codeOrigin)
+    end
+    
+    def dump
+        "\terror"
+    end
+end
+
+class ConstDecl < Node
+    attr_reader :variable, :value
+    
+    def initialize(codeOrigin, variable, value)
+        super(codeOrigin)
+        @variable = variable
+        @value = value
+    end
+    
+    def children
+        [@variable, @value]
+    end
+    
+    def mapChildren
+        ConstDecl.new(codeOrigin, (yield @variable), (yield @value))
+    end
+    
+    def dump
+        "const #{@variable.dump} = #{@value.dump}"
+    end
+end
+
+$labelMapping = {}
+
+class Label < NoChildren
+    attr_reader :name
+    
+    def initialize(codeOrigin, name)
+        super(codeOrigin)
+        @name = name
+    end
+    
+    def self.forName(codeOrigin, name)
+        if $labelMapping[name]
+            raise "Label name collision: #{name}" unless $labelMapping[name].is_a? Label
+        else
+            $labelMapping[name] = Label.new(codeOrigin, name)
+        end
+        $labelMapping[name]
+    end
+    
+    def dump
+        "#{name}:"
+    end
+end
+
+class LocalLabel < NoChildren
+    attr_reader :name
+    
+    def initialize(codeOrigin, name)
+        super(codeOrigin)
+        @name = name
+    end
+
+    @@uniqueNameCounter = 0
+    
+    def self.forName(codeOrigin, name)
+        if $labelMapping[name]
+            raise "Label name collision: #{name}" unless $labelMapping[name].is_a? LocalLabel
+        else
+            $labelMapping[name] = LocalLabel.new(codeOrigin, name)
+        end
+        $labelMapping[name]
+    end
+    
+    def self.unique(comment)
+        newName = "_#{comment}"
+        if $labelMapping[newName]
+            while $labelMapping[newName = "_#{@@uniqueNameCounter}_#{comment}"]
+                @@uniqueNameCounter += 1
+            end
+        end
+        forName(nil, newName)
+    end
+    
+    def cleanName
+        if name =~ /^\./
+            "_" + name[1..-1]
+        else
+            name
+        end
+    end
+    
+    def dump
+        "#{name}:"
+    end
+end
+
+class LabelReference < Node
+    attr_reader :label
+    
+    def initialize(codeOrigin, label)
+        super(codeOrigin)
+        @label = label
+    end
+    
+    def children
+        [@label]
+    end
+    
+    def mapChildren
+        LabelReference.new(codeOrigin, (yield @label))
+    end
+    
+    def name
+        label.name
+    end
+    
+    def dump
+        label.name
+    end
+    
+    def address?
+        false
+    end
+    
+    def label?
+        true
+    end
+end
+
+class LocalLabelReference < NoChildren
+    attr_reader :label
+    
+    def initialize(codeOrigin, label)
+        super(codeOrigin)
+        @label = label
+    end
+    
+    def children
+        [@label]
+    end
+    
+    def mapChildren
+        LocalLabelReference.new(codeOrigin, (yield @label))
+    end
+    
+    def name
+        label.name
+    end
+    
+    def dump
+        label.name
+    end
+    
+    def address?
+        false
+    end
+    
+    def label?
+        true
+    end
+end
+
+class Sequence < Node
+    attr_reader :list
+    
+    def initialize(codeOrigin, list)
+        super(codeOrigin)
+        @list = list
+    end
+    
+    def children
+        list
+    end
+    
+    def mapChildren(&proc)
+        Sequence.new(codeOrigin, @list.map(&proc))
+    end
+    
+    def dump
+        list.collect{|v| v.dump}.join("\n")
+    end
+end
+
+class True < NoChildren
+    def initialize
+        super(nil)
+    end
+    
+    @@instance = True.new
+    
+    def self.instance
+        @@instance
+    end
+    
+    def value
+        true
+    end
+    
+    def dump
+        "true"
+    end
+end
+
+class False < NoChildren
+    def initialize
+        super(nil)
+    end
+    
+    @@instance = False.new
+    
+    def self.instance
+        @@instance
+    end
+    
+    def value
+        false
+    end
+    
+    def dump
+        "false"
+    end
+end
+
+class TrueClass
+    def asNode
+        True.instance
+    end
+end
+
+class FalseClass
+    def asNode
+        False.instance
+    end
+end
+
+class Setting < NoChildren
+    attr_reader :name
+    
+    def initialize(codeOrigin, name)
+        super(codeOrigin)
+        @name = name
+    end
+    
+    @@mapping = {}
+    
+    def self.forName(codeOrigin, name)
+        unless @@mapping[name]
+            @@mapping[name] = Setting.new(codeOrigin, name)
+        end
+        @@mapping[name]
+    end
+    
+    def dump
+        name
+    end
+end
+
+class And < Node
+    attr_reader :left, :right
+    
+    def initialize(codeOrigin, left, right)
+        super(codeOrigin)
+        @left = left
+        @right = right
+    end
+    
+    def children
+        [@left, @right]
+    end
+    
+    def mapChildren
+        And.new(codeOrigin, (yield @left), (yield @right))
+    end
+    
+    def dump
+        "(#{left.dump} and #{right.dump})"
+    end
+end
+
+class Or < Node
+    attr_reader :left, :right
+    
+    def initialize(codeOrigin, left, right)
+        super(codeOrigin)
+        @left = left
+        @right = right
+    end
+    
+    def children
+        [@left, @right]
+    end
+    
+    def mapChildren
+        Or.new(codeOrigin, (yield @left), (yield @right))
+    end
+    
+    def dump
+        "(#{left.dump} or #{right.dump})"
+    end
+end
+
+class Not < Node
+    attr_reader :child
+    
+    def initialize(codeOrigin, child)
+        super(codeOrigin)
+        @child = child
+    end
+    
+    def children
+        [@left, @right]
+    end
+    
+    def mapChildren
+        Not.new(codeOrigin, (yield @child))
+    end
+    
+    def dump
+        "(not #{child.dump})"
+    end
+end
+
+class Skip < NoChildren
+    def initialize(codeOrigin)
+        super(codeOrigin)
+    end
+    
+    def dump
+        "\tskip"
+    end
+end
+
+class IfThenElse < Node
+    attr_reader :predicate, :thenCase
+    attr_accessor :elseCase
+    
+    def initialize(codeOrigin, predicate, thenCase)
+        super(codeOrigin)
+        @predicate = predicate
+        @thenCase = thenCase
+        @elseCase = Skip.new(codeOrigin)
+    end
+    
+    def children
+        if @elseCase
+            [@predicate, @thenCase, @elseCase]
+        else
+            [@predicate, @thenCase]
+        end
+    end
+    
+    def mapChildren
+        IfThenElse.new(codeOrigin, (yield @predicate), (yield @thenCase), (yield @elseCase))
+    end
+    
+    def dump
+        "if #{predicate.dump}\n" + thenCase.dump + "\nelse\n" + elseCase.dump + "\nend"
+    end
+end
+
+class Macro < Node
+    attr_reader :name, :variables, :body
+    
+    def initialize(codeOrigin, name, variables, body)
+        super(codeOrigin)
+        @name = name
+        @variables = variables
+        @body = body
+    end
+    
+    def children
+        @variables + [@body]
+    end
+    
+    def mapChildren
+        Macro.new(codeOrigin, @name, @variables.map{|v| yield v}, (yield @body))
+    end
+    
+    def dump
+        "macro #{name}(" + variables.collect{|v| v.dump}.join(", ") + ")\n" + body.dump + "\nend"
+    end
+end
+
+class MacroCall < Node
+    attr_reader :name, :operands
+    
+    def initialize(codeOrigin, name, operands)
+        super(codeOrigin)
+        @name = name
+        @operands = operands
+        raise unless @operands
+        @operands.each{|v| raise unless v}
+    end
+    
+    def children
+        @operands
+    end
+    
+    def mapChildren(&proc)
+        MacroCall.new(codeOrigin, @name, @operands.map(&proc))
+    end
+    
+    def dump
+        "\t#{name}(" + operands.collect{|v| v.dump}.join(", ") + ")"
+    end
+end
+
diff --git a/Source/JavaScriptCore/offlineasm/backends.rb b/Source/JavaScriptCore/offlineasm/backends.rb
new file mode 100644
index 000000000..2c65b517d
--- /dev/null
+++ b/Source/JavaScriptCore/offlineasm/backends.rb
@@ -0,0 +1,96 @@
+# Copyright (C) 2011 Apple Inc. All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions
+# are met:
+# 1. Redistributions of source code must retain the above copyright
+#    notice, this list of conditions and the following disclaimer.
+# 2. Redistributions in binary form must reproduce the above copyright
+#    notice, this list of conditions and the following disclaimer in the
+#    documentation and/or other materials provided with the distribution.
+#
+# THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+# THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+# PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+# BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+# CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+# SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+# INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+# CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+# ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+# THE POSSIBILITY OF SUCH DAMAGE.
+
+require "armv7"
+require "ast"
+require "x86"
+
+BACKENDS =
+    [
+     "X86",
+     "ARMv7"
+    ]
+
+# Keep the set of working backends separate from the set of backends that might be
+# supported. This is great because the BACKENDS list is almost like a reserved
+# words list, in that it causes settings resolution to treat those words specially.
+# Hence this lets us set aside the name of a backend we might want to support in
+# the future while not actually supporting the backend yet.
+WORKING_BACKENDS =
+    [
+     "X86",
+     "ARMv7"
+    ]
+
+BACKEND_PATTERN = Regexp.new('\\A(' + BACKENDS.join(')|(') + ')\\Z')
+
+class Node
+    def lower(name)
+        send("lower" + name)
+    end
+end
+
+# Overrides for lower() for those nodes that are backend-agnostic
+
+class Label
+    def lower(name)
+        $asm.putsLabel(self.name[1..-1])
+    end
+end
+
+class LocalLabel
+    def lower(name)
+        $asm.putsLocalLabel "_offlineasm_#{self.name[1..-1]}"
+    end
+end
+
+class LabelReference
+    def asmLabel
+        Assembler.labelReference(name[1..-1])
+    end
+end
+
+class LocalLabelReference
+    def asmLabel
+        Assembler.localLabelReference("_offlineasm_"+name[1..-1])
+    end
+end
+
+class Skip
+    def lower(name)
+    end
+end
+
+class Sequence
+    def lower(name)
+        if respond_to? "lower#{name}"
+            send("lower#{name}")
+        else
+            @list.each {
+                | node |
+                node.lower(name)
+            }
+        end
+    end
+end
+
diff --git a/Source/JavaScriptCore/offlineasm/generate_offset_extractor.rb b/Source/JavaScriptCore/offlineasm/generate_offset_extractor.rb
new file mode 100644
index 000000000..8bdf4505d
--- /dev/null
+++ b/Source/JavaScriptCore/offlineasm/generate_offset_extractor.rb
@@ -0,0 +1,146 @@
+#!/usr/bin/env ruby
+
+# Copyright (C) 2011 Apple Inc. All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions
+# are met:
+# 1. Redistributions of source code must retain the above copyright
+#    notice, this list of conditions and the following disclaimer.
+# 2. Redistributions in binary form must reproduce the above copyright
+#    notice, this list of conditions and the following disclaimer in the
+#    documentation and/or other materials provided with the distribution.
+#
+# THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+# THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+# PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+# BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+# CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+# SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+# INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+# CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+# ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+# THE POSSIBILITY OF SUCH DAMAGE.
+
+$: << File.dirname(__FILE__)
+
+require "backends"
+require "digest/sha1"
+require "offsets"
+require "parser"
+require "self_hash"
+require "settings"
+require "transform"
+
+inputFlnm = ARGV.shift
+outputFlnm = ARGV.shift
+
+$stderr.puts "offlineasm: Parsing #{inputFlnm} and creating offset extractor #{outputFlnm}."
+
+def emitMagicNumber
+    OFFSET_MAGIC_NUMBERS.each {
+        | number |
+        $output.puts "#{number},"
+    }
+end
+
+inputData = IO::read(inputFlnm)
+inputHash = "// offlineasm input hash: #{Digest::SHA1.hexdigest(inputData)} #{selfHash}"
+
+if FileTest.exist? outputFlnm
+    File.open(outputFlnm, "r") {
+        | inp |
+        firstLine = inp.gets
+        if firstLine and firstLine.chomp == inputHash
+            $stderr.puts "offlineasm: Nothing changed."
+            exit 0
+        end
+    }
+end
+
+originalAST = parse(lex(inputData))
+
+#
+# Optimize the AST to make configuration extraction faster. This reduces the AST to a form
+# that only contains the things that matter for our purposes: offsets, sizes, and if
+# statements.
+#
+
+class Node
+    def offsetsPruneTo(sequence)
+        children.each {
+            | child |
+            child.offsetsPruneTo(sequence)
+        }
+    end
+    
+    def offsetsPrune
+        result = Sequence.new(codeOrigin, [])
+        offsetsPruneTo(result)
+        result
+    end
+end
+
+class IfThenElse
+    def offsetsPruneTo(sequence)
+        ifThenElse = IfThenElse.new(codeOrigin, predicate, thenCase.offsetsPrune)
+        ifThenElse.elseCase = elseCase.offsetsPrune
+        sequence.list << ifThenElse
+    end
+end
+
+class StructOffset
+    def offsetsPruneTo(sequence)
+        sequence.list << self
+    end
+end
+
+class Sizeof
+    def offsetsPruneTo(sequence)
+        sequence.list << self
+    end
+end
+
+prunedAST = originalAST.offsetsPrune
+
+File.open(outputFlnm, "w") {
+    | outp |
+    $output = outp
+    outp.puts inputHash
+    length = 0
+    emitCodeInAllConfigurations(prunedAST) {
+        | settings, ast, backend, index |
+        offsetsList = ast.filter(StructOffset).uniq.sort
+        sizesList = ast.filter(Sizeof).uniq.sort
+        length += OFFSET_HEADER_MAGIC_NUMBERS.size + (OFFSET_MAGIC_NUMBERS.size + 1) * (1 + offsetsList.size + sizesList.size)
+    }
+    outp.puts "static const unsigned extractorTable[#{length}] = {"
+    emitCodeInAllConfigurations(prunedAST) {
+        | settings, ast, backend, index |
+        OFFSET_HEADER_MAGIC_NUMBERS.each {
+            | number |
+            $output.puts "#{number},"
+        }
+
+        offsetsList = ast.filter(StructOffset).uniq.sort
+        sizesList = ast.filter(Sizeof).uniq.sort
+        
+        emitMagicNumber
+        outp.puts "#{index},"
+        offsetsList.each {
+            | offset |
+            emitMagicNumber
+            outp.puts "OFFLINE_ASM_OFFSETOF(#{offset.struct}, #{offset.field}),"
+        }
+        sizesList.each {
+            | offset |
+            emitMagicNumber
+            outp.puts "sizeof(#{offset.struct}),"
+        }
+    }
+    outp.puts "};"
+}
+
+$stderr.puts "offlineasm: offset extractor #{outputFlnm} successfully generated."
+
diff --git a/Source/JavaScriptCore/offlineasm/instructions.rb b/Source/JavaScriptCore/offlineasm/instructions.rb
new file mode 100644
index 000000000..497b47371
--- /dev/null
+++ b/Source/JavaScriptCore/offlineasm/instructions.rb
@@ -0,0 +1,217 @@
+# Copyright (C) 2011 Apple Inc. All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions
+# are met:
+# 1. Redistributions of source code must retain the above copyright
+#    notice, this list of conditions and the following disclaimer.
+# 2. Redistributions in binary form must reproduce the above copyright
+#    notice, this list of conditions and the following disclaimer in the
+#    documentation and/or other materials provided with the distribution.
+#
+# THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+# THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+# PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+# BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+# CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+# SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+# INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+# CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+# ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+# THE POSSIBILITY OF SUCH DAMAGE.
+
+# Interesting invariant, which we take advantage of: branching instructions
+# always begin with "b", and no non-branching instructions begin with "b".
+# Terminal instructions are "jmp" and "ret".
+
+MACRO_INSTRUCTIONS =
+    [
+     "addi",
+     "andi",
+     "lshifti",
+     "muli",
+     "negi",
+     "noti",
+     "ori",
+     "rshifti",
+     "urshifti",
+     "subi",
+     "xori",
+     "loadi",
+     "loadb",
+     "loadbs",
+     "loadh",
+     "loadhs",
+     "storei",
+     "storeb",
+     "loadd",
+     "moved",
+     "stored",
+     "addd",
+     "divd",
+     "subd",
+     "muld",
+     "sqrtd",
+     "ci2d",
+     "fii2d", # usage: fii2d <gpr with least significant bits>, <gpr with most significant bits>, <fpr>
+     "fd2ii", # usage: fd2ii <fpr>, <gpr with least significant bits>, <gpr with most significant bits>
+     "bdeq",
+     "bdneq",
+     "bdgt",
+     "bdgteq",
+     "bdlt",
+     "bdlteq",
+     "bdequn",
+     "bdnequn",
+     "bdgtun",
+     "bdgtequn",
+     "bdltun",
+     "bdltequn",
+     "btd2i",
+     "td2i",
+     "bcd2i",
+     "movdz",
+     "pop",
+     "push",
+     "move",
+     "sxi2p",
+     "zxi2p",
+     "nop",
+     "bieq",
+     "bineq",
+     "bia",
+     "biaeq",
+     "bib",
+     "bibeq",
+     "bigt",
+     "bigteq",
+     "bilt",
+     "bilteq",
+     "bbeq",
+     "bbneq",
+     "bba",
+     "bbaeq",
+     "bbb",
+     "bbbeq",
+     "bbgt",
+     "bbgteq",
+     "bblt",
+     "bblteq",
+     "btio",
+     "btis",
+     "btiz",
+     "btinz",
+     "btbo",
+     "btbs",
+     "btbz",
+     "btbnz",
+     "jmp",
+     "baddio",
+     "baddis",
+     "baddiz",
+     "baddinz",
+     "bsubio",
+     "bsubis",
+     "bsubiz",
+     "bsubinz",
+     "bmulio",
+     "bmulis",
+     "bmuliz",
+     "bmulinz",
+     "borio",
+     "boris",
+     "boriz",
+     "borinz",
+     "break",
+     "call",
+     "ret",
+     "cieq",
+     "cineq",
+     "cia",
+     "ciaeq",
+     "cib",
+     "cibeq",
+     "cigt",
+     "cigteq",
+     "cilt",
+     "cilteq",
+     "tio",
+     "tis",
+     "tiz",
+     "tinz",
+     "tbo",
+     "tbs",
+     "tbz",
+     "tbnz",
+     "peek",
+     "poke",
+     "bpeq",
+     "bpneq",
+     "bpa",
+     "bpaeq",
+     "bpb",
+     "bpbeq",
+     "bpgt",
+     "bpgteq",
+     "bplt",
+     "bplteq",
+     "addp",
+     "andp",
+     "orp",
+     "subp",
+     "xorp",
+     "loadp",
+     "cpeq",
+     "cpneq",
+     "cpa",
+     "cpaeq",
+     "cpb",
+     "cpbeq",
+     "cpgt",
+     "cpgteq",
+     "cplt",
+     "cplteq",
+     "storep",
+     "btpo",
+     "btps",
+     "btpz",
+     "btpnz",
+     "baddpo",
+     "baddps",
+     "baddpz",
+     "baddpnz",
+     "bo",
+     "bs",
+     "bz",
+     "bnz",
+     "leai",
+     "leap",
+    ]
+
+X86_INSTRUCTIONS =
+    [
+     "cdqi",
+     "idivi"
+    ]
+
+ARMv7_INSTRUCTIONS =
+    [
+     "smulli",
+     "addis",
+     "subis",
+     "oris"
+    ]
+
+INSTRUCTIONS = MACRO_INSTRUCTIONS + X86_INSTRUCTIONS + ARMv7_INSTRUCTIONS
+
+INSTRUCTION_PATTERN = Regexp.new('\\A((' + INSTRUCTIONS.join(')|(') + '))\\Z')
+
+def isBranch(instruction)
+    instruction =~ /^b/
+end
+
+def hasFallThrough(instruction)
+    instruction != "ret" and instruction != "jmp"
+end
+
diff --git a/Source/JavaScriptCore/offlineasm/offsets.rb b/Source/JavaScriptCore/offlineasm/offsets.rb
new file mode 100644
index 000000000..21e1706d2
--- /dev/null
+++ b/Source/JavaScriptCore/offlineasm/offsets.rb
@@ -0,0 +1,173 @@
+# Copyright (C) 2011 Apple Inc. All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions
+# are met:
+# 1. Redistributions of source code must retain the above copyright
+#    notice, this list of conditions and the following disclaimer.
+# 2. Redistributions in binary form must reproduce the above copyright
+#    notice, this list of conditions and the following disclaimer in the
+#    documentation and/or other materials provided with the distribution.
+#
+# THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+# THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+# PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+# BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+# CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+# SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+# INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+# CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+# ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+# THE POSSIBILITY OF SUCH DAMAGE.
+
+require "ast"
+
+OFFSET_HEADER_MAGIC_NUMBERS = [ 0x9e43fd66, 0x4379bfba ]
+OFFSET_MAGIC_NUMBERS = [ 0xec577ac7, 0x0ff5e755 ]
+
+#
+# offsetsList(ast)
+# sizesList(ast)
+#
+# Returns a list of offsets and sizes used by the AST.
+#
+
+def offsetsList(ast)
+    ast.filter(StructOffset).uniq.sort
+end
+
+def sizesList(ast)
+    ast.filter(Sizeof).uniq.sort
+end
+
+#
+# offsetsAndConfigurationIndex(ast, file) ->
+#     [[offsets, index], ...]
+#
+# Parses the offsets from a file and returns a list of offsets and the
+# index of the configuration that is valid in this build target.
+#
+
+def offsetsAndConfigurationIndex(file)
+    endiannessMarkerBytes = nil
+    result = []
+    
+    def readInt(endianness, bytes)
+        if endianness == :little
+            # Little endian
+            (bytes[0] << 0 |
+             bytes[1] << 8 |
+             bytes[2] << 16 |
+             bytes[3] << 24)
+        else
+            # Big endian
+            (bytes[0] << 24 |
+             bytes[1] << 16 |
+             bytes[2] << 8 |
+             bytes[3] << 0)
+        end
+    end
+    
+    def prepareMagic(endianness, numbers)
+        magicBytes = []
+        numbers.each {
+            | number |
+            currentBytes = []
+            4.times {
+                currentBytes << (number & 0xff)
+                number >>= 8
+            }
+            if endianness == :big
+                currentBytes.reverse!
+            end
+            magicBytes += currentBytes
+        }
+        magicBytes
+    end
+    
+    fileBytes = []
+    
+    File.open(file, "r") {
+        | inp |
+        loop {
+            byte = inp.getbyte
+            break unless byte
+            fileBytes << byte
+        }
+    }
+    
+    def sliceByteArrays(byteArray, pattern)
+        result = []
+        lastSlicePoint = 0
+        (byteArray.length - pattern.length + 1).times {
+            | index |
+            foundOne = true
+            pattern.length.times {
+                | subIndex |
+                if byteArray[index + subIndex] != pattern[subIndex]
+                    foundOne = false
+                    break
+                end
+            }
+            if foundOne
+                result << byteArray[lastSlicePoint...index]
+                lastSlicePoint = index + pattern.length
+            end
+        }
+        
+        result << byteArray[lastSlicePoint...(byteArray.length)]
+        
+        result
+    end
+    
+    [:little, :big].each {
+        | endianness |
+        headerMagicBytes = prepareMagic(endianness, OFFSET_HEADER_MAGIC_NUMBERS)
+        magicBytes = prepareMagic(endianness, OFFSET_MAGIC_NUMBERS)
+        
+        bigArray = sliceByteArrays(fileBytes, headerMagicBytes)
+        unless bigArray.size <= 1
+            bigArray[1..-1].each {
+                | configArray |
+                array = sliceByteArrays(configArray, magicBytes)
+                index = readInt(endianness, array[1])
+                offsets = []
+                array[2..-1].each {
+                    | data |
+                    offsets << readInt(endianness, data)
+                }
+                result << [offsets, index]
+            }
+        end
+    }
+    
+    raise unless result.length >= 1
+    raise if result.map{|v| v[1]}.uniq.size < result.map{|v| v[1]}.size
+    
+    result
+end
+
+#
+# buildOffsetsMap(ast, offsetsList) -> [offsets, sizes]
+#
+# Builds a mapping between StructOffset nodes and their values.
+#
+
+def buildOffsetsMap(ast, offsetsList)
+    offsetsMap = {}
+    sizesMap = {}
+    astOffsetsList = offsetsList(ast)
+    astSizesList = sizesList(ast)
+    raise unless astOffsetsList.size + astSizesList.size == offsetsList.size
+    offsetsList(ast).each_with_index {
+        | structOffset, index |
+        offsetsMap[structOffset] = offsetsList.shift
+    }
+    sizesList(ast).each_with_index {
+        | sizeof, index |
+        sizesMap[sizeof] = offsetsList.shift
+    }
+    [offsetsMap, sizesMap]
+end
+
diff --git a/Source/JavaScriptCore/offlineasm/opt.rb b/Source/JavaScriptCore/offlineasm/opt.rb
new file mode 100644
index 000000000..3170d3ae1
--- /dev/null
+++ b/Source/JavaScriptCore/offlineasm/opt.rb
@@ -0,0 +1,134 @@
+# Copyright (C) 2011 Apple Inc. All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions
+# are met:
+# 1. Redistributions of source code must retain the above copyright
+#    notice, this list of conditions and the following disclaimer.
+# 2. Redistributions in binary form must reproduce the above copyright
+#    notice, this list of conditions and the following disclaimer in the
+#    documentation and/or other materials provided with the distribution.
+#
+# THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+# THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+# PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+# BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+# CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+# SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+# INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+# CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+# ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+# THE POSSIBILITY OF SUCH DAMAGE.
+
+require "ast"
+
+#
+# "Optimization" passes. These are used to lower the representation for
+# backends that cannot handle some of our higher-level instructions.
+#
+
+#
+# A temporary - a variable that will be allocated to a register after we're
+# done.
+#
+
+class Node
+    def replaceTemporariesWithRegisters(kind)
+        mapChildren {
+            | node |
+            node.replaceTemporariesWithRegisters(kind)
+        }
+    end
+end
+
+class Tmp < NoChildren
+    attr_reader :firstMention, :lastMention
+    attr_reader :kind
+    attr_accessor :register
+
+    def initialize(codeOrigin, kind)
+        super(codeOrigin)
+        @kind = kind
+    end
+    
+    def dump
+        "$tmp#{object_id}"
+    end
+    
+    def mention!(position)
+        if not @firstMention or position < @firstMention
+            @firstMention = position
+        end
+        if not @lastMention or position > @lastMention
+            @lastMention = position
+        end
+    end
+    
+    def replaceTemporariesWithRegisters(kind)
+        if @kind == kind
+            raise "Did not allocate register to temporary at #{codeOriginString}" unless @register
+            @register
+        else
+            self
+        end
+    end
+    
+    def address?
+        false
+    end
+    
+    def label?
+        false
+    end
+    
+    def immediate?
+        false
+    end
+    
+    def register?
+        true
+    end
+end
+
+# Assign registers to temporaries, by finding which temporaries interfere
+# with each other. Note that this relies on temporary live ranges not crossing
+# basic block boundaries.
+
+def assignRegistersToTemporaries(list, kind, registers)
+    list.each_with_index {
+        | node, index |
+        node.filter(Tmp).uniq.each {
+            | tmp |
+            if tmp.kind == kind
+                tmp.mention! index
+            end
+        }
+    }
+    
+    freeRegisters = registers.dup
+    list.each_with_index {
+        | node, index |
+        tmpList = node.filter(Tmp).uniq
+        tmpList.each {
+            | tmp |
+            if tmp.kind == kind and tmp.firstMention == index
+                raise "Could not allocate register to temporary at #{node.codeOriginString}" if freeRegisters.empty?
+                tmp.register = freeRegisters.pop
+            end
+        }
+        tmpList.each {
+            | tmp |
+            if tmp.kind == kind and tmp.lastMention == index
+                freeRegisters.push tmp.register
+                raise "Register allocation inconsistency at #{node.codeOriginString}" if freeRegisters.size > registers.size
+            end
+        }
+    }
+    
+    list.map {
+        | node |
+        node.replaceTemporariesWithRegisters(kind)
+    }
+end
+
diff --git a/Source/JavaScriptCore/offlineasm/parser.rb b/Source/JavaScriptCore/offlineasm/parser.rb
new file mode 100644
index 000000000..f0e4b0045
--- /dev/null
+++ b/Source/JavaScriptCore/offlineasm/parser.rb
@@ -0,0 +1,586 @@
+# Copyright (C) 2011 Apple Inc. All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions
+# are met:
+# 1. Redistributions of source code must retain the above copyright
+#    notice, this list of conditions and the following disclaimer.
+# 2. Redistributions in binary form must reproduce the above copyright
+#    notice, this list of conditions and the following disclaimer in the
+#    documentation and/or other materials provided with the distribution.
+#
+# THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+# THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+# PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+# BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+# CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+# SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+# INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+# CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+# ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+# THE POSSIBILITY OF SUCH DAMAGE.
+
+require "ast"
+require "instructions"
+require "registers"
+
+class Token
+    attr_reader :codeOrigin, :string
+    
+    def initialize(codeOrigin, string)
+        @codeOrigin = codeOrigin
+        @string = string
+    end
+    
+    def ==(other)
+        if other.is_a? Token
+            @string == other.string
+        else
+            @string == other
+        end
+    end
+    
+    def =~(other)
+        @string =~ other
+    end
+    
+    def to_s
+        "#{@string.inspect} at line #{codeOrigin}"
+    end
+    
+    def parseError(*comment)
+        if comment.empty?
+            raise "Parse error: #{to_s}"
+        else
+            raise "Parse error: #{to_s}: #{comment[0]}"
+        end
+    end
+end
+
+#
+# The lexer. Takes a string and returns an array of tokens.
+#
+
+def lex(str)
+    result = []
+    lineNumber = 1
+    while not str.empty?
+        case str
+        when /\A\#([^\n]*)/
+            # comment, ignore
+        when /\A\n/
+            result << Token.new(lineNumber, $&)
+            lineNumber += 1
+        when /\A[a-zA-Z]([a-zA-Z0-9_]*)/
+            result << Token.new(lineNumber, $&)
+        when /\A\.([a-zA-Z0-9_]*)/
+            result << Token.new(lineNumber, $&)
+        when /\A_([a-zA-Z0-9_]*)/
+            result << Token.new(lineNumber, $&)
+        when /\A([ \t]+)/
+            # whitespace, ignore
+        when /\A0x([0-9a-fA-F]+)/
+            result << Token.new(lineNumber, $&.hex.to_s)
+        when /\A0([0-7]+)/
+            result << Token.new(lineNumber, $&.oct.to_s)
+        when /\A([0-9]+)/
+            result << Token.new(lineNumber, $&)
+        when /\A::/
+            result << Token.new(lineNumber, $&)
+        when /\A[:,\(\)\[\]=\+\-*]/
+            result << Token.new(lineNumber, $&)
+        else
+            raise "Lexer error at line number #{lineNumber}, unexpected sequence #{str[0..20].inspect}"
+        end
+        str = $~.post_match
+    end
+    result
+end
+
+#
+# Token identification.
+#
+
+def isRegister(token)
+    token =~ REGISTER_PATTERN
+end
+
+def isInstruction(token)
+    token =~ INSTRUCTION_PATTERN
+end
+
+def isKeyword(token)
+    token =~ /\A((true)|(false)|(if)|(then)|(else)|(elsif)|(end)|(and)|(or)|(not)|(macro)|(const)|(sizeof)|(error))\Z/ or
+        token =~ REGISTER_PATTERN or
+        token =~ INSTRUCTION_PATTERN
+end
+
+def isIdentifier(token)
+    token =~ /\A[a-zA-Z]([a-zA-Z0-9_]*)\Z/ and not isKeyword(token)
+end
+
+def isLabel(token)
+    token =~ /\A_([a-zA-Z0-9_]*)\Z/
+end
+
+def isLocalLabel(token)
+    token =~ /\A\.([a-zA-Z0-9_]*)\Z/
+end
+
+def isVariable(token)
+    isIdentifier(token) or isRegister(token)
+end
+
+def isInteger(token)
+    token =~ /\A[0-9]/
+end
+
+#
+# The parser. Takes an array of tokens and returns an AST. Methods
+# other than parse(tokens) are not for public consumption.
+#
+
+class Parser
+    def initialize(tokens)
+        @tokens = tokens
+        @idx = 0
+    end
+    
+    def parseError(*comment)
+        if @tokens[@idx]
+            @tokens[@idx].parseError(*comment)
+        else
+            if comment.empty?
+                raise "Parse error at end of file"
+            else
+                raise "Parse error at end of file: #{comment[0]}"
+            end
+        end
+    end
+    
+    def consume(regexp)
+        if regexp
+            parseError unless @tokens[@idx] =~ regexp
+        else
+            parseError unless @idx == @tokens.length
+        end
+        @idx += 1
+    end
+    
+    def skipNewLine
+        while @tokens[@idx] == "\n"
+            @idx += 1
+        end
+    end
+    
+    def parsePredicateAtom
+        if @tokens[@idx] == "not"
+            @idx += 1
+            parsePredicateAtom
+        elsif @tokens[@idx] == "("
+            @idx += 1
+            skipNewLine
+            result = parsePredicate
+            parseError unless @tokens[@idx] == ")"
+            @idx += 1
+            result
+        elsif @tokens[@idx] == "true"
+            result = True.instance
+            @idx += 1
+            result
+        elsif @tokens[@idx] == "false"
+            result = False.instance
+            @idx += 1
+            result
+        elsif isIdentifier @tokens[@idx]
+            result = Setting.forName(@tokens[@idx].codeOrigin, @tokens[@idx].string)
+            @idx += 1
+            result
+        else
+            parseError
+        end
+    end
+    
+    def parsePredicateAnd
+        result = parsePredicateAtom
+        while @tokens[@idx] == "and"
+            codeOrigin = @tokens[@idx].codeOrigin
+            @idx += 1
+            skipNewLine
+            right = parsePredicateAtom
+            result = And.new(codeOrigin, result, right)
+        end
+        result
+    end
+    
+    def parsePredicate
+        # some examples of precedence:
+        # not a and b -> (not a) and b
+        # a and b or c -> (a and b) or c
+        # a or b and c -> a or (b and c)
+        
+        result = parsePredicateAnd
+        while @tokens[@idx] == "or"
+            codeOrigin = @tokens[@idx].codeOrigin
+            @idx += 1
+            skipNewLine
+            right = parsePredicateAnd
+            result = Or.new(codeOrigin, result, right)
+        end
+        result
+    end
+    
+    def parseVariable
+        if isRegister(@tokens[@idx])
+            if @tokens[@idx] =~ FPR_PATTERN
+                result = FPRegisterID.forName(@tokens[@idx].codeOrigin, @tokens[@idx].string)
+            else
+                result = RegisterID.forName(@tokens[@idx].codeOrigin, @tokens[@idx].string)
+            end
+        elsif isIdentifier(@tokens[@idx])
+            result = Variable.forName(@tokens[@idx].codeOrigin, @tokens[@idx].string)
+        else
+            parseError
+        end
+        @idx += 1
+        result
+    end
+    
+    def parseAddress(offset)
+        parseError unless @tokens[@idx] == "["
+        codeOrigin = @tokens[@idx].codeOrigin
+        
+        # Three possibilities:
+        # []       -> AbsoluteAddress
+        # [a]      -> Address
+        # [a,b]    -> BaseIndex with scale = 1
+        # [a,b,c]  -> BaseIndex
+        
+        @idx += 1
+        if @tokens[@idx] == "]"
+            @idx += 1
+            return AbsoluteAddress.new(codeOrigin, offset)
+        end
+        a = parseVariable
+        if @tokens[@idx] == "]"
+            result = Address.new(codeOrigin, a, offset)
+        else
+            parseError unless @tokens[@idx] == ","
+            @idx += 1
+            b = parseVariable
+            if @tokens[@idx] == "]"
+                result = BaseIndex.new(codeOrigin, a, b, 1, offset)
+            else
+                parseError unless @tokens[@idx] == ","
+                @idx += 1
+                parseError unless ["1", "2", "4", "8"].member? @tokens[@idx].string
+                c = @tokens[@idx].string.to_i
+                @idx += 1
+                parseError unless @tokens[@idx] == "]"
+                result = BaseIndex.new(codeOrigin, a, b, c, offset)
+            end
+        end
+        @idx += 1
+        result
+    end
+    
+    def parseColonColon
+        skipNewLine
+        codeOrigin = @tokens[@idx].codeOrigin
+        parseError unless isIdentifier @tokens[@idx]
+        names = [@tokens[@idx].string]
+        @idx += 1
+        while @tokens[@idx] == "::"
+            @idx += 1
+            parseError unless isIdentifier @tokens[@idx]
+            names << @tokens[@idx].string
+            @idx += 1
+        end
+        raise if names.empty?
+        [codeOrigin, names]
+    end
+    
+    def parseExpressionAtom
+        skipNewLine
+        if @tokens[@idx] == "-"
+            @idx += 1
+            NegImmediate.new(@tokens[@idx - 1].codeOrigin, parseExpressionAtom)
+        elsif @tokens[@idx] == "("
+            @idx += 1
+            result = parseExpression
+            parseError unless @tokens[@idx] == ")"
+            @idx += 1
+            result
+        elsif isInteger @tokens[@idx]
+            result = Immediate.new(@tokens[@idx].codeOrigin, @tokens[@idx].string.to_i)
+            @idx += 1
+            result
+        elsif isIdentifier @tokens[@idx]
+            codeOrigin, names = parseColonColon
+            if names.size > 1
+                StructOffset.forField(codeOrigin, names[0..-2].join('::'), names[-1])
+            else
+                Variable.forName(codeOrigin, names[0])
+            end
+        elsif isRegister @tokens[@idx]
+            parseVariable
+        elsif @tokens[@idx] == "sizeof"
+            @idx += 1
+            codeOrigin, names = parseColonColon
+            Sizeof.forName(codeOrigin, names.join('::'))
+        else
+            parseError
+        end
+    end
+    
+    def parseExpressionMul
+        skipNewLine
+        result = parseExpressionAtom
+        while @tokens[@idx] == "*"
+            if @tokens[@idx] == "*"
+                @idx += 1
+                result = MulImmediates.new(@tokens[@idx - 1].codeOrigin, result, parseExpressionAtom)
+            else
+                raise
+            end
+        end
+        result
+    end
+    
+    def couldBeExpression
+        @tokens[@idx] == "-" or @tokens[@idx] == "sizeof" or isInteger(@tokens[@idx]) or isVariable(@tokens[@idx]) or @tokens[@idx] == "("
+    end
+    
+    def parseExpression
+        skipNewLine
+        result = parseExpressionMul
+        while @tokens[@idx] == "+" or @tokens[@idx] == "-"
+            if @tokens[@idx] == "+"
+                @idx += 1
+                result = AddImmediates.new(@tokens[@idx - 1].codeOrigin, result, parseExpressionMul)
+            elsif @tokens[@idx] == "-"
+                @idx += 1
+                result = SubImmediates.new(@tokens[@idx - 1].codeOrigin, result, parseExpressionMul)
+            else
+                raise
+            end
+        end
+        result
+    end
+    
+    def parseOperand(comment)
+        skipNewLine
+        if couldBeExpression
+            expr = parseExpression
+            if @tokens[@idx] == "["
+                parseAddress(expr)
+            else
+                expr
+            end
+        elsif @tokens[@idx] == "["
+            parseAddress(Immediate.new(@tokens[@idx].codeOrigin, 0))
+        elsif isLabel @tokens[@idx]
+            result = LabelReference.new(@tokens[@idx].codeOrigin, Label.forName(@tokens[@idx].codeOrigin, @tokens[@idx].string))
+            @idx += 1
+            result
+        elsif isLocalLabel @tokens[@idx]
+            result = LocalLabelReference.new(@tokens[@idx].codeOrigin, LocalLabel.forName(@tokens[@idx].codeOrigin, @tokens[@idx].string))
+            @idx += 1
+            result
+        else
+            parseError(comment)
+        end
+    end
+    
+    def parseMacroVariables
+        skipNewLine
+        consume(/\A\(\Z/)
+        variables = []
+        loop {
+            skipNewLine
+            if @tokens[@idx] == ")"
+                @idx += 1
+                break
+            elsif isIdentifier(@tokens[@idx])
+                variables << Variable.forName(@tokens[@idx].codeOrigin, @tokens[@idx].string)
+                @idx += 1
+                skipNewLine
+                if @tokens[@idx] == ")"
+                    @idx += 1
+                    break
+                elsif @tokens[@idx] == ","
+                    @idx += 1
+                else
+                    parseError
+                end
+            else
+                parseError
+            end
+        }
+        variables
+    end
+    
+    def parseSequence(final, comment)
+        firstCodeOrigin = @tokens[@idx].codeOrigin
+        list = []
+        loop {
+            if (@idx == @tokens.length and not final) or (final and @tokens[@idx] =~ final)
+                break
+            elsif @tokens[@idx] == "\n"
+                # ignore
+                @idx += 1
+            elsif @tokens[@idx] == "const"
+                @idx += 1
+                parseError unless isVariable @tokens[@idx]
+                variable = Variable.forName(@tokens[@idx].codeOrigin, @tokens[@idx].string)
+                @idx += 1
+                parseError unless @tokens[@idx] == "="
+                @idx += 1
+                value = parseOperand("while inside of const #{variable.name}")
+                list << ConstDecl.new(@tokens[@idx].codeOrigin, variable, value)
+            elsif @tokens[@idx] == "error"
+                list << Error.new(@tokens[@idx].codeOrigin)
+                @idx += 1
+            elsif @tokens[@idx] == "if"
+                codeOrigin = @tokens[@idx].codeOrigin
+                @idx += 1
+                skipNewLine
+                predicate = parsePredicate
+                consume(/\A((then)|(\n))\Z/)
+                skipNewLine
+                ifThenElse = IfThenElse.new(codeOrigin, predicate, parseSequence(/\A((else)|(end)|(elsif))\Z/, "while inside of \"if #{predicate.dump}\""))
+                list << ifThenElse
+                while @tokens[@idx] == "elsif"
+                    codeOrigin = @tokens[@idx].codeOrigin
+                    @idx += 1
+                    skipNewLine
+                    predicate = parsePredicate
+                    consume(/\A((then)|(\n))\Z/)
+                    skipNewLine
+                    elseCase = IfThenElse.new(codeOrigin, predicate, parseSequence(/\A((else)|(end)|(elsif))\Z/, "while inside of \"if #{predicate.dump}\""))
+                    ifThenElse.elseCase = elseCase
+                    ifThenElse = elseCase
+                end
+                if @tokens[@idx] == "else"
+                    @idx += 1
+                    ifThenElse.elseCase = parseSequence(/\Aend\Z/, "while inside of else case for \"if #{predicate.dump}\"")
+                    @idx += 1
+                else
+                    parseError unless @tokens[@idx] == "end"
+                    @idx += 1
+                end
+            elsif @tokens[@idx] == "macro"
+                codeOrigin = @tokens[@idx].codeOrigin
+                @idx += 1
+                skipNewLine
+                parseError unless isIdentifier(@tokens[@idx])
+                name = @tokens[@idx].string
+                @idx += 1
+                variables = parseMacroVariables
+                body = parseSequence(/\Aend\Z/, "while inside of macro #{name}")
+                @idx += 1
+                list << Macro.new(codeOrigin, name, variables, body)
+            elsif isInstruction @tokens[@idx]
+                codeOrigin = @tokens[@idx].codeOrigin
+                name = @tokens[@idx].string
+                @idx += 1
+                if (not final and @idx == @tokens.size) or (final and @tokens[@idx] =~ final)
+                    # Zero operand instruction, and it's the last one.
+                    list << Instruction.new(codeOrigin, name, [])
+                    break
+                elsif @tokens[@idx] == "\n"
+                    # Zero operand instruction.
+                    list << Instruction.new(codeOrigin, name, [])
+                    @idx += 1
+                else
+                    # It's definitely an instruction, and it has at least one operand.
+                    operands = []
+                    endOfSequence = false
+                    loop {
+                        operands << parseOperand("while inside of instruction #{name}")
+                        if (not final and @idx == @tokens.size) or (final and @tokens[@idx] =~ final)
+                            # The end of the instruction and of the sequence.
+                            endOfSequence = true
+                            break
+                        elsif @tokens[@idx] == ","
+                            # Has another operand.
+                            @idx += 1
+                        elsif @tokens[@idx] == "\n"
+                            # The end of the instruction.
+                            @idx += 1
+                            break
+                        else
+                            parseError("Expected a comma, newline, or #{final} after #{operands.last.dump}")
+                        end
+                    }
+                    list << Instruction.new(codeOrigin, name, operands)
+                    if endOfSequence
+                        break
+                    end
+                end
+            elsif isIdentifier @tokens[@idx]
+                codeOrigin = @tokens[@idx].codeOrigin
+                name = @tokens[@idx].string
+                @idx += 1
+                if @tokens[@idx] == "("
+                    # Macro invocation.
+                    @idx += 1
+                    operands = []
+                    skipNewLine
+                    if @tokens[@idx] == ")"
+                        @idx += 1
+                    else
+                        loop {
+                            skipNewLine
+                            if @tokens[@idx] == "macro"
+                                # It's a macro lambda!
+                                codeOriginInner = @tokens[@idx].codeOrigin
+                                @idx += 1
+                                variables = parseMacroVariables
+                                body = parseSequence(/\Aend\Z/, "while inside of anonymous macro passed as argument to #{name}")
+                                @idx += 1
+                                operands << Macro.new(codeOriginInner, nil, variables, body)
+                            else
+                                operands << parseOperand("while inside of macro call to #{name}")
+                            end
+                            skipNewLine
+                            if @tokens[@idx] == ")"
+                                @idx += 1
+                                break
+                            elsif @tokens[@idx] == ","
+                                @idx += 1
+                            else
+                                parseError "Unexpected #{@tokens[@idx].string.inspect} while parsing invocation of macro #{name}"
+                            end
+                        }
+                    end
+                    list << MacroCall.new(codeOrigin, name, operands)
+                else
+                    parseError "Expected \"(\" after #{name}"
+                end
+            elsif isLabel @tokens[@idx] or isLocalLabel @tokens[@idx]
+                codeOrigin = @tokens[@idx].codeOrigin
+                name = @tokens[@idx].string
+                @idx += 1
+                parseError unless @tokens[@idx] == ":"
+                # It's a label.
+                if isLabel name
+                    list << Label.forName(codeOrigin, name)
+                else
+                    list << LocalLabel.forName(codeOrigin, name)
+                end
+                @idx += 1
+            else
+                parseError "Expecting terminal #{final} #{comment}"
+            end
+        }
+        Sequence.new(firstCodeOrigin, list)
+    end
+end
+
+def parse(tokens)
+    parser = Parser.new(tokens)
+    parser.parseSequence(nil, "")
+end
+
diff --git a/Source/JavaScriptCore/offlineasm/registers.rb b/Source/JavaScriptCore/offlineasm/registers.rb
new file mode 100644
index 000000000..75fae4192
--- /dev/null
+++ b/Source/JavaScriptCore/offlineasm/registers.rb
@@ -0,0 +1,60 @@
+# Copyright (C) 2011 Apple Inc. All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions
+# are met:
+# 1. Redistributions of source code must retain the above copyright
+#    notice, this list of conditions and the following disclaimer.
+# 2. Redistributions in binary form must reproduce the above copyright
+#    notice, this list of conditions and the following disclaimer in the
+#    documentation and/or other materials provided with the distribution.
+#
+# THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+# THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+# PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+# BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+# CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+# SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+# INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+# CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+# ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+# THE POSSIBILITY OF SUCH DAMAGE.
+
+GPRS =
+    [
+     "t0",
+     "t1",
+     "t2",
+     "t3",
+     "t4",
+     "cfr",
+     "a0",
+     "a1",
+     "r0",
+     "r1",
+     "sp",
+     "lr"
+    ]
+
+FPRS =
+    [
+     "ft0",
+     "ft1",
+     "ft2",
+     "ft3",
+     "ft4",
+     "ft5",
+     "fa0",
+     "fa1",
+     "fa2",
+     "fa3",
+     "fr"
+    ]
+
+REGISTERS = GPRS + FPRS
+
+GPR_PATTERN = Regexp.new('\\A((' + GPRS.join(')|(') + '))\\Z')
+FPR_PATTERN = Regexp.new('\\A((' + FPRS.join(')|(') + '))\\Z')
+
+REGISTER_PATTERN = Regexp.new('\\A((' + REGISTERS.join(')|(') + '))\\Z')
diff --git a/Source/JavaScriptCore/offlineasm/self_hash.rb b/Source/JavaScriptCore/offlineasm/self_hash.rb
new file mode 100644
index 000000000..a7b51e112
--- /dev/null
+++ b/Source/JavaScriptCore/offlineasm/self_hash.rb
@@ -0,0 +1,46 @@
+# Copyright (C) 2011 Apple Inc. All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions
+# are met:
+# 1. Redistributions of source code must retain the above copyright
+#    notice, this list of conditions and the following disclaimer.
+# 2. Redistributions in binary form must reproduce the above copyright
+#    notice, this list of conditions and the following disclaimer in the
+#    documentation and/or other materials provided with the distribution.
+#
+# THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+# THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+# PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+# BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+# CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+# SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+# INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+# CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+# ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+# THE POSSIBILITY OF SUCH DAMAGE.
+
+require "digest/sha1"
+require "pathname"
+
+#
+# selfHash -> SHA1 hexdigest
+#
+# Returns a hash of the offlineasm source code. This allows dependency
+# tracking for not just changes in input, but also changes in the assembler
+# itself.
+#
+
+def selfHash
+    contents = ""
+    myPath = Pathname.new(__FILE__).dirname
+    Dir.foreach(myPath) {
+        | entry |
+        if entry =~ /\.rb$/
+            contents += IO::read(myPath + entry)
+        end
+    }
+    return Digest::SHA1.hexdigest(contents)
+end
+
diff --git a/Source/JavaScriptCore/offlineasm/settings.rb b/Source/JavaScriptCore/offlineasm/settings.rb
new file mode 100644
index 000000000..34598181c
--- /dev/null
+++ b/Source/JavaScriptCore/offlineasm/settings.rb
@@ -0,0 +1,205 @@
+# Copyright (C) 2011 Apple Inc. All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions
+# are met:
+# 1. Redistributions of source code must retain the above copyright
+#    notice, this list of conditions and the following disclaimer.
+# 2. Redistributions in binary form must reproduce the above copyright
+#    notice, this list of conditions and the following disclaimer in the
+#    documentation and/or other materials provided with the distribution.
+#
+# THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+# THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+# PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+# BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+# CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+# SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+# INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+# CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+# ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+# THE POSSIBILITY OF SUCH DAMAGE.
+
+require "ast"
+require "backends"
+require "parser"
+require "transform"
+
+#
+# computeSettingsCombinations(ast) -> settingsCombiations
+#
+# Computes an array of settings maps, where a settings map constitutes
+# a configuration for the assembly code being generated. The map
+# contains key value pairs where keys are settings names (strings) and
+# the values are booleans (true for enabled, false for disabled).
+#
+
+def computeSettingsCombinations(ast)
+    settingsCombinations = []
+    
+    def settingsCombinator(settingsCombinations, mapSoFar, remaining)
+        if remaining.empty?
+            settingsCombinations << mapSoFar
+            return
+        end
+        
+        newMap = mapSoFar.dup
+        newMap[remaining[0]] = true
+        settingsCombinator(settingsCombinations, newMap, remaining[1..-1])
+        
+        newMap = mapSoFar.dup
+        newMap[remaining[0]] = false
+        settingsCombinator(settingsCombinations, newMap, remaining[1..-1])
+    end
+    
+    settingsCombinator(settingsCombinations, {}, (ast.filter(Setting).uniq.collect{|v| v.name} + ["X86", "ARMv7"]).uniq)
+    
+    settingsCombinations
+end
+
+#
+# forSettings(concreteSettings, ast) {
+#     | concreteSettings, lowLevelAST, backend | ... }
+#
+# Determines if the settings combination is valid, and if so, calls
+# the block with the information you need to generate code.
+#
+
+def forSettings(concreteSettings, ast)
+    # Check which architectures this combinator claims to support.
+    numClaimedBackends = 0
+    selectedBackend = nil
+    BACKENDS.each {
+        | backend |
+        isSupported = concreteSettings[backend]
+        raise unless isSupported != nil
+        numClaimedBackends += if isSupported then 1 else 0 end
+        if isSupported
+            selectedBackend = backend
+        end
+    }
+    
+    return if numClaimedBackends > 1
+    
+    # Resolve the AST down to a low-level form (no macros or conditionals).
+    lowLevelAST = ast.resolveSettings(concreteSettings)
+    
+    yield concreteSettings, lowLevelAST, selectedBackend
+end
+
+#
+# forEachValidSettingsCombination(ast) {
+#     | concreteSettings, ast, backend, index | ... }
+#
+# forEachValidSettingsCombination(ast, settingsCombinations) {
+#     | concreteSettings, ast, backend, index | ... }
+#
+# Executes the given block for each valid settings combination in the
+# settings map. The ast passed into the block is resolved
+# (ast.resolve) against the settings.
+#
+# The first form will call computeSettingsCombinations(ast) for you.
+#
+
+def forEachValidSettingsCombination(ast, *optionalSettingsCombinations)
+    raise if optionalSettingsCombinations.size > 1
+    
+    if optionalSettingsCombinations.empty?
+        settingsCombinations = computeSettingsCombinations(ast)
+    else
+        settingsCombinations = optionalSettingsCombiations[0]
+    end
+    
+    settingsCombinations.each_with_index {
+        | concreteSettings, index |
+        forSettings(concreteSettings, ast) {
+            | concreteSettings_, lowLevelAST, backend |
+            yield concreteSettings, lowLevelAST, backend, index
+        }
+    }
+end
+
+#
+# cppSettingsTest(concreteSettings)
+#
+# Returns the C++ code used to test if we are in a configuration that
+# corresponds to the given concrete settings.
+#
+
+def cppSettingsTest(concreteSettings)
+    "#if " + concreteSettings.to_a.collect{
+        | pair |
+        (if pair[1]
+             ""
+         else
+             "!"
+         end) + "OFFLINE_ASM_" + pair[0]
+    }.join(" && ")
+end
+
+#
+# isASTErroneous(ast)
+#
+# Tests to see if the AST claims that there is an error - i.e. if the
+# user's code, after settings resolution, has Error nodes.
+#
+
+def isASTErroneous(ast)
+    not ast.filter(Error).empty?
+end
+
+#
+# assertConfiguration(concreteSettings)
+#
+# Emits a check that asserts that we're using the given configuration.
+#
+
+def assertConfiguration(concreteSettings)
+    $output.puts cppSettingsTest(concreteSettings)
+    $output.puts "#else"
+    $output.puts "#error \"Configuration mismatch.\""
+    $output.puts "#endif"
+end
+
+#
+# emitCodeInConfiguration(concreteSettings, ast, backend) {
+#     | concreteSettings, ast, backend | ... }
+#
+# Emits all relevant guards to see if the configuration holds and
+# calls the block if the configuration is not erroneous.
+#
+
+def emitCodeInConfiguration(concreteSettings, ast, backend)
+    $output.puts cppSettingsTest(concreteSettings)
+    
+    if isASTErroneous(ast)
+        $output.puts "#error \"Invalid configuration.\""
+    elsif not WORKING_BACKENDS.include? backend
+        $output.puts "#error \"This backend is not supported yet.\""
+    else
+        yield concreteSettings, ast, backend
+    end
+    
+    $output.puts "#endif"
+end
+
+#
+# emitCodeInAllConfigurations(ast) {
+#     | concreteSettings, ast, backend, index | ... }
+#
+# Emits guard codes for all valid configurations, and calls the block
+# for those configurations that are valid and not erroneous.
+#
+
+def emitCodeInAllConfigurations(ast)
+    forEachValidSettingsCombination(ast) {
+        | concreteSettings, lowLevelAST, backend, index |
+        $output.puts cppSettingsTest(concreteSettings)
+        yield concreteSettings, lowLevelAST, backend, index
+        $output.puts "#endif"
+    }
+end
+
+
+
diff --git a/Source/JavaScriptCore/offlineasm/transform.rb b/Source/JavaScriptCore/offlineasm/transform.rb
new file mode 100644
index 000000000..5f5024d9e
--- /dev/null
+++ b/Source/JavaScriptCore/offlineasm/transform.rb
@@ -0,0 +1,342 @@
+# Copyright (C) 2011 Apple Inc. All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions
+# are met:
+# 1. Redistributions of source code must retain the above copyright
+#    notice, this list of conditions and the following disclaimer.
+# 2. Redistributions in binary form must reproduce the above copyright
+#    notice, this list of conditions and the following disclaimer in the
+#    documentation and/or other materials provided with the distribution.
+#
+# THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+# THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+# PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+# BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+# CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+# SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+# INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+# CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+# ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+# THE POSSIBILITY OF SUCH DAMAGE.
+
+require "ast"
+
+#
+# node.resolveSettings(settings)
+#
+# Construct a new AST that does not have any IfThenElse nodes by
+# substituting concrete boolean values for each Setting.
+#
+
+class Node
+    def resolveSettings(settings)
+        mapChildren {
+            | child |
+            child.resolveSettings(settings)
+        }
+    end
+end
+
+class True
+    def resolveSettings(settings)
+        self
+    end
+end
+
+class False
+    def resolveSettings(settings)
+        self
+    end
+end
+
+class Setting
+    def resolveSettings(settings)
+        settings[@name].asNode
+    end
+end
+
+class And
+    def resolveSettings(settings)
+        (@left.resolveSettings(settings).value and @right.resolveSettings(settings).value).asNode
+    end
+end
+
+class Or
+    def resolveSettings(settings)
+        (@left.resolveSettings(settings).value or @right.resolveSettings(settings).value).asNode
+    end
+end
+
+class Not
+    def resolveSettings(settings)
+        (not @child.resolveSettings(settings).value).asNode
+    end
+end
+
+class IfThenElse
+    def resolveSettings(settings)
+        if @predicate.resolveSettings(settings).value
+            @thenCase.resolveSettings(settings)
+        else
+            @elseCase.resolveSettings(settings)
+        end
+    end
+end
+
+class Sequence
+    def resolveSettings(settings)
+        newList = []
+        @list.each {
+            | item |
+            item = item.resolveSettings(settings)
+            if item.is_a? Sequence
+                newList += item.list
+            else
+                newList << item
+            end
+        }
+        Sequence.new(codeOrigin, newList)
+    end
+end
+
+#
+# node.demacroify(macros)
+# node.substitute(mapping)
+#
+# demacroify() constructs a new AST that does not have any Macro
+# nodes, while substitute() replaces Variable nodes with the given
+# nodes in the mapping.
+#
+
+class Node
+    def demacroify(macros)
+        mapChildren {
+            | child |
+            child.demacroify(macros)
+        }
+    end
+    
+    def substitute(mapping)
+        mapChildren {
+            | child |
+            child.substitute(mapping)
+        }
+    end
+    
+    def substituteLabels(mapping)
+        mapChildren {
+            | child |
+            child.substituteLabels(mapping)
+        }
+    end
+end
+
+class Macro
+    def substitute(mapping)
+        myMapping = {}
+        mapping.each_pair {
+            | key, value |
+            unless @variables.include? key
+                myMapping[key] = value
+            end
+        }
+        mapChildren {
+            | child |
+            child.substitute(myMapping)
+        }
+    end
+end
+
+class Variable
+    def substitute(mapping)
+        if mapping[self]
+            mapping[self]
+        else
+            self
+        end
+    end
+end
+
+class LocalLabel
+    def substituteLabels(mapping)
+        if mapping[self]
+            mapping[self]
+        else
+            self
+        end
+    end
+end
+
+class Sequence
+    def substitute(constants)
+        newList = []
+        myConstants = constants.dup
+        @list.each {
+            | item |
+            if item.is_a? ConstDecl
+                myConstants[item.variable] = item.value.substitute(myConstants)
+            else
+                newList << item.substitute(myConstants)
+            end
+        }
+        Sequence.new(codeOrigin, newList)
+    end
+    
+    def renameLabels(comment)
+        mapping = {}
+        
+        @list.each {
+            | item |
+            if item.is_a? LocalLabel
+                mapping[item] = LocalLabel.unique(if comment then comment + "_" else "" end + item.cleanName)
+            end
+        }
+        
+        substituteLabels(mapping)
+    end
+    
+    def demacroify(macros)
+        myMacros = macros.dup
+        @list.each {
+            | item |
+            if item.is_a? Macro
+                myMacros[item.name] = item
+            end
+        }
+        newList = []
+        @list.each {
+            | item |
+            if item.is_a? Macro
+                # Ignore.
+            elsif item.is_a? MacroCall
+                mapping = {}
+                myMyMacros = myMacros.dup
+                raise "Could not find macro #{item.name} at #{item.codeOriginString}" unless myMacros[item.name]
+                raise "Argument count mismatch for call to #{item.name} at #{item.codeOriginString}" unless item.operands.size == myMacros[item.name].variables.size
+                item.operands.size.times {
+                    | idx |
+                    if item.operands[idx].is_a? Variable and myMacros[item.operands[idx].name]
+                        myMyMacros[myMacros[item.name].variables[idx].name] = myMacros[item.operands[idx].name]
+                        mapping[myMacros[item.name].variables[idx].name] = nil
+                    elsif item.operands[idx].is_a? Macro
+                        myMyMacros[myMacros[item.name].variables[idx].name] = item.operands[idx]
+                        mapping[myMacros[item.name].variables[idx].name] = nil
+                    else
+                        myMyMacros[myMacros[item.name].variables[idx]] = nil
+                        mapping[myMacros[item.name].variables[idx]] = item.operands[idx]
+                    end
+                }
+                newList += myMacros[item.name].body.substitute(mapping).demacroify(myMyMacros).renameLabels(item.name).list
+            else
+                newList << item.demacroify(myMacros)
+            end
+        }
+        Sequence.new(codeOrigin, newList).substitute({})
+    end
+end
+
+#
+# node.resolveOffsets(offsets, sizes)
+#
+# Construct a new AST that has offset values instead of symbolic
+# offsets.
+#
+
+class Node
+    def resolveOffsets(offsets, sizes)
+        mapChildren {
+            | child |
+            child.resolveOffsets(offsets, sizes)
+        }
+    end
+end
+
+class StructOffset
+    def resolveOffsets(offsets, sizes)
+        if offsets[self]
+            Immediate.new(codeOrigin, offsets[self])
+        else
+            self
+        end
+    end
+end
+
+class Sizeof
+    def resolveOffsets(offsets, sizes)
+        if sizes[self]
+            Immediate.new(codeOrigin, sizes[self])
+        else
+            puts "Could not find #{self.inspect} in #{sizes.keys.inspect}"
+            puts "sizes = #{sizes.inspect}"
+            self
+        end
+    end
+end
+
+#
+# node.fold
+#
+# Resolve constant references and compute arithmetic expressions.
+#
+
+class Node
+    def fold
+        mapChildren {
+            | child |
+            child.fold
+        }
+    end
+end
+
+class AddImmediates
+    def fold
+        @left = @left.fold
+        @right = @right.fold
+        return self unless @left.is_a? Immediate
+        return self unless @right.is_a? Immediate
+        Immediate.new(codeOrigin, @left.value + @right.value)
+    end
+end
+
+class SubImmediates
+    def fold
+        @left = @left.fold
+        @right = @right.fold
+        return self unless @left.is_a? Immediate
+        return self unless @right.is_a? Immediate
+        Immediate.new(codeOrigin, @left.value - @right.value)
+    end
+end
+
+class MulImmediates
+    def fold
+        @left = @left.fold
+        @right = @right.fold
+        return self unless @left.is_a? Immediate
+        return self unless @right.is_a? Immediate
+        Immediate.new(codeOrigin, @left.value * @right.value)
+    end
+end
+
+class NegImmediate
+    def fold
+        @child = @child.fold
+        return self unless @child.is_a? Immediate
+        Immediate.new(codeOrigin, -@child.value)
+    end
+end
+
+#
+# node.resolveAfterSettings(offsets, sizes)
+#
+# Compile assembly against a set of offsets.
+#
+
+class Node
+    def resolve(offsets, sizes)
+        demacroify({}).resolveOffsets(offsets, sizes).fold
+    end
+end
+
diff --git a/Source/JavaScriptCore/offlineasm/x86.rb b/Source/JavaScriptCore/offlineasm/x86.rb
new file mode 100644
index 000000000..b89f2d90c
--- /dev/null
+++ b/Source/JavaScriptCore/offlineasm/x86.rb
@@ -0,0 +1,681 @@
+# Copyright (C) 2011 Apple Inc. All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions
+# are met:
+# 1. Redistributions of source code must retain the above copyright
+#    notice, this list of conditions and the following disclaimer.
+# 2. Redistributions in binary form must reproduce the above copyright
+#    notice, this list of conditions and the following disclaimer in the
+#    documentation and/or other materials provided with the distribution.
+#
+# THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+# THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+# PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+# BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+# CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+# SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+# INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+# CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+# ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+# THE POSSIBILITY OF SUCH DAMAGE.
+
+class RegisterID
+    def supports8BitOnX86
+        case name
+        when "t0", "a0", "r0", "t1", "a1", "r1", "t2", "t3"
+            true
+        when "t4", "cfr"
+            false
+        else
+            raise
+        end
+    end
+    
+    def x86Operand(kind)
+        case name
+        when "t0", "a0", "r0"
+            case kind
+            when :byte
+                "%al"
+            when :half
+                "%ax"
+            when :int
+                "%eax"
+            else
+                raise
+            end
+        when "t1", "a1", "r1"
+            case kind
+            when :byte
+                "%dl"
+            when :half
+                "%dx"
+            when :int
+                "%edx"
+            else
+                raise
+            end
+        when "t2"
+            case kind
+            when :byte
+                "%cl"
+            when :half
+                "%cx"
+            when :int
+                "%ecx"
+            else
+                raise
+            end
+        when "t3"
+            case kind
+            when :byte
+                "%bl"
+            when :half
+                "%bx"
+            when :int
+                "%ebx"
+            else
+                raise
+            end
+        when "t4"
+            case kind
+            when :byte
+                "%sil"
+            when :half
+                "%si"
+            when :int
+                "%esi"
+            else
+                raise
+            end
+        when "cfr"
+            case kind
+            when :byte
+                "%dil"
+            when :half
+                "%di"
+            when :int
+                "%edi"
+            else
+                raise
+            end
+        when "sp"
+            case kind
+            when :byte
+                "%spl"
+            when :half
+                "%sp"
+            when :int
+                "%esp"
+            else
+                raise
+            end
+        else
+            raise "Bad register #{name} for X86 at #{codeOriginString}"
+        end
+    end
+    def x86CallOperand(kind)
+        "*#{x86Operand(kind)}"
+    end
+end
+
+class FPRegisterID
+    def x86Operand(kind)
+        raise unless kind == :double
+        case name
+        when "ft0", "fa0", "fr"
+            "%xmm0"
+        when "ft1", "fa1"
+            "%xmm1"
+        when "ft2", "fa2"
+            "%xmm2"
+        when "ft3", "fa3"
+            "%xmm3"
+        when "ft4"
+            "%xmm4"
+        when "ft5"
+            "%xmm5"
+        else
+            raise "Bad register #{name} for X86 at #{codeOriginString}"
+        end
+    end
+    def x86CallOperand(kind)
+        "*#{x86Operand(kind)}"
+    end
+end
+
+class Immediate
+    def x86Operand(kind)
+        "$#{value}"
+    end
+    def x86CallOperand(kind)
+        "#{value}"
+    end
+end
+
+class Address
+    def supports8BitOnX86
+        true
+    end
+    
+    def x86Operand(kind)
+        "#{offset.value}(#{base.x86Operand(:int)})"
+    end
+    def x86CallOperand(kind)
+        "*#{x86Operand(kind)}"
+    end
+end
+
+class BaseIndex
+    def supports8BitOnX86
+        true
+    end
+    
+    def x86Operand(kind)
+        "#{offset.value}(#{base.x86Operand(:int)}, #{index.x86Operand(:int)}, #{scale})"
+    end
+
+    def x86CallOperand(kind)
+        "*#{x86operand(kind)}"
+    end
+end
+
+class AbsoluteAddress
+    def supports8BitOnX86
+        true
+    end
+    
+    def x86Operand(kind)
+        "#{address.value}"
+    end
+
+    def x86CallOperand(kind)
+        "*#{address.value}"
+    end
+end
+
+class LabelReference
+    def x86CallOperand(kind)
+        asmLabel
+    end
+end
+
+class LocalLabelReference
+    def x86CallOperand(kind)
+        asmLabel
+    end
+end
+
+class Instruction
+    def x86Operands(*kinds)
+        raise unless kinds.size == operands.size
+        result = []
+        kinds.size.times {
+            | idx |
+            result << operands[idx].x86Operand(kinds[idx])
+        }
+        result.join(", ")
+    end
+
+    def x86Suffix(kind)
+        case kind
+        when :byte
+            "b"
+        when :half
+            "w"
+        when :int
+            "l"
+        when :double
+            "sd"
+        else
+            raise
+        end
+    end
+    
+    def handleX86OpWithNumOperands(opcode, kind, numOperands)
+        if numOperands == 3
+            if operands[0] == operands[2]
+                $asm.puts "#{opcode} #{operands[1].x86Operand(kind)}, #{operands[2].x86Operand(kind)}"
+            elsif operands[1] == operands[2]
+                $asm.puts "#{opcode} #{operands[0].x86Operand(kind)}, #{operands[2].x86Operand(kind)}"
+            else
+                $asm.puts "mov#{x86Suffix(kind)} #{operands[0].x86Operand(kind)}, #{operands[2].x86Operand(kind)}"
+                $asm.puts "#{opcode} #{operands[1].x86Operand(kind)}, #{operands[2].x86Operand(kind)}"
+            end
+        else
+            $asm.puts "#{opcode} #{operands[0].x86Operand(kind)}, #{operands[1].x86Operand(kind)}"
+        end
+    end
+    
+    def handleX86Op(opcode, kind)
+        handleX86OpWithNumOperands(opcode, kind, operands.size)
+    end
+    
+    def handleX86Shift(opcode, kind)
+        if operands[0].is_a? Immediate or operands[0] == RegisterID.forName(nil, "t2")
+            $asm.puts "#{opcode} #{operands[0].x86Operand(:byte)}, #{operands[1].x86Operand(kind)}"
+        else
+            $asm.puts "xchgl #{operands[0].x86Operand(:int)}, %ecx"
+            $asm.puts "#{opcode} %cl, #{operands[1].x86Operand(kind)}"
+            $asm.puts "xchgl #{operands[0].x86Operand(:int)}, %ecx"
+        end
+    end
+    
+    def handleX86DoubleBranch(branchOpcode, mode)
+        case mode
+        when :normal
+            $asm.puts "ucomisd #{operands[1].x86Operand(:double)}, #{operands[0].x86Operand(:double)}"
+        when :reverse
+            $asm.puts "ucomisd #{operands[0].x86Operand(:double)}, #{operands[1].x86Operand(:double)}"
+        else
+            raise mode.inspect
+        end
+        $asm.puts "#{branchOpcode} #{operands[2].asmLabel}"
+    end
+    
+    def handleX86IntCompare(opcodeSuffix, kind)
+        if operands[0].is_a? Immediate and operands[0].value == 0 and operands[1].is_a? RegisterID and (opcodeSuffix == "e" or opcodeSuffix == "ne")
+            $asm.puts "test#{x86Suffix(kind)} #{operands[1].x86Operand(kind)}"
+        elsif operands[1].is_a? Immediate and operands[1].value == 0 and operands[0].is_a? RegisterID and (opcodeSuffix == "e" or opcodeSuffix == "ne")
+            $asm.puts "test#{x86Suffix(kind)} #{operands[0].x86Operand(kind)}"
+        else
+            $asm.puts "cmp#{x86Suffix(kind)} #{operands[1].x86Operand(kind)}, #{operands[0].x86Operand(kind)}"
+        end
+    end
+    
+    def handleX86IntBranch(branchOpcode, kind)
+        handleX86IntCompare(branchOpcode[1..-1], kind)
+        $asm.puts "#{branchOpcode} #{operands[2].asmLabel}"
+    end
+    
+    def handleX86Set(setOpcode, operand)
+        if operand.supports8BitOnX86
+            $asm.puts "#{setOpcode} #{operand.x86Operand(:byte)}"
+            $asm.puts "movzbl #{operand.x86Operand(:byte)}, #{operand.x86Operand(:int)}"
+        else
+            $asm.puts "xchgl #{operand.x86Operand(:int)}, %eax"
+            $asm.puts "#{setOpcode} %al"
+            $asm.puts "movzbl %al, %eax"
+            $asm.puts "xchgl #{operand.x86Operand(:int)}, %eax"
+        end
+    end
+    
+    def handleX86IntCompareSet(setOpcode, kind)
+        handleX86IntCompare(setOpcode[3..-1], kind)
+        handleX86Set(setOpcode, operands[2])
+    end
+    
+    def handleX86Test(kind)
+        value = operands[0]
+        case operands.size
+        when 2
+            mask = Immediate.new(codeOrigin, -1)
+        when 3
+            mask = operands[1]
+        else
+            raise "Expected 2 or 3 operands, but got #{operands.size} at #{codeOriginString}"
+        end
+        
+        if mask.is_a? Immediate and mask.value == -1
+            if value.is_a? RegisterID
+                $asm.puts "test#{x86Suffix(kind)} #{value.x86Operand(kind)}, #{value.x86Operand(kind)}"
+            else
+                $asm.puts "cmp#{x86Suffix(kind)} $0, #{value.x86Operand(kind)}"
+            end
+        else
+            $asm.puts "test#{x86Suffix(kind)} #{mask.x86Operand(kind)}, #{value.x86Operand(kind)}"
+        end
+    end
+    
+    def handleX86BranchTest(branchOpcode, kind)
+        handleX86Test(kind)
+        $asm.puts "#{branchOpcode} #{operands.last.asmLabel}"
+    end
+    
+    def handleX86SetTest(setOpcode, kind)
+        handleX86Test(kind)
+        handleX86Set(setOpcode, operands.last)
+    end
+    
+    def handleX86OpBranch(opcode, branchOpcode, kind)
+        handleX86OpWithNumOperands(opcode, kind, operands.size - 1)
+        case operands.size
+        when 4
+            jumpTarget = operands[3]
+        when 3
+            jumpTarget = operands[2]
+        else
+            raise self.inspect
+        end
+        $asm.puts "#{branchOpcode} #{jumpTarget.asmLabel}"
+    end
+    
+    def handleX86SubBranch(branchOpcode, kind)
+        if operands.size == 4 and operands[1] == operands[2]
+            $asm.puts "negl #{operands[2].x86Operand(:int)}"
+            $asm.puts "addl #{operands[0].x86Operand(:int)}, #{operands[2].x86Operand(:int)}"
+        else
+            handleX86OpWithNumOperands("sub#{x86Suffix(kind)}", kind, operands.size - 1)
+        end
+        case operands.size
+        when 4
+            jumpTarget = operands[3]
+        when 3
+            jumpTarget = operands[2]
+        else
+            raise self.inspect
+        end
+        $asm.puts "#{branchOpcode} #{jumpTarget.asmLabel}"
+    end
+    
+    def lowerX86
+        $asm.comment codeOriginString
+        case opcode
+        when "addi", "addp"
+            if operands.size == 3 and operands[0].is_a? Immediate
+                raise unless operands[1].is_a? RegisterID
+                raise unless operands[2].is_a? RegisterID
+                if operands[0].value == 0
+                    unless operands[1] == operands[2]
+                        $asm.puts "movl #{operands[1].x86Operand(:int)}, #{operands[2].x86Operand(:int)}"
+                    end
+                else
+                    $asm.puts "leal #{operands[0].value}(#{operands[1].x86Operand(:int)}), #{operands[2].x86Operand(:int)}"
+                end
+            elsif operands.size == 3 and operands[0].is_a? RegisterID
+                raise unless operands[1].is_a? RegisterID
+                raise unless operands[2].is_a? RegisterID
+                $asm.puts "leal (#{operands[0].x86Operand(:int)}, #{operands[1].x86Operand(:int)}), #{operands[2].x86Operand(:int)}"
+            else
+                unless Immediate.new(nil, 0) == operands[0]
+                    $asm.puts "addl #{x86Operands(:int, :int)}"
+                end
+            end
+        when "andi", "andp"
+            handleX86Op("andl", :int)
+        when "lshifti"
+            handleX86Shift("sall", :int)
+        when "muli"
+            if operands.size == 3 and operands[0].is_a? Immediate
+                $asm.puts "imull #{x86Operands(:int, :int, :int)}"
+            else
+                # FIXME: could do some peephole in case the left operand is immediate and it's
+                # a power of two.
+                handleX86Op("imull", :int)
+            end
+        when "negi"
+            $asm.puts "negl #{x86Operands(:int)}"
+        when "noti"
+            $asm.puts "notl #{x86Operands(:int)}"
+        when "ori", "orp"
+            handleX86Op("orl", :int)
+        when "rshifti"
+            handleX86Shift("sarl", :int)
+        when "urshifti"
+            handleX86Shift("shrl", :int)
+        when "subi", "subp"
+            if operands.size == 3 and operands[1] == operands[2]
+                $asm.puts "negl #{operands[2].x86Operand(:int)}"
+                $asm.puts "addl #{operands[0].x86Operand(:int)}, #{operands[2].x86Operand(:int)}"
+            else
+                handleX86Op("subl", :int)
+            end
+        when "xori", "xorp"
+            handleX86Op("xorl", :int)
+        when "loadi", "storei", "loadp", "storep"
+            $asm.puts "movl #{x86Operands(:int, :int)}"
+        when "loadb"
+            $asm.puts "movzbl #{operands[0].x86Operand(:byte)}, #{operands[1].x86Operand(:int)}"
+        when "loadbs"
+            $asm.puts "movsbl #{operands[0].x86Operand(:byte)}, #{operands[1].x86Operand(:int)}"
+        when "loadh"
+            $asm.puts "movzwl #{operands[0].x86Operand(:half)}, #{operands[1].x86Operand(:int)}"
+        when "loadhs"
+            $asm.puts "movswl #{operands[0].x86Operand(:half)}, #{operands[1].x86Operand(:int)}"
+        when "storeb"
+            $asm.puts "movb #{x86Operands(:byte, :byte)}"
+        when "loadd", "moved", "stored"
+            $asm.puts "movsd #{x86Operands(:double, :double)}"
+        when "addd"
+            $asm.puts "addsd #{x86Operands(:double, :double)}"
+        when "divd"
+            $asm.puts "divsd #{x86Operands(:double, :double)}"
+        when "subd"
+            $asm.puts "subsd #{x86Operands(:double, :double)}"
+        when "muld"
+            $asm.puts "mulsd #{x86Operands(:double, :double)}"
+        when "sqrtd"
+            $asm.puts "sqrtsd #{operands[0].x86Operand(:double)}, #{operands[1].x86Operand(:double)}"
+        when "ci2d"
+            $asm.puts "cvtsi2sd #{operands[0].x86Operand(:int)}, #{operands[1].x86Operand(:double)}"
+        when "bdeq"
+            isUnordered = LocalLabel.unique("bdeq")
+            $asm.puts "ucomisd #{operands[0].x86Operand(:double)}, #{operands[1].x86Operand(:double)}"
+            $asm.puts "jp #{LabelReference.new(codeOrigin, isUnordered).asmLabel}"
+            $asm.puts "je #{LabelReference.new(codeOrigin, operands[2]).asmLabel}"
+            isUnordered.lower("X86")
+        when "bdneq"
+            handleX86DoubleBranch("jne", :normal)
+        when "bdgt"
+            handleX86DoubleBranch("ja", :normal)
+        when "bdgteq"
+            handleX86DoubleBranch("jae", :normal)
+        when "bdlt"
+            handleX86DoubleBranch("ja", :reverse)
+        when "bdlteq"
+            handleX86DoubleBranch("jae", :reverse)
+        when "bdequn"
+            handleX86DoubleBranch("je", :normal)
+        when "bdnequn"
+            isUnordered = LocalLabel.unique("bdnequn")
+            isEqual = LocalLabel.unique("bdnequn")
+            $asm.puts "ucomisd #{operands[0].x86Operand(:double)}, #{operands[1].x86Operand(:double)}"
+            $asm.puts "jp #{LabelReference.new(codeOrigin, isUnordered).asmLabel}"
+            $asm.puts "je #{LabelReference.new(codeOrigin, isEqual).asmLabel}"
+            isUnordered.lower("X86")
+            $asm.puts "jmp #{operands[2].asmLabel}"
+            isEqual.lower("X86")
+        when "bdgtun"
+            handleX86DoubleBranch("jb", :reverse)
+        when "bdgtequn"
+            handleX86DoubleBranch("jbe", :reverse)
+        when "bdltun"
+            handleX86DoubleBranch("jb", :normal)
+        when "bdltequn"
+            handleX86DoubleBranch("jbe", :normal)
+        when "btd2i"
+            $asm.puts "cvttsd2si #{operands[0].x86Operand(:double)}, #{operands[1].x86Operand(:int)}"
+            $asm.puts "cmpl $0x80000000 #{operands[1].x86Operand(:int)}"
+            $asm.puts "je #{operands[2].asmLabel}"
+        when "td2i"
+            $asm.puts "cvttsd2si #{operands[0].x86Operand(:double)}, #{operands[1].x86Operand(:int)}"
+        when "bcd2i"
+            $asm.puts "cvttsd2si #{operands[0].x86Operand(:double)}, #{operands[1].x86Operand(:int)}"
+            $asm.puts "testl #{operands[1].x86Operand(:int)}, #{operands[1].x86Operand(:int)}"
+            $asm.puts "je #{operands[2].asmLabel}"
+            $asm.puts "cvtsi2sd #{operands[1].x86Operand(:int)}, %xmm7"
+            $asm.puts "ucomisd #{operands[0].x86Operand(:double)}, %xmm7"
+            $asm.puts "jp #{operands[2].asmLabel}"
+            $asm.puts "jne #{operands[2].asmLabel}"
+        when "movdz"
+            $asm.puts "xorpd #{operands[0].x86Operand(:double)}, #{operands[0].x86Operand(:double)}"
+        when "pop"
+            $asm.puts "pop #{operands[0].x86Operand(:int)}"
+        when "push"
+            $asm.puts "push #{operands[0].x86Operand(:int)}"
+        when "move", "sxi2p", "zxi2p"
+            if Immediate.new(nil, 0) == operands[0] and operands[1].is_a? RegisterID
+                $asm.puts "xorl #{operands[1].x86Operand(:int)}, #{operands[1].x86Operand(:int)}"
+            elsif operands[0] != operands[1]
+                $asm.puts "movl #{x86Operands(:int, :int)}"
+            end
+        when "nop"
+            $asm.puts "nop"
+        when "bieq", "bpeq"
+            handleX86IntBranch("je", :int)
+        when "bineq", "bpneq"
+            handleX86IntBranch("jne", :int)
+        when "bia", "bpa"
+            handleX86IntBranch("ja", :int)
+        when "biaeq", "bpaeq"
+            handleX86IntBranch("jae", :int)
+        when "bib", "bpb"
+            handleX86IntBranch("jb", :int)
+        when "bibeq", "bpbeq"
+            handleX86IntBranch("jbe", :int)
+        when "bigt", "bpgt"
+            handleX86IntBranch("jg", :int)
+        when "bigteq", "bpgteq"
+            handleX86IntBranch("jge", :int)
+        when "bilt", "bplt"
+            handleX86IntBranch("jl", :int)
+        when "bilteq", "bplteq"
+            handleX86IntBranch("jle", :int)
+        when "bbeq"
+            handleX86IntBranch("je", :byte)
+        when "bbneq"
+            handleX86IntBranch("jne", :byte)
+        when "bba"
+            handleX86IntBranch("ja", :byte)
+        when "bbaeq"
+            handleX86IntBranch("jae", :byte)
+        when "bbb"
+            handleX86IntBranch("jb", :byte)
+        when "bbbeq"
+            handleX86IntBranch("jbe", :byte)
+        when "bbgt"
+            handleX86IntBranch("jg", :byte)
+        when "bbgteq"
+            handleX86IntBranch("jge", :byte)
+        when "bblt"
+            handleX86IntBranch("jl", :byte)
+        when "bblteq"
+            handleX86IntBranch("jlteq", :byte)
+        when "btio", "btpo"
+            handleX86BranchTest("jo", :int)
+        when "btis", "btps"
+            handleX86BranchTest("js", :int)
+        when "btiz", "btpz"
+            handleX86BranchTest("jz", :int)
+        when "btinz", "btpnz"
+            handleX86BranchTest("jnz", :int)
+        when "btbo"
+            handleX86BranchTest("jo", :byte)
+        when "btbs"
+            handleX86BranchTest("js", :byte)
+        when "btbz"
+            handleX86BranchTest("jz", :byte)
+        when "btbnz"
+            handleX86BranchTest("jnz", :byte)
+        when "jmp"
+            $asm.puts "jmp #{operands[0].x86CallOperand(:int)}"
+        when "baddio", "baddpo"
+            handleX86OpBranch("addl", "jo", :int)
+        when "baddis", "baddps"
+            handleX86OpBranch("addl", "js", :int)
+        when "baddiz", "baddpz"
+            handleX86OpBranch("addl", "jz", :int)
+        when "baddinz", "baddpnz"
+            handleX86OpBranch("addl", "jnz", :int)
+        when "bsubio"
+            handleX86SubBranch("jo", :int)
+        when "bsubis"
+            handleX86SubBranch("js", :int)
+        when "bsubiz"
+            handleX86SubBranch("jz", :int)
+        when "bsubinz"
+            handleX86SubBranch("jnz", :int)
+        when "bmulio"
+            handleX86OpBranch("imull", "jo", :int)
+        when "bmulis"
+            handleX86OpBranch("imull", "js", :int)
+        when "bmuliz"
+            handleX86OpBranch("imull", "jz", :int)
+        when "bmulinz"
+            handleX86OpBranch("imull", "jnz", :int)
+        when "borio"
+            handleX86OpBranch("orl", "jo", :int)
+        when "boris"
+            handleX86OpBranch("orl", "js", :int)
+        when "boriz"
+            handleX86OpBranch("orl", "jz", :int)
+        when "borinz"
+            handleX86OpBranch("orl", "jnz", :int)
+        when "break"
+            $asm.puts "int $3"
+        when "call"
+            $asm.puts "call #{operands[0].x86CallOperand(:int)}"
+        when "ret"
+            $asm.puts "ret"
+        when "cieq", "cpeq"
+            handleX86IntCompareSet("sete", :int)
+        when "cineq", "cpneq"
+            handleX86IntCompareSet("setne", :int)
+        when "cia", "cpa"
+            handleX86IntCompareSet("seta", :int)
+        when "ciaeq", "cpaeq"
+            handleX86IntCompareSet("setae", :int)
+        when "cib", "cpb"
+            handleX86IntCompareSet("setb", :int)
+        when "cibeq", "cpbeq"
+            handleX86IntCompareSet("setbe", :int)
+        when "cigt", "cpgt"
+            handleX86IntCompareSet("setg", :int)
+        when "cigteq", "cpgteq"
+            handleX86IntCompareSet("setge", :int)
+        when "cilt", "cplt"
+            handleX86IntCompareSet("setl", :int)
+        when "cilteq", "cplteq"
+            handleX86IntCompareSet("setle", :int)
+        when "tio"
+            handleX86SetTest("seto", :int)
+        when "tis"
+            handleX86SetTest("sets", :int)
+        when "tiz"
+            handleX86SetTest("setz", :int)
+        when "tinz"
+            handleX86SetTest("setnz", :int)
+        when "tbo"
+            handleX86SetTest("seto", :byte)
+        when "tbs"
+            handleX86SetTest("sets", :byte)
+        when "tbz"
+            handleX86SetTest("setz", :byte)
+        when "tbnz"
+            handleX86SetTest("setnz", :byte)
+        when "peek"
+            $asm.puts "movl #{operands[0].value * 4}(%esp), #{operands[1].x86Operand(:int)}"
+        when "poke"
+            $asm.puts "movl #{operands[0].x86Operand(:int)}, #{operands[1].value * 4}(%esp)"
+        when "cdqi"
+            $asm.puts "cdq"
+        when "idivi"
+            $asm.puts "idivl #{operands[0].x86Operand(:int)}"
+        when "fii2d"
+            $asm.puts "movd #{operands[0].x86Operand(:int)}, #{operands[2].x86Operand(:double)}"
+            $asm.puts "movd #{operands[1].x86Operand(:int)}, %xmm7"
+            $asm.puts "psllq $32, %xmm7"
+            $asm.puts "por %xmm7, #{operands[2].x86Operand(:double)}"
+        when "fd2ii"
+            $asm.puts "movd #{operands[0].x86Operand(:double)}, #{operands[1].x86Operand(:int)}"
+            $asm.puts "movsd #{operands[0].x86Operand(:double)}, %xmm7"
+            $asm.puts "psrlq $32, %xmm7"
+            $asm.puts "movsd %xmm7, #{operands[2].x86Operand(:int)}"
+        when "bo"
+            $asm.puts "jo #{operands[0].asmLabel}"
+        when "bs"
+            $asm.puts "js #{operands[0].asmLabel}"
+        when "bz"
+            $asm.puts "jz #{operands[0].asmLabel}"
+        when "bnz"
+            $asm.puts "jnz #{operands[0].asmLabel}"
+        when "leai", "leap"
+            $asm.puts "leal #{operands[0].x86Operand(:int)}, #{operands[1].x86Operand(:int)}"
+        else
+            raise "Bad opcode: #{opcode}"
+        end
+    end
+end
+
diff --git a/Source/JavaScriptCore/os-win32/inttypes.h b/Source/JavaScriptCore/os-win32/inttypes.h
index 0ed6718d8..af7390e98 100644
--- a/Source/JavaScriptCore/os-win32/inttypes.h
+++ b/Source/JavaScriptCore/os-win32/inttypes.h
@@ -38,6 +38,11 @@
 #error "This inttypes.h file should only be compiled with MSVC"
 #endif
 
+#ifdef WTF_COMPILER_MSVC7_OR_LOWER
+// https://bugs.webkit.org/show_bug.cgi?id=76210
+#error "Visual Studio 2005 or newer is required"
+#endif
+
 #if _MSC_VER > 1000
 #pragma once
 #endif
@@ -63,22 +68,22 @@
 #define PRIdFAST16   "hd"
 #define PRIiFAST16   "hi"
 
-#define PRId32       "I32d"
-#define PRIi32       "I32i"
-#define PRIdLEAST32  "I32d"
-#define PRIiLEAST32  "I32i"
-#define PRIdFAST32   "I32d"
-#define PRIiFAST32   "I32i"
+#define PRId32       "d"
+#define PRIi32       "i"
+#define PRIdLEAST32  "d"
+#define PRIiLEAST32  "i"
+#define PRIdFAST32   "d"
+#define PRIiFAST32   "i"
 
-#define PRId64       "I64d"
-#define PRIi64       "I64i"
-#define PRIdLEAST64  "I64d"
-#define PRIiLEAST64  "I64i"
-#define PRIdFAST64   "I64d"
-#define PRIiFAST64   "I64i"
+#define PRId64       "lld"
+#define PRIi64       "lli"
+#define PRIdLEAST64  "lld"
+#define PRIiLEAST64  "lli"
+#define PRIdFAST64   "lld"
+#define PRIiFAST64   "lli"
 
-#define PRIdMAX     "I64d"
-#define PRIiMAX     "I64i"
+#define PRIdMAX     "lld"
+#define PRIiMAX     "lli"
 
 #define PRIdPTR     "Id"
 #define PRIiPTR     "Ii"
@@ -110,36 +115,36 @@
 #define PRIxFAST16   "hx"
 #define PRIXFAST16   "hX"
 
-#define PRIo32       "I32o"
-#define PRIu32       "I32u"
-#define PRIx32       "I32x"
-#define PRIX32       "I32X"
-#define PRIoLEAST32  "I32o"
-#define PRIuLEAST32  "I32u"
-#define PRIxLEAST32  "I32x"
-#define PRIXLEAST32  "I32X"
-#define PRIoFAST32   "I32o"
-#define PRIuFAST32   "I32u"
-#define PRIxFAST32   "I32x"
-#define PRIXFAST32   "I32X"
-
-#define PRIo64       "I64o"
-#define PRIu64       "I64u"
-#define PRIx64       "I64x"
-#define PRIX64       "I64X"
-#define PRIoLEAST64  "I64o"
-#define PRIuLEAST64  "I64u"
-#define PRIxLEAST64  "I64x"
-#define PRIXLEAST64  "I64X"
-#define PRIoFAST64   "I64o"
-#define PRIuFAST64   "I64u"
-#define PRIxFAST64   "I64x"
-#define PRIXFAST64   "I64X"
-
-#define PRIoMAX     "I64o"
-#define PRIuMAX     "I64u"
-#define PRIxMAX     "I64x"
-#define PRIXMAX     "I64X"
+#define PRIo32       "o"
+#define PRIu32       "u"
+#define PRIx32       "x"
+#define PRIX32       "X"
+#define PRIoLEAST32  "o"
+#define PRIuLEAST32  "u"
+#define PRIxLEAST32  "x"
+#define PRIXLEAST32  "X"
+#define PRIoFAST32   "o"
+#define PRIuFAST32   "u"
+#define PRIxFAST32   "x"
+#define PRIXFAST32   "X"
+
+#define PRIo64       "llo"
+#define PRIu64       "llu"
+#define PRIx64       "llx"
+#define PRIX64       "llX"
+#define PRIoLEAST64  "llo"
+#define PRIuLEAST64  "llu"
+#define PRIxLEAST64  "llx"
+#define PRIXLEAST64  "llX"
+#define PRIoFAST64   "llo"
+#define PRIuFAST64   "llu"
+#define PRIxFAST64   "llx"
+#define PRIXFAST64   "llX"
+
+#define PRIoMAX     "llo"
+#define PRIuMAX     "llu"
+#define PRIxMAX     "llx"
+#define PRIXMAX     "llX"
 
 #define PRIoPTR     "Io"
 #define PRIuPTR     "Iu"
@@ -168,19 +173,19 @@
 #define SCNdFAST32   "ld"
 #define SCNiFAST32   "li"
 
-#define SCNd64       "I64d"
-#define SCNi64       "I64i"
-#define SCNdLEAST64  "I64d"
-#define SCNiLEAST64  "I64i"
-#define SCNdFAST64   "I64d"
-#define SCNiFAST64   "I64i"
+#define SCNd64       "lld"
+#define SCNi64       "lli"
+#define SCNdLEAST64  "lld"
+#define SCNiLEAST64  "lli"
+#define SCNdFAST64   "lld"
+#define SCNiFAST64   "lli"
 
-#define SCNdMAX     "I64d"
-#define SCNiMAX     "I64i"
+#define SCNdMAX     "lld"
+#define SCNiMAX     "lli"
 
 #ifdef _WIN64
-#  define SCNdPTR     "I64d"
-#  define SCNiPTR     "I64i"
+#  define SCNdPTR     "lld"
+#  define SCNiPTR     "lli"
 #else
 #  define SCNdPTR     "ld"
 #  define SCNiPTR     "li"
@@ -226,29 +231,29 @@
 #define SCNxFAST32   "lx"
 #define SCNXFAST32   "lX"
 
-#define SCNo64       "I64o"
-#define SCNu64       "I64u"
-#define SCNx64       "I64x"
-#define SCNX64       "I64X"
-#define SCNoLEAST64  "I64o"
-#define SCNuLEAST64  "I64u"
-#define SCNxLEAST64  "I64x"
-#define SCNXLEAST64  "I64X"
-#define SCNoFAST64   "I64o"
-#define SCNuFAST64   "I64u"
-#define SCNxFAST64   "I64x"
-#define SCNXFAST64   "I64X"
-
-#define SCNoMAX     "I64o"
-#define SCNuMAX     "I64u"
-#define SCNxMAX     "I64x"
-#define SCNXMAX     "I64X"
+#define SCNo64       "llo"
+#define SCNu64       "llu"
+#define SCNx64       "llx"
+#define SCNX64       "llX"
+#define SCNoLEAST64  "llo"
+#define SCNuLEAST64  "llu"
+#define SCNxLEAST64  "llx"
+#define SCNXLEAST64  "llX"
+#define SCNoFAST64   "llo"
+#define SCNuFAST64   "llu"
+#define SCNxFAST64   "llx"
+#define SCNXFAST64   "llX"
+
+#define SCNoMAX     "llo"
+#define SCNuMAX     "llu"
+#define SCNxMAX     "llx"
+#define SCNXMAX     "llX"
 
 #ifdef _WIN64
-#  define SCNoPTR     "I64o"
-#  define SCNuPTR     "I64u"
-#  define SCNxPTR     "I64x"
-#  define SCNXPTR     "I64X"
+#  define SCNoPTR     "llo"
+#  define SCNuPTR     "llu"
+#  define SCNxPTR     "llx"
+#  define SCNXPTR     "llX"
 #else
 #  define SCNoPTR     "lo"
 #  define SCNuPTR     "lu"
diff --git a/Source/JavaScriptCore/parser/ASTBuilder.h b/Source/JavaScriptCore/parser/ASTBuilder.h
index b6ea004b5..b8718709b 100644
--- a/Source/JavaScriptCore/parser/ASTBuilder.h
+++ b/Source/JavaScriptCore/parser/ASTBuilder.h
@@ -265,7 +265,6 @@ public:
 
     FunctionBodyNode* createFunctionBody(int lineNumber, bool inStrictContext)
     {
-        usesClosures();
         return FunctionBodyNode::create(m_globalData, lineNumber, inStrictContext);
     }
     
@@ -624,9 +623,7 @@ private:
     void incConstants() { m_scope.m_numConstants++; }
     void usesThis() { m_scope.m_features |= ThisFeature; }
     void usesCatch() { m_scope.m_features |= CatchFeature; }
-    void usesClosures() { m_scope.m_features |= ClosureFeature; }
     void usesArguments() { m_scope.m_features |= ArgumentsFeature; }
-    void usesAssignment() { m_scope.m_features |= AssignFeature; }
     void usesWith() { m_scope.m_features |= WithFeature; }
     void usesEval() 
     {
@@ -904,7 +901,6 @@ ExpressionNode* ASTBuilder::makeBinaryNode(int lineNumber, int token, pair<Expre
 
 ExpressionNode* ASTBuilder::makeAssignNode(int lineNumber, ExpressionNode* loc, Operator op, ExpressionNode* expr, bool locHasAssignments, bool exprHasAssignments, int start, int divot, int end)
 {
-    usesAssignment();
     if (!loc->isLocation())
         return new (m_globalData) AssignErrorNode(lineNumber, loc, op, expr, divot, divot - start, end - divot);
 
@@ -942,7 +938,6 @@ ExpressionNode* ASTBuilder::makeAssignNode(int lineNumber, ExpressionNode* loc,
 
 ExpressionNode* ASTBuilder::makePrefixNode(int lineNumber, ExpressionNode* expr, Operator op, int start, int divot, int end)
 {
-    usesAssignment();
     if (!expr->isLocation())
         return new (m_globalData) PrefixErrorNode(lineNumber, expr, op, divot, divot - start, end - divot);
 
@@ -965,7 +960,6 @@ ExpressionNode* ASTBuilder::makePrefixNode(int lineNumber, ExpressionNode* expr,
 
 ExpressionNode* ASTBuilder::makePostfixNode(int lineNumber, ExpressionNode* expr, Operator op, int start, int divot, int end)
 {
-    usesAssignment();
     if (!expr->isLocation())
         return new (m_globalData) PostfixErrorNode(lineNumber, expr, op, divot, divot - start, end - divot);
 
diff --git a/Source/JavaScriptCore/parser/Keywords.table b/Source/JavaScriptCore/parser/Keywords.table
index 333b4762d..27c4e53a2 100644
--- a/Source/JavaScriptCore/parser/Keywords.table
+++ b/Source/JavaScriptCore/parser/Keywords.table
@@ -1,12 +1,12 @@
-# main keywords
+# Main keywords.
 @begin mainTable 47
 
-# types
+# Types.
 null		NULLTOKEN
 true		TRUETOKEN
 false		FALSETOKEN
 
-# keywords
+# Keywords.
 break		BREAK
 case		CASE
 catch		CATCH
@@ -35,7 +35,7 @@ typeof		TYPEOF
 with		WITH
 debugger	DEBUGGER
 
-# reserved for future use
+# Reserved for future use.
 class           RESERVED
 enum            RESERVED
 export          RESERVED
@@ -46,7 +46,7 @@ super           RESERVED
 # technically RESERVED_IF_STRICT in ES5, but may be reserved in ES6.
 let             RESERVED
 
-# reserved for future use in strict code
+# Reserved for future use in strict code.
 implements      RESERVED_IF_STRICT
 interface       RESERVED_IF_STRICT
 package         RESERVED_IF_STRICT
@@ -57,4 +57,3 @@ static          RESERVED_IF_STRICT
 yield           RESERVED_IF_STRICT
 
 @end
-
diff --git a/Source/JavaScriptCore/parser/Lexer.cpp b/Source/JavaScriptCore/parser/Lexer.cpp
index e38b52480..015c1509d 100644
--- a/Source/JavaScriptCore/parser/Lexer.cpp
+++ b/Source/JavaScriptCore/parser/Lexer.cpp
@@ -3,6 +3,7 @@
  *  Copyright (C) 2006, 2007, 2008, 2009 Apple Inc. All Rights Reserved.
  *  Copyright (C) 2007 Cameron Zwarich (cwzwarich@uwaterloo.ca)
  *  Copyright (C) 2010 Zoltan Herczeg (zherczeg@inf.u-szeged.hu)
+ *  Copyright (C) 2012 Mathias Bynens (mathias@qiwi.be)
  *
  *  This library is free software; you can redistribute it and/or
  *  modify it under the terms of the GNU Library General Public
@@ -379,8 +380,8 @@ static inline bool isIdentStart(int c)
 
 static NEVER_INLINE bool isNonASCIIIdentPart(int c)
 {
-    return category(c) & (Letter_Uppercase | Letter_Lowercase | Letter_Titlecase | Letter_Modifier | Letter_Other
-        | Mark_NonSpacing | Mark_SpacingCombining | Number_DecimalDigit | Punctuation_Connector);
+    return (category(c) & (Letter_Uppercase | Letter_Lowercase | Letter_Titlecase | Letter_Modifier | Letter_Other
+        | Mark_NonSpacing | Mark_SpacingCombining | Number_DecimalDigit | Punctuation_Connector)) || c == 0x200C || c == 0x200D;
 }
 
 static ALWAYS_INLINE bool isIdentPart(int c)
@@ -1328,7 +1329,7 @@ inNumberAfterDecimalPoint:
                     }
                 // Null-terminate string for strtod.
                 m_buffer8.append('\0');
-                tokenData->doubleValue = WTF::strtod(reinterpret_cast<const char*>(m_buffer8.data()), 0);
+                tokenData->doubleValue = WTF::strtod<WTF::AllowTrailingJunk>(reinterpret_cast<const char*>(m_buffer8.data()), 0);
             }
             token = NUMBER;
         }
diff --git a/Source/JavaScriptCore/parser/Nodes.h b/Source/JavaScriptCore/parser/Nodes.h
index 278d17ef4..0373766b5 100644
--- a/Source/JavaScriptCore/parser/Nodes.h
+++ b/Source/JavaScriptCore/parser/Nodes.h
@@ -51,17 +51,14 @@ namespace JSC {
 
     const CodeFeatures NoFeatures = 0;
     const CodeFeatures EvalFeature = 1 << 0;
-    const CodeFeatures ClosureFeature = 1 << 1;
-    const CodeFeatures AssignFeature = 1 << 2;
-    const CodeFeatures ArgumentsFeature = 1 << 3;
-    const CodeFeatures WithFeature = 1 << 4;
-    const CodeFeatures CatchFeature = 1 << 5;
-    const CodeFeatures ThisFeature = 1 << 6;
-    const CodeFeatures StrictModeFeature = 1 << 7;
-    const CodeFeatures ShadowsArgumentsFeature = 1 << 8;
+    const CodeFeatures ArgumentsFeature = 1 << 1;
+    const CodeFeatures WithFeature = 1 << 2;
+    const CodeFeatures CatchFeature = 1 << 3;
+    const CodeFeatures ThisFeature = 1 << 4;
+    const CodeFeatures StrictModeFeature = 1 << 5;
+    const CodeFeatures ShadowsArgumentsFeature = 1 << 6;
     
-    
-    const CodeFeatures AllFeatures = EvalFeature | ClosureFeature | AssignFeature | ArgumentsFeature | WithFeature | CatchFeature | ThisFeature | StrictModeFeature | ShadowsArgumentsFeature;
+    const CodeFeatures AllFeatures = EvalFeature | ArgumentsFeature | WithFeature | CatchFeature | ThisFeature | StrictModeFeature | ShadowsArgumentsFeature;
 
     enum Operator {
         OpEqual,
@@ -1493,7 +1490,7 @@ namespace JSC {
         void finishParsing(PassRefPtr<FunctionParameters>, const Identifier&);
         
         const Identifier& ident() { return m_ident; }
-        void setInferredName(const Identifier& inferredName) { m_inferredName = inferredName; }
+        void setInferredName(const Identifier& inferredName) { ASSERT(!inferredName.isNull()); m_inferredName = inferredName; }
         const Identifier& inferredName() { return m_inferredName.isEmpty() ? m_ident : m_inferredName; }
 
         static const bool scopeIsFunction = true;
diff --git a/Source/JavaScriptCore/parser/Parser.cpp b/Source/JavaScriptCore/parser/Parser.cpp
index 25ada5606..939d2696c 100644
--- a/Source/JavaScriptCore/parser/Parser.cpp
+++ b/Source/JavaScriptCore/parser/Parser.cpp
@@ -1,7 +1,7 @@
 /*
  *  Copyright (C) 1999-2001 Harri Porten (porten@kde.org)
  *  Copyright (C) 2001 Peter Kelly (pmk@post.com)
- *  Copyright (C) 2003, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
+ *  Copyright (C) 2003, 2006, 2007, 2008, 2009, 2010 Apple Inc. All rights reserved.
  *
  *  This library is free software; you can redistribute it and/or
  *  modify it under the terms of the GNU Library General Public
@@ -774,7 +774,6 @@ template <FunctionRequirements requirements, bool nameIsInContainingScope, class
     functionScope->setIsFunction();
     if (match(IDENT)) {
         name = m_token.m_data.ident;
-        failIfTrueWithMessage(*name == m_globalData->propertyNames->underscoreProto, "Cannot name a function __proto__");
         next();
         if (!nameIsInContainingScope)
             failIfFalseIfStrict(functionScope->declareVariable(name));
diff --git a/Source/JavaScriptCore/parser/Parser.h b/Source/JavaScriptCore/parser/Parser.h
index f3d96ff3e..9b76242d4 100644
--- a/Source/JavaScriptCore/parser/Parser.h
+++ b/Source/JavaScriptCore/parser/Parser.h
@@ -1,7 +1,7 @@
 /*
  *  Copyright (C) 1999-2001 Harri Porten (porten@kde.org)
  *  Copyright (C) 2001 Peter Kelly (pmk@post.com)
- *  Copyright (C) 2003, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
+ *  Copyright (C) 2003, 2006, 2007, 2008, 2009, 2010, 2011 Apple Inc. All rights reserved.
  *
  *  This library is free software; you can redistribute it and/or
  *  modify it under the terms of the GNU Library General Public
@@ -37,6 +37,15 @@
 #include <wtf/Noncopyable.h>
 #include <wtf/OwnPtr.h>
 #include <wtf/RefPtr.h>
+namespace JSC {
+struct Scope;
+}
+
+namespace WTF {
+template <> struct VectorTraits<JSC::Scope> : SimpleClassVectorTraits {
+    static const bool canInitializeWithMemset = false; // Not all Scope data members initialize to 0.
+};
+}
 
 namespace JSC {
 
@@ -1016,7 +1025,7 @@ PassRefPtr<ParsedNode> Parser<LexerType>::parse(JSGlobalObject* lexicalGlobalObj
         else if (isEvalNode<ParsedNode>())
             *exception = createSyntaxError(lexicalGlobalObject, errMsg);
         else
-            *exception = addErrorInfo(&lexicalGlobalObject->globalData(), createSyntaxError(lexicalGlobalObject, errMsg), errLine, *m_source);
+            *exception = addErrorInfo(&lexicalGlobalObject->globalData(), createSyntaxError(lexicalGlobalObject, errMsg), errLine, *m_source, Vector<StackFrame>());
     }
 
     if (debugger && !ParsedNode::scopeIsFunction)
diff --git a/Source/JavaScriptCore/profiler/Profile.cpp b/Source/JavaScriptCore/profiler/Profile.cpp
index 1a84518c1..49d6de97a 100644
--- a/Source/JavaScriptCore/profiler/Profile.cpp
+++ b/Source/JavaScriptCore/profiler/Profile.cpp
@@ -28,6 +28,7 @@
 
 #include "ProfileNode.h"
 #include <stdio.h>
+#include <wtf/DataLog.h>
 
 namespace JSC {
 
@@ -102,7 +103,7 @@ void Profile::restoreAll()
 #ifndef NDEBUG
 void Profile::debugPrintData() const
 {
-    printf("Call graph:\n");
+    dataLog("Call graph:\n");
     m_head->debugPrintData(0);
 }
 
@@ -118,18 +119,18 @@ void Profile::debugPrintDataSampleStyle() const
     typedef Vector<NameCountPair> NameCountPairVector;
 
     FunctionCallHashCount countedFunctions;
-    printf("Call graph:\n");
+    dataLog("Call graph:\n");
     m_head->debugPrintDataSampleStyle(0, countedFunctions);
 
-    printf("\nTotal number in stack:\n");
+    dataLog("\nTotal number in stack:\n");
     NameCountPairVector sortedFunctions(countedFunctions.size());
     copyToVector(countedFunctions, sortedFunctions);
 
     std::sort(sortedFunctions.begin(), sortedFunctions.end(), functionNameCountPairComparator);
     for (NameCountPairVector::iterator it = sortedFunctions.begin(); it != sortedFunctions.end(); ++it)
-        printf("        %-12d%s\n", (*it).second, UString((*it).first).utf8().data());
+        dataLog("        %-12d%s\n", (*it).second, UString((*it).first).utf8().data());
 
-    printf("\nSort by top of stack, same collapsed (when >= 5):\n");
+    dataLog("\nSort by top of stack, same collapsed (when >= 5):\n");
 }
 #endif
 
diff --git a/Source/JavaScriptCore/profiler/ProfileNode.cpp b/Source/JavaScriptCore/profiler/ProfileNode.cpp
index 8f20bbeff..ab43d1511 100644
--- a/Source/JavaScriptCore/profiler/ProfileNode.cpp
+++ b/Source/JavaScriptCore/profiler/ProfileNode.cpp
@@ -32,6 +32,7 @@
 #include "Profiler.h"
 #include <stdio.h>
 #include <wtf/DateMath.h>
+#include <wtf/DataLog.h>
 #include <wtf/text/StringHash.h>
 
 #if OS(WINDOWS)
@@ -293,9 +294,9 @@ void ProfileNode::debugPrintData(int indentLevel) const
 {
     // Print function names
     for (int i = 0; i < indentLevel; ++i)
-        printf("  ");
+        dataLog("  ");
 
-    printf("Function Name %s %d SelfTime %.3fms/%.3f%% TotalTime %.3fms/%.3f%% VSelf %.3fms VTotal %.3fms Visible %s Next Sibling %s\n",
+    dataLog("Function Name %s %d SelfTime %.3fms/%.3f%% TotalTime %.3fms/%.3f%% VSelf %.3fms VTotal %.3fms Visible %s Next Sibling %s\n",
         functionName().utf8().data(), 
         m_numberOfCalls, m_actualSelfTime, selfPercent(), m_actualTotalTime, totalPercent(),
         m_visibleSelfTime, m_visibleTotalTime, 
@@ -312,20 +313,20 @@ void ProfileNode::debugPrintData(int indentLevel) const
 // print the profiled data in a format that matches the tool sample's output.
 double ProfileNode::debugPrintDataSampleStyle(int indentLevel, FunctionCallHashCount& countedFunctions) const
 {
-    printf("    ");
+    dataLog("    ");
 
     // Print function names
     const char* name = functionName().utf8().data();
     double sampleCount = m_actualTotalTime * 1000;
     if (indentLevel) {
         for (int i = 0; i < indentLevel; ++i)
-            printf("  ");
+            dataLog("  ");
 
          countedFunctions.add(functionName().impl());
 
-        printf("%.0f %s\n", sampleCount ? sampleCount : 1, name);
+        dataLog("%.0f %s\n", sampleCount ? sampleCount : 1, name);
     } else
-        printf("%s\n", name);
+        dataLog("%s\n", name);
 
     ++indentLevel;
 
@@ -337,11 +338,11 @@ double ProfileNode::debugPrintDataSampleStyle(int indentLevel, FunctionCallHashC
     sumOfChildrensCount *= 1000;    //
     // Print remainder of samples to match sample's output
     if (sumOfChildrensCount < sampleCount) {
-        printf("    ");
+        dataLog("    ");
         while (indentLevel--)
-            printf("  ");
+            dataLog("  ");
 
-        printf("%.0f %s\n", sampleCount - sumOfChildrensCount, functionName().utf8().data());
+        dataLog("%.0f %s\n", sampleCount - sumOfChildrensCount, functionName().utf8().data());
     }
 
     return m_actualTotalTime;
diff --git a/Source/JavaScriptCore/runtime/Arguments.cpp b/Source/JavaScriptCore/runtime/Arguments.cpp
index 6a675ab84..a099adb75 100644
--- a/Source/JavaScriptCore/runtime/Arguments.cpp
+++ b/Source/JavaScriptCore/runtime/Arguments.cpp
@@ -243,6 +243,9 @@ bool Arguments::deletePropertyByIndex(JSCell* cell, ExecState* exec, unsigned i)
 {
     Arguments* thisObject = jsCast<Arguments*>(cell);
     if (i < thisObject->d->numArguments) {
+        if (!Base::deletePropertyByIndex(cell, exec, i))
+            return false;
+
         if (!thisObject->d->deletedArguments) {
             thisObject->d->deletedArguments = adoptArrayPtr(new bool[thisObject->d->numArguments]);
             memset(thisObject->d->deletedArguments.get(), 0, sizeof(bool) * thisObject->d->numArguments);
@@ -258,10 +261,16 @@ bool Arguments::deletePropertyByIndex(JSCell* cell, ExecState* exec, unsigned i)
 
 bool Arguments::deleteProperty(JSCell* cell, ExecState* exec, const Identifier& propertyName) 
 {
+    if (exec->globalData().isInDefineOwnProperty())
+        return Base::deleteProperty(cell, exec, propertyName);
+
     Arguments* thisObject = jsCast<Arguments*>(cell);
     bool isArrayIndex;
     unsigned i = propertyName.toArrayIndex(isArrayIndex);
     if (isArrayIndex && i < thisObject->d->numArguments) {
+        if (!Base::deleteProperty(cell, exec, propertyName))
+            return false;
+
         if (!thisObject->d->deletedArguments) {
             thisObject->d->deletedArguments = adoptArrayPtr(new bool[thisObject->d->numArguments]);
             memset(thisObject->d->deletedArguments.get(), 0, sizeof(bool) * thisObject->d->numArguments);
@@ -285,12 +294,74 @@ bool Arguments::deleteProperty(JSCell* cell, ExecState* exec, const Identifier&
         thisObject->createStrictModeCalleeIfNecessary(exec);
     }
     
-    if (propertyName == exec->propertyNames().caller && !thisObject->d->isStrictMode)
+    if (propertyName == exec->propertyNames().caller && thisObject->d->isStrictMode)
         thisObject->createStrictModeCallerIfNecessary(exec);
 
     return JSObject::deleteProperty(thisObject, exec, propertyName);
 }
 
+bool Arguments::defineOwnProperty(JSObject* object, ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor, bool shouldThrow)
+{
+    Arguments* thisObject = jsCast<Arguments*>(object);
+    bool isArrayIndex;
+    unsigned i = propertyName.toArrayIndex(isArrayIndex);
+    if (isArrayIndex && i < thisObject->d->numArguments) {
+        if (!Base::defineOwnProperty(object, exec, propertyName, descriptor, shouldThrow))
+            return false;
+
+        if (!thisObject->d->deletedArguments) {
+            thisObject->d->deletedArguments = adoptArrayPtr(new bool[thisObject->d->numArguments]);
+            memset(thisObject->d->deletedArguments.get(), 0, sizeof(bool) * thisObject->d->numArguments);
+        }
+        // From ES 5.1, 10.6 Arguments Object
+        // 5. If the value of isMapped is not undefined, then
+        if (!thisObject->d->deletedArguments[i]) {
+            // a. If IsAccessorDescriptor(Desc) is true, then
+            if (descriptor.isAccessorDescriptor()) {
+                // i. Call the [[Delete]] internal method of map passing P, and false as the arguments.
+                thisObject->d->deletedArguments[i] = true;
+            } else if (descriptor.value()) { // b. Else i. If Desc.[[Value]] is present, then
+                // 1. Call the [[Put]] internal method of map passing P, Desc.[[Value]], and Throw as the arguments.
+                // ii. If Desc.[[Writable]] is present and its value is false, then
+                thisObject->argument(i).set(exec->globalData(), thisObject, descriptor.value());
+                if (descriptor.writablePresent() && !descriptor.writable())
+                    thisObject->d->deletedArguments[i] = true; // 1. Call the [[Delete]] internal method of map passing P and false as arguments.
+            }
+        }
+
+        return true;
+    }
+
+    if (propertyName == exec->propertyNames().length && !thisObject->d->overrodeLength) {
+        thisObject->d->overrodeLength = true;
+        if (!descriptor.isAccessorDescriptor()) {
+            if (!descriptor.value())
+                descriptor.setValue(jsNumber(thisObject->d->numArguments));
+            if (!descriptor.configurablePresent())
+                descriptor.setConfigurable(true);
+        }
+        if (!descriptor.configurablePresent())
+            descriptor.setConfigurable(true);
+    }
+
+    if (propertyName == exec->propertyNames().callee && !thisObject->d->overrodeCallee) {
+        thisObject->d->overrodeCallee = true;
+        if (!descriptor.isAccessorDescriptor()) {
+            if (!descriptor.value())
+                descriptor.setValue(thisObject->d->callee.get());
+            if (!descriptor.configurablePresent())
+                descriptor.setConfigurable(true);
+        }
+        if (!descriptor.configurablePresent())
+            descriptor.setConfigurable(true);
+    }
+
+    if (propertyName == exec->propertyNames().caller && thisObject->d->isStrictMode)
+        thisObject->createStrictModeCallerIfNecessary(exec);
+
+    return Base::defineOwnProperty(object, exec, propertyName, descriptor, shouldThrow);
+}
+
 void Arguments::tearOff(CallFrame* callFrame)
 {
     if (isTornOff())
diff --git a/Source/JavaScriptCore/runtime/Arguments.h b/Source/JavaScriptCore/runtime/Arguments.h
index 3564fe447..ee54a49eb 100644
--- a/Source/JavaScriptCore/runtime/Arguments.h
+++ b/Source/JavaScriptCore/runtime/Arguments.h
@@ -117,6 +117,7 @@ namespace JSC {
         static void putByIndex(JSCell*, ExecState*, unsigned propertyName, JSValue);
         static bool deleteProperty(JSCell*, ExecState*, const Identifier& propertyName);
         static bool deletePropertyByIndex(JSCell*, ExecState*, unsigned propertyName);
+        static bool defineOwnProperty(JSObject*, ExecState*, const Identifier& propertyName, PropertyDescriptor&, bool shouldThrow);
         void createStrictModeCallerIfNecessary(ExecState*);
         void createStrictModeCalleeIfNecessary(ExecState*);
 
diff --git a/Source/JavaScriptCore/runtime/CodeSpecializationKind.h b/Source/JavaScriptCore/runtime/CodeSpecializationKind.h
new file mode 100644
index 000000000..ba2a54f37
--- /dev/null
+++ b/Source/JavaScriptCore/runtime/CodeSpecializationKind.h
@@ -0,0 +1,36 @@
+/*
+ * Copyright (C) 2012 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef CodeSpecializationKind_h
+#define CodeSpecializationKind_h
+
+namespace JSC {
+
+enum CodeSpecializationKind { CodeForCall, CodeForConstruct };
+
+} // namespace JSC
+
+#endif // CodeSpecializationKind_h
+
diff --git a/Source/JavaScriptCore/runtime/CommonIdentifiers.h b/Source/JavaScriptCore/runtime/CommonIdentifiers.h
index 08d8644b5..d79e5c783 100644
--- a/Source/JavaScriptCore/runtime/CommonIdentifiers.h
+++ b/Source/JavaScriptCore/runtime/CommonIdentifiers.h
@@ -62,6 +62,7 @@
     macro(prototype) \
     macro(set) \
     macro(source) \
+    macro(stack) \
     macro(test) \
     macro(toExponential) \
     macro(toFixed) \
diff --git a/Source/JavaScriptCore/runtime/CommonSlowPaths.h b/Source/JavaScriptCore/runtime/CommonSlowPaths.h
index 86c4bd5c2..345af2ebe 100644
--- a/Source/JavaScriptCore/runtime/CommonSlowPaths.h
+++ b/Source/JavaScriptCore/runtime/CommonSlowPaths.h
@@ -27,6 +27,7 @@
 #define CommonSlowPaths_h
 
 #include "CodeBlock.h"
+#include "CodeSpecializationKind.h"
 #include "ExceptionHelpers.h"
 #include "JSArray.h"
 
@@ -41,6 +42,38 @@ namespace JSC {
 
 namespace CommonSlowPaths {
 
+ALWAYS_INLINE ExecState* arityCheckFor(ExecState* exec, RegisterFile* registerFile, CodeSpecializationKind kind)
+{
+    JSFunction* callee = asFunction(exec->callee());
+    ASSERT(!callee->isHostFunction());
+    CodeBlock* newCodeBlock = &callee->jsExecutable()->generatedBytecodeFor(kind);
+    int argumentCountIncludingThis = exec->argumentCountIncludingThis();
+
+    // This ensures enough space for the worst case scenario of zero arguments passed by the caller.
+    if (!registerFile->grow(exec->registers() + newCodeBlock->numParameters() + newCodeBlock->m_numCalleeRegisters))
+        return 0;
+
+    ASSERT(argumentCountIncludingThis < newCodeBlock->numParameters());
+
+    // Too few arguments -- copy call frame and arguments, then fill in missing arguments with undefined.
+    size_t delta = newCodeBlock->numParameters() - argumentCountIncludingThis;
+    Register* src = exec->registers();
+    Register* dst = exec->registers() + delta;
+
+    int i;
+    int end = -ExecState::offsetFor(argumentCountIncludingThis);
+    for (i = -1; i >= end; --i)
+        dst[i] = src[i];
+
+    end -= delta;
+    for ( ; i >= end; --i)
+        dst[i] = jsUndefined();
+
+    ExecState* newExec = ExecState::create(dst);
+    ASSERT((void*)newExec <= registerFile->end());
+    return newExec;
+}
+
 ALWAYS_INLINE bool opInstanceOfSlow(ExecState* exec, JSValue value, JSValue baseVal, JSValue proto)
 {
     ASSERT(!value.isCell() || !baseVal.isCell() || !proto.isCell()
diff --git a/Source/JavaScriptCore/runtime/DatePrototype.cpp b/Source/JavaScriptCore/runtime/DatePrototype.cpp
index 922fb0a86..ddea33786 100644
--- a/Source/JavaScriptCore/runtime/DatePrototype.cpp
+++ b/Source/JavaScriptCore/runtime/DatePrototype.cpp
@@ -60,7 +60,7 @@
 #include <sys/timeb.h>
 #endif
 
-#if PLATFORM(MAC) || PLATFORM(IOS) || PLATFORM(WX) || (PLATFORM(QT) && OS(DARWIN))
+#if PLATFORM(MAC) || PLATFORM(IOS) || (PLATFORM(WX) && OS(DARWIN)) || (PLATFORM(QT) && OS(DARWIN))
 #include <CoreFoundation/CoreFoundation.h>
 #elif USE(ICU_UNICODE)
 #include <unicode/udat.h>
@@ -130,7 +130,7 @@ namespace JSC {
 
 enum LocaleDateTimeFormat { LocaleDateAndTime, LocaleDate, LocaleTime };
  
-#if PLATFORM(MAC) || PLATFORM(IOS) || PLATFORM(WX) || (PLATFORM(QT) && OS(DARWIN))
+#if PLATFORM(MAC) || PLATFORM(IOS) || (PLATFORM(WX) && OS(DARWIN)) || (PLATFORM(QT) && OS(DARWIN))
 
 // FIXME: Since this is superior to the strftime-based version, why limit this to PLATFORM(MAC)?
 // Instead we should consider using this whenever USE(CF) is true.
diff --git a/Source/JavaScriptCore/runtime/Error.cpp b/Source/JavaScriptCore/runtime/Error.cpp
index 0947e3c20..243dc8856 100644
--- a/Source/JavaScriptCore/runtime/Error.cpp
+++ b/Source/JavaScriptCore/runtime/Error.cpp
@@ -26,7 +26,9 @@
 
 #include "ConstructData.h"
 #include "ErrorConstructor.h"
+#include "ExceptionHelpers.h"
 #include "FunctionPrototype.h"
+#include "JSArray.h"
 #include "JSFunction.h"
 #include "JSGlobalObject.h"
 #include "JSObject.h"
@@ -116,7 +118,7 @@ JSObject* createURIError(ExecState* exec, const UString& message)
     return createURIError(exec->lexicalGlobalObject(), message);
 }
 
-JSObject* addErrorInfo(JSGlobalData* globalData, JSObject* error, int line, const SourceCode& source)
+JSObject* addErrorInfo(JSGlobalData* globalData, JSObject* error, int line, const SourceCode& source, const Vector<StackFrame>& stackTrace)
 {
     const UString& sourceURL = source.provider()->url();
 
@@ -124,13 +126,34 @@ JSObject* addErrorInfo(JSGlobalData* globalData, JSObject* error, int line, cons
         error->putDirect(*globalData, Identifier(globalData, linePropertyName), jsNumber(line), ReadOnly | DontDelete);
     if (!sourceURL.isNull())
         error->putDirect(*globalData, Identifier(globalData, sourceURLPropertyName), jsString(globalData, sourceURL), ReadOnly | DontDelete);
+    if (!stackTrace.isEmpty()) {
+        JSGlobalObject* globalObject = 0;
+        if (isTerminatedExecutionException(error) || isInterruptedExecutionException(error))
+            globalObject = globalData->dynamicGlobalObject;
+        else
+            globalObject = error->globalObject();
+        // We use the tryCreateUninitialized creation mechanism and related initialization
+        // functions as they're the only mechanism we currently have that will guarantee we
+        // don't call setters on the prototype. Technically it's faster than the alternative,
+        // but the numerous allocations that take place in this loop makes that last bit
+        // somewhat moot.
+        JSArray* stackTraceArray = JSArray::tryCreateUninitialized(*globalData, globalObject->arrayStructure(), stackTrace.size());
+        if (!stackTraceArray)
+            return error;
+        for (unsigned i = 0; i < stackTrace.size(); i++) {
+            UString stackLevel = stackTrace[i].toString(globalObject->globalExec());
+            stackTraceArray->initializeIndex(*globalData, i, jsString(globalData, stackLevel));
+        }
+        stackTraceArray->completeInitialization(stackTrace.size());
+        error->putDirect(*globalData, globalData->propertyNames->stack, stackTraceArray, ReadOnly | DontDelete);
+    }
 
     return error;
 }
 
-JSObject* addErrorInfo(ExecState* exec, JSObject* error, int line, const SourceCode& source)
+JSObject* addErrorInfo(ExecState* exec, JSObject* error, int line, const SourceCode& source, const Vector<StackFrame>& stackTrace)
 {
-    return addErrorInfo(&exec->globalData(), error, line, source);
+    return addErrorInfo(&exec->globalData(), error, line, source, stackTrace);
 }
 
 bool hasErrorInfo(ExecState* exec, JSObject* error)
diff --git a/Source/JavaScriptCore/runtime/Error.h b/Source/JavaScriptCore/runtime/Error.h
index 88b540a35..59b39495f 100644
--- a/Source/JavaScriptCore/runtime/Error.h
+++ b/Source/JavaScriptCore/runtime/Error.h
@@ -24,6 +24,7 @@
 #define Error_h
 
 #include "InternalFunction.h"
+#include "Interpreter.h"
 #include "JSObject.h"
 #include <stdint.h>
 
@@ -56,9 +57,9 @@ namespace JSC {
 
     // Methods to add 
     bool hasErrorInfo(ExecState*, JSObject* error);
-    JSObject* addErrorInfo(JSGlobalData*, JSObject* error, int line, const SourceCode&);
+    JSObject* addErrorInfo(JSGlobalData*, JSObject* error, int line, const SourceCode&, const Vector<StackFrame>&);
     // ExecState wrappers.
-    JSObject* addErrorInfo(ExecState*, JSObject* error, int line, const SourceCode&);
+    JSObject* addErrorInfo(ExecState*, JSObject* error, int line, const SourceCode&, const Vector<StackFrame>&);
 
     // Methods to throw Errors.
     JS_EXPORT_PRIVATE JSValue throwError(ExecState*, JSValue);
diff --git a/Source/JavaScriptCore/runtime/Executable.cpp b/Source/JavaScriptCore/runtime/Executable.cpp
index bf49767ab..25ddf764a 100644
--- a/Source/JavaScriptCore/runtime/Executable.cpp
+++ b/Source/JavaScriptCore/runtime/Executable.cpp
@@ -29,6 +29,7 @@
 #include "BytecodeGenerator.h"
 #include "CodeBlock.h"
 #include "DFGDriver.h"
+#include "ExecutionHarness.h"
 #include "JIT.h"
 #include "JITDriver.h"
 #include "Parser.h"
@@ -39,10 +40,12 @@ namespace JSC {
 
 const ClassInfo ExecutableBase::s_info = { "Executable", 0, 0, 0, CREATE_METHOD_TABLE(ExecutableBase) };
 
+#if ENABLE(JIT)
 void ExecutableBase::destroy(JSCell* cell)
 {
     jsCast<ExecutableBase*>(cell)->ExecutableBase::~ExecutableBase();
 }
+#endif
 
 inline void ExecutableBase::clearCode()
 {
@@ -67,10 +70,12 @@ Intrinsic ExecutableBase::intrinsic() const
 
 const ClassInfo NativeExecutable::s_info = { "NativeExecutable", &ExecutableBase::s_info, 0, 0, CREATE_METHOD_TABLE(NativeExecutable) };
 
+#if ENABLE(JIT)
 void NativeExecutable::destroy(JSCell* cell)
 {
     jsCast<NativeExecutable*>(cell)->NativeExecutable::~NativeExecutable();
 }
+#endif
 
 #if ENABLE(DFG_JIT)
 Intrinsic NativeExecutable::intrinsic() const
@@ -84,7 +89,7 @@ Intrinsic NativeExecutable::intrinsic() const
 template<typename T>
 static void jettisonCodeBlock(JSGlobalData& globalData, OwnPtr<T>& codeBlock)
 {
-    ASSERT(codeBlock->getJITType() != JITCode::BaselineJIT);
+    ASSERT(JITCode::isOptimizingJIT(codeBlock->getJITType()));
     ASSERT(codeBlock->alternative());
     OwnPtr<T> codeBlockToJettison = codeBlock.release();
     codeBlock = static_pointer_cast<T>(codeBlockToJettison->releaseAlternative());
@@ -100,10 +105,12 @@ void NativeExecutable::finalize(JSCell* cell)
 
 const ClassInfo ScriptExecutable::s_info = { "ScriptExecutable", &ExecutableBase::s_info, 0, 0, CREATE_METHOD_TABLE(ScriptExecutable) };
 
+#if ENABLE(JIT)
 void ScriptExecutable::destroy(JSCell* cell)
 {
     jsCast<ScriptExecutable*>(cell)->ScriptExecutable::~ScriptExecutable();
 }
+#endif
 
 const ClassInfo EvalExecutable::s_info = { "EvalExecutable", &ScriptExecutable::s_info, 0, 0, CREATE_METHOD_TABLE(EvalExecutable) };
 
@@ -169,9 +176,32 @@ JSObject* EvalExecutable::compileOptimized(ExecState* exec, ScopeChainNode* scop
     return error;
 }
 
+#if ENABLE(JIT)
+void EvalExecutable::jitCompile(JSGlobalData& globalData)
+{
+    bool result = jitCompileIfAppropriate(globalData, m_evalCodeBlock, m_jitCodeForCall, JITCode::bottomTierJIT());
+    ASSERT_UNUSED(result, result);
+}
+#endif
+
+inline const char* samplingDescription(JITCode::JITType jitType)
+{
+    switch (jitType) {
+    case JITCode::InterpreterThunk:
+        return "Interpreter Compilation (TOTAL)";
+    case JITCode::BaselineJIT:
+        return "Baseline Compilation (TOTAL)";
+    case JITCode::DFGJIT:
+        return "DFG Compilation (TOTAL)";
+    default:
+        ASSERT_NOT_REACHED();
+        return 0;
+    }
+}
+
 JSObject* EvalExecutable::compileInternal(ExecState* exec, ScopeChainNode* scopeChainNode, JITCode::JITType jitType)
 {
-    SamplingRegion samplingRegion(jitType == JITCode::BaselineJIT ? "Baseline Compilation (TOTAL)" : "DFG Compilation (TOTAL)");
+    SamplingRegion samplingRegion(samplingDescription(jitType));
     
 #if !ENABLE(JIT)
     UNUSED_PARAM(jitType);
@@ -212,12 +242,12 @@ JSObject* EvalExecutable::compileInternal(ExecState* exec, ScopeChainNode* scope
     }
 
 #if ENABLE(JIT)
-    if (!jitCompileIfAppropriate(*globalData, m_evalCodeBlock, m_jitCodeForCall, jitType))
+    if (!prepareForExecution(*globalData, m_evalCodeBlock, m_jitCodeForCall, jitType))
         return 0;
 #endif
 
 #if ENABLE(JIT)
-#if ENABLE(INTERPRETER)
+#if ENABLE(CLASSIC_INTERPRETER)
     if (!m_jitCodeForCall)
         Heap::heap(this)->reportExtraMemoryCost(sizeof(*m_evalCodeBlock));
     else
@@ -297,9 +327,17 @@ JSObject* ProgramExecutable::compileOptimized(ExecState* exec, ScopeChainNode* s
     return error;
 }
 
+#if ENABLE(JIT)
+void ProgramExecutable::jitCompile(JSGlobalData& globalData)
+{
+    bool result = jitCompileIfAppropriate(globalData, m_programCodeBlock, m_jitCodeForCall, JITCode::bottomTierJIT());
+    ASSERT_UNUSED(result, result);
+}
+#endif
+
 JSObject* ProgramExecutable::compileInternal(ExecState* exec, ScopeChainNode* scopeChainNode, JITCode::JITType jitType)
 {
-    SamplingRegion samplingRegion(jitType == JITCode::BaselineJIT ? "Baseline Compilation (TOTAL)" : "DFG Compilation (TOTAL)");
+    SamplingRegion samplingRegion(samplingDescription(jitType));
     
 #if !ENABLE(JIT)
     UNUSED_PARAM(jitType);
@@ -338,12 +376,12 @@ JSObject* ProgramExecutable::compileInternal(ExecState* exec, ScopeChainNode* sc
     }
 
 #if ENABLE(JIT)
-    if (!jitCompileIfAppropriate(*globalData, m_programCodeBlock, m_jitCodeForCall, jitType))
+    if (!prepareForExecution(*globalData, m_programCodeBlock, m_jitCodeForCall, jitType))
         return 0;
 #endif
 
 #if ENABLE(JIT)
-#if ENABLE(INTERPRETER)
+#if ENABLE(CLASSIC_INTERPRETER)
     if (!m_jitCodeForCall)
         Heap::heap(this)->reportExtraMemoryCost(sizeof(*m_programCodeBlock));
     else
@@ -414,7 +452,7 @@ FunctionCodeBlock* FunctionExecutable::baselineCodeBlockFor(CodeSpecializationKi
     while (result->alternative())
         result = static_cast<FunctionCodeBlock*>(result->alternative());
     ASSERT(result);
-    ASSERT(result->getJITType() == JITCode::BaselineJIT);
+    ASSERT(JITCode::isBaselineCode(result->getJITType()));
     return result;
 }
 
@@ -440,6 +478,20 @@ JSObject* FunctionExecutable::compileOptimizedForConstruct(ExecState* exec, Scop
     return error;
 }
 
+#if ENABLE(JIT)
+void FunctionExecutable::jitCompileForCall(JSGlobalData& globalData)
+{
+    bool result = jitCompileFunctionIfAppropriate(globalData, m_codeBlockForCall, m_jitCodeForCall, m_jitCodeForCallWithArityCheck, m_symbolTable, JITCode::bottomTierJIT());
+    ASSERT_UNUSED(result, result);
+}
+
+void FunctionExecutable::jitCompileForConstruct(JSGlobalData& globalData)
+{
+    bool result = jitCompileFunctionIfAppropriate(globalData, m_codeBlockForConstruct, m_jitCodeForConstruct, m_jitCodeForConstructWithArityCheck, m_symbolTable, JITCode::bottomTierJIT());
+    ASSERT_UNUSED(result, result);
+}
+#endif
+
 FunctionCodeBlock* FunctionExecutable::codeBlockWithBytecodeFor(CodeSpecializationKind kind)
 {
     FunctionCodeBlock* codeBlock = baselineCodeBlockFor(kind);
@@ -484,7 +536,7 @@ PassOwnPtr<FunctionCodeBlock> FunctionExecutable::produceCodeBlockFor(ScopeChain
 
 JSObject* FunctionExecutable::compileForCallInternal(ExecState* exec, ScopeChainNode* scopeChainNode, JITCode::JITType jitType)
 {
-    SamplingRegion samplingRegion(jitType == JITCode::BaselineJIT ? "Baseline Compilation (TOTAL)" : "DFG Compilation (TOTAL)");
+    SamplingRegion samplingRegion(samplingDescription(jitType));
     
 #if !ENABLE(JIT)
     UNUSED_PARAM(exec);
@@ -506,12 +558,12 @@ JSObject* FunctionExecutable::compileForCallInternal(ExecState* exec, ScopeChain
     m_symbolTable = m_codeBlockForCall->sharedSymbolTable();
 
 #if ENABLE(JIT)
-    if (!jitCompileFunctionIfAppropriate(exec->globalData(), m_codeBlockForCall, m_jitCodeForCall, m_jitCodeForCallWithArityCheck, m_symbolTable, jitType))
+    if (!prepareFunctionForExecution(exec->globalData(), m_codeBlockForCall, m_jitCodeForCall, m_jitCodeForCallWithArityCheck, m_symbolTable, jitType, CodeForCall))
         return 0;
 #endif
 
 #if ENABLE(JIT)
-#if ENABLE(INTERPRETER)
+#if ENABLE(CLASSIC_INTERPRETER)
     if (!m_jitCodeForCall)
         Heap::heap(this)->reportExtraMemoryCost(sizeof(*m_codeBlockForCall));
     else
@@ -526,7 +578,7 @@ JSObject* FunctionExecutable::compileForCallInternal(ExecState* exec, ScopeChain
 
 JSObject* FunctionExecutable::compileForConstructInternal(ExecState* exec, ScopeChainNode* scopeChainNode, JITCode::JITType jitType)
 {
-    SamplingRegion samplingRegion(jitType == JITCode::BaselineJIT ? "Baseline Compilation (TOTAL)" : "DFG Compilation (TOTAL)");
+    SamplingRegion samplingRegion(samplingDescription(jitType));
     
 #if !ENABLE(JIT)
     UNUSED_PARAM(jitType);
@@ -548,12 +600,12 @@ JSObject* FunctionExecutable::compileForConstructInternal(ExecState* exec, Scope
     m_symbolTable = m_codeBlockForConstruct->sharedSymbolTable();
 
 #if ENABLE(JIT)
-    if (!jitCompileFunctionIfAppropriate(exec->globalData(), m_codeBlockForConstruct, m_jitCodeForConstruct, m_jitCodeForConstructWithArityCheck, m_symbolTable, jitType))
+    if (!prepareFunctionForExecution(exec->globalData(), m_codeBlockForConstruct, m_jitCodeForConstruct, m_jitCodeForConstructWithArityCheck, m_symbolTable, jitType, CodeForConstruct))
         return 0;
 #endif
 
 #if ENABLE(JIT)
-#if ENABLE(INTERPRETER)
+#if ENABLE(CLASSIC_INTERPRETER)
     if (!m_jitCodeForConstruct)
         Heap::heap(this)->reportExtraMemoryCost(sizeof(*m_codeBlockForConstruct));
     else
diff --git a/Source/JavaScriptCore/runtime/Executable.h b/Source/JavaScriptCore/runtime/Executable.h
index 6800b5a82..69e80b28e 100644
--- a/Source/JavaScriptCore/runtime/Executable.h
+++ b/Source/JavaScriptCore/runtime/Executable.h
@@ -27,6 +27,7 @@
 #define Executable_h
 
 #include "CallData.h"
+#include "CodeSpecializationKind.h"
 #include "JSFunction.h"
 #include "Interpreter.h"
 #include "Nodes.h"
@@ -39,12 +40,12 @@ namespace JSC {
     class Debugger;
     class EvalCodeBlock;
     class FunctionCodeBlock;
+    class LLIntOffsetsExtractor;
     class ProgramCodeBlock;
     class ScopeChainNode;
 
     struct ExceptionInfo;
     
-    enum CodeSpecializationKind { CodeForCall, CodeForConstruct };
     enum CompilationKind { FirstCompilation, OptimizingCompilation };
 
     inline bool isCall(CodeSpecializationKind kind)
@@ -77,7 +78,9 @@ namespace JSC {
     public:
         typedef JSCell Base;
 
+#if ENABLE(JIT)
         static void destroy(JSCell*);
+#endif
 
         bool isHostFunction() const
         {
@@ -197,7 +200,7 @@ namespace JSC {
         }
 #endif
 
-#if ENABLE(INTERPRETER)
+#if ENABLE(CLASSIC_INTERPRETER)
         static NativeExecutable* create(JSGlobalData& globalData, NativeFunction function, NativeFunction constructor)
         {
             ASSERT(!globalData.canUseJIT());
@@ -208,7 +211,9 @@ namespace JSC {
         }
 #endif
 
+#if ENABLE(JIT)
         static void destroy(JSCell*);
+#endif
 
         NativeFunction function() { return m_function; }
         NativeFunction constructor() { return m_constructor; }
@@ -233,7 +238,7 @@ namespace JSC {
         }
 #endif
 
-#if ENABLE(INTERPRETER)
+#if ENABLE(CLASSIC_INTERPRETER)
         void finishCreation(JSGlobalData& globalData)
         {
             ASSERT(!globalData.canUseJIT());
@@ -276,7 +281,9 @@ namespace JSC {
         {
         }
 
+#if ENABLE(JIT)
         static void destroy(JSCell*);
+#endif
 
         const SourceCode& source() { return m_source; }
         intptr_t sourceID() const { return m_source.provider()->asID(); }
@@ -319,6 +326,7 @@ namespace JSC {
     };
 
     class EvalExecutable : public ScriptExecutable {
+        friend class LLIntOffsetsExtractor;
     public:
         typedef ScriptExecutable Base;
 
@@ -338,6 +346,7 @@ namespace JSC {
         
 #if ENABLE(JIT)
         void jettisonOptimizedCode(JSGlobalData&);
+        void jitCompile(JSGlobalData&);
 #endif
 
         EvalCodeBlock& generatedBytecode()
@@ -384,6 +393,7 @@ namespace JSC {
     };
 
     class ProgramExecutable : public ScriptExecutable {
+        friend class LLIntOffsetsExtractor;
     public:
         typedef ScriptExecutable Base;
 
@@ -411,6 +421,7 @@ namespace JSC {
         
 #if ENABLE(JIT)
         void jettisonOptimizedCode(JSGlobalData&);
+        void jitCompile(JSGlobalData&);
 #endif
 
         ProgramCodeBlock& generatedBytecode()
@@ -453,6 +464,7 @@ namespace JSC {
 
     class FunctionExecutable : public ScriptExecutable {
         friend class JIT;
+        friend class LLIntOffsetsExtractor;
     public:
         typedef ScriptExecutable Base;
 
@@ -508,6 +520,7 @@ namespace JSC {
         
 #if ENABLE(JIT)
         void jettisonOptimizedCodeForCall(JSGlobalData&);
+        void jitCompileForCall(JSGlobalData&);
 #endif
 
         bool isGeneratedForCall() const
@@ -535,6 +548,7 @@ namespace JSC {
         
 #if ENABLE(JIT)
         void jettisonOptimizedCodeForConstruct(JSGlobalData&);
+        void jitCompileForConstruct(JSGlobalData&);
 #endif
 
         bool isGeneratedForConstruct() const
@@ -582,6 +596,16 @@ namespace JSC {
                 jettisonOptimizedCodeForConstruct(globalData);
             }
         }
+        
+        void jitCompileFor(JSGlobalData& globalData, CodeSpecializationKind kind)
+        {
+            if (kind == CodeForCall) {
+                jitCompileForCall(globalData);
+                return;
+            }
+            ASSERT(kind == CodeForConstruct);
+            jitCompileForConstruct(globalData);
+        }
 #endif
         
         bool isGeneratedFor(CodeSpecializationKind kind)
diff --git a/Source/JavaScriptCore/runtime/ExecutionHarness.h b/Source/JavaScriptCore/runtime/ExecutionHarness.h
new file mode 100644
index 000000000..774c5bf6b
--- /dev/null
+++ b/Source/JavaScriptCore/runtime/ExecutionHarness.h
@@ -0,0 +1,72 @@
+/*
+ * Copyright (C) 2012 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef ExecutionHarness_h
+#define ExecutionHarness_h
+
+#include <wtf/Platform.h>
+
+#if ENABLE(JIT)
+
+#include "JITDriver.h"
+#include "LLIntEntrypoints.h"
+
+namespace JSC {
+
+template<typename CodeBlockType>
+inline bool prepareForExecution(JSGlobalData& globalData, OwnPtr<CodeBlockType>& codeBlock, JITCode& jitCode, JITCode::JITType jitType)
+{
+#if ENABLE(LLINT)
+    if (JITCode::isBaselineCode(jitType)) {
+        // Start off in the low level interpreter.
+        LLInt::getEntrypoint(globalData, codeBlock.get(), jitCode);
+        codeBlock->setJITCode(jitCode, MacroAssemblerCodePtr());
+        return true;
+    }
+#endif // ENABLE(LLINT)
+    return jitCompileIfAppropriate(globalData, codeBlock, jitCode, jitType);
+}
+
+inline bool prepareFunctionForExecution(JSGlobalData& globalData, OwnPtr<FunctionCodeBlock>& codeBlock, JITCode& jitCode, MacroAssemblerCodePtr& jitCodeWithArityCheck, SharedSymbolTable*& symbolTable, JITCode::JITType jitType, CodeSpecializationKind kind)
+{
+#if ENABLE(LLINT)
+    if (JITCode::isBaselineCode(jitType)) {
+        // Start off in the low level interpreter.
+        LLInt::getFunctionEntrypoint(globalData, kind, jitCode, jitCodeWithArityCheck);
+        codeBlock->setJITCode(jitCode, jitCodeWithArityCheck);
+        return true;
+    }
+#else
+    UNUSED_PARAM(kind);
+#endif // ENABLE(LLINT)
+    return jitCompileFunctionIfAppropriate(globalData, codeBlock, jitCode, jitCodeWithArityCheck, symbolTable, jitType);
+}
+
+} // namespace JSC
+
+#endif // ENABLE(JIT)
+
+#endif // ExecutionHarness_h
+
diff --git a/Source/JavaScriptCore/runtime/JSActivation.h b/Source/JavaScriptCore/runtime/JSActivation.h
index c18492344..80c8aa8d0 100644
--- a/Source/JavaScriptCore/runtime/JSActivation.h
+++ b/Source/JavaScriptCore/runtime/JSActivation.h
@@ -75,6 +75,8 @@ namespace JSC {
 
         static Structure* createStructure(JSGlobalData& globalData, JSGlobalObject* globalObject, JSValue proto) { return Structure::create(globalData, globalObject, proto, TypeInfo(ActivationObjectType, StructureFlags), &s_info); }
 
+        bool isValidScopedLookup(int index) { return index < m_numCapturedVars; }
+
     protected:
         void finishCreation(CallFrame*);
         static const unsigned StructureFlags = IsEnvironmentRecord | OverridesGetOwnPropertySlot | OverridesVisitChildren | OverridesGetPropertyNames | JSVariableObject::StructureFlags;
diff --git a/Source/JavaScriptCore/runtime/JSArray.cpp b/Source/JavaScriptCore/runtime/JSArray.cpp
index c84fb5b10..71d520018 100644
--- a/Source/JavaScriptCore/runtime/JSArray.cpp
+++ b/Source/JavaScriptCore/runtime/JSArray.cpp
@@ -24,8 +24,8 @@
 #include "JSArray.h"
 
 #include "ArrayPrototype.h"
-#include "BumpSpace.h"
-#include "BumpSpaceInlineMethods.h"
+#include "CopiedSpace.h"
+#include "CopiedSpaceInlineMethods.h"
 #include "CachedCall.h"
 #include "Error.h"
 #include "Executable.h"
@@ -42,6 +42,7 @@ using namespace WTF;
 namespace JSC {
 
 ASSERT_CLASS_FITS_IN_CELL(JSArray);
+ASSERT_HAS_TRIVIAL_DESTRUCTOR(JSArray);
 
 // Overview of JSArray
 //
@@ -160,10 +161,6 @@ void JSArray::finishCreation(JSGlobalData& globalData, unsigned initialLength)
     m_storage->m_inCompactInitialization = false;
 #endif
 
-    WriteBarrier<Unknown>* vector = m_storage->m_vector;
-    for (size_t i = 0; i < initialVectorLength; ++i)
-        vector[i].clear();
-
     checkConsistency();
 }
 
@@ -193,10 +190,6 @@ JSArray* JSArray::tryFinishCreationUninitialized(JSGlobalData& globalData, unsig
     m_storage->m_inCompactInitialization = true;
 #endif
 
-    WriteBarrier<Unknown>* vector = m_storage->m_vector;
-    for (size_t i = initialLength; i < initialVectorLength; ++i)
-        vector[i].clear();
-
     return this;
 }
 
@@ -222,7 +215,17 @@ inline std::pair<SparseArrayValueMap::iterator, bool> SparseArrayValueMap::add(J
 
 inline void SparseArrayValueMap::put(ExecState* exec, JSArray* array, unsigned i, JSValue value)
 {
-    SparseArrayEntry& entry = add(array, i).first->second;
+    std::pair<SparseArrayValueMap::iterator, bool> result = add(array, i);
+    SparseArrayEntry& entry = result.first->second;
+
+    // To save a separate find & add, we first always add to the sparse map.
+    // In the uncommon case that this is a new property, and the array is not
+    // extensible, this is not the right thing to have done - so remove again.
+    if (result.second && !array->isExtensible()) {
+        remove(result.first);
+        // FIXME: should throw in strict mode.
+        return;
+    }
 
     if (!(entry.attributes & Accessor)) {
         if (entry.attributes & ReadOnly) {
@@ -240,7 +243,8 @@ inline void SparseArrayValueMap::put(ExecState* exec, JSArray* array, unsigned i
     JSObject* setter = asGetterSetter(accessor)->setter();
     
     if (!setter) {
-        throwTypeError(exec, "setting a property that has only a getter");
+        // FIXME: should throw if being called from strict mode.
+        // throwTypeError(exec, "setting a property that has only a getter");
         return;
     }
 
@@ -383,7 +387,7 @@ void JSArray::putDescriptor(ExecState* exec, SparseArrayEntry* entryInMap, Prope
             accessor->setSetter(exec->globalData(), setter);
 
         entryInMap->set(exec->globalData(), this, accessor);
-        entryInMap->attributes = descriptor.attributesOverridingCurrent(oldDescriptor) & ~DontDelete;
+        entryInMap->attributes = descriptor.attributesOverridingCurrent(oldDescriptor) & ~ReadOnly;
         return;
     }
 
@@ -464,7 +468,7 @@ bool JSArray::defineOwnNumericProperty(ExecState* exec, unsigned index, Property
     // 7. If the [[Configurable]] field of current is false then
     if (!current.configurable()) {
         // 7.a. Reject, if the [[Configurable]] field of Desc is true.
-        if (descriptor.configurablePresent() && !descriptor.configurable())
+        if (descriptor.configurablePresent() && descriptor.configurable())
             return reject(exec, throwException, "Attempting to change configurable attribute of unconfigurable property.");
         // 7.b. Reject, if the [[Enumerable]] field of Desc is present and the [[Enumerable]] fields of current and Desc are the Boolean negation of each other.
         if (descriptor.enumerablePresent() && current.enumerable() != descriptor.enumerable())
@@ -682,7 +686,7 @@ bool JSArray::getOwnPropertyDescriptor(JSObject* object, ExecState* exec, const
 {
     JSArray* thisObject = jsCast<JSArray*>(object);
     if (propertyName == exec->propertyNames().length) {
-        descriptor.setDescriptor(jsNumber(thisObject->length()), DontDelete | DontEnum);
+        descriptor.setDescriptor(jsNumber(thisObject->length()), thisObject->isLengthWritable() ? DontDelete | DontEnum : DontDelete | DontEnum | ReadOnly);
         return true;
     }
 
@@ -784,6 +788,9 @@ NEVER_INLINE void JSArray::putByIndexBeyondVectorLength(ExecState* exec, unsigne
 
     // First, handle cases where we don't currently have a sparse map.
     if (LIKELY(!map)) {
+        // If the array is not extensible, we should have entered dictionary mode, and created the spare map.
+        ASSERT(isExtensible());
+    
         // Update m_length if necessary.
         if (i >= storage->m_length)
             storage->m_length = i + 1;
@@ -807,7 +814,7 @@ NEVER_INLINE void JSArray::putByIndexBeyondVectorLength(ExecState* exec, unsigne
     unsigned length = storage->m_length;
     if (i >= length) {
         // Prohibit growing the array if length is not writable.
-        if (map->lengthIsReadOnly()) {
+        if (map->lengthIsReadOnly() || !isExtensible()) {
             // FIXME: should throw in strict mode.
             return;
         }
@@ -977,10 +984,6 @@ bool JSArray::increaseVectorLength(JSGlobalData& globalData, unsigned newLength)
         m_storage->m_allocBase = newStorage;
         ASSERT(m_storage->m_allocBase);
 
-        WriteBarrier<Unknown>* vector = storage->m_vector;
-        for (unsigned i = vectorLength; i < newVectorLength; ++i)
-            vector[i].clear();
-
         m_vectorLength = newVectorLength;
         
         return true;
@@ -1000,10 +1003,8 @@ bool JSArray::increaseVectorLength(JSGlobalData& globalData, unsigned newLength)
     m_indexBias = newIndexBias;
     m_storage = reinterpret_cast_ptr<ArrayStorage*>(reinterpret_cast<WriteBarrier<Unknown>*>(newAllocBase) + m_indexBias);
 
-    // Copy the ArrayStorage header & current contents of the vector, clear the new post-capacity.
+    // Copy the ArrayStorage header & current contents of the vector.
     memmove(m_storage, storage, storageSize(vectorLength));
-    for (unsigned i = vectorLength; i < m_vectorLength; ++i)
-        m_storage->m_vector[i].clear();
 
     // Free the old allocation, update m_allocBase.
     m_storage->m_allocBase = newAllocBase;
@@ -1086,13 +1087,6 @@ bool JSArray::unshiftCountSlowCase(JSGlobalData& globalData, unsigned count)
     if (newAllocBase != m_storage->m_allocBase) {
         // Free the old allocation, update m_allocBase.
         m_storage->m_allocBase = newAllocBase;
-
-        // We need to clear any entries in the vector beyond length. We only need to
-        // do this if this was a new allocation, because if we're using an existing
-        // allocation the post-capacity will already be cleared, and in an existing
-        // allocation we can only beshrinking the amount of post capacity.
-        for (unsigned i = requiredVectorLength; i < m_vectorLength; ++i)
-            m_storage->m_vector[i].clear();
     }
 
     return true;
@@ -1169,7 +1163,6 @@ bool JSArray::setLength(ExecState* exec, unsigned newLength, bool throwException
 JSValue JSArray::pop(ExecState* exec)
 {
     checkConsistency();
-
     ArrayStorage* storage = m_storage;
     
     unsigned length = storage->m_length;
@@ -1179,47 +1172,32 @@ JSValue JSArray::pop(ExecState* exec)
         return jsUndefined();
     }
 
-    --length;
-
-    JSValue result;
-
-    if (length < m_vectorLength) {
-        WriteBarrier<Unknown>& valueSlot = storage->m_vector[length];
+    unsigned index = length - 1;
+    if (index < m_vectorLength) {
+        WriteBarrier<Unknown>& valueSlot = storage->m_vector[index];
         if (valueSlot) {
             --storage->m_numValuesInVector;
-            result = valueSlot.get();
+            JSValue element = valueSlot.get();
             valueSlot.clear();
-        } else
-            result = jsUndefined();
-    } else {
-        result = jsUndefined();
-        if (SparseArrayValueMap* map = m_sparseValueMap) {
-            SparseArrayValueMap::iterator it = map->find(length);
-            if (it != map->notFound()) {
-                unsigned attributes = it->second.attributes;
-
-                result = it->second.get(exec, this);
-                if (exec->hadException())
-                    return jsUndefined();
-                
-                if (attributes & DontDelete) {
-                    throwError(exec, createTypeError(exec, "Unable to delete property."));
-                    checkConsistency();
-                    return result;
-                }
-                
-                map->remove(it);
-                if (map->isEmpty() && !map->sparseMode())
-                    deallocateSparseMap();
-            }
+            
+            ASSERT(isLengthWritable());
+            storage->m_length = index;
+            checkConsistency();
+            return element;
         }
     }
 
-    storage->m_length = length;
-
+    // Let element be the result of calling the [[Get]] internal method of O with argument indx.
+    JSValue element = get(exec, index);
+    if (exec->hadException())
+        return jsUndefined();
+    // Call the [[Delete]] internal method of O with arguments indx and true.
+    deletePropertyByIndex(this, exec, index);
+    // Call the [[Put]] internal method of O with arguments "length", indx, and true.
+    setLength(exec, index, true);
+    // Return element.
     checkConsistency();
-
-    return result;
+    return element;
 }
 
 // Push & putIndex are almost identical, with two small differences.
diff --git a/Source/JavaScriptCore/runtime/JSArray.h b/Source/JavaScriptCore/runtime/JSArray.h
index a3354c602..3bb4c6320 100644
--- a/Source/JavaScriptCore/runtime/JSArray.h
+++ b/Source/JavaScriptCore/runtime/JSArray.h
@@ -28,6 +28,7 @@
 namespace JSC {
 
     class JSArray;
+    class LLIntOffsetsExtractor;
 
     struct SparseArrayEntry : public WriteBarrier<Unknown> {
         typedef WriteBarrier<Unknown> Base;
@@ -116,12 +117,15 @@ namespace JSC {
         unsigned m_numValuesInVector;
         void* m_allocBase; // Pointer to base address returned by malloc().  Keeping this pointer does eliminate false positives from the leak detector.
 #if CHECK_ARRAY_CONSISTENCY
-        bool m_inCompactInitialization;
+        uintptr_t m_inCompactInitialization; // Needs to be a uintptr_t for alignment purposes.
+#else
+        uintptr_t m_padding;
 #endif
         WriteBarrier<Unknown> m_vector[1];
     };
 
     class JSArray : public JSNonFinalObject {
+        friend class LLIntOffsetsExtractor;
         friend class Walker;
 
     protected:
@@ -135,23 +139,14 @@ namespace JSC {
 
         static void finalize(JSCell*);
 
-        static JSArray* create(JSGlobalData& globalData, Structure* structure, unsigned initialLength = 0)
-        {
-            JSArray* array = new (NotNull, allocateCell<JSArray>(globalData.heap)) JSArray(globalData, structure);
-            array->finishCreation(globalData, initialLength);
-            return array;
-        }
+        static JSArray* create(JSGlobalData&, Structure*, unsigned initialLength = 0);
 
         // tryCreateUninitialized is used for fast construction of arrays whose size and
         // contents are known at time of creation. Clients of this interface must:
         //   - null-check the result (indicating out of memory, or otherwise unable to allocate vector).
         //   - call 'initializeIndex' for all properties in sequence, for 0 <= i < initialLength.
         //   - called 'completeInitialization' after all properties have been initialized.
-        static JSArray* tryCreateUninitialized(JSGlobalData& globalData, Structure* structure, unsigned initialLength)
-        {
-            JSArray* array = new (NotNull, allocateCell<JSArray>(globalData.heap)) JSArray(globalData, structure);
-            return array->tryFinishCreationUninitialized(globalData, initialLength);
-        }
+        static JSArray* tryCreateUninitialized(JSGlobalData&, Structure*, unsigned initialLength);
 
         JS_EXPORT_PRIVATE static bool defineOwnProperty(JSObject*, ExecState*, const Identifier&, PropertyDescriptor&, bool throwException);
 
@@ -253,6 +248,8 @@ namespace JSC {
 
         JS_EXPORT_PRIVATE static void visitChildren(JSCell*, SlotVisitor&);
 
+        void enterDictionaryMode(JSGlobalData&);
+
     protected:
         static const unsigned StructureFlags = OverridesGetOwnPropertySlot | OverridesVisitChildren | OverridesGetPropertyNames | JSObject::StructureFlags;
         static void put(JSCell*, ExecState*, const Identifier& propertyName, JSValue, PutPropertySlot&);
@@ -274,7 +271,6 @@ namespace JSC {
         void setLengthWritable(ExecState*, bool writable);
         void putDescriptor(ExecState*, SparseArrayEntry*, PropertyDescriptor&, PropertyDescriptor& old);
         bool defineOwnNumericProperty(ExecState*, unsigned, PropertyDescriptor&, bool throwException);
-        void enterDictionaryMode(JSGlobalData&);
         void allocateSparseMap(JSGlobalData&);
         void deallocateSparseMap();
 
@@ -299,6 +295,19 @@ namespace JSC {
         void* m_subclassData; // A JSArray subclass can use this to fill the vector lazily.
     };
 
+    inline JSArray* JSArray::create(JSGlobalData& globalData, Structure* structure, unsigned initialLength)
+    {
+        JSArray* array = new (NotNull, allocateCell<JSArray>(globalData.heap)) JSArray(globalData, structure);
+        array->finishCreation(globalData, initialLength);
+        return array;
+    }
+
+    inline JSArray* JSArray::tryCreateUninitialized(JSGlobalData& globalData, Structure* structure, unsigned initialLength)
+    {
+        JSArray* array = new (NotNull, allocateCell<JSArray>(globalData.heap)) JSArray(globalData, structure);
+        return array->tryFinishCreationUninitialized(globalData, initialLength);
+    }
+
     JSArray* asArray(JSValue);
 
     inline JSArray* asArray(JSCell* cell)
diff --git a/Source/JavaScriptCore/runtime/JSCell.h b/Source/JavaScriptCore/runtime/JSCell.h
index 74833d12f..78d2d0801 100644
--- a/Source/JavaScriptCore/runtime/JSCell.h
+++ b/Source/JavaScriptCore/runtime/JSCell.h
@@ -36,9 +36,10 @@
 namespace JSC {
 
     class JSGlobalObject;
-    class Structure;
+    class LLIntOffsetsExtractor;
     class PropertyDescriptor;
     class PropertyNameArray;
+    class Structure;
 
     enum EnumerationMode {
         ExcludeDontEnumProperties,
@@ -61,6 +62,7 @@ namespace JSC {
     class JSCell {
         friend class JSValue;
         friend class MarkedBlock;
+        template<typename T> friend void* allocateCell(Heap&);
 
     public:
         enum CreatingEarlyCellTag { CreatingEarlyCell };
@@ -162,6 +164,8 @@ namespace JSC {
         static bool getOwnPropertyDescriptor(JSObject*, ExecState*, const Identifier&, PropertyDescriptor&);
 
     private:
+        friend class LLIntOffsetsExtractor;
+        
         const ClassInfo* m_classInfo;
         WriteBarrier<Structure> m_structure;
     };
@@ -307,14 +311,34 @@ namespace JSC {
         return isCell() ? asCell()->toObject(exec, globalObject) : toObjectSlowCase(exec, globalObject);
     }
 
-    template <typename T> void* allocateCell(Heap& heap)
+#if COMPILER(CLANG)
+    template<class T>
+    struct NeedsDestructor {
+        static const bool value = !__has_trivial_destructor(T);
+    };
+#else
+    // Write manual specializations for this struct template if you care about non-clang compilers.
+    template<class T>
+    struct NeedsDestructor {
+        static const bool value = true;
+    };
+#endif
+
+    template<typename T>
+    void* allocateCell(Heap& heap)
     {
 #if ENABLE(GC_VALIDATION)
         ASSERT(sizeof(T) == T::s_info.cellSize);
         ASSERT(!heap.globalData()->isInitializingObject());
         heap.globalData()->setInitializingObject(true);
 #endif
-        JSCell* result = static_cast<JSCell*>(heap.allocate(sizeof(T)));
+        JSCell* result = 0;
+        if (NeedsDestructor<T>::value)
+            result = static_cast<JSCell*>(heap.allocateWithDestructor(sizeof(T)));
+        else {
+            ASSERT(T::s_info.methodTable.destroy == JSCell::destroy);
+            result = static_cast<JSCell*>(heap.allocateWithoutDestructor(sizeof(T)));
+        }
         result->clearStructure();
         return result;
     }
diff --git a/Source/JavaScriptCore/runtime/JSFunction.cpp b/Source/JavaScriptCore/runtime/JSFunction.cpp
index 72e1ce14f..253128279 100644
--- a/Source/JavaScriptCore/runtime/JSFunction.cpp
+++ b/Source/JavaScriptCore/runtime/JSFunction.cpp
@@ -50,6 +50,7 @@ EncodedJSValue JSC_HOST_CALL callHostFunctionAsConstructor(ExecState* exec)
 }
 
 ASSERT_CLASS_FITS_IN_CELL(JSFunction);
+ASSERT_HAS_TRIVIAL_DESTRUCTOR(JSFunction);
 
 const ClassInfo JSFunction::s_info = { "Function", &Base::s_info, 0, 0, CREATE_METHOD_TABLE(JSFunction) };
 
@@ -108,13 +109,6 @@ void JSFunction::finishCreation(ExecState* exec, FunctionExecutable* executable,
     putDirectOffset(exec->globalData(), scopeChainNode->globalObject->functionNameOffset(), executable->nameValue());
 }
 
-void JSFunction::destroy(JSCell* cell)
-{
-    JSFunction* thisObject = jsCast<JSFunction*>(cell);
-    ASSERT(thisObject->classInfo()->isSubClassOf(&JSFunction::s_info));
-    thisObject->JSFunction::~JSFunction();
-}
-
 const UString& JSFunction::name(ExecState* exec)
 {
     return asString(getDirect(exec->globalData(), exec->globalData().propertyNames->name))->tryGetValue();
diff --git a/Source/JavaScriptCore/runtime/JSFunction.h b/Source/JavaScriptCore/runtime/JSFunction.h
index a12b079d7..6e8557f59 100644
--- a/Source/JavaScriptCore/runtime/JSFunction.h
+++ b/Source/JavaScriptCore/runtime/JSFunction.h
@@ -33,6 +33,7 @@ namespace JSC {
     class FunctionPrototype;
     class JSActivation;
     class JSGlobalObject;
+    class LLIntOffsetsExtractor;
     class NativeExecutable;
     class SourceCode;
     namespace DFG {
@@ -64,8 +65,6 @@ namespace JSC {
             return function;
         }
         
-        static void destroy(JSCell*);
-
         JS_EXPORT_PRIVATE const UString& name(ExecState*);
         JS_EXPORT_PRIVATE const UString displayName(ExecState*);
         const UString calculatedDisplayName(ExecState*);
@@ -142,6 +141,8 @@ namespace JSC {
         static void visitChildren(JSCell*, SlotVisitor&);
 
     private:
+        friend class LLIntOffsetsExtractor;
+        
         JS_EXPORT_PRIVATE bool isHostFunctionNonInline() const;
 
         static JSValue argumentsGetter(ExecState*, JSValue, const Identifier&);
diff --git a/Source/JavaScriptCore/runtime/JSGlobalData.cpp b/Source/JavaScriptCore/runtime/JSGlobalData.cpp
index bbe520a1e..2bdc28ab7 100644
--- a/Source/JavaScriptCore/runtime/JSGlobalData.cpp
+++ b/Source/JavaScriptCore/runtime/JSGlobalData.cpp
@@ -35,6 +35,7 @@
 #include "DebuggerActivation.h"
 #include "FunctionConstructor.h"
 #include "GetterSetter.h"
+#include "HostCallReturnValue.h"
 #include "Interpreter.h"
 #include "JSActivation.h"
 #include "JSAPIValueWrapper.h"
@@ -141,6 +142,8 @@ JSGlobalData::JSGlobalData(GlobalDataType globalDataType, ThreadStackType thread
     , keywords(adoptPtr(new Keywords(this)))
     , interpreter(0)
     , heap(this, heapSize)
+    , jsArrayClassInfo(&JSArray::s_info)
+    , jsFinalObjectClassInfo(&JSFinalObject::s_info)
 #if ENABLE(DFG_JIT)
     , sizeOfLastScratchBuffer(0)
 #endif
@@ -160,6 +163,7 @@ JSGlobalData::JSGlobalData(GlobalDataType globalDataType, ThreadStackType thread
 #if ENABLE(GC_VALIDATION)
     , m_isInitializingObject(false)
 #endif
+    , m_inDefineOwnProperty(false)
 {
     interpreter = new Interpreter;
 
@@ -189,7 +193,7 @@ JSGlobalData::JSGlobalData(GlobalDataType globalDataType, ThreadStackType thread
 
     wtfThreadData().setCurrentIdentifierTable(existingEntryIdentifierTable);
 
-#if ENABLE(JIT) && ENABLE(INTERPRETER)
+#if ENABLE(JIT) && ENABLE(CLASSIC_INTERPRETER)
 #if USE(CF)
     CFStringRef canUseJITKey = CFStringCreateWithCString(0 , "JavaScriptCoreUseJIT", kCFStringEncodingMacRoman);
     CFBooleanRef canUseJIT = (CFBooleanRef)CFPreferencesCopyAppValue(canUseJITKey, kCFPreferencesCurrentApplication);
@@ -209,16 +213,20 @@ JSGlobalData::JSGlobalData(GlobalDataType globalDataType, ThreadStackType thread
 #endif
 #endif
 #if ENABLE(JIT)
-#if ENABLE(INTERPRETER)
+#if ENABLE(CLASSIC_INTERPRETER)
     if (m_canUseJIT)
         m_canUseJIT = executableAllocator.isValid();
 #endif
     jitStubs = adoptPtr(new JITThunks(this));
 #endif
 
-    interpreter->initialize(this->canUseJIT());
+    interpreter->initialize(&llintData, this->canUseJIT());
+    
+    initializeHostCallReturnValue(); // This is needed to convince the linker not to drop host call return support.
 
     heap.notifyIsSafeToCollect();
+    
+    llintData.performAssertions(*this);
 }
 
 void JSGlobalData::clearBuiltinStructures()
@@ -383,7 +391,7 @@ static ThunkGenerator thunkGeneratorForIntrinsic(Intrinsic intrinsic)
 
 NativeExecutable* JSGlobalData::getHostFunction(NativeFunction function, NativeFunction constructor)
 {
-#if ENABLE(INTERPRETER)
+#if ENABLE(CLASSIC_INTERPRETER)
     if (!canUseJIT())
         return NativeExecutable::create(*this, function, constructor);
 #endif
@@ -502,17 +510,17 @@ void JSGlobalData::dumpRegExpTrace()
     RTTraceList::iterator iter = ++m_rtTraceList->begin();
     
     if (iter != m_rtTraceList->end()) {
-        printf("\nRegExp Tracing\n");
-        printf("                                                            match()    matches\n");
-        printf("Regular Expression                          JIT Address      calls      found\n");
-        printf("----------------------------------------+----------------+----------+----------\n");
+        dataLog("\nRegExp Tracing\n");
+        dataLog("                                                            match()    matches\n");
+        dataLog("Regular Expression                          JIT Address      calls      found\n");
+        dataLog("----------------------------------------+----------------+----------+----------\n");
     
         unsigned reCount = 0;
     
         for (; iter != m_rtTraceList->end(); ++iter, ++reCount)
             (*iter)->printTraceData();
 
-        printf("%d Regular Expressions\n", reCount);
+        dataLog("%d Regular Expressions\n", reCount);
     }
     
     m_rtTraceList->clear();
diff --git a/Source/JavaScriptCore/runtime/JSGlobalData.h b/Source/JavaScriptCore/runtime/JSGlobalData.h
index 92817f2a2..7e54c00db 100644
--- a/Source/JavaScriptCore/runtime/JSGlobalData.h
+++ b/Source/JavaScriptCore/runtime/JSGlobalData.h
@@ -30,15 +30,16 @@
 #define JSGlobalData_h
 
 #include "CachedTranscendentalFunction.h"
-#include "Intrinsic.h"
 #include "DateInstanceCache.h"
 #include "ExecutableAllocator.h"
 #include "Heap.h"
-#include "Strong.h"
+#include "Intrinsic.h"
 #include "JITStubs.h"
 #include "JSValue.h"
+#include "LLIntData.h"
 #include "NumericStrings.h"
 #include "SmallStrings.h"
+#include "Strong.h"
 #include "Terminator.h"
 #include "TimeoutChecker.h"
 #include "WeakRandom.h"
@@ -65,6 +66,7 @@ namespace JSC {
     class JSGlobalObject;
     class JSObject;
     class Keywords;
+    class LLIntOffsetsExtractor;
     class NativeExecutable;
     class ParserArena;
     class RegExpCache;
@@ -211,13 +213,23 @@ namespace JSC {
             codeBlocksBeingCompiled.removeLast();
         }
 
+        void setInDefineOwnProperty(bool inDefineOwnProperty)
+        {
+            m_inDefineOwnProperty = inDefineOwnProperty;
+        }
+
+        bool isInDefineOwnProperty()
+        {
+            return m_inDefineOwnProperty;
+        }
+
 #if ENABLE(ASSEMBLER)
         ExecutableAllocator executableAllocator;
 #endif
 
 #if !ENABLE(JIT)
         bool canUseJIT() { return false; } // interpreter only
-#elif !ENABLE(INTERPRETER)
+#elif !ENABLE(CLASSIC_INTERPRETER)
         bool canUseJIT() { return true; } // jit only
 #else
         bool canUseJIT() { return m_canUseJIT; }
@@ -241,7 +253,12 @@ namespace JSC {
         Heap heap;
 
         JSValue exception;
-#if ENABLE(JIT)
+
+        const ClassInfo* const jsArrayClassInfo;
+        const ClassInfo* const jsFinalObjectClassInfo;
+
+        LLInt::Data llintData;
+
         ReturnAddressPtr exceptionLocation;
         JSValue hostCallReturnValue;
         CallFrame* callFrameForThrow;
@@ -271,7 +288,6 @@ namespace JSC {
             return scratchBuffers.last();
         }
 #endif
-#endif
 
         HashMap<OpaqueJSClass*, OwnPtr<OpaqueJSClassContextData> > opaqueJSClassData;
 
@@ -332,7 +348,7 @@ namespace JSC {
             ASSERT(!m_##type##ArrayDescriptor.m_classInfo || m_##type##ArrayDescriptor.m_classInfo == descriptor.m_classInfo); \
             m_##type##ArrayDescriptor = descriptor; \
         } \
-        const TypedArrayDescriptor& type##ArrayDescriptor() const { return m_##type##ArrayDescriptor; }
+        const TypedArrayDescriptor& type##ArrayDescriptor() const { ASSERT(m_##type##ArrayDescriptor.m_classInfo); return m_##type##ArrayDescriptor; }
 
         registerTypedArrayFunction(int8, Int8);
         registerTypedArrayFunction(int16, Int16);
@@ -346,15 +362,19 @@ namespace JSC {
 #undef registerTypedArrayFunction
 
     private:
+        friend class LLIntOffsetsExtractor;
+        
         JSGlobalData(GlobalDataType, ThreadStackType, HeapSize);
         static JSGlobalData*& sharedInstanceInternal();
         void createNativeThunk();
-#if ENABLE(JIT) && ENABLE(INTERPRETER)
+#if ENABLE(JIT) && ENABLE(CLASSIC_INTERPRETER)
         bool m_canUseJIT;
 #endif
 #if ENABLE(GC_VALIDATION)
         bool m_isInitializingObject;
 #endif
+        bool m_inDefineOwnProperty;
+
         TypedArrayDescriptor m_int8ArrayDescriptor;
         TypedArrayDescriptor m_int16ArrayDescriptor;
         TypedArrayDescriptor m_int32ArrayDescriptor;
diff --git a/Source/JavaScriptCore/runtime/JSGlobalObject.cpp b/Source/JavaScriptCore/runtime/JSGlobalObject.cpp
index e648fbe21..8d3975848 100644
--- a/Source/JavaScriptCore/runtime/JSGlobalObject.cpp
+++ b/Source/JavaScriptCore/runtime/JSGlobalObject.cpp
@@ -78,7 +78,7 @@ namespace JSC {
 
 const ClassInfo JSGlobalObject::s_info = { "GlobalObject", &JSVariableObject::s_info, 0, ExecState::globalObjectTable, CREATE_METHOD_TABLE(JSGlobalObject) };
 
-const GlobalObjectMethodTable JSGlobalObject::s_globalObjectMethodTable = { &supportsProfiling, &supportsRichSourceInfo, &shouldInterruptScript };
+const GlobalObjectMethodTable JSGlobalObject::s_globalObjectMethodTable = { &allowsAccessFrom, &supportsProfiling, &supportsRichSourceInfo, &shouldInterruptScript };
 
 /* Source for JSGlobalObject.lut.h
 @begin globalObjectTable
@@ -205,6 +205,10 @@ void JSGlobalObject::reset(JSValue prototype)
     m_callFunction.set(exec->globalData(), this, callFunction);
     m_applyFunction.set(exec->globalData(), this, applyFunction);
     m_objectPrototype.set(exec->globalData(), this, ObjectPrototype::create(exec, this, ObjectPrototype::createStructure(exec->globalData(), this, jsNull())));
+    GetterSetter* protoAccessor = GetterSetter::create(exec);
+    protoAccessor->setGetter(exec->globalData(), JSFunction::create(exec, this, 0, Identifier(), globalFuncProtoGetter));
+    protoAccessor->setSetter(exec->globalData(), JSFunction::create(exec, this, 0, Identifier(), globalFuncProtoSetter));
+    m_objectPrototype->putDirectAccessor(exec->globalData(), exec->propertyNames().underscoreProto, protoAccessor, Accessor | DontEnum);
     m_functionPrototype->structure()->setPrototypeWithoutTransition(exec->globalData(), m_objectPrototype.get());
 
     m_emptyObjectStructure.set(exec->globalData(), this, m_objectPrototype->inheritorID(exec->globalData()));
diff --git a/Source/JavaScriptCore/runtime/JSGlobalObject.h b/Source/JavaScriptCore/runtime/JSGlobalObject.h
index b67ccb764..cbc436e1a 100644
--- a/Source/JavaScriptCore/runtime/JSGlobalObject.h
+++ b/Source/JavaScriptCore/runtime/JSGlobalObject.h
@@ -44,6 +44,7 @@ namespace JSC {
     class FunctionPrototype;
     class GetterSetter;
     class GlobalCodeBlock;
+    class LLIntOffsetsExtractor;
     class NativeErrorConstructor;
     class ProgramCodeBlock;
     class RegExpConstructor;
@@ -56,6 +57,9 @@ namespace JSC {
     typedef Vector<ExecState*, 16> ExecStateStack;
     
     struct GlobalObjectMethodTable {
+        typedef bool (*AllowsAccessFromFunctionPtr)(const JSGlobalObject*, ExecState*);
+        AllowsAccessFromFunctionPtr allowsAccessFrom;
+
         typedef bool (*SupportsProfilingFunctionPtr)(const JSGlobalObject*); 
         SupportsProfilingFunctionPtr supportsProfiling;
 
@@ -279,6 +283,7 @@ namespace JSC {
 
         const GlobalObjectMethodTable* globalObjectMethodTable() const { return m_globalObjectMethodTable; }
 
+        static bool allowsAccessFrom(const JSGlobalObject*, ExecState*) { return true; }
         static bool supportsProfiling(const JSGlobalObject*) { return false; }
         static bool supportsRichSourceInfo(const JSGlobalObject*) { return true; }
 
@@ -336,6 +341,8 @@ namespace JSC {
         JS_EXPORT_PRIVATE void addStaticGlobals(GlobalPropertyInfo*, int count);
 
     private:
+        friend class LLIntOffsetsExtractor;
+        
         // FIXME: Fold reset into init.
         JS_EXPORT_PRIVATE void init(JSObject* thisValue);
         void reset(JSValue prototype);
diff --git a/Source/JavaScriptCore/runtime/JSGlobalObjectFunctions.cpp b/Source/JavaScriptCore/runtime/JSGlobalObjectFunctions.cpp
index b82ab62ab..db8ee1d85 100644
--- a/Source/JavaScriptCore/runtime/JSGlobalObjectFunctions.cpp
+++ b/Source/JavaScriptCore/runtime/JSGlobalObjectFunctions.cpp
@@ -297,7 +297,7 @@ static double parseInt(const UString& s, const CharType* data, int radix)
     }
     if (number >= mantissaOverflowLowerBound) {
         if (radix == 10)
-            number = WTF::strtod(s.substringSharingImpl(firstDigitPosition, p - firstDigitPosition).utf8().data(), 0);
+            number = WTF::strtod<WTF::AllowTrailingJunk>(s.substringSharingImpl(firstDigitPosition, p - firstDigitPosition).utf8().data(), 0);
         else if (radix == 2 || radix == 4 || radix == 8 || radix == 16 || radix == 32)
             number = parseIntOverflow(s.substringSharingImpl(firstDigitPosition, p - firstDigitPosition).utf8().data(), p - firstDigitPosition, radix);
     }
@@ -369,7 +369,7 @@ static double jsStrDecimalLiteral(const CharType*& data, const CharType* end)
     }
     byteBuffer.append(0);
     char* endOfNumber;
-    double number = WTF::strtod(byteBuffer.data(), &endOfNumber);
+    double number = WTF::strtod<WTF::AllowTrailingJunk>(byteBuffer.data(), &endOfNumber);
 
     // Check if strtod found a number; if so return it.
     ptrdiff_t consumed = endOfNumber - byteBuffer.data();
@@ -714,4 +714,40 @@ EncodedJSValue JSC_HOST_CALL globalFuncThrowTypeError(ExecState* exec)
     return throwVMTypeError(exec);
 }
 
+EncodedJSValue JSC_HOST_CALL globalFuncProtoGetter(ExecState* exec)
+{
+    if (!exec->thisValue().isObject())
+        return JSValue::encode(exec->thisValue().synthesizePrototype(exec));
+
+    JSObject* thisObject = asObject(exec->thisValue());
+    if (!thisObject->allowsAccessFrom(exec->trueCallerFrame()))
+        return JSValue::encode(jsUndefined());
+
+    return JSValue::encode(thisObject->prototype());
+}
+
+EncodedJSValue JSC_HOST_CALL globalFuncProtoSetter(ExecState* exec)
+{
+    JSValue value = exec->argument(0);
+
+    // Setting __proto__ of a primitive should have no effect.
+    if (!exec->thisValue().isObject())
+        return JSValue::encode(jsUndefined());
+
+    JSObject* thisObject = asObject(exec->thisValue());
+    if (!thisObject->allowsAccessFrom(exec->trueCallerFrame()))
+        return JSValue::encode(jsUndefined());
+
+    // Setting __proto__ to a non-object, non-null value is silently ignored to match Mozilla.
+    if (!value.isObject() && !value.isNull())
+        return JSValue::encode(jsUndefined());
+
+    if (!thisObject->isExtensible())
+        return throwVMError(exec, createTypeError(exec, StrictModeReadonlyPropertyWriteError));
+
+    if (!thisObject->setPrototypeWithCycleCheck(exec->globalData(), value))
+        throwError(exec, createError(exec, "cyclic __proto__ value"));
+    return JSValue::encode(jsUndefined());
+}
+
 } // namespace JSC
diff --git a/Source/JavaScriptCore/runtime/JSGlobalObjectFunctions.h b/Source/JavaScriptCore/runtime/JSGlobalObjectFunctions.h
index 1183dfac5..8833bf6d0 100644
--- a/Source/JavaScriptCore/runtime/JSGlobalObjectFunctions.h
+++ b/Source/JavaScriptCore/runtime/JSGlobalObjectFunctions.h
@@ -48,6 +48,8 @@ namespace JSC {
     EncodedJSValue JSC_HOST_CALL globalFuncEscape(ExecState*);
     EncodedJSValue JSC_HOST_CALL globalFuncUnescape(ExecState*);
     EncodedJSValue JSC_HOST_CALL globalFuncThrowTypeError(ExecState*);
+    EncodedJSValue JSC_HOST_CALL globalFuncProtoGetter(ExecState*);
+    EncodedJSValue JSC_HOST_CALL globalFuncProtoSetter(ExecState*);
 
     static const double mantissaOverflowLowerBound = 9007199254740992.0;
     double parseIntOverflow(const LChar*, int length, int radix);
diff --git a/Source/JavaScriptCore/runtime/JSObject.cpp b/Source/JavaScriptCore/runtime/JSObject.cpp
index ba2d2a52a..acc4a181e 100644
--- a/Source/JavaScriptCore/runtime/JSObject.cpp
+++ b/Source/JavaScriptCore/runtime/JSObject.cpp
@@ -24,7 +24,7 @@
 #include "config.h"
 #include "JSObject.h"
 
-#include "BumpSpaceInlineMethods.h"
+#include "CopiedSpaceInlineMethods.h"
 #include "DatePrototype.h"
 #include "ErrorConstructor.h"
 #include "GetterSetter.h"
@@ -48,6 +48,7 @@ ASSERT_CLASS_FITS_IN_CELL(JSNonFinalObject);
 ASSERT_CLASS_FITS_IN_CELL(JSFinalObject);
 
 ASSERT_HAS_TRIVIAL_DESTRUCTOR(JSObject);
+ASSERT_HAS_TRIVIAL_DESTRUCTOR(JSFinalObject);
 
 const char* StrictModeReadonlyPropertyWriteError = "Attempted to assign to readonly property.";
 
@@ -55,16 +56,6 @@ const ClassInfo JSObject::s_info = { "Object", 0, 0, 0, CREATE_METHOD_TABLE(JSOb
 
 const ClassInfo JSFinalObject::s_info = { "Object", &Base::s_info, 0, 0, CREATE_METHOD_TABLE(JSFinalObject) };
 
-void JSFinalObject::destroy(JSCell* cell)
-{
-    jsCast<JSFinalObject*>(cell)->JSFinalObject::~JSFinalObject();
-}
-
-void JSNonFinalObject::destroy(JSCell* cell)
-{
-    jsCast<JSNonFinalObject*>(cell)->JSNonFinalObject::~JSNonFinalObject();
-}
-
 static inline void getClassPropertyNames(ExecState* exec, const ClassInfo* classInfo, PropertyNameArray& propertyNames, EnumerationMode mode)
 {
     // Add properties from the static hashtables of properties
@@ -84,11 +75,6 @@ static inline void getClassPropertyNames(ExecState* exec, const ClassInfo* class
     }
 }
 
-void JSObject::destroy(JSCell* cell)
-{
-    jsCast<JSObject*>(cell)->JSObject::~JSObject();
-}
-
 void JSObject::visitChildren(JSCell* cell, SlotVisitor& visitor)
 {
     JSObject* thisObject = jsCast<JSObject*>(cell);
@@ -146,47 +132,36 @@ void JSObject::put(JSCell* cell, ExecState* exec, const Identifier& propertyName
     ASSERT(!Heap::heap(value) || Heap::heap(value) == Heap::heap(thisObject));
     JSGlobalData& globalData = exec->globalData();
 
-    if (propertyName == exec->propertyNames().underscoreProto) {
-        // Setting __proto__ to a non-object, non-null value is silently ignored to match Mozilla.
-        if (!value.isObject() && !value.isNull())
-            return;
-
-        if (!thisObject->isExtensible()) {
-            if (slot.isStrictMode())
-                throwTypeError(exec, StrictModeReadonlyPropertyWriteError);
-            return;
-        }
-            
-        if (!thisObject->setPrototypeWithCycleCheck(globalData, value))
-            throwError(exec, createError(exec, "cyclic __proto__ value"));
-        return;
-    }
-
     // Check if there are any setters or getters in the prototype chain
     JSValue prototype;
-    for (JSObject* obj = thisObject; !obj->structure()->hasGetterSetterProperties(); obj = asObject(prototype)) {
-        prototype = obj->prototype();
-        if (prototype.isNull()) {
-            if (!thisObject->putDirectInternal<PutModePut>(globalData, propertyName, value, 0, slot, getJSFunction(value)) && slot.isStrictMode())
-                throwTypeError(exec, StrictModeReadonlyPropertyWriteError);
-            return;
+    if (propertyName != exec->propertyNames().underscoreProto) {
+        for (JSObject* obj = thisObject; !obj->structure()->hasReadOnlyOrGetterSetterPropertiesExcludingProto(); obj = asObject(prototype)) {
+            prototype = obj->prototype();
+            if (prototype.isNull()) {
+                if (!thisObject->putDirectInternal<PutModePut>(globalData, propertyName, value, 0, slot, getJSFunction(value)) && slot.isStrictMode())
+                    throwTypeError(exec, StrictModeReadonlyPropertyWriteError);
+                return;
+            }
         }
     }
-    
-    unsigned attributes;
-    JSCell* specificValue;
-    if ((thisObject->structure()->get(globalData, propertyName, attributes, specificValue) != WTF::notFound) && attributes & ReadOnly) {
-        if (slot.isStrictMode())
-            throwError(exec, createTypeError(exec, StrictModeReadonlyPropertyWriteError));
-        return;
-    }
 
     for (JSObject* obj = thisObject; ; obj = asObject(prototype)) {
-        if (JSValue gs = obj->getDirect(globalData, propertyName)) {
+        unsigned attributes;
+        JSCell* specificValue;
+        size_t offset = obj->structure()->get(globalData, propertyName, attributes, specificValue);
+        if (offset != WTF::notFound) {
+            if (attributes & ReadOnly) {
+                if (slot.isStrictMode())
+                    throwError(exec, createTypeError(exec, StrictModeReadonlyPropertyWriteError));
+                return;
+            }
+
+            JSValue gs = obj->getDirectOffset(offset);
             if (gs.isGetterSetter()) {
                 JSObject* setterFunc = asGetterSetter(gs)->setter();        
                 if (!setterFunc) {
-                    throwSetterError(exec);
+                    if (slot.isStrictMode())
+                        throwSetterError(exec);
                     return;
                 }
                 
@@ -229,10 +204,31 @@ void JSObject::putDirectVirtual(JSObject* object, ExecState* exec, const Identif
     object->putDirectInternal<PutModeDefineOwnProperty>(exec->globalData(), propertyName, value, attributes, slot, getJSFunction(value));
 }
 
+bool JSObject::setPrototypeWithCycleCheck(JSGlobalData& globalData, JSValue prototype)
+{
+    JSValue checkFor = this;
+    if (this->isGlobalObject())
+        checkFor = static_cast<JSGlobalObject*>(this)->globalExec()->thisValue();
+
+    JSValue nextPrototype = prototype;
+    while (nextPrototype && nextPrototype.isObject()) {
+        if (nextPrototype == checkFor)
+            return false;
+        nextPrototype = asObject(nextPrototype)->prototype();
+    }
+    setPrototype(globalData, prototype);
+    return true;
+}
+
+bool JSObject::allowsAccessFrom(ExecState* exec)
+{
+    JSGlobalObject* globalObject = isGlobalThis() ? static_cast<JSGlobalThis*>(this)->unwrappedObject() : this->globalObject();
+    return globalObject->globalObjectMethodTable()->allowsAccessFrom(globalObject, exec);
+}
+
 void JSObject::putDirectAccessor(JSGlobalData& globalData, const Identifier& propertyName, JSValue value, unsigned attributes)
 {
     ASSERT(value.isGetterSetter() && (attributes & Accessor));
-    ASSERT(propertyName != globalData.propertyNames->underscoreProto);
 
     PutPropertySlot slot;
     putDirectInternal<PutModeDefineOwnProperty>(globalData, propertyName, value, attributes, slot, getJSFunction(value));
@@ -243,7 +239,10 @@ void JSObject::putDirectAccessor(JSGlobalData& globalData, const Identifier& pro
     if (slot.type() != PutPropertySlot::NewProperty)
         setStructure(globalData, Structure::attributeChangeTransition(globalData, structure(), propertyName, attributes));
 
-    structure()->setHasGetterSetterProperties(true);
+    if (attributes & ReadOnly)
+        structure()->setContainsReadOnlyProperties();
+
+    structure()->setHasGetterSetterProperties(propertyName == globalData.propertyNames->underscoreProto);
 }
 
 bool JSObject::hasProperty(ExecState* exec, const Identifier& propertyName) const
@@ -269,7 +268,7 @@ bool JSObject::deleteProperty(JSCell* cell, ExecState* exec, const Identifier& p
     unsigned attributes;
     JSCell* specificValue;
     if (thisObject->structure()->get(exec->globalData(), propertyName, attributes, specificValue) != WTF::notFound) {
-        if ((attributes & DontDelete))
+        if (attributes & DontDelete && !exec->globalData().isInDefineOwnProperty())
             return false;
         thisObject->removeDirect(exec->globalData(), propertyName);
         return true;
@@ -277,7 +276,7 @@ bool JSObject::deleteProperty(JSCell* cell, ExecState* exec, const Identifier& p
 
     // Look in the static hashtable of properties
     const HashEntry* entry = thisObject->findPropertyHashEntry(exec, propertyName);
-    if (entry && entry->attributes() & DontDelete)
+    if (entry && entry->attributes() & DontDelete && !exec->globalData().isInDefineOwnProperty())
         return false; // this builtin property can't be deleted
 
     // FIXME: Should the code here actually do some deletion?
@@ -479,6 +478,8 @@ void JSObject::freeze(JSGlobalData& globalData)
 
 void JSObject::preventExtensions(JSGlobalData& globalData)
 {
+    if (isJSArray(this))
+        asArray(this)->enterDictionaryMode(globalData);
     if (isExtensible())
         setStructure(globalData, Structure::preventExtensionsTransition(globalData, structure()));
 }
@@ -623,6 +624,8 @@ static bool putDescriptor(ExecState* exec, JSObject* target, const Identifier& p
         else if (oldDescriptor.value())
             newValue = oldDescriptor.value();
         target->putDirect(exec->globalData(), propertyName, newValue, attributes & ~Accessor);
+        if (attributes & ReadOnly)
+            target->structure()->setContainsReadOnlyProperties();
         return true;
     }
     attributes &= ~ReadOnly;
@@ -641,12 +644,30 @@ static bool putDescriptor(ExecState* exec, JSObject* target, const Identifier& p
     return true;
 }
 
+class DefineOwnPropertyScope {
+public:
+    DefineOwnPropertyScope(ExecState* exec)
+        : m_globalData(exec->globalData())
+    {
+        m_globalData.setInDefineOwnProperty(true);
+    }
+
+    ~DefineOwnPropertyScope()
+    {
+        m_globalData.setInDefineOwnProperty(false);
+    }
+
+private:
+    JSGlobalData& m_globalData;
+};
+
 bool JSObject::defineOwnProperty(JSObject* object, ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor, bool throwException)
 {
-    // __proto__ is magic; we don't currently support setting it as a regular property.
-    // Silent filter out calls to set __proto__ at an early stage; pretend all is okay.
-    if (propertyName == exec->propertyNames().underscoreProto)
-        return true;
+    // Track on the globaldata that we're in define property.
+    // Currently DefineOwnProperty uses delete to remove properties when they are being replaced
+    // (particularly when changing attributes), however delete won't allow non-configurable (i.e.
+    // DontDelete) properties to be deleted. For now, we can use this flag to make this work.
+    DefineOwnPropertyScope scope(exec);
 
     // If we have a new property we can just put it on normally
     PropertyDescriptor current;
@@ -711,21 +732,15 @@ bool JSObject::defineOwnProperty(JSObject* object, ExecState* exec, const Identi
                 return false;
             }
             if (!current.writable()) {
-                if (descriptor.value() || !sameValue(exec, current.value(), descriptor.value())) {
+                if (descriptor.value() && !sameValue(exec, current.value(), descriptor.value())) {
                     if (throwException)
                         throwError(exec, createTypeError(exec, "Attempting to change value of a readonly property."));
                     return false;
                 }
             }
-        } else if (current.attributesEqual(descriptor)) {
-            if (!descriptor.value())
-                return true;
-            PutPropertySlot slot;
-            object->methodTable()->put(object, exec, propertyName, descriptor.value(), slot);
-            if (exec->hadException())
-                return false;
-            return true;
         }
+        if (current.attributesEqual(descriptor) && !descriptor.value())
+            return true;
         object->methodTable()->deleteProperty(object, exec, propertyName);
         return putDescriptor(exec, object, propertyName, descriptor, current.attributesWithOverride(descriptor), current);
     }
@@ -748,15 +763,14 @@ bool JSObject::defineOwnProperty(JSObject* object, ExecState* exec, const Identi
     if (!accessor)
         return false;
     GetterSetter* getterSetter = asGetterSetter(accessor);
-    if (current.attributesEqual(descriptor)) {
-        if (descriptor.setterPresent())
-            getterSetter->setSetter(exec->globalData(), descriptor.setterObject());
-        if (descriptor.getterPresent())
-            getterSetter->setGetter(exec->globalData(), descriptor.getterObject());
+    if (descriptor.setterPresent())
+        getterSetter->setSetter(exec->globalData(), descriptor.setterObject());
+    if (descriptor.getterPresent())
+        getterSetter->setGetter(exec->globalData(), descriptor.getterObject());
+    if (current.attributesEqual(descriptor))
         return true;
-    }
     object->methodTable()->deleteProperty(object, exec, propertyName);
-    unsigned attrs = current.attributesWithOverride(descriptor);
+    unsigned attrs = descriptor.attributesOverridingCurrent(current);
     object->putDirectAccessor(exec->globalData(), propertyName, getterSetter, attrs | Accessor);
     return true;
 }
diff --git a/Source/JavaScriptCore/runtime/JSObject.h b/Source/JavaScriptCore/runtime/JSObject.h
index e9194fa01..c117cffaf 100644
--- a/Source/JavaScriptCore/runtime/JSObject.h
+++ b/Source/JavaScriptCore/runtime/JSObject.h
@@ -49,6 +49,7 @@ namespace JSC {
     class GetterSetter;
     class HashEntry;
     class InternalFunction;
+    class LLIntOffsetsExtractor;
     class MarkedBlock;
     class PropertyDescriptor;
     class PropertyNameArray;
@@ -84,8 +85,6 @@ namespace JSC {
     public:
         typedef JSCell Base;
 
-        JS_EXPORT_PRIVATE static void destroy(JSCell*);
-
         JS_EXPORT_PRIVATE static void visitChildren(JSCell*, SlotVisitor&);
 
         JS_EXPORT_PRIVATE static UString className(const JSObject*);
@@ -107,6 +106,8 @@ namespace JSC {
         JS_EXPORT_PRIVATE static bool getOwnPropertySlotByIndex(JSCell*, ExecState*, unsigned propertyName, PropertySlot&);
         JS_EXPORT_PRIVATE static bool getOwnPropertyDescriptor(JSObject*, ExecState*, const Identifier&, PropertyDescriptor&);
 
+        bool allowsAccessFrom(ExecState*);
+
         JS_EXPORT_PRIVATE static void put(JSCell*, ExecState*, const Identifier& propertyName, JSValue, PutPropertySlot&);
         JS_EXPORT_PRIVATE static void putByIndex(JSCell*, ExecState*, unsigned propertyName, JSValue);
 
@@ -264,6 +265,8 @@ namespace JSC {
         JSObject(JSGlobalData&, Structure*, PropertyStorage inlineStorage);
 
     private:
+        friend class LLIntOffsetsExtractor;
+        
         // Nobody should ever ask any of these questions on something already known to be a JSObject.
         using JSCell::isAPIValueWrapper;
         using JSCell::isGetterSetter;
@@ -323,8 +326,6 @@ COMPILE_ASSERT((JSFinalObject_inlineStorageCapacity >= JSNonFinalObject_inlineSt
             return Structure::create(globalData, globalObject, prototype, TypeInfo(ObjectType, StructureFlags), &s_info);
         }
 
-        JS_EXPORT_PRIVATE static void destroy(JSCell*);
-
     protected:
         explicit JSNonFinalObject(JSGlobalData& globalData, Structure* structure)
             : JSObject(globalData, structure, m_inlineStorage)
@@ -343,6 +344,8 @@ COMPILE_ASSERT((JSFinalObject_inlineStorageCapacity >= JSNonFinalObject_inlineSt
         WriteBarrier<Unknown> m_inlineStorage[JSNonFinalObject_inlineStorageCapacity];
     };
 
+    class JSFinalObject;
+
     // JSFinalObject is a type of JSObject that contains sufficent internal
     // storage to fully make use of the colloctor cell containing it.
     class JSFinalObject : public JSObject {
@@ -351,13 +354,7 @@ COMPILE_ASSERT((JSFinalObject_inlineStorageCapacity >= JSNonFinalObject_inlineSt
     public:
         typedef JSObject Base;
 
-        static JSFinalObject* create(ExecState* exec, Structure* structure)
-        {
-            JSFinalObject* finalObject = new (NotNull, allocateCell<JSFinalObject>(*exec->heap())) JSFinalObject(exec->globalData(), structure);
-            finalObject->finishCreation(exec->globalData());
-            return finalObject;
-        }
-
+        static JSFinalObject* create(ExecState*, Structure*);
         static Structure* createStructure(JSGlobalData& globalData, JSGlobalObject* globalObject, JSValue prototype)
         {
             return Structure::create(globalData, globalObject, prototype, TypeInfo(FinalObjectType, StructureFlags), &s_info);
@@ -374,9 +371,9 @@ COMPILE_ASSERT((JSFinalObject_inlineStorageCapacity >= JSNonFinalObject_inlineSt
             ASSERT(classInfo());
         }
 
-        static void destroy(JSCell*);
-
     private:
+        friend class LLIntOffsetsExtractor;
+        
         explicit JSFinalObject(JSGlobalData& globalData, Structure* structure)
             : JSObject(globalData, structure, m_inlineStorage)
         {
@@ -387,6 +384,13 @@ COMPILE_ASSERT((JSFinalObject_inlineStorageCapacity >= JSNonFinalObject_inlineSt
         WriteBarrierBase<Unknown> m_inlineStorage[JSFinalObject_inlineStorageCapacity];
     };
 
+inline JSFinalObject* JSFinalObject::create(ExecState* exec, Structure* structure)
+{
+    JSFinalObject* finalObject = new (NotNull, allocateCell<JSFinalObject>(*exec->heap())) JSFinalObject(exec->globalData(), structure);
+    finalObject->finishCreation(exec->globalData());
+    return finalObject;
+}
+
 inline bool isJSFinalObject(JSCell* cell)
 {
     return cell->classInfo() == &JSFinalObject::s_info;
@@ -489,19 +493,6 @@ inline JSValue JSObject::prototype() const
     return structure()->storedPrototype();
 }
 
-inline bool JSObject::setPrototypeWithCycleCheck(JSGlobalData& globalData, JSValue prototype)
-{
-    JSValue nextPrototypeValue = prototype;
-    while (nextPrototypeValue && nextPrototypeValue.isObject()) {
-        JSObject* nextPrototype = asObject(nextPrototypeValue)->unwrappedObject();
-        if (nextPrototype == this)
-            return false;
-        nextPrototypeValue = nextPrototype->prototype();
-    }
-    setPrototype(globalData, prototype);
-    return true;
-}
-
 inline void JSObject::setPrototype(JSGlobalData& globalData, JSValue prototype)
 {
     ASSERT(prototype);
@@ -553,12 +544,6 @@ ALWAYS_INLINE bool JSObject::inlineGetOwnPropertySlot(ExecState* exec, const Ide
         return true;
     }
 
-    // non-standard Netscape extension
-    if (propertyName == exec->propertyNames().underscoreProto) {
-        slot.setValue(prototype());
-        return true;
-    }
-
     return false;
 }
 
@@ -806,8 +791,6 @@ inline JSValue JSValue::get(ExecState* exec, const Identifier& propertyName, Pro
 {
     if (UNLIKELY(!isCell())) {
         JSObject* prototype = synthesizePrototype(exec);
-        if (propertyName == exec->propertyNames().underscoreProto)
-            return prototype;
         if (!prototype->getPropertySlot(exec, propertyName, slot))
             return jsUndefined();
         return slot.getValue(exec, propertyName);
diff --git a/Source/JavaScriptCore/runtime/JSPropertyNameIterator.h b/Source/JavaScriptCore/runtime/JSPropertyNameIterator.h
index d52e3ea61..7530d7532 100644
--- a/Source/JavaScriptCore/runtime/JSPropertyNameIterator.h
+++ b/Source/JavaScriptCore/runtime/JSPropertyNameIterator.h
@@ -38,6 +38,7 @@ namespace JSC {
 
     class Identifier;
     class JSObject;
+    class LLIntOffsetsExtractor;
 
     class JSPropertyNameIterator : public JSCell {
         friend class JIT;
@@ -96,6 +97,8 @@ namespace JSC {
         }
 
     private:
+        friend class LLIntOffsetsExtractor;
+        
         JSPropertyNameIterator(ExecState*, PropertyNameArrayData* propertyNameArrayData, size_t numCacheableSlot);
 
         WriteBarrier<Structure> m_cachedStructure;
diff --git a/Source/JavaScriptCore/runtime/JSString.cpp b/Source/JavaScriptCore/runtime/JSString.cpp
index 4e98f9d18..cfa7d03b4 100644
--- a/Source/JavaScriptCore/runtime/JSString.cpp
+++ b/Source/JavaScriptCore/runtime/JSString.cpp
@@ -189,7 +189,7 @@ void JSString::outOfMemory(ExecState* exec) const
 {
     for (size_t i = 0; i < s_maxInternalRopeLength && m_fibers[i]; ++i)
         m_fibers[i].clear();
-    ASSERT(!isRope());
+    ASSERT(isRope());
     ASSERT(m_value == UString());
     if (exec)
         throwOutOfMemoryError(exec);
@@ -253,10 +253,6 @@ bool JSString::getOwnPropertySlot(JSCell* cell, ExecState* exec, const Identifie
     // This function should only be called by JSValue::get.
     if (thisObject->getStringPropertySlot(exec, propertyName, slot))
         return true;
-    if (propertyName == exec->propertyNames().underscoreProto) {
-        slot.setValue(exec->lexicalGlobalObject()->stringPrototype());
-        return true;
-    }
     slot.setBase(thisObject);
     JSObject* object;
     for (JSValue prototype = exec->lexicalGlobalObject()->stringPrototype(); !prototype.isNull(); prototype = object->prototype()) {
diff --git a/Source/JavaScriptCore/runtime/JSString.h b/Source/JavaScriptCore/runtime/JSString.h
index c0637a6e0..32a32788a 100644
--- a/Source/JavaScriptCore/runtime/JSString.h
+++ b/Source/JavaScriptCore/runtime/JSString.h
@@ -32,6 +32,7 @@
 namespace JSC {
 
     class JSString;
+    class LLIntOffsetsExtractor;
 
     JSString* jsEmptyString(JSGlobalData*);
     JSString* jsEmptyString(ExecState*);
@@ -240,6 +241,8 @@ namespace JSC {
         static void visitChildren(JSCell*, SlotVisitor&);
 
     private:
+        friend class LLIntOffsetsExtractor;
+        
         JS_EXPORT_PRIVATE void resolveRope(ExecState*) const;
         void resolveRopeSlowCase8(LChar*) const;
         void resolveRopeSlowCase(UChar*) const;
diff --git a/Source/JavaScriptCore/runtime/JSTypeInfo.h b/Source/JavaScriptCore/runtime/JSTypeInfo.h
index 3e23aa253..83a3594db 100644
--- a/Source/JavaScriptCore/runtime/JSTypeInfo.h
+++ b/Source/JavaScriptCore/runtime/JSTypeInfo.h
@@ -34,6 +34,8 @@
 
 namespace JSC {
 
+    class LLIntOffsetsExtractor;
+
     static const unsigned MasqueradesAsUndefined = 1; // WebCore uses MasqueradesAsUndefined to make document.all undetectable.
     static const unsigned ImplementsHasInstance = 1 << 1;
     static const unsigned OverridesHasInstance = 1 << 2;
@@ -87,6 +89,8 @@ namespace JSC {
         }
 
     private:
+        friend class LLIntOffsetsExtractor;
+        
         bool isSetOnFlags1(unsigned flag) const { ASSERT(flag <= (1 << 7)); return m_flags & flag; }
         bool isSetOnFlags2(unsigned flag) const { ASSERT(flag >= (1 << 8)); return m_flags2 & (flag >> 8); }
 
diff --git a/Source/JavaScriptCore/runtime/JSValue.cpp b/Source/JavaScriptCore/runtime/JSValue.cpp
index 72cf5a8d5..e3843f02b 100644
--- a/Source/JavaScriptCore/runtime/JSValue.cpp
+++ b/Source/JavaScriptCore/runtime/JSValue.cpp
@@ -118,7 +118,7 @@ JSObject* JSValue::synthesizePrototype(ExecState* exec) const
 
 char* JSValue::description()
 {
-    static const size_t size = 64;
+    static const size_t size = 128;
     static char description[size];
 
     if (!*this)
@@ -127,14 +127,14 @@ char* JSValue::description()
         snprintf(description, size, "Int32: %d", asInt32());
     else if (isDouble()) {
 #if USE(JSVALUE64)
-        snprintf(description, size, "Double: %lf, %lx", asDouble(), reinterpretDoubleToIntptr(asDouble()));
+        snprintf(description, size, "Double: %lx, %lf", reinterpretDoubleToIntptr(asDouble()), asDouble());
 #else
         union {
             double asDouble;
             uint32_t asTwoInt32s[2];
         } u;
         u.asDouble = asDouble();
-        snprintf(description, size, "Double: %lf, %08x:%08x", asDouble(), u.asTwoInt32s[1], u.asTwoInt32s[0]);
+        snprintf(description, size, "Double: %08x:%08x, %lf", u.asTwoInt32s[1], u.asTwoInt32s[0], asDouble());
 #endif
     } else if (isCell())
         snprintf(description, size, "Cell: %p", asCell());
diff --git a/Source/JavaScriptCore/runtime/JSValue.h b/Source/JavaScriptCore/runtime/JSValue.h
index b18c181f5..9f797e05d 100644
--- a/Source/JavaScriptCore/runtime/JSValue.h
+++ b/Source/JavaScriptCore/runtime/JSValue.h
@@ -55,6 +55,9 @@ namespace JSC {
         class SpeculativeJIT;
     }
 #endif
+    namespace LLInt {
+        class Data;
+    }
 
     struct ClassInfo;
     struct Instruction;
@@ -118,6 +121,7 @@ namespace JSC {
         friend class DFG::OSRExitCompiler;
         friend class DFG::SpeculativeJIT;
 #endif
+        friend class LLInt::Data;
 
     public:
         static EncodedJSValue encode(JSValue);
@@ -234,6 +238,8 @@ namespace JSC {
 
         char* description();
 
+        JS_EXPORT_PRIVATE JSObject* synthesizePrototype(ExecState*) const;
+
     private:
         template <class T> JSValue(WriteBarrierBase<T>);
 
@@ -246,7 +252,6 @@ namespace JSC {
         JS_EXPORT_PRIVATE JSObject* toObjectSlowCase(ExecState*, JSGlobalObject*) const;
         JS_EXPORT_PRIVATE JSObject* toThisObjectSlowCase(ExecState*) const;
 
-        JS_EXPORT_PRIVATE JSObject* synthesizePrototype(ExecState*) const;
         JSObject* synthesizeObject(ExecState*) const;
 
 #if USE(JSVALUE32_64)
diff --git a/Source/JavaScriptCore/runtime/JSVariableObject.h b/Source/JavaScriptCore/runtime/JSVariableObject.h
index c1d05ff74..8d058f1fc 100644
--- a/Source/JavaScriptCore/runtime/JSVariableObject.h
+++ b/Source/JavaScriptCore/runtime/JSVariableObject.h
@@ -38,10 +38,12 @@
 
 namespace JSC {
 
+    class LLIntOffsetsExtractor;
     class Register;
 
     class JSVariableObject : public JSNonFinalObject {
         friend class JIT;
+        friend class LLIntOffsetsExtractor;
 
     public:
         typedef JSNonFinalObject Base;
diff --git a/Source/JavaScriptCore/runtime/LiteralParser.cpp b/Source/JavaScriptCore/runtime/LiteralParser.cpp
index b22b81503..3bde3ff08 100644
--- a/Source/JavaScriptCore/runtime/LiteralParser.cpp
+++ b/Source/JavaScriptCore/runtime/LiteralParser.cpp
@@ -1,5 +1,6 @@
 /*
  * Copyright (C) 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2012 Mathias Bynens (mathias@qiwi.be)
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -294,7 +295,7 @@ ALWAYS_INLINE TokenType LiteralParser<LChar>::Lexer::lexIdentifier(LiteralParser
 template <>
 ALWAYS_INLINE TokenType LiteralParser<UChar>::Lexer::lexIdentifier(LiteralParserToken<UChar>& token)
 {
-    while (m_ptr < m_end && (isASCIIAlphanumeric(*m_ptr) || *m_ptr == '_' || *m_ptr == '$'))
+    while (m_ptr < m_end && (isASCIIAlphanumeric(*m_ptr) || *m_ptr == '_' || *m_ptr == '$' || *m_ptr == 0x200C || *m_ptr == 0x200D))
         m_ptr++;
     token.stringIs8Bit = 0;
     token.stringToken16 = token.start;
@@ -536,7 +537,7 @@ TokenType LiteralParser<CharType>::Lexer::lexNumber(LiteralParserToken<CharType>
     }
     buffer[i] = 0;
     char* end;
-    token.numberToken = WTF::strtod(buffer.data(), &end);
+    token.numberToken = WTF::strtod<WTF::AllowTrailingJunk>(buffer.data(), &end);
     ASSERT(buffer.data() + (token.end - token.start) == end);
     return TokNumber;
 }
diff --git a/Source/JavaScriptCore/runtime/ObjectConstructor.cpp b/Source/JavaScriptCore/runtime/ObjectConstructor.cpp
index d96c1de7f..b7dd71655 100644
--- a/Source/JavaScriptCore/runtime/ObjectConstructor.cpp
+++ b/Source/JavaScriptCore/runtime/ObjectConstructor.cpp
@@ -138,11 +138,10 @@ EncodedJSValue JSC_HOST_CALL objectConstructorGetPrototypeOf(ExecState* exec)
 {
     if (!exec->argument(0).isObject())
         return throwVMError(exec, createTypeError(exec, "Requested prototype of a value that is not an object."));
-        
-    // This uses JSValue::get() instead of directly accessing the prototype from the object
-    // (using JSObject::prototype()) in order to allow objects to override the behavior, such
-    // as returning jsUndefined() for cross-origin access.
-    return JSValue::encode(exec->argument(0).get(exec, exec->propertyNames().underscoreProto));
+    JSObject* object = asObject(exec->argument(0));
+    if (!object->allowsAccessFrom(exec->trueCallerFrame()))
+        return JSValue::encode(jsUndefined());
+    return JSValue::encode(object->prototype());
 }
 
 EncodedJSValue JSC_HOST_CALL objectConstructorGetOwnPropertyDescriptor(ExecState* exec)
@@ -342,9 +341,7 @@ EncodedJSValue JSC_HOST_CALL objectConstructorDefineProperties(ExecState* exec)
 {
     if (!exec->argument(0).isObject())
         return throwVMError(exec, createTypeError(exec, "Properties can only be defined on Objects."));
-    if (!exec->argument(1).isObject())
-        return throwVMError(exec, createTypeError(exec, "Property descriptor list must be an Object."));
-    return JSValue::encode(defineProperties(exec, asObject(exec->argument(0)), asObject(exec->argument(1))));
+    return JSValue::encode(defineProperties(exec, asObject(exec->argument(0)), exec->argument(1).toObject(exec)));
 }
 
 EncodedJSValue JSC_HOST_CALL objectConstructorCreate(ExecState* exec)
@@ -362,19 +359,79 @@ EncodedJSValue JSC_HOST_CALL objectConstructorCreate(ExecState* exec)
 
 EncodedJSValue JSC_HOST_CALL objectConstructorSeal(ExecState* exec)
 {
+    // 1. If Type(O) is not Object throw a TypeError exception.
     JSValue obj = exec->argument(0);
     if (!obj.isObject())
         return throwVMError(exec, createTypeError(exec, "Object.seal can only be called on Objects."));
-    asObject(obj)->seal(exec->globalData());
+    JSObject* object = asObject(obj);
+
+    if (isJSFinalObject(object)) {
+        object->seal(exec->globalData());
+        return JSValue::encode(obj);
+    }
+
+    // 2. For each named own property name P of O,
+    PropertyNameArray properties(exec);
+    object->methodTable()->getOwnPropertyNames(object, exec, properties, IncludeDontEnumProperties);
+    PropertyNameArray::const_iterator end = properties.end();
+    for (PropertyNameArray::const_iterator iter = properties.begin(); iter != end; ++iter) {
+        // a. Let desc be the result of calling the [[GetOwnProperty]] internal method of O with P.
+        PropertyDescriptor desc;
+        if (!object->methodTable()->getOwnPropertyDescriptor(object, exec, *iter, desc))
+            continue;
+        // b. If desc.[[Configurable]] is true, set desc.[[Configurable]] to false.
+        desc.setConfigurable(false);
+        // c. Call the [[DefineOwnProperty]] internal method of O with P, desc, and true as arguments.
+        object->methodTable()->defineOwnProperty(object, exec, *iter, desc, true);
+        if (exec->hadException())
+            return JSValue::encode(obj);
+    }
+
+    // 3. Set the [[Extensible]] internal property of O to false.
+    object->preventExtensions(exec->globalData());
+
+    // 4. Return O.
     return JSValue::encode(obj);
 }
 
 EncodedJSValue JSC_HOST_CALL objectConstructorFreeze(ExecState* exec)
 {
+    // 1. If Type(O) is not Object throw a TypeError exception.
     JSValue obj = exec->argument(0);
     if (!obj.isObject())
         return throwVMError(exec, createTypeError(exec, "Object.freeze can only be called on Objects."));
-    asObject(obj)->freeze(exec->globalData());
+    JSObject* object = asObject(obj);
+
+    if (isJSFinalObject(object)) {
+        object->freeze(exec->globalData());
+        return JSValue::encode(obj);
+    }
+
+    // 2. For each named own property name P of O,
+    PropertyNameArray properties(exec);
+    object->methodTable()->getOwnPropertyNames(object, exec, properties, IncludeDontEnumProperties);
+    PropertyNameArray::const_iterator end = properties.end();
+    for (PropertyNameArray::const_iterator iter = properties.begin(); iter != end; ++iter) {
+        // a. Let desc be the result of calling the [[GetOwnProperty]] internal method of O with P.
+        PropertyDescriptor desc;
+        if (!object->methodTable()->getOwnPropertyDescriptor(object, exec, *iter, desc))
+            continue;
+        // b. If IsDataDescriptor(desc) is true, then
+        // i. If desc.[[Writable]] is true, set desc.[[Writable]] to false.
+        if (desc.isDataDescriptor())
+            desc.setWritable(false);
+        // c. If desc.[[Configurable]] is true, set desc.[[Configurable]] to false.
+        desc.setConfigurable(false);
+        // d. Call the [[DefineOwnProperty]] internal method of O with P, desc, and true as arguments.
+        object->methodTable()->defineOwnProperty(object, exec, *iter, desc, true);
+        if (exec->hadException())
+            return JSValue::encode(obj);
+    }
+
+    // 3. Set the [[Extensible]] internal property of O to false.
+    object->preventExtensions(exec->globalData());
+
+    // 4. Return O.
     return JSValue::encode(obj);
 }
 
@@ -389,18 +446,63 @@ EncodedJSValue JSC_HOST_CALL objectConstructorPreventExtensions(ExecState* exec)
 
 EncodedJSValue JSC_HOST_CALL objectConstructorIsSealed(ExecState* exec)
 {
+    // 1. If Type(O) is not Object throw a TypeError exception.
     JSValue obj = exec->argument(0);
     if (!obj.isObject())
         return throwVMError(exec, createTypeError(exec, "Object.isSealed can only be called on Objects."));
-    return JSValue::encode(jsBoolean(asObject(obj)->isSealed(exec->globalData())));
+    JSObject* object = asObject(obj);
+
+    if (isJSFinalObject(object))
+        return JSValue::encode(jsBoolean(object->isSealed(exec->globalData())));
+
+    // 2. For each named own property name P of O,
+    PropertyNameArray properties(exec);
+    object->methodTable()->getOwnPropertyNames(object, exec, properties, IncludeDontEnumProperties);
+    PropertyNameArray::const_iterator end = properties.end();
+    for (PropertyNameArray::const_iterator iter = properties.begin(); iter != end; ++iter) {
+        // a. Let desc be the result of calling the [[GetOwnProperty]] internal method of O with P.
+        PropertyDescriptor desc;
+        if (!object->methodTable()->getOwnPropertyDescriptor(object, exec, *iter, desc))
+            continue;
+        // b. If desc.[[Configurable]] is true, then return false.
+        if (desc.configurable())
+            return JSValue::encode(jsBoolean(false));
+    }
+
+    // 3. If the [[Extensible]] internal property of O is false, then return true.
+    // 4. Otherwise, return false.
+    return JSValue::encode(jsBoolean(!object->isExtensible()));
 }
 
 EncodedJSValue JSC_HOST_CALL objectConstructorIsFrozen(ExecState* exec)
 {
+    // 1. If Type(O) is not Object throw a TypeError exception.
     JSValue obj = exec->argument(0);
     if (!obj.isObject())
         return throwVMError(exec, createTypeError(exec, "Object.isFrozen can only be called on Objects."));
-    return JSValue::encode(jsBoolean(asObject(obj)->isFrozen(exec->globalData())));
+    JSObject* object = asObject(obj);
+
+    if (isJSFinalObject(object))
+        return JSValue::encode(jsBoolean(object->isFrozen(exec->globalData())));
+
+    // 2. For each named own property name P of O,
+    PropertyNameArray properties(exec);
+    object->methodTable()->getOwnPropertyNames(object, exec, properties, IncludeDontEnumProperties);
+    PropertyNameArray::const_iterator end = properties.end();
+    for (PropertyNameArray::const_iterator iter = properties.begin(); iter != end; ++iter) {
+        // a. Let desc be the result of calling the [[GetOwnProperty]] internal method of O with P.
+        PropertyDescriptor desc;
+        if (!object->methodTable()->getOwnPropertyDescriptor(object, exec, *iter, desc))
+            continue;
+        // b. If IsDataDescriptor(desc) is true then
+        // i. If desc.[[Writable]] is true, return false. c. If desc.[[Configurable]] is true, then return false.
+        if ((desc.isDataDescriptor() && desc.writable()) || desc.configurable())
+            return JSValue::encode(jsBoolean(false));
+    }
+
+    // 3. If the [[Extensible]] internal property of O is false, then return true.
+    // 4. Otherwise, return false.
+    return JSValue::encode(jsBoolean(!object->isExtensible()));
 }
 
 EncodedJSValue JSC_HOST_CALL objectConstructorIsExtensible(ExecState* exec)
diff --git a/Source/JavaScriptCore/runtime/ObjectPrototype.cpp b/Source/JavaScriptCore/runtime/ObjectPrototype.cpp
index 674bd7b7d..6ad312c7c 100644
--- a/Source/JavaScriptCore/runtime/ObjectPrototype.cpp
+++ b/Source/JavaScriptCore/runtime/ObjectPrototype.cpp
@@ -80,7 +80,7 @@ void ObjectPrototype::finishCreation(JSGlobalData& globalData, JSGlobalObject*)
 void ObjectPrototype::put(JSCell* cell, ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     ObjectPrototype* thisObject = jsCast<ObjectPrototype*>(cell);
-    JSNonFinalObject::put(cell, exec, propertyName, value, slot);
+    Base::put(cell, exec, propertyName, value, slot);
 
     if (thisObject->m_hasNoPropertiesWithUInt32Names) {
         bool isUInt32;
@@ -89,12 +89,26 @@ void ObjectPrototype::put(JSCell* cell, ExecState* exec, const Identifier& prope
     }
 }
 
+bool ObjectPrototype::defineOwnProperty(JSObject* object, ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor, bool shouldThrow)
+{
+    ObjectPrototype* thisObject = jsCast<ObjectPrototype*>(object);
+    bool result = Base::defineOwnProperty(object, exec, propertyName, descriptor, shouldThrow);
+
+    if (thisObject->m_hasNoPropertiesWithUInt32Names) {
+        bool isUInt32;
+        propertyName.toUInt32(isUInt32);
+        thisObject->m_hasNoPropertiesWithUInt32Names = !isUInt32;
+    }
+
+    return result;
+}
+
 bool ObjectPrototype::getOwnPropertySlotByIndex(JSCell* cell, ExecState* exec, unsigned propertyName, PropertySlot& slot)
 {
     ObjectPrototype* thisObject = jsCast<ObjectPrototype*>(cell);
     if (thisObject->m_hasNoPropertiesWithUInt32Names)
         return false;
-    return JSNonFinalObject::getOwnPropertySlotByIndex(thisObject, exec, propertyName, slot);
+    return Base::getOwnPropertySlotByIndex(thisObject, exec, propertyName, slot);
 }
 
 bool ObjectPrototype::getOwnPropertySlot(JSCell* cell, ExecState* exec, const Identifier& propertyName, PropertySlot &slot)
diff --git a/Source/JavaScriptCore/runtime/ObjectPrototype.h b/Source/JavaScriptCore/runtime/ObjectPrototype.h
index 4c49e97a7..b9b8a30d4 100644
--- a/Source/JavaScriptCore/runtime/ObjectPrototype.h
+++ b/Source/JavaScriptCore/runtime/ObjectPrototype.h
@@ -51,6 +51,7 @@ namespace JSC {
     private:
         ObjectPrototype(ExecState*, Structure*);
         static void put(JSCell*, ExecState*, const Identifier&, JSValue, PutPropertySlot&);
+        static bool defineOwnProperty(JSObject*, ExecState*, const Identifier& propertyName, PropertyDescriptor&, bool shouldThrow);
 
         static bool getOwnPropertySlot(JSCell*, ExecState*, const Identifier&, PropertySlot&);
         static bool getOwnPropertySlotByIndex(JSCell*, ExecState*, unsigned propertyName, PropertySlot&);
diff --git a/Source/JavaScriptCore/runtime/Options.cpp b/Source/JavaScriptCore/runtime/Options.cpp
index ddfba6e7c..5500508cf 100644
--- a/Source/JavaScriptCore/runtime/Options.cpp
+++ b/Source/JavaScriptCore/runtime/Options.cpp
@@ -52,6 +52,10 @@ unsigned maximumFunctionForConstructInlineCandidateInstructionCount;
 
 unsigned maximumInliningDepth;
 
+int32_t executionCounterValueForJITAfterWarmUp;
+int32_t executionCounterValueForDontJITAnytimeSoon;
+int32_t executionCounterValueForJITSoon;
+
 int32_t executionCounterValueForOptimizeAfterWarmUp;
 int32_t executionCounterValueForOptimizeAfterLongWarmUp;
 int32_t executionCounterValueForDontOptimizeAnytimeSoon;
@@ -137,6 +141,10 @@ void initializeOptions()
     
     SET(maximumInliningDepth, 5);
 
+    SET(executionCounterValueForJITAfterWarmUp,     -100);
+    SET(executionCounterValueForDontJITAnytimeSoon, std::numeric_limits<int32_t>::min());
+    SET(executionCounterValueForJITSoon,            -100);
+
     SET(executionCounterValueForOptimizeAfterWarmUp,     -1000);
     SET(executionCounterValueForOptimizeAfterLongWarmUp, -5000);
     SET(executionCounterValueForDontOptimizeAnytimeSoon, std::numeric_limits<int32_t>::min());
@@ -185,6 +193,8 @@ void initializeOptions()
     if (cpusToUse < 1)
         cpusToUse = 1;
     
+    cpusToUse = 1;
+    
     SET(numberOfGCMarkers, cpusToUse);
 
     ASSERT(executionCounterValueForDontOptimizeAnytimeSoon <= executionCounterValueForOptimizeAfterLongWarmUp);
diff --git a/Source/JavaScriptCore/runtime/Options.h b/Source/JavaScriptCore/runtime/Options.h
index feebd37bb..b9e68f90c 100644
--- a/Source/JavaScriptCore/runtime/Options.h
+++ b/Source/JavaScriptCore/runtime/Options.h
@@ -37,6 +37,10 @@ extern unsigned maximumFunctionForConstructInlineCandidateInstructionCount;
 
 extern unsigned maximumInliningDepth; // Depth of inline stack, so 1 = no inlining, 2 = one level, etc.
 
+extern int32_t executionCounterValueForJITAfterWarmUp;
+extern int32_t executionCounterValueForDontJITAnytimeSoon;
+extern int32_t executionCounterValueForJITSoon;
+
 extern int32_t executionCounterValueForOptimizeAfterWarmUp;
 extern int32_t executionCounterValueForOptimizeAfterLongWarmUp;
 extern int32_t executionCounterValueForDontOptimizeAnytimeSoon;
diff --git a/Source/JavaScriptCore/runtime/PropertyDescriptor.cpp b/Source/JavaScriptCore/runtime/PropertyDescriptor.cpp
index e3458e4b9..0cb629584 100644
--- a/Source/JavaScriptCore/runtime/PropertyDescriptor.cpp
+++ b/Source/JavaScriptCore/runtime/PropertyDescriptor.cpp
@@ -217,12 +217,16 @@ unsigned PropertyDescriptor::attributesWithOverride(const PropertyDescriptor& ot
         newAttributes ^= DontDelete;
     if (sharedSeen & EnumerablePresent && mismatch & DontEnum)
         newAttributes ^= DontEnum;
+    if (isAccessorDescriptor() && other.isDataDescriptor())
+        newAttributes |= ReadOnly;
     return newAttributes;
 }
 
 unsigned PropertyDescriptor::attributesOverridingCurrent(const PropertyDescriptor& current) const
 {
     unsigned currentAttributes = current.m_attributes;
+    if (isDataDescriptor() && current.isAccessorDescriptor())
+        currentAttributes |= ReadOnly;
     unsigned overrideMask = 0;
     if (writablePresent())
         overrideMask |= ReadOnly;
diff --git a/Source/JavaScriptCore/runtime/RegExp.cpp b/Source/JavaScriptCore/runtime/RegExp.cpp
index 69bca5df0..2b7feb4b5 100644
--- a/Source/JavaScriptCore/runtime/RegExp.cpp
+++ b/Source/JavaScriptCore/runtime/RegExp.cpp
@@ -413,24 +413,24 @@ void RegExp::matchCompareWithInterpreter(const UString& s, int startOffset, int*
             differences++;
 
     if (differences) {
-        fprintf(stderr, "RegExp Discrepency for /%s/\n    string input ", pattern().utf8().data());
+        dataLog("RegExp Discrepency for /%s/\n    string input ", pattern().utf8().data());
         unsigned segmentLen = s.length() - static_cast<unsigned>(startOffset);
 
-        fprintf(stderr, (segmentLen < 150) ? "\"%s\"\n" : "\"%148s...\"\n", s.utf8().data() + startOffset);
+        dataLog((segmentLen < 150) ? "\"%s\"\n" : "\"%148s...\"\n", s.utf8().data() + startOffset);
 
         if (jitResult != interpreterResult) {
-            fprintf(stderr, "    JIT result = %d, blah interpreted result = %d\n", jitResult, interpreterResult);
+            dataLog("    JIT result = %d, blah interpreted result = %d\n", jitResult, interpreterResult);
             differences--;
         } else {
-            fprintf(stderr, "    Correct result = %d\n", jitResult);
+            dataLog("    Correct result = %d\n", jitResult);
         }
 
         if (differences) {
             for (unsigned j = 2, i = 0; i < m_numSubpatterns; j +=2, i++) {
                 if (offsetVector[j] != interpreterOffsetVector[j])
-                    fprintf(stderr, "    JIT offset[%d] = %d, interpreted offset[%d] = %d\n", j, offsetVector[j], j, interpreterOffsetVector[j]);
+                    dataLog("    JIT offset[%d] = %d, interpreted offset[%d] = %d\n", j, offsetVector[j], j, interpreterOffsetVector[j]);
                 if ((offsetVector[j] >= 0) && (offsetVector[j+1] != interpreterOffsetVector[j+1]))
-                    fprintf(stderr, "    JIT offset[%d] = %d, interpreted offset[%d] = %d\n", j+1, offsetVector[j+1], j+1, interpreterOffsetVector[j+1]);
+                    dataLog("    JIT offset[%d] = %d, interpreted offset[%d] = %d\n", j+1, offsetVector[j+1], j+1, interpreterOffsetVector[j+1]);
             }
         }
     }
diff --git a/Source/JavaScriptCore/runtime/RegExpCache.cpp b/Source/JavaScriptCore/runtime/RegExpCache.cpp
index cd96301db..d5edbbc7f 100644
--- a/Source/JavaScriptCore/runtime/RegExpCache.cpp
+++ b/Source/JavaScriptCore/runtime/RegExpCache.cpp
@@ -46,7 +46,7 @@ RegExp* RegExpCache::lookupOrCreate(const UString& patternString, RegExpFlags fl
     // We need to do a second lookup to add the RegExp as
     // allocating it may have caused a gc cycle, which in
     // turn may have removed items from the cache.
-    m_weakCache.add(key, Weak<RegExp>(*m_globalData, regExp, this));
+    m_weakCache.add(key, PassWeak<RegExp>(*m_globalData, regExp, this));
     return regExp;
 }
 
diff --git a/Source/JavaScriptCore/runtime/SamplingCounter.cpp b/Source/JavaScriptCore/runtime/SamplingCounter.cpp
index e5fb25a93..abed763ca 100644
--- a/Source/JavaScriptCore/runtime/SamplingCounter.cpp
+++ b/Source/JavaScriptCore/runtime/SamplingCounter.cpp
@@ -35,10 +35,10 @@ void AbstractSamplingCounter::dump()
 {
 #if ENABLE(SAMPLING_COUNTERS)
     if (s_abstractSamplingCounterChain != &s_abstractSamplingCounterChainEnd) {
-        printf("\nSampling Counter Values:\n");
+        dataLog("\nSampling Counter Values:\n");
         for (AbstractSamplingCounter* currCounter = s_abstractSamplingCounterChain; (currCounter != &s_abstractSamplingCounterChainEnd); currCounter = currCounter->m_next)
-            printf("\t%s\t: %lld\n", currCounter->m_name, currCounter->m_counter);
-        printf("\n\n");
+            dataLog("\t%s\t: %lld\n", currCounter->m_name, currCounter->m_counter);
+        dataLog("\n\n");
     }
     s_completed = true;
 #endif
diff --git a/Source/JavaScriptCore/runtime/SamplingCounter.h b/Source/JavaScriptCore/runtime/SamplingCounter.h
index 329a5cfd3..8413b5458 100644
--- a/Source/JavaScriptCore/runtime/SamplingCounter.h
+++ b/Source/JavaScriptCore/runtime/SamplingCounter.h
@@ -159,7 +159,7 @@ public:
     ~DeletableSamplingCounter()
     {
         if (!s_completed)
-            fprintf(stderr, "DeletableSamplingCounter \"%s\" deleted early (with count %lld)\n", m_name, m_counter);
+            dataFile("DeletableSamplingCounter \"%s\" deleted early (with count %lld)\n", m_name, m_counter);
         // Our m_referer pointer should know where the pointer to this node is,
         // and m_next should know that this node is the previous node in the list.
         ASSERT(*m_referer == this);
diff --git a/Source/JavaScriptCore/runtime/ScopeChain.cpp b/Source/JavaScriptCore/runtime/ScopeChain.cpp
index 099f7fde6..e7ea07508 100644
--- a/Source/JavaScriptCore/runtime/ScopeChain.cpp
+++ b/Source/JavaScriptCore/runtime/ScopeChain.cpp
@@ -42,12 +42,12 @@ void ScopeChainNode::print()
         o->methodTable()->getPropertyNames(o, globalObject->globalExec(), propertyNames, ExcludeDontEnumProperties);
         PropertyNameArray::const_iterator propEnd = propertyNames.end();
 
-        fprintf(stderr, "----- [scope %p] -----\n", o);
+        dataLog("----- [scope %p] -----\n", o);
         for (PropertyNameArray::const_iterator propIter = propertyNames.begin(); propIter != propEnd; propIter++) {
             Identifier name = *propIter;
-            fprintf(stderr, "%s, ", name.ustring().utf8().data());
+            dataLog("%s, ", name.ustring().utf8().data());
         }
-        fprintf(stderr, "\n");
+        dataLog("\n");
     }
 }
 
diff --git a/Source/JavaScriptCore/runtime/ScopeChain.h b/Source/JavaScriptCore/runtime/ScopeChain.h
index 6e358d779..c382008f1 100644
--- a/Source/JavaScriptCore/runtime/ScopeChain.h
+++ b/Source/JavaScriptCore/runtime/ScopeChain.h
@@ -30,6 +30,7 @@ namespace JSC {
     class JSGlobalData;
     class JSGlobalObject;
     class JSObject;
+    class LLIntOffsetsExtractor;
     class ScopeChainIterator;
     class SlotVisitor;
     
@@ -91,6 +92,8 @@ namespace JSC {
         static JS_EXPORTDATA const ClassInfo s_info;
 
     private:
+        friend class LLIntOffsetsExtractor;
+        
         static const unsigned StructureFlags = OverridesVisitChildren;
     };
 
diff --git a/Source/JavaScriptCore/runtime/Structure.cpp b/Source/JavaScriptCore/runtime/Structure.cpp
index f387cf283..6ee419da6 100644
--- a/Source/JavaScriptCore/runtime/Structure.cpp
+++ b/Source/JavaScriptCore/runtime/Structure.cpp
@@ -142,17 +142,17 @@ void Structure::dumpStatistics()
         }
     }
 
-    printf("Number of live Structures: %d\n", liveStructureSet.size());
-    printf("Number of Structures using the single item optimization for transition map: %d\n", numberUsingSingleSlot);
-    printf("Number of Structures that are leaf nodes: %d\n", numberLeaf);
-    printf("Number of Structures that singletons: %d\n", numberSingletons);
-    printf("Number of Structures with PropertyMaps: %d\n", numberWithPropertyMaps);
-
-    printf("Size of a single Structures: %d\n", static_cast<unsigned>(sizeof(Structure)));
-    printf("Size of sum of all property maps: %d\n", totalPropertyMapsSize);
-    printf("Size of average of all property maps: %f\n", static_cast<double>(totalPropertyMapsSize) / static_cast<double>(liveStructureSet.size()));
+    dataLog("Number of live Structures: %d\n", liveStructureSet.size());
+    dataLog("Number of Structures using the single item optimization for transition map: %d\n", numberUsingSingleSlot);
+    dataLog("Number of Structures that are leaf nodes: %d\n", numberLeaf);
+    dataLog("Number of Structures that singletons: %d\n", numberSingletons);
+    dataLog("Number of Structures with PropertyMaps: %d\n", numberWithPropertyMaps);
+
+    dataLog("Size of a single Structures: %d\n", static_cast<unsigned>(sizeof(Structure)));
+    dataLog("Size of sum of all property maps: %d\n", totalPropertyMapsSize);
+    dataLog("Size of average of all property maps: %f\n", static_cast<double>(totalPropertyMapsSize) / static_cast<double>(liveStructureSet.size()));
 #else
-    printf("Dumping Structure statistics is not enabled.\n");
+    dataLog("Dumping Structure statistics is not enabled.\n");
 #endif
 }
 
@@ -167,6 +167,7 @@ Structure::Structure(JSGlobalData& globalData, JSGlobalObject* globalObject, JSV
     , m_dictionaryKind(NoneDictionaryKind)
     , m_isPinnedPropertyTable(false)
     , m_hasGetterSetterProperties(false)
+    , m_hasReadOnlyOrGetterSetterPropertiesExcludingProto(false)
     , m_hasNonEnumerableProperties(false)
     , m_attributesInPrevious(0)
     , m_specificFunctionThrashCount(0)
@@ -188,6 +189,7 @@ Structure::Structure(JSGlobalData& globalData)
     , m_dictionaryKind(NoneDictionaryKind)
     , m_isPinnedPropertyTable(false)
     , m_hasGetterSetterProperties(false)
+    , m_hasReadOnlyOrGetterSetterPropertiesExcludingProto(false)
     , m_hasNonEnumerableProperties(false)
     , m_attributesInPrevious(0)
     , m_specificFunctionThrashCount(0)
@@ -207,6 +209,7 @@ Structure::Structure(JSGlobalData& globalData, const Structure* previous)
     , m_dictionaryKind(previous->m_dictionaryKind)
     , m_isPinnedPropertyTable(false)
     , m_hasGetterSetterProperties(previous->m_hasGetterSetterProperties)
+    , m_hasReadOnlyOrGetterSetterPropertiesExcludingProto(previous->m_hasReadOnlyOrGetterSetterPropertiesExcludingProto)
     , m_hasNonEnumerableProperties(previous->m_hasNonEnumerableProperties)
     , m_attributesInPrevious(0)
     , m_specificFunctionThrashCount(previous->m_specificFunctionThrashCount)
@@ -322,7 +325,7 @@ Structure* Structure::addPropertyTransition(JSGlobalData& globalData, Structure*
             transition->growPropertyStorageCapacity();
         return transition;
     }
-
+    
     Structure* transition = create(globalData, structure);
 
     transition->m_cachedPrototypeChain.setMayBeNull(globalData, transition, structure->m_cachedPrototypeChain.get());
@@ -467,9 +470,12 @@ Structure* Structure::freezeTransition(JSGlobalData& globalData, Structure* stru
     Structure* transition = preventExtensionsTransition(globalData, structure);
 
     if (transition->m_propertyTable) {
+        PropertyTable::iterator iter = transition->m_propertyTable->begin();
         PropertyTable::iterator end = transition->m_propertyTable->end();
-        for (PropertyTable::iterator iter = transition->m_propertyTable->begin(); iter != end; ++iter)
-            iter->attributes |= (DontDelete | ReadOnly);
+        if (iter != end)
+            transition->m_hasReadOnlyOrGetterSetterPropertiesExcludingProto = true;
+        for (; iter != end; ++iter)
+            iter->attributes |= iter->attributes & Accessor ? DontDelete : (DontDelete | ReadOnly);
     }
 
     return transition;
@@ -520,7 +526,9 @@ bool Structure::isFrozen(JSGlobalData& globalData)
 
     PropertyTable::iterator end = m_propertyTable->end();
     for (PropertyTable::iterator iter = m_propertyTable->begin(); iter != end; ++iter) {
-        if ((iter->attributes & (DontDelete | ReadOnly)) != (DontDelete | ReadOnly))
+        if (!(iter->attributes & DontDelete))
+            return false;
+        if (!(iter->attributes & (ReadOnly | Accessor)))
             return false;
     }
     return true;
@@ -601,11 +609,11 @@ static PropertyMapStatisticsExitLogger logger;
 
 PropertyMapStatisticsExitLogger::~PropertyMapStatisticsExitLogger()
 {
-    printf("\nJSC::PropertyMap statistics\n\n");
-    printf("%d probes\n", numProbes);
-    printf("%d collisions (%.1f%%)\n", numCollisions, 100.0 * numCollisions / numProbes);
-    printf("%d rehashes\n", numRehashes);
-    printf("%d removes\n", numRemoves);
+    dataLog("\nJSC::PropertyMap statistics\n\n");
+    dataLog("%d probes\n", numProbes);
+    dataLog("%d collisions (%.1f%%)\n", numCollisions, 100.0 * numCollisions / numProbes);
+    dataLog("%d rehashes\n", numRehashes);
+    dataLog("%d removes\n", numRemoves);
 }
 
 #endif
diff --git a/Source/JavaScriptCore/runtime/Structure.h b/Source/JavaScriptCore/runtime/Structure.h
index ced296856..46cf732e1 100644
--- a/Source/JavaScriptCore/runtime/Structure.h
+++ b/Source/JavaScriptCore/runtime/Structure.h
@@ -45,6 +45,7 @@
 
 namespace JSC {
 
+    class LLIntOffsetsExtractor;
     class PropertyNameArray;
     class PropertyNameArrayData;
     class StructureChain;
@@ -145,7 +146,17 @@ namespace JSC {
         }
 
         bool hasGetterSetterProperties() const { return m_hasGetterSetterProperties; }
-        void setHasGetterSetterProperties(bool hasGetterSetterProperties) { m_hasGetterSetterProperties = hasGetterSetterProperties; }
+        bool hasReadOnlyOrGetterSetterPropertiesExcludingProto() const { return m_hasReadOnlyOrGetterSetterPropertiesExcludingProto; }
+        void setHasGetterSetterProperties(bool is__proto__)
+        {
+            m_hasGetterSetterProperties = true;
+            if (!is__proto__)
+                m_hasReadOnlyOrGetterSetterPropertiesExcludingProto = true;
+        }
+        void setContainsReadOnlyProperties()
+        {
+            m_hasReadOnlyOrGetterSetterPropertiesExcludingProto = true;
+        }
 
         bool hasNonEnumerableProperties() const { return m_hasNonEnumerableProperties; }
         
@@ -196,6 +207,8 @@ namespace JSC {
         static JS_EXPORTDATA const ClassInfo s_info;
 
     private:
+        friend class LLIntOffsetsExtractor;
+        
         JS_EXPORT_PRIVATE Structure(JSGlobalData&, JSGlobalObject*, JSValue prototype, const TypeInfo&, const ClassInfo*);
         Structure(JSGlobalData&);
         Structure(JSGlobalData&, const Structure*);
@@ -282,6 +295,7 @@ namespace JSC {
         unsigned m_dictionaryKind : 2;
         bool m_isPinnedPropertyTable : 1;
         bool m_hasGetterSetterProperties : 1;
+        bool m_hasReadOnlyOrGetterSetterPropertiesExcludingProto : 1;
         bool m_hasNonEnumerableProperties : 1;
         unsigned m_attributesInPrevious : 7;
         unsigned m_specificFunctionThrashCount : 2;
diff --git a/Source/JavaScriptCore/runtime/StructureChain.h b/Source/JavaScriptCore/runtime/StructureChain.h
index df7a37fa7..3b19d4cf1 100644
--- a/Source/JavaScriptCore/runtime/StructureChain.h
+++ b/Source/JavaScriptCore/runtime/StructureChain.h
@@ -37,6 +37,7 @@
 
 namespace JSC {
 
+    class LLIntOffsetsExtractor;
     class Structure;
 
     class StructureChain : public JSCell {
@@ -74,6 +75,8 @@ namespace JSC {
         }
 
     private:
+        friend class LLIntOffsetsExtractor;
+        
         StructureChain(JSGlobalData&, Structure*);
         static void destroy(JSCell*);
         OwnArrayPtr<WriteBarrier<Structure> > m_vector;
diff --git a/Source/JavaScriptCore/runtime/StructureTransitionTable.h b/Source/JavaScriptCore/runtime/StructureTransitionTable.h
index 536237a33..517992470 100644
--- a/Source/JavaScriptCore/runtime/StructureTransitionTable.h
+++ b/Source/JavaScriptCore/runtime/StructureTransitionTable.h
@@ -29,7 +29,6 @@
 #include "UString.h"
 #include "WeakGCMap.h"
 #include <wtf/HashFunctions.h>
-#include <wtf/HashTraits.h>
 #include <wtf/OwnPtr.h>
 #include <wtf/RefPtr.h>
 
@@ -55,22 +54,6 @@ class StructureTransitionTable {
         static const bool safeToCompareToEmptyOrDeleted = true;
     };
 
-    struct HashTraits {
-        typedef WTF::HashTraits<RefPtr<StringImpl> > FirstTraits;
-        typedef WTF::GenericHashTraits<unsigned> SecondTraits;
-        typedef std::pair<FirstTraits::TraitType, SecondTraits::TraitType > TraitType;
-
-        static const bool emptyValueIsZero = FirstTraits::emptyValueIsZero && SecondTraits::emptyValueIsZero;
-        static TraitType emptyValue() { return std::make_pair(FirstTraits::emptyValue(), SecondTraits::emptyValue()); }
-
-        static const bool needsDestruction = FirstTraits::needsDestruction || SecondTraits::needsDestruction;
-
-        static const int minimumTableSize = FirstTraits::minimumTableSize;
-
-        static void constructDeletedValue(TraitType& slot) { FirstTraits::constructDeletedValue(slot.first); }
-        static bool isDeletedValue(const TraitType& value) { return FirstTraits::isDeletedValue(value.first); }
-    };
-
     struct WeakGCMapFinalizerCallback {
         static void* finalizerContextFor(Hash::Key)
         {
@@ -83,7 +66,7 @@ class StructureTransitionTable {
         }
     };
 
-    typedef WeakGCMap<Hash::Key, Structure, WeakGCMapFinalizerCallback, Hash, HashTraits> TransitionMap;
+    typedef WeakGCMap<Hash::Key, Structure, WeakGCMapFinalizerCallback, Hash> TransitionMap;
 
     static Hash::Key keyForWeakGCMapFinalizer(void* context, Structure*);
 
diff --git a/Source/JavaScriptCore/runtime/WriteBarrier.h b/Source/JavaScriptCore/runtime/WriteBarrier.h
index 6ac52b7c7..7e9db12fb 100644
--- a/Source/JavaScriptCore/runtime/WriteBarrier.h
+++ b/Source/JavaScriptCore/runtime/WriteBarrier.h
@@ -26,6 +26,7 @@
 #ifndef WriteBarrier_h
 #define WriteBarrier_h
 
+#include "GCAssertions.h"
 #include "HandleTypes.h"
 #include "Heap.h"
 #include "SamplingCounter.h"
@@ -73,6 +74,13 @@ public:
         validateCell(value);
         setEarlyValue(globalData, owner, value);
     }
+    
+    // This is meant to be used like operator=, but is called copyFrom instead, in
+    // order to kindly inform the C++ compiler that its advice is not appreciated.
+    void copyFrom(const WriteBarrierBase<T>& other)
+    {
+        m_cell = other.m_cell;
+    }
 
     void setMayBeNull(JSGlobalData& globalData, const JSCell* owner, T* value)
     {
diff --git a/Source/JavaScriptCore/shell/CMakeLists.txt b/Source/JavaScriptCore/shell/CMakeLists.txt
index 44f02b93c..b9d64dbae 100644
--- a/Source/JavaScriptCore/shell/CMakeLists.txt
+++ b/Source/JavaScriptCore/shell/CMakeLists.txt
@@ -1,6 +1,3 @@
-SET(JSC_HEADERS
-)
-
 SET(JSC_SOURCES
     ../jsc.cpp
 )
@@ -9,11 +6,11 @@ SET(JSC_LIBRARIES
     ${JavaScriptCore_LIBRARY_NAME}
 )
 
-INCLUDE_IF_EXISTS(${JAVASCRIPTCORE_DIR}/shell/Platform${PORT}.cmake)
+WEBKIT_INCLUDE_CONFIG_FILES_IF_EXISTS()
 
 WEBKIT_WRAP_SOURCELIST(${JSC_SOURCES})
 INCLUDE_DIRECTORIES(./ ${JavaScriptCore_INCLUDE_DIRECTORIES})
-ADD_EXECUTABLE(${JSC_EXECUTABLE_NAME} ${JSC_HEADERS} ${JSC_SOURCES})
+ADD_EXECUTABLE(${JSC_EXECUTABLE_NAME} ${JSC_SOURCES})
 TARGET_LINK_LIBRARIES(${JSC_EXECUTABLE_NAME} ${JSC_LIBRARIES})
 
 IF (JSC_LINK_FLAGS)
diff --git a/Source/JavaScriptCore/tests/mozilla/ecma/String/15.5.4.11-2.js b/Source/JavaScriptCore/tests/mozilla/ecma/String/15.5.4.11-2.js
index b75f3e8d6..b224ffa83 100644
--- a/Source/JavaScriptCore/tests/mozilla/ecma/String/15.5.4.11-2.js
+++ b/Source/JavaScriptCore/tests/mozilla/ecma/String/15.5.4.11-2.js
@@ -84,7 +84,7 @@ function getTestCases() {
     // Georgian
     // Range: U+10A0 to U+10FF
     for ( var i = 0x10A0; i <= 0x10FF; i++ ) {
-        var U = new Array(new Unicode( i, 4 ), new Unicode( i, 5 ));
+        var U = new Array(new Unicode( i, 4 ), new Unicode( i, 5 ), new Unicode( i, 6.1));
 
 /*
         array[item++] = new TestCase(   SECTION,
@@ -92,7 +92,7 @@ function getTestCases() {
                                         String.fromCharCode(U.lower),
                                         eval("var s = new String( String.fromCharCode("+i+") ); s.toLowerCase()") );
 */
-        array[item++] = new TestCaseDualExpected(   SECTION,
+        array[item++] = new TestCaseMultiExpected(   SECTION,
                                         "var s = new String( String.fromCharCode("+i+") ); s.toLowerCase().charCodeAt(0)",
                                         U,
                                         eval("var s = new String( String.fromCharCode(i) ); s.toLowerCase().charCodeAt(0)") );
@@ -106,7 +106,7 @@ function getTestCases() {
  *
  */
 
-function TestCaseDualExpected( n, d, e, a ) {
+function TestCaseMultiExpected( n, d, e, a ) {
     this.name        = n;
     this.description = d;
     this.expect      = e;
@@ -115,26 +115,27 @@ function TestCaseDualExpected( n, d, e, a ) {
     this.reason      = "";
     this.bugnumber   = BUGNUMBER;
 
-    this.passed = getTestCaseResultDualExpected( this.expect, this.actual );
+    this.passed = getTestCaseResultMultiExpected( this.expect, this.actual );
     if ( DEBUG ) {
         writeLineToLog( "added " + this.description );
     }
 }
 
 // Added so that either Unicode 4.0 or 5.0 results will be considered correct.
-function writeTestCaseResultDualExpected( expect, actual, string ) {
-        var passed = getTestCaseResultDualExpected( expect, actual );
+function writeTestCaseResultMultiExpected( expect, actual, string ) {
+        var passed = getTestCaseResultMultiExpected( expect, actual );
         writeFormattedResult( expect[1].lower, actual, string, passed );
         return passed;
 }
 /*
- * Added so that either Unicode 4.0 or 5.0 results will be considered correct.
+ * Added so that either Unicode 4.0, 5.0 or 6.1 results will be considered correct.
  * Compare expected result to the actual result and figure out whether
  * the test case passed.
  */
-function getTestCaseResultDualExpected( expect, actual ) {
+function getTestCaseResultMultiExpected( expect, actual ) {
     expectedU4 = expect[0].lower;
     expectedU5 = expect[1].lower;
+    expectedU6_1 = expect[2].lower;
     //  because ( NaN == NaN ) always returns false, need to do
     //  a special compare to see if we got the right result.
         if ( actual != actual ) {
@@ -159,22 +160,30 @@ function getTestCaseResultDualExpected( expect, actual ) {
                 expectedU5 = "NaN number";
             }
         }
+        if ( expectedU6_1 != expectedU6_1 )   {
+            if ( typeof expectedU6_1 == "object" ) {
+                expectedU6_1 = "NaN object";
+            } else {
+                expectedU6_1 = "NaN number";
+            }
+        }
 
-        var passed = ( expectedU4 == actual || expectedU5 == actual ) ? true : false;
+        var passed = ( expectedU4 == actual || expectedU5 == actual || expectedU6_1 == actual ) ? true : false;
         
         //  if both objects are numbers
         // need to replace w/ IEEE standard for rounding
         if ( !passed &&
              typeof(actual) == "number" &&
             (typeof(expectedU4) == "number" ||
-             typeof(expectedU5) == "number")) {
-            if (( Math.abs(actual-expectedU4) < 0.0000001 ) || ( Math.abs(actual-expectedU5) < 0.0000001 )) {
+             typeof(expectedU5) == "number" ||
+             typeof(expectedU6_1) == "number")) {
+            if (( Math.abs(actual-expectedU4) < 0.0000001 ) || ( Math.abs(actual-expectedU5) < 0.0000001 ) || ( Math.abs(actual-expectedU6_1) < 0.0000001 )) {
                 passed = true;
             }
         }
 
         //  verify type is the same
-        if ( typeof(expectedU4) != typeof(actual) && typeof(expectedU5) != typeof(actual) )   {
+        if ( typeof(expectedU4) != typeof(actual) && typeof(expectedU5) != typeof(actual) && typeof(expectedU6_1) != typeof(actual) )   {
             passed = false;
         }
 
@@ -183,7 +192,7 @@ function getTestCaseResultDualExpected( expect, actual ) {
 
 function test() {
     for ( tc=0; tc < testcases.length; tc++ ) {
-        testcases[tc].passed = writeTestCaseResultDualExpected(
+        testcases[tc].passed = writeTestCaseResultMultiExpected(
                             testcases[tc].expect,
                             testcases[tc].actual,
                             testcases[tc].description +" = "+ testcases[tc].actual );
@@ -438,7 +447,12 @@ function GetUnicodeValues( c, version ) {
 
     // Georgian
     // Range: U+10A0 to U+10F0
-    if ( version == 5 ) {
+    if ( version >= 5 ) {
+        if ( version >= 6.1 && ( c == 0x10c7 || c == 0x10cd ) ) {
+            u[0] = c;
+            u[1] = c + 7264; //48;
+            return u;
+        }
         if ( c >= 0x10A0 && c <= 0x10C5 ) {
             u[0] = c;
             u[1] = c + 7264; //48;
@@ -630,4 +644,4 @@ function DecimalToHexString( n ) {
     }
 
     return h;
-}
\ No newline at end of file
+}
diff --git a/Source/JavaScriptCore/tools/CodeProfile.cpp b/Source/JavaScriptCore/tools/CodeProfile.cpp
index 7794f58d3..349353eb2 100644
--- a/Source/JavaScriptCore/tools/CodeProfile.cpp
+++ b/Source/JavaScriptCore/tools/CodeProfile.cpp
@@ -123,10 +123,14 @@ void CodeProfile::sample(void* pc, void** framePointer)
         if (type != EngineFrame)
             return;
 
-        // Walk up the stack.
 #if PLATFORM(MAC) && CPU(X86_64)
+        // Walk up the stack.
         pc = framePointer[1];
         framePointer = reinterpret_cast<void**>(*framePointer);
+#elif OS(LINUX) && CPU(X86)
+        // Don't unwind the stack as some dependent third party libraries
+        // may be compiled with -fomit-frame-pointer.
+        framePointer = 0;
 #else
         // This platform is not yet supported!
         ASSERT_NOT_REACHED();
@@ -139,7 +143,7 @@ void CodeProfile::sample(void* pc, void** framePointer)
 
 void CodeProfile::report()
 {
-    fprintf(stdout, "<CodeProfiling %s:%d>\n", m_file.data(), m_lineNo);
+    dataLog("<CodeProfiling %s:%d>\n", m_file.data(), m_lineNo);
 
     // How many frames of C-code to print - 0, if not verbose, 1 if verbose, up to 1024 if very verbose.
     unsigned recursionLimit = CodeProfiling::beVeryVerbose() ? 1024 : CodeProfiling::beVerbose();
@@ -176,13 +180,13 @@ void CodeProfile::report()
     }
 
     // Output the profile tree.
-    fprintf(stdout, "Total samples: %lld\n", static_cast<long long>(profile.childCount()));
+    dataLog("Total samples: %lld\n", static_cast<long long>(profile.childCount()));
     profile.dump();
     
     for (size_t i = 0 ; i < m_children.size(); ++i)
         m_children[i]->report();
 
-    fprintf(stdout, "</CodeProfiling %s:%d>\n", m_file.data(), m_lineNo);
+    dataLog("</CodeProfiling %s:%d>\n", m_file.data(), m_lineNo);
 }
 
 }
diff --git a/Source/JavaScriptCore/tools/CodeProfiling.cpp b/Source/JavaScriptCore/tools/CodeProfiling.cpp
index d927a49f6..f11603854 100644
--- a/Source/JavaScriptCore/tools/CodeProfiling.cpp
+++ b/Source/JavaScriptCore/tools/CodeProfiling.cpp
@@ -33,6 +33,10 @@
 #include <signal.h>
 #endif
 
+#if OS(LINUX)
+#include <sys/time.h>
+#endif
+
 namespace JSC {
 
 volatile CodeProfile* CodeProfiling::s_profileStack = 0;
@@ -44,7 +48,7 @@ WTF::MetaAllocatorTracker* CodeProfiling::s_tracker = 0;
 #pragma clang diagnostic ignored "-Wmissing-noreturn"
 #endif
 
-#if PLATFORM(MAC) && CPU(X86_64)
+#if (PLATFORM(MAC) && CPU(X86_64)) || (OS(LINUX) && CPU(X86))
 // Helper function to start & stop the timer.
 // Presently we're using the wall-clock timer, since this seems to give the best results.
 static void setProfileTimer(unsigned usec)
@@ -69,6 +73,13 @@ static void profilingTimer(int, siginfo_t*, void* uap)
     CodeProfiling::sample(reinterpret_cast<void*>(context->__ss.__rip),
                           reinterpret_cast<void**>(context->__ss.__rbp));
 }
+#elif OS(LINUX) && CPU(X86)
+static void profilingTimer(int, siginfo_t*, void* uap)
+{
+    mcontext_t context = static_cast<ucontext_t*>(uap)->uc_mcontext;
+    CodeProfiling::sample(reinterpret_cast<void*>(context.gregs[REG_EIP]),
+                          reinterpret_cast<void**>(context.gregs[REG_EBP]));
+}
 #endif
 
 // Callback triggered when the timer is fired.
@@ -132,10 +143,10 @@ void CodeProfiling::begin(const SourceCode& source)
     if (alreadyProfiling)
         return;
 
-#if PLATFORM(MAC) && CPU(X86_64)
+#if (PLATFORM(MAC) && CPU(X86_64)) || (OS(LINUX) && CPU(X86))
     // Regsiter a signal handler & itimer.
     struct sigaction action;
-    action.sa_sigaction = reinterpret_cast<void (*)(int, struct __siginfo *, void *)>(profilingTimer);
+    action.sa_sigaction = reinterpret_cast<void (*)(int, siginfo_t *, void *)>(profilingTimer);
     sigfillset(&action.sa_mask);
     action.sa_flags = SA_SIGINFO;
     sigaction(SIGALRM, &action, 0);
@@ -156,7 +167,7 @@ void CodeProfiling::end()
     if (s_profileStack)
         return;
 
-#if PLATFORM(MAC) && CPU(X86_64)
+#if (PLATFORM(MAC) && CPU(X86_64)) || (OS(LINUX) && CPU(X86))
     // Stop profiling
     setProfileTimer(0);
 #endif
diff --git a/Source/JavaScriptCore/tools/ProfileTreeNode.h b/Source/JavaScriptCore/tools/ProfileTreeNode.h
index 6c5fdc185..60d59928a 100644
--- a/Source/JavaScriptCore/tools/ProfileTreeNode.h
+++ b/Source/JavaScriptCore/tools/ProfileTreeNode.h
@@ -95,8 +95,8 @@ private:
             // Print the number of samples, the name of this node, and the number of samples that are stack-top
             // in this node (samples directly within this node, excluding samples in children.
             for (unsigned i = 0; i < indent; ++i)
-                fprintf(stdout, "    ");
-            fprintf(stdout, "% 8lld: %s (%lld stack top)\n",
+                dataLog("    ");
+            dataLog("% 8lld: %s (%lld stack top)\n",
                 static_cast<long long>(entry->second.count()),
                 entry->first.utf8().data(),
                 static_cast<long long>(entry->second.count() - entry->second.childCount()));
diff --git a/Source/JavaScriptCore/wtf/Assertions.h b/Source/JavaScriptCore/wtf/Assertions.h
index 42dc0bd35..e7358dccb 100644
--- a/Source/JavaScriptCore/wtf/Assertions.h
+++ b/Source/JavaScriptCore/wtf/Assertions.h
@@ -322,8 +322,12 @@ while (0)
 
 /* COMPILE_ASSERT */
 #ifndef COMPILE_ASSERT
+#if COMPILER_SUPPORTS(C_STATIC_ASSERT)
+#define COMPILE_ASSERT(exp, name) _Static_assert((exp), #name)
+#else
 #define COMPILE_ASSERT(exp, name) typedef int dummy##name [(exp) ? 1 : -1]
 #endif
+#endif
 
 /* FATAL */
 
@@ -370,29 +374,4 @@ while (0)
 #define LOG_VERBOSE(channel, ...) WTFLogVerbose(__FILE__, __LINE__, WTF_PRETTY_FUNCTION, &JOIN_LOG_CHANNEL_WITH_PREFIX(LOG_CHANNEL_PREFIX, channel), __VA_ARGS__)
 #endif
 
-#if ENABLE(GC_VALIDATION)
-#define ASSERT_GC_OBJECT_LOOKS_VALID(cell) do { \
-    if (!(cell))\
-        CRASH();\
-    if (cell->unvalidatedStructure()->unvalidatedStructure() != cell->unvalidatedStructure()->unvalidatedStructure()->unvalidatedStructure())\
-        CRASH();\
-} while (0)
-
-#define ASSERT_GC_OBJECT_INHERITS(object, classInfo) do {\
-    ASSERT_GC_OBJECT_LOOKS_VALID(object); \
-    if (!object->inherits(classInfo)) \
-        CRASH();\
-} while (0)
-
-#else
-#define ASSERT_GC_OBJECT_LOOKS_VALID(cell) do { (void)cell; } while (0)
-#define ASSERT_GC_OBJECT_INHERITS(object, classInfo) do { (void)object; (void)classInfo; } while (0)
-#endif
-
-#if COMPILER(CLANG)
-#define ASSERT_HAS_TRIVIAL_DESTRUCTOR(klass) COMPILE_ASSERT(__has_trivial_destructor(klass), klass##_has_trivial_destructor_check)
-#else
-#define ASSERT_HAS_TRIVIAL_DESTRUCTOR(klass)
-#endif
-
 #endif /* WTF_Assertions_h */
diff --git a/Source/JavaScriptCore/wtf/CMakeLists.txt b/Source/JavaScriptCore/wtf/CMakeLists.txt
index c22ae5185..63fc59c73 100644
--- a/Source/JavaScriptCore/wtf/CMakeLists.txt
+++ b/Source/JavaScriptCore/wtf/CMakeLists.txt
@@ -3,8 +3,6 @@ SET(WTF_HEADERS
     AVLTree.h
     Alignment.h
     AlwaysInline.h
-    ArrayBuffer.cpp
-    ArrayBufferView.cpp
     Assertions.h
     Atomics.h
     BitVector.h
@@ -17,6 +15,7 @@ SET(WTF_HEADERS
     CryptographicallyRandomNumber.h
     CurrentTime.h
     DateMath.h
+    DataLog.h
     DecimalNumber.h
     Decoder.h
     Deque.h
@@ -45,7 +44,6 @@ SET(WTF_HEADERS
     MallocZoneSupport.h
     MathExtras.h
     MessageQueue.h
-    MetaAllocator.cpp
     MetaAllocator.h
     MetaAllocatorHandle.h
     NonCopyingSort.h
@@ -134,18 +132,22 @@ SET(WTF_HEADERS
 )
 
 SET(WTF_SOURCES
+    ArrayBuffer.cpp
+    ArrayBufferView.cpp
     Assertions.cpp
     BitVector.cpp
     ByteArray.cpp
     CryptographicallyRandomNumber.cpp
     CurrentTime.cpp
     DateMath.cpp
+    DataLog.cpp
     DecimalNumber.cpp
     DynamicAnnotations.cpp
     FastMalloc.cpp
     HashTable.cpp
-    MainThread.cpp
     MD5.cpp
+    MainThread.cpp
+    MetaAllocator.cpp
     OSRandomSource.cpp
     NumberOfCores.cpp
     PageAllocationAligned.cpp
@@ -191,9 +193,6 @@ SET(WTF_INCLUDE_DIRECTORIES
     "${THIRDPARTY_DIR}"
 )
 
-SET(WTF_LIBRARIES
-)
-
 IF (ENABLE_FAST_MALLOC)
     LIST(APPEND WTF_SOURCES
         TCSystemAlloc.cpp
@@ -202,7 +201,7 @@ ELSE ()
     ADD_DEFINITIONS(-DUSE_SYSTEM_MALLOC=1)
 ENDIF()
 
-INCLUDE_IF_EXISTS(${JAVASCRIPTCORE_DIR}/wtf/Platform${PORT}.cmake)
+WEBKIT_INCLUDE_CONFIG_FILES_IF_EXISTS()
 
 WEBKIT_WRAP_SOURCELIST(${WTF_SOURCES})
 INCLUDE_DIRECTORIES(${WTF_INCLUDE_DIRECTORIES})
diff --git a/Source/JavaScriptCore/wtf/Compiler.h b/Source/JavaScriptCore/wtf/Compiler.h
index 96ad6e40e..b8a019299 100644
--- a/Source/JavaScriptCore/wtf/Compiler.h
+++ b/Source/JavaScriptCore/wtf/Compiler.h
@@ -48,6 +48,9 @@
 #define WTF_COMPILER_SUPPORTS_CXX_DELETED_FUNCTIONS __has_feature(cxx_deleted_functions)
 #define WTF_COMPILER_SUPPORTS_CXX_NULLPTR __has_feature(cxx_nullptr)
 #define WTF_COMPILER_SUPPORTS_BLOCKS __has_feature(blocks)
+#define WTF_COMPILER_SUPPORTS_C_STATIC_ASSERT __has_extension(c_static_assert)
+
+#define WTF_COMPILER_SUPPORTS_HAS_TRIVIAL_DESTRUCTOR __has_extension(has_trivial_destructor)
 
 #endif
 
diff --git a/Source/JavaScriptCore/wtf/DataLog.cpp b/Source/JavaScriptCore/wtf/DataLog.cpp
new file mode 100644
index 000000000..5a290e45a
--- /dev/null
+++ b/Source/JavaScriptCore/wtf/DataLog.cpp
@@ -0,0 +1,99 @@
+/*
+ * Copyright (C) 2012 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "DataLog.h"
+#include <stdarg.h>
+#include <wtf/Threading.h>
+
+#define DATA_LOG_TO_FILE 0
+
+// Uncomment to force logging to the given file regardless of what the environment variable says.
+// #define DATA_LOG_FILENAME "/tmp/WTFLog.txt"
+
+namespace WTF {
+
+#if DATA_LOG_TO_FILE
+static FILE* file;
+
+static void initializeLogFileOnce()
+{
+#ifdef DATA_LOG_FILENAME
+    const char* filename = DATA_LOG_FILENAME
+#else
+    const char* filename = getenv("WTF_DATA_LOG_FILENAME");
+#endif
+    if (filename) {
+        file = fopen(filename, "w");
+        if (!file)
+            fprintf(stderr, "Warning: Could not open log file %s for writing.\n", filename);
+    }
+    if (!file)
+        file = stderr;
+    
+    setvbuf(file, 0, _IONBF, 0); // Prefer unbuffered output, so that we get a full log upon crash or deadlock.
+}
+
+#if OS(DARWIN)
+static pthread_once_t initializeLogFileOnceKey = PTHREAD_ONCE_INIT;
+#endif
+
+static void initializeLogFile()
+{
+#if OS(DARWIN)
+    pthread_once(&initializeLogFileOnceKey, initializeLogFileOnce);
+#else
+    if (!file)
+        initializeLogFileOnce();
+#endif
+}
+
+FILE* dataFile()
+{
+    initializeLogFile();
+    return file;
+}
+#else // DATA_LOG_TO_FILE
+FILE* dataFile()
+{
+    return stderr;
+}
+#endif // DATA_LOG_TO_FILE
+
+void dataLogV(const char* format, va_list argList)
+{
+    vfprintf(dataFile(), format, argList);
+}
+
+void dataLog(const char* format, ...)
+{
+    va_list argList;
+    va_start(argList, format);
+    dataLogV(format, argList);
+    va_end(argList);
+}
+
+} // namespace WTF
+
diff --git a/Source/JavaScriptCore/wtf/DataLog.h b/Source/JavaScriptCore/wtf/DataLog.h
new file mode 100644
index 000000000..bcbebb9e2
--- /dev/null
+++ b/Source/JavaScriptCore/wtf/DataLog.h
@@ -0,0 +1,46 @@
+/*
+ * Copyright (C) 2012 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef DataLog_h
+#define DataLog_h
+
+#include <stdarg.h>
+#include <stdio.h>
+#include <wtf/Platform.h>
+#include <wtf/StdLibExtras.h>
+
+namespace WTF {
+
+FILE* dataFile();
+
+void dataLogV(const char* format, va_list) WTF_ATTRIBUTE_PRINTF(1, 0);
+void dataLog(const char* format, ...) WTF_ATTRIBUTE_PRINTF(1, 2);
+
+} // namespace WTF
+
+using WTF::dataLog;
+
+#endif // DataLog_h
+
diff --git a/Source/JavaScriptCore/wtf/DoublyLinkedList.h b/Source/JavaScriptCore/wtf/DoublyLinkedList.h
index 361d71d7b..cd067ef0a 100644
--- a/Source/JavaScriptCore/wtf/DoublyLinkedList.h
+++ b/Source/JavaScriptCore/wtf/DoublyLinkedList.h
@@ -77,6 +77,8 @@ public:
     T* head() const;
     T* removeHead();
 
+    T* tail() const;
+
     void push(T*);
     void append(T*);
     void remove(T*);
@@ -116,6 +118,11 @@ template<typename T> inline T* DoublyLinkedList<T>::head() const
     return m_head;
 }
 
+template<typename T> inline T* DoublyLinkedList<T>::tail() const
+{
+    return m_tail;
+}
+
 template<typename T> inline void DoublyLinkedList<T>::push(T* node)
 {
     if (!m_head) {
diff --git a/Source/JavaScriptCore/wtf/HashTable.cpp b/Source/JavaScriptCore/wtf/HashTable.cpp
index 71d3f86ce..94bba9b32 100644
--- a/Source/JavaScriptCore/wtf/HashTable.cpp
+++ b/Source/JavaScriptCore/wtf/HashTable.cpp
@@ -44,15 +44,15 @@ HashTableStats::~HashTableStats()
 {
     // Don't lock hashTableStatsMutex here because it can cause deadlocks at shutdown 
     // if any thread was killed while holding the mutex.
-    printf("\nWTF::HashTable statistics\n\n");
-    printf("%d accesses\n", numAccesses);
-    printf("%d total collisions, average %.2f probes per access\n", numCollisions, 1.0 * (numAccesses + numCollisions) / numAccesses);
-    printf("longest collision chain: %d\n", maxCollisions);
+    dataLog("\nWTF::HashTable statistics\n\n");
+    dataLog("%d accesses\n", numAccesses);
+    dataLog("%d total collisions, average %.2f probes per access\n", numCollisions, 1.0 * (numAccesses + numCollisions) / numAccesses);
+    dataLog("longest collision chain: %d\n", maxCollisions);
     for (int i = 1; i <= maxCollisions; i++) {
-        printf("  %d lookups with exactly %d collisions (%.2f%% , %.2f%% with this many or more)\n", collisionGraph[i], i, 100.0 * (collisionGraph[i] - collisionGraph[i+1]) / numAccesses, 100.0 * collisionGraph[i] / numAccesses);
+        dataLog("  %d lookups with exactly %d collisions (%.2f%% , %.2f%% with this many or more)\n", collisionGraph[i], i, 100.0 * (collisionGraph[i] - collisionGraph[i+1]) / numAccesses, 100.0 * collisionGraph[i] / numAccesses);
     }
-    printf("%d rehashes\n", numRehashes);
-    printf("%d reinserts\n", numReinserts);
+    dataLog("%d rehashes\n", numRehashes);
+    dataLog("%d reinserts\n", numReinserts);
 }
 
 void HashTableStats::recordCollisionAtCount(int count)
diff --git a/Source/JavaScriptCore/wtf/HashTraits.h b/Source/JavaScriptCore/wtf/HashTraits.h
index 12e6b0699..e3783ed42 100644
--- a/Source/JavaScriptCore/wtf/HashTraits.h
+++ b/Source/JavaScriptCore/wtf/HashTraits.h
@@ -57,6 +57,7 @@ namespace WTF {
 
     template<typename T> struct GenericHashTraits : GenericHashTraitsBase<IsInteger<T>::value, T> {
         typedef T TraitType;
+        typedef T EmptyValueType;
 
         static T emptyValue() { return T(); }
 
@@ -112,7 +113,9 @@ namespace WTF {
     };
 
     template<typename P> struct HashTraits<OwnPtr<P> > : SimpleClassHashTraits<OwnPtr<P> > {
-        static std::nullptr_t emptyValue() { return nullptr; }
+        typedef std::nullptr_t EmptyValueType;
+
+        static EmptyValueType emptyValue() { return nullptr; }
 
         typedef PassOwnPtr<P> PassInType;
         static void store(PassOwnPtr<P> value, OwnPtr<P>& storage) { storage = value; }
@@ -144,9 +147,10 @@ namespace WTF {
         typedef FirstTraitsArg FirstTraits;
         typedef SecondTraitsArg SecondTraits;
         typedef pair<typename FirstTraits::TraitType, typename SecondTraits::TraitType> TraitType;
+        typedef pair<typename FirstTraits::EmptyValueType, typename SecondTraits::EmptyValueType> EmptyValueType;
 
         static const bool emptyValueIsZero = FirstTraits::emptyValueIsZero && SecondTraits::emptyValueIsZero;
-        static TraitType emptyValue() { return make_pair(FirstTraits::emptyValue(), SecondTraits::emptyValue()); }
+        static EmptyValueType emptyValue() { return make_pair(FirstTraits::emptyValue(), SecondTraits::emptyValue()); }
 
         static const bool needsDestruction = FirstTraits::needsDestruction || SecondTraits::needsDestruction;
 
diff --git a/Source/JavaScriptCore/wtf/InlineASM.h b/Source/JavaScriptCore/wtf/InlineASM.h
index 379ebd364..1c99e65a1 100644
--- a/Source/JavaScriptCore/wtf/InlineASM.h
+++ b/Source/JavaScriptCore/wtf/InlineASM.h
@@ -70,4 +70,11 @@
 #define HIDE_SYMBOL(name)
 #endif
 
+// FIXME: figure out how this works on all the platforms. I know that
+// on Linux, the preferred form is ".Lstuff" as opposed to "Lstuff".
+// Don't know about any of the others.
+#if PLATFORM(MAC)
+#define LOCAL_LABEL_STRING(name) "L" #name
+#endif
+
 #endif // InlineASM_h
diff --git a/Source/JavaScriptCore/wtf/MainThread.cpp b/Source/JavaScriptCore/wtf/MainThread.cpp
index 915126589..f8686aa31 100644
--- a/Source/JavaScriptCore/wtf/MainThread.cpp
+++ b/Source/JavaScriptCore/wtf/MainThread.cpp
@@ -34,6 +34,7 @@
 #include "Functional.h"
 #include "StdLibExtras.h"
 #include "Threading.h"
+#include <wtf/ThreadSpecific.h>
 
 #if PLATFORM(CHROMIUM)
 #error Chromium uses a different main thread implementation
@@ -101,6 +102,7 @@ void initializeMainThread()
 
     mainThreadFunctionQueueMutex();
     initializeMainThreadPlatform();
+    initializeGCThreads();
 }
 
 #else
@@ -249,4 +251,42 @@ bool isMainThread()
 }
 #endif
 
+#if ENABLE(PARALLEL_GC)
+static ThreadSpecific<bool>* isGCThread;
+#endif
+
+void initializeGCThreads()
+{
+#if ENABLE(PARALLEL_GC)
+    isGCThread = new ThreadSpecific<bool>();
+#endif
+}
+
+#if ENABLE(PARALLEL_GC)
+void registerGCThread()
+{
+    if (!isGCThread) {
+        // This happens if we're running in a process that doesn't care about
+        // MainThread.
+        return;
+    }
+
+    **isGCThread = true;
+}
+
+bool isMainThreadOrGCThread()
+{
+    if (isGCThread->isSet() && **isGCThread)
+        return true;
+
+    return isMainThread();
+}
+#elif PLATFORM(MAC)
+// This is necessary because JavaScriptCore.exp doesn't support preprocessor macros.
+bool isMainThreadOrGCThread()
+{
+    return isMainThread();
+}
+#endif
+
 } // namespace WTF
diff --git a/Source/JavaScriptCore/wtf/MainThread.h b/Source/JavaScriptCore/wtf/MainThread.h
index ff76a5fd3..4839c8117 100644
--- a/Source/JavaScriptCore/wtf/MainThread.h
+++ b/Source/JavaScriptCore/wtf/MainThread.h
@@ -52,11 +52,14 @@ WTF_EXPORT_PRIVATE void callOnMainThread(const Function<void ()>&);
 WTF_EXPORT_PRIVATE void setMainThreadCallbacksPaused(bool paused);
 
 WTF_EXPORT_PRIVATE bool isMainThread();
+
+void initializeGCThreads();
+
 #if ENABLE(PARALLEL_GC)
 void registerGCThread();
 WTF_EXPORT_PRIVATE bool isMainThreadOrGCThread();
 #elif PLATFORM(MAC)
-bool isMainThreadOrGCThread();
+WTF_EXPORT_PRIVATE bool isMainThreadOrGCThread();
 #else
 inline bool isMainThreadOrGCThread() { return isMainThread(); }
 #endif
diff --git a/Source/JavaScriptCore/wtf/MetaAllocator.cpp b/Source/JavaScriptCore/wtf/MetaAllocator.cpp
index d153faab7..ac6cba8d1 100644
--- a/Source/JavaScriptCore/wtf/MetaAllocator.cpp
+++ b/Source/JavaScriptCore/wtf/MetaAllocator.cpp
@@ -428,7 +428,7 @@ void MetaAllocator::freeFreeSpaceNode(FreeSpaceNode* node)
 #if ENABLE(META_ALLOCATOR_PROFILE)
 void MetaAllocator::dumpProfile()
 {
-    printf("num allocations = %u, num frees = %u\n", m_numAllocations, m_numFrees);
+    dataLog("num allocations = %u, num frees = %u\n", m_numAllocations, m_numFrees);
 }
 #endif
 
diff --git a/Source/JavaScriptCore/wtf/NullPtr.cpp b/Source/JavaScriptCore/wtf/NullPtr.cpp
index fb75cf6d5..d6b0429b1 100644
--- a/Source/JavaScriptCore/wtf/NullPtr.cpp
+++ b/Source/JavaScriptCore/wtf/NullPtr.cpp
@@ -27,7 +27,7 @@ SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 #include "config.h"
 #include "NullPtr.h"
 
-#if !COMPILER_SUPPORTS(CXX_NULLPTR)
+#if !(COMPILER_SUPPORTS(CXX_NULLPTR) || defined(_LIBCPP_VERSION))
 
 std::nullptr_t nullptr;
 
diff --git a/Source/JavaScriptCore/wtf/NullPtr.h b/Source/JavaScriptCore/wtf/NullPtr.h
index b65f8fab5..2d0919ca6 100644
--- a/Source/JavaScriptCore/wtf/NullPtr.h
+++ b/Source/JavaScriptCore/wtf/NullPtr.h
@@ -31,7 +31,9 @@ SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 // nullptr_t type and nullptr object. They are defined in the same namespaces they
 // would be in compiler and library that had the support.
 
-#if COMPILER_SUPPORTS(CXX_NULLPTR)
+#include <ciso646>
+
+#if COMPILER_SUPPORTS(CXX_NULLPTR) || defined(_LIBCPP_VERSION)
 
 #include <cstddef>
 
diff --git a/Source/JavaScriptCore/wtf/OSAllocatorPosix.cpp b/Source/JavaScriptCore/wtf/OSAllocatorPosix.cpp
index 56c6089ff..5dbddc83e 100644
--- a/Source/JavaScriptCore/wtf/OSAllocatorPosix.cpp
+++ b/Source/JavaScriptCore/wtf/OSAllocatorPosix.cpp
@@ -102,7 +102,7 @@ void* OSAllocator::reserveAndCommit(size_t bytes, Usage usage, bool writable, bo
 
     result = mmap(result, bytes, protection, flags, fd, 0);
     if (result == MAP_FAILED) {
-    #if ENABLE(INTERPRETER)
+    #if ENABLE(CLASSIC_INTERPRETER)
         if (executable)
             result = 0;
         else
diff --git a/Source/JavaScriptCore/wtf/ParallelJobsGeneric.cpp b/Source/JavaScriptCore/wtf/ParallelJobsGeneric.cpp
index fd5b1f847..2cc0bc643 100644
--- a/Source/JavaScriptCore/wtf/ParallelJobsGeneric.cpp
+++ b/Source/JavaScriptCore/wtf/ParallelJobsGeneric.cpp
@@ -121,7 +121,7 @@ void ParallelEnvironment::ThreadPrivate::waitForFinish()
         m_threadCondition.wait(m_mutex);
 }
 
-void* ParallelEnvironment::ThreadPrivate::workerThread(void* threadData)
+void ParallelEnvironment::ThreadPrivate::workerThread(void* threadData)
 {
     ThreadPrivate* sharedThread = reinterpret_cast<ThreadPrivate*>(threadData);
     MutexLocker lock(sharedThread->m_mutex);
@@ -136,7 +136,6 @@ void* ParallelEnvironment::ThreadPrivate::workerThread(void* threadData)
 
         sharedThread->m_threadCondition.wait(sharedThread->m_mutex);
     }
-    return 0;
 }
 
 } // namespace WTF
diff --git a/Source/JavaScriptCore/wtf/ParallelJobsGeneric.h b/Source/JavaScriptCore/wtf/ParallelJobsGeneric.h
index 1c7d63c16..6de71067f 100644
--- a/Source/JavaScriptCore/wtf/ParallelJobsGeneric.h
+++ b/Source/JavaScriptCore/wtf/ParallelJobsGeneric.h
@@ -69,7 +69,7 @@ public:
             return adoptRef(new ThreadPrivate());
         }
 
-        static void* workerThread(void*);
+        static void workerThread(void*);
 
     private:
         ThreadIdentifier m_threadID;
diff --git a/Source/JavaScriptCore/wtf/Platform.h b/Source/JavaScriptCore/wtf/Platform.h
index e6d43dac3..76b11fe88 100644
--- a/Source/JavaScriptCore/wtf/Platform.h
+++ b/Source/JavaScriptCore/wtf/Platform.h
@@ -351,6 +351,11 @@
 #define WTF_OS_FREEBSD 1
 #endif
 
+/* OS(HURD) - GNU/Hurd */
+#ifdef __GNU__
+#define WTF_OS_HURD 1
+#endif
+
 /* OS(LINUX) - Linux */
 #ifdef __linux__
 #define WTF_OS_LINUX 1
@@ -394,6 +399,7 @@
     || OS(ANDROID)          \
     || OS(DARWIN)           \
     || OS(FREEBSD)          \
+    || OS(HURD)             \
     || OS(LINUX)            \
     || OS(NETBSD)           \
     || OS(OPENBSD)          \
@@ -459,7 +465,7 @@
 #define WTF_USE_CA 1
 #endif
 
-/* USE(SKIA) for Win/Linux, CG for Mac, unless enabled */
+/* USE(SKIA) for Win/Linux/Mac/Android */
 #if PLATFORM(CHROMIUM)
 #if OS(DARWIN)
 #if USE(SKIA_ON_MAC_CHROMIUM)
@@ -470,6 +476,9 @@
 #define WTF_USE_ATSUI 1
 #define WTF_USE_CORE_TEXT 1
 #define WTF_USE_ICCJPEG 1
+#elif OS(ANDROID)
+#define WTF_USE_SKIA 1
+#define WTF_USE_GLES2_RENDERING 0
 #else
 #define WTF_USE_SKIA 1
 #define WTF_USE_CHROMIUM_NET 1
@@ -594,11 +603,11 @@
 #define WTF_USE_PTHREADS 1
 
 #if PLATFORM(IOS_SIMULATOR)
-    #define ENABLE_INTERPRETER 1
+    #define ENABLE_CLASSIC_INTERPRETER 1
     #define ENABLE_JIT 0
     #define ENABLE_YARR_JIT 0
 #else
-    #define ENABLE_INTERPRETER 1
+    #define ENABLE_CLASSIC_INTERPRETER 1
     #define ENABLE_JIT 1
     #define ENABLE_YARR_JIT 1
 #endif
@@ -633,6 +642,7 @@
 #define ENABLE_JIT 1
 #endif
 #define ENABLE_GLOBAL_FASTMALLOC_NEW 0
+#define ENABLE_LLINT 0
 #if OS(DARWIN)
 #define WTF_USE_CF 1
 #define WTF_USE_CORE_TEXT 1
@@ -919,6 +929,12 @@
 #define ENABLE_JIT 1
 #endif
 
+/* On some of the platforms where we have a JIT, we want to also have the 
+   low-level interpreter. */
+#if !defined(ENABLE_LLINT) && ENABLE(JIT) && OS(DARWIN) && (CPU(X86) || CPU(ARM_THUMB2)) && USE(JSVALUE32_64)
+#define ENABLE_LLINT 1
+#endif
+
 #if !defined(ENABLE_DFG_JIT) && ENABLE(JIT)
 /* Enable the DFG JIT on X86 and X86_64.  Only tested on Mac and GNU/Linux. */
 #if (CPU(X86) || CPU(X86_64)) && (PLATFORM(MAC) || OS(LINUX))
@@ -953,10 +969,10 @@
 #endif
 
 /* Ensure that either the JIT or the interpreter has been enabled. */
-#if !defined(ENABLE_INTERPRETER) && !ENABLE(JIT)
-#define ENABLE_INTERPRETER 1
+#if !defined(ENABLE_CLASSIC_INTERPRETER) && !ENABLE(JIT)
+#define ENABLE_CLASSIC_INTERPRETER 1
 #endif
-#if !(ENABLE(JIT) || ENABLE(INTERPRETER))
+#if !(ENABLE(JIT) || ENABLE(CLASSIC_INTERPRETER))
 #error You have to have at least one execution model enabled to build JSC
 #endif
 
@@ -989,8 +1005,8 @@
 #if COMPILER(GCC) || (RVCT_VERSION_AT_LEAST(4, 0, 0, 0) && defined(__GNUC__))
 #define HAVE_COMPUTED_GOTO 1
 #endif
-#if HAVE(COMPUTED_GOTO) && ENABLE(INTERPRETER)
-#define ENABLE_COMPUTED_GOTO_INTERPRETER 1
+#if HAVE(COMPUTED_GOTO) && ENABLE(CLASSIC_INTERPRETER)
+#define ENABLE_COMPUTED_GOTO_CLASSIC_INTERPRETER 1
 #endif
 
 /* Regular Expression Tracing - Set to 1 to trace RegExp's in jsc.  Results dumped at exit */
@@ -1123,7 +1139,7 @@
 #define ENABLE_COMPARE_AND_SWAP 1
 #endif
 
-#if !defined(ENABLE_PARALLEL_GC) && (PLATFORM(MAC) || PLATFORM(IOS)) && ENABLE(COMPARE_AND_SWAP)
+#if !defined(ENABLE_PARALLEL_GC) && (PLATFORM(MAC) || PLATFORM(IOS) || PLATFORM(QT)) && ENABLE(COMPARE_AND_SWAP)
 #define ENABLE_PARALLEL_GC 1
 #endif
 
@@ -1141,7 +1157,7 @@
 #define WTF_USE_COREMEDIA 1
 #endif
 
-#if PLATFORM(MAC) || PLATFORM(GTK) || PLATFORM(EFL) || (PLATFORM(WIN) && !OS(WINCE) && !PLATFORM(WIN_CAIRO)) || PLATFORM(QT)
+#if PLATFORM(MAC) || PLATFORM(GTK) || PLATFORM(EFL) || (PLATFORM(WIN) && !OS(WINCE) && !PLATFORM(WIN_CAIRO)) || PLATFORM(QT) || PLATFORM(BLACKBERRY)
 #define WTF_USE_REQUEST_ANIMATION_FRAME_TIMER 1
 #endif
 
@@ -1174,4 +1190,8 @@
 #define ENABLE_TEXT_NOTIFICATIONS_ONLY 1
 #endif
 
+#if !defined(WTF_USE_WTFURL)
+#define WTF_USE_WTFURL 0
+#endif
+
 #endif /* WTF_Platform_h */
diff --git a/Source/JavaScriptCore/wtf/PlatformEfl.cmake b/Source/JavaScriptCore/wtf/PlatformEfl.cmake
index 3887ead8c..1a13dbba3 100644
--- a/Source/JavaScriptCore/wtf/PlatformEfl.cmake
+++ b/Source/JavaScriptCore/wtf/PlatformEfl.cmake
@@ -1,6 +1,8 @@
 LIST(APPEND WTF_SOURCES
     efl/MainThreadEfl.cpp
     efl/OwnPtrEfl.cpp
+    gobject/GOwnPtr.cpp
+    gobject/GRefPtr.cpp
 
     OSAllocatorPosix.cpp
     ThreadIdentifierDataPthreads.cpp
@@ -9,24 +11,9 @@ LIST(APPEND WTF_SOURCES
     unicode/icu/CollatorICU.cpp
 )
 
-IF (ENABLE_GLIB_SUPPORT)
-  LIST(APPEND WTF_SOURCES
-    gobject/GOwnPtr.cpp
-    gobject/GRefPtr.cpp
-  )
-
-  LIST(APPEND WTF_INCLUDE_DIRECTORIES
-    ${Glib_INCLUDE_DIRS}
-    ${JAVASCRIPTCORE_DIR}/wtf/gobject
-  )
-
-  LIST(APPEND WTF_LIBRARIES
-    ${Glib_LIBRARIES}
-  )
-ENDIF ()
-
 LIST(APPEND WTF_LIBRARIES
     pthread
+    ${Glib_LIBRARIES}
     ${ICU_LIBRARIES}
     ${ICU_I18N_LIBRARIES}
     ${ECORE_LIBRARIES}
@@ -46,6 +33,8 @@ LIST(APPEND WTF_INCLUDE_DIRECTORIES
     ${ECORE_INCLUDE_DIRS}
     ${ECORE_EVAS_INCLUDE_DIRS}
     ${EVAS_INCLUDE_DIRS}
+    ${Glib_INCLUDE_DIRS}
     ${ICU_INCLUDE_DIRS}
+    ${JAVASCRIPTCORE_DIR}/wtf/gobject
     ${JAVASCRIPTCORE_DIR}/wtf/unicode/
 )
diff --git a/Source/JavaScriptCore/wtf/SentinelLinkedList.h b/Source/JavaScriptCore/wtf/SentinelLinkedList.h
index ecd602452..3943aa5de 100644
--- a/Source/JavaScriptCore/wtf/SentinelLinkedList.h
+++ b/Source/JavaScriptCore/wtf/SentinelLinkedList.h
@@ -86,6 +86,8 @@ public:
 
     iterator begin();
     iterator end();
+    
+    bool isEmpty() { return begin() == end(); }
 
 private:
     RawNode m_headSentinel;
diff --git a/Source/JavaScriptCore/wtf/StdLibExtras.h b/Source/JavaScriptCore/wtf/StdLibExtras.h
index e4d7c8fc0..2a0a9f950 100644
--- a/Source/JavaScriptCore/wtf/StdLibExtras.h
+++ b/Source/JavaScriptCore/wtf/StdLibExtras.h
@@ -114,6 +114,11 @@ inline bool isPointerAligned(void* p)
     return !((intptr_t)(p) & (sizeof(char*) - 1));
 }
 
+inline bool is8ByteAligned(void* p)
+{
+    return !((uintptr_t)(p) & (sizeof(double) - 1));
+}
+
 /*
  * C++'s idea of a reinterpret_cast lacks sufficient cojones.
  */
@@ -292,6 +297,7 @@ inline void* operator new(size_t, NotNullTag, void* location)
 
 using WTF::KB;
 using WTF::isPointerAligned;
+using WTF::is8ByteAligned;
 using WTF::binarySearch;
 using WTF::bitwise_cast;
 using WTF::safeCast;
diff --git a/Source/JavaScriptCore/wtf/ThreadFunctionInvocation.h b/Source/JavaScriptCore/wtf/ThreadFunctionInvocation.h
index f1e147268..2d8599eb9 100644
--- a/Source/JavaScriptCore/wtf/ThreadFunctionInvocation.h
+++ b/Source/JavaScriptCore/wtf/ThreadFunctionInvocation.h
@@ -31,7 +31,7 @@
 
 namespace WTF {
 
-typedef void* (*ThreadFunction)(void* argument);
+typedef void (*ThreadFunction)(void* argument);
 
 struct ThreadFunctionInvocation {
     ThreadFunctionInvocation(ThreadFunction function, void* data)
diff --git a/Source/JavaScriptCore/wtf/ThreadIdentifierDataPthreads.cpp b/Source/JavaScriptCore/wtf/ThreadIdentifierDataPthreads.cpp
index b3b690f70..0badf939a 100644
--- a/Source/JavaScriptCore/wtf/ThreadIdentifierDataPthreads.cpp
+++ b/Source/JavaScriptCore/wtf/ThreadIdentifierDataPthreads.cpp
@@ -36,8 +36,8 @@
 
 #include "Threading.h"
 
-#if OS(ANDROID)
-// PTHREAD_KEYS_MAX is not defined in bionic, so explicitly define it here.
+#if OS(ANDROID) || OS(HURD)
+// PTHREAD_KEYS_MAX is not defined in bionic nor in Hurd, so explicitly define it here.
 #define PTHREAD_KEYS_MAX 1024
 #else
 #include <limits.h>
diff --git a/Source/JavaScriptCore/wtf/ThreadSpecific.h b/Source/JavaScriptCore/wtf/ThreadSpecific.h
index 242acc0d3..f20a3f3df 100644
--- a/Source/JavaScriptCore/wtf/ThreadSpecific.h
+++ b/Source/JavaScriptCore/wtf/ThreadSpecific.h
@@ -77,12 +77,11 @@ private:
     // have exited). It's unlikely that any user of this call will be in that situation - and having
     // a destructor defined can be confusing, given that it has such strong pre-requisites to work correctly.
     ~ThreadSpecific();
-    
+
     T* get();
     void set(T*);
     void static destroy(void* ptr);
 
-#if USE(PTHREADS) || PLATFORM(QT) || PLATFORM(GTK) || OS(WINDOWS)
     struct Data {
         WTF_MAKE_NONCOPYABLE(Data);
     public:
@@ -94,7 +93,6 @@ private:
         void (*destructor)(void*);
 #endif
     };
-#endif
 
 #if USE(PTHREADS)
     pthread_key_t m_key;
@@ -239,6 +237,6 @@ inline T& ThreadSpecific<T>::operator*()
     return *operator T*();
 }
 
-}
+} // namespace WTF
 
-#endif
+#endif // WTF_ThreadSpecific_h
diff --git a/Source/JavaScriptCore/wtf/Threading.cpp b/Source/JavaScriptCore/wtf/Threading.cpp
index d8dbbae4f..8d658e934 100644
--- a/Source/JavaScriptCore/wtf/Threading.cpp
+++ b/Source/JavaScriptCore/wtf/Threading.cpp
@@ -25,6 +25,8 @@
 
 #include "config.h"
 #include "Threading.h"
+#include <wtf/OwnPtr.h>
+#include <wtf/PassOwnPtr.h>
 
 #include <string.h>
 
@@ -47,7 +49,7 @@ public:
     Mutex creationMutex;
 };
 
-static void* threadEntryPoint(void* contextData)
+static void threadEntryPoint(void* contextData)
 {
     NewThreadContext* context = reinterpret_cast<NewThreadContext*>(contextData);
 
@@ -64,7 +66,7 @@ static void* threadEntryPoint(void* contextData)
     void* data = context->data;
     delete context;
 
-    return entryPoint(data);
+    entryPoint(data);
 }
 
 ThreadIdentifier createThread(ThreadFunction entryPoint, void* data, const char* name)
@@ -86,14 +88,58 @@ ThreadIdentifier createThread(ThreadFunction entryPoint, void* data, const char*
 
 #if PLATFORM(MAC) || PLATFORM(WIN)
 
+// For ABI compatibility with Safari on Mac / Windows: Safari uses the private
+// createThread() and waitForThreadCompletion() functions directly and we need
+// to keep the old ABI compatibility until it's been rebuilt.
+
+typedef void* (*ThreadFunctionWithReturnValue)(void* argument);
+
+WTF_EXPORT_PRIVATE ThreadIdentifier createThread(ThreadFunctionWithReturnValue entryPoint, void* data, const char* name);
+
+struct ThreadFunctionWithReturnValueInvocation {
+    ThreadFunctionWithReturnValueInvocation(ThreadFunctionWithReturnValue function, void* data)
+        : function(function)
+        , data(data)
+    {
+    }
+
+    ThreadFunctionWithReturnValue function;
+    void* data;
+};
+
+static void compatEntryPoint(void* param)
+{
+    // Balanced by .leakPtr() in createThread.
+    OwnPtr<ThreadFunctionWithReturnValueInvocation> invocation = adoptPtr(static_cast<ThreadFunctionWithReturnValueInvocation*>(param));
+    invocation->function(invocation->data);
+}
+
+ThreadIdentifier createThread(ThreadFunctionWithReturnValue entryPoint, void* data, const char* name)
+{
+    OwnPtr<ThreadFunctionWithReturnValueInvocation> invocation = adoptPtr(new ThreadFunctionWithReturnValueInvocation(entryPoint, data));
+
+    // Balanced by adoptPtr() in compatEntryPoint.
+    return createThread(compatEntryPoint, invocation.leakPtr(), name);
+}
+
+WTF_EXPORT_PRIVATE int waitForThreadCompletion(ThreadIdentifier, void**);
+
+int waitForThreadCompletion(ThreadIdentifier threadID, void**)
+{
+    return waitForThreadCompletion(threadID);
+}
+
 // This function is deprecated but needs to be kept around for backward
 // compatibility. Use the 3-argument version of createThread above.
 
-WTF_EXPORT_PRIVATE ThreadIdentifier createThread(ThreadFunction entryPoint, void* data);
+WTF_EXPORT_PRIVATE ThreadIdentifier createThread(ThreadFunctionWithReturnValue entryPoint, void* data);
 
-ThreadIdentifier createThread(ThreadFunction entryPoint, void* data)
+ThreadIdentifier createThread(ThreadFunctionWithReturnValue entryPoint, void* data)
 {
-    return createThread(entryPoint, data, 0);
+    OwnPtr<ThreadFunctionWithReturnValueInvocation> invocation = adoptPtr(new ThreadFunctionWithReturnValueInvocation(entryPoint, data));
+
+    // Balanced by adoptPtr() in compatEntryPoint.
+    return createThread(compatEntryPoint, invocation.leakPtr(), 0);
 }
 #endif
 
diff --git a/Source/JavaScriptCore/wtf/Threading.h b/Source/JavaScriptCore/wtf/Threading.h
index 1dee5da1c..b5d432681 100644
--- a/Source/JavaScriptCore/wtf/Threading.h
+++ b/Source/JavaScriptCore/wtf/Threading.h
@@ -78,7 +78,7 @@
 namespace WTF {
 
 typedef uint32_t ThreadIdentifier;
-typedef void* (*ThreadFunction)(void* argument);
+typedef void (*ThreadFunction)(void* argument);
 
 // This function must be called from the main thread. It is safe to call it repeatedly.
 // Darwin is an exception to this rule: it is OK to call it from any thread, the only 
@@ -97,7 +97,7 @@ ThreadIdentifier createThreadInternal(ThreadFunction, void*, const char* threadN
 void initializeCurrentThreadInternal(const char* threadName);
 
 WTF_EXPORT_PRIVATE ThreadIdentifier currentThread();
-WTF_EXPORT_PRIVATE int waitForThreadCompletion(ThreadIdentifier, void**);
+WTF_EXPORT_PRIVATE int waitForThreadCompletion(ThreadIdentifier);
 WTF_EXPORT_PRIVATE void detachThread(ThreadIdentifier);
 
 WTF_EXPORT_PRIVATE void yield();
diff --git a/Source/JavaScriptCore/wtf/ThreadingPthreads.cpp b/Source/JavaScriptCore/wtf/ThreadingPthreads.cpp
index 763ec2bbb..abd350dbb 100644
--- a/Source/JavaScriptCore/wtf/ThreadingPthreads.cpp
+++ b/Source/JavaScriptCore/wtf/ThreadingPthreads.cpp
@@ -40,9 +40,12 @@
 #include "HashMap.h"
 #include "RandomNumberSeed.h"
 #include "StdLibExtras.h"
+#include "ThreadFunctionInvocation.h"
 #include "ThreadIdentifierDataPthreads.h"
 #include "ThreadSpecific.h"
 #include "UnusedParam.h"
+#include <wtf/OwnPtr.h>
+#include <wtf/PassOwnPtr.h>
 #include <wtf/WTFThreadData.h>
 #include <errno.h>
 
@@ -152,6 +155,15 @@ void clearPthreadHandleForIdentifier(ThreadIdentifier id)
     threadMap().remove(id);
 }
 
+static void* wtfThreadEntryPoint(void* param)
+{
+    // Balanced by .leakPtr() in createThreadInternal.
+    OwnPtr<ThreadFunctionInvocation> invocation = adoptPtr(static_cast<ThreadFunctionInvocation*>(param));
+    invocation->function(invocation->data);
+
+    return 0;
+}
+
 #if PLATFORM(BLACKBERRY)
 ThreadIdentifier createThreadInternal(ThreadFunction entryPoint, void* data, const char* threadName)
 {
@@ -171,8 +183,9 @@ ThreadIdentifier createThreadInternal(ThreadFunction entryPoint, void* data, con
             LOG_ERROR("pthread_attr_getstack() failed: %d", errno);
     }
 
+    OwnPtr<ThreadFunctionInvocation> invocation = adoptPtr(new ThreadFunctionInvocation(entryPoint, data));
     pthread_t threadHandle;
-    if (pthread_create(&threadHandle, &attr, entryPoint, data)) {
+    if (pthread_create(&threadHandle, &attr, wtfThreadEntryPoint, invocation.get())) {
         LOG_ERROR("pthread_create() failed: %d", errno);
         threadHandle = 0;
     }
@@ -183,17 +196,26 @@ ThreadIdentifier createThreadInternal(ThreadFunction entryPoint, void* data, con
     if (!threadHandle)
         return 0;
 
+    // Balanced by adoptPtr() in wtfThreadEntryPoint.
+    ThreadFunctionInvocation* leakedInvocation = invocation.leakPtr();
+    UNUSED_PARAM(leakedInvocation);
+
     return establishIdentifierForPthreadHandle(threadHandle);
 }
 #else
 ThreadIdentifier createThreadInternal(ThreadFunction entryPoint, void* data, const char*)
 {
+    OwnPtr<ThreadFunctionInvocation> invocation = adoptPtr(new ThreadFunctionInvocation(entryPoint, data));
     pthread_t threadHandle;
-    if (pthread_create(&threadHandle, 0, entryPoint, data)) {
-        LOG_ERROR("Failed to create pthread at entry point %p with data %p", entryPoint, data);
+    if (pthread_create(&threadHandle, 0, wtfThreadEntryPoint, invocation.get())) {
+        LOG_ERROR("Failed to create pthread at entry point %p with data %p", wtfThreadEntryPoint, invocation.get());
         return 0;
     }
 
+    // Balanced by adoptPtr() in wtfThreadEntryPoint.
+    ThreadFunctionInvocation* leakedInvocation = invocation.leakPtr();
+    UNUSED_PARAM(leakedInvocation);
+
     return establishIdentifierForPthreadHandle(threadHandle);
 }
 #endif
@@ -217,7 +239,7 @@ void initializeCurrentThreadInternal(const char* threadName)
     ThreadIdentifierData::initialize(id);
 }
 
-int waitForThreadCompletion(ThreadIdentifier threadID, void** result)
+int waitForThreadCompletion(ThreadIdentifier threadID)
 {
     ASSERT(threadID);
 
@@ -225,7 +247,7 @@ int waitForThreadCompletion(ThreadIdentifier threadID, void** result)
     if (!pthreadHandle)
         return 0;
 
-    int joinResult = pthread_join(pthreadHandle, result);
+    int joinResult = pthread_join(pthreadHandle, 0);
     if (joinResult == EDEADLK)
         LOG_ERROR("ThreadIdentifier %u was found to be deadlocked trying to quit", threadID);
 
diff --git a/Source/JavaScriptCore/wtf/ThreadingWin.cpp b/Source/JavaScriptCore/wtf/ThreadingWin.cpp
index ac0f73f19..bc32262ce 100644
--- a/Source/JavaScriptCore/wtf/ThreadingWin.cpp
+++ b/Source/JavaScriptCore/wtf/ThreadingWin.cpp
@@ -210,14 +210,14 @@ static void clearThreadHandleForIdentifier(ThreadIdentifier id)
 static unsigned __stdcall wtfThreadEntryPoint(void* param)
 {
     OwnPtr<ThreadFunctionInvocation> invocation = adoptPtr(static_cast<ThreadFunctionInvocation*>(param));
-    void* result = invocation->function(invocation->data);
+    invocation->function(invocation->data);
 
 #if !USE(PTHREADS) && OS(WINDOWS)
     // Do the TLS cleanup.
     ThreadSpecificThreadExit();
 #endif
 
-    return reinterpret_cast<unsigned>(result);
+    return 0;
 }
 
 ThreadIdentifier createThreadInternal(ThreadFunction entryPoint, void* data, const char* threadName)
@@ -252,7 +252,7 @@ ThreadIdentifier createThreadInternal(ThreadFunction entryPoint, void* data, con
     return threadID;
 }
 
-int waitForThreadCompletion(ThreadIdentifier threadID, void** result)
+int waitForThreadCompletion(ThreadIdentifier threadID)
 {
     ASSERT(threadID);
     
diff --git a/Source/JavaScriptCore/wtf/Vector.h b/Source/JavaScriptCore/wtf/Vector.h
index 175f1a582..29bbd37d9 100644
--- a/Source/JavaScriptCore/wtf/Vector.h
+++ b/Source/JavaScriptCore/wtf/Vector.h
@@ -181,7 +181,10 @@ namespace WTF {
         static void uninitializedFill(T* dst, T* dstEnd, const T& val) 
         {
             ASSERT(sizeof(T) == sizeof(char));
-            memset(dst, val, dstEnd - dst);
+#if COMPILER(GCC) && defined(_FORTIFY_SOURCE)
+            if (!__builtin_constant_p(dstEnd - dst) || (!(dstEnd - dst)))
+#endif
+                memset(dst, val, dstEnd - dst);
         }
     };
     
diff --git a/Source/JavaScriptCore/wtf/dtoa.cpp b/Source/JavaScriptCore/wtf/dtoa.cpp
index 3732fe614..4c4041e1c 100644
--- a/Source/JavaScriptCore/wtf/dtoa.cpp
+++ b/Source/JavaScriptCore/wtf/dtoa.cpp
@@ -228,25 +228,6 @@ static void multadd(BigInt& b, int m, int a)    /* multiply by m and add a */
         b.append((uint32_t)carry);
 }
 
-static void s2b(BigInt& b, const char* s, int nd0, int nd, uint32_t y9)
-{
-    b.sign = 0;
-    b.resize(1);
-    b.words()[0] = y9;
-
-    int i = 9;
-    if (9 < nd0) {
-        s += 9;
-        do {
-            multadd(b, 10, *s++ - '0');
-        } while (++i < nd0);
-        s++;
-    } else
-        s += 10;
-    for (; i < nd; i++)
-        multadd(b, 10, *s++ - '0');
-}
-
 static int hi0bits(uint32_t x)
 {
     int k = 0;
@@ -603,57 +584,6 @@ static ALWAYS_INLINE void diff(BigInt& c, const BigInt& aRef, const BigInt& bRef
     c.resize(wa);
 }
 
-static double ulp(U *x)
-{
-    register int32_t L;
-    U u;
-
-    L = (word0(x) & Exp_mask) - (P - 1) * Exp_msk1;
-        word0(&u) = L;
-        word1(&u) = 0;
-    return dval(&u);
-}
-
-static double b2d(const BigInt& a, int* e)
-{
-    const uint32_t* xa;
-    const uint32_t* xa0;
-    uint32_t w;
-    uint32_t y;
-    uint32_t z;
-    int k;
-    U d;
-
-#define d0 word0(&d)
-#define d1 word1(&d)
-
-    xa0 = a.words();
-    xa = xa0 + a.size();
-    y = *--xa;
-    ASSERT(y);
-    k = hi0bits(y);
-    *e = 32 - k;
-    if (k < Ebits) {
-        d0 = Exp_1 | (y >> (Ebits - k));
-        w = xa > xa0 ? *--xa : 0;
-        d1 = (y << (32 - Ebits + k)) | (w >> (Ebits - k));
-        goto returnD;
-    }
-    z = xa > xa0 ? *--xa : 0;
-    if (k -= Ebits) {
-        d0 = Exp_1 | (y << k) | (z >> (32 - k));
-        y = xa > xa0 ? *--xa : 0;
-        d1 = (z << k) | (y >> (32 - k));
-    } else {
-        d0 = Exp_1 | y;
-        d1 = z;
-    }
-returnD:
-#undef d0
-#undef d1
-    return dval(&d);
-}
-
 static ALWAYS_INLINE void d2b(BigInt& b, U* d, int* e, int* bits)
 {
     int de, k;
@@ -701,23 +631,6 @@ static ALWAYS_INLINE void d2b(BigInt& b, U* d, int* e, int* bits)
 #undef d0
 #undef d1
 
-static double ratio(const BigInt& a, const BigInt& b)
-{
-    U da, db;
-    int k, ka, kb;
-
-    dval(&da) = b2d(a, &ka);
-    dval(&db) = b2d(b, &kb);
-    k = ka - kb + 32 * (a.size() - b.size());
-    if (k > 0)
-        word0(&da) += k * Exp_msk1;
-    else {
-        k = -k;
-        word0(&db) += k * Exp_msk1;
-    }
-    return dval(&da) / dval(&db);
-}
-
 static const double tens[] = {
     1e0, 1e1, 1e2, 1e3, 1e4, 1e5, 1e6, 1e7, 1e8, 1e9,
     1e10, 1e11, 1e12, 1e13, 1e14, 1e15, 1e16, 1e17, 1e18, 1e19,
@@ -735,443 +648,26 @@ static const double tinytens[] = { 1e-16, 1e-32, 1e-64, 1e-128,
 #define Scale_Bit 0x10
 #define n_bigtens 5
 
+template<AllowTrailingJunkTag allowTrailingJunk>
 double strtod(const char* s00, char** se)
 {
-    int scale;
-    int bb2, bb5, bbe, bd2, bd5, bbbits, bs2, c, dsign,
-        e, e1, esign, i, j, k, nd, nd0, nf, nz, nz0, sign;
-    const char *s, *s0, *s1;
-    double aadj, aadj1;
-    U aadj2, adj, rv, rv0;
-    int32_t L;
-    uint32_t y, z;
-    BigInt bb, bb1, bd, bd0, bs, delta;
-
-    sign = nz0 = nz = 0;
-    dval(&rv) = 0;
-    for (s = s00; ; s++) {
-        switch (*s) {
-        case '-':
-            sign = 1;
-            /* no break */
-        case '+':
-            if (*++s)
-                goto break2;
-            /* no break */
-        case 0:
-            goto ret0;
-        case '\t':
-        case '\n':
-        case '\v':
-        case '\f':
-        case '\r':
-        case ' ':
-            continue;
-        default:
-            goto break2;
-        }
-    }
-break2:
-    if (*s == '0') {
-        nz0 = 1;
-        while (*++s == '0') { }
-        if (!*s)
-            goto ret;
-    }
-    s0 = s;
-    y = z = 0;
-    for (nd = nf = 0; (c = *s) >= '0' && c <= '9'; nd++, s++)
-        if (nd < 9)
-            y = (10 * y) + c - '0';
-        else if (nd < 16)
-            z = (10 * z) + c - '0';
-    nd0 = nd;
-    if (c == '.') {
-        c = *++s;
-        if (!nd) {
-            for (; c == '0'; c = *++s)
-                nz++;
-            if (c > '0' && c <= '9') {
-                s0 = s;
-                nf += nz;
-                nz = 0;
-                goto haveDig;
-            }
-            goto digDone;
-        }
-        for (; c >= '0' && c <= '9'; c = *++s) {
-haveDig:
-            nz++;
-            if (c -= '0') {
-                nf += nz;
-                for (i = 1; i < nz; i++)
-                    if (nd++ < 9)
-                        y *= 10;
-                    else if (nd <= DBL_DIG + 1)
-                        z *= 10;
-                if (nd++ < 9)
-                    y = (10 * y) + c;
-                else if (nd <= DBL_DIG + 1)
-                    z = (10 * z) + c;
-                nz = 0;
-            }
-        }
-    }
-digDone:
-    e = 0;
-    if (c == 'e' || c == 'E') {
-        if (!nd && !nz && !nz0)
-            goto ret0;
-        s00 = s;
-        esign = 0;
-        switch (c = *++s) {
-        case '-':
-            esign = 1;
-        case '+':
-            c = *++s;
-        }
-        if (c >= '0' && c <= '9') {
-            while (c == '0')
-                c = *++s;
-            if (c > '0' && c <= '9') {
-                L = c - '0';
-                s1 = s;
-                while ((c = *++s) >= '0' && c <= '9')
-                    L = (10 * L) + c - '0';
-                if (s - s1 > 8 || L > 19999)
-                    /* Avoid confusion from exponents
-                     * so large that e might overflow.
-                     */
-                    e = 19999; /* safe for 16 bit ints */
-                else
-                    e = (int)L;
-                if (esign)
-                    e = -e;
-            } else
-                e = 0;
-        } else
-            s = s00;
-    }
-    if (!nd) {
-        if (!nz && !nz0) {
-ret0:
-            s = s00;
-            sign = 0;
-        }
-        goto ret;
-    }
-    e1 = e -= nf;
-
-    /* Now we have nd0 digits, starting at s0, followed by a
-     * decimal point, followed by nd-nd0 digits.  The number we're
-     * after is the integer represented by those digits times
-     * 10**e */
-
-    if (!nd0)
-        nd0 = nd;
-    k = nd < DBL_DIG + 1 ? nd : DBL_DIG + 1;
-    dval(&rv) = y;
-    if (k > 9)
-        dval(&rv) = tens[k - 9] * dval(&rv) + z;
-    if (nd <= DBL_DIG) {
-        if (!e)
-            goto ret;
-        if (e > 0) {
-            if (e <= Ten_pmax) {
-                /* rv = */ rounded_product(dval(&rv), tens[e]);
-                goto ret;
-            }
-            i = DBL_DIG - nd;
-            if (e <= Ten_pmax + i) {
-                /* A fancier test would sometimes let us do
-                 * this for larger i values.
-                 */
-                e -= i;
-                dval(&rv) *= tens[i];
-                /* rv = */ rounded_product(dval(&rv), tens[e]);
-                goto ret;
-            }
-        } else if (e >= -Ten_pmax) {
-            /* rv = */ rounded_quotient(dval(&rv), tens[-e]);
-            goto ret;
-        }
-    }
-    e1 += nd - k;
-
-    scale = 0;
-
-    /* Get starting approximation = rv * 10**e1 */
-
-    if (e1 > 0) {
-        if ((i = e1 & 15))
-            dval(&rv) *= tens[i];
-        if (e1 &= ~15) {
-            if (e1 > DBL_MAX_10_EXP) {
-ovfl:
-#if HAVE(ERRNO_H)
-                errno = ERANGE;
-#endif
-                /* Can't trust HUGE_VAL */
-                word0(&rv) = Exp_mask;
-                word1(&rv) = 0;
-                goto ret;
-            }
-            e1 >>= 4;
-            for (j = 0; e1 > 1; j++, e1 >>= 1)
-                if (e1 & 1)
-                    dval(&rv) *= bigtens[j];
-        /* The last multiplication could overflow. */
-            word0(&rv) -= P * Exp_msk1;
-            dval(&rv) *= bigtens[j];
-            if ((z = word0(&rv) & Exp_mask) > Exp_msk1 * (DBL_MAX_EXP + Bias - P))
-                goto ovfl;
-            if (z > Exp_msk1 * (DBL_MAX_EXP + Bias - 1 - P)) {
-                /* set to largest number */
-                /* (Can't trust DBL_MAX) */
-                word0(&rv) = Big0;
-                word1(&rv) = Big1;
-            } else
-                word0(&rv) += P * Exp_msk1;
-        }
-    } else if (e1 < 0) {
-        e1 = -e1;
-        if ((i = e1 & 15))
-            dval(&rv) /= tens[i];
-        if (e1 >>= 4) {
-            if (e1 >= 1 << n_bigtens)
-                goto undfl;
-            if (e1 & Scale_Bit)
-                scale = 2 * P;
-            for (j = 0; e1 > 0; j++, e1 >>= 1)
-                if (e1 & 1)
-                    dval(&rv) *= tinytens[j];
-            if (scale && (j = (2 * P) + 1 - ((word0(&rv) & Exp_mask) >> Exp_shift)) > 0) {
-                /* scaled rv is denormal; clear j low bits */
-                if (j >= 32) {
-                    word1(&rv) = 0;
-                    if (j >= 53)
-                        word0(&rv) = (P + 2) * Exp_msk1;
-                    else
-                        word0(&rv) &= 0xffffffff << (j - 32);
-                } else
-                    word1(&rv) &= 0xffffffff << j;
-            }
-                if (!dval(&rv)) {
-undfl:
-                    dval(&rv) = 0.;
-#if HAVE(ERRNO_H)
-                    errno = ERANGE;
-#endif
-                    goto ret;
-                }
-        }
-    }
-
-    /* Now the hard part -- adjusting rv to the correct value.*/
-
-    /* Put digits into bd: true value = bd * 10^e */
-
-    s2b(bd0, s0, nd0, nd, y);
-
-    for (;;) {
-        bd = bd0;
-        d2b(bb, &rv, &bbe, &bbbits);    /* rv = bb * 2^bbe */
-        i2b(bs, 1);
-
-        if (e >= 0) {
-            bb2 = bb5 = 0;
-            bd2 = bd5 = e;
-        } else {
-            bb2 = bb5 = -e;
-            bd2 = bd5 = 0;
-        }
-        if (bbe >= 0)
-            bb2 += bbe;
-        else
-            bd2 -= bbe;
-        bs2 = bb2;
-        j = bbe - scale;
-        i = j + bbbits - 1;    /* logb(rv) */
-        if (i < Emin)    /* denormal */
-            j += P - Emin;
-        else
-            j = P + 1 - bbbits;
-        bb2 += j;
-        bd2 += j;
-        bd2 += scale;
-        i = bb2 < bd2 ? bb2 : bd2;
-        if (i > bs2)
-            i = bs2;
-        if (i > 0) {
-            bb2 -= i;
-            bd2 -= i;
-            bs2 -= i;
-        }
-        if (bb5 > 0) {
-            pow5mult(bs, bb5);
-            mult(bb, bs);
-        }
-        if (bb2 > 0)
-            lshift(bb, bb2);
-        if (bd5 > 0)
-            pow5mult(bd, bd5);
-        if (bd2 > 0)
-            lshift(bd, bd2);
-        if (bs2 > 0)
-            lshift(bs, bs2);
-        diff(delta, bb, bd);
-        dsign = delta.sign;
-        delta.sign = 0;
-        i = cmp(delta, bs);
-
-        if (i < 0) {
-            /* Error is less than half an ulp -- check for
-             * special case of mantissa a power of two.
-             */
-            if (dsign || word1(&rv) || word0(&rv) & Bndry_mask
-             || (word0(&rv) & Exp_mask) <= (2 * P + 1) * Exp_msk1
-                ) {
-                break;
-            }
-            if (!delta.words()[0] && delta.size() <= 1) {
-                /* exact result */
-                break;
-            }
-            lshift(delta, Log2P);
-            if (cmp(delta, bs) > 0)
-                goto dropDown;
-            break;
-        }
-        if (!i) {
-            /* exactly half-way between */
-            if (dsign) {
-                if ((word0(&rv) & Bndry_mask1) == Bndry_mask1
-                 &&  word1(&rv) == (
-            (scale && (y = word0(&rv) & Exp_mask) <= 2 * P * Exp_msk1)
-        ? (0xffffffff & (0xffffffff << (2 * P + 1 - (y >> Exp_shift)))) :
-                           0xffffffff)) {
-                    /*boundary case -- increment exponent*/
-                    word0(&rv) = (word0(&rv) & Exp_mask) + Exp_msk1;
-                    word1(&rv) = 0;
-                    dsign = 0;
-                    break;
-                }
-            } else if (!(word0(&rv) & Bndry_mask) && !word1(&rv)) {
-dropDown:
-                /* boundary case -- decrement exponent */
-                if (scale) {
-                    L = word0(&rv) & Exp_mask;
-                    if (L <= (2 * P + 1) * Exp_msk1) {
-                        if (L > (P + 2) * Exp_msk1)
-                            /* round even ==> */
-                            /* accept rv */
-                            break;
-                        /* rv = smallest denormal */
-                        goto undfl;
-                    }
-                }
-                L = (word0(&rv) & Exp_mask) - Exp_msk1;
-                word0(&rv) = L | Bndry_mask1;
-                word1(&rv) = 0xffffffff;
-                break;
-            }
-            if (!(word1(&rv) & LSB))
-                break;
-            if (dsign)
-                dval(&rv) += ulp(&rv);
-            else {
-                dval(&rv) -= ulp(&rv);
-                if (!dval(&rv))
-                    goto undfl;
-            }
-            dsign = 1 - dsign;
-            break;
-        }
-        if ((aadj = ratio(delta, bs)) <= 2.) {
-            if (dsign)
-                aadj = aadj1 = 1.;
-            else if (word1(&rv) || word0(&rv) & Bndry_mask) {
-                if (word1(&rv) == Tiny1 && !word0(&rv))
-                    goto undfl;
-                aadj = 1.;
-                aadj1 = -1.;
-            } else {
-                /* special case -- power of FLT_RADIX to be */
-                /* rounded down... */
-
-                if (aadj < 2. / FLT_RADIX)
-                    aadj = 1. / FLT_RADIX;
-                else
-                    aadj *= 0.5;
-                aadj1 = -aadj;
-            }
-        } else {
-            aadj *= 0.5;
-            aadj1 = dsign ? aadj : -aadj;
-        }
-        y = word0(&rv) & Exp_mask;
-
-        /* Check for overflow */
-
-        if (y == Exp_msk1 * (DBL_MAX_EXP + Bias - 1)) {
-            dval(&rv0) = dval(&rv);
-            word0(&rv) -= P * Exp_msk1;
-            adj.d = aadj1 * ulp(&rv);
-            dval(&rv) += adj.d;
-            if ((word0(&rv) & Exp_mask) >= Exp_msk1 * (DBL_MAX_EXP + Bias - P)) {
-                if (word0(&rv0) == Big0 && word1(&rv0) == Big1)
-                    goto ovfl;
-                word0(&rv) = Big0;
-                word1(&rv) = Big1;
-                goto cont;
-            }
-            word0(&rv) += P * Exp_msk1;
-        } else {
-            if (scale && y <= 2 * P * Exp_msk1) {
-                if (aadj <= 0x7fffffff) {
-                    if ((z = (uint32_t)aadj) <= 0)
-                        z = 1;
-                    aadj = z;
-                    aadj1 = dsign ? aadj : -aadj;
-                }
-                dval(&aadj2) = aadj1;
-                word0(&aadj2) += (2 * P + 1) * Exp_msk1 - y;
-                aadj1 = dval(&aadj2);
-            }
-            adj.d = aadj1 * ulp(&rv);
-            dval(&rv) += adj.d;
-        }
-        z = word0(&rv) & Exp_mask;
-        if (!scale && y == z) {
-            /* Can we stop now? */
-            L = (int32_t)aadj;
-            aadj -= L;
-            /* The tolerances below are conservative. */
-            if (dsign || word1(&rv) || word0(&rv) & Bndry_mask) {
-                if (aadj < .4999999 || aadj > .5000001)
-                    break;
-            } else if (aadj < .4999999 / FLT_RADIX)
-                break;
-        }
-cont:
-        {}
-    }
-    if (scale) {
-        word0(&rv0) = Exp_1 - 2 * P * Exp_msk1;
-        word1(&rv0) = 0;
-        dval(&rv) *= dval(&rv0);
-#if HAVE(ERRNO_H)
-        /* try to avoid the bug of testing an 8087 register value */
-        if (!word0(&rv) && !word1(&rv))
-            errno = ERANGE;
-#endif
-    }
-ret:
+    int length = strlen(s00);
+    double_conversion::StringToDoubleConverter converter(
+        (allowTrailingJunk ? double_conversion::StringToDoubleConverter::ALLOW_TRAILING_JUNK : 0) |
+        double_conversion::StringToDoubleConverter::ALLOW_LEADING_SPACES,
+        0.0, 
+        (allowTrailingJunk ? std::numeric_limits<double>::quiet_NaN() : 0.0), 
+        "Infinity", "NaN");
+    int processedCharacterCount = 0;
+    double result = converter.StringToDouble(s00, length, &processedCharacterCount);
     if (se)
-        *se = const_cast<char*>(s);
-    return sign ? -dval(&rv) : dval(&rv);
+        *se = const_cast<char*>(s00 + processedCharacterCount);
+    return result;
 }
 
+template double strtod<AllowTrailingJunk>(const char*, char**);
+template double strtod<DisallowTrailingJunk>(const char*, char**);
+
 static ALWAYS_INLINE int quorem(BigInt& b, BigInt& S)
 {
     size_t n;
diff --git a/Source/JavaScriptCore/wtf/dtoa.h b/Source/JavaScriptCore/wtf/dtoa.h
index d27c59206..a4672c07a 100644
--- a/Source/JavaScriptCore/wtf/dtoa.h
+++ b/Source/JavaScriptCore/wtf/dtoa.h
@@ -35,9 +35,12 @@ WTF_EXPORT_PRIVATE void dtoa(DtoaBuffer result, double dd, bool& sign, int& expo
 WTF_EXPORT_PRIVATE void dtoaRoundSF(DtoaBuffer result, double dd, int ndigits, bool& sign, int& exponent, unsigned& precision);
 WTF_EXPORT_PRIVATE void dtoaRoundDP(DtoaBuffer result, double dd, int ndigits, bool& sign, int& exponent, unsigned& precision);
 
+enum AllowTrailingJunkTag { DisallowTrailingJunk = 0, AllowTrailingJunk };
+
 // s00: input string. Must not be 0 and must be terminated by 0.
 // se: *se will have the last consumed character position + 1.
-WTF_EXPORT_PRIVATE double strtod(const char* s00, char** se);
+template<AllowTrailingJunkTag allowTrailingJunk>
+double strtod(const char* s00, char** se);
 
 // Size = 80 for sizeof(DtoaBuffer) + some sign bits, decimal point, 'e', exponent digits.
 const unsigned NumberToStringBufferLength = 96;
diff --git a/Source/JavaScriptCore/wtf/dtoa/utils.h b/Source/JavaScriptCore/wtf/dtoa/utils.h
index d5cfe9c29..64e5ad42f 100644
--- a/Source/JavaScriptCore/wtf/dtoa/utils.h
+++ b/Source/JavaScriptCore/wtf/dtoa/utils.h
@@ -49,7 +49,7 @@
 defined(__ARMEL__) || \
 defined(_MIPS_ARCH_MIPS32R2)
 #define DOUBLE_CONVERSION_CORRECT_DOUBLE_OPERATIONS 1
-#elif CPU(MIPS) || CPU(PPC) || CPU(PPC64) || OS(WINCE) || CPU(SH4) || CPU(S390) || CPU(S390X)
+#elif CPU(MIPS) || CPU(PPC) || CPU(PPC64) || OS(WINCE) || CPU(SH4) || CPU(S390) || CPU(S390X) || CPU(IA64) || CPU(SPARC) || CPU(ALPHA)
 #define DOUBLE_CONVERSION_CORRECT_DOUBLE_OPERATIONS 1
 #elif defined(_M_IX86) || defined(__i386__)
 #if defined(_WIN32)
diff --git a/Source/JavaScriptCore/wtf/gobject/GOwnPtr.cpp b/Source/JavaScriptCore/wtf/gobject/GOwnPtr.cpp
index c727956ce..dfe187d78 100644
--- a/Source/JavaScriptCore/wtf/gobject/GOwnPtr.cpp
+++ b/Source/JavaScriptCore/wtf/gobject/GOwnPtr.cpp
@@ -37,6 +37,11 @@ template <> void freeOwnedGPtr<GList>(GList* ptr)
     g_list_free(ptr);
 }
 
+template <> void freeOwnedGPtr<GSList>(GSList* ptr)
+{
+    g_slist_free(ptr);
+}
+
 template <> void freeOwnedGPtr<GPatternSpec>(GPatternSpec* ptr)
 {
     if (ptr)
diff --git a/Source/JavaScriptCore/wtf/gobject/GOwnPtr.h b/Source/JavaScriptCore/wtf/gobject/GOwnPtr.h
index 221971f97..4b2dcb77b 100644
--- a/Source/JavaScriptCore/wtf/gobject/GOwnPtr.h
+++ b/Source/JavaScriptCore/wtf/gobject/GOwnPtr.h
@@ -35,6 +35,7 @@ namespace WTF {
 template <typename T> inline void freeOwnedGPtr(T* ptr);
 template<> void freeOwnedGPtr<GError>(GError*);
 template<> void freeOwnedGPtr<GList>(GList*);
+template<> void freeOwnedGPtr<GSList>(GSList*);
 template<> void freeOwnedGPtr<GPatternSpec>(GPatternSpec*);
 template<> void freeOwnedGPtr<GDir>(GDir*);
 template<> void freeOwnedGPtr<GTimer>(GTimer*);
diff --git a/Source/JavaScriptCore/wtf/gobject/GTypedefs.h b/Source/JavaScriptCore/wtf/gobject/GTypedefs.h
index e2b2ba6b8..cb3842b78 100644
--- a/Source/JavaScriptCore/wtf/gobject/GTypedefs.h
+++ b/Source/JavaScriptCore/wtf/gobject/GTypedefs.h
@@ -53,6 +53,7 @@ typedef struct _GInputStream GInputStream;
 typedef struct _GList GList;
 typedef struct _GPatternSpec GPatternSpec;
 typedef struct _GPollableOutputStream GPollableOutputStream;
+typedef struct _GSList GSList;
 typedef struct _GSocketClient GSocketClient;
 typedef struct _GSocketConnection GSocketConnection;
 typedef struct _GSource GSource;
diff --git a/Source/JavaScriptCore/wtf/mac/MainThreadMac.mm b/Source/JavaScriptCore/wtf/mac/MainThreadMac.mm
index fbc625032..5a82f40a6 100644
--- a/Source/JavaScriptCore/wtf/mac/MainThreadMac.mm
+++ b/Source/JavaScriptCore/wtf/mac/MainThreadMac.mm
@@ -35,7 +35,6 @@
 #import <wtf/Assertions.h>
 #import <wtf/HashSet.h>
 #import <wtf/Threading.h>
-#import <wtf/ThreadSpecific.h>
 
 @interface JSWTFMainThreadCaller : NSObject {
 }
@@ -59,17 +58,6 @@ static bool mainThreadEstablishedAsPthreadMain;
 static pthread_t mainThreadPthread;
 static NSThread* mainThreadNSThread;
 
-#if ENABLE(PARALLEL_GC)
-static ThreadSpecific<bool>* isGCThread;
-
-static void initializeGCThreads()
-{
-    isGCThread = new ThreadSpecific<bool>();
-}
-#else
-static void initializeGCThreads() { }
-#endif
-
 void initializeMainThreadPlatform()
 {
     ASSERT(!staticMainThreadCaller);
@@ -145,31 +133,4 @@ bool isMainThread()
     return pthread_equal(pthread_self(), mainThreadPthread);
 }
 
-#if ENABLE(PARALLEL_GC)
-void registerGCThread()
-{
-    if (!isGCThread) {
-        // This happens if we're running in a process that doesn't care about
-        // MainThread.
-        return;
-    }
-
-    **isGCThread = true;
-}
-
-bool isMainThreadOrGCThread()
-{
-    if (isGCThread->isSet() && **isGCThread)
-        return true;
-    
-    return isMainThread();
-}
-#else
-// This is necessary because JavaScriptCore.exp doesn't support preprocessor macros.
-bool isMainThreadOrGCThread()
-{
-    return isMainThread();
-}
-#endif
-
 } // namespace WTF
diff --git a/Source/JavaScriptCore/wtf/text/StringImpl.h b/Source/JavaScriptCore/wtf/text/StringImpl.h
index 3862effb6..667335b86 100644
--- a/Source/JavaScriptCore/wtf/text/StringImpl.h
+++ b/Source/JavaScriptCore/wtf/text/StringImpl.h
@@ -43,6 +43,8 @@ typedef const struct __CFString * CFStringRef;
 // Landing the file moves in one patch, will follow on with patches to change the namespaces.
 namespace JSC {
 struct IdentifierCStringTranslator;
+namespace LLInt { class Data; }
+class LLIntOffsetsExtractor;
 template <typename T> struct IdentifierCharBufferTranslator;
 struct IdentifierLCharFromUCharTranslator;
 }
@@ -72,7 +74,9 @@ class StringImpl {
     friend struct WTF::SubstringTranslator;
     friend struct WTF::UCharBufferTranslator;
     friend class AtomicStringImpl;
-
+    friend class JSC::LLInt::Data;
+    friend class JSC::LLIntOffsetsExtractor;
+    
 private:
     enum BufferOwnership {
         BufferInternal,
@@ -735,7 +739,7 @@ bool equalIgnoringNullity(const Vector<UChar, inlineCapacity>& a, StringImpl* b)
         return !a.size();
     if (a.size() != b->length())
         return false;
-    return !memcmp(a.data(), b->characters(), b->length());
+    return !memcmp(a.data(), b->characters(), b->length() * sizeof(UChar));
 }
 
 WTF_EXPORT_PRIVATE int codePointCompare(const StringImpl*, const StringImpl*);
diff --git a/Source/JavaScriptCore/wtf/text/WTFString.cpp b/Source/JavaScriptCore/wtf/text/WTFString.cpp
index df74c65af..04c970a7c 100644
--- a/Source/JavaScriptCore/wtf/text/WTFString.cpp
+++ b/Source/JavaScriptCore/wtf/text/WTFString.cpp
@@ -24,6 +24,8 @@
 
 #include <stdarg.h>
 #include <wtf/ASCIICType.h>
+#include <wtf/DataLog.h>
+#include <wtf/MathExtras.h>
 #include <wtf/text/CString.h>
 #include <wtf/StringExtras.h>
 #include <wtf/Vector.h>
@@ -1034,7 +1036,7 @@ intptr_t charactersToIntPtr(const UChar* data, size_t length, bool* ok)
     return toIntegralType<intptr_t, UChar>(data, lengthOfCharactersAsInteger<UChar>(data, length), ok, 10);
 }
 
-template <typename CharType>
+template <typename CharType, WTF::AllowTrailingJunkTag allowTrailingJunk>
 static inline double toDoubleType(const CharType* data, size_t length, bool* ok, bool* didReadNumber)
 {
     if (!length) {
@@ -1051,9 +1053,9 @@ static inline double toDoubleType(const CharType* data, size_t length, bool* ok,
     bytes[length] = '\0';
     char* start = bytes.data();
     char* end;
-    double val = WTF::strtod(start, &end);
+    double val = WTF::strtod<allowTrailingJunk>(start, &end);
     if (ok)
-        *ok = (end == 0 || *end == '\0');
+        *ok = (end == 0 || *end == '\0') && !isnan(val);
     if (didReadNumber)
         *didReadNumber = end - start;
     return val;
@@ -1061,24 +1063,36 @@ static inline double toDoubleType(const CharType* data, size_t length, bool* ok,
 
 double charactersToDouble(const LChar* data, size_t length, bool* ok, bool* didReadNumber)
 {
-    return toDoubleType<LChar>(data, length, ok, didReadNumber);
+    return toDoubleType<LChar, WTF::DisallowTrailingJunk>(data, length, ok, didReadNumber);
 }
 
 double charactersToDouble(const UChar* data, size_t length, bool* ok, bool* didReadNumber)
 {
-    return toDoubleType<UChar>(data, length, ok, didReadNumber);
+    return toDoubleType<UChar, WTF::DisallowTrailingJunk>(data, length, ok, didReadNumber);
 }
 
 float charactersToFloat(const LChar* data, size_t length, bool* ok, bool* didReadNumber)
 {
     // FIXME: This will return ok even when the string fits into a double but not a float.
-    return static_cast<float>(toDoubleType<LChar>(data, length, ok, didReadNumber));
+    return static_cast<float>(toDoubleType<LChar, WTF::DisallowTrailingJunk>(data, length, ok, didReadNumber));
 }
 
 float charactersToFloat(const UChar* data, size_t length, bool* ok, bool* didReadNumber)
 {
     // FIXME: This will return ok even when the string fits into a double but not a float.
-    return static_cast<float>(toDoubleType<UChar>(data, length, ok, didReadNumber));
+    return static_cast<float>(toDoubleType<UChar, WTF::DisallowTrailingJunk>(data, length, ok, didReadNumber));
+}
+
+float charactersToFloatIgnoringJunk(const LChar* data, size_t length, bool* ok, bool* didReadNumber)
+{
+    // FIXME: This will return ok even when the string fits into a double but not a float.
+    return static_cast<float>(toDoubleType<LChar, WTF::AllowTrailingJunk>(data, length, ok, didReadNumber));
+}
+
+float charactersToFloatIgnoringJunk(const UChar* data, size_t length, bool* ok, bool* didReadNumber)
+{
+    // FIXME: This will return ok even when the string fits into a double but not a float.
+    return static_cast<float>(toDoubleType<UChar, WTF::AllowTrailingJunk>(data, length, ok, didReadNumber));
 }
 
 const String& emptyString()
@@ -1097,7 +1111,7 @@ Vector<char> asciiDebug(String& string);
 
 void String::show() const
 {
-    fprintf(stderr, "%s\n", asciiDebug(impl()).data());
+    dataLog("%s\n", asciiDebug(impl()).data());
 }
 
 String* string(const char* s)
diff --git a/Source/JavaScriptCore/wtf/text/WTFString.h b/Source/JavaScriptCore/wtf/text/WTFString.h
index 2d32e6916..edc842154 100644
--- a/Source/JavaScriptCore/wtf/text/WTFString.h
+++ b/Source/JavaScriptCore/wtf/text/WTFString.h
@@ -87,7 +87,9 @@ intptr_t charactersToIntPtr(const UChar*, size_t, bool* ok = 0); // ignores trai
 WTF_EXPORT_PRIVATE double charactersToDouble(const LChar*, size_t, bool* ok = 0, bool* didReadNumber = 0);
 WTF_EXPORT_PRIVATE double charactersToDouble(const UChar*, size_t, bool* ok = 0, bool* didReadNumber = 0);
 float charactersToFloat(const LChar*, size_t, bool* ok = 0, bool* didReadNumber = 0);
+WTF_EXPORT_PRIVATE float charactersToFloatIgnoringJunk(const LChar*, size_t, bool* ok = 0, bool* didReadNumber = 0);
 WTF_EXPORT_PRIVATE float charactersToFloat(const UChar*, size_t, bool* ok = 0, bool* didReadNumber = 0);
+WTF_EXPORT_PRIVATE float charactersToFloatIgnoringJunk(const UChar*, size_t, bool* ok = 0, bool* didReadNumber = 0);
 
 enum FloatConversionFlags {
     ShouldRoundSignificantFigures = 1 << 0,
diff --git a/Source/JavaScriptCore/wtf/url/api/ParsedURL.cpp b/Source/JavaScriptCore/wtf/url/api/ParsedURL.cpp
new file mode 100644
index 000000000..3c1519136
--- /dev/null
+++ b/Source/JavaScriptCore/wtf/url/api/ParsedURL.cpp
@@ -0,0 +1,94 @@
+/*
+ * Copyright (C) 2010 Google, Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "ParsedURL.h"
+
+#if USE(WTFURL)
+
+#include "URLComponent.h"
+#include "URLParser.h"
+
+namespace WTF {
+
+ParsedURL::ParsedURL(const URLString& spec)
+    : m_spec(spec)
+{
+    // FIXME: Handle non-standard URLs.
+    if (spec.string().isEmpty())
+        return;
+    URLParser<UChar>::parseStandardURL(spec.string().characters(), spec.string().length(), m_segments);
+}
+
+String ParsedURL::scheme() const
+{
+    return segment(m_segments.scheme);
+}
+
+String ParsedURL::username() const
+{
+    return segment(m_segments.username);
+}
+
+String ParsedURL::password() const
+{
+    return segment(m_segments.password);
+}
+
+String ParsedURL::host() const
+{
+    return segment(m_segments.host);
+}
+
+String ParsedURL::port() const
+{
+    return segment(m_segments.port);
+}
+
+String ParsedURL::path() const
+{
+    return segment(m_segments.path);
+}
+
+String ParsedURL::query() const
+{
+    return segment(m_segments.query);
+}
+
+String ParsedURL::fragment() const
+{
+    return segment(m_segments.fragment);
+}
+
+String ParsedURL::segment(const URLComponent& component) const
+{
+    if (!component.isValid())
+        return String();
+    return m_spec.string().substring(component.begin(), component.length());
+}
+
+}
+
+#endif // USE(WTFURL)
diff --git a/Source/JavaScriptCore/wtf/url/api/ParsedURL.h b/Source/JavaScriptCore/wtf/url/api/ParsedURL.h
new file mode 100644
index 000000000..023589564
--- /dev/null
+++ b/Source/JavaScriptCore/wtf/url/api/ParsedURL.h
@@ -0,0 +1,66 @@
+/*
+ * Copyright (C) 2010 Google, Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef ParsedURL_h
+#define ParsedURL_h
+
+#if USE(WTFURL)
+
+#include "URLSegments.h"
+#include "URLString.h"
+
+namespace WTF {
+
+class URLComponent;
+
+class ParsedURL {
+public:
+    explicit ParsedURL(const URLString&);
+
+    // FIXME: Add a method for parsing non-canonicalized URLs.
+
+    String scheme() const;
+    String username() const;
+    String password() const;
+    String host() const;
+    String port() const;
+    String path() const;
+    String query() const;
+    String fragment() const;
+
+    URLString spec() { return m_spec; }
+
+private:
+    inline String segment(const URLComponent&) const;
+
+    URLString m_spec;
+    URLSegments m_segments;
+};
+
+}
+
+#endif // USE(WTFURL)
+
+#endif
diff --git a/Source/WebCore/platform/URLString.h b/Source/JavaScriptCore/wtf/url/api/URLString.h
index 78e4b33ed..329f51e2f 100644
--- a/Source/WebCore/platform/URLString.h
+++ b/Source/JavaScriptCore/wtf/url/api/URLString.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2011 Google, Inc. All rights reserved.
+ * Copyright (C) 2010 Google, Inc. All Rights Reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -10,43 +10,50 @@
  *    notice, this list of conditions and the following disclaimer in the
  *    documentation and/or other materials provided with the distribution.
  *
- * THIS SOFTWARE IS PROVIDED BY GOOGLE, INC. ``AS IS'' AND ANY
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
  * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
  * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
  * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
  * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
  * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
  * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
 #ifndef URLString_h
 #define URLString_h
 
-#include <wtf/text/WTFString.h>
+#if USE(WTFURL)
 
-namespace WebCore {
+#include "WTFString.h"
 
-class KURL;
+namespace WTF {
 
+// URLString represents a string that's a canonicalized URL.
 class URLString {
 public:
-    const String& string() const { return m_string; }
+    URLString() { }
+
+    const String& string() const { return m_string;}
 
 private:
-    friend class KURL;
+    friend class ParsedURL;
 
+    // URLString can only be constructed by a ParsedURL.
     explicit URLString(const String& string)
         : m_string(string)
     {
     }
-    
+
     String m_string;
 };
 
 }
 
+#endif // USE(WTFURL)
+
 #endif
+
diff --git a/Source/JavaScriptCore/wtf/url/src/RawURLBuffer.h b/Source/JavaScriptCore/wtf/url/src/RawURLBuffer.h
new file mode 100644
index 000000000..59a7f18af
--- /dev/null
+++ b/Source/JavaScriptCore/wtf/url/src/RawURLBuffer.h
@@ -0,0 +1,74 @@
+// Copyright 2010, Google Inc. All rights reserved.
+//
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following disclaimer
+// in the documentation and/or other materials provided with the
+// distribution.
+//     * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived from
+// this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+#ifndef RawURLBuffer_h
+#define RawURLBuffer_h
+
+#if USE(WTFURL)
+
+#include "URLBuffer.h"
+
+namespace WTF {
+
+// Simple implementation of the URLBuffer using new[]. This class
+// also supports a static buffer so if it is allocated on the stack, most
+// URLs can be canonicalized with no heap allocations.
+template<typename CharacterType, int inlineCapacity = 1024>
+class RawURLBuffer : public URLBuffer<CharacterType> {
+public:
+    RawURLBuffer() : URLBuffer<CharacterType>()
+    {
+        this->m_buffer = m_inlineBuffer;
+        this->m_capacity = inlineCapacity;
+    }
+
+    virtual ~RawURLBuffer()
+    {
+        if (this->m_buffer != m_inlineBuffer)
+            delete[] this->m_buffer;
+    }
+
+    virtual void resize(int size)
+    {
+        CharacterType* newBuffer = new CharacterType[size];
+        memcpy(newBuffer, this->m_buffer, sizeof(CharacterType) * (this->m_length < size ? this->m_length : size));
+        if (this->m_buffer != m_inlineBuffer)
+            delete[] this->m_buffer;
+        this->m_buffer = newBuffer;
+        this->m_capacity = size;
+    }
+
+protected:
+    CharacterType m_inlineBuffer[inlineCapacity];
+};
+
+} // namespace WTF
+
+#endif // USE(WTFURL)
+
+#endif // RawURLBuffer_h
diff --git a/Source/JavaScriptCore/wtf/url/src/URLBuffer.h b/Source/JavaScriptCore/wtf/url/src/URLBuffer.h
new file mode 100644
index 000000000..84a4f85c2
--- /dev/null
+++ b/Source/JavaScriptCore/wtf/url/src/URLBuffer.h
@@ -0,0 +1,140 @@
+// Copyright 2010, Google Inc. All rights reserved.
+//
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following disclaimer
+// in the documentation and/or other materials provided with the
+// distribution.
+//     * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived from
+// this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+#ifndef URLBuffer_h
+#define URLBuffer_h
+
+#if USE(WTFURL)
+
+namespace WTF {
+
+// Base class for the canonicalizer output, this maintains a buffer and
+// supports simple resizing and append operations on it.
+//
+// It is VERY IMPORTANT that no virtual function calls be made on the common
+// code path. We only have two virtual function calls, the destructor and a
+// resize function that is called when the existing buffer is not big enough.
+// The derived class is then in charge of setting up our buffer which we will
+// manage.
+template<typename CharacterType>
+class URLBuffer {
+public:
+    URLBuffer() : m_buffer(0), m_capacity(0), m_length(0) { }
+    virtual ~URLBuffer() { }
+
+    // Implemented to resize the buffer. This function should update the buffer
+    // pointer to point to the new buffer, and any old data up to |m_length| in
+    // the buffer must be copied over.
+    //
+    // The new size must be larger than m_capacity.
+    virtual void resize(int) = 0;
+
+    inline char at(int offset) const { return m_buffer[offset]; }
+    inline void set(int offset, CharacterType ch)
+    {
+        // FIXME: Add ASSERT(offset < length());
+        m_buffer[offset] = ch;
+    }
+
+    // Returns the current capacity of the buffer. The length() is the number of
+    // characters that have been declared to be written, but the capacity() is
+    // the number that can be written without reallocation. If the caller must
+    // write many characters at once, it can make sure there is enough capacity,
+    // write the data, then use setLength() to declare the new length().
+    int capacity() const { return m_capacity; }
+    int length() const { return m_length; }
+
+    // The output will NOT be 0-terminated. Call length() to get the length.
+    const CharacterType* data() const { return m_buffer; }
+    CharacterType* data() { return m_buffer; }
+
+    // Shortens the URL to the new length. Used for "backing up" when processing
+    // relative paths. This can also be used if an external function writes a lot
+    // of data to the buffer (when using the "Raw" version below) beyond the end,
+    // to declare the new length.
+    void setLength(int length)
+    {
+        // FIXME: Add ASSERT(length < capacity());
+        m_length = length;
+    }
+
+    // This is the most performance critical function, since it is called for
+    // every character.
+    void append(CharacterType ch)
+    {
+        // In VC2005, putting this common case first speeds up execution
+        // dramatically because this branch is predicted as taken.
+        if (m_length < m_capacity) {
+            m_buffer[m_length] = ch;
+            ++m_length;
+            return;
+        }
+
+        if (!grow(1))
+            return;
+
+        m_buffer[m_length] = ch;
+        ++m_length;
+    }
+
+    void append(const CharacterType* str, int strLength)
+    {
+        if (m_length + strLength > m_capacity) {
+            if (!grow(m_length + strLength - m_capacity))
+                return;
+        }
+        for (int i = 0; i < strLength; i++)
+            m_buffer[m_length + i] = str[i];
+        m_length += strLength;
+    }
+
+protected:
+    // Returns true if the buffer could be resized, false on OOM.
+    bool grow(int minimumAdditionalCapacity)
+    {
+        static const int minimumCapacity = 16;
+        int newCapacity = m_capacity ? m_capacity : minimumCapacity;
+        do {
+            if (newCapacity >= (1 << 30)) // Prevent overflow below.
+                return false;
+            newCapacity *= 2;
+        } while (newCapacity < m_capacity + minimumAdditionalCapacity);
+        resize(newCapacity);
+        return true;
+    }
+
+    CharacterType* m_buffer;
+    int m_capacity;
+    int m_length; // Used characters in the buffer.
+};
+
+} // namespace WTF
+
+#endif // USE(WTFURL)
+
+#endif // URLBuffer_h
diff --git a/Source/JavaScriptCore/wtf/url/src/URLCharacterTypes.cpp b/Source/JavaScriptCore/wtf/url/src/URLCharacterTypes.cpp
new file mode 100644
index 000000000..f56e7207c
--- /dev/null
+++ b/Source/JavaScriptCore/wtf/url/src/URLCharacterTypes.cpp
@@ -0,0 +1,177 @@
+// Copyright 2010, Google Inc. All rights reserved.
+//
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following disclaimer
+// in the documentation and/or other materials provided with the
+// distribution.
+//     * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived from
+// this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+#include "config.h"
+#include "URLCharacterTypes.h"
+
+#if USE(WTFURL)
+
+namespace WTF {
+
+const unsigned char URLCharacterTypes::characterTypeTable[0x100] = {
+    InvalidCharacter, InvalidCharacter, InvalidCharacter, InvalidCharacter,
+    InvalidCharacter, InvalidCharacter, InvalidCharacter, InvalidCharacter,
+    InvalidCharacter, InvalidCharacter, InvalidCharacter, InvalidCharacter,
+    InvalidCharacter, InvalidCharacter, InvalidCharacter, InvalidCharacter, // 0x00 - 0x0f
+    InvalidCharacter, InvalidCharacter, InvalidCharacter, InvalidCharacter,
+    InvalidCharacter, InvalidCharacter, InvalidCharacter, InvalidCharacter,
+    InvalidCharacter, InvalidCharacter, InvalidCharacter, InvalidCharacter,
+    InvalidCharacter, InvalidCharacter, InvalidCharacter, InvalidCharacter, // 0x10 - 0x1f
+    InvalidCharacter, // 0x20  ' ' (escape spaces in queries)
+    QueryCharacter | UserInfoCharacter, // 0x21  !
+    InvalidCharacter, // 0x22  "
+    InvalidCharacter, // 0x23  #  (invalid in query since it marks the ref)
+    QueryCharacter | UserInfoCharacter, // 0x24  $
+    QueryCharacter | UserInfoCharacter, // 0x25  %
+    QueryCharacter | UserInfoCharacter, // 0x26  &
+    QueryCharacter | UserInfoCharacter, // 0x27  '
+    QueryCharacter | UserInfoCharacter, // 0x28  (
+    QueryCharacter | UserInfoCharacter, // 0x29  )
+    QueryCharacter | UserInfoCharacter, // 0x2a  *
+    QueryCharacter | UserInfoCharacter, // 0x2b  +
+    QueryCharacter | UserInfoCharacter, // 0x2c  ,
+    QueryCharacter | UserInfoCharacter, // 0x2d  -
+    QueryCharacter | UserInfoCharacter | IPv4Character, // 0x2e  .
+    QueryCharacter, // 0x2f  /
+    QueryCharacter | UserInfoCharacter | IPv4Character | HexCharacter | DecimalCharacter | OctalCharacter, // 0x30  0
+    QueryCharacter | UserInfoCharacter | IPv4Character | HexCharacter | DecimalCharacter | OctalCharacter, // 0x31  1
+    QueryCharacter | UserInfoCharacter | IPv4Character | HexCharacter | DecimalCharacter | OctalCharacter, // 0x32  2
+    QueryCharacter | UserInfoCharacter | IPv4Character | HexCharacter | DecimalCharacter | OctalCharacter, // 0x33  3
+    QueryCharacter | UserInfoCharacter | IPv4Character | HexCharacter | DecimalCharacter | OctalCharacter, // 0x34  4
+    QueryCharacter | UserInfoCharacter | IPv4Character | HexCharacter | DecimalCharacter | OctalCharacter, // 0x35  5
+    QueryCharacter | UserInfoCharacter | IPv4Character | HexCharacter | DecimalCharacter | OctalCharacter, // 0x36  6
+    QueryCharacter | UserInfoCharacter | IPv4Character | HexCharacter | DecimalCharacter | OctalCharacter, // 0x37  7
+    QueryCharacter | UserInfoCharacter | IPv4Character | HexCharacter | DecimalCharacter, // 0x38  8
+    QueryCharacter | UserInfoCharacter | IPv4Character | HexCharacter | DecimalCharacter, // 0x39  9
+    QueryCharacter, // 0x3a  :
+    QueryCharacter, // 0x3b  ;
+    InvalidCharacter, // 0x3c  <
+    QueryCharacter, // 0x3d  =
+    InvalidCharacter, // 0x3e  >
+    QueryCharacter, // 0x3f  ?
+    QueryCharacter, // 0x40  @
+    QueryCharacter | UserInfoCharacter | IPv4Character | HexCharacter, // 0x41  A
+    QueryCharacter | UserInfoCharacter | IPv4Character | HexCharacter, // 0x42  B
+    QueryCharacter | UserInfoCharacter | IPv4Character | HexCharacter, // 0x43  C
+    QueryCharacter | UserInfoCharacter | IPv4Character | HexCharacter, // 0x44  D
+    QueryCharacter | UserInfoCharacter | IPv4Character | HexCharacter, // 0x45  E
+    QueryCharacter | UserInfoCharacter | IPv4Character | HexCharacter, // 0x46  F
+    QueryCharacter | UserInfoCharacter, // 0x47  G
+    QueryCharacter | UserInfoCharacter, // 0x48  H
+    QueryCharacter | UserInfoCharacter, // 0x49  I
+    QueryCharacter | UserInfoCharacter, // 0x4a  J
+    QueryCharacter | UserInfoCharacter, // 0x4b  K
+    QueryCharacter | UserInfoCharacter, // 0x4c  L
+    QueryCharacter | UserInfoCharacter, // 0x4d  M
+    QueryCharacter | UserInfoCharacter, // 0x4e  N
+    QueryCharacter | UserInfoCharacter, // 0x4f  O
+    QueryCharacter | UserInfoCharacter, // 0x50  P
+    QueryCharacter | UserInfoCharacter, // 0x51  Q
+    QueryCharacter | UserInfoCharacter, // 0x52  R
+    QueryCharacter | UserInfoCharacter, // 0x53  S
+    QueryCharacter | UserInfoCharacter, // 0x54  T
+    QueryCharacter | UserInfoCharacter, // 0x55  U
+    QueryCharacter | UserInfoCharacter, // 0x56  V
+    QueryCharacter | UserInfoCharacter, // 0x57  W
+    QueryCharacter | UserInfoCharacter | IPv4Character, // 0x58  X
+    QueryCharacter | UserInfoCharacter, // 0x59  Y
+    QueryCharacter | UserInfoCharacter, // 0x5a  Z
+    QueryCharacter, // 0x5b  [
+    QueryCharacter, // 0x5c  '\'
+    QueryCharacter, // 0x5d  ]
+    QueryCharacter, // 0x5e  ^
+    QueryCharacter | UserInfoCharacter, // 0x5f  _
+    QueryCharacter, // 0x60  `
+    QueryCharacter | UserInfoCharacter | IPv4Character | HexCharacter, // 0x61  a
+    QueryCharacter | UserInfoCharacter | IPv4Character | HexCharacter, // 0x62  b
+    QueryCharacter | UserInfoCharacter | IPv4Character | HexCharacter, // 0x63  c
+    QueryCharacter | UserInfoCharacter | IPv4Character | HexCharacter, // 0x64  d
+    QueryCharacter | UserInfoCharacter | IPv4Character | HexCharacter, // 0x65  e
+    QueryCharacter | UserInfoCharacter | IPv4Character | HexCharacter, // 0x66  f
+    QueryCharacter | UserInfoCharacter, // 0x67  g
+    QueryCharacter | UserInfoCharacter, // 0x68  h
+    QueryCharacter | UserInfoCharacter, // 0x69  i
+    QueryCharacter | UserInfoCharacter, // 0x6a  j
+    QueryCharacter | UserInfoCharacter, // 0x6b  k
+    QueryCharacter | UserInfoCharacter, // 0x6c  l
+    QueryCharacter | UserInfoCharacter, // 0x6d  m
+    QueryCharacter | UserInfoCharacter, // 0x6e  n
+    QueryCharacter | UserInfoCharacter, // 0x6f  o
+    QueryCharacter | UserInfoCharacter, // 0x70  p
+    QueryCharacter | UserInfoCharacter, // 0x71  q
+    QueryCharacter | UserInfoCharacter, // 0x72  r
+    QueryCharacter | UserInfoCharacter, // 0x73  s
+    QueryCharacter | UserInfoCharacter, // 0x74  t
+    QueryCharacter | UserInfoCharacter, // 0x75  u
+    QueryCharacter | UserInfoCharacter, // 0x76  v
+    QueryCharacter | UserInfoCharacter, // 0x77  w
+    QueryCharacter | UserInfoCharacter | IPv4Character, // 0x78  x
+    QueryCharacter | UserInfoCharacter, // 0x79  y
+    QueryCharacter | UserInfoCharacter, // 0x7a  z
+    QueryCharacter, // 0x7b  {
+    QueryCharacter, // 0x7c  |
+    QueryCharacter, // 0x7d  }
+    QueryCharacter | UserInfoCharacter, // 0x7e  ~
+    InvalidCharacter, // 0x7f
+    InvalidCharacter, InvalidCharacter, InvalidCharacter, InvalidCharacter,
+    InvalidCharacter, InvalidCharacter, InvalidCharacter, InvalidCharacter,
+    InvalidCharacter, InvalidCharacter, InvalidCharacter, InvalidCharacter,
+    InvalidCharacter, InvalidCharacter, InvalidCharacter, InvalidCharacter, // 0x80 - 0x8f
+    InvalidCharacter, InvalidCharacter, InvalidCharacter, InvalidCharacter,
+    InvalidCharacter, InvalidCharacter, InvalidCharacter, InvalidCharacter,
+    InvalidCharacter, InvalidCharacter, InvalidCharacter, InvalidCharacter,
+    InvalidCharacter, InvalidCharacter, InvalidCharacter, InvalidCharacter, // 0x90 - 0x9f
+    InvalidCharacter, InvalidCharacter, InvalidCharacter, InvalidCharacter,
+    InvalidCharacter, InvalidCharacter, InvalidCharacter, InvalidCharacter,
+    InvalidCharacter, InvalidCharacter, InvalidCharacter, InvalidCharacter,
+    InvalidCharacter, InvalidCharacter, InvalidCharacter, InvalidCharacter, // 0xa0 - 0xaf
+    InvalidCharacter, InvalidCharacter, InvalidCharacter, InvalidCharacter,
+    InvalidCharacter, InvalidCharacter, InvalidCharacter, InvalidCharacter,
+    InvalidCharacter, InvalidCharacter, InvalidCharacter, InvalidCharacter,
+    InvalidCharacter, InvalidCharacter, InvalidCharacter, InvalidCharacter, // 0xb0 - 0xbf
+    InvalidCharacter, InvalidCharacter, InvalidCharacter, InvalidCharacter,
+    InvalidCharacter, InvalidCharacter, InvalidCharacter, InvalidCharacter,
+    InvalidCharacter, InvalidCharacter, InvalidCharacter, InvalidCharacter,
+    InvalidCharacter, InvalidCharacter, InvalidCharacter, InvalidCharacter, // 0xc0 - 0xcf
+    InvalidCharacter, InvalidCharacter, InvalidCharacter, InvalidCharacter,
+    InvalidCharacter, InvalidCharacter, InvalidCharacter, InvalidCharacter,
+    InvalidCharacter, InvalidCharacter, InvalidCharacter, InvalidCharacter,
+    InvalidCharacter, InvalidCharacter, InvalidCharacter, InvalidCharacter, // 0xd0 - 0xdf
+    InvalidCharacter, InvalidCharacter, InvalidCharacter, InvalidCharacter,
+    InvalidCharacter, InvalidCharacter, InvalidCharacter, InvalidCharacter,
+    InvalidCharacter, InvalidCharacter, InvalidCharacter, InvalidCharacter,
+    InvalidCharacter, InvalidCharacter, InvalidCharacter, InvalidCharacter, // 0xe0 - 0xef
+    InvalidCharacter, InvalidCharacter, InvalidCharacter, InvalidCharacter,
+    InvalidCharacter, InvalidCharacter, InvalidCharacter, InvalidCharacter,
+    InvalidCharacter, InvalidCharacter, InvalidCharacter, InvalidCharacter,
+    InvalidCharacter, InvalidCharacter, InvalidCharacter, InvalidCharacter, // 0xf0 - 0xff
+};
+
+}
+
+#endif // USE(WTFURL)
diff --git a/Source/JavaScriptCore/wtf/url/src/URLCharacterTypes.h b/Source/JavaScriptCore/wtf/url/src/URLCharacterTypes.h
new file mode 100644
index 000000000..6edb98ca2
--- /dev/null
+++ b/Source/JavaScriptCore/wtf/url/src/URLCharacterTypes.h
@@ -0,0 +1,65 @@
+// Copyright 2010, Google Inc. All rights reserved.
+//
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following disclaimer
+// in the documentation and/or other materials provided with the
+// distribution.
+//     * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived from
+// this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+#ifndef URLCharacterTypes_h
+#define URLCharacterTypes_h
+
+#if USE(WTFURL)
+
+namespace WTF {
+
+class URLCharacterTypes {
+public:
+    static inline bool isQueryChar(unsigned char c) { return isCharOfType(c, QueryCharacter); }
+    static inline bool isIPv4Char(unsigned char c) { return isCharOfType(c, IPv4Character); }
+    static inline bool isHexChar(unsigned char c) { return isCharOfType(c, HexCharacter); }
+
+private:
+    enum CharTypes {
+        InvalidCharacter = 0,
+        QueryCharacter = 1 << 0,
+        UserInfoCharacter = 1 << 1,
+        IPv4Character = 1 << 2,
+        HexCharacter = 1 << 3,
+        DecimalCharacter = 1 << 4,
+        OctalCharacter = 1 << 5,
+    };
+
+    static const unsigned char characterTypeTable[0x100];
+
+    static inline bool isCharOfType(unsigned char c, CharTypes type)
+    {
+        return !!(characterTypeTable[c] & type);
+    }
+};
+
+}
+
+#endif // USE(WTFURL)
+
+#endif // URLCharacterTypes_h
diff --git a/Source/JavaScriptCore/wtf/url/src/URLComponent.h b/Source/JavaScriptCore/wtf/url/src/URLComponent.h
new file mode 100644
index 000000000..747a80b80
--- /dev/null
+++ b/Source/JavaScriptCore/wtf/url/src/URLComponent.h
@@ -0,0 +1,81 @@
+// Copyright 2010, Google Inc. All rights reserved.
+//
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following disclaimer
+// in the documentation and/or other materials provided with the
+// distribution.
+//     * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived from
+// this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+#ifndef URLComponent_h
+#define URLComponent_h
+
+#if USE(WTFURL)
+
+namespace WTF {
+
+// Represents a substring for URL parsing.
+class URLComponent {
+public:
+    URLComponent() : m_begin(0), m_length(-1) { }
+    URLComponent(int begin, int length) : m_begin(begin), m_length(length) { }
+
+    // Helper that returns a component created with the given begin and ending
+    // points. The ending point is non-inclusive.
+    static inline URLComponent fromRange(int begin, int end)
+    {
+        return URLComponent(begin, end - begin);
+    }
+
+    // Returns true if this component is valid, meaning the length is given. Even
+    // valid components may be empty to record the fact that they exist.
+    bool isValid() const { return m_length != -1; }
+
+    bool isNonEmpty() const { return m_length > 0; }
+    bool isEmptyOrInvalid() const { return m_length <= 0; }
+
+    void reset()
+    {
+        m_begin = 0;
+        m_length = -1;
+    }
+
+    bool operator==(const URLComponent& other) const { return m_begin == other.m_begin && m_length == other.m_length; }
+
+    int begin() const { return m_begin; }
+    void setBegin(int begin) { m_begin = begin; }
+
+    int length() const { return m_length; }
+    void setLength(int length) { m_length = length; }
+
+    int end() const { return m_begin + m_length; }
+
+private:
+    int m_begin; // Byte offset in the string of this component.
+    int m_length; // Will be -1 if the component is unspecified.
+};
+
+} // namespace WTF
+
+#endif // USE(WTFURL)
+
+#endif // URLComponent_h
diff --git a/Source/JavaScriptCore/wtf/url/src/URLEscape.cpp b/Source/JavaScriptCore/wtf/url/src/URLEscape.cpp
new file mode 100644
index 000000000..5acdcde24
--- /dev/null
+++ b/Source/JavaScriptCore/wtf/url/src/URLEscape.cpp
@@ -0,0 +1,43 @@
+// Copyright 2010, Google Inc. All rights reserved.
+//
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following disclaimer
+// in the documentation and/or other materials provided with the
+// distribution.
+//     * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived from
+// this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+#include "config.h"
+#include "URLEscape.h"
+
+#if USE(WTFURL)
+
+namespace WTF {
+
+const char hexCharacterTable[16] = {
+    '0', '1', '2', '3', '4', '5', '6', '7',
+    '8', '9', 'A', 'B', 'C', 'D', 'E', 'F',
+};
+
+}
+
+#endif // USE(WTFURL)
diff --git a/Source/JavaScriptCore/wtf/url/src/URLEscape.h b/Source/JavaScriptCore/wtf/url/src/URLEscape.h
new file mode 100644
index 000000000..e010012a3
--- /dev/null
+++ b/Source/JavaScriptCore/wtf/url/src/URLEscape.h
@@ -0,0 +1,53 @@
+// Copyright 2010, Google Inc. All rights reserved.
+//
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following disclaimer
+// in the documentation and/or other materials provided with the
+// distribution.
+//     * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived from
+// this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+
+#ifndef URLEscape_h
+#define URLEscape_h
+
+#if USE(WTFURL)
+
+#include "URLBuffer.h"
+
+namespace WTF {
+
+extern const char hexCharacterTable[16];
+
+template<typename InChar, typename OutChar>
+inline void appendURLEscapedCharacter(InChar ch, URLBuffer<OutChar>& buffer)
+{
+    buffer.append('%');
+    buffer.append(hexCharacterTable[ch >> 4]);
+    buffer.append(hexCharacterTable[ch & 0xf]);
+}
+
+}
+
+#endif // USE(WTFURL)
+
+#endif
diff --git a/Source/JavaScriptCore/wtf/url/src/URLParser.h b/Source/JavaScriptCore/wtf/url/src/URLParser.h
new file mode 100644
index 000000000..01f738cf3
--- /dev/null
+++ b/Source/JavaScriptCore/wtf/url/src/URLParser.h
@@ -0,0 +1,579 @@
+/* Based on nsURLParsers.cc from Mozilla
+ * -------------------------------------
+ * Copyright (C) 1998 Netscape Communications Corporation.
+ *
+ * Other contributors:
+ *   Darin Fisher (original author)
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2.1 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ *
+ * Alternatively, the contents of this file may be used under the terms
+ * of either the Mozilla Public License Version 1.1, found at
+ * http://www.mozilla.org/MPL/ (the "MPL") or the GNU General Public
+ * License Version 2.0, found at http://www.fsf.org/copyleft/gpl.html
+ * (the "GPL"), in which case the provisions of the MPL or the GPL are
+ * applicable instead of those above.  If you wish to allow use of your
+ * version of this file only under the terms of one of those two
+ * licenses (the MPL or the GPL) and not to allow others to use your
+ * version of this file under the LGPL, indicate your decision by
+ * deletingthe provisions above and replace them with the notice and
+ * other provisions required by the MPL or the GPL, as the case may be.
+ * If you do not delete the provisions above, a recipient may use your
+ * version of this file under any of the LGPL, the MPL or the GPL.
+ */
+
+#ifndef URLParser_h
+#define URLParser_h
+
+#include "URLComponent.h"
+#include "URLSegments.h"
+
+#if USE(WTFURL)
+
+namespace WTF {
+
+template<typename CharacterType>
+class URLParser {
+public:
+    enum SpecialPort {
+        UnspecifiedPort = -1,
+        InvalidPort = -2,
+    };
+
+    // This handles everything that may be an authority terminator, including
+    // backslash. For special backslash handling see parseAfterScheme.
+    static bool isPossibleAuthorityTerminator(CharacterType ch)
+    {
+        return isURLSlash(ch) || ch == '?' || ch == '#' || ch == ';';
+    }
+
+    // Given an already-identified auth section, breaks it into its constituent
+    // parts. The port number will be parsed and the resulting integer will be
+    // filled into the given *port variable, or -1 if there is no port number
+    // or it is invalid.
+    static void parseAuthority(const CharacterType* spec, const URLComponent& auth, URLComponent& username, URLComponent& password, URLComponent& host, URLComponent& port)
+    {
+        // FIXME: add ASSERT(auth.isValid()); // We should always get an authority.
+        if (!auth.length()) {
+            username.reset();
+            password.reset();
+            host.reset();
+            port.reset();
+            return;
+        }
+
+        // Search backwards for @, which is the separator between the user info
+        // and the server info. RFC 3986 forbids @ from occuring in auth, but
+        // someone might include it in a password unescaped.
+        int i = auth.begin() + auth.length() - 1;
+        while (i > auth.begin() && spec[i] != '@')
+            --i;
+
+        if (spec[i] == '@') {
+            // Found user info: <user-info>@<server-info>
+            parseUserInfo(spec, URLComponent(auth.begin(), i - auth.begin()), username, password);
+            parseServerInfo(spec, URLComponent::fromRange(i + 1, auth.begin() + auth.length()), host, port);
+        } else {
+            // No user info, everything is server info.
+            username.reset();
+            password.reset();
+            parseServerInfo(spec, auth, host, port);
+        }
+    }
+
+    static bool extractScheme(const CharacterType* spec, int specLength, URLComponent& scheme)
+    {
+        // Skip leading whitespace and control characters.
+        int begin = 0;
+        while (begin < specLength && shouldTrimFromURL(spec[begin]))
+            begin++;
+        if (begin == specLength)
+            return false; // Input is empty or all whitespace.
+
+        // Find the first colon character.
+        for (int i = begin; i < specLength; i++) {
+            if (spec[i] == ':') {
+                scheme = URLComponent::fromRange(begin, i);
+                return true;
+            }
+        }
+        return false; // No colon found: no scheme
+    }
+
+    // Fills in all members of the URLSegments structure (except for the
+    // scheme) for standard URLs.
+    //
+    // |spec| is the full spec being parsed, of length |specLength|.
+    // |afterScheme| is the character immediately following the scheme (after
+    // the colon) where we'll begin parsing.
+    static void parseAfterScheme(const CharacterType* spec, int specLength, int afterScheme, URLSegments& parsed)
+    {
+        int numberOfSlashes = consecutiveSlashes(spec, afterScheme, specLength);
+        int afterSlashes = afterScheme + numberOfSlashes;
+
+        // First split into two main parts, the authority (username, password,
+        // host, and port) and the full path (path, query, and reference).
+        URLComponent authority;
+        URLComponent fullPath;
+
+        // Found "//<some data>", looks like an authority section. Treat
+        // everything from there to the next slash (or end of spec) to be the
+        // authority. Note that we ignore the number of slashes and treat it as
+        // the authority.
+        int authEnd = nextAuthorityTerminator(spec, afterSlashes, specLength);
+        authority = URLComponent(afterSlashes, authEnd - afterSlashes);
+
+        if (authEnd == specLength) // No beginning of path found.
+            fullPath = URLComponent();
+        else // Everything starting from the slash to the end is the path.
+            fullPath = URLComponent(authEnd, specLength - authEnd);
+
+        // Now parse those two sub-parts.
+        parseAuthority(spec, authority, parsed.username, parsed.password, parsed.host, parsed.port);
+        parsePath(spec, fullPath, parsed.path, parsed.query, parsed.fragment);
+    }
+
+    // The main parsing function for standard URLs. Standard URLs have a scheme,
+    // host, path, etc.
+    static void parseStandardURL(const CharacterType* spec, int specLength, URLSegments& parsed)
+    {
+        // FIXME: add ASSERT(specLength >= 0);
+
+        // Strip leading & trailing spaces and control characters.
+        int begin = 0;
+        trimURL(spec, begin, specLength);
+
+        int afterScheme;
+        if (extractScheme(spec, specLength, parsed.scheme))
+            afterScheme = parsed.scheme.end() + 1; // Skip past the colon.
+        else {
+            // Say there's no scheme when there is a colon. We could also say
+            // that everything is the scheme. Both would produce an invalid
+            // URL, but this way seems less wrong in more cases.
+            parsed.scheme.reset();
+            afterScheme = begin;
+        }
+        parseAfterScheme(spec, specLength, afterScheme, parsed);
+    }
+
+    static void parsePath(const CharacterType* spec, const URLComponent& path, URLComponent& filepath, URLComponent& query, URLComponent& fragment)
+    {
+        // path = [/]<segment1>/<segment2>/<...>/<segmentN>;<param>?<query>#<fragment>
+
+        // Special case when there is no path.
+        if (!path.isValid()) {
+            filepath.reset();
+            query.reset();
+            fragment.reset();
+            return;
+        }
+        // FIXME: add ASSERT(path.length() > 0); // We should never have 0 length paths.
+
+        // Search for first occurrence of either ? or #.
+        int pathEnd = path.begin() + path.length();
+
+        int querySeparator = -1; // Index of the '?'
+        int refSeparator = -1; // Index of the '#'
+        for (int i = path.begin(); i < pathEnd; i++) {
+            switch (spec[i]) {
+            case '?':
+                if (querySeparator < 0)
+                    querySeparator = i;
+                break;
+            case '#':
+                refSeparator = i;
+                i = pathEnd; // Break out of the loop.
+                break;
+            default:
+                break;
+            }
+        }
+
+        // Markers pointing to the character after each of these corresponding
+        // components. The code below works from the end back to the beginning,
+        // and will update these indices as it finds components that exist.
+        int fileEnd, queryEnd;
+
+        // Fragment: from the # to the end of the path.
+        if (refSeparator >= 0) {
+            fileEnd = refSeparator;
+            queryEnd = refSeparator;
+            fragment = URLComponent::fromRange(refSeparator + 1, pathEnd);
+        } else {
+            fileEnd = pathEnd;
+            queryEnd = pathEnd;
+            fragment.reset();
+        }
+
+        // Query fragment: everything from the ? to the next boundary (either
+        // the end of the path or the fragment fragment).
+        if (querySeparator >= 0) {
+            fileEnd = querySeparator;
+            query = URLComponent::fromRange(querySeparator + 1, queryEnd);
+        } else
+            query.reset();
+
+        // File path: treat an empty file path as no file path.
+        if (fileEnd != path.begin())
+            filepath = URLComponent::fromRange(path.begin(), fileEnd);
+        else
+            filepath.reset();
+    }
+
+    // Initializes a path URL which is merely a scheme followed by a path.
+    // Examples include "about:foo" and "javascript:alert('bar');"
+    static void parsePathURL(const CharacterType* spec, int specLength, URLSegments& parsed)
+    {
+        // Get the non-path and non-scheme parts of the URL out of the way, we
+        // never use them.
+        parsed.username.reset();
+        parsed.password.reset();
+        parsed.host.reset();
+        parsed.port.reset();
+        parsed.query.reset();
+        parsed.fragment.reset();
+
+        // Strip leading & trailing spaces and control characters.
+        // FIXME: Perhaps this is unnecessary?
+        int begin = 0;
+        trimURL(spec, begin, specLength);
+
+        // Handle empty specs or ones that contain only whitespace or control
+        // chars.
+        if (begin == specLength) {
+            parsed.scheme.reset();
+            parsed.path.reset();
+            return;
+        }
+
+        // Extract the scheme, with the path being everything following. We also
+        // handle the case where there is no scheme.
+        if (extractScheme(&spec[begin], specLength - begin, parsed.scheme)) {
+            // Offset the results since we gave extractScheme a substring.
+            parsed.scheme.setBegin(parsed.scheme.begin() + begin);
+
+            // For compatibility with the standard URL parser, we treat no path
+            // as -1, rather than having a length of 0 (we normally wouldn't
+            // care so much for these non-standard URLs).
+            if (parsed.scheme.end() == specLength - 1)
+                parsed.path.reset();
+            else
+                parsed.path = URLComponent::fromRange(parsed.scheme.end() + 1, specLength);
+        } else {
+            // No scheme found, just path.
+            parsed.scheme.reset();
+            parsed.path = URLComponent::fromRange(begin, specLength);
+        }
+    }
+
+    static void parseMailtoURL(const CharacterType* spec, int specLength, URLSegments& parsed)
+    {
+        // FIXME: add ASSERT(specLength >= 0);
+
+        // Get the non-path and non-scheme parts of the URL out of the way, we
+        // never use them.
+        parsed.username.reset();
+        parsed.password.reset();
+        parsed.host.reset();
+        parsed.port.reset();
+        parsed.fragment.reset();
+        parsed.query.reset(); // May use this; reset for convenience.
+
+        // Strip leading & trailing spaces and control characters.
+        int begin = 0;
+        trimURL(spec, begin, specLength);
+
+        // Handle empty specs or ones that contain only whitespace or control
+        // chars.
+        if (begin == specLength) {
+            parsed.scheme.reset();
+            parsed.path.reset();
+            return;
+        }
+
+        int pathBegin = -1;
+        int pathEnd = -1;
+
+        // Extract the scheme, with the path being everything following. We also
+        // handle the case where there is no scheme.
+        if (extractScheme(&spec[begin], specLength - begin, parsed.scheme)) {
+            // Offset the results since we gave extractScheme a substring.
+            parsed.scheme.setBegin(parsed.scheme.begin() + begin);
+
+            if (parsed.scheme.end() != specLength - 1) {
+                pathBegin = parsed.scheme.end() + 1;
+                pathEnd = specLength;
+            }
+        } else {
+            // No scheme found, just path.
+            parsed.scheme.reset();
+            pathBegin = begin;
+            pathEnd = specLength;
+        }
+
+        // Split [pathBegin, pathEnd) into a path + query.
+        for (int i = pathBegin; i < pathEnd; ++i) {
+            if (spec[i] == '?') {
+                parsed.query = URLComponent::fromRange(i + 1, pathEnd);
+                pathEnd = i;
+                break;
+            }
+        }
+
+        // For compatibility with the standard URL parser, treat no path as
+        // -1, rather than having a length of 0
+        if (pathBegin == pathEnd)
+            parsed.path.reset();
+        else
+            parsed.path = URLComponent::fromRange(pathBegin, pathEnd);
+    }
+
+    static int parsePort(const CharacterType* spec, const URLComponent& component)
+    {
+        // Easy success case when there is no port.
+        const int maxDigits = 5;
+        if (component.isEmptyOrInvalid())
+            return UnspecifiedPort;
+
+        URLComponent nonZeroDigits(component.end(), 0);
+        for (int i = 0; i < component.length(); ++i) {
+            if (spec[component.begin() + i] != '0') {
+                nonZeroDigits = URLComponent::fromRange(component.begin() + i, component.end());
+                break;
+            }
+        }
+        if (!nonZeroDigits.length())
+            return 0; // All digits were 0.
+
+        if (nonZeroDigits.length() > maxDigits)
+            return InvalidPort;
+
+        int port = 0;
+        for (int i = 0; i < nonZeroDigits.length(); ++i) {
+            CharacterType ch = spec[nonZeroDigits.begin() + i];
+            if (!isPortDigit(ch))
+                return InvalidPort;
+            port *= 10;
+            port += static_cast<char>(ch) - '0';
+        }
+        if (port > 65535)
+            return InvalidPort;
+        return port;
+    }
+
+    static void extractFileName(const CharacterType* spec, const URLComponent& path, URLComponent& fileName)
+    {
+        // Handle empty paths: they have no file names.
+        if (path.isEmptyOrInvalid()) {
+            fileName.reset();
+            return;
+        }
+
+        // Search backwards for a parameter, which is a normally unused field
+        // in a URL delimited by a semicolon. We parse the parameter as part of
+        // the path, but here, we don't want to count it. The last semicolon is
+        // the parameter.
+        int fileEnd = path.end();
+        for (int i = path.end() - 1; i > path.begin(); --i) {
+            if (spec[i] == ';') {
+                fileEnd = i;
+                break;
+            }
+        }
+
+        // Now search backwards from the filename end to the previous slash
+        // to find the beginning of the filename.
+        for (int i = fileEnd - 1; i >= path.begin(); --i) {
+            if (isURLSlash(spec[i])) {
+                // File name is everything following this character to the end
+                fileName = URLComponent::fromRange(i + 1, fileEnd);
+                return;
+            }
+        }
+
+        // No slash found, this means the input was degenerate (generally paths
+        // will start with a slash). Let's call everything the file name.
+        fileName = URLComponent::fromRange(path.begin(), fileEnd);
+    }
+
+    static bool extractQueryKeyValue(const CharacterType* spec, URLComponent& query, URLComponent& key, URLComponent& value)
+    {
+        if (query.isEmptyOrInvalid())
+            return false;
+
+        int start = query.begin();
+        int current = start;
+        int end = query.end();
+
+        // We assume the beginning of the input is the beginning of the "key"
+        // and we skip to the end of it.
+        key.setBegin(current);
+        while (current < end && spec[current] != '&' && spec[current] != '=')
+            ++current;
+        key.setLength(current - key.begin());
+
+        // Skip the separator after the key (if any).
+        if (current < end && spec[current] == '=')
+            ++current;
+
+        // Find the value part.
+        value.setBegin(current);
+        while (current < end && spec[current] != '&')
+            ++current;
+        value.setLength(current - value.begin());
+
+        // Finally skip the next separator if any
+        if (current < end && spec[current] == '&')
+            ++current;
+
+        // Save the new query
+        query = URLComponent::fromRange(current, end);
+        return true;
+    }
+
+// FIXME: This should be protected or private.
+public:
+    // We treat slashes and backslashes the same for IE compatibility.
+    static inline bool isURLSlash(CharacterType ch)
+    {
+        return ch == '/' || ch == '\\';
+    }
+
+    // Returns true if we should trim this character from the URL because it is
+    // a space or a control character.
+    static inline bool shouldTrimFromURL(CharacterType ch)
+    {
+        return ch <= ' ';
+    }
+
+    // Given an already-initialized begin index and end index (the index after
+    // the last CharacterType in spec), this shrinks the range to eliminate
+    // "should-be-trimmed" characters.
+    static inline void trimURL(const CharacterType* spec, int& begin, int& end)
+    {
+        // Strip leading whitespace and control characters.
+        while (begin < end && shouldTrimFromURL(spec[begin]))
+            ++begin;
+
+        // Strip trailing whitespace and control characters. We need the >i
+        // test for when the input string is all blanks; we don't want to back
+        // past the input.
+        while (end > begin && shouldTrimFromURL(spec[end - 1]))
+            --end;
+    }
+
+    // Counts the number of consecutive slashes starting at the given offset
+    // in the given string of the given length.
+    static inline int consecutiveSlashes(const CharacterType *string, int beginOffset, int stringLength)
+    {
+        int count = 0;
+        while (beginOffset + count < stringLength && isURLSlash(string[beginOffset + count]))
+            ++count;
+        return count;
+    }
+
+private:
+    // URLParser cannot be constructed.
+    URLParser();
+
+    // Returns true if the given character is a valid digit to use in a port.
+    static inline bool isPortDigit(CharacterType ch)
+    {
+        return ch >= '0' && ch <= '9';
+    }
+
+    // Returns the offset of the next authority terminator in the input starting
+    // from startOffset. If no terminator is found, the return value will be equal
+    // to specLength.
+    static int nextAuthorityTerminator(const CharacterType* spec, int startOffset, int specLength)
+    {
+        for (int i = startOffset; i < specLength; i++) {
+            if (isPossibleAuthorityTerminator(spec[i]))
+                return i;
+        }
+        return specLength; // Not found.
+    }
+
+    static void parseUserInfo(const CharacterType* spec, const URLComponent& user, URLComponent& username, URLComponent& password)
+    {
+        // Find the first colon in the user section, which separates the
+        // username and password.
+        int colonOffset = 0;
+        while (colonOffset < user.length() && spec[user.begin() + colonOffset] != ':')
+            ++colonOffset;
+
+        if (colonOffset < user.length()) {
+            // Found separator: <username>:<password>
+            username = URLComponent(user.begin(), colonOffset);
+            password = URLComponent::fromRange(user.begin() + colonOffset + 1, user.begin() + user.length());
+        } else {
+            // No separator, treat everything as the username
+            username = user;
+            password = URLComponent();
+        }
+    }
+
+    static void parseServerInfo(const CharacterType* spec, const URLComponent& serverInfo, URLComponent& host, URLComponent& port)
+    {
+        if (!serverInfo.length()) {
+            // No server info, host name is empty.
+            host.reset();
+            port.reset();
+            return;
+        }
+
+        // If the host starts with a left-bracket, assume the entire host is an
+        // IPv6 literal. Otherwise, assume none of the host is an IPv6 literal.
+        // This assumption will be overridden if we find a right-bracket.
+        //
+        // Our IPv6 address canonicalization code requires both brackets to
+        // exist, but the ability to locate an incomplete address can still be
+        // useful.
+        int ipv6Terminator = spec[serverInfo.begin()] == '[' ? serverInfo.end() : -1;
+        int colon = -1;
+
+        // Find the last right-bracket, and the last colon.
+        for (int i = serverInfo.begin(); i < serverInfo.end(); i++) {
+            switch (spec[i]) {
+            case ']':
+                ipv6Terminator = i;
+                break;
+            case ':':
+                colon = i;
+                break;
+            default:
+                break;
+            }
+        }
+
+        if (colon > ipv6Terminator) {
+            // Found a port number: <hostname>:<port>
+            host = URLComponent::fromRange(serverInfo.begin(), colon);
+            if (!host.length())
+                host.reset();
+            port = URLComponent::fromRange(colon + 1, serverInfo.end());
+        } else {
+            // No port: <hostname>
+            host = serverInfo;
+            port.reset();
+        }
+    }
+};
+
+} // namespace WTF
+
+#endif // USE(WTFURL)
+
+#endif // URLParser_h
diff --git a/Source/JavaScriptCore/wtf/url/src/URLQueryCanonicalizer.h b/Source/JavaScriptCore/wtf/url/src/URLQueryCanonicalizer.h
new file mode 100644
index 000000000..467c497fd
--- /dev/null
+++ b/Source/JavaScriptCore/wtf/url/src/URLQueryCanonicalizer.h
@@ -0,0 +1,109 @@
+// Copyright 2010, Google Inc. All rights reserved.
+//
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following disclaimer
+// in the documentation and/or other materials provided with the
+// distribution.
+//     * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived from
+// this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+
+#ifndef URLQueryCanonicalizer_h
+#define URLQueryCanonicalizer_h
+
+#if USE(WTFURL)
+
+#include "RawURLBuffer.h"
+#include "URLBuffer.h"
+#include "URLCharacterTypes.h"
+#include "URLComponent.h"
+#include "URLEscape.h"
+
+namespace WTF {
+
+template<typename InChar, typename OutChar, void convertCharset(const InChar*, int length, URLBuffer<char>&)>
+class URLQueryCanonicalizer {
+public:
+    static void canonicalize(const InChar* spec, const URLComponent& query, URLBuffer<OutChar>& buffer, URLComponent& resultQuery)
+    {
+        if (query.length() < 0) {
+            resultQuery = URLComponent();
+            return;
+        }
+
+        buffer->append('?');
+        resultQuery.setBegin(buffer->length());
+        convertToQueryEncoding(spec, query, buffer);
+        resultQuery.setLength(buffer->length() - resultQuery.begin());
+    }
+
+private:
+    static bool isAllASCII(const InChar* spec, const URLComponent& query)
+    {
+        int end = query.end();
+        for (int i = query.begin(); i < end; ++i) {
+            if (static_cast<unsigned>(spec[i]) >= 0x80)
+                return false;
+        }
+        return true;
+    }
+
+#ifndef NDEBUG
+    static bool isRaw8Bit(const InChar* source, int length)
+    {
+        for (int i = source; i < length; ++i) {
+            if (source[i] & 0xFF != source[i])
+                return false;
+        }
+        return true;
+    }
+#endif
+
+    static void appendRaw8BitQueryString(const InChar* source, int length, URLBuffer<OutChar>* buffer)
+    {
+        ASSERT(isRaw8Bit(source, length));
+        for (int i = 0; i < length; ++i) {
+            if (!URLCharacterTypes::isQueryChar(source[i]))
+                appendURLEscapedCharacter(static_cast<unsigned char>(source[i]), buffer);
+            else
+                buffer->append(static_cast<char>(source[i]));
+        }
+    }
+
+    static void convertToQueryEncoding(const InChar* spec, const URLComponent& query, URLBuffer<OutChar>& buffer)
+    {
+        if (isAllASCII(spec, query)) {
+            appendRaw8BitQueryString(&spec[query.begin()], query.length(), buffer);
+            return;
+        }
+
+        RawURLBuffer<char, 1024> convertedQuery;
+        convertCharset(spec, query, convertedQuery);
+        appendRaw8BitQueryString(convertedQuery.data(), convertedQuery.length(), buffer);
+    }
+};
+
+}
+
+#endif // USE(WTFURL)
+
+#endif
diff --git a/Source/JavaScriptCore/wtf/url/src/URLSegments.cpp b/Source/JavaScriptCore/wtf/url/src/URLSegments.cpp
new file mode 100644
index 000000000..182b0d45b
--- /dev/null
+++ b/Source/JavaScriptCore/wtf/url/src/URLSegments.cpp
@@ -0,0 +1,114 @@
+/* Based on nsURLParsers.cc from Mozilla
+ * -------------------------------------
+ * Copyright (C) 1998 Netscape Communications Corporation.
+ *
+ * Other contributors:
+ *   Darin Fisher (original author)
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2.1 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ *
+ * Alternatively, the contents of this file may be used under the terms
+ * of either the Mozilla Public License Version 1.1, found at
+ * http://www.mozilla.org/MPL/ (the "MPL") or the GNU General Public
+ * License Version 2.0, found at http://www.fsf.org/copyleft/gpl.html
+ * (the "GPL"), in which case the provisions of the MPL or the GPL are
+ * applicable instead of those above.  If you wish to allow use of your
+ * version of this file only under the terms of one of those two
+ * licenses (the MPL or the GPL) and not to allow others to use your
+ * version of this file under the LGPL, indicate your decision by
+ * deletingthe provisions above and replace them with the notice and
+ * other provisions required by the MPL or the GPL, as the case may be.
+ * If you do not delete the provisions above, a recipient may use your
+ * version of this file under any of the LGPL, the MPL or the GPL.
+ */
+
+#include "config.h"
+#include "URLSegments.h"
+
+#if USE(WTFURL)
+
+namespace WTF {
+
+int URLSegments::length() const
+{
+    if (fragment.isValid())
+        return fragment.end();
+    return charactersBefore(Fragment, false);
+}
+
+int URLSegments::charactersBefore(ComponentType type, bool includeDelimiter) const
+{
+    if (type == Scheme)
+        return scheme.begin();
+
+    int current = 0;
+    if (scheme.isValid())
+        current = scheme.end() + 1; // Advance over the ':' at the end of the scheme.
+
+    if (username.isValid()) {
+        if (type <= Username)
+            return username.begin();
+        current = username.end() + 1; // Advance over the '@' or ':' at the end.
+    }
+
+    if (password.isValid()) {
+        if (type <= Password)
+            return password.begin();
+        current = password.end() + 1; // Advance over the '@' at the end.
+    }
+
+    if (host.isValid()) {
+        if (type <= Host)
+            return host.begin();
+        current = host.end();
+    }
+
+    if (port.isValid()) {
+        if (type < Port || (type == Port && includeDelimiter))
+            return port.begin() - 1; // Back over delimiter.
+        if (type == Port)
+            return port.begin(); // Don't want delimiter counted.
+        current = port.end();
+    }
+
+    if (path.isValid()) {
+        if (type <= Path)
+            return path.begin();
+        current = path.end();
+    }
+
+    if (query.isValid()) {
+        if (type < Query || (type == Query && includeDelimiter))
+            return query.begin() - 1; // Back over delimiter.
+        if (type == Query)
+            return query.begin(); // Don't want delimiter counted.
+        current = query.end();
+    }
+
+    if (fragment.isValid()) {
+        if (type == Fragment && !includeDelimiter)
+            return fragment.begin(); // Back over delimiter.
+
+        // When there is a fragment and we get here, the component we wanted was before
+        // this and not found, so we always know the beginning of the fragment is right.
+        return fragment.begin() - 1; // Don't want delimiter counted.
+    }
+
+    return current;
+}
+
+} // namespace WTF
+
+#endif // USE(WTFURL)
diff --git a/Source/JavaScriptCore/wtf/url/src/URLSegments.h b/Source/JavaScriptCore/wtf/url/src/URLSegments.h
new file mode 100644
index 000000000..64d0619b8
--- /dev/null
+++ b/Source/JavaScriptCore/wtf/url/src/URLSegments.h
@@ -0,0 +1,109 @@
+// Copyright 2007, Google Inc. All rights reserved.
+//
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following disclaimer
+// in the documentation and/or other materials provided with the
+// distribution.
+//     * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived from
+// this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+#ifndef URLSegments_h
+#define URLSegments_h
+
+#include "URLComponent.h"
+
+#if USE(WTFURL)
+
+namespace WTF {
+
+// A structure that holds the identified parts of an input URL. This structure
+// does NOT store the URL itself. The caller will have to store the URL text
+// and its corresponding Parsed structure separately.
+class URLSegments {
+public:
+    // Identifies different components.
+    enum ComponentType {
+        Scheme,
+        Username,
+        Password,
+        Host,
+        Port,
+        Path,
+        Query,
+        Fragment,
+    };
+
+    URLSegments() { }
+
+    // Returns the length of the URL (the end of the last component).
+    //
+    // Note that for some invalid, non-canonical URLs, this may not be the length
+    // of the string. For example "http://": the parsed structure will only
+    // contain an entry for the four-character scheme, and it doesn't know about
+    // the "://". For all other last-components, it will return the real length.
+    int length() const;
+
+    // Returns the number of characters before the given component if it exists,
+    // or where the component would be if it did exist. This will return the
+    // string length if the component would be appended to the end.
+    //
+    // Note that this can get a little funny for the port, query, and fragment
+    // components which have a delimiter that is not counted as part of the
+    // component. The |includeDelimiter| flag controls if you want this counted
+    // as part of the component or not when the component exists.
+    //
+    // This example shows the difference between the two flags for two of these
+    // delimited components that is present (the port and query) and one that
+    // isn't (the reference). The components that this flag affects are marked
+    // with a *.
+    //                 0         1         2
+    //                 012345678901234567890
+    // Example input: http://foo:80/?query
+    //              include_delim=true,  ...=false  ("<-" indicates different)
+    //      Scheme: 0                    0
+    //    Username: 5                    5
+    //    Password: 5                    5
+    //        Host: 7                    7
+    //       *Port: 10                   11 <-
+    //        Path: 13                   13
+    //      *Query: 14                   15 <-
+    //        *Fragment: 20                   20
+    //
+    int charactersBefore(ComponentType, bool includeDelimiter) const;
+
+    // Each component excludes the related delimiters and has a length of -1
+    // if that component is absent but 0 if the component exists but is empty.
+    URLComponent scheme;
+    URLComponent username;
+    URLComponent password;
+    URLComponent host;
+    URLComponent port;
+    URLComponent path;
+    URLComponent query;
+    URLComponent fragment;
+};
+
+} // namespace WTF
+
+#endif // USE(WTFURL)
+
+#endif // URLSegments_h
diff --git a/Source/JavaScriptCore/yarr/YarrInterpreter.cpp b/Source/JavaScriptCore/yarr/YarrInterpreter.cpp
index a452bb7f2..4472538e9 100644
--- a/Source/JavaScriptCore/yarr/YarrInterpreter.cpp
+++ b/Source/JavaScriptCore/yarr/YarrInterpreter.cpp
@@ -30,6 +30,7 @@
 #include "UString.h"
 #include "Yarr.h"
 #include <wtf/BumpPointerAllocator.h>
+#include <wtf/DataLog.h>
 #include <wtf/text/CString.h>
 
 #ifndef NDEBUG
@@ -1682,10 +1683,10 @@ public:
 #ifndef NDEBUG
     void dumpDisjunction(ByteDisjunction* disjunction)
     {
-        printf("ByteDisjunction(%p):\n\t", disjunction);
+        dataLog("ByteDisjunction(%p):\n\t", disjunction);
         for (unsigned i = 0; i < disjunction->terms.size(); ++i)
-            printf("{ %d } ", disjunction->terms[i].type);
-        printf("\n");
+            dataLog("{ %d } ", disjunction->terms[i].type);
+        dataLog("\n");
     }
 #endif
 
diff --git a/Source/JavaScriptCore/yarr/YarrJIT.cpp b/Source/JavaScriptCore/yarr/YarrJIT.cpp
index 06faeaa1a..cd861ecf3 100644
--- a/Source/JavaScriptCore/yarr/YarrJIT.cpp
+++ b/Source/JavaScriptCore/yarr/YarrJIT.cpp
@@ -379,6 +379,10 @@ class YarrGenerator : private MacroAssembler {
         Label m_reentry;
         JumpList m_jumps;
 
+        // Used for backtracking when the prior alternative did not consume any
+        // characters but matched.
+        Jump m_zeroLengthMatch;
+
         // This flag is used to null out the second pattern character, when
         // two are fused to match a pair together.
         bool m_isDeadCode;
@@ -728,10 +732,13 @@ class YarrGenerator : private MacroAssembler {
                 break;
             }
             case 3: {
-                BaseIndex address(input, index, TimesOne, (startTermPosition - m_checked) * sizeof(LChar));
-                load32WithUnalignedHalfWords(address, character);
-                and32(Imm32(0xffffff), character);
-                break;
+                BaseIndex highAddress(input, index, TimesOne, (startTermPosition - m_checked) * sizeof(LChar));
+                load16(highAddress, character);
+                if (ignoreCaseMask)
+                    or32(Imm32(ignoreCaseMask), character);
+                op.m_jumps.append(branch32(NotEqual, character, Imm32((allCharacters & 0xffff) | ignoreCaseMask)));
+                op.m_jumps.append(jumpIfCharNotEquals(allCharacters >> 16, startTermPosition + 2 - m_checked, character));
+                return;
             }
             case 4: {
                 BaseIndex address(input, index, TimesOne, (startTermPosition - m_checked) * sizeof(LChar));
@@ -809,10 +816,8 @@ class YarrGenerator : private MacroAssembler {
 
         move(TrustedImm32(0), countRegister);
 
-        if ((ch > 0xff) && (m_charSize == Char8)) {
-            // Have a 16 bit pattern character and an 8 bit string - short circuit
-            op.m_jumps.append(jump());
-        } else {
+        // Unless have a 16 bit pattern character and an 8 bit string - short circuit
+        if (!((ch > 0xff) && (m_charSize == Char8))) {
             JumpList failures;
             Label loop(this);
             failures.append(atEndOfInput());
@@ -830,7 +835,6 @@ class YarrGenerator : private MacroAssembler {
         op.m_reentry = label();
 
         storeToFrame(countRegister, term->frameLocation);
-
     }
     void backtrackPatternCharacterGreedy(size_t opIndex)
     {
@@ -868,16 +872,13 @@ class YarrGenerator : private MacroAssembler {
         const RegisterID character = regT0;
         const RegisterID countRegister = regT1;
 
-        JumpList nonGreedyFailures;
-
         m_backtrackingState.link(this);
 
         loadFromFrame(term->frameLocation, countRegister);
 
-        if ((ch > 0xff) && (m_charSize == Char8)) {
-            // Have a 16 bit pattern character and an 8 bit string - short circuit
-            nonGreedyFailures.append(jump());
-        } else {
+        // Unless have a 16 bit pattern character and an 8 bit string - short circuit
+        if (!((ch > 0xff) && (m_charSize == Char8))) {
+            JumpList nonGreedyFailures;
             nonGreedyFailures.append(atEndOfInput());
             if (term->quantityCount != quantifyInfinite)
                 nonGreedyFailures.append(branch32(Equal, countRegister, Imm32(term->quantityCount.unsafeGet())));
@@ -887,8 +888,8 @@ class YarrGenerator : private MacroAssembler {
             add32(TrustedImm32(1), index);
 
             jump(op.m_reentry);
+            nonGreedyFailures.link(this);
         }
-        nonGreedyFailures.link(this);
 
         sub32(countRegister, index);
         m_backtrackingState.fallthrough();
@@ -1385,7 +1386,7 @@ class YarrGenerator : private MacroAssembler {
                     op.m_checkAdjust -= disjunction->m_minimumSize;
                 if (op.m_checkAdjust)
                     op.m_jumps.append(jumpIfNoAvailableInput(op.m_checkAdjust));
- 
+
                 m_checked += op.m_checkAdjust;
                 break;
             }
@@ -1404,6 +1405,12 @@ class YarrGenerator : private MacroAssembler {
                     op.m_returnAddress = storeToFrameWithPatch(alternativeFrameLocation);
                 }
 
+                if (term->quantityType != QuantifierFixedCount && !m_ops[op.m_previousOp].m_alternative->m_minimumSize) {
+                    // If the previous alternative matched without consuming characters then
+                    // backtrack to try to match while consumming some input.
+                    op.m_zeroLengthMatch = branch32(Equal, index, Address(stackPointerRegister, term->frameLocation * sizeof(void*)));
+                }
+
                 // If we reach here then the last alternative has matched - jump to the
                 // End node, to skip over any further alternatives.
                 //
@@ -1448,6 +1455,12 @@ class YarrGenerator : private MacroAssembler {
                     op.m_returnAddress = storeToFrameWithPatch(alternativeFrameLocation);
                 }
 
+                if (term->quantityType != QuantifierFixedCount && !m_ops[op.m_previousOp].m_alternative->m_minimumSize) {
+                    // If the previous alternative matched without consuming characters then
+                    // backtrack to try to match while consumming some input.
+                    op.m_zeroLengthMatch = branch32(Equal, index, Address(stackPointerRegister, term->frameLocation * sizeof(void*)));
+                }
+
                 // If this set of alternatives contains more than one alternative,
                 // then the Next nodes will have planted jumps to the End, and added
                 // them to this node's m_jumps list.
@@ -1514,14 +1527,19 @@ class YarrGenerator : private MacroAssembler {
             }
             case OpParenthesesSubpatternOnceEnd: {
                 PatternTerm* term = op.m_term;
-                unsigned parenthesesFrameLocation = term->frameLocation;
                 const RegisterID indexTemporary = regT0;
                 ASSERT(term->quantityCount == 1);
 
-                // For Greedy/NonGreedy quantified parentheses, we must reject zero length
-                // matches. If the minimum size is know to be non-zero we need not check.
-                if (term->quantityType != QuantifierFixedCount && !term->parentheses.disjunction->m_minimumSize)
-                    op.m_jumps.append(branch32(Equal, index, Address(stackPointerRegister, parenthesesFrameLocation * sizeof(void*))));
+#ifndef NDEBUG
+                // Runtime ASSERT to make sure that the nested alternative handled the
+                // "no input consumed" check.
+                if (term->quantityType != QuantifierFixedCount && !term->parentheses.disjunction->m_minimumSize) {
+                    Jump pastBreakpoint;
+                    pastBreakpoint = branch32(NotEqual, index, Address(stackPointerRegister, term->frameLocation * sizeof(void*)));
+                    breakpoint();
+                    pastBreakpoint.link(this);
+                }
+#endif
 
                 // If the parenthese are capturing, store the ending index value to the
                 // captures array, offsetting as necessary.
@@ -1568,15 +1586,21 @@ class YarrGenerator : private MacroAssembler {
                 break;
             }
             case OpParenthesesSubpatternTerminalEnd: {
+                YarrOp& beginOp = m_ops[op.m_previousOp];
+#ifndef NDEBUG
                 PatternTerm* term = op.m_term;
 
-                // Check for zero length matches - if the match is non-zero, then we
-                // can accept it & loop back up to the head of the subpattern.
-                YarrOp& beginOp = m_ops[op.m_previousOp];
-                branch32(NotEqual, index, Address(stackPointerRegister, term->frameLocation * sizeof(void*)), beginOp.m_reentry);
+                // Runtime ASSERT to make sure that the nested alternative handled the
+                // "no input consumed" check.
+                Jump pastBreakpoint;
+                pastBreakpoint = branch32(NotEqual, index, Address(stackPointerRegister, term->frameLocation * sizeof(void*)));
+                breakpoint();
+                pastBreakpoint.link(this);
+#endif
 
-                // Reject the match - backtrack back into the subpattern.
-                op.m_jumps.append(jump());
+                // We know that the match is non-zero, we can accept it  and
+                // loop back up to the head of the subpattern.
+                jump(beginOp.m_reentry);
 
                 // This is the entry point to jump to when we stop matching - we will
                 // do so once the subpattern cannot match any more.
@@ -1928,7 +1952,7 @@ class YarrGenerator : private MacroAssembler {
                         // An alternative that is not the last should jump to its successor.
                         jump(nextOp.m_reentry);
                     } else if (!isBegin) {
-                        // The last of more than one alternatives must jump back to the begnning.
+                        // The last of more than one alternatives must jump back to the beginning.
                         nextOp.m_jumps.append(jump());
                     } else {
                         // A single alternative on its own can fall through.
@@ -1940,12 +1964,16 @@ class YarrGenerator : private MacroAssembler {
                         // An alternative that is not the last should jump to its successor.
                         m_backtrackingState.linkTo(nextOp.m_reentry, this);
                     } else if (!isBegin) {
-                        // The last of more than one alternatives must jump back to the begnning.
+                        // The last of more than one alternatives must jump back to the beginning.
                         m_backtrackingState.takeBacktracksToJumpList(nextOp.m_jumps, this);
                     }
                     // In the case of a single alternative on its own do nothing - it can fall through.
                 }
 
+                // If there is a backtrack jump from a zero length match link it here.
+                if (op.m_zeroLengthMatch.isSet())
+                    m_backtrackingState.append(op.m_zeroLengthMatch);
+
                 // At this point we've handled the backtracking back into this node.
                 // Now link any backtracks that need to jump to here.
 
@@ -1978,6 +2006,10 @@ class YarrGenerator : private MacroAssembler {
             case OpNestedAlternativeEnd: {
                 PatternTerm* term = op.m_term;
 
+                // If there is a backtrack jump from a zero length match link it here.
+                if (op.m_zeroLengthMatch.isSet())
+                    m_backtrackingState.append(op.m_zeroLengthMatch);
+
                 // If we backtrack into the end of a simple subpattern do nothing;
                 // just continue through into the last alternative. If we backtrack
                 // into the end of a non-simple set of alterntives we need to jump
diff --git a/Source/ThirdParty/ANGLE/ChangeLog b/Source/ThirdParty/ANGLE/ChangeLog
index 109efc7c3..db1a8388b 100644
--- a/Source/ThirdParty/ANGLE/ChangeLog
+++ b/Source/ThirdParty/ANGLE/ChangeLog
@@ -1,3 +1,18 @@
+2012-02-21  Sam Weinig  <sam@webkit.org>
+
+        Attempt to fix the Snow Leopard build.
+
+        * Configurations/Base.xcconfig:
+
+2012-02-21  Sam Weinig  <sam@webkit.org>
+
+        Use libc++ when building with Clang on Mac
+        https://bugs.webkit.org/show_bug.cgi?id=78981
+
+        Reviewed by Dan Bernstein.
+
+        * Configurations/Base.xcconfig:
+
 2012-01-07  Chris Marrin  <cmarrin@apple.com>
 
         Fixed a warning in GTK build of ANGLE
diff --git a/Source/ThirdParty/ANGLE/Configurations/Base.xcconfig b/Source/ThirdParty/ANGLE/Configurations/Base.xcconfig
index 4a84fb355..42134ba3a 100644
--- a/Source/ThirdParty/ANGLE/Configurations/Base.xcconfig
+++ b/Source/ThirdParty/ANGLE/Configurations/Base.xcconfig
@@ -24,6 +24,11 @@ LINKER_DISPLAYS_MANGLED_NAMES = YES;
 PREBINDING = NO;
 STRIP_INSTALLED_PRODUCT = NO;
 
+CLANG_CXX_LIBRARY = $(CLANG_CXX_LIBRARY_$(TARGET_MAC_OS_X_VERSION_MAJOR));
+CLANG_CXX_LIBRARY_1060 = libstdc++;
+CLANG_CXX_LIBRARY_1070 = libc++;
+CLANG_CXX_LIBRARY_1080 = libc++;
+CLANG_CXX_LIBRARY_1090 = libc++;
 
 REAL_PLATFORM_NAME = $(REAL_PLATFORM_NAME_$(PLATFORM_NAME));
 REAL_PLATFORM_NAME_ = $(REAL_PLATFORM_NAME_macosx);
diff --git a/Source/ThirdParty/ChangeLog b/Source/ThirdParty/ChangeLog
index 02381969c..3e2010833 100644
--- a/Source/ThirdParty/ChangeLog
+++ b/Source/ThirdParty/ChangeLog
@@ -1,3 +1,21 @@
+2012-02-21  Sam Weinig  <sam@webkit.org>
+
+        Attempt to fix the Snow Leopard build.
+
+        * gtest/xcode/Config/General.xcconfig:
+
+2012-02-21  Sam Weinig  <sam@webkit.org>
+
+        Use libc++ when building with Clang on Mac
+        https://bugs.webkit.org/show_bug.cgi?id=78981
+
+        Reviewed by Dan Bernstein.
+
+        * gtest/xcode/Config/General.xcconfig:
+        In addition to enabling libc++ when building with Clang,
+        disable gtest's use of tr1::tuple, which doesn't exist in
+        libc++.
+
 2012-01-25  Mark Rowe  <mrowe@apple.com>
 
         Build in to an alternate location when USE_STAGING_INSTALL_PATH is set.
diff --git a/Source/ThirdParty/gtest/xcode/Config/General.xcconfig b/Source/ThirdParty/gtest/xcode/Config/General.xcconfig
index 50b7c2cb8..93307b687 100644
--- a/Source/ThirdParty/gtest/xcode/Config/General.xcconfig
+++ b/Source/ThirdParty/gtest/xcode/Config/General.xcconfig
@@ -36,6 +36,14 @@ ALWAYS_SEARCH_USER_PATHS = NO
 // Turn on position dependent code for most cases (overridden where appropriate)
 GCC_DYNAMIC_NO_PIC = YES
 
+GCC_PREPROCESSOR_DEFINITIONS = $(GCC_PREPROCESSOR_DEFINITIONS) GTEST_HAS_TR1_TUPLE=0;
+
+CLANG_CXX_LIBRARY = $(CLANG_CXX_LIBRARY_$(TARGET_MAC_OS_X_VERSION_MAJOR));
+CLANG_CXX_LIBRARY_1060 = libstdc++;
+CLANG_CXX_LIBRARY_1070 = libc++;
+CLANG_CXX_LIBRARY_1080 = libc++;
+CLANG_CXX_LIBRARY_1090 = libc++;
+
 REAL_PLATFORM_NAME = $(REAL_PLATFORM_NAME_$(PLATFORM_NAME));
 REAL_PLATFORM_NAME_ = $(REAL_PLATFORM_NAME_macosx);
 REAL_PLATFORM_NAME_iphoneos = iphoneos;
diff --git a/Source/WTF/ChangeLog b/Source/WTF/ChangeLog
index 77d449075..3004dd46a 100644
--- a/Source/WTF/ChangeLog
+++ b/Source/WTF/ChangeLog
@@ -1,3 +1,17 @@
+2012-02-11  Filip Pizlo  <fpizlo@apple.com>
+
+        It should be possible to send all JSC debug logging to a file
+        https://bugs.webkit.org/show_bug.cgi?id=78418
+
+        Reviewed by Sam Weinig.
+        
+        Introduced wtf/DataLog, which defines WTF::dataFile, WTF::dataLog,
+        and WTF::dataLogV. Changed all debugging- and profiling-related printfs
+        to use WTF::dataLog() or one of its friends. By default, debug logging
+        goes to stderr, unless you change the setting in wtf/DataLog.cpp.
+
+        * WTF.pro:
+
 2012-02-03  Simon Hausmann  <simon.hausmann@nokia.com>
 
         [Qt] Fix build when cross-compiling
diff --git a/Source/WTF/WTF.pro b/Source/WTF/WTF.pro
index 69d994c56..b117b0d2d 100644
--- a/Source/WTF/WTF.pro
+++ b/Source/WTF/WTF.pro
@@ -34,6 +34,7 @@ HEADERS += \
     DateMath.h \
     DecimalNumber.h \
     Decoder.h \
+    DataLog.h \ 
     Deque.h \
     DisallowCType.h \
     dtoa.h \
@@ -171,6 +172,7 @@ SOURCES += \
     CryptographicallyRandomNumber.cpp \
     CurrentTime.cpp \
     DateMath.cpp \
+    DataLog.cpp \
     DecimalNumber.cpp \
     dtoa.cpp \
     dtoa/bignum-dtoa.cc \
diff --git a/Source/WebCore/CMakeLists.txt b/Source/WebCore/CMakeLists.txt
index c583668ef..90efc6dba 100644
--- a/Source/WebCore/CMakeLists.txt
+++ b/Source/WebCore/CMakeLists.txt
@@ -1,5 +1,6 @@
 SET(WebCore_INCLUDE_DIRECTORIES
     "${WEBCORE_DIR}"
+    "${WEBCORE_DIR}/Modules/geolocation"
     "${WEBCORE_DIR}/accessibility"
     "${WEBCORE_DIR}/bindings"
     "${WEBCORE_DIR}/bindings/generic"
@@ -27,6 +28,7 @@ SET(WebCore_INCLUDE_DIRECTORIES
     "${WEBCORE_DIR}/notifications"
     "${WEBCORE_DIR}/page"
     "${WEBCORE_DIR}/page/animation"
+    "${WEBCORE_DIR}/page/scrolling"
     "${WEBCORE_DIR}/platform"
     "${WEBCORE_DIR}/platform/animation"
     "${WEBCORE_DIR}/platform/audio"
@@ -74,6 +76,7 @@ SET(WebCore_INCLUDE_DIRECTORIES
     "${JAVASCRIPTCORE_DIR}/debugger"
     "${JAVASCRIPTCORE_DIR}/interpreter"
     "${JAVASCRIPTCORE_DIR}/jit"
+    "${JAVASCRIPTCORE_DIR}/llint"
     "${JAVASCRIPTCORE_DIR}/parser"
     "${JAVASCRIPTCORE_DIR}/profiler"
     "${JAVASCRIPTCORE_DIR}/runtime"
@@ -86,6 +89,7 @@ SET(WebCore_INCLUDE_DIRECTORIES
 )
 
 SET(WebCore_IDL_INCLUDES
+    Modules/geolocation
     bindings/generic
     css
     dom
@@ -104,6 +108,13 @@ SET(WebCore_IDL_INCLUDES
 )
 
 SET(WebCore_IDL_FILES
+    Modules/geolocation/Geolocation.idl
+    Modules/geolocation/Geoposition.idl
+    Modules/geolocation/NavigatorGeolocation.idl
+    Modules/geolocation/PositionCallback.idl
+    Modules/geolocation/PositionError.idl
+    Modules/geolocation/PositionErrorCallback.idl
+
     css/Counter.idl
     css/CSSCharsetRule.idl
     css/CSSFontFaceRule.idl
@@ -205,6 +216,7 @@ SET(WebCore_IDL_FILES
     html/DOMSettableTokenList.idl
     html/DOMTokenList.idl
     html/DOMURL.idl
+    html/DOMWindowHTML.idl
     html/HTMLAllCollection.idl
     html/HTMLAnchorElement.idl
     html/HTMLAppletElement.idl
@@ -282,9 +294,6 @@ SET(WebCore_IDL_FILES
     html/MediaController.idl
     html/MediaError.idl
     html/TextMetrics.idl
-    html/TextTrack.idl
-    html/TextTrackCue.idl
-    html/TextTrackCueList.idl
     html/TimeRanges.idl
     html/ValidityState.idl
     html/VoidCallback.idl
@@ -309,6 +318,9 @@ SET(WebCore_IDL_FILES
     html/shadow/HTMLContentElement.idl
     html/shadow/HTMLShadowElement.idl
 
+    html/track/TextTrack.idl
+    html/track/TextTrackCue.idl
+    html/track/TextTrackCueList.idl
     html/track/TextTrackList.idl
     html/track/TrackEvent.idl
 
@@ -327,8 +339,6 @@ SET(WebCore_IDL_FILES
     page/DOMSelection.idl
     page/DOMWindow.idl
     page/EventSource.idl
-    page/Geolocation.idl
-    page/Geoposition.idl
     page/History.idl
     page/Location.idl
     page/MemoryInfo.idl
@@ -336,9 +346,6 @@ SET(WebCore_IDL_FILES
     page/Performance.idl
     page/PerformanceNavigation.idl
     page/PerformanceTiming.idl
-    page/PositionCallback.idl
-    page/PositionError.idl
-    page/PositionErrorCallback.idl
     page/Screen.idl
     page/SpeechInputEvent.idl
     page/SpeechInputResult.idl
@@ -384,6 +391,7 @@ SET(WebCore_IDL_FILES
     websockets/CloseEvent.idl
     websockets/DOMWindowWebSocket.idl
 
+    xml/DOMWindowXML.idl
     xml/DOMParser.idl
     xml/XMLHttpRequest.idl
     xml/XMLHttpRequestException.idl
@@ -399,6 +407,10 @@ SET(WebCore_IDL_FILES
 )
 
 SET(WebCore_SOURCES
+    Modules/geolocation/Geolocation.cpp
+    Modules/geolocation/GeolocationController.cpp
+    Modules/geolocation/NavigatorGeolocation.cpp
+
     accessibility/AXObjectCache.cpp
     accessibility/AccessibilityARIAGrid.cpp
     accessibility/AccessibilityARIAGridCell.cpp
@@ -478,7 +490,6 @@ SET(WebCore_SOURCES
     css/CSSValueList.cpp
     css/CSSValuePool.cpp
     css/CSSWrapShapes.cpp
-    css/FontFamilyValue.cpp
     css/FontFeatureValue.cpp
     css/FontValue.cpp
     css/MediaFeatureNames.cpp
@@ -489,6 +500,7 @@ SET(WebCore_SOURCES
     css/MediaQueryList.cpp
     css/MediaQueryListListener.cpp
     css/MediaQueryMatcher.cpp
+    css/PropertySetCSSStyleDeclaration.cpp
     css/RGBColor.cpp
     css/SelectorChecker.cpp
     css/ShadowValue.cpp
@@ -600,6 +612,7 @@ SET(WebCore_SOURCES
     dom/SecurityContext.cpp
     dom/SelectorQuery.cpp
     dom/ShadowRoot.cpp
+    dom/ShadowRootList.cpp
     dom/SpaceSplitString.cpp
     dom/StaticHashSetNodeList.cpp
     dom/StaticNodeList.cpp
@@ -863,10 +876,11 @@ SET(WebCore_SOURCES
     html/parser/XSSAuditor.cpp
 
     html/shadow/ContentSelectorQuery.cpp
-    html/shadow/ContentInclusionSelector.cpp
     html/shadow/DetailsMarkerControl.cpp
     html/shadow/HTMLContentElement.cpp
+    html/shadow/HTMLContentSelector.cpp
     html/shadow/HTMLShadowElement.cpp
+    html/shadow/InsertionPoint.cpp
     html/shadow/MediaControls.cpp
     html/shadow/MediaControlRootElement.cpp
     html/shadow/MeterShadowElement.cpp
@@ -878,6 +892,7 @@ SET(WebCore_SOURCES
     inspector/ContentSearchUtils.cpp
     inspector/DOMEditor.cpp
     inspector/DOMNodeHighlighter.cpp
+    inspector/DOMPatchSupport.cpp
     inspector/IdentifiersFactory.cpp
     inspector/InjectedScript.cpp
     inspector/InjectedScriptHost.cpp
@@ -890,6 +905,7 @@ SET(WebCore_SOURCES
     inspector/InspectorClient.cpp
     inspector/InspectorConsoleAgent.cpp
     inspector/InspectorController.cpp
+    inspector/InspectorCounters.cpp
     inspector/InspectorDOMAgent.cpp
     inspector/InspectorDOMDebuggerAgent.cpp
     inspector/InspectorDOMStorageAgent.cpp
@@ -980,6 +996,7 @@ SET(WebCore_SOURCES
     loader/cache/CachedResourceHandle.cpp
     loader/cache/CachedResourceLoader.cpp
     loader/cache/CachedScript.cpp
+    loader/cache/CachedSVGDocument.cpp
     loader/cache/CachedXSLStyleSheet.cpp
     loader/cache/MemoryCache.cpp
 
@@ -1009,8 +1026,6 @@ SET(WebCore_SOURCES
     page/FrameDestructionObserver.cpp
     page/FrameTree.cpp
     page/FrameView.cpp
-    page/Geolocation.cpp
-    page/GeolocationController.cpp
     page/GroupSettings.cpp
     page/History.cpp
     page/Location.cpp
@@ -1018,11 +1033,14 @@ SET(WebCore_SOURCES
     page/MouseEventWithHitTestResults.cpp
     page/Navigator.cpp
     page/NavigatorBase.cpp
+    page/NavigatorRegisterProtocolHandler.cpp
+    page/NavigatorSupplement.cpp
     page/OriginAccessEntry.cpp
     page/Page.cpp
     page/PageGroup.cpp
     page/PageGroupLoadDeferrer.cpp
     page/PageSerializer.cpp
+    page/PageSupplement.cpp
     page/PageVisibilityState.cpp
     page/Performance.cpp
     page/PerformanceNavigation.cpp
@@ -1045,6 +1063,9 @@ SET(WebCore_SOURCES
     page/animation/ImplicitAnimation.cpp
     page/animation/KeyframeAnimation.cpp
 
+    page/scrolling/ScrollingCoordinator.cpp
+    page/scrolling/ScrollingCoordinatorNone.cpp
+
     platform/Arena.cpp
     platform/CalculationValue.cpp
     platform/Clock.cpp
@@ -1053,7 +1074,6 @@ SET(WebCore_SOURCES
     platform/ContentType.cpp
     platform/CrossThreadCopier.cpp
     platform/DateComponents.cpp
-    platform/DefaultLocalizationStrategy.cpp
     platform/DragData.cpp
     platform/DragImage.cpp
     platform/FileChooser.cpp
@@ -1093,6 +1113,7 @@ SET(WebCore_SOURCES
     platform/graphics/BitmapImage.cpp
     platform/graphics/Color.cpp
     platform/graphics/CrossfadeGeneratedImage.cpp
+    platform/graphics/FractionalLayoutSize.cpp
     platform/graphics/FloatPoint.cpp
     platform/graphics/FloatPoint3D.cpp
     platform/graphics/FloatQuad.cpp
@@ -1383,8 +1404,8 @@ SET(WebCore_SOURCES
     storage/IDBFactory.cpp
     storage/IDBFactoryBackendInterface.cpp
     storage/IDBFactoryBackendImpl.cpp
-    storage/LocalStorageTask.cpp
-    storage/LocalStorageThread.cpp
+    storage/StorageTask.cpp
+    storage/StorageThread.cpp
     storage/OriginQuotaManager.cpp
     storage/OriginUsageRecord.cpp
     storage/SQLException.cpp
@@ -1583,6 +1604,7 @@ if (ENABLE_FILE_SYSTEM)
         fileapi/DOMFileSystem.cpp
         fileapi/DOMFileSystemBase.cpp
         fileapi/DOMFileSystemSync.cpp
+        fileapi/DOMWindowFileSystem.cpp
         fileapi/Entry.cpp
         fileapi/EntryArray.cpp
         fileapi/EntryArraySync.cpp
@@ -1604,6 +1626,7 @@ if (ENABLE_FILE_SYSTEM)
         fileapi/DirectoryReaderSync.idl
         fileapi/DOMFileSystem.idl
         fileapi/DOMFileSystemSync.idl
+        fileapi/DOMWindowFileSystem.idl
         fileapi/EntriesCallback.idl
         fileapi/Entry.idl
         fileapi/EntrySync.idl
@@ -1694,6 +1717,7 @@ IF (ENABLE_SVG)
         rendering/svg/SVGTextMetricsBuilder.cpp
         rendering/svg/SVGTextQuery.cpp
         svg/ColorDistance.cpp
+        svg/DOMWindowSVG.idl
         svg/SVGAElement.cpp
         svg/SVGAltGlyphDefElement.cpp
         svg/SVGAltGlyphElement.cpp
@@ -2038,6 +2062,7 @@ IF (ENABLE_WEB_SOCKETS)
         websockets/ThreadableWebSocketChannelClientWrapper.cpp
         websockets/WebSocket.cpp
         websockets/WebSocketChannel.cpp
+        websockets/WebSocketExtensionDispatcher.cpp
         websockets/WebSocketHandshake.cpp
         websockets/WebSocketHandshakeRequest.cpp
         websockets/WebSocketHandshakeResponse.cpp
@@ -2098,13 +2123,19 @@ IF (ENABLE_SHARED_WORKERS)
     )
 ENDIF ()
 
+IF (ENABLE_WORKERS OR ENABLE_SHARED_WORKERS)
+    LIST(APPEND WebCore_IDL_FILES
+        workers/DOMWindowWorker.idl
+    )
+ENDIF ()
+
 IF (ENABLE_VIDEO_TRACK)
     LIST(APPEND WebCore_SOURCES
         html/HTMLTrackElement.cpp
-        html/LoadableTextTrack.cpp
-        html/TextTrack.cpp
-        html/TextTrackCue.cpp
-        html/TextTrackCueList.cpp
+        html/track/LoadableTextTrack.cpp
+        html/track/TextTrack.cpp
+        html/track/TextTrackCue.cpp
+        html/track/TextTrackCueList.cpp
         html/track/TextTrackList.cpp
         html/track/TrackBase.cpp
         html/track/TrackEvent.cpp
@@ -2240,6 +2271,19 @@ IF (ENABLE_REQUEST_ANIMATION_FRAME)
     )
 ENDIF ()
 
+IF (ENABLE_VIBRATION)
+    LIST(APPEND WebCore_INCLUDE_DIRECTORIES
+        ${WEBCORE_DIR}/Modules/vibration
+    )
+    LIST(APPEND WebCore_IDL_FILES
+        Modules/vibration/NavigatorVibration.idl
+    )
+    LIST(APPEND WebCore_SOURCES
+        Modules/vibration/NavigatorVibration.cpp
+        Modules/vibration/Vibration.cpp
+    )
+ENDIF ()
+
 # Modules that the bindings generator scripts may use
 SET(SCRIPTS_RESOLVE_SUPPLEMENTAL
     ${WEBCORE_DIR}/bindings/scripts/IDLParser.pm
@@ -2252,12 +2296,13 @@ SET(SCRIPTS_BINDINGS
 )
 SET(IDL_FILES_TMP ${DERIVED_SOURCES_WEBCORE_DIR}/idl_files.tmp)
 SET(SUPPLEMENTAL_DEPENDENCY_FILE ${DERIVED_SOURCES_WEBCORE_DIR}/supplemental_dependency.tmp)
+SET(IDL_ATTRIBUTES_FILE ${WEBCORE_DIR}/bindings/scripts/IDLAttributes.txt)
 
 INCLUDE(${WEBCORE_DIR}/UseJSC.cmake)
 
 SET(WebCore_LIBRARIES ${JavaScriptCore_LIBRARY_NAME})
 SET(WebCore_LINK_FLAGS "")
-INCLUDE_IF_EXISTS(${WEBCORE_DIR}/Platform${PORT}.cmake)
+WEBKIT_INCLUDE_CONFIG_FILES_IF_EXISTS()
 
 # ANGLE tokenizer & parser
 ADD_CUSTOM_COMMAND(
diff --git a/Source/WebCore/ChangeLog b/Source/WebCore/ChangeLog
index b15d4c227..b0b5bdf70 100644
--- a/Source/WebCore/ChangeLog
+++ b/Source/WebCore/ChangeLog
@@ -1,3 +1,19849 @@
+2012-02-24  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        [Qt] Font related problem with newer Qt5
+        https://bugs.webkit.org/show_bug.cgi?id=79402
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Apply the descent += 1 workaround needed to produce correct metrics only for Qt 4,
+        because the behaviour has been corrected in Qt 5.
+
+        * platform/graphics/qt/SimpleFontDataQt.cpp:
+        (WebCore::SimpleFontData::platformInit):
+
+2012-02-24  Kentaro Hara  <haraken@chromium.org>
+
+        Move XML-related APIs from DOMWindow.idl to DOMWindowXML.idl
+        https://bugs.webkit.org/show_bug.cgi?id=79434
+
+        Reviewed by Adam Barth.
+
+        For WebKit modularization, this patch moves XML-related APIs
+        from DOMWindow.idl to DOMWIndowXML.idl.
+
+        No tests. No change in behavior.
+
+        * xml/DOMWindowXML.idl: Added.
+        * page/DOMWindow.idl:
+
+        * CMakeLists.txt: Added "DOMWindowXML.idl".
+        * DerivedSources.make: Ditto.
+        * DerivedSources.pri: Ditto.
+        * GNUmakefile.list.am: Ditto.
+        * WebCore.gypi: Ditto.
+        * WebCore.xcodeproj/project.pbxproj: Ditto.
+
+2012-02-24  Renata Hodovan  <reni@webkit.org>
+
+        External <use> xlink:href references do not work
+        https://bugs.webkit.org/show_bug.cgi?id=12499
+
+        Reviewed by Nikolas Zimmermann.
+
+        Support external references on <use> by introducing CachedSVGDocument.
+        CachedSVGDocument is a CachedResource specialized for SVGDocuments.
+        This CachedSVGDocument will be stored for every use element with external reference.
+        This first patch only contains the new classes to test whether it works on every platform.
+        So they aren't used anywhere and just a follow-up patch will bind them into the caching system.
+
+        No new tests - no change in functionality.
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * Target.pri:
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * loader/cache/CachedResource.cpp:
+        (WebCore::defaultPriorityForResourceType):
+        (WebCore::cachedResourceTypeToTargetType):
+        * loader/cache/CachedResource.h:
+        * loader/cache/CachedResourceClient.h:
+        (CachedResourceClient):
+        * loader/cache/CachedResourceLoader.cpp:
+        (WebCore::createResource):
+        (WebCore::CachedResourceLoader::checkInsecureContent):
+        (WebCore::CachedResourceLoader::canRequest):
+        * loader/cache/CachedSVGDocument.cpp: Added.
+        (WebCore):
+        (WebCore::CachedSVGDocument::CachedSVGDocument):
+        (WebCore::CachedSVGDocument::~CachedSVGDocument):
+        (WebCore::CachedSVGDocument::setEncoding):
+        (WebCore::CachedSVGDocument::encoding):
+        (WebCore::CachedSVGDocument::data):
+        * loader/cache/CachedSVGDocument.h: Added.
+        (WebCore):
+        (CachedSVGDocument):
+        (WebCore::CachedSVGDocument::document):
+        (WebCore::CachedSVGDocument::schedule):
+        (CachedSVGDocumentClient):
+        (WebCore::CachedSVGDocumentClient::~CachedSVGDocumentClient):
+        (WebCore::CachedSVGDocumentClient::expectedType):
+        (WebCore::CachedSVGDocumentClient::resourceClientType):
+
+2012-02-24  Alexis Menard  <alexis.menard@openbossa.org>
+
+        Little optimization in CSSParser::parseShorthand.
+        https://bugs.webkit.org/show_bug.cgi?id=79356
+
+        Reviewed by Tony Chang.
+
+        Remove one loop by initializing array values at declaration time.
+        Also early return when the number of properties parsed are equals
+        with longhands count of the shorthand. It happens to be very often
+        the case (e.g. border). Instruments shows an improvement from 19ms
+        to 17ms on the time spent in this function for the css-parser-yui
+        benchmark.
+
+        No new tests : refactor, exisiting ones should cover.
+
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseShorthand):
+
+2012-02-24  Kentaro Hara  <haraken@chromium.org>
+
+        Move HTML-related APIs from DOMWindow.idl to DOMWindowHTML.idl
+        https://bugs.webkit.org/show_bug.cgi?id=79436
+
+        Reviewed by Adam Barth.
+
+        For WebKit modularization, this patch moves HTML-related APIs
+        from DOMWindow.idl to DOMWindowHTML.idl.
+
+        No tests. No change in behavior.
+
+        * html/DOMWindowHTML.idl:
+        * page/DOMWindow.idl:
+
+2012-02-24  Jochen Eisinger  <jochen@chromium.org>
+
+        [v8] when a named item on document goes out of scope, actually remove it
+        https://bugs.webkit.org/show_bug.cgi?id=79409
+
+        Reviewed by Adam Barth.
+
+        The original change already included the code, but it led to some
+        problems, so it was reverted in http://trac.webkit.org/changeset/63845.
+        However, not removing the items leaks a considerable amount of memory,
+        so I'm adding the code back. The bug that led to the revert was that
+        the accessor was removed unconditionally. I'm now only removing it,
+        when the last item with that name is removed.
+
+        Test: fast/dom/HTMLDocument/named-item.html
+
+        * bindings/v8/V8DOMWindowShell.cpp:
+        (WebCore::V8DOMWindowShell::namedItemRemoved):
+
+2012-02-24  Kentaro Hara  <haraken@chromium.org>
+
+        Move Worker-related APIs from DOMWindow.idl to DOMWindowWorker.idl
+        https://bugs.webkit.org/show_bug.cgi?id=79442
+
+        Reviewed by Adam Barth.
+
+        For WebKit modularization, this patch moves Worker-related APIs
+        from DOMWindow.idl to DOMWindowWorker.idl.
+
+        No tests. No change in behavior.
+
+        * workers/DOMWindowWorker.idl: Added.
+        * page/DOMWindow.idl:
+
+        * CMakeLists.txt:
+        * DerivedSources.make:
+        * DerivedSources.pri:
+        * GNUmakefile.list.am:
+        * WebCore.gypi:
+
+2012-02-24  Robin Cao  <robin.cao@torchmobile.com.cn>
+
+        [BlackBerry] Upstream helper classes for skia
+        https://bugs.webkit.org/show_bug.cgi?id=79216
+
+        Reviewed by Antonio Gomes.
+
+        Initial upstreaming, no new tests.
+
+        * platform/graphics/blackberry/skia/ImageBufferData.h: Added.
+        (WebCore):
+        (ImageBufferData):
+        * platform/graphics/blackberry/skia/PlatformSupport.cpp: Added.
+        (WebCore):
+        (WebCore::setFontRenderStyleDefaults):
+        (WebCore::PlatformSupport::getRenderStyleForStrike):
+        (WebCore::PlatformSupport::getFontFamilyForCharacters):
+        * platform/graphics/blackberry/skia/PlatformSupport.h: Added.
+        (WebCore):
+        (PlatformSupport):
+        (FontFamily):
+
+2012-02-24  Robin Cao  <robin.cao@torchmobile.com.cn>
+
+        [BlackBerry] Upstream ImageBlackBerry in platform/graphics/blackberry
+        https://bugs.webkit.org/show_bug.cgi?id=79212
+
+        Reviewed by Antonio Gomes.
+
+        Initial upstreaming, no new tests.
+
+        * PlatformBlackBerry.cmake:
+        * platform/graphics/blackberry/ImageBlackBerry.cpp: Added.
+        (WebCore):
+        (WebCore::Image::loadPlatformResource):
+
+2012-02-24  Leo Yang  <leo.yang@torchmobile.com.cn>
+
+        [BlackBerry] Upstream the BlackBerry change to platform/graphics/IntSize.h
+        https://bugs.webkit.org/show_bug.cgi?id=79430
+
+        Reviewed by Antonio Gomes.
+
+        Add conversion convenience between WebCore::IntSize and BlackBerry::Platform::IntSize.
+
+        The porting can't be built yet, no new tests.
+
+        * platform/graphics/IntSize.h:
+        (Platform):
+        (IntSize):
+
+2012-02-24  Shinya Kawanaka  <shinyak@chromium.org>
+
+        SpellCheckRequest needs to know the context where the spellcheck happened.
+        https://bugs.webkit.org/show_bug.cgi?id=79320
+
+        Reviewed by Hajime Morita.
+
+        WebKit clients should be able to get the context how the spellcheck happended.
+        For example, WebKit clients may want to change the behavior by a spellcheck request is
+        invoked in typing or in pasting.
+
+        This patch added an enum in SpellCheckRequest so that WebKit clients can understand the context.
+
+        * editing/Editor.cpp:
+        (WebCore::Editor::replaceSelectionWithFragment):
+        (WebCore::Editor::markAllMisspellingsAndBadGrammarInRanges):
+        * editing/SpellChecker.cpp:
+        (WebCore::SpellCheckRequest::SpellCheckRequest):
+        (WebCore::SpellCheckRequest::create):
+        (WebCore::SpellChecker::invokeRequest):
+        * editing/SpellChecker.h:
+        (SpellCheckRequest):
+        (WebCore::SpellCheckRequest::textCheckingRequest):
+        (WebCore::SpellCheckRequest::processType):
+        * loader/EmptyClients.h:
+        (WebCore::EmptyTextCheckerClient::requestCheckingOfString):
+        * platform/text/TextCheckerClient.h:
+        (WebCore):
+        (TextCheckerClient):
+        * platform/text/TextChecking.h:
+        (TextCheckingRequest):
+        (WebCore::TextCheckingRequest::TextCheckingRequest):
+        (WebCore::TextCheckingRequest::setSequence):
+        (WebCore::TextCheckingRequest::sequence):
+        (WebCore::TextCheckingRequest::text):
+        (WebCore::TextCheckingRequest::mask):
+        (WebCore::TextCheckingRequest::processType):
+        (WebCore):
+
+2012-02-24  Hayato Ito  <hayato@chromium.org>
+
+        Make Node::showTreeForThis (and Node::showTreeForThisAcrossFrame) dump multiple shadow roots.
+        https://bugs.webkit.org/show_bug.cgi?id=79351
+
+        Reviewed by Dimitri Glazkov.
+
+        No new tests since these utility functions are only available in debug build.
+        I manually tested in GDB session.
+
+        * dom/Node.cpp:
+        (WebCore::oldestShadowRootFor):
+        (WebCore::traverseTreeAndMark):
+        (WebCore::parentOrHostOrFrameOwner):
+        (WebCore::showSubTreeAcrossFrame):
+        * dom/ShadowRoot.h:
+        (WebCore::ShadowRoot::youngerShadowRoot):
+        (WebCore::ShadowRoot::olderShadowRoot):
+        (WebCore::toShadowRoot):
+        (WebCore):
+
+2012-02-24  Pavel Feldman  <pfeldman@chromium.org>
+
+        Not reviewed: follow up to inspector's r108331, using more general condition.
+
+        * inspector/front-end/JavaScriptSourceFrame.js:
+        (WebInspector.JavaScriptSourceFrame.prototype._getPopoverAnchor):
+
+2012-02-24  Kentaro Hara  <haraken@chromium.org>
+
+        Move WebGL APIs from DOMWindow.idl to DOMWindowWebGL.idl
+        https://bugs.webkit.org/show_bug.cgi?id=79432
+
+        Reviewed by Adam Barth.
+
+        For WebKit modularization, this patch moves WebGL-related APIs
+        from DOMWindow.idl to DOMWindowWebGL.idl.
+
+        No tests. No change in behavior.
+
+        * html/canvas/DOMWindowWebGL.idl: Added.
+        * page/DOMWindow.idl:
+
+        * DerivedSources.make: Added DOMWindowWebGL.idl.
+        * DerivedSources.pri: Ditto.
+        * GNUmakefile.list.am: Ditto.
+        * WebCore.gypi: Ditto.
+        * WebCore.xcodeproj/project.pbxproj: Ditto.
+
+2012-02-24  Vsevolod Vlasov  <vsevik@chromium.org>
+
+        Web Inspector: [Regression] network worker tests crash on qt.
+        https://bugs.webkit.org/show_bug.cgi?id=79263
+
+        Reviewed by Pavel Feldman.
+
+        * inspector/InspectorPageAgent.cpp:
+        (WebCore::InspectorPageAgent::createDecoder):
+        (WebCore::InspectorPageAgent::cachedResourceContent):
+
+2012-02-24  Andreas Kling  <awesomekling@apple.com>
+
+        Miscellaneous CSSParser dodging in presentation attribute parsing.
+        <http://webkit.org/b/79468>
+
+        Reviewed by Antti Koivisto.
+
+        - Bypass CSSParser when adding constant values to attribute styles.
+        - Added fast paths for the valid HTMLTablePartElement align values.
+
+        * html/HTMLEmbedElement.cpp:
+        (WebCore::HTMLEmbedElement::collectStyleForAttribute):
+        * html/HTMLHRElement.cpp:
+        (WebCore::HTMLHRElement::collectStyleForAttribute):
+        * html/HTMLIFrameElement.cpp:
+        (WebCore::HTMLIFrameElement::collectStyleForAttribute):
+        * html/HTMLTableElement.cpp:
+        (WebCore::HTMLTableElement::collectStyleForAttribute):
+        * html/HTMLTablePartElement.cpp:
+        (WebCore::HTMLTablePartElement::collectStyleForAttribute):
+
+2012-02-24  Dana Jansens  <danakj@chromium.org>
+
+        [chromium] Avoid culling work for fully-non-opaque tiles, and add tracing for draw culling
+        https://bugs.webkit.org/show_bug.cgi?id=79183
+
+        Reviewed by James Robinson.
+
+        Addresses performance issues with draw culling by avoiding the work
+        of mapRect and other function calls when the quad has no opaque area.
+        And adds a TRACE_EVENT to watch the time spent in draw culling.
+
+        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.cpp:
+        (WebCore::CCLayerTreeHostImpl::optimizeRenderPasses):
+        * platform/graphics/chromium/cc/CCQuadCuller.cpp:
+        (WebCore::CCQuadCuller::cullOccludedQuads):
+
+2012-02-24  Vsevolod Vlasov  <vsevik@chromium.org>
+
+        Web Inspector: Scripts panel navigator overlay should be shown automatically only one time.
+        https://bugs.webkit.org/show_bug.cgi?id=79467
+
+        Reviewed by Pavel Feldman.
+
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel.prototype._hideNavigatorOverlay):
+        (WebInspector.ScriptsPanel.prototype._navigatorOverlayWillHide):
+
+2012-02-23  MORITA Hajime  <morrita@google.com>
+
+        Adding a ShadowRoot to image-backed element causes a crash
+        https://bugs.webkit.org/show_bug.cgi?id=78878
+
+        Reviewed by Dimitri Glazkov.
+
+        The crash happened because NodeRenderingContext tried to append a
+        child to a renderer regardless one isn't capable of holding any
+        children if it appears in the shadow attaching phase. RenderImage
+        is one of such renderer classes which aren't capable.
+
+        NodeRenderingContext decide whether the contextual node as a child
+        can create its renderer based on RenderObject::canHaveChildren()
+        and Node::childShouldCreateRenderer(). But the responsibility
+        between these two methods are getting confused. which results this
+        unfortuante crash path.
+
+        This change re-aligns the responsibility:
+
+        - Now canHaveChildren() purely declares the ability of the
+          renderer. If the renderer is capable of having children, it
+          return true regardless of HTML semantics.
+
+        - On the other hand, childShouldCreateRenderer() cares about the
+          semantics. If the element doesn't allow children to be rendered,
+          this returns false.
+
+        - Note that these decision on elements are contextual. Each element
+          needs to know which role it is playing in the tree composition
+          algorithm of Shadow DOM. That's why the method parameter is changed
+          from Node* to NodeRenderingContext.
+
+        - Fixed updateFirstLetter() which relied on this confused assumption.
+          This change introduces RenderDeprecatedFlexibleBox::buttonText()
+          to refine the relying assumption.
+
+        With this change, some decision points are moved from a renderer to an
+        element. Following renderers no longer stop reject having children:
+
+        - RenderButton, RenderListBox, RenderMenuList, RenderMeter,
+          RenderProgress, RenderTextControl.
+
+        Corresponding element for such a render (HTMLProgressElement of
+        RenderProgress for exaple) now cares about that.
+
+        Reviewed by Dimitri Glazkov.
+
+        Tests: fast/dom/shadow/shadow-on-image-expected.html
+               fast/dom/shadow/shadow-on-image.html
+
+        * dom/Element.cpp:
+        (WebCore::Element::childShouldCreateRenderer):
+        * dom/Element.h:
+        (Element):
+        * dom/Node.h:
+        (WebCore::Node::childShouldCreateRenderer):
+        * dom/NodeRenderingContext.cpp:
+        (WebCore::NodeRenderingContext::shouldCreateRenderer):
+        * dom/NodeRenderingContext.h:
+        (NodeRenderingContext):
+        (WebCore::NodeRenderingContext::isOnEncapsulationBoundary):
+        (WebCore):
+        * html/HTMLDetailsElement.cpp:
+        (WebCore::HTMLDetailsElement::childShouldCreateRenderer):
+        * html/HTMLDetailsElement.h:
+        (HTMLDetailsElement):
+        * html/HTMLMediaElement.cpp:
+        (WebCore):
+        (WebCore::HTMLMediaElement::childShouldCreateRenderer):
+        * html/HTMLMediaElement.h:
+        (HTMLMediaElement):
+        * html/HTMLMeterElement.cpp:
+        (WebCore::HTMLMeterElement::childShouldCreateRenderer):
+        (WebCore):
+        * html/HTMLMeterElement.h:
+        (HTMLMeterElement):
+        * html/HTMLProgressElement.cpp:
+        (WebCore::HTMLProgressElement::childShouldCreateRenderer):
+        (WebCore):
+        * html/HTMLProgressElement.h:
+        (HTMLProgressElement):
+        * html/HTMLSelectElement.cpp:
+        (WebCore::HTMLSelectElement::childShouldCreateRenderer):
+        (WebCore):
+        * html/HTMLSelectElement.h:
+        (HTMLSelectElement):
+        * html/HTMLSummaryElement.cpp:
+        (WebCore::HTMLSummaryElement::childShouldCreateRenderer):
+        (WebCore):
+        * html/HTMLSummaryElement.h:
+        (HTMLSummaryElement):
+        * html/HTMLTextFormControlElement.cpp:
+        (WebCore::HTMLTextFormControlElement::childShouldCreateRenderer):
+        (WebCore):
+        * html/HTMLTextFormControlElement.h:
+        (HTMLTextFormControlElement):
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::updateFirstLetter):
+        * rendering/RenderButton.cpp:
+        * rendering/RenderButton.h:
+        (RenderButton):
+        * rendering/RenderDeprecatedFlexibleBox.h:
+        (WebCore::RenderDeprecatedFlexibleBox::buttonText):
+        * rendering/RenderListBox.h:
+        (RenderListBox):
+        * rendering/RenderMedia.h:
+        (WebCore::RenderMedia::canHaveChildren):
+        * rendering/RenderMenuList.h:
+        (RenderMenuList):
+        (WebCore::RenderMenuList::hasControlClip):
+        * rendering/RenderMeter.h:
+        * rendering/RenderProgress.h:
+        * rendering/RenderTextControl.h:
+        * rendering/svg/RenderSVGRoot.h:
+        (WebCore::RenderSVGRoot::canHaveChildren):
+        * svg/SVGAElement.cpp:
+        (WebCore::SVGAElement::childShouldCreateRenderer):
+        * svg/SVGAElement.h:
+        (SVGAElement):
+        * svg/SVGAltGlyphElement.cpp:
+        (WebCore::SVGAltGlyphElement::childShouldCreateRenderer):
+        * svg/SVGAltGlyphElement.h:
+        (SVGAltGlyphElement):
+        * svg/SVGDocument.cpp:
+        (WebCore::SVGDocument::childShouldCreateRenderer):
+        * svg/SVGDocument.h:
+        (SVGDocument):
+        * svg/SVGElement.cpp:
+        (WebCore::SVGElement::childShouldCreateRenderer):
+        * svg/SVGElement.h:
+        (SVGElement):
+        * svg/SVGForeignObjectElement.cpp:
+        (WebCore::SVGForeignObjectElement::childShouldCreateRenderer):
+        * svg/SVGForeignObjectElement.h:
+        (SVGForeignObjectElement):
+        * svg/SVGSwitchElement.cpp:
+        (WebCore::SVGSwitchElement::childShouldCreateRenderer):
+        * svg/SVGSwitchElement.h:
+        (SVGSwitchElement):
+        * svg/SVGTRefElement.cpp:
+        (WebCore::SVGTRefElement::childShouldCreateRenderer):
+        * svg/SVGTRefElement.h:
+        (SVGTRefElement):
+        * svg/SVGTSpanElement.cpp:
+        (WebCore::SVGTSpanElement::childShouldCreateRenderer):
+        * svg/SVGTSpanElement.h:
+        (SVGTSpanElement):
+        * svg/SVGTextElement.cpp:
+        (WebCore::SVGTextElement::childShouldCreateRenderer):
+        * svg/SVGTextElement.h:
+        (SVGTextElement):
+        * svg/SVGTextPathElement.cpp:
+        (WebCore::SVGTextPathElement::childShouldCreateRenderer):
+        * svg/SVGTextPathElement.h:
+
+2012-02-24  Kentaro Hara  <haraken@chromium.org>
+
+        Support [Supplemental] on static methods
+        https://bugs.webkit.org/show_bug.cgi?id=79357
+
+        Reviewed by Adam Barth.
+
+        [Supplemental] on static methods does not work in CodeGeneratorJS.pm
+        and CodeGeneratorV8.pm due to mis-ordered if-elsif statements.
+        This patch fixes it and supports [Supplemental] on static methods.
+
+        Test: bindings/scripts/test/TestSupplemental.idl
+
+        * bindings/scripts/CodeGeneratorJS.pm: Modified as described above.
+        (GenerateParametersCheck):
+        * bindings/scripts/CodeGeneratorV8.pm: Ditto.
+        (GenerateFunctionCallString):
+
+        * bindings/scripts/test/TestSupplemental.idl: Added a test case.
+
+        * bindings/scripts/test/CPP/WebDOMTestInterface.cpp: Updated run-bindings-tests results.
+        (WebDOMTestInterface::supplementalMethod4):
+        * bindings/scripts/test/CPP/WebDOMTestInterface.h: Ditto.
+        * bindings/scripts/test/GObject/WebKitDOMTestInterface.cpp: Ditto.
+        (webkit_dom_test_interface_supplemental_method4):
+        * bindings/scripts/test/GObject/WebKitDOMTestInterface.h: Ditto.
+        * bindings/scripts/test/JS/JSTestInterface.cpp: Ditto.
+        (WebCore):
+        (WebCore::JSTestInterfaceConstructor::getOwnPropertySlot):
+        (WebCore::JSTestInterfaceConstructor::getOwnPropertyDescriptor):
+        (WebCore::jsTestInterfaceConstructorFunctionSupplementalMethod4):
+        * bindings/scripts/test/JS/JSTestInterface.h: Ditto.
+        (WebCore):
+        * bindings/scripts/test/ObjC/DOMTestInterface.h: Ditto.
+        * bindings/scripts/test/ObjC/DOMTestInterface.mm: Ditto.
+        (-[DOMTestInterface supplementalMethod4]):
+        * bindings/scripts/test/V8/V8TestInterface.cpp: Ditto.
+        (TestInterfaceInternal):
+        (WebCore::TestInterfaceInternal::supplementalMethod4Callback):
+        (WebCore::ConfigureV8TestInterfaceTemplate):
+
+2012-02-24  Tony Chang  <tony@chromium.org>
+
+        Small refactor in RenderFlexibleBox::layoutAndPlaceChildren
+        https://bugs.webkit.org/show_bug.cgi?id=79420
+
+        Reviewed by Ojan Vafai.
+
+        No new tests, just a refactor.
+
+        * rendering/RenderFlexibleBox.cpp:
+        (WebCore::RenderFlexibleBox::layoutAndPlaceChildren): Share some of the logic
+        in computing the cross axis length.
+
+2012-02-24  Yury Semikhatsky  <yurys@chromium.org>
+
+        Web Inspector: cannot drag timeline overview window when clicking inside the window
+        https://bugs.webkit.org/show_bug.cgi?id=79453
+
+        Reviewed by Pavel Feldman.
+
+        * inspector/front-end/timelinePanel.css:
+        (.timeline-overview-window-rulers):
+
+2012-02-24  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r108731.
+        http://trac.webkit.org/changeset/108731
+        https://bugs.webkit.org/show_bug.cgi?id=79464
+
+        Broke Chromium Win tests (Requested by bashi on #webkit).
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * Target.pri:
+        * WebCore.gyp/WebCore.gyp:
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * websockets/WebSocket.cpp:
+        (WebCore::WebSocket::didConnect):
+        * websockets/WebSocketChannel.cpp:
+        (WebCore::WebSocketChannel::connect):
+        (WebCore::WebSocketChannel::fail):
+        (WebCore::WebSocketChannel::processFrame):
+        (WebCore::WebSocketChannel::sendFrame):
+        * websockets/WebSocketChannel.h:
+        * websockets/WebSocketDeflateFramer.cpp: Removed.
+        * websockets/WebSocketDeflateFramer.h: Removed.
+
+2012-02-22  Vsevolod Vlasov  <vsevik@chromium.org>
+
+        Web Inspector: Show scripts panel navigator overlay on the first scripts panel opening.
+        https://bugs.webkit.org/show_bug.cgi?id=79248
+
+        Reviewed by Pavel Feldman.
+
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel.prototype.wasShown):
+        (WebInspector.ScriptsPanel.prototype.set _showNavigatorOverlay):
+        (WebInspector.ScriptsPanel.prototype._hideNavigatorOverlay):
+
+2012-02-24  Mike Lawther  <mikelawther@chromium.org>
+
+        CSS3 calc(): handle non-negative values
+        https://bugs.webkit.org/show_bug.cgi?id=79188
+
+        Reviewed by Daniel Bates.
+
+        Some CSS properties (e.g. padding) are required to be non-negative. These
+        are now restricted to the correct range.
+
+        Tests: css3/calc/negative-padding-expected.html
+               css3/calc/negative-padding.html
+
+        * css/CSSCalculationValue.cpp:
+        (WebCore):
+        (WebCore::CSSCalcValue::clampToPermittedRange): Added
+        (WebCore::CSSCalcValue::doubleValue):
+        (WebCore::CSSCalcValue::isNegative): Added
+        (WebCore::CSSCalcValue::computeLengthPx):
+        (WebCore::CSSCalcValue::create):
+        * css/CSSCalculationValue.h:
+        (CSSCalcValue):
+        (WebCore::CSSCalcValue::CSSCalcValue):
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::validCalculationUnit):
+        (WebCore::CSSParser::parseCalculation):
+        * css/CSSParser.h:
+        * platform/CalculationValue.h:
+
+2012-02-22  Vsevolod Vlasov  <vsevik@chromium.org>
+
+        Web Inspector: [Regression] xhr tests are crashing after r108506.
+        https://bugs.webkit.org/show_bug.cgi?id=79265
+
+        Reviewed by Pavel Feldman.
+
+        * inspector/InspectorResourceAgent.cpp:
+        (WebCore::InspectorResourceAgent::setInitialScriptContent):
+        (WebCore::InspectorResourceAgent::setInitialXHRContent):
+
+2012-02-24  Huang Dongsung  <luxtella@company100.net>
+
+        Rename LocalStorageThread to StorageThread and LocalStorageTask to StorageTask.
+        https://bugs.webkit.org/show_bug.cgi?id=79358
+
+        Revision 45124 commented FIXME to rename these classes.
+
+        Reviewed by Kentaro Hara.
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * Target.pri:
+        * WebCore.gypi:
+        * WebCore.order:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * storage/LocalStorageTask.h: Removed.
+        * storage/StorageSyncManager.cpp:
+        (WebCore::StorageSyncManager::StorageSyncManager):
+        (WebCore::StorageSyncManager::scheduleImport):
+        (WebCore::StorageSyncManager::scheduleSync):
+        (WebCore::StorageSyncManager::scheduleDeleteEmptyDatabase):
+        * storage/StorageSyncManager.h:
+        (WebCore):
+        (StorageSyncManager):
+        * storage/StorageTask.cpp: Renamed from Source/WebCore/storage/LocalStorageTask.cpp.
+        (WebCore):
+        (WebCore::StorageTask::StorageTask):
+        (WebCore::StorageTask::~StorageTask):
+        (WebCore::StorageTask::performTask):
+        * storage/StorageTask.h: Added.
+        (WebCore):
+        (StorageTask):
+        (WebCore::StorageTask::createImport):
+        (WebCore::StorageTask::createSync):
+        (WebCore::StorageTask::createDeleteEmptyDatabase):
+        (WebCore::StorageTask::createOriginIdentifiersImport):
+        (WebCore::StorageTask::createSetOriginDetails):
+        (WebCore::StorageTask::createDeleteOrigin):
+        (WebCore::StorageTask::createDeleteAllOrigins):
+        (WebCore::StorageTask::createTerminate):
+        * storage/StorageThread.cpp: Renamed from Source/WebCore/storage/LocalStorageThread.cpp.
+        (WebCore):
+        (WebCore::StorageThread::create):
+        (WebCore::StorageThread::StorageThread):
+        (WebCore::StorageThread::~StorageThread):
+        (WebCore::StorageThread::start):
+        (WebCore::StorageThread::threadEntryPointCallback):
+        (WebCore::StorageThread::threadEntryPoint):
+        (WebCore::StorageThread::scheduleTask):
+        (WebCore::StorageThread::terminate):
+        (WebCore::StorageThread::performTerminate):
+        * storage/StorageThread.h: Renamed from Source/WebCore/storage/LocalStorageThread.h.
+        (WebCore):
+        (StorageThread):
+        * storage/StorageTracker.cpp:
+        (WebCore::StorageTracker::StorageTracker):
+        (WebCore::StorageTracker::importOriginIdentifiers):
+        (WebCore::StorageTracker::setOriginDetails):
+        (WebCore::StorageTracker::scheduleTask):
+        (WebCore::StorageTracker::deleteAllOrigins):
+        (WebCore::StorageTracker::deleteOrigin):
+        * storage/StorageTracker.h:
+        (WebCore):
+        (StorageTracker):
+        * storage/wince/StorageThreadWinCE.cpp: Renamed from Source/WebCore/storage/wince/LocalStorageThreadWinCE.cpp.
+        (WebCore):
+        (WebCore::StorageThread::StorageThread):
+        (WebCore::StorageThread::~StorageThread):
+        (WebCore::StorageThread::start):
+        (WebCore::StorageThread::timerFired):
+        (WebCore::StorageThread::scheduleImport):
+        (WebCore::StorageThread::scheduleSync):
+        (WebCore::StorageThread::terminate):
+        (WebCore::StorageThread::performTerminate):
+        * storage/wince/StorageThreadWinCE.h: Renamed from Source/WebCore/storage/wince/LocalStorageThreadWinCE.h.
+        (WebCore):
+        (StorageThread):
+        (WebCore::StorageThread::create):
+
+2012-02-23  Pavel Feldman  <pfeldman@chromium.org>
+
+        Web Inspector: prepare border images on timelines to enable zooming.
+        https://bugs.webkit.org/show_bug.cgi?id=79360
+
+        Reviewed by Yury Semikhatsky.
+
+        * inspector/front-end/Images/timelineBarBlue.png:
+        * inspector/front-end/Images/timelineBarGray.png:
+        * inspector/front-end/Images/timelineBarGreen.png:
+        * inspector/front-end/Images/timelineBarOrange.png:
+        * inspector/front-end/Images/timelineBarPurple.png:
+        * inspector/front-end/Images/timelineBarRed.png:
+        * inspector/front-end/Images/timelineBarYellow.png:
+        * inspector/front-end/Images/timelineHollowPillBlue.png:
+        * inspector/front-end/Images/timelineHollowPillGray.png:
+        * inspector/front-end/Images/timelineHollowPillGreen.png:
+        * inspector/front-end/Images/timelineHollowPillOrange.png:
+        * inspector/front-end/Images/timelineHollowPillPurple.png:
+        * inspector/front-end/Images/timelineHollowPillRed.png:
+        * inspector/front-end/Images/timelineHollowPillYellow.png:
+        * inspector/front-end/Images/timelinePillBlue.png:
+        * inspector/front-end/Images/timelinePillGray.png:
+        * inspector/front-end/Images/timelinePillGreen.png:
+        * inspector/front-end/Images/timelinePillOrange.png:
+        * inspector/front-end/Images/timelinePillPurple.png:
+        * inspector/front-end/Images/timelinePillRed.png:
+        * inspector/front-end/Images/timelinePillYellow.png:
+        * inspector/front-end/inspectorCommon.css:
+        (body):
+        * inspector/front-end/networkLogView.css:
+        (.network-graph-bar):
+        (.resource-cached .network-graph-bar):
+        (.network-category-documents .network-graph-bar):
+        (.network-category-documents.resource-cached .network-graph-bar):
+        (.network-category-stylesheets .network-graph-bar):
+        (.network-category-stylesheets.resource-cached .network-graph-bar):
+        (.network-category-images.resource-cached .network-graph-bar):
+        (.network-category-fonts .network-graph-bar):
+        (.network-category-fonts.resource-cached .network-graph-bar):
+        (.network-category-scripts .network-graph-bar):
+        (.network-category-scripts.resource-cached .network-graph-bar):
+        (.network-category-xhr .network-graph-bar):
+        (.network-category-xhr.resource-cached .network-graph-bar):
+        (.network-category-websockets .network-graph-bar):
+        (.network-category-websockets.resource-cached .network-graph-bar):
+
+2012-02-23  Yury Semikhatsky  <yurys@chromium.org>
+
+        Web Inspector: exception in front-end on selecting an element in heap snapshot
+        https://bugs.webkit.org/show_bug.cgi?id=79447
+
+        Fixed a typo in method name and added a check that selected node has
+        corresponding heap snapshot object before adding that object to the console
+        as $0 entry.
+
+        Reviewed by Pavel Feldman.
+
+        * inspector/front-end/DetailedHeapshotView.js:
+        (WebInspector.DetailedHeapshotView.prototype._inspectedObjectChanged):
+
+2012-02-23  Pavel Feldman  <pfeldman@chromium.org>
+
+        Web Inspector: hide color picker upon panel switch.
+        https://bugs.webkit.org/show_bug.cgi?id=79355
+
+        Reviewed by Vsevolod Vlasov.
+
+        * inspector/front-end/ElementsPanel.js:
+        (WebInspector.ElementsPanel.prototype.willHide):
+        * inspector/front-end/StylesSidebarPane.js:
+        (WebInspector.StylesSidebarPane.prototype._showUserAgentStylesSettingChanged):
+        (WebInspector.StylesSidebarPane.prototype.willHide):
+
+2012-02-23  Pavel Feldman  <pfeldman@chromium.org>
+
+        Web Inspector: make color review larger in the color picker.
+        https://bugs.webkit.org/show_bug.cgi?id=79339
+
+        Reviewed by Vsevolod Vlasov.
+
+        * inspector/front-end/Popover.js:
+        (WebInspector.Popover.prototype.hide):
+        * inspector/front-end/Spectrum.js:
+        * inspector/front-end/elementsPanel.css:
+        (.spectrum-container):
+        (.spectrum-color):
+        (.spectrum-display-value):
+        (.spectrum-hue):
+        (.spectrum-fill):
+        (.spectrum-range-container label):
+        (.spectrum-range-container input):
+        (.spectrum-slider):
+        (.spectrum-container .swatch):
+        * inspector/front-end/inspector.css:
+        (.swatch):
+
+2012-02-23  Kenichi Ishibashi  <bashi@chromium.org>
+
+        [Chromium] Add HarfBuzzShaperBase class
+        https://bugs.webkit.org/show_bug.cgi?id=79336
+
+        Extract a part of ComplexTextControllerHarfBuzz class as
+        HarfBuzzShaperBase class. This patch intends to share the code between
+        old HarfBuzz and HarfBuzz-ng.
+
+        Reviewed by Tony Chang.
+
+        No new tests. No behavior change. Existing tests in fast/text should pass.
+
+        * PlatformBlackBerry.cmake: Added HarfBuzzShaperBase.cpp.
+        * WebCore.gyp/WebCore.gyp: Added HarfBuzzShaperBase.(cpp|h).
+        * WebCore.gypi: Ditto.
+        * platform/graphics/harfbuzz/ComplexTextControllerHarfBuzz.cpp:
+        (WebCore::ComplexTextController::ComplexTextController): Removed redundant arguments.
+        (WebCore::ComplexTextController::nextScriptRun): Use m_normalizedBuffer and m_normalizedBufferLength instead of m_run.
+        (WebCore::ComplexTextController::setupFontForScriptRun): Ditto.
+        (WebCore::ComplexTextController::setGlyphPositions): Ditto.
+        * platform/graphics/harfbuzz/ComplexTextControllerHarfBuzz.h:
+        (ComplexTextController):
+        * platform/graphics/harfbuzz/FontHarfBuzz.cpp:
+        (WebCore::Font::drawComplexText): Removed redundant arguments of ComplexTextController constructor.
+        (WebCore::Font::floatWidthForComplexText): Ditto.
+        (WebCore::Font::offsetForPositionForComplexText): Ditto.
+        (WebCore::Font::selectionRectForComplexText): Ditto.
+        * platform/graphics/harfbuzz/HarfBuzzShaperBase.cpp: Added.
+        (WebCore):
+        (WebCore::HarfBuzzShaperBase::HarfBuzzShaperBase):
+        (WebCore::normalizeSpacesAndMirrorChars):
+        (WebCore::HarfBuzzShaperBase::setNormalizedBuffer):
+        (WebCore::HarfBuzzShaperBase::isWordEnd):
+        (WebCore::HarfBuzzShaperBase::determineWordBreakSpacing):
+        (WebCore::HarfBuzzShaperBase::setPadding):
+        * platform/graphics/harfbuzz/HarfBuzzShaperBase.h: Added.
+        (WebCore):
+        (HarfBuzzShaperBase):
+        (WebCore::HarfBuzzShaperBase::~HarfBuzzShaperBase):
+        (WebCore::HarfBuzzShaperBase::isCodepointSpace):
+
+2012-02-23  Kenichi Ishibashi  <bashi@chromium.org>
+
+        Adding WebSocket per-frame DEFLATE extension
+        https://bugs.webkit.org/show_bug.cgi?id=77522
+
+        Add WebSocketDeflateFramer class which handles deflate-frame extension.
+        This class encapsulates WebSocketDeflater and WebSocketInflater classes,
+        which depend on zlib, so that WebSocketChannel is not necessary to aware
+        zlib dependency.
+
+        This is the second patch to land. The previous patch broke Chromium Win
+        release build. r108600 should fix the build failure. I also added
+        zlib entry to |export_dependent_settings| of |webcore_prerequisites|
+        target.
+
+        Reviewed by Kent Tamura.
+
+        Tests: http/tests/websocket/tests/hybi/compressed-control-frame.html
+               http/tests/websocket/tests/hybi/deflate-frame-comp-bit-onoff.html
+               http/tests/websocket/tests/hybi/deflate-frame-invalid-parameter.html
+               http/tests/websocket/tests/hybi/deflate-frame-parameter.html
+
+        * CMakeLists.txt: Added WebSocketDeflateFramer.(cpp|h)
+        * GNUmakefile.list.am: Ditto.
+        * Target.pri: Ditto.
+        * WebCore.gypi: Ditto.
+        * WebCore.gyp/WebCore.gyp: Added zlib dependency.
+        * WebCore.vcproj/WebCore.vcproj: Added WebSocketDeflateFramer.(cpp|h)
+        * WebCore.xcodeproj/project.pbxproj: Ditto.
+        * websockets/WebSocket.cpp:
+        (WebCore::WebSocket::didConnect): Set m_extensions.
+        * websockets/WebSocketChannel.cpp:
+        (WebCore::WebSocketChannel::connect): Add deflate-frame extension processor to WebSocketHanshake if deflate can use.
+        (WebCore::WebSocketChannel::fail): Call m_deflateFramer.didFail().
+        (WebCore::WebSocketChannel::processFrame): Decompress frames if needed.
+        (WebCore::WebSocketChannel::sendFrame): Compress frames if possible.
+        * websockets/WebSocketChannel.h:
+        * websockets/WebSocketDeflateFramer.cpp: Added.
+        (WebCore):
+        (WebSocketExtensionDeflateFrame):
+        (WebCore::WebSocketExtensionDeflateFrame::create):
+        (WebCore::WebSocketExtensionDeflateFrame::~WebSocketExtensionDeflateFrame):
+        (WebCore::WebSocketExtensionDeflateFrame::WebSocketExtensionDeflateFrame):
+        (WebCore::WebSocketExtensionDeflateFrame::handshakeString):
+        (WebCore::WebSocketExtensionDeflateFrame::processResponse):
+        (WebCore::DeflateResultHolder::DeflateResultHolder):
+        (WebCore::DeflateResultHolder::~DeflateResultHolder):
+        (WebCore::DeflateResultHolder::fail):
+        (WebCore::InflateResultHolder::InflateResultHolder):
+        (WebCore::InflateResultHolder::~InflateResultHolder):
+        (WebCore::InflateResultHolder::fail):
+        (WebCore::WebSocketDeflateFramer::WebSocketDeflateFramer):
+        (WebCore::WebSocketDeflateFramer::createExtensionProcessor):
+        (WebCore::WebSocketDeflateFramer::canDeflate):
+        (WebCore::WebSocketDeflateFramer::enableDeflate):
+        (WebCore::WebSocketDeflateFramer::deflate):
+        (WebCore::WebSocketDeflateFramer::resetDeflateContext):
+        (WebCore::WebSocketDeflateFramer::inflate):
+        (WebCore::WebSocketDeflateFramer::resetInflateContext):
+        (WebCore::WebSocketDeflateFramer::didFail):
+        * websockets/WebSocketDeflateFramer.h: Added.
+        (WebCore):
+        (DeflateResultHolder):
+        (WebCore::DeflateResultHolder::succeeded):
+        (WebCore::DeflateResultHolder::failureReason):
+        (InflateResultHolder):
+        (WebCore::InflateResultHolder::succeeded):
+        (WebCore::InflateResultHolder::failureReason):
+        (WebSocketDeflateFramer):
+        (WebCore::WebSocketDeflateFramer::enabled):
+
+2012-02-23  Andy Estes  <aestes@apple.com>
+
+        Rename [setS|s]uppressIncrementalRendering to [setS|s]uppressesIncrementalRendering and make it WebPreferences API.
+        https://bugs.webkit.org/show_bug.cgi?id=79433
+
+        Reviewed by Dan Bernstein.
+
+        * dom/Document.cpp:
+        (WebCore::Document::implicitClose):
+        (WebCore::Document::visualUpdatesAllowed):
+        * page/Settings.cpp:
+        (WebCore::Settings::Settings):
+        * page/Settings.h:
+        (WebCore::Settings::setSuppressesIncrementalRendering):
+        (WebCore::Settings::suppressesIncrementalRendering):
+        (Settings):
+
+2012-02-23  Erik Arvidsson  <arv@chromium.org>
+
+        Rename DOMWindow to Window in the bindings
+        https://bugs.webkit.org/show_bug.cgi?id=78721
+
+        Reviewed by Adam Barth.
+
+        Covered by existing tests.
+
+        * inspector/front-end/DetailedHeapshotGridNodes.js:
+        (WebInspector.HeapSnapshotGenericObjectNode):
+        (WebInspector.HeapSnapshotGenericObjectNode.prototype.isWindow):
+        * inspector/front-end/HeapSnapshot.js:
+        (WebInspector.HeapSnapshotNode.prototype.get isWindow):
+        (WebInspector.HeapSnapshot.prototype._calculateObjectToWindowDistance):
+        (WebInspector.HeapSnapshot.prototype._markQueriableHeapObjects):
+        * page/DOMWindow.idl:
+
+2012-02-23  Shinya Kawanaka  <shinyak@chromium.org>
+
+        NodeRenderingContext should have ShadowRootList instead of ShadowRoot.
+        https://bugs.webkit.org/show_bug.cgi?id=79079
+
+        Reviewed by Dimitri Glazkov.
+
+        Apparently NodeRenderingContext should have ShadowRootList instead of ShadowRoot.
+        This patch changes it.
+
+        No new tests. Simple refactoring.
+
+        * dom/NodeRenderingContext.cpp:
+        (WebCore::NodeRenderingContext::NodeRenderingContext):
+        (WebCore::NodeRenderingContext::hostChildrenChanged):
+        (WebCore::NodeRenderingContext::shouldCreateRenderer):
+        * dom/NodeRenderingContext.h:
+        (WebCore):
+
+2012-02-23  Ian Vollick  <vollick@chromium.org>
+
+        [chromium] Implement keyframed animations for the cc thread.
+        https://bugs.webkit.org/show_bug.cgi?id=77229
+
+        Reviewed by James Robinson.
+
+        * WebCore.gypi:
+        * platform/graphics/chromium/LayerChromium.cpp:
+        (WebCore::LayerChromium::hasActiveAnimation):
+        (WebCore):
+        * platform/graphics/chromium/LayerChromium.h:
+        (LayerChromium):
+        * platform/graphics/chromium/cc/CCActiveAnimation.cpp:
+        (WebCore::CCActiveAnimation::CCActiveAnimation):
+        (WebCore::CCActiveAnimation::isFinishedAt):
+        (WebCore::CCActiveAnimation::trimTimeToCurrentIteration):
+        (WebCore::CCActiveAnimation::cloneForImplThread):
+        * platform/graphics/chromium/cc/CCActiveAnimation.h:
+        (WebCore::CCActiveAnimation::curve):
+        (CCActiveAnimation):
+        * platform/graphics/chromium/cc/CCKeyframedAnimationCurve.cpp: Added.
+        (WebCore::CCKeyframedFloatAnimationCurve::create):
+        (WebCore):
+        (WebCore::CCKeyframedFloatAnimationCurve::CCKeyframedFloatAnimationCurve):
+        (WebCore::CCKeyframedFloatAnimationCurve::~CCKeyframedFloatAnimationCurve):
+        (WebCore::CCKeyframedFloatAnimationCurve::duration):
+        (WebCore::CCKeyframedFloatAnimationCurve::clone):
+        (WebCore::CCKeyframedFloatAnimationCurve::getValue):
+        (WebCore::CCKeyframedTransformAnimationCurve::create):
+        (WebCore::CCKeyframedTransformAnimationCurve::CCKeyframedTransformAnimationCurve):
+        (WebCore::CCKeyframedTransformAnimationCurve::~CCKeyframedTransformAnimationCurve):
+        (WebCore::CCKeyframedTransformAnimationCurve::duration):
+        (WebCore::CCKeyframedTransformAnimationCurve::clone):
+        (WebCore::CCKeyframedTransformAnimationCurve::getValue):
+        * platform/graphics/chromium/cc/CCKeyframedAnimationCurve.h: Added.
+        (WebCore):
+        (WebCore::CCFloatKeyframe::CCFloatKeyframe):
+        (CCFloatKeyframe):
+        (WebCore::CCTransformKeyframe::CCTransformKeyframe):
+        (CCTransformKeyframe):
+        (CCKeyframedFloatAnimationCurve):
+        (CCKeyframedTransformAnimationCurve):
+        * platform/graphics/chromium/cc/CCLayerAnimationController.cpp:
+        (WebCore::CCLayerAnimationController::addAnimation):
+        * platform/graphics/chromium/cc/CCLayerAnimationController.h:
+        (WebCore::CCLayerAnimationController::hasActiveAnimation):
+        (CCLayerAnimationController):
+        * platform/graphics/chromium/cc/CCLayerAnimationControllerImpl.cpp:
+        (WebCore::CCLayerAnimationControllerImpl::tickAnimations):
+
+2012-02-23  Raymond Toy  <rtoy@google.com>
+
+        Use MathExtras round() in timeToSampleFrame
+        https://bugs.webkit.org/show_bug.cgi?id=79281
+
+        Reviewed by Chris Rogers.
+
+        No new tests. Existing tests cover this change.
+
+        * platform/audio/AudioUtilities.cpp:
+        (WebCore::AudioUtilities::timeToSampleFrame): Use round(). 
+
+2012-02-23  Greg Billock  <gbillock@google.com>
+
+        Don't clear IntentRequest callback pointers on stop()
+
+        This causes re-entry into ScriptExecutionContext when
+        the ActiveDOMCallback objects get deleted, which crashes.
+        Instead, just de-activate the object and wait for
+        context destruction to clean up.
+
+        Test crashes consistently without fix and passes with fix.
+        Added some test infrastructure to support this test.
+        https://bugs.webkit.org/show_bug.cgi?id=78638
+
+        Reviewed by Adam Barth.
+
+        * Modules/intents/IntentRequest.cpp:
+        (WebCore::IntentRequest::IntentRequest):
+        (WebCore::IntentRequest::stop):
+        (WebCore::IntentRequest::postResult):
+        (WebCore::IntentRequest::postFailure):
+        * Modules/intents/IntentRequest.h:
+        (IntentRequest):
+
+2012-02-23  Konrad Piascik  <kpiascik@rim.com>
+
+        Upstream BlackBerry Cookie Management Classes
+        https://bugs.webkit.org/show_bug.cgi?id=73654
+
+        Reviewed by Rob Buis.
+
+        Added ManualTests/cookieSpeedTest.html as well as tested functionality
+        on the BlackBerry port with http://testsuites.opera.com/cookies/
+        Passes all non Cookie 2 tests since Cookie 2 is not implemented/supported at this time.
+        Error handling and extended tests do not all pass and will be updated with future bugs/patches.
+
+        * platform/blackberry/CookieDatabaseBackingStore/CookieDatabaseBackingStore.cpp: Added.
+        * platform/blackberry/CookieDatabaseBackingStore/CookieDatabaseBackingStore.h: Added.
+        * platform/blackberry/CookieJarBlackBerry.cpp: Added.
+        * platform/blackberry/CookieManager.cpp: Added.
+        * platform/blackberry/CookieManager.h: Added.
+        * platform/blackberry/CookieMap.cpp: Added.
+        * platform/blackberry/CookieMap.h: Added.
+        * platform/blackberry/CookieParser.cpp: Added.
+        * platform/blackberry/CookieParser.h: Added.
+        * platform/blackberry/ParsedCookie.cpp: Added.
+        * platform/blackberry/ParsedCookie.h: Added.
+
+2012-02-23  Levi Weintraub  <leviw@chromium.org>
+
+        Switch drawLineForBoxSide to use integers
+        https://bugs.webkit.org/show_bug.cgi?id=78647
+
+        Reviewed by Eric Seidel.
+
+        drawLineForBoxSide handles painting lines for boxes which must be done on pixel boundaries.
+        Its interface doesn't make it possible to pixel snap properly within the function itself --
+        it draws one side of the box at a time, and the logical right and bottom lines can only be
+        properly determined using the logical top and left positions -- so it needs to be treated 
+        like a graphics context function, whereby the caller handles the proper pixel snapping before
+        passing the values in.
+
+        No new tests. No change in behavior.
+
+        * rendering/LayoutTypes.h:
+        (WebCore::pixelSnappedIntRectFromEdges): convenience function for returning a pixel snapped
+        int rect from four LayoutUnits that are its edges (as opposed to position and size).
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::paintColumnRules): Pixel snapping the column rule rect.
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::RenderBoxModelObject::paintOneBorderSide): Side rects are now IntRects by the time
+        they get to paintOneBorderSide.
+        (WebCore::calculateSideRect): Properly use RoundedRect as IntRects instead of LayoutRects.
+        (WebCore::RenderBoxModelObject::paintBorderSides): Ditto.
+        (WebCore::RenderBoxModelObject::paintBorder): Ditto.
+        (WebCore::calculateSideRectIncludingInner): Ditto.
+        * rendering/RenderBoxModelObject.h:
+        (RenderBoxModelObject):
+        * rendering/RenderInline.cpp:
+        (WebCore::RenderInline::paintOutlineForLine): Outline widths are related to borders and stored
+        as ints. Removing an unnecessary conversion to LayoutUnits. Pixel snapping the edges of the box.
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::drawLineForBoxSide): Moving back to integers and removing an
+        unnecessary pixelSnappedIntRect call.
+        (WebCore::RenderObject::paintOutline): Pixel snapping the column rule rect and using an integer
+        for outlineOffset.
+        * rendering/RenderObject.h:
+        (RenderObject):
+
+2012-02-23  Leo Yang  <leo.yang@torchmobile.com.cn>
+
+        [BlackBerry] Upstream the BlackBerry change to platform/graphics/IntPoint.h
+        https://bugs.webkit.org/show_bug.cgi?id=79094
+
+        Reviewed by Antonio Gomes.
+
+        Add conversion convenience between WebCore::IntPoint and BlackBerry::Platform::IntPoint.
+
+        The porting can't be built yet, no new tests.
+
+        * platform/graphics/IntPoint.h:
+        (Platform):
+        (IntPoint):
+
+2012-02-23  Justin Novosad  <junov@chromium.org>
+
+        [Chromium] Add profiling trace for deferred canvas rendering
+        https://bugs.webkit.org/show_bug.cgi?id=79376
+
+        Reviewed by Stephen White.
+
+        No new tests.
+
+        * platform/graphics/chromium/Canvas2DLayerChromium.cpp:
+        (WebCore::Canvas2DLayerChromium::paintContentsIfDirty):
+        Profiling trace for the entire method, as well as for
+        calls to canvas flush and context flush, both of which may
+        cause deferred operation to be executed.
+        * platform/graphics/skia/PlatformContextSkia.cpp:
+        (WebCore::PlatformContextSkia::bitmap):
+        Inserting a profiling trace in this method because it may cause
+        deferred draw commands to be executed.
+
+2012-02-23  Shinya Kawanaka  <shinyak@chromium.org>
+
+        ShadowRootList should have recalculation flag instead of ShadowRoot.
+        https://bugs.webkit.org/show_bug.cgi?id=79071
+
+        Reviewed by Hajime Morita.
+
+        When light children or shadow children are changed, we currently re-construct a shadow subtree.
+        However, when supporting multiple shadow subtrees, all shadow subtrees should be re-constructed.
+        So ShadowRootList should have re-construction flag instead of ShadowRoot.
+
+        Also, re-construction methods in ShadowRoot should be moved to ShadowRootList.
+
+        No new tests, should be convered by existing tests.
+
+        * dom/Element.cpp:
+        (WebCore::Element::recalcStyle):
+        (WebCore::Element::childrenChanged):
+        * dom/NodeRenderingContext.cpp:
+        (WebCore::NodeRenderingContext::hostChildrenChanged):
+        * dom/ShadowRoot.cpp:
+        (WebCore::ShadowRoot::ShadowRoot):
+        (WebCore::ShadowRoot::list):
+        * dom/ShadowRoot.h:
+        (WebCore):
+        (ShadowRoot):
+        * dom/ShadowRootList.cpp:
+        (WebCore::ShadowRootList::ShadowRootList):
+        (WebCore::ShadowRootList::reattach):
+        (WebCore):
+        (WebCore::ShadowRootList::childNeedsStyleRecalc):
+        (WebCore::ShadowRootList::needsStyleRecalc):
+        (WebCore::ShadowRootList::recalcShadowTreeStyle):
+        (WebCore::ShadowRootList::needsReattachHostChildrenAndShadow):
+        (WebCore::ShadowRootList::hostChildrenChanged):
+        (WebCore::ShadowRootList::setNeedsReattachHostChildrenAndShadow):
+        (WebCore::ShadowRootList::reattachHostChildrenAndShadow):
+        * dom/ShadowRootList.h:
+        (WebCore):
+        (ShadowRootList):
+        (WebCore::ShadowRootList::clearNeedsReattachHostChildrenAndShadow):
+        * html/shadow/HTMLContentElement.cpp:
+        (WebCore::HTMLContentElement::attach):
+        (WebCore::HTMLContentElement::detach):
+        (WebCore::HTMLContentElement::parseAttribute):
+
+2012-02-23  Roland Steiner  <rolandsteiner@chromium.org>
+
+        Unreviewed: add clause in ASSERT missing from r108474.
+
+        No new tests. (fix)
+
+        * html/HTMLStyleElement.cpp:
+        (WebCore::HTMLStyleElement::willRemove):
+
+2012-02-23  Eric Seidel  <eric@webkit.org>
+
+        Split out HTML constructors into new DOMWindowHTML suplemental idl
+        https://bugs.webkit.org/show_bug.cgi?id=79377
+
+        Reviewed by Adam Barth.
+
+        * CMakeLists.txt:
+        * DerivedSources.make:
+        * DerivedSources.pri:
+        * GNUmakefile.list.am:
+        * WebCore.gypi:
+        * WebCore.xcodeproj/project.pbxproj:
+        * html/DOMWindowHTML.idl: Added.
+        * page/DOMWindow.idl:
+
+2012-02-23  Eric Seidel  <eric@webkit.org>
+
+        Move SVG element constructors out of DOMWindow.idl into a new DOMWindowSVG.idl suplemental
+        https://bugs.webkit.org/show_bug.cgi?id=79379
+
+        Reviewed by Adam Barth.
+
+        * CMakeLists.txt:
+        * DerivedSources.make:
+        * DerivedSources.pri:
+        * GNUmakefile.list.am:
+        * WebCore.gypi:
+        * WebCore.xcodeproj/project.pbxproj:
+        * page/DOMWindow.idl:
+        * svg/DOMWindowSVG.idl: Added.
+
+2012-02-23  Jonathan Backer  <backer@chromium.org>
+
+        [chromium] Plumb video damage to the damage tracker.
+        https://bugs.webkit.org/show_bug.cgi?id=79373
+
+        Reviewed by James Robinson.
+
+        * platform/graphics/chromium/VideoLayerChromium.cpp:
+        (WebCore::VideoLayerChromium::contentChanged):
+        (WebCore):
+        * platform/graphics/chromium/VideoLayerChromium.h:
+        (VideoLayerChromium):
+
+2012-02-23  MORITA Hajime  <morrita@google.com>
+
+        This test checks select attribute of content element is valid.
+        https://bugs.webkit.org/show_bug.cgi?id=65595
+
+        Reviewed by Dimitri Glazkov.
+
+        This change introduces FrameTree::scopedChild() and
+        FrameTree::scopedChild(), which can be used for scope-aware
+        frame lookup. Using these, the named accessor and the indexed
+        acceccor on Document, and Window.length are now TreeScope
+        aware. They don't count iframes in Shadow DOM.
+
+        This change also removes FrameTree::m_childCount since
+        Frame::childCount() is no longer in the hot
+        path. m_scopedChildCount is added instead.
+
+        Test: fast/dom/shadow/iframe-shadow.html
+
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::childFrameGetter):
+        (WebCore::indexGetter):
+        (WebCore::JSDOMWindow::getOwnPropertySlot):
+        (WebCore::JSDOMWindow::getOwnPropertyDescriptor):
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::V8DOMWindow::indexedPropertyGetter):
+        (WebCore::V8DOMWindow::namedPropertyGetter):
+        (WebCore::V8DOMWindow::namedSecurityCheck):
+        (WebCore::V8DOMWindow::indexedSecurityCheck):
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::length):
+        * page/Frame.cpp:
+        (WebCore::Frame::inScope):
+        (WebCore):
+        * page/Frame.h:
+        (WebCore):
+        (Frame):
+        * page/FrameTree.cpp:
+        (WebCore::FrameTree::actuallyAppendChild):
+        (WebCore::FrameTree::removeChild):
+        (WebCore::FrameTree::scopedChild):
+        (WebCore):
+        (WebCore::FrameTree::scopedChildCount):
+        (WebCore::FrameTree::childCount):
+        * page/FrameTree.h:
+        (WebCore):
+        (FrameTree):
+        (WebCore::FrameTree::FrameTree):
+
+2012-02-23  Philip Rogers  <pdr@google.com>
+
+        Recompute font metrics on scale changes
+        https://bugs.webkit.org/show_bug.cgi?id=75091
+
+        Reviewed by Nikolas Zimmermann.
+
+        SVG text metrics depend on the transform from renderer to the svg root
+        which requires that we propagate transform changes down to text.
+        This change adds a boolean for tracking transform changes to
+        SVGViewportContainers and SVGTransformableContainers, and updates
+        RenderSVGText::layout() to recalculate text metrics if the transform
+        of an ancestor has changed.
+
+        Tests: platform/mac/svg/text/text-rescale.html
+               platform/mac/svg/text/text-viewbox-rescale.html
+               svg/text/text-rescale.html
+               svg/text/text-viewbox-rescale.html
+
+        * rendering/RenderObject.h:
+        (WebCore::RenderObject::isSVGTransformableContainer):
+        (WebCore::RenderObject::isSVGViewportContainer):
+        * rendering/svg/RenderSVGContainer.h:
+        (WebCore::RenderSVGContainer::didTransformToRootUpdate):
+        * rendering/svg/RenderSVGInlineText.cpp:
+        (WebCore::RenderSVGInlineText::computeNewScaledFontForStyle):
+        * rendering/svg/RenderSVGText.cpp:
+        (WebCore::RenderSVGText::RenderSVGText):
+        (WebCore::RenderSVGText::layout):
+        * rendering/svg/RenderSVGText.h:
+        (WebCore::RenderSVGText::setNeedsTextMetricsUpdate):
+        (RenderSVGText):
+        * rendering/svg/RenderSVGTransformableContainer.cpp:
+        (WebCore::RenderSVGTransformableContainer::RenderSVGTransformableContainer):
+        (WebCore::RenderSVGTransformableContainer::calculateLocalTransform):
+        * rendering/svg/RenderSVGTransformableContainer.h:
+        (WebCore::RenderSVGTransformableContainer::isSVGTransformableContainer):
+        (WebCore::RenderSVGTransformableContainer::didTransformToRootUpdate):
+        (RenderSVGTransformableContainer):
+        * rendering/svg/RenderSVGViewportContainer.cpp:
+        (WebCore::RenderSVGViewportContainer::RenderSVGViewportContainer):
+        (WebCore::RenderSVGViewportContainer::calcViewport):
+        * rendering/svg/RenderSVGViewportContainer.h:
+        (WebCore::RenderSVGViewportContainer::didTransformToRootUpdate):
+        (RenderSVGViewportContainer):
+        * rendering/svg/SVGRenderSupport.cpp:
+        (WebCore::SVGRenderSupport::transformToRootChanged):
+        (WebCore):
+        (WebCore::SVGRenderSupport::layoutChildren):
+        * rendering/svg/SVGRenderSupport.h:
+        (SVGRenderSupport):
+
+2012-02-21  James Robinson  <jamesr@chromium.org>
+
+        [chromium] Notify compositor of wheel event registration via ScrollingCoordinator
+        https://bugs.webkit.org/show_bug.cgi?id=79133
+
+        Reviewed by Dimitri Glazkov.
+
+        This notifies the chromium compositor of changes to the number of wheel event handlers via ScrollingCoordinator
+        instead of through ChromeClient/WebViewImpl. This is the path we'll use for other properties in the future and
+        is more extensible for handling things other than the root layer.
+
+        Property behavior is covered by new unit tests in LayerChromiumTests and CCLayerTreeHostImplTest.
+
+        * page/scrolling/ScrollingCoordinator.cpp:
+        * page/scrolling/ScrollingCoordinator.h:
+        (WebCore):
+        (ScrollingCoordinator):
+            Add a ScrollingCoordinatorPrivate so implementations can tack on additional data without having to #ifdef up
+            ScrollingCoordinator.h/cpp
+        * page/scrolling/ScrollingCoordinatorNone.cpp:
+        (WebCore):
+        (WebCore::ScrollingCoordinator::~ScrollingCoordinator):
+        * page/scrolling/chromium/ScrollingCoordinatorChromium.cpp:
+        (ScrollingCoordinatorPrivate):
+            ScrollingCoordinatorPrivate in the chromium implementation keeps a reference to the scroll layer.
+        (WebCore::ScrollingCoordinatorPrivate::ScrollingCoordinatorPrivate):
+        (WebCore::ScrollingCoordinatorPrivate::~ScrollingCoordinatorPrivate):
+        (WebCore::ScrollingCoordinatorPrivate::setScrollLayer):
+        (WebCore::ScrollingCoordinatorPrivate::scrollLayer):
+        (WebCore):
+        (WebCore::ScrollingCoordinator::create):
+        (WebCore::ScrollingCoordinator::~ScrollingCoordinator):
+        (WebCore::ScrollingCoordinator::frameViewHorizontalScrollbarLayerDidChange):
+        (WebCore::ScrollingCoordinator::frameViewVerticalScrollbarLayerDidChange):
+        (WebCore::ScrollingCoordinator::setScrollLayer):
+        (WebCore::ScrollingCoordinator::setNonFastScrollableRegion):
+        (WebCore::ScrollingCoordinator::setScrollParameters):
+        (WebCore::ScrollingCoordinator::setWheelEventHandlerCount):
+        (WebCore::ScrollingCoordinator::setShouldUpdateScrollLayerPositionOnMainThread):
+        * page/scrolling/mac/ScrollingCoordinatorMac.mm:
+        (WebCore):
+        (WebCore::ScrollingCoordinator::~ScrollingCoordinator):
+        * platform/graphics/chromium/LayerChromium.cpp:
+        (WebCore::LayerChromium::LayerChromium):
+        (WebCore::LayerChromium::setHaveWheelEventHandlers):
+        (WebCore):
+        (WebCore::LayerChromium::pushPropertiesTo):
+        * platform/graphics/chromium/LayerChromium.h:
+        (LayerChromium):
+        * platform/graphics/chromium/cc/CCInputHandler.h:
+        * platform/graphics/chromium/cc/CCLayerImpl.cpp:
+        (WebCore::CCLayerImpl::CCLayerImpl):
+        * platform/graphics/chromium/cc/CCLayerImpl.h:
+        (WebCore::CCLayerImpl::haveWheelEventHandlers):
+        (WebCore::CCLayerImpl::setHaveWheelEventHandlers):
+        (CCLayerImpl):
+        * platform/graphics/chromium/cc/CCLayerTreeHost.cpp:
+        (WebCore::CCLayerTreeHost::CCLayerTreeHost):
+        (WebCore::CCLayerTreeHost::finishCommitOnImplThread):
+        * platform/graphics/chromium/cc/CCLayerTreeHost.h:
+        (CCLayerTreeHost):
+        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.cpp:
+        (WebCore::CCLayerTreeHostImpl::CCLayerTreeHostImpl):
+        (WebCore::CCLayerTreeHostImpl::scrollBegin):
+        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.h:
+        (CCLayerTreeHostImpl):
+
+2012-02-23  No'am Rosenthal  <noam.rosenthal@nokia.com>
+
+        [Qt][WK2] Clipping is broken
+        https://bugs.webkit.org/show_bug.cgi?id=78677
+
+        Reviewed by Simon Hausmann.
+
+        Rework the clipping stack in TextureMapperGL.
+        Instead of saving a stack of IntRect scissor clips, we save every clipping change in the
+        stack, and reapply it when we end the clip. Popping the stack is almost free, since we
+        don't reapply the stencil but simply change the stencil test index.
+
+        In addition, we don't use a special shader for clipping, and we don't apply clipping for
+        masked children, since they're already clipped because they're rendered into an intermediate
+        buffer.
+
+        This fixes exiting tests in LayoutTests/compositing/overflow.
+        It also fixes asserts in the leaves demo, as well as asserts in nytimes.com and other sites.
+
+        * page/FrameView.cpp:
+        (WebCore::FrameView::paintContents):
+        * platform/graphics/texmap/TextureMapperGL.cpp:
+        (ClipState):
+        (WebCore::TextureMapperGLData::SharedGLData::ClipState::ClipState):
+        (SharedGLData):
+        (WebCore::TextureMapperGLData::SharedGLData::pushClipState):
+        (WebCore::TextureMapperGLData::SharedGLData::popClipState):
+        (WebCore::TextureMapperGLData::SharedGLData::scissorClip):
+        (WebCore::TextureMapperGLData::SharedGLData::applyCurrentClip):
+        (TextureMapperGLData):
+        (BitmapTextureGL):
+        (WebCore::TextureMapperGLData::initStencil):
+        (WebCore):
+        (WebCore::TextureMapperGL::beginPainting):
+        (WebCore::TextureMapperGL::endPainting):
+        (WebCore::TextureMapperGL::drawTexture):
+        (WebCore::BitmapTextureGL::initStencil):
+        (WebCore::BitmapTextureGL::bind):
+        (WebCore::BitmapTextureGL::destroy):
+        (WebCore::TextureMapperGL::bindSurface):
+        (WebCore::TextureMapperGL::beginScissorClip):
+        (WebCore::TextureMapperGL::beginClip):
+        (WebCore::TextureMapperGL::endClip):
+        * platform/graphics/texmap/TextureMapperLayer.cpp:
+        (WebCore::TextureMapperLayer::paintSelfAndChildren):
+        * platform/graphics/texmap/TextureMapperShaderManager.cpp:
+        * platform/graphics/texmap/TextureMapperShaderManager.h:
+
+2012-02-23  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r108685.
+        http://trac.webkit.org/changeset/108685
+        https://bugs.webkit.org/show_bug.cgi?id=79414
+
+        Broke Chromium builds (Requested by enne on #webkit).
+
+        * Target.pri:
+        * WebCore.pri:
+        * platform/MIMETypeRegistry.cpp:
+        (WebCore::initializeSupportedImageMIMETypes):
+        (WebCore::initializeSupportedImageMIMETypesForEncoding):
+        * platform/image-decoders/ImageDecoder.h:
+        (WebCore::ImageFrame::getAddr):
+        (ImageFrame):
+        * platform/image-decoders/jpeg/JPEGImageDecoder.cpp:
+        * platform/image-decoders/png/PNGImageDecoder.cpp:
+        (WebCore):
+        * platform/image-decoders/qt/ImageFrameQt.cpp:
+
+2012-02-23  Koji Ishii  <kojiishi@gmail.com>
+
+        CSS2:text-decoration: <rt> element should not inherit text-decoration property
+        https://bugs.webkit.org/show_bug.cgi?id=71266
+
+        Reviewed by Kentaro Hara.
+
+        Tests: fast/ruby/text-decoration-in-descendants-ruby-expected.html
+               fast/ruby/text-decoration-in-descendants-ruby.html
+
+        The spec says "text decorations are not propagated to any out-of-flow descendants":
+        http://www.w3.org/TR/2011/WD-css3-text-20110901/#decoration
+        Floats etc. are fixed in bug 18611, but <rt> is not inline either and therefore
+        it should be included; it was confirmed at a discussion at www-style.
+        http://lists.w3.org/Archives/Public/www-style/2011Sep/0238.html
+
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::getTextDecorationColors):
+
+2012-02-23  Zoltan Horvath  <zoltan@webkit.org>
+
+        [Qt] Allow to use WebCore imagedecoders
+        https://bugs.webkit.org/show_bug.cgi?id=32410
+
+        Add ENABLE(QT_IMAGE_DECODER) guards around Qt imagedecoders and set it to default.
+        By passing ENABLE_QT_IMAGE_DECODER=0 define to the build system WebKit will build
+        with WebCore's imagedecoders.
+
+        I added NO_RETURN attribute to 2 functions of PNG and JPEG decoders to avoid compiler warnings
+        because in Qt-port we treat warning as errors (-Werror).
+
+        I'm continuing the refactoring of this area and try to use Qt imagedecoders only in 
+        cases when WebCore doesn't support the image format.
+
+        Reviewed by Simon Hausmann.
+
+        No behavior change, no need new tests.
+
+        * Target.pri:
+        * WebCore.pri:
+        * platform/MIMETypeRegistry.cpp:
+        (WebCore::initializeSupportedImageMIMETypes):
+        (WebCore::initializeSupportedImageMIMETypesForEncoding):
+        * platform/image-decoders/ImageDecoder.h:
+        (WebCore::ImageFrame::getAddr):
+        (ImageFrame):
+        * platform/image-decoders/jpeg/JPEGImageDecoder.cpp:
+        NO_RETURN has been added to a function to avoid warning message.
+        * platform/image-decoders/png/PNGImageDecoder.cpp:
+        NO_RETURN has been added to a function to avoid warning message.
+        (WebCore):
+        * platform/image-decoders/qt/ImageFrameQt.cpp:
+        (WebCore):
+        (WebCore::ImageFrame::asNewNativeImage):
+
+2012-02-23  Dana Jansens  <danakj@chromium.org>
+
+        [chromium] Push CCLayerIteratorPosition struct into CCLayerIterator class.
+        https://bugs.webkit.org/show_bug.cgi?id=75864
+
+        Reviewed by James Robinson.
+
+        * platform/graphics/chromium/cc/CCLayerIterator.cpp:
+        (WebCore::CCLayerIteratorActions::BackToFront::begin):
+        (WebCore::CCLayerIteratorActions::BackToFront::end):
+        (WebCore::CCLayerIteratorActions::BackToFront::next):
+        (WebCore::CCLayerIteratorActions::FrontToBack::begin):
+        (WebCore::CCLayerIteratorActions::FrontToBack::end):
+        (WebCore::CCLayerIteratorActions::FrontToBack::next):
+        (WebCore::CCLayerIteratorActions::FrontToBack::goToHighestInSubtree):
+        * platform/graphics/chromium/cc/CCLayerIterator.h:
+        (WebCore::CCLayerIterator::CCLayerIterator):
+        (WebCore::CCLayerIterator::operator++):
+        (WebCore::CCLayerIterator::operator==):
+        (WebCore::CCLayerIterator::operator->):
+        (WebCore::CCLayerIterator::operator*):
+        (WebCore::CCLayerIterator::representsTargetRenderSurface):
+        (WebCore::CCLayerIterator::representsContributingRenderSurface):
+        (WebCore::CCLayerIterator::currentLayer):
+        (WebCore::CCLayerIterator::currentLayerRepresentsContributingRenderSurface):
+        (WebCore::CCLayerIterator::currentLayerRepresentsTargetRenderSurface):
+        (WebCore::CCLayerIterator::targetRenderSurfaceLayer):
+        (WebCore::CCLayerIterator::targetRenderSurface):
+        (WebCore::CCLayerIterator::targetRenderSurfaceChildren):
+        * platform/graphics/chromium/cc/CCLayerIteratorPosition.h: Removed.
+
+2012-02-23  Daniel Sievers  <sievers@chromium.org>
+
+        [Chromium] Add video stream texture support
+        https://bugs.webkit.org/show_bug.cgi?id=78398
+
+        This upstreams the abstraction used on Android for
+        hardware video decoding with the compositor.
+
+        Most of the interfaces are kept generic and the core
+        of this change is to allow texturing from an external
+        texture while receiving notifications (on the compositor
+        thread if we are running it) when there are new frames to
+        be displayed.
+
+        Reviewed by James Robinson.
+
+        * platform/graphics/chromium/Extensions3DChromium.h:
+        * platform/graphics/chromium/LayerRendererChromium.cpp:
+        (WebCore::LayerRendererChromium::drawSingleTextureVideoQuad):
+        (WebCore::LayerRendererChromium::drawRGBA):
+        (WebCore::LayerRendererChromium::drawNativeTexture):
+        (WebCore):
+        (WebCore::LayerRendererChromium::drawStreamTexture):
+        (WebCore::LayerRendererChromium::drawVideoQuad):
+        (WebCore::LayerRendererChromium::streamTextureLayerProgram):
+        (WebCore::LayerRendererChromium::cleanupSharedObjects):
+        * platform/graphics/chromium/LayerRendererChromium.h:
+        (LayerRendererChromium):
+        * platform/graphics/chromium/ShaderChromium.cpp:
+        (WebCore::VertexShaderVideoTransform::VertexShaderVideoTransform):
+        (WebCore):
+        (WebCore::VertexShaderVideoTransform::init):
+        (WebCore::VertexShaderVideoTransform::getShaderString):
+        (WebCore::FragmentShaderOESImageExternal::init):
+        (WebCore::FragmentShaderOESImageExternal::getShaderString):
+        * platform/graphics/chromium/ShaderChromium.h:
+        (VertexShaderVideoTransform):
+        (WebCore::VertexShaderVideoTransform::matrixLocation):
+        (WebCore::VertexShaderVideoTransform::texTransformLocation):
+        (WebCore::VertexShaderVideoTransform::texMatrixLocation):
+        (WebCore):
+        (FragmentShaderOESImageExternal):
+        * platform/graphics/chromium/VideoFrameChromium.h:
+        * platform/graphics/chromium/VideoFrameProvider.h:
+        (Client):
+        (VideoFrameProvider):
+        * platform/graphics/chromium/cc/CCVideoDrawQuad.cpp:
+        (WebCore::CCVideoDrawQuad::CCVideoDrawQuad):
+        * platform/graphics/chromium/cc/CCVideoDrawQuad.h:
+        (WebCore::CCVideoDrawQuad::matrix):
+        (CCVideoDrawQuad):
+        (WebCore::CCVideoDrawQuad::setMatrix):
+        * platform/graphics/chromium/cc/CCVideoLayerImpl.cpp:
+        (WebCore):
+        (WebCore::CCVideoLayerImpl::CCVideoLayerImpl):
+        (WebCore::convertVFCFormatToGC3DFormat):
+        (WebCore::CCVideoLayerImpl::appendQuads):
+        (WebCore::CCVideoLayerImpl::didReceiveFrame):
+        (WebCore::CCVideoLayerImpl::didUpdateMatrix):
+        (WebCore::CCVideoLayerImpl::setNeedsRedraw):
+        * platform/graphics/chromium/cc/CCVideoLayerImpl.h:
+        (WebCore):
+        (CCVideoLayerImpl):
+
+2012-02-23  Stephen White  <senorblanco@chromium.org>
+
+        [chromium] Implement drop-shadow() CSS filter on composited layers.
+        https://bugs.webkit.org/show_bug.cgi?id=79386
+
+        Reviewed by James Robinson.
+
+        Covered by css3/filters/effect-drop-shadow-hw.html
+
+        * platform/graphics/chromium/cc/CCRenderSurfaceFilters.cpp:
+        (WebCore::CCRenderSurfaceFilters::apply):
+        * platform/graphics/filters/FilterOperation.h:
+        (WebCore::DropShadowFilterOperation::movesPixels):
+
+2012-02-23  Erik Arvidsson  <arv@chromium.org>
+
+        Add support for InterfaceName in the bindings
+        https://bugs.webkit.org/show_bug.cgi?id=79384
+
+        Reviewed by Adam Barth.
+
+        This makes the interface name part of the idl file instead of being hard coded into the code generators.
+
+        * bindings/scripts/CodeGenerator.pm:
+        (GetVisibleInterfaceName): Extracted from CodeGenerator{JS,V8}.pm and changed to look at the extended attribute.
+        * bindings/scripts/CodeGeneratorJS.pm:
+        (GenerateImplementation):
+        (GenerateConstructorDefinition):
+        * bindings/scripts/CodeGeneratorV8.pm:
+        (GenerateImplementation):
+        * bindings/scripts/IDLAttributes.txt:
+        * bindings/scripts/test/JS/JSTestObj.cpp:
+        (WebCore):
+        * bindings/scripts/test/TestObj.idl:
+        * bindings/scripts/test/V8/V8TestObj.cpp:
+        (WebCore::ConfigureV8TestObjTemplate):
+        * dom/DOMCoreException.idl: Set the InterfaceName.
+        * html/DOMFormData.idl: Ditto.
+        * plugins/DOMMimeType.idl: Ditto.
+        * plugins/DOMMimeTypeArray.idl: Ditto.
+        * plugins/DOMPlugin.idl: Ditto.
+        * plugins/DOMPluginArray.idl: Ditto.
+
+2012-02-22  Ryosuke Niwa  <rniwa@webkit.org>
+
+        REGRESSION(r99076): WebKit pastes the trailing newline into a single-line text field
+        https://bugs.webkit.org/show_bug.cgi?id=79305
+
+        Reviewed by Tony Chang.
+
+        The bug was caused by ReplacementFragment::m_hasInterchangeNewlineAtEnd not reset even when
+        text field's beforeTextInserted event handler removed interchange new lines at the end.
+        Because the event handler is responsible for trimming new lines, we need to recompute the values
+        for m_hasInterchangeNewlineAt* after the event dispatch.
+
+        Test: editing/input/paste-text-ending-with-interchange-newline.html
+
+        * editing/ReplaceSelectionCommand.cpp:
+        (WebCore::ReplacementFragment::ReplacementFragment):
+
+2012-02-23  Andreas Kling  <awesomekling@apple.com>
+
+        Make use of StylePropertySet::setProperty(propertyID, CSSValue).
+        <http://webkit.org/b/79374>
+
+        Reviewed by Antti Koivisto.
+
+        Use the new setProperty() overload that takes a CSSValue in more places. This allows us
+        to get rid of 1/3 setProperty() overloads that don't expand shorthands.
+
+        * css/StylePropertySet.h:
+        * css/StylePropertySet.cpp:
+
+            Remove the setProperty() overload for specific primitive value types. StyledElement
+            can take care of this without help from StylePropertySet.
+
+        * dom/StyledElement.h:
+        * dom/StyledElement.cpp:
+        (WebCore::StyledElement::setInlineStyleProperty):
+        (WebCore::StyledElement::addPropertyToAttributeStyle):
+
+            Switch some functions over to using the setProperty() overload that takes a CSSValue.
+
+        * html/HTMLElement.cpp:
+        (WebCore::HTMLElement::applyBorderAttributeToStyle):
+        * html/HTMLHRElement.cpp:
+        (WebCore::HTMLHRElement::collectStyleForAttribute):
+        * html/HTMLTableElement.cpp:
+        (WebCore::HTMLTableElement::collectStyleForAttribute):
+        * html/HTMLTablePartElement.cpp:
+        (WebCore::HTMLTablePartElement::collectStyleForAttribute):
+
+            Use shorthands where possible to shrink the code a bit. Pass border widths as CSS_PX
+            values directly instead of making a CSSParser round-trip.
+
+2012-02-23  Kevin Ollivier  <kevino@theolliviers.com>
+
+        [wx] Build fix, use the strings in LocalizedStrings.cpp.
+
+        * platform/wx/LocalizedStringsWx.cpp:
+        (WebCore::localizedString):
+        (WebCore):
+
+2012-02-23  Alok Priyadarshi  <alokp@chromium.org>
+
+        Microsoft IE fishtank demo causes assertion in RenderLayer::convertToLayerCoords
+        https://bugs.webkit.org/show_bug.cgi?id=61964
+
+        Reviewed by James Robinson.
+        
+        The assertion is caused with the following callstack:
+        WebCore::RenderLayer::convertToLayerCoords
+        WebCore::RenderLayerCompositor::layerWillBeRemoved
+        WebCore::RenderLayer::removeChild
+        WebCore::RenderLayer::removeOnlyThisLayer
+        
+        WebCore::RenderLayer::removeOnlyThisLayer removes itself from the parent
+        before moving its children to its parent. When WebCore::RenderLayer::convertToLayerCoords
+        is called for one of the children, it tries to walk to root only to stop at the immediate
+        parent which was disconnected from the tree in WebCore::RenderLayer::removeOnlyThisLayer.
+        If removal of layer is delayed until the children has been moved, the ASSERT is avoided.
+
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::removeOnlyThisLayer):
+
+2012-02-23  Matthew Delaney  <mdelaney@apple.com>
+
+        Fix for canvas breakage caused by r108597 from the following:
+        https://bugs.webkit.org/show_bug.cgi?id=79317
+
+        Reviewed by Oliver Hunt.
+
+        * html/HTMLCanvasElement.cpp:
+        (WebCore::HTMLCanvasElement::paintsIntoCanvasBuffer):
+
+2012-02-23  Pavel Feldman  <pfeldman@chromium.org>
+
+        Web Inspector: mad Redo to Cmd+Shift+Z, not Cmd+Y on a Mac.
+        https://bugs.webkit.org/show_bug.cgi?id=79341
+
+        Reviewed by Timothy Hatcher.
+
+        * inspector/front-end/ElementsPanel.js:
+        (WebInspector.ElementsPanel.prototype.handleShortcut):
+
+2012-02-23  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Mac build fix after 108629.
+
+        * WebCore.exp.in:
+
+2012-02-23  Tom Sepez  <tsepez@chromium.org>
+
+        [chromium] XSS Auditor bypass via javascript url and control characters
+        https://bugs.webkit.org/show_bug.cgi?id=79154
+
+        Reviewed by Adam Barth.
+
+        Test: http/tests/security/xssAuditor/javascript-link-control-char2.html
+
+        * html/parser/XSSAuditor.cpp:
+        (WebCore):
+        (WebCore::XSSAuditor::eraseDangerousAttributesIfInjected):
+
+2012-02-23  Patrick Gansterer  <paroga@webkit.org>
+
+        [CMake] Add WEBKIT_INCLUDE_CONFIG_FILES_IF_EXISTS macro
+        https://bugs.webkit.org/show_bug.cgi?id=79371
+
+        Reviewed by Daniel Bates.
+
+        * CMakeLists.txt:
+
+2012-02-23  Julien Chaffraix  <jchaffraix@webkit.org>
+
+        Cleanup RenderBlock::moveChildrenTo
+        https://bugs.webkit.org/show_bug.cgi?id=79319
+
+        Reviewed by Eric Seidel.
+
+        Refactoring, no change in behavior expected.
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::moveChildrenTo):
+        Removed inline check that was redundant, switched to |while| to a |for|
+        to show what's going on more closely and adds a call to moveChildTo to
+        share more code between the 2 functions.
+
+2012-02-23  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        [Qt] Add support for touch cancellation
+        https://bugs.webkit.org/show_bug.cgi?id=79348
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Map Qt touch cancel events to the WebCore equivalent.
+
+        No new tests, unskipped existing test for Qt 5.
+
+        * platform/PlatformTouchPoint.h:
+        (PlatformTouchPoint):
+        * platform/qt/PlatformTouchEventQt.cpp:
+        (WebCore::PlatformTouchEvent::PlatformTouchEvent):
+        * platform/qt/PlatformTouchPointQt.cpp:
+        (WebCore::PlatformTouchPoint::PlatformTouchPoint):
+
+2012-02-23  Erik Arvidsson  <arv@chromium.org>
+
+        Unreviewed. Rebaseline binding test files.
+
+        * bindings/scripts/test/GObject/WebKitDOMTestInterface.cpp:
+        (webkit_dom_test_interface_supplemental_method1):
+        (webkit_dom_test_interface_supplemental_method2):
+        (webkit_dom_test_interface_get_supplemental_str1):
+        (webkit_dom_test_interface_get_supplemental_str2):
+        (webkit_dom_test_interface_set_supplemental_str2):
+        (webkit_dom_test_interface_get_supplemental_node):
+        (webkit_dom_test_interface_set_supplemental_node):
+        (webkit_dom_test_interface_set_property):
+        (webkit_dom_test_interface_get_property):
+
+2012-02-23  Anders Carlsson  <andersca@apple.com>
+
+        Crash in ScrollElasticityController::snapRubberBandTimerFired()
+        https://bugs.webkit.org/show_bug.cgi?id=79372
+        <rdar://problem/10915193>
+
+        Reviewed by Andreas Kling.
+
+        Invalidate the rubber-band timer in the ScrollingTreeNodeMac destructor.
+
+        * page/scrolling/mac/ScrollingTreeNodeMac.h:
+        (ScrollingTreeNodeMac):
+        * page/scrolling/mac/ScrollingTreeNodeMac.mm:
+        (WebCore::ScrollingTreeNodeMac::~ScrollingTreeNodeMac):
+        (WebCore):
+
+2012-02-23  Pavel Feldman  <pfeldman@chromium.org>
+
+        Web Inspector: add experiment that loads stylesheets as links
+        https://bugs.webkit.org/show_bug.cgi?id=79340
+
+        Reviewed by Timothy Hatcher.
+
+        * inspector/front-end/Settings.js:
+        (WebInspector.ExperimentsSettings):
+        * inspector/front-end/View.js:
+        (WebInspector.View.prototype._doLoadCSS):
+
+2012-02-23  Adam Roben  <aroben@apple.com>
+
+        Mac build fix after r108615
+
+        * WebCore.exp.in: Added a missing export.
+
+2012-02-23  Adam Barth  <abarth@webkit.org>
+
+        Move MediaStream related declarations from DOMWindow to DOMWindowMediaStream
+        https://bugs.webkit.org/show_bug.cgi?id=79343
+
+        Reviewed by Eric Seidel.
+
+        These declarations belong in the MEDIA_STREAM module.
+
+        * GNUmakefile.list.am:
+        * WebCore.gypi:
+        * mediastream/DOMWindowMediaStream.idl: Added.
+        * page/DOMWindow.idl:
+
+2012-02-22  Igor Oliveira  <igor.o@sisa.samsung.com>
+
+        Every call to RenderObject::setAnimatableStyle() iterates through all m_compositeAnimations: potentially O(N^2)
+        https://bugs.webkit.org/show_bug.cgi?id=38025
+
+        This patchs implements updateAnimationTimerForRenderer, it just checks the timeToNextService for
+        the current RenderObject reducing the amount of iterations.
+
+        Reviewed by Simon Fraser.
+
+        * page/animation/AnimationController.cpp:
+        (WebCore):
+        (WebCore::AnimationControllerPrivate::updateAnimationTimerForRenderer):
+        (WebCore::AnimationController::updateAnimations):
+        * page/animation/AnimationControllerPrivate.h:
+        (AnimationControllerPrivate):
+
+2012-02-22  Hajime Morrita  <morrita@chromium.org>
+
+        NOTIFICATIONS should be implemented as PageSupplement
+        https://bugs.webkit.org/show_bug.cgi?id=79052
+
+        Reviewed by Adam Barth.
+
+        Turned NotificationController to a PageSupplement.
+
+        No new tests. No behavior change.
+
+        * notifications/NotificationController.cpp:
+        (WebCore::NotificationController::clientFrom):
+        (WebCore):
+        (WebCore::NotificationController::supplementName):
+        (WebCore::provideNotification):
+        * notifications/NotificationController.h:
+        (NotificationController):
+        (WebCore::NotificationController::from):
+        * notifications/NotificationPresenter.h:
+        (WebCore):
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::webkitNotifications):
+        * page/Page.cpp:
+        (WebCore::Page::Page):
+        (WebCore::Page::PageClients::PageClients):
+        * page/Page.h:
+        (WebCore):
+        (PageClients):
+        (Page):
+
+2012-02-22  Dmitry Lomov  <dslomov@google.com>
+
+        [Chromium][V8] Support Uint8ClampedArray in postMessage
+        https://bugs.webkit.org/show_bug.cgi?id=79291.
+
+        Reviewed by Kenneth Russell.
+
+        Covered by existing tests.
+
+        * bindings/v8/SerializedScriptValue.cpp:
+
+2012-02-22  Kentaro Hara  <haraken@chromium.org>
+
+        Enable Geolocation bindings for GObject
+        https://bugs.webkit.org/show_bug.cgi?id=79293
+
+        Reviewed by Adam Barth.
+
+        This patch adds "WebCore::" to supplemental method calls.
+        This will solve the GTK build failure we have observed in the Geolocation API,
+        and thus this patch enables the Geolocation API.
+
+        * Modules/geolocation/NavigatorGeolocation.idl:
+        * bindings/scripts/CodeGeneratorGObject.pm:
+        (GenerateProperty):
+        (GenerateFunction):
+
+2012-02-22  MORITA Hajime  <morrita@google.com>
+
+        [Refactoring] Align supplementName() values.
+        https://bugs.webkit.org/show_bug.cgi?id=79311
+
+        Reviewed by Adam Barth.
+
+        No new tests. No behavioral change.
+
+        * dom/DeviceOrientationController.cpp:
+        (WebCore::DeviceOrientationController::supplementName):
+        * mediastream/UserMediaController.cpp:
+        (WebCore::UserMediaController::supplementName):
+
+2012-02-22  Yuta Kitamura  <yutak@chromium.org>
+
+        Unreviewed, rolling out r108602.
+        http://trac.webkit.org/changeset/108602
+        https://bugs.webkit.org/show_bug.cgi?id=78878
+
+        Caused a couple of layout test failures on Chromium bots.
+
+        * dom/Element.cpp:
+        (WebCore::Element::childShouldCreateRenderer):
+        * dom/Element.h:
+        (Element):
+        * dom/Node.h:
+        (WebCore::Node::childShouldCreateRenderer):
+        * dom/NodeRenderingContext.cpp:
+        (WebCore::NodeRenderingContext::shouldCreateRenderer):
+        * dom/NodeRenderingContext.h:
+        (NodeRenderingContext):
+        * html/HTMLDetailsElement.cpp:
+        (WebCore::HTMLDetailsElement::childShouldCreateRenderer):
+        * html/HTMLDetailsElement.h:
+        (HTMLDetailsElement):
+        * html/HTMLMediaElement.cpp:
+        (WebCore):
+        * html/HTMLMediaElement.h:
+        (HTMLMediaElement):
+        * html/HTMLMeterElement.cpp:
+        * html/HTMLMeterElement.h:
+        (HTMLMeterElement):
+        * html/HTMLProgressElement.cpp:
+        * html/HTMLProgressElement.h:
+        (HTMLProgressElement):
+        * html/HTMLSelectElement.cpp:
+        * html/HTMLSelectElement.h:
+        (HTMLSelectElement):
+        * html/HTMLSummaryElement.cpp:
+        * html/HTMLSummaryElement.h:
+        (HTMLSummaryElement):
+        * html/HTMLTextFormControlElement.cpp:
+        * html/HTMLTextFormControlElement.h:
+        (HTMLTextFormControlElement):
+        * rendering/RenderButton.cpp:
+        (WebCore::RenderButton::canHaveChildren):
+        (WebCore):
+        * rendering/RenderButton.h:
+        (RenderButton):
+        * rendering/RenderListBox.h:
+        (WebCore::RenderListBox::canHaveChildren):
+        (RenderListBox):
+        * rendering/RenderMedia.h:
+        * rendering/RenderMenuList.h:
+        (WebCore::RenderMenuList::canHaveChildren):
+        * rendering/RenderMeter.h:
+        (WebCore::RenderMeter::canHaveChildren):
+        * rendering/RenderProgress.h:
+        (WebCore::RenderProgress::canHaveChildren):
+        * rendering/RenderTextControl.h:
+        (WebCore::RenderTextControl::canHaveChildren):
+        * rendering/svg/RenderSVGRoot.h:
+        (WebCore::RenderSVGRoot::canHaveChildren):
+        * svg/SVGAElement.cpp:
+        (WebCore::SVGAElement::childShouldCreateRenderer):
+        * svg/SVGAElement.h:
+        (SVGAElement):
+        * svg/SVGAltGlyphElement.cpp:
+        (WebCore::SVGAltGlyphElement::childShouldCreateRenderer):
+        * svg/SVGAltGlyphElement.h:
+        (SVGAltGlyphElement):
+        * svg/SVGDocument.cpp:
+        (WebCore::SVGDocument::childShouldCreateRenderer):
+        * svg/SVGDocument.h:
+        (SVGDocument):
+        * svg/SVGElement.cpp:
+        (WebCore::SVGElement::childShouldCreateRenderer):
+        * svg/SVGElement.h:
+        (SVGElement):
+        * svg/SVGForeignObjectElement.cpp:
+        (WebCore::SVGForeignObjectElement::childShouldCreateRenderer):
+        * svg/SVGForeignObjectElement.h:
+        (SVGForeignObjectElement):
+        * svg/SVGSwitchElement.cpp:
+        (WebCore::SVGSwitchElement::childShouldCreateRenderer):
+        * svg/SVGSwitchElement.h:
+        (SVGSwitchElement):
+        * svg/SVGTRefElement.cpp:
+        (WebCore::SVGTRefElement::childShouldCreateRenderer):
+        * svg/SVGTRefElement.h:
+        (SVGTRefElement):
+        * svg/SVGTSpanElement.cpp:
+        (WebCore::SVGTSpanElement::childShouldCreateRenderer):
+        * svg/SVGTSpanElement.h:
+        (SVGTSpanElement):
+        * svg/SVGTextElement.cpp:
+        (WebCore::SVGTextElement::childShouldCreateRenderer):
+        * svg/SVGTextElement.h:
+        (SVGTextElement):
+        * svg/SVGTextPathElement.cpp:
+        (WebCore::SVGTextPathElement::childShouldCreateRenderer):
+        * svg/SVGTextPathElement.h:
+
+2012-02-22  Abhishek Arya  <inferno@chromium.org>
+
+        Crash in RenderBlock::addChildIgnoringAnonymousColumnBlocks.
+        https://bugs.webkit.org/show_bug.cgi?id=79043
+
+        Reviewed by Julien Chaffraix.
+
+        Tests: fast/runin/runin-div-before-child.html
+               fast/runin/runin-table-before-child.html
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::addChildIgnoringAnonymousColumnBlocks): handle
+        the case of run-in elements and strengthen code to handle cases where
+        beforeChild is incorrectly set.
+        * rendering/RenderObject.h: remove anonymousContainer function since
+        the new logic in RenderBlock does not need it.
+
+2012-02-22  Hayato Ito  <hayato@chromium.org>
+
+        Make ShadowRootList manage a node distribution.
+        https://bugs.webkit.org/show_bug.cgi?id=79008
+
+        Reviewed by Dimitri Glazkov.
+
+        The result of node distributions is currently stored in
+        ShadowRoot. To support multiple ShadowRoots, such node distribution
+        information should be managed in one place per shadow host. Now
+        ShadowRootList takes this responsibility on behalf of owing
+        multiple ShadowRoots. Clients should ask ShadowRootList for such
+        information, not for each ShadowRoot.
+
+        No tests. No change in behavior.
+
+        * dom/NodeRenderingContext.cpp:
+        (WebCore::NodeRenderingContext::NodeRenderingContext):
+        * dom/ShadowRoot.cpp:
+        (WebCore::ShadowRoot::create):
+        (WebCore::ShadowRoot::attach):
+        * dom/ShadowRoot.h:
+        (ShadowRoot):
+        * dom/ShadowRootList.cpp:
+        (WebCore::ShadowRootList::insertionPointFor):
+        (WebCore):
+        (WebCore::ShadowRootList::isSelectorActive):
+        (WebCore::ShadowRootList::ensureSelector):
+        * dom/ShadowRootList.h:
+        (WebCore):
+        (ShadowRootList):
+        (WebCore::ShadowRootList::hasShadowRoot):
+        (WebCore::ShadowRootList::youngestShadowRoot):
+        (WebCore::ShadowRootList::oldestShadowRoot):
+        (WebCore::ShadowRootList::selector):
+        (WebCore::ShadowRootList::host):
+        * html/shadow/HTMLContentElement.cpp:
+        (WebCore::HTMLContentElement::attach):
+        (WebCore::HTMLContentElement::detach):
+        * html/shadow/HTMLContentSelector.cpp:
+        (WebCore::HTMLContentSelector::willSelectOver):
+        * html/shadow/HTMLContentSelector.h:
+        (HTMLContentSelector):
+
+2012-02-22  Wei James  <james.wei@intel.com>
+
+        Add multi channels support in AudioBus and AudioBufferSourceNode
+        https://bugs.webkit.org/show_bug.cgi?id=79017
+
+        Reviewed by Chris Rogers.
+
+        Tests: webaudio/up-mixing-mono-51.html
+               webaudio/up-mixing-mono-stereo.html
+               webaudio/up-mixing-stereo-51.html
+
+        * platform/audio/AudioBus.cpp:
+        (WebCore::AudioBus::copyFrom):
+        (WebCore::AudioBus::sumFrom):
+        (WebCore::AudioBus::processWithGainFromMonoStereo):
+        (WebCore::AudioBus::processWithGainFrom):
+
+2012-02-22  Kentaro Hara  <haraken@chromium.org>
+
+        [Supplemental] should support constants
+        https://bugs.webkit.org/show_bug.cgi?id=79303
+
+        Reviewed by Adam Barth.
+
+        Given that we have
+
+            interface [Supplemental=Y] X { constant int A = 123; }
+
+        then the code generator should generate
+
+            X::A
+
+        to refer to the constant. However, the current code generator generates Y::A instead.
+        This patch fixes it.
+
+        Test: bindings/scripts/test/TestSupplemental.idl
+
+        * bindings/scripts/CodeGenerator.pm: Modified as described above.
+        (GenerateCompileTimeCheckForEnumsIfNeeded):
+
+        * bindings/scripts/test/JS/JSTestInterface.cpp: Updated run-bindings-tests results.
+        (WebCore):
+        * bindings/scripts/test/V8/V8TestInterface.cpp: Ditto.
+        (WebCore):
+
+        * page/DOMWindow.h: Moved DOMWindow::FileSystemType to DOMWindowFileSystem::FileSystemType.
+        (DOMWindow):
+        * fileapi/DOMWindowFileSystem.h: Ditto.
+        (DOMWindowFileSystem):
+        * fileapi/DOMWindowFileSystem.cpp: Ditto.
+        (WebCore):
+
+2012-02-22  MORITA Hajime  <morrita@google.com>
+
+        Adding a ShadowRoot to image-backed element causes a crash
+        https://bugs.webkit.org/show_bug.cgi?id=78878
+
+        Reviewed by Dimitri Glazkov.
+
+        The crash happened because NodeRenderingContext tried to append a
+        child to a renderer regardless one isn't capable of holding any
+        children if it appears in the shadow attaching phase. RenderImage
+        is one of such renderer classes which aren't capable.
+
+        NodeRenderingContext decide whether the contextual node as a child
+        can create its renderer based on RenderObject::canHaveChildren()
+        and Node::childShouldCreateRenderer(). But the responsibility
+        between these two methods are getting confused. which results this
+        unfortuante crash path.
+
+        This change re-aligns the responsibility:
+
+        - Now canHaveChildren() purely declares the ability of the
+          renderer. If the renderer is capable of having children, it
+          return true regardless of HTML semantics.
+
+        - On the other hand, childShouldCreateRenderer() cares about the
+          semantics. If the element doesn't allow children to be rendered,
+          this returns false.
+
+        - Note that these decision on elements are contextual. Each element
+          needs to know which role it is playing in the tree composition
+          algorithm of Shadow DOM. That's why the method parameter is changed
+          from Node* to NodeRenderingContext.
+
+        With this change, some decision points are moved from a renderer to an
+        element. Following renderers no longer stop reject having children:
+
+        - RenderButton, RenderListBox, RenderMenuList, RenderMeter,
+          RenderProgress, RenderTextControl.
+
+        Corresponding element for such a render (HTMLProgressElement of
+        RenderProgress for exaple) now cares about that.
+
+        Tests: fast/dom/shadow/shadow-on-image-expected.html
+        fast/dom/shadow/shadow-on-image.html
+
+        * dom/Element.cpp:
+        (WebCore::Element::childShouldCreateRenderer):
+        * dom/Element.h:
+        (Element):
+        * dom/Node.h:
+        * dom/NodeRenderingContext.cpp:
+        (WebCore::NodeRenderingContext::shouldCreateRenderer):
+        * dom/NodeRenderingContext.h:
+        (NodeRenderingContext):
+        (WebCore::NodeRenderingContext::isOnEncapsulationBoundary):
+        (WebCore):
+        * html/HTMLDetailsElement.cpp:
+        (WebCore::HTMLDetailsElement::childShouldCreateRenderer):
+        * html/HTMLDetailsElement.h:
+        (HTMLDetailsElement):
+        * html/HTMLMeterElement.cpp:
+        (WebCore::HTMLMeterElement::childShouldCreateRenderer):
+        (WebCore):
+        * html/HTMLMeterElement.h:
+        (HTMLMeterElement):
+        * html/HTMLProgressElement.cpp:
+        (WebCore::HTMLProgressElement::childShouldCreateRenderer):
+        * html/HTMLMediaElement.h:
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::childShouldCreateRenderer):
+        (WebCore):
+        * html/HTMLProgressElement.h:
+        (HTMLProgressElement):
+        * html/HTMLSelectElement.cpp:
+        (WebCore::HTMLSelectElement::childShouldCreateRenderer):
+        (WebCore):
+        * html/HTMLSelectElement.h:
+        (HTMLSelectElement):
+        * html/HTMLSummaryElement.cpp:
+        * html/HTMLSummaryElement.h:
+        (HTMLSummaryElement):
+        * html/HTMLTextFormControlElement.cpp:
+        * html/HTMLTextFormControlElement.h:
+        (HTMLTextFormControlElement):
+        * rendering/RenderButton.cpp:
+        * rendering/RenderButton.h:
+        (RenderButton):
+        * rendering/RenderListBox.h:
+        (RenderListBox):
+        * rendering/RenderMedia.h:
+        (WebCore::RenderMedia::canHaveChildren):
+        * rendering/RenderMenuList.h:
+        * rendering/RenderMeter.h:
+        * rendering/RenderProgress.h:
+        * rendering/RenderTextControl.h:
+        * rendering/svg/RenderSVGRoot.h:
+        * svg/SVGAElement.cpp:
+        (WebCore::SVGAElement::childShouldCreateRenderer):
+        * svg/SVGAElement.h:
+        (SVGAElement):
+        * svg/SVGAltGlyphElement.cpp:
+        (WebCore::SVGAltGlyphElement::childShouldCreateRenderer):
+        * svg/SVGAltGlyphElement.h:
+        (SVGAltGlyphElement):
+        * svg/SVGDocument.cpp:
+        (WebCore::SVGDocument::childShouldCreateRenderer):
+        * svg/SVGDocument.h:
+        (SVGDocument):
+        * svg/SVGElement.cpp:
+        (WebCore::SVGElement::childShouldCreateRenderer):
+        * svg/SVGElement.h:
+        (SVGElement):
+        * svg/SVGForeignObjectElement.cpp:
+        (WebCore::SVGForeignObjectElement::childShouldCreateRenderer):
+        * svg/SVGForeignObjectElement.h:
+        (SVGForeignObjectElement):
+        * svg/SVGSwitchElement.cpp:
+        (WebCore::SVGSwitchElement::childShouldCreateRenderer):
+        * svg/SVGSwitchElement.h:
+        (SVGSwitchElement):
+        * svg/SVGTRefElement.cpp:
+        (WebCore::SVGTRefElement::childShouldCreateRenderer):
+        * svg/SVGTRefElement.h:
+        (SVGTRefElement):
+        * svg/SVGTSpanElement.cpp:
+        (WebCore::SVGTSpanElement::childShouldCreateRenderer):
+        * svg/SVGTSpanElement.h:
+        (SVGTSpanElement):
+        * svg/SVGTextElement.cpp:
+        (WebCore::SVGTextElement::childShouldCreateRenderer):
+        * svg/SVGTextElement.h:
+        (SVGTextElement):
+        * svg/SVGTextPathElement.cpp:
+        (WebCore::SVGTextPathElement::childShouldCreateRenderer):
+        * svg/SVGTextPathElement.h:
+
+2012-02-22  Yong Li  <yoli@rim.com>
+
+        [BlackBerry] NetworkJob can access deleted objects.
+        https://bugs.webkit.org/show_bug.cgi?id=79246
+
+        Reviewed by Antonio Gomes.
+
+        When a NetworkJob is created by unload handler, we still need
+        to send the request to the server, but we shouldn't save and
+        keep using the Frame pointer because the frame is being detached.
+        The NetworkJob will be cancelled by PingLoader as soon as it gets
+        first response from host.
+        Also see https://bugs.webkit.org/show_bug.cgi?id=30457.
+
+        No new tests because existing test case is good enough like
+        LayoutTests/http/tests/navigation/image-load-in-unload-handler.html.
+
+        * platform/network/blackberry/NetworkJob.cpp:
+        (WebCore::NetworkJob::NetworkJob):
+        (WebCore::NetworkJob::initialize):
+
+2012-02-22  Kenichi Ishibashi  <bashi@chromium.org>
+
+        [WebSocket] Remove zlib.h from WebSocketDeflater.h
+        https://bugs.webkit.org/show_bug.cgi?id=79298
+
+        Use forward declaration and OwnPtr for z_stream to move zlib.h from
+        .h file to .cpp file.
+
+        Reviewed by Kent Tamura.
+
+        No new tests. No behavior change.
+
+        * websockets/WebSocketDeflater.cpp:
+        (WebCore::WebSocketDeflater::WebSocketDeflater):
+        (WebCore::WebSocketDeflater::initialize):
+        (WebCore::WebSocketDeflater::~WebSocketDeflater):
+        (WebCore::setStreamParameter):
+        (WebCore::WebSocketDeflater::addBytes):
+        (WebCore::WebSocketDeflater::finish):
+        (WebCore::WebSocketDeflater::reset):
+        (WebCore::WebSocketInflater::WebSocketInflater):
+        (WebCore::WebSocketInflater::initialize):
+        (WebCore::WebSocketInflater::~WebSocketInflater):
+        (WebCore::WebSocketInflater::addBytes):
+        (WebCore::WebSocketInflater::finish):
+        * websockets/WebSocketDeflater.h:
+        (WebSocketDeflater): Use OwnPtr for m_stream.
+        (WebSocketInflater): Ditto.
+
+2012-02-22  James Robinson  <jamesr@chromium.org>
+
+        Remove GraphicsContext3D::paintsIntoCanvasBuffer and unify WebGL and canvas 2d logic
+        https://bugs.webkit.org/show_bug.cgi?id=79317
+
+        Reviewed by Kenneth Russell.
+
+        HTMLCanvasElement::paint needs to know whether to attempt to paint the canvas buffer for its context. In the
+        case of an accelerated canvas or WebGL context, unless we are printing it is typically the composited layer's
+        responsibility to present the contents and the element itself is only responsible for backgrounds, borders and
+        the like.  This removes a rather indirect path that WebGL content used to take to accomplish this and unifies
+        the logic with CanvasRenderingContext2D's, which has the exact same needs.
+
+        Covered by existing canvas layout tests.
+
+        * html/HTMLCanvasElement.cpp:
+        (WebCore::HTMLCanvasElement::paintsIntoCanvasBuffer):
+        (WebCore):
+        (WebCore::HTMLCanvasElement::paint):
+        * html/HTMLCanvasElement.h:
+        (HTMLCanvasElement):
+        * html/canvas/CanvasRenderingContext.h:
+        * html/canvas/CanvasRenderingContext2D.cpp:
+        * html/canvas/CanvasRenderingContext2D.h:
+        * html/canvas/WebGLRenderingContext.cpp:
+        (WebCore):
+        * html/canvas/WebGLRenderingContext.h:
+        * platform/graphics/GraphicsContext3D.h:
+
+2012-02-22  Pablo Flouret  <pablof@motorola.com>
+
+        PopStateEvent.state should use the same object as history.state
+        https://bugs.webkit.org/show_bug.cgi?id=77493
+
+        Reviewed by Kentaro Hara.
+
+        Tests: fast/loader/stateobjects/state-attribute-history-getter.html
+               fast/loader/stateobjects/state-attribute-popstate-event.html
+
+        * bindings/js/JSPopStateEventCustom.cpp:
+        (WebCore):
+        (WebCore::cacheState):
+        (WebCore::JSPopStateEvent::state):
+        * bindings/v8/V8HiddenPropertyName.h:
+        (WebCore):
+        * bindings/v8/custom/V8HistoryCustom.cpp:
+        (WebCore::V8History::stateAccessorGetter):
+        (WebCore::V8History::pushStateCallback):
+        (WebCore::V8History::replaceStateCallback):
+        * bindings/v8/custom/V8PopStateEventCustom.cpp:
+        (WebCore):
+        (WebCore::cacheState):
+        (WebCore::V8PopStateEvent::stateAccessorGetter):
+        * dom/Document.cpp:
+        (WebCore::Document::enqueuePopstateEvent):
+        * dom/PopStateEvent.cpp:
+        (WebCore::PopStateEvent::PopStateEvent):
+        (WebCore::PopStateEvent::create):
+        * dom/PopStateEvent.h:
+        (WebCore):
+        (PopStateEvent):
+        (WebCore::PopStateEvent::history):
+        * dom/PopStateEvent.idl:
+        * page/History.cpp:
+        (WebCore::History::stateChanged):
+        (WebCore):
+        (WebCore::History::isSameAsCurrentState):
+        * page/History.h:
+        (History):
+
+2012-02-22  Adam Klein  <adamk@chromium.org>
+
+        Remove obsolete FIXMEs from ContainerNode
+        https://bugs.webkit.org/show_bug.cgi?id=79295
+
+        Reviewed by Ryosuke Niwa.
+
+        Each of these three identical FIXMEs has since been fixed by adding
+        "RefPtr<Node> protect(this)" at the top of each method.
+
+        * dom/ContainerNode.cpp:
+        (WebCore::ContainerNode::insertBefore):
+        (WebCore::ContainerNode::replaceChild):
+        (WebCore::ContainerNode::removeChild):
+
+2012-02-22  Dmitry Lomov  <dslomov@google.com>
+
+        [JSC] Implement ArrayBuffer and typed array cloning in JSC
+        https://bugs.webkit.org/show_bug.cgi?id=79294
+
+        Reviewed by Oliver Hunt.
+
+        Covered by existing tests.
+
+        * bindings/js/SerializedScriptValue.cpp:
+        (WebCore::typedArrayElementSize):
+        (WebCore):
+        (WebCore::CloneSerializer::dumpArrayBufferView):
+        (CloneSerializer):
+        (WebCore::CloneSerializer::dumpIfTerminal):
+        (WebCore::CloneSerializer::write):
+        (WebCore::CloneDeserializer::readArrayBufferViewSubtag):
+        (CloneDeserializer):
+        (WebCore::CloneDeserializer::readArrayBuffer):
+        (WebCore::CloneDeserializer::readArrayBufferView):
+        (WebCore::CloneDeserializer::getJSValue):
+        (WebCore::CloneDeserializer::readTerminal):
+
+2012-02-22  Adrienne Walker  <enne@google.com>
+
+        [chromium] Unreviewed speculative chromium-mac build fix.
+        https://bugs.webkit.org/show_bug.cgi?id=75874
+
+        This broke in r108581.
+
+        * platform/graphics/chromium/cc/CCLayerAnimationController.h:
+        (WebCore):
+
+2012-02-22  Raymond Toy  <rtoy@google.com>
+
+        exponentialRampToValue doesn't use starting value
+        https://bugs.webkit.org/show_bug.cgi?id=78035
+
+        Reviewed by Chris Rogers.
+
+        Test: webaudio/audioparam-exponentialRampToValueAtTime.html
+
+        * webaudio/AudioParamTimeline.cpp:
+        (WebCore::AudioParamTimeline::valuesForTimeRangeImpl): Set
+        starting value for exponential ramp.
+
+2012-02-22  Andreas Kling  <awesomekling@apple.com>
+
+        Make parsing color presentation attributes do less pointless work.
+        <http://webkit.org/b/79304>
+
+        Reviewed by Antti Koivisto.
+
+        Let HTMLElement::addHTMLColorToStyle() construct the color CSSValue directly
+        rather than passing a string that has to go through CSSParser.
+
+        * css/StylePropertySet.cpp:
+        (WebCore::StylePropertySet::setProperty):
+        * css/StylePropertySet.h:
+
+            Added a setProperty(propertyID, CSSValue) overload that expands shorthand
+            properties if necessary. Also added a little comment about the behavior
+            differences between setProperty() overloads.
+
+        * html/HTMLElement.cpp:
+        (WebCore::parseColorStringWithCrazyLegacyRules):
+
+            Changed this to return an RGBA32.
+
+        (WebCore::HTMLElement::addHTMLColorToStyle):
+
+            Figure out the RGB value and construct a (pooled) CSSValue directly.
+
+2012-02-22  Ian Vollick  <vollick@chromium.org>
+
+        [chromium] Plumb from GraphicsLayer to the cc thread animation code
+        https://bugs.webkit.org/show_bug.cgi?id=75874
+
+        Reviewed by James Robinson.
+
+        * WebCore.gypi:
+        * page/Settings.cpp:
+        (WebCore::Settings::Settings):
+        * page/Settings.h:
+        (WebCore::Settings::setThreadedAnimationEnabled):
+        (WebCore::Settings::threadedAnimationEnabled):
+        (Settings):
+        * platform/graphics/chromium/GraphicsLayerChromium.cpp:
+        (std):
+        (WebCore::GraphicsLayerChromium::addChild):
+        (WebCore::GraphicsLayerChromium::addAnimation):
+        (WebCore):
+        (WebCore::GraphicsLayerChromium::pauseAnimation):
+        (WebCore::GraphicsLayerChromium::removeAnimation):
+        (WebCore::GraphicsLayerChromium::suspendAnimations):
+        (WebCore::GraphicsLayerChromium::resumeAnimations):
+        (WebCore::GraphicsLayerChromium::setContentsToMedia):
+        (WebCore::GraphicsLayerChromium::updateLayerPreserves3D):
+        (WebCore::GraphicsLayerChromium::mapAnimationNameToId):
+        * platform/graphics/chromium/GraphicsLayerChromium.h:
+        (GraphicsLayerChromium):
+        * platform/graphics/chromium/LayerChromium.cpp:
+        (WebCore::LayerChromium::LayerChromium):
+        (WebCore::LayerChromium::addAnimation):
+        (WebCore):
+        (WebCore::LayerChromium::pauseAnimation):
+        (WebCore::LayerChromium::removeAnimation):
+        (WebCore::LayerChromium::suspendAnimations):
+        (WebCore::LayerChromium::resumeAnimations):
+        (WebCore::LayerChromium::setLayerAnimationController):
+        (WebCore::LayerChromium::pushPropertiesTo):
+        * platform/graphics/chromium/LayerChromium.h:
+        (WebCore):
+        (LayerChromium):
+        (WebCore::LayerChromium::layerAnimationController):
+        (WebCore::LayerChromium::numChildren):
+        * platform/graphics/chromium/cc/CCActiveAnimation.cpp:
+        (WebCore::CCActiveAnimation::create):
+        (WebCore):
+        (WebCore::CCActiveAnimation::CCActiveAnimation):
+        (WebCore::CCActiveAnimation::~CCActiveAnimation):
+        (WebCore::CCActiveAnimation::isWaiting):
+        (WebCore::CCActiveAnimation::isRunningOrHasRun):
+        (WebCore::CCActiveAnimation::cloneForImplThread):
+        (WebCore::CCActiveAnimation::synchronizeProperties):
+        * platform/graphics/chromium/cc/CCActiveAnimation.h:
+        (CCActiveAnimation):
+        (WebCore::CCActiveAnimation::AnimationSignature::AnimationSignature):
+        (AnimationSignature):
+        (WebCore::CCActiveAnimation::id):
+        (WebCore::CCActiveAnimation::group):
+        (WebCore::CCActiveAnimation::signature):
+        * platform/graphics/chromium/cc/CCAnimationCurve.h:
+        (CCAnimationCurve):
+        (CCTransformAnimationCurve):
+        * platform/graphics/chromium/cc/CCAnimationEvents.h: Copied from Source/WebCore/platform/graphics/chromium/cc/CCAnimationCurve.h.
+        (WebCore):
+        (WebCore::CCAnimationStartedEvent::CCAnimationStartedEvent):
+        (CCAnimationStartedEvent):
+        * platform/graphics/chromium/cc/CCLayerAnimationController.cpp: Added.
+        (WebCore):
+        (WebCore::CCLayerAnimationController::CCLayerAnimationController):
+        (WebCore::CCLayerAnimationController::~CCLayerAnimationController):
+        (WebCore::CCLayerAnimationController::create):
+        (WebCore::CCLayerAnimationController::addAnimation):
+        (WebCore::CCLayerAnimationController::pauseAnimation):
+        (WebCore::CCLayerAnimationController::removeAnimation):
+        (WebCore::CCLayerAnimationController::suspendAnimations):
+        (WebCore::CCLayerAnimationController::resumeAnimations):
+        (WebCore::CCLayerAnimationController::synchronizeAnimations):
+        (WebCore::CCLayerAnimationController::removeCompletedAnimations):
+        (WebCore::CCLayerAnimationController::pushNewAnimationsToImplThread):
+        (WebCore::CCLayerAnimationController::removeAnimationsCompletedOnMainThread):
+        (WebCore::CCLayerAnimationController::pushAnimationProperties):
+        (WebCore::CCLayerAnimationController::getActiveAnimation):
+        (WebCore::CCLayerAnimationController::remove):
+        * platform/graphics/chromium/cc/CCLayerAnimationController.h: Added.
+        (WebCore):
+        (CCLayerAnimationController):
+        (WebCore::CCLayerAnimationController::activeAnimations):
+        * platform/graphics/chromium/cc/CCLayerAnimationControllerImpl.cpp:
+        (WebCore::CCLayerAnimationControllerImpl::~CCLayerAnimationControllerImpl):
+        (WebCore):
+        (WebCore::CCLayerAnimationControllerImpl::animate):
+        (WebCore::CCLayerAnimationControllerImpl::add):
+        (WebCore::CCLayerAnimationControllerImpl::getActiveAnimation):
+        (WebCore::CCLayerAnimationControllerImpl::startAnimationsWaitingForNextTick):
+        (WebCore::CCLayerAnimationControllerImpl::startAnimationsWaitingForStartTime):
+        (WebCore::CCLayerAnimationControllerImpl::startAnimationsWaitingForTargetAvailability):
+        (WebCore::CCLayerAnimationControllerImpl::purgeFinishedAnimations):
+        (WebCore::CCLayerAnimationControllerImpl::tickAnimations):
+        * platform/graphics/chromium/cc/CCLayerAnimationControllerImpl.h:
+        (CCLayerAnimationControllerImplClient):
+        (CCLayerAnimationControllerImpl):
+        * platform/graphics/chromium/cc/CCLayerImpl.cpp:
+        (WebCore::CCLayerImpl::CCLayerImpl):
+        * platform/graphics/chromium/cc/CCLayerImpl.h:
+        (CCLayerImpl):
+        (WebCore::CCLayerImpl::id):
+        (WebCore::CCLayerImpl::opacity):
+        (WebCore::CCLayerImpl::transform):
+        (WebCore::CCLayerImpl::bounds):
+        (WebCore::CCLayerImpl::layerAnimationController):
+        * platform/graphics/chromium/cc/CCLayerTreeHost.cpp:
+        (WebCore::CCLayerTreeHost::finishCommitOnImplThread):
+        (WebCore::CCLayerTreeHost::setAnimationEvents):
+        (WebCore):
+        (WebCore::CCLayerTreeHost::didBecomeInvisibleOnImplThread):
+        * platform/graphics/chromium/cc/CCLayerTreeHost.h:
+        (WebCore::CCSettings::CCSettings):
+        (CCSettings):
+        (CCLayerTreeHost):
+        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.cpp:
+        (WebCore::CCLayerTreeHostImpl::CCLayerTreeHostImpl):
+        (WebCore::CCLayerTreeHostImpl::animate):
+        (WebCore::CCLayerTreeHostImpl::animateLayersRecursive):
+        (WebCore):
+        (WebCore::CCLayerTreeHostImpl::animatePageScale):
+        (WebCore::CCLayerTreeHostImpl::animateLayers):
+        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.h:
+        (CCLayerTreeHostImplClient):
+        (CCLayerTreeHostImpl):
+        (WebCore::CCLayerTreeHostImpl::needsAnimateLayers):
+        (WebCore::CCLayerTreeHostImpl::setNeedsAnimateLayers):
+        * platform/graphics/chromium/cc/CCSingleThreadProxy.cpp:
+        (WebCore::CCSingleThreadProxy::postAnimationEventsToMainThreadOnImplThread):
+        (WebCore):
+        * platform/graphics/chromium/cc/CCSingleThreadProxy.h:
+        (CCSingleThreadProxy):
+        (WebCore):
+        (DebugScopedSetMainThread):
+        (WebCore::DebugScopedSetMainThread::DebugScopedSetMainThread):
+        (WebCore::DebugScopedSetMainThread::~DebugScopedSetMainThread):
+        * platform/graphics/chromium/cc/CCThreadProxy.cpp:
+        (WebCore::CCThreadProxy::postAnimationEventsToMainThreadOnImplThread):
+        (WebCore):
+        (WebCore::CCThreadProxy::setAnimationEvents):
+        * platform/graphics/chromium/cc/CCThreadProxy.h:
+        (CCThreadProxy):
+
+2012-02-22  Anders Carlsson  <andersca@apple.com>
+
+        Subframes with scrollable areas must be added to the non-fast scrollable region
+        https://bugs.webkit.org/show_bug.cgi?id=79306
+        <rdar://problem/10915564>
+
+        Reviewed by Andreas Kling.
+
+        When computing the non-fast scrollable region, add subframes with scrollable regions to the region.
+
+        * page/scrolling/ScrollingCoordinator.cpp:
+        (WebCore::computeNonFastScrollableRegion):
+
+2012-02-22  Nate Chapin  <japhet@chromium.org>
+
+        CachedResourceLoader ignores the Range header
+        in determineRavlidationPolicy(), resulting in incorrect
+        cache hits.
+
+        Reviewed by Adam Barth.
+
+        Test: http/tests/xmlhttprequest/range-test.html
+        Test written by Aaron Colwell (acolwell@chromium.org).
+
+        * loader/cache/CachedResourceLoader.cpp:
+        (WebCore::CachedResourceLoader::determineRevalidationPolicy):
+
+2012-02-22  Antti Koivisto  <antti@apple.com>
+
+        REGRESSION (r104060): Web font is not loaded if specified by link element dynamically inserted
+        https://bugs.webkit.org/show_bug.cgi?id=79186
+
+        Reviewed by Andreas Kling.
+
+        Test: fast/css/font-face-insert-link.html
+        
+        If a dynamically inserted stylesheet contains @font-face rules, we may fail to update the rendering.
+        
+        Before r104060 the style selector was destroyed on every style change, and the font selector along with it.
+        This is no longer the case and we can't rely on comparing font selector pointers when comparing Fonts
+        for equality. This patch adds version number to the font selector and checks it in Font::operator==.
+        The version number is incremented when new font-face rules are added to the font selector.
+        
+        FontFallbackList is an object shared between Fonts so the extra field shouldn't matter much in terms
+        of memory.
+
+        * css/CSSFontSelector.cpp:
+        (WebCore::CSSFontSelector::CSSFontSelector):
+        (WebCore::CSSFontSelector::addFontFaceRule):
+        * css/CSSFontSelector.h:
+        (CSSFontSelector):
+        * platform/graphics/Font.cpp:
+        (WebCore::Font::operator==):
+        * platform/graphics/FontFallbackList.cpp:
+        (WebCore::FontFallbackList::FontFallbackList):
+        (WebCore::FontFallbackList::invalidate):
+        * platform/graphics/FontFallbackList.h:
+        (FontFallbackList):
+        (WebCore::FontFallbackList::fontSelectorVersion):
+        * platform/graphics/FontSelector.h:
+        (FontSelector):
+
+2012-02-22  Nate Chapin  <japhet@chromium.org>
+
+        Prevent CachedRawResource from sending the same data
+        chunk multiple times.
+        https://bugs.webkit.org/show_bug.cgi?id=78810
+
+        Reviewed by Adam Barth.
+
+        If a CachedRawResource receives data while a CachedRawResourceCallback
+        timer is active, the incremental data will be sent to the client, followed
+        but all data received so far, resulting in invalid data. Resolving this adds
+        complexity to CachedRawResource and requires making a few more CachedResource
+        functions virtual, so push the callback logic into CachedResource where it can
+        be implemented more cleanly.
+
+        Test: inspector/debugger/script-formatter-console.html
+            should no longer be flaky.
+
+        * loader/cache/CachedRawResource.cpp: CachedRawResourceCallback renamed and moved to CachedResource.
+        (WebCore::CachedRawResource::didAddClient): More or less the same as sendCallbacks() was.
+        * loader/cache/CachedRawResource.h:
+        * loader/cache/CachedResource.cpp:
+        (WebCore::CachedResource::addClient): Check the return value of addClientToSet() to determine whether
+            or not to call didAddClient.
+        (WebCore::CachedResource::didAddClient): May be called during addClient(), or may be called on a timer.
+            If called on a timer, move the client between sets.
+        (WebCore::CachedResource::addClientToSet): Determine whether didAddClient() can be called synchronously and
+            return true if it can.
+        (WebCore::CachedResource::removeClient): Ensure we cancel pending callbacks if necessary.
+        (WebCore::CachedResource::CachedResourceCallback::CachedResourceCallback): Renamed and moved from CachedRawResource.
+        * loader/cache/CachedResource.h:
+        (WebCore::CachedResource::hasClients): Check m_clientsAwaitingCallback as well as m_clients.
+        (WebCore::CachedResource::CachedResourceCallback::schedule):
+        (WebCore::CachedResource::hasClient): Helper for calling contains() on both m_clientsAwaitingCallback and m_clients.
+
+2012-02-22  Daniel Bates  <dbates@webkit.org>
+
+        Update change log entry for r108561 to reflect removal of "if (m_dispatchSoonList.isEmpty())".
+        https://bugs.webkit.org/show_bug.cgi?id=78840
+
+        Mention removal of unnecessary check for empty list m_dispatchSoonList in EventSender::cancelEvent().
+
+        Also, fix the date in the change log entry for changeset r108562 since it landed today (02/22/2012).
+
+2012-02-22  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Remove the remaining uses of CSSStyleDeclaration in Editor
+        https://bugs.webkit.org/show_bug.cgi?id=78939
+
+        Reviewed by Enrica Casucci.
+
+        Changed the argument types of shouldApplyStyle, applyParagraphStyle, applyStyleToSelection,
+        applyParagraphStyleToSelection, and computeAndSetTypingStyle in Editor from CSSStyleDeclaration
+        to StylePropertySet.
+
+        * WebCore.exp.in:
+        * WebCore.xcodeproj/project.pbxproj:
+        * editing/Editor.cpp:
+        (WebCore::Editor::applyStyle):
+        (WebCore::Editor::shouldApplyStyle):
+        (WebCore::Editor::applyParagraphStyle):
+        (WebCore::Editor::applyStyleToSelection):
+        (WebCore::Editor::applyParagraphStyleToSelection):
+        (WebCore::Editor::setBaseWritingDirection):
+        (WebCore::Editor::computeAndSetTypingStyle):
+        * editing/Editor.h:
+        (WebCore):
+        (Editor):
+        * editing/EditorCommand.cpp:
+        (WebCore::applyCommandToFrame):
+        (WebCore::executeApplyParagraphStyle):
+        (WebCore::executeMakeTextWritingDirectionLeftToRight):
+        (WebCore::executeMakeTextWritingDirectionNatural):
+        (WebCore::executeMakeTextWritingDirectionRightToLeft):
+        * loader/EmptyClients.h:
+        (WebCore::EmptyEditorClient::shouldApplyStyle):
+        * page/DragController.cpp:
+        (WebCore::DragController::concludeEditDrag):
+        * page/EditorClient.h:
+        (WebCore):
+        (EditorClient):
+
+2012-02-22  Daniel Bates  <dbates@webkit.org>
+
+        Abstract ImageEventSender into a general purpose EventSender
+        https://bugs.webkit.org/show_bug.cgi?id=78840
+
+        Reviewed by Adam Barth.
+
+        Abstract the functionality in ImageEventSender so that it can be used again.
+        This functionality may be useful in fixing WebKit Bug #38995.
+
+        No functionality was changed; no new tests.
+
+        * GNUmakefile.list.am: Added EventSender.h.
+        * Target.pri: Ditto.
+        * WebCore.gypi: Ditto.
+        * WebCore.vcproj/WebCore.vcproj: Ditto.
+        * WebCore.xcodeproj/project.pbxproj: Ditto.
+        * dom/EventSender.h: Added.
+        (WebCore):
+        (EventSender):
+        (WebCore::EventSender::eventType):
+        (WebCore::EventSender::hasPendingEvents):
+        (WebCore::EventSender::timerFired):
+        (WebCore::::EventSender):
+        (WebCore::::dispatchEventSoon):
+        (WebCore::::cancelEvent): Removed unnecessary check for empty list m_dispatchSoonList;
+        As far as I can tell this is an artifact of using a
+        QPtrList data structure for this functionality when it was originally in
+        DocumentImpl::removeImage() (see <http://trac.webkit.org/browser/trunk/WebCore/khtml/xml/DocumentImpl.cpp?rev=12515#L2302>),
+        which actually removed items from a list (as opposed to zeroing them out as we do
+        now).
+        (WebCore::::dispatchPendingEvents):
+        * loader/ImageLoader.cpp: Modified to use EventSender.
+        (WebCore):
+        (WebCore::ImageLoader::dispatchPendingEvent): Added; called by EventSender when the ImageLoader
+        should dispatch a pending BeforeLoad or Load event.
+        * loader/ImageLoader.h:
+        (WebCore):
+        (ImageLoader):
+
+2012-02-22  Max Vujovic  <mvujovic@adobe.com>
+
+        Paddings and borders on root SVG element with viewbox causes child SVG elements to be rendered with the incorrect size
+        https://bugs.webkit.org/show_bug.cgi?id=78613
+
+        Reviewed by Nikolas Zimmermann.
+
+        When computing its localToBorderBoxTransform, RenderSVGRoot was using its width and height
+        as the dimensions of the SVG viewport. However, width and height include CSS borders and
+        paddings, which are not part of the SVG viewport area. Now, RenderSVGRoot uses its
+        contentWidth and contentHeight, which correspond to the SVG viewport area.
+
+        Tests: svg/custom/svg-root-padding-border-margin-expected.html
+               svg/custom/svg-root-padding-border-margin.html
+
+        * rendering/svg/RenderSVGRoot.cpp:
+        (WebCore::RenderSVGRoot::buildLocalToBorderBoxTransform):
+
+2012-02-22  Raphael Kubo da Costa  <kubo@profusion.mobi>
+
+        [EFL] Get rid of GeolocationServiceEfl
+        https://bugs.webkit.org/show_bug.cgi?id=79270
+
+        Reviewed by Adam Barth.
+
+        These were just a bunch of dummy files with no real functionality, and
+        removing them helps the preparation of bug 78853, which will make
+        client-based geolocation the default.
+
+        No new tests, this functionality was not used.
+
+        * PlatformEfl.cmake:
+        * platform/efl/GeolocationServiceEfl.cpp: Removed.
+        * platform/efl/GeolocationServiceEfl.h: Removed.
+
+2012-02-22  Julien Chaffraix  <jchaffraix@webkit.org>
+
+        Clean-up RenderTableSection::calcRowLogicalHeight
+        https://bugs.webkit.org/show_bug.cgi?id=77705
+
+        Reviewed by Eric Seidel.
+
+        Refactoring / simplication of the code.
+
+        This change removes some variables that were unneeded and were
+        hiding what the code was really doing. Also some of the code was
+        split and moved down to RenderTableCell.
+
+        * rendering/RenderTableCell.cpp:
+        (WebCore::RenderTableCell::logicalHeightForRowSizing):
+        * rendering/RenderTableCell.h:
+        (RenderTableCell):
+        Added the previous helper function to calculate the cell's
+        adjusted logical height.
+
+        * rendering/RenderTableSection.cpp:
+        (WebCore::RenderTableSection::calcRowLogicalHeight):
+        Removed some variables, simplified the rowspan logic to be clearer
+        (and added a comment about how we handle rowspans).
+
+2012-02-22  Adam Barth  <abarth@webkit.org>
+
+        Move FILE_SYSTEM code out of DOMWindow and into the fileapi folder
+        https://bugs.webkit.org/show_bug.cgi?id=79259
+
+        Reviewed by Eric Seidel.
+
+        This patch is part of our ongoing effort to remove ifdefs from code
+        classes.  The FILE_SYSTEM code in DOMWindow doesn't really have any
+        necessary connection to DOMWindow.  DOMWindow is just the context
+        object that the API hangs off of.
+
+        This patch moves the FILE_SYSTEM code into the fileapi folder using
+        [Supplemental].
+
+        * CMakeLists.txt:
+        * DerivedSources.make:
+        * DerivedSources.pri:
+        * GNUmakefile.list.am:
+        * Target.pri:
+        * WebCore.gypi:
+        * fileapi/DOMWindowFileSystem.cpp: Added.
+        (WebCore):
+        (WebCore::DOMWindowFileSystem::DOMWindowFileSystem):
+        (WebCore::DOMWindowFileSystem::~DOMWindowFileSystem):
+        (WebCore::DOMWindowFileSystem::webkitRequestFileSystem):
+        (WebCore::DOMWindowFileSystem::webkitResolveLocalFileSystemURL):
+        * fileapi/DOMWindowFileSystem.h: Added.
+        (WebCore):
+        (DOMWindowFileSystem):
+        * fileapi/DOMWindowFileSystem.idl: Added.
+        * page/DOMWindow.cpp:
+        (WebCore):
+        * page/DOMWindow.h:
+        (WebCore):
+        (DOMWindow):
+        * page/DOMWindow.idl:
+
+2012-02-22  Luke Macpherson   <macpherson@chromium.org>
+
+        Re-implement many more HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE macros in CSSStyleApplyProperty.
+        https://bugs.webkit.org/show_bug.cgi?id=79200
+
+        Reviewed by Andreas Kling.
+
+        No new tests / refactoring only.
+
+        * css/CSSStyleApplyProperty.cpp:
+        (WebCore::CSSStyleApplyProperty::CSSStyleApplyProperty):
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::collectMatchingRulesForList):
+        * rendering/style/RenderStyle.h:
+
+2012-02-22  Tom Sepez  <tsepez@chromium.org>
+
+        XSSAuditor bypass with <svg> tags and html-entities.
+        https://bugs.webkit.org/show_bug.cgi?id=78836
+
+        Reviewed by Adam Barth.
+
+        Tests: http/tests/security/xssAuditor/iframe-onload-in-svg-tag.html
+               http/tests/security/xssAuditor/script-tag-inside-svg-tag.html
+               http/tests/security/xssAuditor/script-tag-inside-svg-tag2.html
+               http/tests/security/xssAuditor/script-tag-inside-svg-tag3.html
+
+        * html/parser/XSSAuditor.cpp:
+        (WebCore::isNonCanonicalCharacter):
+        (WebCore::isTerminatingCharacter):
+        (WebCore):
+        (WebCore::startsHTMLCommentAt):
+        (WebCore::startsSingleLineCommentAt):
+        (WebCore::fullyDecodeString):
+        (WebCore::XSSAuditor::XSSAuditor):
+        (WebCore::XSSAuditor::init):
+        (WebCore::XSSAuditor::filterToken):
+        (WebCore::XSSAuditor::filterStartToken):
+        (WebCore::XSSAuditor::filterEndToken):
+        (WebCore::XSSAuditor::filterCharacterToken):
+        (WebCore::XSSAuditor::filterScriptToken):
+        (WebCore::XSSAuditor::filterObjectToken):
+        (WebCore::XSSAuditor::filterParamToken):
+        (WebCore::XSSAuditor::filterEmbedToken):
+        (WebCore::XSSAuditor::filterAppletToken):
+        (WebCore::XSSAuditor::filterIframeToken):
+        (WebCore::XSSAuditor::filterMetaToken):
+        (WebCore::XSSAuditor::filterBaseToken):
+        (WebCore::XSSAuditor::filterFormToken):
+        (WebCore::XSSAuditor::decodedSnippetForAttribute):
+        (WebCore::XSSAuditor::snippetForJavaScript):
+        * html/parser/XSSAuditor.h:
+        (XSSAuditor):
+
+2012-02-22  Anders Carlsson  <andersca@apple.com>
+
+        Crash when marking cached pages for full style recalc
+        https://bugs.webkit.org/show_bug.cgi?id=79276
+        <rdar://problem/10884036>
+
+        Reviewed by Beth Dakin.
+
+        Guard against a null history item.
+
+        * history/BackForwardController.cpp:
+        (WebCore::BackForwardController::markPagesForFullStyleRecalc):
+
+2012-02-22  Ken Buchanan  <kenrb@chromium.org>
+
+        Crash from empty anonymous block preceding :before content
+        https://bugs.webkit.org/show_bug.cgi?id=78250
+
+        Reviewed by David Hyatt.
+
+        RenderListMarkers getting removed from the tree in updateMarkerLocation()
+        can leave parent anonymous blocks behind with no children. This was
+        confusing updateBeforeAfterContent() because it does not expect
+        an empty block to precede :before content renderers.
+
+        Fix is to remove the anonymous block if it will lose all of its children.
+
+        * rendering/RenderListItem.cpp:
+        (WebCore::RenderListItem::updateMarkerLocation):
+
+2012-02-22  Abhishek Arya  <inferno@chromium.org>
+
+        Crash due to accessing removed parent lineboxes when clearing view selection.
+        https://bugs.webkit.org/show_bug.cgi?id=79264
+
+        Reviewed by Eric Seidel.
+
+        When our block needed a full layout, we were deleting our own lineboxes
+        and letting descendant children (at any level in hierarchy and not just 
+        immediate children) clear their own lineboxes as we keep laying them out.
+        This was problematic because those descendant children lineboxes were
+        pointing to removed parent lineboxes in the meantime. An example scenario
+        where this would go wrong is first-letter object removal, which can cause
+        clearing view selection, leading to accessing parent lineboxes. The patch
+        modifies clearing the entire linebox tree upfront. It shouldn't introduce
+        performance issues since it will eventually happen as we are laying out
+        those children.
+ 
+        Test: fast/css-generated-content/first-letter-textbox-parent-crash.html
+
+        * rendering/RenderBlockLineLayout.cpp:
+        (WebCore::RenderBlock::layoutInlineChildren):
+
+2012-02-22  Abhishek Arya  <inferno@chromium.org>
+
+        Cloning and linebox issues in multi-column layout.
+        https://bugs.webkit.org/show_bug.cgi?id=78273
+
+        Reviewed by Eric Seidel.
+
+        Tests: fast/multicol/span/clone-flexbox.html
+               fast/multicol/span/clone-summary.html
+               fast/multicol/span/textbox-not-removed-crash.html
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::clone): Fix cloning algorithm to take
+        care of cloning descendant classes of RenderBlock.
+        (WebCore::RenderBlock::splitBlocks): When we move our inline children
+        to cloneBlock, we need to clear our entire line box tree. Any descendant
+        child in the hierarchy could be a part of our line box tree and will
+        never get cleared since the child has moved to new parent cloneBlock.
+
+2012-02-22  Tim Dresser  <tdresser@chromium.org>
+
+        CCLayerTreeHostImpl calls didDraw more frequently than willDraw
+        https://bugs.webkit.org/show_bug.cgi?id=79139
+
+        Reviewed by James Robinson.
+
+        Ensure that didDraw is called if and only if willDraw was called previously.
+
+        CCLayerTreeHostImplTest.didDrawNotCalledOnHiddenLayer has been added to ensure that
+        hidden layers, for which willDraw is not called, will also not have didDraw called.
+
+        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.cpp:
+        (WebCore::CCLayerTreeHostImpl::drawLayers):
+        * platform/graphics/chromium/cc/CCVideoLayerImpl.cpp:
+        (WebCore::CCVideoLayerImpl::didDraw):
+
+2012-02-22  Levi Weintraub  <leviw@chromium.org>
+
+        ScrollbarThemeComposite::thumbPosition uses the result of a divide by zero
+        https://bugs.webkit.org/show_bug.cgi?id=78910
+
+        Reviewed by Eric Seidel.
+
+        Adding a check to avoid doing a floating point divide by zero and assigning NaN to an integer.
+        This causes problems with our conversion to subpixel layout, which asserts when we overflow.
+
+        * platform/ScrollbarThemeComposite.cpp:
+        (WebCore::ScrollbarThemeComposite::thumbPosition):
+
+2012-02-22  Raymond Liu  <raymond.liu@intel.com>
+
+        Have the DynamicsCompressorNode support multi-channel data
+        https://bugs.webkit.org/show_bug.cgi?id=77856
+
+        Reviewed by Chris Rogers.
+
+        * platform/audio/DynamicsCompressor.cpp:
+        (WebCore::DynamicsCompressor::DynamicsCompressor):
+        (WebCore::DynamicsCompressor::setEmphasisStageParameters):
+        (WebCore::DynamicsCompressor::process):
+        (WebCore::DynamicsCompressor::reset):
+        (WebCore::DynamicsCompressor::setNumberOfChannels):
+        (WebCore):
+        * platform/audio/DynamicsCompressor.h:
+        (DynamicsCompressor):
+        * platform/audio/DynamicsCompressorKernel.cpp:
+        (WebCore::DynamicsCompressorKernel::DynamicsCompressorKernel):
+        (WebCore::DynamicsCompressorKernel::setNumberOfChannels):
+        (WebCore):
+        (WebCore::DynamicsCompressorKernel::setPreDelayTime):
+        (WebCore::DynamicsCompressorKernel::process):
+        (WebCore::DynamicsCompressorKernel::reset):
+        * platform/audio/DynamicsCompressorKernel.h:
+        (DynamicsCompressorKernel):
+        * webaudio/DynamicsCompressorNode.cpp:
+        (WebCore::DynamicsCompressorNode::DynamicsCompressorNode):
+        (WebCore::DynamicsCompressorNode::initialize):
+
+2012-02-22  Bear Travis  <betravis@adobe.com>
+
+        Not correctly recalculating layout for elements within nested SVG elements
+        https://bugs.webkit.org/show_bug.cgi?id=77535
+
+        Reviewed by Dirk Schulze.
+
+        Relatively positioned text is not correctly updating its position when the
+        size of its nearest viewport changes. Updating to mark text for layout when
+        viewPort size changes.
+        
+        Test: svg/repaint/inner-svg-change-viewPort-relative.svg
+
+        * rendering/svg/SVGRenderSupport.cpp:
+        (WebCore::SVGRenderSupport::layoutChildren):
+
+2012-02-22  Alexei Svitkine  <asvitkine@chromium.org>
+
+        [chromium] Fix remaining compositing/rubberbanding test failures
+        https://bugs.webkit.org/show_bug.cgi?id=78008
+
+        These were happening due to the fact that ScrollView wasn't updating
+        the overhang layer when the contentsSize was updated. This is necessary
+        because calculateOverhangAreasForPainting() takes the contentsSize into
+        account when determining whether the overhang areas are visible.
+
+        Reviewed by James Robinson.
+
+        Re-enabled the following tests with updated baselines:
+        * platform/chromium/compositing/rubberbanding/transform-overhang-e-expected.png:
+        * platform/chromium/compositing/rubberbanding/transform-overhang-s-expected.png:
+        * platform/chromium/compositing/rubberbanding/transform-overhang-se-expected.png:
+        * platform/chromium/test_expectations.txt:
+
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::setContentsSize):
+        (WebCore::ScrollView::scrollContents):
+        (WebCore::ScrollView::updateOverhangAreas):
+        (WebCore):
+        * platform/ScrollView.h:
+        (ScrollView):
+
+2012-02-22  Vsevolod Vlasov  <vsevik@chromium.org>
+
+        Web Inspector: [Regression] network worker tests crash on qt.
+        https://bugs.webkit.org/show_bug.cgi?id=79263
+
+        Reviewed by Pavel Feldman.
+
+        * inspector/InspectorPageAgent.cpp:
+        (WebCore::InspectorPageAgent::createDecoder):
+        (WebCore::InspectorPageAgent::cachedResourceContent):
+
+2012-02-22  Adrienne Walker  <enne@google.com>
+
+        Unreviewed, rolling out r108518.
+        http://trac.webkit.org/changeset/108518
+        https://bugs.webkit.org/show_bug.cgi?id=75864
+
+        Breaks surfaceOcclusionWithOverlappingSiblingSurfaces unit test.
+
+        * WebCore.gypi:
+        * platform/graphics/chromium/cc/CCLayerIterator.cpp:
+        (WebCore):
+        (WebCore::CCLayerIteratorActions::BackToFront::begin):
+        (WebCore::CCLayerIteratorActions::BackToFront::end):
+        (WebCore::CCLayerIteratorActions::BackToFront::next):
+        (WebCore::CCLayerIteratorActions::FrontToBack::begin):
+        (WebCore::CCLayerIteratorActions::FrontToBack::end):
+        (WebCore::CCLayerIteratorActions::FrontToBack::next):
+        (WebCore::CCLayerIteratorActions::FrontToBack::goToHighestInSubtree):
+        * platform/graphics/chromium/cc/CCLayerIterator.h:
+        (WebCore):
+        (WebCore::CCLayerIterator::CCLayerIterator):
+        (WebCore::CCLayerIterator::operator++):
+        (WebCore::CCLayerIterator::operator==):
+        (WebCore::CCLayerIterator::operator->):
+        (WebCore::CCLayerIterator::operator*):
+        (WebCore::CCLayerIterator::representsTargetRenderSurface):
+        (WebCore::CCLayerIterator::representsContributingRenderSurface):
+        (WebCore::CCLayerIterator::targetRenderSurfaceLayer):
+        (CCLayerIterator):
+        (BackToFront):
+        (FrontToBack):
+        * platform/graphics/chromium/cc/CCLayerIteratorPosition.h: Added.
+        (WebCore):
+        (CCLayerIteratorPositionValue):
+        (WebCore::CCLayerIteratorPosition::CCLayerIteratorPosition):
+        (CCLayerIteratorPosition):
+        (WebCore::CCLayerIteratorPosition::currentLayer):
+        (WebCore::CCLayerIteratorPosition::currentLayerRepresentsContributingRenderSurface):
+        (WebCore::CCLayerIteratorPosition::currentLayerRepresentsTargetRenderSurface):
+        (WebCore::CCLayerIteratorPosition::targetRenderSurfaceLayer):
+        (WebCore::CCLayerIteratorPosition::targetRenderSurface):
+        (WebCore::CCLayerIteratorPosition::targetRenderSurfaceChildren):
+        (WebCore::CCLayerIteratorPosition::operator==):
+
+2012-02-22  Dan Bernstein  <mitz@apple.com>
+
+        REGRESSION (r62632): page-break-inside: avoid is ignored
+        https://bugs.webkit.org/show_bug.cgi?id=79262
+
+        Reviewed by Adele Peterson.
+
+        This was disabled in r62632 because of <http://webkit.org/b/41532>. Changes to the
+        pagination code since then have invalidated that bug, so enabling the feature again does not
+        re-introduce the bug.
+
+        Updated expected results for printing/page-break-inside-avoid.html.
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::adjustForUnsplittableChild):
+
+2012-02-22  Philippe Normand  <pnormand@igalia.com>
+
+        [GStreamer] webkitwebsrc: use HTTP referer provided by MediaPlayer
+        https://bugs.webkit.org/show_bug.cgi?id=79236
+
+        Reviewed by Martin Robinson.
+
+        Store a pointer to the MediaPlayer object in the private structure
+        of the WebKitWebSrc element so we can call its public methods,
+        like ::referrer().
+
+        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::MediaPlayerPrivateGStreamer::sourceChanged):
+        * platform/graphics/gstreamer/WebKitWebSourceGStreamer.cpp:
+        (_WebKitWebSrcPrivate):
+        * platform/graphics/gstreamer/WebKitWebSourceGStreamer.h:
+
+2012-02-22  Martin Robinson  <mrobinson@igalia.com>
+
+        [GTK] Clean build is broken when using make -j
+        https://bugs.webkit.org/show_bug.cgi?id=76388
+
+        No new tests. This is just a build fix.
+
+        Use order-only dependencies to ensure that built sources are built before
+        files that depend on them.
+
+        * GNUmakefile.am: Establish an order-only dependency on some built sources before starting
+        to build non-generated sources. Rename some temporary files and variables to be more consistent.
+        * bindings/gobject/GNUmakefile.am: Updated to reflect new variable names.
+
+2012-02-22  Dana Jansens  <danakj@chromium.org>
+
+        [Chromium] New CCOcclusionTracker class with tests
+        https://bugs.webkit.org/show_bug.cgi?id=78549
+
+        Reviewed by James Robinson.
+
+        Adds a CCOcclusionTrackerBase template class that is able to track occlusion
+        of layers while traversing the layer tree from front-to-back, with typedefed
+        versions for the main and impl threads.
+
+        At each step of the front-to-back traversal, the class should be notified of
+        changes to the current render target, and when done working with a layer, the
+        layer is added the tracked occlusion.
+
+        The class provides tests for checking if a rect in content space
+        for a layer/surface is occluded by others in front of it.
+
+        Unit tests: CCOcclusionTrackerTest.cpp
+
+        * WebCore.gypi:
+        * platform/graphics/chromium/cc/CCOcclusionTracker.cpp: Added.
+        (WebCore):
+        (WebCore::::enterTargetRenderSurface):
+        (WebCore::::finishedTargetRenderSurface):
+        (WebCore::transformSurfaceOpaqueRegion):
+        (WebCore::::leaveToTargetRenderSurface):
+        (WebCore::contentToScreenSpaceTransform):
+        (WebCore::contentToTargetSurfaceTransform):
+        (WebCore::computeOcclusionBehindLayer):
+        (WebCore::::markOccludedBehindLayer):
+        (WebCore::testContentRectOccluded):
+        (WebCore::::occluded):
+        (WebCore::::surfaceOccluded):
+        (WebCore::rectSubtractRegion):
+        (WebCore::computeUnoccludedContentRect):
+        (WebCore::::unoccludedContentRect):
+        (WebCore::::surfaceUnoccludedContentRect):
+        (WebCore::::currentOcclusionInScreenSpace):
+        (WebCore::::currentOcclusionInTargetSurface):
+        * platform/graphics/chromium/cc/CCOcclusionTracker.h: Added.
+        (WebCore):
+        (CCOcclusionTrackerBase):
+        (WebCore::CCOcclusionTrackerBase::CCOcclusionTrackerBase):
+        (StackObject):
+
+2012-02-22  Joshua Bell  <jsbell@chromium.org>
+
+        [Chromium] IndexedDB: Integrate with about:tracing
+        https://bugs.webkit.org/show_bug.cgi?id=78831
+
+        Annotate interesting IDB functions so they show up in the
+        tracing utility included in the Chromium port.
+
+        Reviewed by Tony Chang.
+
+        * WebCore.gypi:
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/v8/IDBBindingUtilities.cpp:
+        (WebCore::createIDBKeyFromSerializedValueAndKeyPath):
+        (WebCore::injectIDBKeyIntoSerializedValue):
+        * storage/IDBCursor.cpp:
+        (WebCore::IDBCursor::direction):
+        (WebCore::IDBCursor::key):
+        (WebCore::IDBCursor::primaryKey):
+        (WebCore::IDBCursor::value):
+        (WebCore::IDBCursor::update):
+        (WebCore::IDBCursor::continueFunction):
+        (WebCore::IDBCursor::deleteFunction):
+        * storage/IDBCursorBackendImpl.cpp:
+        (WebCore::IDBCursorBackendImpl::direction):
+        (WebCore::IDBCursorBackendImpl::key):
+        (WebCore::IDBCursorBackendImpl::primaryKey):
+        (WebCore::IDBCursorBackendImpl::value):
+        (WebCore::IDBCursorBackendImpl::update):
+        (WebCore::IDBCursorBackendImpl::continueFunction):
+        (WebCore::IDBCursorBackendImpl::continueFunctionInternal):
+        (WebCore::IDBCursorBackendImpl::deleteFunction):
+        (WebCore::IDBCursorBackendImpl::prefetchContinue):
+        (WebCore::IDBCursorBackendImpl::prefetchContinueInternal):
+        (WebCore::IDBCursorBackendImpl::prefetchReset):
+        (WebCore::IDBCursorBackendImpl::close):
+        * storage/IDBDatabase.cpp:
+        (WebCore::IDBDatabase::dispatchEvent):
+        * storage/IDBIndex.cpp:
+        (WebCore::IDBIndex::openCursor):
+        (WebCore::IDBIndex::count):
+        (WebCore::IDBIndex::openKeyCursor):
+        (WebCore::IDBIndex::get):
+        (WebCore::IDBIndex::getKey):
+        * storage/IDBIndexBackendImpl.cpp:
+        (WebCore::IDBIndexBackendImpl::openCursorInternal):
+        (WebCore::IDBIndexBackendImpl::openCursor):
+        (WebCore::IDBIndexBackendImpl::openKeyCursor):
+        (WebCore::IDBIndexBackendImpl::countInternal):
+        (WebCore::IDBIndexBackendImpl::count):
+        (WebCore::IDBIndexBackendImpl::getInternal):
+        (WebCore::IDBIndexBackendImpl::get):
+        (WebCore::IDBIndexBackendImpl::getKey):
+        * storage/IDBObjectStore.cpp:
+        (WebCore::IDBObjectStore::name):
+        (WebCore::IDBObjectStore::keyPath):
+        (WebCore::IDBObjectStore::indexNames):
+        (WebCore::IDBObjectStore::transaction):
+        (WebCore::IDBObjectStore::get):
+        (WebCore::IDBObjectStore::add):
+        (WebCore::IDBObjectStore::put):
+        (WebCore::IDBObjectStore::deleteFunction):
+        (WebCore::IDBObjectStore::clear):
+        (WebCore::IDBObjectStore::createIndex):
+        (WebCore::IDBObjectStore::index):
+        (WebCore::IDBObjectStore::openCursor):
+        (WebCore::IDBObjectStore::count):
+        * storage/IDBObjectStoreBackendImpl.cpp:
+        (WebCore::IDBObjectStoreBackendImpl::get):
+        (WebCore::IDBObjectStoreBackendImpl::getInternal):
+        (WebCore::fetchKeyFromKeyPath):
+        (WebCore::injectKeyIntoKeyPath):
+        (WebCore::IDBObjectStoreBackendImpl::put):
+        (WebCore::IDBObjectStoreBackendImpl::putInternal):
+        (WebCore::IDBObjectStoreBackendImpl::deleteFunction):
+        (WebCore::IDBObjectStoreBackendImpl::deleteInternal):
+        (WebCore::IDBObjectStoreBackendImpl::clear):
+        (WebCore::IDBObjectStoreBackendImpl::openCursor):
+        (WebCore::IDBObjectStoreBackendImpl::openCursorInternal):
+        (WebCore::IDBObjectStoreBackendImpl::count):
+        (WebCore::IDBObjectStoreBackendImpl::countInternal):
+        * storage/IDBRequest.cpp:
+        (WebCore::IDBRequest::onSuccess):
+        (WebCore::IDBRequest::onSuccessWithContinuation):
+        (WebCore::IDBRequest::dispatchEvent):
+        * storage/IDBTracing.h: Added.
+        * storage/IDBTransaction.cpp:
+        (WebCore::IDBTransaction::dispatchEvent):
+        * storage/IDBTransactionBackendImpl.cpp:
+        (WebCore::IDBTransactionBackendImpl::abort):
+        (WebCore::IDBTransactionBackendImpl::commit):
+        (WebCore::IDBTransactionBackendImpl::taskTimerFired):
+        (WebCore::IDBTransactionBackendImpl::taskEventTimerFired):
+
+2012-02-22  Dana Jansens  <danakj@chromium.org>
+
+        [chromium] Push CCLayerIteratorPosition struct into CCLayerIterator class.
+        https://bugs.webkit.org/show_bug.cgi?id=75864
+
+        Reviewed by James Robinson.
+
+        * platform/graphics/chromium/cc/CCLayerIterator.cpp:
+        (WebCore::CCLayerIteratorActions::BackToFront::begin):
+        (WebCore::CCLayerIteratorActions::BackToFront::end):
+        (WebCore::CCLayerIteratorActions::BackToFront::next):
+        (WebCore::CCLayerIteratorActions::FrontToBack::begin):
+        (WebCore::CCLayerIteratorActions::FrontToBack::end):
+        (WebCore::CCLayerIteratorActions::FrontToBack::next):
+        (WebCore::CCLayerIteratorActions::FrontToBack::goToHighestInSubtree):
+        * platform/graphics/chromium/cc/CCLayerIterator.h:
+        (WebCore::CCLayerIterator::CCLayerIterator):
+        (WebCore::CCLayerIterator::operator++):
+        (WebCore::CCLayerIterator::operator==):
+        (WebCore::CCLayerIterator::operator->):
+        (WebCore::CCLayerIterator::operator*):
+        (WebCore::CCLayerIterator::representsTargetRenderSurface):
+        (WebCore::CCLayerIterator::representsContributingRenderSurface):
+        (WebCore::CCLayerIterator::currentLayer):
+        (WebCore::CCLayerIterator::currentLayerRepresentsContributingRenderSurface):
+        (WebCore::CCLayerIterator::currentLayerRepresentsTargetRenderSurface):
+        (WebCore::CCLayerIterator::targetRenderSurfaceLayer):
+        (WebCore::CCLayerIterator::targetRenderSurface):
+        (WebCore::CCLayerIterator::targetRenderSurfaceChildren):
+        * platform/graphics/chromium/cc/CCLayerIteratorPosition.h: Removed.
+
+2012-02-22  Pavel Feldman  <pfeldman@google.com>
+
+        Web Inspector: console doesn't show properly arrays from which tail values have been deleted
+        https://bugs.webkit.org/show_bug.cgi?id=79242
+
+        Reviewed by Yury Semikhatsky.
+
+        * English.lproj/localizedStrings.js:
+        * inspector/front-end/ConsoleMessage.js:
+        (WebInspector.ConsoleMessageImpl.prototype._printArray.appendUndefined):
+        (WebInspector.ConsoleMessageImpl.prototype._printArray):
+
+2012-02-22  Pavel Feldman  <pfeldman@google.com>
+
+        Web Inspector: warning external font mime (font/font/woff).
+        https://bugs.webkit.org/show_bug.cgi?id=79244
+
+        Reviewed by Yury Semikhatsky.
+
+        * inspector/front-end/Resource.js:
+
+2012-02-22  Yury Semikhatsky  <yurys@chromium.org>
+
+        Web Inspector: use dots as markers on the counter graphs
+        https://bugs.webkit.org/show_bug.cgi?id=79243
+
+        Changed counter graphs marker and counter text styles.
+
+        Reviewed by Pavel Feldman.
+
+        * English.lproj/localizedStrings.js:
+        * inspector/front-end/MemoryStatistics.js:
+        (WebInspector.MemoryStatistics):
+        (WebInspector.MemoryStatistics.prototype._createCounterSidebarElement):
+        (WebInspector.MemoryStatistics.prototype.addTimlineEvent):
+        (WebInspector.MemoryStatistics.prototype._draw):
+        (WebInspector.MemoryStatistics.prototype._onMouseOut):
+        (WebInspector.MemoryStatistics.prototype._onMouseOver):
+        (WebInspector.MemoryStatistics.prototype._onMouseMove):
+        (WebInspector.MemoryStatistics.prototype._refreshCurrentValues):
+        (WebInspector.MemoryStatistics.prototype._recordIndexAt):
+        (WebInspector.MemoryStatistics.prototype._highlightCurrentPositionOnGraphs):
+        (WebInspector.MemoryStatistics.prototype._clearMarkers):
+        (WebInspector.MemoryStatistics.prototype._saveImageUnderMarker):
+        (WebInspector.MemoryStatistics.prototype.refresh):
+        (WebInspector.MemoryStatistics.prototype._drawPolyline):
+        (WebInspector.MemoryStatistics.prototype._clear):
+        * inspector/front-end/timelinePanel.css:
+        (.memory-counter-sidebar-info):
+        (.memory-counter-sidebar-info .title):
+        (.memory-counter-sidebar-info .counter-value):
+
+2012-02-22  Pavel Feldman  <pfeldman@google.com>
+
+        Web Inspector: make 'glue asynchronous events' optional.
+        https://bugs.webkit.org/show_bug.cgi?id=79240
+
+        Reviewed by Yury Semikhatsky.
+
+        * English.lproj/localizedStrings.js:
+        * inspector/front-end/Images/statusbarButtonGlyphs.png:
+        * inspector/front-end/TimelinePanel.js:
+        (WebInspector.TimelinePanel.prototype.get statusBarItems):
+        (WebInspector.TimelinePanel.prototype._createStatusbarButtons):
+        (WebInspector.TimelinePanel.prototype._glueParentButtonClicked):
+        (WebInspector.TimelinePanel.prototype._toggleStartAtZeroButtonClicked):
+        (WebInspector.TimelinePanel.prototype._repopulateRecords):
+        (WebInspector.TimelinePanel.prototype._findParentRecord):
+        (WebInspector.TimelinePanel.prototype._innerAddRecordToTimeline):
+        (WebInspector.TimelinePanel.prototype.sidebarResized):
+        (WebInspector.TimelineCalculator.prototype.computeBarGraphPercentages):
+        (WebInspector.TimelineCalculator.prototype.computeBarGraphWindowPosition):
+        (WebInspector.TimelineRecordGraphRow):
+        (WebInspector.TimelineRecordGraphRow.prototype.update):
+        (WebInspector.TimelinePanel.FormattedRecord.prototype._calculateAggregatedStats):
+        * inspector/front-end/timelinePanel.css:
+        (.glue-async-status-bar-item .glyph):
+        (.timeline-start-at-zero-status-bar-item .glyph):
+
+2012-02-22  Vsevolod Vlasov  <vsevik@chromium.org>
+
+        Web Inspector: [REGRESSION] Console xhr logging is broken for async xhrs since r107672.
+        https://bugs.webkit.org/show_bug.cgi?id=79229
+
+        Reviewed by Pavel Feldman.
+
+        Test: http/tests/inspector/console-xhr-logging-async.html
+
+        * inspector/InspectorResourceAgent.cpp:
+        (WebCore::InspectorResourceAgent::setInitialScriptContent):
+        * xml/XMLHttpRequest.cpp:
+        (WebCore::XMLHttpRequest::didFinishLoading):
+
+2012-02-22  Andrey Kosyakov  <caseq@chromium.org>
+
+        Web Inspector: fix memory counters and start-at-zero modes of timeline panels to co-exist nicely
+        https://bugs.webkit.org/show_bug.cgi?id=79241
+
+        Reviewed by Yury Semikhatsky.
+
+        * inspector/front-end/MemoryStatistics.js:
+        (WebInspector.MemoryStatistics.prototype.addTimlineEvent):
+        * inspector/front-end/TimelineOverviewPane.js:
+        (WebInspector.TimelineOverviewPane):
+        (WebInspector.TimelineOverviewPane.prototype._showTimelines):
+        (WebInspector.TimelineOverviewPane.prototype._showMemoryGraph):
+        (WebInspector.TimelineOverviewPane.prototype.setStartAtZero):
+        (WebInspector.TimelineOverviewPane.prototype._onWindowChanged):
+        * inspector/front-end/TimelinePanel.js:
+        (WebInspector.TimelinePanel.prototype._timelinesOverviewModeChanged):
+
+2012-02-22  Andrey Kosyakov  <caseq@chromium.org>
+
+        Web Inspector: [experimental] add a mode to display timeline events aligned by the start time
+        https://bugs.webkit.org/show_bug.cgi?id=79123
+
+        Reviewed by Pavel Feldman.
+
+        * inspector/front-end/Images/statusbarButtonGlyphs.png:
+        * inspector/front-end/Settings.js:
+        (WebInspector.ExperimentsSettings):
+        * inspector/front-end/TimelineOverviewPane.js:
+        (WebInspector.TimelineOverviewPane):
+        (WebInspector.TimelineOverviewPane.prototype._showTimelines):
+        (WebInspector.TimelineOverviewPane.prototype._showMemoryGraph):
+        (WebInspector.TimelineOverviewPane.prototype._onWindowChanged):
+        (WebInspector.TimelineOverviewPane.prototype.setStartAtZero):
+        (WebInspector.TimelineOverviewPane.prototype.update):
+        (WebInspector.TimelineOverviewPane.prototype.reset):
+        (WebInspector.TimelineOverviewWindow):
+        (WebInspector.TimelineOverviewWindow.prototype.reset):
+        (WebInspector.TimelineOverviewWindow.prototype._setWindowPosition):
+        (WebInspector.TimelineOverviewWindow.prototype.scrollWindow):
+        (WebInspector.TimelineStartAtZeroOverview):
+        (WebInspector.TimelineStartAtZeroOverview.prototype.reset):
+        (WebInspector.TimelineStartAtZeroOverview.prototype.update):
+        (WebInspector.TimelineStartAtZeroOverview.prototype._filterRecords):
+        (WebInspector.TimelineStartAtZeroOverview.prototype._buildBar):
+        (WebInspector.TimelineStartAtZeroOverview.prototype._onWindowChanged):
+        * inspector/front-end/TimelinePanel.js:
+        (WebInspector.TimelinePanel.prototype.get statusBarItems):
+        (WebInspector.TimelinePanel.prototype._createStatusbarButtons):
+        (WebInspector.TimelinePanel.prototype._toggleStartAtZeroButtonClicked):
+        (WebInspector.TimelinePanel.prototype.get _startAtZero):
+        (WebInspector.TimelinePanel.prototype._innerAddRecordToTimeline):
+        (WebInspector.TimelinePanel.prototype.sidebarResized):
+        (WebInspector.TimelinePanel.prototype._onRecordsCleared):
+        (WebInspector.TimelinePanel.prototype._resetPanel):
+        (WebInspector.TimelinePanel.prototype._scheduleRefresh):
+        (WebInspector.TimelinePanel.prototype._refresh):
+        (WebInspector.TimelinePanel.prototype._filterRecords):
+        (WebInspector.TimelinePanel.prototype._refreshRecords):
+        (WebInspector.TimelineCalculator.prototype.computeBarGraphWindowPosition):
+        (WebInspector.TimelineStartAtZeroCalculator):
+        (WebInspector.TimelineStartAtZeroCalculator.prototype.computeBarGraphPercentages):
+        (WebInspector.TimelineStartAtZeroCalculator.prototype.computeBarGraphWindowPosition):
+        (WebInspector.TimelineStartAtZeroCalculator.prototype.calculateWindow):
+        (WebInspector.TimelineStartAtZeroCalculator.prototype.reset):
+        (WebInspector.TimelineStartAtZeroCalculator.prototype.updateBoundaries):
+        (WebInspector.TimelineStartAtZeroCalculator.prototype.formatValue):
+        (WebInspector.TimelinePanel.FormattedRecord):
+        (WebInspector.TimelinePanel.FormattedRecord.prototype._generateAggregatedInfo):
+        (WebInspector.TimelinePanel.FormattedRecord.prototype._generatePopupContent):
+        (WebInspector.TimelinePanel.FormattedRecord.prototype._calculateAggregatedStats):
+        (WebInspector.TimelinePanel.FormattedRecord.prototype.get aggregatedStats):
+        (WebInspector.TimelineModel.prototype.get records):
+        (WebInspector.TimelinePresentationModel):
+        (WebInspector.TimelinePresentationModel.prototype.reset):
+        (WebInspector.TimelinePresentationModel.prototype.setWindowIndices):
+        (WebInspector.TimelineRecordFilter):
+        (WebInspector.TimelineRecordFilter.prototype.accept):
+        (WebInspector.TimelineStartAtZeroRecordFilter):
+        (WebInspector.TimelineStartAtZeroRecordFilter.prototype.accept):
+        * inspector/front-end/timelinePanel.css:
+        (.timeline-start-at-zero #timeline-overview-sidebar):
+        (.timeline-start-at-zero #timeline-overview-grid):
+        (.timeline-overview-window):
+        (.timeline-start-at-zero .timeline-overview-window):
+        (.timeline-start-at-zero .timeline-overview-dividers-background):
+        (.timeline-overview-window-rulers):
+        (.timeline-start-at-zero #timeline-overview-memory):
+        (.popover .timeline-loading):
+        (.popover .timeline-scripting):
+        (.popover .timeline-rendering):
+        (.timeline-start-at-zero-status-bar-item .glyph):
+        (.timeline-start-at-zero-status-bar-item.toggled-on .glyph):
+        (.timeline-overview-start-at-zero):
+        (.timeline-overview-start-at-zero-bars):
+        (.timeline-overview-start-at-zero-bars .padding):
+        (.timeline-overview-start-at-zero-bars .timeline-bar-vertical):
+        (.timeline-bar-vertical div:first-child):
+        (.timeline-bar-vertical .timeline-loading):
+        (.timeline-bar-vertical .timeline-scripting):
+        (.timeline-bar-vertical .timeline-rendering):
+
+2012-02-22  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        [Qt] Disregard previous backing store as soon as possible
+        https://bugs.webkit.org/show_bug.cgi?id=79232
+
+        Reviewed by Simon Hausmann and No'am Rosenthal.
+
+        Make it possible to drop non-visible tiles and to test
+        if the current visible rect is fully covered.
+
+        * platform/graphics/TiledBackingStore.cpp:
+        (WebCore::TiledBackingStore::visibleContentsRect):
+        (WebCore::TiledBackingStore::coverageRatio):
+        (WebCore::TiledBackingStore::visibleAreaIsCovered):
+        (WebCore):
+        (WebCore::TiledBackingStore::createTiles):
+        (WebCore::TiledBackingStore::removeAllNonVisibleTiles):
+        * platform/graphics/TiledBackingStore.h:
+        (TiledBackingStore):
+
+2012-02-22  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        [Qt] Move QMenu dependant scrollbar context menu handling out of WebCore
+        https://bugs.webkit.org/show_bug.cgi?id=79233
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Move the code into WebKit/qt/Api/qwebpage.cpp, the only place where it is called from.
+
+        * Target.pri: Remove ScrollbarQt.cpp from build.
+        * platform/Scrollbar.h: Remove Qt-only context menu handling but make moveThum
+        accessible from the outside.
+        * platform/qt/ScrollbarQt.cpp: Removed. Not needed anymore.
+
+2012-02-22  Vsevolod Vlasov  <vsevik@chromium.org>
+
+        Web Inspector: retrieving content for some XHR requests crashes inspected page renderer
+        https://bugs.webkit.org/show_bug.cgi?id=79026
+
+        Reviewed by Pavel Feldman.
+
+        Fixed loading empty xhr content and xhr content decoding that was
+        broken in r107672.
+
+        Tests: http/tests/inspector/network/network-cyrillic-xhr.html
+               http/tests/inspector/network/network-empty-xhr.html
+
+        * inspector/InspectorPageAgent.cpp:
+        (WebCore):
+        (WebCore::InspectorPageAgent::createDecoder):
+        (WebCore::InspectorPageAgent::cachedResourceContent):
+        * inspector/InspectorPageAgent.h:
+        (WebCore):
+        * inspector/NetworkResourcesData.cpp:
+        (WebCore::NetworkResourcesData::ResourceData::decodeDataToContent):
+        (WebCore::NetworkResourcesData::responseReceived):
+        * inspector/NetworkResourcesData.h:
+        (WebCore::NetworkResourcesData::ResourceData::decoder):
+        (WebCore::NetworkResourcesData::ResourceData::setDecoder):
+
+2012-02-22  Peter Rybin  <peter.rybin@gmail.com>
+
+        Web Inspector: CodeGeneratorInspector.py: remove neural-net-style constructions
+        https://bugs.webkit.org/show_bug.cgi?id=79153
+
+        Reviewed by Yury Semikhatsky.
+
+        CParamType class removed completely, some ("virtual") methods are
+        removed. TypeModel notion is added instead with some minor helper
+        classes and methods.
+
+        * inspector/CodeGeneratorInspector.py:
+        (DomainNameFixes):
+        (RawTypes.BaseType):
+        (RawTypes.String):
+        (RawTypes.String.get_raw_type_model):
+        (RawTypes.Int):
+        (RawTypes.Int.get_raw_type_model):
+        (RawTypes.Number):
+        (RawTypes.Number.get_raw_type_model):
+        (RawTypes.Bool):
+        (RawTypes.Bool.get_raw_type_model):
+        (RawTypes.Object):
+        (RawTypes.Object.get_raw_type_model):
+        (RawTypes.Any):
+        (RawTypes.Any.get_raw_type_model):
+        (RawTypes.Array):
+        (RawTypes.Array.get_raw_type_model):
+        (replace_right_shift):
+        (CommandReturnPassModel):
+        (CommandReturnPassModel.ByReference):
+        (CommandReturnPassModel.ByReference.__init__):
+        (CommandReturnPassModel.ByReference.get_return_var_type):
+        (CommandReturnPassModel.get_output_argument_prefix):
+        (CommandReturnPassModel.get_output_to_raw_expression):
+        (CommandReturnPassModel.get_output_parameter_type):
+        (CommandReturnPassModel.get_set_return_condition):
+        (CommandReturnPassModel.ByPointer):
+        (CommandReturnPassModel.ByPointer.__init__):
+        (CommandReturnPassModel.ByPointer.get_return_var_type):
+        (TypeModel):
+        (TypeModel.RefPtrBased):
+        (TypeModel.RefPtrBased.__init__):
+        (TypeModel.RefPtrBased.get_optional):
+        (TypeModel.RefPtrBased.get_command_return_pass_model):
+        (TypeModel.RefPtrBased.get_input_param_type_text):
+        (TypeModel.RefPtrBased.get_event_setter_expression_pattern):
+        (TypeModel.Enum):
+        (TypeModel.Enum.__init__):
+        (TypeModel.Enum.get_optional):
+        (TypeModel.Enum.get_optional.EnumOptional):
+        (TypeModel.Enum.get_optional.EnumOptional.get_optional):
+        (TypeModel.Enum.get_optional.EnumOptional.get_command_return_pass_model):
+        (TypeModel.Enum.get_input_param_type_text):
+        (TypeModel.Enum.get_event_setter_expression_pattern):
+        (TypeModel.Enum.get_command_return_pass_model):
+        (TypeModel.ValueType):
+        (TypeModel.ValueType.__init__):
+        (TypeModel.ValueType.get_optional):
+        (TypeModel.ValueType.get_command_return_pass_model):
+        (TypeModel.ValueType.get_input_param_type_text):
+        (TypeModel.ValueType.get_event_setter_expression_pattern):
+        (TypeModel.ValueType.ValueOptional):
+        (TypeModel.ValueType.ValueOptional.__init__):
+        (TypeModel.ValueType.ValueOptional.get_optional):
+        (TypeModel.ValueType.ValueOptional.get_command_return_pass_model):
+        (TypeModel.ValueType.ValueOptional.get_input_param_type_text):
+        (TypeModel.ValueType.ValueOptional.get_event_setter_expression_pattern):
+        (TypeModel.init_class):
+        (TypeBindings.create_ad_hoc_type_declaration.Helper):
+        (TypeBindings.create_type_declaration_.EnumBinding.get_array_item_c_type_text):
+        (TypeBindings.create_type_declaration_.EnumBinding.get_setter_value_expression_pattern):
+        (TypeBindings.create_type_declaration_.EnumBinding):
+        (TypeBindings.create_type_declaration_.EnumBinding.get_type_model):
+        (TypeBindings.create_type_declaration_):
+        (TypeBindings.create_type_declaration_.get_type_model):
+        (TypeBindings.create_type_declaration_.get_array_item_c_type_text):
+        (get_type_model):
+        (AdHocTypeContextImpl.__init__):
+        (PlainObjectBinding):
+        (PlainObjectBinding.get_type_model):
+        (AdHocTypeContext):
+        (ArrayBinding.get_array_item_c_type_text):
+        (ArrayBinding):
+        (ArrayBinding.get_type_model):
+        (RawTypeBinding.get_validator_call_text):
+        (RawTypeBinding.reduce_to_raw_type):
+        (RawTypeBinding):
+        (RawTypeBinding.get_type_model):
+        (MethodGenerateModes.StrictParameterMode.get_c_param_type_text):
+        (MethodGenerateModes.RawParameterMode.get_c_param_type_text):
+        (MethodGenerateModes.CombinedMode.get_c_param_type_text):
+        (Generator.go):
+        (Generator.process_event):
+        (Generator.process_command):
+        (Generator.resolve_type_and_generate_ad_hoc):
+        (Generator.resolve_type_and_generate_ad_hoc.AdHocTypeContext):
+        * inspector/InspectorDebuggerAgent.cpp:
+        (WebCore::InspectorDebuggerAgent::didParseSource):
+
+2012-02-21  Vsevolod Vlasov  <vsevik@chromium.org>
+
+        Web Inspector: [InspectorIndexedDB] Show IndexedDB views on selection IndexedDB elements in resources panel.
+        https://bugs.webkit.org/show_bug.cgi?id=79098
+
+        Reviewed by Pavel Feldman.
+
+        * English.lproj/localizedStrings.js:
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * inspector/InspectorIndexedDBAgent.cpp:
+        (WebCore):
+        * inspector/compile-front-end.sh:
+        * inspector/front-end/IndexedDBModel.js:
+        (WebInspector.IndexedDBModel.prototype._assertFrameId):
+        (WebInspector.IndexedDBModel.prototype.loadObjectStoreData):
+        (WebInspector.IndexedDBModel.prototype.loadIndexData):
+        * inspector/front-end/IndexedDBViews.js: Added.
+        * inspector/front-end/ObjectPropertiesSection.js:
+        (WebInspector.ObjectPropertiesSection):
+        (WebInspector.ObjectPropertiesSection.prototype.updateProperties):
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourcesPanel.prototype.showIndexedDB):
+        (WebInspector.IndexedDBTreeElement.prototype.refreshIndexedDB):
+        (WebInspector.IndexedDBTreeElement.prototype._indexedDBAdded):
+        (WebInspector.IDBDatabaseTreeElement):
+        (WebInspector.IDBDatabaseTreeElement.prototype.get itemURL):
+        (WebInspector.IDBDatabaseTreeElement.prototype.update):
+        (WebInspector.IDBDatabaseTreeElement.prototype.onselect):
+        (WebInspector.IDBObjectStoreTreeElement):
+        (WebInspector.IDBObjectStoreTreeElement.prototype.get itemURL):
+        (WebInspector.IDBObjectStoreTreeElement.prototype.update):
+        (WebInspector.IDBObjectStoreTreeElement.prototype.onselect):
+        (WebInspector.IDBIndexTreeElement):
+        (WebInspector.IDBIndexTreeElement.prototype.get itemURL):
+        (WebInspector.IDBIndexTreeElement.prototype.update):
+        (WebInspector.IDBIndexTreeElement.prototype.onselect):
+        * inspector/front-end/WebKit.qrc:
+        * inspector/front-end/externs.js:
+        * inspector/front-end/indexedDBViews.css: Added.
+        * inspector/front-end/inspector.html:
+
+2012-02-22  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        REGRESSION(58212): html foreignObjects with positions other than static not hidden correctly when parent has display:none
+        https://bugs.webkit.org/show_bug.cgi?id=41386
+
+        Reviewed by Zoltan Herczeg.
+
+        r58212 gave SVGGElements a renderer, regardless if "display: none" was set or not, for various reasons (see change set).
+        The <g> renderer for such cases is a RenderSVGHiddenContainer. We make sure in SVG that such subtrees are never used
+        for painting & hittesting - they only exist for the purpose of SVG DOM (query getCTM, etc..) and to create renderers
+        for child resources, like <g display="none"><linearGradient>.
+
+        This concept still works fine for: <g display="none"><foreignObject><body>Foobar</body></foreignObject></g>, as
+        RenderSVGForeignObject::paint is never called thus we never paint the subtree of the <fO>. If the <body> elements
+        contains "position: relative" a new layer is created for the <body>. When the document paints we have two seperated
+        layers, and the <body> layer doesn't know that it's actually inside a "SVG hidden subtree", and gets painted, where it
+        shouldn't. HTML doesn't have this problems, as a display: none object, never creates a renderer.
+
+        The fix is to disallow layer creation in hidden SVG subtrees, to mimic what would happen if we'd follow HTML rules
+        to not create renderers for display: none objects. This avoids any indirections - as no layers are created anymore.
+
+        Tests: svg/foreignObject/fO-display-none-with-relative-pos-content.svg
+               svg/foreignObject/fO-display-none.svg
+               svg/foreignObject/fO-parent-display-changes.svg
+               svg/foreignObject/fO-parent-display-none-with-relative-pos-content.svg
+               svg/foreignObject/fO-parent-display-none.svg
+               svg/foreignObject/fO-parent-of-parent-display-none-with-relative-pos-content.svg
+               svg/foreignObject/fO-parent-of-parent-display-none.svg
+
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::RenderBoxModelObject::styleDidChange): Only create layers, if its allowed -- layerCreationAllowedForSubtree() will always return true for HTML, and only false for layers inside a hidden SVG subtree.
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::addChild): Only create layers, if its allowed.
+        * rendering/RenderObject.h: Add inline layerCreationAllowedForSubtree() helper, that craws the tree to find a RenderSVGHiddenContainer ancestor, if not present, return true.
+
+2012-02-22  Zoltan Herczeg  <zherczeg@webkit.org>
+
+        Drop clipToImageBuffer from RenderBoxModelObject
+        https://bugs.webkit.org/show_bug.cgi?id=79225
+
+        Reviewed by Nikolas Zimmermann.
+
+        -webkit-background-clip: text is a rarely used non-standard
+        feature uses clipToImageBuffer. It is replaced by
+        CompositeDestinationIn on a transparent layer. The new
+        approach has the same speed as the old one.
+
+        Existing tests cover this issue.
+
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::RenderBoxModelObject::paintFillLayerExtended):
+
+2012-02-22  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Merge setVisibleRectTrajectoryVector and adjustVisibleRect to
+        the more descriptive coverWithTilesIfNeeded
+        https://bugs.webkit.org/show_bug.cgi?id=79230
+
+        Reviewed by Simon Hausmann.
+
+        Both setVisibleRectTrajectoryVector and the adjustVisibleRect are
+        used for initiating re-tiling, so make that more obvious and merge
+        the two.
+
+        * platform/graphics/TiledBackingStore.cpp:
+        (WebCore::TiledBackingStore::coverWithTilesIfNeeded):
+        * platform/graphics/TiledBackingStore.h:
+        (TiledBackingStore):
+
+2012-02-17  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        REGRESSION: unbalanced transparency layers for clipPath
+        https://bugs.webkit.org/show_bug.cgi?id=78074
+
+        Reviewed by Zoltan Herczeg.
+
+        If we're rendering to a mask image buffer, all children are rendered with opacity=1, regardless what their RenderStyles specify.
+        SVGRenderSupport::finishRenderSVGContent() did not take this into account and always called endTransparencyLayer(). Fix that
+        by checking if we're rendering to a mask image buffer, if so don't call endTransparencyLayer().
+
+        Add new reftest covering both the visual & logical correctness (no assertion).
+
+        Tests: svg/clip-path/opacity-assertion-expected.svg
+               svg/clip-path/opacity-assertion.svg
+
+        * rendering/svg/SVGRenderSupport.cpp:
+        (WebCore::isRenderingMaskImage): Extraced as sharable helper function.
+        (WebCore::SVGRenderSupport::prepareToRenderSVGContent): Factor out isRenderingMaskImage() function.
+        (WebCore::SVGRenderSupport::finishRenderSVGContent): Only call endTransparencyLayer(), if we actually called beginTL() first. 
+
+2012-02-22  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Improve comments in tiling code.
+
+        Rubberstamped by Simon Hausmann.
+
+        * platform/graphics/TiledBackingStore.cpp:
+        (WebCore::TiledBackingStore::createTiles):
+
+2012-02-22  'Pavel Feldman'  <pfeldman@google.com>
+
+        Not reviewed: build fix.
+
+        * inspector/InspectorController.cpp:
+        * inspector/InspectorController.h:
+        (InspectorController):
+
+2012-02-21  Pavel Feldman  <pfeldman@google.com>
+
+        Web Inspector: do not filter out requestAnimationFrame from timeline, implement stop on animation events.
+        https://bugs.webkit.org/show_bug.cgi?id=79116
+
+        Reviewed by Yury Semikhatsky.
+
+        * English.lproj/localizedStrings.js:
+        * dom/ScriptedAnimationController.cpp:
+        (WebCore::ScriptedAnimationController::registerCallback):
+        * inspector/InspectorInstrumentation.cpp:
+        (WebCore):
+        (WebCore::InspectorInstrumentation::didRequestAnimationFrameCallbackImpl):
+        (WebCore::InspectorInstrumentation::didCancelAnimationFrameCallbackImpl):
+        (WebCore::InspectorInstrumentation::willFireAnimationFrameEventImpl):
+        * inspector/InspectorInstrumentation.h:
+        (InspectorInstrumentation):
+        (WebCore::InspectorInstrumentation::didRequestAnimationFrameCallback):
+        * inspector/InspectorTimelineAgent.cpp:
+        (TimelineRecordType):
+        (WebCore::InspectorTimelineAgent::didRequestAnimationFrameCallback):
+        (WebCore::InspectorTimelineAgent::didCancelAnimationFrameCallback):
+        (WebCore::InspectorTimelineAgent::willFireAnimationFrameEvent):
+        (WebCore::InspectorTimelineAgent::didFireAnimationFrameEvent):
+        * inspector/InspectorTimelineAgent.h:
+        (InspectorTimelineAgent):
+        * inspector/front-end/BreakpointsSidebarPane.js:
+        (WebInspector.EventListenerBreakpointsSidebarPane):
+        (WebInspector.EventListenerBreakpointsSidebarPane.eventNameForUI):
+        * inspector/front-end/TimelineAgent.js:
+        * inspector/front-end/TimelinePanel.js:
+        (WebInspector.TimelinePanel):
+        (WebInspector.TimelinePanel.prototype.get _recordStyles):
+        (WebInspector.TimelinePanel.prototype._findParentRecord):
+        (WebInspector.TimelinePanel.prototype._innerAddRecordToTimeline):
+        (WebInspector.TimelinePanel.prototype._onRecordsCleared):
+        (WebInspector.TimelinePanel.FormattedRecord):
+        (WebInspector.TimelinePanel.FormattedRecord.prototype._generatePopupContent):
+        (WebInspector.TimelinePanel.FormattedRecord.prototype._getRecordDetails):
+
+2012-02-22  Changhun Kang  <temoochin@company100.net>
+
+        Remove unused class declaration in WebCore/page/scrolling/ScrollingCoordinator.h
+        https://bugs.webkit.org/show_bug.cgi?id=79175
+
+        Reviewed by Kentaro Hara.
+
+        * page/scrolling/ScrollingCoordinator.h:
+        Remove PlatformGestureEvent class declaration.
+        (WebCore):
+
+2012-02-22  Andras Becsi  <andras.becsi@nokia.com>
+
+        [Qt][WK2] Fix the N9 build
+        https://bugs.webkit.org/show_bug.cgi?id=79101
+
+        Reviewed by Simon Hausmann.
+
+        Fixed the include order of the rolled out r108359 not to break
+        the build with CONFIG+=force_static_libs_as_shared.
+
+        * platform/graphics/OpenGLShims.h: Add missing include.
+
+2012-02-22  Shinya Kawanaka  <shinyak@chromium.org>
+
+        firstRendererOf() should also return a fallback element renderer in NodeRenderingContext.
+        https://bugs.webkit.org/show_bug.cgi?id=79180
+
+        Reviewed by Hajime Morita.
+
+        Currently we have handled AttachingFallback in some special mannger, however if firstRendererOf
+        and lastRendererOf return a fallback element renderer, we don't need to handle it in such a manner.
+
+        We have introduced new attaching phase: AttachingFallbacked, and AttachingNotFallbacked.
+        They are used for fallback elements.
+
+        Added new test cases in:
+          fast/dom/shadow/shadow-contents-fallback.html
+          fast/dom/shadow/shadow-contents-fallback-dynamic.html
+
+        * dom/NodeRenderingContext.cpp:
+        (WebCore::NodeRenderingContext::NodeRenderingContext):
+        (WebCore::firstRendererOf):
+        (WebCore::lastRendererOf):
+        (WebCore::NodeRenderingContext::nextRenderer):
+        (WebCore::NodeRenderingContext::previousRenderer):
+        (WebCore::NodeRenderingContext::shouldCreateRenderer):
+        * dom/NodeRenderingContext.h:
+        * html/shadow/InsertionPoint.h:
+        (WebCore::isInsertionPoint):
+        (WebCore):
+        (WebCore::toInsertionPoint):
+
+2012-02-22  Csaba Osztrogonác  <ossy@webkit.org>
+
+        [Qt] Unreviewed gardening after r108464.
+
+        * Target.pri:
+
+2012-02-22  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r108468.
+        http://trac.webkit.org/changeset/108468
+        https://bugs.webkit.org/show_bug.cgi?id=79219
+
+        Broke Chromium Win release build (Requested by bashi on
+        #webkit).
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * Target.pri:
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * websockets/WebSocket.cpp:
+        (WebCore::WebSocket::didConnect):
+        * websockets/WebSocketChannel.cpp:
+        (WebCore::WebSocketChannel::connect):
+        (WebCore::WebSocketChannel::fail):
+        (WebCore::WebSocketChannel::processFrame):
+        (WebCore::WebSocketChannel::sendFrame):
+        * websockets/WebSocketChannel.h:
+        * websockets/WebSocketDeflateFramer.cpp: Removed.
+        * websockets/WebSocketDeflateFramer.h: Removed.
+
+2012-02-20  Roland Steiner  <rolandsteiner@chromium.org>
+
+        <style scoped>: Add runtime-flag
+        https://bugs.webkit.org/show_bug.cgi?id=79074
+
+        Added runtime-flag.
+        Query runtime flag when (un)registering a <style scoped> element, and when determineing a style sheet's scope.
+
+        Reviewed by Dimitri Glazkov.
+
+        No new tests. (no change in functionality)
+
+        * bindings/generic/RuntimeEnabledFeatures.cpp:
+        (WebCore):
+        * bindings/generic/RuntimeEnabledFeatures.h:
+        (RuntimeEnabledFeatures):
+        (WebCore::RuntimeEnabledFeatures::styleScopedEnabled):
+        (WebCore::RuntimeEnabledFeatures::setStyleScopedEnabled):
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::determineScopingElement):
+        * html/HTMLStyleElement.cpp:
+        (WebCore::HTMLStyleElement::registerWithScopingNode):
+        (WebCore::HTMLStyleElement::unregisterWithScopingNode):
+        * html/HTMLStyleElement.idl:
+
+2012-02-21  Alexander Pavlov  <apavlov@chromium.org>
+
+        Web Inspector: Audit rules to recommend unprefixing supported CSS properties
+        https://bugs.webkit.org/show_bug.cgi?id=78985
+
+        Reviewed by Pavel Feldman.
+
+        * inspector/front-end/AuditCategories.js:
+        (WebInspector.AuditCategories.PagePerformance.prototype.initialize):
+        * inspector/front-end/AuditRules.js:
+        (WebInspector.AuditRules.CSSRuleBase):
+        (WebInspector.AuditRules.CSSRuleBase.prototype.doRun.sheetsCallback):
+        (WebInspector.AuditRules.CSSRuleBase.prototype.doRun):
+        (WebInspector.AuditRules.CSSRuleBase.prototype._visitStyleSheet.sheetCallback):
+        (WebInspector.AuditRules.CSSRuleBase.prototype._visitStyleSheet):
+        (WebInspector.AuditRules.CSSRuleBase.prototype._visitRule):
+        (WebInspector.AuditRules.CSSRuleBase.prototype.visitStyleSheet):
+        (WebInspector.AuditRules.CSSRuleBase.prototype.didVisitStyleSheet):
+        (WebInspector.AuditRules.CSSRuleBase.prototype.visitRule):
+        (WebInspector.AuditRules.CSSRuleBase.prototype.didVisitRule):
+        (WebInspector.AuditRules.CSSRuleBase.prototype.visitProperty):
+        (WebInspector.AuditRules.VendorPrefixedCSSProperties):
+        (WebInspector.AuditRules.VendorPrefixedCSSProperties.prototype.didVisitStyleSheet):
+        (WebInspector.AuditRules.VendorPrefixedCSSProperties.prototype.visitRule):
+        (WebInspector.AuditRules.VendorPrefixedCSSProperties.prototype.didVisitRule):
+        (WebInspector.AuditRules.VendorPrefixedCSSProperties.prototype.visitProperty):
+        * inspector/front-end/ResourceUtils.js:
+
+2012-02-22  Shinya Kawanaka  <shinyak@chromium.org>
+
+        Node::attach() should be after attaching children in Element::attach().
+        https://bugs.webkit.org/show_bug.cgi?id=79201
+
+        Reviewed by Hajime Morita.
+
+        In Element::attach(), Node::attach() is called before attaching children if a shaodw root exists.
+        This may cause O(N^2) problem in NodeRenderingContext.
+
+        No new tests. Existing tests should cover this.
+
+        * dom/Element.cpp:
+        (WebCore::Element::attach):
+
+2012-02-22  Kenichi Ishibashi  <bashi@chromium.org>
+
+        Adding WebSocket per-frame DEFLATE extension
+        https://bugs.webkit.org/show_bug.cgi?id=77522
+
+        Add WebSocketDeflateFramer class which handles deflate-frame extension.
+        This class encapsulates WebSocketDeflater and WebSocketInflater classes,
+        which depend on zlib, so that WebSocketChannel is not necessary to aware
+        zlib dependency.
+
+        Reviewed by Kent Tamura.
+
+        Tests: http/tests/websocket/tests/hybi/compressed-control-frame.html
+               http/tests/websocket/tests/hybi/deflate-frame-comp-bit-onoff.html
+               http/tests/websocket/tests/hybi/deflate-frame-invalid-parameter.html
+               http/tests/websocket/tests/hybi/deflate-frame-parameter.html
+
+        * CMakeLists.txt: Added WebSocketDeflateFramer.(cpp|h)
+        * GNUmakefile.list.am: Ditto.
+        * Target.pri: Ditto.
+        * WebCore.gypi: Ditto.
+        * WebCore.vcproj/WebCore.vcproj: Ditto.
+        * WebCore.xcodeproj/project.pbxproj: Ditto.
+        * websockets/WebSocket.cpp:
+        (WebCore::WebSocket::didConnect): Set m_extensions.
+        * websockets/WebSocketChannel.cpp:
+        (WebCore::WebSocketChannel::connect): Add deflate-frame extension processor to WebSocketHanshake if deflate can use.
+        (WebCore::WebSocketChannel::fail): Call m_deflateFramer.didFail().
+        (WebCore::WebSocketChannel::processFrame): Decompress frames if needed.
+        (WebCore::WebSocketChannel::sendFrame): Compress frames if possible.
+        * websockets/WebSocketChannel.h:
+        * websockets/WebSocketDeflateFramer.cpp: Added.
+        (WebCore):
+        (WebSocketExtensionDeflateFrame):
+        (WebCore::WebSocketExtensionDeflateFrame::create):
+        (WebCore::WebSocketExtensionDeflateFrame::~WebSocketExtensionDeflateFrame):
+        (WebCore::WebSocketExtensionDeflateFrame::WebSocketExtensionDeflateFrame):
+        (WebCore::WebSocketExtensionDeflateFrame::handshakeString):
+        (WebCore::WebSocketExtensionDeflateFrame::processResponse):
+        (WebCore::DeflateResultHolder::DeflateResultHolder):
+        (WebCore::DeflateResultHolder::~DeflateResultHolder):
+        (WebCore::DeflateResultHolder::fail):
+        (WebCore::InflateResultHolder::InflateResultHolder):
+        (WebCore::InflateResultHolder::~InflateResultHolder):
+        (WebCore::InflateResultHolder::fail):
+        (WebCore::WebSocketDeflateFramer::WebSocketDeflateFramer):
+        (WebCore::WebSocketDeflateFramer::createExtensionProcessor):
+        (WebCore::WebSocketDeflateFramer::canDeflate):
+        (WebCore::WebSocketDeflateFramer::enableDeflate):
+        (WebCore::WebSocketDeflateFramer::deflate):
+        (WebCore::WebSocketDeflateFramer::resetDeflateContext):
+        (WebCore::WebSocketDeflateFramer::inflate):
+        (WebCore::WebSocketDeflateFramer::resetInflateContext):
+        (WebCore::WebSocketDeflateFramer::didFail):
+        * websockets/WebSocketDeflateFramer.h: Added.
+        (WebCore):
+        (DeflateResultHolder):
+        (WebCore::DeflateResultHolder::succeeded):
+        (WebCore::DeflateResultHolder::failureReason):
+        (InflateResultHolder):
+        (WebCore::InflateResultHolder::succeeded):
+        (WebCore::InflateResultHolder::failureReason):
+        (WebSocketDeflateFramer):
+        (WebCore::WebSocketDeflateFramer::enabled):
+
+2012-02-22  Yuta Kitamura  <yutak@chromium.org>
+
+        Unreviewed, rolling out r108453.
+        http://trac.webkit.org/changeset/108453
+        https://bugs.webkit.org/show_bug.cgi?id=78549
+
+        Broke Chromium's webkit_unit_tests.
+
+        * WebCore.gypi:
+        * platform/graphics/chromium/cc/CCOcclusionTracker.cpp: Removed.
+        * platform/graphics/chromium/cc/CCOcclusionTracker.h: Removed.
+
+2012-02-22  Zoltan Herczeg  <zherczeg@webkit.org>
+
+        [Qt] clipToImageBuffer assertion fix in debug mode on Qt.
+
+        Rubber stamped by Csaba Osztrogonác.
+
+        * platform/graphics/qt/GraphicsContextQt.cpp:
+        (WebCore::GraphicsContext::restorePlatformState):
+
+2012-02-22  Adam Barth  <abarth@webkit.org>
+
+        [GTK] fast/frames/frame-dead-region.html crash
+        https://bugs.webkit.org/show_bug.cgi?id=79205
+
+        Unreviewed.
+
+        Apparently we're not supposed to call willDetachPage from
+        CachedFrame::destroy.  This call got added in
+        http://trac.webkit.org/changeset/108428, but it seems to cause a crash.
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::closeAndRemoveChild):
+        (WebCore::FrameLoader::detachFromParent):
+        * page/Frame.h:
+        (WebCore::Frame::detachFromPage):
+        * page/Page.cpp:
+        (WebCore::Page::~Page):
+
+2012-02-22  Adam Barth  <abarth@webkit.org>
+
+        Move Geolocation code into Modules/geolocation
+        https://bugs.webkit.org/show_bug.cgi?id=79204
+
+        Reviewed by Hajime Morita.
+
+        There are still some dangling references into the Geolocation module,
+        which I will clean up in a followup patch.
+
+        * CMakeLists.txt:
+        * DerivedSources.make:
+        * DerivedSources.pri:
+        * GNUmakefile.list.am:
+        * Modules/geolocation/Geolocation.cpp: Copied from Source/WebCore/page/Geolocation.cpp.
+        * Modules/geolocation/Geolocation.h: Copied from Source/WebCore/page/Geolocation.h.
+        * Modules/geolocation/Geolocation.idl: Copied from Source/WebCore/page/Geolocation.idl.
+        * Modules/geolocation/GeolocationController.cpp: Copied from Source/WebCore/page/GeolocationController.cpp.
+        * Modules/geolocation/GeolocationController.h: Copied from Source/WebCore/page/GeolocationController.h.
+        * Modules/geolocation/GeolocationError.h: Copied from Source/WebCore/page/GeolocationError.h.
+        * Modules/geolocation/GeolocationPosition.h: Copied from Source/WebCore/page/GeolocationPosition.h.
+        * Modules/geolocation/Geoposition.h: Copied from Source/WebCore/page/Geoposition.h.
+        * Modules/geolocation/Geoposition.idl: Copied from Source/WebCore/page/Geoposition.idl.
+        * Modules/geolocation/PositionCallback.h: Copied from Source/WebCore/page/PositionCallback.h.
+        * Modules/geolocation/PositionCallback.idl: Copied from Source/WebCore/page/PositionCallback.idl.
+        * Modules/geolocation/PositionError.h: Copied from Source/WebCore/page/PositionError.h.
+        * Modules/geolocation/PositionError.idl: Copied from Source/WebCore/page/PositionError.idl.
+        * Modules/geolocation/PositionErrorCallback.h: Copied from Source/WebCore/page/PositionErrorCallback.h.
+        * Modules/geolocation/PositionErrorCallback.idl: Copied from Source/WebCore/page/PositionErrorCallback.idl.
+        * Modules/geolocation/PositionOptions.h: Copied from Source/WebCore/page/PositionOptions.h.
+        * Target.pri:
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * page/Geolocation.cpp: Removed.
+        * page/Geolocation.h: Removed.
+        * page/Geolocation.idl: Removed.
+        * page/GeolocationController.cpp: Removed.
+        * page/GeolocationController.h: Removed.
+        * page/GeolocationError.h: Removed.
+        * page/GeolocationPosition.h: Removed.
+        * page/Geoposition.h: Removed.
+        * page/Geoposition.idl: Removed.
+        * page/PositionCallback.h: Removed.
+        * page/PositionCallback.idl: Removed.
+        * page/PositionError.h: Removed.
+        * page/PositionError.idl: Removed.
+        * page/PositionErrorCallback.h: Removed.
+        * page/PositionErrorCallback.idl: Removed.
+        * page/PositionOptions.h: Removed.
+
+2012-02-22  Frederik Gladhorn  <frederik.gladhorn@nokia.com>
+
+        [gtk] Accessibility: use find funtion in vector instead of for.
+        https://bugs.webkit.org/show_bug.cgi?id=77878
+
+        Reviewed by Hajime Morita.
+
+        Minor cleanup, use the find function from vector.
+
+        * accessibility/gtk/WebKitAccessibleWrapperAtk.cpp:
+        (webkitAccessibleGetIndexInParent):
+
+2012-02-22  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Remove the remaining uses of CSSStyleDeclaration in Editor
+        https://bugs.webkit.org/show_bug.cgi?id=78939
+
+        Reviewed by Enrica Casucci.
+
+        Changed the argument types of shouldApplyStyle, applyParagraphStyle, applyStyleToSelection,
+        applyParagraphStyleToSelection, and computeAndSetTypingStyle in Editor from CSSStyleDeclaration
+        to StylePropertySet.
+
+        * WebCore.exp.in:
+        * WebCore.xcodeproj/project.pbxproj:
+        * editing/Editor.cpp:
+        (WebCore::Editor::applyStyle):
+        (WebCore::Editor::shouldApplyStyle):
+        (WebCore::Editor::applyParagraphStyle):
+        (WebCore::Editor::applyStyleToSelection):
+        (WebCore::Editor::applyParagraphStyleToSelection):
+        (WebCore::Editor::setBaseWritingDirection):
+        (WebCore::Editor::computeAndSetTypingStyle):
+        * editing/Editor.h:
+        (WebCore):
+        (Editor):
+        * editing/EditorCommand.cpp:
+        (WebCore::applyCommandToFrame):
+        (WebCore::executeApplyParagraphStyle):
+        (WebCore::executeMakeTextWritingDirectionLeftToRight):
+        (WebCore::executeMakeTextWritingDirectionNatural):
+        (WebCore::executeMakeTextWritingDirectionRightToLeft):
+        * loader/EmptyClients.h:
+        (WebCore::EmptyEditorClient::shouldApplyStyle):
+        * page/DragController.cpp:
+        (WebCore::DragController::concludeEditDrag):
+        * page/EditorClient.h:
+        (WebCore):
+        (EditorClient):
+
+2012-02-22  Dana Jansens  <danakj@chromium.org>
+
+        [chromium] Cull quads outside of the scissoring damage rect
+        https://bugs.webkit.org/show_bug.cgi?id=79181
+
+        Reviewed by James Robinson.
+
+        Quads outside of the partial swap cause us to execute GL operations
+        that actually use a fair amount of CPU time (enough to affect power
+        usage). Here we cull quads by only keeping their intersection
+        with the damage rect used for partial swap.
+
+        Unit test: CCQuadCuller.cpp
+
+        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.cpp:
+        (WebCore::CCLayerTreeHostImpl::optimizeRenderPasses):
+        * platform/graphics/chromium/cc/CCQuadCuller.cpp:
+        (WebCore::CCQuadCuller::cullOccludedQuads):
+        * platform/graphics/chromium/cc/CCQuadCuller.h:
+        (CCQuadCuller):
+        * platform/graphics/chromium/cc/CCRenderPass.cpp:
+        (WebCore::CCRenderPass::optimizeQuads):
+        * platform/graphics/chromium/cc/CCRenderPass.h:
+        (CCRenderPass):
+
+2012-02-21  Dana Jansens  <danakj@chromium.org>
+
+        [Chromium] New CCOcclusionTracker class with tests
+        https://bugs.webkit.org/show_bug.cgi?id=78549
+
+        Reviewed by James Robinson.
+
+        Adds a CCOcclusionTrackerBase template class that is able to track occlusion
+        of layers while traversing the layer tree from front-to-back, with typedefed
+        versions for the main and impl threads.
+
+        At each step of the front-to-back traversal, the class should be notified of
+        changes to the current render target, and when done working with a layer, the
+        layer is added the tracked occlusion.
+
+        The class provides tests for checking if a rect in content space
+        for a layer/surface is occluded by others in front of it.
+
+        Unit tests: CCOcclusionTrackerTest.cpp
+
+        * WebCore.gypi:
+        * platform/graphics/chromium/cc/CCOcclusionTracker.cpp: Added.
+        (WebCore):
+        (WebCore::::enterTargetRenderSurface):
+        (WebCore::::finishedTargetRenderSurface):
+        (WebCore::transformSurfaceOpaqueRegion):
+        (WebCore::::leaveToTargetRenderSurface):
+        (WebCore::contentToScreenSpaceTransform):
+        (WebCore::contentToTargetSurfaceTransform):
+        (WebCore::computeOcclusionBehindLayer):
+        (WebCore::::markOccludedBehindLayer):
+        (WebCore::testContentRectOccluded):
+        (WebCore::::occluded):
+        (WebCore::::surfaceOccluded):
+        (WebCore::rectSubtractRegion):
+        (WebCore::computeUnoccludedContentRect):
+        (WebCore::::unoccludedContentRect):
+        (WebCore::::surfaceUnoccludedContentRect):
+        (WebCore::::currentOcclusionInScreenSpace):
+        (WebCore::::currentOcclusionInTargetSurface):
+        * platform/graphics/chromium/cc/CCOcclusionTracker.h: Added.
+        (WebCore):
+        (CCOcclusionTrackerBase):
+        (WebCore::CCOcclusionTrackerBase::CCOcclusionTrackerBase):
+        (StackObject):
+
+2012-02-21  Andreas Kling  <awesomekling@apple.com>
+
+        Cache <font face> family lists in CSSValuePool.
+        <http://webkit.org/b/79195>
+
+        Reviewed by Antti Koivisto.
+
+        HTMLFontElements with "face" attributes are very common in legacy web content.
+        Add a String->CSSValue cache for these in CSSValuePool and use it to avoid
+        reparsing and recreating duplicate font face values.
+
+        This knocks 20ms (~1.5%) worth of samples off of the Moz page cycler on my system.
+
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseFontFaceValue):
+        * css/CSSParser.h:
+        * css/CSSValuePool.cpp:
+        (WebCore::CSSValuePool::createFontFaceValue):
+        * css/CSSValuePool.h:
+        * html/HTMLFontElement.cpp:
+        (WebCore::HTMLFontElement::collectStyleForAttribute):
+
+2012-02-21  Adam Barth  <abarth@webkit.org>
+
+        Separate the implementation of registerProtocolHandler from Navigator.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=78945
+
+        Reviewed by Eric Seidel.
+
+        The implementation of registerProtocolHandler needlessly complicates
+        the implementation of Navigator.cpp.  In principle,
+        registerProtocolHandler (and possibly registerContentHandler, when we
+        implement that feature) could be its own module, but that seems like
+        overkill for one or two files.
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * Target.pri:
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * page/Navigator.cpp:
+        (WebCore):
+        * page/Navigator.h:
+        (Navigator):
+        * page/Navigator.idl:
+
+2012-02-21  MORITA Hajime  <morrita@google.com>
+
+        HasIDFlag and HasClassFlag can be removed.
+        https://bugs.webkit.org/show_bug.cgi?id=77861
+
+        Reviewed by Andreas Kling.
+
+        Replaced HasIDFlag and HasClassFlag with a check against
+        ElementAttributeData. It looks these flags (originally bitfields)
+        were legacy of ancient era, where we didn't cache @id and @class
+        values and needed a hash lookup for each check.
+
+        No new tests. No behavioral change.
+
+        * dom/Element.cpp:
+        (WebCore::Element::idAttributeChanged):
+        * dom/Element.h:
+        (WebCore::Element::hasID):
+        (WebCore):
+        (WebCore::Element::hasClass):
+        (WebCore::Node::hasID):
+        (WebCore::Node::hasClass):
+        * dom/ElementAttributeData.h:
+        (WebCore::ElementAttributeData::hasID):
+        (WebCore::ElementAttributeData::hasClass):
+        (ElementAttributeData):
+        * dom/Node.h:
+        (Node):
+        (WebCore::nodeStyleChangeShift):
+        * dom/StyledElement.cpp:
+        (WebCore::StyledElement::classAttributeChanged):
+
+2012-02-21  Matthew Delaney  <mdelaney@apple.com>
+
+        2D Canvas setTransform makes unnecessary matrix mults
+        https://bugs.webkit.org/show_bug.cgi?id=79190
+
+        Reviewed by Dan Bernstein.
+
+        No new tests - plenty of current tests using setTransform.
+
+        * html/canvas/CanvasRenderingContext2D.cpp:
+        (WebCore::CanvasRenderingContext2D::setTransform):
+
+2012-02-21  MORITA Hajime <morrita@google.com>
+
+        INPUT_SPEECH should be implemented as a PageSupplement.
+        https://bugs.webkit.org/show_bug.cgi?id=79051
+
+        Turned SpeechInput to a PageSupplement.
+
+        Reviewed by Adam Barth.
+
+        No new tests. No behavior change.
+
+        * html/shadow/TextControlInnerElements.cpp:
+        (WebCore::InputFieldSpeechButtonElement::speechInput):
+        (WebCore::InputFieldSpeechButtonElement::attach):
+        * page/Page.cpp:
+        (WebCore::Page::Page):
+        (WebCore::Page::PageClients::PageClients):
+        * page/Page.h:
+        (WebCore):
+        (PageClients):
+        (Page):
+        * page/SpeechInput.cpp:
+        (WebCore::SpeechInput::supplementName):
+        (WebCore):
+        (WebCore::provideSpeechInputTo):
+        * page/SpeechInput.h:
+        (SpeechInput):
+        (WebCore::SpeechInput::from):
+        * page/SpeechInputClient.h:
+        (WebCore):
+
+2012-02-21  Alexandre Elias  <aelias@google.com>
+
+        [chromium] Add three small zoom gesture features
+        https://bugs.webkit.org/show_bug.cgi?id=74216
+
+        Reviewed by James Robinson.
+
+        1. Support panning around with two fingers.
+        2. When double-tap zooming, issue the commit at final/scroll scale as
+        early as possible.
+        3. When pinch zooming out, issue a commit at minimum scale to avoid
+        showing checkerboard.
+
+        Added test for panning to CCLayerTreeHostImplTest::pinchGesture.
+        (The other features are heuristics whose exact behavior we don't need
+        to lock in with a test.)
+
+        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.cpp:
+        (WebCore::CCLayerTreeHostImpl::startPageScaleAnimation):
+        (WebCore::CCLayerTreeHostImpl::pinchGestureBegin):
+        (WebCore::CCLayerTreeHostImpl::pinchGestureUpdate):
+        (WebCore::CCLayerTreeHostImpl::computeDoubleTapZoomDeltas):
+        (WebCore::CCLayerTreeHostImpl::computePinchZoomDeltas):
+        (WebCore::CCLayerTreeHostImpl::makeScrollAndScaleSet):
+        (WebCore::CCLayerTreeHostImpl::processScrollDeltas):
+        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.h:
+
+2012-02-21  Filip Pizlo  <fpizlo@apple.com>
+
+        JSC should be a triple-tier VM
+        https://bugs.webkit.org/show_bug.cgi?id=75812
+        <rdar://problem/10079694>
+
+        Reviewed by Gavin Barraclough.
+        
+        No new tests, because there is no change in behavior.
+
+        * CMakeLists.txt:
+
+2012-02-21  Kentaro Hara  <haraken@chromium.org>
+
+        NavigatorMediaStream.idl defines an interface for NavigatorGamepad
+        https://bugs.webkit.org/show_bug.cgi?id=79152
+
+        Reviewed by Adam Barth.
+
+        Fixed a typo: NavigatorGamepad => NavigatorMediaStream
+
+        This typo fix just changes the name of generated files:
+
+        - V8NavigatorGamepad.h => V8NavigatorMediaStream.h
+        - V8NavigatorGamepad.cpp => V8NavigatorMediaStream.cpp
+
+        The reason why the typo has not caused any serious build issues is that
+        the generate files for supplemental interfaces are "empty" and not important.
+        They just exist to control makefile dependencies.
+
+        No tests. No change in behavior.
+
+        * mediastream/NavigatorMediaStream.idl:
+
+2012-02-21  Daniel Sievers  <sievers@chromium.org>
+
+        [Chromium] Fix compositor setting color uniforms incorrectly for solid color quads.
+        https://bugs.webkit.org/show_bug.cgi?id=76017
+
+        Reviewed by James Robinson.
+
+        * platform/graphics/chromium/LayerRendererChromium.cpp:
+        (WebCore::LayerRendererChromium::drawSolidColorQuad):
+
+2012-02-21  Max Vujovic  <mvujovic@adobe.com>
+
+        getCTM() on SVG root element with borders, paddings, and viewbox returns incorrect values
+        https://bugs.webkit.org/show_bug.cgi?id=78631
+
+        Reviewed by Eric Seidel.
+
+        SVGSVGElement::currentViewportSize was returning the size of the SVG viewport plus CSS
+        borders and paddings, causing the CTM calculation to be off.
+
+        Test: svg/dom/SVGLocatable-getCTM-svg-root.html
+
+        * svg/SVGSVGElement.cpp:
+        (WebCore::SVGSVGElement::currentViewportSize):
+
+            SVGSVGElement::currentViewportSize now uses the contentBoxRect instead of the frameRect.
+            The contentBoxRect corresponds to the SVG viewport and does not include borders and
+            paddings.
+
+2012-02-21  Robin Cao  <robin.cao@torchmobile.com.cn>
+
+        [BlackBerry] Upstream Icon class in platform/graphics/blackberry
+        https://bugs.webkit.org/show_bug.cgi?id=79088
+
+        Reviewed by Antonio Gomes.
+
+        Initial upstreaming, no new tests.
+
+        * platform/graphics/blackberry/IconBlackBerry.cpp: Added.
+        (WebCore):
+        (WebCore::Icon::~Icon):
+        (WebCore::Icon::paint):
+        (WebCore::Icon::createIconForFiles):
+
+2012-02-21  Kenichi Ishibashi  <bashi@chromium.org>
+
+        Rename "reserved1" flag of WebSocketFrame to compress
+        https://bugs.webkit.org/show_bug.cgi?id=79187
+
+        WebSocket deflate-frame extension draft specification defines COMP bit.
+        http://tools.ietf.org/html/draft-tyoshino-hybi-websocket-perframe-deflate-05#page-11
+
+        Reviewed by Kent Tamura.
+
+        No new tests. http/tests/websocket/tests/hybi/reserved-bits.html is revised to follow the change.
+
+        * websockets/WebSocketChannel.cpp:
+        (WebCore):
+        (WebCore::WebSocketChannel::parseFrame): "reserved1" renamed "compress".
+        (WebCore::WebSocketChannel::processFrame): Removed reserved1 flag check.
+        (WebCore::makeFrameData):
+        (WebCore::WebSocketChannel::sendFrame):
+        * websockets/WebSocketFrame.h: "reserved1" flag renamed "compress".
+        (WebCore::WebSocketFrame::WebSocketFrame):
+        (WebSocketFrame):
+
+2012-02-21  Yael Aharon  <yael.aharon@nokia.com>
+
+        [Texmap] Move all TextureMapper related files to graphics/texmap
+        https://bugs.webkit.org/show_bug.cgi?id=79141
+
+        Reviewed by Martin Robinson.
+
+        Move TextureMaooerGL and TextureMapperShaderManager files to graphics/texmap.
+        No new tests. 
+
+        * GNUmakefile.list.am:
+        * Target.pri:
+        * WebCore.gypi:
+        * platform/graphics/qt/GraphicsContext3DQt.cpp
+        * platform/graphics/opengl/TextureMapperGL.cpp: Removed.
+        * platform/graphics/opengl/TextureMapperGL.h: Removed.
+        * platform/graphics/opengl/TextureMapperShaderManager.cpp: Removed.
+        * platform/graphics/opengl/TextureMapperShaderManager.h: Removed.
+        * platform/graphics/texmap/TextureMapperGL.cpp: Copied from Source/WebCore/platform/graphics/opengl/TextureMapperGL.cpp.
+        * platform/graphics/texmap/TextureMapperGL.h: Copied from Source/WebCore/platform/graphics/opengl/TextureMapperGL.h.
+        * platform/graphics/texmap/TextureMapperShaderManager.cpp: Copied from Source/WebCore/platform/graphics/opengl/TextureMapperShaderManager.cpp.
+        * platform/graphics/texmap/TextureMapperShaderManager.h: Copied from Source/WebCore/platform/graphics/opengl/TextureMapperShaderManager.h.
+
+2012-02-20  MORITA Hajime  <morrita@google.com>
+
+        MEDIA_STREAM should be implemented as a PageSupplement.
+        https://bugs.webkit.org/show_bug.cgi?id=79050
+
+        Reviewed by Adam Barth.
+
+        Added UserMediaController which implements PageSupplement. This
+        controller mediates WebCore-to-client communication and lifecycle
+        management. Then pushed UserMediaController out as a
+        PageSupplement module.
+
+        No new tests. No behavior change.
+
+        * WebCore.gypi:
+        * GNUmakefile.list.am:
+        * mediastream/NavigatorMediaStream.cpp:
+        (WebCore::NavigatorMediaStream::webkitGetUserMedia):
+        * mediastream/UserMediaClient.h:
+        (WebCore):
+        * mediastream/UserMediaController.cpp: Added.
+        (WebCore):
+        (WebCore::UserMediaController::supplementName):
+        (WebCore::UserMediaController::UserMediaController):
+        (WebCore::UserMediaController::~UserMediaController):
+        (WebCore::UserMediaController::create):
+        (WebCore::provideUserMediaTo):
+        * mediastream/UserMediaController.h: Added.
+        (WebCore):
+        (UserMediaController):
+        (WebCore::UserMediaController::client):
+        (WebCore::UserMediaController::from):
+        (WebCore::UserMediaController::requestUserMedia):
+        (WebCore::UserMediaController::cancelUserMediaRequest):
+        * mediastream/UserMediaRequest.cpp:
+        (WebCore::UserMediaRequest::create):
+        (WebCore::UserMediaRequest::UserMediaRequest):
+        (WebCore::UserMediaRequest::didCompleteQuery):
+        (WebCore::UserMediaRequest::contextDestroyed):
+        * mediastream/UserMediaRequest.h:
+        (WebCore):
+        (UserMediaRequest):
+        * page/Page.cpp:
+        (WebCore::Page::Page):
+        (WebCore::Page::~Page):
+        (WebCore::Page::PageClients::PageClients):
+        * page/Page.h:
+        (WebCore):
+        (PageClients):
+        (Page):
+
+2012-02-21  James Robinson  <jamesr@chromium.org>
+
+        Node::isContentEditable should only update styles, not layout
+        https://bugs.webkit.org/show_bug.cgi?id=78637
+
+        Reviewed by Ryosuke Niwa.
+
+        isContentEditable depends on knowing the node's current computed style, so it has to update styles if they are
+        out of date.  It does not depend on knowing any layout-derived properties, however, so updating layout is just a
+        waste of time.
+
+        Behavior is covered by existing layout tests, primarily in editing/
+
+        * dom/Node.cpp:
+        (WebCore::Node::isContentEditable):
+        (WebCore::Node::isContentRichlyEditable):
+
+2012-02-21  James Robinson  <jamesr@chromium.org>
+
+        Partially revert r108418 - move allowEventDispatch() call back to where it used to be.
+
+        Rubber-stamped by Ryosuke Niwa.
+
+        Tested by fast/text/find-layout-crash.html
+
+        * dom/ContainerNode.cpp:
+        (WebCore::ContainerNode::removeChildren):
+
+2012-02-21  Anders Carlsson  <andersca@apple.com>
+
+        Background jitters on pages with background-attachment: fixed
+        https://bugs.webkit.org/show_bug.cgi?id=79182
+
+        Reviewed by Dan Bernstein.
+
+        Make sure to update the main frame scroll position before updating the scrolling layer.
+        This also fixes a (purely theoretical) bug where we wouldn't be updating the main frame
+        position if the main frame didn't have a scroll layer.
+
+        * page/scrolling/ScrollingCoordinator.cpp:
+        (WebCore::ScrollingCoordinator::updateMainFrameScrollPositionAndScrollLayerPosition):
+
+2012-02-21  Dana Jansens  <danakj@chromium.org>
+
+        Early-out in Region::unite() for adding an empty region.
+        https://bugs.webkit.org/show_bug.cgi?id=79174
+
+        Reviewed by Anders Carlsson.
+
+        * platform/graphics/Region.cpp:
+        (WebCore::Region::unite):
+
+2012-02-21  Dana Jansens  <danakj@chromium.org>
+
+        [chromium] Painting a layer clears opaque rect in untouched tiles
+        https://bugs.webkit.org/show_bug.cgi?id=79157
+
+        Reviewed by James Robinson.
+
+        When painting a tiled layer, we would throw away the saved opaque rect
+        for any tiles that were not part of the paint. So now we check
+        if we are able to save the existing saved opaque rect in a more
+        proper way:
+        1. If any pixels of the saved rect are painted non-opaque, we replace
+        the saved rect.
+        2. If an opaque rect is drawn outside of the saved rect, we replace
+        the saved rect.
+
+        Unit test: TiledLayerChromiumTest.cpp
+
+        * platform/graphics/chromium/TiledLayerChromium.cpp:
+        (WebCore::TiledLayerChromium::prepareToUpdateTiles):
+        (WebCore::TiledLayerChromium::addSelfToOccludedScreenSpace):
+
+2012-02-21  Raymond Toy  <rtoy@google.com>
+
+        Small typo in AudioPannerNode.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=75890
+
+        Change to check elevation as intended instead of azimuth.
+        
+        Reviewed by Chris Rogers.
+
+        No new tests for correction of typo.
+
+        * webaudio/AudioPannerNode.cpp:
+        (WebCore::AudioPannerNode::getAzimuthElevation):
+
+2012-02-21  Adam Barth  <abarth@webkit.org>
+
+        Frame and Navigator shouldn't need to worry about Geolocation
+        https://bugs.webkit.org/show_bug.cgi?id=78860
+
+        Reviewed by Eric Seidel.
+
+        This patch removes some Geolocation-specific code from Frame and
+        Navigator in favor of our new supplemental module mechanism.  We're
+        still refining the module system, but we seem to be converging on a
+        simple Observer/Supplement design.
+
+        In a future patch, I'll move the remaining Geolocation-related files in
+        WebCore into Modules/geolocation.  This patch appears to be the first
+        patch that introduces a module used by all the various build systems,
+        which is why there's a bit more build system overhead than usual.
+
+        * Modules/geolocation: Added.
+        * Modules/geolocation/NavigatorGeolocation.cpp: Added.
+        (WebCore):
+        (WebCore::NavigatorGeolocation::NavigatorGeolocation):
+        (WebCore::NavigatorGeolocation::~NavigatorGeolocation):
+        (WebCore::NavigatorGeolocation::pageDestroyed):
+        (WebCore::NavigatorGeolocation::from):
+        (WebCore::NavigatorGeolocation::geolocation):
+        * Modules/geolocation/NavigatorGeolocation.h: Added.
+        (WebCore):
+        (NavigatorGeolocation):
+        * Modules/geolocation/NavigatorGeolocation.idl: Added.
+            - I've temporarily disabled this API for GObject because it generates
+              a strange compile error.  Once I land this patch, I'll spend some
+              more time fixing the compile error.
+        * page/DOMWindow.cpp:
+        (WebCore):
+        * page/DOMWindow.h:
+        (DOMWindow):
+        * page/Frame.cpp:
+        (WebCore::Frame::pageDestroyed):
+        (WebCore::Frame::transferChildFrameToNewDocument):
+        * page/FrameDestructionObserver.cpp:
+        (WebCore::FrameDestructionObserver::pageDestroyed):
+        (WebCore):
+        * page/FrameDestructionObserver.h:
+        (FrameDestructionObserver):
+        * page/Navigator.cpp:
+        (WebCore):
+        * page/Navigator.h:
+        (WebCore):
+        (Navigator):
+        * page/Navigator.idl:
+
+2012-02-21  Shawn Singh  <shawnsingh@chromium.org>
+
+        [chromium] Refactor CCLayerTreeHostCommon: merge scattered setTargetRenderSurface logic
+        https://bugs.webkit.org/show_bug.cgi?id=78936
+
+        Reviewed by James Robinson.
+
+        No change in behavior, the code moved around already covered by existing tests.
+
+        In calculateDrawTransformsAndVisibility(), there are two separate
+        if-else statements where setTargetRenderSurface logic is
+        performed, and this makes the code less readable and more error
+        prone. This patch merges the logic, removing the redundant if-else
+        statements.
+
+        This code also merges one other set of if-statements that are
+        equivalent, if (layer->parent()) and if (layer!=rootLayer).
+
+        * platform/graphics/chromium/LayerChromium.cpp:
+        (WebCore::LayerChromium::createRenderSurface):
+        * platform/graphics/chromium/cc/CCLayerImpl.cpp:
+        (WebCore::CCLayerImpl::createRenderSurface):
+        * platform/graphics/chromium/cc/CCLayerTreeHostCommon.cpp:
+        (WebCore::calculateDrawTransformsAndVisibilityInternal):
+
+2012-02-21  Kentaro Hara  <haraken@chromium.org>
+
+        Remove FIXME from resolve-supplemental.pl
+        https://bugs.webkit.org/show_bug.cgi?id=79160
+
+        Reviewed by Adam Barth.
+
+        The IDL attribute checker has been enabled in all build systems.
+        This patch removes FIXME in resolve-supplemental.pl.
+        Also, this patch improves a comment in IDLAttributes.txt.
+
+        No tests. No change in behavior.
+
+        * bindings/scripts/IDLAttributes.txt:
+        * bindings/scripts/resolve-supplemental.pl:
+
+2012-02-21  Emil A Eklund  <eae@chromium.org>
+
+        Add FractionalLayoutRect for sub-pixel layout
+        https://bugs.webkit.org/show_bug.cgi?id=78924
+
+        Reviewed by Eric Seidel.
+
+        Add FractionalLayoutUnit version of Rect class. Uses FractionalLayoutPoint
+        and FractionalLayoutSize internally.
+
+        Also add conversions to int/float versions of same.
+
+        No new tests.
+
+        * GNUmakefile.list.am:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * platform/graphics/FloatRect.cpp:
+        (WebCore::FloatRect::FloatRect):
+        (WebCore):
+        * platform/graphics/FloatRect.h:
+        (WebCore):
+        (FloatRect):
+        * platform/graphics/FractionalLayoutRect.cpp: Added.
+        (WebCore):
+        (WebCore::FractionalLayoutRect::FractionalLayoutRect):
+        (WebCore::FractionalLayoutRect::intersects):
+        (WebCore::FractionalLayoutRect::contains):
+        (WebCore::FractionalLayoutRect::intersect):
+        (WebCore::FractionalLayoutRect::unite):
+        (WebCore::FractionalLayoutRect::uniteIfNonZero):
+        (WebCore::FractionalLayoutRect::scale):
+        (WebCore::unionRect):
+        (WebCore::enclosingIntRect):
+        (WebCore::enclosingFractionalLayoutRect):
+        (WebCore::pixelSnappedIntRect):
+        * platform/graphics/FractionalLayoutRect.h: Added.
+        (WebCore):
+        (FractionalLayoutRect):
+        (WebCore::FractionalLayoutRect::FractionalLayoutRect):
+        (WebCore::FractionalLayoutRect::location):
+        (WebCore::FractionalLayoutRect::size):
+        (WebCore::FractionalLayoutRect::setLocation):
+        (WebCore::FractionalLayoutRect::setSize):
+        (WebCore::FractionalLayoutRect::x):
+        (WebCore::FractionalLayoutRect::y):
+        (WebCore::FractionalLayoutRect::maxX):
+        (WebCore::FractionalLayoutRect::maxY):
+        (WebCore::FractionalLayoutRect::width):
+        (WebCore::FractionalLayoutRect::height):
+        (WebCore::FractionalLayoutRect::setX):
+        (WebCore::FractionalLayoutRect::setY):
+        (WebCore::FractionalLayoutRect::setWidth):
+        (WebCore::FractionalLayoutRect::setHeight):
+        (WebCore::FractionalLayoutRect::isEmpty):
+        (WebCore::FractionalLayoutRect::center):
+        (WebCore::FractionalLayoutRect::move):
+        (WebCore::FractionalLayoutRect::moveBy):
+        (WebCore::FractionalLayoutRect::expand):
+        (WebCore::FractionalLayoutRect::contract):
+        (WebCore::FractionalLayoutRect::shiftXEdgeTo):
+        (WebCore::FractionalLayoutRect::shiftMaxXEdgeTo):
+        (WebCore::FractionalLayoutRect::shiftYEdgeTo):
+        (WebCore::FractionalLayoutRect::shiftMaxYEdgeTo):
+        (WebCore::FractionalLayoutRect::minXMinYCorner):
+        (WebCore::FractionalLayoutRect::maxXMinYCorner):
+        (WebCore::FractionalLayoutRect::minXMaxYCorner):
+        (WebCore::FractionalLayoutRect::maxXMaxYCorner):
+        (WebCore::FractionalLayoutRect::contains):
+        (WebCore::FractionalLayoutRect::inflateX):
+        (WebCore::FractionalLayoutRect::inflateY):
+        (WebCore::FractionalLayoutRect::inflate):
+        (WebCore::FractionalLayoutRect::transposedRect):
+        (WebCore::FractionalLayoutRect::infiniteRect):
+        (WebCore::intersection):
+        (WebCore::unionRect):
+        (WebCore::operator==):
+        (WebCore::operator!=):
+        * platform/graphics/IntRect.cpp:
+        (WebCore::IntRect::IntRect):
+        (WebCore):
+        * platform/graphics/IntRect.h:
+        (WebCore):
+        (IntRect):
+
+2012-02-21  James Robinson  <jamesr@chromium.org>
+
+        Enable ScrollingCoordinator in chromium whenever compositing is enabled
+        https://bugs.webkit.org/show_bug.cgi?id=79165
+
+        Reviewed by Adam Barth.
+
+        As the title says.
+
+        * page/scrolling/chromium/ScrollingCoordinatorChromium.cpp:
+        (WebCore::ScrollingCoordinator::frameViewHorizontalScrollbarLayerDidChange):
+        (WebCore::ScrollingCoordinator::frameViewVerticalScrollbarLayerDidChange):
+        (WebCore::ScrollingCoordinator::setScrollLayer):
+        (WebCore::ScrollingCoordinator::setNonFastScrollableRegion):
+        (WebCore::ScrollingCoordinator::setScrollParameters):
+        (WebCore::ScrollingCoordinator::setWheelEventHandlerCount):
+        (WebCore::ScrollingCoordinator::setShouldUpdateScrollLayerPositionOnMainThread):
+            Remove ASSERT_NOT_REACHED()ed from these functions, they are now expected to be called but do nothing.
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::RenderLayerBacking):
+            Guard a mac-specific piece of code in #if PLATFORM(MAC). This code already has a FIXME.
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::shouldCompositeOverflowControls):
+            Make coordinatesScroll..() sufficient but not necessary for compositing overflow controls. In chromium, we
+            want to composite overflow controls even for FrameViews that we aren't coordinating via the
+            ScrollingCoordinator.
+
+2012-02-21  Adam Klein  <adamk@chromium.org>
+
+        Setting innerText causes DOMSubtreeModified to be dispatched too early
+        https://bugs.webkit.org/show_bug.cgi?id=79140
+
+        Reviewed by Ryosuke Niwa.
+
+        Followup to r108152: move children change notifications later in
+        ContainerNode::removeChildren(), thus making sure Node::inDocument()
+        is in the correct state when we call into script.
+
+        Tests: fast/dom/getElementById-consistency3.html
+               fast/dom/getElementById-consistency4.html
+               fast/dom/getElementById-consistency5.html
+
+        * dom/ContainerNode.cpp:
+        (WebCore::ContainerNode::removeChildren):
+
+2012-02-15  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Assertion failure in TextIterator::handleTextBox
+        https://bugs.webkit.org/show_bug.cgi?id=78530
+
+        Reviewed by Eric Seidel.
+
+        The assertion failure was caused by handleTextNodeFirstLetter's updating m_text without clearing
+        m_sortedTextBoxesPosition. Re-structured handleTextNode so that we always reset m_sortedTextBoxesPosition
+        when we have a first-letter.
+
+        Test: editing/text-iterator/rtl-first-letter-text-iterator-crash.html
+
+        * editing/TextIterator.cpp:
+        (WebCore::TextIterator::handleTextNode):
+        (WebCore::TextIterator::handleTextBox):
+        (WebCore::TextIterator::handleTextNodeFirstLetter):
+
+2012-02-21  Yael Aharon  <yael.aharon@nokia.com>
+
+        Unreviewed build fix.
+
+        No new tests.
+
+        * platform/graphics/opengl/TextureMapperGL.cpp:
+
+2012-02-21  Adam Klein  <adamk@chromium.org>
+
+        ContainerNode::childrenChanged must be called immediately after removing children
+        https://bugs.webkit.org/show_bug.cgi?id=79162
+
+        Reviewed by Ryosuke Niwa.
+
+        In r108152, a call to childrenChanged() was erroneously moved
+        below the call to child->removedFromDocument(). This breaks, at the
+        least, the behavior of the <title> element. This patch corrects the
+        mistake and adds a test.
+
+        Test: fast/dom/title-directionality-removeChild.html
+
+        * dom/ContainerNode.cpp:
+        (WebCore::ContainerNode::removeChild):
+
+2012-02-21  Luke Macpherson   <macpherson@chromium.org>
+
+        Implement many instances of HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE in CSSStyleApplyProperty.
+        https://bugs.webkit.org/show_bug.cgi?id=79067
+
+        Reviewed by Andreas Kling.
+
+        No new tests / refactoring only.
+
+        * css/CSSStyleApplyProperty.cpp:
+        (WebCore::CSSStyleApplyProperty::CSSStyleApplyProperty):
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::collectMatchingRulesForList):
+        * rendering/style/RenderStyle.h:
+
+2012-02-21  Jon Lee  <jonlee@apple.com>
+
+        Bring notifications support to WK1 mac
+        https://bugs.webkit.org/show_bug.cgi?id=78783
+        <rdar://problem/10610578>
+
+        Reviewed by Anders Carlsson.
+
+        * WebCore.exp.in: Expose dispatchErrorEvent on Notification.
+
+2012-02-21  No'am Rosenthal  <noam.rosenthal@nokia.com>
+
+        [Qt] Previous web page appears outside content rect
+        https://bugs.webkit.org/show_bug.cgi?id=78816
+
+        Adjust the scissor clipping by -1, as the glScissor() function requires coordinates and
+        not sizes.
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        No new functionality.
+
+        * platform/graphics/opengl/TextureMapperGL.cpp:
+        (WebCore::scissorClip):
+
+2012-02-21  Victor Carbune  <vcarbune@adobe.com>
+
+        Added support for pause-on-exit flag on a TextTrackCue.
+        https://bugs.webkit.org/show_bug.cgi?id=72173
+
+        Reviewed by Eric Carlson.
+
+        Test: media/track/track-cues-pause-on-exit.html
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::updateActiveTextTrackCues): Implemented
+        support for pausing the video if the pause-on-exit flag is set on
+        a cue that is currently exiting.
+
+2012-02-21  Kentaro Hara  <haraken@chromium.org>
+
+        Enable the IDL attribute checker in all build systems
+        https://bugs.webkit.org/show_bug.cgi?id=79090
+
+        Reviewed by Adam Barth.
+
+        We have enabled the IDL attribute checker in Chromium in r108322.
+        This patch enables the IDL attribute checker in all other
+        build systems.
+
+        No tests. I manually checked that [Custommm], [CallWith=],
+        [CallWith=ScriptExecutionContext|Foo] cause build failures.
+
+        * CMakeLists.txt:
+        * DerivedSources.make:
+        * DerivedSources.pri:
+        * GNUmakefile.am:
+        * UseJSC.cmake:
+        * UseV8.cmake:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/scripts/IDLAttributes.txt: Added [ObjCCustomImplementation]
+        since I forgot to add it in r108322.
+
+2012-02-21  Yael Aharon  <yael.aharon@nokia.com>
+
+        [Texmap] Better management of shaders in TextureMapperGL
+        https://bugs.webkit.org/show_bug.cgi?id=78674
+ 
+        Reviewed by Noam Rosenthal.
+ 
+        Split TextureMapperGL.cpp into two files.
+        Get rid of the enums that we were using to identify shaders and to identify variables.
+        Switch flip and opaque from using bool to using enums.
+ 
+        No new tests. This is refactoring only.
+ 
+        * GNUmakefile.list.am:
+        * Target.pri:
+        * WebCore.gypi:
+        * platform/graphics/OpenGLShims.h:
+        * platform/graphics/opengl/TextureMapperGL.cpp:
+        (WebCore):
+        (SharedGLData):
+        (WebCore::TextureMapperGLData::SharedGLData::SharedGLData):
+        (WebCore::TextureMapperGLData::SharedGLData::~SharedGLData):
+        (WebCore::TextureMapperGLData::TextureMapperGLData):
+        (TextureMapperGLData):
+        (WebCore::TextureMapperGL::drawTexture):
+        (WebCore::TextureMapperGL::drawTextureWithMaskAndOpacity):
+        (WebCore::TextureMapperGL::drawTextureSimple):
+        (WebCore::TextureMapperGL::beginClip):
+        * platform/graphics/opengl/TextureMapperGL.h:
+        * platform/graphics/opengl/TextureMapperShaderManager.cpp: Added.
+        (WebCore):
+        (WebCore::FRAGMENT_SHADER):
+        (WebCore::TextureMapperShaderProgram::initializeProgram):
+        (WebCore::TextureMapperShaderProgram::getUniformLocation):
+        (WebCore::TextureMapperShaderProgram::~TextureMapperShaderProgram):
+        (WebCore::TextureMapperShaderProgramSimple::create):
+        (WebCore::TextureMapperShaderProgramSimple::TextureMapperShaderProgramSimple):
+        (WebCore::TextureMapperShaderProgramSimple::vertexShaderSource):
+        (WebCore::TextureMapperShaderProgramSimple::fragmentShaderSource):
+        (WebCore::TextureMapperShaderProgramOpacityAndMask::create):
+        (WebCore::TextureMapperShaderProgramOpacityAndMask::TextureMapperShaderProgramOpacityAndMask):
+        (WebCore::TextureMapperShaderProgramOpacityAndMask::vertexShaderSource):
+        (WebCore::TextureMapperShaderProgramOpacityAndMask::fragmentShaderSource):
+        (WebCore::TextureMapperShaderProgramClip::create):
+        (WebCore::TextureMapperShaderProgramClip::TextureMapperShaderProgramClip):
+        (WebCore::TextureMapperShaderProgramClip::vertexShaderSource):
+        (WebCore::TextureMapperShaderProgramClip::fragmentShaderSource):
+        (WebCore::TextureMapperShaderManager::TextureMapperShaderManager):
+        (WebCore::TextureMapperShaderManager::~TextureMapperShaderManager):
+        * platform/graphics/opengl/TextureMapperShaderManager.h: Added.
+        (WebCore):
+        (WebCore::debugGLCommand):
+        (TextureMapperShaderProgram):
+        (WebCore::TextureMapperShaderProgram::id):
+        (WebCore::TextureMapperShaderProgram::vertexAttrib):
+        (WebCore::TextureMapperShaderProgram::shaderType):
+        (TextureMapperShaderProgramSimple):
+        (WebCore::TextureMapperShaderProgramSimple::matrixVariable):
+        (WebCore::TextureMapperShaderProgramSimple::sourceMatrixVariable):
+        (WebCore::TextureMapperShaderProgramSimple::sourceTextureVariable):
+        (WebCore::TextureMapperShaderProgramSimple::opacityVariable):
+        (TextureMapperShaderProgramOpacityAndMask):
+        (WebCore::TextureMapperShaderProgramOpacityAndMask::sourceMatrixVariable):
+        (WebCore::TextureMapperShaderProgramOpacityAndMask::matrixVariable):
+        (WebCore::TextureMapperShaderProgramOpacityAndMask::maskMatrixVariable):
+        (WebCore::TextureMapperShaderProgramOpacityAndMask::sourceTextureVariable):
+        (WebCore::TextureMapperShaderProgramOpacityAndMask::maskTextureVariable):
+        (WebCore::TextureMapperShaderProgramOpacityAndMask::opacityVariable):
+        (TextureMapperShaderProgramClip):
+        (WebCore::TextureMapperShaderProgramClip::matrixVariable):
+        (TextureMapperShaderManager):
+        (WebCore::TextureMapperShaderManager::getShaderProgram):
+        * platform/graphics/qt/GraphicsContext3DQt.cpp:
+        (WebCore::GraphicsContext3DPrivate::paintToTextureMapper):
+        * platform/graphics/texmap/TextureMapper.h:
+        (WebCore::BitmapTexture::reset):
+        (WebCore::BitmapTexture::isOpaque):
+        (BitmapTexture):
+
+2012-02-21  Anders Carlsson  <andersca@apple.com>
+
+        The tile cache should keep track of the tile coverage rect
+        https://bugs.webkit.org/show_bug.cgi?id=79149
+        <rdar://problem/10877338>
+
+        Reviewed by Andreas Kling.
+
+        Keep track of the tile coverage rect and use it to avoid trying to iterate over non-existent tiles on large pages.
+
+        * platform/graphics/ca/mac/TileCache.h:
+        (TileCache):
+        * platform/graphics/ca/mac/TileCache.mm:
+        (WebCore::TileCache::setNeedsDisplayInRect):
+        (WebCore::TileCache::revalidateTiles):
+
+2012-02-21  Andreas Kling  <awesomekling@apple.com>
+
+        Make WebKitCSSShaderValue inherit directly from CSSValue.
+        <http://webkit.org/b/79144>
+
+        Reviewed by Antti Koivisto.
+
+        WebKitCSSShaderValue was inheriting from CSSPrimitiveValue but only used
+        it for storing the shader URL. Moved that to a String member instead.
+
+        WebKitCSSShaderValues didn't even return true for isPrimitiveValue() so
+        there should be no behavior change whatsoever here.
+
+        * css/WebKitCSSShaderValue.cpp:
+        (WebCore::WebKitCSSShaderValue::WebKitCSSShaderValue):
+        (WebCore::WebKitCSSShaderValue::cachedShader):
+        (WebCore::WebKitCSSShaderValue::customCssText):
+        * css/WebKitCSSShaderValue.h:
+        (WebKitCSSShaderValue):
+
+2012-02-21  James Robinson  <jamesr@chromium.org>
+
+        Unreviewed windows build fix - avoid return statement after return if USE(ACCELERATED_COMPOSITING) is set.
+
+        * page/scrolling/ScrollingCoordinator.cpp:
+        (WebCore::ScrollingCoordinator::coordinatesScrollingForFrameView):
+
+2012-02-21  James Robinson  <jamesr@chromium.org>
+
+        ScrollingCoordinator::coordinatesScrollingForFrameView should be conditional on compositing being active
+        https://bugs.webkit.org/show_bug.cgi?id=79126
+
+        Reviewed by Anders Carlsson.
+
+        The ScrollingCoordinator should only attempt to coordinate scrolling when compositing is active, since it's all
+        about manipulating GraphicsLayers. Adds a runtime check.
+
+        Also removes some stray #if ENABLE(THREADED_SCROLLING) guards that snuck into FrameView.
+
+        * page/FrameView.cpp:
+        (WebCore::FrameView::addFixedObject):
+        (WebCore::FrameView::removeFixedObject):
+        * page/scrolling/ScrollingCoordinator.cpp:
+        (WebCore::ScrollingCoordinator::coordinatesScrollingForFrameView):
+        (WebCore::ScrollingCoordinator::frameViewRootLayerDidChange):
+
+2012-02-21  James Robinson  <jamesr@chromium.org>
+
+        Chromium build fix. Unreviwed but rubber-stamped by Antti.
+
+        * dom/Document.cpp:
+        * editing/ReplaceSelectionCommand.cpp:
+        * inspector/InspectorStyleSheet.h:
+
+2012-02-21  Eric Carlson  <eric.carlson@apple.com>
+
+        Set Referrer header for media downloads
+        https://bugs.webkit.org/show_bug.cgi?id=78614
+
+        Reviewed by Alexey Proskuryakov.
+
+        Test: http/tests/media/video-referer.html was modified to test this change.
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::mediaPlayerReferrer): New, return the document's referer.
+        * html/HTMLMediaElement.h:
+
+        * platform/graphics/MediaPlayer.cpp:
+        (WebCore::MediaPlayer::referrer): New, return the client's mediaPlayerReferrer.
+        * platform/graphics/MediaPlayer.h:
+        (WebCore::MediaPlayerClient::mediaPlayerReferrer):
+
+        * platform/graphics/avfoundation/MediaPlayerPrivateAVFoundation.h:
+        * platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.mm:
+        (WebCore::MediaPlayerPrivateAVFoundationObjC::createAVAssetForURL): Tell AVFoundation to add
+            a referer header.
+
+2012-02-21  Antti Koivisto  <antti@apple.com>
+
+        Not reviewed.
+
+        Remove some obsolete comments, use consistent name for propertyID.
+
+        * css/StylePropertySet.h:
+        (StylePropertySet):
+
+2012-02-21  Antti Koivisto  <antti@apple.com>
+
+        Clean up StylePropertySet included headers
+        https://bugs.webkit.org/show_bug.cgi?id=79134
+
+        Reviewed by Andreas Kling.
+
+        Remove unneccesary includes.
+
+        * bindings/js/JSDOMBinding.h:
+        * css/StylePropertySet.cpp:
+        * css/StylePropertySet.h:
+        (WebCore):
+        (StylePropertySet):
+        * editing/RemoveCSSPropertyCommand.cpp:
+
+2012-02-21  Lin Wei  <wei.a.lin@intel.com>
+
+        Fix bug from r107672.
+        https://bugs.webkit.org/show_bug.cgi?id=78773
+
+        Before set MediaStreamTrack disable/enable operation,
+        checking the status of MediaStream that contains this MediaStreamTrack.
+        if MediaStream is finished, then skipping operation of 
+        didSetMediaStreamTrackEnabled().
+
+        Reviewed by Adam Barth.
+        * mediastream/MediaStreamTrack.cpp:
+        (WebCore::MediaStreamTrack::setEnabled):
+
+2012-02-21  Julien Chaffraix  <jchaffraix@webkit.org>
+
+        Move RenderLayer::scrolledContentOffset calls to a common function
+        https://bugs.webkit.org/show_bug.cgi?id=76971
+
+        Reviewed by David Hyatt.
+
+        Refactoring without any change in behavior.
+
+        This change adds a RenderBox::scrolledContentOffset function to handle all
+        the calls that goes through the layer(). This indirection will enable us to
+        add layer() checks without patching a lot of call sites as part of bug 75568.
+
+        We also moved down the concept of scroll offset down to RenderBox where it belongs!
+
+        * rendering/RenderLayer.h:
+        (RenderLayer):
+        (WebCore::RenderLayer::scrolledContentOffset):
+        Moved scrolledContent to the private section of the class to prevent misuse.
+
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::scrolledContentOffset):
+        New function to add an indirection with RenderLayer.
+
+        * editing/visible_units.cpp:
+        (WebCore::absoluteLineDirectionPointToLocalPointInBlock):
+        * rendering/LayoutState.cpp:
+        (WebCore::LayoutState::LayoutState):
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::layoutBlock):
+        (WebCore::RenderBlock::paintObject):
+        (WebCore::RenderBlock::selectionGapRectsForRepaint):
+        (WebCore::RenderBlock::paintSelection):
+        (WebCore::RenderBlock::nodeAtPoint):
+        (WebCore::RenderBlock::offsetForContents):
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::offsetFromContainer):
+        (WebCore::RenderBox::computeRectForRepaint):
+        * rendering/RenderBox.h:
+        (RenderBox):
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::RenderBoxModelObject::paintFillLayerExtended):
+        * rendering/RenderInline.cpp:
+        (WebCore::RenderInline::clippedOverflowRectForRepaint):
+        (WebCore::RenderInline::computeRectForRepaint):
+        (WebCore::RenderInline::offsetFromContainer):
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::computeRectForRepaint):
+        (WebCore::RenderObject::mapLocalToContainer):
+        (WebCore::RenderObject::mapAbsoluteToLocalPoint):
+        (WebCore::RenderObject::offsetFromContainer):
+        * rendering/RenderTextControlSingleLine.cpp:
+        (WebCore::RenderTextControlInnerBlock::positionForPoint):
+        Patched all those call sites to use the new function.
+
+2012-02-21  Emil A Eklund  <eae@chromium.org>
+
+        Remove obsolete float comparison FIXMEs
+        https://bugs.webkit.org/show_bug.cgi?id=79127
+
+        Reviewed by Eric Seidel.
+
+        Remove obsolete FIXME comments added back when we were planning to use
+        floating point units for layout.
+
+        No new tests, no code changes.
+
+        * page/FrameView.cpp:
+        (WebCore::FrameView::init):
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::layoutBlock):
+        (WebCore::RenderBlock::computeStartPositionDeltaForChildAvoidingFloats):
+        (WebCore::RenderBlock::getClearDelta):
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::computeLogicalHeight):
+        (WebCore::RenderBox::computeLogicalHeightUsing):
+        (WebCore::RenderBox::computePercentageLogicalHeight):
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::ImageQualityController::shouldPaintAtLowQuality):
+
+2012-02-21  Alexander Pavlov  <apavlov@chromium.org>
+
+        Web Inspector: it is nearly impossible to select and copy text on the Elements panel.
+        https://bugs.webkit.org/show_bug.cgi?id=60814
+
+        Reviewed by Pavel Feldman.
+
+        * inspector/front-end/inspector.js:
+        (WebInspector.documentClick.followLink):
+        (WebInspector.documentClick):
+
+2012-02-21  Abhishek Arya  <inferno@chromium.org>
+
+        Crash in RenderTableSection::nodeAtPoint.
+        https://bugs.webkit.org/show_bug.cgi?id=78922
+
+        Reviewed by Julien Chaffraix.
+
+        Test: fast/table/table-section-node-at-point-crash.html
+
+        * rendering/RenderTableSection.cpp:
+        (WebCore::RenderTableSection::nodeAtPoint): recalc cells if the
+        m_needsCellRecalc is set. Otherwise, we will end up accessing
+        removed table cells.
+
+2012-02-21  Antti Koivisto  <antti@apple.com>
+
+        Move PropertySetCSSStyleDeclaration to a file of its own
+        https://bugs.webkit.org/show_bug.cgi?id=79121
+
+        Rubber-stamped by Andreas Kling.
+
+        This makes StylePropertySet.cpp more readable.
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * Target.pri:
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * css/PropertySetCSSStyleDeclaration.cpp: Copied from Source/WebCore/css/StylePropertySet.cpp.
+        (WebCore::PropertySetCSSStyleDeclaration::ref):
+        (WebCore::PropertySetCSSStyleDeclaration::deref):
+        (WebCore):
+        * css/PropertySetCSSStyleDeclaration.h: Added.
+        (WebCore):
+        (PropertySetCSSStyleDeclaration):
+        (WebCore::PropertySetCSSStyleDeclaration::PropertySetCSSStyleDeclaration):
+        (WebCore::PropertySetCSSStyleDeclaration::parentElement):
+        (WebCore::PropertySetCSSStyleDeclaration::clearParentRule):
+        (WebCore::PropertySetCSSStyleDeclaration::clearParentElement):
+        (WebCore::PropertySetCSSStyleDeclaration::contextStyleSheet):
+        (WebCore::PropertySetCSSStyleDeclaration::setNeedsStyleRecalc):
+        (RuleCSSStyleDeclaration):
+        (WebCore::RuleCSSStyleDeclaration::RuleCSSStyleDeclaration):
+        (WebCore::RuleCSSStyleDeclaration::parentRule):
+        (WebCore::RuleCSSStyleDeclaration::clearParentRule):
+        (InlineCSSStyleDeclaration):
+        (WebCore::InlineCSSStyleDeclaration::InlineCSSStyleDeclaration):
+        (WebCore::InlineCSSStyleDeclaration::parentElement):
+        (WebCore::InlineCSSStyleDeclaration::clearParentElement):
+        * css/StylePropertySet.cpp:
+        (WebCore):
+
+2012-02-21  Philippe Normand  <pnormand@igalia.com>
+
+        [GTK] WebAudio build is broken
+        https://bugs.webkit.org/show_bug.cgi?id=79113
+
+        Reviewed by Martin Robinson.
+
+        * platform/audio/gstreamer/WebKitWebAudioSourceGStreamer.cpp:
+        (webKitWebAudioGStreamerChannelPosition): Set a default value for
+        the position variable.
+        * platform/audio/gtk/AudioBusGtk.cpp: Include CString.h, needed
+        for sharedResourcesPath().
+
+2012-02-21  Andreas Kling  <awesomekling@apple.com>
+
+        Kill FontFamilyValue.
+        <http://webkit.org/b/79103>
+
+        Reviewed by Antti Koivisto.
+
+        Remove FontFamilyValue and replace all usage by CSSPrimitiveValue.
+        The class was only used to filter font family names, removing bracketed
+        suffixes, e.g "[Xft]".
+
+        This was added to KHTML in 2002 to support the use of specific X11 font
+        families inside KMail: <https://bugs.kde.org/show_bug.cgi?id=38808>
+
+        Test: fast/css/font-family-trailing-bracket-gunk.html
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * Target.pri:
+        * WebCore.gypi:
+        * WebCore.order:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * css/CSSFontSelector.cpp:
+        (WebCore::CSSFontSelector::addFontFaceRule):
+        * css/CSSParser.cpp:
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::collectMatchingRulesForList):
+        * css/CSSValue.cpp:
+        (WebCore::CSSValue::cssText):
+        (WebCore::CSSValue::destroy):
+        * css/CSSValue.h:
+        * css/CSSValuePool.cpp:
+        (WebCore::CSSValuePool::createFontFamilyValue):
+        * css/CSSValuePool.h:
+        (CSSValuePool):
+        * css/FontFamilyValue.cpp: Removed.
+        * css/FontFamilyValue.h: Removed.
+
+2012-02-21  Alexis Menard  <alexis.menard@openbossa.org>
+
+        Little optimization for CSSParser::parseFillShorthand.
+        https://bugs.webkit.org/show_bug.cgi?id=79042
+
+        Reviewed by Hajime Morita.
+
+        Remove one extra loop that we can combine with the following one
+        which adds the properties to the parser's list of properties. I also
+        removed a useless check.
+        Instruments shows on the css-parser-yui benchmark an improvement
+        of 13ms (from 77ms spent in the function to 64ms).
+
+        No new tests : refactoring, existings tests should cover.
+
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseFillShorthand):
+
+2012-02-20  David Hyatt  <hyatt@apple.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=79046
+        
+        width of overflow:hidden blocks is wrong when their margins overlap floats.
+        
+        Relevant discussion is here: http://lists.w3.org/Archives/Public/www-style/2012Feb/0954.html
+        
+        This patch makes the following changes to how objects shrink when avoiding floats:
+        (1) The containing block width used for percentage calculations is now constant. This means that
+        an overflow:hidden block with a margin-left of 10% will no longer change what 10% means depending
+        on the available line width. From a code perspective, containingBlockLogicalWidthForContent and
+        containingBlockLogicalWidthForContentInRegion no longer contain any special-case code for
+        shrinkToAvoidFloats() objects.
+
+        (2) Now the computation of the logical width for the shrinking object itself handles the adjustments.
+        Two kinds of adjustments are made for both the start and end margins. Conceptually what we do is shrink
+        the object to the available line width minus our margins, and then expand the width back out to the content edge
+        or to the float edge as necessary. If the float fully fits in the margin, then we expand back out to the
+        content edge. Otherwise if the float doesn't fit, then we expand only to the float edge, making sure our
+        margin overlaps with the float. This expansion is not performed for negative margins, since our result is already
+        correct in that case.
+        
+        Reviewed by Dan Bernstein.
+
+        Added the new tests from the thread on www-style about this issue (from Alan Gresley and George Talbot)
+        in fast/block/float.
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::containsFloat):
+        * rendering/RenderBlock.h:
+        (WebCore::RenderBlock::containsFloats):
+        Changed to be const.
+
+        (WebCore::RenderBlock::endOffsetForLine):
+        (WebCore::RenderBlock::endOffsetForContent):
+        Added endOffsetForXXX methods to mirror their startOffset counterparts. Used by the width adjustment code.
+
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::shrinkLogicalWidthToAvoidFloats):
+        New method that handles shrinking the logical width to the line width (and then re-expanding back out to the
+        float and/or content edges as needed).
+
+        (WebCore::RenderBox::containingBlockLogicalWidthForContent):
+        (WebCore::RenderBox::containingBlockLogicalWidthForContentInRegion):
+        Patched to no longer do the shrinking of objects to avoid floats.
+
+        (WebCore::RenderBox::computeLogicalWidthInRegion):
+        (WebCore::RenderBox::computeLogicalWidthInRegionUsing):
+        Patched to handle calling the new shrinking code to adjust our logical width.
+
+        * rendering/RenderBox.h:
+        (RenderBox):
+        The signature of computeLogicalWithUsing changed to be region-specific and to carry along enough information
+        to efficiently perform the shrinking.
+
+        * rendering/RenderTable.cpp:
+        (WebCore::RenderTable::computeLogicalWidth):
+        Patched to handle calling the new shrinking code to adjust our logical width.
+
+2012-02-21  Sam Weinig  <sam@webkit.org>
+
+        Attempt to fix the Snow Leopard build.
+
+        * Configurations/Base.xcconfig:
+
+2012-02-21  Sam Weinig  <sam@webkit.org>
+
+        Use libc++ when building with Clang on Mac
+        https://bugs.webkit.org/show_bug.cgi?id=78981
+
+        Reviewed by Dan Bernstein.
+
+        * Configurations/Base.xcconfig:
+
+2012-02-21  Adam Roben  <aroben@apple.com>
+
+        Mac build fix
+
+        * WebCore.xcodeproj/project.pbxproj: Mark TextTrack.h and TextTrackCue.h private so that
+        WebKit can include them.
+
+2012-02-21  Andras Becsi  <andras.becsi@nokia.com>
+
+        [Qt][WK2] Fix the N9 build
+        https://bugs.webkit.org/show_bug.cgi?id=79101
+
+        Reviewed by Noam Rosenthal.
+
+        No new tests needed.
+
+        * platform/graphics/opengl/TextureMapperGL.cpp: Add missing include.
+
+2012-02-21  Adam Roben  <aroben@apple.com>
+
+        Roll out r108309, r108323, and r108326
+
+        They broke the 32-bit Lion build.
+
+        Original bugs is <http://webkit.org/b/75812> <rdar://problem/10079694>.
+
+        * CMakeLists.txt:
+
+2012-02-21  Alexander Pavlov  <apavlov@chromium.org>
+
+        Web Inspector: [SuggestBox] textPrompt.css disablement displays garbled suggest box
+        https://bugs.webkit.org/show_bug.cgi?id=79107
+
+        Reviewed by Pavel Feldman.
+
+        * inspector/front-end/TextPrompt.js:
+        (WebInspector.TextPrompt.SuggestBox):
+        (WebInspector.TextPrompt.SuggestBox.prototype.get visible):
+        (WebInspector.TextPrompt.SuggestBox.prototype.hide):
+        (WebInspector.TextPrompt.SuggestBox.prototype.removeFromElement):
+        (WebInspector.TextPrompt.SuggestBox.prototype._completionsReady):
+        * inspector/front-end/textPrompt.css:
+        (.suggest-box):
+
+2012-02-21  Yury Semikhatsky  <yurys@chromium.org>
+
+        Web Inspector: timeline hangs on a page with deep chain of nested events.
+        https://bugs.webkit.org/show_bug.cgi?id=79106
+
+        Use stack of states instead of recursive calls when traversing records tree to
+        avoid stack overflow.
+
+        Reviewed by Pavel Feldman.
+
+        * inspector/front-end/TimelineOverviewPane.js:
+        (WebInspector.TimelineOverviewPane.prototype._forAllRecords):
+        * inspector/front-end/TimelinePanel.js:
+        (WebInspector.TimelinePanel.prototype._filterRecords):
+
+2012-02-21  Pavel Feldman  <pfeldman@google.com>
+
+        Web Inspector: [crash] upon style modification after navigation
+        https://bugs.webkit.org/show_bug.cgi?id=79108
+
+        Reviewed by Yury Semikhatsky.
+
+        * inspector/InspectorHistory.cpp:
+        (WebCore::InspectorHistory::undo):
+        (WebCore::InspectorHistory::redo):
+        (WebCore::InspectorHistory::reset):
+
+2012-02-21  Patrick Gansterer  <paroga@webkit.org>
+
+        Use WTF::cryptographicallyRandomValues in FileSystemWin.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=79089
+
+        Reviewed by Adam Roben.
+
+        Avoid loading and unloading of the crypto library during every
+        call to openTemporaryFile() and make the code easier.
+
+        * platform/win/FileSystemWin.cpp:
+        (WebCore::openTemporaryFile):
+
+2012-02-21  Alexander Færøy  <alexander.faeroy@nokia.com>
+
+        Remove stylesheet pointer from StylePropertySet
+        https://bugs.webkit.org/show_bug.cgi?id=79092
+
+        Reviewed by Csaba Osztrogonác.
+
+        Qt buildfix after r108345.
+
+        * css/CSSParser.cpp:
+        (WebCore::parseColorValue):
+
+2012-02-21  Csaba Osztrogonác  <ossy@webkit.org>
+
+        Remove stylesheet pointer from StylePropertySet
+        https://bugs.webkit.org/show_bug.cgi?id=79092
+
+        Reviewed by Antti Koivisto.
+
+        Qt buildfix after r108345. We need this workaround because of buggy gcc (4.4.5), which
+        reported a false warning: 'value$m_ptr' may be used uninitialized in this function
+
+        * css/CSSParser.cpp:
+        (WebCore::parseSimpleLengthValue):
+
+2012-02-21  Andreas Kling  <awesomekling@apple.com>
+
+        Shrink attribute style property sets after populating them.
+        <http://webkit.org/b/78972>
+
+        Reviewed by Antti Koivisto.
+
+        Add a StylePropertySet::shrinkToFit() and call it at the end of updateStyleAttribute()
+        to minimize the amount of wasted space.
+
+        * css/StylePropertySet.h:
+        (WebCore::StylePropertySet::shrinkToFit):
+        * dom/StyledElement.cpp:
+        (WebCore::StyledElement::updateAttributeStyle):
+
+2012-02-21  Antti Koivisto  <antti@apple.com>
+
+        Remove stylesheet pointer from StylePropertySet
+        https://bugs.webkit.org/show_bug.cgi?id=79092
+
+        Reviewed by Andreas Kling.
+
+        The context should be passed as an argument for CSS parser invoking setters that actually need it.
+        
+        - Remove the context stylesheet pointer.
+        - Add context stylesheet argument to setters.
+        - Drop an unnecessary StylePropertySet constructor, pass strict parsing flag directly.
+        - Adapt to changes by passing in the context stylesheet where needed.
+        - Add StyledElement::applyPresentationAttributeToStyle helpers for building up the attribute style.
+
+        * css/CSSFontFaceRule.cpp:
+        (WebCore::CSSFontFaceRule::addSubresourceStyleURLs):
+        * css/CSSParser.cpp:
+        (WebCore::parseColorValue):
+        (WebCore::parseSimpleLengthValue):
+        (WebCore::CSSParser::parseValue):
+        (WebCore::CSSParser::parseDeclaration):
+        (WebCore::CSSParser::createStyleRule):
+        (WebCore::CSSParser::createFontFaceRule):
+        (WebCore::CSSParser::createPageRule):
+        (WebCore::CSSParser::createKeyframeRule):
+        * css/CSSParser.h:
+        (CSSParser):
+        * css/CSSStyleRule.cpp:
+        (WebCore::CSSStyleRule::addSubresourceStyleURLs):
+        * css/StylePropertySet.cpp:
+        (WebCore::PropertySetCSSStyleDeclaration::contextStyleSheet):
+        (WebCore::PropertySetCSSStyleDeclaration::setNeedsStyleRecalc):
+        (RuleCSSStyleDeclaration):
+        (InlineCSSStyleDeclaration):
+        (WebCore):
+        (WebCore::StylePropertySet::StylePropertySet):
+        (WebCore::StylePropertySet::setProperty):
+        (WebCore::StylePropertySet::parseDeclaration):
+        (WebCore::StylePropertySet::addSubresourceStyleURLs):
+        (WebCore::StylePropertySet::clearParentRule):
+        (WebCore::StylePropertySet::clearParentElement):
+        (WebCore::PropertySetCSSStyleDeclaration::setCssText):
+        (WebCore::PropertySetCSSStyleDeclaration::setProperty):
+        (WebCore::PropertySetCSSStyleDeclaration::setPropertyInternal):
+        (WebCore::PropertySetCSSStyleDeclaration::parentStyleSheet):
+        (WebCore::RuleCSSStyleDeclaration::setNeedsStyleRecalc):
+        (WebCore::RuleCSSStyleDeclaration::contextStyleSheet):
+        (WebCore::InlineCSSStyleDeclaration::contextStyleSheet):
+        (SameSizeAsStylePropertySet):
+        * css/StylePropertySet.h:
+        (WebCore::StylePropertySet::create):
+        (StylePropertySet):
+        * css/WebKitCSSMatrix.cpp:
+        (WebCore::WebKitCSSMatrix::setMatrixValue):
+        * dom/ElementAttributeData.cpp:
+        (WebCore::ElementAttributeData::ensureInlineStyleDecl):
+        * dom/StyledElement.cpp:
+        (WebCore):
+        (WebCore::StyledElement::parseAttribute):
+        (WebCore::StyledElement::setInlineStyleProperty):
+        (WebCore::StyledElement::addSubresourceAttributeURLs):
+        (WebCore::StyledElement::updateAttributeStyle):
+        * dom/StyledElement.h:
+        (StyledElement):
+        (WebCore::StyledElement::applyPresentationAttributeToStyle):
+        (WebCore):
+        * html/HTMLBRElement.cpp:
+        (WebCore::HTMLBRElement::collectStyleForAttribute):
+        * html/HTMLBodyElement.cpp:
+        (WebCore::HTMLBodyElement::collectStyleForAttribute):
+        * html/HTMLDivElement.cpp:
+        (WebCore::HTMLDivElement::collectStyleForAttribute):
+        * html/HTMLElement.cpp:
+        (WebCore::HTMLElement::applyBorderAttributeToStyle):
+        (WebCore::HTMLElement::mapLanguageAttributeToLocale):
+        (WebCore::HTMLElement::collectStyleForAttribute):
+        (WebCore::HTMLElement::applyAlignmentAttributeToStyle):
+        (WebCore::HTMLElement::addHTMLLengthToStyle):
+        (WebCore::HTMLElement::addHTMLColorToStyle):
+        * html/HTMLElement.h:
+        (HTMLElement):
+        * html/HTMLFontElement.cpp:
+        (WebCore::HTMLFontElement::collectStyleForAttribute):
+        * html/HTMLHRElement.cpp:
+        (WebCore::HTMLHRElement::collectStyleForAttribute):
+        * html/HTMLImageElement.cpp:
+        (WebCore::HTMLImageElement::collectStyleForAttribute):
+        * html/HTMLLIElement.cpp:
+        (WebCore::HTMLLIElement::collectStyleForAttribute):
+        * html/HTMLMarqueeElement.cpp:
+        (WebCore::HTMLMarqueeElement::collectStyleForAttribute):
+        * html/HTMLOListElement.cpp:
+        (WebCore::HTMLOListElement::collectStyleForAttribute):
+        * html/HTMLParagraphElement.cpp:
+        (WebCore::HTMLParagraphElement::collectStyleForAttribute):
+        * html/HTMLTableCaptionElement.cpp:
+        (WebCore::HTMLTableCaptionElement::collectStyleForAttribute):
+        * html/HTMLTableCellElement.cpp:
+        (WebCore::HTMLTableCellElement::collectStyleForAttribute):
+        * html/HTMLTableElement.cpp:
+        (WebCore::HTMLTableElement::collectStyleForAttribute):
+        * html/HTMLTablePartElement.cpp:
+        (WebCore::HTMLTablePartElement::collectStyleForAttribute):
+        * html/HTMLTextAreaElement.cpp:
+        (WebCore::HTMLTextAreaElement::collectStyleForAttribute):
+        * html/HTMLUListElement.cpp:
+        (WebCore::HTMLUListElement::collectStyleForAttribute):
+        * html/canvas/CanvasRenderingContext2D.cpp:
+        (WebCore::CanvasRenderingContext2D::setFont):
+        * mathml/MathMLElement.cpp:
+        (WebCore::MathMLElement::collectStyleForAttribute):
+        * svg/SVGFontFaceElement.cpp:
+        (WebCore::SVGFontFaceElement::insertedIntoDocument):
+        (WebCore::SVGFontFaceElement::removedFromDocument):
+        (WebCore::SVGFontFaceElement::removeFromMappedElementSheet):
+        * svg/SVGImageElement.cpp:
+        (WebCore::SVGImageElement::collectStyleForAttribute):
+        * svg/SVGStyledElement.cpp:
+        (WebCore::SVGStyledElement::collectStyleForAttribute):
+        * svg/SVGTextContentElement.cpp:
+        (WebCore::SVGTextContentElement::collectStyleForAttribute):
+
+2012-02-21  Yury Semikhatsky  <yurys@chromium.org>
+
+        [V8] Web Inspector: set breakpoint/pause doesn't work when worker is in a tight loop
+        https://bugs.webkit.org/show_bug.cgi?id=79097
+
+        Worker script will be interrupted to dispatch all arriving inspector commands.
+        This way debugger will be operable even if worker is in a tight loop.
+
+        Reviewed by Pavel Feldman.
+
+        * bindings/js/ScriptDebugServer.h:
+        (Task):
+        (WebCore::ScriptDebugServer::Task::~Task):
+        (ScriptDebugServer):
+        * bindings/js/WorkerScriptDebugServer.cpp:
+        (WebCore::WorkerScriptDebugServer::interruptAndRunTask):
+        (WebCore):
+        * bindings/js/WorkerScriptDebugServer.h:
+        (WorkerScriptDebugServer):
+        * bindings/v8/ScriptDebugServer.cpp:
+        (WebCore::ScriptDebugServer::interruptAndRun):
+        * bindings/v8/ScriptDebugServer.h:
+        (ScriptDebugServer):
+        * bindings/v8/WorkerScriptDebugServer.cpp:
+        (WebCore::WorkerScriptDebugServer::WorkerScriptDebugServer):
+        (WebCore::WorkerScriptDebugServer::interruptAndRunTask):
+        (WebCore):
+        * bindings/v8/WorkerScriptDebugServer.h:
+        (v8):
+        (WebCore):
+        (WorkerScriptDebugServer):
+        * inspector/WorkerDebuggerAgent.cpp:
+        (WebCore::WorkerDebuggerAgent::WorkerDebuggerAgent):
+        (WebCore::WorkerDebuggerAgent::~WorkerDebuggerAgent):
+        (WebCore):
+        (WebCore::WorkerDebuggerAgent::interruptAndDispatchInspectorCommands):
+        * inspector/WorkerDebuggerAgent.h:
+        (WebCore):
+        (WorkerDebuggerAgent):
+        * workers/WorkerMessagingProxy.cpp:
+        (WebCore):
+        (WebCore::WorkerMessagingProxy::sendMessageToInspector):
+        * workers/WorkerRunLoop.cpp:
+        (WebCore::WorkerRunLoop::run):
+        (WebCore::WorkerRunLoop::runInMode):
+        * workers/WorkerRunLoop.h:
+        (WorkerRunLoop):
+
+2012-02-21  'Pavel Feldman'  <pfeldman@google.com>
+
+        Not reviewed: fixing Mac build (take 2).
+
+        * inspector/InspectorPageAgent.cpp:
+        (WebCore::InspectorPageAgent::setShowPaintRects):
+
+2012-02-21  'Pavel Feldman'  <pfeldman@google.com>
+
+        Not reviewed: fixing Mac build.
+
+        * inspector/DOMNodeHighlighter.cpp:
+        (WebCore::DOMNodeHighlighter::drawOutline):
+        * inspector/DOMNodeHighlighter.h:
+        (DOMNodeHighlighter):
+        * inspector/InspectorInstrumentation.cpp:
+        (WebCore::InspectorInstrumentation::willPaintImpl):
+        * inspector/InspectorInstrumentation.h:
+        (InspectorInstrumentation):
+        (WebCore::InspectorInstrumentation::willPaint):
+        * inspector/InspectorPageAgent.cpp:
+        (WebCore::InspectorPageAgent::InspectorPageAgent):
+        (WebCore::InspectorPageAgent::willPaint):
+        (WebCore::InspectorPageAgent::didPaint):
+        * inspector/InspectorPageAgent.h:
+
+2012-02-21  Peter Rybin  <peter.rybin@gmail.com>
+
+        Web Inspector: Switch Debugger agent to TypeBuilder
+        https://bugs.webkit.org/show_bug.cgi?id=78390
+
+        Reviewed by Vsevolod Vlasov.
+
+        Client code is switched to TypeBuilder.
+
+        * inspector/CodeGeneratorInspector.py:
+        * inspector/InjectedScript.cpp:
+        (WebCore::InjectedScript::evaluateOnCallFrame):
+        (WebCore::InjectedScript::getFunctionDetails):
+        (WebCore::InjectedScript::getProperties):
+        (WebCore::InjectedScript::wrapCallFrames):
+        * inspector/InjectedScript.h:
+        (InjectedScript):
+        * inspector/InspectorDebuggerAgent.cpp:
+        (WebCore::InspectorDebuggerAgent::setBreakpointByUrl):
+        (WebCore::InspectorDebuggerAgent::resolveBreakpoint):
+        (WebCore::InspectorDebuggerAgent::getFunctionDetails):
+        (WebCore::InspectorDebuggerAgent::evaluateOnCallFrame):
+        (WebCore::InspectorDebuggerAgent::currentCallFrames):
+        (WebCore::InspectorDebuggerAgent::didParseSource):
+        * inspector/InspectorDebuggerAgent.h:
+        (InspectorDebuggerAgent):
+
+2012-02-21  'Pavel Feldman'  <pfeldman@google.com>
+
+        Not reviewed: fixing poor merge in r108332.
+
+        * inspector/front-end/StylesSidebarPane.js:
+        (WebInspector.StylePropertiesSection.prototype._handleSelectorClick):
+        * inspector/front-end/externs.js:
+
+2012-02-21  Alexander Pavlov  <apavlov@chromium.org>
+
+        Web Inspector: [Styles] Rule source URL tooltip should show line number
+        https://bugs.webkit.org/show_bug.cgi?id=79087
+
+        Reviewed by Pavel Feldman.
+
+        * inspector/front-end/StylesSidebarPane.js:
+        (WebInspector.StylePropertiesSection):
+        (WebInspector.StylePropertiesSection.prototype._createRuleOriginNode):
+
+2012-02-21  Pavel Feldman  <pfeldman@chomium.org>
+
+        Web Inspector: clicking empty space should not re-enter edit mode
+        https://bugs.webkit.org/show_bug.cgi?id=79024
+
+        Reviewed by Vsevolod Vlasov.
+
+        * inspector/front-end/StylesSidebarPane.js:
+        (WebInspector.StylePropertiesSection):
+        (WebInspector.StylePropertiesSection.prototype._handleEmptySpaceMouseDown):
+        (WebInspector.StylePropertiesSection.prototype._handleEmptySpaceClick):
+
+2012-02-21  Pavel Feldman  <pfeldman@chomium.org>
+
+        Web Inspector: evaluate on hover does not work for large files.
+        https://bugs.webkit.org/show_bug.cgi?id=79015
+
+        Reviewed by Yury Semikhatsky.
+
+        * inspector/front-end/JavaScriptSourceFrame.js:
+        (WebInspector.JavaScriptSourceFrame.prototype._getPopoverAnchor):
+        (WebInspector.JavaScriptSourceFrame.prototype._highlightExpression):
+        * inspector/front-end/Popover.js:
+        (WebInspector.PopoverHelper.prototype._handleMouseAction):
+        * inspector/front-end/SourceJavaScriptTokenizer.js:
+        (WebInspector.SourceJavaScriptTokenizer):
+        (WebInspector.SourceJavaScriptTokenizer.prototype.nextToken):
+        * inspector/front-end/SourceJavaScriptTokenizer.re2js:
+
+2012-02-21  Pavel Feldman  <pfeldman@google.com>
+
+        Web Inspector: add "show paint rectangles" setting.
+        https://bugs.webkit.org/show_bug.cgi?id=79030
+
+        Reviewed by Yury Semikhatsky.
+
+        * English.lproj/localizedStrings.js:
+        * inspector/DOMNodeHighlighter.cpp:
+        (WebCore::DOMNodeHighlighter::drawOutline):
+        (DOMNodeHighlighter):
+        * inspector/DOMNodeHighlighter.h:
+        (WebCore):
+        (DOMNodeHighlighter):
+        * inspector/Inspector.json:
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::InspectorController):
+        * inspector/InspectorInstrumentation.cpp:
+        (WebCore::InspectorInstrumentation::willPaintImpl):
+        (WebCore::InspectorInstrumentation::didPaintImpl):
+        * inspector/InspectorInstrumentation.h:
+        (WebCore):
+        (InspectorInstrumentation):
+        (WebCore::InspectorInstrumentation::willPaint):
+        * inspector/InspectorPageAgent.cpp:
+        (PageAgentState):
+        (WebCore::InspectorPageAgent::create):
+        (WebCore::InspectorPageAgent::InspectorPageAgent):
+        (WebCore::InspectorPageAgent::setShowPaintRects):
+        (WebCore):
+        (WebCore::InspectorPageAgent::didClearWindowObjectInWorld):
+        (WebCore::InspectorPageAgent::willPaint):
+        (WebCore::InspectorPageAgent::didPaint):
+        (WebCore::InspectorPageAgent::buildObjectForFrame):
+        * inspector/InspectorPageAgent.h:
+        (WebCore):
+        * inspector/front-end/Settings.js:
+        (WebInspector.Settings):
+        * inspector/front-end/SettingsScreen.js:
+        (WebInspector.SettingsScreen):
+        (WebInspector.SettingsScreen.prototype._showPaintRectsChanged):
+        * inspector/front-end/inspector.js:
+        * page/FrameView.cpp:
+        (WebCore::FrameView::paintContents):
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::paintContents):
+
+2012-02-21  Andras Becsi  <andras.becsi@nokia.com>
+
+        [Qt] Clean-up project file after r108310
+
+        Reviewed by Csaba Osztrogonác.
+
+        No new tests needed.
+
+        * Target.pri: Fix path for TextTrack headers.
+
+2012-02-17  Philippe Normand  <pnormand@igalia.com>
+
+        [GStreamer] media/W3C failures
+        https://bugs.webkit.org/show_bug.cgi?id=75078
+
+        Reviewed by Martin Robinson.
+
+        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::MediaPlayerPrivateGStreamer::load): Clean out everything
+        after file:// url path to cope with media/W3C tests loading
+        file:///path/to/media.ext?some parameters.
+
+2012-02-21  Matt Lilek  <mrl@apple.com>
+
+        Not reviewed, build fix for non-client-based Geolocation builds after r107982.
+
+        * page/Geolocation.cpp:
+
+2012-02-21  Yury Semikhatsky  <yurys@chromium.org>
+
+        [V8] Web Inspector: simplify worker debugger implementation
+        https://bugs.webkit.org/show_bug.cgi?id=79085
+
+        There is one instance of WorkerScriptDebugServer per worker thread. We don't
+        need to resolve WorkerContext from V8::Context anymore.
+
+        Reviewed by Pavel Feldman.
+
+        * bindings/v8/WorkerScriptDebugServer.cpp:
+        (WebCore::WorkerScriptDebugServer::WorkerScriptDebugServer):
+        (WebCore::WorkerScriptDebugServer::addListener):
+        (WebCore::WorkerScriptDebugServer::removeListener):
+        (WebCore::WorkerScriptDebugServer::getDebugListenerForContext):
+        (WebCore::WorkerScriptDebugServer::runMessageLoopOnPause):
+        * bindings/v8/WorkerScriptDebugServer.h:
+        (WorkerScriptDebugServer):
+        * inspector/WorkerDebuggerAgent.cpp:
+        (WebCore::WorkerDebuggerAgent::WorkerDebuggerAgent):
+        (WebCore::WorkerDebuggerAgent::startListeningScriptDebugServer):
+        (WebCore::WorkerDebuggerAgent::stopListeningScriptDebugServer):
+
+2012-02-21  Kentaro Hara  <haraken@chromium.org>
+
+        Enable the IDL attribute checker in Chromium
+        https://bugs.webkit.org/show_bug.cgi?id=79082
+
+        Reviewed by Adam Barth.
+
+        We have fixed 10~ bugs caused by typos of IDL attributes.
+        This patch adds an IDL attribute checker, which checks if all IDL attributes
+        used in IDL files are implemented by code generators.
+
+            - The IDL attribute checker uses IDLAttributes.txt, which lists all
+              IDL attributes implemented in code generators. If we want to add
+              a new IDL attribute, we need to add it to IDLAttributes.txt manually.
+            - The IDL attribute checker checks if all IDL attributes used in IDL files
+              are listed in IDLAttributes.txt.
+            - If the IDL attribute checker fails, the build fails with a verbose error message.
+
+        No tests. I manually checked that [Custommm], [CallWith=],
+        [CallWith=ScriptExecutionContext|Foo] cause build failures.
+
+        * WebCore.gyp/WebCore.gyp: Modified to enable the IDL attribute checker.
+
+        * bindings/scripts/resolve-supplemental.pl:
+        (loadIDLAttributes): This method loads a list of IDL attributes from IDLAttributes.txt.
+        (checkIDLAttributes): This method implementes the IDL attribute checker as described above.
+        (checkIfIDLAttributesExists):
+
+        * bindings/scripts/IDLParser.pm: "1" is not good to represent that
+        the IDL attribute does not have any value. This patch changed it to "VALUE_IS_MISSING".
+        (parseExtendedAttributes):
+        (ParseInterface):
+        * bindings/scripts/CodeGenerator.pm: Ditto.
+        (ContentAttributeName):
+        * bindings/scripts/CodeGeneratorV8.pm: Ditto.
+        (GenerateNormalAttrGetter):
+        (GenerateNormalAttrSetter):
+        (GenerateSingleBatchedAttribute):
+        (GetRuntimeEnableFunctionName):
+        * bindings/scripts/IDLAttributes.txt: Added. This file lists all IDL attributes implemented
+        in code generators.
+
+2012-02-21  Patrick Gansterer  <paroga@webkit.org>
+
+        Use Win32 API to get file information
+        https://bugs.webkit.org/show_bug.cgi?id=55336
+
+        Reviewed by Adam Roben.
+
+        Use FindFirstFile() in favour over _wstat64() to share the code with WinCE.
+
+        * platform/win/FileSystemWin.cpp:
+        (WebCore):
+        (WebCore::getFindData):
+        (WebCore::getFileSize):
+        (WebCore::getFileModificationTime):
+        (WebCore::fileExists):
+
+2012-02-20  Adam Barth  <abarth@webkit.org>
+
+        Invalid cast in WebCore::toElement / WebCore::HTMLElementStack::ElementRecord::element
+        https://bugs.webkit.org/show_bug.cgi?id=78975
+
+        Reviewed by Eric Seidel.
+
+        We're supposed to set the action attribute on the form element we just
+        created.  Previously, we assumed the newly created form element would
+        be on the top of the stack of open elements, but if we're in the table
+        body insertion mode, the form element gets treated as self closing and
+        is therefore popped off the stack of open elements.
+
+        Fortunately, we already cache a pointer to the most recently inserted
+        form element on the HTMLConstructionSite, so we can just grab the
+        element from there.
+
+        Test: html5lib/runner.html
+
+        * html/parser/HTMLTreeBuilder.cpp:
+        (WebCore::HTMLTreeBuilder::processIsindexStartTagForInBody):
+        (WebCore):
+
+2012-02-20  Adam Barth  <abarth@webkit.org>
+
+        Unite TextTrack-related files with their friends in WebCore/html/track
+        https://bugs.webkit.org/show_bug.cgi?id=78941
+
+        Reviewed by Eric Seidel.
+
+        The code that supports <track> seems to be split between the
+        WebCore/html directory and the WebCore/html/track directory.  This
+        patch unites this code in the WebCore/html/track directory.
+
+        * CMakeLists.txt:
+        * DerivedSources.make:
+        * DerivedSources.pri:
+        * GNUmakefile.list.am:
+        * WebCore.gypi:
+        * WebCore.xcodeproj/project.pbxproj:
+        * html/LoadableTextTrack.cpp: Removed.
+        * html/LoadableTextTrack.h: Removed.
+        * html/TextTrack.cpp: Removed.
+        * html/TextTrack.h: Removed.
+        * html/TextTrack.idl: Removed.
+        * html/TextTrackCue.cpp: Removed.
+        * html/TextTrackCue.h: Removed.
+        * html/TextTrackCue.idl: Removed.
+        * html/TextTrackCueList.cpp: Removed.
+        * html/TextTrackCueList.h: Removed.
+        * html/TextTrackCueList.idl: Removed.
+        * html/track/LoadableTextTrack.cpp: Copied from Source/WebCore/html/LoadableTextTrack.cpp.
+        * html/track/LoadableTextTrack.h: Copied from Source/WebCore/html/LoadableTextTrack.h.
+        * html/track/TextTrack.cpp: Copied from Source/WebCore/html/TextTrack.cpp.
+        * html/track/TextTrack.h: Copied from Source/WebCore/html/TextTrack.h.
+        * html/track/TextTrack.idl: Copied from Source/WebCore/html/TextTrack.idl.
+        * html/track/TextTrackCue.cpp: Copied from Source/WebCore/html/TextTrackCue.cpp.
+        * html/track/TextTrackCue.h: Copied from Source/WebCore/html/TextTrackCue.h.
+        * html/track/TextTrackCue.idl: Copied from Source/WebCore/html/TextTrackCue.idl.
+        * html/track/TextTrackCueList.cpp: Copied from Source/WebCore/html/TextTrackCueList.cpp.
+        * html/track/TextTrackCueList.h: Copied from Source/WebCore/html/TextTrackCueList.h.
+        * html/track/TextTrackCueList.idl: Copied from Source/WebCore/html/TextTrackCueList.idl.
+
+2012-02-20  Filip Pizlo  <fpizlo@apple.com>
+
+        JSC should be a triple-tier VM
+        https://bugs.webkit.org/show_bug.cgi?id=75812
+        <rdar://problem/10079694>
+
+        Reviewed by Gavin Barraclough.
+        
+        No new tests, because there is no change in behavior.
+
+        * CMakeLists.txt:
+
+2012-02-20  Benjamin Poulain  <benjamin@webkit.org>
+
+        Get rid of the LocalizationStrategy
+        https://bugs.webkit.org/show_bug.cgi?id=78324
+
+        Reviewed by Sam Weinig.
+
+        Remove LocalizationStrategy and unify the localization behind
+        LocalizedStrings.h and LocalizedStrings.cpp.
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * Target.pri:
+        * WebCore.exp.in:
+        * WebCore.gypi:
+        * WebCore.order:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * platform/DefaultLocalizationStrategy.cpp: Removed.
+        * platform/DefaultLocalizationStrategy.h: Removed.
+        * platform/LocalizationStrategy.h: Removed.
+        * platform/LocalizedStrings.cpp:
+        * platform/LocalizedStrings.h:
+        (WebCore):
+        * platform/PlatformStrategies.cpp:
+        * platform/PlatformStrategies.h:
+        (WebCore):
+        (WebCore::PlatformStrategies::PlatformStrategies):
+        (PlatformStrategies):
+        * platform/qt/LocalizedStringsQt.cpp: Copied from Source/WebKit/qt/WebCoreSupport/PlatformStrategiesQt.cpp.
+
+2012-02-20  Kentaro Hara  <haraken@chromium.org>
+
+        Remove [TreatReturnedNullStringAsNull] from HTMLMediaElement.mediaGroup
+        https://bugs.webkit.org/show_bug.cgi?id=79064
+
+        Reviewed by Hajime Morita.
+
+        [TreatReturnedNullStringAsNull] is a typo of [TreatReturnedNullStringAs=Null].
+        But as far as I read the spec
+        (http://www.whatwg.org/specs/web-apps/current-work/multipage/the-video-element.html#attr-media-mediagroup),
+        there is no statement about what value should be returned when HTMLMediaElement.mediaGroup
+        is not yet initialized. In particular, there is no statement that says "null should
+        be returned when HTMLMediaElement.mediaGroup is not initialized". Thus, instead of
+        fixing the typo, just removing [TreatReturnedNullStringAsNull] would make sense.
+        Removing [TreatReturnedNullStringAsNull] does not change the current behavior.
+
+        Test: media/media-controller.html (No change in the test results.)
+
+        * html/HTMLMediaElement.idl:
+
+2012-02-20  Hayato Ito  <hayato@chromium.org>
+
+        Use InsertinonPoint instead of HTMLContentElement.
+        https://bugs.webkit.org/show_bug.cgi?id=78778
+
+        Reviewed by Hajime Morita.
+
+        Replace HTMLContentElement with InsertionPoint in NodeRenderingContext and HTMLContentSelection.
+        This is one of followup patches for r108207.
+
+        No new tests, no change in behavior.
+
+        * dom/NodeRenderingContext.cpp:
+        (WebCore::nextRendererOf):
+        (WebCore::previousRendererOf):
+        (WebCore::firstRendererOf):
+        (WebCore::lastRendererOf):
+        * dom/NodeRenderingContext.h:
+        (WebCore):
+        (NodeRenderingContext):
+        (WebCore::NodeRenderingContext::insertionPoint):
+        * dom/ShadowRoot.cpp:
+        (WebCore::ShadowRoot::insertionPointFor):
+        * dom/ShadowRoot.h:
+        (WebCore):
+        * html/shadow/HTMLContentElement.cpp:
+        (WebCore::HTMLContentElement::HTMLContentElement):
+        (WebCore::HTMLContentElement::attach):
+        (WebCore::HTMLContentElement::detach):
+        * html/shadow/HTMLContentElement.h:
+        (HTMLContentElement):
+        * html/shadow/HTMLContentSelector.cpp:
+        (WebCore::HTMLContentSelector::select):
+        * html/shadow/HTMLContentSelector.h:
+        (WebCore):
+        (HTMLContentSelection):
+        (WebCore::HTMLContentSelection::insertionPoint):
+        (WebCore::HTMLContentSelection::HTMLContentSelection):
+        (WebCore::HTMLContentSelection::create):
+        * html/shadow/InsertionPoint.cpp:
+        (WebCore::InsertionPoint::InsertionPoint):
+        * html/shadow/InsertionPoint.h:
+        (WebCore::InsertionPoint::selections):
+        (WebCore::InsertionPoint::hasSelection):
+        (InsertionPoint):
+
+2012-02-20  David Barton  <dbarton@mathscribe.com>
+
+        MathML internals - code clean-up for RenderMathMLSubSup
+        https://bugs.webkit.org/show_bug.cgi?id=79063
+
+        Reviewed by Eric Seidel.
+
+        In the next patch, I will shrink and revise the <msubsup> formatting code. To make this
+        easier to follow, I am first doing some simple code clean-up.
+
+        No new tests.
+
+        * rendering/mathml/RenderMathMLRow.cpp:
+        (WebCore::RenderMathMLRow::layout):
+        * rendering/mathml/RenderMathMLRow.h:
+        (WebCore::RenderMathMLRow::isRenderMathMLRow):
+        * rendering/mathml/RenderMathMLSubSup.cpp:
+        (WebCore::RenderMathMLSubSup::stretchToHeight):
+        (WebCore::RenderMathMLSubSup::layout):
+            - There is no need to iterate over baseWrapper's children since it should have only
+              one child, the base of the <msubsup>.
+
+2012-02-20  Kentaro Hara  <haraken@chromium.org>
+
+        Replace [V8Custom=DOMWindowNOP] with [V8Custom]
+        https://bugs.webkit.org/show_bug.cgi?id=79062
+
+        Reviewed by Adam Barth.
+
+        [V8Custom=DOMWindowNOP] is not implemented by CodeGeneratorV8.pm.
+        This patch replaces it with [V8Custom].
+
+        No new tests. No change in behavior.
+
+        * page/DOMWindow.idl:
+
+2012-02-20  Kentaro Hara  <haraken@chromium.org>
+
+        [JSGenerateIsReachable=ImplRoot] is not implemented, it should be [JSGenerateIsReachable]
+        https://bugs.webkit.org/show_bug.cgi?id=79061
+
+        Reviewed by Adam Barth.
+
+        CSSStyleDeclaration.idl uses [JSGenerateIsReachable=ImplRoot],
+        but "ImplRoot" is not implemented in CodeGeneratorJS.pm.
+        This patch replaces [JSGenerateIsReachable=ImplRoot] with [JSGenerateIsReachable].
+
+        No tests. No change in behavior.
+
+        * css/CSSStyleDeclaration.idl:
+
+2012-02-20  Kentaro Hara  <haraken@chromium.org>
+
+        [EnabledAtRuntime] in HTMLShadowElement.idl should be [V8EnabledAtRuntime]
+        https://bugs.webkit.org/show_bug.cgi?id=79058
+
+        Reviewed by Adam Barth.
+
+        [EnabledAtRuntime] does not exist any longer. It should be [V8EnabledAtRuntime].
+
+        No tests.
+
+        * html/shadow/HTMLShadowElement.idl:
+
+2012-02-20  Kentaro Hara  <haraken@chromium.org>
+
+        Replace [Callback=FunctionOnly] with [Callback]
+        https://bugs.webkit.org/show_bug.cgi?id=79060
+
+        Reviewed by Adam Barth.
+
+        [Callback=FunctionOnly] is not implemented by any code generator.
+        This patch replaces it with [Callback].
+
+        No tests. No change in behavior.
+
+        * Modules/intents/IntentResultCallback.idl:
+        * Modules/intents/NavigatorIntents.idl:
+        * dom/RequestAnimationFrameCallback.idl:
+        * mediastream/NavigatorMediaStream.idl:
+        * mediastream/NavigatorUserMediaErrorCallback.idl:
+        * mediastream/NavigatorUserMediaSuccessCallback.idl:
+        * mediastream/PeerConnection.idl:
+        * mediastream/SignalingCallback.idl:
+        * page/PositionCallback.idl:
+        * page/PositionErrorCallback.idl:
+
+2012-02-20  Andy Chen  <andchen@rim.com>
+
+        2012-02-17  Andy Chen  <andchen@rim.com>
+
+        [BlackBerry] Need to override active/inactive text search highlight color for RenderThemeBlackBerry
+        https://bugs.webkit.org/show_bug.cgi?id=78920
+
+        Override two functions for text search highlight colors so that we can
+        provide platform specified colors.
+
+        Reviewed by Antonio Gomes.
+
+        No function change so no new tests.
+
+        * platform/blackberry/RenderThemeBlackBerry.cpp:
+        (WebCore::RenderThemeBlackBerry::platformActiveTextSearchHighlightColor):
+        (WebCore::RenderThemeBlackBerry::platformInactiveTextSearchHighlightColor):
+        * platform/blackberry/RenderThemeBlackBerry.h:
+
+2012-02-20  John Knottenbelt  <jknotten@chromium.org>
+
+        Default canvas backing store to be 1:1 with specified dimensions.
+        https://bugs.webkit.org/show_bug.cgi?id=78971
+
+        Reviewed by Adam Barth.
+
+        Although the canvas specification states that the backing image may
+        be larger than the user-specified dimensions, there are a number of
+        philip canvas tests that fail when the backing image data is not
+        1:1 with the specified canvas dimensions. These failures are
+        tracked in https://bugs.webkit.org/show_bug.cgi?id=73645
+
+        This change defaults the canvas backing store to be 1:1 with the
+        user-specified dimensions, while also providing an
+        ENABLE(HIGH_DPI_CANVAS) build option to reinstate the original
+        behaviour, so that the above bug may be more easily fixed.
+
+        * html/HTMLCanvasElement.cpp:
+        (WebCore::HTMLCanvasElement::HTMLCanvasElement):
+
+2012-02-20  Mary Wu  <mary.wu@torchmobile.com.cn>
+
+        Upstream RenderThemeBlackberry.h/.cpp into WebCore/platform/blackberry
+        https://bugs.webkit.org/show_bug.cgi?id=78785
+
+        Main Contributors:
+        Daniel Bates <dbates@rim.com>
+        Bryan Gislason <bgislason@rim.com>
+        Akash Vaswani <akvaswani@rim.com>
+        Dave Battista <dbattista@rim.com>
+        Robin Cao  <robin.cao@torchmobile.com.cn>
+        Genevieve Mak <gmak@rim.com>
+        Mike Fenton  <mifenton@rim.com>
+
+        Reviewed by Antonio Gomes.
+
+        Initial upstream, no new tests.
+
+        * platform/blackberry/RenderThemeBlackBerry.cpp: Added.
+        * platform/blackberry/RenderThemeBlackBerry.h: Added.
+
+2012-02-20  Martin Robinson  <mrobinson@igalia.com>
+
+        [GTK] [EFL] Collapse duplicate WebGL support code
+        https://bugs.webkit.org/show_bug.cgi?id=78970
+
+        Reviewed by Gustavo Noronha Silva.
+
+        No new tests. This just cleans up duplicated code.
+
+        Centralize duplicated WebGL code for EFL and GTK+ in the Cairo
+        directory. This is in preparation for the changes necessary to
+        connect WebGL to the TextureMapper AC.
+
+        * GNUmakefile.list.am: Update source list.
+        * PlatformEfl.cmake: Update source list.
+        * platform/graphics/cairo/DrawingBufferCairo.cpp: Renamed from Source/WebCore/platform/graphics/gtk/DrawingBufferGtk.cpp.
+        * platform/graphics/cairo/GraphicsContext3DCairo.cpp: Integrated the code From GraphicsContext3DGtk.cpp.
+        * platform/graphics/efl/DrawingBufferEfl.cpp: Removed.
+        * platform/graphics/efl/GraphicsContext3DEfl.cpp: Removed.
+        * platform/graphics/gtk/GraphicsContext3DGtk.cpp: Removed.
+
+2012-02-20  Martin Robinson  <mrobinson@igalia.com>
+
+        [UNIX] Plugin information fields are not interpreted as UTF-8
+        https://bugs.webkit.org/show_bug.cgi?id=78635
+
+        Reviewed by Gustavo Noronha Silva.
+
+        Interpret plugin metadata as UTF8 aways. This matches the behavior
+        of Chromium and the Totem plugin.
+
+        This is tested by a change to TestNetscapePlugin and expectations updates.
+
+        * plugins/efl/PluginPackageEfl.cpp:
+        (WebCore::PluginPackage::fetchInfo): Use String::fromUTF8.
+        * plugins/gtk/PluginPackageGtk.cpp:
+        (WebCore::PluginPackage::fetchInfo): Use String::fromUTF8.
+        * plugins/qt/PluginPackageQt.cpp:
+        (WebCore::PluginPackage::fetchInfo): Use String::fromUTF8.
+
+2012-02-20  Martin Robinson  <mrobinson@igalia.com>
+
+        [GTK] Web content oftens steals focus from other widgets
+        https://bugs.webkit.org/show_bug.cgi?id=77791
+
+        Reviewed by Gustavo Noronha Silva.
+
+        * platform/gtk/WidgetGtk.cpp:
+        (WebCore::Widget::setFocus): No longer do anything special to try
+        to grab "real" widget focus. This matches the behavior on Qt.
+        * plugins/gtk/PluginViewGtk.cpp:
+        (WebCore::PluginView::setFocus): Moved the focus handling to here.
+        This ensures that behavior for plugins does not change.
+
+2012-02-20  Yael Aharon  <yael.aharon@nokia.com>
+
+        Regression (108135) isOpaque() returns uninitialized variable.
+        https://bugs.webkit.org/show_bug.cgi?id=79049
+
+        Reviewed by Noam Rosenthal.
+
+        isOpaque() should use the new m_flags instead of the old m_isOpaque.
+        No new tests. No new functionality.
+
+        * platform/graphics/texmap/TextureMapper.h:
+        (WebCore::BitmapTexture::reset):
+        (WebCore::BitmapTexture::isOpaque):
+        (BitmapTexture):
+
+2012-02-20  Kentaro Hara  <haraken@chromium.org>
+
+        Unreviewed. Rebaselined run-bindings-tests results.
+
+        * bindings/scripts/test/CPP/WebDOMTestInterface.cpp:
+        * bindings/scripts/test/CPP/WebDOMTestInterface.h:
+        * bindings/scripts/test/CPP/WebDOMTestObj.cpp:
+        * bindings/scripts/test/CPP/WebDOMTestObj.h:
+
+2012-02-20  No'am Rosenthal  <noam.rosenthal@nokia.com>
+
+        [Qt][WK2] Clipping is broken
+        https://bugs.webkit.org/show_bug.cgi?id=78677
+
+        It's not necessary to add a full-viewport rect to the scissor clip stack.
+        It creates a situation where if there's a clip in the page, we return to
+        the viewport clip instead of applying the WebView's clip we got from the
+        scenegraph.
+
+        Also, it's unnecessary to clip before we paint the layer's content, we should
+        only clip afterwards, before painting the children. 
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        No new functionality.
+
+        * platform/graphics/opengl/TextureMapperGL.cpp:
+        (WebCore::BitmapTextureGL::size):
+        (WebCore::scissorClip):
+        (WebCore):
+        (WebCore::TextureMapperGL::beginScissorClip):
+        (WebCore::TextureMapperGL::endScissorClip):
+        * platform/graphics/texmap/TextureMapperLayer.cpp:
+        (WebCore::TextureMapperLayer::paintSelfAndChildren):
+
+2012-02-20  No'am Rosenthal  <noam.rosenthal@nokia.com>
+
+        [Texmap] Layers and tiles appear to have missing pixels in their right/bottom borders
+        https://bugs.webkit.org/show_bug.cgi?id=78961
+
+        The relativeSize member should point to one pixel before the edge, since it's used
+        by glVertexAttribPointer, which takes edge points and not sizes.
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        No new funcionality.
+
+        * platform/graphics/opengl/TextureMapperGL.cpp:
+        (WebCore::BitmapTextureGL::didReset):
+
+2012-02-20  Kihong Kwon  <kihong.kwon@samsung.com>
+
+        Add a new API for the Vibration API(W3C).
+        https://bugs.webkit.org/show_bug.cgi?id=72010
+
+        http://dev.w3.org/2009/dap/vibration/
+        This patch implements navigator.webkitvibrate() API.
+        This API operates differently depending upon a given parameter:
+        1. It cancels vibration when given 0 or [].
+        2. It gives a vibration duration in milliseconds when given as a single integer value.
+        3. It gives a vibration pattern when given as an integer array. For instance, [1000 300 1000] generates a vibration of 1000ms followed by 300ms of idle time, and then creates another vibration of 1000ms.
+
+        Reviewed by Hajime Morita.
+
+        Test: fast/dom/navigator-vibration.html
+
+        * CMakeLists.txt:
+        * Modules/vibration/NavigatorVibration.cpp: Added.
+        (WebCore):
+        (WebCore::NavigatorVibration::NavigatorVibration):
+        (WebCore::NavigatorVibration::~NavigatorVibration):
+        (WebCore::NavigatorVibration::webkitVibrate):
+        Add webkitVibrate method to get an array or single integer parameter for vibrating.
+        They check vibration is activated in the platform, and then call vibrate() in the Vibration class.
+        * Modules/vibration/NavigatorVibration.h: Added.
+        (WebCore):
+        (NavigatorVibration):
+        * Modules/vibration/NavigatorVibration.idl: Added.
+        * Modules/vibration/Vibration.cpp: Added.
+        This class implements the entire vibration logic.
+        (WebCore):
+        (WebCore::Vibration::Vibration):
+        (WebCore::Vibration::~Vibration):
+        (WebCore::Vibration::create):
+        (WebCore::Vibration::vibrate):
+        (WebCore::Vibration::cancelVibration):
+        (WebCore::Vibration::suspendVibration):
+        (WebCore::Vibration::resumeVibration):
+        (WebCore::Vibration::timerStartFired):
+        (WebCore::Vibration::timerStopFired):
+        (WebCore::Vibration::supplementName):
+        (WebCore::Vibration::isActive):
+        (WebCore::provideVibrationTo):
+        * Modules/vibration/Vibration.h: Added.
+        (WebCore):
+        (Vibration):
+        (WebCore::Vibration::from):
+        * Modules/vibration/VibrationClient.h: Added.
+        vibrate() and cancelVibrate() need to be implemented in the VibrationClient.
+        (WebCore):
+        (VibrationClient):
+        (WebCore::VibrationClient::~VibrationClient):
+
+2012-02-20  Yuta Kitamura  <yutak@chromium.org>
+
+        Unreviewed, rolling out r108263.
+        http://trac.webkit.org/changeset/108263
+        https://bugs.webkit.org/show_bug.cgi?id=77856
+
+        Broke Chromium Windows build.
+
+        * platform/audio/DynamicsCompressor.cpp:
+        (WebCore::DynamicsCompressor::DynamicsCompressor):
+        (WebCore::DynamicsCompressor::setEmphasisStageParameters):
+        (WebCore::DynamicsCompressor::process):
+        (WebCore::DynamicsCompressor::reset):
+        * platform/audio/DynamicsCompressor.h:
+        (WebCore::DynamicsCompressor::isStereo):
+        (DynamicsCompressor):
+        * platform/audio/DynamicsCompressorKernel.cpp:
+        (WebCore::DynamicsCompressorKernel::DynamicsCompressorKernel):
+        (WebCore::DynamicsCompressorKernel::setPreDelayTime):
+        (WebCore::DynamicsCompressorKernel::process):
+        (WebCore::DynamicsCompressorKernel::reset):
+        * platform/audio/DynamicsCompressorKernel.h:
+        (DynamicsCompressorKernel):
+        * webaudio/DynamicsCompressorNode.cpp:
+        (WebCore::DynamicsCompressorNode::DynamicsCompressorNode):
+        (WebCore::DynamicsCompressorNode::initialize):
+
+2012-02-20  Raymond Liu  <raymond.liu@intel.com>
+
+        Have the DynamicsCompressorNode support multi-channel data
+        https://bugs.webkit.org/show_bug.cgi?id=77856
+
+        Reviewed by Chris Rogers.
+
+        * platform/audio/DynamicsCompressor.cpp:
+        (WebCore::DynamicsCompressor::DynamicsCompressor):
+        (WebCore::DynamicsCompressor::setEmphasisStageParameters):
+        (WebCore::DynamicsCompressor::process):
+        (WebCore::DynamicsCompressor::reset):
+        (WebCore::DynamicsCompressor::setNumberOfChannels):
+        (WebCore):
+        * platform/audio/DynamicsCompressor.h:
+        (DynamicsCompressor):
+        * platform/audio/DynamicsCompressorKernel.cpp:
+        (WebCore::DynamicsCompressorKernel::DynamicsCompressorKernel):
+        (WebCore::DynamicsCompressorKernel::setNumberOfChannels):
+        (WebCore):
+        (WebCore::DynamicsCompressorKernel::setPreDelayTime):
+        (WebCore::DynamicsCompressorKernel::process):
+        (WebCore::DynamicsCompressorKernel::reset):
+        * platform/audio/DynamicsCompressorKernel.h:
+        (DynamicsCompressorKernel):
+        * webaudio/DynamicsCompressorNode.cpp:
+        (WebCore::DynamicsCompressorNode::DynamicsCompressorNode):
+        (WebCore::DynamicsCompressorNode::initialize):
+
+2012-02-20  David Barton  <dbarton@mathscribe.com>
+
+        RenderMathMLRow::baselinePosition() only if linePositionMode == PositionOnContainingLine
+        https://bugs.webkit.org/show_bug.cgi?id=79039
+
+        Reviewed by Eric Seidel.
+
+        RenderMathMLRow::baselinePosition() is actually unnecessary, but I am deleting it in two
+        steps. First we add a guard to restrict it to the intended PositionOnContainingLine
+        case, leaving PositionOfInteriorLineBoxes to a superclass, RenderBlock. This removes
+        some randomness, and tightens up the results of four existing test files.
+
+        Test: mathml/presentation/row.xhtml, fenced.xhtml, mo.xhtml, and mo-stretch.html
+
+        * rendering/mathml/RenderMathMLRow.cpp:
+        (WebCore::RenderMathMLRow::baselinePosition):
+
+2012-02-18  Jon Lee  <jonlee@apple.com>
+
+        HTML input file control "No File Selected" needs more room in some languages
+        https://bugs.webkit.org/show_bug.cgi?id=32366
+        <rdar://problem/4481028>
+
+        Reviewed by David Hyatt.
+
+        The patch exposes a function to return the "no file(s) selected" label text.
+
+        * rendering/RenderTheme.cpp:
+        (WebCore::RenderTheme::fileListDefaultLabel): Added to expose the text for the label in
+        file upload controls when nothing has been selected.
+        (WebCore::RenderTheme::fileListNameForWidth): Refactor to use fileListDefaultLabel().
+        * rendering/RenderTheme.h: Change fileListNameForWidth() to be a const function.
+
+        * rendering/RenderThemeMac.h: Update fileListNameForWidth() to be a const function for
+        platform implementations.
+        * rendering/RenderThemeMac.mm:
+        (WebCore::RenderThemeMac::fileListNameForWidth): Refactor to use fileListDefaultLabel().
+
+        Update fileListNameForWidth() to be a const function for platform implementations.
+        * platform/gtk/RenderThemeGtk.h:
+        * platform/gtk/RenderThemeGtk.cpp:
+        * platform/qt/RenderThemeQt.h:
+        * platform/qt/RenderThemeQt.cpp:
+
+        * rendering/RenderFileUploadControl.cpp:
+        (WebCore::RenderFileUploadControl::computePreferredLogicalWidths): Change the calculation
+        of the max preferred logical width. Calculate the length of the "no file(s) selected" text,
+        and include the button and after-button margin. Take the max of that and the original
+        default width, which was a string of 34 (defaultWidthNumChars) "0"'s, in the case that the
+        label text is too short.
+
+2012-02-20  Gavin Barraclough  <barraclough@apple.com>
+
+        Rubber stamped by Sam Weinig.
+
+        * bindings/js/JSDOMWindowBase.cpp:
+        (WebCore::JSDOMWindowBase::allowsAccessFrom):
+            - Errk, remove dead code from end of function.
+
+2012-02-16  Gavin Barraclough  <barraclough@apple.com>
+
+        Move special __proto__ property to Object.prototype
+        https://bugs.webkit.org/show_bug.cgi?id=78409
+
+        Reviewed by Oliver Hunt.
+
+        Re-implement this as a regular accessor property.  This has three key benefits:
+        1) It makes it possible for objects to be given properties named __proto__.
+        2) Object.prototype.__proto__ can be deleted, preventing object prototypes from being changed.
+        3) This largely removes the magic used the implement __proto__, it can just be made a regular accessor property.
+
+        * bindings/js/JSDOMWindowBase.cpp:
+        (WebCore::JSDOMWindowBase::allowsAccessFrom):
+        (WebCore):
+            - expose allowsAccessFrom check to JSC.
+        * bindings/js/JSDOMWindowBase.h:
+        (JSDOMWindowBase):
+            - expose allowsAccessFrom check to JSC.
+
+2012-02-20  Benjamin Poulain  <benjamin@webkit.org>
+
+        Make JSCSSStyleDeclaration work directly with CSS Property ID
+        https://bugs.webkit.org/show_bug.cgi?id=79014
+
+        Reviewed by Geoffrey Garen.
+
+        Previously, accessing the CSS property was done by converting from
+        the JavaScript name to the CSS name, then converting that name to a lowercase
+        character array, and finally getting the CSS property ID.
+
+        This patch cut the indirection and make the code go directly from the
+        JavaScript name conversion to the CSS property ID.
+
+        This improves the performance mainly due to the following:
+        -avoid dynamic memory allocation
+        -cut the conversion early when possible
+        -do not parse the string twice
+        The previous fast-path optimization was removed because it is no longer
+        necessary with this change.
+
+        The improvement are the following:
+        -previous fast-path: no change
+        -previous slow-path: ~3 times faster
+
+        Test: fast/dom/CSSStyleDeclaration/access-longest-css-property.html
+        This just test the edge case of CSSPropertyName.
+
+        * bindings/js/JSCSSStyleDeclarationCustom.cpp:
+        (WebCore::writeWebKitPrefix):
+        (WebCore::writeEpubPrefix):
+        (WebCore::cssPropertyIDForJSCSSPropertyName):
+        (WebCore::isCSSPropertyName):
+        (WebCore::JSCSSStyleDeclaration::nameGetter):
+        (WebCore::JSCSSStyleDeclaration::putDelegate):
+        * css/CSSParser.cpp:
+        (WebCore::cssPropertyID):
+        (WebCore):
+        (WebCore::cssPropertyNameIOSAliasing):
+        * css/CSSParser.h:
+        (WebCore):
+
+2012-02-20  Dan Bernstein  <mitz@apple.com>
+
+        Updated Localizable.strings after r107440.
+
+        Rubber-stamped by Joseph Pecoraro.
+
+        * English.lproj/Localizable.strings:
+
+2012-02-20  David Barton  <dbarton@mathscribe.com>
+
+        MathML internals - remove nonOperatorHeight(), hasBase()
+        https://bugs.webkit.org/show_bug.cgi?id=78977
+
+        Reviewed by Eric Seidel.
+
+        Stretchy operators, including embellished ones, should stretch to the largest height of
+        the non-stretchy items in the same explicit or implicit <mrow>.
+        RenderMathMLRow::layout() used to use hasBase(), isRenderMathMLOperator(), and
+        nonOperatorHeight() to approximate this height. We now use unembellishedOperator() to
+        improve this approximation, while also simplifying the code. More plainly, the code used
+        to skip all operators when estimating this height, instead of just the stretchy ones. We
+        continue to do that for now, but we more accurately skip all embellished operators
+        (using our currently implemented approximate definition of this), and use the simple and
+        true height of the remaining items. In case all items in the row are stretchy,
+        style()->fontSize() is better than using whatever heights these items currently happen
+        to be stretched to.
+
+        Test: mathml/presentation/mo-stretch.html, and many existing tests
+
+        * rendering/mathml/RenderMathMLBlock.cpp:
+        (WebCore):
+        * rendering/mathml/RenderMathMLBlock.h:
+        (WebCore::RenderMathMLBlock::unembellishedOperator):
+        * rendering/mathml/RenderMathMLRow.cpp:
+        (WebCore):
+        (WebCore::RenderMathMLRow::layout):
+        * rendering/mathml/RenderMathMLRow.h:
+        (WebCore::RenderMathMLRow::isRenderMathMLRow):
+        * rendering/mathml/RenderMathMLSubSup.cpp:
+        (WebCore):
+        * rendering/mathml/RenderMathMLSubSup.h:
+        (RenderMathMLSubSup):
+        * rendering/mathml/RenderMathMLUnderOver.cpp:
+        (WebCore):
+        * rendering/mathml/RenderMathMLUnderOver.h:
+        (RenderMathMLUnderOver):
+
+2012-02-17  Anders Carlsson  <andersca@apple.com>
+
+        Stop the committer timer when the page is destroyed
+        https://bugs.webkit.org/show_bug.cgi?id=78907
+
+        Reviewed by Adam Roben.
+
+        We don't want the committer timer to fire after the scrolling tree has been invalidated,
+        so stop the committer timer to prevent it from firing and trying to access the scrolling tree.
+
+        * page/scrolling/ScrollingCoordinator.cpp:
+        (WebCore::ScrollingCoordinator::pageDestroyed):
+
+2012-02-20  Patrick Gansterer  <paroga@webkit.org>
+
+        [WIN] Allow compiling FileSystem without CoreFoundation.
+        https://bugs.webkit.org/show_bug.cgi?id=79032
+
+        Reviewed by Adam Roben.
+
+        Add #if USE(CF) around code using the CoreFoundation functions.
+
+        * platform/FileSystem.h:
+        * platform/win/FileSystemWin.cpp:
+
+2012-02-20  Robin Cao  <robin.cao@torchmobile.com.cn>
+
+        [BlackBerry] Upstream the first few files in platform/graphics/blackberry
+        https://bugs.webkit.org/show_bug.cgi?id=79023
+
+        Reviewed by Antonio Gomes.
+
+        Initial upstreaming, no new tests.
+
+        * platform/graphics/blackberry/FloatPointBlackBerry.cpp: Added.
+        (WebCore):
+        (WebCore::FloatPoint::FloatPoint):
+        (WebCore::FloatPoint::operator BlackBerry::Platform::FloatPoint):
+        * platform/graphics/blackberry/FloatRectBlackBerry.cpp: Added.
+        (WebCore):
+        (WebCore::FloatRect::FloatRect):
+        (WebCore::FloatRect::operator BlackBerry::Platform::FloatRect):
+        * platform/graphics/blackberry/FloatSizeBlackBerry.cpp: Added.
+        (WebCore):
+        (WebCore::FloatSize::FloatSize):
+        (WebCore::FloatSize::operator BlackBerry::Platform::FloatSize):
+        * platform/graphics/blackberry/IntPointBlackBerry.cpp: Added.
+        (WebCore):
+        (WebCore::IntPoint::IntPoint):
+        (WebCore::IntPoint::operator BlackBerry::Platform::IntPoint):
+        * platform/graphics/blackberry/IntRectBlackBerry.cpp: Added.
+        (WebCore):
+        (WebCore::IntRect::IntRect):
+        (WebCore::IntRect::operator BlackBerry::Platform::IntRect):
+        * platform/graphics/blackberry/IntSizeBlackBerry.cpp: Added.
+        (WebCore):
+        (WebCore::IntSize::IntSize):
+        (WebCore::IntSize::operator BlackBerry::Platform::IntSize):
+
+2012-02-20  Patrick Gansterer  <paroga@webkit.org>
+
+        [WIN] Share openTemporaryFile with WinCE
+        https://bugs.webkit.org/show_bug.cgi?id=58750
+
+        Reviewed by Adam Roben.
+
+        Use pathByAppendingComponent instead of PathCombine to share the
+        code with WinCE. Also use the wide version of Windows functions.
+
+        * platform/win/FileSystemWin.cpp:
+        (WebCore::openTemporaryFile):
+
+2012-02-20  Victor Carbune  <victor@rosedu.org>
+
+        Added code to support dispatching of missed cues in case of normal playback
+        and event sorting in case of simultaneous event triggering.
+
+        <track>-related events cuechange, enter, and exit should be sorted and filtered before dispatching
+        https://bugs.webkit.org/show_bug.cgi?id=72171
+
+        Reviewed by Eric Carlson.
+
+        Tests: media/track/track-cues-missed.html
+               media/track/track-cues-sorted-before-dispatch.html
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::HTMLMediaElement): Added initialization code
+        for newly added state variables.
+        (WebCore::trackIndexCompare): Static boolean compare function between
+        the index of two tracks.
+        (WebCore):
+        (WebCore::eventTimeCueCompare): Static boolean compare function between
+        events associated with text track cues.
+        (WebCore::HTMLMediaElement::updateActiveTextTrackCues): Added code to
+        sort the events associated with text track cues before dispatching.
+        Each step from the specification is commented within the code.
+        (WebCore::HTMLMediaElement::finishSeek): Added a boolean variable that
+        is needed within the text track update function, to know whether a seek
+        event has occured before or not.
+        (WebCore::HTMLMediaElement::mediaPlayerTimeChanged): Moved the update
+        call for text tracks at the beginning of the function instead of the end.
+        'ended' events for video should be dispatched after track specific events.
+        * html/HTMLMediaElement.h: Added variables to keep
+        state information required by the text track update algorithm (last time
+        the algorithm was run, and whether a seeking event has occured)
+        (HTMLMediaElement):
+
+        * html/LoadableTextTrack.cpp: Refactored fireCueChangeEvent method
+        (WebCore::LoadableTextTrack::fireCueChangeEvent): The method dispatches a
+        synchronous cue change event for the track element.
+        * html/LoadableTextTrack.h:
+        (LoadableTextTrack):
+        * html/TextTrack.cpp: Modified the fireCueChange method, cached track index.
+        (WebCore::TextTrack::TextTrack):
+        (WebCore::TextTrack::trackIndex): Cached the track index.
+        (WebCore):
+        (WebCore::TextTrack::invalidateTrackIndex): Invalidates the track. Used
+        when a new track is added in a TextTrackList instance.
+        * html/TextTrack.h:
+        (TextTrack):
+        (WebCore::TextTrack::fireCueChangeEvent): The fireCueChangeEvent has been changed,
+        as events need to be fired asyncronously.
+        * html/TextTrackCue.cpp: Added internal variables to keep the current index
+        position in the track cue order. This is invalidated when an element is
+        inserted before.
+        (WebCore::TextTrackCue::TextTrackCue):
+        (WebCore::TextTrackCue::cueIndex): Getter for the cueIndex.
+        (WebCore):
+        (WebCore::TextTrackCue::invalidateCueIndex): Invalidates the currently stored
+        cue index.
+        (WebCore::TextTrackCue::dispatchEvent): Event dispatching is done asynchronously
+        now. This should be the only method used for event dispatching.
+        (WebCore::TextTrackCue::setIsActive): The setIsActive method no longer dispatches
+        events, but rather just changes the m_isActive variable.
+        * html/TextTrackCue.h:
+        (TextTrackCue):
+
+        * html/TextTrackCueList.cpp:
+        (WebCore::TextTrackCueList::getCueIndex): Retrieves the cue index, in the track cue
+        order, of a given cue.
+        (WebCore):
+        (WebCore::TextTrackCueList::add): Modified the add method such that all the next cue
+        indexes are invalidated.
+        (WebCore::TextTrackCueList::invalidateCueIndexes): Invalidates all cue indexes starting
+        with a specific position.
+        * html/TextTrackCueList.h:
+        (TextTrackCueList):
+        * html/track/TextTrackList.cpp:
+        (TextTrackList::getTrackIndex): Retrieves the track index position.
+        (TextTrackList::append): Added method for invalidating the text track index in case of
+        changing the list contents.
+        * html/track/TextTrackList.h:
+        (TextTrackList):
+
+2012-02-20  Kenichi Ishibashi  <bashi@chromium.org>
+
+        [WebSocket] Move WebSocketChannel::FrameData into a separate header file
+        https://bugs.webkit.org/show_bug.cgi?id=78682
+
+        Extract WebSocketChannel::FrameData as WebSocketFrame. This brings
+        flexibility to add classes which want to do something for
+        incoming/outgoing frames (e.g. compression/decompression).
+
+        Reviewed by Kent Tamura.
+
+        No new tests. No behavior change.
+
+        * GNUmakefile.list.am: AddedWebSocketFrame.h
+        * Target.pri: Ditto.
+        * WebCore.gypi: Ditto.
+        * WebCore.vcproj/WebCore.vcproj: Ditto.
+        * WebCore.xcodeproj/project.pbxproj: Ditto.
+        * websockets/WebSocketChannel.cpp: Modified to use WebSocketFrame instead of FrameData
+        (WebCore):
+        (WebCore::WebSocketChannel::send):
+        (WebCore::WebSocketChannel::startClosingHandshake):
+        (WebCore::WebSocketChannel::parseFrame):
+        (WebCore::WebSocketChannel::processFrame):
+        (WebCore::WebSocketChannel::enqueueTextFrame):
+        (WebCore::WebSocketChannel::enqueueRawFrame):
+        (WebCore::WebSocketChannel::enqueueBlobFrame):
+        (WebCore::appendMaskedFramePayload): Added.
+        (WebCore::makeFrameData): Added.
+        (WebCore::WebSocketChannel::sendFrame):
+        * websockets/WebSocketChannel.h: Removed FrameData.
+        (WebSocketChannel):
+        (QueuedFrame):
+        * websockets/WebSocketFrame.h: Added.
+        (WebCore):
+        (WebSocketFrame):
+        (WebCore::WebSocketFrame::isNonControlOpCode):
+        (WebCore::WebSocketFrame::isControlOpCode):
+        (WebCore::WebSocketFrame::isReservedOpCode):
+        (WebCore::WebSocketFrame::WebSocketFrame):
+
+2012-02-20  Adam Roben  <aroben@apple.com>
+
+        32-bit build fix
+
+        * platform/FractionalLayoutUnit.h:
+        (WebCore::FractionalLayoutUnit::setRawValue): Explicitly cast long long to int, since they
+        are different widths in 32-bit.
+
+2012-02-20  Adam Roben  <aroben@apple.com>
+
+        Clang build fix
+
+        * inspector/InspectorDOMAgent.cpp:
+        (WebCore::InspectorDOMAgent::willModifyDOMAttr): Removed unused parameter.
+
+2012-02-20  Vsevolod Vlasov  <vsevik@chromium.org>
+
+        Unreviewed manual rollout of r107970 which breaks table column widths
+        updates from javascript (e.g. inspector's network panel).
+
+        * rendering/FixedTableLayout.cpp:
+        (WebCore::FixedTableLayout::calcWidthArray):
+        * rendering/RenderTableCol.h:
+        (RenderTableCol):
+
+2012-02-20  Alexander Pavlov  <apavlov@chromium.org>
+
+        Web Inspector: [Styles] Inconsistent alignment of non-parsed properties (having an exclamation mark)
+        https://bugs.webkit.org/show_bug.cgi?id=79028
+
+        Reviewed by Yury Semikhatsky.
+
+        * inspector/front-end/elementsPanel.css:
+        (.styles-section .properties li.not-parsed-ok img.exclamation-mark):
+
+2012-02-20  Alexander Pavlov  <apavlov@chromium.org>
+
+        Web Inspector: DOMAttrModified should not be fired if the attribute value remains the same
+        https://bugs.webkit.org/show_bug.cgi?id=79025
+
+        Reviewed by Pavel Feldman.
+
+        * dom/Element.cpp:
+        (WebCore::Element::willModifyAttribute):
+        * inspector/InspectorDOMAgent.cpp:
+        (WebCore::InspectorDOMAgent::InspectorDOMAgent):
+        (WebCore::InspectorDOMAgent::willModifyDOMAttr):
+        (WebCore):
+        (WebCore::InspectorDOMAgent::didModifyDOMAttr):
+        * inspector/InspectorDOMAgent.h:
+        (InspectorDOMAgent):
+        * inspector/InspectorInstrumentation.cpp:
+        (WebCore::InspectorInstrumentation::willModifyDOMAttrImpl):
+        * inspector/InspectorInstrumentation.h:
+        (InspectorInstrumentation):
+        (WebCore::InspectorInstrumentation::willModifyDOMAttr):
+
+2012-02-20  Kwonjin Jeong  <gram@company100.net>
+
+        Correct a typo error in ScrollingCoordinator.h
+        https://bugs.webkit.org/show_bug.cgi?id=79012
+
+        Reviewed by Andreas Kling.
+
+        * page/scrolling/ScrollingCoordinator.h:
+        (ScrollingCoordinator):
+
+2012-02-20  Alexander Pavlov  <apavlov@chromium.org>
+
+        Web Inspector: [Styles] box-shadow and -webkit-box-shadow properties are not considered color-aware
+        https://bugs.webkit.org/show_bug.cgi?id=78988
+
+        Reviewed by Yury Semikhatsky.
+
+        * inspector/front-end/CSSKeywordCompletions.js:
+
+2012-02-20  Yosifumi Inoue  <yosin@chromium.org>
+
+        [Forms] Spin buttons of number input type should fire both input and change event
+        https://bugs.webkit.org/show_bug.cgi?id=75067
+
+        Reviewed by Kent Tamura.
+
+        This patch makes spin button in number input field clicks to fire input and change events as described in WHATWG HTML5 specification.
+        To implement this behavior, this patch introduces new value DispatchInputAndChangeEvent in TextFieldEventBehavior.
+
+        Test: fast/forms/number/spin-button-events.html
+
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::stepUpFromRenderer): Pass DispatchInputAndChangeEvent instead of DispatchChangeEvent to applyStep, setValue, and setValueAsNumber.
+        * html/HTMLTextFormControlElement.h: Add new enum value DispatchInputAndChangeEvent to TextFieldEventBehavior.
+        * html/TextFieldInputType.cpp:
+        (WebCore::TextFieldInputType::setValue): Handle DispatchInputAndChangeEvent and use RefPtr for element to keep reference.
+
+2012-02-20  Shinya Kawanaka  <shinyak@chromium.org>
+
+        Attached/Detached state must be testable
+        https://bugs.webkit.org/show_bug.cgi?id=79010
+
+        Reviewed by Hajime Morita.
+
+        Added a method to check an element attached or not.
+
+        Test: fast/dom/shadow/shadow-root-attached.html
+
+        * testing/Internals.cpp:
+        (WebCore::Internals::attached):
+        (WebCore):
+        * testing/Internals.h:
+        (Internals):
+        * testing/Internals.idl:
+
+2012-02-20  Kenichi Ishibashi  <bashi@chromium.org>
+
+        [WebSocket] Add deflater/inflater classes
+        https://bugs.webkit.org/show_bug.cgi?id=78449
+
+        Add WebSocketDeflater/WebSocketInflater classes which wrap zlib
+        functions. These classes are not used yet, but will be used for
+        supporting WebSocket deflate-frame extension.
+
+        This patch is second try. The previous patch broke Chromium Win
+        build. I added dependency of zlib to WebCore.gyp. I think it's
+        OK because Chromium already depends on zlib.
+
+        Reviewed by Kent Tamura.
+
+        No new tests except for chromium port. Behavior is unchanged.
+
+        * GNUmakefile.list.am: Added WebSocketDeflater.(cpp|h).
+        * WebCore.gyp/WebCore.gyp: Added zlib dependency.
+        * WebCore.gypi: Added WebSocketDeflater.(cpp|h).
+        * WebCore.vcproj/WebCore.vcproj: Ditto.
+        * WebCore.xcodeproj/project.pbxproj: Ditto.
+        * websockets/WebSocketDeflater.cpp: Added.
+        (WebCore):
+        (WebCore::WebSocketDeflater::create):
+        (WebCore::WebSocketDeflater::WebSocketDeflater):
+        (WebCore::WebSocketDeflater::initialize):
+        (WebCore::WebSocketDeflater::~WebSocketDeflater):
+        (WebCore::setStreamParameter):
+        (WebCore::WebSocketDeflater::addBytes):
+        (WebCore::WebSocketDeflater::finish):
+        (WebCore::WebSocketDeflater::reset):
+        (WebCore::WebSocketInflater::create):
+        (WebCore::WebSocketInflater::WebSocketInflater):
+        (WebCore::WebSocketInflater::initialize):
+        (WebCore::WebSocketInflater::~WebSocketInflater):
+        (WebCore::WebSocketInflater::addBytes):
+        (WebCore::WebSocketInflater::finish):
+        (WebCore::WebSocketInflater::reset):
+        * websockets/WebSocketDeflater.h: Added.
+        (WebCore):
+        (WebSocketDeflater):
+        (WebCore::WebSocketDeflater::data):
+        (WebCore::WebSocketDeflater::size):
+        (WebSocketInflater):
+        (WebCore::WebSocketInflater::data):
+        (WebCore::WebSocketInflater::size):
+
+2012-02-20  pfeldman@chomium.org  <pavel.feldman@gmail.com>
+
+        Web Inspector: consume undo/redo shortcuts.
+        https://bugs.webkit.org/show_bug.cgi?id=79016
+
+        Reviewed by Vsevolod Vlasov.
+
+        * inspector/front-end/ElementsPanel.js:
+        (WebInspector.ElementsPanel.prototype.handleShortcut):
+
+2012-02-20  Philippe Normand  <pnormand@igalia.com>
+
+        MediaPlayer: MediaPlayerPrivate registration cleanup
+        https://bugs.webkit.org/show_bug.cgi?id=78897
+
+        Reviewed by Martin Robinson.
+
+        * platform/graphics/MediaPlayer.cpp:
+        (WebCore::installedMediaEngines): Simplified GStreamer Private
+        player registration by using the PlatformMediaEngineClassName
+        macro like other players do.
+
+2012-02-17  Yury Semikhatsky  <yurys@chromium.org>
+
+        [Chromium] Web Inspector: terminated workers are not removed from dedicated worker list
+        https://bugs.webkit.org/show_bug.cgi?id=78899
+
+        Notify inspector about starting context from WorkerContextProxy not from Worker.
+
+        Reviewed by Pavel Feldman.
+
+        * workers/Worker.cpp:
+        (WebCore::Worker::notifyFinished):
+        * workers/WorkerMessagingProxy.cpp:
+        (WebCore::WorkerMessagingProxy::startWorkerContext):
+
+2012-02-19  Keishi Hattori  <keishi@webkit.org>
+
+        Use shadowRootList for ColorInputType
+        https://bugs.webkit.org/show_bug.cgi?id=79007
+
+        Reviewed by Kent Tamura.
+
+        * html/ColorInputType.cpp:
+        (WebCore::ColorInputType::createShadowSubtree): Changed shadowRoot to shadowRootList.
+        (WebCore::ColorInputType::shadowColorSwatch): Changed shadowRoot to shadowRootList.
+
+2012-02-19  Shinya Kawanaka  <shinyak@chromium.org>
+
+        Introduce InsertionPoint, which will be a common base class of HTMLShadowElement and HTMLContentElement.
+        https://bugs.webkit.org/show_bug.cgi?id=78771
+
+        Reviewed by Hajime Morita.
+
+        This patch introduces InsertionPoint, which will be a common base class of HTMLShadowElement and HTMLContentElement.
+
+        This is a step for rendering <shadow> correctly, because <shadow> has almost the same function of <content>.
+        After this patch, we will change NodeRenderingContext and related classes to accept InsertionPoint instead of
+        HTMLContentElement only.
+
+        No new tests, no change in behavior.
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * Target.pri:
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * html/shadow/HTMLContentElement.cpp:
+        (WebCore::HTMLContentElement::HTMLContentElement):
+        (WebCore::HTMLContentElement::attach):
+        (WebCore::HTMLContentElement::detach):
+        (WebCore::HTMLContentElement::parseAttribute):
+        * html/shadow/HTMLContentElement.h:
+        * html/shadow/InsertionPoint.cpp: Added.
+        (WebCore):
+        (WebCore::InsertionPoint::InsertionPoint):
+        (WebCore::InsertionPoint::~InsertionPoint):
+        * html/shadow/InsertionPoint.h: Added.
+        (WebCore):
+        (InsertionPoint):
+
+2012-02-19  Paweł Forysiuk  <tuxator@o2.pl>
+
+        [GTK] Can't find webinspector and error page redirection on Windows
+        https://bugs.webkit.org/show_bug.cgi?id=51616
+
+        Create and use an abstraction for finding shared resources on Windows.
+
+        Reviewed by Martin Robinson.
+
+        * platform/FileSystem.h:
+        (WebCore):
+        * platform/audio/gtk/AudioBusGtk.cpp:
+        (WebCore::AudioBus::loadPlatformResource):
+        * platform/graphics/gtk/ImageGtk.cpp:
+        (WebCore::getPathToImageResource):
+        * platform/gtk/FileSystemGtk.cpp:
+        (WebCore::sharedResourcesPath):
+        (WebCore):
+
+2012-02-19  James Robinson  <jamesr@chromium.org>
+
+        Move stub implementations of ScrollingCoordinator functions into ScrollingCoordinatorNone.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=78951
+
+        Reviewed by Adam Barth.
+
+        This move stubs for ScrollingCoordinator functions into ScrollingCoordinatorNone.cpp instead of #ifdefing inside
+        ScrollingCoordinator.cpp.  The mac port uses ScrollingCoordinator when #if ENABLE(THREADED_SCROLLING) is not set
+        and implementations in ScrollingCoordinator.cpp / ScrollingCoordinatorMac.mm otherwise.  The chromium port
+        always uses implementations in ScrollingCoordinatorChromium.cpp.  All other ports use
+        ScrollingCoordinatorNone.cpp.
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * Target.pri:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbx:
+        * page/scrolling/ScrollingCoordinator.cpp:
+        * page/scrolling/ScrollingCoordinatorNone.cpp:
+        (WebCore):
+        (WebCore::ScrollingCoordinator::create):
+        (WebCore::ScrollingCoordinator::frameViewHorizontalScrollbarLayerDidChange):
+        (WebCore::ScrollingCoordinator::frameViewVerticalScrollbarLayerDidChange):
+        (WebCore::ScrollingCoordinator::setScrollLayer):
+        (WebCore::ScrollingCoordinator::setNonFastScrollableRegion):
+        (WebCore::ScrollingCoordinator::setScrollParameters):
+        (WebCore::ScrollingCoordinator::setWheelEventHandlerCount):
+        (WebCore::ScrollingCoordinator::setShouldUpdateScrollLayerPositionOnMainThread):
+        * page/scrolling/mac/ScrollingCoordinatorMac.mm:
+        (WebCore::ScrollingCoordinator::create):
+        (WebCore):
+
+2012-02-19  Kentaro Hara  <haraken@chromium.org>
+
+        Rename [CheckDomainSecurity] to [CheckSecurity]
+        https://bugs.webkit.org/show_bug.cgi?id=78874
+
+        Reviewed by Adam Barth.
+
+        "Domain security" isn't a term that's used elsewhere.
+        This patch renames IDL attributes as follows:
+
+        - [CheckDomainSecurity] => [CheckSecurity]
+        - [DoNotCheckDomainSecurity] => [DoNotCheckSecurity]
+        - [DoNotCheckDomainSecurityOnGetter] => [DoNotCheckSecurityOnGetter]
+        - [DoNotCheckDomainSecurityOnSetter] => [DoNotCheckSecurityOnSetter]
+
+        No tests. No change in behavior.
+
+        * bindings/scripts/CodeGeneratorJS.pm:
+        (GenerateGetOwnPropertyDescriptorBody):
+        (GenerateImplementation):
+        * bindings/scripts/CodeGeneratorV8.pm:
+        (GenerateHeader):
+        (IsVisibleAcrossOrigins):
+        (GenerateFunctionCallback):
+        (GenerateSingleBatchedAttribute):
+        (GenerateImplementation):
+        (GenerateToV8Converters):
+        * bindings/scripts/test/TestDomainSecurity.idl:
+        * bindings/scripts/test/V8/V8TestActiveDOMObject.cpp:
+        (WebCore::ConfigureV8TestActiveDOMObjectTemplate):
+        * page/DOMWindow.idl:
+        * page/History.idl:
+        * page/Location.idl:
+
+2012-02-19  James Robinson  <jamesr@chromium.org>
+
+        Unreviewed, rolling out r108195.
+        http://trac.webkit.org/changeset/108195
+        https://bugs.webkit.org/show_bug.cgi?id=77700
+
+        Lots of failing ASSERT()s on v8 bots, requested by kling on
+        #webkit
+
+        * bindings/js/JSCSSValueCustom.cpp:
+        (WebCore::toJS):
+        * bindings/scripts/CodeGeneratorV8.pm:
+        (GenerateHeader):
+
+2012-02-19  Kentaro Hara  <haraken@chromium.org>
+
+        Rename [CheckAccessToNode] to [CheckSecurityForNode]
+        https://bugs.webkit.org/show_bug.cgi?id=78991
+
+        Reviewed by Adam Barth.
+
+        For naming consistency with [CheckSecurity], this patch renames
+        [CheckAccessToNode] to [CheckSecurityForNode].
+
+        No tests. No change in behavior.
+
+        * bindings/scripts/CodeGeneratorJS.pm:
+        (GenerateImplementation):
+        * bindings/scripts/CodeGeneratorV8.pm:
+        (GenerateNormalAttrGetter):
+        (GenerateFunctionCallback):
+        * bindings/scripts/test/TestObj.idl:
+        * bindings/scripts/test/V8/V8TestObj.cpp:
+        (WebCore):
+        * html/HTMLEmbedElement.idl:
+        * html/HTMLFrameElement.idl:
+        * html/HTMLIFrameElement.idl:
+        * html/HTMLObjectElement.idl:
+        * page/DOMWindow.idl:
+
+2012-02-19  James Robinson  <jamesr@chromium.org>
+
+        Sort WebCore Xcode project files with sort-Xcode-project-files script. Unreviewed.
+
+        * WebCore.xcodeproj/project.pbxproj:
+
+2012-02-19  Andreas Kling  <awesomekling@apple.com>
+
+        Make CSSValue wrapper getters return unique objects every time.
+        <http://webkit.org/b/77700>
+
+        Reviewed by Antti Koivisto.
+
+        Change the behavior of CSSValue getters to return unique JS wrappers every
+        time they are called. This means we no longer have to deal with the risk
+        of leaking custom properties between unrelated documents, and are free to
+        implement global value sharing across WebCore.
+
+        This patch will be followed by one making CSSValuePool globally shared,
+        it's done in two steps to monitor the impact of this change.
+
+        * bindings/js/JSCSSValueCustom.cpp:
+        (WebCore::toJS):
+        * bindings/scripts/CodeGeneratorV8.pm:
+        (GenerateHeader):
+        (IsCSSValueType):
+
+2012-02-19  Abhishek Arya  <inferno@chromium.org>
+
+        Crash in RenderBlock::splitAnonymousBlocksAroundChild.
+        https://bugs.webkit.org/show_bug.cgi?id=78994
+
+        Reviewed by Eric Seidel.
+
+        Generalize splitTablePartsAroundChild to handle splitting
+        in nested tables.
+        Table->Table Section->Table Row->Table Cell->Table->Table Section->Table Row
+
+        Test: fast/table/table-split-inside-table.html
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::splitTablePartsAroundChild):
+
+2012-02-19  Kalev Lember  <kalevlember@gmail.com>
+
+        [GTK] Fix build on platforms where UChar is wchar_t
+        https://bugs.webkit.org/show_bug.cgi?id=78996
+
+        Reviewed by Martin Robinson.
+
+        The ICU backend defines UChar as wchar_t for platforms where wchar_t is
+        16 bits wide, e.g. win32.
+
+        * platform/graphics/pango/FontPango.cpp:
+        (WebCore::utf16ToUtf8): Use reinterpret_cast instead of static_cast.
+        * platform/gtk/GtkPopupMenu.cpp:
+        (WebCore::GtkPopupMenu::typeAheadFind): Ditto.
+
+2012-02-19  Carlos Garcia Campos  <cgarcia@igalia.com>
+
+        Unreviewed. Fix make distcheck issues.
+
+        * GNUmakefile.list.am: Add missing header.
+
+2012-02-18  Robert Hogan  <robert@webkit.org>
+
+        CSS 2.1 failure: inline-box-002.htm fails
+        https://bugs.webkit.org/show_bug.cgi?id=69210
+
+        Reviewed by David Hyatt.
+
+        Tests: css2.1/20110323/dynamic-top-change-005.htm
+               css2.1/20110323/dynamic-top-change-005a.htm
+               css2.1/20110323/dynamic-top-change-005b.htm
+               css2.1/20110323/inline-box-002.htm
+               fast/css/relative-positioned-block-nested-with-inline-parent-dynamic-removed.html
+               fast/css/relative-positioned-block-nested-with-inline-parent-dynamic.html
+               fast/css/relative-positioned-block-nested-with-inline-parent-multiple-descendant-blocks-dynamic.html
+               fast/css/relative-positioned-block-nested-with-inline-parent.html
+               fast/css/relative-positioned-block-with-inline-ancestor-and-parent-dynamic.html
+               fast/css/relative-positioned-block-with-inline-ancestor-dynamic-removed.html
+               fast/css/relative-positioned-block-with-inline-ancestor-dynamic.html
+               fast/css/relative-positioned-block-with-inline-ancestor.html
+               fast/css/relative-positioned-block-with-inline-parent-dynamic-removed.html
+               fast/css/relative-positioned-block-with-inline-parent-dynamic.html
+               fast/css/relative-positioned-block-with-inline-parent-keeps-style.html
+               fast/css/relative-positioned-block-with-inline-parent.html
+
+        A block within an inline is affected by relative positioning on the inline box. Give
+        the anonymous block containing the block a layer and make it relative positioned. Then
+        calculate the offset of the anonymous block's layer by accumulating the offsets from its
+        inline continuation and the inline continuation's inline parents.
+        If the position of an inline changes from or to relative positioned then ensure that any
+        descendant blocks update their position and layer accordingly.
+
+        * rendering/RenderBoxModelObject.cpp:
+        (): add an enum RelPosAxis
+        (WebCore::accumulateRelativePositionOffsets): 
+        Total up the offsets of all relatively positioned inlines that are de-facto parents of the relatively 
+        positioned anonymous block's child block.
+
+        (WebCore):
+        (WebCore::RenderBoxModelObject::relativePositionOffsetX): 
+        Use accumulateRelativePositionOffsets when calculating the relative position offset of a relatively positioned anonymous block.
+
+        (WebCore::RenderBoxModelObject::relativePositionOffsetY): ditto
+
+        * rendering/RenderInline.cpp:
+        (WebCore::hasRelPositionedInlineAncestor): 
+        Detects if the anonymous block contains a block that is the de-facto descendant of a relatively positioned inline.
+
+        (WebCore::updateStyleOfAnonymousBlockContinuations): 
+        Update the style's positioning for each anonymous block containing a block that is descendant from the inline whose style has changed.
+
+        (WebCore::RenderInline::styleDidChange): 
+        If an inline changes to or from relative positioning ensure that any descendant blocks change to or from relative positioning
+        as well, unless they still have a relatively positioned ancestor after the current ancestor loses its relative positioning.
+
+        (WebCore::RenderInline::addChildIgnoringContinuation): 
+        If the anonymous block contains a block that is effectively descended from a relatively positioned inline, make it relatively
+        positioned so the block will respect its inline ancestor's relative positioning.
+
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::propagateStyleToAnonymousChildren): 
+        Preserve style position in anonymous block continuations when the parent block propagates a style change. 
+
+2012-02-18  raman Tenneti  <rtenneti@chromium.org>
+
+        Track the NPN protocol version negotiated with the server
+        https://bugs.webkit.org/show_bug.cgi?id=77349
+
+        Reviewed by Darin Fisher..
+
+        [chromium] Added ExtraData to WebURLResponse.
+        
+        No intended functionality change.
+
+        * platform/network/chromium/ResourceResponse.h:
+        (ExtraData):
+        (WebCore::ResourceResponse::ExtraData::~ExtraData):
+        (ResourceResponse):
+        (WebCore::ResourceResponse::extraData):
+        (WebCore::ResourceResponse::setExtraData):
+
+2012-02-18  Abhishek Arya  <inferno@chromium.org>
+
+        Unreviewed, rolling out r107965.
+        http://trac.webkit.org/changeset/107965
+        https://bugs.webkit.org/show_bug.cgi?id=78273
+
+        crashes
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::clone):
+
+2012-02-18  Sam Weinig  <sam@webkit.org>
+
+        Make WebCore compile with libc++ (Part 2)
+        https://bugs.webkit.org/show_bug.cgi?id=78974
+
+        Reviewed by Anders Carlsson.
+
+        * config.h:
+        Disable the DisallowCType check when using libc++.
+
+2012-02-18  Sam Weinig  <sam@webkit.org>
+
+        Fix the build.
+
+        * page/DOMWindow.idl:
+
+2012-02-14  Sam Weinig  <sam@webkit.org>
+
+        Make WebCore compile with libc++ (Part 1)
+        https://bugs.webkit.org/show_bug.cgi?id=78974
+
+        Reviewed by Anders Carlsson.
+
+        Add a workaround for <rdar://problem/10858112>, which cause the standard heap functions
+        not to work when using an iterator with proxy objects for reference and pointer types.
+
+        * WebCorePrefix.h:
+        (move):
+        Add an overload of std::move that the heap functions can call successfully.
+
+2012-02-18  Kevin Ollivier  <kevino@theolliviers.com>
+
+        [wx] Build fixes for C++ bindings after recent changes.
+        
+        * bindings/scripts/CodeGeneratorCPP.pm:
+        (ShouldSkipType):
+        (GenerateHeader):
+        * page/DOMWindow.idl:
+
+2012-02-18  Kevin Ollivier  <kevino@theolliviers.com>
+
+        [wx] Build fix, add new platform method wx impl.
+
+        * platform/wx/ContextMenuWx.cpp:
+        (ContextMenu::itemCount):
+
+2012-02-18  Sam Weinig  <sam@webkit.org>
+
+        Fix part of the windows build failure.
+
+        * WebCore.vcproj/WebCore.vcproj:
+        Don't build JSWebKitCSSRegionRule.cpp, since it is already being built
+        as part of DerivedSources.cpp.
+
+2012-02-18  Sam Weinig  <sam@webkit.org>
+
+        Fix the ENABLE(THREADED_SCROLLING) build.
+
+        * page/scrolling/ScrollingCoordinator.cpp:
+        (WebCore::ScrollingCoordinator::setNonFastScrollableRegion):
+        (WebCore::ScrollingCoordinator::setScrollParameters):
+
+2012-02-18  Andreas Kling  <awesomekling@apple.com>
+
+        HTML: Remove unnecessary attributeChange() overrides.
+        <http://webkit.org/b/78890>
+
+        Reviewed by Anders Carlsson.
+
+        Move logic from attributeChanged() overrides into parseAttribute().
+        This is a step towards making attributeChanged() non-virtual.
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::parseAttribute):
+        * html/HTMLMediaElement.h:
+        (HTMLMediaElement):
+        * html/HTMLScriptElement.cpp:
+        (WebCore::HTMLScriptElement::parseAttribute):
+        * html/HTMLScriptElement.h:
+        (HTMLScriptElement):
+        * html/HTMLTrackElement.cpp:
+        (WebCore::HTMLTrackElement::parseAttribute):
+        * html/HTMLTrackElement.h:
+        (HTMLTrackElement):
+
+2012-02-18  Andreas Kling  <awesomekling@apple.com>
+
+        Remove Element::createAttribute().
+        <http://webkit.org/b/78965>
+
+        Reviewed by Anders Carlsson.
+
+        Switch call sites to use Attribute::create() directly, as there is no magic
+        in calling Element::createAttribute() anymore (it used to be virtual and handled
+        differently by StyledElement.)
+
+        * dom/Element.cpp:
+        (WebCore::Element::setAttributeInternal):
+        * dom/Element.h:
+        * svg/properties/SVGAnimatedPropertySynchronizer.h:
+
+2012-02-18  Andreas Kling  <awesomekling@apple.com>
+
+        HTMLBodyElement: Avoid synchronous style recalc when setting link/vlink/alink.
+        <http://webkit.org/b/78959>
+
+        Reviewed by Anders Carlsson.
+
+        Mark the body element for deferred style recalc instead of doing it synchronously
+        when the attributes change.
+
+        * html/HTMLBodyElement.cpp:
+        (WebCore::HTMLBodyElement::parseAttribute):
+
+2012-02-18  Martin Robinson  <mrobinson@igalia.com>
+
+        Fix the TextureMapper build for non-Qt ports. Qt debug builds
+        must use RTTI, but GTK+, at least, does not.
+
+        * platform/graphics/texmap/TextureMapperLayer.cpp:
+        (WebCore::TextureMapperLayer::updateBackingStore): Make the RTTI check
+        Qt only.
+
+2012-02-16  Andreas Kling  <awesomekling@apple.com>
+
+        FontFamilyValue: Utilize inheritance from CSSPrimitiveValue better.
+        <http://webkit.org/b/78806>
+
+        Reviewed by Antti Koivisto.
+
+        Now that FontFamilyValue's string doesn't change after creation, we can just
+        pass the massaged family name up to the CSSPrimitiveValue constructor and get
+        cached cssText() for free. This also shrinks FontFamilyValue by sizeof(String)
+        though that's less of an issue now that we cache them in CSSValuePool.
+
+        * css/FontFamilyValue.cpp:
+        (WebCore::stripFontFamilyJunk):
+        (WebCore::FontFamilyValue::FontFamilyValue):
+        * css/FontFamilyValue.h:
+        (WebCore::FontFamilyValue::familyName):
+        (FontFamilyValue):
+
+2012-02-17  Adam Klein  <adamk@chromium.org>
+
+        Avoid inconsistency in Node::inDocument due to DOMSubtreeModified dispatch
+        https://bugs.webkit.org/show_bug.cgi?id=76087
+
+        Reviewed by Ryosuke Niwa.
+
+        Move post-removal notifications after call to Node::removeFromDocument
+        to avoid inconsistent state of Node::inDocument() and thus avoid
+        inconsistent state in DocumentOrderedMap.
+
+        Tests: fast/dom/getElementById-consistency.html
+               fast/dom/getElementById-consistency2.html
+
+        * dom/ContainerNode.cpp:
+        (WebCore::ContainerNode::removeChild):
+        * svg/SVGTRefElement.cpp:
+        (WebCore::SVGTRefElement::updateReferencedText): Fixed to work with new timing of DOMSubtreeModified dispatch.
+
+2012-02-17  Joshua Bell  <jsbell@chromium.org>
+
+        IndexedDB: Support overloaded methods that take IDBKey or IDBKeyRange
+        https://bugs.webkit.org/show_bug.cgi?id=78399
+
+        Implements IDBObjectStore.delete(IDBKeyRange) to exercise the functionality.
+
+        Reviewed by Tony Chang.
+
+        Test: storage/indexeddb/delete-range.html
+
+        * bindings/scripts/CodeGeneratorV8.pm:
+        (GenerateFunctionCallString): Use .get() to disambiguate when passing RefPtr.
+        * bindings/scripts/test/V8/V8TestObj.cpp: Update test expectations.
+        * storage/IDBLevelDBBackingStore.cpp:
+        (WebCore):
+        * storage/IDBObjectStore.cpp:
+        (WebCore::IDBObjectStore::deleteFunction):
+        (WebCore):
+        * storage/IDBObjectStore.h:
+        (IDBObjectStore):
+        * storage/IDBObjectStore.idl:
+        * storage/IDBObjectStoreBackendImpl.cpp:
+        (WebCore::IDBObjectStoreBackendImpl::deleteFunction):
+        (WebCore):
+        (WebCore::IDBObjectStoreBackendImpl::deleteInternal):
+        * storage/IDBObjectStoreBackendImpl.h:
+        (IDBObjectStoreBackendImpl):
+        * storage/IDBObjectStoreBackendInterface.h:
+
+2012-02-17  Kentaro Hara  <haraken@chromium.org>
+
+        Replace [V8OnInstance] with [V8Unforgeable]
+        https://bugs.webkit.org/show_bug.cgi?id=78894
+
+        Reviewed by Adam Barth.
+
+        [V8OnInstance] means that the method should be defined
+        (not on a prototype chain but) on a DOM object. It is the
+        same meaning as [V8Unforgeable]. This patch replaces [V8OnInstance]
+        with [V8Unforgeable].
+
+        No tests. No change in behavior.
+
+        * bindings/scripts/CodeGeneratorV8.pm:
+        (GenerateImplementation):
+        * page/Location.idl:
+
+2012-02-17  James Robinson  <jamesr@chromium.org>
+
+        [chromium] Unreviewed build fix. MSVS gyp generator can't handle multiple .cpps with the same name in the same
+        target from different paths.
+
+        * WebCore.gypi:
+        * page/scrolling/chromium/ScrollingCoordinatorChromium.cpp: Renamed from Source/WebCore/page/scrolling/chromium/ScrollingCoordinator.cpp.
+        (WebCore):
+        (WebCore::ScrollingCoordinator::frameViewHorizontalScrollbarLayerDidChange):
+        (WebCore::ScrollingCoordinator::frameViewVerticalScrollbarLayerDidChange):
+        (WebCore::ScrollingCoordinator::setScrollLayer):
+        (WebCore::ScrollingCoordinator::setNonFastScrollableRegion):
+        (WebCore::ScrollingCoordinator::setScrollParameters):
+        (WebCore::ScrollingCoordinator::setWheelEventHandlerCount):
+        (WebCore::ScrollingCoordinator::setShouldUpdateScrollLayerPositionOnMainThread):
+
+2012-02-17  James Robinson  <jamesr@chromium.org>
+
+        Unreviewed mac compile fix pt 2
+
+        * page/scrolling/ScrollingCoordinator.cpp:
+        (WebCore::ScrollingCoordinator::frameViewHorizontalScrollbarLayerDidChange):
+        (WebCore::ScrollingCoordinator::frameViewVerticalScrollbarLayerDidChange):
+        (WebCore::ScrollingCoordinator::setScrollLayer):
+        (WebCore::ScrollingCoordinator::setNonFastScrollableRegion):
+        (WebCore::ScrollingCoordinator::setScrollParameters):
+        (WebCore::ScrollingCoordinator::setWheelEventHandlerCount):
+        (WebCore::ScrollingCoordinator::setShouldUpdateScrollLayerPositionOnMainThread):
+
+2012-02-17  James Robinson  <jamesr@chromium.org>
+
+        Unreviewed mac compile fix (unused parameter warning)
+
+        * page/scrolling/ScrollingCoordinator.cpp:
+        (WebCore::ScrollingCoordinator::frameViewHorizontalScrollbarLayerDidChange):
+        (WebCore::ScrollingCoordinator::frameViewVerticalScrollbarLayerDidChange):
+
+2012-02-14  James Robinson  <jamesr@chromium.org>
+
+        Move ScrollingCoordinator out of ENABLE(THREADED_SCROLLING) ifdef and enable on all platforms
+        https://bugs.webkit.org/show_bug.cgi?id=78401
+
+        Reviewed by Adam Barth.
+
+        Separates THREADED_SCROLLING from ScrollingCoordinator and enables ScrollingCoordinator-related code on
+        chromium. ScrollingCoordinator receives scrolling information to be used with an external scrolling source.
+        ENABLE(THREADED_SCROLLING) enables a codepath that uses a thread in WebCore to handle scrolling related input
+        events and interact with composited layers.
+
+        * WebCore.gyp/WebCore.gyp:
+        * WebCore.gypi:
+        * dom/Document.cpp:
+        (WebCore::wheelEventHandlerCountChanged):
+        * page/FrameView.cpp:
+        (WebCore::FrameView::addSlowRepaintObject):
+        (WebCore::FrameView::removeSlowRepaintObject):
+        (WebCore::FrameView::performPostLayoutTasks):
+        * page/Page.cpp:
+        (WebCore::Page::~Page):
+        (WebCore):
+        * page/Page.h:
+        (Page):
+        * page/Settings.cpp:
+        (WebCore::Settings::Settings):
+        * page/Settings.h:
+        (Settings):
+        * page/scrolling/ScrollingCoordinator.cpp:
+        (WebCore::ScrollingCoordinator::ScrollingCoordinator):
+        (WebCore::ScrollingCoordinator::~ScrollingCoordinator):
+        (WebCore::ScrollingCoordinator::pageDestroyed):
+        (WebCore):
+        * page/scrolling/ScrollingCoordinator.h:
+        (WebCore):
+        (ScrollingCoordinator):
+        * page/scrolling/ScrollingThread.cpp:
+        (WebCore::ScrollingThread::createThreadIfNeeded):
+        * page/scrolling/ScrollingTreeState.cpp:
+        * page/scrolling/ScrollingTreeState.h:
+        * page/scrolling/chromium/ScrollingCoordinator.cpp: Added.
+        (WebCore):
+        (WebCore::ScrollingCoordinator::scheduleTreeStateCommit):
+        (WebCore::ScrollingCoordinator::frameViewScrollLayerDidChange):
+        (WebCore::ScrollingCoordinator::frameViewHorizontalScrollbarLayerDidChange):
+        (WebCore::ScrollingCoordinator::frameViewVerticalScrollbarLayerDidChange):
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::RenderLayerBacking):
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::frameViewDidScroll):
+        (WebCore::shouldCompositeOverflowControls):
+        (WebCore::RenderLayerCompositor::requiresOverhangAreasLayer):
+        (WebCore::RenderLayerCompositor::requiresContentShadowLayer):
+        (WebCore::RenderLayerCompositor::updateOverflowControlsLayers):
+        (WebCore::RenderLayerCompositor::ensureRootLayer):
+        (WebCore):
+        * rendering/RenderLayerCompositor.h:
+        (WebCore):
+        (RenderLayerCompositor):
+
+2012-02-17  Emil A Eklund  <eae@chromium.org>
+
+        Add FractionalLayoutPoint for sub-pixel layout
+        https://bugs.webkit.org/show_bug.cgi?id=78913
+
+        Reviewed by Eric Seidel.
+
+        Add FractionalLayoutUnit version of Point class and a couple of
+        conversion methods to the Int and Float versions of same.
+
+        No new tests.
+
+        * GNUmakefile.list.am:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * platform/graphics/FloatPoint.cpp:
+        (WebCore::FloatPoint::FloatPoint):
+        (WebCore):
+        (WebCore::FloatPoint::moveBy):
+        * platform/graphics/FloatPoint.h:
+        (WebCore):
+        (FloatPoint):
+        * platform/graphics/FractionalLayoutPoint.h: Added.
+        (WebCore):
+        (FractionalLayoutPoint):
+        (WebCore::FractionalLayoutPoint::FractionalLayoutPoint):
+        (WebCore::FractionalLayoutPoint::zero):
+        (WebCore::FractionalLayoutPoint::x):
+        (WebCore::FractionalLayoutPoint::y):
+        (WebCore::FractionalLayoutPoint::setX):
+        (WebCore::FractionalLayoutPoint::setY):
+        (WebCore::FractionalLayoutPoint::move):
+        (WebCore::FractionalLayoutPoint::moveBy):
+        (WebCore::FractionalLayoutPoint::scale):
+        (WebCore::FractionalLayoutPoint::expandedTo):
+        (WebCore::FractionalLayoutPoint::shrunkTo):
+        (WebCore::FractionalLayoutPoint::clampNegativeToZero):
+        (WebCore::FractionalLayoutPoint::transposedPoint):
+        (WebCore::operator+=):
+        (WebCore::operator-=):
+        (WebCore::operator+):
+        (WebCore::operator-):
+        (WebCore::operator==):
+        (WebCore::operator!=):
+        (WebCore::toPoint):
+        (WebCore::toSize):
+        (WebCore::flooredIntPoint):
+        (WebCore::roundedIntPoint):
+        (WebCore::ceiledIntPoint):
+        * platform/graphics/FractionalLayoutSize.cpp:
+        (WebCore::pixelSnappedIntSize):
+        * platform/graphics/FractionalLayoutSize.h:
+        (WebCore):
+
+2012-02-17  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Move textDirectionForSelection from Editor to EditingStyle
+        https://bugs.webkit.org/show_bug.cgi?id=78868
+
+        Reviewed by Enrica Casucci.
+
+        Move textDirectionForSelection from Editor to EditingStyle to centralize the editing code's
+        dependency on CSSStyleDeclaration.
+
+        * editing/EditingStyle.cpp:
+        (WebCore::EditingStyle::textDirectionForSelection):
+        (WebCore):
+        * editing/EditingStyle.h:
+        (EditingStyle):
+        * editing/Editor.cpp:
+        (WebCore):
+        * editing/Editor.h:
+        (Editor):
+        * editing/EditorCommand.cpp:
+        (WebCore::stateTextWritingDirection):
+        * editing/ReplaceSelectionCommand.cpp:
+        * editing/markup.cpp:
+
+2012-02-17  David Barton  <dbarton@mathscribe.com>
+
+        MathML internals - embellished operators, getBase() accessor functions
+        https://bugs.webkit.org/show_bug.cgi?id=78617
+
+        Reviewed by Eric Seidel.
+
+        Define functions that return an unembellished "base", by omitting
+        subscripts/superscripts, underscripts/overscripts, or denominators. This is needed in
+        subsequent patches both for correct operator stretching and simple code factoring.
+
+        No new tests.
+
+        * rendering/mathml/RenderMathMLBlock.h:
+        (WebCore):
+        (RenderMathMLBlock):
+        (WebCore::RenderMathMLBlock::unembellishedOperator):
+        * rendering/mathml/RenderMathMLFraction.cpp:
+        (WebCore::RenderMathMLFraction::unembellishedOperator):
+        (WebCore):
+        * rendering/mathml/RenderMathMLFraction.h:
+        (RenderMathMLFraction):
+        * rendering/mathml/RenderMathMLOperator.h:
+        (WebCore::RenderMathMLOperator::unembellishedOperator):
+        * rendering/mathml/RenderMathMLSubSup.cpp:
+        (WebCore::RenderMathMLSubSup::base):
+        (WebCore):
+        (WebCore::RenderMathMLSubSup::unembellishedOperator):
+        (WebCore::RenderMathMLSubSup::stretchToHeight):
+            - renamed a variable for clarity, especially in later patches
+        (WebCore::RenderMathMLSubSup::layout):
+            - renamed a variable for clarity, especially in later patches
+        * rendering/mathml/RenderMathMLSubSup.h:
+        (RenderMathMLSubSup):
+        * rendering/mathml/RenderMathMLUnderOver.cpp:
+        (WebCore::RenderMathMLUnderOver::base):
+        (WebCore):
+        (WebCore::RenderMathMLUnderOver::unembellishedOperator):
+        (WebCore::RenderMathMLUnderOver::stretchToHeight):
+        * rendering/mathml/RenderMathMLUnderOver.h:
+        (RenderMathMLUnderOver):
+
+2012-02-17  No'am Rosenthal  <noam.rosenthal@nokia.com>
+
+        [Qt][WK2] Allow opaque tiles
+        https://bugs.webkit.org/show_bug.cgi?id=78809
+
+        Replace the isOpaque boolean in BitmapTexture to a SupportsAlpha flag.
+        Use reset/didReset instead of a virtual function that has to call the superclass.
+
+        Make sure that all calls to BitmapTexture::reset() pass the correct SupportsAlpha flag,
+        based on the source image.
+        Since we now disable blending for opaque textures, we also have to make sure that we treat
+        the depth buffer correctly and bring it back to its previous state.
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        No behavior changes.
+
+        * platform/graphics/opengl/TextureMapperGL.cpp:
+        (TextureMapperGLData):
+        (WebCore::TextureMapperGLData::initStencil):
+        (WebCore::TextureMapperGLData::TextureMapperGLData):
+        (BitmapTextureGL):
+        (WebCore::TextureMapperGL::beginPainting):
+        (WebCore::TextureMapperGL::endPainting):
+        (WebCore::TextureMapperGL::drawTexture):
+        (WebCore::BitmapTextureGL::didReset):
+        (WebCore::BitmapTextureGL::bind):
+        (WebCore::TextureMapperGL::beginClip):
+        * platform/graphics/texmap/TextureMapper.h:
+        (WebCore::BitmapTexture::BitmapTexture):
+        (WebCore::BitmapTexture::flags):
+        (WebCore::BitmapTexture::didReset):
+        (WebCore::BitmapTexture::reset):
+        (BitmapTexture):
+        * platform/graphics/texmap/TextureMapperBackingStore.cpp:
+        (WebCore::TextureMapperTile::updateContents):
+        (WebCore::TextureMapperTiledBackingStore::updateContentsFromImageIfNeeded):
+        (WebCore::TextureMapperTiledBackingStore::createOrDestroyTilesIfNeeded):
+        (WebCore::TextureMapperTiledBackingStore::updateContents):
+        * platform/graphics/texmap/TextureMapperBackingStore.h:
+        (TextureMapperTiledBackingStore):
+        * platform/graphics/texmap/TextureMapperImageBuffer.cpp:
+        (WebCore::BitmapTextureImageBuffer::didReset):
+        (WebCore):
+        * platform/graphics/texmap/TextureMapperImageBuffer.h:
+        (BitmapTextureImageBuffer):
+
+2012-02-17  Stephen Chenney  <schenney@chromium.org>
+
+        Crash in SVGAnimateElement due to changed target
+        https://bugs.webkit.org/show_bug.cgi?id=75096
+
+        Reviewed by Nikolas Zimmermann.
+
+        The SVGAnimateElement object creates various internal objects
+        depending on the type of property being animated, which depends on the
+        target. These objects were not being recreated when the target
+        changed, and crashes ensued. Now the SVGSMILElement provides a virtual
+        method that is called when the target changes, and SVGAnimateElement
+        updates its objects as necessary. We also deactivate the animation
+        when the target changes, forcing recomputation of other derived
+        objects.
+
+        This change also removes various unnecessary calls to semi-expensive
+        methods.
+
+        Not only does this change fix the new test, it also fixes potential
+        crashes in other tests that apparently never manifested before (but
+        manifest when this new test is included in DRT).
+
+        Test: svg/animations/svglength-animation-retarget-crash.html
+
+        * svg/SVGAnimateElement.cpp:
+        (WebCore::SVGAnimateElement::hasValidAttributeType):
+        (WebCore::SVGAnimateElement::calculateAnimatedValue):
+        (WebCore::SVGAnimateElement::calculateFromAndToValues):
+        (WebCore::SVGAnimateElement::calculateFromAndByValues):
+        (WebCore::SVGAnimateElement::resetToBaseValue):
+        (WebCore::SVGAnimateElement::calculateDistance):
+        (WebCore):
+        (WebCore::SVGAnimateElement::targetElementDidChange):
+        * svg/SVGAnimateElement.h:
+        (SVGAnimateElement):
+        * svg/SVGAnimatedTypeAnimator.h:
+        (SVGAnimatedTypeAnimator):
+        (WebCore::SVGAnimatedTypeAnimator::type):
+        * svg/animation/SVGSMILElement.cpp:
+        (WebCore::SVGSMILElement::targetElement):
+        (WebCore::SVGSMILElement::resetTargetElement):
+        (WebCore):
+        * svg/animation/SVGSMILElement.h:
+        (SVGSMILElement):
+        (WebCore::SVGSMILElement::targetElementDidChange):
+
+2012-02-17  David Hyatt  <hyatt@apple.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=78934
+        
+        Add the -webkit-line-align property to support the alignment of lines in the inline direction
+        to the line grid.
+
+        Reviewed by Dan Bernstein.
+
+        Added fast/line-grid/line-align-parsing.html
+
+        * css/CSSComputedStyleDeclaration.cpp:
+        (WebCore):
+        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue):
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseValue):
+        * css/CSSPrimitiveValueMappings.h:
+        (WebCore::CSSPrimitiveValue::CSSPrimitiveValue):
+        (WebCore):
+        (WebCore::CSSPrimitiveValue::operator LineAlign):
+        * css/CSSProperty.cpp:
+        (WebCore::CSSProperty::isInheritedProperty):
+        * css/CSSPropertyNames.in:
+        * css/CSSStyleApplyProperty.cpp:
+        (WebCore::CSSStyleApplyProperty::CSSStyleApplyProperty):
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::applyProperty):
+        * css/CSSValueKeywords.in:
+        * rendering/style/RenderStyle.cpp:
+        (WebCore::RenderStyle::diff):
+        * rendering/style/RenderStyle.h:
+        * rendering/style/RenderStyleConstants.h:
+        * rendering/style/StyleRareInheritedData.cpp:
+        (WebCore::StyleRareInheritedData::StyleRareInheritedData):
+        (WebCore::StyleRareInheritedData::operator==):
+        * rendering/style/StyleRareInheritedData.h:
+        (StyleRareInheritedData):
+
+2012-02-17  Emil A Eklund  <eae@chromium.org>
+
+        Add FractionalLayoutSize for sub-pixel layout
+        https://bugs.webkit.org/show_bug.cgi?id=78852
+
+        Reviewed by Eric Seidel.
+
+        Add FractionalLayoutUnit version of Size class and a couple of
+        conversion methods to the Int and Float versions of same.
+
+        No new tests.
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * platform/graphics/FloatPoint.cpp:
+        (WebCore::FloatPoint::move):
+        Add FractionalLayoutSize version of move.
+
+        * platform/graphics/FloatPoint.h:
+        * platform/graphics/FloatSize.cpp:
+        (WebCore::FloatSize::FloatSize):
+        Add FloatSize(FractionalLayoutSize) constructor.
+
+        * platform/graphics/FloatSize.h:
+        * platform/graphics/FractionalLayoutSize.cpp: Added.
+        * platform/graphics/FractionalLayoutSize.h: Added.
+
+2012-02-17  Enrica Casucci  <enrica@apple.com>
+
+        REGRESSION (r107606): Copy Link writes malformed WebURLsWithTitlesPboardType
+        data to the pasteboard.
+        https://bugs.webkit.org/show_bug.cgi?id=78933
+        <rdar://problem/10874553>
+        
+        For this format, the data needs to be placed in the pasteboard as array of arrays
+        of strings. Currently is it stored as array of strings, which causes the code
+        that uses this format to break.
+        
+        Reviewed by Ryosuke Niwa.
+
+        * platform/mac/PlatformPasteboardMac.mm:
+        (WebCore::PlatformPasteboard::setPathnamesForType):
+
+2012-02-17  Abhishek Arya  <inferno@chromium.org>
+
+        Incorrect placement of a new child when beforeChild and its
+        previous sibling are in the same table.
+        https://bugs.webkit.org/show_bug.cgi?id=78269
+
+        Reviewed by Julien Chaffraix.
+
+        Tests: fast/table/table-cell-split.html
+               fast/table/table-row-split.html
+               fast/table/table-section-split-with-after-content.html
+               fast/table/table-section-split.html
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::splitAnonymousBlocksAroundChild): add
+        call to splitTablePartsAroundChild to take care of splitting the
+        table first if the child is part of table.
+        (WebCore::markTableForSectionAndCellRecalculation): add helper to
+        mark table for complete relayout by invalidating sections and cells.
+        (WebCore):
+        (WebCore::moveAllTableChildrenTo): moves children to another table.
+        (WebCore::RenderBlock::splitTablePartsAroundChild): split table child
+        and its next siblings into a new table. This allows adding a new
+        non-table child between the tables.
+        (WebCore::RenderBlock::addChildIgnoringAnonymousColumnBlocks): calls
+        splitTablePartsAroundChild to see if we need to split the table
+        for adding this new child.
+        * rendering/RenderBlock.h:
+        (RenderBlock):
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::createAnonymousTable): add helper for
+        creating anonymous table.
+        (WebCore):
+        (WebCore::RenderObject::addChild): use the new helper for creating
+        anonymous table.
+        * rendering/RenderObject.h:
+        (WebCore):
+        (RenderObject):
+        (WebCore::RenderObject::isTablePart): add helper to tell if the object
+        is a table part.
+
+2012-02-17  Andreas Kling  <awesomekling@apple.com>
+
+        Element: Inline style selector and AX invalidation in attributeChanged().
+        <http://webkit.org/b/78888>
+
+        Reviewed by Antti Koivisto.
+
+        Inline the updateAfterAttributeChanged() and recalcStyleIfNeededAfterAttributeChanged()
+        methods into Element::attributeChanged(). They were separated when we needed them in
+        StyledElement::attributeChanged(), but that's no longer the case.
+
+        * dom/Element.cpp:
+        (WebCore::Element::attributeChanged):
+        * dom/Element.h:
+
+2012-02-17  David Reveman  <reveman@chromium.org>
+
+        [Chromium] Texture eviction doesn't show up in traces.
+        https://bugs.webkit.org/show_bug.cgi?id=78851
+
+        Reviewed by James Robinson.
+
+        Add TextureManager::evictTexture() function with TRACE statement so
+        that texture eviction shows up in traces.
+
+        No new tests.
+
+        * platform/graphics/chromium/TextureManager.cpp:
+        (WebCore::TextureManager::evictTexture):
+        (WebCore):
+        (WebCore::TextureManager::reduceMemoryToLimit):
+        * platform/graphics/chromium/TextureManager.h:
+        (TextureManager):
+
+2012-02-17  Kalev Lember  <kalevlember@gmail.com>
+
+        Remove unused parameters from WTF threading API
+        https://bugs.webkit.org/show_bug.cgi?id=78389
+
+        Reviewed by Adam Roben.
+
+        waitForThreadCompletion() had an out param 'void **result' to get the
+        'void *' returned by ThreadFunction. However, the implementation in
+        ThreadingWin.cpp ignored the out param, not filling it in. This had
+        led to a situation where none of the client code made use of the param
+        and just ignored it.
+
+        To clean this up, the patch changes the signature of ThreadFunction to
+        return void instead of void* and drops the the unused 'void **result'
+        parameter from waitForThreadCompletion. Also, all client code is
+        updated for the API change.
+
+        As mentioned in https://bugs.webkit.org/show_bug.cgi?id=78389 , even
+        though the change only affects internal API, Safari is using it
+        directly and we'll need to keep the old versions around for ABI
+        compatibility. For this, the patch adds compatibility wrappers with
+        the old ABI.
+
+        * bindings/js/GCController.cpp:
+        (WebCore::collect):
+        (WebCore::GCController::garbageCollectOnAlternateThreadForDebugging):
+        * fileapi/FileThread.cpp:
+        (WebCore::FileThread::fileThreadStart):
+        (WebCore::FileThread::runLoop):
+        * fileapi/FileThread.h:
+        (FileThread):
+        * loader/icon/IconDatabase.cpp:
+        (WebCore::IconDatabase::close):
+        (WebCore::IconDatabase::iconDatabaseSyncThreadStart):
+        (WebCore::IconDatabase::iconDatabaseSyncThread):
+        (WebCore::IconDatabase::syncThreadMainLoop):
+        * loader/icon/IconDatabase.h:
+        (IconDatabase):
+        * page/scrolling/ScrollingThread.cpp:
+        (WebCore::ScrollingThread::threadCallback):
+        * page/scrolling/ScrollingThread.h:
+        (ScrollingThread):
+        * platform/audio/HRTFDatabaseLoader.cpp:
+        (WebCore::databaseLoaderEntry):
+        (WebCore::HRTFDatabaseLoader::waitForLoaderThreadCompletion):
+        * platform/audio/ReverbConvolver.cpp:
+        (WebCore::backgroundThreadEntry):
+        (WebCore::ReverbConvolver::~ReverbConvolver):
+        * platform/network/cf/LoaderRunLoopCF.cpp:
+        (WebCore::runLoaderThread):
+        * storage/DatabaseThread.cpp:
+        (WebCore::DatabaseThread::databaseThreadStart):
+        (WebCore::DatabaseThread::databaseThread):
+        * storage/DatabaseThread.h:
+        (DatabaseThread):
+        * storage/LocalStorageThread.cpp:
+        (WebCore::LocalStorageThread::threadEntryPointCallback):
+        (WebCore::LocalStorageThread::threadEntryPoint):
+        (WebCore::LocalStorageThread::terminate):
+        * storage/LocalStorageThread.h:
+        (LocalStorageThread):
+        * webaudio/AsyncAudioDecoder.cpp:
+        (WebCore::AsyncAudioDecoder::~AsyncAudioDecoder):
+        (WebCore::AsyncAudioDecoder::threadEntry):
+        * webaudio/AsyncAudioDecoder.h:
+        (AsyncAudioDecoder):
+        * webaudio/OfflineAudioDestinationNode.cpp:
+        (WebCore::OfflineAudioDestinationNode::uninitialize):
+        (WebCore::OfflineAudioDestinationNode::renderEntry):
+        * webaudio/OfflineAudioDestinationNode.h:
+        (OfflineAudioDestinationNode):
+        * workers/WorkerThread.cpp:
+        (WebCore::WorkerThread::workerThreadStart):
+        (WebCore::WorkerThread::workerThread):
+        * workers/WorkerThread.h:
+        (WorkerThread):
+
+2012-02-17  Robert Hogan  <robert@webkit.org>
+
+        AppleMac Build fix for r108111
+
+        Remove variable that is now unused.
+
+        Unreviewed, build fix.
+
+        * rendering/RenderBlockLineLayout.cpp:
+        (WebCore::alwaysRequiresLineBox): Remove lineInfo
+        (WebCore::requiresLineBox): 
+        (WebCore::RenderBlock::LineBreaker::nextLineBreak):
+
+2012-02-17  Michal Mocny  <mmocny@google.com>
+
+        [chromium] GL_CHROMIUM_gpu_memory_manager extension
+        https://bugs.webkit.org/show_bug.cgi?id=77155
+
+        Reviewed by James Robinson.
+
+        * platform/graphics/chromium/Extensions3DChromium.h:
+        (GpuMemoryAllocationChangedCallbackCHROMIUM):
+        (WebCore::Extensions3DChromium::GpuMemoryAllocationChangedCallbackCHROMIUM::~GpuMemoryAllocationChangedCallbackCHROMIUM):
+        (Extensions3DChromium):
+
+2012-01-23  Robert Hogan  <robert@webkit.org>
+
+        REGRESSION: empty span creates renders with non-zero height
+        https://bugs.webkit.org/show_bug.cgi?id=76465
+
+        Reviewed by David Hyatt.
+
+        Tests: fast/css/empty-span.html
+               fast/css/non-empty-span.html
+
+        Empty inlines with line-height, vertical-alignment or font metrics should only get a linebox if there is some
+        other content in the line. So only create line boxes for such elements on lines that are not empty.
+
+        This patch fixes a regression where an empty inline with line-height was propagating its height to an empty line.
+        It also fixes cases where lines with content that had a leading empty inline element weren't respecting the 
+        vertical alignment or font-height of the empty inline.
+
+        * rendering/RenderBlockLineLayout.cpp:
+        (WebCore::RenderBlock::constructLine): only create line boxes for lines that are not empty.
+        (WebCore::requiresLineBoxForContent): an inline flow with line-height, vertical-alignment, or font-size
+         will need a linebox if the rest of the line is not empty.
+        (WebCore):
+        (WebCore::alwaysRequiresLineBox): rename from inlineFlowRequiresLineBox.
+        (WebCore::requiresLineBox):
+        (WebCore::RenderBlock::LineBreaker::nextLineBreak): if the inline flow definitely requires a line, mark
+         the line non-empty - otherwise hold off.
+
+2012-02-17  Raymond Toy  <rtoy@google.com>
+
+        RealtimeAnalyserNode does not consistently respect .minDecibels
+        https://bugs.webkit.org/show_bug.cgi?id=78729
+
+        Make use of m_minDecibel consistent.  Clean up some style issues
+        with names of local variables and style issues with float
+        constants.
+        
+        Reviewed by Chris Rogers.
+
+        No new tests because the changes are cosmetic for style issues.
+
+        * webaudio/RealtimeAnalyser.cpp:
+        (WebCore):
+        (WebCore::RealtimeAnalyser::doFFTAnalysis):
+        (WebCore::RealtimeAnalyser::getFloatFrequencyData):
+        (WebCore::RealtimeAnalyser::getByteFrequencyData):
+        (WebCore::RealtimeAnalyser::getByteTimeDomainData):
+
+2012-02-17  Abhishek Arya  <inferno@chromium.org>
+
+        :before content incorrectly placed in continuation
+        when we don't have a first child.
+        https://bugs.webkit.org/show_bug.cgi?id=78380
+
+        Reviewed by David Hyatt.
+
+        Test: fast/css-generated-content/before-content-continuation-chain.html
+
+        * rendering/RenderObjectChildList.cpp:
+        (WebCore::RenderObjectChildList::updateBeforeAfterContent):
+
+2012-02-17  Mihnea Ovidenie  <mihnea@adobe.com>
+
+        CSS regions enabled by default
+        https://bugs.webkit.org/show_bug.cgi?id=78525
+
+        Reviewed by David Hyatt.
+
+        Test: fast/regions/css-regions-disabled.html
+
+        Add a runtime preference to enable/disable regions functionality at runtime(WebKitCSSRegionsEnabled).
+        CSSRegions are still enabled by default.
+        In DRT, use layoutTestController.overridePreference("WebKitCSSRegionsEnabled", "0") to disable the css regions functionality.
+
+        * WebCore.xcodeproj/project.pbxproj:
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseValue):
+        (WebCore::CSSParser::cssRegionsEnabled):
+        (WebCore):
+        (WebCore::CSSParser::parseFlowThread):
+        (WebCore::CSSParser::parseRegionThread):
+        (WebCore::CSSParser::createRegionRule):
+        * css/CSSParser.h:
+        * dom/Document.cpp:
+        (WebCore::Document::cssRegionsEnabled):
+        (WebCore):
+        (WebCore::Document::webkitGetFlowByName):
+        * dom/Document.h:
+        (Document):
+        * dom/Element.cpp:
+        (WebCore::Element::webkitRegionOverflow):
+        * dom/NodeRenderingContext.cpp:
+        (WebCore::NodeRenderingContext::moveToFlowThreadIfNeeded):
+        * page/Settings.cpp:
+        (WebCore::Settings::Settings):
+        * page/Settings.h:
+        (WebCore::Settings::setCSSRegionsEnabled):
+        (WebCore::Settings::cssRegionsEnabled):
+        (Settings):
+        * rendering/RenderFlowThread.cpp:
+        (WebCore::RenderFlowThread::RenderFlowThread):
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::createObject):
+        * rendering/RenderRegion.cpp:
+        (WebCore::RenderRegion::RenderRegion):
+
+2012-02-17  Mihnea Ovidenie  <mihnea@adobe.com>
+
+        [CSSRegions]Implement NamedFlow::overflow
+        https://bugs.webkit.org/show_bug.cgi?id=78880
+
+        Reviewed by David Hyatt.
+
+        Test: fast/regions/webkit-named-flow-overflow.html
+
+        * dom/WebKitNamedFlow.cpp:
+        (WebCore::WebKitNamedFlow::WebKitNamedFlow):
+        (WebCore::WebKitNamedFlow::overflow):
+        (WebCore):
+        * dom/WebKitNamedFlow.h:
+        (WebCore):
+        (WebCore::WebKitNamedFlow::create):
+        (WebKitNamedFlow):
+        * dom/WebKitNamedFlow.idl:
+        * rendering/RenderFlowThread.cpp:
+        (WebCore::RenderFlowThread::RenderFlowThread):
+        (WebCore::RenderFlowThread::ensureNamedFlow):
+        (WebCore::RenderFlowThread::computeOverflowStateForRegions):
+        * rendering/RenderFlowThread.h:
+
+2012-02-17  Joe Thomas  <joethomas@motorola.com>
+
+        flex-wrap:nowrap should be flex-wrap:none
+        https://bugs.webkit.org/show_bug.cgi?id=78772
+
+        As per the spec http://dev.w3.org/csswg/css3-flexbox/#flex-wrap0, flex-wrap:nowrap should be changed to flex-wrap:none.
+
+        Reviewed by Ojan Vafai.
+
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseValue):
+        * css/CSSPrimitiveValueMappings.h:
+        (WebCore::CSSPrimitiveValue::CSSPrimitiveValue):
+        (WebCore::CSSPrimitiveValue::operator EFlexWrap):
+        * css/CSSValueKeywords.in:
+        * rendering/style/RenderStyle.h:
+        * rendering/style/RenderStyleConstants.h:
+
+2012-02-17  Enrica Casucci  <enrica@apple.com>
+
+        Refactor DragData class to use PlatformStrategies in the Mac implementation.
+        https://bugs.webkit.org/show_bug.cgi?id=78768
+
+        Reviewed by Darin Adler.
+
+        No new tests. No behavior change.
+
+        * WebCore.exp.in: Added new exported method of the PlatformPasteboard class.
+        * platform/DragData.h:
+        (WebCore::DragData::pasteboardName): Added pasteboardName and removed pasteboard.
+        * platform/PasteboardStrategy.h: Added color() method.
+        * platform/PlatformPasteboard.h: Ditto.
+        * platform/mac/ClipboardMac.mm:
+        (WebCore::Clipboard::create): Changed to use pasteboardName() method.
+        * platform/mac/DragDataMac.mm: All the methods below have been changed to use pasteboardName
+        and the pasteboardStrategy() methods.
+        (WebCore::DragData::DragData):
+        (WebCore::DragData::canSmartReplace):
+        (WebCore::DragData::containsColor):
+        (WebCore::DragData::containsFiles):
+        (WebCore::DragData::numberOfFiles):
+        (WebCore::DragData::asFilenames):
+        (WebCore::DragData::containsPlainText):
+        (WebCore::DragData::asPlainText):
+        (WebCore::DragData::asColor):
+        (WebCore::DragData::containsCompatibleContent):
+        (WebCore::DragData::asURL):
+        (WebCore::DragData::asFragment):
+        * platform/mac/PlatformPasteboardMac.mm:
+        (WebCore::PlatformPasteboard::color): Added implementation of the color() method.
+
+2012-02-17  Nate Chapin  <japhet@chromium.org>
+
+        [Chromium mac] Cursors and background images disappear.
+        https://bugs.webkit.org/show_bug.cgi?id=78834
+
+        The issue occurs because a CachedImage sees that it has no clients
+        and decide it is safe to purge its m_data buffer. However,
+        StyleCachedImage is holding a CachedResourceHandle to the
+        CachedImage, and it can still add a client later. If it does so,
+        the CachedImage says everything is loaded but has no data.
+
+        Reviewed by Adam Barth.
+
+        No new tests, since the known repros have resisted reduction.
+        Tested manually with chrome.angrybirds.com, redfin.com and a
+        couple of other sites.
+
+        * rendering/style/StyleCachedImage.cpp:
+        * rendering/style/StyleCachedImage.h: Ensure the underlying
+            CachedImage has a client for the lifetime of the
+            StyleCachedImage and doesn't purge its buffer. Call
+            addClient(this) in the constructor and removeClient(this) in
+            the destructor, then ignore all cache callbacks.
+
+2012-02-17  Julien Chaffraix  <jchaffraix@webkit.org>
+
+        Table cell's anonymous wrappers are left in the tree, impacting our layout
+        https://bugs.webkit.org/show_bug.cgi?id=7180
+
+        Reviewed by David Hyatt.
+
+        Tests: fast/table/table-switch-cell-position-bad-layout-expected.html
+               fast/table/table-switch-cell-position-bad-layout.html
+
+        This patch implements cell's anonymous wrapper removal at detach time.
+
+        Trimming the render tree when we remove objects from it would be more complex
+        to generalize as several objects override the behavior to do their own clean-ups.
+        This would also open more potential for programming errors.
+
+        This change is limited to table cells' as a simple step towards fixing bug 52123
+        and more generally eliminate some anonymous wrappers from the tree at detach time.
+
+        * dom/Node.cpp:
+        (WebCore::Node::detach):
+        Patched detach to call destroyAndCleanupAnonymousWrappers. The Document does not need
+        to clean up any anonymous wrappers on detach.
+
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::destroyAndCleanupAnonymousWrappers):
+        Added this method to wrap destroy() call and trim the render tree. To avoid slowing down
+        detach in some cases, added a fast path.
+
+        * rendering/RenderObject.h: Added destroyAndCleanupAnonymousWrappers.
+
+2012-02-17  Rob Buis  <rbuis@rim.com>
+
+        ASSERT (and crash) with dynamically moved <font-face>
+        https://bugs.webkit.org/show_bug.cgi?id=64839
+
+        Reviewed by Antti Koivisto.
+
+        Reset the style declaration when rmeoving the font-face element from the document.
+
+        Test: svg/custom/font-face-move.svg
+
+        * svg/SVGFontFaceElement.cpp:
+        (WebCore::SVGFontFaceElement::removedFromDocument):
+
+2012-02-17  Martin Robinson  <mrobinson@igalia.com>
+
+        Fix some warnings encountered during the GTK+ build
+        https://bugs.webkit.org/show_bug.cgi?id=78911
+
+        Reviewed by Xan Lopez.
+
+        No new tests. These are just fixes for warnings.
+
+        * page/GestureTapHighlighter.cpp: Avoid using potentially signed operations on
+        a size_t type. Use size_t for iterating over members of a vector.
+        * platform/graphics/texmap/TextureMapperBackingStore.cpp: Use size_t where necessary.
+        (WebCore::TextureMapperTiledBackingStore::createOrDestroyTilesIfNeeded): Ditto.
+        * platform/graphics/texmap/TextureMapperLayer.cpp: Ditto.
+        (WebCore::TextureMapperLayer::computeTransformsRecursive): Ditto.
+        (WebCore::TextureMapperLayer::paintSelfAndChildren): Ditto.
+        (WebCore::TextureMapperLayer::intermediateSurfaceRect): Ditto.
+
+2012-02-17  Tim Dresser  <tdresser@chromium.org>
+
+        [chromium] Refactor video drawing to be more data driven
+        https://bugs.webkit.org/show_bug.cgi?id=76720
+
+        Reviewed by James Robinson.
+
+        CCVideoLayerImpl no longer handles drawing itself, but produces a list of CCVideoDrawQuads.
+        These quads are then drawn by LayerRendererChromium.
+
+        CCLayerImpl::willDraw(LayerRendererChromium*) is called directly before appendQuads.
+        CCLayerImpl::didDraw() is called directly after all drawing has been completed.
+        CCLayerImpl::draw has been removed.
+
+        willDraw and didDraw are used to handle interaction with the VideoFrameProvider
+        in CCVideoLayerImpl. willDraw gets a frame from the VideoFrameProvider, and
+        didDraw returns it.
+
+        A unit test has been added: CCLayerTreeHostImplTest.didDrawCalledOnAllLayers.
+        This test ensures that CCLayerImpl::didDraw() is called on all layers,
+        including layers on different render surfaces.
+
+        As this was a refactor, no other tests were added.
+
+        * platform/graphics/chromium/LayerRendererChromium.cpp:
+        (WebCore::LayerRendererChromium::drawYUV):
+        (WebCore):
+        (WebCore::LayerRendererChromium::drawSingleTextureVideoQuad):
+        (WebCore::LayerRendererChromium::drawRGBA):
+        (WebCore::LayerRendererChromium::drawNativeTexture):
+        (WebCore::LayerRendererChromium::copyFrameToTextures):
+        (WebCore::LayerRendererChromium::copyPlaneToTexture):
+        (WebCore::LayerRendererChromium::drawVideoQuad):
+        * platform/graphics/chromium/LayerRendererChromium.h:
+        (LayerRendererChromium):
+        * platform/graphics/chromium/cc/CCLayerImpl.cpp:
+        * platform/graphics/chromium/cc/CCLayerImpl.h:
+        (WebCore::CCLayerImpl::didDraw):
+        (CCLayerImpl):
+        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.cpp:
+        (WebCore::CCLayerTreeHostImpl::calculateRenderPasses):
+        (WebCore::CCLayerTreeHostImpl::drawLayers):
+        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.h:
+        (CCLayerTreeHostImpl):
+        * platform/graphics/chromium/cc/CCVideoDrawQuad.cpp:
+        (WebCore::CCVideoDrawQuad::create):
+        (WebCore::CCVideoDrawQuad::CCVideoDrawQuad):
+        * platform/graphics/chromium/cc/CCVideoDrawQuad.h:
+        (CCVideoDrawQuad):
+        (WebCore::CCVideoDrawQuad::textures):
+        (WebCore::CCVideoDrawQuad::frame):
+        (WebCore::CCVideoDrawQuad::format):
+        * platform/graphics/chromium/cc/CCVideoLayerImpl.cpp:
+        (WebCore::CCVideoLayerImpl::willDraw):
+        (WebCore::CCVideoLayerImpl::appendQuads):
+        (WebCore::CCVideoLayerImpl::didDraw):
+        (WebCore::CCVideoLayerImpl::computeVisibleSize):
+        * platform/graphics/chromium/cc/CCVideoLayerImpl.h:
+        (CCVideoLayerImpl):
+        (WebCore::CCVideoLayerImpl::providerMutex):
+        (WebCore::CCVideoLayerImpl::provider):
+        (Texture):
+
+2012-02-17  Stephen Chenney  <schenney@chromium.org>
+
+        Crash at WebCore::SVGUseElement::expandSymbolElementsInShadowTree
+        https://bugs.webkit.org/show_bug.cgi?id=77639
+
+        Reviewed by Nikolas Zimmermann.
+
+        Fix a SVG crash in Release builds, although it still crashes in Debug builds.
+        The crash occurred when an SVG use element attempted to reference a style element while the file
+        contained an error causing the error banner to display. The fix is to prevent SVGUseElement
+        from recalculating style during tree building and return immediately when style is recalculated and
+        the tree is building.
+
+        Test: svg/custom/use-referencing-style-crash.svg
+
+        * svg/SVGUseElement.cpp:
+        (WebCore::SVGUseElement::willRecalcStyle): Return false if the tree is being built.
+        (WebCore::SVGUseElement::didRecalcStyle): Check and return if the tree
+        is being built and we are not yet ready for style update.
+
+2012-02-17  Ilya Tikhonovsky  <loislo@chromium.org>
+
+        Unreviewed, rolling out r108077.
+        http://trac.webkit.org/changeset/108077
+        https://bugs.webkit.org/show_bug.cgi?id=78390
+
+        it broke compilation.
+
+        * inspector/CodeGeneratorInspector.py:
+        * inspector/InjectedScript.cpp:
+        (WebCore::InjectedScript::evaluateOnCallFrame):
+        (WebCore::InjectedScript::getFunctionDetails):
+        (WebCore::InjectedScript::getProperties):
+        (WebCore::InjectedScript::wrapCallFrames):
+        * inspector/InjectedScript.h:
+        (InjectedScript):
+        * inspector/InspectorDebuggerAgent.cpp:
+        (WebCore::InspectorDebuggerAgent::setBreakpointByUrl):
+        (WebCore::InspectorDebuggerAgent::resolveBreakpoint):
+        (WebCore::InspectorDebuggerAgent::getFunctionDetails):
+        (WebCore::InspectorDebuggerAgent::evaluateOnCallFrame):
+        (WebCore::InspectorDebuggerAgent::currentCallFrames):
+        (WebCore::InspectorDebuggerAgent::didParseSource):
+        * inspector/InspectorDebuggerAgent.h:
+        (InspectorDebuggerAgent):
+
+2012-02-17  Florin Malita  <fmalita@google.com>
+
+        chrome.dll!WebCore::SVGTRefElement::updateReferencedText ReadAV@NULL (e85cb8e140071fa7790cad215b0109dc)
+        https://bugs.webkit.org/show_bug.cgi?id=74858
+
+        Reviewed by Nikolas Zimmermann.
+
+        Tests: svg/custom/tref-remove-target-crash-expected.svg
+               svg/custom/tref-remove-target-crash.svg
+
+        Add a DOMNodeRemovedFromDocumentEvent listener to detect when the target element is removed. Upon removal,
+        cleanup all listeners and re-activate the pending resource to attach if the referenced ID is added
+        at a later time programmatically. Also move the DOMSubtreeModifiedEvent listener from the parent to
+        the target element to simplify the implementation and reduce the scope.
+
+        * svg/SVGTRefElement.cpp:
+        (WebCore::TargetListener::create):
+        (WebCore::TargetListener::cast):
+        (WebCore::TargetListener::clear):
+        (WebCore::TargetListener::TargetListener):
+        (WebCore::TargetListener::operator==):
+        (WebCore::TargetListener::handleEvent):
+        (WebCore::SVGTRefElement::detachTarget):
+        (WebCore::SVGTRefElement::buildPendingResource):
+        * svg/SVGTRefElement.h:
+
+2012-02-17  Simon Fraser  <simon.fraser@apple.com>
+
+        Fix the build after r108077.
+
+        * inspector/CodeGeneratorInspector.py:
+        (RawTypes.Any.generate_validate_method):
+
+2012-02-17  Simon Fraser  <simon.fraser@apple.com>
+
+        Avoid using a transparency layer for rgba() border drawing when possible
+        https://bugs.webkit.org/show_bug.cgi?id=63176
+
+        Reviewed by Dan Bernstein.
+        
+        The non-radiused border drawing code would use a transparency layer
+        when drawing any one or more borders with alpha colors. However,
+        we only need to use a transparency layer when there is a corner
+        join between the borders being rendered with any one color,
+        so add a utility function includesAdjacentEdges() that can tell us
+        that, and use it to avoid making extraneous transparency layers.
+
+        Optimization only, no new tests.
+
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::includesAdjacentEdges):
+        (WebCore):
+        (WebCore::RenderBoxModelObject::paintTranslucentBorderSides):
+
+2012-02-17  Pavel Feldman  <pfeldman@google.com>
+
+        Not reviewed: Qt minimal build fix.
+
+        * inspector/InjectedScript.h:
+        (WebCore):
+
+2012-02-17  Peter Rybin  <peter.rybin@gmail.com>
+
+        Web Inspector: Switch Debugger agent to TypeBuilder
+        https://bugs.webkit.org/show_bug.cgi?id=78390
+
+        Reviewed by Vsevolod Vlasov.
+
+        Client code is switched to TypeBuilder.
+
+        * inspector/CodeGeneratorInspector.py:
+        * inspector/InjectedScript.cpp:
+        (WebCore::InjectedScript::evaluateOnCallFrame):
+        (WebCore::InjectedScript::getFunctionDetails):
+        (WebCore::InjectedScript::getProperties):
+        (WebCore::InjectedScript::wrapCallFrames):
+        * inspector/InjectedScript.h:
+        (InjectedScript):
+        * inspector/InspectorDebuggerAgent.cpp:
+        (WebCore::InspectorDebuggerAgent::setBreakpointByUrl):
+        (WebCore::InspectorDebuggerAgent::resolveBreakpoint):
+        (WebCore::InspectorDebuggerAgent::getFunctionDetails):
+        (WebCore::InspectorDebuggerAgent::evaluateOnCallFrame):
+        (WebCore::InspectorDebuggerAgent::currentCallFrames):
+        (WebCore::InspectorDebuggerAgent::didParseSource):
+        * inspector/InspectorDebuggerAgent.h:
+        (InspectorDebuggerAgent):
+
+2012-02-17  Pavel Feldman  <pfeldman@google.com>
+
+        Web Inspector: hide color picker on selected node update.
+        https://bugs.webkit.org/show_bug.cgi?id=78896
+
+        Reviewed by Vsevolod Vlasov.
+
+        * inspector/front-end/Spectrum.js:
+        (WebInspector.Spectrum.prototype.get visible):
+        (WebInspector.Spectrum.prototype.toggle):
+        (WebInspector.Spectrum.prototype.show):
+        * inspector/front-end/StylesSidebarPane.js:
+        (WebInspector.StylesSidebarPane.prototype.update):
+        (WebInspector.StylePropertyTreeElement.prototype.updateTitle.):
+
+2012-02-17  Pavel Feldman  <pfeldman@google.com>
+
+        Web Inspector: check undo-redo boundaries based on current action index, not history size.
+        https://bugs.webkit.org/show_bug.cgi?id=78895
+
+        Reviewed by Vsevolod Vlasov.
+
+        Tests: inspector/elements/perform-undo-undo.html
+               inspector/styles/perform-undo-perform-of-mergable-action.html
+
+        * inspector/InspectorHistory.cpp:
+        (WebCore::InspectorHistory::perform):
+
+2012-02-17  Ilya Tikhonovsky  <loislo@chromium.org>
+
+        Unreviewed, rolling out r108071.
+        http://trac.webkit.org/changeset/108071
+        https://bugs.webkit.org/show_bug.cgi?id=77155
+
+        chromium-mac compilation failed
+
+        * platform/graphics/chromium/Extensions3DChromium.h:
+
+2012-02-17  Michal Mocny  <mmocny@google.com>
+
+        [chromium] GL_CHROMIUM_gpu_memory_manager extension
+        https://bugs.webkit.org/show_bug.cgi?id=77155
+
+        Reviewed by James Robinson.
+
+        * platform/graphics/chromium/Extensions3DChromium.h:
+        (GpuMemoryAllocationChangedCallbackCHROMIUM):
+        (WebCore::Extensions3DChromium::GpuMemoryAllocationChangedCallbackCHROMIUM::~GpuMemoryAllocationChangedCallbackCHROMIUM):
+        (Extensions3DChromium):
+
+2012-02-17  Raphael Kubo da Costa  <kubo@profusion.mobi>
+
+        [CMake, EFL] Unreviewed, fix the build when building with
+        SHARED_CORE=ON after r107820.
+
+        RunLoopEfl.cpp has not been upstreamed yet, and building only
+        RunLoop.cpp created an .so with some missing, unimplemented
+        symbols. The BlackBerry port seems to be in the same situation.
+
+        The best solution for now is to build RunLoop.cpp only on the
+        WinCE port.
+
+        * CMakeLists.txt: Remove RunLoop.cpp from the list of files to build.
+        * PlatformWinCE.cmake: Add RunLoop.cpp to the list of files to build.
+
+2012-02-17  Pavel Feldman  <pfeldman@google.com>
+
+        Web Inspector: a bit of color picker polish
+        https://bugs.webkit.org/show_bug.cgi?id=78892
+
+        - Fixed computed style swatch
+        - Removed color: caption
+        - Rendered value as source code, user-selectable
+        - Removed scroller gap
+
+        Reviewed by Yury Semikhatsky.
+
+        * English.lproj/localizedStrings.js:
+        * inspector/front-end/Popover.js:
+        (WebInspector.Popover.prototype.setCanShrink):
+        (WebInspector.Popover.prototype._positionElement):
+        * inspector/front-end/Spectrum.js:
+        * inspector/front-end/StylesSidebarPane.js:
+        (WebInspector.StylePropertyTreeElement.prototype._resetMouseDownElement):
+        (WebInspector.StylePropertyTreeElement.prototype.updateTitle.):
+        * inspector/front-end/elementsPanel.css:
+        (.spectrum-container):
+        (.spectrum-display-value):
+        (.spectrum-range-container):
+        * inspector/front-end/popover.css:
+        (.popover .content.fixed-height):
+
+2012-02-17  Pavel Feldman  <pfeldman@google.com>
+
+        Web Inspector: color picker does not allow changing the color.
+        https://bugs.webkit.org/show_bug.cgi?id=78886
+
+        Reviewed by Vsevolod Vlasov.
+
+        * inspector/front-end/ElementsPanel.js:
+        (WebInspector.ElementsPanel.prototype._showPopover.showPopover):
+        * inspector/front-end/Popover.js:
+        (WebInspector.Popover.prototype.setCanShrink):
+        (WebInspector.Popover.prototype._positionElement):
+        * inspector/front-end/Settings.js:
+        * inspector/front-end/Spectrum.js:
+        * inspector/front-end/StylesSidebarPane.js:
+        (WebInspector.StylesSidebarPane):
+        (WebInspector.StylePropertyTreeElement.prototype.updateTitle.):
+
+2012-02-17  Pavel Feldman  <pfeldman@google.com>
+
+        Web Inspector: new image preview has poorly positioned popover arrow.
+        https://bugs.webkit.org/show_bug.cgi?id=78884
+
+        Reviewed by Vsevolod Vlasov.
+
+        * inspector/front-end/Popover.js:
+        (WebInspector.Popover.prototype._positionElement):
+        * inspector/front-end/utilities.js:
+        (Element.prototype.boxInWindow):
+
+2012-02-17  Pavel Feldman  <pfeldman@google.com>
+
+        Web Inspector: enable "Single click CSS editing" experiment by default.
+        https://bugs.webkit.org/show_bug.cgi?id=78881
+
+        Reviewed by Vsevolod Vlasov.
+
+        * inspector/front-end/elementsPanel.css:
+        (.styles-section .properties .enabled-button):
+
+2012-02-17  Pavel Feldman  <pfeldman@google.com>
+
+        Web Inspector: split innerUpdate into rebuildUpdate and refreshUpdate, make computed styles load lazily.
+        https://bugs.webkit.org/show_bug.cgi?id=78827
+
+        Reviewed by Vsevolod Vlasov.
+
+        * inspector/front-end/StylesSidebarPane.js:
+        (WebInspector.StylesSidebarPane.prototype.update):
+        (WebInspector.StylesSidebarPane.prototype._refreshUpdate.computedStyleCallback):
+        (WebInspector.StylesSidebarPane.prototype._refreshUpdate):
+        (WebInspector.StylesSidebarPane.prototype._rebuildUpdate):
+        (WebInspector.StylesSidebarPane.prototype._validateNode):
+        (WebInspector.StylesSidebarPane.prototype._styleSheetOrMediaQueryResultChanged):
+        (WebInspector.StylesSidebarPane.prototype._attributesModified):
+        (WebInspector.StylesSidebarPane.prototype._attributesRemoved):
+        (WebInspector.StylesSidebarPane.prototype._styleInvalidated):
+        (WebInspector.StylesSidebarPane.prototype._innerRefreshUpdate):
+        (WebInspector.StylesSidebarPane.prototype._innerRebuildUpdate):
+        (WebInspector.StylesSidebarPane.prototype._nodeStylesUpdatedForTest):
+        (WebInspector.StylesSidebarPane.prototype._toggleElementStatePane):
+        (WebInspector.StylesSidebarPane.prototype._createElementStatePane.clickListener):
+        (WebInspector.StylesSidebarPane.prototype._showUserAgentStylesSettingChanged):
+        (WebInspector.ComputedStyleSidebarPane.prototype.expand):
+        (WebInspector.StylePropertyTreeElement.prototype):
+
+2012-02-17  No'am Rosenthal  <noam.rosenthal@nokia.com>
+
+        [Qt][WK2] Allow partial updates
+        https://bugs.webkit.org/show_bug.cgi?id=78824
+
+        BitmapTextureGL should not zero-fill the textures when resetting.
+        This was needed in the previous buffer management system, where texture were not completely
+        filled by the backing store.
+
+        Reviewed by Simon Hausmann.
+
+        No new behavior.
+
+        * platform/graphics/opengl/TextureMapperGL.cpp:
+        (BitmapTextureGL):
+        (WebCore::texSubImage2DResourceSafe):
+        (WebCore):
+        (WebCore::BitmapTextureGL::reset):
+
+2012-02-17  Yosifumi Inoue  <yosin@chromium.org>
+
+        [Forms] Integrate InputType::dispatchChangeEventInResponseToSetValue into InputType::setValue
+        https://bugs.webkit.org/show_bug.cgi?id=78873
+
+        Reviewed by Kent Tamura.
+
+        This patch moves event dispatch logic to InputType and TextFieldInputType from HTMLInputElement
+        and merge dispatchChangeEventInResponseToSetValue to setValue.
+
+        No new tests. No change in behavior.
+
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::setValue): Move dispatch logic to InputType and TextFieldInput.
+        * html/InputType.cpp: Remove dispatchChangeEventInResponseToSetValue implementation.
+        * html/InputType.h: Remove dispatchChangeEventInResponseToSetValue declaration.
+        (WebCore::InputType::setValue): Move code from dispatchChangeEventInResponseToSetValue.
+        * html/TextFieldInputType.cpp: Remove dispatchChangeEventInResponseToSetValue implementation.
+        * html/TextFieldInputType.h: Remove dispatchChangeEventInResponseToSetValue declaration.
+        (WebCore::TextFieldInputType::setValue): Move code from dispatchChangeEventInResponseToSetValue. Stop dispatching event in InputType::setValue.
+        * html/HTMLTextFormControlElement.h: Make setTextAsOfLastFormControlChangeEvent to public from protected for accessing from InputType class.
+
+2012-02-17  Yury Semikhatsky  <yurys@chromium.org>
+
+        Unreviewed. Mac build fix after r108047.
+
+        * WebCore.xcodeproj/project.pbxproj:
+
+2012-02-16  Andreas Kling  <awesomekling@apple.com>
+
+        Removing the last presentation attribute should result in a null attributeStyle().
+        <http://webkit.org/b/78812>
+
+        Reviewed by Antti Koivisto.
+
+        If the collectStyleForAttribute() pass in updateAttributeStyle() doesn't encounter any
+        respected presentation attributes, set a null attributeStyle() instead of an empty one.
+
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::collectMatchingRulesForList):
+        * dom/StyledElement.cpp:
+        (WebCore::StyledElement::updateAttributeStyle):
+
+2012-02-16  Yury Semikhatsky  <yurys@chromium.org>
+
+        Web Inspector: use static counters for estimation of allocated Documents, Nodes and JS EventListeners
+        https://bugs.webkit.org/show_bug.cgi?id=78825
+
+        Introduced static counters of allocated Documents, Nodes and JS EventListeners.
+        Their values are displayed on the Timeline panel.
+
+        Reviewed by Pavel Feldman.
+
+        * CMakeLists.txt:
+        * English.lproj/localizedStrings.js:
+        * GNUmakefile.list.am:
+        * Target.pri:
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/JSEventListener.cpp:
+        (WebCore::JSEventListener::JSEventListener):
+        (WebCore::JSEventListener::~JSEventListener):
+        * bindings/v8/V8AbstractEventListener.cpp:
+        (WebCore::V8AbstractEventListener::V8AbstractEventListener):
+        (WebCore::V8AbstractEventListener::~V8AbstractEventListener):
+        * dom/Document.cpp:
+        (WebCore::Document::Document):
+        (WebCore::Document::~Document):
+        * dom/Document.h:
+        (WebCore::Node::Node):
+        * dom/Node.cpp:
+        (WebCore::Node::~Node):
+        * inspector/InspectorAllInOne.cpp:
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::InspectorController):
+        * inspector/InspectorCounters.cpp: Added.
+        (WebCore):
+        (WebCore::InspectorCounters::counterValue):
+        * inspector/InspectorCounters.h: Added.
+        (WebCore):
+        (InspectorCounters):
+        (WebCore::InspectorCounters::incrementCounter):
+        (WebCore::InspectorCounters::decrementCounter):
+        * inspector/InspectorTimelineAgent.cpp:
+        (WebCore::InspectorTimelineAgent::didCallFunction):
+        (WebCore::InspectorTimelineAgent::didDispatchEvent):
+        (WebCore::InspectorTimelineAgent::didWriteHTML):
+        (WebCore::InspectorTimelineAgent::didFireTimer):
+        (WebCore::InspectorTimelineAgent::didEvaluateScript):
+        (WebCore::InspectorTimelineAgent::setHeapSizeStatistic):
+        (WebCore::InspectorTimelineAgent::InspectorTimelineAgent):
+        * inspector/InspectorTimelineAgent.h:
+        (WebCore):
+        (WebCore::InspectorTimelineAgent::create):
+        (InspectorTimelineAgent):
+        * inspector/front-end/MemoryStatistics.js:
+        (WebInspector.MemoryStatistics):
+        (WebInspector.MemoryStatistics.prototype.addTimlineEvent):
+        (WebInspector.MemoryStatistics.prototype._draw.getDocumentCount):
+        (WebInspector.MemoryStatistics.prototype._refreshCurrentValues):
+        * inspector/front-end/TimelinePanel.js:
+        (WebInspector.TimelinePanel.prototype._onTimelineEventRecorded):
+
+2012-02-16  Cris Neckar  <cdn@chromium.org>
+
+        Correct a misleading comment regarding string delimiters in CSS parsing.
+        https://bugs.webkit.org/show_bug.cgi?id=78521
+
+        Reviewed by Zoltan Herczeg.
+
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::lex):
+
+2012-02-16  Martin Robinson  <mrobinson@igalia.com>
+
+        Fix the TextureMapper build for GTK+.
+
+        No new tests. This is just a build fix.
+
+        * GNUmakefile.list.am: Add missing files to the build and change spaces to tabs.
+
+2012-02-16  Daniel Bates  <dbates@webkit.org>
+
+        Add ENABLE(STYLE_SCOPED) around HTMLStyleElement::m_isRegisteredWithScopingNode 
+
+        The instance variable HTMLStyleElement::m_isRegisteredWithScopingNode is only
+        referenced from within ENABLE(STYLE_SCOPED)-guarded code. We should add this
+        guard around its declaration.
+
+        * html/HTMLStyleElement.h:
+        (HTMLStyleElement):
+
+2012-02-16  Shinya Kawanaka  <shinyak@chromium.org>
+
+        [v8] v8 doesn't assume to do 'new WebKitShadowRoot(host)'
+        https://bugs.webkit.org/show_bug.cgi?id=78875
+
+        Reviewed by Kentaro Hara.
+
+        Since v8 does not assume that we do 'new WebkitShadowRoot(host)', a wrapper object for new WebKitShadowRoot(host)
+        was saved in DOMObject storage instead of DOMNode storage.
+
+        CodeGenerator should handle with DOMNode correctly to solve the problem.
+
+        Test: fast/dom/shadow/shadow-root-new.html
+
+        * bindings/scripts/CodeGeneratorV8.pm:
+        (GenerateConstructorCallback):
+
+2012-02-16  Ilya Tikhonovsky  <loislo@chromium.org>
+
+        Unreviewed rollout r107952 because it broke shadow-boundary-events.html and related-target-focusevent.html on mac.
+        see http://webkit.org/b/78832
+
+        * CMakeLists.txt:
+        * DerivedSources.cpp:
+        * DerivedSources.make:
+        * DerivedSources.pri:
+        * GNUmakefile.list.am:
+        * Target.pri:
+        * WebCore.gypi:
+        * WebCore.xcodeproj/project.pbxproj:
+        * dom/DOMAllInOne.cpp:
+        * dom/EventDispatchMediator.cpp:
+        (WebCore::FocusEventDispatchMediator::create):
+        (WebCore):
+        (WebCore::FocusEventDispatchMediator::FocusEventDispatchMediator):
+        (WebCore::FocusEventDispatchMediator::dispatchEvent):
+        (WebCore::BlurEventDispatchMediator::create):
+        (WebCore::BlurEventDispatchMediator::BlurEventDispatchMediator):
+        (WebCore::BlurEventDispatchMediator::dispatchEvent):
+        * dom/EventDispatchMediator.h:
+        (FocusEventDispatchMediator):
+        (WebCore):
+        (BlurEventDispatchMediator):
+        * dom/EventFactory.in:
+        * dom/FocusEvent.cpp: Removed.
+        * dom/FocusEvent.h: Removed.
+        * dom/FocusEvent.idl: Removed.
+        * dom/Node.cpp:
+        (WebCore::Node::dispatchFocusInEvent):
+        (WebCore::Node::dispatchFocusOutEvent):
+        * dom/UIEvent.cpp:
+        (WebCore::FocusInEventDispatchMediator::create):
+        (WebCore):
+        (WebCore::FocusInEventDispatchMediator::FocusInEventDispatchMediator):
+        (WebCore::FocusInEventDispatchMediator::dispatchEvent):
+        (WebCore::FocusOutEventDispatchMediator::create):
+        (WebCore::FocusOutEventDispatchMediator::FocusOutEventDispatchMediator):
+        (WebCore::FocusOutEventDispatchMediator::dispatchEvent):
+        * dom/UIEvent.h:
+        (FocusInEventDispatchMediator):
+        (WebCore):
+        (FocusOutEventDispatchMediator):
+        * page/DOMWindow.idl:
+
+2012-02-16  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Another fix for viewport tests
+
+        No new tests.
+
+        * dom/ViewportArguments.cpp:
+        (WebCore::numericPrefix): When we don't parse a number, we could either be 
+        trying to parse junk, which returns NaN, or we could get an empty string, 
+        which returns 0, so we need to account for that in the assert.
+
+2012-02-16  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Another build fix for viewport tests
+
+        No new tests.
+
+        * dom/ViewportArguments.cpp:
+        (WebCore::numericPrefix): We now return NaN instead of 0 when we fail to 
+        parse a number using charactersToFloatIgnoringJunk, so we need to assert that 
+        we have NaN rather than 0.
+
+2012-02-16  Alexandre Elias  <aelias@google.com>
+
+        [chromium] Bundle page scale factor and limits in CCLayerTreeHost
+        https://bugs.webkit.org/show_bug.cgi?id=78762
+
+        Setting page scale factor and its limits in separate methods
+        may cause clamping bugs if one of them makes it to the
+        impl thread before the other.  Change the API to bundle them together,
+        which matches the existing impl-side interface.
+
+        Reviewed by James Robinson.
+
+        No new tests (API change will disallow this type of bug).
+
+        * platform/graphics/chromium/cc/CCLayerTreeHost.cpp:
+        (WebCore::CCLayerTreeHost::CCLayerTreeHost):
+        (WebCore::CCLayerTreeHost::finishCommitOnImplThread):
+        (WebCore::CCLayerTreeHost::setPageScaleFactorAndLimits):
+        * platform/graphics/chromium/cc/CCLayerTreeHost.h:
+        (CCLayerTreeHost):
+
+2012-02-16  Kentaro Hara  <haraken@chromium.org>
+
+        Unreviewed. Rebaselined run-bindings-tests results.
+
+        * bindings/scripts/test/JS/JSTestEventConstructor.cpp:
+        (WebCore::JSTestEventConstructorConstructor::finishCreation):
+        * bindings/scripts/test/JS/JSTestInterface.cpp:
+        (WebCore::JSTestInterfaceConstructor::finishCreation):
+        * bindings/scripts/test/JS/JSTestObj.cpp:
+        (WebCore::JSTestObjConstructor::finishCreation):
+        * bindings/scripts/test/JS/JSTestSerializedScriptValueInterface.cpp:
+        (WebCore::JSTestSerializedScriptValueInterfaceConstructor::finishCreation):
+
+2012-02-16  Sami Kyostila  <skyostil@chromium.org>
+
+        [chromium] LayerChromium::setNeedsDisplay does not apply contents scale correctly
+        https://bugs.webkit.org/show_bug.cgi?id=77464
+
+        Use bounds() instead of contentBounds() to calculate the region to mark
+        as needing painting in LayerChromium::setNeedsDisplay(). contentBounds()
+        includes contents scale, while bounds() does not.
+
+        Since this change also means that TiledLayerChromium::setNeedsDisplayRect() is
+        given an unscaled rectangle, modify that function to scale the rectangle before
+        using it to invalidate the underlying tiles.
+
+        Reviewed by James Robinson.
+
+        Tests: New tests added to LayerChromium and TiledLayerChromium unit tests.
+
+        * platform/graphics/chromium/LayerChromium.h:
+        (WebCore::LayerChromium::setNeedsDisplay):
+        * platform/graphics/chromium/TiledLayerChromium.cpp:
+        (WebCore::TiledLayerChromium::setNeedsDisplayRect):
+
+2012-02-16  Raymond Liu  <raymond.liu@intel.com>
+
+        Lazy init for DefaultAudioDestinationNode and OfflineAudioDestinationNode
+        https://bugs.webkit.org/show_bug.cgi?id=76509
+
+        Reviewed by Eric Seidel.
+
+        No new tests required.
+
+        * webaudio/AudioDestinationNode.h:
+        * webaudio/AudioNode.h:
+        (WebCore::AudioNode::sampleRate):
+        * webaudio/DefaultAudioDestinationNode.cpp:
+        (WebCore::DefaultAudioDestinationNode::DefaultAudioDestinationNode):
+        * webaudio/DefaultAudioDestinationNode.h:
+        * webaudio/OfflineAudioDestinationNode.cpp:
+        (WebCore::OfflineAudioDestinationNode::OfflineAudioDestinationNode):
+        * webaudio/OfflineAudioDestinationNode.h:
+        (WebCore::OfflineAudioDestinationNode::sampleRate):
+
+2012-02-16  Shinya Kawanaka  <shinyak@chromium.org>
+
+        [Refactoring] Remove location from NodeRenderingContext.
+        https://bugs.webkit.org/show_bug.cgi?id=78796
+
+        Reviewed by Hajime Morita.
+
+        This is a simple refactoring to remove m_location from NodeRenderingContext.
+        TreeLocation is merged into AttachPhase like the following.
+            LocationUndertermined -> Calculating
+            LocationNotInTree -> AttachingNotInTree
+            LocationLightChild -> AttachingStraight / AttachingNotDistributed / AttachingDistributed
+            LocationShadowChild -> AttachingStraight / AttachingShadowChild / AttachingFallback
+
+        We have renamed the enum items of AttachPhase, because not only <content> but also
+        <shadow> will use the phases. Basically these words are taken from Shadow DOM spec.
+        'Calculating' means NodeRenderingContext is used not for attaching but for calculating RenderObject.
+
+        No new tests, no change in behavior.
+
+        * dom/NodeRenderingContext.cpp:
+        (WebCore::NodeRenderingContext::NodeRenderingContext):
+        (WebCore::NodeRenderingContext::nextRenderer):
+        (WebCore::NodeRenderingContext::previousRenderer):
+        (WebCore::NodeRenderingContext::parentRenderer):
+        (WebCore::NodeRenderingContext::shouldCreateRenderer):
+        * dom/NodeRenderingContext.h:
+        (NodeRenderingContext):
+        (WebCore::NodeRenderingContext::parentNodeForRenderingAndStyle):
+
+2012-02-16  Kent Tamura  <tkent@chromium.org>
+
+        Run sort-Xcode-project-file.
+
+        * WebCore.xcodeproj/project.pbxproj: Sorted.
+
+2012-02-16  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Another build fix for viewport tests
+
+        No new tests.
+
+        * dom/ViewportArguments.cpp:
+        (WebCore::numericPrefix): We now return NaN instead of 0 when we fail to 
+        parse a number using charactersToFloatIgnoringJunk, so we need to assert that 
+        we have NaN rather than 0.
+
+2012-02-15  Michael Nordman  <michaeln@google.com>
+
+        [chromium] Fix bugs in the implementation of WebDatabase::closeDatabaseImmediately.
+        https://bugs.webkit.org/show_bug.cgi?id=78841
+
+        WebDatabase now delegates this function entirely to DatabaseTracker,
+        a new closeDatabasesImmediately() has been added for that purpose. That
+        method posts tasks to the appropiate context thread for each database
+        instance that should be closed immediately.
+
+        The DatabaseTracker getAllOpenDatabases() method has been removed from
+        the chromium impl because it's unsafe, refs cannot be safely taken on
+        AbstractDatabase instances in the tracker's collection of open databases.
+
+        Add a message to the console log when a database is forcibly closed.
+
+        Transactions initiated on a database instance that has been forcibly
+        closed complete with a transaction error callback.
+        
+        This is part of resolving http://crbug.com/98939
+
+        Reviewed by David Levin.
+
+        No new layout tests, there is no common code way to closeImmediately.
+        We have coverage for this in py automation tests.
+
+        * platform/sql/SQLiteDatabase.cpp:
+        The closeImmediately code path can result in the underlying sqlite3 handle being
+        closed earlier than usual and trip some assertions. Updated the assertions to no
+        longer trigger in this early close case.
+        (WebCore::SQLiteDatabase::close):
+        (WebCore::SQLiteDatabase::setMaximumSize):
+        * platform/sql/SQLiteDatabase.h:
+        (WebCore::SQLiteDatabase::sqlite3Handle):
+
+        * storage/Database.cpp:
+        (WebCore::Database::closeImmediately): Modified to only be called on the context thread and to log a console message.
+        (WebCore::Database::changeVersion): Use the private runTransaction helper method.
+        (WebCore::Database::transaction): Pass a new param required by the runTransaction helper.
+        (WebCore::Database::readTransaction): Ditto.
+        (WebCore::callTransactionErrorCallback): Used to defer invocation of the error callback.
+        (WebCore::Database::runTransaction): Modified to detect when the database has been closed, and
+        to invoke the error callback in that case. This also avoids creating a reference cycle between
+        a newly created transaction and the database that previously existed due to a transction being
+        added and never removed from the Q while in this state.
+        * storage/Database.h:
+        * storage/DatabaseSync.cpp:
+        (WebCore::DatabaseSync::closeImmediately): Modified to only be called on the context thread and to log a console message.
+        * storage/DatabaseTracker.h:
+
+        * storage/chromium/DatabaseTrackerChromium.cpp:
+        Posts tasks to the appropiate context thread for execution without bumping AbstractDatabase refcounts.
+        (DatabaseTracker::CloseOneDatabaseImmediatelyTask):
+        (WebCore::DatabaseTracker::CloseOneDatabaseImmediatelyTask::create):
+        (WebCore::DatabaseTracker::CloseOneDatabaseImmediatelyTask::performTask):
+        (WebCore::DatabaseTracker::CloseOneDatabaseImmediatelyTask::CloseOneDatabaseImmediatelyTask):
+        (WebCore::DatabaseTracker::closeDatabasesImmediately): 
+        (WebCore::DatabaseTracker::closeOneDatabaseImmediately):
+
+2012-02-16  Dana Jansens  <danakj@chromium.org>
+
+        [Chromium] Occlusion tracking with CSS filters
+        https://bugs.webkit.org/show_bug.cgi?id=77498
+
+        Reviewed by James Robinson.
+
+        The new CSS filter support within the compositor changes how
+        occlusion tracking needs to function. A filter can change the
+        alpha value of pixels, making an otherwise opaque pixel no
+        longer so. Secondly, a filter may move color values around
+        on a surface, which can cause otherwise occluded areas to
+        become visible and require painting.
+
+        New unit tests: CCLayerTreeHostTest.cpp
+
+        Tests: compositing/culling/filter-occlusion-alpha-large.html
+               compositing/culling/filter-occlusion-alpha.html
+               compositing/culling/filter-occlusion-blur-large.html
+               compositing/culling/filter-occlusion-blur.html
+
+        * platform/graphics/chromium/RenderSurfaceChromium.cpp:
+        (WebCore::RenderSurfaceChromium::RenderSurfaceChromium):
+        * platform/graphics/chromium/RenderSurfaceChromium.h:
+        (WebCore::RenderSurfaceChromium::setFilters):
+        (WebCore::RenderSurfaceChromium::filters):
+        (WebCore::RenderSurfaceChromium::setNearestAncestorThatMovesPixels):
+        (WebCore::RenderSurfaceChromium::nearestAncestorThatMovesPixels):
+        (RenderSurfaceChromium):
+        * platform/graphics/chromium/cc/CCLayerTreeHost.cpp:
+        (WebCore::enterTargetRenderSurface):
+        (WebCore::CCLayerTreeHost::paintLayerContents):
+        * platform/graphics/chromium/cc/CCLayerTreeHostCommon.cpp:
+        (WebCore::subtreeShouldRenderToSeparateSurface):
+        (WebCore::calculateDrawTransformsAndVisibilityInternal):
+        (WebCore::CCLayerTreeHostCommon::calculateDrawTransformsAndVisibility):
+        * platform/graphics/chromium/cc/CCRenderSurface.cpp:
+        (WebCore::CCRenderSurface::CCRenderSurface):
+        * platform/graphics/chromium/cc/CCRenderSurface.h:
+        (WebCore::CCRenderSurface::setNearestAncestorThatMovesPixels):
+        (WebCore::CCRenderSurface::nearestAncestorThatMovesPixels):
+        (CCRenderSurface):
+        * platform/graphics/filters/FilterOperation.h:
+        (FilterOperation):
+        (WebCore::FilterOperation::affectsOpacity):
+        (WebCore::FilterOperation::movesPixels):
+        (WebCore::ReferenceFilterOperation::affectsOpacity):
+        (WebCore::ReferenceFilterOperation::movesPixels):
+        (ReferenceFilterOperation):
+        (WebCore::BasicComponentTransferFilterOperation::affectsOpacity):
+        (BasicComponentTransferFilterOperation):
+        (WebCore::BlurFilterOperation::affectsOpacity):
+        (WebCore::BlurFilterOperation::movesPixels):
+        (BlurFilterOperation):
+        (WebCore::DropShadowFilterOperation::affectsOpacity):
+        (DropShadowFilterOperation):
+        * platform/graphics/filters/FilterOperations.cpp:
+        (WebCore::FilterOperations::hasFilterThatAffectsOpacity):
+        (WebCore):
+        (WebCore::FilterOperations::hasFilterThatMovesPixels):
+        * platform/graphics/filters/FilterOperations.h:
+        (WebCore::FilterOperations::isEmpty):
+        (FilterOperations):
+
+2012-02-16  Leo Yang  <leo.yang@torchmobile.com.cn>
+
+        [BlackBerry] Adapt to the removal of WebStringIml.h
+        https://bugs.webkit.org/show_bug.cgi?id=78784
+
+        Reviewed by Antonio Gomes.
+
+        WebKit/blackberry/WebCoreSupport/WebStringImpl.h which hasn't been upstreamed
+        has been removed internally. We should adapt to this removal for the
+        upstreamed part of the BlackBerry port. Actually WebStringImpl is not necessary
+        because it just inherits from WTF::StringImpl but adding nothing.
+
+        No functionalities changed, no new tests.
+
+        * platform/text/blackberry/StringBlackBerry.cpp:
+        (WTF::String::operator WebString):
+
+2012-02-15  Geoffrey Garen  <ggaren@apple.com>
+
+        Made Weak<T> single-owner, adding PassWeak<T>
+        https://bugs.webkit.org/show_bug.cgi?id=78740
+
+        Reviewed by Sam Weinig.
+
+        * bindings/js/JSDOMBinding.cpp:
+        (WebCore::jsStringSlowCase): Use PassWeak<T>, as required by our new
+        hash map API.
+
+        * bindings/js/JSDOMBinding.h:
+        (WebCore::getCachedWrapper):
+        (WebCore::cacheWrapper): Use PassWeak<T> and raw pointer, as required by
+        our new hash map API.
+
+        * bindings/js/JSEventListener.h:
+        (WebCore::JSEventListener::setWrapper):
+        * bindings/js/ScriptWrappable.h:
+        (WebCore::ScriptWrappable::setWrapper):
+        * bridge/jsc/BridgeJSC.cpp:
+        (JSC::Bindings::Instance::createRuntimeObject):
+        * bridge/runtime_root.cpp:
+        (JSC::Bindings::RootObject::addRuntimeObject): Use PassWeak<T>, as
+        required by our new hash map and Weak<T> APIs.
+
+2012-02-16  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Crash in visiblePositionForIndex
+        https://bugs.webkit.org/show_bug.cgi?id=77683
+
+        Reviewed by Eric Seidel.
+
+        Fixed the crash.
+
+        Test: editing/execCommand/applyblockelement-visiblepositionforindex-crash.html
+
+        * editing/ApplyBlockElementCommand.cpp:
+        (WebCore::ApplyBlockElementCommand::doApply):
+        * editing/InsertListCommand.cpp:
+        (WebCore::InsertListCommand::doApply):
+        * editing/htmlediting.cpp:
+        (WebCore::indexForVisiblePosition):
+        * editing/htmlediting.h:
+        (WebCore):
+
+2012-02-16  Matthew Delaney  <mdelaney@apple.com>
+
+        ShadowBlur.cpp's cached content matching needs to consider m_layerSize changes
+        https://bugs.webkit.org/show_bug.cgi?id=78765
+
+        Reviewed by Simon Fraser.
+
+        No new tests due to the flaky nature of reproducing the issue.
+
+        * platform/graphics/ShadowBlur.cpp:
+        (WebCore::ScratchBuffer::getScratchBuffer): Make sure to call clearScratchBuffer()
+        when we create a new ImageBuffer in order to invalidate cached values.
+        (WebCore::ScratchBuffer::setCachedShadowValues): Roll together matching and setting
+        of cached values into one method to enforce them being the same.
+        (WebCore::ScratchBuffer::setCachedInsetShadowValues): Ditto.
+
+        Restructure to use new method described above.
+        (WebCore::ShadowBlur::drawRectShadowWithoutTiling): 
+        (WebCore::ShadowBlur::drawInsetShadowWithoutTiling):
+        (WebCore::ShadowBlur::drawInsetShadowWithTiling):
+        (WebCore::ShadowBlur::drawRectShadowWithTiling):
+        (WebCore::ShadowBlur::beginShadowLayer):
+
+2012-02-16  Dana Jansens  <danakj@chromium.org>
+
+        [chromium] Empty divs not transforming overflow correctly
+        https://bugs.webkit.org/show_bug.cgi?id=78850
+
+        Reviewed by James Robinson.
+
+        Test: compositing/overflow/transform-in-empty-container.html
+
+        * platform/graphics/chromium/GraphicsLayerChromium.cpp:
+        (WebCore::GraphicsLayerChromium::setSize):
+
+2012-02-16  Emil A Eklund  <eae@chromium.org>
+
+        Fix use of long long in FractionalLayoutUnit::setRawValue
+        https://bugs.webkit.org/show_bug.cgi?id=78835
+
+        Reviewed by Eric Seidel.
+
+        Change setRawValue(long long) to compare against int min and max instead
+        of using abs as not all platforms we support implement a long long
+        version of abs or llabs.
+
+        No new tests.
+
+        * platform/FractionalLayoutUnit.h:
+        (WebCore::FractionalLayoutUnit::setRawValue):
+        Compare against int min/max instead of just max with abs.
+        
+        (WebCore::FractionalLayoutUnit::isInBounds):
+        Fix type mismatch warning.
+        
+        (WebCore::operator==):
+        Fix typo.
+        
+        (WebCore::operator*):
+        Use long long version of setRawValue.
+
+2012-02-15  Shinya Kawanaka  <shinyak@chromium.org>
+
+        Add an internal flag to accept multiple shadow roots for the purpose of tests.
+        https://bugs.webkit.org/show_bug.cgi?id=78453
+
+        Reviewed by Hajime Morita.
+
+        This patch introduces a flag to enable multiple shadow subtrees.
+        This flag is intended to be used for testing purpose for a while.
+        We will remove it later.
+
+        No new tests, no change in behavior.
+
+        * WebCore.exp.in:
+        * bindings/generic/RuntimeEnabledFeatures.cpp:
+        (WebCore):
+        * bindings/generic/RuntimeEnabledFeatures.h:
+        (RuntimeEnabledFeatures):
+        (WebCore::RuntimeEnabledFeatures::multipleShadowSubtreesEnabled):
+        (WebCore::RuntimeEnabledFeatures::setMultipleShadowSubtreesEnabled):
+        * dom/ShadowRoot.cpp:
+        (WebCore::ShadowRoot::create):
+        * dom/ShadowRootList.cpp:
+        (WebCore::ShadowRootList::pushShadowRoot):
+        * testing/Internals.cpp:
+        (WebCore::Internals::setMultipleShadowSubtreesEnabled):
+        (WebCore):
+        * testing/Internals.h:
+        (Internals):
+        * testing/Internals.idl:
+
+2012-02-16  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Fix the broken viewport tests
+        https://bugs.webkit.org/show_bug.cgi?id=78774
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        No new tests.
+
+        * dom/ViewportArguments.cpp:
+        (WebCore::numericPrefix): Changed to use the new charactersToFloatWithJunk function(s).
+
+2012-02-16  Cris Neckar  <cdn@chromium.org>
+
+        Very large strings could cause the new quoted string to wrap.
+        https://bugs.webkit.org/show_bug.cgi?id=78387
+
+        Reviewed by Eric Seidel.
+
+        * css/CSSParser.cpp:
+        (WebCore::quoteCSSString):
+
+2012-02-16  Eric Seidel  <eric@webkit.org>
+
+        Add a themeChromiumAndroid.css file for android-specific default styles
+        https://bugs.webkit.org/show_bug.cgi?id=78547
+
+        Reviewed by Adam Barth.
+
+        This includes the themeChromiumAndroid.css file from the Chromium-Android port
+        as well as some addidtional changes they had to html.css.  I believe those
+        changes were made before themeChromiumAndroid was created, but it's now the better place for this CSS.
+
+        * WebCore.gyp/WebCore.gyp:
+        * css/themeChromiumAndroid.css: Added.
+        (select[size][multiple]):
+        (input[type="date"], input[type="datetime"], input[type="datetime-local"], input[type="time"], input[type="month"]):
+        * rendering/RenderThemeChromiumAndroid.cpp:
+        (WebCore::RenderThemeChromiumAndroid::extraDefaultStyleSheet):
+        (WebCore):
+        * rendering/RenderThemeChromiumAndroid.h:
+        (RenderThemeChromiumAndroid):
+        (WebCore::RenderThemeChromiumAndroid::delegatesMenuListRendering):
+        (WebCore::RenderThemeChromiumAndroid::platformTapHighlightColor):
+
+2012-02-16  Brady Eidson  <beidson@apple.com>
+
+        <rdar://problem/10616280> and https://bugs.webkit.org/show_bug.cgi?id=78767
+        REGRESSION (r90471) - iAd Producer 2.0.1 produces blank pages
+
+        Reviewed by Sam Weinig.
+
+        No new tests. (Subtle API change attached to a specific application)
+
+        * loader/DocumentLoader.cpp:
+        (WebCore::DocumentLoader::isLoadingInAPISense): Return true if the app needs the quirk
+        and there are outstanding subresource loads.
+
+        * page/Settings.cpp:
+        (WebCore::Settings::Settings):
+        * page/Settings.h:
+        (WebCore::Settings::setNeedsIsLoadingInAPISenseQuirk):
+        (WebCore::Settings::needsIsLoadingInAPISenseQuirk):
+        (Settings):
+
+2012-02-16  Kentaro Hara  <haraken@chromium.org>
+
+        Remove [ConvertScriptString] from FileReaderSync.idl
+        https://bugs.webkit.org/show_bug.cgi?id=78335
+
+        Reviewed by Eric Seidel.
+
+        The spec says that FileReadSync should throw NOT_FOUND_ERR
+        if a given blob is invalid: http://www.w3.org/TR/FileAPI/#FileReaderSync
+
+        By this fix, we can completely remove [ConvertScriptString] from WebKit.
+
+        Tests: fast/files/workers/worker-read-blob-sync.html
+               fast/files/workers/worker-read-file-sync.html
+
+        * fileapi/FileReaderSync.cpp: Modified to throw NOT_FOUND_ERR if a blob is invalid.
+        (WebCore::FileReaderSync::readAsArrayBuffer):
+        (WebCore::FileReaderSync::readAsBinaryString):
+        (WebCore::FileReaderSync::readAsText):
+        (WebCore::FileReaderSync::readAsDataURL):
+        * fileapi/FileReaderSync.idl:
+
+        * bindings/scripts/CodeGeneratorJS.pm: Removed [ConvertScriptString]
+        since no one is using it.
+        (NativeToJSValue):
+        * bindings/scripts/CodeGeneratorV8.pm: Ditto.
+        (NativeToJSValue):
+
+        * bindings/scripts/test/TestObj.idl: Removed a test case for [ConvertScriptString].
+
+        * bindings/scripts/test/CPP/WebDOMTestObj.cpp: Updated run-bindings-tests results.
+        * bindings/scripts/test/CPP/WebDOMTestObj.h:
+        * bindings/scripts/test/GObject/WebKitDOMTestObj.cpp:
+        (webkit_dom_test_obj_get_property):
+        (webkit_dom_test_obj_class_init):
+        * bindings/scripts/test/GObject/WebKitDOMTestObj.h:
+        * bindings/scripts/test/JS/JSTestObj.cpp:
+        (WebCore):
+        * bindings/scripts/test/JS/JSTestObj.h:
+        (WebCore):
+        * bindings/scripts/test/ObjC/DOMTestObj.h:
+        * bindings/scripts/test/ObjC/DOMTestObj.mm:
+        * bindings/scripts/test/V8/V8TestObj.cpp:
+        (WebCore):
+
+
+2012-02-16  Dana Jansens  <danakj@chromium.org>
+
+        [chromium] Clipping/Transforms applied in wrong order in opaque paint tracking
+        https://bugs.webkit.org/show_bug.cgi?id=78775
+
+        Reviewed by Stephen White.
+
+        The clip was being applied in device coordinates, before transforming the painted
+        rect into device coordinates. This made any translations get doubly represented,
+        and gave incorrect paint tracking results.
+
+        Test: compositing/culling/unscrolled-within-boxshadow.html
+
+        Unit test: PlatformContextSkiaTest.cpp
+
+        * platform/graphics/skia/OpaqueRegionSkia.cpp:
+        (WebCore::OpaqueRegionSkia::didDraw):
+
+2012-02-16  Abhishek Arya  <inferno@chromium.org>
+
+        Crash with tables in multi-column layout.
+        https://bugs.webkit.org/show_bug.cgi?id=78415
+
+        Reviewed by Julien Chaffraix.
+
+        Multi-column code creates anonymous column blocks directly
+        under RenderTable, thereby violating table layout assumption.
+        E.g. Captions in this testcase gets reparented to these anonymous
+        column blocks and when they go away, they are not able to clear
+        themselves from table's m_captions list (since RenderTable::removeChild
+        is not called).
+
+        Test: fast/multicol/span/table-multi-column-crash.html
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::containingColumnsBlock):
+
+2012-02-16  ChangSeok Oh  <shivamidow@gmail.com>
+
+        [GTK] File system api build is broken
+        https://bugs.webkit.org/show_bug.cgi?id=78479
+
+        Reviewed by Philippe Normand.
+
+        This patch is a small step to support FileSystem API for GTK port.
+        As I know, bug58443 also dealt with it, but it looks like the submitted patch
+        needs to be updated. To do that, I think I need to discuss with the original author.
+        So, I hope to just fix build break issue in this bug.
+
+        No new tests. Implementing the feature is not done yet.
+
+        * GNUmakefile.list.am: Added some missing files.
+        * bindings/js/JSDirectoryEntryCustom.cpp: Added Error.h to use its API.
+        * platform/AsyncFileSystem.cpp:
+        (WebCore):
+        (WebCore::AsyncFileSystem::create): The arguments don't match the declaration in AsyncFileSystem.h.
+        * platform/gtk/AsyncFileSystemGtk.cpp: Added.
+        (WebCore):
+        (WebCore::AsyncFileSystem::isAvailable):
+        (WebCore::AsyncFileSystem::isValidType):
+        (WebCore::AsyncFileSystem::create):
+        (WebCore::AsyncFileSystem::openFileSystem):
+        (WebCore::AsyncFileSystem::crackFileSystemURL):
+        (WebCore::AsyncFileSystemGtk::AsyncFileSystemGtk):
+        (WebCore::AsyncFileSystemGtk::~AsyncFileSystemGtk):
+        (WebCore::AsyncFileSystemGtk::toURL):
+        (WebCore::AsyncFileSystemGtk::move):
+        (WebCore::AsyncFileSystemGtk::copy):
+        (WebCore::AsyncFileSystemGtk::remove):
+        (WebCore::AsyncFileSystemGtk::removeRecursively):
+        (WebCore::AsyncFileSystemGtk::readMetadata):
+        (WebCore::AsyncFileSystemGtk::createFile):
+        (WebCore::AsyncFileSystemGtk::createDirectory):
+        (WebCore::AsyncFileSystemGtk::fileExists):
+        (WebCore::AsyncFileSystemGtk::directoryExists):
+        (WebCore::AsyncFileSystemGtk::readDirectory):
+        (WebCore::AsyncFileSystemGtk::createWriter):
+        * platform/gtk/AsyncFileSystemGtk.h: Added.
+        (WebCore):
+        (AsyncFileSystemGtk):
+
+2012-02-16  Adrienne Walker  <enne@google.com>
+
+        Handle dirty descendant visibility status in RenderLayer::updateLayerPositionsAfterScroll
+        https://bugs.webkit.org/show_bug.cgi?id=78286
+
+        Reviewed by Julien Chaffraix.
+
+        This is an unfortunate bandaid over a corner case where sometimes the
+        visible descendant status dirty flag is true when this function is
+        called from FrameView::repaintFixedElementsAfterScrolling. As it
+        should be cheap to refresh this flag when dirty in most cases (as it
+        early outs after finding any visible descendant), just lazily update
+        the dirty flag here to ensure correctness.
+
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::updateLayerPositionsAfterScroll):
+
+2012-02-16  Adam Barth  <abarth@webkit.org>
+
+        Chrome::*Geolocation* are just useless pass-throughs to ChromeClient and should be removed
+        https://bugs.webkit.org/show_bug.cgi?id=78844
+
+        Reviewed by Eric Seidel.
+
+        These function serve no useful purpose and should be removed.
+
+        * page/Chrome.cpp:
+        (WebCore):
+        * page/Chrome.h:
+        (Chrome):
+        * page/Geolocation.cpp:
+        (WebCore::Geolocation::reset):
+        (WebCore::Geolocation::requestPermission):
+
+2012-02-16  Sergio Villar Senin  <svillar@igalia.com>
+
+        [soup] Move important SoupSession feature initialization to WebCore
+        https://bugs.webkit.org/show_bug.cgi?id=68602
+
+        Reviewed by Martin Robinson.
+
+        Moved content sniffer and decoder initialization from WebKit to
+        WebCore because network stuff will not work as expected without
+        them. Added also out-of-the-box proxy support to WebCore.
+
+        No new tests required as we're just moving stuff from WebKit to
+        WebCore.
+
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::ResourceHandle::defaultSession):
+
+2012-02-16  Julien Chaffraix  <jchaffraix@webkit.org>
+
+        thead in table without tbody causes table height doubling
+        https://bugs.webkit.org/show_bug.cgi?id=37244
+
+        Reviewed by Ojan Vafai.
+
+        Tests: fast/table/double-height-table-no-tbody-expected.html
+               fast/table/double-height-table-no-tbody.html
+
+        The bug is caused by the layout code would wrongly assuming that a
+        table without a <tbody> is an empty table. We would set the logical
+        height to the style's logical height wrongly before inflating the
+        logical height to account for the section(s). This would cause us
+        to increase past our needed size thus the bug.
+
+        * rendering/RenderTable.cpp:
+        (WebCore::RenderTable::layout):
+        A table is empty if it does not have any top section, not just a <tbody>.
+        The test uncovered an issue with height distribution in layoutRows where we
+        would distribute the extra height to the first <tbody> not section.
+
+2012-02-07  Robert Hogan  <robert@webkit.org>
+
+        CSS 2.1 failure: fixed-table-layout-013 and fixed-table-layout-015 fail
+        https://bugs.webkit.org/show_bug.cgi?id=78027
+
+        Reviewed by Julien Chaffraix.
+
+        Both of these test the (slightly implicit) rule that width set on column-groups cannot
+        affect the width of columns in a fixed layout table: http://www.w3.org/TR/CSS21/tables.html#fixed-table-layout
+        FF, Opera and IE all pass these two tests.
+
+        Tests: css2.1/20110323/fixed-table-layout-013.htm
+               css2.1/20110323/fixed-table-layout-015.htm
+
+        * rendering/FixedTableLayout.cpp:
+        (WebCore::nextCol): A helper function for finding the next column along.
+        (WebCore::FixedTableLayout::calcWidthArray): Ignore width specified by column groups.
+        * rendering/RenderTableCol.h:
+        (WebCore::RenderTableCol::isTableColGroup): Convenience function for identifying column groups.
+
+2012-02-16  Philippe Normand  <pnormand@igalia.com>
+
+        Unreviewed, rolling out r107941.
+        http://trac.webkit.org/changeset/107941
+        https://bugs.webkit.org/show_bug.cgi?id=68602
+
+        Broke 23 http tests on GTK
+
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::ResourceHandle::defaultSession):
+
+2012-02-16  Tom Sepez  <tsepez@chromium.org>
+
+        XSS Auditor bypass with U+2028/2029
+        https://bugs.webkit.org/show_bug.cgi?id=78732
+
+        Reviewed by Adam Barth.
+
+        Test: http/tests/security/xssAuditor/script-tag-with-trailing-comment-U2028.html
+
+        * html/parser/XSSAuditor.cpp:
+        (WebCore::isJSNewline):
+        (WebCore::XSSAuditor::snippetForJavaScript):
+
+2012-02-15  Mark Rowe  <mrowe@apple.com>
+
+        NPN_GetValueForURL / NPNURLVProxy returns DIRECT when proxy configured via PAC
+        <http://webkit.org/b/78766> / <rdar://problem/10729283>
+
+        Reviewed by Anders Carlsson.
+
+        * platform/network/cf/ProxyServerCFNet.cpp:
+        (WebCore::proxyAutoConfigurationResultCallback): Stop the runloop, and then process
+        the results that we received.
+        (WebCore::processProxyServers): Processing of array of proxy configuration information
+        moved from addProxyServersForURL. Handling of proxy auto-configuration URLs is now handled
+        by calling CFNetworkExecuteProxyAutoConfigurationURL and waiting synchronously on the result
+        callback. Doing this synchronously is not great, but it's the best we can do without a lot
+        of restructuring of the code that calls this. We arbitrarily time out the execution after five
+        seconds to avoid permanently hanging.
+        (WebCore::addProxyServersForURL): Call in to our helper function.
+
+2012-02-16  Abhishek Arya  <inferno@chromium.org>
+
+        Fix clone() function to handle descendant classes of RenderBlock.
+        https://bugs.webkit.org/show_bug.cgi?id=78273
+
+        Reviewed by Eric Seidel.
+
+        Test: fast/multicol/span/clone-flexbox-crash.html
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::clone):
+
+2012-02-16  Raul Hudea  <rhudea@adobe.com>
+
+        [CSSRegions]overflowRegion tests are flaky
+        https://bugs.webkit.org/show_bug.cgi?id=78761
+
+        Reviewed by Tony Chang.
+
+        The overflowRegion tests were updated.
+
+        * dom/Element.cpp:
+        (WebCore::Element::webkitRegionOverflow):
+
+2012-02-16  Raul Hudea  <rhudea@adobe.com>
+
+        [CSS Regions] Repaint issues when changing innerHTML of content
+        https://bugs.webkit.org/show_bug.cgi?id=78787
+
+        Reviewed by David Hyatt.
+
+        The calculation of the clipping rectangle is based on the repaint rectangle,
+        so it needs to be clipped to the current region, because it might spread over multiple ones.
+
+        Test: fast/repaint/region-painting-invalidation.html
+
+        * rendering/RenderFlowThread.cpp:
+        (WebCore::RenderFlowThread::repaintRectangleInRegions):
+
+2012-02-16  Adam Roben  <aroben@apple.com>
+
+        Roll out r107887
+
+        It broke 32-bit builds due to truncation from "long long" to "int".
+
+        Original bug is <http://webkit.org/b/76571> Add FractionalLayoutPoint/Size/Rect for
+        sub-pixel layout
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * WebCore.gypi:
+        * WebCore.order:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * platform/FractionalLayoutUnit.h:
+        (WebCore::FractionalLayoutUnit::isInBounds):
+        (WebCore::operator==):
+        (WebCore::operator*):
+        * platform/graphics/FloatPoint.cpp:
+        * platform/graphics/FloatPoint.h:
+        (WebCore):
+        (FloatPoint):
+        (WebCore::FloatPoint::move):
+        (WebCore::FloatPoint::moveBy):
+        * platform/graphics/FloatRect.cpp:
+        * platform/graphics/FloatRect.h:
+        (WebCore):
+        * platform/graphics/FloatSize.cpp:
+        * platform/graphics/FloatSize.h:
+        (WebCore):
+        * platform/graphics/FractionalLayoutPoint.h: Removed.
+        * platform/graphics/FractionalLayoutRect.cpp: Removed.
+        * platform/graphics/FractionalLayoutRect.h: Removed.
+        * platform/graphics/FractionalLayoutSize.cpp: Removed.
+        * platform/graphics/FractionalLayoutSize.h: Removed.
+        * platform/graphics/IntRect.cpp:
+        * platform/graphics/IntRect.h:
+        (WebCore):
+        (IntRect):
+
+2012-02-16  Pavel Feldman  <pfeldman@google.com>
+
+        Web Inspector: cache settings values
+        https://bugs.webkit.org/show_bug.cgi?id=78815
+
+        Reviewed by Vsevolod Vlasov.
+
+        * inspector/front-end/Settings.js:
+        (WebInspector.Setting.prototype.get if):
+        (WebInspector.Setting.prototype):
+        (WebInspector.Setting.prototype.):
+        (WebInspector.Setting.prototype.set this):
+
+2012-02-16  Terry Anderson  <tdanderson@chromium.org>
+
+        WebKit does not support DOM 3 Events FocusEvent
+        https://bugs.webkit.org/show_bug.cgi?id=76216
+
+        Created a new FocusEvent class (extends UIEvent) with a relatedTarget attribute.  Moved
+        the {Focus,Blur,FocusIn,FocusOut}EventDispatchMediator classes inside FocusEvent.  Now when
+        focusin or focusout events are dispatched, a FocusEvent is created with the relatedTarget
+        attribute set accordingly.  No other logic changes have been made besides adding the
+        FocusEvent class.
+
+        Reviewed by Eric Seidel.
+
+        Test: fast/events/related-target-focusevent.html
+
+        * CMakeLists.txt:
+        * DerivedSources.cpp:
+        * DerivedSources.make:
+        * DerivedSources.pri:
+        * GNUmakefile.list.am:
+        * Target.pri:
+        * WebCore.gypi:
+        * WebCore.xcodeproj/project.pbxproj:
+        * dom/DOMAllInOne.cpp:
+            - Included mention of FocusEvent / JSFocusEvent in the above files to
+              allow the patch to build on the different platforms
+        * dom/EventDispatchMediator.cpp:
+        * dom/EventDispatchMediator.h:
+        * dom/EventFactory.in:
+        * dom/FocusEvent.cpp: Added.
+        (WebCore):
+        (WebCore::FocusEvent::FocusEvent):
+        (WebCore::FocusEvent::~FocusEvent):
+        (WebCore::FocusEvent::initFocusEvent):
+        (WebCore::FocusEvent::interfaceName):
+        (WebCore::FocusInEventDispatchMediator::create):
+        (WebCore::FocusInEventDispatchMediator::FocusInEventDispatchMediator):
+        (WebCore::FocusInEventDispatchMediator::dispatchEvent):
+        (WebCore::FocusInEventDispatchMediator::event):
+        (WebCore::FocusOutEventDispatchMediator::create):
+        (WebCore::FocusOutEventDispatchMediator::FocusOutEventDispatchMediator):
+        (WebCore::FocusOutEventDispatchMediator::dispatchEvent):
+        (WebCore::FocusOutEventDispatchMediator::event):
+        (WebCore::FocusEventDispatchMediator::create):
+        (WebCore::FocusEventDispatchMediator::FocusEventDispatchMediator):
+        (WebCore::FocusEventDispatchMediator::dispatchEvent):
+        (WebCore::BlurEventDispatchMediator::create):
+        (WebCore::BlurEventDispatchMediator::BlurEventDispatchMediator):
+        (WebCore::BlurEventDispatchMediator::dispatchEvent):
+        * dom/FocusEvent.h: Copied from Source/WebCore/dom/EventDispatchMediator.h.
+        (WebCore):
+        (FocusEvent):
+        (WebCore::FocusEvent::create):
+        (WebCore::FocusEvent::relatedTarget):
+        (WebCore::FocusEvent::setRelatedTarget):
+        (FocusInEventDispatchMediator):
+        (FocusOutEventDispatchMediator):
+        (FocusEventDispatchMediator):
+        (BlurEventDispatchMediator):
+        * dom/FocusEvent.idl: Added.
+        * dom/Node.cpp:
+        (WebCore::Node::dispatchFocusInEvent):
+        (WebCore::Node::dispatchFocusOutEvent):
+        * dom/UIEvent.cpp:
+        * dom/UIEvent.h:
+        * page/DOMWindow.idl:
+
+2012-02-16  No'am Rosenthal  <noam.rosenthal@nokia.com>
+
+        [Texmap] Improve the way we deal with BGRA extension
+        https://bugs.webkit.org/show_bug.cgi?id=78822
+
+        Swizzle the RGBA manually only in OpenGL ES, and only if the extension is not available.
+        Pass the pixel-format of the images when updating TextureMapperTiledBackingStore.
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        No new behavior.
+
+        * platform/graphics/opengl/TextureMapperGL.cpp:
+        (WebCore):
+        (WebCore::hasExtension):
+        (WebCore::hasBgraExtension):
+        (WebCore::BitmapTextureGL::updateContents):
+        * platform/graphics/texmap/TextureMapperBackingStore.cpp:
+        (WebCore::TextureMapperTile::updateContents):
+        (WebCore::TextureMapperTiledBackingStore::updateContentsFromImageIfNeeded):
+        (WebCore::TextureMapperTiledBackingStore::updateContents):
+        * platform/graphics/texmap/TextureMapperBackingStore.h:
+        (TextureMapperTile):
+        (TextureMapperTiledBackingStore):
+        (WebCore::TextureMapperTiledBackingStore::updateContents):
+        * platform/graphics/texmap/TextureMapperLayer.cpp:
+        (WebCore::TextureMapperLayer::updateBackingStore):
+
+2012-02-16  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        [Gtk][Efl][Qt] Move OpenGLShims out of cairo/ subdirectory
+        https://bugs.webkit.org/show_bug.cgi?id=78800
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        The file is not specific to Cairo and used in other ports. Move it into
+        common space.
+
+        * GNUmakefile.list.am:
+        * PlatformEfl.cmake:
+        * Target.pri:
+        * platform/graphics/OpenGLShims.cpp: Renamed from Source/WebCore/platform/graphics/cairo/OpenGLShims.cpp.
+        (WebCore):
+        (WebCore::openGLFunctionTable):
+        (WebCore::getProcAddress):
+        (WebCore::lookupOpenGLFunctionAddress):
+        (WebCore::initializeOpenGLShims):
+        * platform/graphics/OpenGLShims.h: Renamed from Source/WebCore/platform/graphics/cairo/OpenGLShims.h.
+        (WebCore):
+        (_OpenGLFunctionTable):
+        * platform/graphics/opengl/Extensions3DOpenGL.cpp:
+        * platform/graphics/opengl/GraphicsContext3DOpenGL.cpp:
+        * platform/graphics/opengl/GraphicsContext3DOpenGLCommon.cpp:
+        * platform/graphics/opengl/TextureMapperGL.cpp:
+        * platform/graphics/qt/Extensions3DQt.cpp:
+        * platform/graphics/qt/GraphicsContext3DQt.cpp:
+
+2012-02-16  No'am Rosenthal  <noam.rosenthal@nokia.com>
+
+        [Qt][WK2] Allow opaque tiles
+        https://bugs.webkit.org/show_bug.cgi?id=78809
+
+        Add a supportsAlpha property to TiledBackingStore.
+        We invalidate all the tiles if that property changes, because the buffers need to be
+        recreated in a different format.
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        No behavior changes.
+
+        * platform/graphics/TiledBackingStore.cpp:
+        (WebCore::TiledBackingStore::TiledBackingStore):
+        (WebCore::TiledBackingStore::setSupportsAlpha):
+        (WebCore):
+        * platform/graphics/TiledBackingStore.h:
+        (TiledBackingStore):
+        (WebCore::TiledBackingStore::supportsAlpha):
+
+2012-02-16  Sergio Villar Senin  <svillar@igalia.com>
+
+        [soup] Move important SoupSession feature initialization to WebCore
+        https://bugs.webkit.org/show_bug.cgi?id=68602
+
+        Reviewed by Martin Robinson.
+
+        Moved content sniffer and decoder initialization from WebKit to
+        WebCore because network stuff will not work as expected without
+        them. Added also out-of-the-box proxy support to WebCore.
+
+        No new tests required as we're just moving stuff from WebKit to
+        WebCore.
+
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::ResourceHandle::defaultSession):
+
+2012-02-16  Pavel Feldman  <pfeldman@google.com>
+
+        Web Inspector: remove free flow DOM editing experiment.
+        https://bugs.webkit.org/show_bug.cgi?id=78813
+
+        Reviewed by Yury Semikhatsky.
+
+        * inspector/front-end/DOMAgent.js:
+        (WebInspector.DOMAgent.prototype._markRevision):
+
+2012-02-16  Patrick Gansterer  <paroga@webkit.org>
+
+        WinCE build fix after r107453.
+
+        * platform/FractionalLayoutUnit.h:
+        (WebCore::FractionalLayoutUnit::isInBounds): Use fabs() instead of abs().
+
+2012-02-15  Pavel Feldman  <pfeldman@google.com>
+
+        Web Inspector: explicitly mark undoable state from the front-end.
+        https://bugs.webkit.org/show_bug.cgi?id=78716
+
+        Reviewed by Vsevolod Vlasov.
+
+        * inspector/InspectorCSSAgent.cpp:
+        (WebCore::InspectorCSSAgent::toggleProperty):
+        (WebCore::InspectorCSSAgent::setRuleSelector):
+        (WebCore::InspectorCSSAgent::addRule):
+        * inspector/InspectorDOMAgent.cpp:
+        (WebCore::InspectorDOMAgent::setAttributeValue):
+        (WebCore::InspectorDOMAgent::setAttributesAsText):
+        (WebCore::InspectorDOMAgent::removeAttribute):
+        (WebCore::InspectorDOMAgent::removeNode):
+        (WebCore::InspectorDOMAgent::setNodeName):
+        (WebCore::InspectorDOMAgent::setOuterHTML):
+        (WebCore::InspectorDOMAgent::setNodeValue):
+        (WebCore::InspectorDOMAgent::moveTo):
+        * inspector/InspectorHistory.cpp:
+        (WebCore::InspectorHistory::redo):
+        * inspector/InspectorHistory.h:
+        (InspectorHistory):
+        * inspector/front-end/CSSStyleModel.js:
+        (WebInspector.CSSStyleModel.prototype.setRuleSelector.callback):
+        (WebInspector.CSSStyleModel.prototype.setRuleSelector):
+        (WebInspector.CSSStyleModel.prototype.addRule.callback):
+        (WebInspector.CSSStyleModel.prototype.addRule):
+        (WebInspector.CSSStyleModel.prototype.setStyleSheetText):
+        (WebInspector.CSSProperty.prototype.setText.callback):
+        (WebInspector.CSSProperty.prototype.setText):
+        (WebInspector.CSSProperty.prototype.setDisabled.callback):
+        (WebInspector.CSSProperty.prototype.setDisabled):
+        (WebInspector.CSSStyleSheet.prototype.setText):
+        * inspector/front-end/DOMAgent.js:
+        (WebInspector.DOMAgent.prototype._markRevision):
+        (WebInspector.DOMAgent.prototype.get markUndoableState):
+
+2012-02-15  Pavel Feldman  <pfeldman@google.com>
+
+        Web Inspector: revert 'modification of DOM upon single click for selected nodes'.
+        https://bugs.webkit.org/show_bug.cgi?id=78717
+
+        Reviewed by Vsevolod Vlasov.
+
+        * inspector/front-end/ElementsTreeOutline.js:
+        (WebInspector.ElementsTreeElement.prototype.onattach):
+
+2012-02-16  Pavel Feldman  <pfeldman@google.com>
+
+        Web Inspector: move style disable checkboxes to the left
+        https://bugs.webkit.org/show_bug.cgi?id=78780
+
+        Reviewed by Vsevolod Vlasov.
+
+        * inspector/front-end/StylesSidebarPane.js:
+        (WebInspector.StylePropertiesSection):
+        (WebInspector.StylePropertiesSection.prototype._handleSelectorDoubleClick):
+        (WebInspector.StylePropertyTreeElement.prototype):
+        * inspector/front-end/elementsPanel.css:
+        (.styles-section.matched-styles .properties):
+        (.styles-section.matched-styles .properties li):
+        (.styles-section .properties li.parent::before):
+        (.styles-section .properties li.parent.expanded::before):
+        (.styles-section.matched-styles .properties li.parent .expand-element):
+        (.styles-section.matched-styles .properties li.parent.expanded .expand-element):
+        (.styles-section.computed-style .properties li.parent::before):
+        (.styles-section.computed-style .properties li.parent.expanded::before):
+        (.styles-section.matched-styles:not(.read-only):hover .properties .enabled-button):
+        (.styles-section.matched-styles:not(.read-only) .properties li.disabled .enabled-button):
+        (.styles-section .properties .enabled-button):
+        (.styles-section.matched-styles .properties ol.expanded):
+        * inspector/front-end/treeoutline.js:
+        (TreeElement.treeElementDoubleClicked):
+
+2012-02-16  Yury Semikhatsky  <yurys@chromium.org>
+
+        Web Inspector: show memory counter graphics when switching to memory view
+        https://bugs.webkit.org/show_bug.cgi?id=78808
+
+        Switching to memory view in timeline will display memory counters. Counter
+        graphics know show fair data without approximations between sampling points.
+
+        Reviewed by Pavel Feldman.
+
+        * English.lproj/localizedStrings.js:
+        * inspector/front-end/MemoryStatistics.js:
+        (WebInspector.MemoryStatistics.prototype._calculateVisibleIndexes):
+        (WebInspector.MemoryStatistics.prototype._calculateXValues):
+        (WebInspector.MemoryStatistics.prototype._drawPolyline):
+        * inspector/front-end/TimelinePanel.js:
+        (WebInspector.TimelinePanel.prototype.get statusBarItems):
+        (WebInspector.TimelinePanel.prototype._createStatusbarButtons):
+        (WebInspector.TimelinePanel.prototype._timelinesOverviewItemSelected):
+        (WebInspector.TimelinePanel.prototype._memoryOverviewItemSelected):
+
+2012-02-16  Ilya Tikhonovsky  <loislo@chromium.org>
+
+        Web Inspector: [heap snapshot] It could be useful to have access to the selected heap object from the console.
+        https://bugs.webkit.org/show_bug.cgi?id=78496
+
+        Reviewed by Yury Semikhatsky.
+
+       * bindings/js/JSInjectedScriptHostCustom.cpp:
+        (WebCore::JSInjectedScriptHost::inspectedObject):
+        * bindings/v8/custom/V8InjectedScriptHostCustom.cpp:
+        (WebCore::V8InjectedScriptHost::inspectedObjectCallback):
+        * inspector/InjectedScriptHost.cpp:
+        (WebCore::InjectedScriptHost::InjectedScriptHost):
+        (WebCore::InjectedScriptHost::InspectableObject::get):
+        (WebCore):
+        (WebCore::InjectedScriptHost::addInspectedObject):
+        (WebCore::InjectedScriptHost::clearInspectedObjects):
+        (WebCore::InjectedScriptHost::inspectedObject):
+        * inspector/InjectedScriptHost.h:
+        (InspectableObject):
+        (WebCore::InjectedScriptHost::InspectableObject::~InspectableObject):
+        (InjectedScriptHost):
+        * inspector/InjectedScriptHost.idl:
+        * inspector/InjectedScriptSource.js:
+        (.):
+        * inspector/Inspector.json:
+        * inspector/InspectorAgent.cpp:
+        (WebCore::InspectorAgent::domContentLoadedEventFired):
+        * inspector/InspectorConsoleAgent.cpp:
+        (InspectableHeapObject):
+        (WebCore::InspectableHeapObject::InspectableHeapObject):
+        (WebCore::InspectableHeapObject::get):
+        (WebCore):
+        (WebCore::InspectorConsoleAgent::addInspectedHeapObject):
+        * inspector/InspectorConsoleAgent.h:
+        (InspectorConsoleAgent):
+        * inspector/InspectorProfilerAgent.cpp:
+        (WebCore::InspectorProfilerAgent::resetState):
+        * inspector/PageConsoleAgent.cpp:
+        (InspectableNode):
+        (WebCore::InspectableNode::InspectableNode):
+        (WebCore::InspectableNode::get):
+        (WebCore):
+        (WebCore::PageConsoleAgent::addInspectedNode):
+        * inspector/front-end/DetailedHeapshotView.js:
+        (WebInspector.DetailedHeapshotView.prototype._selectionChanged):
+        (WebInspector.DetailedHeapshotView.prototype._inspectedObjectChanged):
+
+2012-02-16  Kihong Kwon  <kihong.kwon@samsung.com>
+
+        Add support for unsigned long[] to idl bindings to JSC.
+        https://bugs.webkit.org/show_bug.cgi?id=78210
+
+        Reviewed by Kentaro Hara.
+
+        Add support for unsigned long[] parameter type in idl.
+        This patch adds support just for unsigned long[] parameter type.
+        (support for other types of array should be done in another patch.)
+
+        tests added to TestObj.idl.
+
+        * bindings/js/JSDOMBinding.h:
+        (WebCore::jsUnsignedLongArrayToVector):
+        * bindings/scripts/CodeGeneratorJS.pm:
+        (AddIncludesForType):
+        (JSValueToNative):
+        (NativeToJSValue):
+        * bindings/scripts/test/JS/JSTestObj.cpp:
+        (WebCore):
+        (WebCore::jsTestObjPrototypeFunctionMethodWithUnsignedLongArray):
+        * bindings/scripts/test/JS/JSTestObj.h:
+        (WebCore):
+        * bindings/scripts/test/TestObj.idl:
+
+2012-02-16  Vsevolod Vlasov  <vsevik@chromium.org>
+
+        Web Inspector: [InspectorIndexedDB] Add IndexedDB TreeElement to resources panel.
+        https://bugs.webkit.org/show_bug.cgi?id=78609
+
+        Reviewed by Yury Semikhatsky.
+
+        Added IndexedDB tree element to resources panel (behind experimental setting).
+        Test is currently disabled, since we don't run tests with experiments enabled.
+
+        * English.lproj/localizedStrings.js:
+        * WebCore.gypi:
+        * inspector/front-end/Images/indexedDB.png: Added.
+        * inspector/front-end/Images/indexedDBIndex.png: Added.
+        * inspector/front-end/Images/indexedDBObjectStore.png: Added.
+        * inspector/front-end/IndexedDBModel.js:
+        (WebInspector.IndexedDBModel):
+        (WebInspector.IndexedDBModel.prototype.refreshDatabaseNames):
+        (WebInspector.IndexedDBModel.prototype.refreshDatabase):
+        (WebInspector.IndexedDBModel.prototype._reset):
+        (WebInspector.IndexedDBModel.prototype._originAddedToFrame):
+        (WebInspector.IndexedDBModel.prototype._originRemoved):
+        (WebInspector.IndexedDBModel.prototype._databaseAdded):
+        (WebInspector.IndexedDBModel.prototype._databaseRemoved):
+        (WebInspector.IndexedDBModel.prototype._loadDatabaseNamesForFrame):
+        (WebInspector.IndexedDBModel.prototype._loadDatabase.callback):
+        (WebInspector.IndexedDBModel.prototype._loadDatabase):
+        (WebInspector.IndexedDBModel.Frame):
+        (WebInspector.IndexedDBModel.DatabaseId):
+        (WebInspector.IndexedDBModel.DatabaseId.prototype.equals):
+        (WebInspector.IndexedDBModel.Database):
+        (WebInspector.IndexedDBModel.Index):
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.IndexedDBTreeElement):
+        (WebInspector.IndexedDBTreeElement.prototype.onexpand):
+        (WebInspector.IndexedDBTreeElement.prototype._createIndexedDBModel):
+        (WebInspector.IndexedDBTreeElement.prototype.refreshIndexedDB):
+        (WebInspector.IndexedDBTreeElement.prototype._indexedDBAdded):
+        (WebInspector.IndexedDBTreeElement.prototype._indexedDBRemoved):
+        (WebInspector.IndexedDBTreeElement.prototype._indexedDBLoaded):
+        (WebInspector.IndexedDBTreeElement.prototype._idbDatabaseTreeElement):
+        (WebInspector.IDBDatabaseTreeElement):
+        (WebInspector.IDBDatabaseTreeElement.prototype.update):
+        (WebInspector.IDBDatabaseTreeElement.prototype.onselect):
+        (WebInspector.IDBObjectStoreTreeElement):
+        (WebInspector.IDBObjectStoreTreeElement.prototype.update):
+        (WebInspector.IDBIndexTreeElement):
+        (WebInspector.IDBIndexTreeElement.prototype.update):
+        * inspector/front-end/Settings.js:
+        (WebInspector.ExperimentsSettings):
+        * inspector/front-end/WebKit.qrc:
+        * inspector/front-end/resourcesPanel.css:
+        (.indexed-db-storage-tree-item .icon):
+        (.indexed-db-object-store-storage-tree-item .icon):
+        (.indexed-db-index-storage-tree-item .icon):
+
+2012-02-15  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        REGRESSION (Safari 5.0.5 - 5.1): No animation on svg-wow.org/text-effects/text-effects.xhtml
+        https://bugs.webkit.org/show_bug.cgi?id=65072
+
+        Reviewed by Zoltan Herczeg.
+
+        Fix EMS/EXS length resolving, when the target context has no renderer, eg.
+        <text display="none" dy="1em">ABC</text>, myText.dy.baseVal.getItem(0).value()
+        currently throws, even if <text> has a parent, we could use to resolve the length.
+
+        Always fall-back to parent context, to resolve EMS/EXS units, instead of ignoring it.
+        The current behaviour stays the same, if the target element is not in the document,
+        then we really can't resolve lengths like this.
+
+        Tests: svg/text/ems-display-none.svg
+               svg/text/exs-display-none.svg
+
+        * svg/SVGLengthContext.cpp:
+        (WebCore::renderStyleForLengthResolving):
+        (WebCore::SVGLengthContext::convertValueFromUserUnitsToEMS):
+        (WebCore::SVGLengthContext::convertValueFromEMSToUserUnits):
+        (WebCore::SVGLengthContext::convertValueFromUserUnitsToEXS):
+        (WebCore::SVGLengthContext::convertValueFromEXSToUserUnits):
+
+2012-02-16  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Build fix for Qt 5 without QtWidgets.
+
+        Reviewed by Tor Arne Vestbø.
+
+        The reason why QGLContext is included in Extensions3DQt.cpp is to
+        achieve an implicit gl.h inclusion (needed for GL_FALSE). This patch
+        replaces the inclusion with the OpenGLShims.h inclusions, which has
+        the necessary #ifdefs in place to pull in gl.h with Qt 5 without QtWidgets.
+
+        * platform/graphics/qt/Extensions3DQt.cpp:
+
+2012-02-16  Shawn Singh  <shawnsingh@chromium.org>
+
+        [chromium] Refactor CCLayerTreeHostCommon: create helper function for complex boolean condition
+        https://bugs.webkit.org/show_bug.cgi?id=78539
+
+        Reviewed by James Robinson.
+
+        This change should introduce no change in behavior, and its
+        expected behavior is already covered by existing tests.
+
+        In calculateDrawTransformsAndVisibility, there is a complex
+        boolean condition that indicates whether we should create a
+        RenderSurface or not. This patch pulls out that boolean logic,
+        and wraps it in a helper function for much better readability.
+
+        * platform/graphics/chromium/cc/CCLayerTreeHostCommon.cpp:
+        (WebCore::layerShouldBeSkipped):
+        (WebCore):
+        (WebCore::subtreeShouldRenderToSeparateSurface):
+        (WebCore::calculateDrawTransformsAndVisibilityInternal):
+
+2012-02-16  Andrey Kosyakov  <caseq@chromium.org>
+
+        Web Inspector: [refactoring] move timeline overview sidebar creation to TimelineOverviewPane
+        https://bugs.webkit.org/show_bug.cgi?id=78782
+
+        Reviewed by Vsevolod Vlasov.
+
+        * inspector/front-end/TimelineOverviewPane.js:
+        (WebInspector.TimelineOverviewPane):
+        (WebInspector.TimelineOverviewPane.prototype.showTimelines):
+        (WebInspector.TimelineOverviewPane.prototype.showMemoryGraph):
+        (WebInspector.TimelineOverviewPane.prototype.sidebarResized):
+        * inspector/front-end/TimelinePanel.js:
+        (WebInspector.TimelinePanel):
+        (WebInspector.TimelinePanel.prototype.sidebarResized):
+
+2012-02-15  Andreas Kling  <awesomekling@apple.com>
+
+        Share font-family CSS values through CSSValuePool.
+        <http://webkit.org/b/78604>
+
+        Reviewed by Darin Adler.
+
+        Cache and share FontFamilyValue instances in the per-document CSSValuePool.
+        This reduces memory consumption by 248 kB on the Moz page cycler (64-bit)
+        and avoids a bunch of extra work.
+
+        This is a regression from the recent attribute style refactoring; previously
+        the mapped attribute declaration table would ensure that multiple 'font'
+        elements with the same 'face' value would share the same FontFamilyValue.
+
+        We're not yet sharing the entire CSSValueList returned by parseFontFamily()
+        but this is a step on the way there.
+
+        * css/FontFamilyValue.cpp:
+        * css/FontFamilyValue.h:
+
+            Removed appendSpaceSeparated(), making FontFamilyValue immutable.
+
+        * css/CSSParser.cpp:
+        (FontFamilyValueBuilder):
+        (WebCore::FontFamilyValueBuilder::FontFamilyValueBuilder):
+        (WebCore::FontFamilyValueBuilder::add):
+        (WebCore::FontFamilyValueBuilder::commit):
+        (WebCore::CSSParser::parseFontFamily):
+
+            Refactor parseFontFamily() to defer creation of FontFamilyValue until
+            the whole family name is known. Added a little helper class to avoid
+            code duplication.
+
+        * css/CSSValuePool.h:
+        * css/CSSValuePool.cpp:
+        (WebCore::CSSValuePool::createFontFamilyValue):
+
+            Added a FontFamilyValue cache to CSSValuePool. All values are tied to
+            the lifetime of the pool.
+
+2012-02-16  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        [Qt] Move event conversion functions from WebCore to WebKit
+        https://bugs.webkit.org/show_bug.cgi?id=78788
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Move QtWidgets dependent mouse event constructors out of WebCore
+        into WebKit, similar to the web event conversions of WebKit2.
+
+        * Target.pri:
+        * platform/PlatformMouseEvent.h:
+        (PlatformMouseEvent):
+        * platform/PlatformWheelEvent.h:
+        (PlatformWheelEvent):
+
+2012-02-16  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Unreviewed prospective Qt 4.8/Mac build fix.
+
+        Cast the PlatformWidget from QObject* to QWidget* to gain access
+        to QWidget methods.
+
+        * plugins/mac/PluginViewMac.mm:
+        (WebCore::nativeWindowFor):
+        (WebCore::cgHandleFor):
+        (WebCore::topLevelOffsetFor):
+        (WebCore::PluginView::setFocus):
+        (WebCore::PluginView::invalidateRect):
+
+2012-02-16  Roland Steiner  <rolandsteiner@chromium.org>
+
+        <style scoped>: Implement scoped selector matching in the slow path
+        https://bugs.webkit.org/show_bug.cgi?id=77528
+
+        Added scope information to SelectorCheckingContext, SelectorChecker methods and CSSStyleSelector methods.
+        Added matchOptions struct to CSSStyleSelector similar to SelectorCheckingContext in SelectorChecker.
+        Adapted the calling sites.
+
+        Reviewed by Antti Koivisto.
+
+        No new tests. (extended existing tests)
+
+        * css/CSSStyleSelector.cpp:
+        (RuleData):
+        (RuleSet):
+        (WebCore::CSSStyleSelector::determineScopingElement):
+        (WebCore::CSSStyleSelector::collectMatchingRules):
+        (WebCore::CSSStyleSelector::collectMatchingRulesForRegion):
+        (WebCore::CSSStyleSelector::matchScopedAuthorRules):
+        (WebCore::CSSStyleSelector::matchAuthorRules):
+        (WebCore::CSSStyleSelector::collectMatchingRulesForList):
+        * css/CSSStyleSelector.h:
+        (CSSStyleSelector):
+        (MatchOptions):
+        (WebCore::CSSStyleSelector::MatchOptions::MatchOptions):
+        * css/SelectorChecker.cpp:
+        (WebCore::SelectorChecker::checkSelector):
+        * css/SelectorChecker.h:
+        (WebCore::SelectorChecker::SelectorCheckingContext::SelectorCheckingContext):
+        (SelectorCheckingContext):
+        (SelectorChecker):
+
+2012-02-15  Patrick Gansterer  <paroga@webkit.org>
+
+        Windows build fix for !ENABLE(CSS_FILTERS) after r106593.
+
+        * platform/graphics/ca/win/PlatformCALayerWin.cpp:
+
+2012-02-15  Antti Koivisto  <antti@apple.com>
+
+        Move the context invalidation code out from StylePropertySet
+        https://bugs.webkit.org/show_bug.cgi?id=78589
+
+        Reviewed by Ryosuke Niwa.
+
+        StylePropertySet should be independent of its context so that they can in the future
+        be shared between documents. The context invalidation code should move to the CSSOM wrapper.
+        
+        Parent rule and parent element pointers move to the CSSOM wrapper classes. 
+        
+        The wrapper is responsible of invalidating the element or document style on mutation.
+        In case of internal mutation of style attribute, StyledElement takes care of the 
+        invalidation.
+        
+        The StylePropertySet will still have a pointer to the context stylesheet so the patch
+        doesn't actually reduce memory usage. That pointer will be factored out later.
+
+        * css/CSSFontFaceRule.cpp:
+        (WebCore::CSSFontFaceRule::~CSSFontFaceRule):
+        * css/CSSFontFaceRule.h:
+        (WebCore::CSSFontFaceRule::style):
+        * css/CSSPageRule.cpp:
+        (WebCore::CSSPageRule::~CSSPageRule):
+        * css/CSSPageRule.h:
+        (WebCore::CSSPageRule::style):
+        (WebCore::CSSPageRule::setDeclaration):
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::createStyleRule):
+        (WebCore::CSSParser::createFontFaceRule):
+        (WebCore::CSSParser::createPageRule):
+        (WebCore::CSSParser::createKeyframeRule):
+        * css/CSSStyleRule.cpp:
+        (WebCore::CSSStyleRule::~CSSStyleRule):
+        * css/CSSStyleRule.h:
+        (WebCore::CSSStyleRule::style):
+        (WebCore::CSSStyleRule::setDeclaration):
+        * css/StylePropertySet.cpp:
+        (PropertySetCSSStyleDeclaration):
+        (WebCore::PropertySetCSSStyleDeclaration::parentElement):
+        (WebCore::PropertySetCSSStyleDeclaration::clearParentRule):
+        (WebCore::PropertySetCSSStyleDeclaration::clearParentElement):
+        (WebCore::PropertySetCSSStyleDeclaration::setNeedsStyleRecalc):
+        (RuleCSSStyleDeclaration):
+        (WebCore::RuleCSSStyleDeclaration::RuleCSSStyleDeclaration):
+        (WebCore::RuleCSSStyleDeclaration::parentRule):
+        (WebCore::RuleCSSStyleDeclaration::clearParentRule):
+        (WebCore):
+        (InlineCSSStyleDeclaration):
+        (WebCore::InlineCSSStyleDeclaration::InlineCSSStyleDeclaration):
+        (WebCore::InlineCSSStyleDeclaration::parentElement):
+        (WebCore::InlineCSSStyleDeclaration::clearParentElement):
+        (WebCore::StylePropertySet::StylePropertySet):
+        (WebCore::StylePropertySet::removeShorthandProperty):
+        (WebCore::StylePropertySet::removeProperty):
+        (WebCore::StylePropertySet::setProperty):
+        (WebCore::StylePropertySet::parseDeclaration):
+        (WebCore::StylePropertySet::addParsedProperties):
+        (WebCore::StylePropertySet::addParsedProperty):
+        (WebCore::StylePropertySet::merge):
+        (WebCore::StylePropertySet::removePropertiesInSet):
+        (WebCore::StylePropertySet::copy):
+        (WebCore::StylePropertySet::ensureCSSStyleDeclaration):
+        (WebCore::StylePropertySet::ensureRuleCSSStyleDeclaration):
+        (WebCore::StylePropertySet::ensureInlineCSSStyleDeclaration):
+        (WebCore::StylePropertySet::clearParentRule):
+        (WebCore::StylePropertySet::clearParentElement):
+        (WebCore::PropertySetCSSStyleDeclaration::setCssText):
+        (WebCore::PropertySetCSSStyleDeclaration::setProperty):
+        (WebCore::PropertySetCSSStyleDeclaration::removeProperty):
+        (WebCore::PropertySetCSSStyleDeclaration::setPropertyInternal):
+        (WebCore::RuleCSSStyleDeclaration::setNeedsStyleRecalc):
+        (WebCore::InlineCSSStyleDeclaration::setNeedsStyleRecalc):
+        * css/StylePropertySet.h:
+        (WebCore::StylePropertySet::create):
+        (StylePropertySet):
+        (WebCore::StylePropertySet::useStrictParsing):
+        (WebCore::StylePropertySet::contextStyleSheet):
+        (WebCore::StylePropertySet::setContextStyleSheet):
+        * css/WebKitCSSKeyframeRule.cpp:
+        (WebCore::WebKitCSSKeyframeRule::~WebKitCSSKeyframeRule):
+        (WebCore::WebKitCSSKeyframeRule::setDeclaration):
+        * css/WebKitCSSKeyframeRule.h:
+        (WebCore::WebKitCSSKeyframeRule::style):
+        * dom/ElementAttributeData.cpp:
+        (WebCore::ElementAttributeData::ensureInlineStyleDecl):
+        (WebCore::ElementAttributeData::destroyInlineStyleDecl):
+        * dom/ElementAttributeData.h:
+        (ElementAttributeData):
+        * dom/StyledElement.cpp:
+        (WebCore::StyledElement::insertedIntoDocument):
+        (WebCore):
+        (WebCore::StyledElement::removedFromDocument):
+        (WebCore::StyledElement::parseAttribute):
+        (WebCore::StyledElement::inlineStyleChanged):
+        (WebCore::StyledElement::setInlineStyleProperty):
+        (WebCore::StyledElement::removeInlineStyleProperty):
+        (WebCore::StyledElement::updateAttributeStyle):
+        * dom/StyledElement.h:
+        (StyledElement):
+        (WebCore::StyledElement::destroyInlineStyleDecl):
+        * editing/ApplyStyleCommand.cpp:
+        (WebCore::ApplyStyleCommand::applyRelativeFontStyleChange):
+        * editing/DeleteButtonController.cpp:
+        (WebCore::DeleteButtonController::createDeletionUI):
+        (WebCore::DeleteButtonController::show):
+        (WebCore::DeleteButtonController::hide):
+        * editing/Editor.cpp:
+        (WebCore::Editor::applyEditingStyleToElement):
+        * editing/RemoveCSSPropertyCommand.cpp:
+        (WebCore::RemoveCSSPropertyCommand::doApply):
+        (WebCore::RemoveCSSPropertyCommand::doUnapply):
+        * editing/ReplaceSelectionCommand.cpp:
+        (WebCore::ReplaceSelectionCommand::removeRedundantStylesAndKeepStyleSpanInline):
+        * html/ColorInputType.cpp:
+        (WebCore::ColorInputType::updateColorSwatch):
+        * html/HTMLTextFormControlElement.cpp:
+        (WebCore::HTMLTextFormControlElement::updatePlaceholderVisibility):
+        * html/ImageDocument.cpp:
+        (WebCore::ImageDocument::resizeImageToFit):
+        (WebCore::ImageDocument::restoreImageSize):
+        (WebCore::ImageDocument::windowSizeChanged):
+        * html/ValidationMessage.cpp:
+        (WebCore::adjustBubblePosition):
+        (WebCore::ValidationMessage::buildBubbleTree):
+        * html/shadow/MediaControlElements.cpp:
+        (WebCore::MediaControlElement::show):
+        (WebCore::MediaControlElement::hide):
+        (WebCore::MediaControlPanelElement::setPosition):
+        (WebCore::MediaControlPanelElement::resetPosition):
+        (WebCore::MediaControlPanelElement::makeOpaque):
+        (WebCore::MediaControlPanelElement::makeTransparent):
+        (WebCore::MediaControlInputElement::show):
+        (WebCore::MediaControlInputElement::hide):
+        (WebCore::MediaControlTextTrackContainerElement::updateSizes):
+        * html/shadow/MeterShadowElement.cpp:
+        (WebCore::MeterValueElement::setWidthPercentage):
+        * html/shadow/ProgressShadowElement.cpp:
+        (WebCore::ProgressValueElement::setWidthPercentage):
+        * html/shadow/SliderThumbElement.cpp:
+        (WebCore::TrackLimiterElement::create):
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::resize):
+        * rendering/RenderTextControlSingleLine.cpp:
+        (WebCore::RenderTextControlSingleLine::styleDidChange):
+        * svg/SVGFontFaceElement.cpp:
+        (WebCore::SVGFontFaceElement::SVGFontFaceElement):
+        (WebCore::SVGFontFaceElement::insertedIntoDocument):
+        (WebCore::SVGFontFaceElement::removeFromMappedElementSheet):
+
+2012-02-15  Daniel Cheng  <dcheng@chromium.org>
+
+        dataTransfer.types (HTML5 drag & drop) should return DOMStringList
+        https://bugs.webkit.org/show_bug.cgi?id=30416
+
+        Reviewed by Eric Seidel.
+
+        This change breaks backwards compatibility; however, since Firefox only supported
+        event.dataTransfer.types.contains, sites already needed to check whether to use contains or
+        indexOf. Therefore, the net compatibility effect of this change should be minimal.
+
+        Test: fast/events/drag-dataTransfer-live-attributes.html
+
+        * bindings/js/JSClipboardCustom.cpp:
+        (WebCore):
+        * bindings/v8/custom/V8ClipboardCustom.cpp:
+        * dom/Clipboard.cpp:
+        (WebCore::Clipboard::hasStringOfType):
+        * dom/Clipboard.h:
+        (WebCore):
+        (Clipboard):
+        * dom/Clipboard.idl:
+        * platform/blackberry/ClipboardBlackBerry.cpp:
+        (WebCore::ClipboardBlackBerry::types):
+        * platform/blackberry/ClipboardBlackBerry.h:
+        (ClipboardBlackBerry):
+        * platform/chromium/ChromiumDataObject.cpp:
+        (WebCore::ChromiumDataObject::types):
+        * platform/chromium/ChromiumDataObject.h:
+        (ChromiumDataObject):
+        * platform/chromium/ClipboardChromium.cpp:
+        (WebCore::ClipboardChromium::types):
+        (WebCore::ClipboardChromium::mayUpdateItems):
+        * platform/chromium/ClipboardChromium.h:
+        (ClipboardChromium):
+        * platform/chromium/DragDataChromium.cpp:
+        (WebCore::containsHTML):
+        (WebCore::DragData::containsURL):
+        (WebCore::DragData::asURL):
+        (WebCore::DragData::containsPlainText):
+        (WebCore::DragData::canSmartReplace):
+        (WebCore::DragData::asFragment):
+        * platform/efl/ClipboardEfl.cpp:
+        (WebCore::ClipboardEfl::types):
+        * platform/efl/ClipboardEfl.h:
+        (ClipboardEfl):
+        * platform/gtk/ClipboardGtk.cpp:
+        (WebCore::ClipboardGtk::types):
+        * platform/gtk/ClipboardGtk.h:
+        (ClipboardGtk):
+        * platform/mac/ClipboardMac.h:
+        (ClipboardMac):
+        * platform/mac/ClipboardMac.mm:
+        (WebCore::addHTMLClipboardTypesForCocoaType):
+        (WebCore::ClipboardMac::types):
+        * platform/qt/ClipboardQt.cpp:
+        (WebCore::ClipboardQt::types):
+        * platform/qt/ClipboardQt.h:
+        (ClipboardQt):
+        * platform/win/ClipboardWin.cpp:
+        (WebCore::addMimeTypesForFormat):
+        (WebCore::ClipboardWin::types):
+        * platform/win/ClipboardWin.h:
+        (ClipboardWin):
+        * platform/wx/ClipboardWx.cpp:
+        (WebCore::ClipboardWx::types):
+        * platform/wx/ClipboardWx.h:
+        (ClipboardWx):
+
+2012-02-15  Bear Travis  <betravis@adobe.com>
+
+        Repaint issues on changing 'viewBox' of inner SVG
+        https://bugs.webkit.org/show_bug.cgi?id=77903
+
+        Reviewed by Nikolas Zimmermann.
+
+        Do not update the child viewbox/viewport transform to its parent
+        coordinate system until after layout has stored the old bounds for
+        repainting purposes.
+        
+        Test: svg/repaint/inner-svg-change-viewBox-contract.svg
+
+        * rendering/svg/RenderSVGViewportContainer.cpp:
+        (WebCore::RenderSVGViewportContainer::RenderSVGViewportContainer):
+        (WebCore::RenderSVGViewportContainer::calcViewport):
+        (WebCore):
+        (WebCore::RenderSVGViewportContainer::calculateLocalTransform):
+        (WebCore::RenderSVGViewportContainer::localToParentTransform):
+        * rendering/svg/RenderSVGViewportContainer.h:
+        (WebCore::RenderSVGViewportContainer::setNeedsTransformUpdate):
+        (RenderSVGViewportContainer):
+        * svg/SVGSVGElement.cpp:
+        (WebCore::SVGSVGElement::svgAttributeChanged):
+
+2012-02-15  Bear Travis  <betravis@adobe.com>
+
+        Repaint issues on changing 'viewBox' of inner SVG
+        https://bugs.webkit.org/show_bug.cgi?id=77903
+
+        Reviewed by Nikolas Zimmermann.
+
+        Do not update the child viewbox/viewport transform to its parent
+        coordinate system until after layout has stored the old bounds for
+        repainting purposes.
+        
+        Test: svg/repaint/inner-svg-change-viewBox-contract.svg
+
+        * rendering/svg/RenderSVGViewportContainer.cpp:
+        (WebCore::RenderSVGViewportContainer::RenderSVGViewportContainer):
+        (WebCore::RenderSVGViewportContainer::calcViewport):
+        (WebCore):
+        (WebCore::RenderSVGViewportContainer::calculateLocalTransform):
+        (WebCore::RenderSVGViewportContainer::localToParentTransform):
+        * rendering/svg/RenderSVGViewportContainer.h:
+        (WebCore::RenderSVGViewportContainer::setNeedsTransformUpdate):
+        (RenderSVGViewportContainer):
+        * svg/SVGSVGElement.cpp:
+        (WebCore::SVGSVGElement::svgAttributeChanged):
+
+2012-02-15  Daniel Cheng  <dcheng@chromium.org>
+
+        dataTransfer.types (HTML5 drag & drop) should return DOMStringList
+        https://bugs.webkit.org/show_bug.cgi?id=30416
+
+        Reviewed by Eric Seidel.
+
+        This change breaks backwards compatibility; however, since Firefox only supported
+        event.dataTransfer.types.contains, sites already needed to check whether to use contains or
+        indexOf. Therefore, the net compatibility effect of this change should be minimal.
+
+        Test: fast/events/drag-dataTransfer-live-attributes.html
+
+        * bindings/js/JSClipboardCustom.cpp:
+        (WebCore):
+        * bindings/v8/custom/V8ClipboardCustom.cpp:
+        * dom/Clipboard.cpp:
+        (WebCore::Clipboard::hasStringOfType):
+        * dom/Clipboard.h:
+        (WebCore):
+        (Clipboard):
+        * dom/Clipboard.idl:
+        * platform/blackberry/ClipboardBlackBerry.cpp:
+        (WebCore::ClipboardBlackBerry::types):
+        * platform/blackberry/ClipboardBlackBerry.h:
+        (ClipboardBlackBerry):
+        * platform/chromium/ChromiumDataObject.cpp:
+        (WebCore::ChromiumDataObject::types):
+        * platform/chromium/ChromiumDataObject.h:
+        (ChromiumDataObject):
+        * platform/chromium/ClipboardChromium.cpp:
+        (WebCore::ClipboardChromium::types):
+        (WebCore::ClipboardChromium::mayUpdateItems):
+        * platform/chromium/ClipboardChromium.h:
+        (ClipboardChromium):
+        * platform/chromium/DragDataChromium.cpp:
+        (WebCore::containsHTML):
+        (WebCore::DragData::containsURL):
+        (WebCore::DragData::asURL):
+        (WebCore::DragData::containsPlainText):
+        (WebCore::DragData::canSmartReplace):
+        (WebCore::DragData::asFragment):
+        * platform/efl/ClipboardEfl.cpp:
+        (WebCore::ClipboardEfl::types):
+        * platform/efl/ClipboardEfl.h:
+        (ClipboardEfl):
+        * platform/gtk/ClipboardGtk.cpp:
+        (WebCore::ClipboardGtk::types):
+        * platform/gtk/ClipboardGtk.h:
+        (ClipboardGtk):
+        * platform/mac/ClipboardMac.h:
+        (ClipboardMac):
+        * platform/mac/ClipboardMac.mm:
+        (WebCore::addHTMLClipboardTypesForCocoaType):
+        (WebCore::ClipboardMac::types):
+        * platform/qt/ClipboardQt.cpp:
+        (WebCore::ClipboardQt::types):
+        * platform/qt/ClipboardQt.h:
+        (ClipboardQt):
+        * platform/win/ClipboardWin.cpp:
+        (WebCore::addMimeTypesForFormat):
+        (WebCore::ClipboardWin::types):
+        * platform/win/ClipboardWin.h:
+        (ClipboardWin):
+        * platform/wx/ClipboardWx.cpp:
+        (WebCore::ClipboardWx::types):
+        * platform/wx/ClipboardWx.h:
+        (ClipboardWx):
+
+2012-02-15  Bear Travis  <betravis@adobe.com>
+
+        Repaint issues on changing 'viewBox' of inner SVG
+        https://bugs.webkit.org/show_bug.cgi?id=77903
+
+        Reviewed by Nikolas Zimmermann.
+
+        Do not update the child viewbox/viewport transform to its parent
+        coordinate system until after layout has stored the old bounds for
+        repainting purposes.
+        
+        Test: svg/repaint/inner-svg-change-viewBox-contract.svg
+
+        * rendering/svg/RenderSVGViewportContainer.cpp:
+        (WebCore::RenderSVGViewportContainer::RenderSVGViewportContainer):
+        (WebCore::RenderSVGViewportContainer::calcViewport):
+        (WebCore):
+        (WebCore::RenderSVGViewportContainer::calculateLocalTransform):
+        (WebCore::RenderSVGViewportContainer::localToParentTransform):
+        * rendering/svg/RenderSVGViewportContainer.h:
+        (WebCore::RenderSVGViewportContainer::setNeedsTransformUpdate):
+        (RenderSVGViewportContainer):
+        * svg/SVGSVGElement.cpp:
+        (WebCore::SVGSVGElement::svgAttributeChanged):
+
+2012-02-15  Anders Carlsson  <andersca@apple.com>
+
+        Fix unused parameter warnings.
+
+        * platform/graphics/ca/mac/WebTileCacheLayer.mm:
+        (-[WebTileCacheLayer setContentsScale:]):
+
+2012-02-15  Emil A Eklund  <eae@chromium.org>
+
+        Convert RenderFrameSet to LayoutUnits in preparation for turning on subpixel layout
+        https://bugs.webkit.org/show_bug.cgi?id=78526
+
+        Reviewed by Eric Seidel.
+
+        Revert paintColumnBorder and paintRowBorder to IntRect and pixel snap in
+        paint before calling them. This way the rounding logic is contained in a
+        single place (in paint).
+
+        No new tests, no new functionality.
+
+        * rendering/RenderFrameSet.cpp:
+        (WebCore::RenderFrameSet::paintColumnBorder):
+        (WebCore::RenderFrameSet::paintRowBorder):
+        (WebCore::RenderFrameSet::paint):
+        (WebCore::RenderFrameSet::getCursor):
+        * rendering/RenderFrameSet.h:
+        (RenderFrameSet):
+
+2012-02-15  Emil A Eklund  <eae@chromium.org> and Levi Weintraub  <leviw@chromium.org>
+
+        Add FractionalLayoutPoint/Size/Rect for sub-pixel layout
+        https://bugs.webkit.org/show_bug.cgi?id=76571
+
+        Reviewed by Eric Seidel.
+
+        Add fixed point versions of the Point, Size and Rect classes using
+        the new FractionalLayoutPoint type and.
+
+        FractionalLayoutPoint, FractionalLayoutSize and FractionalLayoutRect are
+        Point, Size and Rect implementations respectively using this new type.
+
+        No new tests.
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * WebCore.gypi:
+        * WebCore.order:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * platform/FractionalLayoutUnit.h:
+        Fixed a couple of typos and signed/unsigned bugs.
+
+        * platform/graphics/FloatPoint.cpp:
+        (WebCore::FloatPoint::FloatPoint):
+        Add explicit FloatPoint(FractionalLayoutPoint) constructor.
+        
+        (WebCore::FloatPoint::move):
+        Add move(FractionalLayoutSize) implementation.
+        
+        (WebCore::FloatPoint::moveBy):
+        Add moveBy(FractionalLayoutPoint) implementation.
+
+        * platform/graphics/FloatPoint.h:
+        * platform/graphics/FloatRect.cpp:
+        (WebCore::FloatRect::FloatRect):
+        Add explicit FloatRectFractionalLayoutRect) constructor.
+        
+        * platform/graphics/FloatRect.h:
+        (WebCore):
+        (FloatRect):
+        * platform/graphics/FloatSize.cpp:
+        (WebCore::FloatSize::FloatSize):
+        Add explicit FloatSize(FractionalLayoutSize) constructor.
+
+        * platform/graphics/FloatSize.h:
+        * platform/graphics/FractionalLayoutPoint.h: Added.
+        * platform/graphics/FractionalLayoutRect.cpp: Added.
+        * platform/graphics/FractionalLayoutRect.h: Added.
+        * platform/graphics/FractionalLayoutSize.cpp: Added.
+        * platform/graphics/FractionalLayoutSize.h: Added.
+        * platform/graphics/IntRect.cpp:
+        (WebCore::IntRect::IntRect):
+        Add explicit IntRect(FractionalLayoutRect) constructor.
+
+        * platform/graphics/IntRect.h:
+
+2012-02-15  Kentaro Hara  <haraken@chromium.org>
+
+        [Mac] PasteboardMac.mm build fails
+        https://bugs.webkit.org/show_bug.cgi?id=78655
+
+        Reviewed by Enrica Casucci.
+
+        This patch fixes the code to make a plain text for pasted file names.
+        The code should return a string of concatenated file names.
+
+        Test: editing/pasteboard/drag-files-to-editable-element.html
+
+        * platform/mac/PasteboardMac.mm:
+        (WebCore::Pasteboard::plainText):
+
+2012-02-15  Anders Carlsson  <andersca@apple.com>
+
+        Another attempt at fixing the Snow Leopard build.
+
+        * platform/graphics/ca/mac/TileCache.mm:
+        (WebCore::TileCache::setContentsScale):
+
+2012-02-15  Pablo Flouret  <pablof@motorola.com>
+
+        Add support for the translate attribute in html elements.
+        https://bugs.webkit.org/show_bug.cgi?id=78751
+
+        Reviewed by Adam Barth.
+
+        The translate attribute is used to specify whether an element's
+        attribute values and the values of its Text node children are to be
+        translated when the page is localized, or whether to leave them
+        unchanged.
+
+        Details at http://www.whatwg.org/specs/web-apps/current-work/multipage/elements.html#attr-translate
+
+        Test: fast/dom/HTMLElement/translate.html
+
+        * html/HTMLAttributeNames.in:
+        * html/HTMLElement.cpp:
+        (WebCore::HTMLElement::translateAttributeMode):
+        (WebCore):
+        (WebCore::HTMLElement::translate):
+        (WebCore::HTMLElement::setTranslate):
+        * html/HTMLElement.h:
+        (HTMLElement):
+        * html/HTMLElement.idl:
+
+2012-02-15  Sami Kyostila  <skyostil@google.com>
+
+        Add -webkit-overflow-scrolling CSS property
+        https://bugs.webkit.org/show_bug.cgi?id=78664
+
+        Reviewed by Eric Seidel.
+
+        Add a CSS property indicating that an element with overflow scrolling
+        should follow the platform's behavior for touch scrollable user
+        interface objects. For instance, this property could enable momentum
+        scrolling for the element if that is the platform convention.
+
+        The property has two possible values: auto (default) and touch. The
+        former does not alter overflow scrolling behavior, while the latter
+        activates touch scrolling.
+
+        As a side effect, enabling touch scrolling also causes an element to
+        gain a stacking context. This is to allow the implementation to promote
+        the scrolling contents into a render layer, which can be translated more
+        efficiently.
+
+        This property was introduced with iOS 5 WebKit. Another implementation
+        is in Chrome for Android.
+
+        Test: platform/chromium/compositing/overflow/overflow-scrolling-touch-stacking-context.html
+
+        * css/CSSComputedStyleDeclaration.cpp:
+        (WebCore):
+        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue):
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseValue):
+        * css/CSSProperty.cpp:
+        (WebCore::CSSProperty::isInheritedProperty):
+        * css/CSSPropertyNames.in:
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::adjustRenderStyle):
+        (WebCore::CSSStyleSelector::applyProperty):
+        * css/CSSValueKeywords.in:
+        * rendering/style/RenderStyle.h:
+        * rendering/style/StyleRareInheritedData.cpp:
+        (WebCore::StyleRareInheritedData::StyleRareInheritedData):
+        (WebCore::StyleRareInheritedData::operator==):
+        * rendering/style/StyleRareInheritedData.h:
+        (StyleRareInheritedData):
+
+2012-02-15  Levi Weintraub  <leviw@chromium.org>
+
+        Add zeroLayoutUnit constant.
+        https://bugs.webkit.org/show_bug.cgi?id=78747
+
+        Reviewed by Eric Seidel.
+
+        Converting call sites where LayoutUnits and raw zeros are in ternary operations
+        and templatized function calls (like std::max and min) to use a new zeroLayoutUnit
+        constant instead of the raw zero.
+
+        No new tests. No change in behavior.
+
+        * rendering/InlineFlowBox.cpp:
+        (WebCore::InlineFlowBox::placeBoxesInBlockDirection):
+        (WebCore::InlineFlowBox::addBorderOutsetVisualOverflow):
+        (WebCore::InlineFlowBox::paintFillLayer):
+        (WebCore::InlineFlowBox::paintBoxDecorations):
+        (WebCore::InlineFlowBox::paintMask):
+        (WebCore::InlineFlowBox::computeOverAnnotationAdjustment):
+        * rendering/LayoutTypes.h:
+        (WebCore):
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::MarginInfo::MarginInfo):
+        (WebCore::RenderBlock::adjustFloatingBlock):
+        (WebCore::RenderBlock::paintColumnRules):
+        (WebCore::RenderBlock::nextFloatLogicalBottomBelow):
+        (WebCore::RenderBlock::getClearDelta):
+        (WebCore::RenderBlock::computeInlinePreferredLogicalWidths):
+        (WebCore::getHeightForLineCount):
+        (WebCore::RenderBlock::adjustForUnsplittableChild):
+        * rendering/RenderBlock.h:
+        (WebCore::RenderBlock::paginationStrut):
+        (WebCore::RenderBlock::pageLogicalOffset):
+        * rendering/RenderBlockLineLayout.cpp:
+        (WebCore::LineLayoutState::updateRepaintRangeFromBox):
+        (WebCore::RenderBlock::addOverflowFromInlineChildren):
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::positionForPoint):
+        * rendering/RenderBox.h:
+        (WebCore::RenderBox::minYVisualOverflow):
+        (WebCore::RenderBox::minXVisualOverflow):
+        (RenderBox):
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::RenderBoxModelObject::offsetLeft):
+        (WebCore::RenderBoxModelObject::offsetTop):
+        (WebCore::RenderBoxModelObject::paintFillLayerExtended):
+        * rendering/RenderFieldset.cpp:
+        (WebCore::RenderFieldset::paintBoxDecorations):
+        * rendering/RenderFileUploadControl.cpp:
+        (WebCore::nodeWidth):
+        * rendering/RenderFlowThread.cpp:
+        (WebCore::RenderFlowThread::layout):
+        (WebCore::RenderFlowThread::computeLogicalWidth):
+        * rendering/RenderInline.cpp:
+        (WebCore::RenderInline::paintOutlineForLine):
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::resize):
+        * rendering/RenderListBox.cpp:
+        (WebCore::RenderListBox::listIndexAtOffset):
+        (WebCore::RenderListBox::verticalScrollbarWidth):
+        * rendering/RenderMarquee.cpp:
+        (WebCore::RenderMarquee::computePosition):
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::repaintAfterLayoutIfNeeded):
+        * rendering/RenderReplaced.cpp:
+        (WebCore::RenderReplaced::computePreferredLogicalWidths):
+        * rendering/RenderTable.cpp:
+        (WebCore::RenderTable::convertStyleLogicalWidthToComputedWidth):
+        (WebCore::RenderTable::layout):
+        * rendering/RenderTable.h:
+        (WebCore::RenderTable::bordersPaddingAndSpacingInRowDirection):
+        * rendering/mathml/RenderMathMLSubSup.cpp:
+        (WebCore::RenderMathMLSubSup::layout):
+
+2012-02-15  Alexey Proskuryakov  <ap@apple.com>
+
+        Crash after trying to use FileReader in a document with null origin string
+        https://bugs.webkit.org/show_bug.cgi?id=78649
+
+        Reviewed by Enrica Casucci.
+
+        Test: fast/files/null-origin-string.html
+
+        * fileapi/FileReaderLoader.cpp: (WebCore::FileReaderLoader::~FileReaderLoader):
+        HashMaps don't like empty keys, and they don't like removing keys that have never been added.
+
+2012-02-15  Anders Carlsson  <andersca@apple.com>
+
+        Attempt to fix the Snow Leopard build.
+
+        * platform/graphics/ca/mac/TileCache.mm:
+        (WebCore::TileCache::createTileLayer):
+        * platform/graphics/ca/mac/WebTileCacheLayer.mm:
+        (-[WebTileCacheLayer setContentsScale:]):
+
+2012-02-15  Dan Bernstein  <mitz@apple.com>
+
+        REGRESSION (r107836): fast/box-shadow/spread.html and fast/writing-mode/box-shadow-*.html tests failing
+        https://bugs.webkit.org/show_bug.cgi?id=78759
+
+        Reviewed by Simon Fraser.
+
+        * rendering/InlineFlowBox.cpp:
+        (WebCore::InlineFlowBox::boxShadowCanBeAppliedToBackground): Added. Returns false if
+        paintFillLayer() would push a clip before painting the layer, thus preventing it from casting
+        its own shadow.
+        (WebCore::InlineFlowBox::paintBoxDecorations): Pass this as an additional parameter to
+        boxShadowShouldBeAppliedToBackground().
+        * rendering/InlineFlowBox.h:
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::RenderBoxModelObject::paintFillLayerExtended): Pass the InlineFlowBox along to
+        boxShadowShouldBeAppliedToBackground().
+        (WebCore::RenderBoxModelObject::boxShadowShouldBeAppliedToBackground): Added an InlineFlowBox
+        parameter. If non-0, check boxShadowCanBeAppliedToBackground(). Also check for shadow spread,
+        and for the case of border radius with a background image, in which paintFillLayerExtended uses
+        clipping. Finally, fixed a bug in the for() loop for finding the last background layer which
+        was noticed by Tony Chang.
+        * rendering/RenderBoxModelObject.h:
+        * rendering/RenderTableCell.cpp:
+        (WebCore::RenderTableCell::boxShadowShouldBeAppliedToBackground):
+        * rendering/RenderTableCell.h:
+
+2012-02-15  Erik Arvidsson  <arv@chromium.org>
+
+        Expose Window constructor
+        https://bugs.webkit.org/show_bug.cgi?id=78722
+
+        Reviewed by Adam Barth.
+
+        Test: fast/dom/Window/window-constructor-presence.html
+
+        * page/DOMWindow.idl:
+
+2012-02-15  Kelly Norton  <knorton@google.com>
+
+        fill-opacity does not render properly only on Chromium Mac.
+        https://bugs.webkit.org/show_bug.cgi?id=78624
+
+        Reviewed by Stephen White.
+
+        Test: svg/text/text-fill-opacity.svg
+
+        * platform/graphics/skia/FontSkia.cpp:
+        (WebCore::Font::drawGlyphs):
+
+2012-02-15  Leo Yang  <leo.yang@torchmobile.com.cn>
+
+        [BlackBerry] Upstream WebPageClient.h
+        https://bugs.webkit.org/show_bug.cgi?id=78660
+
+        Reviewed by Antonio Gomes.
+
+        Header inclusion fix, no new test.
+
+        * plugins/blackberry/PluginViewPrivateBlackBerry.h:
+        Add #include <BlackBerryPlatformIntRectRegion.h>
+        and #include <BlackBerryPlatformGraphics.h> because they
+        are being removed from WebKit/blackberry/Api/WebPageClient.h.
+
+2012-02-15  Tim Horton  <timothy_horton@apple.com>
+
+        REGRESSION(r105057): Dynamically changing <tspan> offsets is broken
+        https://bugs.webkit.org/show_bug.cgi?id=78385
+        <rdar://problem/10832932>
+
+        Reviewed by Simon Fraser.
+
+        Don't short-circuit buildLayoutAttributesIfNeeded if m_textPositions is already full;
+        we can't skip rebuilding the layout attributes, just walking the tree to acquire the
+        positioning lists (invalidation of positioning lists is already covered by textDOMChanged).
+
+        Test: svg/text/tspan-dynamic-positioning.svg
+
+        * rendering/svg/SVGTextLayoutAttributesBuilder.cpp:
+        (WebCore::SVGTextLayoutAttributesBuilder::buildLayoutAttributesIfNeeded):
+
+2012-02-15  Tommy Widenflycht  <tommyw@google.com>
+
+        MediaStream API: Removing SecurityContext from the embedder API
+        https://bugs.webkit.org/show_bug.cgi?id=73816
+
+        Reviewed by Darin Fisher.
+
+        Tests for the Media Stream API will be provided by the bug 56587, pending enough landed code.
+
+        * mediastream/PeerConnection.cpp:
+        (WebCore::PeerConnection::PeerConnection):
+        * platform/mediastream/PeerConnectionHandler.h:
+        (WebCore):
+        (PeerConnectionHandler):
+        * platform/mediastream/gstreamer/PeerConnectionHandler.cpp:
+        (WebCore::PeerConnectionHandler::create):
+        (WebCore::PeerConnectionHandler::PeerConnectionHandler):
+
+2012-02-15  Nate Chapin  <japhet@chromium.org>
+
+        Fix test regressons from r107672.
+        https://bugs.webkit.org/show_bug.cgi?id=76564
+
+        Move setting CachedRawResource::m_identifer from
+        data() to setResponse(). WorkerScriptLoader depends
+        on the identifier being set correctly during setResponse()
+        in order to correctly mark itself as a ScriptResource in
+        the inspector.
+
+        Reviewed by Adam Barth.
+
+        Fixes several worker script loading tests.
+
+        * loader/cache/CachedRawResource.cpp:
+        (WebCore::CachedRawResource::data):
+        (WebCore::CachedRawResource::setResponse):
+
+2012-02-15  Enrica Casucci  <enrica@apple.com>
+
+        REGRESSION: "Copy image" fails...copies image URL instead.
+        https://bugs.webkit.org/show_bug.cgi?id=78723
+        <rdar://problem/10869104>
+
+        During the refactoring of the Pasteboard class some code was lost.
+        When placing an NSImage in the NSPasteboard as NSTIFFPboardType, we need
+        to use the its TIFF representation.
+        
+        Reviewed by Andy Estes.
+
+        * platform/mac/PasteboardMac.mm:
+        (WebCore::Pasteboard::writeImage):
+
+2012-01-31  Raphael Kubo da Costa  <kubo@profusion.mobi>
+
+        [soup] Add support for multiple SoupSessions.
+        https://bugs.webkit.org/show_bug.cgi?id=77341
+
+        Reviewed by Gustavo Noronha Silva.
+
+        Make the libsoup network backend support multiple SoupSessions. This is
+        accomplished by using the NetworkingContext classes, which now have a
+        `soupSession()' method when the libsoup backend is being used.
+
+        libsoup's ResourceHandle implementation now retrieves the SoupSession
+        via the NetworkingContext it receives instead of relying on
+        defaultSession(). defaultSession() is still used when a null
+        NetworkingContext is passed to ResourceHandle::start (for example, via
+        webkit_download_start).
+
+        The CookieJar implementation retrieves the SoupSession from the
+        NetworkingContext as much as possible as well -- the functions used by
+        WebKit2 could not be converted, though, as they seem to assume there is
+        only one shared cookie jar.
+
+        No new tests, covered by the existing ones.
+
+        * platform/network/NetworkingContext.h:
+        (NetworkingContext): Add soupSession() method if USE(SOUP) is set.
+        * platform/network/ResourceHandleInternal.h:
+        (ResourceHandleInternal):
+        * platform/network/soup/CookieJarSoup.cpp:
+        (WebCore::cookieJarForDocument):
+        (WebCore):
+        (WebCore::defaultCookieJar):
+        (WebCore::setCookies):
+        (WebCore::cookies):
+        (WebCore::cookieRequestHeaderFieldValue):
+        (WebCore::cookiesEnabled):
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::ResourceHandleInternal::soupSession): Add method to retrieve
+        a SoupSession from a NetworkingContext and fallback to defaultSession()
+        if there's no valid NetworkingContext.
+        (WebCore):
+        (WebCore::ensureSessionIsInitialized): Only change or use the default
+        cookie jar if the SoupSession being changed is the default one.
+        (WebCore::sendRequestCallback):
+        (WebCore::startHTTPRequest):
+        (WebCore::ResourceHandle::cancel):
+        (WebCore::startNonHTTPRequest):
+
+2012-02-15  Anders Carlsson  <andersca@apple.com>
+
+        The TileCache object should be deallocated on the main thread
+        https://bugs.webkit.org/show_bug.cgi?id=78757
+        <rdar://problem/10866161>
+
+        Reviewed by Sam Weinig.
+
+        Since the WebTileCacheLayer can be deleted on the scrolling thread, we need to make sure that the underlying
+        TileCache object is actually destroyed on the main thread.
+
+        * platform/graphics/ca/mac/TileCache.h:
+        * platform/graphics/ca/mac/TileCache.mm:
+        (WebCore::TileCache::~TileCache):
+        Assert that this object is being destroyed on the main thread.
+
+        * platform/graphics/ca/mac/WebTileCacheLayer.mm:
+        (-[WebTileCacheLayer dealloc]):
+        If dealloc is being called from a non-main thread, make sure to delete the tile cache object on the main thread.
+
+2012-02-15  Anders Carlsson  <andersca@apple.com>
+
+        Scrolling Coordinator must be deleted on the main thread
+        https://bugs.webkit.org/show_bug.cgi?id=78756
+        <rdar://problem/10866167>
+
+        Reviewed by Sam Weinig.
+
+        ScrollingTree::invalidate will finish breaking the cycle between the scrolling coordinator and the
+        scrolling tree by dereffing the scrolling coordinator. We need to make sure that this happens on the main
+        thread because the scrolling coordinator expects to be destroyed from there.
+
+        * page/scrolling/ScrollingTree.cpp:
+        (WebCore::derefScrollingCoordinator):
+        (WebCore):
+        (WebCore::ScrollingTree::invalidate):
+
+2012-02-15  Anders Carlsson  <andersca@apple.com>
+
+        Scrolling coordinator should handle pages being restored from the page cache
+        https://bugs.webkit.org/show_bug.cgi?id=78753
+        <rdar://problem/10866171>
+
+        Reviewed by Sam Weinig.
+
+        Replace ScrollingCoordinator::frameViewScrollLayerDidChange with a new member function,
+        ScrollingCoordinator::frameViewRootLayerDidChange which is called whenever the root layer
+        of the frame view changes (which happens on back/forward navigation as well).
+
+        In this function, reset the scrolling tree state from the frame view.
+
+        * page/scrolling/ScrollingCoordinator.cpp:
+        (WebCore::scrollLayerForFrameView):
+        Add a helper function.
+
+        (WebCore::ScrollingCoordinator::frameViewRootLayerDidChange):
+        Reset the entire scrolling tree state.
+
+        (WebCore::ScrollingCoordinator::updateMainFrameScrollPositionAndScrollLayerPosition):
+        Call the newly added helper function.
+
+        * page/scrolling/ScrollingCoordinator.h:
+        (ScrollingCoordinator):
+        * page/scrolling/mac/ScrollingCoordinatorMac.mm:
+        Remove frameViewScrollLayerDidChange.
+
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::ensureRootLayer):
+        Remove call to ScrollingCoordinator::frameViewScrollLayerDidChange.
+
+        (WebCore::RenderLayerCompositor::attachRootLayer):
+        Call ScrollingCoordinator::frameViewRootLayerDidChange.
+
+2012-02-15  Enrica Casucci  <enrica@apple.com>
+
+        Refactor ClipboardMac class to use PlatformStrategies.
+        https://bugs.webkit.org/show_bug.cgi?id=78554
+
+        Reviewed by Anders Carlsson.
+
+        No new tests. No change in behavior.
+
+        * WebCore.exp.in: Added new exported methods of the PlatformPasteboard class
+        * editing/mac/EditorMac.mm:
+        (WebCore::Editor::newGeneralClipboard): Use name based pasteboard references.
+        * page/DragClient.h:
+        (WebCore::DragClient::declareAndWriteDragImage): Ditto.
+        * page/mac/EventHandlerMac.mm:
+        (WebCore::EventHandler::createDraggingClipboard): Ditto.
+        * platform/PasteboardStrategy.h: Added new methods to get a unique pasteboard name
+        and the pasteboard change count.
+        * platform/PlatformPasteboard.h: Ditto.
+        * platform/mac/ClipboardMac.h:
+        (WebCore::ClipboardMac::create): Using name based pasteboard.
+        (WebCore::ClipboardMac::pasteboardName): Replacing the old pasteboard() method.
+        * platform/mac/ClipboardMac.mm: All the methods below have been modified to avoid
+        using Objective-C types and direct access to NSPasteboard object.
+        (WebCore::Clipboard::create):
+        (WebCore::ClipboardMac::ClipboardMac):
+        (WebCore::ClipboardMac::hasData):
+        (WebCore::cocoaTypeFromHTMLClipboardType):
+        (WebCore::utiTypeFromCocoaType):
+        (WebCore::addHTMLClipboardTypesForCocoaType):
+        (WebCore::ClipboardMac::clearData):
+        (WebCore::ClipboardMac::clearAllData):
+        (WebCore::absoluteURLsFromPasteboardFilenames):
+        (WebCore::absoluteURLsFromPasteboard):
+        (WebCore::ClipboardMac::getData):
+        (WebCore::ClipboardMac::setData):
+        (WebCore::ClipboardMac::types):
+        (WebCore::ClipboardMac::files):
+        (WebCore::ClipboardMac::setDragImage):
+        (WebCore::ClipboardMac::writeRange):
+        (WebCore::ClipboardMac::writePlainText):
+        (WebCore::ClipboardMac::writeURL):
+        (WebCore::ClipboardMac::declareAndWriteDragImage):
+        * platform/mac/PasteboardMac.mm:
+        (WebCore::Pasteboard::writeClipboard): Using name based pasteboard reference.
+        * platform/mac/PlatformPasteboardMac.mm:
+        (WebCore::PlatformPasteboard::getPathnamesForType): Fixed to support NSArray and NString content.
+        (WebCore::PlatformPasteboard::changeCount): Added.
+        (WebCore::PlatformPasteboard::uniqueName): Added.
+
+2012-02-15  Anders Carlsson  <andersca@apple.com>
+
+        TileCache needs to support setting the contents scale
+        https://bugs.webkit.org/show_bug.cgi?id=78741
+        <rdar://problem/10710773>
+
+        Reviewed by Sam Weinig.
+
+        * platform/graphics/ca/mac/TileCache.h:
+        * platform/graphics/ca/mac/TileCache.mm:
+        (WebCore::TileCache::setContentsScale):
+        Update the contents scale of all the tiles and then revalidate the tile cache since tiles
+        might have come and gone as a result of setting the contents scale.
+        
+        (WebCore::TileCache::createTileLayer):
+        Set the contents scale of the tile layer.
+
+        * platform/graphics/ca/mac/WebTileCacheLayer.mm:
+        (-[WebTileCacheLayer setContentsScale:]):
+        Call TileCache::setContentsScale.
+
+2012-02-15  Anders Carlsson  <andersca@apple.com>
+
+        Try to fix the Chromium build and remove a snarky comment in the process.
+
+        * platform/chromium/PopupListBox.cpp:
+        (WebCore::PopupListBox::handleWheelEvent):
+
+2012-02-15  Anders Carlsson  <andersca@apple.com>
+
+        Wheel events should be re-dispatched to the scrolling thread
+        https://bugs.webkit.org/show_bug.cgi?id=78731
+        <rdar://problem/10866144>
+
+        Reviewed by Sam Weinig.
+
+        When threaded scrolling is enabled, all the state is assumed to be kept in the scrolling tree,
+        on the scrolling thread. This means that even if we do end up processing an event on the main thread
+        (because of wheel event handlers for example), we still have to dispatch the wheel event back to the
+        scrolling thread.
+
+        * page/FrameView.cpp:
+        (WebCore::FrameView::wheelEvent):
+        Move wheelEvent from ScrollView and ask the scrolling coordinator to handle the wheel event.
+
+        * page/scrolling/ScrollingCoordinator.cpp:
+        (WebCore::ScrollingCoordinator::handleWheelEvent):
+        Dispatch the event to the scrolling thread, unless it will start a gesture. In that case we'll return false
+        so that information will be passed back to the UI process.
+        
+        (ScrollingCoordinator):
+        * platform/ScrollView.cpp:
+        * platform/ScrollView.h:
+        Move wheelEvent to FrameView.
+
+2012-02-15  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        RootObject::finalize can cause a crash in object->invalidate()
+        https://bugs.webkit.org/show_bug.cgi?id=78645
+
+        Reviewed by Geoffrey Garen.
+
+        No new tests.
+
+        * bridge/runtime_root.cpp:
+        (JSC::Bindings::RootObject::finalize): Added a stack-allocated RefPtr to protect the RootObject
+        during the call to invalidate().
+
+2012-02-15  Dan Bernstein  <mitz@apple.com>
+
+        <rdar://problem/10870238> Box shadow drawing takes an unnecessarily slow code path in some single-shadow, opaque-background cases
+        https://bugs.webkit.org/show_bug.cgi?id=78728
+
+        In some cases, when there is only one normal box shadow, and the box has an opaque background,
+        it is possible to draw the box shadow by having the background cast it directly. This appears
+        to be faster than the generic code path that uses a separate drawing pass to cast the shadow,
+        clipping out the border box and the shadow-casting box.
+
+        Reviewed by Dave Hyatt.
+
+        No new tests, because behavior is unchanged.
+
+        * rendering/InlineFlowBox.cpp:
+        (WebCore::InlineFlowBox::paintBoxDecorations): Changed to not paint normal box shadows if
+        they are going to be cast by the background.
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::paintBoxDecorations): Ditto.
+        * rendering/RenderBox.h: Made determineBackgroundBleedAvoidance() protected.
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::applyBoxShadowForBackground): Added this helper function, which applies the first
+        normal shadow from the given RenderStyle to the given GraphicsContext.
+        (WebCore::RenderBoxModelObject::paintFillLayerExtended): Added calls to
+        applyBoxShadowForBackground() before drawing the background color when needed.
+        (WebCore::RenderBoxModelObject::boxShadowShouldBeAppliedToBackground): Added. Returns true
+        in some of the cases where the box shadow can be cast by the background directly.
+        * rendering/RenderBoxModelObject.h:
+        * rendering/RenderFieldset.cpp:
+        (WebCore::RenderFieldset::paintBoxDecorations): Changed to not paint normal box shadows if
+        they are going to be cast by the background.
+        * rendering/RenderTable.cpp:
+        (WebCore::RenderTable::paintBoxDecorations): Ditto.
+        * rendering/RenderTableCell.cpp:
+        (WebCore::RenderTableCell::boxShadowShouldBeAppliedToBackground): Added this override that
+        always returns false, because table cells sometimes apply a clip before drawing the background.
+        * rendering/RenderTableCell.h:
+
+2012-02-15  Ojan Vafai  <ojan@chromium.org>
+
+        getComputedStyle of flex-item-align:auto should resolve to it's parent's flex-align value
+        https://bugs.webkit.org/show_bug.cgi?id=76326
+
+        Reviewed by Tony Chang.
+
+        * css/CSSComputedStyleDeclaration.cpp:
+        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue):
+
+2012-02-15  Sadrul Habib Chowdhury  <sadrul@chromium.org>
+
+        Notify ChromeClient when touch-event handlers are installed/removed.
+        https://bugs.webkit.org/show_bug.cgi?id=77440
+
+        Reviewed by Darin Fisher and Ryosuke Niwa.
+
+        Keep a count of the number of touch-event handlers and notify the
+        embedder when the count changes. Depending on the count, the embedder
+        can decide whether or not to dispatch touch events to webkit.
+
+        * dom/Document.cpp:
+        (WebCore::Document::Document):
+        (WebCore::Document::didAddTouchEventHandler):
+        (WebCore):
+        (WebCore::Document::didRemoveTouchEventHandler):
+        * dom/Document.h:
+        (WebCore::Document::touchEventHandlerCount):
+        (Document):
+        * dom/Node.cpp:
+        (WebCore::isTouchEventType):
+        (WebCore::tryAddEventListener):
+        (WebCore::tryRemoveEventListener):
+        * loader/EmptyClients.h:
+        (WebCore::EmptyChromeClient::numTouchEventHandlersChanged):
+        * page/ChromeClient.h:
+        (ChromeClient):
+        * page/Frame.cpp:
+        (WebCore::Frame::notifyChromeClientWheelEventHandlerCountChanged):
+        (WebCore::Frame::notifyChromeClientTouchEventHandlerCountChanged):
+        (WebCore):
+        * page/Frame.h:
+        (Frame):
+
+2012-02-15  Eric Carlson  <eric.carlson@apple.com>
+
+        Unset the active flag when TextTrackCues go away
+        https://bugs.webkit.org/show_bug.cgi?id=72552
+
+        Reviewed by Maciej Stachowiak.
+
+        Test: media/track/track-active-cues.html
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::loadTimerFired): Configure new text tracks before preparing to load
+            so we know about all tracks when resource selection begins.
+        (WebCore::HTMLMediaElement::prepareForLoad): Call updateActiveTextTrackCues after setting
+            to m_readyState is HAVE_NOTHING so all cues get deactivated. Don't build list of 
+            available text tracks because resource selection won't actually start until after the load timer fires.
+        (WebCore::HTMLMediaElement::loadInternal): Build list of non-disabled tracks.
+        (WebCore::HTMLMediaElement::updateActiveTextTrackCues):  Clear the active flag on all cues
+            when m_readyState is HAVE_NOTHING or m_player is 0.
+        (WebCore::HTMLMediaElement::setReadyState): Don't update m_readyState when tracks which haven't
+            loaded yet will prevent events from firing. Call updateActiveTextTrackCues to ensure that the
+            first cue(s) are shown as soon as possible.
+        (WebCore::HTMLMediaElement::userCancelledLoad): Call updateActiveTextTrackCues when when m_readyState 
+            is HAVE_NOTHING so all cues get deactivated.
+
+2012-02-15  Jessie Berlin  <jberlin@apple.com>
+
+        WebCore build exceeds address space on 32-bit Windows builders (again).
+        https://bugs.webkit.org/show_bug.cgi?id=78724
+
+        Reviewed by Jon Honeycutt.
+
+        Add the rest of the inspector .cpp files to the InspectorAllInOne.cpp file in Production and
+        Release builds.
+
+        * WebCore.vcproj/WebCore.vcproj:
+        In the process, let VS have its way with this file.
+
+        * inspector/InspectorAllInOne.cpp:
+
+2012-02-15  Anders Carlsson  <andersca@apple.com>
+
+        Remove ScrollableArea::handleGestureEvent
+        https://bugs.webkit.org/show_bug.cgi?id=78661
+
+        Reviewed by Adam Roben.
+
+        ScrollableArea::handleGestureEvent ends up being a no-op so remove it and the related code.
+
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::handleGestureEvent):
+        * platform/ScrollAnimator.cpp:
+        * platform/ScrollAnimator.h:
+        (ScrollAnimator):
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::wheelEvent):
+        * platform/ScrollView.h:
+        (ScrollView):
+        * platform/ScrollableArea.cpp:
+        * platform/ScrollableArea.h:
+        (ScrollableArea):
+
+2012-02-14  Stephen White  <senorblanco@chromium.org>
+
+        Fix for incorrect/offset image in CSS filters (non-composited path)
+        https://bugs.webkit.org/show_bug.cgi?id=78626
+
+        Reviewed by Darin Adler.
+
+        Test: css3/filters/multiple-filters-invalidation.html
+
+        * rendering/FilterEffectRenderer.cpp:
+        (WebCore::FilterEffectRenderer::prepare):
+        When invalidating results, invalidate all intermediate filter
+        results, not just the last effect's result.
+
+2012-02-15  Alexander Pavlov  <apavlov@chromium.org>
+
+        Web Inspector: "Minus" (Delete) button disappears for hovered watch expression in Watches pane
+        https://bugs.webkit.org/show_bug.cgi?id=78714
+
+        Reviewed by Pavel Feldman.
+
+        * inspector/front-end/WatchExpressionsSidebarPane.js:
+        (WebInspector.WatchExpressionsSection.prototype._mouseOut):
+
+2012-02-15  Patrick Gansterer  <paroga@webkit.org>
+
+        [CMake] Move RunLoop to WebCore/platform
+        https://bugs.webkit.org/show_bug.cgi?id=78504
+
+        Reviewed by Adam Roben.
+
+        r105475 moved RunLoop.cpp from WebKit2 to WebCore, but missed the CMake based ports.
+
+        * CMakeLists.txt:
+        * PlatformWinCE.cmake:
+
+2012-02-15  Zoltan Herczeg  <zherczeg@webkit.org>
+
+        Remove clipToImageBuffer from SourceAlpha and feComposite
+        https://bugs.webkit.org/show_bug.cgi?id=78355
+
+        Reviewed by Nikolas Zimmermann.
+
+        The implementation of clipToImageBuffer is inefficient on
+        non-mac platforms, so we would benefit if remove it.
+
+        Existing tests cover this feature.
+
+        * platform/graphics/filters/FEComposite.cpp:
+        (WebCore::FEComposite::platformApplySoftware):
+        * platform/graphics/filters/SourceAlpha.cpp:
+        (WebCore::SourceAlpha::platformApplySoftware):
+
+2012-02-15  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        [Qt] Replace use of QGLWidget/QGLContext with QOpenGLContext and QSurface for Qt 5
+        https://bugs.webkit.org/show_bug.cgi?id=78694
+
+        Reviewed by Noam Rosenthal.
+
+        Typedef PlatformGraphicsContext3D and PlatformGraphicsSurface3D to QOpenGLContext
+        and QSurface for Qt 5. Use these APIs to change the current context and get the
+        procedure addresses. Removed QGraphicsObject inheritance remainder while we're at it,
+        because that code path is obsolete.
+
+        * platform/graphics/GraphicsContext3D.h:
+        * platform/graphics/cairo/OpenGLShims.cpp:
+        (WebCore::getProcAddress):
+        * platform/graphics/cairo/OpenGLShims.h:
+        * platform/graphics/qt/GraphicsContext3DQt.cpp:
+        (WebCore::GraphicsContext3DPrivate::~GraphicsContext3DPrivate):
+        (WebCore::GraphicsContext3DPrivate::blitMultisampleFramebufferAndRestoreContext):
+        (WebCore::GraphicsContext3DPrivate::makeCurrentIfNeeded):
+        (WebCore::GraphicsContext3D::~GraphicsContext3D):
+
+2012-02-15  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        [Qt] Move Qt platform specific GL Context/Surface creation out of WebCore into WebKit
+        https://bugs.webkit.org/show_bug.cgi?id=78692
+
+        Reviewed by Noam Rosenthal.
+
+        Replace the "glWidget" term in the GraphicsContext with "surface" and delegate
+        the context and surface creation to the page client.
+
+        * platform/graphics/GraphicsContext3D.h:
+        * platform/graphics/qt/GraphicsContext3DQt.cpp:
+        (GraphicsContext3DPrivate):
+        (WebCore::GraphicsContext3DPrivate::GraphicsContext3DPrivate):
+        (WebCore::GraphicsContext3DPrivate::~GraphicsContext3DPrivate):
+        (WebCore::GraphicsContext3DPrivate::blitMultisampleFramebufferAndRestoreContext):
+        (WebCore::GraphicsContext3DPrivate::makeCurrentIfNeeded):
+        (WebCore::GraphicsContext3D::GraphicsContext3D):
+        (WebCore::GraphicsContext3D::~GraphicsContext3D):
+        (WebCore::GraphicsContext3D::platformGraphicsContext3D):
+        * platform/qt/QWebPageClient.h:
+        (QWebPageClient):
+
+2012-02-15  No'am Rosenthal  <noam.rosenthal@nokia.com>
+
+        [Texmap] Support filters in TextureMapperImageBuffer
+        https://bugs.webkit.org/show_bug.cgi?id=76026
+
+        Implement GraphicsLayer::setFilters for TextureMapper, and pass the filters all the way
+        to BitmapTextureImageBuffer. This does not introduce a new filters implementation, but
+        rather uses the non-AC implementation. A complete implementation will be needed in
+        TextureMapperGL, which can use some of the glue in this code.
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Unskipped 10 tests in css3/filters.
+
+        * platform/graphics/texmap/GraphicsLayerTextureMapper.cpp:
+        (WebCore):
+        (WebCore::GraphicsLayerTextureMapper::setFilters):
+        * platform/graphics/texmap/GraphicsLayerTextureMapper.h:
+        (GraphicsLayerTextureMapper):
+        * platform/graphics/texmap/TextureMapper.h:
+        (BitmapTexture):
+        (WebCore::BitmapTexture::applyFilters):
+        * platform/graphics/texmap/TextureMapperImageBuffer.cpp:
+        (WebCore):
+        (WebCore::BitmapTextureImageBuffer::applyFilters):
+        * platform/graphics/texmap/TextureMapperImageBuffer.h:
+        (BitmapTextureImageBuffer):
+        * platform/graphics/texmap/TextureMapperLayer.cpp:
+        (WebCore::TextureMapperLayer::shouldPaintToIntermediateSurface):
+        (WebCore):
+        (WebCore::applyFilters):
+        (WebCore::TextureMapperLayer::paintRecursive):
+        (WebCore::TextureMapperLayer::syncCompositingStateSelf):
+        * platform/graphics/texmap/TextureMapperLayer.h:
+        (State):
+
+2012-02-15  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        [Qt] Clean up fallback rendering of GraphicsContext3D to Canvas
+        https://bugs.webkit.org/show_bug.cgi?id=78690
+
+        Reviewed by Noam Rosenthal.
+
+        Use the common paintRenderingResultsToCanvas code to retrieve the
+        pixels from the FBO and use a Qt port specific paintToCanvas
+        implementation to wrap the pixels into a QImage and render it
+        into the graphics context, just like it's done for the other ports.
+
+        This removes the QGraphicsObject based paint, which is an now 
+        obsolete method of rendering.
+
+        * platform/graphics/GraphicsContext3D.h:
+        * platform/graphics/opengl/GraphicsContext3DOpenGLCommon.cpp:
+        (WebCore::GraphicsContext3D::paintRenderingResultsToCanvas):
+        * platform/graphics/qt/GraphicsContext3DQt.cpp:
+        (GraphicsContext3DPrivate):
+        (WebCore::GraphicsContext3D::paintToCanvas):
+
+2012-02-14  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        [Qt] Eliminate first set of QtWidgets dependencies from WebCore
+        https://bugs.webkit.org/show_bug.cgi?id=78611
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        * bindings/js/ScriptControllerQt.cpp: Remove unused include.
+        * page/qt/EventHandlerQt.cpp:
+        (WebCore::EventHandler::tabsToAllFormControls): Replace import
+        of private Qt(Widgets) variable with the default of Qt 5, where
+        it is also not configurable.
+        * platform/ContextMenu.h: Remove unused include.
+        * platform/ContextMenuItem.h: Ditto.
+        * platform/Widget.h: Use QObject as type for PlatformWidget
+        instead of QWidget.
+        * platform/graphics/Icon.h:
+        (Icon): Prefer QImage over QIcon for storage.
+        * platform/graphics/gstreamer/PlatformVideoWindowPrivate.h:
+        (WebCore): Make it compile with QWindow for Qt 5 and QWidget for Qt 4.
+        * platform/graphics/gstreamer/PlatformVideoWindowQt.cpp:
+        (FullScreenVideoWindow::FullScreenVideoWindow):
+        (FullScreenVideoWindow::keyPressEvent):
+        (FullScreenVideoWindow::event):
+        (FullScreenVideoWindow::showFullScreen):
+        (PlatformVideoWindow::PlatformVideoWindow):
+        * platform/graphics/qt/IconQt.cpp: Revert the implementation of this class
+        back to notImplemented(). It was trying to load the actual file as QIcon
+        instead of trying to find a symbolic icon for the given file. We should
+        probably use the QMimeType API in Qt 5 once it becomes available.
+        (WebCore::Icon::createIconForFiles):
+        (WebCore::Icon::paint):
+        * platform/graphics/qt/ImageQt.cpp:
+        (graphics): Remove use of QStyle for retrieving icons. Code moved to
+        WebCoreSupport instead.
+        * platform/qt/ContextMenuQt.cpp: Removed unused include.
+        * platform/qt/PlatformScreenQt.cpp: Add #ifdefs to use QScreen API
+        with Qt 5.
+        (WebCore::screenDepth):
+        (WebCore::screenDepthPerComponent):
+        (WebCore::screenIsMonochrome):
+        (WebCore::screenRect):
+        (WebCore::screenAvailableRect):
+        * platform/qt/QWebPageClient.h: Add hook for showing/hiding widget.
+        (WebCore):
+        (QWebPageClient):
+        * platform/qt/SoundQt.cpp:
+        (WebCore::systemBeep): Beep is not implemented in Qt 5 and its use is
+        questionable. Move back to notImplemented() until proper QPA API becomes
+        available in Qt 5 (if ever...).
+        * platform/qt/WidgetQt.cpp: Delegate QWidget specific show/hide calls
+        to the PageClient, out of WebCore.
+        (WebCore::Widget::Widget):
+        (WebCore::Widget::show):
+        (WebCore::Widget::hide):
+        * plugins/PluginView.h: Remove unused include.
+        * rendering/RenderTreeAsText.cpp:
+        (WebCore::RenderTreeAsText::writeRenderObject): When dumping properties of
+        QWidget, use the QObject property API to retrieve the values instead of
+        QWidget specific API. Removed the mask from the dump as it's not available
+        as property and our layout tests don't seem to use it.
+
+2012-02-15  Alexander Pavlov  <apavlov@chromium.org>
+
+        Web Inspector: Fix minor design issues in the Spectrum color picker
+        https://bugs.webkit.org/show_bug.cgi?id=78693
+
+        Drive-by: frontend compilability fixes.
+
+        Reviewed by Pavel Feldman.
+
+        * English.lproj/localizedStrings.js:
+        * inspector/compile-front-end.sh:
+        * inspector/front-end/ElementsPanel.js:
+        * inspector/front-end/Popover.js:
+        * inspector/front-end/Spectrum.js:
+        (WebInspector.Spectrum.rgbaToHSVA):
+        (WebInspector.Spectrum.prototype.set color):
+        (WebInspector.Spectrum.prototype.get isVisible):
+        (WebInspector.Spectrum.prototype.toggle):
+        (WebInspector.Spectrum.prototype.show):
+        (WebInspector.Spectrum.prototype.hide):
+        * inspector/front-end/StylesSidebarPane.js:
+        (WebInspector.StylePropertyTreeElement.prototype.updateTitle.):
+        * inspector/front-end/elementsPanel.css:
+        (.spectrum-container):
+        (.spectrum-top):
+        (.spectrum-color):
+        (.spectrum-hue):
+        (.spectrum-fill):
+        (.spectrum-range-container):
+        (.spectrum-range-container *):
+        (.spectrum-range-container label):
+        (.spectrum-range-container input):
+        (.swatch, .spectrum-dragger, .spectrum-slider):
+        (.spectrum-sat):
+        (.spectrum-val):
+        (.spectrum-dragger):
+        (.spectrum-slider):
+        * inspector/front-end/inspector.css:
+        (.custom-popup-vertical-scroll ::-webkit-scrollbar-track-piece:vertical:increment):
+
+2012-02-15  Yury Semikhatsky  <yurys@chromium.org>
+
+        Unreviewed. Build fix after r107806
+
+        * inspector/InjectedScript.cpp:
+        (WebCore::InjectedScript::callFunctionWithEvalEnabled):
+        * inspector/InjectedScript.h:
+        (InjectedScript):
+
+2012-02-15  Yury Semikhatsky  <yurys@chromium.org>
+
+        Web Inspector: crash when inspecting an element on a page with eval disabled by CSP
+        https://bugs.webkit.org/show_bug.cgi?id=78705
+
+        Inspector functions in injected script may use eval so we need to make sure
+        it is allowed for inspector code on pages where it is prohibited by CSP.
+
+        Reviewed by Pavel Feldman.
+
+        Test: inspector/elements/resolve-node-blocked.html
+
+        * inspector/InjectedScript.cpp:
+        (WebCore::InjectedScript::nodeForObjectId):
+        (WebCore::InjectedScript::wrapCallFrames):
+        (WebCore::InjectedScript::wrapObject):
+        (WebCore::InjectedScript::releaseObjectGroup):
+        (WebCore::InjectedScript::callFunctionWithEvalEnabled):
+        (WebCore):
+        (WebCore::InjectedScript::makeCall):
+        * inspector/InjectedScript.h:
+        (InjectedScript):
+
+2012-02-13  Brian Grinstead  <briangrinstead@gmail.com>
+
+        Web Inspector: Add colorpicker functionality to color swatches in Styles Sidebar
+        https://bugs.webkit.org/show_bug.cgi?id=71262
+
+        Reviewed by Pavel Feldman.
+
+        * English.lproj/localizedStrings.js:
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * inspector/front-end/Settings.js:
+        * inspector/front-end/Spectrum.js: Added.
+        (WebInspector.Spectrum.hueDrag):
+        (WebInspector.Spectrum.colorDrag):
+        (WebInspector.Spectrum.alphaDrag):
+        (WebInspector.Spectrum):
+        (WebInspector.Spectrum.hsvaToRGBA):
+        (WebInspector.Spectrum.rgbaToHSVA):
+        (WebInspector.Spectrum.draggable.prevent):
+        (WebInspector.Spectrum.draggable.move):
+        (WebInspector.Spectrum.draggable.start):
+        (WebInspector.Spectrum.draggable.stop):
+        (WebInspector.Spectrum.draggable):
+        (WebInspector.Spectrum.prototype.set color):
+        (WebInspector.Spectrum.prototype.get color):
+        (WebInspector.Spectrum.prototype.get outputColorFormat):
+        (WebInspector.Spectrum.prototype.get colorHueOnly):
+        (WebInspector.Spectrum.prototype.set displayText):
+        (WebInspector.Spectrum.prototype._onchange):
+        (WebInspector.Spectrum.prototype._updateHelperLocations):
+        (WebInspector.Spectrum.prototype._updateUI):
+        (WebInspector.Spectrum.prototype.toggle):
+        (WebInspector.Spectrum.prototype.show):
+        (WebInspector.Spectrum.prototype.reposition):
+        (WebInspector.Spectrum.prototype.hide):
+        * inspector/front-end/StylesSidebarPane.js:
+        (WebInspector.StylesSidebarPane):
+        (WebInspector.StylePropertyTreeElement.prototype.updateTitle.):
+        * inspector/front-end/WebKit.qrc:
+        * inspector/front-end/inspector.css:
+        (.swatch):
+        (.swatch-inner):
+        (.spectrum-container):
+        (.spectrum-top):
+        (.spectrum-color):
+        (.spectrum-hue):
+        (.spectrum-fill):
+        (.spectrum-range-container):
+        (.spectrum-range-container *):
+        (.spectrum-range-container label):
+        (.spectrum-range-container input):
+        (.swatch, .spectrum-dragger, .spectrum-slider):
+        (.spectrum-sat):
+        (.spectrum-val):
+        (.spectrum-dragger):
+        (.spectrum-slider):
+        * inspector/front-end/inspector.html:
+
+2012-02-15  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        [Qt] Be smarter with tile usages during tiling
+        https://bugs.webkit.org/show_bug.cgi?id=78243
+
+        Reviewed by Simon Hausmann.
+
+        The keep rect used to know what existing tiles to keep around, is now a
+        padding (in tile dimensions) around the usual cover rect. With usual,
+        I mean to point out that we take our panning optimization into account.
+
+        We also do a good effort at keeping the amount of tiles steady, by not
+        simply intersecting our areas with the contentRect, but moving it
+        first into legal bounds and then expanding in opposite direction to
+        cover a similar amount of pixels.
+
+        In the future the cover area should be calculated given available
+        system memory.
+
+        * platform/graphics/TiledBackingStore.cpp:
+        (WebCore):
+        (WebCore::TiledBackingStore::TiledBackingStore):
+        (WebCore::TiledBackingStore::createTiles):
+        (WebCore::TiledBackingStore::adjustForContentsRect):
+        (WebCore::TiledBackingStore::computeCoverAndKeepRect):
+        (WebCore::TiledBackingStore::tileRectForCoordinate):
+        * platform/graphics/TiledBackingStore.h:
+        (TiledBackingStore):
+
+2012-02-13  Vsevolod Vlasov  <vsevik@chromium.org>
+
+        Web Inspector: [InspectorIndexedDB] Pass data entries from object stores and indexes to front-end.
+        https://bugs.webkit.org/show_bug.cgi?id=78503
+
+        Reviewed by Yury Semikhatsky.
+
+        Test: http/tests/inspector/indexeddb/database-data.html
+
+        * bindings/js/SerializedScriptValue.cpp:
+        (WebCore::SerializedScriptValue::deserializeForInspector):
+        (WebCore):
+        * bindings/js/SerializedScriptValue.h:
+        (SerializedScriptValue):
+        * bindings/v8/SerializedScriptValue.cpp:
+        (WebCore::SerializedScriptValue::deserializeForInspector):
+        (WebCore):
+        * bindings/v8/SerializedScriptValue.h:
+        (SerializedScriptValue):
+        * inspector/InjectedScript.cpp:
+        (WebCore::InjectedScript::wrapObject):
+        (WebCore::InjectedScript::wrapSerializedObject):
+        (WebCore):
+        (WebCore::InjectedScript::canAccessInspectedWindow):
+        * inspector/InjectedScript.h:
+        (InjectedScript):
+        * inspector/Inspector.json:
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::InspectorController):
+        * inspector/InspectorIndexedDBAgent.cpp:
+        (WebCore):
+        (WebCore::InspectorIndexedDBAgent::InspectorIndexedDBAgent):
+        (WebCore::assertFrame):
+        (WebCore::assertDocument):
+        (WebCore::InspectorIndexedDBAgent::requestData):
+        * inspector/InspectorIndexedDBAgent.h:
+        (WebCore):
+        (WebCore::InspectorIndexedDBAgent::create):
+        (InspectorIndexedDBAgent):
+        * inspector/front-end/IndexedDBModel.js:
+        (WebInspector.IndexedDBModel.idbKeyFromKey):
+        (WebInspector.IndexedDBModel.keyFromIDBKey):
+        (WebInspector.IndexedDBModel.keyRangeFromIDBKeyRange):
+        (WebInspector.IndexedDBModel.prototype._loadDatabase):
+        (WebInspector.IndexedDBModel.prototype.loadObjectStoreData):
+        (WebInspector.IndexedDBModel.prototype.loadIndexData):
+        (WebInspector.IndexedDBModel.Entry):
+        (WebInspector.IndexedDBRequestManager):
+        (WebInspector.IndexedDBRequestManager.prototype._requestData.innerCallback):
+        (WebInspector.IndexedDBRequestManager.prototype._requestData):
+        (WebInspector.IndexedDBRequestManager.prototype.requestObjectStoreData):
+        (WebInspector.IndexedDBRequestManager.prototype._objectStoreDataLoaded):
+        (WebInspector.IndexedDBRequestManager.prototype.requestIndexData):
+        (WebInspector.IndexedDBRequestManager.prototype._indexDataLoaded):
+        (WebInspector.IndexedDBRequestManager.prototype._frameDetached):
+        (WebInspector.IndexedDBRequestManager.prototype._databaseRemoved):
+        (WebInspector.IndexedDBRequestManager.prototype._reset):
+        (WebInspector.IndexedDBRequestManager.DataRequest):
+        (WebInspector.IndexedDBDispatcher.prototype.databaseLoaded):
+        (WebInspector.IndexedDBDispatcher.prototype.objectStoreDataLoaded):
+        (WebInspector.IndexedDBDispatcher.prototype.indexDataLoaded):
+
+2012-02-15  Hajime Morrita  <morrita@chromium.org>
+
+        REGRESSION(r107518): DeviceOrientationController doesn't remove registered DOMWindows
+        https://bugs.webkit.org/show_bug.cgi?id=78683
+
+        Reviewed by Kentaro Hara.
+        
+        A copy-n-paste disaster. This change fixed it by calling correct methods.
+
+        No new tests. Needs browser side mocking for testing this.
+        A Chromium automated test covers this.
+
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::removeAllEventListeners):
+        * page/Page.cpp:
+        (WebCore::Page::provideSupplement):
+        (WebCore::Page::requireSupplement):
+        * page/Page.h: Fix typo.
+        (Page):
+
+2012-02-15  Roland Steiner  <rolandsteiner@chromium.org>
+
+        Unreviewed, quick build fix for 107792
+
+        * inspector/DOMEditor.cpp:
+        (WebCore::DOMEditor::RemoveAttributeAction::redo):
+
+2012-02-15  Tony Gentilcore  <tonyg@chromium.org>
+
+        [chromium] Don't use increased FontCache size on Android
+        https://bugs.webkit.org/show_bug.cgi?id=78656
+
+        Reviewed by Adam Barth.
+
+        The chromium port uses a larger font cache size because it increases
+        performance on the intl1 and intl2 page cyclers. However, on Android
+        devices where resources are more constrained, it isn't desireable to
+        allow the FontCache to grow so big.
+
+        No new tests because no testable difference in functionality.
+
+        * platform/graphics/FontCache.cpp:
+        (WebCore):
+
+2012-02-15  Roland Steiner  <rolandsteiner@chromium.org>
+
+        <style scoped>: Allow <style scoped> as a direct child of a ShadowRoot
+        https://bugs.webkit.org/show_bug.cgi?id=77853
+
+        Moved registration code from Element to Node. updated Internals and build files accordingly.
+        Moved registration data members from ElementRareData to NodeRareData.
+        Forward willRemove() from host element into shadow DOM tree.
+
+        Reviewed by Dimitri Glazkov.
+
+        Test: fast/css/style-scoped/registering-shadowroot.html
+
+        * WebCore.exp.in:
+        * dom/Element.cpp:
+        (WebCore::Element::willRemove):
+        * dom/Element.h:
+        (Element):
+        * dom/ElementRareData.h:
+        (ElementRareData):
+        (WebCore::ElementRareData::ElementRareData):
+        * dom/Node.cpp:
+        (WebCore):
+        (WebCore::Node::hasScopedHTMLStyleChild):
+        (WebCore::Node::numberOfScopedHTMLStyleChildren):
+        (WebCore::Node::registerScopedHTMLStyleChild):
+        (WebCore::Node::unregisterScopedHTMLStyleChild):
+        * dom/Node.h:
+        (Node):
+        * dom/NodeRareData.h:
+        (WebCore::NodeRareData::NodeRareData):
+        (NodeRareData):
+        (WebCore::NodeRareData::registerScopedHTMLStyleChild):
+        (WebCore::NodeRareData::unregisterScopedHTMLStyleChild):
+        (WebCore::NodeRareData::hasScopedHTMLStyleChild):
+        (WebCore::NodeRareData::numberOfScopedHTMLStyleChildren):
+        * dom/ShadowRootList.cpp:
+        (WebCore::ShadowRootList::willRemove):
+        (WebCore):
+        * dom/ShadowRootList.h:
+        (ShadowRootList):
+        * html/HTMLStyleElement.cpp:
+        (WebCore::HTMLStyleElement::registerWithScopingNode):
+        (WebCore::HTMLStyleElement::unregisterWithScopingNode):
+        * testing/Internals.cpp:
+        (WebCore::Internals::numberOfScopedHTMLStyleChildren):
+        * testing/Internals.h:
+        (Internals):
+        * testing/Internals.idl:
+
+2012-02-14  Pavel Feldman  <pfeldman@chromium.org>
+
+        Web Inspector: implement redo for DOM actions.
+        https://bugs.webkit.org/show_bug.cgi?id=78601
+
+        Reviewed by Yury Semikhatsky.
+
+        * inspector/DOMEditor.cpp:
+        (WebCore::DOMEditor::RemoveChildAction::perform):
+        (WebCore::DOMEditor::RemoveChildAction::redo):
+        (DOMEditor::RemoveChildAction):
+        (WebCore::DOMEditor::InsertBeforeAction::redo):
+        (DOMEditor::InsertBeforeAction):
+        (WebCore::DOMEditor::RemoveAttributeAction::perform):
+        (WebCore::DOMEditor::RemoveAttributeAction::redo):
+        (DOMEditor::RemoveAttributeAction):
+        (WebCore::DOMEditor::SetAttributeAction::perform):
+        (WebCore::DOMEditor::SetAttributeAction::redo):
+        (DOMEditor::SetAttributeAction):
+        (WebCore::DOMEditor::SetOuterHTMLAction::redo):
+        (DOMEditor::SetOuterHTMLAction):
+        (WebCore::DOMEditor::ReplaceWholeTextAction::perform):
+        (WebCore::DOMEditor::ReplaceWholeTextAction::redo):
+        (DOMEditor::ReplaceWholeTextAction):
+        (WebCore::DOMEditor::ReplaceChildNodeAction::perform):
+        (WebCore::DOMEditor::ReplaceChildNodeAction::redo):
+        (DOMEditor::ReplaceChildNodeAction):
+        (WebCore::DOMEditor::SetNodeValueAction::perform):
+        (WebCore::DOMEditor::SetNodeValueAction::redo):
+        (DOMEditor::SetNodeValueAction):
+        * inspector/Inspector.json:
+        * inspector/InspectorCSSAgent.cpp:
+        (WebCore::InspectorCSSAgent::SetStyleSheetTextAction::perform):
+        (WebCore::InspectorCSSAgent::SetStyleSheetTextAction::undo):
+        (WebCore::InspectorCSSAgent::SetStyleSheetTextAction::redo):
+        (WebCore::InspectorCSSAgent::SetPropertyTextAction::perform):
+        (InspectorCSSAgent::SetPropertyTextAction):
+        (WebCore::InspectorCSSAgent::SetPropertyTextAction::undo):
+        (WebCore::InspectorCSSAgent::SetPropertyTextAction::redo):
+        (WebCore::InspectorCSSAgent::TogglePropertyAction::perform):
+        (WebCore::InspectorCSSAgent::TogglePropertyAction::redo):
+        (InspectorCSSAgent::TogglePropertyAction):
+        (WebCore::InspectorCSSAgent::SetRuleSelectorAction::perform):
+        (WebCore::InspectorCSSAgent::SetRuleSelectorAction::redo):
+        (InspectorCSSAgent::SetRuleSelectorAction):
+        (WebCore::InspectorCSSAgent::AddRuleAction::perform):
+        (WebCore::InspectorCSSAgent::AddRuleAction::redo):
+        (InspectorCSSAgent::AddRuleAction):
+        * inspector/InspectorDOMAgent.cpp:
+        (WebCore::InspectorDOMAgent::setNodeValue):
+        (WebCore::InspectorDOMAgent::redo):
+        (WebCore):
+        * inspector/InspectorDOMAgent.h:
+        (InspectorDOMAgent):
+        * inspector/InspectorHistory.cpp:
+        (WebCore::InspectorHistory::InspectorHistory):
+        (WebCore::InspectorHistory::perform):
+        (WebCore::InspectorHistory::markUndoableState):
+        (WebCore::InspectorHistory::undo):
+        (WebCore::InspectorHistory::redo):
+        (WebCore):
+        * inspector/InspectorHistory.h:
+        (Action):
+        (InspectorHistory):
+        * inspector/front-end/CSSStyleModel.js:
+        (WebInspector.CSSStyleModel):
+        (WebInspector.CSSStyleModel.prototype._undoRedoRequested):
+        (WebInspector.CSSStyleModel.prototype._undoRedoCompleted):
+        * inspector/front-end/DOMAgent.js:
+        (WebInspector.DOMAgent.prototype.get undo):
+        (WebInspector.DOMAgent.prototype.redo):
+        * inspector/front-end/ElementsPanel.js:
+        (WebInspector.ElementsPanel.prototype.handleShortcut):
+
+2012-02-15  Yuta Kitamura  <yutak@chromium.org>
+
+        WebSocket: MessageEvent fired during send() on workers
+        https://bugs.webkit.org/show_bug.cgi?id=76521
+
+        Reviewed by David Levin.
+
+        WebSocket's message event should not be invoked while a synchronous operation
+        (send() and bufferedAmount) is in progress.
+
+        Test: http/tests/websocket/tests/hybi/workers/no-onmessage-in-sync-op.html
+
+        * websockets/ThreadableWebSocketChannelClientWrapper.cpp:
+        Added #if ENABLE(WORKERS) because ThreadableWebSocketChannelClientWrapper is not used
+        if Web Workers is not available.
+        Changed access label because private members were declared as protected with no good reason.
+        (WebCore::ThreadableWebSocketChannelClientWrapper::ThreadableWebSocketChannelClientWrapper):
+        Receive ScriptExecutionContext so we can post a task that should be executed later.
+        (WebCore::ThreadableWebSocketChannelClientWrapper::create):
+        (WebCore::ThreadableWebSocketChannelClientWrapper::processPendingTasksCallback):
+        (WebCore::ThreadableWebSocketChannelClientWrapper::processPendingTasks):
+        * websockets/ThreadableWebSocketChannelClientWrapper.h:
+        * websockets/WorkerThreadableWebSocketChannel.cpp:
+        (WebCore::WorkerThreadableWebSocketChannel::WorkerThreadableWebSocketChannel):
+
+2012-02-15  No'am Rosenthal  <noam.rosenthal@nokia.com>
+
+        [Texmap] Divide TextureMapperNode.cpp to 3 files.
+        https://bugs.webkit.org/show_bug.cgi?id=76660
+
+        Rename TextureMapperNode to TextureMapperLayer.
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        No new tests.
+
+        * GNUmakefile.list.am:
+        * Target.pri:
+        * WebCore.gypi:
+        * platform/graphics/texmap/GraphicsLayerTextureMapper.cpp:
+        (WebCore::GraphicsLayerTextureMapper::GraphicsLayerTextureMapper):
+        (WebCore::GraphicsLayerTextureMapper::notifyChange):
+        (WebCore::GraphicsLayerTextureMapper::setNeedsDisplay):
+        (WebCore::GraphicsLayerTextureMapper::setContentsNeedsDisplay):
+        (WebCore::GraphicsLayerTextureMapper::setNeedsDisplayInRect):
+        (WebCore::GraphicsLayerTextureMapper::setParent):
+        (WebCore::GraphicsLayerTextureMapper::setChildren):
+        (WebCore::GraphicsLayerTextureMapper::addChild):
+        (WebCore::GraphicsLayerTextureMapper::addChildAtIndex):
+        (WebCore::GraphicsLayerTextureMapper::addChildAbove):
+        (WebCore::GraphicsLayerTextureMapper::addChildBelow):
+        (WebCore::GraphicsLayerTextureMapper::replaceChild):
+        (WebCore::GraphicsLayerTextureMapper::removeFromParent):
+        (WebCore::GraphicsLayerTextureMapper::setMaskLayer):
+        (WebCore::GraphicsLayerTextureMapper::setReplicatedByLayer):
+        (WebCore::GraphicsLayerTextureMapper::setPosition):
+        (WebCore::GraphicsLayerTextureMapper::setAnchorPoint):
+        (WebCore::GraphicsLayerTextureMapper::setSize):
+        (WebCore::GraphicsLayerTextureMapper::setTransform):
+        (WebCore::GraphicsLayerTextureMapper::setChildrenTransform):
+        (WebCore::GraphicsLayerTextureMapper::setPreserves3D):
+        (WebCore::GraphicsLayerTextureMapper::setMasksToBounds):
+        (WebCore::GraphicsLayerTextureMapper::setDrawsContent):
+        (WebCore::GraphicsLayerTextureMapper::setContentsOpaque):
+        (WebCore::GraphicsLayerTextureMapper::setBackfaceVisibility):
+        (WebCore::GraphicsLayerTextureMapper::setOpacity):
+        (WebCore::GraphicsLayerTextureMapper::setContentsRect):
+        (WebCore::GraphicsLayerTextureMapper::setContentsToImage):
+        (WebCore::GraphicsLayerTextureMapper::setContentsToMedia):
+        (WebCore::GraphicsLayerTextureMapper::syncCompositingStateForThisLayerOnly):
+        (WebCore::GraphicsLayerTextureMapper::syncCompositingState):
+        (WebCore::GraphicsLayerTextureMapper::addAnimation):
+        * platform/graphics/texmap/GraphicsLayerTextureMapper.h:
+        (WebCore):
+        (GraphicsLayerTextureMapper):
+        (WebCore::GraphicsLayerTextureMapper::layer):
+        * platform/graphics/texmap/TextureMapperLayer.cpp: Renamed from Source/WebCore/platform/graphics/texmap/TextureMapperNode.cpp.
+        (WebCore):
+        (WebCore::toTextureMapperLayer):
+        (WebCore::TextureMapperLayer::rootLayer):
+        (WebCore::TextureMapperLayer::setTransform):
+        (WebCore::TextureMapperLayer::clearBackingStoresRecursive):
+        (WebCore::TextureMapperLayer::computeTransformsRecursive):
+        (WebCore::TextureMapperLayer::updateBackingStore):
+        (WebCore::TextureMapperLayer::paint):
+        (WebCore::TextureMapperLayer::paintSelf):
+        (WebCore::TextureMapperLayer::compareGraphicsLayersZValue):
+        (WebCore::TextureMapperLayer::sortByZOrder):
+        (WebCore::TextureMapperLayer::paintSelfAndChildren):
+        (WebCore::TextureMapperLayer::intermediateSurfaceRect):
+        (WebCore::TextureMapperLayer::shouldPaintToIntermediateSurface):
+        (WebCore::TextureMapperLayer::isVisible):
+        (WebCore::TextureMapperLayer::paintSelfAndChildrenWithReplica):
+        (WebCore::TextureMapperLayer::paintRecursive):
+        (WebCore::TextureMapperLayer::~TextureMapperLayer):
+        (WebCore::TextureMapperLayer::syncCompositingState):
+        (WebCore::TextureMapperLayer::syncCompositingStateSelf):
+        (WebCore::TextureMapperLayer::descendantsOrSelfHaveRunningAnimations):
+        (WebCore::TextureMapperLayer::syncAnimations):
+        (WebCore::TextureMapperLayer::syncAnimationsRecursively):
+        * platform/graphics/texmap/TextureMapperLayer.h: Renamed from Source/WebCore/platform/graphics/texmap/TextureMapperNode.h.
+        (WebCore):
+        (TextureMapperPaintOptions):
+        (WebCore::TextureMapperPaintOptions::TextureMapperPaintOptions):
+        (TextureMapperLayer):
+        (WebCore::TextureMapperLayer::TextureMapperLayer):
+        (WebCore::TextureMapperLayer::size):
+        (WebCore::TextureMapperLayer::setOpacity):
+        (WebCore::TextureMapperLayer::setTextureMapper):
+        (WebCore::TextureMapperLayer::setShouldUpdateBackingStoreFromLayer):
+        (WebCore::TextureMapperLayer::setBackingStore):
+        (WebCore::TextureMapperLayer::backingStore):
+        (WebCore::TextureMapperLayer::texture):
+        (WebCore::TextureMapperLayer::layerRect):
+        (State):
+        (WebCore::TextureMapperLayer::State::State):
+
+2012-02-15  Hayato Ito  <hayato@chromium.org>
+
+        ShadowRoot: Remove a public static factory function which doesn't have any callers.
+        https://bugs.webkit.org/show_bug.cgi?id=78668
+
+        Reviewed by Kent Tamura.
+
+        No tests. No change in behavior.
+
+        * dom/ShadowRoot.cpp:
+        (WebCore::ShadowRoot::create):
+        * dom/ShadowRoot.h:
+        (ShadowRoot):
+
+2012-02-14  Hao Zheng  <zhenghao@chromium.org>
+
+        Cleanup pending transaction queue in Database.
+        https://bugs.webkit.org/show_bug.cgi?id=75048
+
+        Reviewed by David Levin.
+
+        Each SQLTransaction has 3 SQLCallbackWrappers, and each of them
+        holds a ref to WorkerContext. As a result, if the worker thread is
+        stopped before all SQLTransactions are finished, the ASSERT of
+        m_workerContext->hasOneRef() in WorkerThread::workerThread() would fail.
+
+        No new tests.
+        REGRESSION(r103429) fast/workers/storage/use-same-database-in-page-and-workers.html asserts
+
+        * storage/Database.cpp:
+        (WebCore::Database::close): Cleanup pending transaction queue in close().
+        * storage/SQLCallbackWrapper.h:
+        (WebCore::SQLCallbackWrapper::clear):
+        (SafeReleaseTask): Make SafeReleaseTask a cleanup task, which is
+        necessary because at the time of SafeReleaseTask is performed,
+        WorkerRunLoop has been terminated and only runs cleanup tasks.
+        (WebCore::SQLCallbackWrapper::SafeReleaseTask::create):
+        (WebCore::SQLCallbackWrapper::SafeReleaseTask::performTask):
+        (WebCore::SQLCallbackWrapper::SafeReleaseTask::isCleanupTask):
+        (WebCore::SQLCallbackWrapper::SafeReleaseTask::SafeReleaseTask):
+
+2012-02-14  Antti Koivisto  <antti@apple.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=78662
+        CSSStyleSelector should not rely on parent rule pointer in StylePropertySet
+
+        Reviewed by Andreas Kling.
+
+        Pass the rule pointer down to the style applying so we don't need to rely on
+        StylePropertySet having one.
+
+        To make this easier the patch also refactors the matched properties vector to
+        be part of MatchResult object instead of a member of CSSStyleSelector.
+        
+        Rename Declaration -> Properties.
+        
+        * css/CSSFontSelector.cpp:
+        (WebCore::CSSFontSelector::dispatchInvalidationCallbacks):
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::CSSStyleSelector):
+        (WebCore::CSSStyleSelector::sweepMatchedPropertiesCache):
+        (WebCore::CSSStyleSelector::addMatchedProperties):
+        (WebCore::CSSStyleSelector::sortAndTransferMatchedRules):
+        (WebCore::CSSStyleSelector::matchScopedAuthorRules):
+        (WebCore::CSSStyleSelector::matchAuthorRules):
+        (WebCore::CSSStyleSelector::matchUserRules):
+        (WebCore::CSSStyleSelector::matchUARules):
+        (WebCore::CSSStyleSelector::collectMatchingRulesForList):
+        (WebCore::CSSStyleSelector::matchAllRules):
+        (WebCore):
+        (WebCore::CSSStyleSelector::initForStyleResolve):
+        (WebCore::CSSStyleSelector::matchesRuleSet):
+        (WebCore::CSSStyleSelector::styleForElement):
+        (WebCore::CSSStyleSelector::styleForKeyframe):
+        (WebCore::CSSStyleSelector::pseudoStyleForElement):
+        (WebCore::CSSStyleSelector::styleForPage):
+        (WebCore::CSSStyleSelector::pseudoStyleRulesForElement):
+        (WebCore::isInsideRegionRule):
+        (WebCore::CSSStyleSelector::applyProperties):
+        (WebCore::CSSStyleSelector::applyMatchedProperties):
+        (WebCore::CSSStyleSelector::computeMatchedPropertiesHash):
+        (WebCore::operator==):
+        (WebCore::operator!=):
+        (WebCore::CSSStyleSelector::findFromMatchedPropertiesCache):
+        (WebCore::CSSStyleSelector::addToMatchedPropertiesCache):
+        (WebCore::CSSStyleSelector::invalidateMatchedPropertiesCache):
+        (WebCore::isCacheableInMatchedPropertiesCache):
+        (WebCore::CSSStyleSelector::matchPageRules):
+        * css/CSSStyleSelector.h:
+        (CSSStyleSelector):
+        (WebCore::CSSStyleSelector::addMatchedRule):
+        (WebCore::CSSStyleSelector::MatchedProperties::MatchedProperties):
+        (MatchedProperties):
+        (MatchResult):
+        (MatchedPropertiesCacheItem):
+
+2012-02-14  Takashi Toyoshima  <toyoshim@chromium.org>
+
+        WebSocketChannel minor refactoring for code manageability
+        https://bugs.webkit.org/show_bug.cgi?id=78576
+
+        Reviewed by Kent Tamura.
+
+        Change the first argument type of WebSocketChannel
+        from ScriptExecutionContext to Document.
+        WebSocketChannel always assume this ScriptExecutionContext must
+        inherit Document. Then, it results in many static cast.
+        It isn't readable and dangerous against future code changes.
+
+        * websockets/ThreadableWebSocketChannel.cpp: Pass the first argument for WebSocketChannel as Document.
+        (WebCore::ThreadableWebSocketChannel::create):
+        * websockets/WebSocketChannel.cpp: Replace all ScriptExecutionContext* m_context descriptions to Document* m_document.
+        (WebCore::WebSocketChannel::WebSocketChannel):
+        (WebCore::WebSocketChannel::connect):
+        (WebCore::WebSocketChannel::fail):
+        (WebCore::WebSocketChannel::disconnect):
+        (WebCore::WebSocketChannel::didOpenSocketStream):
+        (WebCore::WebSocketChannel::didCloseSocketStream):
+        (WebCore::WebSocketChannel::didReceiveSocketStreamData):
+        (WebCore::WebSocketChannel::didFailSocketStream):
+        (WebCore::WebSocketChannel::processBuffer):
+        (WebCore::WebSocketChannel::processOutgoingFrameQueue):
+        * websockets/WebSocketChannel.h: Change the first argument for construction to Document and hold it as Document m_document.
+        (WebCore):
+        (WebCore::WebSocketChannel::create):
+        (WebSocketChannel):
+        * websockets/WorkerThreadableWebSocketChannel.cpp: Pass the first argument for WebSocketChannel as Document.
+        (WebCore::WorkerThreadableWebSocketChannel::Peer::Peer):
+
+2012-02-14  Noel Gordon  <noel.gordon@gmail.com>
+
+        Unreviewed, rolling out r107774.
+        http://trac.webkit.org/changeset/107774
+        https://bugs.webkit.org/show_bug.cgi?id=78661
+
+        Broke Chromium build
+
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::handleGestureEvent):
+        * platform/ScrollAnimator.cpp:
+        (WebCore):
+        (WebCore::ScrollAnimator::handleGestureEvent):
+        * platform/ScrollAnimator.h:
+        (ScrollAnimator):
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::wheelEvent):
+        * platform/ScrollView.h:
+        (ScrollView):
+        * platform/ScrollableArea.cpp:
+        (WebCore):
+        (WebCore::ScrollableArea::handleGestureEvent):
+        * platform/ScrollableArea.h:
+        (ScrollableArea):
+
+2012-02-14  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r107766.
+        http://trac.webkit.org/changeset/107766
+        https://bugs.webkit.org/show_bug.cgi?id=78665
+
+        Breaks Chromium Win build (Requested by bashi1 on #webkit).
+
+        * GNUmakefile.list.am:
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * websockets/WebSocketDeflater.cpp: Removed.
+        * websockets/WebSocketDeflater.h: Removed.
+
+2012-02-14  Anders Carlsson  <andersca@apple.com>
+
+        Remove ScrollableArea::handleGestureEvent
+        https://bugs.webkit.org/show_bug.cgi?id=78661
+
+        Reviewed by Sam Weinig.
+
+        ScrollableArea::handleGestureEvent ends up being a no-op so remove it and the related code. 
+
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::handleGestureEvent):
+        * platform/ScrollAnimator.cpp:
+        * platform/ScrollAnimator.h:
+        (ScrollAnimator):
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::wheelEvent):
+        * platform/ScrollView.h:
+        (ScrollView):
+        * platform/ScrollableArea.cpp:
+        * platform/ScrollableArea.h:
+        (ScrollableArea):
+
+2012-02-14  Kentaro Hara  <haraken@chromium.org>
+
+        [JSC] Cache the number of non-custom constructor arguments
+        https://bugs.webkit.org/show_bug.cgi?id=78195
+
+        Reviewed by Darin Adler.
+
+        If [ConstructorParameters=] is specified, JSC caches the number of constructor
+        arguments for performance. However, at present, [ConstructorParameters=] is specified
+        on a small part of constructors (It appears that people have forgotten to
+        add [ConstructorParameters=]). Thus, for non-custom constructors, this patch modifies
+        CodeGeneratorJS.pm so that it caches the number of constructor arguments automatically
+        without [ConstructorParameters=] (CodeGeneratorJS.pm can know the number of arguments
+        by the [Constructor=...] signature).
+
+        Test: fast/js/constructor-length.html
+
+        * bindings/scripts/CodeGeneratorJS.pm:
+        (GenerateConstructorDefinition):
+
+2012-02-14  Mark Rowe  <mrowe@apple.com>
+
+        <http://webkit.org/b/78658> platformUserPreferredLanguages is leaking all of the language codes
+
+        Reviewed by Darin Adler.
+
+        * platform/mac/Language.mm:
+        (WebCore::httpStyleLanguageCode): Switch to using RetainPtr's for temporaries to make the ownership
+        more explicit. Switch to returning a WTF::String so that the caller doesn't have to worry about
+        ownership at all. Change the name to reflect the lack of transfer of ownership.
+        (WebCore::platformUserPreferredLanguages):
+
+2012-02-14  Kentaro Hara  <haraken@chromium.org>
+
+        [Mac] PasteboardMac.mm build fails
+        https://bugs.webkit.org/show_bug.cgi?id=78655
+
+        Reviewed by Hajime Morita.
+
+        Although the bots have been working fine, PasteboardMac.mm build fails
+        in our local Mac environments due to an uninitialized variable:
+
+            /Users/haraken/WebKit/Source/WebCore/platform/mac/PasteboardMac.mm:322: warning: 'string' may be used uninitialized in this function
+
+        This patch initializes the 'string' to nil to fix the build failure.
+
+        No tests. No change in behavior.
+
+        * platform/mac/PasteboardMac.mm:
+        (WebCore::Pasteboard::plainText):
+
+2012-02-14  Kenichi Ishibashi  <bashi@chromium.org>
+
+        [WebSocket] Add extension attribute support
+        https://bugs.webkit.org/show_bug.cgi?id=78557
+
+        Implement WebSocket "extensions" attribute that holds a list of
+        extension the server accepted. No change in behavior at this time
+        because we don't send any extension on handshake.
+
+        Reviewed by Kent Tamura.
+
+        No new tests. http/tests/websocket/tests/hybi/extensions.html checks the value of this attribute.
+
+        * websockets/ThreadableWebSocketChannel.h: Add extensions().
+        (ThreadableWebSocketChannel):
+        * websockets/ThreadableWebSocketChannelClientWrapper.cpp:
+        (WebCore::ThreadableWebSocketChannelClientWrapper::extensions): Added.
+        (WebCore):
+        (WebCore::ThreadableWebSocketChannelClientWrapper::setExtensions): Added.
+        * websockets/ThreadableWebSocketChannelClientWrapper.h:
+        (ThreadableWebSocketChannelClientWrapper):
+        * websockets/WebSocket.cpp: Added m_extensions member variable.
+        (WebCore::WebSocket::WebSocket):
+        (WebCore::WebSocket::extensions): Returns m_extensions.
+        * websockets/WebSocket.h:
+        * websockets/WebSocketChannel.cpp:
+        (WebCore::WebSocketChannel::extensions): Added.
+        (WebCore):
+        * websockets/WebSocketChannel.h:
+        (WebSocketChannel):
+        * websockets/WebSocketExtensionDispatcher.cpp:
+        (WebCore::WebSocketExtensionDispatcher::fail): Added.
+        (WebCore::WebSocketExtensionDispatcher::processHeaderValue): Stores accepted extensions.
+        (WebCore::WebSocketExtensionDispatcher::acceptedExtensions): Added.
+        (WebCore):
+        (WebCore::WebSocketExtensionDispatcher::acceptedExtensions): Added.
+        * websockets/WebSocketExtensionDispatcher.h:
+        (WebSocketExtensionDispatcher):
+        * websockets/WebSocketHandshake.cpp:
+        (WebCore::WebSocketHandshake::acceptedExtensions): Added.
+        (WebCore):
+        * websockets/WebSocketHandshake.h:
+        * websockets/WorkerThreadableWebSocketChannel.cpp:
+        (WebCore::WorkerThreadableWebSocketChannel::extensions): Added.
+        (WebCore):
+        (WebCore::workerContextDidConnect): Calls ThreadableWebSocketChannelClientWrapper::setExtensions().
+        (WebCore::WorkerThreadableWebSocketChannel::Peer::didConnect): Passes extensions as an argument.
+        * websockets/WorkerThreadableWebSocketChannel.h:
+        (WorkerThreadableWebSocketChannel):
+
+2012-02-14  Kentaro Hara  <haraken@chromium.org>
+
+        Rename [JSGenerateToJS] to [JSGenerateToJSObject]
+        https://bugs.webkit.org/show_bug.cgi?id=78490
+
+        Reviewed by Adam Barth.
+
+        This patch renames [JSGenerateToJS] to [JSGenerateToJSObject],
+        for naming consistency with [CustomToJSObject], [JSCustomToJSObject] and [V8CustomToJSObject].
+
+        No tests. No change in behavior.
+
+        * bindings/scripts/CodeGeneratorJS.pm:
+        (GenerateHeader):
+        (GenerateImplementation):
+        * dom/WebKitNamedFlow.idl:
+        * fileapi/DirectoryEntry.idl:
+        * fileapi/DirectoryEntrySync.idl:
+        * fileapi/File.idl:
+        * fileapi/FileEntry.idl:
+        * fileapi/FileEntrySync.idl:
+        * html/DOMFormData.idl:
+        * html/DOMSettableTokenList.idl:
+        * html/DOMURL.idl:
+        * html/MediaController.idl:
+        * mediastream/LocalMediaStream.idl:
+        * webaudio/AudioBufferCallback.idl:
+        * webaudio/AudioBufferSourceNode.idl:
+        * webaudio/AudioDestinationNode.idl:
+        * webaudio/AudioGain.idl:
+        * webaudio/AudioGainNode.idl:
+        * webaudio/AudioPannerNode.idl:
+        * webaudio/AudioProcessingEvent.idl:
+        * webaudio/BiquadFilterNode.idl:
+        * webaudio/ConvolverNode.idl:
+        * webaudio/DelayNode.idl:
+        * webaudio/DynamicsCompressorNode.idl:
+        * webaudio/HighPass2FilterNode.idl:
+        * webaudio/JavaScriptAudioNode.idl:
+        * webaudio/LowPass2FilterNode.idl:
+        * webaudio/MediaElementAudioSourceNode.idl:
+        * webaudio/OfflineAudioCompletionEvent.idl:
+        * webaudio/RealtimeAnalyserNode.idl:
+        * webaudio/WaveShaperNode.idl:
+        * workers/SharedWorker.idl:
+        * workers/Worker.idl:
+
+2012-02-14  Kenichi Ishibashi  <bashi@chromium.org>
+
+        [WebSocket] Add deflater/inflater classes
+        https://bugs.webkit.org/show_bug.cgi?id=78449
+
+        Add WebSocketDeflater/WebSocketInflater classes which wrap zlib
+        functions. These classes are not used yet, but will be used for
+        supporting WebSocket deflate-frame extension.
+
+        Reviewed by Kent Tamura.
+
+        No new tests except for chromium port. Behavior is unchanged.
+
+        * GNUmakefile.list.am: Added.WebSocketDeflater.(cpp|h).
+        * WebCore.gypi: Ditto.
+        * WebCore.vcproj/WebCore.vcproj: Ditto.
+        * WebCore.xcodeproj/project.pbxproj: Ditto.
+        * websockets/WebSocketDeflater.cpp: Added.
+        (WebCore):
+        (WebCore::WebSocketDeflater::create):
+        (WebCore::WebSocketDeflater::WebSocketDeflater):
+        (WebCore::WebSocketDeflater::initialize):
+        (WebCore::WebSocketDeflater::~WebSocketDeflater):
+        (WebCore::WebSocketDeflater::addBytes):
+        (WebCore::WebSocketDeflater::finish):
+        (WebCore::WebSocketDeflater::reset):
+        (WebCore::WebSocketInflater::create):
+        (WebCore::WebSocketInflater::WebSocketInflater):
+        (WebCore::WebSocketInflater::initialize):
+        (WebCore::WebSocketInflater::~WebSocketInflater):
+        (WebCore::WebSocketInflater::addBytes):
+        (WebCore::WebSocketInflater::finish):
+        (WebCore::WebSocketInflater::reset):
+        * websockets/WebSocketDeflater.h: Added.
+        (WebCore):
+        (WebSocketDeflater):
+        (WebCore::WebSocketDeflater::data):
+        (WebCore::WebSocketDeflater::size):
+        (WebSocketInflater):
+        (WebCore::WebSocketInflater::data):
+        (WebCore::WebSocketInflater::size):
+
+2012-02-14  Dana Jansens  <danakj@chromium.org>
+
+        [chromium] Compare filters on impl thread when setting them, and test setting in unit tests
+        https://bugs.webkit.org/show_bug.cgi?id=78643
+
+        Reviewed by James Robinson.
+
+        Add setFilters() coverage to CCLayerImplTest.cpp
+
+        * platform/graphics/chromium/cc/CCLayerImpl.cpp:
+        (WebCore::CCLayerImpl::setFilters):
+
+2012-02-14  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Crash in deleteInsignificantText
+        https://bugs.webkit.org/show_bug.cgi?id=78567
+
+        Reviewed by Eric Seidel.
+
+        Fix the crash. Also update layout at the beginning of each call to deleteInsignificantText
+        since the previous call may have mutated the DOM.
+
+        Test: editing/inserting/delete-insignificant-text-crash.html
+
+        * editing/CompositeEditCommand.cpp:
+        (WebCore::CompositeEditCommand::deleteInsignificantText):
+
+2012-02-14  Levi Weintraub  <leviw@chromium.org>
+
+        Prepare RenderLayerBacking and RenderLayerCompositor for subpixel layout
+        https://bugs.webkit.org/show_bug.cgi?id=78630
+
+        Reviewed by Simon Fraser.
+
+        In our transition to subpixel layout in the render tree, we continue to pass RenderLayerBacking
+        and RenderLayerCompositor integer (pixel) sizes and positions. This patch moves nearly all
+        methods and members on these two classes back to integers, and applies pixel snapping logic to
+        LayoutUnits pulled in.
+
+        No new tests. No change in behavior.
+
+        * rendering/RenderBox.h:
+        (WebCore::RenderBox::pixelSnappedLayoutOverflowRect): Convenience function for getting pixel
+        snapped overflow bounds.
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore):
+        (WebCore::RenderLayerBacking::updateCompositedBounds): Switch to integers and pixel snapping the
+        clipping bounds.
+        (WebCore::clipBox): Returns a pixel snapped rect.
+        (WebCore::RenderLayerBacking::updateGraphicsLayerGeometry): Using pixelSnappedLayerCoords. Removing
+        pixelSnappedIntRect calls to clipBox since this is now an IntRect.
+        (WebCore::RenderLayerBacking::computeTransformOrigin): Switching to operate on a pixel snapped rect.
+        (WebCore::RenderLayerBacking::computePerspectiveOrigin): Ditto.
+        (WebCore::RenderLayerBacking::contentOffsetInCompostingLayer): Returns a size based on m_compositingBounds,
+        which is now an IntSize.
+        (WebCore::RenderLayerBacking::contentsBox): Switching to use pixel snapped values from the render tree.
+        (WebCore::RenderLayerBacking::setContentsNeedDisplayInRect): This now takes in and outputs integers.
+        (WebCore::RenderLayerBacking::paintIntoLayer): Uses a pixel snapped rect for the dirty rect.
+        (WebCore::paintScrollbar): Scrollbars are Widgets & painted natively, so they should use integers.
+        (WebCore::RenderLayerBacking::paintContents): We now properly take in an integer clip rect, as it's
+        used for the scrollbars. 
+        (WebCore::RenderLayerBacking::startAnimation): Using pixel snapped values for animations and transitions.
+        (WebCore::RenderLayerBacking::startTransition): Ditto.
+        (WebCore::RenderLayerBacking::compositedBounds): Composited bounds are now properly stored as integers.
+        (WebCore::RenderLayerBacking::setCompositedBounds): Ditto.
+        * rendering/RenderLayerBacking.h:
+        (RenderLayerBacking):
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::calculateCompositedBounds): Composited bounds are pixel snapped, but
+        we use LayoutUnits up until we snap and return.
+        (WebCore::RenderLayerCompositor::addToOverlapMap): Overlap mapping uses our integer positions. Switching
+        it back to operating on them.
+        (WebCore::RenderLayerCompositor::addToOverlapMapRecursive): Ditto.
+        (WebCore::RenderLayerCompositor::overlapsCompositedLayers): Ditto.
+        (WebCore::RenderLayerCompositor::computeCompositingRequirements): Using integers.
+        (WebCore::RenderLayerCompositor::frameViewDidChangeLocation): FrameViews are on integer bounds. We now
+        properly use these as integers.
+        (WebCore::RenderLayerCompositor::frameViewDidScroll): Ditto.
+        (WebCore::RenderLayerCompositor::recursiveRepaintLayerRect): Switching to use integers and
+        pixelSnappedLayerCoords.
+        (WebCore::RenderLayerCompositor::repaintCompositedLayersAbsoluteRect): Ditto.
+        (WebCore::RenderLayerCompositor::updateRootLayerPosition): Using integer positions, which are what
+        the apis used already returned.
+        (WebCore::RenderLayerCompositor::requiresCompositingForPlugin): Using pixel snapped values.
+        (WebCore::RenderLayerCompositor::requiresCompositingForFrame): Ditto.
+        (WebCore::paintScrollbar): Scrollbars should always use integers.
+        (WebCore::RenderLayerCompositor::paintContents): Switching to use an integer clip rect.
+        (WebCore::RenderLayerCompositor::ensureRootLayer): Using values from new pixelSnappedLayoutOverflowRect
+        method on RenderBox to ensure we're using values that are pixel snapped to the proper location.
+        (WebCore::RenderLayerCompositor::destroyRootLayer): Properly calling scrollbar invalidation methods
+        with integers.
+        * rendering/RenderLayerCompositor.h:
+        (RenderLayerCompositor):
+
+2012-02-14  Anders Carlsson  <andersca@apple.com>
+
+        Swipe gestures don't work if main frame has a horizontal scrollbar
+        https://bugs.webkit.org/show_bug.cgi?id=78650
+        <rdar://problem/10864993>
+
+        Reviewed by Sam Weinig.
+
+        Change ScrollingTree::tryToHandleWheelEvent so we can indicate that an event was
+        processed by the scrolling tree but that we should indicate back to WebKit that it wasn't handled.
+
+        * page/scrolling/ScrollingTree.cpp:
+        (WebCore::ScrollingTree::ScrollingTree):
+        Initialize new member variables.
+
+        (WebCore::ScrollingTree::tryToHandleWheelEvent):
+        If the wheel event will start a swipe gesture, return DidNotHandleEvent.
+
+        (WebCore::ScrollingTree::updateBackForwardState):
+        This can now be called from any thread, so use a mutex.
+
+        (WebCore::ScrollingTree::setMainFramePinState):
+        New function that will set the current main frame pin state.
+
+        (WebCore::ScrollingTree::canGoBack):
+        (WebCore::ScrollingTree::canGoForward):
+        Put locks around these.
+
+        (WebCore::ScrollingTree::willWheelEventStartSwipeGesture):
+        Helper function that returns whether the given wheel event will start a swipe gesture
+        because the main frame is pinned to the left/right and we can go back/forward.
+
+        * page/scrolling/mac/ScrollingTreeNodeMac.mm:
+        (WebCore::ScrollingTreeNodeMac::update):
+        Call updateMainFramePinState if the frame geometry changes.
+
+        (WebCore::ScrollingTreeNodeMac::setScrollPosition):
+        Call updateMainFramePinState.
+
+        (WebCore::ScrollingTreeNodeMac::updateMainFramePinState):
+        Compute the main frame pin state and set it on the scrolling tree.
+
+2012-02-14  Brian Weinstein  <bweinstein@apple.com>
+
+        Web Inspector: Add the ability to show the resources panel on launch
+        https://bugs.webkit.org/show_bug.cgi?id=78641
+
+        Reviewed by Timothy Hatcher.
+
+        * WebCore.exp.in: Add a new function to be exported.
+        * inspector/InspectorFrontendClientLocal.cpp:
+        (WebCore::InspectorFrontendClientLocal::showResources): Call showResources on load.
+        * inspector/InspectorFrontendClientLocal.h:
+        (InspectorFrontendClientLocal):
+        * inspector/front-end/InspectorFrontendAPI.js:
+        (InspectorFrontendAPI.showResources): Show the resources panel.
+
+2012-02-14  Enrica Casucci  <enrica@apple.com>
+
+        REGRESSION (r107568-r107627): Crash when copying in WebCore::SharedBuffer::hasPlatformData().
+        https://bugs.webkit.org/show_bug.cgi?id=78577
+
+        Reviewed by Dan Bernstein.
+
+        * platform/mac/PlatformPasteboardMac.mm:
+        (WebCore::PlatformPasteboard::setBufferForType): Missing null check when
+        setting data to the NSPasteboard.
+
+2012-02-14  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Crash in WebCore::SVGElement::removedFromDocument
+        https://bugs.webkit.org/show_bug.cgi?id=77270
+
+        Reviewed by Adam Barth.
+
+        Add a protector before calling NodeRemovalDispatcher::dispatch since
+        NodeRemovalDispatcher::dispatch may remove the last RefPtr to this node.
+
+        Test: fast/dom/Range/surround-contents-font-face-crash.svg
+
+        * dom/ContainerNodeAlgorithms.h:
+        (WebCore::Private::addChildNodesToDeletionQueue):
+
+2012-02-14  Matt Lilek  <mrl@apple.com>
+
+        Don't ENABLE_DASHBOARD_SUPPORT unconditionally on all Mac platforms
+        https://bugs.webkit.org/show_bug.cgi?id=78629
+
+        Reviewed by David Kilzer.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2012-02-14  Andreas Kling  <awesomekling@apple.com>
+
+        Avoid full style recalc when presentation attributes change.
+        <http://webkit.org/b/78636>
+
+        Reviewed by Antti Koivisto.
+
+        Use setNeedsStyleRecalc(InlineStyleChange) when a presentation attribute changes
+        to reduce the amount of work done in recalcStyle().
+
+        * dom/StyledElement.cpp:
+        (WebCore::StyledElement::attributeChanged):
+
+2012-02-14  Ramya Chandrasekaran  <cramya@google.com>
+
+        Last character display for passwords in Android.
+        https://bugs.webkit.org/show_bug.cgi?id=78532
+
+        Reviewed by Adam Barth.
+
+        * page/Settings.cpp:
+        (WebCore::Settings::Settings):
+
+2012-02-14  Joshua Bell  <jsbell@chromium.org>
+
+        IndexedDB: Invalid dates should not be valid keys
+        https://bugs.webkit.org/show_bug.cgi?id=78622
+
+        Reviewed by Tony Chang.
+
+        Tests: storage/indexeddb/invalid-keys.html
+               storage/indexeddb/factory-cmp.html
+
+        * bindings/v8/IDBBindingUtilities.cpp: Special case for NaN Dates.
+        (WebCore::createIDBKeyFromValue):
+
+2012-02-14  Ken Buchanan  <kenrb@chromium.org>
+
+        Crash from line break iterators in counter content
+        https://bugs.webkit.org/show_bug.cgi?id=72977
+
+        Reviewed by David Hyatt.
+
+        Calculating the width of counter text can sometimes cause the
+        underlying text buffer to change. This patch causes the iterator
+        to reset appropriately when this happens.
+
+        * rendering/RenderBlockLineLayout.cpp:
+        (WebCore::RenderBlock::LineBreaker::nextLineBreak):
+
+2012-02-14  Levi Weintraub  <leviw@chromium.org>
+
+        Update usage of LayoutUnits in RenderLayer
+        https://bugs.webkit.org/show_bug.cgi?id=78511
+
+        Reviewed by Simon Fraser.
+
+        Updating RenderLayer to properly use LayoutUnits. See descriptions below for the rationale behind all
+        the changes. Also adding a roundedIntSize method that takes a LayoutSize.
+
+        No new tests. No change in behavior.
+
+        * rendering/LayoutTypes.h:
+        (WebCore::roundedIntSize): Inline method that currently does nothing, but will round a LayoutSize
+        to an IntSize.
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::updateLayerPositions): Switching repaint and outline boxes to LayoutRects, as
+        it's important to keep the precision of these rects until handing off to the embedder (in FrameView).
+        (WebCore::RenderLayer::computeRepaintRects): Repaint rects should be preserved in subpixel units until
+        being passed to the embedding layer. This prevents needless repaints.
+        (WebCore::RenderLayer::convertToPixelSnappedLayerCoords): Convenience function to return pixel snapped rects
+        (WebCore):
+        (WebCore::RenderLayer::convertToLayerCoords): Fixing a style flaw.
+        (WebCore::RenderLayer::scrollRectToVisible): Pixel snapping the rect when handing off to the embedder.
+        (WebCore::RenderLayer::maximumScrollPosition): Scroll offsets are rounded.
+        (WebCore::RenderLayer::scrollCornerRect): Scrollbars are drawn natively and should be positioned on pixel
+        boundaries.
+        (WebCore::RenderLayer::scrollCornerAndResizerRect): Resize corner doesn't influence the size/position of
+        render objects. It is only painted and hit tested. Therefor it should use integers.
+        (WebCore::RenderLayer::offsetFromResizeCorner): Ditto.
+        (WebCore::RenderLayer::positionOverflowControls): Overflow controls are drawn natively and should be
+        positioned on integer boundaries.
+        (WebCore::RenderLayer::paintOverflowControls): Ditto.
+        (WebCore::RenderLayer::paintScrollCorner): Ditto.
+        (WebCore::RenderLayer::drawPlatformResizerImage): Ditto.
+        (WebCore::RenderLayer::paintResizer): Ditto.
+        (WebCore::RenderLayer::hitTestOverflowControls): Hit testing & overflow controls both use integers.
+        (WebCore::RenderLayer::clipToRect): Clipping to actual painted (pixel snapped) layer bounds in the
+        graphics context.
+        (WebCore::RenderLayer::paintLayerContents): Calling paintOverflowControls at pixel bounds.
+        (WebCore::RenderLayer::hitTest): Intersecting the hit test area with pixel snapped boundaries.
+        (WebCore::RenderLayer::setBackingNeedsRepaintInRect): Sending pixelSnapped rects to the backing
+        store, which only cares about pixels, and hence integers.
+        * rendering/RenderLayer.h:
+        (WebCore::RenderLayer::scrolledContentOffset): RenderLayer's scroll offsets are used in platform
+        code, so we need to return them as integers. Rounding the scroll overflow before adding it to the
+        scroll offset, which was already stored in integers.
+        (RenderLayer):
+
+2012-02-14  Abhishek Arya  <inferno@chromium.org>
+
+        Crash in NavigationScheduler::schedule.
+        https://bugs.webkit.org/show_bug.cgi?id=78297
+
+        Reviewed by Adam Barth.
+
+        Protect frame pointer and navigation scheduler when we stop the
+        load (when redirect is scheduled during a load). Also, dont fire
+        the navigation scheduler timer when we know that frameloader is
+        going away.
+
+        Test: http/tests/navigation/navigation-redirect-schedule-crash.html
+
+        * loader/NavigationScheduler.cpp:
+        (WebCore::NavigationScheduler::schedule):
+
+2012-02-14  Alexis Menard  <alexis.menard@openbossa.org>
+
+        font shorthand with inherit keyword incorrectly parsed and rendered
+        https://bugs.webkit.org/show_bug.cgi?id=20181
+
+        Reviewed by Tony Chang.
+
+        As stated in http://www.w3.org/TR/CSS21/changes.html#q142
+        if the inherit (and also by extension initial) is encountered in the
+        middle of the shorthand then the property becomes invalid.
+
+        Test: fast/css/font-shorthand-mix-inherit.html
+
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseFont):
+        (WebCore::CSSParser::parseFontFamily):
+
+2012-02-14  Abhishek Arya  <inferno@chromium.org>
+
+        Crash due to incorrect firing of mutation event during class attribute parsing.
+        https://bugs.webkit.org/show_bug.cgi?id=78537
+
+        Reviewed by Ryosuke Niwa.
+
+        Test: fast/dom/class-attr-change-double-mutation-fire.html
+
+        * dom/StyledElement.cpp:
+        (WebCore::StyledElement::classAttributeChanged):
+
+2012-02-14  Mike Lawther  <mikelawther@chromium.org>
+
+        CSS3 calc: add isZero implementations to catch divide by zero
+        https://bugs.webkit.org/show_bug.cgi?id=78603
+
+        Reviewed by Ojan Vafai.
+
+        * css/CSSCalculationValue.cpp:
+        (WebCore::CSSCalcPrimitiveValue::isZero):
+        (CSSCalcPrimitiveValue):
+        (WebCore::CSSCalcBinaryOperation::isZero):
+        (CSSCalcBinaryOperation):
+        * css/CSSCalculationValue.h:
+        (CSSCalcExpressionNode):
+
+2012-02-12  Timothy Hatcher  <timothy@apple.com>
+
+        Don't include CachedResources that haven't downloaded when populating the Web Inspector on load.
+
+        https://webkit.org/b/78447
+        rdar://problem/10843542
+
+        Reviewed by Brian Weinstein.
+
+        Test: inspector/protocol/page-agent.html
+
+        * inspector/InspectorPageAgent.cpp:
+        (WebCore::InspectorPageAgent::cachedResourcesForFrame): Skip CachedFonts and CachedImages that
+        return true for stillNeedsLoad.
+        * loader/cache/CachedFont.h:
+        (WebCore::CachedFont::stillNeedsLoad): Added.
+
+2012-02-12  Timothy Hatcher  <timothy@apple.com>
+
+        Web Inspector: include failed and canceled in FrameResourceTree.
+
+        https://webkit.org/b/78445
+
+        Reviewed by Pavel Feldman.
+
+        Test: inspector/protocol/page-agent.html
+
+        * WebCore.xcodeproj/project.pbxproj: Added Inspector.json, Inspector-0.1.json and Inspector-1.0.json
+        for quick access and easy editing.
+        * inspector/Inspector.json: Added failed and canceled as optional properties to the object for resources in FrameResourceTree.
+        * inspector/InspectorPageAgent.cpp:
+        (WebCore::InspectorPageAgent::buildObjectForFrameTree): Set those properties.
+
+2012-02-14  Csaba Osztrogonác  <ossy@webkit.org>
+
+        Typo fix after r107707.
+
+        * platform/graphics/texmap/TextureMapperNode.cpp:
+        (WebCore::TextureMapperNode::updateBackingStore):
+
+2012-02-14  Andrey Kosyakov  <caseq@chromium.org>
+
+        Web Inspector: [refactoring] extract TimelineOverviewWindow from TimelineOverviewPanel
+        https://bugs.webkit.org/show_bug.cgi?id=78599
+
+        Reviewed by Pavel Feldman.
+
+        * inspector/front-end/TimelineOverviewPane.js:
+        (WebInspector.TimelineOverviewPane):
+        (WebInspector.TimelineOverviewPane.prototype.reset):
+        (WebInspector.TimelineOverviewPane.prototype.scrollWindow):
+        (WebInspector.TimelineOverviewWindow):
+        (WebInspector.TimelineOverviewWindow.prototype.reset):
+        (WebInspector.TimelineOverviewWindow.prototype.scrollWindow):
+        (WebInspector.TimelineOverviewWindow.prototype._windowResizeDragging):
+        (WebInspector.TimelineOverviewWindow.prototype._dragWindow):
+        (WebInspector.TimelineOverviewWindow.prototype._windowSelectorDragging):
+        (WebInspector.TimelineOverviewWindow.prototype._endWindowSelectorDragging):
+        (WebInspector.TimelineOverviewWindow.prototype._windowDragging):
+        (WebInspector.TimelineOverviewWindow.prototype._resizeWindowRight):
+        (WebInspector.TimelineOverviewWindow.prototype._resizeWindowMaximum):
+        (WebInspector.TimelineOverviewWindow.prototype._setWindowPosition):
+        (WebInspector.TimelineOverviewWindow.prototype._endWindowDragging):
+        (WebInspector.TimelinePanel.WindowSelector):
+
+2012-02-14  Vsevolod Vlasov  <vsevik@chromium.org>
+
+        Web Inspector: Make ScriptsNavigator default file selector.
+        https://bugs.webkit.org/show_bug.cgi?id=78349
+
+        Reviewed by Pavel Feldman.
+
+        Moved ScriptsNavigator out of experiments.
+        Introduced new setting "useScriptsNavigator" with true as default value.
+        Updated scripts panel tests related to file selector.
+
+        Tests: inspector/debugger/scripts-combobox-file-selector-history.html
+               inspector/debugger/scripts-file-selector.html
+
+        * English.lproj/localizedStrings.js:
+        * inspector/front-end/DebuggerPresentationModel.js:
+        (WebInspector.DebuggerPresentationModel.prototype.uiSourceCodes):
+        * inspector/front-end/ScriptsNavigator.js:
+        (WebInspector.ScriptsNavigator.prototype._removeUISourceCode):
+        (WebInspector.ScriptsNavigator.prototype._showScriptFoldersSettingChanged):
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel.prototype._uiSourceCodeAdded):
+        (WebInspector.ScriptsPanel.prototype._addUISourceCode):
+        (WebInspector.ScriptsPanel.prototype._updateExecutionLine):
+        * inspector/front-end/Settings.js:
+        (WebInspector.ExperimentsSettings):
+        * inspector/front-end/SettingsScreen.js:
+        (WebInspector.SettingsScreen):
+
+2012-02-14  No'am Rosenthal  <noam.rosenthal@nokia.com>
+
+        [Qt][Texmap] Refactor backing-store code in TextureMapper
+        https://bugs.webkit.org/show_bug.cgi?id=78305
+
+        Instead of dealing with tiling inside of TextureMapperNode, we now deal with that in a new
+        TextureMapperBackingStore class. Since the class is abstract, WebKit2 can overload it to
+        support remotely-managed tiles.
+        The backing-store for directly composited images is handled separately, in a new class
+        TextureMapperCompositedImage. The TextureMapper implementation decides the dimension of
+        the tiles, for example 2000 in the case of OpenGL.
+        Also, directly composited content is now handled correctly, by painting it after the regular
+        content and not as part of the same texture.
+
+        To make this work, the functions in TextureMapperPlatformLayers had to become non-const,
+        thus the changes to that file and GraphicsContext3DQt.
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        No new functionality, no new tests.
+
+        * GNUmakefile.list.am:
+        * Target.pri:
+        * WebCore.gypi:
+        * platform/graphics/opengl/TextureMapperGL.h:
+        (WebCore::TextureMapperGL::maxTextureDimension):
+        * platform/graphics/qt/GraphicsContext3DQt.cpp:
+        (GraphicsContext3DPrivate):
+        (WebCore::GraphicsContext3DPrivate::paintToTextureMapper):
+        * platform/graphics/texmap/GraphicsLayerTextureMapper.cpp:
+        (WebCore::GraphicsLayerTextureMapper::GraphicsLayerTextureMapper):
+        (WebCore::GraphicsLayerTextureMapper::didSynchronize):
+        (WebCore::GraphicsLayerTextureMapper::setNeedsDisplay):
+        (WebCore::GraphicsLayerTextureMapper::setContentsNeedsDisplay):
+        (WebCore::GraphicsLayerTextureMapper::setNeedsDisplayInRect):
+        (WebCore::GraphicsLayerTextureMapper::addChildBelow):
+        (WebCore):
+        (WebCore::GraphicsLayerTextureMapper::getContentsLayer):
+        (WebCore::GraphicsLayerTextureMapper::setContentsToImage):
+        (WebCore::GraphicsLayerTextureMapper::setContentsToMedia):
+        * platform/graphics/texmap/GraphicsLayerTextureMapper.h:
+        (GraphicsLayerTextureMapper):
+        (WebCore::GraphicsLayerTextureMapper::platformLayer):
+        (WebCore::GraphicsLayerTextureMapper::needsDisplay):
+        (WebCore::GraphicsLayerTextureMapper::needsDisplayRect):
+        * platform/graphics/texmap/TextureMapper.cpp:
+        * platform/graphics/texmap/TextureMapper.h:
+        (WebCore::TextureMapper::maxTextureDimension):
+        (TextureMapper):
+        * platform/graphics/texmap/TextureMapperBackingStore.cpp: Added.
+        * platform/graphics/texmap/TextureMapperBackingStore.h: Added.
+        * platform/graphics/texmap/TextureMapperNode.cpp:
+        (WebCore::TextureMapperNode::backingStore):
+        (WebCore::TextureMapperNode::updateBackingStore):
+        (WebCore::TextureMapperNode::paint):
+        (WebCore::TextureMapperNode::paintSelf):
+        (WebCore::TextureMapperNode::intermediateSurfaceRect):
+        (WebCore::TextureMapperNode::paintRecursive):
+        (WebCore::TextureMapperNode::syncCompositingStateSelf):
+        (WebCore::TextureMapperNode::syncCompositingState):
+        * platform/graphics/texmap/TextureMapperNode.h:
+        (TextureMapperPaintOptions):
+        (WebCore::TextureMapperPaintOptions::TextureMapperPaintOptions):
+        (WebCore::TextureMapperNode::TextureMapperNode):
+        (TextureMapperNode):
+        (WebCore::TextureMapperNode::setBackingStore):
+        (WebCore::TextureMapperNode::texture):
+        (WebCore::TextureMapperNode::layerRect):
+        (WebCore::TextureMapperNode::createBackingStore):
+        (State):
+        (WebCore::TextureMapperNode::State::State):
+        * platform/graphics/texmap/TextureMapperPlatformLayer.h:
+        (TextureMapperPlatformLayer):
+        (WebCore::TextureMapperPlatformLayer::swapBuffers):
+
+2012-02-14  Shinya Kawanaka  <shinyak@google.com>
+
+        Use youngestShadowRoot and oldestShadowRoot instead of Element::shadowRoot().
+        https://bugs.webkit.org/show_bug.cgi?id=78455
+
+        Reviewed by Hajime Morita.
+
+        Element::shadowRoot() was used for these 3 purposes.
+        1. checks a shadow root exists.
+        2. gets author shadow root.
+        3. gets user agent shadow root.
+
+        We have to distinguish them when implementing multiple shadow subtrees.
+
+        Calling for (1), (2), and (3) are convered to hasShadowRoot(),
+        ShadowRootList()->youngestShadowRoot(), and ShadowRootList()->oldestShadowRoot() respectively.
+
+        No new tests, no change in behavior.
+
+        * WebCore.exp.in:
+        * dom/Document.cpp:
+        (WebCore::Document::buildAccessKeyMap):
+        * dom/Element.cpp:
+        (WebCore::Element::insertedIntoDocument):
+        (WebCore::Element::removedFromDocument):
+        (WebCore::Element::insertedIntoTree):
+        (WebCore::Element::removedFromTree):
+        (WebCore::Element::attach):
+        (WebCore::Element::detach):
+        (WebCore::Element::recalcStyle):
+        (WebCore::Element::ensureShadowRoot):
+        (WebCore::Element::childrenChanged):
+        (WebCore::Element::focus):
+        * dom/Element.h:
+        (Element):
+        * dom/EventDispatcher.cpp:
+        (WebCore::isShadowHost):
+        * dom/Node.cpp:
+        (WebCore::shadowRoot):
+        * dom/NodeRenderingContext.cpp:
+        (WebCore::NodeRenderingContext::NodeRenderingContext):
+        * dom/ShadowRoot.cpp:
+        (WebCore::ShadowRoot::create):
+        * dom/ShadowRootList.cpp:
+        (WebCore::ShadowRootList::insertedIntoDocument):
+        (WebCore):
+        (WebCore::ShadowRootList::removedFromDocument):
+        (WebCore::ShadowRootList::insertedIntoTree):
+        (WebCore::ShadowRootList::removedFromTree):
+        (WebCore::ShadowRootList::hostChildrenChanged):
+        (WebCore::ShadowRootList::attach):
+        (WebCore::ShadowRootList::detach):
+        * dom/ShadowRootList.h:
+        (ShadowRootList):
+        * dom/TreeScopeAdopter.cpp:
+        (WebCore::shadowRootFor):
+        * html/FileInputType.cpp:
+        (WebCore::FileInputType::createShadowSubtree):
+        (WebCore::FileInputType::multipleAttributeChanged):
+        * html/HTMLDetailsElement.cpp:
+        (WebCore::HTMLDetailsElement::createShadowSubtree):
+        (WebCore::HTMLDetailsElement::findMainSummary):
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::createShadowSubtree):
+        * html/HTMLKeygenElement.cpp:
+        (WebCore::HTMLKeygenElement::HTMLKeygenElement):
+        (WebCore::HTMLKeygenElement::shadowSelect):
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::mediaControls):
+        (WebCore::HTMLMediaElement::hasMediaControls):
+        * html/HTMLMeterElement.cpp:
+        (WebCore::HTMLMeterElement::createShadowSubtree):
+        * html/HTMLProgressElement.cpp:
+        (WebCore::HTMLProgressElement::createShadowSubtree):
+        * html/HTMLSummaryElement.cpp:
+        (WebCore::HTMLSummaryElement::createShadowSubtree):
+        * html/HTMLTextAreaElement.cpp:
+        (WebCore::HTMLTextAreaElement::createShadowSubtree):
+        (WebCore::HTMLTextAreaElement::innerTextElement):
+        (WebCore::HTMLTextAreaElement::updatePlaceholderText):
+        * html/InputType.cpp:
+        (WebCore::InputType::destroyShadowSubtree):
+        * html/RangeInputType.cpp:
+        (WebCore::RangeInputType::handleMouseDownEvent):
+        (WebCore::RangeInputType::createShadowSubtree):
+        * html/TextFieldInputType.cpp:
+        (WebCore::TextFieldInputType::createShadowSubtree):
+        (WebCore::TextFieldInputType::updatePlaceholderText):
+        * html/ValidationMessage.cpp:
+        (WebCore::ValidationMessage::deleteBubbleTree):
+        * html/shadow/SliderThumbElement.cpp:
+        (WebCore::sliderThumbElementOf):
+        (WebCore::RenderSliderContainer::layout):
+        (WebCore::trackLimiterElementOf):
+        * page/FocusController.cpp:
+        (WebCore::shadowRoot):
+        * rendering/RenderFileUploadControl.cpp:
+        (WebCore::RenderFileUploadControl::uploadButton):
+        * svg/SVGTRefElement.cpp:
+        (WebCore::SVGTRefElement::updateReferencedText):
+        * testing/Internals.cpp:
+        (WebCore::Internals::ensureShadowRoot):
+        (WebCore::Internals::shadowRoot):
+        (WebCore):
+        (WebCore::Internals::youngestShadowRoot):
+        (WebCore::Internals::oldestShadowRoot):
+        * testing/Internals.h:
+        (Internals):
+        * testing/Internals.idl:
+
+2012-02-14  Alexander Pavlov  <apavlov@chromium.org>
+
+        Elements panel needs to be able to preview images
+        https://bugs.webkit.org/show_bug.cgi?id=21570
+
+        Reviewed by Pavel Feldman.
+
+        * inspector/front-end/ElementsPanel.js:
+        (WebInspector.ElementsPanel):
+        (WebInspector.ElementsPanel.prototype.willHide):
+        (WebInspector.ElementsPanel.prototype._getPopoverAnchor):
+        (WebInspector.ElementsPanel.prototype._loadDimensionsForNode.resolvedNode.dimensions):
+        (WebInspector.ElementsPanel.prototype._loadDimensionsForNode.resolvedNode):
+        (WebInspector.ElementsPanel.prototype._loadDimensionsForNode):
+        (WebInspector.ElementsPanel.prototype._showPopover.dimensionsCallback):
+        (WebInspector.ElementsPanel.prototype._showPopover.showPopover):
+        (WebInspector.ElementsPanel.prototype._showPopover.buildPopoverContents):
+        (WebInspector.ElementsPanel.prototype._showPopover):
+        * inspector/front-end/ElementsTreeOutline.js:
+        (WebInspector.ElementsTreeOutline.prototype._onmousemove):
+        * inspector/front-end/StylesSidebarPane.js:
+        (WebInspector.StylePropertyTreeElement.prototype.updateTitle.get g):
+        (WebInspector.StylePropertyTreeElement.prototype.updateTitle):
+        * inspector/front-end/elementsPanel.css:
+        (.image-preview-container):
+        (.image-preview-container img):
+
+2012-02-14  Pavel Feldman  <pfeldman@chromium.org>
+
+        Web Inspector: List expansion arrows is pointing down even
+        when the list of eventListeners are hidden in the Elements tab
+        https://bugs.webkit.org/show_bug.cgi?id=78360
+
+        Reviewed by Timothy Hatcher.
+
+        * inspector/front-end/elementsPanel.css:
+        (.section .event-bar .header):
+        (.section .event-bars .event-bar .header .title):
+        (.section .event-bar .header .subtitle):
+        (.section .event-bar .header::before):
+        (.section .event-bar.expanded .header::before):
+
+2012-02-14  Hayato Ito  <hayato@chromium.org>
+
+        Make ShadowRoot.nodeType return DOCUMENT_FRAGMENT_NODE.
+        https://bugs.webkit.org/show_bug.cgi?id=77514
+
+        Reviewed by Dimitri Glazkov.
+
+        NodeType.SHADOW_ROOT_NODE type is finally gone.
+
+        * bindings/js/JSNodeCustom.cpp:
+        (WebCore::createWrapperInline):
+        * bindings/objc/DOM.mm:
+        (kitClass):
+        * bindings/v8/custom/V8NodeCustom.cpp:
+        (WebCore::toV8Slow):
+        * dom/ContainerNode.cpp:
+        (WebCore::collectTargetNodes):
+        (WebCore::ContainerNode::replaceChild):
+        * dom/Document.cpp:
+        (WebCore::Document::importNode):
+        (WebCore::Document::childTypeAllowed):
+        (WebCore::Document::canReplaceChild):
+        * dom/Node.cpp:
+        (WebCore::Node::dumpStatistics):
+        (WebCore::Node::isDefaultNamespace):
+        (WebCore::Node::lookupPrefix):
+        (WebCore::Node::lookupNamespaceURI):
+        (WebCore::appendTextContent):
+        (WebCore::Node::setTextContent):
+        * dom/Node.h:
+        * dom/Range.cpp:
+        (WebCore::lengthOfContentsInNode):
+        (WebCore::Range::processContentsBetweenOffsets):
+        (WebCore::Range::insertNode):
+        (WebCore::Range::checkNodeWOffset):
+        (WebCore::Range::checkNodeBA):
+        (WebCore::Range::selectNode):
+        (WebCore::Range::selectNodeContents):
+        (WebCore::Range::surroundContents):
+        * dom/ShadowRoot.cpp:
+        * dom/ShadowRoot.h:
+        (ShadowRoot):
+        (WebCore::toShadowRoot):
+        * editing/FrameSelection.cpp:
+        (WebCore::nodeIsDetachedFromDocument):
+        (WebCore):
+        (WebCore::FrameSelection::textWillBeReplaced):
+        * editing/MarkupAccumulator.cpp:
+        (WebCore::MarkupAccumulator::appendStartMarkup):
+        * html/parser/HTMLElementStack.cpp:
+        (WebCore::HTMLNames::isRootNode):
+        (WebCore::HTMLElementStack::pushRootNode):
+        * html/parser/HTMLElementStack.h:
+        (WebCore::isInHTMLNamespace):
+        * inspector/InspectorDOMAgent.cpp:
+        (WebCore::InspectorDOMAgent::pushChildNodesToFrontend):
+        (WebCore::InspectorDOMAgent::buildObjectForNode):
+        * xml/XPathUtil.cpp:
+        (WebCore::XPath::isValidContextNode):
+
+2012-02-14  Andreas Kling  <awesomekling@apple.com>
+
+        StylePropertySet: Try to find a CSSValuePool for identifier values.
+        <http://webkit.org/b/78590>
+
+        Reviewed by Antti Koivisto.
+
+        For StylePropertySets with a parent element (inline and attribute style),
+        grab at the parentElement()->document() to locate a CSSValuePool.
+        This code will change soon in the CSSOM refactoring and moreso once we
+        figure out how to have a global CSSValuePool, but I'm hoping it will buy
+        us some perf back in the meantime.
+
+        * css/StylePropertySet.cpp:
+        (WebCore::StylePropertySet::setProperty):
+
+2012-02-14  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Convert svg/animations to use SMIL methods for driving the timeline
+        https://bugs.webkit.org/show_bug.cgi?id=78422
+
+        Reviewed by Hajime Morita.
+
+        Fix last-minute typo in clearTimesWithDynamicOrigins, leading to assertions browsing the W3C SVG animation tests.
+        Covered by existing tests in svg/animations.
+
+        * svg/SVGAnimationElement.cpp: Remove unused endedActiveInterval.
+        * svg/SVGAnimationElement.h: Ditto.
+        * svg/animation/SVGSMILElement.cpp:
+        (WebCore::clearTimesWithDynamicOrigins): Fix order of walking the times list.
+        (WebCore::SVGSMILElement::reset): Move calls to clearTimesWithDynamicOrigins into endedActiveInterval.
+        (WebCore::SVGSMILElement::endedActiveInterval):
+        * svg/animation/SVGSMILElement.h:
+        (SVGSMILElement): Devirtualize endedActiveInterval.
+
+2012-02-14  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r107661.
+        http://trac.webkit.org/changeset/107661
+        https://bugs.webkit.org/show_bug.cgi?id=78591
+
+        crash on lion/qt bots (Requested by hayato on #webkit).
+
+        * bindings/js/JSNodeCustom.cpp:
+        (WebCore::createWrapperInline):
+        * bindings/objc/DOM.mm:
+        (kitClass):
+        * bindings/v8/custom/V8NodeCustom.cpp:
+        (WebCore::toV8Slow):
+        * dom/ContainerNode.cpp:
+        (WebCore::collectTargetNodes):
+        (WebCore::ContainerNode::replaceChild):
+        * dom/Document.cpp:
+        (WebCore::Document::importNode):
+        (WebCore::Document::childTypeAllowed):
+        (WebCore::Document::canReplaceChild):
+        * dom/Node.cpp:
+        (WebCore::Node::dumpStatistics):
+        (WebCore::Node::isDefaultNamespace):
+        (WebCore::Node::lookupPrefix):
+        (WebCore::Node::lookupNamespaceURI):
+        (WebCore::appendTextContent):
+        (WebCore::Node::setTextContent):
+        * dom/Node.h:
+        * dom/Range.cpp:
+        (WebCore::lengthOfContentsInNode):
+        (WebCore::Range::processContentsBetweenOffsets):
+        (WebCore::Range::insertNode):
+        (WebCore::Range::checkNodeWOffset):
+        (WebCore::Range::checkNodeBA):
+        (WebCore::Range::selectNode):
+        (WebCore::Range::selectNodeContents):
+        (WebCore::Range::surroundContents):
+        * dom/ShadowRoot.cpp:
+        (WebCore::ShadowRoot::nodeType):
+        (WebCore):
+        * dom/ShadowRoot.h:
+        (ShadowRoot):
+        (WebCore::toShadowRoot):
+        * editing/FrameSelection.cpp:
+        (WebCore::FrameSelection::textWillBeReplaced):
+        * editing/MarkupAccumulator.cpp:
+        (WebCore::MarkupAccumulator::appendStartMarkup):
+        * html/parser/HTMLElementStack.cpp:
+        (WebCore::HTMLNames::isRootNode):
+        (WebCore::HTMLElementStack::pushRootNode):
+        * html/parser/HTMLElementStack.h:
+        (WebCore::isInHTMLNamespace):
+        * inspector/InspectorDOMAgent.cpp:
+        (WebCore::InspectorDOMAgent::pushChildNodesToFrontend):
+        (WebCore::InspectorDOMAgent::buildObjectForNode):
+        * xml/XPathUtil.cpp:
+        (WebCore::XPath::isValidContextNode):
+
+2012-02-14  Hayato Ito  <hayato@chromium.org>
+
+        Fix typo. HTMLContentSeleciton -> HTMLContentSelection.
+        https://bugs.webkit.org/show_bug.cgi?id=78571
+
+        Reviewed by Hajime Morita.
+
+        No tests. No change in behavior.
+
+        * dom/NodeRenderingContext.cpp:
+        (WebCore::nextRendererOf):
+        (WebCore::previousRendererOf):
+        (WebCore::firstRendererOf):
+        (WebCore::lastRendererOf):
+        * dom/ShadowRoot.cpp:
+        (WebCore::ShadowRoot::insertionPointFor):
+        * html/shadow/HTMLContentElement.cpp:
+        (WebCore::HTMLContentElement::attach):
+        * html/shadow/HTMLContentSelector.cpp:
+        (WebCore::HTMLContentSelection::append):
+        (WebCore::HTMLContentSelection::unlink):
+        (WebCore::HTMLContentSelectionList::find):
+        (WebCore::HTMLContentSelectionList::append):
+        (WebCore::HTMLContentSelector::select):
+        (WebCore::HTMLContentSelector::unselect):
+        (WebCore::HTMLContentSelector::findFor):
+        * html/shadow/HTMLContentSelector.h:
+        (HTMLContentSelection):
+        (WebCore::HTMLContentSelection::next):
+        (WebCore::HTMLContentSelection::previous):
+        (WebCore::HTMLContentSelection::HTMLContentSelection):
+        (WebCore::HTMLContentSelection::create):
+        (WebCore::HTMLContentSelectionList::first):
+        (WebCore::HTMLContentSelectionList::last):
+        (HTMLContentSelectionList):
+        (WebCore::HTMLContentSelectionSet::add):
+        (WebCore::HTMLContentSelectionSet::remove):
+        (HTMLContentSelectionSet):
+        (WebCore::HTMLContentSelectionSet::Translator::equal):
+        (WebCore::HTMLContentSelectionSet::Hash::hash):
+        (WebCore::HTMLContentSelectionSet::Hash::equal):
+        (WebCore::HTMLContentSelectionSet::find):
+        (HTMLContentSelector):
+
+2012-02-14  Mike Lawther  <mikelawther@chromium.org>
+
+        CSS3 calc: embed calc expressions in CSSPrimitiveValue
+        https://bugs.webkit.org/show_bug.cgi?id=78446
+
+        Reviewed by Ojan Vafai.
+        
+        Adds calc expressions to CSSPrimitiveValue. This enables simple (ie no mixing of
+        percents with numbers/lengths) expressions to be evaluated on most properties.
+
+        Tests: css3/calc/block-mask-overlay-image-outset-expected.html
+               css3/calc/css3-radial-gradients-expected.html
+               css3/calc/gradient-color-stops-expected.html
+
+        * css/CSSCalculationValue.cpp:
+        (WebCore::CSSCalcValue::computeLengthPx):
+        (WebCore):
+        (WebCore::CSSCalcPrimitiveValue::doubleValue):
+        (CSSCalcPrimitiveValue):
+        (WebCore::CSSCalcPrimitiveValue::computeLengthPx):
+        (CSSCalcBinaryOperation):
+        (WebCore::CSSCalcBinaryOperation::computeLengthPx):
+        * css/CSSCalculationValue.h:
+        (CSSCalcExpressionNode):
+        (CSSCalcValue):
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::createPrimitiveNumericValue):
+        (WebCore::CSSParser::parseValidPrimitive):
+        * css/CSSPrimitiveValue.cpp:
+        (WebCore::isValidCSSUnitTypeForDoubleConversion):
+        (WebCore::CSSPrimitiveValue::primitiveType):
+        (WebCore::CSSPrimitiveValue::init):
+        (WebCore):
+        (WebCore::CSSPrimitiveValue::cleanup):
+        (WebCore::CSSPrimitiveValue::computeLengthDouble):
+        (WebCore::CSSPrimitiveValue::getDoubleValue):
+        (WebCore::CSSPrimitiveValue::getDoubleValueInternal):
+        (WebCore::CSSPrimitiveValue::customCssText):
+        * css/CSSPrimitiveValue.h:
+        (WebCore):
+        (WebCore::CSSPrimitiveValue::isLength):
+        (WebCore::CSSPrimitiveValue::isNumber):
+        (WebCore::CSSPrimitiveValue::isPercentage):
+        (WebCore::CSSPrimitiveValue::isPx):
+        (WebCore::CSSPrimitiveValue::isCalculated):
+        (WebCore::CSSPrimitiveValue::isCalculatedPercentageNumber):
+        (WebCore::CSSPrimitiveValue::isCalculatedPercentageLength):
+        (CSSPrimitiveValue):
+        (WebCore::CSSPrimitiveValue::getValue):
+        (WebCore::CSSPrimitiveValue::cssCalcValue):
+        * css/CSSStyleApplyProperty.cpp:
+        (WebCore::ApplyPropertyBorderRadius::applyValue):
+
+2012-02-14  Pavel Feldman  <pfeldman@chromium.org>
+
+        Not reviewed: follow up to r107683: protect inspector sidebar from updating
+        while inserting new rule.
+
+        * inspector/front-end/StylesSidebarPane.js:
+        (WebInspector.BlankStylePropertiesSection.prototype.editingSelectorCommitted.successCallback):
+        (WebInspector.BlankStylePropertiesSection.prototype.editingSelectorCommitted):
+
+2012-02-14  Rick Byers  <rbyers@.com>
+
+        Extend Chromium V8 tracing to cover more cases
+        https://bugs.webkit.org/show_bug.cgi?id=78507
+
+        Reviewed by Eric Seidel.
+
+        No tests modified because this affects only chrome tracing which we
+        currently don't try to validate with automated tests.
+
+        * bindings/v8/V8EventListener.cpp:
+        (WebCore::V8EventListener::callListenerFunction):
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::instrumentedCallFunction):
+        (WebCore::V8Proxy::newInstance):
+
+2012-02-14  Pavel Feldman  <pfeldman@google.com>
+
+        Web Inspector: fire stylesheet changed event upon CSS modifications.
+        https://bugs.webkit.org/show_bug.cgi?id=78500
+
+        Reviewed by Yury Semikhatsky.
+
+        * inspector/Inspector.json:
+        * inspector/InspectorCSSAgent.cpp:
+        (WebCore::InspectorCSSAgent::SetStyleSheetTextAction::mergeId):
+        (InspectorCSSAgent::SetStyleSheetTextAction):
+        (WebCore::InspectorCSSAgent::SetStyleSheetTextAction::merge):
+        (WebCore::InspectorCSSAgent::setStyleSheetText):
+        (WebCore::InspectorCSSAgent::asInspectorStyleSheet):
+        (WebCore::InspectorCSSAgent::bindStyleSheet):
+        (WebCore::InspectorCSSAgent::viaInspectorStyleSheet):
+        (WebCore::InspectorCSSAgent::styleSheetChanged):
+        (WebCore):
+        * inspector/InspectorCSSAgent.h:
+        (InspectorCSSAgent):
+        * inspector/InspectorStyleSheet.cpp:
+        (WebCore::InspectorStyleSheet::create):
+        (WebCore::InspectorStyleSheet::InspectorStyleSheet):
+        (WebCore::InspectorStyleSheet::reparseStyleSheet):
+        (WebCore::InspectorStyleSheet::setRuleSelector):
+        (WebCore::InspectorStyleSheet::addRule):
+        (WebCore::InspectorStyleSheet::deleteRule):
+        (WebCore::InspectorStyleSheet::setPropertyText):
+        (WebCore::InspectorStyleSheet::toggleProperty):
+        (WebCore::InspectorStyleSheet::fireStyleSheetChanged):
+        (WebCore):
+        (WebCore::InspectorStyleSheetForInlineStyle::create):
+        (WebCore::InspectorStyleSheetForInlineStyle::InspectorStyleSheetForInlineStyle):
+        * inspector/InspectorStyleSheet.h:
+        (WebCore::InspectorStyleSheet::Listener::~Listener):
+        (Listener):
+        (InspectorStyleSheet):
+        (InspectorStyleSheetForInlineStyle):
+        * inspector/front-end/CSSStyleModel.js:
+        (WebInspector.CSSStyleModel):
+        (WebInspector.CSSStyleModel.prototype.setRuleSelector):
+        (WebInspector.CSSStyleModel.prototype.setRuleSelector.callback):
+        (WebInspector.CSSStyleModel.prototype.addRule):
+        (WebInspector.CSSStyleModel.prototype.addRule.callback):
+        (WebInspector.CSSStyleModel.prototype._fireStyleSheetChanged.callback):
+        (WebInspector.CSSStyleModel.prototype._fireStyleSheetChanged):
+        (WebInspector.CSSStyleModel.prototype.setStyleSheetText):
+        (WebInspector.CSSStyleModel.prototype._undoRequested):
+        (WebInspector.CSSStyleModel.prototype._undoCompleted):
+        (WebInspector.CSSStyleDeclaration.prototype.insertPropertyAt):
+        (WebInspector.CSSProperty.prototype.setText):
+        (WebInspector.CSSProperty.prototype.setText.callback):
+        (WebInspector.CSSProperty.prototype.setDisabled.callback):
+        (WebInspector.CSSProperty.prototype.setDisabled):
+        (WebInspector.CSSStyleSheet.prototype.setText):
+        (WebInspector.CSSDispatcher.prototype.mediaQueryResultChanged):
+        (WebInspector.CSSDispatcher.prototype.styleSheetChanged):
+        * inspector/front-end/DOMAgent.js:
+        (WebInspector.DOMAgent.prototype._emulateTouchEventsChanged):
+        (WebInspector.DOMAgent.prototype.get undo):
+        * inspector/front-end/ElementsPanel.js:
+        (WebInspector.ElementsPanel.prototype.handleShortcut):
+
+2012-02-11  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Convert svg/animations to use SMIL methods for driving the timeline
+        https://bugs.webkit.org/show_bug.cgi?id=78422
+
+        Reviewed by Dirk Schulze.
+
+        Switch the svg/animations tests to use SVGSVGElement.setCurrentTime to drive the animation timeline.
+        This should fix all flakiness we previously had with these tests - and as nice side-effect we're now
+        using the standard SVG methods to drive the timeline, and thus have more coverage for these methods.
+        It already exposed several SMIL bugs, that had to be fixed, before this worked:
+
+        - beginElement()/endElement() modify the begin/end times of a SVGSMILElement. When beginElement() is
+          called a new begin time is added to the list - and the same happens for endElement() with the end list.
+          Unfortunately the begin/end times never get removed again, leading to incorrect instance time resolving
+          when begin/endElement is called repeatedly, combined with moving the timeline through setCurrentTime.
+
+          SMIL3 specifically demands that all 'dynamic' times in the begin/endTimes list, such that got inserted
+          via beginElement/endElement - get removed if the begin/endTimes list is updated. Why?
+          When calling beginElement, then endElement, then beginElement again, the begin/endTimes lists should be
+          identical, w/o leftovers from any previous begin/endElement call.
+
+          To keep track of that introduce SMILTimeWithOrigin, which holds a SMILTime and an Origin enum,
+          which determines whether this SMILTime was created by the parser or dynamically created via
+          beginElement/endElement.
+
+        - SMILTimeContainer::setElapsed() (called by SVGSVGElement::setCurrentTime) forgot to update the
+          animation state, when it was not paused.
+
+        - document.getElementsByTagName('animateMotion')[0], always returned 'object SVGElement', instead of
+          SVGAnimateMotion element making it impossible to query the animation start time, as the interfaces
+          from SVGAnimationElement were not available. Fix that by removing the last hacks from svgtags.in,
+          now that all IDLs are available.
+
+        Now that we use SVGSVGElement::setCurrentTime to drive the animation testing, we can remove
+        the DRT specific sampleSVGAnimationAtTime functionality, and its code springled all over WebCore.
+
+        Covered by all existing tests in svg/animations.
+
+        * WebCore.exp.in: Remove sampleAnimationAtTime() symbols.
+        * WebCore.order: Ditto.
+        * svg/SVGAnimationElement.cpp: Add a flag to begin/endElement, SMILTimeWithOrigin::ScriptOrigin, to indicate that these are dynamic SMILTimes, added by a script. 
+        (WebCore::SVGAnimationElement::beginElementAt):
+        (WebCore::SVGAnimationElement::endElementAt):
+        * svg/SVGDocumentExtensions.cpp: Remove sampleAnimationAtTime.
+        * svg/SVGDocumentExtensions.h: Ditto.
+        * svg/animation/SMILTime.h: Add SMILTimeWithOrigin helper.
+        (SMILTimeWithOrigin): Needs a SMILTime and an Origin enum entry.
+        (WebCore::SMILTimeWithOrigin::SMILTimeWithOrigin):
+        (WebCore::SMILTimeWithOrigin::time): Returns the SMILTime.
+        (WebCore::SMILTimeWithOrigin::originIsScript): Determines if this SMILTime got added by a script.
+        (WebCore::operator<): Used by std::sort.
+        * svg/animation/SMILTimeContainer.cpp:
+        (WebCore::SMILTimeContainer::setElapsed): Always call updateAnimations, even if the animation is not paused. Use the right elpased time value, to seek precisely to the desired position.
+        (WebCore::SMILTimeContainer::timerFired): Cleanup code, no need for a local variable 'elapsed'.
+        (WebCore::SMILTimeContainer::updateAnimations): Remove DRT specific sampling code, which is no longer needed.
+        * svg/animation/SMILTimeContainer.h: Remove sampleAnimationAtTime.
+        * svg/animation/SVGSMILElement.cpp:
+        (WebCore::SVGSMILElement::SVGSMILElement): Only call resolveFirstInterval, not reset, from the constructor - it wastes unnecessary time, as everything is already initialized.
+        (WebCore::clearTimesWithDynamicOrigins): Helper function to clear all SMILTimes from the begin/endTimes list, that are dynamic.
+        (WebCore::SVGSMILElement::reset): Clear begin/endTimes lists, on any reset() call (when driving the animation timeline through setElapsed).
+        (WebCore::SVGSMILElement::insertedIntoDocument): m_beginTimes now stores SMILTimeWithOrigins, adapt the code.
+        (WebCore::sortTimeList): Ditto.
+        (WebCore::SVGSMILElement::parseBeginOrEnd): Ditto.
+        (WebCore::SVGSMILElement::addBeginTime): Ditto.
+        (WebCore::SVGSMILElement::addEndTime): Ditto.
+        (WebCore::extractTimeFromVector): Ditto.
+        (WebCore::SVGSMILElement::findInstanceTime): Ditto.
+        * svg/animation/SVGSMILElement.h: 
+        * svg/svgtags.in: Enable animateMotion/hkern/mpath JS interfaces, which were not enabled, despite their IDLs existed.
+
+2012-02-14  Pavel Feldman  <pfeldman@chromium.org>
+
+        Web Inspector: [REGRESSION] Copy Stack Trace is broken
+        https://bugs.webkit.org/show_bug.cgi?id=78583
+
+        Reviewed by Yury Semikhatsky.
+
+        Test: inspector/debugger/copy-stack-trace.html
+
+        * inspector/front-end/CallStackSidebarPane.js:
+        (WebInspector.CallStackSidebarPane.prototype._copyStackTrace):
+
+2012-02-14  Eric Seidel  <eric@webkit.org>
+
+        Upstream Android's support for SK_B32_SHIFT to JPEGImageEncoder
+        https://bugs.webkit.org/show_bug.cgi?id=78540
+
+        Reviewed by Adam Barth.
+
+        * platform/image-encoders/skia/JPEGImageEncoder.cpp:
+        (WebCore::encodePixels):
+
+2012-02-13  Pavel Feldman  <pfeldman@chromium.org>
+
+        [Qt] inspector/styles/undo-add-new-rule.html crashes
+        https://bugs.webkit.org/show_bug.cgi?id=78502
+
+        Reviewed by Yury Semikhatsky.
+
+        * inspector/InspectorStyleSheet.cpp:
+        (WebCore::InspectorStyleSheet::deleteRule):
+
+2012-02-13  Nate Chapin  <japhet@chromium.org>
+
+        Reuse CachedRawResources (e.g., XHRs) that are stored
+        in the MemoryCache when appropriate.
+        https://bugs.webkit.org/show_bug.cgi?id=76564
+
+        Reviewed by Antti Koivisto.
+
+        No new tests, expected behavior covered by existing tests.
+
+        * html/DOMURL.cpp:
+        (WebCore::DOMURL::revokeObjectURL): Objects shouldn't remain in the
+            MemoryCache if revokeObjectURL is called on them.
+        * inspector/InspectorPageAgent.cpp:
+        (WebCore::InspectorPageAgent::cachedResourceContent): Add CachedRawResource support.
+        * inspector/InspectorResourceAgent.cpp:
+        (WebCore::InspectorResourceAgent::setCacheDisabled): Immediately
+            evict resources, rather than waiting for navigation, since XHRs
+            should hit the cache if it has been disabled.
+        * loader/cache/CachedRawResource.cpp:
+        (CachedRawResourceCallback): Encapsulates the async callback for
+            a cache hit for CachedRawResources.
+        (WebCore::CachedRawResource::sendCallbacks): Do the work defered in didAddClient.
+        (WebCore::CachedRawResource::didAddClient): Scheduled a CachedRawResourceCallback if
+            we already have a response, since async XHRs may not play nicely with receiving
+            their data synchronously.
+        (WebCore::CachedRawResource::removeClient): Ensure we cancel a callback to a client if
+            it removes itself.
+        (WebCore::CachedRawResource::canReuse): Provide some basic rules for when a
+            CachedRawResource can be reused.
+        * loader/cache/CachedRawResource.h:
+        * loader/cache/CachedResource.h:
+        * loader/cache/CachedResourceLoader.cpp:
+        (WebCore::CachedResourceLoader::determineRevalidationPolicy): Don't automatically reload
+            CachedRawResources, and add a check for whether this request has already been
+            made conditional.
+        * xml/XMLHttpRequest.cpp:
+
+2012-02-13  Dana Jansens  <danakj@chromium.org>
+
+        [chromium] Set opaque flag on SkBitmap in per-tile layer updater
+        https://bugs.webkit.org/show_bug.cgi?id=78498
+
+        Reviewed by Stephen White.
+
+        No new tests.
+
+        * platform/graphics/chromium/BitmapSkPictureCanvasLayerTextureUpdater.cpp:
+        (WebCore::BitmapSkPictureCanvasLayerTextureUpdater::Texture::prepareRect):
+        * platform/graphics/chromium/SkPictureCanvasLayerTextureUpdater.h:
+        (SkPictureCanvasLayerTextureUpdater):
+        (WebCore::SkPictureCanvasLayerTextureUpdater::layerIsOpaque):
+
+2012-02-13  W. James MacLean  <wjmaclean@chromium.org>
+
+        [chromium] Remove obsolete zoom animation pathway.
+        https://bugs.webkit.org/show_bug.cgi?id=78359
+
+        Reviewed by James Robinson.
+
+        Tests for existing pathways should not be broken. Tests for removed pathway removed previously.
+
+        This patch removes dead code from the previous incarnation of zoom animation for chromium.
+
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::handleGestureEvent):
+        * page/FrameView.cpp:
+        * page/FrameView.h:
+        (FrameView):
+        * platform/ScrollAnimator.cpp:
+        (WebCore::ScrollAnimator::ScrollAnimator):
+        * platform/ScrollAnimator.h:
+        (ScrollAnimator):
+        * platform/ScrollAnimatorNone.cpp:
+        (WebCore::ScrollAnimatorNone::ScrollAnimatorNone):
+        (WebCore::ScrollAnimatorNone::animationTimerFired):
+        * platform/ScrollAnimatorNone.h:
+        (ScrollAnimatorNone):
+        * platform/ScrollableArea.cpp:
+        * platform/ScrollableArea.h:
+        * testing/InternalSettings.cpp:
+        * testing/InternalSettings.h:
+        (InternalSettings):
+        * testing/InternalSettings.idl:
+        * testing/Internals.cpp:
+
+2012-02-13  Shinya Kawanaka  <shinyak@chromium.org>
+
+        [Regression] r107650 broke the windows build.
+        https://bugs.webkit.org/show_bug.cgi?id=78569
+
+        Build fix, Unreviewed.
+
+        The variable defined in switch statement should not escape from the switch statement.
+
+        * dom/Element.cpp:
+        (WebCore::Element::webkitRegionOverflow):
+
+2012-02-13  ChangSeok Oh  <shivamidow@gmail.com>
+
+        [GTK] Mutation Observers build is broken
+        https://bugs.webkit.org/show_bug.cgi?id=78433
+
+        Reviewed by Martin Robinson.
+
+        Added some files missed.
+
+        No new tests since no new feature.
+
+        * GNUmakefile.list.am:
+
+2012-02-13  Hayato Ito  <hayato@chromium.org>
+
+        Make ShadowRoot.nodeType return DOCUMENT_FRAGMENT_NODE.
+        https://bugs.webkit.org/show_bug.cgi?id=77514
+
+        Reviewed by Dimitri Glazkov.
+
+        NodeType.SHADOW_ROOT_NODE type is finally gone.
+
+        * bindings/js/JSNodeCustom.cpp:
+        (WebCore::createWrapperInline):
+        * bindings/objc/DOM.mm:
+        (kitClass):
+        * bindings/v8/custom/V8NodeCustom.cpp:
+        (WebCore::toV8Slow):
+        * dom/ContainerNode.cpp:
+        (WebCore::collectTargetNodes):
+        (WebCore::ContainerNode::replaceChild):
+        * dom/Document.cpp:
+        (WebCore::Document::importNode):
+        (WebCore::Document::childTypeAllowed):
+        (WebCore::Document::canReplaceChild):
+        * dom/Node.cpp:
+        (WebCore::Node::dumpStatistics):
+        (WebCore::Node::isDefaultNamespace):
+        (WebCore::Node::lookupPrefix):
+        (WebCore::Node::lookupNamespaceURI):
+        (WebCore::appendTextContent):
+        (WebCore::Node::setTextContent):
+        * dom/Node.h:
+        * dom/Range.cpp:
+        (WebCore::lengthOfContentsInNode):
+        (WebCore::Range::processContentsBetweenOffsets):
+        (WebCore::Range::insertNode):
+        (WebCore::Range::checkNodeWOffset):
+        (WebCore::Range::checkNodeBA):
+        (WebCore::Range::selectNode):
+        (WebCore::Range::selectNodeContents):
+        (WebCore::Range::surroundContents):
+        * dom/ShadowRoot.cpp:
+        * dom/ShadowRoot.h:
+        (ShadowRoot):
+        (WebCore::toShadowRoot):
+        * editing/FrameSelection.cpp:
+        (WebCore::nodeIsDetachedFromDocument):
+        (WebCore):
+        (WebCore::FrameSelection::textWillBeReplaced):
+        * editing/MarkupAccumulator.cpp:
+        (WebCore::MarkupAccumulator::appendStartMarkup):
+        * html/parser/HTMLElementStack.cpp:
+        (WebCore::HTMLNames::isRootNode):
+        (WebCore::HTMLElementStack::pushRootNode):
+        * html/parser/HTMLElementStack.h:
+        (WebCore::isInHTMLNamespace):
+        * inspector/InspectorDOMAgent.cpp:
+        (WebCore::InspectorDOMAgent::pushChildNodesToFrontend):
+        (WebCore::InspectorDOMAgent::buildObjectForNode):
+        * xml/XPathUtil.cpp:
+        (WebCore::XPath::isValidContextNode):
+
+2012-02-13  Ojan Vafai  <ojan@chromium.org>
+
+        rtl + flex-direction:column is positioning elements incorrectly
+        https://bugs.webkit.org/show_bug.cgi?id=78555
+
+        Reviewed by Tony Chang.
+
+        Do the y-axis flipping after we have adjusted the y-position for
+        flex-align instead of before.
+
+        Tests: css3/flexbox/flex-align-baseline.html
+               css3/flexbox/flex-align-end.html
+
+        * rendering/RenderFlexibleBox.cpp:
+        (WebCore::RenderFlexibleBox::alignChildren):
+        The amount we adjust by also needs to be flipped for rtl+column,
+        so the flipping needs to be done after we align the flex items.
+
+2012-02-09  Ojan Vafai  <ojan@chromium.org>
+
+        nesting horizontal flexboxes is broken
+        https://bugs.webkit.org/show_bug.cgi?id=76867
+
+        Reviewed by David Hyatt.
+
+        This is copied from RenderDeprecatedFlexibleBox and updated
+        for RenderFlexibleBox and to handle vertical writing mode.
+
+        Tests: css3/flexbox/preferred-widths-orthogonal.html
+               css3/flexbox/preferred-widths.html
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::computePreferredLogicalWidths):
+        * rendering/RenderFlexibleBox.cpp:
+        (WebCore::marginWidthForChild):
+        (WebCore):
+        (WebCore::RenderFlexibleBox::computePreferredLogicalWidths):
+        * rendering/RenderFlexibleBox.h:
+        (RenderFlexibleBox):
+
+2012-02-13  Anders Carlsson  <andersca@apple.com>
+
+        The tile cache layer should have its background set to the page background
+        https://bugs.webkit.org/show_bug.cgi?id=78560
+        <rdar://problem/10857472>
+
+        Reviewed by Sam Weinig.
+
+        * page/FrameView.cpp:
+        (WebCore::FrameView::recalculateScrollbarOverlayStyle):
+        Inform the RenderLayerCompositor that the background color has changed.
+
+        * platform/graphics/ca/GraphicsLayerCA.cpp:
+        (WebCore::GraphicsLayerCA::updateLayerBackgroundColor):
+        For tile cache layers we don't need a separate contents layer for the background color so
+        just set the background color on the layer directly.
+
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::documentBackgroundColorDidChange):
+        If the root render layer is using a tile cache layer, update its background color.
+
+2012-02-13  Raul Hudea  <rhudea@adobe.com>
+
+        Implement Element.webkitRegionOverflow
+
+        [CSSRegions][CSSOM] Implement Element.regionOverflow
+        https://bugs.webkit.org/show_bug.cgi?id=77863
+
+        Reviewed by David Hyatt.
+
+        On each layout, compute the overflowState for each region belonging to the flow thread
+
+        Tests: fast/regions/element-region-overflow-state-vertical-rl.html
+               fast/regions/element-region-overflow-state.html
+
+        * dom/Element.cpp:
+        (WebCore::Element::webkitRegionOverflow):
+        (WebCore):
+        * dom/Element.h:
+        * dom/Element.idl:
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::computeOverflow):
+        * rendering/RenderFlowThread.cpp:
+        (WebCore::RenderFlowThread::computeOverflowStateForRegions):
+        (WebCore):
+        * rendering/RenderFlowThread.h:
+        * rendering/RenderRegion.cpp:
+        (WebCore::RenderRegion::RenderRegion):
+        * rendering/RenderRegion.h:
+        (RenderRegion):
+        (WebCore::RenderRegion::regionState):
+        (WebCore::RenderRegion::setRegionState):
+
+2012-02-13  Alexey Proskuryakov  <ap@apple.com>
+
+        File API IDLs are incorrect in Xcode project
+        https://bugs.webkit.org/show_bug.cgi?id=78551
+
+        Rubber-stamped by Dan Bernstein.
+
+        * WebCore.xcodeproj/project.pbxproj: Corrected paths, and added missing files.
+
+2012-02-13  Benjamin Poulain  <bpoulain@apple.com>
+
+        SharedBuffer::getSomeData() can potentially return a pointer past the data
+        https://bugs.webkit.org/show_bug.cgi?id=77799
+
+        Reviewed by David Kilzer.
+
+        The expected behavior from SharedBuffer::getSomeData() is to return a size and pointer of value 0
+        if position is past the data.
+
+        However, the code handling the memory mapped data is before the code ensuring the aforementioned
+        condition. It is possible to return a pointer past the data, and a non-null size.
+
+        This patch aims at preventing such invalid memory access by checking position is in the boundaries
+        before any attempt is made to return the data.
+
+        * platform/SharedBuffer.cpp:
+        (WebCore::SharedBuffer::getSomeData):
+
+2012-02-13  Benjamin Poulain  <bpoulain@apple.com>
+
+        SharedBuffer::getSomeData() must support m_dataArray if NETWORK_CFDATA_ARRAY_CALLBACK is defined
+        https://bugs.webkit.org/show_bug.cgi?id=77718
+
+        Reviewed by David Kilzer.
+
+        Previously, the last part of SharedBuffer::getSomeData() was systematically accessing
+        the data from the segments. When NETWORK_CFDATA_ARRAY_CALLBACK is defined, there can
+        be data in m_dataArray past the segment.
+
+        The previous code was making invalid memory access pass the segment vector. This patch
+        adds support for getting the data out of m_dataArray to make SharedBuffer::getSomeData()
+        works with NETWORK_CFDATA_ARRAY_CALLBACK.
+
+        This is covered by existing tests when NETWORK_CFDATA_ARRAY_CALLBACK is defined.
+        The test 'fast/events/constructors/track-event-constructor.html' is a reliable test
+        for this.
+
+        * platform/SharedBuffer.cpp:
+        (WebCore::SharedBuffer::getSomeData):
+        * platform/SharedBuffer.h:
+        (SharedBuffer):
+        * platform/cf/SharedBufferCF.cpp:
+        (WebCore):
+        (WebCore::SharedBuffer::copySomeDataFromDataArray):
+
+2012-02-13  Anders Carlsson  <andersca@apple.com>
+
+        Force slow-scrolling mode when there are position:fixed elements on a page
+        https://bugs.webkit.org/show_bug.cgi?id=78553
+        <rdar://problem/10247934>
+
+        Reviewed by Dan Bernstein.
+
+        Eventually, the scrolling tree will know about fixed positioning layers so their position can be updated
+        when the scroll layer position is updated. For now we'll take the simple route however.
+
+        * page/FrameView.cpp:
+        (WebCore::FrameView::addFixedObject):
+        (WebCore::FrameView::removeFixedObject):
+        Inform the scrolling coordinator when the number of fixed objects changes between 0 and 1.
+
+        * page/FrameView.h:
+        (WebCore::FrameView::hasFixedObjects):
+        Make this public.
+
+        * page/scrolling/ScrollingCoordinator.cpp:
+        (WebCore::ScrollingCoordinator::frameViewHasSlowRepaintObjectsDidChange):
+        Call updateShouldUpdateScrollLayerPositionOnMainThread.
+
+        (WebCore::ScrollingCoordinator::frameViewHasFixedObjectsDidChange):
+        Call updateShouldUpdateScrollLayerPositionOnMainThread.
+
+        (WebCore::ScrollingCoordinator::updateMainFrameScrollPositionAndScrollLayerPosition):
+        Make sure to update compositing layers here. Normally, they will be updated by layout but doing a layout
+        here is too intrusive since it could potentially change the size of the page.
+
+        (WebCore::ScrollingCoordinator::updateShouldUpdateScrollLayerPositionOnMainThread):
+        If we have fixed objects or slow repaint objects we need to update the scroll layer position on the main thread.
+
+2012-02-13  Adrienne Walker  <enne@google.com>
+
+        [chromium] Use HashMap<..., OwnPtr<Tile>> for compositor tilemap
+        https://bugs.webkit.org/show_bug.cgi?id=74154
+
+        Reviewed by James Robinson.
+
+        Covered by the compositing/ layout tests.
+
+        * platform/graphics/chromium/TiledLayerChromium.cpp:
+        (WebCore::UpdatableTile::create):
+        (WebCore::UpdatableTile::UpdatableTile):
+        (WebCore::TiledLayerChromium::createTile):
+        * platform/graphics/chromium/cc/CCLayerTilingData.cpp:
+        (WebCore::CCLayerTilingData::addTile):
+        (WebCore::CCLayerTilingData::takeTile):
+        (WebCore::CCLayerTilingData::tileAt):
+        * platform/graphics/chromium/cc/CCLayerTilingData.h:
+        * platform/graphics/chromium/cc/CCTiledLayerImpl.cpp:
+        (WebCore::DrawableTile::create):
+        (WebCore::DrawableTile::DrawableTile):
+        (WebCore::CCTiledLayerImpl::createTile):
+
+2012-02-13  Kentaro Hara  <haraken@chromium.org>
+
+        Add [CustomToJSObject] to interfaces which have custom toJS() and toV8()
+        https://bugs.webkit.org/show_bug.cgi?id=78489
+
+        Reviewed by Adam Barth.
+
+        This is the final step to remove hard-coding from HasCustomToV8Implementation()
+        in CodeGeneratorV8.pm. This patch replaces [JSCustomToJS] with [CustomToJSObject]
+        for interfaces which have custom toJS() and custom toV8().
+
+        No tests. No change in behavior.
+
+        * bindings/scripts/CodeGeneratorJS.pm:
+        (GenerateHeader):
+        (GenerateImplementation):
+        * bindings/scripts/CodeGeneratorV8.pm:
+        (GenerateHeader):
+
+        * bindings/scripts/test/TestTypedArray.idl:
+        * css/CSSRule.idl:
+        * css/CSSValue.idl:
+        * css/StyleSheet.idl:
+        * dom/Document.idl:
+        * dom/Event.idl:
+        * dom/Node.idl:
+        * fileapi/Blob.idl:
+        * fileapi/Entry.idl:
+        * fileapi/EntrySync.idl:
+        * html/HTMLCollection.idl:
+        * html/ImageData.idl:
+        * html/canvas/ArrayBufferView.idl:
+        * html/canvas/DataView.idl:
+        * html/canvas/Float32Array.idl:
+        * html/canvas/Float64Array.idl:
+        * html/canvas/Int16Array.idl:
+        * html/canvas/Int32Array.idl:
+        * html/canvas/Int8Array.idl:
+        * html/canvas/Uint16Array.idl:
+        * html/canvas/Uint32Array.idl:
+        * html/canvas/Uint8Array.idl:
+        * html/canvas/Uint8ClampedArray.idl:
+        * storage/IDBAny.idl:
+        * storage/IDBKey.idl:
+        * svg/SVGPathSeg.idl:
+
+2012-02-13  Arun Patole  <bmf834@motorola.com>
+
+        Chrome crashes when attempting to add cue to track element
+        https://bugs.webkit.org/show_bug.cgi?id=77951
+
+        Reviewed by Eric Carlson.
+
+        Allocate text track's text track list of cues before using it.
+
+        * html/TextTrack.cpp:
+        (WebCore::TextTrack::cues):
+        (WebCore::TextTrack::addCue):
+        (WebCore::TextTrack::removeCue): return if text track list of cues is not allocated.
+        (WebCore::TextTrack::ensureTextTrackCueList):Added.
+        * html/TextTrack.h:
+        (TextTrack):
+
+2012-02-13  Andy Estes  <aestes@apple.com>
+
+        Fix the Windows build.
+
+        * platform/PlatformPasteboard.h:
+        (PlatformPasteboard):
+
+2012-02-13  Abhishek Arya  <inferno@chromium.org>
+
+        Crash with button in multi-column layout.
+        https://bugs.webkit.org/show_bug.cgi?id=78378
+
+        Reviewed by David Hyatt.
+
+        Button creates an anonymous wrapper and expects that new children
+        be added to its m_inner anonymous block. However, splitBlock code
+        incorrectly creates column blocks directly under the button.
+
+        Test: fast/multicol/span/split-flow-anonymous-wrapper-crash.html
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::containingColumnsBlock):
+        (WebCore::RenderBlock::columnsBlockForSpanningElement):
+
+2012-02-09  Ojan Vafai  <ojan@chromium.org>
+
+        nesting horizontal flexboxes is broken
+        https://bugs.webkit.org/show_bug.cgi?id=76867
+
+        Reviewed by David Hyatt.
+
+        This is copied from RenderDeprecatedFlexibleBox and updated
+        for RenderFlexibleBox and to handle vertical writing mode.
+
+        Tests: css3/flexbox/preferred-widths-orthogonal.html
+               css3/flexbox/preferred-widths.html
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::computePreferredLogicalWidths):
+        * rendering/RenderFlexibleBox.cpp:
+        (WebCore::marginWidthForChild):
+        (WebCore):
+        (WebCore::RenderFlexibleBox::computePreferredLogicalWidths):
+        * rendering/RenderFlexibleBox.h:
+        (RenderFlexibleBox):
+
+2012-02-13  Mihnea Ovidenie  <mihnea@adobe.com>
+
+        Crash in RenderFlowThread::setRegionBoxesRegionStyle
+        https://bugs.webkit.org/show_bug.cgi?id=78298
+
+        Reviewed by David Hyatt.
+
+        Test: fast/regions/set-box-style-in-region-crash.html
+
+        We have to make sure that anonymous block objects get their information in RenderFlowThread
+        removed properly.
+
+        * dom/Node.cpp:
+        (WebCore::Node::diff):
+        Correct a comment.
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::collapseAnonymousBoxChild):
+        Remove the information for anonymous block from render flow thread.
+        * rendering/RenderFlowThread.cpp:
+        (WebCore::RenderFlowThread::removeFlowChildInfo):
+        (WebCore):
+        (WebCore::RenderFlowThread::setRegionRangeForBox):
+        Do not set region range if the flow thread does not have regions.
+        * rendering/RenderFlowThread.h:
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::willBeDestroyed):
+        Add an assert to make sure that after we remove an object, there is no remaining info
+        in any render flow thread.
+
+2012-02-13  Tony Chang  <tony@chromium.org>
+
+        Unreviewed, rolling out r107582.
+        http://trac.webkit.org/changeset/107582
+        https://bugs.webkit.org/show_bug.cgi?id=78349
+
+        Broke three inspector interactive_ui_tests
+
+        * English.lproj/localizedStrings.js:
+        * inspector/front-end/DebuggerPresentationModel.js:
+        (WebInspector.DebuggerPresentationModel.prototype.uiSourceCodes):
+        * inspector/front-end/ScriptsNavigator.js:
+        (WebInspector.ScriptsNavigator.prototype._removeUISourceCode.get while):
+        (WebInspector.ScriptsNavigator.prototype._removeUISourceCode):
+        (WebInspector.ScriptsNavigator.prototype._showScriptFoldersSettingChanged):
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel.prototype._uiSourceCodeAdded):
+        (WebInspector.ScriptsPanel.prototype._updateExecutionLine):
+        * inspector/front-end/Settings.js:
+        (WebInspector.ExperimentsSettings):
+        * inspector/front-end/SettingsScreen.js:
+        (WebInspector.SettingsScreen):
+
+2012-02-13  Abhishek Arya  <inferno@chromium.org>
+
+        Incorrect children placement in multi-column layout.
+        https://bugs.webkit.org/show_bug.cgi?id=78160
+
+        Reviewed by David Hyatt.
+
+        Test: fast/multicol/span/clone-before-after-content-crash.html
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::clone): no longer need to take care of making
+        children noninline (remove fix r105769) since moveChild functions take
+        care of adding the child properly if type of children differ. this
+        function just makes sure to set the right value of childrenInline property.
+        (WebCore::RenderBlock::splitBlocks): similar to moveChild functions below.
+        (WebCore::RenderBlock::moveChildTo): when child is fullRemoveInsert (across
+        different parents, e.g clones), we should use addChild function to make sure
+        it handles the case of different type of children between fromBlock and
+        toBlock correctly (specifically making children non-inline/wrapping inline
+        children under anonymous blocks.).
+        (WebCore::RenderBlock::moveChildrenTo):
+        * rendering/RenderBlock.h:
+        (RenderBlock):
+        (WebCore::RenderBlock::moveAllChildrenTo): Rename to->toBlock.
+        (WebCore::RenderBlock::moveChildrenTo): Rename to->toBlock.
+
+2012-02-13  Stephen White  <senorblanco@chromium.org>
+
+        [chromium] Implement Brightness and Contrast filters on composited
+        layers.  Fix Saturation filter.
+        https://bugs.webkit.org/show_bug.cgi?id=78527
+
+        Reviewed by Kenneth Russell.
+
+        Will be covered by existing tests in css3/filters, when enabled.
+
+        * platform/graphics/chromium/cc/CCRenderSurfaceFilters.cpp:
+        (WebCore::CCRenderSurfaceFilters::apply):
+
+2012-02-13  Anders Carlsson  <andersca@apple.com>
+
+        Turn off edge antialiasing for tile cache tile layers
+        https://bugs.webkit.org/show_bug.cgi?id=78533
+        <rdar://problem/10710798>
+
+        Reviewed by Sam Weinig.
+
+        * platform/graphics/ca/mac/TileCache.mm:
+        (WebCore::TileCache::createTileLayer):
+
+2012-02-13  Enrica Casucci  <enrica@apple.com>
+
+        Build fix. Unreviewed.
+
+        * WebCore.xcodeproj/project.pbxproj:
+
+2012-02-13  Brady Eidson  <beidson@apple.com>
+
+        <rdar://problem/7196487> and https://bugs.webkit.org/show_bug.cgi?id=26777
+        Add https pages to the page cache in some cases
+
+        Reviewed by Anders Carlsson.
+
+        Test: http/tests/navigation/https-in-page-cache.html
+
+        * history/PageCache.cpp:
+        (WebCore::PageCache::canCachePageContainingThisFrame): Allow HTTPS pages that do not specify cache-control: no-cache
+          or cache-control: no-store into the page cache. This will match Firefox's behavior for HTTPS in their bfcache.
+
+2012-02-10  Enrica Casucci  <enrica@apple.com>
+
+        Refactor Mac platform implementation of the Pasteboard class to use Platform Strategies.
+        https://bugs.webkit.org/show_bug.cgi?id=78282
+
+        This patch removes any accesss to the NSPasteboard object from the Pasteboard class which
+        now makes use of a new pasteboardStrategy object that is implemented both in WebKit and
+        WebKit2. The actual access to NSPasteboard is now performed inside the PlatformPasteboard
+        class. Currently both WebKit and WebKit2 use the same implementation of the PasteboardStrategy
+        interface but this one more step in the direction of removing access to NSPasteboard from
+        the WebProcess.
+        As part of the refactoring the I've reduced to a minimum the use of OBJ-C classes.
+
+        Reviewed by Anders Carlsson.
+
+        No new tests. No change in behavior, just code refactoring.
+
+        * WebCore.exp.in: Added exported class PlatformPasteboard.
+        * WebCore.xcodeproj/project.pbxproj: Added new files to the build.
+        * editing/mac/EditorMac.mm:
+        (WebCore::Editor::writeSelectionToPasteboard): New method signature that doesn't use OBJ-C types.
+        * platform/Pasteboard.h:
+
+        * platform/PasteboardStrategy.h: Added PasteboardStrategy abstract class.
+        * platform/PlatformPasteboard.h: Added. This class implements access to NSPasteboard.
+        * platform/PlatformStrategies.h:
+        (WebCore::PlatformStrategies::pasteboardStrategy): Added.
+        * platform/mac/DragDataMac.mm:
+        (WebCore::DragData::canSmartReplace):
+        (WebCore::insertablePasteboardTypes): 
+        (WebCore::DragData::asURL):
+        * platform/mac/PasteboardMac.mm:
+        (WebCore::selectionPasteboardTypes): Changed to use Vector<String> instead of NSArray.
+        (WebCore::writableTypesForURL): Ditto.
+        (WebCore::createWritableTypesForImage): Ditto.
+        (WebCore::writableTypesForImage): Ditto.
+        (WebCore::Pasteboard::Pasteboard): Removed access to NSPasteboard.
+        (WebCore::Pasteboard::clear): Modified to use platformStrategies()->pasteboardStrategy().
+        (WebCore::Pasteboard::writeSelectionForTypes): Ditto.
+        (WebCore::Pasteboard::writePlainText): Ditto.
+        (WebCore::Pasteboard::writeSelection): Ditto.
+        (WebCore::writeURLForTypes): Ditto.
+        (WebCore::Pasteboard::writeURL): Ditto.
+        (WebCore::writeFileWrapperAsRTFDAttachment): Ditto.
+        (WebCore::Pasteboard::writeImage): Ditto.
+        (WebCore::Pasteboard::writeClipboard): Ditto.
+        (WebCore::Pasteboard::canSmartReplace): Ditto.
+        (WebCore::Pasteboard::plainText): Ditto.
+        (WebCore::documentFragmentWithRTF): Ditto.
+        (WebCore::Pasteboard::documentFragment): Ditto.
+        * platform/mac/PlatformPasteboardMac.mm: Added.
+        (WebCore::PlatformPasteboard::PlatformPasteboard):
+        (WebCore::PlatformPasteboard::getTypes):
+        (WebCore::PlatformPasteboard::bufferForType):
+        (WebCore::PlatformPasteboard::getPathnamesForType):
+        (WebCore::PlatformPasteboard::stringForType):
+        (WebCore::PlatformPasteboard::copy):
+        (WebCore::PlatformPasteboard::setTypes):
+        (WebCore::PlatformPasteboard::setBufferForType):
+        (WebCore::PlatformPasteboard::setPathnamesForType):
+        (WebCore::PlatformPasteboard::setStringForType):
+
+2012-02-13  Raul Hudea  <rhudea@adobe.com>
+
+        [CSS Regions] Inconsistent text selection behavior in regions
+        https://bugs.webkit.org/show_bug.cgi?id=76456
+
+        Reviewed by David Hyatt.
+
+        Use the proper bounding rect when doing hit testing on flow threads.
+        Based on initial patch by Alexandru Chiculita.
+
+        Test: fast/regions/hit-test-region.html
+
+        * rendering/RenderFlowThread.cpp:
+        (WebCore::RenderFlowThread::hitTestRegion):
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::hitTest):
+        * rendering/RenderRegion.cpp:
+        (WebCore::RenderRegion::nodeAtPoint):
+
+2012-02-12  Andy Estes  <aestes@apple.com>
+
+        [Windows] Add API to enable inverted color drawing on a WebView
+        https://bugs.webkit.org/show_bug.cgi?id=77382
+
+        Reviewed by Adam Roben.
+
+        Implement CACFLayerTreeHost::setShouldInvertColors(), which instructs
+        the layer tree host to render composited content with inverted colors.
+
+        Test: platform/win/inverted-colors/non-composited.html
+
+        * platform/graphics/ca/win/CACFLayerTreeHost.cpp:
+        (WebCore::CACFLayerTreeHost::setShouldInvertColors):
+        (WebCore):
+        * platform/graphics/ca/win/CACFLayerTreeHost.h:
+        (CACFLayerTreeHost):
+        * platform/graphics/ca/win/WKCACFViewLayerTreeHost.cpp: Use
+        SOFT_LINK_OPTIONAL since WKCACFViewSetShouldInvertColors might not
+        exist in older versions of WebKitQuartzCoreAdditions.
+        (WebCore::WKCACFViewLayerTreeHost::setShouldInvertColors):
+        (WebCore):
+        * platform/graphics/ca/win/WKCACFViewLayerTreeHost.h:
+        (WKCACFViewLayerTreeHost):
+
+2012-02-13  Anders Carlsson  <andersca@apple.com>
+
+        The scrolling tree needs to know about the back forward state of the page
+        https://bugs.webkit.org/show_bug.cgi?id=78523
+        <rdar://problem/10756548>
+
+        Reviewed by Sam Weinig.
+
+        In order to know if a page should rubber-band in the horizontal direction, the scrolling tree
+        needs to know about the back/forward state of the page.
+
+        * WebCore.exp.in:
+        Export new symbols.
+
+        * WebCore.xcodeproj/project.pbxproj:
+        * page/scrolling/ScrollingTree.cpp:
+        (WebCore::ScrollingTree::ScrollingTree):
+        Initialize m_canGoBack and m_canGoForward.
+
+        (WebCore::ScrollingTree::updateBackForwardState):
+        Update m_canGoBack and m_canGoForward.
+
+        * page/scrolling/ScrollingTree.h:
+        (WebCore::ScrollingTree::canGoBack):
+        (WebCore::ScrollingTree::canGoForward):
+        Add getters.
+
+        * page/scrolling/mac/ScrollingTreeNodeMac.mm:
+        (WebCore::ScrollingTreeNodeMac::shouldRubberBandInDirection):
+        Implement this, using canGoBack and canGoForward.
+
+2012-02-13  Brady Eidson  <beidson@apple.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=78520
+        Cleanup PageCache::canCachePageContainingThisFrame readability
+
+        Reviewed by Anders Carlsson.
+
+        No new tests. (Code cleanup, no change in behavior)
+
+        * history/PageCache.cpp:
+        (WebCore::PageCache::canCachePageContainingThisFrame): Store three commonly
+          getter-accessed variables in local variables for readability.
+
+2012-02-13  Timothy Hatcher  <timothy@apple.com>
+
+        Don't include a separator before the "Inspect Element" context menu item when the context menu is empty.
+
+        https://webkit.org/b/78312
+
+        Reviewed by Brian Weinstein.
+
+        * page/ContextMenuController.cpp:
+        (WebCore::ContextMenuController::addInspectElementItem): Check itemCount before appending the separator.
+        * platform/gtk/ContextMenuGtk.cpp:
+        (WebCore::ContextMenu::itemCount): Added. Implement so this builds on GTK.
+
+2012-02-13  Patrick Gansterer  <paroga@webkit.org>
+
+        [WIN] Define HWND_MESSAGE if not done already
+        https://bugs.webkit.org/show_bug.cgi?id=78341
+
+        Reviewed by Adam Roben.
+
+        HWND_MESSAGE is not defined on WinCE.
+        Set it to 0 when not defined to avoid #ifdefs.
+
+        * platform/win/PasteboardWin.cpp:
+        (WebCore::Pasteboard::Pasteboard):
+        * platform/win/WindowsExtras.h:
+        (WebCore):
+
+2012-02-13  Chris Fleizach  <cfleizach@apple.com>
+
+        AX: <mark> element should be exposed through attributes
+        https://bugs.webkit.org/show_bug.cgi?id=75727
+
+        Reviewed by Beth Dakin.
+
+        Exposes an attribute indicating that an element has highlighting through attributedStringForRange.
+        Also allows the search mechanism to find elements with this style.
+
+        Test: platform/mac/accessibility/attributed-string-includes-highlighting.html
+
+        * accessibility/AccessibilityObject.cpp:
+        (WebCore::AccessibilityObject::isAccessibilityObjectSearchMatch):
+        (WebCore::AccessibilityObject::hasHighlighting):
+        * accessibility/AccessibilityObject.h:
+        * accessibility/mac/WebAccessibilityObjectWrapper.mm:
+        (createAccessibilitySearchKeyMap):
+        (AXAttributeStringSetStyle):
+
+2012-02-13  Chris Fleizach  <cfleizach@apple.com>
+
+        AX: the web area should report that focus can be set to itself
+        https://bugs.webkit.org/show_bug.cgi?id=78272
+
+        Reviewed by Beth Dakin.
+
+        Test: platform/mac/accessibility/webarea-can-set-focus.html
+
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::canSetFocusAttribute):
+        * accessibility/AccessibilityTable.cpp:
+        (WebCore::AccessibilityTable::isDataTable):
+           Fixed erroneous comment.
+
+2012-02-13  Patrick Gansterer  <paroga@webkit.org>
+
+        Port RunLoop to WinCE
+        https://bugs.webkit.org/show_bug.cgi?id=76781
+
+        Reviewed by Adam Roben.
+
+        * platform/win/RunLoopWin.cpp:
+        (WebCore::RunLoop::registerRunLoopMessageWindowClass):
+
+2012-02-10  Vsevolod Vlasov  <vsevik@chromium.org>
+
+        Web Inspector: Make ScriptsNavigator default file selector.
+        https://bugs.webkit.org/show_bug.cgi?id=78349
+
+        Reviewed by Pavel Feldman.
+
+        Moved ScriptsNavigator out of experiments.
+        Introduced new setting "useScriptsNavigator" with true as default value.
+        Updated scripts panel tests related to file selector.
+
+        Tests: inspector/debugger/scripts-combobox-file-selector-history.html
+               inspector/debugger/scripts-file-selector.html
+
+        * English.lproj/localizedStrings.js:
+        * inspector/front-end/DebuggerPresentationModel.js:
+        (WebInspector.DebuggerPresentationModel.prototype.uiSourceCodes):
+        * inspector/front-end/ScriptsNavigator.js:
+        (WebInspector.ScriptsNavigator.prototype._removeUISourceCode):
+        (WebInspector.ScriptsNavigator.prototype._showScriptFoldersSettingChanged):
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel.prototype._uiSourceCodeAdded):
+        (WebInspector.ScriptsPanel.prototype._addUISourceCode):
+        (WebInspector.ScriptsPanel.prototype._updateExecutionLine):
+        * inspector/front-end/Settings.js:
+        (WebInspector.ExperimentsSettings):
+        * inspector/front-end/SettingsScreen.js:
+        (WebInspector.SettingsScreen):
+
+2012-02-13  Andreas Kling  <awesomekling@apple.com>
+
+        Make HTMLTableCaptionElement inherit from HTMLElement.
+        <http://webkit.org/b/78505>
+
+        Reviewed by Antti Koivisto.
+
+        HTMLTableCaptionElement was already bypassing its base class (HTMLTablePartElement)
+        and calling up to HTMLElement in all its overrides. Just make it an HTMLElement
+        instead since it doesn't use anything from HTMLTablePartElement.
+        Remove parseAttribute() overload since it's no longer needed.
+
+        * html/HTMLTableCaptionElement.cpp:
+        (WebCore::HTMLTableCaptionElement::HTMLTableCaptionElement):
+        (WebCore::HTMLTableCaptionElement::isPresentationAttribute):
+        (WebCore::HTMLTableCaptionElement::collectStyleForAttribute):
+        * html/HTMLTableCaptionElement.h:
+
+2012-02-13  Andreas Kling  <awesomekling@apple.com>
+
+        HTMLMarqueeElement: Don't cache presence of truespeed attribute.
+        <http://webkit.org/b/78483>
+
+        Reviewed by Antti Koivisto.
+
+        Out-of-line minimumDelay() and look up the "truespeed" attribute there instead
+        of caching the minimum delay in parseAttribute().
+        Remove HTMLMarqueeElement::parseAttribute() as it's no longer needed.
+
+        * html/HTMLMarqueeElement.cpp:
+        (WebCore::HTMLMarqueeElement::HTMLMarqueeElement):
+        (WebCore::HTMLMarqueeElement::minimumDelay):
+        * html/HTMLMarqueeElement.h:
+        (HTMLMarqueeElement):
+
+2012-02-13  Andrey Kosyakov  <caseq@chromium.org>
+
+        Web Inspector: [refactoring] factor common timeline UI state into TimelinePresentationModel
+        https://bugs.webkit.org/show_bug.cgi?id=78501
+
+        Reviewed by Pavel Feldman.
+
+        * inspector/front-end/TimelineOverviewPane.js:
+        (WebInspector.TimelineOverviewPane):
+        (WebInspector.TimelineOverviewPane.prototype._onCategoryVisibilityChanged):
+        (WebInspector.TimelineOverviewPane.prototype.update):
+        (WebInspector.TimelineOverviewPane.prototype.sidebarResized):
+        (WebInspector.TimelineOverviewPane.prototype._setWindowPosition):
+        (WebInspector.TimelineOverviewPane.prototype.scrollWindow):
+        * inspector/front-end/TimelinePanel.js:
+        (WebInspector.TimelinePanel):
+        (WebInspector.TimelinePanel.prototype._createTopPane):
+        (WebInspector.TimelinePanel.prototype.get statusBarItems):
+        (WebInspector.TimelinePanel.prototype.get _recordStyles):
+        (WebInspector.TimelinePanel.prototype._createStatusbarButtons):
+        (WebInspector.TimelinePanel.prototype._createTimelineCategoryStatusBarCheckbox):
+        (WebInspector.TimelinePanel.prototype._onCategoryCheckboxClicked):
+        (WebInspector.TimelinePanel.prototype._innerAddRecordToTimeline):
+        (WebInspector.TimelinePanel.prototype.sidebarResized):
+        (WebInspector.TimelinePanel.prototype._updateBoundaries):
+        (WebInspector.TimelinePanel.prototype._showPopover):
+        (WebInspector.TimelinePresentationModel):
+        (WebInspector.TimelinePresentationModel.prototype.get categories):
+        (WebInspector.TimelinePresentationModel.prototype.addCategory):
+        (WebInspector.TimelinePresentationModel.prototype.setWindowPosition):
+        (WebInspector.TimelinePresentationModel.prototype.setCategoryVisibility):
+
+2012-02-13  Joel Webber  <jgw@google.com>
+
+        Use requestAnimationFrame callbacks to pump CSS animations
+        https://bugs.webkit.org/show_bug.cgi?id=64591
+
+        Reviewed by James Robinson.
+
+        No new tests needed (covered by tests in animations/*).
+
+        * page/FrameView.cpp:
+        (WebCore::FrameView::serviceScriptedAnimations):
+        * page/animation/AnimationController.cpp:
+        (WebCore::AnimationControllerPrivate::updateAnimations):
+        (WebCore::AnimationControllerPrivate::updateAnimationTimer):
+        (WebCore::AnimationControllerPrivate::fireEventsAndUpdateStyle):
+        (WebCore::AnimationControllerPrivate::animationFrameCallbackFired):
+        (WebCore::AnimationController::updateAnimations):
+        (WebCore::AnimationController::serviceAnimations):
+        * page/animation/AnimationController.h:
+        * page/animation/AnimationControllerPrivate.h:
+
+2012-02-13  Patrick Gansterer  <paroga@webkit.org>
+
+        Add WindowsExtras.h
+        https://bugs.webkit.org/show_bug.cgi?id=78340
+
+        Reviewed by Adam Roben.
+
+        Add a new file to share common code for Win32/WinCE differences.
+
+        * platform/win/PopupMenuWin.cpp:
+        (WebCore::PopupMenuWin::PopupMenuWndProc):
+        * platform/win/RunLoopWin.cpp:
+        (WebCore::RunLoop::RunLoopWndProc):
+        * platform/win/WindowsExtras.h: Added.
+        (WebCore):
+        (WebCore::getWindowPointer):
+        (WebCore::setWindowPointer):
+
+2012-02-13  Andreas Kling  <awesomekling@apple.com>
+
+        Don't mark element for style recalc when modifying its attribute style.
+        <http://webkit.org/b/78497>
+
+        Reviewed by Antti Koivisto.
+
+        StylePropertySet::setNeedsStyleRecalc() shouldn't do anything for attribute styles.
+        Their invalidation is handled exclusively by StyledElement::attributeChanged().
+        Elements with presentation attributes were being marked for style recalc twice,
+        once when the attribute changed, and again during attribute style update, below the
+        call to collectStyleForAttribute().
+
+        * css/StylePropertySet.cpp:
+        (WebCore::StylePropertySet::setNeedsStyleRecalc):
+
+2012-02-13  Caio Marcelo de Oliveira Filho  <caio.oliveira@openbossa.org>
+
+        Move attribute storage from NamedNodeMap to ElementAttributeData
+        https://bugs.webkit.org/show_bug.cgi?id=77674
+
+        Reviewed by Andreas Kling.
+
+        Move m_attributes vector from NamedNodeMap to ElementAttributeData. Make the
+        remaining callsites interact with ElementAttributeData if possible. The parsing
+        code is still interacting with NamedNodeMap, so some functions remained as
+        wrappers there. A next change will it use ElementAttributeData instead.
+
+        The code for DOM exported functions remained in NamedNodeMap. This implementation
+        should move to Element in a next change, too.
+
+        * dom/Attr.h:
+        (Attr):
+        * dom/Element.cpp:
+        (WebCore::Element::setAttribute):
+        (WebCore::Element::setAttributeInternal):
+        (WebCore::Element::parserSetAttributeMap):
+        (WebCore::Element::removeAttribute):
+        (WebCore::Element::hasAttribute):
+        (WebCore::Element::hasAttributeNS):
+        (WebCore::Element::normalizeAttributes):
+        * dom/Element.h:
+        (Element):
+        (WebCore::Element::ensureUpdatedAttributes):
+        (WebCore::Element::ensureAttributeData):
+        (WebCore):
+        (WebCore::Element::updatedAttributeData):
+        (WebCore::Element::ensureUpdatedAttributeData):
+        These *AttributeData functions are the correct correct way for callers to touch
+        the details of attribute storage. The "updated" variants will update invalid
+        attributes before return.
+
+        (WebCore::Element::setAttributesFromElement):
+        * dom/ElementAttributeData.cpp:
+        (WebCore::ElementAttributeData::~ElementAttributeData):
+        (WebCore):
+        (WebCore::ElementAttributeData::ensureInlineStyleDecl):
+        (WebCore::ElementAttributeData::addAttribute):
+        (WebCore::ElementAttributeData::removeAttribute):
+        (WebCore::ElementAttributeData::detachAttributesFromElement):
+        (WebCore::ElementAttributeData::copyAttributesToVector):
+        (WebCore::ElementAttributeData::getAttributeItemIndexSlowCase):
+        (WebCore::ElementAttributeData::setAttributes): Make use of the assumption that
+        this will only be called with a valid Element, since the only call site is an
+        Element method.
+        (WebCore::ElementAttributeData::clearAttributes):
+        (WebCore::ElementAttributeData::replaceAttribute): Make use of the assumption
+        this will only be called with a valid Element, since the only call site return
+        early if there's no Element.
+        * dom/ElementAttributeData.h:
+        (ElementAttributeData):
+        (WebCore::ElementAttributeData::length):
+        (WebCore::ElementAttributeData::isEmpty):
+        (WebCore::ElementAttributeData::attributeItem):
+        (WebCore::ElementAttributeData::removeAttribute):
+        (WebCore):
+        (WebCore::ElementAttributeData::getAttributeItem):
+        (WebCore::ElementAttributeData::getAttributeItemIndex):
+        * dom/NamedNodeMap.cpp:
+        (WebCore::NamedNodeMap::getNamedItem):
+        (WebCore::NamedNodeMap::removeNamedItem):
+        (WebCore::NamedNodeMap::setNamedItem):
+        (WebCore::NamedNodeMap::item):
+        (WebCore::NamedNodeMap::detachFromElement):
+        * dom/NamedNodeMap.h:
+        (WebCore::NamedNodeMap::length):
+        (WebCore::NamedNodeMap::isEmpty):
+        (WebCore::NamedNodeMap::attributeItem):
+        (WebCore::NamedNodeMap::getAttributeItem):
+        (WebCore::NamedNodeMap::getAttributeItemIndex):
+        (WebCore::NamedNodeMap::shrinkToLength):
+        (WebCore::NamedNodeMap::reserveInitialCapacity):
+        (WebCore::NamedNodeMap::addAttribute):
+        (WebCore::NamedNodeMap::removeAttribute):
+        (NamedNodeMap):
+        * dom/StyledElement.cpp:
+        (WebCore::StyledElement::updateAttributeStyle):
+        * dom/StyledElement.h:
+        (WebCore::StyledElement::ensureInlineStyleDecl):
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::updateType):
+        * svg/properties/SVGAnimatedPropertySynchronizer.h:
+        * xml/parser/XMLDocumentParserQt.cpp:
+        (WebCore::XMLDocumentParser::XMLDocumentParser):
+
+2012-02-13  Alexei Filippov  <alexeif@chromium.org>
+
+        Web Inspector: wrong percent calculations for empty snapshot.
+        https://bugs.webkit.org/show_bug.cgi?id=78329
+
+        Reviewed by Yury Semikhatsky.
+
+        * inspector/front-end/DetailedHeapshotGridNodes.js:
+        (WebInspector.HeapSnapshotGridNode.prototype._createValueCell):
+
+2012-02-13  Alexei Filippov  <alexeif@chromium.org>
+
+        Web Inspector: add class filter to heap profiler.
+        https://bugs.webkit.org/show_bug.cgi?id=78362
+
+        Reviewed by Yury Semikhatsky.
+
+        * inspector/front-end/DataGrid.js:
+        (WebInspector.DataGrid.prototype.insertChild):
+        * inspector/front-end/DetailedHeapshotView.js:
+        (WebInspector.HeapSnapshotSortableDataGrid.prototype._performSorting):
+        (WebInspector.HeapSnapshotConstructorsDataGrid):
+        (WebInspector.HeapSnapshotConstructorsDataGrid.prototype._nameFilterChanged):
+        (WebInspector.DetailedHeapshotView.prototype._changeNameFilter):
+        * inspector/front-end/heapProfiler.css:
+        (.detailed-heapshot-view .constructors-view-grid):
+        (.detailed-heapshot-view .constructors-view-toolbar):
+        (.detailed-heapshot-view .constructors-view-toolbar input.constructors-view-filter):
+
+2012-02-13  Peter Rybin  <peter.rybin@gmail.com>
+
+        Web Inspector: In Inspector.json PropertyDescriptor.writable should be declared optional
+        https://bugs.webkit.org/show_bug.cgi?id=77917
+
+        Reviewed by Pavel Feldman.
+
+        Property descriptor is fixed in Inspector.json. Also retroactively in
+        0.1 and 1.0.
+        Injected script in instructed to never return null property values.
+
+        * inspector/InjectedScriptSource.js:
+        (.):
+        * inspector/Inspector-0.1.json:
+        * inspector/Inspector-1.0.json:
+        * inspector/Inspector.json:
+
+2012-02-13  ChangSeok Oh  <shivamidow@gmail.com>
+
+        [GTK] Revise configuration for MHTML
+        https://bugs.webkit.org/show_bug.cgi?id=78364
+
+        Reviewed by Gustavo Noronha Silva.
+
+        Added mhtml directory and removed target files duplicated to build when enabling mhtml.
+        Archive.cpp, ArchiveFactory.cpp & their headers are included at the above line.
+        This duplication has caused build-break if mhtml is enabled.
+
+        No new tests, since no new features.
+
+        * GNUmakefile.am:
+        * GNUmakefile.list.am:
+
+2012-02-06  Raphael Kubo da Costa  <kubo@profusion.mobi>
+
+        [EFL] Drop support for the Curl network backend.
+        https://bugs.webkit.org/show_bug.cgi?id=77874
+
+        Reviewed by Eric Seidel.
+
+        Nobody seems to be maintaining the Curl backend in WebCore, the
+        EFL port developers all seem to be using the Soup backend and the
+        port itself has many features which are only implemented for the
+        latter.
+
+        No new tests, just some dependency plumbing.
+
+        * PlatformEfl.cmake: Build the glib/soup source files
+        unconditionally.
+        * platform/efl/FileSystemEfl.cpp: Remove ENABLE(GLIB_SUPPORT) check.
+
+2012-02-13  Pavel Feldman  <pfeldman@google.com>
+
+        Web Inspector: wrap settings selector text and adding a rule with undoable actions.
+        https://bugs.webkit.org/show_bug.cgi?id=78482
+
+        Reviewed by Yury Semikhatsky.
+
+        Tests: inspector/styles/undo-add-new-rule.html
+               inspector/styles/undo-set-selector-text.html
+
+        * inspector/InspectorCSSAgent.cpp:
+        (WebCore::InspectorCSSAgent::StyleSheetAction::StyleSheetAction):
+        (InspectorCSSAgent::StyleSheetAction):
+        (WebCore::InspectorCSSAgent::SetStyleSheetTextAction::SetStyleSheetTextAction):
+        (WebCore::InspectorCSSAgent::SetStyleSheetTextAction::perform):
+        (WebCore::InspectorCSSAgent::SetStyleSheetTextAction::undo):
+        (WebCore::InspectorCSSAgent::SetPropertyTextAction::SetPropertyTextAction):
+        (WebCore::InspectorCSSAgent::SetPropertyTextAction::perform):
+        (WebCore::InspectorCSSAgent::SetPropertyTextAction::undo):
+        (WebCore::InspectorCSSAgent::SetPropertyTextAction::mergeId):
+        (WebCore::InspectorCSSAgent::TogglePropertyAction::TogglePropertyAction):
+        (WebCore::InspectorCSSAgent::TogglePropertyAction::perform):
+        (WebCore::InspectorCSSAgent::TogglePropertyAction::undo):
+        (InspectorCSSAgent::SetRuleSelectorAction):
+        (WebCore::InspectorCSSAgent::SetRuleSelectorAction::SetRuleSelectorAction):
+        (WebCore::InspectorCSSAgent::SetRuleSelectorAction::perform):
+        (WebCore::InspectorCSSAgent::SetRuleSelectorAction::undo):
+        (WebCore):
+        (InspectorCSSAgent::AddRuleAction):
+        (WebCore::InspectorCSSAgent::AddRuleAction::AddRuleAction):
+        (WebCore::InspectorCSSAgent::AddRuleAction::perform):
+        (WebCore::InspectorCSSAgent::AddRuleAction::undo):
+        (WebCore::InspectorCSSAgent::AddRuleAction::newRuleId):
+        (WebCore::InspectorCSSAgent::setStyleSheetText):
+        (WebCore::InspectorCSSAgent::setPropertyText):
+        (WebCore::InspectorCSSAgent::toggleProperty):
+        (WebCore::InspectorCSSAgent::setRuleSelector):
+        (WebCore::InspectorCSSAgent::addRule):
+        (WebCore::InspectorCSSAgent::asInspectorStyleSheet):
+        (WebCore::InspectorCSSAgent::bindStyleSheet):
+        (WebCore::InspectorCSSAgent::viaInspectorStyleSheet):
+        (WebCore::InspectorCSSAgent::styleSheetChanged):
+        * inspector/InspectorCSSAgent.h:
+        (InspectorCSSAgent):
+        * inspector/InspectorStyleSheet.cpp:
+        (WebCore::InspectorStyleSheet::create):
+        (WebCore::InspectorStyleSheet::InspectorStyleSheet):
+        (WebCore::InspectorStyleSheet::reparseStyleSheet):
+        (WebCore::InspectorStyleSheet::ruleSelector):
+        (WebCore):
+        (WebCore::InspectorStyleSheet::setRuleSelector):
+        (WebCore::InspectorStyleSheet::addRule):
+        (WebCore::InspectorStyleSheet::deleteRule):
+        (WebCore::InspectorStyleSheet::setPropertyText):
+        (WebCore::InspectorStyleSheet::toggleProperty):
+        (WebCore::InspectorStyleSheet::fireStyleSheetChanged):
+        (WebCore::InspectorStyleSheetForInlineStyle::create):
+        (WebCore::InspectorStyleSheetForInlineStyle::InspectorStyleSheetForInlineStyle):
+        * inspector/InspectorStyleSheet.h:
+        (InspectorStyleSheet):
+        (WebCore::InspectorStyleSheet::styleId):
+        (InspectorStyleSheetForInlineStyle):
+
+2012-02-13  Hayato Ito  <hayato@chromium.org>
+
+        Rename names defined in ContentInclutionSelector to more intuitive names.
+        https://bugs.webkit.org/show_bug.cgi?id=78333
+
+        Reviewed by Hajime Morita.
+
+        This is just refactoring, renaming non-intuitive names to more intuitive names
+        so that they match the terms in the spec.
+
+        No tests. No change in behavior.
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * Target.pri:
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * dom/NodeRenderingContext.cpp:
+        (WebCore::NodeRenderingContext::NodeRenderingContext):
+        (WebCore::nextRendererOf):
+        (WebCore::previousRendererOf):
+        (WebCore::firstRendererOf):
+        (WebCore::lastRendererOf):
+        (WebCore::NodeRenderingContext::nextRenderer):
+        (WebCore::NodeRenderingContext::previousRenderer):
+        * dom/NodeRenderingContext.h:
+        (NodeRenderingContext):
+        (WebCore::NodeRenderingContext::insertionPoint):
+        * dom/ShadowRoot.cpp:
+        (WebCore::ShadowRoot::insertionPointFor):
+        (WebCore::ShadowRoot::isSelectorActive):
+        (WebCore::ShadowRoot::attach):
+        (WebCore::ShadowRoot::selector):
+        (WebCore::ShadowRoot::ensureSelector):
+        * dom/ShadowRoot.h:
+        (WebCore):
+        (ShadowRoot):
+        * html/shadow/ContentInclusionSelector.h: Removed.
+        * html/shadow/HTMLContentElement.cpp:
+        (WebCore::HTMLContentElement::HTMLContentElement):
+        (WebCore::HTMLContentElement::attach):
+        (WebCore::HTMLContentElement::detach):
+        * html/shadow/HTMLContentElement.h:
+        (WebCore):
+        (WebCore::HTMLContentElement::selections):
+        (WebCore::HTMLContentElement::hasSelection):
+        (HTMLContentElement):
+        * html/shadow/HTMLContentSelector.cpp: Renamed from Source/WebCore/html/shadow/ContentInclusionSelector.cpp.
+        (WebCore):
+        (WebCore::HTMLContentSeleciton::append):
+        (WebCore::HTMLContentSeleciton::unlink):
+        (WebCore::HTMLContentSelectionList::HTMLContentSelectionList):
+        (WebCore::HTMLContentSelectionList::~HTMLContentSelectionList):
+        (WebCore::HTMLContentSelectionList::find):
+        (WebCore::HTMLContentSelectionList::clear):
+        (WebCore::HTMLContentSelectionList::append):
+        (WebCore::HTMLContentSelector::HTMLContentSelector):
+        (WebCore::HTMLContentSelector::~HTMLContentSelector):
+        (WebCore::HTMLContentSelector::select):
+        (WebCore::HTMLContentSelector::unselect):
+        (WebCore::HTMLContentSelector::findFor):
+        (WebCore::HTMLContentSelector::didSelect):
+        (WebCore::HTMLContentSelector::willSelectOver):
+        * html/shadow/HTMLContentSelector.h: Added.
+        (WebCore):
+        (HTMLContentSeleciton):
+        (WebCore::HTMLContentSeleciton::insertionPoint):
+        (WebCore::HTMLContentSeleciton::node):
+        (WebCore::HTMLContentSeleciton::next):
+        (WebCore::HTMLContentSeleciton::previous):
+        (WebCore::HTMLContentSeleciton::HTMLContentSeleciton):
+        (WebCore::HTMLContentSeleciton::create):
+        (HTMLContentSelectionList):
+        (WebCore::HTMLContentSelectionList::first):
+        (WebCore::HTMLContentSelectionList::last):
+        (WebCore::HTMLContentSelectionList::isEmpty):
+        (HTMLContentSelectionSet):
+        (WebCore::HTMLContentSelectionSet::add):
+        (WebCore::HTMLContentSelectionSet::remove):
+        (WebCore::HTMLContentSelectionSet::isEmpty):
+        (Translator):
+        (WebCore::HTMLContentSelectionSet::Translator::hash):
+        (WebCore::HTMLContentSelectionSet::Translator::equal):
+        (WebCore::HTMLContentSelectionSet::Hash::hash):
+        (WebCore::HTMLContentSelectionSet::Hash::equal):
+        (Hash):
+        (WebCore::HTMLContentSelectionSet::find):
+        (HTMLContentSelector):
+        (WebCore::HTMLContentSelector::hasCandidates):
+        * testing/Internals.cpp:
+        (WebCore::Internals::includerFor):
+
+2012-02-13  No'am Rosenthal  <noam.rosenthal@nokia.com>
+
+        [Texmap] morphing-cubes animation appears too close when clicking the button
+        https://bugs.webkit.org/show_bug.cgi?id=78476
+
+        Fixed bug in TextureMapperAnimation that made transform animations that go to/from identity
+        to not work.
+
+        Reviewed by Simon Hausmann.
+
+        No behavior changes.
+
+        * platform/graphics/texmap/TextureMapperAnimation.cpp:
+        (WebCore::applyTransformAnimation):
+
+2012-02-13  Yosifumi Inoue  <yosin@chromium.org>
+
+        [Forms] Use enum instead of bool for HTMLInputElement::setValue
+        https://bugs.webkit.org/show_bug.cgi?id=75217
+
+        Reviewed by Kent Tamura.
+
+        Use TextFieldEventBehavior enum instead of sendChangeEvent bool
+        parameter for HTMLInputElement::setValue method. This new enum
+        parameter will be extended to dispatch input and change events
+        when user agent populates input field as specified in
+        "Common events behavior" of HTML5 standard.
+
+        This patch is required for fixing bug 75067 "[Forms] Spin buttons
+        of number input type should fire both input and change event."
+
+        No new tests. Existing tests cover this patch.
+
+        * html/BaseButtonInputType.cpp:
+        (WebCore::BaseButtonInputType::setValue):
+        * html/BaseButtonInputType.h:
+        * html/BaseCheckableInputType.cpp:
+        (WebCore::BaseCheckableInputType::setValue):
+        * html/BaseCheckableInputType.h:
+        * html/BaseDateAndTimeInputType.cpp:
+        (WebCore::BaseDateAndTimeInputType::setValueAsNumber):
+        * html/BaseDateAndTimeInputType.h:
+        * html/CheckboxInputType.cpp:
+        (WebCore::CheckboxInputType::willDispatchClick):
+        * html/ColorInputType.cpp:
+        (WebCore::ColorInputType::setValue):
+        * html/ColorInputType.h:
+        * html/FileInputType.cpp:
+        (WebCore::FileInputType::setValue):
+        * html/FileInputType.h:
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::applyStep):
+        (WebCore::HTMLInputElement::stepUp):
+        (WebCore::HTMLInputElement::stepDown):
+        (WebCore::HTMLInputElement::setChecked):
+        (WebCore::HTMLInputElement::setValueForUser):
+        (WebCore::HTMLInputElement::setValue):
+        (WebCore::HTMLInputElement::setValueInternal):
+        (WebCore::HTMLInputElement::setValueAsNumber):
+        (WebCore::HTMLInputElement::stepUpFromRenderer):
+        * html/HTMLInputElement.h:
+        * html/HTMLTextFormControlElement.h:
+        * html/HiddenInputType.cpp:
+        (WebCore::HiddenInputType::setValue):
+        * html/HiddenInputType.h:
+        * html/InputType.cpp:
+        (WebCore::InputType::setValueAsNumber):
+        (WebCore::InputType::setValue):
+        * html/InputType.h:
+        * html/NumberInputType.cpp:
+        (WebCore::NumberInputType::setValueAsNumber):
+        * html/NumberInputType.h:
+        * html/RadioInputType.cpp:
+        (WebCore::RadioInputType::willDispatchClick):
+        * html/RangeInputType.cpp:
+        (WebCore::RangeInputType::setValueAsNumber):
+        (WebCore::RangeInputType::handleKeydownEvent):
+        (WebCore::RangeInputType::setValue):
+        * html/RangeInputType.h:
+        * html/TextFieldInputType.cpp:
+        (WebCore::TextFieldInputType::setValue):
+        * html/TextFieldInputType.h:
+
+2012-02-13  Andreas Kling  <awesomekling@apple.com>
+
+        Move attribute style invalidation to attributeChanged().
+        <http://webkit.org/b/78461>
+
+        Reviewed by Antti Koivisto.
+
+        Moved attribute style invalidation out of the parseAttribute() overloads
+        and added an "isPresentationAttribute(Attribute*) virtual to StyledElement.
+        Returning true for a given Attribute will cause attribute style invalidation
+        when that attribute passes through attributeChanged().
+
+        Removed a couple of parseAttribute() overloads whose only remaining purpose
+        was invalidating attribute style.
+
+        For form elements that deliberately don't map the "align" attribute, added
+        short-circuits in isPresentationAttribute instead of falling back to the
+        respective base class (which may othweise then map "align")
+
+        * dom/StyledElement.cpp:
+        (WebCore::StyledElement::attributeChanged):
+        * dom/StyledElement.h:
+        (WebCore::StyledElement::isPresentationAttribute):
+        * html/HTMLBRElement.cpp:
+        (WebCore::HTMLBRElement::isPresentationAttribute):
+        * html/HTMLBRElement.h:
+        * html/HTMLBodyElement.cpp:
+        (WebCore::HTMLBodyElement::isPresentationAttribute):
+        (WebCore::HTMLBodyElement::collectStyleForAttribute):
+        (WebCore::HTMLBodyElement::parseAttribute):
+        * html/HTMLBodyElement.h:
+        * html/HTMLButtonElement.cpp:
+        (WebCore::HTMLButtonElement::isPresentationAttribute):
+        (WebCore::HTMLButtonElement::parseAttribute):
+        * html/HTMLButtonElement.h:
+        * html/HTMLDivElement.cpp:
+        (WebCore::HTMLDivElement::isPresentationAttribute):
+        * html/HTMLDivElement.h:
+        * html/HTMLElement.cpp:
+        (WebCore::HTMLElement::isPresentationAttribute):
+        (WebCore::HTMLElement::parseAttribute):
+        * html/HTMLElement.h:
+        * html/HTMLEmbedElement.cpp:
+        (WebCore::HTMLEmbedElement::isPresentationAttribute):
+        (WebCore::HTMLEmbedElement::parseAttribute):
+        * html/HTMLEmbedElement.h:
+        * html/HTMLFontElement.cpp:
+        (WebCore::HTMLFontElement::isPresentationAttribute):
+        * html/HTMLFontElement.h:
+        * html/HTMLFrameSetElement.cpp:
+        (WebCore::HTMLFrameSetElement::isPresentationAttribute):
+        (WebCore::HTMLFrameSetElement::parseAttribute):
+        * html/HTMLFrameSetElement.h:
+        * html/HTMLHRElement.cpp:
+        (WebCore::HTMLHRElement::isPresentationAttribute):
+        (WebCore::HTMLHRElement::collectStyleForAttribute):
+        * html/HTMLHRElement.h:
+        * html/HTMLIFrameElement.cpp:
+        (WebCore::HTMLIFrameElement::isPresentationAttribute):
+        (WebCore::HTMLIFrameElement::collectStyleForAttribute):
+        (WebCore::HTMLIFrameElement::parseAttribute):
+        * html/HTMLIFrameElement.h:
+        * html/HTMLImageElement.cpp:
+        (WebCore::HTMLImageElement::isPresentationAttribute):
+        (WebCore::HTMLImageElement::collectStyleForAttribute):
+        (WebCore::HTMLImageElement::parseAttribute):
+        * html/HTMLImageElement.h:
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::isPresentationAttribute):
+        (WebCore::HTMLInputElement::collectStyleForAttribute):
+        (WebCore::HTMLInputElement::parseAttribute):
+        * html/HTMLInputElement.h:
+        * html/HTMLLIElement.cpp:
+        (WebCore::HTMLLIElement::isPresentationAttribute):
+        (WebCore::HTMLLIElement::parseAttribute):
+        * html/HTMLLIElement.h:
+        * html/HTMLMarqueeElement.cpp:
+        (WebCore::HTMLMarqueeElement::isPresentationAttribute):
+        (WebCore::HTMLMarqueeElement::collectStyleForAttribute):
+        (WebCore::HTMLMarqueeElement::parseAttribute):
+        * html/HTMLMarqueeElement.h:
+        * html/HTMLOListElement.cpp:
+        (WebCore::HTMLOListElement::isPresentationAttribute):
+        (WebCore::HTMLOListElement::parseAttribute):
+        * html/HTMLOListElement.h:
+        * html/HTMLObjectElement.cpp:
+        (WebCore::HTMLObjectElement::isPresentationAttribute):
+        (WebCore::HTMLObjectElement::parseAttribute):
+        * html/HTMLObjectElement.h:
+        * html/HTMLParagraphElement.cpp:
+        (WebCore::HTMLParagraphElement::isPresentationAttribute):
+        * html/HTMLParagraphElement.h:
+        * html/HTMLPlugInElement.cpp:
+        (WebCore::HTMLPlugInElement::isPresentationAttribute):
+        (WebCore::HTMLPlugInElement::collectStyleForAttribute):
+        * html/HTMLPlugInElement.h:
+        * html/HTMLPreElement.cpp:
+        (WebCore::HTMLPreElement::isPresentationAttribute):
+        (WebCore::HTMLPreElement::collectStyleForAttribute):
+        * html/HTMLPreElement.h:
+        * html/HTMLSelectElement.cpp:
+        (WebCore::HTMLSelectElement::isPresentationAttribute):
+        (WebCore::HTMLSelectElement::parseAttribute):
+        * html/HTMLSelectElement.h:
+        * html/HTMLTableCaptionElement.cpp:
+        (WebCore::HTMLTableCaptionElement::isPresentationAttribute):
+        (WebCore::HTMLTableCaptionElement::parseAttribute):
+        * html/HTMLTableCaptionElement.h:
+        * html/HTMLTableCellElement.cpp:
+        (WebCore::HTMLTableCellElement::isPresentationAttribute):
+        (WebCore::HTMLTableCellElement::collectStyleForAttribute):
+        (WebCore::HTMLTableCellElement::parseAttribute):
+        * html/HTMLTableCellElement.h:
+        * html/HTMLTableColElement.cpp:
+        (WebCore::HTMLTableColElement::isPresentationAttribute):
+        (WebCore::HTMLTableColElement::parseAttribute):
+        * html/HTMLTableColElement.h:
+        * html/HTMLTableElement.cpp:
+        (WebCore::HTMLTableElement::isPresentationAttribute):
+        (WebCore::HTMLTableElement::parseAttribute):
+        * html/HTMLTableElement.h:
+        * html/HTMLTablePartElement.cpp:
+        (WebCore::HTMLTablePartElement::isPresentationAttribute):
+        (WebCore::HTMLTablePartElement::collectStyleForAttribute):
+        * html/HTMLTablePartElement.h:
+        * html/HTMLTextAreaElement.cpp:
+        (WebCore::HTMLTextAreaElement::isPresentationAttribute):
+        (WebCore::HTMLTextAreaElement::parseAttribute):
+        * html/HTMLTextAreaElement.h:
+        * html/HTMLUListElement.cpp:
+        (WebCore::HTMLUListElement::isPresentationAttribute):
+        (WebCore::HTMLUListElement::collectStyleForAttribute):
+        * html/HTMLUListElement.h:
+        * html/HTMLVideoElement.cpp:
+        (WebCore::HTMLVideoElement::isPresentationAttribute):
+        (WebCore::HTMLVideoElement::parseAttribute):
+        * html/HTMLVideoElement.h:
+        * mathml/MathMLElement.cpp:
+        (WebCore::MathMLElement::isPresentationAttribute):
+        (WebCore::MathMLElement::collectStyleForAttribute):
+        * mathml/MathMLElement.h:
+        * svg/SVGImageElement.cpp:
+        (WebCore::SVGImageElement::isPresentationAttribute):
+        (WebCore::SVGImageElement::parseAttribute):
+        * svg/SVGImageElement.h:
+        * svg/SVGStyledElement.cpp:
+        (WebCore::SVGStyledElement::isPresentationAttribute):
+        (WebCore::SVGStyledElement::parseAttribute):
+        * svg/SVGStyledElement.h:
+        * svg/SVGTextContentElement.cpp:
+        (WebCore::SVGTextContentElement::isPresentationAttribute):
+        (WebCore::SVGTextContentElement::parseAttribute):
+        * svg/SVGTextContentElement.h:
+
+2012-02-13  Kentaro Hara  <haraken@chromium.org>
+
+        Add [JSCustomToJSObject] IDL attribute to interfaces that have
+        custom toJS() but do not have custom toV8()
+        https://bugs.webkit.org/show_bug.cgi?id=78466
+
+        Reviewed by Adam Barth.
+
+        This is the second step to remove hard-coding in HasCustomToV8Implementation()
+        in CodeGeneratorV8.pm. This patch replaces [JSCustomToJS] with [JSCustomToJSObject]
+        for interfaces which have custom toJS() but do not have custom toV8().
+
+        No tests. No change in behavior.
+
+        * bindings/scripts/CodeGeneratorJS.pm:
+        (GenerateHeader):
+        (GenerateImplementation):
+        * bindings/scripts/CodeGeneratorV8.pm:
+        (HasCustomToV8Implementation): I found that AbstractWorker and CanvasRenderingContext
+        are the only IDL files to which I need to add [JSCustomToJSObject].
+        Other IDL files which had been listed here do not have [JSCustomToJS].
+        * html/canvas/CanvasRenderingContext.idl:
+        * workers/AbstractWorker.idl:
+
+2012-02-13  Andreas Kling  <awesomekling@apple.com>
+
+        Avoid unnecessary work when evaluating style sharing candidates.
+        <http://webkit.org/b/78220>
+
+        Reviewed by Antti Koivisto.
+
+        Do the cheap checks (bitfields, pointers) before calling virtuals and doing hash lookups.
+        Remove comparison of attributes that are reflected in the attribute styles (cellpadding.)
+        Moved comparison of "type" and "readonly" attributes into the more specific
+        canShareStyleWithControl() since they are only relevant for input elements. Don't bother
+        calling isFormControlElement() on both elements as they already have the same tagQName().
+
+        Altogether this knocks off ~8ms worth of samples per cycle of the "Moz" page cycler test.
+
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::canShareStyleWithControl):
+        (WebCore::CSSStyleSelector::canShareStyleWithElement):
+        (WebCore::isCommonAttributeSelectorAttribute):
+
+2012-02-13  Arko Saha  <arko@motorola.com>
+
+        <summary> is not keyboard accessible.
+        https://bugs.webkit.org/show_bug.cgi?id=75478
+
+        Reviewed by Hajime Morita.
+
+        Toggle the content of <details> element on pressing Enter or Spacebar
+        key on a focused <summary> element.
+
+        Test: fast/html/details-keyboard-show-hide.html
+
+        * html/HTMLSummaryElement.cpp:
+        (WebCore::HTMLSummaryElement::supportsFocus):
+        (WebCore):
+        (WebCore::HTMLSummaryElement::defaultEventHandler):
+        * html/HTMLSummaryElement.h:
+        (HTMLSummaryElement):
+
+2012-02-13  Gavin Barraclough  <barraclough@apple.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=78434
+        Unreviewed - temporarily reverting r107498 will I fix a couple of testcases.
+
+        * bindings/js/JSDOMWindowBase.cpp:
+        (WebCore):
+        * bindings/js/JSDOMWindowBase.h:
+        (JSDOMWindowBase):
+
+2012-02-13  Ilya Tikhonovsky  <loislo@chromium.org>
+
+        Web Inspector: get rid of cycles in containment view of an object.
+        https://bugs.webkit.org/show_bug.cgi?id=78462
+
+        Reviewed by Yury Semikhatsky.
+
+        * inspector/front-end/DetailedHeapshotGridNodes.js:
+        (WebInspector.HeapSnapshotObjectNode.prototype.updateHasChildren):
+        (WebInspector.HeapSnapshotObjectNode.prototype._prefixObjectCell):
+
+2012-02-12  Adam Barth  <abarth@webkit.org>
+
+        Remove ENABLE(MEDIA_STREAM) from Navigator.h
+        https://bugs.webkit.org/show_bug.cgi?id=78467
+
+        Reviewed by Kentaro Hara.
+
+        Navigator.webkitGetUser media doesn't really have anything to do with
+        Navigator.cpp.  This patch moves it into the mediastream directory and
+        removes the ENABLE(MEDIA_STREAM) ifdefs in Navigator.h and
+        Navigator.cpp.
+
+        * GNUmakefile.list.am:
+        * WebCore.gypi:
+        * mediastream/NavigatorMediaStream.cpp: Added.
+        (WebCore):
+        (WebCore::NavigatorMediaStream::NavigatorMediaStream):
+        (WebCore::NavigatorMediaStream::~NavigatorMediaStream):
+        (WebCore::NavigatorMediaStream::webkitGetUserMedia):
+        * mediastream/NavigatorMediaStream.h: Added.
+        (WebCore):
+        (NavigatorMediaStream):
+        * mediastream/NavigatorMediaStream.idl: Added.
+        * page/Navigator.cpp:
+        (WebCore):
+        * page/Navigator.h:
+        (WebCore):
+        (Navigator):
+        * page/Navigator.idl:
+
+2012-02-12  Adam Barth  <abarth@webkit.org>
+
+        Navigator.webkitGetUserMedia doesn't need to be custom
+        https://bugs.webkit.org/show_bug.cgi?id=78464
+
+        Reviewed by Eric Seidel.
+
+        The code generator has gotten smarter since this function was added.
+
+        * GNUmakefile.list.am:
+        * UseV8.cmake:
+        * WebCore.gypi:
+        * bindings/js/JSNavigatorCustom.cpp: Removed.
+        * bindings/v8/custom/V8NavigatorCustom.cpp: Removed.
+        * page/Navigator.idl:
+
+2012-02-12  Adam Barth  <abarth@webkit.org>
+
+        Move ENABLE(GAMEPAD) logic out of Navigator.h/cpp
+        https://bugs.webkit.org/show_bug.cgi?id=78457
+
+        Reviewed by Hajime Morita.
+
+        This patch moves GAMEPAD-specific logic out of Navigator by introducing
+        the concept of a NavigatorSupplement, analogous to the recently
+        introduced PageSupplement.
+
+        * Modules/gamepad/NavigatorGamepad.cpp:
+        (WebCore::NavigatorGamepad::from):
+        (WebCore):
+        (WebCore::NavigatorGamepad::webkitGamepads):
+        (WebCore::NavigatorGamepad::gamepads):
+        * Modules/gamepad/NavigatorGamepad.h:
+        (NavigatorGamepad):
+        * WebCore.gypi:
+        * dom/DeviceMotionController.cpp:
+        (WebCore::DeviceMotionController::supplementName):
+        * page/Navigator.cpp:
+        (WebCore::Navigator::provideSupplement):
+        (WebCore):
+        (WebCore::Navigator::requireSupplement):
+        * page/Navigator.h:
+        (Navigator):
+        * page/Page.h:
+        (Page):
+        * page/PageSupplement.h:
+            - This patch cleans up some nits in PageSupplement.
+        (WebCore):
+        (PageSupplement):
+
+2012-02-12  Kentaro Hara  <haraken@chromium.org>
+
+        Add a [V8CustomToJSObject] IDL attribute
+        https://bugs.webkit.org/show_bug.cgi?id=78450
+
+        Reviewed by Adam Barth.
+
+        This is the first step to remove hard-coding in HasCustomToV8Implementation()
+        in CodeGeneratorV8.pm. This patch adds [V8CustomToJSObject]
+        to interfaces which have custom toV8() but do not have custom toJS().
+
+        No tests. No change in behavior.
+
+        * bindings/scripts/CodeGeneratorV8.pm: Replaced hard-coding with [V8CustomToJSObject].
+        (HasCustomToV8Implementation):
+
+        * css/CSSStyleSheet.idl: Added [V8CustomToJSObject].
+        * dom/DOMStringMap.idl:
+        * dom/Element.idl:
+        * dom/NamedNodeMap.idl:
+        * html/DOMTokenList.idl:
+        * html/HTMLDocument.idl:
+        * html/HTMLElement.idl:
+        * html/canvas/CanvasPixelArray.idl:
+        * inspector/ScriptProfile.idl:
+        * inspector/ScriptProfileNode.idl:
+        * page/DOMWindow.idl:
+        * page/Location.idl:
+        * svg/SVGDocument.idl:
+        * svg/SVGElement.idl:
+        * workers/WorkerContext.idl:
+
+2012-02-12  David Barr  <davidbarr@chromium.org>
+
+        CSS3 currentColor on outline-color gets treated as inherit
+        https://bugs.webkit.org/show_bug.cgi?id=73180
+
+        Reviewed by Antti Koivisto.
+
+        The CSS2 and CSS3 UI modules state that outline-color
+        is not inherited. Make it so.
+        http://www.w3.org/TR/CSS2/ui.html#propdef-outline-color
+        http://www.w3.org/TR/css3-ui/#outline-color
+
+        Test: fast/css/outline-currentcolor.html
+
+        * css/CSSStyleApplyProperty.cpp:
+        (WebCore::CSSStyleApplyProperty::CSSStyleApplyProperty):
+
+2012-02-12  Antti Koivisto  <antti@apple.com>
+
+        CSSPageRule should inherit from CSSRule instead of CSSStyleRule
+        https://bugs.webkit.org/show_bug.cgi?id=78452
+
+        Reviewed by Anders Carlsson.
+
+        This matches CSSOM and eliminates the only subclass of CSSStyleRule, enabling further refactoring.
+
+        * css/CSSPageRule.cpp:
+        (WebCore::CSSPageRule::CSSPageRule):
+        (WebCore::CSSPageRule::~CSSPageRule):
+        (WebCore):
+        (WebCore::CSSPageRule::selectorText):
+        (WebCore::CSSPageRule::setSelectorText):
+        (WebCore::CSSPageRule::cssText):
+        * css/CSSPageRule.h:
+        (CSSPageRule):
+        (WebCore::CSSPageRule::style):
+        (WebCore::CSSPageRule::selector):
+        (WebCore::CSSPageRule::properties):
+        (WebCore::CSSPageRule::adoptSelectorVector):
+        (WebCore::CSSPageRule::setDeclaration):
+        * css/CSSRule.cpp:
+        (WebCore::CSSRule::cssText):
+        * css/CSSStyleRule.cpp:
+        (WebCore::CSSStyleRule::generateSelectorText):
+        * css/CSSStyleSelector.cpp:
+        (WebCore::RuleSet::pageRules):
+        (RuleSet):
+        (WebCore::RuleSet::addPageRule):
+        (WebCore::comparePageRules):
+        (WebCore::CSSStyleSelector::matchPageRules):
+        (WebCore::CSSStyleSelector::matchPageRulesForList):
+        * css/CSSStyleSelector.h:
+        (CSSStyleSelector):
+
+2012-02-12  Shinya Kawanaka  <shinyak@google.com>
+
+        Introduce ShadowRootList.
+        https://bugs.webkit.org/show_bug.cgi?id=78069
+
+        Reviewed by Hajime Morita.
+
+        This is a step to implement multiple shadow subtrees.
+
+        This patch introduces a shadow root list. ShadowRootList is a doubly linked list,
+        and each shadow root now has a younger shadow root and older shadow root,
+        which are a previous element and a next element respectively.
+        Since a visual tree traversal, which will be introduced in coming patches, will need a older shadow root,
+        we make a shadow root list a doubly linked list.
+
+        However, ShadowRootList does not have more than one shadow root now.
+        This will be changed in a series of coming patches.
+
+        Element::shadowRoot(), setShadowRoot(), ensureShadowRoot(), and removeShadowRoot() are
+        emulated using ShadowRootList for a while. These API will be replaced to ShadowRootList API later.
+
+        No new tests, no change in behavior.
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * Target.pri:
+        * WebCore.gypi:
+        * WebCore.xcodeproj/project.pbxproj:
+        * dom/DOMAllInOne.cpp:
+        * dom/Element.cpp:
+        (WebCore::Element::hasShadowRoot):
+          Retruns true if an element has a shadowRoot.
+        (WebCore::Element::shadowRootList):
+          Gets shadow root list if any.
+        (WebCore::Element::shadowRoot):
+          Gets the first shadow root from the shadow root list.
+        (WebCore::Element::setShadowRoot):
+          Sets the first shadow root to the shadow root list.
+        (WebCore::Element::removeShadowRoot):
+          Removes all the shadow roots in the shadow root list.
+        * dom/Element.h:
+        (WebCore):
+        (Element):
+        * dom/ElementRareData.h:
+        (ElementRareData):
+        (WebCore::ElementRareData::ElementRareData):
+          Has shadow root lists instead of shadow root.
+        (WebCore::ElementRareData::~ElementRareData):
+        * dom/ShadowRoot.cpp:
+        (WebCore::ShadowRoot::ShadowRoot):
+        (WebCore::ShadowRoot::~ShadowRoot):
+        * dom/ShadowRoot.h:
+        (ShadowRoot):
+        (WebCore::ShadowRoot::youngerShadowRoot):
+        (WebCore::ShadowRoot::olderShadowRoot):
+        * dom/ShadowRootList.cpp: Added.
+        (WebCore):
+        (WebCore::ShadowRootList::ShadowRootList):
+        (WebCore::ShadowRootList::~ShadowRootList):
+        (WebCore::ShadowRootList::pushShadowRoot):
+          Adds a shadow root into the list. Currently we limit the list can have only one shadow root.
+        (WebCore::ShadowRootList::popShadowRoot):
+          Removes and returns the youngest shadow root if any.
+        * dom/ShadowRootList.h: Added.
+        (WebCore):
+        (ShadowRootList):
+        (WebCore::ShadowRootList::hasShadowRoot):
+        (WebCore::ShadowRootList::youngestShadowRoot):
+        (WebCore::ShadowRootList::oldestShadowRoot):
+
+2012-02-12  Shinya Kawanaka  <shinyak@google.com>
+
+        INPUT shouldn't create ShadowRoot dynamically.
+        https://bugs.webkit.org/show_bug.cgi?id=77930
+
+        Reviewed by Dimitri Glazkov.
+
+        When input type is changed, ShadowRoot was being re-created. This makes it difficult to
+        support multiple shadow subtrees. This patch makes input re-use the existing shadow root
+        instead of re-creating a shaow root. A shadow root should be created when an element is created.
+
+        Since media control elements are implemented using input elements, these elements should also
+        create a shadow root in their construction phase.
+
+        Test: fast/dom/shadow/input-shadow-nochange.html
+        Tests related to media controls should be covered by existing tests.
+
+        * html/ColorInputType.cpp:
+        (WebCore::ColorInputType::createShadowSubtree):
+        * html/FileInputType.cpp:
+        (WebCore::FileInputType::createShadowSubtree):
+        (WebCore::FileInputType::multipleAttributeChanged):
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::createShadowSubtree):
+        * html/InputType.cpp:
+        (WebCore::InputType::destroyShadowSubtree):
+        * html/RangeInputType.cpp:
+        (WebCore::RangeInputType::createShadowSubtree):
+        * html/TextFieldInputType.cpp:
+        (WebCore::TextFieldInputType::createShadowSubtree):
+        * html/shadow/MediaControlElements.cpp:
+          Creates a shadow tree in the construction phase.
+        (WebCore::MediaControlPanelMuteButtonElement::create):
+        (WebCore::MediaControlVolumeSliderMuteButtonElement::create):
+        (WebCore::MediaControlPlayButtonElement::create):
+        (WebCore::MediaControlSeekForwardButtonElement::create):
+        (WebCore::MediaControlSeekBackButtonElement::create):
+        (WebCore::MediaControlRewindButtonElement::create):
+        (WebCore::MediaControlReturnToRealtimeButtonElement::create):
+        (WebCore::MediaControlToggleClosedCaptionsButtonElement::create):
+        (WebCore::MediaControlTimelineElement::create):
+        (WebCore::MediaControlVolumeSliderElement::create):
+        (WebCore::MediaControlFullscreenVolumeSliderElement::create):
+        (WebCore::MediaControlFullscreenButtonElement::create):
+        (WebCore::MediaControlFullscreenVolumeMinButtonElement::create):
+        (WebCore::MediaControlFullscreenVolumeMaxButtonElement::create):
+
+2012-02-12  Shinya Kawanaka  <shinyak@google.com>
+
+        SVGTRefElement shouldn't create a shadow root dynamically.
+        https://bugs.webkit.org/show_bug.cgi?id=77938
+
+        Reviewed by Hajime Morita.
+
+        SVGTRefElement creates a shadow root dynamically. This will cause a problem to support
+        multiple shadow subtrees. So it should be created in a constructor phase.
+
+        Test: svg/custom/tref-shadowdom.html
+
+        * svg/SVGTRefElement.cpp:
+        (WebCore::SVGTRefElement::create):
+        (WebCore::SVGTRefElement::createShadowSubtree):
+        (WebCore):
+        (WebCore::SVGTRefElement::updateReferencedText):
+        * svg/SVGTRefElement.h:
+        (SVGTRefElement):
+
+2012-02-12  Kentaro Hara  <haraken@chromium.org>
+
+        Unreviewed. Rebaselined run-bindings-tests results.
+
+        * bindings/scripts/test/JS/JSFloat64Array.cpp:
+        (WebCore):
+        * bindings/scripts/test/JS/JSTestActiveDOMObject.cpp:
+        (WebCore):
+        (WebCore::JSTestActiveDOMObject::destroy):
+        (WebCore::JSTestActiveDOMObject::~JSTestActiveDOMObject):
+        * bindings/scripts/test/JS/JSTestActiveDOMObject.h:
+        (JSTestActiveDOMObject):
+        * bindings/scripts/test/JS/JSTestCustomNamedGetter.cpp:
+        (WebCore):
+        (WebCore::JSTestCustomNamedGetter::destroy):
+        (WebCore::JSTestCustomNamedGetter::~JSTestCustomNamedGetter):
+        * bindings/scripts/test/JS/JSTestCustomNamedGetter.h:
+        (JSTestCustomNamedGetter):
+        * bindings/scripts/test/JS/JSTestEventConstructor.cpp:
+        (WebCore):
+        (WebCore::JSTestEventConstructor::destroy):
+        (WebCore::JSTestEventConstructor::~JSTestEventConstructor):
+        * bindings/scripts/test/JS/JSTestEventConstructor.h:
+        (JSTestEventConstructor):
+        * bindings/scripts/test/JS/JSTestEventTarget.cpp:
+        (WebCore):
+        (WebCore::JSTestEventTarget::destroy):
+        (WebCore::JSTestEventTarget::~JSTestEventTarget):
+        * bindings/scripts/test/JS/JSTestEventTarget.h:
+        (JSTestEventTarget):
+        * bindings/scripts/test/JS/JSTestInterface.cpp:
+        (WebCore):
+        (WebCore::JSTestInterface::destroy):
+        (WebCore::JSTestInterface::~JSTestInterface):
+        * bindings/scripts/test/JS/JSTestInterface.h:
+        (JSTestInterface):
+        * bindings/scripts/test/JS/JSTestMediaQueryListListener.cpp:
+        (WebCore):
+        (WebCore::JSTestMediaQueryListListener::destroy):
+        (WebCore::JSTestMediaQueryListListener::~JSTestMediaQueryListListener):
+        * bindings/scripts/test/JS/JSTestMediaQueryListListener.h:
+        (JSTestMediaQueryListListener):
+        * bindings/scripts/test/JS/JSTestNamedConstructor.cpp:
+        (WebCore):
+        (WebCore::JSTestNamedConstructor::destroy):
+        (WebCore::JSTestNamedConstructor::~JSTestNamedConstructor):
+        * bindings/scripts/test/JS/JSTestNamedConstructor.h:
+        (JSTestNamedConstructor):
+        * bindings/scripts/test/JS/JSTestObj.cpp:
+        (WebCore):
+        (WebCore::JSTestObj::destroy):
+        (WebCore::JSTestObj::~JSTestObj):
+        * bindings/scripts/test/JS/JSTestObj.h:
+        (JSTestObj):
+        * bindings/scripts/test/JS/JSTestSerializedScriptValueInterface.cpp:
+        (WebCore):
+        (WebCore::JSTestSerializedScriptValueInterface::destroy):
+        (WebCore::JSTestSerializedScriptValueInterface::~JSTestSerializedScriptValueInterface):
+        * bindings/scripts/test/JS/JSTestSerializedScriptValueInterface.h:
+        (JSTestSerializedScriptValueInterface):
+
+2012-02-12  Abhishek Arya  <inferno@chromium.org>
+
+        Regression (r104528): Crash when moving nodes across documents.
+        https://bugs.webkit.org/show_bug.cgi?id=78432
+
+        Reviewed by Hajime Morita.
+
+        Test: fast/dom/node-move-to-new-document-crash-main.html
+
+        * dom/TreeScopeAdopter.cpp:
+        (WebCore::TreeScopeAdopter::moveTreeToNewScope):
+        (WebCore::TreeScopeAdopter::moveTreeToNewDocument):
+        (WebCore::TreeScopeAdopter::moveNodeToNewDocument):
+
+2012-02-12  Hajime Morrita  <morrita@chromium.org>
+
+        Page should have less intrusive way to associate API implementation objects.
+        https://bugs.webkit.org/show_bug.cgi?id=78085
+
+        Reviewed by Adam Barth.
+
+        Introducing PageSupplement interface to attach behind-the-flag-ish
+        objects to Page instances.
+
+        This change aims to improve modularity of Modules/ entries. With
+        PageSupplement mechinary, we can eliminate ifdef conditionals from
+        Page.h/Page.cpp and are able to add Modules/ entries without
+        touching non-Module WebCore files. WebKit API classes like WebPage
+        can "provide" these objects dynamically during the Page setup phase.
+
+        In this change, DeviceMotionController and
+        DeviceOrientationController is updated to adopt PageSupplement
+        inteface for an illustrative purpose because they are going to
+        move into Modules/ shortly. Other Page associated API backing
+        objects also should be transformed to PageSupplement family.
+
+        Reviewed by Adam Barth.
+
+        No new tests. No behavior change.
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * Target.pri:
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * dom/DeviceMotionClient.h:
+        (WebCore):
+        * dom/DeviceMotionController.cpp:
+        (WebCore::DeviceMotionController::supplementName):
+        (WebCore):
+        (WebCore::DeviceMotionController::isActiveAt):
+        (WebCore::provideDeviceMotionTo):
+        * dom/DeviceMotionController.h:
+        (DeviceMotionController):
+        (WebCore::DeviceMotionController::from):
+        * dom/DeviceOrientationClient.h:
+        (WebCore):
+        * dom/DeviceOrientationController.cpp:
+        (WebCore::DeviceOrientationController::supplementName):
+        (WebCore):
+        (WebCore::DeviceOrientationController::isActiveAt):
+        (WebCore::provideDeviceOrientationTo):
+        * dom/DeviceOrientationController.h:
+        (DeviceOrientationController):
+        (WebCore::DeviceOrientationController::from):
+        * dom/Document.cpp:
+        (WebCore::Document::suspendActiveDOMObjects):
+        (WebCore::Document::resumeActiveDOMObjects):
+        * history/PageCache.cpp:
+        (WebCore::logCanCachePageDecision):
+        (WebCore::PageCache::canCache):
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::addEventListener):
+        (WebCore::DOMWindow::removeEventListener):
+        (WebCore::DOMWindow::removeAllEventListeners):
+        * page/PageSupplement.cpp:
+        (WebCore::PageSupplement::~PageSupplement):
+        (WebCore::PageSupplement::provideTo):
+        (WebCore::PageSupplement::from):
+        * page/PageSupplement.h:
+        * page/Page.cpp:
+        (WebCore::Page::Page):
+        (WebCore::Page::~Page):
+        (WebCore::Page::provideSupplement):
+        (WebCore):
+        (WebCore::Page::requireSupplement):
+        (WebCore::Page::notifyDestroyedToSupplements):
+        (WebCore::Page::PageClients::PageClients):
+        * page/Page.h:
+        (WebCore):
+        (PageClients):
+        (Page):
+        * svg/graphics/SVGImage.cpp:
+        (WebCore::SVGImage::dataChanged):
+
+2012-02-12  Nico Weber  <nicolasweber@gmx.de>
+
+        [chromium/mac] Change the type of webkit_system_interface from static_library to none
+        https://bugs.webkit.org/show_bug.cgi?id=78441
+
+        This target exists only run an action and to add a dependency to the
+        action's output to targets depending on webkit_system_interface.
+        This is what target type 'none' is for. With this, no dummy source
+        file is needed, and no empty libwebkit_system_interface.a is created.
+        This also fixes this (harmless) libtool warning:
+
+        libtool: warning for library: libwebkit_system_interface.a the table
+        of contents is empty (no object file members in the library define
+        global symbols)
+
+        Reviewed by Adam Barth.
+
+        * WebCore.gyp/WebCore.gyp:
+        * WebCore.gyp/mac/Empty.cpp: Removed.
+
+2012-02-12  Kenichi Ishibashi  <bashi@chromium.org>
+
+        If @font-face does not provide an explicit italic/bold variant, regular is used.
+        https://bugs.webkit.org/show_bug.cgi?id=34147
+
+        Reviewed by Dan Bernstein.
+
+        Update @font-face handling code so that it matches @font-face behavior to the current draft of CSS3 Font spec. The original patch was written by yusukes@chromium.org.
+        - Drops support for "bolder", "lighter", and "all" value. These are no longer allowed.
+        - Only allows one value for font-style and font-weight.
+
+        Tests: fast/css/font-face-synthetic-bold-italic.html
+               fast/css/font-face-weight-matching.html
+
+        * css/CSSFontSelector.cpp:
+        (WebCore::CSSFontSelector::addFontFaceRule): Removed "all", "lighter", "bolder" handling code.
+        (WebCore::compareFontFaces):Updated the weight matching algortihm.
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseValue): Replaced parseFontStyle() call with checking primitive values.
+        (WebCore::CSSParser::parseFontWeight): Changed to allow only primitive values.
+        (WebCore::CSSParser::createFontFaceRule): Removed checks for font-weight and font-style.
+        (WebCore::CSSParser::deleteFontFaceOnlyValues): Ditto.
+        * css/CSSParser.h: Removed parseFontStyle().
+
+2012-02-12  David Reveman  <reveman@chromium.org>
+
+        [Chromium] Avoid unnecessary memset in per-tile layer updater.
+        https://bugs.webkit.org/show_bug.cgi?id=78426
+
+        Reviewed by Stephen White.
+
+        Use our own SkBitmap and call SkBitmap::allocPixels() instead of
+        letting SkDevice construct a SkBitmap. This avoids an unnecessary
+        memset otherwise done by SkDevice.
+
+        No new tests.
+
+        * platform/graphics/chromium/BitmapSkPictureCanvasLayerTextureUpdater.cpp:
+        (WebCore::BitmapSkPictureCanvasLayerTextureUpdater::Texture::prepareRect):
+        (WebCore::BitmapSkPictureCanvasLayerTextureUpdater::Texture::updateRect):
+        * platform/graphics/chromium/BitmapSkPictureCanvasLayerTextureUpdater.h:
+        (Texture):
+
+2012-02-12  Joe Thomas  <joethomas@motorola.com>
+
+        Add toText and isTextNode helpers in Text class.
+        https://bugs.webkit.org/show_bug.cgi?id=78140
+
+        Added a new helper function toText() in dom/Text.h which does the type casting operation to Text object.
+        Modified the code to make use of this helper function.
+
+        Reviewed by Adam Barth.
+
+        No new tests.
+
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::accessibleNameForNode):
+        * bindings/v8/custom/V8NodeCustom.cpp:
+        (WebCore::toV8Slow):
+        * css/SelectorChecker.cpp:
+        (WebCore::SelectorChecker::checkOneSelector):
+        * dom/Attr.cpp:
+        (WebCore::Attr::childrenChanged):
+        * dom/Element.cpp:
+        (WebCore::Element::recalcStyle):
+        * dom/Node.cpp:
+        (WebCore::Node::normalize):
+        * dom/Position.cpp:
+        (WebCore::Position::containerText):
+        (WebCore::Position::leadingWhitespacePosition):
+        * dom/Range.cpp:
+        (WebCore::Range::insertNode):
+        (WebCore::Range::getBorderAndTextQuads):
+        * dom/ScriptElement.cpp:
+        (WebCore::ScriptElement::scriptContent):
+        * dom/ShadowRoot.cpp:
+        (WebCore::ShadowRoot::recalcShadowTreeStyle):
+        * dom/Text.h: Added new helper function toText.
+        (WebCore::toText): new helper function which does the type casting operation to Text object.
+        (WebCore):
+        * editing/ApplyBlockElementCommand.cpp:
+        (WebCore::isNewLineAtPosition):
+        (WebCore::ApplyBlockElementCommand::endOfNextParagrahSplittingTextNodesIfNeeded):
+        * editing/ApplyStyleCommand.cpp:
+        (WebCore::ApplyStyleCommand::splitTextAtEnd):
+        (WebCore::ApplyStyleCommand::splitTextElementAtEnd):
+        (WebCore::ApplyStyleCommand::joinChildTextNodes):
+        * editing/BreakBlockquoteCommand.cpp:
+        (WebCore::BreakBlockquoteCommand::doApply):
+        * editing/CompositeEditCommand.cpp:
+        (WebCore::CompositeEditCommand::insertNodeAt):
+        (WebCore::CompositeEditCommand::positionOutsideTabSpan):
+        (WebCore::CompositeEditCommand::canRebalance):
+        (WebCore::CompositeEditCommand::rebalanceWhitespaceAt):
+        (WebCore::CompositeEditCommand::prepareWhitespaceAtPositionForSplit):
+        (WebCore::CompositeEditCommand::deleteInsignificantText):
+        (WebCore::CompositeEditCommand::removePlaceholderAt):
+        (WebCore::CompositeEditCommand::cleanupAfterDeletion):
+        (WebCore::CompositeEditCommand::breakOutOfEmptyMailBlockquotedParagraph):
+        * editing/DeleteSelectionCommand.cpp:
+        (WebCore::DeleteSelectionCommand::handleGeneralDelete):
+        (WebCore::DeleteSelectionCommand::fixupWhitespace):
+        * editing/Editor.cpp:
+        (WebCore::Editor::setComposition):
+        * editing/InsertLineBreakCommand.cpp:
+        (WebCore::InsertLineBreakCommand::doApply):
+        * editing/InsertParagraphSeparatorCommand.cpp:
+        (WebCore::InsertParagraphSeparatorCommand::doApply):
+        * editing/InsertTextCommand.cpp:
+        (WebCore::InsertTextCommand::insertTab):
+        * editing/MarkupAccumulator.cpp:
+        (WebCore::MarkupAccumulator::appendStartMarkup):
+        * editing/ReplaceSelectionCommand.cpp:
+        (WebCore::ReplaceSelectionCommand::removeUnrenderedTextNodesAtEnds):
+        (WebCore::ReplaceSelectionCommand::addSpacesForSmartReplace):
+        (WebCore::ReplaceSelectionCommand::insertAsListItems):
+        (WebCore::ReplaceSelectionCommand::performTrivialReplace):
+        * editing/htmlediting.cpp:
+        (WebCore::lineBreakExistsAtPosition):
+        * editing/visible_units.cpp:
+        (WebCore::startPositionForLine):
+        (WebCore::endPositionForLine):
+        (WebCore::startOfParagraph):
+        (WebCore::endOfParagraph):
+        * html/HTMLElement.cpp:
+        (WebCore::replaceChildrenWithFragment):
+        (WebCore::replaceChildrenWithText):
+        (WebCore::mergeWithNextTextNode):
+        * html/HTMLObjectElement.cpp:
+        (WebCore::HTMLObjectElement::hasFallbackContent):
+        (WebCore::HTMLObjectElement::updateDocNamedItem):
+        * html/HTMLOptionElement.cpp:
+        (WebCore::HTMLOptionElement::setText):
+        * html/HTMLScriptElement.cpp:
+        (WebCore::HTMLScriptElement::setText):
+        * html/HTMLTextAreaElement.cpp:
+        (WebCore::HTMLTextAreaElement::defaultValue):
+        * html/HTMLTextFormControlElement.cpp:
+        (WebCore::HTMLTextFormControlElement::innerTextValue):
+        (WebCore::HTMLTextFormControlElement::valueWithHardLineBreaks):
+        * html/HTMLTitleElement.cpp:
+        (WebCore::HTMLTitleElement::text):
+        (WebCore::HTMLTitleElement::setText):
+        * inspector/InspectorDOMAgent.cpp:
+        (WebCore::InspectorDOMAgent::setNodeValue):
+        * rendering/RenderText.cpp:
+        (WebCore::RenderText::originalText):
+        * rendering/RenderTextFragment.cpp:
+        (WebCore::RenderTextFragment::originalText):
+        (WebCore::RenderTextFragment::previousCharacter):
+
+2012-02-12  Kentaro Hara  <haraken@chromium.org>
+
+        Remove [CPPCustom] from CodeGeneratorCPP.pm
+        https://bugs.webkit.org/show_bug.cgi?id=78342
+
+        Reviewed by Adam Barth.
+
+        This patch removes [CPPCustom].
+
+        [CPPCustom] has been used in DOMWindow.location only to indicate that
+        DOMWindow.location should be ignored in CPP. However, there are many
+        other attributes and methods that CPP does not support (e.g. [CallWith=...],
+        [CustomSetter], etc), and they are not yet marked with [CPPCustom].
+        CPP just generates "meaningless" code for those unsupported attributes
+        and methods. Ideally we can mark all unsupported attributes and methods
+        with [CPPCustom], but it would not be so practical. Otherwise, removing
+        [CPPCustom] would make sense. The side effect of removing [CPPCustom]
+        is just that CPP will generate "meaningless" code for DOMWindow.location.
+
+        No tests. No change in behavior.
+
+        * bindings/scripts/CodeGeneratorCPP.pm:
+        (ShouldSkipType):
+        * page/DOMWindow.idl:
+
+2012-02-12  Kentaro Hara  <haraken@chromium.org>
+
+        Rename [JSCustomPrototypeDefineOwnProperty] to [JSCustomDefineOwnPropertyOnPrototype]
+        https://bugs.webkit.org/show_bug.cgi?id=78354
+
+        Reviewed by Adam Barth.
+
+        This patch renames [JSCustomPrototypeDefineOwnProperty] to
+        [JSCustomDefineOwnPropertyOnPrototype], for naming consistency with
+        [JSCustomDefineOwnProperty] and [JSCustomNamedGetterOnPrototype].
+
+        No tests. No change in behavior.
+
+        * bindings/scripts/CodeGeneratorJS.pm:
+        (GenerateHeader):
+        * page/Location.idl:
+
+2012-02-11  Filip Pizlo  <fpizlo@apple.com>
+
+        It should be possible to send all JSC debug logging to a file
+        https://bugs.webkit.org/show_bug.cgi?id=78418
+
+        Reviewed by Sam Weinig.
+        
+        Introduced wtf/DataLog, which defines WTF::dataFile, WTF::dataLog,
+        and WTF::dataLogV. Changed all debugging- and profiling-related printfs
+        to use WTF::dataLog() or one of its friends. By default, debug logging
+        goes to stderr, unless you change the setting in wtf/DataLog.cpp.
+
+        No new tests because behavior is unchanged.
+
+        * ForwardingHeaders/wtf/DataLog.h: Added.
+
+2012-02-11  Gavin Barraclough  <barraclough@apple.com>
+
+        Move special __proto__ property to Object.prototype
+        https://bugs.webkit.org/show_bug.cgi?id=78409
+
+        Reviewed by Oliver Hunt.
+
+        Re-implement this as a regular accessor property.  This has three key benefits:
+        1) It makes it possible for objects to be given properties named __proto__.
+        2) Object.prototype.__proto__ can be deleted, preventing object prototypes from being changed.
+        3) This largely removes the magic used the implement __proto__, it can just be made a regular accessor property.
+
+        * bindings/js/JSDOMWindowBase.cpp:
+        (WebCore::JSDOMWindowBase::allowsAccessFrom):
+        (WebCore):
+            - expose allowsAccessFrom check to JSC.
+        * bindings/js/JSDOMWindowBase.h:
+        (JSDOMWindowBase):
+            - expose allowsAccessFrom check to JSC.
+
+2012-02-11  Benjamin Poulain  <benjamin@webkit.org>
+
+        Get rid of WebCore::URLString
+        https://bugs.webkit.org/show_bug.cgi?id=78429
+
+        Reviewed by Adam Barth.
+
+        URLString is unused, remove the class.
+
+        * GNUmakefile.list.am:
+        * WebCore.gypi:
+        * WebCore.xcodeproj/project.pbxproj:
+        * platform/KURL.cpp:
+        * platform/KURL.h:
+        (KURL):
+        * platform/URLString.h: Removed.
+
+2012-02-11  Sam Weinig  <sam@webkit.org>
+
+        Fix the windows build.
+
+        Since Windows uses an all-in-one file to compile, the isRespectedPresentationAttribute()
+        functions all need unique names.
+
+        * html/HTMLBodyElement.cpp:
+        * html/HTMLHRElement.cpp:
+        * html/HTMLIFrameElement.cpp:
+        * html/HTMLImageElement.cpp:
+        * html/HTMLInputElement.cpp:
+        * html/HTMLMarqueeElement.cpp:
+        * html/HTMLPlugInElement.cpp:
+        * html/HTMLTableCellElement.cpp:
+        * html/HTMLTablePartElement.cpp:
+        * mathml/MathMLElement.cpp:
+
+2012-02-11  Anders Carlsson  <andersca@apple.com>
+
+        Overlay scrollbars don't appear when scrolling on the scrolling thread
+        https://bugs.webkit.org/show_bug.cgi?id=78427
+
+        Reviewed by Sam Weinig.
+
+        Add a ScrollAnimator::notifyContentAreaScrolled and call it from ScrollAnimator::notifyContentAreaScrolled.
+        It is then overridden in ScrollAnimatorMac to tickle AppKit so that overlay scrollbars will be shown.
+
+        * platform/ScrollAnimator.h:
+        (WebCore::ScrollAnimator::notifyContentAreaScrolled):
+        (ScrollAnimator):
+        * platform/ScrollableArea.cpp:
+        (WebCore::ScrollableArea::notifyScrollPositionChanged):
+        * platform/mac/ScrollAnimatorMac.h:
+        (ScrollAnimatorMac):
+        * platform/mac/ScrollAnimatorMac.mm:
+        (WebCore::ScrollAnimatorMac::notifyPositionChanged):
+        (WebCore::ScrollAnimatorMac::notifyContentAreaScrolled):
+        (WebCore):
+
+2012-02-11  Anders Carlsson  <andersca@apple.com>
+
+        Implement more ScrollElasticityControllerClient member functions
+        https://bugs.webkit.org/show_bug.cgi?id=78425
+        <rdar://problem/10710727>
+
+        Reviewed by Sam Weinig.
+
+        * page/scrolling/ScrollingTreeNode.h:
+        (ScrollingTreeNode):
+        (WebCore::ScrollingTreeNode::horizontalScrollElasticity):
+        (WebCore::ScrollingTreeNode::verticalScrollElasticity):
+        (WebCore::ScrollingTreeNode::hasEnabledHorizontalScrollbar):
+        (WebCore::ScrollingTreeNode::hasEnabledVerticalScrollbar):
+        Add new getters.
+
+        * page/scrolling/mac/ScrollingTreeNodeMac.h:
+        * page/scrolling/mac/ScrollingTreeNodeMac.mm:
+        (WebCore::ScrollingTreeNodeMac::allowsHorizontalStretching):
+        (WebCore::ScrollingTreeNodeMac::allowsVerticalStretching):
+        (WebCore::ScrollingTreeNodeMac::stretchAmount):
+        (WebCore::ScrollingTreeNodeMac::pinnedInDirection):
+        (WebCore::ScrollingTreeNodeMac::canScrollHorizontally):
+        (WebCore::ScrollingTreeNodeMac::canScrollVertically):
+        (WebCore::ScrollingTreeNodeMac::absoluteScrollPosition):
+        (WebCore::ScrollingTreeNodeMac::immediateScrollByWithoutContentEdgeConstraints):
+        (WebCore::ScrollingTreeNodeMac::startSnapRubberbandTimer):
+        (WebCore::ScrollingTreeNodeMac::stopSnapRubberbandTimer):
+        (WebCore::ScrollingTreeNodeMac::scrollByWithoutContentEdgeConstraints):
+        Implement ScrollElasticityControllerClient member functions.
+
+2012-02-11  Antti Koivisto  <antti@apple.com>
+
+        Add size assert for Length
+        https://bugs.webkit.org/show_bug.cgi?id=78420
+
+        Rubber-stamped by Andreas Kling.
+
+        Length type is memory critical and must not grow.
+
+        * platform/Length.cpp:
+        (SameSizeAsLength):
+        (WebCore):
+
+2012-02-11  Anders Carlsson  <andersca@apple.com>
+
+        Pass wheel events to a scroll elasticity controller on the scrolling thread
+        https://bugs.webkit.org/show_bug.cgi?id=78421
+
+        Reviewed by Sam Weinig.
+
+        Add a ScrollElasticityController to ScrollingTreeNodeMac and pass wheel events to it.
+        Fix ScrollingTreeNodeMac::scrollBy to clamp by the minimum and maximum scroll positions.
+
+        * page/scrolling/mac/ScrollingTreeNodeMac.h:
+        (ScrollingTreeNodeMac):
+        * page/scrolling/mac/ScrollingTreeNodeMac.mm:
+        (WebCore::ScrollingTreeNodeMac::ScrollingTreeNodeMac):
+        (WebCore::ScrollingTreeNodeMac::handleWheelEvent):
+        (WebCore::ScrollingTreeNodeMac::immediateScrollBy):
+        (WebCore::ScrollingTreeNodeMac::setScrollLayerPosition):
+        (WebCore::ScrollingTreeNodeMac::minimumScrollPosition):
+        (WebCore):
+        (WebCore::ScrollingTreeNodeMac::maximumScrollPosition):
+        (WebCore::ScrollingTreeNodeMac::scrollBy):
+
+2012-02-11  Andreas Kling  <awesomekling@apple.com>
+
+        Attribute styles should be created lazily.
+        <http://webkit.org/b/78381>
+
+        Reviewed by Antti Koivisto.
+
+        TL;DR summary: Lazily construct the StyledElement::attributeStyle() instead of
+        moving properties in/out of it in parseAttribute(). This allows us to enable
+        the matched declaration cache for elements with presentation attributes.
+
+        The matched declaration cache has been disabled for elements with presentation
+        attributes because attributeStyle() was mutable, and (simply put) the cache maps
+        a set of StylePropertySet pointers to a resulting RenderStyle. This requires
+        that the StylePropertySets are immutable.
+
+        To make them immutable, we now construct the attribute style lazily by adding
+        a flag (to Node) that gets set in parseAttribute() when a presentation attribute
+        respected by the element changes. A subsequent call to attributeStyle() checks
+        the flag and rebuilds the style by looping over the attributes and calling the
+        new virtual StyledElement::collectStyleForAttribute() on each one. Any dangling
+        references to the previous attribute style will be garbage collected by the
+        cache in CSSStyleSelector::sweepMatchedDeclarationCache().
+
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::matchAllRules):
+
+            Enable matched declaration cache for elements with attribute style.
+
+        * dom/Node.h:
+        (WebCore::Node::attributeStyleDirty):
+        (WebCore::Node::setAttributeStyleDirty):
+        (WebCore::Node::clearAttributeStyleDirty):
+
+            Add a Node flag to signify that a presentation attribute has changed and
+            the attribute style needs to be rebuilt.
+
+        * dom/ElementAttributeData.h:
+        * dom/ElementAttributeData.cpp:
+        (WebCore::ElementAttributeData::setAttributeStyle):
+
+            Added a setter for the attribute style, called by updateAttributeStyle().
+
+        * dom/StyledElement.cpp:
+        (WebCore::StyledElement::addHTMLLengthToStyle):
+        (WebCore::StyledElement::addHTMLColorToStyle):
+
+            Moved and renamed two of the old addCSS* helpers from StyledElement.
+
+        (WebCore::StyledElement::updateAttributeStyle):
+
+            Called by attributeStyle() in case the "attribute style dirty" flag is
+            set. Rebuilds the attribute style from scratch by looping over the
+            attribute map and calling collectStyleForAttribute() on each attribute.
+
+        * dom/StyledElement.h:
+        (WebCore::StyledElement::collectStyleForAttribute):
+        (WebCore::StyledElement::attributeStyle):
+        (WebCore::StyledElement::setNeedsAttributeStyleUpdate):
+
+            Helper, sets the attribute style dirty flag and marks the element for
+            full style recalc. This is what parseAttribute() calls in subclasses
+            when they encounter a presentation attribute.
+
+        * html/HTMLBRElement.cpp:
+        (WebCore::HTMLBRElement::collectStyleForAttribute):
+        (WebCore::HTMLBRElement::parseAttribute):
+        * html/HTMLBRElement.h:
+        * html/HTMLBodyElement.cpp:
+        (WebCore::isRespectedPresentationAttribute):
+        (WebCore::HTMLBodyElement::collectStyleForAttribute):
+        (WebCore::HTMLBodyElement::parseAttribute):
+        * html/HTMLBodyElement.h:
+        * html/HTMLDivElement.cpp:
+        (WebCore::HTMLDivElement::collectStyleForAttribute):
+        (WebCore::HTMLDivElement::parseAttribute):
+        * html/HTMLDivElement.h:
+        * html/HTMLElement.cpp:
+        (WebCore::HTMLElement::applyBorderAttributeToStyle):
+        (WebCore::HTMLElement::mapLanguageAttributeToLocale):
+        (WebCore::HTMLElement::collectStyleForAttribute):
+        (WebCore::HTMLElement::parseAttribute):
+        (WebCore::HTMLElement::applyAlignmentAttributeToStyle):
+        * html/HTMLElement.h:
+        * html/HTMLEmbedElement.cpp:
+        (WebCore::HTMLEmbedElement::collectStyleForAttribute):
+        (WebCore::HTMLEmbedElement::parseAttribute):
+        * html/HTMLEmbedElement.h:
+        * html/HTMLFontElement.cpp:
+        (WebCore::HTMLFontElement::collectStyleForAttribute):
+        (WebCore::HTMLFontElement::parseAttribute):
+        * html/HTMLFontElement.h:
+        * html/HTMLFrameSetElement.cpp:
+        (WebCore::HTMLFrameSetElement::collectStyleForAttribute):
+        (WebCore::HTMLFrameSetElement::parseAttribute):
+        * html/HTMLFrameSetElement.h:
+        * html/HTMLHRElement.cpp:
+        (WebCore::isRespectedPresentationAttribute):
+        (WebCore::HTMLHRElement::collectStyleForAttribute):
+        (WebCore::HTMLHRElement::parseAttribute):
+        * html/HTMLHRElement.h:
+        * html/HTMLIFrameElement.cpp:
+        (WebCore::HTMLIFrameElement::collectStyleForAttribute):
+        (WebCore::HTMLIFrameElement::parseAttribute):
+        * html/HTMLIFrameElement.h:
+        * html/HTMLImageElement.cpp:
+        (WebCore::isRespectedPresentationAttribute):
+        (WebCore::HTMLImageElement::collectStyleForAttribute):
+        (WebCore::HTMLImageElement::parseAttribute):
+        * html/HTMLImageElement.h:
+        * html/HTMLInputElement.cpp:
+        (WebCore::isRespectedPresentationAttribute):
+        (WebCore::HTMLInputElement::collectStyleForAttribute):
+        (WebCore::HTMLInputElement::parseAttribute):
+        * html/HTMLInputElement.h:
+        * html/HTMLLIElement.cpp:
+        (WebCore::HTMLLIElement::collectStyleForAttribute):
+        (WebCore::HTMLLIElement::parseAttribute):
+        * html/HTMLLIElement.h:
+        * html/HTMLMarqueeElement.cpp:
+        (WebCore::isRespectedPresentationAttribute):
+        (WebCore::HTMLMarqueeElement::collectStyleForAttribute):
+        (WebCore::HTMLMarqueeElement::parseAttribute):
+        * html/HTMLMarqueeElement.h:
+        * html/HTMLOListElement.cpp:
+        (WebCore::HTMLOListElement::collectStyleForAttribute):
+        (WebCore::HTMLOListElement::parseAttribute):
+        * html/HTMLOListElement.h:
+        * html/HTMLObjectElement.cpp:
+        (WebCore::HTMLObjectElement::collectStyleForAttribute):
+        (WebCore::HTMLObjectElement::parseAttribute):
+        * html/HTMLObjectElement.h:
+        * html/HTMLParagraphElement.cpp:
+        (WebCore::HTMLParagraphElement::collectStyleForAttribute):
+        (WebCore::HTMLParagraphElement::parseAttribute):
+        * html/HTMLParagraphElement.h:
+        * html/HTMLPlugInElement.cpp:
+        (WebCore::isRespectedPresentationAttribute):
+        (WebCore::HTMLPlugInElement::collectStyleForAttribute):
+        (WebCore::HTMLPlugInElement::parseAttribute):
+        * html/HTMLPlugInElement.h:
+        * html/HTMLPreElement.cpp:
+        (WebCore::HTMLPreElement::collectStyleForAttribute):
+        (WebCore::HTMLPreElement::parseAttribute):
+        * html/HTMLPreElement.h:
+        * html/HTMLTableCaptionElement.cpp:
+        (WebCore::HTMLTableCaptionElement::collectStyleForAttribute):
+        (WebCore::HTMLTableCaptionElement::parseAttribute):
+        * html/HTMLTableCaptionElement.h:
+        * html/HTMLTableCellElement.cpp:
+        (WebCore::isRespectedPresentationAttribute):
+        (WebCore::HTMLTableCellElement::collectStyleForAttribute):
+        (WebCore::HTMLTableCellElement::parseAttribute):
+        * html/HTMLTableCellElement.h:
+        * html/HTMLTableColElement.cpp:
+        (WebCore::HTMLTableColElement::collectStyleForAttribute):
+        (WebCore::HTMLTableColElement::parseAttribute):
+        * html/HTMLTableColElement.h:
+        * html/HTMLTableElement.cpp:
+        (WebCore::getBordersFromFrameAttributeValue):
+        (WebCore::HTMLTableElement::collectStyleForAttribute):
+        (WebCore::HTMLTableElement::parseAttribute):
+        * html/HTMLTableElement.h:
+        * html/HTMLTablePartElement.cpp:
+        (WebCore::isRespectedPresentationAttribute):
+        (WebCore::HTMLTablePartElement::collectStyleForAttribute):
+        (WebCore::HTMLTablePartElement::parseAttribute):
+        * html/HTMLTablePartElement.h:
+        * html/HTMLTextAreaElement.cpp:
+        (WebCore::HTMLTextAreaElement::collectStyleForAttribute):
+        (WebCore::HTMLTextAreaElement::parseAttribute):
+        * html/HTMLTextAreaElement.h:
+        * html/HTMLUListElement.cpp:
+        (WebCore::HTMLUListElement::collectStyleForAttribute):
+        (WebCore::HTMLUListElement::parseAttribute):
+        * html/HTMLUListElement.h:
+        * html/HTMLVideoElement.cpp:
+        (WebCore::HTMLVideoElement::collectStyleForAttribute):
+        (WebCore::HTMLVideoElement::parseAttribute):
+        * html/HTMLVideoElement.h:
+        * mathml/MathMLElement.cpp:
+        (WebCore::isRespectedPresentationAttribute):
+        (WebCore::MathMLElement::collectStyleForAttribute):
+        (WebCore::MathMLElement::parseAttribute):
+        * mathml/MathMLElement.h:
+        * svg/SVGImageElement.cpp:
+        (WebCore::SVGImageElement::collectStyleForAttribute):
+        (WebCore::SVGImageElement::parseAttribute):
+        * svg/SVGImageElement.h:
+        * svg/SVGStyledElement.cpp:
+        (WebCore::SVGStyledElement::collectStyleForAttribute):
+        (WebCore::SVGStyledElement::parseAttribute):
+        * svg/SVGStyledElement.h:
+        * svg/SVGTextContentElement.cpp:
+        (WebCore::SVGTextContentElement::collectStyleForAttribute):
+        (WebCore::SVGTextContentElement::parseAttribute):
+        * svg/SVGTextContentElement.h:
+
+            Split handling of presentation attributes between parseAttribute() and
+            collectStyleForAttribute() as appropriate. Some minor refactorings here and
+            there (mostly in HTMLTableElement) to avoid excessive code duplication.
+            Also sprinkled FIXMEs about inefficiencies we should clean up.
+
+2012-02-11   Arko Saha  <arko@motorola.com>
+
+        HTML 5: Support click() method on HTMLElement.
+        https://bugs.webkit.org/show_bug.cgi?id=27880
+
+        Reviewed by Timothy Hatcher.
+
+        Test: fast/dom/click-method-on-html-element.html
+
+        * bindings/objc/PublicDOMInterfaces.h: Added click() method in DOMHTMLElement
+        with availability macro AVAILABLE_AFTER_WEBKIT_VERSION_5_1.
+        * html/HTMLButtonElement.idl: Moved click() method under LANGUAGE_OBJECTIVE_C.
+        * html/HTMLElement.idl: Added click() IDL method.
+        * html/HTMLInputElement.idl: Moved click() method under LANGUAGE_OBJECTIVE_C.
+
+2012-02-11  Martin Robinson  <mrobinson@igalia.com>
+
+        [GStreamer] html5test.com says that gstreamer ports do not support WebM for audio
+        https://bugs.webkit.org/show_bug.cgi?id=78244
+
+        Reviewed by Eric Seidel.
+
+        Specifically advertise support for audio/webm when we support the vorbis
+        audio codec. This is necessary because gstreamer doesn't advertise it.
+
+        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::mimeTypeCache): Add an override for audio/webm.
+
+2012-02-11  Anders Carlsson  <andersca@apple.com>
+
+        Try to fix the Windows build.
+
+        * platform/win/PopupMenuWin.cpp:
+        (WebCore::PopupMenuWin::scrollToRevealSelection):
+
+2012-02-08  Stephen White  <senorblanco@chromium.org>
+
+        [chromium] Enable CSS filters on composited layers.
+        https://bugs.webkit.org/show_bug.cgi?id=77266
+
+        Reviewed by James Robinson.
+
+        Will be covered by existing tests in css3/filters (when enabled).
+
+        * WebCore.gypi:
+        Add CCRenderSurfaceFilters.* to the Chromium build.
+        * platform/graphics/chromium/GraphicsLayerChromium.cpp:
+        (WebCore::GraphicsLayerChromium::setFilters):
+        * platform/graphics/chromium/GraphicsLayerChromium.h:
+        Override setFilters() virtual from GraphicsLayer.
+        * platform/graphics/chromium/LayerChromium.cpp:
+        (WebCore::LayerChromium::setFilters):
+        Implement setFilters() to cache the filters here...
+        (WebCore::LayerChromium::pushPropertiesTo):
+        ... and push them to the CCLayerImpl at commit time.
+        * platform/graphics/chromium/LayerChromium.h:
+        (WebCore::LayerChromium::filters):
+        Implement accessor.
+        * platform/graphics/chromium/RenderSurfaceChromium.h:
+        (WebCore::RenderSurfaceChromium::setFilters):
+        Implement stub version of setFilters(), to satisfy the templates.
+        * platform/graphics/chromium/cc/CCLayerImpl.cpp:
+        (WebCore::CCLayerImpl::setFilters):
+        Implement setter to receive filters at commit time.
+        * platform/graphics/chromium/cc/CCLayerImpl.h:
+        (WebCore::CCLayerImpl::filters):
+        Implement member var and accessor for filters.
+        * platform/graphics/chromium/cc/CCLayerTreeHostCommon.cpp:
+        (WebCore::calculateDrawTransformsAndVisibilityInternal):
+        Add another clause here to force creation of a RenderSurface when
+        filters are present, and to forward them from the layer to the
+        RenderSurface.
+        * platform/graphics/chromium/cc/CCRenderSurface.cpp:
+        (WebCore::CCRenderSurface::draw):
+        (WebCore::CCRenderSurface::drawLayer):
+        Check for filters at draw time, apply them, and forward the result
+        through the drawing traversal.
+        (WebCore::CCRenderSurface::drawSurface):
+        If filter bitmap is present, bind it instead of the normal
+        RenderSurface texture.
+        (WebCore::CCRenderSurface::applyFilters):
+        Apply filters to the render surface texture, and return the result.
+        This function is a no-op for the threaded compositor, due to use
+        of the SharedGraphicsContext3D.
+        * platform/graphics/chromium/cc/CCRenderSurface.h:
+        (WebCore::CCRenderSurface::setFilters):
+        (WebCore::CCRenderSurface::filters):
+        (CCRenderSurface):
+        Filters getters and setters.
+        * platform/graphics/chromium/cc/CCRenderSurfaceFilters.cpp: Added.
+        (WebCore::CCRenderSurfaceFilters::apply):
+        External interface for this (static) class.  All internal
+        implementation and helper functions are in the unnamed namespace.
+        * platform/graphics/chromium/cc/CCRenderSurfaceFilters.h: Added.
+
+2012-02-11  Andreas Kling  <awesomekling@apple.com>
+
+        Node.isEqualNode() compares attributes twice.
+        <http://webkit.org/b/78414>
+
+        Reviewed by Anders Carlsson.
+
+        A single pass across the attribute maps should be enough for anyone.
+
+        Added a test verifying correct behavior of Node.isEqualNode() when comparing
+        two elements, one of which has had attributes that were all removed,
+        resulting in an empty but non-null NamedNodeMap hanging off of the element.
+        Note that this change is not fixing a regression, I'm just adding the test
+        since I came close to introducing a bug here.
+
+        Test: fast/dom/isEqualNode-after-removeAttribute.html
+
+        * dom/Node.cpp:
+        (WebCore::Node::isEqualNode):
+
+2012-02-11  Andreas Kling  <awesomekling@apple.com>
+
+        HTMLTablePartElement: Add helper method to find parent table.
+        <http://webkit.org/b/78413>
+
+        Reviewed by Anders Carlsson.
+
+        Add HTMLTablePartElement::findParentTable() and use that in subclasses instead
+        of duplicating the code.
+
+        * html/HTMLTableCellElement.cpp:
+        (WebCore::HTMLTableCellElement::additionalAttributeStyle):
+        * html/HTMLTableColElement.cpp:
+        (WebCore::HTMLTableColElement::additionalAttributeStyle):
+        * html/HTMLTablePartElement.cpp:
+        (WebCore::HTMLTablePartElement::findParentTable):
+        (WebCore):
+        * html/HTMLTablePartElement.h:
+        (WebCore):
+        (HTMLTablePartElement):
+        * html/HTMLTableSectionElement.cpp:
+        (WebCore::HTMLTableSectionElement::additionalAttributeStyle):
+
+2012-02-11  Andreas Kling  <awesomekling@apple.com>
+
+        Use Element's hasName/hasID flags to avoid unnecessary work when looking up name/id attributes.
+        <http://webkit.org/b/77845>
+
+        Reviewed by Anders Carlsson.
+
+        Have Element::getIdAttribute() check the hasID() flag before looking up the attribute.
+        Add an Element::getNameAttribute() to do the same thing with hasName().
+        Update call sites to make use of these helpers whenever possible.
+
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::accessibilityDescription):
+        * dom/DocumentOrderedMap.cpp:
+        (WebCore::keyMatchesId):
+        * dom/Element.h:
+        (Element):
+        (WebCore::Element::getIdAttribute):
+        (WebCore):
+        (WebCore::Element::getNameAttribute):
+        * dom/NameNodeList.cpp:
+        (WebCore::NameNodeList::nodeMatches):
+        * dom/StaticHashSetNodeList.cpp:
+        (WebCore::StaticHashSetNodeList::itemWithName):
+        * dom/StaticNodeList.cpp:
+        (WebCore::StaticNodeList::itemWithName):
+        * html/HTMLAnchorElement.cpp:
+        (WebCore::HTMLAnchorElement::name):
+        * html/HTMLAppletElement.cpp:
+        (WebCore::HTMLAppletElement::createRenderer):
+        * html/HTMLCollection.cpp:
+        (WebCore::HTMLCollection::checkForNameMatch):
+        (WebCore::HTMLCollection::updateNameCache):
+        * html/HTMLEmbedElement.cpp:
+        (WebCore::HTMLEmbedElement::updateWidget):
+        * html/HTMLFormCollection.cpp:
+        (WebCore::HTMLFormCollection::updateNameCache):
+        * html/HTMLFormControlElement.cpp:
+        (WebCore::HTMLFormControlElement::formControlName):
+        * html/HTMLFormElement.cpp:
+        (WebCore::HTMLFormElement::name):
+        * html/HTMLFrameElementBase.cpp:
+        (WebCore::HTMLFrameElementBase::setNameAndOpenURL):
+        * html/HTMLMetaElement.cpp:
+        (WebCore::HTMLMetaElement::name):
+        * html/HTMLNameCollection.cpp:
+        (WebCore::HTMLNameCollection::itemAfter):
+        * html/HTMLObjectElement.cpp:
+        (WebCore::HTMLObjectElement::updateWidget):
+        (WebCore::HTMLObjectElement::updateDocNamedItem):
+        (WebCore::HTMLObjectElement::containsJavaApplet):
+        (WebCore::HTMLObjectElement::formControlName):
+        * inspector/InspectorPageAgent.cpp:
+        (WebCore::InspectorPageAgent::buildObjectForFrame):
+        * page/Frame.cpp:
+        (WebCore::Frame::matchLabelsAgainstElement):
+        * rendering/svg/RenderSVGResourceContainer.cpp:
+        (WebCore::RenderSVGResourceContainer::RenderSVGResourceContainer):
+        * svg/SVGSVGElement.cpp:
+        (WebCore::SVGSVGElement::getElementById):
+
+2012-02-11  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r107435.
+        http://trac.webkit.org/changeset/107435
+        https://bugs.webkit.org/show_bug.cgi?id=78410
+
+        It broke the Qt build (Requested by Ossy on #webkit).
+
+        * WebCore.exp.in:
+        * WebCore.xcodeproj/project.pbxproj:
+        * editing/mac/EditorMac.mm:
+        (WebCore::Editor::writeSelectionToPasteboard):
+        * platform/Pasteboard.h:
+        (WebCore):
+        (Pasteboard):
+        * platform/PasteboardStrategy.h: Removed.
+        * platform/PlatformPasteboard.h: Removed.
+        * platform/PlatformStrategies.h:
+        (WebCore):
+        (WebCore::PlatformStrategies::PlatformStrategies):
+        (PlatformStrategies):
+        * platform/mac/DragDataMac.mm:
+        (WebCore::DragData::canSmartReplace):
+        (WebCore::insertablePasteboardTypes):
+        (WebCore::DragData::asURL):
+        * platform/mac/PasteboardMac.mm:
+        (WebCore):
+        (WebCore::selectionPasteboardTypes):
+        (WebCore::writableTypesForURL):
+        (WebCore::createWritableTypesForImage):
+        (WebCore::writableTypesForImage):
+        (WebCore::Pasteboard::Pasteboard):
+        (WebCore::Pasteboard::clear):
+        (WebCore::Pasteboard::writeSelectionForTypes):
+        (WebCore::Pasteboard::writePlainText):
+        (WebCore::Pasteboard::writeSelection):
+        (WebCore::writeURLForTypes):
+        (WebCore::Pasteboard::writeURL):
+        (WebCore::writeFileWrapperAsRTFDAttachment):
+        (WebCore::Pasteboard::writeImage):
+        (WebCore::Pasteboard::writeClipboard):
+        (WebCore::Pasteboard::canSmartReplace):
+        (WebCore::Pasteboard::plainText):
+        (WebCore::documentFragmentWithRTF):
+        (WebCore::Pasteboard::documentFragment):
+        * platform/mac/PlatformPasteboardMac.mm: Removed.
+
+2012-02-10  Antti Koivisto  <antti@apple.com>
+
+        Move CSSOM wrapper pointer out of StylePropertySet
+        https://bugs.webkit.org/show_bug.cgi?id=78406
+
+        Reviewed by Andreas Kling.
+        
+        Most StylePropertySet instances never have CSSOM wrappers so having a pointer to one in
+        each and and every object makes no sense.
+
+        Move the PropertySetCSSStyleDeclaration instances to a global HashMap. This shrinks
+        StylePropertySet by a pointer.
+        
+        Added COMPILE_ASSERT for StylePropertySet size.
+
+        * css/StylePropertySet.cpp:
+        (WebCore):
+        (WebCore::StylePropertySet::StylePropertySet):
+        (WebCore::StylePropertySet::~StylePropertySet):
+        (WebCore::StylePropertySet::ensureCSSStyleDeclaration):
+        * css/StylePropertySet.h:
+        (StylePropertySet):
+
+2012-02-10  David Barton  <dbarton@mathscribe.com>
+
+        MathML internals - use createXXX() function naming, ASSERT()s
+        https://bugs.webkit.org/show_bug.cgi?id=78384
+
+        Reviewed by Eric Seidel.
+
+        Standard RefPtr function naming uses "createXXX" instead of "makeXXX".
+        I also added a couple of ASSERT()s.
+
+        No new tests.
+
+        * rendering/mathml/RenderMathMLBlock.cpp:
+        (WebCore::RenderMathMLBlock::createBlockStyle):
+        * rendering/mathml/RenderMathMLBlock.h:
+        (RenderMathMLBlock):
+        * rendering/mathml/RenderMathMLFenced.cpp:
+        (WebCore::RenderMathMLFenced::createOperatorStyle):
+        (WebCore::RenderMathMLFenced::makeFences):
+        (WebCore::RenderMathMLFenced::addChild):
+        * rendering/mathml/RenderMathMLFenced.h:
+        (RenderMathMLFenced):
+        * rendering/mathml/RenderMathMLFraction.cpp:
+        (WebCore::RenderMathMLFraction::addChild):
+        * rendering/mathml/RenderMathMLRoot.cpp:
+        (WebCore::RenderMathMLRoot::addChild):
+        * rendering/mathml/RenderMathMLSubSup.cpp:
+        (WebCore::RenderMathMLSubSup::RenderMathMLSubSup):
+        * rendering/mathml/RenderMathMLUnderOver.cpp:
+        (WebCore::RenderMathMLUnderOver::RenderMathMLUnderOver):
+        (WebCore::RenderMathMLUnderOver::addChild):
+
+2012-02-10  Dan Bernstein  <mitz@apple.com>
+
+        Non-threaded scrolling build fix.
+
+        * page/FrameView.cpp:
+        (WebCore::FrameView::requestScrollPositionUpdate):
+
+2012-02-10  Edward O'Connor  <eoconnor@apple.com>
+
+        Change values for WEBKIT_KEYFRAMES_RULE, WEBKIT_KEYFRAME_RULE
+        https://bugs.webkit.org/show_bug.cgi?id=71293
+
+        Reviewed by Chris Marrin.
+
+        Tests: animations/animation-css-rule-types.html
+
+        * css/CSSRule.h: Change WEBKIT_KEYFRAMES_RULE to 7 and
+        WEBKIT_KEYFRAME_RULE to 8.
+        * css/CSSRule.idl: Ditto.
+
+2012-02-10  Eric Seidel  <eric@webkit.org>
+
+        AtomicMarkupTokenBase::initializeAttributes should not create a StringImpl if it doesn't need to
+        https://bugs.webkit.org/show_bug.cgi?id=78394
+
+        Reviewed by Adam Barth.
+
+        On the very next line is passes value to Attribute::create which takes
+        an AtomicString, so this code was just allocating a StringImpl (every time)
+        only to (much of the time) just release that StringImpl on the next line
+        when it got the AtomicString instead.
+
+        I discovered this while looking at DOM/Events.html, but it's unclear
+        if this fix actually makes that benchmark faster.
+
+        * xml/parser/MarkupTokenBase.h:
+        (WebCore::::initializeAttributes):
+
+2012-02-10  Anders Carlsson  <andersca@apple.com>
+
+        Always update the scroll position through the scrolling coordinator
+        https://bugs.webkit.org/show_bug.cgi?id=78403
+
+        Reviewed by Sam Weinig.
+
+        To get correct behavior, we always want to update the scrolling layer position
+        on the scrolling thread. Do this by allowing the scrolling coordinator to intercept
+        scroll position update requests and send them to the scrolling tree.
+
+        * page/FrameView.cpp:
+        (WebCore::FrameView::requestScrollPositionUpdate):
+        Let the scrolling coordinator have a go at updating the scroll position for this frame view.
+
+        * page/scrolling/ScrollingCoordinator.cpp:
+        (WebCore::ScrollingCoordinator::requestScrollPositionUpdate):
+        If it's a frame view we're coordinating scrolling for, tell the scrolling tree to update 
+        the scroll position.
+
+        * page/scrolling/ScrollingTree.cpp:
+        (WebCore::ScrollingTree::setMainFrameScrollPosition):
+        Call through to the scrolling tree node.
+
+        * page/scrolling/ScrollingTreeNode.h:
+        Add a new pure virtual setScrollPosition member function.
+
+        (WebCore::ScrollingTreeNodeMac::setScrollPosition):
+        Move most of the code from scrollBy here.
+
+        (WebCore::ScrollingTreeNodeMac::setScrollLayerPosition):
+        Rename this member function from setScrollPosition to avoid conflicts.
+
+        (WebCore::ScrollingTreeNodeMac::scrollBy):
+        Just call setScsrollPosition.
+
+        * platform/ScrollableArea.cpp:
+        (WebCore::ScrollableArea::setScrollOffsetFromAnimation):
+        Call requestScrollPositionUpdate, which allows subclasses of scrollable area to intercept
+        the scroll operation and call it asynchronously.
+
+2012-02-10  Anders Carlsson  <andersca@apple.com>
+
+        ScrollableArea should have a function for noting that the scroll position changed
+        https://bugs.webkit.org/show_bug.cgi?id=78402
+
+        Reviewed by Sam Weinig.
+
+        The scrolling coordinator needs a specialized function to call whenever the main frame
+        scrolling position has changed, so add ScrollableArea::notifyScrollPositionChanged and
+        call it from the scrolling coordinator.
+
+        * page/scrolling/ScrollingCoordinator.cpp:
+        (WebCore::ScrollingCoordinator::updateMainFrameScrollPosition):
+        (WebCore::ScrollingCoordinator::updateMainFrameScrollPositionAndScrollLayerPosition):
+        * platform/ScrollableArea.cpp:
+        (WebCore::ScrollableArea::notifyScrollPositionChanged):
+        New function.
+
+        (WebCore::ScrollableArea::setScrollOffsetFromAnimation):
+        Call ScrollableArea::notifyScrollPositionChanged.
+
+2012-02-09  Levi Weintraub  <leviw@chromium.org>
+
+        Unreviewed build fix.
+
+        Fixing the build by removing a duplicate definition of pixelSnappedIntRect in LayoutTypes.h and
+        removing conflict markers from the changelog.
+
+        * rendering/LayoutTypes.h:
+        (pixelSnappedIntRect):
+        * ChangeLog:
+
+2012-02-09  Levi Weintraub  <leviw@chromium.org>
+
+        Add pixelSnappedIntRect method
+        https://bugs.webkit.org/show_bug.cgi?id=78054
+
+        Reviewed by Eric Seidel.
+
+        This patch introduces a pixelSnappedIntRect method that will snap a sub-pixel LayoutRect to
+        pixel boundaries. These pixel snapped forms are what is used to communicate with the graphics
+        engine (to paint at whole pixel boundaries) and the embedding app (so they don't need to 
+        understand we're using sub-pixel units).
+
+        No new tests. No change in behavior.
+
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::isOffScreen):
+        (WebCore::AccessibilityRenderObject::boundsForVisiblePositionRange):
+        * dom/Range.cpp:
+        (WebCore::Range::boundingBox):
+        * html/HTMLCanvasElement.cpp:
+        (WebCore::HTMLCanvasElement::paint):
+        * html/shadow/TextControlInnerElements.cpp:
+        (WebCore::InputFieldSpeechButtonElement::startSpeechInput):
+        * page/Frame.cpp:
+        (WebCore::Frame::nodeImage):
+        * page/FrameView.cpp:
+        (WebCore::FrameView::repaintContentRectangle):
+        (WebCore::FrameView::doDeferredRepaints):
+        (WebCore::FrameView::windowClipRectForLayer):
+        * platform/graphics/GraphicsLayer.cpp:
+        (WebCore::GraphicsLayer::paintGraphicsLayerContents):
+        * rendering/InlineFlowBox.cpp:
+        (WebCore::InlineFlowBox::paint):
+        * rendering/LayoutTypes.h:
+        (WebCore::pixelSnappedIntRect):
+        (WebCore):
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::paintColumnContents):
+        (WebCore::RenderBlock::selectionGaps):
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::paintBoxDecorations):
+        (WebCore::RenderBox::pushContentsClip):
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::RenderBoxModelObject::paintFillLayerExtended):
+        (WebCore::RenderBoxModelObject::calculateBackgroundImageGeometry):
+        (WebCore::RenderBoxModelObject::drawBoxSideFromPath):
+        (WebCore::RenderBoxModelObject::paintBoxShadow):
+        * rendering/RenderDetailsMarker.cpp:
+        (WebCore::RenderDetailsMarker::paint):
+        * rendering/RenderFlowThread.cpp:
+        (WebCore::RenderFlowThread::paintIntoRegion):
+        * rendering/RenderFrameSet.cpp:
+        (WebCore::RenderFrameSet::paintColumnBorder):
+        (WebCore::RenderFrameSet::paintRowBorder):
+        (WebCore::RenderFrameSet::positionFramesWithFlattening):
+        * rendering/RenderImage.cpp:
+        (WebCore::RenderImage::paintReplaced):
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::scrollRectToVisible):
+        (WebCore::RenderLayer::positionOverflowControls):
+        (WebCore::RenderLayer::calculateRects):
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::updateGraphicsLayerGeometry):
+        (WebCore::paintScrollbar):
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::calculateCompositedBounds):
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::drawLineForBoxSide):
+        (WebCore::RenderObject::addPDFURLRect):
+        * rendering/RenderTextControlSingleLine.cpp:
+        (WebCore::RenderTextControlSingleLine::showPopup):
+        (WebCore::RenderTextControlSingleLine::paint):
+        * rendering/RenderWidget.cpp:
+        (WebCore::RenderWidget::paint):
+        * rendering/style/RenderStyle.cpp:
+        (WebCore::RenderStyle::getRoundedBorderFor):
+        (WebCore::RenderStyle::getRoundedInnerBorderFor):
+
+2012-02-09  Levi Weintraub  <leviw@chromium.org>
+
+        Add pixelSnappedIntRect method
+        https://bugs.webkit.org/show_bug.cgi?id=78054
+
+        Reviewed by Eric Seidel.
+
+        This patch introduces a pixelSnappedIntRect method that will snap a sub-pixel LayoutRect to
+        pixel boundaries. These pixel snapped forms are what is used to communicate with the graphics
+        engine (to paint at whole pixel boundaries) and the embedding app (so they don't need to 
+        understand we're using sub-pixel units).
+
+        No new tests. No change in behavior.
+
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::isOffScreen):
+        (WebCore::AccessibilityRenderObject::boundsForVisiblePositionRange):
+        * dom/Range.cpp:
+        (WebCore::Range::boundingBox):
+        * html/HTMLCanvasElement.cpp:
+        (WebCore::HTMLCanvasElement::paint):
+        * html/shadow/TextControlInnerElements.cpp:
+        (WebCore::InputFieldSpeechButtonElement::startSpeechInput):
+        * page/Frame.cpp:
+        (WebCore::Frame::nodeImage):
+        * page/FrameView.cpp:
+        (WebCore::FrameView::repaintContentRectangle):
+        (WebCore::FrameView::doDeferredRepaints):
+        (WebCore::FrameView::windowClipRectForLayer):
+        * platform/graphics/GraphicsLayer.cpp:
+        (WebCore::GraphicsLayer::paintGraphicsLayerContents):
+        * rendering/InlineFlowBox.cpp:
+        (WebCore::InlineFlowBox::paint):
+        * rendering/LayoutTypes.h:
+        (WebCore::pixelSnappedIntRect):
+        (WebCore):
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::paintColumnContents):
+        (WebCore::RenderBlock::selectionGaps):
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::paintBoxDecorations):
+        (WebCore::RenderBox::pushContentsClip):
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::RenderBoxModelObject::paintFillLayerExtended):
+        (WebCore::RenderBoxModelObject::calculateBackgroundImageGeometry):
+        (WebCore::RenderBoxModelObject::drawBoxSideFromPath):
+        (WebCore::RenderBoxModelObject::paintBoxShadow):
+        * rendering/RenderDetailsMarker.cpp:
+        (WebCore::RenderDetailsMarker::paint):
+        * rendering/RenderFlowThread.cpp:
+        (WebCore::RenderFlowThread::paintIntoRegion):
+        * rendering/RenderFrameSet.cpp:
+        (WebCore::RenderFrameSet::paintColumnBorder):
+        (WebCore::RenderFrameSet::paintRowBorder):
+        (WebCore::RenderFrameSet::positionFramesWithFlattening):
+        * rendering/RenderImage.cpp:
+        (WebCore::RenderImage::paintReplaced):
+                * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::scrollRectToVisible):
+        (WebCore::RenderLayer::positionOverflowControls):
+        (WebCore::RenderLayer::calculateRects):
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::updateGraphicsLayerGeometry):
+        (WebCore::paintScrollbar):
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::calculateCompositedBounds):
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::drawLineForBoxSide):
+        (WebCore::RenderObject::addPDFURLRect):
+        * rendering/RenderTextControlSingleLine.cpp:
+        (WebCore::RenderTextControlSingleLine::showPopup):
+        (WebCore::RenderTextControlSingleLine::paint):
+        * rendering/RenderWidget.cpp:
+        (WebCore::RenderWidget::paint):
+        * rendering/style/RenderStyle.cpp:
+        (WebCore::RenderStyle::getRoundedBorderFor):
+        (WebCore::RenderStyle::getRoundedInnerBorderFor):
+
+2012-02-10  Brian Weinstein  <bweinstein@apple.com>
+
+        Web Inspector: Add the ability to jump to the source for a given frame
+        https://bugs.webkit.org/show_bug.cgi?id=78396
+
+        Reviewed by Tim Hatcher.
+
+        * WebCore.exp.in: Add a new exported function.
+        * inspector/InspectorController.cpp: Add and expose the InspectorPageAgent.
+        (WebCore::InspectorController::InspectorController): Set m_pageAgent.
+        * inspector/InspectorController.h: Add m_pageAgent.
+        (WebCore::InspectorController::pageAgent): Return m_pageAgent.
+
+        * inspector/InspectorFrontendClientLocal.cpp:
+        (WebCore::InspectorFrontendClientLocal::showMainResourceForFrame): Get the inspector's frame ID
+            of the frame that was passed in, and add a call to evaluate on load.
+        * inspector/InspectorFrontendClientLocal.h:
+
+        * inspector/front-end/InspectorFrontendAPI.js:
+        (InspectorFrontendAPI.showMainResourceForFrame): Add a FIXME to show the source code for the main
+            resource of the given frame.
+
+2012-02-10  Vineet Chaudhary  <rgf748@motorola.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=72756
+        DOMHTMLElement’s accessKey property is declared as available in WebKit version that didn’t have it. 
+
+        Reviewed by Timothy Hatcher.
+
+        No new tests.
+
+        * bindings/objc/PublicDOMInterfaces.h: Moving accessKey property to DOMHTMLElement
+          with an appropriate availability macro AVAILABLE_AFTER_WEBKIT_VERSION_5_1.
+          Also Moving accessKey property to HTMLAnchorElement, HTMLAreaElement, HTMLButtonElement,
+          HTMLInputElement, HTMLLabelElement, HTMLLegendElement  and HTMLTextAreaElement idls
+          with an availability macro AVAILABLE_WEBKIT_VERSION_1_3_AND_LATER_BUT_DEPRECATED_AFTER_WEBKIT_VERSION_5_1.
+        * html/HTMLAnchorElement.idl: Adding accessKey entries back to idls under LANGUAGE_OBJECTIVE_C.
+        * html/HTMLAreaElement.idl: Ditto.
+        * html/HTMLButtonElement.idl: Ditto.
+        * html/HTMLInputElement.idl: Ditto.
+        * html/HTMLLabelElement.idl: Ditto.
+        * html/HTMLLegendElement.idl: Ditto.
+        * html/HTMLTextAreaElement.idl: Ditto.
+
+2012-02-10  Beth Dakin  <bdakin@apple.com>
+
+        Speculative build fix.
+
+        * platform/win/PopupMenuWin.cpp:
+        (WebCore::PopupMenuWin::scrollToRevealSelection):
+
+2012-02-10  Adam Klein  <adamk@chromium.org>
+
+        Enable MUTATION_OBSERVERS by default on all platforms
+        https://bugs.webkit.org/show_bug.cgi?id=78196
+
+        Reviewed by Ojan Vafai.
+
+        * Configurations/FeatureDefines.xcconfig:
+        * UseV8.cmake: Add some previously-missing files.
+        * WebCore.vcproj/WebCore.vcproj: ditto.
+        * bindings/js/JSBindingsAllInOne.cpp: ditto.
+        * dom/DOMAllInOne.cpp: ditto.
+
+2012-02-10  Emil A Eklund  <eae@chromium.org> and Levi Weintraub  <leviw@chromium.org>
+
+        Add FractionalLayoutUnit type for sub-pixel layout
+        https://bugs.webkit.org/show_bug.cgi?id=77485
+
+        Reviewed by Eric Seidel.
+
+        Add fixed point implementation (FractionalLayoutUnit).
+
+        FractionalLayoutUnit represents values as multiples of 1/60th pixel. This allows us
+        to represent sub-pixel values using integer math and avoids floating point precision
+        problems.
+
+        No new tests.
+
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * platform/FractionalLayoutUnit.h: Added.
+
+2012-02-10  Adam Langley  <agl@chromium.org>
+
+        Don't lowercase ping URLs.
+
+        Previously, ping URLs would be lowercased when splitting them apart.
+        URLs are not, however, case-insensitive.
+
+        https://bugs.webkit.org/show_bug.cgi?id=78371
+
+        Reviewed by Tony Chang.
+
+        * html/HTMLAnchorElement.cpp:
+        (WebCore::HTMLAnchorElement::sendPings): Don't lowercase URL.
+
+2012-02-10  Ojan Vafai  <ojan@chromium.org>
+
+        flex-pack:center and flex-item-align:center should do true centering
+        https://bugs.webkit.org/show_bug.cgi?id=77385
+
+        Reviewed by Tony Chang.
+
+        Also, removed passing totalPositiveFlexibility around. We don't
+        need to know about positive/negative flex once we run the flexing algorithm.
+        We used to need to know this in order to flex margins, but margins can
+        no longer be flexed.
+
+        Test: css3/flexbox/true-centering.html
+
+        * rendering/RenderFlexibleBox.cpp:
+        (WebCore::RenderFlexibleBox::layoutFlexItems):
+        (WebCore::initialPackingOffset):
+        (WebCore::packingSpaceBetweenChildren):
+        (WebCore::RenderFlexibleBox::layoutAndPlaceChildren):
+        (WebCore::RenderFlexibleBox::layoutColumnReverse):
+        * rendering/RenderFlexibleBox.h:
+        (RenderFlexibleBox):
+
+2012-02-10  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Split MarkedSpace into destructor and destructor-free subspaces
+        https://bugs.webkit.org/show_bug.cgi?id=77761
+
+        Reviewed by Geoffrey Garen.
+
+        No new tests.
+
+        * bindings/js/JSDOMWindowShell.cpp: Removed old operator new, which was just used in the create
+        function so that we can use allocateCell instead.
+        (WebCore):
+        * bindings/js/JSDOMWindowShell.h:
+        (WebCore::JSDOMWindowShell::create):
+        (JSDOMWindowShell):
+        * bindings/scripts/CodeGeneratorJS.pm: Added destructor back to root JS DOM nodes (e.g. JSNode, etc)
+        because their destroy functions need to be called, so we don't want the NeedsDestructor struct to 
+        think they don't need destruction due to having empty/trivial destructors.
+        Removed ASSERT_HAS_TRIVIAL_DESTRUCTOR from all JS DOM wrapper auto-generated objects because their 
+        ancestors now have non-trivial destructors. 
+        (GenerateHeader):
+        (GenerateImplementation):
+        (GenerateConstructorDefinition):
+
+2012-02-10  Anders Carlsson  <andersca@apple.com>
+
+        Remove a bunch of unused ScrollableArea member functions
+        https://bugs.webkit.org/show_bug.cgi?id=78388
+
+        Reviewed by Beth Dakin.
+
+        * platform/ScrollableArea.cpp:
+        * platform/ScrollableArea.h:
+
+2012-02-10  Pavel Podivilov  <podivilov@chromium.org>
+
+        Fix a few typos in IDL exception names.
+        https://bugs.webkit.org/show_bug.cgi?id=78356
+
+        Reviewed by Adam Barth.
+
+        * dom/Node.idl:
+        * notifications/NotificationCenter.idl:
+        * page/Navigator.idl:
+
+2012-02-10  Benjamin Poulain  <bpoulain@apple.com>
+
+        DefaultLocalizationStrategy::htmlSelectMultipleItems() should use size_t instead of int
+        https://bugs.webkit.org/show_bug.cgi?id=78374
+
+        Reviewed by Joseph Pecoraro.
+
+        The value comes from size_t and is converted to int for no good reason. We should use
+        size_t.
+
+        * platform/DefaultLocalizationStrategy.cpp:
+        (WebCore::DefaultLocalizationStrategy::htmlSelectMultipleItems):
+        * platform/DefaultLocalizationStrategy.h:
+        (DefaultLocalizationStrategy):
+
+2012-02-10  Anders Carlsson  <andersca@apple.com>
+
+        More ScrollableArea cleanup
+        https://bugs.webkit.org/show_bug.cgi?id=78383
+
+        Reviewed by Beth Dakin.
+
+        Get rid of setScrollOriginX and setScrollOriginY. Make ScrollableArea::setScrollOrigin private.
+
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::updateScrollbars):
+        * platform/ScrollableArea.cpp:
+        (WebCore::ScrollableArea::setScrollOrigin):
+        * platform/ScrollableArea.h:
+        (ScrollableArea):
+
+2012-02-10  Kentaro Hara  <haraken@chromium.org>
+
+        Rename [JSCustomPrototypePutDelegate] to [JSCustomNamedGetterOnPrototype]
+        https://bugs.webkit.org/show_bug.cgi?id=78353
+
+        Reviewed by Adam Barth.
+
+        [JSCustomPrototypePutDelegate] is used to write custom code for named
+        getters on a prototype interface. "PutDelegate" is just a method name
+        in implementation and not so descriptive. This patch renames it to
+        [JSCustomNamedGetterOnPrototype]. This is also for naming consistency
+        with [CustomNamedGetter].
+
+        No tests. No change in behavior.
+
+        * bindings/scripts/CodeGeneratorJS.pm:
+        (GenerateHeader):
+        (GenerateImplementation):
+        * page/Location.idl:
+
+2012-02-10  Enrica Casucci  <enrica@apple.com>
+
+        Refactor Mac platform implementation of the Pasteboard class to use Platform Strategies.
+        https://bugs.webkit.org/show_bug.cgi?id=78282
+
+        This patch removes any accesss to the NSPasteboard object from the Pasteboard class which
+        now makes use of a new pasteboardStrategy object that is implemented both in WebKit and
+        WebKit2. The actual access to NSPasteboard is now performed inside the PlatformPasteboard
+        class. Currently both WebKit and WebKit2 use the same implementation of the PasteboardStrategy
+        interface but this one more step in the direction of removing access to NSPasteboard from
+        the WebProcess.
+        As part of the refactoring the I've reduced to a minimum the use of OBJ-C classes.
+        
+        Reviewed by Anders Carlsson.
+
+        No new tests. No change in behavior, just code refactoring.
+
+        * WebCore.exp.in: Added exported class PlatformPasteboard.
+        * WebCore.xcodeproj/project.pbxproj: Added new files to the build.
+        * editing/mac/EditorMac.mm:
+        (WebCore::Editor::writeSelectionToPasteboard): New method signature that doesn't use OBJ-C types.
+        * platform/Pasteboard.h:
+
+        * platform/PasteboardStrategy.h: Added PasteboardStrategy abstract class.
+        * platform/PlatformPasteboard.h: Added. This class implements access to NSPasteboard.
+        * platform/PlatformStrategies.h:
+        (WebCore::PlatformStrategies::pasteboardStrategy): Added.
+        * platform/mac/DragDataMac.mm:
+        (WebCore::DragData::canSmartReplace):
+        (WebCore::insertablePasteboardTypes): 
+        (WebCore::DragData::asURL):
+        * platform/mac/PasteboardMac.mm:
+        (WebCore::selectionPasteboardTypes): Changed to use Vector<String> instead of NSArray.
+        (WebCore::writableTypesForURL): Ditto.
+        (WebCore::createWritableTypesForImage): Ditto.
+        (WebCore::writableTypesForImage): Ditto.
+        (WebCore::Pasteboard::Pasteboard): Removed access to NSPasteboard.
+        (WebCore::Pasteboard::clear): Modified to use platformStrategies()->pasteboardStrategy().
+        (WebCore::Pasteboard::writeSelectionForTypes): Ditto.
+        (WebCore::Pasteboard::writePlainText): Ditto.
+        (WebCore::Pasteboard::writeSelection): Ditto.
+        (WebCore::writeURLForTypes): Ditto.
+        (WebCore::Pasteboard::writeURL): Ditto.
+        (WebCore::writeFileWrapperAsRTFDAttachment): Ditto.
+        (WebCore::Pasteboard::writeImage): Ditto.
+        (WebCore::Pasteboard::writeClipboard): Ditto.
+        (WebCore::Pasteboard::canSmartReplace): Ditto.
+        (WebCore::Pasteboard::plainText): Ditto.
+        (WebCore::documentFragmentWithRTF): Ditto.
+        (WebCore::Pasteboard::documentFragment): Ditto.
+        * platform/mac/PlatformPasteboardMac.mm: Added.
+        (WebCore::PlatformPasteboard::PlatformPasteboard):
+        (WebCore::PlatformPasteboard::getTypes):
+        (WebCore::PlatformPasteboard::bufferForType):
+        (WebCore::PlatformPasteboard::getPathnamesForType):
+        (WebCore::PlatformPasteboard::stringForType):
+        (WebCore::PlatformPasteboard::copy):
+        (WebCore::PlatformPasteboard::setTypes):
+        (WebCore::PlatformPasteboard::setBufferForType):
+        (WebCore::PlatformPasteboard::setPathnamesForType):
+        (WebCore::PlatformPasteboard::setStringForType):
+
+2012-02-10  Kentaro Hara  <haraken@chromium.org>
+
+        Rename [JSCustomGetOwnPropertySlotDelegate] to [JSCustomGetOwnPropertySlotAndDescriptor]
+        https://bugs.webkit.org/show_bug.cgi?id=78352
+
+        Reviewed by Adam Barth.
+
+        [JSCustomGetOwnPropertySlotDelegate] is used for "flexibly customizable"
+        named getter. It allows us to write custom code for getOwnPropertySlotDelegate()
+        and getOwnPropertyDescriptorDelegate(). To clarify that, we can rename
+        [JSCustomGetOwnPropertySlotDelegate] to [JSCustomGetOwnPropertySlotAndDescriptor].
+
+        No tests. No change in behavior.
+
+        * bindings/scripts/CodeGeneratorJS.pm:
+        (GenerateGetOwnPropertySlotBody):
+        (GenerateGetOwnPropertyDescriptorBody):
+        (GenerateHeader):
+        (GenerateImplementation):
+
+        * html/HTMLAppletElement.idl:
+        * html/HTMLEmbedElement.idl:
+        * html/HTMLObjectElement.idl:
+        * page/History.idl:
+        * page/Location.idl:
+        * workers/WorkerContext.idl:
+
+2012-02-10  Anders Carlsson  <andersca@apple.com>
+
+        Minor ScrollAnimatorMac cleanup
+        https://bugs.webkit.org/show_bug.cgi?id=78375
+
+        Reviewed by Beth Dakin.
+
+        Get rid of adjustScrollXPositionIfNecessary and adjustScrollYPositionIfNecessary.
+        Also, reduce nesting in willAdd/didAdd functions by using early returns.
+
+        * platform/mac/ScrollAnimatorMac.h:
+        (ScrollAnimatorMac):
+        * platform/mac/ScrollAnimatorMac.mm:
+        (WebCore::ScrollAnimatorMac::didAddVerticalScrollbar):
+        (WebCore::ScrollAnimatorMac::willRemoveVerticalScrollbar):
+        (WebCore::ScrollAnimatorMac::didAddHorizontalScrollbar):
+        (WebCore::ScrollAnimatorMac::willRemoveHorizontalScrollbar):
+        (WebCore::ScrollAnimatorMac::immediateScrollBy):
+
+2012-02-10  Anders Carlsson  <andersca@apple.com>
+
+        Minor ScrollableArea cleanup
+        https://bugs.webkit.org/show_bug.cgi?id=78372
+
+        Reviewed by Beth Dakin.
+
+        Get rid of scrollToXOffsetWithoutAnimation and scrollToYOffsetWithoutAnimation.
+
+        * platform/ScrollableArea.cpp:
+        (WebCore::ScrollableArea::scrollToOffsetWithoutAnimation):
+        * platform/ScrollableArea.h:
+        * rendering/RenderListBox.cpp:
+        (WebCore::RenderListBox::computeLogicalHeight):
+        (WebCore::RenderListBox::scrollToRevealElementAtListIndex):
+        (WebCore::RenderListBox::setScrollTop):
+
+2012-02-10  Benjamin Poulain  <bpoulain@apple.com>
+
+        [Mac] DYLIB_INSTALL_NAME_BASE should not be prefixed by the SDKROOT
+        https://bugs.webkit.org/show_bug.cgi?id=78320
+
+        Reviewed by Joseph Pecoraro.
+
+        <rdar://problem/10839750>
+
+        * Configurations/WebCore.xcconfig:
+
+2012-02-10  Anders Carlsson  <andersca@apple.com>
+
+        Update the non-fast-scrollable region for subframe layout as well
+        https://bugs.webkit.org/show_bug.cgi?id=78366
+        <rdar://problem/10844064>
+
+        Reviewed by Beth Dakin.
+
+        * page/scrolling/ScrollingCoordinator.cpp:
+        (WebCore::computeNonFastScrollableRegion):
+        Move the non-fast-scrollable region computation out into a new function.
+
+        (WebCore::ScrollingCoordinator::frameViewLayoutUpdated):
+        Always recompute the non-fast-scrollable region whenever a frame view's layout is updated,
+        not just the main frame.
+
+2012-02-09  Chris Marrin  <cmarrin@apple.com>
+
+        Implement hardware animation of CSS filters
+        https://bugs.webkit.org/show_bug.cgi?id=78155
+
+        Added logic to PlatformCAAnimation to return enough information
+        to GraphicsLayerCA to be able to construct a keyPath animation
+        for each filter property. Some filters need to animate multiple
+        properties per filter, so PlatformCAAnimation also returns the number
+        of properties per filter and then an animation is constructed for 
+        each one. Also added all the support logic to handle hardware filter
+        animation in the higher level logic, just like we do for transforms and
+        opacity.
+
+        Also stubbed out new PlatformCAAnimation functions for Windows. We don't yet
+        support hardware filters on Windows.
+
+        Reviewed by Dean Jackson.
+
+        Tests: css3/filters/filter-animation-from-none-hw.html
+               css3/filters/filter-animation-from-none-multi-hw.html
+               css3/filters/filter-animation-from-none-multi.html
+               css3/filters/filter-animation-hw.html
+               css3/filters/filter-animation-multi-hw.html
+               css3/filters/filter-animation-multi.html
+
+        * page/animation/AnimationBase.cpp:
+        (WebCore):
+        (PropertyWrapperAcceleratedFilter):
+        (WebCore::PropertyWrapperAcceleratedFilter::PropertyWrapperAcceleratedFilter):
+        (WebCore::PropertyWrapperAcceleratedFilter::animationIsAccelerated):
+        (WebCore::PropertyWrapperAcceleratedFilter::blend):
+        (WebCore::AnimationBase::ensurePropertyMap):
+        * platform/graphics/GraphicsLayer.cpp:
+        (WebCore):
+        (WebCore::filterOperationsAt):
+        (WebCore::GraphicsLayer::validateFilterOperations):
+        * platform/graphics/GraphicsLayer.h:
+        (WebCore):
+        (FilterAnimationValue):
+        (WebCore::FilterAnimationValue::FilterAnimationValue):
+        (WebCore::FilterAnimationValue::clone):
+        (WebCore::FilterAnimationValue::value):
+        (GraphicsLayer):
+        * platform/graphics/GraphicsLayerClient.h:
+        * platform/graphics/ca/GraphicsLayerCA.cpp:
+        (WebCore::propertyIdToString):
+        (WebCore::GraphicsLayerCA::moveOrCopyAnimations):
+        (WebCore::GraphicsLayerCA::addAnimation):
+        (WebCore::GraphicsLayerCA::ensureStructuralLayer):
+        (WebCore::GraphicsLayerCA::createAnimationFromKeyframes):
+        (WebCore::GraphicsLayerCA::appendToUncommittedAnimations):
+        (WebCore):
+        (WebCore::GraphicsLayerCA::createFilterAnimationsFromKeyframes):
+        (WebCore::GraphicsLayerCA::createBasicAnimation):
+        (WebCore::GraphicsLayerCA::createKeyframeAnimation):
+        (WebCore::GraphicsLayerCA::setFilterAnimationEndpoints):
+        (WebCore::GraphicsLayerCA::setFilterAnimationKeyframes):
+        (WebCore::GraphicsLayerCA::swapFromOrToTiledLayer):
+        (WebCore::GraphicsLayerCA::cloneLayer):
+        * platform/graphics/ca/GraphicsLayerCA.h:
+        (GraphicsLayerCA):
+        * platform/graphics/ca/PlatformCAAnimation.h:
+        (PlatformCAAnimation):
+        * platform/graphics/ca/mac/PlatformCAAnimationMac.mm:
+        (PlatformCAAnimation::setFromValue):
+        (PlatformCAAnimation::setToValue):
+        (PlatformCAAnimation::setValues):
+        (PlatformCAAnimation::numAnimatedFilterProperties):
+        (PlatformCAAnimation::animatedFilterPropertyName):
+        * platform/graphics/ca/win/PlatformCAAnimationWin.cpp:
+        (PlatformCAAnimation::setFromValue):
+        (PlatformCAAnimation::setToValue):
+        (PlatformCAAnimation::setValues):
+        (PlatformCAAnimation::numAnimatedFilterProperties):
+        (PlatformCAAnimation::animatedFilterPropertyName):
+        * platform/graphics/filters/FilterOperation.h:
+        (FilterOperation):
+        (WebCore::FilterOperation::isDefault):
+        (DefaultFilterOperation):
+        (WebCore::DefaultFilterOperation::create):
+        (WebCore::DefaultFilterOperation::operator==):
+        (WebCore::DefaultFilterOperation::isDefault):
+        (WebCore::DefaultFilterOperation::DefaultFilterOperation):
+        (WebCore):
+        * rendering/RenderLayer.h:
+        (WebCore::RenderLayer::hasFilter):
+        (RenderLayer):
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::startAnimation):
+        (WebCore::RenderLayerBacking::startTransition):
+        (WebCore::RenderLayerBacking::graphicsLayerToCSSProperty):
+        (WebCore::RenderLayerBacking::cssToGraphicsLayerProperty):
+
+2012-02-10  Peter Rybin  <peter.rybin@gmail.com>
+
+        Web Inspector: CodeGeneratorInspector.py: properly resolve output types of commands
+        https://bugs.webkit.org/show_bug.cgi?id=78025
+
+        Reviewed by Vsevolod Vlasov.
+
+        Code for generating ad-hoc types is added. It was reused from event
+        generator part.
+
+        * inspector/CodeGeneratorInspector.py:
+        (Generator.process_event):
+        (Generator.process_command):
+        (Generator.resolve_type_and_generate_ad_hoc):
+        (Generator.resolve_type_and_generate_ad_hoc.AdHocTypeContext):
+        (Generator.resolve_type_and_generate_ad_hoc.AdHocTypeContext.get_type_name_fix):
+        (Generator.resolve_type_and_generate_ad_hoc.AdHocTypeContext.get_type_name_fix.NameFix):
+        (Generator.resolve_type_and_generate_ad_hoc.AdHocTypeContext.get_type_name_fix.NameFix.output_comment):
+        (Generator.resolve_type_and_generate_ad_hoc.AdHocTypeContext.add_type):
+        (Generator.resolve_type_and_generate_ad_hoc.InterfaceForwardListener):
+        (Generator.resolve_type_and_generate_ad_hoc.InterfaceForwardListener.add_type_data):
+        (Generator.resolve_type_and_generate_ad_hoc.InterfaceResolveContext):
+        (Generator.resolve_type_and_generate_ad_hoc.InterfaceGenerateContext):
+        (Generator):
+
+2012-02-10  Kentaro Hara  <haraken@chromium.org>
+
+        Rename [CustomPropertyNames] to [CustomEnumerateProperty]
+        https://bugs.webkit.org/show_bug.cgi?id=78351
+
+        Reviewed by Adam Barth.
+
+        This patch renames [CustomPropertyNames] to [CustomEnumerateProperty],
+        for clarification and for naming consistency with [CustomDeleteProperty].
+
+        No tests. No change in behavior.
+
+        * bindings/scripts/CodeGeneratorJS.pm:
+        (GenerateHeader):
+        (GenerateImplementation):
+        * bindings/scripts/CodeGeneratorV8.pm:
+        (GenerateHeaderNamedAndIndexedPropertyAccessors):
+        (GenerateImplementationNamedPropertyGetter):
+
+        * css/CSSStyleDeclaration.idl:
+        * dom/DOMStringMap.idl:
+        * page/DOMWindow.idl:
+        * page/History.idl:
+        * page/Location.idl:
+        * storage/Storage.idl:
+
+2012-02-09  Antti Koivisto  <antti@apple.com>
+
+        Use underlying property set to refcount PropertySetCSSStyleDeclaration
+        https://bugs.webkit.org/show_bug.cgi?id=78257
+
+        Reviewed by Andreas Kling.
+
+        Clean up the PropertySetCSSStyleDeclaration refcounting. PropertySetCSSStyleDeclaration now
+        forwards the ref/deref to the underlying StylePropertySet.
+
+        Also made CSSComputedStyleDeclaration construction use the standard create() pattern.
+
+        * css/CSSComputedStyleDeclaration.cpp:
+        (WebCore::CSSComputedStyleDeclaration::ref):
+        (WebCore):
+        (WebCore::CSSComputedStyleDeclaration::deref):
+        * css/CSSComputedStyleDeclaration.h:
+        (WebCore::CSSComputedStyleDeclaration::create):
+        (CSSComputedStyleDeclaration):
+        (WebCore):
+        * css/CSSStyleDeclaration.h:
+        (CSSStyleDeclaration):
+        * css/StylePropertySet.cpp:
+        (WebCore::PropertySetCSSStyleDeclaration::PropertySetCSSStyleDeclaration):
+        (WebCore):
+        (WebCore::StylePropertySet::~StylePropertySet):
+        (WebCore::StylePropertySet::ensureCSSStyleDeclaration):
+        (WebCore::PropertySetCSSStyleDeclaration::makeMutable):
+        * css/StylePropertySet.h:
+        * editing/ApplyStyleCommand.cpp:
+        (WebCore::ApplyStyleCommand::splitAncestorsWithUnicodeBidi):
+        (WebCore::ApplyStyleCommand::removeEmbeddingUpToEnclosingBlock):
+        (WebCore::highestEmbeddingAncestor):
+        (WebCore::ApplyStyleCommand::computedFontSize):
+        * editing/EditingStyle.cpp:
+        (WebCore::EditingStyle::init):
+        (WebCore::EditingStyle::removeStyleAddedByNode):
+        (WebCore::EditingStyle::removeStyleConflictingWithStyleOfNode):
+        (WebCore::EditingStyle::triStateOfStyle):
+        (WebCore::EditingStyle::styleIsPresentInComputedStyleOfNode):
+        (WebCore::EditingStyle::mergeStyleFromRulesForSerialization):
+        (WebCore::backgroundColorInEffect):
+        * editing/Editor.cpp:
+        (WebCore::Editor::textDirectionForSelection):
+        * inspector/InspectorCSSAgent.cpp:
+        (WebCore::InspectorCSSAgent::getComputedStyleForNode):
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::getComputedStyle):
+        * svg/SVGAnimateElement.cpp:
+        (WebCore::getPropertyValue):
+        * svg/animation/SMILTimeContainer.cpp:
+        (WebCore::SMILTimeContainer::baseValueFor):
+
+2012-02-10  Alexander Pavlov  <apavlov@chromium.org>
+
+        Web Inspector: [TextPrompt] TAB should complete suggestions up to their common prefix in Console
+        https://bugs.webkit.org/show_bug.cgi?id=78236
+
+        Reviewed by Vsevolod Vlasov.
+
+        * inspector/front-end/TextPrompt.js:
+        (WebInspector.TextPrompt.prototype._completionsReady):
+        (WebInspector.TextPrompt.prototype._completeCommonPrefix):
+        (WebInspector.TextPrompt.prototype.acceptSuggestion):
+        (WebInspector.TextPrompt.prototype.tabKeyPressed):
+
+2012-02-10  Pavel Feldman  <pfeldman@google.com>
+
+        Web Inspector: implement undo for setOuterHTML via undo-ing nested primitive commands.
+        https://bugs.webkit.org/show_bug.cgi?id=78346
+
+        Reviewed by Yury Semikhatsky.
+
+        Tests: inspector/elements/undo-set-outer-html-2.html
+               inspector/elements/undo-set-outer-html.html
+
+        * inspector/DOMEditor.cpp:
+        (WebCore::DOMEditor::RemoveChildAction::RemoveChildAction):
+        (WebCore::DOMEditor::InsertBeforeAction::InsertBeforeAction):
+        (WebCore::DOMEditor::InsertBeforeAction::undo):
+        (WebCore::DOMEditor::RemoveAttributeAction::RemoveAttributeAction):
+        (WebCore::DOMEditor::SetAttributeAction::SetAttributeAction):
+        (WebCore::DOMEditor::SetOuterHTMLAction::SetOuterHTMLAction):
+        (WebCore::DOMEditor::SetOuterHTMLAction::perform):
+        (WebCore::DOMEditor::SetOuterHTMLAction::undo):
+        (DOMEditor::SetOuterHTMLAction):
+        (WebCore::DOMEditor::ReplaceWholeTextAction::ReplaceWholeTextAction):
+        (DOMEditor::ReplaceChildNodeAction):
+        (WebCore::DOMEditor::ReplaceChildNodeAction::ReplaceChildNodeAction):
+        (WebCore::DOMEditor::ReplaceChildNodeAction::perform):
+        (WebCore::DOMEditor::ReplaceChildNodeAction::undo):
+        (WebCore):
+        (DOMEditor::SetNodeValueAction):
+        (WebCore::DOMEditor::SetNodeValueAction::SetNodeValueAction):
+        (WebCore::DOMEditor::SetNodeValueAction::perform):
+        (WebCore::DOMEditor::SetNodeValueAction::undo):
+        (WebCore::DOMEditor::insertBefore):
+        (WebCore::DOMEditor::removeChild):
+        (WebCore::DOMEditor::setAttribute):
+        (WebCore::DOMEditor::removeAttribute):
+        (WebCore::DOMEditor::setOuterHTML):
+        (WebCore::DOMEditor::replaceWholeText):
+        (WebCore::DOMEditor::replaceChild):
+        (WebCore::DOMEditor::setNodeValue):
+        (WebCore::populateErrorString):
+        * inspector/DOMEditor.h:
+        (DOMEditor):
+        * inspector/DOMPatchSupport.cpp:
+        (WebCore::DOMPatchSupport::patchDocument):
+        (WebCore):
+        (WebCore::DOMPatchSupport::DOMPatchSupport):
+        (WebCore::DOMPatchSupport::patchNode):
+        (WebCore::DOMPatchSupport::innerPatchNode):
+        (WebCore::DOMPatchSupport::innerPatchChildren):
+        (WebCore::DOMPatchSupport::insertBeforeAndMarkAsUsed):
+        (WebCore::DOMPatchSupport::removeChildAndMoveToNew):
+        * inspector/DOMPatchSupport.h:
+        (WebCore):
+        (DOMPatchSupport):
+        * inspector/InspectorCSSAgent.cpp:
+        (WebCore::InspectorCSSAgent::StyleSheetAction::perform):
+        (WebCore::InspectorCSSAgent::StyleSheetAction::undo):
+        (InspectorCSSAgent::StyleSheetAction):
+        (WebCore::InspectorCSSAgent::SetStyleSheetTextAction::perform):
+        (WebCore::InspectorCSSAgent::SetStyleSheetTextAction::undo):
+        (WebCore::InspectorCSSAgent::SetPropertyTextAction::perform):
+        (WebCore::InspectorCSSAgent::SetPropertyTextAction::undo):
+        (WebCore::InspectorCSSAgent::TogglePropertyAction::perform):
+        (WebCore::InspectorCSSAgent::TogglePropertyAction::undo):
+        (WebCore::InspectorCSSAgent::setStyleSheetText):
+        (WebCore::InspectorCSSAgent::setPropertyText):
+        (WebCore::InspectorCSSAgent::toggleProperty):
+        (WebCore::InspectorCSSAgent::assertStyleSheetForId):
+        * inspector/InspectorDOMAgent.cpp:
+        (WebCore::InspectorDOMAgent::toErrorString):
+        (WebCore):
+        (WebCore::InspectorDOMAgent::setAttributesAsText):
+        (WebCore::InspectorDOMAgent::setOuterHTML):
+        (WebCore::InspectorDOMAgent::undo):
+        * inspector/InspectorDOMAgent.h:
+        (InspectorDOMAgent):
+        * inspector/InspectorHistory.cpp:
+        (WebCore::InspectorHistory::perform):
+        (WebCore::InspectorHistory::undo):
+        * inspector/InspectorHistory.h:
+        (WebCore):
+        (Action):
+        (InspectorHistory):
+        * inspector/InspectorPageAgent.cpp:
+        (WebCore::InspectorPageAgent::setDocumentContent):
+        * inspector/InspectorStyleSheet.cpp:
+        (WebCore::InspectorStyle::setPropertyText):
+        (WebCore::InspectorStyle::toggleProperty):
+        (WebCore::InspectorStyleSheet::setPropertyText):
+        (WebCore::InspectorStyleSheet::toggleProperty):
+        * inspector/InspectorStyleSheet.h:
+        (InspectorStyle):
+        (InspectorStyleSheet):
+
+2012-02-10  Kentaro Hara  <haraken@chromium.org>
+
+        Replace [CustomArgumentHandling] with [CallWith=ScriptArguments|CallStack]
+        https://bugs.webkit.org/show_bug.cgi?id=78327
+
+        Reviewed by Adam Barth.
+
+        This patch replaces [CustomArgumentHandling] with [CallWith=ScriptArguments|CallStack],
+        and removes [CustomArgumentHandling].
+
+        Test: bindings/scripts/test/TestObj.idl
+
+        * bindings/scripts/CodeGeneratorJS.pm: Modified to replace
+        [CustomArgumentHandling] with [CallWith=ScriptArguments|CallStack].
+        (GenerateCallWith):
+        (GenerateParametersCheck):
+        * bindings/scripts/CodeGeneratorV8.pm: Ditto.
+        (GenerateCallWith):
+        * bindings/scripts/CodeGeneratorGObject.pm: Ditto.
+        (SkipFunction):
+        (GenerateFunction):
+        * bindings/scripts/CodeGeneratorCPP.pm: Simply removed [CustomArgumentHandling]
+        from the skipped list. By this fix, CodeGeneratorCPP.pm will generate
+        meaningless code for attributes or methods which was previously marked as
+        [CustomArgumentHandling], but this change will be harmless.
+        (ShouldSkipType):
+
+        * bindings/v8/custom/V8ConsoleCustom.cpp: Changed the argument order.
+        (WebCore::V8Console::assertCallback):
+        * page/Console.cpp: Ditto.
+        (WebCore::Console::assertCondition):
+        (WebCore::Console::timeEnd):
+        * page/Console.h: Ditto.
+        (Console):
+
+        * bindings/scripts/test/TestObj.idl: Added test cases for [CallWith=ScriptArguments|CallStack].
+
+        * bindings/scripts/test/CPP/WebDOMTestObj.cpp: Updated run-bindings-tests results.
+        (WebDOMTestObj::withScriptArgumentsAndCallStackAttribute):
+        (WebDOMTestObj::setWithScriptArgumentsAndCallStackAttribute):
+        (WebDOMTestObj::withScriptArgumentsAndCallStack):
+        * bindings/scripts/test/CPP/WebDOMTestObj.h:
+        * bindings/scripts/test/GObject/WebKitDOMTestObj.cpp:
+        (webkit_dom_test_obj_with_script_arguments_and_call_stack):
+        (webkit_dom_test_obj_get_with_script_arguments_and_call_stack_attribute):
+        (webkit_dom_test_obj_set_with_script_arguments_and_call_stack_attribute):
+        (webkit_dom_test_obj_get_property):
+        (webkit_dom_test_obj_class_init):
+        * bindings/scripts/test/GObject/WebKitDOMTestObj.h:
+        * bindings/scripts/test/JS/JSTestObj.cpp:
+        (WebCore):
+        (WebCore::jsTestObjWithScriptArgumentsAndCallStackAttribute):
+        (WebCore::setJSTestObjWithScriptArgumentsAndCallStackAttribute):
+        (WebCore::jsTestObjPrototypeFunctionWithScriptArgumentsAndCallStack):
+        * bindings/scripts/test/JS/JSTestObj.h:
+        (WebCore):
+        * bindings/scripts/test/ObjC/DOMTestObj.h:
+        * bindings/scripts/test/ObjC/DOMTestObj.mm:
+        (-[DOMTestObj withScriptArgumentsAndCallStackAttribute]):
+        (-[DOMTestObj setWithScriptArgumentsAndCallStackAttribute:]):
+        (-[DOMTestObj withScriptArgumentsAndCallStack]):
+        * bindings/scripts/test/V8/V8TestObj.cpp:
+        (WebCore::TestObjInternal::withScriptArgumentsAndCallStackAttributeAttrGetter):
+        (TestObjInternal):
+        (WebCore::TestObjInternal::withScriptArgumentsAndCallStackAttributeAttrSetter):
+        (WebCore::TestObjInternal::withScriptArgumentsAndCallStackCallback):
+        (WebCore):
+        (WebCore::ConfigureV8TestObjTemplate):
+
+2012-02-10  Carlos Garcia Campos  <cgarcia@igalia.com>
+
+        [GTK] KURL::fileSystemPath() doesn't work if uri contains #
+        https://bugs.webkit.org/show_bug.cgi?id=78339
+
+        Reviewed by Philippe Normand.
+
+        * platform/gtk/KURLGtk.cpp:
+        (WebCore::KURL::fileSystemPath): Use GFile API instead of
+        g_filename_from_uri() to convert the uri to a local
+        path. g_file_get_path() removes the anchor from the uri and
+        returns a valid path instead of NULL.
+
+2012-02-10  Pablo Flouret  <pablof@motorola.com>
+
+        CodeGeneratorJS doesn't always generate visitChildren() implementation when required
+        https://bugs.webkit.org/show_bug.cgi?id=78336
+
+        Reviewed by Kentaro Hara.
+        
+        In an IDL for an interface that declares no functions, but has
+        attributes with [CachedAttribute], the implementation of visitChildren()
+        is not generated by the JSC code generator.
+
+        * bindings/scripts/CodeGeneratorJS.pm:
+        (GenerateImplementation):
+        * bindings/scripts/test/JS/JSTestSerializedScriptValueInterface.cpp:
+        (WebCore::JSTestSerializedScriptValueInterface::visitChildren):
+        (WebCore):
+
+2012-02-10  Noel Gordon  <noel.gordon@gmail.com>
+
+        [chromium] Increase JPEG decoding performance some more
+        https://bugs.webkit.org/show_bug.cgi?id=78323
+
+        Reviewed by Adam Barth.
+
+        Increase JPEG image decoding speed by another 9% (avg) according to libjpeg-turbo tjbench.
+
+        No new tests. Covered by many existing tests, all requiring subsequent rebaselines.
+
+        * platform/image-decoders/jpeg/JPEGImageDecoder.cpp:
+        (dctMethod): Fast decode on the jpeg-turbo using ports (Chrome Android, Chrome, Chromium).
+        (WebCore::JPEGImageReader::decode): Select DCT method via a helper routine.
+
+2012-02-10  Vsevolod Vlasov  <vsevik@chromium.org>
+
+        Web Inspector: FileSelector should not depend on DebuggerPresentationModel.
+        https://bugs.webkit.org/show_bug.cgi?id=78337
+
+        Reviewed by Pavel Feldman.
+
+        * inspector/front-end/ScriptsNavigator.js:
+        (WebInspector.ScriptsNavigator):
+        (WebInspector.ScriptsNavigator.prototype._showScriptFoldersSettingChanged):
+        (WebInspector.ScriptsNavigator.prototype.reset):
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel.prototype._reset):
+        (WebInspector.ScriptsPanel.FileSelector.prototype.replaceUISourceCodes):
+        (WebInspector.ScriptsPanel.FileSelector.prototype.reset):
+        (WebInspector.ScriptsPanel.ComboBoxFileSelector):
+        (WebInspector.ScriptsPanel.ComboBoxFileSelector.prototype.reset):
+
+2012-02-10  Kentaro Hara  <haraken@chromium.org>
+
+        Remove [ConvertingNullStringTo] from CloseEvent.idl
+        https://bugs.webkit.org/show_bug.cgi?id=78328
+
+        Reviewed by Adam Barth.
+
+        In CloseEvent.idl, [ConvertingNullStringTo] is a typo of [ConvertNullStringTo],
+        (although in bug 78108, [ConvertNullStringTo] was renamed to [TreatReturnedNullStringAs]).
+
+        Anyway, the spec says that "The reason attribute must return the value it was
+        initialized to. When the object is created, this attribute must be initialized to empty string."
+        http://dev.w3.org/html5/websockets/#event-definitions
+        Thus, this patch removes [ConvertingNullStringTo] from CloseEvent.idl.
+
+        Test: fast/events/constructors/close-event-constructor.html
+
+        * websockets/CloseEvent.idl:
+
+2012-02-10  Pavel Feldman  <pfeldman@google.com>
+
+        [Qt] REGRESSION(r107242): It made 5 inspector tests crash in debug mode
+        https://bugs.webkit.org/show_bug.cgi?id=78330
+
+        Reviewed by Yury Semikhatsky.
+
+        * inspector/DOMPatchSupport.cpp:
+        (WebCore::DOMPatchSupport::innerPatchChildren):
+
+2012-02-09  Andrey Kosyakov  <caseq@chromium.org>
+
+        Web Inspector: [refactoring] TimelineModel should not depend on TimelinePanel
+        https://bugs.webkit.org/show_bug.cgi?id=78254
+
+        Reviewed by Yury Semikhatsky.
+
+        * inspector/front-end/TimelinePanel.js:
+        (WebInspector.TimelinePanel):
+        (WebInspector.TimelinePanel.prototype._loadFromFile):
+        (WebInspector.TimelinePanel.prototype._toggleTimelineButtonClicked):
+        (WebInspector.TimelinePanel.prototype._onTimelineEventRecorded):
+        (WebInspector.TimelinePanel.prototype._clearPanel):
+        (WebInspector.TimelinePanel.prototype._onRecordsCleared):
+        (WebInspector.TimelineModel):
+        (WebInspector.TimelineModel.prototype.startRecord):
+        (WebInspector.TimelineModel.prototype.stopRecord):
+        (WebInspector.TimelineModel.prototype._onRecordAdded):
+        (WebInspector.TimelineModel.prototype._addRecord):
+        (WebInspector.TimelineModel.prototype._loadNextChunk):
+        (WebInspector.TimelineModel.prototype._loadFromFile):
+        (WebInspector.TimelineModel.prototype._reset):
+
+2012-02-09  Kentaro Hara  <haraken@chromium.org>
+
+        Unreviewed, rolling out r107368.
+        http://trac.webkit.org/changeset/107368
+        https://bugs.webkit.org/show_bug.cgi?id=78327
+
+        break GTK build
+
+        * bindings/scripts/CodeGeneratorCPP.pm:
+        (ShouldSkipType):
+        * bindings/scripts/CodeGeneratorGObject.pm:
+        (SkipFunction):
+        (GenerateFunction):
+        * bindings/scripts/CodeGeneratorJS.pm:
+        (GenerateCallWith):
+        (GenerateParametersCheck):
+        * bindings/scripts/CodeGeneratorV8.pm:
+        (GenerateFunctionCallback):
+        (GenerateCallWith):
+        (GenerateFunctionCallString):
+        * bindings/scripts/test/CPP/WebDOMTestObj.cpp:
+        * bindings/scripts/test/CPP/WebDOMTestObj.h:
+        * bindings/scripts/test/GObject/WebKitDOMTestObj.cpp:
+        (webkit_dom_test_obj_get_property):
+        (webkit_dom_test_obj_class_init):
+        * bindings/scripts/test/GObject/WebKitDOMTestObj.h:
+        * bindings/scripts/test/JS/JSTestObj.cpp:
+        (WebCore):
+        (WebCore::jsTestObjPrototypeFunctionCustomArgsAndException):
+        * bindings/scripts/test/JS/JSTestObj.h:
+        (WebCore):
+        * bindings/scripts/test/ObjC/DOMTestObj.h:
+        * bindings/scripts/test/ObjC/DOMTestObj.mm:
+        (-[DOMTestObj customArgsAndException:]):
+        * bindings/scripts/test/TestObj.idl:
+        * bindings/scripts/test/V8/V8TestObj.cpp:
+        (WebCore::TestObjInternal::customArgsAndExceptionCallback):
+        (TestObjInternal):
+        (WebCore):
+        (WebCore::ConfigureV8TestObjTemplate):
+        * bindings/v8/custom/V8ConsoleCustom.cpp:
+        (WebCore::V8Console::assertCallback):
+        * page/Console.cpp:
+        (WebCore::Console::assertCondition):
+        (WebCore::Console::timeEnd):
+        * page/Console.h:
+        (Console):
+        * page/Console.idl:
+
+2012-02-09  Zoltan Herczeg  <zherczeg@webkit.org>
+
+        Heap-buffer-overflow in WebCore::CSSParser::lex
+        https://bugs.webkit.org/show_bug.cgi?id=77402
+
+        Reviewed by Antti Koivisto.
+
+        Comments should check only a single \0 terminator.
+
+        Test: fast/css/parsing-css-comment.html
+
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::lex):
+
+2012-02-09  Kentaro Hara  <haraken@chromium.org>
+
+        Replace [CustomArgumentHandling] with [CallWith=ScriptArguments|CallStack]
+        https://bugs.webkit.org/show_bug.cgi?id=78327
+
+        Reviewed by Adam Barth.
+
+        This patch replaces [CustomArgumentHandling] with [CallWith=ScriptArguments|CallStack],
+        and removes [CustomArgumentHandling].
+
+        Test: bindings/scripts/test/TestObj.idl
+
+        * bindings/scripts/CodeGeneratorJS.pm: Modified to replace
+        [CustomArgumentHandling] with [CallWith=ScriptArguments|CallStack].
+        (GenerateCallWith):
+        (GenerateParametersCheck):
+        * bindings/scripts/CodeGeneratorV8.pm: Ditto.
+        (GenerateCallWith):
+        * bindings/scripts/CodeGeneratorCPP.pm: Simply removed [CustomArgumentHandling]
+        from the skipped list. By this fix, CodeGeneratorCPP.pm will generate
+        meaningless code for attributes or methods which was previously marked as
+        [CustomArgumentHandling], but this change will be harmless.
+        (ShouldSkipType):
+        * bindings/scripts/CodeGeneratorGObject.pm: Ditto.
+        (SkipFunction):
+        (GenerateFunction):
+
+        * bindings/v8/custom/V8ConsoleCustom.cpp: Changed the argument order.
+        (WebCore::V8Console::assertCallback):
+        * page/Console.cpp: Ditto.
+        (WebCore::Console::assertCondition):
+        (WebCore::Console::timeEnd):
+        * page/Console.h: Ditto.
+        (Console):
+
+        * bindings/scripts/test/TestObj.idl: Added test cases for [CallWith=ScriptArguments|CallStack].
+
+        * bindings/scripts/test/CPP/WebDOMTestObj.cpp: Updated run-bindings-tests results.
+        (WebDOMTestObj::withScriptArgumentsAndCallStackAttribute):
+        (WebDOMTestObj::setWithScriptArgumentsAndCallStackAttribute):
+        (WebDOMTestObj::withScriptArgumentsAndCallStack):
+        * bindings/scripts/test/CPP/WebDOMTestObj.h:
+        * bindings/scripts/test/GObject/WebKitDOMTestObj.cpp:
+        (webkit_dom_test_obj_with_script_arguments_and_call_stack):
+        (webkit_dom_test_obj_get_with_script_arguments_and_call_stack_attribute):
+        (webkit_dom_test_obj_set_with_script_arguments_and_call_stack_attribute):
+        (webkit_dom_test_obj_get_property):
+        (webkit_dom_test_obj_class_init):
+        * bindings/scripts/test/GObject/WebKitDOMTestObj.h:
+        * bindings/scripts/test/JS/JSTestObj.cpp:
+        (WebCore):
+        (WebCore::jsTestObjWithScriptArgumentsAndCallStackAttribute):
+        (WebCore::setJSTestObjWithScriptArgumentsAndCallStackAttribute):
+        (WebCore::jsTestObjPrototypeFunctionWithScriptArgumentsAndCallStack):
+        * bindings/scripts/test/JS/JSTestObj.h:
+        (WebCore):
+        * bindings/scripts/test/ObjC/DOMTestObj.h:
+        * bindings/scripts/test/ObjC/DOMTestObj.mm:
+        (-[DOMTestObj withScriptArgumentsAndCallStackAttribute]):
+        (-[DOMTestObj setWithScriptArgumentsAndCallStackAttribute:]):
+        (-[DOMTestObj withScriptArgumentsAndCallStack]):
+        * bindings/scripts/test/V8/V8TestObj.cpp:
+        (WebCore::TestObjInternal::withScriptArgumentsAndCallStackAttributeAttrGetter):
+        (TestObjInternal):
+        (WebCore::TestObjInternal::withScriptArgumentsAndCallStackAttributeAttrSetter):
+        (WebCore::TestObjInternal::withScriptArgumentsAndCallStackCallback):
+        (WebCore):
+        (WebCore::ConfigureV8TestObjTemplate):
+
+2012-02-09  Adam Barth  <abarth@webkit.org>
+
+        Dromaeo/dom-traverse.html should go fast
+        https://bugs.webkit.org/show_bug.cgi?id=78307
+
+        Reviewed by Eric Seidel.
+
+        This patch improves Dromaeo/dom-traverse.html by roughly 2.5% by
+        removing a branch.  Previously, we null-checked the result of
+        V8DOMWrapper::getWrapper in a hot code path, but the only case where we
+        return a non-empty wrapper comes from a cold code path.  By pushing the
+        null check into the cold codepath, we eliminate the branch from the
+        hot code path.
+
+        This patch also annotates the branches in the hot code path with their
+        likely outcome.  I didn't measure a statistically significant
+        improvement with that aspect of the change, but it seems worthwhile.
+
+        * bindings/scripts/CodeGeneratorV8.pm:
+        (GenerateHeader):
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::getExistingWrapperInline):
+        (WebCore):
+        (WebCore::V8DOMWrapper::getExistingWrapperSlow):
+        (WebCore::V8DOMWrapper::getWrapperSlow):
+        * bindings/v8/V8DOMWrapper.h:
+        (WebCore::V8DOMWrapper::getExistingWrapper):
+        (V8DOMWrapper):
+        (WebCore::V8DOMWrapper::getWrapper):
+        * bindings/v8/custom/V8NodeCustom.cpp:
+        (WebCore::toV8Slow):
+
+2012-02-09  Emil A Eklund  <eae@chromium.org>
+
+        Convert Frame/FrameView to LayoutUnits in preparation for turning on subpixel layout
+        https://bugs.webkit.org/show_bug.cgi?id=78311
+
+        Reviewed by Eric Seidel.
+
+        No new tests, no new functionality.
+
+        * page/Frame.cpp:
+        (WebCore::Frame::nodeImage):
+        Pixel snap painting rect for image to ensure that it is painted aligned
+        to device pixels. This avoids avoid unwanted anti-aliasing.
+
+        * page/FrameView.cpp:
+        (WebCore::FrameView::windowClipRectForLayer):
+        Pixel snap clip rects as all window coordinates and sizes are exposed as
+        integers.
+
+        * page/GestureTapHighlighter.cpp:
+        * page/Page.cpp:
+        (WebCore::Page::addRelevantRepaintedObject):
+        As the painting is done aligned on pixel boundaries we need to pixel snap
+        the view rect when checking if it intersects the objects paint rect.
+
+        * page/mac/FrameMac.mm:
+        (WebCore::Frame::snapshotDragImage):
+        (WebCore::Frame::nodeImage):
+        Pixel snap painting rect for image to ensure that it is painted aligned
+        to device pixels. This avoids avoid unwanted anti-aliasing.
+
+        * page/win/FrameCGWin.cpp:
+        (WebCore::Frame::nodeImage):
+        Pixel snap painting rect for image to ensure that it is painted aligned
+        to device pixels. This avoids avoid unwanted anti-aliasing.
+
+        * rendering/LayoutTypes.h:
+        (WebCore::pixelSnappedIntRect):
+        (WebCore):
+        No-op implementation of pixelSnappedIntRect for now.
+
+2012-02-09  Kenichi Ishibashi  <bashi@chromium.org>
+
+        Add WebSocket extension support
+        https://bugs.webkit.org/show_bug.cgi?id=78079
+
+        This patch introduces WebSocketExtensionDispatcher class, which creates client's
+        Sec-WebSocket-Extensions header field and parses the server response.
+        This patch doesn't add any actual extension, so no changes in behavior.
+
+        Reviewed by Kent Tamura.
+
+        No new tests except for chromium port.
+
+        * CMakeLists.txt: Added WebSocketExtensionDispatcher.(cpp|h) and WebSocketExtensionProcessor.h.
+        * GNUmakefile.list.am: Ditto.
+        * Target.pri: Ditto.
+        * WebCore.gypi: Ditto.
+        * WebCore.vcproj/WebCore.vcproj: Ditto.
+        * WebCore.xcodeproj/project.pbxproj: Ditto.
+        * websockets/WebSocketExtensionDispatcher.cpp: Added.
+        (WebCore):
+        (ExtensionParser):
+        (WebCore::ExtensionParser::ExtensionParser):
+        (WebCore::ExtensionParser::currentToken):
+        (WebCore::ExtensionParser::finished):
+        (WebCore::ExtensionParser::parsedSuccessfully):
+        (WebCore::isTokenCharacter):
+        (WebCore::isSeparator):
+        (WebCore::ExtensionParser::skipSpaces):
+        (WebCore::ExtensionParser::consumeToken):
+        (WebCore::ExtensionParser::consumeQuotedString):
+        (WebCore::ExtensionParser::consumeQuotedStringOrToken):
+        (WebCore::ExtensionParser::consumeCharacter):
+        (WebCore::WebSocketExtensionDispatcher::reset):
+        (WebCore::WebSocketExtensionDispatcher::addProcessor):
+        (WebCore::WebSocketExtensionDispatcher::createHeaderValue):
+        (WebCore::WebSocketExtensionDispatcher::processHeaderValue):
+        (WebCore::WebSocketExtensionDispatcher::failureReason):
+        * websockets/WebSocketExtensionDispatcher.h: Added.
+        (WebCore):
+        (WebSocketExtensionDispatcher):
+        (WebCore::WebSocketExtensionDispatcher::WebSocketExtensionDispatcher):
+        * websockets/WebSocketExtensionProcessor.h: Added.
+        (WebCore):
+        (WebSocketExtensionProcessor):
+        (WebCore::WebSocketExtensionProcessor::~WebSocketExtensionProcessor):
+        (WebCore::WebSocketExtensionProcessor::extensionToken):
+        (WebCore::WebSocketExtensionProcessor::failureReason):
+        (WebCore::WebSocketExtensionProcessor::WebSocketExtensionProcessor):
+        * websockets/WebSocketHandshake.cpp:
+        (WebCore::WebSocketHandshake::clientHandshakeMessage): Adds extension header value if exists.
+        (WebCore::WebSocketHandshake::clientHandshakeRequest): Ditto.
+        (WebCore::WebSocketHandshake::reset): Resets WebSocketExtensionDispatcher object.
+        (WebCore::WebSocketHandshake::serverHandshakeResponse): Removed.
+        (WebCore::WebSocketHandshake::addExtensionProcessor): Added.
+        (WebCore::WebSocketHandshake::readHTTPHeaders): Parses and checks every time Sec-WebSocket-Extensions header appears.
+        (WebCore::WebSocketHandshake::checkResponseHeaders): Removed the check of Sec-WebSocket-Extensions.
+        * websockets/WebSocketHandshake.h: Removed serverHandshakeResponse().
+
+2012-02-09  Xianzhu Wang  <wangxianzhu@chromium.org>
+
+        Avoid compositing invisible fixed positioned elements
+        https://bugs.webkit.org/show_bug.cgi?id=78186
+
+        Reviewed by James Robinson.
+
+        Test: compositing/layer-creation/fixed-position-out-of-view.html
+
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::requiresCompositingForPosition):
+
+2012-02-09  Timothy Hatcher  <timothy@apple.com>
+
+        Prevent attaching when inspecting the Web Inspector.
+
+        https://webkit.org/b/78304
+
+        Reviewed by Brian Weinstein.
+
+        * inspector/InspectorFrontendClientLocal.cpp:
+        (WebCore::InspectorFrontendClientLocal::canAttachWindow): Prevent attaching when the page is an inspector page.
+
+2012-02-09  Dana Jansens  <danakj@chromium.org>
+
+        [Chromium] Assertion failure minX <= maxX in Region.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=78038
+
+        Reviewed by James Robinson.
+
+        Covered by existing tests (should make them stop asserting).
+
+        Clamp sizes for composited layers coming out of WebCore to make sure they are valid non-negative values.
+
+        * platform/graphics/chromium/GraphicsLayerChromium.cpp:
+        (WebCore::GraphicsLayerChromium::setSize):
+
+2012-02-09  Gregg Tavares  <gman@google.com>
+
+        Make WebGLRenderingContext::printWarningToConsole safer
+        https://bugs.webkit.org/show_bug.cgi?id=78284
+
+        Reviewed by Kenneth Russell.
+
+        No new tests because no change in functionality.
+
+        * html/canvas/WebGLRenderingContext.cpp:
+        (WebCore):
+        (WebCore::WebGLRenderingContext::printWarningToConsole):
+
+2012-02-09  W. James MacLean  <wjmaclean@chromium.org>
+
+        [chromium] Add support for starting page/scale animations on CC impl thread from WebViewImpl
+        https://bugs.webkit.org/show_bug.cgi?id=77872
+
+        Reviewed by James Robinson.
+
+        Added unit test.
+
+        Provides a pathway to invoke CCLayerTreeHostImpl::startPageScaleAnimation() from
+        WebViewImpl. This is intended to support scale and scroll animations, such as WebInputEvent::GestureDoubleTap.
+
+        * platform/CrossThreadCopier.h:
+        (WebCore):
+        * platform/graphics/chromium/cc/CCLayerTreeHost.cpp:
+        (WebCore::CCLayerTreeHost::startPageScaleAnimation):
+        * platform/graphics/chromium/cc/CCLayerTreeHost.h:
+        (CCLayerTreeHost):
+        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.h:
+        (CCLayerTreeHostImpl):
+        * platform/graphics/chromium/cc/CCProxy.h:
+        (CCProxy):
+        * platform/graphics/chromium/cc/CCSingleThreadProxy.cpp:
+        (WebCore::CCSingleThreadProxy::startPageScaleAnimation):
+        (WebCore):
+        * platform/graphics/chromium/cc/CCSingleThreadProxy.h:
+        (CCSingleThreadProxy):
+        * platform/graphics/chromium/cc/CCThreadProxy.cpp:
+        (WebCore::CCThreadProxy::startPageScaleAnimation):
+        (WebCore):
+        (WebCore::CCThreadProxy::requestStartPageScaleAnimationOnImplThread):
+        * platform/graphics/chromium/cc/CCThreadProxy.h:
+        (CCThreadProxy):
+
+2012-02-09  Xianzhu Wang  <wangxianzhu@chromium.org>
+
+        [Chromium] TiledLayerChromium::protectVisibleTileTextures() should only protect the visible textures
+        https://bugs.webkit.org/show_bug.cgi?id=78249
+
+        Reviewed by James Robinson.
+
+        * platform/graphics/chromium/TiledLayerChromium.cpp:
+        (WebCore::TiledLayerChromium::protectVisibleTileTextures):
+
+2012-02-09  Hayato Ito  <hayato@chromium.org>
+
+        Add Node::isShadowElement() member function.
+        https://bugs.webkit.org/show_bug.cgi?id=78201
+
+        Reviewed by Dimitri Glazkov.
+
+        No tests. No change in behavior. An upcoming change requires this to detect HTMLShadowElement.
+
+        * dom/Node.h:
+        (Node):
+        (WebCore::Node::isShadowElement):
+        * html/shadow/HTMLShadowElement.h:
+        (WebCore::HTMLShadowElement::isShadowElement):
+
+2012-02-09  Ryosuke Niwa  <rniwa@webkit.org>
+
+        CachedResourceLoader is destroyed before CSSFontSelector is destroyed
+        https://bugs.webkit.org/show_bug.cgi?id=77817
+
+        Reviewed by Adam Barth.
+
+        Explicitly clear style selector before destorying the cached resource loader.
+
+        No new tests but PerformanceTests/Parser/html5-full-render.html was crashing
+        on performance bots due to this bug.
+
+        * dom/Document.cpp:
+        (WebCore::Document::~Document):
+
+2012-02-09  Anders Carlsson  <andersca@apple.com>
+
+        Update the scroll layer position on the main thread when we have slow repaint objects
+        https://bugs.webkit.org/show_bug.cgi?id=78300
+        <rdar://problem/10710754>
+
+        Reviewed by Dan Bernstein.
+
+        When we have slow repaint objects (background-attachment: fixed), we need to update the
+        scroll layer position on the main thread, otherwise the web page will appear to jiggle.
+    
+        * page/FrameView.cpp:
+        (WebCore::FrameView::addSlowRepaintObject):
+        (WebCore::FrameView::removeSlowRepaintObject):
+        Call ScrollingCoordinator::frameViewHasSlowRepaintObjectsDidChange if needed.
+
+        * page/FrameView.h:
+        (WebCore::FrameView::hasSlowRepaintObjects):
+        Add new getter.
+
+        * page/scrolling/ScrollingCoordinator.cpp:
+        (WebCore::ScrollingCoordinator::frameViewHasSlowRepaintObjectsDidChange):
+        Call ScrollingTreeNode::shouldUpdateScrollLayerPositionOnMainThread.
+
+        (WebCore::ScrollingCoordinator::updateMainFrameScrollPositionAndScrollLayerPosition):
+        New function that will update both the main frame scroll position and the scroll layer position.
+
+        * page/scrolling/ScrollingTree.cpp:
+        (WebCore::ScrollingTree::updateMainFrameScrollPositionAndScrollLayerPosition):
+        Dispatch a call to ScrollingCoordinator::updateMainFrameScrollPositionAndScrollLayerPosition on the main thread.
+
+        * page/scrolling/ScrollingTreeNode.cpp:
+        (WebCore::ScrollingTreeNode::ScrollingTreeNode):
+        Initialize m_shouldUpdateScrollLayerPositionOnMainThread.
+
+        (WebCore::ScrollingTreeNode::update):
+        Set m_shouldUpdateScrollLayerPositionOnMainThread.
+
+        * page/scrolling/ScrollingTreeState.cpp:
+        (WebCore::ScrollingTreeState::ScrollingTreeState):
+        Initialize m_shouldUpdateScrollLayerPositionOnMainThread.
+
+        (WebCore::ScrollingTreeState::setShouldUpdateScrollLayerPositionOnMainThread):
+        Update m_shouldUpdateScrollLayerPositionOnMainThread if needed.
+
+        * page/scrolling/mac/ScrollingTreeNodeMac.mm:
+        (WebCore::ScrollingTreeNodeMac::setScrollPosition):
+        Assert that we're not supposed to update the scroll layer position on the main thread.
+
+        (WebCore::ScrollingTreeNodeMac::scrollBy):
+        If we're supposed to update the scroll layer position on the main thread, 
+        call ScrollingTree::updateMainFrameScrollPositionAndScrollLayerPosition.
+
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::frameViewDidScroll):
+        If the frame view has its scrolling coordinated by a scrolling coordinator, don't update the scroll layer position.
+
+2012-02-09  Anders Carlsson  <andersca@apple.com>
+
+        FrameView::addSlowRepaintObject() doesn't update m_canBlitOnScroll correctly
+        https://bugs.webkit.org/show_bug.cgi?id=78291
+
+        Reviewed by Dan Bernstein.
+
+        m_slowRepaintObjectCount needs to be incremented before calling updateCanBlitOnScrollRecursively(),
+        because otherwise useSlowRepaints() will return false even though we have to use slow repaints.
+
+        I was unable to make a layout test for this because it requires that updateCanBlitOnScrollRecursively() isn't
+        called again after m_slowRepaintObjectCount has been incremented.
+
+        * page/FrameView.cpp:
+        (WebCore::FrameView::addSlowRepaintObject):
+
+2012-02-09  Ojan Vafai  <ojan@chromium.org>
+
+        Remove TreeOrderIterator and iterate over the child boxes directly.
+        https://bugs.webkit.org/show_bug.cgi?id=78294
+
+        Reviewed by Tony Chang.
+
+        No new tests. This is purely a refactor. No change in behavior. 
+
+        * rendering/RenderFlexibleBox.cpp:
+        (WebCore::RenderFlexibleBox::layoutFlexItems):
+        (WebCore::RenderFlexibleBox::computeMainAxisPreferredSizes):
+        * rendering/RenderFlexibleBox.h:
+        (RenderFlexibleBox):
+        (FlexOrderHashTraits):
+        (WebCore::RenderFlexibleBox::FlexOrderHashTraits::emptyValue):
+        (WebCore::RenderFlexibleBox::FlexOrderHashTraits::constructDeletedValue):
+        (WebCore::RenderFlexibleBox::FlexOrderHashTraits::isDeletedValue):
+
+2012-02-09  Kentaro Hara  <haraken@chromium.org>
+
+        Code generators should support multiple values for the [CallWith=] attribute
+        https://bugs.webkit.org/show_bug.cgi?id=78224
+
+        Reviewed by Adam Barth.
+
+        Currently we can specify only one value for one [CallWith=],
+        like [CallWith=ScriptExecutionContext] or [CallWith=ScriptState].
+        To reduce redundant IDL attributes, we are planning to support multiple
+        values for [CallWith=], like [CallWith=ScriptExecutionContext|ScriptArguments|CallStack].
+        This patch makes a change on code generators to support it.
+
+        Test: bindings/scripts/test/TestObj.idl
+        No change in WebKit behavior since IDL files have not yet used [CallWith=X|Y|Z].
+
+        * bindings/scripts/CodeGenerator.pm: Modified to support [CallWith=X|Y|Z].
+        (ExtendedAttributeContains):
+        * bindings/scripts/CodeGeneratorJS.pm:
+        (GenerateImplementation):
+        (GenerateCallWith):
+        (GenerateParametersCheck):
+        (GenerateImplementationFunctionCall):
+        (GenerateConstructorDeclaration):
+        (GenerateConstructorDefinition):
+        * bindings/scripts/CodeGeneratorV8.pm:
+        (GenerateNormalAttrGetter):
+        (GenerateNormalAttrSetter):
+        (GenerateCallWith):
+        (GenerateFunctionCallString):
+
+        * bindings/scripts/test/TestObj.idl: Added test cases for [CallWith=X|Y|Z].
+
+        * bindings/scripts/test/CPP/WebDOMTestObj.cpp: Updated run-bindings-tests results.
+        (WebDOMTestObj::withScriptExecutionContextAndScriptStateAttribute):
+        (WebDOMTestObj::setWithScriptExecutionContextAndScriptStateAttribute):
+        (WebDOMTestObj::withScriptExecutionContextAndScriptStateAttributeRaises):
+        (WebDOMTestObj::setWithScriptExecutionContextAndScriptStateAttributeRaises):
+        (WebDOMTestObj::withScriptExecutionContextAndScriptStateWithSpacesAttribute):
+        (WebDOMTestObj::setWithScriptExecutionContextAndScriptStateWithSpacesAttribute):
+        (WebDOMTestObj::withScriptExecutionContextAndScriptState):
+        (WebDOMTestObj::withScriptExecutionContextAndScriptStateObjException):
+        (WebDOMTestObj::withScriptExecutionContextAndScriptStateWithSpaces):
+        * bindings/scripts/test/CPP/WebDOMTestObj.h:
+        * bindings/scripts/test/GObject/WebKitDOMTestObj.cpp:
+        (webkit_dom_test_obj_with_script_execution_context_and_script_state):
+        (webkit_dom_test_obj_with_script_execution_context_and_script_state_obj_exception):
+        (webkit_dom_test_obj_with_script_execution_context_and_script_state_with_spaces):
+        (webkit_dom_test_obj_get_with_script_execution_context_and_script_state_attribute):
+        (webkit_dom_test_obj_set_with_script_execution_context_and_script_state_attribute):
+        (webkit_dom_test_obj_get_with_script_execution_context_and_script_state_attribute_raises):
+        (webkit_dom_test_obj_set_with_script_execution_context_and_script_state_attribute_raises):
+        (webkit_dom_test_obj_get_with_script_execution_context_and_script_state_with_spaces_attribute):
+        (webkit_dom_test_obj_set_with_script_execution_context_and_script_state_with_spaces_attribute):
+        (webkit_dom_test_obj_get_property):
+        (webkit_dom_test_obj_class_init):
+        * bindings/scripts/test/GObject/WebKitDOMTestObj.h:
+        * bindings/scripts/test/JS/JSTestObj.cpp:
+        (WebCore):
+        (WebCore::jsTestObjWithScriptExecutionContextAndScriptStateAttribute):
+        (WebCore::jsTestObjWithScriptExecutionContextAndScriptStateAttributeRaises):
+        (WebCore::jsTestObjWithScriptExecutionContextAndScriptStateWithSpacesAttribute):
+        (WebCore::setJSTestObjWithScriptExecutionContextAndScriptStateAttribute):
+        (WebCore::setJSTestObjWithScriptExecutionContextAndScriptStateAttributeRaises):
+        (WebCore::setJSTestObjWithScriptExecutionContextAndScriptStateWithSpacesAttribute):
+        (WebCore::jsTestObjPrototypeFunctionWithScriptExecutionContextAndScriptState):
+        (WebCore::jsTestObjPrototypeFunctionWithScriptExecutionContextAndScriptStateObjException):
+        (WebCore::jsTestObjPrototypeFunctionWithScriptExecutionContextAndScriptStateWithSpaces):
+        * bindings/scripts/test/JS/JSTestObj.h:
+        (WebCore):
+        * bindings/scripts/test/ObjC/DOMTestObj.h:
+        * bindings/scripts/test/ObjC/DOMTestObj.mm:
+        (-[DOMTestObj withScriptExecutionContextAndScriptStateAttribute]):
+        (-[DOMTestObj setWithScriptExecutionContextAndScriptStateAttribute:]):
+        (-[DOMTestObj withScriptExecutionContextAndScriptStateAttributeRaises]):
+        (-[DOMTestObj setWithScriptExecutionContextAndScriptStateAttributeRaises:]):
+        (-[DOMTestObj withScriptExecutionContextAndScriptStateWithSpacesAttribute]):
+        (-[DOMTestObj setWithScriptExecutionContextAndScriptStateWithSpacesAttribute:]):
+        (-[DOMTestObj withScriptExecutionContextAndScriptState]):
+        (-[DOMTestObj withScriptExecutionContextAndScriptStateObjException]):
+        (-[DOMTestObj withScriptExecutionContextAndScriptStateWithSpaces]):
+        * bindings/scripts/test/V8/V8TestObj.cpp:
+        (WebCore::TestObjInternal::withScriptExecutionContextAndScriptStateAttributeAttrGetter):
+        (TestObjInternal):
+        (WebCore::TestObjInternal::withScriptExecutionContextAndScriptStateAttributeAttrSetter):
+        (WebCore::TestObjInternal::withScriptExecutionContextAndScriptStateAttributeRaisesAttrGetter):
+        (WebCore::TestObjInternal::withScriptExecutionContextAndScriptStateAttributeRaisesAttrSetter):
+        (WebCore::TestObjInternal::withScriptExecutionContextAndScriptStateWithSpacesAttributeAttrGetter):
+        (WebCore::TestObjInternal::withScriptExecutionContextAndScriptStateWithSpacesAttributeAttrSetter):
+        (WebCore::TestObjInternal::withScriptExecutionContextAndScriptStateCallback):
+        (WebCore::TestObjInternal::withScriptExecutionContextAndScriptStateObjExceptionCallback):
+        (WebCore::TestObjInternal::withScriptExecutionContextAndScriptStateWithSpacesCallback):
+        (WebCore):
+
+2012-02-09  Kentaro Hara  <haraken@chromium.org>
+
+        Rename [ConvertNullStringTo=] to [TreatReturnedNullStringAs=]
+        https://bugs.webkit.org/show_bug.cgi?id=78108
+
+        Reviewed by Adam Barth.
+
+        [ConvertNullStringTo=] is not descriptive. To clarify that it specifies
+        the behavior when the null string is returned by WebCore, this patch renames
+        [ConvertNullStringTo=] to [TreatReturnedNullStringAs=]. This change is also
+        for naming consistency with [TreatNullAs] and [TreatUndefinedAs].
+
+        No tests. No change in behavior.
+
+        * bindings/scripts/CodeGeneratorJS.pm:
+        (GenerateGetOwnPropertySlotBody):
+        (NativeToJSValue):
+        * bindings/scripts/CodeGeneratorV8.pm:
+        (GenerateImplementationIndexer):
+        (NativeToJSValue):
+        * bindings/scripts/test/TestObj.idl:
+        * css/CSSCharsetRule.idl:
+        * css/CSSImportRule.idl:
+        * css/CSSPageRule.idl:
+        * css/CSSRule.idl:
+        * css/CSSStyleDeclaration.idl:
+        * css/CSSStyleRule.idl:
+        * css/CSSValue.idl:
+        * css/MediaList.idl:
+        * css/StyleSheet.idl:
+        * css/WebKitCSSKeyframesRule.idl:
+        * dom/Attr.idl:
+        * dom/CharacterData.idl:
+        * dom/Clipboard.idl:
+        * dom/DOMStringList.idl:
+        * dom/Document.idl:
+        * dom/DocumentType.idl:
+        * dom/Element.idl:
+        * dom/Entity.idl:
+        * dom/MutationRecord.idl:
+        * dom/Node.idl:
+        * dom/Notation.idl:
+        * dom/ProcessingInstruction.idl:
+        * html/DOMTokenList.idl:
+        * html/DOMURL.idl:
+        * html/HTMLMediaElement.idl:
+        * html/canvas/WebGLDebugShaders.idl:
+        * html/canvas/WebGLRenderingContext.idl:
+        * page/DOMWindow.idl:
+        * storage/IDBObjectStore.idl:
+        * storage/IDBRequest.idl:
+        * storage/Storage.idl:
+        * storage/StorageEvent.idl:
+        * websockets/WebSocket.idl:
+        * xml/XMLHttpRequest.idl:
+        * xml/XPathNSResolver.idl:
+        * xml/XSLTProcessor.idl:
+
+2012-02-09  Tony Chang  <tony@chromium.org>
+
+        more refactoring of RenderFlexibleBox in preparation for multiline
+        https://bugs.webkit.org/show_bug.cgi?id=78281
+
+        Reviewed by Ojan Vafai.
+
+        Previously, we were creating Vector of each flex item's preferred size in document order,
+        but for multiline, we need to break the lines in the flex order.  I just removed this code
+        since it was the wrong order.
+
+        Instead, have 2 funtions, computeMainAxisPreferredSizes which only does the necessary
+        layouts and margin computations to compute preferred sizes and computeFlexOrder which
+        does the work of computing the flex order, preferred sizes, positive/negative flex.
+
+        For multiline, we will have computeFlexOrder drive a while loop and it will return the
+        flex items, preferred size, and positive/negative flex values for each line.
+
+        No new tests, just refactoring.
+
+        * rendering/RenderFlexibleBox.cpp:
+        (WebCore::RenderFlexibleBox::layoutFlexItems):
+        (WebCore::RenderFlexibleBox::computeMainAxisPreferredSizes): Only layout auto sized children and set margins.
+        (WebCore::RenderFlexibleBox::computeFlexOrder): Compute flex order, preferred size, positive/negative flex.
+        (WebCore::RenderFlexibleBox::runFreeSpaceAllocationAlgorithm): Use the precomputed flex order.
+        (WebCore::RenderFlexibleBox::layoutAndPlaceChildren): Use the precomputed flex order.
+        (WebCore::RenderFlexibleBox::layoutColumnReverse): Use the precomputed flex order.
+        (WebCore::RenderFlexibleBox::alignChildren): Use the precomputed flex order.
+        * rendering/RenderFlexibleBox.h:
+        (RenderFlexibleBox):
+
+2012-02-09  Kentaro Hara  <haraken@chromium.org>
+
+        Rename [Optional=CallWithDefaultValue] and [Optional=CallWithNullValue]
+        https://bugs.webkit.org/show_bug.cgi?id=78200
+
+        Reviewed by Adam Barth.
+
+        [Optional=CallWithDefaultValue] and [Optional=CallWithNullValue] are confusing.
+
+        - [Optional=CallWithDefaultValue] indicates that a missing value should be treated
+        as if the JavaScript undefined is passed.
+        - [Optional=CallWithNullValue] indicates that a missing value should be treated as
+        the WebKit null value (i.e. JSValue() or v8::Local<v8::Value>()).
+        - Actually, the difference between [Optional=CallWithDefaultValue] and
+        [Optional=CallWithNullValue] will appear only when the type of the missing value
+        is DOMString. In case of [Optional=CallWithDefaultValue], the missing value is
+        converted to the string "undefined". On the other hand, in case of
+        [Optional=CallWithNullValue], the missing value is converted to the WebKit null string.
+
+        With these observations, this patch renames as follows:
+
+        - Rename [Optional=CallWithDefaultValue] to [Optional=DefaultIsUndefined].
+        - Rename [Optional=CallWithNullValue] to [Optional=DefaultIsNullString].
+
+        Test: bindings/scripts/test/TestObj.idl
+
+        * bindings/js/JSDOMBinding.h: Renamed MissingIsEmpty to DefaultIsNullString,
+        renamed MissingIsUndefined to DefaultIsUndefined.
+        * bindings/v8/V8Binding.h: Ditto.
+        * bindings/v8/custom/V8BindingMacros.h: Ditto.
+
+        * bindings/scripts/CodeGeneratorJS.pm: Modified to support the renaming.
+        (GenerateParametersCheck):
+        * bindings/scripts/CodeGeneratorV8.pm: Ditto.
+        (GenerateParametersCheck):
+        (RequiresCustomSignature):
+
+        * bindings/scripts/test/TestObj.idl: Renamed [Optional=...] as described above.
+        * bindings/scripts/test/TestInterface.idl: Ditto.
+        * bindings/scripts/test/TestNamedConstructor.idl: Ditto.
+
+        * bindings/scripts/test/CPP/WebDOMTestObj.cpp: Updated run-bindings-tests results.
+        (WebDOMTestObj::methodWithOptionalString):
+        (WebDOMTestObj::methodWithOptionalStringIsUndefinedString):
+        (WebDOMTestObj::methodWithOptionalStringIsNullString):
+        * bindings/scripts/test/CPP/WebDOMTestObj.h:
+        * bindings/scripts/test/GObject/WebKitDOMTestObj.cpp:
+        (webkit_dom_test_obj_method_with_optional_string):
+        (webkit_dom_test_obj_method_with_optional_string_is_undefined_string):
+        (webkit_dom_test_obj_method_with_optional_string_is_null_string):
+        * bindings/scripts/test/GObject/WebKitDOMTestObj.h:
+        * bindings/scripts/test/JS/JSTestNamedConstructor.cpp:
+        (WebCore::JSTestNamedConstructorNamedConstructor::constructJSTestNamedConstructor):
+        * bindings/scripts/test/JS/JSTestObj.cpp:
+        (WebCore):
+        (WebCore::jsTestObjPrototypeFunctionMethodWithOptionalString):
+        (WebCore::jsTestObjPrototypeFunctionMethodWithOptionalStringIsUndefinedString):
+        (WebCore::jsTestObjPrototypeFunctionMethodWithOptionalStringIsNullString):
+        * bindings/scripts/test/JS/JSTestObj.h:
+        (WebCore):
+        * bindings/scripts/test/ObjC/DOMTestObj.h:
+        * bindings/scripts/test/ObjC/DOMTestObj.mm:
+        (-[DOMTestObj methodWithOptionalString:]):
+        (-[DOMTestObj methodWithOptionalStringIsUndefinedString:]):
+        (-[DOMTestObj methodWithOptionalStringIsNullString:]):
+        * bindings/scripts/test/V8/V8TestNamedConstructor.cpp:
+        (WebCore::V8TestNamedConstructorConstructorCallback):
+        * bindings/scripts/test/V8/V8TestObj.cpp:
+        (WebCore::TestObjInternal::methodWithOptionalStringCallback):
+        (TestObjInternal):
+        (WebCore::TestObjInternal::methodWithOptionalStringIsUndefinedStringCallback):
+        (WebCore::TestObjInternal::methodWithOptionalStringIsNullStringCallback):
+        (WebCore):
+
+        * Modules/gamepad/GamepadList.idl: Renamed [Optional=...] as described above.
+        * Modules/intents/Intent.idl:
+        * css/CSSMediaRule.idl:
+        * css/CSSPrimitiveValue.idl:
+        * css/CSSRuleList.idl:
+        * css/CSSStyleDeclaration.idl:
+        * css/CSSStyleSheet.idl:
+        * css/CSSValueList.idl:
+        * css/MediaList.idl:
+        * css/MediaQueryList.idl:
+        * css/MediaQueryListListener.idl:
+        * css/StyleMedia.idl:
+        * css/StyleSheetList.idl:
+        * css/WebKitCSSKeyframesRule.idl:
+        * css/WebKitCSSMatrix.idl:
+        * dom/CharacterData.idl:
+        * dom/ClientRectList.idl:
+        * dom/CompositionEvent.idl:
+        * dom/CustomEvent.idl:
+        * dom/DOMImplementation.idl:
+        * dom/DOMStringList.idl:
+        * dom/DataTransferItem.idl:
+        * dom/DataTransferItemList.idl:
+        * dom/DeviceMotionEvent.idl:
+        * dom/DeviceOrientationEvent.idl:
+        * dom/Document.idl:
+        * dom/Element.idl:
+        * dom/Event.idl:
+        * dom/HashChangeEvent.idl:
+        * dom/KeyboardEvent.idl:
+        * dom/MessageEvent.idl:
+        * dom/MouseEvent.idl:
+        * dom/MutationEvent.idl:
+        * dom/NamedNodeMap.idl:
+        * dom/Node.idl:
+        * dom/NodeFilter.idl:
+        * dom/NodeList.idl:
+        * dom/OverflowEvent.idl:
+        * dom/Range.idl:
+        * dom/ShadowRoot.idl:
+        * dom/Text.idl:
+        * dom/TextEvent.idl:
+        * dom/TouchEvent.idl:
+        * dom/UIEvent.idl:
+        * dom/WheelEvent.idl:
+        * html/DOMFormData.idl:
+        * html/HTMLAllCollection.idl:
+        * html/HTMLAudioElement.idl:
+        * html/HTMLCanvasElement.idl:
+        * html/HTMLCollection.idl:
+        * html/HTMLDocument.idl:
+        * html/HTMLElement.idl:
+        * html/HTMLInputElement.idl:
+        * html/HTMLMediaElement.idl:
+        * html/HTMLOptionElement.idl:
+        * html/HTMLOptionsCollection.idl:
+        * html/HTMLSelectElement.idl:
+        * html/HTMLTableElement.idl:
+        * html/HTMLTableRowElement.idl:
+        * html/HTMLTableSectionElement.idl:
+        * html/HTMLTextAreaElement.idl:
+        * html/TextTrackCue.idl:
+        * html/canvas/CanvasGradient.idl:
+        * html/canvas/CanvasRenderingContext2D.idl:
+        * html/canvas/Float32Array.idl:
+        * html/canvas/Float64Array.idl:
+        * html/canvas/Int16Array.idl:
+        * html/canvas/Int32Array.idl:
+        * html/canvas/Int8Array.idl:
+        * html/canvas/OESVertexArrayObject.idl:
+        * html/canvas/Uint16Array.idl:
+        * html/canvas/Uint32Array.idl:
+        * html/canvas/Uint8Array.idl:
+        * html/canvas/Uint8ClampedArray.idl:
+        * page/Console.idl:
+        * page/DOMSelection.idl:
+        * page/DOMWindow.idl:
+        * page/History.idl:
+        * page/Location.idl:
+        * plugins/DOMMimeTypeArray.idl:
+        * plugins/DOMPlugin.idl:
+        * plugins/DOMPluginArray.idl:
+        * storage/IDBDatabase.idl:
+        * storage/StorageEvent.idl:
+        * svg/ElementTimeControl.idl:
+        * svg/SVGDocument.idl:
+        * svg/SVGElementInstanceList.idl:
+        * svg/SVGFEDropShadowElement.idl:
+        * svg/SVGFEGaussianBlurElement.idl:
+        * svg/SVGFEMorphologyElement.idl:
+        * svg/SVGFilterElement.idl:
+        * svg/SVGLocatable.idl:
+        * svg/SVGMarkerElement.idl:
+        * svg/SVGPathElement.idl:
+        * svg/SVGSVGElement.idl:
+        * svg/SVGStylable.idl:
+        * svg/SVGTests.idl:
+        * svg/SVGTextContentElement.idl:
+        * webaudio/AudioNode.idl:
+        * workers/SharedWorker.idl:
+        * workers/WorkerContext.idl:
+        * xml/DOMParser.idl:
+        * xml/XMLSerializer.idl:
+        * xml/XPathEvaluator.idl:
+        * xml/XPathExpression.idl:
+        * xml/XPathNSResolver.idl:
+        * xml/XPathResult.idl:
+
+2012-02-09  Matthew Delaney  <mdelaney@apple.com>
+
+        getComputedStyle() returns different values for different zoom levels
+        https://bugs.webkit.org/show_bug.cgi?id=32230
+
+        Reviewed by Beth Dakin.
+
+        Test: fast/css/getComputedStyle/getComputedStyle-zoom-and-background-size.html
+
+        * css/CSSComputedStyleDeclaration.cpp:
+        (WebCore::fillSizeToCSSValue): Pass down the RenderStyle for use in adjusting
+        values to account for zoom.
+        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue): Adjust additional
+        properties that are affected by zoom.
+
+2012-02-09  Kentaro Hara  <haraken@chromium.org>
+
+        Rename [Return] to [CustomReturn]
+        https://bugs.webkit.org/show_bug.cgi?id=78225
+
+        Reviewed by Adam Barth.
+
+        [Return] is used to handle custom code for a returned value.
+        To clarify it, this patch renames [Return] to [CustomReturn].
+
+        No tests. No change in behavior.
+
+        * bindings/scripts/CodeGeneratorCPP.pm:
+        (GenerateImplementation):
+        * bindings/scripts/CodeGeneratorGObject.pm:
+        (GenerateFunction):
+        * bindings/scripts/CodeGeneratorObjC.pm:
+        (GenerateImplementation):
+        * dom/Node.idl:
+
+2012-02-09  Levi Weintraub  <leviw@chromium.org>
+
+        Add roundedIntPoint method for LayoutPoints
+        https://bugs.webkit.org/show_bug.cgi?id=78262
+
+        Reviewed by Eric Seidel.
+
+        Adding a roundedIntPoint method that operates on a LayoutPoint. Currently, this does
+        nothing as LayoutPoint is a typedef to IntPoint. When we enable sub-pixel LayoutUnits,
+        this is a critical part in our pixel snapping strategy, where we round the logical top-
+        left point, then snap the right and bottom edges.
+
+        Also using this new method where we wish to convert LayoutPoints to IntPoints, which
+        we're currently doing implicitly (since they're the same thing).
+
+        No new tests. No change in functionality.
+
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::visiblePositionForPoint):
+        (WebCore::AccessibilityRenderObject::accessibilityHitTest):
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::eventMayStartDrag):
+        (WebCore::EventHandler::hitTestResultAtPoint):
+        (WebCore::EventHandler::selectCursor):
+        * rendering/LayoutTypes.h:
+        (WebCore::roundedIntPoint):
+        (WebCore):
+        * rendering/RenderEmbeddedObject.cpp:
+        (WebCore::RenderEmbeddedObject::getReplacementTextGeometry):
+        * rendering/RenderFlowThread.cpp:
+        (WebCore::RenderFlowThread::paintIntoRegion):
+        * rendering/RenderFrameSet.cpp:
+        (WebCore::RenderFrameSet::getCursor):
+        * rendering/RenderImage.cpp:
+        (WebCore::RenderImage::paintReplaced):
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::scrollRectToVisible):
+        (WebCore::RenderLayer::offsetFromResizeCorner):
+        (WebCore::RenderLayer::isPointInResizeControl):
+        (WebCore::RenderLayer::paintLayerContents):
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::paintContents):
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::paintContents):
+        * rendering/mathml/RenderMathMLBlock.cpp:
+        (WebCore::RenderMathMLBlock::paint):
+        * rendering/mathml/RenderMathMLFraction.cpp:
+        (WebCore::RenderMathMLFraction::paint):
+        * rendering/mathml/RenderMathMLRoot.cpp:
+        (WebCore::RenderMathMLRoot::paint):
+        * rendering/mathml/RenderMathMLSquareRoot.cpp:
+        (WebCore::RenderMathMLSquareRoot::paint):
+
+2012-02-09  John Bates  <jbates@google.com>
+
+        [Chromium] Add chromium-style tracing support
+        https://bugs.webkit.org/show_bug.cgi?id=76885
+
+        Reviewed by Darin Fisher.
+
+        This code enables WebKit trace events to pass through more data to the
+        chromium platform tracing API and generally to use the full tracing
+        API provided by chromium.
+
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::evaluate): Replace old tracing API.
+        * page/Console.cpp:
+        (WebCore::Console::time): Replace old tracing API.
+        (WebCore::Console::timeEnd): Replace old tracing API.
+        * platform/chromium/PlatformSupport.h:
+        * platform/chromium/TraceEvent.h:
+        (WebCore::TraceEvent::TraceID::TraceID):
+        (WebCore::TraceEvent::TraceID::data):
+        (WebCore::TraceEvent::TraceStringWithCopy::TraceStringWithCopy):
+        (WebCore::TraceEvent::TraceStringWithCopy::operator const char* ):
+        (WebCore::TraceEvent::setTraceValue):
+        (WebCore::TraceEvent::addTraceEvent):
+        (WebCore::TraceEvent::TraceEndOnScopeClose::TraceEndOnScopeClose):
+        (WebCore::TraceEvent::TraceEndOnScopeClose::~TraceEndOnScopeClose):
+        (WebCore::TraceEvent::TraceEndOnScopeClose::initialize):
+        (WebCore::TraceEvent::TraceEndOnScopeClose::addEventIfEnabled):
+        (WebCore::TraceEvent::TraceEndOnScopeCloseThreshold::TraceEndOnScopeCloseThreshold):
+        (WebCore::TraceEvent::TraceEndOnScopeCloseThreshold::~TraceEndOnScopeCloseThreshold):
+        (WebCore::TraceEvent::TraceEndOnScopeCloseThreshold::initialize):
+        (WebCore::TraceEvent::TraceEndOnScopeCloseThreshold::addEventIfEnabled):
+
+2012-02-09  David Hyatt  <hyatt@apple.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=78256
+        
+        Rename line-grid-snap to line-snap so that it matches the draft proposal for the
+        property.
+
+        Reviewed by Dan Bernstein.
+
+        * css/CSSComputedStyleDeclaration.cpp:
+        (WebCore):
+        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue):
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseValue):
+        * css/CSSPrimitiveValueMappings.h:
+        (WebCore::CSSPrimitiveValue::CSSPrimitiveValue):
+        (WebCore::CSSPrimitiveValue::operator LineSnap):
+        * css/CSSProperty.cpp:
+        (WebCore::CSSProperty::isInheritedProperty):
+        * css/CSSPropertyNames.in:
+        * css/CSSStyleApplyProperty.cpp:
+        (WebCore::CSSStyleApplyProperty::CSSStyleApplyProperty):
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::applyProperty):
+        * rendering/RootInlineBox.cpp:
+        (WebCore::RootInlineBox::alignBoxesInBlockDirection):
+        (WebCore::RootInlineBox::lineSnapAdjustment):
+        * rendering/RootInlineBox.h:
+        (RootInlineBox):
+        * rendering/style/RenderStyle.cpp:
+        (WebCore::RenderStyle::diff):
+        * rendering/style/RenderStyle.h:
+        * rendering/style/RenderStyleConstants.h:
+        * rendering/style/StyleRareInheritedData.cpp:
+        (WebCore::StyleRareInheritedData::StyleRareInheritedData):
+        (WebCore::StyleRareInheritedData::operator==):
+        * rendering/style/StyleRareInheritedData.h:
+        (StyleRareInheritedData):
+
+2012-02-09  Benjamin Poulain  <bpoulain@apple.com>
+
+        The localization of htmlSelectMultipleItems() needs better support of pluralization
+        https://bugs.webkit.org/show_bug.cgi?id=78197
+
+        Reviewed by Joseph Pecoraro.
+
+        For translation, the localization of 0 and 1 depends on the language.
+
+        * English.lproj/Localizable.strings:
+        * platform/DefaultLocalizationStrategy.cpp:
+        (WebCore::DefaultLocalizationStrategy::htmlSelectMultipleItems):
+
+2012-02-09  Anders Carlsson  <andersca@apple.com>
+
+        ScrollingTreeNodeMac should implement ScrollElasticityController
+        https://bugs.webkit.org/show_bug.cgi?id=78277
+
+        Reviewed by Andreas Kling.
+
+        Add stubbed out implementations of the ScrollElasticityController member functions.
+
+        * page/scrolling/mac/ScrollingTreeNodeMac.h:
+        (ScrollingTreeNodeMac):
+        * page/scrolling/mac/ScrollingTreeNodeMac.mm:
+        (WebCore::ScrollingTreeNodeMac::allowsHorizontalStretching):
+        (WebCore):
+        (WebCore::ScrollingTreeNodeMac::allowsVerticalStretching):
+        (WebCore::ScrollingTreeNodeMac::stretchAmount):
+        (WebCore::ScrollingTreeNodeMac::pinnedInDirection):
+        (WebCore::ScrollingTreeNodeMac::canScrollHorizontally):
+        (WebCore::ScrollingTreeNodeMac::canScrollVertically):
+        (WebCore::ScrollingTreeNodeMac::shouldRubberBandInDirection):
+        (WebCore::ScrollingTreeNodeMac::absoluteScrollPosition):
+        (WebCore::ScrollingTreeNodeMac::immediateScrollBy):
+        (WebCore::ScrollingTreeNodeMac::immediateScrollByWithoutContentEdgeConstraints):
+        (WebCore::ScrollingTreeNodeMac::startSnapRubberbandTimer):
+        (WebCore::ScrollingTreeNodeMac::stopSnapRubberbandTimer):
+
+2012-02-09  Adrienne Walker  <enne@google.com>
+
+        [chromium] Correct potential double reserveTextures() in CCLayerTreeHost
+        https://bugs.webkit.org/show_bug.cgi?id=78258
+
+        Reviewed by James Robinson.
+
+        This isn't a problem currently, because scrollbar layers don't create
+        render surfaces. However, if this ever got used for other layers, we
+        could call reserve on them twice needlessly. It's also just bad form
+        to have an iterator doing the wrong thing.
+
+        * platform/graphics/chromium/cc/CCLayerTreeHost.cpp:
+        (WebCore::CCLayerTreeHost::reserveTextures):
+
+2012-02-09  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r107261.
+        http://trac.webkit.org/changeset/107261
+        https://bugs.webkit.org/show_bug.cgi?id=78274
+
+        It has regressed svg/W3C-SVG-1.1/styling-css-05-b.svg (using
+        lang() selectors) (Requested by jchaffraix on #webkit).
+
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::canShareStyleWithControl):
+        (WebCore::CSSStyleSelector::canShareStyleWithElement):
+        (WebCore::isCommonAttributeSelectorAttribute):
+
+2012-02-09  Joshua Bell  <jsbell@chromium.org>
+
+        [Chromium] IndexedDB: IDBVersionChangeRequest V8 wrapper not generated as ActiveDOMObject
+        https://bugs.webkit.org/show_bug.cgi?id=78167
+
+        Add ActiveDOMObject annotation to IDBVersionChangeRequest.idl; it is not
+        automagically inherited from IDBRequest.idl.
+
+        Reviewed by Adam Barth.
+
+        Test: storage/indexeddb/versionchangerequest-activedomobject.html
+
+        * storage/IDBVersionChangeRequest.idl:
+
+2012-02-09  Anders Carlsson  <andersca@apple.com>
+
+        The scrolling tree should know more about the scrollbar state
+        https://bugs.webkit.org/show_bug.cgi?id=78268
+
+        Reviewed by Andreas Kling.
+
+        With this change, the scroll tree now keeps track of the horizontal scroll elasticity,
+        the vertical scroll elasticity and whether the page has enabled scrollbars.
+
+        This is needed in order to make rubber-banding work correctly when doing fast scrolling.
+
+        * page/scrolling/ScrollingCoordinator.cpp:
+        (WebCore::ScrollingCoordinator::frameViewLayoutUpdated):
+        * page/scrolling/ScrollingTreeNode.cpp:
+        (WebCore::ScrollingTreeNode::ScrollingTreeNode):
+        (WebCore::ScrollingTreeNode::update):
+        * page/scrolling/ScrollingTreeNode.h:
+        (ScrollingTreeNode):
+        * page/scrolling/ScrollingTreeState.cpp:
+        (WebCore::ScrollingTreeState::ScrollingTreeState):
+        (WebCore::ScrollingTreeState::setHorizontalScrollElasticity):
+        (WebCore):
+        (WebCore::ScrollingTreeState::setVerticalScrollElasticity):
+        (WebCore::ScrollingTreeState::setHasEnabledHorizontalScrollbar):
+        (WebCore::ScrollingTreeState::setHasEnabledVerticalScrollbar):
+        * page/scrolling/ScrollingTreeState.h:
+        (WebCore::ScrollingTreeState::horizontalScrollElasticity):
+        (ScrollingTreeState):
+        (WebCore::ScrollingTreeState::verticalScrollElasticity):
+        (WebCore::ScrollingTreeState::hasEnabledHorizontalScrollbar):
+        (WebCore::ScrollingTreeState::hasEnabledVerticalScrollbar):
+
+2012-02-09  Xianzhu Wang  <wangxianzhu@chromium.org>
+
+        Unnecessary and incorrect invalidation about composited fixed-position layers
+        https://bugs.webkit.org/show_bug.cgi?id=75638
+
+        When a FrameView scrolls, composited fixed-position layers should
+        not contribute to the invalidation rect of the root layer.
+
+        Reviewed by Simon Fraser.
+
+        No new tests. Haven't found a good way to test this programatically.
+
+        * page/FrameView.cpp:
+        (WebCore::FrameView::scrollContentsFastPath):
+
+2012-02-09  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r107035.
+        http://trac.webkit.org/changeset/107035
+        https://bugs.webkit.org/show_bug.cgi?id=78253
+
+        Regressed DOMDivWalk (Requested by arv on #webkit).
+
+        * Target.pri:
+        * UseV8.cmake:
+        * WebCore.gypi:
+        * bindings/scripts/CodeGeneratorV8.pm:
+        (GenerateNormalAttrGetter):
+        (HasCustomToV8Implementation):
+        * bindings/v8/custom/V8DOMStringMapCustom.cpp:
+        (WebCore::toV8):
+        (WebCore):
+        * bindings/v8/custom/V8DOMTokenListCustom.cpp: Copied from Source/WebCore/bindings/v8/custom/V8NamedNodeMapCustom.cpp.
+        (WebCore):
+        (WebCore::toV8):
+        * bindings/v8/custom/V8NamedNodeMapCustom.cpp:
+        (WebCore::toV8):
+        (WebCore):
+
+2012-02-09  David Barton  <dbarton@mathscribe.com>
+
+        MathML internals for bug 52444 fix - type checking, PassRefPtr
+        https://bugs.webkit.org/show_bug.cgi?id=78180
+
+        Reviewed by Eric Seidel.
+        
+        static_cast<Element*>(node()) is done in methods in RenderMathMLFenced.cpp and a few
+        other files. It is more type-safe if the RenderMathMLFenced() or other constructor only
+        accepts an Element*, not a Node*. Also a couple functions were changed to return a
+        PassRefPtr instead of a RefPtr.
+
+        No new tests.
+
+        * rendering/mathml/RenderMathMLFenced.cpp:
+        (WebCore::RenderMathMLFenced::RenderMathMLFenced):
+        (WebCore::RenderMathMLFenced::updateFromElement):
+        (WebCore::RenderMathMLFenced::makeOperatorStyle):
+        (WebCore::RenderMathMLFenced::makeFences):
+        (WebCore::RenderMathMLFenced::addChild):
+        * rendering/mathml/RenderMathMLFenced.h:
+        (RenderMathMLFenced):
+        * rendering/mathml/RenderMathMLFraction.cpp:
+        (WebCore::RenderMathMLFraction::RenderMathMLFraction):
+        * rendering/mathml/RenderMathMLFraction.h:
+        (RenderMathMLFraction):
+        * rendering/mathml/RenderMathMLMath.cpp:
+        (WebCore::RenderMathMLMath::RenderMathMLMath):
+        * rendering/mathml/RenderMathMLMath.h:
+        (RenderMathMLMath):
+        * rendering/mathml/RenderMathMLOperator.cpp:
+        (WebCore::RenderMathMLOperator::RenderMathMLOperator):
+        (WebCore::RenderMathMLOperator::updateFromElement):
+        (WebCore::RenderMathMLOperator::createStackableStyle):
+        (WebCore::RenderMathMLOperator::createGlyph):
+        * rendering/mathml/RenderMathMLOperator.h:
+        (RenderMathMLOperator):
+        * rendering/mathml/RenderMathMLRoot.cpp:
+        (WebCore::RenderMathMLRoot::RenderMathMLRoot):
+        (WebCore::RenderMathMLRoot::layout):
+        * rendering/mathml/RenderMathMLRoot.h:
+        (RenderMathMLRoot):
+        * rendering/mathml/RenderMathMLRow.cpp:
+        (WebCore::RenderMathMLRow::RenderMathMLRow):
+        * rendering/mathml/RenderMathMLRow.h:
+        (RenderMathMLRow):
+        * rendering/mathml/RenderMathMLSquareRoot.cpp:
+        (WebCore::RenderMathMLSquareRoot::RenderMathMLSquareRoot):
+        * rendering/mathml/RenderMathMLSquareRoot.h:
+        (RenderMathMLSquareRoot):
+        * rendering/mathml/RenderMathMLSubSup.cpp:
+        (WebCore::RenderMathMLSubSup::addChild):
+        * rendering/mathml/RenderMathMLSubSup.h:
+        (RenderMathMLSubSup):
+        * rendering/mathml/RenderMathMLUnderOver.cpp:
+        (WebCore::RenderMathMLUnderOver::RenderMathMLUnderOver):
+        * rendering/mathml/RenderMathMLUnderOver.h:
+        (RenderMathMLUnderOver):
+
+2012-02-09  Andreas Kling  <awesomekling@apple.com>
+
+        Avoid unnecessary work when evaluating style sharing candidates.
+        <http://webkit.org/b/78220>
+
+        Reviewed by Antti Koivisto.
+
+        Do the cheap checks (bitfields, pointers) before calling virtuals and doing hash lookups.
+        Remove comparison of attributes that are reflected in the attribute styles (cellpadding,
+        lang and xml:lang.) Moved comparison of "type" and "readonly" attributes into the more
+        specific canShareStyleWithControl() since they are only relevant for input elements.
+        Don't bother calling isFormControlElement() on both elements since we already know they
+        have the same tagQName().
+
+        Altogether this knocks off 8-9ms worth of samples per cycle of the "Moz" page cycler test.
+
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::canShareStyleWithControl):
+        (WebCore::CSSStyleSelector::canShareStyleWithElement):
+        (WebCore::isCommonAttributeSelectorAttribute):
+
+2012-02-09  Mike Lawther  <mikelawther@chromium.org>
+
+        CSS3 calc() - remove mod
+        https://bugs.webkit.org/show_bug.cgi?id=78226
+
+        mod has been removed from the spec for calc().
+
+        Reviewed by Ojan Vafai.
+
+        * css/CSSCalculationValue.cpp:
+        (WebCore::CSSCalcBinaryOperation::create):
+        (WebCore::CSSCalcBinaryOperation::evaluate):
+        (WebCore::CSSCalcExpressionNodeParser::parseValueMultiplicativeExpression):
+        * css/CSSGrammar.y:
+        * platform/CalculationValue.h:
+
+2012-02-09  Pavel Feldman  <pfeldman@google.com>
+
+        Web Inspector: rename DOMEditor to DOMPatchSupport, move undoable actions from
+        InspectorDOMAgent to the new DOMEditor.
+        https://bugs.webkit.org/show_bug.cgi?id=78245
+
+        Reviewed by Yury Semikhatsky.
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * Target.pri:
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * inspector/DOMEditor.cpp:
+        (DOMEditor::DOMAction):
+        (WebCore::DOMEditor::DOMAction::DOMAction):
+        (WebCore::DOMEditor::DOMAction::perform):
+        (WebCore::DOMEditor::DOMAction::undo):
+        (DOMEditor::RemoveChildAction):
+        (WebCore::DOMEditor::RemoveChildAction::RemoveChildAction):
+        (WebCore::DOMEditor::RemoveChildAction::perform):
+        (WebCore::DOMEditor::RemoveChildAction::undo):
+        (DOMEditor::InsertBeforeAction):
+        (WebCore::DOMEditor::InsertBeforeAction::InsertBeforeAction):
+        (WebCore::DOMEditor::InsertBeforeAction::perform):
+        (WebCore::DOMEditor::InsertBeforeAction::undo):
+        (DOMEditor::RemoveAttributeAction):
+        (WebCore::DOMEditor::RemoveAttributeAction::RemoveAttributeAction):
+        (WebCore::DOMEditor::RemoveAttributeAction::perform):
+        (WebCore::DOMEditor::RemoveAttributeAction::undo):
+        (DOMEditor::SetAttributeAction):
+        (WebCore::DOMEditor::SetAttributeAction::SetAttributeAction):
+        (WebCore::DOMEditor::SetAttributeAction::perform):
+        (WebCore::DOMEditor::SetAttributeAction::undo):
+        (DOMEditor::SetOuterHTMLAction):
+        (WebCore::DOMEditor::SetOuterHTMLAction::SetOuterHTMLAction):
+        (WebCore::DOMEditor::SetOuterHTMLAction::perform):
+        (WebCore::DOMEditor::SetOuterHTMLAction::undo):
+        (WebCore::DOMEditor::SetOuterHTMLAction::newNode):
+        (DOMEditor::ReplaceWholeTextAction):
+        (WebCore::DOMEditor::ReplaceWholeTextAction::ReplaceWholeTextAction):
+        (WebCore::DOMEditor::ReplaceWholeTextAction::perform):
+        (WebCore::DOMEditor::ReplaceWholeTextAction::undo):
+        (WebCore::DOMEditor::DOMEditor):
+        (WebCore):
+        (WebCore::DOMEditor::~DOMEditor):
+        (WebCore::DOMEditor::insertBefore):
+        (WebCore::DOMEditor::removeChild):
+        (WebCore::DOMEditor::setAttribute):
+        (WebCore::DOMEditor::removeAttribute):
+        (WebCore::DOMEditor::setOuterHTML):
+        (WebCore::DOMEditor::replaceWholeText):
+        * inspector/DOMEditor.h:
+        (WebCore):
+        (DOMEditor):
+        * inspector/DOMPatchSupport.cpp: Copied from Source/WebCore/inspector/DOMEditor.cpp.
+        (WebCore::DOMPatchSupport::DOMPatchSupport):
+        (WebCore::DOMPatchSupport::~DOMPatchSupport):
+        (WebCore::DOMPatchSupport::patchDocument):
+        (WebCore::DOMPatchSupport::patchNode):
+        (WebCore::DOMPatchSupport::innerPatchNode):
+        (WebCore):
+        (WebCore::DOMPatchSupport::diff):
+        (WebCore::DOMPatchSupport::innerPatchChildren):
+        (WebCore::DOMPatchSupport::createDigest):
+        (WebCore::DOMPatchSupport::insertBefore):
+        (WebCore::DOMPatchSupport::removeChild):
+        (WebCore::DOMPatchSupport::markNodeAsUsed):
+        (WebCore::DOMPatchSupport::dumpMap):
+        * inspector/DOMPatchSupport.h: Copied from Source/WebCore/inspector/DOMEditor.h.
+        (DOMPatchSupport):
+        * inspector/InspectorDOMAgent.cpp:
+        (WebCore::InspectorDOMAgent::InspectorDOMAgent):
+        (WebCore::InspectorDOMAgent::setFrontend):
+        (WebCore::InspectorDOMAgent::clearFrontend):
+        (WebCore::InspectorDOMAgent::reset):
+        (WebCore::InspectorDOMAgent::setAttributeValue):
+        (WebCore::InspectorDOMAgent::setAttributesAsText):
+        (WebCore::InspectorDOMAgent::removeAttribute):
+        (WebCore::InspectorDOMAgent::removeNode):
+        (WebCore::InspectorDOMAgent::setNodeName):
+        (WebCore::InspectorDOMAgent::setOuterHTML):
+        (WebCore::InspectorDOMAgent::setNodeValue):
+        (WebCore::InspectorDOMAgent::moveTo):
+        * inspector/InspectorDOMAgent.h:
+        (WebCore):
+        (InspectorDOMAgent):
+        * inspector/InspectorPageAgent.cpp:
+        (WebCore::InspectorPageAgent::setDocumentContent):
+
+2012-02-09  Mark Rowe  <mrowe@apple.com>
+
+        REGRESSION (r104746): iframes load PDFs as media documents
+        <http://webkit.org/b/77079> / <rdar://problem/10757933>
+
+        Roll out r104746 since it completely broke support for loading PDF documents in subframes.
+
+        Reviewed by Adam Treat.
+
+        * dom/DOMImplementation.cpp:
+        (WebCore::DOMImplementation::createDocument):
+
+2012-02-09  Andrey Kosyakov  <caseq@chromium.org>
+
+        Web Inspector: [refactoring] take _showShortEvents out of timeline calculator
+        https://bugs.webkit.org/show_bug.cgi?id=78230
+
+        Reviewed by Pavel Feldman.
+
+        * inspector/front-end/TimelinePanel.js:
+        (WebInspector.TimelinePanel):
+        (WebInspector.TimelinePanel.prototype._toggleFilterButtonClicked):
+        (WebInspector.TimelinePanel.prototype._refresh):
+        (WebInspector.TimelinePanel.prototype._addToRecordsWindow):
+
+2012-02-08  Dan Vrátil  <dvratil@redhat.com>, Milan Crha <mcrha@redhat.com>
+
+        [GTK] Embedded GtkWidgets are not drawn
+        https://bugs.webkit.org/show_bug.cgi?id=63451
+
+        Remove widget from it's parent container when GtkPluginWidget is destroyed.
+        Remove paint() method because real expose even is used for drawing child widgets now.
+
+        Reviewed by Martin Robinson.
+
+        * platform/gtk/GtkPluginWidget.cpp:
+        (WebCore::GtkPluginWidget::~GtkPluginWidget):
+        (WebCore):
+        * platform/gtk/GtkPluginWidget.h:
+        (GtkPluginWidget):
+
+2012-02-09  Arun Patole  <arun.patole@motorola.com>
+
+        Setting media element 'src' attribute to "" should trigger load
+        https://bugs.webkit.org/show_bug.cgi?id=47907
+
+        Reviewed by Eric Carlson.
+
+        Test: media/video-src-empty.html
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::attributeChanged):Trigger a load, as long as the 'src' attribute is present.
+
+2012-02-09  Jonathan Backer  <backer@chromium.org>
+
+        [chromium] Add setNeedsRedraw to WebWidget
+        https://bugs.webkit.org/show_bug.cgi?id=77555
+
+        Reviewed by James Robinson.
+
+        * platform/graphics/chromium/cc/CCLayerTreeHost.cpp:
+        (WebCore::CCLayerTreeHost::setNeedsRedraw):
+        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.cpp:
+        (WebCore::CCLayerTreeHostImpl::setFullRootLayerDamage):
+        (WebCore):
+        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.h:
+        (CCLayerTreeHostImpl):
+        * platform/graphics/chromium/cc/CCSingleThreadProxy.cpp:
+        (WebCore::CCSingleThreadProxy::setNeedsRedraw):
+        * platform/graphics/chromium/cc/CCThreadProxy.cpp:
+        (WebCore::CCThreadProxy::setNeedsRedraw):
+        (WebCore::CCThreadProxy::setFullRootLayerDamageOnImplThread):
+        (WebCore):
+        * platform/graphics/chromium/cc/CCThreadProxy.h:
+        (CCThreadProxy):
+
+2012-02-09  Pavel Feldman  <pfeldman@google.com>
+
+        Web Inspector: fix setOuterHTML for the case that adds / removes duplicate.
+        https://bugs.webkit.org/show_bug.cgi?id=78235
+
+        Reviewed by Yury Semikhatsky.
+
+        * inspector/DOMEditor.cpp:
+        (WebCore::DOMEditor::diff):
+        (WebCore::DOMEditor::innerPatchChildren):
+        (WebCore):
+        (WebCore::nodeName):
+        (WebCore::DOMEditor::dumpMap):
+        * inspector/DOMEditor.h:
+        (DOMEditor):
+
+2012-02-09  Allan Sandfeld Jensen  <allan.jensen@nokia.com>
+
+        Ensure timers and other active DOM objects do not fire in suspended documents.
+        https://bugs.webkit.org/show_bug.cgi?id=53733
+
+        ScriptExecutionContext now remembers it has suspended active DOM objects
+        and suspends all newly installed active DOM objects as well.
+
+        All create-calls active DOM objects now calls the post constructor method
+        suspendIfNeeded that updates the suspend state. It is post constructor
+        because the suspend/resume functions are virtual and thus can not be called
+        from constructors.
+
+        Reviewed by Mihai Parparita.
+
+        Test: fast/events/suspend-timers.html
+
+        * Modules/intents/IntentRequest.cpp:
+        (WebCore::IntentRequest::create):
+        * bindings/generic/ActiveDOMCallback.cpp:
+        (WebCore::ActiveDOMCallback::ActiveDOMCallback):
+        * dom/ActiveDOMObject.cpp:
+        (WebCore::ActiveDOMObject::ActiveDOMObject):
+        (WebCore::ActiveDOMObject::~ActiveDOMObject):
+        (WebCore::ActiveDOMObject::suspendIfNeeded):
+        * dom/ActiveDOMObject.h:
+        (WebCore::ActiveDOMObject::suspendIfNeededCalled):
+        * dom/DocumentEventQueue.cpp:
+        (WebCore::DocumentEventQueue::DocumentEventQueue):
+        * dom/ScriptExecutionContext.cpp:
+        (WebCore::ScriptExecutionContext::ScriptExecutionContext):
+        (WebCore::ScriptExecutionContext::~ScriptExecutionContext):
+        (WebCore::ScriptExecutionContext::canSuspendActiveDOMObjects):
+        (WebCore::ScriptExecutionContext::suspendActiveDOMObjects):
+        (WebCore::ScriptExecutionContext::resumeActiveDOMObjects):
+        (WebCore::ScriptExecutionContext::stopActiveDOMObjects):
+        (WebCore::ScriptExecutionContext::suspendActiveDOMObjectIfNeeded):
+        * dom/ScriptExecutionContext.h:
+        (ScriptExecutionContext):
+        (WebCore::ScriptExecutionContext::activeDOMObjectsAreSuspended):
+        * fileapi/DOMFileSystem.cpp:
+        (WebCore::DOMFileSystem::create):
+        * fileapi/FileReader.cpp:
+        (WebCore::FileReader::create):
+        * fileapi/FileReader.h:
+        * fileapi/FileWriter.cpp:
+        (WebCore::FileWriter::create):
+        * fileapi/FileWriter.h:
+        * history/CachedFrame.cpp:
+        (WebCore::CachedFrame::CachedFrame):
+        * html/HTMLAudioElement.cpp:
+        (WebCore::HTMLAudioElement::create):
+        (WebCore::HTMLAudioElement::createForJSConstructor):
+        * html/HTMLMarqueeElement.cpp:
+        (WebCore::HTMLMarqueeElement::create):
+        * html/HTMLVideoElement.cpp:
+        (WebCore::HTMLVideoElement::create):
+        * mediastream/PeerConnection.cpp:
+        (WebCore::PeerConnection::create):
+        * notifications/Notification.cpp:
+        (WebCore::Notification::create):
+        * notifications/NotificationCenter.cpp:
+        (WebCore::NotificationCenter::create):
+        * notifications/NotificationCenter.h:
+        * page/DOMTimer.cpp:
+        (WebCore::DOMTimer::install):
+        (WebCore::DOMTimer::fired):
+        * page/EventSource.cpp:
+        (WebCore::EventSource::create):
+        * page/SuspendableTimer.cpp:
+        (WebCore::SuspendableTimer::SuspendableTimer):
+        * storage/IDBDatabase.cpp:
+        (WebCore::IDBDatabase::create):
+        * storage/IDBRequest.cpp:
+        (WebCore::IDBRequest::create):
+        * storage/IDBTransaction.cpp:
+        (WebCore::IDBTransaction::create):
+        * storage/IDBVersionChangeRequest.cpp:
+        (WebCore::IDBVersionChangeRequest::create):
+        * webaudio/AudioContext.cpp:
+        (WebCore::AudioContext::create):
+        (WebCore::AudioContext::createOfflineContext):
+        * websockets/WebSocket.cpp:
+        (WebCore::WebSocket::create):
+        * websockets/WebSocket.h:
+        * workers/SharedWorker.cpp:
+        (WebCore::SharedWorker::create):
+        * workers/Worker.cpp:
+        (WebCore::Worker::create):
+        * xml/XMLHttpRequest.cpp:
+        (WebCore::XMLHttpRequest::create):
+
+2012-02-09  Vsevolod Vlasov  <vsevik@chromium.org>
+
+        Unreviewed followup for r107235.
+
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel.prototype._hideNavigatorOverlay):
+        (WebInspector.ScriptsPanel.prototype._navigatorOverlayWillHide):
+
+2012-02-09  Vsevolod Vlasov  <vsevik@chromium.org>
+
+        Web Inspector: Support hiding scripts panel debug sidebar.
+        https://bugs.webkit.org/show_bug.cgi?id=77543
+
+        Reviewed by Pavel Feldman.
+
+        * English.lproj/localizedStrings.js:
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * inspector/compile-front-end.sh:
+        * inspector/front-end/Dialog.js:
+        (WebInspector.Dialog):
+        (WebInspector.DialogDelegate.prototype.show):
+        * inspector/front-end/Images/navigatorPinButton.png: Added.
+        * inspector/front-end/Images/navigatorShowHideButton.png: Added.
+        * inspector/front-end/ScriptsNavigator.js:
+        (WebInspector.ScriptsNavigator):
+        (WebInspector.ScriptsNavigator.prototype.get view):
+        (WebInspector.ScriptsNavigator.prototype.get element):
+        (WebInspector.ScriptsNavigator.prototype.show):
+        (WebInspector.ScriptsNavigator.prototype.focus):
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel.prototype._fileSelected):
+        (WebInspector.ScriptsPanel.prototype._createDebugToolbar):
+        (WebInspector.ScriptsPanel.prototype._createNavigatorControls):
+        (WebInspector.ScriptsPanel.prototype._createNavigatorControlButton):
+        (WebInspector.ScriptsPanel.prototype._toggleNavigator):
+        (WebInspector.ScriptsPanel.prototype._hidePinnedNavigator):
+        (WebInspector.ScriptsPanel.prototype.set _pinNavigator):
+        (WebInspector.ScriptsPanel.prototype.set _showNavigatorOverlay):
+        (WebInspector.ScriptsPanel.prototype._hideNavigatorOverlay):
+        (WebInspector.ScriptsPanel.prototype._navigatorOverlayWasShown):
+        (WebInspector.ScriptsPanel.prototype._navigatorOverlayWillHide):
+        * inspector/front-end/SidebarOverlay.js: Added.
+        * inspector/front-end/SplitView.js:
+        (WebInspector.SplitView.prototype.get resizable):
+        (WebInspector.SplitView.prototype.hideMainElement):
+        (WebInspector.SplitView.prototype.showMainElement):
+        (WebInspector.SplitView.prototype.hideSidebarElement):
+        (WebInspector.SplitView.prototype.showSidebarElement):
+        (WebInspector.SplitView.prototype._resizerDragging):
+        * inspector/front-end/TabbedEditorContainer.js:
+        (WebInspector.TabbedEditorContainer.prototype.get element):
+        * inspector/front-end/WebKit.qrc:
+        * inspector/front-end/dialog.css:
+        * inspector/front-end/inspector.html:
+        * inspector/front-end/scriptsPanel.css:
+
+2012-02-09  Alexei Filippov  <alexeif@chromium.org>
+
+        Web Inspector: Show percentage by default in heap profiler.
+        https://bugs.webkit.org/show_bug.cgi?id=78103
+
+        Reviewed by Pavel Feldman.
+
+        * inspector/front-end/DetailedHeapshotGridNodes.js:
+        (WebInspector.HeapSnapshotGridNode.prototype._toPercentString):
+        (WebInspector.HeapSnapshotGridNode.prototype._createValueCell):
+        (WebInspector.HeapSnapshotGenericObjectNode.prototype.get data):
+        (WebInspector.HeapSnapshotConstructorNode.prototype.get data):
+        * inspector/front-end/DetailedHeapshotView.js:
+        (WebInspector.DetailedHeapshotView.profileCallback):
+        (WebInspector.DetailedHeapshotView):
+        (WebInspector.DetailedHeapshotView.prototype.get statusBarItems):
+        (WebInspector.DetailedHeapshotView.prototype._mouseDownInContentsGrid):
+        (WebInspector.DetailedHeapshotView.prototype._updateFilterOptions):
+        * inspector/front-end/UIUtils.js:
+        (Number.withThousandsSeparator):
+        * inspector/front-end/heapProfiler.css:
+        (.detailed-heapshot-view .data-grid span.percent-column):
+
 2012-02-09  Ilya Tikhonovsky  <loislo@chromium.org>
 
         Web Inspector: Timeline memory graph would have been more useful if it had used minUsedHeapSize as the lower bound. Currently it uses zero as the lower bound.
diff --git a/Source/WebCore/Configurations/Base.xcconfig b/Source/WebCore/Configurations/Base.xcconfig
index 9e3608de5..6e894c980 100644
--- a/Source/WebCore/Configurations/Base.xcconfig
+++ b/Source/WebCore/Configurations/Base.xcconfig
@@ -69,6 +69,11 @@ WARNING_CFLAGS_macosx_ppc = $(WARNING_CFLAGS_BASE) -Wshorten-64-to-32;
 WARNING_CFLAGS_macosx_ppc64 = $(WARNING_CFLAGS_BASE);
 WARNING_CFLAGS_macosx_x86_64 = $(WARNING_CFLAGS_BASE);
 
+CLANG_CXX_LIBRARY = $(CLANG_CXX_LIBRARY_$(TARGET_MAC_OS_X_VERSION_MAJOR));
+CLANG_CXX_LIBRARY_1060 = libstdc++;
+CLANG_CXX_LIBRARY_1070 = libc++;
+CLANG_CXX_LIBRARY_1080 = libc++;
+CLANG_CXX_LIBRARY_1090 = libc++;
 
 REAL_PLATFORM_NAME = $(REAL_PLATFORM_NAME_$(PLATFORM_NAME));
 REAL_PLATFORM_NAME_ = $(REAL_PLATFORM_NAME_macosx);
diff --git a/Source/WebCore/Configurations/FeatureDefines.xcconfig b/Source/WebCore/Configurations/FeatureDefines.xcconfig
index f5bc9cf39..3e2090355 100644
--- a/Source/WebCore/Configurations/FeatureDefines.xcconfig
+++ b/Source/WebCore/Configurations/FeatureDefines.xcconfig
@@ -37,7 +37,8 @@ ENABLE_BLOB_macosx = ENABLE_BLOB;
 ENABLE_CLIENT_BASED_GEOLOCATION = $(ENABLE_CLIENT_BASED_GEOLOCATION_$(REAL_PLATFORM_NAME));
 ENABLE_CLIENT_BASED_GEOLOCATION_macosx = ENABLE_CLIENT_BASED_GEOLOCATION;
 
-ENABLE_DASHBOARD_SUPPORT = ENABLE_DASHBOARD_SUPPORT;
+ENABLE_DASHBOARD_SUPPORT = $(ENABLE_DASHBOARD_SUPPORT_$(REAL_PLATFORM_NAME));
+ENABLE_DASHBOARD_SUPPORT_macosx = ENABLE_DASHBOARD_SUPPORT;
 
 ENABLE_DATALIST = $(ENABLE_DATALIST_$(REAL_PLATFORM_NAME));
 ENABLE_DATALIST_macosx = ENABLE_DATALIST;
@@ -95,7 +96,7 @@ ENABLE_MEDIA_SOURCE = ;
 ENABLE_MEDIA_STATISTICS = ;
 ENABLE_METER_TAG = ENABLE_METER_TAG;
 ENABLE_MHTML = ;
-ENABLE_MUTATION_OBSERVERS = ;
+ENABLE_MUTATION_OBSERVERS = ENABLE_MUTATION_OBSERVERS;
 
 ENABLE_NOTIFICATIONS = $(ENABLE_NOTIFICATIONS_$(REAL_PLATFORM_NAME));
 ENABLE_NOTIFICATIONS_macosx = $(ENABLE_NOTIFICATIONS_macosx_$(TARGET_MAC_OS_X_VERSION_MAJOR));
diff --git a/Source/WebCore/Configurations/Version.xcconfig b/Source/WebCore/Configurations/Version.xcconfig
index 01f343c7a..14e0bdc80 100644
--- a/Source/WebCore/Configurations/Version.xcconfig
+++ b/Source/WebCore/Configurations/Version.xcconfig
@@ -22,7 +22,7 @@
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
 
 MAJOR_VERSION = 535;
-MINOR_VERSION = 20;
+MINOR_VERSION = 23;
 TINY_VERSION = 0;
 FULL_VERSION = $(MAJOR_VERSION).$(MINOR_VERSION);
 
diff --git a/Source/WebCore/Configurations/WebCore.xcconfig b/Source/WebCore/Configurations/WebCore.xcconfig
index fb2739790..662e99427 100644
--- a/Source/WebCore/Configurations/WebCore.xcconfig
+++ b/Source/WebCore/Configurations/WebCore.xcconfig
@@ -77,8 +77,8 @@ WEBCORE_FRAMEWORKS_DIR_macosx_USE_STAGING_INSTALL_PATH_NO = $(NORMAL_WEBCORE_FRA
 WEBCORE_FRAMEWORKS_DIR_macosx_USE_STAGING_INSTALL_PATH_YES = $(SYSTEM_LIBRARY_DIR)/StagedFrameworks/Safari;
 
 NORMAL_PRODUCTION_FRAMEWORKS_DIR = $(NORMAL_PRODUCTION_FRAMEWORKS_DIR_$(REAL_PLATFORM_NAME));
-NORMAL_PRODUCTION_FRAMEWORKS_DIR_iphoneos = $(SDKROOT)$(SYSTEM_LIBRARY_DIR)/PrivateFrameworks;
-NORMAL_PRODUCTION_FRAMEWORKS_DIR_iphonesimulator = $(PRODUCTION_FRAMEWORKS_DIR_iphoneos);
+NORMAL_PRODUCTION_FRAMEWORKS_DIR_iphoneos = $(SYSTEM_LIBRARY_DIR)/PrivateFrameworks;
+NORMAL_PRODUCTION_FRAMEWORKS_DIR_iphonesimulator = $(NORMAL_PRODUCTION_FRAMEWORKS_DIR_iphoneos);
 NORMAL_PRODUCTION_FRAMEWORKS_DIR_macosx = $(NEXT_ROOT)$(SYSTEM_LIBRARY_DIR)/Frameworks;
 
 PRODUCTION_FRAMEWORKS_DIR = $(PRODUCTION_FRAMEWORKS_DIR_$(REAL_PLATFORM_NAME));
diff --git a/Source/WebCore/DerivedSources.make b/Source/WebCore/DerivedSources.make
index 70fc74489..828d9b233 100644
--- a/Source/WebCore/DerivedSources.make
+++ b/Source/WebCore/DerivedSources.make
@@ -28,6 +28,7 @@
 
 VPATH = \
     $(WebCore) \
+    $(WebCore)/Modules/geolocation \
     $(WebCore)/bindings/generic \
     $(WebCore)/bindings/js \
     $(WebCore)/bindings/objc \
@@ -53,6 +54,12 @@ VPATH = \
 #
 
 BINDING_IDLS = \
+    $(WebCore)/Modules/geolocation/Geolocation.idl \
+    $(WebCore)/Modules/geolocation/Geoposition.idl \
+    $(WebCore)/Modules/geolocation/NavigatorGeolocation.idl \
+    $(WebCore)/Modules/geolocation/PositionCallback.idl \
+    $(WebCore)/Modules/geolocation/PositionError.idl \
+    $(WebCore)/Modules/geolocation/PositionErrorCallback.idl \
     $(WebCore)/css/CSSCharsetRule.idl \
     $(WebCore)/css/CSSFontFaceRule.idl \
     $(WebCore)/css/CSSImportRule.idl \
@@ -151,6 +158,7 @@ BINDING_IDLS = \
     $(WebCore)/fileapi/Blob.idl \
     $(WebCore)/fileapi/DOMFileSystem.idl \
     $(WebCore)/fileapi/DOMFileSystemSync.idl \
+    $(WebCore)/fileapi/DOMWindowFileSystem.idl \
     $(WebCore)/fileapi/DirectoryEntry.idl \
     $(WebCore)/fileapi/DirectoryEntrySync.idl \
     $(WebCore)/fileapi/DirectoryReader.idl \
@@ -183,6 +191,7 @@ BINDING_IDLS = \
     $(WebCore)/html/DOMSettableTokenList.idl \
     $(WebCore)/html/DOMTokenList.idl \
     $(WebCore)/html/DOMURL.idl \
+    $(WebCore)/html/DOMWindowHTML.idl \
     $(WebCore)/html/HTMLAllCollection.idl \
     $(WebCore)/html/HTMLAnchorElement.idl \
     $(WebCore)/html/HTMLAppletElement.idl \
@@ -260,9 +269,6 @@ BINDING_IDLS = \
     $(WebCore)/html/MediaController.idl \
     $(WebCore)/html/MediaError.idl \
     $(WebCore)/html/TextMetrics.idl \
-    $(WebCore)/html/TextTrack.idl \
-    $(WebCore)/html/TextTrackCue.idl \
-    $(WebCore)/html/TextTrackCueList.idl \
     $(WebCore)/html/TimeRanges.idl \
     $(WebCore)/html/ValidityState.idl \
     $(WebCore)/html/canvas/ArrayBuffer.idl \
@@ -271,6 +277,7 @@ BINDING_IDLS = \
     $(WebCore)/html/canvas/CanvasPattern.idl \
     $(WebCore)/html/canvas/CanvasRenderingContext.idl \
     $(WebCore)/html/canvas/CanvasRenderingContext2D.idl \
+    $(WebCore)/html/canvas/DOMWindowWebGL.idl \
     $(WebCore)/html/canvas/DataView.idl \
     $(WebCore)/html/canvas/Float32Array.idl \
     $(WebCore)/html/canvas/Float64Array.idl \
@@ -300,6 +307,9 @@ BINDING_IDLS = \
     $(WebCore)/html/canvas/WebGLVertexArrayObjectOES.idl \
     $(WebCore)/html/shadow/HTMLContentElement.idl \
     $(WebCore)/html/shadow/HTMLShadowElement.idl \
+    $(WebCore)/html/track/TextTrack.idl \
+    $(WebCore)/html/track/TextTrackCue.idl \
+    $(WebCore)/html/track/TextTrackCueList.idl \
     $(WebCore)/html/track/TextTrackList.idl \
     $(WebCore)/html/track/TrackEvent.idl \
     $(WebCore)/inspector/InjectedScriptHost.idl \
@@ -317,8 +327,6 @@ BINDING_IDLS = \
     $(WebCore)/page/DOMSelection.idl \
     $(WebCore)/page/DOMWindow.idl \
     $(WebCore)/page/EventSource.idl \
-    $(WebCore)/page/Geolocation.idl \
-    $(WebCore)/page/Geoposition.idl \
     $(WebCore)/page/History.idl \
     $(WebCore)/page/Location.idl \
     $(WebCore)/page/MemoryInfo.idl \
@@ -326,9 +334,6 @@ BINDING_IDLS = \
     $(WebCore)/page/Performance.idl \
     $(WebCore)/page/PerformanceNavigation.idl \
     $(WebCore)/page/PerformanceTiming.idl \
-    $(WebCore)/page/PositionCallback.idl \
-    $(WebCore)/page/PositionError.idl \
-    $(WebCore)/page/PositionErrorCallback.idl \
     $(WebCore)/page/Screen.idl \
     $(WebCore)/page/SpeechInputEvent.idl \
     $(WebCore)/page/SpeechInputResult.idl \
@@ -374,6 +379,7 @@ BINDING_IDLS = \
     $(WebCore)/storage/StorageInfoErrorCallback.idl \
     $(WebCore)/storage/StorageInfoQuotaCallback.idl \
     $(WebCore)/storage/StorageInfoUsageCallback.idl \
+    $(WebCore)/svg/DOMWindowSVG.idl \
     $(WebCore)/svg/ElementTimeControl.idl \
     $(WebCore)/svg/SVGAElement.idl \
     $(WebCore)/svg/SVGAltGlyphDefElement.idl \
@@ -559,12 +565,14 @@ BINDING_IDLS = \
     $(WebCore)/websockets/DOMWindowWebSocket.idl \
     $(WebCore)/websockets/WebSocket.idl \
     $(WebCore)/workers/AbstractWorker.idl \
+    $(WebCore)/workers/DOMWindowWorker.idl \
     $(WebCore)/workers/DedicatedWorkerContext.idl \
     $(WebCore)/workers/SharedWorker.idl \
     $(WebCore)/workers/SharedWorkerContext.idl \
     $(WebCore)/workers/Worker.idl \
     $(WebCore)/workers/WorkerContext.idl \
     $(WebCore)/workers/WorkerLocation.idl \
+    $(WebCore)/xml/DOMWindowXML.idl \
     $(WebCore)/xml/DOMParser.idl \
     $(WebCore)/xml/XMLHttpRequest.idl \
     $(WebCore)/xml/XMLHttpRequestException.idl \
@@ -911,15 +919,16 @@ JS_BINDINGS_SCRIPTS = $(GENERATE_SCRIPTS) bindings/scripts/CodeGeneratorJS.pm
 SUPPLEMENTAL_DEPENDENCY_FILE = ./supplemental_dependency.tmp
 IDL_FILES_TMP = ./idl_files.tmp
 ADDITIONAL_IDLS = $(WebCore)/inspector/JavaScriptCallFrame.idl
+IDL_ATTRIBUTES_FILE = $(WebCore)/bindings/scripts/IDLAttributes.txt
 
 # The following two lines get a space character stored in a variable.
 # See <http://blog.jgc.org/2007/06/escaping-comma-and-space-in-gnu-make.html>.
 space :=
 space +=
 
-$(SUPPLEMENTAL_DEPENDENCY_FILE) : $(RESOLVE_SUPPLEMENTAL_SCRIPTS) $(BINDING_IDLS) $(ADDITIONAL_IDLS)
+$(SUPPLEMENTAL_DEPENDENCY_FILE) : $(RESOLVE_SUPPLEMENTAL_SCRIPTS) $(BINDING_IDLS) $(ADDITIONAL_IDLS) $(IDL_ATTRIBUTES_FILE)
 	printf "$(subst $(space),,$(patsubst %,%\n,$(BINDING_IDLS) $(ADDITIONAL_IDLS)))" > $(IDL_FILES_TMP)
-	$(call resolve_supplemental_script, $(RESOLVE_SUPPLEMENTAL_SCRIPTS)) --defines "$(FEATURE_DEFINES) $(ADDITIONAL_IDL_DEFINES) LANGUAGE_JAVASCRIPT" --idlFilesList $(IDL_FILES_TMP) --supplementalDependencyFile $@
+	$(call resolve_supplemental_script, $(RESOLVE_SUPPLEMENTAL_SCRIPTS)) --defines "$(FEATURE_DEFINES) $(ADDITIONAL_IDL_DEFINES) LANGUAGE_JAVASCRIPT" --idlFilesList $(IDL_FILES_TMP) --supplementalDependencyFile $@ --idlAttributesFile $(IDL_ATTRIBUTES_FILE)
 	rm -f $(IDL_FILES_TMP)
 
 JS%.h : %.idl $(JS_BINDINGS_SCRIPTS) $(SUPPLEMENTAL_DEPENDENCY_FILE)
diff --git a/Source/WebCore/DerivedSources.pri b/Source/WebCore/DerivedSources.pri
index 610cff199..a6976b4cb 100644
--- a/Source/WebCore/DerivedSources.pri
+++ b/Source/WebCore/DerivedSources.pri
@@ -86,6 +86,12 @@ STYLESHEETS_EMBED = \
     $$PWD/css/mobileThemeQt.css
 
 IDL_BINDINGS += \
+    $$PWD/Modules/geolocation/Geolocation.idl \
+    $$PWD/Modules/geolocation/Geoposition.idl \
+    $$PWD/Modules/geolocation/NavigatorGeolocation.idl \
+    $$PWD/Modules/geolocation/PositionCallback.idl \
+    $$PWD/Modules/geolocation/PositionError.idl \
+    $$PWD/Modules/geolocation/PositionErrorCallback.idl \
     $$PWD/css/Counter.idl \
     $$PWD/css/CSSCharsetRule.idl \
     $$PWD/css/CSSFontFaceRule.idl \
@@ -183,6 +189,7 @@ IDL_BINDINGS += \
     $$PWD/fileapi/DirectoryReaderSync.idl \
     $$PWD/fileapi/DOMFileSystem.idl \
     $$PWD/fileapi/DOMFileSystemSync.idl \
+    $$PWD/fileapi/DOMWindowFileSystem.idl \
     $$PWD/fileapi/EntriesCallback.idl \
     $$PWD/fileapi/Entry.idl \
     $$PWD/fileapi/EntryArray.idl \
@@ -208,6 +215,7 @@ IDL_BINDINGS += \
     $$PWD/fileapi/WebKitBlobBuilder.idl \
     $$PWD/html/canvas/ArrayBufferView.idl \
     $$PWD/html/canvas/ArrayBuffer.idl \
+    $$PWD/html/canvas/DOMWindowWebGL.idl \
     $$PWD/html/canvas/DataView.idl \
     $$PWD/html/canvas/Int8Array.idl \
     $$PWD/html/canvas/Float32Array.idl \
@@ -245,6 +253,7 @@ IDL_BINDINGS += \
     $$PWD/html/DOMSettableTokenList.idl \
     $$PWD/html/DOMTokenList.idl \
     $$PWD/html/DOMURL.idl \
+    $$PWD/html/DOMWindowHTML.idl \
     $$PWD/html/HTMLAllCollection.idl \
     $$PWD/html/HTMLAudioElement.idl \
     $$PWD/html/HTMLAnchorElement.idl \
@@ -342,8 +351,6 @@ IDL_BINDINGS += \
     $$PWD/page/DOMSelection.idl \
     $$PWD/page/DOMWindow.idl \
     $$PWD/page/EventSource.idl \
-    $$PWD/page/Geolocation.idl \
-    $$PWD/page/Geoposition.idl \
     $$PWD/page/History.idl \
     $$PWD/page/Location.idl \
     $$PWD/page/MemoryInfo.idl \
@@ -351,9 +358,6 @@ IDL_BINDINGS += \
     $$PWD/page/Performance.idl \
     $$PWD/page/PerformanceNavigation.idl \
     $$PWD/page/PerformanceTiming.idl \
-    $$PWD/page/PositionCallback.idl \
-    $$PWD/page/PositionError.idl \
-    $$PWD/page/PositionErrorCallback.idl \
     $$PWD/page/Screen.idl \
     $$PWD/page/SpeechInputEvent.idl \
     $$PWD/page/SpeechInputResult.idl \
@@ -426,12 +430,14 @@ IDL_BINDINGS += \
     $$PWD/websockets/DOMWindowWebSocket.idl \
     $$PWD/websockets/WebSocket.idl \
     $$PWD/workers/AbstractWorker.idl \
+    $$PWD/workers/DOMWindowWorker.idl \
     $$PWD/workers/DedicatedWorkerContext.idl \
     $$PWD/workers/SharedWorker.idl \
     $$PWD/workers/SharedWorkerContext.idl \
     $$PWD/workers/Worker.idl \
     $$PWD/workers/WorkerContext.idl \
     $$PWD/workers/WorkerLocation.idl \
+    $$PWD/xml/DOMWindowXML.idl \
     $$PWD/xml/DOMParser.idl \
     $$PWD/xml/XMLHttpRequest.idl \
     $$PWD/xml/XMLHttpRequestException.idl \
@@ -454,6 +460,7 @@ v8 {
 
 contains(DEFINES, ENABLE_SVG=1) {
   IDL_BINDINGS += \
+    $$PWD/svg/DOMWindowSVG.idl \
     $$PWD/svg/SVGZoomEvent.idl \
     $$PWD/svg/SVGAElement.idl \
     $$PWD/svg/SVGAltGlyphDefElement.idl \
@@ -599,9 +606,9 @@ contains(DEFINES, ENABLE_SVG=1) {
 
 contains(DEFINES, ENABLE_VIDEO_TRACK=1) {
   IDL_BINDINGS += \
-    $$PWD/html/TextTrack.idl \
-    $$PWD/html/TextTrackCue.idl \
-    $$PWD/html/TextTrackCueList.idl \
+    $$PWD/html/track/TextTrack.idl \
+    $$PWD/html/track/TextTrackCue.idl \
+    $$PWD/html/track/TextTrackCueList.idl \
     $$PWD/html/track/TextTrackList.idl \
     $$PWD/html/track/TrackEvent.idl \
 }
@@ -659,8 +666,9 @@ GENERATORS += cssvalues
 SUPPLEMENTAL_DEPENDENCY_FILE = supplemental_dependency.tmp
 IDL_FILES_TMP = ${QMAKE_FUNC_FILE_OUT_PATH}/idl_files.tmp
 RESOLVE_SUPPLEMENTAL_SCRIPT = $$PWD/bindings/scripts/resolve-supplemental.pl
+IDL_ATTRIBUTES_FILE = $$PWD/bindings/scripts/IDLAttributes.txt
 
-resolveSupplemental.input = RESOLVE_SUPPLEMENTAL_SCRIPT # dummy input to fire this rule
+resolveSupplemental.input = IDL_ATTRIBUTES_FILE
 resolveSupplemental.script = $$RESOLVE_SUPPLEMENTAL_SCRIPT
 # FIXME : We need to use only perl at some point.
 resolveSupplemental.commands = echo $$IDL_BINDINGS | tr \' \' \'\\n\' > $$IDL_FILES_TMP && \
@@ -668,6 +676,7 @@ resolveSupplemental.commands = echo $$IDL_BINDINGS | tr \' \' \'\\n\' > $$IDL_FI
                                --defines \"$${FEATURE_DEFINES_JAVASCRIPT}\" \
                                --idlFilesList $$IDL_FILES_TMP \
                                --supplementalDependencyFile ${QMAKE_FUNC_FILE_OUT_PATH}/$$SUPPLEMENTAL_DEPENDENCY_FILE \
+                               --idlAttributesFile $${IDL_ATTRIBUTES_FILE} \
                                --preprocessor \"$${QMAKE_MOC} -E\"
 resolveSupplemental.output = $$SUPPLEMENTAL_DEPENDENCY_FILE
 resolveSupplemental.add_output_to_sources = false
@@ -682,6 +691,7 @@ else: generator = JS
 generateBindings.commands = perl -I$$PWD/bindings/scripts $$generateBindings.script \
                             --defines \"$${FEATURE_DEFINES_JAVASCRIPT}\" \
                             --generator $$generator \
+                            --include $$PWD/Modules/geolocation \
                             --include $$PWD/dom \
                             --include $$PWD/fileapi \
                             --include $$PWD/html \
diff --git a/Source/WebCore/English.lproj/Localizable.strings b/Source/WebCore/English.lproj/Localizable.strings
index 245dacb04..0c2378a0e 100644
--- a/Source/WebCore/English.lproj/Localizable.strings
+++ b/Source/WebCore/English.lproj/Localizable.strings
diff --git a/Source/WebCore/English.lproj/localizedStrings.js b/Source/WebCore/English.lproj/localizedStrings.js
index a2ddf6763..cadf49ee2 100644
--- a/Source/WebCore/English.lproj/localizedStrings.js
+++ b/Source/WebCore/English.lproj/localizedStrings.js
diff --git a/Source/WebCore/ForwardingHeaders/wtf/DataLog.h b/Source/WebCore/ForwardingHeaders/wtf/DataLog.h
new file mode 100644
index 000000000..1be170fcb
--- /dev/null
+++ b/Source/WebCore/ForwardingHeaders/wtf/DataLog.h
@@ -0,0 +1,4 @@
+#ifndef WebCore_FWD_DataLog_h
+#define WebCore_FWD_DataLog_h
+#include <JavaScriptCore/DataLog.h>
+#endif
diff --git a/Source/WebCore/GNUmakefile.am b/Source/WebCore/GNUmakefile.am
index fe5ccb94f..2df6a36d6 100644
--- a/Source/WebCore/GNUmakefile.am
+++ b/Source/WebCore/GNUmakefile.am
@@ -11,6 +11,7 @@ webcore_cppflags += \
 	-I$(srcdir)/Source/ThirdParty/ANGLE/include \
 	-I$(srcdir)/Source/ThirdParty/ANGLE/include/GLSLANG \
 	-I$(srcdir)/Source/WebCore \
+	-I$(srcdir)/Source/WebCore/Modules/geolocation \
 	-I$(srcdir)/Source/WebCore/accessibility \
 	-I$(srcdir)/Source/WebCore/bindings \
 	-I$(srcdir)/Source/WebCore/bindings/generic \
@@ -42,6 +43,7 @@ webcore_cppflags += \
 	-I$(srcdir)/Source/WebCore/notifications \
 	-I$(srcdir)/Source/WebCore/page \
 	-I$(srcdir)/Source/WebCore/page/animation \
+	-I$(srcdir)/Source/WebCore/page/scrolling \
 	-I$(srcdir)/Source/WebCore/platform \
 	-I$(srcdir)/Source/WebCore/platform/animation \
 	-I$(srcdir)/Source/WebCore/platform/audio \
@@ -588,7 +590,9 @@ endif  # END USE_CLUTTER
 # ---
 if ENABLE_MHTML
 FEATURE_DEFINES += ENABLE_MHTML=1
-webcore_cppflags += -DENABLE_MHTML=1
+webcore_cppflags += \
+	-DENABLE_MHTML=1 \
+	-I$(srcdir)/Source/WebCore/loader/archive/mhtml
 endif  # END ENABLE_MHTML
 
 # ---
@@ -755,6 +759,7 @@ DerivedSources/ANGLE/glslang_tab.cpp: Source/ThirdParty/ANGLE/src/compiler/glsla
 DerivedSources/ANGLE/glslang_tab.h: DerivedSources/ANGLE/glslang_tab.cpp
 
 IDL_PATH := \
+    $(WebCore)/Modules/geolocation \
     $(WebCore)/bindings/js \
     $(WebCore)/css \
     $(WebCore)/dom \
@@ -780,23 +785,32 @@ IDL_PATH := \
 
 vpath %.idl $(IDL_PATH)
 
-# This does not appear to work correctly with gnumake unless
-# it includes an empty command list (the semicolon).
-DerivedSources/WebCore/JS%.cpp: DerivedSources/WebCore/JS%.h;
-
-SUPPLEMENTAL_DEPENDENCY_FILE = $(top_builddir)/DerivedSources/WebCore/supplemental_dependency.tmp
-IDL_FILES_TMP = $(top_builddir)/DerivedSources/WebCore/idl_files.tmp
+supplemental_dependency_file = $(top_builddir)/DerivedSources/WebCore/idl_supplemental_dependencies
+idl_files_list = $(top_builddir)/DerivedSources/WebCore/idl_files_list
+idl_attributes_file = $(WebCore)/bindings/scripts/IDLAttributes.txt
 
 .SECONDARY:
-$(SUPPLEMENTAL_DEPENDENCY_FILE): $(SCRIPTS_FOR_RESOLVE_SUPPLEMENTAL) $(dom_binding_idls)
+$(supplemental_dependency_file): $(SCRIPTS_FOR_RESOLVE_SUPPLEMENTAL) $(dom_binding_idls) $(idl_attributes_file)
 	$(AM_V_GEN)
-	$(AM_V_at)echo -n > $(IDL_FILES_TMP)
-	$(AM_V_at)($(foreach idl, $(dom_binding_idls), echo $(idl) &&) echo -n) >> $(IDL_FILES_TMP)
-	$(AM_V_at)$(PERL) -I$(WebCore)/bindings/scripts $(WebCore)/bindings/scripts/resolve-supplemental.pl --defines "LANGUAGE_JAVASCRIPT=1 $(FEATURE_DEFINES)" --idlFilesList $(IDL_FILES_TMP) --supplementalDependencyFile $@
+	$(AM_V_at)echo -n > $(idl_files_list)
+	$(AM_V_at)($(foreach idl, $(dom_binding_idls), echo $(idl) &&) echo -n) >> $(idl_files_list)
+	$(AM_V_at)$(PERL) -I$(WebCore)/bindings/scripts $(WebCore)/bindings/scripts/resolve-supplemental.pl --defines "LANGUAGE_JAVASCRIPT=1 $(FEATURE_DEFINES)" --idlFilesList $(idl_files_list) --supplementalDependencyFile $@ --idlAttributesFile $(idl_attributes_file)
+
+# This does not appear to work correctly with gnumake unless
+# it includes an empty command list (the semicolon).
+DerivedSources/WebCore/JS%.cpp: DerivedSources/WebCore/JS%.h;
 
 .SECONDARY:
-DerivedSources/WebCore/JS%.h: %.idl $(SCRIPTS_FOR_GENERATE_BINDINGS) $(WebCore)/bindings/scripts/CodeGeneratorJS.pm $(SUPPLEMENTAL_DEPENDENCY_FILE)
-	$(AM_V_GEN)$(PERL) -I$(WebCore)/bindings/scripts $(WebCore)/bindings/scripts/generate-bindings.pl $(IDL_PATH:%=--include "%") --outputDir "$(GENSOURCES_WEBCORE)" --defines "LANGUAGE_JAVASCRIPT=1 $(FEATURE_DEFINES)" --generator JS --supplementalDependencyFile $(SUPPLEMENTAL_DEPENDENCY_FILE) $<
+DerivedSources/WebCore/JS%.h: %.idl $(SCRIPTS_FOR_GENERATE_BINDINGS) $(WebCore)/bindings/scripts/CodeGeneratorJS.pm $(supplemental_dependency_file)
+	$(AM_V_GEN)$(PERL) -I$(WebCore)/bindings/scripts $(WebCore)/bindings/scripts/generate-bindings.pl $(IDL_PATH:%=--include "%") --outputDir "$(GENSOURCES_WEBCORE)" --defines "LANGUAGE_JAVASCRIPT=1 $(FEATURE_DEFINES)" --generator JS --supplementalDependencyFile $(supplemental_dependency_file) $<
+
+# See https://bugs.webkit.org/show_bug.cgi?id=76388
+# We need to introduce a manual dependency to prevent non-generated sources from 
+# trying to build before the generated ones. This can happen if the supplemental
+# IDL generation takes a long time. The pipe represents an order-only dependency,
+# which means that GNUmake will only try to build the dependencies first, but
+# not rebuild all the targets if the dependencies change.
+$(webkitgtk_sources) $(webkit2_sources) $(webkit2_plugin_process_sources) $(webcore_sources) $(webcoregtk_sources) : | $(supplemental_dependency_file) $(webcore_built_sources)
 
 noinst_LTLIBRARIES += \
 	libWebCore.la
diff --git a/Source/WebCore/GNUmakefile.list.am b/Source/WebCore/GNUmakefile.list.am
index c08cb25a8..e5a03cb53 100644
--- a/Source/WebCore/GNUmakefile.list.am
+++ b/Source/WebCore/GNUmakefile.list.am
@@ -388,6 +388,8 @@ webcore_built_sources += \
 	DerivedSources/WebCore/JSMessagePort.h \
 	DerivedSources/WebCore/JSMouseEvent.cpp \
 	DerivedSources/WebCore/JSMouseEvent.h \
+	DerivedSources/WebCore/JSMutationCallback.cpp \
+	DerivedSources/WebCore/JSMutationCallback.h \
 	DerivedSources/WebCore/JSMutationEvent.cpp \
 	DerivedSources/WebCore/JSMutationEvent.h \
 	DerivedSources/WebCore/JSMutationRecord.cpp \
@@ -587,6 +589,8 @@ webcore_built_sources += \
 	DerivedSources/WebCore/JSWebKitCSSRegionRule.h \
 	DerivedSources/WebCore/JSWebKitCSSTransformValue.cpp \
 	DerivedSources/WebCore/JSWebKitCSSTransformValue.h \
+	DerivedSources/WebCore/JSWebKitMutationObserver.cpp \
+	DerivedSources/WebCore/JSWebKitMutationObserver.h \
 	DerivedSources/WebCore/JSWebKitNamedFlow.cpp \
 	DerivedSources/WebCore/JSWebKitNamedFlow.h \
 	DerivedSources/WebCore/JSWebKitPoint.cpp \
@@ -646,6 +650,12 @@ webcore_built_sources += \
 	DerivedSources/WebCore/XPathGrammar.h
 
 dom_binding_idls += \
+	$(WebCore)/Modules/geolocation/Geolocation.idl \
+	$(WebCore)/Modules/geolocation/Geoposition.idl \
+	$(WebCore)/Modules/geolocation/NavigatorGeolocation.idl \
+	$(WebCore)/Modules/geolocation/PositionCallback.idl \
+	$(WebCore)/Modules/geolocation/PositionError.idl \
+	$(WebCore)/Modules/geolocation/PositionErrorCallback.idl \
 	$(WebCore)/css/CSSCharsetRule.idl \
 	$(WebCore)/css/CSSFontFaceRule.idl \
 	$(WebCore)/css/CSSImportRule.idl \
@@ -705,6 +715,7 @@ dom_binding_idls += \
 	$(WebCore)/dom/MessageEvent.idl \
 	$(WebCore)/dom/MessagePort.idl \
 	$(WebCore)/dom/MouseEvent.idl \
+	$(WebCore)/dom/MutationCallback.idl \
 	$(WebCore)/dom/MutationEvent.idl \
 	$(WebCore)/dom/MutationRecord.idl \
 	$(WebCore)/dom/NamedNodeMap.idl \
@@ -729,6 +740,7 @@ dom_binding_idls += \
 	$(WebCore)/dom/TreeWalker.idl \
 	$(WebCore)/dom/UIEvent.idl \
 	$(WebCore)/dom/WebKitAnimationEvent.idl \
+	$(WebCore)/dom/WebKitMutationObserver.idl \
 	$(WebCore)/dom/WebKitNamedFlow.idl \
 	$(WebCore)/dom/WebKitTransitionEvent.idl \
 	$(WebCore)/dom/WheelEvent.idl \
@@ -745,6 +757,7 @@ dom_binding_idls += \
 	$(WebCore)/html/DOMSettableTokenList.idl \
 	$(WebCore)/html/DOMTokenList.idl \
 	$(WebCore)/html/DOMURL.idl \
+	$(WebCore)/html/DOMWindowHTML.idl \
 	$(WebCore)/html/HTMLAllCollection.idl \
 	$(WebCore)/html/HTMLAnchorElement.idl \
 	$(WebCore)/html/HTMLAppletElement.idl \
@@ -822,9 +835,6 @@ dom_binding_idls += \
 	$(WebCore)/html/MediaController.idl \
 	$(WebCore)/html/MediaError.idl \
 	$(WebCore)/html/TextMetrics.idl \
-	$(WebCore)/html/TextTrack.idl \
-	$(WebCore)/html/TextTrackCue.idl \
-	$(WebCore)/html/TextTrackCueList.idl \
 	$(WebCore)/html/TimeRanges.idl \
 	$(WebCore)/html/ValidityState.idl \
 	$(WebCore)/html/VoidCallback.idl \
@@ -834,6 +844,7 @@ dom_binding_idls += \
 	$(WebCore)/html/canvas/CanvasPattern.idl \
 	$(WebCore)/html/canvas/CanvasRenderingContext.idl \
 	$(WebCore)/html/canvas/CanvasRenderingContext2D.idl \
+	$(WebCore)/html/canvas/DOMWindowWebGL.idl \
 	$(WebCore)/html/canvas/DataView.idl \
 	$(WebCore)/html/canvas/Float32Array.idl \
 	$(WebCore)/html/canvas/Float64Array.idl \
@@ -862,6 +873,9 @@ dom_binding_idls += \
 	$(WebCore)/html/canvas/WebGLUniformLocation.idl \
 	$(WebCore)/html/canvas/WebGLVertexArrayObjectOES.idl \
 	$(WebCore)/html/shadow/HTMLContentElement.idl \
+	$(WebCore)/html/track/TextTrack.idl \
+	$(WebCore)/html/track/TextTrackCue.idl \
+	$(WebCore)/html/track/TextTrackCueList.idl \
 	$(WebCore)/html/track/TextTrackList.idl \
 	$(WebCore)/html/track/TrackEvent.idl \
 	$(WebCore)/inspector/InjectedScriptHost.idl \
@@ -870,12 +884,14 @@ dom_binding_idls += \
 	$(WebCore)/inspector/ScriptProfile.idl \
 	$(WebCore)/inspector/ScriptProfileNode.idl \
 	$(WebCore)/loader/appcache/DOMApplicationCache.idl \
+	$(WebCore)/mediastream/DOMWindowMediaStream.idl \
 	$(WebCore)/mediastream/LocalMediaStream.idl \
 	$(WebCore)/mediastream/MediaStream.idl \
 	$(WebCore)/mediastream/MediaStreamEvent.idl \
 	$(WebCore)/mediastream/MediaStreamList.idl \
 	$(WebCore)/mediastream/MediaStreamTrack.idl \
 	$(WebCore)/mediastream/MediaStreamTrackList.idl \
+	$(WebCore)/mediastream/NavigatorMediaStream.idl \
 	$(WebCore)/mediastream/NavigatorUserMediaError.idl \
 	$(WebCore)/mediastream/NavigatorUserMediaErrorCallback.idl \
 	$(WebCore)/mediastream/NavigatorUserMediaSuccessCallback.idl \
@@ -890,8 +906,6 @@ dom_binding_idls += \
 	$(WebCore)/page/DOMSelection.idl \
 	$(WebCore)/page/DOMWindow.idl \
 	$(WebCore)/page/EventSource.idl \
-	$(WebCore)/page/Geolocation.idl \
-	$(WebCore)/page/Geoposition.idl \
 	$(WebCore)/page/History.idl \
 	$(WebCore)/page/Location.idl \
 	$(WebCore)/page/MemoryInfo.idl \
@@ -899,9 +913,6 @@ dom_binding_idls += \
 	$(WebCore)/page/Performance.idl \
 	$(WebCore)/page/PerformanceNavigation.idl \
 	$(WebCore)/page/PerformanceTiming.idl \
-	$(WebCore)/page/PositionCallback.idl \
-	$(WebCore)/page/PositionError.idl \
-	$(WebCore)/page/PositionErrorCallback.idl \
 	$(WebCore)/page/Screen.idl \
 	$(WebCore)/page/SpeechInputEvent.idl \
 	$(WebCore)/page/SpeechInputResult.idl \
@@ -924,12 +935,14 @@ dom_binding_idls += \
 	$(WebCore)/webaudio/DOMWindowWebAudio.idl \
 	$(WebCore)/webaudio/WaveShaperNode.idl \
 	$(WebCore)/workers/AbstractWorker.idl \
+	$(WebCore)/workers/DOMWindowWorker.idl \
 	$(WebCore)/workers/DedicatedWorkerContext.idl \
 	$(WebCore)/workers/SharedWorker.idl \
 	$(WebCore)/workers/SharedWorkerContext.idl \
 	$(WebCore)/workers/Worker.idl \
 	$(WebCore)/workers/WorkerContext.idl \
 	$(WebCore)/workers/WorkerLocation.idl \
+	$(WebCore)/xml/DOMWindowXML.idl \
 	$(WebCore)/xml/DOMParser.idl \
 	$(WebCore)/xml/XMLHttpRequest.idl \
 	$(WebCore)/xml/XMLHttpRequestException.idl \
@@ -944,6 +957,19 @@ dom_binding_idls += \
 	$(WebCore)/xml/XSLTProcessor.idl
 
 webcore_sources += \
+	Source/WebCore/Modules/geolocation/Geolocation.cpp \
+	Source/WebCore/Modules/geolocation/Geolocation.h \
+	Source/WebCore/Modules/geolocation/GeolocationController.cpp \
+	Source/WebCore/Modules/geolocation/GeolocationController.h \
+	Source/WebCore/Modules/geolocation/GeolocationError.h \
+	Source/WebCore/Modules/geolocation/GeolocationPosition.h \
+	Source/WebCore/Modules/geolocation/Geoposition.h \
+	Source/WebCore/Modules/geolocation/NavigatorGeolocation.cpp \
+	Source/WebCore/Modules/geolocation/NavigatorGeolocation.h \
+	Source/WebCore/Modules/geolocation/PositionCallback.h \
+	Source/WebCore/Modules/geolocation/PositionError.h \
+	Source/WebCore/Modules/geolocation/PositionErrorCallback.h \
+	Source/WebCore/Modules/geolocation/PositionOptions.h \
 	Source/WebCore/accessibility/AccessibilityARIAGridCell.cpp \
 	Source/WebCore/accessibility/AccessibilityARIAGridCell.h \
 	Source/WebCore/accessibility/AccessibilityARIAGrid.cpp \
@@ -1135,7 +1161,6 @@ webcore_sources += \
 	Source/WebCore/bindings/js/JSMessagePortCustom.h \
 	Source/WebCore/bindings/js/JSMutationCallbackCustom.cpp \
 	Source/WebCore/bindings/js/JSNamedNodeMapCustom.cpp \
-	Source/WebCore/bindings/js/JSNavigatorCustom.cpp \
 	Source/WebCore/bindings/js/JSNodeCustom.cpp \
 	Source/WebCore/bindings/js/JSNodeCustom.h \
 	Source/WebCore/bindings/js/JSNodeFilterCondition.cpp \
@@ -1382,8 +1407,6 @@ webcore_sources += \
 	Source/WebCore/css/CSSValuePool.cpp \
 	Source/WebCore/css/CSSValuePool.h \
 	Source/WebCore/css/DashboardRegion.h \
-	Source/WebCore/css/FontFamilyValue.cpp \
-	Source/WebCore/css/FontFamilyValue.h \
 	Source/WebCore/css/FontFeatureValue.cpp \
 	Source/WebCore/css/FontFeatureValue.h \
 	Source/WebCore/css/FontValue.cpp \
@@ -1405,6 +1428,8 @@ webcore_sources += \
 	Source/WebCore/css/MediaQueryMatcher.cpp \
 	Source/WebCore/css/MediaQueryMatcher.h \
 	Source/WebCore/css/Pair.h \
+	Source/WebCore/css/PropertySetCSSStyleDeclaration.cpp \
+	Source/WebCore/css/PropertySetCSSStyleDeclaration.h \
 	Source/WebCore/css/Rect.h \
 	Source/WebCore/css/RGBColor.cpp \
 	Source/WebCore/css/RGBColor.h \
@@ -1558,6 +1583,7 @@ webcore_sources += \
 	Source/WebCore/dom/EventTarget.cpp \
 	Source/WebCore/dom/EventTarget.h \
 	Source/WebCore/dom/EventQueue.h \
+	Source/WebCore/dom/EventSender.h \
 	Source/WebCore/dom/ExceptionBase.cpp \
 	Source/WebCore/dom/ExceptionBase.h \
 	Source/WebCore/dom/ExceptionCode.h \
@@ -1659,6 +1685,8 @@ webcore_sources += \
 	Source/WebCore/dom/SelectorQuery.h \
 	Source/WebCore/dom/ShadowRoot.cpp \
 	Source/WebCore/dom/ShadowRoot.h \
+	Source/WebCore/dom/ShadowRootList.cpp \
+	Source/WebCore/dom/ShadowRootList.h \
 	Source/WebCore/dom/SpaceSplitString.cpp \
 	Source/WebCore/dom/SpaceSplitString.h \
 	Source/WebCore/dom/StaticHashSetNodeList.cpp \
@@ -1851,6 +1879,8 @@ webcore_sources += \
 	Source/WebCore/fileapi/DOMFileSystemBase.h \
 	Source/WebCore/fileapi/DOMFileSystemSync.cpp \
 	Source/WebCore/fileapi/DOMFileSystemSync.h \
+	Source/WebCore/fileapi/DOMWindowFileSystem.cpp \
+	Source/WebCore/fileapi/DOMWindowFileSystem.h \
 	Source/WebCore/fileapi/EntriesCallback.h \
 	Source/WebCore/fileapi/Entry.cpp \
 	Source/WebCore/fileapi/Entry.h \
@@ -1858,6 +1888,7 @@ webcore_sources += \
 	Source/WebCore/fileapi/EntryArray.h \
 	Source/WebCore/fileapi/EntryArraySync.cpp \
 	Source/WebCore/fileapi/EntryArraySync.h \
+	Source/WebCore/fileapi/EntryBase.cpp \
 	Source/WebCore/fileapi/EntryBase.h \
 	Source/WebCore/fileapi/EntryCallback.h \
 	Source/WebCore/fileapi/EntrySync.cpp \
@@ -2172,8 +2203,6 @@ webcore_sources += \
 	Source/WebCore/html/LabelsNodeList.h \
 	Source/WebCore/html/LinkRelAttribute.cpp \
 	Source/WebCore/html/LinkRelAttribute.h \
-	Source/WebCore/html/LoadableTextTrack.cpp \
-	Source/WebCore/html/LoadableTextTrack.h \
 	Source/WebCore/html/MediaController.cpp \
 	Source/WebCore/html/MediaController.h \
 	Source/WebCore/html/MediaControllerInterface.h \
@@ -2231,14 +2260,16 @@ webcore_sources += \
 	Source/WebCore/html/parser/TextViewSourceParser.h \
 	Source/WebCore/html/parser/XSSAuditor.cpp \
 	Source/WebCore/html/parser/XSSAuditor.h \
-	Source/WebCore/html/shadow/ContentInclusionSelector.cpp \
-	Source/WebCore/html/shadow/ContentInclusionSelector.h \
 	Source/WebCore/html/shadow/ContentSelectorQuery.cpp \
 	Source/WebCore/html/shadow/ContentSelectorQuery.h \
 	Source/WebCore/html/shadow/DetailsMarkerControl.cpp \
 	Source/WebCore/html/shadow/DetailsMarkerControl.h \
 	Source/WebCore/html/shadow/HTMLContentElement.cpp \
 	Source/WebCore/html/shadow/HTMLContentElement.h \
+	Source/WebCore/html/shadow/HTMLContentSelector.cpp \
+	Source/WebCore/html/shadow/HTMLContentSelector.h \
+	Source/WebCore/html/shadow/InsertionPoint.cpp \
+	Source/WebCore/html/shadow/InsertionPoint.h \
 	Source/WebCore/html/shadow/MediaControls.cpp \
 	Source/WebCore/html/shadow/MediaControls.h \
 	Source/WebCore/html/shadow/MediaControlElements.cpp \
@@ -2279,16 +2310,18 @@ webcore_sources += \
 	Source/WebCore/html/TextInputType.cpp \
 	Source/WebCore/html/TextInputType.h \
 	Source/WebCore/html/TextMetrics.h \
-	Source/WebCore/html/TextTrack.cpp \
-	Source/WebCore/html/TextTrack.h \
-	Source/WebCore/html/TextTrackCue.cpp \
-	Source/WebCore/html/TextTrackCue.h \
-	Source/WebCore/html/TextTrackCueList.cpp \
-	Source/WebCore/html/TextTrackCueList.h \
 	Source/WebCore/html/TimeInputType.cpp \
 	Source/WebCore/html/TimeInputType.h \
 	Source/WebCore/html/TimeRanges.cpp \
 	Source/WebCore/html/TimeRanges.h \
+	Source/WebCore/html/track/LoadableTextTrack.cpp \
+	Source/WebCore/html/track/LoadableTextTrack.h \
+	Source/WebCore/html/track/TextTrack.cpp \
+	Source/WebCore/html/track/TextTrack.h \
+	Source/WebCore/html/track/TextTrackCue.cpp \
+	Source/WebCore/html/track/TextTrackCue.h \
+	Source/WebCore/html/track/TextTrackCueList.cpp \
+	Source/WebCore/html/track/TextTrackCueList.h \
 	Source/WebCore/html/track/TextTrackList.cpp \
 	Source/WebCore/html/track/TextTrackList.h \
 	Source/WebCore/html/track/TrackBase.cpp \
@@ -2344,6 +2377,8 @@ webcore_sources += \
 	Source/WebCore/inspector/DOMEditor.h \
 	Source/WebCore/inspector/DOMNodeHighlighter.cpp \
 	Source/WebCore/inspector/DOMNodeHighlighter.h \
+	Source/WebCore/inspector/DOMPatchSupport.cpp \
+	Source/WebCore/inspector/DOMPatchSupport.h \
 	Source/WebCore/inspector/DOMWrapperVisitor.h \
 	Source/WebCore/inspector/IdentifiersFactory.cpp \
 	Source/WebCore/inspector/IdentifiersFactory.h \
@@ -2366,6 +2401,8 @@ webcore_sources += \
 	Source/WebCore/inspector/InspectorConsoleAgent.cpp \
 	Source/WebCore/inspector/InspectorConsoleAgent.h \
 	Source/WebCore/inspector/InspectorConsoleInstrumentation.h \
+	Source/WebCore/inspector/InspectorCounters.cpp \
+	Source/WebCore/inspector/InspectorCounters.h \
 	Source/WebCore/inspector/InspectorCSSAgent.cpp \
 	Source/WebCore/inspector/InspectorCSSAgent.h \
 	Source/WebCore/inspector/InspectorDatabaseAgent.cpp \
@@ -2495,6 +2532,8 @@ webcore_sources += \
 	Source/WebCore/loader/cache/CachedShader.cpp \
 	Source/WebCore/loader/cache/CachedShader.h \
 	Source/WebCore/loader/cache/CachedStyleSheetClient.h \
+	Source/WebCore/loader/cache/CachedSVGDocument.cpp \
+	Source/WebCore/loader/cache/CachedSVGDocument.h \
 	Source/WebCore/loader/cache/CachedTextTrack.cpp \
 	Source/WebCore/loader/cache/CachedTextTrack.h \
 	Source/WebCore/loader/cache/CachedXSLStyleSheet.cpp \
@@ -2615,6 +2654,8 @@ webcore_sources += \
 	Source/WebCore/mediastream/MediaStreamTrack.h \
 	Source/WebCore/mediastream/MediaStreamTrackList.cpp \
 	Source/WebCore/mediastream/MediaStreamTrackList.h \
+	Source/WebCore/mediastream/NavigatorMediaStream.cpp \
+	Source/WebCore/mediastream/NavigatorMediaStream.h \
 	Source/WebCore/mediastream/NavigatorUserMediaError.h \
 	Source/WebCore/mediastream/NavigatorUserMediaErrorCallback.h \
 	Source/WebCore/mediastream/NavigatorUserMediaSuccessCallback.h \
@@ -2622,6 +2663,8 @@ webcore_sources += \
 	Source/WebCore/mediastream/PeerConnection.h \
 	Source/WebCore/mediastream/SignalingCallback.h \
 	Source/WebCore/mediastream/UserMediaClient.h \
+	Source/WebCore/mediastream/UserMediaController.h \
+	Source/WebCore/mediastream/UserMediaController.cpp \
 	Source/WebCore/mediastream/UserMediaRequest.cpp \
 	Source/WebCore/mediastream/UserMediaRequest.h \
 	Source/WebCore/notifications/NotificationCenter.cpp \
@@ -2693,14 +2736,7 @@ webcore_sources += \
 	Source/WebCore/page/FrameTree.h \
 	Source/WebCore/page/FrameView.cpp \
 	Source/WebCore/page/FrameView.h \
-	Source/WebCore/page/Geolocation.cpp \
-	Source/WebCore/page/Geolocation.h \
 	Source/WebCore/page/GeolocationClient.h \
-	Source/WebCore/page/GeolocationController.cpp \
-	Source/WebCore/page/GeolocationController.h \
-	Source/WebCore/page/GeolocationError.h \
-	Source/WebCore/page/GeolocationPosition.h \
-	Source/WebCore/page/Geoposition.h \
 	Source/WebCore/page/GestureTapHighlighter.cpp \
 	Source/WebCore/page/GestureTapHighlighter.h \
 	Source/WebCore/page/GroupSettings.cpp \
@@ -2718,6 +2754,10 @@ webcore_sources += \
 	Source/WebCore/page/Navigator.h \
 	Source/WebCore/page/NavigatorBase.cpp \
 	Source/WebCore/page/NavigatorBase.h \
+	Source/WebCore/page/NavigatorRegisterProtocolHandler.cpp \
+	Source/WebCore/page/NavigatorRegisterProtocolHandler.h \
+	Source/WebCore/page/NavigatorSupplement.cpp \
+	Source/WebCore/page/NavigatorSupplement.h \
 	Source/WebCore/page/OriginAccessEntry.cpp \
 	Source/WebCore/page/OriginAccessEntry.h \
 	Source/WebCore/page/Page.cpp \
@@ -2728,6 +2768,8 @@ webcore_sources += \
 	Source/WebCore/page/PageGroupLoadDeferrer.h \
 	Source/WebCore/page/PageSerializer.cpp \
 	Source/WebCore/page/PageSerializer.h \
+	Source/WebCore/page/PageSupplement.cpp \
+	Source/WebCore/page/PageSupplement.h \
 	Source/WebCore/page/PageVisibilityState.cpp \
 	Source/WebCore/page/PageVisibilityState.h \
 	Source/WebCore/page/Performance.cpp \
@@ -2739,14 +2781,13 @@ webcore_sources += \
 	Source/WebCore/page/PointerLock.h \
 	Source/WebCore/page/PointerLockController.cpp \
 	Source/WebCore/page/PointerLockController.h \
-	Source/WebCore/page/PositionCallback.h \
-	Source/WebCore/page/PositionError.h \
-	Source/WebCore/page/PositionErrorCallback.h \
-	Source/WebCore/page/PositionOptions.h \
 	Source/WebCore/page/PrintContext.cpp \
 	Source/WebCore/page/PrintContext.h \
 	Source/WebCore/page/Screen.cpp \
 	Source/WebCore/page/Screen.h \
+	Source/WebCore/page/scrolling/ScrollingCoordinator.cpp \
+	Source/WebCore/page/scrolling/ScrollingCoordinator.h \
+	Source/WebCore/page/scrolling/ScrollingCoordinatorNone.cpp \
 	Source/WebCore/page/SecurityOrigin.cpp \
 	Source/WebCore/page/SecurityOrigin.h \
 	Source/WebCore/page/SecurityOriginHash.h \
@@ -2817,8 +2858,6 @@ webcore_sources += \
 	Source/WebCore/platform/Cursor.h \
 	Source/WebCore/platform/DateComponents.cpp \
 	Source/WebCore/platform/DateComponents.h \
-	Source/WebCore/platform/DefaultLocalizationStrategy.cpp \
-	Source/WebCore/platform/DefaultLocalizationStrategy.h \
 	Source/WebCore/platform/DragData.cpp \
 	Source/WebCore/platform/DragData.h \
 	Source/WebCore/platform/DragImage.cpp \
@@ -2835,6 +2874,7 @@ webcore_sources += \
 	Source/WebCore/platform/FileSystem.cpp \
 	Source/WebCore/platform/FileSystem.h \
 	Source/WebCore/platform/FloatConversion.h \
+	Source/WebCore/platform/FractionalLayoutUnit.h \
 	Source/WebCore/platform/GeolocationService.cpp \
 	Source/WebCore/platform/GeolocationService.h \
 	Source/WebCore/platform/HashTools.h \
@@ -2975,6 +3015,11 @@ webcore_sources += \
 	Source/WebCore/platform/graphics/FontSmoothingMode.h \
 	Source/WebCore/platform/graphics/FontTraitsMask.h \
 	Source/WebCore/platform/graphics/FontWidthVariant.h \
+	Source/WebCore/platform/graphics/FractionalLayoutPoint.h \
+	Source/WebCore/platform/graphics/FractionalLayoutRect.cpp \
+	Source/WebCore/platform/graphics/FractionalLayoutRect.h \
+	Source/WebCore/platform/graphics/FractionalLayoutSize.cpp \
+	Source/WebCore/platform/graphics/FractionalLayoutSize.h \
 	Source/WebCore/platform/graphics/GeneratorGeneratedImage.cpp \
 	Source/WebCore/platform/graphics/GeneratorGeneratedImage.h \
 	Source/WebCore/platform/graphics/GeneratedImage.h \
@@ -3349,7 +3394,6 @@ webcore_sources += \
 	Source/WebCore/platform/Timer.cpp \
 	Source/WebCore/platform/Timer.h \
 	Source/WebCore/platform/TreeShared.h \
-	Source/WebCore/platform/URLString.h \
 	Source/WebCore/platform/UUID.cpp \
 	Source/WebCore/platform/UUID.h \
 	Source/WebCore/platform/Widget.cpp \
@@ -3859,10 +3903,10 @@ webcore_sources += \
 	Source/WebCore/storage/IDBTransaction.h \
 	Source/WebCore/storage/IDBVersionChangeEvent.h \
 	Source/WebCore/storage/IDBVersionChangeRequest.h \
-	Source/WebCore/storage/LocalStorageTask.cpp \
-	Source/WebCore/storage/LocalStorageTask.h \
-	Source/WebCore/storage/LocalStorageThread.cpp \
-	Source/WebCore/storage/LocalStorageThread.h \
+	Source/WebCore/storage/StorageTask.cpp \
+	Source/WebCore/storage/StorageTask.h \
+	Source/WebCore/storage/StorageThread.cpp \
+	Source/WebCore/storage/StorageThread.h \
 	Source/WebCore/storage/OriginQuotaManager.cpp \
 	Source/WebCore/storage/OriginQuotaManager.h \
 	Source/WebCore/storage/OriginUsageRecord.cpp \
@@ -4305,6 +4349,12 @@ webcore_sources += \
 	Source/WebCore/websockets/WebSocketChannel.h \
 	Source/WebCore/websockets/WebSocket.cpp \
 	Source/WebCore/websockets/WebSocket.h \
+	Source/WebCore/websockets/WebSocketDeflater.cpp \
+	Source/WebCore/websockets/WebSocketDeflater.h \
+	Source/WebCore/websockets/WebSocketExtensionDispatcher.cpp \
+	Source/WebCore/websockets/WebSocketExtensionDispatcher.h \
+	Source/WebCore/websockets/WebSocketExtensionProcessor.h \
+	Source/WebCore/websockets/WebSocketFrame.h \
 	Source/WebCore/websockets/WebSocketHandshake.cpp \
 	Source/WebCore/websockets/WebSocketHandshake.h \
 	Source/WebCore/websockets/WebSocketHandshakeRequest.cpp \
@@ -4793,6 +4843,7 @@ webcore_built_sources += \
 dom_binding_idls += \
 	$(WebCore)/fileapi/DOMFileSystem.idl \
 	$(WebCore)/fileapi/DOMFileSystemSync.idl \
+	$(WebCore)/fileapi/DOMWindowFileSystem.idl \
 	$(WebCore)/fileapi/DirectoryEntry.idl \
 	$(WebCore)/fileapi/DirectoryEntrySync.idl \
 	$(WebCore)/fileapi/DirectoryReader.idl \
@@ -4812,8 +4863,11 @@ dom_binding_idls += \
 	$(WebCore)/fileapi/FileWriterCallback.idl \
 	$(WebCore)/fileapi/FileWriterSync.idl \
 	$(WebCore)/fileapi/Metadata.idl \
-	$(WebCore)/fileapi/MetadataCallback.idl \
-	$(WebCore)/fileapi/WebKitFlags.idl
+	$(WebCore)/fileapi/MetadataCallback.idl
+
+webcoregtk_sources += \
+	Source/WebCore/platform/gtk/AsyncFileSystemGtk.cpp \
+	Source/WebCore/platform/gtk/AsyncFileSystemGtk.h
 endif # END ENABLE_FILE_SYSTEM
 
 # ----
@@ -5118,6 +5172,7 @@ webcore_built_sources += \
 	DerivedSources/WebCore/JSSVGZoomEvent.h
 
 dom_binding_idls += \
+	$(WebCore)/svg/DOMWindowSVG.idl \
 	$(WebCore)/svg/SVGAElement.idl \
 	$(WebCore)/svg/SVGAltGlyphDefElement.idl \
 	$(WebCore)/svg/SVGAltGlyphElement.idl \
@@ -5663,17 +5718,16 @@ webcore_sources += \
 	Source/WebCore/html/canvas/OESVertexArrayObject.h \
 	Source/WebCore/platform/graphics/ANGLEWebKitBridge.cpp \
 	Source/WebCore/platform/graphics/ANGLEWebKitBridge.h \
+	Source/WebCore/platform/graphics/cairo/DrawingBufferCairo.cpp \
 	Source/WebCore/platform/graphics/cairo/GraphicsContext3DCairo.cpp \
-	Source/WebCore/platform/graphics/cairo/OpenGLShims.cpp \
-	Source/WebCore/platform/graphics/cairo/OpenGLShims.h \
 	Source/WebCore/platform/graphics/glx/GraphicsContext3DPrivate.cpp \
 	Source/WebCore/platform/graphics/glx/GraphicsContext3DPrivate.h \
 	Source/WebCore/platform/graphics/gpu/DrawingBuffer.cpp \
 	Source/WebCore/platform/graphics/gpu/DrawingBuffer.h \
 	Source/WebCore/platform/graphics/GraphicsContext3D.cpp \
 	Source/WebCore/platform/graphics/GraphicsContext3D.h \
-	Source/WebCore/platform/graphics/gtk/DrawingBufferGtk.cpp \
-	Source/WebCore/platform/graphics/gtk/GraphicsContext3DGtk.cpp \
+	Source/WebCore/platform/graphics/OpenGLShims.cpp \
+	Source/WebCore/platform/graphics/OpenGLShims.h \
 	Source/WebCore/platform/graphics/opengl/Extensions3DOpenGL.cpp \
 	Source/WebCore/platform/graphics/opengl/Extensions3DOpenGL.h \
 	Source/WebCore/platform/graphics/opengl/GraphicsContext3DOpenGL.cpp \
@@ -5685,10 +5739,6 @@ endif  # END ENABLE_WEBGL
 # ---
 if ENABLE_MHTML
 webcore_sources += \
-	Source/WebCore/loader/archive/Archive.cpp \
-	Source/WebCore/loader/archive/Archive.h \
-	Source/WebCore/loader/archive/ArchiveFactory.cpp \
-	Source/WebCore/loader/archive/ArchiveFactory.h \
 	Source/WebCore/loader/archive/mhtml/MHTMLArchive.cpp \
 	Source/WebCore/loader/archive/mhtml/MHTMLArchive.h \
 	Source/WebCore/loader/archive/mhtml/MHTMLParser.cpp \
@@ -5731,15 +5781,17 @@ webcore_sources += \
 	Source/WebCore/platform/graphics/texmap/GraphicsLayerTextureMapper.h \
 	Source/WebCore/platform/graphics/texmap/LayerTransform.cpp \
 	Source/WebCore/platform/graphics/texmap/LayerTransform.h \
-	Source/WebCore/platform/graphics/texmap/TextureMapper.cpp \
-	Source/WebCore/platform/graphics/texmap/TextureMapper.h \
 	Source/WebCore/platform/graphics/texmap/TextureMapperAnimation.cpp \
 	Source/WebCore/platform/graphics/texmap/TextureMapperAnimation.h \
-        Source/WebCore/platform/graphics/texmap/TextureMapperImageBuffer.cpp \
-        Source/WebCore/platform/graphics/texmap/TextureMapperImageBuffer.h \
-        Source/WebCore/platform/graphics/texmap/TextureMapperNode.cpp \
-        Source/WebCore/platform/graphics/texmap/TextureMapperNode.h \
-        Source/WebCore/platform/graphics/texmap/TextureMapperPlatformLayer.h
+	Source/WebCore/platform/graphics/texmap/TextureMapperBackingStore.cpp \
+	Source/WebCore/platform/graphics/texmap/TextureMapperBackingStore.h \
+	Source/WebCore/platform/graphics/texmap/TextureMapper.cpp \
+	Source/WebCore/platform/graphics/texmap/TextureMapper.h \
+	Source/WebCore/platform/graphics/texmap/TextureMapperImageBuffer.cpp \
+	Source/WebCore/platform/graphics/texmap/TextureMapperImageBuffer.h \
+	Source/WebCore/platform/graphics/texmap/TextureMapperLayer.cpp \
+	Source/WebCore/platform/graphics/texmap/TextureMapperLayer.h \
+	Source/WebCore/platform/graphics/texmap/TextureMapperPlatformLayer.h 
 webcoregtk_sources += \
 	Source/WebCore/platform/graphics/cairo/TextureMapperCairo.cpp \
 	Source/WebCore/platform/graphics/cairo/TextureMapperCairo.h
@@ -5747,20 +5799,24 @@ endif  # END USE_TEXTURE_MAPPER_CAIRO
 
 if USE_TEXTURE_MAPPER_GL
 webcore_sources += \
-	Source/WebCore/platform/graphics/opengl/TextureMapperGL.cpp \
-	Source/WebCore/platform/graphics/opengl/TextureMapperGL.h \
+	Source/WebCore/platform/graphics/texmap/TextureMapperGL.cpp \
+	Source/WebCore/platform/graphics/texmap/TextureMapperGL.h \
+	Source/WebCore/platform/graphics/texmap/TextureMapperShaderManager.cpp \
+	Source/WebCore/platform/graphics/texmap/TextureMapperShaderManager.h \
 	Source/WebCore/platform/graphics/texmap/GraphicsLayerTextureMapper.cpp \
 	Source/WebCore/platform/graphics/texmap/GraphicsLayerTextureMapper.h \
 	Source/WebCore/platform/graphics/texmap/LayerTransform.cpp \
 	Source/WebCore/platform/graphics/texmap/LayerTransform.h \
-	Source/WebCore/platform/graphics/texmap/TextureMapper.cpp \
-	Source/WebCore/platform/graphics/texmap/TextureMapper.h \
 	Source/WebCore/platform/graphics/texmap/TextureMapperAnimation.cpp \
 	Source/WebCore/platform/graphics/texmap/TextureMapperAnimation.h \
+	Source/WebCore/platform/graphics/texmap/TextureMapperBackingStore.cpp \
+	Source/WebCore/platform/graphics/texmap/TextureMapperBackingStore.h \
+	Source/WebCore/platform/graphics/texmap/TextureMapper.cpp \
+	Source/WebCore/platform/graphics/texmap/TextureMapper.h \
 	Source/WebCore/platform/graphics/texmap/TextureMapperImageBuffer.cpp \
 	Source/WebCore/platform/graphics/texmap/TextureMapperImageBuffer.h \
-	Source/WebCore/platform/graphics/texmap/TextureMapperNode.cpp \
-	Source/WebCore/platform/graphics/texmap/TextureMapperNode.h \
+	Source/WebCore/platform/graphics/texmap/TextureMapperLayer.cpp \
+	Source/WebCore/platform/graphics/texmap/TextureMapperLayer.h \
 	Source/WebCore/platform/graphics/texmap/TextureMapperPlatformLayer.h
 webcoregtk_sources += \
 	Source/WebCore/platform/graphics/gtk/WindowGLContextGLX.cpp \
diff --git a/Source/WebCore/Modules/gamepad/GamepadList.idl b/Source/WebCore/Modules/gamepad/GamepadList.idl
index 6189ddc37..4f1e1df9a 100644
--- a/Source/WebCore/Modules/gamepad/GamepadList.idl
+++ b/Source/WebCore/Modules/gamepad/GamepadList.idl
@@ -30,7 +30,7 @@ module dom {
         IndexedGetter
     ] GamepadList {
         readonly attribute unsigned long length;
-        Gamepad item(in [Optional=CallWithDefaultValue] unsigned long index);
+        Gamepad item(in [Optional=DefaultIsUndefined] unsigned long index);
     };
 
 }
diff --git a/Source/WebCore/Modules/gamepad/NavigatorGamepad.cpp b/Source/WebCore/Modules/gamepad/NavigatorGamepad.cpp
index 4d1d933b8..95cd602a2 100644
--- a/Source/WebCore/Modules/gamepad/NavigatorGamepad.cpp
+++ b/Source/WebCore/Modules/gamepad/NavigatorGamepad.cpp
@@ -28,7 +28,10 @@
 
 #if ENABLE(GAMEPAD)
 
+#include "GamepadList.h"
+#include "Gamepads.h"
 #include "Navigator.h"
+#include <wtf/PassOwnPtr.h>
 
 namespace WebCore {
 
@@ -40,10 +43,28 @@ NavigatorGamepad::~NavigatorGamepad()
 {
 }
 
+NavigatorGamepad* NavigatorGamepad::from(Navigator* navigator)
+{
+    DEFINE_STATIC_LOCAL(AtomicString, name, ("NavigatorGamepad"));
+    NavigatorGamepad* supplement = static_cast<NavigatorGamepad*>(NavigatorSupplement::from(navigator, name));
+    if (!supplement) {
+        supplement = new NavigatorGamepad();
+        provideTo(navigator, name, adoptPtr(supplement));
+    }
+    return supplement;
+}
+
 GamepadList* NavigatorGamepad::webkitGamepads(Navigator* navigator)
 {
-    // FIXME: We shouldn't need to direct this call to Navigator.
-    return navigator->gamepads();
+    return NavigatorGamepad::from(navigator)->gamepads();
+}
+
+GamepadList* NavigatorGamepad::gamepads()
+{
+    if (!m_gamepads)
+        m_gamepads = GamepadList::create();
+    sampleGamepads(m_gamepads.get());
+    return m_gamepads.get();
 }
 
 } // namespace WebCore
diff --git a/Source/WebCore/Modules/gamepad/NavigatorGamepad.h b/Source/WebCore/Modules/gamepad/NavigatorGamepad.h
index 2dc125a1e..0ab51b594 100644
--- a/Source/WebCore/Modules/gamepad/NavigatorGamepad.h
+++ b/Source/WebCore/Modules/gamepad/NavigatorGamepad.h
@@ -28,18 +28,26 @@
 
 #if ENABLE(GAMEPAD)
 
+#include "NavigatorSupplement.h"
+
 namespace WebCore {
 
 class GamepadList;
 class Navigator;
 
-class NavigatorGamepad {
+class NavigatorGamepad : public NavigatorSupplement {
 public:
+    virtual ~NavigatorGamepad();
+    static NavigatorGamepad* from(Navigator*);
+
     static GamepadList* webkitGamepads(Navigator*);
 
+    GamepadList* gamepads();
+
 private:
     NavigatorGamepad();
-    ~NavigatorGamepad();
+
+    RefPtr<GamepadList> m_gamepads;
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/page/Geolocation.cpp b/Source/WebCore/Modules/geolocation/Geolocation.cpp
index 2703bcd1f..ae1f4fcbc 100644
--- a/Source/WebCore/page/Geolocation.cpp
+++ b/Source/WebCore/Modules/geolocation/Geolocation.cpp
@@ -31,6 +31,7 @@
 #if ENABLE(GEOLOCATION)
 
 #include "Chrome.h"
+#include "ChromeClient.h"
 #include "Document.h"
 #include "Frame.h"
 #include "Geoposition.h"
@@ -255,7 +256,7 @@ void Geolocation::reset()
 #if ENABLE(CLIENT_BASED_GEOLOCATION)
         page->geolocationController()->cancelPermissionRequest(this);
 #else
-        page->chrome()->cancelGeolocationPermissionRequestForFrame(m_frame, this);
+        page->chrome()->client()->cancelGeolocationPermissionRequestForFrame(m_frame, this);
 #endif
     }
     // The frame may be moving to a new page and we want to get the permissions from the new page's client.
@@ -619,7 +620,7 @@ void Geolocation::requestPermission()
 #if ENABLE(CLIENT_BASED_GEOLOCATION)
     page->geolocationController()->requestPermission(this);
 #else
-    page->chrome()->requestGeolocationPermissionForFrame(m_frame, this);
+    page->chrome()->client()->requestGeolocationPermissionForFrame(m_frame, this);
 #endif
 }
 
diff --git a/Source/WebCore/page/Geolocation.h b/Source/WebCore/Modules/geolocation/Geolocation.h
index ea55cbf1f..ea55cbf1f 100644
--- a/Source/WebCore/page/Geolocation.h
+++ b/Source/WebCore/Modules/geolocation/Geolocation.h
diff --git a/Source/WebCore/page/Geolocation.idl b/Source/WebCore/Modules/geolocation/Geolocation.idl
index 4f159bcb1..4f159bcb1 100644
--- a/Source/WebCore/page/Geolocation.idl
+++ b/Source/WebCore/Modules/geolocation/Geolocation.idl
diff --git a/Source/WebCore/page/GeolocationController.cpp b/Source/WebCore/Modules/geolocation/GeolocationController.cpp
index 9694a99c4..9694a99c4 100644
--- a/Source/WebCore/page/GeolocationController.cpp
+++ b/Source/WebCore/Modules/geolocation/GeolocationController.cpp
diff --git a/Source/WebCore/page/GeolocationController.h b/Source/WebCore/Modules/geolocation/GeolocationController.h
index 0611dc30b..0611dc30b 100644
--- a/Source/WebCore/page/GeolocationController.h
+++ b/Source/WebCore/Modules/geolocation/GeolocationController.h
diff --git a/Source/WebCore/page/GeolocationError.h b/Source/WebCore/Modules/geolocation/GeolocationError.h
index 2a3bad4a9..2a3bad4a9 100644
--- a/Source/WebCore/page/GeolocationError.h
+++ b/Source/WebCore/Modules/geolocation/GeolocationError.h
diff --git a/Source/WebCore/page/GeolocationPosition.h b/Source/WebCore/Modules/geolocation/GeolocationPosition.h
index 9f25b1147..9f25b1147 100644
--- a/Source/WebCore/page/GeolocationPosition.h
+++ b/Source/WebCore/Modules/geolocation/GeolocationPosition.h
diff --git a/Source/WebCore/page/Geoposition.h b/Source/WebCore/Modules/geolocation/Geoposition.h
index 5386aaaf4..5386aaaf4 100644
--- a/Source/WebCore/page/Geoposition.h
+++ b/Source/WebCore/Modules/geolocation/Geoposition.h
diff --git a/Source/WebCore/page/Geoposition.idl b/Source/WebCore/Modules/geolocation/Geoposition.idl
index cbe728a81..cbe728a81 100644
--- a/Source/WebCore/page/Geoposition.idl
+++ b/Source/WebCore/Modules/geolocation/Geoposition.idl
diff --git a/Source/WebCore/Modules/geolocation/NavigatorGeolocation.cpp b/Source/WebCore/Modules/geolocation/NavigatorGeolocation.cpp
new file mode 100644
index 000000000..b8a47c1f5
--- /dev/null
+++ b/Source/WebCore/Modules/geolocation/NavigatorGeolocation.cpp
@@ -0,0 +1,77 @@
+/*
+ * Copyright (C) 2012, Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+ * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+ * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH
+ * DAMAGE.
+ */
+
+#include "config.h"
+#include "NavigatorGeolocation.h"
+
+#include "Geolocation.h"
+#include "Navigator.h"
+
+namespace WebCore {
+
+NavigatorGeolocation::NavigatorGeolocation(Frame* frame)
+    : DOMWindowProperty(frame)
+{
+}
+
+NavigatorGeolocation::~NavigatorGeolocation()
+{
+}
+
+void NavigatorGeolocation::willDetachPage()
+{
+    // FIXME: We should ideally allow existing Geolocation activities to continue
+    // when the Geolocation's iframe is reparented. (Assuming we continue to
+    // support reparenting iframes.)
+    // See https://bugs.webkit.org/show_bug.cgi?id=55577
+    // and https://bugs.webkit.org/show_bug.cgi?id=52877
+    if (m_geolocation)
+        m_geolocation->reset();
+}
+
+NavigatorGeolocation* NavigatorGeolocation::from(Navigator* navigator)
+{
+    DEFINE_STATIC_LOCAL(AtomicString, name, ("NavigatorGeolocation"));
+    NavigatorGeolocation* supplement = static_cast<NavigatorGeolocation*>(NavigatorSupplement::from(navigator, name));
+    if (!supplement) {
+        supplement = new NavigatorGeolocation(navigator->frame());
+        provideTo(navigator, name, adoptPtr(supplement));
+    }
+    return supplement;
+}
+
+Geolocation* NavigatorGeolocation::geolocation(Navigator* navigator)
+{
+    return NavigatorGeolocation::from(navigator)->geolocation();
+}
+
+Geolocation* NavigatorGeolocation::geolocation() const
+{
+    if (!m_geolocation)
+        m_geolocation = Geolocation::create(frame());
+    return m_geolocation.get();
+}
+
+} // namespace WebCore
diff --git a/Source/WebCore/Modules/geolocation/NavigatorGeolocation.h b/Source/WebCore/Modules/geolocation/NavigatorGeolocation.h
new file mode 100644
index 000000000..b8c92e6a3
--- /dev/null
+++ b/Source/WebCore/Modules/geolocation/NavigatorGeolocation.h
@@ -0,0 +1,56 @@
+/*
+ * Copyright (C) 2011, Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+ * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+ * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH
+ * DAMAGE.
+ */
+
+#ifndef NavigatorGeolocation_h
+#define NavigatorGeolocation_h
+
+#include "DOMWindowProperty.h"
+#include "NavigatorSupplement.h"
+
+namespace WebCore {
+
+class Frame;
+class Geolocation;
+class Navigator;
+
+class NavigatorGeolocation : public NavigatorSupplement, public DOMWindowProperty {
+public:
+    virtual ~NavigatorGeolocation();
+    static NavigatorGeolocation* from(Navigator*);
+
+    static Geolocation* geolocation(Navigator*);
+    Geolocation* geolocation() const;
+
+private:
+    NavigatorGeolocation(Frame*);
+
+    virtual void willDetachPage() OVERRIDE;
+
+    mutable RefPtr<Geolocation> m_geolocation;
+};
+
+} // namespace WebCore
+
+#endif // NavigatorGeolocation_h
diff --git a/Source/WebCore/Modules/geolocation/NavigatorGeolocation.idl b/Source/WebCore/Modules/geolocation/NavigatorGeolocation.idl
new file mode 100644
index 000000000..e0b8f0ed1
--- /dev/null
+++ b/Source/WebCore/Modules/geolocation/NavigatorGeolocation.idl
@@ -0,0 +1,29 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ */
+
+module window {
+
+    interface [
+        Conditional=GEOLOCATION,
+        Supplemental=Navigator
+    ] NavigatorGeolocation {
+        readonly attribute [V8EnabledAtRuntime] Geolocation geolocation;
+    };
+
+}
diff --git a/Source/WebCore/page/PositionCallback.h b/Source/WebCore/Modules/geolocation/PositionCallback.h
index 09d7eb692..09d7eb692 100644
--- a/Source/WebCore/page/PositionCallback.h
+++ b/Source/WebCore/Modules/geolocation/PositionCallback.h
diff --git a/Source/WebCore/page/PositionCallback.idl b/Source/WebCore/Modules/geolocation/PositionCallback.idl
index 6d10c4337..39cfa34eb 100644
--- a/Source/WebCore/page/PositionCallback.idl
+++ b/Source/WebCore/Modules/geolocation/PositionCallback.idl
@@ -25,7 +25,7 @@
 module core {
     interface [
         Conditional=GEOLOCATION,
-        Callback=FunctionOnly
+        Callback
     ] PositionCallback {
         boolean handleEvent(in Geoposition position);
     };
diff --git a/Source/WebCore/page/PositionError.h b/Source/WebCore/Modules/geolocation/PositionError.h
index 146717041..146717041 100644
--- a/Source/WebCore/page/PositionError.h
+++ b/Source/WebCore/Modules/geolocation/PositionError.h
diff --git a/Source/WebCore/page/PositionError.idl b/Source/WebCore/Modules/geolocation/PositionError.idl
index 98e036f7b..98e036f7b 100644
--- a/Source/WebCore/page/PositionError.idl
+++ b/Source/WebCore/Modules/geolocation/PositionError.idl
diff --git a/Source/WebCore/page/PositionErrorCallback.h b/Source/WebCore/Modules/geolocation/PositionErrorCallback.h
index d152785c1..d152785c1 100644
--- a/Source/WebCore/page/PositionErrorCallback.h
+++ b/Source/WebCore/Modules/geolocation/PositionErrorCallback.h
diff --git a/Source/WebCore/page/PositionErrorCallback.idl b/Source/WebCore/Modules/geolocation/PositionErrorCallback.idl
index 32099f94f..a7dc932d5 100644
--- a/Source/WebCore/page/PositionErrorCallback.idl
+++ b/Source/WebCore/Modules/geolocation/PositionErrorCallback.idl
@@ -25,7 +25,7 @@
 module core {
     interface [
         Conditional=GEOLOCATION,
-        Callback=FunctionOnly
+        Callback
     ] PositionErrorCallback {
         boolean handleEvent(in PositionError error);
     };
diff --git a/Source/WebCore/page/PositionOptions.h b/Source/WebCore/Modules/geolocation/PositionOptions.h
index 5cb66f735..5cb66f735 100644
--- a/Source/WebCore/page/PositionOptions.h
+++ b/Source/WebCore/Modules/geolocation/PositionOptions.h
diff --git a/Source/WebCore/Modules/intents/Intent.idl b/Source/WebCore/Modules/intents/Intent.idl
index 33657f4c8..b3e23692c 100644
--- a/Source/WebCore/Modules/intents/Intent.idl
+++ b/Source/WebCore/Modules/intents/Intent.idl
@@ -26,7 +26,7 @@
 module window {
   interface [
       Conditional=WEB_INTENTS,
-      Constructor(in DOMString action, in DOMString type, in [Optional=CallWithNullValue] SerializedScriptValue data),
+      Constructor(in DOMString action, in DOMString type, in [Optional=DefaultIsNullString] SerializedScriptValue data),
       ConstructorRaisesException
   ] Intent {
         readonly attribute DOMString action;
diff --git a/Source/WebCore/Modules/intents/IntentRequest.cpp b/Source/WebCore/Modules/intents/IntentRequest.cpp
index 296f3dd2d..486caefab 100644
--- a/Source/WebCore/Modules/intents/IntentRequest.cpp
+++ b/Source/WebCore/Modules/intents/IntentRequest.cpp
@@ -41,7 +41,9 @@ PassRefPtr<IntentRequest> IntentRequest::create(ScriptExecutionContext* context,
                                                 PassRefPtr<IntentResultCallback> successCallback,
                                                 PassRefPtr<IntentResultCallback> errorCallback)
 {
-    return adoptRef(new IntentRequest(context, intent, successCallback, errorCallback));
+    RefPtr<IntentRequest> intentRequest(adoptRef(new IntentRequest(context, intent, successCallback, errorCallback)));
+    intentRequest->suspendIfNeeded();
+    return intentRequest.release();
 }
 
 IntentRequest::IntentRequest(ScriptExecutionContext* context,
@@ -52,24 +54,26 @@ IntentRequest::IntentRequest(ScriptExecutionContext* context,
     , m_intent(intent)
     , m_successCallback(successCallback)
     , m_errorCallback(errorCallback)
+    , m_stopped(false)
 {
 }
 
 void IntentRequest::contextDestroyed()
 {
     ContextDestructionObserver::contextDestroyed();
-    m_successCallback.clear();
-    m_errorCallback.clear();
+    m_stopped = true;
 }
 
 void IntentRequest::stop()
 {
-    m_successCallback.clear();
-    m_errorCallback.clear();
+    m_stopped = true;
 }
 
 void IntentRequest::postResult(SerializedScriptValue* data)
 {
+    if (m_stopped)
+        return;
+
     // Callback could lead to deletion of this.
     RefPtr<IntentRequest> protector(this);
 
@@ -84,6 +88,9 @@ void IntentRequest::postResult(SerializedScriptValue* data)
 
 void IntentRequest::postFailure(SerializedScriptValue* data)
 {
+    if (m_stopped)
+        return;
+
     // Callback could lead to deletion of this.
     RefPtr<IntentRequest> protector(this);
 
diff --git a/Source/WebCore/Modules/intents/IntentRequest.h b/Source/WebCore/Modules/intents/IntentRequest.h
index 7a809a98e..3edc0cedd 100644
--- a/Source/WebCore/Modules/intents/IntentRequest.h
+++ b/Source/WebCore/Modules/intents/IntentRequest.h
@@ -60,6 +60,7 @@ private:
     RefPtr<Intent> m_intent;
     RefPtr<IntentResultCallback> m_successCallback;
     RefPtr<IntentResultCallback> m_errorCallback;
+    bool m_stopped;
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/Modules/intents/IntentResultCallback.idl b/Source/WebCore/Modules/intents/IntentResultCallback.idl
index feb4a3cc6..0afa2add6 100644
--- a/Source/WebCore/Modules/intents/IntentResultCallback.idl
+++ b/Source/WebCore/Modules/intents/IntentResultCallback.idl
@@ -26,7 +26,7 @@
 module window {
   interface [
       Conditional=WEB_INTENTS,
-      Callback=FunctionOnly
+      Callback
   ] IntentResultCallback {
       boolean handleEvent(in SerializedScriptValue result);
   };
diff --git a/Source/WebCore/Modules/intents/NavigatorIntents.idl b/Source/WebCore/Modules/intents/NavigatorIntents.idl
index 755f58e1a..b39247a3f 100644
--- a/Source/WebCore/Modules/intents/NavigatorIntents.idl
+++ b/Source/WebCore/Modules/intents/NavigatorIntents.idl
@@ -24,8 +24,8 @@ module window {
         Supplemental=Navigator
     ] NavigatorIntents {
         void startActivity(in Intent intent,
-                           in [Callback=FunctionOnly, Optional] IntentResultCallback successCallback,
-                           in [Callback=FunctionOnly, Optional] IntentResultCallback failureCallback)
+                           in [Callback, Optional] IntentResultCallback successCallback,
+                           in [Callback, Optional] IntentResultCallback failureCallback)
             raises(DOMException);
     };
 
diff --git a/Source/WebCore/Modules/vibration/NavigatorVibration.cpp b/Source/WebCore/Modules/vibration/NavigatorVibration.cpp
new file mode 100644
index 000000000..ae46bff9c
--- /dev/null
+++ b/Source/WebCore/Modules/vibration/NavigatorVibration.cpp
@@ -0,0 +1,81 @@
+/*
+ *  Copyright (C) 2012 Samsung Electronics
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Library General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Library General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Library General Public License
+ *  along with this library; see the file COPYING.LIB.  If not, write to
+ *  the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ *  Boston, MA 02110-1301, USA.
+ */
+
+#include "config.h"
+#include "NavigatorVibration.h"
+
+#if ENABLE(VIBRATION)
+
+#include "ExceptionCode.h"
+#include "Frame.h"
+#include "Navigator.h"
+#include "Page.h"
+#include "Vibration.h"
+#include <wtf/Uint32Array.h>
+
+namespace WebCore {
+
+NavigatorVibration::NavigatorVibration()
+{
+}
+
+NavigatorVibration::~NavigatorVibration()
+{
+}
+
+void NavigatorVibration::webkitVibrate(Navigator* navigator, unsigned long time, ExceptionCode& ec)
+{
+    if (!navigator->frame()->page())
+        return;
+
+#if ENABLE(PAGE_VISIBILITY_API)
+    if (navigator->frame()->page()->visibilityState() == PageVisibilityStateHidden)
+        return;
+#endif
+
+    if (!Vibration::isActive(navigator->frame()->page())) {
+        ec = NOT_SUPPORTED_ERR;
+        return;
+    }
+
+    Vibration::from(navigator->frame()->page())->vibrate(time);
+}
+
+void NavigatorVibration::webkitVibrate(Navigator* navigator, const VibrationPattern& pattern, ExceptionCode& ec)
+{
+    if (!navigator->frame()->page())
+        return;
+
+#if ENABLE(PAGE_VISIBILITY_API)
+    if (navigator->frame()->page()->visibilityState() == PageVisibilityStateHidden)
+        return;
+#endif
+
+    if (!Vibration::isActive(navigator->frame()->page())) {
+        ec = NOT_SUPPORTED_ERR;
+        return;
+    }
+
+    Vibration::from(navigator->frame()->page())->vibrate(pattern);
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(VIBRATION)
+
diff --git a/Source/WebCore/Modules/vibration/NavigatorVibration.h b/Source/WebCore/Modules/vibration/NavigatorVibration.h
new file mode 100644
index 000000000..098f6ad5a
--- /dev/null
+++ b/Source/WebCore/Modules/vibration/NavigatorVibration.h
@@ -0,0 +1,50 @@
+/*
+ *  Copyright (C) 2012 Samsung Electronics
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Library General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Library General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Library General Public License
+ *  along with this library; see the file COPYING.LIB.  If not, write to
+ *  the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ *  Boston, MA 02110-1301, USA.
+ */
+
+#ifndef NavigatorVibration_h
+#define NavigatorVibration_h
+
+#if ENABLE(VIBRATION)
+
+#include "ExceptionCode.h"
+#include <wtf/Vector.h>
+
+namespace WebCore {
+
+class Navigator;
+class Uint32Array;
+
+class NavigatorVibration {
+public:
+    typedef Vector<unsigned long> VibrationPattern;
+
+    static void webkitVibrate(Navigator*, unsigned long time, ExceptionCode&);
+    static void webkitVibrate(Navigator*, const VibrationPattern&, ExceptionCode&);
+
+private:
+    NavigatorVibration();
+    ~NavigatorVibration();
+};
+
+} // namespace WebCore
+
+#endif // ENABLE(VIBRATION)
+
+#endif // NavigatorVibration_h
+
diff --git a/Source/WebCore/Modules/vibration/NavigatorVibration.idl b/Source/WebCore/Modules/vibration/NavigatorVibration.idl
new file mode 100644
index 000000000..624845d81
--- /dev/null
+++ b/Source/WebCore/Modules/vibration/NavigatorVibration.idl
@@ -0,0 +1,30 @@
+/*
+ *  Copyright (C) 2012 Samsung Electronics
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Library General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Library General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Library General Public License
+ *  along with this library; see the file COPYING.LIB.  If not, write to
+ *  the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ *  Boston, MA 02110-1301, USA.
+ */
+
+module window {
+
+    interface [
+        Conditional=VIBRATION,
+        Supplemental=Navigator
+    ] NavigatorVibration {
+        void webkitVibrate(in unsigned long[] pattern) raises(DOMException);
+        void webkitVibrate(in unsigned long time) raises(DOMException);
+    };
+
+}
diff --git a/Source/WebCore/Modules/vibration/Vibration.cpp b/Source/WebCore/Modules/vibration/Vibration.cpp
new file mode 100644
index 000000000..9e52c3dfb
--- /dev/null
+++ b/Source/WebCore/Modules/vibration/Vibration.cpp
@@ -0,0 +1,144 @@
+/*
+ *  Copyright (C) 2012 Samsung Electronics
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Library General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Library General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Library General Public License
+ *  along with this library; see the file COPYING.LIB.  If not, write to
+ *  the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ *  Boston, MA 02110-1301, USA.
+ */
+
+#include "config.h"
+#include "Vibration.h"
+
+#if ENABLE(VIBRATION)
+
+#include "VibrationClient.h"
+
+namespace WebCore {
+
+Vibration::Vibration(VibrationClient* client)
+    : m_vibrationClient(client)
+    , m_timerStart(this, &Vibration::timerStartFired)
+    , m_timerStop(this, &Vibration::timerStopFired)
+    , m_isVibrating(false)
+{
+}
+
+Vibration::~Vibration()
+{
+    m_vibrationClient->vibrationDestroyed();
+}
+
+PassOwnPtr<Vibration> Vibration::create(VibrationClient* client)
+{
+    return adoptPtr(new Vibration(client));
+}
+
+void Vibration::vibrate(const unsigned long& time)
+{
+    if (!time) {
+        cancelVibration();
+        return;
+    }
+    m_pattern.append(time);
+    m_timerStart.startOneShot(0);
+}
+
+void Vibration::vibrate(const VibrationPattern& pattern)
+{
+    int length = pattern.size();
+
+    if (m_isVibrating)
+        cancelVibration();
+
+    if (!length || (length == 1 && !pattern[0]))
+        return;
+
+    if (m_timerStart.isActive())
+        m_timerStart.stop();
+
+    m_pattern = pattern;
+    m_timerStart.startOneShot(0);
+}
+
+void Vibration::cancelVibration()
+{
+    if (m_isVibrating) {
+        m_vibrationClient->cancelVibration();
+        m_isVibrating = false;
+        m_timerStop.stop();
+    }
+}
+
+void Vibration::suspendVibration()
+{
+    if (!m_isVibrating)
+        return;
+
+    m_pattern.insert(0, m_timerStop.nextFireInterval());
+    m_timerStop.stop();
+    cancelVibration();
+}
+
+void Vibration::resumeVibration()
+{
+    m_timerStart.startOneShot(0);
+}
+
+void Vibration::timerStartFired(Timer<Vibration>* timer)
+{
+    ASSERT_UNUSED(timer, timer == &m_timerStart);
+
+    m_timerStart.stop();
+
+    if (m_pattern.size()) {
+        m_isVibrating = true;
+        m_vibrationClient->vibrate(m_pattern[0]);
+        m_timerStop.startOneShot(m_pattern[0] / 1000.0);
+        m_pattern.remove(0);
+    }
+}
+
+void Vibration::timerStopFired(Timer<Vibration>* timer)
+{
+    ASSERT_UNUSED(timer, timer == &m_timerStop);
+
+    m_timerStop.stop();
+    m_isVibrating = false;
+
+    if (m_pattern.size()) {
+        m_timerStart.startOneShot(m_pattern[0] / 1000.0);
+        m_pattern.remove(0);
+    }
+}
+
+const AtomicString& Vibration::supplementName()
+{
+    DEFINE_STATIC_LOCAL(AtomicString, name, ("vibration"));
+    return name;
+}
+
+bool Vibration::isActive(Page* page)
+{
+    return static_cast<bool>(Vibration::from(page));
+}
+
+void provideVibrationTo(Page* page, VibrationClient* client)
+{
+    PageSupplement::provideTo(page, Vibration::supplementName(), Vibration::create(client));
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(VIBRATION)
+
diff --git a/Source/WebCore/Modules/vibration/Vibration.h b/Source/WebCore/Modules/vibration/Vibration.h
new file mode 100644
index 000000000..27e0736be
--- /dev/null
+++ b/Source/WebCore/Modules/vibration/Vibration.h
@@ -0,0 +1,71 @@
+/*
+ *  Copyright (C) 2012 Samsung Electronics
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Library General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Library General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Library General Public License
+ *  along with this library; see the file COPYING.LIB.  If not, write to
+ *  the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ *  Boston, MA 02110-1301, USA.
+ */
+
+#ifndef Vibration_h
+#define Vibration_h
+
+#if ENABLE(VIBRATION)
+
+#include "PageSupplement.h"
+#include "Timer.h"
+#include <wtf/PassOwnPtr.h>
+
+namespace WebCore {
+
+class Navigator;
+class Page;
+class VibrationClient;
+
+class Vibration : public PageSupplement {
+public:
+    typedef Vector<unsigned long> VibrationPattern;
+
+    Vibration(VibrationClient*);
+    ~Vibration();
+
+    static PassOwnPtr<Vibration> create(VibrationClient*);
+
+    void vibrate(const unsigned long& time);
+    void vibrate(const VibrationPattern&);
+    void cancelVibration();
+
+    // FIXME : Add suspendVibration() and resumeVibration() to the page visibility feature, when the document.hidden attribute is changed.
+    void suspendVibration();
+    void resumeVibration();
+    void timerStartFired(Timer<Vibration>*);
+    void timerStopFired(Timer<Vibration>*);
+
+    static const AtomicString& supplementName();
+    static Vibration* from(Page* page) { return static_cast<Vibration*>(PageSupplement::from(page, supplementName())); }
+    static bool isActive(Page*);
+
+private:
+    VibrationClient* m_vibrationClient;
+    Timer<Vibration> m_timerStart;
+    Timer<Vibration> m_timerStop;
+    bool m_isVibrating;
+    VibrationPattern m_pattern;
+};
+
+} // namespace WebCore
+
+#endif // ENABLE(VIBRATION)
+
+#endif // Vibration_h
+
diff --git a/Source/WebCore/Modules/vibration/VibrationClient.h b/Source/WebCore/Modules/vibration/VibrationClient.h
new file mode 100644
index 000000000..ebe688927
--- /dev/null
+++ b/Source/WebCore/Modules/vibration/VibrationClient.h
@@ -0,0 +1,42 @@
+/*
+ *  Copyright (C) 2012 Samsung Electronics
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Library General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Library General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Library General Public License
+ *  along with this library; see the file COPYING.LIB.  If not, write to
+ *  the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ *  Boston, MA 02110-1301, USA.
+ */
+
+#ifndef VibrationClient_h
+#define VibrationClient_h
+
+namespace WebCore {
+
+class Page;
+
+class VibrationClient {
+public:
+    virtual ~VibrationClient() { }
+
+    virtual void vibrate(const unsigned long& time) = 0;
+    virtual void cancelVibration() = 0;
+
+    virtual void vibrationDestroyed() = 0;
+};
+
+void provideVibrationTo(Page*, VibrationClient*);
+
+} // namespace WebCore
+
+#endif // VibrationClient_h
+
diff --git a/Source/WebCore/PlatformBlackBerry.cmake b/Source/WebCore/PlatformBlackBerry.cmake
index cec781a42..32524d084 100644
--- a/Source/WebCore/PlatformBlackBerry.cmake
+++ b/Source/WebCore/PlatformBlackBerry.cmake
@@ -45,6 +45,7 @@ LIST(APPEND WebCore_SOURCES
     platform/graphics/harfbuzz/ComplexTextControllerHarfBuzz.cpp
     platform/graphics/harfbuzz/FontHarfBuzz.cpp
     platform/graphics/harfbuzz/FontPlatformDataHarfBuzz.cpp
+    platform/graphics/harfbuzz/HarfBuzzShaper.cpp
     platform/graphics/harfbuzz/HarfBuzzSkia.cpp
     platform/graphics/skia/FontCacheSkia.cpp
     platform/graphics/skia/GlyphPageTreeNodeSkia.cpp
@@ -164,12 +165,12 @@ LIST(APPEND WebCore_SOURCES
     platform/graphics/blackberry/FloatRectBlackBerry.cpp
     platform/graphics/blackberry/FloatSizeBlackBerry.cpp
     platform/graphics/blackberry/IconBlackBerry.cpp
+    platform/graphics/blackberry/ImageBlackBerry.cpp
     platform/graphics/blackberry/IntPointBlackBerry.cpp
     platform/graphics/blackberry/IntRectBlackBerry.cpp
     platform/graphics/blackberry/IntSizeBlackBerry.cpp
     platform/graphics/blackberry/MMrenderer.cpp
     platform/graphics/blackberry/MediaPlayerPrivateMMrenderer.cpp
-    platform/graphics/blackberry/ResourceBlackBerry.cpp
     platform/text/blackberry/StringBlackBerry.cpp
 )
 
diff --git a/Source/WebCore/PlatformEfl.cmake b/Source/WebCore/PlatformEfl.cmake
index 4c877ae0e..5d98c8904 100644
--- a/Source/WebCore/PlatformEfl.cmake
+++ b/Source/WebCore/PlatformEfl.cmake
@@ -9,6 +9,7 @@ LIST(APPEND WebCore_INCLUDE_DIRECTORIES
   "${WEBCORE_DIR}/page/efl"
   "${WEBCORE_DIR}/platform/efl"
   "${WEBCORE_DIR}/platform/graphics/efl"
+  "${WEBCORE_DIR}/platform/network/soup"
   "${WEBCORE_DIR}/platform/text/efl"
   "${WEBCORE_DIR}/plugins/efl"
   "${WEBKIT_DIR}/efl/WebCoreSupport"
@@ -71,6 +72,15 @@ LIST(APPEND WebCore_SOURCES
   platform/image-decoders/jpeg/JPEGImageDecoder.cpp
   platform/image-decoders/png/PNGImageDecoder.cpp
   platform/image-decoders/webp/WEBPImageDecoder.cpp
+  platform/network/soup/CookieJarSoup.cpp
+  platform/network/soup/CredentialStorageSoup.cpp
+  platform/network/soup/GOwnPtrSoup.cpp
+  platform/network/soup/ProxyServerSoup.cpp
+  platform/network/soup/ResourceHandleSoup.cpp
+  platform/network/soup/ResourceRequestSoup.cpp
+  platform/network/soup/ResourceResponseSoup.cpp
+  platform/network/soup/SocketStreamHandleSoup.cpp
+  platform/network/soup/SoupURIUtils.cpp
   platform/posix/FileSystemPOSIX.cpp
   platform/text/efl/TextBreakIteratorInternalICUEfl.cpp
 )
@@ -162,41 +172,6 @@ IF (WTF_USE_CAIRO)
   ENDIF ()
 ENDIF ()
 
-IF (WTF_USE_SOUP)
-  LIST(APPEND WebCore_INCLUDE_DIRECTORIES
-    "${WEBCORE_DIR}/platform/network/soup"
-    "${WEBCORE_DIR}/platform/network/soup/cache"
-    "${WEBCORE_DIR}/platform/network/soup/cache/webkit"
-  )
-  LIST(APPEND WebCore_SOURCES
-    platform/network/soup/CookieJarSoup.cpp
-    platform/network/soup/CredentialStorageSoup.cpp
-    platform/network/soup/GOwnPtrSoup.cpp
-    platform/network/soup/ProxyServerSoup.cpp
-    platform/network/soup/ResourceHandleSoup.cpp
-    platform/network/soup/ResourceRequestSoup.cpp
-    platform/network/soup/ResourceResponseSoup.cpp
-    platform/network/soup/SocketStreamHandleSoup.cpp
-    platform/network/soup/SoupURIUtils.cpp
-  )
-ENDIF ()
-
-IF (WTF_USE_CURL)
-  LIST(APPEND WebCore_INCLUDE_DIRECTORIES
-    "${WEBCORE_DIR}/platform/network/curl"
-  )
-  LIST(APPEND WebCore_SOURCES
-    platform/network/curl/CookieJarCurl.cpp
-    platform/network/curl/CredentialStorageCurl.cpp
-    platform/network/curl/DNSCurl.cpp
-    platform/network/curl/FormDataStreamCurl.cpp
-    platform/network/curl/ProxyServerCurl.cpp
-    platform/network/curl/ResourceHandleCurl.cpp
-    platform/network/curl/ResourceHandleManager.cpp
-    platform/network/curl/SocketStreamHandleCurl.cpp
-  )
-ENDIF ()
-
 IF (WTF_USE_ICU_UNICODE)
   LIST(APPEND WebCore_SOURCES
     editing/SmartReplaceICU.cpp
@@ -206,12 +181,6 @@ IF (WTF_USE_ICU_UNICODE)
   )
 ENDIF ()
 
-IF (ENABLE_GEOLOCATION)
-  LIST(APPEND WebCore_SOURCES
-    platform/efl/GeolocationServiceEfl.cpp
-  )
-ENDIF()
-
 IF (ENABLE_VIDEO)
   LIST(APPEND WebCore_INCLUDE_DIRECTORIES
     "${WEBCORE_DIR}/platform/graphics/gstreamer"
@@ -237,20 +206,10 @@ LIST(APPEND WebCore_LIBRARIES
   ${LIBXML2_LIBRARIES}
   ${LIBXSLT_LIBRARIES}
   ${SQLITE_LIBRARIES}
+  ${Glib_LIBRARIES}
+  ${LIBSOUP24_LIBRARIES}
 )
 
-IF (WTF_USE_SOUP)
-  LIST(APPEND WebCore_LIBRARIES
-    ${LIBSOUP24_LIBRARIES}
-  )
-ENDIF ()
-
-IF (WTF_USE_CURL)
-  LIST(APPEND WebCore_LIBRARIES
-    ${CURL_LIBRARIES}
-  )
-ENDIF ()
-
 IF (ENABLE_VIDEO)
   LIST(APPEND WebCore_LIBRARIES
     ${GStreamer-App_LIBRARIES}
@@ -270,6 +229,8 @@ LIST(APPEND WebCore_INCLUDE_DIRECTORIES
   ${LIBXML2_INCLUDE_DIR}
   ${LIBXSLT_INCLUDE_DIR}
   ${SQLITE_INCLUDE_DIR}
+  ${Glib_INCLUDE_DIRS}
+  ${LIBSOUP24_INCLUDE_DIRS}
 )
 
 IF (ENABLE_VIDEO)
@@ -281,15 +242,6 @@ IF (ENABLE_VIDEO)
   )
 ENDIF ()
 
-IF (ENABLE_GLIB_SUPPORT)
-  LIST(APPEND WebCore_LIBRARIES
-    ${Glib_LIBRARIES}
-  )
-  LIST(APPEND WebCore_INCLUDE_DIRECTORIES
-    ${Glib_INCLUDE_DIRS}
-  )
-ENDIF ()
-
 IF (ENABLE_WEBGL)
   LIST(APPEND WebCore_INCLUDE_DIRECTORIES
     ${OPENGL_INCLUDE_DIR}
@@ -301,28 +253,15 @@ IF (ENABLE_WEBGL)
     ${OPENGL_gl_LIBRARY}
   )
   LIST(APPEND WebCore_SOURCES
+    platform/graphics/cairo/DrawingBufferCairo.cpp
     platform/graphics/cairo/GraphicsContext3DCairo.cpp
-    platform/graphics/cairo/OpenGLShims.cpp
-    platform/graphics/efl/DrawingBufferEfl.cpp
-    platform/graphics/efl/GraphicsContext3DEfl.cpp
     platform/graphics/glx/GraphicsContext3DPrivate.cpp
+    platform/graphics/OpenGLShims.cpp
     platform/graphics/opengl/Extensions3DOpenGL.cpp
     platform/graphics/opengl/GraphicsContext3DOpenGL.cpp
     platform/graphics/opengl/GraphicsContext3DOpenGLCommon.cpp
   )
 ENDIF ()
 
-IF (WTF_USE_SOUP)
-  LIST(APPEND WebCore_INCLUDE_DIRECTORIES
-    ${LIBSOUP24_INCLUDE_DIRS}
-  )
-ENDIF ()
-
-IF (WTF_USE_CURL)
-  LIST(APPEND WebCore_INCLUDE_DIRECTORIES
-    ${CURL_INCLUDE_DIRS}
-  )
-ENDIF ()
-
 ADD_DEFINITIONS(-DWTF_USE_CROSS_PLATFORM_CONTEXT_MENUS=1
                 -DDATA_DIR="${CMAKE_INSTALL_PREFIX}/${DATA_INSTALL_DIR}")
diff --git a/Source/WebCore/PlatformWinCE.cmake b/Source/WebCore/PlatformWinCE.cmake
index 48ce75a8e..11bb4b1ec 100644
--- a/Source/WebCore/PlatformWinCE.cmake
+++ b/Source/WebCore/PlatformWinCE.cmake
@@ -32,6 +32,7 @@ LIST(APPEND WebCore_SOURCES
     platform/Cursor.cpp
     platform/LocalizedStrings.cpp
     platform/PlatformStrategies.cpp
+    platform/RunLoop.cpp
     platform/ScrollAnimatorWin.cpp
 
     platform/graphics/ImageSource.cpp
@@ -61,6 +62,7 @@ LIST(APPEND WebCore_SOURCES
     platform/win/PopupMenuWin.cpp
     platform/win/PlatformMouseEventWin.cpp
     platform/win/PlatformScreenWin.cpp
+    platform/win/RunLoopWin.cpp
     platform/win/SSLKeyGeneratorWin.cpp
     platform/win/ScrollbarThemeWin.cpp
     platform/win/SearchPopupMenuWin.cpp
diff --git a/Source/WebCore/Target.pri b/Source/WebCore/Target.pri
index 758dd4bd2..9f5ce3817 100644
--- a/Source/WebCore/Target.pri
+++ b/Source/WebCore/Target.pri
@@ -34,6 +34,10 @@ include_webinspector {
 }
 
 SOURCES += \
+    Modules/geolocation/Geolocation.cpp \
+    Modules/geolocation/GeolocationController.cpp \
+    Modules/geolocation/NavigatorGeolocation.cpp \
+    \
     accessibility/AccessibilityImageMapLink.cpp \
     accessibility/AccessibilityMediaControls.cpp \
     accessibility/AccessibilityMenuList.cpp \
@@ -158,7 +162,8 @@ v8 {
         bindings/v8/custom/V8InjectedScriptHostCustom.cpp \
         bindings/v8/custom/V8InjectedScriptManager.cpp \
         bindings/v8/custom/V8InspectorFrontendHostCustom.cpp \
-        bindings/v8/custom/V8DOMStringMapCustom.cpp
+        bindings/v8/custom/V8DOMStringMapCustom.cpp \
+        bindings/v8/custom/V8DOMTokenListCustom.cpp
 
     SOURCES += \
         bindings/v8/custom/V8CustomSQLStatementErrorCallback.cpp \
@@ -440,7 +445,6 @@ SOURCES += \
     css/CSSValueList.cpp \
     css/CSSValuePool.cpp \
     css/CSSWrapShapes.cpp \
-    css/FontFamilyValue.cpp \
     css/FontFeatureValue.cpp \
     css/FontValue.cpp \
     css/MediaFeatureNames.cpp \
@@ -451,6 +455,7 @@ SOURCES += \
     css/MediaQueryList.cpp \
     css/MediaQueryListListener.cpp \
     css/MediaQueryMatcher.cpp \
+    css/PropertySetCSSStyleDeclaration.cpp \
     css/RGBColor.cpp \
     css/SelectorChecker.cpp \
     css/ShadowValue.cpp \
@@ -565,6 +570,7 @@ SOURCES += \
     dom/SecurityContext.cpp \
     dom/SelectorQuery.cpp \
     dom/ShadowRoot.cpp \
+    dom/ShadowRootList.cpp \
     dom/SpaceSplitString.cpp \
     dom/StaticNodeList.cpp \
     dom/StyledElement.cpp \
@@ -650,6 +656,7 @@ SOURCES += \
     fileapi/DOMFileSystem.cpp \
     fileapi/DOMFileSystemBase.cpp \
     fileapi/DOMFileSystemSync.cpp \
+    fileapi/DOMWindowFileSystem.cpp \
     fileapi/DirectoryEntry.cpp \
     fileapi/DirectoryEntrySync.cpp \
     fileapi/DirectoryReader.cpp \
@@ -841,10 +848,11 @@ SOURCES += \
     html/parser/TextViewSourceParser.cpp \
     html/parser/XSSAuditor.cpp \
     html/shadow/ContentSelectorQuery.cpp \
-    html/shadow/ContentInclusionSelector.cpp \
     html/shadow/DetailsMarkerControl.cpp \
     html/shadow/HTMLContentElement.cpp \
+    html/shadow/HTMLContentSelector.cpp \
     html/shadow/HTMLShadowElement.cpp \
+    html/shadow/InsertionPoint.cpp \
     html/shadow/MediaControls.cpp \
     html/shadow/MediaControlRootElement.cpp \
     html/shadow/MeterShadowElement.cpp \
@@ -855,6 +863,7 @@ SOURCES += \
     inspector/ContentSearchUtils.cpp \
     inspector/DOMEditor.cpp \
     inspector/DOMNodeHighlighter.cpp \
+    inspector/DOMPatchSupport.cpp \
     inspector/IdentifiersFactory.cpp \
     inspector/InjectedScript.cpp \
     inspector/InjectedScriptHost.cpp \
@@ -866,6 +875,7 @@ SOURCES += \
     inspector/InspectorClient.cpp \
     inspector/InspectorConsoleAgent.cpp \
     inspector/InspectorController.cpp \
+    inspector/InspectorCounters.cpp \
     inspector/InspectorDatabaseAgent.cpp \
     inspector/InspectorDatabaseResource.cpp \
     inspector/InspectorDebuggerAgent.cpp \
@@ -919,6 +929,8 @@ SOURCES += \
     loader/cache/CachedResource.cpp \
     loader/cache/CachedScript.cpp \
     loader/cache/CachedShader.cpp \
+    loader/cache/CachedSVGDocument.cpp \
+    loader/cache/CachedSVGDocument.h \
     loader/cache/CachedXSLStyleSheet.cpp \
     loader/CrossOriginAccessControl.cpp \
     loader/CrossOriginPreflightResultCache.cpp \
@@ -984,8 +996,6 @@ SOURCES += \
     page/FrameDestructionObserver.cpp \
     page/FrameTree.cpp \
     page/FrameView.cpp \
-    page/Geolocation.cpp \
-    page/GeolocationController.cpp \
     page/GestureTapHighlighter.cpp \
     page/GroupSettings.cpp \
     page/History.cpp \
@@ -994,16 +1004,21 @@ SOURCES += \
     page/MouseEventWithHitTestResults.cpp \
     page/Navigator.cpp \
     page/NavigatorBase.cpp \
+    page/NavigatorRegisterProtocolHandler.cpp \
+    page/NavigatorSupplement.cpp \
     page/OriginAccessEntry.cpp \
     page/Page.cpp \
     page/PageGroup.cpp \
     page/PageGroupLoadDeferrer.cpp \
+    page/PageSupplement.cpp \
     page/PageVisibilityState.cpp \
     page/Performance.cpp \
     page/PerformanceNavigation.cpp \
     page/PerformanceTiming.cpp \
     page/PrintContext.cpp \
     page/Screen.cpp \
+    page/scrolling/ScrollingCoordinator.cpp \
+    page/scrolling/ScrollingCoordinatorNone.cpp \
     page/SecurityOrigin.cpp \
     page/SecurityPolicy.cpp \
     page/Settings.cpp \
@@ -1033,7 +1048,6 @@ SOURCES += \
     platform/ContentType.cpp \
     platform/CrossThreadCopier.cpp \
     platform/DateComponents.cpp \
-    platform/DefaultLocalizationStrategy.cpp \
     platform/DragData.cpp \
     platform/DragImage.cpp \
     platform/FileChooser.cpp \
@@ -1167,7 +1181,6 @@ SOURCES += \
     platform/UUID.cpp \
     platform/Widget.cpp \
     platform/PlatformStrategies.cpp \
-    platform/LocalizedStrings.cpp \
     plugins/IFrameShimSupport.cpp \
     plugins/PluginDatabase.cpp \
     plugins/PluginDebug.cpp \
@@ -1290,8 +1303,8 @@ SOURCES += \
     storage/Database.cpp \
     storage/DatabaseAuthorizer.cpp \
     storage/DatabaseSync.cpp \
-    storage/LocalStorageTask.cpp \
-    storage/LocalStorageThread.cpp \
+    storage/StorageTask.cpp \
+    storage/StorageThread.cpp \
     storage/Storage.cpp \
     storage/StorageAreaImpl.cpp \
     storage/StorageAreaSync.cpp \
@@ -1505,6 +1518,16 @@ v8 {
 }
 
 HEADERS += \
+    Modules/geolocation/Geolocation.h \
+    Modules/geolocation/GeolocationController.h \
+    Modules/geolocation/GeolocationError.h \
+    Modules/geolocation/GeolocationPosition.h \
+    Modules/geolocation/Geoposition.h \
+    Modules/geolocation/PositionCallback.h \
+    Modules/geolocation/PositionError.h \
+    Modules/geolocation/PositionErrorCallback.h \
+    Modules/geolocation/PositionOptions.h \
+    \
     css/CSSAspectRatioValue.h \
     css/CSSBorderImageSliceValue.h \
     css/CSSBorderImage.h \
@@ -1554,7 +1577,6 @@ HEADERS += \
     css/CSSValueList.h \
     css/CSSValuePool.h \
     css/CSSWrapShapes.h \
-    css/FontFamilyValue.h \
     css/FontFeatureValue.h \
     css/FontValue.h \
     css/MediaFeatureNames.h \
@@ -1627,6 +1649,7 @@ HEADERS += \
     dom/EventListenerMap.h \
     dom/EventNames.h \
     dom/EventQueue.h \
+    dom/EventSender.h \
     dom/EventTarget.h \
     dom/ExceptionBase.h \
     dom/ExceptionCode.h \
@@ -1667,6 +1690,7 @@ HEADERS += \
     dom/ScriptExecutionContext.h \
     dom/SelectorQuery.h \
     dom/ShadowRoot.h \
+    dom/ShadowRootList.h \
     dom/SpaceSplitString.h \
     dom/StaticNodeList.h \
     dom/StyledElement.h \
@@ -1873,7 +1897,6 @@ HEADERS += \
     html/ImageDocument.h \
     html/LabelsNodeList.h \
     html/LinkRelAttribute.h \
-    html/LoadableTextTrack.h \
     html/MediaController.h \
     html/MediaDocument.h \
     html/MediaFragmentURIParser.h \
@@ -1882,9 +1905,6 @@ HEADERS += \
     html/PublicURLManager.h \
     html/StepRange.h \
     html/TextDocument.h \
-    html/TextTrack.h \
-    html/TextTrackCue.h \
-    html/TextTrackCueList.h \
     html/TimeRanges.h \
     html/ValidityState.h \
     html/parser/CSSPreloadScanner.h \
@@ -1905,11 +1925,15 @@ HEADERS += \
     html/parser/HTMLViewSourceParser.h \
     html/parser/XSSAuditor.h \
     html/shadow/ContentSelectorQuery.h \
-    html/shadow/ContentInclusionSelector.h \
     html/shadow/HTMLContentElement.h \
+    html/shadow/HTMLContentSelector.h \
     html/shadow/HTMLShadowElement.h \
     html/shadow/MediaControlElements.h \
     html/shadow/DetailsMarkerControl.h \
+    html/track/LoadableTextTrack.h \
+    html/track/TextTrack.h \
+    html/track/TextTrackCue.h \
+    html/track/TextTrackCueList.h \
     html/track/TextTrackList.h \
     html/track/TrackBase.h \
     html/track/TrackEvent.h \
@@ -1920,6 +1944,7 @@ HEADERS += \
     inspector/ContentSearchUtils.h \
     inspector/DOMEditor.h \
     inspector/DOMNodeHighlighter.h \
+    inspector/DOMPatchSupport.h \
     inspector/DOMWrapperVisitor.h \
     inspector/IdentifiersFactory.h \
     inspector/InjectedScript.h \
@@ -1931,6 +1956,7 @@ HEADERS += \
     inspector/InspectorConsoleAgent.h \
     inspector/InspectorConsoleInstrumentation.h \
     inspector/InspectorController.h \
+    inspector/InspectorCounters.h \
     inspector/InspectorCSSAgent.h \
     inspector/InspectorDatabaseAgent.h \
     inspector/InspectorDatabaseInstrumentation.h \
@@ -1982,6 +2008,7 @@ HEADERS += \
     loader/cache/CachedResourceHandle.h \
     loader/cache/CachedScript.h \
     loader/cache/CachedShader.h \
+    loader/cache/CachedSVGDocument.h \
     loader/cache/CachedXSLStyleSheet.h \
     loader/cache/MemoryCache.h \
     loader/CrossOriginAccessControl.h \
@@ -2047,8 +2074,6 @@ HEADERS += \
     page/Frame.h \
     page/FrameTree.h \
     page/FrameView.h \
-    page/Geolocation.h \
-    page/Geoposition.h \
     page/GestureTapHighlighter.h\
     page/GroupSettings.h \
     page/History.h \
@@ -2059,6 +2084,7 @@ HEADERS += \
     page/PageGroup.h \
     page/PageGroupLoadDeferrer.h \
     page/Page.h \
+    page/PageSupplement.h \
     page/PageVisibilityState.h \
     page/PrintContext.h \
     page/Screen.h \
@@ -2087,7 +2113,6 @@ HEADERS += \
     platform/ContextMenu.h \
     platform/CrossThreadCopier.h \
     platform/DateComponents.h \
-    platform/DefaultLocalizationStrategy.h \
     platform/DragData.h \
     platform/DragImage.h \
     platform/FileChooser.h \
@@ -2498,8 +2523,8 @@ HEADERS += \
     storage/DatabaseTask.h \
     storage/DatabaseThread.h \
     storage/DatabaseTracker.h \
-    storage/LocalStorageTask.h \
-    storage/LocalStorageThread.h \
+    storage/StorageTask.h \
+    storage/StorageThread.h \
     storage/OriginQuotaManager.h \
     storage/OriginUsageRecord.h \
     storage/SQLCallbackWrapper.h \
@@ -2820,7 +2845,6 @@ SOURCES += \
     platform/qt/MIMETypeRegistryQt.cpp \
     platform/qt/PasteboardQt.cpp \
     platform/qt/PlatformKeyboardEventQt.cpp \
-    platform/qt/PlatformMouseEventQt.cpp \
     platform/qt/PlatformScreenQt.cpp \
     platform/qt/PlatformTouchEventQt.cpp \
     platform/qt/PlatformTouchPointQt.cpp \
@@ -2832,11 +2856,11 @@ SOURCES += \
     platform/qt/SoundQt.cpp \
     platform/qt/LoggingQt.cpp \
     platform/qt/LanguageQt.cpp \
+    platform/qt/LocalizedStringsQt.cpp \
     platform/qt/TemporaryLinkStubsQt.cpp \
     platform/text/qt/TextBoundariesQt.cpp \
     platform/text/qt/TextBreakIteratorInternalICUQt.cpp \
     platform/text/qt/TextCodecQt.cpp \
-    platform/qt/WheelEventQt.cpp \
     platform/qt/WidgetQt.cpp
 
 !contains(DEFINES, WTF_USE_LIBXML2=1) {
@@ -2847,8 +2871,7 @@ contains(DEFINES, HAVE_QSTYLE=1) {
     HEADERS += platform/qt/QtStyleOptionWebComboBox.h \
                platform/qt/RenderThemeQStyle.h \
                platform/qt/ScrollbarThemeQt.h
-    SOURCES += platform/qt/RenderThemeQStyle.cpp \
-               platform/qt/ScrollbarQt.cpp
+    SOURCES += platform/qt/RenderThemeQStyle.cpp
 }
 
 contains(DEFINES, ENABLE_SMOOTH_SCROLLING=1) {
@@ -3655,6 +3678,9 @@ contains(DEFINES, ENABLE_WEB_SOCKETS=1) {
         websockets/WebSocket.h \
         websockets/WebSocketChannel.h \
         websockets/WebSocketChannelClient.h \
+        websockets/WebSocketExtensionDispatcher.h \
+        websockets/WebSocketExtensionProcessor.h \
+        websockets/WebSocketFrame.h \
         websockets/WebSocketHandshake.h \
         websockets/WebSocketHandshakeRequest.h \
         websockets/WebSocketHandshakeResponse.h \
@@ -3663,6 +3689,7 @@ contains(DEFINES, ENABLE_WEB_SOCKETS=1) {
     SOURCES += \
         websockets/WebSocket.cpp \
         websockets/WebSocketChannel.cpp \
+        websockets/WebSocketExtensionDispatcher.cpp \
         websockets/WebSocketHandshake.cpp \
         websockets/WebSocketHandshakeRequest.cpp \
         websockets/WebSocketHandshakeResponse.cpp \
@@ -3944,21 +3971,29 @@ contains(CONFIG, texmap) {
         platform/graphics/texmap/LayerTransform.h \
         platform/graphics/texmap/TextureMapper.h \
         platform/graphics/texmap/TextureMapperAnimation.h \
+        platform/graphics/texmap/TextureMapperBackingStore.h \
         platform/graphics/texmap/TextureMapperImageBuffer.h \
-        platform/graphics/texmap/TextureMapperNode.h \
+        platform/graphics/texmap/TextureMapperLayer.h \
         platform/graphics/texmap/TextureMapperPlatformLayer.h
 
     SOURCES += \
         platform/graphics/texmap/LayerTransform.cpp \
         platform/graphics/texmap/TextureMapper.cpp \
         platform/graphics/texmap/TextureMapperAnimation.cpp \
+        platform/graphics/texmap/TextureMapperBackingStore.cpp \
         platform/graphics/texmap/TextureMapperImageBuffer.cpp \
-        platform/graphics/texmap/TextureMapperNode.cpp \
+        platform/graphics/texmap/TextureMapperLayer.cpp \
         platform/graphics/texmap/GraphicsLayerTextureMapper.cpp
 
     !win32-*:contains(QT_CONFIG, opengl) {
-        HEADERS += platform/graphics/opengl/TextureMapperGL.h
-        SOURCES += platform/graphics/opengl/TextureMapperGL.cpp
+        HEADERS += \
+            platform/graphics/texmap/TextureMapperGL.h \
+            platform/graphics/texmap/TextureMapperShaderManager.h
+
+        SOURCES += \
+            platform/graphics/texmap/TextureMapperGL.cpp \
+            platform/graphics/texmap/TextureMapperShaderManager.cpp
+
         CONFIG += opengl-shims
         DEFINES += WTF_USE_TEXTURE_MAPPER_GL
     }
@@ -3968,8 +4003,8 @@ contains(CONFIG, texmap) {
 }
 
 contains(CONFIG, opengl-shims) {
-    HEADERS += platform/graphics/cairo/OpenGLShims.h
-    SOURCES += platform/graphics/cairo/OpenGLShims.cpp
+    HEADERS += platform/graphics/OpenGLShims.h
+    SOURCES += platform/graphics/OpenGLShims.cpp
     DEFINES += QT_OPENGL_SHIMS=1
 }
 
diff --git a/Source/WebCore/UseJSC.cmake b/Source/WebCore/UseJSC.cmake
index 38e67312c..e8a35d1ff 100644
--- a/Source/WebCore/UseJSC.cmake
+++ b/Source/WebCore/UseJSC.cmake
@@ -267,8 +267,8 @@ FILE(WRITE ${IDL_FILES_TMP} ${IDL_FILES_LIST})
 
 ADD_CUSTOM_COMMAND(
     OUTPUT ${SUPPLEMENTAL_DEPENDENCY_FILE}
-    DEPENDS ${WEBCORE_DIR}/bindings/scripts/resolve-supplemental.pl ${SCRIPTS_RESOLVE_SUPPLEMENTAL} ${WebCore_IDL_FILES}
-    COMMAND ${PERL_EXECUTABLE} -I${WEBCORE_DIR}/bindings/scripts ${WEBCORE_DIR}/bindings/scripts/resolve-supplemental.pl --defines "${FEATURE_DEFINES_JAVASCRIPT}" --idlFilesList ${IDL_FILES_TMP} --preprocessor "${CODE_GENERATOR_PREPROCESSOR}" --supplementalDependencyFile ${SUPPLEMENTAL_DEPENDENCY_FILE}
+    DEPENDS ${WEBCORE_DIR}/bindings/scripts/resolve-supplemental.pl ${SCRIPTS_RESOLVE_SUPPLEMENTAL} ${WebCore_IDL_FILES} ${IDL_ATTRIBUTES_FILE}
+    COMMAND ${PERL_EXECUTABLE} -I${WEBCORE_DIR}/bindings/scripts ${WEBCORE_DIR}/bindings/scripts/resolve-supplemental.pl --defines "${FEATURE_DEFINES_JAVASCRIPT}" --idlFilesList ${IDL_FILES_TMP} --preprocessor "${CODE_GENERATOR_PREPROCESSOR}" --supplementalDependencyFile ${SUPPLEMENTAL_DEPENDENCY_FILE} --idlAttributesFile ${IDL_ATTRIBUTES_FILE}
     VERBATIM)
 
 FOREACH (_file ${WebCore_IDL_FILES})
diff --git a/Source/WebCore/UseV8.cmake b/Source/WebCore/UseV8.cmake
index 9b0a039b9..befe1c76f 100755
--- a/Source/WebCore/UseV8.cmake
+++ b/Source/WebCore/UseV8.cmake
@@ -81,6 +81,7 @@ LIST(APPEND WebCore_SOURCES
     bindings/v8/custom/V8CustomXPathNSResolver.cpp
     bindings/v8/custom/V8DOMFormDataCustom.cpp
     bindings/v8/custom/V8DOMStringMapCustom.cpp
+    bindings/v8/custom/V8DOMTokenListCustom.cpp
     bindings/v8/custom/V8DOMWindowCustom.cpp
     bindings/v8/custom/V8DataViewCustom.cpp
     bindings/v8/custom/V8DedicatedWorkerContextCustom.cpp
@@ -128,9 +129,9 @@ LIST(APPEND WebCore_SOURCES
     bindings/v8/custom/V8MessageChannelConstructor.cpp
     bindings/v8/custom/V8MessageEventCustom.cpp
     bindings/v8/custom/V8MessagePortCustom.cpp
+    bindings/v8/custom/V8MutationCallbackCustom.cpp
     bindings/v8/custom/V8NamedNodeMapCustom.cpp
     bindings/v8/custom/V8NamedNodesCollection.cpp
-    bindings/v8/custom/V8NavigatorCustom.cpp
     bindings/v8/custom/V8NodeCustom.cpp
     bindings/v8/custom/V8NodeListCustom.cpp
     bindings/v8/custom/V8NotificationCenterCustom.cpp
@@ -147,6 +148,7 @@ LIST(APPEND WebCore_SOURCES
     bindings/v8/custom/V8Uint8ArrayCustom.cpp
     bindings/v8/custom/V8WebGLRenderingContextCustom.cpp
     bindings/v8/custom/V8WebKitAnimationCustom.cpp
+    bindings/v8/custom/V8WebKitMutationObserverCustom.cpp
     bindings/v8/custom/V8WebKitPointConstructor.cpp
     bindings/v8/custom/V8WebSocketCustom.cpp
     bindings/v8/custom/V8WorkerContextCustom.cpp
@@ -251,8 +253,8 @@ FILE(WRITE ${IDL_FILES_TMP} ${IDL_FILES_LIST})
 
 ADD_CUSTOM_COMMAND(
     OUTPUT ${SUPPLEMENTAL_DEPENDENCY_FILE}
-    DEPENDS ${WEBCORE_DIR}/bindings/scripts/resolve-supplemental.pl ${SCRIPTS_RESOLVE_SUPPLEMENTAL} ${WebCore_IDL_FILES}
-    COMMAND ${PERL_EXECUTABLE} -I${WEBCORE_DIR}/bindings/scripts ${WEBCORE_DIR}/bindings/scripts/resolve-supplemental.pl --defines "${FEATURE_DEFINES_JAVASCRIPT}" --idlFilesList ${IDL_FILES_TMP} --preprocessor "${CODE_GENERATOR_PREPROCESSOR}" --supplementalDependencyFile ${SUPPLEMENTAL_DEPENDENCY_FILE}
+    DEPENDS ${WEBCORE_DIR}/bindings/scripts/resolve-supplemental.pl ${SCRIPTS_RESOLVE_SUPPLEMENTAL} ${WebCore_IDL_FILES} ${IDL_ATTRIBUTES_FILE}
+    COMMAND ${PERL_EXECUTABLE} -I${WEBCORE_DIR}/bindings/scripts ${WEBCORE_DIR}/bindings/scripts/resolve-supplemental.pl --defines "${FEATURE_DEFINES_JAVASCRIPT}" --idlFilesList ${IDL_FILES_TMP} --preprocessor "${CODE_GENERATOR_PREPROCESSOR}" --supplementalDependencyFile ${SUPPLEMENTAL_DEPENDENCY_FILE} --idlAttributesFile ${IDL_ATTRIBUTES_FILE}
     VERBATIM)
 
 FOREACH (_file ${WebCore_IDL_FILES})
diff --git a/Source/WebCore/WebCore.exp.in b/Source/WebCore/WebCore.exp.in
index d839c53d9..e812ffff6 100644
--- a/Source/WebCore/WebCore.exp.in
+++ b/Source/WebCore/WebCore.exp.in
@@ -519,7 +519,7 @@ __ZN7WebCore16ScriptController18windowScriptObjectEv
 __ZN7WebCore16ScriptController20executeScriptInWorldEPNS_15DOMWrapperWorldERKN3WTF6StringEb
 __ZN7WebCore16ScriptController21processingUserGestureEv
 __ZN7WebCore16ScriptController24jsObjectForPluginElementEPNS_17HTMLPlugInElementE
-__ZN7WebCore16StylePropertySet5derefEv
+__ZN7WebCore16StylePropertySetD1Ev
 __ZN7WebCore16ThreadGlobalData10staticDataE
 __ZN7WebCore16ThreadGlobalDataC1Ev
 __ZN7WebCore16ThreadGlobalDataD1Ev
@@ -548,7 +548,19 @@ __ZN7WebCore17RegularExpressionD1Ev
 __ZN7WebCore17cacheDOMStructureEPNS_17JSDOMGlobalObjectEPN3JSC9StructureEPKNS2_9ClassInfoE
 __ZN7WebCore17openTemporaryFileERKN3WTF6StringERi
 __ZN7WebCore18HTMLContentElement6createEPNS_8DocumentE
-__ZN7WebCore18PlatformStrategies26createLocalizationStrategyEv
+__ZN7WebCore18PlatformPasteboard13bufferForTypeERKN3WTF6StringE
+__ZN7WebCore18PlatformPasteboard13stringForTypeERKN3WTF6StringE
+__ZN7WebCore18PlatformPasteboard19setPathnamesForTypeERKN3WTF6VectorINS1_6StringELm0EEERKS3_
+__ZN7WebCore18PlatformPasteboard19getPathnamesForTypeERN3WTF6VectorINS1_6StringELm0EEERKS3_
+__ZN7WebCore18PlatformPasteboard8setTypesERKN3WTF6VectorINS1_6StringELm0EEE
+__ZN7WebCore18PlatformPasteboardC1ERKN3WTF6StringE
+__ZN7WebCore18PlatformPasteboard8getTypesERN3WTF6VectorINS1_6StringELm0EEE
+__ZN7WebCore18PlatformPasteboard4copyERKN3WTF6StringE
+__ZN7WebCore18PlatformPasteboard16setBufferForTypeEN3WTF10PassRefPtrINS_12SharedBufferEEERKNS1_6StringE
+__ZN7WebCore18PlatformPasteboard16setStringForTypeERKN3WTF6StringES4_
+__ZN7WebCore18PlatformPasteboard10uniqueNameEv
+__ZNK7WebCore18PlatformPasteboard11changeCountEv
+__ZN7WebCore18PlatformPasteboard5colorEv
 __ZN7WebCore18SearchPopupMenuMacC1EPNS_15PopupMenuClientE
 __ZN7WebCore18isStartOfParagraphERKNS_15VisiblePositionENS_27EditingBoundaryCrossingRuleE
 __ZN7WebCore18pluginScriptObjectEPN3JSC9ExecStateEPNS_13JSHTMLElementE
@@ -592,6 +604,11 @@ __ZN7WebCore19TextResourceDecoder6decodeEPKcm
 __ZN7WebCore19TextResourceDecoderC1ERKN3WTF6StringERKNS_12TextEncodingEb
 __ZN7WebCore19TextResourceDecoderD1Ev
 __ZN7WebCore19applicationIsSafariEv
+
+#if ENABLE(NOTIFICATIONS)
+__ZN7WebCore19provideNotificationEPNS_4PageEPNS_21NotificationPresenterE
+#endif
+
 __ZN7WebCore20DisplaySleepDisablerC1EPKc
 __ZN7WebCore20DisplaySleepDisablerD1Ev
 __ZN7WebCore20NodeRenderingContextC1EPNS_4NodeE
@@ -660,6 +677,7 @@ __ZN7WebCore24FrameDestructionObserverD2Ev
 __ZN7WebCore24FrameDestructionObserverC2EPNS_5FrameE
 __ZN7WebCore24FrameDestructionObserver12observeFrameEPNS_5FrameE
 __ZN7WebCore24FrameDestructionObserver14frameDestroyedEv
+__ZN7WebCore24FrameDestructionObserver14willDetachPageEv
 __ZN7WebCore24keyIdentifierForKeyEventEP7NSEvent
 __ZN7WebCore24notifyHistoryItemChangedE
 __ZN7WebCore25HistoryPropertyListWriter11releaseDataEv
@@ -829,7 +847,7 @@ __ZN7WebCore6Cursor8fromTypeENS0_4TypeE
 __ZN7WebCore6CursorC1EPNS_5ImageERKNS_8IntPointE
 __ZN7WebCore6CursorD1Ev
 __ZN7WebCore6CursoraSERKS0_
-__ZN7WebCore6Editor10applyStyleEPNS_19CSSStyleDeclarationENS_10EditActionE
+__ZN7WebCore6Editor10applyStyleEPNS_16StylePropertySetENS_10EditActionE
 __ZN7WebCore6Editor10findStringERKN3WTF6StringEj
 __ZN7WebCore6Editor10insertTextERKN3WTF6StringEPNS_5EventE
 __ZN7WebCore6Editor13canDHTMLPasteEv
@@ -846,11 +864,11 @@ __ZN7WebCore6Editor18confirmCompositionEv
 __ZN7WebCore6Editor19countMatchesForTextERKN3WTF6StringEPNS_5RangeEjjb
 __ZN7WebCore6Editor19deleteWithDirectionENS_18SelectionDirectionENS_15TextGranularityEbb
 __ZN7WebCore6Editor19insertUnorderedListEv
-__ZN7WebCore6Editor21applyStyleToSelectionEPNS_19CSSStyleDeclarationENS_10EditActionE
+__ZN7WebCore6Editor21applyStyleToSelectionEPNS_16StylePropertySetENS_10EditActionE
 __ZN7WebCore6Editor21isSelectionMisspelledEv
 __ZN7WebCore6Editor23setBaseWritingDirectionE16WritingDirection
 __ZN7WebCore6Editor24advanceToNextMisspellingEb
-__ZN7WebCore6Editor24computeAndSetTypingStyleEPNS_19CSSStyleDeclarationENS_10EditActionE
+__ZN7WebCore6Editor24computeAndSetTypingStyleEPNS_16StylePropertySetENS_10EditActionE
 __ZN7WebCore6Editor24isSelectionUngrammaticalEv
 __ZN7WebCore6Editor24replaceSelectionWithTextERKN3WTF6StringEbb
 __ZN7WebCore6Editor26decreaseSelectionListLevelEv
@@ -861,7 +879,6 @@ __ZN7WebCore6Editor27readSelectionFromPasteboardERKN3WTF6StringE
 __ZN7WebCore6Editor28replaceSelectionWithFragmentEN3WTF10PassRefPtrINS_16DocumentFragmentEEEbbb
 __ZN7WebCore6Editor29canDecreaseSelectionListLevelEv
 __ZN7WebCore6Editor29canIncreaseSelectionListLevelEv
-__ZN7WebCore6Editor30applyParagraphStyleToSelectionEPNS_19CSSStyleDeclarationENS_10EditActionE
 __ZN7WebCore6Editor30deleteSelectionWithSmartDeleteEb
 __ZN7WebCore6Editor30pasteAsPlainTextBypassingDHTMLEv
 __ZN7WebCore6Editor32guessesForUngrammaticalSelectionEv
@@ -1424,8 +1441,9 @@ __ZNK7WebCore6Widget25convertToContainingWindowERKNS_7IntRectE
 __ZNK7WebCore6Widget25convertToContainingWindowERKNS_8IntPointE
 __ZNK7WebCore6Widget9frameRectEv
 __ZNK7WebCore7Element10screenRectEv
-__ZNK7WebCore7Element10shadowRootEv
 __ZNK7WebCore7Element12getAttributeERKNS_13QualifiedNameE
+__ZNK7WebCore7Element13hasShadowRootEv
+__ZNK7WebCore7Element14shadowRootListEv
 __ZNK7WebCore7IntRect10intersectsERKS0_
 __ZNK7WebCore7IntRect8containsERKS0_
 __ZNK7WebCore7IntRectcv6CGRectEv
@@ -1463,6 +1481,7 @@ __ZNK7WebCore9FrameTree20traverseNextWithWrapEb
 __ZNK7WebCore9FrameTree24traversePreviousWithWrapEb
 __ZNK7WebCore9FrameTree4findERKN3WTF12AtomicStringE
 __ZNK7WebCore9FrameTree6parentEb
+__ZNK7WebCore9FrameTree10childCountEv
 __ZNK7WebCore9FrameView11needsLayoutEv
 __ZNK7WebCore9FrameView13isTransparentEv
 __ZNK7WebCore9FrameView13paintBehaviorEv
@@ -1477,7 +1496,6 @@ __ZNK7WebCore9TreeScope14getElementByIdERKN3WTF12AtomicStringE
 __ZTVN7WebCore12ChromeClientE
 __ZTVN7WebCore16IconDatabaseBaseE
 __ZTVN7WebCore17FrameLoaderClientE
-__ZTVN7WebCore18PlatformStrategiesE
 __ZTVN7WebCore25HistoryPropertyListWriterE
 __ZTVN7WebCore28InspectorFrontendClientLocal8SettingsE
 _filenameByFixingIllegalCharacters
@@ -1616,7 +1634,6 @@ _wkCreateAXUIElementRef
 
 #if ENABLE(SVG)
 __ZN7WebCore14SVGSMILElement13isSMILElementEPNS_4NodeE
-__ZN7WebCore21SVGDocumentExtensions21sampleAnimationAtTimeERKN3WTF6StringEPNS_14SVGSMILElementEd
 __ZN7WebCore8Document13svgExtensionsEv
 __ZN7WebCore8Document19accessSVGExtensionsEv
 #endif
@@ -1697,6 +1714,7 @@ __ZN7WebCore19InspectorController5closeEv
 __ZN7WebCore28InspectorFrontendClientLocal11showConsoleEv
 __ZN7WebCore28InspectorFrontendClientLocal12moveWindowByEff
 __ZN7WebCore28InspectorFrontendClientLocal12openInNewTabERKN3WTF6StringE
+__ZN7WebCore28InspectorFrontendClientLocal13showResourcesEv
 __ZN7WebCore28InspectorFrontendClientLocal14frontendLoadedEv
 __ZN7WebCore28InspectorFrontendClientLocal15canAttachWindowEv
 __ZN7WebCore28InspectorFrontendClientLocal17setAttachedWindowEb
@@ -1708,6 +1726,7 @@ __ZN7WebCore28InspectorFrontendClientLocal19windowObjectClearedEv
 __ZN7WebCore28InspectorFrontendClientLocal20sendMessageToBackendERKN3WTF6StringE
 __ZN7WebCore28InspectorFrontendClientLocal21isProfilingJavaScriptEv
 __ZN7WebCore28InspectorFrontendClientLocal23stopProfilingJavaScriptEv
+__ZN7WebCore28InspectorFrontendClientLocal24showMainResourceForFrameEPNS_5FrameE
 __ZN7WebCore28InspectorFrontendClientLocal24startProfilingJavaScriptEv
 __ZN7WebCore28InspectorFrontendClientLocal26changeAttachedWindowHeightEj
 __ZN7WebCore28InspectorFrontendClientLocal26isTimelineProfilingEnabledEv
@@ -2065,15 +2084,20 @@ __ZN7WebCore12NotificationD1Ev
 __ZN7WebCore12Notification17dispatchShowEventEv
 __ZN7WebCore12Notification18dispatchClickEventEv
 __ZN7WebCore12Notification18dispatchCloseEventEv
+__ZN7WebCore12Notification18dispatchErrorEventEv
 #endif
 
 #if ENABLE(THREADED_SCROLLING)
 __ZN7WebCore13ScrollingTree21tryToHandleWheelEventERKNS_18PlatformWheelEventE
+__ZN7WebCore13ScrollingTree22updateBackForwardStateEbb
 __ZN7WebCore13ScrollingTreeD1Ev
+__ZN7WebCore15ScrollingThread8dispatchERKN3WTF8FunctionIFvvEEE
 __ZN7WebCore4Page20scrollingCoordinatorEv
 __ZNK7WebCore20ScrollingCoordinator13scrollingTreeEv
 #endif
 
-#if ENABLE(STYLE_SCOPED)
-__ZNK7WebCore7Element31numberOfScopedHTMLStyleChildrenEv
+__ZNK7WebCore4Node31numberOfScopedHTMLStyleChildrenEv
+
+#if ENABLE(SHADOW_DOM)
+__ZN7WebCore22RuntimeEnabledFeatures32setMultipleShadowSubtreesEnabledEb
 #endif
diff --git a/Source/WebCore/WebCore.gyp/WebCore.gyp b/Source/WebCore/WebCore.gyp/WebCore.gyp
index 517f9b1be..25c541336 100644
--- a/Source/WebCore/WebCore.gyp/WebCore.gyp
+++ b/Source/WebCore/WebCore.gyp/WebCore.gyp
@@ -52,6 +52,7 @@
       '../',
       '../..',
       '../Modules/gamepad',
+      '../Modules/geolocation',
       '../Modules/intents',
       '../Modules/indexeddb',
       '../accessibility',
@@ -89,6 +90,7 @@
       '../page',
       '../page/animation',
       '../page/chromium',
+      '../page/scrolling',
       '../platform',
       '../platform/animation',
       '../platform/audio',
@@ -310,18 +312,11 @@
           # static library and rebuilds it with these global symbols
           # transformed to private_extern.
           'target_name': 'webkit_system_interface',
-          'type': 'static_library',
+          'type': 'none',
           'variables': {
             'adjusted_library_path':
                 '<(PRODUCT_DIR)/libWebKitSystemInterfaceLeopardPrivateExtern.a',
           },
-          'sources': [
-            # An empty source file is needed to convince Xcode to produce
-            # output for this target.  The resulting library won't actually
-            # contain anything.  The library at adjusted_library_path will,
-            # and that library is pushed to dependents of this target below.
-            'mac/Empty.cpp',
-          ],
           'actions': [
             {
               'action_name': 'Adjust Visibility',
@@ -484,6 +479,7 @@
           'inputs': [
             '../bindings/scripts/resolve-supplemental.pl',
             '../bindings/scripts/IDLParser.pm',
+            '../bindings/scripts/IDLAttributes.txt',
             '<(idl_files_list)',
             '<!@(cat <(idl_files_list))',
           ],
@@ -501,6 +497,8 @@
             '<(idl_files_list)',
             '--supplementalDependencyFile',
             '<(SHARED_INTERMEDIATE_DIR)/supplemental_dependency.tmp',
+            '--idlAttributesFile',
+            '../bindings/scripts/IDLAttributes.txt',
           ],
           'message': 'Resolving [Supplemental=XXX] dependencies in all IDL files',
         }
@@ -820,6 +818,7 @@
               '../css/quirks.css',
               '../css/view-source.css',
               '../css/themeChromium.css', # Chromium only.
+              '../css/themeChromiumAndroid.css', # Chromium only.
               '../css/themeChromiumLinux.css', # Chromium only.
               '../css/themeChromiumSkia.css',  # Chromium only.
               '../css/themeWin.css',
@@ -1177,6 +1176,7 @@
         '<(chromium_src_dir)/third_party/ots/ots.gyp:ots',
         '<(chromium_src_dir)/third_party/sqlite/sqlite.gyp:sqlite',
         '<(chromium_src_dir)/third_party/angle/src/build_angle.gyp:translator_glsl',
+        '<(chromium_src_dir)/third_party/zlib/zlib.gyp:zlib',
         '<(chromium_src_dir)/v8/tools/gyp/v8.gyp:v8',
         '<(libjpeg_gyp_path):libjpeg',
       ],
@@ -1484,6 +1484,7 @@
             ['include', 'platform/graphics/harfbuzz/FontHarfBuzz\\.cpp$'],
             ['include', 'platform/graphics/harfbuzz/FontPlatformDataHarfBuzz\\.cpp$'],
             ['include', 'platform/graphics/harfbuzz/HarfBuzzSkia\\.cpp$'],
+            ['include', 'platform/graphics/harfbuzz/HarfBuzzShaperBase\\.(cpp|h)$'],
             ['include', 'platform/graphics/skia/SimpleFontDataSkia\\.cpp$'],
           ],
         }, { # use_x11==0
diff --git a/Source/WebCore/WebCore.gypi b/Source/WebCore/WebCore.gypi
index e4a52271b..bf1e89651 100644
--- a/Source/WebCore/WebCore.gypi
+++ b/Source/WebCore/WebCore.gypi
@@ -3,6 +3,15 @@
         'project_dir': ['.'],
         # These headers are part of WebCore's private API in the Apple Mac build.
         'webcore_privateheader_files': [
+            'Modules/geolocation/Geolocation.h',
+            'Modules/geolocation/GeolocationController.h',
+            'Modules/geolocation/GeolocationError.h',
+            'Modules/geolocation/GeolocationPosition.h',
+            'Modules/geolocation/Geoposition.h',
+            'Modules/geolocation/PositionCallback.h',
+            'Modules/geolocation/PositionError.h',
+            'Modules/geolocation/PositionErrorCallback.h',
+            'Modules/geolocation/PositionOptions.h',
             'accessibility/AXObjectCache.h',
             'accessibility/AccessibilityObject.h',
             'bindings/ScriptControllerBase.h',
@@ -207,23 +216,15 @@
             'page/Frame.h',
             'page/FrameTree.h',
             'page/FrameView.h',
-            'page/Geolocation.h',
             'page/GeolocationClient.h',
-            'page/GeolocationController.h',
-            'page/GeolocationError.h',
-            'page/GeolocationPosition.h',
-            'page/Geoposition.h',
             'page/GroupSettings.h',
             'page/MediaCanStartListener.h',
             'page/MemoryInfo.h',
             'page/Page.h',
             'page/PageGroup.h',
             'page/PageSerializer.h',
+            'page/PageSupplement.h',
             'page/PageVisibilityState.h',
-            'page/PositionCallback.h',
-            'page/PositionError.h',
-            'page/PositionErrorCallback.h',
-            'page/PositionOptions.h',
             'page/PrintContext.h',
             'page/SecurityOrigin.h',
             'page/SecurityOriginHash.h',
@@ -251,7 +252,6 @@
             'platform/CookiesStrategy.h',
             'platform/Cursor.h',
             'platform/DateComponents.h',
-            'platform/DefaultLocalizationStrategy.h',
             'platform/DragData.h',
             'platform/DragImage.h',
             'platform/FileChooser.h',
@@ -267,7 +267,6 @@
             'platform/LengthBox.h',
             'platform/LengthSize.h',
             'platform/LinkHash.h',
-            'platform/LocalizationStrategy.h',
             'platform/LocalizedStrings.h',
             'platform/Logging.h',
             'platform/MemoryPressureHandler.h',
@@ -303,7 +302,6 @@
             'platform/ThreadGlobalData.h',
             'platform/Timer.h',
             'platform/TreeShared.h',
-            'platform/URLString.h',
             'platform/VisitedLinkStrategy.h',
             'platform/Widget.h',
             'platform/WindowsKeyboardCodes.h',
@@ -619,6 +617,7 @@
             'dom/ScriptExecutionContext.h',
             'dom/ScriptRunner.h',
             'dom/ShadowRoot.h',
+            'dom/ShadowRootList.h',
             'dom/SpaceSplitString.h',
             'dom/StyledElement.h',
             'dom/Text.h',
@@ -721,6 +720,12 @@
             'Modules/gamepad/Gamepad.idl',
             'Modules/gamepad/GamepadList.idl',
             'Modules/gamepad/NavigatorGamepad.idl',
+            'Modules/geolocation/Geolocation.idl',
+            'Modules/geolocation/Geoposition.idl',
+            'Modules/geolocation/NavigatorGeolocation.idl',
+            'Modules/geolocation/PositionCallback.idl',
+            'Modules/geolocation/PositionError.idl',
+            'Modules/geolocation/PositionErrorCallback.idl',
             'Modules/indexeddb/DOMWindowIndexedDatabase.idl',
             'Modules/intents/DOMWindowIntents.idl',
             'Modules/intents/Intent.idl',
@@ -827,6 +832,7 @@
             'fileapi/DirectoryReaderSync.idl',
             'fileapi/DOMFileSystem.idl',
             'fileapi/DOMFileSystemSync.idl',
+            'fileapi/DOMWindowFileSystem.idl',
             'fileapi/EntriesCallback.idl',
             'fileapi/Entry.idl',
             'fileapi/EntryArray.idl',
@@ -855,6 +861,7 @@
             'html/DOMSettableTokenList.idl',
             'html/DOMTokenList.idl',
             'html/DOMURL.idl',
+            'html/DOMWindowHTML.idl',
             'html/HTMLAllCollection.idl',
             'html/HTMLAnchorElement.idl',
             'html/HTMLAppletElement.idl',
@@ -932,9 +939,6 @@
             'html/MediaController.idl',
             'html/MediaError.idl',
             'html/TextMetrics.idl',
-            'html/TextTrack.idl',
-            'html/TextTrackCue.idl',
-            'html/TextTrackCueList.idl',
             'html/TimeRanges.idl',
             'html/ValidityState.idl',
             'html/VoidCallback.idl',
@@ -945,6 +949,7 @@
             'html/canvas/CanvasPixelArray.idl',
             'html/canvas/CanvasRenderingContext.idl',
             'html/canvas/CanvasRenderingContext2D.idl',
+            'html/canvas/DOMWindowWebGL.idl',
             'html/canvas/DataView.idl',
             'html/canvas/Float32Array.idl',
             'html/canvas/Float64Array.idl',
@@ -976,6 +981,9 @@
             'html/canvas/WebGLVertexArrayObjectOES.idl',
             'html/shadow/HTMLContentElement.idl',
             'html/shadow/HTMLShadowElement.idl',
+            'html/track/TextTrack.idl',
+            'html/track/TextTrackCue.idl',
+            'html/track/TextTrackCueList.idl',
             'html/track/TextTrackList.idl',
             'html/track/TrackEvent.idl',
             'inspector/InjectedScriptHost.idl',
@@ -984,12 +992,14 @@
             'inspector/ScriptProfile.idl',
             'inspector/ScriptProfileNode.idl',
             'loader/appcache/DOMApplicationCache.idl',
+            'mediastream/DOMWindowMediaStream.idl',
             'mediastream/LocalMediaStream.idl',
             'mediastream/MediaStream.idl',
             'mediastream/MediaStreamEvent.idl',
             'mediastream/MediaStreamList.idl',
             'mediastream/MediaStreamTrack.idl',
             'mediastream/MediaStreamTrackList.idl',
+            'mediastream/NavigatorMediaStream.idl',
             'mediastream/NavigatorUserMediaError.idl',
             'mediastream/NavigatorUserMediaErrorCallback.idl',
             'mediastream/NavigatorUserMediaSuccessCallback.idl',
@@ -1005,19 +1015,15 @@
             'page/DOMSelection.idl',
             'page/DOMWindow.idl',
             'page/EventSource.idl',
-            'page/Geolocation.idl',
-            'page/Geoposition.idl',
             'page/History.idl',
             'page/Location.idl',
             'page/MemoryInfo.idl',
             'page/Navigator.idl',
+            'page/NavigatorRegisterProtocolHandler.idl',
             'page/Performance.idl',
             'page/PerformanceNavigation.idl',
             'page/PerformanceTiming.idl',
             'page/PointerLock.idl',
-            'page/PositionCallback.idl',
-            'page/PositionError.idl',
-            'page/PositionErrorCallback.idl',
             'page/Screen.idl',
             'page/SpeechInputEvent.idl',
             'page/SpeechInputResult.idl',
@@ -1097,12 +1103,14 @@
             'websockets/DOMWindowWebSocket.idl',
             'websockets/WebSocket.idl',
             'workers/AbstractWorker.idl',
+            'workers/DOMWindowWorker.idl',
             'workers/DedicatedWorkerContext.idl',
             'workers/SharedWorker.idl',
             'workers/SharedWorkerContext.idl',
             'workers/Worker.idl',
             'workers/WorkerContext.idl',
             'workers/WorkerLocation.idl',
+            'xml/DOMWindowXML.idl',
             'xml/DOMParser.idl',
             'xml/XMLHttpRequest.idl',
             'xml/XMLHttpRequestException.idl',
@@ -1117,6 +1125,7 @@
             'xml/XSLTProcessor.idl',
         ],
         'webcore_svg_bindings_idl_files': [
+            'svg/DOMWindowSVG.idl',
             'svg/ElementTimeControl.idl',
             'svg/SVGAElement.idl',
             'svg/SVGAltGlyphElement.idl',
@@ -1277,6 +1286,10 @@
             'Modules/gamepad/GamepadList.h',
             'Modules/gamepad/NavigatorGamepad.cpp',
             'Modules/gamepad/NavigatorGamepad.h',
+            'Modules/geolocation/Geolocation.cpp',
+            'Modules/geolocation/GeolocationController.cpp',
+            'Modules/geolocation/NavigatorGeolocation.cpp',
+            'Modules/geolocation/NavigatorGeolocation.h',
             'Modules/indexeddb/DOMWindowIndexedDatabase.cpp',
             'Modules/indexeddb/DOMWindowIndexedDatabase.h',
             'Modules/intents/Intent.cpp',
@@ -1557,7 +1570,6 @@
             'bindings/js/JSMessagePortCustom.h',
             'bindings/js/JSMutationCallbackCustom.cpp',
             'bindings/js/JSNamedNodeMapCustom.cpp',
-            'bindings/js/JSNavigatorCustom.cpp',
             'bindings/js/JSNodeCustom.cpp',
             'bindings/js/JSNodeFilterCondition.cpp',
             'bindings/js/JSNodeFilterCondition.h',
@@ -1815,6 +1827,7 @@
             'bindings/v8/custom/V8CustomXPathNSResolver.h',
             'bindings/v8/custom/V8DOMFormDataCustom.cpp',
             'bindings/v8/custom/V8DOMStringMapCustom.cpp',
+            'bindings/v8/custom/V8DOMTokenListCustom.cpp',
             'bindings/v8/custom/V8DOMWindowCustom.cpp',
             'bindings/v8/custom/V8DataViewCustom.cpp',
             'bindings/v8/custom/V8DedicatedWorkerContextCustom.cpp',
@@ -1869,7 +1882,6 @@
             'bindings/v8/custom/V8NamedNodeMapCustom.cpp',
             'bindings/v8/custom/V8NamedNodesCollection.cpp',
             'bindings/v8/custom/V8NamedNodesCollection.h',
-            'bindings/v8/custom/V8NavigatorCustom.cpp',
             'bindings/v8/custom/V8NodeCustom.cpp',
             'bindings/v8/custom/V8NodeListCustom.cpp',
             'bindings/v8/custom/V8NotificationCenterCustom.cpp',
@@ -2060,8 +2072,6 @@
             'css/CSSWrapShapes.cpp',
             'css/Counter.h',
             'css/DashboardRegion.h',
-            'css/FontFamilyValue.cpp',
-            'css/FontFamilyValue.h',
             'css/FontFeatureValue.cpp',
             'css/FontFeatureValue.h',
             'css/FontValue.cpp',
@@ -2082,6 +2092,8 @@
             'css/MediaQueryListListener.h',
             'css/MediaQueryMatcher.cpp',
             'css/MediaQueryMatcher.h',
+            'css/PropertySetCSSStyleDeclaration.cpp',
+            'css/PropertySetCSSStyleDeclaration.h',
             'css/RGBColor.cpp',
             'css/RGBColor.h',
             'css/Rect.h',
@@ -2227,6 +2239,8 @@
             'fileapi/DOMFileSystemBase.h',
             'fileapi/DOMFileSystemSync.cpp',
             'fileapi/DOMFileSystemSync.h',
+            'fileapi/DOMWindowFileSystem.cpp',
+            'fileapi/DOMWindowFileSystem.h',
             'fileapi/DirectoryEntry.cpp',
             'fileapi/DirectoryEntry.h',
             'fileapi/DirectoryEntrySync.cpp',
@@ -2343,6 +2357,8 @@
             'inspector/DOMEditor.h',
             'inspector/DOMNodeHighlighter.cpp',
             'inspector/DOMNodeHighlighter.h',
+            'inspector/DOMPatchSupport.cpp',
+            'inspector/DOMPatchSupport.h',
             'inspector/DOMWrapperVisitor.h',
             'inspector/IdentifiersFactory.cpp',
             'inspector/IdentifiersFactory.h',
@@ -2363,6 +2379,8 @@
             'inspector/InspectorConsoleAgent.h',
             'inspector/InspectorConsoleInstrumentation.h',
             'inspector/InspectorController.cpp',
+            'inspector/InspectorCounters.cpp',
+            'inspector/InspectorCounters.h',
             'inspector/InspectorDOMAgent.cpp',
             'inspector/InspectorDOMDebuggerAgent.cpp',
             'inspector/InspectorDOMDebuggerAgent.h',
@@ -2527,6 +2545,8 @@
             'loader/cache/CachedScript.h',
             'loader/cache/CachedShader.cpp',
             'loader/cache/CachedShader.h',
+            'loader/cache/CachedSVGDocument.cpp',
+            'loader/cache/CachedSVGDocument.h',
             'loader/cache/CachedTextTrack.cpp',
             'loader/cache/CachedTextTrack.h',
             'loader/cache/CachedXSLStyleSheet.cpp',
@@ -2574,6 +2594,8 @@
             'mediastream/MediaStreamTrack.h',
             'mediastream/MediaStreamTrackList.cpp',
             'mediastream/MediaStreamTrackList.h',
+            'mediastream/NavigatorMediaStream.cpp',
+            'mediastream/NavigatorMediaStream.h',
             'mediastream/NavigatorUserMediaError.h',
             'mediastream/NavigatorUserMediaErrorCallback.h',
             'mediastream/NavigatorUserMediaSuccessCallback.h',
@@ -2581,6 +2603,8 @@
             'mediastream/PeerConnection.h',
             'mediastream/SignalingCallback.h',
             'mediastream/UserMediaClient.h',
+            'mediastream/UserMediaController.h',
+            'mediastream/UserMediaController.cpp',
             'mediastream/UserMediaRequest.cpp',
             'mediastream/UserMediaRequest.h',
             'notifications/Notification.cpp',
@@ -2618,8 +2642,6 @@
             'page/FrameDestructionObserver.h',
             'page/FrameTree.cpp',
             'page/FrameView.cpp',
-            'page/Geolocation.cpp',
-            'page/GeolocationController.cpp',
             'page/GroupSettings.cpp',
             'page/History.cpp',
             'page/History.h',
@@ -2632,6 +2654,10 @@
             'page/Navigator.h',
             'page/NavigatorBase.cpp',
             'page/NavigatorBase.h',
+            'page/NavigatorRegisterProtocolHandler.cpp',
+            'page/NavigatorRegisterProtocolHandler.h',
+            'page/NavigatorSupplement.cpp',
+            'page/NavigatorSupplement.h',
             'page/OriginAccessEntry.cpp',
             'page/OriginAccessEntry.h',
             'page/Page.cpp',
@@ -2639,6 +2665,7 @@
             'page/PageGroupLoadDeferrer.cpp',
             'page/PageGroupLoadDeferrer.h',
             'page/PageSerializer.cpp',
+            'page/PageSupplement.cpp',
             'page/PageVisibilityState.cpp',
             'page/Performance.cpp',
             'page/Performance.h',
@@ -2702,6 +2729,13 @@
             'page/mac/PageMac.cpp',
             'page/qt/DragControllerQt.cpp',
             'page/qt/EventHandlerQt.cpp',
+            'page/scrolling/ScrollingCoordinator.cpp',
+            'page/scrolling/ScrollingCoordinator.h',
+            'page/scrolling/ScrollingThread.cpp',
+            'page/scrolling/ScrollingThread.h',
+            'page/scrolling/ScrollingTreeNode.cpp',
+            'page/scrolling/ScrollingTreeNode.h',
+            'page/scrolling/chromium/ScrollingCoordinatorChromium.cpp',
             'page/win/DragControllerWin.cpp',
             'page/win/EventHandlerWin.cpp',
             'page/win/FrameCGWin.cpp',
@@ -2729,7 +2763,6 @@
             'platform/CrossThreadCopier.h',
             'platform/Cursor.cpp',
             'platform/DateComponents.cpp',
-            'platform/DefaultLocalizationStrategy.cpp',
             'platform/DragData.cpp',
             'platform/DragImage.cpp',
             'platform/EventLoop.h',
@@ -2753,7 +2786,6 @@
             'platform/Language.cpp',
             'platform/Length.cpp',
             'platform/LinkHash.cpp',
-            'platform/LocalizedStrings.cpp',
             'platform/Logging.cpp',
             'platform/MemoryPressureHandler.cpp',
             'platform/MIMETypeRegistry.cpp',
@@ -3001,6 +3033,7 @@
             'platform/graphics/CrossfadeGeneratedImage.cpp',
             'platform/graphics/CrossfadeGeneratedImage.h',
             'platform/graphics/Extensions3D.h',
+            'platform/graphics/FractionalLayoutSize.cpp',
             'platform/graphics/FloatPoint.cpp',
             'platform/graphics/FloatPoint3D.cpp',
             'platform/graphics/FloatQuad.cpp',
@@ -3222,6 +3255,7 @@
             'platform/graphics/chromium/cc/CCActiveAnimation.h',
             'platform/graphics/chromium/cc/CCAnimationCurve.cpp',
             'platform/graphics/chromium/cc/CCAnimationCurve.h',
+            'platform/graphics/chromium/cc/CCAnimationResults.h',
             'platform/graphics/chromium/cc/CCCanvasDrawQuad.cpp',
             'platform/graphics/chromium/cc/CCCanvasDrawQuad.h',
             'platform/graphics/chromium/cc/CCCanvasLayerImpl.cpp',
@@ -3239,13 +3273,16 @@
             'platform/graphics/chromium/cc/CCHeadsUpDisplay.cpp',
             'platform/graphics/chromium/cc/CCHeadsUpDisplay.h',
             'platform/graphics/chromium/cc/CCInputHandler.h',
+            'platform/graphics/chromium/cc/CCKeyframedAnimationCurve.cpp',
+            'platform/graphics/chromium/cc/CCKeyframedAnimationCurve.h',
+            'platform/graphics/chromium/cc/CCLayerAnimationController.h',
+            'platform/graphics/chromium/cc/CCLayerAnimationController.cpp',
             'platform/graphics/chromium/cc/CCLayerAnimationControllerImpl.h',
             'platform/graphics/chromium/cc/CCLayerAnimationControllerImpl.cpp',
             'platform/graphics/chromium/cc/CCLayerImpl.cpp',
             'platform/graphics/chromium/cc/CCLayerImpl.h',
             'platform/graphics/chromium/cc/CCLayerIterator.cpp',
             'platform/graphics/chromium/cc/CCLayerIterator.h',
-            'platform/graphics/chromium/cc/CCLayerIteratorPosition.h',
             'platform/graphics/chromium/cc/CCLayerQuad.cpp',
             'platform/graphics/chromium/cc/CCLayerQuad.h',
             'platform/graphics/chromium/cc/CCLayerSorter.cpp',
@@ -3258,6 +3295,8 @@
             'platform/graphics/chromium/cc/CCLayerTreeHost.h',
             'platform/graphics/chromium/cc/CCLayerTreeHostImpl.cpp',
             'platform/graphics/chromium/cc/CCLayerTreeHostImpl.h',
+            'platform/graphics/chromium/cc/CCOcclusionTracker.cpp',
+            'platform/graphics/chromium/cc/CCOcclusionTracker.h',
             'platform/graphics/chromium/cc/CCPageScaleAnimation.cpp',
             'platform/graphics/chromium/cc/CCPageScaleAnimation.h',
             'platform/graphics/chromium/cc/CCPluginDrawQuad.cpp',
@@ -3274,6 +3313,8 @@
             'platform/graphics/chromium/cc/CCRenderSurface.h',
             'platform/graphics/chromium/cc/CCRenderSurfaceDrawQuad.cpp',
             'platform/graphics/chromium/cc/CCRenderSurfaceDrawQuad.h',
+            'platform/graphics/chromium/cc/CCRenderSurfaceFilters.cpp',
+            'platform/graphics/chromium/cc/CCRenderSurfaceFilters.h',
             'platform/graphics/chromium/cc/CCScheduler.cpp',
             'platform/graphics/chromium/cc/CCScheduler.h',
             'platform/graphics/chromium/cc/CCSchedulerStateMachine.cpp',
@@ -3436,6 +3477,8 @@
             'platform/graphics/harfbuzz/FontPlatformDataHarfBuzz.h',
             'platform/graphics/harfbuzz/HarfBuzzSkia.cpp',
             'platform/graphics/harfbuzz/HarfBuzzSkia.h',
+            'platform/graphics/harfbuzz/HarfBuzzShaperBase.cpp',
+            'platform/graphics/harfbuzz/HarfBuzzShaperBase.h',
             'platform/graphics/mac/ColorMac.mm',
             'platform/graphics/mac/ComplexTextController.cpp',
             'platform/graphics/mac/ComplexTextController.h',
@@ -3472,8 +3515,6 @@
             'platform/graphics/opengl/Extensions3DOpenGL.h',
             'platform/graphics/opengl/GraphicsContext3DOpenGL.cpp',
             'platform/graphics/opengl/GraphicsContext3DOpenGLCommon.cpp',
-            'platform/graphics/opengl/TextureMapperGL.cpp',
-            'platform/graphics/opengl/TextureMapperGL.h',
             'platform/graphics/opentype/OpenTypeSanitizer.cpp',
             'platform/graphics/opentype/OpenTypeSanitizer.h',
             'platform/graphics/opentype/OpenTypeUtilities.cpp',
@@ -3576,11 +3617,17 @@
             'platform/graphics/texmap/TextureMapper.h',
             'platform/graphics/texmap/TextureMapperAnimation.cpp',
             'platform/graphics/texmap/TextureMapperAnimation.h',
+            'platform/graphics/texmap/TextureMapperBackingStore.cpp',
+            'platform/graphics/texmap/TextureMapperBackingStore.h',
+            'platform/graphics/texmap/TextureMapperGL.cpp',
+            'platform/graphics/texmap/TextureMapperGL.h',
             'platform/graphics/texmap/TextureMapperImageBuffer.cpp',
             'platform/graphics/texmap/TextureMapperImageBuffer.h',
-            'platform/graphics/texmap/TextureMapperNode.cpp',
-            'platform/graphics/texmap/TextureMapperNode.h',
+            'platform/graphics/texmap/TextureMapperLayer.cpp',
+            'platform/graphics/texmap/TextureMapperLayer.h',
             'platform/graphics/texmap/TextureMapperPlatformLayer.h',
+            'platform/graphics/texmap/TextureMapperShaderManager.cpp',
+            'platform/graphics/texmap/TextureMapperShaderManager.h',
             'platform/graphics/transforms/AffineTransform.cpp',
             'platform/graphics/transforms/IdentityTransformOperation.h',
             'platform/graphics/transforms/Matrix3DTransformOperation.cpp',
@@ -4630,6 +4677,7 @@
             'storage/IDBPendingTransactionMonitor.h',
             'storage/IDBRequest.cpp',
             'storage/IDBRequest.h',
+            'storage/IDBTracing.h',
             'storage/IDBTransaction.cpp',
             'storage/IDBTransaction.h',
             'storage/IDBTransactionBackendImpl.cpp',
@@ -4642,10 +4690,10 @@
             'storage/IDBVersionChangeEvent.h',
             'storage/IDBVersionChangeRequest.cpp',
             'storage/IDBVersionChangeRequest.h',
-            'storage/LocalStorageTask.cpp',
-            'storage/LocalStorageTask.h',
-            'storage/LocalStorageThread.cpp',
-            'storage/LocalStorageThread.h',
+            'storage/StorageTask.cpp',
+            'storage/StorageTask.h',
+            'storage/StorageThread.cpp',
+            'storage/StorageThread.h',
             'storage/OriginQuotaManager.cpp',
             'storage/OriginQuotaManager.h',
             'storage/OriginUsageRecord.cpp',
@@ -4700,8 +4748,8 @@
             'storage/chromium/SQLTransactionClientChromium.cpp',
             'storage/wince/DatabaseThreadWinCE.cpp',
             'storage/wince/DatabaseThreadWinCE.h',
-            'storage/wince/LocalStorageThreadWinCE.cpp',
-            'storage/wince/LocalStorageThreadWinCE.h',
+            'storage/wince/StorageThreadWinCE.cpp',
+            'storage/wince/StorageThreadWinCE.h',
             'webaudio/AudioBasicProcessorNode.cpp',
             'webaudio/AudioBasicProcessorNode.h',
             'webaudio/AudioBuffer.cpp',
@@ -4789,6 +4837,12 @@
             'websockets/WebSocketChannel.cpp',
             'websockets/WebSocketChannel.h',
             'websockets/WebSocketChannelClient.h',
+            'websockets/WebSocketDeflater.cpp',
+            'websockets/WebSocketDeflater.h',
+            'websockets/WebSocketExtensionDispatcher.cpp',
+            'websockets/WebSocketExtensionDispatcher.h',
+            'websockets/WebSocketExtensionProcessor.h',
+            'websockets/WebSocketFrame.h',
             'websockets/WebSocketHandshake.cpp',
             'websockets/WebSocketHandshake.h',
             'websockets/WebSocketHandshakeRequest.cpp',
@@ -5008,6 +5062,7 @@
             'dom/EventListenerMap.cpp',
             'dom/EventNames.cpp',
             'dom/EventQueue.h',
+            'dom/EventSender.h',
             'dom/EventTarget.cpp',
             'dom/ExceptionBase.cpp',
             'dom/ExceptionBase.h',
@@ -5092,6 +5147,8 @@
             'dom/SelectorQuery.h',
             'dom/ShadowRoot.cpp',
             'dom/ShadowRoot.h',
+            'dom/ShadowRootList.cpp',
+            'dom/ShadowRootList.h',
             'dom/SpaceSplitString.cpp',
             'dom/StaticHashSetNodeList.cpp',
             'dom/StaticHashSetNodeList.h',
@@ -5354,8 +5411,6 @@
             'html/LabelsNodeList.h',
             'html/LinkRelAttribute.cpp',
             'html/LinkRelAttribute.h',
-            'html/LoadableTextTrack.cpp',
-            'html/LoadableTextTrack.h',
             'html/MediaController.cpp',
             'html/MediaController.h',
             'html/MediaDocument.cpp',
@@ -5395,12 +5450,6 @@
             'html/TextInputType.cpp',
             'html/TextInputType.h',
             'html/TextMetrics.h',
-            'html/TextTrack.cpp',
-            'html/TextTrack.h',
-            'html/TextTrackCue.cpp',
-            'html/TextTrackCue.h',
-            'html/TextTrackCueList.cpp',
-            'html/TextTrackCueList.h',
             'html/TimeInputType.cpp',
             'html/TimeInputType.h',
             'html/TimeRanges.cpp',
@@ -5523,14 +5572,16 @@
             'html/parser/XSSAuditor.h',
             'html/shadow/ContentSelectorQuery.cpp',
             'html/shadow/ContentSelectorQuery.h',
-            'html/shadow/ContentInclusionSelector.cpp',
-            'html/shadow/ContentInclusionSelector.h',
             'html/shadow/DetailsMarkerControl.cpp',
             'html/shadow/DetailsMarkerControl.h',
             'html/shadow/HTMLContentElement.cpp',
             'html/shadow/HTMLContentElement.h',
+            'html/shadow/HTMLContentSelector.cpp',
+            'html/shadow/HTMLContentSelector.h',
             'html/shadow/HTMLShadowElement.cpp',
             'html/shadow/HTMLShadowElement.h',
+            'html/shadow/InsertionPoint.cpp',
+            'html/shadow/InsertionPoint.h',
             'html/shadow/MediaControls.cpp',
             'html/shadow/MediaControls.h',
             'html/shadow/MediaControlElements.cpp',
@@ -5545,6 +5596,14 @@
             'html/shadow/SliderThumbElement.h',
             'html/shadow/TextControlInnerElements.cpp',
             'html/shadow/TextControlInnerElements.h',
+            'html/track/LoadableTextTrack.cpp',
+            'html/track/LoadableTextTrack.h',
+            'html/track/TextTrack.cpp',
+            'html/track/TextTrack.h',
+            'html/track/TextTrackCue.cpp',
+            'html/track/TextTrackCue.h',
+            'html/track/TextTrackCueList.cpp',
+            'html/track/TextTrackCueList.h',
             'html/track/TextTrackList.cpp',
             'html/track/TrackBase.cpp',
             'html/track/TrackEvent.cpp',
@@ -6111,6 +6170,7 @@
             'inspector/front-end/HelpScreen.js',
             'inspector/front-end/ImageView.js',
             'inspector/front-end/IndexedDBModel.js',
+            'inspector/front-end/IndexedDBViews.js',
             'inspector/front-end/InspectorBackend.js',
             'inspector/front-end/InspectorFrontendAPI.js',
             'inspector/front-end/InspectorFrontendHostStub.js',
@@ -6168,6 +6228,7 @@
             'inspector/front-end/ShowMoreDataGridNode.js',
             'inspector/front-end/Section.js',
             'inspector/front-end/Settings.js',
+            'inspector/front-end/SidebarOverlay.js',
             'inspector/front-end/SidebarPane.js',
             'inspector/front-end/SidebarTreeElement.js',
             'inspector/front-end/SoftContextMenu.js',
@@ -6176,6 +6237,7 @@
             'inspector/front-end/SourceHTMLTokenizer.js',
             'inspector/front-end/SourceJavaScriptTokenizer.js',
             'inspector/front-end/SourceTokenizer.js',
+            'inspector/front-end/Spectrum.js',
             'inspector/front-end/SplitView.js',
             'inspector/front-end/StatusBarButton.js',
             'inspector/front-end/StylesSidebarPane.js',
@@ -6215,6 +6277,7 @@
             'inspector/front-end/elementsPanel.css',
             'inspector/front-end/filteredItemSelectionDialog.css',
             'inspector/front-end/heapProfiler.css',
+            'inspector/front-end/indexedDBViews.css',
             'inspector/front-end/inspectorCommon.css',
             'inspector/front-end/networkLogView.css',
             'inspector/front-end/networkPanel.css',
@@ -6272,7 +6335,12 @@
             'inspector/front-end/Images/goArrow.png',
             'inspector/front-end/Images/graphLabelCalloutLeft.png',
             'inspector/front-end/Images/graphLabelCalloutRight.png',
+            'inspector/front-end/Images/indexedDB.png',
+            'inspector/front-end/Images/indexedDBObjectStore.png',
+            'inspector/front-end/Images/indexedDBIndex.png',
             'inspector/front-end/Images/localStorage.png',
+            'inspector/front-end/Images/navigatorShowHideButton.png',
+            'inspector/front-end/Images/navigatorPinButton.png',
             'inspector/front-end/Images/paneAddButtons.png',
             'inspector/front-end/Images/paneBottomGrow.png',
             'inspector/front-end/Images/paneBottomGrowActive.png',
diff --git a/Source/WebCore/WebCore.order b/Source/WebCore/WebCore.order
index 99ac4d2d9..952c2992b 100644
--- a/Source/WebCore/WebCore.order
+++ b/Source/WebCore/WebCore.order
@@ -445,23 +445,23 @@ __ZN7WebCore16SQLiteFileSystem24ensureDatabaseFileExistsERKN3WTF6StringEb
 __ZN7WebCore15DatabaseTracker7trackerEv
 __ZN7WebCore15DatabaseTracker9setClientEPNS_21DatabaseTrackerClientE
 __ZN7WebCore14StorageTracker17initializeTrackerERKN3WTF6StringE
-__ZN7WebCore18LocalStorageThread6createEv
+__ZN7WebCore13StorageThread6createEv
 __ZN7WebCore14StorageTracker23setStorageDirectoryPathERKN3WTF6StringE
-__ZN7WebCore18LocalStorageThread5startEv
+__ZN7WebCore13StorageThread5startEv
 __ZN7WebCore14StorageTracker23importOriginIdentifiersEv
-__ZN7WebCore16LocalStorageTaskC1ENS0_4TypeE
-__ZN7WebCore18LocalStorageThread12scheduleTaskEN3WTF10PassOwnPtrINS_16LocalStorageTaskEEE
-__ZN3WTF5DequeIPN7WebCore16LocalStorageTaskELm0EE14expandCapacityEv
+__ZN7WebCore11StorageTaskC1ENS0_4TypeE
+__ZN7WebCore13StorageThread12scheduleTaskEN3WTF10PassOwnPtrINS_11StorageTaskEEE
+__ZN3WTF5DequeIPN7WebCore11StorageTaskELm0EE14expandCapacityEv
 __ZN7WebCore14StorageTracker7trackerEv
 __ZN7WebCore14StorageTracker9setClientEPNS_20StorageTrackerClientE
 __ZN7WebCore12cacheStorageEv
-__ZN7WebCore18LocalStorageThread24threadEntryPointCallbackEPv
+__ZN7WebCore13StorageThread24threadEntryPointCallbackEPv
 __ZN7WebCore23ApplicationCacheStorage17setCacheDirectoryERKN3WTF6StringE
-__ZN7WebCore18LocalStorageThread16threadEntryPointEv
-__ZN3WTF12MessageQueueIN7WebCore16LocalStorageTaskEE14waitForMessageEv
-__ZN3WTF12MessageQueueIN7WebCore16LocalStorageTaskEE19alwaysTruePredicateEPS2_
+__ZN7WebCore13StorageThread16threadEntryPointEv
+__ZN3WTF12MessageQueueIN7WebCore11StorageTaskEE14waitForMessageEv
+__ZN3WTF12MessageQueueIN7WebCore11StorageTaskEE19alwaysTruePredicateEPS2_
 __ZN7WebCore21setPlatformStrategiesEPNS_18PlatformStrategiesE
-__ZN7WebCore16LocalStorageTask11performTaskEv
+__ZN7WebCore11StorageTask11performTaskEv
 __ZN7WebCore8Settings29setDefaultMinDOMTimerIntervalEd
 __ZN7WebCore14StorageTracker27syncImportOriginIdentifiersEv
 __ZN7WebCore4Page11PageClientsC1Ev
@@ -471,7 +471,7 @@ __ZN7WebCore13listDirectoryERKN3WTF6StringES3_
 __ZN7WebCore4PageC1ERNS0_11PageClientsE
 __ZN3WTF6VectorINS_6StringELm0EEaSERKS2_
 __ZN7WebCore4PageC2ERNS0_11PageClientsE
-__ZN7WebCore16LocalStorageTaskD1Ev
+__ZN7WebCore11StorageTaskD1Ev
 __ZN7WebCore6ChromeC1EPNS_4PageEPNS_12ChromeClientE
 __ZN7WebCore19DragCaretControllerC1Ev
 __ZN7WebCore14DragControllerC1EPNS_4PageEPNS_10DragClientE
@@ -5329,9 +5329,6 @@ __ZNK7WebCore19AccessibilityObject15isMediaTimelineEv
 -[AccessibilityObjectWrapper roleDescription]
 __ZN7WebCore13AXHeadingTextEv
 __ZN7WebCore21hasPlatformStrategiesEv
-__ZN7WebCore18PlatformStrategies26createLocalizationStrategyEv
-__ZN7WebCore27DefaultLocalizationStrategyC1Ev
-__ZN7WebCore27DefaultLocalizationStrategy13AXHeadingTextEv
 __ZNK7WebCore25AccessibilityRenderObject4sizeEv
 __ZNK7WebCore25AccessibilityRenderObject11elementRectEv
 __ZNK7WebCore19AccessibilityObject13isRadioButtonEv
@@ -6680,7 +6677,6 @@ __ZNK7WebCore14DocumentLoader25isLoadingMultipartContentEv
 __ZNK7WebCore4KURL17lastPathComponentEv
 __ZN7WebCore24decodeURLEscapeSequencesERKN3WTF6StringE
 __ZN7WebCore10imageTitleERKN3WTF6StringERKNS_7IntSizeE
-__ZN7WebCore27DefaultLocalizationStrategy10imageTitleERKN3WTF6StringERKNS_7IntSizeE
 __ZN7WebCoreL21formatLocalizedStringEN3WTF6StringEz
 __ZN7WebCore8Document8setTitleERKN3WTF6StringE
 __ZN7WebCore8Document4headEv
@@ -6730,7 +6726,6 @@ __ZN7WebCore16JSHTMLPreElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobal
 __ZN7WebCore16JSHTMLPreElementC1EPN3JSC9StructureEPNS_17JSDOMGlobalObjectEN3WTF10PassRefPtrINS_14HTMLPreElementEEE
 __ZN7WebCore12cacheWrapperINS_14HTMLPreElementEEEvPNS_15DOMWrapperWorldEPT_PNS_12JSDOMWrapperE
 __ZN7WebCore13AXWebAreaTextEv
-__ZN7WebCore27DefaultLocalizationStrategy13AXWebAreaTextEv
 __ZN7WebCore10RenderView13absoluteQuadsERN3WTF6VectorINS_9FloatQuadELm0EEE
 __ZN7WebCore25AccessibilityRenderObject16getDocumentLinksERN3WTF6VectorINS1_6RefPtrINS_19AccessibilityObjectEEELm0EEE
 __ZN7WebCore8Document5linksEv
@@ -6740,7 +6735,6 @@ __ZNK7WebCore25AccessibilityRenderObject11layoutCountEv
 __ZNK7WebCore25AccessibilityRenderObject24estimatedLoadingProgressEv
 __ZNK7WebCore15ProgressTracker17estimatedProgressEv
 __ZN7WebCore10AXLinkTextEv
-__ZN7WebCore27DefaultLocalizationStrategy10AXLinkTextEv
 __ZN7WebCore12RenderInline25culledInlineAbsoluteRectsEPKS0_RN3WTF6VectorINS_7IntRectELm0EEERKNS_7IntSizeE
 __ZNK7WebCore25AccessibilityRenderObject19internalLinkElementEv
 __ZNK7WebCore17HTMLAnchorElement4hrefEv
@@ -6891,9 +6885,7 @@ __ZNK7WebCore13HTMLHRElement23canContainRangeEndPointEv
 __ZNK7WebCore17AccessibilityList13isOrderedListEv
 __ZNK7WebCore17AccessibilityList16isDefinitionListEv
 __ZN7WebCore24AXDefinitionListTermTextEv
-__ZN7WebCore27DefaultLocalizationStrategy24AXDefinitionListTermTextEv
 __ZN7WebCore30AXDefinitionListDefinitionTextEv
-__ZN7WebCore27DefaultLocalizationStrategy30AXDefinitionListDefinitionTextEv
 __ZN7WebCore19HTMLFieldSetElementD0Ev
 __ZN7WebCore17HTMLLegendElementD0Ev
 __ZN7WebCoreL16videoConstructorERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementEb
@@ -7182,7 +7174,6 @@ __ZThn120_N7WebCore16HTMLMediaElement30mediaPlayerNetworkStateChangedEPNS_11Medi
 __ZN7WebCore11MediaPlayer12networkStateEv
 __ZN7WebCore16HTMLMediaElement15setNetworkStateENS_11MediaPlayer12NetworkStateE
 __ZN7WebCore28mediaElementLoadingStateTextEv
-__ZN7WebCore27DefaultLocalizationStrategy28mediaElementLoadingStateTextEv
 __ZN7WebCore34MediaPlayerPrivateAVFoundationObjC19createAVAssetForURLERKN3WTF6StringE
 __ZN7WebCore30MediaPlayerPrivateAVFoundation17setDelayCallbacksEb
 __ZL38initAVURLAssetReferenceRestrictionsKeyv
@@ -7417,7 +7408,6 @@ __ZNK7WebCore35AccessibilityMediaControlsContainer9roleValueEv
 __ZNK7WebCore35AccessibilityMediaControlsContainer24accessibilityDescriptionEv
 __ZNK7WebCore35AccessibilityMediaControlsContainer15elementTypeNameEv
 __ZN7WebCore34localizedMediaControlElementStringERKN3WTF6StringE
-__ZN7WebCore27DefaultLocalizationStrategy34localizedMediaControlElementStringERKN3WTF6StringE
 __ZN7WebCore15DynamicNodeList15invalidateCacheEv
 __ZNK7WebCore24MediaControlInputElement21isMediaControlElementEv
 __ZNK7WebCore25AccessibilityMediaControl22accessibilityIsIgnoredEv
@@ -7554,14 +7544,12 @@ __ZN7WebCore23RenderFileUploadControl14styleDidChangeENS_15StyleDifferenceEPKNS_
 __ZN7WebCore23RenderFileUploadControl17updateFromElementEv
 __ZN7WebCore18ShadowInputElement6createEPNS_11HTMLElementE
 __ZN7WebCore25fileButtonChooseFileLabelEv
-__ZN7WebCore27DefaultLocalizationStrategy25fileButtonChooseFileLabelEv
 __ZN7WebCore9InputType12valueChangedEv
 __ZN7WebCore22HTMLFormControlElement11setDisabledEb
 __ZN7WebCore23RenderFileUploadControl29computePreferredLogicalWidthsEv
 __ZNK7WebCore13FileInputType12isFileUploadEv
 __ZN7WebCore23RenderFileUploadControl11paintObjectERNS_9PaintInfoEii
 __ZN7WebCore29fileButtonNoFileSelectedLabelEv
-__ZN7WebCore27DefaultLocalizationStrategy29fileButtonNoFileSelectedLabelEv
 __ZN7WebCore12RenderObject23absoluteBoundingBoxRectEb
 __ZN7WebCore11RenderBlock13absoluteRectsERN3WTF6VectorINS_7IntRectELm0EEEii
 __ZThn8_N7WebCore19HTMLTextAreaElementD0Ev
@@ -7817,10 +7805,7 @@ __ZN3WTF9HashTableINS_6StringESt4pairIS1_PKN7WebCore21EditorInternalCommandEENS_
 __ZN3WTF9HashTableINS_6StringESt4pairIS1_PKN7WebCore21EditorInternalCommandEENS_18PairFirstExtractorIS7_EENS_15CaseFoldingHashENS_14PairHashTraitsINS_10HashTraitsIS1_EENSC_IS6_EEEESD_E6lookupIS1_NS_22IdentityHashTranslatorIS1_S7_SA_EEEEPS7_RKT_
 __ZN3WTF9HashTableINS_6StringESt4pairIS1_PKN7WebCore21EditorInternalCommandEENS_18PairFirstExtractorIS7_EENS_15CaseFoldingHashENS_14PairHashTraitsINS_10HashTraitsIS1_EENSC_IS6_EEEESD_E6rehashEi
 __ZN7WebCore35contextMenuItemTagShowSubstitutionsEb
-__ZN7WebCore27DefaultLocalizationStrategy6sharedEv
-__ZN7WebCore27DefaultLocalizationStrategy35contextMenuItemTagShowSubstitutionsEb
 __ZN7WebCore35contextMenuItemTagShowSpellingPanelEb
-__ZN7WebCore27DefaultLocalizationStrategy35contextMenuItemTagShowSpellingPanelEb
 __ZN7WebCoreL22centerTruncateToBufferERKN3WTF6StringEjjPt
 __ZN7WebCore11isTextBreakEPNS_17TextBreakIteratorEi
 __ZN7WebCore15SQLiteStatement8bindNullEi
@@ -7917,12 +7902,8 @@ __ZNK7WebCore17CSSPrimitiveValue22getDoubleValueInternalENS0_9UnitTypesEPd
 __ZN7WebCore23HTMLTableCaptionElementD0Ev
 __ZN7WebCore13StyledElement11addCSSColorEPNS_9AttributeEiRKN3WTF6StringE
 __ZN7WebCore16HTMLStyleElement20parseMappedAttributeEPNS_9AttributeE
-__ZN7WebCore15FontFamilyValueC1ERKN3WTF6StringE
-__ZN7WebCore15FontFamilyValueC2ERKN3WTF6StringE
 __ZN7WebCore17CSSPrimitiveValueC2ERKN3WTF6StringENS0_9UnitTypesE
-__ZN7WebCore15FontFamilyValueD0Ev
 __ZN7WebCore17CSSPrimitiveValueD2Ev
-__ZNK7WebCore15FontFamilyValue17isFontFamilyValueEv
 __ZN7WebCore9CSSParser9parseFontEb
 __ZN7WebCore16SharedFontFamilyD1Ev
 __ZNK7WebCore8CSSValue12cssValueTypeEv
@@ -9563,7 +9544,6 @@ __ZN7WebCore12BidiResolverINS_15TextRunIteratorENS_16BidiCharacterRunEE27raiseEx
 __ZN3WTF14derefIfNotNullIN7WebCore11BidiContextEEEvPT_
 __ZN7WebCore24CanvasRenderingContext2D10strokeTextERKN3WTF6StringEff
 __ZN7WebCore9FontCache24getFontDataForCharactersERKNS_4FontEPKti
-__ZN7WebCore15FontFamilyValue20appendSpaceSeparatedEPKtj
 __ZN7WebCore17CSSInheritedValueD0Ev
 __ZN7WebCore9CSSParser15invalidBlockHitEv
 __ZN7WebCore13JSTextMetrics18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
@@ -11950,7 +11930,6 @@ __ZN7WebCore22jsHTMLCollectionLengthEPN3JSC9ExecStateENS0_7JSValueERKNS0_10Ident
 __ZNK7WebCore17HTMLObjectElement18containsJavaAppletEv
 __ZN7WebCore20RenderEmbeddedObject30setShowsMissingPluginIndicatorEv
 __ZN7WebCore17missingPluginTextEv
-__ZN7WebCore27DefaultLocalizationStrategy17missingPluginTextEv
 __ZN7WebCore20RenderEmbeddedObject13paintReplacedERNS_9PaintInfoEii
 __ZN7WebCore20RenderEmbeddedObject26getReplacementTextGeometryEiiRNS_9FloatRectERNS_4PathES2_RNS_4FontERNS_7TextRunERf
 __ZN7WebCore4Path14addRoundedRectERKNS_9FloatRectERKNS_9FloatSizeE
@@ -12370,7 +12349,6 @@ __ZN7WebCore9InputType19altAttributeChangedEv
 __ZN3WTF6String10makeSecureEt
 __ZN7WebCore9InputType27shouldRespectAlignAttributeEv
 __ZN7WebCore19inputElementAltTextEv
-__ZN7WebCore27DefaultLocalizationStrategy19inputElementAltTextEv
 __ZNK7WebCore17RenderTextControl36requiresForcedStyleRecalcPropagationEv
 __ZN7WebCore30jsHTMLInputElementDefaultValueEPN3JSC9ExecStateENS0_7JSValueERKNS0_10IdentifierE
 __ZN7WebCore32jsHTMLInputElementDefaultCheckedEPN3JSC9ExecStateENS0_7JSValueERKNS0_10IdentifierE
@@ -13845,7 +13823,6 @@ __ZN7WebCore11RenderStyle9setWidowsEs
 __ZN7WebCore11RenderStyle18setTextStrokeWidthEf
 __ZN7WebCore23ReplaceSelectionCommand16handleStyleSpansEv
 __ZN7WebCore12EditingStyleC1EPKNS_19CSSStyleDeclarationE
-__ZNK7WebCore15FontFamilyValue7cssTextEv
 __ZN7WebCore23ReplaceSelectionCommand19copyStyleToChildrenEPNS_4NodeEPKNS_26CSSMutableStyleDeclarationE
 __ZN7WebCore26CSSMutableStyleDeclarationaSERKS0_
 __ZN7WebCore20CompositeEditCommand16setNodeAttributeEN3WTF10PassRefPtrINS_7ElementEEERKNS_13QualifiedNameERKNS1_12AtomicStringE
@@ -15086,11 +15063,8 @@ __ZN7WebCore17HTMLKeygenElement6createERKNS_13QualifiedNameEPNS_8DocumentEPNS_15
 __ZN7WebCore17HTMLKeygenElementC2ERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementE
 __ZN7WebCore20getSupportedKeySizesERN3WTF6VectorINS0_6StringELm0EEE
 __ZN7WebCore18keygenMenuItem2048Ev
-__ZN7WebCore27DefaultLocalizationStrategy18keygenMenuItem2048Ev
 __ZN7WebCore18keygenMenuItem1024Ev
-__ZN7WebCore27DefaultLocalizationStrategy18keygenMenuItem1024Ev
 __ZN7WebCore17keygenMenuItem512Ev
-__ZN7WebCore27DefaultLocalizationStrategy17keygenMenuItem512Ev
 __ZN7WebCore17HTMLSelectElementC2ERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementE
 __ZN7WebCore17HTMLOptionElement6createEPNS_8DocumentEPNS_15HTMLFormElementE
 __ZN7WebCore13SelectElement13deselectItemsERNS_17SelectElementDataEPNS_7ElementES4_
@@ -15571,60 +15545,34 @@ __ZN7WebCore11ContextMenuC1Ev
 __ZN7WebCore11ContextMenuC2Ev
 __ZN7WebCore21ContextMenuController8populateEv
 __ZN7WebCore26contextMenuItemTagOpenLinkEv
-__ZN7WebCore27DefaultLocalizationStrategy26contextMenuItemTagOpenLinkEv
 __ZN7WebCore15ContextMenuItemC1ENS_19ContextMenuItemTypeENS_17ContextMenuActionERKN3WTF6StringEPNS_11ContextMenuE
 __ZN7WebCore15ContextMenuItemC2ENS_19ContextMenuItemTypeENS_17ContextMenuActionERKN3WTF6StringEPNS_11ContextMenuE
 __ZN7WebCoreL33createPlatformMenuItemDescriptionENS_19ContextMenuItemTypeENS_17ContextMenuActionERKN3WTF6StringEbb
 __ZN7WebCore37contextMenuItemTagOpenLinkInNewWindowEv
-__ZN7WebCore27DefaultLocalizationStrategy37contextMenuItemTagOpenLinkInNewWindowEv
 __ZN7WebCore36contextMenuItemTagDownloadLinkToDiskEv
-__ZN7WebCore27DefaultLocalizationStrategy36contextMenuItemTagDownloadLinkToDiskEv
 __ZN7WebCore37contextMenuItemTagCopyLinkToClipboardEv
-__ZN7WebCore27DefaultLocalizationStrategy37contextMenuItemTagCopyLinkToClipboardEv
 __ZN7WebCore38contextMenuItemTagOpenImageInNewWindowEv
-__ZN7WebCore27DefaultLocalizationStrategy38contextMenuItemTagOpenImageInNewWindowEv
 __ZN7WebCore37contextMenuItemTagDownloadImageToDiskEv
-__ZN7WebCore27DefaultLocalizationStrategy37contextMenuItemTagDownloadImageToDiskEv
 __ZN7WebCore38contextMenuItemTagCopyImageToClipboardEv
-__ZN7WebCore27DefaultLocalizationStrategy38contextMenuItemTagCopyImageToClipboardEv
 __ZN7WebCore27contextMenuItemTagMediaPlayEv
-__ZN7WebCore27DefaultLocalizationStrategy27contextMenuItemTagMediaPlayEv
 __ZN7WebCore27contextMenuItemTagMediaMuteEv
-__ZN7WebCore27DefaultLocalizationStrategy27contextMenuItemTagMediaMuteEv
 __ZN7WebCore37contextMenuItemTagToggleMediaControlsEv
-__ZN7WebCore27DefaultLocalizationStrategy37contextMenuItemTagToggleMediaControlsEv
 __ZN7WebCore33contextMenuItemTagToggleMediaLoopEv
-__ZN7WebCore27DefaultLocalizationStrategy33contextMenuItemTagToggleMediaLoopEv
 __ZN7WebCore38contextMenuItemTagEnterVideoFullscreenEv
-__ZN7WebCore27DefaultLocalizationStrategy38contextMenuItemTagEnterVideoFullscreenEv
 __ZN7WebCore35contextMenuItemTagSearchInSpotlightEv
-__ZN7WebCore27DefaultLocalizationStrategy35contextMenuItemTagSearchInSpotlightEv
 __ZN7WebCore27contextMenuItemTagSearchWebEv
-__ZN7WebCore27DefaultLocalizationStrategy27contextMenuItemTagSearchWebEv
 __ZN7WebCore22contextMenuItemTagCopyEv
-__ZN7WebCore27DefaultLocalizationStrategy22contextMenuItemTagCopyEv
 __ZN7WebCore24contextMenuItemTagGoBackEv
-__ZN7WebCore27DefaultLocalizationStrategy24contextMenuItemTagGoBackEv
 __ZN7WebCore27contextMenuItemTagGoForwardEv
-__ZN7WebCore27DefaultLocalizationStrategy27contextMenuItemTagGoForwardEv
 __ZN7WebCore22contextMenuItemTagStopEv
-__ZN7WebCore27DefaultLocalizationStrategy22contextMenuItemTagStopEv
 __ZN7WebCore24contextMenuItemTagReloadEv
-__ZN7WebCore27DefaultLocalizationStrategy24contextMenuItemTagReloadEv
 __ZN7WebCore38contextMenuItemTagOpenFrameInNewWindowEv
-__ZN7WebCore27DefaultLocalizationStrategy38contextMenuItemTagOpenFrameInNewWindowEv
 __ZN7WebCore32contextMenuItemTagNoGuessesFoundEv
-__ZN7WebCore27DefaultLocalizationStrategy32contextMenuItemTagNoGuessesFoundEv
 __ZN7WebCore32contextMenuItemTagIgnoreSpellingEv
-__ZN7WebCore27DefaultLocalizationStrategy32contextMenuItemTagIgnoreSpellingEv
 __ZN7WebCore31contextMenuItemTagLearnSpellingEv
-__ZN7WebCore27DefaultLocalizationStrategy31contextMenuItemTagLearnSpellingEv
 __ZN7WebCore31contextMenuItemTagIgnoreGrammarEv
-__ZN7WebCore27DefaultLocalizationStrategy31contextMenuItemTagIgnoreGrammarEv
 __ZN7WebCore21contextMenuItemTagCutEv
-__ZN7WebCore27DefaultLocalizationStrategy21contextMenuItemTagCutEv
 __ZN7WebCore23contextMenuItemTagPasteEv
-__ZN7WebCore27DefaultLocalizationStrategy23contextMenuItemTagPasteEv
 __ZNK7WebCore13HitTestResult17isContentEditableEv
 __ZNK7WebCore21ContextMenuController21checkOrEnableIfNeededERNS_15ContextMenuItemE
 __ZNK7WebCore15ContextMenuItem4typeEv
@@ -15638,7 +15586,6 @@ __ZNK7WebCore13HitTestResult12mediaElementEv
 __ZN7WebCore15ContextMenuItemD1Ev
 __ZN7WebCore21ContextMenuController21addInspectElementItemEv
 __ZN7WebCore32contextMenuItemTagInspectElementEv
-__ZN7WebCore27DefaultLocalizationStrategy32contextMenuItemTagInspectElementEv
 __ZNK7WebCore11ContextMenu19platformDescriptionEv
 __ZN7WebCore11ContextMenu22setPlatformDescriptionEP14NSMutableArray
 __ZN7WebCore8Document23activeChainNodeDetachedEPNS_4NodeE
@@ -16210,16 +16157,11 @@ __ZNK7WebCore18TextCheckingHelper40guessesForMisspelledOrUngrammaticalRangeEbRbS
 __ZNK7WebCore13HitTestResult14replacedStringEv
 __ZN7WebCoreL29selectionContainsPossibleWordEPNS_5FrameE
 __ZN7WebCore30contextMenuItemTagSpellingMenuEv
-__ZN7WebCore27DefaultLocalizationStrategy30contextMenuItemTagSpellingMenuEv
 __ZN7WebCore21ContextMenuController40createAndAppendSpellingAndGrammarSubMenuERNS_15ContextMenuItemE
 __ZN7WebCore31contextMenuItemTagCheckSpellingEv
-__ZN7WebCore27DefaultLocalizationStrategy31contextMenuItemTagCheckSpellingEv
 __ZN7WebCore42contextMenuItemTagCheckSpellingWhileTypingEv
-__ZN7WebCore27DefaultLocalizationStrategy42contextMenuItemTagCheckSpellingWhileTypingEv
 __ZN7WebCore42contextMenuItemTagCheckGrammarWithSpellingEv
-__ZN7WebCore27DefaultLocalizationStrategy42contextMenuItemTagCheckGrammarWithSpellingEv
 __ZN7WebCore46contextMenuItemTagCorrectSpellingAutomaticallyEv
-__ZN7WebCore27DefaultLocalizationStrategy46contextMenuItemTagCorrectSpellingAutomaticallyEv
 __ZN7WebCore6Editor22spellingPanelIsShowingEv
 __ZN7WebCore15ContextMenuItem8setTitleERKN3WTF6StringE
 __ZN7WebCore6Editor24isGrammarCheckingEnabledEv
@@ -16227,66 +16169,41 @@ __ZN7WebCore6Editor36isAutomaticSpellingCorrectionEnabledEv
 __ZN7WebCore15ContextMenuItem10setSubMenuEPNS_11ContextMenuE
 __ZN7WebCore11ContextMenuD1Ev
 __ZN7WebCore35contextMenuItemTagSubstitutionsMenuEv
-__ZN7WebCore27DefaultLocalizationStrategy35contextMenuItemTagSubstitutionsMenuEv
 __ZN7WebCore21ContextMenuController35createAndAppendSubstitutionsSubMenuERNS_15ContextMenuItemE
 __ZN7WebCore32contextMenuItemTagSmartCopyPasteEv
-__ZN7WebCore27DefaultLocalizationStrategy32contextMenuItemTagSmartCopyPasteEv
 __ZN7WebCore29contextMenuItemTagSmartQuotesEv
-__ZN7WebCore27DefaultLocalizationStrategy29contextMenuItemTagSmartQuotesEv
 __ZN7WebCore29contextMenuItemTagSmartDashesEv
-__ZN7WebCore27DefaultLocalizationStrategy29contextMenuItemTagSmartDashesEv
 __ZN7WebCore28contextMenuItemTagSmartLinksEv
-__ZN7WebCore27DefaultLocalizationStrategy28contextMenuItemTagSmartLinksEv
 __ZN7WebCore33contextMenuItemTagTextReplacementEv
-__ZN7WebCore27DefaultLocalizationStrategy33contextMenuItemTagTextReplacementEv
 __ZN7WebCore6Editor27substitutionsPanelIsShowingEv
 __ZN7WebCore6Editor35isAutomaticQuoteSubstitutionEnabledEv
 __ZN7WebCore6Editor34isAutomaticDashSubstitutionEnabledEv
 __ZN7WebCore6Editor31isAutomaticLinkDetectionEnabledEv
 __ZN7WebCore6Editor33isAutomaticTextReplacementEnabledEv
 __ZN7WebCore37contextMenuItemTagTransformationsMenuEv
-__ZN7WebCore27DefaultLocalizationStrategy37contextMenuItemTagTransformationsMenuEv
 __ZN7WebCore21ContextMenuController37createAndAppendTransformationsSubMenuERNS_15ContextMenuItemE
 __ZN7WebCore31contextMenuItemTagMakeUpperCaseEv
-__ZN7WebCore27DefaultLocalizationStrategy31contextMenuItemTagMakeUpperCaseEv
 __ZN7WebCore31contextMenuItemTagMakeLowerCaseEv
-__ZN7WebCore27DefaultLocalizationStrategy31contextMenuItemTagMakeLowerCaseEv
 __ZN7WebCore28contextMenuItemTagCapitalizeEv
-__ZN7WebCore27DefaultLocalizationStrategy28contextMenuItemTagCapitalizeEv
 __ZN7WebCore26contextMenuItemTagFontMenuEv
-__ZN7WebCore27DefaultLocalizationStrategy26contextMenuItemTagFontMenuEv
 __ZN7WebCore21ContextMenuController26createAndAppendFontSubMenuERNS_15ContextMenuItemE
 __ZN7WebCore27contextMenuItemTagShowFontsEv
-__ZN7WebCore27DefaultLocalizationStrategy27contextMenuItemTagShowFontsEv
 __ZN7WebCore22contextMenuItemTagBoldEv
-__ZN7WebCore27DefaultLocalizationStrategy22contextMenuItemTagBoldEv
 __ZN7WebCore24contextMenuItemTagItalicEv
-__ZN7WebCore27DefaultLocalizationStrategy24contextMenuItemTagItalicEv
 __ZN7WebCore27contextMenuItemTagUnderlineEv
-__ZN7WebCore27DefaultLocalizationStrategy27contextMenuItemTagUnderlineEv
 __ZN7WebCore25contextMenuItemTagOutlineEv
-__ZN7WebCore27DefaultLocalizationStrategy25contextMenuItemTagOutlineEv
 __ZN7WebCore24contextMenuItemTagStylesEv
-__ZN7WebCore27DefaultLocalizationStrategy24contextMenuItemTagStylesEv
 __ZN7WebCore28contextMenuItemTagShowColorsEv
-__ZN7WebCore27DefaultLocalizationStrategy28contextMenuItemTagShowColorsEv
 __ZN7WebCore28contextMenuItemTagSpeechMenuEv
-__ZN7WebCore27DefaultLocalizationStrategy28contextMenuItemTagSpeechMenuEv
 __ZN7WebCore21ContextMenuController28createAndAppendSpeechSubMenuERNS_15ContextMenuItemE
 __ZN7WebCore31contextMenuItemTagStartSpeakingEv
-__ZN7WebCore27DefaultLocalizationStrategy31contextMenuItemTagStartSpeakingEv
 __ZN7WebCore30contextMenuItemTagStopSpeakingEv
 __ZN7WebCore30overrideUserPreferredLanguagesERKN3WTF6VectorINS0_6StringELm0EEE
-__ZN7WebCore27DefaultLocalizationStrategy30contextMenuItemTagStopSpeakingEv
 __ZN7WebCore38contextMenuItemTagWritingDirectionMenuEv
-__ZN7WebCore27DefaultLocalizationStrategy38contextMenuItemTagWritingDirectionMenuEv
 __ZN7WebCore21ContextMenuController38createAndAppendWritingDirectionSubMenuERNS_15ContextMenuItemE
 __ZN7WebCore34contextMenuItemTagDefaultDirectionEv
-__ZN7WebCore27DefaultLocalizationStrategy34contextMenuItemTagDefaultDirectionEv
 __ZN7WebCore29contextMenuItemTagLeftToRightEv
-__ZN7WebCore27DefaultLocalizationStrategy29contextMenuItemTagLeftToRightEv
 __ZN7WebCore29contextMenuItemTagRightToLeftEv
-__ZN7WebCore27DefaultLocalizationStrategy29contextMenuItemTagRightToLeftEv
 __ZNK7WebCore6Editor16hasBidiSelectionEv
 __ZNK7WebCore13KeyboardEvent8charCodeEv
 __ZN7WebCore18jsDOMSelectionTypeEPN3JSC9ExecStateENS0_7JSValueERKNS0_10IdentifierE
@@ -16295,7 +16212,6 @@ __ZNK7WebCore11RenderBlock24containsNonZeroBidiLevelEv
 __ZNK7WebCore19ApplyPropertyLengthILNS_10LengthAutoE1ELNS_15LengthIntrinsicE1ELNS_18LengthMinIntrinsicE1ELNS_10LengthNoneE1ELNS_15LengthUndefinedE1EE10applyValueEPNS_16CSSStyleSelectorEPNS_8CSSValueE
 __ZN7WebCore11RenderStyle11setMaxWidthENS_6LengthE
 __ZN7WebCore36contextMenuItemTagLookUpInDictionaryERKN3WTF6StringE
-__ZN7WebCore27DefaultLocalizationStrategy36contextMenuItemTagLookUpInDictionaryERKN3WTF6StringE
 __ZNK7WebCore19InspectorController26hasInspectorFrontendClientEv
 __ZNK7WebCore21BackForwardController18canGoBackOrForwardEi
 __ZNK7WebCore4Page18canGoBackOrForwardEi
@@ -17063,7 +16979,6 @@ __ZN7WebCore14SVGSMILElement20disconnectConditionsEv
 __ZN7WebCore17SMILTimeContainer10unscheduleEPNS_14SVGSMILElementE
 __ZNK7WebCore17RenderDeprecatedFlexibleBox10renderNameEv
 __ZN7WebCore27searchableIndexIntroductionEv
-__ZN7WebCore27DefaultLocalizationStrategy27searchableIndexIntroductionEv
 __ZN7WebCore14RenderRubyTextC1EPNS_4NodeE
 __ZNK7WebCore13RenderRubyRun11hasRubyTextEv
 __ZNK7WebCore14RenderRubyText10isRubyTextEv
@@ -18969,7 +18884,6 @@ __ZN7WebCore8Location7setHrefERKN3WTF6StringEPNS_9DOMWindowES6_
 __ZN7WebCore17StylePendingImage12removeClientEPNS_12RenderObjectE
 __ZN7WebCore15SubmitInputType12defaultValueEv
 __ZN7WebCore24submitButtonDefaultLabelEv
-__ZN7WebCore27DefaultLocalizationStrategy24submitButtonDefaultLabelEv
 __ZNK7WebCore11RenderTable20firstLineBoxBaselineEv
 __ZNK7WebCore18RenderTableSection20firstLineBoxBaselineEv
 __ZNK7WebCore15RenderWordBreak10renderNameEv
@@ -19455,7 +19369,6 @@ __ZN7WebCoreL22TopGradientInterpolateEPvPKdPd
 __ZN7WebCoreL25BottomGradientInterpolateEPvPKdPd
 __ZN7WebCore14ResetInputType12defaultValueEv
 __ZN7WebCore23resetButtonDefaultLabelEv
-__ZN7WebCore27DefaultLocalizationStrategy23resetButtonDefaultLabelEv
 __ZN7WebCore12URLInputType6createEPNS_16HTMLInputElementE
 __ZNK7WebCore12URLInputType15formControlTypeEv
 __ZN7WebCore14InputTypeNames3urlEv
@@ -20071,7 +19984,7 @@ __ZNK7WebCore14SecurityOrigin18databaseIdentifierEv
 __ZN7WebCore17encodeForFileNameERKN3WTF6StringE
 __ZN7WebCore15StorageAreaSync6createEN3WTF10PassRefPtrINS_18StorageSyncManagerEEENS2_INS_15StorageAreaImplEEERKNS1_6StringE
 __ZN7WebCore18StorageSyncManager14scheduleImportEN3WTF10PassRefPtrINS_15StorageAreaSyncEEE
-__ZN7WebCore16LocalStorageTaskC1ENS0_4TypeEPNS_15StorageAreaSyncE
+__ZN7WebCore11StorageTaskC1ENS0_4TypeEPNS_15StorageAreaSyncE
 __ZN7WebCore15StorageAreaSync13performImportEv
 __ZN7WebCore15StorageAreaSync12openDatabaseENS0_21OpenDatabaseParamTypeE
 __ZN7WebCore18StorageSyncManager20fullDatabaseFilenameERKN3WTF6StringE
@@ -25221,7 +25134,6 @@ __ZN7WebCore13JSEventSourceD1Ev
 __ZN7WebCore11EventSourceD0Ev
 __ZNK3JSC14JSGlobalObject14isGlobalObjectEv
 __ZN7WebCore22multipleFileUploadTextEj
-__ZN7WebCore27DefaultLocalizationStrategy22multipleFileUploadTextEj
 __ZN7WebCore17RenderDeprecatedFlexibleBox22calcVerticalPrefWidthsEv
 __ZN7WebCore11RenderStyle15setBoxFlexGroupEj
 __ZNK7WebCore13RenderListBox10renderNameEv
@@ -25498,7 +25410,6 @@ __ZN7WebCore22HTMLFormControlElement30updateVisibleValidationMessageEv
 __ZNK7WebCore16HTMLInputElement16valueMissingTextEv
 __ZNK7WebCore9InputType16valueMissingTextEv
 __ZN7WebCore33validationMessageValueMissingTextEv
-__ZN7WebCore27DefaultLocalizationStrategy33validationMessageValueMissingTextEv
 __ZN7WebCore17ValidationMessage6createEPNS_21FormAssociatedElementE
 __ZN7WebCore17ValidationMessage10setMessageERKN3WTF6StringE
 __ZN7WebCore5TimerINS_17ValidationMessageEE5firedEv
@@ -25608,11 +25519,9 @@ __ZN7WebCore44validationMessageValueMissingForCheckboxTextEv
 __ZNK7WebCore14RadioInputType16valueMissingTextEv
 __ZN7WebCore41validationMessageValueMissingForRadioTextEv
 __ZN7WebCore36validationMessagePatternMismatchTextEv
-__ZN7WebCore27DefaultLocalizationStrategy36validationMessagePatternMismatchTextEv
 __ZNK7WebCore16HTMLInputElement16typeMismatchTextEv
 __ZNK7WebCore14EmailInputType16typeMismatchTextEv
 __ZN7WebCore41validationMessageTypeMismatchForEmailTextEv
-__ZN7WebCore27DefaultLocalizationStrategy33validationMessageTypeMismatchTextEv
 __ZN7WebCore38jsHTMLFieldSetElementValidationMessageEPN3JSC9ExecStateENS0_7JSValueERKNS0_10IdentifierE
 __ZN7WebCore36jsHTMLKeygenElementValidationMessageEPN3JSC9ExecStateENS0_7JSValueERKNS0_10IdentifierE
 __ZN7WebCore33jsHTMLFieldSetElementWillValidateEPN3JSC9ExecStateENS0_7JSValueERKNS0_10IdentifierE
@@ -25922,7 +25831,7 @@ __ZN7WebCore15StorageAreaSync11performSyncEv
 __ZN7WebCore15StorageAreaSync4syncEbRKN3WTF7HashMapINS1_6StringES3_NS1_10StringHashENS1_10HashTraitsIS3_EES6_EE
 __ZN7WebCore14StorageTracker20cancelDeletingOriginERKN3WTF6StringE
 __ZN7WebCore14StorageTracker16setOriginDetailsERKN3WTF6StringES4_
-__ZN7WebCore16LocalStorageTaskC1ENS0_4TypeERKN3WTF6StringES5_
+__ZN7WebCore11StorageTaskC1ENS0_4TypeERKN3WTF6StringES5_
 __ZN7WebCore14StorageTracker12scheduleTaskEPv
 __ZN7WebCore14StorageTracker20syncSetOriginDetailsERKN3WTF6StringES4_
 __ZN7WebCore26setJSDOMWindowOnhashchangeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
@@ -27510,12 +27419,12 @@ __ZN7WebCore15StorageAreaImpl5closeEv
 __ZN7WebCore15StorageAreaSync17scheduleFinalSyncEv
 __ZN7WebCore18StorageSyncManager27scheduleDeleteEmptyDatabaseEN3WTF10PassRefPtrINS_15StorageAreaSyncEEE
 __ZN7WebCore18StorageSyncManager5closeEv
-__ZN7WebCore18LocalStorageThread9terminateEv
-__ZN7WebCore16LocalStorageTaskC1ENS0_4TypeEPNS_18LocalStorageThreadE
+__ZN7WebCore13StorageThread9terminateEv
+__ZN7WebCore11StorageTaskC1ENS0_4TypeEPNS_13StorageThreadE
 __ZN7WebCore15StorageAreaSync19deleteEmptyDatabaseEv
-__ZN7WebCore18LocalStorageThread16performTerminateEv
-__ZN7WebCore18LocalStorageThreadD1Ev
-__ZN3WTF12MessageQueueIN7WebCore16LocalStorageTaskEED1Ev
+__ZN7WebCore13StorageThread16performTerminateEv
+__ZN7WebCore13StorageThreadD1Ev
+__ZN3WTF12MessageQueueIN7WebCore11StorageTaskEED1Ev
 __ZN7WebCore28InspectorFrontendClientLocalD2Ev
 __ZN7WebCore21InspectorFrontendHost16disconnectClientEv
 __ZN7WebCore23JSInspectorFrontendHostD1Ev
@@ -28611,7 +28520,6 @@ __ZN7WebCore11FrameLoader22findFrameForNavigationERKN3WTF12AtomicStringE
 __ZN3JSC8Bindings13RuntimeObject23throwInvalidAccessErrorEPNS_9ExecStateE
 __ZN7WebCore20RenderEmbeddedObject30setShowsCrashedPluginIndicatorEv
 __ZN7WebCore17crashedPluginTextEv
-__ZN7WebCore27DefaultLocalizationStrategy17crashedPluginTextEv
 __ZN7WebCore16ScriptController11createWorldEv
 __ZN7WebCore9PageGroup20addUserScriptToWorldEPNS_15DOMWrapperWorldERKN3WTF6StringERKNS_4KURLENS3_10PassOwnPtrINS3_6VectorIS4_Lm0EEEEESD_NS_23UserScriptInjectionTimeENS_25UserContentInjectedFramesE
 __ZN7WebCore10UserScriptC2ERKN3WTF6StringERKNS_4KURLENS1_10PassOwnPtrINS1_6VectorIS2_Lm0EEEEESB_NS_23UserScriptInjectionTimeENS_25UserContentInjectedFramesE
@@ -28774,7 +28682,7 @@ __ZN7WebCore14StorageTracker12deleteOriginEPNS_14SecurityOriginE
 __ZN7WebCore9PageGroup26clearLocalStorageForOriginEPNS_14SecurityOriginE
 __ZN7WebCore20StorageNamespaceImpl22clearOriginForDeletionEPNS_14SecurityOriginE
 __ZNK3WTF7HashMapINS_6RefPtrIN7WebCore14SecurityOriginEEENS1_INS2_15StorageAreaImplEEENS2_18SecurityOriginHashENS_10HashTraitsIS4_EENS8_IS6_EEE3getEPS3_
-__ZN7WebCore16LocalStorageTaskC1ENS0_4TypeERKN3WTF6StringE
+__ZN7WebCore11StorageTaskC1ENS0_4TypeERKN3WTF6StringE
 __ZN7WebCore14StorageTracker16syncDeleteOriginERKN3WTF6StringE
 __ZN7WebCore14StorageTracker21databasePathForOriginERKN3WTF6StringE
 __ZN7WebCore14StorageTracker18diskUsageForOriginEPNS_14SecurityOriginE
@@ -29802,8 +29710,6 @@ __ZN7WebCore19JSSVGAnimateElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10I
 __ZN7WebCore12RenderObject16positionForPointERKNS_8IntPointE
 __ZN7WebCore22ConditionEventListener11handleEventEPNS_22ScriptExecutionContextEPNS_5EventE
 __ZN7WebCore14SVGSMILElement20handleConditionEventEPNS_5EventEPNS0_9ConditionE
-__ZN7WebCore21SVGDocumentExtensions21sampleAnimationAtTimeERKN3WTF6StringEPNS_14SVGSMILElementEd
-__ZN7WebCore17SMILTimeContainer21sampleAnimationAtTimeERKN3WTF6StringEd
 __ZN7WebCore50jsSVGAnimationElementPrototypeFunctionBeginElementEPN3JSC9ExecStateE
 __ZN7WebCore19SVGAnimationElement12beginElementEv
 __ZN7WebCore19SVGAnimationElement14beginElementAtEf
diff --git a/Source/WebCore/WebCore.pri b/Source/WebCore/WebCore.pri
index addd58793..af9941a25 100644
--- a/Source/WebCore/WebCore.pri
+++ b/Source/WebCore/WebCore.pri
@@ -18,6 +18,7 @@ WEBCORE_GENERATED_SOURCES_DIR = $${ROOT_BUILD_DIR}/Source/WebCore/$${GENERATED_S
 
 INCLUDEPATH += \
     $$SOURCE_DIR \
+    $$SOURCE_DIR/Modules/geolocation \
     $$SOURCE_DIR/accessibility \
     $$SOURCE_DIR/bindings \
     $$SOURCE_DIR/bindings/generic \
@@ -43,8 +44,9 @@ INCLUDEPATH += \
     $$SOURCE_DIR/mathml \
     $$SOURCE_DIR/notifications \
     $$SOURCE_DIR/page \
-    $$SOURCE_DIR/page/qt \
     $$SOURCE_DIR/page/animation \
+    $$SOURCE_DIR/page/qt \
+    $$SOURCE_DIR/page/scrolling \
     $$SOURCE_DIR/platform \
     $$SOURCE_DIR/platform/animation \
     $$SOURCE_DIR/platform/audio \
diff --git a/Source/WebCore/WebCore.vcproj/WebCore.vcproj b/Source/WebCore/WebCore.vcproj/WebCore.vcproj
index 59c667e92..19106c0e5 100755
--- a/Source/WebCore/WebCore.vcproj/WebCore.vcproj
+++ b/Source/WebCore/WebCore.vcproj/WebCore.vcproj
@@ -22564,6 +22564,54 @@
 			<File
 				RelativePath="$(ConfigurationBuildDir)\obj\$(ProjectName)\DerivedSources\JSWebKitCSSRegionRule.cpp"
 				>
+				<FileConfiguration
+					Name="Debug|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Release|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Debug_Cairo_CFLite|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Release_Cairo_CFLite|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Debug_All|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Production|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
 			</File>
 			<File
 				RelativePath="$(ConfigurationBuildDir)\obj\$(ProjectName)\DerivedSources\JSWebKitCSSRegionRule.h"
@@ -24003,6 +24051,66 @@
 			</File>
 		</Filter>
 		<Filter
+			Name="Modules"
+			>
+			<Filter
+				Name="geolocation"
+				>
+				<File
+					RelativePath="..\Modules\geolocation\Geolocation.cpp"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\geolocation\Geolocation.h"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\geolocation\GeolocationController.cpp"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\geolocation\GeolocationController.h"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\geolocation\GeolocationError.h"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\geolocation\GeolocationPosition.h"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\geolocation\Geoposition.h"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\geolocation\NavigatorGeolocation.cpp"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\geolocation\NavigatorGeolocation.h"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\geolocation\PositionCallback.h"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\geolocation\PositionError.h"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\geolocation\PositionErrorCallback.h"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\geolocation\PositionOptions.h"
+					>
+				</File>
+			</Filter>
+		</Filter>
+		<Filter
 			Name="accessibility"
 			>
 			<File
@@ -25422,38 +25530,10 @@
 				>
 			</File>
 			<File
-				RelativePath="..\page\Geolocation.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\page\Geolocation.h"
-				>
-			</File>
-			<File
 				RelativePath="..\page\GeolocationClient.h"
 				>
 			</File>
 			<File
-				RelativePath="..\page\GeolocationController.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\page\GeolocationController.h"
-				>
-			</File>
-			<File
-				RelativePath="..\page\GeolocationError.h"
-				>
-			</File>
-			<File
-				RelativePath="..\page\GeolocationPosition.h"
-				>
-			</File>
-			<File
-				RelativePath="..\page\Geoposition.h"
-				>
-			</File>
-			<File
 				RelativePath="..\page\GroupSettings.cpp"
 				>
 			</File>
@@ -25522,6 +25602,22 @@
 				>
 			</File>
 			<File
+				RelativePath="..\page\NavigatorRegisterProtocolHandler.cpp"
+				>
+			</File>
+			<File
+				RelativePath="..\page\NavigatorRegisterProtocolHandler.h"
+				>
+			</File>
+			<File
+				RelativePath="..\page\NavigatorSupplement.cpp"
+				>
+			</File>
+			<File
+				RelativePath="..\page\NavigatorSupplement.h"
+				>
+			</File>
+			<File
 				RelativePath="..\page\OriginAccessEntry.cpp"
 				>
 			</File>
@@ -25558,6 +25654,14 @@
 				>
 			</File>
 			<File
+				RelativePath="..\page\PageSupplement.cpp"
+				>
+			</File>
+			<File
+				RelativePath="..\page\PageSupplement.h"
+				>
+			</File>
+			<File
 				RelativePath="..\page\PageVisibilityState.cpp"
 				>
 			</File>
@@ -25590,22 +25694,6 @@
 				>
 			</File>
 			<File
-				RelativePath="..\page\PositionCallback.h"
-				>
-			</File>
-			<File
-				RelativePath="..\page\PositionError.h"
-				>
-			</File>
-			<File
-				RelativePath="..\page\PositionErrorCallback.h"
-				>
-			</File>
-			<File
-				RelativePath="..\page\PositionOptions.h"
-				>
-			</File>
-			<File
 				RelativePath="..\page\PrintContext.cpp"
 				>
 			</File>
@@ -25745,6 +25833,18 @@
 				RelativePath="..\page\WorkerNavigator.h"
 				>
 			</File>
+			<File
+				RelativePath="..\page\scrolling\ScrollingCoordinator.cpp"
+				>
+			</File>
+			<File
+				RelativePath="..\page\scrolling\ScrollingCoordinator.h"
+				>
+			</File>
+			<File
+				RelativePath="..\page\scrolling\ScrollingCoordinatorNone.cpp"
+				>
+			</File>
 			<Filter
 				Name="win"
 				>
@@ -26409,6 +26509,14 @@
 					>
 				</File>
 				<File
+					RelativePath="..\loader\cache\CachedSVGDocument.cpp"
+					>
+				</File>
+				<File
+					RelativePath="..\loader\cache\CachedSVGDocument.h"
+					>
+				</File>
+				<File
 					RelativePath="..\loader\cache\CachedXSLStyleSheet.cpp"
 					>
 				</File>
@@ -26542,14 +26650,6 @@
 				>
 			</File>
 			<File
-				RelativePath="..\platform\DefaultLocalizationStrategy.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\platform\DefaultLocalizationStrategy.h"
-				>
-			</File>
-			<File
 				RelativePath="..\platform\DragData.cpp"
 				>
 			</File>
@@ -26614,6 +26714,10 @@
 				>
 			</File>
 			<File
+				RelativePath="..\platform\FractionalLayoutUnit.h"
+				>
+			</File>
+			<File
 				RelativePath="..\platform\GeolocationService.cpp"
 				>
 			</File>
@@ -26686,10 +26790,6 @@
 				>
 			</File>
 			<File
-				RelativePath="..\platform\LocalizationStrategy.h"
-				>
-			</File>
-			<File
 				RelativePath="..\platform\LocalizedStrings.cpp"
 				>
 			</File>
@@ -27505,6 +27605,26 @@
 					>
 				</File>
 				<File
+					RelativePath="..\platform\graphics\FractionalLayoutRect.cpp"
+					>
+				</File>
+				<File
+					RelativePath="..\platform\graphics\FractionalLayoutRect.h"
+					>
+				</File>
+				<File
+					RelativePath="..\platform\graphics\FractionalLayoutSize.cpp"
+					>
+				</File>
+				<File
+					RelativePath="..\platform\graphics\FractionalLayoutSize.h"
+					>
+				</File>
+				<File
+					RelativePath="..\platform\graphics\FractionalLayoutPoint.h"
+					>
+				</File>
+				<File
 					RelativePath="..\platform\graphics\FloatPoint.cpp"
 					>
 				</File>
@@ -33942,62 +34062,6 @@
 				>
 			</File>
 			<File
-				RelativePath="..\css\StylePropertySet.cpp"
-				>
-				<FileConfiguration
-					Name="Debug|Win32"
-					ExcludedFromBuild="true"
-					>
-					<Tool
-						Name="VCCLCompilerTool"
-					/>
-				</FileConfiguration>
-				<FileConfiguration
-					Name="Release|Win32"
-					ExcludedFromBuild="true"
-					>
-					<Tool
-						Name="VCCLCompilerTool"
-					/>
-				</FileConfiguration>
-				<FileConfiguration
-					Name="Debug_Cairo_CFLite|Win32"
-					ExcludedFromBuild="true"
-					>
-					<Tool
-						Name="VCCLCompilerTool"
-					/>
-				</FileConfiguration>
-				<FileConfiguration
-					Name="Release_Cairo_CFLite|Win32"
-					ExcludedFromBuild="true"
-					>
-					<Tool
-						Name="VCCLCompilerTool"
-					/>
-				</FileConfiguration>
-				<FileConfiguration
-					Name="Debug_All|Win32"
-					ExcludedFromBuild="true"
-					>
-					<Tool
-						Name="VCCLCompilerTool"
-					/>
-				</FileConfiguration>
-				<FileConfiguration
-					Name="Production|Win32"
-					ExcludedFromBuild="true"
-					>
-					<Tool
-						Name="VCCLCompilerTool"
-					/>
-				</FileConfiguration>
-			</File>
-			<File
-				RelativePath="..\css\StylePropertySet.h"
-				>
-			</File>
-			<File
 				RelativePath="..\css\CSSNamespace.h"
 				>
 			</File>
@@ -35326,14 +35390,6 @@
 				>
 			</File>
 			<File
-				RelativePath="..\css\FontFamilyValue.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\css\FontFamilyValue.h"
-				>
-			</File>
-			<File
 				RelativePath="..\css\FontFeatureValue.cpp"
 				>
 			</File>
@@ -35434,6 +35490,14 @@
 				>
 			</File>
 			<File
+				RelativePath="..\css\PropertySetCSSStyleDeclaration.cpp"
+				>
+			</File>
+			<File
+				RelativePath="..\css\PropertySetCSSStyleDeclaration.h"
+				>
+			</File>
+			<File
 				RelativePath="..\css\quirks.css"
 				>
 			</File>
@@ -35474,6 +35538,62 @@
 				>
 			</File>
 			<File
+				RelativePath="..\css\StylePropertySet.cpp"
+				>
+				<FileConfiguration
+					Name="Debug|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Release|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Debug_Cairo_CFLite|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Release_Cairo_CFLite|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Debug_All|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Production|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+			</File>
+			<File
+				RelativePath="..\css\StylePropertySet.h"
+				>
+			</File>
+			<File
 				RelativePath="..\css\StyleSheet.cpp"
 				>
 			</File>
@@ -48658,6 +48778,10 @@
 				>
 			</File>
 			<File
+				RelativePath="..\dom\EventSender.h"
+				>
+			</File>
+			<File
 				RelativePath="..\dom\EventTarget.cpp"
 				>
 				<FileConfiguration
@@ -48854,11 +48978,11 @@
 				>
 			</File>
 			<File
-				RelativePath="..\dom\GenericEventQueue.h"
+				RelativePath="..\dom\GenericEventQueue.cpp"
 				>
 			</File>
 			<File
-				RelativePath="..\dom\GenericEventQueue.cpp"
+				RelativePath="..\dom\GenericEventQueue.h"
 				>
 			</File>
 			<File
@@ -52118,6 +52242,62 @@
 				>
 			</File>
 			<File
+				RelativePath="..\dom\WebKitMutationObserver.cpp"
+				>
+				<FileConfiguration
+					Name="Debug|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Release|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Debug_Cairo_CFLite|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Release_Cairo_CFLite|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Debug_All|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Production|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+			</File>
+			<File
+				RelativePath="..\dom\WebKitMutationObserver.h"
+				>
+			</File>
+			<File
 				RelativePath="..\dom\WebKitNamedFlow.cpp"
 				>
 				<FileConfiguration
@@ -60489,7 +60669,7 @@
 				RelativePath="..\html\PublicURLManager.h"
 				>
 			</File>
-            <File
+			<File
 				RelativePath="..\html\RadioInputType.cpp"
 				>
 			</File>
@@ -60805,14 +60985,6 @@
 				Name="shadow"
 				>
 				<File
-					RelativePath="..\html\shadow\ContentInclusionSelector.cpp"
-					>
-				</File>
-				<File
-					RelativePath="..\html\shadow\ContentInclusionSelector.h"
-					>
-				</File>
-				<File
 					RelativePath="..\html\shadow\ContentSelectorQuery.cpp"
 					>
 				</File>
@@ -60885,6 +61057,14 @@
 					>
 				</File>
 				<File
+					RelativePath="..\html\shadow\HTMLContentSelector.cpp"
+					>
+				</File>
+				<File
+					RelativePath="..\html\shadow\HTMLContentSelector.h"
+					>
+				</File>
+				<File
 					RelativePath="..\html\shadow\HTMLShadowElement.cpp"
 					>
 					<FileConfiguration
@@ -60941,6 +61121,14 @@
 					>
 				</File>
 				<File
+					RelativePath="..\html\shadow\InsertionPoint.cpp"
+					>
+				</File>
+				<File
+					RelativePath="..\html\shadow\InsertionPoint.h"
+					>
+				</File>
+				<File
 					RelativePath="..\html\shadow\MediaControlElements.cpp"
 					>
 				</File>
@@ -68712,6 +68900,10 @@
 					RelativePath="..\bindings\scripts\resolve-supplemental.pl"
 					>
 				</File>
+				<File
+					RelativePath="..\bindings\scripts\IDLAttributes.txt"
+					>
+				</File>
 			</Filter>
 		</Filter>
 		<Filter
@@ -70742,19 +70934,19 @@
 				>
 			</File>
 			<File
-				RelativePath="..\storage\LocalStorageTask.cpp"
+				RelativePath="..\storage\StorageTask.cpp"
 				>
 			</File>
 			<File
-				RelativePath="..\storage\LocalStorageTask.h"
+				RelativePath="..\storage\StorageTask.h"
 				>
 			</File>
 			<File
-				RelativePath="..\storage\LocalStorageThread.cpp"
+				RelativePath="..\storage\StorageThread.cpp"
 				>
 			</File>
 			<File
-				RelativePath="..\storage\LocalStorageThread.h"
+				RelativePath="..\storage\StorageThread.h"
 				>
 			</File>
 			<File
@@ -71124,6 +71316,22 @@
 			<File
 				RelativePath="..\inspector\ConsoleMessage.cpp"
 				>
+				<FileConfiguration
+					Name="Release|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Production|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
 			</File>
 			<File
 				RelativePath="..\inspector\ConsoleMessage.h"
@@ -71132,6 +71340,22 @@
 			<File
 				RelativePath="..\inspector\ContentSearchUtils.cpp"
 				>
+				<FileConfiguration
+					Name="Release|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Production|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
 			</File>
 			<File
 				RelativePath="..\inspector\ContentSearchUtils.h"
@@ -71140,6 +71364,22 @@
 			<File
 				RelativePath="..\inspector\DOMEditor.cpp"
 				>
+				<FileConfiguration
+					Name="Release|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Production|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
 			</File>
 			<File
 				RelativePath="..\inspector\DOMEditor.h"
@@ -71148,18 +71388,74 @@
 			<File
 				RelativePath="..\inspector\DOMNodeHighlighter.cpp"
 				>
+				<FileConfiguration
+					Name="Release|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Production|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
 			</File>
 			<File
 				RelativePath="..\inspector\DOMNodeHighlighter.h"
 				>
 			</File>
 			<File
+				RelativePath="..\inspector\DOMPatchSupport.cpp"
+				>
+				<FileConfiguration
+					Name="Release|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Production|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+			</File>
+			<File
+				RelativePath="..\inspector\DOMPatchSupport.h"
+				>
+			</File>
+			<File
 				RelativePath="..\inspector\DOMWrapperVisitor.h"
 				>
 			</File>
 			<File
 				RelativePath="..\inspector\IdentifiersFactory.cpp"
 				>
+				<FileConfiguration
+					Name="Release|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Production|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
 			</File>
 			<File
 				RelativePath="..\inspector\IdentifiersFactory.h"
@@ -71168,6 +71464,22 @@
 			<File
 				RelativePath="..\inspector\InjectedScript.cpp"
 				>
+				<FileConfiguration
+					Name="Release|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Production|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
 			</File>
 			<File
 				RelativePath="..\inspector\InjectedScript.h"
@@ -71176,6 +71488,22 @@
 			<File
 				RelativePath="..\inspector\InjectedScriptHost.cpp"
 				>
+				<FileConfiguration
+					Name="Release|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Production|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
 			</File>
 			<File
 				RelativePath="..\inspector\InjectedScriptHost.h"
@@ -71184,6 +71512,22 @@
 			<File
 				RelativePath="..\inspector\InjectedScriptManager.cpp"
 				>
+				<FileConfiguration
+					Name="Release|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Production|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
 			</File>
 			<File
 				RelativePath="..\inspector\InjectedScriptManager.h"
@@ -71370,6 +71714,30 @@
 				</FileConfiguration>
 			</File>
 			<File
+				RelativePath="..\inspector\InspectorCounters.h"
+				>
+			</File>
+			<File
+				RelativePath="..\inspector\InspectorCounters.cpp"
+				>
+				<FileConfiguration
+					Name="Release|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Production|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+			</File>
+			<File
 				RelativePath="..\inspector\InspectorController.h"
 				>
 			</File>
@@ -72000,6 +72368,22 @@
 			<File
 				RelativePath="..\inspector\InstrumentingAgents.cpp"
 				>
+				<FileConfiguration
+					Name="Release|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Production|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
 			</File>
 			<File
 				RelativePath="..\inspector\InstrumentingAgents.h"
@@ -72008,6 +72392,22 @@
 			<File
 				RelativePath="..\inspector\NetworkResourcesData.cpp"
 				>
+				<FileConfiguration
+					Name="Release|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Production|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
 			</File>
 			<File
 				RelativePath="..\inspector\NetworkResourcesData.h"
@@ -72016,6 +72416,22 @@
 			<File
 				RelativePath="..\inspector\PageConsoleAgent.cpp"
 				>
+				<FileConfiguration
+					Name="Release|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Production|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
 			</File>
 			<File
 				RelativePath="..\inspector\PageConsoleAgent.h"
@@ -72024,6 +72440,22 @@
 			<File
 				RelativePath="..\inspector\PageDebuggerAgent.cpp"
 				>
+				<FileConfiguration
+					Name="Release|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Production|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
 			</File>
 			<File
 				RelativePath="..\inspector\PageDebuggerAgent.h"
@@ -72032,6 +72464,22 @@
 			<File
 				RelativePath="..\inspector\PageRuntimeAgent.cpp"
 				>
+				<FileConfiguration
+					Name="Release|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Production|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
 			</File>
 			<File
 				RelativePath="..\inspector\PageRuntimeAgent.h"
@@ -72040,6 +72488,22 @@
 			<File
 				RelativePath="..\inspector\ScriptArguments.cpp"
 				>
+				<FileConfiguration
+					Name="Release|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Production|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
 			</File>
 			<File
 				RelativePath="..\inspector\ScriptArguments.h"
@@ -72052,6 +72516,22 @@
 			<File
 				RelativePath="..\inspector\ScriptCallFrame.cpp"
 				>
+				<FileConfiguration
+					Name="Release|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Production|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
 			</File>
 			<File
 				RelativePath="..\inspector\ScriptCallFrame.h"
@@ -72060,6 +72540,22 @@
 			<File
 				RelativePath="..\inspector\ScriptCallStack.cpp"
 				>
+				<FileConfiguration
+					Name="Release|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Production|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
 			</File>
 			<File
 				RelativePath="..\inspector\ScriptCallStack.h"
@@ -72072,6 +72568,22 @@
 			<File
 				RelativePath="..\inspector\TimelineRecordFactory.cpp"
 				>
+				<FileConfiguration
+					Name="Release|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Production|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
 			</File>
 			<File
 				RelativePath="..\inspector\TimelineRecordFactory.h"
@@ -72080,6 +72592,22 @@
 			<File
 				RelativePath="..\inspector\WorkerConsoleAgent.cpp"
 				>
+				<FileConfiguration
+					Name="Release|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Production|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
 			</File>
 			<File
 				RelativePath="..\inspector\WorkerConsoleAgent.h"
@@ -72088,6 +72616,22 @@
 			<File
 				RelativePath="..\inspector\WorkerDebuggerAgent.cpp"
 				>
+				<FileConfiguration
+					Name="Release|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Production|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
 			</File>
 			<File
 				RelativePath="..\inspector\WorkerDebuggerAgent.h"
@@ -72096,6 +72640,22 @@
 			<File
 				RelativePath="..\inspector\WorkerInspectorController.cpp"
 				>
+				<FileConfiguration
+					Name="Release|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Production|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
 			</File>
 			<File
 				RelativePath="..\inspector\WorkerInspectorController.h"
@@ -72104,6 +72664,22 @@
 			<File
 				RelativePath="..\inspector\WorkerRuntimeAgent.cpp"
 				>
+				<FileConfiguration
+					Name="Release|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Production|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
 			</File>
 			<File
 				RelativePath="..\inspector\WorkerRuntimeAgent.h"
@@ -72409,6 +72985,14 @@
 					>
 				</File>
 				<File
+					RelativePath="..\inspector\front-end\indexedDBViews.css"
+					>
+				</File>
+				<File
+					RelativePath="..\inspector\front-end\IndexedDBViews.js"
+					>
+				</File>
+				<File
 					RelativePath="..\inspector\front-end\InjectedFakeWorker.js"
 					>
 				</File>
@@ -72453,11 +73037,11 @@
 					>
 				</File>
 				<File
-					RelativePath="..\inspector\front-end\JavaScriptFormatter.js"
+					RelativePath="..\inspector\front-end\UglifyJS\JavaScriptFormatter.js"
 					>
 				</File>
 				<File
-					RelativePath="..\inspector\front-end\UglifyJS\JavaScriptFormatter.js"
+					RelativePath="..\inspector\front-end\JavaScriptFormatter.js"
 					>
 				</File>
 				<File
@@ -72689,6 +73273,10 @@
 					>
 				</File>
 				<File
+					RelativePath="..\inspector\front-end\SidebarOverlay.js"
+					>
+				</File>
+				<File
 					RelativePath="..\inspector\front-end\SidebarPane.js"
 					>
 				</File>
@@ -72721,6 +73309,10 @@
 					>
 				</File>
 				<File
+					RelativePath="..\inspector\front-end\Spectrum.js"
+					>
+				</File>
+				<File
 					RelativePath="..\inspector\front-end\splitView.css"
 					>
 				</File>
@@ -72890,6 +73482,30 @@
 				>
 			</File>
 			<File
+				RelativePath="..\websockets\WebSocketDeflater.cpp"
+				>
+			</File>
+			<File
+				RelativePath="..\websockets\WebSocketDeflater.h"
+				>
+			</File>
+			<File
+				RelativePath="..\websockets\WebSocketExtensionDispatcher.cpp"
+				>
+			</File>
+			<File
+				RelativePath="..\websockets\WebSocketExtensionDispatcher.h"
+				>
+			</File>
+			<File
+				RelativePath="..\websockets\WebSocketExtensionProcessor.h"
+				>
+			</File>
+			<File
+				RelativePath="..\websockets\WebSocketFrame.h"
+				>
+			</File>
+			<File
 				RelativePath="..\websockets\WebSocketHandshake.cpp"
 				>
 			</File>
diff --git a/Source/WebCore/WebCore.vcproj/WebCoreCommon.vsprops b/Source/WebCore/WebCore.vcproj/WebCoreCommon.vsprops
index e95b87c39..838c080a6 100644
--- a/Source/WebCore/WebCore.vcproj/WebCoreCommon.vsprops
+++ b/Source/WebCore/WebCore.vcproj/WebCoreCommon.vsprops
@@ -7,7 +7,7 @@
 	>
 	<Tool
 		Name="VCCLCompilerTool"
-		AdditionalIncludeDirectories="&quot;$(ProjectDir)..&quot;;&quot;$(ProjectDir)..\accessibility&quot;;&quot;$(ProjectDir)..\accessibility\win&quot;;&quot;$(ProjectDir)..\bridge&quot;;&quot;$(ProjectDir)..\bridge\c&quot;;&quot;$(ProjectDir)..\bridge\jsc&quot;;&quot;$(ProjectDir)..\css&quot;;&quot;$(ProjectDir)..\editing&quot;;&quot;$(ProjectDir)..\fileapi&quot;;&quot;$(ProjectDir)..\rendering&quot;;&quot;$(ProjectDir)..\rendering\mathml&quot;;&quot;$(ProjectDir)..\rendering\style&quot;;&quot;$(ProjectDir)..\rendering\svg&quot;;&quot;$(ProjectDir)..\bindings&quot;;&quot;$(ProjectDir)..\bindings\generic&quot;;&quot;$(ProjectDir)..\bindings\js&quot;;&quot;$(ProjectDir)..\bindings\js\specialization&quot;;&quot;$(ProjectDir)..\dom&quot;;&quot;$(ProjectDir)..\dom\default&quot;;&quot;$(ProjectDir)..\history&quot;;&quot;$(ProjectDir)..\html&quot;;&quot;$(ProjectDir)..\html\canvas&quot;;&quot;$(ProjectDir)..\html\parser&quot;;&quot;$(ProjectDir)..\html\shadow&quot;;&quot;$(ProjectDir)..\inspector&quot;;&quot;$(ProjectDir)..\loader&quot;;&quot;$(ProjectDir)..\loader\appcache&quot;;&quot;$(ProjectDir)..\loader\archive&quot;;&quot;$(ProjectDir)..\loader\archive\cf&quot;;&quot;$(ProjectDir)..\loader\cache&quot;;&quot;$(ProjectDir)..\loader\icon&quot;;&quot;$(ProjectDir)..\mathml&quot;;&quot;$(ProjectDir)..\notifications&quot;;&quot;$(ProjectDir)..\page&quot;;&quot;$(ProjectDir)..\page\animation&quot;;&quot;$(ProjectDir)..\page\win&quot;;&quot;$(ProjectDir)..\platform&quot;;&quot;$(ProjectDir)..\platform\animation&quot;;&quot;$(ProjectDir)..\platform\mock&quot;;&quot;$(ProjectDir)..\platform\sql&quot;;&quot;$(ProjectDir)..\platform\win&quot;;&quot;$(ProjectDir)..\platform\network&quot;;&quot;$(ProjectDir)..\platform\network\win&quot;;&quot;$(ProjectDir)..\platform\cf&quot;;&quot;$(ProjectDir)..\platform\graphics&quot;;&quot;$(ProjectDir)..\platform\graphics\ca&quot;;&quot;$(ProjectDir)..\platform\graphics\filters&quot;;&quot;$(ProjectDir)..\platform\graphics\filters\arm&quot;;&quot;$(ProjectDir)..\platform\graphics\opentype&quot;;&quot;$(ProjectDir)..\platform\graphics\transforms&quot;;&quot;$(ProjectDir)..\platform\text&quot;;&quot;$(ProjectDir)..\platform\text\transcoder&quot;;&quot;$(ProjectDir)..\platform\graphics\win&quot;;&quot;$(ProjectDir)..\xml&quot;;&quot;$(ProjectDir)..\xml\parser&quot;;&quot;$(ConfigurationBuildDir)\obj\WebCore\DerivedSources&quot;;&quot;$(ProjectDir)..\plugins&quot;;&quot;$(ProjectDir)..\plugins\win&quot;;&quot;$(ProjectDir)..\svg\animation&quot;;&quot;$(ProjectDir)..\svg\graphics&quot;;&quot;$(ProjectDir)..\svg\properties&quot;;&quot;$(ProjectDir)..\svg\graphics\filters&quot;;&quot;$(ProjectDir)..\svg&quot;;&quot;$(ProjectDir)..\testing&quot;;&quot;$(ProjectDir)..\wml&quot;;&quot;$(ProjectDir)..\storage&quot;;&quot;$(ProjectDir)..\websockets&quot;;&quot;$(ProjectDir)..\workers&quot;;&quot;$(ConfigurationBuildDir)\include&quot;;&quot;$(ConfigurationBuildDir)\include\private&quot;;&quot;$(ConfigurationBuildDir)\include\JavaScriptCore&quot;;&quot;$(ConfigurationBuildDir)\include\private\JavaScriptCore&quot;;&quot;$(ProjectDir)..\ForwardingHeaders&quot;;&quot;$(WebKitLibrariesDir)\include&quot;;&quot;$(WebKitLibrariesDir)\include\private&quot;;&quot;$(WebKitLibrariesDir)\include\private\JavaScriptCore&quot;;&quot;$(WebKitLibrariesDir)\include\pthreads&quot;;&quot;$(WebKitLibrariesDir)\include\sqlite&quot;;&quot;$(WebKitLibrariesDir)\include\JavaScriptCore&quot;;&quot;$(WebKitLibrariesDir)\include\zlib&quot;"
+		AdditionalIncludeDirectories="&quot;$(ProjectDir)..&quot;;&quot;$(ProjectDir)..\Modules\geolocation&quot;;&quot;$(ProjectDir)..\accessibility&quot;;&quot;$(ProjectDir)..\accessibility\win&quot;;&quot;$(ProjectDir)..\bridge&quot;;&quot;$(ProjectDir)..\bridge\c&quot;;&quot;$(ProjectDir)..\bridge\jsc&quot;;&quot;$(ProjectDir)..\css&quot;;&quot;$(ProjectDir)..\editing&quot;;&quot;$(ProjectDir)..\fileapi&quot;;&quot;$(ProjectDir)..\rendering&quot;;&quot;$(ProjectDir)..\rendering\mathml&quot;;&quot;$(ProjectDir)..\rendering\style&quot;;&quot;$(ProjectDir)..\rendering\svg&quot;;&quot;$(ProjectDir)..\bindings&quot;;&quot;$(ProjectDir)..\bindings\generic&quot;;&quot;$(ProjectDir)..\bindings\js&quot;;&quot;$(ProjectDir)..\bindings\js\specialization&quot;;&quot;$(ProjectDir)..\dom&quot;;&quot;$(ProjectDir)..\dom\default&quot;;&quot;$(ProjectDir)..\history&quot;;&quot;$(ProjectDir)..\html&quot;;&quot;$(ProjectDir)..\html\canvas&quot;;&quot;$(ProjectDir)..\html\parser&quot;;&quot;$(ProjectDir)..\html\shadow&quot;;&quot;$(ProjectDir)..\inspector&quot;;&quot;$(ProjectDir)..\loader&quot;;&quot;$(ProjectDir)..\loader\appcache&quot;;&quot;$(ProjectDir)..\loader\archive&quot;;&quot;$(ProjectDir)..\loader\archive\cf&quot;;&quot;$(ProjectDir)..\loader\cache&quot;;&quot;$(ProjectDir)..\loader\icon&quot;;&quot;$(ProjectDir)..\mathml&quot;;&quot;$(ProjectDir)..\notifications&quot;;&quot;$(ProjectDir)..\page&quot;;&quot;$(ProjectDir)..\page\animation&quot;;&quot;$(ProjectDir)..\page\scrolling&quot;;&quot;$(ProjectDir)..\page\win&quot;;&quot;$(ProjectDir)..\platform&quot;;&quot;$(ProjectDir)..\platform\animation&quot;;&quot;$(ProjectDir)..\platform\mock&quot;;&quot;$(ProjectDir)..\platform\sql&quot;;&quot;$(ProjectDir)..\platform\win&quot;;&quot;$(ProjectDir)..\platform\network&quot;;&quot;$(ProjectDir)..\platform\network\win&quot;;&quot;$(ProjectDir)..\platform\cf&quot;;&quot;$(ProjectDir)..\platform\graphics&quot;;&quot;$(ProjectDir)..\platform\graphics\ca&quot;;&quot;$(ProjectDir)..\platform\graphics\filters&quot;;&quot;$(ProjectDir)..\platform\graphics\filters\arm&quot;;&quot;$(ProjectDir)..\platform\graphics\opentype&quot;;&quot;$(ProjectDir)..\platform\graphics\transforms&quot;;&quot;$(ProjectDir)..\platform\text&quot;;&quot;$(ProjectDir)..\platform\text\transcoder&quot;;&quot;$(ProjectDir)..\platform\graphics\win&quot;;&quot;$(ProjectDir)..\xml&quot;;&quot;$(ProjectDir)..\xml\parser&quot;;&quot;$(ConfigurationBuildDir)\obj\WebCore\DerivedSources&quot;;&quot;$(ProjectDir)..\plugins&quot;;&quot;$(ProjectDir)..\plugins\win&quot;;&quot;$(ProjectDir)..\svg\animation&quot;;&quot;$(ProjectDir)..\svg\graphics&quot;;&quot;$(ProjectDir)..\svg\properties&quot;;&quot;$(ProjectDir)..\svg\graphics\filters&quot;;&quot;$(ProjectDir)..\svg&quot;;&quot;$(ProjectDir)..\testing&quot;;&quot;$(ProjectDir)..\wml&quot;;&quot;$(ProjectDir)..\storage&quot;;&quot;$(ProjectDir)..\websockets&quot;;&quot;$(ProjectDir)..\workers&quot;;&quot;$(ConfigurationBuildDir)\include&quot;;&quot;$(ConfigurationBuildDir)\include\private&quot;;&quot;$(ConfigurationBuildDir)\include\JavaScriptCore&quot;;&quot;$(ConfigurationBuildDir)\include\private\JavaScriptCore&quot;;&quot;$(ProjectDir)..\ForwardingHeaders&quot;;&quot;$(WebKitLibrariesDir)\include&quot;;&quot;$(WebKitLibrariesDir)\include\private&quot;;&quot;$(WebKitLibrariesDir)\include\private\JavaScriptCore&quot;;&quot;$(WebKitLibrariesDir)\include\pthreads&quot;;&quot;$(WebKitLibrariesDir)\include\sqlite&quot;;&quot;$(WebKitLibrariesDir)\include\JavaScriptCore&quot;;&quot;$(WebKitLibrariesDir)\include\zlib&quot;"
 		PreprocessorDefinitions="__WIN32__;DISABLE_3D_RENDERING;WEBCORE_CONTEXT_MENUS"
 		UsePrecompiledHeader="2"
 		PrecompiledHeaderThrough="WebCorePrefix.h"
diff --git a/Source/WebCore/WebCore.vcproj/copyForwardingHeaders.cmd b/Source/WebCore/WebCore.vcproj/copyForwardingHeaders.cmd
index 249347394..dfd62b12d 100755
--- a/Source/WebCore/WebCore.vcproj/copyForwardingHeaders.cmd
+++ b/Source/WebCore/WebCore.vcproj/copyForwardingHeaders.cmd
@@ -19,6 +19,7 @@ mkdir 2>NUL "%CONFIGURATIONBUILDDIR%\include\WebCoreTestSupport"
 
 xcopy /y /d "%ProjectDir%..\config.h" "%CONFIGURATIONBUILDDIR%\include\WebCore"
 xcopy /y /d "%CONFIGURATIONBUILDDIR%\obj\WebCore\DerivedSources\*.h" "%CONFIGURATIONBUILDDIR%\include\WebCore"
+xcopy /y /d "%ProjectDir%..\Modules\geolocation\*.h" "%CONFIGURATIONBUILDDIR%\include\WebCore"
 xcopy /y /d "%ProjectDir%..\accessibility\*.h" "%CONFIGURATIONBUILDDIR%\include\WebCore"
 xcopy /y /d "%ProjectDir%..\accessibility\win\*.h" "%CONFIGURATIONBUILDDIR%\include\WebCore"
 xcopy /y /d "%ProjectDir%..\inspector\*.h" "%CONFIGURATIONBUILDDIR%\include\WebCore"
diff --git a/Source/WebCore/WebCore.xcodeproj/project.pbxproj b/Source/WebCore/WebCore.xcodeproj/project.pbxproj
index 0d1c49408..729d53276 100644
--- a/Source/WebCore/WebCore.xcodeproj/project.pbxproj
+++ b/Source/WebCore/WebCore.xcodeproj/project.pbxproj
@@ -297,6 +297,11 @@
 		1432E8490C51493F00B1500F /* GCController.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 1432E8480C51493F00B1500F /* GCController.cpp */; };
 		1449E24C107D4A8400B5793F /* JSCallbackData.h in Headers */ = {isa = PBXBuildFile; fileRef = 1449E24A107D4A8400B5793F /* JSCallbackData.h */; };
 		1449E287107D4DB400B5793F /* JSCallbackData.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 1449E286107D4DB400B5793F /* JSCallbackData.cpp */; };
+		144FCE5214EC79BC000D17A3 /* FractionalLayoutUnit.h in Headers */ = {isa = PBXBuildFile; fileRef = 144FCE5114EC79BC000D17A3 /* FractionalLayoutUnit.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		144FCE5C14EC79E7000D17A3 /* FractionalLayoutSize.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 144FCE5714EC79E7000D17A3 /* FractionalLayoutSize.cpp */; };
+		144FCE5D14EC79E7000D17A3 /* FractionalLayoutSize.h in Headers */ = {isa = PBXBuildFile; fileRef = 144FCE5814EC79E7000D17A3 /* FractionalLayoutSize.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		144FCFE014EF2509000D17A3 /* FractionalLayoutRect.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 144FCFDE14EF2509000D17A3 /* FractionalLayoutRect.cpp */; };
+		144FCFE114EF2509000D17A3 /* FractionalLayoutRect.h in Headers */ = {isa = PBXBuildFile; fileRef = 144FCFDF14EF2509000D17A3 /* FractionalLayoutRect.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		1464E06C135EC10600FDB00A /* JSMediaListCustom.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 1464E06B135EC10600FDB00A /* JSMediaListCustom.cpp */; };
 		1477E7760BF4134A00152872 /* PageCache.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 1477E7740BF4134A00152872 /* PageCache.cpp */; };
 		1477E7770BF4134A00152872 /* PageCache.h in Headers */ = {isa = PBXBuildFile; fileRef = 1477E7750BF4134A00152872 /* PageCache.h */; settings = {ATTRIBUTES = (Private, ); }; };
@@ -599,7 +604,7 @@
 		1AF62EE814DA22A70041556C /* ScrollingCoordinator.h in Headers */ = {isa = PBXBuildFile; fileRef = 1AF62EE514DA22A70041556C /* ScrollingCoordinator.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		1AF62F2414DAFE910041556C /* ScrollingThreadMac.mm in Sources */ = {isa = PBXBuildFile; fileRef = 1AF62F2314DAFE910041556C /* ScrollingThreadMac.mm */; };
 		1AF62F2514DAFE9E0041556C /* ScrollingThread.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 1AF62F2014DAFE790041556C /* ScrollingThread.cpp */; };
-		1AF62F2614DAFEA10041556C /* ScrollingThread.h in Headers */ = {isa = PBXBuildFile; fileRef = 1AF62F2114DAFE790041556C /* ScrollingThread.h */; };
+		1AF62F2614DAFEA10041556C /* ScrollingThread.h in Headers */ = {isa = PBXBuildFile; fileRef = 1AF62F2114DAFE790041556C /* ScrollingThread.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		1AF8E11A1256592600230FF7 /* ProxyServer.h in Headers */ = {isa = PBXBuildFile; fileRef = 1AF8E1191256592600230FF7 /* ProxyServer.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		1AF8E13312565A4400230FF7 /* ProxyServer.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 1AF8E13212565A4400230FF7 /* ProxyServer.cpp */; };
 		1AF8E1C3125673E000230FF7 /* ProxyServerCFNet.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 1AF8E1C1125673E000230FF7 /* ProxyServerCFNet.cpp */; };
@@ -984,6 +989,7 @@
 		37F818FD0D657606005E1F05 /* WebCoreURLResponse.h in Headers */ = {isa = PBXBuildFile; fileRef = 37F818FB0D657606005E1F05 /* WebCoreURLResponse.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		37F818FE0D657606005E1F05 /* WebCoreURLResponse.mm in Sources */ = {isa = PBXBuildFile; fileRef = 37F818FC0D657606005E1F05 /* WebCoreURLResponse.mm */; };
 		37FD4298118368460093C029 /* TreeDepthLimit.h in Headers */ = {isa = PBXBuildFile; fileRef = 37FD4297118368460093C029 /* TreeDepthLimit.h */; };
+		3866AF3814F1C17100283D68 /* ScrollingCoordinatorNone.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 3866AF3714F1C17100283D68 /* ScrollingCoordinatorNone.cpp */; };
 		3AB02D2A12D4F91600FBB694 /* StorageTracker.h in Headers */ = {isa = PBXBuildFile; fileRef = 3AB02D2812D4F91600FBB694 /* StorageTracker.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		3AB02D2B12D4F91600FBB694 /* StorageTracker.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 3AB02D2912D4F91600FBB694 /* StorageTracker.cpp */; };
 		3AC3680012EF7A09006A3D6F /* StorageTrackerClient.h in Headers */ = {isa = PBXBuildFile; fileRef = 3AC367FE12EF7A09006A3D6F /* StorageTrackerClient.h */; settings = {ATTRIBUTES = (Private, ); }; };
@@ -1361,11 +1367,14 @@
 		4A1E719614E101F900626F9D /* JSHTMLShadowElement.h in Headers */ = {isa = PBXBuildFile; fileRef = 4A1E719414E101F900626F9D /* JSHTMLShadowElement.h */; };
 		4A1E71A514E106AC00626F9D /* JSShadowRoot.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 4A1E71A314E106AC00626F9D /* JSShadowRoot.cpp */; };
 		4A1E71A614E106AC00626F9D /* JSShadowRoot.h in Headers */ = {isa = PBXBuildFile; fileRef = 4A1E71A414E106AC00626F9D /* JSShadowRoot.h */; };
+		4A4A234614F1E1440046FBF1 /* WebSocketFrame.h in Headers */ = {isa = PBXBuildFile; fileRef = 4A4A234514F1E1440046FBF1 /* WebSocketFrame.h */; };
 		4A6E9FC313C17D1D0046A7F8 /* FontFeatureValue.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 4A6E9FC113C17D1D0046A7F8 /* FontFeatureValue.cpp */; };
 		4A6E9FC413C17D1D0046A7F8 /* FontFeatureValue.h in Headers */ = {isa = PBXBuildFile; fileRef = 4A6E9FC213C17D1D0046A7F8 /* FontFeatureValue.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		4A6E9FC713C17D570046A7F8 /* FontFeatureSettings.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 4A6E9FC513C17D570046A7F8 /* FontFeatureSettings.cpp */; };
 		4A6E9FC813C17D570046A7F8 /* FontFeatureSettings.h in Headers */ = {isa = PBXBuildFile; fileRef = 4A6E9FC613C17D570046A7F8 /* FontFeatureSettings.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		4A8C96EB0BE69032004EEFF0 /* FrameSelectionMac.mm in Sources */ = {isa = PBXBuildFile; fileRef = 4A8C96EA0BE69032004EEFF0 /* FrameSelectionMac.mm */; };
+		4A957F0614E2412A0049DBFB /* WebSocketExtensionDispatcher.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 4A957F0314E241100049DBFB /* WebSocketExtensionDispatcher.cpp */; };
+		4A957F0714E241300049DBFB /* WebSocketExtensionDispatcher.h in Headers */ = {isa = PBXBuildFile; fileRef = 4A957F0414E241100049DBFB /* WebSocketExtensionDispatcher.h */; };
 		4ABDFF0B14DBE385004D117D /* HTMLShadowElement.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 4ABDFF0714DBE312004D117D /* HTMLShadowElement.cpp */; };
 		4ABDFF0C14DBE385004D117D /* HTMLShadowElement.h in Headers */ = {isa = PBXBuildFile; fileRef = 4ABDFF0814DBE312004D117D /* HTMLShadowElement.h */; };
 		4ACBC0BE12713CBD0094F9B2 /* ClassList.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 4ACBC0BC12713CBD0094F9B2 /* ClassList.cpp */; };
@@ -1379,6 +1388,9 @@
 		4AD01009127E642A0015035F /* HTMLOutputElement.h in Headers */ = {isa = PBXBuildFile; fileRef = 4AD01006127E642A0015035F /* HTMLOutputElement.h */; };
 		4AD0173C127E82860015035F /* JSHTMLOutputElement.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 4AD0173A127E82860015035F /* JSHTMLOutputElement.cpp */; };
 		4AD0173D127E82860015035F /* JSHTMLOutputElement.h in Headers */ = {isa = PBXBuildFile; fileRef = 4AD0173B127E82860015035F /* JSHTMLOutputElement.h */; };
+		4ADE25FA14E3BB4C004C2213 /* WebSocketExtensionProcessor.h in Headers */ = {isa = PBXBuildFile; fileRef = 4ADE25F914E3BB4C004C2213 /* WebSocketExtensionProcessor.h */; };
+		4AE02ABD14E8A9D200BC3BA7 /* WebSocketDeflater.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 4AE02ABB14E8A9D200BC3BA7 /* WebSocketDeflater.cpp */; };
+		4AE02ABE14E8A9D200BC3BA7 /* WebSocketDeflater.h in Headers */ = {isa = PBXBuildFile; fileRef = 4AE02ABC14E8A9D200BC3BA7 /* WebSocketDeflater.h */; };
 		4AF1AD3E13FD23A400AA9590 /* EventDispatchMediator.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 4AF1AD3C13FD23A400AA9590 /* EventDispatchMediator.cpp */; };
 		4AF1AD3F13FD23A400AA9590 /* EventDispatchMediator.h in Headers */ = {isa = PBXBuildFile; fileRef = 4AF1AD3D13FD23A400AA9590 /* EventDispatchMediator.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		4B2708C70AF19EE40065127F /* Pasteboard.h in Headers */ = {isa = PBXBuildFile; fileRef = 4B2708C50AF19EE40065127F /* Pasteboard.h */; };
@@ -1461,10 +1473,10 @@
 		5112247810CFB8F4008099D7 /* WorkerThreadableWebSocketChannel.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 5112247710CFB8F4008099D7 /* WorkerThreadableWebSocketChannel.cpp */; };
 		5112247A10CFB8FF008099D7 /* WorkerThreadableWebSocketChannel.h in Headers */ = {isa = PBXBuildFile; fileRef = 5112247910CFB8FF008099D7 /* WorkerThreadableWebSocketChannel.h */; };
 		5116D9770CF177BD00C2B84D /* DatabaseDetails.h in Headers */ = {isa = PBXBuildFile; fileRef = 5116D9750CF177BD00C2B84D /* DatabaseDetails.h */; settings = {ATTRIBUTES = (Private, ); }; };
-		511F23170DC160DA004F0032 /* LocalStorageTask.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 511F23130DC160DA004F0032 /* LocalStorageTask.cpp */; };
-		511F23180DC160DA004F0032 /* LocalStorageTask.h in Headers */ = {isa = PBXBuildFile; fileRef = 511F23140DC160DA004F0032 /* LocalStorageTask.h */; };
-		511F23190DC160DA004F0032 /* LocalStorageThread.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 511F23150DC160DA004F0032 /* LocalStorageThread.cpp */; };
-		511F231A0DC160DA004F0032 /* LocalStorageThread.h in Headers */ = {isa = PBXBuildFile; fileRef = 511F23160DC160DA004F0032 /* LocalStorageThread.h */; };
+		511F23170DC160DA004F0032 /* StorageTask.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 511F23130DC160DA004F0032 /* StorageTask.cpp */; };
+		511F23180DC160DA004F0032 /* StorageTask.h in Headers */ = {isa = PBXBuildFile; fileRef = 511F23140DC160DA004F0032 /* StorageTask.h */; };
+		511F23190DC160DA004F0032 /* StorageThread.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 511F23150DC160DA004F0032 /* StorageThread.cpp */; };
+		511F231A0DC160DA004F0032 /* StorageThread.h in Headers */ = {isa = PBXBuildFile; fileRef = 511F23160DC160DA004F0032 /* StorageThread.h */; };
 		5126E6BB0A2E3B12005C29FA /* IconDatabase.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 5126E6B90A2E3B12005C29FA /* IconDatabase.cpp */; };
 		5126E6BC0A2E3B12005C29FA /* IconDatabase.h in Headers */ = {isa = PBXBuildFile; fileRef = 5126E6BA0A2E3B12005C29FA /* IconDatabase.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		512DD8E30D91E2B4000F89EE /* SharedBufferCF.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 512DD8E20D91E2B4000F89EE /* SharedBufferCF.cpp */; };
@@ -1599,13 +1611,17 @@
 		53C8298E13D8D92700DE2DEB /* RenderFlexibleBox.h in Headers */ = {isa = PBXBuildFile; fileRef = 53C8298C13D8D92700DE2DEB /* RenderFlexibleBox.h */; };
 		550A0BC9085F6039007353D6 /* QualifiedName.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 550A0BC7085F6039007353D6 /* QualifiedName.cpp */; };
 		550A0BCA085F6039007353D6 /* QualifiedName.h in Headers */ = {isa = PBXBuildFile; fileRef = 550A0BC8085F6039007353D6 /* QualifiedName.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		572E92FB14E540580087FFBA /* ShadowRootList.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 572E92F914E540580087FFBA /* ShadowRootList.cpp */; };
+		572E92FC14E540580087FFBA /* ShadowRootList.h in Headers */ = {isa = PBXBuildFile; fileRef = 572E92FA14E540580087FFBA /* ShadowRootList.h */; };
 		573D134714CE39FF0057ABCA /* InspectorTypeBuilder.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 573D134514CE39FF0057ABCA /* InspectorTypeBuilder.cpp */; };
-		57B791A314C6A62900F202D1 /* ContentInclusionSelector.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 57B7919F14C6A62900F202D1 /* ContentInclusionSelector.cpp */; };
-		57B791A414C6A62900F202D1 /* ContentInclusionSelector.h in Headers */ = {isa = PBXBuildFile; fileRef = 57B791A014C6A62900F202D1 /* ContentInclusionSelector.h */; };
+		57B791A314C6A62900F202D1 /* HTMLContentSelector.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 57B7919F14C6A62900F202D1 /* HTMLContentSelector.cpp */; };
+		57B791A414C6A62900F202D1 /* HTMLContentSelector.h in Headers */ = {isa = PBXBuildFile; fileRef = 57B791A014C6A62900F202D1 /* HTMLContentSelector.h */; };
 		57B791A514C6A62900F202D1 /* ContentSelectorQuery.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 57B791A114C6A62900F202D1 /* ContentSelectorQuery.cpp */; };
 		57B791A614C6A62900F202D1 /* ContentSelectorQuery.h in Headers */ = {isa = PBXBuildFile; fileRef = 57B791A214C6A62900F202D1 /* ContentSelectorQuery.h */; };
 		57B791A914C6A63300F202D1 /* HTMLContentElement.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 57B791A714C6A63300F202D1 /* HTMLContentElement.cpp */; };
 		57B791AA14C6A63300F202D1 /* HTMLContentElement.h in Headers */ = {isa = PBXBuildFile; fileRef = 57B791A814C6A63300F202D1 /* HTMLContentElement.h */; };
+		57CF497414EE36D700ECFF14 /* InsertionPoint.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 57CF497214EE36D700ECFF14 /* InsertionPoint.cpp */; };
+		57CF497514EE36D700ECFF14 /* InsertionPoint.h in Headers */ = {isa = PBXBuildFile; fileRef = 57CF497314EE36D700ECFF14 /* InsertionPoint.h */; };
 		5905ADBF1302F3CE00F116DF /* XMLTreeViewer.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 5905ADBD1302F3CE00F116DF /* XMLTreeViewer.cpp */; };
 		5905ADC01302F3CE00F116DF /* XMLTreeViewer.h in Headers */ = {isa = PBXBuildFile; fileRef = 5905ADBE1302F3CE00F116DF /* XMLTreeViewer.h */; };
 		590E1B4911E4EF4B0069F784 /* DeviceOrientation.h in Headers */ = {isa = PBXBuildFile; fileRef = 590E1B4811E4EF4B0069F784 /* DeviceOrientation.h */; settings = {ATTRIBUTES = (Private, ); }; };
@@ -1890,6 +1906,8 @@
 		7A24587C1021EAF4000A00AA /* InspectorDOMAgent.h in Headers */ = {isa = PBXBuildFile; fileRef = 7A24587A1021EAF4000A00AA /* InspectorDOMAgent.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		7A54857F14E02D51006AE05A /* InspectorHistory.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 7A54857D14E02D51006AE05A /* InspectorHistory.cpp */; };
 		7A54858014E02D51006AE05A /* InspectorHistory.h in Headers */ = {isa = PBXBuildFile; fileRef = 7A54857E14E02D51006AE05A /* InspectorHistory.h */; };
+		7A54881714E432A1006AE05A /* DOMPatchSupport.h in Headers */ = {isa = PBXBuildFile; fileRef = 7A54881514E432A1006AE05A /* DOMPatchSupport.h */; };
+		7A54881814E432A1006AE05A /* DOMPatchSupport.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 7A54881614E432A1006AE05A /* DOMPatchSupport.cpp */; };
 		7A674BDB0F9EBF4E006CF099 /* PageGroupLoadDeferrer.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 7A674BD90F9EBF4E006CF099 /* PageGroupLoadDeferrer.cpp */; };
 		7A674BDC0F9EBF4E006CF099 /* PageGroupLoadDeferrer.h in Headers */ = {isa = PBXBuildFile; fileRef = 7A674BDA0F9EBF4E006CF099 /* PageGroupLoadDeferrer.h */; };
 		7A74ECBA101839A600BF939E /* InspectorDOMStorageAgent.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 7A74ECB8101839A500BF939E /* InspectorDOMStorageAgent.cpp */; };
@@ -3307,7 +3325,8 @@
 		9705997A107D975200A50A7C /* PolicyChecker.h in Headers */ = {isa = PBXBuildFile; fileRef = 97059976107D975200A50A7C /* PolicyChecker.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		970B728A144FFAC600F00A37 /* EventInterfaces.h in Headers */ = {isa = PBXBuildFile; fileRef = 970B7289144FFAC600F00A37 /* EventInterfaces.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		970B72A6145008EB00F00A37 /* EventHeaders.h in Headers */ = {isa = PBXBuildFile; fileRef = 970B72A5145008EB00F00A37 /* EventHeaders.h */; };
-		971491DA12FD65E8001BFEB1 /* URLString.h in Headers */ = {isa = PBXBuildFile; fileRef = 971491D912FD65E8001BFEB1 /* URLString.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		9711460314EF009A00674FD9 /* NavigatorGeolocation.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 9711460014EF009A00674FD9 /* NavigatorGeolocation.cpp */; };
+		9711460414EF009A00674FD9 /* NavigatorGeolocation.h in Headers */ = {isa = PBXBuildFile; fileRef = 9711460114EF009A00674FD9 /* NavigatorGeolocation.h */; };
 		97205AAF123928CA00B17380 /* FTPDirectoryDocument.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 97205AAD123928CA00B17380 /* FTPDirectoryDocument.cpp */; };
 		97205AB0123928CA00B17380 /* FTPDirectoryDocument.h in Headers */ = {isa = PBXBuildFile; fileRef = 97205AAE123928CA00B17380 /* FTPDirectoryDocument.h */; };
 		97205AB51239291000B17380 /* ImageDocument.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 97205AB11239291000B17380 /* ImageDocument.cpp */; };
@@ -3324,12 +3343,31 @@
 		973DC640145A9409002842C2 /* ExceptionCodeDescription.h in Headers */ = {isa = PBXBuildFile; fileRef = 973DC63E145A9409002842C2 /* ExceptionCodeDescription.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		973E325610883B7C005BC493 /* ResourceLoadNotifier.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 973E325410883B7C005BC493 /* ResourceLoadNotifier.cpp */; };
 		973E325710883B7C005BC493 /* ResourceLoadNotifier.h in Headers */ = {isa = PBXBuildFile; fileRef = 973E325510883B7C005BC493 /* ResourceLoadNotifier.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		9746AF2314F4DDE6003E7A70 /* Geolocation.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 9746AF1314F4DDE6003E7A70 /* Geolocation.cpp */; };
+		9746AF2414F4DDE6003E7A70 /* Geolocation.h in Headers */ = {isa = PBXBuildFile; fileRef = 9746AF1414F4DDE6003E7A70 /* Geolocation.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		9746AF2614F4DDE6003E7A70 /* GeolocationController.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 9746AF1614F4DDE6003E7A70 /* GeolocationController.cpp */; };
+		9746AF2714F4DDE6003E7A70 /* GeolocationController.h in Headers */ = {isa = PBXBuildFile; fileRef = 9746AF1714F4DDE6003E7A70 /* GeolocationController.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		9746AF2814F4DDE6003E7A70 /* GeolocationError.h in Headers */ = {isa = PBXBuildFile; fileRef = 9746AF1814F4DDE6003E7A70 /* GeolocationError.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		9746AF2914F4DDE6003E7A70 /* GeolocationPosition.h in Headers */ = {isa = PBXBuildFile; fileRef = 9746AF1914F4DDE6003E7A70 /* GeolocationPosition.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		9746AF2A14F4DDE6003E7A70 /* Geoposition.h in Headers */ = {isa = PBXBuildFile; fileRef = 9746AF1A14F4DDE6003E7A70 /* Geoposition.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		9746AF2C14F4DDE6003E7A70 /* PositionCallback.h in Headers */ = {isa = PBXBuildFile; fileRef = 9746AF1C14F4DDE6003E7A70 /* PositionCallback.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		9746AF2E14F4DDE6003E7A70 /* PositionError.h in Headers */ = {isa = PBXBuildFile; fileRef = 9746AF1E14F4DDE6003E7A70 /* PositionError.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		9746AF3014F4DDE6003E7A70 /* PositionErrorCallback.h in Headers */ = {isa = PBXBuildFile; fileRef = 9746AF2014F4DDE6003E7A70 /* PositionErrorCallback.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		9746AF3214F4DDE6003E7A70 /* PositionOptions.h in Headers */ = {isa = PBXBuildFile; fileRef = 9746AF2214F4DDE6003E7A70 /* PositionOptions.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		974A862214B7ADBB003FDC76 /* FrameDestructionObserver.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 974A862014B7ADBB003FDC76 /* FrameDestructionObserver.cpp */; };
 		974A862314B7ADBB003FDC76 /* FrameDestructionObserver.h in Headers */ = {isa = PBXBuildFile; fileRef = 974A862114B7ADBB003FDC76 /* FrameDestructionObserver.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		974D2DA4146A535D00D51F8B /* SecurityPolicy.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 974D2DA2146A535D00D51F8B /* SecurityPolicy.cpp */; };
 		974D2DA5146A535D00D51F8B /* SecurityPolicy.h in Headers */ = {isa = PBXBuildFile; fileRef = 974D2DA3146A535D00D51F8B /* SecurityPolicy.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		9752D38D1413104B003305BD /* JSHTMLSpanElement.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 9752D38B1413104B003305BD /* JSHTMLSpanElement.cpp */; };
 		9752D38E1413104B003305BD /* JSHTMLSpanElement.h in Headers */ = {isa = PBXBuildFile; fileRef = 9752D38C1413104B003305BD /* JSHTMLSpanElement.h */; };
+		9759E93E14EF1CF80026A2DD /* LoadableTextTrack.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 9759E93414EF1CF80026A2DD /* LoadableTextTrack.cpp */; };
+		9759E93F14EF1CF80026A2DD /* TextTrack.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 9759E93514EF1CF80026A2DD /* TextTrack.cpp */; };
+		9759E94014EF1CF80026A2DD /* TextTrack.h in Headers */ = {isa = PBXBuildFile; fileRef = 9759E93614EF1CF80026A2DD /* TextTrack.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		9759E94214EF1CF80026A2DD /* TextTrackCue.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 9759E93814EF1CF80026A2DD /* TextTrackCue.cpp */; };
+		9759E94314EF1CF80026A2DD /* TextTrackCue.h in Headers */ = {isa = PBXBuildFile; fileRef = 9759E93914EF1CF80026A2DD /* TextTrackCue.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		9759E94514EF1CF80026A2DD /* TextTrackCueList.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 9759E93B14EF1CF80026A2DD /* TextTrackCueList.cpp */; };
+		9759E94614EF1CF80026A2DD /* TextTrackCueList.h in Headers */ = {isa = PBXBuildFile; fileRef = 9759E93C14EF1CF80026A2DD /* TextTrackCueList.h */; };
+		9759E94914EF1D490026A2DD /* LoadableTextTrack.h in Headers */ = {isa = PBXBuildFile; fileRef = 9759E94814EF1D490026A2DD /* LoadableTextTrack.h */; };
 		975CA28A130365F800E99AD9 /* Crypto.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 975CA287130365F800E99AD9 /* Crypto.cpp */; };
 		975CA28B130365F800E99AD9 /* Crypto.h in Headers */ = {isa = PBXBuildFile; fileRef = 975CA288130365F800E99AD9 /* Crypto.h */; };
 		975CA2A11303679D00E99AD9 /* JSCrypto.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 975CA29F1303679D00E99AD9 /* JSCrypto.cpp */; };
@@ -3424,12 +3462,16 @@
 		97C078501165D5BE003A32EF /* SuffixTree.h in Headers */ = {isa = PBXBuildFile; fileRef = 97C0784F1165D5BE003A32EF /* SuffixTree.h */; };
 		97C471DB12F925BD0086354B /* ContentSecurityPolicy.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 97C471D912F925BC0086354B /* ContentSecurityPolicy.cpp */; };
 		97C471DC12F925BD0086354B /* ContentSecurityPolicy.h in Headers */ = {isa = PBXBuildFile; fileRef = 97C471DA12F925BD0086354B /* ContentSecurityPolicy.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		97CC3AE214E8E4A200894988 /* NavigatorSupplement.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 97CC3AE014E8E4A200894988 /* NavigatorSupplement.cpp */; };
+		97CC3AE314E8E4A200894988 /* NavigatorSupplement.h in Headers */ = {isa = PBXBuildFile; fileRef = 97CC3AE114E8E4A200894988 /* NavigatorSupplement.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		97D2AD0314B823A60093DF32 /* DOMWindowProperty.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 97D2AD0114B823A60093DF32 /* DOMWindowProperty.cpp */; };
 		97D2AD0414B823A60093DF32 /* DOMWindowProperty.h in Headers */ = {isa = PBXBuildFile; fileRef = 97D2AD0214B823A60093DF32 /* DOMWindowProperty.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		97DCE20110807C750057D394 /* HistoryController.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 97DCE1FF10807C750057D394 /* HistoryController.cpp */; };
 		97DCE20210807C750057D394 /* HistoryController.h in Headers */ = {isa = PBXBuildFile; fileRef = 97DCE20010807C750057D394 /* HistoryController.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		97E4028F13A696ED00913D67 /* IconController.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 97E4028D13A696ED00913D67 /* IconController.cpp */; };
 		97E4029013A696ED00913D67 /* IconController.h in Headers */ = {isa = PBXBuildFile; fileRef = 97E4028E13A696ED00913D67 /* IconController.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		97E4A12614F4C5D400870E43 /* NavigatorRegisterProtocolHandler.h in Headers */ = {isa = PBXBuildFile; fileRef = 9730BE1514EF286B00DF06B9 /* NavigatorRegisterProtocolHandler.h */; };
+		97E4A12714F4C5D700870E43 /* NavigatorRegisterProtocolHandler.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 9730BE1414EF286B00DF06B9 /* NavigatorRegisterProtocolHandler.cpp */; };
 		97EF7DFE107E55B700D7C49C /* ScriptControllerBase.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 97EF7DFD107E55B700D7C49C /* ScriptControllerBase.cpp */; };
 		984264F112D5280A000D88A4 /* LinkLoaderClient.h in Headers */ = {isa = PBXBuildFile; fileRef = 984264EF12D5280A000D88A4 /* LinkLoaderClient.h */; };
 		985BB96D13A94058007A0B69 /* LinkRelAttribute.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 985BB96B13A94058007A0B69 /* LinkRelAttribute.cpp */; };
@@ -3479,6 +3521,8 @@
 		A0EE0DF6144F825500F80B0D /* WebGLDebugRendererInfo.h in Headers */ = {isa = PBXBuildFile; fileRef = A0EE0DF2144F825500F80B0D /* WebGLDebugRendererInfo.h */; };
 		A0EE0DF7144F825500F80B0D /* WebGLDebugShaders.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A0EE0DF3144F825500F80B0D /* WebGLDebugShaders.cpp */; };
 		A0EE0DF8144F825500F80B0D /* WebGLDebugShaders.h in Headers */ = {isa = PBXBuildFile; fileRef = A0EE0DF4144F825500F80B0D /* WebGLDebugShaders.h */; };
+		A104F24314C71F7A009E2C23 /* CachedSVGDocument.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A104F24114C71F7A009E2C23 /* CachedSVGDocument.cpp */; };
+		A104F24414C71F7A009E2C23 /* CachedSVGDocument.h in Headers */ = {isa = PBXBuildFile; fileRef = A104F24214C71F7A009E2C23 /* CachedSVGDocument.h */; };
 		A10BB5851484E3A700B2E87A /* RenderSVGRect.h in Headers */ = {isa = PBXBuildFile; fileRef = A10BB5831484E3A700B2E87A /* RenderSVGRect.h */; };
 		A10BB58B1484E3B300B2E87A /* RenderSVGShape.h in Headers */ = {isa = PBXBuildFile; fileRef = A10BB5891484E3B300B2E87A /* RenderSVGShape.h */; };
 		A10DC76A14747BAB005E2471 /* StyleGridData.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A10DC76814747BAB005E2471 /* StyleGridData.cpp */; };
@@ -3541,6 +3585,8 @@
 		A715E653134BBBEC00D8E713 /* ProgressShadowElement.h in Headers */ = {isa = PBXBuildFile; fileRef = A715E651134BBBEC00D8E713 /* ProgressShadowElement.h */; };
 		A718760E0B2A120100A16ECE /* DragActions.h in Headers */ = {isa = PBXBuildFile; fileRef = A718760D0B2A120100A16ECE /* DragActions.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		A71878900B2D04AC00A16ECE /* DragControllerMac.mm in Sources */ = {isa = PBXBuildFile; fileRef = A718788F0B2D04AC00A16ECE /* DragControllerMac.mm */; };
+		A71E083714E3CEAF006A4619 /* PageSupplement.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A71E083514E3CEAF006A4619 /* PageSupplement.cpp */; };
+		A71E083814E3CEAF006A4619 /* PageSupplement.h in Headers */ = {isa = PBXBuildFile; fileRef = A71E083614E3CEAF006A4619 /* PageSupplement.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		A723F77B1484CA4C008C6DBE /* PlatformExportMacros.h in Headers */ = {isa = PBXBuildFile; fileRef = A723F77A1484CA4C008C6DBE /* PlatformExportMacros.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		A73F95FE12C97BFE0031AAF9 /* RoundedRect.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A73F95FC12C97BFE0031AAF9 /* RoundedRect.cpp */; };
 		A73F95FF12C97BFE0031AAF9 /* RoundedRect.h in Headers */ = {isa = PBXBuildFile; fileRef = A73F95FD12C97BFE0031AAF9 /* RoundedRect.h */; settings = {ATTRIBUTES = (Private, ); }; };
@@ -3613,14 +3659,12 @@
 		A80E6CE80A1989CA007FB8C5 /* ShadowValue.h in Headers */ = {isa = PBXBuildFile; fileRef = A80E6CBE0A1989CA007FB8C5 /* ShadowValue.h */; };
 		A80E6CE90A1989CA007FB8C5 /* CSSValueList.h in Headers */ = {isa = PBXBuildFile; fileRef = A80E6CBF0A1989CA007FB8C5 /* CSSValueList.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		A80E6CEB0A1989CA007FB8C5 /* CSSImportRule.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A80E6CC10A1989CA007FB8C5 /* CSSImportRule.cpp */; };
-		A80E6CEC0A1989CA007FB8C5 /* FontFamilyValue.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A80E6CC20A1989CA007FB8C5 /* FontFamilyValue.cpp */; };
 		A80E6CED0A1989CA007FB8C5 /* FontValue.h in Headers */ = {isa = PBXBuildFile; fileRef = A80E6CC30A1989CA007FB8C5 /* FontValue.h */; };
 		A80E6CEE0A1989CA007FB8C5 /* CSSValue.h in Headers */ = {isa = PBXBuildFile; fileRef = A80E6CC40A1989CA007FB8C5 /* CSSValue.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		A80E6CEF0A1989CA007FB8C5 /* CSSStyleRule.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A80E6CC50A1989CA007FB8C5 /* CSSStyleRule.cpp */; };
 		A80E6CF00A1989CA007FB8C5 /* CSSInheritedValue.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A80E6CC60A1989CA007FB8C5 /* CSSInheritedValue.cpp */; };
 		A80E6CF10A1989CA007FB8C5 /* FontValue.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A80E6CC70A1989CA007FB8C5 /* FontValue.cpp */; };
 		A80E6CF20A1989CA007FB8C5 /* CSSRuleList.h in Headers */ = {isa = PBXBuildFile; fileRef = A80E6CC80A1989CA007FB8C5 /* CSSRuleList.h */; settings = {ATTRIBUTES = (Private, ); }; };
-		A80E6CF30A1989CA007FB8C5 /* FontFamilyValue.h in Headers */ = {isa = PBXBuildFile; fileRef = A80E6CC90A1989CA007FB8C5 /* FontFamilyValue.h */; };
 		A80E6CF40A1989CA007FB8C5 /* ShadowValue.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A80E6CCA0A1989CA007FB8C5 /* ShadowValue.cpp */; };
 		A80E6CF50A1989CA007FB8C5 /* CSSPageRule.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A80E6CCB0A1989CA007FB8C5 /* CSSPageRule.cpp */; };
 		A80E6CF60A1989CA007FB8C5 /* CSSImportRule.h in Headers */ = {isa = PBXBuildFile; fileRef = A80E6CCC0A1989CA007FB8C5 /* CSSImportRule.h */; settings = {ATTRIBUTES = (Private, ); }; };
@@ -4268,14 +4312,6 @@
 		B10B6981140C174000BC1C26 /* WebVTTTokenizer.cpp in Sources */ = {isa = PBXBuildFile; fileRef = B10B697E140C174000BC1C26 /* WebVTTTokenizer.cpp */; };
 		B10B6982140C174000BC1C26 /* WebVTTTokenizer.h in Headers */ = {isa = PBXBuildFile; fileRef = B10B697F140C174000BC1C26 /* WebVTTTokenizer.h */; };
 		B1827493134CA4C100B98C2D /* CallbackFunction.cpp in Sources */ = {isa = PBXBuildFile; fileRef = B1827492134CA4C100B98C2D /* CallbackFunction.cpp */; };
-		B1AD4E5E13A12A0B00846B27 /* LoadableTextTrack.cpp in Sources */ = {isa = PBXBuildFile; fileRef = B1AD4E4D13A12A0B00846B27 /* LoadableTextTrack.cpp */; };
-		B1AD4E5F13A12A0B00846B27 /* LoadableTextTrack.h in Headers */ = {isa = PBXBuildFile; fileRef = B1AD4E4E13A12A0B00846B27 /* LoadableTextTrack.h */; };
-		B1AD4E6613A12A0B00846B27 /* TextTrack.cpp in Sources */ = {isa = PBXBuildFile; fileRef = B1AD4E5513A12A0B00846B27 /* TextTrack.cpp */; };
-		B1AD4E6713A12A0B00846B27 /* TextTrack.h in Headers */ = {isa = PBXBuildFile; fileRef = B1AD4E5613A12A0B00846B27 /* TextTrack.h */; settings = {ATTRIBUTES = (Private, ); }; };
-		B1AD4E6813A12A0B00846B27 /* TextTrackCue.cpp in Sources */ = {isa = PBXBuildFile; fileRef = B1AD4E5713A12A0B00846B27 /* TextTrackCue.cpp */; };
-		B1AD4E6913A12A0B00846B27 /* TextTrackCue.h in Headers */ = {isa = PBXBuildFile; fileRef = B1AD4E5813A12A0B00846B27 /* TextTrackCue.h */; settings = {ATTRIBUTES = (Private, ); }; };
-		B1AD4E6A13A12A0B00846B27 /* TextTrackCueList.cpp in Sources */ = {isa = PBXBuildFile; fileRef = B1AD4E5913A12A0B00846B27 /* TextTrackCueList.cpp */; };
-		B1AD4E6B13A12A0B00846B27 /* TextTrackCueList.h in Headers */ = {isa = PBXBuildFile; fileRef = B1AD4E5A13A12A0B00846B27 /* TextTrackCueList.h */; };
 		B1AD4E7313A12A4600846B27 /* TextTrackLoader.cpp in Sources */ = {isa = PBXBuildFile; fileRef = B1AD4E7113A12A4600846B27 /* TextTrackLoader.cpp */; };
 		B1AD4E7413A12A4600846B27 /* TextTrackLoader.h in Headers */ = {isa = PBXBuildFile; fileRef = B1AD4E7213A12A4600846B27 /* TextTrackLoader.h */; };
 		B1D5ECB5134B58DA0087C78F /* CallbackFunction.h in Headers */ = {isa = PBXBuildFile; fileRef = B1D5ECB4134B58DA0087C78F /* CallbackFunction.h */; };
@@ -5126,11 +5162,7 @@
 		BC53DA601143141A000D817E /* DOMObjectHashTableMap.h in Headers */ = {isa = PBXBuildFile; fileRef = BC53DA5F1143141A000D817E /* DOMObjectHashTableMap.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		BC53DA62114314BD000D817E /* DOMObjectHashTableMap.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC53DA61114314BD000D817E /* DOMObjectHashTableMap.cpp */; };
 		BC53DAC711433064000D817E /* JSDOMWrapper.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC53DAC611433064000D817E /* JSDOMWrapper.cpp */; };
-		BC56CB2110D5AC8000A77C64 /* GeolocationController.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC56CB1C10D5AC8000A77C64 /* GeolocationController.cpp */; };
-		BC56CB2210D5AC8000A77C64 /* GeolocationController.h in Headers */ = {isa = PBXBuildFile; fileRef = BC56CB1D10D5AC8000A77C64 /* GeolocationController.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		BC56CB2310D5AC8000A77C64 /* GeolocationClient.h in Headers */ = {isa = PBXBuildFile; fileRef = BC56CB1E10D5AC8000A77C64 /* GeolocationClient.h */; settings = {ATTRIBUTES = (Private, ); }; };
-		BC56CB2410D5AC8000A77C64 /* GeolocationError.h in Headers */ = {isa = PBXBuildFile; fileRef = BC56CB1F10D5AC8000A77C64 /* GeolocationError.h */; settings = {ATTRIBUTES = (Private, ); }; };
-		BC56CB2510D5AC8000A77C64 /* GeolocationPosition.h in Headers */ = {isa = PBXBuildFile; fileRef = BC56CB2010D5AC8000A77C64 /* GeolocationPosition.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		BC5823F50C0A98DF0053F1B5 /* JSHTMLElementCustom.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC5823F40C0A98DF0053F1B5 /* JSHTMLElementCustom.cpp */; };
 		BC5825F30C0B89380053F1B5 /* JSCSSStyleDeclarationCustom.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC5825F20C0B89380053F1B5 /* JSCSSStyleDeclarationCustom.cpp */; };
 		BC588AF00BFA6CF900EE679E /* HTMLParserErrorCodes.h in Headers */ = {isa = PBXBuildFile; fileRef = BC588AEF0BFA6CF900EE679E /* HTMLParserErrorCodes.h */; };
@@ -5143,7 +5175,6 @@
 		BC5A86B60C3367E800EEA649 /* JSDOMSelection.h in Headers */ = {isa = PBXBuildFile; fileRef = BC5A86B40C3367E800EEA649 /* JSDOMSelection.h */; };
 		BC5C762A1497FE1400BC4775 /* PlatformEvent.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC5C76281497FE1400BC4775 /* PlatformEvent.cpp */; };
 		BC5C762B1497FE1400BC4775 /* PlatformEvent.h in Headers */ = {isa = PBXBuildFile; fileRef = BC5C76291497FE1400BC4775 /* PlatformEvent.h */; settings = {ATTRIBUTES = (Private, ); }; };
-		BC5CFCA911F793320099ED09 /* LocalizationStrategy.h in Headers */ = {isa = PBXBuildFile; fileRef = BC5CFCA811F793320099ED09 /* LocalizationStrategy.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		BC5EB5DB0E81B7EA00B25965 /* BorderValue.h in Headers */ = {isa = PBXBuildFile; fileRef = BC5EB5DA0E81B7EA00B25965 /* BorderValue.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		BC5EB5DD0E81B8DD00B25965 /* OutlineValue.h in Headers */ = {isa = PBXBuildFile; fileRef = BC5EB5DC0E81B8DD00B25965 /* OutlineValue.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		BC5EB5DF0E81B9AB00B25965 /* CollapsedBorderValue.h in Headers */ = {isa = PBXBuildFile; fileRef = BC5EB5DE0E81B9AB00B25965 /* CollapsedBorderValue.h */; settings = {ATTRIBUTES = (Private, ); }; };
@@ -5347,8 +5378,6 @@
 		BCC065880F3CE2A700CD2D87 /* JSClientRect.h in Headers */ = {isa = PBXBuildFile; fileRef = BCC065840F3CE2A700CD2D87 /* JSClientRect.h */; };
 		BCC065890F3CE2A700CD2D87 /* JSClientRectList.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BCC065850F3CE2A700CD2D87 /* JSClientRectList.cpp */; };
 		BCC0658A0F3CE2A700CD2D87 /* JSClientRectList.h in Headers */ = {isa = PBXBuildFile; fileRef = BCC065860F3CE2A700CD2D87 /* JSClientRectList.h */; };
-		BCC36EB81342AA3F004BEEF7 /* DefaultLocalizationStrategy.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BCC36EB61342AA3F004BEEF7 /* DefaultLocalizationStrategy.cpp */; };
-		BCC36EB91342AA3F004BEEF7 /* DefaultLocalizationStrategy.h in Headers */ = {isa = PBXBuildFile; fileRef = BCC36EB71342AA3F004BEEF7 /* DefaultLocalizationStrategy.h */; };
 		BCC438780E886CC700533DD5 /* JSHTMLInputElementCustom.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BCC438770E886CC700533DD5 /* JSHTMLInputElementCustom.cpp */; };
 		BCC573350D695BBE006EF517 /* DOMProgressEvent.h in Headers */ = {isa = PBXBuildFile; fileRef = BCC573330D695BBE006EF517 /* DOMProgressEvent.h */; };
 		BCC573360D695BBE006EF517 /* DOMProgressEvent.mm in Sources */ = {isa = PBXBuildFile; fileRef = BCC573340D695BBE006EF517 /* DOMProgressEvent.mm */; };
@@ -5567,6 +5596,9 @@
 		C585A6FC11D4FB3D004C3E4B /* IDBFactoryBackendImpl.h in Headers */ = {isa = PBXBuildFile; fileRef = C585A6C811D4FB3D004C3E4B /* IDBFactoryBackendImpl.h */; };
 		C585A6FD11D4FB3D004C3E4B /* IDBFactory.cpp in Sources */ = {isa = PBXBuildFile; fileRef = C585A6C911D4FB3D004C3E4B /* IDBFactory.cpp */; };
 		C585A6FE11D4FB3D004C3E4B /* IDBFactory.h in Headers */ = {isa = PBXBuildFile; fileRef = C585A6CA11D4FB3D004C3E4B /* IDBFactory.h */; };
+		C598902E14E9B0F800E8D18B /* PlatformPasteboardMac.mm in Sources */ = {isa = PBXBuildFile; fileRef = C5F765BA14E1ECF4006C899B /* PlatformPasteboardMac.mm */; };
+		C598905714E9C28000E8D18B /* PasteboardStrategy.h in Headers */ = {isa = PBXBuildFile; fileRef = C5F765B414E1D414006C899B /* PasteboardStrategy.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		C598905814E9C29900E8D18B /* PlatformPasteboard.h in Headers */ = {isa = PBXBuildFile; fileRef = C5BAC16F14E30E4700008837 /* PlatformPasteboard.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		C5D4AA7A116BAFB60069CA93 /* GlyphMetricsMap.h in Headers */ = {isa = PBXBuildFile; fileRef = C5D4AA78116BAFB60069CA93 /* GlyphMetricsMap.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		C5E9B67710697E1300C7BB1A /* StorageEventDispatcher.cpp in Sources */ = {isa = PBXBuildFile; fileRef = C5E9B67610697E1300C7BB1A /* StorageEventDispatcher.cpp */; };
 		C5EBDD84105EDDEC0056816F /* StorageEventDispatcher.h in Headers */ = {isa = PBXBuildFile; fileRef = C5EBDD81105EDDEC0056816F /* StorageEventDispatcher.h */; };
@@ -5855,12 +5887,15 @@
 		E4AFD00E0DAF335500F5F55C /* SMILTimeContainer.h in Headers */ = {isa = PBXBuildFile; fileRef = E4AFD0080DAF335400F5F55C /* SMILTimeContainer.h */; };
 		E4AFD00F0DAF335500F5F55C /* SVGSMILElement.cpp in Sources */ = {isa = PBXBuildFile; fileRef = E4AFD0090DAF335400F5F55C /* SVGSMILElement.cpp */; };
 		E4AFD0100DAF335500F5F55C /* SVGSMILElement.h in Headers */ = {isa = PBXBuildFile; fileRef = E4AFD00A0DAF335400F5F55C /* SVGSMILElement.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		E4BBED0E14F4025D003F0B98 /* PropertySetCSSStyleDeclaration.cpp in Sources */ = {isa = PBXBuildFile; fileRef = E4BBED0C14F4025D003F0B98 /* PropertySetCSSStyleDeclaration.cpp */; };
+		E4BBED0F14F4025D003F0B98 /* PropertySetCSSStyleDeclaration.h in Headers */ = {isa = PBXBuildFile; fileRef = E4BBED0D14F4025D003F0B98 /* PropertySetCSSStyleDeclaration.h */; };
 		E4C1789A0EE6903800824D69 /* CSSSelectorList.cpp in Sources */ = {isa = PBXBuildFile; fileRef = E4C178950EE6903800824D69 /* CSSSelectorList.cpp */; };
 		E4C1789B0EE6903800824D69 /* CSSSelectorList.h in Headers */ = {isa = PBXBuildFile; fileRef = E4C178960EE6903800824D69 /* CSSSelectorList.h */; };
 		E4C279580CF9741900E97B98 /* RenderMedia.cpp in Sources */ = {isa = PBXBuildFile; fileRef = E4C279560CF9741900E97B98 /* RenderMedia.cpp */; };
 		E4C279590CF9741900E97B98 /* RenderMedia.h in Headers */ = {isa = PBXBuildFile; fileRef = E4C279570CF9741900E97B98 /* RenderMedia.h */; };
 		E4D687770ED7AE3D006EA978 /* PurgeableBufferMac.cpp in Sources */ = {isa = PBXBuildFile; fileRef = E4D687760ED7AE3D006EA978 /* PurgeableBufferMac.cpp */; };
 		E4D687790ED7AE4F006EA978 /* PurgeableBuffer.h in Headers */ = {isa = PBXBuildFile; fileRef = E4D687780ED7AE4F006EA978 /* PurgeableBuffer.h */; };
+		EB49DB8F14F46E8B002299D9 /* IDBTracing.h in Headers */ = {isa = PBXBuildFile; fileRef = EB49DB8E14F46E8B002299D9 /* IDBTracing.h */; };
 		ED2BA83C09A24B91006C0AC4 /* DocumentMarker.h in Headers */ = {isa = PBXBuildFile; fileRef = ED2BA83B09A24B91006C0AC4 /* DocumentMarker.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		ED501DC60B249F2900AE18D9 /* EditorMac.mm in Sources */ = {isa = PBXBuildFile; fileRef = ED501DC50B249F2900AE18D9 /* EditorMac.mm */; };
 		EDE3A5000C7A430600956A37 /* ColorMac.h in Headers */ = {isa = PBXBuildFile; fileRef = EDE3A4FF0C7A430600956A37 /* ColorMac.h */; settings = {ATTRIBUTES = (Private, ); }; };
@@ -5868,6 +5903,8 @@
 		F316396B1329481A00A649CB /* InjectedScriptManager.cpp in Sources */ = {isa = PBXBuildFile; fileRef = F31639691329481A00A649CB /* InjectedScriptManager.cpp */; };
 		F316396C1329481A00A649CB /* InjectedScriptManager.h in Headers */ = {isa = PBXBuildFile; fileRef = F316396A1329481A00A649CB /* InjectedScriptManager.h */; };
 		F316396E1329487600A649CB /* JSInjectedScriptManager.cpp in Sources */ = {isa = PBXBuildFile; fileRef = F316396D1329487600A649CB /* JSInjectedScriptManager.cpp */; };
+		F325A40A14EE36FA007324E2 /* InspectorCounters.cpp in Sources */ = {isa = PBXBuildFile; fileRef = F325A40814EE36FA007324E2 /* InspectorCounters.cpp */; };
+		F325A40B14EE36FA007324E2 /* InspectorCounters.h in Headers */ = {isa = PBXBuildFile; fileRef = F325A40914EE36FA007324E2 /* InspectorCounters.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		F3335BF812E07DC300D33011 /* InspectorConsoleAgent.cpp in Sources */ = {isa = PBXBuildFile; fileRef = F3335BF612E07DC300D33011 /* InspectorConsoleAgent.cpp */; };
 		F3335BF912E07DC300D33011 /* InspectorConsoleAgent.h in Headers */ = {isa = PBXBuildFile; fileRef = F3335BF712E07DC300D33011 /* InspectorConsoleAgent.h */; };
 		F33F0282120947F200E5743A /* ScriptProfile.cpp in Sources */ = {isa = PBXBuildFile; fileRef = F33F0281120947F200E5743A /* ScriptProfile.cpp */; };
@@ -6210,13 +6247,6 @@
 		FE6FD48E0F676E9300092873 /* JSCoordinates.h in Headers */ = {isa = PBXBuildFile; fileRef = FE6FD48C0F676E9300092873 /* JSCoordinates.h */; };
 		FE700DD10F92D81A008E2BFE /* JSCoordinatesCustom.cpp in Sources */ = {isa = PBXBuildFile; fileRef = FE700DD00F92D81A008E2BFE /* JSCoordinatesCustom.cpp */; };
 		FE80D7AB0E9C1ED2000D6F75 /* JSGeolocationCustom.cpp in Sources */ = {isa = PBXBuildFile; fileRef = FE80D7A60E9C1ED2000D6F75 /* JSGeolocationCustom.cpp */; };
-		FE80D7C50E9C1F25000D6F75 /* Geolocation.cpp in Sources */ = {isa = PBXBuildFile; fileRef = FE80D7B70E9C1F25000D6F75 /* Geolocation.cpp */; };
-		FE80D7C60E9C1F25000D6F75 /* Geolocation.h in Headers */ = {isa = PBXBuildFile; fileRef = FE80D7B80E9C1F25000D6F75 /* Geolocation.h */; settings = {ATTRIBUTES = (Private, ); }; };
-		FE80D7C90E9C1F25000D6F75 /* Geoposition.h in Headers */ = {isa = PBXBuildFile; fileRef = FE80D7BB0E9C1F25000D6F75 /* Geoposition.h */; settings = {ATTRIBUTES = (Private, ); }; };
-		FE80D7CB0E9C1F25000D6F75 /* PositionCallback.h in Headers */ = {isa = PBXBuildFile; fileRef = FE80D7BD0E9C1F25000D6F75 /* PositionCallback.h */; settings = {ATTRIBUTES = (Private, ); }; };
-		FE80D7CD0E9C1F25000D6F75 /* PositionError.h in Headers */ = {isa = PBXBuildFile; fileRef = FE80D7BF0E9C1F25000D6F75 /* PositionError.h */; settings = {ATTRIBUTES = (Private, ); }; };
-		FE80D7CF0E9C1F25000D6F75 /* PositionErrorCallback.h in Headers */ = {isa = PBXBuildFile; fileRef = FE80D7C10E9C1F25000D6F75 /* PositionErrorCallback.h */; settings = {ATTRIBUTES = (Private, ); }; };
-		FE80D7D10E9C1F25000D6F75 /* PositionOptions.h in Headers */ = {isa = PBXBuildFile; fileRef = FE80D7C30E9C1F25000D6F75 /* PositionOptions.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		FE80DA630E9C4703000D6F75 /* JSGeolocation.cpp in Sources */ = {isa = PBXBuildFile; fileRef = FE80DA5F0E9C4703000D6F75 /* JSGeolocation.cpp */; };
 		FE80DA640E9C4703000D6F75 /* JSGeolocation.h in Headers */ = {isa = PBXBuildFile; fileRef = FE80DA600E9C4703000D6F75 /* JSGeolocation.h */; };
 		FE80DA650E9C4703000D6F75 /* JSGeoposition.cpp in Sources */ = {isa = PBXBuildFile; fileRef = FE80DA610E9C4703000D6F75 /* JSGeoposition.cpp */; };
@@ -6773,9 +6803,6 @@
 		0707568A142262D600414161 /* HTMLTrackElement.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = HTMLTrackElement.idl; sourceTree = "<group>"; };
 		0707568E1422668C00414161 /* JSTextTrack.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSTextTrack.cpp; sourceTree = "<group>"; };
 		0707568F1422668C00414161 /* JSTextTrack.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSTextTrack.h; sourceTree = "<group>"; };
-		0707569C1422979800414161 /* TextTrack.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = TextTrack.idl; sourceTree = "<group>"; };
-		0707569D1422979800414161 /* TextTrackCue.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = TextTrackCue.idl; sourceTree = "<group>"; };
-		0707569E1422979800414161 /* TextTrackCueList.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = TextTrackCueList.idl; sourceTree = "<group>"; };
 		070756D114239A4E00414161 /* JSHTMLTrackElement.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSHTMLTrackElement.cpp; sourceTree = "<group>"; };
 		070756D214239A4E00414161 /* JSHTMLTrackElement.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSHTMLTrackElement.h; sourceTree = "<group>"; };
 		070756D714239B4B00414161 /* JSTextTrackCue.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSTextTrackCue.cpp; sourceTree = "<group>"; };
@@ -7002,6 +7029,12 @@
 		1432E8480C51493F00B1500F /* GCController.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = GCController.cpp; sourceTree = "<group>"; };
 		1449E24A107D4A8400B5793F /* JSCallbackData.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSCallbackData.h; sourceTree = "<group>"; };
 		1449E286107D4DB400B5793F /* JSCallbackData.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSCallbackData.cpp; sourceTree = "<group>"; };
+		144FCE5114EC79BC000D17A3 /* FractionalLayoutUnit.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = FractionalLayoutUnit.h; sourceTree = "<group>"; };
+		144FCE5414EC79E7000D17A3 /* FractionalLayoutPoint.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = FractionalLayoutPoint.h; sourceTree = "<group>"; };
+		144FCE5714EC79E7000D17A3 /* FractionalLayoutSize.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = FractionalLayoutSize.cpp; sourceTree = "<group>"; };
+		144FCE5814EC79E7000D17A3 /* FractionalLayoutSize.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = FractionalLayoutSize.h; sourceTree = "<group>"; };
+		144FCFDE14EF2509000D17A3 /* FractionalLayoutRect.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = FractionalLayoutRect.cpp; sourceTree = "<group>"; };
+		144FCFDF14EF2509000D17A3 /* FractionalLayoutRect.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = FractionalLayoutRect.h; sourceTree = "<group>"; };
 		1464E06B135EC10600FDB00A /* JSMediaListCustom.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSMediaListCustom.cpp; sourceTree = "<group>"; };
 		1477E7740BF4134A00152872 /* PageCache.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = PageCache.cpp; sourceTree = "<group>"; };
 		1477E7750BF4134A00152872 /* PageCache.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = PageCache.h; sourceTree = "<group>"; };
@@ -7020,10 +7053,10 @@
 		14947FFC12F80CD200A0F631 /* DocumentOrderedMap.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DocumentOrderedMap.h; sourceTree = "<group>"; };
 		14993BE30B2F2B1C0050497F /* FocusController.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = FocusController.cpp; sourceTree = "<group>"; };
 		14993BE40B2F2B1C0050497F /* FocusController.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = FocusController.h; sourceTree = "<group>"; };
-		14A98E05136386A200C9FED2 /* Blob.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; name = Blob.idl; path = ../../../webkit/Source/WebCore/fileapi/Blob.idl; sourceTree = SOURCE_ROOT; };
-		14BDF5971365392C00148393 /* DOMFileSystem.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; name = DOMFileSystem.idl; path = ../../../webkit/Source/WebCore/fileapi/DOMFileSystem.idl; sourceTree = SOURCE_ROOT; };
-		14BDF59A1365399100148393 /* FileReader.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; name = FileReader.idl; path = ../../../webkit/Source/WebCore/fileapi/FileReader.idl; sourceTree = SOURCE_ROOT; };
-		14BDF59C136539BE00148393 /* FileWriter.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; name = FileWriter.idl; path = ../../../webkit/Source/WebCore/fileapi/FileWriter.idl; sourceTree = SOURCE_ROOT; };
+		14A98E05136386A200C9FED2 /* Blob.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; name = Blob.idl; path = fileapi/Blob.idl; sourceTree = SOURCE_ROOT; };
+		14BDF5971365392C00148393 /* DOMFileSystem.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; name = DOMFileSystem.idl; path = fileapi/DOMFileSystem.idl; sourceTree = SOURCE_ROOT; };
+		14BDF59A1365399100148393 /* FileReader.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; name = FileReader.idl; path = fileapi/FileReader.idl; sourceTree = SOURCE_ROOT; };
+		14BDF59C136539BE00148393 /* FileWriter.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; name = FileWriter.idl; path = fileapi/FileWriter.idl; sourceTree = SOURCE_ROOT; };
 		14C9A5E90B3D105F005A0232 /* Settings.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = Settings.cpp; sourceTree = "<group>"; };
 		14CD8D81106B529000A46D23 /* JSSharedWorkerCustom.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSSharedWorkerCustom.cpp; sourceTree = "<group>"; };
 		14CF787109F587CA00EB3665 /* CSSValue.idl */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = text; path = CSSValue.idl; sourceTree = "<group>"; };
@@ -7365,6 +7398,9 @@
 		1AFE11980CBFFCC4003017FA /* JSSQLResultSetRowList.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSSQLResultSetRowList.h; sourceTree = "<group>"; };
 		1C2649790D7E248A00BD10F2 /* DocumentLoaderMac.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = DocumentLoaderMac.cpp; sourceTree = "<group>"; };
 		1C26497B0D7E24EC00BD10F2 /* PageMac.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = PageMac.cpp; sourceTree = "<group>"; };
+		1C435CD314E8544F004E10EA /* Inspector.json */ = {isa = PBXFileReference; lastKnownFileType = text; path = Inspector.json; sourceTree = "<group>"; };
+		1C435CD414E8545B004E10EA /* Inspector-0.1.json */ = {isa = PBXFileReference; lastKnownFileType = text; path = "Inspector-0.1.json"; sourceTree = "<group>"; };
+		1C435CD514E8545B004E10EA /* Inspector-1.0.json */ = {isa = PBXFileReference; lastKnownFileType = text; path = "Inspector-1.0.json"; sourceTree = "<group>"; };
 		1C4C8EFF0AD85D87009475CE /* DeleteButtonController.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = DeleteButtonController.cpp; sourceTree = "<group>"; tabWidth = 8; usesTabs = 0; };
 		1C4C8F000AD85D87009475CE /* DeleteButtonController.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DeleteButtonController.h; sourceTree = "<group>"; tabWidth = 8; usesTabs = 0; };
 		1C4C8F630AD8655D009475CE /* DeleteButton.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = DeleteButton.cpp; sourceTree = "<group>"; tabWidth = 8; usesTabs = 0; };
@@ -7760,6 +7796,7 @@
 		37F818FC0D657606005E1F05 /* WebCoreURLResponse.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = WebCoreURLResponse.mm; sourceTree = "<group>"; };
 		37FC96DA1104ED71003E1FAD /* TrailingFloatsRootInlineBox.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = TrailingFloatsRootInlineBox.h; sourceTree = "<group>"; };
 		37FD4297118368460093C029 /* TreeDepthLimit.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = TreeDepthLimit.h; sourceTree = "<group>"; };
+		3866AF3714F1C17100283D68 /* ScrollingCoordinatorNone.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ScrollingCoordinatorNone.cpp; sourceTree = "<group>"; };
 		3AB02D2812D4F91600FBB694 /* StorageTracker.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = StorageTracker.h; sourceTree = "<group>"; };
 		3AB02D2912D4F91600FBB694 /* StorageTracker.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = StorageTracker.cpp; sourceTree = "<group>"; };
 		3AC367FE12EF7A09006A3D6F /* StorageTrackerClient.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = StorageTrackerClient.h; sourceTree = "<group>"; };
@@ -8197,11 +8234,14 @@
 		4A1E719414E101F900626F9D /* JSHTMLShadowElement.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSHTMLShadowElement.h; sourceTree = "<group>"; };
 		4A1E71A314E106AC00626F9D /* JSShadowRoot.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSShadowRoot.cpp; sourceTree = "<group>"; };
 		4A1E71A414E106AC00626F9D /* JSShadowRoot.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSShadowRoot.h; sourceTree = "<group>"; };
+		4A4A234514F1E1440046FBF1 /* WebSocketFrame.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WebSocketFrame.h; sourceTree = "<group>"; };
 		4A6E9FC113C17D1D0046A7F8 /* FontFeatureValue.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = FontFeatureValue.cpp; sourceTree = "<group>"; };
 		4A6E9FC213C17D1D0046A7F8 /* FontFeatureValue.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = FontFeatureValue.h; sourceTree = "<group>"; };
 		4A6E9FC513C17D570046A7F8 /* FontFeatureSettings.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = FontFeatureSettings.cpp; sourceTree = "<group>"; };
 		4A6E9FC613C17D570046A7F8 /* FontFeatureSettings.h */ = {isa = PBXFileReference; explicitFileType = sourcecode.c.h; fileEncoding = 4; path = FontFeatureSettings.h; sourceTree = "<group>"; };
 		4A8C96EA0BE69032004EEFF0 /* FrameSelectionMac.mm */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.objcpp; name = FrameSelectionMac.mm; path = mac/FrameSelectionMac.mm; sourceTree = "<group>"; };
+		4A957F0314E241100049DBFB /* WebSocketExtensionDispatcher.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = WebSocketExtensionDispatcher.cpp; sourceTree = "<group>"; };
+		4A957F0414E241100049DBFB /* WebSocketExtensionDispatcher.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WebSocketExtensionDispatcher.h; sourceTree = "<group>"; };
 		4ABDFF0714DBE312004D117D /* HTMLShadowElement.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = HTMLShadowElement.cpp; sourceTree = "<group>"; };
 		4ABDFF0814DBE312004D117D /* HTMLShadowElement.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = HTMLShadowElement.h; sourceTree = "<group>"; };
 		4ABDFF0914DBE312004D117D /* HTMLShadowElement.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = HTMLShadowElement.idl; sourceTree = "<group>"; };
@@ -8218,6 +8258,9 @@
 		4AD01007127E642A0015035F /* HTMLOutputElement.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = HTMLOutputElement.idl; sourceTree = "<group>"; };
 		4AD0173A127E82860015035F /* JSHTMLOutputElement.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSHTMLOutputElement.cpp; sourceTree = "<group>"; };
 		4AD0173B127E82860015035F /* JSHTMLOutputElement.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSHTMLOutputElement.h; sourceTree = "<group>"; };
+		4ADE25F914E3BB4C004C2213 /* WebSocketExtensionProcessor.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WebSocketExtensionProcessor.h; sourceTree = "<group>"; };
+		4AE02ABB14E8A9D200BC3BA7 /* WebSocketDeflater.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = WebSocketDeflater.cpp; sourceTree = "<group>"; };
+		4AE02ABC14E8A9D200BC3BA7 /* WebSocketDeflater.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WebSocketDeflater.h; sourceTree = "<group>"; };
 		4AF1AD3C13FD23A400AA9590 /* EventDispatchMediator.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = EventDispatchMediator.cpp; sourceTree = "<group>"; };
 		4AF1AD3D13FD23A400AA9590 /* EventDispatchMediator.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = EventDispatchMediator.h; sourceTree = "<group>"; };
 		4B2708C50AF19EE40065127F /* Pasteboard.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = Pasteboard.h; sourceTree = "<group>"; };
@@ -8302,10 +8345,10 @@
 		5112247710CFB8F4008099D7 /* WorkerThreadableWebSocketChannel.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = WorkerThreadableWebSocketChannel.cpp; sourceTree = "<group>"; };
 		5112247910CFB8FF008099D7 /* WorkerThreadableWebSocketChannel.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WorkerThreadableWebSocketChannel.h; sourceTree = "<group>"; };
 		5116D9750CF177BD00C2B84D /* DatabaseDetails.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DatabaseDetails.h; sourceTree = "<group>"; };
-		511F23130DC160DA004F0032 /* LocalStorageTask.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = LocalStorageTask.cpp; sourceTree = "<group>"; };
-		511F23140DC160DA004F0032 /* LocalStorageTask.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = LocalStorageTask.h; sourceTree = "<group>"; };
-		511F23150DC160DA004F0032 /* LocalStorageThread.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = LocalStorageThread.cpp; sourceTree = "<group>"; };
-		511F23160DC160DA004F0032 /* LocalStorageThread.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = LocalStorageThread.h; sourceTree = "<group>"; };
+		511F23130DC160DA004F0032 /* StorageTask.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = StorageTask.cpp; sourceTree = "<group>"; };
+		511F23140DC160DA004F0032 /* StorageTask.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = StorageTask.h; sourceTree = "<group>"; };
+		511F23150DC160DA004F0032 /* StorageThread.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = StorageThread.cpp; sourceTree = "<group>"; };
+		511F23160DC160DA004F0032 /* StorageThread.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = StorageThread.h; sourceTree = "<group>"; };
 		5126E6B90A2E3B12005C29FA /* IconDatabase.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = IconDatabase.cpp; sourceTree = "<group>"; };
 		5126E6BA0A2E3B12005C29FA /* IconDatabase.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = IconDatabase.h; sourceTree = "<group>"; };
 		512DD8E20D91E2B4000F89EE /* SharedBufferCF.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = SharedBufferCF.cpp; sourceTree = "<group>"; };
@@ -8454,14 +8497,18 @@
 		53C8298C13D8D92700DE2DEB /* RenderFlexibleBox.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = RenderFlexibleBox.h; sourceTree = "<group>"; };
 		550A0BC7085F6039007353D6 /* QualifiedName.cpp */ = {isa = PBXFileReference; fileEncoding = 30; indentWidth = 4; lastKnownFileType = sourcecode.cpp.cpp; path = QualifiedName.cpp; sourceTree = "<group>"; tabWidth = 8; usesTabs = 0; };
 		550A0BC8085F6039007353D6 /* QualifiedName.h */ = {isa = PBXFileReference; fileEncoding = 30; indentWidth = 4; lastKnownFileType = sourcecode.c.h; path = QualifiedName.h; sourceTree = "<group>"; tabWidth = 8; usesTabs = 0; };
+		572E92F914E540580087FFBA /* ShadowRootList.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = ShadowRootList.cpp; path = ../../dom/ShadowRootList.cpp; sourceTree = "<group>"; };
+		572E92FA14E540580087FFBA /* ShadowRootList.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = ShadowRootList.h; path = ../../dom/ShadowRootList.h; sourceTree = "<group>"; };
 		573D134514CE39FF0057ABCA /* InspectorTypeBuilder.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = InspectorTypeBuilder.cpp; sourceTree = "<group>"; };
 		573D134614CE39FF0057ABCA /* InspectorTypeBuilder.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = InspectorTypeBuilder.h; sourceTree = "<group>"; };
-		57B7919F14C6A62900F202D1 /* ContentInclusionSelector.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ContentInclusionSelector.cpp; sourceTree = "<group>"; };
-		57B791A014C6A62900F202D1 /* ContentInclusionSelector.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ContentInclusionSelector.h; sourceTree = "<group>"; };
+		57B7919F14C6A62900F202D1 /* HTMLContentSelector.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = HTMLContentSelector.cpp; sourceTree = "<group>"; };
+		57B791A014C6A62900F202D1 /* HTMLContentSelector.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = HTMLContentSelector.h; sourceTree = "<group>"; };
 		57B791A114C6A62900F202D1 /* ContentSelectorQuery.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ContentSelectorQuery.cpp; sourceTree = "<group>"; };
 		57B791A214C6A62900F202D1 /* ContentSelectorQuery.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ContentSelectorQuery.h; sourceTree = "<group>"; };
 		57B791A714C6A63300F202D1 /* HTMLContentElement.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = HTMLContentElement.cpp; sourceTree = "<group>"; };
 		57B791A814C6A63300F202D1 /* HTMLContentElement.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = HTMLContentElement.h; sourceTree = "<group>"; };
+		57CF497214EE36D700ECFF14 /* InsertionPoint.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = InsertionPoint.cpp; sourceTree = "<group>"; };
+		57CF497314EE36D700ECFF14 /* InsertionPoint.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = InsertionPoint.h; sourceTree = "<group>"; };
 		5905ADBD1302F3CE00F116DF /* XMLTreeViewer.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = XMLTreeViewer.cpp; sourceTree = "<group>"; };
 		5905ADBE1302F3CE00F116DF /* XMLTreeViewer.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = XMLTreeViewer.h; sourceTree = "<group>"; };
 		590E1B4811E4EF4B0069F784 /* DeviceOrientation.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DeviceOrientation.h; sourceTree = "<group>"; };
@@ -8472,8 +8519,6 @@
 		5913A24013D49EBA00F5B05C /* IdentifiersFactory.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = IdentifiersFactory.h; sourceTree = "<group>"; };
 		59309A1011F4AE5800250603 /* DeviceOrientationClientMock.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DeviceOrientationClientMock.cpp; path = mock/DeviceOrientationClientMock.cpp; sourceTree = "<group>"; };
 		59309A1211F4AE6A00250603 /* DeviceOrientationClientMock.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DeviceOrientationClientMock.h; path = mock/DeviceOrientationClientMock.h; sourceTree = "<group>"; };
-		593AB6971355CD9200FC8211 /* PositionCallback.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = PositionCallback.idl; sourceTree = "<group>"; };
-		593AB6991355CDAE00FC8211 /* PositionErrorCallback.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = PositionErrorCallback.idl; sourceTree = "<group>"; };
 		5958F1CB1343917C0080B31F /* XMLViewer.css */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text.css; path = XMLViewer.css; sourceTree = "<group>"; };
 		5958F1CC1343917C0080B31F /* XMLViewer.js */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.javascript; path = XMLViewer.js; sourceTree = "<group>"; };
 		596950811321059900C3ED18 /* JobjectWrapper.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JobjectWrapper.h; sourceTree = "<group>"; };
@@ -8773,6 +8818,8 @@
 		7A24587A1021EAF4000A00AA /* InspectorDOMAgent.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = InspectorDOMAgent.h; sourceTree = "<group>"; };
 		7A54857D14E02D51006AE05A /* InspectorHistory.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = InspectorHistory.cpp; sourceTree = "<group>"; };
 		7A54857E14E02D51006AE05A /* InspectorHistory.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = InspectorHistory.h; sourceTree = "<group>"; };
+		7A54881514E432A1006AE05A /* DOMPatchSupport.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DOMPatchSupport.h; sourceTree = "<group>"; };
+		7A54881614E432A1006AE05A /* DOMPatchSupport.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = DOMPatchSupport.cpp; sourceTree = "<group>"; };
 		7A563E5412DE32B000F4536D /* InjectedScriptSource.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = InjectedScriptSource.h; sourceTree = "<group>"; };
 		7A563F9512DF5C9100F4536D /* InjectedScriptSource.js */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.javascript; path = InjectedScriptSource.js; sourceTree = "<group>"; };
 		7A674BD90F9EBF4E006CF099 /* PageGroupLoadDeferrer.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = PageGroupLoadDeferrer.cpp; sourceTree = "<group>"; };
@@ -10146,7 +10193,9 @@
 		97059976107D975200A50A7C /* PolicyChecker.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = PolicyChecker.h; sourceTree = "<group>"; };
 		970B7289144FFAC600F00A37 /* EventInterfaces.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = EventInterfaces.h; sourceTree = "<group>"; };
 		970B72A5145008EB00F00A37 /* EventHeaders.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = EventHeaders.h; sourceTree = "<group>"; };
-		971491D912FD65E8001BFEB1 /* URLString.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = URLString.h; sourceTree = "<group>"; };
+		9711460014EF009A00674FD9 /* NavigatorGeolocation.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = NavigatorGeolocation.cpp; path = Modules/geolocation/NavigatorGeolocation.cpp; sourceTree = "<group>"; };
+		9711460114EF009A00674FD9 /* NavigatorGeolocation.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = NavigatorGeolocation.h; path = Modules/geolocation/NavigatorGeolocation.h; sourceTree = "<group>"; };
+		9711460214EF009A00674FD9 /* NavigatorGeolocation.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; name = NavigatorGeolocation.idl; path = Modules/geolocation/NavigatorGeolocation.idl; sourceTree = "<group>"; };
 		97205AAD123928CA00B17380 /* FTPDirectoryDocument.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = FTPDirectoryDocument.cpp; sourceTree = "<group>"; };
 		97205AAE123928CA00B17380 /* FTPDirectoryDocument.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = FTPDirectoryDocument.h; sourceTree = "<group>"; };
 		97205AB11239291000B17380 /* ImageDocument.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ImageDocument.cpp; sourceTree = "<group>"; };
@@ -10157,18 +10206,48 @@
 		97205ABA1239292700B17380 /* PluginDocument.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = PluginDocument.h; sourceTree = "<group>"; };
 		9728C3111268E4390041E89B /* MarkupAccumulator.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = MarkupAccumulator.cpp; sourceTree = "<group>"; };
 		9728C3121268E4390041E89B /* MarkupAccumulator.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = MarkupAccumulator.h; sourceTree = "<group>"; };
+		9730BE1414EF286B00DF06B9 /* NavigatorRegisterProtocolHandler.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = NavigatorRegisterProtocolHandler.cpp; sourceTree = "<group>"; };
+		9730BE1514EF286B00DF06B9 /* NavigatorRegisterProtocolHandler.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = NavigatorRegisterProtocolHandler.h; sourceTree = "<group>"; };
+		9730BE1614EF286B00DF06B9 /* NavigatorRegisterProtocolHandler.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = NavigatorRegisterProtocolHandler.idl; sourceTree = "<group>"; };
 		9738899E116EA9DC00ADF313 /* DocumentWriter.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = DocumentWriter.cpp; sourceTree = "<group>"; };
 		9738899F116EA9DC00ADF313 /* DocumentWriter.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DocumentWriter.h; sourceTree = "<group>"; };
 		973DC63D145A9409002842C2 /* ExceptionCodeDescription.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ExceptionCodeDescription.cpp; sourceTree = "<group>"; };
 		973DC63E145A9409002842C2 /* ExceptionCodeDescription.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ExceptionCodeDescription.h; sourceTree = "<group>"; };
 		973E325410883B7C005BC493 /* ResourceLoadNotifier.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ResourceLoadNotifier.cpp; sourceTree = "<group>"; };
 		973E325510883B7C005BC493 /* ResourceLoadNotifier.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ResourceLoadNotifier.h; sourceTree = "<group>"; };
+		9746AF1314F4DDE6003E7A70 /* Geolocation.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = Geolocation.cpp; path = Modules/geolocation/Geolocation.cpp; sourceTree = "<group>"; };
+		9746AF1414F4DDE6003E7A70 /* Geolocation.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = Geolocation.h; path = Modules/geolocation/Geolocation.h; sourceTree = "<group>"; };
+		9746AF1514F4DDE6003E7A70 /* Geolocation.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; name = Geolocation.idl; path = Modules/geolocation/Geolocation.idl; sourceTree = "<group>"; };
+		9746AF1614F4DDE6003E7A70 /* GeolocationController.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = GeolocationController.cpp; path = Modules/geolocation/GeolocationController.cpp; sourceTree = "<group>"; };
+		9746AF1714F4DDE6003E7A70 /* GeolocationController.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = GeolocationController.h; path = Modules/geolocation/GeolocationController.h; sourceTree = "<group>"; };
+		9746AF1814F4DDE6003E7A70 /* GeolocationError.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = GeolocationError.h; path = Modules/geolocation/GeolocationError.h; sourceTree = "<group>"; };
+		9746AF1914F4DDE6003E7A70 /* GeolocationPosition.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = GeolocationPosition.h; path = Modules/geolocation/GeolocationPosition.h; sourceTree = "<group>"; };
+		9746AF1A14F4DDE6003E7A70 /* Geoposition.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = Geoposition.h; path = Modules/geolocation/Geoposition.h; sourceTree = "<group>"; };
+		9746AF1B14F4DDE6003E7A70 /* Geoposition.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; name = Geoposition.idl; path = Modules/geolocation/Geoposition.idl; sourceTree = "<group>"; };
+		9746AF1C14F4DDE6003E7A70 /* PositionCallback.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = PositionCallback.h; path = Modules/geolocation/PositionCallback.h; sourceTree = "<group>"; };
+		9746AF1D14F4DDE6003E7A70 /* PositionCallback.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; name = PositionCallback.idl; path = Modules/geolocation/PositionCallback.idl; sourceTree = "<group>"; };
+		9746AF1E14F4DDE6003E7A70 /* PositionError.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = PositionError.h; path = Modules/geolocation/PositionError.h; sourceTree = "<group>"; };
+		9746AF1F14F4DDE6003E7A70 /* PositionError.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; name = PositionError.idl; path = Modules/geolocation/PositionError.idl; sourceTree = "<group>"; };
+		9746AF2014F4DDE6003E7A70 /* PositionErrorCallback.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = PositionErrorCallback.h; path = Modules/geolocation/PositionErrorCallback.h; sourceTree = "<group>"; };
+		9746AF2114F4DDE6003E7A70 /* PositionErrorCallback.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; name = PositionErrorCallback.idl; path = Modules/geolocation/PositionErrorCallback.idl; sourceTree = "<group>"; };
+		9746AF2214F4DDE6003E7A70 /* PositionOptions.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = PositionOptions.h; path = Modules/geolocation/PositionOptions.h; sourceTree = "<group>"; };
 		974A862014B7ADBB003FDC76 /* FrameDestructionObserver.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = FrameDestructionObserver.cpp; sourceTree = "<group>"; };
 		974A862114B7ADBB003FDC76 /* FrameDestructionObserver.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = FrameDestructionObserver.h; sourceTree = "<group>"; };
 		974D2DA2146A535D00D51F8B /* SecurityPolicy.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = SecurityPolicy.cpp; sourceTree = "<group>"; };
 		974D2DA3146A535D00D51F8B /* SecurityPolicy.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SecurityPolicy.h; sourceTree = "<group>"; };
 		9752D38B1413104B003305BD /* JSHTMLSpanElement.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSHTMLSpanElement.cpp; sourceTree = "<group>"; };
 		9752D38C1413104B003305BD /* JSHTMLSpanElement.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSHTMLSpanElement.h; sourceTree = "<group>"; };
+		9759E93414EF1CF80026A2DD /* LoadableTextTrack.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = LoadableTextTrack.cpp; sourceTree = "<group>"; };
+		9759E93514EF1CF80026A2DD /* TextTrack.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = TextTrack.cpp; sourceTree = "<group>"; };
+		9759E93614EF1CF80026A2DD /* TextTrack.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = TextTrack.h; sourceTree = "<group>"; };
+		9759E93714EF1CF80026A2DD /* TextTrack.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = TextTrack.idl; sourceTree = "<group>"; };
+		9759E93814EF1CF80026A2DD /* TextTrackCue.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = TextTrackCue.cpp; sourceTree = "<group>"; };
+		9759E93914EF1CF80026A2DD /* TextTrackCue.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = TextTrackCue.h; sourceTree = "<group>"; };
+		9759E93A14EF1CF80026A2DD /* TextTrackCue.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = TextTrackCue.idl; sourceTree = "<group>"; };
+		9759E93B14EF1CF80026A2DD /* TextTrackCueList.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = TextTrackCueList.cpp; sourceTree = "<group>"; };
+		9759E93C14EF1CF80026A2DD /* TextTrackCueList.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = TextTrackCueList.h; sourceTree = "<group>"; };
+		9759E93D14EF1CF80026A2DD /* TextTrackCueList.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = TextTrackCueList.idl; sourceTree = "<group>"; };
+		9759E94814EF1D490026A2DD /* LoadableTextTrack.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = LoadableTextTrack.h; sourceTree = "<group>"; };
 		975CA287130365F800E99AD9 /* Crypto.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = Crypto.cpp; sourceTree = "<group>"; };
 		975CA288130365F800E99AD9 /* Crypto.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = Crypto.h; sourceTree = "<group>"; };
 		975CA289130365F800E99AD9 /* Crypto.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = Crypto.idl; sourceTree = "<group>"; };
@@ -10265,6 +10344,8 @@
 		97C1F552122855CB00EDE616 /* HTMLToken.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = HTMLToken.h; path = parser/HTMLToken.h; sourceTree = "<group>"; };
 		97C471D912F925BC0086354B /* ContentSecurityPolicy.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ContentSecurityPolicy.cpp; sourceTree = "<group>"; };
 		97C471DA12F925BD0086354B /* ContentSecurityPolicy.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ContentSecurityPolicy.h; sourceTree = "<group>"; };
+		97CC3AE014E8E4A200894988 /* NavigatorSupplement.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = NavigatorSupplement.cpp; sourceTree = "<group>"; };
+		97CC3AE114E8E4A200894988 /* NavigatorSupplement.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = NavigatorSupplement.h; sourceTree = "<group>"; };
 		97D2AD0114B823A60093DF32 /* DOMWindowProperty.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = DOMWindowProperty.cpp; sourceTree = "<group>"; };
 		97D2AD0214B823A60093DF32 /* DOMWindowProperty.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DOMWindowProperty.h; sourceTree = "<group>"; };
 		97DCE1FF10807C750057D394 /* HistoryController.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = HistoryController.cpp; sourceTree = "<group>"; };
@@ -10327,6 +10408,8 @@
 		A0EE0DF2144F825500F80B0D /* WebGLDebugRendererInfo.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = WebGLDebugRendererInfo.h; path = canvas/WebGLDebugRendererInfo.h; sourceTree = "<group>"; };
 		A0EE0DF3144F825500F80B0D /* WebGLDebugShaders.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = WebGLDebugShaders.cpp; path = canvas/WebGLDebugShaders.cpp; sourceTree = "<group>"; };
 		A0EE0DF4144F825500F80B0D /* WebGLDebugShaders.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = WebGLDebugShaders.h; path = canvas/WebGLDebugShaders.h; sourceTree = "<group>"; };
+		A104F24114C71F7A009E2C23 /* CachedSVGDocument.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = CachedSVGDocument.cpp; sourceTree = "<group>"; };
+		A104F24214C71F7A009E2C23 /* CachedSVGDocument.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = CachedSVGDocument.h; sourceTree = "<group>"; };
 		A10BB5821484E3A700B2E87A /* RenderSVGRect.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = RenderSVGRect.cpp; sourceTree = "<group>"; };
 		A10BB5831484E3A700B2E87A /* RenderSVGRect.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = RenderSVGRect.h; sourceTree = "<group>"; };
 		A10BB5881484E3B300B2E87A /* RenderSVGShape.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = RenderSVGShape.cpp; sourceTree = "<group>"; };
@@ -10394,6 +10477,8 @@
 		A718760D0B2A120100A16ECE /* DragActions.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DragActions.h; sourceTree = "<group>"; };
 		A718788F0B2D04AC00A16ECE /* DragControllerMac.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = DragControllerMac.mm; sourceTree = "<group>"; };
 		A71A70C911AFB02000989D6D /* HTMLMeterElement.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = HTMLMeterElement.idl; sourceTree = "<group>"; };
+		A71E083514E3CEAF006A4619 /* PageSupplement.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = PageSupplement.cpp; sourceTree = "<group>"; };
+		A71E083614E3CEAF006A4619 /* PageSupplement.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = PageSupplement.h; sourceTree = "<group>"; };
 		A723F77A1484CA4C008C6DBE /* PlatformExportMacros.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = PlatformExportMacros.h; sourceTree = "<group>"; };
 		A73F95FC12C97BFE0031AAF9 /* RoundedRect.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = RoundedRect.cpp; sourceTree = "<group>"; };
 		A73F95FD12C97BFE0031AAF9 /* RoundedRect.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = RoundedRect.h; sourceTree = "<group>"; };
@@ -10471,14 +10556,12 @@
 		A80E6CBE0A1989CA007FB8C5 /* ShadowValue.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = ShadowValue.h; sourceTree = "<group>"; };
 		A80E6CBF0A1989CA007FB8C5 /* CSSValueList.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = CSSValueList.h; sourceTree = "<group>"; };
 		A80E6CC10A1989CA007FB8C5 /* CSSImportRule.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = CSSImportRule.cpp; sourceTree = "<group>"; };
-		A80E6CC20A1989CA007FB8C5 /* FontFamilyValue.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = FontFamilyValue.cpp; sourceTree = "<group>"; };
 		A80E6CC30A1989CA007FB8C5 /* FontValue.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = FontValue.h; sourceTree = "<group>"; };
 		A80E6CC40A1989CA007FB8C5 /* CSSValue.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = CSSValue.h; sourceTree = "<group>"; };
 		A80E6CC50A1989CA007FB8C5 /* CSSStyleRule.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = CSSStyleRule.cpp; sourceTree = "<group>"; };
 		A80E6CC60A1989CA007FB8C5 /* CSSInheritedValue.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = CSSInheritedValue.cpp; sourceTree = "<group>"; };
 		A80E6CC70A1989CA007FB8C5 /* FontValue.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = FontValue.cpp; sourceTree = "<group>"; };
 		A80E6CC80A1989CA007FB8C5 /* CSSRuleList.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = CSSRuleList.h; sourceTree = "<group>"; };
-		A80E6CC90A1989CA007FB8C5 /* FontFamilyValue.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = FontFamilyValue.h; sourceTree = "<group>"; };
 		A80E6CCA0A1989CA007FB8C5 /* ShadowValue.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = ShadowValue.cpp; sourceTree = "<group>"; };
 		A80E6CCB0A1989CA007FB8C5 /* CSSPageRule.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = CSSPageRule.cpp; sourceTree = "<group>"; };
 		A80E6CCC0A1989CA007FB8C5 /* CSSImportRule.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = CSSImportRule.h; sourceTree = "<group>"; };
@@ -10593,6 +10676,9 @@
 		A833C7F60A2CF1D800D57664 /* xmlattrs.in */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = text; path = xmlattrs.in; sourceTree = "<group>"; };
 		A833C80A0A2CF25600D57664 /* XMLNames.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = XMLNames.cpp; sourceTree = "<group>"; };
 		A833C80B0A2CF25600D57664 /* XMLNames.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = XMLNames.h; sourceTree = "<group>"; };
+		A83B533814F399BB00720D9D /* IDLAttributes.txt */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; name = IDLAttributes.txt; path = scripts/IDLAttributes.txt; sourceTree = "<group>"; };
+		A83B535B14F7413A00720D9D /* DOMWindowWebGL.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; name = DOMWindowWebGL.idl; path = canvas/DOMWindowWebGL.idl; sourceTree = "<group>"; };
+		A83B536C14F749E200720D9D /* DOMWindowXML.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = DOMWindowXML.idl; sourceTree = "<group>"; };
 		A83B78F20CCAFF15000B0825 /* JSSVGFontFaceUriElement.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSSVGFontFaceUriElement.h; sourceTree = "<group>"; };
 		A83B78F30CCAFF15000B0825 /* JSSVGFontFaceUriElement.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSSVGFontFaceUriElement.cpp; sourceTree = "<group>"; };
 		A83B78F40CCAFF15000B0825 /* JSSVGFontFaceSrcElement.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSSVGFontFaceSrcElement.h; sourceTree = "<group>"; };
@@ -10700,8 +10786,10 @@
 		A88DD4880B4629B000C02990 /* PathTraversalState.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = PathTraversalState.cpp; sourceTree = "<group>"; };
 		A89943260B42338700D7C802 /* BitmapImage.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = BitmapImage.h; sourceTree = "<group>"; };
 		A89943270B42338700D7C802 /* BitmapImage.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = BitmapImage.cpp; sourceTree = "<group>"; };
+		A89AACD514F6C12700C1FA4A /* DOMWindowSVG.idl */ = {isa = PBXFileReference; lastKnownFileType = text; path = DOMWindowSVG.idl; sourceTree = "<group>"; };
 		A89CCC500F44E98100B5DA10 /* ReplaceNodeWithSpanCommand.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ReplaceNodeWithSpanCommand.cpp; sourceTree = "<group>"; };
 		A89CCC510F44E98100B5DA10 /* ReplaceNodeWithSpanCommand.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ReplaceNodeWithSpanCommand.h; sourceTree = "<group>"; };
+		A8A5205D14F6BD3C00FBA19E /* DOMWindowHTML.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = DOMWindowHTML.idl; sourceTree = "<group>"; };
 		A8BC04911214F69600B5F122 /* HTMLEntityTable.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = HTMLEntityTable.cpp; sourceTree = "<group>"; };
 		A8C2280D11D4A59700D5A7D3 /* DocumentParser.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = DocumentParser.cpp; sourceTree = "<group>"; };
 		A8C2289F11D5722E00D5A7D3 /* DecodedDataDocumentParser.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DecodedDataDocumentParser.h; sourceTree = "<group>"; };
@@ -11009,14 +11097,6 @@
 		B10B697E140C174000BC1C26 /* WebVTTTokenizer.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = WebVTTTokenizer.cpp; sourceTree = "<group>"; };
 		B10B697F140C174000BC1C26 /* WebVTTTokenizer.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WebVTTTokenizer.h; sourceTree = "<group>"; };
 		B1827492134CA4C100B98C2D /* CallbackFunction.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = CallbackFunction.cpp; sourceTree = "<group>"; };
-		B1AD4E4D13A12A0B00846B27 /* LoadableTextTrack.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = LoadableTextTrack.cpp; sourceTree = "<group>"; };
-		B1AD4E4E13A12A0B00846B27 /* LoadableTextTrack.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = LoadableTextTrack.h; sourceTree = "<group>"; };
-		B1AD4E5513A12A0B00846B27 /* TextTrack.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = TextTrack.cpp; sourceTree = "<group>"; };
-		B1AD4E5613A12A0B00846B27 /* TextTrack.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = TextTrack.h; sourceTree = "<group>"; };
-		B1AD4E5713A12A0B00846B27 /* TextTrackCue.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = TextTrackCue.cpp; sourceTree = "<group>"; };
-		B1AD4E5813A12A0B00846B27 /* TextTrackCue.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = TextTrackCue.h; sourceTree = "<group>"; };
-		B1AD4E5913A12A0B00846B27 /* TextTrackCueList.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = TextTrackCueList.cpp; sourceTree = "<group>"; };
-		B1AD4E5A13A12A0B00846B27 /* TextTrackCueList.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = TextTrackCueList.h; sourceTree = "<group>"; };
 		B1AD4E7113A12A4600846B27 /* TextTrackLoader.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = TextTrackLoader.cpp; path = loader/TextTrackLoader.cpp; sourceTree = SOURCE_ROOT; };
 		B1AD4E7213A12A4600846B27 /* TextTrackLoader.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = TextTrackLoader.h; path = loader/TextTrackLoader.h; sourceTree = SOURCE_ROOT; };
 		B1D5ECB4134B58DA0087C78F /* CallbackFunction.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = CallbackFunction.h; sourceTree = "<group>"; };
@@ -12026,11 +12106,7 @@
 		BC53DA5F1143141A000D817E /* DOMObjectHashTableMap.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DOMObjectHashTableMap.h; sourceTree = "<group>"; };
 		BC53DA61114314BD000D817E /* DOMObjectHashTableMap.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = DOMObjectHashTableMap.cpp; sourceTree = "<group>"; };
 		BC53DAC611433064000D817E /* JSDOMWrapper.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSDOMWrapper.cpp; sourceTree = "<group>"; };
-		BC56CB1C10D5AC8000A77C64 /* GeolocationController.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = GeolocationController.cpp; sourceTree = "<group>"; };
-		BC56CB1D10D5AC8000A77C64 /* GeolocationController.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = GeolocationController.h; sourceTree = "<group>"; };
 		BC56CB1E10D5AC8000A77C64 /* GeolocationClient.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = GeolocationClient.h; sourceTree = "<group>"; };
-		BC56CB1F10D5AC8000A77C64 /* GeolocationError.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = GeolocationError.h; sourceTree = "<group>"; };
-		BC56CB2010D5AC8000A77C64 /* GeolocationPosition.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = GeolocationPosition.h; sourceTree = "<group>"; };
 		BC5823F40C0A98DF0053F1B5 /* JSHTMLElementCustom.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSHTMLElementCustom.cpp; sourceTree = "<group>"; };
 		BC5825F20C0B89380053F1B5 /* JSCSSStyleDeclarationCustom.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSCSSStyleDeclarationCustom.cpp; sourceTree = "<group>"; };
 		BC588AEF0BFA6CF900EE679E /* HTMLParserErrorCodes.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = HTMLParserErrorCodes.h; sourceTree = "<group>"; };
@@ -12044,7 +12120,6 @@
 		BC5A86B40C3367E800EEA649 /* JSDOMSelection.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = JSDOMSelection.h; sourceTree = "<group>"; };
 		BC5C76281497FE1400BC4775 /* PlatformEvent.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = PlatformEvent.cpp; sourceTree = "<group>"; };
 		BC5C76291497FE1400BC4775 /* PlatformEvent.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = PlatformEvent.h; sourceTree = "<group>"; };
-		BC5CFCA811F793320099ED09 /* LocalizationStrategy.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = LocalizationStrategy.h; sourceTree = "<group>"; };
 		BC5EB5DA0E81B7EA00B25965 /* BorderValue.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = BorderValue.h; path = style/BorderValue.h; sourceTree = "<group>"; };
 		BC5EB5DC0E81B8DD00B25965 /* OutlineValue.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = OutlineValue.h; path = style/OutlineValue.h; sourceTree = "<group>"; };
 		BC5EB5DE0E81B9AB00B25965 /* CollapsedBorderValue.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = CollapsedBorderValue.h; path = style/CollapsedBorderValue.h; sourceTree = "<group>"; };
@@ -12269,8 +12344,6 @@
 		BCC065840F3CE2A700CD2D87 /* JSClientRect.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSClientRect.h; sourceTree = "<group>"; };
 		BCC065850F3CE2A700CD2D87 /* JSClientRectList.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSClientRectList.cpp; sourceTree = "<group>"; };
 		BCC065860F3CE2A700CD2D87 /* JSClientRectList.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSClientRectList.h; sourceTree = "<group>"; };
-		BCC36EB61342AA3F004BEEF7 /* DefaultLocalizationStrategy.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = DefaultLocalizationStrategy.cpp; sourceTree = "<group>"; };
-		BCC36EB71342AA3F004BEEF7 /* DefaultLocalizationStrategy.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DefaultLocalizationStrategy.h; sourceTree = "<group>"; };
 		BCC438770E886CC700533DD5 /* JSHTMLInputElementCustom.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSHTMLInputElementCustom.cpp; sourceTree = "<group>"; };
 		BCC573330D695BBE006EF517 /* DOMProgressEvent.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DOMProgressEvent.h; sourceTree = "<group>"; };
 		BCC573340D695BBE006EF517 /* DOMProgressEvent.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = DOMProgressEvent.mm; sourceTree = "<group>"; };
@@ -12512,9 +12585,12 @@
 		C585A6C911D4FB3D004C3E4B /* IDBFactory.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = IDBFactory.cpp; sourceTree = "<group>"; };
 		C585A6CA11D4FB3D004C3E4B /* IDBFactory.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = IDBFactory.h; sourceTree = "<group>"; };
 		C585A6CB11D4FB3D004C3E4B /* IDBFactory.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = IDBFactory.idl; sourceTree = "<group>"; };
+		C5BAC16F14E30E4700008837 /* PlatformPasteboard.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = PlatformPasteboard.h; sourceTree = "<group>"; };
 		C5D4AA78116BAFB60069CA93 /* GlyphMetricsMap.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = GlyphMetricsMap.h; sourceTree = "<group>"; };
 		C5E9B67610697E1300C7BB1A /* StorageEventDispatcher.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = StorageEventDispatcher.cpp; sourceTree = "<group>"; };
 		C5EBDD81105EDDEC0056816F /* StorageEventDispatcher.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = StorageEventDispatcher.h; sourceTree = "<group>"; };
+		C5F765B414E1D414006C899B /* PasteboardStrategy.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = PasteboardStrategy.h; sourceTree = "<group>"; };
+		C5F765BA14E1ECF4006C899B /* PlatformPasteboardMac.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = PlatformPasteboardMac.mm; sourceTree = "<group>"; };
 		C6D74AD309AA282E000B0A52 /* ModifySelectionListLevel.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ModifySelectionListLevel.h; sourceTree = "<group>"; };
 		C6D74AE309AA290A000B0A52 /* ModifySelectionListLevel.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ModifySelectionListLevel.cpp; sourceTree = "<group>"; };
 		C6F08FB91430FE8F00685849 /* MutationRecord.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = MutationRecord.cpp; sourceTree = "<group>"; };
@@ -12569,6 +12645,7 @@
 		CE057FA31220731100A476D5 /* DocumentMarkerController.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = DocumentMarkerController.cpp; sourceTree = "<group>"; };
 		CE057FA41220731100A476D5 /* DocumentMarkerController.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DocumentMarkerController.h; sourceTree = "<group>"; };
 		CE54FD371016D9A6008B44C8 /* ScriptSourceProvider.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ScriptSourceProvider.h; sourceTree = "<group>"; };
+		CE5CB1B314EDAB6F00BB2795 /* EventSender.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = EventSender.h; sourceTree = "<group>"; };
 		CEA3949A11D45CDA003094CF /* StaticHashSetNodeList.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = StaticHashSetNodeList.cpp; sourceTree = "<group>"; };
 		CEA3949B11D45CDA003094CF /* StaticHashSetNodeList.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = StaticHashSetNodeList.h; sourceTree = "<group>"; };
 		CECCFC3A141973D5002A0AC1 /* DecodeEscapeSequences.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DecodeEscapeSequences.h; sourceTree = "<group>"; };
@@ -12710,6 +12787,32 @@
 		E1A5F99A0E7EAA2500AF85EA /* JSMessageChannelCustom.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSMessageChannelCustom.cpp; sourceTree = "<group>"; };
 		E1A643F10EC0972500779668 /* WorkerScriptController.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WorkerScriptController.h; sourceTree = "<group>"; };
 		E1A643FC0EC097A000779668 /* WorkerScriptController.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = WorkerScriptController.cpp; sourceTree = "<group>"; };
+		E1AB1EA814E9E27D00449E13 /* FileList.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; name = FileList.idl; path = fileapi/FileList.idl; sourceTree = "<group>"; };
+		E1AB1EAB14E9E2EF00449E13 /* DirectoryEntry.idl */ = {isa = PBXFileReference; lastKnownFileType = text; name = DirectoryEntry.idl; path = fileapi/DirectoryEntry.idl; sourceTree = "<group>"; };
+		E1AB1EAC14E9E2F800449E13 /* DirectoryEntrySync.idl */ = {isa = PBXFileReference; lastKnownFileType = text; name = DirectoryEntrySync.idl; path = fileapi/DirectoryEntrySync.idl; sourceTree = "<group>"; };
+		E1AB1EAD14E9E30500449E13 /* DirectoryReader.idl */ = {isa = PBXFileReference; lastKnownFileType = text; name = DirectoryReader.idl; path = fileapi/DirectoryReader.idl; sourceTree = "<group>"; };
+		E1AB1EAE14E9E30B00449E13 /* DirectoryReaderSync.idl */ = {isa = PBXFileReference; lastKnownFileType = text; name = DirectoryReaderSync.idl; path = fileapi/DirectoryReaderSync.idl; sourceTree = "<group>"; };
+		E1AB1EAF14E9E31700449E13 /* DOMFileSystemSync.idl */ = {isa = PBXFileReference; lastKnownFileType = text; name = DOMFileSystemSync.idl; path = fileapi/DOMFileSystemSync.idl; sourceTree = "<group>"; };
+		E1AB1EB014E9E32300449E13 /* EntriesCallback.idl */ = {isa = PBXFileReference; lastKnownFileType = text; name = EntriesCallback.idl; path = fileapi/EntriesCallback.idl; sourceTree = "<group>"; };
+		E1AB1EB114E9E32A00449E13 /* Entry.idl */ = {isa = PBXFileReference; lastKnownFileType = text; name = Entry.idl; path = fileapi/Entry.idl; sourceTree = "<group>"; };
+		E1AB1EB214E9E33200449E13 /* EntryArray.idl */ = {isa = PBXFileReference; lastKnownFileType = text; name = EntryArray.idl; path = fileapi/EntryArray.idl; sourceTree = "<group>"; };
+		E1AB1EB314E9E33900449E13 /* EntryArraySync.idl */ = {isa = PBXFileReference; lastKnownFileType = text; name = EntryArraySync.idl; path = fileapi/EntryArraySync.idl; sourceTree = "<group>"; };
+		E1AB1EB414E9E34500449E13 /* EntryCallback.idl */ = {isa = PBXFileReference; lastKnownFileType = text; name = EntryCallback.idl; path = fileapi/EntryCallback.idl; sourceTree = "<group>"; };
+		E1AB1EB514E9E34B00449E13 /* EntrySync.idl */ = {isa = PBXFileReference; lastKnownFileType = text; name = EntrySync.idl; path = fileapi/EntrySync.idl; sourceTree = "<group>"; };
+		E1AB1EB614E9E35200449E13 /* ErrorCallback.idl */ = {isa = PBXFileReference; lastKnownFileType = text; name = ErrorCallback.idl; path = fileapi/ErrorCallback.idl; sourceTree = "<group>"; };
+		E1AB1EB714E9E35800449E13 /* File.idl */ = {isa = PBXFileReference; lastKnownFileType = text; name = File.idl; path = fileapi/File.idl; sourceTree = "<group>"; };
+		E1AB1EB814E9E36200449E13 /* FileCallback.idl */ = {isa = PBXFileReference; lastKnownFileType = text; name = FileCallback.idl; path = fileapi/FileCallback.idl; sourceTree = "<group>"; };
+		E1AB1EB914E9E36D00449E13 /* FileEntry.idl */ = {isa = PBXFileReference; lastKnownFileType = text; name = FileEntry.idl; path = fileapi/FileEntry.idl; sourceTree = "<group>"; };
+		E1AB1EBA14E9E37200449E13 /* FileEntrySync.idl */ = {isa = PBXFileReference; lastKnownFileType = text; name = FileEntrySync.idl; path = fileapi/FileEntrySync.idl; sourceTree = "<group>"; };
+		E1AB1EBB14E9E37A00449E13 /* FileError.idl */ = {isa = PBXFileReference; lastKnownFileType = text; name = FileError.idl; path = fileapi/FileError.idl; sourceTree = "<group>"; };
+		E1AB1EBC14E9E39700449E13 /* FileException.idl */ = {isa = PBXFileReference; lastKnownFileType = text; name = FileException.idl; path = fileapi/FileException.idl; sourceTree = "<group>"; };
+		E1AB1EBD14E9E3A800449E13 /* FileReaderSync.idl */ = {isa = PBXFileReference; lastKnownFileType = text; name = FileReaderSync.idl; path = fileapi/FileReaderSync.idl; sourceTree = "<group>"; };
+		E1AB1EBE14E9E3B200449E13 /* FileSystemCallback.idl */ = {isa = PBXFileReference; lastKnownFileType = text; name = FileSystemCallback.idl; path = fileapi/FileSystemCallback.idl; sourceTree = "<group>"; };
+		E1AB1EBF14E9E3BE00449E13 /* FileWriterCallback.idl */ = {isa = PBXFileReference; lastKnownFileType = text; name = FileWriterCallback.idl; path = fileapi/FileWriterCallback.idl; sourceTree = "<group>"; };
+		E1AB1EC014E9E3C400449E13 /* FileWriterSync.idl */ = {isa = PBXFileReference; lastKnownFileType = text; name = FileWriterSync.idl; path = fileapi/FileWriterSync.idl; sourceTree = "<group>"; };
+		E1AB1EC114E9E3CC00449E13 /* Metadata.idl */ = {isa = PBXFileReference; lastKnownFileType = text; name = Metadata.idl; path = fileapi/Metadata.idl; sourceTree = "<group>"; };
+		E1AB1EC214E9E3D500449E13 /* MetadataCallback.idl */ = {isa = PBXFileReference; lastKnownFileType = text; name = MetadataCallback.idl; path = fileapi/MetadataCallback.idl; sourceTree = "<group>"; };
+		E1AB1EC314E9E3E200449E13 /* WebKitBlobBuilder.idl */ = {isa = PBXFileReference; lastKnownFileType = text; name = WebKitBlobBuilder.idl; path = fileapi/WebKitBlobBuilder.idl; sourceTree = "<group>"; };
 		E1ACAF4A0E791AAF0087D12B /* DOMMessagePort.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = DOMMessagePort.mm; sourceTree = "<group>"; };
 		E1ACAF4B0E791AAF0087D12B /* DOMMessagePort.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DOMMessagePort.h; sourceTree = "<group>"; };
 		E1AD12D51295D0BD00ACA989 /* JSProcessingInstructionCustom.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSProcessingInstructionCustom.cpp; sourceTree = "<group>"; };
@@ -12832,12 +12935,15 @@
 		E4B423800CBFB73C00AF2ECE /* JSHTMLMediaElement.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSHTMLMediaElement.h; sourceTree = "<group>"; };
 		E4B423850CBFB73C00AF2ECE /* JSProgressEvent.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSProgressEvent.cpp; sourceTree = "<group>"; };
 		E4B423860CBFB73C00AF2ECE /* JSProgressEvent.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSProgressEvent.h; sourceTree = "<group>"; };
+		E4BBED0C14F4025D003F0B98 /* PropertySetCSSStyleDeclaration.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = PropertySetCSSStyleDeclaration.cpp; sourceTree = "<group>"; };
+		E4BBED0D14F4025D003F0B98 /* PropertySetCSSStyleDeclaration.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = PropertySetCSSStyleDeclaration.h; sourceTree = "<group>"; };
 		E4C178950EE6903800824D69 /* CSSSelectorList.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = CSSSelectorList.cpp; sourceTree = "<group>"; };
 		E4C178960EE6903800824D69 /* CSSSelectorList.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = CSSSelectorList.h; sourceTree = "<group>"; };
 		E4C279560CF9741900E97B98 /* RenderMedia.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = RenderMedia.cpp; sourceTree = "<group>"; };
 		E4C279570CF9741900E97B98 /* RenderMedia.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = RenderMedia.h; sourceTree = "<group>"; };
 		E4D687760ED7AE3D006EA978 /* PurgeableBufferMac.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = PurgeableBufferMac.cpp; sourceTree = "<group>"; };
 		E4D687780ED7AE4F006EA978 /* PurgeableBuffer.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = PurgeableBuffer.h; sourceTree = "<group>"; };
+		EB49DB8E14F46E8B002299D9 /* IDBTracing.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = IDBTracing.h; sourceTree = "<group>"; };
 		ED2BA83B09A24B91006C0AC4 /* DocumentMarker.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DocumentMarker.h; sourceTree = "<group>"; };
 		ED501DC50B249F2900AE18D9 /* EditorMac.mm */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.objcpp; name = EditorMac.mm; path = mac/EditorMac.mm; sourceTree = "<group>"; };
 		EDE3A4FF0C7A430600956A37 /* ColorMac.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ColorMac.h; sourceTree = "<group>"; };
@@ -12845,6 +12951,8 @@
 		F31639691329481A00A649CB /* InjectedScriptManager.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = InjectedScriptManager.cpp; sourceTree = "<group>"; };
 		F316396A1329481A00A649CB /* InjectedScriptManager.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = InjectedScriptManager.h; sourceTree = "<group>"; };
 		F316396D1329487600A649CB /* JSInjectedScriptManager.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSInjectedScriptManager.cpp; sourceTree = "<group>"; };
+		F325A40814EE36FA007324E2 /* InspectorCounters.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = InspectorCounters.cpp; sourceTree = "<group>"; };
+		F325A40914EE36FA007324E2 /* InspectorCounters.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = InspectorCounters.h; sourceTree = "<group>"; };
 		F3335BF612E07DC300D33011 /* InspectorConsoleAgent.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = InspectorConsoleAgent.cpp; sourceTree = "<group>"; };
 		F3335BF712E07DC300D33011 /* InspectorConsoleAgent.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = InspectorConsoleAgent.h; sourceTree = "<group>"; };
 		F33F0281120947F200E5743A /* ScriptProfile.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ScriptProfile.cpp; sourceTree = "<group>"; };
@@ -13237,16 +13345,6 @@
 		FE6FD48C0F676E9300092873 /* JSCoordinates.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSCoordinates.h; sourceTree = "<group>"; };
 		FE700DD00F92D81A008E2BFE /* JSCoordinatesCustom.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSCoordinatesCustom.cpp; sourceTree = "<group>"; };
 		FE80D7A60E9C1ED2000D6F75 /* JSGeolocationCustom.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSGeolocationCustom.cpp; sourceTree = "<group>"; };
-		FE80D7B70E9C1F25000D6F75 /* Geolocation.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = Geolocation.cpp; sourceTree = "<group>"; };
-		FE80D7B80E9C1F25000D6F75 /* Geolocation.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = Geolocation.h; sourceTree = "<group>"; };
-		FE80D7B90E9C1F25000D6F75 /* Geolocation.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = Geolocation.idl; sourceTree = "<group>"; };
-		FE80D7BB0E9C1F25000D6F75 /* Geoposition.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = Geoposition.h; sourceTree = "<group>"; };
-		FE80D7BC0E9C1F25000D6F75 /* Geoposition.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = Geoposition.idl; sourceTree = "<group>"; };
-		FE80D7BD0E9C1F25000D6F75 /* PositionCallback.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = PositionCallback.h; sourceTree = "<group>"; };
-		FE80D7BF0E9C1F25000D6F75 /* PositionError.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = PositionError.h; sourceTree = "<group>"; };
-		FE80D7C00E9C1F25000D6F75 /* PositionError.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = PositionError.idl; sourceTree = "<group>"; };
-		FE80D7C10E9C1F25000D6F75 /* PositionErrorCallback.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = PositionErrorCallback.h; sourceTree = "<group>"; };
-		FE80D7C30E9C1F25000D6F75 /* PositionOptions.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = PositionOptions.h; sourceTree = "<group>"; };
 		FE80DA5F0E9C4703000D6F75 /* JSGeolocation.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSGeolocation.cpp; sourceTree = "<group>"; };
 		FE80DA600E9C4703000D6F75 /* JSGeolocation.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSGeolocation.h; sourceTree = "<group>"; };
 		FE80DA610E9C4703000D6F75 /* JSGeoposition.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSGeoposition.cpp; sourceTree = "<group>"; };
@@ -13385,6 +13483,7 @@
 				EDEC98020AED7E170059137F /* WebCorePrefix.h */,
 				9307061309E0CA8200B17FE4 /* DerivedSources.make */,
 				93F19B1908245E59001E9ABC /* Info.plist */,
+				971145FE14EF006E00674FD9 /* Modules */,
 				29A812040FBB9B4100510293 /* accessibility */,
 				BC1A3790097C6F970019F3D8 /* bindings */,
 				1A569CC40D7E2B60007C3983 /* bridge */,
@@ -13860,14 +13959,15 @@
 				C585A6BF11D4FB3D004C3E4B /* IDBRequest.cpp */,
 				C585A6C011D4FB3D004C3E4B /* IDBRequest.h */,
 				C585A6C111D4FB3D004C3E4B /* IDBRequest.idl */,
+				EB49DB8E14F46E8B002299D9 /* IDBTracing.h */,
 				B6566267120B115A006EA85C /* IDBTransaction.cpp */,
 				B6566268120B115A006EA85C /* IDBTransaction.h */,
 				B6566269120B115A006EA85C /* IDBTransaction.idl */,
 				B656626D120B116B006EA85C /* IDBTransactionBackendInterface.h */,
-				511F23130DC160DA004F0032 /* LocalStorageTask.cpp */,
-				511F23140DC160DA004F0032 /* LocalStorageTask.h */,
-				511F23150DC160DA004F0032 /* LocalStorageThread.cpp */,
-				511F23160DC160DA004F0032 /* LocalStorageThread.h */,
+				511F23130DC160DA004F0032 /* StorageTask.cpp */,
+				511F23140DC160DA004F0032 /* StorageTask.h */,
+				511F23150DC160DA004F0032 /* StorageThread.cpp */,
+				511F23160DC160DA004F0032 /* StorageThread.h */,
 				51A926780D53F0570063ECC2 /* OriginQuotaManager.cpp */,
 				51A926790D53F0570063ECC2 /* OriginQuotaManager.h */,
 				51A9267A0D53F0570063ECC2 /* OriginUsageRecord.cpp */,
@@ -13950,6 +14050,7 @@
 				1AF62EE214DA22A70041556C /* mac */,
 				1AF62EE414DA22A70041556C /* ScrollingCoordinator.cpp */,
 				1AF62EE514DA22A70041556C /* ScrollingCoordinator.h */,
+				3866AF3714F1C17100283D68 /* ScrollingCoordinatorNone.cpp */,
 				1AF62F2014DAFE790041556C /* ScrollingThread.cpp */,
 				1AF62F2114DAFE790041556C /* ScrollingThread.h */,
 				1AAADDA114DB409F00AF64B3 /* ScrollingTree.cpp */,
@@ -13977,13 +14078,13 @@
 		1C5FAECA0DCFD8C900D58F78 /* Inspector */ = {
 			isa = PBXGroup;
 			children = (
-				573D134514CE39FF0057ABCA /* InspectorTypeBuilder.cpp */,
-				573D134614CE39FF0057ABCA /* InspectorTypeBuilder.h */,
 				7A563E5412DE32B000F4536D /* InjectedScriptSource.h */,
 				4F707A9711EF679400ACDA69 /* InspectorBackendDispatcher.cpp */,
 				4F707A9811EF679400ACDA69 /* InspectorBackendDispatcher.h */,
 				4F4F5FFA11CBD2D200A186BF /* InspectorFrontend.cpp */,
 				4F4F5FFC11CBD30100A186BF /* InspectorFrontend.h */,
+				573D134514CE39FF0057ABCA /* InspectorTypeBuilder.cpp */,
+				573D134614CE39FF0057ABCA /* InspectorTypeBuilder.h */,
 				7A0E76D810BF059800A0276E /* JSInjectedScriptHost.cpp */,
 				7A0E76D910BF059800A0276E /* JSInjectedScriptHost.h */,
 				7A0E771C10C00DB100A0276E /* JSInspectorFrontendHost.cpp */,
@@ -14010,6 +14111,8 @@
 				7AABA25814BC613300AA9A11 /* DOMEditor.h */,
 				4F1442261339FD6200E0D6F8 /* DOMNodeHighlighter.cpp */,
 				4F1442271339FD6200E0D6F8 /* DOMNodeHighlighter.h */,
+				7A54881614E432A1006AE05A /* DOMPatchSupport.cpp */,
+				7A54881514E432A1006AE05A /* DOMPatchSupport.h */,
 				F35AE5AB14925F5B004D5776 /* DOMWrapperVisitor.h */,
 				5913A23F13D49EBA00F5B05C /* IdentifiersFactory.cpp */,
 				5913A24013D49EBA00F5B05C /* IdentifiersFactory.h */,
@@ -14021,6 +14124,9 @@
 				F31639691329481A00A649CB /* InjectedScriptManager.cpp */,
 				F316396A1329481A00A649CB /* InjectedScriptManager.h */,
 				7A563F9512DF5C9100F4536D /* InjectedScriptSource.js */,
+				1C435CD414E8545B004E10EA /* Inspector-0.1.json */,
+				1C435CD514E8545B004E10EA /* Inspector-1.0.json */,
+				1C435CD314E8544F004E10EA /* Inspector.json */,
 				4F2D205312EAE7B3005C2874 /* InspectorAgent.cpp */,
 				4F2D205212EAE7B3005C2874 /* InspectorAgent.h */,
 				B885E8D211E06DD2009FFBF4 /* InspectorApplicationCacheAgent.cpp */,
@@ -14034,6 +14140,8 @@
 				F3F5CF1012ED81A80084C569 /* InspectorConsoleInstrumentation.h */,
 				1C81B9570E97330800266E07 /* InspectorController.cpp */,
 				1C81B9560E97330800266E07 /* InspectorController.h */,
+				F325A40814EE36FA007324E2 /* InspectorCounters.cpp */,
+				F325A40914EE36FA007324E2 /* InspectorCounters.h */,
 				82AB1741124B99EC00C5069D /* InspectorCSSAgent.cpp */,
 				82AB1742124B99EC00C5069D /* InspectorCSSAgent.h */,
 				7AB0B1BE1211A62200A76940 /* InspectorDatabaseAgent.cpp */,
@@ -14325,8 +14433,6 @@
 		4150F9ED12B6E0990008C860 /* shadow */ = {
 			isa = PBXGroup;
 			children = (
-				57B7919F14C6A62900F202D1 /* ContentInclusionSelector.cpp */,
-				57B791A014C6A62900F202D1 /* ContentInclusionSelector.h */,
 				57B791A114C6A62900F202D1 /* ContentSelectorQuery.cpp */,
 				57B791A214C6A62900F202D1 /* ContentSelectorQuery.h */,
 				A7C9ABF61357A3BF00F5503F /* DetailsMarkerControl.cpp */,
@@ -14334,9 +14440,13 @@
 				57B791A714C6A63300F202D1 /* HTMLContentElement.cpp */,
 				57B791A814C6A63300F202D1 /* HTMLContentElement.h */,
 				A7B7749614CF6353004044BB /* HTMLContentElement.idl */,
+				57B7919F14C6A62900F202D1 /* HTMLContentSelector.cpp */,
+				57B791A014C6A62900F202D1 /* HTMLContentSelector.h */,
 				4ABDFF0714DBE312004D117D /* HTMLShadowElement.cpp */,
 				4ABDFF0814DBE312004D117D /* HTMLShadowElement.h */,
 				4ABDFF0914DBE312004D117D /* HTMLShadowElement.idl */,
+				57CF497214EE36D700ECFF14 /* InsertionPoint.cpp */,
+				57CF497314EE36D700ECFF14 /* InsertionPoint.h */,
 				417253A81354BBBC00360F2A /* MediaControlElements.cpp */,
 				417253A91354BBBC00360F2A /* MediaControlElements.h */,
 				4157AF7F12F1FB0400A8C6F5 /* MediaControlRootElement.cpp */,
@@ -14347,6 +14457,8 @@
 				A78E526E1346BD1700AD9C31 /* MeterShadowElement.h */,
 				A715E650134BBBEC00D8E713 /* ProgressShadowElement.cpp */,
 				A715E651134BBBEC00D8E713 /* ProgressShadowElement.h */,
+				572E92F914E540580087FFBA /* ShadowRootList.cpp */,
+				572E92FA14E540580087FFBA /* ShadowRootList.h */,
 				4150F9F012B6E0E70008C860 /* SliderThumbElement.cpp */,
 				4150F9EF12B6E0E70008C860 /* SliderThumbElement.h */,
 				142B97C713138943008BEF4B /* TextControlInnerElements.cpp */,
@@ -14429,6 +14541,7 @@
 		49484FAE102CF01E00187DD3 /* canvas */ = {
 			isa = PBXGroup;
 			children = (
+				A83B535B14F7413A00720D9D /* DOMWindowWebGL.idl */,
 				49EECDCC10503C2300099FAB /* ArrayBuffer.idl */,
 				49EECDC910503C2300099FAB /* ArrayBufferView.idl */,
 				6E4E91A710F7FB3100A2779C /* CanvasContextAttributes.cpp */,
@@ -14754,6 +14867,12 @@
 				510D4A47103177A20049EA54 /* WebSocketChannel.cpp */,
 				510D4A48103177A20049EA54 /* WebSocketChannel.h */,
 				510D4A49103177A20049EA54 /* WebSocketChannelClient.h */,
+				4AE02ABB14E8A9D200BC3BA7 /* WebSocketDeflater.cpp */,
+				4AE02ABC14E8A9D200BC3BA7 /* WebSocketDeflater.h */,
+				4A957F0314E241100049DBFB /* WebSocketExtensionDispatcher.cpp */,
+				4A957F0414E241100049DBFB /* WebSocketExtensionDispatcher.h */,
+				4ADE25F914E3BB4C004C2213 /* WebSocketExtensionProcessor.h */,
+				4A4A234514F1E1440046FBF1 /* WebSocketFrame.h */,
 				51ABAE421043AB4A008C5260 /* WebSocketHandshake.cpp */,
 				51ABAE431043AB4A008C5260 /* WebSocketHandshake.h */,
 				7637C540112E7B74003D6CDC /* WebSocketHandshakeRequest.cpp */,
@@ -15039,6 +15158,7 @@
 				CDAA8D0814D385600061EA60 /* PlatformClockCM.mm */,
 				BCAA486E14A052530088FAC4 /* PlatformEventFactoryMac.h */,
 				BCAA486D14A052530088FAC4 /* PlatformEventFactoryMac.mm */,
+				C5F765BA14E1ECF4006C899B /* PlatformPasteboardMac.mm */,
 				BC94D1070C274F88006BC617 /* PlatformScreenMac.mm */,
 				D39D006C11F8E308006041F2 /* PopupMenuMac.h */,
 				0668E18E0ADD9640004128E0 /* PopupMenuMac.mm */,
@@ -15151,16 +15271,7 @@
 				65A21483097A3F5300B9050A /* FrameTree.h */,
 				65CBFEF70974F607001DAC25 /* FrameView.cpp */,
 				65CBFEF80974F607001DAC25 /* FrameView.h */,
-				FE80D7B70E9C1F25000D6F75 /* Geolocation.cpp */,
-				FE80D7B80E9C1F25000D6F75 /* Geolocation.h */,
-				FE80D7B90E9C1F25000D6F75 /* Geolocation.idl */,
 				BC56CB1E10D5AC8000A77C64 /* GeolocationClient.h */,
-				BC56CB1C10D5AC8000A77C64 /* GeolocationController.cpp */,
-				BC56CB1D10D5AC8000A77C64 /* GeolocationController.h */,
-				BC56CB1F10D5AC8000A77C64 /* GeolocationError.h */,
-				BC56CB2010D5AC8000A77C64 /* GeolocationPosition.h */,
-				FE80D7BB0E9C1F25000D6F75 /* Geoposition.h */,
-				FE80D7BC0E9C1F25000D6F75 /* Geoposition.idl */,
 				C50B561412119D23008B46E0 /* GroupSettings.cpp */,
 				C50B561512119D23008B46E0 /* GroupSettings.h */,
 				BC94D1500C275C8B006BC617 /* History.cpp */,
@@ -15180,6 +15291,11 @@
 				A9C6E65D0D746694006442E9 /* Navigator.idl */,
 				E12719C90EEEC21300F61213 /* NavigatorBase.cpp */,
 				E12719C60EEEC16800F61213 /* NavigatorBase.h */,
+				9730BE1414EF286B00DF06B9 /* NavigatorRegisterProtocolHandler.cpp */,
+				9730BE1514EF286B00DF06B9 /* NavigatorRegisterProtocolHandler.h */,
+				9730BE1614EF286B00DF06B9 /* NavigatorRegisterProtocolHandler.idl */,
+				97CC3AE014E8E4A200894988 /* NavigatorSupplement.cpp */,
+				97CC3AE114E8E4A200894988 /* NavigatorSupplement.h */,
 				00146288103CD1DE000B20DB /* OriginAccessEntry.cpp */,
 				00146289103CD1DE000B20DB /* OriginAccessEntry.h */,
 				65FEA86809833ADE00BED4AB /* Page.cpp */,
@@ -15190,6 +15306,8 @@
 				7A674BDA0F9EBF4E006CF099 /* PageGroupLoadDeferrer.h */,
 				371E65CD13661EED00BEEDB0 /* PageSerializer.cpp */,
 				371E65CB13661EDC00BEEDB0 /* PageSerializer.h */,
+				A71E083514E3CEAF006A4619 /* PageSupplement.cpp */,
+				A71E083614E3CEAF006A4619 /* PageSupplement.h */,
 				FFD5B977135CC97800D5E92A /* PageVisibilityState.cpp */,
 				FFD5B978135CC97800D5E92A /* PageVisibilityState.h */,
 				8A844D0111D3C18E0014065C /* Performance.cpp */,
@@ -15201,13 +15319,6 @@
 				8AF4E55811DC5A63000ED3DE /* PerformanceTiming.cpp */,
 				8AF4E55911DC5A63000ED3DE /* PerformanceTiming.h */,
 				8AF4E55A11DC5A63000ED3DE /* PerformanceTiming.idl */,
-				FE80D7BD0E9C1F25000D6F75 /* PositionCallback.h */,
-				593AB6971355CD9200FC8211 /* PositionCallback.idl */,
-				FE80D7BF0E9C1F25000D6F75 /* PositionError.h */,
-				FE80D7C00E9C1F25000D6F75 /* PositionError.idl */,
-				FE80D7C10E9C1F25000D6F75 /* PositionErrorCallback.h */,
-				593AB6991355CDAE00FC8211 /* PositionErrorCallback.idl */,
-				FE80D7C30E9C1F25000D6F75 /* PositionOptions.h */,
 				B776D43C1104527500BEB0EC /* PrintContext.cpp */,
 				B776D43A1104525D00BEB0EC /* PrintContext.h */,
 				BCEC01BA0C274DAC009F4EC9 /* Screen.cpp */,
@@ -16641,6 +16752,7 @@
 				2E37DFD712DBAFB800A6B233 /* DOMURL.cpp */,
 				2E37DFD812DBAFB800A6B233 /* DOMURL.h */,
 				2E37DFD912DBAFB800A6B233 /* DOMURL.idl */,
+				A8A5205D14F6BD3C00FBA19E /* DOMWindowHTML.idl */,
 				F55B3D871251F12D003EF269 /* EmailInputType.cpp */,
 				F55B3D881251F12D003EF269 /* EmailInputType.h */,
 				F55B3D891251F12D003EF269 /* FileInputType.cpp */,
@@ -16915,8 +17027,6 @@
 				A456FA2511AD4A830020B420 /* LabelsNodeList.h */,
 				985BB96B13A94058007A0B69 /* LinkRelAttribute.cpp */,
 				985BB96C13A94058007A0B69 /* LinkRelAttribute.h */,
-				B1AD4E4D13A12A0B00846B27 /* LoadableTextTrack.cpp */,
-				B1AD4E4E13A12A0B00846B27 /* LoadableTextTrack.h */,
 				CD27F6E6145770D30078207D /* MediaController.cpp */,
 				CD27F6E4145767870078207D /* MediaController.h */,
 				CD27F6E014575C1B0078207D /* MediaController.idl */,
@@ -16960,15 +17070,6 @@
 				F55B3DA61251F12D003EF269 /* TextInputType.h */,
 				BCEF45E80E687767001C1287 /* TextMetrics.h */,
 				BCEF453F0E676AC1001C1287 /* TextMetrics.idl */,
-				B1AD4E5513A12A0B00846B27 /* TextTrack.cpp */,
-				B1AD4E5613A12A0B00846B27 /* TextTrack.h */,
-				0707569C1422979800414161 /* TextTrack.idl */,
-				B1AD4E5713A12A0B00846B27 /* TextTrackCue.cpp */,
-				B1AD4E5813A12A0B00846B27 /* TextTrackCue.h */,
-				0707569D1422979800414161 /* TextTrackCue.idl */,
-				B1AD4E5913A12A0B00846B27 /* TextTrackCueList.cpp */,
-				B1AD4E5A13A12A0B00846B27 /* TextTrackCueList.h */,
-				0707569E1422979800414161 /* TextTrackCueList.idl */,
 				F55B3DA71251F12D003EF269 /* TimeInputType.cpp */,
 				F55B3DA81251F12D003EF269 /* TimeInputType.h */,
 				E446139D0CD6331000FADA75 /* TimeRanges.cpp */,
@@ -16991,6 +17092,40 @@
 			tabWidth = 4;
 			usesTabs = 0;
 		};
+		971145FE14EF006E00674FD9 /* Modules */ = {
+			isa = PBXGroup;
+			children = (
+				971145FF14EF007900674FD9 /* geolocation */,
+			);
+			name = Modules;
+			sourceTree = "<group>";
+		};
+		971145FF14EF007900674FD9 /* geolocation */ = {
+			isa = PBXGroup;
+			children = (
+				9746AF1314F4DDE6003E7A70 /* Geolocation.cpp */,
+				9746AF1414F4DDE6003E7A70 /* Geolocation.h */,
+				9746AF1514F4DDE6003E7A70 /* Geolocation.idl */,
+				9746AF1614F4DDE6003E7A70 /* GeolocationController.cpp */,
+				9746AF1714F4DDE6003E7A70 /* GeolocationController.h */,
+				9746AF1814F4DDE6003E7A70 /* GeolocationError.h */,
+				9746AF1914F4DDE6003E7A70 /* GeolocationPosition.h */,
+				9746AF1A14F4DDE6003E7A70 /* Geoposition.h */,
+				9746AF1B14F4DDE6003E7A70 /* Geoposition.idl */,
+				9711460014EF009A00674FD9 /* NavigatorGeolocation.cpp */,
+				9711460114EF009A00674FD9 /* NavigatorGeolocation.h */,
+				9711460214EF009A00674FD9 /* NavigatorGeolocation.idl */,
+				9746AF1C14F4DDE6003E7A70 /* PositionCallback.h */,
+				9746AF1D14F4DDE6003E7A70 /* PositionCallback.idl */,
+				9746AF1E14F4DDE6003E7A70 /* PositionError.h */,
+				9746AF1F14F4DDE6003E7A70 /* PositionError.idl */,
+				9746AF2014F4DDE6003E7A70 /* PositionErrorCallback.h */,
+				9746AF2114F4DDE6003E7A70 /* PositionErrorCallback.idl */,
+				9746AF2214F4DDE6003E7A70 /* PositionOptions.h */,
+			);
+			name = geolocation;
+			sourceTree = "<group>";
+		};
 		976D6C57122B8A18001FD1F7 /* fileapi */ = {
 			isa = PBXGroup;
 			children = (
@@ -17003,13 +17138,17 @@
 				976D6C60122B8A3D001FD1F7 /* BlobURL.h */,
 				89878539122CA064003AABDA /* DirectoryEntry.cpp */,
 				8987853A122CA064003AABDA /* DirectoryEntry.h */,
+				E1AB1EAB14E9E2EF00449E13 /* DirectoryEntry.idl */,
 				893C47F01248BD39002B3D86 /* DirectoryEntrySync.cpp */,
 				893C47F11248BD39002B3D86 /* DirectoryEntrySync.h */,
+				E1AB1EAC14E9E2F800449E13 /* DirectoryEntrySync.idl */,
 				8987853B122CA064003AABDA /* DirectoryReader.cpp */,
 				8987853C122CA064003AABDA /* DirectoryReader.h */,
+				E1AB1EAD14E9E30500449E13 /* DirectoryReader.idl */,
 				890AE0E01256A07900F5968C /* DirectoryReaderBase.h */,
 				893C47F21248BD39002B3D86 /* DirectoryReaderSync.cpp */,
 				893C47F31248BD39002B3D86 /* DirectoryReaderSync.h */,
+				E1AB1EAE14E9E30B00449E13 /* DirectoryReaderSync.idl */,
 				8987853D122CA064003AABDA /* DOMFilePath.cpp */,
 				8987853E122CA064003AABDA /* DOMFilePath.h */,
 				8987853F122CA064003AABDA /* DOMFileSystem.cpp */,
@@ -17019,31 +17158,46 @@
 				893C47F51248BD39002B3D86 /* DOMFileSystemBase.h */,
 				893C47F61248BD39002B3D86 /* DOMFileSystemSync.cpp */,
 				893C47F71248BD39002B3D86 /* DOMFileSystemSync.h */,
+				E1AB1EAF14E9E31700449E13 /* DOMFileSystemSync.idl */,
 				89878541122CA064003AABDA /* EntriesCallback.h */,
+				E1AB1EB014E9E32300449E13 /* EntriesCallback.idl */,
 				89878542122CA064003AABDA /* Entry.cpp */,
 				89878543122CA064003AABDA /* Entry.h */,
+				E1AB1EB114E9E32A00449E13 /* Entry.idl */,
 				89878544122CA064003AABDA /* EntryArray.cpp */,
 				89878545122CA064003AABDA /* EntryArray.h */,
+				E1AB1EB214E9E33200449E13 /* EntryArray.idl */,
 				893C47F81248BD39002B3D86 /* EntryArraySync.cpp */,
 				893C47F91248BD39002B3D86 /* EntryArraySync.h */,
+				E1AB1EB314E9E33900449E13 /* EntryArraySync.idl */,
 				C6F41046130C6E8900393DE4 /* EntryBase.cpp */,
 				893C47FB1248BD39002B3D86 /* EntryBase.h */,
 				89878546122CA064003AABDA /* EntryCallback.h */,
+				E1AB1EB414E9E34500449E13 /* EntryCallback.idl */,
 				893C47FC1248BD39002B3D86 /* EntrySync.cpp */,
 				893C47FD1248BD39002B3D86 /* EntrySync.h */,
+				E1AB1EB514E9E34B00449E13 /* EntrySync.idl */,
 				89878547122CA064003AABDA /* ErrorCallback.h */,
+				E1AB1EB614E9E35200449E13 /* ErrorCallback.idl */,
 				976D6C61122B8A3D001FD1F7 /* File.cpp */,
 				976D6C62122B8A3D001FD1F7 /* File.h */,
+				E1AB1EB714E9E35800449E13 /* File.idl */,
 				893C47A51238908B002B3D86 /* FileCallback.h */,
+				E1AB1EB814E9E36200449E13 /* FileCallback.idl */,
 				89878548122CA064003AABDA /* FileEntry.cpp */,
 				89878549122CA064003AABDA /* FileEntry.h */,
+				E1AB1EB914E9E36D00449E13 /* FileEntry.idl */,
 				893C47FE1248BD39002B3D86 /* FileEntrySync.cpp */,
 				893C47FF1248BD39002B3D86 /* FileEntrySync.h */,
+				E1AB1EBA14E9E37200449E13 /* FileEntrySync.idl */,
 				976D6C64122B8A3D001FD1F7 /* FileError.h */,
+				E1AB1EBB14E9E37A00449E13 /* FileError.idl */,
 				978D07B5145A0F030096908D /* FileException.cpp */,
 				2EDF369E122C94C8002F7D4E /* FileException.h */,
+				E1AB1EBC14E9E39700449E13 /* FileException.idl */,
 				976D6C66122B8A3D001FD1F7 /* FileList.cpp */,
 				976D6C67122B8A3D001FD1F7 /* FileList.h */,
+				E1AB1EA814E9E27D00449E13 /* FileList.idl */,
 				4689F1AE1267BAE100E8D380 /* FileMetadata.h */,
 				976D6C69122B8A3D001FD1F7 /* FileReader.cpp */,
 				976D6C6A122B8A3D001FD1F7 /* FileReader.h */,
@@ -17053,9 +17207,11 @@
 				2E75841C12779ADA0062628B /* FileReaderLoaderClient.h */,
 				2EDF369A122C94B4002F7D4E /* FileReaderSync.cpp */,
 				2EDF369B122C94B4002F7D4E /* FileReaderSync.h */,
+				E1AB1EBD14E9E3A800449E13 /* FileReaderSync.idl */,
 				976D6C6C122B8A3D001FD1F7 /* FileStreamProxy.cpp */,
 				976D6C6D122B8A3D001FD1F7 /* FileStreamProxy.h */,
 				8987854A122CA064003AABDA /* FileSystemCallback.h */,
+				E1AB1EBE14E9E3B200449E13 /* FileSystemCallback.idl */,
 				8987854B122CA064003AABDA /* FileSystemCallbacks.cpp */,
 				8987854C122CA064003AABDA /* FileSystemCallbacks.h */,
 				976D6C6E122B8A3D001FD1F7 /* FileThread.cpp */,
@@ -17068,12 +17224,16 @@
 				46BC724C129B104C0071C07E /* FileWriterBase.h */,
 				46BC724D129B104C0071C07E /* FileWriterBaseCallback.h */,
 				893C47A61238908B002B3D86 /* FileWriterCallback.h */,
+				E1AB1EBF14E9E3BE00449E13 /* FileWriterCallback.idl */,
 				46700ECE127B96CB00F5D5D6 /* FileWriterSync.cpp */,
 				46700ECF127B96CB00F5D5D6 /* FileWriterSync.h */,
+				E1AB1EC014E9E3C400449E13 /* FileWriterSync.idl */,
 				8987854E122CA064003AABDA /* LocalFileSystem.cpp */,
 				8987854F122CA064003AABDA /* LocalFileSystem.h */,
 				89878550122CA064003AABDA /* Metadata.h */,
+				E1AB1EC114E9E3CC00449E13 /* Metadata.idl */,
 				89878551122CA064003AABDA /* MetadataCallback.h */,
+				E1AB1EC214E9E3D500449E13 /* MetadataCallback.idl */,
 				978D07B7145A0F1B0096908D /* OperationNotAllowedException.cpp */,
 				2E2445F51395893A004B6C19 /* OperationNotAllowedException.h */,
 				2E2445F61395893A004B6C19 /* OperationNotAllowedException.idl */,
@@ -17081,6 +17241,7 @@
 				976D6C76122B8A3D001FD1F7 /* ThreadableBlobRegistry.h */,
 				976D6C5C122B8A3D001FD1F7 /* WebKitBlobBuilder.cpp */,
 				976D6C5D122B8A3D001FD1F7 /* WebKitBlobBuilder.h */,
+				E1AB1EC314E9E3E200449E13 /* WebKitBlobBuilder.idl */,
 				8987854D122CA064003AABDA /* WebKitFlags.h */,
 			);
 			name = fileapi;
@@ -17162,13 +17323,13 @@
 		A75E8B7F0E1DE2B0007F2481 /* filters */ = {
 			isa = PBXGroup;
 			children = (
-				50CC089914C6E99C0017AB51 /* CustomFilterNumberParameter.h */,
 				49ECEB5C1499790D00CDD3A4 /* arm */,
 				50D405F7147D31F300D30BB5 /* CustomFilterMesh.cpp */,
 				50D405F8147D31F300D30BB5 /* CustomFilterMesh.h */,
-				509CC9FA14C069ED00BBECBD /* CustomFilterParameter.h */,
+				50CC089914C6E99C0017AB51 /* CustomFilterNumberParameter.h */,
 				50CC0A3814C6F5B10017AB51 /* CustomFilterOperation.cpp */,
 				50ACE2CA14B5D79300446666 /* CustomFilterOperation.h */,
+				509CC9FA14C069ED00BBECBD /* CustomFilterParameter.h */,
 				503D0CA714B5B08700F32F57 /* CustomFilterProgram.cpp */,
 				503D0CA814B5B08700F32F57 /* CustomFilterProgram.h */,
 				503D0CA914B5B08700F32F57 /* CustomFilterProgramClient.h */,
@@ -18088,6 +18249,8 @@
 		A8D2B2521287A56000AF4DDA /* cache */ = {
 			isa = PBXGroup;
 			children = (
+				A104F24114C71F7A009E2C23 /* CachedSVGDocument.cpp */,
+				A104F24214C71F7A009E2C23 /* CachedSVGDocument.h */,
 				BCB16C000979C3BD00467741 /* CachedCSSStyleSheet.cpp */,
 				BCB16C010979C3BD00467741 /* CachedCSSStyleSheet.h */,
 				BC64B4C90CB4295D005F2B62 /* CachedFont.cpp */,
@@ -18138,6 +18301,17 @@
 		B1AD4E7713A12A7200846B27 /* track */ = {
 			isa = PBXGroup;
 			children = (
+				9759E93414EF1CF80026A2DD /* LoadableTextTrack.cpp */,
+				9759E94814EF1D490026A2DD /* LoadableTextTrack.h */,
+				9759E93514EF1CF80026A2DD /* TextTrack.cpp */,
+				9759E93614EF1CF80026A2DD /* TextTrack.h */,
+				9759E93714EF1CF80026A2DD /* TextTrack.idl */,
+				9759E93814EF1CF80026A2DD /* TextTrackCue.cpp */,
+				9759E93914EF1CF80026A2DD /* TextTrackCue.h */,
+				9759E93A14EF1CF80026A2DD /* TextTrackCue.idl */,
+				9759E93B14EF1CF80026A2DD /* TextTrackCueList.cpp */,
+				9759E93C14EF1CF80026A2DD /* TextTrackCueList.h */,
+				9759E93D14EF1CF80026A2DD /* TextTrackCueList.idl */,
 				076970841463AD8700F502CF /* TextTrackList.cpp */,
 				076970851463AD8700F502CF /* TextTrackList.h */,
 				07B5A3061468537100A81ECE /* TextTrackList.idl */,
@@ -18163,6 +18337,7 @@
 				081CDFBD126ECFE800D215CA /* properties */,
 				B22277CB0D00BF1F0071B782 /* ColorDistance.cpp */,
 				B22277CC0D00BF1F0071B782 /* ColorDistance.h */,
+				A89AACD514F6C12700C1FA4A /* DOMWindowSVG.idl */,
 				E415F1830D9A1A830033CE97 /* ElementTimeControl.h */,
 				E415F10C0D9A05870033CE97 /* ElementTimeControl.idl */,
 				B22277CD0D00BF1F0071B782 /* GradientAttributes.h */,
@@ -18815,6 +18990,11 @@
 				37202198106213C600F25C4B /* FontSmoothingMode.h */,
 				3784C34A0E11AA34007D8D48 /* FontTraitsMask.h */,
 				BCE4413512F7490B009B84B8 /* FontWidthVariant.h */,
+				144FCE5414EC79E7000D17A3 /* FractionalLayoutPoint.h */,
+				144FCFDE14EF2509000D17A3 /* FractionalLayoutRect.cpp */,
+				144FCFDF14EF2509000D17A3 /* FractionalLayoutRect.h */,
+				144FCE5714EC79E7000D17A3 /* FractionalLayoutSize.cpp */,
+				144FCE5814EC79E7000D17A3 /* FractionalLayoutSize.h */,
 				BC23F0DA0DAFF4A4009FDC91 /* GeneratedImage.h */,
 				BCE04C890DAFF7A0007A0F41 /* Generator.h */,
 				2D2FC0561460CD6F00263633 /* GeneratorGeneratedImage.cpp */,
@@ -19063,6 +19243,7 @@
 				BC1A3794097C6FC40019F3D8 /* objc */,
 				93F8B3050A300FE100F61AB8 /* CodeGenerator.pm */,
 				93F8B3070A300FEA00F61AB8 /* generate-bindings.pl */,
+				A83B533814F399BB00720D9D /* IDLAttributes.txt */,
 				14813BF309EDF88E00F757E1 /* IDLParser.pm */,
 				93F8B3080A300FEA00F61AB8 /* IDLStructure.pm */,
 				C0F2A43F13869A280066C534 /* preprocessor.pm */,
@@ -19673,8 +19854,6 @@
 				F587868402DE3B8601EA4122 /* Cursor.h */,
 				A5732B08136A161D005C8D7C /* DateComponents.cpp */,
 				A5732B09136A161D005C8D7C /* DateComponents.h */,
-				BCC36EB61342AA3F004BEEF7 /* DefaultLocalizationStrategy.cpp */,
-				BCC36EB71342AA3F004BEEF7 /* DefaultLocalizationStrategy.h */,
 				A79546420B5C4CB4007B438F /* DragData.cpp */,
 				A7B6E69D0B291A9600D0529F /* DragData.h */,
 				A7CFB3CF0B7ED10A0070C32D /* DragImage.cpp */,
@@ -19690,6 +19869,7 @@
 				C57FEDE01212EE9C0097BE65 /* FileSystem.cpp */,
 				514B3F720C722047000530DF /* FileSystem.h */,
 				BC073BA90C399B1F000F5979 /* FloatConversion.h */,
+				144FCE5114EC79BC000D17A3 /* FractionalLayoutUnit.h */,
 				A8748BDF12CBF2DC001FBA41 /* HashTools.h */,
 				D6FDAEF2149C06190037B1E1 /* HistogramSupport.cpp */,
 				D630E2AB149BF344005B2F93 /* HistogramSupport.h */,
@@ -19707,7 +19887,6 @@
 				BCFF64900EAD15C200C1D6F7 /* LengthSize.h */,
 				A7AD2F850EC89D07008AB002 /* LinkHash.cpp */,
 				A7AD2F860EC89D07008AB002 /* LinkHash.h */,
-				BC5CFCA811F793320099ED09 /* LocalizationStrategy.h */,
 				C046E1AB1208A9FE00BA2CF7 /* LocalizedStrings.cpp */,
 				935207BD09BD410A00F2038D /* LocalizedStrings.h */,
 				A8239DFE09B3CF8A00B60641 /* Logging.cpp */,
@@ -19718,6 +19897,7 @@
 				BC772C4D0C4EB3040083285F /* MIMETypeRegistry.h */,
 				98EB1F941313FE0500D0E1EA /* NotImplemented.h */,
 				4B2708C50AF19EE40065127F /* Pasteboard.h */,
+				C5F765B414E1D414006C899B /* PasteboardStrategy.h */,
 				BC5C76281497FE1400BC4775 /* PlatformEvent.cpp */,
 				BC5C76291497FE1400BC4775 /* PlatformEvent.h */,
 				A723F77A1484CA4C008C6DBE /* PlatformExportMacros.h */,
@@ -19725,6 +19905,7 @@
 				935C476609AC4D4300A6AAB4 /* PlatformKeyboardEvent.h */,
 				932871BF0B20DEB70049035A /* PlatformMenuDescription.h */,
 				935C476709AC4D4300A6AAB4 /* PlatformMouseEvent.h */,
+				C5BAC16F14E30E4700008837 /* PlatformPasteboard.h */,
 				BCEC01D60C274EB4009F4EC9 /* PlatformScreen.h */,
 				1AD8F81A11CAB9E900E93E54 /* PlatformStrategies.cpp */,
 				1AD8F81911CAB9E900E93E54 /* PlatformStrategies.h */,
@@ -19782,7 +19963,6 @@
 				93309EA1099EB78C0056E581 /* Timer.cpp */,
 				9305B24C098F1B6B00C28855 /* Timer.h */,
 				1419D2C40CEA6F6100FF507A /* TreeShared.h */,
-				971491D912FD65E8001BFEB1 /* URLString.h */,
 				2E3BBF051162DA1100B9409A /* UUID.cpp */,
 				2E3BBF061162DA1100B9409A /* UUID.h */,
 				515788C01207852C00A37C4A /* VisitedLinkStrategy.h */,
@@ -19838,6 +20018,7 @@
 		E1F0424309839389006694EA /* xml */ = {
 			isa = PBXGroup;
 			children = (
+				A83B536C14F749E200720D9D /* DOMWindowXML.idl */,
 				00B9318013BA867F0035A948 /* parser */,
 				1ACE53E10A8D18E70022947D /* DOMParser.cpp */,
 				1ACE53E20A8D18E70022947D /* DOMParser.h */,
@@ -20012,8 +20193,6 @@
 				A80E6CD20A1989CA007FB8C5 /* CSSMediaRule.cpp */,
 				A80E6CD90A1989CA007FB8C5 /* CSSMediaRule.h */,
 				85C56CA20AA89C1000D95755 /* CSSMediaRule.idl */,
-				A80E6DF90A199067007FB8C5 /* StylePropertySet.cpp */,
-				A80E6DFA0A199067007FB8C5 /* StylePropertySet.h */,
 				A80E73470A199C77007FB8C5 /* CSSNamespace.h */,
 				F98FFF4211A2676200F548E8 /* CSSOMUtils.cpp */,
 				F98FFF4311A2676200F548E8 /* CSSOMUtils.h */,
@@ -20081,8 +20260,6 @@
 				501BAAB11395114B00F7ACEB /* CSSWrapShapes.cpp */,
 				501BA9E11393CEA000F7ACEB /* CSSWrapShapes.h */,
 				A80E6CE10A1989CA007FB8C5 /* DashboardRegion.h */,
-				A80E6CC20A1989CA007FB8C5 /* FontFamilyValue.cpp */,
-				A80E6CC90A1989CA007FB8C5 /* FontFamilyValue.h */,
 				4A6E9FC113C17D1D0046A7F8 /* FontFeatureValue.cpp */,
 				4A6E9FC213C17D1D0046A7F8 /* FontFeatureValue.h */,
 				A80E6CC70A1989CA007FB8C5 /* FontValue.cpp */,
@@ -20116,6 +20293,8 @@
 				D3AA10F1123A98AA0092152B /* MediaQueryMatcher.cpp */,
 				D3AA10F2123A98AA0092152B /* MediaQueryMatcher.h */,
 				A80E6CD10A1989CA007FB8C5 /* Pair.h */,
+				E4BBED0C14F4025D003F0B98 /* PropertySetCSSStyleDeclaration.cpp */,
+				E4BBED0D14F4025D003F0B98 /* PropertySetCSSStyleDeclaration.h */,
 				93CA4C9F09DF93FA00DF8677 /* quirks.css */,
 				BC4368E70C226E32005EFB5F /* Rect.h */,
 				A80E79960A19BD21007FB8C5 /* Rect.idl */,
@@ -20129,6 +20308,8 @@
 				0FF5026E102BA9660066F39A /* StyleMedia.cpp */,
 				0FF5026F102BA96A0066F39A /* StyleMedia.h */,
 				0FF50270102BA96A0066F39A /* StyleMedia.idl */,
+				A80E6DF90A199067007FB8C5 /* StylePropertySet.cpp */,
+				A80E6DFA0A199067007FB8C5 /* StylePropertySet.h */,
 				A8EA80050A19516E00A8EF5F /* StyleSheet.cpp */,
 				A8EA80040A19516E00A8EF5F /* StyleSheet.h */,
 				850656DC0AAB44D9002D15C0 /* StyleSheet.idl */,
@@ -20533,6 +20714,7 @@
 				939885C108B7E3D100E707C4 /* EventNames.cpp */,
 				939885C208B7E3D100E707C4 /* EventNames.h */,
 				8F6756191288B17B0047ACA3 /* EventQueue.h */,
+				CE5CB1B314EDAB6F00BB2795 /* EventSender.h */,
 				E12EDBE90B308E0B002704B6 /* EventTarget.cpp */,
 				E12EDB7A0B308A78002704B6 /* EventTarget.h */,
 				85AFA7420AAF298400E84305 /* EventTarget.idl */,
@@ -21199,6 +21381,7 @@
 				BCD533640ED6848900887468 /* CachedScriptSourceProvider.h in Headers */,
 				5038BE411472AD980095E0D1 /* CachedShader.h in Headers */,
 				D0BC54491443AC4A00E105DA /* CachedStyleSheetClient.h in Headers */,
+				A104F24414C71F7A009E2C23 /* CachedSVGDocument.h in Headers */,
 				0753860314489E9800B78452 /* CachedTextTrack.h in Headers */,
 				BCB16C280979C3BD00467741 /* CachedXSLStyleSheet.h in Headers */,
 				93F1995008245E59001E9ABC /* CachePolicy.h in Headers */,
@@ -21256,7 +21439,6 @@
 				A818721C0977D3C0005826D9 /* ContainerNode.h in Headers */,
 				E1A1470811102B1500EEC0F3 /* ContainerNodeAlgorithms.h in Headers */,
 				BC5EB9810E82072500B25965 /* ContentData.h in Headers */,
-				57B791A414C6A62900F202D1 /* ContentInclusionSelector.h in Headers */,
 				59102FBC14327D3B003C9D04 /* ContentSearchUtils.h in Headers */,
 				97C471DC12F925BD0086354B /* ContentSecurityPolicy.h in Headers */,
 				57B791A614C6A62900F202D1 /* ContentSelectorQuery.h in Headers */,
@@ -21314,7 +21496,6 @@
 				A80E6D080A1989CA007FB8C5 /* CSSInitialValue.h in Headers */,
 				BC772E131331620C001EC9CE /* CSSLineBoxContainValue.h in Headers */,
 				A80E6D030A1989CA007FB8C5 /* CSSMediaRule.h in Headers */,
-				A80E6DFC0A199067007FB8C5 /* StylePropertySet.h in Headers */,
 				A80E734E0A199C77007FB8C5 /* CSSNamespace.h in Headers */,
 				F98FFF4511A2676200F548E8 /* CSSOMUtils.h in Headers */,
 				A80E6D000A1989CA007FB8C5 /* CSSPageRule.h in Headers */,
@@ -21352,7 +21533,9 @@
 				BC2272AD0E82E8F300E7F975 /* CursorList.h in Headers */,
 				62CD325A1157E57C0063B0A7 /* CustomEvent.h in Headers */,
 				50D405FA147D31F300D30BB5 /* CustomFilterMesh.h in Headers */,
+				50CC089A14C6E99C0017AB51 /* CustomFilterNumberParameter.h in Headers */,
 				50ACE2CB14B5D79300446666 /* CustomFilterOperation.h in Headers */,
+				509CC9FB14C069ED00BBECBD /* CustomFilterParameter.h in Headers */,
 				503D0CAB14B5B08700F32F57 /* CustomFilterProgram.h in Headers */,
 				503D0CAC14B5B08700F32F57 /* CustomFilterProgramClient.h in Headers */,
 				50D40612147D49DE00D30BB5 /* CustomFilterShader.h in Headers */,
@@ -21381,7 +21564,6 @@
 				4162A451101145AE00DFF3ED /* DedicatedWorkerContext.h in Headers */,
 				41A3D58F101C152D00316D07 /* DedicatedWorkerThread.h in Headers */,
 				FD06DFA6134A4DEF006F5D7D /* DefaultAudioDestinationNode.h in Headers */,
-				BCC36EB91342AA3F004BEEF7 /* DefaultLocalizationStrategy.h in Headers */,
 				4167EBF6102962BA003D252A /* DefaultSharedWorkerRepository.h in Headers */,
 				FD31602C12B0267600C1A359 /* DelayDSPKernel.h in Headers */,
 				FD31602E12B0267600C1A359 /* DelayNode.h in Headers */,
@@ -21674,6 +21856,7 @@
 				85989DCF0ACC8BBD00A0BC51 /* DOMOverflowEventInternal.h in Headers */,
 				E1284BD61044A01E00EAEB52 /* DOMPageTransitionEvent.h in Headers */,
 				1ACE53E80A8D18E70022947D /* DOMParser.h in Headers */,
+				7A54881714E432A1006AE05A /* DOMPatchSupport.h in Headers */,
 				A9C6E4EC0D745E2B006442E9 /* DOMPlugin.h in Headers */,
 				A9C6E4F00D745E38006442E9 /* DOMPluginArray.h in Headers */,
 				BC1A37BB097C715F0019F3D8 /* DOMPrivate.h in Headers */,
@@ -22012,6 +22195,8 @@
 				316FE0820E6CCC2800BF6088 /* DOMWebKitCSSKeyframesRuleInternal.h in Headers */,
 				498391500F1E76B400C23782 /* DOMWebKitCSSMatrix.h in Headers */,
 				498391520F1E76B400C23782 /* DOMWebKitCSSMatrixInternal.h in Headers */,
+				8AD0A59614C88358000D83C5 /* DOMWebKitCSSRegionRule.h in Headers */,
+				8AD0A59814C88358000D83C5 /* DOMWebKitCSSRegionRuleInternal.h in Headers */,
 				31611E610E1C4E1400F6A579 /* DOMWebKitCSSTransformValue.h in Headers */,
 				31611E630E1C4E1400F6A579 /* DOMWebKitCSSTransformValueInternal.h in Headers */,
 				8A195932147EA16E00D1EA61 /* DOMWebKitNamedFlow.h in Headers */,
@@ -22056,6 +22241,7 @@
 				4BAE95B10B2FA9CE00AED8A0 /* EditorDeleteAction.h in Headers */,
 				93FDAFCA0B11307400E2746F /* EditorInsertAction.h in Headers */,
 				A8C4A80709D563270003AC8D /* Element.h in Headers */,
+				2CF6878A14D32EFF00340F39 /* ElementAttributeData.h in Headers */,
 				63F5D4F70E8C4B7100C0BD04 /* ElementRareData.h in Headers */,
 				E415F1840D9A1A830033CE97 /* ElementTimeControl.h in Headers */,
 				A8CFF6BE0A156118000A4234 /* EllipsisBox.h in Headers */,
@@ -22178,7 +22364,6 @@
 				B2C3DA660D006CD600EF6F26 /* FontDescription.h in Headers */,
 				B2C3DA680D006CD600EF6F26 /* FontFallbackList.h in Headers */,
 				B2C3DA6A0D006CD600EF6F26 /* FontFamily.h in Headers */,
-				A80E6CF30A1989CA007FB8C5 /* FontFamilyValue.h in Headers */,
 				4A6E9FC813C17D570046A7F8 /* FontFeatureSettings.h in Headers */,
 				4A6E9FC413C17D1D0046A7F8 /* FontFeatureValue.h in Headers */,
 				0845680812B90DA600960A9F /* FontMetrics.h in Headers */,
@@ -22201,6 +22386,9 @@
 				656D373A0ADBA5DE00A4554D /* FormState.h in Headers */,
 				41885B9311B6FDA6003383BB /* FormSubmission.h in Headers */,
 				935C476D09AC4D6300A6AAB4 /* FoundationExtras.h in Headers */,
+				144FCFE114EF2509000D17A3 /* FractionalLayoutRect.h in Headers */,
+				144FCE5D14EC79E7000D17A3 /* FractionalLayoutSize.h in Headers */,
+				144FCE5214EC79BC000D17A3 /* FractionalLayoutUnit.h in Headers */,
 				A853123D11D0471B00D4D077 /* FragmentScriptingPermission.h in Headers */,
 				65BF022F0974816300C43196 /* Frame.h in Headers */,
 				A7B070D3130A409C00A3763C /* FrameActionScheduler.h in Headers */,
@@ -22223,13 +22411,14 @@
 				BCE04C8A0DAFF7A0007A0F41 /* Generator.h in Headers */,
 				2D481F04146B5C6B00AA7834 /* GeneratorGeneratedImage.h in Headers */,
 				A622A8FF122C44A600A785B3 /* GenericBinding.h in Headers */,
-				FE80D7C60E9C1F25000D6F75 /* Geolocation.h in Headers */,
+				0720B0A114D3323500642955 /* GenericEventQueue.h in Headers */,
+				9746AF2414F4DDE6003E7A70 /* Geolocation.h in Headers */,
 				BC56CB2310D5AC8000A77C64 /* GeolocationClient.h in Headers */,
 				052BFCEB128ABF2100FD338D /* GeolocationClientMock.h in Headers */,
-				BC56CB2210D5AC8000A77C64 /* GeolocationController.h in Headers */,
-				BC56CB2410D5AC8000A77C64 /* GeolocationError.h in Headers */,
-				BC56CB2510D5AC8000A77C64 /* GeolocationPosition.h in Headers */,
-				FE80D7C90E9C1F25000D6F75 /* Geoposition.h in Headers */,
+				9746AF2714F4DDE6003E7A70 /* GeolocationController.h in Headers */,
+				9746AF2814F4DDE6003E7A70 /* GeolocationError.h in Headers */,
+				9746AF2914F4DDE6003E7A70 /* GeolocationPosition.h in Headers */,
+				9746AF2A14F4DDE6003E7A70 /* Geoposition.h in Headers */,
 				086BBD0F136039C2008B15D8 /* Glyph.h in Headers */,
 				B2C3DA6C0D006CD600EF6F26 /* GlyphBuffer.h in Headers */,
 				C5D4AA7A116BAFB60069CA93 /* GlyphMetricsMap.h in Headers */,
@@ -22279,6 +22468,7 @@
 				A8DF3FD0097FA0FC0052981B /* HTMLCollection.h in Headers */,
 				977B3865122883E900B81FF8 /* HTMLConstructionSite.h in Headers */,
 				57B791AA14C6A63300F202D1 /* HTMLContentElement.h in Headers */,
+				57B791A414C6A62900F202D1 /* HTMLContentSelector.h in Headers */,
 				E1A31663134BCAE8007C9A4F /* HTMLConverter.h in Headers */,
 				F5C041DB0FFCA7CE00839D4A /* HTMLDataListElement.h in Headers */,
 				D359D78A129CA2710006E5D2 /* HTMLDetailsElement.h in Headers */,
@@ -22412,6 +22602,7 @@
 				C585A6EF11D4FB3D004C3E4B /* IDBObjectStoreBackendImpl.h in Headers */,
 				C585A6F111D4FB3D004C3E4B /* IDBObjectStoreBackendInterface.h in Headers */,
 				C585A6F411D4FB3D004C3E4B /* IDBRequest.h in Headers */,
+				EB49DB8F14F46E8B002299D9 /* IDBTracing.h in Headers */,
 				B656626B120B115A006EA85C /* IDBTransaction.h in Headers */,
 				1A71D57C0F33819000F9CE4E /* IdentifierRep.h in Headers */,
 				5913A24213D49EBA00F5B05C /* IdentifiersFactory.h in Headers */,
@@ -22442,6 +22633,7 @@
 				BCEA485A097D93020094C9E4 /* InlineTextBox.h in Headers */,
 				37E3524D12450C6600BAF5D9 /* InputType.h in Headers */,
 				93309DEA099E64920056E581 /* InsertIntoTextNodeCommand.h in Headers */,
+				57CF497514EE36D700ECFF14 /* InsertionPoint.h in Headers */,
 				93309DEC099E64920056E581 /* InsertLineBreakCommand.h in Headers */,
 				D07DEABA0A36554A00CA30F8 /* InsertListCommand.h in Headers */,
 				93309DEE099E64920056E581 /* InsertNodeBeforeCommand.h in Headers */,
@@ -22455,6 +22647,7 @@
 				F3335BF912E07DC300D33011 /* InspectorConsoleAgent.h in Headers */,
 				F3F5CF1112ED81A80084C569 /* InspectorConsoleInstrumentation.h in Headers */,
 				1C81B95A0E97330800266E07 /* InspectorController.h in Headers */,
+				F325A40B14EE36FA007324E2 /* InspectorCounters.h in Headers */,
 				82AB1744124B99EC00C5069D /* InspectorCSSAgent.h in Headers */,
 				7AB0B1C11211A62200A76940 /* InspectorDatabaseAgent.h in Headers */,
 				F3F5CF1312ED81B30084C569 /* InspectorDatabaseInstrumentation.h in Headers */,
@@ -22470,6 +22663,7 @@
 				F344C7141125B82C00F26EEE /* InspectorFrontendClient.h in Headers */,
 				F344C75311294D9D00F26EEE /* InspectorFrontendClientLocal.h in Headers */,
 				7A0E770F10C00A8800A0276E /* InspectorFrontendHost.h in Headers */,
+				7A54858014E02D51006AE05A /* InspectorHistory.h in Headers */,
 				7ACD88D414C08BD60084EDD2 /* InspectorIndexedDBAgent.h in Headers */,
 				20D629271253690B00081543 /* InspectorInstrumentation.h in Headers */,
 				7AA51DD6148506A900AD2752 /* InspectorMemoryAgent.h in Headers */,
@@ -23004,6 +23198,7 @@
 				316FE0720E6CCBEE00BF6088 /* JSWebKitCSSKeyframeRule.h in Headers */,
 				316FE0740E6CCBEE00BF6088 /* JSWebKitCSSKeyframesRule.h in Headers */,
 				498391400F1E767500C23782 /* JSWebKitCSSMatrix.h in Headers */,
+				8AD0A59514C88336000D83C5 /* JSWebKitCSSRegionRule.h in Headers */,
 				31611E5B0E1C4DE000F6A579 /* JSWebKitCSSTransformValue.h in Headers */,
 				C6F0902D14327D4F00685849 /* JSWebKitMutationObserver.h in Headers */,
 				494BD79E0F55C94C00747828 /* JSWebKitPoint.h in Headers */,
@@ -23060,18 +23255,17 @@
 				98CE432A129E00E5005821DC /* LinkLoader.h in Headers */,
 				984264F112D5280A000D88A4 /* LinkLoaderClient.h in Headers */,
 				985BB96E13A94058007A0B69 /* LinkRelAttribute.h in Headers */,
-				B1AD4E5F13A12A0B00846B27 /* LoadableTextTrack.h in Headers */,
+				9759E94914EF1D490026A2DD /* LoadableTextTrack.h in Headers */,
 				656D37320ADBA5DE00A4554D /* LoaderNSURLExtras.h in Headers */,
 				7EE6846912D26E3800E79415 /* LoaderRunLoopCF.h in Headers */,
 				06E81ED70AB5D5E900C87837 /* LocalCurrentGraphicsContext.h in Headers */,
 				7633A72613D8B33A008501B6 /* LocaleToScriptMapping.h in Headers */,
 				89878568122CA064003AABDA /* LocalFileSystem.h in Headers */,
-				BC5CFCA911F793320099ED09 /* LocalizationStrategy.h in Headers */,
 				A5732B0D136A16C4005C8D7C /* LocalizedDate.h in Headers */,
 				F5142C69123F12B000F5BD4C /* LocalizedNumber.h in Headers */,
 				935207BE09BD410A00F2038D /* LocalizedStrings.h in Headers */,
-				511F23180DC160DA004F0032 /* LocalStorageTask.h in Headers */,
-				511F231A0DC160DA004F0032 /* LocalStorageThread.h in Headers */,
+				511F23180DC160DA004F0032 /* StorageTask.h in Headers */,
+				511F231A0DC160DA004F0032 /* StorageThread.h in Headers */,
 				BCE1C41B0D982980003B02F2 /* Location.h in Headers */,
 				A8239E0109B3CF8A00B60641 /* Logging.h in Headers */,
 				FD31603912B0267600C1A359 /* LowPass2FilterNode.h in Headers */,
@@ -23148,6 +23342,9 @@
 				979F43D41075E44A0000F83B /* NavigationScheduler.h in Headers */,
 				A9C6E5A60D746458006442E9 /* Navigator.h in Headers */,
 				E12719C70EEEC16800F61213 /* NavigatorBase.h in Headers */,
+				9711460414EF009A00674FD9 /* NavigatorGeolocation.h in Headers */,
+				97E4A12614F4C5D400870E43 /* NavigatorRegisterProtocolHandler.h in Headers */,
+				97CC3AE314E8E4A200894988 /* NavigatorSupplement.h in Headers */,
 				8A309C9F123950BE00CB9204 /* NestingLevelIncrementer.h in Headers */,
 				656D37430ADBA5DE00A4554D /* NetscapePlugInStreamLoader.h in Headers */,
 				628D214C12131ED10055DCFC /* NetworkingContext.h in Headers */,
@@ -23211,6 +23408,7 @@
 				F3820895147D35F90010BC06 /* PageRuntimeAgent.h in Headers */,
 				F34742E51343633C00531BC2 /* PageScriptDebugServer.h in Headers */,
 				371E65CC13661EDC00BEEDB0 /* PageSerializer.h in Headers */,
+				A71E083814E3CEAF006A4619 /* PageSupplement.h in Headers */,
 				E1284AE110447D4500EAEB52 /* PageTransitionEvent.h in Headers */,
 				51E1ECC30C91C90400DC255B /* PageURLRecord.h in Headers */,
 				FFD5B97B135CC97800D5E92A /* PageVisibilityState.h in Headers */,
@@ -23222,6 +23420,7 @@
 				F55B3DCA1251F12D003EF269 /* PasswordInputType.h in Headers */,
 				4B2708C70AF19EE40065127F /* Pasteboard.h in Headers */,
 				A7D3C5240B576B4B002CA450 /* PasteboardHelper.h in Headers */,
+				C598905714E9C28000E8D18B /* PasteboardStrategy.h in Headers */,
 				B27535800B053814002CE64F /* Path.h in Headers */,
 				A88DD4870B4629A300C02990 /* PathTraversalState.h in Headers */,
 				A8FA6E5D0E4CFDED00D5CF49 /* Pattern.h in Headers */,
@@ -23245,6 +23444,7 @@
 				932871C00B20DEB70049035A /* PlatformMenuDescription.h in Headers */,
 				41BF70100FE86F61005E8DEC /* PlatformMessagePortChannel.h in Headers */,
 				935C476909AC4D4300A6AAB4 /* PlatformMouseEvent.h in Headers */,
+				C598905814E9C29900E8D18B /* PlatformPasteboard.h in Headers */,
 				BCEC01D70C274EB4009F4EC9 /* PlatformScreen.h in Headers */,
 				1AD8F81B11CAB9E900E93E54 /* PlatformStrategies.h in Headers */,
 				B2C3DA2B0D006C1D00EF6F26 /* PlatformString.h in Headers */,
@@ -23269,20 +23469,22 @@
 				D39D006D11F8E308006041F2 /* PopupMenuMac.h in Headers */,
 				BC3BE12B0E98092F00835588 /* PopupMenuStyle.h in Headers */,
 				93F199DE08245E59001E9ABC /* Position.h in Headers */,
-				FE80D7CB0E9C1F25000D6F75 /* PositionCallback.h in Headers */,
-				FE80D7CD0E9C1F25000D6F75 /* PositionError.h in Headers */,
-				FE80D7CF0E9C1F25000D6F75 /* PositionErrorCallback.h in Headers */,
+				9746AF2C14F4DDE6003E7A70 /* PositionCallback.h in Headers */,
+				9746AF2E14F4DDE6003E7A70 /* PositionError.h in Headers */,
+				9746AF3014F4DDE6003E7A70 /* PositionErrorCallback.h in Headers */,
 				37919C240B7D188600A56998 /* PositionIterator.h in Headers */,
-				FE80D7D10E9C1F25000D6F75 /* PositionOptions.h in Headers */,
+				9746AF3214F4DDE6003E7A70 /* PositionOptions.h in Headers */,
 				C0F2A44113869AAB0066C534 /* preprocessor.pm in Headers */,
 				B71FE6DF11091CB300DAEF77 /* PrintContext.h in Headers */,
 				A8EA7EBC0A1945D000A8EF5F /* ProcessingInstruction.h in Headers */,
 				E44613EC0CD681B500FADA75 /* ProgressEvent.h in Headers */,
 				A715E653134BBBEC00D8E713 /* ProgressShadowElement.h in Headers */,
 				1A2A68240B5BEDE70002A480 /* ProgressTracker.h in Headers */,
+				E4BBED0F14F4025D003F0B98 /* PropertySetCSSStyleDeclaration.h in Headers */,
 				514C76750CE923A1007EF3CD /* ProtectionSpace.h in Headers */,
 				51A052561058874000CC9E95 /* ProtectionSpaceHash.h in Headers */,
 				1AF8E11A1256592600230FF7 /* ProxyServer.h in Headers */,
+				10FB084B14E15C7E00A3DB98 /* PublicURLManager.h in Headers */,
 				E4D687790ED7AE4F006EA978 /* PurgeableBuffer.h in Headers */,
 				7E33CD01127F340D00BE8F17 /* PurgePriority.h in Headers */,
 				550A0BCA085F6039007353D6 /* QualifiedName.h in Headers */,
@@ -23458,6 +23660,7 @@
 				A8CFF5E10A155A05000A4234 /* RootInlineBox.h in Headers */,
 				49E911C90EF86D47009D0CAF /* RotateTransformOperation.h in Headers */,
 				A73F95FF12C97BFE0031AAF9 /* RoundedRect.h in Headers */,
+				BC0B358814C4F9830055E22A /* RunLoop.h in Headers */,
 				1C63A2480F71646600C09D5A /* RunLoopTimer.h in Headers */,
 				1A569D1F0D7E2B82007C3983 /* runtime_array.h in Headers */,
 				1A569D210D7E2B82007C3983 /* runtime_method.h in Headers */,
@@ -23510,6 +23713,12 @@
 				0FE71406142170B800DB33BA /* ScrollbarThemeMock.h in Headers */,
 				5D925B680F64D4DD00B847F0 /* ScrollBehavior.h in Headers */,
 				1AA84F05143BA7BD0051D153 /* ScrollElasticityController.h in Headers */,
+				1AF62EE814DA22A70041556C /* ScrollingCoordinator.h in Headers */,
+				1AF62F2614DAFEA10041556C /* ScrollingThread.h in Headers */,
+				1AAADDA414DB409F00AF64B3 /* ScrollingTree.h in Headers */,
+				1AAADDE414DC8C8F00AF64B3 /* ScrollingTreeNode.h in Headers */,
+				1AAADDE914DC8DF800AF64B3 /* ScrollingTreeNodeMac.h in Headers */,
+				1AAADDBF14DC640700AF64B3 /* ScrollingTreeState.h in Headers */,
 				93C09C860B0657AA005ABD4D /* ScrollTypes.h in Headers */,
 				BC6D6E2609AF943500F59759 /* ScrollView.h in Headers */,
 				F55B3DD21251F12D003EF269 /* SearchInputType.h in Headers */,
@@ -23532,6 +23741,7 @@
 				0F3DD45012F5EA1B000D9190 /* ShadowBlur.h in Headers */,
 				BC5EB8C40E82031B00B25965 /* ShadowData.h in Headers */,
 				A6D169641346B4C1000EB770 /* ShadowRoot.h in Headers */,
+				572E92FC14E540580087FFBA /* ShadowRootList.h in Headers */,
 				A80E6CE80A1989CA007FB8C5 /* ShadowValue.h in Headers */,
 				B2AFFC940D00A5DF0030074D /* ShapeArabic.h in Headers */,
 				1A4A954E0B4EDCCB002D8C3C /* SharedBuffer.h in Headers */,
@@ -23635,6 +23845,7 @@
 				BC5EB72A0E81DE8100B25965 /* StyleMarqueeData.h in Headers */,
 				0FF50272102BA96A0066F39A /* StyleMedia.h in Headers */,
 				BC5EB74E0E81E06700B25965 /* StyleMultiColData.h in Headers */,
+				A80E6DFC0A199067007FB8C5 /* StylePropertySet.h in Headers */,
 				BC2272E40E82EE9B00E7F975 /* StyleRareInheritedData.h in Headers */,
 				BC2272BD0E82EAAE00E7F975 /* StyleRareNonInheritedData.h in Headers */,
 				BC2272870E82E70700E7F975 /* StyleReflection.h in Headers */,
@@ -23926,9 +24137,9 @@
 				93F198F608245E59001E9ABC /* TextResourceDecoder.h in Headers */,
 				A824B4650E2EF2EA0081A7B7 /* TextRun.h in Headers */,
 				B2C3DA4B0D006C1D00EF6F26 /* TextStream.h in Headers */,
-				B1AD4E6713A12A0B00846B27 /* TextTrack.h in Headers */,
-				B1AD4E6913A12A0B00846B27 /* TextTrackCue.h in Headers */,
-				B1AD4E6B13A12A0B00846B27 /* TextTrackCueList.h in Headers */,
+				9759E94014EF1CF80026A2DD /* TextTrack.h in Headers */,
+				9759E94314EF1CF80026A2DD /* TextTrackCue.h in Headers */,
+				9759E94614EF1CF80026A2DD /* TextTrackCueList.h in Headers */,
 				076970871463AD8700F502CF /* TextTrackList.h in Headers */,
 				B1AD4E7413A12A4600846B27 /* TextTrackLoader.h in Headers */,
 				498770F11242C535002226BA /* Texture.h in Headers */,
@@ -23974,7 +24185,6 @@
 				E4AFCFA50DAF29A300F5F55C /* UnitBezier.h in Headers */,
 				D086FE9809D53AAB005BC74D /* UnlinkCommand.h in Headers */,
 				F55B3DDE1251F12D003EF269 /* URLInputType.h in Headers */,
-				971491DA12FD65E8001BFEB1 /* URLString.h in Headers */,
 				656581B209D14EE6000E61D7 /* UserAgentStyleSheets.h in Headers */,
 				003F1FEA11E6AB43008258D9 /* UserContentTypes.h in Headers */,
 				BCACF3BD1072921A00C0C8A3 /* UserContentURLPattern.h in Headers */,
@@ -24055,6 +24265,10 @@
 				518A34C21026C831001B6896 /* WebSocket.h in Headers */,
 				510D4A4F103177A20049EA54 /* WebSocketChannel.h in Headers */,
 				510D4A50103177A20049EA54 /* WebSocketChannelClient.h in Headers */,
+				4AE02ABE14E8A9D200BC3BA7 /* WebSocketDeflater.h in Headers */,
+				4A957F0714E241300049DBFB /* WebSocketExtensionDispatcher.h in Headers */,
+				4ADE25FA14E3BB4C004C2213 /* WebSocketExtensionProcessor.h in Headers */,
+				4A4A234614F1E1440046FBF1 /* WebSocketFrame.h in Headers */,
 				51ABAE451043AB4A008C5260 /* WebSocketHandshake.h in Headers */,
 				7637C543112E7B7E003D6CDC /* WebSocketHandshakeRequest.h in Headers */,
 				767F99C011A119560080C51D /* WebSocketHandshakeResponse.h in Headers */,
@@ -24139,22 +24353,6 @@
 				E1BE512E0CF6C512002EA959 /* XSLTUnicodeSort.h in Headers */,
 				977E2E0F12F0FC9C00C13379 /* XSSAuditor.h in Headers */,
 				FD537353137B651800008DCE /* ZeroPole.h in Headers */,
-				509CC9FB14C069ED00BBECBD /* CustomFilterParameter.h in Headers */,
-				50CC089A14C6E99C0017AB51 /* CustomFilterNumberParameter.h in Headers */,
-				BC0B358814C4F9830055E22A /* RunLoop.h in Headers */,
-				8AD0A59514C88336000D83C5 /* JSWebKitCSSRegionRule.h in Headers */,
-				8AD0A59614C88358000D83C5 /* DOMWebKitCSSRegionRule.h in Headers */,
-				8AD0A59814C88358000D83C5 /* DOMWebKitCSSRegionRuleInternal.h in Headers */,
-				0720B0A114D3323500642955 /* GenericEventQueue.h in Headers */,
-				2CF6878A14D32EFF00340F39 /* ElementAttributeData.h in Headers */,
-				1AF62EE814DA22A70041556C /* ScrollingCoordinator.h in Headers */,
-				1AF62F2614DAFEA10041556C /* ScrollingThread.h in Headers */,
-				1AAADDA414DB409F00AF64B3 /* ScrollingTree.h in Headers */,
-				1AAADDBF14DC640700AF64B3 /* ScrollingTreeState.h in Headers */,
-				1AAADDE414DC8C8F00AF64B3 /* ScrollingTreeNode.h in Headers */,
-				1AAADDE914DC8DF800AF64B3 /* ScrollingTreeNodeMac.h in Headers */,
-				10FB084B14E15C7E00A3DB98 /* PublicURLManager.h in Headers */,
-				7A54858014E02D51006AE05A /* InspectorHistory.h in Headers */,
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 		};
@@ -24622,6 +24820,7 @@
 				BCB16C290979C3BD00467741 /* CachedResourceLoader.cpp in Sources */,
 				BCB16C230979C3BD00467741 /* CachedScript.cpp in Sources */,
 				5038BE401472AD980095E0D1 /* CachedShader.cpp in Sources */,
+				A104F24314C71F7A009E2C23 /* CachedSVGDocument.cpp in Sources */,
 				0753860214489E9800B78452 /* CachedTextTrack.cpp in Sources */,
 				BCB16C270979C3BD00467741 /* CachedXSLStyleSheet.cpp in Sources */,
 				49AE2D96134EE5F90072920A /* CalculationValue.cpp in Sources */,
@@ -24670,7 +24869,6 @@
 				41F0618F0F5F069800A07EAC /* ConsoleMessage.cpp in Sources */,
 				A818721F0977D3C0005826D9 /* ContainerNode.cpp in Sources */,
 				BC5EB9800E82072500B25965 /* ContentData.cpp in Sources */,
-				57B791A314C6A62900F202D1 /* ContentInclusionSelector.cpp in Sources */,
 				59102FBB14327D3B003C9D04 /* ContentSearchUtils.cpp in Sources */,
 				97C471DB12F925BD0086354B /* ContentSecurityPolicy.cpp in Sources */,
 				57B791A514C6A62900F202D1 /* ContentSelectorQuery.cpp in Sources */,
@@ -24722,7 +24920,6 @@
 				A80E6D020A1989CA007FB8C5 /* CSSInitialValue.cpp in Sources */,
 				BC772E16133162C2001EC9CE /* CSSLineBoxContainValue.cpp in Sources */,
 				A80E6CFC0A1989CA007FB8C5 /* CSSMediaRule.cpp in Sources */,
-				A80E6DFB0A199067007FB8C5 /* StylePropertySet.cpp in Sources */,
 				F98FFF4411A2676200F548E8 /* CSSOMUtils.cpp in Sources */,
 				A80E6CF50A1989CA007FB8C5 /* CSSPageRule.cpp in Sources */,
 				BC772B3D0C4EA91E0083285F /* CSSParser.cpp in Sources */,
@@ -24776,7 +24973,6 @@
 				4162A450101145AE00DFF3ED /* DedicatedWorkerContext.cpp in Sources */,
 				41A3D58E101C152D00316D07 /* DedicatedWorkerThread.cpp in Sources */,
 				FD06DFA5134A4DEF006F5D7D /* DefaultAudioDestinationNode.cpp in Sources */,
-				BCC36EB81342AA3F004BEEF7 /* DefaultLocalizationStrategy.cpp in Sources */,
 				4167EBF5102962BA003D252A /* DefaultSharedWorkerRepository.cpp in Sources */,
 				FD31602B12B0267600C1A359 /* DelayDSPKernel.cpp in Sources */,
 				FD31602D12B0267600C1A359 /* DelayNode.cpp in Sources */,
@@ -24947,6 +25143,7 @@
 				85C7F5D10AAFB8D9004014DD /* DOMOverflowEvent.mm in Sources */,
 				E1284BD51044A01E00EAEB52 /* DOMPageTransitionEvent.mm in Sources */,
 				1ACE53E70A8D18E70022947D /* DOMParser.cpp in Sources */,
+				7A54881814E432A1006AE05A /* DOMPatchSupport.cpp in Sources */,
 				A9C6E4EB0D745E2B006442E9 /* DOMPlugin.cpp in Sources */,
 				A9C6E4EF0D745E38006442E9 /* DOMPluginArray.cpp in Sources */,
 				85F56A7B0A98CE3700ADB60A /* DOMProcessingInstruction.mm in Sources */,
@@ -25147,6 +25344,7 @@
 				93A38B4B0D0E5808006872C2 /* EditorCommand.cpp in Sources */,
 				ED501DC60B249F2900AE18D9 /* EditorMac.mm in Sources */,
 				A8C4A80809D563270003AC8D /* Element.cpp in Sources */,
+				2CF6878814D32EB500340F39 /* ElementAttributeData.cpp in Sources */,
 				A8CFF6CB0A1561CD000A4234 /* EllipsisBox.cpp in Sources */,
 				F55B3DBB1251F12D003EF269 /* EmailInputType.cpp in Sources */,
 				A8EA7EC10A1945D000A8EF5F /* EntityReference.cpp in Sources */,
@@ -25250,7 +25448,6 @@
 				37ACCF690DA414E70089E602 /* FontDescription.cpp in Sources */,
 				B2C3DA670D006CD600EF6F26 /* FontFallbackList.cpp in Sources */,
 				B2C3DA690D006CD600EF6F26 /* FontFamily.cpp in Sources */,
-				A80E6CEC0A1989CA007FB8C5 /* FontFamilyValue.cpp in Sources */,
 				72626E020EF022FE00A07E20 /* FontFastPath.cpp in Sources */,
 				4A6E9FC713C17D570046A7F8 /* FontFeatureSettings.cpp in Sources */,
 				4A6E9FC313C17D1D0046A7F8 /* FontFeatureValue.cpp in Sources */,
@@ -25268,6 +25465,8 @@
 				514C764F0CE9234E007EF3CD /* FormDataStreamMac.mm in Sources */,
 				656D373B0ADBA5DE00A4554D /* FormState.cpp in Sources */,
 				41885B9411B6FDA6003383BB /* FormSubmission.cpp in Sources */,
+				144FCFE014EF2509000D17A3 /* FractionalLayoutRect.cpp in Sources */,
+				144FCE5C14EC79E7000D17A3 /* FractionalLayoutSize.cpp in Sources */,
 				65BF022E0974816300C43196 /* Frame.cpp in Sources */,
 				A7B070D2130A409C00A3763C /* FrameActionScheduler.cpp in Sources */,
 				974A862214B7ADBB003FDC76 /* FrameDestructionObserver.cpp in Sources */,
@@ -25282,9 +25481,10 @@
 				51C81B890C4422F70019ECE3 /* FTPDirectoryParser.cpp in Sources */,
 				1432E8490C51493F00B1500F /* GCController.cpp in Sources */,
 				2D481F03146B5C6500AA7834 /* GeneratorGeneratedImage.cpp in Sources */,
-				FE80D7C50E9C1F25000D6F75 /* Geolocation.cpp in Sources */,
+				0720B0A014D3323500642955 /* GenericEventQueue.cpp in Sources */,
+				9746AF2314F4DDE6003E7A70 /* Geolocation.cpp in Sources */,
 				052BFCE9128ABF1500FD338D /* GeolocationClientMock.cpp in Sources */,
-				BC56CB2110D5AC8000A77C64 /* GeolocationController.cpp in Sources */,
+				9746AF2614F4DDE6003E7A70 /* GeolocationController.cpp in Sources */,
 				B2C3DA6D0D006CD600EF6F26 /* GlyphPageTreeNode.cpp in Sources */,
 				B2AFFC830D00A5C10030074D /* GlyphPageTreeNodeMac.cpp in Sources */,
 				BC53C6080DA56C570021EB5D /* Gradient.cpp in Sources */,
@@ -25330,6 +25530,7 @@
 				A8DF3FD1097FA0FC0052981B /* HTMLCollection.cpp in Sources */,
 				977B3864122883E900B81FF8 /* HTMLConstructionSite.cpp in Sources */,
 				57B791A914C6A63300F202D1 /* HTMLContentElement.cpp in Sources */,
+				57B791A314C6A62900F202D1 /* HTMLContentSelector.cpp in Sources */,
 				5D4F51DF132725480016F541 /* HTMLConverter.mm in Sources */,
 				F5C041DA0FFCA7CE00839D4A /* HTMLDataListElement.cpp in Sources */,
 				D359D789129CA2710006E5D2 /* HTMLDetailsElement.cpp in Sources */,
@@ -25480,6 +25681,7 @@
 				BCEA4859097D93020094C9E4 /* InlineTextBox.cpp in Sources */,
 				37E3524B12450C5200BAF5D9 /* InputType.cpp in Sources */,
 				93309DE9099E64920056E581 /* InsertIntoTextNodeCommand.cpp in Sources */,
+				57CF497414EE36D700ECFF14 /* InsertionPoint.cpp in Sources */,
 				93309DEB099E64920056E581 /* InsertLineBreakCommand.cpp in Sources */,
 				D07DEAB90A36554A00CA30F8 /* InsertListCommand.cpp in Sources */,
 				93309DED099E64920056E581 /* InsertNodeBeforeCommand.cpp in Sources */,
@@ -25492,6 +25694,7 @@
 				7A1F2B52126C61B20006A7E6 /* InspectorClient.cpp in Sources */,
 				F3335BF812E07DC300D33011 /* InspectorConsoleAgent.cpp in Sources */,
 				1C81B95B0E97330800266E07 /* InspectorController.cpp in Sources */,
+				F325A40A14EE36FA007324E2 /* InspectorCounters.cpp in Sources */,
 				82AB1743124B99EC00C5069D /* InspectorCSSAgent.cpp in Sources */,
 				7AB0B1C01211A62200A76940 /* InspectorDatabaseAgent.cpp in Sources */,
 				41F062150F5F192600A07EAC /* InspectorDatabaseResource.cpp in Sources */,
@@ -25504,6 +25707,7 @@
 				4F4F5FFB11CBD2E100A186BF /* InspectorFrontend.cpp in Sources */,
 				F344C75811294FF600F26EEE /* InspectorFrontendClientLocal.cpp in Sources */,
 				7A0E770E10C00A8800A0276E /* InspectorFrontendHost.cpp in Sources */,
+				7A54857F14E02D51006AE05A /* InspectorHistory.cpp in Sources */,
 				7ACD88D314C08BD60084EDD2 /* InspectorIndexedDBAgent.cpp in Sources */,
 				20D629261253690B00081543 /* InspectorInstrumentation.cpp in Sources */,
 				7AA51DD5148506A900AD2752 /* InspectorMemoryAgent.cpp in Sources */,
@@ -25515,6 +25719,7 @@
 				82AB1773125C826700C5069D /* InspectorStyleSheet.cpp in Sources */,
 				82889B4C13C62392009A6156 /* InspectorStyleTextEditor.cpp in Sources */,
 				754133AA102E00F400075D00 /* InspectorTimelineAgent.cpp in Sources */,
+				573D134714CE39FF0057ABCA /* InspectorTypeBuilder.cpp in Sources */,
 				4F3289B511A42AAB005ABE7E /* InspectorValues.cpp in Sources */,
 				F3810C1B1365A49600ED6E33 /* InspectorWorkerAgent.cpp in Sources */,
 				F350B73513F1377D00880C43 /* InstrumentingAgents.cpp in Sources */,
@@ -26214,7 +26419,7 @@
 				A7AD2F870EC89D07008AB002 /* LinkHash.cpp in Sources */,
 				98CE4326129E00BD005821DC /* LinkLoader.cpp in Sources */,
 				985BB96D13A94058007A0B69 /* LinkRelAttribute.cpp in Sources */,
-				B1AD4E5E13A12A0B00846B27 /* LoadableTextTrack.cpp in Sources */,
+				9759E93E14EF1CF80026A2DD /* LoadableTextTrack.cpp in Sources */,
 				656D37330ADBA5DE00A4554D /* LoaderNSURLExtras.mm in Sources */,
 				7EE6846812D26E3800E79415 /* LoaderRunLoopCF.cpp in Sources */,
 				06E81EEC0AB5DA9700C87837 /* LocalCurrentGraphicsContext.mm in Sources */,
@@ -26224,8 +26429,8 @@
 				F5CC42DC12F801CA00D5F7E3 /* LocalizedNumberMac.mm in Sources */,
 				C046E1AC1208A9FE00BA2CF7 /* LocalizedStrings.cpp in Sources */,
 				BC25B52A131C6D3900180E10 /* LocalizedStringsMac.mm in Sources */,
-				511F23170DC160DA004F0032 /* LocalStorageTask.cpp in Sources */,
-				511F23190DC160DA004F0032 /* LocalStorageThread.cpp in Sources */,
+				511F23170DC160DA004F0032 /* StorageTask.cpp in Sources */,
+				511F23190DC160DA004F0032 /* StorageThread.cpp in Sources */,
 				BCE1C41C0D982981003B02F2 /* Location.cpp in Sources */,
 				A8239E0009B3CF8A00B60641 /* Logging.cpp in Sources */,
 				1402645E0AFDC19B005919E2 /* LoggingMac.mm in Sources */,
@@ -26295,6 +26500,9 @@
 				979F43D31075E44A0000F83B /* NavigationScheduler.cpp in Sources */,
 				A9C6E5A50D746458006442E9 /* Navigator.cpp in Sources */,
 				E12719CA0EEEC21300F61213 /* NavigatorBase.cpp in Sources */,
+				9711460314EF009A00674FD9 /* NavigatorGeolocation.cpp in Sources */,
+				97E4A12714F4C5D700870E43 /* NavigatorRegisterProtocolHandler.cpp in Sources */,
+				97CC3AE214E8E4A200894988 /* NavigatorSupplement.cpp in Sources */,
 				5D874F130D161D3200796C3B /* NetscapePlugInStreamLoader.cpp in Sources */,
 				59C27F05138D28C10079B7E2 /* NetworkResourcesData.cpp in Sources */,
 				1A7FA61B0DDA3BBE0028F8A5 /* NetworkStateNotifier.cpp in Sources */,
@@ -26342,6 +26550,7 @@
 				F3820894147D35F90010BC06 /* PageRuntimeAgent.cpp in Sources */,
 				F34742E41343633C00531BC2 /* PageScriptDebugServer.cpp in Sources */,
 				371E65CE13661EED00BEEDB0 /* PageSerializer.cpp in Sources */,
+				A71E083714E3CEAF006A4619 /* PageSupplement.cpp in Sources */,
 				E1284AEA10447DEE00EAEB52 /* PageTransitionEvent.cpp in Sources */,
 				51E1ECC20C91C90400DC255B /* PageURLRecord.cpp in Sources */,
 				FFD5B97A135CC97800D5E92A /* PageVisibilityState.cpp in Sources */,
@@ -26364,9 +26573,11 @@
 				4958782112A57DDF007238AC /* PlatformCAAnimationMac.mm in Sources */,
 				4958782212A57DDF007238AC /* PlatformCALayerMac.mm in Sources */,
 				CDEA763014608A53008B31F1 /* PlatformClockCA.cpp in Sources */,
+				CDAA8D0A14D71B2E0061EA60 /* PlatformClockCM.mm in Sources */,
 				BC5C762A1497FE1400BC4775 /* PlatformEvent.cpp in Sources */,
 				BCAA486F14A052530088FAC4 /* PlatformEventFactoryMac.mm in Sources */,
 				41BF700F0FE86F61005E8DEC /* PlatformMessagePortChannel.cpp in Sources */,
+				C598902E14E9B0F800E8D18B /* PlatformPasteboardMac.mm in Sources */,
 				BC94D1080C274F88006BC617 /* PlatformScreenMac.mm in Sources */,
 				1AD8F81C11CAB9E900E93E54 /* PlatformStrategies.cpp in Sources */,
 				A9C6E4F30D745E48006442E9 /* PluginData.cpp in Sources */,
@@ -26386,6 +26597,7 @@
 				E44613EB0CD681B400FADA75 /* ProgressEvent.cpp in Sources */,
 				A715E652134BBBEC00D8E713 /* ProgressShadowElement.cpp in Sources */,
 				1A2A68230B5BEDE70002A480 /* ProgressTracker.cpp in Sources */,
+				E4BBED0E14F4025D003F0B98 /* PropertySetCSSStyleDeclaration.cpp in Sources */,
 				514C76740CE923A1007EF3CD /* ProtectionSpace.cpp in Sources */,
 				1AF8E13312565A4400230FF7 /* ProxyServer.cpp in Sources */,
 				1AF8E1C3125673E000230FF7 /* ProxyServerCFNet.cpp in Sources */,
@@ -26525,8 +26737,8 @@
 				A8CFF5E70A155A05000A4234 /* RootInlineBox.cpp in Sources */,
 				49E911C80EF86D47009D0CAF /* RotateTransformOperation.cpp in Sources */,
 				A73F95FE12C97BFE0031AAF9 /* RoundedRect.cpp in Sources */,
-				BC0B358314C4F9540055E22A /* RunLoopMac.mm in Sources */,
 				BC0B358714C4F9830055E22A /* RunLoop.cpp in Sources */,
+				BC0B358314C4F9540055E22A /* RunLoopMac.mm in Sources */,
 				1C63A2490F71646600C09D5A /* RunLoopTimerCF.cpp in Sources */,
 				1A569D1E0D7E2B82007C3983 /* runtime_array.cpp in Sources */,
 				1A569D200D7E2B82007C3983 /* runtime_method.cpp in Sources */,
@@ -26573,6 +26785,16 @@
 				0FE71405142170B800DB33BA /* ScrollbarThemeMock.cpp in Sources */,
 				5D925B670F64D4DD00B847F0 /* ScrollBehavior.cpp in Sources */,
 				1AA84F04143BA7BD0051D153 /* ScrollElasticityController.mm in Sources */,
+				1AF62EE714DA22A70041556C /* ScrollingCoordinator.cpp in Sources */,
+				1AF62EE614DA22A70041556C /* ScrollingCoordinatorMac.mm in Sources */,
+				3866AF3814F1C17100283D68 /* ScrollingCoordinatorNone.cpp in Sources */,
+				1AF62F2514DAFE9E0041556C /* ScrollingThread.cpp in Sources */,
+				1AF62F2414DAFE910041556C /* ScrollingThreadMac.mm in Sources */,
+				1AAADDA314DB409F00AF64B3 /* ScrollingTree.cpp in Sources */,
+				1AAADDE314DC8C8F00AF64B3 /* ScrollingTreeNode.cpp in Sources */,
+				1AAADDE814DC8DF800AF64B3 /* ScrollingTreeNodeMac.mm in Sources */,
+				1AAADDBE14DC640700AF64B3 /* ScrollingTreeState.cpp in Sources */,
+				1AAADDDA14DC74EC00AF64B3 /* ScrollingTreeStateMac.mm in Sources */,
 				BC2441C40E8B65D00055320F /* ScrollView.cpp in Sources */,
 				9353676B09AED88B00D35CD6 /* ScrollViewMac.mm in Sources */,
 				F55B3DD11251F12D003EF269 /* SearchInputType.cpp in Sources */,
@@ -26593,6 +26815,7 @@
 				0F3DD44F12F5EA1B000D9190 /* ShadowBlur.cpp in Sources */,
 				BC5EB8C30E82031B00B25965 /* ShadowData.cpp in Sources */,
 				A6D169621346B49B000EB770 /* ShadowRoot.cpp in Sources */,
+				572E92FB14E540580087FFBA /* ShadowRootList.cpp in Sources */,
 				A80E6CF40A1989CA007FB8C5 /* ShadowValue.cpp in Sources */,
 				B2AFFC930D00A5DF0030074D /* ShapeArabic.c in Sources */,
 				1A4A954D0B4EDCCB002D8C3C /* SharedBuffer.cpp in Sources */,
@@ -26686,6 +26909,7 @@
 				BC5EB7290E81DE8100B25965 /* StyleMarqueeData.cpp in Sources */,
 				0FF50271102BA96A0066F39A /* StyleMedia.cpp in Sources */,
 				BC5EB74D0E81E06700B25965 /* StyleMultiColData.cpp in Sources */,
+				A80E6DFB0A199067007FB8C5 /* StylePropertySet.cpp in Sources */,
 				BC2272E30E82EE9B00E7F975 /* StyleRareInheritedData.cpp in Sources */,
 				BC2272BC0E82EAAE00E7F975 /* StyleRareNonInheritedData.cpp in Sources */,
 				A8EA800D0A19516E00A8EF5F /* StyleSheet.cpp in Sources */,
@@ -26896,9 +27120,9 @@
 				93F19A9D08245E59001E9ABC /* TextResourceDecoder.cpp in Sources */,
 				376DCCE113B4F966002EBEFC /* TextRun.cpp in Sources */,
 				B2C3DA4A0D006C1D00EF6F26 /* TextStream.cpp in Sources */,
-				B1AD4E6613A12A0B00846B27 /* TextTrack.cpp in Sources */,
-				B1AD4E6813A12A0B00846B27 /* TextTrackCue.cpp in Sources */,
-				B1AD4E6A13A12A0B00846B27 /* TextTrackCueList.cpp in Sources */,
+				9759E93F14EF1CF80026A2DD /* TextTrack.cpp in Sources */,
+				9759E94214EF1CF80026A2DD /* TextTrackCue.cpp in Sources */,
+				9759E94514EF1CF80026A2DD /* TextTrackCueList.cpp in Sources */,
 				076970861463AD8700F502CF /* TextTrackList.cpp in Sources */,
 				B1AD4E7313A12A4600846B27 /* TextTrackLoader.cpp in Sources */,
 				498770F01242C535002226BA /* Texture.cpp in Sources */,
@@ -27001,6 +27225,8 @@
 				1CAF34820A6C405200ABE06E /* WebScriptObject.mm in Sources */,
 				518A34C11026C831001B6896 /* WebSocket.cpp in Sources */,
 				510D4A4E103177A20049EA54 /* WebSocketChannel.cpp in Sources */,
+				4AE02ABD14E8A9D200BC3BA7 /* WebSocketDeflater.cpp in Sources */,
+				4A957F0614E2412A0049DBFB /* WebSocketExtensionDispatcher.cpp in Sources */,
 				51ABAE441043AB4A008C5260 /* WebSocketHandshake.cpp in Sources */,
 				7637C541112E7B74003D6CDC /* WebSocketHandshakeRequest.cpp in Sources */,
 				767F99BE11A1194A0080C51D /* WebSocketHandshakeResponse.cpp in Sources */,
@@ -27078,20 +27304,6 @@
 				E1BE512D0CF6C512002EA959 /* XSLTUnicodeSort.cpp in Sources */,
 				977E2E0E12F0FC9C00C13379 /* XSSAuditor.cpp in Sources */,
 				FD537352137B651800008DCE /* ZeroPole.cpp in Sources */,
-				573D134714CE39FF0057ABCA /* InspectorTypeBuilder.cpp in Sources */,
-				0720B0A014D3323500642955 /* GenericEventQueue.cpp in Sources */,
-				2CF6878814D32EB500340F39 /* ElementAttributeData.cpp in Sources */,
-				1AF62EE614DA22A70041556C /* ScrollingCoordinatorMac.mm in Sources */,
-				1AF62EE714DA22A70041556C /* ScrollingCoordinator.cpp in Sources */,
-				1AF62F2414DAFE910041556C /* ScrollingThreadMac.mm in Sources */,
-				1AF62F2514DAFE9E0041556C /* ScrollingThread.cpp in Sources */,
-				1AAADDA314DB409F00AF64B3 /* ScrollingTree.cpp in Sources */,
-				1AAADDBE14DC640700AF64B3 /* ScrollingTreeState.cpp in Sources */,
-				1AAADDDA14DC74EC00AF64B3 /* ScrollingTreeStateMac.mm in Sources */,
-				1AAADDE314DC8C8F00AF64B3 /* ScrollingTreeNode.cpp in Sources */,
-				1AAADDE814DC8DF800AF64B3 /* ScrollingTreeNodeMac.mm in Sources */,
-				7A54857F14E02D51006AE05A /* InspectorHistory.cpp in Sources */,
-				CDAA8D0A14D71B2E0061EA60 /* PlatformClockCM.mm in Sources */,
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 		};
diff --git a/Source/WebCore/WebCorePrefix.h b/Source/WebCore/WebCorePrefix.h
index 518b7b910..142c6abfc 100644
--- a/Source/WebCore/WebCorePrefix.h
+++ b/Source/WebCore/WebCorePrefix.h
@@ -89,6 +89,34 @@
 
 #ifdef __cplusplus
 
+
+#include <ciso646>
+
+#if defined(_LIBCPP_VERSION)
+
+// Add work around for a bug in libc++ that caused standard heap
+// APIs to not compile <rdar://problem/10858112>.
+
+#include <type_traits>
+
+_LIBCPP_BEGIN_NAMESPACE_STD
+
+template <class _Tp>
+inline _LIBCPP_INLINE_VISIBILITY
+typename enable_if
+<
+    !is_convertible<_Tp, __rv<_Tp> >::value,
+    const _Tp&
+>::type
+move(const _Tp& __t)
+{
+    return __t;
+}
+
+_LIBCPP_END_NAMESPACE_STD
+
+#endif // defined(_LIBCPP_VERSION)
+
 #include <algorithm>
 #include <cstddef>
 #include <new>
diff --git a/Source/WebCore/accessibility/AccessibilityObject.cpp b/Source/WebCore/accessibility/AccessibilityObject.cpp
index bbbbff2dd..c0af86102 100644
--- a/Source/WebCore/accessibility/AccessibilityObject.cpp
+++ b/Source/WebCore/accessibility/AccessibilityObject.cpp
@@ -163,7 +163,10 @@ bool AccessibilityObject::isAccessibilityObjectSearchMatch(AccessibilityObject*
         
     case HeadingSearchKey:
         return axObject->isHeading();
-        
+    
+    case HighlightedSearchKey:
+        return axObject->hasHighlighting();
+            
     case ItalicFontSearchKey:
         return axObject->hasItalicFont();
         
@@ -1414,6 +1417,16 @@ AccessibilityRole AccessibilityObject::ariaRoleToWebCoreRole(const String& value
     return role;
 }
 
+bool AccessibilityObject::hasHighlighting() const
+{
+    for (Node* node = this->node(); node; node = node->parentNode()) {
+        if (node->hasTagName(markTag))
+            return true;
+    }
+    
+    return false;
+}
+
 const AtomicString& AccessibilityObject::placeholderValue() const
 {
     const AtomicString& placeholder = getAttribute(placeholderAttr);
diff --git a/Source/WebCore/accessibility/AccessibilityObject.h b/Source/WebCore/accessibility/AccessibilityObject.h
index 249fa2940..e9a6aff57 100644
--- a/Source/WebCore/accessibility/AccessibilityObject.h
+++ b/Source/WebCore/accessibility/AccessibilityObject.h
@@ -244,6 +244,7 @@ enum AccessibilitySearchKey {
     HeadingLevel6SearchKey,
     HeadingSameLevelSearchKey,
     HeadingSearchKey,
+    HighlightedSearchKey,
     ItalicFontSearchKey,
     LandmarkSearchKey,
     LinkSearchKey,
@@ -409,6 +410,7 @@ public:
     virtual bool hasSameStyle(RenderObject*) const { return false; }
     bool hasStaticText() const { return roleValue() == StaticTextRole; }
     virtual bool hasUnderline() const { return false; }
+    bool hasHighlighting() const;
 
     virtual bool canSetFocusAttribute() const { return false; }
     virtual bool canSetTextRangeAttributes() const { return false; }
diff --git a/Source/WebCore/accessibility/AccessibilityRenderObject.cpp b/Source/WebCore/accessibility/AccessibilityRenderObject.cpp
index 44ced9db9..8799346c9 100644
--- a/Source/WebCore/accessibility/AccessibilityRenderObject.cpp
+++ b/Source/WebCore/accessibility/AccessibilityRenderObject.cpp
@@ -707,7 +707,7 @@ bool AccessibilityRenderObject::isReadOnly() const
 bool AccessibilityRenderObject::isOffScreen() const
 {
     ASSERT(m_renderer);
-    LayoutRect contentRect = m_renderer->absoluteClippedOverflowRect();
+    IntRect contentRect = pixelSnappedIntRect(m_renderer->absoluteClippedOverflowRect());
     FrameView* view = m_renderer->frame()->view();
     IntRect viewRect = view->visibleContentRect();
     viewRect.intersect(contentRect);
@@ -1212,7 +1212,7 @@ String AccessibilityRenderObject::stringValue() const
 static String accessibleNameForNode(Node* node)
 {
     if (node->isTextNode())
-        return static_cast<Text*>(node)->data();
+        return toText(node)->data();
 
     if (node->hasTagName(inputTag))
         return static_cast<HTMLInputElement*>(node)->value();
@@ -1428,14 +1428,14 @@ String AccessibilityRenderObject::accessibilityDescription() const
                 const AtomicString& title = static_cast<HTMLFrameElementBase*>(owner)->getAttribute(titleAttr);
                 if (!title.isEmpty())
                     return title;
-                return static_cast<HTMLFrameElementBase*>(owner)->getAttribute(nameAttr);
+                return static_cast<HTMLFrameElementBase*>(owner)->getNameAttribute();
             }
             if (owner->isHTMLElement())
-                return toHTMLElement(owner)->getAttribute(nameAttr);
+                return toHTMLElement(owner)->getNameAttribute();
         }
         owner = document->body();
         if (owner && owner->isHTMLElement())
-            return toHTMLElement(owner)->getAttribute(nameAttr);
+            return toHTMLElement(owner)->getNameAttribute();
     }
 
     return String();
@@ -2630,9 +2630,9 @@ IntRect AccessibilityRenderObject::boundsForVisiblePositionRange(const VisiblePo
     }
     
 #if PLATFORM(MAC)
-    return m_renderer->document()->view()->contentsToScreen(ourrect);
+    return m_renderer->document()->view()->contentsToScreen(pixelSnappedIntRect(ourrect));
 #else
-    return ourrect;
+    return pixelSnappedIntRect(ourrect);
 #endif
 }
     
@@ -2675,7 +2675,7 @@ VisiblePosition AccessibilityRenderObject::visiblePositionForPoint(const LayoutP
     while (1) {
         LayoutPoint ourpoint;
 #if PLATFORM(MAC)
-        ourpoint = frameView->screenToContents(point);
+        ourpoint = frameView->screenToContents(roundedIntPoint(point));
 #else
         ourpoint = point;
 #endif
@@ -2854,7 +2854,7 @@ AccessibilityObject* AccessibilityRenderObject::accessibilityHitTest(const IntPo
     Node* node = hitTestResult.innerNode()->shadowAncestorNode();
 
     if (node->hasTagName(areaTag)) 
-        return accessibilityImageMapHitTest(static_cast<HTMLAreaElement*>(node), point);
+        return accessibilityImageMapHitTest(static_cast<HTMLAreaElement*>(node), roundedIntPoint(point));
     
     if (node->hasTagName(optionTag))
         node = static_cast<HTMLOptionElement*>(node)->ownerSelectElement();
@@ -3348,6 +3348,9 @@ bool AccessibilityRenderObject::canSetFocusAttribute() const
 {
     Node* node = this->node();
 
+    if (isWebArea())
+        return true;
+    
     // NOTE: It would be more accurate to ask the document whether setFocusedNode() would
     // do anything.  For example, setFocusedNode() will do nothing if the current focused
     // node will not relinquish the focus.
diff --git a/Source/WebCore/accessibility/AccessibilityTable.cpp b/Source/WebCore/accessibility/AccessibilityTable.cpp
index 8e1ef7a13..56ef47bcd 100644
--- a/Source/WebCore/accessibility/AccessibilityTable.cpp
+++ b/Source/WebCore/accessibility/AccessibilityTable.cpp
@@ -170,7 +170,7 @@ bool AccessibilityTable::isDataTable() const
             if (!row && isTHCell)
                 headersInFirstRowCount++;
 
-            // If the first column is comprised of all <tg> tags, assume it is a data table.
+            // If the first column is comprised of all <th> tags, assume it is a data table.
             if (!col && isTHCell)
                 headersInFirstColumnCount++;
             
diff --git a/Source/WebCore/accessibility/gtk/WebKitAccessibleWrapperAtk.cpp b/Source/WebCore/accessibility/gtk/WebKitAccessibleWrapperAtk.cpp
index 525d28ea5..7f6b89412 100644
--- a/Source/WebCore/accessibility/gtk/WebKitAccessibleWrapperAtk.cpp
+++ b/Source/WebCore/accessibility/gtk/WebKitAccessibleWrapperAtk.cpp
@@ -396,14 +396,8 @@ static gint webkitAccessibleGetIndexInParent(AtkObject* object)
     if (parent && parent->isTableRow() && coreObject->isTableCell())
         return getIndexInParentForCellInRow(coreObject);
 
-    AccessibilityObject::AccessibilityChildrenVector children = parent->children();
-    unsigned count = children.size();
-    for (unsigned i = 0; i < count; ++i) {
-        if (children[i] == coreObject)
-            return i;
-    }
-
-    return -1;
+    size_t index = parent->children().find(coreObject);
+    return (index == WTF::notFound) ? -1 : index;
 }
 
 static AtkAttributeSet* webkitAccessibleGetAttributes(AtkObject* object)
diff --git a/Source/WebCore/accessibility/mac/WebAccessibilityObjectWrapper.mm b/Source/WebCore/accessibility/mac/WebAccessibilityObjectWrapper.mm
index ea91c7745..6bc4c63eb 100644
--- a/Source/WebCore/accessibility/mac/WebAccessibilityObjectWrapper.mm
+++ b/Source/WebCore/accessibility/mac/WebAccessibilityObjectWrapper.mm
@@ -259,6 +259,10 @@ using namespace std;
 #define NSAccessibilityHeadingSearchKey @"AXHeadingSearchKey"
 #endif
 
+#ifndef NSAccessibilityHighlightedSearchKey
+#define NSAccessibilityHighlightedSearchKey @"AXHighlightedSearchKey"
+#endif
+
 #ifndef NSAccessibilityItalicFontSearchKey
 #define NSAccessibilityItalicFontSearchKey @"AXItalicFontSearchKey"
 #endif
@@ -467,6 +471,7 @@ static AccessibilitySearchKeyMap* createAccessibilitySearchKeyMap()
         { NSAccessibilityHeadingLevel6SearchKey, HeadingLevel6SearchKey },
         { NSAccessibilityHeadingSameLevelSearchKey, HeadingSameLevelSearchKey },
         { NSAccessibilityHeadingSearchKey, HeadingSearchKey },
+        { NSAccessibilityHighlightedSearchKey, HighlightedSearchKey },
         { NSAccessibilityItalicFontSearchKey, ItalicFontSearchKey },
         { NSAccessibilityLandmarkSearchKey, LandmarkSearchKey },
         { NSAccessibilityLinkSearchKey, LinkSearchKey },
@@ -676,6 +681,12 @@ static void AXAttributeStringSetStyle(NSMutableAttributedString* attrString, Ren
             AXAttributeStringSetColor(attrString, NSAccessibilityStrikethroughColorTextAttribute, nsColor(linethrough), range);
         }
     }
+    
+    // Indicate background highlighting.
+    for (Node* node = renderer->node(); node; node = node->parentNode()) {
+        if (node->hasTagName(markTag))
+            AXAttributeStringSetNumber(attrString, @"AXHighlight", [NSNumber numberWithBool:YES], range);
+    }
 }
 
 static void AXAttributeStringSetBlockquoteLevel(NSMutableAttributedString* attrString, RenderObject* renderer, NSRange range)
diff --git a/Source/WebCore/bindings/generic/ActiveDOMCallback.cpp b/Source/WebCore/bindings/generic/ActiveDOMCallback.cpp
index ff02a4205..c2041d3df 100644
--- a/Source/WebCore/bindings/generic/ActiveDOMCallback.cpp
+++ b/Source/WebCore/bindings/generic/ActiveDOMCallback.cpp
@@ -122,6 +122,7 @@ static void destroyOnContextThread(PassOwnPtr<ActiveDOMObjectCallbackImpl> impl)
 ActiveDOMCallback::ActiveDOMCallback(ScriptExecutionContext* context)
     : m_impl(adoptPtr(new ActiveDOMObjectCallbackImpl(context)))
 {
+    m_impl->suspendIfNeeded();
 }
 
 ActiveDOMCallback::~ActiveDOMCallback()
diff --git a/Source/WebCore/bindings/generic/RuntimeEnabledFeatures.cpp b/Source/WebCore/bindings/generic/RuntimeEnabledFeatures.cpp
index 59e8b0f64..8fad2c5d7 100644
--- a/Source/WebCore/bindings/generic/RuntimeEnabledFeatures.cpp
+++ b/Source/WebCore/bindings/generic/RuntimeEnabledFeatures.cpp
@@ -182,6 +182,10 @@ bool RuntimeEnabledFeatures::isMediaSourceEnabled = false;
 
 #if ENABLE(SHADOW_DOM)
 bool RuntimeEnabledFeatures::isShadowDOMEnabled = false;
+bool RuntimeEnabledFeatures::isMultipleShadowSubtreesEnabled = false;
 #endif
 
+#if ENABLE(STYLE_SCOPED)
+bool RuntimeEnabledFeatures::isStyleScopedEnabled = false;
+#endif
 } // namespace WebCore
diff --git a/Source/WebCore/bindings/generic/RuntimeEnabledFeatures.h b/Source/WebCore/bindings/generic/RuntimeEnabledFeatures.h
index 6732cb1f0..36065c82a 100644
--- a/Source/WebCore/bindings/generic/RuntimeEnabledFeatures.h
+++ b/Source/WebCore/bindings/generic/RuntimeEnabledFeatures.h
@@ -194,6 +194,14 @@ public:
 #if ENABLE(SHADOW_DOM)
     static bool shadowDOMEnabled() { return isShadowDOMEnabled; }
     static void setShadowDOMEnabled(bool isEnabled) { isShadowDOMEnabled = isEnabled; }
+
+    static bool multipleShadowSubtreesEnabled() { return isMultipleShadowSubtreesEnabled; }
+    static void setMultipleShadowSubtreesEnabled(bool isEnabled) { isMultipleShadowSubtreesEnabled = isEnabled; }
+#endif
+
+#if ENABLE(STYLE_SCOPED)
+    static bool styleScopedEnabled() { return isStyleScopedEnabled; }
+    static void setStyleScopedEnabled(bool isEnabled) { isStyleScopedEnabled = isEnabled; }
 #endif
 
 private:
@@ -255,6 +263,11 @@ private:
 
 #if ENABLE(SHADOW_DOM)
     static bool isShadowDOMEnabled;
+    static bool isMultipleShadowSubtreesEnabled;
+#endif
+
+#if ENABLE(STYLE_SCOPED)
+    static bool isStyleScopedEnabled;
 #endif
 };
 
diff --git a/Source/WebCore/bindings/gobject/GNUmakefile.am b/Source/WebCore/bindings/gobject/GNUmakefile.am
index e8bf9901d..a51280f95 100644
--- a/Source/WebCore/bindings/gobject/GNUmakefile.am
+++ b/Source/WebCore/bindings/gobject/GNUmakefile.am
@@ -460,5 +460,5 @@ $(top_builddir)/DerivedSources/webkit/WebKitDOMCustom.h: $(WebCore)/bindings/gob
 
 # Filter out SVG and IndexedDB for now
 gdom_feature_defines := $(filter-out ENABLE_INDEXED_DATABASE=1, $(filter-out ENABLE_SVG%, $(FEATURE_DEFINES)))
-DerivedSources/webkit/WebKitDOM%.cpp DerivedSources/webkit/WebKitDOM%.h DerivedSources/webkit/WebKitDOM%Private.h: %.idl $(SCRIPTS_FOR_GENERATE_BINDINGS) $(WebCore)/bindings/scripts/CodeGeneratorGObject.pm $(WebCore)/bindings/gobject/GNUmakefile.am $(SUPPLEMENTAL_DEPENDENCY_FILE)
-	$(AM_V_GEN)$(PERL) -I$(WebCore)/bindings/scripts $(WebCore)/bindings/scripts/generate-bindings.pl --include $(WebCore)/dom --include $(WebCore)/html --include $(WebCore)/css --include $(WebCore)/page --include $(WebCore)/xml --include $(WebCore)/svg --outputDir "$(GENSOURCES_WEBKIT)" --defines "LANGUAGE_GOBJECT=1 $(gdom_feature_defines)" --generator GObject --supplementalDependencyFile $(SUPPLEMENTAL_DEPENDENCY_FILE) $<
+DerivedSources/webkit/WebKitDOM%.cpp DerivedSources/webkit/WebKitDOM%.h DerivedSources/webkit/WebKitDOM%Private.h: %.idl $(SCRIPTS_FOR_GENERATE_BINDINGS) $(WebCore)/bindings/scripts/CodeGeneratorGObject.pm $(WebCore)/bindings/gobject/GNUmakefile.am $(supplemental_dependency_file)
+	$(AM_V_GEN)$(PERL) -I$(WebCore)/bindings/scripts $(WebCore)/bindings/scripts/generate-bindings.pl --include $(WebCore)/dom --include $(WebCore)/html --include $(WebCore)/css --include $(WebCore)/page --include $(WebCore)/xml --include $(WebCore)/svg --outputDir "$(GENSOURCES_WEBKIT)" --defines "LANGUAGE_GOBJECT=1 $(gdom_feature_defines)" --generator GObject --supplementalDependencyFile $(supplemental_dependency_file) $<
diff --git a/Source/WebCore/bindings/js/GCController.cpp b/Source/WebCore/bindings/js/GCController.cpp
index 765e363e4..cf70f18c3 100644
--- a/Source/WebCore/bindings/js/GCController.cpp
+++ b/Source/WebCore/bindings/js/GCController.cpp
@@ -36,11 +36,10 @@ using namespace JSC;
 
 namespace WebCore {
 
-static void* collect(void*)
+static void collect(void*)
 {
     JSLock lock(SilenceAssertionsOnly);
     JSDOMWindow::commonJSGlobalData()->heap.collectAllGarbage();
-    return 0;
 }
 
 GCController& gcController()
@@ -77,7 +76,7 @@ void GCController::garbageCollectOnAlternateThreadForDebugging(bool waitUntilDon
     ThreadIdentifier threadID = createThread(collect, 0, "WebCore: GCController");
 
     if (waitUntilDone) {
-        waitForThreadCompletion(threadID, 0);
+        waitForThreadCompletion(threadID);
         return;
     }
 
diff --git a/Source/WebCore/bindings/js/JSBindingsAllInOne.cpp b/Source/WebCore/bindings/js/JSBindingsAllInOne.cpp
index 061ca59a4..bbe3f1cd3 100644
--- a/Source/WebCore/bindings/js/JSBindingsAllInOne.cpp
+++ b/Source/WebCore/bindings/js/JSBindingsAllInOne.cpp
@@ -117,6 +117,7 @@
 #include "JSMessageChannelCustom.cpp"
 #include "JSMessageEventCustom.cpp"
 #include "JSMessagePortCustom.cpp"
+#include "JSMutationCallbackCustom.cpp"
 #include "JSNamedNodeMapCustom.cpp"
 #include "JSNodeCustom.cpp"
 #include "JSNodeFilterCondition.cpp"
@@ -155,6 +156,7 @@
 #include "JSWebKitAnimationListCustom.cpp"
 #include "JSWebKitCSSKeyframeRuleCustom.cpp"
 #include "JSWebKitCSSKeyframesRuleCustom.cpp"
+#include "JSWebKitMutationObserverCustom.cpp"
 #include "JSWebKitPointCustom.cpp"
 #include "JSWebSocketCustom.cpp"
 #include "JSWorkerContextBase.cpp"
diff --git a/Source/WebCore/bindings/js/JSCSSStyleDeclarationCustom.cpp b/Source/WebCore/bindings/js/JSCSSStyleDeclarationCustom.cpp
index 66936ed34..8518cde35 100644
--- a/Source/WebCore/bindings/js/JSCSSStyleDeclarationCustom.cpp
+++ b/Source/WebCore/bindings/js/JSCSSStyleDeclarationCustom.cpp
@@ -30,6 +30,7 @@
 #include "CSSPrimitiveValue.h"
 #include "CSSPropertyNames.h"
 #include "CSSValue.h"
+#include "HashTools.h"
 #include "JSCSSValue.h"
 #include "JSNode.h"
 #include "PlatformString.h"
@@ -138,46 +139,51 @@ static PropertyNamePrefix getCSSPropertyNamePrefix(const StringImpl& propertyNam
     return PropertyNamePrefixNone;
 }
 
-template<typename CharacterType>
-static inline bool containsASCIIUpperChar(const CharacterType* string, size_t length)
+static inline void writeWebKitPrefix(char*& buffer)
 {
-    for (unsigned i = 0; i < length; ++i) {
-        if (isASCIIUpper(string[i]))
-            return true;
-    }
-    return false;
+    *buffer++ = '-';
+    *buffer++ = 'w';
+    *buffer++ = 'e';
+    *buffer++ = 'b';
+    *buffer++ = 'k';
+    *buffer++ = 'i';
+    *buffer++ = 't';
+    *buffer++ = '-';
 }
 
-static inline bool containsASCIIUpperChar(const StringImpl& string)
+static inline void writeEpubPrefix(char*& buffer)
 {
-    if (string.is8Bit())
-        return containsASCIIUpperChar(string.characters8(), string.length());
-    return containsASCIIUpperChar(string.characters16(), string.length());
+    *buffer++ = '-';
+    *buffer++ = 'e';
+    *buffer++ = 'p';
+    *buffer++ = 'u';
+    *buffer++ = 'b';
+    *buffer++ = '-';
 }
 
-static String cssPropertyName(const Identifier& propertyName, bool* hadPixelOrPosPrefix = 0)
+static int cssPropertyIDForJSCSSPropertyName(const Identifier& propertyName, bool* hadPixelOrPosPrefix = 0)
 {
     if (hadPixelOrPosPrefix)
         *hadPixelOrPosPrefix = false;
 
     unsigned length = propertyName.length();
     if (!length)
-        return String();
+        return 0;
 
     StringImpl* propertyNameString = propertyName.impl();
-    // If there is no uppercase character in the propertyName, there can
-    // be no prefix, nor extension and we can return the same string.
-    if (!containsASCIIUpperChar(*propertyNameString))
-        return String(propertyNameString);
-
-    StringBuilder builder;
-    builder.reserveCapacity(length);
+    const size_t bufferSize = maxCSSPropertyNameLength + 1;
+    char buffer[bufferSize];
+    char* bufferPtr = buffer;
+    const char* name = bufferPtr;
 
     unsigned i = 0;
+    // Prefixes CSS, Pixel, Pos are ignored.
+    // Prefixes Apple, KHTML and Webkit are transposed to "-webkit-".
+    // The prefix "Epub" becomes "-epub-".
     switch (getCSSPropertyNamePrefix(*propertyNameString)) {
     case PropertyNamePrefixNone:
         if (isASCIIUpper((*propertyNameString)[0]))
-            return String();
+            return 0;
         break;
     case PropertyNamePrefixCSS:
         i += 3;
@@ -193,28 +199,59 @@ static String cssPropertyName(const Identifier& propertyName, bool* hadPixelOrPo
             *hadPixelOrPosPrefix = true;
         break;
     case PropertyNamePrefixApple:
-    case PropertyNamePrefixEpub:
     case PropertyNamePrefixKHTML:
+        writeWebKitPrefix(bufferPtr);
+        i += 5;
+        break;
+    case PropertyNamePrefixEpub:
+        writeEpubPrefix(bufferPtr);
+        i += 4;
+        break;
     case PropertyNamePrefixWebKit:
-        builder.append('-');
+        writeWebKitPrefix(bufferPtr);
+        i += 6;
+        break;
     }
 
-    builder.append(toASCIILower((*propertyNameString)[i++]));
+    *bufferPtr++ = toASCIILower((*propertyNameString)[i++]);
+
+    char* bufferEnd = buffer + bufferSize;
+    char* stringEnd = bufferEnd - 1;
+    size_t bufferSizeLeft = stringEnd - bufferPtr;
+    size_t propertySizeLeft = length - i;
+    if (propertySizeLeft > bufferSizeLeft)
+        return 0;
 
     for (; i < length; ++i) {
         UChar c = (*propertyNameString)[i];
-        if (!isASCIIUpper(c))
-            builder.append(c);
-        else
-            builder.append(makeString('-', toASCIILower(c)));
+        if (!c || c >= 0x7F)
+            return 0; // illegal character
+        if (isASCIIUpper(c)) {
+            size_t bufferSizeLeft = stringEnd - bufferPtr;
+            size_t propertySizeLeft = length - i + 1;
+            if (propertySizeLeft > bufferSizeLeft)
+                return 0;
+            *bufferPtr++ = '-';
+            *bufferPtr++ = toASCIILower(c);
+        } else
+            *bufferPtr++ = c;
+        ASSERT(bufferPtr < bufferEnd);
     }
+    ASSERT(bufferPtr < bufferEnd);
+    *bufferPtr = '\0';
 
-    return builder.toString();
+    unsigned outputLength = bufferPtr - buffer;
+#if PLATFORM(IOS)
+    cssPropertyNameIOSAliasing(buffer, name, outputLength);
+#endif
+
+    const Property* hashTableEntry = findProperty(name, outputLength);
+    return hashTableEntry ? hashTableEntry->id : 0;
 }
 
 static bool isCSSPropertyName(const Identifier& propertyIdentifier)
 {
-    return cssPropertyID(cssPropertyName(propertyIdentifier));
+    return cssPropertyIDForJSCSSPropertyName(propertyIdentifier);
 }
 
 bool JSCSSStyleDeclaration::canGetItemsForName(ExecState*, CSSStyleDeclaration*, const Identifier& propertyName)
@@ -232,8 +269,8 @@ JSValue JSCSSStyleDeclaration::nameGetter(ExecState* exec, JSValue slotBase, con
     // positioned element. if it is not a positioned element, return 0
     // from MSIE documentation FIXME: IMPLEMENT THAT (Dirk)
     bool pixelOrPos;
-    String prop = cssPropertyName(propertyName, &pixelOrPos);
-    RefPtr<CSSValue> v = thisObj->impl()->getPropertyCSSValue(prop);
+    int cssPropertyID = cssPropertyIDForJSCSSPropertyName(propertyName, &pixelOrPos);
+    RefPtr<CSSValue> v = thisObj->impl()->getPropertyCSSValueInternal(static_cast<CSSPropertyID>(cssPropertyID));
     if (v) {
         if (pixelOrPos && v->isPrimitiveValue())
             return jsNumber(static_pointer_cast<CSSPrimitiveValue>(v)->getFloatValue(CSSPrimitiveValue::CSS_PX));
@@ -242,22 +279,21 @@ JSValue JSCSSStyleDeclaration::nameGetter(ExecState* exec, JSValue slotBase, con
 
     // If the property is a shorthand property (such as "padding"), 
     // it can only be accessed using getPropertyValue.
-
-    return jsString(exec, thisObj->impl()->getPropertyValue(prop));
+    return jsString(exec, thisObj->impl()->getPropertyValueInternal(static_cast<CSSPropertyID>(cssPropertyID)));
 }
 
 bool JSCSSStyleDeclaration::putDelegate(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot&)
 {
     bool pixelOrPos;
-    String prop = cssPropertyName(propertyName, &pixelOrPos);
-    if (!cssPropertyID(prop))
+    int cssPropertyID = cssPropertyIDForJSCSSPropertyName(propertyName, &pixelOrPos);
+    if (!cssPropertyID)
         return false;
 
     String propValue = valueToStringWithNullCheck(exec, value);
     if (pixelOrPos)
         propValue += "px";
     ExceptionCode ec = 0;
-    impl()->setProperty(prop, propValue, emptyString(), ec);
+    impl()->setPropertyInternal(static_cast<CSSPropertyID>(cssPropertyID), propValue, false, ec);
     setDOMException(exec, ec);
     return true;
 }
diff --git a/Source/WebCore/bindings/js/JSClipboardCustom.cpp b/Source/WebCore/bindings/js/JSClipboardCustom.cpp
index efce79bc0..3532c7859 100644
--- a/Source/WebCore/bindings/js/JSClipboardCustom.cpp
+++ b/Source/WebCore/bindings/js/JSClipboardCustom.cpp
@@ -48,21 +48,6 @@ namespace WebCore {
 
 using namespace HTMLNames;
 
-JSValue JSClipboard::types(ExecState* exec) const
-{
-    Clipboard* clipboard = impl();
-
-    HashSet<String> types = clipboard->types();
-    if (types.isEmpty())
-        return jsNull();
-
-    MarkedArgumentBuffer list;
-    HashSet<String>::const_iterator end = types.end();
-    for (HashSet<String>::const_iterator it = types.begin(); it != end; ++it)
-        list.append(jsString(exec, stringToUString(*it)));
-    return constructArray(exec, globalObject(), list);
-}
-
 JSValue JSClipboard::clearData(ExecState* exec)
 {
     Clipboard* clipboard = impl();
diff --git a/Source/WebCore/bindings/js/JSDOMBinding.cpp b/Source/WebCore/bindings/js/JSDOMBinding.cpp
index 69cc1b84a..13580aec8 100644
--- a/Source/WebCore/bindings/js/JSDOMBinding.cpp
+++ b/Source/WebCore/bindings/js/JSDOMBinding.cpp
@@ -49,7 +49,7 @@ const JSC::HashTable* getHashTableForGlobalData(JSGlobalData& globalData, const
 JSValue jsStringSlowCase(ExecState* exec, JSStringCache& stringCache, StringImpl* stringImpl)
 {
     JSString* wrapper = jsString(exec, UString(stringImpl));
-    stringCache.add(stringImpl, Weak<JSString>(exec->globalData(), wrapper, currentWorld(exec)->stringWrapperOwner(), stringImpl));
+    stringCache.add(stringImpl, PassWeak<JSString>(exec->globalData(), wrapper, currentWorld(exec)->stringWrapperOwner(), stringImpl));
     return wrapper;
 }
 
diff --git a/Source/WebCore/bindings/js/JSDOMBinding.h b/Source/WebCore/bindings/js/JSDOMBinding.h
index 7e1af20fc..0eb3d9cf5 100644
--- a/Source/WebCore/bindings/js/JSDOMBinding.h
+++ b/Source/WebCore/bindings/js/JSDOMBinding.h
@@ -23,6 +23,7 @@
 #define JSDOMBinding_h
 
 #include "CSSImportRule.h"
+#include "CSSStyleDeclaration.h"
 #include "CSSStyleSheet.h"
 #include "JSDOMGlobalObject.h"
 #include "JSDOMWrapper.h"
@@ -38,15 +39,16 @@
 #include <runtime/ObjectPrototype.h>
 #include <wtf/Forward.h>
 #include <wtf/Noncopyable.h>
+#include <wtf/Vector.h>
 
 namespace WebCore {
 
-enum ParameterMissingPolicy {
-    MissingIsUndefined,
-    MissingIsEmpty
+enum ParameterDefaultPolicy {
+    DefaultIsUndefined,
+    DefaultIsNullString
 };
 
-#define MAYBE_MISSING_PARAMETER(exec, index, policy) (((policy) == MissingIsEmpty && (index) >= (exec)->argumentCount()) ? (JSValue()) : ((exec)->argument(index)))
+#define MAYBE_MISSING_PARAMETER(exec, index, policy) (((policy) == DefaultIsNullString && (index) >= (exec)->argumentCount()) ? (JSValue()) : ((exec)->argument(index)))
 
     class Frame;
     class KURL;
@@ -131,17 +133,16 @@ enum ParameterMissingPolicy {
     {
         if (JSDOMWrapper* wrapper = getInlineCachedWrapper(world, domObject))
             return wrapper;
-        return world->m_wrappers.get(domObject).get();
+        return world->m_wrappers.get(domObject);
     }
 
     template <typename DOMClass> inline void cacheWrapper(DOMWrapperWorld* world, DOMClass* domObject, JSDOMWrapper* wrapper)
     {
         if (setInlineCachedWrapper(world, domObject, wrapper))
             return;
-        pair<DOMObjectWrapperMap::iterator, bool> entry = world->m_wrappers.add(domObject, JSC::Weak<JSDOMWrapper>());
-        ASSERT(entry.second);
-        JSC::Weak<JSDOMWrapper> handle(*world->globalData(), wrapper, wrapperOwner(world, domObject), wrapperContext(world, domObject));
-        entry.first->second.swap(handle);
+        JSC::PassWeak<JSDOMWrapper> passWeak(*world->globalData(), wrapper, wrapperOwner(world, domObject), wrapperContext(world, domObject));
+        pair<DOMObjectWrapperMap::iterator, bool> result = world->m_wrappers.add(domObject, passWeak);
+        ASSERT_UNUSED(result, result.second);
     }
 
     template <typename DOMClass> inline void uncacheWrapper(DOMWrapperWorld* world, DOMClass* domObject, JSDOMWrapper* wrapper)
@@ -342,6 +343,23 @@ enum ParameterMissingPolicy {
         return AtomicString(identifier.impl());
     }
 
+    inline Vector<unsigned long> jsUnsignedLongArrayToVector(JSC::ExecState* exec, JSC::JSValue value)
+    {
+        unsigned length;
+        JSC::JSObject* object = toJSSequence(exec, value, length);
+        if (exec->hadException())
+            return Vector<unsigned long>();
+
+        Vector<unsigned long> result;
+        for (unsigned i = 0; i < length; i++) {
+            JSC::JSValue indexedValue;
+            indexedValue = object->get(exec, i);
+            if (exec->hadException() || indexedValue.isUndefinedOrNull() || !indexedValue.isNumber())
+                return Vector<unsigned long>();
+            result.append(indexedValue.toUInt32(exec));
+        }
+        return result;
+    }
 } // namespace WebCore
 
 #endif // JSDOMBinding_h
diff --git a/Source/WebCore/bindings/js/JSDOMWindowBase.cpp b/Source/WebCore/bindings/js/JSDOMWindowBase.cpp
index 8de432edf..160465f4b 100644
--- a/Source/WebCore/bindings/js/JSDOMWindowBase.cpp
+++ b/Source/WebCore/bindings/js/JSDOMWindowBase.cpp
@@ -43,7 +43,7 @@ namespace WebCore {
 
 const ClassInfo JSDOMWindowBase::s_info = { "Window", &JSDOMGlobalObject::s_info, 0, 0, CREATE_METHOD_TABLE(JSDOMWindowBase) };
 
-const GlobalObjectMethodTable JSDOMWindowBase::s_globalObjectMethodTable = { &supportsProfiling, &supportsRichSourceInfo, &shouldInterruptScript };
+const GlobalObjectMethodTable JSDOMWindowBase::s_globalObjectMethodTable = { &allowsAccessFrom, &supportsProfiling, &supportsRichSourceInfo, &shouldInterruptScript };
 
 JSDOMWindowBase::JSDOMWindowBase(JSGlobalData& globalData, Structure* structure, PassRefPtr<DOMWindow> window, JSDOMWindowShell* shell)
     : JSDOMGlobalObject(globalData, structure, shell->world(), &s_globalObjectMethodTable)
@@ -92,6 +92,31 @@ void JSDOMWindowBase::printErrorMessage(const String& message) const
     printErrorMessageForFrame(impl()->frame(), message);
 }
 
+// This method checks whether accesss to *this* global object is permitted from
+// the given context; this differs from allowsAccessFromPrivate, since that
+// method checks whether the given context is permitted to access the current
+// window the shell is referencing (which may come from a different security
+// origin to this global object).
+bool JSDOMWindowBase::allowsAccessFrom(const JSGlobalObject* thisObject, ExecState* exec)
+{
+    JSGlobalObject* otherObject = exec->lexicalGlobalObject();
+
+    const JSDOMWindow* originWindow = asJSDOMWindow(otherObject);
+    const JSDOMWindow* targetWindow = asJSDOMWindow(thisObject);
+
+    if (originWindow == targetWindow)
+        return true;
+
+    const SecurityOrigin* originSecurityOrigin = originWindow->impl()->securityOrigin();
+    const SecurityOrigin* targetSecurityOrigin = targetWindow->impl()->securityOrigin();
+
+    if (originSecurityOrigin->canAccess(targetSecurityOrigin))
+        return true;
+
+    targetWindow->printErrorMessage(targetWindow->crossDomainAccessErrorMessage(otherObject));
+    return false;
+}
+
 bool JSDOMWindowBase::supportsProfiling(const JSGlobalObject* object)
 {
 #if !ENABLE(JAVASCRIPT_DEBUGGER) || !ENABLE(INSPECTOR)
diff --git a/Source/WebCore/bindings/js/JSDOMWindowBase.h b/Source/WebCore/bindings/js/JSDOMWindowBase.h
index 84c18624a..51e0f894f 100644
--- a/Source/WebCore/bindings/js/JSDOMWindowBase.h
+++ b/Source/WebCore/bindings/js/JSDOMWindowBase.h
@@ -63,7 +63,8 @@ namespace WebCore {
         static bool supportsProfiling(const JSC::JSGlobalObject*);
         static bool supportsRichSourceInfo(const JSC::JSGlobalObject*);
         static bool shouldInterruptScript(const JSC::JSGlobalObject*);
-
+        static bool allowsAccessFrom(const JSC::JSGlobalObject*, JSC::ExecState*);
+        
         bool allowsAccessFrom(JSC::ExecState*) const;
         bool allowsAccessFromNoErrorMessage(JSC::ExecState*) const;
         bool allowsAccessFrom(JSC::ExecState*, String& message) const;
diff --git a/Source/WebCore/bindings/js/JSDOMWindowCustom.cpp b/Source/WebCore/bindings/js/JSDOMWindowCustom.cpp
index baf80d360..0ba259e76 100644
--- a/Source/WebCore/bindings/js/JSDOMWindowCustom.cpp
+++ b/Source/WebCore/bindings/js/JSDOMWindowCustom.cpp
@@ -99,12 +99,12 @@ JSValue nonCachingStaticFunctionGetter(ExecState* exec, JSValue, const Identifie
 
 static JSValue childFrameGetter(ExecState* exec, JSValue slotBase, const Identifier& propertyName)
 {
-    return toJS(exec, static_cast<JSDOMWindow*>(asObject(slotBase))->impl()->frame()->tree()->child(identifierToAtomicString(propertyName))->domWindow());
+    return toJS(exec, static_cast<JSDOMWindow*>(asObject(slotBase))->impl()->frame()->tree()->scopedChild(identifierToAtomicString(propertyName))->domWindow());
 }
 
 static JSValue indexGetter(ExecState* exec, JSValue slotBase, unsigned index)
 {
-    return toJS(exec, static_cast<JSDOMWindow*>(asObject(slotBase))->impl()->frame()->tree()->child(index)->domWindow());
+    return toJS(exec, static_cast<JSDOMWindow*>(asObject(slotBase))->impl()->frame()->tree()->scopedChild(index)->domWindow());
 }
 
 static JSValue namedItemGetter(ExecState* exec, JSValue slotBase, const Identifier& propertyName)
@@ -220,7 +220,7 @@ bool JSDOMWindow::getOwnPropertySlot(JSCell* cell, ExecState* exec, const Identi
     // naming frames things that conflict with window properties that
     // are in Moz but not IE. Since we have some of these, we have to do
     // it the Moz way.
-    if (thisObject->impl()->frame()->tree()->child(identifierToAtomicString(propertyName))) {
+    if (thisObject->impl()->frame()->tree()->scopedChild(identifierToAtomicString(propertyName))) {
         slot.setCustom(thisObject, childFrameGetter);
         return true;
     }
@@ -244,7 +244,7 @@ bool JSDOMWindow::getOwnPropertySlot(JSCell* cell, ExecState* exec, const Identi
     // allow window[1] or parent[1] etc. (#56983)
     bool ok;
     unsigned i = propertyName.toArrayIndex(ok);
-    if (ok && i < thisObject->impl()->frame()->tree()->childCount()) {
+    if (ok && i < thisObject->impl()->frame()->tree()->scopedChildCount()) {
         slot.setCustomIndex(thisObject, i, indexGetter);
         return true;
     }
@@ -310,7 +310,7 @@ bool JSDOMWindow::getOwnPropertyDescriptor(JSObject* object, ExecState* exec, co
     // naming frames things that conflict with window properties that
     // are in Moz but not IE. Since we have some of these, we have to do
     // it the Moz way.
-    if (thisObject->impl()->frame()->tree()->child(identifierToAtomicString(propertyName))) {
+    if (thisObject->impl()->frame()->tree()->scopedChild(identifierToAtomicString(propertyName))) {
         PropertySlot slot;
         slot.setCustom(thisObject, childFrameGetter);
         descriptor.setDescriptor(slot.getValue(exec, propertyName), ReadOnly | DontDelete | DontEnum);
@@ -319,7 +319,7 @@ bool JSDOMWindow::getOwnPropertyDescriptor(JSObject* object, ExecState* exec, co
     
     bool ok;
     unsigned i = propertyName.toArrayIndex(ok);
-    if (ok && i < thisObject->impl()->frame()->tree()->childCount()) {
+    if (ok && i < thisObject->impl()->frame()->tree()->scopedChildCount()) {
         PropertySlot slot;
         slot.setCustomIndex(thisObject, i, indexGetter);
         descriptor.setDescriptor(slot.getValue(exec, propertyName), ReadOnly | DontDelete | DontEnum);
diff --git a/Source/WebCore/bindings/js/JSDOMWindowShell.cpp b/Source/WebCore/bindings/js/JSDOMWindowShell.cpp
index 45506e6e4..1f06713b5 100644
--- a/Source/WebCore/bindings/js/JSDOMWindowShell.cpp
+++ b/Source/WebCore/bindings/js/JSDOMWindowShell.cpp
@@ -149,16 +149,6 @@ DOMWindow* JSDOMWindowShell::impl() const
     return window()->impl();
 }
 
-void* JSDOMWindowShell::operator new(size_t size)
-{
-    Heap& heap = JSDOMWindow::commonJSGlobalData()->heap;
-#if ENABLE(GC_VALIDATION)
-    ASSERT(!heap.globalData()->isInitializingObject());
-    heap.globalData()->setInitializingObject(true);
-#endif
-    return heap.allocate(size);
-}
-
 // ----
 // Conversion methods
 // ----
diff --git a/Source/WebCore/bindings/js/JSDOMWindowShell.h b/Source/WebCore/bindings/js/JSDOMWindowShell.h
index e111cb84d..b7c750140 100644
--- a/Source/WebCore/bindings/js/JSDOMWindowShell.h
+++ b/Source/WebCore/bindings/js/JSDOMWindowShell.h
@@ -58,7 +58,8 @@ namespace WebCore {
 
         static JSDOMWindowShell* create(PassRefPtr<DOMWindow> window, JSC::Structure* structure, DOMWrapperWorld* world) 
         {
-            JSDOMWindowShell* shell = new JSDOMWindowShell(structure, world);
+            JSC::Heap& heap = JSDOMWindow::commonJSGlobalData()->heap;
+            JSDOMWindowShell* shell = new (NotNull, JSC::allocateCell<JSDOMWindowShell>(heap)) JSDOMWindowShell(structure, world);
             shell->finishCreation(*world->globalData(), window);
             return shell; 
         }
@@ -75,7 +76,6 @@ namespace WebCore {
         void finishCreation(JSC::JSGlobalData&, PassRefPtr<DOMWindow>);
 
     private:
-        void* operator new(size_t);
         static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | JSC::OverridesGetPropertyNames | Base::StructureFlags;
 
         static JSC::UString className(const JSC::JSObject*);
diff --git a/Source/WebCore/bindings/js/JSDirectoryEntryCustom.cpp b/Source/WebCore/bindings/js/JSDirectoryEntryCustom.cpp
index 31232d3cc..57d980cfb 100644
--- a/Source/WebCore/bindings/js/JSDirectoryEntryCustom.cpp
+++ b/Source/WebCore/bindings/js/JSDirectoryEntryCustom.cpp
@@ -38,6 +38,7 @@
 #include "JSDOMBinding.h"
 #include "JSEntryCallback.h"
 #include "JSErrorCallback.h"
+#include <runtime/Error.h>
 #include <wtf/Assertions.h>
 
 using namespace JSC;
diff --git a/Source/WebCore/bindings/js/JSEventListener.cpp b/Source/WebCore/bindings/js/JSEventListener.cpp
index a3c320197..6de073b05 100644
--- a/Source/WebCore/bindings/js/JSEventListener.cpp
+++ b/Source/WebCore/bindings/js/JSEventListener.cpp
@@ -22,6 +22,7 @@
 
 #include "Event.h"
 #include "Frame.h"
+#include "InspectorCounters.h"
 #include "JSEvent.h"
 #include "JSEventTarget.h"
 #include "JSMainThreadExecState.h"
@@ -44,11 +45,12 @@ JSEventListener::JSEventListener(JSObject* function, JSObject* wrapper, bool isA
         m_jsFunction.setMayBeNull(*m_isolatedWorld->globalData(), wrapper, function);
     else
         ASSERT(!function);
-
+    InspectorCounters::incrementCounter(InspectorCounters::JSEventListenerCounter);
 }
 
 JSEventListener::~JSEventListener()
 {
+    InspectorCounters::decrementCounter(InspectorCounters::JSEventListenerCounter);
 }
 
 JSObject* JSEventListener::initializeJSFunction(ScriptExecutionContext*) const
diff --git a/Source/WebCore/bindings/js/JSEventListener.h b/Source/WebCore/bindings/js/JSEventListener.h
index 4cee34711..32a8c5634 100644
--- a/Source/WebCore/bindings/js/JSEventListener.h
+++ b/Source/WebCore/bindings/js/JSEventListener.h
@@ -53,7 +53,7 @@ namespace WebCore {
         DOMWrapperWorld* isolatedWorld() const { return m_isolatedWorld.get(); }
 
         JSC::JSObject* wrapper() const { return m_wrapper.get(); }
-        void setWrapper(JSC::JSGlobalData& globalData, JSC::JSObject* wrapper) const { m_wrapper.set(globalData, wrapper, 0); }
+        void setWrapper(JSC::JSGlobalData& globalData, JSC::JSObject* wrapper) const { m_wrapper = JSC::PassWeak<JSC::JSObject>(globalData, wrapper, 0); }
 
     private:
         virtual JSC::JSObject* initializeJSFunction(ScriptExecutionContext*) const;
diff --git a/Source/WebCore/bindings/js/JSInjectedScriptHostCustom.cpp b/Source/WebCore/bindings/js/JSInjectedScriptHostCustom.cpp
index 73cb2fa7e..70402bc46 100644
--- a/Source/WebCore/bindings/js/JSInjectedScriptHostCustom.cpp
+++ b/Source/WebCore/bindings/js/JSInjectedScriptHostCustom.cpp
@@ -76,17 +76,17 @@ ScriptValue InjectedScriptHost::nodeAsScriptValue(ScriptState* state, Node* node
     return ScriptValue(state->globalData(), toJS(state, deprecatedGlobalObjectForPrototype(state), node));
 }
 
-JSValue JSInjectedScriptHost::inspectedNode(ExecState* exec)
+JSValue JSInjectedScriptHost::inspectedObject(ExecState* exec)
 {
     if (exec->argumentCount() < 1)
         return jsUndefined();
 
-    Node* node = impl()->inspectedNode(exec->argument(0).toInt32(exec));
-    if (!node)
+    InjectedScriptHost::InspectableObject* object = impl()->inspectedObject(exec->argument(0).toInt32(exec));
+    if (!object)
         return jsUndefined();
 
     JSLock lock(SilenceAssertionsOnly);
-    return toJS(exec, globalObject(), node);
+    return object->get(exec).jsValue();
 }
 
 JSValue JSInjectedScriptHost::internalConstructorName(ExecState* exec)
diff --git a/Source/WebCore/bindings/js/JSNavigatorCustom.cpp b/Source/WebCore/bindings/js/JSNavigatorCustom.cpp
deleted file mode 100644
index 2d8d49dfd..000000000
--- a/Source/WebCore/bindings/js/JSNavigatorCustom.cpp
+++ /dev/null
@@ -1,63 +0,0 @@
-/*
- *  Copyright (C) 2000 Harri Porten (porten@kde.org)
- *  Copyright (c) 2000 Daniel Molkentin (molkentin@kde.org)
- *  Copyright (c) 2000 Stefan Schimanski (schimmi@kde.org)
- *  Copyright (C) 2003, 2004, 2005, 2006, 2007, 2008, 2009 Apple Inc. All Rights Reserved.
- *  Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies)
- *
- *  This library is free software; you can redistribute it and/or
- *  modify it under the terms of the GNU Lesser General Public
- *  License as published by the Free Software Foundation; either
- *  version 2 of the License, or (at your option) any later version.
- *
- *  This library is distributed in the hope that it will be useful,
- *  but WITHOUT ANY WARRANTY; without even the implied warranty of
- *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- *  Lesser General Public License for more details.
- *
- *  You should have received a copy of the GNU Lesser General Public
- *  License along with this library; if not, write to the Free Software
- *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
- */
-
-#include "config.h"
-#include "JSNavigator.h"
-
-#include "CallbackFunction.h"
-#include "ExceptionCode.h"
-#include "JSNavigatorUserMediaErrorCallback.h"
-#include "JSNavigatorUserMediaSuccessCallback.h"
-#include "Navigator.h"
-
-namespace WebCore {
-
-using namespace JSC;
-
-#if ENABLE(MEDIA_STREAM)
-JSValue JSNavigator::webkitGetUserMedia(ExecState* exec)
-{
-    // Arguments: Options, successCallback, (optional)errorCallback
-
-    String options = ustringToString(exec->argument(0).toString(exec)->value(exec));
-    if (exec->hadException())
-        return jsUndefined();
-
-    RefPtr<NavigatorUserMediaSuccessCallback> successCallback = createFunctionOnlyCallback<JSNavigatorUserMediaSuccessCallback>(exec, static_cast<JSDOMGlobalObject*>(exec->lexicalGlobalObject()), exec->argument(1));
-    if (exec->hadException())
-        return jsUndefined();
-
-    RefPtr<NavigatorUserMediaErrorCallback> errorCallback = createFunctionOnlyCallback<JSNavigatorUserMediaErrorCallback>(exec, static_cast<JSDOMGlobalObject*>(exec->lexicalGlobalObject()), exec->argument(2), CallbackAllowUndefined);
-    if (exec->hadException())
-        return jsUndefined();
-
-    ExceptionCode ec = 0;
-    m_impl->webkitGetUserMedia(options, successCallback.release(), errorCallback.release(), ec);
-
-    if (ec)
-        setDOMException(exec, ec);
-
-    return jsUndefined();
-}
-#endif // ENABLE(MEDIA_STREAM)
-
-}
diff --git a/Source/WebCore/bindings/js/JSNodeCustom.cpp b/Source/WebCore/bindings/js/JSNodeCustom.cpp
index 61c15d6b9..7cdd5fce7 100644
--- a/Source/WebCore/bindings/js/JSNodeCustom.cpp
+++ b/Source/WebCore/bindings/js/JSNodeCustom.cpp
@@ -256,9 +256,6 @@ static ALWAYS_INLINE JSValue createWrapperInline(ExecState* exec, JSDOMGlobalObj
         case Node::DOCUMENT_FRAGMENT_NODE:
             wrapper = CREATE_DOM_WRAPPER(exec, globalObject, DocumentFragment, node);
             break;
-        case Node::SHADOW_ROOT_NODE:
-            wrapper = CREATE_DOM_WRAPPER(exec, globalObject, Node, node);
-            break;
         case Node::ENTITY_REFERENCE_NODE:
             wrapper = CREATE_DOM_WRAPPER(exec, globalObject, EntityReference, node);
             break;
diff --git a/Source/WebCore/bindings/js/JSPopStateEventCustom.cpp b/Source/WebCore/bindings/js/JSPopStateEventCustom.cpp
index 38edfb68d..f01f84b90 100644
--- a/Source/WebCore/bindings/js/JSPopStateEventCustom.cpp
+++ b/Source/WebCore/bindings/js/JSPopStateEventCustom.cpp
@@ -30,21 +30,52 @@
 
 #include "config.h"
 
+#include "History.h"
+#include "JSHistory.h"
 #include "JSPopStateEvent.h"
 
 using namespace JSC;
 
 namespace WebCore {
 
+// Save the state value to the m_state member of a JSPopStateEvent, and return it, for convenience.
+static const JSValue& cacheState(ExecState* exec, JSPopStateEvent* event, const JSValue& state)
+{
+    event->m_state.set(exec->globalData(), event, state);
+    return state;
+}
+
 JSValue JSPopStateEvent::state(ExecState* exec) const
 {
+    JSValue cachedValue = m_state.get();
+    if (!cachedValue.isEmpty())
+        return cachedValue;
+
     PopStateEvent* event = static_cast<PopStateEvent*>(impl());
-    SerializedScriptValue* serializedState = event->serializedState();
-    if (serializedState)
-        return serializedState->deserialize(exec, globalObject(), 0);
+
     if (!event->state().hasNoValue())
-        return event->state().jsValue();
-    return jsNull();
+        return cacheState(exec, const_cast<JSPopStateEvent*>(this), event->state().jsValue());
+
+    History* history = event->history();
+    if (!history || !event->serializedState())
+        return cacheState(exec, const_cast<JSPopStateEvent*>(this), jsNull());
+
+    // There's no cached value from a previous invocation, nor a state value was provided by the
+    // event, but there is a history object, so first we need to see if the state object has been
+    // deserialized through the history object already.
+    // The current history state object might've changed in the meantime, so we need to take care
+    // of using the correct one, and always share the same deserialization with history.state.
+
+    bool isSameState = history->isSameAsCurrentState(event->serializedState());
+    JSValue result;
+
+    if (isSameState) {
+        JSHistory* jsHistory = static_cast<JSHistory*>(toJS(exec, globalObject(), history).asCell());
+        result = jsHistory->state(exec);
+    } else
+        result = event->serializedState()->deserialize(exec, globalObject(), 0);
+
+    return cacheState(exec, const_cast<JSPopStateEvent*>(this), result);
 }
 
 } // namespace WebCore
diff --git a/Source/WebCore/bindings/js/ScriptControllerQt.cpp b/Source/WebCore/bindings/js/ScriptControllerQt.cpp
index a8cdf9dd0..979a4f658 100644
--- a/Source/WebCore/bindings/js/ScriptControllerQt.cpp
+++ b/Source/WebCore/bindings/js/ScriptControllerQt.cpp
@@ -42,8 +42,6 @@
 #include "qt_instance.h"
 #include "runtime_root.h"
 
-#include <QWidget>
-
 namespace WebCore {
 
 PassRefPtr<JSC::Bindings::Instance> ScriptController::createScriptInstanceForWidget(WebCore::Widget* widget)
diff --git a/Source/WebCore/bindings/js/ScriptDebugServer.h b/Source/WebCore/bindings/js/ScriptDebugServer.h
index 3f7bd4f64..0ecd5a870 100644
--- a/Source/WebCore/bindings/js/ScriptDebugServer.h
+++ b/Source/WebCore/bindings/js/ScriptDebugServer.h
@@ -92,6 +92,12 @@ public:
 
     bool isPaused() { return m_paused; }
 
+    class Task {
+    public:
+        virtual ~Task() { }
+        virtual void run() = 0;
+    };
+
 protected:
     typedef HashSet<ScriptDebugListener*> ListenerSet;
     typedef void (ScriptDebugServer::*JavaScriptExecutionCallback)(ScriptDebugListener*);
diff --git a/Source/WebCore/bindings/js/ScriptWrappable.h b/Source/WebCore/bindings/js/ScriptWrappable.h
index 4fef50655..92d05e804 100644
--- a/Source/WebCore/bindings/js/ScriptWrappable.h
+++ b/Source/WebCore/bindings/js/ScriptWrappable.h
@@ -45,7 +45,7 @@ public:
 
     void setWrapper(JSC::JSGlobalData& globalData, JSDOMWrapper* wrapper, JSC::WeakHandleOwner* wrapperOwner, void* context)
     {
-        m_wrapper.set(globalData, wrapper, wrapperOwner, context);
+        m_wrapper = JSC::PassWeak<JSDOMWrapper>(globalData, wrapper, wrapperOwner, context);
     }
 
     void clearWrapper()
diff --git a/Source/WebCore/bindings/js/SerializedScriptValue.cpp b/Source/WebCore/bindings/js/SerializedScriptValue.cpp
index 3ac6ecf58..77cd65b3a 100644
--- a/Source/WebCore/bindings/js/SerializedScriptValue.cpp
+++ b/Source/WebCore/bindings/js/SerializedScriptValue.cpp
@@ -31,13 +31,26 @@
 #include "File.h"
 #include "FileList.h"
 #include "ImageData.h"
+#include "JSArrayBuffer.h"
+#include "JSArrayBufferView.h"
 #include "JSBlob.h"
+#include "JSDataView.h"
 #include "JSDOMGlobalObject.h"
 #include "JSFile.h"
 #include "JSFileList.h"
+#include "JSFloat32Array.h"
+#include "JSFloat64Array.h"
 #include "JSImageData.h"
+#include "JSInt16Array.h"
+#include "JSInt32Array.h"
+#include "JSInt8Array.h"
 #include "JSMessagePort.h"
 #include "JSNavigator.h"
+#include "JSUint16Array.h"
+#include "JSUint32Array.h"
+#include "JSUint8Array.h"
+#include "JSUint8ClampedArray.h"
+#include "ScriptValue.h"
 #include "SharedBuffer.h"
 #include <limits>
 #include <JavaScriptCore/APICast.h>
@@ -90,9 +103,47 @@ enum SerializationTag {
     RegExpTag = 18,
     ObjectReferenceTag = 19,
     MessagePortReferenceTag = 20,
+    ArrayBufferTag = 21,
+    ArrayBufferViewTag = 22,
     ErrorTag = 255
 };
 
+enum ArrayBufferViewSubtag {
+    DataViewTag = 0,
+    Int8ArrayTag = 1,
+    Uint8ArrayTag = 2,
+    Uint8ClampedArrayTag = 3,
+    Int16ArrayTag = 4,
+    Uint16ArrayTag = 5,
+    Int32ArrayTag = 6,
+    Uint32ArrayTag = 7,
+    Float32ArrayTag = 8,
+    Float64ArrayTag = 9
+};
+
+static unsigned typedArrayElementSize(ArrayBufferViewSubtag tag)
+{
+    switch (tag) {
+    case DataViewTag:
+    case Int8ArrayTag:
+    case Uint8ArrayTag:
+    case Uint8ClampedArrayTag:
+        return 1;
+    case Int16ArrayTag:
+    case Uint16ArrayTag:
+        return 2;
+    case Int32ArrayTag:
+    case Uint32ArrayTag:
+    case Float32ArrayTag:
+        return 4;
+    case Float64ArrayTag:
+        return 8;
+    default:
+        return 0;
+    }
+
+}
+
 /* CurrentVersion tracks the serialization version so that persistant stores
  * are able to correctly bail out in the case of encountering newer formats.
  *
@@ -136,8 +187,10 @@ static const unsigned int StringPoolTag = 0xFFFFFFFE;
  *    | FileList
  *    | ImageData
  *    | Blob
- *    | ObjectReferenceTag <opIndex:IndexType>
+ *    | ObjectReference
  *    | MessagePortReferenceTag <value:uint32_t>
+ *    | ArrayBuffer
+ *    | ArrayBufferViewTag ArrayBufferViewSubtag <byteOffset:uint32_t> <byteLenght:uint32_t> (ArrayBuffer | ObjectReference)
  *
  * String :-
  *      EmptyStringTag
@@ -164,6 +217,12 @@ static const unsigned int StringPoolTag = 0xFFFFFFFE;
  *
  * RegExp :-
  *    RegExpTag <pattern:StringData><flags:StringData>
+ *
+ * ObjectReference :-
+ *    ObjectReferenceTag <opIndex:IndexType>
+ *
+ * ArrayBuffer :-
+ *    ArrayBufferTag <length:uint32_t> <contents:byte{length}>
  */
 
 typedef pair<JSC::JSValue, SerializationReturnCode> DeserializationResult;
@@ -416,6 +475,40 @@ private:
         }
     }
 
+    bool dumpArrayBufferView(JSObject* obj)
+    {
+        write(ArrayBufferViewTag);
+        if (obj->inherits(&JSDataView::s_info))
+            write(DataViewTag);
+        else if (obj->inherits(&JSUint8ClampedArray::s_info))
+            write(Uint8ClampedArrayTag);
+        else if (obj->inherits(&JSInt8Array::s_info))
+            write(Int8ArrayTag);
+        else if (obj->inherits(&JSUint8Array::s_info))
+            write(Uint8ArrayTag);
+        else if (obj->inherits(&JSInt16Array::s_info))
+            write(Int16ArrayTag);
+        else if (obj->inherits(&JSUint16Array::s_info))
+            write(Uint16ArrayTag);
+        else if (obj->inherits(&JSInt32Array::s_info))
+            write(Int32ArrayTag);
+        else if (obj->inherits(&JSUint32Array::s_info))
+            write(Uint32ArrayTag);
+        else if (obj->inherits(&JSFloat32Array::s_info))
+            write(Float32ArrayTag);
+        else if (obj->inherits(&JSFloat64Array::s_info))
+            write(Float64ArrayTag);
+        else
+            return false;
+
+        RefPtr<ArrayBufferView> arrayBufferView = toArrayBufferView(obj);
+        write(static_cast<uint32_t>(arrayBufferView->byteOffset()));
+        write(static_cast<uint32_t>(arrayBufferView->byteLength()));
+        RefPtr<ArrayBuffer> arrayBuffer = arrayBufferView->buffer();
+        JSValue bufferObj = toJS(m_exec, static_cast<JSDOMGlobalObject*>(m_exec->lexicalGlobalObject()), arrayBuffer.get());
+        return dumpIfTerminal(bufferObj);
+    }
+
     bool dumpIfTerminal(JSValue value)
     {
         if (!value.isCell()) {
@@ -509,6 +602,20 @@ private:
                 }
                 return false;
             }
+            if (obj->inherits(&JSArrayBuffer::s_info)) {
+                if (!startObjectInternal(obj)) // handle duplicates
+                    return true;
+                write(ArrayBufferTag);
+                RefPtr<ArrayBuffer> arrayBuffer = toArrayBuffer(obj);
+                write(arrayBuffer->byteLength());
+                write(static_cast<const uint8_t *>(arrayBuffer->data()), arrayBuffer->byteLength());
+                return true;
+            }
+            if (obj->inherits(&JSArrayBufferView::s_info)) {
+                if (!startObjectInternal(obj))
+                    return true;
+                return dumpArrayBufferView(obj);
+            }
 
             CallData unusedData;
             if (getCallData(value, unusedData) == CallTypeNone)
@@ -524,6 +631,11 @@ private:
         writeLittleEndian<uint8_t>(m_buffer, static_cast<uint8_t>(tag));
     }
 
+    void write(ArrayBufferViewSubtag tag)
+    {
+        writeLittleEndian<uint8_t>(m_buffer, static_cast<uint8_t>(tag));
+    }
+
     void write(uint8_t c)
     {
         writeLittleEndian(m_buffer, c);
@@ -1064,6 +1176,14 @@ private:
         return static_cast<SerializationTag>(*m_ptr++);
     }
 
+    bool readArrayBufferViewSubtag(ArrayBufferViewSubtag& tag)
+    {
+        if (m_ptr >= m_end)
+            return false;
+        tag = static_cast<ArrayBufferViewSubtag>(*m_ptr++);
+        return true;
+    }
+
     void putProperty(JSArray* array, unsigned index, JSValue value)
     {
         if (array->canSetIndex(index))
@@ -1093,6 +1213,83 @@ private:
         return true;
     }
 
+    bool readArrayBuffer(RefPtr<ArrayBuffer>& arrayBuffer)
+    {
+        uint32_t length;
+        if (!read(length))
+            return false;
+        if (m_ptr + length > m_end)
+            return false;
+        arrayBuffer = ArrayBuffer::create(m_ptr, length);
+        m_ptr += length;
+        return true;
+    }
+
+    bool readArrayBufferView(JSValue& arrayBufferView)
+    {
+        ArrayBufferViewSubtag arrayBufferViewSubtag;
+        if (!readArrayBufferViewSubtag(arrayBufferViewSubtag))
+            return false;
+        uint32_t byteOffset;
+        if (!read(byteOffset))
+            return false;
+        uint32_t byteLength;
+        if (!read(byteLength))
+            return false;
+        JSObject* arrayBufferObj = asObject(readTerminal());
+        if (!arrayBufferObj || !arrayBufferObj->inherits(&JSArrayBuffer::s_info))
+            return false;
+
+        unsigned elementSize = typedArrayElementSize(arrayBufferViewSubtag);
+        if (!elementSize)
+            return false;
+        unsigned length = byteLength / elementSize;
+        if (length * elementSize != byteLength)
+            return false;
+
+        RefPtr<ArrayBuffer> arrayBuffer = toArrayBuffer(arrayBufferObj);
+        switch (arrayBufferViewSubtag) {
+        case DataViewTag:
+            arrayBufferView = getJSValue(DataView::create(arrayBuffer, byteOffset, length).get());
+            return true;
+        case Int8ArrayTag:
+            arrayBufferView = getJSValue(Int8Array::create(arrayBuffer, byteOffset, length).get());
+            return true;
+        case Uint8ArrayTag:
+            arrayBufferView = getJSValue(Uint8Array::create(arrayBuffer, byteOffset, length).get());
+            return true;
+        case Uint8ClampedArrayTag:
+            arrayBufferView = getJSValue(Uint8ClampedArray::create(arrayBuffer, byteOffset, length).get());
+            return true;
+        case Int16ArrayTag:
+            arrayBufferView = getJSValue(Int16Array::create(arrayBuffer, byteOffset, length).get());
+            return true;
+        case Uint16ArrayTag:
+            arrayBufferView = getJSValue(Uint16Array::create(arrayBuffer, byteOffset, length).get());
+            return true;
+        case Int32ArrayTag:
+            arrayBufferView = getJSValue(Int32Array::create(arrayBuffer, byteOffset, length).get());
+            return true;
+        case Uint32ArrayTag:
+            arrayBufferView = getJSValue(Uint32Array::create(arrayBuffer, byteOffset, length).get());
+            return true;
+        case Float32ArrayTag:
+            arrayBufferView = getJSValue(Float32Array::create(arrayBuffer, byteOffset, length).get());
+            return true;
+        case Float64ArrayTag:
+            arrayBufferView = getJSValue(Float64Array::create(arrayBuffer, byteOffset, length).get());
+            return true;
+        default:
+            return false;
+        }
+    }
+
+    template<class T>
+    JSValue getJSValue(T* nativeObj)
+    {
+        return toJS(m_exec, static_cast<JSDOMGlobalObject*>(m_globalObject), nativeObj);
+    }
+
     JSValue readTerminal()
     {
         SerializationTag tag = readTag();
@@ -1149,7 +1346,7 @@ private:
             }
             if (!m_isDOMGlobalObject)
                 return jsNull();
-            return toJS(m_exec, static_cast<JSDOMGlobalObject*>(m_globalObject), result.get());
+            return getJSValue(result.get());
         }
         case ImageDataTag: {
             int32_t width;
@@ -1172,7 +1369,7 @@ private:
             RefPtr<ImageData> result = ImageData::create(IntSize(width, height));
             memcpy(result->data()->data()->data(), m_ptr, length);
             m_ptr += length;
-            return toJS(m_exec, static_cast<JSDOMGlobalObject*>(m_globalObject), result.get());
+            return getJSValue(result.get());
         }
         case BlobTag: {
             CachedStringRef url;
@@ -1186,7 +1383,7 @@ private:
                 return JSValue();
             if (!m_isDOMGlobalObject)
                 return jsNull();
-            return toJS(m_exec, static_cast<JSDOMGlobalObject*>(m_globalObject), Blob::create(KURL(KURL(), url->ustring().impl()), String(type->ustring().impl()), size));
+            return getJSValue(Blob::create(KURL(KURL(), url->ustring().impl()), String(type->ustring().impl()), size).get());
         }
         case StringTag: {
             CachedStringRef cachedString;
@@ -1223,8 +1420,26 @@ private:
                 fail();
                 return JSValue();
             }
-            return toJS(m_exec, static_cast<JSDOMGlobalObject*>(m_exec->lexicalGlobalObject()),
-                        m_messagePorts->at(index).get());
+            return getJSValue(m_messagePorts->at(index).get());
+        }
+        case ArrayBufferTag: {
+            RefPtr<ArrayBuffer> arrayBuffer;
+            if (!readArrayBuffer(arrayBuffer)) {
+                fail();
+                return JSValue();
+            }
+            JSValue result = getJSValue(arrayBuffer.get());
+            m_gcBuffer.append(result);
+            return result;
+        }
+        case ArrayBufferViewTag: {
+            JSValue arrayBufferView;
+            if (!readArrayBufferView(arrayBufferView)) {
+                fail();
+                return JSValue();
+            }
+            m_gcBuffer.append(arrayBufferView);
+            return arrayBufferView;
         }
         default:
             m_ptr--; // Push the tag back
@@ -1452,6 +1667,14 @@ JSValue SerializedScriptValue::deserialize(ExecState* exec, JSGlobalObject* glob
     return result.first;
 }
 
+#if ENABLE(INSPECTOR)
+ScriptValue SerializedScriptValue::deserializeForInspector(ScriptState* scriptState)
+{
+    JSValue value = deserialize(scriptState, scriptState->lexicalGlobalObject(), 0);
+    return ScriptValue(scriptState->globalData(), value);
+}
+#endif
+
 JSValueRef SerializedScriptValue::deserialize(JSContextRef destinationContext, JSValueRef* exception, MessagePortArray* messagePorts)
 {
     ExecState* exec = toJS(destinationContext);
diff --git a/Source/WebCore/bindings/js/SerializedScriptValue.h b/Source/WebCore/bindings/js/SerializedScriptValue.h
index caed6473c..75ce694b2 100644
--- a/Source/WebCore/bindings/js/SerializedScriptValue.h
+++ b/Source/WebCore/bindings/js/SerializedScriptValue.h
@@ -27,6 +27,7 @@
 #ifndef SerializedScriptValue_h
 #define SerializedScriptValue_h
 
+#include "ScriptState.h"
 #include <heap/Strong.h>
 #include <runtime/JSValue.h>
 #include <wtf/Forward.h>
@@ -52,6 +53,7 @@ enum SerializationReturnCode {
     
 enum SerializationErrorMode { NonThrowing, Throwing };
 
+class ScriptValue;
 class SharedBuffer;
 
 class SerializedScriptValue : public RefCounted<SerializedScriptValue> {
@@ -77,6 +79,10 @@ public:
     JSValueRef deserialize(JSContextRef, JSValueRef* exception, MessagePortArray*);
     JSValueRef deserialize(JSContextRef, JSValueRef* exception);
 
+#if ENABLE(INSPECTOR)
+    ScriptValue deserializeForInspector(ScriptState*);
+#endif
+
     const Vector<uint8_t>& data() { return m_data; }
 
     ~SerializedScriptValue();
diff --git a/Source/WebCore/bindings/js/WorkerScriptDebugServer.cpp b/Source/WebCore/bindings/js/WorkerScriptDebugServer.cpp
index 14d64650f..67bb4da6d 100644
--- a/Source/WebCore/bindings/js/WorkerScriptDebugServer.cpp
+++ b/Source/WebCore/bindings/js/WorkerScriptDebugServer.cpp
@@ -33,23 +33,26 @@
 #if ENABLE(JAVASCRIPT_DEBUGGER) && ENABLE(WORKERS)
 
 #include "WorkerScriptDebugServer.h"
-
-#include "WorkerContext.h"
+#include <wtf/PassOwnPtr.h>
 
 namespace WebCore {
 
 const char* WorkerScriptDebugServer::debuggerTaskMode = "debugger";
 
-WorkerScriptDebugServer::WorkerScriptDebugServer()
+WorkerScriptDebugServer::WorkerScriptDebugServer(WorkerContext*)
     : ScriptDebugServer()
 {
 }
 
-void WorkerScriptDebugServer::addListener(ScriptDebugListener*, WorkerContext*)
+void WorkerScriptDebugServer::addListener(ScriptDebugListener*)
+{
+}
+
+void WorkerScriptDebugServer::removeListener(ScriptDebugListener*)
 {
 }
 
-void WorkerScriptDebugServer::removeListener(ScriptDebugListener*, WorkerContext*)
+void WorkerScriptDebugServer::interruptAndRunTask(PassOwnPtr<ScriptDebugServer::Task>)
 {
 }
 
diff --git a/Source/WebCore/bindings/js/WorkerScriptDebugServer.h b/Source/WebCore/bindings/js/WorkerScriptDebugServer.h
index f4c976535..d2d7710c7 100644
--- a/Source/WebCore/bindings/js/WorkerScriptDebugServer.h
+++ b/Source/WebCore/bindings/js/WorkerScriptDebugServer.h
@@ -42,14 +42,16 @@ class WorkerContext;
 class WorkerScriptDebugServer : public ScriptDebugServer {
     WTF_MAKE_NONCOPYABLE(WorkerScriptDebugServer);
 public:
-    WorkerScriptDebugServer();
+    explicit WorkerScriptDebugServer(WorkerContext*);
     ~WorkerScriptDebugServer() { }
 
-    void addListener(ScriptDebugListener*, WorkerContext*);
-    void removeListener(ScriptDebugListener*, WorkerContext*);
+    void addListener(ScriptDebugListener*);
+    void removeListener(ScriptDebugListener*);
 
     static const char* debuggerTaskMode;
 
+    void interruptAndRunTask(PassOwnPtr<ScriptDebugServer::Task>);
+
 private:
     virtual void recompileAllJSFunctions(Timer<ScriptDebugServer>*) { }
     virtual ListenerSet* getListenersForGlobalObject(JSC::JSGlobalObject*) { return 0; }
diff --git a/Source/WebCore/bindings/objc/DOM.mm b/Source/WebCore/bindings/objc/DOM.mm
index 8ccb7e286..780634acb 100644
--- a/Source/WebCore/bindings/objc/DOM.mm
+++ b/Source/WebCore/bindings/objc/DOM.mm
@@ -327,8 +327,6 @@ Class kitClass(WebCore::Node* impl)
             // FIXME: Create an XPath objective C wrapper
             // See http://bugs.webkit.org/show_bug.cgi?id=8755
             return nil;
-        case WebCore::Node::SHADOW_ROOT_NODE:
-            return [DOMNode class];
     }
     ASSERT_NOT_REACHED();
     return nil;
diff --git a/Source/WebCore/bindings/objc/PublicDOMInterfaces.h b/Source/WebCore/bindings/objc/PublicDOMInterfaces.h
index b379c0b3c..1239971be 100644
--- a/Source/WebCore/bindings/objc/PublicDOMInterfaces.h
+++ b/Source/WebCore/bindings/objc/PublicDOMInterfaces.h
@@ -331,6 +331,7 @@
 @end
 
 @interface DOMHTMLAnchorElement : DOMHTMLElement WEBKIT_VERSION_1_3
+@property(copy) NSString *accessKey AVAILABLE_WEBKIT_VERSION_1_3_AND_LATER_BUT_DEPRECATED_AFTER_WEBKIT_VERSION_5_1;
 @property(copy) NSString *charset;
 @property(copy) NSString *coords;
 @property(copy) NSString *href;
@@ -367,6 +368,7 @@
 @end
 
 @interface DOMHTMLAreaElement : DOMHTMLElement WEBKIT_VERSION_1_3
+@property(copy) NSString *accessKey AVAILABLE_WEBKIT_VERSION_1_3_AND_LATER_BUT_DEPRECATED_AFTER_WEBKIT_VERSION_5_1;
 @property(copy) NSString *alt;
 @property(copy) NSString *coords;
 @property(copy) NSString *href;
@@ -408,6 +410,7 @@
 @end
 
 @interface DOMHTMLButtonElement : DOMHTMLElement WEBKIT_VERSION_1_3
+@property(copy) NSString *accessKey AVAILABLE_WEBKIT_VERSION_1_3_AND_LATER_BUT_DEPRECATED_AFTER_WEBKIT_VERSION_5_1;
 @property(readonly, retain) DOMHTMLFormElement *form;
 @property BOOL disabled;
 @property(copy) NSString *name;
@@ -468,7 +471,7 @@
 @end
 
 @interface DOMHTMLElement : DOMElement WEBKIT_VERSION_1_3
-@property(copy) NSString *accessKey;
+@property(copy) NSString *accessKey AVAILABLE_AFTER_WEBKIT_VERSION_5_1;
 @property(copy) NSString *title;
 @property(copy) NSString *idName;
 @property(copy) NSString *lang;
@@ -483,6 +486,7 @@
 @property(readonly) BOOL isContentEditable;
 @property(readonly, copy) NSString *titleDisplayString AVAILABLE_WEBKIT_VERSION_3_0_AND_LATER;
 @property int tabIndex;
+- (void)click AVAILABLE_AFTER_WEBKIT_VERSION_5_1;
 @end
 
 @interface DOMHTMLEmbedElement : DOMHTMLElement WEBKIT_VERSION_1_3
@@ -601,6 +605,7 @@
 @property BOOL defaultChecked;
 @property(readonly, retain) DOMHTMLFormElement *form;
 @property(copy) NSString *accept;
+@property(copy) NSString *accessKey AVAILABLE_WEBKIT_VERSION_1_3_AND_LATER_BUT_DEPRECATED_AFTER_WEBKIT_VERSION_5_1;
 @property(copy) NSString *align;
 @property(copy) NSString *alt;
 @property BOOL checked;
@@ -633,11 +638,13 @@
 @end
 
 @interface DOMHTMLLabelElement : DOMHTMLElement WEBKIT_VERSION_1_3
+@property(copy) NSString *accessKey AVAILABLE_WEBKIT_VERSION_1_3_AND_LATER_BUT_DEPRECATED_AFTER_WEBKIT_VERSION_5_1;
 @property(readonly, retain) DOMHTMLFormElement *form;
 @property(copy) NSString *htmlFor;
 @end
 
 @interface DOMHTMLLegendElement : DOMHTMLElement WEBKIT_VERSION_1_3
+@property(copy) NSString *accessKey AVAILABLE_WEBKIT_VERSION_1_3_AND_LATER_BUT_DEPRECATED_AFTER_WEBKIT_VERSION_5_1;
 @property(readonly, retain) DOMHTMLFormElement *form;
 @property(copy) NSString *align;
 @end
@@ -874,6 +881,7 @@
 @interface DOMHTMLTextAreaElement : DOMHTMLElement WEBKIT_VERSION_1_3
 @property(copy) NSString *defaultValue;
 @property(readonly, retain) DOMHTMLFormElement *form;
+@property(copy) NSString *accessKey AVAILABLE_WEBKIT_VERSION_1_3_AND_LATER_BUT_DEPRECATED_AFTER_WEBKIT_VERSION_5_1;
 @property int cols;
 @property BOOL disabled;
 @property(copy) NSString *name;
diff --git a/Source/WebCore/bindings/scripts/CodeGenerator.pm b/Source/WebCore/bindings/scripts/CodeGenerator.pm
index d5b6bdf19..ea5835996 100644
--- a/Source/WebCore/bindings/scripts/CodeGenerator.pm
+++ b/Source/WebCore/bindings/scripts/CodeGenerator.pm
@@ -528,7 +528,7 @@ sub ContentAttributeName
     my $contentAttributeName = $attribute->signature->extendedAttributes->{"Reflect"};
     return undef if !$contentAttributeName;
 
-    $contentAttributeName = lc $generator->AttributeNameForGetterAndSetter($attribute) if $contentAttributeName eq "1";
+    $contentAttributeName = lc $generator->AttributeNameForGetterAndSetter($attribute) if $contentAttributeName eq "VALUE_IS_MISSING";
 
     my $namespace = $generator->NamespaceForAttributeName($interfaceName, $contentAttributeName);
 
@@ -627,7 +627,11 @@ sub GenerateCompileTimeCheckForEnumsIfNeeded
                 push(@checks, "#if ${conditionalString}\n");
             }
 
-            push(@checks, "COMPILE_ASSERT($value == ${interfaceName}::$name, ${interfaceName}Enum${name}IsWrongUseDoNotCheckConstants);\n");
+            if ($constant->extendedAttributes->{"ImplementedBy"}) {
+                push(@checks, "COMPILE_ASSERT($value == " . $constant->extendedAttributes->{"ImplementedBy"} . "::$name, ${interfaceName}Enum${name}IsWrongUseDoNotCheckConstants);\n");
+            } else {
+                push(@checks, "COMPILE_ASSERT($value == ${interfaceName}::$name, ${interfaceName}Enum${name}IsWrongUseDoNotCheckConstants);\n");
+            }
 
             if ($conditional) {
                 push(@checks, "#endif\n");
@@ -638,4 +642,25 @@ sub GenerateCompileTimeCheckForEnumsIfNeeded
     return @checks;
 }
 
+sub ExtendedAttributeContains
+{
+    my $object = shift;
+    my $callWith = shift;
+    return 0 unless $callWith;
+    my $keyword = shift;
+
+    my @callWithKeywords = split /\s*\|\s*/, $callWith;
+    return grep { $_ eq $keyword } @callWithKeywords;
+}
+
+# FIXME: This is backwards. We currently name the interface and the IDL files with the implementation name. We
+# should use the real interface name in the IDL files and then use ImplementedAs to map this to the implementation name.
+sub GetVisibleInterfaceName
+{
+    my $object = shift;
+    my $dataNode = shift;
+    my $interfaceName = $dataNode->extendedAttributes->{"InterfaceName"};
+    return $interfaceName ? $interfaceName : $dataNode->name;
+}
+
 1;
diff --git a/Source/WebCore/bindings/scripts/CodeGeneratorCPP.pm b/Source/WebCore/bindings/scripts/CodeGeneratorCPP.pm
index a909a57d0..efe755290 100644
--- a/Source/WebCore/bindings/scripts/CodeGeneratorCPP.pm
+++ b/Source/WebCore/bindings/scripts/CodeGeneratorCPP.pm
@@ -191,16 +191,18 @@ sub ShouldSkipType
 {
     my $typeInfo = shift;
 
-    return 1 if $typeInfo->signature->extendedAttributes->{"Custom"};
-
-    return 1 if $typeInfo->signature->extendedAttributes->{"CustomArgumentHandling"}
-             or $typeInfo->signature->extendedAttributes->{"CustomGetter"}
-             or $typeInfo->signature->extendedAttributes->{"CPPCustom"};
+    return 1 if $typeInfo->signature->extendedAttributes->{"Custom"}
+                or $typeInfo->signature->extendedAttributes->{"CustomGetter"};
 
     # FIXME: We don't generate bindings for SVG related interfaces yet
     return 1 if $typeInfo->signature->name =~ /getSVGDocument/;
 
     return 1 if $typeInfo->signature->name =~ /Constructor/;
+    
+    # FIXME: This is typically used to add script execution state arguments to the method.
+    # These functions will not compile with the C++ bindings as is, so disable them
+    # to restore compilation until a proper implementation can be developed.
+    return 1 if $typeInfo->signature->extendedAttributes->{"CallWith"};
     return 0;
 }
 
@@ -462,7 +464,7 @@ sub GenerateHeader
     if ($numFunctions > 0) {
         foreach my $function (@{$dataNode->functions}) {
             next if ShouldSkipType($function);
-            my $functionName = $function->signature->name;
+            my $functionName = $function->signature->extendedAttributes->{"ImplementedAs"} || $function->signature->name;
 
             my $returnType = GetCPPType($function->signature->type, 0);
             my $numberOfParameters = @{$function->parameters};
@@ -807,7 +809,7 @@ sub GenerateImplementation
                 my $implGetter = GetCPPTypeGetter($paramName, $idlType);
 
                 push(@parameterNames, $implGetter);
-                $needsCustom{"NodeToReturn"} = $paramName if $param->extendedAttributes->{"Return"};
+                $needsCustom{"NodeToReturn"} = $paramName if $param->extendedAttributes->{"CustomReturn"};
 
                 unless ($codeGenerator->IsPrimitiveType($idlType) or $codeGenerator->IsStringType($idlType)) {
                     push(@needsAssert, "    ASSERT($paramName);\n");
diff --git a/Source/WebCore/bindings/scripts/CodeGeneratorGObject.pm b/Source/WebCore/bindings/scripts/CodeGeneratorGObject.pm
index 6edfd0c80..47677a8c3 100644
--- a/Source/WebCore/bindings/scripts/CodeGeneratorGObject.pm
+++ b/Source/WebCore/bindings/scripts/CodeGeneratorGObject.pm
@@ -188,10 +188,11 @@ sub SkipFunction {
     my $prefix = shift;
 
     my $functionName = "webkit_dom_" . $decamelize . "_" . $prefix . decamelize($function->signature->name);
-    my $isCustomFunction = $function->signature->extendedAttributes->{"Custom"} ||
-        $function->signature->extendedAttributes->{"CustomArgumentHandling"};
+    my $isCustomFunction = $function->signature->extendedAttributes->{"Custom"};
+    my $callWith = $function->signature->extendedAttributes->{"CallWith"};
+    my $isUnsupportedCallWith = $codeGenerator->ExtendedAttributeContains($callWith, "ScriptArguments") || $codeGenerator->ExtendedAttributeContains($callWith, "CallStack");
 
-    if ($isCustomFunction &&
+    if (($isCustomFunction || $isUnsupportedCallWith) &&
         $functionName ne "webkit_dom_node_replace_child" &&
         $functionName ne "webkit_dom_node_insert_before" &&
         $functionName ne "webkit_dom_node_remove_child" &&
@@ -388,8 +389,8 @@ sub GenerateProperty {
         push(@setterArguments, "${convertFunction}(g_value_get_$gtype(value))");
         unshift(@getterArguments, "coreSelf");
         unshift(@setterArguments, "coreSelf");
-        $getterFunctionName = "${implementedBy}::$getterFunctionName";
-        $setterFunctionName = "${implementedBy}::$setterFunctionName";
+        $getterFunctionName = "WebCore::${implementedBy}::$getterFunctionName";
+        $setterFunctionName = "WebCore::${implementedBy}::$setterFunctionName";
     } else {
         push(@setterArguments, "${convertFunction}(g_value_get_$gtype(value))");
         $getterFunctionName = "coreSelf->$getterFunctionName";
@@ -417,7 +418,7 @@ sub GenerateProperty {
         push(@txtGetProps, "        g_value_take_string(value, convertToUTF8String(${getterFunctionName}(" . join(", ", @getterArguments) . ")));\n");
         $done = 1;
     } elsif ($gtype eq "object") {
-        push(@txtGetProps, "        RefPtr<WebCore::${propType}> ptr = coreSelf->${getPropNameFunction}(" . (@{$attribute->getterExceptions} ? "ec" : "") . ");\n");
+        push(@txtGetProps, "        RefPtr<WebCore::${propType}> ptr = ${getterFunctionName}(" . join(", ", @getterArguments) . ");\n");
         push(@txtGetProps, "        g_value_set_object(value, WebKit::kit(ptr.get()));\n");
         $done = 1;
     }
@@ -738,10 +739,6 @@ sub GenerateFunction {
 
     my @callImplParams;
 
-    # skip some custom functions for now
-    my $isCustomFunction = $function->signature->extendedAttributes->{"Custom"} ||
-                       $function->signature->extendedAttributes->{"CustomArgumentHandling"};
-
     foreach my $param (@{$function->parameters}) {
         my $paramIDLType = $param->type;
         if ($paramIDLType eq "EventListener" || $paramIDLType eq "MediaQueryListListener") {
@@ -868,7 +865,7 @@ sub GenerateFunction {
 
             push(@cBody, "    }\n");
         }
-        $returnParamName = "converted_".$paramName if $param->extendedAttributes->{"Return"};
+        $returnParamName = "converted_".$paramName if $param->extendedAttributes->{"CustomReturn"};
     }
 
     my $assign = "";
@@ -929,7 +926,7 @@ EOF
                 my $implementedBy = $function->signature->extendedAttributes->{"ImplementedBy"};
                 $implIncludes{"${implementedBy}.h"} = 1;
                 unshift(@arguments, "item");
-                $functionName = "${implementedBy}::${functionName}";
+                $functionName = "WebCore::${implementedBy}::${functionName}";
             } else {
                 $functionName = "item->${functionName}";
             }
@@ -940,7 +937,7 @@ EOF
                 my $implementedBy = $function->signature->extendedAttributes->{"ImplementedBy"};
                 $implIncludes{"${implementedBy}.h"} = 1;
                 unshift(@arguments, "item");
-                $getterContentHead = "${assign}convertToUTF8String(${implementedBy}::${functionSigName}(" . join(", ", @arguments) . "));\n";
+                $getterContentHead = "${assign}convertToUTF8String(WebCore::${implementedBy}::${functionSigName}(" . join(", ", @arguments) . "));\n";
             } else {
                 $getterContentHead = "${assign}convertToUTF8String(item->${functionSigName}(" . join(", ", @arguments) . "));\n";
             }
@@ -955,7 +952,7 @@ EOF
                 my $implementedBy = $function->signature->extendedAttributes->{"ImplementedBy"};
                 $implIncludes{"${implementedBy}.h"} = 1;
                 unshift(@arguments, "item");
-                $functionName = "${implementedBy}::${functionName}";
+                $functionName = "WebCore::${implementedBy}::${functionName}";
             } else {
                 $functionName = "item->${functionName}";
             }
@@ -967,7 +964,7 @@ EOF
                 my $implementedBy = $function->signature->extendedAttributes->{"ImplementedBy"};
                 $implIncludes{"${implementedBy}.h"} = 1;
                 unshift(@arguments, "item");
-                $functionName = "${implementedBy}::${functionName}";
+                $functionName = "WebCore::${implementedBy}::${functionName}";
                 $contentHead = "${assign}${assignPre}${functionName}(" . join(", ", @arguments) . "${assignPost});\n";
             } else {
                 $functionName = "item->${functionName}";
@@ -979,7 +976,7 @@ EOF
                 my $implementedBy = $function->signature->extendedAttributes->{"ImplementedBy"};
                 $implIncludes{"${implementedBy}.h"} = 1;
                 unshift(@arguments, "item");
-                $contentHead = "${assign}${assignPre}${implementedBy}::${functionSigName}(" . join(", ", @arguments) . "${assignPost});\n";
+                $contentHead = "${assign}${assignPre}WebCore::${implementedBy}::${functionSigName}(" . join(", ", @arguments) . "${assignPost});\n";
             } else {
                 $contentHead = "${assign}${assignPre}item->${functionSigName}(" . join(", ", @arguments) . "${assignPost});\n";
             }
diff --git a/Source/WebCore/bindings/scripts/CodeGeneratorJS.pm b/Source/WebCore/bindings/scripts/CodeGeneratorJS.pm
index 2e914262f..2aa9f5977 100644
--- a/Source/WebCore/bindings/scripts/CodeGeneratorJS.pm
+++ b/Source/WebCore/bindings/scripts/CodeGeneratorJS.pm
@@ -30,7 +30,7 @@ use strict;
 
 use constant FileNamePrefix => "JS";
 
-my ($codeGenerator);
+my $codeGenerator;
 
 my $module = "";
 my $outputDir = "";
@@ -189,20 +189,6 @@ sub GetParentClassName
     return "JS" . $codeGenerator->StripModule($dataNode->parents(0));
 }
 
-sub GetVisibleClassName
-{
-    my $className = shift;
-
-    return "DOMException" if $className eq "DOMCoreException";
-    return "FormData" if $className eq "DOMFormData";
-    return "MimeType" if $className eq "DOMMimeType";
-    return "MimeTypeArray" if $className eq "DOMMimeTypeArray";
-    return "Plugin" if $className eq "DOMPlugin";
-    return "PluginArray" if $className eq "DOMPluginArray";
-    
-    return $className;
-}
-
 sub GetCallbackClassName
 {
     my $className = shift;
@@ -274,6 +260,8 @@ sub AddIncludesForType
     } elsif ($type eq "DOMString[]") {
         # FIXME: Add proper support for T[], T[]?, sequence<T>
         $includesRef->{"JSDOMStringList.h"} = 1;
+    } elsif ($type eq "unsigned long[]") {
+        $includesRef->{"<wtf/Vector.h>"} = 1;
     } elsif ($isCallback) {
         $includesRef->{"JS${type}.h"} = 1;
     } elsif (IsTypedArrayType($type)) {
@@ -437,7 +425,7 @@ sub GenerateGetOwnPropertySlotBody
         push(@getOwnPropertySlotImpl, "    bool ok;\n");
         push(@getOwnPropertySlotImpl, "    unsigned index = propertyName.toUInt32(ok);\n");
 
-        # If the item function returns a string then we let the ConvertNullStringTo handle the cases
+        # If the item function returns a string then we let the TreatReturnedNullStringAs handle the cases
         # where the index is out of range.
         if (IndexGetterReturnsStrings($implClassName)) {
             push(@getOwnPropertySlotImpl, "    if (ok) {\n");
@@ -469,7 +457,7 @@ sub GenerateGetOwnPropertySlotBody
         &$manualLookupGetterGeneration();
     }
 
-    if ($dataNode->extendedAttributes->{"JSCustomGetOwnPropertySlotDelegate"}) {
+    if ($dataNode->extendedAttributes->{"JSCustomGetOwnPropertySlotAndDescriptor"}) {
         push(@getOwnPropertySlotImpl, "    if (thisObject->getOwnPropertySlotDelegate(exec, propertyName, slot))\n");
         push(@getOwnPropertySlotImpl, "        return true;\n");
     }
@@ -495,7 +483,7 @@ sub GenerateGetOwnPropertyDescriptorBody
     my $namespaceMaybe = ($inlined ? "JSC::" : "");
     
     my @getOwnPropertyDescriptorImpl = ();
-    if ($dataNode->extendedAttributes->{"CheckDomainSecurity"}) {
+    if ($dataNode->extendedAttributes->{"CheckSecurity"}) {
         if ($interfaceName eq "DOMWindow") {
             push(@implContent, "    if (!thisObject->allowsAccessFrom(exec))\n");
         } else {
@@ -570,7 +558,7 @@ sub GenerateGetOwnPropertyDescriptorBody
         &$manualLookupGetterGeneration();
     }
 
-    if ($dataNode->extendedAttributes->{"JSCustomGetOwnPropertySlotDelegate"}) {
+    if ($dataNode->extendedAttributes->{"JSCustomGetOwnPropertySlotAndDescriptor"}) {
         push(@getOwnPropertyDescriptorImpl, "    if (thisObject->getOwnPropertyDescriptorDelegate(exec, propertyName, descriptor))\n");
         push(@getOwnPropertyDescriptorImpl, "        return true;\n");
     }
@@ -758,7 +746,7 @@ sub GenerateHeader
                  || $dataNode->extendedAttributes->{"IndexedGetter"}
                  || $dataNode->extendedAttributes->{"NumericIndexedGetter"}
                  || $dataNode->extendedAttributes->{"CustomGetOwnPropertySlot"}
-                 || $dataNode->extendedAttributes->{"JSCustomGetOwnPropertySlotDelegate"}
+                 || $dataNode->extendedAttributes->{"JSCustomGetOwnPropertySlotAndDescriptor"}
                  || $dataNode->extendedAttributes->{"NamedGetter"}
                  || $dataNode->extendedAttributes->{"CustomNamedGetter"};
 
@@ -767,8 +755,8 @@ sub GenerateHeader
         push(@headerContent, "    static bool getOwnPropertySlot(JSC::JSCell*, JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);\n");
         push(@headerContent, "    static bool getOwnPropertyDescriptor(JSC::JSObject*, JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);\n");
         push(@headerContent, "    static bool getOwnPropertySlotByIndex(JSC::JSCell*, JSC::ExecState*, unsigned propertyName, JSC::PropertySlot&);\n") if ($dataNode->extendedAttributes->{"IndexedGetter"} || $dataNode->extendedAttributes->{"NumericIndexedGetter"}) && !$dataNode->extendedAttributes->{"CustomNamedGetter"};
-        push(@headerContent, "    bool getOwnPropertySlotDelegate(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);\n") if $dataNode->extendedAttributes->{"JSCustomGetOwnPropertySlotDelegate"};
-        push(@headerContent, "    bool getOwnPropertyDescriptorDelegate(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);\n") if $dataNode->extendedAttributes->{"JSCustomGetOwnPropertySlotDelegate"};
+        push(@headerContent, "    bool getOwnPropertySlotDelegate(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);\n") if $dataNode->extendedAttributes->{"JSCustomGetOwnPropertySlotAndDescriptor"};
+        push(@headerContent, "    bool getOwnPropertyDescriptorDelegate(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);\n") if $dataNode->extendedAttributes->{"JSCustomGetOwnPropertySlotAndDescriptor"};
         $structureFlags{"JSC::OverridesGetOwnPropertySlot"} = 1;
     }
 
@@ -794,6 +782,7 @@ sub GenerateHeader
 
     if (!$hasParent) {
         push(@headerContent, "    static void destroy(JSC::JSCell*);\n");
+        push(@headerContent, "    ~${className}();\n");
     }
 
     # Class info
@@ -828,7 +817,7 @@ sub GenerateHeader
     }
 
     # Custom getOwnPropertyNames function
-    if ($dataNode->extendedAttributes->{"CustomGetPropertyNames"} || $dataNode->extendedAttributes->{"IndexedGetter"} || $dataNode->extendedAttributes->{"NumericIndexedGetter"}) {
+    if ($dataNode->extendedAttributes->{"CustomEnumerateProperty"} || $dataNode->extendedAttributes->{"IndexedGetter"} || $dataNode->extendedAttributes->{"NumericIndexedGetter"}) {
         push(@headerContent, "    static void getOwnPropertyNames(JSC::JSObject*, JSC::ExecState*, JSC::PropertyNameArray&, JSC::EnumerationMode mode = JSC::ExcludeDontEnumProperties);\n");
         $structureFlags{"JSC::OverridesGetPropertyNames"} = 1;       
     }
@@ -1002,7 +991,7 @@ sub GenerateHeader
         push(@headerContent, "\n");
     }
 
-    if (!$hasParent || $dataNode->extendedAttributes->{"JSGenerateToJS"} || $dataNode->extendedAttributes->{"JSCustomToJS"}) {
+    if (!$hasParent || $dataNode->extendedAttributes->{"JSGenerateToJSObject"} || ($dataNode->extendedAttributes->{"CustomToJSObject"} || $dataNode->extendedAttributes->{"JSCustomToJSObject"})) {
         push(@headerContent, "JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, $implType*);\n");
     }
     if (!$hasParent || $dataNode->extendedAttributes->{"JSGenerateToNativeObject"}) {
@@ -1048,13 +1037,13 @@ sub GenerateHeader
         "    {\n" .
         "        return JSC::Structure::create(globalData, globalObject, prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), &s_info);\n" .
         "    }\n");
-    if ($dataNode->extendedAttributes->{"JSCustomPrototypePutDelegate"}) {
+    if ($dataNode->extendedAttributes->{"JSCustomNamedGetterOnPrototype"}) {
         push(@headerContent, "    static void put(JSC::JSCell*, JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);\n");
         push(@headerContent, "    bool putDelegate(JSC::ExecState*, const JSC::Identifier&, JSC::JSValue, JSC::PutPropertySlot&);\n");
     }
 
     # Custom defineOwnProperty function
-    push(@headerContent, "    static bool defineOwnProperty(JSC::JSObject*, JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&, bool shouldThrow);\n") if $dataNode->extendedAttributes->{"JSCustomPrototypeDefineOwnProperty"};
+    push(@headerContent, "    static bool defineOwnProperty(JSC::JSObject*, JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&, bool shouldThrow);\n") if $dataNode->extendedAttributes->{"JSCustomDefineOwnPropertyOnPrototype"};
 
     push(@headerContent, "\nprivate:\n");
     push(@headerContent, "    ${className}Prototype(JSC::JSGlobalData& globalData, JSC::JSGlobalObject*, JSC::Structure* structure) : JSC::JSNonFinalObject(globalData, structure) { }\n");
@@ -1320,7 +1309,7 @@ sub GenerateImplementation
     my $hasRealParent = @{$dataNode->parents} > 0;
     my $hasParent = $hasLegacyParent || $hasRealParent;
     my $parentClassName = GetParentClassName($dataNode);
-    my $visibleClassName = GetVisibleClassName($interfaceName);
+    my $visibleInterfaceName = $codeGenerator->GetVisibleInterfaceName($dataNode);
     my $eventTarget = $dataNode->extendedAttributes->{"EventTarget"};
     my $needsMarkChildren = $dataNode->extendedAttributes->{"JSCustomMarkFunction"} || $dataNode->extendedAttributes->{"EventTarget"};
 
@@ -1340,9 +1329,6 @@ sub GenerateImplementation
     push(@implContent, "namespace WebCore {\n\n");
 
     push(@implContent, "ASSERT_CLASS_FITS_IN_CELL($className);\n");
-    if ($interfaceName ne "DOMWindow" && !$dataNode->extendedAttributes->{"IsWorkerContext"}) {
-        push(@implContent, "ASSERT_HAS_TRIVIAL_DESTRUCTOR($className);\n\n");
-    }
 
     my $numAttributes = GenerateAttributesHashTable($object, $dataNode);
 
@@ -1369,6 +1355,10 @@ sub GenerateImplementation
             push(@hashValue2, "0");
             push(@hashSpecials, "DontDelete | ReadOnly");
 
+            my $implementedBy = $constant->extendedAttributes->{"ImplementedBy"};
+            if ($implementedBy) {
+                $implIncludes{"${implementedBy}.h"} = 1;
+            }
             my $conditional = $constant->extendedAttributes->{"Conditional"};
             if ($conditional) {
                 $conditionals{$name} = $conditional;
@@ -1408,7 +1398,7 @@ sub GenerateImplementation
         push(@implContent, $codeGenerator->GenerateCompileTimeCheckForEnumsIfNeeded($dataNode));
 
         my $protoClassName = "${className}Prototype";
-        GenerateConstructorDefinition(\@implContent, $className, $protoClassName, $interfaceName, $visibleClassName, $dataNode);
+        GenerateConstructorDefinition(\@implContent, $className, $protoClassName, $interfaceName, $visibleInterfaceName, $dataNode);
         if ($dataNode->extendedAttributes->{"NamedConstructor"}) {
             GenerateConstructorDefinition(\@implContent, $className, $protoClassName, $interfaceName, $dataNode->extendedAttributes->{"NamedConstructor"}, $dataNode, "GeneratingNamedConstructor");
         }
@@ -1474,9 +1464,9 @@ sub GenerateImplementation
         push(@implContent, "{\n");
         push(@implContent, "    return getHashTableForGlobalData(exec->globalData(), &${className}PrototypeTable);\n");
         push(@implContent, "}\n\n");
-        push(@implContent, "const ClassInfo ${className}Prototype::s_info = { \"${visibleClassName}Prototype\", &Base::s_info, 0, get${className}PrototypeTable, CREATE_METHOD_TABLE(${className}Prototype) };\n\n");
+        push(@implContent, "const ClassInfo ${className}Prototype::s_info = { \"${visibleInterfaceName}Prototype\", &Base::s_info, 0, get${className}PrototypeTable, CREATE_METHOD_TABLE(${className}Prototype) };\n\n");
     } else {
-        push(@implContent, "const ClassInfo ${className}Prototype::s_info = { \"${visibleClassName}Prototype\", &Base::s_info, &${className}PrototypeTable, 0, CREATE_METHOD_TABLE(${className}Prototype) };\n\n");
+        push(@implContent, "const ClassInfo ${className}Prototype::s_info = { \"${visibleInterfaceName}Prototype\", &Base::s_info, &${className}PrototypeTable, 0, CREATE_METHOD_TABLE(${className}Prototype) };\n\n");
     }
     if ($interfaceName ne "DOMWindow" && !$dataNode->extendedAttributes->{"IsWorkerContext"}) {
         push(@implContent, "JSObject* ${className}Prototype::self(ExecState* exec, JSGlobalObject* globalObject)\n");
@@ -1517,7 +1507,7 @@ sub GenerateImplementation
         push(@implContent, "}\n\n");
     }
 
-    if ($dataNode->extendedAttributes->{"JSCustomPrototypePutDelegate"}) {
+    if ($dataNode->extendedAttributes->{"JSCustomNamedGetterOnPrototype"}) {
         push(@implContent, "void ${className}Prototype::put(JSCell* cell, ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)\n");
         push(@implContent, "{\n");
         push(@implContent, "    ${className}Prototype* thisObject = jsCast<${className}Prototype*>(cell);\n");
@@ -1535,7 +1525,7 @@ sub GenerateImplementation
         push(@implContent, "}\n\n");
     }
 
-    push(@implContent, "const ClassInfo $className" . "::s_info = { \"${visibleClassName}\", &Base::s_info, ");
+    push(@implContent, "const ClassInfo $className" . "::s_info = { \"${visibleInterfaceName}\", &Base::s_info, ");
 
     if ($numAttributes > 0 && !$dataNode->extendedAttributes->{"JSNoStaticTables"}) {
         push(@implContent, "&${className}Table");
@@ -1615,7 +1605,14 @@ sub GenerateImplementation
         push(@implContent, "void ${className}::destroy(JSC::JSCell* cell)\n");
         push(@implContent, "{\n");
         push(@implContent, "    ${className}* thisObject = jsCast<${className}*>(cell);\n");
-        push(@implContent, "    thisObject->releaseImplIfNotNull();\n");
+        push(@implContent, "    thisObject->${className}::~${className}();\n");
+        push(@implContent, "}\n\n");
+
+        # We also need a destructor for the allocateCell to work properly with the destructor-free part of the heap.
+        # Otherwise, these destroy functions/destructors won't get called.
+        push(@implContent, "${className}::~${className}()\n");
+        push(@implContent, "{\n");
+        push(@implContent, "    releaseImplIfNotNull();\n");
         push(@implContent, "}\n\n");
     }
 
@@ -1623,7 +1620,7 @@ sub GenerateImplementation
                  || !$dataNode->extendedAttributes->{"OmitConstructor"} 
                  || $dataNode->extendedAttributes->{"IndexedGetter"}
                  || $dataNode->extendedAttributes->{"NumericIndexedGetter"}
-                 || $dataNode->extendedAttributes->{"JSCustomGetOwnPropertySlotDelegate"}
+                 || $dataNode->extendedAttributes->{"JSCustomGetOwnPropertySlotAndDescriptor"}
                  || $dataNode->extendedAttributes->{"CustomGetOwnPropertySlot"}
                  || $dataNode->extendedAttributes->{"NamedGetter"}
                  || $dataNode->extendedAttributes->{"CustomNamedGetter"};
@@ -1681,16 +1678,16 @@ sub GenerateImplementation
                     $needsMarkChildren = 1;
                 }
 
-                if ($dataNode->extendedAttributes->{"CheckDomainSecurity"} && 
-                        !$attribute->signature->extendedAttributes->{"DoNotCheckDomainSecurity"} &&
-                        !$attribute->signature->extendedAttributes->{"DoNotCheckDomainSecurityOnGetter"}) {
+                if ($dataNode->extendedAttributes->{"CheckSecurity"} && 
+                        !$attribute->signature->extendedAttributes->{"DoNotCheckSecurity"} &&
+                        !$attribute->signature->extendedAttributes->{"DoNotCheckSecurityOnGetter"}) {
                     push(@implContent, "    if (!castedThis->allowsAccessFrom(exec))\n");
                     push(@implContent, "        return jsUndefined();\n");
                 }
 
                 if ($attribute->signature->extendedAttributes->{"Custom"} || $attribute->signature->extendedAttributes->{"JSCustom"} || $attribute->signature->extendedAttributes->{"CustomGetter"} || $attribute->signature->extendedAttributes->{"JSCustomGetter"}) {
                     push(@implContent, "    return castedThis->$implGetterFunctionName(exec);\n");
-                } elsif ($attribute->signature->extendedAttributes->{"CheckAccessToNode"}) {
+                } elsif ($attribute->signature->extendedAttributes->{"CheckSecurityForNode"}) {
                     $implIncludes{"JSDOMBinding.h"} = 1;
                     push(@implContent, "    $implClassName* impl = static_cast<$implClassName*>(castedThis->impl());\n");
                     push(@implContent, "    return shouldAllowAccessToNode(exec, impl->" . $attribute->signature->name . "()) ? " . NativeToJSValue($attribute->signature, 0, $implClassName, "impl->$implGetterFunctionName()", "castedThis") . " : jsUndefined();\n");
@@ -1716,10 +1713,7 @@ sub GenerateImplementation
                     # Once JSDOMWrappers have a back-pointer to the globalObject we can pass castedThis->globalObject()
                     push(@implContent, "    return JS" . $constructorType . "::getConstructor(exec, castedThis);\n");
                 } elsif (!@{$attribute->getterExceptions}) {
-                    my $callWith = $attribute->signature->extendedAttributes->{"CallWith"};
-                    my $callWithArg = "";
-
-                    push(@implContent, "    UNUSED_PARAM(exec);\n") if (!$callWith);
+                    push(@implContent, "    UNUSED_PARAM(exec);\n") if !$attribute->signature->extendedAttributes->{"CallWith"};
 
                     my $cacheIndex = 0;
                     if ($attribute->signature->extendedAttributes->{"CachedAttribute"}) {
@@ -1729,18 +1723,16 @@ sub GenerateImplementation
                         push(@implContent, "        return cachedValue;\n");
                     }
 
-                    if ($callWith) {
-                        $callWithArg = GenerateCallWith($callWith, \@implContent, "jsUndefined()");
-                    }
+                    my @callWithArgs = GenerateCallWith($attribute->signature->extendedAttributes->{"CallWith"}, \@implContent, "jsUndefined()");
 
                     if ($svgListPropertyType) {
-                        push(@implContent, "    JSValue result =  " . NativeToJSValue($attribute->signature, 0, $implClassName, "castedThis->impl()->$implGetterFunctionName($callWithArg)", "castedThis") . ";\n");
+                        push(@implContent, "    JSValue result =  " . NativeToJSValue($attribute->signature, 0, $implClassName, "castedThis->impl()->$implGetterFunctionName(" . (join ", ", @callWithArgs) . ")", "castedThis") . ";\n");
                     } elsif ($svgPropertyOrListPropertyType) {
                         push(@implContent, "    $svgPropertyOrListPropertyType& impl = castedThis->impl()->propertyReference();\n");
                         if ($svgPropertyOrListPropertyType eq "float") { # Special case for JSSVGNumber
                             push(@implContent, "    JSValue result =  " . NativeToJSValue($attribute->signature, 0, $implClassName, "impl", "castedThis") . ";\n");
                         } else {
-                            push(@implContent, "    JSValue result =  " . NativeToJSValue($attribute->signature, 0, $implClassName, "impl.$implGetterFunctionName($callWithArg)", "castedThis") . ";\n");
+                            push(@implContent, "    JSValue result =  " . NativeToJSValue($attribute->signature, 0, $implClassName, "impl.$implGetterFunctionName(" . (join ", ", @callWithArgs) . ")", "castedThis") . ";\n");
 
                         }
                     } else {
@@ -1754,9 +1746,7 @@ sub GenerateImplementation
                             $functionName = "impl->${functionName}";
                         }
 
-                        if ($callWith) {
-                            unshift(@arguments, $callWithArg);
-                        }
+                        unshift(@arguments, @callWithArgs);
 
                         my $jsType = NativeToJSValue($attribute->signature, 0, $implClassName, "${functionName}(" . join(", ", @arguments) . ")", "castedThis");
                         push(@implContent, "    $implClassName* impl = static_cast<$implClassName*>(castedThis->impl());\n");
@@ -1772,14 +1762,10 @@ sub GenerateImplementation
                     push(@implContent, "    return result;\n");
 
                 } else {
-                    my $callWith = $attribute->signature->extendedAttributes->{"CallWith"};
                     my @arguments = ("ec");
+                    push(@implContent, "    ExceptionCode ec = 0;\n");
 
-                    push(@implContent, "    ExceptionCode ec = 0;\n");                    
-
-                    if ($callWith) {
-                        unshift(@arguments, GenerateCallWith($callWith, \@implContent, "jsUndefined()"));
-                    }
+                    unshift(@arguments, GenerateCallWith($attribute->signature->extendedAttributes->{"CallWith"}, \@implContent, "jsUndefined()"));
 
                     if ($svgPropertyOrListPropertyType) {
                         push(@implContent, "    $svgPropertyOrListPropertyType impl(*castedThis->impl());\n");
@@ -1807,7 +1793,7 @@ sub GenerateImplementation
                 push(@implContent, "{\n");
                 push(@implContent, "    ${className}* domObject = static_cast<$className*>(asObject(slotBase));\n");
 
-                if ($dataNode->extendedAttributes->{"CheckDomainSecurity"}) {
+                if ($dataNode->extendedAttributes->{"CheckSecurity"}) {
                     push(@implContent, "    if (!domObject->allowsAccessFrom(exec))\n");
                     push(@implContent, "        return jsUndefined();\n");
                 }
@@ -1878,7 +1864,7 @@ sub GenerateImplementation
                         push(@implContent, "void ${putFunctionName}(ExecState* exec, JSObject* thisObject, JSValue value)\n");
                         push(@implContent, "{\n");
 
-                        if ($dataNode->extendedAttributes->{"CheckDomainSecurity"} && !$attribute->signature->extendedAttributes->{"DoNotCheckDomainSecurity"}) {
+                        if ($dataNode->extendedAttributes->{"CheckSecurity"} && !$attribute->signature->extendedAttributes->{"DoNotCheckSecurity"}) {
                             if ($interfaceName eq "DOMWindow") {
                                 push(@implContent, "    if (!static_cast<$className*>(thisObject)->allowsAccessFrom(exec))\n");
                             } else {
@@ -1983,10 +1969,7 @@ sub GenerateImplementation
                                     $functionName = "impl->${functionName}";
                                 }
 
-                                my $callWith = $attribute->signature->extendedAttributes->{"CallWith"};
-                                if ($callWith) {
-                                    unshift(@arguments, GenerateCallWith($callWith, \@implContent, ""));
-                                }
+                                unshift(@arguments, GenerateCallWith($attribute->signature->extendedAttributes->{"CallWith"}, \@implContent, ""));
 
                                 push(@arguments, "ec") if @{$attribute->setterExceptions};
                                 push(@implContent, "    ${functionName}(" . join(", ", @arguments) . ");\n");
@@ -2006,7 +1989,7 @@ sub GenerateImplementation
 
                 push(@implContent, "void ${constructorFunctionName}(ExecState* exec, JSObject* thisObject, JSValue value)\n");
                 push(@implContent, "{\n");
-                if ($dataNode->extendedAttributes->{"CheckDomainSecurity"}) {
+                if ($dataNode->extendedAttributes->{"CheckSecurity"}) {
                     if ($interfaceName eq "DOMWindow") {
                         push(@implContent, "    if (!static_cast<$className*>(thisObject)->allowsAccessFrom(exec))\n");
                     } else {
@@ -2027,7 +2010,7 @@ sub GenerateImplementation
         }
     }
 
-    if (($dataNode->extendedAttributes->{"IndexedGetter"} || $dataNode->extendedAttributes->{"NumericIndexedGetter"}) && !$dataNode->extendedAttributes->{"CustomGetPropertyNames"}) {
+    if (($dataNode->extendedAttributes->{"IndexedGetter"} || $dataNode->extendedAttributes->{"NumericIndexedGetter"}) && !$dataNode->extendedAttributes->{"CustomEnumerateProperty"}) {
         push(@implContent, "void ${className}::getOwnPropertyNames(JSObject* object, ExecState* exec, PropertyNameArray& propertyNames, EnumerationMode mode)\n");
         push(@implContent, "{\n");
         push(@implContent, "    ${className}* thisObject = jsCast<${className}*>(object);\n");
@@ -2097,8 +2080,8 @@ sub GenerateImplementation
 
             push(@implContent, "    ASSERT_GC_OBJECT_INHERITS(castedThis, &${className}::s_info);\n") unless ($function->isStatic);
 
-            if ($dataNode->extendedAttributes->{"CheckDomainSecurity"} and
-                !$function->signature->extendedAttributes->{"DoNotCheckDomainSecurity"} and
+            if ($dataNode->extendedAttributes->{"CheckSecurity"} and
+                !$function->signature->extendedAttributes->{"DoNotCheckSecurity"} and
                 !$function->isStatic) {
                 push(@implContent, "    if (!castedThis->allowsAccessFrom(exec))\n");
                 push(@implContent, "        return JSValue::encode(jsUndefined());\n");
@@ -2123,7 +2106,7 @@ sub GenerateImplementation
                     push(@implContent, "    ExceptionCode ec = 0;\n");
                 }
 
-                if ($function->signature->extendedAttributes->{"CheckAccessToNode"} and !$function->isStatic) {
+                if ($function->signature->extendedAttributes->{"CheckSecurityForNode"} and !$function->isStatic) {
                     push(@implContent, "    if (!shouldAllowAccessToNode(exec, impl->" . $function->signature->name . "(" . (@{$function->raisesExceptions} ? "ec" : "") .")))\n");
                     push(@implContent, "        return JSValue::encode(jsUndefined());\n");
                     $implIncludes{"JSDOMBinding.h"} = 1;
@@ -2149,7 +2132,9 @@ sub GenerateImplementation
 
             push(@implContent, "#endif\n\n") if $conditional;
         }
-        
+    }
+
+    if ($numFunctions > 0 || $numCachedAttributes > 0) {
         if ($needsMarkChildren && !$dataNode->extendedAttributes->{"JSCustomMarkFunction"}) {
             push(@implContent, "void ${className}::visitChildren(JSCell* cell, SlotVisitor& visitor)\n");
             push(@implContent, "{\n");
@@ -2172,12 +2157,13 @@ sub GenerateImplementation
             }
             push(@implContent, "}\n\n");
         }
-        # Cached attributes are indeed allowed when there is a custom mark/visitChildren function.
-        # The custom function must make sure to account for the cached attribute.
-        # Uncomment the below line to temporarily enforce generated mark functions when cached attributes are present.
-        # die "Can't generate binding for class with cached attribute and custom mark." if (($numCachedAttributes > 0) and ($dataNode->extendedAttributes->{"JSCustomMarkFunction"}));
     }
 
+    # Cached attributes are indeed allowed when there is a custom mark/visitChildren function.
+    # The custom function must make sure to account for the cached attribute.
+    # Uncomment the below line to temporarily enforce generated mark functions when cached attributes are present.
+    # die "Can't generate binding for class with cached attribute and custom mark." if (($numCachedAttributes > 0) and ($dataNode->extendedAttributes->{"JSCustomMarkFunction"}));
+
     if ($numConstants > 0) {
         push(@implContent, "// Constant getters\n\n");
 
@@ -2316,7 +2302,7 @@ sub GenerateImplementation
         push(@implContent, "}\n\n");
     }
 
-    if ((!$hasParent or $dataNode->extendedAttributes->{"JSGenerateToJS"}) and !$dataNode->extendedAttributes->{"JSCustomToJS"}) {
+    if ((!$hasParent or $dataNode->extendedAttributes->{"JSGenerateToJSObject"}) and !($dataNode->extendedAttributes->{"CustomToJSObject"} or $dataNode->extendedAttributes->{"JSCustomToJSObject"})) {
         push(@implContent, "JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, $implType* impl)\n");
         push(@implContent, "{\n");
         if ($svgPropertyType) {
@@ -2343,20 +2329,33 @@ sub GenerateImplementation
 sub GenerateCallWith
 {
     my $callWith = shift;
+    return () unless $callWith;
     my $outputArray = shift;
     my $returnValue = shift;
-    my $callWithArg = "COMPILE_ASSERT(false)";
+    my $function = shift;
 
-    if ($callWith eq "ScriptState") {
-        $callWithArg = "exec";
-    } elsif ($callWith eq "ScriptExecutionContext") {
+    my @callWithArgs;
+    if ($codeGenerator->ExtendedAttributeContains($callWith, "ScriptState")) {
+        push(@callWithArgs, "exec");
+    }
+    if ($codeGenerator->ExtendedAttributeContains($callWith, "ScriptExecutionContext")) {
         push(@$outputArray, "    ScriptExecutionContext* scriptContext = static_cast<JSDOMGlobalObject*>(exec->lexicalGlobalObject())->scriptExecutionContext();\n");
         push(@$outputArray, "    if (!scriptContext)\n");
         push(@$outputArray, "        return" . ($returnValue ? " " . $returnValue : "") . ";\n");
-        $callWithArg = "scriptContext";
+        push(@callWithArgs, "scriptContext");
     }
-
-    return $callWithArg;
+    if ($function and $codeGenerator->ExtendedAttributeContains($callWith, "ScriptArguments")) {
+        push(@$outputArray, "    RefPtr<ScriptArguments> scriptArguments(createScriptArguments(exec, " . @{$function->parameters} . "));\n");
+        $implIncludes{"ScriptArguments.h"} = 1;
+        push(@callWithArgs, "scriptArguments");
+    }
+    if ($codeGenerator->ExtendedAttributeContains($callWith, "CallStack")) {
+        push(@$outputArray, "    RefPtr<ScriptCallStack> callStack(createScriptCallStackForInspector(exec));\n");
+        $implIncludes{"ScriptCallStack.h"} = 1;
+        $implIncludes{"ScriptCallStackFactory.h"} = 1;
+        push(@callWithArgs, "callStack");
+    }
+    return @callWithArgs;
 }
 
 sub GenerateArgumentsCountCheck
@@ -2397,42 +2396,31 @@ sub GenerateParametersCheck
 
     my @arguments;
     my $functionName;
-    if ($function->isStatic) {
-        $functionName = "${implClassName}::${functionImplementationName}";
-    } elsif ($function->signature->extendedAttributes->{"ImplementedBy"}) {
-        my $implementedBy = $function->signature->extendedAttributes->{"ImplementedBy"};
+    my $implementedBy = $function->signature->extendedAttributes->{"ImplementedBy"};
+    if ($implementedBy) {
         AddToImplIncludes("${implementedBy}.h");
-        unshift(@arguments, "impl");
+        unshift(@arguments, "impl") if !$function->isStatic;
         $functionName = "${implementedBy}::${functionImplementationName}";
+    } elsif ($function->isStatic) {
+        $functionName = "${implClassName}::${functionImplementationName}";
     } elsif ($svgPropertyOrListPropertyType and !$svgListPropertyType) {
         $functionName = "podImpl.${functionImplementationName}";
     } else {
         $functionName = "impl->${functionImplementationName}";
     }
 
-    if ($function->signature->extendedAttributes->{"CustomArgumentHandling"} and !$function->isStatic) {
-        push(@$outputArray, "    RefPtr<ScriptArguments> scriptArguments(createScriptArguments(exec, $numParameters));\n");
-        push(@$outputArray, "    RefPtr<ScriptCallStack> callStack(createScriptCallStackForInspector(exec));\n");
-        $implIncludes{"ScriptArguments.h"} = 1;
-        $implIncludes{"ScriptCallStack.h"} = 1;
-        $implIncludes{"ScriptCallStackFactory.h"} = 1;
-    }
-
-    my $callWith = $function->signature->extendedAttributes->{"CallWith"};
-    if ($callWith and !$function->signature->extendedAttributes->{"Constructor"}) {
-        push(@arguments, GenerateCallWith($callWith, \@$outputArray, "JSValue::encode(jsUndefined())"));
+    if (!$function->signature->extendedAttributes->{"Constructor"}) {
+        push(@arguments, GenerateCallWith($function->signature->extendedAttributes->{"CallWith"}, \@$outputArray, "JSValue::encode(jsUndefined())", $function));
     }
 
     $implIncludes{"ExceptionCode.h"} = 1;
     $implIncludes{"JSDOMBinding.h"} = 1;
 
     foreach my $parameter (@{$function->parameters}) {
-        # Optional callbacks should be treated differently, because they always have a default value (0),
-        # and we can reduce the number of overloaded functions that take a different number of parameters.
-        # Optional arguments with [Optional=CallWithDefaultValue] or [Optional=CallWithNullValue]
-        # should not generate an early call.
+        # Optional arguments with [Optional] should generate an early call with fewer arguments.
+        # Optional arguments with [Optional=...] should not generate the early call.
         my $optional = $parameter->extendedAttributes->{"Optional"};
-        if ($optional && $optional ne "CallWithDefaultValue" && $optional ne "CallWithNullValue" && !$parameter->extendedAttributes->{"Callback"}) {
+        if ($optional && $optional ne "DefaultIsUndefined" && $optional ne "DefaultIsNullString" && !$parameter->extendedAttributes->{"Callback"}) {
             # Generate early call if there are enough parameters.
             if (!$hasOptionalArguments) {
                 push(@$outputArray, "\n    size_t argsCount = exec->argumentCount();\n");
@@ -2441,9 +2429,6 @@ sub GenerateParametersCheck
             push(@$outputArray, "    if (argsCount <= $argsIndex) {\n");
 
             my @optionalCallbackArguments = @arguments;
-            if ($function->signature->extendedAttributes->{"CustomArgumentHandling"}) {
-                push @optionalCallbackArguments, "scriptArguments, callStack";
-            }
             if (@{$function->raisesExceptions}) {
                 push @optionalCallbackArguments, "ec";
             }
@@ -2467,7 +2452,7 @@ sub GenerateParametersCheck
         } elsif ($parameter->extendedAttributes->{"Callback"}) {
             my $callbackClassName = GetCallbackClassName($argType);
             $implIncludes{"$callbackClassName.h"} = 1;
-            if ($parameter->extendedAttributes->{"Optional"}) {
+            if ($optional) {
                 push(@$outputArray, "    RefPtr<$argType> $name;\n");
                 push(@$outputArray, "    if (exec->argumentCount() > $argsIndex && !exec->argument($argsIndex).isUndefinedOrNull()) {\n");
                 push(@$outputArray, "        if (!exec->argument($argsIndex).isObject()) {\n");
@@ -2499,13 +2484,12 @@ sub GenerateParametersCheck
                 }
             }
 
-            my $optional = $parameter->extendedAttributes->{"Optional"};
-            my $parameterMissingPolicy = "MissingIsUndefined";
-            if ($optional && $optional eq "CallWithNullValue") {
-                $parameterMissingPolicy = "MissingIsEmpty";
+            my $parameterDefaultPolicy = "DefaultIsUndefined";
+            if ($optional and $optional eq "DefaultIsNullString") {
+                $parameterDefaultPolicy = "DefaultIsNullString";
             }
 
-            push(@$outputArray, "    " . GetNativeTypeFromSignature($parameter) . " $name(" . JSValueToNative($parameter, "MAYBE_MISSING_PARAMETER(exec, $argsIndex, $parameterMissingPolicy)") . ");\n");
+            push(@$outputArray, "    " . GetNativeTypeFromSignature($parameter) . " $name(" . JSValueToNative($parameter, "MAYBE_MISSING_PARAMETER(exec, $argsIndex, $parameterDefaultPolicy)") . ");\n");
 
             # If a parameter is "an index" and it's negative it should throw an INDEX_SIZE_ERR exception.
             # But this needs to be done in the bindings, because the type is unsigned and the fact that it
@@ -2539,9 +2523,6 @@ sub GenerateParametersCheck
         $argsIndex++;
     }
 
-    if ($function->signature->extendedAttributes->{"CustomArgumentHandling"}) {
-        push @arguments, "scriptArguments, callStack";
-    }
     if (@{$function->raisesExceptions}) {
         push @arguments, "ec";
     }
@@ -2732,8 +2713,7 @@ sub GenerateImplementationFunctionCall()
         push(@implContent, "\n" . $indent . "JSC::JSValue result = " . NativeToJSValue($function->signature, 1, $implClassName, $functionString, "castedThis") . ";\n");
         push(@implContent, $indent . "setDOMException(exec, ec);\n") if @{$function->raisesExceptions};
 
-        my $callWith = $function->signature->extendedAttributes->{"CallWith"};
-        if ($callWith and $callWith eq "ScriptState") {
+        if ($codeGenerator->ExtendedAttributeContains($function->signature->extendedAttributes->{"CallWith"}, "ScriptState")) {
             push(@implContent, $indent . "if (exec->hadException())\n");
             push(@implContent, $indent . "    return JSValue::encode(jsUndefined());\n");
         }
@@ -2774,7 +2754,8 @@ my %nativeType = (
     "long long" => "long long",
     "unsigned long long" => "unsigned long long",
     "MediaQueryListListener" => "RefPtr<MediaQueryListListener>",
-    "DOMTimeStamp" => "DOMTimeStamp"
+    "DOMTimeStamp" => "DOMTimeStamp",
+    "unsigned long[]" => "Vector<unsigned long>"
 );
 
 sub GetNativeType
@@ -2903,6 +2884,11 @@ sub JSValueToNative
         return "toDOMStringList($value)";
     }
 
+    if ($type eq "unsigned long[]") {
+        AddToImplIncludes("JSDOMBinding.h", $conditional);
+        return "jsUnsignedLongArrayToVector(exec, $value)";
+    }
+
     AddToImplIncludes("HTMLOptionElement.h", $conditional) if $type eq "HTMLOptionElement";
     AddToImplIncludes("JSCustomVoidCallback.h", $conditional) if $type eq "VoidCallback";
     AddToImplIncludes("Event.h", $conditional) if $type eq "Event";
@@ -2941,20 +2927,18 @@ sub NativeToJSValue
 
     if ($codeGenerator->IsStringType($type)) {
         AddToImplIncludes("KURL.h", $conditional);
-        my $conv = $signature->extendedAttributes->{"ConvertNullStringTo"};
+        my $conv = $signature->extendedAttributes->{"TreatReturnedNullStringAs"};
         if (defined $conv) {
             return "jsStringOrNull(exec, $value)" if $conv eq "Null";
             return "jsStringOrUndefined(exec, $value)" if $conv eq "Undefined";
             return "jsStringOrFalse(exec, $value)" if $conv eq "False";
 
-            die "Unknown value for ConvertNullStringTo extended attribute";
+            die "Unknown value for TreatReturnedNullStringAs extended attribute";
         }
-        $conv = $signature->extendedAttributes->{"ConvertScriptString"};
-        return "jsOwnedStringOrNull(exec, $value)" if $conv;
         AddToImplIncludes("<runtime/JSString.h>", $conditional);
         return "jsString(exec, $value)";
     }
-    
+
     my $globalObject = "$thisValue->globalObject()";
 
     if ($type eq "CSSStyleDeclaration") {
@@ -2979,6 +2963,8 @@ sub NativeToJSValue
     } elsif ($type eq "SerializedScriptValue" or $type eq "any") {
         AddToImplIncludes("SerializedScriptValue.h", $conditional);
         return "$value ? $value->deserialize(exec, castedThis->globalObject(), 0) : jsNull()";
+    } elsif ($type eq "unsigned long[]") {
+        AddToImplIncludes("<wrt/Vector.h>", $conditional);
     } else {
         # Default, include header with same name.
         AddToImplIncludes("JS$type.h", $conditional);
@@ -3298,7 +3284,6 @@ sub GenerateConstructorDeclaration
     my $interfaceName = shift;
 
     my $constructorClassName = "${className}Constructor";
-    my $callWith = $dataNode->extendedAttributes->{"CallWith"};
 
     push(@$outputArray, "class ${constructorClassName} : public DOMConstructorObject {\n");
     push(@$outputArray, "private:\n");
@@ -3374,23 +3359,28 @@ sub GenerateConstructorDefinition
     my $className = shift;
     my $protoClassName = shift;
     my $interfaceName = shift;
-    my $visibleClassName = shift;
+    my $visibleInterfaceName = shift;
     my $dataNode = shift;
     my $generatingNamedConstructor = shift;
 
     my $constructorClassName = $generatingNamedConstructor ? "${className}NamedConstructor" : "${className}Constructor";
-    my $numberOfconstructParameters = $dataNode->extendedAttributes->{"ConstructorParameters"};
+    my $numberOfConstructorParameters = $dataNode->extendedAttributes->{"ConstructorParameters"};
+    if (!defined $numberOfConstructorParameters) {
+        if (IsConstructorTemplate($dataNode, "Event")) {
+            $numberOfConstructorParameters = 2;
+        } elsif ($dataNode->extendedAttributes->{"Constructor"} and !$dataNode->extendedAttributes->{"CustomConstructor"} and !$dataNode->extendedAttributes->{"JSCustomConstructor"}) {
+            $numberOfConstructorParameters = @{$dataNode->constructor->parameters};
+        }
+    }
 
     if ($generatingNamedConstructor) {
-        push(@$outputArray, "const ClassInfo ${constructorClassName}::s_info = { \"${visibleClassName}Constructor\", &Base::s_info, 0, 0, CREATE_METHOD_TABLE($constructorClassName) };\n\n");
+        push(@$outputArray, "const ClassInfo ${constructorClassName}::s_info = { \"${visibleInterfaceName}Constructor\", &Base::s_info, 0, 0, CREATE_METHOD_TABLE($constructorClassName) };\n\n");
         push(@$outputArray, "${constructorClassName}::${constructorClassName}(Structure* structure, JSDOMGlobalObject* globalObject)\n");
         push(@$outputArray, "    : DOMConstructorWithDocument(structure, globalObject)\n");
         push(@$outputArray, "{\n");
         push(@$outputArray, "}\n\n");
     } else {
-        push(@$outputArray, "ASSERT_HAS_TRIVIAL_DESTRUCTOR(${constructorClassName});\n\n");
-
-        push(@$outputArray, "const ClassInfo ${constructorClassName}::s_info = { \"${visibleClassName}Constructor\", &Base::s_info, &${constructorClassName}Table, 0, CREATE_METHOD_TABLE($constructorClassName) };\n\n");
+        push(@$outputArray, "const ClassInfo ${constructorClassName}::s_info = { \"${visibleInterfaceName}Constructor\", &Base::s_info, &${constructorClassName}Table, 0, CREATE_METHOD_TABLE($constructorClassName) };\n\n");
         push(@$outputArray, "${constructorClassName}::${constructorClassName}(Structure* structure, JSDOMGlobalObject* globalObject)\n");
         push(@$outputArray, "    : DOMConstructorObject(structure, globalObject)\n");
         push(@$outputArray, "{\n");
@@ -3412,7 +3402,7 @@ sub GenerateConstructorDefinition
         push(@$outputArray, "    ASSERT(inherits(&s_info));\n");
         push(@$outputArray, "    putDirect(exec->globalData(), exec->propertyNames().prototype, ${protoClassName}::self(exec, globalObject), DontDelete | ReadOnly);\n");
     }
-    push(@$outputArray, "    putDirect(exec->globalData(), exec->propertyNames().length, jsNumber(${numberOfconstructParameters}), ReadOnly | DontDelete | DontEnum);\n") if $numberOfconstructParameters;
+    push(@$outputArray, "    putDirect(exec->globalData(), exec->propertyNames().length, jsNumber(${numberOfConstructorParameters}), ReadOnly | DontDelete | DontEnum);\n") if defined $numberOfConstructorParameters;
     push(@$outputArray, "}\n\n");
 
     if (!$generatingNamedConstructor) {
@@ -3526,7 +3516,7 @@ END
             my $numParameters = @{$function->parameters};
             my ($dummy, $paramIndex) = GenerateParametersCheck($outputArray, $function, $dataNode, $numParameters, $interfaceName, "constructorCallback", undef, undef, undef);
 
-            if ($dataNode->extendedAttributes->{"CallWith"} && $dataNode->extendedAttributes->{"CallWith"} eq "ScriptExecutionContext") {
+            if ($codeGenerator->ExtendedAttributeContains($dataNode->extendedAttributes->{"CallWith"}, "ScriptExecutionContext")) {
                 push(@constructorArgList, "context");
                 push(@$outputArray, "    ScriptExecutionContext* context = jsConstructor->scriptExecutionContext();\n");
                 push(@$outputArray, "    if (!context)\n");
diff --git a/Source/WebCore/bindings/scripts/CodeGeneratorObjC.pm b/Source/WebCore/bindings/scripts/CodeGeneratorObjC.pm
index 5a63fc33b..3978481bc 100644
--- a/Source/WebCore/bindings/scripts/CodeGeneratorObjC.pm
+++ b/Source/WebCore/bindings/scripts/CodeGeneratorObjC.pm
@@ -1495,7 +1495,7 @@ sub GenerateImplementation
                 $needsCustom{"NodeFilter"} = $paramName if $idlType eq "NodeFilter";
                 $needsCustom{"EventListener"} = $paramName if $idlType eq "EventListener";
                 $needsCustom{"EventTarget"} = $paramName if $idlType eq "EventTarget";
-                $needsCustom{"NodeToReturn"} = $paramName if $param->extendedAttributes->{"Return"};
+                $needsCustom{"NodeToReturn"} = $paramName if $param->extendedAttributes->{"CustomReturn"};
 
                 unless ($codeGenerator->IsPrimitiveType($idlType) or $codeGenerator->IsStringType($idlType)) {
                     push(@needsAssert, "    ASSERT($paramName);\n");
diff --git a/Source/WebCore/bindings/scripts/CodeGeneratorV8.pm b/Source/WebCore/bindings/scripts/CodeGeneratorV8.pm
index 10015ad3e..8c46f8c42 100644
--- a/Source/WebCore/bindings/scripts/CodeGeneratorV8.pm
+++ b/Source/WebCore/bindings/scripts/CodeGeneratorV8.pm
@@ -3,7 +3,7 @@
 # Copyright (C) 2006 Samuel Weinig <sam.weinig@gmail.com>
 # Copyright (C) 2006 Alexey Proskuryakov <ap@webkit.org>
 # Copyright (C) 2006 Apple Computer, Inc.
-# Copyright (C) 2007-2012 Google Inc.
+# Copyright (C) 2007, 2008, 2009 Google Inc.
 # Copyright (C) 2009 Cameron McCormack <cam@mcc.id.au>
 # Copyright (C) Research In Motion Limited 2010. All rights reserved.
 # Copyright (C) 2010 Nokia Corporation and/or its subsidiary(-ies)
@@ -32,7 +32,7 @@ use Digest::MD5;
 
 use constant FileNamePrefix => "V8";
 
-my ($codeGenerator);
+my $codeGenerator;
 
 my $module = "";
 my $outputDir = "";
@@ -407,7 +407,7 @@ END
     GenerateHeaderCustomCall($dataNode);
     GenerateHeaderCustomInternalFieldIndices($dataNode);
 
-    if ($dataNode->extendedAttributes->{"CheckDomainSecurity"}) {
+    if ($dataNode->extendedAttributes->{"CheckSecurity"}) {
         push(@headerContent, <<END);
     static bool namedSecurityCheck(v8::Local<v8::Object> host, v8::Local<v8::Value> key, v8::AccessType, v8::Local<v8::Value> data);
     static bool indexedSecurityCheck(v8::Local<v8::Object> host, uint32_t index, v8::AccessType, v8::Local<v8::Value> data);
@@ -427,7 +427,7 @@ END
 ALWAYS_INLINE v8::Handle<v8::Object> ${className}::existingWrapper(${nativeType}* impl)
 {
 END
-    my $getWrapper = IsNodeSubType($dataNode) ? "V8DOMWrapper::getWrapper(impl)" : "${domMapFunction}.get(impl)";
+    my $getWrapper = IsNodeSubType($dataNode) ? "V8DOMWrapper::getExistingWrapper(impl)" : "${domMapFunction}.get(impl)";
     push(@headerContent, <<END);
     return ${getWrapper};
 }
@@ -447,7 +447,7 @@ END
 }
 END
 
-    if (!HasCustomToV8Implementation($dataNode, $interfaceName)) {
+    if (!($dataNode->extendedAttributes->{"CustomToJSObject"} or $dataNode->extendedAttributes->{"V8CustomToJSObject"})) {
         push(@headerContent, <<END);
 
 inline v8::Handle<v8::Value> toV8(${nativeType}* impl${forceNewObjectParameter})
@@ -469,14 +469,11 @@ v8::Handle<v8::Value> toV8Slow(Node*, bool);
 
 inline v8::Handle<v8::Value> toV8(Node* impl, bool forceNewObject = false)
 {
-    if (!impl)
+    if (UNLIKELY(!impl))
         return v8::Null();
-    if (!forceNewObject) {
-        v8::Handle<v8::Value> wrapper = V8DOMWrapper::getWrapper(impl);
-        if (!wrapper.IsEmpty())
-            return wrapper;
-    }
-    return toV8Slow(impl, forceNewObject);
+    if (UNLIKELY(forceNewObject))
+        return toV8Slow(impl, forceNewObject);
+    return V8DOMWrapper::getWrapper(impl);
 }
 END
     }
@@ -568,7 +565,7 @@ sub GenerateHeaderNamedAndIndexedPropertyAccessors
     my $hasCustomNamedGetter = $dataNode->extendedAttributes->{"NamedGetter"} || $dataNode->extendedAttributes->{"CustomNamedGetter"} || $dataNode->extendedAttributes->{"CustomGetOwnPropertySlot"};
     my $hasCustomNamedSetter = $dataNode->extendedAttributes->{"CustomNamedSetter"};
     my $hasCustomDeleters = $dataNode->extendedAttributes->{"CustomDeleteProperty"};
-    my $hasCustomEnumerator = $dataNode->extendedAttributes->{"CustomGetPropertyNames"};
+    my $hasCustomEnumerator = $dataNode->extendedAttributes->{"CustomEnumerateProperty"};
     if ($interfaceName eq "HTMLOptionsCollection") {
         $interfaceName = "HTMLCollection";
         $hasCustomIndexedGetter = 1;
@@ -678,7 +675,7 @@ sub IsNodeSubType
 sub IsVisibleAcrossOrigins
 {
     my $dataNode = shift;
-    return $dataNode->extendedAttributes->{"CheckDomainSecurity"} && !($dataNode->name eq "DOMWindow");
+    return $dataNode->extendedAttributes->{"CheckSecurity"} && !($dataNode->name eq "DOMWindow");
 }
 
 sub IsConstructable
@@ -831,7 +828,7 @@ END
         my $url = $attribute->signature->extendedAttributes->{"URL"};
         if ($getterStringUsesImp && $reflect && !$url && IsNodeSubType($dataNode) && $codeGenerator->IsStringType($attrType)) {
             # Generate super-compact call for regular attribute getter:
-            my $contentAttributeName = $reflect eq "1" ? lc $attrName : $reflect;
+            my $contentAttributeName = $reflect eq "VALUE_IS_MISSING" ? lc $attrName : $reflect;
             my $namespace = $codeGenerator->NamespaceForAttributeName($interfaceName, $contentAttributeName);
             AddToImplIncludes("${namespace}.h");
             push(@implContentDecls, "    return getElementStringAttr(info, ${namespace}::${contentAttributeName}Attr);\n");
@@ -854,7 +851,7 @@ END
     }
 
     # Generate security checks if necessary
-    if ($attribute->signature->extendedAttributes->{"CheckAccessToNode"}) {
+    if ($attribute->signature->extendedAttributes->{"CheckSecurityForNode"}) {
         push(@implContentDecls, "    if (!V8BindingSecurity::shouldAllowAccessToNode(V8BindingState::Only(), imp->" . $attribute->signature->name . "()))\n    return v8::Handle<v8::Value>();\n\n");
     }
 
@@ -866,14 +863,11 @@ END
 
     my $returnType = GetTypeFromSignature($attribute->signature);
     my $getterString;
-    my $callWith = $attribute->signature->extendedAttributes->{"CallWith"} || "";
 
     if ($getterStringUsesImp) {
         my ($functionName, @arguments) = $codeGenerator->GetterExpression(\%implIncludes, $interfaceName, $attribute);
 
-        if ($callWith) {
-            push(@arguments, GenerateCallWith($callWith, \@implContentDecls, "    ", 0, 0));
-        }
+        push(@arguments, GenerateCallWith($attribute->signature->extendedAttributes->{"CallWith"}, \@implContentDecls, "    ", 0, 0));
 
         push(@arguments, "ec") if $useExceptions;
         if ($attribute->signature->extendedAttributes->{"ImplementedBy"}) {
@@ -905,7 +899,7 @@ END
         }
         push(@implContentDecls, GenerateSetDOMException("    "));
 
-        if ($callWith eq "ScriptState") {
+        if ($codeGenerator->ExtendedAttributeContains($attribute->signature->extendedAttributes->{"CallWith"}, "ScriptState")) {
             push(@implContentDecls, "    if (state.hadException())\n");
             push(@implContentDecls, "        return throwError(state.exception());\n");
         }
@@ -922,7 +916,7 @@ END
     # Special case for readonly or Replaceable attributes (with a few exceptions). This attempts to ensure that JS wrappers don't get
     # garbage-collected prematurely when their lifetime is strongly tied to their owner. We accomplish this by inserting a reference to
     # the newly created wrapper into an internal field of the holder object.
-    if ($attrName ne "self" && (IsWrapperType($returnType) && ($attribute->type =~ /^readonly/ || $attribute->signature->extendedAttributes->{"Replaceable"})
+    if (!IsNodeSubType($dataNode) && $attrName ne "self" && (IsWrapperType($returnType) && ($attribute->type =~ /^readonly/ || $attribute->signature->extendedAttributes->{"Replaceable"})
         && $returnType ne "EventTarget" && $returnType ne "SerializedScriptValue" && $returnType ne "DOMWindow" 
         && $returnType !~ /SVG/ && $returnType !~ /HTML/ && !IsDOMNodeType($returnType))) {
         AddIncludesForType($returnType);
@@ -1075,7 +1069,7 @@ END
         my $reflect = $attribute->signature->extendedAttributes->{"Reflect"};
         if ($reflect && IsNodeSubType($dataNode) && $codeGenerator->IsStringType($attrType)) {
             # Generate super-compact call for regular attribute setter:
-            my $contentAttributeName = $reflect eq "1" ? lc $attrName : $reflect;
+            my $contentAttributeName = $reflect eq "VALUE_IS_MISSING" ? lc $attrName : $reflect;
             my $namespace = $codeGenerator->NamespaceForAttributeName($interfaceName, $contentAttributeName);
             AddToImplIncludes("${namespace}.h");
             push(@implContentDecls, "    setElementStringAttr(info, ${namespace}::${contentAttributeName}Attr, value);\n");
@@ -1118,8 +1112,6 @@ END
         push(@implContentDecls, "    ExceptionCode ec = 0;\n");
     }
 
-    my $callWith = $attribute->signature->extendedAttributes->{"CallWith"} || "";
-
     if ($implClassName eq "SVGNumber") {
         push(@implContentDecls, "    *imp = $result;\n");
     } else {
@@ -1145,9 +1137,7 @@ END
         } else {
             my ($functionName, @arguments) = $codeGenerator->SetterExpression(\%implIncludes, $interfaceName, $attribute);
 
-            if ($callWith) {
-                push(@arguments, GenerateCallWith($callWith, \@implContentDecls, "    ", 1, 0));
-            }
+            push(@arguments, GenerateCallWith($attribute->signature->extendedAttributes->{"CallWith"}, \@implContentDecls, "    ", 1, 0));
 
             push(@arguments, $result);
             push(@arguments, "ec") if $useExceptions;
@@ -1168,7 +1158,7 @@ END
         push(@implContentDecls, "        V8Proxy::setDOMException(ec);\n");
     }
 
-    if ($callWith eq "ScriptState") {
+    if ($codeGenerator->ExtendedAttributeContains($attribute->signature->extendedAttributes->{"CallWith"}, "ScriptState")) {
         push(@implContentDecls, "    if (state.hadException())\n");
         push(@implContentDecls, "        throwError(state.exception());\n");
     }
@@ -1371,8 +1361,6 @@ static v8::Handle<v8::Value> ${name}Callback(const v8::Arguments& args)
     INC_STATS(\"DOM.$implClassName.$name\");
 END
 
-    my $numParameters = @{$function->parameters};
-
     push(@implContentDecls, GenerateArgumentsCountCheck($function, $dataNode));
 
     my ($svgPropertyType, $svgListPropertyType, $svgNativeType) = GetSVGPropertyTypes($implClassName);
@@ -1399,9 +1387,9 @@ END
     }
 
     # Check domain security if needed
-    if (($dataNode->extendedAttributes->{"CheckDomainSecurity"}
+    if (($dataNode->extendedAttributes->{"CheckSecurity"}
        || $interfaceName eq "DOMWindow")
-       && !$function->signature->extendedAttributes->{"DoNotCheckDomainSecurity"}) {
+       && !$function->signature->extendedAttributes->{"DoNotCheckSecurity"}) {
     # We have not find real use cases yet.
     push(@implContentDecls, <<END);
     if (!V8BindingSecurity::canAccessFrame(V8BindingState::Only(), imp->frame(), true))
@@ -1427,18 +1415,7 @@ END
         # right before the label 'fail:'.
     }
 
-    if ($function->signature->extendedAttributes->{"CustomArgumentHandling"}) {
-        push(@implContentDecls, <<END);
-    RefPtr<ScriptArguments> scriptArguments(createScriptArguments(args, $numParameters));
-    RefPtr<ScriptCallStack> callStack(createScriptCallStackForInspector());
-    if (!callStack)
-        return v8::Undefined();
-END
-        AddToImplIncludes("ScriptArguments.h");
-        AddToImplIncludes("ScriptCallStack.h");
-        AddToImplIncludes("ScriptCallStackFactory.h");
-    }
-    if ($function->signature->extendedAttributes->{"CheckAccessToNode"}) {
+    if ($function->signature->extendedAttributes->{"CheckSecurityForNode"}) {
         push(@implContentDecls, "    if (!V8BindingSecurity::shouldAllowAccessToNode(V8BindingState::Only(), imp->" . $function->signature->name . "(ec)))\n");
         push(@implContentDecls, "        return v8::Handle<v8::Value>();\n");
 END
@@ -1464,30 +1441,45 @@ END
 sub GenerateCallWith
 {
     my $callWith = shift;
+    return () unless $callWith;
     my $outputArray = shift;
     my $indent = shift;
     my $returnVoid = shift;
     my $emptyContext = shift;
-    my $callWithArg = "COMPILE_ASSERT(false)";
+    my $function = shift;
 
-    if ($callWith eq "ScriptState") {
+    my @callWithArgs;
+    if ($codeGenerator->ExtendedAttributeContains($callWith, "ScriptState")) {
         if ($emptyContext) {
             push(@$outputArray, $indent . "EmptyScriptState state;\n");
-            $callWithArg = "&state";
+            push(@callWithArgs, "&state");
         } else {
             push(@$outputArray, $indent . "ScriptState* state = ScriptState::current();\n");
             push(@$outputArray, $indent . "if (!state)\n");
             push(@$outputArray, $indent . "    return" . ($returnVoid ? "" : " v8::Undefined()") . ";\n");
-            $callWithArg = "state";
+            push(@callWithArgs, "state");
         }
-    } elsif ($callWith eq "ScriptExecutionContext") {
+    }
+    if ($codeGenerator->ExtendedAttributeContains($callWith, "ScriptExecutionContext")) {
         push(@$outputArray, $indent . "ScriptExecutionContext* scriptContext = getScriptExecutionContext();\n");
         push(@$outputArray, $indent . "if (!scriptContext)\n");
         push(@$outputArray, $indent . "    return" . ($returnVoid ? "" : " v8::Undefined()") . ";\n");
-        $callWithArg = "scriptContext";
+        push(@callWithArgs, "scriptContext");
     }
-
-    return $callWithArg;
+    if ($function and $codeGenerator->ExtendedAttributeContains($callWith, "ScriptArguments")) {
+        push(@$outputArray, $indent . "RefPtr<ScriptArguments> scriptArguments(createScriptArguments(args, " . @{$function->parameters} . "));\n");
+        push(@callWithArgs, "scriptArguments");
+        AddToImplIncludes("ScriptArguments.h");
+    }
+    if ($codeGenerator->ExtendedAttributeContains($callWith, "CallStack")) {
+        push(@$outputArray, $indent . "RefPtr<ScriptCallStack> callStack(createScriptCallStackForInspector());\n");
+        push(@$outputArray, $indent . "if (!callStack)\n");
+        push(@$outputArray, $indent . "    return v8::Undefined();\n");
+        push(@callWithArgs, "callStack");
+        AddToImplIncludes("ScriptCallStack.h");
+        AddToImplIncludes("ScriptCallStackFactory.h");
+    }
+    return @callWithArgs;
 }
 
 sub GenerateArgumentsCountCheck
@@ -1526,21 +1518,19 @@ sub GenerateParametersCheck
 
         my $parameterName = $parameter->name;
 
-        # Optional callbacks should be treated differently, because they always have a default value (0),
-        # and we can reduce the number of overloaded functions that take a different number of parameters.
-        # Optional arguments with default values [Optional=CallWithDefaultValue] or [Optional=CallWithNullValue] should not generate an early call.
-        my $optional = $parameter->extendedAttributes->{"Optional"};        
-        if ($optional && $optional ne "CallWithDefaultValue" && $optional ne "CallWithNullValue" && !$parameter->extendedAttributes->{"Callback"}) {
-            # Generate early call if there are not enough parameters.
+        # Optional arguments with [Optional] should generate an early call with fewer arguments.
+        # Optional arguments with [Optional=...] should not generate the early call.
+        my $optional = $parameter->extendedAttributes->{"Optional"};
+        if ($optional && $optional ne "DefaultIsUndefined" && $optional ne "DefaultIsNullString" && !$parameter->extendedAttributes->{"Callback"}) {
             $parameterCheckString .= "    if (args.Length() <= $paramIndex) {\n";
             my $functionCall = GenerateFunctionCallString($function, $paramIndex, "    " x 2, $implClassName);
             $parameterCheckString .= $functionCall;
             $parameterCheckString .= "    }\n";
         }
 
-        my $parameterMissingPolicy = "MissingIsUndefined";
-        if ($optional && $optional eq "CallWithNullValue") {
-            $parameterMissingPolicy = "MissingIsEmpty";
+        my $parameterDefaultPolicy = "DefaultIsUndefined";
+        if ($optional and $optional eq "DefaultIsNullString") {
+            $parameterDefaultPolicy = "DefaultIsNullString";
         }
 
         AddToImplIncludes("ExceptionCode.h");
@@ -1548,7 +1538,7 @@ sub GenerateParametersCheck
         if ($parameter->extendedAttributes->{"Callback"}) {
             my $className = GetCallbackClassName($parameter->type);
             AddToImplIncludes("$className.h");
-            if ($parameter->extendedAttributes->{"Optional"}) {
+            if ($optional) {
                 $parameterCheckString .= "    RefPtr<" . $parameter->type . "> $parameterName;\n";
                 $parameterCheckString .= "    if (args.Length() > $paramIndex && !args[$paramIndex]->IsNull() && !args[$paramIndex]->IsUndefined()) {\n";
                 $parameterCheckString .= "        if (!args[$paramIndex]->IsObject())\n";
@@ -1574,7 +1564,7 @@ sub GenerateParametersCheck
             $parameterCheckString .= "        goto fail;\n";
             $parameterCheckString .= "    }\n";
         } elsif ($nativeType =~ /^V8Parameter/) {
-            my $value = JSValueToNative($parameter, "MAYBE_MISSING_PARAMETER(args, $paramIndex, $parameterMissingPolicy)");
+            my $value = JSValueToNative($parameter, "MAYBE_MISSING_PARAMETER(args, $paramIndex, $parameterDefaultPolicy)");
             $parameterCheckString .= "    " . ConvertToV8Parameter($parameter, $nativeType, $parameterName, $value) . "\n";
         } else {
             AddToImplIncludes("V8BindingMacros.h");
@@ -1595,7 +1585,7 @@ sub GenerateParametersCheck
                 }
             }
             $parameterCheckString .= "    EXCEPTION_BLOCK($nativeType, $parameterName, " .
-                 JSValueToNative($parameter, "MAYBE_MISSING_PARAMETER(args, $paramIndex, $parameterMissingPolicy)") . ");\n";
+                 JSValueToNative($parameter, "MAYBE_MISSING_PARAMETER(args, $paramIndex, $parameterDefaultPolicy)") . ");\n";
             if ($nativeType eq 'OptionsObject') {
                $parameterCheckString .= "    if (args.Length() > $paramIndex && !$parameterName.isUndefinedOrNull() && !$parameterName.isObject()) {\n";
                $parameterCheckString .= "        ec = TYPE_MISMATCH_ERR;\n";
@@ -1692,7 +1682,13 @@ END
         push(@implContent, "        goto fail;\n");
     }
 
-    my $DOMObject = $dataNode->extendedAttributes->{"ActiveDOMObject"} ? "ActiveDOMObject" : "DOMObject";
+    my $DOMObject = "DOMObject";
+    if (IsNodeSubType($dataNode)) {
+        $DOMObject = "DOMNode";
+    } elsif ($dataNode->extendedAttributes->{"ActiveDOMObject"}) {
+        $DOMObject = "ActiveDOMObject";
+    }
+
     push(@implContent, <<END);
 
     V8DOMWrapper::setDOMWrapper(wrapper, &info, impl.get());
@@ -1933,11 +1929,11 @@ sub GenerateSingleBatchedAttribute
     my $attrExt = $attribute->signature->extendedAttributes;
 
     my $accessControl = "v8::DEFAULT";
-    if ($attrExt->{"DoNotCheckDomainSecurityOnGetter"}) {
+    if ($attrExt->{"DoNotCheckSecurityOnGetter"}) {
         $accessControl = "v8::ALL_CAN_READ";
-    } elsif ($attrExt->{"DoNotCheckDomainSecurityOnSetter"}) {
+    } elsif ($attrExt->{"DoNotCheckSecurityOnSetter"}) {
         $accessControl = "v8::ALL_CAN_WRITE";
-    } elsif ($attrExt->{"DoNotCheckDomainSecurity"}) {
+    } elsif ($attrExt->{"DoNotCheckSecurity"}) {
         $accessControl = "v8::ALL_CAN_READ";
         if (!($attribute->type =~ /^readonly/) && !($attrExt->{"V8ReadOnly"})) {
             $accessControl .= " | v8::ALL_CAN_WRITE";
@@ -1956,7 +1952,7 @@ sub GenerateSingleBatchedAttribute
         $attrExt->{"V8CustomSetter"} ||
         $attrExt->{"V8CustomGetter"} ||
         "";
-    if ($customAccessor eq 1) {
+    if ($customAccessor eq "VALUE_IS_MISSING") {
         # use the naming convension, interface + (capitalize) attr name
         $customAccessor = $interfaceName . "::" . $attrName;
     }
@@ -2086,7 +2082,7 @@ sub GenerateImplementationIndexer
 
     if ($indexerType && !$hasCustomSetter) {
         if ($indexerType eq "DOMString") {
-            my $conversion = $indexer->extendedAttributes->{"ConvertNullStringTo"};
+            my $conversion = $indexer->extendedAttributes->{"TreatReturnedNullStringAs"};
             if ($conversion && $conversion eq "Null") {
                 push(@implContent, <<END);
     setCollectionStringOrNullIndexedGetter<${interfaceName}>(desc);
@@ -2170,7 +2166,7 @@ END
 
     my $hasCustomNamedSetter = $dataNode->extendedAttributes->{"CustomNamedSetter"};
     my $hasDeleter = $dataNode->extendedAttributes->{"CustomDeleteProperty"};
-    my $hasEnumerator = $dataNode->extendedAttributes->{"CustomGetPropertyNames"};
+    my $hasEnumerator = $dataNode->extendedAttributes->{"CustomEnumerateProperty"};
     my $setOn = "Instance";
 
     # V8 has access-check callback API (see ObjectTemplate::SetAccessCheckCallbacks) and it's used on DOMWindow
@@ -2228,7 +2224,7 @@ sub GenerateImplementation
     my $object = shift;
     my $dataNode = shift;
     my $interfaceName = $dataNode->name;
-    my $visibleInterfaceName = GetVisibleInterfaceName($interfaceName);
+    my $visibleInterfaceName = $codeGenerator->GetVisibleInterfaceName($dataNode);
     my $className = "V8$interfaceName";
     my $implClassName = $interfaceName;
 
@@ -2337,7 +2333,7 @@ sub GenerateImplementation
         # If the function does not need domain security check, we need to
         # generate an access getter that returns different function objects
         # for different calling context.
-        if (($dataNode->extendedAttributes->{"CheckDomainSecurity"} || ($interfaceName eq "DOMWindow")) && $function->signature->extendedAttributes->{"DoNotCheckDomainSecurity"}) {
+        if (($dataNode->extendedAttributes->{"CheckSecurity"} || ($interfaceName eq "DOMWindow")) && $function->signature->extendedAttributes->{"DoNotCheckSecurity"}) {
             if (!$isCustom || $function->{overloadIndex} == 1) {
                 GenerateDomainSafeFunctionGetter($function, $implClassName);
             }
@@ -2388,7 +2384,7 @@ sub GenerateImplementation
 
         my $attrExt = $function->signature->extendedAttributes;
         # Don't put any nonstandard functions into this table:
-        if ($attrExt->{"V8OnInstance"}) {
+        if ($attrExt->{"V8Unforgeable"}) {
             next;
         }
         if ($function->isStatic) {
@@ -2397,8 +2393,8 @@ sub GenerateImplementation
         if ($attrExt->{"V8EnabledAtRuntime"} || RequiresCustomSignature($function) || $attrExt->{"V8DoNotCheckSignature"}) {
             next;
         }
-        if ($attrExt->{"DoNotCheckDomainSecurity"} &&
-            ($dataNode->extendedAttributes->{"CheckDomainSecurity"} || $interfaceName eq "DOMWindow")) {
+        if ($attrExt->{"DoNotCheckSecurity"} &&
+            ($dataNode->extendedAttributes->{"CheckSecurity"} || $interfaceName eq "DOMWindow")) {
             next;
         }
         if ($attrExt->{"NotEnumerable"} || $attrExt->{"V8ReadOnly"}) {
@@ -2432,6 +2428,10 @@ END
         my $value = $constant->value;
         my $attrExt = $constant->extendedAttributes;
         my $conditional = $attrExt->{"Conditional"};
+        my $implementedBy = $attrExt->{"ImplementedBy"};
+        if ($implementedBy) {
+            AddToImplIncludes("${implementedBy}.h");
+        }
         if ($attrExt->{"V8EnabledAtRuntime"}) {
             push(@constantsEnabledAtRuntime, $constant);
         } else {
@@ -2464,7 +2464,7 @@ END
     }
 
     my $access_check = "";
-    if ($dataNode->extendedAttributes->{"CheckDomainSecurity"} && !($interfaceName eq "DOMWindow")) {
+    if ($dataNode->extendedAttributes->{"CheckSecurity"} && !($interfaceName eq "DOMWindow")) {
         $access_check = "instance->SetAccessCheckCallbacks(V8${interfaceName}::namedSecurityCheck, V8${interfaceName}::indexedSecurityCheck, v8::External::Wrap(&V8${interfaceName}::info));";
     }
 
@@ -2607,7 +2607,7 @@ END
         my $commentInfo = "Function '$name' (ExtAttr: '" . join(' ', keys(%{$attrExt})) . "')";
 
         my $template = "proto";
-        if ($attrExt->{"V8OnInstance"}) {
+        if ($attrExt->{"V8Unforgeable"}) {
             $template = "instance";
         }
         if ($function->isStatic) {
@@ -2621,8 +2621,8 @@ END
             $conditional = "if (${enable_function}())\n        ";
         }
 
-        if ($attrExt->{"DoNotCheckDomainSecurity"} &&
-            ($dataNode->extendedAttributes->{"CheckDomainSecurity"} || $interfaceName eq "DOMWindow")) {
+        if ($attrExt->{"DoNotCheckSecurity"} &&
+            ($dataNode->extendedAttributes->{"CheckSecurity"} || $interfaceName eq "DOMWindow")) {
             # Mark the accessor as ReadOnly and set it on the proto object so
             # it can be shadowed. This is really a hack to make it work.
             # There are several sceneria to call into the accessor:
@@ -3049,7 +3049,7 @@ END
 
     # FIXME: We need a better way of recovering the correct prototype chain
     # for every sort of object. For now, we special-case cross-origin visible
-    # objects (i.e., those with CheckDomainSecurity).
+    # objects (i.e., those with CheckSecurity).
     if (IsVisibleAcrossOrigins($dataNode)) {
         push(@implContent, <<END);
     if (impl->frame()) {
@@ -3111,40 +3111,6 @@ END
 END
 }
 
-sub HasCustomToV8Implementation {
-    # FIXME: This subroutine is lame. Probably should be an .idl attribute (CustomToV8)?
-    my $dataNode = shift;
-    my $interfaceName = shift;
-
-    # We generate a custom converter (but JSC doesn't) for the following:
-    return 1 if $interfaceName eq "CSSStyleSheet";
-    return 1 if $interfaceName eq "CanvasPixelArray";
-    return 1 if $interfaceName eq "DOMWindow";
-    return 1 if $interfaceName eq "Element";
-    return 1 if $interfaceName eq "HTMLDocument";
-    return 1 if $interfaceName eq "HTMLElement";
-    return 1 if $interfaceName eq "Location";
-    return 1 if $interfaceName eq "SVGDocument";
-    return 1 if $interfaceName eq "SVGElement";
-    return 1 if $interfaceName eq "ScriptProfile";
-    return 1 if $interfaceName eq "ScriptProfileNode";
-    return 1 if $interfaceName eq "WorkerContext";
-    # We don't generate a custom converter (but JSC does) for the following:
-    return 0 if $interfaceName eq "AbstractWorker";
-    return 0 if $interfaceName eq "CanvasRenderingContext";
-    return 0 if $interfaceName eq "SVGElementInstance";
-    return 0 if $interfaceName eq "NodeList";
-    return 0 if $interfaceName eq "CSSRuleList";
-    return 0 if $interfaceName eq "CSSStyleDeclaration";
-    return 0 if $interfaceName eq "MediaList";
-    return 0 if $interfaceName eq "StyleSheetList";
-    return 0 if $interfaceName eq "DOMImplementation";
-    return 0 if $interfaceName eq "TextTrack";
-
-    # For everything else, do what JSC does.
-    return $dataNode->extendedAttributes->{"JSCustomToJS"};
-}
-
 sub GetDomMapFunction
 {
     my $dataNode = shift;
@@ -3189,25 +3155,24 @@ sub GenerateFunctionCallString()
 
     my @arguments;
     my $functionName;
-    if ($function->isStatic) {
-        $functionName = "${implClassName}::${name}";
-    } elsif ($function->signature->extendedAttributes->{"ImplementedBy"}) {
-        my $implementedBy = $function->signature->extendedAttributes->{"ImplementedBy"};
+    my $implementedBy = $function->signature->extendedAttributes->{"ImplementedBy"};
+    if ($implementedBy) {
         AddToImplIncludes("${implementedBy}.h");
-        unshift(@arguments, "imp");
+        unshift(@arguments, "imp") if !$function->isStatic;
         $functionName = "${implementedBy}::${name}";
+    } elsif ($function->isStatic) {
+        $functionName = "${implClassName}::${name}";
     } else {
         $functionName = "imp->${name}";
     }
 
-    my $callWith = $function->signature->extendedAttributes->{"CallWith"} || "";
-    if ($callWith) {
-        my @callWithOutput = ();
-        push(@arguments, GenerateCallWith($callWith, \@callWithOutput, $indent, 0, 1));
-        $result .= join("", @callWithOutput);
-        $index++;
-        $numberOfParameters++
-    }
+    my $callWith = $function->signature->extendedAttributes->{"CallWith"};
+    my @callWithOutput = ();
+    my @callWithArgs = GenerateCallWith($callWith, \@callWithOutput, $indent, 0, 1, $function);
+    $result .= join("", @callWithOutput);
+    push(@arguments, @callWithArgs);
+    $index += @callWithArgs;
+    $numberOfParameters += @callWithArgs;
 
     foreach my $parameter (@{$function->parameters}) {
         if ($index eq $numberOfParameters) {
@@ -3216,7 +3181,7 @@ sub GenerateFunctionCallString()
         my $paramName = $parameter->name;
         my $paramType = $parameter->type;
 
-        if ($parameter->type eq "NodeFilter" || $parameter->type eq "XPathNSResolver") {
+        if ($parameter->type eq "IDBKey" || $parameter->type eq "NodeFilter" || $parameter->type eq "XPathNSResolver") {
             push @arguments, "$paramName.get()";
         } elsif ($codeGenerator->IsSVGTypeNeedingTearOff($parameter->type) and not $implClassName =~ /List$/) {
             push @arguments, "$paramName->propertyReference()";
@@ -3232,10 +3197,6 @@ sub GenerateFunctionCallString()
         $index++;
     }
 
-    if ($function->signature->extendedAttributes->{"CustomArgumentHandling"}) {
-        push @arguments, "scriptArguments, callStack";
-    }
-
     if (@{$function->raisesExceptions}) {
         push @arguments, "ec";
     }
@@ -3247,13 +3208,13 @@ sub GenerateFunctionCallString()
 
     if ($returnType eq "void") {
         $result .= $indent . "$functionString;\n";
-    } elsif ($callWith eq "ScriptState" or @{$function->raisesExceptions}) {
+    } elsif ($codeGenerator->ExtendedAttributeContains($callWith, "ScriptState") or @{$function->raisesExceptions}) {
         $result .= $indent . $nativeReturnType . " result = $functionString;\n";
     } else {
         # Can inline the function call into the return statement to avoid overhead of using a Ref<> temporary
         $return = $functionString;
         $returnIsRef = 0;
-    
+
         if ($implClassName eq "SVGTransformList" and IsRefPtrType($returnType)) {
             $return = "WTF::getPtr(" . $return . ")";
         }
@@ -3264,7 +3225,7 @@ sub GenerateFunctionCallString()
         $result .= $indent . "    goto fail;\n";
     }
 
-    if ($callWith eq "ScriptState") {
+    if ($codeGenerator->ExtendedAttributeContains($callWith, "ScriptState")) {
         $result .= $indent . "if (state.hadException())\n";
         $result .= $indent . "    return throwError(state.exception());\n"
     }
@@ -3594,7 +3555,7 @@ sub RequiresCustomSignature
     }
     foreach my $parameter (@{$function->parameters}) {
         my $optional = $parameter->extendedAttributes->{"Optional"};
-        if (($optional && $optional ne "CallWithDefaultValue" && $optional ne "CallWithNullValue") || $parameter->extendedAttributes->{"Callback"}) {
+        if (($optional && $optional ne "DefaultIsUndefined" && $optional ne "DefaultIsNullString") || $parameter->extendedAttributes->{"Callback"}) {
             return 0;
         }
     }
@@ -3717,16 +3678,14 @@ sub NativeToJSValue
     return "v8NumberArray($value)" if $type eq "double[]";
 
     if ($codeGenerator->IsStringType($type)) {
-        my $conv = $signature->extendedAttributes->{"ConvertNullStringTo"};
+        my $conv = $signature->extendedAttributes->{"TreatReturnedNullStringAs"};
         if (defined $conv) {
             return "v8StringOrNull($value)" if $conv eq "Null";
             return "v8StringOrUndefined($value)" if $conv eq "Undefined";
             return "v8StringOrFalse($value)" if $conv eq "False";
 
-            die "Unknown value for ConvertNullStringTo extended attribute";
+            die "Unknown value for TreatReturnedNullStringAs extended attribute";
         }
-        $conv = $signature->extendedAttributes->{"ConvertScriptString"};
-        return "v8StringOrNull($value)" if $conv;
         return "v8String($value)";
     }
 
@@ -3824,15 +3783,6 @@ sub WriteData
     @headerContent = ();
 }
 
-sub GetVisibleInterfaceName
-{
-    my $interfaceName = shift;
-
-    return "DOMException" if $interfaceName eq "DOMCoreException";
-    return "FormData" if $interfaceName eq "DOMFormData";
-    return $interfaceName;
-}
-
 sub GetCallbackClassName
 {
     my $interfaceName = shift;
@@ -3867,7 +3817,7 @@ sub GetRuntimeEnableFunctionName
     my $signature = shift;
 
     # If a parameter is given (e.g. "V8EnabledAtRuntime=FeatureName") return the RuntimeEnabledFeatures::{FeatureName}Enabled() method.
-    return "RuntimeEnabledFeatures::" . $codeGenerator->WK_lcfirst($signature->extendedAttributes->{"V8EnabledAtRuntime"}) . "Enabled" if ($signature->extendedAttributes->{"V8EnabledAtRuntime"} && $signature->extendedAttributes->{"V8EnabledAtRuntime"} ne "1");
+    return "RuntimeEnabledFeatures::" . $codeGenerator->WK_lcfirst($signature->extendedAttributes->{"V8EnabledAtRuntime"}) . "Enabled" if ($signature->extendedAttributes->{"V8EnabledAtRuntime"} && $signature->extendedAttributes->{"V8EnabledAtRuntime"} ne "VALUE_IS_MISSING");
 
     # Otherwise return a function named RuntimeEnabledFeatures::{methodName}Enabled().
     return "RuntimeEnabledFeatures::" . $codeGenerator->WK_lcfirst($signature->name) . "Enabled";
diff --git a/Source/WebCore/bindings/scripts/IDLAttributes.txt b/Source/WebCore/bindings/scripts/IDLAttributes.txt
new file mode 100644
index 000000000..d105e0872
--- /dev/null
+++ b/Source/WebCore/bindings/scripts/IDLAttributes.txt
@@ -0,0 +1,113 @@
+#
+# This file describes all IDL attributes.
+# If any IDL file uses an IDL attribute not listed below, the WebKit build will fail.
+# If you want to add a new IDL attribute, you need to
+#     (1) add the IDL attribute to this file
+#     (2) add the explanation to the WebKit IDL document (https://trac.webkit.org/wiki/WebKitIDL)
+#     (3) add test cases to run-bindings-tests
+#
+# The syntax of this file is as follows:
+#     - You can write one IDL attribute per one line.
+#     - "ATTR" means that the IDL attribute ATTR does not take any argument; i.e. [ATTR].
+#     - "ATTR=X" means that the IDL attribute ATTR always takes one argument X; i.e. [ATTR=X].
+#     - "ATTR=X|Y|Z" means that the IDL attribute ATTR takes one or more arguments
+#       and the arguments are X, Y or Z; e.g. [ATTR=X], [ATTR=Y], [ATTR=X|Z], [ATTR=X|Y|Z].
+#     - "ATTR=|X|Y|Z" means that the IDL attribute ATTR can take arguments
+#       and the arguments are X, Y or Z; e.g. [ATTR], [ATTR=X], [ATTR=Y], [ATTR=X|Z], [ATTR=X|Y|Z].
+#     - "ATTR=*" means that the IDL attribute ATTR can take arbitrary arguments;
+#       e.g. [ATTR=INDEXED_DATABASE], [ATTR=deleteFunction].
+#
+
+ActiveDOMObject
+CPPPureInterface
+CachedAttribute
+CallWith=ScriptExecutionContext|ScriptState|ScriptArguments|CallStack
+Callback
+CheckSecurity
+CheckSecurityForNode
+Conditional=*
+Constructor
+ConstructorParameters=*
+ConstructorRaisesException
+ConstructorTemplate=Event
+Custom
+CustomCall
+CustomConstructor
+CustomDeleteProperty
+CustomEnumerateProperty
+CustomGetOwnPropertySlot
+CustomGetter
+CustomIndexedSetter
+CustomNamedGetter
+CustomNamedSetter
+CustomPutFunction
+CustomReturn
+CustomSetter
+CustomToJSObject
+Deletable
+DoNotCheckConstants
+DoNotCheckSecurity
+DoNotCheckSecurityOnGetter
+DoNotCheckSecurityOnSetter
+EventTarget
+ExtendsDOMGlobalObject
+Immutable
+ImplementedAs=*
+IndexedGetter
+InterfaceName=*
+InitializedByEventConstructor
+IsIndex
+IsWorkerContext
+JSCustom
+JSCustomConstructor
+JSCustomDefineOwnProperty
+JSCustomDefineOwnPropertyOnPrototype
+JSCustomFinalize
+JSCustomGetOwnPropertySlotAndDescriptor
+JSCustomGetter
+JSCustomHeader
+JSCustomIsReachable
+JSCustomMarkFunction
+JSCustomNamedGetterOnPrototype
+JSCustomPushEventHandlerScope
+JSCustomSetter
+JSCustomToJSObject
+JSCustomToNativeObject
+JSGenerateIsReachable=|Impl|ImplContext|ImplDocument|ImplElementRoot|ImplFrame
+JSGenerateToJSObject
+JSGenerateToNativeObject
+JSInlineGetOwnPropertySlot
+JSLegacyParent=*
+JSNoStaticTables
+JSWindowEventListener
+MasqueradesAsUndefined
+NamedConstructor=*
+NamedGetter
+NotEnumerable
+NumericIndexedGetter
+ObjCCustomImplementation
+ObjCLegacyUnnamedParameters
+ObjCPolymorphic
+ObjCProtocol
+OmitConstructor
+Optional=|DefaultIsNullString|DefaultIsUndefined
+Reflect=*
+Replaceable
+ReplaceableConstructor
+ReturnNewObject
+StrictTypeChecking
+Supplemental=*
+TreatNullAs=NullString
+TreatReturnedNullStringAs=False|Null|Undefined
+TreatUndefinedAs=NullString
+URL
+V8Custom
+V8CustomConstructor
+V8CustomGetter
+V8CustomSetter
+V8CustomToJSObject
+V8DependentLifetime
+V8DoNotCheckSignature
+V8EnabledAtRuntime=*
+V8ReadOnly
+V8Unforgeable
diff --git a/Source/WebCore/bindings/scripts/IDLParser.pm b/Source/WebCore/bindings/scripts/IDLParser.pm
index fbb7ac255..52671a335 100644
--- a/Source/WebCore/bindings/scripts/IDLParser.pm
+++ b/Source/WebCore/bindings/scripts/IDLParser.pm
@@ -215,7 +215,7 @@ sub parseExtendedAttributes
             if ($name eq "Constructor") {
                 $attrs{$name} = "";
             } else {
-                $attrs{$name} = 1;
+                $attrs{$name} = "VALUE_IS_MISSING";
             }
             $str =~ s/^\s*,?//;
         } else {
@@ -297,7 +297,7 @@ sub ParseInterface
             $newDataNode->signature->name("Constructor");
             $newDataNode->signature->extendedAttributes($extendedAttributes);
             parseParameters($newDataNode, $extendedAttributes->{"Constructor"});
-            $extendedAttributes->{"Constructor"} = 1;
+            $extendedAttributes->{"Constructor"} = "VALUE_IS_MISSING";
             $dataNode->constructor($newDataNode);
         } elsif (defined $extendedAttributes->{"NamedConstructor"}) {
             my $newDataNode = new domFunction();
diff --git a/Source/WebCore/bindings/scripts/resolve-supplemental.pl b/Source/WebCore/bindings/scripts/resolve-supplemental.pl
index 9fe0e661c..168b349dc 100644
--- a/Source/WebCore/bindings/scripts/resolve-supplemental.pl
+++ b/Source/WebCore/bindings/scripts/resolve-supplemental.pl
@@ -30,12 +30,14 @@ my $defines;
 my $preprocessor;
 my $verbose;
 my $idlFilesList;
+my $idlAttributesFile;
 my $supplementalDependencyFile;
 
 GetOptions('defines=s' => \$defines,
            'preprocessor=s' => \$preprocessor,
            'verbose' => \$verbose,
            'idlFilesList=s' => \$idlFilesList,
+           'idlAttributesFile=s' => \$idlAttributesFile,
            'supplementalDependencyFile=s' => \$supplementalDependencyFile);
 
 die('Must specify #define macros using --defines.') unless defined($defines);
@@ -61,6 +63,12 @@ foreach my $idlFile (@idlFiles) {
     $interfaceNameToIdlFile{fileparse(basename($idlFile), ".idl")} = $fullPath;
 }
 
+# Runs the IDL attribute checker.
+my $idlAttributes = loadIDLAttributes($idlAttributesFile);
+foreach my $idlFile (keys %documents) {
+    checkIDLAttributes($idlAttributes, $documents{$idlFile}, basename($idlFile));
+}
+
 # Resolves [Supplemental=XXX] dependencies.
 my %supplementals;
 foreach my $idlFile (keys %documents) {
@@ -93,3 +101,86 @@ foreach my $idlFile (sort keys %supplementals) {
     print FH $idlFile, " @{$supplementals{$idlFile}}\n";
 }
 close FH;
+
+sub loadIDLAttributes
+{
+    my $idlAttributesFile = shift;
+
+    my %idlAttributes;
+    open FH, "<", $idlAttributesFile or die "Couldn't open $idlAttributesFile: $!";
+    while (my $line = <FH>) {
+        chomp $line;
+        next if $line =~ /^\s*#/;
+        next if $line =~ /^\s*$/;
+
+        if ($line =~ /^\s*([^=\s]*)\s*=?\s*(.*)/) {
+            my $name = $1;
+            $idlAttributes{$name} = {};
+            if ($2) {
+                foreach my $rightValue (split /\|/, $2) {
+                    $rightValue =~ s/^\s*|\s*$//g;
+                    $rightValue = "VALUE_IS_MISSING" unless $rightValue;
+                    $idlAttributes{$name}{$rightValue} = 1;
+                }
+            } else {
+                $idlAttributes{$name}{"VALUE_IS_MISSING"} = 1;
+            }
+        } else {
+            die "The format of " . basename($idlAttributesFile) . " is wrong: line $.\n";
+        }
+    }
+    close FH;
+
+    return \%idlAttributes;
+}
+
+sub checkIDLAttributes
+{
+    my $idlAttributes = shift;
+    my $document = shift;
+    my $idlFile = shift;
+
+    foreach my $dataNode (@{$document->classes}) {
+        checkIfIDLAttributesExists($idlAttributes, $dataNode->extendedAttributes, $idlFile);
+
+        foreach my $attribute (@{$dataNode->attributes}) {
+            checkIfIDLAttributesExists($idlAttributes, $attribute->signature->extendedAttributes, $idlFile);
+        }
+
+        foreach my $function (@{$dataNode->functions}) {
+            checkIfIDLAttributesExists($idlAttributes, $function->signature->extendedAttributes, $idlFile);
+            foreach my $parameter (@{$function->parameters}) {
+                checkIfIDLAttributesExists($idlAttributes, $parameter->extendedAttributes, $idlFile);
+            }
+        }
+    }
+}
+
+sub checkIfIDLAttributesExists
+{
+    my $idlAttributes = shift;
+    my $extendedAttributes = shift;
+    my $idlFile = shift;
+
+    my $error;
+    OUTER: for my $name (keys %$extendedAttributes) {
+        if (!exists $idlAttributes->{$name}) {
+            $error = "Unknown IDL attribute [$name] is found at $idlFile.";
+            last OUTER;
+        }
+        if ($idlAttributes->{$name}{"*"}) {
+            next;
+        }
+        for my $rightValue (split /\s*\|\s*/, $extendedAttributes->{$name}) {
+            if (!exists $idlAttributes->{$name}{$rightValue}) {
+                $error = "Unknown IDL attribute [$name=" . $extendedAttributes->{$name} . "] is found at $idlFile.";
+                last OUTER;
+            }
+        }
+    }
+    if ($error) {
+        die "IDL ATTRIBUTE CHECKER ERROR: $error
+If you want to add a new IDL attribute, you need to add it to WebCore/bindings/scripts/IDLAttributes.txt and add explanations to the WebKit IDL document (https://trac.webkit.org/wiki/WebKitIDL).
+";
+    }
+}
diff --git a/Source/WebCore/bindings/scripts/test/CPP/WebDOMTestInterface.cpp b/Source/WebCore/bindings/scripts/test/CPP/WebDOMTestInterface.cpp
index a90991088..cd28aab52 100644
--- a/Source/WebCore/bindings/scripts/test/CPP/WebDOMTestInterface.cpp
+++ b/Source/WebCore/bindings/scripts/test/CPP/WebDOMTestInterface.cpp
@@ -25,11 +25,11 @@
 #include "WebDOMTestInterface.h"
 
 #include "KURL.h"
+#include "Node.h"
 #include "TestInterface.h"
-#include "TestObj.h"
 #include "TestSupplemental.h"
+#include "WebDOMNode.h"
 #include "WebDOMString.h"
-#include "WebDOMTestObj.h"
 #include "WebExceptionHandler.h"
 #include "wtf/text/AtomicString.h"
 #include <wtf/GetPtr.h>
@@ -108,6 +108,24 @@ void WebDOMTestInterface::setSupplementalStr2(const WebDOMString& newSupplementa
 }
 
 #endif
+#if ENABLE(Condition11) || ENABLE(Condition12)
+WebDOMNode WebDOMTestInterface::supplementalNode() const
+{
+    if (!impl())
+        return WebDOMNode();
+
+    return toWebKit(WTF::getPtr(TestSupplemental::supplementalNode(impl())));
+}
+
+void WebDOMTestInterface::setSupplementalNode(const WebDOMNode& newSupplementalNode)
+{
+    if (!impl())
+        return;
+
+    TestSupplemental::setSupplementalNode(impl(), toWebCore(newSupplementalNode));
+}
+
+#endif
 
 #if ENABLE(Condition11) || ENABLE(Condition12)
 void WebDOMTestInterface::supplementalMethod1()
@@ -122,15 +140,12 @@ void WebDOMTestInterface::supplementalMethod1()
 
 
 #if ENABLE(Condition11) || ENABLE(Condition12)
-WebDOMTestObj WebDOMTestInterface::supplementalMethod2(const WebDOMString& strArg, const WebDOMTestObj& objArg)
+void WebDOMTestInterface::supplementalMethod4()
 {
     if (!impl())
-        return WebDOMTestObj();
+        return;
 
-    WebCore::ExceptionCode ec = 0;
-    WebDOMTestObj result = toWebKit(WTF::getPtr(WebCore::TestSupplemental::supplementalMethod2(impl(), strArg, toWebCore(objArg), ec)));
-    webDOMRaiseError(static_cast<WebDOMExceptionCode>(ec));
-    return result;
+    WebCore::TestSupplemental::supplementalMethod4(impl());
 }
 
 #endif
diff --git a/Source/WebCore/bindings/scripts/test/CPP/WebDOMTestInterface.h b/Source/WebCore/bindings/scripts/test/CPP/WebDOMTestInterface.h
index 4c7f666bf..280460bbd 100644
--- a/Source/WebCore/bindings/scripts/test/CPP/WebDOMTestInterface.h
+++ b/Source/WebCore/bindings/scripts/test/CPP/WebDOMTestInterface.h
@@ -32,7 +32,7 @@ namespace WebCore {
 class TestInterface;
 };
 
-class WebDOMTestObj;
+class WebDOMNode;
 
 class WebDOMTestInterface : public WebDOMObject {
 public:
@@ -59,9 +59,13 @@ public:
     WebDOMString supplementalStr2() const;
     void setSupplementalStr2(const WebDOMString&);
 #endif
+#if ENABLE(Condition11) || ENABLE(Condition12)
+    WebDOMNode supplementalNode() const;
+    void setSupplementalNode(const WebDOMNode&);
+#endif
 
     void supplementalMethod1();
-    WebDOMTestObj supplementalMethod2(const WebDOMString& strArg, const WebDOMTestObj& objArg);
+    void supplementalMethod4();
 
     WebCore::TestInterface* impl() const;
 
diff --git a/Source/WebCore/bindings/scripts/test/CPP/WebDOMTestObj.cpp b/Source/WebCore/bindings/scripts/test/CPP/WebDOMTestObj.cpp
index d81871fa6..ac076486f 100644
--- a/Source/WebCore/bindings/scripts/test/CPP/WebDOMTestObj.cpp
+++ b/Source/WebCore/bindings/scripts/test/CPP/WebDOMTestObj.cpp
@@ -487,88 +487,6 @@ void WebDOMTestObj::setStringAttrWithSetterException(const WebDOMString& newStri
     webDOMRaiseError(static_cast<WebDOMExceptionCode>(ec));
 }
 
-int WebDOMTestObj::withScriptStateAttribute() const
-{
-    if (!impl())
-        return 0;
-
-    return impl()->withScriptStateAttribute();
-}
-
-void WebDOMTestObj::setWithScriptStateAttribute(int newWithScriptStateAttribute)
-{
-    if (!impl())
-        return;
-
-    impl()->setWithScriptStateAttribute(newWithScriptStateAttribute);
-}
-
-WebDOMTestObj WebDOMTestObj::withScriptExecutionContextAttribute() const
-{
-    if (!impl())
-        return WebDOMTestObj();
-
-    return toWebKit(WTF::getPtr(impl()->withScriptExecutionContextAttribute()));
-}
-
-void WebDOMTestObj::setWithScriptExecutionContextAttribute(const WebDOMTestObj& newWithScriptExecutionContextAttribute)
-{
-    if (!impl())
-        return;
-
-    impl()->setWithScriptExecutionContextAttribute(toWebCore(newWithScriptExecutionContextAttribute));
-}
-
-WebDOMTestObj WebDOMTestObj::withScriptStateAttributeRaises() const
-{
-    if (!impl())
-        return WebDOMTestObj();
-
-    WebCore::ExceptionCode ec = 0;
-    WebDOMTestObj result = toWebKit(WTF::getPtr(impl()->withScriptStateAttributeRaises(ec)));
-    webDOMRaiseError(static_cast<WebDOMExceptionCode>(ec));
-    return result;
-}
-
-void WebDOMTestObj::setWithScriptStateAttributeRaises(const WebDOMTestObj& newWithScriptStateAttributeRaises)
-{
-    if (!impl())
-        return;
-
-    WebCore::ExceptionCode ec = 0;
-    impl()->setWithScriptStateAttributeRaises(toWebCore(newWithScriptStateAttributeRaises), ec);
-    webDOMRaiseError(static_cast<WebDOMExceptionCode>(ec));
-}
-
-WebDOMTestObj WebDOMTestObj::withScriptExecutionContextAttributeRaises() const
-{
-    if (!impl())
-        return WebDOMTestObj();
-
-    WebCore::ExceptionCode ec = 0;
-    WebDOMTestObj result = toWebKit(WTF::getPtr(impl()->withScriptExecutionContextAttributeRaises(ec)));
-    webDOMRaiseError(static_cast<WebDOMExceptionCode>(ec));
-    return result;
-}
-
-void WebDOMTestObj::setWithScriptExecutionContextAttributeRaises(const WebDOMTestObj& newWithScriptExecutionContextAttributeRaises)
-{
-    if (!impl())
-        return;
-
-    WebCore::ExceptionCode ec = 0;
-    impl()->setWithScriptExecutionContextAttributeRaises(toWebCore(newWithScriptExecutionContextAttributeRaises), ec);
-    webDOMRaiseError(static_cast<WebDOMExceptionCode>(ec));
-}
-
-WebDOMString WebDOMTestObj::scriptStringAttr() const
-{
-    if (!impl())
-        return WebDOMString();
-
-    return static_cast<const WTF::String&>(impl()->scriptStringAttr());
-}
-
 #if ENABLE(Condition1)
 int WebDOMTestObj::conditionalAttr1() const
 {
@@ -874,73 +792,52 @@ void WebDOMTestObj::removeEventListener(const WebDOMString& type, const WebDOMEv
     impl()->removeEventListener(type, toWebCore(listener), useCapture);
 }
 
-void WebDOMTestObj::withScriptStateVoid()
+void WebDOMTestObj::methodWithOptionalArg(int opt)
 {
     if (!impl())
         return;
 
-    impl()->withScriptStateVoid();
-}
-
-WebDOMTestObj WebDOMTestObj::withScriptStateObj()
-{
-    if (!impl())
-        return WebDOMTestObj();
-
-    return toWebKit(WTF::getPtr(impl()->withScriptStateObj()));
+    impl()->methodWithOptionalArg(opt);
 }
 
-void WebDOMTestObj::withScriptStateVoidException()
+void WebDOMTestObj::methodWithNonOptionalArgAndOptionalArg(int nonOpt, int opt)
 {
     if (!impl())
         return;
 
-    WebCore::ExceptionCode ec = 0;
-    impl()->withScriptStateVoidException(ec);
-    webDOMRaiseError(static_cast<WebDOMExceptionCode>(ec));
-}
-
-WebDOMTestObj WebDOMTestObj::withScriptStateObjException()
-{
-    if (!impl())
-        return WebDOMTestObj();
-
-    WebCore::ExceptionCode ec = 0;
-    WebDOMTestObj result = toWebKit(WTF::getPtr(impl()->withScriptStateObjException(ec)));
-    webDOMRaiseError(static_cast<WebDOMExceptionCode>(ec));
-    return result;
+    impl()->methodWithNonOptionalArgAndOptionalArg(nonOpt, opt);
 }
 
-void WebDOMTestObj::withScriptExecutionContext()
+void WebDOMTestObj::methodWithNonOptionalArgAndTwoOptionalArgs(int nonOpt, int opt1, int opt2)
 {
     if (!impl())
         return;
 
-    impl()->withScriptExecutionContext();
+    impl()->methodWithNonOptionalArgAndTwoOptionalArgs(nonOpt, opt1, opt2);
 }
 
-void WebDOMTestObj::methodWithOptionalArg(int opt)
+void WebDOMTestObj::methodWithOptionalString(const WebDOMString& str)
 {
     if (!impl())
         return;
 
-    impl()->methodWithOptionalArg(opt);
+    impl()->methodWithOptionalString(str);
 }
 
-void WebDOMTestObj::methodWithNonOptionalArgAndOptionalArg(int nonOpt, int opt)
+void WebDOMTestObj::methodWithOptionalStringIsUndefined(const WebDOMString& str)
 {
     if (!impl())
         return;
 
-    impl()->methodWithNonOptionalArgAndOptionalArg(nonOpt, opt);
+    impl()->methodWithOptionalStringIsUndefined(str);
 }
 
-void WebDOMTestObj::methodWithNonOptionalArgAndTwoOptionalArgs(int nonOpt, int opt1, int opt2)
+void WebDOMTestObj::methodWithOptionalStringIsNullString(const WebDOMString& str)
 {
     if (!impl())
         return;
 
-    impl()->methodWithNonOptionalArgAndTwoOptionalArgs(nonOpt, opt1, opt2);
+    impl()->methodWithOptionalStringIsNullString(str);
 }
 
 
diff --git a/Source/WebCore/bindings/scripts/test/CPP/WebDOMTestObj.h b/Source/WebCore/bindings/scripts/test/CPP/WebDOMTestObj.h
index 6f9101d12..5d90fd261 100644
--- a/Source/WebCore/bindings/scripts/test/CPP/WebDOMTestObj.h
+++ b/Source/WebCore/bindings/scripts/test/CPP/WebDOMTestObj.h
@@ -120,15 +120,6 @@ public:
     void setStringAttrWithGetterException(const WebDOMString&);
     WebDOMString stringAttrWithSetterException() const;
     void setStringAttrWithSetterException(const WebDOMString&);
-    int withScriptStateAttribute() const;
-    void setWithScriptStateAttribute(int);
-    WebDOMTestObj withScriptExecutionContextAttribute() const;
-    void setWithScriptExecutionContextAttribute(const WebDOMTestObj&);
-    WebDOMTestObj withScriptStateAttributeRaises() const;
-    void setWithScriptStateAttributeRaises(const WebDOMTestObj&);
-    WebDOMTestObj withScriptExecutionContextAttributeRaises() const;
-    void setWithScriptExecutionContextAttributeRaises(const WebDOMTestObj&);
-    WebDOMString scriptStringAttr() const;
 #if ENABLE(Condition1)
     int conditionalAttr1() const;
     void setConditionalAttr1(int);
@@ -178,14 +169,12 @@ public:
     void methodWithException();
     void addEventListener(const WebDOMString& type, const WebDOMEventListener& listener, bool useCapture);
     void removeEventListener(const WebDOMString& type, const WebDOMEventListener& listener, bool useCapture);
-    void withScriptStateVoid();
-    WebDOMTestObj withScriptStateObj();
-    void withScriptStateVoidException();
-    WebDOMTestObj withScriptStateObjException();
-    void withScriptExecutionContext();
     void methodWithOptionalArg(int opt);
     void methodWithNonOptionalArgAndOptionalArg(int nonOpt, int opt);
     void methodWithNonOptionalArgAndTwoOptionalArgs(int nonOpt, int opt1, int opt2);
+    void methodWithOptionalString(const WebDOMString& str);
+    void methodWithOptionalStringIsUndefined(const WebDOMString& str);
+    void methodWithOptionalStringIsNullString(const WebDOMString& str);
     WebDOMString conditionalMethod1();
     void conditionalMethod2();
     void conditionalMethod3();
@@ -200,7 +189,7 @@ public:
     void convert5(const WebDOMe& );
     WebDOMSVGPoint mutablePointFunction();
     WebDOMSVGPoint immutablePointFunction();
-    void orange();
+    void banana();
     WebDOMbool strictFunction(const WebDOMString& str, float a, int b);
 
     WebCore::TestObj* impl() const;
diff --git a/Source/WebCore/bindings/scripts/test/GObject/WebKitDOMTestInterface.cpp b/Source/WebCore/bindings/scripts/test/GObject/WebKitDOMTestInterface.cpp
index 26ab91bc8..a73ebf1c7 100644
--- a/Source/WebCore/bindings/scripts/test/GObject/WebKitDOMTestInterface.cpp
+++ b/Source/WebCore/bindings/scripts/test/GObject/WebKitDOMTestInterface.cpp
@@ -28,11 +28,14 @@
 #include "DOMObjectCache.h"
 #include "ExceptionCode.h"
 #include "JSMainThreadExecState.h"
+#include "Node.h"
 #include "TestInterface.h"
 #include "TestObj.h"
 #include "TestSupplemental.h"
 #include "WebKitDOMBinding.h"
 #include "gobject/ConvertToUTF8String.h"
+#include "webkit/WebKitDOMNode.h"
+#include "webkit/WebKitDOMNodePrivate.h"
 #include "webkit/WebKitDOMTestInterface.h"
 #include "webkit/WebKitDOMTestInterfacePrivate.h"
 #include "webkit/WebKitDOMTestObj.h"
@@ -62,7 +65,7 @@ webkit_dom_test_interface_supplemental_method1(WebKitDOMTestInterface* self)
     g_return_if_fail(self);
     WebCore::JSMainThreadNullState state;
     WebCore::TestInterface * item = WebKit::core(self);
-    TestSupplemental::supplementalMethod1(item);
+    WebCore::TestSupplemental::supplementalMethod1(item);
 #endif /* ENABLE(Condition11) || ENABLE(Condition12) */
 }
 
@@ -82,7 +85,7 @@ webkit_dom_test_interface_supplemental_method2(WebKitDOMTestInterface* self, con
         g_return_val_if_fail(converted_obj_arg, 0);
     }
     WebCore::ExceptionCode ec = 0;
-    PassRefPtr<WebCore::TestObj> g_res = WTF::getPtr(TestSupplemental::supplementalMethod2(item, converted_str_arg, converted_obj_arg, ec));
+    PassRefPtr<WebCore::TestObj> g_res = WTF::getPtr(WebCore::TestSupplemental::supplementalMethod2(item, converted_str_arg, converted_obj_arg, ec));
     if (ec) {
         WebCore::ExceptionCodeDescription ecdesc(ec);
         g_set_error_literal(error, g_quark_from_string("WEBKIT_DOM"), ecdesc.code, ecdesc.name);
@@ -94,6 +97,17 @@ webkit_dom_test_interface_supplemental_method2(WebKitDOMTestInterface* self, con
 #endif /* ENABLE(Condition11) || ENABLE(Condition12) */
 }
 
+void
+webkit_dom_test_interface_supplemental_method4(WebKitDOMTestInterface* self)
+{
+#if ENABLE(Condition11) || ENABLE(Condition12)
+    g_return_if_fail(self);
+    WebCore::JSMainThreadNullState state;
+    WebCore::TestInterface * item = WebKit::core(self);
+    TestSupplemental::supplementalMethod4(item);
+#endif /* ENABLE(Condition11) || ENABLE(Condition12) */
+}
+
 gchar*
 webkit_dom_test_interface_get_supplemental_str1(WebKitDOMTestInterface* self)
 {
@@ -101,7 +115,7 @@ webkit_dom_test_interface_get_supplemental_str1(WebKitDOMTestInterface* self)
     g_return_val_if_fail(self, 0);
     WebCore::JSMainThreadNullState state;
     WebCore::TestInterface * item = WebKit::core(self);
-    gchar* res = convertToUTF8String(TestSupplemental::supplementalStr1(item));
+    gchar* res = convertToUTF8String(WebCore::TestSupplemental::supplementalStr1(item));
     return res;
 #else
     return NULL;
@@ -115,7 +129,7 @@ webkit_dom_test_interface_get_supplemental_str2(WebKitDOMTestInterface* self)
     g_return_val_if_fail(self, 0);
     WebCore::JSMainThreadNullState state;
     WebCore::TestInterface * item = WebKit::core(self);
-    gchar* res = convertToUTF8String(TestSupplemental::supplementalStr2(item));
+    gchar* res = convertToUTF8String(WebCore::TestSupplemental::supplementalStr2(item));
     return res;
 #else
     return NULL;
@@ -131,7 +145,39 @@ webkit_dom_test_interface_set_supplemental_str2(WebKitDOMTestInterface* self, co
     WebCore::TestInterface * item = WebKit::core(self);
     g_return_if_fail(value);
     WTF::String converted_value = WTF::String::fromUTF8(value);
-    TestSupplemental::setSupplementalStr2(item, converted_value);
+    WebCore::TestSupplemental::setSupplementalStr2(item, converted_value);
+#endif /* ENABLE(Condition11) || ENABLE(Condition12) */
+}
+
+WebKitDOMNode*
+webkit_dom_test_interface_get_supplemental_node(WebKitDOMTestInterface* self)
+{
+#if ENABLE(Condition11) || ENABLE(Condition12)
+    g_return_val_if_fail(self, 0);
+    WebCore::JSMainThreadNullState state;
+    WebCore::TestInterface * item = WebKit::core(self);
+    PassRefPtr<WebCore::Node> g_res = WTF::getPtr(WebCore::TestSupplemental::supplementalNode(item));
+    WebKitDOMNode* res = WebKit::kit(g_res.get());
+    return res;
+#else
+    return NULL;
+#endif /* ENABLE(Condition11) || ENABLE(Condition12) */
+}
+
+void
+webkit_dom_test_interface_set_supplemental_node(WebKitDOMTestInterface* self, WebKitDOMNode* value)
+{
+#if ENABLE(Condition11) || ENABLE(Condition12)
+    g_return_if_fail(self);
+    WebCore::JSMainThreadNullState state;
+    WebCore::TestInterface * item = WebKit::core(self);
+    g_return_if_fail(value);
+    WebCore::Node * converted_value = NULL;
+    if (value != NULL) {
+        converted_value = WebKit::core(value);
+        g_return_if_fail(converted_value);
+    }
+    WebCore::TestSupplemental::setSupplementalNode(item, converted_value);
 #endif /* ENABLE(Condition11) || ENABLE(Condition12) */
 }
 
@@ -159,6 +205,9 @@ enum {
 #if ENABLE(Condition11) || ENABLE(Condition12)
     PROP_SUPPLEMENTAL_STR2,
 #endif /* ENABLE(Condition11) || ENABLE(Condition12) */
+#if ENABLE(Condition11) || ENABLE(Condition12)
+    PROP_SUPPLEMENTAL_NODE,
+#endif /* ENABLE(Condition11) || ENABLE(Condition12) */
 };
 
 
@@ -187,7 +236,7 @@ static void webkit_dom_test_interface_set_property(GObject* object, guint prop_i
 #if ENABLE(Condition11) || ENABLE(Condition12)
     case PROP_SUPPLEMENTAL_STR2:
     {
-        TestSupplemental::setSupplementalStr2(coreSelf, WTF::String::fromUTF8(g_value_get_string(value)));
+        WebCore::TestSupplemental::setSupplementalStr2(coreSelf, WTF::String::fromUTF8(g_value_get_string(value)));
         break;
     }
 #endif /* ENABLE(Condition11) || ENABLE(Condition12) */
@@ -207,14 +256,22 @@ static void webkit_dom_test_interface_get_property(GObject* object, guint prop_i
 #if ENABLE(Condition11) || ENABLE(Condition12)
     case PROP_SUPPLEMENTAL_STR1:
     {
-        g_value_take_string(value, convertToUTF8String(TestSupplemental::supplementalStr1(coreSelf)));
+        g_value_take_string(value, convertToUTF8String(WebCore::TestSupplemental::supplementalStr1(coreSelf)));
         break;
     }
 #endif /* ENABLE(Condition11) || ENABLE(Condition12) */
 #if ENABLE(Condition11) || ENABLE(Condition12)
     case PROP_SUPPLEMENTAL_STR2:
     {
-        g_value_take_string(value, convertToUTF8String(TestSupplemental::supplementalStr2(coreSelf)));
+        g_value_take_string(value, convertToUTF8String(WebCore::TestSupplemental::supplementalStr2(coreSelf)));
+        break;
+    }
+#endif /* ENABLE(Condition11) || ENABLE(Condition12) */
+#if ENABLE(Condition11) || ENABLE(Condition12)
+    case PROP_SUPPLEMENTAL_NODE:
+    {
+        RefPtr<WebCore::Node> ptr = WebCore::TestSupplemental::supplementalNode(coreSelf);
+        g_value_set_object(value, WebKit::kit(ptr.get()));
         break;
     }
 #endif /* ENABLE(Condition11) || ENABLE(Condition12) */
@@ -258,6 +315,15 @@ static void webkit_dom_test_interface_class_init(WebKitDOMTestInterfaceClass* re
                                                            "", /* default */
                                                            WEBKIT_PARAM_READWRITE));
 #endif /* ENABLE(Condition11) || ENABLE(Condition12) */
+#if ENABLE(Condition11) || ENABLE(Condition12)
+    g_object_class_install_property(gobjectClass,
+                                    PROP_SUPPLEMENTAL_NODE,
+                                    g_param_spec_object("supplemental-node", /* name */
+                                                           "test_interface_supplemental-node", /* short description */
+                                                           "read-write  WebKitDOMNode* TestInterface.supplemental-node", /* longer - could do with some extra doc stuff here */
+                                                           WEBKIT_TYPE_DOM_NODE, /* gobject type */
+                                                           WEBKIT_PARAM_READWRITE));
+#endif /* ENABLE(Condition11) || ENABLE(Condition12) */
 
 
 }
diff --git a/Source/WebCore/bindings/scripts/test/GObject/WebKitDOMTestInterface.h b/Source/WebCore/bindings/scripts/test/GObject/WebKitDOMTestInterface.h
index ea1a7b150..0b688920e 100644
--- a/Source/WebCore/bindings/scripts/test/GObject/WebKitDOMTestInterface.h
+++ b/Source/WebCore/bindings/scripts/test/GObject/WebKitDOMTestInterface.h
@@ -70,6 +70,16 @@ WEBKIT_API WebKitDOMTestObj*
 webkit_dom_test_interface_supplemental_method2(WebKitDOMTestInterface* self, const gchar* str_arg, WebKitDOMTestObj* obj_arg, GError **error);
 
 /**
+ * webkit_dom_test_interface_supplemental_method4:
+ * @self: A #WebKitDOMTestInterface
+ *
+ * Returns:
+ *
+**/
+WEBKIT_API void
+webkit_dom_test_interface_supplemental_method4(WebKitDOMTestInterface* self);
+
+/**
  * webkit_dom_test_interface_get_supplemental_str1:
  * @self: A #WebKitDOMTestInterface
  *
@@ -100,6 +110,27 @@ webkit_dom_test_interface_get_supplemental_str2(WebKitDOMTestInterface* self);
 WEBKIT_API void
 webkit_dom_test_interface_set_supplemental_str2(WebKitDOMTestInterface* self, const gchar* value);
 
+/**
+ * webkit_dom_test_interface_get_supplemental_node:
+ * @self: A #WebKitDOMTestInterface
+ *
+ * Returns: (transfer none):
+ *
+**/
+WEBKIT_API WebKitDOMNode*
+webkit_dom_test_interface_get_supplemental_node(WebKitDOMTestInterface* self);
+
+/**
+ * webkit_dom_test_interface_set_supplemental_node:
+ * @self: A #WebKitDOMTestInterface
+ * @value: A #WebKitDOMNode
+ *
+ * Returns: (transfer none):
+ *
+**/
+WEBKIT_API void
+webkit_dom_test_interface_set_supplemental_node(WebKitDOMTestInterface* self, WebKitDOMNode* value);
+
 G_END_DECLS
 
 #endif /* WebKitDOMTestInterface_h */
diff --git a/Source/WebCore/bindings/scripts/test/GObject/WebKitDOMTestObj.cpp b/Source/WebCore/bindings/scripts/test/GObject/WebKitDOMTestObj.cpp
index 5f9f95f44..35add3087 100644
--- a/Source/WebCore/bindings/scripts/test/GObject/WebKitDOMTestObj.cpp
+++ b/Source/WebCore/bindings/scripts/test/GObject/WebKitDOMTestObj.cpp
@@ -308,6 +308,42 @@ webkit_dom_test_obj_with_script_execution_context(WebKitDOMTestObj* self)
 }
 
 void
+webkit_dom_test_obj_with_script_execution_context_and_script_state(WebKitDOMTestObj* self)
+{
+    g_return_if_fail(self);
+    WebCore::JSMainThreadNullState state;
+    WebCore::TestObj * item = WebKit::core(self);
+    item->withScriptExecutionContextAndScriptState();
+}
+
+WebKitDOMTestObj*
+webkit_dom_test_obj_with_script_execution_context_and_script_state_obj_exception(WebKitDOMTestObj* self, GError **error)
+{
+    g_return_val_if_fail(self, 0);
+    WebCore::JSMainThreadNullState state;
+    WebCore::TestObj * item = WebKit::core(self);
+    WebCore::ExceptionCode ec = 0;
+    PassRefPtr<WebCore::TestObj> g_res = WTF::getPtr(item->withScriptExecutionContextAndScriptStateObjException(ec));
+    if (ec) {
+        WebCore::ExceptionCodeDescription ecdesc(ec);
+        g_set_error_literal(error, g_quark_from_string("WEBKIT_DOM"), ecdesc.code, ecdesc.name);
+    }
+    WebKitDOMTestObj* res = WebKit::kit(g_res.get());
+    return res;
+}
+
+WebKitDOMTestObj*
+webkit_dom_test_obj_with_script_execution_context_and_script_state_with_spaces(WebKitDOMTestObj* self)
+{
+    g_return_val_if_fail(self, 0);
+    WebCore::JSMainThreadNullState state;
+    WebCore::TestObj * item = WebKit::core(self);
+    PassRefPtr<WebCore::TestObj> g_res = WTF::getPtr(item->withScriptExecutionContextAndScriptStateWithSpaces());
+    WebKitDOMTestObj* res = WebKit::kit(g_res.get());
+    return res;
+}
+
+void
 webkit_dom_test_obj_method_with_optional_arg(WebKitDOMTestObj* self, glong opt)
 {
     g_return_if_fail(self);
@@ -334,6 +370,39 @@ webkit_dom_test_obj_method_with_non_optional_arg_and_two_optional_args(WebKitDOM
     item->methodWithNonOptionalArgAndTwoOptionalArgs(non_opt, opt1, opt2);
 }
 
+void
+webkit_dom_test_obj_method_with_optional_string(WebKitDOMTestObj* self, const gchar* str)
+{
+    g_return_if_fail(self);
+    WebCore::JSMainThreadNullState state;
+    WebCore::TestObj * item = WebKit::core(self);
+    g_return_if_fail(str);
+    WTF::String converted_str = WTF::String::fromUTF8(str);
+    item->methodWithOptionalString(converted_str);
+}
+
+void
+webkit_dom_test_obj_method_with_optional_string_is_undefined(WebKitDOMTestObj* self, const gchar* str)
+{
+    g_return_if_fail(self);
+    WebCore::JSMainThreadNullState state;
+    WebCore::TestObj * item = WebKit::core(self);
+    g_return_if_fail(str);
+    WTF::String converted_str = WTF::String::fromUTF8(str);
+    item->methodWithOptionalStringIsUndefined(converted_str);
+}
+
+void
+webkit_dom_test_obj_method_with_optional_string_is_null_string(WebKitDOMTestObj* self, const gchar* str)
+{
+    g_return_if_fail(self);
+    WebCore::JSMainThreadNullState state;
+    WebCore::TestObj * item = WebKit::core(self);
+    g_return_if_fail(str);
+    WTF::String converted_str = WTF::String::fromUTF8(str);
+    item->methodWithOptionalStringIsNullString(converted_str);
+}
+
 gchar*
 webkit_dom_test_obj_conditional_method1(WebKitDOMTestObj* self)
 {
@@ -1157,16 +1226,94 @@ webkit_dom_test_obj_set_with_script_execution_context_attribute_raises(WebKitDOM
     }
 }
 
-gchar*
-webkit_dom_test_obj_get_script_string_attr(WebKitDOMTestObj* self)
+WebKitDOMTestObj*
+webkit_dom_test_obj_get_with_script_execution_context_and_script_state_attribute(WebKitDOMTestObj* self)
 {
     g_return_val_if_fail(self, 0);
     WebCore::JSMainThreadNullState state;
     WebCore::TestObj * item = WebKit::core(self);
-    gchar* res = convertToUTF8String(item->scriptStringAttr());
+    PassRefPtr<WebCore::TestObj> g_res = WTF::getPtr(item->withScriptExecutionContextAndScriptStateAttribute());
+    WebKitDOMTestObj* res = WebKit::kit(g_res.get());
     return res;
 }
 
+void
+webkit_dom_test_obj_set_with_script_execution_context_and_script_state_attribute(WebKitDOMTestObj* self, WebKitDOMTestObj* value)
+{
+    g_return_if_fail(self);
+    WebCore::JSMainThreadNullState state;
+    WebCore::TestObj * item = WebKit::core(self);
+    g_return_if_fail(value);
+    WebCore::TestObj * converted_value = NULL;
+    if (value != NULL) {
+        converted_value = WebKit::core(value);
+        g_return_if_fail(converted_value);
+    }
+    item->setWithScriptExecutionContextAndScriptStateAttribute(converted_value);
+}
+
+WebKitDOMTestObj*
+webkit_dom_test_obj_get_with_script_execution_context_and_script_state_attribute_raises(WebKitDOMTestObj* self, GError **error)
+{
+    g_return_val_if_fail(self, 0);
+    WebCore::JSMainThreadNullState state;
+    WebCore::TestObj * item = WebKit::core(self);
+    WebCore::ExceptionCode ec = 0;
+    PassRefPtr<WebCore::TestObj> g_res = WTF::getPtr(item->withScriptExecutionContextAndScriptStateAttributeRaises(ec));
+    if (ec) {
+        WebCore::ExceptionCodeDescription ecdesc(ec);
+        g_set_error_literal(error, g_quark_from_string("WEBKIT_DOM"), ecdesc.code, ecdesc.name);
+    }
+    WebKitDOMTestObj* res = WebKit::kit(g_res.get());
+    return res;
+}
+
+void
+webkit_dom_test_obj_set_with_script_execution_context_and_script_state_attribute_raises(WebKitDOMTestObj* self, WebKitDOMTestObj* value, GError **error)
+{
+    g_return_if_fail(self);
+    WebCore::JSMainThreadNullState state;
+    WebCore::TestObj * item = WebKit::core(self);
+    g_return_if_fail(value);
+    WebCore::TestObj * converted_value = NULL;
+    if (value != NULL) {
+        converted_value = WebKit::core(value);
+        g_return_if_fail(converted_value);
+    }
+    WebCore::ExceptionCode ec = 0;
+    item->setWithScriptExecutionContextAndScriptStateAttributeRaises(converted_value, ec);
+    if (ec) {
+        WebCore::ExceptionCodeDescription ecdesc(ec);
+        g_set_error_literal(error, g_quark_from_string("WEBKIT_DOM"), ecdesc.code, ecdesc.name);
+    }
+}
+
+WebKitDOMTestObj*
+webkit_dom_test_obj_get_with_script_execution_context_and_script_state_with_spaces_attribute(WebKitDOMTestObj* self)
+{
+    g_return_val_if_fail(self, 0);
+    WebCore::JSMainThreadNullState state;
+    WebCore::TestObj * item = WebKit::core(self);
+    PassRefPtr<WebCore::TestObj> g_res = WTF::getPtr(item->withScriptExecutionContextAndScriptStateWithSpacesAttribute());
+    WebKitDOMTestObj* res = WebKit::kit(g_res.get());
+    return res;
+}
+
+void
+webkit_dom_test_obj_set_with_script_execution_context_and_script_state_with_spaces_attribute(WebKitDOMTestObj* self, WebKitDOMTestObj* value)
+{
+    g_return_if_fail(self);
+    WebCore::JSMainThreadNullState state;
+    WebCore::TestObj * item = WebKit::core(self);
+    g_return_if_fail(value);
+    WebCore::TestObj * converted_value = NULL;
+    if (value != NULL) {
+        converted_value = WebKit::core(value);
+        g_return_if_fail(converted_value);
+    }
+    item->setWithScriptExecutionContextAndScriptStateWithSpacesAttribute(converted_value);
+}
+
 glong
 webkit_dom_test_obj_get_conditional_attr1(WebKitDOMTestObj* self)
 {
@@ -1410,7 +1557,10 @@ enum {
     PROP_WITH_SCRIPT_EXECUTION_CONTEXT_ATTRIBUTE,
     PROP_WITH_SCRIPT_STATE_ATTRIBUTE_RAISES,
     PROP_WITH_SCRIPT_EXECUTION_CONTEXT_ATTRIBUTE_RAISES,
-    PROP_SCRIPT_STRING_ATTR,
+    PROP_WITH_SCRIPT_EXECUTION_CONTEXT_AND_SCRIPT_STATE_ATTRIBUTE,
+    PROP_WITH_SCRIPT_EXECUTION_CONTEXT_AND_SCRIPT_STATE_ATTRIBUTE_RAISES,
+    PROP_WITH_SCRIPT_EXECUTION_CONTEXT_AND_SCRIPT_STATE_WITH_SPACES_ATTRIBUTE,
+    PROP_WITH_SCRIPT_ARGUMENTS_AND_CALL_STACK_ATTRIBUTE,
 #if ENABLE(Condition1)
     PROP_CONDITIONAL_ATTR1,
 #endif /* ENABLE(Condition1) */
@@ -1750,9 +1900,29 @@ static void webkit_dom_test_obj_get_property(GObject* object, guint prop_id, GVa
         g_value_set_object(value, WebKit::kit(ptr.get()));
         break;
     }
-    case PROP_SCRIPT_STRING_ATTR:
+    case PROP_WITH_SCRIPT_EXECUTION_CONTEXT_AND_SCRIPT_STATE_ATTRIBUTE:
     {
-        g_value_take_string(value, convertToUTF8String(coreSelf->scriptStringAttr()));
+        RefPtr<WebCore::TestObj> ptr = coreSelf->withScriptExecutionContextAndScriptStateAttribute();
+        g_value_set_object(value, WebKit::kit(ptr.get()));
+        break;
+    }
+    case PROP_WITH_SCRIPT_EXECUTION_CONTEXT_AND_SCRIPT_STATE_ATTRIBUTE_RAISES:
+    {
+        WebCore::ExceptionCode ec = 0;
+        RefPtr<WebCore::TestObj> ptr = coreSelf->withScriptExecutionContextAndScriptStateAttributeRaises(ec);
+        g_value_set_object(value, WebKit::kit(ptr.get()));
+        break;
+    }
+    case PROP_WITH_SCRIPT_EXECUTION_CONTEXT_AND_SCRIPT_STATE_WITH_SPACES_ATTRIBUTE:
+    {
+        RefPtr<WebCore::TestObj> ptr = coreSelf->withScriptExecutionContextAndScriptStateWithSpacesAttribute();
+        g_value_set_object(value, WebKit::kit(ptr.get()));
+        break;
+    }
+    case PROP_WITH_SCRIPT_ARGUMENTS_AND_CALL_STACK_ATTRIBUTE:
+    {
+        RefPtr<WebCore::TestObj> ptr = coreSelf->withScriptArgumentsAndCallStackAttribute();
+        g_value_set_object(value, WebKit::kit(ptr.get()));
         break;
     }
 #if ENABLE(Condition1)
@@ -2064,12 +2234,33 @@ G_MAXLONG, /* max */
                                                            WEBKIT_TYPE_DOM_TEST_OBJ, /* gobject type */
                                                            WEBKIT_PARAM_READWRITE));
     g_object_class_install_property(gobjectClass,
-                                    PROP_SCRIPT_STRING_ATTR,
-                                    g_param_spec_string("script-string-attr", /* name */
-                                                           "test_obj_script-string-attr", /* short description */
-                                                           "read-only  gchar* TestObj.script-string-attr", /* longer - could do with some extra doc stuff here */
-                                                           "", /* default */
-                                                           WEBKIT_PARAM_READABLE));
+                                    PROP_WITH_SCRIPT_EXECUTION_CONTEXT_AND_SCRIPT_STATE_ATTRIBUTE,
+                                    g_param_spec_object("with-script-execution-context-and-script-state-attribute", /* name */
+                                                           "test_obj_with-script-execution-context-and-script-state-attribute", /* short description */
+                                                           "read-write  WebKitDOMTestObj* TestObj.with-script-execution-context-and-script-state-attribute", /* longer - could do with some extra doc stuff here */
+                                                           WEBKIT_TYPE_DOM_TEST_OBJ, /* gobject type */
+                                                           WEBKIT_PARAM_READWRITE));
+    g_object_class_install_property(gobjectClass,
+                                    PROP_WITH_SCRIPT_EXECUTION_CONTEXT_AND_SCRIPT_STATE_ATTRIBUTE_RAISES,
+                                    g_param_spec_object("with-script-execution-context-and-script-state-attribute-raises", /* name */
+                                                           "test_obj_with-script-execution-context-and-script-state-attribute-raises", /* short description */
+                                                           "read-write  WebKitDOMTestObj* TestObj.with-script-execution-context-and-script-state-attribute-raises", /* longer - could do with some extra doc stuff here */
+                                                           WEBKIT_TYPE_DOM_TEST_OBJ, /* gobject type */
+                                                           WEBKIT_PARAM_READWRITE));
+    g_object_class_install_property(gobjectClass,
+                                    PROP_WITH_SCRIPT_EXECUTION_CONTEXT_AND_SCRIPT_STATE_WITH_SPACES_ATTRIBUTE,
+                                    g_param_spec_object("with-script-execution-context-and-script-state-with-spaces-attribute", /* name */
+                                                           "test_obj_with-script-execution-context-and-script-state-with-spaces-attribute", /* short description */
+                                                           "read-write  WebKitDOMTestObj* TestObj.with-script-execution-context-and-script-state-with-spaces-attribute", /* longer - could do with some extra doc stuff here */
+                                                           WEBKIT_TYPE_DOM_TEST_OBJ, /* gobject type */
+                                                           WEBKIT_PARAM_READWRITE));
+    g_object_class_install_property(gobjectClass,
+                                    PROP_WITH_SCRIPT_ARGUMENTS_AND_CALL_STACK_ATTRIBUTE,
+                                    g_param_spec_object("with-script-arguments-and-call-stack-attribute", /* name */
+                                                           "test_obj_with-script-arguments-and-call-stack-attribute", /* short description */
+                                                           "read-write  WebKitDOMTestObj* TestObj.with-script-arguments-and-call-stack-attribute", /* longer - could do with some extra doc stuff here */
+                                                           WEBKIT_TYPE_DOM_TEST_OBJ, /* gobject type */
+                                                           WEBKIT_PARAM_READWRITE));
 #if ENABLE(Condition1)
     g_object_class_install_property(gobjectClass,
                                     PROP_CONDITIONAL_ATTR1,
diff --git a/Source/WebCore/bindings/scripts/test/GObject/WebKitDOMTestObj.h b/Source/WebCore/bindings/scripts/test/GObject/WebKitDOMTestObj.h
index f118dd880..caeb51ffa 100644
--- a/Source/WebCore/bindings/scripts/test/GObject/WebKitDOMTestObj.h
+++ b/Source/WebCore/bindings/scripts/test/GObject/WebKitDOMTestObj.h
@@ -226,6 +226,37 @@ WEBKIT_API void
 webkit_dom_test_obj_with_script_execution_context(WebKitDOMTestObj* self);
 
 /**
+ * webkit_dom_test_obj_with_script_execution_context_and_script_state:
+ * @self: A #WebKitDOMTestObj
+ *
+ * Returns:
+ *
+**/
+WEBKIT_API void
+webkit_dom_test_obj_with_script_execution_context_and_script_state(WebKitDOMTestObj* self);
+
+/**
+ * webkit_dom_test_obj_with_script_execution_context_and_script_state_obj_exception:
+ * @self: A #WebKitDOMTestObj
+ * @error: #GError
+ *
+ * Returns: (transfer none):
+ *
+**/
+WEBKIT_API WebKitDOMTestObj*
+webkit_dom_test_obj_with_script_execution_context_and_script_state_obj_exception(WebKitDOMTestObj* self, GError **error);
+
+/**
+ * webkit_dom_test_obj_with_script_execution_context_and_script_state_with_spaces:
+ * @self: A #WebKitDOMTestObj
+ *
+ * Returns: (transfer none):
+ *
+**/
+WEBKIT_API WebKitDOMTestObj*
+webkit_dom_test_obj_with_script_execution_context_and_script_state_with_spaces(WebKitDOMTestObj* self);
+
+/**
  * webkit_dom_test_obj_method_with_optional_arg:
  * @self: A #WebKitDOMTestObj
  * @opt: A #glong
@@ -262,6 +293,39 @@ WEBKIT_API void
 webkit_dom_test_obj_method_with_non_optional_arg_and_two_optional_args(WebKitDOMTestObj* self, glong non_opt, glong opt1, glong opt2);
 
 /**
+ * webkit_dom_test_obj_method_with_optional_string:
+ * @self: A #WebKitDOMTestObj
+ * @str: A #gchar
+ *
+ * Returns:
+ *
+**/
+WEBKIT_API void
+webkit_dom_test_obj_method_with_optional_string(WebKitDOMTestObj* self, const gchar* str);
+
+/**
+ * webkit_dom_test_obj_method_with_optional_string_is_undefined:
+ * @self: A #WebKitDOMTestObj
+ * @str: A #gchar
+ *
+ * Returns:
+ *
+**/
+WEBKIT_API void
+webkit_dom_test_obj_method_with_optional_string_is_undefined(WebKitDOMTestObj* self, const gchar* str);
+
+/**
+ * webkit_dom_test_obj_method_with_optional_string_is_null_string:
+ * @self: A #WebKitDOMTestObj
+ * @str: A #gchar
+ *
+ * Returns:
+ *
+**/
+WEBKIT_API void
+webkit_dom_test_obj_method_with_optional_string_is_null_string(WebKitDOMTestObj* self, const gchar* str);
+
+/**
  * webkit_dom_test_obj_conditional_method1:
  * @self: A #WebKitDOMTestObj
  *
@@ -1020,14 +1084,69 @@ WEBKIT_API void
 webkit_dom_test_obj_set_with_script_execution_context_attribute_raises(WebKitDOMTestObj* self, WebKitDOMTestObj* value, GError **error);
 
 /**
- * webkit_dom_test_obj_get_script_string_attr:
+ * webkit_dom_test_obj_get_with_script_execution_context_and_script_state_attribute:
  * @self: A #WebKitDOMTestObj
  *
- * Returns:
+ * Returns: (transfer none):
  *
 **/
-WEBKIT_API gchar*
-webkit_dom_test_obj_get_script_string_attr(WebKitDOMTestObj* self);
+WEBKIT_API WebKitDOMTestObj*
+webkit_dom_test_obj_get_with_script_execution_context_and_script_state_attribute(WebKitDOMTestObj* self);
+
+/**
+ * webkit_dom_test_obj_set_with_script_execution_context_and_script_state_attribute:
+ * @self: A #WebKitDOMTestObj
+ * @value: A #WebKitDOMTestObj
+ *
+ * Returns: (transfer none):
+ *
+**/
+WEBKIT_API void
+webkit_dom_test_obj_set_with_script_execution_context_and_script_state_attribute(WebKitDOMTestObj* self, WebKitDOMTestObj* value);
+
+/**
+ * webkit_dom_test_obj_get_with_script_execution_context_and_script_state_attribute_raises:
+ * @self: A #WebKitDOMTestObj
+ * @error: #GError
+ *
+ * Returns: (transfer none):
+ *
+**/
+WEBKIT_API WebKitDOMTestObj*
+webkit_dom_test_obj_get_with_script_execution_context_and_script_state_attribute_raises(WebKitDOMTestObj* self, GError **error);
+
+/**
+ * webkit_dom_test_obj_set_with_script_execution_context_and_script_state_attribute_raises:
+ * @self: A #WebKitDOMTestObj
+ * @value: A #WebKitDOMTestObj
+ * @error: #GError
+ *
+ * Returns: (transfer none):
+ *
+**/
+WEBKIT_API void
+webkit_dom_test_obj_set_with_script_execution_context_and_script_state_attribute_raises(WebKitDOMTestObj* self, WebKitDOMTestObj* value, GError **error);
+
+/**
+ * webkit_dom_test_obj_get_with_script_execution_context_and_script_state_with_spaces_attribute:
+ * @self: A #WebKitDOMTestObj
+ *
+ * Returns: (transfer none):
+ *
+**/
+WEBKIT_API WebKitDOMTestObj*
+webkit_dom_test_obj_get_with_script_execution_context_and_script_state_with_spaces_attribute(WebKitDOMTestObj* self);
+
+/**
+ * webkit_dom_test_obj_set_with_script_execution_context_and_script_state_with_spaces_attribute:
+ * @self: A #WebKitDOMTestObj
+ * @value: A #WebKitDOMTestObj
+ *
+ * Returns: (transfer none):
+ *
+**/
+WEBKIT_API void
+webkit_dom_test_obj_set_with_script_execution_context_and_script_state_with_spaces_attribute(WebKitDOMTestObj* self, WebKitDOMTestObj* value);
 
 /**
  * webkit_dom_test_obj_get_conditional_attr1:
diff --git a/Source/WebCore/bindings/scripts/test/JS/JSFloat64Array.cpp b/Source/WebCore/bindings/scripts/test/JS/JSFloat64Array.cpp
index e2aabcd35..67220b7af 100644
--- a/Source/WebCore/bindings/scripts/test/JS/JSFloat64Array.cpp
+++ b/Source/WebCore/bindings/scripts/test/JS/JSFloat64Array.cpp
@@ -36,8 +36,6 @@ using namespace JSC;
 namespace WebCore {
 
 ASSERT_CLASS_FITS_IN_CELL(JSFloat64Array);
-ASSERT_HAS_TRIVIAL_DESTRUCTOR(JSFloat64Array);
-
 /* Hash table */
 
 static const HashTableValue JSFloat64ArrayTableValues[] =
@@ -55,8 +53,6 @@ static const HashTableValue JSFloat64ArrayConstructorTableValues[] =
 };
 
 static const HashTable JSFloat64ArrayConstructorTable = { 1, 0, JSFloat64ArrayConstructorTableValues, 0 };
-ASSERT_HAS_TRIVIAL_DESTRUCTOR(JSFloat64ArrayConstructor);
-
 const ClassInfo JSFloat64ArrayConstructor::s_info = { "Float64ArrayConstructor", &Base::s_info, &JSFloat64ArrayConstructorTable, 0, CREATE_METHOD_TABLE(JSFloat64ArrayConstructor) };
 
 JSFloat64ArrayConstructor::JSFloat64ArrayConstructor(Structure* structure, JSDOMGlobalObject* globalObject)
@@ -235,7 +231,7 @@ EncodedJSValue JSC_HOST_CALL jsFloat64ArrayPrototypeFunctionFoo(ExecState* exec)
     Float64Array* impl = static_cast<Float64Array*>(castedThis->impl());
     if (exec->argumentCount() < 1)
         return throwVMError(exec, createTypeError(exec, "Not enough arguments"));
-    Float32Array* array(toFloat32Array(MAYBE_MISSING_PARAMETER(exec, 0, MissingIsUndefined)));
+    Float32Array* array(toFloat32Array(MAYBE_MISSING_PARAMETER(exec, 0, DefaultIsUndefined)));
     if (exec->hadException())
         return JSValue::encode(jsUndefined());
 
diff --git a/Source/WebCore/bindings/scripts/test/JS/JSTestActiveDOMObject.cpp b/Source/WebCore/bindings/scripts/test/JS/JSTestActiveDOMObject.cpp
index f886cdda7..6e66849f0 100644
--- a/Source/WebCore/bindings/scripts/test/JS/JSTestActiveDOMObject.cpp
+++ b/Source/WebCore/bindings/scripts/test/JS/JSTestActiveDOMObject.cpp
@@ -33,8 +33,6 @@ using namespace JSC;
 namespace WebCore {
 
 ASSERT_CLASS_FITS_IN_CELL(JSTestActiveDOMObject);
-ASSERT_HAS_TRIVIAL_DESTRUCTOR(JSTestActiveDOMObject);
-
 /* Hash table */
 
 static const HashTableValue JSTestActiveDOMObjectTableValues[] =
@@ -53,8 +51,6 @@ static const HashTableValue JSTestActiveDOMObjectConstructorTableValues[] =
 };
 
 static const HashTable JSTestActiveDOMObjectConstructorTable = { 1, 0, JSTestActiveDOMObjectConstructorTableValues, 0 };
-ASSERT_HAS_TRIVIAL_DESTRUCTOR(JSTestActiveDOMObjectConstructor);
-
 const ClassInfo JSTestActiveDOMObjectConstructor::s_info = { "TestActiveDOMObjectConstructor", &Base::s_info, &JSTestActiveDOMObjectConstructorTable, 0, CREATE_METHOD_TABLE(JSTestActiveDOMObjectConstructor) };
 
 JSTestActiveDOMObjectConstructor::JSTestActiveDOMObjectConstructor(Structure* structure, JSDOMGlobalObject* globalObject)
@@ -130,7 +126,12 @@ JSObject* JSTestActiveDOMObject::createPrototype(ExecState* exec, JSGlobalObject
 void JSTestActiveDOMObject::destroy(JSC::JSCell* cell)
 {
     JSTestActiveDOMObject* thisObject = jsCast<JSTestActiveDOMObject*>(cell);
-    thisObject->releaseImplIfNotNull();
+    thisObject->JSTestActiveDOMObject::~JSTestActiveDOMObject();
+}
+
+JSTestActiveDOMObject::~JSTestActiveDOMObject()
+{
+    releaseImplIfNotNull();
 }
 
 bool JSTestActiveDOMObject::getOwnPropertySlot(JSCell* cell, ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -186,7 +187,7 @@ EncodedJSValue JSC_HOST_CALL jsTestActiveDOMObjectPrototypeFunctionExcitingFunct
     TestActiveDOMObject* impl = static_cast<TestActiveDOMObject*>(castedThis->impl());
     if (exec->argumentCount() < 1)
         return throwVMError(exec, createTypeError(exec, "Not enough arguments"));
-    Node* nextChild(toNode(MAYBE_MISSING_PARAMETER(exec, 0, MissingIsUndefined)));
+    Node* nextChild(toNode(MAYBE_MISSING_PARAMETER(exec, 0, DefaultIsUndefined)));
     if (exec->hadException())
         return JSValue::encode(jsUndefined());
     impl->excitingFunction(nextChild);
@@ -203,7 +204,7 @@ EncodedJSValue JSC_HOST_CALL jsTestActiveDOMObjectPrototypeFunctionPostMessage(E
     TestActiveDOMObject* impl = static_cast<TestActiveDOMObject*>(castedThis->impl());
     if (exec->argumentCount() < 1)
         return throwVMError(exec, createTypeError(exec, "Not enough arguments"));
-    const String& message(ustringToString(MAYBE_MISSING_PARAMETER(exec, 0, MissingIsUndefined).isEmpty() ? UString() : MAYBE_MISSING_PARAMETER(exec, 0, MissingIsUndefined).toString(exec)->value(exec)));
+    const String& message(ustringToString(MAYBE_MISSING_PARAMETER(exec, 0, DefaultIsUndefined).isEmpty() ? UString() : MAYBE_MISSING_PARAMETER(exec, 0, DefaultIsUndefined).toString(exec)->value(exec)));
     if (exec->hadException())
         return JSValue::encode(jsUndefined());
     impl->postMessage(message);
diff --git a/Source/WebCore/bindings/scripts/test/JS/JSTestActiveDOMObject.h b/Source/WebCore/bindings/scripts/test/JS/JSTestActiveDOMObject.h
index bcd224dd2..2a42407a0 100644
--- a/Source/WebCore/bindings/scripts/test/JS/JSTestActiveDOMObject.h
+++ b/Source/WebCore/bindings/scripts/test/JS/JSTestActiveDOMObject.h
@@ -43,6 +43,7 @@ public:
     static bool getOwnPropertySlot(JSC::JSCell*, JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     static bool getOwnPropertyDescriptor(JSC::JSObject*, JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     static void destroy(JSC::JSCell*);
+    ~JSTestActiveDOMObject();
     static const JSC::ClassInfo s_info;
 
     static JSC::Structure* createStructure(JSC::JSGlobalData& globalData, JSC::JSGlobalObject* globalObject, JSC::JSValue prototype)
diff --git a/Source/WebCore/bindings/scripts/test/JS/JSTestCustomNamedGetter.cpp b/Source/WebCore/bindings/scripts/test/JS/JSTestCustomNamedGetter.cpp
index fdf0fa192..aeab46b4c 100644
--- a/Source/WebCore/bindings/scripts/test/JS/JSTestCustomNamedGetter.cpp
+++ b/Source/WebCore/bindings/scripts/test/JS/JSTestCustomNamedGetter.cpp
@@ -33,8 +33,6 @@ using namespace JSC;
 namespace WebCore {
 
 ASSERT_CLASS_FITS_IN_CELL(JSTestCustomNamedGetter);
-ASSERT_HAS_TRIVIAL_DESTRUCTOR(JSTestCustomNamedGetter);
-
 /* Hash table */
 
 static const HashTableValue JSTestCustomNamedGetterTableValues[] =
@@ -52,8 +50,6 @@ static const HashTableValue JSTestCustomNamedGetterConstructorTableValues[] =
 };
 
 static const HashTable JSTestCustomNamedGetterConstructorTable = { 1, 0, JSTestCustomNamedGetterConstructorTableValues, 0 };
-ASSERT_HAS_TRIVIAL_DESTRUCTOR(JSTestCustomNamedGetterConstructor);
-
 const ClassInfo JSTestCustomNamedGetterConstructor::s_info = { "TestCustomNamedGetterConstructor", &Base::s_info, &JSTestCustomNamedGetterConstructorTable, 0, CREATE_METHOD_TABLE(JSTestCustomNamedGetterConstructor) };
 
 JSTestCustomNamedGetterConstructor::JSTestCustomNamedGetterConstructor(Structure* structure, JSDOMGlobalObject* globalObject)
@@ -128,7 +124,12 @@ JSObject* JSTestCustomNamedGetter::createPrototype(ExecState* exec, JSGlobalObje
 void JSTestCustomNamedGetter::destroy(JSC::JSCell* cell)
 {
     JSTestCustomNamedGetter* thisObject = jsCast<JSTestCustomNamedGetter*>(cell);
-    thisObject->releaseImplIfNotNull();
+    thisObject->JSTestCustomNamedGetter::~JSTestCustomNamedGetter();
+}
+
+JSTestCustomNamedGetter::~JSTestCustomNamedGetter()
+{
+    releaseImplIfNotNull();
 }
 
 bool JSTestCustomNamedGetter::getOwnPropertySlot(JSCell* cell, ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -176,7 +177,7 @@ EncodedJSValue JSC_HOST_CALL jsTestCustomNamedGetterPrototypeFunctionAnotherFunc
     TestCustomNamedGetter* impl = static_cast<TestCustomNamedGetter*>(castedThis->impl());
     if (exec->argumentCount() < 1)
         return throwVMError(exec, createTypeError(exec, "Not enough arguments"));
-    const String& str(ustringToString(MAYBE_MISSING_PARAMETER(exec, 0, MissingIsUndefined).isEmpty() ? UString() : MAYBE_MISSING_PARAMETER(exec, 0, MissingIsUndefined).toString(exec)->value(exec)));
+    const String& str(ustringToString(MAYBE_MISSING_PARAMETER(exec, 0, DefaultIsUndefined).isEmpty() ? UString() : MAYBE_MISSING_PARAMETER(exec, 0, DefaultIsUndefined).toString(exec)->value(exec)));
     if (exec->hadException())
         return JSValue::encode(jsUndefined());
     impl->anotherFunction(str);
diff --git a/Source/WebCore/bindings/scripts/test/JS/JSTestCustomNamedGetter.h b/Source/WebCore/bindings/scripts/test/JS/JSTestCustomNamedGetter.h
index f530c8b5c..83b8b4f75 100644
--- a/Source/WebCore/bindings/scripts/test/JS/JSTestCustomNamedGetter.h
+++ b/Source/WebCore/bindings/scripts/test/JS/JSTestCustomNamedGetter.h
@@ -43,6 +43,7 @@ public:
     static bool getOwnPropertySlot(JSC::JSCell*, JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     static bool getOwnPropertyDescriptor(JSC::JSObject*, JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     static void destroy(JSC::JSCell*);
+    ~JSTestCustomNamedGetter();
     static const JSC::ClassInfo s_info;
 
     static JSC::Structure* createStructure(JSC::JSGlobalData& globalData, JSC::JSGlobalObject* globalObject, JSC::JSValue prototype)
diff --git a/Source/WebCore/bindings/scripts/test/JS/JSTestEventConstructor.cpp b/Source/WebCore/bindings/scripts/test/JS/JSTestEventConstructor.cpp
index dbe8e5e30..bd72745ae 100644
--- a/Source/WebCore/bindings/scripts/test/JS/JSTestEventConstructor.cpp
+++ b/Source/WebCore/bindings/scripts/test/JS/JSTestEventConstructor.cpp
@@ -33,8 +33,6 @@ using namespace JSC;
 namespace WebCore {
 
 ASSERT_CLASS_FITS_IN_CELL(JSTestEventConstructor);
-ASSERT_HAS_TRIVIAL_DESTRUCTOR(JSTestEventConstructor);
-
 /* Hash table for constructor */
 
 static const HashTableValue JSTestEventConstructorTableValues[] =
@@ -54,8 +52,6 @@ static const HashTableValue JSTestEventConstructorConstructorTableValues[] =
 };
 
 static const HashTable JSTestEventConstructorConstructorTable = { 1, 0, JSTestEventConstructorConstructorTableValues, 0 };
-ASSERT_HAS_TRIVIAL_DESTRUCTOR(JSTestEventConstructorConstructor);
-
 const ClassInfo JSTestEventConstructorConstructor::s_info = { "TestEventConstructorConstructor", &Base::s_info, &JSTestEventConstructorConstructorTable, 0, CREATE_METHOD_TABLE(JSTestEventConstructorConstructor) };
 
 JSTestEventConstructorConstructor::JSTestEventConstructorConstructor(Structure* structure, JSDOMGlobalObject* globalObject)
@@ -68,6 +64,7 @@ void JSTestEventConstructorConstructor::finishCreation(ExecState* exec, JSDOMGlo
     Base::finishCreation(exec->globalData());
     ASSERT(inherits(&s_info));
     putDirect(exec->globalData(), exec->propertyNames().prototype, JSTestEventConstructorPrototype::self(exec, globalObject), DontDelete | ReadOnly);
+    putDirect(exec->globalData(), exec->propertyNames().length, jsNumber(2), ReadOnly | DontDelete | DontEnum);
 }
 
 bool JSTestEventConstructorConstructor::getOwnPropertySlot(JSCell* cell, ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -161,7 +158,12 @@ JSObject* JSTestEventConstructor::createPrototype(ExecState* exec, JSGlobalObjec
 void JSTestEventConstructor::destroy(JSC::JSCell* cell)
 {
     JSTestEventConstructor* thisObject = jsCast<JSTestEventConstructor*>(cell);
-    thisObject->releaseImplIfNotNull();
+    thisObject->JSTestEventConstructor::~JSTestEventConstructor();
+}
+
+JSTestEventConstructor::~JSTestEventConstructor()
+{
+    releaseImplIfNotNull();
 }
 
 bool JSTestEventConstructor::getOwnPropertySlot(JSCell* cell, ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
diff --git a/Source/WebCore/bindings/scripts/test/JS/JSTestEventConstructor.h b/Source/WebCore/bindings/scripts/test/JS/JSTestEventConstructor.h
index 888ae5d9a..260bdeb3b 100644
--- a/Source/WebCore/bindings/scripts/test/JS/JSTestEventConstructor.h
+++ b/Source/WebCore/bindings/scripts/test/JS/JSTestEventConstructor.h
@@ -45,6 +45,7 @@ public:
     static bool getOwnPropertySlot(JSC::JSCell*, JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     static bool getOwnPropertyDescriptor(JSC::JSObject*, JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     static void destroy(JSC::JSCell*);
+    ~JSTestEventConstructor();
     static const JSC::ClassInfo s_info;
 
     static JSC::Structure* createStructure(JSC::JSGlobalData& globalData, JSC::JSGlobalObject* globalObject, JSC::JSValue prototype)
diff --git a/Source/WebCore/bindings/scripts/test/JS/JSTestEventTarget.cpp b/Source/WebCore/bindings/scripts/test/JS/JSTestEventTarget.cpp
index 9a522f300..157288984 100644
--- a/Source/WebCore/bindings/scripts/test/JS/JSTestEventTarget.cpp
+++ b/Source/WebCore/bindings/scripts/test/JS/JSTestEventTarget.cpp
@@ -39,8 +39,6 @@ using namespace JSC;
 namespace WebCore {
 
 ASSERT_CLASS_FITS_IN_CELL(JSTestEventTarget);
-ASSERT_HAS_TRIVIAL_DESTRUCTOR(JSTestEventTarget);
-
 /* Hash table */
 
 static const HashTableValue JSTestEventTargetTableValues[] =
@@ -58,8 +56,6 @@ static const HashTableValue JSTestEventTargetConstructorTableValues[] =
 };
 
 static const HashTable JSTestEventTargetConstructorTable = { 1, 0, JSTestEventTargetConstructorTableValues, 0 };
-ASSERT_HAS_TRIVIAL_DESTRUCTOR(JSTestEventTargetConstructor);
-
 const ClassInfo JSTestEventTargetConstructor::s_info = { "TestEventTargetConstructor", &Base::s_info, &JSTestEventTargetConstructorTable, 0, CREATE_METHOD_TABLE(JSTestEventTargetConstructor) };
 
 JSTestEventTargetConstructor::JSTestEventTargetConstructor(Structure* structure, JSDOMGlobalObject* globalObject)
@@ -137,7 +133,12 @@ JSObject* JSTestEventTarget::createPrototype(ExecState* exec, JSGlobalObject* gl
 void JSTestEventTarget::destroy(JSC::JSCell* cell)
 {
     JSTestEventTarget* thisObject = jsCast<JSTestEventTarget*>(cell);
-    thisObject->releaseImplIfNotNull();
+    thisObject->JSTestEventTarget::~JSTestEventTarget();
+}
+
+JSTestEventTarget::~JSTestEventTarget()
+{
+    releaseImplIfNotNull();
 }
 
 bool JSTestEventTarget::getOwnPropertySlot(JSCell* cell, ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -231,7 +232,7 @@ EncodedJSValue JSC_HOST_CALL jsTestEventTargetPrototypeFunctionItem(ExecState* e
     TestEventTarget* impl = static_cast<TestEventTarget*>(castedThis->impl());
     if (exec->argumentCount() < 1)
         return throwVMError(exec, createTypeError(exec, "Not enough arguments"));
-    int index(MAYBE_MISSING_PARAMETER(exec, 0, MissingIsUndefined).toUInt32(exec));
+    int index(MAYBE_MISSING_PARAMETER(exec, 0, DefaultIsUndefined).toUInt32(exec));
     if (index < 0) {
         setDOMException(exec, INDEX_SIZE_ERR);
         return JSValue::encode(jsUndefined());
@@ -288,7 +289,7 @@ EncodedJSValue JSC_HOST_CALL jsTestEventTargetPrototypeFunctionDispatchEvent(Exe
     if (exec->argumentCount() < 1)
         return throwVMError(exec, createTypeError(exec, "Not enough arguments"));
     ExceptionCode ec = 0;
-    Event* evt(toEvent(MAYBE_MISSING_PARAMETER(exec, 0, MissingIsUndefined)));
+    Event* evt(toEvent(MAYBE_MISSING_PARAMETER(exec, 0, DefaultIsUndefined)));
     if (exec->hadException())
         return JSValue::encode(jsUndefined());
 
diff --git a/Source/WebCore/bindings/scripts/test/JS/JSTestEventTarget.h b/Source/WebCore/bindings/scripts/test/JS/JSTestEventTarget.h
index 6fd4a3447..48edd5707 100644
--- a/Source/WebCore/bindings/scripts/test/JS/JSTestEventTarget.h
+++ b/Source/WebCore/bindings/scripts/test/JS/JSTestEventTarget.h
@@ -44,6 +44,7 @@ public:
     static bool getOwnPropertyDescriptor(JSC::JSObject*, JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     static bool getOwnPropertySlotByIndex(JSC::JSCell*, JSC::ExecState*, unsigned propertyName, JSC::PropertySlot&);
     static void destroy(JSC::JSCell*);
+    ~JSTestEventTarget();
     static const JSC::ClassInfo s_info;
 
     static JSC::Structure* createStructure(JSC::JSGlobalData& globalData, JSC::JSGlobalObject* globalObject, JSC::JSValue prototype)
diff --git a/Source/WebCore/bindings/scripts/test/JS/JSTestInterface.cpp b/Source/WebCore/bindings/scripts/test/JS/JSTestInterface.cpp
index 476d7250c..c3888e8e8 100644
--- a/Source/WebCore/bindings/scripts/test/JS/JSTestInterface.cpp
+++ b/Source/WebCore/bindings/scripts/test/JS/JSTestInterface.cpp
@@ -35,17 +35,20 @@
 #include <wtf/GetPtr.h>
 
 #if ENABLE(Condition11) || ENABLE(Condition12)
+#include "JSNode.h"
 #include "KURL.h"
 #include <runtime/JSString.h>
 #endif
 
+#if ENABLE(Condition11) || ENABLE(Condition12)
+#include "Node.h"
+#endif
+
 using namespace JSC;
 
 namespace WebCore {
 
 ASSERT_CLASS_FITS_IN_CELL(JSTestInterface);
-ASSERT_HAS_TRIVIAL_DESTRUCTOR(JSTestInterface);
-
 /* Hash table */
 
 static const HashTableValue JSTestInterfaceTableValues[] =
@@ -59,11 +62,14 @@ static const HashTableValue JSTestInterfaceTableValues[] =
 #if ENABLE(Condition11) || ENABLE(Condition12)
     { "supplementalStr3", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsTestInterfaceSupplementalStr3), (intptr_t)setJSTestInterfaceSupplementalStr3, NoIntrinsic },
 #endif
+#if ENABLE(Condition11) || ENABLE(Condition12)
+    { "supplementalNode", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsTestInterfaceSupplementalNode), (intptr_t)setJSTestInterfaceSupplementalNode, NoIntrinsic },
+#endif
     { "constructor", DontEnum | ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsTestInterfaceConstructor), (intptr_t)0, NoIntrinsic },
     { 0, 0, 0, 0, NoIntrinsic }
 };
 
-static const HashTable JSTestInterfaceTable = { 9, 7, JSTestInterfaceTableValues, 0 };
+static const HashTable JSTestInterfaceTable = { 16, 15, JSTestInterfaceTableValues, 0 };
 /* Hash table for constructor */
 
 static const HashTableValue JSTestInterfaceConstructorTableValues[] =
@@ -74,20 +80,21 @@ static const HashTableValue JSTestInterfaceConstructorTableValues[] =
 #if ENABLE(Condition11) || ENABLE(Condition12)
     { "SUPPLEMENTALCONSTANT2", DontDelete | ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsTestInterfaceSUPPLEMENTALCONSTANT2), (intptr_t)0, NoIntrinsic },
 #endif
+#if ENABLE(Condition11) || ENABLE(Condition12)
+    { "supplementalMethod4", DontDelete | JSC::Function, (intptr_t)static_cast<NativeFunction>(jsTestInterfaceConstructorFunctionSupplementalMethod4), (intptr_t)0, NoIntrinsic },
+#endif
     { 0, 0, 0, 0, NoIntrinsic }
 };
 
 static const HashTable JSTestInterfaceConstructorTable = { 4, 3, JSTestInterfaceConstructorTableValues, 0 };
 
 #if ENABLE(Condition11) || ENABLE(Condition12)
-COMPILE_ASSERT(1 == TestInterface::SUPPLEMENTALCONSTANT1, TestInterfaceEnumSUPPLEMENTALCONSTANT1IsWrongUseDoNotCheckConstants);
+COMPILE_ASSERT(1 == TestSupplemental::SUPPLEMENTALCONSTANT1, TestInterfaceEnumSUPPLEMENTALCONSTANT1IsWrongUseDoNotCheckConstants);
 #endif
 #if ENABLE(Condition11) || ENABLE(Condition12)
-COMPILE_ASSERT(2 == TestInterface::CONST_IMPL, TestInterfaceEnumCONST_IMPLIsWrongUseDoNotCheckConstants);
+COMPILE_ASSERT(2 == TestSupplemental::CONST_IMPL, TestInterfaceEnumCONST_IMPLIsWrongUseDoNotCheckConstants);
 #endif
 
-ASSERT_HAS_TRIVIAL_DESTRUCTOR(JSTestInterfaceConstructor);
-
 const ClassInfo JSTestInterfaceConstructor::s_info = { "TestInterfaceConstructor", &Base::s_info, &JSTestInterfaceConstructorTable, 0, CREATE_METHOD_TABLE(JSTestInterfaceConstructor) };
 
 JSTestInterfaceConstructor::JSTestInterfaceConstructor(Structure* structure, JSDOMGlobalObject* globalObject)
@@ -100,16 +107,17 @@ void JSTestInterfaceConstructor::finishCreation(ExecState* exec, JSDOMGlobalObje
     Base::finishCreation(exec->globalData());
     ASSERT(inherits(&s_info));
     putDirect(exec->globalData(), exec->propertyNames().prototype, JSTestInterfacePrototype::self(exec, globalObject), DontDelete | ReadOnly);
+    putDirect(exec->globalData(), exec->propertyNames().length, jsNumber(2), ReadOnly | DontDelete | DontEnum);
 }
 
 bool JSTestInterfaceConstructor::getOwnPropertySlot(JSCell* cell, ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
 {
-    return getStaticValueSlot<JSTestInterfaceConstructor, JSDOMWrapper>(exec, &JSTestInterfaceConstructorTable, static_cast<JSTestInterfaceConstructor*>(cell), propertyName, slot);
+    return getStaticPropertySlot<JSTestInterfaceConstructor, JSDOMWrapper>(exec, &JSTestInterfaceConstructorTable, static_cast<JSTestInterfaceConstructor*>(cell), propertyName, slot);
 }
 
 bool JSTestInterfaceConstructor::getOwnPropertyDescriptor(JSObject* object, ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
 {
-    return getStaticValueDescriptor<JSTestInterfaceConstructor, JSDOMWrapper>(exec, &JSTestInterfaceConstructorTable, static_cast<JSTestInterfaceConstructor*>(object), propertyName, descriptor);
+    return getStaticPropertyDescriptor<JSTestInterfaceConstructor, JSDOMWrapper>(exec, &JSTestInterfaceConstructorTable, static_cast<JSTestInterfaceConstructor*>(object), propertyName, descriptor);
 }
 
 EncodedJSValue JSC_HOST_CALL JSTestInterfaceConstructor::constructJSTestInterface(ExecState* exec)
@@ -118,10 +126,10 @@ EncodedJSValue JSC_HOST_CALL JSTestInterfaceConstructor::constructJSTestInterfac
     if (exec->argumentCount() < 1)
         return throwVMError(exec, createTypeError(exec, "Not enough arguments"));
     ExceptionCode ec = 0;
-    const String& str1(ustringToString(MAYBE_MISSING_PARAMETER(exec, 0, MissingIsUndefined).isEmpty() ? UString() : MAYBE_MISSING_PARAMETER(exec, 0, MissingIsUndefined).toString(exec)->value(exec)));
+    const String& str1(ustringToString(MAYBE_MISSING_PARAMETER(exec, 0, DefaultIsUndefined).isEmpty() ? UString() : MAYBE_MISSING_PARAMETER(exec, 0, DefaultIsUndefined).toString(exec)->value(exec)));
     if (exec->hadException())
         return JSValue::encode(jsUndefined());
-    const String& str2(ustringToString(MAYBE_MISSING_PARAMETER(exec, 1, MissingIsUndefined).isEmpty() ? UString() : MAYBE_MISSING_PARAMETER(exec, 1, MissingIsUndefined).toString(exec)->value(exec)));
+    const String& str2(ustringToString(MAYBE_MISSING_PARAMETER(exec, 1, DefaultIsUndefined).isEmpty() ? UString() : MAYBE_MISSING_PARAMETER(exec, 1, DefaultIsUndefined).toString(exec)->value(exec)));
     if (exec->hadException())
         return JSValue::encode(jsUndefined());
     ScriptExecutionContext* context = jsConstructor->scriptExecutionContext();
@@ -205,7 +213,12 @@ JSObject* JSTestInterface::createPrototype(ExecState* exec, JSGlobalObject* glob
 void JSTestInterface::destroy(JSC::JSCell* cell)
 {
     JSTestInterface* thisObject = jsCast<JSTestInterface*>(cell);
-    thisObject->releaseImplIfNotNull();
+    thisObject->JSTestInterface::~JSTestInterface();
+}
+
+JSTestInterface::~JSTestInterface()
+{
+    releaseImplIfNotNull();
 }
 
 bool JSTestInterface::getOwnPropertySlot(JSCell* cell, ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -255,6 +268,18 @@ JSValue jsTestInterfaceSupplementalStr3(ExecState* exec, JSValue slotBase, const
 
 #endif
 
+#if ENABLE(Condition11) || ENABLE(Condition12)
+JSValue jsTestInterfaceSupplementalNode(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSTestInterface* castedThis = static_cast<JSTestInterface*>(asObject(slotBase));
+    UNUSED_PARAM(exec);
+    TestInterface* impl = static_cast<TestInterface*>(castedThis->impl());
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(TestSupplemental::supplementalNode(impl)));
+    return result;
+}
+
+#endif
+
 JSValue jsTestInterfaceConstructor(ExecState* exec, JSValue slotBase, const Identifier&)
 {
     JSTestInterface* domObject = static_cast<JSTestInterface*>(asObject(slotBase));
@@ -288,6 +313,16 @@ void setJSTestInterfaceSupplementalStr3(ExecState* exec, JSObject* thisObject, J
 
 #endif
 
+#if ENABLE(Condition11) || ENABLE(Condition12)
+void setJSTestInterfaceSupplementalNode(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    JSTestInterface* castedThis = static_cast<JSTestInterface*>(thisObject);
+    TestInterface* impl = static_cast<TestInterface*>(castedThis->impl());
+    TestSupplemental::setSupplementalNode(impl, toNode(value));
+}
+
+#endif
+
 JSValue JSTestInterface::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
 {
     return getDOMConstructor<JSTestInterfaceConstructor>(exec, static_cast<JSDOMGlobalObject*>(globalObject));
@@ -323,10 +358,10 @@ EncodedJSValue JSC_HOST_CALL jsTestInterfacePrototypeFunctionSupplementalMethod2
     ScriptExecutionContext* scriptContext = static_cast<JSDOMGlobalObject*>(exec->lexicalGlobalObject())->scriptExecutionContext();
     if (!scriptContext)
         return JSValue::encode(jsUndefined());
-    const String& strArg(ustringToString(MAYBE_MISSING_PARAMETER(exec, 0, MissingIsUndefined).isEmpty() ? UString() : MAYBE_MISSING_PARAMETER(exec, 0, MissingIsUndefined).toString(exec)->value(exec)));
+    const String& strArg(ustringToString(MAYBE_MISSING_PARAMETER(exec, 0, DefaultIsUndefined).isEmpty() ? UString() : MAYBE_MISSING_PARAMETER(exec, 0, DefaultIsUndefined).toString(exec)->value(exec)));
     if (exec->hadException())
         return JSValue::encode(jsUndefined());
-    TestObj* objArg(toTestObj(MAYBE_MISSING_PARAMETER(exec, 1, MissingIsUndefined)));
+    TestObj* objArg(toTestObj(MAYBE_MISSING_PARAMETER(exec, 1, DefaultIsUndefined)));
     if (exec->hadException())
         return JSValue::encode(jsUndefined());
 
@@ -350,6 +385,15 @@ EncodedJSValue JSC_HOST_CALL jsTestInterfacePrototypeFunctionSupplementalMethod3
 
 #endif
 
+#if ENABLE(Condition11) || ENABLE(Condition12)
+EncodedJSValue JSC_HOST_CALL jsTestInterfaceConstructorFunctionSupplementalMethod4(ExecState* exec)
+{
+    TestSupplemental::supplementalMethod4();
+    return JSValue::encode(jsUndefined());
+}
+
+#endif
+
 // Constant getters
 
 #if ENABLE(Condition11) || ENABLE(Condition12)
diff --git a/Source/WebCore/bindings/scripts/test/JS/JSTestInterface.h b/Source/WebCore/bindings/scripts/test/JS/JSTestInterface.h
index c6f3da952..a0ce24452 100644
--- a/Source/WebCore/bindings/scripts/test/JS/JSTestInterface.h
+++ b/Source/WebCore/bindings/scripts/test/JS/JSTestInterface.h
@@ -47,6 +47,7 @@ public:
     static void put(JSC::JSCell*, JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     bool putDelegate(JSC::ExecState*, const JSC::Identifier&, JSC::JSValue, JSC::PutPropertySlot&);
     static void destroy(JSC::JSCell*);
+    ~JSTestInterface();
     static const JSC::ClassInfo s_info;
 
     static JSC::Structure* createStructure(JSC::JSGlobalData& globalData, JSC::JSGlobalObject* globalObject, JSC::JSValue prototype)
@@ -151,6 +152,7 @@ protected:
 JSC::EncodedJSValue JSC_HOST_CALL jsTestInterfacePrototypeFunctionSupplementalMethod1(JSC::ExecState*);
 JSC::EncodedJSValue JSC_HOST_CALL jsTestInterfacePrototypeFunctionSupplementalMethod2(JSC::ExecState*);
 JSC::EncodedJSValue JSC_HOST_CALL jsTestInterfacePrototypeFunctionSupplementalMethod3(JSC::ExecState*);
+JSC::EncodedJSValue JSC_HOST_CALL jsTestInterfaceConstructorFunctionSupplementalMethod4(JSC::ExecState*);
 // Attributes
 
 JSC::JSValue jsTestInterfaceSupplementalStr1(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
@@ -158,6 +160,8 @@ JSC::JSValue jsTestInterfaceSupplementalStr2(JSC::ExecState*, JSC::JSValue, cons
 void setJSTestInterfaceSupplementalStr2(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
 JSC::JSValue jsTestInterfaceSupplementalStr3(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSTestInterfaceSupplementalStr3(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsTestInterfaceSupplementalNode(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSTestInterfaceSupplementalNode(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
 JSC::JSValue jsTestInterfaceConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 // Constants
 
diff --git a/Source/WebCore/bindings/scripts/test/JS/JSTestMediaQueryListListener.cpp b/Source/WebCore/bindings/scripts/test/JS/JSTestMediaQueryListListener.cpp
index 1a7821fe4..4237cbd3b 100644
--- a/Source/WebCore/bindings/scripts/test/JS/JSTestMediaQueryListListener.cpp
+++ b/Source/WebCore/bindings/scripts/test/JS/JSTestMediaQueryListListener.cpp
@@ -33,8 +33,6 @@ using namespace JSC;
 namespace WebCore {
 
 ASSERT_CLASS_FITS_IN_CELL(JSTestMediaQueryListListener);
-ASSERT_HAS_TRIVIAL_DESTRUCTOR(JSTestMediaQueryListListener);
-
 /* Hash table */
 
 static const HashTableValue JSTestMediaQueryListListenerTableValues[] =
@@ -52,8 +50,6 @@ static const HashTableValue JSTestMediaQueryListListenerConstructorTableValues[]
 };
 
 static const HashTable JSTestMediaQueryListListenerConstructorTable = { 1, 0, JSTestMediaQueryListListenerConstructorTableValues, 0 };
-ASSERT_HAS_TRIVIAL_DESTRUCTOR(JSTestMediaQueryListListenerConstructor);
-
 const ClassInfo JSTestMediaQueryListListenerConstructor::s_info = { "TestMediaQueryListListenerConstructor", &Base::s_info, &JSTestMediaQueryListListenerConstructorTable, 0, CREATE_METHOD_TABLE(JSTestMediaQueryListListenerConstructor) };
 
 JSTestMediaQueryListListenerConstructor::JSTestMediaQueryListListenerConstructor(Structure* structure, JSDOMGlobalObject* globalObject)
@@ -128,7 +124,12 @@ JSObject* JSTestMediaQueryListListener::createPrototype(ExecState* exec, JSGloba
 void JSTestMediaQueryListListener::destroy(JSC::JSCell* cell)
 {
     JSTestMediaQueryListListener* thisObject = jsCast<JSTestMediaQueryListListener*>(cell);
-    thisObject->releaseImplIfNotNull();
+    thisObject->JSTestMediaQueryListListener::~JSTestMediaQueryListListener();
+}
+
+JSTestMediaQueryListListener::~JSTestMediaQueryListListener()
+{
+    releaseImplIfNotNull();
 }
 
 bool JSTestMediaQueryListListener::getOwnPropertySlot(JSCell* cell, ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -166,7 +167,7 @@ EncodedJSValue JSC_HOST_CALL jsTestMediaQueryListListenerPrototypeFunctionMethod
     TestMediaQueryListListener* impl = static_cast<TestMediaQueryListListener*>(castedThis->impl());
     if (exec->argumentCount() < 1)
         return throwVMError(exec, createTypeError(exec, "Not enough arguments"));
-    RefPtr<MediaQueryListListener> listener(MediaQueryListListener::create(ScriptValue(exec->globalData(), MAYBE_MISSING_PARAMETER(exec, 0, MissingIsUndefined))));
+    RefPtr<MediaQueryListListener> listener(MediaQueryListListener::create(ScriptValue(exec->globalData(), MAYBE_MISSING_PARAMETER(exec, 0, DefaultIsUndefined))));
     if (exec->hadException())
         return JSValue::encode(jsUndefined());
     impl->method(listener);
diff --git a/Source/WebCore/bindings/scripts/test/JS/JSTestMediaQueryListListener.h b/Source/WebCore/bindings/scripts/test/JS/JSTestMediaQueryListListener.h
index f03fcb51c..af5bb5800 100644
--- a/Source/WebCore/bindings/scripts/test/JS/JSTestMediaQueryListListener.h
+++ b/Source/WebCore/bindings/scripts/test/JS/JSTestMediaQueryListListener.h
@@ -43,6 +43,7 @@ public:
     static bool getOwnPropertySlot(JSC::JSCell*, JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     static bool getOwnPropertyDescriptor(JSC::JSObject*, JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     static void destroy(JSC::JSCell*);
+    ~JSTestMediaQueryListListener();
     static const JSC::ClassInfo s_info;
 
     static JSC::Structure* createStructure(JSC::JSGlobalData& globalData, JSC::JSGlobalObject* globalObject, JSC::JSValue prototype)
diff --git a/Source/WebCore/bindings/scripts/test/JS/JSTestNamedConstructor.cpp b/Source/WebCore/bindings/scripts/test/JS/JSTestNamedConstructor.cpp
index 147f2c19f..225208dc2 100644
--- a/Source/WebCore/bindings/scripts/test/JS/JSTestNamedConstructor.cpp
+++ b/Source/WebCore/bindings/scripts/test/JS/JSTestNamedConstructor.cpp
@@ -32,8 +32,6 @@ using namespace JSC;
 namespace WebCore {
 
 ASSERT_CLASS_FITS_IN_CELL(JSTestNamedConstructor);
-ASSERT_HAS_TRIVIAL_DESTRUCTOR(JSTestNamedConstructor);
-
 /* Hash table for constructor */
 
 static const HashTableValue JSTestNamedConstructorTableValues[] =
@@ -51,8 +49,6 @@ static const HashTableValue JSTestNamedConstructorConstructorTableValues[] =
 };
 
 static const HashTable JSTestNamedConstructorConstructorTable = { 1, 0, JSTestNamedConstructorConstructorTableValues, 0 };
-ASSERT_HAS_TRIVIAL_DESTRUCTOR(JSTestNamedConstructorConstructor);
-
 const ClassInfo JSTestNamedConstructorConstructor::s_info = { "TestNamedConstructorConstructor", &Base::s_info, &JSTestNamedConstructorConstructorTable, 0, CREATE_METHOD_TABLE(JSTestNamedConstructorConstructor) };
 
 JSTestNamedConstructorConstructor::JSTestNamedConstructorConstructor(Structure* structure, JSDOMGlobalObject* globalObject)
@@ -97,13 +93,13 @@ EncodedJSValue JSC_HOST_CALL JSTestNamedConstructorNamedConstructor::constructJS
     if (exec->argumentCount() < 1)
         return throwVMError(exec, createTypeError(exec, "Not enough arguments"));
     ExceptionCode ec = 0;
-    const String& str1(ustringToString(MAYBE_MISSING_PARAMETER(exec, 0, MissingIsUndefined).isEmpty() ? UString() : MAYBE_MISSING_PARAMETER(exec, 0, MissingIsUndefined).toString(exec)->value(exec)));
+    const String& str1(ustringToString(MAYBE_MISSING_PARAMETER(exec, 0, DefaultIsUndefined).isEmpty() ? UString() : MAYBE_MISSING_PARAMETER(exec, 0, DefaultIsUndefined).toString(exec)->value(exec)));
     if (exec->hadException())
         return JSValue::encode(jsUndefined());
-    const String& str2(ustringToString(MAYBE_MISSING_PARAMETER(exec, 1, MissingIsUndefined).isEmpty() ? UString() : MAYBE_MISSING_PARAMETER(exec, 1, MissingIsUndefined).toString(exec)->value(exec)));
+    const String& str2(ustringToString(MAYBE_MISSING_PARAMETER(exec, 1, DefaultIsUndefined).isEmpty() ? UString() : MAYBE_MISSING_PARAMETER(exec, 1, DefaultIsUndefined).toString(exec)->value(exec)));
     if (exec->hadException())
         return JSValue::encode(jsUndefined());
-    const String& str3(ustringToString(MAYBE_MISSING_PARAMETER(exec, 2, MissingIsEmpty).isEmpty() ? UString() : MAYBE_MISSING_PARAMETER(exec, 2, MissingIsEmpty).toString(exec)->value(exec)));
+    const String& str3(ustringToString(MAYBE_MISSING_PARAMETER(exec, 2, DefaultIsNullString).isEmpty() ? UString() : MAYBE_MISSING_PARAMETER(exec, 2, DefaultIsNullString).toString(exec)->value(exec)));
     if (exec->hadException())
         return JSValue::encode(jsUndefined());
     RefPtr<TestNamedConstructor> object = TestNamedConstructor::createForJSConstructor(jsConstructor->document(), str1, str2, str3, ec);
@@ -157,7 +153,12 @@ JSObject* JSTestNamedConstructor::createPrototype(ExecState* exec, JSGlobalObjec
 void JSTestNamedConstructor::destroy(JSC::JSCell* cell)
 {
     JSTestNamedConstructor* thisObject = jsCast<JSTestNamedConstructor*>(cell);
-    thisObject->releaseImplIfNotNull();
+    thisObject->JSTestNamedConstructor::~JSTestNamedConstructor();
+}
+
+JSTestNamedConstructor::~JSTestNamedConstructor()
+{
+    releaseImplIfNotNull();
 }
 
 bool JSTestNamedConstructor::getOwnPropertySlot(JSCell* cell, ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
diff --git a/Source/WebCore/bindings/scripts/test/JS/JSTestNamedConstructor.h b/Source/WebCore/bindings/scripts/test/JS/JSTestNamedConstructor.h
index 23bb53958..f93f97f2f 100644
--- a/Source/WebCore/bindings/scripts/test/JS/JSTestNamedConstructor.h
+++ b/Source/WebCore/bindings/scripts/test/JS/JSTestNamedConstructor.h
@@ -43,6 +43,7 @@ public:
     static bool getOwnPropertySlot(JSC::JSCell*, JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     static bool getOwnPropertyDescriptor(JSC::JSObject*, JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     static void destroy(JSC::JSCell*);
+    ~JSTestNamedConstructor();
     static const JSC::ClassInfo s_info;
 
     static JSC::Structure* createStructure(JSC::JSGlobalData& globalData, JSC::JSGlobalObject* globalObject, JSC::JSValue prototype)
diff --git a/Source/WebCore/bindings/scripts/test/JS/JSTestObj.cpp b/Source/WebCore/bindings/scripts/test/JS/JSTestObj.cpp
index 98e79b3e0..97dcc8f2f 100644
--- a/Source/WebCore/bindings/scripts/test/JS/JSTestObj.cpp
+++ b/Source/WebCore/bindings/scripts/test/JS/JSTestObj.cpp
@@ -42,7 +42,6 @@
 #include "JSd.h"
 #include "JSe.h"
 #include "JSint.h"
-#include "JSlog.h"
 #include "KURL.h"
 #include "SVGDocument.h"
 #include "SVGStaticPropertyTearOff.h"
@@ -73,8 +72,6 @@ using namespace JSC;
 namespace WebCore {
 
 ASSERT_CLASS_FITS_IN_CELL(JSTestObj);
-ASSERT_HAS_TRIVIAL_DESTRUCTOR(JSTestObj);
-
 /* Hash table */
 
 static const HashTableValue JSTestObjTableValues[] =
@@ -109,7 +106,10 @@ static const HashTableValue JSTestObjTableValues[] =
     { "withScriptExecutionContextAttribute", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsTestObjWithScriptExecutionContextAttribute), (intptr_t)setJSTestObjWithScriptExecutionContextAttribute, NoIntrinsic },
     { "withScriptStateAttributeRaises", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsTestObjWithScriptStateAttributeRaises), (intptr_t)setJSTestObjWithScriptStateAttributeRaises, NoIntrinsic },
     { "withScriptExecutionContextAttributeRaises", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsTestObjWithScriptExecutionContextAttributeRaises), (intptr_t)setJSTestObjWithScriptExecutionContextAttributeRaises, NoIntrinsic },
-    { "scriptStringAttr", DontDelete | ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsTestObjScriptStringAttr), (intptr_t)0, NoIntrinsic },
+    { "withScriptExecutionContextAndScriptStateAttribute", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsTestObjWithScriptExecutionContextAndScriptStateAttribute), (intptr_t)setJSTestObjWithScriptExecutionContextAndScriptStateAttribute, NoIntrinsic },
+    { "withScriptExecutionContextAndScriptStateAttributeRaises", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsTestObjWithScriptExecutionContextAndScriptStateAttributeRaises), (intptr_t)setJSTestObjWithScriptExecutionContextAndScriptStateAttributeRaises, NoIntrinsic },
+    { "withScriptExecutionContextAndScriptStateWithSpacesAttribute", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsTestObjWithScriptExecutionContextAndScriptStateWithSpacesAttribute), (intptr_t)setJSTestObjWithScriptExecutionContextAndScriptStateWithSpacesAttribute, NoIntrinsic },
+    { "withScriptArgumentsAndCallStackAttribute", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsTestObjWithScriptArgumentsAndCallStackAttribute), (intptr_t)setJSTestObjWithScriptArgumentsAndCallStackAttribute, NoIntrinsic },
 #if ENABLE(Condition1)
     { "conditionalAttr1", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsTestObjConditionalAttr1), (intptr_t)setJSTestObjConditionalAttr1, NoIntrinsic },
 #endif
@@ -187,9 +187,7 @@ COMPILE_ASSERT(0X20 == TestObj::CONST_VALUE_13, TestObjEnumCONST_VALUE_13IsWrong
 COMPILE_ASSERT(0x1abc == TestObj::CONST_VALUE_14, TestObjEnumCONST_VALUE_14IsWrongUseDoNotCheckConstants);
 COMPILE_ASSERT(15 == TestObj::CONST_IMPL, TestObjEnumCONST_IMPLIsWrongUseDoNotCheckConstants);
 
-ASSERT_HAS_TRIVIAL_DESTRUCTOR(JSTestObjConstructor);
-
-const ClassInfo JSTestObjConstructor::s_info = { "TestObjConstructor", &Base::s_info, &JSTestObjConstructorTable, 0, CREATE_METHOD_TABLE(JSTestObjConstructor) };
+const ClassInfo JSTestObjConstructor::s_info = { "TestObjectConstructor", &Base::s_info, &JSTestObjConstructorTable, 0, CREATE_METHOD_TABLE(JSTestObjConstructor) };
 
 JSTestObjConstructor::JSTestObjConstructor(Structure* structure, JSDOMGlobalObject* globalObject)
     : DOMConstructorObject(structure, globalObject)
@@ -201,6 +199,7 @@ void JSTestObjConstructor::finishCreation(ExecState* exec, JSDOMGlobalObject* gl
     Base::finishCreation(exec->globalData());
     ASSERT(inherits(&s_info));
     putDirect(exec->globalData(), exec->propertyNames().prototype, JSTestObjPrototype::self(exec, globalObject), DontDelete | ReadOnly);
+    putDirect(exec->globalData(), exec->propertyNames().length, jsNumber(0), ReadOnly | DontDelete | DontEnum);
 }
 
 bool JSTestObjConstructor::getOwnPropertySlot(JSCell* cell, ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -258,7 +257,6 @@ static const HashTableValue JSTestObjPrototypeTableValues[] =
     { "methodWithException", DontDelete | JSC::Function, (intptr_t)static_cast<NativeFunction>(jsTestObjPrototypeFunctionMethodWithException), (intptr_t)0, NoIntrinsic },
     { "customMethod", DontDelete | JSC::Function, (intptr_t)static_cast<NativeFunction>(jsTestObjPrototypeFunctionCustomMethod), (intptr_t)0, NoIntrinsic },
     { "customMethodWithArgs", DontDelete | JSC::Function, (intptr_t)static_cast<NativeFunction>(jsTestObjPrototypeFunctionCustomMethodWithArgs), (intptr_t)3, NoIntrinsic },
-    { "customArgsAndException", DontDelete | JSC::Function, (intptr_t)static_cast<NativeFunction>(jsTestObjPrototypeFunctionCustomArgsAndException), (intptr_t)1, NoIntrinsic },
     { "addEventListener", DontDelete | JSC::Function, (intptr_t)static_cast<NativeFunction>(jsTestObjPrototypeFunctionAddEventListener), (intptr_t)3, NoIntrinsic },
     { "removeEventListener", DontDelete | JSC::Function, (intptr_t)static_cast<NativeFunction>(jsTestObjPrototypeFunctionRemoveEventListener), (intptr_t)3, NoIntrinsic },
     { "withScriptStateVoid", DontDelete | JSC::Function, (intptr_t)static_cast<NativeFunction>(jsTestObjPrototypeFunctionWithScriptStateVoid), (intptr_t)0, NoIntrinsic },
@@ -266,9 +264,16 @@ static const HashTableValue JSTestObjPrototypeTableValues[] =
     { "withScriptStateVoidException", DontDelete | JSC::Function, (intptr_t)static_cast<NativeFunction>(jsTestObjPrototypeFunctionWithScriptStateVoidException), (intptr_t)0, NoIntrinsic },
     { "withScriptStateObjException", DontDelete | JSC::Function, (intptr_t)static_cast<NativeFunction>(jsTestObjPrototypeFunctionWithScriptStateObjException), (intptr_t)0, NoIntrinsic },
     { "withScriptExecutionContext", DontDelete | JSC::Function, (intptr_t)static_cast<NativeFunction>(jsTestObjPrototypeFunctionWithScriptExecutionContext), (intptr_t)0, NoIntrinsic },
+    { "withScriptExecutionContextAndScriptState", DontDelete | JSC::Function, (intptr_t)static_cast<NativeFunction>(jsTestObjPrototypeFunctionWithScriptExecutionContextAndScriptState), (intptr_t)0, NoIntrinsic },
+    { "withScriptExecutionContextAndScriptStateObjException", DontDelete | JSC::Function, (intptr_t)static_cast<NativeFunction>(jsTestObjPrototypeFunctionWithScriptExecutionContextAndScriptStateObjException), (intptr_t)0, NoIntrinsic },
+    { "withScriptExecutionContextAndScriptStateWithSpaces", DontDelete | JSC::Function, (intptr_t)static_cast<NativeFunction>(jsTestObjPrototypeFunctionWithScriptExecutionContextAndScriptStateWithSpaces), (intptr_t)0, NoIntrinsic },
+    { "withScriptArgumentsAndCallStack", DontDelete | JSC::Function, (intptr_t)static_cast<NativeFunction>(jsTestObjPrototypeFunctionWithScriptArgumentsAndCallStack), (intptr_t)0, NoIntrinsic },
     { "methodWithOptionalArg", DontDelete | JSC::Function, (intptr_t)static_cast<NativeFunction>(jsTestObjPrototypeFunctionMethodWithOptionalArg), (intptr_t)1, NoIntrinsic },
     { "methodWithNonOptionalArgAndOptionalArg", DontDelete | JSC::Function, (intptr_t)static_cast<NativeFunction>(jsTestObjPrototypeFunctionMethodWithNonOptionalArgAndOptionalArg), (intptr_t)2, NoIntrinsic },
     { "methodWithNonOptionalArgAndTwoOptionalArgs", DontDelete | JSC::Function, (intptr_t)static_cast<NativeFunction>(jsTestObjPrototypeFunctionMethodWithNonOptionalArgAndTwoOptionalArgs), (intptr_t)3, NoIntrinsic },
+    { "methodWithOptionalString", DontDelete | JSC::Function, (intptr_t)static_cast<NativeFunction>(jsTestObjPrototypeFunctionMethodWithOptionalString), (intptr_t)1, NoIntrinsic },
+    { "methodWithOptionalStringIsUndefined", DontDelete | JSC::Function, (intptr_t)static_cast<NativeFunction>(jsTestObjPrototypeFunctionMethodWithOptionalStringIsUndefined), (intptr_t)1, NoIntrinsic },
+    { "methodWithOptionalStringIsNullString", DontDelete | JSC::Function, (intptr_t)static_cast<NativeFunction>(jsTestObjPrototypeFunctionMethodWithOptionalStringIsNullString), (intptr_t)1, NoIntrinsic },
     { "methodWithCallbackArg", DontDelete | JSC::Function, (intptr_t)static_cast<NativeFunction>(jsTestObjPrototypeFunctionMethodWithCallbackArg), (intptr_t)1, NoIntrinsic },
     { "methodWithNonCallbackArgAndCallbackArg", DontDelete | JSC::Function, (intptr_t)static_cast<NativeFunction>(jsTestObjPrototypeFunctionMethodWithNonCallbackArgAndCallbackArg), (intptr_t)2, NoIntrinsic },
     { "methodWithCallbackAndOptionalArg", DontDelete | JSC::Function, (intptr_t)static_cast<NativeFunction>(jsTestObjPrototypeFunctionMethodWithCallbackAndOptionalArg), (intptr_t)1, NoIntrinsic },
@@ -282,6 +287,7 @@ static const HashTableValue JSTestObjPrototypeTableValues[] =
     { "conditionalMethod3", DontDelete | JSC::Function, (intptr_t)static_cast<NativeFunction>(jsTestObjPrototypeFunctionConditionalMethod3), (intptr_t)0, NoIntrinsic },
 #endif
     { "overloadedMethod", DontDelete | JSC::Function, (intptr_t)static_cast<NativeFunction>(jsTestObjPrototypeFunctionOverloadedMethod), (intptr_t)2, NoIntrinsic },
+    { "methodWithUnsignedLongArray", DontDelete | JSC::Function, (intptr_t)static_cast<NativeFunction>(jsTestObjPrototypeFunctionMethodWithUnsignedLongArray), (intptr_t)1, NoIntrinsic },
     { "getSVGDocument", DontDelete | JSC::Function, (intptr_t)static_cast<NativeFunction>(jsTestObjPrototypeFunctionGetSVGDocument), (intptr_t)0, NoIntrinsic },
     { "convert1", DontDelete | JSC::Function, (intptr_t)static_cast<NativeFunction>(jsTestObjPrototypeFunctionConvert1), (intptr_t)1, NoIntrinsic },
     { "convert2", DontDelete | JSC::Function, (intptr_t)static_cast<NativeFunction>(jsTestObjPrototypeFunctionConvert2), (intptr_t)1, NoIntrinsic },
@@ -295,8 +301,8 @@ static const HashTableValue JSTestObjPrototypeTableValues[] =
     { 0, 0, 0, 0, NoIntrinsic }
 };
 
-static const HashTable JSTestObjPrototypeTable = { 138, 127, JSTestObjPrototypeTableValues, 0 };
-const ClassInfo JSTestObjPrototype::s_info = { "TestObjPrototype", &Base::s_info, &JSTestObjPrototypeTable, 0, CREATE_METHOD_TABLE(JSTestObjPrototype) };
+static const HashTable JSTestObjPrototypeTable = { 266, 255, JSTestObjPrototypeTableValues, 0 };
+const ClassInfo JSTestObjPrototype::s_info = { "TestObjectPrototype", &Base::s_info, &JSTestObjPrototypeTable, 0, CREATE_METHOD_TABLE(JSTestObjPrototype) };
 
 JSObject* JSTestObjPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
@@ -315,7 +321,7 @@ bool JSTestObjPrototype::getOwnPropertyDescriptor(JSObject* object, ExecState* e
     return getStaticPropertyDescriptor<JSTestObjPrototype, JSObject>(exec, &JSTestObjPrototypeTable, thisObject, propertyName, descriptor);
 }
 
-const ClassInfo JSTestObj::s_info = { "TestObj", &Base::s_info, &JSTestObjTable, 0 , CREATE_METHOD_TABLE(JSTestObj) };
+const ClassInfo JSTestObj::s_info = { "TestObject", &Base::s_info, &JSTestObjTable, 0 , CREATE_METHOD_TABLE(JSTestObj) };
 
 JSTestObj::JSTestObj(Structure* structure, JSDOMGlobalObject* globalObject, PassRefPtr<TestObj> impl)
     : JSDOMWrapper(structure, globalObject)
@@ -337,7 +343,12 @@ JSObject* JSTestObj::createPrototype(ExecState* exec, JSGlobalObject* globalObje
 void JSTestObj::destroy(JSC::JSCell* cell)
 {
     JSTestObj* thisObject = jsCast<JSTestObj*>(cell);
-    thisObject->releaseImplIfNotNull();
+    thisObject->JSTestObj::~JSTestObj();
+}
+
+JSTestObj::~JSTestObj()
+{
+    releaseImplIfNotNull();
 }
 
 bool JSTestObj::getOwnPropertySlot(JSCell* cell, ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -659,12 +670,50 @@ JSValue jsTestObjWithScriptExecutionContextAttributeRaises(ExecState* exec, JSVa
 }
 
 
-JSValue jsTestObjScriptStringAttr(ExecState* exec, JSValue slotBase, const Identifier&)
+JSValue jsTestObjWithScriptExecutionContextAndScriptStateAttribute(ExecState* exec, JSValue slotBase, const Identifier&)
 {
     JSTestObj* castedThis = static_cast<JSTestObj*>(asObject(slotBase));
-    UNUSED_PARAM(exec);
+    ScriptExecutionContext* scriptContext = static_cast<JSDOMGlobalObject*>(exec->lexicalGlobalObject())->scriptExecutionContext();
+    if (!scriptContext)
+        return jsUndefined();
+    TestObj* impl = static_cast<TestObj*>(castedThis->impl());
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(impl->withScriptExecutionContextAndScriptStateAttribute(exec, scriptContext)));
+    return result;
+}
+
+
+JSValue jsTestObjWithScriptExecutionContextAndScriptStateAttributeRaises(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSTestObj* castedThis = static_cast<JSTestObj*>(asObject(slotBase));
+    ExceptionCode ec = 0;
+    ScriptExecutionContext* scriptContext = static_cast<JSDOMGlobalObject*>(exec->lexicalGlobalObject())->scriptExecutionContext();
+    if (!scriptContext)
+        return jsUndefined();
+    TestObj* impl = static_cast<TestObj*>(castedThis->impl());
+    JSC::JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(impl->withScriptExecutionContextAndScriptStateAttributeRaises(exec, scriptContext, ec)));
+    setDOMException(exec, ec);
+    return result;
+}
+
+
+JSValue jsTestObjWithScriptExecutionContextAndScriptStateWithSpacesAttribute(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSTestObj* castedThis = static_cast<JSTestObj*>(asObject(slotBase));
+    ScriptExecutionContext* scriptContext = static_cast<JSDOMGlobalObject*>(exec->lexicalGlobalObject())->scriptExecutionContext();
+    if (!scriptContext)
+        return jsUndefined();
+    TestObj* impl = static_cast<TestObj*>(castedThis->impl());
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(impl->withScriptExecutionContextAndScriptStateWithSpacesAttribute(exec, scriptContext)));
+    return result;
+}
+
+
+JSValue jsTestObjWithScriptArgumentsAndCallStackAttribute(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSTestObj* castedThis = static_cast<JSTestObj*>(asObject(slotBase));
+    RefPtr<ScriptCallStack> callStack(createScriptCallStackForInspector(exec));
     TestObj* impl = static_cast<TestObj*>(castedThis->impl());
-    JSValue result = jsOwnedStringOrNull(exec, impl->scriptStringAttr());
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(impl->withScriptArgumentsAndCallStackAttribute(callStack)));
     return result;
 }
 
@@ -1071,6 +1120,50 @@ void setJSTestObjWithScriptExecutionContextAttributeRaises(ExecState* exec, JSOb
 }
 
 
+void setJSTestObjWithScriptExecutionContextAndScriptStateAttribute(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    JSTestObj* castedThis = static_cast<JSTestObj*>(thisObject);
+    TestObj* impl = static_cast<TestObj*>(castedThis->impl());
+    ScriptExecutionContext* scriptContext = static_cast<JSDOMGlobalObject*>(exec->lexicalGlobalObject())->scriptExecutionContext();
+    if (!scriptContext)
+        return;
+    impl->setWithScriptExecutionContextAndScriptStateAttribute(exec, scriptContext, toTestObj(value));
+}
+
+
+void setJSTestObjWithScriptExecutionContextAndScriptStateAttributeRaises(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    JSTestObj* castedThis = static_cast<JSTestObj*>(thisObject);
+    TestObj* impl = static_cast<TestObj*>(castedThis->impl());
+    ExceptionCode ec = 0;
+    ScriptExecutionContext* scriptContext = static_cast<JSDOMGlobalObject*>(exec->lexicalGlobalObject())->scriptExecutionContext();
+    if (!scriptContext)
+        return;
+    impl->setWithScriptExecutionContextAndScriptStateAttributeRaises(exec, scriptContext, toTestObj(value), ec);
+    setDOMException(exec, ec);
+}
+
+
+void setJSTestObjWithScriptExecutionContextAndScriptStateWithSpacesAttribute(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    JSTestObj* castedThis = static_cast<JSTestObj*>(thisObject);
+    TestObj* impl = static_cast<TestObj*>(castedThis->impl());
+    ScriptExecutionContext* scriptContext = static_cast<JSDOMGlobalObject*>(exec->lexicalGlobalObject())->scriptExecutionContext();
+    if (!scriptContext)
+        return;
+    impl->setWithScriptExecutionContextAndScriptStateWithSpacesAttribute(exec, scriptContext, toTestObj(value));
+}
+
+
+void setJSTestObjWithScriptArgumentsAndCallStackAttribute(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    JSTestObj* castedThis = static_cast<JSTestObj*>(thisObject);
+    TestObj* impl = static_cast<TestObj*>(castedThis->impl());
+    RefPtr<ScriptCallStack> callStack(createScriptCallStackForInspector(exec));
+    impl->setWithScriptArgumentsAndCallStackAttribute(callStack, toTestObj(value));
+}
+
+
 #if ENABLE(Condition1)
 void setJSTestObjConditionalAttr1(ExecState* exec, JSObject* thisObject, JSValue value)
 {
@@ -1187,13 +1280,13 @@ EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionVoidMethodWithArgs(ExecSt
     TestObj* impl = static_cast<TestObj*>(castedThis->impl());
     if (exec->argumentCount() < 3)
         return throwVMError(exec, createTypeError(exec, "Not enough arguments"));
-    int intArg(MAYBE_MISSING_PARAMETER(exec, 0, MissingIsUndefined).toInt32(exec));
+    int intArg(MAYBE_MISSING_PARAMETER(exec, 0, DefaultIsUndefined).toInt32(exec));
     if (exec->hadException())
         return JSValue::encode(jsUndefined());
-    const String& strArg(ustringToString(MAYBE_MISSING_PARAMETER(exec, 1, MissingIsUndefined).isEmpty() ? UString() : MAYBE_MISSING_PARAMETER(exec, 1, MissingIsUndefined).toString(exec)->value(exec)));
+    const String& strArg(ustringToString(MAYBE_MISSING_PARAMETER(exec, 1, DefaultIsUndefined).isEmpty() ? UString() : MAYBE_MISSING_PARAMETER(exec, 1, DefaultIsUndefined).toString(exec)->value(exec)));
     if (exec->hadException())
         return JSValue::encode(jsUndefined());
-    TestObj* objArg(toTestObj(MAYBE_MISSING_PARAMETER(exec, 2, MissingIsUndefined)));
+    TestObj* objArg(toTestObj(MAYBE_MISSING_PARAMETER(exec, 2, DefaultIsUndefined)));
     if (exec->hadException())
         return JSValue::encode(jsUndefined());
     impl->voidMethodWithArgs(intArg, strArg, objArg);
@@ -1223,13 +1316,13 @@ EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionIntMethodWithArgs(ExecSta
     TestObj* impl = static_cast<TestObj*>(castedThis->impl());
     if (exec->argumentCount() < 3)
         return throwVMError(exec, createTypeError(exec, "Not enough arguments"));
-    int intArg(MAYBE_MISSING_PARAMETER(exec, 0, MissingIsUndefined).toInt32(exec));
+    int intArg(MAYBE_MISSING_PARAMETER(exec, 0, DefaultIsUndefined).toInt32(exec));
     if (exec->hadException())
         return JSValue::encode(jsUndefined());
-    const String& strArg(ustringToString(MAYBE_MISSING_PARAMETER(exec, 1, MissingIsUndefined).isEmpty() ? UString() : MAYBE_MISSING_PARAMETER(exec, 1, MissingIsUndefined).toString(exec)->value(exec)));
+    const String& strArg(ustringToString(MAYBE_MISSING_PARAMETER(exec, 1, DefaultIsUndefined).isEmpty() ? UString() : MAYBE_MISSING_PARAMETER(exec, 1, DefaultIsUndefined).toString(exec)->value(exec)));
     if (exec->hadException())
         return JSValue::encode(jsUndefined());
-    TestObj* objArg(toTestObj(MAYBE_MISSING_PARAMETER(exec, 2, MissingIsUndefined)));
+    TestObj* objArg(toTestObj(MAYBE_MISSING_PARAMETER(exec, 2, DefaultIsUndefined)));
     if (exec->hadException())
         return JSValue::encode(jsUndefined());
 
@@ -1260,13 +1353,13 @@ EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionObjMethodWithArgs(ExecSta
     TestObj* impl = static_cast<TestObj*>(castedThis->impl());
     if (exec->argumentCount() < 3)
         return throwVMError(exec, createTypeError(exec, "Not enough arguments"));
-    int intArg(MAYBE_MISSING_PARAMETER(exec, 0, MissingIsUndefined).toInt32(exec));
+    int intArg(MAYBE_MISSING_PARAMETER(exec, 0, DefaultIsUndefined).toInt32(exec));
     if (exec->hadException())
         return JSValue::encode(jsUndefined());
-    const String& strArg(ustringToString(MAYBE_MISSING_PARAMETER(exec, 1, MissingIsUndefined).isEmpty() ? UString() : MAYBE_MISSING_PARAMETER(exec, 1, MissingIsUndefined).toString(exec)->value(exec)));
+    const String& strArg(ustringToString(MAYBE_MISSING_PARAMETER(exec, 1, DefaultIsUndefined).isEmpty() ? UString() : MAYBE_MISSING_PARAMETER(exec, 1, DefaultIsUndefined).toString(exec)->value(exec)));
     if (exec->hadException())
         return JSValue::encode(jsUndefined());
-    TestObj* objArg(toTestObj(MAYBE_MISSING_PARAMETER(exec, 2, MissingIsUndefined)));
+    TestObj* objArg(toTestObj(MAYBE_MISSING_PARAMETER(exec, 2, DefaultIsUndefined)));
     if (exec->hadException())
         return JSValue::encode(jsUndefined());
 
@@ -1285,10 +1378,10 @@ EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionMethodThatRequiresAllArgs
     if (exec->argumentCount() < 2)
         return throwVMError(exec, createTypeError(exec, "Not enough arguments"));
     ExceptionCode ec = 0;
-    const String& strArg(ustringToString(MAYBE_MISSING_PARAMETER(exec, 0, MissingIsUndefined).isEmpty() ? UString() : MAYBE_MISSING_PARAMETER(exec, 0, MissingIsUndefined).toString(exec)->value(exec)));
+    const String& strArg(ustringToString(MAYBE_MISSING_PARAMETER(exec, 0, DefaultIsUndefined).isEmpty() ? UString() : MAYBE_MISSING_PARAMETER(exec, 0, DefaultIsUndefined).toString(exec)->value(exec)));
     if (exec->hadException())
         return JSValue::encode(jsUndefined());
-    TestObj* objArg(toTestObj(MAYBE_MISSING_PARAMETER(exec, 1, MissingIsUndefined)));
+    TestObj* objArg(toTestObj(MAYBE_MISSING_PARAMETER(exec, 1, DefaultIsUndefined)));
     if (exec->hadException())
         return JSValue::encode(jsUndefined());
 
@@ -1307,7 +1400,7 @@ EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionSerializedValue(ExecState
     TestObj* impl = static_cast<TestObj*>(castedThis->impl());
     if (exec->argumentCount() < 1)
         return throwVMError(exec, createTypeError(exec, "Not enough arguments"));
-    RefPtr<SerializedScriptValue> serializedArg(SerializedScriptValue::create(exec, MAYBE_MISSING_PARAMETER(exec, 0, MissingIsUndefined)));
+    RefPtr<SerializedScriptValue> serializedArg(SerializedScriptValue::create(exec, MAYBE_MISSING_PARAMETER(exec, 0, DefaultIsUndefined)));
     if (exec->hadException())
         return JSValue::encode(jsUndefined());
     impl->serializedValue(serializedArg);
@@ -1324,7 +1417,7 @@ EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionIdbKey(ExecState* exec)
     TestObj* impl = static_cast<TestObj*>(castedThis->impl());
     if (exec->argumentCount() < 1)
         return throwVMError(exec, createTypeError(exec, "Not enough arguments"));
-    RefPtr<IDBKey> key(createIDBKeyFromValue(exec, MAYBE_MISSING_PARAMETER(exec, 0, MissingIsUndefined)));
+    RefPtr<IDBKey> key(createIDBKeyFromValue(exec, MAYBE_MISSING_PARAMETER(exec, 0, DefaultIsUndefined)));
     if (exec->hadException())
         return JSValue::encode(jsUndefined());
     impl->idbKey(key);
@@ -1341,7 +1434,7 @@ EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionOptionsObject(ExecState*
     TestObj* impl = static_cast<TestObj*>(castedThis->impl());
     if (exec->argumentCount() < 1)
         return throwVMError(exec, createTypeError(exec, "Not enough arguments"));
-    OptionsObject* oo(toOptionsObject(MAYBE_MISSING_PARAMETER(exec, 0, MissingIsUndefined)));
+    OptionsObject* oo(toOptionsObject(MAYBE_MISSING_PARAMETER(exec, 0, DefaultIsUndefined)));
     if (exec->hadException())
         return JSValue::encode(jsUndefined());
 
@@ -1351,7 +1444,7 @@ EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionOptionsObject(ExecState*
         return JSValue::encode(jsUndefined());
     }
 
-    OptionsObject* ooo(toOptionsObject(MAYBE_MISSING_PARAMETER(exec, 1, MissingIsUndefined)));
+    OptionsObject* ooo(toOptionsObject(MAYBE_MISSING_PARAMETER(exec, 1, DefaultIsUndefined)));
     if (exec->hadException())
         return JSValue::encode(jsUndefined());
     impl->optionsObject(oo, ooo);
@@ -1392,27 +1485,6 @@ EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionCustomMethodWithArgs(Exec
     return JSValue::encode(castedThis->customMethodWithArgs(exec));
 }
 
-EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionCustomArgsAndException(ExecState* exec)
-{
-    JSValue thisValue = exec->hostThisValue();
-    if (!thisValue.inherits(&JSTestObj::s_info))
-        return throwVMTypeError(exec);
-    JSTestObj* castedThis = static_cast<JSTestObj*>(asObject(thisValue));
-    ASSERT_GC_OBJECT_INHERITS(castedThis, &JSTestObj::s_info);
-    TestObj* impl = static_cast<TestObj*>(castedThis->impl());
-    if (exec->argumentCount() < 1)
-        return throwVMError(exec, createTypeError(exec, "Not enough arguments"));
-    ExceptionCode ec = 0;
-    RefPtr<ScriptArguments> scriptArguments(createScriptArguments(exec, 1));
-    RefPtr<ScriptCallStack> callStack(createScriptCallStackForInspector(exec));
-    log* intArg(tolog(MAYBE_MISSING_PARAMETER(exec, 0, MissingIsUndefined)));
-    if (exec->hadException())
-        return JSValue::encode(jsUndefined());
-    impl->customArgsAndException(intArg, scriptArguments, callStack, ec);
-    setDOMException(exec, ec);
-    return JSValue::encode(jsUndefined());
-}
-
 EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionAddEventListener(ExecState* exec)
 {
     JSValue thisValue = exec->hostThisValue();
@@ -1520,6 +1592,73 @@ EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionWithScriptExecutionContex
     return JSValue::encode(jsUndefined());
 }
 
+EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionWithScriptExecutionContextAndScriptState(ExecState* exec)
+{
+    JSValue thisValue = exec->hostThisValue();
+    if (!thisValue.inherits(&JSTestObj::s_info))
+        return throwVMTypeError(exec);
+    JSTestObj* castedThis = static_cast<JSTestObj*>(asObject(thisValue));
+    ASSERT_GC_OBJECT_INHERITS(castedThis, &JSTestObj::s_info);
+    TestObj* impl = static_cast<TestObj*>(castedThis->impl());
+    ScriptExecutionContext* scriptContext = static_cast<JSDOMGlobalObject*>(exec->lexicalGlobalObject())->scriptExecutionContext();
+    if (!scriptContext)
+        return JSValue::encode(jsUndefined());
+    impl->withScriptExecutionContextAndScriptState(exec, scriptContext);
+    return JSValue::encode(jsUndefined());
+}
+
+EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionWithScriptExecutionContextAndScriptStateObjException(ExecState* exec)
+{
+    JSValue thisValue = exec->hostThisValue();
+    if (!thisValue.inherits(&JSTestObj::s_info))
+        return throwVMTypeError(exec);
+    JSTestObj* castedThis = static_cast<JSTestObj*>(asObject(thisValue));
+    ASSERT_GC_OBJECT_INHERITS(castedThis, &JSTestObj::s_info);
+    TestObj* impl = static_cast<TestObj*>(castedThis->impl());
+    ExceptionCode ec = 0;
+    ScriptExecutionContext* scriptContext = static_cast<JSDOMGlobalObject*>(exec->lexicalGlobalObject())->scriptExecutionContext();
+    if (!scriptContext)
+        return JSValue::encode(jsUndefined());
+
+    JSC::JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(impl->withScriptExecutionContextAndScriptStateObjException(exec, scriptContext, ec)));
+    setDOMException(exec, ec);
+    if (exec->hadException())
+        return JSValue::encode(jsUndefined());
+    return JSValue::encode(result);
+}
+
+EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionWithScriptExecutionContextAndScriptStateWithSpaces(ExecState* exec)
+{
+    JSValue thisValue = exec->hostThisValue();
+    if (!thisValue.inherits(&JSTestObj::s_info))
+        return throwVMTypeError(exec);
+    JSTestObj* castedThis = static_cast<JSTestObj*>(asObject(thisValue));
+    ASSERT_GC_OBJECT_INHERITS(castedThis, &JSTestObj::s_info);
+    TestObj* impl = static_cast<TestObj*>(castedThis->impl());
+    ScriptExecutionContext* scriptContext = static_cast<JSDOMGlobalObject*>(exec->lexicalGlobalObject())->scriptExecutionContext();
+    if (!scriptContext)
+        return JSValue::encode(jsUndefined());
+
+    JSC::JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(impl->withScriptExecutionContextAndScriptStateWithSpaces(exec, scriptContext)));
+    if (exec->hadException())
+        return JSValue::encode(jsUndefined());
+    return JSValue::encode(result);
+}
+
+EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionWithScriptArgumentsAndCallStack(ExecState* exec)
+{
+    JSValue thisValue = exec->hostThisValue();
+    if (!thisValue.inherits(&JSTestObj::s_info))
+        return throwVMTypeError(exec);
+    JSTestObj* castedThis = static_cast<JSTestObj*>(asObject(thisValue));
+    ASSERT_GC_OBJECT_INHERITS(castedThis, &JSTestObj::s_info);
+    TestObj* impl = static_cast<TestObj*>(castedThis->impl());
+    RefPtr<ScriptArguments> scriptArguments(createScriptArguments(exec, 0));
+    RefPtr<ScriptCallStack> callStack(createScriptCallStackForInspector(exec));
+    impl->withScriptArgumentsAndCallStack(scriptArguments, callStack);
+    return JSValue::encode(jsUndefined());
+}
+
 EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionMethodWithOptionalArg(ExecState* exec)
 {
     JSValue thisValue = exec->hostThisValue();
@@ -1535,7 +1674,7 @@ EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionMethodWithOptionalArg(Exe
         return JSValue::encode(jsUndefined());
     }
 
-    int opt(MAYBE_MISSING_PARAMETER(exec, 0, MissingIsUndefined).toInt32(exec));
+    int opt(MAYBE_MISSING_PARAMETER(exec, 0, DefaultIsUndefined).toInt32(exec));
     if (exec->hadException())
         return JSValue::encode(jsUndefined());
     impl->methodWithOptionalArg(opt);
@@ -1552,7 +1691,7 @@ EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionMethodWithNonOptionalArgA
     TestObj* impl = static_cast<TestObj*>(castedThis->impl());
     if (exec->argumentCount() < 1)
         return throwVMError(exec, createTypeError(exec, "Not enough arguments"));
-    int nonOpt(MAYBE_MISSING_PARAMETER(exec, 0, MissingIsUndefined).toInt32(exec));
+    int nonOpt(MAYBE_MISSING_PARAMETER(exec, 0, DefaultIsUndefined).toInt32(exec));
     if (exec->hadException())
         return JSValue::encode(jsUndefined());
 
@@ -1562,7 +1701,7 @@ EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionMethodWithNonOptionalArgA
         return JSValue::encode(jsUndefined());
     }
 
-    int opt(MAYBE_MISSING_PARAMETER(exec, 1, MissingIsUndefined).toInt32(exec));
+    int opt(MAYBE_MISSING_PARAMETER(exec, 1, DefaultIsUndefined).toInt32(exec));
     if (exec->hadException())
         return JSValue::encode(jsUndefined());
     impl->methodWithNonOptionalArgAndOptionalArg(nonOpt, opt);
@@ -1579,7 +1718,7 @@ EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionMethodWithNonOptionalArgA
     TestObj* impl = static_cast<TestObj*>(castedThis->impl());
     if (exec->argumentCount() < 1)
         return throwVMError(exec, createTypeError(exec, "Not enough arguments"));
-    int nonOpt(MAYBE_MISSING_PARAMETER(exec, 0, MissingIsUndefined).toInt32(exec));
+    int nonOpt(MAYBE_MISSING_PARAMETER(exec, 0, DefaultIsUndefined).toInt32(exec));
     if (exec->hadException())
         return JSValue::encode(jsUndefined());
 
@@ -1589,7 +1728,7 @@ EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionMethodWithNonOptionalArgA
         return JSValue::encode(jsUndefined());
     }
 
-    int opt1(MAYBE_MISSING_PARAMETER(exec, 1, MissingIsUndefined).toInt32(exec));
+    int opt1(MAYBE_MISSING_PARAMETER(exec, 1, DefaultIsUndefined).toInt32(exec));
     if (exec->hadException())
         return JSValue::encode(jsUndefined());
     if (argsCount <= 2) {
@@ -1597,13 +1736,65 @@ EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionMethodWithNonOptionalArgA
         return JSValue::encode(jsUndefined());
     }
 
-    int opt2(MAYBE_MISSING_PARAMETER(exec, 2, MissingIsUndefined).toInt32(exec));
+    int opt2(MAYBE_MISSING_PARAMETER(exec, 2, DefaultIsUndefined).toInt32(exec));
     if (exec->hadException())
         return JSValue::encode(jsUndefined());
     impl->methodWithNonOptionalArgAndTwoOptionalArgs(nonOpt, opt1, opt2);
     return JSValue::encode(jsUndefined());
 }
 
+EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionMethodWithOptionalString(ExecState* exec)
+{
+    JSValue thisValue = exec->hostThisValue();
+    if (!thisValue.inherits(&JSTestObj::s_info))
+        return throwVMTypeError(exec);
+    JSTestObj* castedThis = static_cast<JSTestObj*>(asObject(thisValue));
+    ASSERT_GC_OBJECT_INHERITS(castedThis, &JSTestObj::s_info);
+    TestObj* impl = static_cast<TestObj*>(castedThis->impl());
+
+    size_t argsCount = exec->argumentCount();
+    if (argsCount <= 0) {
+        impl->methodWithOptionalString();
+        return JSValue::encode(jsUndefined());
+    }
+
+    const String& str(ustringToString(MAYBE_MISSING_PARAMETER(exec, 0, DefaultIsUndefined).isEmpty() ? UString() : MAYBE_MISSING_PARAMETER(exec, 0, DefaultIsUndefined).toString(exec)->value(exec)));
+    if (exec->hadException())
+        return JSValue::encode(jsUndefined());
+    impl->methodWithOptionalString(str);
+    return JSValue::encode(jsUndefined());
+}
+
+EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionMethodWithOptionalStringIsUndefined(ExecState* exec)
+{
+    JSValue thisValue = exec->hostThisValue();
+    if (!thisValue.inherits(&JSTestObj::s_info))
+        return throwVMTypeError(exec);
+    JSTestObj* castedThis = static_cast<JSTestObj*>(asObject(thisValue));
+    ASSERT_GC_OBJECT_INHERITS(castedThis, &JSTestObj::s_info);
+    TestObj* impl = static_cast<TestObj*>(castedThis->impl());
+    const String& str(ustringToString(MAYBE_MISSING_PARAMETER(exec, 0, DefaultIsUndefined).isEmpty() ? UString() : MAYBE_MISSING_PARAMETER(exec, 0, DefaultIsUndefined).toString(exec)->value(exec)));
+    if (exec->hadException())
+        return JSValue::encode(jsUndefined());
+    impl->methodWithOptionalStringIsUndefined(str);
+    return JSValue::encode(jsUndefined());
+}
+
+EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionMethodWithOptionalStringIsNullString(ExecState* exec)
+{
+    JSValue thisValue = exec->hostThisValue();
+    if (!thisValue.inherits(&JSTestObj::s_info))
+        return throwVMTypeError(exec);
+    JSTestObj* castedThis = static_cast<JSTestObj*>(asObject(thisValue));
+    ASSERT_GC_OBJECT_INHERITS(castedThis, &JSTestObj::s_info);
+    TestObj* impl = static_cast<TestObj*>(castedThis->impl());
+    const String& str(ustringToString(MAYBE_MISSING_PARAMETER(exec, 0, DefaultIsNullString).isEmpty() ? UString() : MAYBE_MISSING_PARAMETER(exec, 0, DefaultIsNullString).toString(exec)->value(exec)));
+    if (exec->hadException())
+        return JSValue::encode(jsUndefined());
+    impl->methodWithOptionalStringIsNullString(str);
+    return JSValue::encode(jsUndefined());
+}
+
 EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionMethodWithCallbackArg(ExecState* exec)
 {
     JSValue thisValue = exec->hostThisValue();
@@ -1633,7 +1824,7 @@ EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionMethodWithNonCallbackArgA
     TestObj* impl = static_cast<TestObj*>(castedThis->impl());
     if (exec->argumentCount() < 2)
         return throwVMError(exec, createTypeError(exec, "Not enough arguments"));
-    int nonCallback(MAYBE_MISSING_PARAMETER(exec, 0, MissingIsUndefined).toInt32(exec));
+    int nonCallback(MAYBE_MISSING_PARAMETER(exec, 0, DefaultIsUndefined).toInt32(exec));
     if (exec->hadException())
         return JSValue::encode(jsUndefined());
     if (exec->argumentCount() <= 1 || !exec->argument(1).isObject()) {
@@ -1721,10 +1912,10 @@ static EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionOverloadedMethod1(
     TestObj* impl = static_cast<TestObj*>(castedThis->impl());
     if (exec->argumentCount() < 2)
         return throwVMError(exec, createTypeError(exec, "Not enough arguments"));
-    TestObj* objArg(toTestObj(MAYBE_MISSING_PARAMETER(exec, 0, MissingIsUndefined)));
+    TestObj* objArg(toTestObj(MAYBE_MISSING_PARAMETER(exec, 0, DefaultIsUndefined)));
     if (exec->hadException())
         return JSValue::encode(jsUndefined());
-    const String& strArg(ustringToString(MAYBE_MISSING_PARAMETER(exec, 1, MissingIsUndefined).isEmpty() ? UString() : MAYBE_MISSING_PARAMETER(exec, 1, MissingIsUndefined).toString(exec)->value(exec)));
+    const String& strArg(ustringToString(MAYBE_MISSING_PARAMETER(exec, 1, DefaultIsUndefined).isEmpty() ? UString() : MAYBE_MISSING_PARAMETER(exec, 1, DefaultIsUndefined).toString(exec)->value(exec)));
     if (exec->hadException())
         return JSValue::encode(jsUndefined());
     impl->overloadedMethod(objArg, strArg);
@@ -1741,7 +1932,7 @@ static EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionOverloadedMethod2(
     TestObj* impl = static_cast<TestObj*>(castedThis->impl());
     if (exec->argumentCount() < 1)
         return throwVMError(exec, createTypeError(exec, "Not enough arguments"));
-    TestObj* objArg(toTestObj(MAYBE_MISSING_PARAMETER(exec, 0, MissingIsUndefined)));
+    TestObj* objArg(toTestObj(MAYBE_MISSING_PARAMETER(exec, 0, DefaultIsUndefined)));
     if (exec->hadException())
         return JSValue::encode(jsUndefined());
 
@@ -1751,7 +1942,7 @@ static EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionOverloadedMethod2(
         return JSValue::encode(jsUndefined());
     }
 
-    int intArg(MAYBE_MISSING_PARAMETER(exec, 1, MissingIsUndefined).toInt32(exec));
+    int intArg(MAYBE_MISSING_PARAMETER(exec, 1, DefaultIsUndefined).toInt32(exec));
     if (exec->hadException())
         return JSValue::encode(jsUndefined());
     impl->overloadedMethod(objArg, intArg);
@@ -1768,7 +1959,7 @@ static EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionOverloadedMethod3(
     TestObj* impl = static_cast<TestObj*>(castedThis->impl());
     if (exec->argumentCount() < 1)
         return throwVMError(exec, createTypeError(exec, "Not enough arguments"));
-    const String& strArg(ustringToString(MAYBE_MISSING_PARAMETER(exec, 0, MissingIsUndefined).isEmpty() ? UString() : MAYBE_MISSING_PARAMETER(exec, 0, MissingIsUndefined).toString(exec)->value(exec)));
+    const String& strArg(ustringToString(MAYBE_MISSING_PARAMETER(exec, 0, DefaultIsUndefined).isEmpty() ? UString() : MAYBE_MISSING_PARAMETER(exec, 0, DefaultIsUndefined).toString(exec)->value(exec)));
     if (exec->hadException())
         return JSValue::encode(jsUndefined());
     impl->overloadedMethod(strArg);
@@ -1785,7 +1976,7 @@ static EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionOverloadedMethod4(
     TestObj* impl = static_cast<TestObj*>(castedThis->impl());
     if (exec->argumentCount() < 1)
         return throwVMError(exec, createTypeError(exec, "Not enough arguments"));
-    int intArg(MAYBE_MISSING_PARAMETER(exec, 0, MissingIsUndefined).toInt32(exec));
+    int intArg(MAYBE_MISSING_PARAMETER(exec, 0, DefaultIsUndefined).toInt32(exec));
     if (exec->hadException())
         return JSValue::encode(jsUndefined());
     impl->overloadedMethod(intArg);
@@ -1821,7 +2012,7 @@ static EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionOverloadedMethod6(
     TestObj* impl = static_cast<TestObj*>(castedThis->impl());
     if (exec->argumentCount() < 1)
         return throwVMError(exec, createTypeError(exec, "Not enough arguments"));
-    DOMStringList* listArg(toDOMStringList(MAYBE_MISSING_PARAMETER(exec, 0, MissingIsUndefined)));
+    DOMStringList* listArg(toDOMStringList(MAYBE_MISSING_PARAMETER(exec, 0, DefaultIsUndefined)));
     if (exec->hadException())
         return JSValue::encode(jsUndefined());
     impl->overloadedMethod(listArg);
@@ -1838,7 +2029,7 @@ static EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionOverloadedMethod7(
     TestObj* impl = static_cast<TestObj*>(castedThis->impl());
     if (exec->argumentCount() < 1)
         return throwVMError(exec, createTypeError(exec, "Not enough arguments"));
-    DOMStringList* arrayArg(toDOMStringList(MAYBE_MISSING_PARAMETER(exec, 0, MissingIsUndefined)));
+    DOMStringList* arrayArg(toDOMStringList(MAYBE_MISSING_PARAMETER(exec, 0, DefaultIsUndefined)));
     if (exec->hadException())
         return JSValue::encode(jsUndefined());
     impl->overloadedMethod(arrayArg);
@@ -1883,7 +2074,7 @@ EncodedJSValue JSC_HOST_CALL jsTestObjConstructorFunctionClassMethodWithOptional
         return JSValue::encode(result);
     }
 
-    int arg(MAYBE_MISSING_PARAMETER(exec, 0, MissingIsUndefined).toInt32(exec));
+    int arg(MAYBE_MISSING_PARAMETER(exec, 0, DefaultIsUndefined).toInt32(exec));
     if (exec->hadException())
         return JSValue::encode(jsUndefined());
 
@@ -1896,7 +2087,7 @@ static EncodedJSValue JSC_HOST_CALL jsTestObjConstructorFunctionOverloadedMethod
 {
     if (exec->argumentCount() < 1)
         return throwVMError(exec, createTypeError(exec, "Not enough arguments"));
-    int arg(MAYBE_MISSING_PARAMETER(exec, 0, MissingIsUndefined).toInt32(exec));
+    int arg(MAYBE_MISSING_PARAMETER(exec, 0, DefaultIsUndefined).toInt32(exec));
     if (exec->hadException())
         return JSValue::encode(jsUndefined());
     TestObj::overloadedMethod1(arg);
@@ -1910,7 +2101,7 @@ static EncodedJSValue JSC_HOST_CALL jsTestObjConstructorFunctionOverloadedMethod
 {
     if (exec->argumentCount() < 1)
         return throwVMError(exec, createTypeError(exec, "Not enough arguments"));
-    const String& type(ustringToString(MAYBE_MISSING_PARAMETER(exec, 0, MissingIsUndefined).isEmpty() ? UString() : MAYBE_MISSING_PARAMETER(exec, 0, MissingIsUndefined).toString(exec)->value(exec)));
+    const String& type(ustringToString(MAYBE_MISSING_PARAMETER(exec, 0, DefaultIsUndefined).isEmpty() ? UString() : MAYBE_MISSING_PARAMETER(exec, 0, DefaultIsUndefined).toString(exec)->value(exec)));
     if (exec->hadException())
         return JSValue::encode(jsUndefined());
     TestObj::overloadedMethod1(type);
@@ -1930,6 +2121,23 @@ EncodedJSValue JSC_HOST_CALL jsTestObjConstructorFunctionOverloadedMethod1(ExecS
 
 #endif
 
+EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionMethodWithUnsignedLongArray(ExecState* exec)
+{
+    JSValue thisValue = exec->hostThisValue();
+    if (!thisValue.inherits(&JSTestObj::s_info))
+        return throwVMTypeError(exec);
+    JSTestObj* castedThis = static_cast<JSTestObj*>(asObject(thisValue));
+    ASSERT_GC_OBJECT_INHERITS(castedThis, &JSTestObj::s_info);
+    TestObj* impl = static_cast<TestObj*>(castedThis->impl());
+    if (exec->argumentCount() < 1)
+        return throwVMError(exec, createTypeError(exec, "Not enough arguments"));
+    Vector<unsigned long> unsignedLongArray(jsUnsignedLongArrayToVector(exec, MAYBE_MISSING_PARAMETER(exec, 0, DefaultIsUndefined)));
+    if (exec->hadException())
+        return JSValue::encode(jsUndefined());
+    impl->methodWithUnsignedLongArray(unsignedLongArray);
+    return JSValue::encode(jsUndefined());
+}
+
 EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionGetSVGDocument(ExecState* exec)
 {
     JSValue thisValue = exec->hostThisValue();
@@ -1957,7 +2165,7 @@ EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionConvert1(ExecState* exec)
     TestObj* impl = static_cast<TestObj*>(castedThis->impl());
     if (exec->argumentCount() < 1)
         return throwVMError(exec, createTypeError(exec, "Not enough arguments"));
-    a* (toa(MAYBE_MISSING_PARAMETER(exec, 0, MissingIsUndefined)));
+    a* (toa(MAYBE_MISSING_PARAMETER(exec, 0, DefaultIsUndefined)));
     if (exec->hadException())
         return JSValue::encode(jsUndefined());
     impl->convert1();
@@ -1974,7 +2182,7 @@ EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionConvert2(ExecState* exec)
     TestObj* impl = static_cast<TestObj*>(castedThis->impl());
     if (exec->argumentCount() < 1)
         return throwVMError(exec, createTypeError(exec, "Not enough arguments"));
-    b* (tob(MAYBE_MISSING_PARAMETER(exec, 0, MissingIsUndefined)));
+    b* (tob(MAYBE_MISSING_PARAMETER(exec, 0, DefaultIsUndefined)));
     if (exec->hadException())
         return JSValue::encode(jsUndefined());
     impl->convert2();
@@ -1991,7 +2199,7 @@ EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionConvert3(ExecState* exec)
     TestObj* impl = static_cast<TestObj*>(castedThis->impl());
     if (exec->argumentCount() < 1)
         return throwVMError(exec, createTypeError(exec, "Not enough arguments"));
-    c* (toc(MAYBE_MISSING_PARAMETER(exec, 0, MissingIsUndefined)));
+    c* (toc(MAYBE_MISSING_PARAMETER(exec, 0, DefaultIsUndefined)));
     if (exec->hadException())
         return JSValue::encode(jsUndefined());
     impl->convert3();
@@ -2008,7 +2216,7 @@ EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionConvert4(ExecState* exec)
     TestObj* impl = static_cast<TestObj*>(castedThis->impl());
     if (exec->argumentCount() < 1)
         return throwVMError(exec, createTypeError(exec, "Not enough arguments"));
-    d* (tod(MAYBE_MISSING_PARAMETER(exec, 0, MissingIsUndefined)));
+    d* (tod(MAYBE_MISSING_PARAMETER(exec, 0, DefaultIsUndefined)));
     if (exec->hadException())
         return JSValue::encode(jsUndefined());
     impl->convert4();
@@ -2025,7 +2233,7 @@ EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionConvert5(ExecState* exec)
     TestObj* impl = static_cast<TestObj*>(castedThis->impl());
     if (exec->argumentCount() < 1)
         return throwVMError(exec, createTypeError(exec, "Not enough arguments"));
-    e* (toe(MAYBE_MISSING_PARAMETER(exec, 0, MissingIsUndefined)));
+    e* (toe(MAYBE_MISSING_PARAMETER(exec, 0, DefaultIsUndefined)));
     if (exec->hadException())
         return JSValue::encode(jsUndefined());
     impl->convert5();
@@ -2081,15 +2289,15 @@ EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionStrictFunction(ExecState*
     if (exec->argumentCount() < 3)
         return throwVMError(exec, createTypeError(exec, "Not enough arguments"));
     ExceptionCode ec = 0;
-    const String& str(ustringToString(MAYBE_MISSING_PARAMETER(exec, 0, MissingIsUndefined).isEmpty() ? UString() : MAYBE_MISSING_PARAMETER(exec, 0, MissingIsUndefined).toString(exec)->value(exec)));
+    const String& str(ustringToString(MAYBE_MISSING_PARAMETER(exec, 0, DefaultIsUndefined).isEmpty() ? UString() : MAYBE_MISSING_PARAMETER(exec, 0, DefaultIsUndefined).toString(exec)->value(exec)));
     if (exec->hadException())
         return JSValue::encode(jsUndefined());
-    float a(MAYBE_MISSING_PARAMETER(exec, 1, MissingIsUndefined).toFloat(exec));
+    float a(MAYBE_MISSING_PARAMETER(exec, 1, DefaultIsUndefined).toFloat(exec));
     if (exec->hadException())
         return JSValue::encode(jsUndefined());
     if (exec->argumentCount() > 2 && !exec->argument(2).isUndefinedOrNull() && !exec->argument(2).inherits(&JSint::s_info))
         return throwVMTypeError(exec);
-    int* b(toint(MAYBE_MISSING_PARAMETER(exec, 2, MissingIsUndefined)));
+    int* b(toint(MAYBE_MISSING_PARAMETER(exec, 2, DefaultIsUndefined)));
     if (exec->hadException())
         return JSValue::encode(jsUndefined());
 
diff --git a/Source/WebCore/bindings/scripts/test/JS/JSTestObj.h b/Source/WebCore/bindings/scripts/test/JS/JSTestObj.h
index 89cc93226..cb9dafb6d 100644
--- a/Source/WebCore/bindings/scripts/test/JS/JSTestObj.h
+++ b/Source/WebCore/bindings/scripts/test/JS/JSTestObj.h
@@ -44,6 +44,7 @@ public:
     static bool getOwnPropertyDescriptor(JSC::JSObject*, JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     static void put(JSC::JSCell*, JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     static void destroy(JSC::JSCell*);
+    ~JSTestObj();
     static const JSC::ClassInfo s_info;
 
     static JSC::Structure* createStructure(JSC::JSGlobalData& globalData, JSC::JSGlobalObject* globalObject, JSC::JSValue prototype)
@@ -163,7 +164,6 @@ JSC::EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionOptionsObject(JSC::E
 JSC::EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionMethodWithException(JSC::ExecState*);
 JSC::EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionCustomMethod(JSC::ExecState*);
 JSC::EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionCustomMethodWithArgs(JSC::ExecState*);
-JSC::EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionCustomArgsAndException(JSC::ExecState*);
 JSC::EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionAddEventListener(JSC::ExecState*);
 JSC::EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionRemoveEventListener(JSC::ExecState*);
 JSC::EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionWithScriptStateVoid(JSC::ExecState*);
@@ -171,9 +171,16 @@ JSC::EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionWithScriptStateObj(J
 JSC::EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionWithScriptStateVoidException(JSC::ExecState*);
 JSC::EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionWithScriptStateObjException(JSC::ExecState*);
 JSC::EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionWithScriptExecutionContext(JSC::ExecState*);
+JSC::EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionWithScriptExecutionContextAndScriptState(JSC::ExecState*);
+JSC::EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionWithScriptExecutionContextAndScriptStateObjException(JSC::ExecState*);
+JSC::EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionWithScriptExecutionContextAndScriptStateWithSpaces(JSC::ExecState*);
+JSC::EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionWithScriptArgumentsAndCallStack(JSC::ExecState*);
 JSC::EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionMethodWithOptionalArg(JSC::ExecState*);
 JSC::EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionMethodWithNonOptionalArgAndOptionalArg(JSC::ExecState*);
 JSC::EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionMethodWithNonOptionalArgAndTwoOptionalArgs(JSC::ExecState*);
+JSC::EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionMethodWithOptionalString(JSC::ExecState*);
+JSC::EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionMethodWithOptionalStringIsUndefined(JSC::ExecState*);
+JSC::EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionMethodWithOptionalStringIsNullString(JSC::ExecState*);
 JSC::EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionMethodWithCallbackArg(JSC::ExecState*);
 JSC::EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionMethodWithNonCallbackArgAndCallbackArg(JSC::ExecState*);
 JSC::EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionMethodWithCallbackAndOptionalArg(JSC::ExecState*);
@@ -184,6 +191,7 @@ JSC::EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionOverloadedMethod(JSC
 JSC::EncodedJSValue JSC_HOST_CALL jsTestObjConstructorFunctionClassMethod(JSC::ExecState*);
 JSC::EncodedJSValue JSC_HOST_CALL jsTestObjConstructorFunctionClassMethodWithOptional(JSC::ExecState*);
 JSC::EncodedJSValue JSC_HOST_CALL jsTestObjConstructorFunctionOverloadedMethod1(JSC::ExecState*);
+JSC::EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionMethodWithUnsignedLongArray(JSC::ExecState*);
 JSC::EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionGetSVGDocument(JSC::ExecState*);
 JSC::EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionConvert1(JSC::ExecState*);
 JSC::EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionConvert2(JSC::ExecState*);
@@ -253,7 +261,14 @@ JSC::JSValue jsTestObjWithScriptStateAttributeRaises(JSC::ExecState*, JSC::JSVal
 void setJSTestObjWithScriptStateAttributeRaises(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
 JSC::JSValue jsTestObjWithScriptExecutionContextAttributeRaises(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSTestObjWithScriptExecutionContextAttributeRaises(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsTestObjScriptStringAttr(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+JSC::JSValue jsTestObjWithScriptExecutionContextAndScriptStateAttribute(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSTestObjWithScriptExecutionContextAndScriptStateAttribute(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsTestObjWithScriptExecutionContextAndScriptStateAttributeRaises(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSTestObjWithScriptExecutionContextAndScriptStateAttributeRaises(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsTestObjWithScriptExecutionContextAndScriptStateWithSpacesAttribute(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSTestObjWithScriptExecutionContextAndScriptStateWithSpacesAttribute(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsTestObjWithScriptArgumentsAndCallStackAttribute(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSTestObjWithScriptArgumentsAndCallStackAttribute(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
 JSC::JSValue jsTestObjConditionalAttr1(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSTestObjConditionalAttr1(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
 JSC::JSValue jsTestObjConditionalAttr2(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
diff --git a/Source/WebCore/bindings/scripts/test/JS/JSTestSerializedScriptValueInterface.cpp b/Source/WebCore/bindings/scripts/test/JS/JSTestSerializedScriptValueInterface.cpp
index 02deeda6f..c0ea6eaad 100644
--- a/Source/WebCore/bindings/scripts/test/JS/JSTestSerializedScriptValueInterface.cpp
+++ b/Source/WebCore/bindings/scripts/test/JS/JSTestSerializedScriptValueInterface.cpp
@@ -36,8 +36,6 @@ using namespace JSC;
 namespace WebCore {
 
 ASSERT_CLASS_FITS_IN_CELL(JSTestSerializedScriptValueInterface);
-ASSERT_HAS_TRIVIAL_DESTRUCTOR(JSTestSerializedScriptValueInterface);
-
 /* Hash table */
 
 static const HashTableValue JSTestSerializedScriptValueInterfaceTableValues[] =
@@ -59,8 +57,6 @@ static const HashTableValue JSTestSerializedScriptValueInterfaceConstructorTable
 };
 
 static const HashTable JSTestSerializedScriptValueInterfaceConstructorTable = { 1, 0, JSTestSerializedScriptValueInterfaceConstructorTableValues, 0 };
-ASSERT_HAS_TRIVIAL_DESTRUCTOR(JSTestSerializedScriptValueInterfaceConstructor);
-
 const ClassInfo JSTestSerializedScriptValueInterfaceConstructor::s_info = { "TestSerializedScriptValueInterfaceConstructor", &Base::s_info, &JSTestSerializedScriptValueInterfaceConstructorTable, 0, CREATE_METHOD_TABLE(JSTestSerializedScriptValueInterfaceConstructor) };
 
 JSTestSerializedScriptValueInterfaceConstructor::JSTestSerializedScriptValueInterfaceConstructor(Structure* structure, JSDOMGlobalObject* globalObject)
@@ -73,6 +69,7 @@ void JSTestSerializedScriptValueInterfaceConstructor::finishCreation(ExecState*
     Base::finishCreation(exec->globalData());
     ASSERT(inherits(&s_info));
     putDirect(exec->globalData(), exec->propertyNames().prototype, JSTestSerializedScriptValueInterfacePrototype::self(exec, globalObject), DontDelete | ReadOnly);
+    putDirect(exec->globalData(), exec->propertyNames().length, jsNumber(2), ReadOnly | DontDelete | DontEnum);
 }
 
 bool JSTestSerializedScriptValueInterfaceConstructor::getOwnPropertySlot(JSCell* cell, ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -90,10 +87,10 @@ EncodedJSValue JSC_HOST_CALL JSTestSerializedScriptValueInterfaceConstructor::co
     JSTestSerializedScriptValueInterfaceConstructor* jsConstructor = static_cast<JSTestSerializedScriptValueInterfaceConstructor*>(exec->callee());
     if (exec->argumentCount() < 2)
         return throwVMError(exec, createTypeError(exec, "Not enough arguments"));
-    const String& hello(ustringToString(MAYBE_MISSING_PARAMETER(exec, 0, MissingIsUndefined).isEmpty() ? UString() : MAYBE_MISSING_PARAMETER(exec, 0, MissingIsUndefined).toString(exec)->value(exec)));
+    const String& hello(ustringToString(MAYBE_MISSING_PARAMETER(exec, 0, DefaultIsUndefined).isEmpty() ? UString() : MAYBE_MISSING_PARAMETER(exec, 0, DefaultIsUndefined).toString(exec)->value(exec)));
     if (exec->hadException())
         return JSValue::encode(jsUndefined());
-    RefPtr<SerializedScriptValue> value(SerializedScriptValue::create(exec, MAYBE_MISSING_PARAMETER(exec, 1, MissingIsUndefined)));
+    RefPtr<SerializedScriptValue> value(SerializedScriptValue::create(exec, MAYBE_MISSING_PARAMETER(exec, 1, DefaultIsUndefined)));
     if (exec->hadException())
         return JSValue::encode(jsUndefined());
     RefPtr<TestSerializedScriptValueInterface> object = TestSerializedScriptValueInterface::create(hello, value);
@@ -143,7 +140,12 @@ JSObject* JSTestSerializedScriptValueInterface::createPrototype(ExecState* exec,
 void JSTestSerializedScriptValueInterface::destroy(JSC::JSCell* cell)
 {
     JSTestSerializedScriptValueInterface* thisObject = jsCast<JSTestSerializedScriptValueInterface*>(cell);
-    thisObject->releaseImplIfNotNull();
+    thisObject->JSTestSerializedScriptValueInterface::~JSTestSerializedScriptValueInterface();
+}
+
+JSTestSerializedScriptValueInterface::~JSTestSerializedScriptValueInterface()
+{
+    releaseImplIfNotNull();
 }
 
 bool JSTestSerializedScriptValueInterface::getOwnPropertySlot(JSCell* cell, ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -240,6 +242,19 @@ JSValue JSTestSerializedScriptValueInterface::getConstructor(ExecState* exec, JS
     return getDOMConstructor<JSTestSerializedScriptValueInterfaceConstructor>(exec, static_cast<JSDOMGlobalObject*>(globalObject));
 }
 
+void JSTestSerializedScriptValueInterface::visitChildren(JSCell* cell, SlotVisitor& visitor)
+{
+    JSTestSerializedScriptValueInterface* thisObject = jsCast<JSTestSerializedScriptValueInterface*>(cell);
+    ASSERT_GC_OBJECT_INHERITS(thisObject, &s_info);
+    COMPILE_ASSERT(StructureFlags & OverridesVisitChildren, OverridesVisitChildrenWithoutSettingFlag);
+    ASSERT(thisObject->structure()->typeInfo().overridesVisitChildren());
+    Base::visitChildren(thisObject, visitor);
+    if (thisObject->m_cachedValue)
+        visitor.append(&thisObject->m_cachedValue);
+    if (thisObject->m_cachedReadonlyValue)
+        visitor.append(&thisObject->m_cachedReadonlyValue);
+}
+
 static inline bool isObservable(JSTestSerializedScriptValueInterface* jsTestSerializedScriptValueInterface)
 {
     if (jsTestSerializedScriptValueInterface->hasCustomProperties())
diff --git a/Source/WebCore/bindings/scripts/test/JS/JSTestSerializedScriptValueInterface.h b/Source/WebCore/bindings/scripts/test/JS/JSTestSerializedScriptValueInterface.h
index 363fc85e0..c944e42a3 100644
--- a/Source/WebCore/bindings/scripts/test/JS/JSTestSerializedScriptValueInterface.h
+++ b/Source/WebCore/bindings/scripts/test/JS/JSTestSerializedScriptValueInterface.h
@@ -46,6 +46,7 @@ public:
     static bool getOwnPropertyDescriptor(JSC::JSObject*, JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     static void put(JSC::JSCell*, JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     static void destroy(JSC::JSCell*);
+    ~JSTestSerializedScriptValueInterface();
     static const JSC::ClassInfo s_info;
 
     static JSC::Structure* createStructure(JSC::JSGlobalData& globalData, JSC::JSGlobalObject* globalObject, JSC::JSValue prototype)
diff --git a/Source/WebCore/bindings/scripts/test/ObjC/DOMTestInterface.h b/Source/WebCore/bindings/scripts/test/ObjC/DOMTestInterface.h
index da6f2094c..7e3b1c402 100644
--- a/Source/WebCore/bindings/scripts/test/ObjC/DOMTestInterface.h
+++ b/Source/WebCore/bindings/scripts/test/ObjC/DOMTestInterface.h
@@ -28,6 +28,7 @@
 
 #if WEBKIT_VERSION_MAX_ALLOWED >= WEBKIT_VERSION_LATEST
 
+@class DOMNode;
 @class DOMTestObj;
 @class NSString;
 
@@ -53,9 +54,14 @@ enum {
 - (NSString *)supplementalStr3;
 - (void)setSupplementalStr3:(NSString *)newSupplementalStr3;
 #endif
+#if ENABLE(Condition11) || ENABLE(Condition12)
+- (DOMNode *)supplementalNode;
+- (void)setSupplementalNode:(DOMNode *)newSupplementalNode;
+#endif
 - (void)supplementalMethod1;
 - (DOMTestObj *)supplementalMethod2:(NSString *)strArg objArg:(DOMTestObj *)objArg;
 - (void)supplementalMethod3;
+- (void)supplementalMethod4;
 @end
 
 #endif
diff --git a/Source/WebCore/bindings/scripts/test/ObjC/DOMTestInterface.mm b/Source/WebCore/bindings/scripts/test/ObjC/DOMTestInterface.mm
index d8a17a073..381e4c2c3 100644
--- a/Source/WebCore/bindings/scripts/test/ObjC/DOMTestInterface.mm
+++ b/Source/WebCore/bindings/scripts/test/ObjC/DOMTestInterface.mm
@@ -43,6 +43,7 @@
 #import "ExceptionHandlers.h"
 #import "JSMainThreadExecState.h"
 #import "KURL.h"
+#import "Node.h"
 #import "TestInterface.h"
 #import "TestObj.h"
 #import "TestSupplemental.h"
@@ -108,6 +109,22 @@
 }
 #endif
 
+#if ENABLE(Condition11) || ENABLE(Condition12)
+- (DOMNode *)supplementalNode
+{
+    WebCore::JSMainThreadNullState state;
+    return kit(WTF::getPtr(TestSupplemental::supplementalNode(IMPL)));
+}
+
+- (void)setSupplementalNode:(DOMNode *)newSupplementalNode
+{
+    WebCore::JSMainThreadNullState state;
+    ASSERT(newSupplementalNode);
+
+    TestSupplemental::setSupplementalNode(IMPL, core(newSupplementalNode));
+}
+#endif
+
 
 #if ENABLE(Condition11) || ENABLE(Condition12)
 - (void)supplementalMethod1
@@ -141,6 +158,16 @@
 
 #endif
 
+
+#if ENABLE(Condition11) || ENABLE(Condition12)
+- (void)supplementalMethod4
+{
+    WebCore::JSMainThreadNullState state;
+    TestSupplemental::supplementalMethod4(IMPL);
+}
+
+#endif
+
 @end
 
 WebCore::TestInterface* core(DOMTestInterface *wrapper)
diff --git a/Source/WebCore/bindings/scripts/test/ObjC/DOMTestObj.h b/Source/WebCore/bindings/scripts/test/ObjC/DOMTestObj.h
index 547455674..295741e67 100644
--- a/Source/WebCore/bindings/scripts/test/ObjC/DOMTestObj.h
+++ b/Source/WebCore/bindings/scripts/test/ObjC/DOMTestObj.h
@@ -43,7 +43,6 @@
 @class DOMc;
 @class DOMd;
 @class DOMe;
-@class DOMlog;
 @class NSString;
 @protocol DOMEventListener;
 
@@ -123,7 +122,14 @@ enum {
 - (void)setWithScriptStateAttributeRaises:(DOMTestObj *)newWithScriptStateAttributeRaises;
 - (DOMTestObj *)withScriptExecutionContextAttributeRaises;
 - (void)setWithScriptExecutionContextAttributeRaises:(DOMTestObj *)newWithScriptExecutionContextAttributeRaises;
-- (NSString *)scriptStringAttr;
+- (DOMTestObj *)withScriptExecutionContextAndScriptStateAttribute;
+- (void)setWithScriptExecutionContextAndScriptStateAttribute:(DOMTestObj *)newWithScriptExecutionContextAndScriptStateAttribute;
+- (DOMTestObj *)withScriptExecutionContextAndScriptStateAttributeRaises;
+- (void)setWithScriptExecutionContextAndScriptStateAttributeRaises:(DOMTestObj *)newWithScriptExecutionContextAndScriptStateAttributeRaises;
+- (DOMTestObj *)withScriptExecutionContextAndScriptStateWithSpacesAttribute;
+- (void)setWithScriptExecutionContextAndScriptStateWithSpacesAttribute:(DOMTestObj *)newWithScriptExecutionContextAndScriptStateWithSpacesAttribute;
+- (DOMTestObj *)withScriptArgumentsAndCallStackAttribute;
+- (void)setWithScriptArgumentsAndCallStackAttribute:(DOMTestObj *)newWithScriptArgumentsAndCallStackAttribute;
 #if ENABLE(Condition1)
 - (int)conditionalAttr1;
 - (void)setConditionalAttr1:(int)newConditionalAttr1;
@@ -172,7 +178,6 @@ enum {
 - (void)methodWithException;
 - (void)customMethod;
 - (void)customMethodWithArgs:(int)intArg strArg:(NSString *)strArg objArg:(DOMTestObj *)objArg;
-- (void)customArgsAndException:(DOMlog *)intArg;
 - (void)addEventListener:(NSString *)type listener:(id <DOMEventListener>)listener useCapture:(BOOL)useCapture;
 - (void)removeEventListener:(NSString *)type listener:(id <DOMEventListener>)listener useCapture:(BOOL)useCapture;
 - (void)withScriptStateVoid;
@@ -180,9 +185,16 @@ enum {
 - (void)withScriptStateVoidException;
 - (DOMTestObj *)withScriptStateObjException;
 - (void)withScriptExecutionContext;
+- (void)withScriptExecutionContextAndScriptState;
+- (DOMTestObj *)withScriptExecutionContextAndScriptStateObjException;
+- (DOMTestObj *)withScriptExecutionContextAndScriptStateWithSpaces;
+- (void)withScriptArgumentsAndCallStack;
 - (void)methodWithOptionalArg:(int)opt;
 - (void)methodWithNonOptionalArgAndOptionalArg:(int)nonOpt opt:(int)opt;
 - (void)methodWithNonOptionalArgAndTwoOptionalArgs:(int)nonOpt opt1:(int)opt1 opt2:(int)opt2;
+- (void)methodWithOptionalString:(NSString *)str;
+- (void)methodWithOptionalStringIsUndefined:(NSString *)str;
+- (void)methodWithOptionalStringIsNullString:(NSString *)str;
 - (NSString *)conditionalMethod1;
 - (void)conditionalMethod2;
 - (void)conditionalMethod3;
diff --git a/Source/WebCore/bindings/scripts/test/ObjC/DOMTestObj.mm b/Source/WebCore/bindings/scripts/test/ObjC/DOMTestObj.mm
index b4ff638c7..38f9c6bec 100644
--- a/Source/WebCore/bindings/scripts/test/ObjC/DOMTestObj.mm
+++ b/Source/WebCore/bindings/scripts/test/ObjC/DOMTestObj.mm
@@ -50,7 +50,6 @@
 #import "DOMcInternal.h"
 #import "DOMdInternal.h"
 #import "DOMeInternal.h"
-#import "DOMlogInternal.h"
 #import "Document.h"
 #import "EventListener.h"
 #import "ExceptionHandlers.h"
@@ -76,7 +75,6 @@
 #import "c.h"
 #import "d.h"
 #import "e.h"
-#import "log.h"
 #import <wtf/GetPtr.h>
 
 #define IMPL reinterpret_cast<WebCore::TestObj*>(_internal)
@@ -476,10 +474,65 @@
     WebCore::raiseOnDOMError(ec);
 }
 
-- (NSString *)scriptStringAttr
+- (DOMTestObj *)withScriptExecutionContextAndScriptStateAttribute
 {
     WebCore::JSMainThreadNullState state;
-    return IMPL->scriptStringAttr();
+    return kit(WTF::getPtr(IMPL->withScriptExecutionContextAndScriptStateAttribute()));
+}
+
+- (void)setWithScriptExecutionContextAndScriptStateAttribute:(DOMTestObj *)newWithScriptExecutionContextAndScriptStateAttribute
+{
+    WebCore::JSMainThreadNullState state;
+    ASSERT(newWithScriptExecutionContextAndScriptStateAttribute);
+
+    IMPL->setWithScriptExecutionContextAndScriptStateAttribute(core(newWithScriptExecutionContextAndScriptStateAttribute));
+}
+
+- (DOMTestObj *)withScriptExecutionContextAndScriptStateAttributeRaises
+{
+    WebCore::JSMainThreadNullState state;
+    WebCore::ExceptionCode ec = 0;
+    DOMTestObj *result = kit(WTF::getPtr(IMPL->withScriptExecutionContextAndScriptStateAttributeRaises(ec)));
+    WebCore::raiseOnDOMError(ec);
+    return result;
+}
+
+- (void)setWithScriptExecutionContextAndScriptStateAttributeRaises:(DOMTestObj *)newWithScriptExecutionContextAndScriptStateAttributeRaises
+{
+    WebCore::JSMainThreadNullState state;
+    ASSERT(newWithScriptExecutionContextAndScriptStateAttributeRaises);
+
+    WebCore::ExceptionCode ec = 0;
+    IMPL->setWithScriptExecutionContextAndScriptStateAttributeRaises(core(newWithScriptExecutionContextAndScriptStateAttributeRaises), ec);
+    WebCore::raiseOnDOMError(ec);
+}
+
+- (DOMTestObj *)withScriptExecutionContextAndScriptStateWithSpacesAttribute
+{
+    WebCore::JSMainThreadNullState state;
+    return kit(WTF::getPtr(IMPL->withScriptExecutionContextAndScriptStateWithSpacesAttribute()));
+}
+
+- (void)setWithScriptExecutionContextAndScriptStateWithSpacesAttribute:(DOMTestObj *)newWithScriptExecutionContextAndScriptStateWithSpacesAttribute
+{
+    WebCore::JSMainThreadNullState state;
+    ASSERT(newWithScriptExecutionContextAndScriptStateWithSpacesAttribute);
+
+    IMPL->setWithScriptExecutionContextAndScriptStateWithSpacesAttribute(core(newWithScriptExecutionContextAndScriptStateWithSpacesAttribute));
+}
+
+- (DOMTestObj *)withScriptArgumentsAndCallStackAttribute
+{
+    WebCore::JSMainThreadNullState state;
+    return kit(WTF::getPtr(IMPL->withScriptArgumentsAndCallStackAttribute()));
+}
+
+- (void)setWithScriptArgumentsAndCallStackAttribute:(DOMTestObj *)newWithScriptArgumentsAndCallStackAttribute
+{
+    WebCore::JSMainThreadNullState state;
+    ASSERT(newWithScriptArgumentsAndCallStackAttribute);
+
+    IMPL->setWithScriptArgumentsAndCallStackAttribute(core(newWithScriptArgumentsAndCallStackAttribute));
 }
 
 #if ENABLE(Condition1)
@@ -725,14 +778,6 @@
     IMPL->customMethodWithArgs(intArg, strArg, core(objArg));
 }
 
-- (void)customArgsAndException:(DOMlog *)intArg
-{
-    WebCore::JSMainThreadNullState state;
-    WebCore::ExceptionCode ec = 0;
-    IMPL->customArgsAndException(core(intArg), ec);
-    WebCore::raiseOnDOMError(ec);
-}
-
 - (void)addEventListener:(NSString *)type listener:(id <DOMEventListener>)listener useCapture:(BOOL)useCapture
 {
     WebCore::JSMainThreadNullState state;
@@ -782,6 +827,33 @@
     IMPL->withScriptExecutionContext();
 }
 
+- (void)withScriptExecutionContextAndScriptState
+{
+    WebCore::JSMainThreadNullState state;
+    IMPL->withScriptExecutionContextAndScriptState();
+}
+
+- (DOMTestObj *)withScriptExecutionContextAndScriptStateObjException
+{
+    WebCore::JSMainThreadNullState state;
+    WebCore::ExceptionCode ec = 0;
+    DOMTestObj *result = kit(WTF::getPtr(IMPL->withScriptExecutionContextAndScriptStateObjException(ec)));
+    WebCore::raiseOnDOMError(ec);
+    return result;
+}
+
+- (DOMTestObj *)withScriptExecutionContextAndScriptStateWithSpaces
+{
+    WebCore::JSMainThreadNullState state;
+    return kit(WTF::getPtr(IMPL->withScriptExecutionContextAndScriptStateWithSpaces()));
+}
+
+- (void)withScriptArgumentsAndCallStack
+{
+    WebCore::JSMainThreadNullState state;
+    IMPL->withScriptArgumentsAndCallStack();
+}
+
 - (void)methodWithOptionalArg:(int)opt
 {
     WebCore::JSMainThreadNullState state;
@@ -800,6 +872,24 @@
     IMPL->methodWithNonOptionalArgAndTwoOptionalArgs(nonOpt, opt1, opt2);
 }
 
+- (void)methodWithOptionalString:(NSString *)str
+{
+    WebCore::JSMainThreadNullState state;
+    IMPL->methodWithOptionalString(str);
+}
+
+- (void)methodWithOptionalStringIsUndefined:(NSString *)str
+{
+    WebCore::JSMainThreadNullState state;
+    IMPL->methodWithOptionalStringIsUndefined(str);
+}
+
+- (void)methodWithOptionalStringIsNullString:(NSString *)str
+{
+    WebCore::JSMainThreadNullState state;
+    IMPL->methodWithOptionalStringIsNullString(str);
+}
+
 
 #if ENABLE(Condition1)
 - (NSString *)conditionalMethod1
diff --git a/Source/WebCore/bindings/scripts/test/TestDomainSecurity.idl b/Source/WebCore/bindings/scripts/test/TestDomainSecurity.idl
index 09d60bd52..bbd46e0d4 100644
--- a/Source/WebCore/bindings/scripts/test/TestDomainSecurity.idl
+++ b/Source/WebCore/bindings/scripts/test/TestDomainSecurity.idl
@@ -28,10 +28,10 @@
 
 module test {
     interface [
-        CheckDomainSecurity
+        CheckSecurity
     ] TestActiveDOMObject {
         readonly attribute long excitingAttr;
         void excitingFunction(in Node nextChild);
-        [DoNotCheckDomainSecurity] void postMessage(in DOMString message);
+        [DoNotCheckSecurity] void postMessage(in DOMString message);
     };
 }
diff --git a/Source/WebCore/bindings/scripts/test/TestInterface.idl b/Source/WebCore/bindings/scripts/test/TestInterface.idl
index b043061ee..a058f1a9e 100644
--- a/Source/WebCore/bindings/scripts/test/TestInterface.idl
+++ b/Source/WebCore/bindings/scripts/test/TestInterface.idl
@@ -34,7 +34,7 @@ module test {
         CustomNamedSetter,
         Conditional=Condition1|Condition2,
         CallWith=ScriptExecutionContext,
-        Constructor(in DOMString str1, in [Optional=CallWithDefaultValue] DOMString str2),
+        Constructor(in DOMString str1, in [Optional=DefaultIsUndefined] DOMString str2),
         ConstructorRaisesException
     ] TestInterface {
     };
diff --git a/Source/WebCore/bindings/scripts/test/TestNamedConstructor.idl b/Source/WebCore/bindings/scripts/test/TestNamedConstructor.idl
index fa8d3b3aa..e0f8539e4 100644
--- a/Source/WebCore/bindings/scripts/test/TestNamedConstructor.idl
+++ b/Source/WebCore/bindings/scripts/test/TestNamedConstructor.idl
@@ -31,7 +31,7 @@
 module test {
     interface [
         ActiveDOMObject,
-        NamedConstructor=Audio(in DOMString str1, in [Optional=CallWithDefaultValue] DOMString str2, in [Optional=CallWithNullValue] DOMString str3),
+        NamedConstructor=Audio(in DOMString str1, in [Optional=DefaultIsUndefined] DOMString str2, in [Optional=DefaultIsNullString] DOMString str3),
         ConstructorRaisesException
     ] TestNamedConstructor {
     };
diff --git a/Source/WebCore/bindings/scripts/test/TestObj.idl b/Source/WebCore/bindings/scripts/test/TestObj.idl
index 94e89e1a0..171fda48c 100644
--- a/Source/WebCore/bindings/scripts/test/TestObj.idl
+++ b/Source/WebCore/bindings/scripts/test/TestObj.idl
@@ -31,7 +31,8 @@
 // changes in its ouput.
 module test {
     interface [
-        Constructor
+        Constructor,
+        InterfaceName=TestObject
     ] TestObj {
         // Attributes
         readonly attribute long            readOnlyIntAttr;
@@ -88,9 +89,6 @@ module test {
         [Custom] void customMethod();
         [Custom] void customMethodWithArgs(in long intArg, in DOMString strArg, in TestObj objArg);
 
-        [CustomArgumentHandling] void customArgsAndException(in log intArg)
-            raises(DOMException);
-
         void addEventListener(in DOMString type, 
                               in EventListener listener, 
                               in [Optional] boolean useCapture);
@@ -106,6 +104,11 @@ module test {
         [CallWith=ScriptState] TestObj withScriptStateObjException()
             raises(DOMException);
         [CallWith=ScriptExecutionContext] void withScriptExecutionContext();
+        [CallWith=ScriptExecutionContext|ScriptState] void withScriptExecutionContextAndScriptState();
+        [CallWith=ScriptExecutionContext|ScriptState] TestObj withScriptExecutionContextAndScriptStateObjException()
+            raises(DOMException);
+        [CallWith=  ScriptExecutionContext  |  ScriptState  ] TestObj withScriptExecutionContextAndScriptStateWithSpaces();
+        [CallWith=ScriptArguments|CallStack] void withScriptArgumentsAndCallStack();
 
         attribute [CallWith=ScriptState] long withScriptStateAttribute;
         attribute [CallWith=ScriptExecutionContext] TestObj withScriptExecutionContextAttribute;
@@ -113,11 +116,19 @@ module test {
             getter raises(DOMException);
         attribute [CallWith=ScriptExecutionContext] TestObj withScriptExecutionContextAttributeRaises
             getter raises(DOMException);
+        attribute [CallWith=ScriptExecutionContext|ScriptState] TestObj withScriptExecutionContextAndScriptStateAttribute;
+        attribute [CallWith=ScriptExecutionContext|ScriptState] TestObj withScriptExecutionContextAndScriptStateAttributeRaises
+            getter raises(DOMException);
+        attribute [CallWith=  ScriptExecutionContext  |  ScriptState  ] TestObj withScriptExecutionContextAndScriptStateWithSpacesAttribute;
+        attribute [CallWith=ScriptArguments|CallStack] TestObj withScriptArgumentsAndCallStackAttribute;
 
         // 'Optional' extended attribute
         void    methodWithOptionalArg(in [Optional] long opt);
         void    methodWithNonOptionalArgAndOptionalArg(in long nonOpt, in [Optional] long opt);
         void    methodWithNonOptionalArgAndTwoOptionalArgs(in long nonOpt, in [Optional] long opt1, in [Optional] long opt2);
+        void    methodWithOptionalString(in [Optional] DOMString str);
+        void    methodWithOptionalStringIsUndefined(in [Optional=DefaultIsUndefined] DOMString str);
+        void    methodWithOptionalStringIsNullString(in [Optional=DefaultIsNullString] DOMString str);
 
 #if defined(TESTING_V8) || defined(TESTING_JS)
         // 'Callback' extended attribute
@@ -126,9 +137,6 @@ module test {
         void    methodWithCallbackAndOptionalArg(in [Callback, Optional] TestCallback callback);
 #endif
 
-        // 'ConvertScriptString' extended attribute
-        readonly attribute [ConvertScriptString] DOMString scriptStringAttr;
-
         // 'Conditional' extended attribute
         attribute [Conditional=Condition1] long conditionalAttr1;
         attribute [Conditional=Condition1&Condition2] long conditionalAttr2;
@@ -184,13 +192,17 @@ module test {
         attribute double[]                  doubleArray;
 #endif
 
-        readonly attribute [CheckAccessToNode] Document contentDocument;
-        [CheckAccessToNode] SVGDocument getSVGDocument()
+#if defined(TESTING_JS)
+        void methodWithUnsignedLongArray(in unsigned long[] unsignedLongArray);
+#endif
+
+        readonly attribute [CheckSecurityForNode] Document contentDocument;
+        [CheckSecurityForNode] SVGDocument getSVGDocument()
             raises(DOMException);
 
-        void convert1(in [ConvertNullStringTo=Null] a);
-        void convert2(in [ConvertNullStringTo=Undefined] b);
-        void convert3(in [ConvertNullStringTo=False] c);
+        void convert1(in [TreatReturnedNullStringAs=Null] a);
+        void convert2(in [TreatReturnedNullStringAs=Undefined] b);
+        void convert3(in [TreatReturnedNullStringAs=False] c);
         void convert4(in [TreatNullAs=NullString] d);
         void convert5(in [TreatNullAs=NullString, TreatUndefinedAs=NullString] e);
 
diff --git a/Source/WebCore/bindings/scripts/test/TestSupplemental.idl b/Source/WebCore/bindings/scripts/test/TestSupplemental.idl
index 2355d6d39..0d7e96169 100644
--- a/Source/WebCore/bindings/scripts/test/TestSupplemental.idl
+++ b/Source/WebCore/bindings/scripts/test/TestSupplemental.idl
@@ -36,10 +36,12 @@ module test {
         readonly attribute DOMString supplementalStr1;
         attribute DOMString supplementalStr2;
         attribute [CustomGetter, CustomSetter] DOMString supplementalStr3;
+        attribute Node supplementalNode;
 
         void supplementalMethod1();
         [CallWith=ScriptExecutionContext] TestObj supplementalMethod2(in DOMString strArg, in TestObj objArg) raises(DOMException);
         [Custom] void supplementalMethod3();
+        static void supplementalMethod4();
 
         const unsigned short SUPPLEMENTALCONSTANT1 = 1;
         const [Reflect=CONST_IMPL] unsigned short SUPPLEMENTALCONSTANT2 = 2;
diff --git a/Source/WebCore/bindings/scripts/test/TestTypedArray.idl b/Source/WebCore/bindings/scripts/test/TestTypedArray.idl
index 4ea69e598..cf5306d42 100644
--- a/Source/WebCore/bindings/scripts/test/TestTypedArray.idl
+++ b/Source/WebCore/bindings/scripts/test/TestTypedArray.idl
@@ -31,7 +31,7 @@ module html {
         CustomIndexedSetter,
         JSGenerateToNativeObject,
         JSNoStaticTables,
-        JSCustomToJS,
+        CustomToJSObject,
         DoNotCheckConstants
     ] Float64Array : ArrayBufferView {
         Int32Array foo(in Float32Array array);
diff --git a/Source/WebCore/bindings/scripts/test/V8/V8Float64Array.cpp b/Source/WebCore/bindings/scripts/test/V8/V8Float64Array.cpp
index 26070b3e3..0a0f628b4 100644
--- a/Source/WebCore/bindings/scripts/test/V8/V8Float64Array.cpp
+++ b/Source/WebCore/bindings/scripts/test/V8/V8Float64Array.cpp
@@ -54,7 +54,7 @@ static v8::Handle<v8::Value> fooCallback(const v8::Arguments& args)
     if (args.Length() < 1)
         return throwError("Not enough arguments", V8Proxy::TypeError);
     Float64Array* imp = V8Float64Array::toNative(args.Holder());
-    EXCEPTION_BLOCK(Float32Array*, array, V8Float32Array::HasInstance(MAYBE_MISSING_PARAMETER(args, 0, MissingIsUndefined)) ? V8Float32Array::toNative(v8::Handle<v8::Object>::Cast(MAYBE_MISSING_PARAMETER(args, 0, MissingIsUndefined))) : 0);
+    EXCEPTION_BLOCK(Float32Array*, array, V8Float32Array::HasInstance(MAYBE_MISSING_PARAMETER(args, 0, DefaultIsUndefined)) ? V8Float32Array::toNative(v8::Handle<v8::Object>::Cast(MAYBE_MISSING_PARAMETER(args, 0, DefaultIsUndefined))) : 0);
     return toV8(imp->foo(array));
 }
 
diff --git a/Source/WebCore/bindings/scripts/test/V8/V8TestActiveDOMObject.cpp b/Source/WebCore/bindings/scripts/test/V8/V8TestActiveDOMObject.cpp
index 66582879b..dc73c2690 100644
--- a/Source/WebCore/bindings/scripts/test/V8/V8TestActiveDOMObject.cpp
+++ b/Source/WebCore/bindings/scripts/test/V8/V8TestActiveDOMObject.cpp
@@ -55,7 +55,7 @@ static v8::Handle<v8::Value> excitingFunctionCallback(const v8::Arguments& args)
     TestActiveDOMObject* imp = V8TestActiveDOMObject::toNative(args.Holder());
     if (!V8BindingSecurity::canAccessFrame(V8BindingState::Only(), imp->frame(), true))
         return v8::Handle<v8::Value>();
-    EXCEPTION_BLOCK(Node*, nextChild, V8Node::HasInstance(MAYBE_MISSING_PARAMETER(args, 0, MissingIsUndefined)) ? V8Node::toNative(v8::Handle<v8::Object>::Cast(MAYBE_MISSING_PARAMETER(args, 0, MissingIsUndefined))) : 0);
+    EXCEPTION_BLOCK(Node*, nextChild, V8Node::HasInstance(MAYBE_MISSING_PARAMETER(args, 0, DefaultIsUndefined)) ? V8Node::toNative(v8::Handle<v8::Object>::Cast(MAYBE_MISSING_PARAMETER(args, 0, DefaultIsUndefined))) : 0);
     imp->excitingFunction(nextChild);
     return v8::Handle<v8::Value>();
 }
@@ -66,7 +66,7 @@ static v8::Handle<v8::Value> postMessageCallback(const v8::Arguments& args)
     if (args.Length() < 1)
         return throwError("Not enough arguments", V8Proxy::TypeError);
     TestActiveDOMObject* imp = V8TestActiveDOMObject::toNative(args.Holder());
-    STRING_TO_V8PARAMETER_EXCEPTION_BLOCK(V8Parameter<>, message, MAYBE_MISSING_PARAMETER(args, 0, MissingIsUndefined));
+    STRING_TO_V8PARAMETER_EXCEPTION_BLOCK(V8Parameter<>, message, MAYBE_MISSING_PARAMETER(args, 0, DefaultIsUndefined));
     imp->postMessage(message);
     return v8::Handle<v8::Value>();
 }
@@ -117,7 +117,7 @@ static v8::Persistent<v8::FunctionTemplate> ConfigureV8TestActiveDOMObjectTempla
     v8::Handle<v8::Signature> excitingFunctionSignature = v8::Signature::New(desc, excitingFunctionArgc, excitingFunctionArgv);
     proto->Set(v8::String::New("excitingFunction"), v8::FunctionTemplate::New(TestActiveDOMObjectInternal::excitingFunctionCallback, v8::Handle<v8::Value>(), excitingFunctionSignature));
 
-    // Function 'postMessage' (ExtAttr: 'DoNotCheckDomainSecurity')
+    // Function 'postMessage' (ExtAttr: 'DoNotCheckSecurity')
     proto->SetAccessor(v8::String::New("postMessage"), TestActiveDOMObjectInternal::postMessageAttrGetter, 0, v8::Handle<v8::Value>(), v8::ALL_CAN_READ, static_cast<v8::PropertyAttribute>(v8::DontDelete | v8::ReadOnly));
 
     // Custom toString template
diff --git a/Source/WebCore/bindings/scripts/test/V8/V8TestCustomNamedGetter.cpp b/Source/WebCore/bindings/scripts/test/V8/V8TestCustomNamedGetter.cpp
index bf1bc4a49..699eb4b93 100644
--- a/Source/WebCore/bindings/scripts/test/V8/V8TestCustomNamedGetter.cpp
+++ b/Source/WebCore/bindings/scripts/test/V8/V8TestCustomNamedGetter.cpp
@@ -45,7 +45,7 @@ static v8::Handle<v8::Value> anotherFunctionCallback(const v8::Arguments& args)
     if (args.Length() < 1)
         return throwError("Not enough arguments", V8Proxy::TypeError);
     TestCustomNamedGetter* imp = V8TestCustomNamedGetter::toNative(args.Holder());
-    STRING_TO_V8PARAMETER_EXCEPTION_BLOCK(V8Parameter<>, str, MAYBE_MISSING_PARAMETER(args, 0, MissingIsUndefined));
+    STRING_TO_V8PARAMETER_EXCEPTION_BLOCK(V8Parameter<>, str, MAYBE_MISSING_PARAMETER(args, 0, DefaultIsUndefined));
     imp->anotherFunction(str);
     return v8::Handle<v8::Value>();
 }
diff --git a/Source/WebCore/bindings/scripts/test/V8/V8TestEventTarget.cpp b/Source/WebCore/bindings/scripts/test/V8/V8TestEventTarget.cpp
index 00e0f34ec..be0113383 100644
--- a/Source/WebCore/bindings/scripts/test/V8/V8TestEventTarget.cpp
+++ b/Source/WebCore/bindings/scripts/test/V8/V8TestEventTarget.cpp
@@ -50,7 +50,7 @@ static v8::Handle<v8::Value> itemCallback(const v8::Arguments& args)
     TestEventTarget* imp = V8TestEventTarget::toNative(args.Holder());
     ExceptionCode ec = 0;
     {
-    EXCEPTION_BLOCK(int, index, toUInt32(MAYBE_MISSING_PARAMETER(args, 0, MissingIsUndefined)));
+    EXCEPTION_BLOCK(int, index, toUInt32(MAYBE_MISSING_PARAMETER(args, 0, DefaultIsUndefined)));
     if (UNLIKELY(index < 0)) {
         ec = INDEX_SIZE_ERR;
         goto fail;
@@ -92,7 +92,7 @@ static v8::Handle<v8::Value> dispatchEventCallback(const v8::Arguments& args)
     TestEventTarget* imp = V8TestEventTarget::toNative(args.Holder());
     ExceptionCode ec = 0;
     {
-    EXCEPTION_BLOCK(Event*, evt, V8Event::HasInstance(MAYBE_MISSING_PARAMETER(args, 0, MissingIsUndefined)) ? V8Event::toNative(v8::Handle<v8::Object>::Cast(MAYBE_MISSING_PARAMETER(args, 0, MissingIsUndefined))) : 0);
+    EXCEPTION_BLOCK(Event*, evt, V8Event::HasInstance(MAYBE_MISSING_PARAMETER(args, 0, DefaultIsUndefined)) ? V8Event::toNative(v8::Handle<v8::Object>::Cast(MAYBE_MISSING_PARAMETER(args, 0, DefaultIsUndefined))) : 0);
     bool result = imp->dispatchEvent(evt, ec);
     if (UNLIKELY(ec))
         goto fail;
diff --git a/Source/WebCore/bindings/scripts/test/V8/V8TestInterface.cpp b/Source/WebCore/bindings/scripts/test/V8/V8TestInterface.cpp
index 0477223f2..a347626f1 100644
--- a/Source/WebCore/bindings/scripts/test/V8/V8TestInterface.cpp
+++ b/Source/WebCore/bindings/scripts/test/V8/V8TestInterface.cpp
@@ -31,6 +31,7 @@
 #include "V8BindingState.h"
 #include "V8DOMWrapper.h"
 #include "V8IsolatedContext.h"
+#include "V8Node.h"
 #include "V8Proxy.h"
 #include "V8TestObj.h"
 #include <wtf/GetPtr.h>
@@ -83,6 +84,30 @@ static void supplementalStr2AttrSetter(v8::Local<v8::String> name, v8::Local<v8:
 
 #if ENABLE(Condition11) || ENABLE(Condition12)
 
+static v8::Handle<v8::Value> supplementalNodeAttrGetter(v8::Local<v8::String> name, const v8::AccessorInfo& info)
+{
+    INC_STATS("DOM.TestInterface.supplementalNode._get");
+    TestInterface* imp = V8TestInterface::toNative(info.Holder());
+    return toV8(TestSupplemental::supplementalNode(imp));
+}
+
+#endif // ENABLE(Condition11) || ENABLE(Condition12)
+
+#if ENABLE(Condition11) || ENABLE(Condition12)
+
+static void supplementalNodeAttrSetter(v8::Local<v8::String> name, v8::Local<v8::Value> value, const v8::AccessorInfo& info)
+{
+    INC_STATS("DOM.TestInterface.supplementalNode._set");
+    TestInterface* imp = V8TestInterface::toNative(info.Holder());
+    Node* v = V8Node::HasInstance(value) ? V8Node::toNative(v8::Handle<v8::Object>::Cast(value)) : 0;
+    TestSupplemental::setSupplementalNode(imp, WTF::getPtr(v));
+    return;
+}
+
+#endif // ENABLE(Condition11) || ENABLE(Condition12)
+
+#if ENABLE(Condition11) || ENABLE(Condition12)
+
 static v8::Handle<v8::Value> supplementalMethod1Callback(const v8::Arguments& args)
 {
     INC_STATS("DOM.TestInterface.supplementalMethod1");
@@ -103,8 +128,8 @@ static v8::Handle<v8::Value> supplementalMethod2Callback(const v8::Arguments& ar
     TestInterface* imp = V8TestInterface::toNative(args.Holder());
     ExceptionCode ec = 0;
     {
-    STRING_TO_V8PARAMETER_EXCEPTION_BLOCK(V8Parameter<>, strArg, MAYBE_MISSING_PARAMETER(args, 0, MissingIsUndefined));
-    EXCEPTION_BLOCK(TestObj*, objArg, V8TestObj::HasInstance(MAYBE_MISSING_PARAMETER(args, 1, MissingIsUndefined)) ? V8TestObj::toNative(v8::Handle<v8::Object>::Cast(MAYBE_MISSING_PARAMETER(args, 1, MissingIsUndefined))) : 0);
+    STRING_TO_V8PARAMETER_EXCEPTION_BLOCK(V8Parameter<>, strArg, MAYBE_MISSING_PARAMETER(args, 0, DefaultIsUndefined));
+    EXCEPTION_BLOCK(TestObj*, objArg, V8TestObj::HasInstance(MAYBE_MISSING_PARAMETER(args, 1, DefaultIsUndefined)) ? V8TestObj::toNative(v8::Handle<v8::Object>::Cast(MAYBE_MISSING_PARAMETER(args, 1, DefaultIsUndefined))) : 0);
     ScriptExecutionContext* scriptContext = getScriptExecutionContext();
     if (!scriptContext)
         return v8::Undefined();
@@ -120,6 +145,17 @@ static v8::Handle<v8::Value> supplementalMethod2Callback(const v8::Arguments& ar
 
 #endif // ENABLE(Condition11) || ENABLE(Condition12)
 
+#if ENABLE(Condition11) || ENABLE(Condition12)
+
+static v8::Handle<v8::Value> supplementalMethod4Callback(const v8::Arguments& args)
+{
+    INC_STATS("DOM.TestInterface.supplementalMethod4");
+    TestSupplemental::supplementalMethod4();
+    return v8::Handle<v8::Value>();
+}
+
+#endif // ENABLE(Condition11) || ENABLE(Condition12)
+
 } // namespace TestInterfaceInternal
 
 static const BatchedAttribute TestInterfaceAttrs[] = {
@@ -135,6 +171,10 @@ static const BatchedAttribute TestInterfaceAttrs[] = {
     // Attribute 'supplementalStr3' (Type: 'attribute' ExtAttr: 'CustomSetter CustomGetter Conditional ImplementedBy')
     {"supplementalStr3", V8TestInterface::supplementalStr3AccessorGetter, V8TestInterface::supplementalStr3AccessorSetter, 0 /* no data */, static_cast<v8::AccessControl>(v8::DEFAULT), static_cast<v8::PropertyAttribute>(v8::None), 0 /* on instance */},
 #endif // ENABLE(Condition11) || ENABLE(Condition12)
+#if ENABLE(Condition11) || ENABLE(Condition12)
+    // Attribute 'supplementalNode' (Type: 'attribute' ExtAttr: 'Conditional ImplementedBy')
+    {"supplementalNode", TestInterfaceInternal::supplementalNodeAttrGetter, TestInterfaceInternal::supplementalNodeAttrSetter, 0 /* no data */, static_cast<v8::AccessControl>(v8::DEFAULT), static_cast<v8::PropertyAttribute>(v8::None), 0 /* on instance */},
+#endif // ENABLE(Condition11) || ENABLE(Condition12)
 };
 
 static const BatchedCallback TestInterfaceCallbacks[] = {
@@ -157,10 +197,10 @@ static const BatchedConstant TestInterfaceConsts[] = {
 
 
 #if ENABLE(Condition11) || ENABLE(Condition12)
-COMPILE_ASSERT(1 == TestInterface::SUPPLEMENTALCONSTANT1, TestInterfaceEnumSUPPLEMENTALCONSTANT1IsWrongUseDoNotCheckConstants);
+COMPILE_ASSERT(1 == TestSupplemental::SUPPLEMENTALCONSTANT1, TestInterfaceEnumSUPPLEMENTALCONSTANT1IsWrongUseDoNotCheckConstants);
 #endif
 #if ENABLE(Condition11) || ENABLE(Condition12)
-COMPILE_ASSERT(2 == TestInterface::CONST_IMPL, TestInterfaceEnumCONST_IMPLIsWrongUseDoNotCheckConstants);
+COMPILE_ASSERT(2 == TestSupplemental::CONST_IMPL, TestInterfaceEnumCONST_IMPLIsWrongUseDoNotCheckConstants);
 #endif
 
 v8::Handle<v8::Value> V8TestInterface::constructorCallback(const v8::Arguments& args)
@@ -176,8 +216,8 @@ v8::Handle<v8::Value> V8TestInterface::constructorCallback(const v8::Arguments&
         return throwError("Not enough arguments", V8Proxy::TypeError);
 
     ExceptionCode ec = 0;
-    STRING_TO_V8PARAMETER_EXCEPTION_BLOCK(V8Parameter<>, str1, MAYBE_MISSING_PARAMETER(args, 0, MissingIsUndefined));
-    STRING_TO_V8PARAMETER_EXCEPTION_BLOCK(V8Parameter<>, str2, MAYBE_MISSING_PARAMETER(args, 1, MissingIsUndefined));
+    STRING_TO_V8PARAMETER_EXCEPTION_BLOCK(V8Parameter<>, str1, MAYBE_MISSING_PARAMETER(args, 0, DefaultIsUndefined));
+    STRING_TO_V8PARAMETER_EXCEPTION_BLOCK(V8Parameter<>, str2, MAYBE_MISSING_PARAMETER(args, 1, DefaultIsUndefined));
 
     ScriptExecutionContext* context = getScriptExecutionContext();
     if (!context)
@@ -219,6 +259,9 @@ static v8::Persistent<v8::FunctionTemplate> ConfigureV8TestInterfaceTemplate(v8:
 #if ENABLE(Condition11) || ENABLE(Condition12)
     proto->Set(v8::String::New("supplementalMethod2"), v8::FunctionTemplate::New(TestInterfaceInternal::supplementalMethod2Callback, v8::Handle<v8::Value>(), supplementalMethod2Signature));
 #endif // ENABLE(Condition11) || ENABLE(Condition12)
+#if ENABLE(Condition11) || ENABLE(Condition12)
+    desc->Set(v8::String::New("supplementalMethod4"), v8::FunctionTemplate::New(TestInterfaceInternal::supplementalMethod4Callback, v8::Handle<v8::Value>(), v8::Local<v8::Signature>()));
+#endif // ENABLE(Condition11) || ENABLE(Condition12)
     batchConfigureConstants(desc, proto, TestInterfaceConsts, WTF_ARRAY_LENGTH(TestInterfaceConsts));
 
     // Custom toString template
diff --git a/Source/WebCore/bindings/scripts/test/V8/V8TestMediaQueryListListener.cpp b/Source/WebCore/bindings/scripts/test/V8/V8TestMediaQueryListListener.cpp
index 142012d04..1fa12d4eb 100644
--- a/Source/WebCore/bindings/scripts/test/V8/V8TestMediaQueryListListener.cpp
+++ b/Source/WebCore/bindings/scripts/test/V8/V8TestMediaQueryListListener.cpp
@@ -46,7 +46,7 @@ static v8::Handle<v8::Value> methodCallback(const v8::Arguments& args)
     if (args.Length() < 1)
         return throwError("Not enough arguments", V8Proxy::TypeError);
     TestMediaQueryListListener* imp = V8TestMediaQueryListListener::toNative(args.Holder());
-    EXCEPTION_BLOCK(RefPtr<MediaQueryListListener>, listener, MediaQueryListListener::create(MAYBE_MISSING_PARAMETER(args, 0, MissingIsUndefined)));
+    EXCEPTION_BLOCK(RefPtr<MediaQueryListListener>, listener, MediaQueryListListener::create(MAYBE_MISSING_PARAMETER(args, 0, DefaultIsUndefined)));
     imp->method(listener);
     return v8::Handle<v8::Value>();
 }
diff --git a/Source/WebCore/bindings/scripts/test/V8/V8TestNamedConstructor.cpp b/Source/WebCore/bindings/scripts/test/V8/V8TestNamedConstructor.cpp
index 97f4a2611..8e6f61dff 100644
--- a/Source/WebCore/bindings/scripts/test/V8/V8TestNamedConstructor.cpp
+++ b/Source/WebCore/bindings/scripts/test/V8/V8TestNamedConstructor.cpp
@@ -67,9 +67,9 @@ static v8::Handle<v8::Value> V8TestNamedConstructorConstructorCallback(const v8:
         return throwError("Not enough arguments", V8Proxy::TypeError);
 
     ExceptionCode ec = 0;
-    STRING_TO_V8PARAMETER_EXCEPTION_BLOCK(V8Parameter<>, str1, MAYBE_MISSING_PARAMETER(args, 0, MissingIsUndefined));
-    STRING_TO_V8PARAMETER_EXCEPTION_BLOCK(V8Parameter<>, str2, MAYBE_MISSING_PARAMETER(args, 1, MissingIsUndefined));
-    STRING_TO_V8PARAMETER_EXCEPTION_BLOCK(V8Parameter<>, str3, MAYBE_MISSING_PARAMETER(args, 2, MissingIsEmpty));
+    STRING_TO_V8PARAMETER_EXCEPTION_BLOCK(V8Parameter<>, str1, MAYBE_MISSING_PARAMETER(args, 0, DefaultIsUndefined));
+    STRING_TO_V8PARAMETER_EXCEPTION_BLOCK(V8Parameter<>, str2, MAYBE_MISSING_PARAMETER(args, 1, DefaultIsUndefined));
+    STRING_TO_V8PARAMETER_EXCEPTION_BLOCK(V8Parameter<>, str3, MAYBE_MISSING_PARAMETER(args, 2, DefaultIsNullString));
 
     RefPtr<TestNamedConstructor> impl = TestNamedConstructor::createForJSConstructor(document, str1, str2, str3, ec);
     v8::Handle<v8::Object> wrapper = args.Holder();
diff --git a/Source/WebCore/bindings/scripts/test/V8/V8TestObj.cpp b/Source/WebCore/bindings/scripts/test/V8/V8TestObj.cpp
index 2ece58248..4a2029a22 100644
--- a/Source/WebCore/bindings/scripts/test/V8/V8TestObj.cpp
+++ b/Source/WebCore/bindings/scripts/test/V8/V8TestObj.cpp
@@ -51,7 +51,6 @@
 #include "V8d.h"
 #include "V8e.h"
 #include "V8int.h"
-#include "V8log.h"
 #include <wtf/GetPtr.h>
 #include <wtf/RefCounted.h>
 #include <wtf/RefPtr.h>
@@ -594,11 +593,127 @@ static void withScriptExecutionContextAttributeRaisesAttrSetter(v8::Local<v8::St
     return;
 }
 
-static v8::Handle<v8::Value> scriptStringAttrAttrGetter(v8::Local<v8::String> name, const v8::AccessorInfo& info)
+static v8::Handle<v8::Value> withScriptExecutionContextAndScriptStateAttributeAttrGetter(v8::Local<v8::String> name, const v8::AccessorInfo& info)
 {
-    INC_STATS("DOM.TestObj.scriptStringAttr._get");
+    INC_STATS("DOM.TestObj.withScriptExecutionContextAndScriptStateAttribute._get");
     TestObj* imp = V8TestObj::toNative(info.Holder());
-    return v8StringOrNull(imp->scriptStringAttr());
+    ScriptState* state = ScriptState::current();
+    if (!state)
+        return v8::Undefined();
+    ScriptExecutionContext* scriptContext = getScriptExecutionContext();
+    if (!scriptContext)
+        return v8::Undefined();
+    return toV8(imp->withScriptExecutionContextAndScriptStateAttribute(state, scriptContext));
+}
+
+static void withScriptExecutionContextAndScriptStateAttributeAttrSetter(v8::Local<v8::String> name, v8::Local<v8::Value> value, const v8::AccessorInfo& info)
+{
+    INC_STATS("DOM.TestObj.withScriptExecutionContextAndScriptStateAttribute._set");
+    TestObj* imp = V8TestObj::toNative(info.Holder());
+    TestObj* v = V8TestObj::HasInstance(value) ? V8TestObj::toNative(v8::Handle<v8::Object>::Cast(value)) : 0;
+    ScriptState* state = ScriptState::current();
+    if (!state)
+        return;
+    ScriptExecutionContext* scriptContext = getScriptExecutionContext();
+    if (!scriptContext)
+        return;
+    imp->setWithScriptExecutionContextAndScriptStateAttribute(state, scriptContext, WTF::getPtr(v));
+    if (state.hadException())
+        throwError(state.exception());
+    return;
+}
+
+static v8::Handle<v8::Value> withScriptExecutionContextAndScriptStateAttributeRaisesAttrGetter(v8::Local<v8::String> name, const v8::AccessorInfo& info)
+{
+    INC_STATS("DOM.TestObj.withScriptExecutionContextAndScriptStateAttributeRaises._get");
+    TestObj* imp = V8TestObj::toNative(info.Holder());
+    ExceptionCode ec = 0;
+    ScriptState* state = ScriptState::current();
+    if (!state)
+        return v8::Undefined();
+    ScriptExecutionContext* scriptContext = getScriptExecutionContext();
+    if (!scriptContext)
+        return v8::Undefined();
+    RefPtr<TestObj> v = imp->withScriptExecutionContextAndScriptStateAttributeRaises(state, scriptContext, ec);
+    if (UNLIKELY(ec)) {
+        V8Proxy::setDOMException(ec);
+        return v8::Handle<v8::Value>();
+    }
+    if (state.hadException())
+        return throwError(state.exception());
+    return toV8(v.release());
+}
+
+static void withScriptExecutionContextAndScriptStateAttributeRaisesAttrSetter(v8::Local<v8::String> name, v8::Local<v8::Value> value, const v8::AccessorInfo& info)
+{
+    INC_STATS("DOM.TestObj.withScriptExecutionContextAndScriptStateAttributeRaises._set");
+    TestObj* imp = V8TestObj::toNative(info.Holder());
+    TestObj* v = V8TestObj::HasInstance(value) ? V8TestObj::toNative(v8::Handle<v8::Object>::Cast(value)) : 0;
+    ExceptionCode ec = 0;
+    ScriptState* state = ScriptState::current();
+    if (!state)
+        return;
+    ScriptExecutionContext* scriptContext = getScriptExecutionContext();
+    if (!scriptContext)
+        return;
+    imp->setWithScriptExecutionContextAndScriptStateAttributeRaises(state, scriptContext, WTF::getPtr(v), ec);
+    if (UNLIKELY(ec))
+        V8Proxy::setDOMException(ec);
+    if (state.hadException())
+        throwError(state.exception());
+    return;
+}
+
+static v8::Handle<v8::Value> withScriptExecutionContextAndScriptStateWithSpacesAttributeAttrGetter(v8::Local<v8::String> name, const v8::AccessorInfo& info)
+{
+    INC_STATS("DOM.TestObj.withScriptExecutionContextAndScriptStateWithSpacesAttribute._get");
+    TestObj* imp = V8TestObj::toNative(info.Holder());
+    ScriptState* state = ScriptState::current();
+    if (!state)
+        return v8::Undefined();
+    ScriptExecutionContext* scriptContext = getScriptExecutionContext();
+    if (!scriptContext)
+        return v8::Undefined();
+    return toV8(imp->withScriptExecutionContextAndScriptStateWithSpacesAttribute(state, scriptContext));
+}
+
+static void withScriptExecutionContextAndScriptStateWithSpacesAttributeAttrSetter(v8::Local<v8::String> name, v8::Local<v8::Value> value, const v8::AccessorInfo& info)
+{
+    INC_STATS("DOM.TestObj.withScriptExecutionContextAndScriptStateWithSpacesAttribute._set");
+    TestObj* imp = V8TestObj::toNative(info.Holder());
+    TestObj* v = V8TestObj::HasInstance(value) ? V8TestObj::toNative(v8::Handle<v8::Object>::Cast(value)) : 0;
+    ScriptState* state = ScriptState::current();
+    if (!state)
+        return;
+    ScriptExecutionContext* scriptContext = getScriptExecutionContext();
+    if (!scriptContext)
+        return;
+    imp->setWithScriptExecutionContextAndScriptStateWithSpacesAttribute(state, scriptContext, WTF::getPtr(v));
+    if (state.hadException())
+        throwError(state.exception());
+    return;
+}
+
+static v8::Handle<v8::Value> withScriptArgumentsAndCallStackAttributeAttrGetter(v8::Local<v8::String> name, const v8::AccessorInfo& info)
+{
+    INC_STATS("DOM.TestObj.withScriptArgumentsAndCallStackAttribute._get");
+    TestObj* imp = V8TestObj::toNative(info.Holder());
+    RefPtr<ScriptCallStack> callStack(createScriptCallStackForInspector());
+    if (!callStack)
+        return v8::Undefined();
+    return toV8(imp->withScriptArgumentsAndCallStackAttribute(callStack));
+}
+
+static void withScriptArgumentsAndCallStackAttributeAttrSetter(v8::Local<v8::String> name, v8::Local<v8::Value> value, const v8::AccessorInfo& info)
+{
+    INC_STATS("DOM.TestObj.withScriptArgumentsAndCallStackAttribute._set");
+    TestObj* imp = V8TestObj::toNative(info.Holder());
+    TestObj* v = V8TestObj::HasInstance(value) ? V8TestObj::toNative(v8::Handle<v8::Object>::Cast(value)) : 0;
+    RefPtr<ScriptCallStack> callStack(createScriptCallStackForInspector());
+    if (!callStack)
+        return v8::Undefined();
+    imp->setWithScriptArgumentsAndCallStackAttribute(callStack, WTF::getPtr(v));
+    return;
 }
 
 #if ENABLE(Condition1)
@@ -875,9 +990,9 @@ static v8::Handle<v8::Value> voidMethodWithArgsCallback(const v8::Arguments& arg
     if (args.Length() < 3)
         return throwError("Not enough arguments", V8Proxy::TypeError);
     TestObj* imp = V8TestObj::toNative(args.Holder());
-    EXCEPTION_BLOCK(int, intArg, toInt32(MAYBE_MISSING_PARAMETER(args, 0, MissingIsUndefined)));
-    STRING_TO_V8PARAMETER_EXCEPTION_BLOCK(V8Parameter<>, strArg, MAYBE_MISSING_PARAMETER(args, 1, MissingIsUndefined));
-    EXCEPTION_BLOCK(TestObj*, objArg, V8TestObj::HasInstance(MAYBE_MISSING_PARAMETER(args, 2, MissingIsUndefined)) ? V8TestObj::toNative(v8::Handle<v8::Object>::Cast(MAYBE_MISSING_PARAMETER(args, 2, MissingIsUndefined))) : 0);
+    EXCEPTION_BLOCK(int, intArg, toInt32(MAYBE_MISSING_PARAMETER(args, 0, DefaultIsUndefined)));
+    STRING_TO_V8PARAMETER_EXCEPTION_BLOCK(V8Parameter<>, strArg, MAYBE_MISSING_PARAMETER(args, 1, DefaultIsUndefined));
+    EXCEPTION_BLOCK(TestObj*, objArg, V8TestObj::HasInstance(MAYBE_MISSING_PARAMETER(args, 2, DefaultIsUndefined)) ? V8TestObj::toNative(v8::Handle<v8::Object>::Cast(MAYBE_MISSING_PARAMETER(args, 2, DefaultIsUndefined))) : 0);
     imp->voidMethodWithArgs(intArg, strArg, objArg);
     return v8::Handle<v8::Value>();
 }
@@ -895,9 +1010,9 @@ static v8::Handle<v8::Value> intMethodWithArgsCallback(const v8::Arguments& args
     if (args.Length() < 3)
         return throwError("Not enough arguments", V8Proxy::TypeError);
     TestObj* imp = V8TestObj::toNative(args.Holder());
-    EXCEPTION_BLOCK(int, intArg, toInt32(MAYBE_MISSING_PARAMETER(args, 0, MissingIsUndefined)));
-    STRING_TO_V8PARAMETER_EXCEPTION_BLOCK(V8Parameter<>, strArg, MAYBE_MISSING_PARAMETER(args, 1, MissingIsUndefined));
-    EXCEPTION_BLOCK(TestObj*, objArg, V8TestObj::HasInstance(MAYBE_MISSING_PARAMETER(args, 2, MissingIsUndefined)) ? V8TestObj::toNative(v8::Handle<v8::Object>::Cast(MAYBE_MISSING_PARAMETER(args, 2, MissingIsUndefined))) : 0);
+    EXCEPTION_BLOCK(int, intArg, toInt32(MAYBE_MISSING_PARAMETER(args, 0, DefaultIsUndefined)));
+    STRING_TO_V8PARAMETER_EXCEPTION_BLOCK(V8Parameter<>, strArg, MAYBE_MISSING_PARAMETER(args, 1, DefaultIsUndefined));
+    EXCEPTION_BLOCK(TestObj*, objArg, V8TestObj::HasInstance(MAYBE_MISSING_PARAMETER(args, 2, DefaultIsUndefined)) ? V8TestObj::toNative(v8::Handle<v8::Object>::Cast(MAYBE_MISSING_PARAMETER(args, 2, DefaultIsUndefined))) : 0);
     return v8::Integer::New(imp->intMethodWithArgs(intArg, strArg, objArg));
 }
 
@@ -914,9 +1029,9 @@ static v8::Handle<v8::Value> objMethodWithArgsCallback(const v8::Arguments& args
     if (args.Length() < 3)
         return throwError("Not enough arguments", V8Proxy::TypeError);
     TestObj* imp = V8TestObj::toNative(args.Holder());
-    EXCEPTION_BLOCK(int, intArg, toInt32(MAYBE_MISSING_PARAMETER(args, 0, MissingIsUndefined)));
-    STRING_TO_V8PARAMETER_EXCEPTION_BLOCK(V8Parameter<>, strArg, MAYBE_MISSING_PARAMETER(args, 1, MissingIsUndefined));
-    EXCEPTION_BLOCK(TestObj*, objArg, V8TestObj::HasInstance(MAYBE_MISSING_PARAMETER(args, 2, MissingIsUndefined)) ? V8TestObj::toNative(v8::Handle<v8::Object>::Cast(MAYBE_MISSING_PARAMETER(args, 2, MissingIsUndefined))) : 0);
+    EXCEPTION_BLOCK(int, intArg, toInt32(MAYBE_MISSING_PARAMETER(args, 0, DefaultIsUndefined)));
+    STRING_TO_V8PARAMETER_EXCEPTION_BLOCK(V8Parameter<>, strArg, MAYBE_MISSING_PARAMETER(args, 1, DefaultIsUndefined));
+    EXCEPTION_BLOCK(TestObj*, objArg, V8TestObj::HasInstance(MAYBE_MISSING_PARAMETER(args, 2, DefaultIsUndefined)) ? V8TestObj::toNative(v8::Handle<v8::Object>::Cast(MAYBE_MISSING_PARAMETER(args, 2, DefaultIsUndefined))) : 0);
     return toV8(imp->objMethodWithArgs(intArg, strArg, objArg));
 }
 
@@ -928,8 +1043,8 @@ static v8::Handle<v8::Value> methodThatRequiresAllArgsAndThrowsCallback(const v8
     TestObj* imp = V8TestObj::toNative(args.Holder());
     ExceptionCode ec = 0;
     {
-    STRING_TO_V8PARAMETER_EXCEPTION_BLOCK(V8Parameter<>, strArg, MAYBE_MISSING_PARAMETER(args, 0, MissingIsUndefined));
-    EXCEPTION_BLOCK(TestObj*, objArg, V8TestObj::HasInstance(MAYBE_MISSING_PARAMETER(args, 1, MissingIsUndefined)) ? V8TestObj::toNative(v8::Handle<v8::Object>::Cast(MAYBE_MISSING_PARAMETER(args, 1, MissingIsUndefined))) : 0);
+    STRING_TO_V8PARAMETER_EXCEPTION_BLOCK(V8Parameter<>, strArg, MAYBE_MISSING_PARAMETER(args, 0, DefaultIsUndefined));
+    EXCEPTION_BLOCK(TestObj*, objArg, V8TestObj::HasInstance(MAYBE_MISSING_PARAMETER(args, 1, DefaultIsUndefined)) ? V8TestObj::toNative(v8::Handle<v8::Object>::Cast(MAYBE_MISSING_PARAMETER(args, 1, DefaultIsUndefined))) : 0);
     RefPtr<TestObj> result = imp->methodThatRequiresAllArgsAndThrows(strArg, objArg, ec);
     if (UNLIKELY(ec))
         goto fail;
@@ -960,8 +1075,8 @@ static v8::Handle<v8::Value> idbKeyCallback(const v8::Arguments& args)
     if (args.Length() < 1)
         return throwError("Not enough arguments", V8Proxy::TypeError);
     TestObj* imp = V8TestObj::toNative(args.Holder());
-    EXCEPTION_BLOCK(RefPtr<IDBKey>, key, createIDBKeyFromValue(MAYBE_MISSING_PARAMETER(args, 0, MissingIsUndefined)));
-    imp->idbKey(key);
+    EXCEPTION_BLOCK(RefPtr<IDBKey>, key, createIDBKeyFromValue(MAYBE_MISSING_PARAMETER(args, 0, DefaultIsUndefined)));
+    imp->idbKey(key.get());
     return v8::Handle<v8::Value>();
 }
 
@@ -971,7 +1086,7 @@ static v8::Handle<v8::Value> optionsObjectCallback(const v8::Arguments& args)
     if (args.Length() < 1)
         return throwError("Not enough arguments", V8Proxy::TypeError);
     TestObj* imp = V8TestObj::toNative(args.Holder());
-    EXCEPTION_BLOCK(OptionsObject, oo, MAYBE_MISSING_PARAMETER(args, 0, MissingIsUndefined));
+    EXCEPTION_BLOCK(OptionsObject, oo, MAYBE_MISSING_PARAMETER(args, 0, DefaultIsUndefined));
     if (args.Length() > 0 && !oo.isUndefinedOrNull() && !oo.isObject()) {
         ec = TYPE_MISMATCH_ERR;
         V8Proxy::setDOMException(ec);
@@ -981,7 +1096,7 @@ static v8::Handle<v8::Value> optionsObjectCallback(const v8::Arguments& args)
         imp->optionsObject(oo);
         return v8::Handle<v8::Value>();
     }
-    EXCEPTION_BLOCK(OptionsObject, ooo, MAYBE_MISSING_PARAMETER(args, 1, MissingIsUndefined));
+    EXCEPTION_BLOCK(OptionsObject, ooo, MAYBE_MISSING_PARAMETER(args, 1, DefaultIsUndefined));
     if (args.Length() > 1 && !ooo.isUndefinedOrNull() && !ooo.isObject()) {
         ec = TYPE_MISMATCH_ERR;
         V8Proxy::setDOMException(ec);
@@ -1007,29 +1122,6 @@ static v8::Handle<v8::Value> methodWithExceptionCallback(const v8::Arguments& ar
     return v8::Handle<v8::Value>();
 }
 
-static v8::Handle<v8::Value> customArgsAndExceptionCallback(const v8::Arguments& args)
-{
-    INC_STATS("DOM.TestObj.customArgsAndException");
-    if (args.Length() < 1)
-        return throwError("Not enough arguments", V8Proxy::TypeError);
-    TestObj* imp = V8TestObj::toNative(args.Holder());
-    ExceptionCode ec = 0;
-    {
-    RefPtr<ScriptArguments> scriptArguments(createScriptArguments(args, 1));
-    RefPtr<ScriptCallStack> callStack(createScriptCallStackForInspector());
-    if (!callStack)
-        return v8::Undefined();
-    EXCEPTION_BLOCK(log*, intArg, V8log::HasInstance(MAYBE_MISSING_PARAMETER(args, 0, MissingIsUndefined)) ? V8log::toNative(v8::Handle<v8::Object>::Cast(MAYBE_MISSING_PARAMETER(args, 0, MissingIsUndefined))) : 0);
-    imp->customArgsAndException(intArg, scriptArguments, callStack, ec);
-    if (UNLIKELY(ec))
-        goto fail;
-    return v8::Handle<v8::Value>();
-    }
-    fail:
-    V8Proxy::setDOMException(ec);
-    return v8::Handle<v8::Value>();
-}
-
 static v8::Handle<v8::Value> addEventListenerCallback(const v8::Arguments& args)
 {
     INC_STATS("DOM.TestObj.addEventListener()");
@@ -1123,6 +1215,68 @@ static v8::Handle<v8::Value> withScriptExecutionContextCallback(const v8::Argume
     return v8::Handle<v8::Value>();
 }
 
+static v8::Handle<v8::Value> withScriptExecutionContextAndScriptStateCallback(const v8::Arguments& args)
+{
+    INC_STATS("DOM.TestObj.withScriptExecutionContextAndScriptState");
+    TestObj* imp = V8TestObj::toNative(args.Holder());
+    EmptyScriptState state;
+    ScriptExecutionContext* scriptContext = getScriptExecutionContext();
+    if (!scriptContext)
+        return v8::Undefined();
+    imp->withScriptExecutionContextAndScriptState(&state, scriptContext);
+    if (state.hadException())
+        return throwError(state.exception());
+    return v8::Handle<v8::Value>();
+}
+
+static v8::Handle<v8::Value> withScriptExecutionContextAndScriptStateObjExceptionCallback(const v8::Arguments& args)
+{
+    INC_STATS("DOM.TestObj.withScriptExecutionContextAndScriptStateObjException");
+    TestObj* imp = V8TestObj::toNative(args.Holder());
+    ExceptionCode ec = 0;
+    {
+    EmptyScriptState state;
+    ScriptExecutionContext* scriptContext = getScriptExecutionContext();
+    if (!scriptContext)
+        return v8::Undefined();
+    RefPtr<TestObj> result = imp->withScriptExecutionContextAndScriptStateObjException(&state, scriptContext, ec);
+    if (UNLIKELY(ec))
+        goto fail;
+    if (state.hadException())
+        return throwError(state.exception());
+    return toV8(result.release());
+    }
+    fail:
+    V8Proxy::setDOMException(ec);
+    return v8::Handle<v8::Value>();
+}
+
+static v8::Handle<v8::Value> withScriptExecutionContextAndScriptStateWithSpacesCallback(const v8::Arguments& args)
+{
+    INC_STATS("DOM.TestObj.withScriptExecutionContextAndScriptStateWithSpaces");
+    TestObj* imp = V8TestObj::toNative(args.Holder());
+    EmptyScriptState state;
+    ScriptExecutionContext* scriptContext = getScriptExecutionContext();
+    if (!scriptContext)
+        return v8::Undefined();
+    RefPtr<TestObj> result = imp->withScriptExecutionContextAndScriptStateWithSpaces(&state, scriptContext);
+    if (state.hadException())
+        return throwError(state.exception());
+    return toV8(result.release());
+}
+
+static v8::Handle<v8::Value> withScriptArgumentsAndCallStackCallback(const v8::Arguments& args)
+{
+    INC_STATS("DOM.TestObj.withScriptArgumentsAndCallStack");
+    TestObj* imp = V8TestObj::toNative(args.Holder());
+    RefPtr<ScriptArguments> scriptArguments(createScriptArguments(args, 0));
+    RefPtr<ScriptCallStack> callStack(createScriptCallStackForInspector());
+    if (!callStack)
+        return v8::Undefined();
+    imp->withScriptArgumentsAndCallStack(scriptArguments, callStack);
+    return v8::Handle<v8::Value>();
+}
+
 static v8::Handle<v8::Value> methodWithOptionalArgCallback(const v8::Arguments& args)
 {
     INC_STATS("DOM.TestObj.methodWithOptionalArg");
@@ -1131,7 +1285,7 @@ static v8::Handle<v8::Value> methodWithOptionalArgCallback(const v8::Arguments&
         imp->methodWithOptionalArg();
         return v8::Handle<v8::Value>();
     }
-    EXCEPTION_BLOCK(int, opt, toInt32(MAYBE_MISSING_PARAMETER(args, 0, MissingIsUndefined)));
+    EXCEPTION_BLOCK(int, opt, toInt32(MAYBE_MISSING_PARAMETER(args, 0, DefaultIsUndefined)));
     imp->methodWithOptionalArg(opt);
     return v8::Handle<v8::Value>();
 }
@@ -1142,12 +1296,12 @@ static v8::Handle<v8::Value> methodWithNonOptionalArgAndOptionalArgCallback(cons
     if (args.Length() < 1)
         return throwError("Not enough arguments", V8Proxy::TypeError);
     TestObj* imp = V8TestObj::toNative(args.Holder());
-    EXCEPTION_BLOCK(int, nonOpt, toInt32(MAYBE_MISSING_PARAMETER(args, 0, MissingIsUndefined)));
+    EXCEPTION_BLOCK(int, nonOpt, toInt32(MAYBE_MISSING_PARAMETER(args, 0, DefaultIsUndefined)));
     if (args.Length() <= 1) {
         imp->methodWithNonOptionalArgAndOptionalArg(nonOpt);
         return v8::Handle<v8::Value>();
     }
-    EXCEPTION_BLOCK(int, opt, toInt32(MAYBE_MISSING_PARAMETER(args, 1, MissingIsUndefined)));
+    EXCEPTION_BLOCK(int, opt, toInt32(MAYBE_MISSING_PARAMETER(args, 1, DefaultIsUndefined)));
     imp->methodWithNonOptionalArgAndOptionalArg(nonOpt, opt);
     return v8::Handle<v8::Value>();
 }
@@ -1158,21 +1312,52 @@ static v8::Handle<v8::Value> methodWithNonOptionalArgAndTwoOptionalArgsCallback(
     if (args.Length() < 1)
         return throwError("Not enough arguments", V8Proxy::TypeError);
     TestObj* imp = V8TestObj::toNative(args.Holder());
-    EXCEPTION_BLOCK(int, nonOpt, toInt32(MAYBE_MISSING_PARAMETER(args, 0, MissingIsUndefined)));
+    EXCEPTION_BLOCK(int, nonOpt, toInt32(MAYBE_MISSING_PARAMETER(args, 0, DefaultIsUndefined)));
     if (args.Length() <= 1) {
         imp->methodWithNonOptionalArgAndTwoOptionalArgs(nonOpt);
         return v8::Handle<v8::Value>();
     }
-    EXCEPTION_BLOCK(int, opt1, toInt32(MAYBE_MISSING_PARAMETER(args, 1, MissingIsUndefined)));
+    EXCEPTION_BLOCK(int, opt1, toInt32(MAYBE_MISSING_PARAMETER(args, 1, DefaultIsUndefined)));
     if (args.Length() <= 2) {
         imp->methodWithNonOptionalArgAndTwoOptionalArgs(nonOpt, opt1);
         return v8::Handle<v8::Value>();
     }
-    EXCEPTION_BLOCK(int, opt2, toInt32(MAYBE_MISSING_PARAMETER(args, 2, MissingIsUndefined)));
+    EXCEPTION_BLOCK(int, opt2, toInt32(MAYBE_MISSING_PARAMETER(args, 2, DefaultIsUndefined)));
     imp->methodWithNonOptionalArgAndTwoOptionalArgs(nonOpt, opt1, opt2);
     return v8::Handle<v8::Value>();
 }
 
+static v8::Handle<v8::Value> methodWithOptionalStringCallback(const v8::Arguments& args)
+{
+    INC_STATS("DOM.TestObj.methodWithOptionalString");
+    TestObj* imp = V8TestObj::toNative(args.Holder());
+    if (args.Length() <= 0) {
+        imp->methodWithOptionalString();
+        return v8::Handle<v8::Value>();
+    }
+    STRING_TO_V8PARAMETER_EXCEPTION_BLOCK(V8Parameter<>, str, MAYBE_MISSING_PARAMETER(args, 0, DefaultIsUndefined));
+    imp->methodWithOptionalString(str);
+    return v8::Handle<v8::Value>();
+}
+
+static v8::Handle<v8::Value> methodWithOptionalStringIsUndefinedCallback(const v8::Arguments& args)
+{
+    INC_STATS("DOM.TestObj.methodWithOptionalStringIsUndefined");
+    TestObj* imp = V8TestObj::toNative(args.Holder());
+    STRING_TO_V8PARAMETER_EXCEPTION_BLOCK(V8Parameter<>, str, MAYBE_MISSING_PARAMETER(args, 0, DefaultIsUndefined));
+    imp->methodWithOptionalStringIsUndefined(str);
+    return v8::Handle<v8::Value>();
+}
+
+static v8::Handle<v8::Value> methodWithOptionalStringIsNullStringCallback(const v8::Arguments& args)
+{
+    INC_STATS("DOM.TestObj.methodWithOptionalStringIsNullString");
+    TestObj* imp = V8TestObj::toNative(args.Holder());
+    STRING_TO_V8PARAMETER_EXCEPTION_BLOCK(V8Parameter<>, str, MAYBE_MISSING_PARAMETER(args, 0, DefaultIsNullString));
+    imp->methodWithOptionalStringIsNullString(str);
+    return v8::Handle<v8::Value>();
+}
+
 static v8::Handle<v8::Value> methodWithCallbackArgCallback(const v8::Arguments& args)
 {
     INC_STATS("DOM.TestObj.methodWithCallbackArg");
@@ -1192,7 +1377,7 @@ static v8::Handle<v8::Value> methodWithNonCallbackArgAndCallbackArgCallback(cons
     if (args.Length() < 2)
         return throwError("Not enough arguments", V8Proxy::TypeError);
     TestObj* imp = V8TestObj::toNative(args.Holder());
-    EXCEPTION_BLOCK(int, nonCallback, toInt32(MAYBE_MISSING_PARAMETER(args, 0, MissingIsUndefined)));
+    EXCEPTION_BLOCK(int, nonCallback, toInt32(MAYBE_MISSING_PARAMETER(args, 0, DefaultIsUndefined)));
     if (args.Length() <= 1 || !args[1]->IsObject())
         return throwError(TYPE_MISMATCH_ERR);
     RefPtr<TestCallback> callback = V8TestCallback::create(args[1], getScriptExecutionContext());
@@ -1255,8 +1440,8 @@ static v8::Handle<v8::Value> overloadedMethod1Callback(const v8::Arguments& args
     if (args.Length() < 2)
         return throwError("Not enough arguments", V8Proxy::TypeError);
     TestObj* imp = V8TestObj::toNative(args.Holder());
-    EXCEPTION_BLOCK(TestObj*, objArg, V8TestObj::HasInstance(MAYBE_MISSING_PARAMETER(args, 0, MissingIsUndefined)) ? V8TestObj::toNative(v8::Handle<v8::Object>::Cast(MAYBE_MISSING_PARAMETER(args, 0, MissingIsUndefined))) : 0);
-    STRING_TO_V8PARAMETER_EXCEPTION_BLOCK(V8Parameter<>, strArg, MAYBE_MISSING_PARAMETER(args, 1, MissingIsUndefined));
+    EXCEPTION_BLOCK(TestObj*, objArg, V8TestObj::HasInstance(MAYBE_MISSING_PARAMETER(args, 0, DefaultIsUndefined)) ? V8TestObj::toNative(v8::Handle<v8::Object>::Cast(MAYBE_MISSING_PARAMETER(args, 0, DefaultIsUndefined))) : 0);
+    STRING_TO_V8PARAMETER_EXCEPTION_BLOCK(V8Parameter<>, strArg, MAYBE_MISSING_PARAMETER(args, 1, DefaultIsUndefined));
     imp->overloadedMethod(objArg, strArg);
     return v8::Handle<v8::Value>();
 }
@@ -1267,12 +1452,12 @@ static v8::Handle<v8::Value> overloadedMethod2Callback(const v8::Arguments& args
     if (args.Length() < 1)
         return throwError("Not enough arguments", V8Proxy::TypeError);
     TestObj* imp = V8TestObj::toNative(args.Holder());
-    EXCEPTION_BLOCK(TestObj*, objArg, V8TestObj::HasInstance(MAYBE_MISSING_PARAMETER(args, 0, MissingIsUndefined)) ? V8TestObj::toNative(v8::Handle<v8::Object>::Cast(MAYBE_MISSING_PARAMETER(args, 0, MissingIsUndefined))) : 0);
+    EXCEPTION_BLOCK(TestObj*, objArg, V8TestObj::HasInstance(MAYBE_MISSING_PARAMETER(args, 0, DefaultIsUndefined)) ? V8TestObj::toNative(v8::Handle<v8::Object>::Cast(MAYBE_MISSING_PARAMETER(args, 0, DefaultIsUndefined))) : 0);
     if (args.Length() <= 1) {
         imp->overloadedMethod(objArg);
         return v8::Handle<v8::Value>();
     }
-    EXCEPTION_BLOCK(int, intArg, toInt32(MAYBE_MISSING_PARAMETER(args, 1, MissingIsUndefined)));
+    EXCEPTION_BLOCK(int, intArg, toInt32(MAYBE_MISSING_PARAMETER(args, 1, DefaultIsUndefined)));
     imp->overloadedMethod(objArg, intArg);
     return v8::Handle<v8::Value>();
 }
@@ -1283,7 +1468,7 @@ static v8::Handle<v8::Value> overloadedMethod3Callback(const v8::Arguments& args
     if (args.Length() < 1)
         return throwError("Not enough arguments", V8Proxy::TypeError);
     TestObj* imp = V8TestObj::toNative(args.Holder());
-    STRING_TO_V8PARAMETER_EXCEPTION_BLOCK(V8Parameter<>, strArg, MAYBE_MISSING_PARAMETER(args, 0, MissingIsUndefined));
+    STRING_TO_V8PARAMETER_EXCEPTION_BLOCK(V8Parameter<>, strArg, MAYBE_MISSING_PARAMETER(args, 0, DefaultIsUndefined));
     imp->overloadedMethod(strArg);
     return v8::Handle<v8::Value>();
 }
@@ -1294,7 +1479,7 @@ static v8::Handle<v8::Value> overloadedMethod4Callback(const v8::Arguments& args
     if (args.Length() < 1)
         return throwError("Not enough arguments", V8Proxy::TypeError);
     TestObj* imp = V8TestObj::toNative(args.Holder());
-    EXCEPTION_BLOCK(int, intArg, toInt32(MAYBE_MISSING_PARAMETER(args, 0, MissingIsUndefined)));
+    EXCEPTION_BLOCK(int, intArg, toInt32(MAYBE_MISSING_PARAMETER(args, 0, DefaultIsUndefined)));
     imp->overloadedMethod(intArg);
     return v8::Handle<v8::Value>();
 }
@@ -1318,7 +1503,7 @@ static v8::Handle<v8::Value> overloadedMethod6Callback(const v8::Arguments& args
     if (args.Length() < 1)
         return throwError("Not enough arguments", V8Proxy::TypeError);
     TestObj* imp = V8TestObj::toNative(args.Holder());
-    EXCEPTION_BLOCK(RefPtr<DOMStringList>, listArg, v8ValueToWebCoreDOMStringList(MAYBE_MISSING_PARAMETER(args, 0, MissingIsUndefined)));
+    EXCEPTION_BLOCK(RefPtr<DOMStringList>, listArg, v8ValueToWebCoreDOMStringList(MAYBE_MISSING_PARAMETER(args, 0, DefaultIsUndefined)));
     imp->overloadedMethod(listArg);
     return v8::Handle<v8::Value>();
 }
@@ -1329,7 +1514,7 @@ static v8::Handle<v8::Value> overloadedMethod7Callback(const v8::Arguments& args
     if (args.Length() < 1)
         return throwError("Not enough arguments", V8Proxy::TypeError);
     TestObj* imp = V8TestObj::toNative(args.Holder());
-    EXCEPTION_BLOCK(RefPtr<DOMStringList>, arrayArg, v8ValueToWebCoreDOMStringList(MAYBE_MISSING_PARAMETER(args, 0, MissingIsUndefined)));
+    EXCEPTION_BLOCK(RefPtr<DOMStringList>, arrayArg, v8ValueToWebCoreDOMStringList(MAYBE_MISSING_PARAMETER(args, 0, DefaultIsUndefined)));
     imp->overloadedMethod(arrayArg);
     return v8::Handle<v8::Value>();
 }
@@ -1368,7 +1553,7 @@ static v8::Handle<v8::Value> classMethodWithOptionalCallback(const v8::Arguments
     if (args.Length() <= 0) {
         return v8::Integer::New(TestObj::classMethodWithOptional());
     }
-    EXCEPTION_BLOCK(int, arg, toInt32(MAYBE_MISSING_PARAMETER(args, 0, MissingIsUndefined)));
+    EXCEPTION_BLOCK(int, arg, toInt32(MAYBE_MISSING_PARAMETER(args, 0, DefaultIsUndefined)));
     return v8::Integer::New(TestObj::classMethodWithOptional(arg));
 }
 
@@ -1379,7 +1564,7 @@ static v8::Handle<v8::Value> overloadedMethod11Callback(const v8::Arguments& arg
     INC_STATS("DOM.TestObj.overloadedMethod11");
     if (args.Length() < 1)
         return throwError("Not enough arguments", V8Proxy::TypeError);
-    EXCEPTION_BLOCK(int, arg, toInt32(MAYBE_MISSING_PARAMETER(args, 0, MissingIsUndefined)));
+    EXCEPTION_BLOCK(int, arg, toInt32(MAYBE_MISSING_PARAMETER(args, 0, DefaultIsUndefined)));
     TestObj::overloadedMethod1(arg);
     return v8::Handle<v8::Value>();
 }
@@ -1393,7 +1578,7 @@ static v8::Handle<v8::Value> overloadedMethod12Callback(const v8::Arguments& arg
     INC_STATS("DOM.TestObj.overloadedMethod12");
     if (args.Length() < 1)
         return throwError("Not enough arguments", V8Proxy::TypeError);
-    STRING_TO_V8PARAMETER_EXCEPTION_BLOCK(V8Parameter<>, type, MAYBE_MISSING_PARAMETER(args, 0, MissingIsUndefined));
+    STRING_TO_V8PARAMETER_EXCEPTION_BLOCK(V8Parameter<>, type, MAYBE_MISSING_PARAMETER(args, 0, DefaultIsUndefined));
     TestObj::overloadedMethod1(type);
     return v8::Handle<v8::Value>();
 }
@@ -1421,7 +1606,7 @@ static v8::Handle<v8::Value> enabledAtRuntimeMethod1Callback(const v8::Arguments
     if (args.Length() < 1)
         return throwError("Not enough arguments", V8Proxy::TypeError);
     TestObj* imp = V8TestObj::toNative(args.Holder());
-    EXCEPTION_BLOCK(int, intArg, V8int::HasInstance(MAYBE_MISSING_PARAMETER(args, 0, MissingIsUndefined)) ? V8int::toNative(v8::Handle<v8::Object>::Cast(MAYBE_MISSING_PARAMETER(args, 0, MissingIsUndefined))) : 0);
+    EXCEPTION_BLOCK(int, intArg, V8int::HasInstance(MAYBE_MISSING_PARAMETER(args, 0, DefaultIsUndefined)) ? V8int::toNative(v8::Handle<v8::Object>::Cast(MAYBE_MISSING_PARAMETER(args, 0, DefaultIsUndefined))) : 0);
     imp->enabledAtRuntimeMethod1(intArg);
     return v8::Handle<v8::Value>();
 }
@@ -1432,7 +1617,7 @@ static v8::Handle<v8::Value> enabledAtRuntimeMethod2Callback(const v8::Arguments
     if (args.Length() < 1)
         return throwError("Not enough arguments", V8Proxy::TypeError);
     TestObj* imp = V8TestObj::toNative(args.Holder());
-    EXCEPTION_BLOCK(int, intArg, V8int::HasInstance(MAYBE_MISSING_PARAMETER(args, 0, MissingIsUndefined)) ? V8int::toNative(v8::Handle<v8::Object>::Cast(MAYBE_MISSING_PARAMETER(args, 0, MissingIsUndefined))) : 0);
+    EXCEPTION_BLOCK(int, intArg, V8int::HasInstance(MAYBE_MISSING_PARAMETER(args, 0, DefaultIsUndefined)) ? V8int::toNative(v8::Handle<v8::Object>::Cast(MAYBE_MISSING_PARAMETER(args, 0, DefaultIsUndefined))) : 0);
     imp->enabledAtRuntimeMethod2(intArg);
     return v8::Handle<v8::Value>();
 }
@@ -1461,7 +1646,7 @@ static v8::Handle<v8::Value> convert1Callback(const v8::Arguments& args)
     if (args.Length() < 1)
         return throwError("Not enough arguments", V8Proxy::TypeError);
     TestObj* imp = V8TestObj::toNative(args.Holder());
-    EXCEPTION_BLOCK(a*, , V8a::HasInstance(MAYBE_MISSING_PARAMETER(args, 0, MissingIsUndefined)) ? V8a::toNative(v8::Handle<v8::Object>::Cast(MAYBE_MISSING_PARAMETER(args, 0, MissingIsUndefined))) : 0);
+    EXCEPTION_BLOCK(a*, , V8a::HasInstance(MAYBE_MISSING_PARAMETER(args, 0, DefaultIsUndefined)) ? V8a::toNative(v8::Handle<v8::Object>::Cast(MAYBE_MISSING_PARAMETER(args, 0, DefaultIsUndefined))) : 0);
     imp->convert1();
     return v8::Handle<v8::Value>();
 }
@@ -1472,7 +1657,7 @@ static v8::Handle<v8::Value> convert2Callback(const v8::Arguments& args)
     if (args.Length() < 1)
         return throwError("Not enough arguments", V8Proxy::TypeError);
     TestObj* imp = V8TestObj::toNative(args.Holder());
-    EXCEPTION_BLOCK(b*, , V8b::HasInstance(MAYBE_MISSING_PARAMETER(args, 0, MissingIsUndefined)) ? V8b::toNative(v8::Handle<v8::Object>::Cast(MAYBE_MISSING_PARAMETER(args, 0, MissingIsUndefined))) : 0);
+    EXCEPTION_BLOCK(b*, , V8b::HasInstance(MAYBE_MISSING_PARAMETER(args, 0, DefaultIsUndefined)) ? V8b::toNative(v8::Handle<v8::Object>::Cast(MAYBE_MISSING_PARAMETER(args, 0, DefaultIsUndefined))) : 0);
     imp->convert2();
     return v8::Handle<v8::Value>();
 }
@@ -1483,7 +1668,7 @@ static v8::Handle<v8::Value> convert3Callback(const v8::Arguments& args)
     if (args.Length() < 1)
         return throwError("Not enough arguments", V8Proxy::TypeError);
     TestObj* imp = V8TestObj::toNative(args.Holder());
-    EXCEPTION_BLOCK(c*, , V8c::HasInstance(MAYBE_MISSING_PARAMETER(args, 0, MissingIsUndefined)) ? V8c::toNative(v8::Handle<v8::Object>::Cast(MAYBE_MISSING_PARAMETER(args, 0, MissingIsUndefined))) : 0);
+    EXCEPTION_BLOCK(c*, , V8c::HasInstance(MAYBE_MISSING_PARAMETER(args, 0, DefaultIsUndefined)) ? V8c::toNative(v8::Handle<v8::Object>::Cast(MAYBE_MISSING_PARAMETER(args, 0, DefaultIsUndefined))) : 0);
     imp->convert3();
     return v8::Handle<v8::Value>();
 }
@@ -1494,7 +1679,7 @@ static v8::Handle<v8::Value> convert4Callback(const v8::Arguments& args)
     if (args.Length() < 1)
         return throwError("Not enough arguments", V8Proxy::TypeError);
     TestObj* imp = V8TestObj::toNative(args.Holder());
-    EXCEPTION_BLOCK(d*, , V8d::HasInstance(MAYBE_MISSING_PARAMETER(args, 0, MissingIsUndefined)) ? V8d::toNative(v8::Handle<v8::Object>::Cast(MAYBE_MISSING_PARAMETER(args, 0, MissingIsUndefined))) : 0);
+    EXCEPTION_BLOCK(d*, , V8d::HasInstance(MAYBE_MISSING_PARAMETER(args, 0, DefaultIsUndefined)) ? V8d::toNative(v8::Handle<v8::Object>::Cast(MAYBE_MISSING_PARAMETER(args, 0, DefaultIsUndefined))) : 0);
     imp->convert4();
     return v8::Handle<v8::Value>();
 }
@@ -1505,7 +1690,7 @@ static v8::Handle<v8::Value> convert5Callback(const v8::Arguments& args)
     if (args.Length() < 1)
         return throwError("Not enough arguments", V8Proxy::TypeError);
     TestObj* imp = V8TestObj::toNative(args.Holder());
-    EXCEPTION_BLOCK(e*, , V8e::HasInstance(MAYBE_MISSING_PARAMETER(args, 0, MissingIsUndefined)) ? V8e::toNative(v8::Handle<v8::Object>::Cast(MAYBE_MISSING_PARAMETER(args, 0, MissingIsUndefined))) : 0);
+    EXCEPTION_BLOCK(e*, , V8e::HasInstance(MAYBE_MISSING_PARAMETER(args, 0, DefaultIsUndefined)) ? V8e::toNative(v8::Handle<v8::Object>::Cast(MAYBE_MISSING_PARAMETER(args, 0, DefaultIsUndefined))) : 0);
     imp->convert5();
     return v8::Handle<v8::Value>();
 }
@@ -1540,9 +1725,9 @@ static v8::Handle<v8::Value> strictFunctionCallback(const v8::Arguments& args)
     TestObj* imp = V8TestObj::toNative(args.Holder());
     ExceptionCode ec = 0;
     {
-    STRING_TO_V8PARAMETER_EXCEPTION_BLOCK(V8Parameter<>, str, MAYBE_MISSING_PARAMETER(args, 0, MissingIsUndefined));
-    EXCEPTION_BLOCK(float, a, static_cast<float>(MAYBE_MISSING_PARAMETER(args, 1, MissingIsUndefined)->NumberValue()));
-    EXCEPTION_BLOCK(int, b, V8int::HasInstance(MAYBE_MISSING_PARAMETER(args, 2, MissingIsUndefined)) ? V8int::toNative(v8::Handle<v8::Object>::Cast(MAYBE_MISSING_PARAMETER(args, 2, MissingIsUndefined))) : 0);
+    STRING_TO_V8PARAMETER_EXCEPTION_BLOCK(V8Parameter<>, str, MAYBE_MISSING_PARAMETER(args, 0, DefaultIsUndefined));
+    EXCEPTION_BLOCK(float, a, static_cast<float>(MAYBE_MISSING_PARAMETER(args, 1, DefaultIsUndefined)->NumberValue()));
+    EXCEPTION_BLOCK(int, b, V8int::HasInstance(MAYBE_MISSING_PARAMETER(args, 2, DefaultIsUndefined)) ? V8int::toNative(v8::Handle<v8::Object>::Cast(MAYBE_MISSING_PARAMETER(args, 2, DefaultIsUndefined))) : 0);
     RefPtr<bool> result = imp->strictFunction(str, a, b, ec);
     if (UNLIKELY(ec))
         goto fail;
@@ -1616,8 +1801,14 @@ static const BatchedAttribute TestObjAttrs[] = {
     {"withScriptStateAttributeRaises", TestObjInternal::withScriptStateAttributeRaisesAttrGetter, TestObjInternal::withScriptStateAttributeRaisesAttrSetter, 0 /* no data */, static_cast<v8::AccessControl>(v8::DEFAULT), static_cast<v8::PropertyAttribute>(v8::None), 0 /* on instance */},
     // Attribute 'withScriptExecutionContextAttributeRaises' (Type: 'attribute' ExtAttr: 'CallWith')
     {"withScriptExecutionContextAttributeRaises", TestObjInternal::withScriptExecutionContextAttributeRaisesAttrGetter, TestObjInternal::withScriptExecutionContextAttributeRaisesAttrSetter, 0 /* no data */, static_cast<v8::AccessControl>(v8::DEFAULT), static_cast<v8::PropertyAttribute>(v8::None), 0 /* on instance */},
-    // Attribute 'scriptStringAttr' (Type: 'readonly attribute' ExtAttr: 'ConvertScriptString')
-    {"scriptStringAttr", TestObjInternal::scriptStringAttrAttrGetter, 0, 0 /* no data */, static_cast<v8::AccessControl>(v8::DEFAULT), static_cast<v8::PropertyAttribute>(v8::None), 0 /* on instance */},
+    // Attribute 'withScriptExecutionContextAndScriptStateAttribute' (Type: 'attribute' ExtAttr: 'CallWith')
+    {"withScriptExecutionContextAndScriptStateAttribute", TestObjInternal::withScriptExecutionContextAndScriptStateAttributeAttrGetter, TestObjInternal::withScriptExecutionContextAndScriptStateAttributeAttrSetter, 0 /* no data */, static_cast<v8::AccessControl>(v8::DEFAULT), static_cast<v8::PropertyAttribute>(v8::None), 0 /* on instance */},
+    // Attribute 'withScriptExecutionContextAndScriptStateAttributeRaises' (Type: 'attribute' ExtAttr: 'CallWith')
+    {"withScriptExecutionContextAndScriptStateAttributeRaises", TestObjInternal::withScriptExecutionContextAndScriptStateAttributeRaisesAttrGetter, TestObjInternal::withScriptExecutionContextAndScriptStateAttributeRaisesAttrSetter, 0 /* no data */, static_cast<v8::AccessControl>(v8::DEFAULT), static_cast<v8::PropertyAttribute>(v8::None), 0 /* on instance */},
+    // Attribute 'withScriptExecutionContextAndScriptStateWithSpacesAttribute' (Type: 'attribute' ExtAttr: 'CallWith')
+    {"withScriptExecutionContextAndScriptStateWithSpacesAttribute", TestObjInternal::withScriptExecutionContextAndScriptStateWithSpacesAttributeAttrGetter, TestObjInternal::withScriptExecutionContextAndScriptStateWithSpacesAttributeAttrSetter, 0 /* no data */, static_cast<v8::AccessControl>(v8::DEFAULT), static_cast<v8::PropertyAttribute>(v8::None), 0 /* on instance */},
+    // Attribute 'withScriptArgumentsAndCallStackAttribute' (Type: 'attribute' ExtAttr: 'CallWith')
+    {"withScriptArgumentsAndCallStackAttribute", TestObjInternal::withScriptArgumentsAndCallStackAttributeAttrGetter, TestObjInternal::withScriptArgumentsAndCallStackAttributeAttrSetter, 0 /* no data */, static_cast<v8::AccessControl>(v8::DEFAULT), static_cast<v8::PropertyAttribute>(v8::None), 0 /* on instance */},
 #if ENABLE(Condition1)
     // Attribute 'conditionalAttr1' (Type: 'attribute' ExtAttr: 'Conditional')
     {"conditionalAttr1", TestObjInternal::conditionalAttr1AttrGetter, TestObjInternal::conditionalAttr1AttrSetter, 0 /* no data */, static_cast<v8::AccessControl>(v8::DEFAULT), static_cast<v8::PropertyAttribute>(v8::None), 0 /* on instance */},
@@ -1650,7 +1841,7 @@ static const BatchedAttribute TestObjAttrs[] = {
     {"floatArray", TestObjInternal::floatArrayAttrGetter, TestObjInternal::floatArrayAttrSetter, 0 /* no data */, static_cast<v8::AccessControl>(v8::DEFAULT), static_cast<v8::PropertyAttribute>(v8::None), 0 /* on instance */},
     // Attribute 'doubleArray' (Type: 'attribute' ExtAttr: '')
     {"doubleArray", TestObjInternal::doubleArrayAttrGetter, TestObjInternal::doubleArrayAttrSetter, 0 /* no data */, static_cast<v8::AccessControl>(v8::DEFAULT), static_cast<v8::PropertyAttribute>(v8::None), 0 /* on instance */},
-    // Attribute 'contentDocument' (Type: 'readonly attribute' ExtAttr: 'CheckAccessToNode')
+    // Attribute 'contentDocument' (Type: 'readonly attribute' ExtAttr: 'CheckSecurityForNode')
     {"contentDocument", TestObjInternal::contentDocumentAttrGetter, 0, 0 /* no data */, static_cast<v8::AccessControl>(v8::DEFAULT), static_cast<v8::PropertyAttribute>(v8::None), 0 /* on instance */},
     // Attribute 'mutablePoint' (Type: 'attribute' ExtAttr: '')
     {"mutablePoint", TestObjInternal::mutablePointAttrGetter, TestObjInternal::mutablePointAttrSetter, 0 /* no data */, static_cast<v8::AccessControl>(v8::DEFAULT), static_cast<v8::PropertyAttribute>(v8::None), 0 /* on instance */},
@@ -1683,9 +1874,16 @@ static const BatchedCallback TestObjCallbacks[] = {
     {"withScriptStateVoidException", TestObjInternal::withScriptStateVoidExceptionCallback},
     {"withScriptStateObjException", TestObjInternal::withScriptStateObjExceptionCallback},
     {"withScriptExecutionContext", TestObjInternal::withScriptExecutionContextCallback},
+    {"withScriptExecutionContextAndScriptState", TestObjInternal::withScriptExecutionContextAndScriptStateCallback},
+    {"withScriptExecutionContextAndScriptStateObjException", TestObjInternal::withScriptExecutionContextAndScriptStateObjExceptionCallback},
+    {"withScriptExecutionContextAndScriptStateWithSpaces", TestObjInternal::withScriptExecutionContextAndScriptStateWithSpacesCallback},
+    {"withScriptArgumentsAndCallStack", TestObjInternal::withScriptArgumentsAndCallStackCallback},
     {"methodWithOptionalArg", TestObjInternal::methodWithOptionalArgCallback},
     {"methodWithNonOptionalArgAndOptionalArg", TestObjInternal::methodWithNonOptionalArgAndOptionalArgCallback},
     {"methodWithNonOptionalArgAndTwoOptionalArgs", TestObjInternal::methodWithNonOptionalArgAndTwoOptionalArgsCallback},
+    {"methodWithOptionalString", TestObjInternal::methodWithOptionalStringCallback},
+    {"methodWithOptionalStringIsUndefined", TestObjInternal::methodWithOptionalStringIsUndefinedCallback},
+    {"methodWithOptionalStringIsNullString", TestObjInternal::methodWithOptionalStringIsNullStringCallback},
     {"methodWithCallbackArg", TestObjInternal::methodWithCallbackArgCallback},
     {"methodWithNonCallbackArgAndCallbackArg", TestObjInternal::methodWithNonCallbackArgAndCallbackArgCallback},
     {"methodWithCallbackAndOptionalArg", TestObjInternal::methodWithCallbackAndOptionalArgCallback},
@@ -1765,7 +1963,7 @@ static v8::Persistent<v8::FunctionTemplate> ConfigureV8TestObjTemplate(v8::Persi
     desc->ReadOnlyPrototype();
 
     v8::Local<v8::Signature> defaultSignature;
-    defaultSignature = configureTemplate(desc, "TestObj", v8::Persistent<v8::FunctionTemplate>(), V8TestObj::internalFieldCount,
+    defaultSignature = configureTemplate(desc, "TestObject", v8::Persistent<v8::FunctionTemplate>(), V8TestObj::internalFieldCount,
         TestObjAttrs, WTF_ARRAY_LENGTH(TestObjAttrs),
         TestObjCallbacks, WTF_ARRAY_LENGTH(TestObjCallbacks));
     UNUSED_PARAM(defaultSignature); // In some cases, it will not be used.
@@ -1811,12 +2009,6 @@ static v8::Persistent<v8::FunctionTemplate> ConfigureV8TestObjTemplate(v8::Persi
     v8::Handle<v8::FunctionTemplate> methodThatRequiresAllArgsAndThrowsArgv[methodThatRequiresAllArgsAndThrowsArgc] = { v8::Handle<v8::FunctionTemplate>(), V8TestObj::GetRawTemplate() };
     v8::Handle<v8::Signature> methodThatRequiresAllArgsAndThrowsSignature = v8::Signature::New(desc, methodThatRequiresAllArgsAndThrowsArgc, methodThatRequiresAllArgsAndThrowsArgv);
     proto->Set(v8::String::New("methodThatRequiresAllArgsAndThrows"), v8::FunctionTemplate::New(TestObjInternal::methodThatRequiresAllArgsAndThrowsCallback, v8::Handle<v8::Value>(), methodThatRequiresAllArgsAndThrowsSignature));
-
-    // Custom Signature 'customArgsAndException'
-    const int customArgsAndExceptionArgc = 1;
-    v8::Handle<v8::FunctionTemplate> customArgsAndExceptionArgv[customArgsAndExceptionArgc] = { V8log::GetRawTemplate() };
-    v8::Handle<v8::Signature> customArgsAndExceptionSignature = v8::Signature::New(desc, customArgsAndExceptionArgc, customArgsAndExceptionArgv);
-    proto->Set(v8::String::New("customArgsAndException"), v8::FunctionTemplate::New(TestObjInternal::customArgsAndExceptionCallback, v8::Handle<v8::Value>(), customArgsAndExceptionSignature));
     desc->Set(v8::String::New("classMethod"), v8::FunctionTemplate::New(TestObjInternal::classMethodCallback, v8::Handle<v8::Value>(), v8::Local<v8::Signature>()));
     desc->Set(v8::String::New("classMethodWithOptional"), v8::FunctionTemplate::New(TestObjInternal::classMethodWithOptionalCallback, v8::Handle<v8::Value>(), v8::Local<v8::Signature>()));
 #if ENABLE(Condition1)
diff --git a/Source/WebCore/bindings/scripts/test/V8/V8TestSerializedScriptValueInterface.cpp b/Source/WebCore/bindings/scripts/test/V8/V8TestSerializedScriptValueInterface.cpp
index 27e51b230..aaf298e3c 100644
--- a/Source/WebCore/bindings/scripts/test/V8/V8TestSerializedScriptValueInterface.cpp
+++ b/Source/WebCore/bindings/scripts/test/V8/V8TestSerializedScriptValueInterface.cpp
@@ -127,7 +127,7 @@ v8::Handle<v8::Value> V8TestSerializedScriptValueInterface::constructorCallback(
         return args.Holder();
     if (args.Length() < 2)
         return throwError("Not enough arguments", V8Proxy::TypeError);
-    STRING_TO_V8PARAMETER_EXCEPTION_BLOCK(V8Parameter<>, hello, MAYBE_MISSING_PARAMETER(args, 0, MissingIsUndefined));
+    STRING_TO_V8PARAMETER_EXCEPTION_BLOCK(V8Parameter<>, hello, MAYBE_MISSING_PARAMETER(args, 0, DefaultIsUndefined));
     bool valueDidThrow = false;
     RefPtr<SerializedScriptValue> value = SerializedScriptValue::create(args[1], 0, 0, valueDidThrow);
     if (valueDidThrow)
diff --git a/Source/WebCore/bindings/v8/IDBBindingUtilities.cpp b/Source/WebCore/bindings/v8/IDBBindingUtilities.cpp
index d0fb1ce38..b4ee695fb 100644
--- a/Source/WebCore/bindings/v8/IDBBindingUtilities.cpp
+++ b/Source/WebCore/bindings/v8/IDBBindingUtilities.cpp
@@ -31,9 +31,11 @@
 #include "IDBDatabaseException.h"
 #include "IDBKey.h"
 #include "IDBKeyPath.h"
+#include "IDBTracing.h"
 #include "SerializedScriptValue.h"
 #include "V8Binding.h"
 #include "V8IDBKey.h"
+#include <wtf/MathExtras.h>
 #include <wtf/Vector.h>
 
 namespace WebCore {
@@ -46,7 +48,7 @@ static PassRefPtr<IDBKey> createIDBKeyFromValue(v8::Handle<v8::Value> value, Vec
         return IDBKey::createNumber(value->NumberValue());
     if (value->IsString())
         return IDBKey::createString(v8ValueToWebCoreString(value));
-    if (value->IsDate())
+    if (value->IsDate() && !isnan(value->NumberValue()))
         return IDBKey::createDate(value->NumberValue());
     if (value->IsArray()) {
         v8::Handle<v8::Array> array = v8::Handle<v8::Array>::Cast(value);
@@ -148,6 +150,7 @@ v8::Handle<v8::Value> ensureNthValueOnKeyPath(v8::Handle<v8::Value>& rootValue,
 
 PassRefPtr<IDBKey> createIDBKeyFromSerializedValueAndKeyPath(PassRefPtr<SerializedScriptValue> value, const Vector<String>& keyPath)
 {
+    IDB_TRACE("createIDBKeyFromSerializedValueAndKeyPath");
     V8LocalContext localContext;
     v8::Handle<v8::Value> v8Value(value->deserialize());
     v8::Handle<v8::Value> v8Key(getNthValueOnKeyPath(v8Value, keyPath, keyPath.size()));
@@ -158,6 +161,7 @@ PassRefPtr<IDBKey> createIDBKeyFromSerializedValueAndKeyPath(PassRefPtr<Serializ
 
 PassRefPtr<SerializedScriptValue> injectIDBKeyIntoSerializedValue(PassRefPtr<IDBKey> key, PassRefPtr<SerializedScriptValue> value, const Vector<String>& keyPath)
 {
+    IDB_TRACE("injectIDBKeyIntoSerializedValue");
     V8LocalContext localContext;
     if (!keyPath.size())
         return 0;
diff --git a/Source/WebCore/bindings/v8/ScriptDebugServer.cpp b/Source/WebCore/bindings/v8/ScriptDebugServer.cpp
index 5fe394303..b705523b7 100644
--- a/Source/WebCore/bindings/v8/ScriptDebugServer.cpp
+++ b/Source/WebCore/bindings/v8/ScriptDebugServer.cpp
@@ -268,9 +268,9 @@ ScriptValue ScriptDebugServer::currentCallFrame()
     return ScriptValue(toV8(currentCallFrame.release()));
 }
 
-void ScriptDebugServer::interruptAndRun(PassOwnPtr<Task> task)
+void ScriptDebugServer::interruptAndRun(PassOwnPtr<Task> task, v8::Isolate* isolate)
 {
-    v8::Debug::DebugBreakForCommand(new ClientDataImpl(task));
+    v8::Debug::DebugBreakForCommand(new ClientDataImpl(task), isolate);
 }
 
 void ScriptDebugServer::runPendingTasks()
diff --git a/Source/WebCore/bindings/v8/ScriptDebugServer.h b/Source/WebCore/bindings/v8/ScriptDebugServer.h
index 0afaae8b1..de8465140 100644
--- a/Source/WebCore/bindings/v8/ScriptDebugServer.h
+++ b/Source/WebCore/bindings/v8/ScriptDebugServer.h
@@ -89,7 +89,7 @@ public:
         virtual ~Task() { }
         virtual void run() = 0;
     };
-    static void interruptAndRun(PassOwnPtr<Task>);
+    static void interruptAndRun(PassOwnPtr<Task>, v8::Isolate* = 0);
     void runPendingTasks();
 
     bool isPaused();
diff --git a/Source/WebCore/bindings/v8/SerializedScriptValue.cpp b/Source/WebCore/bindings/v8/SerializedScriptValue.cpp
index 9181b73f5..c6738cdc4 100644
--- a/Source/WebCore/bindings/v8/SerializedScriptValue.cpp
+++ b/Source/WebCore/bindings/v8/SerializedScriptValue.cpp
@@ -397,10 +397,10 @@ public:
 #endif
         if (arrayBufferView.isByteArray())
             append(ByteArrayTag);
-        else if (arrayBufferView.isUnsignedByteArray())
-            append(UnsignedByteArrayTag);
         else if (arrayBufferView.isUnsignedByteClampedArray())
             append(UnsignedByteClampedArrayTag);
+        else if (arrayBufferView.isUnsignedByteArray())
+            append(UnsignedByteArrayTag);
         else if (arrayBufferView.isShortArray())
             append(ShortArrayTag);
         else if (arrayBufferView.isUnsignedShortArray())
@@ -2258,4 +2258,14 @@ v8::Handle<v8::Value> SerializedScriptValue::deserialize(MessagePortArray* messa
     return deserializer.deserialize();
 }
 
+#if ENABLE(INSPECTOR)
+ScriptValue SerializedScriptValue::deserializeForInspector(ScriptState* scriptState)
+{
+    v8::HandleScope handleScope;
+    v8::Context::Scope contextScope(scriptState->context());
+
+    return ScriptValue(deserialize());
+}
+#endif
+
 } // namespace WebCore
diff --git a/Source/WebCore/bindings/v8/SerializedScriptValue.h b/Source/WebCore/bindings/v8/SerializedScriptValue.h
index d3a668b98..68b1954d5 100644
--- a/Source/WebCore/bindings/v8/SerializedScriptValue.h
+++ b/Source/WebCore/bindings/v8/SerializedScriptValue.h
@@ -76,6 +76,10 @@ public:
     // case of failure.
     v8::Handle<v8::Value> deserialize(MessagePortArray* = 0);
 
+#if ENABLE(INSPECTOR)
+    ScriptValue deserializeForInspector(ScriptState*);
+#endif
+
 private:
     enum StringDataMode {
         StringValue,
diff --git a/Source/WebCore/bindings/v8/V8AbstractEventListener.cpp b/Source/WebCore/bindings/v8/V8AbstractEventListener.cpp
index 6e27eeb16..9c56440c4 100644
--- a/Source/WebCore/bindings/v8/V8AbstractEventListener.cpp
+++ b/Source/WebCore/bindings/v8/V8AbstractEventListener.cpp
@@ -35,6 +35,7 @@
 #include "Document.h"
 #include "Event.h"
 #include "Frame.h"
+#include "InspectorCounters.h"
 #include "V8Binding.h"
 #include "V8Event.h"
 #include "V8EventListenerList.h"
@@ -57,6 +58,7 @@ V8AbstractEventListener::V8AbstractEventListener(bool isAttribute, const WorldCo
     , m_isAttribute(isAttribute)
     , m_worldContext(worldContext)
 {
+    InspectorCounters::incrementCounter(InspectorCounters::JSEventListenerCounter);
 }
 
 V8AbstractEventListener::~V8AbstractEventListener()
@@ -67,6 +69,7 @@ V8AbstractEventListener::~V8AbstractEventListener()
         V8EventListenerList::clearWrapper(listener, m_isAttribute);
     }
     disposeListenerObject();
+    InspectorCounters::decrementCounter(InspectorCounters::JSEventListenerCounter);
 }
 
 void V8AbstractEventListener::handleEvent(ScriptExecutionContext* context, Event* event)
diff --git a/Source/WebCore/bindings/v8/V8Binding.h b/Source/WebCore/bindings/v8/V8Binding.h
index 528b4fbcb..0bb5e936b 100644
--- a/Source/WebCore/bindings/v8/V8Binding.h
+++ b/Source/WebCore/bindings/v8/V8Binding.h
@@ -511,9 +511,9 @@ namespace WebCore {
         return V8ParameterBase::prepareBase();
     }
 
-    enum ParameterMissingPolicy {
-        MissingIsUndefined,
-        MissingIsEmpty
+    enum ParameterDefaultPolicy {
+        DefaultIsUndefined,
+        DefaultIsNullString
     };
 
 } // namespace WebCore
diff --git a/Source/WebCore/bindings/v8/V8DOMWindowShell.cpp b/Source/WebCore/bindings/v8/V8DOMWindowShell.cpp
index a2fceb004..8d16a1037 100644
--- a/Source/WebCore/bindings/v8/V8DOMWindowShell.cpp
+++ b/Source/WebCore/bindings/v8/V8DOMWindowShell.cpp
@@ -577,6 +577,18 @@ void V8DOMWindowShell::namedItemAdded(HTMLDocument* doc, const AtomicString& nam
 
 void V8DOMWindowShell::namedItemRemoved(HTMLDocument* doc, const AtomicString& name)
 {
+    if (doc->hasNamedItem(name.impl()) || doc->hasExtraNamedItem(name.impl()))
+        return;
+
+    if (!initContextIfNeeded())
+        return;
+
+    v8::HandleScope handleScope;
+    v8::Context::Scope contextScope(m_context);
+
+    ASSERT(!m_document.IsEmpty());
+    checkDocumentWrapper(m_document, doc);
+    m_document->Delete(v8String(name));
 }
 
 void V8DOMWindowShell::updateSecurityOrigin()
diff --git a/Source/WebCore/bindings/v8/V8DOMWrapper.cpp b/Source/WebCore/bindings/v8/V8DOMWrapper.cpp
index 8a45b71ec..4cf3c9a46 100644
--- a/Source/WebCore/bindings/v8/V8DOMWrapper.cpp
+++ b/Source/WebCore/bindings/v8/V8DOMWrapper.cpp
@@ -72,6 +72,20 @@ namespace WebCore {
 typedef HashMap<Node*, v8::Object*> DOMNodeMap;
 typedef HashMap<void*, v8::Object*> DOMObjectMap;
 
+static ALWAYS_INLINE v8::Handle<v8::Object> getExistingWrapperInline(Node* node)
+{
+    V8IsolatedContext* context = V8IsolatedContext::getEntered();
+    if (LIKELY(!context)) {
+        v8::Persistent<v8::Object>* wrapper = node->wrapper();
+        if (!wrapper)
+            return v8::Handle<v8::Object>();
+        return *wrapper;
+    }
+    DOMDataStore* store = context->world()->domDataStore();
+    DOMNodeMapping& domNodeMap = node->isActiveNode() ? store->activeDomNodeMap() : store->domNodeMap();
+    return domNodeMap.get(node);
+}
+
 // The caller must have increased obj's ref count.
 void V8DOMWrapper::setJSWrapperForDOMObject(void* object, v8::Persistent<v8::Object> wrapper)
 {
@@ -292,18 +306,17 @@ bool V8DOMWrapper::isWrapperOfType(v8::Handle<v8::Value> value, WrapperTypeInfo*
     return typeInfo == type;
 }
 
-v8::Handle<v8::Object> V8DOMWrapper::getWrapperSlow(Node* node)
+v8::Handle<v8::Object> V8DOMWrapper::getExistingWrapperSlow(Node* node)
 {
-    V8IsolatedContext* context = V8IsolatedContext::getEntered();
-    if (LIKELY(!context)) {
-        v8::Persistent<v8::Object>* wrapper = node->wrapper();
-        if (!wrapper)
-            return v8::Handle<v8::Object>();
-        return *wrapper;
-    }
-    DOMDataStore* store = context->world()->domDataStore();
-    DOMNodeMapping& domNodeMap = node->isActiveNode() ? store->activeDomNodeMap() : store->domNodeMap();
-    return domNodeMap.get(node);
+    return getExistingWrapperInline(node);
+}
+
+v8::Handle<v8::Value> V8DOMWrapper::getWrapperSlow(Node* node)
+{
+    v8::Handle<v8::Object> wrapper = getExistingWrapperInline(node);
+    if (!wrapper.IsEmpty())
+        return wrapper;
+    return toV8Slow(node, false);
 }
 
 #define TRY_TO_WRAP_WITH_INTERFACE(interfaceName) \
diff --git a/Source/WebCore/bindings/v8/V8DOMWrapper.h b/Source/WebCore/bindings/v8/V8DOMWrapper.h
index 748e827c5..d3ca51e06 100644
--- a/Source/WebCore/bindings/v8/V8DOMWrapper.h
+++ b/Source/WebCore/bindings/v8/V8DOMWrapper.h
@@ -124,19 +124,31 @@ namespace WebCore {
 
         static v8::Local<v8::Object> instantiateV8Object(V8Proxy* proxy, WrapperTypeInfo*, void* impl);
 
-        static v8::Handle<v8::Object> getWrapper(Node* node)
+        static v8::Handle<v8::Object> getExistingWrapper(Node* node)
         {
             ASSERT(isMainThread());
             if (LIKELY(!IsolatedWorld::count())) {
                 v8::Persistent<v8::Object>* wrapper = node->wrapper();
-                if (wrapper)
+                if (LIKELY(!!wrapper))
+                    return *wrapper;
+            }
+            return getExistingWrapperSlow(node);
+        }
+
+        static v8::Handle<v8::Value> getWrapper(Node* node)
+        {
+            ASSERT(isMainThread());
+            if (LIKELY(!IsolatedWorld::count())) {
+                v8::Persistent<v8::Object>* wrapper = node->wrapper();
+                if (LIKELY(!!wrapper))
                     return *wrapper;
             }
             return getWrapperSlow(node);
         }
 
     private:
-        static v8::Handle<v8::Object> getWrapperSlow(Node*);
+        static v8::Handle<v8::Object> getExistingWrapperSlow(Node*);
+        static v8::Handle<v8::Value> getWrapperSlow(Node*);
     };
 
 }
diff --git a/Source/WebCore/bindings/v8/V8EventListener.cpp b/Source/WebCore/bindings/v8/V8EventListener.cpp
index 811013bc0..b04f1695a 100644
--- a/Source/WebCore/bindings/v8/V8EventListener.cpp
+++ b/Source/WebCore/bindings/v8/V8EventListener.cpp
@@ -79,10 +79,6 @@ v8::Local<v8::Value> V8EventListener::callListenerFunction(ScriptExecutionContex
 
     v8::Handle<v8::Value> parameters[1] = { jsEvent };
 
-#if PLATFORM(CHROMIUM)
-    TRACE_EVENT("V8EventListener::callListenerFunction", this, 0);
-#endif
-
     if (V8Proxy* proxy = V8Proxy::retrieve(context)) {
         Frame* frame = static_cast<Document*>(context)->frame();
         if (frame->script()->canExecuteScripts(AboutToExecuteScript))
diff --git a/Source/WebCore/bindings/v8/V8HiddenPropertyName.h b/Source/WebCore/bindings/v8/V8HiddenPropertyName.h
index deba4a51d..c8f53527f 100644
--- a/Source/WebCore/bindings/v8/V8HiddenPropertyName.h
+++ b/Source/WebCore/bindings/v8/V8HiddenPropertyName.h
@@ -43,7 +43,8 @@ namespace WebCore {
     V(devtoolsInjectedScript) \
     V(sleepFunction) \
     V(toStringString) \
-    V(event)
+    V(event) \
+    V(state)
 
 
     class V8HiddenPropertyName {
diff --git a/Source/WebCore/bindings/v8/V8Proxy.cpp b/Source/WebCore/bindings/v8/V8Proxy.cpp
index 376e12f51..e3dc00b3f 100644
--- a/Source/WebCore/bindings/v8/V8Proxy.cpp
+++ b/Source/WebCore/bindings/v8/V8Proxy.cpp
@@ -71,6 +71,10 @@
 #include <wtf/UnusedParam.h>
 #include <wtf/text/WTFString.h>
 
+#if PLATFORM(CHROMIUM)
+#include "TraceEvent.h"
+#endif
+
 namespace WebCore {
 
 static V8Extensions& staticExtensionsList()
@@ -335,7 +339,7 @@ v8::Local<v8::Value> V8Proxy::evaluate(const ScriptSourceCode& source, Node* nod
         // Compile the script.
         v8::Local<v8::String> code = v8ExternalString(source.source());
 #if PLATFORM(CHROMIUM)
-        PlatformSupport::traceEventBegin("v8.compile", node, "");
+        TRACE_EVENT_BEGIN0("v8", "v8.compile");
 #endif
         OwnPtr<v8::ScriptData> scriptData = precompileScript(code, source.cachedScript());
 
@@ -343,15 +347,11 @@ v8::Local<v8::Value> V8Proxy::evaluate(const ScriptSourceCode& source, Node* nod
         // 1, whereas v8 starts at 0.
         v8::Handle<v8::Script> script = compileScript(code, source.url(), source.startPosition(), scriptData.get());
 #if PLATFORM(CHROMIUM)
-        PlatformSupport::traceEventEnd("v8.compile", node, "");
-
-        PlatformSupport::traceEventBegin("v8.run", node, "");
+        TRACE_EVENT_END0("v8", "v8.compile");
+        TRACE_EVENT0("v8", "v8.run");
 #endif
         result = runScript(script);
     }
-#if PLATFORM(CHROMIUM)
-    PlatformSupport::traceEventEnd("v8.run", node, "");
-#endif
 
     InspectorInstrumentation::didEvaluateScript(cookie);
 
@@ -428,6 +428,9 @@ v8::Local<v8::Value> V8Proxy::instrumentedCallFunction(Frame* frame, v8::Handle<
 
     v8::Local<v8::Value> result;
     {
+#if PLATFORM(CHROMIUM)
+        TRACE_EVENT0("v8", "v8.callFunction");
+#endif
         V8RecursionScope recursionScope(frame ? frame->document() : 0);
         result = function->Call(receiver, argc, args);
     }
@@ -442,6 +445,10 @@ v8::Local<v8::Value> V8Proxy::instrumentedCallFunction(Frame* frame, v8::Handle<
 
 v8::Local<v8::Value> V8Proxy::newInstance(v8::Handle<v8::Function> constructor, int argc, v8::Handle<v8::Value> args[])
 {
+#if PLATFORM(CHROMIUM)
+    TRACE_EVENT0("v8", "v8.newInstance");
+#endif
+
     // No artificial limitations on the depth of recursion, see comment in
     // V8Proxy::callFunction.
     v8::Local<v8::Value> result;
diff --git a/Source/WebCore/bindings/v8/WorkerScriptDebugServer.cpp b/Source/WebCore/bindings/v8/WorkerScriptDebugServer.cpp
index 58d6311e4..1860ddc8d 100755
--- a/Source/WebCore/bindings/v8/WorkerScriptDebugServer.cpp
+++ b/Source/WebCore/bindings/v8/WorkerScriptDebugServer.cpp
@@ -34,9 +34,6 @@
 #if ENABLE(JAVASCRIPT_DEBUGGER) && ENABLE(WORKERS)
 
 #include "ScriptDebugListener.h"
-#include "V8DOMWrapper.h"
-#include "V8DedicatedWorkerContext.h"
-#include "V8SharedWorkerContext.h"
 #include "WorkerContext.h"
 #include "WorkerContextExecutionProxy.h"
 #include "WorkerDebuggerAgent.h"
@@ -44,52 +41,33 @@
 #include <v8.h>
 #include <wtf/MessageQueue.h>
 
-namespace WebCore {
 
-static WorkerContext* retrieveWorkerContext(v8::Handle<v8::Context> context)
-{
-    v8::Handle<v8::Object> global = context->Global();
-    ASSERT(!global.IsEmpty());
-
-    v8::Handle<v8::Object> prototype = v8::Handle<v8::Object>::Cast(global->GetPrototype());
-    ASSERT(!prototype.IsEmpty());
-
-    prototype = v8::Handle<v8::Object>::Cast(prototype->GetPrototype());
-    ASSERT(!prototype.IsEmpty());
-
-    WrapperTypeInfo* typeInfo = V8DOMWrapper::domWrapperType(prototype);
-    if (&V8DedicatedWorkerContext::info == typeInfo)
-        return V8DedicatedWorkerContext::toNative(prototype);
-#if ENABLE(SHARED_WORKERS)
-    if (&V8SharedWorkerContext::info == typeInfo)
-        return V8SharedWorkerContext::toNative(prototype);
-#endif
-    ASSERT_NOT_REACHED();
-    return 0;
-}
+namespace WebCore {
 
-WorkerScriptDebugServer::WorkerScriptDebugServer()
+WorkerScriptDebugServer::WorkerScriptDebugServer(WorkerContext* workerContext)
     : ScriptDebugServer()
-    , m_pausedWorkerContext(0)
+    , m_listener(0)
+    , m_workerContext(workerContext)
+    , m_isolate(v8::Isolate::GetCurrent())
 {
+    ASSERT(m_isolate);
 }
 
-void WorkerScriptDebugServer::addListener(ScriptDebugListener* listener, WorkerContext* workerContext)
+void WorkerScriptDebugServer::addListener(ScriptDebugListener* listener)
 {
     v8::HandleScope scope;
     v8::Local<v8::Context> debuggerContext = v8::Debug::GetDebugContext();
     v8::Context::Scope contextScope(debuggerContext);
 
-    if (!m_listenersMap.size()) {
-        // FIXME: synchronize access to this code.
-        ensureDebuggerScriptCompiled();
-        ASSERT(!m_debuggerScript.get()->IsUndefined());
-        v8::Debug::SetDebugEventListener2(&WorkerScriptDebugServer::v8DebugEventCallback, v8::External::New(this));
-    }
-    m_listenersMap.set(workerContext, listener);
+    ASSERT(!m_listener);
+    m_listener = listener;
+
+    ensureDebuggerScriptCompiled();
+    ASSERT(!m_debuggerScript.get()->IsUndefined());
+    v8::Debug::SetDebugEventListener2(&WorkerScriptDebugServer::v8DebugEventCallback, v8::External::New(this));
     
     // TODO: Should we remove |proxy|? It looks like unused now.
-    WorkerContextExecutionProxy* proxy = workerContext->script()->proxy();
+    WorkerContextExecutionProxy* proxy = m_workerContext->script()->proxy();
     if (!proxy)
         return;
 
@@ -104,45 +82,36 @@ void WorkerScriptDebugServer::addListener(ScriptDebugListener* listener, WorkerC
         dispatchDidParseSource(listener, v8::Handle<v8::Object>::Cast(scriptsArray->Get(v8::Integer::New(i))));
 }
 
-void WorkerScriptDebugServer::removeListener(ScriptDebugListener* listener, WorkerContext* workerContext)
+void WorkerScriptDebugServer::removeListener(ScriptDebugListener* listener)
 {
-    if (!m_listenersMap.contains(workerContext))
-        return;
-
-    if (m_pausedWorkerContext == workerContext)
-        continueProgram();
-
-    m_listenersMap.remove(workerContext);
-
-    if (m_listenersMap.isEmpty())
-        v8::Debug::SetDebugEventListener2(0);
+    ASSERT(m_listener == listener);
+    continueProgram();
+    m_listener = 0;
+    v8::Debug::SetDebugEventListener2(0);
 }
 
-ScriptDebugListener* WorkerScriptDebugServer::getDebugListenerForContext(v8::Handle<v8::Context> context)
+void WorkerScriptDebugServer::interruptAndRunTask(PassOwnPtr<Task> task)
 {
-    WorkerContext* workerContext = retrieveWorkerContext(context);
-    if (!workerContext)
-        return 0;
-    return m_listenersMap.get(workerContext);
+    interruptAndRun(task, m_isolate);
 }
 
-void WorkerScriptDebugServer::runMessageLoopOnPause(v8::Handle<v8::Context> context)
+ScriptDebugListener* WorkerScriptDebugServer::getDebugListenerForContext(v8::Handle<v8::Context>)
 {
-    WorkerContext* workerContext = retrieveWorkerContext(context);
-    WorkerThread* workerThread = workerContext->thread();
-
-    m_pausedWorkerContext = workerContext;
+    // There is only one worker context in isolate.
+    return m_listener;
+}
 
+void WorkerScriptDebugServer::runMessageLoopOnPause(v8::Handle<v8::Context>)
+{
     MessageQueueWaitResult result;
     do {
-        result = workerThread->runLoop().runInMode(workerContext, WorkerDebuggerAgent::debuggerTaskMode);
+        result = m_workerContext->thread()->runLoop().runInMode(m_workerContext, WorkerDebuggerAgent::debuggerTaskMode);
     // Keep waiting until execution is resumed.
     } while (result == MessageQueueMessageReceived && isPaused());
-    m_pausedWorkerContext = 0;
     
     // The listener may have been removed in the nested loop.
-    if (ScriptDebugListener* listener = m_listenersMap.get(workerContext))
-        listener->didContinue();
+    if (m_listener)
+        m_listener->didContinue();
 }
 
 void WorkerScriptDebugServer::quitMessageLoopOnPause()
diff --git a/Source/WebCore/bindings/v8/WorkerScriptDebugServer.h b/Source/WebCore/bindings/v8/WorkerScriptDebugServer.h
index 6264c68cb..a3276abd1 100644
--- a/Source/WebCore/bindings/v8/WorkerScriptDebugServer.h
+++ b/Source/WebCore/bindings/v8/WorkerScriptDebugServer.h
@@ -35,18 +35,25 @@
 
 #include "ScriptDebugServer.h"
 
+namespace v8 {
+class Isolate;
+}
+
 namespace WebCore {
 
 class WorkerContext;
+class WorkerThread;
 
 class WorkerScriptDebugServer : public ScriptDebugServer {
     WTF_MAKE_NONCOPYABLE(WorkerScriptDebugServer);
 public:
-    WorkerScriptDebugServer();
+    explicit WorkerScriptDebugServer(WorkerContext*);
     ~WorkerScriptDebugServer() { }
 
-    void addListener(ScriptDebugListener*, WorkerContext*);
-    void removeListener(ScriptDebugListener*, WorkerContext*);
+    void addListener(ScriptDebugListener*);
+    void removeListener(ScriptDebugListener*);
+
+    void interruptAndRunTask(PassOwnPtr<Task>);
 
 private:
     virtual ScriptDebugListener* getDebugListenerForContext(v8::Handle<v8::Context>);
@@ -54,8 +61,9 @@ private:
     virtual void quitMessageLoopOnPause();
 
     typedef HashMap<WorkerContext*, ScriptDebugListener*> ListenersMap;
-    ListenersMap m_listenersMap;
-    WorkerContext* m_pausedWorkerContext;
+    ScriptDebugListener* m_listener;
+    WorkerContext* m_workerContext;
+    v8::Isolate* m_isolate;
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/bindings/v8/custom/V8BindingMacros.h b/Source/WebCore/bindings/v8/custom/V8BindingMacros.h
index 7242a36f0..ce5170647 100644
--- a/Source/WebCore/bindings/v8/custom/V8BindingMacros.h
+++ b/Source/WebCore/bindings/v8/custom/V8BindingMacros.h
@@ -48,4 +48,4 @@
         return;
 
 #define MAYBE_MISSING_PARAMETER(args, index, policy) \
-    (((policy) == MissingIsEmpty && (index) >= (args).Length()) ? (v8::Local<v8::Value>()) : ((args)[(index)]))
+    (((policy) == DefaultIsNullString && (index) >= (args).Length()) ? (v8::Local<v8::Value>()) : ((args)[(index)]))
diff --git a/Source/WebCore/bindings/v8/custom/V8ClipboardCustom.cpp b/Source/WebCore/bindings/v8/custom/V8ClipboardCustom.cpp
index d85d7a06c..51d6f2c72 100644
--- a/Source/WebCore/bindings/v8/custom/V8ClipboardCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8ClipboardCustom.cpp
@@ -44,24 +44,6 @@
 
 namespace WebCore {
 
-v8::Handle<v8::Value> V8Clipboard::typesAccessorGetter(v8::Local<v8::String> name, const v8::AccessorInfo& info)
-{
-    INC_STATS("DOM.Clipboard.types()");
-    Clipboard* clipboard = V8Clipboard::toNative(info.Holder());
-
-    HashSet<String> types = clipboard->types();
-    if (types.isEmpty())
-        return v8::Null();
-
-    v8::Local<v8::Array> result = v8::Array::New(types.size());
-    HashSet<String>::const_iterator end = types.end();
-    int index = 0;
-    for (HashSet<String>::const_iterator it = types.begin(); it != end; ++it, ++index)
-        result->Set(v8::Integer::New(index), v8String(*it));
-
-    return result;
-}
-
 v8::Handle<v8::Value> V8Clipboard::clearDataCallback(const v8::Arguments& args)
 {
     INC_STATS("DOM.Clipboard.clearData()");
diff --git a/Source/WebCore/bindings/v8/custom/V8ConsoleCustom.cpp b/Source/WebCore/bindings/v8/custom/V8ConsoleCustom.cpp
index 40ff2b141..7ade8688d 100644
--- a/Source/WebCore/bindings/v8/custom/V8ConsoleCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8ConsoleCustom.cpp
@@ -79,7 +79,7 @@ v8::Handle<v8::Value> V8Console::assertCallback(const v8::Arguments& args)
     RefPtr<ScriptCallStack> callStack(createScriptCallStack(ScriptCallStack::maxCallStackSizeToCapture));
     bool condition = args[0]->BooleanValue();
     RefPtr<ScriptArguments> scriptArguments(createScriptArguments(args, 1));
-    imp->assertCondition(condition, scriptArguments.release(), callStack);
+    imp->assertCondition(scriptArguments.release(), callStack, condition);
     return v8::Handle<v8::Value>();
 }
 
diff --git a/Source/WebCore/bindings/v8/custom/V8DOMStringMapCustom.cpp b/Source/WebCore/bindings/v8/custom/V8DOMStringMapCustom.cpp
index 8e7f6b053..2799ae2c8 100644
--- a/Source/WebCore/bindings/v8/custom/V8DOMStringMapCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8DOMStringMapCustom.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2012 Google Inc. All rights reserved.
+ * Copyright (C) 2010 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
@@ -84,4 +84,19 @@ v8::Handle<v8::Value> V8DOMStringMap::namedPropertySetter(v8::Local<v8::String>
     return value;
 }
 
+v8::Handle<v8::Value> toV8(DOMStringMap* impl)
+{
+    if (!impl)
+        return v8::Null();
+    v8::Handle<v8::Object> wrapper = V8DOMStringMap::wrap(impl);
+    // Add a hidden reference from the element to the DOMStringMap.
+    Element* element = impl->element();
+    if (!wrapper.IsEmpty() && element) {
+        v8::Handle<v8::Value> elementValue = toV8(element);
+        if (!elementValue.IsEmpty() && elementValue->IsObject())
+            V8DOMWrapper::setNamedHiddenReference(elementValue.As<v8::Object>(), "domStringMap", wrapper);
+    }
+    return wrapper;
+}
+
 } // namespace WebCore
diff --git a/Source/WebKit/chromium/src/BoundObject.cpp b/Source/WebCore/bindings/v8/custom/V8DOMTokenListCustom.cpp
index d0f66aac5..08051abd5 100644
--- a/Source/WebKit/chromium/src/BoundObject.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8DOMTokenListCustom.cpp
@@ -29,52 +29,28 @@
  */
 
 #include "config.h"
-#include "BoundObject.h"
+#include "V8DOMTokenList.h"
 
+#include "DOMTokenList.h"
 #include "V8Binding.h"
-#include "V8Proxy.h"
+#include "V8DOMWrapper.h"
+#include "V8Element.h"
 
-namespace WebKit {
+namespace WebCore {
 
-BoundObject::BoundObject(v8::Handle<v8::Context> context, void* v8This, const char* objectName)
-    : m_objectName(objectName)
-    , m_context(context)
-    , m_v8This(v8This)
+v8::Handle<v8::Value> toV8(DOMTokenList* impl)
 {
-    v8::Context::Scope contextScope(context);
-    v8::Local<v8::FunctionTemplate> localTemplate = v8::FunctionTemplate::New(WebCore::V8Proxy::checkNewLegal);
-    m_hostTemplate = v8::Persistent<v8::FunctionTemplate>::New(localTemplate);
-    m_hostTemplate->SetClassName(v8::String::New(objectName));
+    if (!impl)
+        return v8::Null();
+    v8::Handle<v8::Object> wrapper = V8DOMTokenList::wrap(impl);
+    // Add a hidden reference from the element to the DOMTokenList.
+    Element* element = impl->element();
+    if (!wrapper.IsEmpty() && element) {
+        v8::Handle<v8::Value> elementValue = toV8(element);
+        if (!elementValue.IsEmpty() && elementValue->IsObject())
+            V8DOMWrapper::setNamedHiddenReference(elementValue.As<v8::Object>(), "domTokenList", wrapper);
+    }
+    return wrapper;
 }
 
-BoundObject::~BoundObject()
-{
-    m_hostTemplate.Dispose();
-}
-
-void BoundObject::addProtoFunction(const char* name, v8::InvocationCallback callback)
-{
-    v8::Context::Scope contextScope(m_context);
-    v8::Local<v8::Signature> signature = v8::Signature::New(m_hostTemplate);
-    v8::Local<v8::ObjectTemplate> proto = m_hostTemplate->PrototypeTemplate();
-    v8::Local<v8::External> v8This = v8::External::New(m_v8This);
-    proto->Set(
-        v8::String::New(name),
-        v8::FunctionTemplate::New(
-            callback,
-            v8This,
-            signature),
-        static_cast<v8::PropertyAttribute>(v8::DontDelete));
-}
-
-void BoundObject::build()
-{
-    v8::Context::Scope contextScope(m_context);
-    v8::Local<v8::Function> constructor = m_hostTemplate->GetFunction();
-    v8::Local<v8::Object> boundObject = WebCore::SafeAllocation::newInstance(constructor);
-
-    v8::Handle<v8::Object> global = m_context->Global();
-    global->Set(v8::String::New(m_objectName), boundObject);
-}
-
-} // namespace WebKit
+} // namespace WebCore
diff --git a/Source/WebCore/bindings/v8/custom/V8DOMWindowCustom.cpp b/Source/WebCore/bindings/v8/custom/V8DOMWindowCustom.cpp
index fb7628eb7..cbae11300 100644
--- a/Source/WebCore/bindings/v8/custom/V8DOMWindowCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8DOMWindowCustom.cpp
@@ -476,7 +476,7 @@ v8::Handle<v8::Value> V8DOMWindow::indexedPropertyGetter(uint32_t index, const v
     if (!frame)
         return notHandledByInterceptor();
 
-    Frame* child = frame->tree()->child(index);
+    Frame* child = frame->tree()->scopedChild(index);
     if (child)
         return toV8(child->domWindow());
 
@@ -499,7 +499,7 @@ v8::Handle<v8::Value> V8DOMWindow::namedPropertyGetter(v8::Local<v8::String> nam
 
     // Search sub-frames.
     AtomicString propName = v8StringToAtomicWebCoreString(name);
-    Frame* child = frame->tree()->child(propName);
+    Frame* child = frame->tree()->scopedChild(propName);
     if (child)
         return toV8(child->domWindow());
 
@@ -556,14 +556,15 @@ bool V8DOMWindow::namedSecurityCheck(v8::Local<v8::Object> host, v8::Local<v8::V
         DEFINE_STATIC_LOCAL(AtomicString, nameOfProtoProperty, ("__proto__"));
 
         String name = toWebCoreString(key);
+        Frame* childFrame = target->tree()->scopedChild(name);
         // Notice that we can't call HasRealNamedProperty for ACCESS_HAS
         // because that would generate infinite recursion.
-        if (type == v8::ACCESS_HAS && target->tree()->child(name))
+        if (type == v8::ACCESS_HAS && childFrame)
             return true;
         // We need to explicitly compare against nameOfProtoProperty because
         // V8's JSObject::LocalLookup finds __proto__ before
         // interceptors and even when __proto__ isn't a "real named property".
-        if (type == v8::ACCESS_GET && target->tree()->child(name) && !host->HasRealNamedProperty(key->ToString()) && name != nameOfProtoProperty)
+        if (type == v8::ACCESS_GET && childFrame && !host->HasRealNamedProperty(key->ToString()) && name != nameOfProtoProperty)
             return true;
     }
 
@@ -583,12 +584,13 @@ bool V8DOMWindow::indexedSecurityCheck(v8::Local<v8::Object> host, uint32_t inde
     Frame* target = targetWindow->frame();
     if (!target)
         return false;
+    Frame* childFrame =  target->tree()->scopedChild(index);
 
     // Notice that we can't call HasRealNamedProperty for ACCESS_HAS
     // because that would generate infinite recursion.
-    if (type == v8::ACCESS_HAS && target->tree()->child(index))
+    if (type == v8::ACCESS_HAS && childFrame)
         return true;
-    if (type == v8::ACCESS_GET && target->tree()->child(index) && !host->HasRealIndexedProperty(index))
+    if (type == v8::ACCESS_GET && childFrame && !host->HasRealIndexedProperty(index))
         return true;
 
     return V8BindingSecurity::canAccessFrame(V8BindingState::Only(), target, false);
diff --git a/Source/WebCore/bindings/v8/custom/V8HistoryCustom.cpp b/Source/WebCore/bindings/v8/custom/V8HistoryCustom.cpp
index a1bd76b2a..abaddcaa1 100644
--- a/Source/WebCore/bindings/v8/custom/V8HistoryCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8HistoryCustom.cpp
@@ -37,6 +37,7 @@
 #include "V8Binding.h"
 #include "V8BindingState.h"
 #include "V8DOMWindow.h"
+#include "V8HiddenPropertyName.h"
 #include "V8Proxy.h"
 
 namespace WebCore {
@@ -46,15 +47,14 @@ v8::Handle<v8::Value> V8History::stateAccessorGetter(v8::Local<v8::String> name,
     INC_STATS("DOM.History.state");
     History* history = V8History::toNative(info.Holder());
 
-    v8::Handle<v8::String> propertyName = v8::String::NewSymbol("state");
-    v8::Handle<v8::Value> value = info.Holder()->GetHiddenValue(propertyName);
+    v8::Handle<v8::Value> value = info.Holder()->GetHiddenValue(V8HiddenPropertyName::state());
 
     if (!value.IsEmpty() && !history->stateChanged())
         return value;
 
     SerializedScriptValue* serialized = history->state();
     value = serialized ? serialized->deserialize() : v8::Handle<v8::Value>(v8::Null());
-    info.Holder()->SetHiddenValue(propertyName, value);
+    info.Holder()->SetHiddenValue(V8HiddenPropertyName::state(), value);
 
     return value;
 }
@@ -80,7 +80,7 @@ v8::Handle<v8::Value> V8History::pushStateCallback(const v8::Arguments& args)
     ExceptionCode ec = 0;
     History* history = V8History::toNative(args.Holder());
     history->stateObjectAdded(historyState.release(), title, url, History::StateObjectPush, ec);
-    args.Holder()->DeleteHiddenValue(v8::String::NewSymbol("state"));
+    args.Holder()->DeleteHiddenValue(V8HiddenPropertyName::state());
     return throwError(ec);
 }
 
@@ -105,7 +105,7 @@ v8::Handle<v8::Value> V8History::replaceStateCallback(const v8::Arguments& args)
     ExceptionCode ec = 0;
     History* history = V8History::toNative(args.Holder());
     history->stateObjectAdded(historyState.release(), title, url, History::StateObjectReplace, ec);
-    args.Holder()->DeleteHiddenValue(v8::String::NewSymbol("state"));
+    args.Holder()->DeleteHiddenValue(V8HiddenPropertyName::state());
     return throwError(ec);
 }
 
diff --git a/Source/WebCore/bindings/v8/custom/V8InjectedScriptHostCustom.cpp b/Source/WebCore/bindings/v8/custom/V8InjectedScriptHostCustom.cpp
index 3aa444c9d..951f18969 100644
--- a/Source/WebCore/bindings/v8/custom/V8InjectedScriptHostCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8InjectedScriptHostCustom.cpp
@@ -66,19 +66,20 @@ ScriptValue InjectedScriptHost::nodeAsScriptValue(ScriptState* state, Node* node
     return ScriptValue(toV8(node));
 }
 
-v8::Handle<v8::Value> V8InjectedScriptHost::inspectedNodeCallback(const v8::Arguments& args)
+v8::Handle<v8::Value> V8InjectedScriptHost::inspectedObjectCallback(const v8::Arguments& args)
 {
-    INC_STATS("InjectedScriptHost.inspectedNode()");
+    INC_STATS("InjectedScriptHost.inspectedObject()");
     if (args.Length() < 1)
         return v8::Undefined();
 
-    InjectedScriptHost* host = V8InjectedScriptHost::toNative(args.Holder());
-
-    Node* node = host->inspectedNode(args[0]->ToInt32()->Value());
-    if (!node)
+    if (!args[0]->IsInt32()) {
+        throwError("argument has to be an integer");
         return v8::Undefined();
+    }
 
-    return toV8(node);
+    InjectedScriptHost* host = V8InjectedScriptHost::toNative(args.Holder());
+    InjectedScriptHost::InspectableObject* object = host->inspectedObject(args[0]->ToInt32()->Value());
+    return object->get(ScriptState::current()).v8Value();
 }
 
 v8::Handle<v8::Value> V8InjectedScriptHost::internalConstructorNameCallback(const v8::Arguments& args)
diff --git a/Source/WebCore/bindings/v8/custom/V8NamedNodeMapCustom.cpp b/Source/WebCore/bindings/v8/custom/V8NamedNodeMapCustom.cpp
index 90e8fd626..4782dcc32 100644
--- a/Source/WebCore/bindings/v8/custom/V8NamedNodeMapCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8NamedNodeMapCustom.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2007-2012 Google Inc. All rights reserved.
+ * Copyright (C) 2007-2009 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
@@ -71,4 +71,16 @@ v8::Handle<v8::Value> V8NamedNodeMap::namedPropertyGetter(v8::Local<v8::String>
     return toV8(result.release());
 }
 
+v8::Handle<v8::Value> toV8(NamedNodeMap* impl)
+{
+    if (!impl)
+        return v8::Null();
+    v8::Handle<v8::Object> wrapper = V8NamedNodeMap::wrap(impl);
+    // Add a hidden reference from named node map to its owner node.
+    Element* element = impl->element();
+    if (!wrapper.IsEmpty() && element)
+        V8DOMWrapper::setNamedHiddenReference(wrapper, "ownerNode", toV8(element));
+    return wrapper;
+}
+
 } // namespace WebCore
diff --git a/Source/WebCore/bindings/v8/custom/V8NodeCustom.cpp b/Source/WebCore/bindings/v8/custom/V8NodeCustom.cpp
index 4ad13d4af..449031558 100644
--- a/Source/WebCore/bindings/v8/custom/V8NodeCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8NodeCustom.cpp
@@ -137,7 +137,7 @@ v8::Handle<v8::Value> toV8Slow(Node* impl, bool forceNewObject)
         return v8::Null();
 
     if (!forceNewObject) {
-        v8::Handle<v8::Value> wrapper = V8DOMWrapper::getWrapper(impl);
+        v8::Handle<v8::Value> wrapper = V8DOMWrapper::getExistingWrapper(impl);
         if (!wrapper.IsEmpty())
             return wrapper;
     }
@@ -147,7 +147,7 @@ v8::Handle<v8::Value> toV8Slow(Node* impl, bool forceNewObject)
     case Node::ATTRIBUTE_NODE:
         return toV8(static_cast<Attr*>(impl), forceNewObject);
     case Node::TEXT_NODE:
-        return toV8(static_cast<Text*>(impl), forceNewObject);
+        return toV8(toText(impl), forceNewObject);
     case Node::CDATA_SECTION_NODE:
         return toV8(static_cast<CDATASection*>(impl), forceNewObject);
     case Node::ENTITY_REFERENCE_NODE:
@@ -166,7 +166,6 @@ v8::Handle<v8::Value> toV8Slow(Node* impl, bool forceNewObject)
         return toV8(static_cast<DocumentFragment*>(impl), forceNewObject);
     case Node::NOTATION_NODE:
         return toV8(static_cast<Notation*>(impl), forceNewObject);
-    case Node::SHADOW_ROOT_NODE: // There's no IDL class for ShadowRoot, fall-through to default and use Node instead.
     default: break; // XPATH_NAMESPACE_NODE
     }
     return V8Node::wrap(impl, forceNewObject);
diff --git a/Source/WebCore/bindings/v8/custom/V8PopStateEventCustom.cpp b/Source/WebCore/bindings/v8/custom/V8PopStateEventCustom.cpp
index 57ce238fe..c0f3e3589 100644
--- a/Source/WebCore/bindings/v8/custom/V8PopStateEventCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8PopStateEventCustom.cpp
@@ -31,23 +31,60 @@
 #include "config.h"
 #include "V8PopStateEvent.h"
 
+#include "History.h"
 #include "PopStateEvent.h"
 #include "SerializedScriptValue.h"
+#include "V8HiddenPropertyName.h"
+#include "V8History.h"
 #include "V8Proxy.h"
 
 namespace WebCore {
 
+// Save the state value to a hidden attribute in the V8PopStateEvent, and return it, for convenience.
+static v8::Handle<v8::Value> cacheState(v8::Handle<v8::Object> popStateEvent, v8::Handle<v8::Value> state)
+{
+    popStateEvent->SetHiddenValue(V8HiddenPropertyName::state(), state);
+    return state;
+}
+
 v8::Handle<v8::Value> V8PopStateEvent::stateAccessorGetter(v8::Local<v8::String> name, const v8::AccessorInfo& info)
 {
     INC_STATS("DOM.PopStateEvent.state");
 
+    v8::Handle<v8::Value> result = info.Holder()->GetHiddenValue(V8HiddenPropertyName::state());
+
+    if (!result.IsEmpty())
+        return result;
+
     PopStateEvent* event = V8PopStateEvent::toNative(info.Holder());
-    SerializedScriptValue* serializedState = event->serializedState();
-    if (serializedState)
-        return serializedState->deserialize();
     if (!event->state().hasNoValue())
-        return event->state().v8Value();
-    return v8::Null();
+        return cacheState(info.Holder(), event->state().v8Value());
+
+    History* history = event->history();
+    if (!history || !event->serializedState())
+        return cacheState(info.Holder(), v8::Null());
+
+    // There's no cached value from a previous invocation, nor a state value was provided by the
+    // event, but there is a history object, so first we need to see if the state object has been
+    // deserialized through the history object already.
+    // The current history state object might've changed in the meantime, so we need to take care
+    // of using the correct one, and always share the same deserialization with history.state.
+
+    bool isSameState = history->isSameAsCurrentState(event->serializedState());
+
+    if (isSameState) {
+        v8::Handle<v8::Object> v8History = toV8(history).As<v8::Object>();
+        if (!history->stateChanged()) {
+            result = v8History->GetHiddenValue(V8HiddenPropertyName::state());
+            if (!result.IsEmpty())
+                return cacheState(info.Holder(), result);
+        }
+        result = event->serializedState()->deserialize();
+        v8History->SetHiddenValue(V8HiddenPropertyName::state(), result);
+    } else
+        result = event->serializedState()->deserialize();
+
+    return cacheState(info.Holder(), result);
 }
 
 } // namespace WebCore
diff --git a/Source/WebCore/bridge/jsc/BridgeJSC.cpp b/Source/WebCore/bridge/jsc/BridgeJSC.cpp
index 1d67041c8..3bcb29b2b 100644
--- a/Source/WebCore/bridge/jsc/BridgeJSC.cpp
+++ b/Source/WebCore/bridge/jsc/BridgeJSC.cpp
@@ -95,7 +95,7 @@ JSObject* Instance::createRuntimeObject(ExecState* exec)
 
     JSLock lock(SilenceAssertionsOnly);
     RuntimeObject* newObject = newRuntimeObject(exec);
-    m_runtimeObject.set(exec->globalData(), newObject, 0);
+    m_runtimeObject = PassWeak<RuntimeObject>(exec->globalData(), newObject);
     m_rootObject->addRuntimeObject(exec->globalData(), newObject);
     return newObject;
 }
diff --git a/Source/WebCore/bridge/qt/qt_runtime.cpp b/Source/WebCore/bridge/qt/qt_runtime.cpp
index 7022c02b4..83a9ef51b 100644
--- a/Source/WebCore/bridge/qt/qt_runtime.cpp
+++ b/Source/WebCore/bridge/qt/qt_runtime.cpp
@@ -972,7 +972,7 @@ void QtRuntimeMethod::finishCreation(ExecState* exec, const Identifier& identifi
     Base::finishCreation(exec->globalData(), identifier);
     QW_D(QtRuntimeMethod);
     d->m_instance = instance;
-    d->m_finalizer.set(exec->globalData(), this, d);
+    d->m_finalizer = PassWeak<QtRuntimeMethod>(exec->globalData(), this, d);
 }
 
 QtRuntimeMethod::~QtRuntimeMethod()
diff --git a/Source/WebCore/bridge/runtime_root.cpp b/Source/WebCore/bridge/runtime_root.cpp
index d8b478af2..e884e61b1 100644
--- a/Source/WebCore/bridge/runtime_root.cpp
+++ b/Source/WebCore/bridge/runtime_root.cpp
@@ -181,7 +181,7 @@ void RootObject::addRuntimeObject(JSGlobalData& globalData, RuntimeObject* objec
     ASSERT(m_isValid);
     ASSERT(!m_runtimeObjects.get(object));
 
-    m_runtimeObjects.set(object, JSC::Weak<RuntimeObject>(globalData, object, this));
+    m_runtimeObjects.set(object, JSC::PassWeak<RuntimeObject>(globalData, object, this));
 }
 
 void RootObject::removeRuntimeObject(RuntimeObject* object)
@@ -199,6 +199,7 @@ void RootObject::finalize(JSC::Handle<JSC::Unknown> handle, void*)
     RuntimeObject* object = static_cast<RuntimeObject*>(asObject(handle.get()));
     ASSERT(m_runtimeObjects.contains(object));
 
+    RefPtr<RootObject> protect(this);
     object->invalidate();
     m_runtimeObjects.remove(object);
 }
diff --git a/Source/WebCore/config.h b/Source/WebCore/config.h
index 2e0feec8d..04e516f34 100644
--- a/Source/WebCore/config.h
+++ b/Source/WebCore/config.h
@@ -77,6 +77,8 @@
 #undef delete
 #include <wtf/FastMalloc.h>
 
+#include <ciso646>
+
 #endif
 
 // On MSW, wx headers need to be included before windows.h is.
@@ -90,7 +92,7 @@
 // are used from wx headers. On GTK+ for Mac many GTK+ files include <libintl.h>
 // or <glib/gi18n-lib.h>, which in turn include <xlocale/_ctype.h> which uses
 // isacii(). 
-#if !PLATFORM(QT) && !PLATFORM(WX) && !PLATFORM(CHROMIUM) && !(OS(DARWIN) && PLATFORM(GTK))
+#if !PLATFORM(QT) && !PLATFORM(WX) && !PLATFORM(CHROMIUM) && !(OS(DARWIN) && PLATFORM(GTK)) && !defined(_LIBCPP_VERSION)
 #include <wtf/DisallowCType.h>
 #endif
 
diff --git a/Source/WebCore/css/CSSCalculationValue.cpp b/Source/WebCore/css/CSSCalculationValue.cpp
index 972d62b31..87fa73782 100755
--- a/Source/WebCore/css/CSSCalculationValue.cpp
+++ b/Source/WebCore/css/CSSCalculationValue.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2011 Google Inc. All rights reserved.
+ * Copyright (C) 2011, 2012 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
@@ -76,10 +76,20 @@ String CSSCalcValue::customCssText() const
 {
     return "";
 }
-
+    
+double CSSCalcValue::clampToPermittedRange(double value) const
+{
+    return m_nonNegative && value < 0 ? 0 : value;
+}    
+    
 double CSSCalcValue::doubleValue() const 
 { 
-    return m_expression->doubleValue();
+    return clampToPermittedRange(m_expression->doubleValue());
+}
+
+double CSSCalcValue::computeLengthPx(RenderStyle* currentStyle, RenderStyle* rootStyle, double multiplier, bool computingFontSize) const
+{
+    return clampToPermittedRange(m_expression->computeLengthPx(currentStyle, rootStyle, multiplier, computingFontSize));
 }
     
 CSSCalcExpressionNode::~CSSCalcExpressionNode() 
@@ -94,6 +104,11 @@ public:
         return adoptRef(new CSSCalcPrimitiveValue(value, isInteger));
     }
     
+    virtual bool isZero() const
+    {
+        return !m_value->getDoubleValue();
+    }
+
     virtual String cssText() const
     {
         return m_value->cssText();
@@ -113,7 +128,25 @@ public:
             break;
         }
         return 0;
-    }    
+    }
+    
+    virtual double computeLengthPx(RenderStyle* currentStyle, RenderStyle* rootStyle, double multiplier, bool computingFontSize) const
+    {
+        switch (m_category) {
+        case CalcLength:
+            return m_value->computeLength<double>(currentStyle, rootStyle, multiplier, computingFontSize);
+        case CalcPercent:
+        case CalcNumber:
+            return m_value->getDoubleValue();
+        case CalcPercentLength:
+        case CalcPercentNumber:
+        case CalcOther:
+            ASSERT_NOT_REACHED();
+            break;
+        }
+        return 0;        
+    }
+    
 private:
     explicit CSSCalcPrimitiveValue(CSSPrimitiveValue* value, bool isInteger)
         : CSSCalcExpressionNode(unitCategory((CSSPrimitiveValue::UnitTypes)value->primitiveType()), isInteger)
@@ -158,7 +191,6 @@ public:
             break;
                 
         case CalcDivide:
-        case CalcMod:
             if (rightCategory != CalcNumber || rightSide->isZero())
                 return 0;
             newCategory = leftCategory;
@@ -171,10 +203,22 @@ public:
         return adoptRef(new CSSCalcBinaryOperation(leftSide, rightSide, op, newCategory));
     }
     
+    virtual bool isZero() const
+    {
+        return !doubleValue();
+    }
+
     virtual double doubleValue() const 
     {
         return evaluate(m_leftSide->doubleValue(), m_rightSide->doubleValue());
     }
+    
+    virtual double computeLengthPx(RenderStyle* currentStyle, RenderStyle* rootStyle, double multiplier, bool computingFontSize) const
+    {
+        const double leftValue = m_leftSide->computeLengthPx(currentStyle, rootStyle, multiplier, computingFontSize);
+        const double rightValue = m_rightSide->computeLengthPx(currentStyle, rootStyle, multiplier, computingFontSize);
+        return evaluate(leftValue, rightValue);
+    }
 
 private:
     CSSCalcBinaryOperation(PassRefPtr<CSSCalcExpressionNode> leftSide, PassRefPtr<CSSCalcExpressionNode> rightSide, CalcOperator op, CalculationCategory category)
@@ -198,10 +242,6 @@ private:
             if (rightValue)
                 return leftValue / rightValue;
             return std::numeric_limits<double>::quiet_NaN();
-        case CalcMod:
-            // FIXME calc() : mod has been removed from the spec, need to remove
-            // this enum value
-            return 0;
         }
         return 0;
     }
@@ -296,7 +336,7 @@ private:
 
         while (*index < tokens->size() - 1) {
             char operatorCharacter = operatorValue(tokens, *index);
-            if (operatorCharacter != CalcMultiply && operatorCharacter != CalcDivide && operatorCharacter != CalcMod)
+            if (operatorCharacter != CalcMultiply && operatorCharacter != CalcDivide)
                 break;
             ++*index;
 
@@ -346,7 +386,7 @@ private:
     }
 };
 
-PassRefPtr<CSSCalcValue> CSSCalcValue::create(CSSParserString name, CSSParserValueList* parserValueList)
+PassRefPtr<CSSCalcValue> CSSCalcValue::create(CSSParserString name, CSSParserValueList* parserValueList, CalculationPermittedValueRange range)
 {    
     CSSCalcExpressionNodeParser parser;    
     RefPtr<CSSCalcExpressionNode> expression;
@@ -355,7 +395,7 @@ PassRefPtr<CSSCalcValue> CSSCalcValue::create(CSSParserString name, CSSParserVal
         expression = parser.parseCalc(parserValueList);    
     // FIXME calc (http://webkit.org/b/16662) Add parsing for min and max here
 
-    return expression ? adoptRef(new CSSCalcValue(expression)) : 0;
+    return expression ? adoptRef(new CSSCalcValue(expression, range)) : 0;
 }
 
 } // namespace WebCore
diff --git a/Source/WebCore/css/CSSCalculationValue.h b/Source/WebCore/css/CSSCalculationValue.h
index b33b30f9f..7c3667125 100755
--- a/Source/WebCore/css/CSSCalculationValue.h
+++ b/Source/WebCore/css/CSSCalculationValue.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2011 Google Inc. All rights reserved.
+ * Copyright (C) 2011, 2012 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
@@ -59,11 +59,12 @@ class CSSCalcExpressionNode : public RefCounted<CSSCalcExpressionNode> {
 public:
     
     virtual ~CSSCalcExpressionNode() = 0;  
-    virtual double doubleValue() const = 0;  
+    virtual bool isZero() const = 0;
+    virtual double doubleValue() const = 0;
+    virtual double computeLengthPx(RenderStyle* currentStyle, RenderStyle* rootStyle, double multiplier = 1.0, bool computingFontSize = false) const = 0;
     
     CalculationCategory category() const { return m_category; }    
     bool isInteger() const { return m_isInteger; }
-    bool isZero() const { return false; }
     
 protected:
     CSSCalcExpressionNode(CalculationCategory category, bool isInteger)
@@ -78,22 +79,28 @@ protected:
         
 class CSSCalcValue : public CSSValue {
 public:
-    static PassRefPtr<CSSCalcValue> create(CSSParserString name, CSSParserValueList*);
+    static PassRefPtr<CSSCalcValue> create(CSSParserString name, CSSParserValueList*, CalculationPermittedValueRange);
 
     CalculationCategory category() const { return m_expression->category(); }
     bool isInt() const { return m_expression->isInteger(); }    
     double doubleValue() const;
+    bool isNegative() const { return m_expression->doubleValue() < 0; }
+    double computeLengthPx(RenderStyle* currentStyle, RenderStyle* rootStyle, double multiplier = 1.0, bool computingFontSize = false) const;
         
     String customCssText() const;
     
 private:    
-    CSSCalcValue(PassRefPtr<CSSCalcExpressionNode> expression)
+    CSSCalcValue(PassRefPtr<CSSCalcExpressionNode> expression, CalculationPermittedValueRange range)
         : CSSValue(CalculationClass)
         , m_expression(expression)
+        , m_nonNegative(range == CalculationRangeNonNegative)
     {
     }
     
+    double clampToPermittedRange(double) const;
+
     const RefPtr<CSSCalcExpressionNode> m_expression;
+    const bool m_nonNegative;
 };
     
 } // namespace WebCore
diff --git a/Source/WebCore/css/CSSCharsetRule.idl b/Source/WebCore/css/CSSCharsetRule.idl
index be23871d0..3cdaf4a78 100644
--- a/Source/WebCore/css/CSSCharsetRule.idl
+++ b/Source/WebCore/css/CSSCharsetRule.idl
@@ -23,9 +23,9 @@ module css {
     // Introduced in DOM Level 2:
     interface CSSCharsetRule : CSSRule {
 #if defined(LANGUAGE_OBJECTIVE_C) && LANGUAGE_OBJECTIVE_C
-        readonly attribute [ConvertNullStringTo=Null] DOMString encoding;
+        readonly attribute [TreatReturnedNullStringAs=Null] DOMString encoding;
 #else
-                 attribute [ConvertNullStringTo=Null, TreatNullAs=NullString] DOMString encoding
+                 attribute [TreatReturnedNullStringAs=Null, TreatNullAs=NullString] DOMString encoding
                      setter raises(DOMException);
 #endif
     };
diff --git a/Source/WebCore/css/CSSComputedStyleDeclaration.cpp b/Source/WebCore/css/CSSComputedStyleDeclaration.cpp
index d0131eed0..04f72c86e 100644
--- a/Source/WebCore/css/CSSComputedStyleDeclaration.cpp
+++ b/Source/WebCore/css/CSSComputedStyleDeclaration.cpp
@@ -239,11 +239,12 @@ static const int computedProperties[] = {
     CSSPropertyWebkitHyphenateLimitBefore,
     CSSPropertyWebkitHyphenateLimitLines,
     CSSPropertyWebkitHyphens,
+    CSSPropertyWebkitLineAlign,
     CSSPropertyWebkitLineBoxContain,
     CSSPropertyWebkitLineBreak,
     CSSPropertyWebkitLineClamp,
     CSSPropertyWebkitLineGrid,
-    CSSPropertyWebkitLineGridSnap,
+    CSSPropertyWebkitLineSnap,
     CSSPropertyWebkitLocale,
     CSSPropertyWebkitMarginBeforeCollapse,
     CSSPropertyWebkitMarginAfterCollapse,
@@ -266,6 +267,9 @@ static const int computedProperties[] = {
     CSSPropertyWebkitMaskRepeat,
     CSSPropertyWebkitMaskSize,
     CSSPropertyWebkitNbspMode,
+#if ENABLE(OVERFLOW_SCROLLING)
+    CSSPropertyWebkitOverflowScrolling,
+#endif
     CSSPropertyWebkitPerspective,
     CSSPropertyWebkitPerspectiveOrigin,
     CSSPropertyWebkitPrintColorAdjust,
@@ -979,6 +983,7 @@ static PassRefPtr<CSSValue> createLineBoxContainValue(CSSValuePool* cssValuePool
 CSSComputedStyleDeclaration::CSSComputedStyleDeclaration(PassRefPtr<Node> n, bool allowVisitedStyle, const String& pseudoElementName)
     : m_node(n)
     , m_allowVisitedStyle(allowVisitedStyle)
+    , m_refCount(1)
 {
     unsigned nameWithoutColonsStart = pseudoElementName[0] == ':' ? (pseudoElementName[1] == ':' ? 2 : 1) : 0;
     m_pseudoElementSpecifier = CSSSelector::pseudoId(CSSSelector::parsePseudoType(
@@ -989,6 +994,18 @@ CSSComputedStyleDeclaration::~CSSComputedStyleDeclaration()
 {
 }
 
+void CSSComputedStyleDeclaration::ref()
+{
+    ++m_refCount;
+}
+
+void CSSComputedStyleDeclaration::deref()
+{
+    ASSERT(m_refCount);
+    if (!--m_refCount)
+        delete this;
+}
+
 String CSSComputedStyleDeclaration::cssText() const
 {
     String result("");
@@ -1133,7 +1150,7 @@ static PassRefPtr<CSSValue> fillRepeatToCSSValue(EFillRepeat xRepeat, EFillRepea
     return list.release();
 }
 
-static PassRefPtr<CSSValue> fillSizeToCSSValue(const FillSize& fillSize, CSSValuePool* cssValuePool)
+static PassRefPtr<CSSValue> fillSizeToCSSValue(const FillSize& fillSize, const RenderStyle* style, CSSValuePool* cssValuePool)
 {
     if (fillSize.type == Contain)
         return cssValuePool->createIdentifierValue(CSSValueContain);
@@ -1142,11 +1159,11 @@ static PassRefPtr<CSSValue> fillSizeToCSSValue(const FillSize& fillSize, CSSValu
         return cssValuePool->createIdentifierValue(CSSValueCover);
 
     if (fillSize.size.height().isAuto())
-        return cssValuePool->createValue(fillSize.size.width());
+        return zoomAdjustedPixelValueForLength(fillSize.size.width(), style, cssValuePool);
 
     RefPtr<CSSValueList> list = CSSValueList::createSpaceSeparated();
-    list->append(cssValuePool->createValue(fillSize.size.width()));
-    list->append(cssValuePool->createValue(fillSize.size.height()));
+    list->append(zoomAdjustedPixelValueForLength(fillSize.size.width(), style, cssValuePool));
+    list->append(zoomAdjustedPixelValueForLength(fillSize.size.height(), style, cssValuePool));
     return list.release();
 }
 
@@ -1324,11 +1341,11 @@ PassRefPtr<CSSValue> CSSComputedStyleDeclaration::getPropertyCSSValue(int proper
         case CSSPropertyWebkitMaskSize: {
             const FillLayer* layers = propertyID == CSSPropertyWebkitMaskSize ? style->maskLayers() : style->backgroundLayers();
             if (!layers->next())
-                return fillSizeToCSSValue(layers->size(), cssValuePool);
+                return fillSizeToCSSValue(layers->size(), style.get(), cssValuePool);
 
             RefPtr<CSSValueList> list = CSSValueList::createCommaSeparated();
             for (const FillLayer* currLayer = layers; currLayer; currLayer = currLayer->next())
-                list->append(fillSizeToCSSValue(currLayer->size(), cssValuePool));
+                list->append(fillSizeToCSSValue(currLayer->size(), style.get(), cssValuePool));
 
             return list.release();
         }
@@ -1394,16 +1411,16 @@ PassRefPtr<CSSValue> CSSComputedStyleDeclaration::getPropertyCSSValue(int proper
             const FillLayer* layers = propertyID == CSSPropertyWebkitMaskPosition ? style->maskLayers() : style->backgroundLayers();
             if (!layers->next()) {
                 RefPtr<CSSValueList> list = CSSValueList::createSpaceSeparated();
-                list->append(cssValuePool->createValue(layers->xPosition()));
-                list->append(cssValuePool->createValue(layers->yPosition()));
+                list->append(zoomAdjustedPixelValueForLength(layers->xPosition(), style.get(), cssValuePool));
+                list->append(zoomAdjustedPixelValueForLength(layers->yPosition(), style.get(), cssValuePool));
                 return list.release();
             }
 
             RefPtr<CSSValueList> list = CSSValueList::createCommaSeparated();
             for (const FillLayer* currLayer = layers; currLayer; currLayer = currLayer->next()) {
                 RefPtr<CSSValueList> positionList = CSSValueList::createSpaceSeparated();
-                positionList->append(cssValuePool->createValue(currLayer->xPosition()));
-                positionList->append(cssValuePool->createValue(currLayer->yPosition()));
+                positionList->append(zoomAdjustedPixelValueForLength(currLayer->xPosition(), style.get(), cssValuePool));
+                positionList->append(zoomAdjustedPixelValueForLength(currLayer->yPosition(), style.get(), cssValuePool));
                 list->append(positionList);
             }
 
@@ -1571,8 +1588,8 @@ PassRefPtr<CSSValue> CSSComputedStyleDeclaration::getPropertyCSSValue(int proper
         case CSSPropertyWebkitFlexAlign:
             return cssValuePool->createValue(style->flexAlign());
         case CSSPropertyWebkitFlexItemAlign:
-            // FIXME: If flex-item-align:auto, then we should return the parent's flex-align.
-            // http://webkit.org/b/76326
+            if (style->flexItemAlign() == AlignAuto && m_node && m_node->parentNode() && m_node->parentNode()->computedStyle())
+                return cssValuePool->createValue(m_node->parentNode()->computedStyle()->flexAlign());
             return cssValuePool->createValue(style->flexItemAlign());
         case CSSPropertyWebkitFlexDirection:
             return cssValuePool->createValue(style->flexDirection());
@@ -1741,18 +1758,18 @@ PassRefPtr<CSSValue> CSSComputedStyleDeclaration::getPropertyCSSValue(int proper
             const Length& maxHeight = style->maxHeight();
             if (maxHeight.isUndefined())
                 return cssValuePool->createIdentifierValue(CSSValueNone);
-            return cssValuePool->createValue(maxHeight);
+            return zoomAdjustedPixelValueForLength(maxHeight, style.get(), cssValuePool);
         }
         case CSSPropertyMaxWidth: {
             const Length& maxWidth = style->maxWidth();
             if (maxWidth.isUndefined())
                 return cssValuePool->createIdentifierValue(CSSValueNone);
-            return cssValuePool->createValue(maxWidth);
+            return zoomAdjustedPixelValueForLength(maxWidth, style.get(), cssValuePool);
         }
         case CSSPropertyMinHeight:
-            return cssValuePool->createValue(style->minHeight());
+            return zoomAdjustedPixelValueForLength(style->minHeight(), style.get(), cssValuePool);
         case CSSPropertyMinWidth:
-            return cssValuePool->createValue(style->minWidth());
+            return zoomAdjustedPixelValueForLength(style->minWidth(), style.get(), cssValuePool);
         case CSSPropertyOpacity:
             return cssValuePool->createValue(style->opacity(), CSSPrimitiveValue::CSS_NUMBER);
         case CSSPropertyOrphans:
@@ -1776,19 +1793,19 @@ PassRefPtr<CSSValue> CSSComputedStyleDeclaration::getPropertyCSSValue(int proper
         case CSSPropertyPaddingTop:
             if (renderer && renderer->isBox())
                 return zoomAdjustedPixelValue(toRenderBox(renderer)->paddingTop(false), style.get(), cssValuePool);
-            return cssValuePool->createValue(style->paddingTop());
+            return zoomAdjustedPixelValueForLength(style->paddingTop(), style.get(), cssValuePool);
         case CSSPropertyPaddingRight:
             if (renderer && renderer->isBox())
                 return zoomAdjustedPixelValue(toRenderBox(renderer)->paddingRight(false), style.get(), cssValuePool);
-            return cssValuePool->createValue(style->paddingRight());
+            return zoomAdjustedPixelValueForLength(style->paddingRight(), style.get(), cssValuePool);
         case CSSPropertyPaddingBottom:
             if (renderer && renderer->isBox())
                 return zoomAdjustedPixelValue(toRenderBox(renderer)->paddingBottom(false), style.get(), cssValuePool);
-            return cssValuePool->createValue(style->paddingBottom());
+            return zoomAdjustedPixelValueForLength(style->paddingBottom(), style.get(), cssValuePool);
         case CSSPropertyPaddingLeft:
             if (renderer && renderer->isBox())
                 return zoomAdjustedPixelValue(toRenderBox(renderer)->paddingLeft(false), style.get(), cssValuePool);
-            return cssValuePool->createValue(style->paddingLeft());
+            return zoomAdjustedPixelValueForLength(style->paddingLeft(), style.get(), cssValuePool);
         case CSSPropertyPageBreakAfter:
             return cssValuePool->createValue(style->pageBreakAfter());
         case CSSPropertyPageBreakBefore:
@@ -1839,7 +1856,7 @@ PassRefPtr<CSSValue> CSSComputedStyleDeclaration::getPropertyCSSValue(int proper
             }
             }
         case CSSPropertyTextIndent:
-            return cssValuePool->createValue(style->textIndent());
+            return zoomAdjustedPixelValueForLength(style->textIndent(), style.get(), cssValuePool);
         case CSSPropertyTextShadow:
             return valueForShadow(style->textShadow(), propertyID, style.get());
         case CSSPropertyTextRendering:
@@ -2106,6 +2123,12 @@ PassRefPtr<CSSValue> CSSComputedStyleDeclaration::getPropertyCSSValue(int proper
         case CSSPropertyWebkitMarginTopCollapse:
         case CSSPropertyWebkitMarginBeforeCollapse:
             return cssValuePool->createValue(style->marginBeforeCollapse());
+#if ENABLE(OVERFLOW_SCROLLING)
+        case CSSPropertyWebkitOverflowScrolling:
+            if (!style->useTouchOverflowScrolling())
+                return cssValuePool->createIdentifierValue(CSSValueAuto);
+            return cssValuePool->createIdentifierValue(CSSValueTouch);
+#endif
         case CSSPropertyWebkitPerspective:
             if (!style->hasPerspective())
                 return cssValuePool->createIdentifierValue(CSSValueNone);
@@ -2207,8 +2230,10 @@ PassRefPtr<CSSValue> CSSComputedStyleDeclaration::getPropertyCSSValue(int proper
             if (style->lineGrid().isNull())
                 return cssValuePool->createIdentifierValue(CSSValueNone);
             return cssValuePool->createValue(style->lineGrid(), CSSPrimitiveValue::CSS_STRING);
-        case CSSPropertyWebkitLineGridSnap:
-            return CSSPrimitiveValue::create(style->lineGridSnap());
+        case CSSPropertyWebkitLineSnap:
+            return CSSPrimitiveValue::create(style->lineSnap());
+        case CSSPropertyWebkitLineAlign:
+            return CSSPrimitiveValue::create(style->lineAlign());
         case CSSPropertyWebkitWritingMode:
             return cssValuePool->createValue(style->writingMode());
         case CSSPropertyWebkitTextCombine:
diff --git a/Source/WebCore/css/CSSComputedStyleDeclaration.h b/Source/WebCore/css/CSSComputedStyleDeclaration.h
index 2c504acb8..de4494194 100644
--- a/Source/WebCore/css/CSSComputedStyleDeclaration.h
+++ b/Source/WebCore/css/CSSComputedStyleDeclaration.h
@@ -47,9 +47,15 @@ enum EUpdateLayout { DoNotUpdateLayout = false, UpdateLayout = true };
 
 class CSSComputedStyleDeclaration : public CSSStyleDeclaration {
 public:
-    friend PassRefPtr<CSSComputedStyleDeclaration> computedStyle(PassRefPtr<Node>, bool allowVisitedStyle, const String& pseudoElementName);
+    static PassRefPtr<CSSComputedStyleDeclaration> create(PassRefPtr<Node> node, bool allowVisitedStyle = false, const String& pseudoElementName = String())
+    {
+        return adoptRef(new CSSComputedStyleDeclaration(node, allowVisitedStyle, pseudoElementName));
+    }
     virtual ~CSSComputedStyleDeclaration();
 
+    virtual void ref() OVERRIDE;
+    virtual void deref() OVERRIDE;
+
     PassRefPtr<CSSValue> getPropertyCSSValue(int propertyID) const;
     String getPropertyValue(int propertyID) const;
     bool getPropertyPriority(int propertyID) const;
@@ -109,13 +115,9 @@ private:
     RefPtr<Node> m_node;
     PseudoId m_pseudoElementSpecifier;
     bool m_allowVisitedStyle;
+    unsigned m_refCount;
 };
 
-inline PassRefPtr<CSSComputedStyleDeclaration> computedStyle(PassRefPtr<Node> node,  bool allowVisitedStyle = false, const String& pseudoElementName = String())
-{
-    return adoptRef(new CSSComputedStyleDeclaration(node, allowVisitedStyle, pseudoElementName));
-}
-
 } // namespace WebCore
 
 #endif // CSSComputedStyleDeclaration_h
diff --git a/Source/WebCore/css/CSSFontFaceRule.cpp b/Source/WebCore/css/CSSFontFaceRule.cpp
index 8f50c26ac..0972a4b47 100644
--- a/Source/WebCore/css/CSSFontFaceRule.cpp
+++ b/Source/WebCore/css/CSSFontFaceRule.cpp
@@ -34,7 +34,7 @@ CSSFontFaceRule::CSSFontFaceRule(CSSStyleSheet* parent)
 CSSFontFaceRule::~CSSFontFaceRule()
 {
     if (m_style)
-        m_style->clearParentRule();
+        m_style->clearParentRule(this);
 }
 
 String CSSFontFaceRule::cssText() const
@@ -49,7 +49,7 @@ String CSSFontFaceRule::cssText() const
 void CSSFontFaceRule::addSubresourceStyleURLs(ListHashSet<KURL>& urls)
 {
     if (m_style)
-        m_style->addSubresourceStyleURLs(urls);
+        m_style->addSubresourceStyleURLs(urls, parentStyleSheet());
 }
 
 } // namespace WebCore
diff --git a/Source/WebCore/css/CSSFontFaceRule.h b/Source/WebCore/css/CSSFontFaceRule.h
index 2ca0a1069..ab858f298 100644
--- a/Source/WebCore/css/CSSFontFaceRule.h
+++ b/Source/WebCore/css/CSSFontFaceRule.h
@@ -42,7 +42,7 @@ public:
 
     ~CSSFontFaceRule();
 
-    CSSStyleDeclaration* style() const { return m_style->ensureCSSStyleDeclaration(); }
+    CSSStyleDeclaration* style() const { return m_style->ensureRuleCSSStyleDeclaration(this); }
 
     String cssText() const;
 
diff --git a/Source/WebCore/css/CSSFontSelector.cpp b/Source/WebCore/css/CSSFontSelector.cpp
index 02977422e..6d22fdccd 100644
--- a/Source/WebCore/css/CSSFontSelector.cpp
+++ b/Source/WebCore/css/CSSFontSelector.cpp
@@ -42,7 +42,6 @@
 #include "CachedResourceLoader.h"
 #include "Document.h"
 #include "FontCache.h"
-#include "FontFamilyValue.h"
 #include "Frame.h"
 #include "RenderObject.h"
 #include "Settings.h"
@@ -63,6 +62,7 @@ namespace WebCore {
 CSSFontSelector::CSSFontSelector(Document* document)
     : m_document(document)
     , m_beginLoadingTimer(this, &CSSFontSelector::beginLoadTimerFired)
+    , m_version(0)
 {
     // FIXME: An old comment used to say there was no need to hold a reference to m_document
     // because "we are guaranteed to be destroyed before the document". But there does not
@@ -106,94 +106,65 @@ void CSSFontSelector::addFontFaceRule(const CSSFontFaceRule* fontFaceRule)
     unsigned traitsMask = 0;
 
     if (RefPtr<CSSValue> fontStyle = style->getPropertyCSSValue(CSSPropertyFontStyle)) {
-        if (fontStyle->isPrimitiveValue()) {
-            RefPtr<CSSValueList> list = CSSValueList::createCommaSeparated();
-            list->append(fontStyle);
-            fontStyle = list;
-        } else if (!fontStyle->isValueList())
-            return;
-
-        CSSValueList* styleList = static_cast<CSSValueList*>(fontStyle.get());
-        unsigned numStyles = styleList->length();
-        if (!numStyles)
+        if (!fontStyle->isPrimitiveValue())
             return;
 
-        for (unsigned i = 0; i < numStyles; ++i) {
-            switch (static_cast<CSSPrimitiveValue*>(styleList->itemWithoutBoundsCheck(i))->getIdent()) {
-                case CSSValueAll:
-                    traitsMask |= FontStyleMask;
-                    break;
-                case CSSValueNormal:
-                    traitsMask |= FontStyleNormalMask;
-                    break;
-                case CSSValueItalic:
-                case CSSValueOblique:
-                    traitsMask |= FontStyleItalicMask;
-                    break;
-                default:
-                    break;
-            }
+        switch (static_cast<CSSPrimitiveValue*>(fontStyle.get())->getIdent()) {
+        case CSSValueNormal:
+            traitsMask |= FontStyleNormalMask;
+            break;
+        case CSSValueItalic:
+        case CSSValueOblique:
+            traitsMask |= FontStyleItalicMask;
+            break;
+        default:
+            break;
         }
     } else
-        traitsMask |= FontStyleMask;
+        traitsMask |= FontStyleNormalMask;
 
     if (RefPtr<CSSValue> fontWeight = style->getPropertyCSSValue(CSSPropertyFontWeight)) {
-        if (fontWeight->isPrimitiveValue()) {
-            RefPtr<CSSValueList> list = CSSValueList::createCommaSeparated();
-            list->append(fontWeight);
-            fontWeight = list;
-        } else if (!fontWeight->isValueList())
+        if (!fontWeight->isPrimitiveValue())
             return;
 
-        CSSValueList* weightList = static_cast<CSSValueList*>(fontWeight.get());
-        unsigned numWeights = weightList->length();
-        if (!numWeights)
-            return;
-
-        for (unsigned i = 0; i < numWeights; ++i) {
-            switch (static_cast<CSSPrimitiveValue*>(weightList->itemWithoutBoundsCheck(i))->getIdent()) {
-                case CSSValueAll:
-                    traitsMask |= FontWeightMask;
-                    break;
-                case CSSValueBolder:
-                case CSSValueBold:
-                case CSSValue700:
-                    traitsMask |= FontWeight700Mask;
-                    break;
-                case CSSValueNormal:
-                case CSSValue400:
-                    traitsMask |= FontWeight400Mask;
-                    break;
-                case CSSValue900:
-                    traitsMask |= FontWeight900Mask;
-                    break;
-                case CSSValue800:
-                    traitsMask |= FontWeight800Mask;
-                    break;
-                case CSSValue600:
-                    traitsMask |= FontWeight600Mask;
-                    break;
-                case CSSValue500:
-                    traitsMask |= FontWeight500Mask;
-                    break;
-                case CSSValue300:
-                    traitsMask |= FontWeight300Mask;
-                    break;
-                case CSSValueLighter:
-                case CSSValue200:
-                    traitsMask |= FontWeight200Mask;
-                    break;
-                case CSSValue100:
-                    traitsMask |= FontWeight100Mask;
-                    break;
-                default:
-                    break;
-            }
+        switch (static_cast<CSSPrimitiveValue*>(fontWeight.get())->getIdent()) {
+        case CSSValueBold:
+        case CSSValue700:
+            traitsMask |= FontWeight700Mask;
+            break;
+        case CSSValueNormal:
+        case CSSValue400:
+            traitsMask |= FontWeight400Mask;
+            break;
+        case CSSValue900:
+            traitsMask |= FontWeight900Mask;
+            break;
+        case CSSValue800:
+            traitsMask |= FontWeight800Mask;
+            break;
+        case CSSValue600:
+            traitsMask |= FontWeight600Mask;
+            break;
+        case CSSValue500:
+            traitsMask |= FontWeight500Mask;
+            break;
+        case CSSValue300:
+            traitsMask |= FontWeight300Mask;
+            break;
+        case CSSValue200:
+            traitsMask |= FontWeight200Mask;
+            break;
+        case CSSValue100:
+            traitsMask |= FontWeight100Mask;
+            break;
+        default:
+            break;
         }
     } else
-        traitsMask |= FontWeightMask;
+        traitsMask |= FontWeight400Mask;
 
     if (RefPtr<CSSValue> fontVariant = style->getPropertyCSSValue(CSSPropertyFontVariant)) {
+        // font-variant descriptor can be a value list.
         if (fontVariant->isPrimitiveValue()) {
             RefPtr<CSSValueList> list = CSSValueList::createCommaSeparated();
             list->append(fontVariant);
@@ -208,9 +179,6 @@ void CSSFontSelector::addFontFaceRule(const CSSFontFaceRule* fontFaceRule)
 
         for (unsigned i = 0; i < numVariants; ++i) {
             switch (static_cast<CSSPrimitiveValue*>(variantList->itemWithoutBoundsCheck(i))->getIdent()) {
-                case CSSValueAll:
-                    traitsMask |= FontVariantMask;
-                    break;
                 case CSSValueNormal:
                     traitsMask |= FontVariantNormalMask;
                     break;
@@ -286,11 +254,10 @@ void CSSFontSelector::addFontFaceRule(const CSSFontFaceRule* fontFaceRule)
         CSSPrimitiveValue* item = static_cast<CSSPrimitiveValue*>(familyList->itemWithoutBoundsCheck(i));
         String familyName;
         if (item->isString())
-            familyName = static_cast<FontFamilyValue*>(item)->familyName();
+            familyName = item->getStringValue();
         else if (item->isIdent()) {
             // We need to use the raw text for all the generic family types, since @font-face is a way of actually
             // defining what font to use for those types.
-            String familyName;
             switch (item->getIdent()) {
                 case CSSValueSerif:
                     familyName = serifFamily;
@@ -341,6 +308,8 @@ void CSSFontSelector::addFontFaceRule(const CSSFontFaceRule* fontFaceRule)
         }
 
         familyFontFaces->append(fontFace);
+        
+        ++m_version;
     }
 }
 
@@ -365,7 +334,7 @@ void CSSFontSelector::dispatchInvalidationCallbacks()
     if (!m_document)
         return;
     if (CSSStyleSelector* styleSelector = m_document->styleSelectorIfExists())
-        styleSelector->invalidateMatchedDeclarationCache();
+        styleSelector->invalidateMatchedPropertiesCache();
     if (m_document->inPageCache() || !m_document->renderer())
         return;
     m_document->scheduleForcedStyleRecalc();
@@ -427,6 +396,7 @@ static inline bool compareFontFaces(CSSFontFace* first, CSSFontFace* second)
     if (firstHasDesiredVariant != secondHasDesiredVariant)
         return firstHasDesiredVariant;
 
+    // We need to check font-variant css property for CSS2.1 compatibility.
     if ((desiredTraitsMaskForComparison & FontVariantSmallCapsMask) && !first->isLocalFallback() && !second->isLocalFallback()) {
         // Prefer a font that has indicated that it can only support small-caps to a font that claims to support
         // all variants.  The specialized font is more likely to be true small-caps and not require synthesis.
@@ -456,12 +426,11 @@ static inline bool compareFontFaces(CSSFontFace* first, CSSFontFace* second)
     if (firstTraitsMask & desiredTraitsMaskForComparison & FontWeightMask)
         return true;
 
-    // http://www.w3.org/TR/2002/WD-css3-webfonts-20020802/#q46 says: "If there are fewer then 9 weights in the family, the default algorithm
-    // for filling the "holes" is as follows. If '500' is unassigned, it will be assigned the same font as '400'. If any of the values '600',
-    // '700', '800', or '900' remains unassigned, they are assigned to the same face as the next darker assigned keyword, if any, or the next
-    // lighter one otherwise. If any of '300', '200', or '100' remains unassigned, it is assigned to the next lighter assigned keyword, if any,
-    // or the next darker otherwise."
-    // For '400', we made up our own rule (which then '500' follows).
+    // http://www.w3.org/TR/2011/WD-css3-fonts-20111004/#font-matching-algorithm says :
+    //   - If the desired weight is less than 400, weights below the desired weight are checked in descending order followed by weights above the desired weight in ascending order until a match is found.
+    //   - If the desired weight is greater than 500, weights above the desired weight are checked in ascending order followed by weights below the desired weight in descending order until a match is found.
+    //   - If the desired weight is 400, 500 is checked first and then the rule for desired weights less than 400 is used.
+    //   - If the desired weight is 500, 400 is checked first and then the rule for desired weights less than 400 is used.
 
     static const unsigned fallbackRuleSets = 9;
     static const unsigned rulesPerSet = 8;
@@ -469,8 +438,8 @@ static inline bool compareFontFaces(CSSFontFace* first, CSSFontFace* second)
         { FontWeight200Mask, FontWeight300Mask, FontWeight400Mask, FontWeight500Mask, FontWeight600Mask, FontWeight700Mask, FontWeight800Mask, FontWeight900Mask },
         { FontWeight100Mask, FontWeight300Mask, FontWeight400Mask, FontWeight500Mask, FontWeight600Mask, FontWeight700Mask, FontWeight800Mask, FontWeight900Mask },
         { FontWeight200Mask, FontWeight100Mask, FontWeight400Mask, FontWeight500Mask, FontWeight600Mask, FontWeight700Mask, FontWeight800Mask, FontWeight900Mask },
-        { FontWeight500Mask, FontWeight300Mask, FontWeight600Mask, FontWeight200Mask, FontWeight700Mask, FontWeight100Mask, FontWeight800Mask, FontWeight900Mask },
-        { FontWeight400Mask, FontWeight300Mask, FontWeight600Mask, FontWeight200Mask, FontWeight700Mask, FontWeight100Mask, FontWeight800Mask, FontWeight900Mask },
+        { FontWeight500Mask, FontWeight300Mask, FontWeight200Mask, FontWeight100Mask, FontWeight600Mask, FontWeight700Mask, FontWeight800Mask, FontWeight900Mask },
+        { FontWeight400Mask, FontWeight300Mask, FontWeight200Mask, FontWeight100Mask, FontWeight600Mask, FontWeight700Mask, FontWeight800Mask, FontWeight900Mask },
         { FontWeight700Mask, FontWeight800Mask, FontWeight900Mask, FontWeight500Mask, FontWeight400Mask, FontWeight300Mask, FontWeight200Mask, FontWeight100Mask },
         { FontWeight800Mask, FontWeight900Mask, FontWeight600Mask, FontWeight500Mask, FontWeight400Mask, FontWeight300Mask, FontWeight200Mask, FontWeight100Mask },
         { FontWeight900Mask, FontWeight700Mask, FontWeight600Mask, FontWeight500Mask, FontWeight400Mask, FontWeight300Mask, FontWeight200Mask, FontWeight100Mask },
diff --git a/Source/WebCore/css/CSSFontSelector.h b/Source/WebCore/css/CSSFontSelector.h
index 3e992cc74..a5f8db5d2 100644
--- a/Source/WebCore/css/CSSFontSelector.h
+++ b/Source/WebCore/css/CSSFontSelector.h
@@ -51,6 +51,8 @@ public:
         return adoptRef(new CSSFontSelector(document));
     }
     virtual ~CSSFontSelector();
+    
+    virtual unsigned version() const OVERRIDE { return m_version; }
 
     virtual FontData* getFontData(const FontDescription& fontDescription, const AtomicString& familyName);
 
@@ -85,6 +87,8 @@ private:
 
     Vector<CachedResourceHandle<CachedFont> > m_fontsToBeginLoading;
     Timer<CSSFontSelector> m_beginLoadingTimer;
+    
+    unsigned m_version;
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/css/CSSGrammar.y b/Source/WebCore/css/CSSGrammar.y
index 705c36be0..a57edf3d1 100644
--- a/Source/WebCore/css/CSSGrammar.y
+++ b/Source/WebCore/css/CSSGrammar.y
@@ -1530,12 +1530,6 @@ calc_func_operator:
     | '/' maybe_space {
         $$ = '/';
     }
-    | IDENT maybe_space {
-        if (equalIgnoringCase("mod", $1.characters, $1.length))
-            $$ = '%';
-        else
-            $$ = 0;
-    }
   ;
 
 calc_func_paren_expr:
diff --git a/Source/WebCore/css/CSSImportRule.idl b/Source/WebCore/css/CSSImportRule.idl
index 05654fe27..ddd0a8bff 100644
--- a/Source/WebCore/css/CSSImportRule.idl
+++ b/Source/WebCore/css/CSSImportRule.idl
@@ -22,7 +22,7 @@ module css {
 
     // Introduced in DOM Level 2:
     interface CSSImportRule : CSSRule {
-        readonly attribute [ConvertNullStringTo=Null] DOMString href;
+        readonly attribute [TreatReturnedNullStringAs=Null] DOMString href;
         readonly attribute MediaList media;
         readonly attribute CSSStyleSheet styleSheet;
     };
diff --git a/Source/WebCore/css/CSSMediaRule.idl b/Source/WebCore/css/CSSMediaRule.idl
index c62ac9b77..f52a6cec8 100644
--- a/Source/WebCore/css/CSSMediaRule.idl
+++ b/Source/WebCore/css/CSSMediaRule.idl
@@ -25,10 +25,10 @@ module css {
         readonly attribute MediaList media;
         readonly attribute CSSRuleList cssRules;
         
-        [ObjCLegacyUnnamedParameters] unsigned long      insertRule(in [Optional=CallWithDefaultValue] DOMString rule, 
-                                                     in [Optional=CallWithDefaultValue] unsigned long index)
+        [ObjCLegacyUnnamedParameters] unsigned long      insertRule(in [Optional=DefaultIsUndefined] DOMString rule, 
+                                                     in [Optional=DefaultIsUndefined] unsigned long index)
             raises(DOMException);
-        void               deleteRule(in [Optional=CallWithDefaultValue] unsigned long index)
+        void               deleteRule(in [Optional=DefaultIsUndefined] unsigned long index)
             raises(DOMException);
     };
 
diff --git a/Source/WebCore/css/CSSPageRule.cpp b/Source/WebCore/css/CSSPageRule.cpp
index 359d0fbcd..d067e46c5 100644
--- a/Source/WebCore/css/CSSPageRule.cpp
+++ b/Source/WebCore/css/CSSPageRule.cpp
@@ -1,7 +1,7 @@
 /*
  * (C) 1999-2003 Lars Knoll (knoll@kde.org)
  * (C) 2002-2003 Dirk Mueller (mueller@kde.org)
- * Copyright (C) 2002, 2005, 2006, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2002, 2005, 2006, 2008, 2012 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -22,20 +22,29 @@
 #include "config.h"
 #include "CSSPageRule.h"
 
+#include "CSSParser.h"
+#include "CSSSelector.h"
+#include "Document.h"
 #include "StylePropertySet.h"
 #include <wtf/Vector.h>
 
 namespace WebCore {
 
 CSSPageRule::CSSPageRule(CSSStyleSheet* parent, int sourceLine)
-    : CSSStyleRule(parent, sourceLine, CSSRule::PAGE_RULE)
+    : CSSRule(parent, CSSRule::PAGE_RULE)
 {
+    setSourceLine(sourceLine);
 }
 
-String CSSPageRule::pageSelectorText() const
+CSSPageRule::~CSSPageRule()
+{
+    m_style->clearParentRule(this);
+}
+
+String CSSPageRule::selectorText() const
 {
     String text = "@page";
-    CSSSelector* selector = selectorList().first();
+    const CSSSelector* selector = this->selector();
     if (selector) {
         String pageSpecification = selector->selectorText();
         if (!pageSpecification.isEmpty() && pageSpecification != starAtom)
@@ -44,4 +53,35 @@ String CSSPageRule::pageSelectorText() const
     return text;
 }
 
+void CSSPageRule::setSelectorText(const String& selectorText)
+{
+    Document* doc = 0;
+    if (CSSStyleSheet* styleSheet = parentStyleSheet())
+        doc = styleSheet->findDocument();
+    if (!doc)
+        return;
+    
+    CSSParser p;
+    CSSSelectorList selectorList;
+    p.parseSelector(selectorText, doc, selectorList);
+    if (!selectorList.first())
+        return;
+    
+    String oldSelectorText = this->selectorText();
+    m_selectorList.adopt(selectorList);
+    
+    if (this->selectorText() == oldSelectorText)
+        return;
+    doc->styleSelectorChanged(DeferRecalcStyle);
+}
+
+String CSSPageRule::cssText() const
+{
+    String result = selectorText();
+    result += " { ";
+    result += m_style->asText();
+    result += "}";
+    return result;
+}
+
 } // namespace WebCore
diff --git a/Source/WebCore/css/CSSPageRule.h b/Source/WebCore/css/CSSPageRule.h
index 687114968..7b09665b3 100644
--- a/Source/WebCore/css/CSSPageRule.h
+++ b/Source/WebCore/css/CSSPageRule.h
@@ -22,7 +22,9 @@
 #ifndef CSSPageRule_h
 #define CSSPageRule_h
 
-#include "CSSStyleRule.h"
+#include "CSSRule.h"
+#include "CSSSelectorList.h"
+#include "StylePropertySet.h"
 #include <wtf/PassRefPtr.h>
 #include <wtf/RefPtr.h>
 
@@ -31,17 +33,32 @@ namespace WebCore {
 class CSSSelector;
 class CSSSelectorList;
 
-class CSSPageRule : public CSSStyleRule {
+class CSSPageRule : public CSSRule {
 public:
     static PassRefPtr<CSSPageRule> create(CSSStyleSheet* parent, int sourceLine)
     {
         return adoptRef(new CSSPageRule(parent, sourceLine));
     }
+    ~CSSPageRule();
 
-    String pageSelectorText() const;
+    CSSStyleDeclaration* style() const { return m_style->ensureRuleCSSStyleDeclaration(this); }
+
+    String selectorText() const;
+    void setSelectorText(const String&);
+
+    String cssText() const;
+    
+    const CSSSelector* selector() const { return m_selectorList.first(); }
+    StylePropertySet* properties() const { return m_style.get(); }
+    
+    void adoptSelectorVector(Vector<OwnPtr<CSSParserSelector> >& selectors) { m_selectorList.adoptSelectorVector(selectors); }
+    void setDeclaration(PassRefPtr<StylePropertySet> style) { m_style = style; }
 
 private:
     CSSPageRule(CSSStyleSheet* parent, int sourceLine);
+
+    RefPtr<StylePropertySet> m_style;
+    CSSSelectorList m_selectorList;
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/css/CSSPageRule.idl b/Source/WebCore/css/CSSPageRule.idl
index 4f3747ea0..b3ea22850 100644
--- a/Source/WebCore/css/CSSPageRule.idl
+++ b/Source/WebCore/css/CSSPageRule.idl
@@ -23,7 +23,7 @@ module css {
     // Introduced in DOM Level 2:
     interface CSSPageRule : CSSRule {
 
-                 attribute [ConvertNullStringTo=Null, TreatNullAs=NullString] DOMString selectorText;
+                 attribute [TreatReturnedNullStringAs=Null, TreatNullAs=NullString] DOMString selectorText;
 
         readonly attribute CSSStyleDeclaration style;
 
diff --git a/Source/WebCore/css/CSSParser.cpp b/Source/WebCore/css/CSSParser.cpp
index 8a1075171..52a80418d 100644
--- a/Source/WebCore/css/CSSParser.cpp
+++ b/Source/WebCore/css/CSSParser.cpp
@@ -61,7 +61,6 @@
 #include "Counter.h"
 #include "Document.h"
 #include "FloatConversion.h"
-#include "FontFamilyValue.h"
 #include "FontFeatureValue.h"
 #include "FontValue.h"
 #include "HTMLParserIdioms.h"
@@ -326,7 +325,7 @@ static inline bool isColorPropertyID(int propertyId)
     }
 }
 
-static bool parseColorValue(StylePropertySet* declaration, int propertyId, const String& string, bool important, bool strict, CSSStyleSheet* contextStyleSheet = 0)
+static bool parseColorValue(StylePropertySet* declaration, int propertyId, const String& string, bool important, bool strict, CSSStyleSheet* contextStyleSheet)
 {
     if (!string.length())
         return false;
@@ -346,22 +345,25 @@ static bool parseColorValue(StylePropertySet* declaration, int propertyId, const
         validPrimitive = true;
     }
 
-    CSSStyleSheet* styleSheet = contextStyleSheet ? contextStyleSheet : declaration->contextStyleSheet();
-    if (!styleSheet)
-        return false;
-    Document* document = styleSheet->findDocument();
-    if (!document)
-        return false;
+    Document* document = contextStyleSheet->findDocument();
     if (validPrimitive) {
-        CSSProperty property(propertyId, document->cssValuePool()->createIdentifierValue(valueID), important);
-        declaration->addParsedProperty(property);
+        RefPtr<CSSValue> value;
+        if (document)
+            value = document->cssValuePool()->createIdentifierValue(valueID);
+        else
+            value = CSSPrimitiveValue::createIdentifier(valueID);
+        declaration->addParsedProperty(CSSProperty(propertyId, value.release(), important));
         return true;
     }
     RGBA32 color;
     if (!CSSParser::fastParseColor(color, string, strict && string[0] != '#'))
         return false;
-    CSSProperty property(propertyId, document->cssValuePool()->createColorValue(color), important);
-    declaration->addParsedProperty(property);
+    RefPtr<CSSValue> value;
+    if (document)
+        value = document->cssValuePool()->createColorValue(color);
+    else
+        value = CSSPrimitiveValue::createColor(color);
+    declaration->addParsedProperty(CSSProperty(propertyId, value.release(), important));
     return true;
 }
 
@@ -409,7 +411,7 @@ static inline bool isSimpleLengthPropertyID(int propertyId, bool& acceptsNegativ
     }
 }
 
-static bool parseSimpleLengthValue(StylePropertySet* declaration, int propertyId, const String& string, bool important, bool strict)
+static bool parseSimpleLengthValue(StylePropertySet* declaration, int propertyId, const String& string, bool important, bool strict, CSSStyleSheet* contextStyleSheet)
 {
     bool acceptsNegativeNumbers;
     unsigned length = string.length();
@@ -473,33 +475,37 @@ static bool parseSimpleLengthValue(StylePropertySet* declaration, int propertyId
     if (number < 0 && !acceptsNegativeNumbers)
         return false;
 
-    CSSStyleSheet* styleSheet = declaration->contextStyleSheet();
-    if (!styleSheet)
-        return false;
-    Document* document = styleSheet->findDocument();
-    if (!document)
-        return false;
-    CSSProperty property(propertyId, document->cssValuePool()->createValue(number, unit), important);
-    declaration->addParsedProperty(property);
+    Document* document = contextStyleSheet->findDocument();
+    RefPtr<CSSValue> value;
+    if (document)
+        value = document->cssValuePool()->createValue(number, unit);
+    else
+        value = CSSPrimitiveValue::create(number, unit);
+    declaration->addParsedProperty(CSSProperty(propertyId, value.release(), important));
     return true;
 }
 
-bool CSSParser::parseValue(StylePropertySet* declaration, int propertyId, const String& string, bool important, bool strict)
+PassRefPtr<CSSValueList> CSSParser::parseFontFaceValue(const AtomicString& string, CSSStyleSheet* contextStyleSheet)
 {
-    if (parseSimpleLengthValue(declaration, propertyId, string, important, strict))
+    RefPtr<StylePropertySet> dummyStyle = StylePropertySet::create();
+    if (!parseValue(dummyStyle.get(), CSSPropertyFontFamily, string, false, false, contextStyleSheet))
+        return 0;
+    return static_pointer_cast<CSSValueList>(dummyStyle->getPropertyCSSValue(CSSPropertyFontFamily));
+}
+
+bool CSSParser::parseValue(StylePropertySet* declaration, int propertyId, const String& string, bool important, bool strict, CSSStyleSheet* contextStyleSheet)
+{
+    if (parseSimpleLengthValue(declaration, propertyId, string, important, strict, contextStyleSheet))
         return true;
-    if (parseColorValue(declaration, propertyId, string, important, strict))
+    if (parseColorValue(declaration, propertyId, string, important, strict, contextStyleSheet))
         return true;
     CSSParser parser(strict);
-    return parser.parseValue(declaration, propertyId, string, important);
+    return parser.parseValue(declaration, propertyId, string, important, contextStyleSheet);
 }
 
 bool CSSParser::parseValue(StylePropertySet* declaration, int propertyId, const String& string, bool important, CSSStyleSheet* contextStyleSheet)
 {
-    if (contextStyleSheet)
-        setStyleSheet(contextStyleSheet);
-    else
-        setStyleSheet(declaration->contextStyleSheet());
+    setStyleSheet(contextStyleSheet);
 
     setupParser("@-webkit-value{", string, "} ");
 
@@ -599,10 +605,8 @@ bool CSSParser::parseDeclaration(StylePropertySet* declaration, const String& st
     // Length of the "@-webkit-decls{" prefix.
     static const unsigned prefixLength = 15;
 
-    if (contextStyleSheet)
-        setStyleSheet(contextStyleSheet);
-    else
-        setStyleSheet(declaration->contextStyleSheet());
+    setStyleSheet(contextStyleSheet);
+
     if (styleSourceData) {
         m_currentRuleData = CSSRuleSourceData::create();
         m_currentRuleData->styleSourceData = CSSStyleSourceData::create();
@@ -707,7 +711,9 @@ Document* CSSParser::findDocument() const
 
 bool CSSParser::validCalculationUnit(CSSParserValue* value, Units unitflags)
 {
-    if (!parseCalculation(value))
+    bool mustBeNonNegative = unitflags & FNonNeg;
+
+    if (!parseCalculation(value, mustBeNonNegative ? CalculationRangeNonNegative : CalculationRangeAll))
         return false;
 
     bool b = false;
@@ -717,17 +723,15 @@ bool CSSParser::validCalculationUnit(CSSParserValue* value, Units unitflags)
         break;
     case CalcPercent:
         b = (unitflags & FPercent);
-        // FIXME calc (http://webkit.org/b/16662): test FNonNeg here, eg
-        // if (b && (unitflags & FNonNeg) && m_parsedCalculation->doubleValue() < 0)
-        //    b = false;
+        if (b && mustBeNonNegative && m_parsedCalculation->isNegative())
+            b = false;
         break;
     case CalcNumber:
         b = (unitflags & FNumber);
         if (!b && (unitflags & FInteger) && m_parsedCalculation->isInt())
             b = true;
-        // FIXME calc (http://webkit.org/b/16662): test FNonNeg here, eg
-        // if (b && (unitflags & FNonNeg) && m_parsedCalculation->doubleValue() < 0)
-        //    b = false;
+        if (b && mustBeNonNegative && m_parsedCalculation->isNegative())
+            b = false;
         break;
     case CalcPercentLength:
         b = (unitflags & FPercent) && (unitflags & FLength);
@@ -800,10 +804,7 @@ inline PassRefPtr<CSSPrimitiveValue> CSSParser::createPrimitiveNumericValue(CSSP
 {
     if (m_parsedCalculation) {
         ASSERT(isCalculation(value));
-        // FIXME calc() http://webkit.org/b/16662: create a CSSPrimitiveValue here, ie
-        // return CSSPrimitiveValue::create(m_parsedCalculation.release());
-        m_parsedCalculation.release();
-        return 0;
+        return CSSPrimitiveValue::create(m_parsedCalculation.release());
     }
                
     ASSERT((value->unit >= CSSPrimitiveValue::CSS_NUMBER && value->unit <= CSSPrimitiveValue::CSS_KHZ)
@@ -904,9 +905,7 @@ inline PassRefPtr<CSSPrimitiveValue> CSSParser::parseValidPrimitive(int id, CSSP
     if (value->unit >= CSSParserValue::Q_EMS)
         return CSSPrimitiveValue::createAllowingMarginQuirk(value->fValue, CSSPrimitiveValue::CSS_EMS);
     if (isCalculation(value))
-        // FIXME calc()  http://webkit.org/b/16662: create a primitive value here, ie
-        // return CSSPrimitiveValue::create(m_parsedCalculation.release());
-        m_parsedCalculation.release();
+        return CSSPrimitiveValue::create(m_parsedCalculation.release());
 
     return 0;
 }
@@ -996,14 +995,14 @@ bool CSSParser::parseValue(int propId, bool important)
             || id == CSSValueAvoid
             || id == CSSValueLeft
             || id == CSSValueRight)
-            validPrimitive = true;
+            validPrimitive = ((propId == CSSPropertyWebkitRegionBreakAfter) || (propId == CSSPropertyWebkitRegionBreakBefore)) ? cssRegionsEnabled() : true;
         break;
 
     case CSSPropertyPageBreakInside:     // avoid | auto | inherit
     case CSSPropertyWebkitColumnBreakInside:
     case CSSPropertyWebkitRegionBreakInside:
         if (id == CSSValueAuto || id == CSSValueAvoid)
-            validPrimitive = true;
+            validPrimitive = (propId == CSSPropertyWebkitRegionBreakInside) ? cssRegionsEnabled() : true;
         break;
 
     case CSSPropertyEmptyCells:          // show | hide | inherit
@@ -1411,7 +1410,9 @@ bool CSSParser::parseValue(int propId, bool important)
         break;
 
     case CSSPropertyFontStyle:           // normal | italic | oblique | inherit
-        return parseFontStyle(important);
+        if (id == CSSValueNormal || id == CSSValueItalic || id == CSSValueOblique)
+            validPrimitive = true;
+        break;
 
     case CSSPropertyFontVariant:         // normal | small-caps | inherit
         return parseFontVariant(important);
@@ -1722,7 +1723,7 @@ bool CSSParser::parseValue(int propId, bool important)
         validPrimitive = id == CSSValueRow || id == CSSValueRowReverse || id == CSSValueColumn || id == CSSValueColumnReverse;
         break;
     case CSSPropertyWebkitFlexWrap:
-        validPrimitive = id == CSSValueNowrap || id == CSSValueWrap || id == CSSValueWrapReverse;
+        validPrimitive = id == CSSValueNone || id == CSSValueWrap || id == CSSValueWrapReverse;
         break;
     case CSSPropertyWebkitMarquee: {
         const int properties[5] = { CSSPropertyWebkitMarqueeDirection, CSSPropertyWebkitMarqueeIncrement,
@@ -1759,11 +1760,15 @@ bool CSSParser::parseValue(int propId, bool important)
             validPrimitive = validUnit(value, FTime | FInteger | FNonNeg, m_strict);
         break;
     case CSSPropertyWebkitFlowInto:
+        if (!cssRegionsEnabled())
+            return false;
         return parseFlowThread(propId, important);
     case CSSPropertyWebkitFlowFrom:
+        if (!cssRegionsEnabled())
+            return false;
         return parseRegionThread(propId, important);
     case CSSPropertyWebkitRegionOverflow:
-        if (id == CSSValueAuto || id == CSSValueBreak)
+        if (cssRegionsEnabled() && (id == CSSValueAuto || id == CSSValueBreak))
             validPrimitive = true;
         break;
 
@@ -2049,10 +2054,14 @@ bool CSSParser::parseValue(int propId, bool important)
             }
         }
         break;
-    case CSSPropertyWebkitLineGridSnap:
+    case CSSPropertyWebkitLineSnap:
         if (id == CSSValueNone || id == CSSValueBaseline || id == CSSValueContain)
             validPrimitive = true;
         break;
+    case CSSPropertyWebkitLineAlign:
+        if (id == CSSValueNone || id == CSSValueEdges)
+            validPrimitive = true;
+        break;
     case CSSPropertyWebkitLocale:
         if (id == CSSValueAuto || value->unit == CSSPrimitiveValue::CSS_STRING)
             validPrimitive = true;
@@ -2095,6 +2104,14 @@ bool CSSParser::parseValue(int propId, bool important)
         }
         break;
 #endif
+
+#if ENABLE(OVERFLOW_SCROLLING)
+    case CSSPropertyWebkitOverflowScrolling:
+        if (id == CSSValueAuto || id == CSSValueTouch)
+            validPrimitive = true;
+        break;
+#endif
+
         /* shorthand properties */
     case CSSPropertyBackground: {
         // Position must come before color in this array because a plain old "0" is a legal color
@@ -2471,23 +2488,20 @@ bool CSSParser::parseFillShorthand(int propId, const int* properties, int numPro
             return false;
     }
 
-    // Fill in any remaining properties with the initial value.
-    for (i = 0; i < numProperties; ++i) {
+    // Now add all of the properties we found.
+    for (i = 0; i < numProperties; i++) {
+        // Fill in any remaining properties with the initial value.
         if (!parsedProperty[i]) {
             addFillValue(values[i], cssValuePool()->createImplicitInitialValue());
             if (properties[i] == CSSPropertyBackgroundPosition || properties[i] == CSSPropertyWebkitMaskPosition)
                 addFillValue(positionYValue, cssValuePool()->createImplicitInitialValue());
             if (properties[i] == CSSPropertyBackgroundRepeat || properties[i] == CSSPropertyWebkitMaskRepeat)
                 addFillValue(repeatYValue, cssValuePool()->createImplicitInitialValue());
-            if ((properties[i] == CSSPropertyBackgroundOrigin || properties[i] == CSSPropertyWebkitMaskOrigin) && !parsedProperty[i]) {
+            if ((properties[i] == CSSPropertyBackgroundOrigin || properties[i] == CSSPropertyWebkitMaskOrigin)) {
                 // If background-origin wasn't present, then reset background-clip also.
                 addFillValue(clipValue, cssValuePool()->createImplicitInitialValue());
             }
         }
-    }
-
-    // Now add all of the properties we found.
-    for (i = 0; i < numProperties; i++) {
         if (properties[i] == CSSPropertyBackgroundPosition) {
             addProperty(CSSPropertyBackgroundPositionX, values[i].release(), important);
             // it's OK to call positionYValue.release() since we only see CSSPropertyBackgroundPosition once
@@ -2664,16 +2678,15 @@ bool CSSParser::parseShorthand(int propId, const int *properties, int numPropert
     ShorthandScope scope(this, propId);
 
     bool found = false;
-    bool fnd[6]; // Trust me ;)
-    for (int i = 0; i < numProperties; i++)
-        fnd[i] = false;
+    int propertiesParsed = 0;
+    bool fnd[6]= { false, false, false, false, false, false }; // 6 is enough size.
 
     while (m_valueList->current()) {
         found = false;
         for (int propIndex = 0; !found && propIndex < numProperties; ++propIndex) {
-            if (!fnd[propIndex]) {
-                if (parseValue(properties[propIndex], important))
+            if (!fnd[propIndex] && parseValue(properties[propIndex], important)) {
                     fnd[propIndex] = found = true;
+                    propertiesParsed++;
             }
         }
 
@@ -2683,6 +2696,9 @@ bool CSSParser::parseShorthand(int propId, const int *properties, int numPropert
             return false;
     }
 
+    if (propertiesParsed == numProperties)
+        return true;
+
     // Fill in any remaining properties with the initial value.
     ImplicitScope implicitScope(this, PropertyImplicit);
     for (int i = 0; i < numProperties; ++i) {
@@ -4150,6 +4166,8 @@ bool CSSParser::parseFont(bool important)
     // Optional font-style, font-variant and font-weight.
     while (value) {
         int id = value->id;
+        if (id == CSSValueInitial || id == CSSValueInherit)
+            return false;
         if (id) {
             if (id == CSSValueNormal) {
                 // It's the initial value for all three, so mark the corresponding longhand as explicit.
@@ -4219,6 +4237,9 @@ bool CSSParser::parseFont(bool important)
     if (!value)
         return false;
 
+    if (value->id == CSSValueInitial || value->id == CSSValueInherit)
+        return false;
+
     // Set undefined values to default.
     if (!font->style)
         font->style = cssValuePool()->createIdentifierValue(CSSValueNormal);
@@ -4237,6 +4258,9 @@ bool CSSParser::parseFont(bool important)
     if (!font->size || !value)
         return false;
 
+    if (value->id == CSSValueInitial || value->id == CSSValueInherit)
+        return false;
+
     if (value->unit == CSSParserValue::Operator && value->iValue == '/') {
         // The line-height property.
         value = m_valueList->next();
@@ -4255,6 +4279,9 @@ bool CSSParser::parseFont(bool important)
             return false;
     }
 
+    if (value->id == CSSValueInitial || value->id == CSSValueInherit)
+        return false;
+
     if (!font->lineHeight)
         font->lineHeight = cssValuePool()->createIdentifierValue(CSSValueNormal);
 
@@ -4279,13 +4306,46 @@ bool CSSParser::parseFont(bool important)
     return true;
 }
 
+class FontFamilyValueBuilder {
+public:
+    FontFamilyValueBuilder(CSSValueList* list, CSSValuePool* pool)
+        : m_list(list)
+        , m_cssValuePool(pool)
+    {
+    }
+
+    void add(const CSSParserString& string)
+    {
+        if (!m_builder.isEmpty())
+            m_builder.append(' ');
+        m_builder.append(string.characters, string.length);
+    }
+
+    void commit()
+    {
+        if (m_builder.isEmpty())
+            return;
+        m_list->append(m_cssValuePool->createFontFamilyValue(m_builder.toString()));
+        m_builder.clear();
+    }
+
+private:
+    StringBuilder m_builder;
+    CSSValueList* m_list;
+    CSSValuePool* m_cssValuePool;
+};
+
 PassRefPtr<CSSValueList> CSSParser::parseFontFamily()
 {
     RefPtr<CSSValueList> list = CSSValueList::createCommaSeparated();
     CSSParserValue* value = m_valueList->current();
 
-    FontFamilyValue* currFamily = 0;
+    FontFamilyValueBuilder familyBuilder(list.get(), cssValuePool());
+    bool inFamily = false;
+
     while (value) {
+        if (value->id == CSSValueInitial || value->id == CSSValueInherit)
+            return 0;
         CSSParserValue* nextValue = m_valueList->next();
         bool nextValBreaksFont = !nextValue ||
                                  (nextValue->unit == CSSParserValue::Operator && nextValue->iValue == ',');
@@ -4294,28 +4354,29 @@ PassRefPtr<CSSValueList> CSSParser::parseFontFamily()
             (nextValue->unit == CSSPrimitiveValue::CSS_STRING || nextValue->unit == CSSPrimitiveValue::CSS_IDENT));
 
         if (value->id >= CSSValueSerif && value->id <= CSSValueWebkitBody) {
-            if (currFamily)
-                currFamily->appendSpaceSeparated(value->string.characters, value->string.length);
+            if (inFamily)
+                familyBuilder.add(value->string);
             else if (nextValBreaksFont || !nextValIsFontName)
                 list->append(cssValuePool()->createIdentifierValue(value->id));
             else {
-                RefPtr<FontFamilyValue> newFamily = FontFamilyValue::create(value->string);
-                currFamily = newFamily.get();
-                list->append(newFamily.release());
+                familyBuilder.commit();
+                familyBuilder.add(value->string);
+                inFamily = true;
             }
         } else if (value->unit == CSSPrimitiveValue::CSS_STRING) {
             // Strings never share in a family name.
-            currFamily = 0;
-            list->append(FontFamilyValue::create(value->string));
+            inFamily = false;
+            familyBuilder.commit();
+            list->append(cssValuePool()->createFontFamilyValue(value->string));
         } else if (value->unit == CSSPrimitiveValue::CSS_IDENT) {
-            if (currFamily)
-                currFamily->appendSpaceSeparated(value->string.characters, value->string.length);
+            if (inFamily)
+                familyBuilder.add(value->string);
             else if (nextValBreaksFont || !nextValIsFontName)
-                list->append(FontFamilyValue::create(value->string));
+                list->append(cssValuePool()->createFontFamilyValue(value->string));
             else {
-                RefPtr<FontFamilyValue> newFamily = FontFamilyValue::create(value->string);
-                currFamily = newFamily.get();
-                list->append(newFamily.release());
+                familyBuilder.commit();
+                familyBuilder.add(value->string);
+                inFamily = true;
             }
         } else {
             break;
@@ -4326,65 +4387,21 @@ PassRefPtr<CSSValueList> CSSParser::parseFontFamily()
 
         if (nextValBreaksFont) {
             value = m_valueList->next();
-            currFamily = 0;
+            familyBuilder.commit();
+            inFamily = false;
         }
         else if (nextValIsFontName)
             value = nextValue;
         else
             break;
     }
+    familyBuilder.commit();
+
     if (!list->length())
         list = 0;
     return list.release();
 }
 
-bool CSSParser::parseFontStyle(bool important)
-{
-    RefPtr<CSSValueList> values;
-    if (m_valueList->size() > 1)
-        values = CSSValueList::createCommaSeparated();
-    CSSParserValue* val;
-    bool expectComma = false;
-    while ((val = m_valueList->current())) {
-        RefPtr<CSSPrimitiveValue> parsedValue;
-        if (!expectComma) {
-            expectComma = true;
-            if (val->id == CSSValueNormal || val->id == CSSValueItalic || val->id == CSSValueOblique)
-                parsedValue = cssValuePool()->createIdentifierValue(val->id);
-            else if (val->id == CSSValueAll && !values) {
-                // 'all' is only allowed in @font-face and with no other values. Make a value list to
-                // indicate that we are in the @font-face case.
-                values = CSSValueList::createCommaSeparated();
-                parsedValue = cssValuePool()->createIdentifierValue(val->id);
-            }
-        } else if (val->unit == CSSParserValue::Operator && val->iValue == ',') {
-            expectComma = false;
-            m_valueList->next();
-            continue;
-        }
-
-        if (!parsedValue)
-            return false;
-
-        m_valueList->next();
-
-        if (values)
-            values->append(parsedValue.release());
-        else {
-            addProperty(CSSPropertyFontStyle, parsedValue.release(), important);
-            return true;
-        }
-    }
-
-    if (values && values->length()) {
-        m_hasFontFaceOnlyValues = true;
-        addProperty(CSSPropertyFontStyle, values.release(), important);
-        return true;
-    }
-
-    return false;
-}
-
 bool CSSParser::parseFontVariant(bool important)
 {
     RefPtr<CSSValueList> values;
@@ -4434,54 +4451,20 @@ bool CSSParser::parseFontVariant(bool important)
 
 bool CSSParser::parseFontWeight(bool important)
 {
-    RefPtr<CSSValueList> values;
-    if (m_valueList->size() > 1)
-        values = CSSValueList::createCommaSeparated();
-    CSSParserValue* val;
-    bool expectComma = false;
-    while ((val = m_valueList->current())) {
-        RefPtr<CSSPrimitiveValue> parsedValue;
-        if (!expectComma) {
-            expectComma = true;
-            if (val->unit == CSSPrimitiveValue::CSS_IDENT) {
-                if (val->id >= CSSValueNormal && val->id <= CSSValue900)
-                    parsedValue = cssValuePool()->createIdentifierValue(val->id);
-                else if (val->id == CSSValueAll && !values) {
-                    // 'all' is only allowed in @font-face and with no other values. Make a value list to
-                    // indicate that we are in the @font-face case.
-                    values = CSSValueList::createCommaSeparated();
-                    parsedValue = cssValuePool()->createIdentifierValue(val->id);
-                }
-            } else if (validUnit(val, FInteger | FNonNeg, false)) {
-                int weight = static_cast<int>(val->fValue);
-                if (!(weight % 100) && weight >= 100 && weight <= 900)
-                    parsedValue = cssValuePool()->createIdentifierValue(CSSValue100 + weight / 100 - 1);
-            }
-        } else if (val->unit == CSSParserValue::Operator && val->iValue == ',') {
-            expectComma = false;
-            m_valueList->next();
-            continue;
-        }
-
-        if (!parsedValue)
-            return false;
-
-        m_valueList->next();
+    if (m_valueList->size() != 1)
+        return false;
 
-        if (values)
-            values->append(parsedValue.release());
-        else {
-            addProperty(CSSPropertyFontWeight, parsedValue.release(), important);
-            return true;
-        }
+    CSSParserValue* value = m_valueList->current();
+    if ((value->id >= CSSValueNormal) && (value->id <= CSSValue900)) {
+        addProperty(CSSPropertyFontWeight, cssValuePool()->createIdentifierValue(value->id), important);
+        return true;
     }
-
-    if (values && values->length()) {
-        m_hasFontFaceOnlyValues = true;
-        addProperty(CSSPropertyFontWeight, values.release(), important);
+    if (validUnit(value, FInteger | FNonNeg, false)) {
+        int weight = static_cast<int>(value->fValue);
+        if (!(weight % 100) && weight >= 100 && weight <= 900)
+            addProperty(CSSPropertyFontWeight, cssValuePool()->createIdentifierValue(CSSValue100 + weight / 100 - 1), important);
         return true;
     }
-
     return false;
 }
 
@@ -7091,10 +7074,19 @@ static bool validFlowName(const String& flowName)
     return true;
 }
 
+bool CSSParser::cssRegionsEnabled() const
+{
+    if (Document* document = findDocument())
+        return document->cssRegionsEnabled();
+
+    return false;
+}
+
 // auto | <ident>
 bool CSSParser::parseFlowThread(int propId, bool important)
 {
     ASSERT(propId == CSSPropertyWebkitFlowInto);
+    ASSERT(cssRegionsEnabled());
 
     if (m_valueList->size() != 1)
         return false;
@@ -7126,6 +7118,7 @@ bool CSSParser::parseFlowThread(int propId, bool important)
 bool CSSParser::parseRegionThread(int propId, bool important)
 {
     ASSERT(propId == CSSPropertyWebkitFlowFrom);
+    ASSERT(cssRegionsEnabled());
 
     if (m_valueList->size() != 1)
         return false;
@@ -7428,7 +7421,7 @@ bool CSSParser::parseFontVariantLigatures(bool important)
     return true;
 }
 
-bool CSSParser::parseCalculation(CSSParserValue* value) 
+bool CSSParser::parseCalculation(CSSParserValue* value, CalculationPermittedValueRange range) 
 {
     ASSERT(isCalculation(value));
     
@@ -7437,7 +7430,7 @@ bool CSSParser::parseCalculation(CSSParserValue* value)
         return false;
 
     ASSERT(!m_parsedCalculation);
-    m_parsedCalculation = CSSCalcValue::create(value->function->name, args);
+    m_parsedCalculation = CSSCalcValue::create(value->function->name, args, range);
     
     if (!m_parsedCalculation)
         return false;
@@ -8253,8 +8246,8 @@ int CSSParser::lex(void* yylvalWithoutType)
     UChar* result;
     bool hasEscape;
 
-    // The input buffer is terminated by two \0, so
-    // it is safe to read two characters ahead anytime.
+    // The input buffer is terminated by a \0 character, so
+    // it is safe to read one character ahead of a known non-null.
 
 #ifndef NDEBUG
     // In debug we check with an ASSERT that the length is > 0 for string types.
@@ -8525,9 +8518,9 @@ restartAfterComment:
         if (*m_currentCharacter == '*') {
             ++m_currentCharacter;
             while (m_currentCharacter[0] != '*' || m_currentCharacter[1] != '/') {
-                if (m_currentCharacter[0] == '\n')
+                if (*m_currentCharacter == '\n')
                     ++m_lineNumber;
-                if (m_currentCharacter[0] == '\0' && m_currentCharacter[1] == '\0') {
+                if (*m_currentCharacter == '\0') {
                     // Unterminated comments are simply ignored.
                     m_currentCharacter -= 2;
                     break;
@@ -8831,7 +8824,7 @@ CSSRule* CSSParser::createStyleRule(Vector<OwnPtr<CSSParserSelector> >* selector
         rule->adoptSelectorVector(*selectors);
         if (m_hasFontFaceOnlyValues)
             deleteFontFaceOnlyValues();
-        rule->setDeclaration(StylePropertySet::create(rule.get(), m_parsedProperties, m_numParsedProperties));
+        rule->setDeclaration(StylePropertySet::create(m_parsedProperties, m_numParsedProperties, m_strict));
         result = rule.get();
         m_parsedRules.append(rule.release());
         if (m_ruleRangeMap) {
@@ -8856,7 +8849,7 @@ CSSRule* CSSParser::createFontFaceRule()
     for (unsigned i = 0; i < m_numParsedProperties; ++i) {
         CSSProperty* property = m_parsedProperties[i];
         int id = property->id();
-        if ((id == CSSPropertyFontWeight || id == CSSPropertyFontStyle || id == CSSPropertyFontVariant) && property->value()->isPrimitiveValue()) {
+        if (id == CSSPropertyFontVariant && property->value()->isPrimitiveValue()) {
             RefPtr<CSSValue> value = property->m_value.release();
             property->m_value = CSSValueList::createCommaSeparated();
             static_cast<CSSValueList*>(property->value())->append(value.release());
@@ -8870,7 +8863,7 @@ CSSRule* CSSParser::createFontFaceRule()
         }
     }
     RefPtr<CSSFontFaceRule> rule = CSSFontFaceRule::create(m_styleSheet);
-    rule->setDeclaration(StylePropertySet::create(rule.get(), m_parsedProperties, m_numParsedProperties));
+    rule->setDeclaration(StylePropertySet::create(m_parsedProperties, m_numParsedProperties, m_strict));
     clearProperties();
     CSSFontFaceRule* result = rule.get();
     m_parsedRules.append(rule.release());
@@ -8941,7 +8934,7 @@ CSSRule* CSSParser::createPageRule(PassOwnPtr<CSSParserSelector> pageSelector)
         Vector<OwnPtr<CSSParserSelector> > selectorVector;
         selectorVector.append(pageSelector);
         rule->adoptSelectorVector(selectorVector);
-        rule->setDeclaration(StylePropertySet::create(rule.get(), m_parsedProperties, m_numParsedProperties));
+        rule->setDeclaration(StylePropertySet::create(m_parsedProperties, m_numParsedProperties, m_strict));
         pageRule = rule.get();
         m_parsedRules.append(rule.release());
     }
@@ -8957,7 +8950,7 @@ void CSSParser::setReusableRegionSelectorVector(Vector<OwnPtr<CSSParserSelector>
 
 CSSRule* CSSParser::createRegionRule(Vector<OwnPtr<CSSParserSelector> >* regionSelector, CSSRuleList* rules)
 {
-    if (!regionSelector || !rules)
+    if (!cssRegionsEnabled() || !regionSelector || !rules)
         return 0;
 
     m_allowImportRules = m_allowNamespaceDeclarations = false;
@@ -9001,7 +8994,7 @@ void CSSParser::deleteFontFaceOnlyValues()
     for (unsigned i = 0; i < m_numParsedProperties; ++i) {
         CSSProperty* property = m_parsedProperties[i];
         int id = property->id();
-        if ((id == CSSPropertyFontWeight || id == CSSPropertyFontStyle || id == CSSPropertyFontVariant) && property->value()->isValueList()) {
+        if (id == CSSPropertyFontVariant && property->value()->isValueList()) {
             delete property;
             deletedProperties++;
         } else if (deletedProperties)
@@ -9025,7 +9018,7 @@ WebKitCSSKeyframeRule* CSSParser::createKeyframeRule(CSSParserValueList* keys)
 
     RefPtr<WebKitCSSKeyframeRule> keyframe = WebKitCSSKeyframeRule::create(m_styleSheet);
     keyframe->setKeyText(keyString);
-    keyframe->setDeclaration(StylePropertySet::create(keyframe.get(), m_parsedProperties, m_numParsedProperties));
+    keyframe->setDeclaration(StylePropertySet::create(m_parsedProperties, m_numParsedProperties, m_strict));
 
     clearProperties();
 
@@ -9148,14 +9141,8 @@ static int cssPropertyID(const UChar* propertyName, unsigned length)
             memcpy(buffer, "-webkit", 7);
             ++length;
         }
-
 #if PLATFORM(IOS)
-        if (!strcmp(buffer, "-webkit-hyphenate-locale")) {
-            // Worked in iOS 4.2.
-            const char* const webkitLocale = "-webkit-locale";
-            name = webkitLocale;
-            length = strlen(webkitLocale);
-        }
+        cssPropertyNameIOSAliasing(buffer, name, length);
 #endif
     }
 
@@ -9173,6 +9160,18 @@ int cssPropertyID(const CSSParserString& string)
     return cssPropertyID(string.characters, string.length);
 }
 
+#if PLATFORM(IOS)
+void cssPropertyNameIOSAliasing(const char* propertyName, const char*& propertyNameAlias, unsigned& newLength)
+{
+    if (!strcmp(propertyName, "-webkit-hyphenate-locale")) {
+        // Worked in iOS 4.2.
+        static const char* const webkitLocale = "-webkit-locale";
+        propertyNameAlias = webkitLocale;
+        newLength = strlen(webkitLocale);
+    }
+}
+#endif
+
 int cssValueKeywordID(const CSSParserString& string)
 {
     unsigned length = string.length;
@@ -9260,6 +9259,11 @@ static bool isCSSTokenizerURL(const String& string)
 // We use single quotes for now because markup.cpp uses double quotes.
 String quoteCSSString(const String& string)
 {
+    // This function expands each character to at most 3 characters ('\u0010' -> '\' '1' '0') as well as adds
+    // 2 quote characters (before and after). Make sure the resulting size (3 * length + 2) will not overflow unsigned.
+    if (string.length() >= (std::numeric_limits<unsigned>::max() / 3) - 2)
+        return "";
+
     // For efficiency, we first pre-calculate the length of the quoted string, then we build the actual one.
     // Please see below for the actual logic.
     unsigned quotedStringSize = 2; // Two quotes surrounding the entire string.
diff --git a/Source/WebCore/css/CSSParser.h b/Source/WebCore/css/CSSParser.h
index 5527d3616..5d766be88 100644
--- a/Source/WebCore/css/CSSParser.h
+++ b/Source/WebCore/css/CSSParser.h
@@ -69,11 +69,12 @@ public:
     void parseSheet(CSSStyleSheet*, const String&, int startLineNumber = 0, StyleRuleRangeMap* ruleRangeMap = 0);
     PassRefPtr<CSSRule> parseRule(CSSStyleSheet*, const String&);
     PassRefPtr<WebKitCSSKeyframeRule> parseKeyframeRule(CSSStyleSheet*, const String&);
-    static bool parseValue(StylePropertySet*, int propId, const String&, bool important, bool strict);
+    static bool parseValue(StylePropertySet*, int propId, const String&, bool important, bool strict, CSSStyleSheet* contextStyleSheet);
     static bool parseColor(RGBA32& color, const String&, bool strict = false);
     static bool parseSystemColor(RGBA32& color, const String&, Document*);
+    static PassRefPtr<CSSValueList> parseFontFaceValue(const AtomicString&, CSSStyleSheet* contextStyleSheet);
     PassRefPtr<CSSPrimitiveValue> parseValidPrimitive(int propId, CSSParserValue*);
-    bool parseDeclaration(StylePropertySet*, const String&, RefPtr<CSSStyleSourceData>* = 0, CSSStyleSheet* contextStyleSheet = 0);
+    bool parseDeclaration(StylePropertySet*, const String&, RefPtr<CSSStyleSourceData>*, CSSStyleSheet* contextStyleSheet);
     bool parseMediaQuery(MediaList*, const String&);
 
     Document* findDocument() const;
@@ -156,7 +157,6 @@ public:
 
     static bool fastParseColor(RGBA32&, const String&, bool strict);
 
-    bool parseFontStyle(bool important);
     bool parseFontVariant(bool important);
     bool parseFontWeight(bool important);
     bool parseFontFaceSrc();
@@ -209,11 +209,12 @@ public:
     bool parseTextEmphasisStyle(bool important);
 
     bool parseLineBoxContain(bool important);
-    bool parseCalculation(CSSParserValue*);
+    bool parseCalculation(CSSParserValue*, CalculationPermittedValueRange);
 
     bool parseFontFeatureTag(CSSValueList*);
     bool parseFontFeatureSettings(bool important);
 
+    bool cssRegionsEnabled() const;
     bool parseFlowThread(int propId, bool important);
     bool parseRegionThread(int propId, bool important);
 
@@ -355,7 +356,7 @@ private:
     bool isGeneratedImageValue(CSSParserValue*) const;
     bool parseGeneratedImage(CSSParserValueList*, RefPtr<CSSValue>&);
 
-    bool parseValue(StylePropertySet*, int propId, const String&, bool important, CSSStyleSheet* contextStyleSheet = 0);
+    bool parseValue(StylePropertySet*, int propId, const String&, bool important, CSSStyleSheet* contextStyleSheet);
 
     enum SizeParameterType {
         None,
@@ -449,6 +450,9 @@ private:
 int cssPropertyID(const CSSParserString&);
 int cssPropertyID(const String&);
 int cssValueKeywordID(const CSSParserString&);
+#if PLATFORM(IOS)
+void cssPropertyNameIOSAliasing(const char* propertyName, const char*& propertyNameAlias, unsigned& newLength);
+#endif
 
 class ShorthandScope {
     WTF_MAKE_FAST_ALLOCATED;
diff --git a/Source/WebCore/css/CSSPrimitiveValue.cpp b/Source/WebCore/css/CSSPrimitiveValue.cpp
index 9021a6353..fc14e8206 100644
--- a/Source/WebCore/css/CSSPrimitiveValue.cpp
+++ b/Source/WebCore/css/CSSPrimitiveValue.cpp
@@ -21,12 +21,14 @@
 #include "config.h"
 #include "CSSPrimitiveValue.h"
 
+#include "CSSCalculationValue.h"
 #include "CSSHelper.h"
 #include "CSSParser.h"
 #include "CSSPropertyNames.h"
 #include "CSSStyleSheet.h"
 #include "CSSValueKeywords.h"
 #include "CSSWrapShapes.h"
+#include "CalculationValue.h"
 #include "Color.h"
 #include "Counter.h"
 #include "ExceptionCode.h"
@@ -52,6 +54,9 @@ namespace WebCore {
 static inline bool isValidCSSUnitTypeForDoubleConversion(CSSPrimitiveValue::UnitTypes unitType)
 {
     switch (unitType) {
+    case CSSPrimitiveValue:: CSS_CALC:
+    case CSSPrimitiveValue:: CSS_CALC_PERCENTAGE_WITH_NUMBER:
+    case CSSPrimitiveValue:: CSS_CALC_PERCENTAGE_WITH_LENGTH:
     case CSSPrimitiveValue:: CSS_CM:
     case CSSPrimitiveValue:: CSS_DEG:
     case CSSPrimitiveValue:: CSS_DIMENSION:
@@ -137,6 +142,27 @@ static CSSTextCache& cssTextCache()
     return cache;
 }
 
+unsigned short CSSPrimitiveValue::primitiveType() const 
+{
+    if (m_primitiveUnitType != CSSPrimitiveValue::CSS_CALC)
+        return m_primitiveUnitType; 
+    
+    switch (m_value.calc->category()) {
+    case CalcNumber:
+        return CSSPrimitiveValue::CSS_NUMBER;
+    case CalcPercent:
+        return CSSPrimitiveValue::CSS_PERCENTAGE;
+    case CalcLength:
+        return CSSPrimitiveValue::CSS_PX;
+    case CalcPercentNumber:
+        return CSSPrimitiveValue::CSS_CALC_PERCENTAGE_WITH_NUMBER;
+    case CalcPercentLength:
+        return CSSPrimitiveValue::CSS_CALC_PERCENTAGE_WITH_LENGTH;
+    case CalcOther:
+        return CSSPrimitiveValue::CSS_UNKNOWN;
+    }
+    return CSSPrimitiveValue::CSS_UNKNOWN;
+}
 static const AtomicString& valueOrPropertyName(int valueOrPropertyID)
 {
     ASSERT_ARG(valueOrPropertyID, valueOrPropertyID >= 0);
@@ -284,6 +310,13 @@ void CSSPrimitiveValue::init(PassRefPtr<Pair> p)
     m_value.pair = p.leakRef();
 }
 
+void CSSPrimitiveValue::init(PassRefPtr<CSSCalcValue> c)
+{
+    m_primitiveUnitType = CSS_CALC;
+    m_hasCachedCSSText = false;
+    m_value.calc = c.leakRef();
+}
+
 void CSSPrimitiveValue::init(PassRefPtr<CSSWrapShape> shape)
 {
     m_primitiveUnitType = CSS_SHAPE;
@@ -324,6 +357,9 @@ void CSSPrimitiveValue::cleanup()
                 m_value.region->deref();
             break;
 #endif
+        case CSS_CALC:
+            m_value.calc->deref();
+            break;
         case CSS_SHAPE:
             m_value.shape->deref();
             break;
@@ -437,12 +473,23 @@ double CSSPrimitiveValue::computeLengthDouble(RenderStyle* style, RenderStyle* r
             // 1 pc == 12 pt
             factor = cssPixelsPerInch * 12.0 / 72.0;
             break;
+        case CSS_CALC_PERCENTAGE_WITH_LENGTH:
+        case CSS_CALC_PERCENTAGE_WITH_NUMBER:
+            ASSERT_NOT_REACHED();
+            return -1.0;
         default:
             ASSERT_NOT_REACHED();
             return -1.0;
     }
 
-    double result = getDoubleValue() * factor;
+    double computedValue;
+    if (m_primitiveUnitType == CSS_CALC)
+        // The multiplier is passed in as 1.0 here to ensure it is only applied once
+        computedValue = m_value.calc->computeLengthPx(style, rootStyle, 1.0, computingFontSize);
+    else
+        computedValue = getDoubleValue();
+    
+    double result = computedValue * factor;
     if (!applyZoomMultiplier || multiplier == 1.0f)
         return result;
 
@@ -528,6 +575,11 @@ double CSSPrimitiveValue::getDoubleValue(unsigned short unitType) const
     return result;
 }
 
+double CSSPrimitiveValue::getDoubleValue() const
+{ 
+    return m_primitiveUnitType != CSS_CALC ? m_value.num : m_value.calc->doubleValue();
+}
+
 CSSPrimitiveValue::UnitTypes CSSPrimitiveValue::canonicalUnitTypeForCategory(UnitCategory category)
 {
     // The canonical unit type is chosen according to the way CSSParser::validUnit() chooses the default unit
@@ -554,12 +606,13 @@ bool CSSPrimitiveValue::getDoubleValueInternal(UnitTypes requestedUnitType, doub
 {
     if (!isValidCSSUnitTypeForDoubleConversion(static_cast<UnitTypes>(m_primitiveUnitType)) || !isValidCSSUnitTypeForDoubleConversion(requestedUnitType))
         return false;
-    if (requestedUnitType == static_cast<UnitTypes>(m_primitiveUnitType) || requestedUnitType == CSS_DIMENSION) {
-        *result = m_value.num;
+
+    UnitTypes sourceUnitType = static_cast<UnitTypes>(primitiveType());
+    if (requestedUnitType == sourceUnitType || requestedUnitType == CSS_DIMENSION) {
+        *result = getDoubleValue();
         return true;
     }
 
-    UnitTypes sourceUnitType = static_cast<UnitTypes>(m_primitiveUnitType);
     UnitCategory sourceCategory = unitCategory(sourceUnitType);
     ASSERT(sourceCategory != UOther);
 
@@ -585,7 +638,7 @@ bool CSSPrimitiveValue::getDoubleValueInternal(UnitTypes requestedUnitType, doub
             return false;
     }
 
-    double convertedValue = m_value.num;
+    double convertedValue = getDoubleValue();
 
     // First convert the value from m_primitiveUnitType to canonical type.
     double factor = conversionToCanonicalUnitsScaleFactor(sourceUnitType);
@@ -958,6 +1011,9 @@ String CSSPrimitiveValue::customCssText() const
         case CSS_PARSER_IDENTIFIER:
             text = quoteCSSStringIfNeeded(m_value.string);
             break;
+        case CSS_CALC:
+            text = m_value.calc->cssText();
+            break;
         case CSS_SHAPE:
             text = m_value.shape->cssText();
             break;
diff --git a/Source/WebCore/css/CSSPrimitiveValue.h b/Source/WebCore/css/CSSPrimitiveValue.h
index 3f15ff78d..13e576a3e 100644
--- a/Source/WebCore/css/CSSPrimitiveValue.h
+++ b/Source/WebCore/css/CSSPrimitiveValue.h
@@ -30,6 +30,7 @@
 
 namespace WebCore {
 
+class CSSCalcValue;
 class Counter;
 class DashboardRegion;
 class Pair;
@@ -102,7 +103,11 @@ public:
         CSS_SHAPE = 110,
 
         // Used by border images.
-        CSS_QUAD = 111
+        CSS_QUAD = 111,
+
+        CSS_CALC = 112,
+        CSS_CALC_PERCENTAGE_WITH_NUMBER = 113,
+        CSS_CALC_PERCENTAGE_WITH_LENGTH = 114
     };
 
     // This enum follows the CSSParser::Units enum augmented with UNIT_FREQUENCY for frequencies.
@@ -133,19 +138,21 @@ public:
     bool isIdent() const { return m_primitiveUnitType == CSS_IDENT; }
     bool isLength() const
     {
-        return (m_primitiveUnitType >= CSS_EMS && m_primitiveUnitType <= CSS_PC)
-               || m_primitiveUnitType == CSS_REMS;
+        unsigned short type = primitiveType();
+        return (type >= CSS_EMS && type <= CSS_PC) || type == CSS_REMS;
     }
-    bool isNumber() const { return m_primitiveUnitType == CSS_NUMBER; }
-    bool isPercentage() const { return m_primitiveUnitType == CSS_PERCENTAGE; }
-    bool isPx() const { return m_primitiveUnitType == CSS_PX; }
+    bool isNumber() const { return primitiveType() == CSS_NUMBER; }
+    bool isPercentage() const { return primitiveType() == CSS_PERCENTAGE; }
+    bool isPx() const { return primitiveType() == CSS_PX; }
     bool isRect() const { return m_primitiveUnitType == CSS_RECT; }
     bool isRGBColor() const { return m_primitiveUnitType == CSS_RGBCOLOR; }
     bool isShape() const { return m_primitiveUnitType == CSS_SHAPE; }
     bool isString() const { return m_primitiveUnitType == CSS_STRING; }
     bool isTime() const { return m_primitiveUnitType == CSS_S || m_primitiveUnitType == CSS_MS; }
     bool isURI() const { return m_primitiveUnitType == CSS_URI; }
-
+    bool isCalculated() const { return m_primitiveUnitType == CSS_CALC; }
+    bool isCalculatedPercentageWithNumber() const { return primitiveType() == CSS_CALC_PERCENTAGE_WITH_NUMBER; }
+    bool isCalculatedPercentageWithLength() const { return primitiveType() == CSS_CALC_PERCENTAGE_WITH_LENGTH; }
 
     static PassRefPtr<CSSPrimitiveValue> createIdentifier(int identifier) { return adoptRef(new CSSPrimitiveValue(identifier)); }
     static PassRefPtr<CSSPrimitiveValue> createColor(unsigned rgbValue) { return adoptRef(new CSSPrimitiveValue(rgbValue)); }
@@ -172,7 +179,7 @@ public:
 
     void cleanup();
 
-    unsigned short primitiveType() const { return m_primitiveUnitType; }
+    unsigned short primitiveType() const;
 
     double computeDegrees();
 
@@ -211,7 +218,7 @@ public:
 
     double getDoubleValue(unsigned short unitType, ExceptionCode&) const;
     double getDoubleValue(unsigned short unitType) const;
-    double getDoubleValue() const { return m_value.num; }
+    double getDoubleValue() const;
 
     void setFloatValue(unsigned short unitType, double floatValue, ExceptionCode&);
     float getFloatValue(unsigned short unitType, ExceptionCode& ec) const { return getValue<float>(unitType, ec); }
@@ -224,7 +231,7 @@ public:
 
     template<typename T> inline T getValue(unsigned short unitType, ExceptionCode& ec) const { return clampTo<T>(getDoubleValue(unitType, ec)); }
     template<typename T> inline T getValue(unsigned short unitType) const { return clampTo<T>(getDoubleValue(unitType)); }
-    template<typename T> inline T getValue() const { return clampTo<T>(m_value.num); }
+    template<typename T> inline T getValue() const { return clampTo<T>(getDoubleValue()); }
 
     void setStringValue(unsigned short stringType, const String& stringValue, ExceptionCode&);
     String getStringValue(ExceptionCode&) const;
@@ -248,6 +255,8 @@ public:
     DashboardRegion* getDashboardRegionValue() const { return m_primitiveUnitType != CSS_DASHBOARD_REGION ? 0 : m_value.region; }
 
     CSSWrapShape* getShapeValue() const { return m_primitiveUnitType != CSS_SHAPE ? 0 : m_value.shape; }
+    
+    CSSCalcValue* cssCalcValue() const { return m_primitiveUnitType != CSS_CALC ? 0 : m_value.calc; }
 
     int getIdent() const { return m_primitiveUnitType == CSS_IDENT ? m_value.ident : 0; }
 
@@ -301,7 +310,7 @@ private:
     void init(PassRefPtr<Quad>);
     void init(PassRefPtr<DashboardRegion>); // FIXME: Dashboard region should not be a primitive value.
     void init(PassRefPtr<CSSWrapShape>);
-
+    void init(PassRefPtr<CSSCalcValue>);
     bool getDoubleValueInternal(UnitTypes targetUnitType, double* result) const;
 
     double computeLengthDouble(RenderStyle* currentStyle, RenderStyle* rootStyle, float multiplier, bool computingFontSize);
@@ -317,6 +326,7 @@ private:
         Pair* pair;
         DashboardRegion* region;
         CSSWrapShape* shape;
+        CSSCalcValue* calc;
     } m_value;
 };
 
diff --git a/Source/WebCore/css/CSSPrimitiveValue.idl b/Source/WebCore/css/CSSPrimitiveValue.idl
index 8d44737e9..517aba226 100644
--- a/Source/WebCore/css/CSSPrimitiveValue.idl
+++ b/Source/WebCore/css/CSSPrimitiveValue.idl
@@ -51,13 +51,13 @@ module css {
 
         readonly attribute unsigned short primitiveType;
 
-        [ObjCLegacyUnnamedParameters] void setFloatValue(in [Optional=CallWithDefaultValue] unsigned short unitType,
-                                          in [Optional=CallWithDefaultValue] float floatValue)
+        [ObjCLegacyUnnamedParameters] void setFloatValue(in [Optional=DefaultIsUndefined] unsigned short unitType,
+                                          in [Optional=DefaultIsUndefined] float floatValue)
             raises(DOMException);
-        float getFloatValue(in [Optional=CallWithDefaultValue] unsigned short unitType)
+        float getFloatValue(in [Optional=DefaultIsUndefined] unsigned short unitType)
             raises(DOMException);
-        [ObjCLegacyUnnamedParameters] void setStringValue(in [Optional=CallWithDefaultValue] unsigned short stringType, 
-                                           in [Optional=CallWithDefaultValue] DOMString stringValue)
+        [ObjCLegacyUnnamedParameters] void setStringValue(in [Optional=DefaultIsUndefined] unsigned short stringType, 
+                                           in [Optional=DefaultIsUndefined] DOMString stringValue)
             raises(DOMException);
         DOMString getStringValue()
             raises(DOMException);
diff --git a/Source/WebCore/css/CSSPrimitiveValueMappings.h b/Source/WebCore/css/CSSPrimitiveValueMappings.h
index a2434dde7..73491c30d 100644
--- a/Source/WebCore/css/CSSPrimitiveValueMappings.h
+++ b/Source/WebCore/css/CSSPrimitiveValueMappings.h
@@ -1288,8 +1288,8 @@ template<> inline CSSPrimitiveValue::CSSPrimitiveValue(EFlexWrap e)
 {
     m_primitiveUnitType = CSS_IDENT;
     switch (e) {
-    case FlexNoWrap:
-        m_value.ident = CSSValueNowrap;
+    case FlexWrapNone:
+        m_value.ident = CSSValueNone;
         break;
     case FlexWrap:
         m_value.ident = CSSValueWrap;
@@ -1303,15 +1303,15 @@ template<> inline CSSPrimitiveValue::CSSPrimitiveValue(EFlexWrap e)
 template<> inline CSSPrimitiveValue::operator EFlexWrap() const
 {
     switch (m_value.ident) {
-    case CSSValueNowrap:
-        return FlexNoWrap;
+    case CSSValueNone:
+        return FlexWrapNone;
     case CSSValueWrap:
         return FlexWrap;
     case CSSValueWrapReverse:
         return FlexWrapReverse;
     default:
         ASSERT_NOT_REACHED();
-        return FlexNoWrap;
+        return FlexWrapNone;
     }
 }
 
@@ -3158,35 +3158,62 @@ template<> inline CSSPrimitiveValue::operator Hyphens() const
     }
 }
 
-template<> inline CSSPrimitiveValue::CSSPrimitiveValue(LineGridSnap gridSnap)
+template<> inline CSSPrimitiveValue::CSSPrimitiveValue(LineSnap gridSnap)
     : CSSValue(PrimitiveClass)
 {
     m_primitiveUnitType = CSS_IDENT;
     switch (gridSnap) {
-    case LineGridSnapNone:
+    case LineSnapNone:
         m_value.ident = CSSValueNone;
         break;
-    case LineGridSnapBaseline:
+    case LineSnapBaseline:
         m_value.ident = CSSValueBaseline;
         break;
-    case LineGridSnapContain:
+    case LineSnapContain:
         m_value.ident = CSSValueContain;
         break;
     }
 }
 
-template<> inline CSSPrimitiveValue::operator LineGridSnap() const
+template<> inline CSSPrimitiveValue::operator LineSnap() const
 {
     switch (m_value.ident) {
     case CSSValueNone:
-        return LineGridSnapNone;
+        return LineSnapNone;
     case CSSValueBaseline:
-        return LineGridSnapBaseline;
+        return LineSnapBaseline;
     case CSSValueContain:
-        return LineGridSnapContain;
+        return LineSnapContain;
+    default:
+        ASSERT_NOT_REACHED();
+        return LineSnapNone;
+    }
+}
+
+template<> inline CSSPrimitiveValue::CSSPrimitiveValue(LineAlign lineAlign)
+    : CSSValue(PrimitiveClass)
+{
+    m_primitiveUnitType = CSS_IDENT;
+    switch (lineAlign) {
+    case LineAlignNone:
+        m_value.ident = CSSValueNone;
+        break;
+    case LineAlignEdges:
+        m_value.ident = CSSValueEdges;
+        break;
+    }
+}
+
+template<> inline CSSPrimitiveValue::operator LineAlign() const
+{
+    switch (m_value.ident) {
+    case CSSValueNone:
+        return LineAlignNone;
+    case CSSValueEdges:
+        return LineAlignEdges;
     default:
         ASSERT_NOT_REACHED();
-        return LineGridSnapNone;
+        return LineAlignNone;
     }
 }
 
diff --git a/Source/WebCore/css/CSSProperty.cpp b/Source/WebCore/css/CSSProperty.cpp
index 1071bbef4..fd85e9bae 100644
--- a/Source/WebCore/css/CSSProperty.cpp
+++ b/Source/WebCore/css/CSSProperty.cpp
@@ -328,11 +328,15 @@ bool CSSProperty::isInheritedProperty(unsigned propertyID)
     case CSSPropertyWebkitHyphenateLimitBefore:
     case CSSPropertyWebkitHyphenateLimitLines:
     case CSSPropertyWebkitHyphens:
+    case CSSPropertyWebkitLineAlign:
     case CSSPropertyWebkitLineBoxContain:
     case CSSPropertyWebkitLineBreak:
     case CSSPropertyWebkitLineGrid:
-    case CSSPropertyWebkitLineGridSnap:
+    case CSSPropertyWebkitLineSnap:
     case CSSPropertyWebkitNbspMode:
+#if ENABLE(OVERFLOW_SCROLLING)
+    case CSSPropertyWebkitOverflowScrolling:
+#endif
     case CSSPropertyWebkitPrintColorAdjust:
     case CSSPropertyWebkitRtlOrdering:
     case CSSPropertyWebkitTextCombine:
diff --git a/Source/WebCore/css/CSSPropertyNames.in b/Source/WebCore/css/CSSPropertyNames.in
index 92070f69e..9afda37a7 100644
--- a/Source/WebCore/css/CSSPropertyNames.in
+++ b/Source/WebCore/css/CSSPropertyNames.in
@@ -271,10 +271,11 @@ z-index
 -webkit-hyphens
 -epub-hyphens = -webkit-hyphens
 -webkit-line-box-contain
+-webkit-line-align
 -webkit-line-break
 -webkit-line-clamp
 -webkit-line-grid
--webkit-line-grid-snap
+-webkit-line-snap
 -webkit-logical-width
 -webkit-logical-height
 -webkit-margin-after-collapse
@@ -379,3 +380,6 @@ z-index
 #if defined(ENABLE_DASHBOARD_SUPPORT) && ENABLE_DASHBOARD_SUPPORT
 -webkit-dashboard-region
 #endif
+#if defined(ENABLE_OVERFLOW_SCROLLING)
+-webkit-overflow-scrolling
+#endif
diff --git a/Source/WebCore/css/CSSRule.cpp b/Source/WebCore/css/CSSRule.cpp
index 5399848da..13ad50ad3 100644
--- a/Source/WebCore/css/CSSRule.cpp
+++ b/Source/WebCore/css/CSSRule.cpp
@@ -54,8 +54,9 @@ String CSSRule::cssText() const
     case UNKNOWN_RULE:
         return String();
     case STYLE_RULE:
-    case PAGE_RULE:
         return static_cast<const CSSStyleRule*>(this)->cssText();
+    case PAGE_RULE:
+        return static_cast<const CSSPageRule*>(this)->cssText();
     case CHARSET_RULE:
         return static_cast<const CSSCharsetRule*>(this)->cssText();
     case IMPORT_RULE:
diff --git a/Source/WebCore/css/CSSRule.h b/Source/WebCore/css/CSSRule.h
index 4f3ca3b74..5f5627417 100644
--- a/Source/WebCore/css/CSSRule.h
+++ b/Source/WebCore/css/CSSRule.h
@@ -49,10 +49,12 @@ public:
         MEDIA_RULE,
         FONT_FACE_RULE,
         PAGE_RULE,
-        // 7 used to be VARIABLES_RULE
-        WEBKIT_KEYFRAMES_RULE = 8,
+        // 7 was VARIABLES_RULE; we now match other browsers with 7 as
+        // KEYFRAMES_RULE:
+        // <https://bugs.webkit.org/show_bug.cgi?id=71293>.
+        WEBKIT_KEYFRAMES_RULE,
         WEBKIT_KEYFRAME_RULE,
-        WEBKIT_REGION_RULE
+        WEBKIT_REGION_RULE = 10
     };
 
     Type type() const { return static_cast<Type>(m_type); }
diff --git a/Source/WebCore/css/CSSRule.idl b/Source/WebCore/css/CSSRule.idl
index 279752662..dc65688d7 100644
--- a/Source/WebCore/css/CSSRule.idl
+++ b/Source/WebCore/css/CSSRule.idl
@@ -24,7 +24,7 @@ module css {
     interface [
         JSCustomMarkFunction,
         JSGenerateIsReachable,
-        JSCustomToJS,
+        CustomToJSObject,
         ObjCPolymorphic,
         V8DependentLifetime
     ] CSSRule {
@@ -37,13 +37,13 @@ module css {
         const unsigned short MEDIA_RULE = 4;
         const unsigned short FONT_FACE_RULE = 5;
         const unsigned short PAGE_RULE = 6;
-        const unsigned short WEBKIT_KEYFRAMES_RULE = 8;
-        const unsigned short WEBKIT_KEYFRAME_RULE = 9;
+        const unsigned short WEBKIT_KEYFRAMES_RULE = 7;
+        const unsigned short WEBKIT_KEYFRAME_RULE = 8;
         const unsigned short WEBKIT_REGION_RULE = 10;
 
         readonly attribute unsigned short   type;
 
-                 attribute [ConvertNullStringTo=Null, TreatNullAs=NullString] DOMString        cssText
+                 attribute [TreatReturnedNullStringAs=Null, TreatNullAs=NullString] DOMString        cssText
                      setter raises (DOMException);
 
         readonly attribute CSSStyleSheet    parentStyleSheet;
diff --git a/Source/WebCore/css/CSSRuleList.idl b/Source/WebCore/css/CSSRuleList.idl
index eff029339..7ac533b8a 100644
--- a/Source/WebCore/css/CSSRuleList.idl
+++ b/Source/WebCore/css/CSSRuleList.idl
@@ -32,7 +32,7 @@ module css {
         V8DependentLifetime
     ] CSSRuleList {
         readonly attribute unsigned long    length;
-        CSSRule           item(in [Optional=CallWithDefaultValue] unsigned long index);
+        CSSRule           item(in [Optional=DefaultIsUndefined] unsigned long index);
     };
 
 }
diff --git a/Source/WebCore/css/CSSStyleApplyProperty.cpp b/Source/WebCore/css/CSSStyleApplyProperty.cpp
index 524ed773c..274ceb482 100644
--- a/Source/WebCore/css/CSSStyleApplyProperty.cpp
+++ b/Source/WebCore/css/CSSStyleApplyProperty.cpp
@@ -440,11 +440,19 @@ public:
         Length radiusHeight;
         if (pair->first()->isPercentage())
             radiusWidth = Length(pair->first()->getDoubleValue(), Percent);
-        else
+        else if (pair->first()->isCalculatedPercentageWithLength()) {
+            // FIXME calc(): http://webkit.org/b/16662
+            // handle this case
+            return;
+        } else
             radiusWidth = Length(max(intMinForLength, min(intMaxForLength, pair->first()->computeLength<int>(selector->style(), selector->rootElementStyle(), selector->style()->effectiveZoom()))), Fixed);
         if (pair->second()->isPercentage())
             radiusHeight = Length(pair->second()->getDoubleValue(), Percent);
-        else
+        else if (pair->second()->isCalculatedPercentageWithLength()) {
+            // FIXME calc(): http://webkit.org/b/16662
+            // handle this case
+            return;
+        } else
             radiusHeight = Length(max(intMinForLength, min(intMaxForLength, pair->second()->computeLength<int>(selector->style(), selector->rootElementStyle(), selector->style()->effectiveZoom()))), Fixed);
         int width = radiusWidth.value();
         int height = radiusHeight.value();
@@ -1742,6 +1750,9 @@ CSSStyleApplyProperty::CSSStyleApplyProperty()
     setPropertyHandler(CSSPropertyWebkitMaskRepeat, ApplyPropertyExpanding<SuppressValue, CSSPropertyBackgroundRepeatX, CSSPropertyBackgroundRepeatY>::createHandler());
 
     setPropertyHandler(CSSPropertyBackgroundColor, ApplyPropertyColor<NoInheritFromParent, &RenderStyle::backgroundColor, &RenderStyle::setBackgroundColor, &RenderStyle::setVisitedLinkBackgroundColor, &RenderStyle::invalidColor>::createHandler());
+
+    setPropertyHandler(CSSPropertyBorderCollapse, ApplyPropertyDefault<EBorderCollapse, &RenderStyle::borderCollapse, EBorderCollapse, &RenderStyle::setBorderCollapse, EBorderCollapse, &RenderStyle::initialBorderCollapse>::createHandler());
+
     setPropertyHandler(CSSPropertyBorderBottomColor, ApplyPropertyColor<NoInheritFromParent, &RenderStyle::borderBottomColor, &RenderStyle::setBorderBottomColor, &RenderStyle::setVisitedLinkBorderBottomColor, &RenderStyle::color>::createHandler());
     setPropertyHandler(CSSPropertyBorderLeftColor, ApplyPropertyColor<NoInheritFromParent, &RenderStyle::borderLeftColor, &RenderStyle::setBorderLeftColor, &RenderStyle::setVisitedLinkBorderLeftColor, &RenderStyle::color>::createHandler());
     setPropertyHandler(CSSPropertyBorderRightColor, ApplyPropertyColor<NoInheritFromParent, &RenderStyle::borderRightColor, &RenderStyle::setBorderRightColor, &RenderStyle::setVisitedLinkBorderRightColor, &RenderStyle::color>::createHandler());
@@ -1799,6 +1810,9 @@ CSSStyleApplyProperty::CSSStyleApplyProperty()
     setPropertyHandler(CSSPropertyLetterSpacing, ApplyPropertyComputeLength<int, &RenderStyle::letterSpacing, &RenderStyle::setLetterSpacing, &RenderStyle::initialLetterWordSpacing, NormalEnabled, ThicknessDisabled, SVGZoomEnabled>::createHandler());
     setPropertyHandler(CSSPropertyWordSpacing, ApplyPropertyComputeLength<int, &RenderStyle::wordSpacing, &RenderStyle::setWordSpacing, &RenderStyle::initialLetterWordSpacing, NormalEnabled, ThicknessDisabled, SVGZoomEnabled>::createHandler());
 
+    setPropertyHandler(CSSPropertyCaptionSide, ApplyPropertyDefault<ECaptionSide, &RenderStyle::captionSide, ECaptionSide, &RenderStyle::setCaptionSide, ECaptionSide, &RenderStyle::initialCaptionSide>::createHandler());
+    setPropertyHandler(CSSPropertyClear, ApplyPropertyDefault<EClear, &RenderStyle::clear, EClear, &RenderStyle::setClear, EClear, &RenderStyle::initialClear>::createHandler());
+
     setPropertyHandler(CSSPropertyClip, ApplyPropertyClip::createHandler());
 
     setPropertyHandler(CSSPropertyCursor, ApplyPropertyCursor::createHandler());
@@ -1806,6 +1820,8 @@ CSSStyleApplyProperty::CSSStyleApplyProperty()
     setPropertyHandler(CSSPropertyCounterIncrement, ApplyPropertyCounter<Increment>::createHandler());
     setPropertyHandler(CSSPropertyCounterReset, ApplyPropertyCounter<Reset>::createHandler());
 
+    setPropertyHandler(CSSPropertyEmptyCells, ApplyPropertyDefault<EEmptyCell, &RenderStyle::emptyCells, EEmptyCell, &RenderStyle::setEmptyCells, EEmptyCell, &RenderStyle::initialEmptyCells>::createHandler());
+
     setPropertyHandler(CSSPropertyWebkitFlexOrder, ApplyPropertyDefault<int, &RenderStyle::flexOrder, int, &RenderStyle::setFlexOrder, int, &RenderStyle::initialFlexOrder>::createHandler());
     setPropertyHandler(CSSPropertyWebkitFlexPack, ApplyPropertyDefault<EFlexPack, &RenderStyle::flexPack, EFlexPack, &RenderStyle::setFlexPack, EFlexPack, &RenderStyle::initialFlexPack>::createHandler());
     setPropertyHandler(CSSPropertyWebkitFlexAlign, ApplyPropertyDefault<EFlexAlign, &RenderStyle::flexAlign, EFlexAlign, &RenderStyle::setFlexAlign, EFlexAlign, &RenderStyle::initialFlexAlign>::createHandler());
@@ -1814,6 +1830,8 @@ CSSStyleApplyProperty::CSSStyleApplyProperty()
     setPropertyHandler(CSSPropertyWebkitFlexWrap, ApplyPropertyDefault<EFlexWrap, &RenderStyle::flexWrap, EFlexWrap, &RenderStyle::setFlexWrap, EFlexWrap, &RenderStyle::initialFlexWrap>::createHandler());
     setPropertyHandler(CSSPropertyWebkitFlexFlow, ApplyPropertyExpanding<SuppressValue, CSSPropertyWebkitFlexDirection, CSSPropertyWebkitFlexWrap>::createHandler());
 
+    setPropertyHandler(CSSPropertyFloat, ApplyPropertyDefault<EFloat, &RenderStyle::floating, EFloat, &RenderStyle::setFloating, EFloat, &RenderStyle::initialFloating>::createHandler());
+
     setPropertyHandler(CSSPropertyFontSize, ApplyPropertyFontSize::createHandler());
     setPropertyHandler(CSSPropertyFontStyle, ApplyPropertyFont<FontItalic, &FontDescription::italic, &FontDescription::setItalic, FontItalicOff>::createHandler());
     setPropertyHandler(CSSPropertyFontVariant, ApplyPropertyFont<FontSmallCaps, &FontDescription::smallCaps, &FontDescription::setSmallCaps, FontSmallCapsOff>::createHandler());
@@ -1828,7 +1846,7 @@ CSSStyleApplyProperty::CSSStyleApplyProperty()
     setPropertyHandler(CSSPropertyTextDecoration, ApplyPropertyTextDecoration::createHandler());
 
     setPropertyHandler(CSSPropertyOutlineStyle, ApplyPropertyOutlineStyle::createHandler());
-    setPropertyHandler(CSSPropertyOutlineColor, ApplyPropertyColor<InheritFromParent, &RenderStyle::outlineColor, &RenderStyle::setOutlineColor, &RenderStyle::setVisitedLinkOutlineColor, &RenderStyle::color>::createHandler());
+    setPropertyHandler(CSSPropertyOutlineColor, ApplyPropertyColor<NoInheritFromParent, &RenderStyle::outlineColor, &RenderStyle::setOutlineColor, &RenderStyle::setVisitedLinkOutlineColor, &RenderStyle::color>::createHandler());
     setPropertyHandler(CSSPropertyOutlineOffset, ApplyPropertyComputeLength<int, &RenderStyle::outlineOffset, &RenderStyle::setOutlineOffset, &RenderStyle::initialOutlineOffset>::createHandler());
 
     setPropertyHandler(CSSPropertyOutline, ApplyPropertyExpanding<SuppressValue, CSSPropertyOutlineWidth, CSSPropertyOutlineColor, CSSPropertyOutlineStyle>::createHandler());
@@ -1882,19 +1900,22 @@ CSSStyleApplyProperty::CSSStyleApplyProperty()
     setPropertyHandler(CSSPropertyPaddingLeft, ApplyPropertyLength<&RenderStyle::paddingLeft, &RenderStyle::setPaddingLeft, &RenderStyle::initialPadding>::createHandler());
     setPropertyHandler(CSSPropertyPadding, ApplyPropertyExpanding<SuppressValue, CSSPropertyPaddingTop, CSSPropertyPaddingRight, CSSPropertyPaddingBottom, CSSPropertyPaddingLeft>::createHandler());
 
-    setPropertyHandler(CSSPropertyResize, ApplyPropertyResize::createHandler());
+    setPropertyHandler(CSSPropertyPageBreakAfter, ApplyPropertyDefault<EPageBreak, &RenderStyle::pageBreakAfter, EPageBreak, &RenderStyle::setPageBreakAfter, EPageBreak, &RenderStyle::initialPageBreak>::createHandler());
+    setPropertyHandler(CSSPropertyPageBreakBefore, ApplyPropertyDefault<EPageBreak, &RenderStyle::pageBreakBefore, EPageBreak, &RenderStyle::setPageBreakBefore, EPageBreak, &RenderStyle::initialPageBreak>::createHandler());
+    setPropertyHandler(CSSPropertyPageBreakInside, ApplyPropertyDefault<EPageBreak, &RenderStyle::pageBreakInside, EPageBreak, &RenderStyle::setPageBreakInside, EPageBreak, &RenderStyle::initialPageBreak>::createHandler());
 
-    setPropertyHandler(CSSPropertyVerticalAlign, ApplyPropertyVerticalAlign::createHandler());
+    setPropertyHandler(CSSPropertyPosition, ApplyPropertyDefault<EPosition, &RenderStyle::position, EPosition, &RenderStyle::setPosition, EPosition, &RenderStyle::initialPosition>::createHandler());
 
+    setPropertyHandler(CSSPropertyResize, ApplyPropertyResize::createHandler());
     setPropertyHandler(CSSPropertySize, ApplyPropertyPageSize::createHandler());
-
-    setPropertyHandler(CSSPropertyWebkitPerspectiveOriginX, ApplyPropertyLength<&RenderStyle::perspectiveOriginX, &RenderStyle::setPerspectiveOriginX, &RenderStyle::initialPerspectiveOriginX>::createHandler());
-    setPropertyHandler(CSSPropertyWebkitPerspectiveOriginY, ApplyPropertyLength<&RenderStyle::perspectiveOriginY, &RenderStyle::setPerspectiveOriginY, &RenderStyle::initialPerspectiveOriginY>::createHandler());
-    setPropertyHandler(CSSPropertyWebkitPerspectiveOrigin, ApplyPropertyExpanding<SuppressValue, CSSPropertyWebkitPerspectiveOriginX, CSSPropertyWebkitPerspectiveOriginY>::createHandler());
-    setPropertyHandler(CSSPropertyWebkitTransformOriginX, ApplyPropertyLength<&RenderStyle::transformOriginX, &RenderStyle::setTransformOriginX, &RenderStyle::initialTransformOriginX>::createHandler());
-    setPropertyHandler(CSSPropertyWebkitTransformOriginY, ApplyPropertyLength<&RenderStyle::transformOriginY, &RenderStyle::setTransformOriginY, &RenderStyle::initialTransformOriginY>::createHandler());
-    setPropertyHandler(CSSPropertyWebkitTransformOriginZ, ApplyPropertyComputeLength<float, &RenderStyle::transformOriginZ, &RenderStyle::setTransformOriginZ, &RenderStyle::initialTransformOriginZ>::createHandler());
-    setPropertyHandler(CSSPropertyWebkitTransformOrigin, ApplyPropertyExpanding<SuppressValue, CSSPropertyWebkitTransformOriginX, CSSPropertyWebkitTransformOriginY, CSSPropertyWebkitTransformOriginZ>::createHandler());
+    setPropertyHandler(CSSPropertyTableLayout, ApplyPropertyDefault<ETableLayout, &RenderStyle::tableLayout, ETableLayout, &RenderStyle::setTableLayout, ETableLayout, &RenderStyle::initialTableLayout>::createHandler());
+    setPropertyHandler(CSSPropertyTextTransform, ApplyPropertyDefault<ETextTransform, &RenderStyle::textTransform, ETextTransform, &RenderStyle::setTextTransform, ETextTransform, &RenderStyle::initialTextTransform>::createHandler());
+    setPropertyHandler(CSSPropertyUnicodeBidi, ApplyPropertyDefault<EUnicodeBidi, &RenderStyle::unicodeBidi, EUnicodeBidi, &RenderStyle::setUnicodeBidi, EUnicodeBidi, &RenderStyle::initialUnicodeBidi>::createHandler());
+    setPropertyHandler(CSSPropertyVerticalAlign, ApplyPropertyVerticalAlign::createHandler());
+    setPropertyHandler(CSSPropertyVisibility, ApplyPropertyDefault<EVisibility, &RenderStyle::visibility, EVisibility, &RenderStyle::setVisibility, EVisibility, &RenderStyle::initialVisibility>::createHandler());
+    setPropertyHandler(CSSPropertyWhiteSpace, ApplyPropertyDefault<EWhiteSpace, &RenderStyle::whiteSpace, EWhiteSpace, &RenderStyle::setWhiteSpace, EWhiteSpace, &RenderStyle::initialWhiteSpace>::createHandler());
+    setPropertyHandler(CSSPropertyWordBreak, ApplyPropertyDefault<EWordBreak, &RenderStyle::wordBreak, EWordBreak, &RenderStyle::setWordBreak, EWordBreak, &RenderStyle::initialWordBreak>::createHandler());
+    setPropertyHandler(CSSPropertyWordWrap, ApplyPropertyDefault<EWordWrap, &RenderStyle::wordWrap, EWordWrap, &RenderStyle::setWordWrap, EWordWrap, &RenderStyle::initialWordWrap>::createHandler());
 
     setPropertyHandler(CSSPropertyWebkitAnimationDelay, ApplyPropertyAnimation<double, &Animation::delay, &Animation::setDelay, &Animation::isDelaySet, &Animation::clearDelay, &Animation::initialAnimationDelay, &CSSStyleSelector::mapAnimationDelay, &RenderStyle::accessAnimations, &RenderStyle::animations>::createHandler());
     setPropertyHandler(CSSPropertyWebkitAnimationDirection, ApplyPropertyAnimation<Animation::AnimationDirection, &Animation::direction, &Animation::setDirection, &Animation::isDirectionSet, &Animation::clearDirection, &Animation::initialAnimationDirection, &CSSStyleSelector::mapAnimationDirection, &RenderStyle::accessAnimations, &RenderStyle::animations>::createHandler());
@@ -1904,39 +1925,66 @@ CSSStyleApplyProperty::CSSStyleApplyProperty()
     setPropertyHandler(CSSPropertyWebkitAnimationName, ApplyPropertyAnimation<const String&, &Animation::name, &Animation::setName, &Animation::isNameSet, &Animation::clearName, &Animation::initialAnimationName, &CSSStyleSelector::mapAnimationName, &RenderStyle::accessAnimations, &RenderStyle::animations>::createHandler());
     setPropertyHandler(CSSPropertyWebkitAnimationPlayState, ApplyPropertyAnimation<EAnimPlayState, &Animation::playState, &Animation::setPlayState, &Animation::isPlayStateSet, &Animation::clearPlayState, &Animation::initialAnimationPlayState, &CSSStyleSelector::mapAnimationPlayState, &RenderStyle::accessAnimations, &RenderStyle::animations>::createHandler());
     setPropertyHandler(CSSPropertyWebkitAnimationTimingFunction, ApplyPropertyAnimation<const PassRefPtr<TimingFunction>, &Animation::timingFunction, &Animation::setTimingFunction, &Animation::isTimingFunctionSet, &Animation::clearTimingFunction, &Animation::initialAnimationTimingFunction, &CSSStyleSelector::mapAnimationTimingFunction, &RenderStyle::accessAnimations, &RenderStyle::animations>::createHandler());
-
-    setPropertyHandler(CSSPropertyWebkitTransitionDelay, ApplyPropertyAnimation<double, &Animation::delay, &Animation::setDelay, &Animation::isDelaySet, &Animation::clearDelay, &Animation::initialAnimationDelay, &CSSStyleSelector::mapAnimationDelay, &RenderStyle::accessTransitions, &RenderStyle::transitions>::createHandler());
-    setPropertyHandler(CSSPropertyWebkitTransitionDuration, ApplyPropertyAnimation<double, &Animation::duration, &Animation::setDuration, &Animation::isDurationSet, &Animation::clearDuration, &Animation::initialAnimationDuration, &CSSStyleSelector::mapAnimationDuration, &RenderStyle::accessTransitions, &RenderStyle::transitions>::createHandler());
-    setPropertyHandler(CSSPropertyWebkitTransitionProperty, ApplyPropertyAnimation<int, &Animation::property, &Animation::setProperty, &Animation::isPropertySet, &Animation::clearProperty, &Animation::initialAnimationProperty, &CSSStyleSelector::mapAnimationProperty, &RenderStyle::accessTransitions, &RenderStyle::transitions>::createHandler());
-    setPropertyHandler(CSSPropertyWebkitTransitionTimingFunction, ApplyPropertyAnimation<const PassRefPtr<TimingFunction>, &Animation::timingFunction, &Animation::setTimingFunction, &Animation::isTimingFunctionSet, &Animation::clearTimingFunction, &Animation::initialAnimationTimingFunction, &CSSStyleSelector::mapAnimationTimingFunction, &RenderStyle::accessTransitions, &RenderStyle::transitions>::createHandler());
-
+    setPropertyHandler(CSSPropertyWebkitAppearance, ApplyPropertyDefault<ControlPart, &RenderStyle::appearance, ControlPart, &RenderStyle::setAppearance, ControlPart, &RenderStyle::initialAppearance>::createHandler());
+    setPropertyHandler(CSSPropertyWebkitBackfaceVisibility, ApplyPropertyDefault<EBackfaceVisibility, &RenderStyle::backfaceVisibility, EBackfaceVisibility, &RenderStyle::setBackfaceVisibility, EBackfaceVisibility, &RenderStyle::initialBackfaceVisibility>::createHandler());
+    setPropertyHandler(CSSPropertyWebkitBoxAlign, ApplyPropertyDefault<EBoxAlignment, &RenderStyle::boxAlign, EBoxAlignment, &RenderStyle::setBoxAlign, EBoxAlignment, &RenderStyle::initialBoxAlign>::createHandler());
+    setPropertyHandler(CSSPropertyWebkitBoxDirection, ApplyPropertyDefault<EBoxDirection, &RenderStyle::boxDirection, EBoxDirection, &RenderStyle::setBoxDirection, EBoxDirection, &RenderStyle::initialBoxDirection>::createHandler());
+    setPropertyHandler(CSSPropertyWebkitBoxFlex, ApplyPropertyDefault<float, &RenderStyle::boxFlex, float, &RenderStyle::setBoxFlex, float, &RenderStyle::initialBoxFlex>::createHandler());
+    setPropertyHandler(CSSPropertyWebkitBoxFlexGroup, ApplyPropertyDefault<unsigned int, &RenderStyle::boxFlexGroup, unsigned int, &RenderStyle::setBoxFlexGroup, unsigned int, &RenderStyle::initialBoxFlexGroup>::createHandler());
+    setPropertyHandler(CSSPropertyWebkitBoxLines, ApplyPropertyDefault<EBoxLines, &RenderStyle::boxLines, EBoxLines, &RenderStyle::setBoxLines, EBoxLines, &RenderStyle::initialBoxLines>::createHandler());
+    setPropertyHandler(CSSPropertyWebkitBoxOrdinalGroup, ApplyPropertyDefault<unsigned int, &RenderStyle::boxOrdinalGroup, unsigned int, &RenderStyle::setBoxOrdinalGroup, unsigned int, &RenderStyle::initialBoxOrdinalGroup>::createHandler());
+    setPropertyHandler(CSSPropertyWebkitBoxOrient, ApplyPropertyDefault<EBoxOrient, &RenderStyle::boxOrient, EBoxOrient, &RenderStyle::setBoxOrient, EBoxOrient, &RenderStyle::initialBoxOrient>::createHandler());
+    setPropertyHandler(CSSPropertyWebkitBoxPack, ApplyPropertyDefault<EBoxPack, &RenderStyle::boxPack, EBoxPack, &RenderStyle::setBoxPack, EBoxPack, &RenderStyle::initialBoxPack>::createHandler());
     setPropertyHandler(CSSPropertyWebkitColumnCount, ApplyPropertyAuto<unsigned short, &RenderStyle::columnCount, &RenderStyle::setColumnCount, &RenderStyle::hasAutoColumnCount, &RenderStyle::setHasAutoColumnCount>::createHandler());
     setPropertyHandler(CSSPropertyWebkitColumnGap, ApplyPropertyAuto<float, &RenderStyle::columnGap, &RenderStyle::setColumnGap, &RenderStyle::hasNormalColumnGap, &RenderStyle::setHasNormalColumnGap, ComputeLength, CSSValueNormal>::createHandler());
-    setPropertyHandler(CSSPropertyWebkitColumnWidth, ApplyPropertyAuto<float, &RenderStyle::columnWidth, &RenderStyle::setColumnWidth, &RenderStyle::hasAutoColumnWidth, &RenderStyle::setHasAutoColumnWidth, ComputeLength>::createHandler());
     setPropertyHandler(CSSPropertyWebkitColumns, ApplyPropertyExpanding<SuppressValue, CSSPropertyWebkitColumnWidth, CSSPropertyWebkitColumnCount>::createHandler());
-
-    setPropertyHandler(CSSPropertyWebkitFlowInto, ApplyPropertyString<MapAutoToNull, &RenderStyle::flowThread, &RenderStyle::setFlowThread, &RenderStyle::initialFlowThread>::createHandler());
+    setPropertyHandler(CSSPropertyWebkitColumnSpan, ApplyPropertyDefault<ColumnSpan, &RenderStyle::columnSpan, ColumnSpan, &RenderStyle::setColumnSpan, ColumnSpan, &RenderStyle::initialColumnSpan>::createHandler());
+    setPropertyHandler(CSSPropertyWebkitColumnWidth, ApplyPropertyAuto<float, &RenderStyle::columnWidth, &RenderStyle::setColumnWidth, &RenderStyle::hasAutoColumnWidth, &RenderStyle::setHasAutoColumnWidth, ComputeLength>::createHandler());
     setPropertyHandler(CSSPropertyWebkitFlowFrom, ApplyPropertyString<MapNoneToNull, &RenderStyle::regionThread, &RenderStyle::setRegionThread, &RenderStyle::initialRegionThread>::createHandler());
-
+    setPropertyHandler(CSSPropertyWebkitFlowInto, ApplyPropertyString<MapAutoToNull, &RenderStyle::flowThread, &RenderStyle::setFlowThread, &RenderStyle::initialFlowThread>::createHandler());
     setPropertyHandler(CSSPropertyWebkitHighlight, ApplyPropertyString<MapNoneToNull, &RenderStyle::highlight, &RenderStyle::setHighlight, &RenderStyle::initialHighlight>::createHandler());
     setPropertyHandler(CSSPropertyWebkitHyphenateCharacter, ApplyPropertyString<MapAutoToNull, &RenderStyle::hyphenationString, &RenderStyle::setHyphenationString, &RenderStyle::initialHyphenationString>::createHandler());
-
     setPropertyHandler(CSSPropertyWebkitHyphenateLimitAfter, ApplyPropertyNumber<short, &RenderStyle::hyphenationLimitAfter, &RenderStyle::setHyphenationLimitAfter, &RenderStyle::initialHyphenationLimitAfter>::createHandler());
     setPropertyHandler(CSSPropertyWebkitHyphenateLimitBefore, ApplyPropertyNumber<short, &RenderStyle::hyphenationLimitBefore, &RenderStyle::setHyphenationLimitBefore, &RenderStyle::initialHyphenationLimitBefore>::createHandler());
     setPropertyHandler(CSSPropertyWebkitHyphenateLimitLines, ApplyPropertyNumber<short, &RenderStyle::hyphenationLimitLines, &RenderStyle::setHyphenationLimitLines, &RenderStyle::initialHyphenationLimitLines, CSSValueNoLimit>::createHandler());
-
+    setPropertyHandler(CSSPropertyWebkitLineAlign, ApplyPropertyDefault<LineAlign, &RenderStyle::lineAlign, LineAlign, &RenderStyle::setLineAlign, LineAlign, &RenderStyle::initialLineAlign>::createHandler());
+    setPropertyHandler(CSSPropertyWebkitLineBreak, ApplyPropertyDefault<EKHTMLLineBreak, &RenderStyle::khtmlLineBreak, EKHTMLLineBreak, &RenderStyle::setKHTMLLineBreak, EKHTMLLineBreak, &RenderStyle::initialKHTMLLineBreak>::createHandler());
     setPropertyHandler(CSSPropertyWebkitLineGrid, ApplyPropertyString<MapNoneToNull, &RenderStyle::lineGrid, &RenderStyle::setLineGrid, &RenderStyle::initialLineGrid>::createHandler());
-    setPropertyHandler(CSSPropertyWebkitLineGridSnap, ApplyPropertyDefault<LineGridSnap, &RenderStyle::lineGridSnap, LineGridSnap, &RenderStyle::setLineGridSnap, LineGridSnap, &RenderStyle::initialLineGridSnap>::createHandler());
-
+    setPropertyHandler(CSSPropertyWebkitLineSnap, ApplyPropertyDefault<LineSnap, &RenderStyle::lineSnap, LineSnap, &RenderStyle::setLineSnap, LineSnap, &RenderStyle::initialLineSnap>::createHandler());
+    setPropertyHandler(CSSPropertyWebkitMarqueeDirection, ApplyPropertyDefault<EMarqueeDirection, &RenderStyle::marqueeDirection, EMarqueeDirection, &RenderStyle::setMarqueeDirection, EMarqueeDirection, &RenderStyle::initialMarqueeDirection>::createHandler());
+    setPropertyHandler(CSSPropertyWebkitMarqueeStyle, ApplyPropertyDefault<EMarqueeBehavior, &RenderStyle::marqueeBehavior, EMarqueeBehavior, &RenderStyle::setMarqueeBehavior, EMarqueeBehavior, &RenderStyle::initialMarqueeBehavior>::createHandler());
+    setPropertyHandler(CSSPropertyWebkitMatchNearestMailBlockquoteColor, ApplyPropertyDefault<EMatchNearestMailBlockquoteColor, &RenderStyle::matchNearestMailBlockquoteColor, EMatchNearestMailBlockquoteColor, &RenderStyle::setMatchNearestMailBlockquoteColor, EMatchNearestMailBlockquoteColor, &RenderStyle::initialMatchNearestMailBlockquoteColor>::createHandler());
+    setPropertyHandler(CSSPropertyWebkitNbspMode, ApplyPropertyDefault<ENBSPMode, &RenderStyle::nbspMode, ENBSPMode, &RenderStyle::setNBSPMode, ENBSPMode, &RenderStyle::initialNBSPMode>::createHandler());
+    setPropertyHandler(CSSPropertyWebkitPerspectiveOrigin, ApplyPropertyExpanding<SuppressValue, CSSPropertyWebkitPerspectiveOriginX, CSSPropertyWebkitPerspectiveOriginY>::createHandler());
+    setPropertyHandler(CSSPropertyWebkitPerspectiveOriginX, ApplyPropertyLength<&RenderStyle::perspectiveOriginX, &RenderStyle::setPerspectiveOriginX, &RenderStyle::initialPerspectiveOriginX>::createHandler());
+    setPropertyHandler(CSSPropertyWebkitPerspectiveOriginY, ApplyPropertyLength<&RenderStyle::perspectiveOriginY, &RenderStyle::setPerspectiveOriginY, &RenderStyle::initialPerspectiveOriginY>::createHandler());
+    setPropertyHandler(CSSPropertyWebkitPrintColorAdjust, ApplyPropertyDefault<PrintColorAdjust, &RenderStyle::printColorAdjust, PrintColorAdjust, &RenderStyle::setPrintColorAdjust, PrintColorAdjust, &RenderStyle::initialPrintColorAdjust>::createHandler());
+    setPropertyHandler(CSSPropertyWebkitRegionOverflow, ApplyPropertyDefault<RegionOverflow, &RenderStyle::regionOverflow, RegionOverflow, &RenderStyle::setRegionOverflow, RegionOverflow, &RenderStyle::initialRegionOverflow>::createHandler());
+    setPropertyHandler(CSSPropertyWebkitRtlOrdering, ApplyPropertyDefault<Order, &RenderStyle::rtlOrdering, Order, &RenderStyle::setRTLOrdering, Order, &RenderStyle::initialRTLOrdering>::createHandler());
     setPropertyHandler(CSSPropertyWebkitTextCombine, ApplyPropertyDefault<TextCombine, &RenderStyle::textCombine, TextCombine, &RenderStyle::setTextCombine, TextCombine, &RenderStyle::initialTextCombine>::createHandler());
     setPropertyHandler(CSSPropertyWebkitTextEmphasisPosition, ApplyPropertyDefault<TextEmphasisPosition, &RenderStyle::textEmphasisPosition, TextEmphasisPosition, &RenderStyle::setTextEmphasisPosition, TextEmphasisPosition, &RenderStyle::initialTextEmphasisPosition>::createHandler());
     setPropertyHandler(CSSPropertyWebkitTextEmphasisStyle, ApplyPropertyTextEmphasisStyle::createHandler());
-
+    setPropertyHandler(CSSPropertyWebkitTextSecurity, ApplyPropertyDefault<ETextSecurity, &RenderStyle::textSecurity, ETextSecurity, &RenderStyle::setTextSecurity, ETextSecurity, &RenderStyle::initialTextSecurity>::createHandler());
+    setPropertyHandler(CSSPropertyWebkitTransformOrigin, ApplyPropertyExpanding<SuppressValue, CSSPropertyWebkitTransformOriginX, CSSPropertyWebkitTransformOriginY, CSSPropertyWebkitTransformOriginZ>::createHandler());
+    setPropertyHandler(CSSPropertyWebkitTransformOriginX, ApplyPropertyLength<&RenderStyle::transformOriginX, &RenderStyle::setTransformOriginX, &RenderStyle::initialTransformOriginX>::createHandler());
+    setPropertyHandler(CSSPropertyWebkitTransformOriginY, ApplyPropertyLength<&RenderStyle::transformOriginY, &RenderStyle::setTransformOriginY, &RenderStyle::initialTransformOriginY>::createHandler());
+    setPropertyHandler(CSSPropertyWebkitTransformOriginZ, ApplyPropertyComputeLength<float, &RenderStyle::transformOriginZ, &RenderStyle::setTransformOriginZ, &RenderStyle::initialTransformOriginZ>::createHandler());
+    setPropertyHandler(CSSPropertyWebkitTransformStyle, ApplyPropertyDefault<ETransformStyle3D, &RenderStyle::transformStyle3D, ETransformStyle3D, &RenderStyle::setTransformStyle3D, ETransformStyle3D, &RenderStyle::initialTransformStyle3D>::createHandler());
+    setPropertyHandler(CSSPropertyWebkitTransitionDelay, ApplyPropertyAnimation<double, &Animation::delay, &Animation::setDelay, &Animation::isDelaySet, &Animation::clearDelay, &Animation::initialAnimationDelay, &CSSStyleSelector::mapAnimationDelay, &RenderStyle::accessTransitions, &RenderStyle::transitions>::createHandler());
+    setPropertyHandler(CSSPropertyWebkitTransitionDuration, ApplyPropertyAnimation<double, &Animation::duration, &Animation::setDuration, &Animation::isDurationSet, &Animation::clearDuration, &Animation::initialAnimationDuration, &CSSStyleSelector::mapAnimationDuration, &RenderStyle::accessTransitions, &RenderStyle::transitions>::createHandler());
+    setPropertyHandler(CSSPropertyWebkitTransitionProperty, ApplyPropertyAnimation<int, &Animation::property, &Animation::setProperty, &Animation::isPropertySet, &Animation::clearProperty, &Animation::initialAnimationProperty, &CSSStyleSelector::mapAnimationProperty, &RenderStyle::accessTransitions, &RenderStyle::transitions>::createHandler());
+    setPropertyHandler(CSSPropertyWebkitTransitionTimingFunction, ApplyPropertyAnimation<const PassRefPtr<TimingFunction>, &Animation::timingFunction, &Animation::setTimingFunction, &Animation::isTimingFunctionSet, &Animation::clearTimingFunction, &Animation::initialAnimationTimingFunction, &CSSStyleSelector::mapAnimationTimingFunction, &RenderStyle::accessTransitions, &RenderStyle::transitions>::createHandler());
+    setPropertyHandler(CSSPropertyWebkitUserDrag, ApplyPropertyDefault<EUserDrag, &RenderStyle::userDrag, EUserDrag, &RenderStyle::setUserDrag, EUserDrag, &RenderStyle::initialUserDrag>::createHandler());
+    setPropertyHandler(CSSPropertyWebkitUserModify, ApplyPropertyDefault<EUserModify, &RenderStyle::userModify, EUserModify, &RenderStyle::setUserModify, EUserModify, &RenderStyle::initialUserModify>::createHandler());
+    setPropertyHandler(CSSPropertyWebkitUserSelect, ApplyPropertyDefault<EUserSelect, &RenderStyle::userSelect, EUserSelect, &RenderStyle::setUserSelect, EUserSelect, &RenderStyle::initialUserSelect>::createHandler());
+    setPropertyHandler(CSSPropertyWebkitWrap, ApplyPropertyExpanding<SuppressValue, CSSPropertyWebkitWrapFlow, CSSPropertyWebkitWrapMargin, CSSPropertyWebkitWrapPadding>::createHandler());
+    setPropertyHandler(CSSPropertyWebkitWrapFlow, ApplyPropertyDefault<WrapFlow, &RenderStyle::wrapFlow, WrapFlow, &RenderStyle::setWrapFlow, WrapFlow, &RenderStyle::initialWrapFlow>::createHandler());
     setPropertyHandler(CSSPropertyWebkitWrapMargin, ApplyPropertyLength<&RenderStyle::wrapMargin, &RenderStyle::setWrapMargin, &RenderStyle::initialWrapMargin>::createHandler());
     setPropertyHandler(CSSPropertyWebkitWrapPadding, ApplyPropertyLength<&RenderStyle::wrapPadding, &RenderStyle::setWrapPadding, &RenderStyle::initialWrapPadding>::createHandler());
-    setPropertyHandler(CSSPropertyWebkitWrapFlow, ApplyPropertyDefault<WrapFlow, &RenderStyle::wrapFlow, WrapFlow, &RenderStyle::setWrapFlow, WrapFlow, &RenderStyle::initialWrapFlow>::createHandler());
     setPropertyHandler(CSSPropertyWebkitWrapThrough, ApplyPropertyDefault<WrapThrough, &RenderStyle::wrapThrough, WrapThrough, &RenderStyle::setWrapThrough, WrapThrough, &RenderStyle::initialWrapThrough>::createHandler());
-    setPropertyHandler(CSSPropertyWebkitWrap, ApplyPropertyExpanding<SuppressValue, CSSPropertyWebkitWrapFlow, CSSPropertyWebkitWrapMargin, CSSPropertyWebkitWrapPadding>::createHandler());
+
+    setPropertyHandler(CSSPropertyWidows, ApplyPropertyDefault<short, &RenderStyle::widows, short, &RenderStyle::setWidows, short, &RenderStyle::initialWidows>::createHandler());
+    setPropertyHandler(CSSPropertyOrphans, ApplyPropertyDefault<short, &RenderStyle::orphans, short, &RenderStyle::setOrphans, short, &RenderStyle::initialOrphans>::createHandler());
 
     setPropertyHandler(CSSPropertyZIndex, ApplyPropertyAuto<int, &RenderStyle::zIndex, &RenderStyle::setZIndex, &RenderStyle::hasAutoZIndex, &RenderStyle::setHasAutoZIndex>::createHandler());
     setPropertyHandler(CSSPropertyZoom, ApplyPropertyZoom::createHandler());
diff --git a/Source/WebCore/css/CSSStyleDeclaration.h b/Source/WebCore/css/CSSStyleDeclaration.h
index e5e7cb957..50bcef25e 100644
--- a/Source/WebCore/css/CSSStyleDeclaration.h
+++ b/Source/WebCore/css/CSSStyleDeclaration.h
@@ -35,11 +35,14 @@ class StyledElement;
 
 typedef int ExceptionCode;
 
-class CSSStyleDeclaration : public RefCounted<CSSStyleDeclaration> {
-    WTF_MAKE_NONCOPYABLE(CSSStyleDeclaration);
+class CSSStyleDeclaration {
+    WTF_MAKE_NONCOPYABLE(CSSStyleDeclaration); WTF_MAKE_FAST_ALLOCATED;
 public:
     virtual ~CSSStyleDeclaration() { }
 
+    virtual void ref() = 0;
+    virtual void deref() = 0;
+
     virtual CSSRule* parentRule() const = 0;
     virtual String cssText() const = 0;
     virtual void setCssText(const String&, ExceptionCode&) = 0;
@@ -64,7 +67,7 @@ public:
 
     virtual bool cssPropertyMatches(const CSSProperty*) const = 0;
     virtual CSSStyleSheet* parentStyleSheet() const { return 0; }
- 
+
 #ifndef NDEBUG
     void showStyle();
 #endif
diff --git a/Source/WebCore/css/CSSStyleDeclaration.idl b/Source/WebCore/css/CSSStyleDeclaration.idl
index 14683d1f1..8be67e4a6 100644
--- a/Source/WebCore/css/CSSStyleDeclaration.idl
+++ b/Source/WebCore/css/CSSStyleDeclaration.idl
@@ -23,33 +23,33 @@ module css {
     // Introduced in DOM Level 2:
     interface [
         JSCustomMarkFunction,
-        JSGenerateIsReachable=ImplRoot,
+        JSGenerateIsReachable,
         CustomNamedSetter,
         NamedGetter,
         IndexedGetter,
-        CustomGetPropertyNames,
+        CustomEnumerateProperty,
         V8DependentLifetime
     ] CSSStyleDeclaration {
-                 attribute [ConvertNullStringTo=Null, TreatNullAs=NullString] DOMString        cssText
+                 attribute [TreatReturnedNullStringAs=Null, TreatNullAs=NullString] DOMString        cssText
                      setter raises(DOMException);
 
-        [ConvertNullStringTo=Null] DOMString          getPropertyValue(in [Optional=CallWithDefaultValue] DOMString propertyName);
-        [JSCustom] CSSValue           getPropertyCSSValue(in [Optional=CallWithDefaultValue] DOMString propertyName);
-        [ConvertNullStringTo=Null] DOMString          removeProperty(in [Optional=CallWithDefaultValue] DOMString propertyName)
+        [TreatReturnedNullStringAs=Null] DOMString          getPropertyValue(in [Optional=DefaultIsUndefined] DOMString propertyName);
+        [JSCustom] CSSValue           getPropertyCSSValue(in [Optional=DefaultIsUndefined] DOMString propertyName);
+        [TreatReturnedNullStringAs=Null] DOMString          removeProperty(in [Optional=DefaultIsUndefined] DOMString propertyName)
             raises(DOMException);
-        [ConvertNullStringTo=Null] DOMString          getPropertyPriority(in [Optional=CallWithDefaultValue] DOMString propertyName);
-        [ObjCLegacyUnnamedParameters] void setProperty(in [Optional=CallWithDefaultValue] DOMString propertyName, 
-                                        in [TreatNullAs=NullString,Optional=CallWithDefaultValue] DOMString value, 
-                                        in [Optional=CallWithDefaultValue] DOMString priority)
+        [TreatReturnedNullStringAs=Null] DOMString          getPropertyPriority(in [Optional=DefaultIsUndefined] DOMString propertyName);
+        [ObjCLegacyUnnamedParameters] void setProperty(in [Optional=DefaultIsUndefined] DOMString propertyName, 
+                                        in [TreatNullAs=NullString,Optional=DefaultIsUndefined] DOMString value, 
+                                        in [Optional=DefaultIsUndefined] DOMString priority)
             raises(DOMException);
 
         readonly attribute unsigned long    length;
-        DOMString          item(in [Optional=CallWithDefaultValue] unsigned long index);
+        DOMString          item(in [Optional=DefaultIsUndefined] unsigned long index);
         readonly attribute CSSRule          parentRule;
 
         // Extensions
-        [ConvertNullStringTo=Null] DOMString          getPropertyShorthand(in [Optional=CallWithDefaultValue] DOMString propertyName);
-        boolean            isPropertyImplicit(in [Optional=CallWithDefaultValue] DOMString propertyName);
+        [TreatReturnedNullStringAs=Null] DOMString          getPropertyShorthand(in [Optional=DefaultIsUndefined] DOMString propertyName);
+        boolean            isPropertyImplicit(in [Optional=DefaultIsUndefined] DOMString propertyName);
     };
 
 }
diff --git a/Source/WebCore/css/CSSStyleRule.cpp b/Source/WebCore/css/CSSStyleRule.cpp
index ae56df9f9..7a1d66fca 100644
--- a/Source/WebCore/css/CSSStyleRule.cpp
+++ b/Source/WebCore/css/CSSStyleRule.cpp
@@ -35,8 +35,8 @@
 
 namespace WebCore {
 
-CSSStyleRule::CSSStyleRule(CSSStyleSheet* parent, int line, CSSRule::Type type)
-    : CSSRule(parent, type)
+CSSStyleRule::CSSStyleRule(CSSStyleSheet* parent, int line)
+    : CSSRule(parent, CSSRule::STYLE_RULE)
 {
     setSourceLine(line);
 
@@ -47,7 +47,7 @@ CSSStyleRule::CSSStyleRule(CSSStyleSheet* parent, int line, CSSRule::Type type)
 CSSStyleRule::~CSSStyleRule()
 {
     if (m_style)
-        m_style->clearParentRule();
+        m_style->clearParentRule(this);
     cleanup();
 }
 
@@ -68,17 +68,13 @@ inline void CSSStyleRule::cleanup()
 
 String CSSStyleRule::generateSelectorText() const
 {
-    if (isPageRule())
-        return static_cast<const CSSPageRule*>(this)->pageSelectorText();
-    else {
-        StringBuilder builder;
-        for (CSSSelector* s = selectorList().first(); s; s = CSSSelectorList::next(s)) {
-            if (s != selectorList().first())
-                builder.append(", ");
-            builder.append(s->selectorText());
-        }
-        return builder.toString();
+    StringBuilder builder;
+    for (CSSSelector* s = selectorList().first(); s; s = CSSSelectorList::next(s)) {
+        if (s != selectorList().first())
+            builder.append(", ");
+        builder.append(s->selectorText());
     }
+    return builder.toString();
 }
 
 String CSSStyleRule::selectorText() const
@@ -137,7 +133,7 @@ String CSSStyleRule::cssText() const
 void CSSStyleRule::addSubresourceStyleURLs(ListHashSet<KURL>& urls)
 {
     if (m_style)
-        m_style->addSubresourceStyleURLs(urls);
+        m_style->addSubresourceStyleURLs(urls, parentStyleSheet());
 }
 
 } // namespace WebCore
diff --git a/Source/WebCore/css/CSSStyleRule.h b/Source/WebCore/css/CSSStyleRule.h
index 7fd12a162..f70b9b231 100644
--- a/Source/WebCore/css/CSSStyleRule.h
+++ b/Source/WebCore/css/CSSStyleRule.h
@@ -43,12 +43,12 @@ public:
     String selectorText() const;
     void setSelectorText(const String&);
 
-    CSSStyleDeclaration* style() const { return m_style->ensureCSSStyleDeclaration(); }
+    CSSStyleDeclaration* style() const { return m_style->ensureRuleCSSStyleDeclaration(this); }
 
     String cssText() const;
 
     void adoptSelectorVector(Vector<OwnPtr<CSSParserSelector> >& selectors) { m_selectorList.adoptSelectorVector(selectors); }
-    void setDeclaration(PassRefPtr<StylePropertySet> style) { ASSERT(style->parentRuleInternal() == this); m_style = style; }
+    void setDeclaration(PassRefPtr<StylePropertySet> style) { m_style = style; }
 
     const CSSSelectorList& selectorList() const { return m_selectorList; }
     StylePropertySet* declaration() const { return m_style.get(); }
@@ -57,10 +57,9 @@ public:
 
     using CSSRule::sourceLine;
 
-protected:
-    CSSStyleRule(CSSStyleSheet* parent, int sourceLine, CSSRule::Type = CSSRule::STYLE_RULE);
-
 private:
+    CSSStyleRule(CSSStyleSheet* parent, int sourceLine);
+
     void cleanup();
     String generateSelectorText() const;
 
diff --git a/Source/WebCore/css/CSSStyleRule.idl b/Source/WebCore/css/CSSStyleRule.idl
index c0a5e6822..c57632942 100644
--- a/Source/WebCore/css/CSSStyleRule.idl
+++ b/Source/WebCore/css/CSSStyleRule.idl
@@ -23,7 +23,7 @@ module css {
     // Introduced in DOM Level 2:
     interface CSSStyleRule : CSSRule {
 
-                 attribute [ConvertNullStringTo=Null, TreatNullAs=NullString] DOMString selectorText;
+                 attribute [TreatReturnedNullStringAs=Null, TreatNullAs=NullString] DOMString selectorText;
 
         readonly attribute CSSStyleDeclaration style;
 
diff --git a/Source/WebCore/css/CSSStyleSelector.cpp b/Source/WebCore/css/CSSStyleSelector.cpp
index 7d84a81a5..b172c4733 100644
--- a/Source/WebCore/css/CSSStyleSelector.cpp
+++ b/Source/WebCore/css/CSSStyleSelector.cpp
@@ -54,7 +54,6 @@
 #include "CSSTimingFunctionValue.h"
 #include "CSSValueList.h"
 #include "CursorList.h"
-#include "FontFamilyValue.h"
 #include "FontFeatureValue.h"
 #include "FontValue.h"
 #include "Frame.h"
@@ -88,6 +87,7 @@
 #include "RenderStyleConstants.h"
 #include "RenderTheme.h"
 #include "RotateTransformOperation.h"
+#include "RuntimeEnabledFeatures.h"
 #include "ScaleTransformOperation.h"
 #include "SecurityOrigin.h"
 #include "Settings.h"
@@ -173,7 +173,7 @@ if (primitiveValue) \
 
 class RuleData {
 public:
-    RuleData(CSSStyleRule*, CSSSelector*, unsigned position);
+    RuleData(CSSStyleRule*, CSSSelector*, unsigned position, bool canUseFastCheckSelector = true);
 
     unsigned position() const { return m_position; }
     CSSStyleRule* rule() const { return m_rule; }
@@ -225,8 +225,8 @@ public:
 
     void addRulesFromSheet(CSSStyleSheet*, const MediaQueryEvaluator&, CSSStyleSelector* = 0, const Element* = 0);
 
-    void addStyleRule(CSSStyleRule*);
-    void addRule(CSSStyleRule*, CSSSelector*);
+    void addStyleRule(CSSStyleRule*, bool canUseFastCheckSelector = true);
+    void addRule(CSSStyleRule*, CSSSelector*, bool canUseFastCheckSelector = true);
     void addPageRule(CSSPageRule*);
     void addToRuleSet(AtomicStringImpl* key, AtomRuleMap&, const RuleData&);
     void addRegionRule(WebKitCSSRegionRule*);
@@ -242,7 +242,7 @@ public:
     const Vector<RuleData>* linkPseudoClassRules() const { return &m_linkPseudoClassRules; }
     const Vector<RuleData>* focusPseudoClassRules() const { return &m_focusPseudoClassRules; }
     const Vector<RuleData>* universalRules() const { return &m_universalRules; }
-    const Vector<RuleData>* pageRules() const { return &m_pageRules; }
+    const Vector<CSSPageRule*>& pageRules() const { return m_pageRules; }
 
 public:
     AtomRuleMap m_idRules;
@@ -252,7 +252,7 @@ public:
     Vector<RuleData> m_linkPseudoClassRules;
     Vector<RuleData> m_focusPseudoClassRules;
     Vector<RuleData> m_universalRules;
-    Vector<RuleData> m_pageRules;
+    Vector<CSSPageRule*> m_pageRules;
     unsigned m_ruleCount;
     bool m_autoShrinkToFitEnabled;
     CSSStyleSelector::Features m_features;
@@ -318,7 +318,7 @@ CSSStyleSelector::CSSStyleSelector(Document* document, StyleSheetList* styleShee
                                    bool strictParsing, bool matchAuthorAndUserStyles)
     : m_hasUAAppearance(false)
     , m_backgroundData(BackgroundFillLayer)
-    , m_matchedDeclarationCacheAdditionsSinceLastSweep(0)
+    , m_matchedPropertiesCacheAdditionsSinceLastSweep(0)
     , m_checker(document, strictParsing)
     , m_parentStyle(0)
     , m_rootElementStyle(0)
@@ -443,10 +443,13 @@ void CSSStyleSelector::collectFeatures()
 }
 
 #if ENABLE(STYLE_SCOPED)
-Element* CSSStyleSelector::determineScopingElement(const CSSStyleSheet* sheet)
+const Element* CSSStyleSelector::determineScopingElement(const CSSStyleSheet* sheet)
 {
     ASSERT(sheet);
 
+    if (!RuntimeEnabledFeatures::styleScopedEnabled())
+        return 0;
+
     Node* ownerNode = sheet->findStyleSheetOwnerNode();
     if (!ownerNode || !ownerNode->isHTMLElement() || !ownerNode->hasTagName(HTMLNames::styleTag))
         return 0;
@@ -572,25 +575,25 @@ CSSStyleSelector::~CSSStyleSelector()
     m_fontSelector->clearDocument();
 }
 
-void CSSStyleSelector::sweepMatchedDeclarationCache()
+void CSSStyleSelector::sweepMatchedPropertiesCache()
 {
     // Look for cache entries containing a style declaration with a single ref and remove them.
     // This may happen when an element attribute mutation causes it to swap out its Attribute::decl()
     // for another CSSMappedAttributeDeclaration, potentially leaving this cache with the last ref.
     Vector<unsigned, 16> toRemove;
-    MatchedStyleDeclarationCache::iterator it = m_matchedStyleDeclarationCache.begin();
-    MatchedStyleDeclarationCache::iterator end = m_matchedStyleDeclarationCache.end();
+    MatchedPropertiesCache::iterator it = m_matchedPropertiesCache.begin();
+    MatchedPropertiesCache::iterator end = m_matchedPropertiesCache.end();
     for (; it != end; ++it) {
-        Vector<MatchedStyleDeclaration>& matchedStyleDeclarations = it->second.matchedStyleDeclarations;
-        for (size_t i = 0; i < matchedStyleDeclarations.size(); ++i) {
-            if (matchedStyleDeclarations[i].styleDeclaration->hasOneRef()) {
+        Vector<MatchedProperties>& matchedProperties = it->second.matchedProperties;
+        for (size_t i = 0; i < matchedProperties.size(); ++i) {
+            if (matchedProperties[i].properties->hasOneRef()) {
                 toRemove.append(it->first);
                 break;
             }
         }
     }
     for (size_t i = 0; i < toRemove.size(); ++i)
-        m_matchedStyleDeclarationCache.remove(toRemove[i]);
+        m_matchedPropertiesCache.remove(toRemove[i]);
 }
 
 CSSStyleSelector::Features::Features()
@@ -747,15 +750,16 @@ static void ensureDefaultStyleSheetsForElement(Element* element)
     ASSERT_UNUSED(loadedMathMLUserAgentSheet, loadedMathMLUserAgentSheet || defaultStyle->features().siblingRules.isEmpty());
 }
 
-void CSSStyleSelector::addMatchedDeclaration(StylePropertySet* styleDeclaration, unsigned linkMatchType)
+void CSSStyleSelector::addMatchedProperties(MatchResult& matchResult, StylePropertySet* properties, CSSStyleRule* rule, unsigned linkMatchType)
 {
-    m_matchedDecls.grow(m_matchedDecls.size() + 1);
-    MatchedStyleDeclaration& newDeclaration = m_matchedDecls.last();
-    newDeclaration.styleDeclaration = styleDeclaration;
-    newDeclaration.linkMatchType = linkMatchType;
+    matchResult.matchedProperties.grow(matchResult.matchedProperties.size() + 1);
+    MatchedProperties& newProperties = matchResult.matchedProperties.last();
+    newProperties.properties = properties;
+    newProperties.linkMatchType = linkMatchType;
+    matchResult.matchedRules.append(rule);
 }
 
-void CSSStyleSelector::collectMatchingRules(RuleSet* rules, int& firstRuleIndex, int& lastRuleIndex, bool includeEmptyRules)
+void CSSStyleSelector::collectMatchingRules(RuleSet* rules, int& firstRuleIndex, int& lastRuleIndex, const MatchOptions& options)
 {
     ASSERT(rules);
     ASSERT(m_element);
@@ -763,28 +767,28 @@ void CSSStyleSelector::collectMatchingRules(RuleSet* rules, int& firstRuleIndex,
     // We need to collect the rules for id, class, tag, and everything else into a buffer and
     // then sort the buffer.
     if (m_element->hasID())
-        collectMatchingRulesForList(rules->idRules(m_element->idForStyleResolution().impl()), firstRuleIndex, lastRuleIndex, includeEmptyRules);
+        collectMatchingRulesForList(rules->idRules(m_element->idForStyleResolution().impl()), firstRuleIndex, lastRuleIndex, options);
     if (m_element->hasClass()) {
         ASSERT(m_styledElement);
         const SpaceSplitString& classNames = m_styledElement->classNames();
         size_t size = classNames.size();
         for (size_t i = 0; i < size; ++i)
-            collectMatchingRulesForList(rules->classRules(classNames[i].impl()), firstRuleIndex, lastRuleIndex, includeEmptyRules);
+            collectMatchingRulesForList(rules->classRules(classNames[i].impl()), firstRuleIndex, lastRuleIndex, options);
     }
     const AtomicString& pseudoId = m_element->shadowPseudoId();
     if (!pseudoId.isEmpty()) {
         ASSERT(m_styledElement);
-        collectMatchingRulesForList(rules->shadowPseudoElementRules(pseudoId.impl()), firstRuleIndex, lastRuleIndex, includeEmptyRules);
+        collectMatchingRulesForList(rules->shadowPseudoElementRules(pseudoId.impl()), firstRuleIndex, lastRuleIndex, options);
     }
     if (m_element->isLink())
-        collectMatchingRulesForList(rules->linkPseudoClassRules(), firstRuleIndex, lastRuleIndex, includeEmptyRules);
+        collectMatchingRulesForList(rules->linkPseudoClassRules(), firstRuleIndex, lastRuleIndex, options);
     if (m_checker.matchesFocusPseudoClass(m_element))
-        collectMatchingRulesForList(rules->focusPseudoClassRules(), firstRuleIndex, lastRuleIndex, includeEmptyRules);
-    collectMatchingRulesForList(rules->tagRules(m_element->localName().impl()), firstRuleIndex, lastRuleIndex, includeEmptyRules);
-    collectMatchingRulesForList(rules->universalRules(), firstRuleIndex, lastRuleIndex, includeEmptyRules);
+        collectMatchingRulesForList(rules->focusPseudoClassRules(), firstRuleIndex, lastRuleIndex, options);
+    collectMatchingRulesForList(rules->tagRules(m_element->localName().impl()), firstRuleIndex, lastRuleIndex, options);
+    collectMatchingRulesForList(rules->universalRules(), firstRuleIndex, lastRuleIndex, options);
 }
 
-void CSSStyleSelector::collectMatchingRulesForRegion(RuleSet* rules, int& firstRuleIndex, int& lastRuleIndex, bool includeEmptyRules)
+void CSSStyleSelector::collectMatchingRulesForRegion(RuleSet* rules, int& firstRuleIndex, int& lastRuleIndex, const MatchOptions& options)
 {
     if (!m_regionForStyling)
         return;
@@ -795,12 +799,12 @@ void CSSStyleSelector::collectMatchingRulesForRegion(RuleSet* rules, int& firstR
         if (checkRegionSelector(regionSelector, static_cast<Element*>(m_regionForStyling->node()))) {
             RuleSet* regionRules = rules->m_regionSelectorsAndRuleSets.at(i).ruleSet.get();
             ASSERT(regionRules);
-            collectMatchingRules(regionRules, firstRuleIndex, lastRuleIndex, includeEmptyRules);
+            collectMatchingRules(regionRules, firstRuleIndex, lastRuleIndex, options);
         }
     }
 }
 
-void CSSStyleSelector::sortAndTransferMatchedRules()
+void CSSStyleSelector::sortAndTransferMatchedRules(MatchResult& result)
 {
     if (m_matchedRules.isEmpty())
         return;
@@ -824,64 +828,81 @@ void CSSStyleSelector::sortAndTransferMatchedRules()
         unsigned linkMatchType = m_matchedRules[i]->linkMatchType();
         if (swapVisitedUnvisited && linkMatchType && linkMatchType != SelectorChecker::MatchAll)
             linkMatchType = (linkMatchType == SelectorChecker::MatchVisited) ? SelectorChecker::MatchLink : SelectorChecker::MatchVisited;
-        addMatchedDeclaration(m_matchedRules[i]->rule()->declaration(), linkMatchType);
+        addMatchedProperties(result, m_matchedRules[i]->rule()->declaration(), m_matchedRules[i]->rule(), linkMatchType);
     }
 }
 
-void CSSStyleSelector::matchScopedAuthorRules(int& firstRuleIndex, int& lastRuleIndex, bool includeEmptyRules)
+void CSSStyleSelector::matchScopedAuthorRules(MatchResult& result, bool includeEmptyRules)
 {
 #if ENABLE(STYLE_SCOPED)
     if (m_scopedAuthorStyles.isEmpty())
         return;
 
+    MatchOptions options(includeEmptyRules);
+
     // Match scoped author rules by traversing the scoped element stack (rebuild it if it got inconsistent).
     const Element* parent = m_element->parentOrHostElement();
     if (!scopingElementStackIsConsistent(parent))
         setupScopingElementStack(parent);
     for (size_t i = m_scopingElementStack.size(); i; --i) {
-        collectMatchingRules(m_scopingElementStack[i - 1].m_ruleSet, firstRuleIndex, lastRuleIndex, includeEmptyRules);
-        collectMatchingRulesForRegion(m_scopingElementStack[i - 1].m_ruleSet, firstRuleIndex, lastRuleIndex, includeEmptyRules);
+        const ScopeStackFrame& frame = m_scopingElementStack[i - 1];
+        options.scope = frame.m_element;
+        collectMatchingRules(frame.m_ruleSet, result.ranges.firstAuthorRule, result.ranges.lastAuthorRule, options);
+        collectMatchingRulesForRegion(frame.m_ruleSet, result.ranges.firstAuthorRule, result.ranges.lastAuthorRule, options);
     }
     // Also include the current element.
     RuleSet* ruleSet = scopedRuleSetForElement(m_element);
     if (ruleSet) {
-        collectMatchingRules(ruleSet, firstRuleIndex, lastRuleIndex, includeEmptyRules);
-        collectMatchingRulesForRegion(ruleSet, firstRuleIndex, lastRuleIndex, includeEmptyRules);
+        options.scope = m_element;
+        collectMatchingRules(ruleSet, result.ranges.firstAuthorRule, result.ranges.lastAuthorRule, options);
+        collectMatchingRulesForRegion(ruleSet, result.ranges.firstAuthorRule, result.ranges.lastAuthorRule, options);
     }
 #else
-    UNUSED_PARAM(firstRuleIndex);
-    UNUSED_PARAM(lastRuleIndex);
+    UNUSED_PARAM(result);
     UNUSED_PARAM(includeEmptyRules);
 #endif
 }
 
-void CSSStyleSelector::matchAuthorRules(int& firstRuleIndex, int& lastRuleIndex, bool includeEmptyRules)
+void CSSStyleSelector::matchAuthorRules(MatchResult& result, bool includeEmptyRules)
 {
     m_matchedRules.clear();
+    result.ranges.lastAuthorRule = result.matchedProperties.size() - 1;
 
     if (!m_element)
         return;
 
     // Match global author rules.
-    collectMatchingRules(m_authorStyle.get(), firstRuleIndex, lastRuleIndex, includeEmptyRules);
-    collectMatchingRulesForRegion(m_authorStyle.get(), firstRuleIndex, lastRuleIndex, includeEmptyRules);
+    MatchOptions options(includeEmptyRules);
+    collectMatchingRules(m_authorStyle.get(), result.ranges.firstAuthorRule, result.ranges.lastAuthorRule, options);
+    collectMatchingRulesForRegion(m_authorStyle.get(), result.ranges.firstAuthorRule, result.ranges.lastAuthorRule, options);
 
-    matchScopedAuthorRules(firstRuleIndex, lastRuleIndex, includeEmptyRules);
+    matchScopedAuthorRules(result, includeEmptyRules);
 
-    sortAndTransferMatchedRules();
+    sortAndTransferMatchedRules(result);
 }
 
-void CSSStyleSelector::matchRules(RuleSet* rules, int& firstRuleIndex, int& lastRuleIndex, bool includeEmptyRules)
+void CSSStyleSelector::matchUserRules(MatchResult& result, bool includeEmptyRules)
 {
+    if (!m_userStyle)
+        return;
+    
     m_matchedRules.clear();
 
-    if (!rules || !m_element)
-        return;
+    result.ranges.lastUserRule = result.matchedProperties.size() - 1;
+    collectMatchingRules(m_userStyle.get(), result.ranges.firstUserRule, result.ranges.lastUserRule, includeEmptyRules);
+    collectMatchingRulesForRegion(m_userStyle.get(), result.ranges.firstUserRule, result.ranges.lastUserRule, includeEmptyRules);
 
-    collectMatchingRules(rules, firstRuleIndex, lastRuleIndex, includeEmptyRules);
-    collectMatchingRulesForRegion(rules, firstRuleIndex, lastRuleIndex, includeEmptyRules);
+    sortAndTransferMatchedRules(result);
+}
 
-    sortAndTransferMatchedRules();
+void CSSStyleSelector::matchUARules(MatchResult& result, RuleSet* rules)
+{
+    m_matchedRules.clear();
+    
+    result.ranges.lastUARule = result.matchedProperties.size() - 1;
+    collectMatchingRules(rules, result.ranges.firstUARule, result.ranges.lastUARule, false);
+
+    sortAndTransferMatchedRules(result);
 }
 
 class MatchingUARulesScope {
@@ -913,12 +934,7 @@ inline bool MatchingUARulesScope::isMatchingUARules()
 
 bool MatchingUARulesScope::m_matchingUARules = false;
 
-inline static bool matchesInTreeScope(TreeScope* treeScope, bool ruleReachesIntoShadowDOM)
-{
-    return MatchingUARulesScope::isMatchingUARules() || treeScope->applyAuthorSheets() || ruleReachesIntoShadowDOM;
-}
-
-void CSSStyleSelector::collectMatchingRulesForList(const Vector<RuleData>* rules, int& firstRuleIndex, int& lastRuleIndex, bool includeEmptyRules)
+void CSSStyleSelector::collectMatchingRulesForList(const Vector<RuleData>* rules, int& firstRuleIndex, int& lastRuleIndex, const MatchOptions& options)
 {
     if (!rules)
         return;
@@ -934,14 +950,30 @@ void CSSStyleSelector::collectMatchingRulesForList(const Vector<RuleData>* rules
 
         CSSStyleRule* rule = ruleData.rule();
         InspectorInstrumentationCookie cookie = InspectorInstrumentation::willMatchRule(document(), rule);
+#if ENABLE(STYLE_SCOPED)
+        if (checkSelector(ruleData, options.scope)) {
+#else
         if (checkSelector(ruleData)) {
-            if (!matchesInTreeScope(m_element->treeScope(), m_checker.hasUnknownPseudoElements())) {
+#endif
+            // Check whether the rule is applicable in the current tree scope. Criteria for this:
+            // a) it's a UA rule
+            // b) the tree scope allows author rules
+            // c) the rules comes from a scoped style sheet within the same tree scope
+            // d) the rule contains shadow-ID pseudo elements
+            TreeScope* treeScope = m_element->treeScope();
+            if (!MatchingUARulesScope::isMatchingUARules()
+                && !treeScope->applyAuthorSheets()
+#if ENABLE(STYLE_SCOPED)
+                && (!options.scope || options.scope->treeScope() != treeScope)
+#endif
+                && !m_checker.hasUnknownPseudoElements()) {
+
                 InspectorInstrumentation::didMatchRule(cookie, false);
                 continue;
             }
             // If the rule has no properties to apply, then ignore it in the non-debug mode.
             StylePropertySet* decl = rule->declaration();
-            if (!decl || (decl->isEmpty() && !includeEmptyRules)) {
+            if (!decl || (decl->isEmpty() && !options.includeEmptyRules)) {
                 InspectorInstrumentation::didMatchRule(cookie, false);
                 continue;
             }
@@ -960,7 +992,7 @@ void CSSStyleSelector::collectMatchingRulesForList(const Vector<RuleData>* rules
                     m_style->setHasPseudoStyle(m_dynamicPseudo);
             } else {
                 // Update our first/last rule indices in the matched rules array.
-                lastRuleIndex = m_matchedDecls.size() + m_matchedRules.size();
+                ++lastRuleIndex;
                 if (firstRuleIndex == -1)
                     firstRuleIndex = lastRuleIndex;
 
@@ -992,18 +1024,15 @@ void CSSStyleSelector::matchAllRules(MatchResult& result)
 
     // Now we check user sheet rules.
     if (m_matchAuthorAndUserStyles)
-        matchRules(m_userStyle.get(), result.ranges.firstUserRule, result.ranges.lastUserRule, false);
+        matchUserRules(result, false);
         
     // Now check author rules, beginning first with presentational attributes mapped from HTML.
     if (m_styledElement) {
         if (StylePropertySet* attributeStyle = m_styledElement->attributeStyle()) {
-            if (!attributeStyle->isEmpty()) {
-                result.ranges.lastAuthorRule = m_matchedRules.size();
-                if (result.ranges.firstAuthorRule == -1)
-                    result.ranges.firstAuthorRule = result.ranges.lastAuthorRule;
-                addMatchedDeclaration(attributeStyle);
-                result.isCacheable = false;
-            }
+            result.ranges.lastAuthorRule = m_matchedRules.size();
+            if (result.ranges.firstAuthorRule == -1)
+                result.ranges.firstAuthorRule = result.ranges.lastAuthorRule;
+            addMatchedProperties(result, attributeStyle);
         }
 
         // Now we check additional mapped declarations.
@@ -1011,9 +1040,9 @@ void CSSStyleSelector::matchAllRules(MatchResult& result)
         // after all attributes, since their mapped style depends on the values of multiple attributes.
         if (StylePropertySet* additionalStyle = m_styledElement->additionalAttributeStyle()) {
             if (result.ranges.firstAuthorRule == -1)
-                result.ranges.firstAuthorRule = m_matchedDecls.size();
-            result.ranges.lastAuthorRule = m_matchedDecls.size();
-            addMatchedDeclaration(additionalStyle);
+                result.ranges.firstAuthorRule = result.matchedProperties.size();
+            result.ranges.lastAuthorRule = result.ranges.firstAuthorRule;
+            addMatchedProperties(result, additionalStyle);
             result.isCacheable = false;
         }
 
@@ -1021,27 +1050,27 @@ void CSSStyleSelector::matchAllRules(MatchResult& result)
             bool isAuto;
             TextDirection textDirection = toHTMLElement(m_styledElement)->directionalityIfhasDirAutoAttribute(isAuto);
             if (isAuto)
-                addMatchedDeclaration(textDirection == LTR ? leftToRightDeclaration() : rightToLeftDeclaration());
+                addMatchedProperties(result, textDirection == LTR ? leftToRightDeclaration() : rightToLeftDeclaration());
         }
     }
     
     // Check the rules in author sheets next.
     if (m_matchAuthorAndUserStyles)
-        matchAuthorRules(result.ranges.firstAuthorRule, result.ranges.lastAuthorRule, false);
+        matchAuthorRules(result, false);
 
     // Now check our inline style attribute.
     if (m_matchAuthorAndUserStyles && m_styledElement) {
         StylePropertySet* inlineDecl = m_styledElement->inlineStyleDecl();
         if (inlineDecl) {
-            result.ranges.lastAuthorRule = m_matchedDecls.size();
+            result.ranges.lastAuthorRule = result.matchedProperties.size();
             if (result.ranges.firstAuthorRule == -1)
                 result.ranges.firstAuthorRule = result.ranges.lastAuthorRule;
-            addMatchedDeclaration(inlineDecl);
+            addMatchedProperties(result, inlineDecl);
             result.isCacheable = false;
         }
     }
 }
-    
+
 inline void CSSStyleSelector::initElement(Element* e)
 {
     if (m_element != e) {
@@ -1072,8 +1101,6 @@ inline void CSSStyleSelector::initForStyleResolve(Element* e, RenderStyle* paren
 
     m_style = 0;
 
-    m_matchedDecls.clear();
-
     m_pendingImageProperties.clear();
 
     m_ruleList = 0;
@@ -1129,11 +1156,16 @@ Node* CSSStyleSelector::locateCousinList(Element* parent, unsigned& visitedNodeC
 
 bool CSSStyleSelector::matchesRuleSet(RuleSet* ruleSet)
 {
-    int firstSiblingRule = -1, lastSiblingRule = -1;
-    matchRules(ruleSet, firstSiblingRule, lastSiblingRule, false);
-    if (m_matchedDecls.isEmpty())
+    if (!ruleSet)
+        return false;
+    m_matchedRules.clear();
+
+    int firstRuleIndex = -1, lastRuleIndex = -1;
+    collectMatchingRules(ruleSet, firstRuleIndex, lastRuleIndex, false);
+
+    if (m_matchedRules.isEmpty())
         return false;
-    m_matchedDecls.clear();
+    m_matchedRules.clear();
     return true;
 }
 
@@ -1190,6 +1222,13 @@ bool CSSStyleSelector::canShareStyleWithControl(StyledElement* element) const
             return false;
     }
 
+    if (element->fastGetAttribute(typeAttr) != m_element->fastGetAttribute(typeAttr))
+        return false;
+
+    if (element->fastGetAttribute(readonlyAttr) != m_element->fastGetAttribute(readonlyAttr))
+        return false;
+
+
     return true;
 }
 
@@ -1235,10 +1274,6 @@ bool CSSStyleSelector::canShareStyleWithElement(StyledElement* element) const
         return false;
     if (!!element->attributeStyle() != !!m_styledElement->attributeStyle())
         return false;
-    StylePropertySet* additionalAttributeStyleA = element->additionalAttributeStyle();
-    StylePropertySet* additionalAttributeStyleB = m_styledElement->additionalAttributeStyle();
-    if (!additionalAttributeStyleA != !additionalAttributeStyleB)
-        return false;
     if (element->isLink() != m_element->isLink())
         return false;
     if (style->affectedByUncommonAttributeSelectors())
@@ -1249,40 +1284,19 @@ bool CSSStyleSelector::canShareStyleWithElement(StyledElement* element) const
         return false;
     if (element->focused() != m_element->focused())
         return false;
-    if (element->shadowPseudoId() != m_element->shadowPseudoId())
-        return false;
     if (element == element->document()->cssTarget())
         return false;
     if (m_element == m_element->document()->cssTarget())
         return false;
-    if (element->getAttribute(typeAttr) != m_element->getAttribute(typeAttr))
-        return false;
-    if (element->fastGetAttribute(XMLNames::langAttr) != m_element->fastGetAttribute(XMLNames::langAttr))
-        return false;
-    if (element->fastGetAttribute(langAttr) != m_element->fastGetAttribute(langAttr))
+    if (style->transitions() || style->animations())
         return false;
-    if (element->fastGetAttribute(readonlyAttr) != m_element->fastGetAttribute(readonlyAttr))
+    if (element->isLink() && m_elementLinkState != style->insideLink())
         return false;
-    if (element->fastGetAttribute(cellpaddingAttr) != m_element->fastGetAttribute(cellpaddingAttr))
+    if (element->shadowPseudoId() != m_element->shadowPseudoId())
         return false;
-
     if (element->hasID() && m_features.idsInRules.contains(element->idForStyleResolution().impl()))
         return false;
-
-#if ENABLE(STYLE_SCOPED)
-    if (element->hasScopedHTMLStyleChild())
-        return false;
-#endif
-
-    bool isControl = element->isFormControlElement();
-
-    if (isControl != m_element->isFormControlElement())
-        return false;
-
-    if (isControl && !canShareStyleWithControl(element))
-        return false;
-
-    if (style->transitions() || style->animations())
+    if (m_element->isFormControlElement() && !canShareStyleWithControl(element))
         return false;
 
 #if USE(ACCELERATED_COMPOSITING)
@@ -1303,14 +1317,26 @@ bool CSSStyleSelector::canShareStyleWithElement(StyledElement* element) const
     if (element->hasClass() && m_element->getAttribute(classAttr) != element->getAttribute(classAttr))
         return false;
 
+    StylePropertySet* additionalAttributeStyleA = element->additionalAttributeStyle();
+    StylePropertySet* additionalAttributeStyleB = m_styledElement->additionalAttributeStyle();
+    if (!additionalAttributeStyleA != !additionalAttributeStyleB)
+        return false;
+
+    if (element->fastGetAttribute(XMLNames::langAttr) != m_element->fastGetAttribute(XMLNames::langAttr))
+        return false;
+    if (element->fastGetAttribute(langAttr) != m_element->fastGetAttribute(langAttr))
+        return false;
+
     if (element->attributeStyle() && !attributeStylesEqual(element->attributeStyle(), m_styledElement->attributeStyle()))
         return false;
 
     if (additionalAttributeStyleA && !attributeStylesEqual(additionalAttributeStyleA, additionalAttributeStyleB))
         return false;
 
-    if (element->isLink() && m_elementLinkState != style->insideLink())
+#if ENABLE(STYLE_SCOPED)
+    if (element->hasScopedHTMLStyleChild())
         return false;
+#endif
 
     return true;
 }
@@ -1390,17 +1416,17 @@ void CSSStyleSelector::matchUARules(MatchResult& result)
         result.isCacheable = false;
     RuleSet* userAgentStyleSheet = m_medium->mediaTypeMatchSpecific("print")
         ? defaultPrintStyle : defaultStyle;
-    matchRules(userAgentStyleSheet, result.ranges.firstUARule, result.ranges.lastUARule, false);
+    matchUARules(result, userAgentStyleSheet);
 
     // In quirks mode, we match rules from the quirks user agent sheet.
     if (!m_checker.strictParsing())
-        matchRules(defaultQuirksStyle, result.ranges.firstUARule, result.ranges.lastUARule, false);
+        matchUARules(result, defaultQuirksStyle);
 
     // If document uses view source styles (in view source mode or in xml viewer mode), then we match rules from the view source style sheet.
     if (m_checker.document()->isViewSource()) {
         if (!defaultViewSourceStyle)
             loadViewSourceStyle();
-        matchRules(defaultViewSourceStyle, result.ranges.firstUARule, result.ranges.lastUARule, false);
+        matchUARules(result, defaultViewSourceStyle);
     }
 }
 
@@ -1528,7 +1554,7 @@ PassRefPtr<RenderStyle> CSSStyleSelector::styleForElement(Element* element, Rend
     else
         matchAllRules(matchResult);
 
-    applyMatchedDeclarations(matchResult);
+    applyMatchedProperties(matchResult);
 
     // Clean up our style object's display and text decorations (among other fixups).
     adjustRenderStyle(style(), m_parentStyle, element);
@@ -1541,8 +1567,9 @@ PassRefPtr<RenderStyle> CSSStyleSelector::styleForElement(Element* element, Rend
 
 PassRefPtr<RenderStyle> CSSStyleSelector::styleForKeyframe(const RenderStyle* elementStyle, const WebKitCSSKeyframeRule* keyframeRule, KeyframeValue& keyframe)
 {
+    MatchResult result;
     if (keyframeRule->declaration())
-        addMatchedDeclaration(keyframeRule->declaration());
+        addMatchedProperties(result, keyframeRule->declaration());
 
     ASSERT(!m_style);
 
@@ -1555,7 +1582,7 @@ PassRefPtr<RenderStyle> CSSStyleSelector::styleForKeyframe(const RenderStyle* el
     // decl, there's nothing to override. So just add the first properties.
     bool inheritedOnly = false;
     if (keyframeRule->style())
-        applyDeclarations<true>(false, 0, m_matchedDecls.size() - 1, inheritedOnly);
+        applyMatchedProperties<true>(result, false, 0, result.matchedProperties.size() - 1, inheritedOnly);
 
     // If our font got dirtied, go ahead and update it now.
     updateFont();
@@ -1566,7 +1593,7 @@ PassRefPtr<RenderStyle> CSSStyleSelector::styleForKeyframe(const RenderStyle* el
 
     // Now do rest of the properties.
     if (keyframeRule->style())
-        applyDeclarations<false>(false, 0, m_matchedDecls.size() - 1, inheritedOnly);
+        applyMatchedProperties<false>(result, false, 0, result.matchedProperties.size() - 1, inheritedOnly);
 
     // If our font got dirtied by one of the non-essential font props,
     // go ahead and update it a second time.
@@ -1672,16 +1699,16 @@ PassRefPtr<RenderStyle> CSSStyleSelector::pseudoStyleForElement(PseudoId pseudo,
     matchUARules(matchResult);
 
     if (m_matchAuthorAndUserStyles) {
-        matchRules(m_userStyle.get(), matchResult.ranges.firstUserRule, matchResult.ranges.lastUserRule, false);
-        matchAuthorRules(matchResult.ranges.firstAuthorRule, matchResult.ranges.lastAuthorRule, false);
+        matchUserRules(matchResult, false);
+        matchAuthorRules(matchResult, false);
     }
 
-    if (m_matchedDecls.isEmpty())
+    if (matchResult.matchedProperties.isEmpty())
         return 0;
 
     m_style->setStyleType(pseudo);
 
-    applyMatchedDeclarations(matchResult);
+    applyMatchedProperties(matchResult);
 
     // Clean up our style object's display and text decorations (among other fixups).
     adjustRenderStyle(style(), parentStyle, 0);
@@ -1708,13 +1735,15 @@ PassRefPtr<RenderStyle> CSSStyleSelector::styleForPage(int pageIndex)
     const bool isLeft = isLeftPage(pageIndex);
     const bool isFirst = isFirstPage(pageIndex);
     const String page = pageName(pageIndex);
-    matchPageRules(defaultPrintStyle, isLeft, isFirst, page);
-    matchPageRules(m_userStyle.get(), isLeft, isFirst, page);
+    
+    MatchResult result;
+    matchPageRules(result, defaultPrintStyle, isLeft, isFirst, page);
+    matchPageRules(result, m_userStyle.get(), isLeft, isFirst, page);
     // Only consider the global author RuleSet for @page rules, as per the HTML5 spec.
-    matchPageRules(m_authorStyle.get(), isLeft, isFirst, page);
+    matchPageRules(result, m_authorStyle.get(), isLeft, isFirst, page);
     m_lineHeightValue = 0;
     bool inheritedOnly = false;
-    applyDeclarations<true>(false, 0, m_matchedDecls.size() - 1, inheritedOnly);
+    applyMatchedProperties<true>(result, false, 0, result.matchedProperties.size() - 1, inheritedOnly);
 
     // If our font got dirtied, go ahead and update it now.
     updateFont();
@@ -1723,7 +1752,7 @@ PassRefPtr<RenderStyle> CSSStyleSelector::styleForPage(int pageIndex)
     if (m_lineHeightValue)
         applyProperty(CSSPropertyLineHeight, m_lineHeightValue);
 
-    applyDeclarations<false>(false, 0, m_matchedDecls.size() - 1, inheritedOnly);
+    applyMatchedProperties<false>(result, false, 0, result.matchedProperties.size() - 1, inheritedOnly);
 
     // Start loading images referenced by this style.
     loadPendingImages();
@@ -1896,7 +1925,12 @@ void CSSStyleSelector::adjustRenderStyle(RenderStyle* style, RenderStyle* parent
     // cases where objects that should be blended as a single unit end up with a non-transparent
     // object wedged in between them.  Auto z-index also becomes 0 for objects that specify transforms/masks/reflections.
     if (style->hasAutoZIndex() && ((e && e->document()->documentElement() == e) || style->opacity() < 1.0f
-        || style->hasTransformRelatedProperty() || style->hasMask() || style->boxReflect() || style->hasFilter()))
+        || style->hasTransformRelatedProperty() || style->hasMask() || style->boxReflect() || style->hasFilter()
+#if ENABLE(OVERFLOW_SCROLLING)
+        // Touch overflow scrolling creates a stacking context.
+        || style->useTouchOverflowScrolling()
+#endif
+        ))
         style->setZIndex(0);
 
     // Textarea considers overflow visible as auto.
@@ -2052,14 +2086,14 @@ PassRefPtr<CSSRuleList> CSSStyleSelector::pseudoStyleRulesForElement(Element* e,
 
         // Now we check user sheet rules.
         if (m_matchAuthorAndUserStyles)
-            matchRules(m_userStyle.get(), dummy.ranges.firstUserRule, dummy.ranges.lastUserRule, rulesToInclude & EmptyCSSRules);
+            matchUserRules(dummy, rulesToInclude & EmptyCSSRules);
     }
 
     if (m_matchAuthorAndUserStyles && (rulesToInclude & AuthorCSSRules)) {
         m_sameOriginOnly = !(rulesToInclude & CrossOriginCSSRules);
 
         // Check the rules in author sheets.
-        matchAuthorRules(dummy.ranges.firstAuthorRule, dummy.ranges.lastAuthorRule, rulesToInclude & EmptyCSSRules);
+        matchAuthorRules(dummy, rulesToInclude & EmptyCSSRules);
 
         m_sameOriginOnly = false;
     }
@@ -2069,7 +2103,7 @@ PassRefPtr<CSSRuleList> CSSStyleSelector::pseudoStyleRulesForElement(Element* e,
     return m_ruleList.release();
 }
 
-inline bool CSSStyleSelector::checkSelector(const RuleData& ruleData)
+inline bool CSSStyleSelector::checkSelector(const RuleData& ruleData, const Element* scope)
 {
     m_dynamicPseudo = NOPSEUDO;
     m_checker.clearHasUnknownPseudoElements();
@@ -2092,7 +2126,10 @@ inline bool CSSStyleSelector::checkSelector(const RuleData& ruleData)
     }
 
     // Slow path.
-    SelectorChecker::SelectorCheckingContext context(ruleData.selector(), m_element, SelectorChecker::VisitedMatchEnabled, style(), m_parentNode ? m_parentNode->renderStyle() : 0);
+    SelectorChecker::SelectorCheckingContext context(ruleData.selector(), m_element, SelectorChecker::VisitedMatchEnabled);
+    context.elementStyle = style();
+    context.elementParentStyle = m_parentNode ? m_parentNode->renderStyle() : 0;
+    context.scope = scope;
     SelectorChecker::SelectorMatch match = m_checker.checkSelector(context, m_dynamicPseudo);
     if (match != SelectorChecker::SelectorMatches)
         return false;
@@ -2173,7 +2210,7 @@ static inline bool selectorListContainsUncommonAttributeSelector(const CSSSelect
 
 static inline bool isCommonAttributeSelectorAttribute(const QualifiedName& attribute)
 {
-    // These are explicitly tested for equality in canShareStyleWithElement.
+    // These are explicitly tested for equality in canShareStyleWithControl.
     return attribute == typeAttr || attribute == readonlyAttr;
 }
 
@@ -2199,12 +2236,12 @@ static inline bool containsUncommonAttributeSelector(const CSSSelector* selector
     return false;
 }
 
-RuleData::RuleData(CSSStyleRule* rule, CSSSelector* selector, unsigned position)
+RuleData::RuleData(CSSStyleRule* rule, CSSSelector* selector, unsigned position, bool canUseFastCheckSelector)
     : m_rule(rule)
     , m_selector(selector)
     , m_specificity(selector->specificity())
     , m_position(position)
-    , m_hasFastCheckableSelector(SelectorChecker::isFastCheckableSelector(selector))
+    , m_hasFastCheckableSelector(canUseFastCheckSelector && SelectorChecker::isFastCheckableSelector(selector))
     , m_hasMultipartSelector(!!selector->tagHistory())
     , m_hasRightmostSelectorMatchingHTMLBasedOnRuleHash(isSelectorMatchingHTMLBasedOnRuleHash(selector))
     , m_containsUncommonAttributeSelector(WebCore::containsUncommonAttributeSelector(selector))
@@ -2273,9 +2310,9 @@ void RuleSet::addToRuleSet(AtomicStringImpl* key, AtomRuleMap& map, const RuleDa
     rules->append(ruleData);
 }
 
-void RuleSet::addRule(CSSStyleRule* rule, CSSSelector* selector)
+void RuleSet::addRule(CSSStyleRule* rule, CSSSelector* selector, bool canUseFastCheckSelector)
 {
-    RuleData ruleData(rule, selector, m_ruleCount++);
+    RuleData ruleData(rule, selector, m_ruleCount++, canUseFastCheckSelector);
     collectFeaturesFromRuleData(m_features, ruleData);
 
     if (selector->m_match == CSSSelector::Id) {
@@ -2315,7 +2352,7 @@ void RuleSet::addRule(CSSStyleRule* rule, CSSSelector* selector)
 
 void RuleSet::addPageRule(CSSPageRule* rule)
 {
-    m_pageRules.append(RuleData(rule, rule->selectorList().first(), m_pageRules.size()));
+    m_pageRules.append(rule);
 }
 
 void RuleSet::addRegionRule(WebKitCSSRegionRule* rule)
@@ -2352,7 +2389,7 @@ void RuleSet::addRulesFromSheet(CSSStyleSheet* sheet, const MediaQueryEvaluator&
     for (int i = 0; i < len; i++) {
         CSSRule* rule = sheet->item(i);
         if (rule->isStyleRule())
-            addStyleRule(static_cast<CSSStyleRule*>(rule));
+            addStyleRule(static_cast<CSSStyleRule*>(rule), !scope);
         else if (rule->isPageRule())
             addPageRule(static_cast<CSSPageRule*>(rule));
         else if (rule->isImportRule()) {
@@ -2369,7 +2406,7 @@ void RuleSet::addRulesFromSheet(CSSStyleSheet* sheet, const MediaQueryEvaluator&
                 for (unsigned j = 0; j < rules->length(); j++) {
                     CSSRule *childItem = rules->item(j);
                     if (childItem->isStyleRule())
-                        addStyleRule(static_cast<CSSStyleRule*>(childItem));
+                        addStyleRule(static_cast<CSSStyleRule*>(childItem), !scope);
                     else if (childItem->isPageRule())
                         addPageRule(static_cast<CSSPageRule*>(childItem));
                     else if (childItem->isFontFaceRule() && styleSelector) {
@@ -2379,7 +2416,7 @@ void RuleSet::addRulesFromSheet(CSSStyleSheet* sheet, const MediaQueryEvaluator&
                             continue;
                         const CSSFontFaceRule* fontFaceRule = static_cast<CSSFontFaceRule*>(childItem);
                         styleSelector->fontSelector()->addFontFaceRule(fontFaceRule);
-                        styleSelector->invalidateMatchedDeclarationCache();
+                        styleSelector->invalidateMatchedPropertiesCache();
                     } else if (childItem->isKeyframesRule() && styleSelector) {
                         // Add this keyframe rule to our set.
                         // FIXME(BUG 72462): We don't add @keyframe rules of scoped style sheets for the moment.
@@ -2396,7 +2433,7 @@ void RuleSet::addRulesFromSheet(CSSStyleSheet* sheet, const MediaQueryEvaluator&
                 continue;
             const CSSFontFaceRule* fontFaceRule = static_cast<CSSFontFaceRule*>(rule);
             styleSelector->fontSelector()->addFontFaceRule(fontFaceRule);
-            styleSelector->invalidateMatchedDeclarationCache();
+            styleSelector->invalidateMatchedPropertiesCache();
         } else if (rule->isKeyframesRule()) {
             // FIXME (BUG 72462): We don't add @keyframe rules of scoped style sheets for the moment.
             if (scope)
@@ -2413,10 +2450,10 @@ void RuleSet::addRulesFromSheet(CSSStyleSheet* sheet, const MediaQueryEvaluator&
         shrinkToFit();
 }
 
-void RuleSet::addStyleRule(CSSStyleRule* rule)
+void RuleSet::addStyleRule(CSSStyleRule* rule, bool canUseFastCheckSelector)
 {
     for (CSSSelector* s = rule->selectorList().first(); s; s = CSSSelectorList::next(s))
-        addRule(rule, s);
+        addRule(rule, s, canUseFastCheckSelector);
 }
 
 static inline void shrinkMapVectorsToFit(RuleSet::AtomRuleMap& map)
@@ -2479,28 +2516,26 @@ static Length convertToFloatLength(CSSPrimitiveValue* primitiveValue, RenderStyl
     return convertToLength(primitiveValue, style, rootStyle, true, multiplier, ok);
 }
 
-static inline bool isInsideRegionRule(StylePropertySet* styleDeclaration)
+static inline bool isInsideRegionRule(CSSRule* rule)
 {
-    ASSERT(styleDeclaration);
-
-    CSSRule* parentRule = styleDeclaration->parentRuleInternal();
-    while (parentRule) {
-        if (parentRule->isRegionRule())
+    // FIXME: Cache this bit somewhere.
+    while (rule) {
+        if (rule->isRegionRule())
             return true;
-        parentRule = parentRule->parentRule();
+        rule = rule->parentRule();
     }
     return false;
 }
 
 template <bool applyFirst>
-void CSSStyleSelector::applyDeclaration(StylePropertySet* styleDeclaration, bool isImportant, bool inheritedOnly)
+void CSSStyleSelector::applyProperties(const StylePropertySet* properties, CSSStyleRule* rule, bool isImportant, bool inheritedOnly)
 {
-    InspectorInstrumentationCookie cookie = InspectorInstrumentation::willProcessRule(document(), styleDeclaration->parentRuleInternal());
-    bool styleDeclarationInsideRegionRule = m_regionForStyling ? isInsideRegionRule(styleDeclaration) : false;
+    InspectorInstrumentationCookie cookie = InspectorInstrumentation::willProcessRule(document(), rule);
+    bool styleDeclarationInsideRegionRule = m_regionForStyling && isInsideRegionRule(rule);
 
-    unsigned propertyCount = styleDeclaration->propertyCount();
+    unsigned propertyCount = properties->propertyCount();
     for (unsigned i = 0; i < propertyCount; ++i) {
-        const CSSProperty& current = styleDeclaration->propertyAt(i);
+        const CSSProperty& current = properties->propertyAt(i);
         if (isImportant != current.isImportant())
             continue;
         if (inheritedOnly && !current.isInherited()) {
@@ -2538,32 +2573,32 @@ void CSSStyleSelector::applyDeclaration(StylePropertySet* styleDeclaration, bool
 }
 
 template <bool applyFirst>
-void CSSStyleSelector::applyDeclarations(bool isImportant, int startIndex, int endIndex, bool inheritedOnly)
+void CSSStyleSelector::applyMatchedProperties(const MatchResult& matchResult, bool isImportant, int startIndex, int endIndex, bool inheritedOnly)
 {
     if (startIndex == -1)
         return;
 
     if (m_style->insideLink() != NotInsideLink) {
         for (int i = startIndex; i <= endIndex; ++i) {
-            StylePropertySet* styleDeclaration = m_matchedDecls[i].styleDeclaration.get();
-            unsigned linkMatchType = m_matchedDecls[i].linkMatchType;
+            unsigned linkMatchType = matchResult.matchedProperties[i].linkMatchType;
             // FIXME: It would be nicer to pass these as arguments but that requires changes in many places.
             m_applyPropertyToRegularStyle = linkMatchType & SelectorChecker::MatchLink;
             m_applyPropertyToVisitedLinkStyle = linkMatchType & SelectorChecker::MatchVisited;
 
-            applyDeclaration<applyFirst>(styleDeclaration, isImportant, inheritedOnly);
+            applyProperties<applyFirst>(matchResult.matchedProperties[i].properties.get(), matchResult.matchedRules[i], isImportant, inheritedOnly);
         }
         m_applyPropertyToRegularStyle = true;
         m_applyPropertyToVisitedLinkStyle = false;
         return;
     }
     for (int i = startIndex; i <= endIndex; ++i)
-        applyDeclaration<applyFirst>(m_matchedDecls[i].styleDeclaration.get(), isImportant, inheritedOnly);
+        applyProperties<applyFirst>(matchResult.matchedProperties[i].properties.get(), matchResult.matchedRules[i], isImportant, inheritedOnly);
 }
 
-unsigned CSSStyleSelector::computeDeclarationHash(MatchedStyleDeclaration* declarations, unsigned size)
+unsigned CSSStyleSelector::computeMatchedPropertiesHash(const MatchedProperties* properties, unsigned size)
 {
-    return StringHasher::hashMemory(declarations, sizeof(MatchedStyleDeclaration) * size);
+    
+    return StringHasher::hashMemory(properties, sizeof(MatchedProperties) * size);
 }
 
 bool operator==(const CSSStyleSelector::MatchRanges& a, const CSSStyleSelector::MatchRanges& b)
@@ -2581,30 +2616,30 @@ bool operator!=(const CSSStyleSelector::MatchRanges& a, const CSSStyleSelector::
     return !(a == b);
 }
 
-bool operator==(const CSSStyleSelector::MatchedStyleDeclaration& a, const CSSStyleSelector::MatchedStyleDeclaration& b)
+bool operator==(const CSSStyleSelector::MatchedProperties& a, const CSSStyleSelector::MatchedProperties& b)
 {
-    return a.styleDeclaration == b.styleDeclaration && a.linkMatchType == b.linkMatchType;
+    return a.properties == b.properties && a.linkMatchType == b.linkMatchType;
 }
 
-bool operator!=(const CSSStyleSelector::MatchedStyleDeclaration& a, const CSSStyleSelector::MatchedStyleDeclaration& b)
+bool operator!=(const CSSStyleSelector::MatchedProperties& a, const CSSStyleSelector::MatchedProperties& b)
 {
     return !(a == b);
 }
 
-const CSSStyleSelector::MatchedStyleDeclarationCacheItem* CSSStyleSelector::findFromMatchedDeclarationCache(unsigned hash, const MatchResult& matchResult)
+const CSSStyleSelector::MatchedPropertiesCacheItem* CSSStyleSelector::findFromMatchedPropertiesCache(unsigned hash, const MatchResult& matchResult)
 {
     ASSERT(hash);
 
-    MatchedStyleDeclarationCache::iterator it = m_matchedStyleDeclarationCache.find(hash);
-    if (it == m_matchedStyleDeclarationCache.end())
+    MatchedPropertiesCache::iterator it = m_matchedPropertiesCache.find(hash);
+    if (it == m_matchedPropertiesCache.end())
         return 0;
-    MatchedStyleDeclarationCacheItem& cacheItem = it->second;
+    MatchedPropertiesCacheItem& cacheItem = it->second;
 
-    size_t size = m_matchedDecls.size();
-    if (size != cacheItem.matchedStyleDeclarations.size())
+    size_t size = matchResult.matchedProperties.size();
+    if (size != cacheItem.matchedProperties.size())
         return 0;
     for (size_t i = 0; i < size; ++i) {
-        if (m_matchedDecls[i] != cacheItem.matchedStyleDeclarations[i])
+        if (matchResult.matchedProperties[i] != cacheItem.matchedProperties[i])
             return 0;
     }
     if (cacheItem.ranges != matchResult.ranges)
@@ -2612,31 +2647,31 @@ const CSSStyleSelector::MatchedStyleDeclarationCacheItem* CSSStyleSelector::find
     return &cacheItem;
 }
 
-void CSSStyleSelector::addToMatchedDeclarationCache(const RenderStyle* style, const RenderStyle* parentStyle, unsigned hash, const MatchResult& matchResult)
+void CSSStyleSelector::addToMatchedPropertiesCache(const RenderStyle* style, const RenderStyle* parentStyle, unsigned hash, const MatchResult& matchResult)
 {
     static unsigned matchedDeclarationCacheAdditionsBetweenSweeps = 100;
-    if (++m_matchedDeclarationCacheAdditionsSinceLastSweep >= matchedDeclarationCacheAdditionsBetweenSweeps) {
-        sweepMatchedDeclarationCache();
-        m_matchedDeclarationCacheAdditionsSinceLastSweep = 0;
+    if (++m_matchedPropertiesCacheAdditionsSinceLastSweep >= matchedDeclarationCacheAdditionsBetweenSweeps) {
+        sweepMatchedPropertiesCache();
+        m_matchedPropertiesCacheAdditionsSinceLastSweep = 0;
     }
 
     ASSERT(hash);
-    MatchedStyleDeclarationCacheItem cacheItem;
-    cacheItem.matchedStyleDeclarations.append(m_matchedDecls);
+    MatchedPropertiesCacheItem cacheItem;
+    cacheItem.matchedProperties.append(matchResult.matchedProperties);
     cacheItem.ranges = matchResult.ranges;
     // Note that we don't cache the original RenderStyle instance. It may be further modified.
     // The RenderStyle in the cache is really just a holder for the substructures and never used as-is.
     cacheItem.renderStyle = RenderStyle::clone(style);
     cacheItem.parentRenderStyle = RenderStyle::clone(parentStyle);
-    m_matchedStyleDeclarationCache.add(hash, cacheItem);
+    m_matchedPropertiesCache.add(hash, cacheItem);
 }
-    
-void CSSStyleSelector::invalidateMatchedDeclarationCache()
+
+void CSSStyleSelector::invalidateMatchedPropertiesCache()
 {
-    m_matchedStyleDeclarationCache.clear();
+    m_matchedPropertiesCache.clear();
 }
 
-static bool isCacheableInMatchedDeclarationCache(const RenderStyle* style, const RenderStyle* parentStyle)
+static bool isCacheableInMatchedPropertiesCache(const RenderStyle* style, const RenderStyle* parentStyle)
 {
     if (style->unique() || (style->styleType() != NOPSEUDO && parentStyle->unique()))
         return false;
@@ -2650,12 +2685,12 @@ static bool isCacheableInMatchedDeclarationCache(const RenderStyle* style, const
     return true;
 }
 
-void CSSStyleSelector::applyMatchedDeclarations(const MatchResult& matchResult)
+void CSSStyleSelector::applyMatchedProperties(const MatchResult& matchResult)
 {
-    unsigned cacheHash = matchResult.isCacheable ? computeDeclarationHash(m_matchedDecls.data(), m_matchedDecls.size()) : 0;
+    unsigned cacheHash = matchResult.isCacheable ? computeMatchedPropertiesHash(matchResult.matchedProperties.data(), matchResult.matchedProperties.size()) : 0;
     bool applyInheritedOnly = false;
-    const MatchedStyleDeclarationCacheItem* cacheItem = 0;
-    if (cacheHash && (cacheItem = findFromMatchedDeclarationCache(cacheHash, matchResult))) {
+    const MatchedPropertiesCacheItem* cacheItem = 0;
+    if (cacheHash && (cacheItem = findFromMatchedPropertiesCache(cacheHash, matchResult))) {
         // We can build up the style by copying non-inherited properties from an earlier style object built using the same exact
         // style declarations. We then only need to apply the inherited properties, if any, as their values can depend on the 
         // element context. This is fast and saves memory by reusing the style data structures.
@@ -2676,10 +2711,10 @@ void CSSStyleSelector::applyMatchedDeclarations(const MatchResult& matchResult)
     // The order is (1) high-priority not important, (2) high-priority important, (3) normal not important
     // and (4) normal important.
     m_lineHeightValue = 0;
-    applyDeclarations<true>(false, 0, m_matchedDecls.size() - 1, applyInheritedOnly);
-    applyDeclarations<true>(true, matchResult.ranges.firstAuthorRule, matchResult.ranges.lastAuthorRule, applyInheritedOnly);
-    applyDeclarations<true>(true, matchResult.ranges.firstUserRule, matchResult.ranges.lastUserRule, applyInheritedOnly);
-    applyDeclarations<true>(true, matchResult.ranges.firstUARule, matchResult.ranges.lastUARule, applyInheritedOnly);
+    applyMatchedProperties<true>(matchResult, false, 0, matchResult.matchedProperties.size() - 1, applyInheritedOnly);
+    applyMatchedProperties<true>(matchResult, true, matchResult.ranges.firstAuthorRule, matchResult.ranges.lastAuthorRule, applyInheritedOnly);
+    applyMatchedProperties<true>(matchResult, true, matchResult.ranges.firstUserRule, matchResult.ranges.lastUserRule, applyInheritedOnly);
+    applyMatchedProperties<true>(matchResult, true, matchResult.ranges.firstUARule, matchResult.ranges.lastUARule, applyInheritedOnly);
 
     if (cacheItem && cacheItem->renderStyle->effectiveZoom() != m_style->effectiveZoom()) {
         m_fontDirty = true;
@@ -2698,16 +2733,16 @@ void CSSStyleSelector::applyMatchedDeclarations(const MatchResult& matchResult)
         applyInheritedOnly = false;
 
     // Now do the normal priority UA properties.
-    applyDeclarations<false>(false, matchResult.ranges.firstUARule, matchResult.ranges.lastUARule, applyInheritedOnly);
+    applyMatchedProperties<false>(matchResult, false, matchResult.ranges.firstUARule, matchResult.ranges.lastUARule, applyInheritedOnly);
     
     // Cache our border and background so that we can examine them later.
     cacheBorderAndBackground();
     
     // Now do the author and user normal priority properties and all the !important properties.
-    applyDeclarations<false>(false, matchResult.ranges.lastUARule + 1, m_matchedDecls.size() - 1, applyInheritedOnly);
-    applyDeclarations<false>(true, matchResult.ranges.firstAuthorRule, matchResult.ranges.lastAuthorRule, applyInheritedOnly);
-    applyDeclarations<false>(true, matchResult.ranges.firstUserRule, matchResult.ranges.lastUserRule, applyInheritedOnly);
-    applyDeclarations<false>(true, matchResult.ranges.firstUARule, matchResult.ranges.lastUARule, applyInheritedOnly);
+    applyMatchedProperties<false>(matchResult, false, matchResult.ranges.lastUARule + 1, matchResult.matchedProperties.size() - 1, applyInheritedOnly);
+    applyMatchedProperties<false>(matchResult, true, matchResult.ranges.firstAuthorRule, matchResult.ranges.lastAuthorRule, applyInheritedOnly);
+    applyMatchedProperties<false>(matchResult, true, matchResult.ranges.firstUserRule, matchResult.ranges.lastUserRule, applyInheritedOnly);
+    applyMatchedProperties<false>(matchResult, true, matchResult.ranges.firstUARule, matchResult.ranges.lastUARule, applyInheritedOnly);
     
     loadPendingImages();
     
@@ -2719,57 +2754,53 @@ void CSSStyleSelector::applyMatchedDeclarations(const MatchResult& matchResult)
     
     if (cacheItem || !cacheHash)
         return;
-    if (!isCacheableInMatchedDeclarationCache(m_style.get(), m_parentStyle))
+    if (!isCacheableInMatchedPropertiesCache(m_style.get(), m_parentStyle))
         return;
-    addToMatchedDeclarationCache(m_style.get(), m_parentStyle, cacheHash, matchResult);
+    addToMatchedPropertiesCache(m_style.get(), m_parentStyle, cacheHash, matchResult);
 }
 
-void CSSStyleSelector::matchPageRules(RuleSet* rules, bool isLeftPage, bool isFirstPage, const String& pageName)
+static inline bool comparePageRules(const CSSPageRule* r1, const CSSPageRule* r2)
 {
-    m_matchedRules.clear();
+    return r1->selector()->specificity() < r2->selector()->specificity();
+}
 
+void CSSStyleSelector::matchPageRules(MatchResult& result, RuleSet* rules, bool isLeftPage, bool isFirstPage, const String& pageName)
+{
     if (!rules)
         return;
 
-    matchPageRulesForList(rules->pageRules(), isLeftPage, isFirstPage, pageName);
-
-    // If we didn't match any rules, we're done.
-    if (m_matchedRules.isEmpty())
+    Vector<CSSPageRule*> matchedPageRules;
+    matchPageRulesForList(matchedPageRules, rules->pageRules(), isLeftPage, isFirstPage, pageName);
+    if (matchedPageRules.isEmpty())
         return;
 
-    // Sort the set of matched rules.
-    sortMatchedRules();
+    std::stable_sort(matchedPageRules.begin(), matchedPageRules.end(), comparePageRules);
 
-    // Now transfer the set of matched rules over to our list of decls.
-    for (unsigned i = 0; i < m_matchedRules.size(); i++)
-        addMatchedDeclaration(m_matchedRules[i]->rule()->declaration());
+    for (unsigned i = 0; i < matchedPageRules.size(); i++)
+        addMatchedProperties(result, matchedPageRules[i]->properties());
 }
 
-void CSSStyleSelector::matchPageRulesForList(const Vector<RuleData>* rules, bool isLeftPage, bool isFirstPage, const String& pageName)
+void CSSStyleSelector::matchPageRulesForList(Vector<CSSPageRule*>& matchedRules, const Vector<CSSPageRule*>& rules, bool isLeftPage, bool isFirstPage, const String& pageName)
 {
-    if (!rules)
-        return;
-
-    unsigned size = rules->size();
+    unsigned size = rules.size();
     for (unsigned i = 0; i < size; ++i) {
-        const RuleData& ruleData = rules->at(i);
-        CSSStyleRule* rule = ruleData.rule();
-        const AtomicString& selectorLocalName = ruleData.selector()->tag().localName();
+        CSSPageRule* rule = rules[i];
+        const AtomicString& selectorLocalName = rule->selector()->tag().localName();
         if (selectorLocalName != starAtom && selectorLocalName != pageName)
             continue;
-        CSSSelector::PseudoType pseudoType = ruleData.selector()->pseudoType();
+        CSSSelector::PseudoType pseudoType = rule->selector()->pseudoType();
         if ((pseudoType == CSSSelector::PseudoLeftPage && !isLeftPage)
             || (pseudoType == CSSSelector::PseudoRightPage && isLeftPage)
             || (pseudoType == CSSSelector::PseudoFirstPage && !isFirstPage))
             continue;
 
         // If the rule has no properties to apply, then ignore it.
-        StylePropertySet* decl = rule->declaration();
-        if (!decl || decl->isEmpty())
+        StylePropertySet* properties = rule->properties();
+        if (!properties || properties->isEmpty())
             continue;
 
         // Add this rule to our list of matched rules.
-        addMatchedRule(&ruleData);
+        matchedRules.append(rule);
     }
 }
 
@@ -2960,72 +2991,6 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
     // RenderStyle values.  Shorthands (e.g. border, background) occur in this list as well and
     // are only hit when mapping "inherit" or "initial" into front-end values.
     switch (property) {
-// ident only properties
-    case CSSPropertyBorderCollapse:
-        HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE(borderCollapse, BorderCollapse)
-        return;
-    case CSSPropertyCaptionSide:
-        HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE(captionSide, CaptionSide)
-        return;
-    case CSSPropertyClear:
-        HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE(clear, Clear)
-        return;
-    case CSSPropertyEmptyCells:
-        HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE(emptyCells, EmptyCells)
-        return;
-    case CSSPropertyFloat:
-        HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE(floating, Floating)
-        return;
-    case CSSPropertyPageBreakBefore:
-        HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE_WITH_VALUE(pageBreakBefore, PageBreakBefore, PageBreak)
-        return;
-    case CSSPropertyPageBreakAfter:
-        HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE_WITH_VALUE(pageBreakAfter, PageBreakAfter, PageBreak)
-        return;
-    case CSSPropertyPageBreakInside:
-        HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE_WITH_VALUE(pageBreakInside, PageBreakInside, PageBreak)
-        return;
-    case CSSPropertyPosition:
-        HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE(position, Position)
-        return;
-    case CSSPropertyTableLayout:
-        HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE(tableLayout, TableLayout)
-        return;
-    case CSSPropertyUnicodeBidi:
-        HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE(unicodeBidi, UnicodeBidi)
-        return;
-    case CSSPropertyTextTransform:
-        HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE(textTransform, TextTransform)
-        return;
-    case CSSPropertyVisibility:
-        HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE(visibility, Visibility)
-        return;
-    case CSSPropertyWhiteSpace:
-        HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE(whiteSpace, WhiteSpace)
-        return;
-// uri || inherit
-    case CSSPropertyWordBreak:
-        HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE(wordBreak, WordBreak)
-        return;
-    case CSSPropertyWordWrap:
-        HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE(wordWrap, WordWrap)
-        return;
-    case CSSPropertyWebkitNbspMode:
-        HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE(nbspMode, NBSPMode)
-        return;
-    case CSSPropertyWebkitLineBreak:
-        HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE(khtmlLineBreak, KHTMLLineBreak)
-        return;
-    case CSSPropertyWebkitMatchNearestMailBlockquoteColor:
-        HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE(matchNearestMailBlockquoteColor, MatchNearestMailBlockquoteColor)
-        return;
-    case CSSPropertyWidows:
-        HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE(widows, Widows)
-        return;
-    case CSSPropertyOrphans:
-        HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE(orphans, Orphans)
-        return;
-
 // lists
     case CSSPropertyContent:
         // list of string, uri, counter, attr, i
@@ -3182,10 +3147,9 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
             CSSPrimitiveValue* contentValue = static_cast<CSSPrimitiveValue*>(item);
             AtomicString face;
             Settings* settings = m_checker.document()->settings();
-            if (contentValue->isString()) {
-                if (contentValue->isFontFamilyValue())
-                    face = static_cast<FontFamilyValue*>(contentValue)->familyName();
-            } else if (settings) {
+            if (contentValue->isString())
+                face = contentValue->getStringValue();
+            else if (settings) {
                 switch (contentValue->getIdent()) {
                     case CSSValueWebkitBody:
                         face = settings->standardFontFamily();
@@ -3328,9 +3292,6 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
         return;
 
     // CSS3 Properties
-    case CSSPropertyWebkitAppearance:
-        HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE(appearance, Appearance)
-        return;
     case CSSPropertyImageRendering:
         HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE(imageRendering, ImageRendering);
         return;
@@ -3403,43 +3364,13 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
         // Clamp opacity to the range 0-1
         m_style->setOpacity(clampTo<float>(primitiveValue->getDoubleValue(), 0, 1));
         return;
-    case CSSPropertyWebkitBoxAlign:
-        HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE(boxAlign, BoxAlign)
-        return;
     case CSSPropertySrc: // Only used in @font-face rules.
         return;
     case CSSPropertyUnicodeRange: // Only used in @font-face rules.
         return;
-    case CSSPropertyWebkitBackfaceVisibility:
-        HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE(backfaceVisibility, BackfaceVisibility)
-        return;
-    case CSSPropertyWebkitBoxDirection:
-        HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE(boxDirection, BoxDirection)
-        return;
-    case CSSPropertyWebkitBoxLines:
-        HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE(boxLines, BoxLines)
-        return;
-    case CSSPropertyWebkitBoxOrient:
-        HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE(boxOrient, BoxOrient)
-        return;
-    case CSSPropertyWebkitBoxPack:
-        HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE(boxPack, BoxPack)
-        return;
-    case CSSPropertyWebkitBoxFlex:
-        HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE(boxFlex, BoxFlex)
-        return;
-    case CSSPropertyWebkitBoxFlexGroup:
-        HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE(boxFlexGroup, BoxFlexGroup)
-        return;
-    case CSSPropertyWebkitBoxOrdinalGroup:
-        HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE(boxOrdinalGroup, BoxOrdinalGroup)
-        return;
     case CSSPropertyBoxSizing:
         HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE(boxSizing, BoxSizing);
         return;
-    case CSSPropertyWebkitColumnSpan:
-        HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE(columnSpan, ColumnSpan)
-        return;
     case CSSPropertyWebkitColumnRuleStyle:
         HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE_WITH_VALUE(columnRuleStyle, ColumnRuleStyle, BorderStyle)
         return;
@@ -3535,25 +3466,6 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
         }
         return;
     }
-    case CSSPropertyWebkitMarqueeStyle:
-        HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE(marqueeBehavior, MarqueeBehavior)
-        return;
-    case CSSPropertyWebkitRegionOverflow:
-        HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE(regionOverflow, RegionOverflow);
-        return;
-    case CSSPropertyWebkitMarqueeDirection:
-        HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE(marqueeDirection, MarqueeDirection)
-        return;
-    case CSSPropertyWebkitUserDrag:
-        HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE(userDrag, UserDrag)
-        return;
-    case CSSPropertyWebkitUserModify:
-        HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE(userModify, UserModify)
-        return;
-    case CSSPropertyWebkitUserSelect:
-        HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE(userSelect, UserSelect)
-        return;
-
     case CSSPropertyTextOverflow: {
         // This property is supported by WinIE, and so we leave off the "-webkit-" in order to
         // work with WinIE-specific pages that use the property.
@@ -3594,10 +3506,6 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
         setTextSizeAdjust(primitiveValue->getIdent() == CSSValueAuto);
         return;
     }
-    case CSSPropertyWebkitTextSecurity:
-        HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE(textSecurity, TextSecurity)
-        return;
-
 #if ENABLE(DASHBOARD_SUPPORT)
     case CSSPropertyWebkitDashboardRegion: {
         HANDLE_INHERIT_AND_INITIAL(dashboardRegions, DashboardRegions)
@@ -3631,9 +3539,6 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
         return;
     }
 #endif
-    case CSSPropertyWebkitRtlOrdering:
-        HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE(rtlOrdering, RTLOrdering)
-        return;
     case CSSPropertyWebkitTextStrokeWidth: {
         HANDLE_INHERIT_AND_INITIAL(textStrokeWidth, TextStrokeWidth)
         float width = 0;
@@ -3663,12 +3568,6 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
         m_style->setTransform(operations);
         return;
     }
-    case CSSPropertyWebkitTransformStyle:
-        HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE(transformStyle3D, TransformStyle3D)
-        return;
-    case CSSPropertyWebkitPrintColorAdjust:
-        HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE(printColorAdjust, PrintColorAdjust);
-        return;
     case CSSPropertyWebkitPerspective: {
         HANDLE_INHERIT_AND_INITIAL(perspective, Perspective)
         if (primitiveValue && primitiveValue->getIdent() == CSSValueNone) {
@@ -3724,6 +3623,15 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
         return;
     }
 #endif
+#if ENABLE(OVERFLOW_SCROLLING)
+    case CSSPropertyWebkitOverflowScrolling: {
+        HANDLE_INHERIT_AND_INITIAL(useTouchOverflowScrolling, UseTouchOverflowScrolling);
+        if (!primitiveValue)
+            break;
+        m_style->setUseTouchOverflowScrolling(primitiveValue->getIdent() == CSSValueTouch);
+        return;
+    }
+#endif
     case CSSPropertyWebkitColorCorrection:
         HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE(colorSpace, ColorSpace);
         return;
@@ -3899,150 +3807,115 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
 #endif
 
     // These properties are implemented in the CSSStyleApplyProperty lookup table.
-    case CSSPropertyColor:
-    case CSSPropertyDirection:
-    case CSSPropertyDisplay:
     case CSSPropertyBackgroundAttachment:
     case CSSPropertyBackgroundClip:
-    case CSSPropertyWebkitBackgroundClip:
-    case CSSPropertyWebkitBackgroundComposite:
-    case CSSPropertyBackgroundOrigin:
-    case CSSPropertyWebkitBackgroundOrigin:
+    case CSSPropertyBackgroundColor:
     case CSSPropertyBackgroundImage:
-    case CSSPropertyWebkitAspectRatio:
+    case CSSPropertyBackgroundOrigin:
+    case CSSPropertyBackgroundPosition:
+    case CSSPropertyBackgroundPositionX:
+    case CSSPropertyBackgroundPositionY:
+    case CSSPropertyBackgroundRepeat:
+    case CSSPropertyBackgroundRepeatX:
+    case CSSPropertyBackgroundRepeatY:
     case CSSPropertyBackgroundSize:
-    case CSSPropertyWebkitBackgroundSize:
-    case CSSPropertyWebkitMaskAttachment:
-    case CSSPropertyWebkitMaskClip:
-    case CSSPropertyWebkitMaskComposite:
-    case CSSPropertyWebkitMaskOrigin:
-    case CSSPropertyWebkitMaskImage:
-    case CSSPropertyWebkitMaskSize:
-    case CSSPropertyBackgroundColor:
+    case CSSPropertyBorder:
+    case CSSPropertyBorderBottom:
     case CSSPropertyBorderBottomColor:
-    case CSSPropertyBorderLeftColor:
-    case CSSPropertyBorderRightColor:
-    case CSSPropertyBorderTopColor:
-    case CSSPropertyBorderTopStyle:
-    case CSSPropertyBorderRightStyle:
+    case CSSPropertyBorderBottomLeftRadius:
+    case CSSPropertyBorderBottomRightRadius:
     case CSSPropertyBorderBottomStyle:
-    case CSSPropertyBorderLeftStyle:
-    case CSSPropertyBorderTopWidth:
-    case CSSPropertyBorderRightWidth:
     case CSSPropertyBorderBottomWidth:
-    case CSSPropertyBorderLeftWidth:
-    case CSSPropertyBorder:
-    case CSSPropertyBorderStyle:
-    case CSSPropertyBorderWidth:
+    case CSSPropertyBorderCollapse:
     case CSSPropertyBorderColor:
     case CSSPropertyBorderImage:
-    case CSSPropertyWebkitBorderImage:
-    case CSSPropertyWebkitMaskBoxImage:
     case CSSPropertyBorderImageOutset:
-    case CSSPropertyWebkitMaskBoxImageOutset:
     case CSSPropertyBorderImageRepeat:
-    case CSSPropertyWebkitMaskBoxImageRepeat:
     case CSSPropertyBorderImageSlice:
-    case CSSPropertyWebkitMaskBoxImageSlice:
-    case CSSPropertyBorderImageWidth:
-    case CSSPropertyWebkitMaskBoxImageWidth:
     case CSSPropertyBorderImageSource:
-    case CSSPropertyWebkitMaskBoxImageSource:
-    case CSSPropertyBorderTop:
-    case CSSPropertyBorderRight:
-    case CSSPropertyBorderBottom:
+    case CSSPropertyBorderImageWidth:
     case CSSPropertyBorderLeft:
+    case CSSPropertyBorderLeftColor:
+    case CSSPropertyBorderLeftStyle:
+    case CSSPropertyBorderLeftWidth:
     case CSSPropertyBorderRadius:
-    case CSSPropertyWebkitBorderRadius:
+    case CSSPropertyBorderRight:
+    case CSSPropertyBorderRightColor:
+    case CSSPropertyBorderRightStyle:
+    case CSSPropertyBorderRightWidth:
+    case CSSPropertyBorderSpacing:
+    case CSSPropertyBorderStyle:
+    case CSSPropertyBorderTop:
+    case CSSPropertyBorderTopColor:
     case CSSPropertyBorderTopLeftRadius:
     case CSSPropertyBorderTopRightRadius:
-    case CSSPropertyBorderBottomLeftRadius:
-    case CSSPropertyBorderBottomRightRadius:
-    case CSSPropertyBorderSpacing:
-    case CSSPropertyWebkitBorderHorizontalSpacing:
-    case CSSPropertyWebkitBorderVerticalSpacing:
+    case CSSPropertyBorderTopStyle:
+    case CSSPropertyBorderTopWidth:
+    case CSSPropertyBorderWidth:
+    case CSSPropertyBottom:
+    case CSSPropertyCaptionSide:
+    case CSSPropertyClear:
     case CSSPropertyClip:
+    case CSSPropertyColor:
     case CSSPropertyCounterIncrement:
     case CSSPropertyCounterReset:
-    case CSSPropertyLetterSpacing:
-    case CSSPropertyWordSpacing:
-    case CSSPropertyWebkitFlexOrder:
-    case CSSPropertyWebkitFlexPack:
-    case CSSPropertyWebkitFlexAlign:
-    case CSSPropertyWebkitFlexItemAlign:
-    case CSSPropertyWebkitFlexDirection:
-    case CSSPropertyWebkitFlexFlow:
-    case CSSPropertyWebkitFlexWrap:
+    case CSSPropertyCursor:
+    case CSSPropertyDirection:
+    case CSSPropertyDisplay:
+    case CSSPropertyEmptyCells:
+    case CSSPropertyFloat:
     case CSSPropertyFontSize:
     case CSSPropertyFontStyle:
     case CSSPropertyFontVariant:
-    case CSSPropertyTextRendering:
-    case CSSPropertyWebkitTextOrientation:
-    case CSSPropertyWebkitFontSmoothing:
     case CSSPropertyFontWeight:
-    case CSSPropertyOutline:
-    case CSSPropertyOutlineStyle:
-    case CSSPropertyOutlineWidth:
-    case CSSPropertyOutlineOffset:
-    case CSSPropertyWebkitColumnRuleWidth:
-    case CSSPropertyOutlineColor:
-    case CSSPropertyWebkitColumnRuleColor:
-    case CSSPropertyWebkitTextEmphasisColor:
-    case CSSPropertyWebkitTextFillColor:
-    case CSSPropertyWebkitTextStrokeColor:
-    case CSSPropertyBackgroundPosition:
-    case CSSPropertyBackgroundPositionX:
-    case CSSPropertyBackgroundPositionY:
-    case CSSPropertyWebkitMaskPosition:
-    case CSSPropertyWebkitMaskPositionX:
-    case CSSPropertyWebkitMaskPositionY:
-    case CSSPropertyBackgroundRepeat:
-    case CSSPropertyBackgroundRepeatX:
-    case CSSPropertyBackgroundRepeatY:
-    case CSSPropertyWebkitMaskRepeat:
-    case CSSPropertyWebkitMaskRepeatX:
-    case CSSPropertyWebkitMaskRepeatY:
-    case CSSPropertyOverflow:
-    case CSSPropertyOverflowX:
-    case CSSPropertyOverflowY:
-    case CSSPropertyMaxWidth:
-    case CSSPropertyTop:
+    case CSSPropertyHeight:
     case CSSPropertyLeft:
-    case CSSPropertyRight:
-    case CSSPropertyBottom:
-    case CSSPropertyWidth:
-    case CSSPropertyMinWidth:
+    case CSSPropertyLetterSpacing:
     case CSSPropertyLineHeight:
     case CSSPropertyListStyle:
     case CSSPropertyListStyleImage:
     case CSSPropertyListStylePosition:
     case CSSPropertyListStyleType:
-    case CSSPropertyMarginTop:
-    case CSSPropertyMarginRight:
+    case CSSPropertyMargin:
     case CSSPropertyMarginBottom:
     case CSSPropertyMarginLeft:
-    case CSSPropertyMargin:
-    case CSSPropertyPaddingTop:
-    case CSSPropertyPaddingRight:
+    case CSSPropertyMarginRight:
+    case CSSPropertyMarginTop:
+    case CSSPropertyMaxHeight:
+    case CSSPropertyMaxWidth:
+    case CSSPropertyMinHeight:
+    case CSSPropertyMinWidth:
+    case CSSPropertyOrphans:
+    case CSSPropertyOutline:
+    case CSSPropertyOutlineColor:
+    case CSSPropertyOutlineOffset:
+    case CSSPropertyOutlineStyle:
+    case CSSPropertyOutlineWidth:
+    case CSSPropertyOverflow:
+    case CSSPropertyOverflowX:
+    case CSSPropertyOverflowY:
+    case CSSPropertyPadding:
     case CSSPropertyPaddingBottom:
     case CSSPropertyPaddingLeft:
-    case CSSPropertyPadding:
+    case CSSPropertyPaddingRight:
+    case CSSPropertyPaddingTop:
+    case CSSPropertyPageBreakAfter:
+    case CSSPropertyPageBreakBefore:
+    case CSSPropertyPageBreakInside:
+    case CSSPropertyPosition:
     case CSSPropertyResize:
+    case CSSPropertyRight:
     case CSSPropertySize:
+    case CSSPropertyTableLayout:
     case CSSPropertyTextAlign:
     case CSSPropertyTextDecoration:
     case CSSPropertyTextIndent:
-    case CSSPropertyMaxHeight:
-    case CSSPropertyHeight:
-    case CSSPropertyMinHeight:
+    case CSSPropertyTextRendering:
+    case CSSPropertyTextTransform:
+    case CSSPropertyTop:
+    case CSSPropertyUnicodeBidi:
     case CSSPropertyVerticalAlign:
-    case CSSPropertyWebkitTransformOriginX:
-    case CSSPropertyWebkitTransformOriginY:
-    case CSSPropertyWebkitTransformOriginZ:
-    case CSSPropertyWebkitTransformOrigin:
-    case CSSPropertyWebkitPerspectiveOriginX:
-    case CSSPropertyWebkitPerspectiveOriginY:
-    case CSSPropertyWebkitPerspectiveOrigin:
+    case CSSPropertyVisibility:
     case CSSPropertyWebkitAnimationDelay:
     case CSSPropertyWebkitAnimationDirection:
     case CSSPropertyWebkitAnimationDuration:
@@ -4051,34 +3924,112 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
     case CSSPropertyWebkitAnimationName:
     case CSSPropertyWebkitAnimationPlayState:
     case CSSPropertyWebkitAnimationTimingFunction:
-    case CSSPropertyWebkitTransitionDelay:
-    case CSSPropertyWebkitTransitionDuration:
-    case CSSPropertyWebkitTransitionProperty:
-    case CSSPropertyWebkitTransitionTimingFunction:
-    case CSSPropertyCursor:
-    case CSSPropertyWebkitColumns:
+    case CSSPropertyWebkitAppearance:
+    case CSSPropertyWebkitAspectRatio:
+    case CSSPropertyWebkitBackfaceVisibility:
+    case CSSPropertyWebkitBackgroundClip:
+    case CSSPropertyWebkitBackgroundComposite:
+    case CSSPropertyWebkitBackgroundOrigin:
+    case CSSPropertyWebkitBackgroundSize:
+    case CSSPropertyWebkitBorderHorizontalSpacing:
+    case CSSPropertyWebkitBorderImage:
+    case CSSPropertyWebkitBorderRadius:
+    case CSSPropertyWebkitBorderVerticalSpacing:
+    case CSSPropertyWebkitBoxAlign:
+    case CSSPropertyWebkitBoxDirection:
+    case CSSPropertyWebkitBoxFlex:
+    case CSSPropertyWebkitBoxFlexGroup:
+    case CSSPropertyWebkitBoxLines:
+    case CSSPropertyWebkitBoxOrdinalGroup:
+    case CSSPropertyWebkitBoxOrient:
+    case CSSPropertyWebkitBoxPack:
     case CSSPropertyWebkitColumnCount:
     case CSSPropertyWebkitColumnGap:
+    case CSSPropertyWebkitColumnRuleColor:
+    case CSSPropertyWebkitColumnRuleWidth:
+    case CSSPropertyWebkitColumns:
+    case CSSPropertyWebkitColumnSpan:
     case CSSPropertyWebkitColumnWidth:
-    case CSSPropertyWebkitFlowInto:
+    case CSSPropertyWebkitFlexAlign:
+    case CSSPropertyWebkitFlexDirection:
+    case CSSPropertyWebkitFlexFlow:
+    case CSSPropertyWebkitFlexItemAlign:
+    case CSSPropertyWebkitFlexOrder:
+    case CSSPropertyWebkitFlexPack:
+    case CSSPropertyWebkitFlexWrap:
     case CSSPropertyWebkitFlowFrom:
+    case CSSPropertyWebkitFlowInto:
     case CSSPropertyWebkitFontKerning:
+    case CSSPropertyWebkitFontSmoothing:
     case CSSPropertyWebkitFontVariantLigatures:
     case CSSPropertyWebkitHighlight:
     case CSSPropertyWebkitHyphenateCharacter:
     case CSSPropertyWebkitHyphenateLimitAfter:
     case CSSPropertyWebkitHyphenateLimitBefore:
     case CSSPropertyWebkitHyphenateLimitLines:
+    case CSSPropertyWebkitLineAlign:
+    case CSSPropertyWebkitLineBreak:
     case CSSPropertyWebkitLineGrid:
-    case CSSPropertyWebkitLineGridSnap:
+    case CSSPropertyWebkitLineSnap:
+    case CSSPropertyWebkitMarqueeDirection:
+    case CSSPropertyWebkitMarqueeStyle:
+    case CSSPropertyWebkitMaskAttachment:
+    case CSSPropertyWebkitMaskBoxImage:
+    case CSSPropertyWebkitMaskBoxImageOutset:
+    case CSSPropertyWebkitMaskBoxImageRepeat:
+    case CSSPropertyWebkitMaskBoxImageSlice:
+    case CSSPropertyWebkitMaskBoxImageSource:
+    case CSSPropertyWebkitMaskBoxImageWidth:
+    case CSSPropertyWebkitMaskClip:
+    case CSSPropertyWebkitMaskComposite:
+    case CSSPropertyWebkitMaskImage:
+    case CSSPropertyWebkitMaskOrigin:
+    case CSSPropertyWebkitMaskPosition:
+    case CSSPropertyWebkitMaskPositionX:
+    case CSSPropertyWebkitMaskPositionY:
+    case CSSPropertyWebkitMaskRepeat:
+    case CSSPropertyWebkitMaskRepeatX:
+    case CSSPropertyWebkitMaskRepeatY:
+    case CSSPropertyWebkitMaskSize:
+    case CSSPropertyWebkitMatchNearestMailBlockquoteColor:
+    case CSSPropertyWebkitNbspMode:
+    case CSSPropertyWebkitPerspectiveOrigin:
+    case CSSPropertyWebkitPerspectiveOriginX:
+    case CSSPropertyWebkitPerspectiveOriginY:
+    case CSSPropertyWebkitPrintColorAdjust:
+    case CSSPropertyWebkitRegionOverflow:
+    case CSSPropertyWebkitRtlOrdering:
     case CSSPropertyWebkitTextCombine:
+    case CSSPropertyWebkitTextEmphasisColor:
     case CSSPropertyWebkitTextEmphasisPosition:
     case CSSPropertyWebkitTextEmphasisStyle:
+    case CSSPropertyWebkitTextFillColor:
+    case CSSPropertyWebkitTextOrientation:
+    case CSSPropertyWebkitTextSecurity:
+    case CSSPropertyWebkitTextStrokeColor:
+    case CSSPropertyWebkitTransformOrigin:
+    case CSSPropertyWebkitTransformOriginX:
+    case CSSPropertyWebkitTransformOriginY:
+    case CSSPropertyWebkitTransformOriginZ:
+    case CSSPropertyWebkitTransformStyle:
+    case CSSPropertyWebkitTransitionDelay:
+    case CSSPropertyWebkitTransitionDuration:
+    case CSSPropertyWebkitTransitionProperty:
+    case CSSPropertyWebkitTransitionTimingFunction:
+    case CSSPropertyWebkitUserDrag:
+    case CSSPropertyWebkitUserModify:
+    case CSSPropertyWebkitUserSelect:
+    case CSSPropertyWebkitWrap:
+    case CSSPropertyWebkitWrapFlow:
     case CSSPropertyWebkitWrapMargin:
     case CSSPropertyWebkitWrapPadding:
-    case CSSPropertyWebkitWrapFlow:
     case CSSPropertyWebkitWrapThrough:
-    case CSSPropertyWebkitWrap:
+    case CSSPropertyWhiteSpace:
+    case CSSPropertyWidows:
+    case CSSPropertyWidth:
+    case CSSPropertyWordBreak:
+    case CSSPropertyWordSpacing:
+    case CSSPropertyWordWrap:
     case CSSPropertyZIndex:
     case CSSPropertyZoom:
         ASSERT_NOT_REACHED();
diff --git a/Source/WebCore/css/CSSStyleSelector.h b/Source/WebCore/css/CSSStyleSelector.h
index 844235ae6..4db7f226d 100644
--- a/Source/WebCore/css/CSSStyleSelector.h
+++ b/Source/WebCore/css/CSSStyleSelector.h
@@ -106,10 +106,6 @@ public:
                      bool strictParsing, bool matchAuthorAndUserStyles);
     ~CSSStyleSelector();
 
-#if ENABLE(STYLE_SCOPED)
-    static Element* determineScopingElement(const CSSStyleSheet*);
-#endif
-
     // Using these during tree walk will allow style selector to optimize child and descendant selector lookups.
     void pushParent(Element* parent);
     void popParent(Element* parent);
@@ -217,7 +213,7 @@ public:
 
     static bool createTransformOperations(CSSValue* inValue, RenderStyle* inStyle, RenderStyle* rootStyle, TransformOperations& outOperations);
     
-    void invalidateMatchedDeclarationCache();
+    void invalidateMatchedPropertiesCache();
 
 #if ENABLE(CSS_FILTERS)
     bool createFilterOperations(CSSValue* inValue, RenderStyle* inStyle, RenderStyle* rootStyle, FilterOperations& outOperations);
@@ -259,7 +255,6 @@ private:
     void adjustRenderStyle(RenderStyle* styleToAdjust, RenderStyle* parentStyle, Element*);
 
     void addMatchedRule(const RuleData* rule) { m_matchedRules.append(rule); }
-    void addMatchedDeclaration(StylePropertySet*, unsigned linkMatchType = SelectorChecker::MatchAll);
 
     struct MatchRanges {
         MatchRanges() : firstUARule(-1), lastUARule(-1), firstAuthorRule(-1), lastAuthorRule(-1), firstUserRule(-1), lastUserRule(-1) { }
@@ -271,35 +266,58 @@ private:
         int lastUserRule;
     };
 
+    struct MatchedProperties {
+        MatchedProperties() : possiblyPaddedMember(0) { }
+        
+        RefPtr<StylePropertySet> properties;
+        union {
+            unsigned linkMatchType;
+            // Used to make sure all memory is zero-initialized since we compute the hash over the bytes of this object.
+            void* possiblyPaddedMember;
+        };
+    };
+
     struct MatchResult {
         MatchResult() : isCacheable(true) { }
+        Vector<MatchedProperties, 64> matchedProperties;
+        Vector<CSSStyleRule*, 64> matchedRules;
         MatchRanges ranges;
         bool isCacheable;
     };
+
+    struct MatchOptions {
+        MatchOptions(bool includeEmptyRules, const Element* scope = 0) : scope(scope), includeEmptyRules(includeEmptyRules) { }
+        const Element* scope;
+        bool includeEmptyRules;
+    };
+
+    static void addMatchedProperties(MatchResult& matchResult, StylePropertySet* properties, CSSStyleRule* rule = 0, unsigned linkMatchType =  SelectorChecker::MatchAll);
+
     void matchAllRules(MatchResult&);
     void matchUARules(MatchResult&);
-    void matchRules(RuleSet*, int& firstRuleIndex, int& lastRuleIndex, bool includeEmptyRules);
-    void matchAuthorRules(int& firstRuleIndex, int& lastRuleIndex, bool includeEmptyRules);
-    void matchScopedAuthorRules(int& firstRuleIndex, int& lastRuleIndex, bool includeEmptyRules);
-    void collectMatchingRules(RuleSet*, int& firstRuleIndex, int& lastRuleIndex, bool includeEmptyRules);
-    void collectMatchingRulesForRegion(RuleSet*, int& firstRuleIndex, int& lastRuleIndex, bool includeEmptyRules);
-    void collectMatchingRulesForList(const Vector<RuleData>*, int& firstRuleIndex, int& lastRuleIndex, bool includeEmptyRules);
+    void matchUARules(MatchResult&, RuleSet*);
+    void matchAuthorRules(MatchResult&, bool includeEmptyRules);
+    void matchUserRules(MatchResult&, bool includeEmptyRules);
+    void matchScopedAuthorRules(MatchResult&, bool includeEmptyRules);
+    void collectMatchingRules(RuleSet*, int& firstRuleIndex, int& lastRuleIndex, const MatchOptions&);
+    void collectMatchingRulesForRegion(RuleSet*, int& firstRuleIndex, int& lastRuleIndex, const MatchOptions&);
+    void collectMatchingRulesForList(const Vector<RuleData>*, int& firstRuleIndex, int& lastRuleIndex, const MatchOptions&);
     bool fastRejectSelector(const RuleData&) const;
     void sortMatchedRules();
-    void sortAndTransferMatchedRules();
+    void sortAndTransferMatchedRules(MatchResult&);
 
-    bool checkSelector(const RuleData&);
+    bool checkSelector(const RuleData&, const Element* scope = 0);
     bool checkRegionSelector(CSSSelector* regionSelector, Element* regionElement);
-    void applyMatchedDeclarations(const MatchResult&);
+    void applyMatchedProperties(const MatchResult&);
     template <bool firstPass>
-    void applyDeclarations(bool important, int startIndex, int endIndex, bool inheritedOnly);
+    void applyMatchedProperties(const MatchResult&, bool important, int startIndex, int endIndex, bool inheritedOnly);
     template <bool firstPass>
-    void applyDeclaration(StylePropertySet*, bool isImportant, bool inheritedOnly);
+    void applyProperties(const StylePropertySet* properties, CSSStyleRule*, bool isImportant, bool inheritedOnly);
 
     static bool isValidRegionStyleProperty(int id);
 
-    void matchPageRules(RuleSet*, bool isLeftPage, bool isFirstPage, const String& pageName);
-    void matchPageRulesForList(const Vector<RuleData>*, bool isLeftPage, bool isFirstPage, const String& pageName);
+    void matchPageRules(MatchResult&, RuleSet*, bool isLeftPage, bool isFirstPage, const String& pageName);
+    void matchPageRulesForList(Vector<CSSPageRule*>& matchedRules, const Vector<CSSPageRule*>&, bool isLeftPage, bool isFirstPage, const String& pageName);
     bool isLeftPage(int pageIndex) const;
     bool isRightPage(int pageIndex) const { return !isLeftPage(pageIndex); }
     bool isFirstPage(int pageIndex) const;
@@ -372,39 +390,24 @@ private:
     PassRefPtr<StyleImage> loadPendingImage(StylePendingImage*);
     void loadPendingImages();
 
-    struct MatchedStyleDeclaration {
-        MatchedStyleDeclaration() : possiblyPaddedMember(0) { }
-
-        RefPtr<StylePropertySet> styleDeclaration;
-        union {
-            unsigned linkMatchType;
-            // Used to make sure all memory is zero-initialized since we compute the hash over the bytes of this object.
-            void* possiblyPaddedMember;
-        };
-    };
-    static unsigned computeDeclarationHash(MatchedStyleDeclaration*, unsigned size);
-    struct MatchedStyleDeclarationCacheItem {
-        Vector<MatchedStyleDeclaration> matchedStyleDeclarations;
+    static unsigned computeMatchedPropertiesHash(const MatchedProperties*, unsigned size);
+    struct MatchedPropertiesCacheItem {
+        Vector<MatchedProperties> matchedProperties;
         MatchRanges ranges;
         RefPtr<RenderStyle> renderStyle;
         RefPtr<RenderStyle> parentRenderStyle;
     };
-    const MatchedStyleDeclarationCacheItem* findFromMatchedDeclarationCache(unsigned hash, const MatchResult&);
-    void addToMatchedDeclarationCache(const RenderStyle*, const RenderStyle* parentStyle, unsigned hash, const MatchResult&);
+    const MatchedPropertiesCacheItem* findFromMatchedPropertiesCache(unsigned hash, const MatchResult&);
+    void addToMatchedPropertiesCache(const RenderStyle*, const RenderStyle* parentStyle, unsigned hash, const MatchResult&);
 
     // Every N additions to the matched declaration cache trigger a sweep where entries holding
     // the last reference to a style declaration are garbage collected.
-    void sweepMatchedDeclarationCache();
+    void sweepMatchedPropertiesCache();
 
-    // We collect the set of decls that match in |m_matchedDecls|. We then walk the
-    // set of matched decls four times, once for those properties that others depend on (like font-size),
-    // and then a second time for all the remaining properties. We then do the same two passes
-    // for any !important rules.
-    Vector<MatchedStyleDeclaration, 64> m_matchedDecls;
-    unsigned m_matchedDeclarationCacheAdditionsSinceLastSweep;
+    unsigned m_matchedPropertiesCacheAdditionsSinceLastSweep;
 
-    typedef HashMap<unsigned, MatchedStyleDeclarationCacheItem> MatchedStyleDeclarationCache;
-    MatchedStyleDeclarationCache m_matchedStyleDeclarationCache;
+    typedef HashMap<unsigned, MatchedPropertiesCacheItem> MatchedPropertiesCache;
+    MatchedPropertiesCache m_matchedPropertiesCache;
 
     // A buffer used to hold the set of matched rules for an element, and a temporary buffer used for
     // merge sorting.
@@ -446,6 +449,8 @@ private:
 #endif
 
 #if ENABLE(STYLE_SCOPED)
+    static const Element* determineScopingElement(const CSSStyleSheet*);
+
     typedef HashMap<const Element*, OwnPtr<RuleSet> > ScopedRuleSetMap;
 
     RuleSet* scopedRuleSetForElement(const Element*) const;
@@ -470,8 +475,8 @@ private:
 #endif
 
     friend class CSSStyleApplyProperty;
-    friend bool operator==(const MatchedStyleDeclaration&, const MatchedStyleDeclaration&);
-    friend bool operator!=(const MatchedStyleDeclaration&, const MatchedStyleDeclaration&);
+    friend bool operator==(const MatchedProperties&, const MatchedProperties&);
+    friend bool operator!=(const MatchedProperties&, const MatchedProperties&);
     friend bool operator==(const MatchRanges&, const MatchRanges&);
     friend bool operator!=(const MatchRanges&, const MatchRanges&);
 };
diff --git a/Source/WebCore/css/CSSStyleSheet.idl b/Source/WebCore/css/CSSStyleSheet.idl
index e2514f027..962c9dbdc 100644
--- a/Source/WebCore/css/CSSStyleSheet.idl
+++ b/Source/WebCore/css/CSSStyleSheet.idl
@@ -21,24 +21,26 @@
 module css {
 
     // Introduced in DOM Level 2:
-    interface CSSStyleSheet : StyleSheet {
+    interface [
+        V8CustomToJSObject
+    ] CSSStyleSheet : StyleSheet {
         readonly attribute CSSRule          ownerRule;
         readonly attribute CSSRuleList      cssRules;
 
-        [ObjCLegacyUnnamedParameters] unsigned long insertRule(in [Optional=CallWithDefaultValue] DOMString rule, 
-                                                in [Optional=CallWithDefaultValue] unsigned long index)
+        [ObjCLegacyUnnamedParameters] unsigned long insertRule(in [Optional=DefaultIsUndefined] DOMString rule, 
+                                                in [Optional=DefaultIsUndefined] unsigned long index)
             raises(DOMException);
-        void               deleteRule(in [Optional=CallWithDefaultValue] unsigned long index)
+        void               deleteRule(in [Optional=DefaultIsUndefined] unsigned long index)
             raises(DOMException);
 
         // IE Extensions
         readonly attribute CSSRuleList      rules;
 
-        long addRule(in [Optional=CallWithDefaultValue] DOMString selector,
-                     in [Optional=CallWithDefaultValue] DOMString style,
+        long addRule(in [Optional=DefaultIsUndefined] DOMString selector,
+                     in [Optional=DefaultIsUndefined] DOMString style,
                      in [Optional] unsigned long index)
             raises(DOMException);
-        void removeRule(in [Optional=CallWithDefaultValue] unsigned long index)
+        void removeRule(in [Optional=DefaultIsUndefined] unsigned long index)
             raises(DOMException);
     };
 
diff --git a/Source/WebCore/css/CSSValue.cpp b/Source/WebCore/css/CSSValue.cpp
index 016cb0bba..aea4ee4fd 100644
--- a/Source/WebCore/css/CSSValue.cpp
+++ b/Source/WebCore/css/CSSValue.cpp
@@ -48,7 +48,6 @@
 #include "CSSUnicodeRangeValue.h"
 #include "CSSValueList.h"
 #include "FontValue.h"
-#include "FontFamilyValue.h"
 #include "FontFeatureValue.h"
 #include "ShadowValue.h"
 #include "SVGColor.h"
@@ -110,8 +109,6 @@ String CSSValue::cssText() const
         return static_cast<const FontValue*>(this)->customCssText();
     case FontFaceSrcClass:
         return static_cast<const CSSFontFaceSrcValue*>(this)->customCssText();
-    case FontFamilyClass:
-        return static_cast<const FontFamilyValue*>(this)->customCssText();
     case FontFeatureClass:
         return static_cast<const FontFeatureValue*>(this)->customCssText();
     case FunctionClass:
@@ -192,9 +189,6 @@ void CSSValue::destroy()
     case FontFaceSrcClass:
         delete static_cast<CSSFontFaceSrcValue*>(this);
         return;
-    case FontFamilyClass:
-        delete static_cast<FontFamilyValue*>(this);
-        return;
     case FontFeatureClass:
         delete static_cast<FontFeatureValue*>(this);
         return;
diff --git a/Source/WebCore/css/CSSValue.h b/Source/WebCore/css/CSSValue.h
index 61233212b..66a5943e0 100644
--- a/Source/WebCore/css/CSSValue.h
+++ b/Source/WebCore/css/CSSValue.h
@@ -62,7 +62,6 @@ public:
     bool isAspectRatioValue() const { return m_classType == AspectRatioClass; }
     bool isBorderImageSliceValue() const { return m_classType == BorderImageSliceClass; }
     bool isCursorImageValue() const { return m_classType == CursorImageClass; }
-    bool isFontFamilyValue() const { return m_classType == FontFamilyClass; }
     bool isFontFeatureValue() const { return m_classType == FontFeatureClass; }
     bool isFontValue() const { return m_classType == FontClass; }
     bool isImageGeneratorValue() const { return m_classType >= CanvasClass && m_classType <= RadialGradientClass; }
@@ -97,7 +96,6 @@ protected:
         // Primitive class types must appear before PrimitiveClass.
         ImageClass,
         CursorImageClass,
-        FontFamilyClass,
         PrimitiveClass,
 
         // Image generator classes.
diff --git a/Source/WebCore/css/CSSValue.idl b/Source/WebCore/css/CSSValue.idl
index c46267321..2b0ceb31f 100644
--- a/Source/WebCore/css/CSSValue.idl
+++ b/Source/WebCore/css/CSSValue.idl
@@ -21,7 +21,7 @@
 module css {
 
     interface [
-        JSCustomToJS,
+        CustomToJSObject,
         JSCustomIsReachable,
         JSCustomFinalize,
         ObjCPolymorphic,
@@ -34,7 +34,7 @@ module css {
         const unsigned short CSS_VALUE_LIST      = 2;
         const unsigned short CSS_CUSTOM          = 3;
 
-                 attribute [ConvertNullStringTo=Null, TreatNullAs=NullString] DOMString cssText
+                 attribute [TreatReturnedNullStringAs=Null, TreatNullAs=NullString] DOMString cssText
                      setter raises(DOMException);
 
         readonly attribute unsigned short cssValueType;
diff --git a/Source/WebCore/css/CSSValueKeywords.in b/Source/WebCore/css/CSSValueKeywords.in
index dd5c27c83..d299391d8 100644
--- a/Source/WebCore/css/CSSValueKeywords.in
+++ b/Source/WebCore/css/CSSValueKeywords.in
@@ -501,7 +501,7 @@ row
 row-reverse
 column
 column-reverse
-// nowrap
+// none
 // wrap
 wrap-reverse
 
@@ -802,6 +802,12 @@ no-limit
 manual
 // auto
 
+#if defined(ENABLE_OVERFLOW_SCROLLING)
+// -webkit-overflow-scrolling
+// auto
+touch
+#endif
+
 // -webkit-writing-mode
 // SVG compatibility
 lr
@@ -882,6 +888,9 @@ maximum
 wrap
 // none
 
+// -webkit-line-align
+edges
+
 #if defined(ENABLE_CSS_FILTERS) && ENABLE_CSS_FILTERS
 // -webkit-filter
 #if defined(ENABLE_CSS_SHADERS) && ENABLE_CSS_SHADERS
diff --git a/Source/WebCore/css/CSSValueList.idl b/Source/WebCore/css/CSSValueList.idl
index 0a4051b7a..23e27ec16 100644
--- a/Source/WebCore/css/CSSValueList.idl
+++ b/Source/WebCore/css/CSSValueList.idl
@@ -30,7 +30,7 @@ module css {
         IndexedGetter
     ] CSSValueList : CSSValue {
         readonly attribute unsigned long    length;
-        CSSValue           item(in [Optional=CallWithDefaultValue] unsigned long index);
+        CSSValue           item(in [Optional=DefaultIsUndefined] unsigned long index);
     };
 
 }
diff --git a/Source/WebCore/css/CSSValuePool.cpp b/Source/WebCore/css/CSSValuePool.cpp
index 3d8893ea8..c46c7047c 100644
--- a/Source/WebCore/css/CSSValuePool.cpp
+++ b/Source/WebCore/css/CSSValuePool.cpp
@@ -25,7 +25,10 @@
 
 #include "config.h"
 #include "CSSValuePool.h"
+
+#include "CSSParser.h"
 #include "CSSValueKeywords.h"
+#include "CSSValueList.h"
 
 namespace WebCore {
 
@@ -120,4 +123,25 @@ PassRefPtr<CSSPrimitiveValue> CSSValuePool::createValue(double value, CSSPrimiti
     return entry.first->second;
 }
 
+PassRefPtr<CSSPrimitiveValue> CSSValuePool::createFontFamilyValue(const String& familyName)
+{
+    RefPtr<CSSPrimitiveValue>& value = m_fontFamilyValueCache.add(familyName, 0).first->second;
+    if (!value)
+        value = CSSPrimitiveValue::create(familyName, CSSPrimitiveValue::CSS_STRING);
+    return value;
+}
+
+PassRefPtr<CSSValueList> CSSValuePool::createFontFaceValue(const AtomicString& string, CSSStyleSheet* contextStyleSheet)
+{
+    // Just wipe out the cache and start rebuilding if it gets too big.
+    const int maximumFontFaceCacheSize = 128;
+    if (m_fontFaceValueCache.size() > maximumFontFaceCacheSize)
+        m_fontFaceValueCache.clear();
+
+    RefPtr<CSSValueList>& value = m_fontFaceValueCache.add(string, 0).first->second;
+    if (!value)
+        value = CSSParser::parseFontFaceValue(string, contextStyleSheet);
+    return value;
+}
+
 }
diff --git a/Source/WebCore/css/CSSValuePool.h b/Source/WebCore/css/CSSValuePool.h
index bc751ebf7..ade9fe066 100644
--- a/Source/WebCore/css/CSSValuePool.h
+++ b/Source/WebCore/css/CSSValuePool.h
@@ -29,16 +29,21 @@
 #include "CSSInheritedValue.h"
 #include "CSSInitialValue.h"
 #include "CSSPrimitiveValue.h"
+#include <wtf/text/AtomicStringHash.h>
 #include <wtf/HashMap.h>
 #include <wtf/RefPtr.h>
 
 namespace WebCore {
 
+class CSSValueList;
+
 class CSSValuePool : public RefCounted<CSSValuePool> {
 public:
     static PassRefPtr<CSSValuePool> create() { return adoptRef(new CSSValuePool); }
     ~CSSValuePool();
 
+    PassRefPtr<CSSValueList> createFontFaceValue(const AtomicString&, CSSStyleSheet* contextStyleSheet);
+    PassRefPtr<CSSPrimitiveValue> createFontFamilyValue(const String&);
     PassRefPtr<CSSInheritedValue> createInheritedValue() { return m_inheritedValue; }
     PassRefPtr<CSSInitialValue> createImplicitInitialValue() { return m_implicitInitialValue; }
     PassRefPtr<CSSInitialValue> createExplicitInitialValue() { return m_explicitInitialValue; }
@@ -71,6 +76,12 @@ private:
     IntegerValueCache m_pixelValueCache;
     IntegerValueCache m_percentValueCache;
     IntegerValueCache m_numberValueCache;
+
+    typedef HashMap<AtomicString, RefPtr<CSSValueList> > FontFaceValueCache;
+    FontFaceValueCache m_fontFaceValueCache;
+
+    typedef HashMap<String, RefPtr<CSSPrimitiveValue> > FontFamilyValueCache;
+    FontFamilyValueCache m_fontFamilyValueCache;
 };
 
 }
diff --git a/Source/WebCore/css/FontFamilyValue.cpp b/Source/WebCore/css/FontFamilyValue.cpp
deleted file mode 100644
index 665895d3a..000000000
--- a/Source/WebCore/css/FontFamilyValue.cpp
+++ /dev/null
@@ -1,72 +0,0 @@
-/*
- * (C) 1999-2003 Lars Knoll (knoll@kde.org)
- * Copyright (C) 2004, 2005, 2006, 2007, 2008 Apple Inc. All rights reserved.
- *
- * This library is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Library General Public
- * License as published by the Free Software Foundation; either
- * version 2 of the License, or (at your option) any later version.
- *
- * This library is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Library General Public License for more details.
- *
- * You should have received a copy of the GNU Library General Public License
- * along with this library; see the file COPYING.LIB.  If not, write to
- * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
- * Boston, MA 02110-1301, USA.
- */
-
-#include "config.h"
-#include "FontFamilyValue.h"
-
-#include "CSSParser.h"
-
-namespace WebCore {
-
-FontFamilyValue::FontFamilyValue(const String& familyName)
-    : CSSPrimitiveValue(FontFamilyClass, String(), CSS_STRING)
-    , m_familyName(familyName)
-{
-    // If there is anything in parentheses or square brackets at the end, delete it.
-    // FIXME: Do we really need this? The original code mentioned "a language tag in
-    // braces at the end" and "[Xft] qualifiers", but it's not clear either of those
-    // is in active use on the web.
-    unsigned length = m_familyName.length();
-    while (length >= 3) {
-        UChar startCharacter = 0;
-        switch (m_familyName[length - 1]) {
-            case ']':
-                startCharacter = '[';
-                break;
-            case ')':
-                startCharacter = '(';
-                break;
-        }
-        if (!startCharacter)
-            break;
-        unsigned first = 0;
-        for (unsigned i = length - 2; i > 0; --i) {
-            if (m_familyName[i - 1] == ' ' && m_familyName[i] == startCharacter)
-                first = i - 1;
-        }
-        if (!first)
-            break;
-        length = first;
-    }
-    m_familyName.truncate(length);
-}
-
-void FontFamilyValue::appendSpaceSeparated(const UChar* characters, unsigned length)
-{
-    m_familyName.append(' ');
-    m_familyName.append(characters, length);
-}
-
-String FontFamilyValue::customCssText() const
-{
-    return quoteCSSStringIfNeeded(m_familyName);
-}
-
-}
diff --git a/Source/WebCore/css/MediaList.idl b/Source/WebCore/css/MediaList.idl
index ed0d2ba4d..35445a3dd 100644
--- a/Source/WebCore/css/MediaList.idl
+++ b/Source/WebCore/css/MediaList.idl
@@ -31,14 +31,14 @@ module stylesheets {
         IndexedGetter
     ] MediaList {
 
-                 attribute [TreatNullAs=NullString, ConvertNullStringTo=Null] DOMString mediaText
+                 attribute [TreatNullAs=NullString, TreatReturnedNullStringAs=Null] DOMString mediaText
                      setter raises(DOMException);
         readonly attribute unsigned long length;
 
-        [ConvertNullStringTo=Null] DOMString item(in [Optional=CallWithDefaultValue] unsigned long index);
-        void deleteMedium(in [Optional=CallWithDefaultValue] DOMString oldMedium)
+        [TreatReturnedNullStringAs=Null] DOMString item(in [Optional=DefaultIsUndefined] unsigned long index);
+        void deleteMedium(in [Optional=DefaultIsUndefined] DOMString oldMedium)
             raises(DOMException);
-        void appendMedium(in [Optional=CallWithDefaultValue] DOMString newMedium)
+        void appendMedium(in [Optional=DefaultIsUndefined] DOMString newMedium)
             raises(DOMException);
 
     };
diff --git a/Source/WebCore/css/MediaQueryList.idl b/Source/WebCore/css/MediaQueryList.idl
index 0d8b1f22d..b4f7b9581 100644
--- a/Source/WebCore/css/MediaQueryList.idl
+++ b/Source/WebCore/css/MediaQueryList.idl
@@ -21,7 +21,7 @@ module view {
     interface MediaQueryList {
         readonly attribute DOMString media;
         readonly attribute boolean matches;
-        void addListener(in [Optional=CallWithDefaultValue] MediaQueryListListener listener);
-        void removeListener(in [Optional=CallWithDefaultValue] MediaQueryListListener listener);
+        void addListener(in [Optional=DefaultIsUndefined] MediaQueryListListener listener);
+        void removeListener(in [Optional=DefaultIsUndefined] MediaQueryListListener listener);
     };
 }
diff --git a/Source/WebCore/css/MediaQueryListListener.idl b/Source/WebCore/css/MediaQueryListListener.idl
index cd499eacc..d8f383aae 100644
--- a/Source/WebCore/css/MediaQueryListListener.idl
+++ b/Source/WebCore/css/MediaQueryListListener.idl
@@ -24,6 +24,6 @@ module view {
         CPPPureInterface,
         OmitConstructor
     ] MediaQueryListListener {
-        void queryChanged(in [Optional=CallWithDefaultValue] MediaQueryList list);
+        void queryChanged(in [Optional=DefaultIsUndefined] MediaQueryList list);
     };
 }
diff --git a/Source/WebCore/css/PropertySetCSSStyleDeclaration.cpp b/Source/WebCore/css/PropertySetCSSStyleDeclaration.cpp
new file mode 100644
index 000000000..428f1957b
--- /dev/null
+++ b/Source/WebCore/css/PropertySetCSSStyleDeclaration.cpp
@@ -0,0 +1,321 @@
+/*
+ * (C) 1999-2003 Lars Knoll (knoll@kde.org)
+ * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009, 2010, 2012 Apple Inc. All rights reserved.
+ * Copyright (C) 2011 Research In Motion Limited. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ */
+
+#include "config.h"
+#include "PropertySetCSSStyleDeclaration.h"
+
+#include "CSSParser.h"
+#include "HTMLNames.h"
+#include "InspectorInstrumentation.h"
+#include "MutationObserverInterestGroup.h"
+#include "MutationRecord.h"
+#include "StylePropertySet.h"
+#include "StyledElement.h"
+
+using namespace std;
+
+namespace WebCore {
+
+namespace {
+
+class StyleAttributeMutationScope {
+    WTF_MAKE_NONCOPYABLE(StyleAttributeMutationScope);
+public:
+    StyleAttributeMutationScope(PropertySetCSSStyleDeclaration* decl)
+    {
+        ++s_scopeCount;
+
+        if (s_scopeCount != 1) {
+            ASSERT(s_currentDecl == decl);
+            return;
+        }
+
+        ASSERT(!s_currentDecl);
+        s_currentDecl = decl;
+
+#if ENABLE(MUTATION_OBSERVERS)
+        if (!s_currentDecl->parentElement())
+            return;
+        m_mutationRecipients = MutationObserverInterestGroup::createForAttributesMutation(s_currentDecl->parentElement(), HTMLNames::styleAttr);
+        if (!m_mutationRecipients)
+            return;
+
+        AtomicString oldValue = m_mutationRecipients->isOldValueRequested() ? s_currentDecl->parentElement()->getAttribute(HTMLNames::styleAttr) : nullAtom;
+        m_mutation = MutationRecord::createAttributes(s_currentDecl->parentElement(), HTMLNames::styleAttr, oldValue);
+#endif
+    }
+
+    ~StyleAttributeMutationScope()
+    {
+        --s_scopeCount;
+        if (s_scopeCount)
+            return;
+
+#if ENABLE(MUTATION_OBSERVERS)
+        if (m_mutation && s_shouldDeliver)
+            m_mutationRecipients->enqueueMutationRecord(m_mutation);
+        s_shouldDeliver = false;
+#endif
+        if (!s_shouldNotifyInspector) {
+            s_currentDecl = 0;
+            return;
+        }
+        // We have to clear internal state before calling Inspector's code.
+        PropertySetCSSStyleDeclaration* localCopyStyleDecl = s_currentDecl;
+        s_currentDecl = 0;
+        s_shouldNotifyInspector = false;
+        if (localCopyStyleDecl->parentElement() && localCopyStyleDecl->parentElement()->document())
+            InspectorInstrumentation::didInvalidateStyleAttr(localCopyStyleDecl->parentElement()->document(), localCopyStyleDecl->parentElement());
+    }
+
+#if ENABLE(MUTATION_OBSERVERS)
+    void enqueueMutationRecord()
+    {
+        s_shouldDeliver = true;
+    }
+#endif
+
+    void didInvalidateStyleAttr()
+    {
+        s_shouldNotifyInspector = true;
+    }
+
+private:
+    static unsigned s_scopeCount;
+    static PropertySetCSSStyleDeclaration* s_currentDecl;
+    static bool s_shouldNotifyInspector;
+#if ENABLE(MUTATION_OBSERVERS)
+    static bool s_shouldDeliver;
+
+    OwnPtr<MutationObserverInterestGroup> m_mutationRecipients;
+    RefPtr<MutationRecord> m_mutation;
+#endif
+};
+
+unsigned StyleAttributeMutationScope::s_scopeCount = 0;
+PropertySetCSSStyleDeclaration* StyleAttributeMutationScope::s_currentDecl = 0;
+bool StyleAttributeMutationScope::s_shouldNotifyInspector = false;
+#if ENABLE(MUTATION_OBSERVERS)
+bool StyleAttributeMutationScope::s_shouldDeliver = false;
+#endif
+
+} // namespace
+    
+void PropertySetCSSStyleDeclaration::ref()
+{ 
+    m_propertySet->ref();
+}
+
+void PropertySetCSSStyleDeclaration::deref()
+{ 
+    m_propertySet->deref(); 
+}
+
+unsigned PropertySetCSSStyleDeclaration::length() const
+{
+    return m_propertySet->propertyCount();
+}
+
+String PropertySetCSSStyleDeclaration::item(unsigned i) const
+{
+    if (i >= m_propertySet->propertyCount())
+        return "";
+    return getPropertyName(static_cast<CSSPropertyID>(m_propertySet->propertyAt(i).id()));
+}
+
+String PropertySetCSSStyleDeclaration::cssText() const
+{
+    return m_propertySet->asText();
+}
+    
+void PropertySetCSSStyleDeclaration::setCssText(const String& text, ExceptionCode& ec)
+{
+#if ENABLE(MUTATION_OBSERVERS)
+    StyleAttributeMutationScope mutationScope(this);
+#endif
+    ec = 0;
+    // FIXME: Detect syntax errors and set ec.
+    m_propertySet->parseDeclaration(text, contextStyleSheet());
+
+    setNeedsStyleRecalc();
+#if ENABLE(MUTATION_OBSERVERS)
+    mutationScope.enqueueMutationRecord();    
+#endif
+}
+
+PassRefPtr<CSSValue> PropertySetCSSStyleDeclaration::getPropertyCSSValue(const String& propertyName)
+{
+    int propertyID = cssPropertyID(propertyName);
+    if (!propertyID)
+        return 0;
+    return m_propertySet->getPropertyCSSValue(propertyID);
+}
+
+String PropertySetCSSStyleDeclaration::getPropertyValue(const String &propertyName)
+{
+    int propertyID = cssPropertyID(propertyName);
+    if (!propertyID)
+        return String();
+    return m_propertySet->getPropertyValue(propertyID);
+}
+
+String PropertySetCSSStyleDeclaration::getPropertyPriority(const String& propertyName)
+{
+    int propertyID = cssPropertyID(propertyName);
+    if (!propertyID)
+        return String();
+    return m_propertySet->propertyIsImportant(propertyID) ? "important" : "";
+}
+
+String PropertySetCSSStyleDeclaration::getPropertyShorthand(const String& propertyName)
+{
+    int propertyID = cssPropertyID(propertyName);
+    if (!propertyID)
+        return String();
+    int shorthandID = m_propertySet->getPropertyShorthand(propertyID);
+    if (!shorthandID)
+        return String();
+    return getPropertyName(static_cast<CSSPropertyID>(shorthandID));
+}
+
+bool PropertySetCSSStyleDeclaration::isPropertyImplicit(const String& propertyName)
+{
+    int propertyID = cssPropertyID(propertyName);
+    if (!propertyID)
+        return false;
+    return m_propertySet->isPropertyImplicit(propertyID);
+}
+
+void PropertySetCSSStyleDeclaration::setProperty(const String& propertyName, const String& value, const String& priority, ExceptionCode& ec)
+{
+#if ENABLE(MUTATION_OBSERVERS)
+    StyleAttributeMutationScope mutationScope(this);
+#endif
+    int propertyID = cssPropertyID(propertyName);
+    if (!propertyID)
+        return;
+    bool important = priority.find("important", 0, false) != notFound;
+    ec = 0;
+    bool changed = m_propertySet->setProperty(propertyID, value, important, contextStyleSheet());
+    if (changed) {
+        // CSS DOM requires raising SYNTAX_ERR of parsing failed, but this is too dangerous for compatibility,
+        // see <http://bugs.webkit.org/show_bug.cgi?id=7296>.
+        setNeedsStyleRecalc();
+#if ENABLE(MUTATION_OBSERVERS)
+        mutationScope.enqueueMutationRecord();
+#endif
+    }
+}
+
+String PropertySetCSSStyleDeclaration::removeProperty(const String& propertyName, ExceptionCode& ec)
+{
+#if ENABLE(MUTATION_OBSERVERS)
+    StyleAttributeMutationScope mutationScope(this);
+#endif
+    int propertyID = cssPropertyID(propertyName);
+    if (!propertyID)
+        return String();
+    ec = 0;
+    String result;
+    bool changes = m_propertySet->removeProperty(propertyID, &result);
+    if (changes) {
+        setNeedsStyleRecalc();
+#if ENABLE(MUTATION_OBSERVERS)
+        mutationScope.enqueueMutationRecord();
+#endif
+    }
+    return result;
+}
+
+PassRefPtr<CSSValue> PropertySetCSSStyleDeclaration::getPropertyCSSValueInternal(CSSPropertyID propertyID)
+{ 
+    return m_propertySet->getPropertyCSSValue(propertyID); 
+}
+
+String PropertySetCSSStyleDeclaration::getPropertyValueInternal(CSSPropertyID propertyID)
+{ 
+    return m_propertySet->getPropertyValue(propertyID); 
+}
+
+void PropertySetCSSStyleDeclaration::setPropertyInternal(CSSPropertyID propertyID, const String& value, bool important, ExceptionCode& ec)
+{ 
+#if ENABLE(MUTATION_OBSERVERS)
+    StyleAttributeMutationScope mutationScope(this);
+#endif
+    ec = 0;
+    bool changed = m_propertySet->setProperty(propertyID, value, important, contextStyleSheet());
+    if (changed) {
+        setNeedsStyleRecalc();
+#if ENABLE(MUTATION_OBSERVERS)
+        mutationScope.enqueueMutationRecord();
+#endif
+    }
+}
+
+CSSStyleSheet* PropertySetCSSStyleDeclaration::parentStyleSheet() const
+{ 
+    return contextStyleSheet(); 
+}
+
+PassRefPtr<StylePropertySet> PropertySetCSSStyleDeclaration::copy() const
+{
+    return m_propertySet->copy();
+}
+
+PassRefPtr<StylePropertySet> PropertySetCSSStyleDeclaration::makeMutable()
+{
+    return m_propertySet;
+}
+
+bool PropertySetCSSStyleDeclaration::cssPropertyMatches(const CSSProperty* property) const
+{
+    return m_propertySet->propertyMatches(property);
+}
+
+void RuleCSSStyleDeclaration::setNeedsStyleRecalc()
+{
+    if (CSSStyleSheet* styleSheet = contextStyleSheet()) {
+        if (Document* document = styleSheet->findDocument())
+            document->styleSelectorChanged(DeferRecalcStyle);
+    }
+}
+    
+CSSStyleSheet* RuleCSSStyleDeclaration::contextStyleSheet() const
+{
+    return m_parentRule ? m_parentRule->parentStyleSheet() : 0;
+}
+
+void InlineCSSStyleDeclaration::setNeedsStyleRecalc()
+{
+    if (!m_parentElement)
+        return;
+    m_parentElement->setNeedsStyleRecalc(InlineStyleChange);
+    m_parentElement->invalidateStyleAttribute();
+    StyleAttributeMutationScope(this).didInvalidateStyleAttr();
+    return;
+}
+
+CSSStyleSheet* InlineCSSStyleDeclaration::contextStyleSheet() const
+{
+    return m_parentElement ? m_parentElement->document()->elementSheet() : 0;
+}
+
+} // namespace WebCore
diff --git a/Source/WebCore/css/PropertySetCSSStyleDeclaration.h b/Source/WebCore/css/PropertySetCSSStyleDeclaration.h
new file mode 100644
index 000000000..0edb98cf4
--- /dev/null
+++ b/Source/WebCore/css/PropertySetCSSStyleDeclaration.h
@@ -0,0 +1,117 @@
+/*
+ * Copyright (C) 2012 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef PropertySetCSSStyleDeclaration_h
+#define PropertySetCSSStyleDeclaration_h
+
+#include "CSSStyleDeclaration.h"
+
+namespace WebCore {
+
+class CSSRule;
+class CSSProperty;
+class CSSStyleSheet;
+class CSSValue;
+class StylePropertySet;
+class StyledElement;
+
+class PropertySetCSSStyleDeclaration : public CSSStyleDeclaration {
+public:
+    PropertySetCSSStyleDeclaration(StylePropertySet* propertySet) : m_propertySet(propertySet) { }
+    
+    virtual StyledElement* parentElement() const { return 0; }
+    virtual void clearParentRule() { ASSERT_NOT_REACHED(); }
+    virtual void clearParentElement() { ASSERT_NOT_REACHED(); }
+    virtual CSSStyleSheet* contextStyleSheet() const { return 0; }
+    
+private:
+    virtual void ref() OVERRIDE;
+    virtual void deref() OVERRIDE;
+    
+    virtual CSSRule* parentRule() const OVERRIDE { return 0; };
+    virtual unsigned length() const OVERRIDE;
+    virtual String item(unsigned index) const OVERRIDE;
+    virtual PassRefPtr<CSSValue> getPropertyCSSValue(const String& propertyName) OVERRIDE;
+    virtual String getPropertyValue(const String& propertyName) OVERRIDE;
+    virtual String getPropertyPriority(const String& propertyName) OVERRIDE;
+    virtual String getPropertyShorthand(const String& propertyName) OVERRIDE;
+    virtual bool isPropertyImplicit(const String& propertyName) OVERRIDE;
+    virtual void setProperty(const String& propertyName, const String& value, const String& priority, ExceptionCode&) OVERRIDE;
+    virtual String removeProperty(const String& propertyName, ExceptionCode&) OVERRIDE;
+    virtual String cssText() const OVERRIDE;
+    virtual void setCssText(const String&, ExceptionCode&) OVERRIDE;
+    virtual PassRefPtr<CSSValue> getPropertyCSSValueInternal(CSSPropertyID) OVERRIDE;
+    virtual String getPropertyValueInternal(CSSPropertyID) OVERRIDE;
+    virtual void setPropertyInternal(CSSPropertyID, const String& value, bool important, ExceptionCode&) OVERRIDE;
+    
+    virtual bool cssPropertyMatches(const CSSProperty*) const OVERRIDE;
+    virtual CSSStyleSheet* parentStyleSheet() const OVERRIDE;
+    virtual PassRefPtr<StylePropertySet> copy() const OVERRIDE;
+    virtual PassRefPtr<StylePropertySet> makeMutable() OVERRIDE;
+    virtual void setNeedsStyleRecalc() { }    
+    
+protected:
+    StylePropertySet* m_propertySet;
+};
+
+class RuleCSSStyleDeclaration : public PropertySetCSSStyleDeclaration
+{
+public:
+    RuleCSSStyleDeclaration(StylePropertySet* propertySet, CSSRule* parentRule)
+        : PropertySetCSSStyleDeclaration(propertySet)
+        , m_parentRule(parentRule) 
+    {
+    }
+    
+private:    
+    virtual CSSRule* parentRule() const { return m_parentRule; };
+    virtual void clearParentRule() { m_parentRule = 0; }
+    virtual void setNeedsStyleRecalc();
+    virtual CSSStyleSheet* contextStyleSheet() const;
+    
+    CSSRule* m_parentRule;
+};
+
+class InlineCSSStyleDeclaration : public PropertySetCSSStyleDeclaration
+{
+public:
+    InlineCSSStyleDeclaration(StylePropertySet* propertySet, StyledElement* parentElement)
+        : PropertySetCSSStyleDeclaration(propertySet)
+        , m_parentElement(parentElement) 
+    {
+    }
+    
+private:
+    virtual StyledElement* parentElement() const { return m_parentElement; }
+    virtual void clearParentElement() { m_parentElement = 0; }
+    virtual void setNeedsStyleRecalc();
+    virtual CSSStyleSheet* contextStyleSheet() const;
+    
+    StyledElement* m_parentElement;
+};
+
+} // namespace WebCore
+
+#endif
diff --git a/Source/WebCore/css/SelectorChecker.cpp b/Source/WebCore/css/SelectorChecker.cpp
index d4636b710..bc216605d 100644
--- a/Source/WebCore/css/SelectorChecker.cpp
+++ b/Source/WebCore/css/SelectorChecker.cpp
@@ -468,6 +468,10 @@ SelectorChecker::SelectorMatch SelectorChecker::checkSelector(const SelectorChec
     nextContext.selector = historySelector;
 
     if (relation != CSSSelector::SubSelector) {
+        // Abort if the next selector would exceed the scope.
+        if (context.element == context.scope)
+            return SelectorFailsCompletely;
+
         // Bail-out if this selector is irrelevant for the pseudoStyle
         if (m_pseudoStyle != NOPSEUDO && m_pseudoStyle != dynamicPseudo)
             return SelectorFailsCompletely;
@@ -487,6 +491,8 @@ SelectorChecker::SelectorMatch SelectorChecker::checkSelector(const SelectorChec
             SelectorMatch match = checkSelector(nextContext, dynamicPseudo);
             if (match == SelectorMatches || match == SelectorFailsCompletely)
                 return match;
+            if (nextContext.element == nextContext.scope)
+                return SelectorFailsCompletely;
         }
         return SelectorFailsCompletely;
 
@@ -542,6 +548,9 @@ SelectorChecker::SelectorMatch SelectorChecker::checkSelector(const SelectorChec
 
     case CSSSelector::ShadowDescendant:
         {
+            // If we're in the same tree-scope as the scoping element, then following a shadow descendant combinator would escape that and thus the scope.
+            if (context.scope && context.scope->treeScope() == context.element->treeScope())
+                return SelectorFailsCompletely;
             Node* shadowHostNode = context.element->shadowAncestorNode();
             if (shadowHostNode == context.element || !shadowHostNode->isElementNode())
                 return SelectorFailsCompletely;
@@ -771,7 +780,7 @@ bool SelectorChecker::checkOneSelector(const SelectorCheckingContext& context, P
                         break;
                     }
                     if (n->isTextNode()) {
-                        Text* textNode = static_cast<Text*>(n);
+                        Text* textNode = toText(n);
                         if (!textNode->data().isEmpty()) {
                             result = false;
                             break;
diff --git a/Source/WebCore/css/SelectorChecker.h b/Source/WebCore/css/SelectorChecker.h
index 06b619d87..7e80808dd 100644
--- a/Source/WebCore/css/SelectorChecker.h
+++ b/Source/WebCore/css/SelectorChecker.h
@@ -54,17 +54,19 @@ public:
 
     struct SelectorCheckingContext {
         // Initial selector constructor
-        SelectorCheckingContext(CSSSelector* selector, Element* element, VisitedMatchType visitedMatchType, RenderStyle* elementStyle = 0, RenderStyle* elementParentStyle = 0)
+        SelectorCheckingContext(CSSSelector* selector, Element* element, VisitedMatchType visitedMatchType)
             : selector(selector)
             , element(element)
+            , scope(0)
             , visitedMatchType(visitedMatchType)
-            , elementStyle(elementStyle)
-            , elementParentStyle(elementParentStyle)
+            , elementStyle(0)
+            , elementParentStyle(0)
             , isSubSelector(false)
         { }
 
         CSSSelector* selector;
         Element* element;
+        const Element* scope;
         VisitedMatchType visitedMatchType;
         RenderStyle* elementStyle;
         RenderStyle* elementParentStyle;
@@ -143,7 +145,7 @@ private:
         Vector<unsigned, 4> identifierHashes;
     };
     Vector<ParentStackFrame> m_parentStack;
-    
+
     // With 100 unique strings in the filter, 2^12 slot table has false positive rate of ~0.2%.
     static const unsigned bloomFilterKeyBits = 12;
     OwnPtr<BloomFilter<bloomFilterKeyBits> > m_ancestorIdentifierFilter;
diff --git a/Source/WebCore/css/StyleMedia.idl b/Source/WebCore/css/StyleMedia.idl
index 6ff457803..5dd58da1f 100644
--- a/Source/WebCore/css/StyleMedia.idl
+++ b/Source/WebCore/css/StyleMedia.idl
@@ -29,6 +29,6 @@ module view {
         JSGenerateIsReachable=ImplFrame
     ] StyleMedia {
         readonly attribute DOMString type;
-        boolean matchMedium(in [Optional=CallWithDefaultValue] DOMString mediaquery);
+        boolean matchMedium(in [Optional=DefaultIsUndefined] DOMString mediaquery);
     };
 }
diff --git a/Source/WebCore/css/StylePropertySet.cpp b/Source/WebCore/css/StylePropertySet.cpp
index 11ec77172..e8d97cacc 100644
--- a/Source/WebCore/css/StylePropertySet.cpp
+++ b/Source/WebCore/css/StylePropertySet.cpp
@@ -22,182 +22,44 @@
 #include "config.h"
 #include "StylePropertySet.h"
 
-#include "CSSImageValue.h"
 #include "CSSParser.h"
 #include "CSSPropertyLonghand.h"
 #include "CSSPropertyNames.h"
-#include "CSSRule.h"
-#include "CSSStyleSheet.h"
 #include "CSSValueKeywords.h"
 #include "CSSValueList.h"
+#include "CSSValuePool.h"
 #include "Document.h"
-#include "ExceptionCode.h"
-#include "HTMLNames.h"
-#include "InspectorInstrumentation.h"
-#include "MutationObserverInterestGroup.h"
-#include "MutationRecord.h"
-#include "StyledElement.h"
-#include "WebKitMutationObserver.h"
+#include "PropertySetCSSStyleDeclaration.h"
 #include <wtf/text/StringBuilder.h>
-#include <wtf/text/WTFString.h>
 
 using namespace std;
 
 namespace WebCore {
 
-class PropertySetCSSStyleDeclaration : public CSSStyleDeclaration {
-public:
-    static PassRefPtr<PropertySetCSSStyleDeclaration> create(PassRefPtr<StylePropertySet> propertySet)
-    {
-        return adoptRef(new PropertySetCSSStyleDeclaration(propertySet)); 
-    }
-
-private:
-    PropertySetCSSStyleDeclaration(PassRefPtr<StylePropertySet> propertySet) : m_propertySet(propertySet) { }
-    
-    virtual CSSRule* parentRule() const OVERRIDE;
-    virtual unsigned length() const OVERRIDE;
-    virtual String item(unsigned index) const;
-    virtual PassRefPtr<CSSValue> getPropertyCSSValue(const String& propertyName) OVERRIDE;
-    virtual String getPropertyValue(const String& propertyName) OVERRIDE;
-    virtual String getPropertyPriority(const String& propertyName) OVERRIDE;
-    virtual String getPropertyShorthand(const String& propertyName) OVERRIDE;
-    virtual bool isPropertyImplicit(const String& propertyName) OVERRIDE;
-    virtual void setProperty(const String& propertyName, const String& value, const String& priority, ExceptionCode&) OVERRIDE;
-    virtual String removeProperty(const String& propertyName, ExceptionCode&) OVERRIDE;
-    virtual String cssText() const OVERRIDE;
-    virtual void setCssText(const String&, ExceptionCode&);
-    virtual PassRefPtr<CSSValue> getPropertyCSSValueInternal(CSSPropertyID) OVERRIDE;
-    virtual String getPropertyValueInternal(CSSPropertyID) OVERRIDE;
-    virtual void setPropertyInternal(CSSPropertyID, const String& value, bool important, ExceptionCode&) OVERRIDE;
-    
-    virtual bool cssPropertyMatches(const CSSProperty*) const OVERRIDE;
-    virtual CSSStyleSheet* parentStyleSheet() const OVERRIDE;
-    virtual PassRefPtr<StylePropertySet> copy() const OVERRIDE;
-    virtual PassRefPtr<StylePropertySet> makeMutable() OVERRIDE;
-    
-    RefPtr<StylePropertySet> m_propertySet;
-};
-
-namespace {
-
-class StyleAttributeMutationScope {
-    WTF_MAKE_NONCOPYABLE(StyleAttributeMutationScope);
-public:
-    StyleAttributeMutationScope(StylePropertySet* decl)
-    {
-        ++s_scopeCount;
-
-        if (s_scopeCount != 1) {
-            ASSERT(s_currentDecl == decl);
-            return;
-        }
-
-        ASSERT(!s_currentDecl);
-        s_currentDecl = decl;
-
-#if ENABLE(MUTATION_OBSERVERS)
-        if (!s_currentDecl->isInlineStyleDeclaration())
-            return;
-        if (!s_currentDecl->parentElement())
-            return;
-        m_mutationRecipients = MutationObserverInterestGroup::createForAttributesMutation(s_currentDecl->parentElement(), HTMLNames::styleAttr);
-        if (!m_mutationRecipients)
-            return;
-
-        AtomicString oldValue = m_mutationRecipients->isOldValueRequested() ? s_currentDecl->parentElement()->getAttribute(HTMLNames::styleAttr) : nullAtom;
-        m_mutation = MutationRecord::createAttributes(s_currentDecl->parentElement(), HTMLNames::styleAttr, oldValue);
-#endif
-    }
-
-    ~StyleAttributeMutationScope()
-    {
-        --s_scopeCount;
-        if (s_scopeCount)
-            return;
-
-#if ENABLE(MUTATION_OBSERVERS)
-        if (m_mutation && s_shouldDeliver)
-            m_mutationRecipients->enqueueMutationRecord(m_mutation);
-        s_shouldDeliver = false;
-#endif
-        if (!s_shouldNotifyInspector) {
-            s_currentDecl = 0;
-            return;
-        }
-        // We have to clear internal state before calling Inspector's code.
-        StylePropertySet* localCopyStyleDecl = s_currentDecl;
-        s_currentDecl = 0;
-        s_shouldNotifyInspector = false;
-        if (localCopyStyleDecl->isInlineStyleDeclaration() && localCopyStyleDecl->parentElement() && localCopyStyleDecl->parentElement()->document())
-            InspectorInstrumentation::didInvalidateStyleAttr(localCopyStyleDecl->parentElement()->document(), localCopyStyleDecl->parentElement());
-    }
-
-#if ENABLE(MUTATION_OBSERVERS)
-    void enqueueMutationRecord()
-    {
-        s_shouldDeliver = true;
-    }
-#endif
-
-    void didInvalidateStyleAttr()
-    {
-        ASSERT(s_currentDecl->isInlineStyleDeclaration());
-        s_shouldNotifyInspector = true;
-    }
-
-private:
-    static unsigned s_scopeCount;
-    static StylePropertySet* s_currentDecl;
-    static bool s_shouldNotifyInspector;
-#if ENABLE(MUTATION_OBSERVERS)
-    static bool s_shouldDeliver;
-
-    OwnPtr<MutationObserverInterestGroup> m_mutationRecipients;
-    RefPtr<MutationRecord> m_mutation;
-#endif
-};
-
-unsigned StyleAttributeMutationScope::s_scopeCount = 0;
-StylePropertySet* StyleAttributeMutationScope::s_currentDecl = 0;
-bool StyleAttributeMutationScope::s_shouldNotifyInspector = false;
-#if ENABLE(MUTATION_OBSERVERS)
-bool StyleAttributeMutationScope::s_shouldDeliver = false;
-#endif
-
-} // namespace
-
-StylePropertySet::StylePropertySet()
-    : m_strictParsing(false)
-    , m_parentIsElement(false)
-    , m_isInlineStyleDeclaration(false)
-    , m_parent(static_cast<CSSRule*>(0))
+typedef HashMap<const StylePropertySet*, OwnPtr<PropertySetCSSStyleDeclaration> > PropertySetCSSOMWrapperMap;
+static PropertySetCSSOMWrapperMap& propertySetCSSOMWrapperMap()
 {
+    DEFINE_STATIC_LOCAL(PropertySetCSSOMWrapperMap, propertySetCSSOMWrapperMapInstance, ());
+    return propertySetCSSOMWrapperMapInstance;
 }
 
-StylePropertySet::StylePropertySet(CSSRule* parentRule)
-    : m_strictParsing(!parentRule || parentRule->useStrictParsing())
-    , m_parentIsElement(false)
-    , m_isInlineStyleDeclaration(false)
-    , m_parent(parentRule)
+StylePropertySet::StylePropertySet()
+    : m_strictParsing(false)
+    , m_hasCSSOMWrapper(false)
 {
 }
 
-StylePropertySet::StylePropertySet(CSSRule* parentRule, const Vector<CSSProperty>& properties)
+StylePropertySet::StylePropertySet(const Vector<CSSProperty>& properties)
     : m_properties(properties)
-    , m_strictParsing(!parentRule || parentRule->useStrictParsing())
-    , m_parentIsElement(false)
-    , m_isInlineStyleDeclaration(false)
-    , m_parent(parentRule)
+    , m_strictParsing(true)
+    , m_hasCSSOMWrapper(false)
 {
     m_properties.shrinkToFit();
 }
 
-StylePropertySet::StylePropertySet(CSSRule* parentRule, const CSSProperty* const * properties, int numProperties)
-    : m_strictParsing(!parentRule || parentRule->useStrictParsing())
-    , m_parentIsElement(false)
-    , m_isInlineStyleDeclaration(false)
-    , m_parent(parentRule)
+StylePropertySet::StylePropertySet(const CSSProperty* const * properties, int numProperties, bool useStrictParsing)
+    : m_strictParsing(useStrictParsing)
+    , m_hasCSSOMWrapper(false)
 {
     m_properties.reserveInitialCapacity(numProperties);
     HashMap<int, bool> candidates;
@@ -210,7 +72,7 @@ StylePropertySet::StylePropertySet(CSSRule* parentRule, const CSSProperty* const
         if (it != candidates.end()) {
             if (!important && it->second)
                 continue;
-            removeProperty(property->id(), false, false);
+            removeProperty(property->id());
         }
 
         m_properties.append(*property);
@@ -218,37 +80,11 @@ StylePropertySet::StylePropertySet(CSSRule* parentRule, const CSSProperty* const
     }
 }
 
-StylePropertySet::StylePropertySet(StyledElement* parentElement, bool isInlineStyle)
-    : m_strictParsing(false)
-    , m_parentIsElement(true)
-    , m_isInlineStyleDeclaration(isInlineStyle)
-    , m_parent(parentElement)
-{
-}
-
 StylePropertySet::~StylePropertySet()
 {
-}
-
-void StylePropertySet::deref()
-{
-    if (derefBase()) {
-        delete this;
-        return;
-    }
-    // StylePropertySet and CSSStyleDeclaration ref each other. When we have a declaration and
-    // our refcount drops to one we know it is the only thing keeping us alive.
-    if (m_cssStyleDeclaration && hasOneRef())
-        m_cssStyleDeclaration.clear();
-}
-
-CSSStyleSheet* StylePropertySet::contextStyleSheet() const
-{
-    if (m_parentIsElement) {
-        Document* document = m_parent.element ? m_parent.element->document() : 0;
-        return document ? document->elementSheet() : 0;
-    }
-    return m_parent.rule ? m_parent.rule->parentStyleSheet() : 0;
+    ASSERT(!m_hasCSSOMWrapper || propertySetCSSOMWrapperMap().contains(this));
+    if (m_hasCSSOMWrapper)
+        propertySetCSSOMWrapperMap().remove(this);
 }
 
 void StylePropertySet::copyPropertiesFrom(const StylePropertySet& other)
@@ -669,67 +505,38 @@ PassRefPtr<CSSValue> StylePropertySet::getPropertyCSSValue(int propertyID) const
     return property ? property->value() : 0;
 }
 
-bool StylePropertySet::removeShorthandProperty(int propertyID, bool notifyChanged)
+bool StylePropertySet::removeShorthandProperty(int propertyID)
 {
     CSSPropertyLonghand longhand = longhandForProperty(propertyID);
     if (!longhand.length())
         return false;
-    return removePropertiesInSet(longhand.properties(), longhand.length(), notifyChanged);
+    return removePropertiesInSet(longhand.properties(), longhand.length());
 }
 
-String StylePropertySet::removeProperty(int propertyID, bool notifyChanged, bool returnText)
+bool StylePropertySet::removeProperty(int propertyID, String* returnText)
 {
-#if ENABLE(MUTATION_OBSERVERS)
-    StyleAttributeMutationScope mutationScope(this);
-#endif
-
-    if (removeShorthandProperty(propertyID, notifyChanged)) {
+    if (removeShorthandProperty(propertyID)) {
         // FIXME: Return an equivalent shorthand when possible.
-        return String();
+        if (returnText)
+            *returnText = "";
+        return true;
     }
 
     CSSProperty* foundProperty = findPropertyWithId(propertyID);
-    if (!foundProperty)
-        return String();
+    if (!foundProperty) {
+        if (returnText)
+            *returnText = "";
+        return false;
+    }
 
-    String value = returnText ? foundProperty->value()->cssText() : String();
+    if (returnText)
+        *returnText = foundProperty->value()->cssText();
 
     // A more efficient removal strategy would involve marking entries as empty
     // and sweeping them when the vector grows too big.
     m_properties.remove(foundProperty - m_properties.data());
-
-#if ENABLE(MUTATION_OBSERVERS)
-    mutationScope.enqueueMutationRecord();
-#endif
-
-    if (notifyChanged)
-        setNeedsStyleRecalc();
-
-    return value;
-}
-
-void StylePropertySet::setNeedsStyleRecalc()
-{
-    if (m_parentIsElement) {
-        StyledElement* element = parentElement();
-        if (!element)
-            return;
-
-        if (!m_isInlineStyleDeclaration) {
-            element->setNeedsStyleRecalc();
-            return;
-        }
-
-        element->setNeedsStyleRecalc(InlineStyleChange);
-        element->invalidateStyleAttribute();
-        StyleAttributeMutationScope(this).didInvalidateStyleAttr();
-        return;
-    }
-
-    if (CSSStyleSheet* styleSheet = contextStyleSheet()) {
-        if (Document* document = styleSheet->findDocument())
-            document->styleSelectorChanged(DeferRecalcStyle);
-    }
+    
+    return true;
 }
 
 bool StylePropertySet::propertyIsImportant(int propertyID) const
@@ -761,45 +568,38 @@ bool StylePropertySet::isPropertyImplicit(int propertyID) const
     return property ? property->isImplicit() : false;
 }
 
-bool StylePropertySet::setProperty(int propertyID, const String& value, bool important, bool notifyChanged)
+bool StylePropertySet::setProperty(int propertyID, const String& value, bool important, CSSStyleSheet* contextStyleSheet)
 {
-#if ENABLE(MUTATION_OBSERVERS)
-    StyleAttributeMutationScope mutationScope(this);
-#endif
-
     // Setting the value to an empty string just removes the property in both IE and Gecko.
     // Setting it to null seems to produce less consistent results, but we treat it just the same.
     if (value.isEmpty()) {
-        removeProperty(propertyID, notifyChanged, false);
+        removeProperty(propertyID);
         return true;
     }
 
     // When replacing an existing property value, this moves the property to the end of the list.
     // Firefox preserves the position, and MSIE moves the property to the beginning.
-    bool success = CSSParser::parseValue(this, propertyID, value, important, useStrictParsing());
-    if (!success) {
-        // CSS DOM requires raising SYNTAX_ERR here, but this is too dangerous for compatibility,
-        // see <http://bugs.webkit.org/show_bug.cgi?id=7296>.
-        return false;
-    }
+    return CSSParser::parseValue(this, propertyID, value, important, useStrictParsing(), contextStyleSheet);
+}
 
-#if ENABLE(MUTATION_OBSERVERS)
-    mutationScope.enqueueMutationRecord();
-#endif
+void StylePropertySet::setProperty(int propertyID, PassRefPtr<CSSValue> prpValue, bool important)
+{
+    CSSPropertyLonghand longhand = longhandForProperty(propertyID);
+    if (!longhand.length()) {
+        setProperty(CSSProperty(propertyID, prpValue, important));
+        return;
+    }
 
-    if (notifyChanged)
-        setNeedsStyleRecalc();
+    removePropertiesInSet(longhand.properties(), longhand.length());
 
-    return true;
+    RefPtr<CSSValue> value = prpValue;
+    for (unsigned i = 0; i < longhand.length(); ++i)
+        m_properties.append(CSSProperty(longhand.properties()[i], value, important));
 }
 
 void StylePropertySet::setProperty(const CSSProperty& property, CSSProperty* slot)
 {
-#if ENABLE(MUTATION_OBSERVERS)
-    StyleAttributeMutationScope mutationScope(this);
-#endif
-
-    if (!removeShorthandProperty(property.id(), false)) {
+    if (!removeShorthandProperty(property.id())) {
         CSSProperty* toReplace = slot ? slot : findPropertyWithId(property.id());
         if (toReplace) {
             *toReplace = property;
@@ -807,80 +607,41 @@ void StylePropertySet::setProperty(const CSSProperty& property, CSSProperty* slo
         }
     }
     m_properties.append(property);
-
-#if ENABLE(MUTATION_OBSERVERS)
-    mutationScope.enqueueMutationRecord();
-#endif
 }
 
-bool StylePropertySet::setProperty(int propertyID, int value, bool important, bool notifyChanged)
+bool StylePropertySet::setProperty(int propertyID, int identifier, bool important, CSSStyleSheet* contextStyleSheet)
 {
-    CSSProperty property(propertyID, CSSPrimitiveValue::createIdentifier(value), important);
-    setProperty(property);
-    if (notifyChanged)
-        setNeedsStyleRecalc();
-    return true;
-}
+    RefPtr<CSSPrimitiveValue> value;    
+    if (Document* document = contextStyleSheet ? contextStyleSheet->findDocument() : 0)
+        value = document->cssValuePool()->createIdentifierValue(identifier);
+    else
+        value = CSSPrimitiveValue::createIdentifier(identifier);
 
-bool StylePropertySet::setProperty(int propertyID, double value, CSSPrimitiveValue::UnitTypes unit, bool important, bool notifyChanged)
-{
-    CSSProperty property(propertyID, CSSPrimitiveValue::create(value, unit), important);
-    setProperty(property);
-    if (notifyChanged)
-        setNeedsStyleRecalc();
+    setProperty(CSSProperty(propertyID, value.release(), important));
     return true;
 }
 
-void StylePropertySet::parseDeclaration(const String& styleDeclaration)
+void StylePropertySet::parseDeclaration(const String& styleDeclaration, CSSStyleSheet* contextStyleSheet)
 {
-#if ENABLE(MUTATION_OBSERVERS)
-    StyleAttributeMutationScope mutationScope(this);
-#endif
-
     m_properties.clear();
     CSSParser parser(useStrictParsing());
-    parser.parseDeclaration(this, styleDeclaration);
-
-#if ENABLE(MUTATION_OBSERVERS)
-    mutationScope.enqueueMutationRecord();
-#endif
-
-    setNeedsStyleRecalc();
+    parser.parseDeclaration(this, styleDeclaration, 0, contextStyleSheet);
 }
 
 void StylePropertySet::addParsedProperties(const CSSProperty* const* properties, int numProperties)
 {
-#if ENABLE(MUTATION_OBSERVERS)
-    StyleAttributeMutationScope mutationScope(this);
-#endif
-
     m_properties.reserveCapacity(numProperties);
     for (int i = 0; i < numProperties; ++i)
         addParsedProperty(*properties[i]);
-
-#if ENABLE(MUTATION_OBSERVERS)
-    mutationScope.enqueueMutationRecord();
-#endif
-
-    // FIXME: This probably should have a call to setNeedsStyleRecalc() if something changed. We may also wish to add
-    // a notifyChanged argument to this function to follow the model of other functions in this class.
 }
 
 void StylePropertySet::addParsedProperty(const CSSProperty& property)
 {
-#if ENABLE(MUTATION_OBSERVERS)
-    StyleAttributeMutationScope mutationScope(this);
-#endif
-
     // Only add properties that have no !important counterpart present
     if (!propertyIsImportant(property.id()) || property.isImportant()) {
-        removeProperty(property.id(), false, false);
+        removeProperty(property.id());
         m_properties.append(property);
     }
-
-#if ENABLE(MUTATION_OBSERVERS)
-    mutationScope.enqueueMutationRecord();
-#endif
 }
 
 String StylePropertySet::asText() const
@@ -947,10 +708,6 @@ String StylePropertySet::asText() const
 
 void StylePropertySet::merge(const StylePropertySet* other, bool argOverridesOnConflict)
 {
-#if ENABLE(MUTATION_OBSERVERS)
-    StyleAttributeMutationScope mutationScope(this);
-#endif
-
     unsigned size = other->m_properties.size();
     for (unsigned n = 0; n < size; ++n) {
         const CSSProperty& toMerge = other->m_properties[n];
@@ -962,21 +719,13 @@ void StylePropertySet::merge(const StylePropertySet* other, bool argOverridesOnC
         } else
             m_properties.append(toMerge);
     }
-
-#if ENABLE(MUTATION_OBSERVERS)
-    mutationScope.enqueueMutationRecord();
-#endif
-
-    // FIXME: This probably should have a call to setNeedsStyleRecalc() if something changed. We may also wish to add
-    // a notifyChanged argument to this function to follow the model of other functions in this class.
 }
 
-void StylePropertySet::addSubresourceStyleURLs(ListHashSet<KURL>& urls)
+void StylePropertySet::addSubresourceStyleURLs(ListHashSet<KURL>& urls, CSSStyleSheet* contextStyleSheet)
 {
-    CSSStyleSheet* sheet = contextStyleSheet();
     size_t size = m_properties.size();
     for (size_t i = 0; i < size; ++i)
-        m_properties[i].value()->addSubresourceStyleURLs(urls, sheet);
+        m_properties[i].value()->addSubresourceStyleURLs(urls, contextStyleSheet);
 }
 
 // This is the list of properties we want to copy in the copyBlockProperties() function.
@@ -1017,15 +766,11 @@ void StylePropertySet::removeBlockProperties()
     removePropertiesInSet(blockProperties, numBlockProperties);
 }
 
-bool StylePropertySet::removePropertiesInSet(const int* set, unsigned length, bool notifyChanged)
+bool StylePropertySet::removePropertiesInSet(const int* set, unsigned length)
 {
     if (m_properties.isEmpty())
         return false;
 
-#if ENABLE(MUTATION_OBSERVERS)
-    StyleAttributeMutationScope mutationScope(this);
-#endif
-
     // FIXME: This is always used with static sets and in that case constructing the hash repeatedly is pretty pointless.
     HashSet<int> toRemove;
     for (unsigned i = 0; i < length; ++i)
@@ -1047,14 +792,6 @@ bool StylePropertySet::removePropertiesInSet(const int* set, unsigned length, bo
 
     bool changed = newProperties.size() != m_properties.size();
     m_properties = newProperties;
-
-    if (notifyChanged) {
-#if ENABLE(MUTATION_OBSERVERS)
-        mutationScope.enqueueMutationRecord();
-#endif
-        setNeedsStyleRecalc();
-    }
-
     return changed;
 }
 
@@ -1112,7 +849,7 @@ void StylePropertySet::removeEquivalentProperties(const CSSStyleDeclaration* sty
 
 PassRefPtr<StylePropertySet> StylePropertySet::copy() const
 {
-    return adoptRef(new StylePropertySet(0, m_properties));
+    return adoptRef(new StylePropertySet(m_properties));
 }
 
 PassRefPtr<StylePropertySet> StylePropertySet::copyPropertiesInSet(const int* set, unsigned length) const
@@ -1129,139 +866,61 @@ PassRefPtr<StylePropertySet> StylePropertySet::copyPropertiesInSet(const int* se
 
 CSSStyleDeclaration* StylePropertySet::ensureCSSStyleDeclaration() const
 {
-    if (!m_cssStyleDeclaration)
-        m_cssStyleDeclaration = PropertySetCSSStyleDeclaration::create(const_cast<StylePropertySet*>(this));
-    return m_cssStyleDeclaration.get();
-}
-
-unsigned PropertySetCSSStyleDeclaration::length() const
-{
-    return m_propertySet->propertyCount();
-}
-
-String PropertySetCSSStyleDeclaration::item(unsigned i) const
-{
-    if (i >= m_propertySet->propertyCount())
-        return "";
-    return getPropertyName(static_cast<CSSPropertyID>(m_propertySet->propertyAt(i).id()));
-}
-
-CSSRule* PropertySetCSSStyleDeclaration::parentRule() const
-{
-    return m_propertySet->parentRuleInternal();
-}
-
-String PropertySetCSSStyleDeclaration::cssText() const
-{
-    return m_propertySet->asText();
-}
-    
-void PropertySetCSSStyleDeclaration::setCssText(const String& text, ExceptionCode& ec)
-{
-    ec = 0;
-    // FIXME: Detect syntax errors and set ec.
-    m_propertySet->parseDeclaration(text);
-}
-
-PassRefPtr<CSSValue> PropertySetCSSStyleDeclaration::getPropertyCSSValue(const String& propertyName)
-{
-    int propertyID = cssPropertyID(propertyName);
-    if (!propertyID)
-        return 0;
-    return m_propertySet->getPropertyCSSValue(propertyID);
-}
-
-String PropertySetCSSStyleDeclaration::getPropertyValue(const String &propertyName)
-{
-    int propertyID = cssPropertyID(propertyName);
-    if (!propertyID)
-        return String();
-    return m_propertySet->getPropertyValue(propertyID);
-}
-
-String PropertySetCSSStyleDeclaration::getPropertyPriority(const String& propertyName)
-{
-    int propertyID = cssPropertyID(propertyName);
-    if (!propertyID)
-        return String();
-    return m_propertySet->propertyIsImportant(propertyID) ? "important" : "";
+    if (m_hasCSSOMWrapper) {
+        ASSERT(!static_cast<CSSStyleDeclaration*>(propertySetCSSOMWrapperMap().get(this))->parentRule());
+        ASSERT(!propertySetCSSOMWrapperMap().get(this)->parentElement());
+        return propertySetCSSOMWrapperMap().get(this);
+    }
+    m_hasCSSOMWrapper = true;
+    PropertySetCSSStyleDeclaration* cssomWrapper = new PropertySetCSSStyleDeclaration(const_cast<StylePropertySet*>(this));
+    propertySetCSSOMWrapperMap().add(this, adoptPtr(cssomWrapper));
+    return cssomWrapper;
 }
 
-String PropertySetCSSStyleDeclaration::getPropertyShorthand(const String& propertyName)
+CSSStyleDeclaration* StylePropertySet::ensureRuleCSSStyleDeclaration(const CSSRule* parentRule) const
 {
-    int propertyID = cssPropertyID(propertyName);
-    if (!propertyID)
-        return String();
-    int shorthandID = m_propertySet->getPropertyShorthand(propertyID);
-    if (!shorthandID)
-        return String();
-    return getPropertyName(static_cast<CSSPropertyID>(shorthandID));
+    if (m_hasCSSOMWrapper) {
+        ASSERT(static_cast<CSSStyleDeclaration*>(propertySetCSSOMWrapperMap().get(this))->parentRule() == parentRule);
+        return propertySetCSSOMWrapperMap().get(this);
+    }
+    m_hasCSSOMWrapper = true;
+    PropertySetCSSStyleDeclaration* cssomWrapper = new RuleCSSStyleDeclaration(const_cast<StylePropertySet*>(this), const_cast<CSSRule*>(parentRule));
+    propertySetCSSOMWrapperMap().add(this, adoptPtr(cssomWrapper));
+    return cssomWrapper;
 }
 
-bool PropertySetCSSStyleDeclaration::isPropertyImplicit(const String& propertyName)
+CSSStyleDeclaration* StylePropertySet::ensureInlineCSSStyleDeclaration(const StyledElement* parentElement) const
 {
-    int propertyID = cssPropertyID(propertyName);
-    if (!propertyID)
-        return false;
-    return m_propertySet->isPropertyImplicit(propertyID);
+    if (m_hasCSSOMWrapper) {
+        ASSERT(propertySetCSSOMWrapperMap().get(this)->parentElement() == parentElement);
+        return propertySetCSSOMWrapperMap().get(this);
+    }
+    m_hasCSSOMWrapper = true;
+    PropertySetCSSStyleDeclaration* cssomWrapper = new InlineCSSStyleDeclaration(const_cast<StylePropertySet*>(this), const_cast<StyledElement*>(parentElement));
+    propertySetCSSOMWrapperMap().add(this, adoptPtr(cssomWrapper));
+    return cssomWrapper;
 }
 
-void PropertySetCSSStyleDeclaration::setProperty(const String& propertyName, const String& value, const String& priority, ExceptionCode& ec)
+void StylePropertySet::clearParentRule(CSSRule* rule)
 {
-    int propertyID = cssPropertyID(propertyName);
-    if (!propertyID)
+    if (!m_hasCSSOMWrapper)
         return;
-    bool important = priority.find("important", 0, false) != notFound;
-    ec = 0;
-    m_propertySet->setProperty(propertyID, value, important, true);
-}
-
-String PropertySetCSSStyleDeclaration::removeProperty(const String& propertyName, ExceptionCode& ec)
-{
-    int propertyID = cssPropertyID(propertyName);
-    if (!propertyID)
-        return String();
-    ec = 0;
-    return m_propertySet->removeProperty(propertyID, true, true);
-}
-
-PassRefPtr<CSSValue> PropertySetCSSStyleDeclaration::getPropertyCSSValueInternal(CSSPropertyID propertyID)
-{ 
-    return m_propertySet->getPropertyCSSValue(propertyID); 
-}
-
-String PropertySetCSSStyleDeclaration::getPropertyValueInternal(CSSPropertyID propertyID)
-{ 
-    return m_propertySet->getPropertyValue(propertyID); 
+    ASSERT_UNUSED(rule, static_cast<CSSStyleDeclaration*>(propertySetCSSOMWrapperMap().get(this))->parentRule() == rule);
+    propertySetCSSOMWrapperMap().get(this)->clearParentRule();
 }
 
-void PropertySetCSSStyleDeclaration::setPropertyInternal(CSSPropertyID propertyID, const String& value, bool important, ExceptionCode& ec)
-{ 
-    ec = 0;
-    m_propertySet->setProperty(propertyID, value, important, true);
-}
-
-CSSStyleSheet* PropertySetCSSStyleDeclaration::parentStyleSheet() const
-{ 
-    return m_propertySet->contextStyleSheet(); 
-}
-
-PassRefPtr<StylePropertySet> PropertySetCSSStyleDeclaration::copy() const
+void StylePropertySet::clearParentElement(StyledElement* element)
 {
-    return m_propertySet->copy();
-}
-
-PassRefPtr<StylePropertySet> PropertySetCSSStyleDeclaration::makeMutable()
-{
-    ASSERT(m_propertySet->m_cssStyleDeclaration == this || (!m_propertySet->m_cssStyleDeclaration && m_propertySet->hasOneRef()));
-    if (!m_propertySet->m_cssStyleDeclaration)
-        m_propertySet->m_cssStyleDeclaration = this;
-    return m_propertySet;
+    if (!m_hasCSSOMWrapper)
+        return;
+    ASSERT_UNUSED(element, propertySetCSSOMWrapperMap().get(this)->parentElement() == element);
+    propertySetCSSOMWrapperMap().get(this)->clearParentElement();
 }
 
-bool PropertySetCSSStyleDeclaration::cssPropertyMatches(const CSSProperty* property) const
-{
-    return m_propertySet->propertyMatches(property);
-}
+class SameSizeAsStylePropertySet : public RefCounted<SameSizeAsStylePropertySet> {
+    Vector<CSSProperty, 4> properties;
+    unsigned bitfield;
+};
+COMPILE_ASSERT(sizeof(StylePropertySet) == sizeof(SameSizeAsStylePropertySet), style_property_set_should_stay_small);
 
 } // namespace WebCore
diff --git a/Source/WebCore/css/StylePropertySet.h b/Source/WebCore/css/StylePropertySet.h
index a61b3767d..9aeb2e4ae 100644
--- a/Source/WebCore/css/StylePropertySet.h
+++ b/Source/WebCore/css/StylePropertySet.h
@@ -23,18 +23,19 @@
 
 #include "CSSPrimitiveValue.h"
 #include "CSSProperty.h"
-#include "CSSStyleDeclaration.h"
-#include "KURLHash.h"
-#include "PlatformString.h"
 #include <wtf/ListHashSet.h>
 #include <wtf/Vector.h>
+#include <wtf/text/WTFString.h>
 
 namespace WebCore {
 
+class CSSRule;
+class CSSStyleDeclaration;
+class KURL;
 class PropertySetCSSStyleDeclaration;
 class StyledElement;
 
-class StylePropertySet : public WTF::RefCountedBase {
+class StylePropertySet : public RefCounted<StylePropertySet> {
 public:
     ~StylePropertySet();
 
@@ -42,67 +43,52 @@ public:
     {
         return adoptRef(new StylePropertySet);
     }
-    static PassRefPtr<StylePropertySet> create(CSSRule* parentRule)
+    static PassRefPtr<StylePropertySet> create(const CSSProperty* const* properties, int numProperties, bool useStrictParsing)
     {
-        return adoptRef(new StylePropertySet(parentRule));
-    }
-    static PassRefPtr<StylePropertySet> create(CSSRule* parentRule, const CSSProperty* const* properties, int numProperties)
-    {
-        return adoptRef(new StylePropertySet(parentRule, properties, numProperties));
+        return adoptRef(new StylePropertySet(properties, numProperties, useStrictParsing));
     }
     static PassRefPtr<StylePropertySet> create(const Vector<CSSProperty>& properties)
     {
-        return adoptRef(new StylePropertySet(0, properties));
-    }
-    static PassRefPtr<StylePropertySet> createInline(StyledElement* element)
-    {
-        return adoptRef(new StylePropertySet(element, /*isInlineStyle*/ true));
+        return adoptRef(new StylePropertySet(properties));
     }
-    static PassRefPtr<StylePropertySet> createAttributeStyle(StyledElement* element)
-    {
-        return adoptRef(new StylePropertySet(element, /*isInlineStyle*/ false));
-    }
-
-    void deref();
 
     unsigned propertyCount() const { return m_properties.size(); }
     bool isEmpty() const { return m_properties.isEmpty(); }
     const CSSProperty& propertyAt(unsigned index) const { return m_properties[index]; }
 
+    void shrinkToFit() { m_properties.shrinkToFit(); }
+
     PassRefPtr<CSSValue> getPropertyCSSValue(int propertyID) const;
     String getPropertyValue(int propertyID) const;
     bool propertyIsImportant(int propertyID) const;
     int getPropertyShorthand(int propertyID) const;
     bool isPropertyImplicit(int propertyID) const;
 
-    bool setProperty(int propertyID, int value, bool important = false) { return setProperty(propertyID, value, important, true); }
-    bool setProperty(int propertyId, double value, CSSPrimitiveValue::UnitTypes unit, bool important = false) { return setProperty(propertyId, value, unit, important, true); }
-    bool setProperty(int propertyID, const String& value, bool important = false) { return setProperty(propertyID, value, important, true); }
+    // These expand shorthand properties into multiple properties.
+    bool setProperty(int propertyID, const String& value, bool important = false, CSSStyleSheet* contextStyleSheet = 0);
+    void setProperty(int propertyID, PassRefPtr<CSSValue>, bool important = false);
+
+    // These do not. FIXME: This is too messy, we can do better.
+    bool setProperty(int propertyID, int value, bool important = false, CSSStyleSheet* contextStyleSheet = 0);
     void setProperty(const CSSProperty&, CSSProperty* slot = 0);
     
-    void removeProperty(int propertyID) { removeProperty(propertyID, true, false); }
-    String removeProperty(int propertyID, bool notifyChanged, bool returnText);
+    bool removeProperty(int propertyID, String* returnText = 0);
 
-    // The following parses an entire new style declaration.
-    void parseDeclaration(const String& styleDeclaration);
+    void parseDeclaration(const String& styleDeclaration, CSSStyleSheet* contextStyleSheet);
 
-    // Besides adding the properties, this also removes any existing properties with these IDs.
-    // It does no notification since it's called by the parser.
     void addParsedProperties(const CSSProperty* const *, int numProperties);
-    // This does no change notifications since it's only called by createMarkup.
     void addParsedProperty(const CSSProperty&);
 
     PassRefPtr<StylePropertySet> copyBlockProperties() const;
     void removeBlockProperties();
-    void removePropertiesInSet(const int* set, unsigned length) { removePropertiesInSet(set, length, true); }
+    bool removePropertiesInSet(const int* set, unsigned length);
 
     void merge(const StylePropertySet*, bool argOverridesOnConflict = true);
 
     void setStrictParsing(bool b) { m_strictParsing = b; }
     bool useStrictParsing() const { return m_strictParsing; }
-    bool isInlineStyleDeclaration() const { return m_isInlineStyleDeclaration; }
 
-    void addSubresourceStyleURLs(ListHashSet<KURL>&);
+    void addSubresourceStyleURLs(ListHashSet<KURL>&, CSSStyleSheet* contextStyleSheet);
 
     PassRefPtr<StylePropertySet> copy() const;
     // Used by StyledElement::copyNonAttributeProperties().
@@ -112,25 +98,20 @@ public:
     void removeEquivalentProperties(const CSSStyleDeclaration*);
 
     PassRefPtr<StylePropertySet> copyPropertiesInSet(const int* set, unsigned length) const;
-
-    CSSRule* parentRuleInternal() const { return m_parentIsElement ? 0 : m_parent.rule; }
-    void clearParentRule() { ASSERT(!m_parentIsElement); m_parent.rule = 0; }
-
-    StyledElement* parentElement() const { ASSERT(m_parentIsElement); return m_parent.element; }
-    void clearParentElement() { ASSERT(m_parentIsElement); m_parent.element = 0; }
-
-    CSSStyleSheet* contextStyleSheet() const;
     
     String asText() const;
     
+    void clearParentRule(CSSRule*);
+    void clearParentElement(StyledElement*);
+
     CSSStyleDeclaration* ensureCSSStyleDeclaration() const;
+    CSSStyleDeclaration* ensureRuleCSSStyleDeclaration(const CSSRule* parentRule) const;
+    CSSStyleDeclaration* ensureInlineCSSStyleDeclaration(const StyledElement* parentElement) const;
 
 private:
     StylePropertySet();
-    StylePropertySet(CSSRule* parentRule);
-    StylePropertySet(CSSRule* parentRule, const Vector<CSSProperty>&);
-    StylePropertySet(CSSRule* parentRule, const CSSProperty* const *, int numProperties);
-    StylePropertySet(StyledElement*, bool isInlineStyle);
+    StylePropertySet(const Vector<CSSProperty>&);
+    StylePropertySet(const CSSProperty* const *, int numProperties, bool useStrictParsing);
 
     void setNeedsStyleRecalc();
 
@@ -146,30 +127,16 @@ private:
     template<size_t size> String getCommonValue(const int (&properties)[size]) const { return getCommonValue(properties, size); }
     template<size_t size> String getLayeredShorthandValue(const int (&properties)[size]) const { return getLayeredShorthandValue(properties, size); }
 
-    bool setProperty(int propertyID, int value, bool important, bool notifyChanged);
-    bool setProperty(int propertyId, double value, CSSPrimitiveValue::UnitTypes, bool important, bool notifyChanged);
-    bool setProperty(int propertyID, const String& value, bool important, bool notifyChanged);
-    bool removeShorthandProperty(int propertyID, bool notifyChanged);
-    bool removePropertiesInSet(const int* set, unsigned length, bool notifyChanged);
+    bool removeShorthandProperty(int propertyID);
     bool propertyMatches(const CSSProperty*) const;
 
-    const CSSProperty* findPropertyWithId(int propertyId) const;
-    CSSProperty* findPropertyWithId(int propertyId);
+    const CSSProperty* findPropertyWithId(int propertyID) const;
+    CSSProperty* findPropertyWithId(int propertyID);
 
     Vector<CSSProperty, 4> m_properties;
 
     bool m_strictParsing : 1;
-    bool m_parentIsElement : 1;
-    bool m_isInlineStyleDeclaration : 1;
-
-    union Parent {
-        Parent(CSSRule* rule) : rule(rule) { }
-        Parent(StyledElement* element) : element(element) { }
-        CSSRule* rule;
-        StyledElement* element;
-    } m_parent;
-    
-    mutable RefPtr<PropertySetCSSStyleDeclaration> m_cssStyleDeclaration;
+    mutable bool m_hasCSSOMWrapper : 1;
     
     friend class PropertySetCSSStyleDeclaration;
 };
diff --git a/Source/WebCore/css/StyleSheet.idl b/Source/WebCore/css/StyleSheet.idl
index cad4da4a1..9e20d84ac 100644
--- a/Source/WebCore/css/StyleSheet.idl
+++ b/Source/WebCore/css/StyleSheet.idl
@@ -24,16 +24,16 @@ module stylesheets {
     interface [
         JSCustomMarkFunction,
         JSGenerateIsReachable,
-        JSCustomToJS,
+        CustomToJSObject,
         ObjCPolymorphic,
         V8DependentLifetime
     ] StyleSheet {
-        readonly attribute [ConvertNullStringTo=Null] DOMString        type;
+        readonly attribute [TreatReturnedNullStringAs=Null] DOMString        type;
                  attribute boolean          disabled;
         readonly attribute Node             ownerNode;
         readonly attribute StyleSheet       parentStyleSheet;
-        readonly attribute [ConvertNullStringTo=Null] DOMString        href;
-        readonly attribute [ConvertNullStringTo=Null] DOMString        title;
+        readonly attribute [TreatReturnedNullStringAs=Null] DOMString        href;
+        readonly attribute [TreatReturnedNullStringAs=Null] DOMString        title;
         readonly attribute MediaList        media;
 
 #if defined(LANGUAGE_CPP) && LANGUAGE_CPP
diff --git a/Source/WebCore/css/StyleSheetList.idl b/Source/WebCore/css/StyleSheetList.idl
index 67390b2dd..3a7b185cd 100644
--- a/Source/WebCore/css/StyleSheetList.idl
+++ b/Source/WebCore/css/StyleSheetList.idl
@@ -28,7 +28,7 @@ module stylesheets {
         V8DependentLifetime
     ] StyleSheetList {
         readonly attribute unsigned long    length;
-        StyleSheet         item(in [Optional=CallWithDefaultValue] unsigned long index);
+        StyleSheet         item(in [Optional=DefaultIsUndefined] unsigned long index);
     };
 
 }
diff --git a/Source/WebCore/css/WebKitCSSKeyframeRule.cpp b/Source/WebCore/css/WebKitCSSKeyframeRule.cpp
index 36742a9b3..59f650ff0 100644
--- a/Source/WebCore/css/WebKitCSSKeyframeRule.cpp
+++ b/Source/WebCore/css/WebKitCSSKeyframeRule.cpp
@@ -38,7 +38,7 @@ WebKitCSSKeyframeRule::WebKitCSSKeyframeRule(CSSStyleSheet* parent)
 WebKitCSSKeyframeRule::~WebKitCSSKeyframeRule()
 {
     if (m_style)
-        m_style->clearParentRule();
+        m_style->clearParentRule(this);
 }
 
 String WebKitCSSKeyframeRule::cssText() const
@@ -54,7 +54,6 @@ String WebKitCSSKeyframeRule::cssText() const
 
 void WebKitCSSKeyframeRule::setDeclaration(PassRefPtr<StylePropertySet> style)
 {
-    ASSERT(style->parentRuleInternal() == this);
     m_style = style;
 }
 
diff --git a/Source/WebCore/css/WebKitCSSKeyframeRule.h b/Source/WebCore/css/WebKitCSSKeyframeRule.h
index a3d3a2659..4a98573da 100644
--- a/Source/WebCore/css/WebKitCSSKeyframeRule.h
+++ b/Source/WebCore/css/WebKitCSSKeyframeRule.h
@@ -53,7 +53,7 @@ public:
 
     void getKeys(Vector<float>& keys) const   { parseKeyString(m_key, keys); }
 
-    CSSStyleDeclaration* style() const { return m_style ? m_style->ensureCSSStyleDeclaration() : 0; }
+    CSSStyleDeclaration* style() const { return m_style ? m_style->ensureRuleCSSStyleDeclaration(this) : 0; }
 
     String cssText() const;
 
diff --git a/Source/WebCore/css/WebKitCSSKeyframesRule.idl b/Source/WebCore/css/WebKitCSSKeyframesRule.idl
index daf2e7eba..fa0ea2a1b 100644
--- a/Source/WebCore/css/WebKitCSSKeyframesRule.idl
+++ b/Source/WebCore/css/WebKitCSSKeyframesRule.idl
@@ -33,12 +33,12 @@ module css {
         IndexedGetter
     ] WebKitCSSKeyframesRule : CSSRule {
 
-        attribute [ConvertNullStringTo=Null, TreatNullAs=NullString] DOMString name;
+        attribute [TreatReturnedNullStringAs=Null, TreatNullAs=NullString] DOMString name;
         readonly attribute CSSRuleList cssRules;
         
-        void insertRule(in [Optional=CallWithDefaultValue] DOMString rule);
-        void deleteRule(in [Optional=CallWithDefaultValue] DOMString key);
-        WebKitCSSKeyframeRule findRule(in [Optional=CallWithDefaultValue] DOMString key);
+        void insertRule(in [Optional=DefaultIsUndefined] DOMString rule);
+        void deleteRule(in [Optional=DefaultIsUndefined] DOMString key);
+        WebKitCSSKeyframeRule findRule(in [Optional=DefaultIsUndefined] DOMString key);
     };
 
 }
diff --git a/Source/WebCore/css/WebKitCSSMatrix.cpp b/Source/WebCore/css/WebKitCSSMatrix.cpp
index 86e88b204..9aeea7715 100644
--- a/Source/WebCore/css/WebKitCSSMatrix.cpp
+++ b/Source/WebCore/css/WebKitCSSMatrix.cpp
@@ -53,7 +53,7 @@ WebKitCSSMatrix::~WebKitCSSMatrix()
 void WebKitCSSMatrix::setMatrixValue(const String& string, ExceptionCode& ec)
 {
     RefPtr<StylePropertySet> styleDeclaration = StylePropertySet::create();
-    if (CSSParser::parseValue(styleDeclaration.get(), CSSPropertyWebkitTransform, string, true, true)) {
+    if (CSSParser::parseValue(styleDeclaration.get(), CSSPropertyWebkitTransform, string, true, true, 0)) {
         // Convert to TransformOperations. This can fail if a property
         // requires style (i.e., param uses 'ems' or 'exs')
         RefPtr<CSSValue> value = styleDeclaration->getPropertyCSSValue(CSSPropertyWebkitTransform);
diff --git a/Source/WebCore/css/WebKitCSSMatrix.idl b/Source/WebCore/css/WebKitCSSMatrix.idl
index c6adabfa4..08fd6641d 100644
--- a/Source/WebCore/css/WebKitCSSMatrix.idl
+++ b/Source/WebCore/css/WebKitCSSMatrix.idl
@@ -28,7 +28,7 @@ module css {
     // Introduced in DOM Level ?:
     interface [
         ConstructorParameters=1,
-        Constructor(in [Optional=CallWithNullValue] DOMString cssValue),
+        Constructor(in [Optional=DefaultIsNullString] DOMString cssValue),
         ConstructorRaisesException,
     ] WebKitCSSMatrix {
 
@@ -57,49 +57,49 @@ module css {
         attribute double m43;
         attribute double m44;
 
-        void setMatrixValue(in [Optional=CallWithDefaultValue] DOMString string) raises (DOMException);
+        void setMatrixValue(in [Optional=DefaultIsUndefined] DOMString string) raises (DOMException);
         
         // Multiply this matrix by secondMatrix, on the right (result = this * secondMatrix)
-        [Immutable] WebKitCSSMatrix multiply(in [Optional=CallWithDefaultValue] WebKitCSSMatrix secondMatrix);
+        [Immutable] WebKitCSSMatrix multiply(in [Optional=DefaultIsUndefined] WebKitCSSMatrix secondMatrix);
         
         // Return the inverse of this matrix. Throw an exception if the matrix is not invertible
         [Immutable] WebKitCSSMatrix inverse() raises (DOMException);
         
         // Return this matrix translated by the passed values.
         // Passing a NaN will use a value of 0. This allows the 3D form to used for 2D operations    
-        [Immutable] WebKitCSSMatrix translate(in [Optional=CallWithDefaultValue] double x, 
-                                              in [Optional=CallWithDefaultValue] double y, 
-                                              in [Optional=CallWithDefaultValue] double z);
+        [Immutable] WebKitCSSMatrix translate(in [Optional=DefaultIsUndefined] double x, 
+                                              in [Optional=DefaultIsUndefined] double y, 
+                                              in [Optional=DefaultIsUndefined] double z);
         
         // Returns this matrix scaled by the passed values.
         // Passing scaleX or scaleZ as NaN uses a value of 1, but passing scaleY of NaN 
         // makes it the same as scaleX. This allows the 3D form to used for 2D operations
-        [Immutable] WebKitCSSMatrix scale(in [Optional=CallWithDefaultValue] double scaleX, 
-                                          in [Optional=CallWithDefaultValue] double scaleY, 
-                                          in [Optional=CallWithDefaultValue] double scaleZ);
+        [Immutable] WebKitCSSMatrix scale(in [Optional=DefaultIsUndefined] double scaleX, 
+                                          in [Optional=DefaultIsUndefined] double scaleY, 
+                                          in [Optional=DefaultIsUndefined] double scaleZ);
         
         // Returns this matrix rotated by the passed values.
         // If rotY and rotZ are NaN, rotate about Z (rotX=0, rotateY=0, rotateZ=rotX).
         // Otherwise use a rotation value of 0 for any passed NaN.    
-        [Immutable] WebKitCSSMatrix rotate(in [Optional=CallWithDefaultValue] double rotX, 
-                                           in [Optional=CallWithDefaultValue] double rotY, 
-                                           in [Optional=CallWithDefaultValue] double rotZ);
+        [Immutable] WebKitCSSMatrix rotate(in [Optional=DefaultIsUndefined] double rotX, 
+                                           in [Optional=DefaultIsUndefined] double rotY, 
+                                           in [Optional=DefaultIsUndefined] double rotZ);
         
         // Returns this matrix rotated about the passed axis by the passed angle.
         // Passing a NaN will use a value of 0. If the axis is (0,0,0) use a value
         // of (0,0,1).
-        [Immutable] WebKitCSSMatrix rotateAxisAngle(in [Optional=CallWithDefaultValue] double x, 
-                                                    in [Optional=CallWithDefaultValue] double y, 
-                                                    in [Optional=CallWithDefaultValue] double z, 
-                                                    in [Optional=CallWithDefaultValue] double angle);
+        [Immutable] WebKitCSSMatrix rotateAxisAngle(in [Optional=DefaultIsUndefined] double x, 
+                                                    in [Optional=DefaultIsUndefined] double y, 
+                                                    in [Optional=DefaultIsUndefined] double z, 
+                                                    in [Optional=DefaultIsUndefined] double angle);
 
         // Returns this matrix skewed along the X axis by the passed values.
         // Passing a NaN will use a value of 0.
-        [Immutable] WebKitCSSMatrix skewX(in [Optional=CallWithDefaultValue] double angle);
+        [Immutable] WebKitCSSMatrix skewX(in [Optional=DefaultIsUndefined] double angle);
 
         // Returns this matrix skewed along the Y axis by the passed values.
         // Passing a NaN will use a value of 0.
-        [Immutable] WebKitCSSMatrix skewY(in [Optional=CallWithDefaultValue] double angle);
+        [Immutable] WebKitCSSMatrix skewY(in [Optional=DefaultIsUndefined] double angle);
 
         [NotEnumerable] DOMString toString();
     };
diff --git a/Source/WebCore/css/WebKitCSSShaderValue.cpp b/Source/WebCore/css/WebKitCSSShaderValue.cpp
index 51cf8a30f..ea930304b 100644
--- a/Source/WebCore/css/WebKitCSSShaderValue.cpp
+++ b/Source/WebCore/css/WebKitCSSShaderValue.cpp
@@ -33,6 +33,7 @@
 #include "WebKitCSSShaderValue.h"
 
 #include "CachedResourceLoader.h"
+#include "CSSParser.h"
 #include "Document.h"
 #include "StyleCachedShader.h"
 #include "StylePendingShader.h"
@@ -40,7 +41,8 @@
 namespace WebCore {
 
 WebKitCSSShaderValue::WebKitCSSShaderValue(const String& url)
-    : CSSPrimitiveValue(WebKitCSSShaderClass, url, CSS_URI)
+    : CSSValue(WebKitCSSShaderClass)
+    , m_url(url)
     , m_accessedShader(false)
 {
 }
@@ -56,7 +58,7 @@ StyleCachedShader* WebKitCSSShaderValue::cachedShader(CachedResourceLoader* load
     if (!m_accessedShader) {
         m_accessedShader = true;
 
-        ResourceRequest request(loader->document()->completeURL(getStringValue()));
+        ResourceRequest request(loader->document()->completeURL(m_url));
         if (CachedShader* cachedShader = loader->requestShader(request))
             m_shader = StyleCachedShader::create(cachedShader);
     }
@@ -72,6 +74,10 @@ StyleShader* WebKitCSSShaderValue::cachedOrPendingShader()
     return m_shader.get();
 }
 
+String WebKitCSSShaderValue::customCssText() const
+{
+    return "url(" + quoteCSSURLIfNeeded(m_url) + ")";
+}
 
 } // namespace WebCore
 
diff --git a/Source/WebCore/css/WebKitCSSShaderValue.h b/Source/WebCore/css/WebKitCSSShaderValue.h
index 825482db3..610922001 100644
--- a/Source/WebCore/css/WebKitCSSShaderValue.h
+++ b/Source/WebCore/css/WebKitCSSShaderValue.h
@@ -32,8 +32,7 @@
 
 #if ENABLE(CSS_SHADERS)
 
-#include "CachedResourceHandle.h"
-#include "CSSPrimitiveValue.h"
+#include "CSSValue.h"
 
 namespace WebCore {
 
@@ -41,17 +40,20 @@ class CachedResourceLoader;
 class StyleCachedShader;
 class StyleShader;
 
-class WebKitCSSShaderValue : public CSSPrimitiveValue {
+class WebKitCSSShaderValue : public CSSValue {
 public:
     static PassRefPtr<WebKitCSSShaderValue> create(const String& url) { return adoptRef(new WebKitCSSShaderValue(url)); }
     ~WebKitCSSShaderValue();
 
     StyleCachedShader* cachedShader(CachedResourceLoader*);
     StyleShader* cachedOrPendingShader();
-    
+
+    String customCssText() const;
+
 private:
     WebKitCSSShaderValue(const String& url);
-    
+
+    String m_url;
     RefPtr<StyleShader> m_shader;
     bool m_accessedShader;
 };
diff --git a/Source/WebCore/css/themeChromiumAndroid.css b/Source/WebCore/css/themeChromiumAndroid.css
new file mode 100644
index 000000000..346d836af
--- /dev/null
+++ b/Source/WebCore/css/themeChromiumAndroid.css
@@ -0,0 +1,45 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+/* These styles override other user-agent styles for Chromium on Android. */
+
+select[size],
+select[multiple],
+select[size][multiple] {
+    -webkit-appearance: menulist;
+    -webkit-box-align: center;
+    border: 1px solid;
+    -webkit-border-radius: 5px;
+    white-space: pre;
+}
+
+input[type="date"], input[type="datetime"], input[type="datetime-local"], input[type="time"], input[type="month"] {
+    -webkit-appearance: menulist-button;
+}
diff --git a/Source/WebCore/dom/ActiveDOMObject.cpp b/Source/WebCore/dom/ActiveDOMObject.cpp
index 39a4c4c6b..bb2ec2209 100644
--- a/Source/WebCore/dom/ActiveDOMObject.cpp
+++ b/Source/WebCore/dom/ActiveDOMObject.cpp
@@ -60,6 +60,9 @@ void ContextDestructionObserver::contextDestroyed()
 ActiveDOMObject::ActiveDOMObject(ScriptExecutionContext* scriptExecutionContext, void* upcastPointer)
     : ContextDestructionObserver(scriptExecutionContext)
     , m_pendingActivityCount(0)
+#if !ASSERT_DISABLED
+    , m_suspendIfNeededCalled(false)
+#endif
 {
     if (!m_scriptExecutionContext)
         return;
@@ -73,10 +76,23 @@ ActiveDOMObject::~ActiveDOMObject()
     if (!m_scriptExecutionContext)
         return;
 
+    ASSERT(m_suspendIfNeededCalled);
     ASSERT(m_scriptExecutionContext->isContextThread());
     m_scriptExecutionContext->willDestroyActiveDOMObject(this);
 }
 
+void ActiveDOMObject::suspendIfNeeded()
+{
+#if !ASSERT_DISABLED
+    ASSERT(!m_suspendIfNeededCalled);
+    m_suspendIfNeededCalled = true;
+#endif
+    if (!m_scriptExecutionContext)
+        return;
+
+    m_scriptExecutionContext->suspendActiveDOMObjectIfNeeded(this);
+}
+
 bool ActiveDOMObject::hasPendingActivity() const
 {
     return m_pendingActivityCount;
diff --git a/Source/WebCore/dom/ActiveDOMObject.h b/Source/WebCore/dom/ActiveDOMObject.h
index db7ca66c0..dce6b56dd 100644
--- a/Source/WebCore/dom/ActiveDOMObject.h
+++ b/Source/WebCore/dom/ActiveDOMObject.h
@@ -51,6 +51,13 @@ namespace WebCore {
     public:
         ActiveDOMObject(ScriptExecutionContext*, void* upcastPointer);
 
+        // suspendIfNeeded() should be called exactly once after object construction to synchronize
+        // the suspend state with that in ScriptExecutionContext.
+        void suspendIfNeeded();
+#if !ASSERT_DISABLED
+        bool suspendIfNeededCalled() const { return m_suspendIfNeededCalled; }
+#endif
+
         virtual bool hasPendingActivity() const;
 
         // canSuspend() is used by the caller if there is a choice between suspending and stopping.
@@ -88,6 +95,9 @@ namespace WebCore {
 
     private:
         unsigned m_pendingActivityCount;
+#if !ASSERT_DISABLED
+        bool m_suspendIfNeededCalled;
+#endif
     };
 
 } // namespace WebCore
diff --git a/Source/WebCore/dom/Attr.cpp b/Source/WebCore/dom/Attr.cpp
index 6930fa1dc..e54c8d0df 100644
--- a/Source/WebCore/dom/Attr.cpp
+++ b/Source/WebCore/dom/Attr.cpp
@@ -181,7 +181,7 @@ void Attr::childrenChanged(bool changedByParser, Node* beforeChange, Node* after
     StringBuilder valueBuilder;
     for (Node *n = firstChild(); n; n = n->nextSibling()) {
         if (n->isTextNode())
-            valueBuilder.append(static_cast<Text*>(n)->data());
+            valueBuilder.append(toText(n)->data());
     }
 
     AtomicString newValue = valueBuilder.toString();
diff --git a/Source/WebCore/dom/Attr.h b/Source/WebCore/dom/Attr.h
index 0209f9041..b70357495 100644
--- a/Source/WebCore/dom/Attr.h
+++ b/Source/WebCore/dom/Attr.h
@@ -39,6 +39,7 @@ class CSSStyleDeclaration;
 // destruction. however, this is not yet implemented.
 
 class Attr : public ContainerNode {
+    friend class ElementAttributeData;
     friend class NamedNodeMap;
 public:
     static PassRefPtr<Attr> create(Element*, Document*, PassRefPtr<Attribute>);
diff --git a/Source/WebCore/dom/Attr.idl b/Source/WebCore/dom/Attr.idl
index e3a802cf2..300896723 100644
--- a/Source/WebCore/dom/Attr.idl
+++ b/Source/WebCore/dom/Attr.idl
@@ -27,11 +27,11 @@ module core {
 
         // DOM Level 1
 
-        readonly attribute [ConvertNullStringTo=Null] DOMString name;
+        readonly attribute [TreatReturnedNullStringAs=Null] DOMString name;
 
         readonly attribute boolean specified;
 
-                 attribute [ConvertNullStringTo=Null, TreatNullAs=NullString] DOMString value 
+                 attribute [TreatReturnedNullStringAs=Null, TreatNullAs=NullString] DOMString value 
                      setter raises(DOMException);
 
         // DOM Level 2
diff --git a/Source/WebCore/dom/CharacterData.idl b/Source/WebCore/dom/CharacterData.idl
index dcf796ae5..2bb3d4e49 100644
--- a/Source/WebCore/dom/CharacterData.idl
+++ b/Source/WebCore/dom/CharacterData.idl
@@ -26,24 +26,24 @@ module core {
 
         readonly attribute unsigned long length;
         
-        [ConvertNullStringTo=Null, ObjCLegacyUnnamedParameters] DOMString substringData(in [IsIndex,Optional=CallWithDefaultValue] unsigned long offset, 
-                                                                         in [IsIndex,Optional=CallWithDefaultValue] unsigned long length)
+        [TreatReturnedNullStringAs=Null, ObjCLegacyUnnamedParameters] DOMString substringData(in [IsIndex,Optional=DefaultIsUndefined] unsigned long offset, 
+                                                                         in [IsIndex,Optional=DefaultIsUndefined] unsigned long length)
             raises(DOMException);
 
-        void appendData(in [Optional=CallWithDefaultValue] DOMString data)
+        void appendData(in [Optional=DefaultIsUndefined] DOMString data)
             raises(DOMException);
 
-        [ObjCLegacyUnnamedParameters] void insertData(in [IsIndex,Optional=CallWithDefaultValue] unsigned long offset, 
-                                       in [Optional=CallWithDefaultValue] DOMString data)
+        [ObjCLegacyUnnamedParameters] void insertData(in [IsIndex,Optional=DefaultIsUndefined] unsigned long offset, 
+                                       in [Optional=DefaultIsUndefined] DOMString data)
             raises(DOMException);
 
-        [ObjCLegacyUnnamedParameters] void deleteData(in [IsIndex,Optional=CallWithDefaultValue] unsigned long offset, 
-                                       in [IsIndex,Optional=CallWithDefaultValue] unsigned long length)
+        [ObjCLegacyUnnamedParameters] void deleteData(in [IsIndex,Optional=DefaultIsUndefined] unsigned long offset, 
+                                       in [IsIndex,Optional=DefaultIsUndefined] unsigned long length)
             raises(DOMException);
 
-        [ObjCLegacyUnnamedParameters] void replaceData(in [IsIndex,Optional=CallWithDefaultValue] unsigned long offset, 
-                                        in [IsIndex,Optional=CallWithDefaultValue] unsigned long length,
-                                        in [Optional=CallWithDefaultValue] DOMString data)
+        [ObjCLegacyUnnamedParameters] void replaceData(in [IsIndex,Optional=DefaultIsUndefined] unsigned long offset, 
+                                        in [IsIndex,Optional=DefaultIsUndefined] unsigned long length,
+                                        in [Optional=DefaultIsUndefined] DOMString data)
             raises(DOMException);
     
     };
diff --git a/Source/WebCore/dom/ClientRectList.idl b/Source/WebCore/dom/ClientRectList.idl
index 45d6f485f..02f055e6e 100644
--- a/Source/WebCore/dom/ClientRectList.idl
+++ b/Source/WebCore/dom/ClientRectList.idl
@@ -30,7 +30,7 @@ module view {
         IndexedGetter
     ] ClientRectList {
         readonly attribute unsigned long length;
-        ClientRect item(in [IsIndex,Optional=CallWithDefaultValue] unsigned long index);
+        ClientRect item(in [IsIndex,Optional=DefaultIsUndefined] unsigned long index);
         // FIXME: Fix list behavior to allow custom exceptions to be thrown.
     };
 
diff --git a/Source/WebCore/dom/Clipboard.cpp b/Source/WebCore/dom/Clipboard.cpp
index 027992515..2053292a1 100644
--- a/Source/WebCore/dom/Clipboard.cpp
+++ b/Source/WebCore/dom/Clipboard.cpp
@@ -27,6 +27,7 @@
 #include "Clipboard.h"
 
 #include "CachedImage.h"
+#include "DOMStringList.h"
 #include "FileList.h"
 #include "Frame.h"
 #include "FrameLoader.h"
@@ -147,7 +148,7 @@ bool Clipboard::hasStringOfType(const String& type) const
     if (m_policy != ClipboardReadable && m_policy != ClipboardTypesReadable)
         return false;
     
-    return types().contains(type); 
+    return types()->contains(type);
 }
     
 void Clipboard::setDropEffect(const String &effect)
diff --git a/Source/WebCore/dom/Clipboard.h b/Source/WebCore/dom/Clipboard.h
index a07ae9fc5..d33829a6c 100644
--- a/Source/WebCore/dom/Clipboard.h
+++ b/Source/WebCore/dom/Clipboard.h
@@ -33,6 +33,7 @@
 
 namespace WebCore {
 
+    class DOMStringList;
     class DataTransferItemList;
     class DragData;
     class FileList;
@@ -66,7 +67,7 @@ namespace WebCore {
         virtual bool setData(const String& type, const String& data) = 0;
     
         // extensions beyond IE's API
-        virtual HashSet<String> types() const = 0;
+        virtual PassRefPtr<DOMStringList> types() const = 0;
         virtual PassRefPtr<FileList> files() const = 0;
 
         IntPoint dragLocation() const { return m_dragLoc; }
diff --git a/Source/WebCore/dom/Clipboard.idl b/Source/WebCore/dom/Clipboard.idl
index dc453f298..c1c5850ec 100644
--- a/Source/WebCore/dom/Clipboard.idl
+++ b/Source/WebCore/dom/Clipboard.idl
@@ -29,9 +29,9 @@
 module core {
 
     interface Clipboard {
-                 attribute [ConvertNullStringTo=Undefined] DOMString dropEffect;
-                 attribute [ConvertNullStringTo=Undefined] DOMString effectAllowed;
-        readonly attribute [CustomGetter] Array types;
+                 attribute [TreatReturnedNullStringAs=Undefined] DOMString dropEffect;
+                 attribute [TreatReturnedNullStringAs=Undefined] DOMString effectAllowed;
+        readonly attribute DOMStringList types;
         readonly attribute FileList files;
 
         [Custom] void clearData(in [Optional] DOMString type)
diff --git a/Source/WebCore/dom/CompositionEvent.idl b/Source/WebCore/dom/CompositionEvent.idl
index a28292c36..f66ed5ae4 100644
--- a/Source/WebCore/dom/CompositionEvent.idl
+++ b/Source/WebCore/dom/CompositionEvent.idl
@@ -30,11 +30,11 @@ module events {
 
         readonly attribute DOMString data;
 
-        void initCompositionEvent(in [Optional=CallWithDefaultValue] DOMString typeArg, 
-                                  in [Optional=CallWithDefaultValue] boolean canBubbleArg, 
-                                  in [Optional=CallWithDefaultValue] boolean cancelableArg, 
-                                  in [Optional=CallWithDefaultValue] DOMWindow viewArg, 
-                                  in [Optional=CallWithDefaultValue] DOMString dataArg);
+        void initCompositionEvent(in [Optional=DefaultIsUndefined] DOMString typeArg, 
+                                  in [Optional=DefaultIsUndefined] boolean canBubbleArg, 
+                                  in [Optional=DefaultIsUndefined] boolean cancelableArg, 
+                                  in [Optional=DefaultIsUndefined] DOMWindow viewArg, 
+                                  in [Optional=DefaultIsUndefined] DOMString dataArg);
 
     };
 
diff --git a/Source/WebCore/dom/ContainerNode.cpp b/Source/WebCore/dom/ContainerNode.cpp
index dbd2b7259..0a81c6dea 100644
--- a/Source/WebCore/dom/ContainerNode.cpp
+++ b/Source/WebCore/dom/ContainerNode.cpp
@@ -69,7 +69,7 @@ static inline void collectNodes(Node* node, NodeVector& nodes)
 
 static void collectTargetNodes(Node* node, NodeVector& nodes)
 {
-    if (node->nodeType() != Node::DOCUMENT_FRAGMENT_NODE) {
+    if (node->nodeType() != Node::DOCUMENT_FRAGMENT_NODE || node->isShadowRoot()) {
         nodes.append(node);
         return;
     }
@@ -158,11 +158,6 @@ bool ContainerNode::insertBefore(PassRefPtr<Node> newChild, Node* refChild, Exce
         if (ec)
             return false;
 
-        // FIXME: After sending the mutation events, "this" could be destroyed.
-        // We can prevent that by doing a "ref", but first we have to make sure
-        // that no callers call with ref count == 0 and parent = 0 (as of this
-        // writing, there are definitely callers who call that way).
-
         // Due to arbitrary code running in response to a DOM mutation event it's
         // possible that "next" is no longer a child of "this".
         // It's also possible that "child" has been inserted elsewhere.
@@ -293,12 +288,7 @@ bool ContainerNode::replaceChild(PassRefPtr<Node> newChild, Node* oldChild, Exce
     if (ec)
         return false;
 
-    // FIXME: After sending the mutation events, "this" could be destroyed.
-    // We can prevent that by doing a "ref", but first we have to make sure
-    // that no callers call with ref count == 0 and parent = 0 (as of this
-    // writing, there are definitely callers who call that way).
-
-    bool isFragment = newChild->nodeType() == DOCUMENT_FRAGMENT_NODE;
+    bool isFragment = newChild->nodeType() == DOCUMENT_FRAGMENT_NODE && !newChild->isShadowRoot();
 
     // Add the new child(ren)
     RefPtr<Node> child = isFragment ? newChild->firstChild() : newChild;
@@ -469,24 +459,19 @@ bool ContainerNode::removeChild(Node* oldChild, ExceptionCode& ec)
         return false;
     }
 
-    // FIXME: After sending the mutation events, "this" could be destroyed.
-    // We can prevent that by doing a "ref", but first we have to make sure
-    // that no callers call with ref count == 0 and parent = 0 (as of this
-    // writing, there are definitely callers who call that way).
-
     Node* prev = child->previousSibling();
     Node* next = child->nextSibling();
     removeBetween(prev, next, child.get());
 
-    // Dispatch post-removal mutation events
     childrenChanged(false, prev, next, -1);
-    dispatchSubtreeModifiedEvent();
 
     if (child->inDocument())
         child->removedFromDocument();
     else
         child->removedFromTree(true);
 
+    dispatchSubtreeModifiedEvent();
+
     return child;
 }
 
@@ -592,11 +577,10 @@ void ContainerNode::removeChildren()
             removedChild->detach();
     }
 
+    // FIXME: This should be just above dispatchSubtreeModifiedEvent();
     allowEventDispatch();
 
-    // Dispatch a single post-removal mutation event denoting a modified subtree.
     childrenChanged(false, 0, 0, -static_cast<int>(removedChildrenCount));
-    dispatchSubtreeModifiedEvent();
 
     for (i = 0; i < removedChildrenCount; ++i) {
         Node* removedChild = removedChildren[i].get();
@@ -606,6 +590,8 @@ void ContainerNode::removeChildren()
         // document. There is no explanation for this discrepancy between removeChild()
         // and its optimized version removeChildren().
     }
+
+    dispatchSubtreeModifiedEvent();
 }
 
 bool ContainerNode::appendChild(PassRefPtr<Node> newChild, ExceptionCode& ec, bool shouldLazyAttach)
diff --git a/Source/WebCore/dom/ContainerNodeAlgorithms.h b/Source/WebCore/dom/ContainerNodeAlgorithms.h
index 55095a72e..ee69afd16 100644
--- a/Source/WebCore/dom/ContainerNodeAlgorithms.h
+++ b/Source/WebCore/dom/ContainerNodeAlgorithms.h
@@ -135,8 +135,10 @@ namespace Private {
                     head = n;
 
                 tail = n;
-            } else
+            } else {
+                RefPtr<GenericNode> protect(n); // removedFromDocument may remove remove all references to this node.
                 NodeRemovalDispatcher<GenericNode, ShouldDispatchRemovalNotification<GenericNode>::value>::dispatch(n);
+            }
         }
 
         container->setFirstChild(0);
diff --git a/Source/WebCore/dom/CustomEvent.idl b/Source/WebCore/dom/CustomEvent.idl
index 53a1ffca8..9158d58a2 100644
--- a/Source/WebCore/dom/CustomEvent.idl
+++ b/Source/WebCore/dom/CustomEvent.idl
@@ -32,10 +32,10 @@ module events {
     ] CustomEvent : Event {
         readonly attribute [InitializedByEventConstructor] DOMObject detail;
 
-        void initCustomEvent(in [Optional=CallWithDefaultValue] DOMString typeArg, 
-                             in [Optional=CallWithDefaultValue] boolean canBubbleArg, 
-                             in [Optional=CallWithDefaultValue] boolean cancelableArg, 
-                             in [Optional=CallWithDefaultValue] DOMObject detailArg);
+        void initCustomEvent(in [Optional=DefaultIsUndefined] DOMString typeArg, 
+                             in [Optional=DefaultIsUndefined] boolean canBubbleArg, 
+                             in [Optional=DefaultIsUndefined] boolean cancelableArg, 
+                             in [Optional=DefaultIsUndefined] DOMObject detailArg);
     };
 #endif
 
diff --git a/Source/WebCore/dom/DOMAllInOne.cpp b/Source/WebCore/dom/DOMAllInOne.cpp
index 8b1ebbb88..8ec4bfb6b 100644
--- a/Source/WebCore/dom/DOMAllInOne.cpp
+++ b/Source/WebCore/dom/DOMAllInOne.cpp
@@ -33,6 +33,7 @@
 #include "CDATASection.cpp"
 #include "CharacterData.cpp"
 #include "CheckedRadioButtons.cpp"
+#include "ChildListMutationScope.cpp"
 #include "ChildNodeList.cpp"
 #include "ClassNodeList.cpp"
 #include "ClientRect.cpp"
@@ -88,6 +89,9 @@
 #include "MouseEvent.cpp"
 #include "MouseRelatedEvent.cpp"
 #include "MutationEvent.cpp"
+#include "MutationObserverInterestGroup.cpp"
+#include "MutationObserverRegistration.cpp"
+#include "MutationRecord.cpp"
 #include "NameNodeList.cpp"
 #include "NodeFilter.cpp"
 #include "NodeFilterCondition.cpp"
@@ -113,6 +117,7 @@
 #include "SecurityContext.cpp"
 #include "SelectorQuery.cpp"
 #include "ShadowRoot.cpp"
+#include "ShadowRootList.cpp"
 #include "SpaceSplitString.cpp"
 #include "StaticHashSetNodeList.cpp"
 #include "StaticNodeList.cpp"
@@ -135,6 +140,7 @@
 #include "UserTypingGestureIndicator.cpp"
 #include "ViewportArguments.cpp"
 #include "WebKitAnimationEvent.cpp"
+#include "WebKitMutationObserver.cpp"
 #include "WebKitNamedFlow.cpp"
 #include "WebKitTransitionEvent.cpp"
 #include "WheelEvent.cpp"
diff --git a/Source/WebCore/dom/DOMCoreException.idl b/Source/WebCore/dom/DOMCoreException.idl
index 3f25b021a..add5bd9a1 100644
--- a/Source/WebCore/dom/DOMCoreException.idl
+++ b/Source/WebCore/dom/DOMCoreException.idl
@@ -30,7 +30,8 @@ module core {
 
     interface [
         JSNoStaticTables,
-        DoNotCheckConstants
+        DoNotCheckConstants,
+        InterfaceName=DOMException
     ] DOMCoreException {
 
         readonly attribute unsigned short   code;
diff --git a/Source/WebCore/dom/DOMImplementation.cpp b/Source/WebCore/dom/DOMImplementation.cpp
index 33104097e..ae6d3665c 100644
--- a/Source/WebCore/dom/DOMImplementation.cpp
+++ b/Source/WebCore/dom/DOMImplementation.cpp
@@ -364,46 +364,37 @@ PassRefPtr<Document> DOMImplementation::createDocument(const String& type, Frame
     // Plugins cannot take HTML and XHTML from us, and we don't even need to initialize the plugin database for those.
     if (type == "text/html")
         return HTMLDocument::create(frame, url);
-
-    // Plugins cannot take text/plain from us either.
-    if (type == "text/plain")
-        return TextDocument::create(frame, url);
-
     if (type == "application/xhtml+xml")
         return Document::createXHTML(frame, url);
 
 #if ENABLE(FTPDIR)
-    // Plugins cannot take FTP from us either.
+    // Plugins cannot take FTP from us either
     if (type == "application/x-ftp-directory")
         return FTPDirectoryDocument::create(frame, url);
 #endif
 
-    // PDF is the only image type for which a plugin can override built-in support.
-    if (Image::supportsType(type) && type != "application/pdf" && type != "text/pdf")
-        return ImageDocument::create(frame, url);
-
-#if ENABLE(VIDEO)
-     // Check to see if the type can be played by our MediaPlayer, if so create a MediaDocument as
-     // this can not be taken by plugins either.
-     if (MediaPlayer::supportsType(ContentType(type)))
-         return MediaDocument::create(frame, url);
-#endif
-
-    // The plugin database is initialized at this point if plugins are enabled
-    // which is non-zero overhead.
     PluginData* pluginData = 0;
     if (frame && frame->page() && frame->loader()->subframeLoader()->allowPlugins(NotAboutToInstantiatePlugin))
         pluginData = frame->page()->pluginData();
 
-    // At this point anything that can be supported can be overridden by plugins.
-    if (pluginData && pluginData->supportsMimeType(type))
+    // PDF is one image type for which a plugin can override built-in support.
+    // We do not want QuickTime to take over all image types, obviously.
+    if ((type == "application/pdf" || type == "text/pdf") && pluginData && pluginData->supportsMimeType(type))
         return PluginDocument::create(frame, url);
-
-    // Handle PDF for instance if it was not handled by a plugin.
     if (Image::supportsType(type))
         return ImageDocument::create(frame, url);
 
-    // Handle a text document was not handled by a plugin.
+#if ENABLE(VIDEO)
+     // Check to see if the type can be played by our MediaPlayer, if so create a MediaDocument
+     if (MediaPlayer::supportsType(ContentType(type)))
+         return MediaDocument::create(frame, url);
+#endif
+
+    // Everything else except text/plain can be overridden by plugins. In particular, Adobe SVG Viewer should be used for SVG, if installed.
+    // Disallowing plug-ins to use text/plain prevents plug-ins from hijacking a fundamental type that the browser is expected to handle,
+    // and also serves as an optimization to prevent loading the plug-in database in the common case.
+    if (type != "text/plain" && pluginData && pluginData->supportsMimeType(type)) 
+        return PluginDocument::create(frame, url);
     if (isTextMIMEType(type))
         return TextDocument::create(frame, url);
 
diff --git a/Source/WebCore/dom/DOMImplementation.idl b/Source/WebCore/dom/DOMImplementation.idl
index 0a2368e52..cd5709906 100644
--- a/Source/WebCore/dom/DOMImplementation.idl
+++ b/Source/WebCore/dom/DOMImplementation.idl
@@ -27,29 +27,29 @@ module core {
 
         // DOM Level 1
 
-        [ObjCLegacyUnnamedParameters] boolean hasFeature(in [Optional=CallWithDefaultValue] DOMString feature, 
-                                          in [TreatNullAs=NullString,Optional=CallWithDefaultValue] DOMString version);
+        [ObjCLegacyUnnamedParameters] boolean hasFeature(in [Optional=DefaultIsUndefined] DOMString feature, 
+                                          in [TreatNullAs=NullString,Optional=DefaultIsUndefined] DOMString version);
 
         // DOM Level 2
 
-        [ObjCLegacyUnnamedParameters] DocumentType createDocumentType(in [TreatNullAs=NullString, TreatUndefinedAs=NullString,Optional=CallWithDefaultValue] DOMString qualifiedName,
-                                                       in [TreatNullAs=NullString, TreatUndefinedAs=NullString,Optional=CallWithDefaultValue] DOMString publicId,
-                                                       in [TreatNullAs=NullString, TreatUndefinedAs=NullString,Optional=CallWithDefaultValue] DOMString systemId)
+        [ObjCLegacyUnnamedParameters] DocumentType createDocumentType(in [TreatNullAs=NullString, TreatUndefinedAs=NullString,Optional=DefaultIsUndefined] DOMString qualifiedName,
+                                                       in [TreatNullAs=NullString, TreatUndefinedAs=NullString,Optional=DefaultIsUndefined] DOMString publicId,
+                                                       in [TreatNullAs=NullString, TreatUndefinedAs=NullString,Optional=DefaultIsUndefined] DOMString systemId)
             raises(DOMException);
-        [ObjCLegacyUnnamedParameters] Document createDocument(in [TreatNullAs=NullString,Optional=CallWithDefaultValue] DOMString namespaceURI, 
-                                               in [TreatNullAs=NullString,Optional=CallWithDefaultValue] DOMString qualifiedName, 
-                                               in [TreatNullAs=NullString,Optional=CallWithDefaultValue] DocumentType doctype)
+        [ObjCLegacyUnnamedParameters] Document createDocument(in [TreatNullAs=NullString,Optional=DefaultIsUndefined] DOMString namespaceURI, 
+                                               in [TreatNullAs=NullString,Optional=DefaultIsUndefined] DOMString qualifiedName, 
+                                               in [TreatNullAs=NullString,Optional=DefaultIsUndefined] DocumentType doctype)
             raises(DOMException);
 
         // DOMImplementationCSS interface from DOM Level 2 CSS
 
-        [ObjCLegacyUnnamedParameters] CSSStyleSheet createCSSStyleSheet(in [Optional=CallWithDefaultValue] DOMString title,
-                                                         in [Optional=CallWithDefaultValue] DOMString media)
+        [ObjCLegacyUnnamedParameters] CSSStyleSheet createCSSStyleSheet(in [Optional=DefaultIsUndefined] DOMString title,
+                                                         in [Optional=DefaultIsUndefined] DOMString media)
             raises(DOMException);
 
         // HTMLDOMImplementation interface from DOM Level 2 HTML
 
-        HTMLDocument createHTMLDocument(in [Optional=CallWithDefaultValue] DOMString title);
+        HTMLDocument createHTMLDocument(in [Optional=DefaultIsUndefined] DOMString title);
     };
 
 }
diff --git a/Source/WebCore/dom/DOMStringList.idl b/Source/WebCore/dom/DOMStringList.idl
index 8238575c6..8f059ae2b 100644
--- a/Source/WebCore/dom/DOMStringList.idl
+++ b/Source/WebCore/dom/DOMStringList.idl
@@ -29,8 +29,8 @@ module core {
         IndexedGetter
     ] DOMStringList {
         readonly attribute unsigned long length;
-        [ConvertNullStringTo=Null] DOMString item(in [IsIndex,Optional=CallWithDefaultValue] unsigned long index);
-        boolean contains(in [Optional=CallWithDefaultValue] DOMString string);
+        [TreatReturnedNullStringAs=Null] DOMString item(in [IsIndex,Optional=DefaultIsUndefined] unsigned long index);
+        boolean contains(in [Optional=DefaultIsUndefined] DOMString string);
     };
 
 }
diff --git a/Source/WebCore/dom/DOMStringMap.idl b/Source/WebCore/dom/DOMStringMap.idl
index dbda74dba..980d044cd 100644
--- a/Source/WebCore/dom/DOMStringMap.idl
+++ b/Source/WebCore/dom/DOMStringMap.idl
@@ -29,8 +29,9 @@ module core {
         JSGenerateIsReachable=ImplElementRoot,
         NamedGetter,
         CustomDeleteProperty,
-        CustomGetPropertyNames,
+        CustomEnumerateProperty,
         CustomNamedSetter,
+        V8CustomToJSObject
     ] DOMStringMap {
     };
 
diff --git a/Source/WebCore/dom/DataTransferItem.idl b/Source/WebCore/dom/DataTransferItem.idl
index befd7e2b1..0dad33822 100644
--- a/Source/WebCore/dom/DataTransferItem.idl
+++ b/Source/WebCore/dom/DataTransferItem.idl
@@ -36,7 +36,7 @@ module core {
         readonly attribute DOMString kind;
         readonly attribute DOMString type;
 
-        void getAsString(in [Callback,Optional=CallWithDefaultValue] StringCallback callback);
+        void getAsString(in [Callback,Optional=DefaultIsUndefined] StringCallback callback);
         Blob getAsFile();
     };
 
diff --git a/Source/WebCore/dom/DataTransferItemList.idl b/Source/WebCore/dom/DataTransferItemList.idl
index 8fcc47ded..d1de50e79 100644
--- a/Source/WebCore/dom/DataTransferItemList.idl
+++ b/Source/WebCore/dom/DataTransferItemList.idl
@@ -39,12 +39,12 @@ module core {
 #endif
     ] DataTransferItemList {
         readonly attribute long length;
-        DataTransferItem item(in [Optional=CallWithDefaultValue] unsigned long index);
+        DataTransferItem item(in [Optional=DefaultIsUndefined] unsigned long index);
 
         void clear();
         void add(in File file);
-        void add(in [Optional=CallWithDefaultValue] DOMString data, 
-                 in [Optional=CallWithDefaultValue] DOMString type) raises(DOMException);
+        void add(in [Optional=DefaultIsUndefined] DOMString data, 
+                 in [Optional=DefaultIsUndefined] DOMString type) raises(DOMException);
     };
 
 }
diff --git a/Source/WebCore/dom/DeviceMotionClient.h b/Source/WebCore/dom/DeviceMotionClient.h
index 45bf11aea..34e28e2b2 100644
--- a/Source/WebCore/dom/DeviceMotionClient.h
+++ b/Source/WebCore/dom/DeviceMotionClient.h
@@ -30,6 +30,7 @@ namespace WebCore {
 
 class DeviceMotionController;
 class DeviceMotionData;
+class Page;
 
 class DeviceMotionClient {
 public:
@@ -41,6 +42,8 @@ public:
     virtual void deviceMotionControllerDestroyed() = 0;
 };
 
+void provideDeviceMotionTo(Page*, DeviceMotionClient*);
+
 } // namespace WebCore
 
 #endif // DeviceMotionClient_h
diff --git a/Source/WebCore/dom/DeviceMotionController.cpp b/Source/WebCore/dom/DeviceMotionController.cpp
index d7ac3059f..79eacc5e9 100644
--- a/Source/WebCore/dom/DeviceMotionController.cpp
+++ b/Source/WebCore/dom/DeviceMotionController.cpp
@@ -135,4 +135,22 @@ void DeviceMotionController::didChangeDeviceMotion(DeviceMotionData* deviceMotio
         listenersVector[i]->dispatchEvent(event);
 }
 
+const AtomicString& DeviceMotionController::supplementName()
+{
+    DEFINE_STATIC_LOCAL(AtomicString, name, ("DeviceMotionController"));
+    return name;
+}
+
+bool DeviceMotionController::isActiveAt(Page* page)
+{
+    if (DeviceMotionController* self = DeviceMotionController::from(page))
+        return self->isActive();
+    return false;
+}
+
+void provideDeviceMotionTo(Page* page, DeviceMotionClient* client)
+{
+    PageSupplement::provideTo(page, DeviceMotionController::supplementName(), DeviceMotionController::create(client));
+}
+
 } // namespace WebCore
diff --git a/Source/WebCore/dom/DeviceMotionController.h b/Source/WebCore/dom/DeviceMotionController.h
index bb8cca961..996c98861 100644
--- a/Source/WebCore/dom/DeviceMotionController.h
+++ b/Source/WebCore/dom/DeviceMotionController.h
@@ -27,6 +27,7 @@
 #define DeviceMotionController_h
 
 #include "DOMWindow.h"
+#include "PageSupplement.h"
 #include "Timer.h"
 #include <wtf/HashCountedSet.h>
 
@@ -35,7 +36,7 @@ namespace WebCore {
 class DeviceMotionData;
 class DeviceMotionClient;
 
-class DeviceMotionController {
+class DeviceMotionController : public PageSupplement {
 public:
     ~DeviceMotionController();
 
@@ -52,6 +53,11 @@ public:
 
     bool isActive() { return !m_listeners.isEmpty(); }
 
+    static const AtomicString& supplementName();
+    static DeviceMotionController* from(Frame* frame) { return static_cast<DeviceMotionController*>(PageSupplement::from(frame, supplementName())); }
+    static DeviceMotionController* from(Page* page) { return static_cast<DeviceMotionController*>(PageSupplement::from(page, supplementName())); }
+    static bool isActiveAt(Page*);
+
 private:
     DeviceMotionController(DeviceMotionClient*);
 
diff --git a/Source/WebCore/dom/DeviceMotionEvent.idl b/Source/WebCore/dom/DeviceMotionEvent.idl
index fe1b7503e..bb55f7cce 100644
--- a/Source/WebCore/dom/DeviceMotionEvent.idl
+++ b/Source/WebCore/dom/DeviceMotionEvent.idl
@@ -32,13 +32,13 @@ module core {
         readonly attribute [Custom] Acceleration accelerationIncludingGravity;
         readonly attribute [Custom] RotationRate rotationRate;
         readonly attribute [Custom] double interval;
-        [Custom] void initDeviceMotionEvent(in [Optional=CallWithDefaultValue] DOMString type, 
-                                            in [Optional=CallWithDefaultValue] boolean bubbles, 
-                                            in [Optional=CallWithDefaultValue] boolean cancelable, 
-                                            in [Optional=CallWithDefaultValue] Acceleration acceleration, 
-                                            in [Optional=CallWithDefaultValue] Acceleration accelerationIncludingGravity, 
-                                            in [Optional=CallWithDefaultValue] RotationRate rotationRate, 
-                                            in [Optional=CallWithDefaultValue] double interval);
+        [Custom] void initDeviceMotionEvent(in [Optional=DefaultIsUndefined] DOMString type, 
+                                            in [Optional=DefaultIsUndefined] boolean bubbles, 
+                                            in [Optional=DefaultIsUndefined] boolean cancelable, 
+                                            in [Optional=DefaultIsUndefined] Acceleration acceleration, 
+                                            in [Optional=DefaultIsUndefined] Acceleration accelerationIncludingGravity, 
+                                            in [Optional=DefaultIsUndefined] RotationRate rotationRate, 
+                                            in [Optional=DefaultIsUndefined] double interval);
     };
 
 }
diff --git a/Source/WebCore/dom/DeviceOrientationClient.h b/Source/WebCore/dom/DeviceOrientationClient.h
index 347c3b399..2c16b0cd8 100644
--- a/Source/WebCore/dom/DeviceOrientationClient.h
+++ b/Source/WebCore/dom/DeviceOrientationClient.h
@@ -30,6 +30,7 @@ namespace WebCore {
 
 class DeviceOrientation;
 class DeviceOrientationController;
+class Page;
 
 class DeviceOrientationClient {
 public:
@@ -42,6 +43,8 @@ public:
     virtual void deviceOrientationControllerDestroyed() = 0;
 };
 
+void provideDeviceOrientationTo(Page*, DeviceOrientationClient*);
+
 } // namespace WebCore
 
 #endif // DeviceOrientationClient_h
diff --git a/Source/WebCore/dom/DeviceOrientationController.cpp b/Source/WebCore/dom/DeviceOrientationController.cpp
index 68683fd05..d298b3f44 100644
--- a/Source/WebCore/dom/DeviceOrientationController.cpp
+++ b/Source/WebCore/dom/DeviceOrientationController.cpp
@@ -137,4 +137,22 @@ void DeviceOrientationController::didChangeDeviceOrientation(DeviceOrientation*
         listenersVector[i]->dispatchEvent(event);
 }
 
+const AtomicString& DeviceOrientationController::supplementName()
+{
+    DEFINE_STATIC_LOCAL(AtomicString, name, ("DeviceOrientationController"));
+    return name;
+}
+
+bool DeviceOrientationController::isActiveAt(Page* page)
+{
+    if (DeviceOrientationController* self = DeviceOrientationController::from(page))
+        return self->isActive();
+    return false;
+}
+
+void provideDeviceOrientationTo(Page* page, DeviceOrientationClient* client)
+{
+    PageSupplement::provideTo(page, DeviceOrientationController::supplementName(), DeviceOrientationController::create(page, client));
+}
+
 } // namespace WebCore
diff --git a/Source/WebCore/dom/DeviceOrientationController.h b/Source/WebCore/dom/DeviceOrientationController.h
index 1b87998d9..d8efaca39 100644
--- a/Source/WebCore/dom/DeviceOrientationController.h
+++ b/Source/WebCore/dom/DeviceOrientationController.h
@@ -27,6 +27,7 @@
 #define DeviceOrientationController_h
 
 #include "DOMWindow.h"
+#include "PageSupplement.h"
 #include "Timer.h"
 
 #include <wtf/HashCountedSet.h>
@@ -37,7 +38,7 @@ class DeviceOrientation;
 class DeviceOrientationClient;
 class Page;
 
-class DeviceOrientationController {
+class DeviceOrientationController : public PageSupplement {
 public:
     ~DeviceOrientationController();
 
@@ -56,6 +57,11 @@ public:
 
     DeviceOrientationClient* client() const { return m_client; }
 
+    static const AtomicString& supplementName();
+    static DeviceOrientationController* from(Frame* frame) { return static_cast<DeviceOrientationController*>(PageSupplement::from(frame, supplementName())); }
+    static DeviceOrientationController* from(Page* page) { return static_cast<DeviceOrientationController*>(PageSupplement::from(page, supplementName())); }
+    static bool isActiveAt(Page*);
+
 private:
     DeviceOrientationController(Page*, DeviceOrientationClient*);
 
diff --git a/Source/WebCore/dom/DeviceOrientationEvent.idl b/Source/WebCore/dom/DeviceOrientationEvent.idl
index 11833be92..aed38ffe3 100644
--- a/Source/WebCore/dom/DeviceOrientationEvent.idl
+++ b/Source/WebCore/dom/DeviceOrientationEvent.idl
@@ -32,13 +32,13 @@ module core {
         readonly attribute [Custom] double beta;
         readonly attribute [Custom] double gamma;
         readonly attribute [Custom] boolean absolute;
-        [Custom] void initDeviceOrientationEvent(in [Optional=CallWithDefaultValue] DOMString type, 
-                                                 in [Optional=CallWithDefaultValue] boolean bubbles, 
-                                                 in [Optional=CallWithDefaultValue] boolean cancelable, 
-                                                 in [Optional=CallWithDefaultValue] double alpha, 
-                                                 in [Optional=CallWithDefaultValue] double beta, 
-                                                 in [Optional=CallWithDefaultValue] double gamma,
-                                                 in [Optional=CallWithDefaultValue] boolean absolute);
+        [Custom] void initDeviceOrientationEvent(in [Optional=DefaultIsUndefined] DOMString type, 
+                                                 in [Optional=DefaultIsUndefined] boolean bubbles, 
+                                                 in [Optional=DefaultIsUndefined] boolean cancelable, 
+                                                 in [Optional=DefaultIsUndefined] double alpha, 
+                                                 in [Optional=DefaultIsUndefined] double beta, 
+                                                 in [Optional=DefaultIsUndefined] double gamma,
+                                                 in [Optional=DefaultIsUndefined] boolean absolute);
     };
 
 }
diff --git a/Source/WebCore/dom/Document.cpp b/Source/WebCore/dom/Document.cpp
index 7e9293672..e85d22f2c 100644
--- a/Source/WebCore/dom/Document.cpp
+++ b/Source/WebCore/dom/Document.cpp
@@ -33,6 +33,7 @@
 #include "Attr.h"
 #include "Attribute.h"
 #include "CDATASection.h"
+#include "CSSStyleDeclaration.h"
 #include "CSSStyleSelector.h"
 #include "CSSStyleSheet.h"
 #include "CSSValueKeywords.h"
@@ -78,6 +79,7 @@
 #include "GeolocationController.h"
 #include "HashChangeEvent.h"
 #include "HistogramSupport.h"
+#include "History.h"
 #include "HTMLAllCollection.h"
 #include "HTMLAnchorElement.h"
 #include "HTMLBodyElement.h"
@@ -100,6 +102,7 @@
 #include "HitTestRequest.h"
 #include "HitTestResult.h"
 #include "ImageLoader.h"
+#include "InspectorCounters.h"
 #include "InspectorInstrumentation.h"
 #include "Logging.h"
 #include "MediaQueryList.h"
@@ -132,11 +135,13 @@
 #include "ScriptElement.h"
 #include "ScriptEventListener.h"
 #include "ScriptRunner.h"
+#include "ScrollingCoordinator.h"
 #include "SecurityOrigin.h"
 #include "SecurityPolicy.h"
 #include "SegmentedString.h"
 #include "Settings.h"
 #include "ShadowRoot.h"
+#include "ShadowRootList.h"
 #include "StaticHashSetNodeList.h"
 #include "StyleSheetList.h"
 #include "TextResourceDecoder.h"
@@ -201,10 +206,6 @@
 #include "NodeRareData.h"
 #endif
 
-#if ENABLE(THREADED_SCROLLING)
-#include "ScrollingCoordinator.h"
-#endif
-
 using namespace std;
 using namespace WTF;
 using namespace Unicode;
@@ -436,6 +437,7 @@ Document::Document(Frame* frame, const KURL& url, bool isXHTML, bool isHTML)
     , m_writeRecursionIsTooDeep(false)
     , m_writeRecursionDepth(0)
     , m_wheelEventHandlerCount(0)
+    , m_touchEventHandlerCount(0)
     , m_pendingTasksTimer(this, &Document::pendingTasksTimerFired)
 {
     m_document = this;
@@ -508,6 +510,7 @@ Document::Document(Frame* frame, const KURL& url, bool isXHTML, bool isHTML)
 #ifndef NDEBUG
     m_updatingStyleSelector = false;
 #endif
+    InspectorCounters::incrementCounter(InspectorCounters::DocumentCounter);
 }
 
 static void histogramMutationEventUsage(const unsigned short& listenerTypes)
@@ -545,7 +548,6 @@ Document::~Document()
     ASSERT(!m_parser || m_parser->refCount() == 1);
     detachParser();
     m_document = 0;
-    m_cachedResourceLoader.clear();
 
     m_renderArena.clear();
 
@@ -578,10 +580,15 @@ Document::~Document()
     if (m_mediaQueryMatcher)
         m_mediaQueryMatcher->documentDestroyed();
 
+    clearStyleSelector(); // We need to destory CSSFontSelector before destroying m_cachedResourceLoader.
+    m_cachedResourceLoader.clear();
+
     // We must call clearRareData() here since a Document class inherits TreeScope
     // as well as Node. See a comment on TreeScope.h for the reason.
     if (hasRareData())
         clearRareData();
+
+    InspectorCounters::decrementCounter(InspectorCounters::DocumentCounter);
 }
 
 void Document::removedLastRef()
@@ -664,8 +671,11 @@ void Document::buildAccessKeyMap(TreeScope* scope)
         const AtomicString& accessKey = element->getAttribute(accesskeyAttr);
         if (!accessKey.isEmpty())
             m_elementsByAccessKey.set(accessKey.impl(), element);
-        if (ShadowRoot* shadowRoot = element->shadowRoot())
-            buildAccessKeyMap(shadowRoot);
+
+        if (element->hasShadowRoot()) {
+            for (ShadowRoot* root = element->shadowRootList()->youngestShadowRoot(); root; root = root->olderShadowRoot())
+                buildAccessKeyMap(root);
+        }
     }
 }
 
@@ -874,6 +884,11 @@ PassRefPtr<Node> Document::importNode(Node* importedNode, bool deep, ExceptionCo
     case ATTRIBUTE_NODE:
         return Attr::create(0, this, static_cast<Attr*>(importedNode)->attr()->clone());
     case DOCUMENT_FRAGMENT_NODE: {
+        if (importedNode->isShadowRoot()) {
+            // ShadowRoot nodes should not be explicitly importable.
+            // Either they are imported along with their host node, or created implicitly.
+            break;
+        }
         DocumentFragment* oldFragment = static_cast<DocumentFragment*>(importedNode);
         RefPtr<DocumentFragment> newFragment = createDocumentFragment();
         if (deep) {
@@ -896,9 +911,6 @@ PassRefPtr<Node> Document::importNode(Node* importedNode, bool deep, ExceptionCo
     case DOCUMENT_NODE:
     case DOCUMENT_TYPE_NODE:
     case XPATH_NAMESPACE_NODE:
-    case SHADOW_ROOT_NODE:
-        // ShadowRoot nodes should not be explicitly importable.
-        // Either they are imported along with their host node, or created implicitly.
         break;
     }
     ec = NOT_SUPPORTED_ERR;
@@ -1011,8 +1023,15 @@ PassRefPtr<Element> Document::createElement(const QualifiedName& qName, bool cre
     return e.release();
 }
 
+bool Document::cssRegionsEnabled() const
+{
+    return settings() && settings()->cssRegionsEnabled(); 
+}
+
 PassRefPtr<WebKitNamedFlow> Document::webkitGetFlowByName(const String& flowName)
 {
+    if (!cssRegionsEnabled())
+        return 0;
     if (!renderer())
         return 0;
     if (RenderView* view = renderer()->view())
@@ -1944,10 +1963,11 @@ void Document::suspendActiveDOMObjects(ActiveDOMObject::ReasonForSuspension why)
     if (!page())
         return;
 
-    if (page()->deviceMotionController())
-        page()->deviceMotionController()->suspendEventsForAllListeners(domWindow());
-    if (page()->deviceOrientationController())
-        page()->deviceOrientationController()->suspendEventsForAllListeners(domWindow());
+    if (DeviceMotionController* controller = DeviceMotionController::from(page()))
+        controller->suspendEventsForAllListeners(domWindow());
+    if (DeviceOrientationController* controller = DeviceOrientationController::from(page()))
+        controller->suspendEventsForAllListeners(domWindow());
+
 #endif
 }
 
@@ -1959,10 +1979,10 @@ void Document::resumeActiveDOMObjects()
     if (!page())
         return;
 
-    if (page()->deviceMotionController())
-        page()->deviceMotionController()->resumeEventsForAllListeners(domWindow());
-    if (page()->deviceOrientationController())
-        page()->deviceOrientationController()->resumeEventsForAllListeners(domWindow());
+    if (DeviceMotionController* controller = DeviceMotionController::from(page()))
+        controller->resumeEventsForAllListeners(domWindow());
+    if (DeviceOrientationController* controller = DeviceOrientationController::from(page()))
+        controller->resumeEventsForAllListeners(domWindow());
 #endif
 }
 
@@ -2311,7 +2331,7 @@ void Document::implicitClose()
     }
 
     // If painting and compositing layer updates were suppressed pending the load event, do these actions now.
-    if (renderer() && settings() && settings()->suppressIncrementalRendering()) {
+    if (renderer() && settings() && settings()->suppressesIncrementalRendering()) {
 #if USE(ACCELERATED_COMPOSITING)
         view()->updateCompositingLayers();
 #endif
@@ -2853,7 +2873,6 @@ bool Document::childTypeAllowed(NodeType type) const
     case NOTATION_NODE:
     case TEXT_NODE:
     case XPATH_NAMESPACE_NODE:
-    case SHADOW_ROOT_NODE:
         return false;
     case COMMENT_NODE:
     case PROCESSING_INSTRUCTION_NODE:
@@ -2923,9 +2942,6 @@ bool Document::canReplaceChild(Node* newChild, Node* oldChild)
             case ELEMENT_NODE:
                 numElements++;
                 break;
-            case SHADOW_ROOT_NODE:
-                ASSERT_NOT_REACHED();
-                return false;
             }
         }
     } else {
@@ -2939,7 +2955,6 @@ bool Document::canReplaceChild(Node* newChild, Node* oldChild)
         case NOTATION_NODE:
         case TEXT_NODE:
         case XPATH_NAMESPACE_NODE:
-        case SHADOW_ROOT_NODE:
             return false;
         case COMMENT_NODE:
         case PROCESSING_INSTRUCTION_NODE:
@@ -5013,7 +5028,7 @@ void Document::enqueueHashchangeEvent(const String& oldURL, const String& newURL
 void Document::enqueuePopstateEvent(PassRefPtr<SerializedScriptValue> stateObject)
 {
     // FIXME: https://bugs.webkit.org/show_bug.cgi?id=36202 Popstate event needs to fire asynchronously
-    dispatchWindowEvent(PopStateEvent::create(stateObject));
+    dispatchWindowEvent(PopStateEvent::create(stateObject, domWindow() ? domWindow()->history() : 0));
 }
 
 void Document::addMediaCanStartListener(MediaCanStartListener* listener)
@@ -5366,7 +5381,6 @@ PassRefPtr<TouchList> Document::createTouchList(ExceptionCode&) const
 
 static void wheelEventHandlerCountChanged(Document* document)
 {
-#if ENABLE(THREADED_SCROLLING)
     Page* page = document->page();
     if (!page)
         return;
@@ -5380,9 +5394,6 @@ static void wheelEventHandlerCountChanged(Document* document)
         return;
 
     scrollingCoordinator->frameViewWheelEventHandlerCountChanged(frameView);
-#else
-    UNUSED_PARAM(document);
-#endif
 }
 
 void Document::didAddWheelEventHandler()
@@ -5406,10 +5417,27 @@ void Document::didRemoveWheelEventHandler()
     wheelEventHandlerCountChanged(this);
 }
 
+void Document::didAddTouchEventHandler()
+{
+    ++m_touchEventHandlerCount;
+    Frame* mainFrame = page() ? page()->mainFrame() : 0;
+    if (mainFrame)
+        mainFrame->notifyChromeClientTouchEventHandlerCountChanged();
+}
+
+void Document::didRemoveTouchEventHandler()
+{
+    ASSERT(m_touchEventHandlerCount > 0);
+    --m_touchEventHandlerCount;
+    Frame* mainFrame = page() ? page()->mainFrame() : 0;
+    if (mainFrame)
+        mainFrame->notifyChromeClientTouchEventHandlerCountChanged();
+}
+
 bool Document::visualUpdatesAllowed() const
 {
     return !settings()
-        || !settings()->suppressIncrementalRendering()
+        || !settings()->suppressesIncrementalRendering()
         || loadEventFinished();
 }
 
diff --git a/Source/WebCore/dom/Document.h b/Source/WebCore/dom/Document.h
index a4bdad685..772e4cd6b 100644
--- a/Source/WebCore/dom/Document.h
+++ b/Source/WebCore/dom/Document.h
@@ -36,6 +36,7 @@
 #include "DocumentEventQueue.h"
 #include "DocumentTiming.h"
 #include "IconURL.h"
+#include "InspectorCounters.h"
 #include "IntRect.h"
 #include "LayoutTypes.h"
 #include "PageVisibilityState.h"
@@ -350,6 +351,7 @@ public:
     virtual PassRefPtr<Element> createElementNS(const String& namespaceURI, const String& qualifiedName, ExceptionCode&);
     PassRefPtr<Element> createElement(const QualifiedName&, bool createdByParser);
 
+    bool cssRegionsEnabled() const;
     PassRefPtr<WebKitNamedFlow> webkitGetFlowByName(const String&);
 
     /**
@@ -1113,6 +1115,10 @@ public:
     void didAddWheelEventHandler();
     void didRemoveWheelEventHandler();
 
+    unsigned touchEventHandlerCount() const { return m_touchEventHandlerCount; }
+    void didAddTouchEventHandler();
+    void didRemoveTouchEventHandler();
+
     bool visualUpdatesAllowed() const;
 
 #if ENABLE(MICRODATA)
@@ -1449,6 +1455,7 @@ private:
     unsigned m_writeRecursionDepth;
     
     unsigned m_wheelEventHandlerCount;
+    unsigned m_touchEventHandlerCount;
 
 #if ENABLE(REQUEST_ANIMATION_FRAME)
     RefPtr<ScriptedAnimationController> m_scriptedAnimationController;
@@ -1481,6 +1488,7 @@ inline Node::Node(Document* document, ConstructionType type)
 #if !defined(NDEBUG) || (defined(DUMP_NODE_STATISTICS) && DUMP_NODE_STATISTICS)
     trackForDebugging();
 #endif
+    InspectorCounters::incrementCounter(InspectorCounters::NodeCounter);
 }
 
 } // namespace WebCore
diff --git a/Source/WebCore/dom/Document.idl b/Source/WebCore/dom/Document.idl
index de7b04df1..b3e0aa3a0 100644
--- a/Source/WebCore/dom/Document.idl
+++ b/Source/WebCore/dom/Document.idl
@@ -21,7 +21,7 @@
 module core {
 
     interface [
-        JSCustomToJS,
+        CustomToJSObject,
         JSGenerateToNativeObject,
         JSInlineGetOwnPropertySlot
     ] Document : Node {
@@ -31,55 +31,55 @@ module core {
         readonly attribute DOMImplementation implementation;
         readonly attribute Element documentElement;
 
-        [ReturnNewObject] Element createElement(in [TreatNullAs=NullString,Optional=CallWithDefaultValue] DOMString tagName)
+        [ReturnNewObject] Element createElement(in [TreatNullAs=NullString,Optional=DefaultIsUndefined] DOMString tagName)
             raises (DOMException);
         DocumentFragment   createDocumentFragment();
-        [ReturnNewObject] Text createTextNode(in [Optional=CallWithDefaultValue] DOMString data);
-        [ReturnNewObject] Comment createComment(in [Optional=CallWithDefaultValue] DOMString data);
-        [ReturnNewObject] CDATASection createCDATASection(in [Optional=CallWithDefaultValue] DOMString data)
+        [ReturnNewObject] Text createTextNode(in [Optional=DefaultIsUndefined] DOMString data);
+        [ReturnNewObject] Comment createComment(in [Optional=DefaultIsUndefined] DOMString data);
+        [ReturnNewObject] CDATASection createCDATASection(in [Optional=DefaultIsUndefined] DOMString data)
             raises(DOMException);
-        [ObjCLegacyUnnamedParameters, ReturnNewObject] ProcessingInstruction createProcessingInstruction(in [Optional=CallWithDefaultValue] DOMString target,
-                                                                                     in [Optional=CallWithDefaultValue] DOMString data)
+        [ObjCLegacyUnnamedParameters, ReturnNewObject] ProcessingInstruction createProcessingInstruction(in [Optional=DefaultIsUndefined] DOMString target,
+                                                                                     in [Optional=DefaultIsUndefined] DOMString data)
             raises (DOMException);
-        [ReturnNewObject] Attr createAttribute(in [Optional=CallWithDefaultValue] DOMString name)
+        [ReturnNewObject] Attr createAttribute(in [Optional=DefaultIsUndefined] DOMString name)
             raises (DOMException);
-        [ReturnNewObject] EntityReference createEntityReference(in [Optional=CallWithDefaultValue] DOMString name)
+        [ReturnNewObject] EntityReference createEntityReference(in [Optional=DefaultIsUndefined] DOMString name)
             raises(DOMException);
-        NodeList           getElementsByTagName(in [Optional=CallWithDefaultValue] DOMString tagname);
+        NodeList           getElementsByTagName(in [Optional=DefaultIsUndefined] DOMString tagname);
 
         // Introduced in DOM Level 2:
 
-        [ObjCLegacyUnnamedParameters, ReturnNewObject] Node importNode(in [Optional=CallWithDefaultValue] Node importedNode,
+        [ObjCLegacyUnnamedParameters, ReturnNewObject] Node importNode(in [Optional=DefaultIsUndefined] Node importedNode,
                                                    in [Optional] boolean deep)
             raises (DOMException);
-        [ObjCLegacyUnnamedParameters, ReturnNewObject] Element createElementNS(in [TreatNullAs=NullString,Optional=CallWithDefaultValue] DOMString namespaceURI,
-                                                           in [TreatNullAs=NullString,Optional=CallWithDefaultValue] DOMString qualifiedName)
+        [ObjCLegacyUnnamedParameters, ReturnNewObject] Element createElementNS(in [TreatNullAs=NullString,Optional=DefaultIsUndefined] DOMString namespaceURI,
+                                                           in [TreatNullAs=NullString,Optional=DefaultIsUndefined] DOMString qualifiedName)
             raises (DOMException);
-        [ObjCLegacyUnnamedParameters, ReturnNewObject] Attr createAttributeNS(in [TreatNullAs=NullString,Optional=CallWithDefaultValue] DOMString namespaceURI,
-                                                          in [TreatNullAs=NullString,Optional=CallWithDefaultValue] DOMString qualifiedName)
+        [ObjCLegacyUnnamedParameters, ReturnNewObject] Attr createAttributeNS(in [TreatNullAs=NullString,Optional=DefaultIsUndefined] DOMString namespaceURI,
+                                                          in [TreatNullAs=NullString,Optional=DefaultIsUndefined] DOMString qualifiedName)
             raises (DOMException);
-        [ObjCLegacyUnnamedParameters] NodeList getElementsByTagNameNS(in [TreatNullAs=NullString,Optional=CallWithDefaultValue] DOMString namespaceURI,
-                                                       in [Optional=CallWithDefaultValue] DOMString localName);
-        Element            getElementById(in [Optional=CallWithDefaultValue] DOMString elementId);
+        [ObjCLegacyUnnamedParameters] NodeList getElementsByTagNameNS(in [TreatNullAs=NullString,Optional=DefaultIsUndefined] DOMString namespaceURI,
+                                                       in [Optional=DefaultIsUndefined] DOMString localName);
+        Element            getElementById(in [Optional=DefaultIsUndefined] DOMString elementId);
 
         // DOM Level 3 Core
 
-        readonly attribute [ConvertNullStringTo=Null] DOMString inputEncoding;
+        readonly attribute [TreatReturnedNullStringAs=Null] DOMString inputEncoding;
 
-        readonly attribute [ConvertNullStringTo=Null] DOMString xmlEncoding;
-                 attribute [ConvertNullStringTo=Null, TreatNullAs=NullString] DOMString xmlVersion
+        readonly attribute [TreatReturnedNullStringAs=Null] DOMString xmlEncoding;
+                 attribute [TreatReturnedNullStringAs=Null, TreatNullAs=NullString] DOMString xmlVersion
                     setter raises (DOMException);
                  attribute boolean xmlStandalone
                     setter raises (DOMException);
 
-        Node               adoptNode(in [Optional=CallWithDefaultValue] Node source)
+        Node               adoptNode(in [Optional=DefaultIsUndefined] Node source)
             raises (DOMException);
 
-                 attribute [ConvertNullStringTo=Null, TreatNullAs=NullString] DOMString documentURI;
+                 attribute [TreatReturnedNullStringAs=Null, TreatNullAs=NullString] DOMString documentURI;
 
         // DOM Level 2 Events (DocumentEvents interface)
 
-        Event              createEvent(in [Optional=CallWithDefaultValue] DOMString eventType)
+        Event              createEvent(in [Optional=DefaultIsUndefined] DOMString eventType)
             raises(DOMException);
 
         // DOM Level 2 Tranversal and Range (DocumentRange interface)
@@ -88,15 +88,15 @@ module core {
 
         // DOM Level 2 Tranversal and Range (DocumentTraversal interface)
 
-        [ObjCLegacyUnnamedParameters] NodeIterator createNodeIterator(in [Optional=CallWithDefaultValue] Node root,
-                                                       in [Optional=CallWithDefaultValue] unsigned long whatToShow,
-                                                       in [Optional=CallWithDefaultValue] NodeFilter filter,
-                                                       in [Optional=CallWithDefaultValue] boolean expandEntityReferences)
+        [ObjCLegacyUnnamedParameters] NodeIterator createNodeIterator(in [Optional=DefaultIsUndefined] Node root,
+                                                       in [Optional=DefaultIsUndefined] unsigned long whatToShow,
+                                                       in [Optional=DefaultIsUndefined] NodeFilter filter,
+                                                       in [Optional=DefaultIsUndefined] boolean expandEntityReferences)
             raises(DOMException);
-        [ObjCLegacyUnnamedParameters] TreeWalker createTreeWalker(in [Optional=CallWithDefaultValue] Node root,
-                                                   in [Optional=CallWithDefaultValue] unsigned long whatToShow,
-                                                   in [Optional=CallWithDefaultValue] NodeFilter filter,
-                                                   in [Optional=CallWithDefaultValue] boolean expandEntityReferences)
+        [ObjCLegacyUnnamedParameters] TreeWalker createTreeWalker(in [Optional=DefaultIsUndefined] Node root,
+                                                   in [Optional=DefaultIsUndefined] unsigned long whatToShow,
+                                                   in [Optional=DefaultIsUndefined] NodeFilter filter,
+                                                   in [Optional=DefaultIsUndefined] boolean expandEntityReferences)
             raises(DOMException);
 
         // DOM Level 2 Abstract Views (DocumentView interface)
@@ -109,26 +109,26 @@ module core {
 
         // DOM Level 2 Style (DocumentCSS interface)
 
-        [ObjCLegacyUnnamedParameters] CSSStyleDeclaration getOverrideStyle(in [Optional=CallWithDefaultValue] Element element,
-                                                            in [Optional=CallWithDefaultValue] DOMString pseudoElement);
+        [ObjCLegacyUnnamedParameters] CSSStyleDeclaration getOverrideStyle(in [Optional=DefaultIsUndefined] Element element,
+                                                            in [Optional=DefaultIsUndefined] DOMString pseudoElement);
 
         // DOM Level 3 XPath (XPathEvaluator interface)
-        [ObjCLegacyUnnamedParameters] XPathExpression createExpression(in [Optional=CallWithDefaultValue] DOMString expression,
-                                                        in [Optional=CallWithDefaultValue] XPathNSResolver resolver)
+        [ObjCLegacyUnnamedParameters] XPathExpression createExpression(in [Optional=DefaultIsUndefined] DOMString expression,
+                                                        in [Optional=DefaultIsUndefined] XPathNSResolver resolver)
             raises(DOMException);
         XPathNSResolver    createNSResolver(in Node nodeResolver);
-        [ObjCLegacyUnnamedParameters, V8Custom] XPathResult evaluate(in [Optional=CallWithDefaultValue] DOMString expression,
-                                                      in [Optional=CallWithDefaultValue] Node contextNode,
-                                                      in [Optional=CallWithDefaultValue] XPathNSResolver resolver,
-                                                      in [Optional=CallWithDefaultValue] unsigned short type,
-                                                      in [Optional=CallWithDefaultValue] XPathResult inResult)
+        [ObjCLegacyUnnamedParameters, V8Custom] XPathResult evaluate(in [Optional=DefaultIsUndefined] DOMString expression,
+                                                      in [Optional=DefaultIsUndefined] Node contextNode,
+                                                      in [Optional=DefaultIsUndefined] XPathNSResolver resolver,
+                                                      in [Optional=DefaultIsUndefined] unsigned short type,
+                                                      in [Optional=DefaultIsUndefined] XPathResult inResult)
             raises(DOMException);
 
         // Common extensions
 
-        boolean            execCommand(in [Optional=CallWithDefaultValue] DOMString command,
-                                       in [Optional=CallWithDefaultValue] boolean userInterface,
-                                       in [TreatNullAs=NullString, TreatUndefinedAs=NullString,Optional=CallWithDefaultValue] DOMString value);
+        boolean            execCommand(in [Optional=DefaultIsUndefined] DOMString command,
+                                       in [Optional=DefaultIsUndefined] boolean userInterface,
+                                       in [TreatNullAs=NullString, TreatUndefinedAs=NullString,Optional=DefaultIsUndefined] DOMString value);
 
 #if defined(LANGUAGE_OBJECTIVE_C) && LANGUAGE_OBJECTIVE_C
         // FIXME: remove the these two versions once [Optional] is implemented for Objective-C.
@@ -137,11 +137,11 @@ module core {
         boolean            execCommand(in DOMString command);
 #endif
 
-        boolean            queryCommandEnabled(in [Optional=CallWithDefaultValue] DOMString command);
-        boolean            queryCommandIndeterm(in [Optional=CallWithDefaultValue] DOMString command);
-        boolean            queryCommandState(in [Optional=CallWithDefaultValue] DOMString command);
-        boolean            queryCommandSupported(in [Optional=CallWithDefaultValue] DOMString command);
-        [ConvertNullStringTo=False] DOMString queryCommandValue(in [Optional=CallWithDefaultValue] DOMString command);
+        boolean            queryCommandEnabled(in [Optional=DefaultIsUndefined] DOMString command);
+        boolean            queryCommandIndeterm(in [Optional=DefaultIsUndefined] DOMString command);
+        boolean            queryCommandState(in [Optional=DefaultIsUndefined] DOMString command);
+        boolean            queryCommandSupported(in [Optional=DefaultIsUndefined] DOMString command);
+        [TreatReturnedNullStringAs=False] DOMString queryCommandValue(in [Optional=DefaultIsUndefined] DOMString command);
 
         // Moved down from HTMLDocument
 
@@ -172,10 +172,10 @@ module core {
         readonly attribute HTMLCollection anchors;
         readonly attribute DOMString lastModified;
 
-        NodeList getElementsByName(in [Optional=CallWithDefaultValue] DOMString elementName);
+        NodeList getElementsByName(in [Optional=DefaultIsUndefined] DOMString elementName);
 
 #if defined(ENABLE_MICRODATA) && ENABLE_MICRODATA
-        NodeList getItems(in [TreatNullAs=NullString, TreatUndefinedAs=NullString, Optional=CallWithDefaultValue] DOMString typeNames);
+        NodeList getItems(in [TreatNullAs=NullString, TreatUndefinedAs=NullString, Optional=DefaultIsUndefined] DOMString typeNames);
 #endif
 
 #if defined(LANGUAGE_JAVASCRIPT) && LANGUAGE_JAVASCRIPT
@@ -184,25 +184,25 @@ module core {
 
         // IE extensions
 
-                 attribute [ConvertNullStringTo=Undefined, TreatNullAs=NullString] DOMString charset;
-        readonly attribute [ConvertNullStringTo=Undefined] DOMString defaultCharset;
-        readonly attribute [ConvertNullStringTo=Undefined] DOMString readyState;
+                 attribute [TreatReturnedNullStringAs=Undefined, TreatNullAs=NullString] DOMString charset;
+        readonly attribute [TreatReturnedNullStringAs=Undefined] DOMString defaultCharset;
+        readonly attribute [TreatReturnedNullStringAs=Undefined] DOMString readyState;
 
-        Element            elementFromPoint(in [Optional=CallWithDefaultValue] long x, 
-                                            in [Optional=CallWithDefaultValue] long y);
-        Range              caretRangeFromPoint(in [Optional=CallWithDefaultValue] long x, 
-                                               in [Optional=CallWithDefaultValue] long y);
+        Element            elementFromPoint(in [Optional=DefaultIsUndefined] long x, 
+                                            in [Optional=DefaultIsUndefined] long y);
+        Range              caretRangeFromPoint(in [Optional=DefaultIsUndefined] long x, 
+                                               in [Optional=DefaultIsUndefined] long y);
 
         // Mozilla extensions
 #if defined(LANGUAGE_JAVASCRIPT) && LANGUAGE_JAVASCRIPT
         DOMSelection       getSelection();
 #endif
-        readonly attribute [ConvertNullStringTo=Null] DOMString characterSet;
+        readonly attribute [TreatReturnedNullStringAs=Null] DOMString characterSet;
 
         // WebKit extensions
 
-        readonly attribute [ConvertNullStringTo=Null] DOMString preferredStylesheetSet;
-                 attribute [ConvertNullStringTo=Null, TreatNullAs=NullString] DOMString selectedStylesheetSet;
+        readonly attribute [TreatReturnedNullStringAs=Null] DOMString preferredStylesheetSet;
+                 attribute [TreatReturnedNullStringAs=Null, TreatNullAs=NullString] DOMString selectedStylesheetSet;
 
 #if !defined(LANGUAGE_JAVASCRIPT) || !LANGUAGE_JAVASCRIPT
         CSSStyleDeclaration createCSSStyleDeclaration();
@@ -230,7 +230,7 @@ module core {
 #endif
 
         // HTML 5
-        NodeList getElementsByClassName(in [Optional=CallWithDefaultValue] DOMString tagname);
+        NodeList getElementsByClassName(in [Optional=DefaultIsUndefined] DOMString tagname);
 
         readonly attribute DOMString compatMode;
 
@@ -325,17 +325,17 @@ module core {
 #endif
 
 #if defined(ENABLE_TOUCH_EVENTS) && ENABLE_TOUCH_EVENTS
-        [ReturnNewObject, V8EnabledAtRuntime] Touch createTouch(in [Optional=CallWithDefaultValue] DOMWindow window,
-                                                         in [Optional=CallWithDefaultValue] EventTarget target,
-                                                         in [Optional=CallWithDefaultValue] long identifier,
-                                                         in [Optional=CallWithDefaultValue] long pageX,
-                                                         in [Optional=CallWithDefaultValue] long pageY,
-                                                         in [Optional=CallWithDefaultValue] long screenX,
-                                                         in [Optional=CallWithDefaultValue] long screenY,
-                                                         in [Optional=CallWithDefaultValue] long webkitRadiusX,
-                                                         in [Optional=CallWithDefaultValue] long webkitRadiusY,
-                                                         in [Optional=CallWithDefaultValue] float webkitRotationAngle,
-                                                         in [Optional=CallWithDefaultValue] float webkitForce)
+        [ReturnNewObject, V8EnabledAtRuntime] Touch createTouch(in [Optional=DefaultIsUndefined] DOMWindow window,
+                                                         in [Optional=DefaultIsUndefined] EventTarget target,
+                                                         in [Optional=DefaultIsUndefined] long identifier,
+                                                         in [Optional=DefaultIsUndefined] long pageX,
+                                                         in [Optional=DefaultIsUndefined] long pageY,
+                                                         in [Optional=DefaultIsUndefined] long screenX,
+                                                         in [Optional=DefaultIsUndefined] long screenY,
+                                                         in [Optional=DefaultIsUndefined] long webkitRadiusX,
+                                                         in [Optional=DefaultIsUndefined] long webkitRadiusY,
+                                                         in [Optional=DefaultIsUndefined] float webkitRotationAngle,
+                                                         in [Optional=DefaultIsUndefined] float webkitForce)
             raises (DOMException);
         [ReturnNewObject, V8EnabledAtRuntime, Custom] TouchList createTouchList()
             raises (DOMException);
diff --git a/Source/WebCore/dom/DocumentEventQueue.cpp b/Source/WebCore/dom/DocumentEventQueue.cpp
index 31023e28d..5b899b3f5 100644
--- a/Source/WebCore/dom/DocumentEventQueue.cpp
+++ b/Source/WebCore/dom/DocumentEventQueue.cpp
@@ -64,6 +64,7 @@ DocumentEventQueue::DocumentEventQueue(ScriptExecutionContext* context)
     : m_pendingEventTimer(adoptPtr(new DocumentEventQueueTimer(this, context)))
     , m_isClosed(false)
 {
+    m_pendingEventTimer->suspendIfNeeded();
 }
 
 DocumentEventQueue::~DocumentEventQueue()
diff --git a/Source/WebCore/dom/DocumentOrderedMap.cpp b/Source/WebCore/dom/DocumentOrderedMap.cpp
index 886b8bf08..bcb23b496 100644
--- a/Source/WebCore/dom/DocumentOrderedMap.cpp
+++ b/Source/WebCore/dom/DocumentOrderedMap.cpp
@@ -42,7 +42,7 @@ using namespace HTMLNames;
 
 inline bool keyMatchesId(AtomicStringImpl* key, Element* element)
 {
-    return element->hasID() && element->getIdAttribute().impl() == key;
+    return element->getIdAttribute().impl() == key;
 }
 
 inline bool keyMatchesMapName(AtomicStringImpl* key, Element* element)
diff --git a/Source/WebCore/dom/DocumentType.idl b/Source/WebCore/dom/DocumentType.idl
index ed146fa4f..729023271 100644
--- a/Source/WebCore/dom/DocumentType.idl
+++ b/Source/WebCore/dom/DocumentType.idl
@@ -31,9 +31,9 @@ module core {
 
         // DOM Level 2
 
-        readonly attribute [ConvertNullStringTo=Null] DOMString publicId;
-        readonly attribute [ConvertNullStringTo=Null] DOMString systemId;
-        readonly attribute [ConvertNullStringTo=Null] DOMString internalSubset;        
+        readonly attribute [TreatReturnedNullStringAs=Null] DOMString publicId;
+        readonly attribute [TreatReturnedNullStringAs=Null] DOMString systemId;
+        readonly attribute [TreatReturnedNullStringAs=Null] DOMString internalSubset;        
 
     };
 
diff --git a/Source/WebCore/dom/Element.cpp b/Source/WebCore/dom/Element.cpp
index 355f38adb..1b4d839db 100644
--- a/Source/WebCore/dom/Element.cpp
+++ b/Source/WebCore/dom/Element.cpp
@@ -57,6 +57,7 @@
 #include "NodeRenderingContext.h"
 #include "Page.h"
 #include "RenderLayer.h"
+#include "RenderRegion.h"
 #include "RenderView.h"
 #include "RenderWidget.h"
 #include "Settings.h"
@@ -616,27 +617,28 @@ void Element::setAttribute(const AtomicString& name, const AtomicString& value,
 
     const AtomicString& localName = shouldIgnoreAttributeCase(this) ? name.lower() : name;
 
-    size_t index = ensureUpdatedAttributes()->getAttributeItemIndex(localName, false);
-    const QualifiedName& qName = index != notFound ? m_attributeMap->attributeItem(index)->name() : QualifiedName(nullAtom, localName, nullAtom);
+    size_t index = ensureUpdatedAttributeData()->getAttributeItemIndex(localName, false);
+    const QualifiedName& qName = index != notFound ? attributeItem(index)->name() : QualifiedName(nullAtom, localName, nullAtom);
     setAttributeInternal(index, qName, value);
 }
 
 void Element::setAttribute(const QualifiedName& name, const AtomicString& value)
 {
-    setAttributeInternal(ensureUpdatedAttributes()->getAttributeItemIndex(name), name, value);
+    setAttributeInternal(ensureUpdatedAttributeData()->getAttributeItemIndex(name), name, value);
 }
 
 inline void Element::setAttributeInternal(size_t index, const QualifiedName& name, const AtomicString& value)
 {
-    Attribute* old = index != notFound ? m_attributeMap->attributeItem(index) : 0;
+    ElementAttributeData* attributeData = &m_attributeMap->m_attributeData;
+    Attribute* old = index != notFound ? attributeData->attributeItem(index) : 0;
     if (value.isNull()) {
         if (old)
-            m_attributeMap->removeAttribute(index);
+            attributeData->removeAttribute(index, this);
         return;
     }
 
     if (!old) {
-        m_attributeMap->addAttribute(createAttribute(name, value));
+        attributeData->addAttribute(Attribute::create(name, value), this);
         return;
     }
 
@@ -650,11 +652,6 @@ inline void Element::setAttributeInternal(size_t index, const QualifiedName& nam
     didModifyAttribute(old);
 }
 
-PassRefPtr<Attribute> Element::createAttribute(const QualifiedName& name, const AtomicString& value)
-{
-    return Attribute::create(name, value);
-}
-
 void Element::attributeChanged(Attribute* attr)
 {
     if (isIdAttributeName(attr->name()))
@@ -662,12 +659,12 @@ void Element::attributeChanged(Attribute* attr)
     else if (attr->name() == HTMLNames::nameAttr)
         setHasName(!attr->isNull());
 
-    recalcStyleIfNeededAfterAttributeChanged(attr);
-    updateAfterAttributeChanged(attr);
-}
+    if (!needsStyleRecalc() && document()->attached()) {
+        CSSStyleSelector* styleSelector = document()->styleSelectorIfExists();
+        if (!styleSelector || styleSelector->hasSelectorForAttribute(attr->name().localName()))
+            setNeedsStyleRecalc();
+    }
 
-void Element::updateAfterAttributeChanged(Attribute* attr)
-{
     invalidateNodeListsCacheAfterAttributeChanged(attr->name());
 
     if (!AXObjectCache::accessibilityEnabled())
@@ -697,22 +694,9 @@ void Element::updateAfterAttributeChanged(Attribute* attr)
     else if (attrName == aria_invalidAttr)
         document()->axObjectCache()->postNotification(renderer(), AXObjectCache::AXInvalidStatusChanged, true);
 }
-    
-void Element::recalcStyleIfNeededAfterAttributeChanged(Attribute* attr)
-{
-    if (needsStyleRecalc())
-        return;
-    if (!document()->attached())
-        return;
-    CSSStyleSelector* styleSelector = document()->styleSelectorIfExists();
-    if (styleSelector && !styleSelector->hasSelectorForAttribute(attr->name().localName()))
-        return;
-    setNeedsStyleRecalc();
-}
 
 void Element::idAttributeChanged(Attribute* attr)
 {
-    setHasID(!attr->isNull());
     if (attributeData()) {
         if (attr->isNull())
             attributeData()->setIdForStyleResolution(nullAtom);
@@ -750,27 +734,28 @@ void Element::parserSetAttributeMap(PassOwnPtr<NamedNodeMap> list, FragmentScrip
     m_attributeMap = list;
 
     if (m_attributeMap) {
+        ElementAttributeData* attributeData = &m_attributeMap->m_attributeData;
         m_attributeMap->m_element = this;
         // If the element is created as result of a paste or drag-n-drop operation
         // we want to remove all the script and event handlers.
         if (scriptingPermission == FragmentScriptingNotAllowed) {
             unsigned i = 0;
             while (i < m_attributeMap->length()) {
-                const QualifiedName& attributeName = m_attributeMap->m_attributes[i]->name();
+                const QualifiedName& attributeName = attributeData->m_attributes[i]->name();
                 if (isEventHandlerAttribute(attributeName)) {
-                    m_attributeMap->m_attributes.remove(i);
+                    attributeData->m_attributes.remove(i);
                     continue;
                 }
 
-                if (isAttributeToRemove(attributeName, m_attributeMap->m_attributes[i]->value()))
-                    m_attributeMap->m_attributes[i]->setValue(nullAtom);
+                if (isAttributeToRemove(attributeName, attributeData->m_attributes[i]->value()))
+                    attributeData->m_attributes[i]->setValue(nullAtom);
                 i++;
             }
         }
         // Store the set of attributes that changed on the stack in case
         // attributeChanged mutates m_attributeMap.
         Vector<RefPtr<Attribute> > attributes;
-        m_attributeMap->copyAttributesToVector(attributes);
+        attributeData->copyAttributesToVector(attributes);
         for (Vector<RefPtr<Attribute> >::iterator iter = attributes.begin(); iter != attributes.end(); ++iter)
             attributeChanged(iter->get());
     }
@@ -862,6 +847,8 @@ void Element::willRemove()
     if (containsFullScreenElement())
         setContainsFullScreenElementOnAncestorsCrossingFrameBoundaries(false);
 #endif
+    if (ShadowRootList* shadowRoots = shadowRootList())
+        shadowRoots->willRemove();
     ContainerNode::willRemove();
 }
 
@@ -870,8 +857,8 @@ void Element::insertedIntoDocument()
     // need to do superclass processing first so inDocument() is true
     // by the time we reach updateId
     ContainerNode::insertedIntoDocument();
-    if (ShadowRoot* shadow = shadowRoot())
-        shadow->insertedIntoDocument();
+    if (ShadowRootList* shadowRoots = shadowRootList())
+        shadowRoots->insertedIntoDocument();
 
     if (m_attributeMap) {
         if (hasID()) {
@@ -903,8 +890,8 @@ void Element::removedFromDocument()
     }
 
     ContainerNode::removedFromDocument();
-    if (ShadowRoot* shadow = shadowRoot())
-        shadow->removedFromDocument();
+    if (ShadowRootList* shadowRoots = shadowRootList())
+        shadowRoots->removedFromDocument();
 }
 
 void Element::insertedIntoTree(bool deep)
@@ -912,8 +899,8 @@ void Element::insertedIntoTree(bool deep)
     ContainerNode::insertedIntoTree(deep);
     if (!deep)
         return;
-    if (ShadowRoot* shadow = shadowRoot())
-        shadow->insertedIntoTree(true);
+    if (ShadowRootList* shadowRoots = shadowRootList())
+        shadowRoots->insertedIntoTree(true);
 
 #if ENABLE(FULLSCREEN_API)
     if (containsFullScreenElement() && parentElement() && !parentElement()->containsFullScreenElement())
@@ -926,8 +913,8 @@ void Element::removedFromTree(bool deep)
     ContainerNode::removedFromTree(deep);
     if (!deep)
         return;
-    if (ShadowRoot* shadow = shadowRoot())
-        shadow->removedFromTree(true);
+    if (ShadowRootList* shadowRoots = shadowRootList())
+        shadowRoots->removedFromTree(true);
 }
 
 void Element::attach()
@@ -939,10 +926,9 @@ void Element::attach()
     StyleSelectorParentPusher parentPusher(this);
 
     // When a shadow root exists, it does the work of attaching the children.
-    if (ShadowRoot* shadow = shadowRoot()) {
+    if (hasShadowRoot()) {
         parentPusher.push();
-        Node::attach();
-        shadow->attach();
+        shadowRootList()->attach();
 
         // In a shadow tree, some of light children may be attached by 'content' element.
         // However, when there is no content element or content element does not select
@@ -951,6 +937,7 @@ void Element::attach()
             if (!child->attached())
                 child->attach();
         }
+        Node::attach();
     } else {
         if (firstChild())
             parentPusher.push();
@@ -978,8 +965,8 @@ void Element::detach()
     if (hasRareData())
         rareData()->resetComputedStyle();
     ContainerNode::detach();
-    if (ShadowRoot* shadow = shadowRoot())
-        shadow->detach();
+    if (ShadowRootList* shadowRoots = shadowRootList())
+        shadowRoots->detach();
 
     RenderWidget::resumeWidgetHierarchyUpdates();
 }
@@ -1121,7 +1108,7 @@ void Element::recalcStyle(StyleChange change)
     bool forceCheckOfAnyElementSibling = false;
     for (Node *n = firstChild(); n; n = n->nextSibling()) {
         if (n->isTextNode()) {
-            static_cast<Text*>(n)->recalcTextStyle(change);
+            toText(n)->recalcTextStyle(change);
             continue;
         } 
         if (!n->isElementNode()) 
@@ -1138,10 +1125,11 @@ void Element::recalcStyle(StyleChange change)
         forceCheckOfAnyElementSibling = forceCheckOfAnyElementSibling || (childRulesChanged && hasIndirectAdjacentRules);
     }
     // FIXME: This does not care about sibling combinators. Will be necessary in XBL2 world.
-    if (ShadowRoot* shadow = shadowRoot()) {
-        if (change >= Inherit || shadow->childNeedsStyleRecalc() || shadow->needsStyleRecalc()) {
+    if (hasShadowRoot()) {
+        ShadowRootList* list = shadowRootList();
+        if (change >= Inherit || list->childNeedsStyleRecalc() || list->needsStyleRecalc()) {
             parentPusher.push();
-            shadow->recalcShadowTreeStyle(change);
+            list->recalcShadowTreeStyle(change);
         }
     }
 
@@ -1152,9 +1140,19 @@ void Element::recalcStyle(StyleChange change)
         didRecalcStyle(change);
 }
 
-ShadowRoot* Element::shadowRoot() const
+bool Element::hasShadowRoot() const
 {
-    return hasRareData() ? rareData()->m_shadowRoot : 0;
+    if (ShadowRootList* list = shadowRootList())
+        return list->hasShadowRoot();
+    return false;
+}
+
+ShadowRootList* Element::shadowRootList() const
+{
+    if (!hasRareData())
+        return 0;
+
+    return &rareData()->m_shadowRootList;
 }
 
 static bool validateShadowRoot(Document* document, ShadowRoot* shadowRoot, ExceptionCode& ec)
@@ -1175,16 +1173,19 @@ static bool validateShadowRoot(Document* document, ShadowRoot* shadowRoot, Excep
     return true;
 }
 
-void Element::setShadowRoot(PassRefPtr<ShadowRoot> prpShadowRoot, ExceptionCode& ec)
+void Element::setShadowRoot(PassRefPtr<ShadowRoot> shadowRoot, ExceptionCode& ec)
 {
-    RefPtr<ShadowRoot> shadowRoot = prpShadowRoot;
     if (!validateShadowRoot(document(), shadowRoot.get(), ec))
         return;
 
+    if (!hasRareData())
+        ensureRareData();
+
     removeShadowRoot();
 
-    ensureRareData()->m_shadowRoot = shadowRoot.get();
     shadowRoot->setShadowHost(this);
+    shadowRootList()->pushShadowRoot(shadowRoot.get());
+
     if (inDocument())
         shadowRoot->insertedIntoDocument();
     if (attached()) {
@@ -1196,23 +1197,20 @@ void Element::setShadowRoot(PassRefPtr<ShadowRoot> prpShadowRoot, ExceptionCode&
 
 ShadowRoot* Element::ensureShadowRoot()
 {
-    if (ShadowRoot* existingRoot = shadowRoot())
-        return existingRoot;
+    if (hasShadowRoot())
+        return shadowRootList()->oldestShadowRoot();
 
     return ShadowRoot::create(this, ShadowRoot::CreatingUserAgentShadowRoot).get();
 }
 
 void Element::removeShadowRoot()
 {
-    if (!hasRareData())
+    if (!hasShadowRoot())
         return;
 
-    ElementRareData* data = rareData();
-    if (RefPtr<ShadowRoot> oldRoot = data->m_shadowRoot) {
-        data->m_shadowRoot = 0;
+    while (RefPtr<ShadowRoot> oldRoot = shadowRootList()->popShadowRoot()) {
         document()->removeFocusedNodeOfSubtree(oldRoot.get());
 
-        // Remove from rendering tree
         if (oldRoot->attached())
             oldRoot->detach();
 
@@ -1223,9 +1221,10 @@ void Element::removeShadowRoot()
         else
             oldRoot->removedFromTree(true);
         if (attached()) {
-            for (Node* child = firstChild(); child; child = child->nextSibling())
+            for (Node* child = firstChild(); child; child = child->nextSibling()) {
                 if (!child->attached())
                     child->lazyAttach();
+            }
         }
     }
 }
@@ -1361,8 +1360,8 @@ void Element::childrenChanged(bool changedByParser, Node* beforeChange, Node* af
         checkForSiblingStyleChanges(this, renderStyle(), false, beforeChange, afterChange, childCountDelta);
 
     if (hasRareData()) {
-        if (ShadowRoot* root = shadowRoot())
-            root->hostChildrenChanged();
+        if (hasShadowRoot())
+            shadowRootList()->hostChildrenChanged();
     }
 }
 
@@ -1473,15 +1472,16 @@ void Element::setAttributeNS(const AtomicString& namespaceURI, const AtomicStrin
 
 void Element::removeAttribute(const String& name)
 {
-    if (!m_attributeMap)
+    ElementAttributeData* attributeData = this->attributeData();
+    if (!attributeData)
         return;
 
     String localName = shouldIgnoreAttributeCase(this) ? name.lower() : name;
-    size_t index = m_attributeMap->getAttributeItemIndex(localName, false);
+    size_t index = attributeData->getAttributeItemIndex(localName, false);
     if (index == notFound)
         return;
 
-    m_attributeMap->removeAttribute(index);
+    attributeData->removeAttribute(index, this);
 }
 
 void Element::removeAttributeNS(const String& namespaceURI, const String& localName)
@@ -1508,22 +1508,22 @@ PassRefPtr<Attr> Element::getAttributeNodeNS(const String& namespaceURI, const S
 
 bool Element::hasAttribute(const String& name) const
 {
-    NamedNodeMap* attrs = updatedAttributes();
-    if (!attrs)
+    ElementAttributeData* attributeData = updatedAttributeData();
+    if (!attributeData)
         return false;
 
     // This call to String::lower() seems to be required but
     // there may be a way to remove it.
     String localName = shouldIgnoreAttributeCase(this) ? name.lower() : name;
-    return attrs->getAttributeItem(localName, false);
+    return attributeData->getAttributeItem(localName, false);
 }
 
 bool Element::hasAttributeNS(const String& namespaceURI, const String& localName) const
 {
-    NamedNodeMap* attrs = updatedAttributes();
-    if (!attrs)
+    ElementAttributeData* attributeData = updatedAttributeData();
+    if (!attributeData)
         return false;
-    return attrs->getAttributeItem(QualifiedName(nullAtom, localName, namespaceURI));
+    return attributeData->getAttributeItem(QualifiedName(nullAtom, localName, namespaceURI));
 }
 
 CSSStyleDeclaration *Element::style()
@@ -1558,7 +1558,7 @@ void Element::focus(bool restorePreviousSelection)
         // If a focus event handler changes the focus to a different node it
         // does not make sense to continue and update appearence.
         protect = this;
-        if (shadowRoot() && page->focusController()->transferFocusToElementInShadowRoot(this, restorePreviousSelection))
+        if (hasShadowRoot() && page->focusController()->transferFocusToElementInShadowRoot(this, restorePreviousSelection))
             return;
         if (!page->focusController()->setFocusedNode(this, doc->frame()))
             return;
@@ -1710,15 +1710,12 @@ void Element::cancelFocusAppearanceUpdate()
 
 void Element::normalizeAttributes()
 {
-    NamedNodeMap* attrs = updatedAttributes();
-    if (!attrs)
-        return;
-
-    if (attrs->isEmpty())
+    ElementAttributeData* attributeData = updatedAttributeData();
+    if (!attributeData || attributeData->isEmpty())
         return;
 
     Vector<RefPtr<Attribute> > attributeVector;
-    attrs->copyAttributesToVector(attributeVector);
+    attributeData->copyAttributesToVector(attributeVector);
     size_t numAttrs = attributeVector.size();
     for (size_t i = 0; i < numAttrs; ++i) {
         if (Attr* attr = attributeVector[i]->attr())
@@ -1751,30 +1748,6 @@ unsigned Element::childElementCount() const
     return count;
 }
 
-#if ENABLE(STYLE_SCOPED)
-bool Element::hasScopedHTMLStyleChild() const
-{
-    return hasRareData() && rareData()->hasScopedHTMLStyleChild();
-}
-
-size_t Element::numberOfScopedHTMLStyleChildren() const
-{
-    return hasRareData() ? rareData()->numberOfScopedHTMLStyleChildren() : 0;
-}
-
-void Element::registerScopedHTMLStyleChild()
-{
-    ensureRareData()->registerScopedHTMLStyleChild();
-}
-
-void Element::unregisterScopedHTMLStyleChild()
-{
-    ASSERT(hasRareData());
-    if (hasRareData())
-        rareData()->unregisterScopedHTMLStyleChild();
-}
-#endif
-
 bool Element::webkitMatchesSelector(const String& selector, ExceptionCode& ec)
 {
     if (selector.isEmpty()) {
@@ -1879,13 +1852,13 @@ void Element::setUnsignedIntegralAttribute(const QualifiedName& attributeName, u
 }
 
 #if ENABLE(SVG)
-bool Element::childShouldCreateRenderer(Node* child) const
+bool Element::childShouldCreateRenderer(const NodeRenderingContext& childContext) const
 {
     // Only create renderers for SVG elements whose parents are SVG elements, or for proper <svg xmlns="svgNS"> subdocuments.
-    if (child->isSVGElement())
-        return child->hasTagName(SVGNames::svgTag) || isSVGElement();
+    if (childContext.node()->isSVGElement())
+        return childContext.node()->hasTagName(SVGNames::svgTag) || isSVGElement();
 
-    return Node::childShouldCreateRenderer(child);
+    return Node::childShouldCreateRenderer(childContext);
 }
 #endif
     
@@ -1971,6 +1944,33 @@ PassRefPtr<WebKitAnimationList> Element::webkitGetAnimations() const
     return animController->animationsForRenderer(renderer());
 }
 
+const AtomicString& Element::webkitRegionOverflow() const
+{
+    document()->updateLayoutIgnorePendingStylesheets();
+
+    if (document()->cssRegionsEnabled() && renderer() && renderer()->isRenderRegion()) {
+        RenderRegion* region = toRenderRegion(renderer());
+        switch (region->regionState()) {
+        case RenderRegion::RegionFit: {
+            DEFINE_STATIC_LOCAL(AtomicString, fitState, ("fit"));
+            return fitState;
+        }
+        case RenderRegion::RegionEmpty: {
+            DEFINE_STATIC_LOCAL(AtomicString, emptyState, ("empty"));
+            return emptyState;
+        }
+        case RenderRegion::RegionOverflow: {
+            DEFINE_STATIC_LOCAL(AtomicString, overflowState, ("overflow"));
+            return overflowState;
+        }
+        default:
+            break;
+        }
+    }
+    DEFINE_STATIC_LOCAL(AtomicString, undefinedState, ("undefined"));
+    return undefinedState;
+}
+
 #ifndef NDEBUG
 bool Element::fastAttributeLookupAllowed(const QualifiedName& name) const
 {
@@ -2004,7 +2004,7 @@ void Element::willModifyAttribute(const QualifiedName& name, const AtomicString&
 
 #if ENABLE(INSPECTOR)
     if (!isSynchronizingStyleAttribute())
-        InspectorInstrumentation::willModifyDOMAttr(document(), this);
+        InspectorInstrumentation::willModifyDOMAttr(document(), this, oldValue, newValue);
 #endif
 }
 
diff --git a/Source/WebCore/dom/Element.h b/Source/WebCore/dom/Element.h
index 9381e2f58..c9a1139a9 100644
--- a/Source/WebCore/dom/Element.h
+++ b/Source/WebCore/dom/Element.h
@@ -42,6 +42,7 @@ class DOMTokenList;
 class ElementRareData;
 class IntSize;
 class ShadowRoot;
+class ShadowRootList;
 class WebKitAnimationList;
 
 enum SpellcheckAttributeState {
@@ -147,6 +148,8 @@ public:
     const AtomicString& getIdAttribute() const;
     void setIdAttribute(const AtomicString&);
 
+    const AtomicString& getNameAttribute() const;
+
     // Call this to get the value of the id attribute for style resolution purposes.
     // The value will already be lowercased if the document is in compatibility mode,
     // so this function is not suitable for non-style uses.
@@ -236,14 +239,10 @@ public:
     // Only called by the parser immediately after element construction.
     void parserSetAttributeMap(PassOwnPtr<NamedNodeMap>, FragmentScriptingPermission);
 
-    NamedNodeMap* attributeMap() const { return m_attributeMap.get(); }
-    NamedNodeMap* ensureAttributeMap() const;
-
     ElementAttributeData* attributeData() const { return m_attributeMap ? m_attributeMap->attributeData() : 0; }
-    ElementAttributeData* ensureAttributeData() const { return ensureUpdatedAttributes()->attributeData(); }
-
-    // FIXME: This method should be removed once AttributeData is moved to Element.
-    ElementAttributeData* ensureAttributeDataWithoutUpdate() const { return ensureAttributeMap()->attributeData(); }
+    ElementAttributeData* ensureAttributeData() const;
+    ElementAttributeData* updatedAttributeData() const;
+    ElementAttributeData* ensureUpdatedAttributeData() const;
 
     void setAttributesFromElement(const Element&);
 
@@ -254,7 +253,11 @@ public:
     virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
     void recalcStyle(StyleChange = NoChange);
 
-    ShadowRoot* shadowRoot() const;
+    bool hasShadowRoot() const;
+    ShadowRootList* shadowRootList() const;
+
+    // FIXME: These API will be moved to ShadowRootList.
+    // https://bugs.webkit.org/show_bug.cgi?id=78313
     void setShadowRoot(PassRefPtr<ShadowRoot>, ExceptionCode&);
     ShadowRoot* ensureShadowRoot();
     void removeShadowRoot();
@@ -323,13 +326,6 @@ public:
     Element* nextElementSibling() const;
     unsigned childElementCount() const;
 
-#if ENABLE(STYLE_SCOPED)
-    void registerScopedHTMLStyleChild();
-    void unregisterScopedHTMLStyleChild();
-    bool hasScopedHTMLStyleChild() const;
-    size_t numberOfScopedHTMLStyleChildren() const;
-#endif
-
     bool webkitMatchesSelector(const String& selectors, ExceptionCode&);
 
     DOMTokenList* classList();
@@ -376,7 +372,7 @@ public:
     virtual void dispatchFormControlChangeEvent() { }
 
 #if ENABLE(SVG)
-    virtual bool childShouldCreateRenderer(Node*) const; 
+    virtual bool childShouldCreateRenderer(const NodeRenderingContext&) const;
 #endif
     
 #if ENABLE(FULLSCREEN_API)
@@ -396,7 +392,10 @@ public:
     
     PassRefPtr<RenderStyle> styleForRenderer();
 
-    PassRefPtr<Attribute> createAttribute(const QualifiedName&, const AtomicString& value);
+    const AtomicString& webkitRegionOverflow() const;
+
+    bool hasID() const;
+    bool hasClass() const;
 
 protected:
     Element(const QualifiedName& tagName, Document* document, ConstructionType type)
@@ -418,11 +417,6 @@ protected:
     virtual bool shouldRegisterAsNamedItem() const { return false; }
     virtual bool shouldRegisterAsExtraNamedItem() const { return false; }
 
-    // The implementation of Element::attributeChanged() calls the following two functions.
-    // They are separated to allow a different flow of control in StyledElement::attributeChanged().
-    void recalcStyleIfNeededAfterAttributeChanged(Attribute*);
-    void updateAfterAttributeChanged(Attribute*);
-    
     void idAttributeChanged(Attribute*);
 
     HTMLCollection* ensureCachedHTMLCollection(CollectionType);
@@ -539,7 +533,9 @@ inline Element* Element::nextElementSibling() const
 inline NamedNodeMap* Element::ensureUpdatedAttributes() const
 {
     updateInvalidAttributes();
-    return ensureAttributeMap();
+    if (!m_attributeMap)
+        createAttributeMap();
+    return m_attributeMap.get();
 }
 
 inline NamedNodeMap* Element::updatedAttributes() const
@@ -548,10 +544,29 @@ inline NamedNodeMap* Element::updatedAttributes() const
     return m_attributeMap.get();
 }
 
+inline ElementAttributeData* Element::ensureAttributeData() const
+{
+    if (!m_attributeMap)
+        createAttributeMap();
+    return m_attributeMap->attributeData();
+}
+
+inline ElementAttributeData* Element::updatedAttributeData() const
+{
+    updateInvalidAttributes();
+    return attributeData();
+}
+
+inline ElementAttributeData* Element::ensureUpdatedAttributeData() const
+{
+    updateInvalidAttributes();
+    return ensureAttributeData();
+}
+
 inline void Element::setAttributesFromElement(const Element& other)
 {
-    if (NamedNodeMap* attributeMap = other.updatedAttributes())
-        ensureUpdatedAttributes()->setAttributes(*attributeMap);
+    if (ElementAttributeData* attributeData = other.updatedAttributeData())
+        ensureUpdatedAttributeData()->setAttributes(*attributeData, this);
 }
 
 inline void Element::updateName(const AtomicString& oldName, const AtomicString& newName)
@@ -628,7 +643,12 @@ inline bool Element::isIdAttributeName(const QualifiedName& attributeName) const
 
 inline const AtomicString& Element::getIdAttribute() const
 {
-    return fastGetAttribute(document()->idAttributeName());
+    return hasID() ? fastGetAttribute(document()->idAttributeName()) : nullAtom;
+}
+
+inline const AtomicString& Element::getNameAttribute() const
+{
+    return hasName() ? fastGetAttribute(HTMLNames::nameAttr) : nullAtom;
 }
 
 inline void Element::setIdAttribute(const AtomicString& value)
@@ -660,13 +680,6 @@ inline void Element::removeAttribute(unsigned index)
     m_attributeMap->removeAttribute(index);
 }
 
-inline NamedNodeMap* Element::ensureAttributeMap() const
-{
-    if (!m_attributeMap)
-        createAttributeMap();
-    return m_attributeMap.get();
-}
-
 inline void Element::updateInvalidAttributes() const
 {
     if (!isStyleAttributeValid())
@@ -687,6 +700,27 @@ inline Element* firstElementChild(const ContainerNode* container)
     return static_cast<Element*>(child);
 }
 
+inline bool Element::hasID() const
+{
+    return attributeData() && attributeData()->hasID();
+}
+
+inline bool Element::hasClass() const
+{
+    return attributeData() && attributeData()->hasClass();
+}
+
+// Put here to make them inline.
+inline bool Node::hasID() const
+{
+    return isElementNode() && toElement(this)->hasID();
+}
+
+inline bool Node::hasClass() const
+{
+    return isElementNode() && toElement(this)->hasClass();
+}
+
 } // namespace
 
 #endif
diff --git a/Source/WebCore/dom/Element.idl b/Source/WebCore/dom/Element.idl
index 20d4c8e11..c66b14592 100644
--- a/Source/WebCore/dom/Element.idl
+++ b/Source/WebCore/dom/Element.idl
@@ -22,44 +22,45 @@ module core {
 
     interface [
         JSGenerateToNativeObject,
-        JSInlineGetOwnPropertySlot
+        JSInlineGetOwnPropertySlot,
+        V8CustomToJSObject
     ] Element : Node {
 
         // DOM Level 1 Core
 
-        readonly attribute [ConvertNullStringTo=Null] DOMString tagName;
+        readonly attribute [TreatReturnedNullStringAs=Null] DOMString tagName;
 
-        [ConvertNullStringTo=Null] DOMString getAttribute(in [Optional=CallWithDefaultValue] DOMString name);
-        [ObjCLegacyUnnamedParameters] void setAttribute(in [Optional=CallWithDefaultValue] DOMString name,
-                                         in [Optional=CallWithDefaultValue] DOMString value)
+        [TreatReturnedNullStringAs=Null] DOMString getAttribute(in [Optional=DefaultIsUndefined] DOMString name);
+        [ObjCLegacyUnnamedParameters] void setAttribute(in [Optional=DefaultIsUndefined] DOMString name,
+                                         in [Optional=DefaultIsUndefined] DOMString value)
             raises(DOMException);
-        void removeAttribute(in [Optional=CallWithDefaultValue] DOMString name);
-        Attr getAttributeNode(in [Optional=CallWithDefaultValue] DOMString name);
-        Attr setAttributeNode(in [Optional=CallWithDefaultValue] Attr newAttr)
+        void removeAttribute(in [Optional=DefaultIsUndefined] DOMString name);
+        Attr getAttributeNode(in [Optional=DefaultIsUndefined] DOMString name);
+        Attr setAttributeNode(in [Optional=DefaultIsUndefined] Attr newAttr)
             raises(DOMException);
-        Attr removeAttributeNode(in [Optional=CallWithDefaultValue] Attr oldAttr)
+        Attr removeAttributeNode(in [Optional=DefaultIsUndefined] Attr oldAttr)
             raises(DOMException);
-        NodeList getElementsByTagName(in [Optional=CallWithDefaultValue] DOMString name);
+        NodeList getElementsByTagName(in [Optional=DefaultIsUndefined] DOMString name);
 
         // DOM Level 2 Core
 
-        [ObjCLegacyUnnamedParameters] DOMString getAttributeNS(in [TreatNullAs=NullString,Optional=CallWithDefaultValue] DOMString namespaceURI,
-                                                in [Optional=CallWithDefaultValue] DOMString localName);
-        [ObjCLegacyUnnamedParameters] void setAttributeNS(in [TreatNullAs=NullString,Optional=CallWithDefaultValue] DOMString namespaceURI,
-                                           in [Optional=CallWithDefaultValue] DOMString qualifiedName, 
-                                           in [Optional=CallWithDefaultValue] DOMString value)
+        [ObjCLegacyUnnamedParameters] DOMString getAttributeNS(in [TreatNullAs=NullString,Optional=DefaultIsUndefined] DOMString namespaceURI,
+                                                in [Optional=DefaultIsUndefined] DOMString localName);
+        [ObjCLegacyUnnamedParameters] void setAttributeNS(in [TreatNullAs=NullString,Optional=DefaultIsUndefined] DOMString namespaceURI,
+                                           in [Optional=DefaultIsUndefined] DOMString qualifiedName, 
+                                           in [Optional=DefaultIsUndefined] DOMString value)
             raises(DOMException);
         [ObjCLegacyUnnamedParameters] void removeAttributeNS(in [TreatNullAs=NullString] DOMString namespaceURI,
                                               in DOMString localName);
-        [ObjCLegacyUnnamedParameters] NodeList getElementsByTagNameNS(in [TreatNullAs=NullString,Optional=CallWithDefaultValue] DOMString namespaceURI,
-                                                       in [Optional=CallWithDefaultValue] DOMString localName);
-        [ObjCLegacyUnnamedParameters] Attr getAttributeNodeNS(in [TreatNullAs=NullString,Optional=CallWithDefaultValue] DOMString namespaceURI,
-                                               in [Optional=CallWithDefaultValue] DOMString localName);
-        Attr setAttributeNodeNS(in [Optional=CallWithDefaultValue] Attr newAttr)
+        [ObjCLegacyUnnamedParameters] NodeList getElementsByTagNameNS(in [TreatNullAs=NullString,Optional=DefaultIsUndefined] DOMString namespaceURI,
+                                                       in [Optional=DefaultIsUndefined] DOMString localName);
+        [ObjCLegacyUnnamedParameters] Attr getAttributeNodeNS(in [TreatNullAs=NullString,Optional=DefaultIsUndefined] DOMString namespaceURI,
+                                               in [Optional=DefaultIsUndefined] DOMString localName);
+        Attr setAttributeNodeNS(in [Optional=DefaultIsUndefined] Attr newAttr)
             raises(DOMException);
         boolean hasAttribute(in DOMString name);
-        [ObjCLegacyUnnamedParameters] boolean hasAttributeNS(in [TreatNullAs=NullString,Optional=CallWithDefaultValue] DOMString namespaceURI,
-                                              in [Optional=CallWithDefaultValue] DOMString localName);
+        [ObjCLegacyUnnamedParameters] boolean hasAttributeNS(in [TreatNullAs=NullString,Optional=DefaultIsUndefined] DOMString namespaceURI,
+                                              in [Optional=DefaultIsUndefined] DOMString localName);
 
         readonly attribute CSSStyleDeclaration style;
 
@@ -86,15 +87,15 @@ module core {
         // WebKit extensions
 
         void scrollIntoViewIfNeeded(in [Optional] boolean centerIfNeeded);
-        void scrollByLines(in [Optional=CallWithDefaultValue] long lines);
-        void scrollByPages(in [Optional=CallWithDefaultValue] long pages);
+        void scrollByLines(in [Optional=DefaultIsUndefined] long lines);
+        void scrollByPages(in [Optional=DefaultIsUndefined] long pages);
 
 #if defined(ENABLE_ANIMATION_API) && ENABLE_ANIMATION_API
         WebKitAnimationList webkitGetAnimations();
 #endif
 
         // HTML 5
-        NodeList getElementsByClassName(in [Optional=CallWithDefaultValue] DOMString name);
+        NodeList getElementsByClassName(in [Optional=DefaultIsUndefined] DOMString name);
 
 #if defined(LANGUAGE_JAVASCRIPT) && LANGUAGE_JAVASCRIPT
         readonly attribute DOMStringMap dataset;
@@ -107,7 +108,7 @@ module core {
             raises(DOMException);
 
         // WebKit extension, pending specification.
-        boolean webkitMatchesSelector(in [Optional=CallWithDefaultValue] DOMString selectors)
+        boolean webkitMatchesSelector(in [Optional=DefaultIsUndefined] DOMString selectors)
             raises(DOMException);
 
         // ElementTraversal API
@@ -130,9 +131,12 @@ module core {
 
 #if defined(ENABLE_FULLSCREEN_API) && ENABLE_FULLSCREEN_API
         const unsigned short ALLOW_KEYBOARD_INPUT = 1;
-        [V8EnabledAtRuntime] void webkitRequestFullScreen(in [Optional=CallWithDefaultValue] unsigned short flags);
+        [V8EnabledAtRuntime] void webkitRequestFullScreen(in [Optional=DefaultIsUndefined] unsigned short flags);
 #endif
 
+        // CSS Regions API
+        readonly attribute DOMString webkitRegionOverflow;
+
 #if !defined(LANGUAGE_OBJECTIVE_C) || !LANGUAGE_OBJECTIVE_C
         // Event handler DOM attributes
         attribute [NotEnumerable] EventListener onabort;
diff --git a/Source/WebCore/dom/ElementAttributeData.cpp b/Source/WebCore/dom/ElementAttributeData.cpp
index cea62f3cf..71457f4b1 100644
--- a/Source/WebCore/dom/ElementAttributeData.cpp
+++ b/Source/WebCore/dom/ElementAttributeData.cpp
@@ -26,38 +26,159 @@
 #include "config.h"
 #include "ElementAttributeData.h"
 
+#include "Attr.h"
 #include "StyledElement.h"
 
 namespace WebCore {
 
+ElementAttributeData::~ElementAttributeData()
+{
+    detachAttributesFromElement();
+}
+
 void ElementAttributeData::setClass(const String& className, bool shouldFoldCase)
 {
     m_classNames.set(className, shouldFoldCase);
 }
 
-StylePropertySet* ElementAttributeData::ensureInlineStyleDecl(Element* element)
+StylePropertySet* ElementAttributeData::ensureInlineStyleDecl(StyledElement* element)
 {
     if (!m_inlineStyleDecl) {
         ASSERT(element->isStyledElement());
-        m_inlineStyleDecl = StylePropertySet::createInline(static_cast<StyledElement*>(element));
+        m_inlineStyleDecl = StylePropertySet::create();
         m_inlineStyleDecl->setStrictParsing(element->isHTMLElement() && !element->document()->inQuirksMode());
     }
     return m_inlineStyleDecl.get();
 }
 
-void ElementAttributeData::destroyInlineStyleDecl()
+void ElementAttributeData::destroyInlineStyleDecl(StyledElement* element)
 {
     if (!m_inlineStyleDecl)
         return;
-    m_inlineStyleDecl->clearParentElement();
+    m_inlineStyleDecl->clearParentElement(element);
     m_inlineStyleDecl = 0;
 }
 
-StylePropertySet* ElementAttributeData::ensureAttributeStyle(StyledElement* element)
+void ElementAttributeData::addAttribute(PassRefPtr<Attribute> prpAttribute, Element* element)
+{
+    RefPtr<Attribute> attribute = prpAttribute;
+
+    if (element)
+        element->willModifyAttribute(attribute->name(), nullAtom, attribute->value());
+
+    m_attributes.append(attribute);
+    if (Attr* attr = attribute->attr())
+        attr->m_element = element;
+
+    if (element)
+        element->didModifyAttribute(attribute.get());
+}
+
+void ElementAttributeData::removeAttribute(size_t index, Element* element)
+{
+    ASSERT(index < length());
+
+    RefPtr<Attribute> attribute = m_attributes[index];
+
+    if (element)
+        element->willRemoveAttribute(attribute->name(), attribute->value());
+
+    if (Attr* attr = attribute->attr())
+        attr->m_element = 0;
+    m_attributes.remove(index);
+
+    if (element)
+        element->didRemoveAttribute(attribute.get());
+}
+
+void ElementAttributeData::detachAttributesFromElement()
+{
+    size_t size = m_attributes.size();
+    for (size_t i = 0; i < size; i++) {
+        if (Attr* attr = m_attributes[i]->attr())
+            attr->m_element = 0;
+    }
+}
+
+void ElementAttributeData::copyAttributesToVector(Vector<RefPtr<Attribute> >& copy)
+{
+    copy = m_attributes;
+}
+
+size_t ElementAttributeData::getAttributeItemIndexSlowCase(const String& name, bool shouldIgnoreAttributeCase) const
+{
+    unsigned len = length();
+
+    // Continue to checking case-insensitively and/or full namespaced names if necessary:
+    for (unsigned i = 0; i < len; ++i) {
+        const QualifiedName& attrName = m_attributes[i]->name();
+        if (!attrName.hasPrefix()) {
+            if (shouldIgnoreAttributeCase && equalIgnoringCase(name, attrName.localName()))
+                return i;
+        } else {
+            // FIXME: Would be faster to do this comparison without calling toString, which
+            // generates a temporary string by concatenation. But this branch is only reached
+            // if the attribute name has a prefix, which is rare in HTML.
+            if (equalPossiblyIgnoringCase(name, attrName.toString(), shouldIgnoreAttributeCase))
+                return i;
+        }
+    }
+    return notFound;
+}
+
+void ElementAttributeData::setAttributes(const ElementAttributeData& other, Element* element)
+{
+    ASSERT(element);
+
+    // If assigning the map changes the id attribute, we need to call
+    // updateId.
+    Attribute* oldId = getAttributeItem(element->document()->idAttributeName());
+    Attribute* newId = other.getAttributeItem(element->document()->idAttributeName());
+
+    if (oldId || newId)
+        element->updateId(oldId ? oldId->value() : nullAtom, newId ? newId->value() : nullAtom);
+
+    Attribute* oldName = getAttributeItem(HTMLNames::nameAttr);
+    Attribute* newName = other.getAttributeItem(HTMLNames::nameAttr);
+
+    if (oldName || newName)
+        element->updateName(oldName ? oldName->value() : nullAtom, newName ? newName->value() : nullAtom);
+
+    clearAttributes();
+    unsigned newLength = other.length();
+    m_attributes.resize(newLength);
+
+    // FIXME: These loops can probably be combined.
+    for (unsigned i = 0; i < newLength; i++)
+        m_attributes[i] = other.m_attributes[i]->clone();
+    for (unsigned i = 0; i < newLength; i++)
+        element->attributeChanged(m_attributes[i].get());
+}
+
+void ElementAttributeData::clearAttributes()
 {
-    if (!m_attributeStyle)
-        m_attributeStyle = StylePropertySet::createAttributeStyle(element);
-    return m_attributeStyle.get();
+    clearClass();
+    detachAttributesFromElement();
+    m_attributes.clear();
+}
+
+void ElementAttributeData::replaceAttribute(size_t index, PassRefPtr<Attribute> prpAttribute, Element* element)
+{
+    ASSERT(element);
+    ASSERT(index < length());
+
+    RefPtr<Attribute> attribute = prpAttribute;
+    Attribute* old = m_attributes[index].get();
+
+    element->willModifyAttribute(attribute->name(), old->value(), attribute->value());
+
+    if (Attr* attr = old->attr())
+        attr->m_element = 0;
+    m_attributes[index] = attribute;
+    if (Attr* attr = attribute->attr())
+        attr->m_element = element;
+
+    element->didModifyAttribute(attribute.get());
 }
 
 }
diff --git a/Source/WebCore/dom/ElementAttributeData.h b/Source/WebCore/dom/ElementAttributeData.h
index 408065981..be145617c 100644
--- a/Source/WebCore/dom/ElementAttributeData.h
+++ b/Source/WebCore/dom/ElementAttributeData.h
@@ -26,8 +26,10 @@
 #ifndef ElementAttributeData_h
 #define ElementAttributeData_h
 
+#include "Attribute.h"
 #include "SpaceSplitString.h"
 #include "StylePropertySet.h"
+#include <wtf/NotFound.h>
 
 namespace WebCore {
 
@@ -35,6 +37,8 @@ class Element;
 
 class ElementAttributeData {
 public:
+    ~ElementAttributeData();
+
     void clearClass() { m_classNames.clear(); }
     void setClass(const String& className, bool shouldFoldCase);
     const SpaceSplitString& classNames() const { return m_classNames; }
@@ -43,25 +47,109 @@ public:
     void setIdForStyleResolution(const AtomicString& newId) { m_idForStyleResolution = newId; }
 
     StylePropertySet* inlineStyleDecl() { return m_inlineStyleDecl.get(); }
-    StylePropertySet* ensureInlineStyleDecl(Element*);
-    void destroyInlineStyleDecl();
+    StylePropertySet* ensureInlineStyleDecl(StyledElement*);
+    void destroyInlineStyleDecl(StyledElement* element);
 
     StylePropertySet* attributeStyle() const { return m_attributeStyle.get(); }
-    StylePropertySet* ensureAttributeStyle(StyledElement*);
+    void setAttributeStyle(PassRefPtr<StylePropertySet> style) { m_attributeStyle = style; }
+
+    size_t length() const { return m_attributes.size(); }
+    bool isEmpty() const { return m_attributes.isEmpty(); }
+
+    // Internal interface.
+    Attribute* attributeItem(unsigned index) const { return m_attributes[index].get(); }
+    Attribute* getAttributeItem(const QualifiedName&) const;
+    size_t getAttributeItemIndex(const QualifiedName&) const;
+
+    // These functions do no error checking.
+    void addAttribute(PassRefPtr<Attribute>, Element*);
+    void removeAttribute(const QualifiedName&, Element*);
+    void removeAttribute(size_t index, Element*);
+
+    bool hasID() const { return !m_idForStyleResolution.isNull(); }
+    bool hasClass() const { return !m_classNames.isNull(); }
 
 private:
+    friend class Element;
     friend class NamedNodeMap;
 
     ElementAttributeData()
     {
     }
 
+    void detachAttributesFromElement();
+    void copyAttributesToVector(Vector<RefPtr<Attribute> >&);
+    Attribute* getAttributeItem(const String& name, bool shouldIgnoreAttributeCase) const;
+    size_t getAttributeItemIndex(const String& name, bool shouldIgnoreAttributeCase) const;
+    size_t getAttributeItemIndexSlowCase(const String& name, bool shouldIgnoreAttributeCase) const;
+    void setAttributes(const ElementAttributeData& other, Element*);
+    void clearAttributes();
+    void replaceAttribute(size_t index, PassRefPtr<Attribute>, Element*);
+
     RefPtr<StylePropertySet> m_inlineStyleDecl;
     RefPtr<StylePropertySet> m_attributeStyle;
     SpaceSplitString m_classNames;
     AtomicString m_idForStyleResolution;
+    Vector<RefPtr<Attribute>, 4> m_attributes;
 };
 
+inline void ElementAttributeData::removeAttribute(const QualifiedName& name, Element* element)
+{
+    size_t index = getAttributeItemIndex(name);
+    if (index == notFound)
+        return;
+
+    removeAttribute(index, element);
+}
+
+inline Attribute* ElementAttributeData::getAttributeItem(const String& name, bool shouldIgnoreAttributeCase) const
+{
+    size_t index = getAttributeItemIndex(name, shouldIgnoreAttributeCase);
+    if (index != notFound)
+        return m_attributes[index].get();
+    return 0;
+}
+
+inline Attribute* ElementAttributeData::getAttributeItem(const QualifiedName& name) const
+{
+    size_t index = getAttributeItemIndex(name);
+    if (index != notFound)
+        return m_attributes[index].get();
+    return 0;
+}
+
+// We use a boolean parameter instead of calling shouldIgnoreAttributeCase so that the caller
+// can tune the behavior (hasAttribute is case sensitive whereas getAttribute is not).
+inline size_t ElementAttributeData::getAttributeItemIndex(const QualifiedName& name) const
+{
+    size_t len = length();
+    for (unsigned i = 0; i < len; ++i) {
+        if (m_attributes[i]->name().matches(name))
+            return i;
+    }
+    return notFound;
+}
+
+inline size_t ElementAttributeData::getAttributeItemIndex(const String& name, bool shouldIgnoreAttributeCase) const
+{
+    unsigned len = length();
+    bool doSlowCheck = shouldIgnoreAttributeCase;
+
+    // Optimize for the case where the attribute exists and its name exactly matches.
+    for (unsigned i = 0; i < len; ++i) {
+        const QualifiedName& attrName = m_attributes[i]->name();
+        if (!attrName.hasPrefix()) {
+            if (name == attrName.localName())
+                return i;
+        } else
+            doSlowCheck = true;
+    }
+
+    if (doSlowCheck)
+        return getAttributeItemIndexSlowCase(name, shouldIgnoreAttributeCase);
+    return notFound;
+}
+
 }
 
 #endif // ElementAttributeData_h
diff --git a/Source/WebCore/dom/ElementRareData.h b/Source/WebCore/dom/ElementRareData.h
index ca32115e6..ff45783bd 100644
--- a/Source/WebCore/dom/ElementRareData.h
+++ b/Source/WebCore/dom/ElementRareData.h
@@ -27,12 +27,11 @@
 #include "Element.h"
 #include "HTMLCollection.h"
 #include "NodeRareData.h"
+#include "ShadowRootList.h"
 #include <wtf/OwnPtr.h>
 
 namespace WebCore {
 
-class ShadowRoot;
-
 class ElementRareData : public NodeRareData {
 public:
     ElementRareData();
@@ -40,13 +39,6 @@ public:
 
     void resetComputedStyle();
 
-#if ENABLE(STYLE_SCOPED)
-    void registerScopedHTMLStyleChild();
-    void unregisterScopedHTMLStyleChild();
-    bool hasScopedHTMLStyleChild() const;
-    size_t numberOfScopedHTMLStyleChildren() const;
-#endif
-
     using NodeRareData::needsFocusAppearanceUpdateSoonAfterAttach;
     using NodeRareData::setNeedsFocusAppearanceUpdateSoonAfterAttach;
 
@@ -72,13 +64,9 @@ public:
 
     LayoutSize m_minimumSizeForResizing;
     RefPtr<RenderStyle> m_computedStyle;
-    ShadowRoot* m_shadowRoot;
+    ShadowRootList m_shadowRootList;
     AtomicString m_shadowPseudoId;
 
-#if ENABLE(STYLE_SCOPED)
-    size_t m_numberOfScopedHTMLStyleChildren;
-#endif
-
     OwnPtr<DatasetDOMStringMap> m_datasetDOMStringMap;
     OwnPtr<ClassList> m_classList;
 
@@ -95,11 +83,8 @@ inline IntSize defaultMinimumSizeForResizing()
 }
 
 inline ElementRareData::ElementRareData()
-    : m_minimumSizeForResizing(defaultMinimumSizeForResizing())
-    , m_shadowRoot(0)
-#if ENABLE(STYLE_SCOPED)
-    , m_numberOfScopedHTMLStyleChildren(0)
-#endif
+    : NodeRareData()
+    , m_minimumSizeForResizing(defaultMinimumSizeForResizing())
     , m_styleAffectedByEmpty(false)
 #if ENABLE(FULLSCREEN_API)
     , m_containsFullScreenElement(false)
@@ -109,7 +94,7 @@ inline ElementRareData::ElementRareData()
 
 inline ElementRareData::~ElementRareData()
 {
-    ASSERT(!m_shadowRoot);
+    ASSERT(!m_shadowRootList.hasShadowRoot());
 }
 
 inline void ElementRareData::resetComputedStyle()
@@ -117,29 +102,5 @@ inline void ElementRareData::resetComputedStyle()
     m_computedStyle.clear();
 }
 
-#if ENABLE(STYLE_SCOPED)
-inline void ElementRareData::registerScopedHTMLStyleChild()
-{
-    ++m_numberOfScopedHTMLStyleChildren;
-}
-
-inline void ElementRareData::unregisterScopedHTMLStyleChild()
-{
-    ASSERT(m_numberOfScopedHTMLStyleChildren > 0);
-    if (m_numberOfScopedHTMLStyleChildren > 0)
-        --m_numberOfScopedHTMLStyleChildren;
-}
-
-inline bool ElementRareData::hasScopedHTMLStyleChild() const
-{
-    return m_numberOfScopedHTMLStyleChildren;
-}
-
-inline size_t ElementRareData::numberOfScopedHTMLStyleChildren() const
-{
-    return m_numberOfScopedHTMLStyleChildren;
-}
-#endif
-
 }
 #endif // ElementRareData_h
diff --git a/Source/WebCore/dom/Entity.idl b/Source/WebCore/dom/Entity.idl
index 8dacbe90a..b9ec406b9 100644
--- a/Source/WebCore/dom/Entity.idl
+++ b/Source/WebCore/dom/Entity.idl
@@ -20,9 +20,9 @@
 module core {
 
     interface Entity : Node {
-        readonly attribute [ConvertNullStringTo=Null] DOMString publicId;
-        readonly attribute [ConvertNullStringTo=Null] DOMString systemId;
-        readonly attribute [ConvertNullStringTo=Null] DOMString notationName;
+        readonly attribute [TreatReturnedNullStringAs=Null] DOMString publicId;
+        readonly attribute [TreatReturnedNullStringAs=Null] DOMString systemId;
+        readonly attribute [TreatReturnedNullStringAs=Null] DOMString notationName;
     };
 
 }
diff --git a/Source/WebCore/dom/Event.idl b/Source/WebCore/dom/Event.idl
index 94d45427e..2abd5a950 100644
--- a/Source/WebCore/dom/Event.idl
+++ b/Source/WebCore/dom/Event.idl
@@ -22,7 +22,7 @@ module events {
 
     // Introduced in DOM Level 2:
     interface [
-        JSCustomToJS,
+        CustomToJSObject,
         ConstructorTemplate=Event,
         JSNoStaticTables,
         ObjCPolymorphic
@@ -63,9 +63,9 @@ module events {
 
         void               stopPropagation();
         void               preventDefault();
-        [ObjCLegacyUnnamedParameters] void initEvent(in [Optional=CallWithDefaultValue] DOMString eventTypeArg, 
-                                      in [Optional=CallWithDefaultValue] boolean canBubbleArg, 
-                                      in [Optional=CallWithDefaultValue] boolean cancelableArg);
+        [ObjCLegacyUnnamedParameters] void initEvent(in [Optional=DefaultIsUndefined] DOMString eventTypeArg, 
+                                      in [Optional=DefaultIsUndefined] boolean canBubbleArg, 
+                                      in [Optional=DefaultIsUndefined] boolean cancelableArg);
 
         // DOM Level 3 Additions.
         readonly attribute boolean defaultPrevented;
diff --git a/Source/WebCore/dom/EventDispatcher.cpp b/Source/WebCore/dom/EventDispatcher.cpp
index 7573832ba..3ee5285bc 100644
--- a/Source/WebCore/dom/EventDispatcher.cpp
+++ b/Source/WebCore/dom/EventDispatcher.cpp
@@ -127,7 +127,7 @@ static inline bool isShadowRootOrSVGShadowRoot(const Node* node)
 
 static inline bool isShadowHost(Node* node)
 {
-    return node->isElementNode() && toElement(node)->shadowRoot();
+    return node->isElementNode() && toElement(node)->hasShadowRoot();
 }
 
 PassRefPtr<EventTarget> EventDispatcher::adjustToShadowBoundaries(PassRefPtr<Node> relatedTarget, const Vector<Node*> relatedTargetAncestors)
diff --git a/Source/WebCore/dom/EventSender.h b/Source/WebCore/dom/EventSender.h
new file mode 100644
index 000000000..646034c32
--- /dev/null
+++ b/Source/WebCore/dom/EventSender.h
@@ -0,0 +1,114 @@
+/*
+ * Copyright (C) 2012 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef EventSender_h
+#define EventSender_h
+
+#include "Timer.h"
+#include <wtf/Vector.h>
+
+namespace WebCore {
+
+template<typename T> class EventSender {
+    WTF_MAKE_NONCOPYABLE(EventSender); WTF_MAKE_FAST_ALLOCATED;
+public:
+    explicit EventSender(const AtomicString& eventType);
+
+    const AtomicString& eventType() const { return m_eventType; }
+    void dispatchEventSoon(T*);
+    void cancelEvent(T*);
+    void dispatchPendingEvents();
+
+#ifndef NDEBUG
+    bool hasPendingEvents(T* sender) const
+    {
+        return m_dispatchSoonList.find(sender) != notFound || m_dispatchingList.find(sender) != notFound;
+    }
+#endif
+
+private:
+    void timerFired(Timer<EventSender<T> >*) { dispatchPendingEvents(); }
+
+    AtomicString m_eventType;
+    Timer<EventSender<T> > m_timer;
+    Vector<T*> m_dispatchSoonList;
+    Vector<T*> m_dispatchingList;
+};
+
+template<typename T> EventSender<T>::EventSender(const AtomicString& eventType)
+    : m_eventType(eventType)
+    , m_timer(this, &EventSender::timerFired)
+{
+}
+
+template<typename T> void EventSender<T>::dispatchEventSoon(T* sender)
+{
+    m_dispatchSoonList.append(sender);
+    if (!m_timer.isActive())
+        m_timer.startOneShot(0);
+}
+
+template<typename T> void EventSender<T>::cancelEvent(T* sender)
+{
+    // Remove instances of this sender from both lists.
+    // Use loops because we allow multiple instances to get into the lists.
+    size_t size = m_dispatchSoonList.size();
+    for (size_t i = 0; i < size; ++i) {
+        if (m_dispatchSoonList[i] == sender)
+            m_dispatchSoonList[i] = 0;
+    }
+    size = m_dispatchingList.size();
+    for (size_t i = 0; i < size; ++i) {
+        if (m_dispatchingList[i] == sender)
+            m_dispatchingList[i] = 0;
+    }
+}
+
+template<typename T> void EventSender<T>::dispatchPendingEvents()
+{
+    // Need to avoid re-entering this function; if new dispatches are
+    // scheduled before the parent finishes processing the list, they
+    // will set a timer and eventually be processed.
+    if (!m_dispatchingList.isEmpty())
+        return;
+
+    m_timer.stop();
+
+    m_dispatchSoonList.checkConsistency();
+
+    m_dispatchingList.swap(m_dispatchSoonList);
+    size_t size = m_dispatchingList.size();
+    for (size_t i = 0; i < size; ++i) {
+        if (T* sender = m_dispatchingList[i]) {
+            m_dispatchingList[i] = 0;
+            sender->dispatchPendingEvent(this);
+        }
+    }
+    m_dispatchingList.clear();
+}
+
+} // namespace WebCore
+
+#endif // EventSender_h
diff --git a/Source/WebCore/dom/HashChangeEvent.idl b/Source/WebCore/dom/HashChangeEvent.idl
index b2b48877b..6c80a957f 100644
--- a/Source/WebCore/dom/HashChangeEvent.idl
+++ b/Source/WebCore/dom/HashChangeEvent.idl
@@ -23,11 +23,11 @@ module events {
     interface [
         ConstructorTemplate=Event
     ] HashChangeEvent : Event {
-        void initHashChangeEvent(in [Optional=CallWithDefaultValue] DOMString type, 
-                                 in [Optional=CallWithDefaultValue] boolean canBubble, 
-                                 in [Optional=CallWithDefaultValue] boolean cancelable, 
-                                 in [Optional=CallWithDefaultValue] DOMString oldURL, 
-                                 in [Optional=CallWithDefaultValue] DOMString newURL); 
+        void initHashChangeEvent(in [Optional=DefaultIsUndefined] DOMString type, 
+                                 in [Optional=DefaultIsUndefined] boolean canBubble, 
+                                 in [Optional=DefaultIsUndefined] boolean cancelable, 
+                                 in [Optional=DefaultIsUndefined] DOMString oldURL, 
+                                 in [Optional=DefaultIsUndefined] DOMString newURL); 
         readonly attribute [InitializedByEventConstructor] DOMString oldURL;
         readonly attribute [InitializedByEventConstructor] DOMString newURL;
     };
diff --git a/Source/WebCore/dom/KeyboardEvent.idl b/Source/WebCore/dom/KeyboardEvent.idl
index e71361f67..2c2b7ba11 100644
--- a/Source/WebCore/dom/KeyboardEvent.idl
+++ b/Source/WebCore/dom/KeyboardEvent.idl
@@ -40,37 +40,37 @@ module events {
         readonly attribute boolean          altGraphKey;
 
 #if !defined(LANGUAGE_JAVASCRIPT) || !LANGUAGE_JAVASCRIPT
-        boolean getModifierState(in [Optional=CallWithDefaultValue] DOMString keyIdentifierArg);
+        boolean getModifierState(in [Optional=DefaultIsUndefined] DOMString keyIdentifierArg);
 #endif
 
         // FIXME: this does not match the version in the DOM spec.
-        void initKeyboardEvent(in [Optional=CallWithDefaultValue] DOMString type, 
-                               in [Optional=CallWithDefaultValue] boolean canBubble, 
-                               in [Optional=CallWithDefaultValue] boolean cancelable, 
-                               in [Optional=CallWithDefaultValue] DOMWindow view, 
-                               in [Optional=CallWithDefaultValue] DOMString keyIdentifier,
-                               in [Optional=CallWithDefaultValue] unsigned long keyLocation,
-                               in [Optional=CallWithDefaultValue] boolean ctrlKey,
-                               in [Optional=CallWithDefaultValue] boolean altKey,
-                               in [Optional=CallWithDefaultValue] boolean shiftKey,
-                               in [Optional=CallWithDefaultValue] boolean metaKey,
-                               in [Optional=CallWithDefaultValue] boolean altGraphKey);
+        void initKeyboardEvent(in [Optional=DefaultIsUndefined] DOMString type, 
+                               in [Optional=DefaultIsUndefined] boolean canBubble, 
+                               in [Optional=DefaultIsUndefined] boolean cancelable, 
+                               in [Optional=DefaultIsUndefined] DOMWindow view, 
+                               in [Optional=DefaultIsUndefined] DOMString keyIdentifier,
+                               in [Optional=DefaultIsUndefined] unsigned long keyLocation,
+                               in [Optional=DefaultIsUndefined] boolean ctrlKey,
+                               in [Optional=DefaultIsUndefined] boolean altKey,
+                               in [Optional=DefaultIsUndefined] boolean shiftKey,
+                               in [Optional=DefaultIsUndefined] boolean metaKey,
+                               in [Optional=DefaultIsUndefined] boolean altGraphKey);
 
         // WebKit Extensions
 #if !defined(LANGUAGE_JAVASCRIPT) || !LANGUAGE_JAVASCRIPT
         readonly attribute long             keyCode;
         readonly attribute long             charCode;
         
-        void initKeyboardEvent(in [Optional=CallWithDefaultValue] DOMString type, 
-                               in [Optional=CallWithDefaultValue] boolean canBubble, 
-                               in [Optional=CallWithDefaultValue] boolean cancelable, 
-                               in [Optional=CallWithDefaultValue] DOMWindow view, 
-                               in [Optional=CallWithDefaultValue] DOMString keyIdentifier,
-                               in [Optional=CallWithDefaultValue] unsigned long keyLocation,
-                               in [Optional=CallWithDefaultValue] boolean ctrlKey,
-                               in [Optional=CallWithDefaultValue] boolean altKey,
-                               in [Optional=CallWithDefaultValue] boolean shiftKey,
-                               in [Optional=CallWithDefaultValue] boolean metaKey);
+        void initKeyboardEvent(in [Optional=DefaultIsUndefined] DOMString type, 
+                               in [Optional=DefaultIsUndefined] boolean canBubble, 
+                               in [Optional=DefaultIsUndefined] boolean cancelable, 
+                               in [Optional=DefaultIsUndefined] DOMWindow view, 
+                               in [Optional=DefaultIsUndefined] DOMString keyIdentifier,
+                               in [Optional=DefaultIsUndefined] unsigned long keyLocation,
+                               in [Optional=DefaultIsUndefined] boolean ctrlKey,
+                               in [Optional=DefaultIsUndefined] boolean altKey,
+                               in [Optional=DefaultIsUndefined] boolean shiftKey,
+                               in [Optional=DefaultIsUndefined] boolean metaKey);
 #endif
 
     };
diff --git a/Source/WebCore/dom/MessageEvent.idl b/Source/WebCore/dom/MessageEvent.idl
index 123235929..c8356ed60 100644
--- a/Source/WebCore/dom/MessageEvent.idl
+++ b/Source/WebCore/dom/MessageEvent.idl
@@ -38,23 +38,23 @@ module events {
         readonly attribute [InitializedByEventConstructor, CachedAttribute, CustomGetter] DOMObject data;
         readonly attribute [InitializedByEventConstructor, CustomGetter] Array ports;
 
-        [Custom] void initMessageEvent(in [Optional=CallWithDefaultValue] DOMString typeArg, 
-                                       in [Optional=CallWithDefaultValue] boolean canBubbleArg, 
-                                       in [Optional=CallWithDefaultValue] boolean cancelableArg, 
-                                       in [Optional=CallWithDefaultValue] DOMObject dataArg, 
-                                       in [Optional=CallWithDefaultValue] DOMString originArg, 
-                                       in [Optional=CallWithDefaultValue] DOMString lastEventIdArg, 
-                                       in [Optional=CallWithDefaultValue] DOMWindow sourceArg, 
-                                       in [Optional=CallWithDefaultValue] Array messagePorts);
+        [Custom] void initMessageEvent(in [Optional=DefaultIsUndefined] DOMString typeArg, 
+                                       in [Optional=DefaultIsUndefined] boolean canBubbleArg, 
+                                       in [Optional=DefaultIsUndefined] boolean cancelableArg, 
+                                       in [Optional=DefaultIsUndefined] DOMObject dataArg, 
+                                       in [Optional=DefaultIsUndefined] DOMString originArg, 
+                                       in [Optional=DefaultIsUndefined] DOMString lastEventIdArg, 
+                                       in [Optional=DefaultIsUndefined] DOMWindow sourceArg, 
+                                       in [Optional=DefaultIsUndefined] Array messagePorts);
 
-        [Custom] void webkitInitMessageEvent(in [Optional=CallWithDefaultValue] DOMString typeArg,
-                                             in [Optional=CallWithDefaultValue] boolean canBubbleArg,
-                                             in [Optional=CallWithDefaultValue] boolean cancelableArg,
-                                             in [Optional=CallWithDefaultValue] DOMObject dataArg,
-                                             in [Optional=CallWithDefaultValue] DOMString originArg,
-                                             in [Optional=CallWithDefaultValue] DOMString lastEventIdArg,
-                                             in [Optional=CallWithDefaultValue] DOMWindow sourceArg,
-                                             in [Optional=CallWithDefaultValue] Array transferables);
+        [Custom] void webkitInitMessageEvent(in [Optional=DefaultIsUndefined] DOMString typeArg,
+                                             in [Optional=DefaultIsUndefined] boolean canBubbleArg,
+                                             in [Optional=DefaultIsUndefined] boolean cancelableArg,
+                                             in [Optional=DefaultIsUndefined] DOMObject dataArg,
+                                             in [Optional=DefaultIsUndefined] DOMString originArg,
+                                             in [Optional=DefaultIsUndefined] DOMString lastEventIdArg,
+                                             in [Optional=DefaultIsUndefined] DOMWindow sourceArg,
+                                             in [Optional=DefaultIsUndefined] Array transferables);
 #else
         // Code generator for ObjC bindings does not support custom bindings, thus there is no good way to
         // return a variant value. As workaround, expose the data attribute as SerializedScriptValue.
@@ -63,14 +63,14 @@ module events {
         // There's no good way to expose an array via the ObjC bindings, so for now just expose a single port.
         readonly attribute MessagePort messagePort;
 
-        void initMessageEvent(in [Optional=CallWithDefaultValue] DOMString typeArg, 
-                              in [Optional=CallWithDefaultValue] boolean canBubbleArg, 
-                              in [Optional=CallWithDefaultValue] boolean cancelableArg, 
-                              in [Optional=CallWithDefaultValue] SerializedScriptValue dataArg, 
-                              in [Optional=CallWithDefaultValue] DOMString originArg, 
-                              in [Optional=CallWithDefaultValue] DOMString lastEventIdArg, 
-                              in [Optional=CallWithDefaultValue] DOMWindow sourceArg, 
-                              in [Optional=CallWithDefaultValue] MessagePort messagePort);
+        void initMessageEvent(in [Optional=DefaultIsUndefined] DOMString typeArg, 
+                              in [Optional=DefaultIsUndefined] boolean canBubbleArg, 
+                              in [Optional=DefaultIsUndefined] boolean cancelableArg, 
+                              in [Optional=DefaultIsUndefined] SerializedScriptValue dataArg, 
+                              in [Optional=DefaultIsUndefined] DOMString originArg, 
+                              in [Optional=DefaultIsUndefined] DOMString lastEventIdArg, 
+                              in [Optional=DefaultIsUndefined] DOMWindow sourceArg, 
+                              in [Optional=DefaultIsUndefined] MessagePort messagePort);
 #endif
 
     };
diff --git a/Source/WebCore/dom/MouseEvent.idl b/Source/WebCore/dom/MouseEvent.idl
index 3ece01c50..48eff1e3e 100644
--- a/Source/WebCore/dom/MouseEvent.idl
+++ b/Source/WebCore/dom/MouseEvent.idl
@@ -34,21 +34,21 @@ module events {
         readonly attribute unsigned short   button;
         readonly attribute EventTarget      relatedTarget;
         
-        [ObjCLegacyUnnamedParameters] void initMouseEvent(in [Optional=CallWithDefaultValue] DOMString type, 
-                                           in [Optional=CallWithDefaultValue] boolean canBubble, 
-                                           in [Optional=CallWithDefaultValue] boolean cancelable, 
-                                           in [Optional=CallWithDefaultValue] DOMWindow view, 
-                                           in [Optional=CallWithDefaultValue] long detail, 
-                                           in [Optional=CallWithDefaultValue] long screenX, 
-                                           in [Optional=CallWithDefaultValue] long screenY, 
-                                           in [Optional=CallWithDefaultValue] long clientX, 
-                                           in [Optional=CallWithDefaultValue] long clientY, 
-                                           in [Optional=CallWithDefaultValue] boolean ctrlKey, 
-                                           in [Optional=CallWithDefaultValue] boolean altKey, 
-                                           in [Optional=CallWithDefaultValue] boolean shiftKey, 
-                                           in [Optional=CallWithDefaultValue] boolean metaKey, 
-                                           in [Optional=CallWithDefaultValue] unsigned short button, 
-                                           in [Optional=CallWithDefaultValue] EventTarget relatedTarget);
+        [ObjCLegacyUnnamedParameters] void initMouseEvent(in [Optional=DefaultIsUndefined] DOMString type, 
+                                           in [Optional=DefaultIsUndefined] boolean canBubble, 
+                                           in [Optional=DefaultIsUndefined] boolean cancelable, 
+                                           in [Optional=DefaultIsUndefined] DOMWindow view, 
+                                           in [Optional=DefaultIsUndefined] long detail, 
+                                           in [Optional=DefaultIsUndefined] long screenX, 
+                                           in [Optional=DefaultIsUndefined] long screenY, 
+                                           in [Optional=DefaultIsUndefined] long clientX, 
+                                           in [Optional=DefaultIsUndefined] long clientY, 
+                                           in [Optional=DefaultIsUndefined] boolean ctrlKey, 
+                                           in [Optional=DefaultIsUndefined] boolean altKey, 
+                                           in [Optional=DefaultIsUndefined] boolean shiftKey, 
+                                           in [Optional=DefaultIsUndefined] boolean metaKey, 
+                                           in [Optional=DefaultIsUndefined] unsigned short button, 
+                                           in [Optional=DefaultIsUndefined] EventTarget relatedTarget);
 
         // extensions
         readonly attribute long             offsetX;
diff --git a/Source/WebCore/dom/MutationEvent.idl b/Source/WebCore/dom/MutationEvent.idl
index 5aee2e560..2765dc9c2 100644
--- a/Source/WebCore/dom/MutationEvent.idl
+++ b/Source/WebCore/dom/MutationEvent.idl
@@ -33,14 +33,14 @@ module events {
         readonly attribute DOMString      attrName;
         readonly attribute unsigned short attrChange;
 
-        [ObjCLegacyUnnamedParameters] void initMutationEvent(in [Optional=CallWithDefaultValue] DOMString type, 
-                                              in [Optional=CallWithDefaultValue] boolean canBubble, 
-                                              in [Optional=CallWithDefaultValue] boolean cancelable, 
-                                              in [Optional=CallWithDefaultValue] Node relatedNode, 
-                                              in [Optional=CallWithDefaultValue] DOMString prevValue, 
-                                              in [Optional=CallWithDefaultValue] DOMString newValue, 
-                                              in [Optional=CallWithDefaultValue] DOMString attrName, 
-                                              in [Optional=CallWithDefaultValue] unsigned short attrChange);
+        [ObjCLegacyUnnamedParameters] void initMutationEvent(in [Optional=DefaultIsUndefined] DOMString type, 
+                                              in [Optional=DefaultIsUndefined] boolean canBubble, 
+                                              in [Optional=DefaultIsUndefined] boolean cancelable, 
+                                              in [Optional=DefaultIsUndefined] Node relatedNode, 
+                                              in [Optional=DefaultIsUndefined] DOMString prevValue, 
+                                              in [Optional=DefaultIsUndefined] DOMString newValue, 
+                                              in [Optional=DefaultIsUndefined] DOMString attrName, 
+                                              in [Optional=DefaultIsUndefined] unsigned short attrChange);
 
     };
 
diff --git a/Source/WebCore/dom/MutationRecord.idl b/Source/WebCore/dom/MutationRecord.idl
index c19b41f21..a7883c50f 100644
--- a/Source/WebCore/dom/MutationRecord.idl
+++ b/Source/WebCore/dom/MutationRecord.idl
@@ -41,8 +41,8 @@ module core {
         readonly attribute Node nextSibling;
 
         readonly attribute DOMString attributeName;
-        readonly attribute [ConvertNullStringTo=Null] DOMString attributeNamespace;
+        readonly attribute [TreatReturnedNullStringAs=Null] DOMString attributeNamespace;
 
-        readonly attribute [ConvertNullStringTo=Null] DOMString oldValue;
+        readonly attribute [TreatReturnedNullStringAs=Null] DOMString oldValue;
     };
 }
diff --git a/Source/WebCore/dom/NameNodeList.cpp b/Source/WebCore/dom/NameNodeList.cpp
index df63a8cfe..47268fe72 100644
--- a/Source/WebCore/dom/NameNodeList.cpp
+++ b/Source/WebCore/dom/NameNodeList.cpp
@@ -44,7 +44,7 @@ NameNodeList::~NameNodeList()
 
 bool NameNodeList::nodeMatches(Element* testNode) const
 {
-    return testNode->fastGetAttribute(nameAttr) == m_nodeName;
+    return testNode->getNameAttribute() == m_nodeName;
 }
 
 } // namespace WebCore
diff --git a/Source/WebCore/dom/NamedNodeMap.cpp b/Source/WebCore/dom/NamedNodeMap.cpp
index 0a32a66ca..47145970e 100644
--- a/Source/WebCore/dom/NamedNodeMap.cpp
+++ b/Source/WebCore/dom/NamedNodeMap.cpp
@@ -40,15 +40,6 @@ static inline bool shouldIgnoreAttributeCase(const Element* e)
     return e && e->document()->isHTMLDocument() && e->isHTMLElement();
 }
 
-inline void NamedNodeMap::detachAttributesFromElement()
-{
-    size_t size = m_attributes.size();
-    for (size_t i = 0; i < size; i++) {
-        if (Attr* attr = m_attributes[i]->attr())
-            attr->m_element = 0;
-    }
-}
-
 void NamedNodeMap::ref()
 {
     ASSERT(m_element);
@@ -61,14 +52,9 @@ void NamedNodeMap::deref()
     m_element->deref();
 }
 
-NamedNodeMap::~NamedNodeMap()
-{
-    detachAttributesFromElement();
-}
-
 PassRefPtr<Node> NamedNodeMap::getNamedItem(const String& name) const
 {
-    Attribute* a = getAttributeItem(name, shouldIgnoreAttributeCase(m_element));
+    Attribute* a = m_attributeData.getAttributeItem(name, shouldIgnoreAttributeCase(m_element));
     if (!a)
         return 0;
     
@@ -82,7 +68,7 @@ PassRefPtr<Node> NamedNodeMap::getNamedItemNS(const String& namespaceURI, const
 
 PassRefPtr<Node> NamedNodeMap::removeNamedItem(const String& name, ExceptionCode& ec)
 {
-    Attribute* a = getAttributeItem(name, shouldIgnoreAttributeCase(m_element));
+    Attribute* a = m_attributeData.getAttributeItem(name, shouldIgnoreAttributeCase(m_element));
     if (!a) {
         ec = NOT_FOUND_ERR;
         return 0;
@@ -135,9 +121,9 @@ PassRefPtr<Node> NamedNodeMap::setNamedItem(Node* node, ExceptionCode& ec)
     RefPtr<Attr> oldAttr;
     if (oldAttribute) {
         oldAttr = oldAttribute->createAttrIfNeeded(m_element);
-        replaceAttribute(index, attribute);
+        m_attributeData.replaceAttribute(index, attribute, m_element);
     } else
-        addAttribute(attribute);
+        m_attributeData.addAttribute(attribute, m_element);
 
     return oldAttr.release();
 }
@@ -157,7 +143,7 @@ PassRefPtr<Node> NamedNodeMap::removeNamedItem(const QualifiedName& name, Except
         return 0;
     }
 
-    RefPtr<Attr> attr = m_attributes[index]->createAttrIfNeeded(m_element);
+    RefPtr<Attr> attr = m_attributeData.m_attributes[index]->createAttrIfNeeded(m_element);
 
     removeAttribute(index);
 
@@ -169,40 +155,7 @@ PassRefPtr<Node> NamedNodeMap::item(unsigned index) const
     if (index >= length())
         return 0;
 
-    return m_attributes[index]->createAttrIfNeeded(m_element);
-}
-
-void NamedNodeMap::copyAttributesToVector(Vector<RefPtr<Attribute> >& copy)
-{
-    copy = m_attributes;
-}
-
-size_t NamedNodeMap::getAttributeItemIndexSlowCase(const String& name, bool shouldIgnoreAttributeCase) const
-{
-    unsigned len = length();
-
-    // Continue to checking case-insensitively and/or full namespaced names if necessary:
-    for (unsigned i = 0; i < len; ++i) {
-        const QualifiedName& attrName = m_attributes[i]->name();
-        if (!attrName.hasPrefix()) {
-            if (shouldIgnoreAttributeCase && equalIgnoringCase(name, attrName.localName()))
-                return i;
-        } else {
-            // FIXME: Would be faster to do this comparison without calling toString, which
-            // generates a temporary string by concatenation. But this branch is only reached
-            // if the attribute name has a prefix, which is rare in HTML.
-            if (equalPossiblyIgnoringCase(name, attrName.toString(), shouldIgnoreAttributeCase))
-                return i;
-        }
-    }
-    return notFound;
-}
-
-void NamedNodeMap::clearAttributes()
-{
-    attributeData()->clearClass();
-    detachAttributesFromElement();
-    m_attributes.clear();
+    return m_attributeData.m_attributes[index]->createAttrIfNeeded(m_element);
 }
 
 void NamedNodeMap::detachFromElement()
@@ -212,90 +165,7 @@ void NamedNodeMap::detachFromElement()
     // of that, we can simply clear all the attributes to avoid accessing stale
     // pointers to do things like create Attr objects.
     m_element = 0;
-    clearAttributes();
-}
-
-void NamedNodeMap::setAttributes(const NamedNodeMap& other)
-{
-    // clone all attributes in the other map, but attach to our element
-    if (!m_element)
-        return;
-
-    // If assigning the map changes the id attribute, we need to call
-    // updateId.
-    Attribute* oldId = getAttributeItem(m_element->document()->idAttributeName());
-    Attribute* newId = other.getAttributeItem(m_element->document()->idAttributeName());
-
-    if (oldId || newId)
-        m_element->updateId(oldId ? oldId->value() : nullAtom, newId ? newId->value() : nullAtom);
-
-    Attribute* oldName = getAttributeItem(HTMLNames::nameAttr);
-    Attribute* newName = other.getAttributeItem(HTMLNames::nameAttr);
-
-    if (oldName || newName)
-        m_element->updateName(oldName ? oldName->value() : nullAtom, newName ? newName->value() : nullAtom);
-
-    clearAttributes();
-    unsigned newLength = other.length();
-    m_attributes.resize(newLength);
-
-    // FIXME: These loops can probably be combined.
-    for (unsigned i = 0; i < newLength; i++)
-        m_attributes[i] = other.m_attributes[i]->clone();
-    for (unsigned i = 0; i < newLength; i++)
-        m_element->attributeChanged(m_attributes[i].get());
-}
-
-void NamedNodeMap::addAttribute(PassRefPtr<Attribute> prpAttribute)
-{
-    RefPtr<Attribute> attribute = prpAttribute;
-
-    if (m_element)
-        m_element->willModifyAttribute(attribute->name(), nullAtom, attribute->value());
-
-    m_attributes.append(attribute);
-    if (Attr* attr = attribute->attr())
-        attr->m_element = m_element;
-
-    if (m_element)
-        m_element->didModifyAttribute(attribute.get());
-}
-
-void NamedNodeMap::removeAttribute(size_t index)
-{
-    ASSERT(index < length());
-
-    RefPtr<Attribute> attribute = m_attributes[index];
-
-    if (m_element)
-        m_element->willRemoveAttribute(attribute->name(), attribute->value());
-
-    if (Attr* attr = attribute->attr())
-        attr->m_element = 0;
-    m_attributes.remove(index);
-
-    if (m_element)
-        m_element->didRemoveAttribute(attribute.get());
-}
-
-void NamedNodeMap::replaceAttribute(size_t index, PassRefPtr<Attribute> prpAttribute)
-{
-    ASSERT(index < length());
-
-    RefPtr<Attribute> attribute = prpAttribute;
-    Attribute* old = m_attributes[index].get();
-
-    if (m_element)
-        m_element->willModifyAttribute(attribute->name(), old->value(), attribute->value());
-
-    if (Attr* attr = old->attr())
-        attr->m_element = 0;
-    m_attributes[index] = attribute;
-    if (Attr* attr = attribute->attr())
-        attr->m_element = m_element;
-
-    if (m_element)
-        m_element->didModifyAttribute(attribute.get());
+    m_attributeData.clearAttributes();
 }
 
 bool NamedNodeMap::mapsEquivalent(const NamedNodeMap* otherMap) const
diff --git a/Source/WebCore/dom/NamedNodeMap.h b/Source/WebCore/dom/NamedNodeMap.h
index 6bdde0fb3..3201fcd08 100644
--- a/Source/WebCore/dom/NamedNodeMap.h
+++ b/Source/WebCore/dom/NamedNodeMap.h
@@ -25,10 +25,8 @@
 #ifndef NamedNodeMap_h
 #define NamedNodeMap_h
 
-#include "Attribute.h"
 #include "ElementAttributeData.h"
 #include "SpaceSplitString.h"
-#include <wtf/NotFound.h>
 
 namespace WebCore {
 
@@ -44,8 +42,6 @@ public:
         return adoptPtr(new NamedNodeMap(element));
     }
 
-    ~NamedNodeMap();
-
     void ref();
     void deref();
 
@@ -63,19 +59,17 @@ public:
     PassRefPtr<Node> setNamedItemNS(Node*, ExceptionCode&);
 
     PassRefPtr<Node> item(unsigned index) const;
-    size_t length() const { return m_attributes.size(); }
-    bool isEmpty() const { return !length(); }
+    size_t length() const { return m_attributeData.length(); }
+    bool isEmpty() const { return m_attributeData.isEmpty(); }
 
     // Internal interface.
 
-    Attribute* attributeItem(unsigned index) const { return m_attributes[index].get(); }
-    Attribute* getAttributeItem(const QualifiedName&) const;
-    size_t getAttributeItemIndex(const QualifiedName&) const;
-
-    void copyAttributesToVector(Vector<RefPtr<Attribute> >&);
+    Attribute* attributeItem(unsigned index) const { return m_attributeData.attributeItem(index); }
+    Attribute* getAttributeItem(const QualifiedName& name) const { return m_attributeData.getAttributeItem(name); }
+    size_t getAttributeItemIndex(const QualifiedName& name) const { return m_attributeData.getAttributeItemIndex(name); }
 
-    void shrinkToLength() { m_attributes.shrinkCapacity(length()); }
-    void reserveInitialCapacity(unsigned capacity) { m_attributes.reserveInitialCapacity(capacity); }
+    void shrinkToLength() { m_attributeData.m_attributes.shrinkCapacity(length()); }
+    void reserveInitialCapacity(unsigned capacity) { m_attributeData.m_attributes.reserveInitialCapacity(capacity); }
 
     // Used during parsing: only inserts if not already there. No error checking!
     void insertAttribute(PassRefPtr<Attribute> newAttribute, bool allowDuplicates)
@@ -88,9 +82,9 @@ public:
     bool mapsEquivalent(const NamedNodeMap* otherMap) const;
 
     // These functions do no error checking.
-    void addAttribute(PassRefPtr<Attribute>);
-    void removeAttribute(const QualifiedName&);
-    void removeAttribute(size_t index);
+    void addAttribute(PassRefPtr<Attribute> attribute) { m_attributeData.addAttribute(attribute, m_element); }
+    void removeAttribute(const QualifiedName& name) { m_attributeData.removeAttribute(name, m_element); }
+    void removeAttribute(size_t index) { m_attributeData.removeAttribute(index, m_element); }
 
     Element* element() const { return m_element; }
 
@@ -103,14 +97,8 @@ private:
     {
     }
 
-    void detachAttributesFromElement();
     void detachFromElement();
-    Attribute* getAttributeItem(const String& name, bool shouldIgnoreAttributeCase) const;
-    size_t getAttributeItemIndex(const String& name, bool shouldIgnoreAttributeCase) const;
-    size_t getAttributeItemIndexSlowCase(const String& name, bool shouldIgnoreAttributeCase) const;
-    void setAttributes(const NamedNodeMap&);
-    void clearAttributes();
-    void replaceAttribute(size_t index, PassRefPtr<Attribute>);
+    Attribute* getAttributeItem(const String& name, bool shouldIgnoreAttributeCase) const { return m_attributeData.getAttributeItem(name, shouldIgnoreAttributeCase); }
 
     // FIXME: NamedNodeMap is being broken up into two classes, one containing data
     //        for elements with attributes, and one for exposure to the DOM.
@@ -118,66 +106,8 @@ private:
     ElementAttributeData m_attributeData;
 
     Element* m_element;
-    Vector<RefPtr<Attribute>, 4> m_attributes;
 };
 
-inline Attribute* NamedNodeMap::getAttributeItem(const QualifiedName& name) const
-{
-    size_t index = getAttributeItemIndex(name);
-    if (index != notFound)
-        return m_attributes[index].get();
-    return 0;
-}
-
-inline size_t NamedNodeMap::getAttributeItemIndex(const QualifiedName& name) const
-{
-    size_t len = length();
-    for (unsigned i = 0; i < len; ++i) {
-        if (m_attributes[i]->name().matches(name))
-            return i;
-    }
-    return notFound;
-}
-
-inline Attribute* NamedNodeMap::getAttributeItem(const String& name, bool shouldIgnoreAttributeCase) const
-{
-    size_t index = getAttributeItemIndex(name, shouldIgnoreAttributeCase);
-    if (index != notFound)
-        return m_attributes[index].get();
-    return 0;
-}
-
-// We use a boolean parameter instead of calling shouldIgnoreAttributeCase so that the caller
-// can tune the behavior (hasAttribute is case sensitive whereas getAttribute is not).
-inline size_t NamedNodeMap::getAttributeItemIndex(const String& name, bool shouldIgnoreAttributeCase) const
-{
-    unsigned len = length();
-    bool doSlowCheck = shouldIgnoreAttributeCase;
-
-    // Optimize for the case where the attribute exists and its name exactly matches.
-    for (unsigned i = 0; i < len; ++i) {
-        const QualifiedName& attrName = m_attributes[i]->name();
-        if (!attrName.hasPrefix()) {
-            if (name == attrName.localName())
-                return i;
-        } else
-            doSlowCheck = true;
-    }
-
-    if (doSlowCheck)
-        return getAttributeItemIndexSlowCase(name, shouldIgnoreAttributeCase);
-    return notFound;
-}
-
-inline void NamedNodeMap::removeAttribute(const QualifiedName& name)
-{
-    size_t index = getAttributeItemIndex(name);
-    if (index == notFound)
-        return;
-
-    removeAttribute(index);
-}
-
 } // namespace WebCore
 
 #endif // NamedNodeMap_h
diff --git a/Source/WebCore/dom/NamedNodeMap.idl b/Source/WebCore/dom/NamedNodeMap.idl
index 3c07a1146..88820c017 100644
--- a/Source/WebCore/dom/NamedNodeMap.idl
+++ b/Source/WebCore/dom/NamedNodeMap.idl
@@ -24,34 +24,35 @@ module core {
         JSGenerateIsReachable=ImplElementRoot,
         JSCustomMarkFunction,
         IndexedGetter,
-        NamedGetter
+        NamedGetter,
+        V8CustomToJSObject
     ] NamedNodeMap {
 
-        Node getNamedItem(in [Optional=CallWithDefaultValue] DOMString name);
+        Node getNamedItem(in [Optional=DefaultIsUndefined] DOMString name);
 
-        Node setNamedItem(in [Optional=CallWithDefaultValue] Node node)
+        Node setNamedItem(in [Optional=DefaultIsUndefined] Node node)
             raises(DOMException);
 
-        Node removeNamedItem(in [Optional=CallWithDefaultValue] DOMString name)
+        Node removeNamedItem(in [Optional=DefaultIsUndefined] DOMString name)
             raises(DOMException);
 
-        Node item(in [Optional=CallWithDefaultValue] unsigned long index);
+        Node item(in [Optional=DefaultIsUndefined] unsigned long index);
         
         readonly attribute unsigned long length;
 
 
         // Introduced in DOM Level 2:
 
-        [ObjCLegacyUnnamedParameters] Node getNamedItemNS(in [TreatNullAs=NullString,Optional=CallWithDefaultValue] DOMString namespaceURI, 
-                                           in [Optional=CallWithDefaultValue] DOMString localName)
+        [ObjCLegacyUnnamedParameters] Node getNamedItemNS(in [TreatNullAs=NullString,Optional=DefaultIsUndefined] DOMString namespaceURI, 
+                                           in [Optional=DefaultIsUndefined] DOMString localName)
             // FIXME: the implementation does take an exceptioncode parameter.
             /*raises(DOMException)*/;
 
-        Node setNamedItemNS(in [Optional=CallWithDefaultValue] Node node)
+        Node setNamedItemNS(in [Optional=DefaultIsUndefined] Node node)
             raises(DOMException);
 
-        [ObjCLegacyUnnamedParameters] Node removeNamedItemNS(in [TreatNullAs=NullString,Optional=CallWithDefaultValue] DOMString namespaceURI, 
-                                              in [Optional=CallWithDefaultValue] DOMString localName)
+        [ObjCLegacyUnnamedParameters] Node removeNamedItemNS(in [TreatNullAs=NullString,Optional=DefaultIsUndefined] DOMString namespaceURI, 
+                                              in [Optional=DefaultIsUndefined] DOMString localName)
             raises(DOMException);
 
     };
diff --git a/Source/WebCore/dom/Node.cpp b/Source/WebCore/dom/Node.cpp
index 39b8fa895..2e9c61a7e 100644
--- a/Source/WebCore/dom/Node.cpp
+++ b/Source/WebCore/dom/Node.cpp
@@ -63,7 +63,7 @@
 #include "HTMLElement.h"
 #include "HTMLFrameOwnerElement.h"
 #include "HTMLNames.h"
-#include "InspectorInstrumentation.h"
+#include "InspectorCounters.h"
 #include "KeyboardEvent.h"
 #include "LabelsNodeList.h"
 #include "Logging.h"
@@ -86,6 +86,7 @@
 #include "ScopedEventQueue.h"
 #include "SelectorQuery.h"
 #include "ShadowRoot.h"
+#include "ShadowRootList.h"
 #include "StaticNodeList.h"
 #include "StorageEvent.h"
 #include "TagNodeList.h"
@@ -227,7 +228,10 @@ void Node::dumpStatistics()
                 break;
             }
             case DOCUMENT_FRAGMENT_NODE: {
-                ++fragmentNodes;
+                if (node->isShadowRoot())
+                    ++shadowRootNodes;
+                else
+                    ++fragmentNodes;
                 break;
             }
             case NOTATION_NODE: {
@@ -238,10 +242,6 @@ void Node::dumpStatistics()
                 ++xpathNSNodes;
                 break;
             }
-            case SHADOW_ROOT_NODE: {
-                ++shadowRootNodes;
-                break;
-            }
         }
     }
 
@@ -352,8 +352,7 @@ Node::StyleChange Node::diff(const RenderStyle* s1, const RenderStyle* s2)
     if ((s1 && s2) && (s1->flowThread() != s2->flowThread()))
         ch = Detach;
 
-    // When either the region thread or the region index has changed,
-    // we need to prepare a separate render region object.
+    // When the region thread has changed, we need to prepare a separate render region object.
     if ((s1 && s2) && (s1->regionThread() != s2->regionThread()))
         ch = Detach;
 
@@ -406,6 +405,8 @@ Node::~Node()
 
     if (doc)
         doc->guardDeref();
+
+    InspectorCounters::decrementCounter(InspectorCounters::NodeCounter);
 }
 
 void Node::setDocument(Document* document)
@@ -632,7 +633,7 @@ void Node::normalize()
             continue;
         }
 
-        RefPtr<Text> text = static_cast<Text*>(node.get());
+        RefPtr<Text> text = toText(node.get());
 
         // Remove empty text nodes.
         if (!text->length()) {
@@ -647,7 +648,7 @@ void Node::normalize()
         while (Node* nextSibling = node->nextSibling()) {
             if (nextSibling->nodeType() != TEXT_NODE)
                 break;
-            RefPtr<Text> nextText = static_cast<Text*>(nextSibling);
+            RefPtr<Text> nextText = toText(nextSibling);
 
             // Remove empty text nodes.
             if (!nextText->length()) {
@@ -694,13 +695,13 @@ const AtomicString& Node::virtualNamespaceURI() const
 
 bool Node::isContentEditable()
 {
-    document()->updateLayoutIgnorePendingStylesheets();
+    document()->updateStyleIfNeeded();
     return rendererIsEditable(Editable);
 }
 
 bool Node::isContentRichlyEditable()
 {
-    document()->updateLayoutIgnorePendingStylesheets();
+    document()->updateStyleIfNeeded();
     return rendererIsEditable(RichlyEditable);
 }
 
@@ -808,9 +809,9 @@ bool Node::hasNonEmptyBoundingBox() const
     return false;
 }
 
-inline static ShadowRoot* shadowRoot(Node* node)
+inline static ShadowRoot* oldestShadowRootFor(const Node* node)
 {
-    return node->isElementNode() ? toElement(node)->shadowRoot() : 0;
+    return node->isElementNode() && toElement(node)->hasShadowRoot() ? toElement(node)->shadowRootList()->oldestShadowRoot() : 0;
 }
 
 inline void Node::setStyleChange(StyleChangeType changeType)
@@ -1339,7 +1340,7 @@ void Node::detach()
     setFlag(InDetachFlag);
 
     if (renderer())
-        renderer()->destroy();
+        renderer()->destroyAndCleanupAnonymousWrappers();
     setRenderer(0);
 
     Document* doc = document();
@@ -1759,11 +1760,13 @@ bool Node::isEqualNode(Node* other) const
         NamedNodeMap* attributes = toElement(this)->updatedAttributes();
         NamedNodeMap* otherAttributes = toElement(other)->updatedAttributes();
 
-        if (attributes && !attributes->mapsEquivalent(otherAttributes))
-            return false;
-
-        if (otherAttributes && !otherAttributes->mapsEquivalent(attributes))
-            return false;
+        if (attributes) {
+            if (!attributes->mapsEquivalent(otherAttributes))
+                return false;
+        } else if (otherAttributes) {
+            if (!otherAttributes->mapsEquivalent(attributes))
+                return false;
+        }
     }
     
     Node* child = firstChild();
@@ -1844,7 +1847,6 @@ bool Node::isDefaultNamespace(const AtomicString& namespaceURIMaybeEmpty) const
         case NOTATION_NODE:
         case DOCUMENT_TYPE_NODE:
         case DOCUMENT_FRAGMENT_NODE:
-        case SHADOW_ROOT_NODE:
             return false;
         case ATTRIBUTE_NODE: {
             const Attr* attr = static_cast<const Attr*>(this);
@@ -1878,7 +1880,6 @@ String Node::lookupPrefix(const AtomicString &namespaceURI) const
         case NOTATION_NODE:
         case DOCUMENT_FRAGMENT_NODE:
         case DOCUMENT_TYPE_NODE:
-        case SHADOW_ROOT_NODE:
             return String();
         case ATTRIBUTE_NODE: {
             const Attr *attr = static_cast<const Attr *>(this);
@@ -1937,7 +1938,6 @@ String Node::lookupNamespaceURI(const String &prefix) const
         case NOTATION_NODE:
         case DOCUMENT_TYPE_NODE:
         case DOCUMENT_FRAGMENT_NODE:
-        case SHADOW_ROOT_NODE:
             return String();
         case ATTRIBUTE_NODE: {
             const Attr *attr = static_cast<const Attr *>(this);
@@ -2005,7 +2005,6 @@ static void appendTextContent(const Node* node, bool convertBRsToNewlines, bool&
     case Node::ENTITY_NODE:
     case Node::ENTITY_REFERENCE_NODE:
     case Node::DOCUMENT_FRAGMENT_NODE:
-    case Node::SHADOW_ROOT_NODE:
         isNullString = false;
         for (Node* child = node->firstChild(); child; child = child->nextSibling()) {
             if (child->nodeType() == Node::COMMENT_NODE || child->nodeType() == Node::PROCESSING_INSTRUCTION_NODE)
@@ -2043,8 +2042,7 @@ void Node::setTextContent(const String& text, ExceptionCode& ec)
         case ATTRIBUTE_NODE:
         case ENTITY_NODE:
         case ENTITY_REFERENCE_NODE:
-        case DOCUMENT_FRAGMENT_NODE:
-        case SHADOW_ROOT_NODE: {
+        case DOCUMENT_FRAGMENT_NODE: {
             ContainerNode* container = toContainerNode(this);
 #if ENABLE(MUTATION_OBSERVERS)
             ChildListMutationScope mutation(this);
@@ -2271,13 +2269,11 @@ static void traverseTreeAndMark(const String& baseIndent, const Node* rootNode,
             indent += "\t";
         fprintf(stderr, "%s", indent.utf8().data());
         node->showNode();
-
-        ContainerNode* rootNode = shadowRoot(const_cast<Node*>(node));
-
-        if (rootNode) {
-            indent += "\t";
-            traverseTreeAndMark(indent, rootNode, markedNode1, markedLabel1, markedNode2, markedLabel2);
-        }
+        if (node->isShadowRoot()) {
+            if (ShadowRoot* youngerShadowRoot = toShadowRoot(node)->youngerShadowRoot())
+                traverseTreeAndMark(indent + "\t", youngerShadowRoot, markedNode1, markedLabel1, markedNode2, markedLabel2);
+        } else if (ShadowRoot* oldestShadowRoot = oldestShadowRootFor(node))
+            traverseTreeAndMark(indent + "\t", oldestShadowRoot, markedNode1, markedLabel1, markedNode2, markedLabel2);
     }
 }
 
@@ -2307,7 +2303,7 @@ void Node::formatForDebugger(char* buffer, unsigned length) const
     strncpy(buffer, result.utf8().data(), length - 1);
 }
 
-static ContainerNode* parentOrHostOrFrameOwner(Node* node)
+static ContainerNode* parentOrHostOrFrameOwner(const Node* node)
 {
     ContainerNode* parent = node->parentOrHostNode();
     if (!parent && node->document() && node->document()->frame())
@@ -2315,16 +2311,21 @@ static ContainerNode* parentOrHostOrFrameOwner(Node* node)
     return parent;
 }
 
-static void showSubTreeAcrossFrame(Node* node, const Node* markedNode, const String& indent)
+static void showSubTreeAcrossFrame(const Node* node, const Node* markedNode, const String& indent)
 {
     if (node == markedNode)
         fputs("*", stderr);
     fputs(indent.utf8().data(), stderr);
     node->showNode();
-    if (node->isFrameOwnerElement())
-        showSubTreeAcrossFrame(static_cast<HTMLFrameOwnerElement*>(node)->contentDocument(), markedNode, indent + "\t");
-    if (ShadowRoot* shadow = shadowRoot(node))
-        showSubTreeAcrossFrame(shadow, markedNode, indent + "\t");
+     if (node->isShadowRoot()) {
+         if (ShadowRoot* youngerShadowRoot = toShadowRoot(node)->youngerShadowRoot())
+             showSubTreeAcrossFrame(youngerShadowRoot, markedNode, indent + "\t");
+     } else {
+         if (node->isFrameOwnerElement())
+             showSubTreeAcrossFrame(static_cast<const HTMLFrameOwnerElement*>(node)->contentDocument(), markedNode, indent + "\t");
+         if (ShadowRoot* oldestShadowRoot = oldestShadowRootFor(node))
+             showSubTreeAcrossFrame(oldestShadowRoot, markedNode, indent + "\t");
+     }
     for (Node* child = node->firstChild(); child; child = child->nextSibling())
         showSubTreeAcrossFrame(child, markedNode, indent + "\t");
 }
@@ -2483,6 +2484,11 @@ static inline HashSet<SVGElementInstance*> instancesForSVGElement(Node* node)
 }
 #endif
 
+static inline bool isTouchEventType(const AtomicString& eventType)
+{
+    return eventType == eventNames().touchstartEvent || eventType == eventNames().touchmoveEvent || eventType == eventNames().touchendEvent || eventType == eventNames().touchcancelEvent;
+}
+
 static inline bool tryAddEventListener(Node* targetNode, const AtomicString& eventType, PassRefPtr<EventListener> listener, bool useCapture)
 {
     if (!targetNode->EventTarget::addEventListener(eventType, listener, useCapture))
@@ -2492,6 +2498,8 @@ static inline bool tryAddEventListener(Node* targetNode, const AtomicString& eve
         document->addListenerTypeIfNeeded(eventType);
         if (eventType == eventNames().mousewheelEvent)
             document->didAddWheelEventHandler();
+        else if (isTouchEventType(eventType))
+            document->didAddTouchEventHandler();
     }
         
     return true;
@@ -2541,6 +2549,8 @@ static inline bool tryRemoveEventListener(Node* targetNode, const AtomicString&
     if (Document* document = targetNode->document()) {
         if (eventType == eventNames().mousewheelEvent)
             document->didRemoveWheelEventHandler();
+        else if (isTouchEventType(eventType))
+            document->didRemoveTouchEventHandler();
     }
     
     return true;
@@ -2721,6 +2731,39 @@ void Node::notifyMutationObserversNodeWillDetach()
 }
 #endif // ENABLE(MUTATION_OBSERVERS)
 
+#if ENABLE(STYLE_SCOPED)
+bool Node::hasScopedHTMLStyleChild() const
+{
+    return hasRareData() && rareData()->hasScopedHTMLStyleChild();
+}
+
+size_t Node::numberOfScopedHTMLStyleChildren() const
+{
+    return hasRareData() ? rareData()->numberOfScopedHTMLStyleChildren() : 0;
+}
+
+void Node::registerScopedHTMLStyleChild()
+{
+    ensureRareData()->registerScopedHTMLStyleChild();
+}
+
+void Node::unregisterScopedHTMLStyleChild()
+{
+    ASSERT(hasRareData());
+    if (hasRareData())
+        rareData()->unregisterScopedHTMLStyleChild();
+}
+#else
+bool Node::hasScopedHTMLStyleChild() const
+{
+    return 0;
+}
+
+size_t Node::numberOfScopedHTMLStyleChildren() const
+{
+    return 0;
+}
+#endif
 
 void Node::handleLocalEvents(Event* event)
 {
diff --git a/Source/WebCore/dom/Node.h b/Source/WebCore/dom/Node.h
index 311bd4117..9ca126498 100644
--- a/Source/WebCore/dom/Node.h
+++ b/Source/WebCore/dom/Node.h
@@ -90,7 +90,7 @@ class HTMLPropertiesCollection;
 
 typedef int ExceptionCode;
 
-const int nodeStyleChangeShift = 25;
+const int nodeStyleChangeShift = 23;
 
 // SyntheticStyleChange means that we need to go through the entire style change logic even though
 // no style property has actually changed. It is used to restructure the tree when, for instance,
@@ -122,7 +122,6 @@ public:
         DOCUMENT_FRAGMENT_NODE = 11,
         NOTATION_NODE = 12,
         XPATH_NAMESPACE_NODE = 13,
-        SHADOW_ROOT_NODE = 14
     };
     enum DocumentPosition {
         DOCUMENT_POSITION_EQUIVALENT = 0x00,
@@ -224,6 +223,9 @@ public:
     bool isDocumentNode() const;
     bool isShadowRoot() const { return getFlag(IsShadowRootOrSVGShadowRootFlag) && !isSVGElement(); }
     virtual bool isContentElement() const { return false; }
+#if ENABLE(SHADOW_DOM)
+    virtual bool isShadowElement() const { return false; }
+#endif
 
     Node* shadowAncestorNode() const;
     // Returns 0, a ShadowRoot, or a legacy shadow root.
@@ -297,9 +299,11 @@ public:
     virtual bool sheetLoaded() { return true; }
     virtual void startLoadingDynamicSheet() { ASSERT_NOT_REACHED(); }
 
+    bool attributeStyleDirty() const { return getFlag(AttributeStyleDirtyFlag); }
     bool hasName() const { return getFlag(HasNameFlag); }
-    bool hasID() const { return getFlag(HasIDFlag); }
-    bool hasClass() const { return getFlag(HasClassFlag); }
+    bool hasID() const;
+    bool hasClass() const;
+    
     bool active() const { return getFlag(IsActiveFlag); }
     bool inActiveChain() const { return getFlag(InActiveChainFlag); }
     bool inDetach() const { return getFlag(InDetachFlag); }
@@ -312,9 +316,10 @@ public:
     bool childNeedsStyleRecalc() const { return getFlag(ChildNeedsStyleRecalcFlag); }
     bool isLink() const { return getFlag(IsLinkFlag); }
 
+    void setAttributeStyleDirty() { setFlag(AttributeStyleDirtyFlag); }
+    void clearAttributeStyleDirty() { clearFlag(AttributeStyleDirtyFlag); }
+
     void setHasName(bool f) { setFlag(f, HasNameFlag); }
-    void setHasID(bool f) { setFlag(f, HasIDFlag); }
-    void setHasClass(bool f) { setFlag(f, HasClassFlag); }
     void setChildNeedsStyleRecalc() { setFlag(ChildNeedsStyleRecalcFlag); }
     void clearChildNeedsStyleRecalc() { clearFlag(ChildNeedsStyleRecalcFlag); }
     void setInDocument() { setFlag(InDocumentFlag); }
@@ -492,7 +497,7 @@ public:
     virtual void willRemove();
     void createRendererIfNeeded();
     virtual bool rendererIsNeeded(const NodeRenderingContext&);
-    virtual bool childShouldCreateRenderer(Node*) const { return true; }
+    virtual bool childShouldCreateRenderer(const NodeRenderingContext&) const { return true; }
     virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
     ContainerNode* parentNodeForRenderingAndStyle();
     
@@ -632,6 +637,13 @@ public:
     void notifyMutationObserversNodeWillDetach();
 #endif // ENABLE(MUTATION_OBSERVERS)
 
+#if ENABLE(STYLE_SCOPED)
+    void registerScopedHTMLStyleChild();
+    void unregisterScopedHTMLStyleChild();
+#endif
+    bool hasScopedHTMLStyleChild() const;
+    size_t numberOfScopedHTMLStyleChildren() const;
+
 private:
     enum NodeFlags {
         IsTextFlag = 1,
@@ -641,37 +653,37 @@ private:
         IsStyledElementFlag = 1 << 4,
         IsHTMLFlag = 1 << 5,
         IsSVGFlag = 1 << 6,
-        HasIDFlag = 1 << 7,
-        HasClassFlag = 1 << 8,
-        IsAttachedFlag = 1 << 9,
-        ChildNeedsStyleRecalcFlag = 1 << 10,
-        InDocumentFlag = 1 << 11,
-        IsLinkFlag = 1 << 12,
-        IsActiveFlag = 1 << 13,
-        IsHoveredFlag = 1 << 14,
-        InActiveChainFlag = 1 << 15,
-        InDetachFlag = 1 << 16,
-        HasRareDataFlag = 1 << 17,
-        IsShadowRootOrSVGShadowRootFlag = 1 << 18,
+        IsAttachedFlag = 1 << 7,
+        ChildNeedsStyleRecalcFlag = 1 << 8,
+        InDocumentFlag = 1 << 9,
+        IsLinkFlag = 1 << 10,
+        IsActiveFlag = 1 << 11,
+        IsHoveredFlag = 1 << 12,
+        InActiveChainFlag = 1 << 13,
+        InDetachFlag = 1 << 14,
+        HasRareDataFlag = 1 << 15,
+        IsShadowRootOrSVGShadowRootFlag = 1 << 16,
 
         // These bits are used by derived classes, pulled up here so they can
         // be stored in the same memory word as the Node bits above.
-        IsParsingChildrenFinishedFlag = 1 << 19, // Element
-        IsStyleAttributeValidFlag = 1 << 20, // StyledElement
-        IsSynchronizingStyleAttributeFlag = 1 << 21, // StyledElement
+        IsParsingChildrenFinishedFlag = 1 << 17, // Element
+        IsStyleAttributeValidFlag = 1 << 18, // StyledElement
+        IsSynchronizingStyleAttributeFlag = 1 << 19, // StyledElement
 #if ENABLE(SVG)
-        AreSVGAttributesValidFlag = 1 << 22, // Element
-        IsSynchronizingSVGAttributesFlag = 1 << 23, // SVGElement
-        HasSVGRareDataFlag = 1 << 24, // SVGElement
+        AreSVGAttributesValidFlag = 1 << 20, // Element
+        IsSynchronizingSVGAttributesFlag = 1 << 21, // SVGElement
+        HasSVGRareDataFlag = 1 << 22, // SVGElement
 #endif
 
         StyleChangeMask = 1 << nodeStyleChangeShift | 1 << (nodeStyleChangeShift + 1),
 
-        SelfOrAncestorHasDirAutoFlag = 1 << 27,
-        HasCustomWillOrDidRecalcStyleFlag = 1 << 28,
-        HasCustomStyleForRendererFlag = 1 << 29,
+        SelfOrAncestorHasDirAutoFlag = 1 << 25,
+        HasCustomWillOrDidRecalcStyleFlag = 1 << 26,
+        HasCustomStyleForRendererFlag = 1 << 27,
+
+        HasNameFlag = 1 << 28,
 
-        HasNameFlag = 1 << 30,
+        AttributeStyleDirtyFlag = 1 << 31,
 
 #if ENABLE(SVG)
         DefaultNodeFlags = IsParsingChildrenFinishedFlag | IsStyleAttributeValidFlag | AreSVGAttributesValidFlag
@@ -680,7 +692,7 @@ private:
 #endif
     };
 
-    // 1 bit remaining
+    // 3 bits remaining
 
     bool getFlag(NodeFlags mask) const { return m_nodeFlags & mask; }
     void setFlag(bool f, NodeFlags mask) const { m_nodeFlags = (m_nodeFlags & ~mask) | (-(int32_t)f & mask); } 
diff --git a/Source/WebCore/dom/Node.idl b/Source/WebCore/dom/Node.idl
index b67be68b4..e27a215ca 100644
--- a/Source/WebCore/dom/Node.idl
+++ b/Source/WebCore/dom/Node.idl
@@ -26,7 +26,7 @@ module core {
         JSCustomPushEventHandlerScope,
         JSCustomIsReachable,
         JSCustomFinalize,
-        JSCustomToJS,
+        CustomToJSObject,
         EventTarget,
         JSGenerateToNativeObject,
         JSInlineGetOwnPropertySlot,
@@ -51,10 +51,10 @@ module core {
         const unsigned short      DOCUMENT_FRAGMENT_NODE         = 11;
         const unsigned short      NOTATION_NODE                  = 12;
 
-        readonly attribute [ConvertNullStringTo=Null] DOMString        nodeName;
+        readonly attribute [TreatReturnedNullStringAs=Null] DOMString        nodeName;
 
                  // FIXME: the spec says this can also raise on retrieval.
-                 attribute [ConvertNullStringTo=Null, TreatNullAs=NullString] DOMString        nodeValue
+                 attribute [TreatReturnedNullStringAs=Null, TreatNullAs=NullString] DOMString        nodeValue
                      setter raises(DOMException);
 
         readonly attribute unsigned short   nodeType;
@@ -67,46 +67,46 @@ module core {
         readonly attribute NamedNodeMap     attributes;
         readonly attribute Document         ownerDocument;
 
-        [ObjCLegacyUnnamedParameters, Custom] Node insertBefore(in [Return] Node newChild,
-                                                 in Node refChild)
+        [ObjCLegacyUnnamedParameters, Custom] Node insertBefore(in [CustomReturn] Node newChild,
+                                                                in Node refChild)
             raises(DOMException);
         [ObjCLegacyUnnamedParameters, Custom] Node replaceChild(in Node newChild,
-                                                 in [Return] Node oldChild)
-            raises(DOMExceptionJSC);
-        [Custom] Node               removeChild(in [Return] Node oldChild)
+                                                                in [CustomReturn] Node oldChild)
             raises(DOMException);
-        [Custom] Node               appendChild(in [Return] Node newChild)
+        [Custom] Node               removeChild(in [CustomReturn] Node oldChild)
+            raises(DOMException);
+        [Custom] Node               appendChild(in [CustomReturn] Node newChild)
             raises(DOMException);
 
         boolean            hasChildNodes();
-        Node               cloneNode(in [Optional=CallWithDefaultValue] boolean deep);
+        Node               cloneNode(in [Optional=DefaultIsUndefined] boolean deep);
         void               normalize();
 
         // Introduced in DOM Level 2:
 
-        [ObjCLegacyUnnamedParameters] boolean isSupported(in [Optional=CallWithDefaultValue] DOMString feature, 
-                                           in [TreatNullAs=NullString,Optional=CallWithDefaultValue] DOMString version);
+        [ObjCLegacyUnnamedParameters] boolean isSupported(in [Optional=DefaultIsUndefined] DOMString feature, 
+                                           in [TreatNullAs=NullString,Optional=DefaultIsUndefined] DOMString version);
 
-        readonly attribute [ConvertNullStringTo=Null] DOMString        namespaceURI;
-                 attribute [ConvertNullStringTo=Null, TreatNullAs=NullString] DOMString        prefix
+        readonly attribute [TreatReturnedNullStringAs=Null] DOMString        namespaceURI;
+                 attribute [TreatReturnedNullStringAs=Null, TreatNullAs=NullString] DOMString        prefix
                      setter raises(DOMException);
-        readonly attribute [ConvertNullStringTo=Null] DOMString        localName;
+        readonly attribute [TreatReturnedNullStringAs=Null] DOMString        localName;
 
         boolean            hasAttributes();
 
         // Introduced in DOM Level 3:
 
-        readonly attribute [ConvertNullStringTo=Null] DOMString       baseURI;
+        readonly attribute [TreatReturnedNullStringAs=Null] DOMString       baseURI;
 
                  // FIXME: the spec says this can also raise on retrieval.
-                 attribute [ConvertNullStringTo=Null, TreatNullAs=NullString] DOMString       textContent
+                 attribute [TreatReturnedNullStringAs=Null, TreatNullAs=NullString] DOMString       textContent
                      setter raises(DOMException);
 
-        boolean            isSameNode(in [Optional=CallWithDefaultValue] Node other);
-        boolean            isEqualNode(in [Optional=CallWithDefaultValue] Node other);
-        [ConvertNullStringTo=Null] DOMString          lookupPrefix(in [TreatNullAs=NullString,Optional=CallWithDefaultValue] DOMString namespaceURI);
-        boolean            isDefaultNamespace(in [TreatNullAs=NullString,Optional=CallWithDefaultValue] DOMString namespaceURI);
-        [ConvertNullStringTo=Null] DOMString          lookupNamespaceURI(in [TreatNullAs=NullString,Optional=CallWithDefaultValue] DOMString prefix);
+        boolean            isSameNode(in [Optional=DefaultIsUndefined] Node other);
+        boolean            isEqualNode(in [Optional=DefaultIsUndefined] Node other);
+        [TreatReturnedNullStringAs=Null] DOMString          lookupPrefix(in [TreatNullAs=NullString,Optional=DefaultIsUndefined] DOMString namespaceURI);
+        boolean            isDefaultNamespace(in [TreatNullAs=NullString,Optional=DefaultIsUndefined] DOMString namespaceURI);
+        [TreatReturnedNullStringAs=Null] DOMString          lookupNamespaceURI(in [TreatNullAs=NullString,Optional=DefaultIsUndefined] DOMString prefix);
 
         // DocumentPosition
         const unsigned short      DOCUMENT_POSITION_DISCONNECTED = 0x01;
@@ -116,10 +116,10 @@ module core {
         const unsigned short      DOCUMENT_POSITION_CONTAINED_BY = 0x10;
         const unsigned short      DOCUMENT_POSITION_IMPLEMENTATION_SPECIFIC = 0x20;
 
-        unsigned short     compareDocumentPosition(in [Optional=CallWithDefaultValue] Node other);
+        unsigned short     compareDocumentPosition(in [Optional=DefaultIsUndefined] Node other);
 
         // Introduced in DOM4
-        boolean contains(in [Optional=CallWithDefaultValue] Node other);
+        boolean contains(in [Optional=DefaultIsUndefined] Node other);
 
 #if 0
         DOMObject          getFeature(in DOMString feature, 
diff --git a/Source/WebCore/dom/NodeFilter.idl b/Source/WebCore/dom/NodeFilter.idl
index 8edef0e03..5caa5ff03 100644
--- a/Source/WebCore/dom/NodeFilter.idl
+++ b/Source/WebCore/dom/NodeFilter.idl
@@ -47,7 +47,7 @@ module traversal {
         const unsigned long       SHOW_DOCUMENT_FRAGMENT         = 0x00000400;
         const unsigned long       SHOW_NOTATION                  = 0x00000800;
 
-        [CallWith=ScriptState] short acceptNode(in [Optional=CallWithDefaultValue] Node n);
+        [CallWith=ScriptState] short acceptNode(in [Optional=DefaultIsUndefined] Node n);
 
     };
 
diff --git a/Source/WebCore/dom/NodeList.idl b/Source/WebCore/dom/NodeList.idl
index ebe813f83..71544d16b 100644
--- a/Source/WebCore/dom/NodeList.idl
+++ b/Source/WebCore/dom/NodeList.idl
@@ -26,7 +26,7 @@ module core {
         NamedGetter
     ] NodeList {
 
-        Node item(in [IsIndex,Optional=CallWithDefaultValue] unsigned long index);
+        Node item(in [IsIndex,Optional=DefaultIsUndefined] unsigned long index);
 
         readonly attribute unsigned long length;
 
diff --git a/Source/WebCore/dom/NodeRareData.h b/Source/WebCore/dom/NodeRareData.h
index 77b920d1b..0864b2626 100644
--- a/Source/WebCore/dom/NodeRareData.h
+++ b/Source/WebCore/dom/NodeRareData.h
@@ -100,6 +100,9 @@ public:
         , m_tabIndexWasSetExplicitly(false)
         , m_isFocused(false)
         , m_needsFocusAppearanceUpdateSoonAfterAttach(false)
+#if ENABLE(STYLE_SCOPED)
+        , m_numberOfScopedHTMLStyleChildren(0)
+#endif
     {
     }
 
@@ -226,6 +229,30 @@ public:
     }
 #endif
 
+#if ENABLE(STYLE_SCOPED)
+    void registerScopedHTMLStyleChild()
+    {
+        ++m_numberOfScopedHTMLStyleChildren;
+    }
+
+    void unregisterScopedHTMLStyleChild()
+    {
+        ASSERT(m_numberOfScopedHTMLStyleChildren > 0);
+        if (m_numberOfScopedHTMLStyleChildren > 0)
+            --m_numberOfScopedHTMLStyleChildren;
+    }
+
+    bool hasScopedHTMLStyleChild() const
+    {
+        return m_numberOfScopedHTMLStyleChildren;
+    }
+
+    size_t numberOfScopedHTMLStyleChildren() const
+    {
+        return m_numberOfScopedHTMLStyleChildren;
+    }
+#endif
+
     bool isFocused() const { return m_isFocused; }
     void setFocused(bool focused) { m_isFocused = focused; }
 
@@ -257,6 +284,10 @@ private:
     mutable RefPtr<DOMSettableTokenList> m_itemType;
     mutable OwnPtr<HTMLPropertiesCollection> m_properties;
 #endif
+
+#if ENABLE(STYLE_SCOPED)
+    size_t m_numberOfScopedHTMLStyleChildren;
+#endif
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/dom/NodeRenderingContext.cpp b/Source/WebCore/dom/NodeRenderingContext.cpp
index 4a9709a0d..cdcb102d8 100644
--- a/Source/WebCore/dom/NodeRenderingContext.cpp
+++ b/Source/WebCore/dom/NodeRenderingContext.cpp
@@ -27,14 +27,15 @@
 #include "NodeRenderingContext.h"
 
 #include "ContainerNode.h"
-#include "ContentInclusionSelector.h"
 #include "HTMLContentElement.h"
+#include "HTMLContentSelector.h"
 #include "Node.h"
 #include "RenderFlowThread.h"
 #include "RenderFullScreen.h"
 #include "RenderObject.h"
 #include "RenderView.h"
 #include "ShadowRoot.h"
+#include "ShadowRootList.h"
 
 #if ENABLE(SVG)
 #include "SVGNames.h"
@@ -43,12 +44,11 @@
 namespace WebCore {
 
 NodeRenderingContext::NodeRenderingContext(Node* node)
-    : m_location(LocationNotInTree)
-    , m_phase(AttachStraight)
+    : m_phase(AttachingNotInTree)
     , m_node(node)
     , m_parentNodeForRenderingAndStyle(0)
-    , m_visualParentShadowRoot(0)
-    , m_includer(0)
+    , m_visualParentShadowRootList(0)
+    , m_insertionPoint(0)
     , m_style(0)
     , m_parentFlowRenderer(0)
 {
@@ -57,49 +57,46 @@ NodeRenderingContext::NodeRenderingContext(Node* node)
         return;
 
     if (parent->isShadowRoot()) {
-        m_location = LocationShadowChild;
+        m_phase = AttachingShadowChild;
         m_parentNodeForRenderingAndStyle = parent->shadowHost();
         return;
     }
 
-    m_location = LocationLightChild;
-
     if (parent->isElementNode()) {
-        m_visualParentShadowRoot = toElement(parent)->shadowRoot();
-
-        if (m_visualParentShadowRoot) {
-            if ((m_includer = m_visualParentShadowRoot->includerFor(m_node))
-                && m_visualParentShadowRoot->isInclusionSelectorActive()) {
-                m_phase = AttachContentForwarded;
-                m_parentNodeForRenderingAndStyle = NodeRenderingContext(m_includer).parentNodeForRenderingAndStyle();
+        if (toElement(parent)->hasShadowRoot()) {
+            m_visualParentShadowRootList = toElement(parent)->shadowRootList();
+            if ((m_insertionPoint = m_visualParentShadowRootList->insertionPointFor(m_node))
+                && m_visualParentShadowRootList->isSelectorActive()) {
+                m_phase = AttachingDistributed;
+                m_parentNodeForRenderingAndStyle = NodeRenderingContext(m_insertionPoint).parentNodeForRenderingAndStyle();
                 return;
             }
 
-            m_phase = AttachContentLight;
+            m_phase = AttachingNotDistributed;
             m_parentNodeForRenderingAndStyle = parent;
             return;
         }
 
-        if (parent->isContentElement()) {
-            HTMLContentElement* shadowContentElement = toHTMLContentElement(parent);
-            if (!shadowContentElement->hasInclusion()) {
-                m_phase = AttachContentFallback;
-                m_parentNodeForRenderingAndStyle = NodeRenderingContext(parent).parentNodeForRenderingAndStyle();
-                return;
-            }
+        if (isInsertionPoint(parent)) {
+            if (toInsertionPoint(parent)->hasSelection())
+                m_phase = AttachingNotFallbacked;
+            else
+                m_phase = AttachingFallbacked;
+            m_parentNodeForRenderingAndStyle = NodeRenderingContext(parent).parentNodeForRenderingAndStyle();
+            return;
         }
     }
 
+    m_phase = AttachingStraight;
     m_parentNodeForRenderingAndStyle = parent;
 }
 
 NodeRenderingContext::NodeRenderingContext(Node* node, RenderStyle* style)
-    : m_location(LocationUndetermined)
-    , m_phase(AttachStraight)
+    : m_phase(Calculating)
     , m_node(node)
     , m_parentNodeForRenderingAndStyle(0)
-    , m_visualParentShadowRoot(0)
-    , m_includer(0)
+    , m_visualParentShadowRootList(0)
+    , m_insertionPoint(0)
     , m_style(style)
     , m_parentFlowRenderer(0)
 {
@@ -120,72 +117,80 @@ PassRefPtr<RenderStyle> NodeRenderingContext::releaseStyle()
     return m_style.release();
 }
 
-static RenderObject* nextRendererOf(HTMLContentElement* parent, Node* current)
+static RenderObject* nextRendererOf(InsertionPoint* parent, Node* current)
 {
-    ShadowInclusion* currentInclusion = parent->inclusions()->find(current);
-    if (!currentInclusion)
+    HTMLContentSelection* currentSelection = parent->selections()->find(current);
+    if (!currentSelection)
         return 0;
 
-    for (ShadowInclusion* inclusion = currentInclusion->next(); inclusion; inclusion = inclusion->next()) {
-        if (RenderObject* renderer = inclusion->content()->renderer())
+    for (HTMLContentSelection* selection = currentSelection->next(); selection; selection = selection->next()) {
+        if (RenderObject* renderer = selection->node()->renderer())
             return renderer;
     }
 
     return 0;
 }
 
-static RenderObject* previousRendererOf(HTMLContentElement* parent, Node* current)
+static RenderObject* previousRendererOf(InsertionPoint* parent, Node* current)
 {
     RenderObject* lastRenderer = 0;
 
-    for (ShadowInclusion* inclusion = parent->inclusions()->first(); inclusion; inclusion = inclusion->next()) {
-        if (inclusion->content() == current)
+    for (HTMLContentSelection* selection = parent->selections()->first(); selection; selection = selection->next()) {
+        if (selection->node() == current)
             break;
-        if (RenderObject* renderer = inclusion->content()->renderer())
+        if (RenderObject* renderer = selection->node()->renderer())
             lastRenderer = renderer;
     }
 
     return lastRenderer;
 }
 
-static RenderObject* firstRendererOf(HTMLContentElement* parent)
+static RenderObject* firstRendererOf(InsertionPoint* parent)
 {
-    for (ShadowInclusion* inclusion = parent->inclusions()->first(); inclusion; inclusion = inclusion->next()) {
-        if (RenderObject* renderer = inclusion->content()->renderer())
-            return renderer;
+    if (parent->hasSelection()) {
+        for (HTMLContentSelection* selection = parent->selections()->first(); selection; selection = selection->next()) {
+            if (RenderObject* renderer = selection->node()->renderer())
+                return renderer;
+        }
+
+        return 0;
     }
 
-    return 0;
+    return NodeRenderingContext(parent).nextRenderer();
 }
 
-static RenderObject* lastRendererOf(HTMLContentElement* parent)
+static RenderObject* lastRendererOf(InsertionPoint* parent)
 {
-    for (ShadowInclusion* inclusion = parent->inclusions()->last(); inclusion; inclusion = inclusion->previous()) {
-        if (RenderObject* renderer = inclusion->content()->renderer())
-            return renderer;
+    if (parent->hasSelection()) {
+        for (HTMLContentSelection* selection = parent->selections()->last(); selection; selection = selection->previous()) {
+            if (RenderObject* renderer = selection->node()->renderer())
+                return renderer;
+        }
+
+        return 0;
     }
 
-    return 0;
+    return NodeRenderingContext(parent).previousRenderer();
 }
 
 RenderObject* NodeRenderingContext::nextRenderer() const
 {
-    ASSERT(m_node->renderer() || m_location != LocationUndetermined);
+    ASSERT(m_node->renderer() || m_phase != Calculating);
     if (RenderObject* renderer = m_node->renderer())
         return renderer->nextSibling();
 
     if (m_parentFlowRenderer)
         return m_parentFlowRenderer->nextRendererForNode(m_node);
 
-    if (m_phase == AttachContentForwarded) {
-        if (RenderObject* found = nextRendererOf(m_includer, m_node))
+    if (m_phase == AttachingDistributed) {
+        if (RenderObject* found = nextRendererOf(m_insertionPoint, m_node))
             return found;
-        return NodeRenderingContext(m_includer).nextRenderer();
+        return NodeRenderingContext(m_insertionPoint).nextRenderer();
     }
 
-    // Avoid an O(n^2) problem with this function by not checking for
+    // Avoid an O(N^2) problem with this function by not checking for
     // nextRenderer() when the parent element hasn't attached yet.
-    if (m_node->parentOrHostNode() && !m_node->parentOrHostNode()->attached() && m_phase != AttachContentFallback)
+    if (m_node->parentOrHostNode() && !m_node->parentOrHostNode()->attached())
         return 0;
 
     for (Node* node = m_node->nextSibling(); node; node = node->nextSibling()) {
@@ -195,31 +200,30 @@ RenderObject* NodeRenderingContext::nextRenderer() const
                 continue;
             return node->renderer();
         }
-        if (node->isContentElement()) {
-            if (RenderObject* first = firstRendererOf(toHTMLContentElement(node)))
+
+        if (isInsertionPoint(node)) {
+            if (RenderObject* first = firstRendererOf(toInsertionPoint(node)))
                 return first;
         }
     }
 
-    if (m_phase == AttachContentFallback)
-        return NodeRenderingContext(m_node->parentNode()).nextRenderer();
-
     return 0;
 }
 
 RenderObject* NodeRenderingContext::previousRenderer() const
 {
-    ASSERT(m_node->renderer() || m_location != LocationUndetermined);
+    ASSERT(m_node->renderer() || m_phase != Calculating);
+
     if (RenderObject* renderer = m_node->renderer())
         return renderer->previousSibling();
 
     if (m_parentFlowRenderer)
         return m_parentFlowRenderer->previousRendererForNode(m_node);
 
-    if (m_phase == AttachContentForwarded) {
-        if (RenderObject* found = previousRendererOf(m_includer, m_node))
+    if (m_phase == AttachingDistributed) {
+        if (RenderObject* found = previousRendererOf(m_insertionPoint, m_node))
             return found;
-        return NodeRenderingContext(m_includer).previousRenderer();
+        return NodeRenderingContext(m_insertionPoint).previousRenderer();
     }
 
     // FIXME: We should have the same O(N^2) avoidance as nextRenderer does
@@ -231,68 +235,57 @@ RenderObject* NodeRenderingContext::previousRenderer() const
                 continue;
             return node->renderer();
         }
-        if (node->isContentElement()) {
-            if (RenderObject* last = lastRendererOf(toHTMLContentElement(node)))
+        if (isInsertionPoint(node)) {
+            if (RenderObject* last = lastRendererOf(toInsertionPoint(node)))
                 return last;
         }
     }
 
-    if (m_phase == AttachContentFallback)
-        return NodeRenderingContext(m_node->parentNode()).previousRenderer();
-
     return 0;
 }
 
 RenderObject* NodeRenderingContext::parentRenderer() const
 {
     if (RenderObject* renderer = m_node->renderer()) {
-        ASSERT(m_location == LocationUndetermined);
+        ASSERT(m_phase == Calculating);
         return renderer->parent();
     }
 
     if (m_parentFlowRenderer)
         return m_parentFlowRenderer;
 
-    ASSERT(m_location != LocationUndetermined);
+    ASSERT(m_phase != Calculating);
     return m_parentNodeForRenderingAndStyle ? m_parentNodeForRenderingAndStyle->renderer() : 0;
 }
 
 void NodeRenderingContext::hostChildrenChanged()
 {
-    if (m_phase == AttachContentLight)
-        m_visualParentShadowRoot->hostChildrenChanged();
+    if (m_phase == AttachingNotDistributed)
+        m_visualParentShadowRootList->hostChildrenChanged();
 }
 
 bool NodeRenderingContext::shouldCreateRenderer() const
 {
-    ASSERT(m_location != LocationUndetermined);
+    ASSERT(m_phase != Calculating);
     ASSERT(parentNodeForRenderingAndStyle());
 
-    if (m_location == LocationNotInTree || m_phase == AttachContentLight)
+    if (m_phase == AttachingNotInTree || m_phase == AttachingNotDistributed || m_phase == AttachingNotFallbacked)
         return false;
-
     RenderObject* parentRenderer = this->parentRenderer();
     if (!parentRenderer)
         return false;
-
-    if (m_location == LocationLightChild && m_phase == AttachStraight) {
-        // FIXME: Ignoring canHaveChildren() in a case of shadow children might be wrong.
-        // See https://bugs.webkit.org/show_bug.cgi?id=52423
-        if (!parentRenderer->canHaveChildren())
-            return false;
-
-        if (m_visualParentShadowRoot)
-            return false;
-    }
-
-    if (!m_parentNodeForRenderingAndStyle->childShouldCreateRenderer(m_node))
+    if (!parentRenderer->canHaveChildren())
+        return false;
+    if (!m_parentNodeForRenderingAndStyle->childShouldCreateRenderer(*this))
         return false;
-
     return true;
 }
 
 void NodeRenderingContext::moveToFlowThreadIfNeeded()
 {
+    if (!m_node->document()->cssRegionsEnabled())
+        return;
+
     if (!m_node->isElementNode() || !m_style || m_style->flowThread().isEmpty())
         return;
 
diff --git a/Source/WebCore/dom/NodeRenderingContext.h b/Source/WebCore/dom/NodeRenderingContext.h
index 610420d37..ca20d525c 100644
--- a/Source/WebCore/dom/NodeRenderingContext.h
+++ b/Source/WebCore/dom/NodeRenderingContext.h
@@ -34,12 +34,12 @@ namespace WebCore {
 
 class ContainerNode;
 class Document;
+class InsertionPoint;
 class Node;
 class RenderFlowThread;
 class RenderObject;
 class RenderStyle;
-class HTMLContentElement;
-class ShadowRoot;
+class ShadowRootList;
 
 class NodeRenderingContext {
 public:
@@ -52,7 +52,7 @@ public:
     RenderObject* parentRenderer() const;
     RenderObject* nextRenderer() const;
     RenderObject* previousRenderer() const;
-    HTMLContentElement* includer() const;
+    InsertionPoint* insertionPoint() const;
 
     RenderStyle* style() const;
     void setStyle(PassRefPtr<RenderStyle>);
@@ -62,32 +62,28 @@ public:
 
     void hostChildrenChanged();
 
+    bool isOnEncapsulationBoundary() const;
     bool hasFlowThreadParent() const { return m_parentFlowRenderer; }
     RenderFlowThread* parentFlowRenderer() const { return m_parentFlowRenderer; }
     void moveToFlowThreadIfNeeded();
 
 private:
-
-    enum TreeLocation {
-        LocationUndetermined,
-        LocationNotInTree,
-        LocationLightChild,
-        LocationShadowChild,
-    };
-
-    enum AttachPhase {
-        AttachStraight,
-        AttachContentLight,
-        AttachContentForwarded,
-        AttachContentFallback,
+    enum AttachingPhase {
+        Calculating,
+        AttachingStraight,
+        AttachingNotInTree,
+        AttachingDistributed,
+        AttachingNotDistributed,
+        AttachingFallbacked,
+        AttachingNotFallbacked,
+        AttachingShadowChild,
     };
 
-    TreeLocation m_location;
-    AttachPhase m_phase;
+    AttachingPhase m_phase;
     Node* m_node;
     ContainerNode* m_parentNodeForRenderingAndStyle;
-    ShadowRoot* m_visualParentShadowRoot;
-    HTMLContentElement* m_includer;
+    ShadowRootList* m_visualParentShadowRootList;
+    InsertionPoint* m_insertionPoint;
     RefPtr<RenderStyle> m_style;
     RenderFlowThread* m_parentFlowRenderer;
     AtomicString m_flowThread;
@@ -100,7 +96,7 @@ inline Node* NodeRenderingContext::node() const
 
 inline ContainerNode* NodeRenderingContext::parentNodeForRenderingAndStyle() const
 {
-    ASSERT(m_location != LocationUndetermined);
+    ASSERT(m_phase != Calculating);
     return m_parentNodeForRenderingAndStyle;
 }
 
@@ -109,9 +105,16 @@ inline RenderStyle* NodeRenderingContext::style() const
     return m_style.get();
 }
 
-inline HTMLContentElement* NodeRenderingContext::includer() const
+inline InsertionPoint* NodeRenderingContext::insertionPoint() const
+{
+    return m_insertionPoint;
+}
+
+inline bool NodeRenderingContext::isOnEncapsulationBoundary() const
 {
-    return m_includer;
+    return (m_phase == AttachingDistributed
+            || m_phase == AttachingShadowChild
+            || m_phase == AttachingFallbacked);
 }
 
 class NodeRendererFactory {
diff --git a/Source/WebCore/dom/Notation.idl b/Source/WebCore/dom/Notation.idl
index 96351d253..2917cb26f 100644
--- a/Source/WebCore/dom/Notation.idl
+++ b/Source/WebCore/dom/Notation.idl
@@ -20,8 +20,8 @@
 module core {
 
     interface Notation : Node {
-        readonly attribute [ConvertNullStringTo=Null] DOMString publicId;
-        readonly attribute [ConvertNullStringTo=Null] DOMString systemId;
+        readonly attribute [TreatReturnedNullStringAs=Null] DOMString publicId;
+        readonly attribute [TreatReturnedNullStringAs=Null] DOMString systemId;
     };
 
 }
diff --git a/Source/WebCore/dom/OverflowEvent.idl b/Source/WebCore/dom/OverflowEvent.idl
index a1ecc4179..10b9504f4 100644
--- a/Source/WebCore/dom/OverflowEvent.idl
+++ b/Source/WebCore/dom/OverflowEvent.idl
@@ -37,9 +37,9 @@ module events {
         readonly attribute [InitializedByEventConstructor] boolean verticalOverflow;
 
 #if defined(LANGUAGE_OBJECTIVE_C) && LANGUAGE_OBJECTIVE_C
-        void initOverflowEvent(in [Optional=CallWithDefaultValue] unsigned short orient,
-                               in [Optional=CallWithDefaultValue] boolean horizontalOverflow,
-                               in [Optional=CallWithDefaultValue] boolean verticalOverflow);
+        void initOverflowEvent(in [Optional=DefaultIsUndefined] unsigned short orient,
+                               in [Optional=DefaultIsUndefined] boolean horizontalOverflow,
+                               in [Optional=DefaultIsUndefined] boolean verticalOverflow);
 #endif
     };
 
diff --git a/Source/WebCore/dom/PopStateEvent.cpp b/Source/WebCore/dom/PopStateEvent.cpp
index 8d0cb7292..d1e0c758a 100644
--- a/Source/WebCore/dom/PopStateEvent.cpp
+++ b/Source/WebCore/dom/PopStateEvent.cpp
@@ -28,6 +28,8 @@
 #include "PopStateEvent.h"
 
 #include "EventNames.h"
+#include "History.h"
+#include "SerializedScriptValue.h"
 
 namespace WebCore {
 
@@ -38,6 +40,7 @@ PopStateEventInit::PopStateEventInit()
 PopStateEvent::PopStateEvent()
     : Event(eventNames().popstateEvent, false, true)
     , m_serializedState(0)
+    , m_history(0)
 {
 }
 
@@ -45,19 +48,14 @@ PopStateEvent::PopStateEvent(const AtomicString& type, const PopStateEventInit&
     : Event(type, initializer)
     , m_state(initializer.state)
     , m_serializedState(0)
+    , m_history(0)
 {
 }
 
-PopStateEvent::PopStateEvent(const ScriptValue& state)
-    : Event(eventNames().popstateEvent, false, true)
-    , m_state(state)
-    , m_serializedState(0)
-{
-}
-
-PopStateEvent::PopStateEvent(PassRefPtr<SerializedScriptValue> serializedState)
+PopStateEvent::PopStateEvent(PassRefPtr<SerializedScriptValue> serializedState, PassRefPtr<History> history)
     : Event(eventNames().popstateEvent, false, true)
     , m_serializedState(serializedState)
+    , m_history(history)
 {
 }
 
@@ -70,14 +68,9 @@ PassRefPtr<PopStateEvent> PopStateEvent::create()
     return adoptRef(new PopStateEvent);
 }
 
-PassRefPtr<PopStateEvent> PopStateEvent::create(const ScriptValue& state)
-{
-    return adoptRef(new PopStateEvent(state));
-}
-
-PassRefPtr<PopStateEvent> PopStateEvent::create(PassRefPtr<SerializedScriptValue> serializedState)
+PassRefPtr<PopStateEvent> PopStateEvent::create(PassRefPtr<SerializedScriptValue> serializedState, PassRefPtr<History> history)
 {
-    return adoptRef(new PopStateEvent(serializedState));
+    return adoptRef(new PopStateEvent(serializedState, history));
 }
 
 PassRefPtr<PopStateEvent> PopStateEvent::create(const AtomicString& type, const PopStateEventInit& initializer)
diff --git a/Source/WebCore/dom/PopStateEvent.h b/Source/WebCore/dom/PopStateEvent.h
index 5125fc1ca..8de0ae6d1 100644
--- a/Source/WebCore/dom/PopStateEvent.h
+++ b/Source/WebCore/dom/PopStateEvent.h
@@ -29,7 +29,6 @@
 
 #include "Event.h"
 #include "ScriptValue.h"
-#include "SerializedScriptValue.h"
 
 namespace WebCore {
 
@@ -39,27 +38,30 @@ struct PopStateEventInit : public EventInit {
     ScriptValue state;
 };
 
+class History;
+class SerializedScriptValue;
+
 class PopStateEvent : public Event {
 public:
     virtual ~PopStateEvent();
     static PassRefPtr<PopStateEvent> create();
-    static PassRefPtr<PopStateEvent> create(const ScriptValue&);
-    static PassRefPtr<PopStateEvent> create(PassRefPtr<SerializedScriptValue>);
+    static PassRefPtr<PopStateEvent> create(PassRefPtr<SerializedScriptValue>, PassRefPtr<History>);
     static PassRefPtr<PopStateEvent> create(const AtomicString&, const PopStateEventInit&);
 
     SerializedScriptValue* serializedState() const { return m_serializedState.get(); }
     ScriptValue state() const { return m_state; }
+    History* history() const { return m_history.get(); }
 
     virtual const AtomicString& interfaceName() const;
 
 private:
     PopStateEvent();
     PopStateEvent(const AtomicString&, const PopStateEventInit&);
-    explicit PopStateEvent(const ScriptValue&);
-    explicit PopStateEvent(PassRefPtr<SerializedScriptValue>);
+    explicit PopStateEvent(PassRefPtr<SerializedScriptValue>, PassRefPtr<History>);
 
     ScriptValue m_state;
     RefPtr<SerializedScriptValue> m_serializedState;
+    RefPtr<History> m_history;
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/dom/PopStateEvent.idl b/Source/WebCore/dom/PopStateEvent.idl
index 6326a9d7a..c9343ca80 100644
--- a/Source/WebCore/dom/PopStateEvent.idl
+++ b/Source/WebCore/dom/PopStateEvent.idl
@@ -30,7 +30,7 @@ module events {
     interface [
         ConstructorTemplate=Event
     ] PopStateEvent : Event {
-        readonly attribute [InitializedByEventConstructor, CustomGetter] DOMObject state;
+        readonly attribute [InitializedByEventConstructor, CachedAttribute, CustomGetter] DOMObject state;
     };
 #endif
 
diff --git a/Source/WebCore/dom/Position.cpp b/Source/WebCore/dom/Position.cpp
index fed04947a..74b16ab60 100644
--- a/Source/WebCore/dom/Position.cpp
+++ b/Source/WebCore/dom/Position.cpp
@@ -153,7 +153,7 @@ Text* Position::containerText() const
 {
     switch (anchorType()) {
     case PositionIsOffsetInAnchor:
-        return m_anchorNode && m_anchorNode->isTextNode() ? static_cast<Text*>(m_anchorNode.get()) : 0;
+        return m_anchorNode && m_anchorNode->isTextNode() ? toText(m_anchorNode.get()) : 0;
     case PositionIsBeforeAnchor:
     case PositionIsAfterAnchor:
         return 0;
@@ -283,7 +283,7 @@ PassRefPtr<CSSComputedStyleDeclaration> Position::computedStyle() const
     Element* elem = element();
     if (!elem)
         return 0;
-    return WebCore::computedStyle(elem);
+    return CSSComputedStyleDeclaration::create(elem);
 }
 
 Position Position::previous(PositionMoveType moveType) const
@@ -1018,7 +1018,7 @@ Position Position::leadingWhitespacePosition(EAffinity affinity, bool considerNo
 
     Position prev = previousCharacterPosition(affinity);
     if (prev != *this && prev.deprecatedNode()->inSameContainingBlockFlowElement(deprecatedNode()) && prev.deprecatedNode()->isTextNode()) {
-        String string = static_cast<Text *>(prev.deprecatedNode())->data();
+        String string = toText(prev.deprecatedNode())->data();
         UChar c = string[prev.deprecatedEditingOffset()];
         if (considerNonCollapsibleWhitespace ? (isSpaceOrNewline(c) || c == noBreakSpace) : isCollapsibleWhitespace(c))
             if (isEditablePosition(prev))
diff --git a/Source/WebCore/dom/ProcessingInstruction.idl b/Source/WebCore/dom/ProcessingInstruction.idl
index 9c673fdcb..02499a2f1 100644
--- a/Source/WebCore/dom/ProcessingInstruction.idl
+++ b/Source/WebCore/dom/ProcessingInstruction.idl
@@ -24,8 +24,8 @@ module core {
 
         // DOM Level 1
 
-        readonly attribute [ConvertNullStringTo=Null] DOMString target;
-                 attribute [ConvertNullStringTo=Null, TreatNullAs=NullString] DOMString data
+        readonly attribute [TreatReturnedNullStringAs=Null] DOMString target;
+                 attribute [TreatReturnedNullStringAs=Null, TreatNullAs=NullString] DOMString data
                      setter raises(DOMException);
 
         // interface LinkStyle from DOM Level 2 Style Sheets
diff --git a/Source/WebCore/dom/Range.cpp b/Source/WebCore/dom/Range.cpp
index 9b569b3e0..0c00cfda9 100644
--- a/Source/WebCore/dom/Range.cpp
+++ b/Source/WebCore/dom/Range.cpp
@@ -677,7 +677,6 @@ static inline unsigned lengthOfContentsInNode(Node* node)
     case Node::DOCUMENT_FRAGMENT_NODE:
     case Node::NOTATION_NODE:
     case Node::XPATH_NAMESPACE_NODE:
-    case Node::SHADOW_ROOT_NODE:
         return node->childNodeCount();
     }
     ASSERT_NOT_REACHED();
@@ -840,7 +839,6 @@ PassRefPtr<Node> Range::processContentsBetweenOffsets(ActionType action, PassRef
     case Node::DOCUMENT_FRAGMENT_NODE:
     case Node::NOTATION_NODE:
     case Node::XPATH_NAMESPACE_NODE:
-    case Node::SHADOW_ROOT_NODE:
         // FIXME: Should we assert that some nodes never appear here?
         if (action == EXTRACT_CONTENTS || action == CLONE_CONTENTS) {
             if (fragment)
@@ -997,7 +995,7 @@ void Range::insertNode(PassRefPtr<Node> prpNewNode, ExceptionCode& ec)
 
     Node::NodeType newNodeType = newNode->nodeType();
     int numNewChildren;
-    if (newNodeType == Node::DOCUMENT_FRAGMENT_NODE) {
+    if (newNodeType == Node::DOCUMENT_FRAGMENT_NODE && !newNode->isShadowRoot()) {
         // check each child node, not the DocumentFragment itself
         numNewChildren = 0;
         for (Node* c = newNode->firstChild(); c; c = c->nextSibling()) {
@@ -1028,16 +1026,19 @@ void Range::insertNode(PassRefPtr<Node> prpNewNode, ExceptionCode& ec)
     case Node::ENTITY_NODE:
     case Node::NOTATION_NODE:
     case Node::DOCUMENT_NODE:
-    case Node::SHADOW_ROOT_NODE:
         ec = RangeException::INVALID_NODE_TYPE_ERR;
         return;
     default:
+        if (newNode->isShadowRoot()) {
+            ec = RangeException::INVALID_NODE_TYPE_ERR;
+            return;
+        }
         break;
     }
 
     bool collapsed = m_start == m_end;
     if (startIsText) {
-        RefPtr<Text> newText = static_cast<Text*>(m_start.container())->splitText(m_start.offset(), ec);
+        RefPtr<Text> newText = toText(m_start.container())->splitText(m_start.offset(), ec);
         if (ec)
             return;
         m_start.container()->parentNode()->insertBefore(newNode.release(), newText.get(), ec);
@@ -1217,8 +1218,7 @@ Node* Range::checkNodeWOffset(Node* n, int offset, ExceptionCode& ec) const
         case Node::DOCUMENT_NODE:
         case Node::ELEMENT_NODE:
         case Node::ENTITY_REFERENCE_NODE:
-        case Node::XPATH_NAMESPACE_NODE:
-        case Node::SHADOW_ROOT_NODE: {
+        case Node::XPATH_NAMESPACE_NODE: {
             if (!offset)
                 return 0;
             Node* childBefore = n->childNode(offset - 1);
@@ -1243,7 +1243,6 @@ void Range::checkNodeBA(Node* n, ExceptionCode& ec) const
         case Node::DOCUMENT_NODE:
         case Node::ENTITY_NODE:
         case Node::NOTATION_NODE:
-        case Node::SHADOW_ROOT_NODE:
             ec = RangeException::INVALID_NODE_TYPE_ERR;
             return;
         case Node::CDATA_SECTION_NODE:
@@ -1265,7 +1264,6 @@ void Range::checkNodeBA(Node* n, ExceptionCode& ec) const
         case Node::ATTRIBUTE_NODE:
         case Node::DOCUMENT_NODE:
         case Node::DOCUMENT_FRAGMENT_NODE:
-        case Node::SHADOW_ROOT_NODE:
             break;
         case Node::CDATA_SECTION_NODE:
         case Node::COMMENT_NODE:
@@ -1397,7 +1395,6 @@ void Range::selectNode(Node* refNode, ExceptionCode& ec)
             case Node::PROCESSING_INSTRUCTION_NODE:
             case Node::TEXT_NODE:
             case Node::XPATH_NAMESPACE_NODE:
-            case Node::SHADOW_ROOT_NODE:
                 break;
             case Node::DOCUMENT_TYPE_NODE:
             case Node::ENTITY_NODE:
@@ -1422,7 +1419,6 @@ void Range::selectNode(Node* refNode, ExceptionCode& ec)
         case Node::DOCUMENT_NODE:
         case Node::ENTITY_NODE:
         case Node::NOTATION_NODE:
-        case Node::SHADOW_ROOT_NODE:
             ec = RangeException::INVALID_NODE_TYPE_ERR;
             return;
     }
@@ -1463,7 +1459,6 @@ void Range::selectNodeContents(Node* refNode, ExceptionCode& ec)
             case Node::PROCESSING_INSTRUCTION_NODE:
             case Node::TEXT_NODE:
             case Node::XPATH_NAMESPACE_NODE:
-            case Node::SHADOW_ROOT_NODE:
                 break;
             case Node::DOCUMENT_TYPE_NODE:
             case Node::ENTITY_NODE:
@@ -1512,7 +1507,6 @@ void Range::surroundContents(PassRefPtr<Node> passNewParent, ExceptionCode& ec)
         case Node::PROCESSING_INSTRUCTION_NODE:
         case Node::TEXT_NODE:
         case Node::XPATH_NAMESPACE_NODE:
-        case Node::SHADOW_ROOT_NODE:
             break;
     }
 
@@ -1678,7 +1672,7 @@ IntRect Range::boundingBox()
     const size_t n = rects.size();
     for (size_t i = 0; i < n; ++i)
         result.unite(rects[i]);
-    return result;
+    return pixelSnappedIntRect(result);
 }
 
 void Range::textRects(Vector<IntRect>& rects, bool useSelectionHeight, RangeInFixedPosition* inFixed)
@@ -2040,7 +2034,7 @@ void Range::getBorderAndTextQuads(Vector<FloatQuad>& quads) const
                 }
             }
         } else if (node->isTextNode()) {
-            if (RenderObject* renderer = static_cast<Text*>(node)->renderer()) {
+            if (RenderObject* renderer = toText(node)->renderer()) {
                 RenderText* renderText = toRenderText(renderer);
                 int startOffset = (node == startContainer) ? m_start.offset() : 0;
                 int endOffset = (node == endContainer) ? m_end.offset() : INT_MAX;
diff --git a/Source/WebCore/dom/Range.idl b/Source/WebCore/dom/Range.idl
index eb7168fa6..67f4aee07 100644
--- a/Source/WebCore/dom/Range.idl
+++ b/Source/WebCore/dom/Range.idl
@@ -36,25 +36,25 @@ module ranges {
         readonly attribute Node commonAncestorContainer
             getter raises(DOMException);
 
-        [ObjCLegacyUnnamedParameters] void setStart(in [Optional=CallWithDefaultValue] Node refNode, 
-                                     in [Optional=CallWithDefaultValue] long offset)
+        [ObjCLegacyUnnamedParameters] void setStart(in [Optional=DefaultIsUndefined] Node refNode, 
+                                     in [Optional=DefaultIsUndefined] long offset)
             raises(RangeException, DOMException);
-        [ObjCLegacyUnnamedParameters] void setEnd(in [Optional=CallWithDefaultValue] Node refNode, 
-                                   in [Optional=CallWithDefaultValue] long offset)
+        [ObjCLegacyUnnamedParameters] void setEnd(in [Optional=DefaultIsUndefined] Node refNode, 
+                                   in [Optional=DefaultIsUndefined] long offset)
             raises(RangeException, DOMException);
-        void setStartBefore(in [Optional=CallWithDefaultValue] Node refNode)
+        void setStartBefore(in [Optional=DefaultIsUndefined] Node refNode)
             raises(RangeException, DOMException);
-        void setStartAfter(in [Optional=CallWithDefaultValue] Node refNode)
+        void setStartAfter(in [Optional=DefaultIsUndefined] Node refNode)
             raises(RangeException, DOMException);
-        void setEndBefore(in [Optional=CallWithDefaultValue] Node refNode)
+        void setEndBefore(in [Optional=DefaultIsUndefined] Node refNode)
             raises(RangeException, DOMException);
-        void setEndAfter(in [Optional=CallWithDefaultValue] Node refNode)
+        void setEndAfter(in [Optional=DefaultIsUndefined] Node refNode)
             raises(RangeException, DOMException);
-        void collapse(in [Optional=CallWithDefaultValue] boolean toStart)
+        void collapse(in [Optional=DefaultIsUndefined] boolean toStart)
             raises(DOMException);
-        void selectNode(in [Optional=CallWithDefaultValue] Node refNode)
+        void selectNode(in [Optional=DefaultIsUndefined] Node refNode)
             raises(RangeException, DOMException);
-        void selectNodeContents(in [Optional=CallWithDefaultValue] Node refNode)
+        void selectNodeContents(in [Optional=DefaultIsUndefined] Node refNode)
             raises(RangeException, DOMException);
 
         // CompareHow
@@ -63,8 +63,8 @@ module ranges {
         const unsigned short END_TO_END     = 2;
         const unsigned short END_TO_START   = 3;
 
-        [ObjCLegacyUnnamedParameters] short compareBoundaryPoints(in [Optional=CallWithDefaultValue] CompareHow how,
-                                                   in [Optional=CallWithDefaultValue] Range sourceRange)
+        [ObjCLegacyUnnamedParameters] short compareBoundaryPoints(in [Optional=DefaultIsUndefined] CompareHow how,
+                                                   in [Optional=DefaultIsUndefined] Range sourceRange)
             raises(DOMException);
 
         void deleteContents()
@@ -73,9 +73,9 @@ module ranges {
             raises(DOMException);
         DocumentFragment cloneContents()
             raises(DOMException);
-        void insertNode(in [Optional=CallWithDefaultValue] Node newNode)
+        void insertNode(in [Optional=DefaultIsUndefined] Node newNode)
             raises(DOMException, RangeException);
-        void surroundContents(in [Optional=CallWithDefaultValue] Node newParent)
+        void surroundContents(in [Optional=DefaultIsUndefined] Node newParent)
             raises(DOMException, RangeException);
         Range cloneRange()
             raises(DOMException);
@@ -94,15 +94,15 @@ module ranges {
 
         // extensions
 
-        DocumentFragment createContextualFragment(in [Optional=CallWithDefaultValue] DOMString html)
+        DocumentFragment createContextualFragment(in [Optional=DefaultIsUndefined] DOMString html)
             raises(DOMException);
 
         // WebKit extensions
 
-        boolean intersectsNode(in [Optional=CallWithDefaultValue] Node refNode)
+        boolean intersectsNode(in [Optional=DefaultIsUndefined] Node refNode)
             raises(RangeException, DOMException);
 
-        short compareNode(in [Optional=CallWithDefaultValue] Node refNode)
+        short compareNode(in [Optional=DefaultIsUndefined] Node refNode)
             raises(RangeException, DOMException);
 
         // CompareResults
@@ -111,15 +111,15 @@ module ranges {
         const unsigned short NODE_BEFORE_AND_AFTER = 2;
         const unsigned short NODE_INSIDE           = 3;
 
-        short comparePoint(in [Optional=CallWithDefaultValue] Node refNode, 
-                           in [Optional=CallWithDefaultValue] long offset)
+        short comparePoint(in [Optional=DefaultIsUndefined] Node refNode, 
+                           in [Optional=DefaultIsUndefined] long offset)
             raises(RangeException, DOMException);
 
-        boolean isPointInRange(in [Optional=CallWithDefaultValue] Node refNode, 
-                               in [Optional=CallWithDefaultValue] long offset)
+        boolean isPointInRange(in [Optional=DefaultIsUndefined] Node refNode, 
+                               in [Optional=DefaultIsUndefined] long offset)
             raises(RangeException, DOMException);
 
-        void expand(in [Optional=CallWithDefaultValue] DOMString unit)
+        void expand(in [Optional=DefaultIsUndefined] DOMString unit)
             raises(RangeException, DOMException);
 
 #if !defined(LANGUAGE_JAVASCRIPT) || !LANGUAGE_JAVASCRIPT
diff --git a/Source/WebCore/dom/RequestAnimationFrameCallback.idl b/Source/WebCore/dom/RequestAnimationFrameCallback.idl
index b850c4776..4da682083 100644
--- a/Source/WebCore/dom/RequestAnimationFrameCallback.idl
+++ b/Source/WebCore/dom/RequestAnimationFrameCallback.idl
@@ -30,7 +30,7 @@
 
 module core {
     interface [
-        Callback=FunctionOnly,
+        Callback,
         Conditional=REQUEST_ANIMATION_FRAME,
     ] RequestAnimationFrameCallback{
 #if defined(V8_BINDING) && V8_BINDING
diff --git a/Source/WebCore/dom/ScriptElement.cpp b/Source/WebCore/dom/ScriptElement.cpp
index 71c1fce42..895e8337d 100644
--- a/Source/WebCore/dom/ScriptElement.cpp
+++ b/Source/WebCore/dom/ScriptElement.cpp
@@ -355,7 +355,7 @@ String ScriptElement::scriptContent() const
         if (!n->isTextNode())
             continue;
 
-        Text* t = static_cast<Text*>(n);
+        Text* t = toText(n);
         if (foundMultipleTextNodes)
             content.append(t->data());
         else if (firstTextNode) {
diff --git a/Source/WebCore/dom/ScriptExecutionContext.cpp b/Source/WebCore/dom/ScriptExecutionContext.cpp
index 5670fe8ef..9a5682d7f 100644
--- a/Source/WebCore/dom/ScriptExecutionContext.cpp
+++ b/Source/WebCore/dom/ScriptExecutionContext.cpp
@@ -93,6 +93,7 @@ ScriptExecutionContext::ScriptExecutionContext()
     : m_iteratingActiveDOMObjects(false)
     , m_inDestructor(false)
     , m_inDispatchErrorEvent(false)
+    , m_activeDOMObjectsAreSuspended(false)
 #if ENABLE(SQL_DATABASE)
     , m_hasOpenDatabases(false)
 #endif
@@ -102,7 +103,6 @@ ScriptExecutionContext::ScriptExecutionContext()
 ScriptExecutionContext::~ScriptExecutionContext()
 {
     m_inDestructor = true;
-
     for (HashSet<ContextDestructionObserver*>::iterator iter = m_destructionObservers.begin(); iter != m_destructionObservers.end(); iter = m_destructionObservers.begin()) {
         ContextDestructionObserver* observer = *iter;
         m_destructionObservers.remove(observer);
@@ -211,11 +211,12 @@ bool ScriptExecutionContext::canSuspendActiveDOMObjects()
     HashMap<ActiveDOMObject*, void*>::iterator activeObjectsEnd = m_activeDOMObjects.end();
     for (HashMap<ActiveDOMObject*, void*>::iterator iter = m_activeDOMObjects.begin(); iter != activeObjectsEnd; ++iter) {
         ASSERT(iter->first->scriptExecutionContext() == this);
+        ASSERT(iter->first->suspendIfNeededCalled());
         if (!iter->first->canSuspend()) {
             m_iteratingActiveDOMObjects = false;
             return false;
         }
-    }    
+    }
     m_iteratingActiveDOMObjects = false;
     return true;
 }
@@ -227,18 +228,23 @@ void ScriptExecutionContext::suspendActiveDOMObjects(ActiveDOMObject::ReasonForS
     HashMap<ActiveDOMObject*, void*>::iterator activeObjectsEnd = m_activeDOMObjects.end();
     for (HashMap<ActiveDOMObject*, void*>::iterator iter = m_activeDOMObjects.begin(); iter != activeObjectsEnd; ++iter) {
         ASSERT(iter->first->scriptExecutionContext() == this);
+        ASSERT(iter->first->suspendIfNeededCalled());
         iter->first->suspend(why);
     }
     m_iteratingActiveDOMObjects = false;
+    m_activeDOMObjectsAreSuspended = true;
+    m_reasonForSuspendingActiveDOMObjects = why;
 }
 
 void ScriptExecutionContext::resumeActiveDOMObjects()
 {
+    m_activeDOMObjectsAreSuspended = false;
     // No protection against m_activeDOMObjects changing during iteration: resume() shouldn't execute arbitrary JS.
     m_iteratingActiveDOMObjects = true;
     HashMap<ActiveDOMObject*, void*>::iterator activeObjectsEnd = m_activeDOMObjects.end();
     for (HashMap<ActiveDOMObject*, void*>::iterator iter = m_activeDOMObjects.begin(); iter != activeObjectsEnd; ++iter) {
         ASSERT(iter->first->scriptExecutionContext() == this);
+        ASSERT(iter->first->suspendIfNeededCalled());
         iter->first->resume();
     }
     m_iteratingActiveDOMObjects = false;
@@ -251,6 +257,7 @@ void ScriptExecutionContext::stopActiveDOMObjects()
     HashMap<ActiveDOMObject*, void*>::iterator activeObjectsEnd = m_activeDOMObjects.end();
     for (HashMap<ActiveDOMObject*, void*>::iterator iter = m_activeDOMObjects.begin(); iter != activeObjectsEnd; ++iter) {
         ASSERT(iter->first->scriptExecutionContext() == this);
+        ASSERT(iter->first->suspendIfNeededCalled());
         iter->first->stop();
     }
     m_iteratingActiveDOMObjects = false;
@@ -259,6 +266,14 @@ void ScriptExecutionContext::stopActiveDOMObjects()
     closeMessagePorts();
 }
 
+void ScriptExecutionContext::suspendActiveDOMObjectIfNeeded(ActiveDOMObject* object)
+{
+    ASSERT(m_activeDOMObjects.contains(object));
+    // Ensure all ActiveDOMObjects are suspended also newly created ones.
+    if (m_activeDOMObjectsAreSuspended)
+        object->suspend(m_reasonForSuspendingActiveDOMObjects);
+}
+
 void ScriptExecutionContext::didCreateActiveDOMObject(ActiveDOMObject* object, void* upcastPointer)
 {
     ASSERT(object);
diff --git a/Source/WebCore/dom/ScriptExecutionContext.h b/Source/WebCore/dom/ScriptExecutionContext.h
index 6cbdd0265..15ceb42ee 100644
--- a/Source/WebCore/dom/ScriptExecutionContext.h
+++ b/Source/WebCore/dom/ScriptExecutionContext.h
@@ -98,6 +98,9 @@ public:
     void addConsoleMessage(MessageSource, MessageType, MessageLevel, const String& message, const String& sourceURL = String(), unsigned lineNumber = 0, PassRefPtr<ScriptCallStack> = 0);
     void addConsoleMessage(MessageSource, MessageType, MessageLevel, const String& message, PassRefPtr<ScriptCallStack>);
 
+#if ENABLE(BLOB)
+    PublicURLManager& publicURLManager();
+#endif
     // Active objects are not garbage collected even if inaccessible, e.g. because their activity may result in callbacks being invoked.
     bool canSuspendActiveDOMObjects();
     // Active objects can be asked to suspend even if canSuspendActiveDOMObjects() returns 'false' -
@@ -106,12 +109,15 @@ public:
     virtual void resumeActiveDOMObjects();
     virtual void stopActiveDOMObjects();
 
-#if ENABLE(BLOB)
-    PublicURLManager& publicURLManager();
-#endif
+    bool activeDOMObjectsAreSuspended() const { return m_activeDOMObjectsAreSuspended; }
+
+    // Called from the constructor and destructors of ActiveDOMObject.
     void didCreateActiveDOMObject(ActiveDOMObject*, void* upcastPointer);
     void willDestroyActiveDOMObject(ActiveDOMObject*);
 
+    // Called after the construction of an ActiveDOMObject to synchronize suspend state.
+    void suspendActiveDOMObjectIfNeeded(ActiveDOMObject*);
+
     typedef const HashMap<ActiveDOMObject*, void*> ActiveDOMObjectsMap;
     ActiveDOMObjectsMap& activeDOMObjects() const { return m_activeDOMObjects; }
 
@@ -215,6 +221,9 @@ private:
     OwnPtr<PublicURLManager> m_publicURLManager;
 #endif
 
+    bool m_activeDOMObjectsAreSuspended;
+    ActiveDOMObject::ReasonForSuspension m_reasonForSuspendingActiveDOMObjects;
+
 #if ENABLE(SQL_DATABASE)
     RefPtr<DatabaseThread> m_databaseThread;
     bool m_hasOpenDatabases; // This never changes back to false, even after the database thread is closed.
diff --git a/Source/WebCore/dom/ScriptedAnimationController.cpp b/Source/WebCore/dom/ScriptedAnimationController.cpp
index 8875f5568..099bc5cbd 100644
--- a/Source/WebCore/dom/ScriptedAnimationController.cpp
+++ b/Source/WebCore/dom/ScriptedAnimationController.cpp
@@ -85,7 +85,7 @@ ScriptedAnimationController::CallbackId ScriptedAnimationController::registerCal
     callback->m_element = animationElement;
     m_callbacks.append(callback);
 
-    InspectorInstrumentation::didRegisterAnimationFrameCallback(m_document, id);
+    InspectorInstrumentation::didRequestAnimationFrame(m_document, id);
 
     if (!m_suspendCount)
         scheduleAnimation();
@@ -97,7 +97,7 @@ void ScriptedAnimationController::cancelCallback(CallbackId id)
     for (size_t i = 0; i < m_callbacks.size(); ++i) {
         if (m_callbacks[i]->m_id == id) {
             m_callbacks[i]->m_firedOrCancelled = true;
-            InspectorInstrumentation::didCancelAnimationFrameCallback(m_document, id);
+            InspectorInstrumentation::didCancelAnimationFrame(m_document, id);
             m_callbacks.remove(i);
             return;
         }
@@ -141,9 +141,9 @@ void ScriptedAnimationController::serviceScriptedAnimations(DOMTimeStamp time)
             RequestAnimationFrameCallback* callback = callbacks[i].get();
             if (!callback->m_firedOrCancelled && (!callback->m_element || callback->m_element->renderer())) {
                 callback->m_firedOrCancelled = true;
-                InspectorInstrumentationCookie cookie = InspectorInstrumentation::willFireAnimationFrameEvent(m_document, callback->m_id);
+                InspectorInstrumentationCookie cookie = InspectorInstrumentation::willFireAnimationFrame(m_document, callback->m_id);
                 callback->handleEvent(time);
-                InspectorInstrumentation::didFireAnimationFrameEvent(cookie);
+                InspectorInstrumentation::didFireAnimationFrame(cookie);
                 firedCallback = true;
                 callbacks.remove(i);
                 break;
diff --git a/Source/WebCore/dom/ShadowRoot.cpp b/Source/WebCore/dom/ShadowRoot.cpp
index 290be3f6d..6cf50acb9 100644
--- a/Source/WebCore/dom/ShadowRoot.cpp
+++ b/Source/WebCore/dom/ShadowRoot.cpp
@@ -27,22 +27,28 @@
 #include "config.h"
 #include "ShadowRoot.h"
 
-#include "ContentInclusionSelector.h"
 #include "Document.h"
 #include "Element.h"
 #include "HTMLContentElement.h"
+#include "HTMLContentSelector.h"
 #include "HTMLNames.h"
+#include "InsertionPoint.h"
 #include "NodeRareData.h"
+#include "ShadowRootList.h"
 #include "SVGNames.h"
-#include "Text.h"
+
+#if ENABLE(SHADOW_DOM)
+#include "RuntimeEnabledFeatures.h"
+#endif
 
 namespace WebCore {
 
 ShadowRoot::ShadowRoot(Document* document)
     : DocumentFragment(document, CreateShadowRoot)
     , TreeScope(this)
+    , m_prev(0)
+    , m_next(0)
     , m_applyAuthorSheets(false)
-    , m_needsRecalculateContent(false)
 {
     ASSERT(document);
     
@@ -55,6 +61,9 @@ ShadowRoot::ShadowRoot(Document* document)
 
 ShadowRoot::~ShadowRoot()
 {
+    ASSERT(!m_prev);
+    ASSERT(!m_next);
+
     // We must call clearRareData() here since a ShadowRoot class inherits TreeScope
     // as well as Node. See a comment on TreeScope.h for the reason.
     if (hasRareData())
@@ -92,7 +101,13 @@ PassRefPtr<ShadowRoot> ShadowRoot::create(Element* element, ExceptionCode& ec)
 
 PassRefPtr<ShadowRoot> ShadowRoot::create(Element* element, ShadowRootCreationPurpose purpose, ExceptionCode& ec)
 {
-    if (!element || element->shadowRoot()) {
+#if ENABLE(SHADOW_DOM)
+    bool isMultipleShadowSubtreesEnabled = RuntimeEnabledFeatures::multipleShadowSubtreesEnabled();
+#else
+    bool isMultipleShadowSubtreesEnabled = false;
+#endif
+
+    if (!element || (!isMultipleShadowSubtreesEnabled && element->hasShadowRoot())) {
         ec = HIERARCHY_REQUEST_ERR;
         return 0;
     }
@@ -104,14 +119,15 @@ PassRefPtr<ShadowRoot> ShadowRoot::create(Element* element, ShadowRootCreationPu
         return 0;
     }
 
-    ASSERT(purpose != CreatingUserAgentShadowRoot || !element->shadowRoot());
-    RefPtr<ShadowRoot> shadowRoot = create(element->document());
+    ASSERT(purpose != CreatingUserAgentShadowRoot || !element->hasShadowRoot());
+    RefPtr<ShadowRoot> shadowRoot = adoptRef(new ShadowRoot(element->document()));
 
     ec = 0;
     element->setShadowRoot(shadowRoot, ec);
     if (ec)
         return 0;
-
+    ASSERT(element == shadowRoot->host());
+    ASSERT(element->hasShadowRoot());
     return shadowRoot.release();
 }
 
@@ -120,11 +136,6 @@ String ShadowRoot::nodeName() const
     return "#shadow-root";
 }
 
-Node::NodeType ShadowRoot::nodeType() const
-{
-    return SHADOW_ROOT_NODE;
-}
-
 PassRefPtr<Node> ShadowRoot::cloneNode(bool)
 {
     // ShadowRoot should not be arbitrarily cloned.
@@ -146,53 +157,11 @@ bool ShadowRoot::childTypeAllowed(NodeType type) const
     }
 }
 
-void ShadowRoot::recalcShadowTreeStyle(StyleChange change)
-{
-    if (needsReattachHostChildrenAndShadow())
-        reattachHostChildrenAndShadow();
-    else {
-        for (Node* n = firstChild(); n; n = n->nextSibling()) {
-            if (n->isElementNode())
-                static_cast<Element*>(n)->recalcStyle(change);
-            else if (n->isTextNode())
-                static_cast<Text*>(n)->recalcTextStyle(change);
-        }
-    }
-
-    clearNeedsReattachHostChildrenAndShadow();
-    clearNeedsStyleRecalc();
-    clearChildNeedsStyleRecalc();
-}
-
-void ShadowRoot::setNeedsReattachHostChildrenAndShadow()
-{
-    m_needsRecalculateContent = true;
-    if (shadowHost())
-        shadowHost()->setNeedsStyleRecalc();
-}
-
-HTMLContentElement* ShadowRoot::includerFor(Node* node) const
-{
-    if (!m_inclusions)
-        return 0;
-    ShadowInclusion* found = m_inclusions->findFor(node);
-    if (!found)
-        return 0;
-    return found->includer();
-}
-
-void ShadowRoot::hostChildrenChanged()
+ShadowRootList* ShadowRoot::list() const
 {
-    if (!hasContentElement())
-        return;
-
-    // This results in forced detaching/attaching of the shadow render tree. See ShadowRoot::recalcStyle().
-    setNeedsReattachHostChildrenAndShadow();
-}
-
-bool ShadowRoot::isInclusionSelectorActive() const
-{
-    return m_inclusions && m_inclusions->hasCandidates();
+    if (host())
+        return host()->shadowRootList();
+    return 0;
 }
 
 bool ShadowRoot::hasContentElement() const
@@ -217,46 +186,15 @@ void ShadowRoot::setApplyAuthorSheets(bool value)
 
 void ShadowRoot::attach()
 {
-    // Children of m_inclusions is populated lazily in
-    // ensureInclusions(), and here we just ensure that
+    // Children of m_selector is populated lazily in
+    // ensureSelector(), and here we just ensure that
     // it is in clean state.
-    ASSERT(!m_inclusions || !m_inclusions->hasCandidates());
+    // FIXME: This assertion breaks if multiple shadow roots are being attached.
+    // ShadowRootList should have responsibility of side effect of selector in attaching/detaching.
+    ASSERT(!host()->shadowRootList()->selector() || !host()->shadowRootList()->selector()->hasCandidates());
     DocumentFragment::attach();
-    if (m_inclusions)
-        m_inclusions->didSelect();
-}
-
-void ShadowRoot::reattachHostChildrenAndShadow()
-{
-    Node* hostNode = host();
-    if (!hostNode)
-        return;
-
-    for (Node* child = hostNode->firstChild(); child; child = child->nextSibling()) {
-        if (child->attached())
-            child->detach();
-    }
-
-    reattach();
-
-    for (Node* child = hostNode->firstChild(); child; child = child->nextSibling()) {
-        if (!child->attached())
-            child->attach();
-    }
-}
-
-ContentInclusionSelector* ShadowRoot::inclusions() const
-{
-    return m_inclusions.get();
+    if (HTMLContentSelector* selector = host()->shadowRootList()->selector())
+        selector->didSelect();
 }
 
-ContentInclusionSelector* ShadowRoot::ensureInclusions()
-{
-    if (!m_inclusions)
-        m_inclusions = adoptPtr(new ContentInclusionSelector());
-    m_inclusions->willSelectOver(this);
-    return m_inclusions.get();
-}
-
-
 }
diff --git a/Source/WebCore/dom/ShadowRoot.h b/Source/WebCore/dom/ShadowRoot.h
index 401ee5e9d..312116749 100644
--- a/Source/WebCore/dom/ShadowRoot.h
+++ b/Source/WebCore/dom/ShadowRoot.h
@@ -30,16 +30,19 @@
 #include "DocumentFragment.h"
 #include "ExceptionCode.h"
 #include "TreeScope.h"
+#include <wtf/DoublyLinkedList.h>
 
 namespace WebCore {
 
-class ContentInclusionSelector;
 class Document;
 class HTMLContentElement;
+class HTMLContentSelector;
+class InsertionPoint;
+class ShadowRootList;
 
-class ShadowRoot : public DocumentFragment, public TreeScope {
+class ShadowRoot : public DocumentFragment, public TreeScope, public DoublyLinkedListNode<ShadowRoot> {
+    friend class WTF::DoublyLinkedListNode<ShadowRoot>;
 public:
-    static PassRefPtr<ShadowRoot> create(Document*);
     static PassRefPtr<ShadowRoot> create(Element*, ExceptionCode&);
 
     // FIXME: We will support multiple shadow subtrees, however current implementation does not work well
@@ -58,56 +61,44 @@ public:
     void clearNeedsReattachHostChildrenAndShadow();
     bool needsReattachHostChildrenAndShadow();
 
-    HTMLContentElement* includerFor(Node*) const;
+    InsertionPoint* insertionPointFor(Node*) const;
     void hostChildrenChanged();
-    bool isInclusionSelectorActive() const;
 
     virtual void attach();
-    void reattachHostChildrenAndShadow();
 
     virtual bool applyAuthorSheets() const;
     void setApplyAuthorSheets(bool);
 
     Element* host() const { return shadowHost(); }
+    ShadowRootList* list() const;
 
-    ContentInclusionSelector* inclusions() const;
-    ContentInclusionSelector* ensureInclusions();
+    ShadowRoot* youngerShadowRoot() const { return prev(); }
+    ShadowRoot* olderShadowRoot() const { return next(); }
+
+    bool hasContentElement() const;
 
 private:
     ShadowRoot(Document*);
     virtual ~ShadowRoot();
 
     virtual String nodeName() const;
-    virtual NodeType nodeType() const;
     virtual PassRefPtr<Node> cloneNode(bool deep);
     virtual bool childTypeAllowed(NodeType) const;
 
-    bool hasContentElement() const;
-
+    ShadowRoot* m_prev;
+    ShadowRoot* m_next;
     bool m_applyAuthorSheets : 1;
-    bool m_needsRecalculateContent : 1;
-    OwnPtr<ContentInclusionSelector> m_inclusions;
 };
 
-inline PassRefPtr<ShadowRoot> ShadowRoot::create(Document* document)
-{
-    return adoptRef(new ShadowRoot(document));
-}
-
-inline void ShadowRoot::clearNeedsReattachHostChildrenAndShadow()
-{
-    m_needsRecalculateContent = false;
-}
-
-inline bool ShadowRoot::needsReattachHostChildrenAndShadow()
+inline const ShadowRoot* toShadowRoot(const Node* node)
 {
-    return m_needsRecalculateContent || hasContentElement();
+    ASSERT(!node || node->isShadowRoot());
+    return static_cast<const ShadowRoot*>(node);
 }
 
 inline ShadowRoot* toShadowRoot(Node* node)
 {
-    ASSERT(!node || node->nodeType() == Node::SHADOW_ROOT_NODE);
-    return static_cast<ShadowRoot*>(node);
+    return const_cast<ShadowRoot*>(toShadowRoot(static_cast<const Node*>(node)));
 }
 
 } // namespace
diff --git a/Source/WebCore/dom/ShadowRoot.idl b/Source/WebCore/dom/ShadowRoot.idl
index 011d6795f..ffa3b03b4 100644
--- a/Source/WebCore/dom/ShadowRoot.idl
+++ b/Source/WebCore/dom/ShadowRoot.idl
@@ -33,11 +33,11 @@ module core {
         ConstructorRaisesException
     ] ShadowRoot : DocumentFragment {
         readonly attribute Element host;
-        Element getElementById(in [Optional=CallWithDefaultValue] DOMString elementId);
-        NodeList getElementsByClassName(in [Optional=CallWithDefaultValue] DOMString className);
-        NodeList getElementsByTagName(in [Optional=CallWithDefaultValue] DOMString tagName);
-        NodeList getElementsByTagNameNS(in [TreatNullAs=NullString,Optional=CallWithDefaultValue] DOMString namespaceURI,
-                                        in [Optional=CallWithDefaultValue] DOMString localName);
+        Element getElementById(in [Optional=DefaultIsUndefined] DOMString elementId);
+        NodeList getElementsByClassName(in [Optional=DefaultIsUndefined] DOMString className);
+        NodeList getElementsByTagName(in [Optional=DefaultIsUndefined] DOMString tagName);
+        NodeList getElementsByTagNameNS(in [TreatNullAs=NullString,Optional=DefaultIsUndefined] DOMString namespaceURI,
+                                        in [Optional=DefaultIsUndefined] DOMString localName);
     };
 
 }
diff --git a/Source/WebCore/dom/ShadowRootList.cpp b/Source/WebCore/dom/ShadowRootList.cpp
new file mode 100644
index 000000000..3adee6370
--- /dev/null
+++ b/Source/WebCore/dom/ShadowRootList.cpp
@@ -0,0 +1,238 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "ShadowRootList.h"
+
+#include "Document.h"
+#include "Element.h"
+#include "HTMLContentSelector.h"
+#include "RuntimeEnabledFeatures.h"
+#include "ShadowRoot.h"
+#include "Text.h"
+
+namespace WebCore {
+
+ShadowRootList::ShadowRootList()
+    : m_needsRecalculateContent(false)
+{
+}
+
+ShadowRootList::~ShadowRootList()
+{
+    ASSERT(!hasShadowRoot());
+}
+
+void ShadowRootList::pushShadowRoot(ShadowRoot* shadowRoot)
+{
+#if ENABLE(SHADOW_DOM)
+    if (!RuntimeEnabledFeatures::multipleShadowSubtreesEnabled())
+        ASSERT(!hasShadowRoot());
+#else
+    ASSERT(!hasShadowRoot());
+#endif
+
+    m_shadowRoots.push(shadowRoot);
+}
+
+ShadowRoot* ShadowRootList::popShadowRoot()
+{
+    if (!hasShadowRoot())
+        return 0;
+
+    return m_shadowRoots.removeHead();
+}
+
+void ShadowRootList::insertedIntoDocument()
+{
+    for (ShadowRoot* root = youngestShadowRoot(); root; root = root->olderShadowRoot())
+        root->insertedIntoDocument();
+}
+
+void ShadowRootList::removedFromDocument()
+{
+    for (ShadowRoot* root = youngestShadowRoot(); root; root = root->olderShadowRoot())
+        root->removedFromDocument();
+}
+
+void ShadowRootList::insertedIntoTree(bool deep)
+{
+    for (ShadowRoot* root = youngestShadowRoot(); root; root = root->olderShadowRoot())
+        root->insertedIntoTree(deep);
+}
+
+void ShadowRootList::removedFromTree(bool deep)
+{
+    for (ShadowRoot* root = youngestShadowRoot(); root; root = root->olderShadowRoot())
+        root->removedFromTree(deep);
+}
+
+void ShadowRootList::willRemove()
+{
+    for (ShadowRoot* root = youngestShadowRoot(); root; root = root->olderShadowRoot())
+        root->willRemove();
+}
+
+void ShadowRootList::attach()
+{
+    // FIXME: Currently we only support the case that the shadow root list has at most one shadow root.
+    // See also https://bugs.webkit.org/show_bug.cgi?id=77503 and its dependent bugs.
+    ASSERT(m_shadowRoots.size() <= 1);
+
+    for (ShadowRoot* root = youngestShadowRoot(); root; root = root->olderShadowRoot()) {
+        if (!root->attached())
+            root->attach();
+    }
+}
+
+void ShadowRootList::detach()
+{
+    // FIXME: Currently we only support the case that the shadow root list has at most one shadow root.
+    // See also https://bugs.webkit.org/show_bug.cgi?id=77503 and its dependent bugs.
+    ASSERT(m_shadowRoots.size() <= 1);
+
+    for (ShadowRoot* root = youngestShadowRoot(); root; root = root->olderShadowRoot()) {
+        if (root->attached())
+            root->detach();
+    }
+}
+
+InsertionPoint* ShadowRootList::insertionPointFor(Node* node) const
+{
+    if (!m_selector)
+        return 0;
+    HTMLContentSelection* found = m_selector->findFor(node);
+    if (!found)
+        return 0;
+    return found->insertionPoint();
+}
+
+bool ShadowRootList::isSelectorActive() const
+{
+    return m_selector && m_selector->hasCandidates();
+}
+
+void ShadowRootList::reattach()
+{
+    detach();
+    attach();
+}
+
+bool ShadowRootList::childNeedsStyleRecalc()
+{
+    ASSERT(youngestShadowRoot());
+    if (!youngestShadowRoot())
+        return false;
+
+    return youngestShadowRoot()->childNeedsStyleRecalc();
+}
+
+bool ShadowRootList::needsStyleRecalc()
+{
+    ASSERT(youngestShadowRoot());
+    if (!youngestShadowRoot())
+        return false;
+
+    return youngestShadowRoot()->needsStyleRecalc();
+}
+
+void ShadowRootList::recalcShadowTreeStyle(Node::StyleChange change)
+{
+    ShadowRoot* youngest = youngestShadowRoot();
+    if (!youngest)
+        return;
+
+    if (needsReattachHostChildrenAndShadow())
+        reattachHostChildrenAndShadow();
+    else {
+        for (Node* n = youngest->firstChild(); n; n = n->nextSibling()) {
+            if (n->isElementNode())
+                static_cast<Element*>(n)->recalcStyle(change);
+            else if (n->isTextNode())
+                toText(n)->recalcTextStyle(change);
+        }
+    }
+
+    clearNeedsReattachHostChildrenAndShadow();
+    for (ShadowRoot* root = youngestShadowRoot(); root; root = root->olderShadowRoot()) {
+        root->clearNeedsStyleRecalc();
+        root->clearChildNeedsStyleRecalc();
+    }
+}
+
+bool ShadowRootList::needsReattachHostChildrenAndShadow()
+{
+    return m_needsRecalculateContent || (youngestShadowRoot() && youngestShadowRoot()->hasContentElement());
+}
+
+void ShadowRootList::hostChildrenChanged()
+{
+    ASSERT(youngestShadowRoot());
+
+    if (!youngestShadowRoot()->hasContentElement())
+        return;
+
+    // This results in forced detaching/attaching of the shadow render tree. See ShadowRoot::recalcStyle().
+    setNeedsReattachHostChildrenAndShadow();
+}
+
+void ShadowRootList::setNeedsReattachHostChildrenAndShadow()
+{
+    m_needsRecalculateContent = true;
+
+    host()->setNeedsStyleRecalc();
+}
+
+void ShadowRootList::reattachHostChildrenAndShadow()
+{
+    ASSERT(youngestShadowRoot());
+
+    Node* hostNode = youngestShadowRoot()->host();
+    if (!hostNode)
+        return;
+
+    for (Node* child = hostNode->firstChild(); child; child = child->nextSibling()) {
+        if (child->attached())
+            child->detach();
+    }
+
+    reattach();
+
+    for (Node* child = hostNode->firstChild(); child; child = child->nextSibling()) {
+        if (!child->attached())
+            child->attach();
+    }
+}
+
+HTMLContentSelector* ShadowRootList::ensureSelector()
+{
+    if (!m_selector)
+        m_selector = adoptPtr(new HTMLContentSelector());
+    m_selector->willSelectOver(host());
+    return m_selector.get();
+}
+
+} // namespace
diff --git a/Source/WebCore/dom/ShadowRootList.h b/Source/WebCore/dom/ShadowRootList.h
new file mode 100644
index 000000000..db3170a6d
--- /dev/null
+++ b/Source/WebCore/dom/ShadowRootList.h
@@ -0,0 +1,123 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef ShadowRootList_h
+#define ShadowRootList_h
+
+#include "ShadowRoot.h"
+#include <wtf/DoublyLinkedList.h>
+#include <wtf/Noncopyable.h>
+#include <wtf/OwnPtr.h>
+#include <wtf/PassRefPtr.h>
+
+namespace WebCore {
+
+class Node;
+class Element;
+class HTMLContentSelector;
+class InsertionPoint;
+
+class ShadowRootList {
+public:
+    ShadowRootList();
+    ~ShadowRootList();
+
+    bool hasShadowRoot() const;
+    ShadowRoot* youngestShadowRoot() const;
+    ShadowRoot* oldestShadowRoot() const;
+
+    void pushShadowRoot(ShadowRoot*);
+    ShadowRoot* popShadowRoot();
+
+    void insertedIntoDocument();
+    void removedFromDocument();
+    void insertedIntoTree(bool deep);
+    void removedFromTree(bool deep);
+    void willRemove();
+
+    void attach();
+    void detach();
+    void reattach();
+
+    bool childNeedsStyleRecalc();
+    bool needsStyleRecalc();
+    void recalcShadowTreeStyle(Node::StyleChange);
+    void setNeedsReattachHostChildrenAndShadow();
+    void clearNeedsReattachHostChildrenAndShadow();
+    bool needsReattachHostChildrenAndShadow();
+    void reattachHostChildrenAndShadow();
+    void hostChildrenChanged();
+
+    InsertionPoint* insertionPointFor(Node*) const;
+
+    HTMLContentSelector* selector() const;
+    HTMLContentSelector* ensureSelector();
+
+    bool isSelectorActive() const;
+
+private:
+    Element* host() const;
+
+    DoublyLinkedList<ShadowRoot> m_shadowRoots;
+    OwnPtr<HTMLContentSelector> m_selector;
+    bool m_needsRecalculateContent : 1;
+    WTF_MAKE_NONCOPYABLE(ShadowRootList);
+};
+
+inline bool ShadowRootList::hasShadowRoot() const
+{
+    return !m_shadowRoots.isEmpty();
+}
+
+inline ShadowRoot* ShadowRootList::youngestShadowRoot() const
+{
+    return m_shadowRoots.head();
+}
+
+inline ShadowRoot* ShadowRootList::oldestShadowRoot() const
+{
+    return m_shadowRoots.tail();
+}
+
+inline HTMLContentSelector* ShadowRootList::selector() const
+{
+    return m_selector.get();
+}
+
+inline void ShadowRootList::clearNeedsReattachHostChildrenAndShadow()
+{
+    m_needsRecalculateContent = false;
+}
+
+inline Element* ShadowRootList::host() const
+{
+    ASSERT(hasShadowRoot());
+    return youngestShadowRoot()->host();
+}
+
+} // namespace
+
+#endif
diff --git a/Source/WebCore/dom/StaticHashSetNodeList.cpp b/Source/WebCore/dom/StaticHashSetNodeList.cpp
index 6c8c2db97..3d6b5c38f 100644
--- a/Source/WebCore/dom/StaticHashSetNodeList.cpp
+++ b/Source/WebCore/dom/StaticHashSetNodeList.cpp
@@ -69,7 +69,7 @@ Node* StaticHashSetNodeList::itemWithName(const AtomicString& elementId) const
     ListHashSet<RefPtr<Node> >::const_iterator end = m_nodes.end();
     for ( ; it != end ; ++it) {
         Node* node = (*it).get();
-        if (node->hasID() && static_cast<Element*>(node)->getIdAttribute() == elementId)
+        if (static_cast<Element*>(node)->getIdAttribute() == elementId)
             return node;
     }
 
diff --git a/Source/WebCore/dom/StaticNodeList.cpp b/Source/WebCore/dom/StaticNodeList.cpp
index 0a19a0582..fe1d1cbe4 100644
--- a/Source/WebCore/dom/StaticNodeList.cpp
+++ b/Source/WebCore/dom/StaticNodeList.cpp
@@ -50,8 +50,7 @@ Node* StaticNodeList::itemWithName(const AtomicString& elementId) const
     size_t length = m_nodes.size();
     for (size_t i = 0; i < length; ++i) {
         Node* node = m_nodes[i].get();
-        // FIXME: This should probably be using getIdAttribute instead of idForStyleResolution.
-        if (node->hasID() && static_cast<Element*>(node)->getIdAttribute() == elementId)
+        if (static_cast<Element*>(node)->getIdAttribute() == elementId)
             return node;
     }
 
diff --git a/Source/WebCore/dom/StyledElement.cpp b/Source/WebCore/dom/StyledElement.cpp
index 526052647..99e7f3523 100644
--- a/Source/WebCore/dom/StyledElement.cpp
+++ b/Source/WebCore/dom/StyledElement.cpp
@@ -66,6 +66,11 @@ void StyledElement::attributeChanged(Attribute* attr)
     if (!(attr->name() == styleAttr && isSynchronizingStyleAttribute()))
         parseAttribute(attr);
 
+    if (isPresentationAttribute(attr)) {
+        setAttributeStyleDirty();
+        setNeedsStyleRecalc(InlineStyleChange);
+    }
+
     Element::attributeChanged(attr);
 }
 
@@ -79,7 +84,6 @@ void StyledElement::classAttributeChanged(const AtomicString& newClassString)
             break;
     }
     bool hasClass = i < length;
-    setHasClass(hasClass);
     if (hasClass) {
         const bool shouldFoldCase = document()->inQuirksMode();
         ensureAttributeData()->setClass(newClassString, shouldFoldCase);
@@ -88,7 +92,6 @@ void StyledElement::classAttributeChanged(const AtomicString& newClassString)
     } else if (attributeData())
         attributeData()->clearClass();
     setNeedsStyleRecalc();
-    dispatchSubtreeModifiedEvent();
 }
 
 void StyledElement::parseAttribute(Attribute* attr)
@@ -99,198 +102,81 @@ void StyledElement::parseAttribute(Attribute* attr)
         if (attr->isNull())
             destroyInlineStyleDecl();
         else if (document()->contentSecurityPolicy()->allowInlineStyle())
-            ensureInlineStyleDecl()->parseDeclaration(attr->value());
+            ensureInlineStyleDecl()->parseDeclaration(attr->value(), document()->elementSheet());
         setIsStyleAttributeValid();
         setNeedsStyleRecalc();
+        InspectorInstrumentation::didInvalidateStyleAttr(document(), this);
     }
 }
 
-void StyledElement::removeCSSProperties(int id1, int id2, int id3, int id4, int id5, int id6, int id7, int id8)
+void StyledElement::inlineStyleChanged()
 {
-    StylePropertySet* style = attributeStyle();
-    if (!style)
-        return;
-
-    ASSERT(id1 != CSSPropertyInvalid);
-    style->removeProperty(id1);
-
-    if (id2 == CSSPropertyInvalid)
-        return;
-    style->removeProperty(id2);
-    if (id3 == CSSPropertyInvalid)
-        return;
-    style->removeProperty(id3);
-    if (id4 == CSSPropertyInvalid)
-        return;
-    style->removeProperty(id4);
-    if (id5 == CSSPropertyInvalid)
-        return;
-    style->removeProperty(id5);
-    if (id6 == CSSPropertyInvalid)
-        return;
-    style->removeProperty(id6);
-    if (id7 == CSSPropertyInvalid)
-        return;
-    style->removeProperty(id7);
-    if (id8 == CSSPropertyInvalid)
-        return;
-    style->removeProperty(id8);
+    setNeedsStyleRecalc(InlineStyleChange);
+    setIsStyleAttributeValid(false);
+    InspectorInstrumentation::didInvalidateStyleAttr(document(), this);
 }
-
-void StyledElement::addCSSProperty(int id, const String &value)
+    
+bool StyledElement::setInlineStyleProperty(int propertyID, int identifier, bool important)
 {
-    if (!ensureAttributeStyle()->setProperty(id, value))
-        removeCSSProperty(id);
+    ensureInlineStyleDecl()->setProperty(propertyID, document()->cssValuePool()->createIdentifierValue(identifier), important);
+    inlineStyleChanged();
+    return true;
 }
 
-void StyledElement::addCSSProperty(int propertyID, int identifier)
+bool StyledElement::setInlineStyleProperty(int propertyID, double value, CSSPrimitiveValue::UnitTypes unit, bool important)
 {
-    ensureAttributeStyle()->setProperty(CSSProperty(propertyID, document()->cssValuePool()->createIdentifierValue(identifier)));
-    setNeedsStyleRecalc();
+    ensureInlineStyleDecl()->setProperty(propertyID, document()->cssValuePool()->createValue(value, unit), important);
+    inlineStyleChanged();
+    return true;
 }
 
-void StyledElement::addCSSImageProperty(int id, const String& url)
+bool StyledElement::setInlineStyleProperty(int propertyID, const String& value, bool important)
 {
-    ensureAttributeStyle()->setProperty(CSSProperty(id, CSSImageValue::create(url)));
-    setNeedsStyleRecalc();
+    bool changes = ensureInlineStyleDecl()->setProperty(propertyID, value, important, document()->elementSheet());
+    if (changes)
+        inlineStyleChanged();
+    return changes;
 }
 
-void StyledElement::addCSSLength(int id, const String &value)
+bool StyledElement::removeInlineStyleProperty(int propertyID)
 {
-    // FIXME: This function should not spin up the CSS parser, but should instead just figure out the correct
-    // length unit and make the appropriate parsed value.
-
-    // strip attribute garbage..
-    StringImpl* v = value.impl();
-    if (v) {
-        unsigned int l = 0;
-        
-        while (l < v->length() && (*v)[l] <= ' ')
-            l++;
-        
-        for (; l < v->length(); l++) {
-            UChar cc = (*v)[l];
-            if (cc > '9')
-                break;
-            if (cc < '0') {
-                if (cc == '%' || cc == '*')
-                    l++;
-                if (cc != '.')
-                    break;
-            }
-        }
-
-        if (l != v->length()) {
-            addCSSProperty(id, v->substring(0, l));
-            return;
-        }
-    }
-
-    addCSSProperty(id, value);
+    bool changes = ensureInlineStyleDecl()->removeProperty(propertyID);
+    if (changes)
+        inlineStyleChanged();
+    return changes;
 }
 
-static String parseColorStringWithCrazyLegacyRules(const String& colorString)
+void StyledElement::addSubresourceAttributeURLs(ListHashSet<KURL>& urls) const
 {
-    // Per spec, only look at the first 128 digits of the string.
-    const size_t maxColorLength = 128;
-    // We'll pad the buffer with two extra 0s later, so reserve two more than the max.
-    Vector<char, maxColorLength+2> digitBuffer;
-    
-    size_t i = 0;
-    // Skip a leading #.
-    if (colorString[0] == '#')
-        i = 1;
-    
-    // Grab the first 128 characters, replacing non-hex characters with 0.
-    // Non-BMP characters are replaced with "00" due to them appearing as two "characters" in the String.
-    for (; i < colorString.length() && digitBuffer.size() < maxColorLength; i++) {
-        if (!isASCIIHexDigit(colorString[i]))
-            digitBuffer.append('0');
-        else
-            digitBuffer.append(colorString[i]);
-    }
-
-    if (!digitBuffer.size())
-        return "#000000";
-
-    // Pad the buffer out to at least the next multiple of three in size.
-    digitBuffer.append('0');
-    digitBuffer.append('0');
-
-    if (digitBuffer.size() < 6)
-        return String::format("#0%c0%c0%c", digitBuffer[0], digitBuffer[1], digitBuffer[2]);
-    
-    // Split the digits into three components, then search the last 8 digits of each component.
-    ASSERT(digitBuffer.size() >= 6);
-    size_t componentLength = digitBuffer.size() / 3;
-    size_t componentSearchWindowLength = min<size_t>(componentLength, 8);
-    size_t redIndex = componentLength - componentSearchWindowLength;
-    size_t greenIndex = componentLength * 2 - componentSearchWindowLength;
-    size_t blueIndex = componentLength * 3 - componentSearchWindowLength;
-    // Skip digits until one of them is non-zero, or we've only got two digits left in the component.
-    while (digitBuffer[redIndex] == '0' && digitBuffer[greenIndex] == '0' && digitBuffer[blueIndex] == '0' && (componentLength - redIndex) > 2) {
-        redIndex++;
-        greenIndex++;
-        blueIndex++;
-    }
-    ASSERT(redIndex + 1 < componentLength);
-    ASSERT(greenIndex >= componentLength);
-    ASSERT(greenIndex + 1 < componentLength * 2);
-    ASSERT(blueIndex >= componentLength * 2);
-    ASSERT(blueIndex + 1 < digitBuffer.size());
-    return String::format("#%c%c%c%c%c%c", digitBuffer[redIndex], digitBuffer[redIndex + 1], digitBuffer[greenIndex], digitBuffer[greenIndex + 1], digitBuffer[blueIndex], digitBuffer[blueIndex + 1]);   
+    if (StylePropertySet* inlineStyle = inlineStyleDecl())
+        inlineStyle->addSubresourceStyleURLs(urls, document()->elementSheet());
 }
 
-// Color parsing that matches HTML's "rules for parsing a legacy color value"
-void StyledElement::addCSSColor(int id, const String& attributeValue)
+void StyledElement::updateAttributeStyle()
 {
-    // An empty string doesn't apply a color. (One containing only whitespace does, which is why this check occurs before stripping.)
-    if (attributeValue.isEmpty()) {
-        removeCSSProperty(id);
-        return;
-    }
-
-    String colorString = attributeValue.stripWhiteSpace();
-
-    // "transparent" doesn't apply a color either.
-    if (equalIgnoringCase(colorString, "transparent")) {
-        removeCSSProperty(id);
-        return;
+    RefPtr<StylePropertySet> style = StylePropertySet::create();
+    for (unsigned i = 0; i < attributeCount(); ++i) {
+        Attribute* attribute = attributeItem(i);
+        collectStyleForAttribute(attribute, style.get());
     }
+    clearAttributeStyleDirty();
 
-    // If the string is a named CSS color or a 3/6-digit hex color, use that.
-    Color parsedColor(colorString);
-    if (parsedColor.isValid()) {
-        addCSSProperty(id, colorString);
-        return;
+    if (style->isEmpty())
+        attributeData()->setAttributeStyle(0);
+    else {
+        style->shrinkToFit();
+        attributeData()->setAttributeStyle(style.release());
     }
-
-    addCSSProperty(id, parseColorStringWithCrazyLegacyRules(colorString));
 }
 
-void StyledElement::copyNonAttributeProperties(const Element* sourceElement)
+void StyledElement::addPropertyToAttributeStyle(StylePropertySet* style, int propertyID, int identifier)
 {
-    ASSERT(sourceElement);
-    ASSERT(sourceElement->isStyledElement());
-
-    const StyledElement* source = static_cast<const StyledElement*>(sourceElement);
-    if (!source->inlineStyleDecl())
-        return;
-
-    StylePropertySet* inlineStyle = ensureInlineStyleDecl();
-    inlineStyle->copyPropertiesFrom(*source->inlineStyleDecl());
-    inlineStyle->setStrictParsing(source->inlineStyleDecl()->useStrictParsing());
-
-    setIsStyleAttributeValid(source->isStyleAttributeValid());
-    setIsSynchronizingStyleAttribute(source->isSynchronizingStyleAttribute());
-    
-    Element::copyNonAttributeProperties(sourceElement);
+    style->setProperty(propertyID, document()->cssValuePool()->createIdentifierValue(identifier));
 }
 
-void StyledElement::addSubresourceAttributeURLs(ListHashSet<KURL>& urls) const
+void StyledElement::addPropertyToAttributeStyle(StylePropertySet* style, int propertyID, double value, CSSPrimitiveValue::UnitTypes unit)
 {
-    if (StylePropertySet* inlineStyle = inlineStyleDecl())
-        inlineStyle->addSubresourceStyleURLs(urls);
+    style->setProperty(propertyID, document()->cssValuePool()->createValue(value, unit));
 }
 
 }
diff --git a/Source/WebCore/dom/StyledElement.h b/Source/WebCore/dom/StyledElement.h
index 2a6d392cf..2773e41c3 100644
--- a/Source/WebCore/dom/StyledElement.h
+++ b/Source/WebCore/dom/StyledElement.h
@@ -36,23 +36,21 @@ class StyledElement : public Element {
 public:
     virtual ~StyledElement();
 
-    void addCSSLength(int id, const String& value);
-    void addCSSProperty(int id, const String& value);
-    void addCSSProperty(int id, int value);
-    void addCSSImageProperty(int propertyID, const String& url);
-    void addCSSColor(int id, const String& color);
-    void removeCSSProperties(int id1, int id2 = CSSPropertyInvalid, int id3 = CSSPropertyInvalid, int id4 = CSSPropertyInvalid, int id5 = CSSPropertyInvalid, int id6 = CSSPropertyInvalid, int id7 = CSSPropertyInvalid, int id8 = CSSPropertyInvalid);
-    void removeCSSProperty(int id) { removeCSSProperties(id); }
-
     virtual StylePropertySet* additionalAttributeStyle() { return 0; }
     void invalidateStyleAttribute();
 
     StylePropertySet* inlineStyleDecl() const { return attributeData() ? attributeData()->inlineStyleDecl() : 0; }
-    StylePropertySet* ensureInlineStyleDecl() { return ensureAttributeDataWithoutUpdate()->ensureInlineStyleDecl(this); }
-    virtual CSSStyleDeclaration* style() OVERRIDE { return ensureInlineStyleDecl()->ensureCSSStyleDeclaration(); }
-
-    StylePropertySet* attributeStyle() const { return attributeData() ? attributeData()->attributeStyle() : 0; }
-    StylePropertySet* ensureAttributeStyle() { return ensureAttributeDataWithoutUpdate()->ensureAttributeStyle(this); }
+    StylePropertySet* ensureInlineStyleDecl() { return ensureAttributeData()->ensureInlineStyleDecl(this); }
+    
+    // Unlike StylePropertySet setters, these implement invalidation.
+    bool setInlineStyleProperty(int propertyID, int identifier, bool important = false);
+    bool setInlineStyleProperty(int propertyID, double value, CSSPrimitiveValue::UnitTypes, bool important = false);
+    bool setInlineStyleProperty(int propertyID, const String& value, bool important = false);
+    bool removeInlineStyleProperty(int propertyID);
+    
+    virtual CSSStyleDeclaration* style() OVERRIDE { return ensureInlineStyleDecl()->ensureInlineCSSStyleDeclaration(this); }
+
+    StylePropertySet* attributeStyle();
 
     const SpaceSplitString& classNames() const;
 
@@ -66,6 +64,13 @@ protected:
     virtual void parseAttribute(Attribute*);
     virtual void copyNonAttributeProperties(const Element*);
 
+    virtual bool isPresentationAttribute(Attribute*) const { return false; }
+    virtual void collectStyleForAttribute(Attribute*, StylePropertySet*) { }
+
+    void addPropertyToAttributeStyle(StylePropertySet*, int propertyID, int identifier);
+    void addPropertyToAttributeStyle(StylePropertySet*, int propertyID, double value, CSSPrimitiveValue::UnitTypes);
+    void addPropertyToAttributeStyle(StylePropertySet*, int propertyID, const String& value);
+
     virtual void addSubresourceAttributeURLs(ListHashSet<KURL>&) const;
 
     // classAttributeChanged() exists to share code between
@@ -75,11 +80,14 @@ protected:
 
 private:
     virtual void updateStyleAttribute() const;
+    void inlineStyleChanged();
+
+    void updateAttributeStyle();
 
     void destroyInlineStyleDecl()
     {
         if (attributeData())
-            attributeData()->destroyInlineStyleDecl();
+            attributeData()->destroyInlineStyleDecl(this);
     }
 };
 
@@ -95,6 +103,18 @@ inline void StyledElement::invalidateStyleAttribute()
     clearIsStyleAttributeValid();
 }
 
+inline StylePropertySet* StyledElement::attributeStyle()
+{
+    if (attributeStyleDirty())
+        updateAttributeStyle();
+    return attributeData() ? attributeData()->attributeStyle() : 0;
+}
+
+inline void StyledElement::addPropertyToAttributeStyle(StylePropertySet* style, int propertyID, const String& value)
+{
+    style->setProperty(propertyID, value, false, document()->elementSheet());
+}
+
 } //namespace
 
 #endif
diff --git a/Source/WebCore/dom/Text.h b/Source/WebCore/dom/Text.h
index 7629b7dab..deb18a5ea 100644
--- a/Source/WebCore/dom/Text.h
+++ b/Source/WebCore/dom/Text.h
@@ -70,6 +70,12 @@ private:
 #endif
 };
 
+inline Text* toText(Node* node)
+{
+    ASSERT(!node || node->isTextNode());
+    return static_cast<Text*>(node);
+}
+
 } // namespace WebCore
 
 #endif // Text_h
diff --git a/Source/WebCore/dom/Text.idl b/Source/WebCore/dom/Text.idl
index d781677f5..4736e22fe 100644
--- a/Source/WebCore/dom/Text.idl
+++ b/Source/WebCore/dom/Text.idl
@@ -23,12 +23,12 @@ module core {
 
         // DOM Level 1
 
-        Text splitText(in [IsIndex,Optional=CallWithDefaultValue] unsigned long offset)
+        Text splitText(in [IsIndex,Optional=DefaultIsUndefined] unsigned long offset)
             raises (DOMException);
 
         // Introduced in DOM Level 3:
         readonly attribute DOMString       wholeText;
-        Text               replaceWholeText(in [Optional=CallWithDefaultValue] DOMString content)
+        Text               replaceWholeText(in [Optional=DefaultIsUndefined] DOMString content)
                                             raises(DOMException);
     };
 
diff --git a/Source/WebCore/dom/TextEvent.idl b/Source/WebCore/dom/TextEvent.idl
index 2421b65ad..36f507c06 100644
--- a/Source/WebCore/dom/TextEvent.idl
+++ b/Source/WebCore/dom/TextEvent.idl
@@ -30,11 +30,11 @@ module events {
 
         readonly attribute DOMString data;
 
-        void initTextEvent(in [Optional=CallWithDefaultValue] DOMString typeArg, 
-                           in [Optional=CallWithDefaultValue] boolean canBubbleArg, 
-                           in [Optional=CallWithDefaultValue] boolean cancelableArg, 
-                           in [Optional=CallWithDefaultValue] DOMWindow viewArg, 
-                           in [Optional=CallWithDefaultValue] DOMString dataArg);
+        void initTextEvent(in [Optional=DefaultIsUndefined] DOMString typeArg, 
+                           in [Optional=DefaultIsUndefined] boolean canBubbleArg, 
+                           in [Optional=DefaultIsUndefined] boolean cancelableArg, 
+                           in [Optional=DefaultIsUndefined] DOMWindow viewArg, 
+                           in [Optional=DefaultIsUndefined] DOMString dataArg);
 
     };
 
diff --git a/Source/WebCore/dom/TouchEvent.idl b/Source/WebCore/dom/TouchEvent.idl
index 39edfc87e..4b79757f5 100644
--- a/Source/WebCore/dom/TouchEvent.idl
+++ b/Source/WebCore/dom/TouchEvent.idl
@@ -36,18 +36,18 @@ module events {
         readonly attribute boolean altKey;
         readonly attribute boolean metaKey;
 
-        void initTouchEvent(in [Optional=CallWithDefaultValue] TouchList touches,
-                            in [Optional=CallWithDefaultValue] TouchList targetTouches,
-                            in [Optional=CallWithDefaultValue] TouchList changedTouches,
-                            in [Optional=CallWithDefaultValue] DOMString type,
-                            in [Optional=CallWithDefaultValue] DOMWindow view,
-                            in [Optional=CallWithDefaultValue] long screenX, 
-                            in [Optional=CallWithDefaultValue] long screenY, 
-                            in [Optional=CallWithDefaultValue] long clientX, 
-                            in [Optional=CallWithDefaultValue] long clientY,
-                            in [Optional=CallWithDefaultValue] boolean ctrlKey,
-                            in [Optional=CallWithDefaultValue] boolean altKey,
-                            in [Optional=CallWithDefaultValue] boolean shiftKey,
-                            in [Optional=CallWithDefaultValue] boolean metaKey);
+        void initTouchEvent(in [Optional=DefaultIsUndefined] TouchList touches,
+                            in [Optional=DefaultIsUndefined] TouchList targetTouches,
+                            in [Optional=DefaultIsUndefined] TouchList changedTouches,
+                            in [Optional=DefaultIsUndefined] DOMString type,
+                            in [Optional=DefaultIsUndefined] DOMWindow view,
+                            in [Optional=DefaultIsUndefined] long screenX, 
+                            in [Optional=DefaultIsUndefined] long screenY, 
+                            in [Optional=DefaultIsUndefined] long clientX, 
+                            in [Optional=DefaultIsUndefined] long clientY,
+                            in [Optional=DefaultIsUndefined] boolean ctrlKey,
+                            in [Optional=DefaultIsUndefined] boolean altKey,
+                            in [Optional=DefaultIsUndefined] boolean shiftKey,
+                            in [Optional=DefaultIsUndefined] boolean metaKey);
     };
 }
diff --git a/Source/WebCore/dom/TreeScopeAdopter.cpp b/Source/WebCore/dom/TreeScopeAdopter.cpp
index 727df2f12..e76209cc8 100644
--- a/Source/WebCore/dom/TreeScopeAdopter.cpp
+++ b/Source/WebCore/dom/TreeScopeAdopter.cpp
@@ -28,12 +28,13 @@
 #include "Document.h"
 #include "NodeRareData.h"
 #include "ShadowRoot.h"
+#include "ShadowRootList.h"
 
 namespace WebCore {
 
 static inline ShadowRoot* shadowRootFor(Node* node)
 {
-    return node->isElementNode() ? toElement(node)->shadowRoot() : 0;
+    return node->isElementNode() && toElement(node)->hasShadowRoot() ? toElement(node)->shadowRootList()->youngestShadowRoot() : 0;
 }
 
 void TreeScopeAdopter::moveTreeToNewScope(Node* root) const
@@ -96,10 +97,8 @@ inline void TreeScopeAdopter::moveNodeToNewDocument(Node* node, Document* oldDoc
     ASSERT(!node->inDocument() || oldDocument != newDocument);
 
     newDocument->guardRef();
-    if (oldDocument) {
+    if (oldDocument)
         oldDocument->moveNodeIteratorsToNewDocument(node, newDocument);
-        oldDocument->guardDeref();
-    }
 
     node->setDocument(newDocument);
 
@@ -110,6 +109,9 @@ inline void TreeScopeAdopter::moveNodeToNewDocument(Node* node, Document* oldDoc
 
     node->didMoveToNewDocument(oldDocument);
     ASSERT(didMoveToNewDocumentWasCalled);
+    
+    if (oldDocument)
+        oldDocument->guardDeref();
 }
 
 }
diff --git a/Source/WebCore/dom/UIEvent.idl b/Source/WebCore/dom/UIEvent.idl
index 83dcdc95a..39a2caf83 100644
--- a/Source/WebCore/dom/UIEvent.idl
+++ b/Source/WebCore/dom/UIEvent.idl
@@ -24,11 +24,11 @@ module events {
         readonly attribute DOMWindow            view;
         readonly attribute long                 detail;
         
-        [ObjCLegacyUnnamedParameters] void initUIEvent(in [Optional=CallWithDefaultValue] DOMString type, 
-                                        in [Optional=CallWithDefaultValue] boolean canBubble, 
-                                        in [Optional=CallWithDefaultValue] boolean cancelable, 
-                                        in [Optional=CallWithDefaultValue] DOMWindow view, 
-                                        in [Optional=CallWithDefaultValue] long detail);
+        [ObjCLegacyUnnamedParameters] void initUIEvent(in [Optional=DefaultIsUndefined] DOMString type, 
+                                        in [Optional=DefaultIsUndefined] boolean canBubble, 
+                                        in [Optional=DefaultIsUndefined] boolean cancelable, 
+                                        in [Optional=DefaultIsUndefined] DOMWindow view, 
+                                        in [Optional=DefaultIsUndefined] long detail);
 
         // extensions
         readonly attribute long                 keyCode;
diff --git a/Source/WebCore/dom/ViewportArguments.cpp b/Source/WebCore/dom/ViewportArguments.cpp
index 636804b97..b5dc48c10 100644
--- a/Source/WebCore/dom/ViewportArguments.cpp
+++ b/Source/WebCore/dom/ViewportArguments.cpp
@@ -212,10 +212,14 @@ static float numericPrefix(const String& keyString, const String& valueString, D
     // and we should check if the valueString prefix was a number.
 
     bool didReadNumber;
-    float value = valueString.toFloat(ok, &didReadNumber);
+    float value;
+    if (valueString.is8Bit())
+        value = WTF::charactersToFloatIgnoringJunk(valueString.characters8(), valueString.length(), ok, &didReadNumber);
+    else
+        value = WTF::charactersToFloatIgnoringJunk(valueString.characters16(), valueString.length(), ok, &didReadNumber);
     if (!*ok) {
         if (!didReadNumber) {
-            ASSERT(!value);
+            ASSERT(isnan(value) || !value);
             reportViewportWarning(document, UnrecognizedViewportArgumentValueError, valueString, keyString);
             return value;
         }
diff --git a/Source/WebCore/dom/WebKitNamedFlow.cpp b/Source/WebCore/dom/WebKitNamedFlow.cpp
index e00263698..bced96576 100644
--- a/Source/WebCore/dom/WebKitNamedFlow.cpp
+++ b/Source/WebCore/dom/WebKitNamedFlow.cpp
@@ -30,9 +30,12 @@
 #include "config.h"
 #include "WebKitNamedFlow.h"
 
+#include "RenderFlowThread.h"
+
 namespace WebCore {
 
-WebKitNamedFlow::WebKitNamedFlow()
+WebKitNamedFlow::WebKitNamedFlow(RenderFlowThread* parentFlowThread)
+: m_parentFlowThread(parentFlowThread)
 {
 }
 
@@ -40,4 +43,10 @@ WebKitNamedFlow::~WebKitNamedFlow()
 {
 }
 
+bool WebKitNamedFlow::overflow() const
+{
+    m_parentFlowThread->document()->updateLayoutIgnorePendingStylesheets();
+    return m_parentFlowThread->overflow();
+}
+
 } // namespace WebCore
diff --git a/Source/WebCore/dom/WebKitNamedFlow.h b/Source/WebCore/dom/WebKitNamedFlow.h
index 276796121..e815f03f4 100644
--- a/Source/WebCore/dom/WebKitNamedFlow.h
+++ b/Source/WebCore/dom/WebKitNamedFlow.h
@@ -35,17 +35,22 @@
 
 namespace WebCore {
 
+class RenderFlowThread;
+
 class WebKitNamedFlow : public RefCounted<WebKitNamedFlow> {
 public:
-    static PassRefPtr<WebKitNamedFlow> create()
+    static PassRefPtr<WebKitNamedFlow> create(RenderFlowThread* parentFlowThread)
     {
-        return adoptRef(new WebKitNamedFlow);
+        return adoptRef(new WebKitNamedFlow(parentFlowThread));
     }
 
     ~WebKitNamedFlow();
 
+    bool overflow() const;
 private:
-    WebKitNamedFlow();
+    WebKitNamedFlow(RenderFlowThread*);
+
+    RenderFlowThread* m_parentFlowThread;
 };
 
 }
diff --git a/Source/WebCore/dom/WebKitNamedFlow.idl b/Source/WebCore/dom/WebKitNamedFlow.idl
index 06d85529e..2a065dd17 100644
--- a/Source/WebCore/dom/WebKitNamedFlow.idl
+++ b/Source/WebCore/dom/WebKitNamedFlow.idl
@@ -29,7 +29,8 @@
 
 module core {
     interface [
-        JSGenerateToJS
+        JSGenerateToJSObject
     ] WebKitNamedFlow {
+        readonly attribute boolean overflow;
     };
 }
diff --git a/Source/WebCore/dom/WheelEvent.idl b/Source/WebCore/dom/WheelEvent.idl
index e0fd563ba..0282525fb 100644
--- a/Source/WebCore/dom/WheelEvent.idl
+++ b/Source/WebCore/dom/WheelEvent.idl
@@ -46,31 +46,31 @@ module events {
 #endif /* defined(LANGUAGE_OBJECTIVE_C) */
 
 #if !defined(LANGUAGE_JAVASCRIPT) || !LANGUAGE_JAVASCRIPT
-        void initWheelEvent(in [Optional=CallWithDefaultValue] long wheelDeltaX,
-                            in [Optional=CallWithDefaultValue] long wheelDeltaY, 
-                            in [Optional=CallWithDefaultValue] DOMWindow view, 
-                            in [Optional=CallWithDefaultValue] long screenX,
-                            in [Optional=CallWithDefaultValue] long screenY,
-                            in [Optional=CallWithDefaultValue] long clientX,
-                            in [Optional=CallWithDefaultValue] long clientY,
-                            in [Optional=CallWithDefaultValue] boolean ctrlKey,
-                            in [Optional=CallWithDefaultValue] boolean altKey,
-                            in [Optional=CallWithDefaultValue] boolean shiftKey,
-                            in [Optional=CallWithDefaultValue] boolean metaKey);
+        void initWheelEvent(in [Optional=DefaultIsUndefined] long wheelDeltaX,
+                            in [Optional=DefaultIsUndefined] long wheelDeltaY, 
+                            in [Optional=DefaultIsUndefined] DOMWindow view, 
+                            in [Optional=DefaultIsUndefined] long screenX,
+                            in [Optional=DefaultIsUndefined] long screenY,
+                            in [Optional=DefaultIsUndefined] long clientX,
+                            in [Optional=DefaultIsUndefined] long clientY,
+                            in [Optional=DefaultIsUndefined] boolean ctrlKey,
+                            in [Optional=DefaultIsUndefined] boolean altKey,
+                            in [Optional=DefaultIsUndefined] boolean shiftKey,
+                            in [Optional=DefaultIsUndefined] boolean metaKey);
 #endif /* !defined(LANGUAGE_JAVASCRIPT) */
 
 #if defined(LANGUAGE_JAVASCRIPT) && LANGUAGE_JAVASCRIPT
-        void initWebKitWheelEvent(in [Optional=CallWithDefaultValue] long wheelDeltaX,
-                                  in [Optional=CallWithDefaultValue] long wheelDeltaY, 
-                                  in [Optional=CallWithDefaultValue] DOMWindow view, 
-                                  in [Optional=CallWithDefaultValue] long screenX,
-                                  in [Optional=CallWithDefaultValue] long screenY,
-                                  in [Optional=CallWithDefaultValue] long clientX,
-                                  in [Optional=CallWithDefaultValue] long clientY,
-                                  in [Optional=CallWithDefaultValue] boolean ctrlKey,
-                                  in [Optional=CallWithDefaultValue] boolean altKey,
-                                  in [Optional=CallWithDefaultValue] boolean shiftKey,
-                                  in [Optional=CallWithDefaultValue] boolean metaKey);
+        void initWebKitWheelEvent(in [Optional=DefaultIsUndefined] long wheelDeltaX,
+                                  in [Optional=DefaultIsUndefined] long wheelDeltaY, 
+                                  in [Optional=DefaultIsUndefined] DOMWindow view, 
+                                  in [Optional=DefaultIsUndefined] long screenX,
+                                  in [Optional=DefaultIsUndefined] long screenY,
+                                  in [Optional=DefaultIsUndefined] long clientX,
+                                  in [Optional=DefaultIsUndefined] long clientY,
+                                  in [Optional=DefaultIsUndefined] boolean ctrlKey,
+                                  in [Optional=DefaultIsUndefined] boolean altKey,
+                                  in [Optional=DefaultIsUndefined] boolean shiftKey,
+                                  in [Optional=DefaultIsUndefined] boolean metaKey);
 #endif /* defined(LANGUAGE_JAVASCRIPT) */
     };
 }
diff --git a/Source/WebCore/editing/ApplyBlockElementCommand.cpp b/Source/WebCore/editing/ApplyBlockElementCommand.cpp
index 45fcf27e1..b32641be7 100644
--- a/Source/WebCore/editing/ApplyBlockElementCommand.cpp
+++ b/Source/WebCore/editing/ApplyBlockElementCommand.cpp
@@ -80,10 +80,10 @@ void ApplyBlockElementCommand::doApply()
     VisiblePosition endOfSelection = selection.visibleEnd();
     ASSERT(!startOfSelection.isNull());
     ASSERT(!endOfSelection.isNull());
-    Element* startScope = 0;
-    int startIndex = indexForVisiblePosition(startOfSelection, &startScope);
-    Element* endScope = 0;
-    int endIndex = indexForVisiblePosition(endOfSelection, &endScope);
+    RefPtr<Element> startScope;
+    int startIndex = indexForVisiblePosition(startOfSelection, startScope);
+    RefPtr<Element> endScope;
+    int endIndex = indexForVisiblePosition(endOfSelection, endScope);
 
     formatSelection(startOfSelection, endOfSelection);
 
@@ -93,8 +93,8 @@ void ApplyBlockElementCommand::doApply()
     ASSERT(startIndex >= 0);
     ASSERT(startIndex <= endIndex);
     if (startScope == endScope && startIndex >= 0 && startIndex <= endIndex) {
-        VisiblePosition start(visiblePositionForIndex(startIndex, startScope));
-        VisiblePosition end(visiblePositionForIndex(endIndex, endScope));
+        VisiblePosition start(visiblePositionForIndex(startIndex, startScope.get()));
+        VisiblePosition end(visiblePositionForIndex(endIndex, endScope.get()));
         if (start.isNotNull() && end.isNotNull())
             setEndingSelection(VisibleSelection(start, end, endingSelection().isDirectional()));
     }
@@ -162,7 +162,7 @@ static bool isNewLineAtPosition(const Position& position)
         return false;
 
     ExceptionCode ec = 0;
-    String textAtPosition = static_cast<Text*>(textNode)->substringData(offset, 1, ec);
+    String textAtPosition = toText(textNode)->substringData(offset, 1, ec);
     if (ec)
         return false;
 
@@ -257,18 +257,18 @@ VisiblePosition ApplyBlockElementCommand::endOfNextParagrahSplittingTextNodesIfN
 
     if (text == start.containerNode() && text->previousSibling() && text->previousSibling()->isTextNode()) {
         ASSERT(start.offsetInContainerNode() < position.offsetInContainerNode());
-        start = Position(static_cast<Text*>(text->previousSibling()), start.offsetInContainerNode());
+        start = Position(toText(text->previousSibling()), start.offsetInContainerNode());
     }
     if (text == end.containerNode() && text->previousSibling() && text->previousSibling()->isTextNode()) {
         ASSERT(end.offsetInContainerNode() < position.offsetInContainerNode());
-        end = Position(static_cast<Text*>(text->previousSibling()), end.offsetInContainerNode());
+        end = Position(toText(text->previousSibling()), end.offsetInContainerNode());
     }
     if (text == m_endOfLastParagraph.containerNode()) {
         if (m_endOfLastParagraph.offsetInContainerNode() < position.offsetInContainerNode()) {
             // We can only fix endOfLastParagraph if the previous node was still text and hasn't been modified by script.
             if (text->previousSibling()->isTextNode()
-                && static_cast<unsigned>(m_endOfLastParagraph.offsetInContainerNode()) <= static_cast<Text*>(text->previousSibling())->length())
-                m_endOfLastParagraph = Position(static_cast<Text*>(text->previousSibling()), m_endOfLastParagraph.offsetInContainerNode());
+                && static_cast<unsigned>(m_endOfLastParagraph.offsetInContainerNode()) <= toText(text->previousSibling())->length())
+                m_endOfLastParagraph = Position(toText(text->previousSibling()), m_endOfLastParagraph.offsetInContainerNode());
         } else
             m_endOfLastParagraph = Position(text.get(), m_endOfLastParagraph.offsetInContainerNode() - 1);
     }
diff --git a/Source/WebCore/editing/ApplyStyleCommand.cpp b/Source/WebCore/editing/ApplyStyleCommand.cpp
index 1adde10cf..25444bb7d 100644
--- a/Source/WebCore/editing/ApplyStyleCommand.cpp
+++ b/Source/WebCore/editing/ApplyStyleCommand.cpp
@@ -387,7 +387,7 @@ void ApplyStyleCommand::applyRelativeFontStyleChange(EditingStyle* style)
         float desiredFontSize = max(MinimumFontSize, startingFontSizes.get(node) + style->fontSizeDelta());
         RefPtr<CSSValue> value = inlineStyleDecl->getPropertyCSSValue(CSSPropertyFontSize);
         if (value) {
-            inlineStyleDecl->removeProperty(CSSPropertyFontSize);
+            element->removeInlineStyleProperty(CSSPropertyFontSize);
             currentFontSize = computedFontSize(node);
         }
         if (currentFontSize != desiredFontSize) {
@@ -444,7 +444,7 @@ HTMLElement* ApplyStyleCommand::splitAncestorsWithUnicodeBidi(Node* node, bool b
     Node* nextHighestAncestorWithUnicodeBidi = 0;
     int highestAncestorUnicodeBidi = 0;
     for (Node* n = node->parentNode(); n != block; n = n->parentNode()) {
-        int unicodeBidi = getIdentifierValue(computedStyle(n).get(), CSSPropertyUnicodeBidi);
+        int unicodeBidi = getIdentifierValue(CSSComputedStyleDeclaration::create(n).get(), CSSPropertyUnicodeBidi);
         if (unicodeBidi && unicodeBidi != CSSValueNormal) {
             highestAncestorUnicodeBidi = unicodeBidi;
             nextHighestAncestorWithUnicodeBidi = highestAncestorWithUnicodeBidi;
@@ -496,7 +496,7 @@ void ApplyStyleCommand::removeEmbeddingUpToEnclosingBlock(Node* node, Node* unsp
             continue;
 
         StyledElement* element = static_cast<StyledElement*>(n);
-        int unicodeBidi = getIdentifierValue(computedStyle(element).get(), CSSPropertyUnicodeBidi);
+        int unicodeBidi = getIdentifierValue(CSSComputedStyleDeclaration::create(element).get(), CSSPropertyUnicodeBidi);
         if (!unicodeBidi || unicodeBidi == CSSValueNormal)
             continue;
 
@@ -522,7 +522,7 @@ void ApplyStyleCommand::removeEmbeddingUpToEnclosingBlock(Node* node, Node* unsp
 static Node* highestEmbeddingAncestor(Node* startNode, Node* enclosingNode)
 {
     for (Node* n = startNode; n && n != enclosingNode; n = n->parentNode()) {
-        if (n->isHTMLElement() && getIdentifierValue(computedStyle(n).get(), CSSPropertyUnicodeBidi) == CSSValueEmbed)
+        if (n->isHTMLElement() && getIdentifierValue(CSSComputedStyleDeclaration::create(n).get(), CSSPropertyUnicodeBidi) == CSSValueEmbed)
             return n;
     }
 
@@ -1123,14 +1123,14 @@ void ApplyStyleCommand::splitTextAtEnd(const Position& start, const Position& en
     ASSERT(end.containerNode()->isTextNode());
 
     bool shouldUpdateStart = start.anchorType() == Position::PositionIsOffsetInAnchor && start.containerNode() == end.containerNode();
-    Text* text = static_cast<Text *>(end.deprecatedNode());
+    Text* text = toText(end.deprecatedNode());
     splitTextNode(text, end.offsetInContainerNode());
 
     Node* prevNode = text->previousSibling();
     if (!prevNode || !prevNode->isTextNode())
         return;
 
-    Position newStart = shouldUpdateStart ? Position(static_cast<Text*>(prevNode), start.offsetInContainerNode()) : start;
+    Position newStart = shouldUpdateStart ? Position(toText(prevNode), start.offsetInContainerNode()) : start;
     updateStartEnd(newStart, lastPositionInNode(prevNode));
 }
 
@@ -1162,7 +1162,7 @@ void ApplyStyleCommand::splitTextElementAtEnd(const Position& start, const Posit
     if (!firstTextNode || !firstTextNode->isTextNode())
         return;
 
-    Position newStart = shouldUpdateStart ? Position(static_cast<Text*>(firstTextNode), start.offsetInContainerNode()) : start;
+    Position newStart = shouldUpdateStart ? Position(toText(firstTextNode), start.offsetInContainerNode()) : start;
     updateStartEnd(newStart, positionAfterNode(firstTextNode));
 }
 
@@ -1410,7 +1410,7 @@ float ApplyStyleCommand::computedFontSize(Node* node)
     if (!node)
         return 0;
 
-    RefPtr<CSSComputedStyleDeclaration> style = computedStyle(node);
+    RefPtr<CSSComputedStyleDeclaration> style = CSSComputedStyleDeclaration::create(node);
     if (!style)
         return 0;
 
@@ -1433,8 +1433,8 @@ void ApplyStyleCommand::joinChildTextNodes(Node* node, const Position& start, co
     while (child) {
         Node* next = child->nextSibling();
         if (child->isTextNode() && next && next->isTextNode()) {
-            Text* childText = static_cast<Text *>(child);
-            Text* nextText = static_cast<Text *>(next);
+            Text* childText = toText(child);
+            Text* nextText = toText(next);
             if (start.anchorType() == Position::PositionIsOffsetInAnchor && next == start.containerNode())
                 newStart = Position(childText, childText->length() + start.offsetInContainerNode());
             if (end.anchorType() == Position::PositionIsOffsetInAnchor && next == end.containerNode())
diff --git a/Source/WebCore/editing/BreakBlockquoteCommand.cpp b/Source/WebCore/editing/BreakBlockquoteCommand.cpp
index 76e9159ac..d3639398a 100644
--- a/Source/WebCore/editing/BreakBlockquoteCommand.cpp
+++ b/Source/WebCore/editing/BreakBlockquoteCommand.cpp
@@ -107,7 +107,7 @@ void BreakBlockquoteCommand::doApply()
         
     // Split at pos if in the middle of a text node.
     if (startNode->isTextNode()) {
-        Text* textNode = static_cast<Text*>(startNode);
+        Text* textNode = toText(startNode);
         if ((unsigned)pos.deprecatedEditingOffset() >= textNode->length()) {
             startNode = startNode->traverseNextNode();
             ASSERT(startNode);
diff --git a/Source/WebCore/editing/CompositeEditCommand.cpp b/Source/WebCore/editing/CompositeEditCommand.cpp
index 2a629c3a0..f57657137 100644
--- a/Source/WebCore/editing/CompositeEditCommand.cpp
+++ b/Source/WebCore/editing/CompositeEditCommand.cpp
@@ -356,7 +356,7 @@ void CompositeEditCommand::insertNodeAt(PassRefPtr<Node> insertChild, const Posi
     } else if (caretMinOffset(refChild) >= offset)
         insertNodeBefore(insertChild, refChild);
     else if (refChild->isTextNode() && caretMaxOffset(refChild) > offset) {
-        splitTextNode(static_cast<Text *>(refChild), offset);
+        splitTextNode(toText(refChild), offset);
 
         // Mutation events (bug 22634) from the text node insertion may have removed the refChild
         if (!refChild->inDocument())
@@ -532,7 +532,7 @@ Position CompositeEditCommand::positionOutsideTabSpan(const Position& pos)
     if (pos.offsetInContainerNode() >= caretMaxOffset(pos.containerNode()))
         return positionInParentAfterNode(tabSpan);
 
-    splitTextNodeContainingElement(static_cast<Text *>(pos.containerNode()), pos.offsetInContainerNode());
+    splitTextNodeContainingElement(toText(pos.containerNode()), pos.offsetInContainerNode());
     return positionInParentBeforeNode(tabSpan);
 }
 
@@ -590,7 +590,7 @@ bool CompositeEditCommand::canRebalance(const Position& position) const
     if (position.anchorType() != Position::PositionIsOffsetInAnchor || !node || !node->isTextNode())
         return false;
 
-    Text* textNode = static_cast<Text*>(node);
+    Text* textNode = toText(node);
     if (textNode->length() == 0)
         return false;
 
@@ -610,14 +610,14 @@ void CompositeEditCommand::rebalanceWhitespaceAt(const Position& position)
 
     // If the rebalance is for the single offset, and neither text[offset] nor text[offset - 1] are some form of whitespace, do nothing.
     int offset = position.deprecatedEditingOffset();
-    String text = static_cast<Text*>(node)->data();
+    String text = toText(node)->data();
     if (!isWhitespace(text[offset])) {
         offset--;
         if (offset < 0 || !isWhitespace(text[offset]))
             return;
     }
 
-    rebalanceWhitespaceOnTextSubstring(static_cast<Text*>(node), position.offsetInContainerNode(), position.offsetInContainerNode());
+    rebalanceWhitespaceOnTextSubstring(toText(node), position.offsetInContainerNode(), position.offsetInContainerNode());
 }
 
 void CompositeEditCommand::rebalanceWhitespaceOnTextSubstring(PassRefPtr<Text> prpTextNode, int startOffset, int endOffset)
@@ -659,7 +659,7 @@ void CompositeEditCommand::prepareWhitespaceAtPositionForSplit(Position& positio
     Node* node = position.deprecatedNode();
     if (!node || !node->isTextNode())
         return;
-    Text* textNode = static_cast<Text*>(node);    
+    Text* textNode = toText(node);    
     
     if (textNode->length() == 0)
         return;
@@ -677,9 +677,9 @@ void CompositeEditCommand::prepareWhitespaceAtPositionForSplit(Position& positio
     Position previous(previousVisiblePos.deepEquivalent());
     
     if (isCollapsibleWhitespace(previousVisiblePos.characterAfter()) && previous.deprecatedNode()->isTextNode() && !previous.deprecatedNode()->hasTagName(brTag))
-        replaceTextInNodePreservingMarkers(static_cast<Text*>(previous.deprecatedNode()), previous.deprecatedEditingOffset(), 1, nonBreakingSpaceString());
+        replaceTextInNodePreservingMarkers(toText(previous.deprecatedNode()), previous.deprecatedEditingOffset(), 1, nonBreakingSpaceString());
     if (isCollapsibleWhitespace(visiblePos.characterAfter()) && position.deprecatedNode()->isTextNode() && !position.deprecatedNode()->hasTagName(brTag))
-        replaceTextInNodePreservingMarkers(static_cast<Text*>(position.deprecatedNode()), position.deprecatedEditingOffset(), 1, nonBreakingSpaceString());
+        replaceTextInNodePreservingMarkers(toText(position.deprecatedNode()), position.deprecatedEditingOffset(), 1, nonBreakingSpaceString());
 }
 
 void CompositeEditCommand::rebalanceWhitespace()
@@ -698,6 +698,8 @@ void CompositeEditCommand::deleteInsignificantText(PassRefPtr<Text> textNode, un
     if (!textNode || start >= end)
         return;
 
+    document()->updateLayout();
+
     RenderText* textRenderer = toRenderText(textNode->renderer());
     if (!textRenderer)
         return;
@@ -780,18 +782,20 @@ void CompositeEditCommand::deleteInsignificantText(const Position& start, const
     if (comparePositions(start, end) >= 0)
         return;
 
-    Node* next;
-    for (Node* node = start.deprecatedNode(); node; node = next) {
-        next = node->traverseNextNode();
-        if (node->isTextNode()) {
-            Text* textNode = static_cast<Text*>(node);
-            int startOffset = node == start.deprecatedNode() ? start.deprecatedEditingOffset() : 0;
-            int endOffset = node == end.deprecatedNode() ? end.deprecatedEditingOffset() : static_cast<int>(textNode->length());
-            deleteInsignificantText(textNode, startOffset, endOffset);
-        }
+    Vector<RefPtr<Text> > nodes;
+    for (Node* node = start.deprecatedNode(); node; node = node->traverseNextNode()) {
+        if (node->isTextNode())
+            nodes.append(toText(node));
         if (node == end.deprecatedNode())
             break;
     }
+
+    for (size_t i = 0; i < nodes.size(); ++i) {
+        Text* textNode = nodes[i].get();
+        int startOffset = textNode == start.deprecatedNode() ? start.deprecatedEditingOffset() : 0;
+        int endOffset = textNode == end.deprecatedNode() ? end.deprecatedEditingOffset() : static_cast<int>(textNode->length());
+        deleteInsignificantText(textNode, startOffset, endOffset);
+    }
 }
 
 void CompositeEditCommand::deleteInsignificantTextDownstream(const Position& pos)
@@ -857,7 +861,7 @@ void CompositeEditCommand::removePlaceholderAt(const Position& p)
         return;
     }
     
-    deleteTextFromNode(static_cast<Text*>(p.anchorNode()), p.offsetInContainerNode(), 1);
+    deleteTextFromNode(toText(p.anchorNode()), p.offsetInContainerNode(), 1);
 }
 
 PassRefPtr<Node> CompositeEditCommand::insertNewDefaultParagraphElementAt(const Position& position)
@@ -1033,7 +1037,7 @@ void CompositeEditCommand::cleanupAfterDeletion(VisiblePosition destination)
         else if (lineBreakExistsAtPosition(position)) {
             // There is a preserved '\n' at caretAfterDelete.
             // We can safely assume this is a text node.
-            Text* textNode = static_cast<Text*>(node);
+            Text* textNode = toText(node);
             if (textNode->length() == 1)
                 removeNodeAndPruneAncestors(node);
             else
@@ -1326,7 +1330,7 @@ bool CompositeEditCommand::breakOutOfEmptyMailBlockquotedParagraph()
         removeNodeAndPruneAncestors(caretPos.deprecatedNode());
     else if (caretPos.deprecatedNode()->isTextNode()) {
         ASSERT(caretPos.deprecatedEditingOffset() == 0);
-        Text* textNode = static_cast<Text*>(caretPos.deprecatedNode());
+        Text* textNode = toText(caretPos.deprecatedNode());
         ContainerNode* parentNode = textNode->parentNode();
         // The preserved newline must be the first thing in the node, since otherwise the previous
         // paragraph would be quoted, and we verified that it wasn't above.
diff --git a/Source/WebCore/editing/DeleteButtonController.cpp b/Source/WebCore/editing/DeleteButtonController.cpp
index 2a3005ea6..e8b05eca5 100644
--- a/Source/WebCore/editing/DeleteButtonController.cpp
+++ b/Source/WebCore/editing/DeleteButtonController.cpp
@@ -205,17 +205,16 @@ void DeleteButtonController::createDeletionUI()
     RefPtr<HTMLDivElement> container = HTMLDivElement::create(m_target->document());
     container->setIdAttribute(containerElementIdentifier);
 
-    StylePropertySet* style = container->ensureInlineStyleDecl();
-    style->setProperty(CSSPropertyWebkitUserDrag, CSSValueNone);
-    style->setProperty(CSSPropertyWebkitUserSelect, CSSValueNone);
-    style->setProperty(CSSPropertyWebkitUserModify, CSSValueReadOnly);
-    style->setProperty(CSSPropertyVisibility, CSSValueHidden);
-    style->setProperty(CSSPropertyPosition, CSSValueAbsolute);
-    style->setProperty(CSSPropertyCursor, CSSValueDefault);
-    style->setProperty(CSSPropertyTop, "0");
-    style->setProperty(CSSPropertyRight, "0");
-    style->setProperty(CSSPropertyBottom, "0");
-    style->setProperty(CSSPropertyLeft, "0");
+    container->setInlineStyleProperty(CSSPropertyWebkitUserDrag, CSSValueNone);
+    container->setInlineStyleProperty(CSSPropertyWebkitUserSelect, CSSValueNone);
+    container->setInlineStyleProperty(CSSPropertyWebkitUserModify, CSSValueReadOnly);
+    container->setInlineStyleProperty(CSSPropertyVisibility, CSSValueHidden);
+    container->setInlineStyleProperty(CSSPropertyPosition, CSSValueAbsolute);
+    container->setInlineStyleProperty(CSSPropertyCursor, CSSValueDefault);
+    container->setInlineStyleProperty(CSSPropertyTop, "0");
+    container->setInlineStyleProperty(CSSPropertyRight, "0");
+    container->setInlineStyleProperty(CSSPropertyBottom, "0");
+    container->setInlineStyleProperty(CSSPropertyLeft, "0");
 
     RefPtr<HTMLDivElement> outline = HTMLDivElement::create(m_target->document());
     outline->setIdAttribute(outlineElementIdentifier);
@@ -223,16 +222,15 @@ void DeleteButtonController::createDeletionUI()
     const int borderWidth = 4;
     const int borderRadius = 6;
 
-    style = outline->ensureInlineStyleDecl();
-    style->setProperty(CSSPropertyPosition, CSSValueAbsolute);
-    style->setProperty(CSSPropertyZIndex, String::number(-1000000));
-    style->setProperty(CSSPropertyTop, String::number(-borderWidth - m_target->renderBox()->borderTop()) + "px");
-    style->setProperty(CSSPropertyRight, String::number(-borderWidth - m_target->renderBox()->borderRight()) + "px");
-    style->setProperty(CSSPropertyBottom, String::number(-borderWidth - m_target->renderBox()->borderBottom()) + "px");
-    style->setProperty(CSSPropertyLeft, String::number(-borderWidth - m_target->renderBox()->borderLeft()) + "px");
-    style->setProperty(CSSPropertyBorder, String::number(borderWidth) + "px solid rgba(0, 0, 0, 0.6)");
-    style->setProperty(CSSPropertyWebkitBorderRadius, String::number(borderRadius) + "px");
-    style->setProperty(CSSPropertyVisibility, CSSValueVisible);
+    outline->setInlineStyleProperty(CSSPropertyPosition, CSSValueAbsolute);
+    outline->setInlineStyleProperty(CSSPropertyZIndex, String::number(-1000000));
+    outline->setInlineStyleProperty(CSSPropertyTop, String::number(-borderWidth - m_target->renderBox()->borderTop()) + "px");
+    outline->setInlineStyleProperty(CSSPropertyRight, String::number(-borderWidth - m_target->renderBox()->borderRight()) + "px");
+    outline->setInlineStyleProperty(CSSPropertyBottom, String::number(-borderWidth - m_target->renderBox()->borderBottom()) + "px");
+    outline->setInlineStyleProperty(CSSPropertyLeft, String::number(-borderWidth - m_target->renderBox()->borderLeft()) + "px");
+    outline->setInlineStyleProperty(CSSPropertyBorder, String::number(borderWidth) + "px solid rgba(0, 0, 0, 0.6)");
+    outline->setInlineStyleProperty(CSSPropertyWebkitBorderRadius, String::number(borderRadius) + "px");
+    outline->setInlineStyleProperty(CSSPropertyVisibility, CSSValueVisible);
 
     ExceptionCode ec = 0;
     container->appendChild(outline.get(), ec);
@@ -247,14 +245,13 @@ void DeleteButtonController::createDeletionUI()
     const int buttonHeight = 30;
     const int buttonBottomShadowOffset = 2;
 
-    style = button->ensureInlineStyleDecl();
-    style->setProperty(CSSPropertyPosition, CSSValueAbsolute);
-    style->setProperty(CSSPropertyZIndex, String::number(1000000));
-    style->setProperty(CSSPropertyTop, String::number((-buttonHeight / 2) - m_target->renderBox()->borderTop() - (borderWidth / 2) + buttonBottomShadowOffset) + "px");
-    style->setProperty(CSSPropertyLeft, String::number((-buttonWidth / 2) - m_target->renderBox()->borderLeft() - (borderWidth / 2)) + "px");
-    style->setProperty(CSSPropertyWidth, String::number(buttonWidth) + "px");
-    style->setProperty(CSSPropertyHeight, String::number(buttonHeight) + "px");
-    style->setProperty(CSSPropertyVisibility, CSSValueVisible);
+    button->setInlineStyleProperty(CSSPropertyPosition, CSSValueAbsolute);
+    button->setInlineStyleProperty(CSSPropertyZIndex, String::number(1000000));
+    button->setInlineStyleProperty(CSSPropertyTop, String::number((-buttonHeight / 2) - m_target->renderBox()->borderTop() - (borderWidth / 2) + buttonBottomShadowOffset) + "px");
+    button->setInlineStyleProperty(CSSPropertyLeft, String::number((-buttonWidth / 2) - m_target->renderBox()->borderLeft() - (borderWidth / 2)) + "px");
+    button->setInlineStyleProperty(CSSPropertyWidth, String::number(buttonWidth) + "px");
+    button->setInlineStyleProperty(CSSPropertyHeight, String::number(buttonHeight) + "px");
+    button->setInlineStyleProperty(CSSPropertyVisibility, CSSValueVisible);
 
     float deviceScaleFactor = WebCore::deviceScaleFactor(m_frame);
     RefPtr<Image> buttonImage;
@@ -310,12 +307,12 @@ void DeleteButtonController::show(HTMLElement* element)
     }
 
     if (m_target->renderer()->style()->position() == StaticPosition) {
-        m_target->ensureInlineStyleDecl()->setProperty(CSSPropertyPosition, CSSValueRelative);
+        m_target->setInlineStyleProperty(CSSPropertyPosition, CSSValueRelative);
         m_wasStaticPositioned = true;
     }
 
     if (m_target->renderer()->style()->hasAutoZIndex()) {
-        m_target->ensureInlineStyleDecl()->setProperty(CSSPropertyZIndex, "0");
+        m_target->setInlineStyleProperty(CSSPropertyZIndex, "0");
         m_wasAutoZIndex = true;
     }
 }
@@ -331,9 +328,9 @@ void DeleteButtonController::hide()
 
     if (m_target) {
         if (m_wasStaticPositioned)
-            m_target->ensureInlineStyleDecl()->setProperty(CSSPropertyPosition, CSSValueStatic);
+            m_target->setInlineStyleProperty(CSSPropertyPosition, CSSValueStatic);
         if (m_wasAutoZIndex)
-            m_target->ensureInlineStyleDecl()->setProperty(CSSPropertyZIndex, CSSValueAuto);
+            m_target->setInlineStyleProperty(CSSPropertyZIndex, CSSValueAuto);
     }
 
     m_wasStaticPositioned = false;
diff --git a/Source/WebCore/editing/DeleteSelectionCommand.cpp b/Source/WebCore/editing/DeleteSelectionCommand.cpp
index 839b73420..9a94509ce 100644
--- a/Source/WebCore/editing/DeleteSelectionCommand.cpp
+++ b/Source/WebCore/editing/DeleteSelectionCommand.cpp
@@ -423,7 +423,7 @@ void DeleteSelectionCommand::handleGeneralDelete()
     }
 
     if (startOffset >= caretMaxOffset(startNode) && startNode->isTextNode()) {
-        Text *text = static_cast<Text *>(startNode);
+        Text* text = toText(startNode);
         if (text->length() > (unsigned)caretMaxOffset(startNode))
             deleteTextFromNode(text, caretMaxOffset(startNode), text->length() - caretMaxOffset(startNode));
     }
@@ -441,7 +441,7 @@ void DeleteSelectionCommand::handleGeneralDelete()
         if (m_downstreamEnd.deprecatedEditingOffset() - startOffset > 0) {
             if (startNode->isTextNode()) {
                 // in a text node that needs to be trimmed
-                Text* text = static_cast<Text*>(startNode);
+                Text* text = toText(startNode);
                 deleteTextFromNode(text, startOffset, m_downstreamEnd.deprecatedEditingOffset() - startOffset);
             } else {
                 removeChildrenInRange(startNode, startOffset, m_downstreamEnd.deprecatedEditingOffset());
@@ -461,14 +461,14 @@ void DeleteSelectionCommand::handleGeneralDelete()
         if (startOffset > 0) {
             if (startNode->isTextNode()) {
                 // in a text node that needs to be trimmed
-                Text *text = static_cast<Text *>(node.get());
+                Text* text = toText(node.get());
                 deleteTextFromNode(text, startOffset, text->length() - startOffset);
                 node = node->traverseNextNode();
             } else {
                 node = startNode->childNode(startOffset);
             }
         } else if (startNode == m_upstreamEnd.deprecatedNode() && startNode->isTextNode()) {
-            Text* text = static_cast<Text*>(m_upstreamEnd.deprecatedNode());
+            Text* text = toText(m_upstreamEnd.deprecatedNode());
             deleteTextFromNode(text, 0, m_upstreamEnd.deprecatedEditingOffset());
         }
         
@@ -501,7 +501,7 @@ void DeleteSelectionCommand::handleGeneralDelete()
             } else {
                 if (m_downstreamEnd.deprecatedNode()->isTextNode()) {
                     // in a text node that needs to be trimmed
-                    Text* text = static_cast<Text*>(m_downstreamEnd.deprecatedNode());
+                    Text* text = toText(m_downstreamEnd.deprecatedNode());
                     if (m_downstreamEnd.deprecatedEditingOffset() > 0) {
                         deleteTextFromNode(text, 0, m_downstreamEnd.deprecatedEditingOffset());
                     }
@@ -533,12 +533,12 @@ void DeleteSelectionCommand::fixupWhitespace()
     document()->updateLayoutIgnorePendingStylesheets();
     // FIXME: isRenderedCharacter should be removed, and we should use VisiblePosition::characterAfter and VisiblePosition::characterBefore
     if (m_leadingWhitespace.isNotNull() && !m_leadingWhitespace.isRenderedCharacter() && m_leadingWhitespace.deprecatedNode()->isTextNode()) {
-        Text* textNode = static_cast<Text*>(m_leadingWhitespace.deprecatedNode());
+        Text* textNode = toText(m_leadingWhitespace.deprecatedNode());
         ASSERT(!textNode->renderer() || textNode->renderer()->style()->collapseWhiteSpace());
         replaceTextInNodePreservingMarkers(textNode, m_leadingWhitespace.deprecatedEditingOffset(), 1, nonBreakingSpaceString());
     }
     if (m_trailingWhitespace.isNotNull() && !m_trailingWhitespace.isRenderedCharacter() && m_trailingWhitespace.deprecatedNode()->isTextNode()) {
-        Text* textNode = static_cast<Text*>(m_trailingWhitespace.deprecatedNode());
+        Text* textNode = toText(m_trailingWhitespace.deprecatedNode());
         ASSERT(!textNode->renderer() ||textNode->renderer()->style()->collapseWhiteSpace());
         replaceTextInNodePreservingMarkers(textNode, m_trailingWhitespace.deprecatedEditingOffset(), 1, nonBreakingSpaceString());
     }
diff --git a/Source/WebCore/editing/EditingStyle.cpp b/Source/WebCore/editing/EditingStyle.cpp
index 98224f243..57291c1f5 100644
--- a/Source/WebCore/editing/EditingStyle.cpp
+++ b/Source/WebCore/editing/EditingStyle.cpp
@@ -378,7 +378,7 @@ void EditingStyle::init(Node* node, PropertiesToInclude propertiesToInclude)
     else if (isTabSpanNode(node))
         node = node->parentNode();
 
-    RefPtr<CSSComputedStyleDeclaration> computedStyleAtPosition = computedStyle(node);
+    RefPtr<CSSComputedStyleDeclaration> computedStyleAtPosition = CSSComputedStyleDeclaration::create(node);
     m_mutableStyle = propertiesToInclude == AllProperties && computedStyleAtPosition ? computedStyleAtPosition->copy() : editingStyleFromComputedStyle(computedStyleAtPosition);
 
     if (propertiesToInclude == EditingPropertiesInEffect) {
@@ -558,8 +558,8 @@ void EditingStyle::removeStyleAddedByNode(Node* node)
 {
     if (!node || !node->parentNode())
         return;
-    RefPtr<StylePropertySet> parentStyle = editingStyleFromComputedStyle(computedStyle(node->parentNode()), AllEditingProperties);
-    RefPtr<StylePropertySet> nodeStyle = editingStyleFromComputedStyle(computedStyle(node), AllEditingProperties);
+    RefPtr<StylePropertySet> parentStyle = editingStyleFromComputedStyle(CSSComputedStyleDeclaration::create(node->parentNode()), AllEditingProperties);
+    RefPtr<StylePropertySet> nodeStyle = editingStyleFromComputedStyle(CSSComputedStyleDeclaration::create(node), AllEditingProperties);
     nodeStyle->removeEquivalentProperties(parentStyle->ensureCSSStyleDeclaration());
     m_mutableStyle->removeEquivalentProperties(nodeStyle->ensureCSSStyleDeclaration());
 }
@@ -569,8 +569,8 @@ void EditingStyle::removeStyleConflictingWithStyleOfNode(Node* node)
     if (!node || !node->parentNode() || !m_mutableStyle)
         return;
 
-    RefPtr<StylePropertySet> parentStyle = editingStyleFromComputedStyle(computedStyle(node->parentNode()), AllEditingProperties);
-    RefPtr<StylePropertySet> nodeStyle = editingStyleFromComputedStyle(computedStyle(node), AllEditingProperties);
+    RefPtr<StylePropertySet> parentStyle = editingStyleFromComputedStyle(CSSComputedStyleDeclaration::create(node->parentNode()), AllEditingProperties);
+    RefPtr<StylePropertySet> nodeStyle = editingStyleFromComputedStyle(CSSComputedStyleDeclaration::create(node), AllEditingProperties);
     nodeStyle->removeEquivalentProperties(parentStyle->ensureCSSStyleDeclaration());
 
     unsigned propertyCount = nodeStyle->propertyCount();
@@ -641,7 +641,7 @@ TriState EditingStyle::triStateOfStyle(const VisibleSelection& selection) const
 
     TriState state = FalseTriState;
     for (Node* node = selection.start().deprecatedNode(); node; node = node->traverseNextNode()) {
-        RefPtr<CSSComputedStyleDeclaration> nodeStyle = computedStyle(node);
+        RefPtr<CSSComputedStyleDeclaration> nodeStyle = CSSComputedStyleDeclaration::create(node);
         if (nodeStyle) {
             TriState nodeState = triStateOfStyle(nodeStyle.get(), node->isTextNode() ? EditingStyle::DoNotIgnoreTextOnlyProperties : EditingStyle::IgnoreTextOnlyProperties);
             if (node == selection.start().deprecatedNode())
@@ -813,7 +813,7 @@ bool EditingStyle::extractConflictingImplicitStyleOfAttributes(HTMLElement* elem
 
 bool EditingStyle::styleIsPresentInComputedStyleOfNode(Node* node) const
 {
-    return !m_mutableStyle || getPropertiesNotIn(m_mutableStyle.get(), computedStyle(node).get())->isEmpty();
+    return !m_mutableStyle || getPropertiesNotIn(m_mutableStyle.get(), CSSComputedStyleDeclaration::create(node).get())->isEmpty();
 }
 
 bool EditingStyle::elementIsStyledSpanOrHTMLEquivalent(const HTMLElement* element)
@@ -1061,7 +1061,7 @@ void EditingStyle::mergeStyleFromRulesForSerialization(StyledElement* element)
     // The property value, if it's a percentage, may not reflect the actual computed value.  
     // For example: style="height: 1%; overflow: visible;" in quirksmode
     // FIXME: There are others like this, see <rdar://problem/5195123> Slashdot copy/paste fidelity problem
-    RefPtr<CSSComputedStyleDeclaration> computedStyleForElement = computedStyle(element);
+    RefPtr<CSSComputedStyleDeclaration> computedStyleForElement = CSSComputedStyleDeclaration::create(element);
     RefPtr<StylePropertySet> fromComputedStyle = StylePropertySet::create();
     {
         unsigned propertyCount = m_mutableStyle->propertyCount();
@@ -1182,6 +1182,91 @@ PassRefPtr<EditingStyle> EditingStyle::styleAtSelectionStart(const VisibleSelect
     return style;
 }
 
+WritingDirection EditingStyle::textDirectionForSelection(const VisibleSelection& selection, EditingStyle* typingStyle, bool& hasNestedOrMultipleEmbeddings)
+{
+    hasNestedOrMultipleEmbeddings = true;
+
+    if (selection.isNone())
+        return NaturalWritingDirection;
+
+    Position position = selection.start().downstream();
+
+    Node* node = position.deprecatedNode();
+    if (!node)
+        return NaturalWritingDirection;
+
+    Position end;
+    if (selection.isRange()) {
+        end = selection.end().upstream();
+
+        Node* pastLast = Range::create(end.document(), position.parentAnchoredEquivalent(), end.parentAnchoredEquivalent())->pastLastNode();
+        for (Node* n = node; n && n != pastLast; n = n->traverseNextNode()) {
+            if (!n->isStyledElement())
+                continue;
+
+            RefPtr<CSSComputedStyleDeclaration> style = CSSComputedStyleDeclaration::create(n);
+            RefPtr<CSSValue> unicodeBidi = style->getPropertyCSSValue(CSSPropertyUnicodeBidi);
+            if (!unicodeBidi || !unicodeBidi->isPrimitiveValue())
+                continue;
+
+            int unicodeBidiValue = static_cast<CSSPrimitiveValue*>(unicodeBidi.get())->getIdent();
+            if (unicodeBidiValue == CSSValueEmbed || unicodeBidiValue == CSSValueBidiOverride)
+                return NaturalWritingDirection;
+        }
+    }
+
+    if (selection.isCaret()) {
+        WritingDirection direction;
+        if (typingStyle && typingStyle->textDirection(direction)) {
+            hasNestedOrMultipleEmbeddings = false;
+            return direction;
+        }
+        node = selection.visibleStart().deepEquivalent().deprecatedNode();
+    }
+
+    // The selection is either a caret with no typing attributes or a range in which no embedding is added, so just use the start position
+    // to decide.
+    Node* block = enclosingBlock(node);
+    WritingDirection foundDirection = NaturalWritingDirection;
+
+    for (; node != block; node = node->parentNode()) {
+        if (!node->isStyledElement())
+            continue;
+
+        RefPtr<CSSComputedStyleDeclaration> style = CSSComputedStyleDeclaration::create(node);
+        RefPtr<CSSValue> unicodeBidi = style->getPropertyCSSValue(CSSPropertyUnicodeBidi);
+        if (!unicodeBidi || !unicodeBidi->isPrimitiveValue())
+            continue;
+
+        int unicodeBidiValue = static_cast<CSSPrimitiveValue*>(unicodeBidi.get())->getIdent();
+        if (unicodeBidiValue == CSSValueNormal)
+            continue;
+
+        if (unicodeBidiValue == CSSValueBidiOverride)
+            return NaturalWritingDirection;
+
+        ASSERT(unicodeBidiValue == CSSValueEmbed);
+        RefPtr<CSSValue> direction = style->getPropertyCSSValue(CSSPropertyDirection);
+        if (!direction || !direction->isPrimitiveValue())
+            continue;
+
+        int directionValue = static_cast<CSSPrimitiveValue*>(direction.get())->getIdent();
+        if (directionValue != CSSValueLtr && directionValue != CSSValueRtl)
+            continue;
+
+        if (foundDirection != NaturalWritingDirection)
+            return NaturalWritingDirection;
+
+        // In the range case, make sure that the embedding element persists until the end of the range.
+        if (selection.isRange() && !end.deprecatedNode()->isDescendantOf(node))
+            return NaturalWritingDirection;
+        
+        foundDirection = directionValue == CSSValueLtr ? LeftToRightWritingDirection : RightToLeftWritingDirection;
+    }
+    hasNestedOrMultipleEmbeddings = false;
+    return foundDirection;
+}
+
 static void reconcileTextDecorationProperties(StylePropertySet* style)
 {    
     RefPtr<CSSValue> textDecorationsInEffect = style->getPropertyCSSValue(CSSPropertyWebkitTextDecorationsInEffect);
@@ -1487,7 +1572,7 @@ bool hasTransparentBackgroundColor(StylePropertySet* style)
 PassRefPtr<CSSValue> backgroundColorInEffect(Node* node)
 {
     for (Node* ancestor = node; ancestor; ancestor = ancestor->parentNode()) {
-        RefPtr<CSSComputedStyleDeclaration> ancestorStyle = computedStyle(ancestor);
+        RefPtr<CSSComputedStyleDeclaration> ancestorStyle = CSSComputedStyleDeclaration::create(ancestor);
         if (!hasTransparentBackgroundColor(ancestorStyle.get()))
             return ancestorStyle->getPropertyCSSValue(CSSPropertyBackgroundColor);
     }
diff --git a/Source/WebCore/editing/EditingStyle.h b/Source/WebCore/editing/EditingStyle.h
index 6b60920c6..71dc652f0 100644
--- a/Source/WebCore/editing/EditingStyle.h
+++ b/Source/WebCore/editing/EditingStyle.h
@@ -145,6 +145,7 @@ public:
     bool shouldUseFixedDefaultFontSize() const { return m_shouldUseFixedDefaultFontSize; }
 
     static PassRefPtr<EditingStyle> styleAtSelectionStart(const VisibleSelection&, bool shouldUseBackgroundColorInEffect = false);
+    static WritingDirection textDirectionForSelection(const VisibleSelection&, EditingStyle* typingStyle, bool& hasNestedOrMultipleEmbeddings);
 private:
     EditingStyle();
     EditingStyle(Node*, PropertiesToInclude);
diff --git a/Source/WebCore/editing/Editor.cpp b/Source/WebCore/editing/Editor.cpp
index 97b153365..1ce24e538 100644
--- a/Source/WebCore/editing/Editor.cpp
+++ b/Source/WebCore/editing/Editor.cpp
@@ -418,7 +418,7 @@ void Editor::replaceSelectionWithFragment(PassRefPtr<DocumentFragment> fragment,
         return;
 
     RefPtr<Range> rangeToCheck = Range::create(m_frame->document(), firstPositionInNode(nodeToCheck), lastPositionInNode(nodeToCheck));
-    m_spellChecker->requestCheckingFor(SpellCheckRequest::create(resolveTextCheckingTypeMask(TextCheckingTypeSpelling | TextCheckingTypeGrammar), rangeToCheck, rangeToCheck));
+    m_spellChecker->requestCheckingFor(SpellCheckRequest::create(resolveTextCheckingTypeMask(TextCheckingTypeSpelling | TextCheckingTypeGrammar), TextCheckingProcessBatch, rangeToCheck, rangeToCheck));
 }
 
 void Editor::replaceSelectionWithText(const String& text, bool selectReplacement, bool smartReplace)
@@ -499,92 +499,6 @@ void Editor::respondToChangedContents(const VisibleSelection& endingSelection)
         client()->respondToChangedContents();
 }
 
-WritingDirection Editor::textDirectionForSelection(bool& hasNestedOrMultipleEmbeddings) const
-{
-    hasNestedOrMultipleEmbeddings = true;
-
-    if (m_frame->selection()->isNone())
-        return NaturalWritingDirection;
-
-    Position position = m_frame->selection()->selection().start().downstream();
-
-    Node* node = position.deprecatedNode();
-    if (!node)
-        return NaturalWritingDirection;
-
-    Position end;
-    if (m_frame->selection()->isRange()) {
-        end = m_frame->selection()->selection().end().upstream();
-
-        Node* pastLast = Range::create(m_frame->document(), position.parentAnchoredEquivalent(), end.parentAnchoredEquivalent())->pastLastNode();
-        for (Node* n = node; n && n != pastLast; n = n->traverseNextNode()) {
-            if (!n->isStyledElement())
-                continue;
-
-            RefPtr<CSSComputedStyleDeclaration> style = computedStyle(n);
-            RefPtr<CSSValue> unicodeBidi = style->getPropertyCSSValue(CSSPropertyUnicodeBidi);
-            if (!unicodeBidi || !unicodeBidi->isPrimitiveValue())
-                continue;
-
-            int unicodeBidiValue = static_cast<CSSPrimitiveValue*>(unicodeBidi.get())->getIdent();
-            if (unicodeBidiValue == CSSValueEmbed || unicodeBidiValue == CSSValueBidiOverride)
-                return NaturalWritingDirection;
-        }
-    }
-
-    if (m_frame->selection()->isCaret()) {
-        RefPtr<EditingStyle> typingStyle = m_frame->selection()->typingStyle();
-        WritingDirection direction;
-        if (typingStyle && typingStyle->textDirection(direction)) {
-            hasNestedOrMultipleEmbeddings = false;
-            return direction;
-        }
-        node = m_frame->selection()->selection().visibleStart().deepEquivalent().deprecatedNode();
-    }
-
-    // The selection is either a caret with no typing attributes or a range in which no embedding is added, so just use the start position
-    // to decide.
-    Node* block = enclosingBlock(node);
-    WritingDirection foundDirection = NaturalWritingDirection;
-
-    for (; node != block; node = node->parentNode()) {
-        if (!node->isStyledElement())
-            continue;
-
-        RefPtr<CSSComputedStyleDeclaration> style = computedStyle(node);
-        RefPtr<CSSValue> unicodeBidi = style->getPropertyCSSValue(CSSPropertyUnicodeBidi);
-        if (!unicodeBidi || !unicodeBidi->isPrimitiveValue())
-            continue;
-
-        int unicodeBidiValue = static_cast<CSSPrimitiveValue*>(unicodeBidi.get())->getIdent();
-        if (unicodeBidiValue == CSSValueNormal)
-            continue;
-
-        if (unicodeBidiValue == CSSValueBidiOverride)
-            return NaturalWritingDirection;
-
-        ASSERT(unicodeBidiValue == CSSValueEmbed);
-        RefPtr<CSSValue> direction = style->getPropertyCSSValue(CSSPropertyDirection);
-        if (!direction || !direction->isPrimitiveValue())
-            continue;
-
-        int directionValue = static_cast<CSSPrimitiveValue*>(direction.get())->getIdent();
-        if (directionValue != CSSValueLtr && directionValue != CSSValueRtl)
-            continue;
-
-        if (foundDirection != NaturalWritingDirection)
-            return NaturalWritingDirection;
-
-        // In the range case, make sure that the embedding element persists until the end of the range.
-        if (m_frame->selection()->isRange() && !end.deprecatedNode()->isDescendantOf(node))
-            return NaturalWritingDirection;
-
-        foundDirection = directionValue == CSSValueLtr ? LeftToRightWritingDirection : RightToLeftWritingDirection;
-    }
-    hasNestedOrMultipleEmbeddings = false;
-    return foundDirection;
-}
-
 bool Editor::hasBidiSelection() const
 {
     if (m_frame->selection()->isNone())
@@ -764,7 +678,7 @@ Node* Editor::findEventTargetFromSelection() const
     return findEventTargetFrom(m_frame->selection()->selection());
 }
 
-void Editor::applyStyle(CSSStyleDeclaration* style, EditAction editingAction)
+void Editor::applyStyle(StylePropertySet* style, EditAction editingAction)
 {
     switch (m_frame->selection()->selectionType()) {
     case VisibleSelection::NoSelection:
@@ -780,12 +694,12 @@ void Editor::applyStyle(CSSStyleDeclaration* style, EditAction editingAction)
     }
 }
     
-bool Editor::shouldApplyStyle(CSSStyleDeclaration* style, Range* range)
+bool Editor::shouldApplyStyle(StylePropertySet* style, Range* range)
 {   
     return client()->shouldApplyStyle(style, range);
 }
     
-void Editor::applyParagraphStyle(CSSStyleDeclaration* style, EditAction editingAction)
+void Editor::applyParagraphStyle(StylePropertySet* style, EditAction editingAction)
 {
     switch (m_frame->selection()->selectionType()) {
     case VisibleSelection::NoSelection:
@@ -799,18 +713,18 @@ void Editor::applyParagraphStyle(CSSStyleDeclaration* style, EditAction editingA
     }
 }
 
-void Editor::applyStyleToSelection(CSSStyleDeclaration* style, EditAction editingAction)
+void Editor::applyStyleToSelection(StylePropertySet* style, EditAction editingAction)
 {
-    if (!style || !style->length() || !canEditRichly())
+    if (!style || style->isEmpty() || !canEditRichly())
         return;
 
     if (client() && client()->shouldApplyStyle(style, m_frame->selection()->toNormalizedRange().get()))
         applyStyle(style, editingAction);
 }
 
-void Editor::applyParagraphStyleToSelection(CSSStyleDeclaration* style, EditAction editingAction)
+void Editor::applyParagraphStyleToSelection(StylePropertySet* style, EditAction editingAction)
 {
-    if (!style || !style->length() || !canEditRichly())
+    if (!style || style->isEmpty() || !canEditRichly())
         return;
     
     if (client() && client()->shouldApplyStyle(style, m_frame->selection()->toNormalizedRange().get()))
@@ -1348,7 +1262,7 @@ void Editor::setBaseWritingDirection(WritingDirection direction)
 
     RefPtr<StylePropertySet> style = StylePropertySet::create();
     style->setProperty(CSSPropertyDirection, direction == LeftToRightWritingDirection ? "ltr" : direction == RightToLeftWritingDirection ? "rtl" : "inherit", false);
-    applyParagraphStyleToSelection(style->ensureCSSStyleDeclaration(), EditActionSetWritingDirection);
+    applyParagraphStyleToSelection(style.get(), EditActionSetWritingDirection);
 }
 
 void Editor::selectComposition()
@@ -1502,7 +1416,7 @@ void Editor::setComposition(const String& text, const Vector<CompositionUnderlin
         unsigned extentOffset = extent.deprecatedEditingOffset();
 
         if (baseNode && baseNode == extentNode && baseNode->isTextNode() && baseOffset + text.length() == extentOffset) {
-            m_compositionNode = static_cast<Text*>(baseNode);
+            m_compositionNode = toText(baseNode);
             m_compositionStart = baseOffset;
             m_compositionEnd = extentOffset;
             m_customCompositionUnderlines = underlines;
@@ -2021,7 +1935,7 @@ void Editor::markAllMisspellingsAndBadGrammarInRanges(TextCheckingTypeMask textC
     bool asynchronous = m_frame && m_frame->settings() && m_frame->settings()->asynchronousSpellCheckingEnabled() && !shouldShowCorrectionPanel;
 
     // In asynchronous mode, we intentionally check paragraph-wide sentence.
-    RefPtr<SpellCheckRequest> request = SpellCheckRequest::create(resolveTextCheckingTypeMask(textCheckingOptions), asynchronous ? paragraphRange : rangeToCheck, paragraphRange);
+    RefPtr<SpellCheckRequest> request = SpellCheckRequest::create(resolveTextCheckingTypeMask(textCheckingOptions), TextCheckingProcessIncremental, asynchronous ? paragraphRange : rangeToCheck, paragraphRange);
 
     if (asynchronous) {
         m_spellChecker->requestCheckingFor(request);
@@ -2665,9 +2579,9 @@ bool Editor::shouldChangeSelection(const VisibleSelection& oldSelection, const V
     return client() && client()->shouldChangeSelectedRange(oldSelection.toNormalizedRange().get(), newSelection.toNormalizedRange().get(), affinity, stillSelecting);
 }
 
-void Editor::computeAndSetTypingStyle(CSSStyleDeclaration* style, EditAction editingAction)
+void Editor::computeAndSetTypingStyle(StylePropertySet* style, EditAction editingAction)
 {
-    if (!style || !style->length()) {
+    if (!style || style->isEmpty()) {
         m_frame->selection()->clearTypingStyle();
         return;
     }
@@ -2676,7 +2590,7 @@ void Editor::computeAndSetTypingStyle(CSSStyleDeclaration* style, EditAction edi
     RefPtr<EditingStyle> typingStyle;
     if (m_frame->selection()->typingStyle()) {
         typingStyle = m_frame->selection()->typingStyle()->copy();
-        typingStyle->overrideWithStyle(style->makeMutable().get());
+        typingStyle->overrideWithStyle(style);
     } else
         typingStyle = EditingStyle::create(style);
 
@@ -2745,10 +2659,13 @@ void Editor::applyEditingStyleToElement(Element* element) const
     ASSERT(element->isStyledElement());
     if (!element->isStyledElement())
         return;
-    StylePropertySet* style = static_cast<StyledElement*>(element)->ensureInlineStyleDecl();
-    style->setProperty(CSSPropertyWordWrap, "break-word", false);
-    style->setProperty(CSSPropertyWebkitNbspMode, "space", false);
-    style->setProperty(CSSPropertyWebkitLineBreak, "after-white-space", false);
+
+    // Mutate using the CSSOM wrapper so we get the same event behavior as a script.
+    CSSStyleDeclaration* style = static_cast<StyledElement*>(element)->style();
+    ExceptionCode ec;
+    style->setPropertyInternal(CSSPropertyWordWrap, "break-word", false, ec);
+    style->setPropertyInternal(CSSPropertyWebkitNbspMode, "space", false, ec);
+    style->setPropertyInternal(CSSPropertyWebkitLineBreak, "after-white-space", false, ec);
 }
 
 // Searches from the beginning of the document if nothing is selected.
diff --git a/Source/WebCore/editing/Editor.h b/Source/WebCore/editing/Editor.h
index 5a7815892..e398bbf3e 100644
--- a/Source/WebCore/editing/Editor.h
+++ b/Source/WebCore/editing/Editor.h
@@ -46,7 +46,6 @@ typedef int NSWritingDirection;
 
 namespace WebCore {
 
-class CSSStyleDeclaration;
 class Clipboard;
 class CompositeEditCommand;
 class DeleteButtonController;
@@ -63,6 +62,7 @@ class SimpleFontData;
 class SpellChecker;
 class SpellCheckRequest;
 class SpellingCorrectionController;
+class StylePropertySet;
 class Text;
 class TextCheckerClient;
 class TextEvent;
@@ -130,7 +130,7 @@ public:
     bool shouldInsertText(const String&, Range*, EditorInsertAction) const;
     bool shouldShowDeleteInterface(HTMLElement*) const;
     bool shouldDeleteRange(Range*) const;
-    bool shouldApplyStyle(CSSStyleDeclaration*, Range*);
+    bool shouldApplyStyle(StylePropertySet*, Range*);
     
     void respondToChangedSelection(const VisibleSelection& oldSelection);
     void respondToChangedContents(const VisibleSelection& endingSelection);
@@ -138,7 +138,6 @@ public:
     bool selectionStartHasStyle(int propertyID, const String& value) const;
     TriState selectionHasStyle(int propertyID, const String& value) const;
     String selectionStartCSSPropertyValue(int propertyID);
-    WritingDirection textDirectionForSelection(bool&) const;
     
     TriState selectionUnorderedListState() const;
     TriState selectionOrderedListState() const;
@@ -162,10 +161,10 @@ public:
     Node* removedAnchor() const { return m_removedAnchor.get(); }
     void setRemovedAnchor(PassRefPtr<Node> n) { m_removedAnchor = n; }
 
-    void applyStyle(CSSStyleDeclaration*, EditAction = EditActionUnspecified);
-    void applyParagraphStyle(CSSStyleDeclaration*, EditAction = EditActionUnspecified);
-    void applyStyleToSelection(CSSStyleDeclaration*, EditAction);
-    void applyParagraphStyleToSelection(CSSStyleDeclaration*, EditAction);
+    void applyStyle(StylePropertySet*, EditAction = EditActionUnspecified);
+    void applyParagraphStyle(StylePropertySet*, EditAction = EditActionUnspecified);
+    void applyStyleToSelection(StylePropertySet*, EditAction);
+    void applyParagraphStyleToSelection(StylePropertySet*, EditAction);
 
     void appliedEditing(PassRefPtr<CompositeEditCommand>);
     void unappliedEditing(PassRefPtr<EditCommandComposition>);
@@ -346,7 +345,7 @@ public:
     const VisibleSelection& mark() const; // Mark, to be used as emacs uses it.
     void setMark(const VisibleSelection&);
 
-    void computeAndSetTypingStyle(CSSStyleDeclaration* , EditAction = EditActionUnspecified);
+    void computeAndSetTypingStyle(StylePropertySet* , EditAction = EditActionUnspecified);
     void applyEditingStyleToBodyElement() const;
     void applyEditingStyleToElement(Element*) const;
 
diff --git a/Source/WebCore/editing/EditorCommand.cpp b/Source/WebCore/editing/EditorCommand.cpp
index a2ad63372..a4137425d 100644
--- a/Source/WebCore/editing/EditorCommand.cpp
+++ b/Source/WebCore/editing/EditorCommand.cpp
@@ -103,11 +103,11 @@ static bool applyCommandToFrame(Frame* frame, EditorCommandSource source, EditAc
     // FIXME: We don't call shouldApplyStyle when the source is DOM; is there a good reason for that?
     switch (source) {
     case CommandFromMenuOrKeyBinding:
-        frame->editor()->applyStyleToSelection(style->ensureCSSStyleDeclaration(), action);
+        frame->editor()->applyStyleToSelection(style, action);
         return true;
     case CommandFromDOM:
     case CommandFromDOMWithUserInterface:
-        frame->editor()->applyStyle(style->ensureCSSStyleDeclaration());
+        frame->editor()->applyStyle(style);
         return true;
     }
     ASSERT_NOT_REACHED();
@@ -179,11 +179,11 @@ static bool executeApplyParagraphStyle(Frame* frame, EditorCommandSource source,
     // FIXME: We don't call shouldApplyStyle when the source is DOM; is there a good reason for that?
     switch (source) {
     case CommandFromMenuOrKeyBinding:
-        frame->editor()->applyParagraphStyleToSelection(style->ensureCSSStyleDeclaration(), action);
+        frame->editor()->applyParagraphStyleToSelection(style.get(), action);
         return true;
     case CommandFromDOM:
     case CommandFromDOMWithUserInterface:
-        frame->editor()->applyParagraphStyle(style->ensureCSSStyleDeclaration());
+        frame->editor()->applyParagraphStyle(style.get());
         return true;
     }
     ASSERT_NOT_REACHED();
@@ -241,7 +241,9 @@ static String valueStyle(Frame* frame, int propertyID)
 static TriState stateTextWritingDirection(Frame* frame, WritingDirection direction)
 {
     bool hasNestedOrMultipleEmbeddings;
-    WritingDirection selectionDirection = frame->editor()->textDirectionForSelection(hasNestedOrMultipleEmbeddings);
+    WritingDirection selectionDirection = EditingStyle::textDirectionForSelection(frame->selection()->selection(),
+        frame->selection()->typingStyle(), hasNestedOrMultipleEmbeddings);
+    // FXIME: We should be returning MixedTriState when selectionDirection == direction && hasNestedOrMultipleEmbeddings
     return (selectionDirection == direction && !hasNestedOrMultipleEmbeddings) ? TrueTriState : FalseTriState;
 }
 
@@ -583,7 +585,7 @@ static bool executeMakeTextWritingDirectionLeftToRight(Frame* frame, Event*, Edi
     RefPtr<StylePropertySet> style = StylePropertySet::create();
     style->setProperty(CSSPropertyUnicodeBidi, CSSValueEmbed);
     style->setProperty(CSSPropertyDirection, CSSValueLtr);
-    frame->editor()->applyStyle(style->ensureCSSStyleDeclaration(), EditActionSetWritingDirection);
+    frame->editor()->applyStyle(style.get(), EditActionSetWritingDirection);
     return true;
 }
 
@@ -591,7 +593,7 @@ static bool executeMakeTextWritingDirectionNatural(Frame* frame, Event*, EditorC
 {
     RefPtr<StylePropertySet> style = StylePropertySet::create();
     style->setProperty(CSSPropertyUnicodeBidi, CSSValueNormal);
-    frame->editor()->applyStyle(style->ensureCSSStyleDeclaration(), EditActionSetWritingDirection);
+    frame->editor()->applyStyle(style.get(), EditActionSetWritingDirection);
     return true;
 }
 
@@ -600,7 +602,7 @@ static bool executeMakeTextWritingDirectionRightToLeft(Frame* frame, Event*, Edi
     RefPtr<StylePropertySet> style = StylePropertySet::create();
     style->setProperty(CSSPropertyUnicodeBidi, CSSValueEmbed);
     style->setProperty(CSSPropertyDirection, CSSValueRtl);
-    frame->editor()->applyStyle(style->ensureCSSStyleDeclaration(), EditActionSetWritingDirection);
+    frame->editor()->applyStyle(style.get(), EditActionSetWritingDirection);
     return true;
 }
 
diff --git a/Source/WebCore/editing/FrameSelection.cpp b/Source/WebCore/editing/FrameSelection.cpp
index fc7286eba..de2d65d7e 100644
--- a/Source/WebCore/editing/FrameSelection.cpp
+++ b/Source/WebCore/editing/FrameSelection.cpp
@@ -425,10 +425,17 @@ static void updatePositionAfterAdoptingTextReplacement(Position& position, Chara
         position.moveToOffset(positionOffset - oldLength + newLength);
 }
 
+static inline bool nodeIsDetachedFromDocument(Node* node)
+{
+    ASSERT(node);
+    Node* highest = highestAncestor(node);
+    return highest->nodeType() == Node::DOCUMENT_FRAGMENT_NODE && !highest->isShadowRoot();
+}
+
 void FrameSelection::textWillBeReplaced(CharacterData* node, unsigned offset, unsigned oldLength, unsigned newLength)
 {
     // The fragment check is a performance optimization. See http://trac.webkit.org/changeset/30062.
-    if (isNone() || !node || highestAncestor(node)->nodeType() == Node::DOCUMENT_FRAGMENT_NODE)
+    if (isNone() || !node || nodeIsDetachedFromDocument(node))
         return;
 
     Position base = m_selection.base();
diff --git a/Source/WebCore/editing/InsertLineBreakCommand.cpp b/Source/WebCore/editing/InsertLineBreakCommand.cpp
index c8e8b83c3..f64763235 100644
--- a/Source/WebCore/editing/InsertLineBreakCommand.cpp
+++ b/Source/WebCore/editing/InsertLineBreakCommand.cpp
@@ -137,7 +137,7 @@ void InsertLineBreakCommand::doApply()
         setEndingSelection(VisibleSelection(positionInParentAfterNode(nodeToInsert.get()), DOWNSTREAM, endingSelection().isDirectional()));
     } else if (pos.deprecatedNode()->isTextNode()) {
         // Split a text node
-        Text* textNode = static_cast<Text*>(pos.deprecatedNode());
+        Text* textNode = toText(pos.deprecatedNode());
         splitTextNode(textNode, pos.deprecatedEditingOffset());
         insertNodeBefore(nodeToInsert, textNode);
         Position endingPosition = firstPositionInNode(textNode);
diff --git a/Source/WebCore/editing/InsertListCommand.cpp b/Source/WebCore/editing/InsertListCommand.cpp
index dbc22ba7d..e4e357826 100644
--- a/Source/WebCore/editing/InsertListCommand.cpp
+++ b/Source/WebCore/editing/InsertListCommand.cpp
@@ -152,11 +152,11 @@ void InsertListCommand::doApply()
                 // FIXME: This is an inefficient way to keep selection alive because indexForVisiblePosition walks from
                 // the beginning of the document to the endOfSelection everytime this code is executed.
                 // But not using index is hard because there are so many ways we can lose selection inside doApplyForSingleParagraph.
-                Element* scope = 0;
-                int indexForEndOfSelection = indexForVisiblePosition(endOfSelection, &scope);
+                RefPtr<Element> scope;
+                int indexForEndOfSelection = indexForVisiblePosition(endOfSelection, scope);
                 doApplyForSingleParagraph(forceCreateList, listTag, currentSelection.get());
                 if (endOfSelection.isNull() || endOfSelection.isOrphan() || startOfLastParagraph.isNull() || startOfLastParagraph.isOrphan()) {
-                    endOfSelection = visiblePositionForIndex(indexForEndOfSelection, scope);
+                    endOfSelection = visiblePositionForIndex(indexForEndOfSelection, scope.get());
                     // If endOfSelection is null, then some contents have been deleted from the document.
                     // This should never happen and if it did, exit early immediately because we've lost the loop invariant.
                     ASSERT(endOfSelection.isNotNull());
diff --git a/Source/WebCore/editing/InsertParagraphSeparatorCommand.cpp b/Source/WebCore/editing/InsertParagraphSeparatorCommand.cpp
index 4aec419a1..46f3c8a5d 100644
--- a/Source/WebCore/editing/InsertParagraphSeparatorCommand.cpp
+++ b/Source/WebCore/editing/InsertParagraphSeparatorCommand.cpp
@@ -322,14 +322,14 @@ void InsertParagraphSeparatorCommand::doApply()
     // FIXME: leadingWhitespacePosition is returning the position before preserved newlines for positions
     // after the preserved newline, causing the newline to be turned into a nbsp.
     if (leadingWhitespace.isNotNull() && leadingWhitespace.deprecatedNode()->isTextNode()) {
-        Text* textNode = static_cast<Text*>(leadingWhitespace.deprecatedNode());
+        Text* textNode = toText(leadingWhitespace.deprecatedNode());
         ASSERT(!textNode->renderer() || textNode->renderer()->style()->collapseWhiteSpace());
         replaceTextInNodePreservingMarkers(textNode, leadingWhitespace.deprecatedEditingOffset(), 1, nonBreakingSpaceString());
     }
     
     // Split at pos if in the middle of a text node.
     if (insertionPosition.deprecatedNode()->isTextNode()) {
-        Text* textNode = static_cast<Text*>(insertionPosition.deprecatedNode());
+        Text* textNode = toText(insertionPosition.deprecatedNode());
         bool atEnd = (unsigned)insertionPosition.deprecatedEditingOffset() >= textNode->length();
         if (insertionPosition.deprecatedEditingOffset() > 0 && !atEnd) {
             splitTextNode(textNode, insertionPosition.deprecatedEditingOffset());
@@ -389,7 +389,7 @@ void InsertParagraphSeparatorCommand::doApply()
             ASSERT(!insertionPosition.deprecatedNode()->renderer() || insertionPosition.deprecatedNode()->renderer()->style()->collapseWhiteSpace());
             deleteInsignificantTextDownstream(insertionPosition);
             if (insertionPosition.deprecatedNode()->isTextNode())
-                insertTextIntoNode(static_cast<Text*>(insertionPosition.deprecatedNode()), 0, nonBreakingSpaceString());
+                insertTextIntoNode(toText(insertionPosition.deprecatedNode()), 0, nonBreakingSpaceString());
         }
     }
 
diff --git a/Source/WebCore/editing/InsertTextCommand.cpp b/Source/WebCore/editing/InsertTextCommand.cpp
index b2c0af06e..39fa2a897 100644
--- a/Source/WebCore/editing/InsertTextCommand.cpp
+++ b/Source/WebCore/editing/InsertTextCommand.cpp
@@ -209,7 +209,7 @@ Position InsertTextCommand::insertTab(const Position& pos)
 
     // keep tabs coalesced in tab span
     if (isTabSpanTextNode(node)) {
-        RefPtr<Text> textNode = static_cast<Text*>(node);
+        RefPtr<Text> textNode = toText(node);
         insertTextIntoNode(textNode, offset, "\t");
         return Position(textNode.release(), offset + 1);
     }
@@ -221,7 +221,7 @@ Position InsertTextCommand::insertTab(const Position& pos)
     if (!node->isTextNode()) {
         insertNodeAt(spanNode.get(), insertPos);
     } else {
-        RefPtr<Text> textNode = static_cast<Text*>(node);
+        RefPtr<Text> textNode = toText(node);
         if (offset >= textNode->length())
             insertNodeAfter(spanNode, textNode.release());
         else {
diff --git a/Source/WebCore/editing/MarkupAccumulator.cpp b/Source/WebCore/editing/MarkupAccumulator.cpp
index 306a84655..476904ebc 100644
--- a/Source/WebCore/editing/MarkupAccumulator.cpp
+++ b/Source/WebCore/editing/MarkupAccumulator.cpp
@@ -419,7 +419,7 @@ void MarkupAccumulator::appendStartMarkup(StringBuilder& result, const Node* nod
 
     switch (node->nodeType()) {
     case Node::TEXT_NODE:
-        appendText(result, static_cast<Text*>(const_cast<Node*>(node)));
+        appendText(result, toText(const_cast<Node*>(node)));
         break;
     case Node::COMMENT_NODE:
         appendComment(result, static_cast<const Comment*>(node)->data());
@@ -444,7 +444,6 @@ void MarkupAccumulator::appendStartMarkup(StringBuilder& result, const Node* nod
     case Node::ENTITY_REFERENCE_NODE:
     case Node::NOTATION_NODE:
     case Node::XPATH_NAMESPACE_NODE:
-    case Node::SHADOW_ROOT_NODE:
         ASSERT_NOT_REACHED();
         break;
     }
diff --git a/Source/WebCore/editing/RemoveCSSPropertyCommand.cpp b/Source/WebCore/editing/RemoveCSSPropertyCommand.cpp
index cbbba5225..ca5baba4b 100644
--- a/Source/WebCore/editing/RemoveCSSPropertyCommand.cpp
+++ b/Source/WebCore/editing/RemoveCSSPropertyCommand.cpp
@@ -26,6 +26,7 @@
 #include "config.h"
 #include "RemoveCSSPropertyCommand.h"
 
+#include "CSSStyleDeclaration.h"
 #include "StylePropertySet.h"
 #include <wtf/Assertions.h>
 
@@ -45,13 +46,17 @@ void RemoveCSSPropertyCommand::doApply()
     StylePropertySet* style = m_element->inlineStyleDecl();
     m_oldValue = style->getPropertyValue(m_property);
     m_important = style->propertyIsImportant(m_property);
-    style->removeProperty(m_property);
+
+    // Mutate using the CSSOM wrapper so we get the same event behavior as a script.
+    ExceptionCode ec;
+    // Setting to null string removes the property. We don't have internal version of removeProperty.
+    m_element->style()->setPropertyInternal(m_property, String(), false, ec);
 }
 
 void RemoveCSSPropertyCommand::doUnapply()
 {
-    StylePropertySet* style = m_element->inlineStyleDecl();
-    style->setProperty(m_property, m_oldValue, m_important);
+    ExceptionCode ec;
+    m_element->style()->setPropertyInternal(m_property, m_oldValue, m_important, ec);
 }
 
 #ifndef NDEBUG
diff --git a/Source/WebCore/editing/ReplaceSelectionCommand.cpp b/Source/WebCore/editing/ReplaceSelectionCommand.cpp
index 8ce9446a9..95fdaf060 100644
--- a/Source/WebCore/editing/ReplaceSelectionCommand.cpp
+++ b/Source/WebCore/editing/ReplaceSelectionCommand.cpp
@@ -30,8 +30,8 @@
 #include "ApplyStyleCommand.h"
 #include "BeforeTextInsertedEvent.h"
 #include "BreakBlockquoteCommand.h"
-#include "CSSComputedStyleDeclaration.h"
 #include "CSSPropertyNames.h"
+#include "CSSStyleDeclaration.h"
 #include "CSSValueKeywords.h"
 #include "Document.h"
 #include "DocumentFragment.h"
@@ -293,6 +293,9 @@ void ReplacementFragment::removeUnrenderedNodes(Node* holder)
 
 void ReplacementFragment::removeInterchangeNodes(Node* container)
 {
+    m_hasInterchangeNewlineAtStart = false;
+    m_hasInterchangeNewlineAtEnd = false;
+
     // Interchange newlines at the "start" of the incoming fragment must be
     // either the first node in the fragment or the first leaf in the fragment.
     Node* node = container->firstChild();
@@ -531,10 +534,13 @@ void ReplaceSelectionCommand::removeRedundantStylesAndKeepStyleSpanInline(Insert
             // FIXME: Hyatt is concerned that selectively using display:inline will give inconsistent
             // results. We already know one issue because td elements ignore their display property
             // in quirks mode (which Mail.app is always in). We should look for an alternative.
+            
+            // Mutate using the CSSOM wrapper so we get the same event behavior as a script.
+            ExceptionCode ec;
             if (isBlock(element))
-                element->ensureInlineStyleDecl()->setProperty(CSSPropertyDisplay, CSSValueInline);
+                element->style()->setPropertyInternal(CSSPropertyDisplay, "inline", false, ec);
             if (element->renderer() && element->renderer()->style()->isFloating())
-                element->ensureInlineStyleDecl()->setProperty(CSSPropertyFloat, CSSValueNone);
+                element->style()->setPropertyInternal(CSSPropertyFloat, "none", false, ec);
         }
     }
 }
@@ -597,7 +603,7 @@ void ReplaceSelectionCommand::removeUnrenderedTextNodesAtEnds(InsertedNodes& ins
     document()->updateLayoutIgnorePendingStylesheets();
 
     Node* lastLeafInserted = insertedNodes.lastLeafInserted();
-    if (lastLeafInserted && lastLeafInserted->isTextNode() && !nodeHasVisibleRenderText(static_cast<Text*>(lastLeafInserted))
+    if (lastLeafInserted && lastLeafInserted->isTextNode() && !nodeHasVisibleRenderText(toText(lastLeafInserted))
         && !enclosingNodeWithTag(firstPositionInOrBeforeNode(lastLeafInserted), selectTag)
         && !enclosingNodeWithTag(firstPositionInOrBeforeNode(lastLeafInserted), scriptTag)) {
         insertedNodes.willRemoveNode(lastLeafInserted);
@@ -608,7 +614,7 @@ void ReplaceSelectionCommand::removeUnrenderedTextNodesAtEnds(InsertedNodes& ins
     // it is a top level node in the fragment and the user can't insert into those elements.
     Node* firstNodeInserted = insertedNodes.firstNodeInserted();
     lastLeafInserted = insertedNodes.lastLeafInserted();
-    if (firstNodeInserted && firstNodeInserted->isTextNode() && !nodeHasVisibleRenderText(static_cast<Text*>(firstNodeInserted))) {
+    if (firstNodeInserted && firstNodeInserted->isTextNode() && !nodeHasVisibleRenderText(toText(firstNodeInserted))) {
         insertedNodes.willRemoveNode(firstNodeInserted);
         removeNode(firstNodeInserted);
     }
@@ -1189,7 +1195,7 @@ void ReplaceSelectionCommand::addSpacesForSmartReplace()
     if (needsTrailingSpace && endNode) {
         bool collapseWhiteSpace = !endNode->renderer() || endNode->renderer()->style()->collapseWhiteSpace();
         if (endNode->isTextNode()) {
-            Text* text = static_cast<Text*>(endNode);
+            Text* text = toText(endNode);
             // FIXME: we shouldn't always be inserting the space at the end
             insertTextIntoNode(text, text->length(), collapseWhiteSpace ? nonBreakingSpaceString() : " ");
             if (m_endOfInsertedContent.containerNode() == text)
@@ -1213,7 +1219,7 @@ void ReplaceSelectionCommand::addSpacesForSmartReplace()
     if (needsLeadingSpace && startNode) {
         bool collapseWhiteSpace = !startNode->renderer() || startNode->renderer()->style()->collapseWhiteSpace();
         if (startNode->isTextNode()) {
-            insertTextIntoNode(static_cast<Text*>(startNode), startOffset, collapseWhiteSpace ? nonBreakingSpaceString() : " ");
+            insertTextIntoNode(toText(startNode), startOffset, collapseWhiteSpace ? nonBreakingSpaceString() : " ");
             if (m_endOfInsertedContent.containerNode() == startNode && m_endOfInsertedContent.offsetInContainerNode())
                 m_endOfInsertedContent.moveToOffset(m_endOfInsertedContent.offsetInContainerNode() + 1);
         } else {
@@ -1279,7 +1285,7 @@ Node* ReplaceSelectionCommand::insertAsListItems(PassRefPtr<Node> prpListElement
     if (isMiddle) {
         int textNodeOffset = insertPos.offsetInContainerNode();
         if (insertPos.deprecatedNode()->isTextNode() && textNodeOffset > 0)
-            splitTextNode(static_cast<Text*>(insertPos.deprecatedNode()), textNodeOffset);
+            splitTextNode(toText(insertPos.deprecatedNode()), textNodeOffset);
         splitTreeToNode(insertPos.deprecatedNode(), lastNode, true);
     }
 
@@ -1333,7 +1339,7 @@ bool ReplaceSelectionCommand::performTrivialReplace(const ReplacementFragment& f
         return false;
 
     Node* nodeAfterInsertionPos = endingSelection().end().downstream().anchorNode();
-    Text* textNode = static_cast<Text*>(fragment.firstChild());
+    Text* textNode = toText(fragment.firstChild());
     // Our fragment creation code handles tabs, spaces, and newlines, so we don't have to worry about those here.
 
     Position start = endingSelection().start();
diff --git a/Source/WebCore/editing/SpellChecker.cpp b/Source/WebCore/editing/SpellChecker.cpp
index 683644c6d..e1243b14d 100644
--- a/Source/WebCore/editing/SpellChecker.cpp
+++ b/Source/WebCore/editing/SpellChecker.cpp
@@ -47,12 +47,13 @@ namespace WebCore {
 
 static const int unrequestedSequence = -1;
 
-SpellCheckRequest::SpellCheckRequest(int sequence, PassRefPtr<Range> checkingRange, PassRefPtr<Range> paragraphRange, const String& text, TextCheckingTypeMask mask)
+SpellCheckRequest::SpellCheckRequest(int sequence, PassRefPtr<Range> checkingRange, PassRefPtr<Range> paragraphRange, const String& text, TextCheckingTypeMask mask, TextCheckingProcessType processType)
     : m_sequence(sequence)
-    , m_checkingRange(checkingRange)
-    , m_paragraphRange(paragraphRange)
     , m_text(text)
     , m_mask(mask)
+    , m_processType(processType)
+    , m_checkingRange(checkingRange)
+    , m_paragraphRange(paragraphRange)
     , m_rootEditableElement(m_checkingRange->startContainer()->rootEditableElement())
 {
 }
@@ -62,7 +63,7 @@ SpellCheckRequest::~SpellCheckRequest()
 }
 
 // static
-PassRefPtr<SpellCheckRequest> SpellCheckRequest::create(TextCheckingTypeMask textCheckingOptions, PassRefPtr<Range> checkingRange, PassRefPtr<Range> paragraphRange)
+PassRefPtr<SpellCheckRequest> SpellCheckRequest::create(TextCheckingTypeMask textCheckingOptions, TextCheckingProcessType processType, PassRefPtr<Range> checkingRange, PassRefPtr<Range> paragraphRange)
 {
     ASSERT(checkingRange);
     ASSERT(paragraphRange);
@@ -71,7 +72,7 @@ PassRefPtr<SpellCheckRequest> SpellCheckRequest::create(TextCheckingTypeMask tex
     if (!text.length())
         return PassRefPtr<SpellCheckRequest>();
 
-    return adoptRef(new SpellCheckRequest(unrequestedSequence, checkingRange, paragraphRange, text, textCheckingOptions));
+    return adoptRef(new SpellCheckRequest(unrequestedSequence, checkingRange, paragraphRange, text, textCheckingOptions, processType));
 }
 
 
@@ -145,7 +146,7 @@ void SpellChecker::invokeRequest(PassRefPtr<SpellCheckRequest> request)
     ASSERT(!m_processingRequest);
 
     m_processingRequest = request;
-    client()->requestCheckingOfString(this, m_processingRequest->sequence(), m_processingRequest->mask(), m_processingRequest->text());
+    client()->requestCheckingOfString(this, m_processingRequest->textCheckingRequest());
 }
 
 void SpellChecker::enqueueRequest(PassRefPtr<SpellCheckRequest> request)
diff --git a/Source/WebCore/editing/SpellChecker.h b/Source/WebCore/editing/SpellChecker.h
index 20306da1a..07f51e431 100644
--- a/Source/WebCore/editing/SpellChecker.h
+++ b/Source/WebCore/editing/SpellChecker.h
@@ -46,10 +46,12 @@ struct TextCheckingResult;
 
 class SpellCheckRequest : public RefCounted<SpellCheckRequest> {
 public:
-    SpellCheckRequest(int sequence, PassRefPtr<Range> checkingRange, PassRefPtr<Range> paragraphRange, const String&, TextCheckingTypeMask);
+    SpellCheckRequest(int sequence, PassRefPtr<Range> checkingRange, PassRefPtr<Range> paragraphRange, const String&, TextCheckingTypeMask, TextCheckingProcessType);
     ~SpellCheckRequest();
 
-    static PassRefPtr<SpellCheckRequest> create(TextCheckingTypeMask, PassRefPtr<Range> checkingRange, PassRefPtr<Range> paragraphRange);
+    static PassRefPtr<SpellCheckRequest> create(TextCheckingTypeMask, TextCheckingProcessType, PassRefPtr<Range> checkingRange, PassRefPtr<Range> paragraphRange);
+
+    TextCheckingRequest textCheckingRequest() const;
 
     void setSequence(int sequence) { m_sequence = sequence; }
     int sequence() const { return m_sequence; }
@@ -57,14 +59,15 @@ public:
     PassRefPtr<Range> paragraphRange() const { return m_paragraphRange; }
     const String& text() const { return m_text; }
     TextCheckingTypeMask mask() const { return m_mask; }
+    TextCheckingProcessType processType() const { return m_processType; }
     PassRefPtr<Element> rootEditableElement() const { return m_rootEditableElement; }
 private:
-
     int m_sequence;
-    RefPtr<Range> m_checkingRange;
-    RefPtr<Range> m_paragraphRange;
     String m_text;
     TextCheckingTypeMask m_mask;
+    TextCheckingProcessType m_processType;
+    RefPtr<Range> m_checkingRange;
+    RefPtr<Range> m_paragraphRange;
     RefPtr<Element> m_rootEditableElement;
 };
 
@@ -109,6 +112,11 @@ private:
     RequestQueue m_requestQueue;
 };
 
+inline TextCheckingRequest SpellCheckRequest::textCheckingRequest() const
+{
+    return TextCheckingRequest(m_sequence, m_text, m_mask, m_processType);
+}
+
 } // namespace WebCore
 
 #endif // SpellChecker_h
diff --git a/Source/WebCore/editing/TextIterator.cpp b/Source/WebCore/editing/TextIterator.cpp
index c1c79f28a..aaeca4f9a 100644
--- a/Source/WebCore/editing/TextIterator.cpp
+++ b/Source/WebCore/editing/TextIterator.cpp
@@ -487,25 +487,20 @@ bool TextIterator::handleTextNode()
         return true;
     }
 
-    if (!renderer->firstTextBox() && str.length() > 0) {
-        if (!m_handledFirstLetter && renderer->isTextFragment()) {
-            handleTextNodeFirstLetter(static_cast<RenderTextFragment*>(renderer));
-            if (m_firstLetterText) {
-                handleTextBox();
-                return false;
-            }
-        }
+    if (renderer->firstTextBox())
+        m_textBox = renderer->firstTextBox();
+
+    bool shouldHandleFirstLetter = !m_handledFirstLetter && renderer->isTextFragment() && !m_offset;
+    if (shouldHandleFirstLetter)
+        handleTextNodeFirstLetter(static_cast<RenderTextFragment*>(renderer));
+
+    if (!renderer->firstTextBox() && str.length() > 0 && !shouldHandleFirstLetter) {
         if (renderer->style()->visibility() != VISIBLE && !m_ignoresStyleVisibility)
             return false;
         m_lastTextNodeEndedWithCollapsedSpace = true; // entire block is collapsed space
         return true;
     }
 
-    
-    m_textBox = renderer->firstTextBox();
-    if (!m_handledFirstLetter && renderer->isTextFragment() && !m_offset)
-        handleTextNodeFirstLetter(static_cast<RenderTextFragment*>(renderer));
-
     if (m_firstLetterText)
         renderer = m_firstLetterText;
 
@@ -562,6 +557,7 @@ void TextIterator::handleTextBox()
                 nextTextBox = m_sortedTextBoxes[m_sortedTextBoxesPosition + 1];
         } else 
             nextTextBox = m_textBox->nextTextBox();
+        ASSERT(!nextTextBox || nextTextBox->renderer() == renderer);
 
         if (runStart < runEnd) {
             // Handle either a single newline character (which becomes a space),
@@ -630,6 +626,7 @@ void TextIterator::handleTextNodeFirstLetter(RenderTextFragment* renderer)
             m_handledFirstLetter = true;
             m_remainingTextBox = m_textBox;
             m_textBox = firstLetter->firstTextBox();
+            m_sortedTextBoxes.clear();
             m_firstLetterText = firstLetter;
         }
     }
diff --git a/Source/WebCore/editing/htmlediting.cpp b/Source/WebCore/editing/htmlediting.cpp
index 28cc029d0..07046100e 100644
--- a/Source/WebCore/editing/htmlediting.cpp
+++ b/Source/WebCore/editing/htmlediting.cpp
@@ -1033,7 +1033,7 @@ bool lineBreakExistsAtPosition(const Position& position)
     if (!position.anchorNode()->isTextNode() || !position.anchorNode()->renderer()->style()->preserveNewline())
         return false;
     
-    Text* textNode = static_cast<Text*>(position.anchorNode());
+    Text* textNode = toText(position.anchorNode());
     unsigned offset = position.offsetInContainerNode();
     return offset < textNode->length() && textNode->data()[offset] == '\n';
 }
@@ -1072,31 +1072,24 @@ VisibleSelection selectionForParagraphIteration(const VisibleSelection& original
 // opertion is unreliable. TextIterator's TextIteratorEmitsCharactersBetweenAllVisiblePositions mode needs to be fixed, 
 // or these functions need to be changed to iterate using actual VisiblePositions.
 // FIXME: Deploy these functions everywhere that TextIterators are used to convert between VisiblePositions and indices.
-int indexForVisiblePosition(const VisiblePosition& visiblePosition, Element **scope)
+int indexForVisiblePosition(const VisiblePosition& visiblePosition, RefPtr<Element>& scope)
 {
     if (visiblePosition.isNull())
         return 0;
-        
+
     Position p(visiblePosition.deepEquivalent());
     Document* document = p.anchorNode()->document();
-    
-    Element* root;
     Node* shadowRoot = p.anchorNode()->shadowTreeRootNode();
-    
+
     if (shadowRoot) {
         // Use the shadow root for form elements, since TextIterators will not enter shadow content.
         ASSERT(shadowRoot->isElementNode());
-        root = static_cast<Element*>(shadowRoot);
+        scope = static_cast<Element*>(shadowRoot);
     } else
-        root = document->documentElement();
-    
-    if (scope) {
-        ASSERT(!*scope);
-        *scope = root;
-    }
-    
-    RefPtr<Range> range = Range::create(document, firstPositionInNode(root), p.parentAnchoredEquivalent());
-    
+        scope = document->documentElement();
+
+    RefPtr<Range> range = Range::create(document, firstPositionInNode(scope.get()), p.parentAnchoredEquivalent());
+
     return TextIterator::rangeLength(range.get(), true);
 }
 
diff --git a/Source/WebCore/editing/htmlediting.h b/Source/WebCore/editing/htmlediting.h
index 0f2d1bdc0..abb49e312 100644
--- a/Source/WebCore/editing/htmlediting.h
+++ b/Source/WebCore/editing/htmlediting.h
@@ -180,7 +180,7 @@ bool lineBreakExistsAtVisiblePosition(const VisiblePosition&);
     
 int comparePositions(const VisiblePosition&, const VisiblePosition&);
 
-int indexForVisiblePosition(const VisiblePosition&, Element **scope);
+int indexForVisiblePosition(const VisiblePosition&, RefPtr<Element>& scope);
 VisiblePosition visiblePositionForIndex(int index, Element *scope);
 
 // -------------------------------------------------------------------------
diff --git a/Source/WebCore/editing/mac/EditorMac.mm b/Source/WebCore/editing/mac/EditorMac.mm
index 423924fa4..2f5833674 100644
--- a/Source/WebCore/editing/mac/EditorMac.mm
+++ b/Source/WebCore/editing/mac/EditorMac.mm
@@ -37,6 +37,8 @@
 #import "FrameView.h"
 #import "HTMLNames.h"
 #import "Pasteboard.h"
+#import "PasteboardStrategy.h"
+#import "PlatformStrategies.h"
 #import "RenderBlock.h"
 #import "RuntimeApplicationChecks.h"
 #import "Sound.h"
@@ -49,7 +51,7 @@ using namespace HTMLNames;
 PassRefPtr<Clipboard> Editor::newGeneralClipboard(ClipboardAccessPolicy policy, Frame* frame)
 {
     return ClipboardMac::create(Clipboard::CopyAndPaste,
-        policy == ClipboardWritable ? [NSPasteboard pasteboardWithUniqueName] : [NSPasteboard generalPasteboard], policy, frame);
+        policy == ClipboardWritable ? platformStrategies()->pasteboardStrategy()->uniqueName() : String(NSGeneralPboard), policy, frame);
 }
 
 void Editor::showFontPanel()
@@ -289,11 +291,8 @@ void Editor::takeFindStringFromSelection()
 
 void Editor::writeSelectionToPasteboard(const String& pasteboardName, const Vector<String>& pasteboardTypes)
 {
-    RetainPtr<NSMutableArray> types(AdoptNS, [[NSMutableArray alloc] init]);    
-    for (size_t i = 0; i < pasteboardTypes.size(); ++i)
-        [types.get() addObject:pasteboardTypes[i]];
     Pasteboard pasteboard(pasteboardName);
-    pasteboard.writeSelectionForTypes(types.get(), selectedRange().get(), true, m_frame);
+    pasteboard.writeSelectionForTypes(pasteboardTypes, selectedRange().get(), true, m_frame);
 }
     
 void Editor::readSelectionFromPasteboard(const String& pasteboardName)
diff --git a/Source/WebCore/editing/markup.cpp b/Source/WebCore/editing/markup.cpp
index c9a0e78dd..c0c0bf4db 100644
--- a/Source/WebCore/editing/markup.cpp
+++ b/Source/WebCore/editing/markup.cpp
@@ -30,7 +30,6 @@
 #include "markup.h"
 
 #include "CDATASection.h"
-#include "CSSComputedStyleDeclaration.h"
 #include "CSSPrimitiveValue.h"
 #include "CSSProperty.h"
 #include "CSSPropertyNames.h"
diff --git a/Source/WebCore/editing/visible_units.cpp b/Source/WebCore/editing/visible_units.cpp
index ece6f233f..db8925946 100644
--- a/Source/WebCore/editing/visible_units.cpp
+++ b/Source/WebCore/editing/visible_units.cpp
@@ -361,7 +361,7 @@ static VisiblePosition startPositionForLine(const VisiblePosition& c, LineEndpoi
         }
     }
 
-    return startNode->isTextNode() ? Position(static_cast<Text*>(startNode), toInlineTextBox(startBox)->start())
+    return startNode->isTextNode() ? Position(toText(startNode), toInlineTextBox(startBox)->start())
         : positionBeforeNode(startNode);
 }
 
@@ -441,7 +441,7 @@ static VisiblePosition endPositionForLine(const VisiblePosition& c, LineEndpoint
         int endOffset = endTextBox->start();
         if (!endTextBox->isLineBreak())
             endOffset += endTextBox->len();
-        pos = Position(static_cast<Text*>(endNode), endOffset);
+        pos = Position(toText(endNode), endOffset);
     } else
         pos = positionAfterNode(endNode);
     
@@ -545,7 +545,7 @@ static inline IntPoint absoluteLineDirectionPointToLocalPointInBlock(RootInlineB
     RenderBlock* containingBlock = root->block();
     FloatPoint absoluteBlockPoint = containingBlock->localToAbsolute(FloatPoint());
     if (containingBlock->hasOverflowClip())
-        absoluteBlockPoint -= containingBlock->layer()->scrolledContentOffset();
+        absoluteBlockPoint -= containingBlock->scrolledContentOffset();
 
     if (root->block()->isHorizontalWritingMode())
         return IntPoint(lineDirectionPoint - absoluteBlockPoint.x(), root->blockDirectionPointInLine());
@@ -834,7 +834,7 @@ VisiblePosition startOfParagraph(const VisiblePosition& c, EditingBoundaryCrossi
                     i = max(0, o);
                 while (--i >= 0) {
                     if (chars[i] == '\n')
-                        return VisiblePosition(Position(static_cast<Text*>(n), i + 1), DOWNSTREAM);
+                        return VisiblePosition(Position(toText(n), i + 1), DOWNSTREAM);
                 }
             }
             node = n;
@@ -910,7 +910,7 @@ VisiblePosition endOfParagraph(const VisiblePosition &c, EditingBoundaryCrossing
                 int o = n == startNode ? offset : 0;
                 for (int i = o; i < length; ++i) {
                     if (chars[i] == '\n')
-                        return VisiblePosition(Position(static_cast<Text*>(n), i), DOWNSTREAM);
+                        return VisiblePosition(Position(toText(n), i), DOWNSTREAM);
                 }
             }
             node = n;
diff --git a/Source/WebCore/fileapi/Blob.idl b/Source/WebCore/fileapi/Blob.idl
index 1400dc1b3..29c5141d2 100644
--- a/Source/WebCore/fileapi/Blob.idl
+++ b/Source/WebCore/fileapi/Blob.idl
@@ -32,7 +32,7 @@ module html {
 
     interface [
         JSGenerateIsReachable=Impl,
-        JSCustomToJS,
+        CustomToJSObject,
         JSNoStaticTables
     ] Blob {
         readonly attribute unsigned long long size;
diff --git a/Source/WebCore/fileapi/DOMFileSystem.cpp b/Source/WebCore/fileapi/DOMFileSystem.cpp
index ac386903b..9799e1207 100644
--- a/Source/WebCore/fileapi/DOMFileSystem.cpp
+++ b/Source/WebCore/fileapi/DOMFileSystem.cpp
@@ -56,8 +56,9 @@ namespace WebCore {
 PassRefPtr<DOMFileSystem> DOMFileSystem::create(ScriptExecutionContext* context, const String& name, PassOwnPtr<AsyncFileSystem> asyncFileSystem)
 {
     RefPtr<DOMFileSystem> fileSystem(adoptRef(new DOMFileSystem(context, name, asyncFileSystem)));
+    fileSystem->suspendIfNeeded();
     InspectorInstrumentation::didOpenFileSystem(fileSystem.get());
-    return fileSystem;
+    return fileSystem.release();
 }
 
 DOMFileSystem::DOMFileSystem(ScriptExecutionContext* context, const String& name, PassOwnPtr<AsyncFileSystem> asyncFileSystem)
diff --git a/Source/WebCore/fileapi/DOMWindowFileSystem.cpp b/Source/WebCore/fileapi/DOMWindowFileSystem.cpp
new file mode 100644
index 000000000..570c39db2
--- /dev/null
+++ b/Source/WebCore/fileapi/DOMWindowFileSystem.cpp
@@ -0,0 +1,107 @@
+/*
+ * Copyright (C) 2012, Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+ * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+ * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH
+ * DAMAGE.
+ */
+
+#include "config.h"
+#include "DOMWindowFileSystem.h"
+
+#if ENABLE(FILE_SYSTEM)
+
+#include "AsyncFileSystem.h"
+#include "DOMFileSystem.h"
+#include "DOMWindow.h"
+#include "Document.h"
+#include "EntryCallback.h"
+#include "ErrorCallback.h"
+#include "FileError.h"
+#include "FileSystemCallback.h"
+#include "FileSystemCallbacks.h"
+#include "LocalFileSystem.h"
+#include "SecurityOrigin.h"
+
+namespace WebCore {
+
+DOMWindowFileSystem::DOMWindowFileSystem()
+{
+}
+
+DOMWindowFileSystem::~DOMWindowFileSystem()
+{
+}
+
+void DOMWindowFileSystem::webkitRequestFileSystem(DOMWindow* window, int type, long long size, PassRefPtr<FileSystemCallback> successCallback, PassRefPtr<ErrorCallback> errorCallback)
+{
+    if (!window->isCurrentlyDisplayedInFrame())
+        return;
+
+    Document* document = window->document();
+    if (!document)
+        return;
+
+    if (!AsyncFileSystem::isAvailable() || !document->securityOrigin()->canAccessFileSystem()) {
+        DOMFileSystem::scheduleCallback(document, errorCallback, FileError::create(FileError::SECURITY_ERR));
+        return;
+    }
+
+    AsyncFileSystem::Type fileSystemType = static_cast<AsyncFileSystem::Type>(type);
+    if (!AsyncFileSystem::isValidType(fileSystemType)) {
+        DOMFileSystem::scheduleCallback(document, errorCallback, FileError::create(FileError::INVALID_MODIFICATION_ERR));
+        return;
+    }
+
+    LocalFileSystem::localFileSystem().requestFileSystem(document, fileSystemType, size, FileSystemCallbacks::create(successCallback, errorCallback, document), false);
+}
+
+void DOMWindowFileSystem::webkitResolveLocalFileSystemURL(DOMWindow* window, const String& url, PassRefPtr<EntryCallback> successCallback, PassRefPtr<ErrorCallback> errorCallback)
+{
+    if (!window->isCurrentlyDisplayedInFrame())
+        return;
+
+    Document* document = window->document();
+    if (!document)
+        return;
+
+    SecurityOrigin* securityOrigin = document->securityOrigin();
+    KURL completedURL = document->completeURL(url);
+    if (!AsyncFileSystem::isAvailable() || !securityOrigin->canAccessFileSystem() || !securityOrigin->canRequest(completedURL)) {
+        DOMFileSystem::scheduleCallback(document, errorCallback, FileError::create(FileError::SECURITY_ERR));
+        return;
+    }
+
+    AsyncFileSystem::Type type;
+    String filePath;
+    if (!completedURL.isValid() || !AsyncFileSystem::crackFileSystemURL(completedURL, type, filePath)) {
+        DOMFileSystem::scheduleCallback(document, errorCallback, FileError::create(FileError::ENCODING_ERR));
+        return;
+    }
+
+    LocalFileSystem::localFileSystem().readFileSystem(document, type, ResolveURICallbacks::create(successCallback, errorCallback, document, filePath));
+}
+
+COMPILE_ASSERT(static_cast<int>(DOMWindowFileSystem::TEMPORARY) == static_cast<int>(AsyncFileSystem::Temporary), enum_mismatch);
+COMPILE_ASSERT(static_cast<int>(DOMWindowFileSystem::PERSISTENT) == static_cast<int>(AsyncFileSystem::Persistent), enum_mismatch);
+
+} // namespace WebCore
+
+#endif // ENABLE(FILE_SYSTEM)
diff --git a/Source/WebCore/fileapi/DOMWindowFileSystem.h b/Source/WebCore/fileapi/DOMWindowFileSystem.h
new file mode 100644
index 000000000..2783553a1
--- /dev/null
+++ b/Source/WebCore/fileapi/DOMWindowFileSystem.h
@@ -0,0 +1,63 @@
+/*
+ * Copyright (C) 2012, Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+ * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+ * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH
+ * DAMAGE.
+ */
+
+#ifndef DOMWindowFileSystem_h
+#define DOMWindowFileSystem_h
+
+#if ENABLE(FILE_SYSTEM)
+
+#include <wtf/PassRefPtr.h>
+#include <wtf/text/WTFString.h>
+
+namespace WebCore {
+
+class DOMWindow;
+class EntryCallback;
+class ErrorCallback;
+class FileSystemCallback;
+
+class DOMWindowFileSystem {
+public:
+
+    static void webkitRequestFileSystem(DOMWindow*, int type, long long size, PassRefPtr<FileSystemCallback>, PassRefPtr<ErrorCallback>);
+    static void webkitResolveLocalFileSystemURL(DOMWindow*, const String&, PassRefPtr<EntryCallback>, PassRefPtr<ErrorCallback>);
+
+    // They are placed here and in all capital letters so they can be checked against the constants in the
+    // IDL at compile time.
+    enum FileSystemType {
+        TEMPORARY,
+        PERSISTENT,
+    };
+
+private:
+    DOMWindowFileSystem();
+    ~DOMWindowFileSystem();
+};
+
+} // namespace WebCore
+
+#endif // ENABLE(FILE_SYSTEM)
+
+#endif // DOMWindowFileSystem_h
diff --git a/Source/WebCore/css/FontFamilyValue.h b/Source/WebCore/fileapi/DOMWindowFileSystem.idl
index b2fbaa29b..79947cbd7 100644
--- a/Source/WebCore/css/FontFamilyValue.h
+++ b/Source/WebCore/fileapi/DOMWindowFileSystem.idl
@@ -1,6 +1,5 @@
 /*
- * (C) 1999-2003 Lars Knoll (knoll@kde.org)
- * Copyright (C) 2004, 2005, 2006, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2012 Google Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -18,33 +17,19 @@
  * Boston, MA 02110-1301, USA.
  */
 
-#ifndef FontFamilyValue_h
-#define FontFamilyValue_h
+module window {
 
-#include "CSSPrimitiveValue.h"
-#include "PlatformString.h"
+    interface [
+        Conditional=FILE_SYSTEM,
+        Supplemental=DOMWindow
+    ] DOMWindowFileSystem {
+        const unsigned short TEMPORARY = 0;
+        const unsigned short PERSISTENT = 1;
 
-namespace WebCore {
+        [V8EnabledAtRuntime=FileSystem] void webkitRequestFileSystem(in unsigned short type, in long long size,
+                in [Callback] FileSystemCallback successCallback, in [Callback, Optional] ErrorCallback errorCallback);
+        [V8EnabledAtRuntime=FileSystem] void webkitResolveLocalFileSystemURL(in DOMString url,
+                in [Callback, Optional] EntryCallback successCallback, in [Callback, Optional] ErrorCallback errorCallback);
+    };
 
-class FontFamilyValue : public CSSPrimitiveValue {
-public:
-    static PassRefPtr<FontFamilyValue> create(const String& familyName)
-    {
-        return adoptRef(new FontFamilyValue(familyName));
-    }
-
-    void appendSpaceSeparated(const UChar* characters, unsigned length);
-
-    const String& familyName() const { return m_familyName; }
-
-    String customCssText() const;
-
-private:
-    FontFamilyValue(const String& familyName);
-
-    String m_familyName;
-};
-
-} // namespace
-
-#endif
+}
diff --git a/Source/WebCore/fileapi/DirectoryEntry.idl b/Source/WebCore/fileapi/DirectoryEntry.idl
index 7d9246502..c6c9ae9bb 100644
--- a/Source/WebCore/fileapi/DirectoryEntry.idl
+++ b/Source/WebCore/fileapi/DirectoryEntry.idl
@@ -32,7 +32,7 @@ module storage {
     interface [
         Conditional=FILE_SYSTEM,
         JSGenerateToNativeObject,
-        JSGenerateToJS,
+        JSGenerateToJSObject,
         JSNoStaticTables
     ] DirectoryEntry : Entry {
         DirectoryReader createReader();
diff --git a/Source/WebCore/fileapi/DirectoryEntrySync.idl b/Source/WebCore/fileapi/DirectoryEntrySync.idl
index e4ca8d7ea..66c288fbb 100644
--- a/Source/WebCore/fileapi/DirectoryEntrySync.idl
+++ b/Source/WebCore/fileapi/DirectoryEntrySync.idl
@@ -32,7 +32,7 @@ module storage {
     interface [
         Conditional=FILE_SYSTEM,
         JSGenerateToNativeObject,
-        JSGenerateToJS,
+        JSGenerateToJSObject,
         JSNoStaticTables
     ] DirectoryEntrySync : EntrySync {
         DirectoryReaderSync createReader() raises (FileException);
diff --git a/Source/WebCore/fileapi/Entry.idl b/Source/WebCore/fileapi/Entry.idl
index 4be6c8b75..c6cdba5bd 100644
--- a/Source/WebCore/fileapi/Entry.idl
+++ b/Source/WebCore/fileapi/Entry.idl
@@ -31,7 +31,7 @@
 module storage {
     interface [
         Conditional=FILE_SYSTEM,
-        JSCustomToJS,
+        CustomToJSObject,
         JSNoStaticTables
     ] Entry {
         readonly attribute boolean isFile;
diff --git a/Source/WebCore/fileapi/EntrySync.idl b/Source/WebCore/fileapi/EntrySync.idl
index 2db476d33..cd4bae7de 100644
--- a/Source/WebCore/fileapi/EntrySync.idl
+++ b/Source/WebCore/fileapi/EntrySync.idl
@@ -31,7 +31,7 @@
 module storage {
     interface [
         Conditional=FILE_SYSTEM,
-        JSCustomToJS,
+        CustomToJSObject,
         JSNoStaticTables
     ] EntrySync {
         readonly attribute boolean isFile;
diff --git a/Source/WebCore/fileapi/File.idl b/Source/WebCore/fileapi/File.idl
index 4a6bbd3cb..4c3bafc27 100644
--- a/Source/WebCore/fileapi/File.idl
+++ b/Source/WebCore/fileapi/File.idl
@@ -27,7 +27,7 @@ module html {
 
     interface [
         JSGenerateToNativeObject,
-        JSGenerateToJS,
+        JSGenerateToJSObject,
         JSNoStaticTables
     ] File : Blob {
         readonly attribute DOMString name;
diff --git a/Source/WebCore/fileapi/FileEntry.idl b/Source/WebCore/fileapi/FileEntry.idl
index d176cdeb8..63b004050 100644
--- a/Source/WebCore/fileapi/FileEntry.idl
+++ b/Source/WebCore/fileapi/FileEntry.idl
@@ -32,7 +32,7 @@ module storage {
     interface [
         Conditional=FILE_SYSTEM,
         JSGenerateToNativeObject,
-        JSGenerateToJS,
+        JSGenerateToJSObject,
         JSNoStaticTables
     ] FileEntry : Entry {
         void createWriter(in [Callback] FileWriterCallback successCallback, in [Optional, Callback] ErrorCallback errorCallback);
diff --git a/Source/WebCore/fileapi/FileEntrySync.idl b/Source/WebCore/fileapi/FileEntrySync.idl
index 0d79250da..8ac40baa2 100644
--- a/Source/WebCore/fileapi/FileEntrySync.idl
+++ b/Source/WebCore/fileapi/FileEntrySync.idl
@@ -32,7 +32,7 @@ module storage {
     interface [
         Conditional=FILE_SYSTEM,
         JSGenerateToNativeObject,
-        JSGenerateToJS,
+        JSGenerateToJSObject,
         JSNoStaticTables
     ] FileEntrySync : EntrySync {
         File file() raises (FileException);
diff --git a/Source/WebCore/fileapi/FileReader.cpp b/Source/WebCore/fileapi/FileReader.cpp
index 29c598470..07c4b6746 100644
--- a/Source/WebCore/fileapi/FileReader.cpp
+++ b/Source/WebCore/fileapi/FileReader.cpp
@@ -48,6 +48,13 @@ namespace WebCore {
 
 static const double progressNotificationIntervalMS = 50;
 
+PassRefPtr<FileReader> FileReader::create(ScriptExecutionContext* context)
+{
+    RefPtr<FileReader> fileReader(adoptRef(new FileReader(context)));
+    fileReader->suspendIfNeeded();
+    return fileReader.release();
+}
+
 FileReader::FileReader(ScriptExecutionContext* context)
     : ActiveDOMObject(context, this)
     , m_state(EMPTY)
diff --git a/Source/WebCore/fileapi/FileReader.h b/Source/WebCore/fileapi/FileReader.h
index 804dd291b..ecdd4856c 100644
--- a/Source/WebCore/fileapi/FileReader.h
+++ b/Source/WebCore/fileapi/FileReader.h
@@ -51,10 +51,7 @@ typedef int ExceptionCode;
 
 class FileReader : public RefCounted<FileReader>, public ActiveDOMObject, public EventTarget, public FileReaderLoaderClient {
 public:
-    static PassRefPtr<FileReader> create(ScriptExecutionContext* context)
-    {
-        return adoptRef(new FileReader(context));
-    }
+    static PassRefPtr<FileReader> create(ScriptExecutionContext*);
 
     virtual ~FileReader();
 
diff --git a/Source/WebCore/fileapi/FileReaderLoader.cpp b/Source/WebCore/fileapi/FileReaderLoader.cpp
index 5fb6061c0..e55149a31 100644
--- a/Source/WebCore/fileapi/FileReaderLoader.cpp
+++ b/Source/WebCore/fileapi/FileReaderLoader.cpp
@@ -68,7 +68,8 @@ FileReaderLoader::FileReaderLoader(ReadType readType, FileReaderLoaderClient* cl
 FileReaderLoader::~FileReaderLoader()
 {
     terminate();
-    ThreadableBlobRegistry::unregisterBlobURL(m_urlForReading);
+    if (!m_urlForReading.isEmpty())
+        ThreadableBlobRegistry::unregisterBlobURL(m_urlForReading);
 }
 
 void FileReaderLoader::start(ScriptExecutionContext* scriptExecutionContext, Blob* blob)
diff --git a/Source/WebCore/fileapi/FileReaderSync.cpp b/Source/WebCore/fileapi/FileReaderSync.cpp
index 1fe5c7f73..79e5200ea 100644
--- a/Source/WebCore/fileapi/FileReaderSync.cpp
+++ b/Source/WebCore/fileapi/FileReaderSync.cpp
@@ -49,8 +49,10 @@ FileReaderSync::FileReaderSync()
 
 PassRefPtr<ArrayBuffer> FileReaderSync::readAsArrayBuffer(ScriptExecutionContext* scriptExecutionContext, Blob* blob, ExceptionCode& ec)
 {
-    if (!blob)
+    if (!blob) {
+        ec = NOT_FOUND_ERR;
         return 0;
+    }
 
     FileReaderLoader loader(FileReaderLoader::ReadAsArrayBuffer, 0);
     startLoading(scriptExecutionContext, loader, blob, ec);
@@ -60,8 +62,10 @@ PassRefPtr<ArrayBuffer> FileReaderSync::readAsArrayBuffer(ScriptExecutionContext
 
 String FileReaderSync::readAsBinaryString(ScriptExecutionContext* scriptExecutionContext, Blob* blob, ExceptionCode& ec)
 {
-    if (!blob)
+    if (!blob) {
+        ec = NOT_FOUND_ERR;
         return String();
+    }
 
     FileReaderLoader loader(FileReaderLoader::ReadAsBinaryString, 0);
     startLoading(scriptExecutionContext, loader, blob, ec);
@@ -70,8 +74,10 @@ String FileReaderSync::readAsBinaryString(ScriptExecutionContext* scriptExecutio
 
 String FileReaderSync::readAsText(ScriptExecutionContext* scriptExecutionContext, Blob* blob, const String& encoding, ExceptionCode& ec)
 {
-    if (!blob)
+    if (!blob) {
+        ec = NOT_FOUND_ERR;
         return String();
+    }
 
     FileReaderLoader loader(FileReaderLoader::ReadAsText, 0);
     loader.setEncoding(encoding);
@@ -81,8 +87,10 @@ String FileReaderSync::readAsText(ScriptExecutionContext* scriptExecutionContext
 
 String FileReaderSync::readAsDataURL(ScriptExecutionContext* scriptExecutionContext, Blob* blob, ExceptionCode& ec)
 {
-    if (!blob)
+    if (!blob) {
+        ec = NOT_FOUND_ERR;
         return String();
+    }
 
     FileReaderLoader loader(FileReaderLoader::ReadAsDataURL, 0);
     loader.setDataType(blob->type());
diff --git a/Source/WebCore/fileapi/FileReaderSync.idl b/Source/WebCore/fileapi/FileReaderSync.idl
index 77250da29..920f36840 100644
--- a/Source/WebCore/fileapi/FileReaderSync.idl
+++ b/Source/WebCore/fileapi/FileReaderSync.idl
@@ -36,11 +36,11 @@ module html {
     ] FileReaderSync {
         [CallWith=ScriptExecutionContext] ArrayBuffer readAsArrayBuffer(in Blob blob)
             raises(FileException);
-        [CallWith=ScriptExecutionContext, ConvertScriptString] DOMString readAsBinaryString(in Blob blob)
+        [CallWith=ScriptExecutionContext] DOMString readAsBinaryString(in Blob blob)
             raises(FileException);
-        [CallWith=ScriptExecutionContext, ConvertScriptString] DOMString readAsText(in Blob blob, in [Optional] DOMString encoding)
+        [CallWith=ScriptExecutionContext] DOMString readAsText(in Blob blob, in [Optional] DOMString encoding)
             raises(FileException);
-        [CallWith=ScriptExecutionContext, ConvertScriptString] DOMString readAsDataURL(in Blob blob)
+        [CallWith=ScriptExecutionContext] DOMString readAsDataURL(in Blob blob)
             raises(FileException);
     };
 }
diff --git a/Source/WebCore/fileapi/FileThread.cpp b/Source/WebCore/fileapi/FileThread.cpp
index 4d55630e4..82bc686f6 100644
--- a/Source/WebCore/fileapi/FileThread.cpp
+++ b/Source/WebCore/fileapi/FileThread.cpp
@@ -83,13 +83,13 @@ void FileThread::unscheduleTasks(const void* instance)
     m_queue.removeIf(predicate);
 }
 
-void* FileThread::fileThreadStart(void* arg)
+void FileThread::fileThreadStart(void* arg)
 {
     FileThread* fileThread = static_cast<FileThread*>(arg);
-    return fileThread->runLoop();
+    fileThread->runLoop();
 }
 
-void* FileThread::runLoop()
+void FileThread::runLoop()
 {
     {
         // Wait for FileThread::start() to complete to have m_threadID
@@ -110,8 +110,6 @@ void* FileThread::runLoop()
 
     // Clear the self refptr, possibly resulting in deletion
     m_selfRef = 0;
-
-    return 0;
 }
 
 } // namespace WebCore
diff --git a/Source/WebCore/fileapi/FileThread.h b/Source/WebCore/fileapi/FileThread.h
index 9c1d267b3..6c3255b57 100644
--- a/Source/WebCore/fileapi/FileThread.h
+++ b/Source/WebCore/fileapi/FileThread.h
@@ -72,8 +72,8 @@ public:
 private:
     FileThread();
 
-    static void* fileThreadStart(void*);
-    void* runLoop();
+    static void fileThreadStart(void*);
+    void runLoop();
 
     ThreadIdentifier m_threadID;
     RefPtr<FileThread> m_selfRef;
diff --git a/Source/WebCore/fileapi/FileWriter.cpp b/Source/WebCore/fileapi/FileWriter.cpp
index 2b25cfaf9..7cd9b8348 100644
--- a/Source/WebCore/fileapi/FileWriter.cpp
+++ b/Source/WebCore/fileapi/FileWriter.cpp
@@ -45,6 +45,13 @@ namespace WebCore {
 
 static const int kMaxRecursionDepth = 3;
 
+PassRefPtr<FileWriter> FileWriter::create(ScriptExecutionContext* context)
+{
+    RefPtr<FileWriter> fileWriter(adoptRef(new FileWriter(context)));
+    fileWriter->suspendIfNeeded();
+    return fileWriter.release();
+}
+
 FileWriter::FileWriter(ScriptExecutionContext* context)
     : ActiveDOMObject(context, this)
     , m_readyState(INIT)
diff --git a/Source/WebCore/fileapi/FileWriter.h b/Source/WebCore/fileapi/FileWriter.h
index 2b597a188..946135072 100644
--- a/Source/WebCore/fileapi/FileWriter.h
+++ b/Source/WebCore/fileapi/FileWriter.h
@@ -48,10 +48,7 @@ class ScriptExecutionContext;
 
 class FileWriter : public FileWriterBase, public ActiveDOMObject, public EventTarget, public AsyncFileWriterClient {
 public:
-    static PassRefPtr<FileWriter> create(ScriptExecutionContext* context)
-    {
-        return adoptRef(new FileWriter(context));
-    }
+    static PassRefPtr<FileWriter> create(ScriptExecutionContext*);
 
     enum ReadyState {
         INIT = 0,
diff --git a/Source/WebCore/history/BackForwardController.cpp b/Source/WebCore/history/BackForwardController.cpp
index d89c9a550..1e8819aae 100644
--- a/Source/WebCore/history/BackForwardController.cpp
+++ b/Source/WebCore/history/BackForwardController.cpp
@@ -116,7 +116,13 @@ void BackForwardController::markPagesForFullStyleRecalc()
     for (int i = first; i <= last; i++) {
         if (!i)
             continue;
-        itemAtIndex(i)->markForFullStyleRecalc();
+
+        // FIXME: itemAtIndex should never return null here, but due to the way the
+        // back/forward list is implemented in WebKit2 it sometimes can, when the
+        // session has been updated in the UI process but the session update message
+        // hasn't yet reached the web process.
+        if (HistoryItem* historyItem = itemAtIndex(i))
+            historyItem->markForFullStyleRecalc();
     }
 }
 
diff --git a/Source/WebCore/history/CachedFrame.cpp b/Source/WebCore/history/CachedFrame.cpp
index 60fab043f..9b0d2fe82 100644
--- a/Source/WebCore/history/CachedFrame.cpp
+++ b/Source/WebCore/history/CachedFrame.cpp
@@ -168,7 +168,6 @@ CachedFrame::CachedFrame(Frame* frame)
     // but after we've fired the pagehide event, in case that creates more objects.
     // Suspending must also happen after we've recursed over child frames, in case
     // those create more objects.
-    // FIXME: It's still possible to have objects created after suspending in some cases, see http://webkit.org/b/53733 for more details.
     m_document->documentWillSuspendForPageCache();
     m_document->suspendScriptedAnimationControllerCallbacks();
     m_document->suspendActiveDOMObjects(ActiveDOMObject::DocumentWillBecomeInactive);
diff --git a/Source/WebCore/history/PageCache.cpp b/Source/WebCore/history/PageCache.cpp
index 2a083619c..a0d5de4d9 100644
--- a/Source/WebCore/history/PageCache.cpp
+++ b/Source/WebCore/history/PageCache.cpp
@@ -199,11 +199,11 @@ static void logCanCachePageDecision(Page* page)
         cannotCache = true;
     }
 #if ENABLE(DEVICE_ORIENTATION)
-    if (page->deviceMotionController() && page->deviceMotionController()->isActive()) {
+    if (DeviceMotionController::isActiveAt(page)) {
         PCLOG("   -Page is using DeviceMotion");
         cannotCache = true;
     }
-    if (page->deviceOrientationController() && page->deviceOrientationController()->isActive()) {
+    if (DeviceOrientationController::isActiveAt(page)) {
         PCLOG("   -Page is using DeviceOrientation");
         cannotCache = true;
     }
@@ -251,29 +251,33 @@ bool PageCache::canCachePageContainingThisFrame(Frame* frame)
             return false;
     }
     
-    return frame->loader()->documentLoader()
-        && frame->loader()->documentLoader()->mainDocumentError().isNull()
+    FrameLoader* frameLoader = frame->loader();
+    DocumentLoader* documentLoader = frameLoader->documentLoader();
+    Document* document = frame->document();
+    
+    return documentLoader
+        && documentLoader->mainDocumentError().isNull()
         // Do not cache error pages (these can be recognized as pages with substitute data or unreachable URLs).
-        && !(frame->loader()->documentLoader()->substituteData().isValid() && !frame->loader()->documentLoader()->substituteData().failingURL().isEmpty())
-        && (!frame->loader()->subframeLoader()->containsPlugins() || frame->page()->settings()->pageCacheSupportsPlugins())
-        && !frame->document()->url().protocolIs("https")
+        && !(documentLoader->substituteData().isValid() && !documentLoader->substituteData().failingURL().isEmpty())
+        && (!frameLoader->subframeLoader()->containsPlugins() || frame->page()->settings()->pageCacheSupportsPlugins())
+        && (!document->url().protocolIs("https") || (!documentLoader->response().cacheControlContainsNoCache() && !documentLoader->response().cacheControlContainsNoStore()))
         && (!frame->domWindow() || !frame->domWindow()->hasEventListeners(eventNames().unloadEvent))
 #if ENABLE(SQL_DATABASE)
-        && !frame->document()->hasOpenDatabases()
+        && !document->hasOpenDatabases()
 #endif
 #if ENABLE(SHARED_WORKERS)
-        && !SharedWorkerRepository::hasSharedWorkers(frame->document())
+        && !SharedWorkerRepository::hasSharedWorkers(document)
 #endif
-        && !frame->document()->usingGeolocation()
-        && frame->loader()->history()->currentItem()
-        && !frame->loader()->quickRedirectComing()
-        && !frame->loader()->documentLoader()->isLoadingInAPISense()
-        && !frame->loader()->documentLoader()->isStopping()
-        && frame->document()->canSuspendActiveDOMObjects()
+        && !document->usingGeolocation()
+        && frameLoader->history()->currentItem()
+        && !frameLoader->quickRedirectComing()
+        && !documentLoader->isLoadingInAPISense()
+        && !documentLoader->isStopping()
+        && document->canSuspendActiveDOMObjects()
         // FIXME: We should investigating caching frames that have an associated
         // application cache. <rdar://problem/5917899> tracks that work.
-        && frame->loader()->documentLoader()->applicationCacheHost()->canCacheInPageCache()
-        && frame->loader()->client()->canCachePage();
+        && documentLoader->applicationCacheHost()->canCacheInPageCache()
+        && frameLoader->client()->canCachePage();
 }
     
 bool PageCache::canCache(Page* page)
@@ -296,8 +300,8 @@ bool PageCache::canCache(Page* page)
         && page->backForward()->isActive()
         && page->settings()->usesPageCache()
 #if ENABLE(DEVICE_ORIENTATION)
-        && !(page->deviceMotionController() && page->deviceMotionController()->isActive())
-        && !(page->deviceOrientationController() && page->deviceOrientationController()->isActive())
+        && !DeviceMotionController::isActiveAt(page)
+        && !DeviceOrientationController::isActiveAt(page)
 #endif
         && loadType != FrameLoadTypeReload
         && loadType != FrameLoadTypeReloadFromOrigin
diff --git a/Source/WebCore/html/BaseButtonInputType.cpp b/Source/WebCore/html/BaseButtonInputType.cpp
index 11546eddd..9a1616fce 100644
--- a/Source/WebCore/html/BaseButtonInputType.cpp
+++ b/Source/WebCore/html/BaseButtonInputType.cpp
@@ -100,7 +100,7 @@ bool BaseButtonInputType::storesValueSeparateFromAttribute()
     return false;
 }
 
-void BaseButtonInputType::setValue(const String& sanitizedValue, bool, bool)
+void BaseButtonInputType::setValue(const String& sanitizedValue, bool, TextFieldEventBehavior)
 {
     element()->setAttribute(valueAttr, sanitizedValue);
 }
diff --git a/Source/WebCore/html/BaseButtonInputType.h b/Source/WebCore/html/BaseButtonInputType.h
index dabc27cac..1b7543c05 100644
--- a/Source/WebCore/html/BaseButtonInputType.h
+++ b/Source/WebCore/html/BaseButtonInputType.h
@@ -48,7 +48,7 @@ private:
     virtual RenderObject* createRenderer(RenderArena*, RenderStyle*) const OVERRIDE;
     virtual void accessKeyAction(bool sendMouseEvents) OVERRIDE;
     virtual bool storesValueSeparateFromAttribute() OVERRIDE;
-    virtual void setValue(const String&, bool, bool) OVERRIDE;
+    virtual void setValue(const String&, bool, TextFieldEventBehavior) OVERRIDE;
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/html/BaseCheckableInputType.cpp b/Source/WebCore/html/BaseCheckableInputType.cpp
index 70f539d80..ff28dae36 100644
--- a/Source/WebCore/html/BaseCheckableInputType.cpp
+++ b/Source/WebCore/html/BaseCheckableInputType.cpp
@@ -104,7 +104,7 @@ bool BaseCheckableInputType::storesValueSeparateFromAttribute()
     return false;
 }
 
-void BaseCheckableInputType::setValue(const String& sanitizedValue, bool, bool)
+void BaseCheckableInputType::setValue(const String& sanitizedValue, bool, TextFieldEventBehavior)
 {
     element()->setAttribute(valueAttr, sanitizedValue);
 }
diff --git a/Source/WebCore/html/BaseCheckableInputType.h b/Source/WebCore/html/BaseCheckableInputType.h
index 2c2c4ad3c..4211ad521 100644
--- a/Source/WebCore/html/BaseCheckableInputType.h
+++ b/Source/WebCore/html/BaseCheckableInputType.h
@@ -50,7 +50,7 @@ private:
     virtual void accessKeyAction(bool sendMouseEvents) OVERRIDE;
     virtual String fallbackValue() const OVERRIDE;
     virtual bool storesValueSeparateFromAttribute() OVERRIDE;
-    virtual void setValue(const String&, bool, bool) OVERRIDE;
+    virtual void setValue(const String&, bool, TextFieldEventBehavior) OVERRIDE;
     virtual bool isCheckable() OVERRIDE;
 };
 
diff --git a/Source/WebCore/html/BaseDateAndTimeInputType.cpp b/Source/WebCore/html/BaseDateAndTimeInputType.cpp
index 46366729f..2904f2e85 100644
--- a/Source/WebCore/html/BaseDateAndTimeInputType.cpp
+++ b/Source/WebCore/html/BaseDateAndTimeInputType.cpp
@@ -65,9 +65,9 @@ double BaseDateAndTimeInputType::valueAsNumber() const
     return parseToDouble(element()->value(), numeric_limits<double>::quiet_NaN());
 }
 
-void BaseDateAndTimeInputType::setValueAsNumber(double newValue, bool sendChangeEvent, ExceptionCode&) const
+void BaseDateAndTimeInputType::setValueAsNumber(double newValue, TextFieldEventBehavior eventBehavior, ExceptionCode&) const
 {
-    element()->setValue(serialize(newValue), sendChangeEvent);
+    element()->setValue(serialize(newValue), eventBehavior);
 }
 
 bool BaseDateAndTimeInputType::typeMismatchFor(const String& value) const
diff --git a/Source/WebCore/html/BaseDateAndTimeInputType.h b/Source/WebCore/html/BaseDateAndTimeInputType.h
index 46c0c9d8d..e34535060 100644
--- a/Source/WebCore/html/BaseDateAndTimeInputType.h
+++ b/Source/WebCore/html/BaseDateAndTimeInputType.h
@@ -52,7 +52,7 @@ private:
     virtual double valueAsDate() const OVERRIDE;
     virtual void setValueAsDate(double, ExceptionCode&) const OVERRIDE;
     virtual double valueAsNumber() const OVERRIDE;
-    virtual void setValueAsNumber(double, bool sendChangeEvent, ExceptionCode&) const OVERRIDE;
+    virtual void setValueAsNumber(double, TextFieldEventBehavior, ExceptionCode&) const OVERRIDE;
     virtual bool typeMismatchFor(const String&) const OVERRIDE;
     virtual bool typeMismatch() const OVERRIDE;
     virtual bool rangeUnderflow(const String&) const OVERRIDE;
diff --git a/Source/WebCore/html/CheckboxInputType.cpp b/Source/WebCore/html/CheckboxInputType.cpp
index 4e9663443..02967bbf4 100644
--- a/Source/WebCore/html/CheckboxInputType.cpp
+++ b/Source/WebCore/html/CheckboxInputType.cpp
@@ -80,7 +80,7 @@ PassOwnPtr<ClickHandlingState> CheckboxInputType::willDispatchClick()
     if (state->indeterminate)
         element()->setIndeterminate(false);
 
-    element()->setChecked(!state->checked, true);
+    element()->setChecked(!state->checked, DispatchChangeEvent);
 
     return state.release();
 }
diff --git a/Source/WebCore/html/ColorInputType.cpp b/Source/WebCore/html/ColorInputType.cpp
index 071cc3416..83647ea6a 100644
--- a/Source/WebCore/html/ColorInputType.cpp
+++ b/Source/WebCore/html/ColorInputType.cpp
@@ -106,6 +106,8 @@ Color ColorInputType::valueAsColor() const
 
 void ColorInputType::createShadowSubtree()
 {
+    ASSERT(element()->hasShadowRoot());
+
     Document* document = element()->document();
     RefPtr<HTMLDivElement> wrapperElement = HTMLDivElement::create(document);
     wrapperElement->setShadowPseudoId("-webkit-color-swatch-wrapper");
@@ -114,15 +116,15 @@ void ColorInputType::createShadowSubtree()
     ExceptionCode ec = 0;
     wrapperElement->appendChild(colorSwatch.release(), ec);
     ASSERT(!ec);
-    element()->ensureShadowRoot()->appendChild(wrapperElement.release(), ec);
+    element()->shadowRootList()->oldestShadowRoot()->appendChild(wrapperElement.release(), ec);
     ASSERT(!ec);
     
     updateColorSwatch();
 }
 
-void ColorInputType::setValue(const String& value, bool valueChanged, bool sendChangeEvent)
+void ColorInputType::setValue(const String& value, bool valueChanged, TextFieldEventBehavior eventBehavior)
 {
-    InputType::setValue(value, valueChanged, sendChangeEvent);
+    InputType::setValue(value, valueChanged, eventBehavior);
 
     if (!valueChanged)
         return;
@@ -178,12 +180,12 @@ void ColorInputType::updateColorSwatch()
     if (!colorSwatch)
         return;
 
-    colorSwatch->ensureInlineStyleDecl()->setProperty(CSSPropertyBackgroundColor, element()->value(), false);
+    colorSwatch->setInlineStyleProperty(CSSPropertyBackgroundColor, element()->value(), false);
 }
 
 HTMLElement* ColorInputType::shadowColorSwatch() const
 {
-    ShadowRoot* shadow = element()->shadowRoot();
+    ShadowRoot* shadow = element()->shadowRootList()->oldestShadowRoot();
     return shadow ? toHTMLElement(shadow->firstChild()->firstChild()) : 0;
 }
 
diff --git a/Source/WebCore/html/ColorInputType.h b/Source/WebCore/html/ColorInputType.h
index 3e064bd44..f92b91ced 100644
--- a/Source/WebCore/html/ColorInputType.h
+++ b/Source/WebCore/html/ColorInputType.h
@@ -55,7 +55,7 @@ private:
     virtual String fallbackValue() const OVERRIDE;
     virtual String sanitizeValue(const String&) const OVERRIDE;
     virtual void createShadowSubtree() OVERRIDE;
-    virtual void setValue(const String&, bool valueChanged, bool sendChangeEvent) OVERRIDE;
+    virtual void setValue(const String&, bool valueChanged, TextFieldEventBehavior) OVERRIDE;
     virtual void handleDOMActivateEvent(Event*) OVERRIDE;
     virtual void detach() OVERRIDE;
 
diff --git a/Source/WebCore/html/DOMFormData.idl b/Source/WebCore/html/DOMFormData.idl
index 73ac211e1..4bab556be 100644
--- a/Source/WebCore/html/DOMFormData.idl
+++ b/Source/WebCore/html/DOMFormData.idl
@@ -33,13 +33,14 @@ module html {
     interface [
         CustomConstructor,
         JSGenerateToNativeObject,
-        JSGenerateToJS
+        JSGenerateToJSObject,
+        InterfaceName=FormData
     ] DOMFormData {
         // void append(DOMString name, DOMString value);
         // void append(DOMString name, Blob value, optional DOMString filename);
-        [Custom] void append(in [Optional=CallWithDefaultValue] DOMString name, 
-                             in [Optional=CallWithDefaultValue] DOMString value,
-                             in [Optional=CallWithDefaultValue] DOMString filename);
+        [Custom] void append(in [Optional=DefaultIsUndefined] DOMString name, 
+                             in [Optional=DefaultIsUndefined] DOMString value,
+                             in [Optional=DefaultIsUndefined] DOMString filename);
     };
 
 }
diff --git a/Source/WebCore/html/DOMSettableTokenList.idl b/Source/WebCore/html/DOMSettableTokenList.idl
index f0646e5a0..93bf67f69 100644
--- a/Source/WebCore/html/DOMSettableTokenList.idl
+++ b/Source/WebCore/html/DOMSettableTokenList.idl
@@ -26,7 +26,7 @@ module core {
 
     interface [
         IndexedGetter,
-        JSGenerateToJS
+        JSGenerateToJSObject
     ] DOMSettableTokenList : DOMTokenList {
         attribute DOMString value;
     };
diff --git a/Source/WebCore/html/DOMTokenList.idl b/Source/WebCore/html/DOMTokenList.idl
index 88169acb9..55b636f7d 100644
--- a/Source/WebCore/html/DOMTokenList.idl
+++ b/Source/WebCore/html/DOMTokenList.idl
@@ -26,10 +26,11 @@ module core {
 
     interface [
         JSGenerateIsReachable=ImplElementRoot,
-        IndexedGetter
+        IndexedGetter,
+        V8CustomToJSObject
     ] DOMTokenList {
         readonly attribute unsigned long length;
-        [ConvertNullStringTo=Null] DOMString item(in unsigned long index);
+        [TreatReturnedNullStringAs=Null] DOMString item(in unsigned long index);
         boolean contains(in DOMString token) raises(DOMException);
         void add(in DOMString token) raises(DOMException);
         void remove(in DOMString token) raises(DOMException);
diff --git a/Source/WebCore/html/DOMURL.cpp b/Source/WebCore/html/DOMURL.cpp
index 086bf778c..36a401a22 100644
--- a/Source/WebCore/html/DOMURL.cpp
+++ b/Source/WebCore/html/DOMURL.cpp
@@ -34,6 +34,7 @@
 #include "Blob.h"
 #include "BlobURL.h"
 #include "KURL.h"
+#include "MemoryCache.h"
 #include "PublicURLManager.h"
 #include "ScriptExecutionContext.h"
 #include "SecurityOrigin.h"
@@ -89,6 +90,8 @@ void DOMURL::revokeObjectURL(ScriptExecutionContext* scriptExecutionContext, con
         return;
 
     KURL url(KURL(), urlString);
+    if (CachedResource* resource = memoryCache()->resourceForURL(url))
+        memoryCache()->remove(resource);
 
     HashSet<String>& blobURLs = scriptExecutionContext->publicURLManager().blobURLs();
     if (blobURLs.contains(url.string())) {
diff --git a/Source/WebCore/html/DOMURL.idl b/Source/WebCore/html/DOMURL.idl
index 4f9722df3..e929ca86f 100644
--- a/Source/WebCore/html/DOMURL.idl
+++ b/Source/WebCore/html/DOMURL.idl
@@ -29,13 +29,13 @@ module html {
         Conditional=BLOB,
         Constructor,
         JSGenerateToNativeObject,
-        JSGenerateToJS,
+        JSGenerateToJSObject,
         JSNoStaticTables
     ] DOMURL {
 #if defined(ENABLE_MEDIA_STREAM) && ENABLE_MEDIA_STREAM
-        static [CallWith=ScriptExecutionContext,ConvertNullStringTo=Undefined] DOMString createObjectURL(in MediaStream stream);
+        static [CallWith=ScriptExecutionContext,TreatReturnedNullStringAs=Undefined] DOMString createObjectURL(in MediaStream stream);
 #endif
-        static [CallWith=ScriptExecutionContext,ConvertNullStringTo=Undefined] DOMString createObjectURL(in Blob blob);
+        static [CallWith=ScriptExecutionContext,TreatReturnedNullStringAs=Undefined] DOMString createObjectURL(in Blob blob);
         static [CallWith=ScriptExecutionContext] void revokeObjectURL(in DOMString url);
     };
 }
diff --git a/Source/WebCore/html/DOMWindowHTML.idl b/Source/WebCore/html/DOMWindowHTML.idl
new file mode 100644
index 000000000..889c3a00e
--- /dev/null
+++ b/Source/WebCore/html/DOMWindowHTML.idl
@@ -0,0 +1,119 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ */
+
+module window {
+
+    // FIXME: Most of this could/should be generated from make_names.pl/HTMLNames.in
+    // to reduce the chance that we forget a constructor when adding a new element.
+    interface [
+        Supplemental=DOMWindow
+    ] DOMWindowHTML {
+
+        attribute HTMLDocumentConstructor HTMLDocument;
+        attribute HTMLElementConstructor HTMLElement;
+        attribute HTMLAnchorElementConstructor HTMLAnchorElement;
+        attribute HTMLAppletElementConstructor HTMLAppletElement;
+        attribute HTMLAreaElementConstructor HTMLAreaElement;
+        attribute HTMLBRElementConstructor HTMLBRElement;
+        attribute HTMLBaseElementConstructor HTMLBaseElement;
+        attribute HTMLBaseFontElementConstructor HTMLBaseFontElement;
+        attribute HTMLBodyElementConstructor HTMLBodyElement;
+        attribute HTMLButtonElementConstructor HTMLButtonElement;
+        attribute HTMLCanvasElementConstructor HTMLCanvasElement;
+        attribute HTMLDListElementConstructor HTMLDListElement;
+        attribute HTMLDirectoryElementConstructor HTMLDirectoryElement;
+        attribute HTMLDivElementConstructor HTMLDivElement;
+        attribute HTMLEmbedElementConstructor HTMLEmbedElement;
+        attribute HTMLFieldSetElementConstructor HTMLFieldSetElement;
+        attribute HTMLFontElementConstructor HTMLFontElement;
+        attribute HTMLFormElementConstructor HTMLFormElement;
+        attribute HTMLFrameElementConstructor HTMLFrameElement;
+        attribute HTMLFrameSetElementConstructor HTMLFrameSetElement;
+        attribute HTMLHRElementConstructor HTMLHRElement;
+        attribute HTMLHeadElementConstructor HTMLHeadElement;
+        attribute HTMLHeadingElementConstructor HTMLHeadingElement;
+        attribute HTMLHtmlElementConstructor HTMLHtmlElement;
+        attribute HTMLIFrameElementConstructor HTMLIFrameElement;
+        attribute HTMLImageElementConstructor HTMLImageElement;
+        attribute HTMLInputElementConstructor HTMLInputElement;
+        attribute HTMLKeygenElementConstructor HTMLKeygenElement;
+        attribute HTMLLIElementConstructor HTMLLIElement;
+        attribute HTMLLabelElementConstructor HTMLLabelElement;
+        attribute HTMLLegendElementConstructor HTMLLegendElement;
+        attribute HTMLLinkElementConstructor HTMLLinkElement;
+        attribute HTMLMapElementConstructor HTMLMapElement;
+        attribute HTMLMarqueeElementConstructor HTMLMarqueeElement;
+        attribute HTMLMenuElementConstructor HTMLMenuElement;
+        attribute HTMLMetaElementConstructor HTMLMetaElement;
+#if defined(ENABLE_METER_TAG) && ENABLE_METER_TAG
+        attribute HTMLMeterElementConstructor HTMLMeterElement;
+#endif
+        attribute HTMLModElementConstructor HTMLModElement;
+        attribute HTMLOListElementConstructor HTMLOListElement;
+        attribute HTMLObjectElementConstructor HTMLObjectElement;
+        attribute HTMLOptGroupElementConstructor HTMLOptGroupElement;
+        attribute HTMLOptionElementConstructor HTMLOptionElement;
+        attribute HTMLOutputElementConstructor HTMLOutputElement;
+        attribute HTMLParagraphElementConstructor HTMLParagraphElement;
+        attribute HTMLParamElementConstructor HTMLParamElement;
+        attribute HTMLPreElementConstructor HTMLPreElement;
+#if defined(ENABLE_PROGRESS_TAG) && ENABLE_PROGRESS_TAG
+        attribute HTMLProgressElementConstructor HTMLProgressElement;
+#endif
+        attribute HTMLQuoteElementConstructor HTMLQuoteElement;
+        attribute HTMLScriptElementConstructor HTMLScriptElement;
+        attribute HTMLSelectElementConstructor HTMLSelectElement;
+        attribute HTMLSpanElementConstructor HTMLSpanElement;
+        attribute HTMLStyleElementConstructor HTMLStyleElement;
+        attribute HTMLTableCaptionElementConstructor HTMLTableCaptionElement;
+        attribute HTMLTableCellElementConstructor HTMLTableCellElement;
+        attribute HTMLTableColElementConstructor HTMLTableColElement;
+        attribute HTMLTableElementConstructor HTMLTableElement;
+        attribute HTMLTableRowElementConstructor HTMLTableRowElement;
+        attribute HTMLTableSectionElementConstructor HTMLTableSectionElement;
+        attribute HTMLTextAreaElementConstructor HTMLTextAreaElement;
+        attribute HTMLTitleElementConstructor HTMLTitleElement;
+        attribute HTMLUListElementConstructor HTMLUListElement;
+
+        attribute HTMLCollectionConstructor HTMLCollection;
+        attribute HTMLAllCollectionConstructor HTMLAllCollection;
+        attribute [Conditional=MICRODATA] HTMLPropertiesCollectionConstructor HTMLPropertiesCollection;
+        attribute HTMLUnknownElementConstructor HTMLUnknownElement;
+
+        attribute [JSCustomGetter, CustomConstructor] HTMLImageElementConstructorConstructor Image; // Usable with new operator
+        attribute [JSCustomGetter] HTMLOptionElementConstructorConstructor Option; // Usable with new operator
+
+        attribute [Conditional=VIDEO_TRACK, V8EnabledAtRuntime=webkitVideoTrack] HTMLTrackElementConstructor HTMLTrackElement;
+        attribute [Conditional=VIDEO_TRACK, V8EnabledAtRuntime=webkitVideoTrack] TextTrackConstructor TextTrack;
+        attribute [Conditional=VIDEO_TRACK, V8EnabledAtRuntime=webkitVideoTrack] TextTrackCueConstructor TextTrackCue; // Usable with the new operator
+        attribute [Conditional=VIDEO_TRACK, V8EnabledAtRuntime=webkitVideoTrack] TextTrackCueListConstructor TextTrackCueList;
+        attribute [Conditional=VIDEO_TRACK, V8EnabledAtRuntime=webkitVideoTrack] TextTrackListConstructor TextTrackList;
+        attribute [Conditional=VIDEO_TRACK, V8EnabledAtRuntime=webkitVideoTrack] TrackEventConstructor TrackEvent;
+
+        attribute [JSCustomGetter, Conditional=VIDEO, V8EnabledAtRuntime] HTMLAudioElementConstructorConstructor Audio; // Usable with the new operator
+        attribute [Conditional=VIDEO, V8EnabledAtRuntime] HTMLAudioElementConstructor HTMLAudioElement;
+        attribute [Conditional=VIDEO, V8EnabledAtRuntime] HTMLMediaElementConstructor HTMLMediaElement;
+        attribute [Conditional=VIDEO, V8EnabledAtRuntime] HTMLVideoElementConstructor HTMLVideoElement;
+        attribute [Conditional=VIDEO, V8EnabledAtRuntime] MediaErrorConstructor MediaError;
+        attribute [Conditional=VIDEO, V8EnabledAtRuntime] TimeRangesConstructor TimeRanges;
+        attribute [Conditional=VIDEO, V8EnabledAtRuntime] HTMLSourceElementConstructor HTMLSourceElement;
+        attribute [Conditional=VIDEO, V8EnabledAtRuntime] MediaControllerConstructor MediaController;
+    };
+
+}
diff --git a/Source/WebCore/html/FileInputType.cpp b/Source/WebCore/html/FileInputType.cpp
index ea9a2ee68..5759f6741 100644
--- a/Source/WebCore/html/FileInputType.cpp
+++ b/Source/WebCore/html/FileInputType.cpp
@@ -36,6 +36,7 @@
 #include "RenderFileUploadControl.h"
 #include "ScriptController.h"
 #include "ShadowRoot.h"
+#include "ShadowRootList.h"
 #include <wtf/PassOwnPtr.h>
 #include <wtf/text/StringBuilder.h>
 #include <wtf/text/WTFString.h>
@@ -217,7 +218,7 @@ bool FileInputType::storesValueSeparateFromAttribute()
     return true;
 }
 
-void FileInputType::setValue(const String&, bool, bool)
+void FileInputType::setValue(const String&, bool, TextFieldEventBehavior)
 {
     m_fileList->clear();
     m_icon.clear();
@@ -265,13 +266,15 @@ bool FileInputType::isFileUpload() const
 
 void FileInputType::createShadowSubtree()
 {
+    ASSERT(element()->hasShadowRoot());
     ExceptionCode ec = 0;
-    element()->ensureShadowRoot()->appendChild(element()->multiple() ? UploadButtonElement::createForMultiple(element()->document()): UploadButtonElement::create(element()->document()), ec);
+    element()->shadowRootList()->oldestShadowRoot()->appendChild(element()->multiple() ? UploadButtonElement::createForMultiple(element()->document()): UploadButtonElement::create(element()->document()), ec);
 }
 
 void FileInputType::multipleAttributeChanged()
 {
-    UploadButtonElement* button = static_cast<UploadButtonElement*>(element()->ensureShadowRoot()->firstChild());
+    ASSERT(element()->hasShadowRoot());
+    UploadButtonElement* button = static_cast<UploadButtonElement*>(element()->shadowRootList()->oldestShadowRoot()->firstChild());
     if (button)
         button->setValue(element()->multiple() ? fileButtonChooseMultipleFilesLabel() : fileButtonChooseFileLabel());
 }
diff --git a/Source/WebCore/html/FileInputType.h b/Source/WebCore/html/FileInputType.h
index b5a5d196d..53575a420 100644
--- a/Source/WebCore/html/FileInputType.h
+++ b/Source/WebCore/html/FileInputType.h
@@ -59,7 +59,7 @@ private:
     virtual bool canSetValue(const String&) OVERRIDE;
     virtual bool getTypeSpecificValue(String&) OVERRIDE; // Checked first, before internal storage or the value attribute.
     virtual bool storesValueSeparateFromAttribute() OVERRIDE;
-    virtual void setValue(const String&, bool valueChanged, bool sendChangeEvent) OVERRIDE;
+    virtual void setValue(const String&, bool valueChanged, TextFieldEventBehavior) OVERRIDE;
     virtual void receiveDroppedFiles(const Vector<String>&) OVERRIDE;
     virtual Icon* icon() const OVERRIDE;
     virtual bool isFileUpload() const OVERRIDE;
diff --git a/Source/WebCore/html/HTMLAllCollection.idl b/Source/WebCore/html/HTMLAllCollection.idl
index 3068e40fd..5ceae016c 100644
--- a/Source/WebCore/html/HTMLAllCollection.idl
+++ b/Source/WebCore/html/HTMLAllCollection.idl
@@ -33,7 +33,7 @@ module html {
         JSGenerateIsReachable
     ] HTMLAllCollection {
         readonly attribute unsigned long length;
-        [Custom] Node item(in [Optional=CallWithDefaultValue] unsigned long index);
+        [Custom] Node item(in [Optional=DefaultIsUndefined] unsigned long index);
         [Custom] Node namedItem(in DOMString name);
 
         // FIXME: This should return an HTMLAllCollection.
diff --git a/Source/WebCore/html/HTMLAnchorElement.cpp b/Source/WebCore/html/HTMLAnchorElement.cpp
index 8b932b4fa..cf86b283f 100644
--- a/Source/WebCore/html/HTMLAnchorElement.cpp
+++ b/Source/WebCore/html/HTMLAnchorElement.cpp
@@ -293,7 +293,7 @@ void HTMLAnchorElement::setRel(const String& value)
 
 const AtomicString& HTMLAnchorElement::name() const
 {
-    return getAttribute(nameAttr);
+    return getNameAttribute();
 }
 
 short HTMLAnchorElement::tabIndex() const
@@ -489,7 +489,7 @@ void HTMLAnchorElement::sendPings(const KURL& destinationURL)
     if (!hasAttribute(pingAttr) || !document()->settings()->hyperlinkAuditingEnabled())
         return;
 
-    SpaceSplitString pingURLs(getAttribute(pingAttr), true);
+    SpaceSplitString pingURLs(getAttribute(pingAttr), false);
     for (unsigned i = 0; i < pingURLs.size(); i++)
         PingLoader::sendPing(document()->frame(), document()->completeURL(pingURLs[i]), destinationURL);
 }
diff --git a/Source/WebCore/html/HTMLAnchorElement.idl b/Source/WebCore/html/HTMLAnchorElement.idl
index 3c40b73b6..7bd174c63 100644
--- a/Source/WebCore/html/HTMLAnchorElement.idl
+++ b/Source/WebCore/html/HTMLAnchorElement.idl
@@ -35,6 +35,10 @@ module html {
         attribute [Reflect] DOMString type;
 
 #if defined(LANGUAGE_OBJECTIVE_C) && LANGUAGE_OBJECTIVE_C
+        attribute [Reflect] DOMString accessKey;
+#endif
+
+#if defined(LANGUAGE_OBJECTIVE_C) && LANGUAGE_OBJECTIVE_C
         readonly attribute DOMString hash;
         readonly attribute DOMString host;
         readonly attribute DOMString hostname;
diff --git a/Source/WebCore/html/HTMLAppletElement.cpp b/Source/WebCore/html/HTMLAppletElement.cpp
index df55cd901..af63d2677 100644
--- a/Source/WebCore/html/HTMLAppletElement.cpp
+++ b/Source/WebCore/html/HTMLAppletElement.cpp
@@ -78,7 +78,7 @@ RenderObject* HTMLAppletElement::createRenderer(RenderArena*, RenderStyle* style
         if (!codeBase.isNull())
             args.set("codeBase", codeBase);
 
-        const AtomicString& name = document()->isHTMLDocument() ? getAttribute(nameAttr) : getIdAttribute();
+        const AtomicString& name = document()->isHTMLDocument() ? getNameAttribute() : getIdAttribute();
         if (!name.isNull())
             args.set("name", name);
         const AtomicString& archive = getAttribute(archiveAttr);
diff --git a/Source/WebCore/html/HTMLAppletElement.idl b/Source/WebCore/html/HTMLAppletElement.idl
index 6a683d7fc..8f16a400f 100644
--- a/Source/WebCore/html/HTMLAppletElement.idl
+++ b/Source/WebCore/html/HTMLAppletElement.idl
@@ -22,7 +22,7 @@ module html {
 
     interface [
         CustomNamedSetter,
-        JSCustomGetOwnPropertySlotDelegate,
+        JSCustomGetOwnPropertySlotAndDescriptor,
         CustomCall
     ] HTMLAppletElement : HTMLElement {
         attribute [Reflect] DOMString align;
diff --git a/Source/WebCore/html/HTMLAreaElement.idl b/Source/WebCore/html/HTMLAreaElement.idl
index a14a4701f..dfb9c9b5d 100644
--- a/Source/WebCore/html/HTMLAreaElement.idl
+++ b/Source/WebCore/html/HTMLAreaElement.idl
@@ -29,6 +29,9 @@ module html {
         attribute [Reflect] DOMString shape;
         attribute [Reflect] DOMString target;
 
+#if defined(LANGUAGE_OBJECTIVE_C) && LANGUAGE_OBJECTIVE_C
+        attribute [Reflect] DOMString accessKey;
+#endif
         // IE Extensions
         readonly attribute DOMString hash;
         readonly attribute DOMString host;
diff --git a/Source/WebCore/html/HTMLAttributeNames.in b/Source/WebCore/html/HTMLAttributeNames.in
index 60d96d53d..151df7f38 100644
--- a/Source/WebCore/html/HTMLAttributeNames.in
+++ b/Source/WebCore/html/HTMLAttributeNames.in
@@ -304,6 +304,7 @@ text
 title
 top
 topmargin
+translate
 truespeed
 type
 usemap
diff --git a/Source/WebCore/html/HTMLAudioElement.cpp b/Source/WebCore/html/HTMLAudioElement.cpp
index e3dcf47f1..98decc152 100644
--- a/Source/WebCore/html/HTMLAudioElement.cpp
+++ b/Source/WebCore/html/HTMLAudioElement.cpp
@@ -43,7 +43,9 @@ HTMLAudioElement::HTMLAudioElement(const QualifiedName& tagName, Document* docum
 
 PassRefPtr<HTMLAudioElement> HTMLAudioElement::create(const QualifiedName& tagName, Document* document, bool createdByParser)
 {
-    return adoptRef(new HTMLAudioElement(tagName, document, createdByParser));
+    RefPtr<HTMLAudioElement> audioElement(adoptRef(new HTMLAudioElement(tagName, document, createdByParser)));
+    audioElement->suspendIfNeeded();
+    return audioElement.release();
 }
 
 PassRefPtr<HTMLAudioElement> HTMLAudioElement::createForJSConstructor(Document* document, const String& src)
@@ -54,6 +56,7 @@ PassRefPtr<HTMLAudioElement> HTMLAudioElement::createForJSConstructor(Document*
         audio->setSrc(src);
         audio->scheduleLoad(HTMLMediaElement::MediaResource);
     }
+    audio->suspendIfNeeded();
     return audio.release();
 }
 
diff --git a/Source/WebCore/html/HTMLAudioElement.idl b/Source/WebCore/html/HTMLAudioElement.idl
index 109164627..1adf01c46 100644
--- a/Source/WebCore/html/HTMLAudioElement.idl
+++ b/Source/WebCore/html/HTMLAudioElement.idl
@@ -27,7 +27,7 @@ module html {
     interface [
         ActiveDOMObject,
         Conditional=VIDEO,
-        NamedConstructor=Audio(in [Optional=CallWithNullValue] DOMString src)
+        NamedConstructor=Audio(in [Optional=DefaultIsNullString] DOMString src)
     ] HTMLAudioElement : HTMLMediaElement {
     };
 }
diff --git a/Source/WebCore/html/HTMLBRElement.cpp b/Source/WebCore/html/HTMLBRElement.cpp
index 5efe6379a..33f0c533c 100644
--- a/Source/WebCore/html/HTMLBRElement.cpp
+++ b/Source/WebCore/html/HTMLBRElement.cpp
@@ -48,21 +48,26 @@ PassRefPtr<HTMLBRElement> HTMLBRElement::create(const QualifiedName& tagName, Do
     return adoptRef(new HTMLBRElement(tagName, document));
 }
 
-void HTMLBRElement::parseAttribute(Attribute* attr)
+bool HTMLBRElement::isPresentationAttribute(Attribute* attr) const
+{
+    if (attr->name() == clearAttr)
+        return true;
+    return HTMLElement::isPresentationAttribute(attr);
+}
+
+void HTMLBRElement::collectStyleForAttribute(Attribute* attr, StylePropertySet* style)
 {
     if (attr->name() == clearAttr) {
-        // If the string is empty, then don't add the clear property. 
+        // If the string is empty, then don't add the clear property.
         // <br clear> and <br clear=""> are just treated like <br> by Gecko, Mac IE, etc. -dwh
-        if (attr->value().isNull())
-            removeCSSProperty(CSSPropertyClear);
-        else if (!attr->value().isEmpty()) {
+        if (!attr->isEmpty()) {
             if (equalIgnoringCase(attr->value(), "all"))
-                addCSSProperty(CSSPropertyClear, "both");
+                addPropertyToAttributeStyle(style, CSSPropertyClear, "both");
             else
-                addCSSProperty(CSSPropertyClear, attr->value());
+                addPropertyToAttributeStyle(style, CSSPropertyClear, attr->value());
         }
     } else
-        HTMLElement::parseAttribute(attr);
+        HTMLElement::collectStyleForAttribute(attr, style);
 }
 
 RenderObject* HTMLBRElement::createRenderer(RenderArena* arena, RenderStyle* style)
diff --git a/Source/WebCore/html/HTMLBRElement.h b/Source/WebCore/html/HTMLBRElement.h
index 10a6432c7..16c1beae7 100644
--- a/Source/WebCore/html/HTMLBRElement.h
+++ b/Source/WebCore/html/HTMLBRElement.h
@@ -38,8 +38,9 @@ public:
 private:
     HTMLBRElement(const QualifiedName&, Document*);
 
-    virtual void parseAttribute(Attribute*) OVERRIDE;
-    
+    virtual bool isPresentationAttribute(Attribute*) const OVERRIDE;
+    virtual void collectStyleForAttribute(Attribute*, StylePropertySet*) OVERRIDE;
+
     virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
 };
 
diff --git a/Source/WebCore/html/HTMLBodyElement.cpp b/Source/WebCore/html/HTMLBodyElement.cpp
index a769a2c21..34d2924fa 100644
--- a/Source/WebCore/html/HTMLBodyElement.cpp
+++ b/Source/WebCore/html/HTMLBodyElement.cpp
@@ -25,6 +25,7 @@
 #include "HTMLBodyElement.h"
 
 #include "Attribute.h"
+#include "CSSImageValue.h"
 #include "CSSParser.h"
 #include "CSSValueKeywords.h"
 #include "EventNames.h"
@@ -60,46 +61,39 @@ HTMLBodyElement::~HTMLBodyElement()
 {
 }
 
-void HTMLBodyElement::parseAttribute(Attribute* attr)
+bool HTMLBodyElement::isPresentationAttribute(Attribute* attr) const
+{
+    if (attr->name() == backgroundAttr || attr->name() == marginwidthAttr || attr->name() == leftmarginAttr || attr->name() == marginheightAttr || attr->name() == topmarginAttr || attr->name() == bgcolorAttr || attr->name() == textAttr || attr->name() == bgpropertiesAttr)
+        return true;
+    return HTMLElement::isPresentationAttribute(attr);
+}
+
+void HTMLBodyElement::collectStyleForAttribute(Attribute* attr, StylePropertySet* style)
 {
     if (attr->name() == backgroundAttr) {
         String url = stripLeadingAndTrailingHTMLSpaces(attr->value());
         if (!url.isEmpty())
-            addCSSImageProperty(CSSPropertyBackgroundImage, document()->completeURL(url).string());
-        else
-            removeCSSProperty(CSSPropertyBackgroundImage);
+            style->setProperty(CSSProperty(CSSPropertyBackgroundImage, CSSImageValue::create(document()->completeURL(url).string())));
     } else if (attr->name() == marginwidthAttr || attr->name() == leftmarginAttr) {
-        if (attr->value().isNull())
-            removeCSSProperties(CSSPropertyMarginRight, CSSPropertyMarginLeft);
-        else {
-            addCSSLength(CSSPropertyMarginRight, attr->value());
-            addCSSLength(CSSPropertyMarginLeft, attr->value());
-        }
+        addHTMLLengthToStyle(style, CSSPropertyMarginRight, attr->value());
+        addHTMLLengthToStyle(style, CSSPropertyMarginLeft, attr->value());
     } else if (attr->name() == marginheightAttr || attr->name() == topmarginAttr) {
-        if (attr->value().isNull())
-            removeCSSProperties(CSSPropertyMarginBottom, CSSPropertyMarginTop);
-        else {
-            addCSSLength(CSSPropertyMarginBottom, attr->value());
-            addCSSLength(CSSPropertyMarginTop, attr->value());
-        }
+        addHTMLLengthToStyle(style, CSSPropertyMarginBottom, attr->value());
+        addHTMLLengthToStyle(style, CSSPropertyMarginTop, attr->value());
     } else if (attr->name() == bgcolorAttr) {
-        if (attr->value().isNull())
-            removeCSSProperty(CSSPropertyBackgroundColor);
-        else
-            addCSSColor(CSSPropertyBackgroundColor, attr->value());
+        addHTMLColorToStyle(style, CSSPropertyBackgroundColor, attr->value());
     } else if (attr->name() == textAttr) {
-        if (attr->value().isNull())
-            removeCSSProperty(CSSPropertyColor);
-        else
-            addCSSColor(CSSPropertyColor, attr->value());
+        addHTMLColorToStyle(style, CSSPropertyColor, attr->value());
     } else if (attr->name() == bgpropertiesAttr) {
         if (equalIgnoringCase(attr->value(), "fixed"))
-            addCSSProperty(CSSPropertyBackgroundAttachment, CSSValueFixed);
-        else
-            removeCSSProperty(CSSPropertyBackgroundAttachment);
-    } else if (attr->name() == vlinkAttr ||
-               attr->name() == alinkAttr ||
-               attr->name() == linkAttr) {
+           addPropertyToAttributeStyle(style, CSSPropertyBackgroundAttachment, CSSValueFixed);
+    } else
+        HTMLElement::collectStyleForAttribute(attr, style);
+}
+
+void HTMLBodyElement::parseAttribute(Attribute* attr)
+{
+    if (attr->name() == vlinkAttr || attr->name() == alinkAttr || attr->name() == linkAttr) {
         if (attr->isNull()) {
             if (attr->name() == linkAttr)
                 document()->resetLinkColor();
@@ -118,9 +112,8 @@ void HTMLBodyElement::parseAttribute(Attribute* attr)
                     document()->setActiveLinkColor(color);
             }
         }
-        
-        if (attached())
-            document()->recalcStyle(Force);
+
+        setNeedsStyleRecalc();
     } else if (attr->name() == onloadAttr)
         document()->setWindowAttributeEventListener(eventNames().loadEvent, createAttributeEventListener(document()->frame(), attr));
     else if (attr->name() == onbeforeunloadAttr)
diff --git a/Source/WebCore/html/HTMLBodyElement.h b/Source/WebCore/html/HTMLBodyElement.h
index 8004b10da..41ba4485c 100644
--- a/Source/WebCore/html/HTMLBodyElement.h
+++ b/Source/WebCore/html/HTMLBodyElement.h
@@ -71,6 +71,8 @@ private:
     HTMLBodyElement(const QualifiedName&, Document*);
 
     virtual void parseAttribute(Attribute*) OVERRIDE;
+    virtual bool isPresentationAttribute(Attribute*) const OVERRIDE;
+    virtual void collectStyleForAttribute(Attribute*, StylePropertySet*) OVERRIDE;
 
     virtual void insertedIntoDocument();
     
diff --git a/Source/WebCore/html/HTMLButtonElement.cpp b/Source/WebCore/html/HTMLButtonElement.cpp
index 1468248b9..a79641a31 100644
--- a/Source/WebCore/html/HTMLButtonElement.cpp
+++ b/Source/WebCore/html/HTMLButtonElement.cpp
@@ -79,6 +79,17 @@ const AtomicString& HTMLButtonElement::formControlType() const
     return emptyAtom;
 }
 
+bool HTMLButtonElement::isPresentationAttribute(Attribute* attr) const
+{
+    if (attr->name() == alignAttr) {
+        // Don't map 'align' attribute.  This matches what Firefox and IE do, but not Opera.
+        // See http://bugs.webkit.org/show_bug.cgi?id=12071
+        return false;
+    }
+
+    return HTMLFormControlElement::isPresentationAttribute(attr);
+}
+
 void HTMLButtonElement::parseAttribute(Attribute* attr)
 {
     if (attr->name() == typeAttr) {
@@ -89,9 +100,6 @@ void HTMLButtonElement::parseAttribute(Attribute* attr)
         else
             m_type = SUBMIT;
         setNeedsWillValidateCheck();
-    } else if (attr->name() == alignAttr) {
-        // Don't map 'align' attribute.  This matches what Firefox and IE do, but not Opera.
-        // See http://bugs.webkit.org/show_bug.cgi?id=12071
     } else
         HTMLFormControlElement::parseAttribute(attr);
 }
diff --git a/Source/WebCore/html/HTMLButtonElement.h b/Source/WebCore/html/HTMLButtonElement.h
index 9699bef0e..00518ea4c 100644
--- a/Source/WebCore/html/HTMLButtonElement.h
+++ b/Source/WebCore/html/HTMLButtonElement.h
@@ -44,6 +44,7 @@ private:
     virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
 
     virtual void parseAttribute(Attribute*) OVERRIDE;
+    virtual bool isPresentationAttribute(Attribute*) const OVERRIDE;
     virtual void defaultEventHandler(Event*);
     virtual bool appendFormData(FormDataList&, bool);
 
diff --git a/Source/WebCore/html/HTMLButtonElement.idl b/Source/WebCore/html/HTMLButtonElement.idl
index b8b8621f9..b9eafb0d5 100644
--- a/Source/WebCore/html/HTMLButtonElement.idl
+++ b/Source/WebCore/html/HTMLButtonElement.idl
@@ -30,6 +30,9 @@ module html {
         attribute [Reflect] DOMString formTarget;
         readonly attribute ValidityState validity;
 
+#if defined(LANGUAGE_OBJECTIVE_C) && LANGUAGE_OBJECTIVE_C
+        attribute [Reflect] DOMString accessKey;
+#endif
         attribute [Reflect] boolean disabled;
         attribute [Reflect] boolean autofocus;
         attribute [Reflect] DOMString name;
@@ -41,7 +44,9 @@ module html {
         boolean checkValidity();
         void setCustomValidity(in [TreatNullAs=NullString, TreatUndefinedAs=NullString] DOMString error);
 
+#if defined(LANGUAGE_OBJECTIVE_C) && LANGUAGE_OBJECTIVE_C
         void click();
+#endif
 
         readonly attribute NodeList labels;
     };
diff --git a/Source/WebCore/html/HTMLCanvasElement.cpp b/Source/WebCore/html/HTMLCanvasElement.cpp
index 9cf78d403..7ed6e3d11 100644
--- a/Source/WebCore/html/HTMLCanvasElement.cpp
+++ b/Source/WebCore/html/HTMLCanvasElement.cpp
@@ -45,6 +45,7 @@
 #include "MIMETypeRegistry.h"
 #include "Page.h"
 #include "RenderHTMLCanvas.h"
+#include "RenderLayer.h"
 #include "Settings.h"
 #include <math.h>
 #include <stdio.h>
@@ -79,7 +80,12 @@ HTMLCanvasElement::HTMLCanvasElement(const QualifiedName& tagName, Document* doc
     , m_size(DefaultWidth, DefaultHeight)
     , m_rendererIsCanvas(false)
     , m_ignoreReset(false)
+#if ENABLE(HIGH_DPI_CANVAS)
+      // FIXME: Make this the default once https://bugs.webkit.org/show_bug.cgi?id=73645 has been fixed.
     , m_deviceScaleFactor(document->frame() ? document->frame()->page()->deviceScaleFactor() : 1)
+#else
+    , m_deviceScaleFactor(1)
+#endif
     , m_originClean(true)
     , m_hasCreatedImageBuffer(false)
 {
@@ -264,6 +270,25 @@ void HTMLCanvasElement::reset()
         (*it)->canvasResized(this);
 }
 
+bool HTMLCanvasElement::paintsIntoCanvasBuffer() const
+{
+    ASSERT(m_context);
+#if USE(IOSURFACE_CANVAS_BACKING_STORE)
+    if (m_context->is2d())
+        return true;
+#endif
+
+#if USE(ACCELERATED_COMPOSITING)
+    if (!m_context->isAccelerated())
+        return true;
+
+    if (renderBox() && renderBox()->hasLayer() && renderBox()->layer()->hasAcceleratedCompositing())
+        return false;
+#endif
+    return true;
+}
+
+
 void HTMLCanvasElement::paint(GraphicsContext* context, const LayoutRect& r, bool useLowQualityScale)
 {
     // Clear the dirty rect
@@ -273,7 +298,7 @@ void HTMLCanvasElement::paint(GraphicsContext* context, const LayoutRect& r, boo
         return;
     
     if (m_context) {
-        if (!m_context->paintsIntoCanvasBuffer() && !document()->printing())
+        if (!paintsIntoCanvasBuffer() && !document()->printing())
             return;
         m_context->paintRenderingResultsToCanvas();
     }
@@ -282,9 +307,9 @@ void HTMLCanvasElement::paint(GraphicsContext* context, const LayoutRect& r, boo
         ImageBuffer* imageBuffer = buffer();
         if (imageBuffer) {
             if (m_presentedImage)
-                context->drawImage(m_presentedImage.get(), ColorSpaceDeviceRGB, r, CompositeSourceOver, useLowQualityScale);
+                context->drawImage(m_presentedImage.get(), ColorSpaceDeviceRGB, pixelSnappedIntRect(r), CompositeSourceOver, useLowQualityScale);
             else
-                context->drawImageBuffer(imageBuffer, ColorSpaceDeviceRGB, r, CompositeSourceOver, useLowQualityScale);
+                context->drawImageBuffer(imageBuffer, ColorSpaceDeviceRGB, pixelSnappedIntRect(r), CompositeSourceOver, useLowQualityScale);
         }
     }
 
diff --git a/Source/WebCore/html/HTMLCanvasElement.h b/Source/WebCore/html/HTMLCanvasElement.h
index 967444d0c..e2c4888e5 100644
--- a/Source/WebCore/html/HTMLCanvasElement.h
+++ b/Source/WebCore/html/HTMLCanvasElement.h
@@ -148,6 +148,8 @@ private:
 
     bool shouldDefer() const;
 
+    bool paintsIntoCanvasBuffer() const;
+
     HashSet<CanvasObserver*> m_observers;
 
     IntSize m_size;
diff --git a/Source/WebCore/html/HTMLCanvasElement.idl b/Source/WebCore/html/HTMLCanvasElement.idl
index 35a806c65..2be96a556 100644
--- a/Source/WebCore/html/HTMLCanvasElement.idl
+++ b/Source/WebCore/html/HTMLCanvasElement.idl
@@ -33,13 +33,13 @@ module html {
         attribute long width;
         attribute long height;
 
-        [Custom] DOMString toDataURL(in [TreatNullAs=NullString, TreatUndefinedAs=NullString,Optional=CallWithDefaultValue] DOMString type)
+        [Custom] DOMString toDataURL(in [TreatNullAs=NullString, TreatUndefinedAs=NullString,Optional=DefaultIsUndefined] DOMString type)
             raises(DOMException);
 
 #if !defined(LANGUAGE_CPP) || !LANGUAGE_CPP
 #if !defined(LANGUAGE_OBJECTIVE_C) || !LANGUAGE_OBJECTIVE_C
         // The custom binding is needed to handle context creation attributes.
-        [Custom] DOMObject getContext(in [Optional=CallWithDefaultValue] DOMString contextId);
+        [Custom] DOMObject getContext(in [Optional=DefaultIsUndefined] DOMString contextId);
 #endif
 #endif
 
diff --git a/Source/WebCore/html/HTMLCollection.cpp b/Source/WebCore/html/HTMLCollection.cpp
index e6f2eac0a..7d06308fc 100644
--- a/Source/WebCore/html/HTMLCollection.cpp
+++ b/Source/WebCore/html/HTMLCollection.cpp
@@ -254,7 +254,7 @@ bool HTMLCollection::checkForNameMatch(Element* element, bool checkName, const A
     if (m_type == DocAll && !nameShouldBeVisibleInDocumentAll(e))
         return false;
 
-    return e->getAttribute(nameAttr) == name && e->getIdAttribute() != name;
+    return e->getNameAttribute() == name && e->getIdAttribute() != name;
 }
 
 Node* HTMLCollection::namedItem(const AtomicString& name) const
@@ -294,7 +294,7 @@ void HTMLCollection::updateNameCache() const
             continue;
         HTMLElement* e = toHTMLElement(element);
         const AtomicString& idAttrVal = e->getIdAttribute();
-        const AtomicString& nameAttrVal = e->getAttribute(nameAttr);
+        const AtomicString& nameAttrVal = e->getNameAttribute();
         if (!idAttrVal.isEmpty())
             append(m_cache.idCache, idAttrVal, e);
         if (!nameAttrVal.isEmpty() && idAttrVal != nameAttrVal && (m_type != DocAll || nameShouldBeVisibleInDocumentAll(e)))
diff --git a/Source/WebCore/html/HTMLCollection.idl b/Source/WebCore/html/HTMLCollection.idl
index a4d172d1a..778377626 100644
--- a/Source/WebCore/html/HTMLCollection.idl
+++ b/Source/WebCore/html/HTMLCollection.idl
@@ -23,16 +23,16 @@ module html {
     interface [
         IndexedGetter,
         NamedGetter,
-        JSCustomToJS,
+        CustomToJSObject,
         JSGenerateIsReachable,
         ObjCPolymorphic
     ] HTMLCollection {
         readonly attribute unsigned long length;
-        Node item(in [Optional=CallWithDefaultValue] unsigned long index);
-        [Custom] Node namedItem(in [Optional=CallWithDefaultValue] DOMString name);
+        Node item(in [Optional=DefaultIsUndefined] unsigned long index);
+        [Custom] Node namedItem(in [Optional=DefaultIsUndefined] DOMString name);
 
 #if defined(LANGUAGE_OBJECTIVE_C) && LANGUAGE_OBJECTIVE_C
-        NodeList tags(in [Optional=CallWithDefaultValue] DOMString name);
+        NodeList tags(in [Optional=DefaultIsUndefined] DOMString name);
 #endif
     };
 
diff --git a/Source/WebCore/html/HTMLDetailsElement.cpp b/Source/WebCore/html/HTMLDetailsElement.cpp
index 015cf61ce..d49daa4c6 100644
--- a/Source/WebCore/html/HTMLDetailsElement.cpp
+++ b/Source/WebCore/html/HTMLDetailsElement.cpp
@@ -28,8 +28,10 @@
 #include "HTMLSummaryElement.h"
 #include "LocalizedStrings.h"
 #include "MouseEvent.h"
+#include "NodeRenderingContext.h"
 #include "RenderDetails.h"
 #include "ShadowRoot.h"
+#include "ShadowRootList.h"
 #include "Text.h"
 
 namespace WebCore {
@@ -108,7 +110,7 @@ RenderObject* HTMLDetailsElement::createRenderer(RenderArena* arena, RenderStyle
 
 void HTMLDetailsElement::createShadowSubtree()
 {
-    ASSERT(!shadowRoot());
+    ASSERT(!hasShadowRoot());
 
     RefPtr<ShadowRoot> root = ShadowRoot::create(this, ShadowRoot::CreatingUserAgentShadowRoot);
     root->appendChild(DetailsSummaryElement::create(document()), ASSERT_NO_EXCEPTION, true);
@@ -122,7 +124,7 @@ Element* HTMLDetailsElement::findMainSummary() const
             return toElement(child);
     }
 
-    return static_cast<DetailsSummaryElement*>(shadowRoot()->firstChild())->fallbackSummary();
+    return static_cast<DetailsSummaryElement*>(shadowRootList()->oldestShadowRoot()->firstChild())->fallbackSummary();
 }
 
 void HTMLDetailsElement::parseAttribute(Attribute* attr)
@@ -136,15 +138,18 @@ void HTMLDetailsElement::parseAttribute(Attribute* attr)
         HTMLElement::parseAttribute(attr);
 }
 
-bool HTMLDetailsElement::childShouldCreateRenderer(Node* child) const
+bool HTMLDetailsElement::childShouldCreateRenderer(const NodeRenderingContext& childContext) const
 {
+    if (!childContext.isOnEncapsulationBoundary())
+        return false;
+
     if (m_isOpen)
-        return true;
+        return HTMLElement::childShouldCreateRenderer(childContext);
 
-    if (!child->hasTagName(summaryTag))
+    if (!childContext.node()->hasTagName(summaryTag))
         return false;
 
-    return child == findMainSummary();
+    return childContext.node() == findMainSummary() && HTMLElement::childShouldCreateRenderer(childContext);
 }
 
 void HTMLDetailsElement::toggleOpen()
diff --git a/Source/WebCore/html/HTMLDetailsElement.h b/Source/WebCore/html/HTMLDetailsElement.h
index a86a365c6..94e88334d 100644
--- a/Source/WebCore/html/HTMLDetailsElement.h
+++ b/Source/WebCore/html/HTMLDetailsElement.h
@@ -36,9 +36,8 @@ private:
     HTMLDetailsElement(const QualifiedName&, Document*);
 
     virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
-
+    virtual bool childShouldCreateRenderer(const NodeRenderingContext&) const OVERRIDE;
     virtual void parseAttribute(Attribute*) OVERRIDE;
-    bool childShouldCreateRenderer(Node*) const;
 
     void createShadowSubtree();
 
diff --git a/Source/WebCore/html/HTMLDivElement.cpp b/Source/WebCore/html/HTMLDivElement.cpp
index da2785c1f..bd15ae239 100644
--- a/Source/WebCore/html/HTMLDivElement.cpp
+++ b/Source/WebCore/html/HTMLDivElement.cpp
@@ -48,21 +48,26 @@ PassRefPtr<HTMLDivElement> HTMLDivElement::create(const QualifiedName& tagName,
     return adoptRef(new HTMLDivElement(tagName, document));
 }
 
-void HTMLDivElement::parseAttribute(Attribute* attr)
+bool HTMLDivElement::isPresentationAttribute(Attribute* attr) const
+{
+    if (attr->name() == alignAttr)
+        return true;
+    return HTMLElement::isPresentationAttribute(attr);
+}
+
+void HTMLDivElement::collectStyleForAttribute(Attribute* attr, StylePropertySet* style)
 {
     if (attr->name() == alignAttr) {
-        if (attr->value().isNull())
-            removeCSSProperty(CSSPropertyTextAlign);
         if (equalIgnoringCase(attr->value(), "middle") || equalIgnoringCase(attr->value(), "center"))
-           addCSSProperty(CSSPropertyTextAlign, CSSValueWebkitCenter);
+            addPropertyToAttributeStyle(style, CSSPropertyTextAlign, CSSValueWebkitCenter);
         else if (equalIgnoringCase(attr->value(), "left"))
-            addCSSProperty(CSSPropertyTextAlign, CSSValueWebkitLeft);
+            addPropertyToAttributeStyle(style, CSSPropertyTextAlign, CSSValueWebkitLeft);
         else if (equalIgnoringCase(attr->value(), "right"))
-            addCSSProperty(CSSPropertyTextAlign, CSSValueWebkitRight);
+            addPropertyToAttributeStyle(style, CSSPropertyTextAlign, CSSValueWebkitRight);
         else
-            addCSSProperty(CSSPropertyTextAlign, attr->value());
+            addPropertyToAttributeStyle(style, CSSPropertyTextAlign, attr->value());
     } else
-        HTMLElement::parseAttribute(attr);
+        HTMLElement::collectStyleForAttribute(attr, style);
 }
 
 }
diff --git a/Source/WebCore/html/HTMLDivElement.h b/Source/WebCore/html/HTMLDivElement.h
index cd90d8728..f8f4f7101 100644
--- a/Source/WebCore/html/HTMLDivElement.h
+++ b/Source/WebCore/html/HTMLDivElement.h
@@ -36,7 +36,8 @@ protected:
     HTMLDivElement(const QualifiedName&, Document*);
 
 private:
-    virtual void parseAttribute(Attribute*) OVERRIDE;
+    virtual bool isPresentationAttribute(Attribute*) const OVERRIDE;
+    virtual void collectStyleForAttribute(Attribute*, StylePropertySet*) OVERRIDE;
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/html/HTMLDocument.idl b/Source/WebCore/html/HTMLDocument.idl
index dd020e2c5..19420ee3d 100644
--- a/Source/WebCore/html/HTMLDocument.idl
+++ b/Source/WebCore/html/HTMLDocument.idl
@@ -21,12 +21,13 @@
 module html {
 
     interface [
-        CustomNamedGetter
+        CustomNamedGetter,
+        V8CustomToJSObject
     ] HTMLDocument : Document {
         [JSCustom, V8Custom] void open();
         void close();
-        [Custom] void write(in [Optional=CallWithDefaultValue] DOMString text);
-        [Custom] void writeln(in [Optional=CallWithDefaultValue] DOMString text);
+        [Custom] void write(in [Optional=DefaultIsUndefined] DOMString text);
+        [Custom] void writeln(in [Optional=DefaultIsUndefined] DOMString text);
 
         readonly attribute HTMLCollection embeds;
         readonly attribute HTMLCollection plugins;
diff --git a/Source/WebCore/html/HTMLElement.cpp b/Source/WebCore/html/HTMLElement.cpp
index a018fe23b..4e8da5c7d 100644
--- a/Source/WebCore/html/HTMLElement.cpp
+++ b/Source/WebCore/html/HTMLElement.cpp
@@ -29,6 +29,7 @@
 #include "CSSParser.h"
 #include "CSSPropertyNames.h"
 #include "CSSValueKeywords.h"
+#include "CSSValuePool.h"
 #include "ChildListMutationScope.h"
 #include "DocumentFragment.h"
 #include "Event.h"
@@ -140,51 +141,85 @@ static unsigned parseBorderWidthAttribute(Attribute* attr)
     return borderWidth;
 }
 
-void HTMLElement::applyBorderAttribute(Attribute* attr)
+void HTMLElement::applyBorderAttributeToStyle(Attribute* attr, StylePropertySet* style)
 {
-    addCSSLength(CSSPropertyBorderWidth, String::number(parseBorderWidthAttribute(attr)));
-    addCSSProperty(CSSPropertyBorderTopStyle, CSSValueSolid);
-    addCSSProperty(CSSPropertyBorderRightStyle, CSSValueSolid);
-    addCSSProperty(CSSPropertyBorderBottomStyle, CSSValueSolid);
-    addCSSProperty(CSSPropertyBorderLeftStyle, CSSValueSolid);
+    addPropertyToAttributeStyle(style, CSSPropertyBorderWidth, parseBorderWidthAttribute(attr), CSSPrimitiveValue::CSS_PX);
+    addPropertyToAttributeStyle(style, CSSPropertyBorderStyle, CSSValueSolid);
 }
 
-void HTMLElement::mapLanguageAttributeToLocale(Attribute* attribute)
+void HTMLElement::mapLanguageAttributeToLocale(Attribute* attribute, StylePropertySet* style)
 {
     ASSERT(attribute && (attribute->name() == langAttr || attribute->name().matches(XMLNames::langAttr)));
-    const AtomicString& value = attribute->value();
-    if (value.isNull())
-        removeCSSProperty(CSSPropertyWebkitLocale);
-    else if (!value.isEmpty()) {
+    if (!attribute->isEmpty()) {
         // Have to quote so the locale id is treated as a string instead of as a CSS keyword.
-        addCSSProperty(CSSPropertyWebkitLocale, quoteCSSString(value));
+        addPropertyToAttributeStyle(style, CSSPropertyWebkitLocale, quoteCSSString(attribute->value()));
     } else {
         // The empty string means the language is explicitly unknown.
-        addCSSProperty(CSSPropertyWebkitLocale, CSSValueAuto);
+        addPropertyToAttributeStyle(style, CSSPropertyWebkitLocale, CSSValueAuto);
     }
-    setNeedsStyleRecalc();
 }
 
-void HTMLElement::parseAttribute(Attribute* attr)
+bool HTMLElement::isPresentationAttribute(Attribute* attr) const
 {
-    if (isIdAttributeName(attr->name()) || attr->name() == classAttr || attr->name() == styleAttr)
-        return StyledElement::parseAttribute(attr);
+    if (attr->name() == alignAttr || attr->name() == contenteditableAttr || attr->name() == hiddenAttr || attr->name() == langAttr || attr->name().matches(XMLNames::langAttr) || attr->name() == draggableAttr || attr->name() == dirAttr)
+        return true;
+    return StyledElement::isPresentationAttribute(attr);
+}
 
+void HTMLElement::collectStyleForAttribute(Attribute* attr, StylePropertySet* style)
+{
     if (attr->name() == alignAttr) {
-        if (attr->isNull())
-            removeCSSProperty(CSSPropertyTextAlign);
-        else if (equalIgnoringCase(attr->value(), "middle"))
-            addCSSProperty(CSSPropertyTextAlign, "center");
+        if (equalIgnoringCase(attr->value(), "middle"))
+            addPropertyToAttributeStyle(style, CSSPropertyTextAlign, "center");
         else
-            addCSSProperty(CSSPropertyTextAlign, attr->value());
+            addPropertyToAttributeStyle(style, CSSPropertyTextAlign, attr->value());
     } else if (attr->name() == contenteditableAttr) {
-        setContentEditable(attr);
+        if (attr->isEmpty() || equalIgnoringCase(attr->value(), "true")) {
+            addPropertyToAttributeStyle(style, CSSPropertyWebkitUserModify, CSSValueReadWrite);
+            addPropertyToAttributeStyle(style, CSSPropertyWordWrap, CSSValueBreakWord);
+            addPropertyToAttributeStyle(style, CSSPropertyWebkitNbspMode, CSSValueSpace);
+            addPropertyToAttributeStyle(style, CSSPropertyWebkitLineBreak, CSSValueAfterWhiteSpace);
+        } else if (equalIgnoringCase(attr->value(), "plaintext-only")) {
+            addPropertyToAttributeStyle(style, CSSPropertyWebkitUserModify, CSSValueReadWritePlaintextOnly);
+            addPropertyToAttributeStyle(style, CSSPropertyWordWrap, CSSValueBreakWord);
+            addPropertyToAttributeStyle(style, CSSPropertyWebkitNbspMode, CSSValueSpace);
+            addPropertyToAttributeStyle(style, CSSPropertyWebkitLineBreak, CSSValueAfterWhiteSpace);
+        } else if (equalIgnoringCase(attr->value(), "false"))
+            addPropertyToAttributeStyle(style, CSSPropertyWebkitUserModify, CSSValueReadOnly);
     } else if (attr->name() == hiddenAttr) {
-        if (attr->isNull())
-            removeCSSProperty(CSSPropertyDisplay);
-        else
-            addCSSProperty(CSSPropertyDisplay, CSSValueNone);
-    } else if (attr->name() == tabindexAttr) {
+        addPropertyToAttributeStyle(style, CSSPropertyDisplay, CSSValueNone);
+    } else if (attr->name() == draggableAttr) {
+        if (equalIgnoringCase(attr->value(), "true")) {
+            addPropertyToAttributeStyle(style, CSSPropertyWebkitUserDrag, CSSValueElement);
+            addPropertyToAttributeStyle(style, CSSPropertyWebkitUserSelect, CSSValueNone);
+        } else if (equalIgnoringCase(attr->value(), "false"))
+            addPropertyToAttributeStyle(style, CSSPropertyWebkitUserDrag, CSSValueNone);
+    } else if (attr->name() == dirAttr) {
+        if (equalIgnoringCase(attr->value(), "auto"))
+            addPropertyToAttributeStyle(style, CSSPropertyUnicodeBidi, unicodeBidiAttributeForDirAuto(this));
+        else {
+            addPropertyToAttributeStyle(style, CSSPropertyDirection, attr->value());
+            if (!hasTagName(bdiTag) && !hasTagName(bdoTag) && !hasTagName(outputTag))
+                addPropertyToAttributeStyle(style, CSSPropertyUnicodeBidi, CSSValueEmbed);
+        }
+    } else if (attr->name().matches(XMLNames::langAttr)) {
+        mapLanguageAttributeToLocale(attr, style);
+    } else if (attr->name() == langAttr) {
+        // xml:lang has a higher priority than lang.
+        if (!fastHasAttribute(XMLNames::langAttr))
+            mapLanguageAttributeToLocale(attr, style);
+    } else
+        StyledElement::collectStyleForAttribute(attr, style);
+}
+
+void HTMLElement::parseAttribute(Attribute* attr)
+{
+    if (isIdAttributeName(attr->name()) || attr->name() == classAttr || attr->name() == styleAttr)
+        return StyledElement::parseAttribute(attr);
+
+    if (attr->name() == dirAttr)
+        dirAttributeChanged(attr);
+    else if (attr->name() == tabindexAttr) {
         int tabindex = 0;
         if (attr->isEmpty())
             clearTabIndexExplicitly();
@@ -192,40 +227,6 @@ void HTMLElement::parseAttribute(Attribute* attr)
             // Clamp tabindex to the range of 'short' to match Firefox's behavior.
             setTabIndexExplicitly(max(static_cast<int>(std::numeric_limits<short>::min()), min(tabindex, static_cast<int>(std::numeric_limits<short>::max()))));
         }
-    } else if (attr->name().matches(XMLNames::langAttr)) {
-        mapLanguageAttributeToLocale(attr);
-    } else if (attr->name() == langAttr) {
-        // xml:lang has a higher priority than lang.
-        if (!fastHasAttribute(XMLNames::langAttr))
-            mapLanguageAttributeToLocale(attr);
-    } else if (attr->name() == dirAttr) {
-        if (attr->isNull())
-            removeCSSProperties(CSSPropertyDirection, CSSPropertyUnicodeBidi);
-        else {
-            bool dirIsAuto = equalIgnoringCase(attr->value(), "auto");
-            if (!dirIsAuto)
-                addCSSProperty(CSSPropertyDirection, attr->value());
-            else
-                removeCSSProperty(CSSPropertyDirection);
-
-            dirAttributeChanged(attr);
-            if (dirIsAuto)
-                addCSSProperty(CSSPropertyUnicodeBidi, unicodeBidiAttributeForDirAuto(this));
-            else if (!hasTagName(bdiTag) && !hasTagName(bdoTag) && !hasTagName(outputTag))
-                addCSSProperty(CSSPropertyUnicodeBidi, CSSValueEmbed);
-            else
-                removeCSSProperty(CSSPropertyUnicodeBidi);
-        }
-    } else if (attr->name() == draggableAttr) {
-        const AtomicString& value = attr->value();
-        if (equalIgnoringCase(value, "true")) {
-            addCSSProperty(CSSPropertyWebkitUserDrag, CSSValueElement);
-            addCSSProperty(CSSPropertyWebkitUserSelect, CSSValueNone);
-        } else if (equalIgnoringCase(value, "false")) {
-            addCSSProperty(CSSPropertyWebkitUserDrag, CSSValueNone);
-            removeCSSProperty(CSSPropertyWebkitUserSelect);
-        } else
-            removeCSSProperties(CSSPropertyWebkitUserDrag, CSSPropertyWebkitUserSelect);
 #if ENABLE(MICRODATA)
     } else if (attr->name() == itempropAttr) {
         setItemProp(attr->value());
@@ -365,7 +366,7 @@ static void replaceChildrenWithFragment(HTMLElement* element, PassRefPtr<Documen
     }
 
     if (hasOneTextChild(element) && hasOneTextChild(fragment.get())) {
-        static_cast<Text*>(element->firstChild())->setData(static_cast<Text*>(fragment->firstChild())->data(), ec);
+        toText(element->firstChild())->setData(toText(fragment->firstChild())->data(), ec);
         return;
     }
 
@@ -385,7 +386,7 @@ static void replaceChildrenWithText(HTMLElement* element, const String& text, Ex
 #endif
 
     if (hasOneTextChild(element)) {
-        static_cast<Text*>(element->firstChild())->setData(text, ec);
+        toText(element->firstChild())->setData(text, ec);
         return;
     }
 
@@ -434,8 +435,8 @@ static void mergeWithNextTextNode(PassRefPtr<Node> node, ExceptionCode& ec)
     if (!next || !next->isTextNode())
         return;
     
-    RefPtr<Text> textNode = static_cast<Text*>(node.get());
-    RefPtr<Text> textNext = static_cast<Text*>(next);
+    RefPtr<Text> textNode = toText(node.get());
+    RefPtr<Text> textNext = toText(next);
     textNode->appendData(textNext->data(), ec);
     if (ec)
         return;
@@ -678,17 +679,7 @@ void HTMLElement::insertAdjacentText(const String& where, const String& text, Ex
     insertAdjacent(where, textNode.get(), ec);
 }
 
-void HTMLElement::addHTMLAlignment(Attribute* attr)
-{
-    addHTMLAlignmentToStyledElement(this, attr);
-}
-
-void HTMLElement::removeHTMLAlignment()
-{
-    removeCSSProperties(CSSPropertyFloat, CSSPropertyVerticalAlign);
-}
-
-void HTMLElement::addHTMLAlignmentToStyledElement(StyledElement* element, Attribute* attr)
+void HTMLElement::applyAlignmentAttributeToStyle(Attribute* attr, StylePropertySet* style)
 {
     // Vertical alignment with respect to the current baseline of the text
     // right or left means floating images.
@@ -718,14 +709,10 @@ void HTMLElement::addHTMLAlignmentToStyledElement(StyledElement* element, Attrib
         verticalAlignValue = CSSValueTextTop;
 
     if (floatValue != CSSValueInvalid)
-        element->addCSSProperty(CSSPropertyFloat, floatValue);
-    else
-        element->removeCSSProperty(CSSPropertyFloat);
+        addPropertyToAttributeStyle(style, CSSPropertyFloat, floatValue);
 
     if (verticalAlignValue != CSSValueInvalid)
-        element->addCSSProperty(CSSPropertyVerticalAlign, verticalAlignValue);
-    else
-        element->removeCSSProperty(CSSPropertyVerticalAlign);
+        addPropertyToAttributeStyle(style, CSSPropertyVerticalAlign, verticalAlignValue);
 }
 
 bool HTMLElement::supportsFocus() const
@@ -749,27 +736,6 @@ String HTMLElement::contentEditable() const
     return "inherit";
 }
 
-void HTMLElement::setContentEditable(Attribute* attr) 
-{
-    const AtomicString& enabled = attr->value();
-    if (enabled.isNull())
-        removeCSSProperties(CSSPropertyWebkitUserModify, CSSPropertyWordWrap, CSSPropertyWebkitNbspMode, CSSPropertyWebkitLineBreak);
-    else if (enabled.isEmpty() || equalIgnoringCase(enabled, "true")) {
-        addCSSProperty(CSSPropertyWebkitUserModify, CSSValueReadWrite);
-        addCSSProperty(CSSPropertyWordWrap, CSSValueBreakWord);
-        addCSSProperty(CSSPropertyWebkitNbspMode, CSSValueSpace);
-        addCSSProperty(CSSPropertyWebkitLineBreak, CSSValueAfterWhiteSpace);
-    } else if (equalIgnoringCase(enabled, "false")) {
-        addCSSProperty(CSSPropertyWebkitUserModify, CSSValueReadOnly);
-        removeCSSProperties(CSSPropertyWordWrap, CSSPropertyWebkitNbspMode, CSSPropertyWebkitLineBreak);
-    } else if (equalIgnoringCase(enabled, "plaintext-only")) {
-        addCSSProperty(CSSPropertyWebkitUserModify, CSSValueReadWritePlaintextOnly);
-        addCSSProperty(CSSPropertyWordWrap, CSSValueBreakWord);
-        addCSSProperty(CSSPropertyWebkitNbspMode, CSSValueSpace);
-        addCSSProperty(CSSPropertyWebkitLineBreak, CSSValueAfterWhiteSpace);
-    }
-}
-
 void HTMLElement::setContentEditable(const String& enabled, ExceptionCode& ec)
 {
     if (equalIgnoringCase(enabled, "true"))
@@ -832,6 +798,42 @@ void HTMLElement::setTabIndex(int value)
     setAttribute(tabindexAttr, String::number(value));
 }
 
+TranslateAttributeMode HTMLElement::translateAttributeMode() const
+{
+    const AtomicString& value = getAttribute(translateAttr);
+
+    if (value == nullAtom)
+        return TranslateAttributeInherit;
+    if (equalIgnoringCase(value, "yes") || equalIgnoringCase(value, ""))
+        return TranslateAttributeYes;
+    if (equalIgnoringCase(value, "no"))
+        return TranslateAttributeNo;
+
+    return TranslateAttributeInherit;
+}
+
+bool HTMLElement::translate() const
+{
+    for (const Node* n = this; n; n = n->parentNode()) {
+        if (n->isHTMLElement()) {
+            TranslateAttributeMode mode = static_cast<const HTMLElement*>(n)->translateAttributeMode();
+            if (mode != TranslateAttributeInherit) {
+                ASSERT(mode == TranslateAttributeYes || mode == TranslateAttributeNo);
+                return mode == TranslateAttributeYes;
+            }
+        }
+    }
+
+    // Default on the root element is translate=yes.
+    return true;
+}
+
+void HTMLElement::setTranslate(bool enable)
+{
+    setAttribute(translateAttr, enable ? "yes" : "no");
+}
+
+
 HTMLCollection* HTMLElement::children()
 {
     return ensureCachedHTMLCollection(NodeChildren);
@@ -1065,6 +1067,137 @@ void HTMLElement::setItemValueText(const String& value, ExceptionCode& ec)
 }
 #endif
 
+void HTMLElement::addHTMLLengthToStyle(StylePropertySet* style, int propertyID, const String& value)
+{
+    // FIXME: This function should not spin up the CSS parser, but should instead just figure out the correct
+    // length unit and make the appropriate parsed value.
+
+    // strip attribute garbage..
+    StringImpl* v = value.impl();
+    if (v) {
+        unsigned int l = 0;
+
+        while (l < v->length() && (*v)[l] <= ' ')
+            l++;
+
+        for (; l < v->length(); l++) {
+            UChar cc = (*v)[l];
+            if (cc > '9')
+                break;
+            if (cc < '0') {
+                if (cc == '%' || cc == '*')
+                    l++;
+                if (cc != '.')
+                    break;
+            }
+        }
+
+        if (l != v->length()) {
+            addPropertyToAttributeStyle(style, propertyID, v->substring(0, l));
+            return;
+        }
+    }
+
+    addPropertyToAttributeStyle(style, propertyID, value);
+}
+
+static RGBA32 parseColorStringWithCrazyLegacyRules(const String& colorString)
+{
+    // Per spec, only look at the first 128 digits of the string.
+    const size_t maxColorLength = 128;
+    // We'll pad the buffer with two extra 0s later, so reserve two more than the max.
+    Vector<char, maxColorLength+2> digitBuffer;
+
+    size_t i = 0;
+    // Skip a leading #.
+    if (colorString[0] == '#')
+        i = 1;
+
+    // Grab the first 128 characters, replacing non-hex characters with 0.
+    // Non-BMP characters are replaced with "00" due to them appearing as two "characters" in the String.
+    for (; i < colorString.length() && digitBuffer.size() < maxColorLength; i++) {
+        if (!isASCIIHexDigit(colorString[i]))
+            digitBuffer.append('0');
+        else
+            digitBuffer.append(colorString[i]);
+    }
+
+    if (!digitBuffer.size())
+        return Color::black;
+
+    // Pad the buffer out to at least the next multiple of three in size.
+    digitBuffer.append('0');
+    digitBuffer.append('0');
+
+    if (digitBuffer.size() < 6)
+        return makeRGB(toASCIIHexValue(digitBuffer[0]), toASCIIHexValue(digitBuffer[1]), toASCIIHexValue(digitBuffer[2]));
+
+    // Split the digits into three components, then search the last 8 digits of each component.
+    ASSERT(digitBuffer.size() >= 6);
+    size_t componentLength = digitBuffer.size() / 3;
+    size_t componentSearchWindowLength = min<size_t>(componentLength, 8);
+    size_t redIndex = componentLength - componentSearchWindowLength;
+    size_t greenIndex = componentLength * 2 - componentSearchWindowLength;
+    size_t blueIndex = componentLength * 3 - componentSearchWindowLength;
+    // Skip digits until one of them is non-zero, or we've only got two digits left in the component.
+    while (digitBuffer[redIndex] == '0' && digitBuffer[greenIndex] == '0' && digitBuffer[blueIndex] == '0' && (componentLength - redIndex) > 2) {
+        redIndex++;
+        greenIndex++;
+        blueIndex++;
+    }
+    ASSERT(redIndex + 1 < componentLength);
+    ASSERT(greenIndex >= componentLength);
+    ASSERT(greenIndex + 1 < componentLength * 2);
+    ASSERT(blueIndex >= componentLength * 2);
+    ASSERT(blueIndex + 1 < digitBuffer.size());
+
+    int redValue = toASCIIHexValue(digitBuffer[redIndex], digitBuffer[redIndex + 1]);
+    int greenValue = toASCIIHexValue(digitBuffer[greenIndex], digitBuffer[greenIndex + 1]);
+    int blueValue = toASCIIHexValue(digitBuffer[blueIndex], digitBuffer[blueIndex + 1]);
+    return makeRGB(redValue, greenValue, blueValue);
+}
+
+// Color parsing that matches HTML's "rules for parsing a legacy color value"
+void HTMLElement::addHTMLColorToStyle(StylePropertySet* style, int propertyID, const String& attributeValue)
+{
+    // An empty string doesn't apply a color. (One containing only whitespace does, which is why this check occurs before stripping.)
+    if (attributeValue.isEmpty())
+        return;
+
+    String colorString = attributeValue.stripWhiteSpace();
+
+    // "transparent" doesn't apply a color either.
+    if (equalIgnoringCase(colorString, "transparent"))
+        return;
+
+    // If the string is a named CSS color or a 3/6-digit hex color, use that.
+    Color parsedColor(colorString);
+    if (!parsedColor.isValid())
+        parsedColor.setRGB(parseColorStringWithCrazyLegacyRules(colorString));
+
+    style->setProperty(propertyID, document()->cssValuePool()->createColorValue(parsedColor.rgb()));
+}
+
+void StyledElement::copyNonAttributeProperties(const Element* sourceElement)
+{
+    ASSERT(sourceElement);
+    ASSERT(sourceElement->isStyledElement());
+
+    const StyledElement* source = static_cast<const StyledElement*>(sourceElement);
+    if (!source->inlineStyleDecl())
+        return;
+
+    StylePropertySet* inlineStyle = ensureInlineStyleDecl();
+    inlineStyle->copyPropertiesFrom(*source->inlineStyleDecl());
+    inlineStyle->setStrictParsing(source->inlineStyleDecl()->useStrictParsing());
+
+    setIsStyleAttributeValid(source->isStyleAttributeValid());
+    setIsSynchronizingStyleAttribute(source->isSynchronizingStyleAttribute());
+    
+    Element::copyNonAttributeProperties(sourceElement);
+}
+
+
 } // namespace WebCore
 
 #ifndef NDEBUG
diff --git a/Source/WebCore/html/HTMLElement.h b/Source/WebCore/html/HTMLElement.h
index 47197261a..9d463cd77 100644
--- a/Source/WebCore/html/HTMLElement.h
+++ b/Source/WebCore/html/HTMLElement.h
@@ -35,6 +35,12 @@ class HTMLFormElement;
 class MicroDataItemValue;
 #endif
 
+enum TranslateAttributeMode {
+    TranslateAttributeYes,
+    TranslateAttributeNo,
+    TranslateAttributeInherit
+};
+
 class HTMLElement : public StyledElement {
 public:
     static PassRefPtr<HTMLElement> create(const QualifiedName& tagName, Document*);
@@ -68,6 +74,9 @@ public:
     bool spellcheck() const;
     void setSpellcheck(bool);
 
+    bool translate() const;
+    void setTranslate(bool);
+
     void click();
 
     virtual void accessKeyAction(bool sendMouseEvents);
@@ -79,8 +88,6 @@ public:
 
     HTMLFormElement* form() const { return virtualForm(); }
 
-    static void addHTMLAlignmentToStyledElement(StyledElement*, Attribute*);
-
     HTMLFormElement* findFormAncestor() const;
 
     TextDirection directionalityIfhasDirAutoAttribute(bool& isAuto) const;
@@ -93,11 +100,15 @@ public:
 protected:
     HTMLElement(const QualifiedName& tagName, Document*);
 
-    void addHTMLAlignment(Attribute*);
-    void removeHTMLAlignment();
+    void addHTMLLengthToStyle(StylePropertySet*, int propertyID, const String& value);
+    void addHTMLColorToStyle(StylePropertySet*, int propertyID, const String& color);
+
+    void applyAlignmentAttributeToStyle(Attribute*, StylePropertySet*);
+    void applyBorderAttributeToStyle(Attribute*, StylePropertySet*);
 
     virtual void parseAttribute(Attribute*) OVERRIDE;
-    void applyBorderAttribute(Attribute*);
+    virtual bool isPresentationAttribute(Attribute*) const OVERRIDE;
+    virtual void collectStyleForAttribute(Attribute*, StylePropertySet*) OVERRIDE;
 
     virtual void childrenChanged(bool changedByParser = false, Node* beforeChange = 0, Node* afterChange = 0, int childCountDelta = 0);
     void calculateAndAdjustDirectionality();
@@ -107,9 +118,7 @@ protected:
 private:
     virtual String nodeName() const;
 
-    void mapLanguageAttributeToLocale(Attribute*);
-
-    void setContentEditable(Attribute*);
+    void mapLanguageAttributeToLocale(Attribute*, StylePropertySet*);
 
     virtual HTMLFormElement* virtualForm() const;
 
@@ -121,6 +130,8 @@ private:
     void adjustDirectionalityIfNeededAfterChildrenChanged(Node* beforeChange, int childCountDelta);
     TextDirection directionality(Node** strongDirectionalityTextNode= 0) const;
 
+    TranslateAttributeMode translateAttributeMode() const;
+
 #if ENABLE(MICRODATA)
     virtual String itemValueText() const;
     virtual void setItemValueText(const String&, ExceptionCode&);
diff --git a/Source/WebCore/html/HTMLElement.idl b/Source/WebCore/html/HTMLElement.idl
index 308010f40..8d5a0688d 100644
--- a/Source/WebCore/html/HTMLElement.idl
+++ b/Source/WebCore/html/HTMLElement.idl
@@ -22,13 +22,15 @@ module html {
 
     interface [
         JSGenerateToNativeObject,
-        JSCustomPushEventHandlerScope
+        JSCustomPushEventHandlerScope,
+        V8CustomToJSObject
     ] HTMLElement : Element {
                  // iht.com relies on id returning the empty string when no id is present. 
                  // Other browsers do this as well. So we don't convert null to JS null.
                  attribute [Reflect] DOMString id;
                  attribute [Reflect] DOMString title;
                  attribute [Reflect] DOMString lang;
+                 attribute boolean             translate;
                  attribute [Reflect] DOMString dir;
                  attribute [Reflect=class] DOMString className;
                  readonly attribute DOMTokenList classList;
@@ -49,14 +51,14 @@ module html {
                  attribute [TreatNullAs=NullString] DOMString outerText
                      setter raises(DOMException);
 
-        Element insertAdjacentElement(in [Optional=CallWithDefaultValue] DOMString where,
-                                      in [Optional=CallWithDefaultValue] Element element)
+        Element insertAdjacentElement(in [Optional=DefaultIsUndefined] DOMString where,
+                                      in [Optional=DefaultIsUndefined] Element element)
             raises(DOMException);
-        void insertAdjacentHTML(in [Optional=CallWithDefaultValue] DOMString where,
-                                in [Optional=CallWithDefaultValue] DOMString html)
+        void insertAdjacentHTML(in [Optional=DefaultIsUndefined] DOMString where,
+                                in [Optional=DefaultIsUndefined] DOMString html)
             raises(DOMException);
-        void insertAdjacentText(in [Optional=CallWithDefaultValue] DOMString where,
-                                in [Optional=CallWithDefaultValue] DOMString text)
+        void insertAdjacentText(in [Optional=DefaultIsUndefined] DOMString where,
+                                in [Optional=DefaultIsUndefined] DOMString text)
             raises(DOMException);
 
         readonly attribute HTMLCollection children;
@@ -88,6 +90,8 @@ module html {
 #if defined(LANGUAGE_OBJECTIVE_C) && LANGUAGE_OBJECTIVE_C
         readonly attribute DOMString titleDisplayString;
 #endif
+
+        void click();
     };
 
 }
diff --git a/Source/WebCore/html/HTMLEmbedElement.cpp b/Source/WebCore/html/HTMLEmbedElement.cpp
index 1d64ecaae..06cb9b1e9 100644
--- a/Source/WebCore/html/HTMLEmbedElement.cpp
+++ b/Source/WebCore/html/HTMLEmbedElement.cpp
@@ -74,6 +74,24 @@ RenderWidget* HTMLEmbedElement::renderWidgetForJSBindings()
     return findWidgetRenderer(this);
 }
 
+bool HTMLEmbedElement::isPresentationAttribute(Attribute* attr) const
+{
+    if (attr->name() == hiddenAttr)
+        return true;
+    return HTMLPlugInImageElement::isPresentationAttribute(attr);
+}
+
+void HTMLEmbedElement::collectStyleForAttribute(Attribute* attr, StylePropertySet* style)
+{
+    if (attr->name() == hiddenAttr) {
+        if (equalIgnoringCase(attr->value(), "yes") || equalIgnoringCase(attr->value(), "true")) {
+            addPropertyToAttributeStyle(style, CSSPropertyWidth, 0, CSSPrimitiveValue::CSS_PX);
+            addPropertyToAttributeStyle(style, CSSPropertyHeight, 0, CSSPrimitiveValue::CSS_PX);
+        }
+    } else
+        HTMLPlugInImageElement::collectStyleForAttribute(attr, style);
+}
+
 void HTMLEmbedElement::parseAttribute(Attribute* attr)
 {
     const AtomicString& value = attr->value();
@@ -94,14 +112,6 @@ void HTMLEmbedElement::parseAttribute(Attribute* attr)
                 m_imageLoader = adoptPtr(new HTMLImageLoader(this));
             m_imageLoader->updateFromElementIgnoringPreviousError();
         }
-    } else if (attr->name() == hiddenAttr) {
-        if (equalIgnoringCase(value.string(), "yes") || equalIgnoringCase(value.string(), "true")) {
-            // FIXME: Not dynamic, since we add this but don't remove it, but it may be OK for now
-            // that this rarely-used attribute won't work properly if you remove it.
-            addCSSLength(CSSPropertyWidth, "0");
-            addCSSLength(CSSPropertyHeight, "0");
-        } else
-            removeCSSProperties(CSSPropertyWidth, CSSPropertyHeight);
     } else
         HTMLPlugInImageElement::parseAttribute(attr);
 }
@@ -164,7 +174,7 @@ void HTMLEmbedElement::updateWidget(PluginCreationOption pluginCreationOption)
 
     SubframeLoader* loader = document()->frame()->loader()->subframeLoader();
     // FIXME: beforeLoad could have detached the renderer!  Just like in the <object> case above.
-    loader->requestObject(this, m_url, getAttribute(nameAttr), m_serviceType, paramNames, paramValues);
+    loader->requestObject(this, m_url, getNameAttribute(), m_serviceType, paramNames, paramValues);
 }
 
 bool HTMLEmbedElement::rendererIsNeeded(const NodeRenderingContext& context)
diff --git a/Source/WebCore/html/HTMLEmbedElement.h b/Source/WebCore/html/HTMLEmbedElement.h
index f37760361..f0fca2224 100644
--- a/Source/WebCore/html/HTMLEmbedElement.h
+++ b/Source/WebCore/html/HTMLEmbedElement.h
@@ -35,6 +35,8 @@ private:
     HTMLEmbedElement(const QualifiedName&, Document*, bool createdByParser);
 
     virtual void parseAttribute(Attribute*) OVERRIDE;
+    virtual bool isPresentationAttribute(Attribute*) const OVERRIDE;
+    virtual void collectStyleForAttribute(Attribute*, StylePropertySet*) OVERRIDE;
 
     virtual bool rendererIsNeeded(const NodeRenderingContext&);
     virtual void insertedIntoDocument();
diff --git a/Source/WebCore/html/HTMLEmbedElement.idl b/Source/WebCore/html/HTMLEmbedElement.idl
index 8ccc38830..b6e3c166a 100644
--- a/Source/WebCore/html/HTMLEmbedElement.idl
+++ b/Source/WebCore/html/HTMLEmbedElement.idl
@@ -22,7 +22,7 @@ module html {
 
     interface [
         CustomNamedSetter,
-        JSCustomGetOwnPropertySlotDelegate,
+        JSCustomGetOwnPropertySlotAndDescriptor,
         CustomCall
     ] HTMLEmbedElement : HTMLElement {
     attribute [Reflect] DOMString align;
@@ -42,7 +42,7 @@ module html {
 
 #if defined(ENABLE_SVG) && ENABLE_SVG
 #if !defined(LANGUAGE_OBJECTIVE_C) || !LANGUAGE_OBJECTIVE_C || defined(ENABLE_SVG_DOM_OBJC_BINDINGS) && ENABLE_SVG_DOM_OBJC_BINDINGS
-    [CheckAccessToNode] SVGDocument getSVGDocument() raises(DOMException);
+    [CheckSecurityForNode] SVGDocument getSVGDocument() raises(DOMException);
 #endif
 #endif
     };
diff --git a/Source/WebCore/html/HTMLFontElement.cpp b/Source/WebCore/html/HTMLFontElement.cpp
index 86f52984a..a7c2e950b 100644
--- a/Source/WebCore/html/HTMLFontElement.cpp
+++ b/Source/WebCore/html/HTMLFontElement.cpp
@@ -26,6 +26,8 @@
 #include "Attribute.h"
 #include "CSSPropertyNames.h"
 #include "CSSValueKeywords.h"
+#include "CSSValueList.h"
+#include "CSSValuePool.h"
 #include "HTMLNames.h"
 #include "HTMLParserIdioms.h"
 #include <wtf/text/StringBuilder.h>
@@ -158,26 +160,26 @@ bool HTMLFontElement::cssValueFromFontSizeNumber(const String& s, int& size)
     return true;
 }
 
-void HTMLFontElement::parseAttribute(Attribute* attr)
+bool HTMLFontElement::isPresentationAttribute(Attribute* attr) const
+{
+    if (attr->name() == sizeAttr || attr->name() == colorAttr || attr->name() == faceAttr)
+        return true;
+    return HTMLElement::isPresentationAttribute(attr);
+}
+
+void HTMLFontElement::collectStyleForAttribute(Attribute* attr, StylePropertySet* style)
 {
     if (attr->name() == sizeAttr) {
         int size = 0;
         if (cssValueFromFontSizeNumber(attr->value(), size))
-            addCSSProperty(CSSPropertyFontSize, size);
-        else
-            removeCSSProperty(CSSPropertyFontSize);
-    } else if (attr->name() == colorAttr) {
-        if (attr->value().isNull())
-            removeCSSProperty(CSSPropertyColor);
-        else
-            addCSSColor(CSSPropertyColor, attr->value());
-    } else if (attr->name() == faceAttr) {
-        if (attr->value().isNull())
-            removeCSSProperty(CSSPropertyFontFamily);
-        else
-            addCSSProperty(CSSPropertyFontFamily, attr->value());
+            addPropertyToAttributeStyle(style, CSSPropertyFontSize, size);
+    } else if (attr->name() == colorAttr)
+        addHTMLColorToStyle(style, CSSPropertyColor, attr->value());
+    else if (attr->name() == faceAttr) {
+        if (RefPtr<CSSValueList> fontFaceValue = document()->cssValuePool()->createFontFaceValue(attr->value(), document()->elementSheet()))
+            style->setProperty(CSSProperty(CSSPropertyFontFamily, fontFaceValue.release()));
     } else
-        HTMLElement::parseAttribute(attr);
+        HTMLElement::collectStyleForAttribute(attr, style);
 }
 
 }
diff --git a/Source/WebCore/html/HTMLFontElement.h b/Source/WebCore/html/HTMLFontElement.h
index eea8b44fb..f24332c31 100644
--- a/Source/WebCore/html/HTMLFontElement.h
+++ b/Source/WebCore/html/HTMLFontElement.h
@@ -37,7 +37,8 @@ public:
 private:
     HTMLFontElement(const QualifiedName&, Document*);
 
-    virtual void parseAttribute(Attribute*) OVERRIDE;
+    virtual bool isPresentationAttribute(Attribute*) const OVERRIDE;
+    virtual void collectStyleForAttribute(Attribute*, StylePropertySet*) OVERRIDE;
 };
 
 } // namespace
diff --git a/Source/WebCore/html/HTMLFormCollection.cpp b/Source/WebCore/html/HTMLFormCollection.cpp
index 919e09c01..684e3a5aa 100644
--- a/Source/WebCore/html/HTMLFormCollection.cpp
+++ b/Source/WebCore/html/HTMLFormCollection.cpp
@@ -164,7 +164,7 @@ void HTMLFormCollection::updateNameCache() const
         if (associatedElement->isEnumeratable()) {
             HTMLElement* element = toHTMLElement(associatedElement);
             const AtomicString& idAttrVal = element->getIdAttribute();
-            const AtomicString& nameAttrVal = element->getAttribute(nameAttr);
+            const AtomicString& nameAttrVal = element->getNameAttribute();
             if (!idAttrVal.isEmpty()) {
                 append(m_cache.idCache, idAttrVal, element);
                 foundInputElements.add(idAttrVal.impl());
@@ -179,7 +179,7 @@ void HTMLFormCollection::updateNameCache() const
     for (unsigned i = 0; i < f->m_imageElements.size(); ++i) {
         HTMLImageElement* element = f->m_imageElements[i];
         const AtomicString& idAttrVal = element->getIdAttribute();
-        const AtomicString& nameAttrVal = element->getAttribute(nameAttr);
+        const AtomicString& nameAttrVal = element->getNameAttribute();
         if (!idAttrVal.isEmpty() && !foundInputElements.contains(idAttrVal.impl()))
             append(m_cache.idCache, idAttrVal, element);
         if (!nameAttrVal.isEmpty() && idAttrVal != nameAttrVal && !foundInputElements.contains(nameAttrVal.impl()))
diff --git a/Source/WebCore/html/HTMLFormControlElement.cpp b/Source/WebCore/html/HTMLFormControlElement.cpp
index c092f617a..8a72df061 100644
--- a/Source/WebCore/html/HTMLFormControlElement.cpp
+++ b/Source/WebCore/html/HTMLFormControlElement.cpp
@@ -227,7 +227,7 @@ void HTMLFormControlElement::removedFromDocument()
 
 const AtomicString& HTMLFormControlElement::formControlName() const
 {
-    const AtomicString& name = fastGetAttribute(nameAttr);
+    const AtomicString& name = getNameAttribute();
     return name.isNull() ? emptyAtom : name;
 }
 
diff --git a/Source/WebCore/html/HTMLFormElement.cpp b/Source/WebCore/html/HTMLFormElement.cpp
index 89f1e7b9b..213b336d9 100644
--- a/Source/WebCore/html/HTMLFormElement.cpp
+++ b/Source/WebCore/html/HTMLFormElement.cpp
@@ -500,7 +500,7 @@ HTMLCollection* HTMLFormElement::elements()
 
 String HTMLFormElement::name() const
 {
-    return getAttribute(nameAttr);
+    return getNameAttribute();
 }
 
 bool HTMLFormElement::noValidate() const
diff --git a/Source/WebCore/html/HTMLFrameElement.idl b/Source/WebCore/html/HTMLFrameElement.idl
index 51a471621..f40f7b1c5 100644
--- a/Source/WebCore/html/HTMLFrameElement.idl
+++ b/Source/WebCore/html/HTMLFrameElement.idl
@@ -32,14 +32,14 @@ module html {
         attribute [Reflect, URL] DOMString src;
 
         // Introduced in DOM Level 2:
-        readonly attribute [CheckAccessToNode] Document contentDocument;
+        readonly attribute [CheckSecurityForNode] Document contentDocument;
 
         // Extensions
         readonly attribute DOMWindow contentWindow;
 
 #if defined(ENABLE_SVG) && ENABLE_SVG
 #if !defined(LANGUAGE_OBJECTIVE_C) || !LANGUAGE_OBJECTIVE_C || defined(ENABLE_SVG_DOM_OBJC_BINDINGS) && ENABLE_SVG_DOM_OBJC_BINDINGS
-        [CheckAccessToNode] SVGDocument getSVGDocument()
+        [CheckSecurityForNode] SVGDocument getSVGDocument()
             raises(DOMException);
 #endif
 #endif
diff --git a/Source/WebCore/html/HTMLFrameElementBase.cpp b/Source/WebCore/html/HTMLFrameElementBase.cpp
index 727173bb9..0841230da 100644
--- a/Source/WebCore/html/HTMLFrameElementBase.cpp
+++ b/Source/WebCore/html/HTMLFrameElementBase.cpp
@@ -174,7 +174,7 @@ void HTMLFrameElementBase::parseAttribute(Attribute* attr)
 
 void HTMLFrameElementBase::setNameAndOpenURL()
 {
-    m_frameName = getAttribute(nameAttr);
+    m_frameName = getNameAttribute();
     if (m_frameName.isNull())
         m_frameName = getIdAttribute();
     openURL();
diff --git a/Source/WebCore/html/HTMLFrameSetElement.cpp b/Source/WebCore/html/HTMLFrameSetElement.cpp
index 4af6342bd..d3fdb97a4 100644
--- a/Source/WebCore/html/HTMLFrameSetElement.cpp
+++ b/Source/WebCore/html/HTMLFrameSetElement.cpp
@@ -64,6 +64,21 @@ PassRefPtr<HTMLFrameSetElement> HTMLFrameSetElement::create(const QualifiedName&
     return adoptRef(new HTMLFrameSetElement(tagName, document));
 }
 
+bool HTMLFrameSetElement::isPresentationAttribute(Attribute* attr) const
+{
+    if (attr->name() == bordercolorAttr)
+        return true;
+    return HTMLElement::isPresentationAttribute(attr);
+}
+
+void HTMLFrameSetElement::collectStyleForAttribute(Attribute* attr, StylePropertySet* style)
+{
+    if (attr->name() == bordercolorAttr)
+        addHTMLColorToStyle(style, CSSPropertyBorderColor, attr->value());
+    else
+        HTMLElement::collectStyleForAttribute(attr, style);
+}
+
 void HTMLFrameSetElement::parseAttribute(Attribute* attr)
 {
     if (attr->name() == rowsAttr) {
@@ -98,13 +113,9 @@ void HTMLFrameSetElement::parseAttribute(Attribute* attr)
             m_borderSet = true;
         } else
             m_borderSet = false;
-    } else if (attr->name() == bordercolorAttr) {
+    } else if (attr->name() == bordercolorAttr)
         m_borderColorSet = !attr->isEmpty();
-        if (attr->value().isNull())
-            removeCSSProperty(CSSPropertyBorderColor);
-        else
-            addCSSColor(CSSPropertyBorderColor, attr->value());
-    } else if (attr->name() == onloadAttr)
+    else if (attr->name() == onloadAttr)
         document()->setWindowAttributeEventListener(eventNames().loadEvent, createAttributeEventListener(document()->frame(), attr));
     else if (attr->name() == onbeforeunloadAttr)
         document()->setWindowAttributeEventListener(eventNames().beforeunloadEvent, createAttributeEventListener(document()->frame(), attr));
diff --git a/Source/WebCore/html/HTMLFrameSetElement.h b/Source/WebCore/html/HTMLFrameSetElement.h
index 187902396..1cd40a290 100644
--- a/Source/WebCore/html/HTMLFrameSetElement.h
+++ b/Source/WebCore/html/HTMLFrameSetElement.h
@@ -68,6 +68,8 @@ private:
     HTMLFrameSetElement(const QualifiedName&, Document*);
 
     virtual void parseAttribute(Attribute*) OVERRIDE;
+    virtual bool isPresentationAttribute(Attribute*) const OVERRIDE;
+    virtual void collectStyleForAttribute(Attribute*, StylePropertySet*) OVERRIDE;
 
     virtual void attach();
     virtual bool rendererIsNeeded(const NodeRenderingContext&);
diff --git a/Source/WebCore/html/HTMLHRElement.cpp b/Source/WebCore/html/HTMLHRElement.cpp
index 5534b929f..8f8b6e140 100644
--- a/Source/WebCore/html/HTMLHRElement.cpp
+++ b/Source/WebCore/html/HTMLHRElement.cpp
@@ -26,6 +26,7 @@
 #include "Attribute.h"
 #include "CSSPropertyNames.h"
 #include "CSSValueKeywords.h"
+#include "CSSValuePool.h"
 #include "HTMLNames.h"
 
 namespace WebCore {
@@ -48,70 +49,52 @@ PassRefPtr<HTMLHRElement> HTMLHRElement::create(const QualifiedName& tagName, Do
     return adoptRef(new HTMLHRElement(tagName, document));
 }
 
-void HTMLHRElement::parseAttribute(Attribute* attr)
+bool HTMLHRElement::isPresentationAttribute(Attribute* attr) const
+{
+    if (attr->name() == alignAttr || attr->name() == widthAttr || attr->name() == colorAttr || attr->name() == noshadeAttr || attr->name() == sizeAttr)
+        return true;
+    return HTMLElement::isPresentationAttribute(attr);
+}
+
+void HTMLHRElement::collectStyleForAttribute(Attribute* attr, StylePropertySet* style)
 {
     if (attr->name() == alignAttr) {
-        if (attr->value().isNull()) {
-            removeCSSProperties(CSSPropertyMarginLeft, CSSPropertyMarginRight);
-        } else if (equalIgnoringCase(attr->value(), "left")) {
-            addCSSProperty(CSSPropertyMarginLeft, "0");
-            addCSSProperty(CSSPropertyMarginRight, CSSValueAuto);
+        if (equalIgnoringCase(attr->value(), "left")) {
+            addPropertyToAttributeStyle(style, CSSPropertyMarginLeft, 0, CSSPrimitiveValue::CSS_PX);
+            addPropertyToAttributeStyle(style, CSSPropertyMarginRight, CSSValueAuto);
         } else if (equalIgnoringCase(attr->value(), "right")) {
-            addCSSProperty(CSSPropertyMarginLeft, CSSValueAuto);
-            addCSSProperty(CSSPropertyMarginRight, "0");
+            addPropertyToAttributeStyle(style, CSSPropertyMarginLeft, CSSValueAuto);
+            addPropertyToAttributeStyle(style, CSSPropertyMarginRight, 0, CSSPrimitiveValue::CSS_PX);
         } else {
-            addCSSProperty(CSSPropertyMarginLeft, CSSValueAuto);
-            addCSSProperty(CSSPropertyMarginRight, CSSValueAuto);
+            addPropertyToAttributeStyle(style, CSSPropertyMarginLeft, CSSValueAuto);
+            addPropertyToAttributeStyle(style, CSSPropertyMarginRight, CSSValueAuto);
         }
     } else if (attr->name() == widthAttr) {
-        if (attr->value().isNull())
-            removeCSSProperty(CSSPropertyWidth);
-        else {
-            bool ok;
-            int v = attr->value().toInt(&ok);
-            if (ok && !v)
-                addCSSLength(CSSPropertyWidth, "1");
-            else
-                addCSSLength(CSSPropertyWidth, attr->value());
-        }
+        bool ok;
+        int v = attr->value().toInt(&ok);
+        if (ok && !v)
+            addPropertyToAttributeStyle(style, CSSPropertyWidth, 1, CSSPrimitiveValue::CSS_PX);
+        else
+            addHTMLLengthToStyle(style, CSSPropertyWidth, attr->value());
     } else if (attr->name() == colorAttr) {
-        if (attr->value().isNull())
-            removeCSSProperties(CSSPropertyBorderTopStyle, CSSPropertyBorderRightStyle, CSSPropertyBorderBottomStyle, CSSPropertyBorderLeftStyle, CSSPropertyBorderColor, CSSPropertyBackgroundColor);
-        else {
-            addCSSProperty(CSSPropertyBorderTopStyle, CSSValueSolid);
-            addCSSProperty(CSSPropertyBorderRightStyle, CSSValueSolid);
-            addCSSProperty(CSSPropertyBorderBottomStyle, CSSValueSolid);
-            addCSSProperty(CSSPropertyBorderLeftStyle, CSSValueSolid);
-            addCSSColor(CSSPropertyBorderColor, attr->value());
-            addCSSColor(CSSPropertyBackgroundColor, attr->value());
-        }
+        addPropertyToAttributeStyle(style, CSSPropertyBorderStyle, CSSValueSolid);
+        addHTMLColorToStyle(style, CSSPropertyBorderColor, attr->value());
+        addHTMLColorToStyle(style, CSSPropertyBackgroundColor, attr->value());
     } else if (attr->name() == noshadeAttr) {
-        if (attr->value().isNull())
-            removeCSSProperties(CSSPropertyBorderTopStyle, CSSPropertyBorderRightStyle, CSSPropertyBorderBottomStyle, CSSPropertyBorderLeftStyle, CSSPropertyBorderColor, CSSPropertyBackgroundColor);
-        else {
-            addCSSProperty(CSSPropertyBorderTopStyle, CSSValueSolid);
-            addCSSProperty(CSSPropertyBorderRightStyle, CSSValueSolid);
-            addCSSProperty(CSSPropertyBorderBottomStyle, CSSValueSolid);
-            addCSSProperty(CSSPropertyBorderLeftStyle, CSSValueSolid);
-            addCSSColor(CSSPropertyBorderColor, String("grey"));
-            addCSSColor(CSSPropertyBackgroundColor, String("grey"));
-        }
+        addPropertyToAttributeStyle(style, CSSPropertyBorderStyle, CSSValueSolid);
+
+        RefPtr<CSSPrimitiveValue> darkGrayValue = document()->cssValuePool()->createColorValue(Color::darkGray);
+        style->setProperty(CSSPropertyBorderColor, darkGrayValue);
+        style->setProperty(CSSPropertyBackgroundColor, darkGrayValue);
     } else if (attr->name() == sizeAttr) {
-        if (attr->value().isNull())
-            removeCSSProperties(CSSPropertyBorderBottomWidth, CSSPropertyHeight);
-        else {
-            StringImpl* si = attr->value().impl();
-            int size = si->toInt();
-            if (size <= 1) {
-                addCSSProperty(CSSPropertyBorderBottomWidth, String("0"));
-                removeCSSProperty(CSSPropertyHeight);
-            } else {
-                addCSSLength(CSSPropertyHeight, String::number(size-2));
-                removeCSSProperty(CSSPropertyBorderBottomWidth);
-            }
-        }
+        StringImpl* si = attr->value().impl();
+        int size = si->toInt();
+        if (size <= 1)
+            addPropertyToAttributeStyle(style, CSSPropertyBorderBottomWidth, 0, CSSPrimitiveValue::CSS_PX);
+        else
+            addPropertyToAttributeStyle(style, CSSPropertyHeight, size - 2, CSSPrimitiveValue::CSS_PX);
     } else
-        HTMLElement::parseAttribute(attr);
+        HTMLElement::collectStyleForAttribute(attr, style);
 }
 
 }
diff --git a/Source/WebCore/html/HTMLHRElement.h b/Source/WebCore/html/HTMLHRElement.h
index f05085b29..728619ac5 100644
--- a/Source/WebCore/html/HTMLHRElement.h
+++ b/Source/WebCore/html/HTMLHRElement.h
@@ -37,7 +37,8 @@ public:
 private:
     HTMLHRElement(const QualifiedName&, Document*);
 
-    virtual void parseAttribute(Attribute*) OVERRIDE;
+    virtual bool isPresentationAttribute(Attribute*) const OVERRIDE;
+    virtual void collectStyleForAttribute(Attribute*, StylePropertySet*) OVERRIDE;
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/html/HTMLIFrameElement.cpp b/Source/WebCore/html/HTMLIFrameElement.cpp
index 5cba88842..a846fa432 100644
--- a/Source/WebCore/html/HTMLIFrameElement.cpp
+++ b/Source/WebCore/html/HTMLIFrameElement.cpp
@@ -48,15 +48,35 @@ PassRefPtr<HTMLIFrameElement> HTMLIFrameElement::create(const QualifiedName& tag
     return adoptRef(new HTMLIFrameElement(tagName, document));
 }
 
-void HTMLIFrameElement::parseAttribute(Attribute* attr)
+bool HTMLIFrameElement::isPresentationAttribute(Attribute* attr) const
+{
+    if (attr->name() == widthAttr || attr->name() == heightAttr || attr->name() == alignAttr || attr->name() == frameborderAttr)
+        return true;
+    return HTMLFrameElementBase::isPresentationAttribute(attr);
+}
+
+void HTMLIFrameElement::collectStyleForAttribute(Attribute* attr, StylePropertySet* style)
 {
     if (attr->name() == widthAttr)
-        addCSSLength(CSSPropertyWidth, attr->value());
+        addHTMLLengthToStyle(style, CSSPropertyWidth, attr->value());
     else if (attr->name() == heightAttr)
-        addCSSLength(CSSPropertyHeight, attr->value());
+        addHTMLLengthToStyle(style, CSSPropertyHeight, attr->value());
     else if (attr->name() == alignAttr)
-        addHTMLAlignment(attr);
-    else if (attr->name() == nameAttr) {
+        applyAlignmentAttributeToStyle(attr, style);
+    else if (attr->name() == frameborderAttr) {
+        // Frame border doesn't really match the HTML4 spec definition for iframes. It simply adds
+        // a presentational hint that the border should be off if set to zero.
+        if (!attr->isNull() && !attr->value().toInt()) {
+            // Add a rule that nulls out our border width.
+            addPropertyToAttributeStyle(style, CSSPropertyBorderWidth, 0, CSSPrimitiveValue::CSS_PX);
+        }
+    } else
+        HTMLFrameElementBase::collectStyleForAttribute(attr, style);
+}
+
+void HTMLIFrameElement::parseAttribute(Attribute* attr)
+{
+    if (attr->name() == nameAttr) {
         const AtomicString& newName = attr->value();
         if (inDocument() && document()->isHTMLDocument()) {
             HTMLDocument* document = static_cast<HTMLDocument*>(this->document());
@@ -64,14 +84,6 @@ void HTMLIFrameElement::parseAttribute(Attribute* attr)
             document->addExtraNamedItem(newName);
         }
         m_name = newName;
-    } else if (attr->name() == frameborderAttr) {
-        // Frame border doesn't really match the HTML4 spec definition for iframes.  It simply adds
-        // a presentational hint that the border should be off if set to zero.
-        if (!attr->isNull() && !attr->value().toInt()) {
-            // Add a rule that nulls out our border width.
-            addCSSLength(CSSPropertyBorderWidth, "0");
-        } else
-            removeCSSProperty(CSSPropertyBorderWidth);
     } else if (attr->name() == sandboxAttr)
         setSandboxFlags(attr->isNull() ? SandboxNone : SecurityContext::parseSandboxPolicy(attr->value()));
     else
diff --git a/Source/WebCore/html/HTMLIFrameElement.h b/Source/WebCore/html/HTMLIFrameElement.h
index bcba2a257..075841091 100644
--- a/Source/WebCore/html/HTMLIFrameElement.h
+++ b/Source/WebCore/html/HTMLIFrameElement.h
@@ -36,6 +36,8 @@ private:
     HTMLIFrameElement(const QualifiedName&, Document*);
 
     virtual void parseAttribute(Attribute*) OVERRIDE;
+    virtual bool isPresentationAttribute(Attribute*) const OVERRIDE;
+    virtual void collectStyleForAttribute(Attribute*, StylePropertySet*) OVERRIDE;
 
     virtual void insertedIntoDocument();
     virtual void removedFromDocument();
diff --git a/Source/WebCore/html/HTMLIFrameElement.idl b/Source/WebCore/html/HTMLIFrameElement.idl
index 1e88269e0..25f9cb14b 100644
--- a/Source/WebCore/html/HTMLIFrameElement.idl
+++ b/Source/WebCore/html/HTMLIFrameElement.idl
@@ -34,14 +34,14 @@ module html {
         attribute [Reflect] DOMString width;
 
         // Introduced in DOM Level 2:
-        readonly attribute [CheckAccessToNode] Document contentDocument;
+        readonly attribute [CheckSecurityForNode] Document contentDocument;
 
         // Extensions
         readonly attribute DOMWindow contentWindow;
 
 #if defined(ENABLE_SVG) && ENABLE_SVG
 #if !defined(LANGUAGE_OBJECTIVE_C) || !LANGUAGE_OBJECTIVE_C || defined(ENABLE_SVG_DOM_OBJC_BINDINGS) && ENABLE_SVG_DOM_OBJC_BINDINGS
-        [CheckAccessToNode] SVGDocument getSVGDocument()
+        [CheckSecurityForNode] SVGDocument getSVGDocument()
             raises(DOMException);
 #endif
 #endif
diff --git a/Source/WebCore/html/HTMLImageElement.cpp b/Source/WebCore/html/HTMLImageElement.cpp
index 6c22edc12..583a23fc8 100644
--- a/Source/WebCore/html/HTMLImageElement.cpp
+++ b/Source/WebCore/html/HTMLImageElement.cpp
@@ -78,6 +78,35 @@ PassRefPtr<HTMLImageElement> HTMLImageElement::createForJSConstructor(Document*
     return image.release();
 }
 
+bool HTMLImageElement::isPresentationAttribute(Attribute* attr) const
+{
+    if (attr->name() == widthAttr || attr->name() == heightAttr || attr->name() == borderAttr || attr->name() == vspaceAttr || attr->name() == hspaceAttr || attr->name() == alignAttr || attr->name() == valignAttr)
+        return true;
+    return HTMLElement::isPresentationAttribute(attr);
+}
+
+void HTMLImageElement::collectStyleForAttribute(Attribute* attr, StylePropertySet* style)
+{
+    if (attr->name() == widthAttr)
+        addHTMLLengthToStyle(style, CSSPropertyWidth, attr->value());
+    else if (attr->name() == heightAttr)
+        addHTMLLengthToStyle(style, CSSPropertyHeight, attr->value());
+    else if (attr->name() == borderAttr)
+        applyBorderAttributeToStyle(attr, style);
+    else if (attr->name() == vspaceAttr) {
+        addHTMLLengthToStyle(style, CSSPropertyMarginTop, attr->value());
+        addHTMLLengthToStyle(style, CSSPropertyMarginBottom, attr->value());
+    } else if (attr->name() == hspaceAttr) {
+        addHTMLLengthToStyle(style, CSSPropertyMarginLeft, attr->value());
+        addHTMLLengthToStyle(style, CSSPropertyMarginRight, attr->value());
+    } else if (attr->name() == alignAttr)
+        applyAlignmentAttributeToStyle(attr, style);
+    else if (attr->name() == valignAttr)
+        addPropertyToAttributeStyle(style, CSSPropertyVerticalAlign, attr->value());
+    else
+        HTMLElement::collectStyleForAttribute(attr, style);
+}
+
 void HTMLImageElement::parseAttribute(Attribute* attr)
 {
     const QualifiedName& attrName = attr->name();
@@ -86,40 +115,6 @@ void HTMLImageElement::parseAttribute(Attribute* attr)
             toRenderImage(renderer())->updateAltText();
     } else if (attrName == srcAttr)
         m_imageLoader.updateFromElementIgnoringPreviousError();
-    else if (attrName == widthAttr)
-        if (attr->value().isNull())
-            removeCSSProperty(CSSPropertyWidth);
-        else
-            addCSSLength(CSSPropertyWidth, attr->value());
-    else if (attrName == heightAttr)
-        if (attr->value().isNull())
-            removeCSSProperty(CSSPropertyHeight);
-        else
-            addCSSLength(CSSPropertyHeight, attr->value());
-    else if (attrName == borderAttr) {
-        // border="noborder" -> border="0"
-        applyBorderAttribute(attr);
-    } else if (attrName == vspaceAttr) {
-        if (attr->value().isNull())
-            removeCSSProperties(CSSPropertyMarginTop, CSSPropertyMarginBottom);
-        else {
-            addCSSLength(CSSPropertyMarginTop, attr->value());
-            addCSSLength(CSSPropertyMarginBottom, attr->value());
-        }
-    } else if (attrName == hspaceAttr) {
-        if (attr->value().isNull())
-            removeCSSProperties(CSSPropertyMarginLeft, CSSPropertyMarginRight);
-        else {
-            addCSSLength(CSSPropertyMarginLeft, attr->value());
-            addCSSLength(CSSPropertyMarginRight, attr->value());
-        }
-    } else if (attrName == alignAttr)
-        addHTMLAlignment(attr);
-    else if (attrName == valignAttr)
-        if (attr->value().isNull())
-            removeCSSProperty(CSSPropertyVerticalAlign);
-        else
-            addCSSProperty(CSSPropertyVerticalAlign, attr->value());
     else if (attrName == usemapAttr)
         setIsLink(!attr->isNull());
     else if (attrName == onabortAttr)
diff --git a/Source/WebCore/html/HTMLImageElement.h b/Source/WebCore/html/HTMLImageElement.h
index b24d348bb..37a23775a 100644
--- a/Source/WebCore/html/HTMLImageElement.h
+++ b/Source/WebCore/html/HTMLImageElement.h
@@ -84,6 +84,8 @@ protected:
 
 private:
     virtual void parseAttribute(Attribute*) OVERRIDE;
+    virtual bool isPresentationAttribute(Attribute*) const OVERRIDE;
+    virtual void collectStyleForAttribute(Attribute*, StylePropertySet*) OVERRIDE;
 
     virtual void attach();
     virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
diff --git a/Source/WebCore/html/HTMLInputElement.cpp b/Source/WebCore/html/HTMLInputElement.cpp
index 960040fdd..422ac8513 100644
--- a/Source/WebCore/html/HTMLInputElement.cpp
+++ b/Source/WebCore/html/HTMLInputElement.cpp
@@ -51,6 +51,7 @@
 #include "RenderTextControlSingleLine.h"
 #include "RenderTheme.h"
 #include "SearchInputType.h"
+#include "ShadowRoot.h"
 #include "ScriptEventListener.h"
 #include "WheelEvent.h"
 #include <wtf/MathExtras.h>
@@ -108,6 +109,9 @@ PassRefPtr<HTMLInputElement> HTMLInputElement::create(const QualifiedName& tagNa
 
 void HTMLInputElement::createShadowSubtree()
 {
+    ASSERT(!hasShadowRoot());
+    ShadowRoot::create(this, ShadowRoot::CreatingUserAgentShadowRoot, ASSERT_NO_EXCEPTION);
+
     m_inputType->createShadowSubtree();
 }
 
@@ -349,7 +353,7 @@ bool HTMLInputElement::getAllowedValueStepWithDecimalPlaces(AnyStepHandling anyS
     return true;
 }
 
-void HTMLInputElement::applyStep(double count, AnyStepHandling anyStepHandling, bool sendChangeEvent, ExceptionCode& ec)
+void HTMLInputElement::applyStep(double count, AnyStepHandling anyStepHandling, TextFieldEventBehavior eventBehavior, ExceptionCode& ec)
 {
     double step;
     unsigned stepDecimalPlaces, currentDecimalPlaces;
@@ -389,7 +393,7 @@ void HTMLInputElement::applyStep(double count, AnyStepHandling anyStepHandling,
     if (newValue > m_inputType->maximum())
         newValue = m_inputType->maximum();
 
-    setValueAsNumber(newValue, ec, sendChangeEvent);
+    setValueAsNumber(newValue, ec, eventBehavior);
 
     if (AXObjectCache::accessibilityEnabled())
          document()->axObjectCache()->postNotification(renderer(), AXObjectCache::AXValueChanged, true);
@@ -416,14 +420,12 @@ double HTMLInputElement::alignValueForStep(double newValue, double step, unsigne
 
 void HTMLInputElement::stepUp(int n, ExceptionCode& ec)
 {
-    bool sendChangeEvent = false;
-    applyStep(n, RejectAny, sendChangeEvent, ec);
+    applyStep(n, RejectAny, DispatchNoEvent, ec);
 }
 
 void HTMLInputElement::stepDown(int n, ExceptionCode& ec)
 {
-    bool sendChangeEvent = false;
-    applyStep(-n, RejectAny, sendChangeEvent, ec);
+    applyStep(-n, RejectAny, DispatchNoEvent, ec);
 }
 
 bool HTMLInputElement::isKeyboardFocusable(KeyboardEvent* event) const
@@ -545,7 +547,7 @@ void HTMLInputElement::updateType()
         registerForSuspensionCallbackIfNeeded();
 
     if (didRespectHeightAndWidth != m_inputType->shouldRespectHeightAndWidthAttributes()) {
-        ASSERT(attributeMap());
+        ASSERT(attributeData());
         if (Attribute* height = getAttributeItem(heightAttr))
             attributeChanged(height);
         if (Attribute* width = getAttributeItem(widthAttr))
@@ -658,6 +660,36 @@ void HTMLInputElement::accessKeyAction(bool sendMouseEvents)
     m_inputType->accessKeyAction(sendMouseEvents);
 }
 
+bool HTMLInputElement::isPresentationAttribute(Attribute* attr) const
+{
+    if (attr->name() == vspaceAttr || attr->name() == hspaceAttr || attr->name() == alignAttr || attr->name() == widthAttr || attr->name() == heightAttr || (attr->name() == borderAttr && isImageButton()))
+        return true;
+    return HTMLTextFormControlElement::isPresentationAttribute(attr);
+}
+
+void HTMLInputElement::collectStyleForAttribute(Attribute* attr, StylePropertySet* style)
+{
+    if (attr->name() == vspaceAttr) {
+        addHTMLLengthToStyle(style, CSSPropertyMarginTop, attr->value());
+        addHTMLLengthToStyle(style, CSSPropertyMarginBottom, attr->value());
+    } else if (attr->name() == hspaceAttr) {
+        addHTMLLengthToStyle(style, CSSPropertyMarginLeft, attr->value());
+        addHTMLLengthToStyle(style, CSSPropertyMarginRight, attr->value());
+    } else if (attr->name() == alignAttr) {
+        if (m_inputType->shouldRespectAlignAttribute())
+            applyAlignmentAttributeToStyle(attr, style);
+    } else if (attr->name() == widthAttr) {
+        if (m_inputType->shouldRespectHeightAndWidthAttributes())
+            addHTMLLengthToStyle(style, CSSPropertyWidth, attr->value());
+    } else if (attr->name() == heightAttr) {
+        if (m_inputType->shouldRespectHeightAndWidthAttributes())
+            addHTMLLengthToStyle(style, CSSPropertyHeight, attr->value());
+    } else if (attr->name() == borderAttr && isImageButton())
+        applyBorderAttributeToStyle(attr, style);
+    else
+        return HTMLTextFormControlElement::collectStyleForAttribute(attr, style);
+}
+
 void HTMLInputElement::parseAttribute(Attribute* attr)
 {
     if (attr->name() == nameAttr) {
@@ -713,29 +745,6 @@ void HTMLInputElement::parseAttribute(Attribute* attr)
         m_inputType->srcAttributeChanged();
     else if (attr->name() == usemapAttr || attr->name() == accesskeyAttr) {
         // FIXME: ignore for the moment
-    } else if (attr->name() == vspaceAttr) {
-        addCSSLength(CSSPropertyMarginTop, attr->value());
-        addCSSLength(CSSPropertyMarginBottom, attr->value());
-    } else if (attr->name() == hspaceAttr) {
-        addCSSLength(CSSPropertyMarginLeft, attr->value());
-        addCSSLength(CSSPropertyMarginRight, attr->value());
-    } else if (attr->name() == alignAttr) {
-        if (m_inputType->shouldRespectAlignAttribute())
-            addHTMLAlignment(attr);
-        else
-            removeHTMLAlignment();
-    } else if (attr->name() == widthAttr) {
-        if (m_inputType->shouldRespectHeightAndWidthAttributes())
-            addCSSLength(CSSPropertyWidth, attr->value());
-        else
-            removeCSSProperty(CSSPropertyWidth);
-    } else if (attr->name() == heightAttr) {
-        if (m_inputType->shouldRespectHeightAndWidthAttributes())
-            addCSSLength(CSSPropertyHeight, attr->value());
-        else
-            removeCSSProperty(CSSPropertyHeight);
-    } else if (attr->name() == borderAttr && isImageButton()) {
-        applyBorderAttribute(attr);
     } else if (attr->name() == onsearchAttr) {
         // Search field and slider attributes all just cause updateFromElement to be called through style recalcing.
         setAttributeEventListener(eventNames().searchEvent, createAttributeEventListener(this, attr));
@@ -900,7 +909,7 @@ bool HTMLInputElement::isTextType() const
     return m_inputType->isTextType();
 }
 
-void HTMLInputElement::setChecked(bool nowChecked, bool sendChangeEvent)
+void HTMLInputElement::setChecked(bool nowChecked, TextFieldEventBehavior eventBehavior)
 {
     if (checked() == nowChecked)
         return;
@@ -925,7 +934,7 @@ void HTMLInputElement::setChecked(bool nowChecked, bool sendChangeEvent)
     // unchecked to match other browsers. DOM is not a useful standard for this
     // because it says only to fire change events at "lose focus" time, which is
     // definitely wrong in practice for these types of elements.
-    if (sendChangeEvent && inDocument() && m_inputType->shouldSendChangeEventAfterCheckedChanged()) {
+    if (eventBehavior != DispatchNoEvent && inDocument() && m_inputType->shouldSendChangeEventAfterCheckedChanged()) {
         setTextAsOfLastFormControlChangeEvent(String());
         dispatchFormControlChangeEvent();
     }
@@ -999,7 +1008,7 @@ String HTMLInputElement::valueWithDefault() const
 void HTMLInputElement::setValueForUser(const String& value)
 {
     // Call setValue and make it send a change event.
-    setValue(value, true);
+    setValue(value, DispatchChangeEvent);
 }
 
 const String& HTMLInputElement::suggestedValue() const
@@ -1017,7 +1026,7 @@ void HTMLInputElement::setSuggestedValue(const String& value)
     updateInnerTextValue();
 }
 
-void HTMLInputElement::setValue(const String& value, bool sendChangeEvent)
+void HTMLInputElement::setValue(const String& value, TextFieldEventBehavior eventBehavior)
 {
     if (!m_inputType->canSetValue(value))
         return;
@@ -1029,25 +1038,18 @@ void HTMLInputElement::setValue(const String& value, bool sendChangeEvent)
     setLastChangeWasNotUserEdit();
     setFormControlValueMatchesRenderer(false);
     m_suggestedValue = String(); // Prevent TextFieldInputType::setValue from using the suggested value.
-    m_inputType->setValue(sanitizedValue, valueChanged, sendChangeEvent);
+    m_inputType->setValue(sanitizedValue, valueChanged, eventBehavior);
 
     if (!valueChanged)
         return;
 
-    if (sendChangeEvent)
-        m_inputType->dispatchChangeEventInResponseToSetValue();
-
-    // FIXME: Why do we do this when !sendChangeEvent?
-    if (isTextField() && (!focused() || !sendChangeEvent))
-        setTextAsOfLastFormControlChangeEvent(value);
-
     notifyFormStateChanged();
 }
 
-void HTMLInputElement::setValueInternal(const String& sanitizedValue, bool sendChangeEvent)
+void HTMLInputElement::setValueInternal(const String& sanitizedValue, TextFieldEventBehavior eventBehavior)
 {
     m_valueIfDirty = sanitizedValue;
-    m_wasModifiedByUser = sendChangeEvent;
+    m_wasModifiedByUser = eventBehavior != DispatchNoEvent;
     setNeedsValidityCheck();
 }
 
@@ -1066,13 +1068,13 @@ double HTMLInputElement::valueAsNumber() const
     return m_inputType->valueAsNumber();
 }
 
-void HTMLInputElement::setValueAsNumber(double newValue, ExceptionCode& ec, bool sendChangeEvent)
+void HTMLInputElement::setValueAsNumber(double newValue, ExceptionCode& ec, TextFieldEventBehavior eventBehavior)
 {
     if (!isfinite(newValue)) {
         ec = NOT_SUPPORTED_ERR;
         return;
     }
-    m_inputType->setValueAsNumber(newValue, sendChangeEvent, ec);
+    m_inputType->setValueAsNumber(newValue, eventBehavior, ec);
 }
 
 String HTMLInputElement::placeholder() const
@@ -1626,7 +1628,6 @@ void HTMLInputElement::stepUpFromRenderer(int n)
     const double nan = numeric_limits<double>::quiet_NaN();
     String currentStringValue = value();
     double current = m_inputType->parseToDouble(currentStringValue, nan);
-    const bool sendChangeEvent = true;
     if (!isfinite(current)) {
         ExceptionCode ec;
         current = m_inputType->defaultValueForStepUp();
@@ -1635,10 +1636,10 @@ void HTMLInputElement::stepUpFromRenderer(int n)
             current = m_inputType->minimum() - nextDiff;
         if (current > m_inputType->maximum() - nextDiff)
             current = m_inputType->maximum() - nextDiff;
-        setValueAsNumber(current, ec, sendChangeEvent);
+        setValueAsNumber(current, ec, DispatchInputAndChangeEvent);
     }
     if ((sign > 0 && current < m_inputType->minimum()) || (sign < 0 && current > m_inputType->maximum()))
-        setValue(m_inputType->serialize(sign > 0 ? m_inputType->minimum() : m_inputType->maximum()), sendChangeEvent);
+        setValue(m_inputType->serialize(sign > 0 ? m_inputType->minimum() : m_inputType->maximum()), DispatchInputAndChangeEvent);
     else {
         ExceptionCode ec;
         if (stepMismatch(value())) {
@@ -1658,14 +1659,14 @@ void HTMLInputElement::stepUpFromRenderer(int n)
             if (newValue > m_inputType->maximum())
                 newValue = m_inputType->maximum();
 
-            setValueAsNumber(newValue, ec, n == 1 || n == -1);
+            setValueAsNumber(newValue, ec, n == 1 || n == -1 ? DispatchInputAndChangeEvent : DispatchNoEvent);
             current = newValue;
             if (n > 1)
-                applyStep(n - 1, AnyIsDefaultStep, sendChangeEvent, ec);
+                applyStep(n - 1, AnyIsDefaultStep, DispatchInputAndChangeEvent, ec);
             else if (n < -1)
-                applyStep(n + 1, AnyIsDefaultStep, sendChangeEvent, ec);
+                applyStep(n + 1, AnyIsDefaultStep, DispatchInputAndChangeEvent, ec);
         } else
-            applyStep(n, AnyIsDefaultStep, sendChangeEvent, ec);
+            applyStep(n, AnyIsDefaultStep, DispatchInputAndChangeEvent, ec);
     }
 }
 
diff --git a/Source/WebCore/html/HTMLInputElement.h b/Source/WebCore/html/HTMLInputElement.h
index b6fa0f623..39cb48ba6 100644
--- a/Source/WebCore/html/HTMLInputElement.h
+++ b/Source/WebCore/html/HTMLInputElement.h
@@ -121,7 +121,7 @@ public:
     virtual HTMLElement* placeholderElement() const;
 
     bool checked() const { return m_isChecked; }
-    void setChecked(bool, bool sendChangeEvent = false);
+    void setChecked(bool, TextFieldEventBehavior = DispatchNoEvent);
 
     // 'indeterminate' is a state independent of the checked state that causes the control to draw in a way that hides the actual state.
     bool indeterminate() const { return m_isIndeterminate; }
@@ -136,7 +136,7 @@ public:
     void setType(const String&);
 
     String value() const;
-    void setValue(const String&, bool sendChangeEvent = false);
+    void setValue(const String&, TextFieldEventBehavior = DispatchNoEvent);
     void setValueForUser(const String&);
     // Checks if the specified string would be a valid value.
     // We should not call this for types with no string value such as CHECKBOX and RADIO.
@@ -160,7 +160,7 @@ public:
     void setValueAsDate(double, ExceptionCode&);
 
     double valueAsNumber() const;
-    void setValueAsNumber(double, ExceptionCode&, bool sendChangeEvent = false);
+    void setValueAsNumber(double, ExceptionCode&, TextFieldEventBehavior = DispatchNoEvent);
 
     virtual String placeholder() const;
     virtual void setPlaceholder(const String&);
@@ -225,7 +225,7 @@ public:
     // Otherwise, they would be private.
     CheckedRadioButtons& checkedRadioButtons() const;
     void updateCheckedRadioButtons();
-    void setValueInternal(const String&, bool sendChangeEvent);
+    void setValueInternal(const String&, TextFieldEventBehavior);
 
     void cacheSelectionInResponseToSetValue(int caretOffset) { cacheSelection(caretOffset, caretOffset, SelectionHasNoDirection); }
 
@@ -276,6 +276,8 @@ private:
     virtual void accessKeyAction(bool sendMouseEvents);
 
     virtual void parseAttribute(Attribute*) OVERRIDE;
+    virtual bool isPresentationAttribute(Attribute*) const OVERRIDE;
+    virtual void collectStyleForAttribute(Attribute*, StylePropertySet*) OVERRIDE;
     virtual void finishParsingChildren();
 
     virtual void copyNonAttributeProperties(const Element* source);
@@ -328,7 +330,7 @@ private:
     bool getAllowedValueStepWithDecimalPlaces(AnyStepHandling, double*, unsigned*) const;
 
     // Helper for stepUp()/stepDown().  Adds step value * count to the current value.
-    void applyStep(double count, AnyStepHandling, bool sendChangeEvent, ExceptionCode&);
+    void applyStep(double count, AnyStepHandling, TextFieldEventBehavior, ExceptionCode&);
     double alignValueForStep(double value, double step, unsigned currentDecimalPlaces, unsigned stepDecimalPlaces);
 
 #if ENABLE(DATALIST)
diff --git a/Source/WebCore/html/HTMLInputElement.idl b/Source/WebCore/html/HTMLInputElement.idl
index 4e218b96c..84beb8ac5 100644
--- a/Source/WebCore/html/HTMLInputElement.idl
+++ b/Source/WebCore/html/HTMLInputElement.idl
@@ -50,6 +50,7 @@ module html {
         attribute [Reflect] boolean readOnly;
         attribute [Reflect] boolean required;
 #if defined(LANGUAGE_OBJECTIVE_C) && LANGUAGE_OBJECTIVE_C
+        attribute [Reflect] DOMString accessKey;
         attribute [ObjCImplementedAsUnsignedLong] DOMString size; // DOM level 2 changed this to a long, but ObjC API is a string
 #else
         attribute unsigned long size; // Changed string -> long -> unsigned long
@@ -74,7 +75,10 @@ module html {
         boolean checkValidity();
         void setCustomValidity(in [TreatNullAs=NullString, TreatUndefinedAs=NullString] DOMString error);
         void select();
+
+#if defined(LANGUAGE_OBJECTIVE_C) && LANGUAGE_OBJECTIVE_C
         void click();
+#endif
 
 #if !defined(LANGUAGE_JAVASCRIPT) || !LANGUAGE_JAVASCRIPT
         void setValueForUser(in [TreatNullAs=NullString] DOMString value);
@@ -90,8 +94,8 @@ module html {
 #if defined(LANGUAGE_OBJECTIVE_C) && LANGUAGE_OBJECTIVE_C
         [Custom] void setSelectionRange(in long start, in long end);
 #else
-        [Custom] void setSelectionRange(in [Optional=CallWithDefaultValue] long start, 
-                                        in [Optional=CallWithDefaultValue] long end, 
+        [Custom] void setSelectionRange(in [Optional=DefaultIsUndefined] long start, 
+                                        in [Optional=DefaultIsUndefined] long end, 
                                         in [Optional] DOMString direction);
 #endif
 
diff --git a/Source/WebCore/html/HTMLKeygenElement.cpp b/Source/WebCore/html/HTMLKeygenElement.cpp
index 85252819a..e10079f64 100644
--- a/Source/WebCore/html/HTMLKeygenElement.cpp
+++ b/Source/WebCore/html/HTMLKeygenElement.cpp
@@ -33,6 +33,7 @@
 #include "HTMLOptionElement.h"
 #include "SSLKeyGenerator.h"
 #include "ShadowRoot.h"
+#include "ShadowRootList.h"
 #include "Text.h"
 #include <wtf/StdLibExtras.h>
 
@@ -85,7 +86,7 @@ inline HTMLKeygenElement::HTMLKeygenElement(const QualifiedName& tagName, Docume
         option->appendChild(Text::create(document, keys[i]), ec);
     }
 
-    ASSERT(!shadowRoot());
+    ASSERT(!hasShadowRoot());
     RefPtr<ShadowRoot> root = ShadowRoot::create(this, ShadowRoot::CreatingUserAgentShadowRoot);
     root->appendChild(select, ec);
 }
@@ -130,8 +131,8 @@ void HTMLKeygenElement::reset()
 
 HTMLSelectElement* HTMLKeygenElement::shadowSelect() const
 {
-    ShadowRoot* shadow = shadowRoot();
-    ASSERT(shadow);
+    ASSERT(hasShadowRoot());
+    ShadowRoot* shadow = shadowRootList()->oldestShadowRoot();
     return shadow ? toHTMLSelectElement(shadow->firstChild()) : 0;
 }
 
diff --git a/Source/WebCore/html/HTMLLIElement.cpp b/Source/WebCore/html/HTMLLIElement.cpp
index f789d32fe..ec7824ea4 100644
--- a/Source/WebCore/html/HTMLLIElement.cpp
+++ b/Source/WebCore/html/HTMLLIElement.cpp
@@ -49,26 +49,37 @@ PassRefPtr<HTMLLIElement> HTMLLIElement::create(const QualifiedName& tagName, Do
     return adoptRef(new HTMLLIElement(tagName, document));
 }
 
-void HTMLLIElement::parseAttribute(Attribute* attr)
+bool HTMLLIElement::isPresentationAttribute(Attribute* attr) const
 {
-    if (attr->name() == valueAttr) {
-        if (renderer() && renderer()->isListItem())
-            parseValue(attr->value());
-    } else if (attr->name() == typeAttr) {
-        if (attr->value().isNull())
-            removeCSSProperty(CSSPropertyListStyleType);
-        else if (attr->value() == "a")
-            addCSSProperty(CSSPropertyListStyleType, CSSValueLowerAlpha);
+    if (attr->name() == typeAttr)
+        return true;
+    return HTMLElement::isPresentationAttribute(attr);
+}
+
+void HTMLLIElement::collectStyleForAttribute(Attribute* attr, StylePropertySet* style)
+{
+    if (attr->name() == typeAttr) {
+        if (attr->value() == "a")
+            addPropertyToAttributeStyle(style, CSSPropertyListStyleType, CSSValueLowerAlpha);
         else if (attr->value() == "A")
-            addCSSProperty(CSSPropertyListStyleType, CSSValueUpperAlpha);
+            addPropertyToAttributeStyle(style, CSSPropertyListStyleType, CSSValueUpperAlpha);
         else if (attr->value() == "i")
-            addCSSProperty(CSSPropertyListStyleType, CSSValueLowerRoman);
+            addPropertyToAttributeStyle(style, CSSPropertyListStyleType, CSSValueLowerRoman);
         else if (attr->value() == "I")
-            addCSSProperty(CSSPropertyListStyleType, CSSValueUpperRoman);
+            addPropertyToAttributeStyle(style, CSSPropertyListStyleType, CSSValueUpperRoman);
         else if (attr->value() == "1")
-            addCSSProperty(CSSPropertyListStyleType, CSSValueDecimal);
+            addPropertyToAttributeStyle(style, CSSPropertyListStyleType, CSSValueDecimal);
         else
-            addCSSProperty(CSSPropertyListStyleType, attr->value());
+            addPropertyToAttributeStyle(style, CSSPropertyListStyleType, attr->value());
+    } else
+        HTMLElement::collectStyleForAttribute(attr, style);
+}
+
+void HTMLLIElement::parseAttribute(Attribute* attr)
+{
+    if (attr->name() == valueAttr) {
+        if (renderer() && renderer()->isListItem())
+            parseValue(attr->value());
     } else
         HTMLElement::parseAttribute(attr);
 }
diff --git a/Source/WebCore/html/HTMLLIElement.h b/Source/WebCore/html/HTMLLIElement.h
index 77a90e801..c730408a7 100644
--- a/Source/WebCore/html/HTMLLIElement.h
+++ b/Source/WebCore/html/HTMLLIElement.h
@@ -36,6 +36,8 @@ private:
     HTMLLIElement(const QualifiedName&, Document*);
 
     virtual void parseAttribute(Attribute*) OVERRIDE;
+    virtual bool isPresentationAttribute(Attribute*) const OVERRIDE;
+    virtual void collectStyleForAttribute(Attribute*, StylePropertySet*) OVERRIDE;
 
     virtual void attach();
 
diff --git a/Source/WebCore/html/HTMLLabelElement.idl b/Source/WebCore/html/HTMLLabelElement.idl
index 9460418cd..bf79680f8 100644
--- a/Source/WebCore/html/HTMLLabelElement.idl
+++ b/Source/WebCore/html/HTMLLabelElement.idl
@@ -24,6 +24,9 @@ module html {
         readonly attribute HTMLFormElement form;
         attribute [Reflect=for] DOMString htmlFor;
         readonly attribute HTMLElement control;
+#if defined(LANGUAGE_OBJECTIVE_C) && LANGUAGE_OBJECTIVE_C
+        attribute [Reflect] DOMString accessKey;
+#endif
     };
 
 }
diff --git a/Source/WebCore/html/HTMLLegendElement.idl b/Source/WebCore/html/HTMLLegendElement.idl
index 8cda34f58..bf755a5bb 100644
--- a/Source/WebCore/html/HTMLLegendElement.idl
+++ b/Source/WebCore/html/HTMLLegendElement.idl
@@ -23,6 +23,9 @@ module html {
     interface HTMLLegendElement : HTMLElement {
         readonly attribute HTMLFormElement form;
         attribute [Reflect] DOMString align;
+#if defined(LANGUAGE_OBJECTIVE_C) && LANGUAGE_OBJECTIVE_C
+        attribute [Reflect] DOMString accessKey;
+#endif
     };
 
 }
diff --git a/Source/WebCore/html/HTMLMarqueeElement.cpp b/Source/WebCore/html/HTMLMarqueeElement.cpp
index 1d883b409..a1445ad55 100644
--- a/Source/WebCore/html/HTMLMarqueeElement.cpp
+++ b/Source/WebCore/html/HTMLMarqueeElement.cpp
@@ -35,83 +35,78 @@ namespace WebCore {
 
 using namespace HTMLNames;
 
-// WinIE uses 60ms as the minimum delay by default.
-const int defaultMinimumDelay = 60;
-
 inline HTMLMarqueeElement::HTMLMarqueeElement(const QualifiedName& tagName, Document* document)
     : HTMLElement(tagName, document)
     , ActiveDOMObject(document, this)
-    , m_minimumDelay(defaultMinimumDelay)
 {
     ASSERT(hasTagName(marqueeTag));
 }
 
 PassRefPtr<HTMLMarqueeElement> HTMLMarqueeElement::create(const QualifiedName& tagName, Document* document)
 {
-    return adoptRef(new HTMLMarqueeElement(tagName, document));
+    RefPtr<HTMLMarqueeElement> marqueeElement(adoptRef(new HTMLMarqueeElement(tagName, document)));
+    marqueeElement->suspendIfNeeded();
+    return marqueeElement.release();
+}
+
+int HTMLMarqueeElement::minimumDelay() const
+{
+    if (fastGetAttribute(truespeedAttr).isEmpty()) {
+        // WinIE uses 60ms as the minimum delay by default.
+        return 60;
+    }
+    return 0;
+}
+
+bool HTMLMarqueeElement::isPresentationAttribute(Attribute* attr) const
+{
+    if (attr->name() == widthAttr || attr->name() == heightAttr || attr->name() == bgcolorAttr || attr->name() == vspaceAttr || attr->name() == hspaceAttr || attr->name() == scrollamountAttr || attr->name() == scrolldelayAttr || attr->name() == loopAttr || attr->name() == behaviorAttr || attr->name() == directionAttr)
+        return true;
+    return HTMLElement::isPresentationAttribute(attr);
 }
 
-void HTMLMarqueeElement::parseAttribute(Attribute* attr)
+void HTMLMarqueeElement::collectStyleForAttribute(Attribute* attr, StylePropertySet* style)
 {
     if (attr->name() == widthAttr) {
-        if (!attr->value().isEmpty())
-            addCSSLength(CSSPropertyWidth, attr->value());
-        else
-            removeCSSProperty(CSSPropertyWidth);
+        if (!attr->isEmpty())
+            addHTMLLengthToStyle(style, CSSPropertyWidth, attr->value());
     } else if (attr->name() == heightAttr) {
         if (!attr->value().isEmpty())
-            addCSSLength(CSSPropertyHeight, attr->value());
-        else
-            removeCSSProperty(CSSPropertyHeight);
+            addHTMLLengthToStyle(style, CSSPropertyHeight, attr->value());
     } else if (attr->name() == bgcolorAttr) {
         if (!attr->value().isEmpty())
-            addCSSColor(CSSPropertyBackgroundColor, attr->value());
-        else
-            removeCSSProperty(CSSPropertyBackgroundColor);
+            addHTMLColorToStyle(style, CSSPropertyBackgroundColor, attr->value());
     } else if (attr->name() == vspaceAttr) {
         if (!attr->value().isEmpty()) {
-            addCSSLength(CSSPropertyMarginTop, attr->value());
-            addCSSLength(CSSPropertyMarginBottom, attr->value());
-        } else
-            removeCSSProperties(CSSPropertyMarginTop, CSSPropertyMarginBottom);
+            addHTMLLengthToStyle(style, CSSPropertyMarginTop, attr->value());
+            addHTMLLengthToStyle(style, CSSPropertyMarginBottom, attr->value());
+        }
     } else if (attr->name() == hspaceAttr) {
         if (!attr->value().isEmpty()) {
-            addCSSLength(CSSPropertyMarginLeft, attr->value());
-            addCSSLength(CSSPropertyMarginRight, attr->value());
-        } else
-            removeCSSProperties(CSSPropertyMarginLeft, CSSPropertyMarginRight);
+            addHTMLLengthToStyle(style, CSSPropertyMarginLeft, attr->value());
+            addHTMLLengthToStyle(style, CSSPropertyMarginRight, attr->value());
+        }
     } else if (attr->name() == scrollamountAttr) {
         if (!attr->value().isEmpty())
-            addCSSLength(CSSPropertyWebkitMarqueeIncrement, attr->value());
-        else
-            removeCSSProperty(CSSPropertyWebkitMarqueeIncrement);
+            addHTMLLengthToStyle(style, CSSPropertyWebkitMarqueeIncrement, attr->value());
     } else if (attr->name() == scrolldelayAttr) {
         if (!attr->value().isEmpty())
-            addCSSLength(CSSPropertyWebkitMarqueeSpeed, attr->value());
-        else
-            removeCSSProperty(CSSPropertyWebkitMarqueeSpeed);
+            addHTMLLengthToStyle(style, CSSPropertyWebkitMarqueeSpeed, attr->value());
     } else if (attr->name() == loopAttr) {
         if (!attr->value().isEmpty()) {
             if (attr->value() == "-1" || equalIgnoringCase(attr->value(), "infinite"))
-                addCSSProperty(CSSPropertyWebkitMarqueeRepetition, CSSValueInfinite);
+                addPropertyToAttributeStyle(style, CSSPropertyWebkitMarqueeRepetition, CSSValueInfinite);
             else
-                addCSSLength(CSSPropertyWebkitMarqueeRepetition, attr->value());
-        } else
-            removeCSSProperty(CSSPropertyWebkitMarqueeRepetition);
+                addHTMLLengthToStyle(style, CSSPropertyWebkitMarqueeRepetition, attr->value());
+        }
     } else if (attr->name() == behaviorAttr) {
         if (!attr->value().isEmpty())
-            addCSSProperty(CSSPropertyWebkitMarqueeStyle, attr->value());
-        else
-            removeCSSProperty(CSSPropertyWebkitMarqueeStyle);
+            addPropertyToAttributeStyle(style, CSSPropertyWebkitMarqueeStyle, attr->value());
     } else if (attr->name() == directionAttr) {
         if (!attr->value().isEmpty())
-            addCSSProperty(CSSPropertyWebkitMarqueeDirection, attr->value());
-        else
-            removeCSSProperty(CSSPropertyWebkitMarqueeDirection);
-    } else if (attr->name() == truespeedAttr)
-        m_minimumDelay = !attr->isEmpty() ? 0 : defaultMinimumDelay;
-    else
-        HTMLElement::parseAttribute(attr);
+            addPropertyToAttributeStyle(style, CSSPropertyWebkitMarqueeDirection, attr->value());
+    } else
+        HTMLElement::collectStyleForAttribute(attr, style);
 }
 
 void HTMLMarqueeElement::start()
diff --git a/Source/WebCore/html/HTMLMarqueeElement.h b/Source/WebCore/html/HTMLMarqueeElement.h
index d1e3070d2..8ababa1d9 100644
--- a/Source/WebCore/html/HTMLMarqueeElement.h
+++ b/Source/WebCore/html/HTMLMarqueeElement.h
@@ -34,7 +34,7 @@ class HTMLMarqueeElement : public HTMLElement, private ActiveDOMObject {
 public:
     static PassRefPtr<HTMLMarqueeElement> create(const QualifiedName&, Document*);
 
-    int minimumDelay() const { return m_minimumDelay; }
+    int minimumDelay() const;
 
     // DOM Functions
 
@@ -53,7 +53,8 @@ public:
 private:
     HTMLMarqueeElement(const QualifiedName&, Document*);
 
-    virtual void parseAttribute(Attribute*) OVERRIDE;
+    virtual bool isPresentationAttribute(Attribute*) const OVERRIDE;
+    virtual void collectStyleForAttribute(Attribute*, StylePropertySet*) OVERRIDE;
 
     // ActiveDOMObject
     virtual bool canSuspend() const;
@@ -61,8 +62,6 @@ private:
     virtual void resume();
 
     RenderMarquee* renderMarquee() const;
-
-    int m_minimumDelay;
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/html/HTMLMediaElement.cpp b/Source/WebCore/html/HTMLMediaElement.cpp
index 7e664840b..b956d66d9 100644
--- a/Source/WebCore/html/HTMLMediaElement.cpp
+++ b/Source/WebCore/html/HTMLMediaElement.cpp
@@ -63,19 +63,23 @@
 #include "MediaQueryEvaluator.h"
 #include "MouseEvent.h"
 #include "MIMETypeRegistry.h"
+#include "NodeRenderingContext.h"
 #include "Page.h"
 #include "RenderVideo.h"
 #include "RenderView.h"
 #include "ScriptController.h"
 #include "ScriptEventListener.h"
 #include "SecurityOrigin.h"
+#include "SecurityPolicy.h"
 #include "Settings.h"
 #include "ShadowRoot.h"
+#include "ShadowRootList.h"
 #include "TimeRanges.h"
 #include "UUID.h"
 #include <limits>
 #include <wtf/CurrentTime.h>
 #include <wtf/MathExtras.h>
+#include <wtf/NonCopyingSort.h>
 #include <wtf/Uint8Array.h>
 #include <wtf/text/CString.h>
 
@@ -235,6 +239,7 @@ HTMLMediaElement::HTMLMediaElement(const QualifiedName& tagName, Document* docum
 #if ENABLE(VIDEO_TRACK)
     , m_tracksAreReady(true)
     , m_haveVisibleTextTrack(false)
+    , m_lastTextTrackUpdateTime(-1)
     , m_textTracks(0)
     , m_ignoreTrackDisplayUpdate(0)
 #endif
@@ -320,14 +325,13 @@ bool HTMLMediaElement::isMouseFocusable() const
     return false;
 }
 
-void HTMLMediaElement::attributeChanged(Attribute* attr)
+void HTMLMediaElement::parseAttribute(Attribute* attr)
 {
-    HTMLElement::attributeChanged(attr);
-
     const QualifiedName& attrName = attr->name();
+
     if (attrName == srcAttr) {
         // Trigger a reload, as long as the 'src' attribute is present.
-        if (!getAttribute(srcAttr).isEmpty())
+        if (fastHasAttribute(srcAttr))
             scheduleLoad(MediaResource);
     } else if (attrName == controlsAttr)
         configureMediaControls();
@@ -335,13 +339,7 @@ void HTMLMediaElement::attributeChanged(Attribute* attr)
     else if (attrName == loopAttr)
         updateDisableSleep();
 #endif
-}
-
-void HTMLMediaElement::parseAttribute(Attribute* attr)
-{
-    const QualifiedName& attrName = attr->name();
-
-    if (attrName == preloadAttr) {
+    else if (attrName == preloadAttr) {
         String value = attr->value();
 
         if (equalIgnoringCase(value, "none"))
@@ -467,7 +465,12 @@ RenderObject* HTMLMediaElement::createRenderer(RenderArena* arena, RenderStyle*)
     return new (arena) RenderMedia(this);
 #endif
 }
- 
+
+bool HTMLMediaElement::childShouldCreateRenderer(const NodeRenderingContext& childContext) const
+{
+    return childContext.isOnEncapsulationBoundary() && HTMLElement::childShouldCreateRenderer(childContext);
+}
+
 void HTMLMediaElement::insertedIntoDocument()
 {
     LOG(Media, "HTMLMediaElement::insertedIntoDocument");
@@ -554,6 +557,11 @@ void HTMLMediaElement::scheduleEvent(const AtomicString& eventName)
 
 void HTMLMediaElement::loadTimerFired(Timer<HTMLMediaElement>*)
 {
+#if ENABLE(VIDEO_TRACK)
+    if (m_pendingLoadFlags & TextTrackResource)
+        configureNewTextTracks();
+#endif
+
     if (m_pendingLoadFlags & MediaResource) {
         if (m_loadState == LoadingFromSourceElement)
             loadNextSourceChild();
@@ -561,11 +569,6 @@ void HTMLMediaElement::loadTimerFired(Timer<HTMLMediaElement>*)
             loadInternal();
     }
 
-#if ENABLE(VIDEO_TRACK)
-    if (m_pendingLoadFlags & TextTrackResource)
-        configureNewTextTracks();
-#endif
-
     m_pendingLoadFlags = 0;
 }
 
@@ -674,6 +677,9 @@ void HTMLMediaElement::prepareForLoad()
         invalidateCachedTime();
         scheduleEvent(eventNames().emptiedEvent);
         updateMediaController();
+#if ENABLE(VIDEO_TRACK)
+        updateActiveTextTrackCues(0);
+#endif
     }
 
     // 5 - Set the playbackRate attribute to the value of the defaultPlaybackRate attribute.
@@ -702,19 +708,6 @@ void HTMLMediaElement::prepareForLoad()
     // event may have already fired by then.
     setShouldDelayLoadEvent(true);
 
-#if ENABLE(VIDEO_TRACK)
-    // HTMLMediaElement::textTracksAreReady will need "... the text tracks whose mode was not in the
-    // disabled state when the element's resource selection algorithm last started".
-    m_textTracksWhenResourceSelectionBegan.clear();
-    if (m_textTracks) {
-        for (unsigned i = 0; i < m_textTracks->length(); ++i) {
-            TextTrack* track = m_textTracks->item(i);
-            if (track->mode() != TextTrack::DISABLED)
-                m_textTracksWhenResourceSelectionBegan.append(track);
-        }
-    }
-#endif
-
     configureMediaControls();
 }
 
@@ -735,6 +728,19 @@ void HTMLMediaElement::loadInternal()
     // put in the the background.
     removeBehaviorRestriction(RequirePageConsentToLoadMediaRestriction);
 
+#if ENABLE(VIDEO_TRACK)
+    // HTMLMediaElement::textTracksAreReady will need "... the text tracks whose mode was not in the
+    // disabled state when the element's resource selection algorithm last started".
+    m_textTracksWhenResourceSelectionBegan.clear();
+    if (m_textTracks) {
+        for (unsigned i = 0; i < m_textTracks->length(); ++i) {
+            TextTrack* track = m_textTracks->item(i);
+            if (track->mode() != TextTrack::DISABLED)
+                m_textTracksWhenResourceSelectionBegan.append(track);
+        }
+    }
+#endif
+
     selectMediaResource();
 }
 
@@ -937,33 +943,237 @@ void HTMLMediaElement::loadResource(const KURL& initialURL, ContentType& content
 }
 
 #if ENABLE(VIDEO_TRACK)
+static bool trackIndexCompare(TextTrack* a,
+                              TextTrack* b)
+{
+    return a->trackIndex() - b->trackIndex() < 0;
+}
+
+static bool eventTimeCueCompare(const std::pair<double, TextTrackCue*>& a,
+                                const std::pair<double, TextTrackCue*>& b)
+{
+    // 12 - Sort the tasks in events in ascending time order (tasks with earlier
+    // times first).
+    if (a.first != b.first)
+        return a.first - b.first < 0;
+
+    // If the cues belong to different text tracks, it doesn't make sense to
+    // compare the two tracks by the relative cue order, so return the relative
+    // track order.
+    if (a.second->track() != b.second->track())
+        return trackIndexCompare(a.second->track(), b.second->track());
+
+    // 12 - Further sort tasks in events that have the same time by the
+    // relative text track cue order of the text track cues associated
+    // with these tasks.
+    return a.second->cueIndex() - b.second->cueIndex() < 0;
+}
+
+
 void HTMLMediaElement::updateActiveTextTrackCues(float movieTime)
 {
+    LOG(Media, "HTMLMediaElement::updateActiveTextTracks");
+
+    // 4.8.10.8 Playing the media resource
+
+    //  If the current playback position changes while the steps are running,
+    //  then the user agent must wait for the steps to complete, and then must
+    //  immediately rerun the steps.
     if (ignoreTrackDisplayUpdateRequests())
         return;
-    
-    CueList previouslyActiveCues = m_currentlyActiveCues;
-    bool activeSetChanged = false;
 
-    m_currentlyActiveCues = m_cueTree.allOverlaps(m_cueTree.createInterval(movieTime, movieTime));
-    
-    // FIXME(72171): Events need to be sorted and filtered before dispatching.
-
-    for (size_t i = 0; i < previouslyActiveCues.size(); ++i) {
-        if (!m_currentlyActiveCues.contains(previouslyActiveCues[i])) {
-            previouslyActiveCues[i].data()->setIsActive(false);
-            activeSetChanged = true;
+    // 1 - Let current cues be a list of cues, initialized to contain all the
+    // cues of all the hidden, showing, or showing by default text tracks of the
+    // media element (not the disabled ones) whose start times are less than or
+    // equal to the current playback position and whose end times are greater
+    // than the current playback position.
+    Vector<CueIntervalTree::IntervalType> currentCues;
+
+    // The user agent must synchronously unset [the text track cue active] flag
+    // whenever ... the media element's readyState is changed back to HAVE_NOTHING.
+    if (m_readyState != HAVE_NOTHING && m_player)
+        currentCues = m_cueTree.allOverlaps(m_cueTree.createInterval(movieTime, movieTime));
+
+    Vector<CueIntervalTree::IntervalType> affectedCues;
+    Vector<CueIntervalTree::IntervalType> previousCues;
+    Vector<CueIntervalTree::IntervalType> missedCues;
+
+    // 2 - Let other cues be a list of cues, initialized to contain all the cues
+    // of hidden, showing, and showing by default text tracks of the media
+    // element that are not present in current cues.
+    previousCues = m_currentlyActiveCues;
+
+    // 3 - Let last time be the current playback position at the time this
+    // algorithm was last run for this media element, if this is not the first
+    // time it has run.
+    float lastTime = m_lastTextTrackUpdateTime;
+
+    // 4 - If the current playback position has, since the last time this
+    // algorithm was run, only changed through its usual monotonic increase
+    // during normal playback, then let missed cues be the list of cues in other
+    // cues whose start times are greater than or equal to last time and whose
+    // end times are less than or equal to the current playback position.
+    // Otherwise, let missed cues be an empty list.
+    if (lastTime >= 0 && m_lastSeekTime < movieTime) {
+        Vector<CueIntervalTree::IntervalType> potentiallySkippedCues =
+            m_cueTree.allOverlaps(m_cueTree.createInterval(lastTime, movieTime));
+
+        for (size_t i = 0; i < potentiallySkippedCues.size(); ++i) {
+            float cueStartTime = potentiallySkippedCues[i].low();
+            float cueEndTime = potentiallySkippedCues[i].high();
+
+            // Consider cues that may have been missed since the last seek time.
+            if (cueStartTime > max(m_lastSeekTime, lastTime) && cueEndTime < movieTime)
+                missedCues.append(potentiallySkippedCues[i]);
         }
     }
-    for (size_t i = 0; i < m_currentlyActiveCues.size(); ++i) {
-        if (!previouslyActiveCues.contains(m_currentlyActiveCues[i])) {
-            m_currentlyActiveCues[i].data()->setIsActive(true);
+
+    m_lastTextTrackUpdateTime = movieTime;
+
+    // 5 - If the time was reached through the usual monotonic increase of the
+    // current playback position during normal playback, and if the user agent
+    // has not fired a timeupdate event at the element in the past 15 to 250ms
+    // and is not still running event handlers for such an event, then the user
+    // agent must queue a task to fire a simple event named timeupdate at the
+    // element. (In the other cases, such as explicit seeks, relevant events get
+    // fired as part of the overall process of changing the current playback
+    // position.)
+    if (m_lastSeekTime <= lastTime)
+        scheduleTimeupdateEvent(false);
+
+    // Explicitly cache vector sizes, as their content is constant from here.
+    size_t currentCuesSize = currentCues.size();
+    size_t missedCuesSize = missedCues.size();
+    size_t previousCuesSize = previousCues.size();
+
+    // 6 - If all of the cues in current cues have their text track cue active
+    // flag set, none of the cues in other cues have their text track cue active
+    // flag set, and missed cues is empty, then abort these steps.
+    bool activeSetChanged = missedCuesSize;
+
+    for (size_t i = 0; !activeSetChanged && i < previousCuesSize; ++i)
+        if (!currentCues.contains(previousCues[i]) && previousCues[i].data()->isActive())
+            activeSetChanged = true;
+
+    for (size_t i = 0; !activeSetChanged && i < currentCuesSize; ++i) {
+        if (!currentCues[i].data()->isActive())
             activeSetChanged = true;
-        }
     }
-    
-    // FIXME(72173): Pause the media element for cues going past their endTime
-    // during a monotonic time increase.
+
+    if (!activeSetChanged)
+        return;
+
+    // 7 - If the time was reached through the usual monotonic increase of the
+    // current playback position during normal playback, and there are cues in
+    // other cues that have their text track cue pause-on-exi flag set and that
+    // either have their text track cue active flag set or are also in missed
+    // cues, then immediately pause the media element.
+    for (size_t i = 0; !m_paused && i < previousCuesSize; ++i) {
+        if (previousCues[i].data()->pauseOnExit()
+            && previousCues[i].data()->isActive()
+            && !currentCues.contains(previousCues[i]))
+            pause();
+    }
+
+    for (size_t i = 0; !m_paused && i < missedCuesSize; ++i) {
+        if (missedCues[i].data()->pauseOnExit())
+            pause();
+    }
+
+    // 8 - Let events be a list of tasks, initially empty. Each task in this
+    // list will be associated with a text track, a text track cue, and a time,
+    // which are used to sort the list before the tasks are queued.
+    Vector<std::pair<double, TextTrackCue*> > eventTasks;
+
+    // 8 - Let affected tracks be a list of text tracks, initially empty.
+    Vector<TextTrack*> affectedTracks;
+
+    for (size_t i = 0; i < missedCuesSize; ++i) {
+        // 9 - For each text track cue in missed cues, prepare an event named enter
+        // for the TextTrackCue object with the text track cue start time.
+        eventTasks.append(std::make_pair(missedCues[i].data()->startTime(),
+                                         missedCues[i].data()));
+
+        // 10 - For each text track in missed cues, prepare an event
+        // named exit for the TextTrackCue object with the text track cue end
+        // time.
+        eventTasks.append(std::make_pair(missedCues[i].data()->endTime(),
+                                         missedCues[i].data()));
+    }
+
+    for (size_t i = 0; i < previousCuesSize; ++i) {
+        // 10 - For each text track cue in other cues that has its text
+        // track cue active flag set prepare an event named exit for the
+        // TextTrackCue object with the text track cue end time.
+        if (!currentCues.contains(previousCues[i]))
+            eventTasks.append(std::make_pair(previousCues[i].data()->endTime(),
+                                             previousCues[i].data()));
+    }
+
+    for (size_t i = 0; i < currentCuesSize; ++i) {
+        // 11 - For each text track cue in current cues that does not have its
+        // text track cue active flag set, prepare an event named enter for the
+        // TextTrackCue object with the text track cue start time.
+        if (!previousCues.contains(currentCues[i]))
+            eventTasks.append(std::make_pair(currentCues[i].data()->startTime(),
+                                             currentCues[i].data()));
+    }
+
+    // 12 - Sort the tasks in events in ascending time order (tasks with earlier
+    // times first).
+    nonCopyingSort(eventTasks.begin(), eventTasks.end(), eventTimeCueCompare);
+
+    for (size_t i = 0; i < eventTasks.size(); ++i) {
+        if (!affectedTracks.contains(eventTasks[i].second->track()))
+            affectedTracks.append(eventTasks[i].second->track());
+
+        // 13 - Queue each task in events, in list order.
+        RefPtr<Event> event;
+
+        // Each event in eventTasks may be either an enterEvent or an exitEvent,
+        // depending on the time that is associated with the event. This
+        // correctly identifies the type of the event, since the startTime is
+        // always less than the endTime.
+        if (eventTasks[i].first == eventTasks[i].second->startTime())
+            event = Event::create(eventNames().enterEvent, false, false);
+        else
+            event = Event::create(eventNames().exitEvent, false, false);
+
+        event->setTarget(eventTasks[i].second);
+        m_asyncEventQueue.enqueueEvent(event.release());
+    }
+
+    // 14 - Sort affected tracks in the same order as the text tracks appear in
+    // the media element's list of text tracks, and remove duplicates.
+    nonCopyingSort(affectedTracks.begin(), affectedTracks.end(), trackIndexCompare);
+
+    // 15 - For each text track in affected tracks, in the list order, queue a
+    // task to fire a simple event named cuechange at the TextTrack object, and,
+    // if the text track has a corresponding track element, to then fire a
+    // simple event named cuechange at the track element as well.
+    for (size_t i = 0; i < affectedTracks.size(); ++i) {
+        RefPtr<Event> event = Event::create(eventNames().cuechangeEvent, false, false);
+        event->setTarget(affectedTracks[i]);
+
+        m_asyncEventQueue.enqueueEvent(event.release());
+
+        // Fire syncronous cue change event for track elements.
+        if (affectedTracks[i]->trackType() == TextTrack::TrackElement)
+            affectedTracks[i]->fireCueChangeEvent();
+    }
+
+    // 16 - Set the text track cue active flag of all the cues in the current
+    // cues, and unset the text track cue active flag of all the cues in the
+    // other cues.
+    for (size_t i = 0; i < currentCuesSize; ++i)
+        currentCues[i].data()->setIsActive(true);
+
+    for (size_t i = 0; i < previousCuesSize; ++i)
+        if (!currentCues.contains(previousCues[i]))
+            previousCues[i].data()->setIsActive(false);
+
+    // Update the current active cues.
+    m_currentlyActiveCues = currentCues;
 
     if (activeSetChanged && hasMediaControls())
         mediaControls()->updateTextTrackDisplay();
@@ -1313,21 +1523,32 @@ void HTMLMediaElement::setReadyState(MediaPlayer::ReadyState state)
     bool wasPotentiallyPlaying = potentiallyPlaying();
 
     ReadyState oldState = m_readyState;
-    m_readyState = static_cast<ReadyState>(state);
+    ReadyState newState = static_cast<ReadyState>(state);
 
 #if ENABLE(VIDEO_TRACK)
     bool tracksAreReady = textTracksAreReady();
 
-    if (m_readyState == oldState && m_tracksAreReady == tracksAreReady)
+    if (newState == oldState && m_tracksAreReady == tracksAreReady)
         return;
 
     m_tracksAreReady = tracksAreReady;
 #else
-    if (m_readyState == oldState)
+    if (newState == oldState)
         return;
     bool tracksAreReady = true;
 #endif
     
+    if (tracksAreReady)
+        m_readyState = newState;
+    else {
+        // If a media file has text tracks the readyState may not progress beyond HAVE_FUTURE_DATA until
+        // the text tracks are ready, regardless of the state of the media file.
+        if (newState <= HAVE_METADATA)
+            m_readyState = newState;
+        else
+            m_readyState = HAVE_CURRENT_DATA;
+    }
+    
     if (oldState > m_readyStateMaximum)
         m_readyStateMaximum = oldState;
 
@@ -1350,7 +1571,7 @@ void HTMLMediaElement::setReadyState(MediaPlayer::ReadyState state)
         }
     }
 
-    if (m_readyState >= HAVE_METADATA && oldState < HAVE_METADATA && tracksAreReady) {
+    if (m_readyState >= HAVE_METADATA && oldState < HAVE_METADATA) {
         prepareMediaFragmentURI();
         scheduleEvent(eventNames().durationchangeEvent);
         scheduleEvent(eventNames().loadedmetadataEvent);
@@ -1362,7 +1583,7 @@ void HTMLMediaElement::setReadyState(MediaPlayer::ReadyState state)
 
     bool shouldUpdateDisplayState = false;
 
-    if (m_readyState >= HAVE_CURRENT_DATA && oldState < HAVE_CURRENT_DATA && !m_haveFiredLoadedData && tracksAreReady) {
+    if (m_readyState >= HAVE_CURRENT_DATA && oldState < HAVE_CURRENT_DATA && !m_haveFiredLoadedData) {
         m_haveFiredLoadedData = true;
         shouldUpdateDisplayState = true;
         scheduleEvent(eventNames().loadeddataEvent);
@@ -1405,6 +1626,9 @@ void HTMLMediaElement::setReadyState(MediaPlayer::ReadyState state)
 
     updatePlayState();
     updateMediaController();
+#if ENABLE(VIDEO_TRACK)
+    updateActiveTextTrackCues(currentTime());
+#endif
 }
 
 #if ENABLE(MEDIA_SOURCE)
@@ -2680,6 +2904,10 @@ void HTMLMediaElement::mediaPlayerTimeChanged(MediaPlayer*)
 {
     LOG(Media, "HTMLMediaElement::mediaPlayerTimeChanged");
 
+#if ENABLE(VIDEO_TRACK)
+    updateActiveTextTrackCues(currentTime());
+#endif
+
     beginProcessingMediaPlayerCallback();
 
     invalidateCachedTime();
@@ -2728,9 +2956,6 @@ void HTMLMediaElement::mediaPlayerTimeChanged(MediaPlayer*)
         m_sentEndEvent = false;
 
     updatePlayState();
-#if ENABLE(VIDEO_TRACK)
-    updateActiveTextTrackCues(now);
-#endif
     endProcessingMediaPlayerCallback();
 }
 
@@ -3143,6 +3368,9 @@ void HTMLMediaElement::userCancelledLoad()
     // Reset m_readyState since m_player is gone.
     m_readyState = HAVE_NOTHING;
     updateMediaController();
+#if ENABLE(VIDEO_TRACK)
+    updateActiveTextTrackCues(0);
+#endif
 }
 
 bool HTMLMediaElement::canSuspend() const
@@ -3519,15 +3747,15 @@ void HTMLMediaElement::privateBrowsingStateDidChange()
 
 MediaControls* HTMLMediaElement::mediaControls()
 {
-    return toMediaControls(shadowRoot()->firstChild());
+    return toMediaControls(shadowRootList()->oldestShadowRoot()->firstChild());
 }
 
 bool HTMLMediaElement::hasMediaControls()
 {
-    if (!shadowRoot())
+    if (!hasShadowRoot())
         return false;
 
-    Node* node = shadowRoot()->firstChild();
+    Node* node = shadowRootList()->oldestShadowRoot()->firstChild();
     return node && node->isMediaControls();
 }
 
@@ -3816,6 +4044,14 @@ bool HTMLMediaElement::shouldDisableSleep() const
 }
 #endif
 
+String HTMLMediaElement::mediaPlayerReferrer() const
+{
+    Frame* frame = document()->frame();
+    if (!frame)
+        return String();
+
+    return SecurityPolicy::generateReferrerHeader(document()->referrerPolicy(), m_currentSrc, frame->loader()->outgoingReferrer());
 }
 
+}
 #endif
diff --git a/Source/WebCore/html/HTMLMediaElement.h b/Source/WebCore/html/HTMLMediaElement.h
index 76c24cbab..126b78f57 100644
--- a/Source/WebCore/html/HTMLMediaElement.h
+++ b/Source/WebCore/html/HTMLMediaElement.h
@@ -337,9 +337,9 @@ private:
 
     virtual bool supportsFocus() const;
     virtual bool isMouseFocusable() const;
-    virtual void attributeChanged(Attribute*) OVERRIDE;
     virtual bool rendererIsNeeded(const NodeRenderingContext&);
     virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
+    virtual bool childShouldCreateRenderer(const NodeRenderingContext&) const OVERRIDE;
     virtual void insertedIntoDocument();
     virtual void removedFromDocument();
     virtual void didRecalcStyle(StyleChange);
@@ -389,6 +389,8 @@ private:
     virtual String mediaPlayerSourceURL() const;
 #endif
 
+    virtual String mediaPlayerReferrer() const OVERRIDE;
+
     void loadTimerFired(Timer<HTMLMediaElement>*);
     void progressEventTimerFired(Timer<HTMLMediaElement>*);
     void playbackProgressTimerFired(Timer<HTMLMediaElement>*);
@@ -595,10 +597,13 @@ private:
 #if ENABLE(VIDEO_TRACK)
     bool m_tracksAreReady : 1;
     bool m_haveVisibleTextTrack : 1;
+    float m_lastTextTrackUpdateTime;
 
     RefPtr<TextTrackList> m_textTracks;
     Vector<RefPtr<TextTrack> > m_textTracksWhenResourceSelectionBegan;
+
     CueIntervalTree m_cueTree;
+
     CueList m_currentlyActiveCues;
     int m_ignoreTrackDisplayUpdate;
 #endif
diff --git a/Source/WebCore/html/HTMLMediaElement.idl b/Source/WebCore/html/HTMLMediaElement.idl
index 4260c2025..55d06f3ca 100644
--- a/Source/WebCore/html/HTMLMediaElement.idl
+++ b/Source/WebCore/html/HTMLMediaElement.idl
@@ -46,7 +46,7 @@ module html {
     readonly attribute TimeRanges buffered;
     void load() 
         raises (DOMException);
-    DOMString canPlayType(in [Optional=CallWithDefaultValue] DOMString type);
+    DOMString canPlayType(in [Optional=DefaultIsUndefined] DOMString type);
 
     // ready state
     const unsigned short HAVE_NOTHING = 0;
@@ -117,7 +117,7 @@ module html {
     readonly attribute [V8EnabledAtRuntime=webkitVideoTrack] TextTrackList textTracks;
 #endif
 
-    attribute [Reflect, TreatNullAs=NullString, ConvertNullStringToNull] DOMString mediaGroup;
+    attribute [Reflect, TreatNullAs=NullString] DOMString mediaGroup;
     attribute [CustomSetter] MediaController controller;
 };
 }
diff --git a/Source/WebCore/html/HTMLMetaElement.cpp b/Source/WebCore/html/HTMLMetaElement.cpp
index fd1f40392..820ad4471 100644
--- a/Source/WebCore/html/HTMLMetaElement.cpp
+++ b/Source/WebCore/html/HTMLMetaElement.cpp
@@ -94,7 +94,7 @@ String HTMLMetaElement::httpEquiv() const
 
 String HTMLMetaElement::name() const
 {
-    return getAttribute(nameAttr);
+    return getNameAttribute();
 }
 
 #if ENABLE(MICRODATA)
diff --git a/Source/WebCore/html/HTMLMeterElement.cpp b/Source/WebCore/html/HTMLMeterElement.cpp
index a1fdaf6c7..3be84e33d 100644
--- a/Source/WebCore/html/HTMLMeterElement.cpp
+++ b/Source/WebCore/html/HTMLMeterElement.cpp
@@ -26,6 +26,7 @@
 #include "EventNames.h"
 #include "ExceptionCode.h"
 #include "FormDataList.h"
+#include "NodeRenderingContext.h"
 #include "HTMLFormElement.h"
 #include "HTMLNames.h"
 #include "HTMLParserIdioms.h"
@@ -60,6 +61,11 @@ RenderObject* HTMLMeterElement::createRenderer(RenderArena* arena, RenderStyle*)
     return new (arena) RenderMeter(this);
 }
 
+bool HTMLMeterElement::childShouldCreateRenderer(const NodeRenderingContext& childContext) const
+{
+    return childContext.isOnEncapsulationBoundary() && HTMLElement::childShouldCreateRenderer(childContext);
+}
+
 const AtomicString& HTMLMeterElement::formControlType() const
 {
     DEFINE_STATIC_LOCAL(const AtomicString, meter, ("meter"));
@@ -234,7 +240,7 @@ void HTMLMeterElement::didElementStateChange()
 
 void HTMLMeterElement::createShadowSubtree()
 {
-    ASSERT(!shadowRoot());
+    ASSERT(!hasShadowRoot());
 
     RefPtr<MeterBarElement> bar = MeterBarElement::create(document());
     m_value = MeterValueElement::create(document());
diff --git a/Source/WebCore/html/HTMLMeterElement.h b/Source/WebCore/html/HTMLMeterElement.h
index fb71bc922..dc5e7ccf5 100644
--- a/Source/WebCore/html/HTMLMeterElement.h
+++ b/Source/WebCore/html/HTMLMeterElement.h
@@ -70,6 +70,7 @@ private:
     virtual bool recalcWillValidate() const { return false; }
     virtual const AtomicString& formControlType() const;
     virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
+    virtual bool childShouldCreateRenderer(const NodeRenderingContext&) const OVERRIDE;
     virtual void parseAttribute(Attribute*) OVERRIDE;
     virtual void attach();
 
diff --git a/Source/WebCore/html/HTMLNameCollection.cpp b/Source/WebCore/html/HTMLNameCollection.cpp
index aaf5b4d02..280c800a7 100644
--- a/Source/WebCore/html/HTMLNameCollection.cpp
+++ b/Source/WebCore/html/HTMLNameCollection.cpp
@@ -61,7 +61,7 @@ Element* HTMLNameCollection::itemAfter(Element* previous) const
                     e->hasTagName(appletTag) ||
                     e->hasTagName(embedTag) ||
                     e->hasTagName(objectTag))
-                    if (e->getAttribute(nameAttr) == m_name)
+                    if (e->getNameAttribute() == m_name)
                         return e;
                 if (e->getIdAttribute() == m_name)
                     return e;
@@ -71,17 +71,17 @@ Element* HTMLNameCollection::itemAfter(Element* previous) const
                 // applets and object by id, and images by id but only if they have
                 // a name attribute (this very strange rule matches IE)
                 if (e->hasTagName(formTag) || e->hasTagName(embedTag) || e->hasTagName(iframeTag)) {
-                    if (e->getAttribute(nameAttr) == m_name)
+                    if (e->getNameAttribute() == m_name)
                         return e;
                 } else if (e->hasTagName(appletTag)) {
-                    if (e->getAttribute(nameAttr) == m_name || e->getIdAttribute() == m_name)
+                    if (e->getNameAttribute() == m_name || e->getIdAttribute() == m_name)
                         return e;
                 } else if (e->hasTagName(objectTag)) {
-                    if ((e->getAttribute(nameAttr) == m_name || e->getIdAttribute() == m_name)
+                    if ((e->getNameAttribute() == m_name || e->getIdAttribute() == m_name)
                             && static_cast<HTMLObjectElement*>(e)->isDocNamedItem())
                         return e;
                 } else if (e->hasTagName(imgTag)) {
-                    if (e->getAttribute(nameAttr) == m_name || (e->getIdAttribute() == m_name && e->hasAttribute(nameAttr)))
+                    if (e->getNameAttribute() == m_name || (e->getIdAttribute() == m_name && e->hasName()))
                         return e;
                 }
                 break;
diff --git a/Source/WebCore/html/HTMLOListElement.cpp b/Source/WebCore/html/HTMLOListElement.cpp
index 2bfa2ff43..1f7e28dfe 100644
--- a/Source/WebCore/html/HTMLOListElement.cpp
+++ b/Source/WebCore/html/HTMLOListElement.cpp
@@ -54,22 +54,33 @@ PassRefPtr<HTMLOListElement> HTMLOListElement::create(const QualifiedName& tagNa
     return adoptRef(new HTMLOListElement(tagName, document));
 }
 
-void HTMLOListElement::parseAttribute(Attribute* attr)
+bool HTMLOListElement::isPresentationAttribute(Attribute* attr) const
+{
+    if (attr->name() == typeAttr)
+        return true;
+    return HTMLElement::isPresentationAttribute(attr);
+}
+
+void HTMLOListElement::collectStyleForAttribute(Attribute* attr, StylePropertySet* style)
 {
     if (attr->name() == typeAttr) {
         if (attr->value() == "a")
-            addCSSProperty(CSSPropertyListStyleType, CSSValueLowerAlpha);
+            addPropertyToAttributeStyle(style, CSSPropertyListStyleType, CSSValueLowerAlpha);
         else if (attr->value() == "A")
-            addCSSProperty(CSSPropertyListStyleType, CSSValueUpperAlpha);
+            addPropertyToAttributeStyle(style, CSSPropertyListStyleType, CSSValueUpperAlpha);
         else if (attr->value() == "i")
-            addCSSProperty(CSSPropertyListStyleType, CSSValueLowerRoman);
+            addPropertyToAttributeStyle(style, CSSPropertyListStyleType, CSSValueLowerRoman);
         else if (attr->value() == "I")
-            addCSSProperty(CSSPropertyListStyleType, CSSValueUpperRoman);
+            addPropertyToAttributeStyle(style, CSSPropertyListStyleType, CSSValueUpperRoman);
         else if (attr->value() == "1")
-            addCSSProperty(CSSPropertyListStyleType, CSSValueDecimal);
-        else
-            removeCSSProperty(CSSPropertyListStyleType);
-    } else if (attr->name() == startAttr) {
+            addPropertyToAttributeStyle(style, CSSPropertyListStyleType, CSSValueDecimal);
+    } else
+        HTMLElement::collectStyleForAttribute(attr, style);
+}
+
+void HTMLOListElement::parseAttribute(Attribute* attr)
+{
+    if (attr->name() == startAttr) {
         int oldStart = start();
         bool canParse;
         int parsedStart = attr->value().toInt(&canParse);
diff --git a/Source/WebCore/html/HTMLOListElement.h b/Source/WebCore/html/HTMLOListElement.h
index 0731fb007..9f0eafb0b 100644
--- a/Source/WebCore/html/HTMLOListElement.h
+++ b/Source/WebCore/html/HTMLOListElement.h
@@ -54,6 +54,8 @@ private:
     void recalculateItemCount();
 
     virtual void parseAttribute(Attribute*) OVERRIDE;
+    virtual bool isPresentationAttribute(Attribute*) const OVERRIDE;
+    virtual void collectStyleForAttribute(Attribute*, StylePropertySet*) OVERRIDE;
 
     int m_start;
     unsigned m_itemCount;
diff --git a/Source/WebCore/html/HTMLObjectElement.cpp b/Source/WebCore/html/HTMLObjectElement.cpp
index e2bef0157..406a3eb3e 100644
--- a/Source/WebCore/html/HTMLObjectElement.cpp
+++ b/Source/WebCore/html/HTMLObjectElement.cpp
@@ -77,6 +77,21 @@ RenderWidget* HTMLObjectElement::renderWidgetForJSBindings()
     return renderPart(); // This will return 0 if the renderer is not a RenderPart.
 }
 
+bool HTMLObjectElement::isPresentationAttribute(Attribute* attr) const
+{
+    if (attr->name() == borderAttr)
+        return true;
+    return HTMLPlugInImageElement::isPresentationAttribute(attr);
+}
+
+void HTMLObjectElement::collectStyleForAttribute(Attribute* attr, StylePropertySet* style)
+{
+    if (attr->name() == borderAttr)
+        applyBorderAttributeToStyle(attr, style);
+    else
+        HTMLPlugInImageElement::collectStyleForAttribute(attr, style);
+}
+
 void HTMLObjectElement::parseAttribute(Attribute* attr)
 {
     if (attr->name() == formAttr)
@@ -108,8 +123,6 @@ void HTMLObjectElement::parseAttribute(Attribute* attr)
         setAttributeEventListener(eventNames().loadEvent, createAttributeEventListener(this, attr));
     else if (attr->name() == onbeforeloadAttr)
         setAttributeEventListener(eventNames().beforeloadEvent, createAttributeEventListener(this, attr));
-    else if (attr->name() == borderAttr)
-        applyBorderAttribute(attr);
     else
         HTMLPlugInImageElement::parseAttribute(attr);
 }
@@ -207,7 +220,7 @@ bool HTMLObjectElement::hasFallbackContent() const
     for (Node* child = firstChild(); child; child = child->nextSibling()) {
         // Ignore whitespace-only text, and <param> tags, any other content is fallback content.
         if (child->isTextNode()) {
-            if (!static_cast<Text*>(child)->containsOnlyWhitespace())
+            if (!toText(child)->containsOnlyWhitespace())
                 return true;
         } else if (!child->hasTagName(paramTag))
             return true;
@@ -300,7 +313,7 @@ void HTMLObjectElement::updateWidget(PluginCreationOption pluginCreationOption)
         return;
 
     SubframeLoader* loader = document()->frame()->loader()->subframeLoader();
-    bool success = beforeLoadAllowedLoad && hasValidClassId() && loader->requestObject(this, url, getAttribute(nameAttr), serviceType, paramNames, paramValues);
+    bool success = beforeLoadAllowedLoad && hasValidClassId() && loader->requestObject(this, url, getNameAttribute(), serviceType, paramNames, paramValues);
     if (!success && fallbackContent)
         renderFallbackContent();
 }
@@ -414,7 +427,7 @@ void HTMLObjectElement::updateDocNamedItem()
             if (isRecognizedTagName(element->tagQName()) && !element->hasTagName(paramTag))
                 isNamedItem = false;
         } else if (child->isTextNode()) {
-            if (!static_cast<Text*>(child)->containsOnlyWhitespace())
+            if (!toText(child)->containsOnlyWhitespace())
                 isNamedItem = false;
         } else
             isNamedItem = false;
@@ -423,10 +436,10 @@ void HTMLObjectElement::updateDocNamedItem()
     if (isNamedItem != wasNamedItem && document()->isHTMLDocument()) {
         HTMLDocument* document = static_cast<HTMLDocument*>(this->document());
         if (isNamedItem) {
-            document->addNamedItem(fastGetAttribute(nameAttr));
+            document->addNamedItem(getNameAttribute());
             document->addExtraNamedItem(getIdAttribute());
         } else {
-            document->removeNamedItem(fastGetAttribute(nameAttr));
+            document->removeNamedItem(getNameAttribute());
             document->removeExtraNamedItem(getIdAttribute());
         }
     }
@@ -440,7 +453,7 @@ bool HTMLObjectElement::containsJavaApplet() const
         
     for (Element* child = firstElementChild(); child; child = child->nextElementSibling()) {
         if (child->hasTagName(paramTag)
-                && equalIgnoringCase(child->getAttribute(nameAttr), "type")
+                && equalIgnoringCase(child->getNameAttribute(), "type")
                 && MIMETypeRegistry::isJavaAppletMIMEType(child->getAttribute(valueAttr).string()))
             return true;
         if (child->hasTagName(objectTag)
@@ -501,7 +514,7 @@ bool HTMLObjectElement::appendFormData(FormDataList& encoding, bool)
 
 const AtomicString& HTMLObjectElement::formControlName() const
 {
-    const AtomicString& name = fastGetAttribute(nameAttr);
+    const AtomicString& name = getNameAttribute();
     return name.isNull() ? emptyAtom : name;
 }
 
diff --git a/Source/WebCore/html/HTMLObjectElement.h b/Source/WebCore/html/HTMLObjectElement.h
index 85bf16f8b..112dcc6af 100644
--- a/Source/WebCore/html/HTMLObjectElement.h
+++ b/Source/WebCore/html/HTMLObjectElement.h
@@ -67,6 +67,9 @@ private:
     HTMLObjectElement(const QualifiedName&, Document*, HTMLFormElement*, bool createdByParser);
 
     virtual void parseAttribute(Attribute*) OVERRIDE;
+    virtual bool isPresentationAttribute(Attribute*) const OVERRIDE;
+    virtual void collectStyleForAttribute(Attribute*, StylePropertySet*) OVERRIDE;
+
     virtual void insertedIntoTree(bool deep);
     virtual void removedFromTree(bool deep);
 
diff --git a/Source/WebCore/html/HTMLObjectElement.idl b/Source/WebCore/html/HTMLObjectElement.idl
index 4553fbc06..f1055fdb8 100644
--- a/Source/WebCore/html/HTMLObjectElement.idl
+++ b/Source/WebCore/html/HTMLObjectElement.idl
@@ -22,7 +22,7 @@ module html {
 
     interface [
         CustomNamedSetter,
-        JSCustomGetOwnPropertySlotDelegate,
+        JSCustomGetOwnPropertySlotAndDescriptor,
         CustomCall
     ] HTMLObjectElement : HTMLElement {
         readonly attribute HTMLFormElement form;
@@ -49,11 +49,11 @@ module html {
         void setCustomValidity(in [TreatNullAs=NullString, TreatUndefinedAs=NullString] DOMString error);
 
         // Introduced in DOM Level 2:
-        readonly attribute [CheckAccessToNode] Document contentDocument;
+        readonly attribute [CheckSecurityForNode] Document contentDocument;
 
 #if defined(ENABLE_SVG) && ENABLE_SVG
 #if !defined(LANGUAGE_OBJECTIVE_C) || !LANGUAGE_OBJECTIVE_C || defined(ENABLE_SVG_DOM_OBJC_BINDINGS) && ENABLE_SVG_DOM_OBJC_BINDINGS
-        [CheckAccessToNode] SVGDocument getSVGDocument() raises(DOMException);
+        [CheckSecurityForNode] SVGDocument getSVGDocument() raises(DOMException);
 #endif
 #endif
 
diff --git a/Source/WebCore/html/HTMLOptionElement.cpp b/Source/WebCore/html/HTMLOptionElement.cpp
index 73f6ffa91..9fef31841 100644
--- a/Source/WebCore/html/HTMLOptionElement.cpp
+++ b/Source/WebCore/html/HTMLOptionElement.cpp
@@ -147,7 +147,7 @@ void HTMLOptionElement::setText(const String &text, ExceptionCode& ec)
     // Handle the common special case where there's exactly 1 child node, and it's a text node.
     Node* child = firstChild();
     if (child && child->isTextNode() && !child->nextSibling())
-        static_cast<Text *>(child)->setData(text, ec);
+        toText(child)->setData(text, ec);
     else {
         removeChildren();
         appendChild(Text::create(document(), text), ec);
diff --git a/Source/WebCore/html/HTMLOptionElement.idl b/Source/WebCore/html/HTMLOptionElement.idl
index 73e9c3bdf..99681f2c1 100644
--- a/Source/WebCore/html/HTMLOptionElement.idl
+++ b/Source/WebCore/html/HTMLOptionElement.idl
@@ -22,7 +22,7 @@ module html {
 
     interface [
         JSGenerateToNativeObject,
-        NamedConstructor=Option(in [Optional=CallWithNullValue] DOMString data, in [Optional=CallWithNullValue] DOMString value, in [Optional=CallWithDefaultValue] boolean defaultSelected, in [Optional=CallWithDefaultValue] boolean selected),
+        NamedConstructor=Option(in [Optional=DefaultIsNullString] DOMString data, in [Optional=DefaultIsNullString] DOMString value, in [Optional=DefaultIsUndefined] boolean defaultSelected, in [Optional=DefaultIsUndefined] boolean selected),
         ConstructorRaisesException
     ] HTMLOptionElement : HTMLElement {
         readonly attribute HTMLFormElement form;
diff --git a/Source/WebCore/html/HTMLOptionsCollection.idl b/Source/WebCore/html/HTMLOptionsCollection.idl
index b28643994..0476e65fc 100644
--- a/Source/WebCore/html/HTMLOptionsCollection.idl
+++ b/Source/WebCore/html/HTMLOptionsCollection.idl
@@ -28,10 +28,10 @@ module html {
                  attribute [Custom] unsigned long length
                         setter raises (DOMException);
 
-        [Custom] void add(in [Optional=CallWithDefaultValue] HTMLOptionElement option, 
+        [Custom] void add(in [Optional=DefaultIsUndefined] HTMLOptionElement option, 
                           in [Optional] unsigned long index)
              raises (DOMException);
-        [Custom] void remove(in [Optional=CallWithDefaultValue] unsigned long index);
+        [Custom] void remove(in [Optional=DefaultIsUndefined] unsigned long index);
 
 #if defined(LANGUAGE_OBJECTIVE_C) && LANGUAGE_OBJECTIVE_C
         Node item(in unsigned long index); 
diff --git a/Source/WebCore/html/HTMLParagraphElement.cpp b/Source/WebCore/html/HTMLParagraphElement.cpp
index 6cc9f51b8..c8f6ad3ee 100644
--- a/Source/WebCore/html/HTMLParagraphElement.cpp
+++ b/Source/WebCore/html/HTMLParagraphElement.cpp
@@ -44,21 +44,26 @@ PassRefPtr<HTMLParagraphElement> HTMLParagraphElement::create(const QualifiedNam
     return adoptRef(new HTMLParagraphElement(tagName, document));
 }
 
-void HTMLParagraphElement::parseAttribute(Attribute* attr)
+bool HTMLParagraphElement::isPresentationAttribute(Attribute* attr) const
+{
+    if (attr->name() == alignAttr)
+        return true;
+    return HTMLElement::isPresentationAttribute(attr);
+}
+
+void HTMLParagraphElement::collectStyleForAttribute(Attribute* attr, StylePropertySet* style)
 {
     if (attr->name() == alignAttr) {
-        if (attr->value().isNull())
-            removeCSSProperty(CSSPropertyTextAlign);
-        else if (equalIgnoringCase(attr->value(), "middle") || equalIgnoringCase(attr->value(), "center"))
-            addCSSProperty(CSSPropertyTextAlign, CSSValueWebkitCenter);
+        if (equalIgnoringCase(attr->value(), "middle") || equalIgnoringCase(attr->value(), "center"))
+            addPropertyToAttributeStyle(style, CSSPropertyTextAlign, CSSValueWebkitCenter);
         else if (equalIgnoringCase(attr->value(), "left"))
-            addCSSProperty(CSSPropertyTextAlign, CSSValueWebkitLeft);
+            addPropertyToAttributeStyle(style, CSSPropertyTextAlign, CSSValueWebkitLeft);
         else if (equalIgnoringCase(attr->value(), "right"))
-            addCSSProperty(CSSPropertyTextAlign, CSSValueWebkitRight);
+            addPropertyToAttributeStyle(style, CSSPropertyTextAlign, CSSValueWebkitRight);
         else
-            addCSSProperty(CSSPropertyTextAlign, attr->value());
+            addPropertyToAttributeStyle(style, CSSPropertyTextAlign, attr->value());
     } else
-        HTMLElement::parseAttribute(attr);
+        HTMLElement::collectStyleForAttribute(attr, style);
 }
 
 }
diff --git a/Source/WebCore/html/HTMLParagraphElement.h b/Source/WebCore/html/HTMLParagraphElement.h
index 0c8c290bb..86a85a63a 100644
--- a/Source/WebCore/html/HTMLParagraphElement.h
+++ b/Source/WebCore/html/HTMLParagraphElement.h
@@ -34,7 +34,8 @@ public:
 private:
     HTMLParagraphElement(const QualifiedName&, Document*);
 
-    virtual void parseAttribute(Attribute*) OVERRIDE;
+    virtual bool isPresentationAttribute(Attribute*) const OVERRIDE;
+    virtual void collectStyleForAttribute(Attribute*, StylePropertySet*) OVERRIDE;
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/html/HTMLPlugInElement.cpp b/Source/WebCore/html/HTMLPlugInElement.cpp
index 66d60922c..8c0f302a2 100644
--- a/Source/WebCore/html/HTMLPlugInElement.cpp
+++ b/Source/WebCore/html/HTMLPlugInElement.cpp
@@ -140,36 +140,29 @@ Widget* HTMLPlugInElement::pluginWidget()
     return renderWidget->widget();
 }
 
-void HTMLPlugInElement::parseAttribute(Attribute* attr)
+bool HTMLPlugInElement::isPresentationAttribute(Attribute* attr) const
+{
+    if (attr->name() == widthAttr || attr->name() == heightAttr || attr->name() == vspaceAttr || attr->name() == hspaceAttr || attr->name() == alignAttr)
+        return true;
+    return HTMLFrameOwnerElement::isPresentationAttribute(attr);
+}
+
+void HTMLPlugInElement::collectStyleForAttribute(Attribute* attr, StylePropertySet* style)
 {
     if (attr->name() == widthAttr)
-        if (attr->isNull())
-            removeCSSProperty(CSSPropertyWidth);
-        else
-            addCSSLength(CSSPropertyWidth, attr->value());
+        addHTMLLengthToStyle(style, CSSPropertyWidth, attr->value());
     else if (attr->name() == heightAttr)
-        if (attr->isNull())
-            removeCSSProperty(CSSPropertyHeight);
-        else
-            addCSSLength(CSSPropertyHeight, attr->value());
+        addHTMLLengthToStyle(style, CSSPropertyHeight, attr->value());
     else if (attr->name() == vspaceAttr) {
-        if (attr->isNull())
-            removeCSSProperties(CSSPropertyMarginTop, CSSPropertyMarginBottom);
-        else {
-            addCSSLength(CSSPropertyMarginTop, attr->value());
-            addCSSLength(CSSPropertyMarginBottom, attr->value());
-        }
+        addHTMLLengthToStyle(style, CSSPropertyMarginTop, attr->value());
+        addHTMLLengthToStyle(style, CSSPropertyMarginBottom, attr->value());
     } else if (attr->name() == hspaceAttr) {
-        if (attr->isNull())
-            removeCSSProperties(CSSPropertyMarginLeft, CSSPropertyMarginRight);
-        else {
-            addCSSLength(CSSPropertyMarginLeft, attr->value());
-            addCSSLength(CSSPropertyMarginRight, attr->value());
-        }
+        addHTMLLengthToStyle(style, CSSPropertyMarginLeft, attr->value());
+        addHTMLLengthToStyle(style, CSSPropertyMarginRight, attr->value());
     } else if (attr->name() == alignAttr)
-        addHTMLAlignment(attr);
+        applyAlignmentAttributeToStyle(attr, style);
     else
-        HTMLFrameOwnerElement::parseAttribute(attr);
+        HTMLFrameOwnerElement::collectStyleForAttribute(attr, style);
 }
 
 void HTMLPlugInElement::defaultEventHandler(Event* event)
diff --git a/Source/WebCore/html/HTMLPlugInElement.h b/Source/WebCore/html/HTMLPlugInElement.h
index 8c2214167..10c1ea791 100644
--- a/Source/WebCore/html/HTMLPlugInElement.h
+++ b/Source/WebCore/html/HTMLPlugInElement.h
@@ -58,7 +58,8 @@ protected:
 
     virtual void detach();
     virtual void removedFromDocument();
-    virtual void parseAttribute(Attribute*) OVERRIDE;
+    virtual bool isPresentationAttribute(Attribute*) const OVERRIDE;
+    virtual void collectStyleForAttribute(Attribute*, StylePropertySet*) OVERRIDE;
 
     bool m_inBeforeLoadEventHandler;
     // Subclasses should use guardedDispatchBeforeLoadEvent instead of calling dispatchBeforeLoadEvent directly.
diff --git a/Source/WebCore/html/HTMLPreElement.cpp b/Source/WebCore/html/HTMLPreElement.cpp
index 7ed85fccd..09c08977a 100644
--- a/Source/WebCore/html/HTMLPreElement.cpp
+++ b/Source/WebCore/html/HTMLPreElement.cpp
@@ -42,20 +42,19 @@ PassRefPtr<HTMLPreElement> HTMLPreElement::create(const QualifiedName& tagName,
     return adoptRef(new HTMLPreElement(tagName, document));
 }
 
-void HTMLPreElement::parseAttribute(Attribute* attr)
+bool HTMLPreElement::isPresentationAttribute(Attribute* attr) const
 {
-    if (attr->name() == widthAttr) {
-        // FIXME: Implement this some day.  Width on a <pre> is the # of characters that
-        // we should size the pre to.  We basically need to take the width of a space,
-        // multiply by the value of the attribute and then set that as the width CSS
-        // property.
-    } else if (attr->name() == wrapAttr) {
-        if (attr->value().isNull())
-            removeCSSProperty(CSSPropertyWhiteSpace);
-        else
-            addCSSProperty(CSSPropertyWhiteSpace, CSSValuePreWrap);
-    } else
-        return HTMLElement::parseAttribute(attr);
+    if (attr->name() == wrapAttr)
+        return true;
+    return HTMLElement::isPresentationAttribute(attr);
+}
+
+void HTMLPreElement::collectStyleForAttribute(Attribute* attr, StylePropertySet* style)
+{
+    if (attr->name() == wrapAttr)
+        style->setProperty(CSSPropertyWhiteSpace, CSSValuePreWrap);
+    else
+        HTMLElement::collectStyleForAttribute(attr, style);
 }
 
 }
diff --git a/Source/WebCore/html/HTMLPreElement.h b/Source/WebCore/html/HTMLPreElement.h
index 3ad3152f1..778204898 100644
--- a/Source/WebCore/html/HTMLPreElement.h
+++ b/Source/WebCore/html/HTMLPreElement.h
@@ -34,7 +34,8 @@ public:
 private:
     HTMLPreElement(const QualifiedName&, Document*);
 
-    virtual void parseAttribute(Attribute*) OVERRIDE;
+    virtual bool isPresentationAttribute(Attribute*) const OVERRIDE;
+    virtual void collectStyleForAttribute(Attribute*, StylePropertySet*) OVERRIDE;
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/html/HTMLProgressElement.cpp b/Source/WebCore/html/HTMLProgressElement.cpp
index 0c2372581..78bbde32b 100644
--- a/Source/WebCore/html/HTMLProgressElement.cpp
+++ b/Source/WebCore/html/HTMLProgressElement.cpp
@@ -26,6 +26,7 @@
 #include "EventNames.h"
 #include "ExceptionCode.h"
 #include "FormDataList.h"
+#include "NodeRenderingContext.h"
 #include "HTMLDivElement.h"
 #include "HTMLFormElement.h"
 #include "HTMLNames.h"
@@ -64,6 +65,11 @@ RenderObject* HTMLProgressElement::createRenderer(RenderArena* arena, RenderStyl
     return new (arena) RenderProgress(this);
 }
 
+bool HTMLProgressElement::childShouldCreateRenderer(const NodeRenderingContext& childContext) const
+{
+    return childContext.isOnEncapsulationBoundary() && HTMLElement::childShouldCreateRenderer(childContext);
+}
+
 bool HTMLProgressElement::supportsFocus() const
 {
     return Node::supportsFocus() && !disabled();
@@ -153,7 +159,7 @@ void HTMLProgressElement::didElementStateChange()
 
 void HTMLProgressElement::createShadowSubtree()
 {
-    ASSERT(!shadowRoot());
+    ASSERT(!hasShadowRoot());
 
     RefPtr<ProgressBarElement> bar = ProgressBarElement::create(document());
     m_value = ProgressValueElement::create(document());
diff --git a/Source/WebCore/html/HTMLProgressElement.h b/Source/WebCore/html/HTMLProgressElement.h
index 731f80b4a..dfd006799 100644
--- a/Source/WebCore/html/HTMLProgressElement.h
+++ b/Source/WebCore/html/HTMLProgressElement.h
@@ -58,6 +58,7 @@ private:
     virtual const AtomicString& formControlType() const;
 
     virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
+    virtual bool childShouldCreateRenderer(const NodeRenderingContext&) const OVERRIDE;
 
     virtual void parseAttribute(Attribute*) OVERRIDE;
 
diff --git a/Source/WebCore/html/HTMLScriptElement.cpp b/Source/WebCore/html/HTMLScriptElement.cpp
index 1df19a63b..cabc21374 100644
--- a/Source/WebCore/html/HTMLScriptElement.cpp
+++ b/Source/WebCore/html/HTMLScriptElement.cpp
@@ -58,19 +58,14 @@ void HTMLScriptElement::childrenChanged(bool changedByParser, Node* beforeChange
     HTMLElement::childrenChanged(changedByParser, beforeChange, afterChange, childCountDelta);
 }
 
-void HTMLScriptElement::attributeChanged(Attribute* attr)
-{
-    if (attr->name() == asyncAttr)
-        handleAsyncAttribute();
-    HTMLElement::attributeChanged(attr);
-}
-
 void HTMLScriptElement::parseAttribute(Attribute* attr)
 {
     const QualifiedName& attrName = attr->name();
 
     if (attrName == srcAttr)
         handleSourceAttribute(attr->value());
+    else if (attr->name() == asyncAttr)
+        handleAsyncAttribute();
     else if (attrName == onloadAttr)
         setAttributeEventListener(eventNames().loadEvent, createAttributeEventListener(this, attr));
     else if (attrName == onbeforeloadAttr)
@@ -91,7 +86,7 @@ void HTMLScriptElement::setText(const String &value)
     int numChildren = childNodeCount();
 
     if (numChildren == 1 && firstChild()->isTextNode()) {
-        static_cast<Text*>(firstChild())->setData(value, ec);
+        toText(firstChild())->setData(value, ec);
         return;
     }
 
diff --git a/Source/WebCore/html/HTMLScriptElement.h b/Source/WebCore/html/HTMLScriptElement.h
index 61d9de094..07c89abf6 100644
--- a/Source/WebCore/html/HTMLScriptElement.h
+++ b/Source/WebCore/html/HTMLScriptElement.h
@@ -47,7 +47,6 @@ private:
     virtual void parseAttribute(Attribute*) OVERRIDE;
     virtual void insertedIntoDocument();
     virtual void childrenChanged(bool changedByParser = false, Node* beforeChange = 0, Node* afterChange = 0, int childCountDelta = 0);
-    virtual void attributeChanged(Attribute*) OVERRIDE;
 
     virtual bool isURLAttribute(Attribute*) const;
 
diff --git a/Source/WebCore/html/HTMLSelectElement.cpp b/Source/WebCore/html/HTMLSelectElement.cpp
index 1b96d226f..a2c31dcda 100644
--- a/Source/WebCore/html/HTMLSelectElement.cpp
+++ b/Source/WebCore/html/HTMLSelectElement.cpp
@@ -42,6 +42,7 @@
 #include "HTMLOptionsCollection.h"
 #include "KeyboardEvent.h"
 #include "MouseEvent.h"
+#include "NodeRenderingContext.h"
 #include "Page.h"
 #include "RenderListBox.h"
 #include "RenderMenuList.h"
@@ -256,6 +257,17 @@ void HTMLSelectElement::setValue(const String &value)
     setSelectedIndex(-1);
 }
 
+bool HTMLSelectElement::isPresentationAttribute(Attribute* attr) const
+{
+    if (attr->name() == alignAttr) {
+        // Don't map 'align' attribute. This matches what Firefox, Opera and IE do.
+        // See http://bugs.webkit.org/show_bug.cgi?id=12072
+        return false;
+    }
+
+    return HTMLFormControlElementWithState::isPresentationAttribute(attr);
+}
+
 void HTMLSelectElement::parseAttribute(Attribute* attr)
 {
     if (attr->name() == sizeAttr) {
@@ -282,9 +294,6 @@ void HTMLSelectElement::parseAttribute(Attribute* attr)
         parseMultipleAttribute(attr);
     else if (attr->name() == accesskeyAttr) {
         // FIXME: ignore for the moment.
-    } else if (attr->name() == alignAttr) {
-        // Don't map 'align' attribute. This matches what Firefox, Opera and IE do.
-        // See http://bugs.webkit.org/show_bug.cgi?id=12072
     } else if (attr->name() == onchangeAttr)
         setAttributeEventListener(eventNames().changeEvent, createAttributeEventListener(this, attr));
     else
@@ -317,6 +326,11 @@ RenderObject* HTMLSelectElement::createRenderer(RenderArena* arena, RenderStyle*
     return new (arena) RenderListBox(this);
 }
 
+bool HTMLSelectElement::childShouldCreateRenderer(const NodeRenderingContext& childContext) const
+{
+    return childContext.isOnEncapsulationBoundary() && HTMLFormControlElementWithState::childShouldCreateRenderer(childContext);
+}
+
 HTMLOptionsCollection* HTMLSelectElement::options()
 {
     if (!m_optionsCollection)
diff --git a/Source/WebCore/html/HTMLSelectElement.h b/Source/WebCore/html/HTMLSelectElement.h
index 8d9b738a4..77c081e6f 100644
--- a/Source/WebCore/html/HTMLSelectElement.h
+++ b/Source/WebCore/html/HTMLSelectElement.h
@@ -122,7 +122,9 @@ private:
     virtual void restoreFormControlState(const String&);
 
     virtual void parseAttribute(Attribute*) OVERRIDE;
+    virtual bool isPresentationAttribute(Attribute*) const OVERRIDE;
 
+    virtual bool childShouldCreateRenderer(const NodeRenderingContext&) const OVERRIDE;
     virtual RenderObject* createRenderer(RenderArena*, RenderStyle *);
     virtual bool appendFormData(FormDataList&, bool);
 
diff --git a/Source/WebCore/html/HTMLSelectElement.idl b/Source/WebCore/html/HTMLSelectElement.idl
index 5d60ef4f8..4f0b82662 100644
--- a/Source/WebCore/html/HTMLSelectElement.idl
+++ b/Source/WebCore/html/HTMLSelectElement.idl
@@ -52,8 +52,8 @@ module html {
         attribute [Reflect] boolean required;
         attribute long size;
         
-        [ObjCLegacyUnnamedParameters] void add(in [Optional=CallWithDefaultValue] HTMLElement element, 
-                                in [Optional=CallWithDefaultValue] HTMLElement before) raises(DOMException);
+        [ObjCLegacyUnnamedParameters] void add(in [Optional=DefaultIsUndefined] HTMLElement element, 
+                                in [Optional=DefaultIsUndefined] HTMLElement before) raises(DOMException);
 
 #if defined(LANGUAGE_JAVASCRIPT) && LANGUAGE_JAVASCRIPT
         // In JavaScript, we support both option index and option object parameters.
@@ -65,8 +65,8 @@ module html {
 
         // These methods are not in DOM Level 2 IDL, but are mentioned in the standard:
         // "The contained options can be directly accessed through the select element as a collection."
-        Node item(in [IsIndex,Optional=CallWithDefaultValue] unsigned long index);
-        Node namedItem(in [Optional=CallWithDefaultValue] DOMString name);
+        Node item(in [IsIndex,Optional=DefaultIsUndefined] unsigned long index);
+        Node namedItem(in [Optional=DefaultIsUndefined] DOMString name);
         readonly attribute NodeList labels;
     };
 
diff --git a/Source/WebCore/html/HTMLStyleElement.cpp b/Source/WebCore/html/HTMLStyleElement.cpp
index 4156ce5f1..2070d56ce 100644
--- a/Source/WebCore/html/HTMLStyleElement.cpp
+++ b/Source/WebCore/html/HTMLStyleElement.cpp
@@ -27,6 +27,7 @@
 #include "Attribute.h"
 #include "Document.h"
 #include "HTMLNames.h"
+#include "RuntimeEnabledFeatures.h"
 #include "ScriptEventListener.h"
 #include "ScriptableDocumentParser.h"
 
@@ -87,38 +88,50 @@ void HTMLStyleElement::registerWithScopingNode()
     // Therefore we cannot rely on scoped()!
     ASSERT(!m_isRegisteredWithScopingNode);
     ASSERT(inDocument());
-    if (!m_isRegisteredWithScopingNode) {
-        Element* scope = parentElement();
-        if (!scope)
-            return;
+    if (m_isRegisteredWithScopingNode)
+        return;
+    if (!RuntimeEnabledFeatures::styleScopedEnabled())
+        return;
+
+    ContainerNode* scope = parentNode();
+    if (!scope)
+        return;
+    if (!scope->isElementNode() && !scope->isShadowRoot()) {
+        // DocumentFragment nodes should never be inDocument,
+        // <style> should not be a child of Document, PI or some such.
+        ASSERT_NOT_REACHED();
+        return;
+    }
 
-        scope->registerScopedHTMLStyleChild();
-        scope->setNeedsStyleRecalc();
-        if (inDocument() && !document()->parsing() && document()->renderer())
-            document()->styleSelectorChanged(DeferRecalcStyle);
+    scope->registerScopedHTMLStyleChild();
+    scope->setNeedsStyleRecalc();
+    if (inDocument() && !document()->parsing() && document()->renderer())
+        document()->styleSelectorChanged(DeferRecalcStyle);
 
-        m_isRegisteredWithScopingNode = true;
-    }
+    m_isRegisteredWithScopingNode = true;
 }
 
 void HTMLStyleElement::unregisterWithScopingNode()
 {
     // Note: We cannot rely on the 'scoped' element still being present when this method is invoked.
     // Therefore we cannot rely on scoped()!
-    ASSERT(m_isRegisteredWithScopingNode);
-    if (m_isRegisteredWithScopingNode) {
-        Element* scope = parentElement();
-        ASSERT(scope);
-        if (scope) {
-            ASSERT(scope->hasScopedHTMLStyleChild());
-            scope->unregisterScopedHTMLStyleChild();
-            scope->setNeedsStyleRecalc();
-        }
-        if (inDocument() && !document()->parsing() && document()->renderer())
-            document()->styleSelectorChanged(DeferRecalcStyle);
-
-        m_isRegisteredWithScopingNode = false;
+    ASSERT(m_isRegisteredWithScopingNode || !RuntimeEnabledFeatures::styleScopedEnabled());
+    if (!m_isRegisteredWithScopingNode)
+        return;
+    if (!RuntimeEnabledFeatures::styleScopedEnabled())
+        return;
+
+    ContainerNode* scope = parentNode();
+    ASSERT(scope);
+    if (scope) {
+        ASSERT(scope->hasScopedHTMLStyleChild());
+        scope->unregisterScopedHTMLStyleChild();
+        scope->setNeedsStyleRecalc();
     }
+    if (inDocument() && !document()->parsing() && document()->renderer())
+        document()->styleSelectorChanged(DeferRecalcStyle);
+
+    m_isRegisteredWithScopingNode = false;
 }
 #endif
 
@@ -149,7 +162,7 @@ void HTMLStyleElement::willRemove()
     // That is, because willRemove() is also called if an ancestor is removed from the document.
     // Now, if we want to register <style scoped> even if it's not inDocument,
     // we'd need to find a way to discern whether that is the case, or whether <style scoped> itself is about to be removed.
-    ASSERT(!scoped() || !inDocument() || m_isRegisteredWithScopingNode);
+    ASSERT(!scoped() || !inDocument() || m_isRegisteredWithScopingNode || !RuntimeEnabledFeatures::styleScopedEnabled());
     if (m_isRegisteredWithScopingNode)
         unregisterWithScopingNode();
     HTMLElement::willRemove();
diff --git a/Source/WebCore/html/HTMLStyleElement.h b/Source/WebCore/html/HTMLStyleElement.h
index 9c50ee240..39d140067 100644
--- a/Source/WebCore/html/HTMLStyleElement.h
+++ b/Source/WebCore/html/HTMLStyleElement.h
@@ -74,7 +74,9 @@ private:
     void registerWithScopingNode();
     void unregisterWithScopingNode();
 
+#if ENABLE(STYLE_SCOPED)
     bool m_isRegisteredWithScopingNode;
+#endif
 };
 
 } //namespace
diff --git a/Source/WebCore/html/HTMLStyleElement.idl b/Source/WebCore/html/HTMLStyleElement.idl
index 7a1b62295..1b9abd47a 100644
--- a/Source/WebCore/html/HTMLStyleElement.idl
+++ b/Source/WebCore/html/HTMLStyleElement.idl
@@ -22,7 +22,7 @@ module html {
 
     interface HTMLStyleElement : HTMLElement {
         attribute boolean disabled;
-        attribute [Conditional=STYLE_SCOPED] boolean scoped;
+        attribute [Conditional=STYLE_SCOPED, V8EnabledAtRuntime=styleScoped] boolean scoped;
         attribute [Reflect] DOMString media;
         attribute [Reflect] DOMString type;
 
diff --git a/Source/WebCore/html/HTMLSummaryElement.cpp b/Source/WebCore/html/HTMLSummaryElement.cpp
index f57a5db23..a3494af81 100644
--- a/Source/WebCore/html/HTMLSummaryElement.cpp
+++ b/Source/WebCore/html/HTMLSummaryElement.cpp
@@ -27,11 +27,13 @@
 #include "HTMLContentElement.h"
 #include "HTMLDetailsElement.h"
 #include "HTMLNames.h"
+#include "KeyboardEvent.h"
 #include "MouseEvent.h"
+#include "NodeRenderingContext.h"
 #include "PlatformMouseEvent.h"
 #include "RenderSummary.h"
-
 #include "ShadowRoot.h"
+#include "ShadowRootList.h"
 
 namespace WebCore {
 
@@ -71,9 +73,14 @@ RenderObject* HTMLSummaryElement::createRenderer(RenderArena* arena, RenderStyle
     return new (arena) RenderSummary(this);
 }
 
+bool HTMLSummaryElement::childShouldCreateRenderer(const NodeRenderingContext& childContext) const
+{
+    return childContext.isOnEncapsulationBoundary() && HTMLElement::childShouldCreateRenderer(childContext);
+}
+
 void HTMLSummaryElement::createShadowSubtree()
 {
-    ASSERT(!shadowRoot());
+    ASSERT(!hasShadowRoot());
     RefPtr<ShadowRoot> root = ShadowRoot::create(this, ShadowRoot::CreatingUserAgentShadowRoot);
     root->appendChild(DetailsMarkerControl::create(document()), ASSERT_NO_EXCEPTION, true);
     root->appendChild(SummaryContentElement::create(document()), ASSERT_NO_EXCEPTION, true);
@@ -106,20 +113,49 @@ static bool isClickableControl(Node* node)
     return host && host->isFormControlElement();
 }
 
+bool HTMLSummaryElement::supportsFocus() const
+{
+    return isMainSummary();
+}
+
 void HTMLSummaryElement::defaultEventHandler(Event* event)
 {
-    HTMLElement::defaultEventHandler(event);
-    if (!isMainSummary() || !renderer() || !renderer()->isSummary() || !event->isMouseEvent() || event->type() != eventNames().clickEvent || event->defaultHandled())
-        return;
-    MouseEvent* mouseEvent = static_cast<MouseEvent*>(event);
-    if (mouseEvent->button() != LeftButton)
-        return;
-    if (isClickableControl(event->target()->toNode()))
-        return;
+    if (isMainSummary() && renderer() && renderer()->isSummary()) {
+        if (event->type() == eventNames().DOMActivateEvent && !isClickableControl(event->target()->toNode())) {
+            if (HTMLDetailsElement* details = detailsElement())
+                details->toggleOpen();
+            event->setDefaultHandled();
+            return;
+        }
+
+        if (event->isKeyboardEvent()) {
+            if (event->type() == eventNames().keydownEvent && static_cast<KeyboardEvent*>(event)->keyIdentifier() == "U+0020") {
+                setActive(true, true);
+                // No setDefaultHandled() - IE dispatches a keypress in this case.
+                return;
+            }
+            if (event->type() == eventNames().keypressEvent) {
+                switch (static_cast<KeyboardEvent*>(event)->charCode()) {
+                case '\r':
+                    dispatchSimulatedClick(event);
+                    event->setDefaultHandled();
+                    return;
+                case ' ':
+                    // Prevent scrolling down the page.
+                    event->setDefaultHandled();
+                    return;
+                }
+            }
+            if (event->type() == eventNames().keyupEvent && static_cast<KeyboardEvent*>(event)->keyIdentifier() == "U+0020") {
+                if (active())
+                    dispatchSimulatedClick(event);
+                event->setDefaultHandled();
+                return;
+            }
+        }
+    }
 
-    if (HTMLDetailsElement* details = detailsElement())
-        details->toggleOpen();
-    event->setDefaultHandled();
+    HTMLElement::defaultEventHandler(event);
 }
 
 }
diff --git a/Source/WebCore/html/HTMLSummaryElement.h b/Source/WebCore/html/HTMLSummaryElement.h
index 43ab73fad..49a2d0bac 100644
--- a/Source/WebCore/html/HTMLSummaryElement.h
+++ b/Source/WebCore/html/HTMLSummaryElement.h
@@ -36,10 +36,13 @@ private:
     HTMLSummaryElement(const QualifiedName&, Document*);
 
     virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
+    virtual bool childShouldCreateRenderer(const NodeRenderingContext&) const OVERRIDE;
     virtual void defaultEventHandler(Event*);
 
     void createShadowSubtree();
     HTMLDetailsElement* detailsElement() const;
+
+    bool supportsFocus() const OVERRIDE;
 };
 
 }
diff --git a/Source/WebCore/html/HTMLTableCaptionElement.cpp b/Source/WebCore/html/HTMLTableCaptionElement.cpp
index 88450d43a..c327d0f85 100644
--- a/Source/WebCore/html/HTMLTableCaptionElement.cpp
+++ b/Source/WebCore/html/HTMLTableCaptionElement.cpp
@@ -34,7 +34,7 @@ namespace WebCore {
 using namespace HTMLNames;
 
 inline HTMLTableCaptionElement::HTMLTableCaptionElement(const QualifiedName& tagName, Document* document)
-    : HTMLTablePartElement(tagName, document)
+    : HTMLElement(tagName, document)
 {
     ASSERT(hasTagName(captionTag));
 }
@@ -44,15 +44,20 @@ PassRefPtr<HTMLTableCaptionElement> HTMLTableCaptionElement::create(const Qualif
     return adoptRef(new HTMLTableCaptionElement(tagName, document));
 }
 
-void HTMLTableCaptionElement::parseAttribute(Attribute* attr)
+bool HTMLTableCaptionElement::isPresentationAttribute(Attribute* attr) const
+{
+    if (attr->name() == alignAttr)
+        return true;
+    return HTMLElement::isPresentationAttribute(attr);
+}
+
+void HTMLTableCaptionElement::collectStyleForAttribute(Attribute* attr, StylePropertySet* style)
 {
     if (attr->name() == alignAttr) {
-        if (!attr->value().isEmpty())
-            addCSSProperty(CSSPropertyCaptionSide, attr->value());
-        else
-            removeCSSProperty(CSSPropertyCaptionSide);
+        if (!attr->isEmpty())
+            addPropertyToAttributeStyle(style, CSSPropertyCaptionSide, attr->value());
     } else
-        HTMLElement::parseAttribute(attr);
+        HTMLElement::collectStyleForAttribute(attr, style);
 }
 
 }
diff --git a/Source/WebCore/html/HTMLTableCaptionElement.h b/Source/WebCore/html/HTMLTableCaptionElement.h
index da40e821d..a43141f40 100644
--- a/Source/WebCore/html/HTMLTableCaptionElement.h
+++ b/Source/WebCore/html/HTMLTableCaptionElement.h
@@ -26,18 +26,19 @@
 #ifndef HTMLTableCaptionElement_h
 #define HTMLTableCaptionElement_h
 
-#include "HTMLTablePartElement.h"
+#include "HTMLElement.h"
 
 namespace WebCore {
 
-class HTMLTableCaptionElement : public HTMLTablePartElement {
+class HTMLTableCaptionElement : public HTMLElement {
 public:
     static PassRefPtr<HTMLTableCaptionElement> create(const QualifiedName&, Document*);
 
 private:
     HTMLTableCaptionElement(const QualifiedName&, Document*);
 
-    virtual void parseAttribute(Attribute*) OVERRIDE;
+    virtual bool isPresentationAttribute(Attribute*) const OVERRIDE;
+    virtual void collectStyleForAttribute(Attribute*, StylePropertySet*) OVERRIDE;
 };
 
 } // namespace
diff --git a/Source/WebCore/html/HTMLTableCellElement.cpp b/Source/WebCore/html/HTMLTableCellElement.cpp
index 84a1c9654..7664673f3 100644
--- a/Source/WebCore/html/HTMLTableCellElement.cpp
+++ b/Source/WebCore/html/HTMLTableCellElement.cpp
@@ -75,46 +75,50 @@ int HTMLTableCellElement::cellIndex() const
     return index;
 }
 
-void HTMLTableCellElement::parseAttribute(Attribute* attr)
+bool HTMLTableCellElement::isPresentationAttribute(Attribute* attr) const
 {
-    if (attr->name() == rowspanAttr) {
-        if (renderer() && renderer()->isTableCell())
-            toRenderTableCell(renderer())->colSpanOrRowSpanChanged();
-    } else if (attr->name() == colspanAttr) {
-        if (renderer() && renderer()->isTableCell())
-            toRenderTableCell(renderer())->colSpanOrRowSpanChanged();
-    } else if (attr->name() == nowrapAttr) {
-        if (attr->isNull())
-            removeCSSProperty(CSSPropertyWhiteSpace);
-        else
-            addCSSProperty(CSSPropertyWhiteSpace, CSSValueWebkitNowrap);
+    if (attr->name() == nowrapAttr || attr->name() == widthAttr || attr->name() == heightAttr)
+        return true;
+    return HTMLTablePartElement::isPresentationAttribute(attr);
+}
 
+void HTMLTableCellElement::collectStyleForAttribute(Attribute* attr, StylePropertySet* style)
+{
+    if (attr->name() == nowrapAttr) {
+        addPropertyToAttributeStyle(style, CSSPropertyWhiteSpace, CSSValueWebkitNowrap);
     } else if (attr->name() == widthAttr) {
         if (!attr->value().isEmpty()) {
             int widthInt = attr->value().toInt();
             if (widthInt > 0) // width="0" is ignored for compatibility with WinIE.
-                addCSSLength(CSSPropertyWidth, attr->value());
-        } else
-            removeCSSProperty(CSSPropertyWidth);
+                addHTMLLengthToStyle(style, CSSPropertyWidth, attr->value());
+        }
     } else if (attr->name() == heightAttr) {
         if (!attr->value().isEmpty()) {
             int heightInt = attr->value().toInt();
             if (heightInt > 0) // height="0" is ignored for compatibility with WinIE.
-                addCSSLength(CSSPropertyHeight, attr->value());
-        } else
-            removeCSSProperty(CSSPropertyHeight);
+                addHTMLLengthToStyle(style, CSSPropertyHeight, attr->value());
+        }
+    } else
+        HTMLTablePartElement::collectStyleForAttribute(attr, style);
+}
+
+void HTMLTableCellElement::parseAttribute(Attribute* attr)
+{
+    if (attr->name() == rowspanAttr) {
+        if (renderer() && renderer()->isTableCell())
+            toRenderTableCell(renderer())->colSpanOrRowSpanChanged();
+    } else if (attr->name() == colspanAttr) {
+        if (renderer() && renderer()->isTableCell())
+            toRenderTableCell(renderer())->colSpanOrRowSpanChanged();
     } else
         HTMLTablePartElement::parseAttribute(attr);
 }
 
 StylePropertySet* HTMLTableCellElement::additionalAttributeStyle()
 {
-    ContainerNode* p = parentNode();
-    while (p && !p->hasTagName(tableTag))
-        p = p->parentNode();
-    if (!p)
-        return 0;
-    return static_cast<HTMLTableElement*>(p)->additionalCellStyle();
+    if (HTMLTableElement* table = findParentTable())
+        return table->additionalCellStyle();
+    return 0;
 }
 
 bool HTMLTableCellElement::isURLAttribute(Attribute *attr) const
diff --git a/Source/WebCore/html/HTMLTableCellElement.h b/Source/WebCore/html/HTMLTableCellElement.h
index 5c32d6a9d..7ca11271f 100644
--- a/Source/WebCore/html/HTMLTableCellElement.h
+++ b/Source/WebCore/html/HTMLTableCellElement.h
@@ -54,6 +54,8 @@ private:
     HTMLTableCellElement(const QualifiedName&, Document*);
 
     virtual void parseAttribute(Attribute*) OVERRIDE;
+    virtual bool isPresentationAttribute(Attribute*) const OVERRIDE;
+    virtual void collectStyleForAttribute(Attribute*, StylePropertySet*) OVERRIDE;
 
     virtual StylePropertySet* additionalAttributeStyle() OVERRIDE;
 
diff --git a/Source/WebCore/html/HTMLTableColElement.cpp b/Source/WebCore/html/HTMLTableColElement.cpp
index 0c83e781c..db75b2544 100644
--- a/Source/WebCore/html/HTMLTableColElement.cpp
+++ b/Source/WebCore/html/HTMLTableColElement.cpp
@@ -47,6 +47,21 @@ PassRefPtr<HTMLTableColElement> HTMLTableColElement::create(const QualifiedName&
     return adoptRef(new HTMLTableColElement(tagName, document));
 }
 
+bool HTMLTableColElement::isPresentationAttribute(Attribute* attr) const
+{
+    if (attr->name() == widthAttr)
+        return true;
+    return HTMLTablePartElement::isPresentationAttribute(attr);
+}
+
+void HTMLTableColElement::collectStyleForAttribute(Attribute* attr, StylePropertySet* style)
+{
+    if (attr->name() == widthAttr)
+        addHTMLLengthToStyle(style, CSSPropertyWidth, attr->value());
+    else
+        HTMLTablePartElement::collectStyleForAttribute(attr, style);
+}
+
 void HTMLTableColElement::parseAttribute(Attribute* attr)
 {
     if (attr->name() == spanAttr) {
@@ -55,15 +70,13 @@ void HTMLTableColElement::parseAttribute(Attribute* attr)
             renderer()->updateFromElement();
     } else if (attr->name() == widthAttr) {
         if (!attr->value().isEmpty()) {
-            addCSSLength(CSSPropertyWidth, attr->value());
             if (renderer() && renderer()->isTableCol()) {
                 RenderTableCol* col = toRenderTableCol(renderer());
                 int newWidth = width().toInt();
                 if (newWidth != col->width())
                     col->setNeedsLayoutAndPrefWidthsRecalc();
             }
-        } else
-            removeCSSProperty(CSSPropertyWidth);
+        }
     } else
         HTMLTablePartElement::parseAttribute(attr);
 }
@@ -72,12 +85,9 @@ StylePropertySet* HTMLTableColElement::additionalAttributeStyle()
 {
     if (!hasLocalName(colgroupTag))
         return 0;
-    ContainerNode* p = parentNode();
-    while (p && !p->hasTagName(tableTag))
-        p = p->parentNode();
-    if (!p)
-        return 0;
-    return static_cast<HTMLTableElement*>(p)->additionalGroupStyle(false);
+    if (HTMLTableElement* table = findParentTable())
+        return table->additionalGroupStyle(false);
+    return 0;
 }
 
 void HTMLTableColElement::setSpan(int n)
diff --git a/Source/WebCore/html/HTMLTableColElement.h b/Source/WebCore/html/HTMLTableColElement.h
index 01cea8e1b..960ee8448 100644
--- a/Source/WebCore/html/HTMLTableColElement.h
+++ b/Source/WebCore/html/HTMLTableColElement.h
@@ -43,6 +43,8 @@ private:
     HTMLTableColElement(const QualifiedName& tagName, Document*);
 
     virtual void parseAttribute(Attribute*) OVERRIDE;
+    virtual bool isPresentationAttribute(Attribute*) const OVERRIDE;
+    virtual void collectStyleForAttribute(Attribute*, StylePropertySet*) OVERRIDE;
     virtual StylePropertySet* additionalAttributeStyle() OVERRIDE;
 
     int m_span;
diff --git a/Source/WebCore/html/HTMLTableElement.cpp b/Source/WebCore/html/HTMLTableElement.cpp
index be3aaa2ce..9420d9518 100644
--- a/Source/WebCore/html/HTMLTableElement.cpp
+++ b/Source/WebCore/html/HTMLTableElement.cpp
@@ -26,6 +26,7 @@
 #include "HTMLTableElement.h"
 
 #include "Attribute.h"
+#include "CSSImageValue.h"
 #include "CSSPropertyNames.h"
 #include "CSSStyleSheet.h"
 #include "CSSValueKeywords.h"
@@ -266,102 +267,118 @@ static bool setTableCellsChanged(Node* n)
     return cellChanged;
 }
 
+static bool getBordersFromFrameAttributeValue(const AtomicString& value, bool& borderTop, bool& borderRight, bool& borderBottom, bool& borderLeft)
+{
+    borderTop = false;
+    borderRight = false;
+    borderBottom = false;
+    borderLeft = false;
+
+    if (equalIgnoringCase(value, "above"))
+        borderTop = true;
+    else if (equalIgnoringCase(value, "below"))
+        borderBottom = true;
+    else if (equalIgnoringCase(value, "hsides"))
+        borderTop = borderBottom = true;
+    else if (equalIgnoringCase(value, "vsides"))
+        borderLeft = borderRight = true;
+    else if (equalIgnoringCase(value, "lhs"))
+        borderLeft = true;
+    else if (equalIgnoringCase(value, "rhs"))
+        borderRight = true;
+    else if (equalIgnoringCase(value, "box") || equalIgnoringCase(value, "border"))
+        borderTop = borderBottom = borderLeft = borderRight = true;
+    else if (!equalIgnoringCase(value, "void"))
+        return false;
+    return true;
+}
+
+void HTMLTableElement::collectStyleForAttribute(Attribute* attr, StylePropertySet* style)
+{
+    if (attr->name() == widthAttr)
+        addHTMLLengthToStyle(style, CSSPropertyWidth, attr->value());
+    else if (attr->name() == heightAttr)
+        addHTMLLengthToStyle(style, CSSPropertyHeight, attr->value());
+    else if (attr->name() == borderAttr) {
+        int borderWidth = attr->isEmpty() ? 1 : attr->value().toInt();
+        addPropertyToAttributeStyle(style, CSSPropertyBorderWidth, borderWidth, CSSPrimitiveValue::CSS_PX);
+    } else if (attr->name() == bordercolorAttr) {
+        if (!attr->isEmpty())
+            addHTMLColorToStyle(style, CSSPropertyBorderColor, attr->value());
+    } else if (attr->name() == bgcolorAttr)
+        addHTMLColorToStyle(style, CSSPropertyBackgroundColor, attr->value());
+    else if (attr->name() == backgroundAttr) {
+        String url = stripLeadingAndTrailingHTMLSpaces(attr->value());
+        if (!url.isEmpty())
+            style->setProperty(CSSProperty(CSSPropertyBackgroundImage, CSSImageValue::create(document()->completeURL(url).string())));
+    } else if (attr->name() == valignAttr) {
+        if (!attr->isEmpty())
+            addPropertyToAttributeStyle(style, CSSPropertyVerticalAlign, attr->value());
+    } else if (attr->name() == cellspacingAttr) {
+        if (!attr->isEmpty())
+            addHTMLLengthToStyle(style, CSSPropertyBorderSpacing, attr->value());
+    } else if (attr->name() == vspaceAttr) {
+        addHTMLLengthToStyle(style, CSSPropertyMarginTop, attr->value());
+        addHTMLLengthToStyle(style, CSSPropertyMarginBottom, attr->value());
+    } else if (attr->name() == hspaceAttr) {
+        addHTMLLengthToStyle(style, CSSPropertyMarginLeft, attr->value());
+        addHTMLLengthToStyle(style, CSSPropertyMarginRight, attr->value());
+    } else if (attr->name() == alignAttr) {
+        if (!attr->value().isEmpty()) {
+            if (equalIgnoringCase(attr->value(), "center")) {
+                addPropertyToAttributeStyle(style, CSSPropertyWebkitMarginStart, CSSValueAuto);
+                addPropertyToAttributeStyle(style, CSSPropertyWebkitMarginEnd, CSSValueAuto);
+            } else
+                addPropertyToAttributeStyle(style, CSSPropertyFloat, attr->value());
+        }
+    } else if (attr->name() == rulesAttr) {
+        // The presence of a valid rules attribute causes border collapsing to be enabled.
+        if (m_rulesAttr != UnsetRules)
+            addPropertyToAttributeStyle(style, CSSPropertyBorderCollapse, CSSValueCollapse);
+    } else if (attr->name() == frameAttr) {
+        bool borderTop;
+        bool borderRight;
+        bool borderBottom;
+        bool borderLeft;
+        if (getBordersFromFrameAttributeValue(attr->value(), borderTop, borderRight, borderBottom, borderLeft)) {
+            addPropertyToAttributeStyle(style, CSSPropertyBorderWidth, CSSValueThin);
+            addPropertyToAttributeStyle(style, CSSPropertyBorderTopStyle, borderTop ? CSSValueSolid : CSSValueHidden);
+            addPropertyToAttributeStyle(style, CSSPropertyBorderBottomStyle, borderBottom ? CSSValueSolid : CSSValueHidden);
+            addPropertyToAttributeStyle(style, CSSPropertyBorderLeftStyle, borderLeft ? CSSValueSolid : CSSValueHidden);
+            addPropertyToAttributeStyle(style, CSSPropertyBorderRightStyle, borderRight ? CSSValueSolid : CSSValueHidden);
+        }
+    } else
+        HTMLElement::collectStyleForAttribute(attr, style);
+}
+
+bool HTMLTableElement::isPresentationAttribute(Attribute* attr) const
+{
+    if (attr->name() == widthAttr || attr->name() == heightAttr || attr->name() == bgcolorAttr || attr->name() == backgroundAttr || attr->name() == valignAttr || attr->name() == vspaceAttr || attr->name() == hspaceAttr || attr->name() == alignAttr || attr->name() == cellspacingAttr || attr->name() == borderAttr || attr->name() == bordercolorAttr || attr->name() == frameAttr || attr->name() == rulesAttr)
+        return true;
+    return HTMLElement::isPresentationAttribute(attr);
+}
+
 void HTMLTableElement::parseAttribute(Attribute* attr)
 {
     CellBorders bordersBefore = cellBorders();
     unsigned short oldPadding = m_padding;
 
-    if (attr->name() == widthAttr)
-        if (attr->isNull())
-            removeCSSProperty(CSSPropertyWidth);
-        else
-            addCSSLength(CSSPropertyWidth, attr->value());
-    else if (attr->name() == heightAttr)
-        if (attr->isNull())
-            removeCSSProperty(CSSPropertyHeight);
-        else
-            addCSSLength(CSSPropertyHeight, attr->value());
-    else if (attr->name() == borderAttr)  {
+    if (attr->name() == borderAttr)  {
+        // FIXME: This attribute is a mess.
         m_borderAttr = true;
-
-        if (attr->isNull())
-            removeCSSProperty(CSSPropertyBorderWidth);
-        else {
-            int border = 0;
-            if (attr->isEmpty())
-                border = 1;
-            else
-                border = attr->value().toInt();
+        if (!attr->isNull()) {
+            int border = attr->isEmpty() ? 1 : attr->value().toInt();
             m_borderAttr = border;
-            addCSSLength(CSSPropertyBorderWidth, String::number(border));
         }
-    } else if (attr->name() == bgcolorAttr)
-        if (attr->isNull())
-            removeCSSProperty(CSSPropertyBackgroundColor);
-        else
-            addCSSColor(CSSPropertyBackgroundColor, attr->value());
-    else if (attr->name() == bordercolorAttr) {
+    } else if (attr->name() == bordercolorAttr) {
         m_borderColorAttr = !attr->isEmpty();
-        if (!attr->isEmpty())
-            addCSSColor(CSSPropertyBorderColor, attr->value());
-        else
-            removeCSSProperty(CSSPropertyBorderColor);
-    } else if (attr->name() == backgroundAttr) {
-        String url = stripLeadingAndTrailingHTMLSpaces(attr->value());
-        if (!url.isEmpty())
-            addCSSImageProperty(CSSPropertyBackgroundImage, document()->completeURL(url).string());
-        else
-            removeCSSProperty(CSSPropertyBackgroundImage);
     } else if (attr->name() == frameAttr) {
-        // Cache the value of "frame" so that the table can examine it later.
-        m_frameAttr = false;
-        
-        // Whether or not to hide the top/right/bottom/left borders.
-        const int cTop = 0;
-        const int cRight = 1;
-        const int cBottom = 2;
-        const int cLeft = 3;
-        bool borders[4] = { false, false, false, false };
-        
-        // void, above, below, hsides, vsides, lhs, rhs, box, border
-        if (equalIgnoringCase(attr->value(), "void"))
-            m_frameAttr = true;
-        else if (equalIgnoringCase(attr->value(), "above")) {
-            m_frameAttr = true;
-            borders[cTop] = true;
-        } else if (equalIgnoringCase(attr->value(), "below")) {
-            m_frameAttr = true;
-            borders[cBottom] = true;
-        } else if (equalIgnoringCase(attr->value(), "hsides")) {
-            m_frameAttr = true;
-            borders[cTop] = borders[cBottom] = true;
-        } else if (equalIgnoringCase(attr->value(), "vsides")) {
-            m_frameAttr = true;
-            borders[cLeft] = borders[cRight] = true;
-        } else if (equalIgnoringCase(attr->value(), "lhs")) {
-            m_frameAttr = true;
-            borders[cLeft] = true;
-        } else if (equalIgnoringCase(attr->value(), "rhs")) {
-            m_frameAttr = true;
-            borders[cRight] = true;
-        } else if (equalIgnoringCase(attr->value(), "box") ||
-                   equalIgnoringCase(attr->value(), "border")) {
-            m_frameAttr = true;
-            borders[cTop] = borders[cBottom] = borders[cLeft] = borders[cRight] = true;
-        }
-        
-        // Now map in the border styles of solid and hidden respectively.
-        if (m_frameAttr) {
-            addCSSProperty(CSSPropertyBorderTopWidth, CSSValueThin);
-            addCSSProperty(CSSPropertyBorderBottomWidth, CSSValueThin);
-            addCSSProperty(CSSPropertyBorderLeftWidth, CSSValueThin);
-            addCSSProperty(CSSPropertyBorderRightWidth, CSSValueThin);
-            addCSSProperty(CSSPropertyBorderTopStyle, borders[cTop] ? CSSValueSolid : CSSValueHidden);
-            addCSSProperty(CSSPropertyBorderBottomStyle, borders[cBottom] ? CSSValueSolid : CSSValueHidden);
-            addCSSProperty(CSSPropertyBorderLeftStyle, borders[cLeft] ? CSSValueSolid : CSSValueHidden);
-            addCSSProperty(CSSPropertyBorderRightStyle, borders[cRight] ? CSSValueSolid : CSSValueHidden);
-        } else
-            removeCSSProperties(CSSPropertyBorderTopWidth, CSSPropertyBorderBottomWidth, CSSPropertyBorderLeftWidth, CSSPropertyBorderRightWidth, CSSPropertyBorderTopStyle, CSSPropertyBorderBottomStyle, CSSPropertyBorderLeftStyle, CSSPropertyBorderRightStyle);
+        // FIXME: This attribute is a mess.
+        bool borderTop;
+        bool borderRight;
+        bool borderBottom;
+        bool borderLeft;
+        m_frameAttr = getBordersFromFrameAttributeValue(attr->value(), borderTop, borderRight, borderBottom, borderLeft);
     } else if (attr->name() == rulesAttr) {
         m_rulesAttr = UnsetRules;
         if (equalIgnoringCase(attr->value(), "none"))
@@ -374,17 +391,6 @@ void HTMLTableElement::parseAttribute(Attribute* attr)
             m_rulesAttr = ColsRules;
         if (equalIgnoringCase(attr->value(), "all"))
             m_rulesAttr = AllRules;
-        
-        // The presence of a valid rules attribute causes border collapsing to be enabled.
-        if (m_rulesAttr != UnsetRules)
-            addCSSProperty(CSSPropertyBorderCollapse, CSSValueCollapse);
-        else
-            removeCSSProperty(CSSPropertyBorderCollapse);
-    } else if (attr->name() == cellspacingAttr) {
-        if (!attr->value().isEmpty())
-            addCSSLength(CSSPropertyBorderSpacing, attr->value());
-        else
-            removeCSSProperty(CSSPropertyBorderSpacing);
     } else if (attr->name() == cellpaddingAttr) {
         if (!attr->value().isEmpty())
             m_padding = max(0, attr->value().toInt());
@@ -392,34 +398,6 @@ void HTMLTableElement::parseAttribute(Attribute* attr)
             m_padding = 1;
     } else if (attr->name() == colsAttr) {
         // ###
-    } else if (attr->name() == vspaceAttr) {
-        if (attr->isNull())
-            removeCSSProperties(CSSPropertyMarginTop, CSSPropertyMarginBottom);
-        else {
-            addCSSLength(CSSPropertyMarginTop, attr->value());
-            addCSSLength(CSSPropertyMarginBottom, attr->value());
-        }
-    } else if (attr->name() == hspaceAttr) {
-        if (attr->isNull())
-            removeCSSProperties(CSSPropertyMarginLeft, CSSPropertyMarginRight);
-        else {
-            addCSSLength(CSSPropertyMarginLeft, attr->value());
-            addCSSLength(CSSPropertyMarginRight, attr->value());
-        }
-    } else if (attr->name() == alignAttr) {
-        if (!attr->value().isEmpty()) {
-            if (equalIgnoringCase(attr->value(), "center")) {
-                addCSSProperty(CSSPropertyWebkitMarginStart, CSSValueAuto);
-                addCSSProperty(CSSPropertyWebkitMarginEnd, CSSValueAuto);
-            } else
-                addCSSProperty(CSSPropertyFloat, attr->value());
-        } else
-            removeCSSProperties(CSSPropertyWebkitMarginStart, CSSPropertyWebkitMarginEnd, CSSPropertyFloat);
-    } else if (attr->name() == valignAttr) {
-        if (!attr->value().isEmpty())
-            addCSSProperty(CSSPropertyVerticalAlign, attr->value());
-        else
-            removeCSSProperty(CSSPropertyVerticalAlign);
     } else
         HTMLElement::parseAttribute(attr);
 
diff --git a/Source/WebCore/html/HTMLTableElement.h b/Source/WebCore/html/HTMLTableElement.h
index ef8ccde6e..d9b86a8fc 100644
--- a/Source/WebCore/html/HTMLTableElement.h
+++ b/Source/WebCore/html/HTMLTableElement.h
@@ -73,6 +73,8 @@ private:
     HTMLTableElement(const QualifiedName&, Document*);
 
     virtual void parseAttribute(Attribute*) OVERRIDE;
+    virtual bool isPresentationAttribute(Attribute*) const OVERRIDE;
+    virtual void collectStyleForAttribute(Attribute*, StylePropertySet*) OVERRIDE;
     virtual bool isURLAttribute(Attribute*) const;
 
     // Used to obtain either a solid or outset border decl and to deal with the frame and rules attributes.
diff --git a/Source/WebCore/html/HTMLTableElement.idl b/Source/WebCore/html/HTMLTableElement.idl
index 7c046eb6e..5e3bb0cf7 100644
--- a/Source/WebCore/html/HTMLTableElement.idl
+++ b/Source/WebCore/html/HTMLTableElement.idl
@@ -46,8 +46,8 @@ module html {
         HTMLElement createCaption();
         void deleteCaption();
 
-        HTMLElement insertRow(in [Optional=CallWithDefaultValue] long index) raises(DOMException);
-        void deleteRow(in [Optional=CallWithDefaultValue] long index) raises(DOMException);
+        HTMLElement insertRow(in [Optional=DefaultIsUndefined] long index) raises(DOMException);
+        void deleteRow(in [Optional=DefaultIsUndefined] long index) raises(DOMException);
     };
 
 }
diff --git a/Source/WebCore/html/HTMLTablePartElement.cpp b/Source/WebCore/html/HTMLTablePartElement.cpp
index 8fd747bd8..8a39260af 100644
--- a/Source/WebCore/html/HTMLTablePartElement.cpp
+++ b/Source/WebCore/html/HTMLTablePartElement.cpp
@@ -26,64 +26,73 @@
 #include "HTMLTablePartElement.h"
 
 #include "Attribute.h"
+#include "CSSImageValue.h"
 #include "CSSPropertyNames.h"
 #include "CSSValueKeywords.h"
 #include "Document.h"
 #include "HTMLNames.h"
 #include "HTMLParserIdioms.h"
+#include "HTMLTableElement.h"
 
 namespace WebCore {
 
 using namespace HTMLNames;
 
-void HTMLTablePartElement::parseAttribute(Attribute* attr)
+bool HTMLTablePartElement::isPresentationAttribute(Attribute* attr) const
+{
+    if (attr->name() == bgcolorAttr || attr->name() == backgroundAttr || attr->name() == bordercolorAttr || attr->name() == valignAttr || attr->name() == alignAttr || attr->name() == heightAttr)
+        return true;
+    return HTMLElement::isPresentationAttribute(attr);
+}
+
+void HTMLTablePartElement::collectStyleForAttribute(Attribute* attr, StylePropertySet* style)
 {
     if (attr->name() == bgcolorAttr)
-        if (attr->value().isNull())
-            removeCSSProperty(CSSPropertyBackgroundColor);
-        else
-            addCSSColor(CSSPropertyBackgroundColor, attr->value());
+        addHTMLColorToStyle(style, CSSPropertyBackgroundColor, attr->value());
     else if (attr->name() == backgroundAttr) {
         String url = stripLeadingAndTrailingHTMLSpaces(attr->value());
         if (!url.isEmpty())
-            addCSSImageProperty(CSSPropertyBackgroundImage, document()->completeURL(url).string());
-        else
-            removeCSSProperty(CSSPropertyBackgroundImage);
+            style->setProperty(CSSProperty(CSSPropertyBackgroundImage, CSSImageValue::create(document()->completeURL(url).string())));
     } else if (attr->name() == bordercolorAttr) {
         if (!attr->value().isEmpty()) {
-            addCSSColor(CSSPropertyBorderColor, attr->value());
-            addCSSProperty(CSSPropertyBorderTopStyle, CSSValueSolid);
-            addCSSProperty(CSSPropertyBorderBottomStyle, CSSValueSolid);
-            addCSSProperty(CSSPropertyBorderLeftStyle, CSSValueSolid);
-            addCSSProperty(CSSPropertyBorderRightStyle, CSSValueSolid);
-        } else
-            removeCSSProperties(CSSPropertyBorderColor, CSSPropertyBorderTopStyle, CSSPropertyBorderBottomStyle, CSSPropertyBorderLeftStyle, CSSPropertyBorderRightStyle);
+            addHTMLColorToStyle(style, CSSPropertyBorderColor, attr->value());
+            addPropertyToAttributeStyle(style, CSSPropertyBorderStyle, CSSValueSolid);
+        }
     } else if (attr->name() == valignAttr) {
-        if (!attr->value().isEmpty())
-            addCSSProperty(CSSPropertyVerticalAlign, attr->value());
+        if (equalIgnoringCase(attr->value(), "top"))
+            addPropertyToAttributeStyle(style, CSSPropertyVerticalAlign, CSSValueTop);
+        else if (equalIgnoringCase(attr->value(), "middle"))
+            addPropertyToAttributeStyle(style, CSSPropertyVerticalAlign, CSSValueMiddle);
+        else if (equalIgnoringCase(attr->value(), "bottom"))
+            addPropertyToAttributeStyle(style, CSSPropertyVerticalAlign, CSSValueBottom);
+        else if (equalIgnoringCase(attr->value(), "baseline"))
+            addPropertyToAttributeStyle(style, CSSPropertyVerticalAlign, CSSValueBaseline);
         else
-            removeCSSProperty(CSSPropertyVerticalAlign);
+            addPropertyToAttributeStyle(style, CSSPropertyVerticalAlign, attr->value());
     } else if (attr->name() == alignAttr) {
-        const AtomicString& v = attr->value();
-        if (v.isNull())
-            removeCSSProperty(CSSPropertyTextAlign);
-        else if (equalIgnoringCase(v, "middle") || equalIgnoringCase(v, "center"))
-            addCSSProperty(CSSPropertyTextAlign, CSSValueWebkitCenter);
-        else if (equalIgnoringCase(v, "absmiddle"))
-            addCSSProperty(CSSPropertyTextAlign, CSSValueCenter);
-        else if (equalIgnoringCase(v, "left"))
-            addCSSProperty(CSSPropertyTextAlign, CSSValueWebkitLeft);
-        else if (equalIgnoringCase(v, "right"))
-            addCSSProperty(CSSPropertyTextAlign, CSSValueWebkitRight);
+        if (equalIgnoringCase(attr->value(), "middle") || equalIgnoringCase(attr->value(), "center"))
+            addPropertyToAttributeStyle(style, CSSPropertyTextAlign, CSSValueWebkitCenter);
+        else if (equalIgnoringCase(attr->value(), "absmiddle"))
+            addPropertyToAttributeStyle(style, CSSPropertyTextAlign, CSSValueCenter);
+        else if (equalIgnoringCase(attr->value(), "left"))
+            addPropertyToAttributeStyle(style, CSSPropertyTextAlign, CSSValueWebkitLeft);
+        else if (equalIgnoringCase(attr->value(), "right"))
+            addPropertyToAttributeStyle(style, CSSPropertyTextAlign, CSSValueWebkitRight);
         else
-            addCSSProperty(CSSPropertyTextAlign, v);
+            addPropertyToAttributeStyle(style, CSSPropertyTextAlign, attr->value());
     } else if (attr->name() == heightAttr) {
         if (!attr->value().isEmpty())
-            addCSSLength(CSSPropertyHeight, attr->value());
-        else
-            removeCSSProperty(CSSPropertyHeight);
+            addHTMLLengthToStyle(style, CSSPropertyHeight, attr->value());
     } else
-        HTMLElement::parseAttribute(attr);
+        HTMLElement::collectStyleForAttribute(attr, style);
+}
+
+HTMLTableElement* HTMLTablePartElement::findParentTable() const
+{
+    ContainerNode* parent = parentNode();
+    while (parent && !parent->hasTagName(tableTag))
+        parent = parent->parentNode();
+    return static_cast<HTMLTableElement*>(parent);
 }
 
 }
diff --git a/Source/WebCore/html/HTMLTablePartElement.h b/Source/WebCore/html/HTMLTablePartElement.h
index c139bbe3c..49f75b3d5 100644
--- a/Source/WebCore/html/HTMLTablePartElement.h
+++ b/Source/WebCore/html/HTMLTablePartElement.h
@@ -30,6 +30,8 @@
 
 namespace WebCore {
 
+class HTMLTableElement;
+
 class HTMLTablePartElement : public HTMLElement {
 protected:
     HTMLTablePartElement(const QualifiedName& tagName, Document* document)
@@ -37,7 +39,10 @@ protected:
     {
     }
 
-    virtual void parseAttribute(Attribute*) OVERRIDE;
+    virtual bool isPresentationAttribute(Attribute*) const OVERRIDE;
+    virtual void collectStyleForAttribute(Attribute*, StylePropertySet*) OVERRIDE;
+
+    HTMLTableElement* findParentTable() const;
 };
 
 } //namespace
diff --git a/Source/WebCore/html/HTMLTableRowElement.idl b/Source/WebCore/html/HTMLTableRowElement.idl
index 482c61f7d..b16d754af 100644
--- a/Source/WebCore/html/HTMLTableRowElement.idl
+++ b/Source/WebCore/html/HTMLTableRowElement.idl
@@ -29,8 +29,8 @@ module html {
         attribute [Reflect=char] DOMString ch;
         attribute [Reflect=charoff] DOMString chOff;
         attribute [Reflect] DOMString vAlign;
-        HTMLElement insertCell(in [Optional=CallWithDefaultValue] long index) raises(DOMException);
-        void deleteCell(in [Optional=CallWithDefaultValue] long index) raises(DOMException);
+        HTMLElement insertCell(in [Optional=DefaultIsUndefined] long index) raises(DOMException);
+        void deleteCell(in [Optional=DefaultIsUndefined] long index) raises(DOMException);
     };
 
 }
diff --git a/Source/WebCore/html/HTMLTableSectionElement.cpp b/Source/WebCore/html/HTMLTableSectionElement.cpp
index 0e7872d12..f450fea25 100644
--- a/Source/WebCore/html/HTMLTableSectionElement.cpp
+++ b/Source/WebCore/html/HTMLTableSectionElement.cpp
@@ -49,12 +49,9 @@ PassRefPtr<HTMLTableSectionElement> HTMLTableSectionElement::create(const Qualif
 
 StylePropertySet* HTMLTableSectionElement::additionalAttributeStyle()
 {
-    ContainerNode* p = parentNode();
-    while (p && !p->hasTagName(tableTag))
-        p = p->parentNode();
-    if (!p)
-        return 0;
-    return static_cast<HTMLTableElement*>(p)->additionalGroupStyle(true);
+    if (HTMLTableElement* table = findParentTable())
+        return table->additionalGroupStyle(true);
+    return 0;
 }
 
 // these functions are rather slow, since we need to get the row at
diff --git a/Source/WebCore/html/HTMLTableSectionElement.idl b/Source/WebCore/html/HTMLTableSectionElement.idl
index 1553b5ea1..88f53369b 100644
--- a/Source/WebCore/html/HTMLTableSectionElement.idl
+++ b/Source/WebCore/html/HTMLTableSectionElement.idl
@@ -28,8 +28,8 @@ module html {
         attribute [Reflect=charoff] DOMString chOff;
         attribute [Reflect] DOMString vAlign;
         readonly attribute HTMLCollection rows;
-        HTMLElement insertRow(in [Optional=CallWithDefaultValue] long index) raises(DOMException);
-        void deleteRow(in [Optional=CallWithDefaultValue] long index) raises(DOMException);
+        HTMLElement insertRow(in [Optional=DefaultIsUndefined] long index) raises(DOMException);
+        void deleteRow(in [Optional=DefaultIsUndefined] long index) raises(DOMException);
     };
 
 }
diff --git a/Source/WebCore/html/HTMLTextAreaElement.cpp b/Source/WebCore/html/HTMLTextAreaElement.cpp
index bff7574be..f110ef695 100644
--- a/Source/WebCore/html/HTMLTextAreaElement.cpp
+++ b/Source/WebCore/html/HTMLTextAreaElement.cpp
@@ -38,6 +38,7 @@
 #include "HTMLNames.h"
 #include "RenderTextControlMultiLine.h"
 #include "ShadowRoot.h"
+#include "ShadowRootList.h"
 #include "Text.h"
 #include "TextControlInnerElements.h"
 #include "TextIterator.h"
@@ -84,7 +85,7 @@ PassRefPtr<HTMLTextAreaElement> HTMLTextAreaElement::create(const QualifiedName&
 
 void HTMLTextAreaElement::createShadowSubtree()
 {
-    ASSERT(!shadowRoot());
+    ASSERT(!hasShadowRoot());
     RefPtr<ShadowRoot> root = ShadowRoot::create(this, ShadowRoot::CreatingUserAgentShadowRoot);
     root->appendChild(TextControlInnerTextElement::create(document()), ASSERT_NO_EXCEPTION);
 }
@@ -117,7 +118,34 @@ void HTMLTextAreaElement::childrenChanged(bool changedByParser, Node* beforeChan
     setInnerTextValue(value());
     HTMLElement::childrenChanged(changedByParser, beforeChange, afterChange, childCountDelta);
 }
-    
+
+bool HTMLTextAreaElement::isPresentationAttribute(Attribute* attr) const
+{
+    if (attr->name() == alignAttr) {
+        // Don't map 'align' attribute.  This matches what Firefox, Opera and IE do.
+        // See http://bugs.webkit.org/show_bug.cgi?id=7075
+        return false;
+    }
+
+    if (attr->name() == wrapAttr)
+        return true;
+    return HTMLTextFormControlElement::isPresentationAttribute(attr);
+}
+
+void HTMLTextAreaElement::collectStyleForAttribute(Attribute* attr, StylePropertySet* style)
+{
+    if (attr->name() == wrapAttr) {
+        if (shouldWrapText()) {
+            addPropertyToAttributeStyle(style, CSSPropertyWhiteSpace, CSSValuePreWrap);
+            addPropertyToAttributeStyle(style, CSSPropertyWordWrap, CSSValueBreakWord);
+        } else {
+            addPropertyToAttributeStyle(style, CSSPropertyWhiteSpace, CSSValuePre);
+            addPropertyToAttributeStyle(style, CSSPropertyWordWrap, CSSValueNormal);
+        }
+    } else
+        HTMLTextFormControlElement::collectStyleForAttribute(attr, style);
+}
+
 void HTMLTextAreaElement::parseAttribute(Attribute* attr)
 {
     if (attr->name() == rowsAttr) {
@@ -150,23 +178,11 @@ void HTMLTextAreaElement::parseAttribute(Attribute* attr)
             wrap = SoftWrap;
         if (wrap != m_wrap) {
             m_wrap = wrap;
-
-            if (shouldWrapText()) {
-                addCSSProperty(CSSPropertyWhiteSpace, CSSValuePreWrap);
-                addCSSProperty(CSSPropertyWordWrap, CSSValueBreakWord);
-            } else {
-                addCSSProperty(CSSPropertyWhiteSpace, CSSValuePre);
-                addCSSProperty(CSSPropertyWordWrap, CSSValueNormal);
-            }
-
             if (renderer())
                 renderer()->setNeedsLayoutAndPrefWidthsRecalc();
         }
     } else if (attr->name() == accesskeyAttr) {
         // ignore for the moment
-    } else if (attr->name() == alignAttr) {
-        // Don't map 'align' attribute.  This matches what Firefox, Opera and IE do.
-        // See http://bugs.webkit.org/show_bug.cgi?id=7075
     } else if (attr->name() == maxlengthAttr)
         setNeedsValidityCheck();
     else
@@ -278,7 +294,7 @@ String HTMLTextAreaElement::sanitizeUserInputValue(const String& proposedValue,
 
 HTMLElement* HTMLTextAreaElement::innerTextElement() const
 {
-    Node* node = shadowRoot()->firstChild();
+    Node* node = shadowRootList()->oldestShadowRoot()->firstChild();
     ASSERT(!node || node->hasTagName(divTag));
     return toHTMLElement(node);
 }
@@ -360,7 +376,7 @@ String HTMLTextAreaElement::defaultValue() const
     // Since there may be comments, ignore nodes other than text nodes.
     for (Node* n = firstChild(); n; n = n->nextSibling()) {
         if (n->isTextNode())
-            value += static_cast<Text*>(n)->data();
+            value += toText(n)->data();
     }
 
     return value;
@@ -455,7 +471,7 @@ void HTMLTextAreaElement::updatePlaceholderText()
     String placeholderText = strippedPlaceholder();
     if (placeholderText.isEmpty()) {
         if (m_placeholder) {
-            shadowRoot()->removeChild(m_placeholder.get(), ec);
+            shadowRootList()->oldestShadowRoot()->removeChild(m_placeholder.get(), ec);
             ASSERT(!ec);
             m_placeholder.clear();
         }
@@ -464,7 +480,7 @@ void HTMLTextAreaElement::updatePlaceholderText()
     if (!m_placeholder) {
         m_placeholder = HTMLDivElement::create(document());
         m_placeholder->setShadowPseudoId("-webkit-input-placeholder");
-        shadowRoot()->insertBefore(m_placeholder, shadowRoot()->firstChild()->nextSibling(), ec);
+        shadowRootList()->oldestShadowRoot()->insertBefore(m_placeholder, shadowRootList()->oldestShadowRoot()->firstChild()->nextSibling(), ec);
         ASSERT(!ec);
     }
     m_placeholder->setInnerText(placeholderText, ec);
diff --git a/Source/WebCore/html/HTMLTextAreaElement.h b/Source/WebCore/html/HTMLTextAreaElement.h
index c2bbc718c..615af2585 100644
--- a/Source/WebCore/html/HTMLTextAreaElement.h
+++ b/Source/WebCore/html/HTMLTextAreaElement.h
@@ -94,6 +94,8 @@ private:
 
     virtual void childrenChanged(bool changedByParser = false, Node* beforeChange = 0, Node* afterChange = 0, int childCountDelta = 0);
     virtual void parseAttribute(Attribute*) OVERRIDE;
+    virtual bool isPresentationAttribute(Attribute*) const OVERRIDE;
+    virtual void collectStyleForAttribute(Attribute*, StylePropertySet*) OVERRIDE;
     virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
     virtual bool appendFormData(FormDataList&, bool);
     virtual void reset();
diff --git a/Source/WebCore/html/HTMLTextAreaElement.idl b/Source/WebCore/html/HTMLTextAreaElement.idl
index 3b76115e5..f6ed37503 100644
--- a/Source/WebCore/html/HTMLTextAreaElement.idl
+++ b/Source/WebCore/html/HTMLTextAreaElement.idl
@@ -40,6 +40,9 @@ module html {
         attribute [TreatNullAs=NullString] DOMString value;
         readonly attribute unsigned long textLength;
 
+#if defined(LANGUAGE_OBJECTIVE_C) && LANGUAGE_OBJECTIVE_C
+        attribute [Reflect] DOMString accessKey;
+#endif
         void select();
 
         readonly attribute boolean willValidate;
@@ -54,8 +57,8 @@ module html {
 #if defined(LANGUAGE_OBJECTIVE_C) && LANGUAGE_OBJECTIVE_C
         void setSelectionRange(in long start, in long end);
 #else
-        void setSelectionRange(in [Optional=CallWithDefaultValue] long start, 
-                               in [Optional=CallWithDefaultValue] long end, 
+        void setSelectionRange(in [Optional=DefaultIsUndefined] long start, 
+                               in [Optional=DefaultIsUndefined] long end, 
                                in [Optional] DOMString direction);
 #endif
         readonly attribute NodeList labels;
diff --git a/Source/WebCore/html/HTMLTextFormControlElement.cpp b/Source/WebCore/html/HTMLTextFormControlElement.cpp
index c7f64903f..f47e1f209 100644
--- a/Source/WebCore/html/HTMLTextFormControlElement.cpp
+++ b/Source/WebCore/html/HTMLTextFormControlElement.cpp
@@ -37,6 +37,7 @@
 #include "HTMLFormElement.h"
 #include "HTMLInputElement.h"
 #include "HTMLNames.h"
+#include "NodeRenderingContext.h"
 #include "Page.h"
 #include "RenderBox.h"
 #include "RenderTextControl.h"
@@ -64,6 +65,11 @@ HTMLTextFormControlElement::~HTMLTextFormControlElement()
 {
 }
 
+bool HTMLTextFormControlElement::childShouldCreateRenderer(const NodeRenderingContext& childContext) const
+{
+    return childContext.isOnEncapsulationBoundary() && HTMLFormControlElementWithState::childShouldCreateRenderer(childContext);
+}
+
 void HTMLTextFormControlElement::insertedIntoDocument()
 {
     HTMLFormControlElement::insertedIntoDocument();
@@ -153,7 +159,7 @@ void HTMLTextFormControlElement::updatePlaceholderVisibility(bool placeholderVal
     if (!placeholder)
         return;
     ExceptionCode ec = 0;
-    placeholder->ensureInlineStyleDecl()->setProperty(CSSPropertyVisibility, placeholderShouldBeVisible() ? "visible" : "hidden", ec);
+    placeholder->setInlineStyleProperty(CSSPropertyVisibility, placeholderShouldBeVisible() ? "visible" : "hidden", ec);
     ASSERT(!ec);
 }
 
@@ -493,7 +499,7 @@ String HTMLTextFormControlElement::innerTextValue() const
         if (node->hasTagName(brTag))
             result.append(newlineCharacter);
         else if (node->isTextNode())
-            result.append(static_cast<Text*>(node)->data());
+            result.append(toText(node)->data());
     }
     return finishText(result);
 }
@@ -540,7 +546,7 @@ String HTMLTextFormControlElement::valueWithHardLineBreaks() const
         if (node->hasTagName(brTag))
             result.append(newlineCharacter);
         else if (node->isTextNode()) {
-            String data = static_cast<Text*>(node)->data();
+            String data = toText(node)->data();
             unsigned length = data.length();
             unsigned position = 0;
             while (breakNode == node && breakOffset <= length) {
diff --git a/Source/WebCore/html/HTMLTextFormControlElement.h b/Source/WebCore/html/HTMLTextFormControlElement.h
index 8aff29093..59cd741dd 100644
--- a/Source/WebCore/html/HTMLTextFormControlElement.h
+++ b/Source/WebCore/html/HTMLTextFormControlElement.h
@@ -34,6 +34,7 @@ class RenderTextControl;
 class VisiblePosition;
 
 enum TextFieldSelectionDirection { SelectionHasNoDirection, SelectionHasForwardDirection, SelectionHasBackwardDirection };
+enum TextFieldEventBehavior { DispatchNoEvent, DispatchChangeEvent, DispatchInputAndChangeEvent };
 
 class HTMLTextFormControlElement : public HTMLFormControlElementWithState {
 public:
@@ -81,14 +82,14 @@ public:
 
     String directionForFormData() const;
 
+    void setTextAsOfLastFormControlChangeEvent(const String& text) { m_textAsOfLastFormControlChangeEvent = text; }
+
 protected:
     HTMLTextFormControlElement(const QualifiedName&, Document*, HTMLFormElement*);
     virtual void updatePlaceholderText() = 0;
 
     virtual void parseAttribute(Attribute*) OVERRIDE;
 
-    void setTextAsOfLastFormControlChangeEvent(const String& text) { m_textAsOfLastFormControlChangeEvent = text; }
-    
     void cacheSelection(int start, int end, TextFieldSelectionDirection direction)
     {
         m_cachedSelectionStart = start;
@@ -113,6 +114,7 @@ private:
 
     virtual void dispatchFocusEvent(PassRefPtr<Node> oldFocusedNode);
     virtual void dispatchBlurEvent(PassRefPtr<Node> newFocusedNode);
+    virtual bool childShouldCreateRenderer(const NodeRenderingContext&) const OVERRIDE;
 
     bool isPlaceholderEmpty() const;
 
diff --git a/Source/WebCore/html/HTMLTitleElement.cpp b/Source/WebCore/html/HTMLTitleElement.cpp
index 69f1f84bc..6e7884b8b 100644
--- a/Source/WebCore/html/HTMLTitleElement.cpp
+++ b/Source/WebCore/html/HTMLTitleElement.cpp
@@ -70,7 +70,7 @@ String HTMLTitleElement::text() const
     
     for (Node *n = firstChild(); n; n = n->nextSibling()) {
         if (n->isTextNode())
-            val += static_cast<Text*>(n)->data();
+            val += toText(n)->data();
     }
 
     return val;
@@ -92,7 +92,7 @@ void HTMLTitleElement::setText(const String &value)
     int numChildren = childNodeCount();
     
     if (numChildren == 1 && firstChild()->isTextNode())
-        static_cast<Text*>(firstChild())->setData(value, ec);
+        toText(firstChild())->setData(value, ec);
     else {  
         // We make a copy here because entity of "value" argument can be Document::m_title,
         // which goes empty during removeChildren() invocation below,
diff --git a/Source/WebCore/html/HTMLTrackElement.cpp b/Source/WebCore/html/HTMLTrackElement.cpp
index ea2ad05c7..f3578dacf 100644
--- a/Source/WebCore/html/HTMLTrackElement.cpp
+++ b/Source/WebCore/html/HTMLTrackElement.cpp
@@ -92,6 +92,20 @@ void HTMLTrackElement::parseAttribute(Attribute* attribute)
 {
     const QualifiedName& attrName = attribute->name();
 
+    if (RuntimeEnabledFeatures::webkitVideoTrackEnabled()) {
+        if (attrName == srcAttr) {
+            if (!attribute->isEmpty() && mediaElement())
+                scheduleLoad();
+            // 4.8.10.12.3 Sourcing out-of-band text tracks
+            // As the kind, label, and srclang attributes are set, changed, or removed, the text track must update accordingly...
+        } else if (attrName == kindAttr)
+            track()->setKind(attribute->value());
+        else if (attrName == labelAttr)
+            track()->setLabel(attribute->value());
+        else if (attrName == srclangAttr)
+            track()->setLanguage(attribute->value());
+    }
+
     if (attrName == onloadAttr)
         setAttributeEventListener(eventNames().loadEvent, createAttributeEventListener(this, attribute));
     else if (attrName == onerrorAttr)
@@ -100,28 +114,6 @@ void HTMLTrackElement::parseAttribute(Attribute* attribute)
         HTMLElement::parseAttribute(attribute);
 }
 
-void HTMLTrackElement::attributeChanged(Attribute* attr)
-{
-    HTMLElement::attributeChanged(attr);
-
-    if (!RuntimeEnabledFeatures::webkitVideoTrackEnabled())
-        return;
-
-    const QualifiedName& attrName = attr->name();
-    if (attrName == srcAttr) {
-        if (!getAttribute(srcAttr).isEmpty() && mediaElement())
-            scheduleLoad();
-
-    // 4.8.10.12.3 Sourcing out-of-band text tracks
-    // As the kind, label, and srclang attributes are set, changed, or removed, the text track must update accordingly...
-    } else if (attrName == kindAttr)
-        track()->setKind(attr->value());
-    else if (attrName == labelAttr)
-        track()->setLabel(attr->value());
-    else if (attrName == srclangAttr)
-        track()->setLanguage(attr->value());
-}
-
 KURL HTMLTrackElement::src() const
 {
     return document()->completeURL(getAttribute(srcAttr));
diff --git a/Source/WebCore/html/HTMLTrackElement.h b/Source/WebCore/html/HTMLTrackElement.h
index d3a05544a..ce1247c69 100644
--- a/Source/WebCore/html/HTMLTrackElement.h
+++ b/Source/WebCore/html/HTMLTrackElement.h
@@ -76,7 +76,6 @@ private:
     virtual ~HTMLTrackElement();
 
     virtual void parseAttribute(Attribute*) OVERRIDE;
-    virtual void attributeChanged(Attribute*) OVERRIDE;
 
     virtual void insertedIntoDocument() OVERRIDE;
     virtual void removedFromDocument() OVERRIDE;
diff --git a/Source/WebCore/html/HTMLUListElement.cpp b/Source/WebCore/html/HTMLUListElement.cpp
index cc3c06999..e18d2a71c 100644
--- a/Source/WebCore/html/HTMLUListElement.cpp
+++ b/Source/WebCore/html/HTMLUListElement.cpp
@@ -47,15 +47,19 @@ PassRefPtr<HTMLUListElement> HTMLUListElement::create(const QualifiedName& tagNa
     return adoptRef(new HTMLUListElement(tagName, document));
 }
 
-void HTMLUListElement::parseAttribute(Attribute* attr)
+bool HTMLUListElement::isPresentationAttribute(Attribute* attr) const
 {
     if (attr->name() == typeAttr)
-        if (attr->value().isNull())
-            removeCSSProperty(CSSPropertyListStyleType);
-        else
-            addCSSProperty(CSSPropertyListStyleType, attr->value());
+        return true;
+    return HTMLElement::isPresentationAttribute(attr);
+}
+
+void HTMLUListElement::collectStyleForAttribute(Attribute* attr, StylePropertySet* style)
+{
+    if (attr->name() == typeAttr)
+        addPropertyToAttributeStyle(style, CSSPropertyListStyleType, attr->value());
     else
-        HTMLElement::parseAttribute(attr);
+        HTMLElement::collectStyleForAttribute(attr, style);
 }
 
 }
diff --git a/Source/WebCore/html/HTMLUListElement.h b/Source/WebCore/html/HTMLUListElement.h
index c7867469f..ea6510da0 100644
--- a/Source/WebCore/html/HTMLUListElement.h
+++ b/Source/WebCore/html/HTMLUListElement.h
@@ -35,7 +35,8 @@ public:
 private:
     HTMLUListElement(const QualifiedName&, Document*);
 
-    virtual void parseAttribute(Attribute*) OVERRIDE;
+    virtual bool isPresentationAttribute(Attribute*) const OVERRIDE;
+    virtual void collectStyleForAttribute(Attribute*, StylePropertySet*) OVERRIDE;
 };
 
 } //namespace
diff --git a/Source/WebCore/html/HTMLVideoElement.cpp b/Source/WebCore/html/HTMLVideoElement.cpp
index c59f995e4..64428d815 100644
--- a/Source/WebCore/html/HTMLVideoElement.cpp
+++ b/Source/WebCore/html/HTMLVideoElement.cpp
@@ -54,7 +54,9 @@ inline HTMLVideoElement::HTMLVideoElement(const QualifiedName& tagName, Document
 
 PassRefPtr<HTMLVideoElement> HTMLVideoElement::create(const QualifiedName& tagName, Document* document, bool createdByParser)
 {
-    return adoptRef(new HTMLVideoElement(tagName, document, createdByParser));
+    RefPtr<HTMLVideoElement> videoElement(adoptRef(new HTMLVideoElement(tagName, document, createdByParser)));
+    videoElement->suspendIfNeeded();
+    return videoElement.release();
 }
 
 bool HTMLVideoElement::rendererIsNeeded(const NodeRenderingContext& context) 
@@ -93,6 +95,23 @@ void HTMLVideoElement::detach()
         m_imageLoader.clear();
 }
 
+void HTMLVideoElement::collectStyleForAttribute(Attribute* attr, StylePropertySet* style)
+{
+    if (attr->name() == widthAttr)
+        addHTMLLengthToStyle(style, CSSPropertyWidth, attr->value());
+    else if (attr->name() == heightAttr)
+        addHTMLLengthToStyle(style, CSSPropertyHeight, attr->value());
+    else
+        HTMLMediaElement::collectStyleForAttribute(attr, style);
+}
+
+bool HTMLVideoElement::isPresentationAttribute(Attribute* attr) const
+{
+    if (attr->name() == widthAttr || attr->name() == heightAttr)
+        return true;
+    return HTMLMediaElement::isPresentationAttribute(attr);
+}
+
 void HTMLVideoElement::parseAttribute(Attribute* attr)
 {
     const QualifiedName& attrName = attr->name();
@@ -113,17 +132,7 @@ void HTMLVideoElement::parseAttribute(Attribute* attr)
                 toRenderImage(renderer())->imageResource()->setCachedImage(0); 
         }
 #endif
-    } else if (attrName == widthAttr)
-        if (attr->value().isNull())
-            removeCSSProperty(CSSPropertyWidth);
-        else
-            addCSSLength(CSSPropertyWidth, attr->value());
-    else if (attrName == heightAttr)
-        if (attr->value().isNull())
-            removeCSSProperty(CSSPropertyHeight);
-        else
-            addCSSLength(CSSPropertyHeight, attr->value());
-    else
+    } else
         HTMLMediaElement::parseAttribute(attr);
 }
 
diff --git a/Source/WebCore/html/HTMLVideoElement.h b/Source/WebCore/html/HTMLVideoElement.h
index e8f6331ef..59efd882b 100644
--- a/Source/WebCore/html/HTMLVideoElement.h
+++ b/Source/WebCore/html/HTMLVideoElement.h
@@ -76,6 +76,8 @@ private:
     virtual void attach();
     virtual void detach();
     virtual void parseAttribute(Attribute*) OVERRIDE;
+    virtual bool isPresentationAttribute(Attribute*) const OVERRIDE;
+    virtual void collectStyleForAttribute(Attribute*, StylePropertySet*) OVERRIDE;
     virtual bool isVideo() const { return true; }
     virtual bool hasVideo() const { return player() && player()->hasVideo(); }
     virtual bool supportsFullscreen() const;
diff --git a/Source/WebCore/html/HiddenInputType.cpp b/Source/WebCore/html/HiddenInputType.cpp
index fc103975b..951b6d826 100644
--- a/Source/WebCore/html/HiddenInputType.cpp
+++ b/Source/WebCore/html/HiddenInputType.cpp
@@ -87,7 +87,7 @@ bool HiddenInputType::storesValueSeparateFromAttribute()
     return false;
 }
 
-void HiddenInputType::setValue(const String& sanitizedValue, bool, bool)
+void HiddenInputType::setValue(const String& sanitizedValue, bool, TextFieldEventBehavior)
 {
     element()->setAttribute(valueAttr, sanitizedValue);
 }
diff --git a/Source/WebCore/html/HiddenInputType.h b/Source/WebCore/html/HiddenInputType.h
index fd86fbc1f..9e8982c54 100644
--- a/Source/WebCore/html/HiddenInputType.h
+++ b/Source/WebCore/html/HiddenInputType.h
@@ -51,7 +51,7 @@ private:
     virtual bool storesValueSeparateFromAttribute() OVERRIDE;
     virtual bool isHiddenType() const OVERRIDE;
     virtual bool shouldRespectHeightAndWidthAttributes() OVERRIDE;
-    virtual void setValue(const String&, bool, bool) OVERRIDE;
+    virtual void setValue(const String&, bool, TextFieldEventBehavior) OVERRIDE;
     virtual bool appendFormData(FormDataList&, bool) const OVERRIDE;
 };
 
diff --git a/Source/WebCore/html/ImageData.idl b/Source/WebCore/html/ImageData.idl
index bbfa460a3..c85945417 100644
--- a/Source/WebCore/html/ImageData.idl
+++ b/Source/WebCore/html/ImageData.idl
@@ -29,7 +29,7 @@
 module html {
 
     interface [
-        JSCustomToJS
+        CustomToJSObject
     ] ImageData {
         readonly attribute long width;
         readonly attribute long height;
diff --git a/Source/WebCore/html/ImageDocument.cpp b/Source/WebCore/html/ImageDocument.cpp
index dc95a0d71..eb8e82198 100644
--- a/Source/WebCore/html/ImageDocument.cpp
+++ b/Source/WebCore/html/ImageDocument.cpp
@@ -253,7 +253,7 @@ void ImageDocument::resizeImageToFit()
     m_imageElement->setWidth(static_cast<int>(imageSize.width() * scale));
     m_imageElement->setHeight(static_cast<int>(imageSize.height() * scale));
     
-    m_imageElement->ensureInlineStyleDecl()->setProperty(CSSPropertyCursor, "-webkit-zoom-in", false);
+    m_imageElement->setInlineStyleProperty(CSSPropertyCursor, "-webkit-zoom-in", false);
 }
 
 void ImageDocument::imageClicked(int x, int y)
@@ -307,9 +307,9 @@ void ImageDocument::restoreImageSize()
     m_imageElement->setHeight(imageSize.height());
     
     if (imageFitsInWindow())
-        m_imageElement->ensureInlineStyleDecl()->removeProperty(CSSPropertyCursor);
+        m_imageElement->removeInlineStyleProperty(CSSPropertyCursor);
     else
-        m_imageElement->ensureInlineStyleDecl()->setProperty(CSSPropertyCursor, "-webkit-zoom-out", false);
+        m_imageElement->setInlineStyleProperty(CSSPropertyCursor, "-webkit-zoom-out", false);
         
     m_didShrinkImage = false;
 }
@@ -340,9 +340,9 @@ void ImageDocument::windowSizeChanged()
     // and set it to a zoom out cursor if the image doesn't fit
     if (!m_shouldShrinkImage) {
         if (fitsInWindow)
-            m_imageElement->ensureInlineStyleDecl()->removeProperty(CSSPropertyCursor);
+            m_imageElement->removeInlineStyleProperty(CSSPropertyCursor);
         else
-            m_imageElement->ensureInlineStyleDecl()->setProperty(CSSPropertyCursor, "-webkit-zoom-out", false);
+            m_imageElement->setInlineStyleProperty(CSSPropertyCursor, "-webkit-zoom-out", false);
         return;
     }
     
diff --git a/Source/WebCore/html/InputType.cpp b/Source/WebCore/html/InputType.cpp
index f34e6eb32..f34b93b5f 100644
--- a/Source/WebCore/html/InputType.cpp
+++ b/Source/WebCore/html/InputType.cpp
@@ -56,6 +56,7 @@
 #include "ResetInputType.h"
 #include "SearchInputType.h"
 #include "ShadowRoot.h"
+#include "ShadowRootList.h"
 #include "SubmitInputType.h"
 #include "TelephoneInputType.h"
 #include "TextInputType.h"
@@ -192,7 +193,7 @@ double InputType::valueAsNumber() const
     return numeric_limits<double>::quiet_NaN();
 }
 
-void InputType::setValueAsNumber(double, bool, ExceptionCode& ec) const
+void InputType::setValueAsNumber(double, TextFieldEventBehavior, ExceptionCode& ec) const
 {
     ec = INVALID_STATE_ERR;
 }
@@ -378,7 +379,11 @@ void InputType::createShadowSubtree()
 
 void InputType::destroyShadowSubtree()
 {
-    element()->removeShadowRoot();
+    if (!element()->hasShadowRoot())
+        return;
+
+    if (ShadowRoot* root = element()->shadowRootList()->oldestShadowRoot())
+        root->removeAllChildren();
 }
 
 double InputType::parseToDouble(const String&, double defaultValue) const
@@ -535,15 +540,12 @@ bool InputType::storesValueSeparateFromAttribute()
     return true;
 }
 
-void InputType::setValue(const String& sanitizedValue, bool, bool sendChangeEvent)
+void InputType::setValue(const String& sanitizedValue, bool valueChanged, TextFieldEventBehavior eventBehavior)
 {
-    element()->setValueInternal(sanitizedValue, sendChangeEvent);
+    element()->setValueInternal(sanitizedValue, eventBehavior);
     element()->setNeedsStyleRecalc();
-}
-
-void InputType::dispatchChangeEventInResponseToSetValue()
-{
-    element()->dispatchFormControlChangeEvent();
+    if (valueChanged && eventBehavior != DispatchNoEvent)
+        element()->dispatchFormControlChangeEvent();
 }
 
 bool InputType::canSetValue(const String&)
diff --git a/Source/WebCore/html/InputType.h b/Source/WebCore/html/InputType.h
index c76aacc8f..6b0f9c15a 100644
--- a/Source/WebCore/html/InputType.h
+++ b/Source/WebCore/html/InputType.h
@@ -32,6 +32,7 @@
 #ifndef InputType_h
 #define InputType_h
 
+#include "HTMLTextFormControlElement.h"
 #include <wtf/Forward.h>
 #include <wtf/FastAllocBase.h>
 #include <wtf/Noncopyable.h>
@@ -126,7 +127,7 @@ public:
     virtual double valueAsDate() const;
     virtual void setValueAsDate(double, ExceptionCode&) const;
     virtual double valueAsNumber() const;
-    virtual void setValueAsNumber(double, bool sendChangeEvent, ExceptionCode&) const;
+    virtual void setValueAsNumber(double, TextFieldEventBehavior, ExceptionCode&) const;
 
     // Validation functions
 
@@ -225,8 +226,7 @@ public:
     virtual bool shouldSendChangeEventAfterCheckedChanged();
     virtual bool canSetValue(const String&);
     virtual bool storesValueSeparateFromAttribute();
-    virtual void setValue(const String&, bool valueChanged, bool sendChangeEvent);
-    virtual void dispatchChangeEventInResponseToSetValue();
+    virtual void setValue(const String&, bool valueChanged, TextFieldEventBehavior);
     virtual bool shouldResetOnDocumentActivation();
     virtual bool shouldRespectListAttribute();
     virtual bool shouldRespectSpeechAttribute();
diff --git a/Source/WebCore/html/MediaController.idl b/Source/WebCore/html/MediaController.idl
index 1899dc3d8..d3f33485b 100644
--- a/Source/WebCore/html/MediaController.idl
+++ b/Source/WebCore/html/MediaController.idl
@@ -28,7 +28,7 @@ module html {
         Conditional=VIDEO,
         Constructor,
         CallWith=ScriptExecutionContext,
-        JSGenerateToJS,
+        JSGenerateToJSObject,
         EventTarget
     ] MediaController {
         readonly attribute TimeRanges buffered;
diff --git a/Source/WebCore/html/NumberInputType.cpp b/Source/WebCore/html/NumberInputType.cpp
index 3a4d420cd..560a4515b 100644
--- a/Source/WebCore/html/NumberInputType.cpp
+++ b/Source/WebCore/html/NumberInputType.cpp
@@ -83,7 +83,7 @@ double NumberInputType::valueAsNumber() const
     return parseToDouble(element()->value(), numeric_limits<double>::quiet_NaN());
 }
 
-void NumberInputType::setValueAsNumber(double newValue, bool sendChangeEvent, ExceptionCode& ec) const
+void NumberInputType::setValueAsNumber(double newValue, TextFieldEventBehavior eventBehavior, ExceptionCode& ec) const
 {
     if (newValue < -numeric_limits<float>::max()) {
         ec = INVALID_STATE_ERR;
@@ -93,7 +93,7 @@ void NumberInputType::setValueAsNumber(double newValue, bool sendChangeEvent, Ex
         ec = INVALID_STATE_ERR;
         return;
     }
-    element()->setValue(serialize(newValue), sendChangeEvent);
+    element()->setValue(serialize(newValue), eventBehavior);
 }
 
 bool NumberInputType::typeMismatchFor(const String& value) const
diff --git a/Source/WebCore/html/NumberInputType.h b/Source/WebCore/html/NumberInputType.h
index 26e7986c3..1afef8a69 100644
--- a/Source/WebCore/html/NumberInputType.h
+++ b/Source/WebCore/html/NumberInputType.h
@@ -43,7 +43,7 @@ private:
     NumberInputType(HTMLInputElement* element) : TextFieldInputType(element) { }
     virtual const AtomicString& formControlType() const OVERRIDE;
     virtual double valueAsNumber() const OVERRIDE;
-    virtual void setValueAsNumber(double, bool sendChangeEvent, ExceptionCode&) const OVERRIDE;
+    virtual void setValueAsNumber(double, TextFieldEventBehavior, ExceptionCode&) const OVERRIDE;
     virtual bool typeMismatchFor(const String&) const OVERRIDE;
     virtual bool typeMismatch() const OVERRIDE;
     virtual bool rangeUnderflow(const String&) const OVERRIDE;
diff --git a/Source/WebCore/html/RadioInputType.cpp b/Source/WebCore/html/RadioInputType.cpp
index d31cc2daf..cea0132e8 100644
--- a/Source/WebCore/html/RadioInputType.cpp
+++ b/Source/WebCore/html/RadioInputType.cpp
@@ -161,7 +161,7 @@ PassOwnPtr<ClickHandlingState> RadioInputType::willDispatchClick()
         element()->setIndeterminate(false);
 #endif
 
-    element()->setChecked(true, true);
+    element()->setChecked(true, DispatchChangeEvent);
 
     return state.release();
 }
diff --git a/Source/WebCore/html/RangeInputType.cpp b/Source/WebCore/html/RangeInputType.cpp
index acfe1cca5..a174ce7af 100644
--- a/Source/WebCore/html/RangeInputType.cpp
+++ b/Source/WebCore/html/RangeInputType.cpp
@@ -42,6 +42,7 @@
 #include "PlatformMouseEvent.h"
 #include "RenderSlider.h"
 #include "ShadowRoot.h"
+#include "ShadowRootList.h"
 #include "SliderThumbElement.h"
 #include "StepRange.h"
 #include <limits>
@@ -78,9 +79,9 @@ double RangeInputType::valueAsNumber() const
     return parseToDouble(element()->value(), numeric_limits<double>::quiet_NaN());
 }
 
-void RangeInputType::setValueAsNumber(double newValue, bool sendChangeEvent, ExceptionCode&) const
+void RangeInputType::setValueAsNumber(double newValue, TextFieldEventBehavior eventBehavior, ExceptionCode&) const
 {
-    element()->setValue(serialize(newValue), sendChangeEvent);
+    element()->setValue(serialize(newValue), eventBehavior);
 }
 
 bool RangeInputType::supportsRequired() const
@@ -157,7 +158,10 @@ void RangeInputType::handleMouseDownEvent(MouseEvent* event)
         return;
 
     Node* targetNode = event->target()->toNode();
-    if (event->button() != LeftButton || !targetNode || (targetNode != element() && !targetNode->isDescendantOf(element()->shadowRoot())))
+    if (event->button() != LeftButton || !targetNode)
+        return;
+    ASSERT(element()->hasShadowRoot());
+    if (targetNode != element() && !targetNode->isDescendantOf(element()->shadowRootList()->oldestShadowRoot()))
         return;
     SliderThumbElement* thumb = sliderThumbElementOf(element());
     if (targetNode == thumb)
@@ -220,8 +224,8 @@ void RangeInputType::handleKeydownEvent(KeyboardEvent* event)
 
     if (newValue != current) {
         ExceptionCode ec;
-        bool sendChangeEvent = true;
-        setValueAsNumber(newValue, sendChangeEvent, ec);
+        TextFieldEventBehavior eventBehavior = DispatchChangeEvent;
+        setValueAsNumber(newValue, eventBehavior, ec);
 
         if (AXObjectCache::accessibilityEnabled())
             element()->document()->axObjectCache()->postNotification(element()->renderer(), AXObjectCache::AXValueChanged, true);
@@ -233,6 +237,8 @@ void RangeInputType::handleKeydownEvent(KeyboardEvent* event)
 
 void RangeInputType::createShadowSubtree()
 {
+    ASSERT(element()->hasShadowRoot());
+
     Document* document = element()->document();
     RefPtr<HTMLDivElement> track = HTMLDivElement::create(document);
     track->setShadowPseudoId("-webkit-slider-runnable-track");
@@ -241,7 +247,7 @@ void RangeInputType::createShadowSubtree()
     RefPtr<HTMLElement> container = SliderContainerElement::create(document);
     container->appendChild(track.release(), ec);
     container->appendChild(TrackLimiterElement::create(document), ec);
-    element()->ensureShadowRoot()->appendChild(container.release(), ec);
+    element()->shadowRootList()->oldestShadowRoot()->appendChild(container.release(), ec);
 }
 
 RenderObject* RangeInputType::createRenderer(RenderArena* arena, RenderStyle*) const
@@ -285,9 +291,9 @@ void RangeInputType::minOrMaxAttributeChanged()
     element()->setNeedsStyleRecalc();
 }
 
-void RangeInputType::setValue(const String& value, bool valueChanged, bool sendChangeEvent)
+void RangeInputType::setValue(const String& value, bool valueChanged, TextFieldEventBehavior eventBehavior)
 {
-    InputType::setValue(value, valueChanged, sendChangeEvent);
+    InputType::setValue(value, valueChanged, eventBehavior);
 
     if (!valueChanged)
         return;
diff --git a/Source/WebCore/html/RangeInputType.h b/Source/WebCore/html/RangeInputType.h
index e75193098..abf2ea674 100644
--- a/Source/WebCore/html/RangeInputType.h
+++ b/Source/WebCore/html/RangeInputType.h
@@ -46,7 +46,7 @@ private:
     virtual bool isRangeControl() const OVERRIDE;
     virtual const AtomicString& formControlType() const OVERRIDE;
     virtual double valueAsNumber() const OVERRIDE;
-    virtual void setValueAsNumber(double, bool sendChangeEvent, ExceptionCode&) const OVERRIDE;
+    virtual void setValueAsNumber(double, TextFieldEventBehavior, ExceptionCode&) const OVERRIDE;
     virtual bool supportsRequired() const OVERRIDE;
     virtual bool rangeUnderflow(const String&) const OVERRIDE;
     virtual bool rangeOverflow(const String&) const OVERRIDE;
@@ -66,7 +66,7 @@ private:
     virtual String serialize(double) const OVERRIDE;
     virtual void accessKeyAction(bool sendMouseEvents) OVERRIDE;
     virtual void minOrMaxAttributeChanged() OVERRIDE;
-    virtual void setValue(const String&, bool valueChanged, bool sendChangeEvent) OVERRIDE;
+    virtual void setValue(const String&, bool valueChanged, TextFieldEventBehavior) OVERRIDE;
     virtual String fallbackValue() const OVERRIDE;
     virtual String sanitizeValue(const String& proposedValue) const OVERRIDE;
     virtual bool shouldRespectListAttribute() OVERRIDE;
diff --git a/Source/WebCore/html/TextFieldInputType.cpp b/Source/WebCore/html/TextFieldInputType.cpp
index 3ec15bcde..d56f47d4e 100644
--- a/Source/WebCore/html/TextFieldInputType.cpp
+++ b/Source/WebCore/html/TextFieldInputType.cpp
@@ -43,6 +43,7 @@
 #include "RenderTextControlSingleLine.h"
 #include "RenderTheme.h"
 #include "ShadowRoot.h"
+#include "ShadowRootList.h"
 #include "TextControlInnerElements.h"
 #include "TextEvent.h"
 #include "TextIterator.h"
@@ -77,29 +78,51 @@ bool TextFieldInputType::canSetSuggestedValue()
     return true;
 }
 
-void TextFieldInputType::setValue(const String& sanitizedValue, bool valueChanged, bool sendChangeEvent)
+void TextFieldInputType::setValue(const String& sanitizedValue, bool valueChanged, TextFieldEventBehavior eventBehavior)
 {
-    InputType::setValue(sanitizedValue, valueChanged, sendChangeEvent);
+    // Grab this input element to keep reference even if JS event handler
+    // changes input type.
+    RefPtr<HTMLInputElement> input(element());
+
+    // We don't ask InputType::setValue to dispatch events because
+    // TextFieldInputType dispatches events different way from InputType.
+    InputType::setValue(sanitizedValue, valueChanged, DispatchNoEvent);
 
     if (valueChanged)
-        element()->updateInnerTextValue();
+        input->updateInnerTextValue();
 
     unsigned max = visibleValue().length();
-    if (element()->focused())
-        element()->setSelectionRange(max, max);
+    if (input->focused())
+        input->setSelectionRange(max, max);
     else
-        element()->cacheSelectionInResponseToSetValue(max);
-}
+        input->cacheSelectionInResponseToSetValue(max);
 
-void TextFieldInputType::dispatchChangeEventInResponseToSetValue()
-{
-    // If the user is still editing this field, dispatch an input event rather than a change event.
-    // The change event will be dispatched when editing finishes.
-    if (element()->focused()) {
-        element()->dispatchFormControlInputEvent();
+    if (!valueChanged)
         return;
+
+    switch (eventBehavior) {
+    case DispatchChangeEvent:
+        // If the user is still editing this field, dispatch an input event rather than a change event.
+        // The change event will be dispatched when editing finishes.
+        if (input->focused())
+            input->dispatchFormControlInputEvent();
+        else
+            input->dispatchFormControlChangeEvent();
+        break;
+
+    case DispatchInputAndChangeEvent: {
+        input->dispatchFormControlInputEvent();
+        input->dispatchFormControlChangeEvent();
+        break;
     }
-    InputType::dispatchChangeEventInResponseToSetValue();
+
+    case DispatchNoEvent:
+        break;
+    }
+
+    // FIXME: Why do we do this when eventBehavior == DispatchNoEvent
+    if (!input->focused() || eventBehavior == DispatchNoEvent)
+        input->setTextAsOfLastFormControlChangeEvent(sanitizedValue);
 }
 
 void TextFieldInputType::handleKeydownEvent(KeyboardEvent* event)
@@ -189,6 +212,8 @@ bool TextFieldInputType::needsContainer() const
 
 void TextFieldInputType::createShadowSubtree()
 {
+    ASSERT(element()->hasShadowRoot());
+
     ASSERT(!m_innerText);
     ASSERT(!m_innerBlock);
     ASSERT(!m_innerSpinButton);
@@ -201,11 +226,11 @@ void TextFieldInputType::createShadowSubtree()
     ExceptionCode ec = 0;
     m_innerText = TextControlInnerTextElement::create(document);
     if (!createsContainer) {
-        element()->ensureShadowRoot()->appendChild(m_innerText, ec);
+        element()->shadowRootList()->oldestShadowRoot()->appendChild(m_innerText, ec);
         return;
     }
 
-    ShadowRoot* shadowRoot = element()->ensureShadowRoot();
+    ShadowRoot* shadowRoot = element()->shadowRootList()->oldestShadowRoot();
     m_container = HTMLDivElement::create(document);
     m_container->setShadowPseudoId("-webkit-textfield-decoration-container");
     shadowRoot->appendChild(m_container, ec);
@@ -367,7 +392,7 @@ void TextFieldInputType::updatePlaceholderText()
     if (!m_placeholder) {
         m_placeholder = HTMLDivElement::create(element()->document());
         m_placeholder->setShadowPseudoId("-webkit-input-placeholder");
-        element()->shadowRoot()->insertBefore(m_placeholder, m_container ? m_container->nextSibling() : innerTextElement()->nextSibling(), ec);
+        element()->shadowRootList()->oldestShadowRoot()->insertBefore(m_placeholder, m_container ? m_container->nextSibling() : innerTextElement()->nextSibling(), ec);
         ASSERT(!ec);
     }
     m_placeholder->setInnerText(placeholderText, ec);
diff --git a/Source/WebCore/html/TextFieldInputType.h b/Source/WebCore/html/TextFieldInputType.h
index f94018bb0..d26e28a9b 100644
--- a/Source/WebCore/html/TextFieldInputType.h
+++ b/Source/WebCore/html/TextFieldInputType.h
@@ -73,8 +73,7 @@ private:
     virtual bool shouldSubmitImplicitly(Event*) OVERRIDE;
     virtual RenderObject* createRenderer(RenderArena*, RenderStyle*) const OVERRIDE;
     virtual bool shouldUseInputMethod() const OVERRIDE;
-    virtual void setValue(const String&, bool valueChanged, bool sendChangeEvent) OVERRIDE;
-    virtual void dispatchChangeEventInResponseToSetValue() OVERRIDE;
+    virtual void setValue(const String&, bool valueChanged, TextFieldEventBehavior) OVERRIDE;
     virtual String sanitizeValue(const String&) const OVERRIDE;
     virtual bool shouldRespectListAttribute() OVERRIDE;
     virtual HTMLElement* placeholderElement() const OVERRIDE;
diff --git a/Source/WebCore/html/ValidationMessage.cpp b/Source/WebCore/html/ValidationMessage.cpp
index bc3c45489..7653951b0 100644
--- a/Source/WebCore/html/ValidationMessage.cpp
+++ b/Source/WebCore/html/ValidationMessage.cpp
@@ -44,6 +44,7 @@
 #include "RenderObject.h"
 #include "Settings.h"
 #include "ShadowRoot.h"
+#include "ShadowRootList.h"
 #include "Text.h"
 #include <wtf/PassOwnPtr.h>
 
@@ -119,14 +120,13 @@ static void adjustBubblePosition(const LayoutRect& hostRect, HTMLElement* bubble
         hostY -= containerLocation.y() + container->borderTop();
     }
 
-    StylePropertySet* style = bubble->ensureInlineStyleDecl();
-    style->setProperty(CSSPropertyTop, hostY + hostRect.height(), CSSPrimitiveValue::CSS_PX);
+    bubble->setInlineStyleProperty(CSSPropertyTop, hostY + hostRect.height(), CSSPrimitiveValue::CSS_PX);
     // The 'left' value of ::-webkit-validation-bubble-arrow.
     const int bubbleArrowTopOffset = 32;
     double bubbleX = hostX;
     if (hostRect.width() / 2 < bubbleArrowTopOffset)
         bubbleX = max(hostX + hostRect.width() / 2 - bubbleArrowTopOffset, 0.0);
-    style->setProperty(CSSPropertyLeft, bubbleX, CSSPrimitiveValue::CSS_PX);
+    bubble->setInlineStyleProperty(CSSPropertyLeft, bubbleX, CSSPrimitiveValue::CSS_PX);
 }
 
 void ValidationMessage::buildBubbleTree(Timer<ValidationMessage>*)
@@ -137,7 +137,7 @@ void ValidationMessage::buildBubbleTree(Timer<ValidationMessage>*)
     m_bubble->setShadowPseudoId("-webkit-validation-bubble");
     // Need to force position:absolute because RenderMenuList doesn't assume it
     // contains non-absolute or non-fixed renderers as children.
-    m_bubble->ensureInlineStyleDecl()->setProperty(CSSPropertyPosition, CSSValueAbsolute);
+    m_bubble->setInlineStyleProperty(CSSPropertyPosition, CSSValueAbsolute);
     ExceptionCode ec = 0;
     host->ensureShadowRoot()->appendChild(m_bubble.get(), ec);
     ASSERT(!ec);
@@ -187,7 +187,7 @@ void ValidationMessage::deleteBubbleTree(Timer<ValidationMessage>*)
         m_messageBody = 0;
         HTMLElement* host = toHTMLElement(m_element);
         ExceptionCode ec;
-        host->shadowRoot()->removeChild(m_bubble.get(), ec);
+        host->shadowRootList()->oldestShadowRoot()->removeChild(m_bubble.get(), ec);
         m_bubble = 0;
     }
     m_message = String();
diff --git a/Source/WebCore/html/canvas/ArrayBufferView.idl b/Source/WebCore/html/canvas/ArrayBufferView.idl
index ed158bfae..0e934e6cb 100644
--- a/Source/WebCore/html/canvas/ArrayBufferView.idl
+++ b/Source/WebCore/html/canvas/ArrayBufferView.idl
@@ -25,7 +25,7 @@
 
 module html {
     interface [
-        JSCustomToJS,
+        CustomToJSObject,
         JSNoStaticTables,
         OmitConstructor
     ] ArrayBufferView {
diff --git a/Source/WebCore/html/canvas/CanvasGradient.idl b/Source/WebCore/html/canvas/CanvasGradient.idl
index 75b19279b..496d4c1b1 100644
--- a/Source/WebCore/html/canvas/CanvasGradient.idl
+++ b/Source/WebCore/html/canvas/CanvasGradient.idl
@@ -27,8 +27,8 @@ module html {
 
     interface CanvasGradient {
 
-        void addColorStop(in [Optional=CallWithDefaultValue] float offset, 
-                          in [Optional=CallWithDefaultValue] DOMString color)
+        void addColorStop(in [Optional=DefaultIsUndefined] float offset, 
+                          in [Optional=DefaultIsUndefined] DOMString color)
             raises (DOMException);
 
     };
diff --git a/Source/WebCore/html/canvas/CanvasPixelArray.idl b/Source/WebCore/html/canvas/CanvasPixelArray.idl
index a12c8ce9b..8c0836b09 100644
--- a/Source/WebCore/html/canvas/CanvasPixelArray.idl
+++ b/Source/WebCore/html/canvas/CanvasPixelArray.idl
@@ -31,7 +31,8 @@ module html {
     interface [
         OmitConstructor,
         NumericIndexedGetter,
-        CustomIndexedSetter
+        CustomIndexedSetter,
+        V8CustomToJSObject
     ] CanvasPixelArray {
 #if !defined(V8_BINDING) || !V8_BINDING
         readonly attribute long length;
diff --git a/Source/WebCore/html/canvas/CanvasRenderingContext.h b/Source/WebCore/html/canvas/CanvasRenderingContext.h
index 53278788d..124729cbe 100644
--- a/Source/WebCore/html/canvas/CanvasRenderingContext.h
+++ b/Source/WebCore/html/canvas/CanvasRenderingContext.h
@@ -55,7 +55,6 @@ public:
     virtual bool isAccelerated() const { return false; }
 
     virtual void paintRenderingResultsToCanvas() {}
-    virtual bool paintsIntoCanvasBuffer() const { return true; }
 
 #if USE(ACCELERATED_COMPOSITING)
     virtual PlatformLayer* platformLayer() const { return 0; }
diff --git a/Source/WebCore/html/canvas/CanvasRenderingContext.idl b/Source/WebCore/html/canvas/CanvasRenderingContext.idl
index acdd0b75c..b9373931f 100644
--- a/Source/WebCore/html/canvas/CanvasRenderingContext.idl
+++ b/Source/WebCore/html/canvas/CanvasRenderingContext.idl
@@ -28,7 +28,7 @@ module html {
     interface [
         JSCustomMarkFunction,
         JSGenerateIsReachable,
-        JSCustomToJS
+        JSCustomToJSObject
     ] CanvasRenderingContext {
 
         readonly attribute HTMLCanvasElement canvas;
diff --git a/Source/WebCore/html/canvas/CanvasRenderingContext2D.cpp b/Source/WebCore/html/canvas/CanvasRenderingContext2D.cpp
index b0e053ff3..0d195ac50 100644
--- a/Source/WebCore/html/canvas/CanvasRenderingContext2D.cpp
+++ b/Source/WebCore/html/canvas/CanvasRenderingContext2D.cpp
@@ -155,20 +155,6 @@ bool CanvasRenderingContext2D::isAccelerated() const
 #endif
 }
 
-bool CanvasRenderingContext2D::paintsIntoCanvasBuffer() const
-{
-#if ENABLE(ACCELERATED_2D_CANVAS) && USE(ACCELERATED_COMPOSITING)
-    if (!isAccelerated())
-        return true;
-
-    RenderBox* renderBox = canvas()->renderBox();
-    if (renderBox && renderBox->hasLayer() && renderBox->layer()->hasAcceleratedCompositing())
-        return false;
-#endif
-    return true;
-}
-
-
 void CanvasRenderingContext2D::reset()
 {
     unwindStateStack();
@@ -669,9 +655,8 @@ void CanvasRenderingContext2D::setTransform(float m11, float m12, float m21, flo
     AffineTransform ctm = state().m_transform;
     if (!ctm.isInvertible())
         return;
-    c->concatCTM(c->getCTM().inverse());
-    c->concatCTM(canvas()->baseTransform());
-    state().m_transform = ctm.inverse() * state().m_transform;
+    c->setCTM(canvas()->baseTransform());
+    state().m_transform = AffineTransform();
     m_path.transform(ctm);
 
     state().m_invertibleCTM = true;
@@ -1920,7 +1905,7 @@ void CanvasRenderingContext2D::setFont(const String& newFont)
 
     String declarationText("font: ");
     declarationText += newFont;
-    parser.parseDeclaration(tempDecl.get(), declarationText);
+    parser.parseDeclaration(tempDecl.get(), declarationText, 0, 0);
     if (tempDecl->isEmpty())
         return;
 
diff --git a/Source/WebCore/html/canvas/CanvasRenderingContext2D.h b/Source/WebCore/html/canvas/CanvasRenderingContext2D.h
index 1f481b755..5581ee9d5 100644
--- a/Source/WebCore/html/canvas/CanvasRenderingContext2D.h
+++ b/Source/WebCore/html/canvas/CanvasRenderingContext2D.h
@@ -67,7 +67,6 @@ public:
 
     virtual bool is2d() const { return true; }
     virtual bool isAccelerated() const;
-    virtual bool paintsIntoCanvasBuffer() const;
 
     CanvasStyle* strokeStyle() const;
     void setStrokeStyle(PassRefPtr<CanvasStyle>);
diff --git a/Source/WebCore/html/canvas/CanvasRenderingContext2D.idl b/Source/WebCore/html/canvas/CanvasRenderingContext2D.idl
index d4560f7a0..cec5ce7bb 100644
--- a/Source/WebCore/html/canvas/CanvasRenderingContext2D.idl
+++ b/Source/WebCore/html/canvas/CanvasRenderingContext2D.idl
@@ -30,38 +30,38 @@ module html {
         void save();
         void restore();
 
-        void scale(in [Optional=CallWithDefaultValue] float sx,
-                   in [Optional=CallWithDefaultValue] float sy);
-        void rotate(in [Optional=CallWithDefaultValue] float angle);
-        void translate(in [Optional=CallWithDefaultValue] float tx,
-                       in [Optional=CallWithDefaultValue] float ty);
-        void transform(in [Optional=CallWithDefaultValue] float m11,
-                       in [Optional=CallWithDefaultValue] float m12,
-                       in [Optional=CallWithDefaultValue] float m21,
-                       in [Optional=CallWithDefaultValue] float m22,
-                       in [Optional=CallWithDefaultValue] float dx,
-                       in [Optional=CallWithDefaultValue] float dy);
-        void setTransform(in [Optional=CallWithDefaultValue] float m11,
-                          in [Optional=CallWithDefaultValue] float m12,
-                          in [Optional=CallWithDefaultValue] float m21,
-                          in [Optional=CallWithDefaultValue] float m22,
-                          in [Optional=CallWithDefaultValue] float dx,
-                          in [Optional=CallWithDefaultValue] float dy);
+        void scale(in [Optional=DefaultIsUndefined] float sx,
+                   in [Optional=DefaultIsUndefined] float sy);
+        void rotate(in [Optional=DefaultIsUndefined] float angle);
+        void translate(in [Optional=DefaultIsUndefined] float tx,
+                       in [Optional=DefaultIsUndefined] float ty);
+        void transform(in [Optional=DefaultIsUndefined] float m11,
+                       in [Optional=DefaultIsUndefined] float m12,
+                       in [Optional=DefaultIsUndefined] float m21,
+                       in [Optional=DefaultIsUndefined] float m22,
+                       in [Optional=DefaultIsUndefined] float dx,
+                       in [Optional=DefaultIsUndefined] float dy);
+        void setTransform(in [Optional=DefaultIsUndefined] float m11,
+                          in [Optional=DefaultIsUndefined] float m12,
+                          in [Optional=DefaultIsUndefined] float m21,
+                          in [Optional=DefaultIsUndefined] float m22,
+                          in [Optional=DefaultIsUndefined] float dx,
+                          in [Optional=DefaultIsUndefined] float dy);
 
         attribute float globalAlpha;
         attribute [TreatNullAs=NullString] DOMString globalCompositeOperation;
 
-        CanvasGradient createLinearGradient(in [Optional=CallWithDefaultValue] float x0,
-                                            in [Optional=CallWithDefaultValue] float y0,
-                                            in [Optional=CallWithDefaultValue] float x1,
-                                            in [Optional=CallWithDefaultValue] float y1)
+        CanvasGradient createLinearGradient(in [Optional=DefaultIsUndefined] float x0,
+                                            in [Optional=DefaultIsUndefined] float y0,
+                                            in [Optional=DefaultIsUndefined] float x1,
+                                            in [Optional=DefaultIsUndefined] float y1)
             raises (DOMException);
-        CanvasGradient createRadialGradient(in [Optional=CallWithDefaultValue] float x0,
-                                            in [Optional=CallWithDefaultValue] float y0,
-                                            in [Optional=CallWithDefaultValue] float r0,
-                                            in [Optional=CallWithDefaultValue] float x1,
-                                            in [Optional=CallWithDefaultValue] float y1,
-                                            in [Optional=CallWithDefaultValue] float r1)
+        CanvasGradient createRadialGradient(in [Optional=DefaultIsUndefined] float x0,
+                                            in [Optional=DefaultIsUndefined] float y0,
+                                            in [Optional=DefaultIsUndefined] float r0,
+                                            in [Optional=DefaultIsUndefined] float x1,
+                                            in [Optional=DefaultIsUndefined] float y1,
+                                            in [Optional=DefaultIsUndefined] float r1)
             raises (DOMException);
 
         attribute float lineWidth;
@@ -80,71 +80,71 @@ module html {
         attribute float webkitLineDashOffset;
 #endif
 
-        void clearRect(in [Optional=CallWithDefaultValue] float x,
-                       in [Optional=CallWithDefaultValue] float y,
-                       in [Optional=CallWithDefaultValue] float width,
-                       in [Optional=CallWithDefaultValue] float height);
-        void fillRect(in [Optional=CallWithDefaultValue] float x,
-                      in [Optional=CallWithDefaultValue] float y,
-                      in [Optional=CallWithDefaultValue] float width,
-                      in [Optional=CallWithDefaultValue] float height);
+        void clearRect(in [Optional=DefaultIsUndefined] float x,
+                       in [Optional=DefaultIsUndefined] float y,
+                       in [Optional=DefaultIsUndefined] float width,
+                       in [Optional=DefaultIsUndefined] float height);
+        void fillRect(in [Optional=DefaultIsUndefined] float x,
+                      in [Optional=DefaultIsUndefined] float y,
+                      in [Optional=DefaultIsUndefined] float width,
+                      in [Optional=DefaultIsUndefined] float height);
 
         void beginPath();
         void closePath();
-        void moveTo(in [Optional=CallWithDefaultValue] float x,
-                    in [Optional=CallWithDefaultValue] float y);
-        void lineTo(in [Optional=CallWithDefaultValue] float x,
-                    in [Optional=CallWithDefaultValue] float y);
-        void quadraticCurveTo(in [Optional=CallWithDefaultValue] float cpx,
-                              in [Optional=CallWithDefaultValue] float cpy,
-                              in [Optional=CallWithDefaultValue] float x,
-                              in [Optional=CallWithDefaultValue] float y);
-        void bezierCurveTo(in [Optional=CallWithDefaultValue] float cp1x,
-                           in [Optional=CallWithDefaultValue] float cp1y,
-                           in [Optional=CallWithDefaultValue] float cp2x,
-                           in [Optional=CallWithDefaultValue] float cp2y,
-                           in [Optional=CallWithDefaultValue] float x,
-                           in [Optional=CallWithDefaultValue] float y);
-        void arcTo(in [Optional=CallWithDefaultValue] float x1,
-                   in [Optional=CallWithDefaultValue] float y1,
-                   in [Optional=CallWithDefaultValue] float x2,
-                   in [Optional=CallWithDefaultValue] float y2,
-                   in [Optional=CallWithDefaultValue] float radius)
-            raises (DOMException);
-        void rect(in [Optional=CallWithDefaultValue] float x,
-                  in [Optional=CallWithDefaultValue] float y,
-                  in [Optional=CallWithDefaultValue] float width,
-                  in [Optional=CallWithDefaultValue] float height);
-        void arc(in [Optional=CallWithDefaultValue] float x,
-                 in [Optional=CallWithDefaultValue] float y,
-                 in [Optional=CallWithDefaultValue] float radius,
-                 in [Optional=CallWithDefaultValue] float startAngle,
-                 in [Optional=CallWithDefaultValue] float endAngle,
-                 in [Optional=CallWithDefaultValue] boolean anticlockwise)
+        void moveTo(in [Optional=DefaultIsUndefined] float x,
+                    in [Optional=DefaultIsUndefined] float y);
+        void lineTo(in [Optional=DefaultIsUndefined] float x,
+                    in [Optional=DefaultIsUndefined] float y);
+        void quadraticCurveTo(in [Optional=DefaultIsUndefined] float cpx,
+                              in [Optional=DefaultIsUndefined] float cpy,
+                              in [Optional=DefaultIsUndefined] float x,
+                              in [Optional=DefaultIsUndefined] float y);
+        void bezierCurveTo(in [Optional=DefaultIsUndefined] float cp1x,
+                           in [Optional=DefaultIsUndefined] float cp1y,
+                           in [Optional=DefaultIsUndefined] float cp2x,
+                           in [Optional=DefaultIsUndefined] float cp2y,
+                           in [Optional=DefaultIsUndefined] float x,
+                           in [Optional=DefaultIsUndefined] float y);
+        void arcTo(in [Optional=DefaultIsUndefined] float x1,
+                   in [Optional=DefaultIsUndefined] float y1,
+                   in [Optional=DefaultIsUndefined] float x2,
+                   in [Optional=DefaultIsUndefined] float y2,
+                   in [Optional=DefaultIsUndefined] float radius)
+            raises (DOMException);
+        void rect(in [Optional=DefaultIsUndefined] float x,
+                  in [Optional=DefaultIsUndefined] float y,
+                  in [Optional=DefaultIsUndefined] float width,
+                  in [Optional=DefaultIsUndefined] float height);
+        void arc(in [Optional=DefaultIsUndefined] float x,
+                 in [Optional=DefaultIsUndefined] float y,
+                 in [Optional=DefaultIsUndefined] float radius,
+                 in [Optional=DefaultIsUndefined] float startAngle,
+                 in [Optional=DefaultIsUndefined] float endAngle,
+                 in [Optional=DefaultIsUndefined] boolean anticlockwise)
             raises (DOMException);
         void fill();
         void stroke();
         void clip();
-        boolean isPointInPath(in [Optional=CallWithDefaultValue] float x,
-                              in [Optional=CallWithDefaultValue] float y);
+        boolean isPointInPath(in [Optional=DefaultIsUndefined] float x,
+                              in [Optional=DefaultIsUndefined] float y);
 
         // text
         attribute DOMString font;
         attribute DOMString textAlign;
         attribute DOMString textBaseline;
 
-        TextMetrics measureText(in [Optional=CallWithDefaultValue] DOMString text);
+        TextMetrics measureText(in [Optional=DefaultIsUndefined] DOMString text);
 
         // other
 
-        void setAlpha(in [Optional=CallWithDefaultValue] float alpha);
-        void setCompositeOperation(in [Optional=CallWithDefaultValue] DOMString compositeOperation);
+        void setAlpha(in [Optional=DefaultIsUndefined] float alpha);
+        void setCompositeOperation(in [Optional=DefaultIsUndefined] DOMString compositeOperation);
 
 #if !defined(LANGUAGE_CPP) || !LANGUAGE_CPP
-        void setLineWidth(in [Optional=CallWithDefaultValue] float width);
-        void setLineCap(in [Optional=CallWithDefaultValue] DOMString cap);
-        void setLineJoin(in [Optional=CallWithDefaultValue] DOMString join);
-        void setMiterLimit(in [Optional=CallWithDefaultValue] float limit);
+        void setLineWidth(in [Optional=DefaultIsUndefined] float width);
+        void setLineCap(in [Optional=DefaultIsUndefined] DOMString cap);
+        void setLineJoin(in [Optional=DefaultIsUndefined] DOMString join);
+        void setMiterLimit(in [Optional=DefaultIsUndefined] float limit);
 #endif
 
         void clearShadow();
@@ -162,10 +162,10 @@ module html {
         void setFillColor(in float r, in float g, in float b, in float a);
         void setFillColor(in float c, in float m, in float y, in float k, in float a);
 
-        void strokeRect(in [Optional=CallWithDefaultValue] float x,
-                        in [Optional=CallWithDefaultValue] float y,
-                        in [Optional=CallWithDefaultValue] float width,
-                        in [Optional=CallWithDefaultValue] float height,
+        void strokeRect(in [Optional=DefaultIsUndefined] float x,
+                        in [Optional=DefaultIsUndefined] float y,
+                        in [Optional=DefaultIsUndefined] float width,
+                        in [Optional=DefaultIsUndefined] float height,
                         in [Optional] float lineWidth);
 
         void drawImage(in HTMLImageElement image, in float x, in float y)
@@ -217,8 +217,8 @@ module html {
         attribute [Custom] custom fillStyle;
 
         // pixel manipulation
-        ImageData getImageData(in [Optional=CallWithDefaultValue] float sx, in [Optional=CallWithDefaultValue] float sy,
-                               in [Optional=CallWithDefaultValue] float sw, in [Optional=CallWithDefaultValue] float sh)
+        ImageData getImageData(in [Optional=DefaultIsUndefined] float sx, in [Optional=DefaultIsUndefined] float sy,
+                               in [Optional=DefaultIsUndefined] float sw, in [Optional=DefaultIsUndefined] float sh)
             raises(DOMException);
     };
 
diff --git a/Source/WebCore/html/canvas/DOMWindowWebGL.idl b/Source/WebCore/html/canvas/DOMWindowWebGL.idl
new file mode 100644
index 000000000..92056d3da
--- /dev/null
+++ b/Source/WebCore/html/canvas/DOMWindowWebGL.idl
@@ -0,0 +1,37 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ */
+
+module window {
+
+    interface [
+        Conditional=WEBGL,
+        Supplemental=DOMWindow
+    ] DOMWindowWebGL {
+        attribute WebGLActiveInfoConstructor WebGLActiveInfo;
+        attribute WebGLBufferConstructor WebGLBuffer;
+        attribute WebGLFramebufferConstructor WebGLFramebuffer;
+        attribute WebGLProgramConstructor WebGLProgram;
+        attribute WebGLRenderbufferConstructor WebGLRenderbuffer;
+        attribute WebGLRenderingContextConstructor WebGLRenderingContext;
+        attribute WebGLShaderConstructor WebGLShader;
+        attribute WebGLTextureConstructor WebGLTexture;
+        attribute WebGLUniformLocationConstructor WebGLUniformLocation;
+    };
+
+}
diff --git a/Source/WebCore/html/canvas/DataView.idl b/Source/WebCore/html/canvas/DataView.idl
index 9530220dc..27bad0e47 100755
--- a/Source/WebCore/html/canvas/DataView.idl
+++ b/Source/WebCore/html/canvas/DataView.idl
@@ -27,7 +27,7 @@ module html {
 
     interface [
         CustomConstructor,
-        JSCustomToJS,
+        CustomToJSObject,
         JSNoStaticTables
     ] DataView : ArrayBufferView {
         // All these methods raise an exception if they would read or write beyond the end of the view.
diff --git a/Source/WebCore/html/canvas/Float32Array.idl b/Source/WebCore/html/canvas/Float32Array.idl
index 785ed819c..5e619a7ea 100644
--- a/Source/WebCore/html/canvas/Float32Array.idl
+++ b/Source/WebCore/html/canvas/Float32Array.idl
@@ -31,13 +31,13 @@ module html {
         CustomIndexedSetter,
         JSGenerateToNativeObject,
         JSNoStaticTables,
-        JSCustomToJS,
+        CustomToJSObject,
         DoNotCheckConstants
     ] Float32Array : ArrayBufferView {
         const unsigned int BYTES_PER_ELEMENT = 4;
 
         readonly attribute unsigned long length;
-        Float32Array subarray(in [Optional=CallWithDefaultValue] long start, 
+        Float32Array subarray(in [Optional=DefaultIsUndefined] long start, 
                               in [Optional] long end);
 
         // void set(in Float32Array array, [Optional] in unsigned long offset);
diff --git a/Source/WebCore/html/canvas/Float64Array.idl b/Source/WebCore/html/canvas/Float64Array.idl
index 7180811fa..f4c448a45 100644
--- a/Source/WebCore/html/canvas/Float64Array.idl
+++ b/Source/WebCore/html/canvas/Float64Array.idl
@@ -31,13 +31,13 @@ module html {
         CustomIndexedSetter,
         JSGenerateToNativeObject,
         JSNoStaticTables,
-        JSCustomToJS,
+        CustomToJSObject,
         DoNotCheckConstants
     ] Float64Array : ArrayBufferView {
         const unsigned int BYTES_PER_ELEMENT = 8;
 
         readonly attribute unsigned long length;
-        Float64Array subarray(in [Optional=CallWithDefaultValue] long start, 
+        Float64Array subarray(in [Optional=DefaultIsUndefined] long start, 
                               in [Optional] long end);
 
         // void set(in Float64Array array, [Optional] in unsigned long offset);
diff --git a/Source/WebCore/html/canvas/Int16Array.idl b/Source/WebCore/html/canvas/Int16Array.idl
index 40e18d530..b7ddc1e7c 100644
--- a/Source/WebCore/html/canvas/Int16Array.idl
+++ b/Source/WebCore/html/canvas/Int16Array.idl
@@ -30,13 +30,13 @@ module html {
         CustomIndexedSetter,
         JSGenerateToNativeObject,
         JSNoStaticTables,
-        JSCustomToJS,
+        CustomToJSObject,
         DoNotCheckConstants
     ] Int16Array : ArrayBufferView {
         const unsigned int BYTES_PER_ELEMENT = 2;
 
         readonly attribute unsigned long length;
-        Int16Array subarray(in [Optional=CallWithDefaultValue] long start, 
+        Int16Array subarray(in [Optional=DefaultIsUndefined] long start, 
                             in [Optional] long end);
 
         // void set(in Int16Array array, [Optional] in unsigned long offset);
diff --git a/Source/WebCore/html/canvas/Int32Array.idl b/Source/WebCore/html/canvas/Int32Array.idl
index 0f5320ac4..950437aec 100644
--- a/Source/WebCore/html/canvas/Int32Array.idl
+++ b/Source/WebCore/html/canvas/Int32Array.idl
@@ -31,13 +31,13 @@ module html {
         CustomIndexedSetter,
         JSGenerateToNativeObject,
         JSNoStaticTables,
-        JSCustomToJS,
+        CustomToJSObject,
         DoNotCheckConstants
     ] Int32Array : ArrayBufferView {
         const unsigned int BYTES_PER_ELEMENT = 4;
 
         readonly attribute unsigned long length;
-        Int32Array subarray(in [Optional=CallWithDefaultValue] long start, 
+        Int32Array subarray(in [Optional=DefaultIsUndefined] long start, 
                             in [Optional] long end);
 
         // void set(in Int32Array array, [Optional] in unsigned long offset);
diff --git a/Source/WebCore/html/canvas/Int8Array.idl b/Source/WebCore/html/canvas/Int8Array.idl
index 9984ada66..da0c8f166 100644
--- a/Source/WebCore/html/canvas/Int8Array.idl
+++ b/Source/WebCore/html/canvas/Int8Array.idl
@@ -31,13 +31,13 @@ module html {
         CustomIndexedSetter,
         JSGenerateToNativeObject,
         JSNoStaticTables,
-        JSCustomToJS,
+        CustomToJSObject,
         DoNotCheckConstants
     ] Int8Array : ArrayBufferView {
         const unsigned int BYTES_PER_ELEMENT = 1;
 
         readonly attribute unsigned long length;
-        Int8Array subarray(in [Optional=CallWithDefaultValue] long start, 
+        Int8Array subarray(in [Optional=DefaultIsUndefined] long start, 
                            in [Optional] long end);
 
         // void set(in Int8Array array, [Optional] in unsigned long offset);
diff --git a/Source/WebCore/html/canvas/OESVertexArrayObject.idl b/Source/WebCore/html/canvas/OESVertexArrayObject.idl
index c4adf99d8..c3d366676 100644
--- a/Source/WebCore/html/canvas/OESVertexArrayObject.idl
+++ b/Source/WebCore/html/canvas/OESVertexArrayObject.idl
@@ -33,8 +33,8 @@ module html {
         const unsigned int VERTEX_ARRAY_BINDING_OES = 0x85B5;
         
         [StrictTypeChecking] WebGLVertexArrayObjectOES createVertexArrayOES();
-        [StrictTypeChecking] void         deleteVertexArrayOES(in [Optional=CallWithDefaultValue] WebGLVertexArrayObjectOES arrayObject);
-        [StrictTypeChecking] boolean      isVertexArrayOES(in [Optional=CallWithDefaultValue] WebGLVertexArrayObjectOES arrayObject);
-        [StrictTypeChecking] void         bindVertexArrayOES(in [Optional=CallWithDefaultValue] WebGLVertexArrayObjectOES arrayObject) raises(DOMException);
+        [StrictTypeChecking] void         deleteVertexArrayOES(in [Optional=DefaultIsUndefined] WebGLVertexArrayObjectOES arrayObject);
+        [StrictTypeChecking] boolean      isVertexArrayOES(in [Optional=DefaultIsUndefined] WebGLVertexArrayObjectOES arrayObject);
+        [StrictTypeChecking] void         bindVertexArrayOES(in [Optional=DefaultIsUndefined] WebGLVertexArrayObjectOES arrayObject) raises(DOMException);
     };
 }
diff --git a/Source/WebCore/html/canvas/Uint16Array.idl b/Source/WebCore/html/canvas/Uint16Array.idl
index 83877b582..33627bfce 100644
--- a/Source/WebCore/html/canvas/Uint16Array.idl
+++ b/Source/WebCore/html/canvas/Uint16Array.idl
@@ -31,13 +31,13 @@ module html {
         CustomIndexedSetter,
         JSGenerateToNativeObject,
         JSNoStaticTables,
-        JSCustomToJS,
+        CustomToJSObject,
         DoNotCheckConstants
     ] Uint16Array : ArrayBufferView {
         const unsigned int BYTES_PER_ELEMENT = 2;
 
         readonly attribute unsigned long length;
-        Uint16Array subarray(in [Optional=CallWithDefaultValue] long start, in [Optional] long end);
+        Uint16Array subarray(in [Optional=DefaultIsUndefined] long start, in [Optional] long end);
 
         // void set(in Uint16Array array, [Optional] in unsigned long offset);
         // void set(in sequence<long> array, [Optional] in unsigned long offset);
diff --git a/Source/WebCore/html/canvas/Uint32Array.idl b/Source/WebCore/html/canvas/Uint32Array.idl
index 2726473cb..7bb4ca39b 100644
--- a/Source/WebCore/html/canvas/Uint32Array.idl
+++ b/Source/WebCore/html/canvas/Uint32Array.idl
@@ -31,13 +31,13 @@ module html {
         CustomIndexedSetter,
         JSGenerateToNativeObject,
         JSNoStaticTables,
-        JSCustomToJS,
+        CustomToJSObject,
         DoNotCheckConstants
     ] Uint32Array : ArrayBufferView {
         const unsigned int BYTES_PER_ELEMENT = 4;
 
         readonly attribute unsigned long length;
-        Uint32Array subarray(in [Optional=CallWithDefaultValue] long start, in [Optional] long end);
+        Uint32Array subarray(in [Optional=DefaultIsUndefined] long start, in [Optional] long end);
 
         // void set(in Uint32Array array, [Optional] in unsigned long offset);
         // void set(in sequence<long> array, [Optional] in unsigned long offset);
diff --git a/Source/WebCore/html/canvas/Uint8Array.idl b/Source/WebCore/html/canvas/Uint8Array.idl
index 4892da8a8..fbbafc320 100644
--- a/Source/WebCore/html/canvas/Uint8Array.idl
+++ b/Source/WebCore/html/canvas/Uint8Array.idl
@@ -31,13 +31,13 @@ module html {
         CustomIndexedSetter,
         JSGenerateToNativeObject,
         JSNoStaticTables,
-        JSCustomToJS,
+        CustomToJSObject,
         DoNotCheckConstants
     ] Uint8Array : ArrayBufferView {
         const unsigned int BYTES_PER_ELEMENT = 1;
 
         readonly attribute unsigned long length;
-        Uint8Array subarray(in [Optional=CallWithDefaultValue] long start, in [Optional] long end);
+        Uint8Array subarray(in [Optional=DefaultIsUndefined] long start, in [Optional] long end);
 
         // void set(in Uint8Array array, [Optional] in unsigned long offset);
         // void set(in sequence<long> array, [Optional] in unsigned long offset);
diff --git a/Source/WebCore/html/canvas/Uint8ClampedArray.idl b/Source/WebCore/html/canvas/Uint8ClampedArray.idl
index a9a49f362..fd006e455 100644
--- a/Source/WebCore/html/canvas/Uint8ClampedArray.idl
+++ b/Source/WebCore/html/canvas/Uint8ClampedArray.idl
@@ -31,13 +31,13 @@ module html {
         CustomIndexedSetter,
         JSGenerateToNativeObject,
         JSNoStaticTables,
-        JSCustomToJS,
+        CustomToJSObject,
         DoNotCheckConstants
     ] Uint8ClampedArray : Uint8Array {
         const unsigned int BYTES_PER_ELEMENT = 1;
 
         readonly attribute unsigned long length;
-        Uint8ClampedArray subarray(in [Optional=CallWithDefaultValue] long start, in [Optional] long end);
+        Uint8ClampedArray subarray(in [Optional=DefaultIsUndefined] long start, in [Optional] long end);
 
         // FIXME: Missing other setters!
         // void set(in Uint8ClampedArray array, [Optional] in unsigned long offset);
diff --git a/Source/WebCore/html/canvas/WebGLDebugShaders.idl b/Source/WebCore/html/canvas/WebGLDebugShaders.idl
index 82d047550..ee330b6ae 100644
--- a/Source/WebCore/html/canvas/WebGLDebugShaders.idl
+++ b/Source/WebCore/html/canvas/WebGLDebugShaders.idl
@@ -29,6 +29,6 @@ module html {
         JSGenerateIsReachable=ImplContext,
         OmitConstructor
     ] WebGLDebugShaders {
-        [StrictTypeChecking, ConvertNullStringTo=Null] DOMString getTranslatedShaderSource(in WebGLShader shader) raises(DOMException);
+        [StrictTypeChecking, TreatReturnedNullStringAs=Null] DOMString getTranslatedShaderSource(in WebGLShader shader) raises(DOMException);
     };
 }
diff --git a/Source/WebCore/html/canvas/WebGLRenderingContext.cpp b/Source/WebCore/html/canvas/WebGLRenderingContext.cpp
index 9a5a295b5..cfb6505a9 100644
--- a/Source/WebCore/html/canvas/WebGLRenderingContext.cpp
+++ b/Source/WebCore/html/canvas/WebGLRenderingContext.cpp
@@ -719,11 +719,6 @@ PassRefPtr<ImageData> WebGLRenderingContext::paintRenderingResultsToImageData()
     return imageData;
 }
 
-bool WebGLRenderingContext::paintsIntoCanvasBuffer() const
-{
-    return m_context->paintsIntoCanvasBuffer();
-}
-
 void WebGLRenderingContext::reshape(int width, int height)
 {
     // This is an approximation because at WebGLRenderingContext level we don't
@@ -4890,7 +4885,21 @@ bool WebGLRenderingContext::validateStencilFunc(const char* functionName, GC3Den
 
 void WebGLRenderingContext::printWarningToConsole(const String& message)
 {
-    canvas()->document()->frame()->domWindow()->console()->addMessage(HTMLMessageSource, LogMessageType, WarningMessageLevel, message, canvas()->document()->url().string());
+    if (!canvas())
+        return;
+    Document* document = canvas()->document();
+    if (!document)
+        return;
+    Frame* frame = document->frame();
+    if (!frame)
+        return;
+    DOMWindow* window = frame->domWindow();
+    if (!window)
+        return;
+    Console* console = window->console();
+    if (!console)
+        return;
+    console->addMessage(HTMLMessageSource, LogMessageType, WarningMessageLevel, message, document->url().string());
 }
 
 bool WebGLRenderingContext::validateFramebufferFuncParameters(const char* functionName, GC3Denum target, GC3Denum attachment)
diff --git a/Source/WebCore/html/canvas/WebGLRenderingContext.h b/Source/WebCore/html/canvas/WebGLRenderingContext.h
index 0449eade1..be9c8cf3c 100644
--- a/Source/WebCore/html/canvas/WebGLRenderingContext.h
+++ b/Source/WebCore/html/canvas/WebGLRenderingContext.h
@@ -77,7 +77,6 @@ public:
 
     virtual bool is3d() const { return true; }
     virtual bool isAccelerated() const { return true; }
-    virtual bool paintsIntoCanvasBuffer() const;
 
     int drawingBufferWidth() const;
     int drawingBufferHeight() const;
diff --git a/Source/WebCore/html/canvas/WebGLRenderingContext.idl b/Source/WebCore/html/canvas/WebGLRenderingContext.idl
index 6db811dd8..3aed43643 100644
--- a/Source/WebCore/html/canvas/WebGLRenderingContext.idl
+++ b/Source/WebCore/html/canvas/WebGLRenderingContext.idl
@@ -542,18 +542,18 @@ module html {
         [StrictTypeChecking, Custom] void getParameter();
         // any getProgramParameter(in WebGLProgram program, in unsigned long pname) raises(DOMException);
         [StrictTypeChecking, Custom] void getProgramParameter();
-        [StrictTypeChecking, ConvertNullStringTo=Null] DOMString getProgramInfoLog(in WebGLProgram program) raises(DOMException);
+        [StrictTypeChecking, TreatReturnedNullStringAs=Null] DOMString getProgramInfoLog(in WebGLProgram program) raises(DOMException);
         // any getRenderbufferParameter(in unsigned long target, in unsigned long pname) raises(DOMException);
         [StrictTypeChecking, Custom] void getRenderbufferParameter();
         // any getShaderParameter(in WebGLShader shader, in unsigned long pname) raises(DOMException);
         [StrictTypeChecking, Custom] void getShaderParameter() raises(DOMException);
 
-        [StrictTypeChecking, ConvertNullStringTo=Null] DOMString    getShaderInfoLog(in WebGLShader shader) raises(DOMException);
+        [StrictTypeChecking, TreatReturnedNullStringAs=Null] DOMString    getShaderInfoLog(in WebGLShader shader) raises(DOMException);
 
         // TBD
         // void glGetShaderPrecisionFormat (GLenum shadertype, GLenum precisiontype, GLint* range, GLint* precision);
 
-        [StrictTypeChecking, ConvertNullStringTo=Null] DOMString    getShaderSource(in WebGLShader shader) raises(DOMException);
+        [StrictTypeChecking, TreatReturnedNullStringAs=Null] DOMString    getShaderSource(in WebGLShader shader) raises(DOMException);
 
         // DOMString[] getSupportedExtensions()
         [StrictTypeChecking, Custom] void getSupportedExtensions();
diff --git a/Source/WebCore/html/parser/HTMLElementStack.cpp b/Source/WebCore/html/parser/HTMLElementStack.cpp
index 98885743e..9cc3a0316 100644
--- a/Source/WebCore/html/parser/HTMLElementStack.cpp
+++ b/Source/WebCore/html/parser/HTMLElementStack.cpp
@@ -53,7 +53,6 @@ inline bool isNumberedHeaderElement(ContainerNode* node)
 inline bool isRootNode(ContainerNode* node)
 {
     return node->nodeType() == Node::DOCUMENT_FRAGMENT_NODE
-        || node->nodeType() == Node::SHADOW_ROOT_NODE
         || node->hasTagName(htmlTag);
 }
 
@@ -310,7 +309,7 @@ void HTMLElementStack::popUntilForeignContentScopeMarker()
     
 void HTMLElementStack::pushRootNode(PassRefPtr<ContainerNode> rootNode)
 {
-    ASSERT(rootNode->nodeType() == Node::DOCUMENT_FRAGMENT_NODE || rootNode->nodeType() == Node::SHADOW_ROOT_NODE);
+    ASSERT(rootNode->nodeType() == Node::DOCUMENT_FRAGMENT_NODE);
     pushRootNodeCommon(rootNode);
 }
 
diff --git a/Source/WebCore/html/parser/HTMLElementStack.h b/Source/WebCore/html/parser/HTMLElementStack.h
index f604f82c7..5697e80c8 100644
--- a/Source/WebCore/html/parser/HTMLElementStack.h
+++ b/Source/WebCore/html/parser/HTMLElementStack.h
@@ -180,8 +180,7 @@ inline bool isInHTMLNamespace(Node* node)
     // A DocumentFragment takes the place of the document element when parsing
     // fragments and should be considered in the HTML namespace.
     return node->namespaceURI() == HTMLNames::xhtmlNamespaceURI
-        || node->nodeType() == Node::DOCUMENT_FRAGMENT_NODE
-        || node->nodeType() == Node::SHADOW_ROOT_NODE; // FIXME: Does this also apply to ShadowRoot?
+        || node->nodeType() == Node::DOCUMENT_FRAGMENT_NODE; // FIXME: Does this also apply to ShadowRoot?
 }
 
 
diff --git a/Source/WebCore/html/parser/HTMLTreeBuilder.cpp b/Source/WebCore/html/parser/HTMLTreeBuilder.cpp
index 9d839120d..3b5414913 100644
--- a/Source/WebCore/html/parser/HTMLTreeBuilder.cpp
+++ b/Source/WebCore/html/parser/HTMLTreeBuilder.cpp
@@ -586,10 +586,8 @@ void HTMLTreeBuilder::processIsindexStartTagForInBody(AtomicHTMLToken& token)
     notImplemented(); // Acknowledge self-closing flag
     processFakeStartTag(formTag);
     RefPtr<Attribute> actionAttribute = token.getAttributeItem(actionAttr);
-    if (actionAttribute) {
-        ASSERT(m_tree.currentElement()->hasTagName(formTag));
-        m_tree.currentElement()->setAttribute(actionAttr, actionAttribute->value());
-    }
+    if (actionAttribute)
+        m_tree.form()->setAttribute(actionAttr, actionAttribute->value());
     processFakeStartTag(hrTag);
     processFakeStartTag(labelTag);
     RefPtr<Attribute> promptAttribute = token.getAttributeItem(promptAttr);
diff --git a/Source/WebCore/html/parser/XSSAuditor.cpp b/Source/WebCore/html/parser/XSSAuditor.cpp
index 138a67118..8fde1a5d7 100644
--- a/Source/WebCore/html/parser/XSSAuditor.cpp
+++ b/Source/WebCore/html/parser/XSSAuditor.cpp
@@ -36,6 +36,7 @@
 #include "FrameLoaderClient.h"
 #include "HTMLDocumentParser.h"
 #include "HTMLNames.h"
+#include "HTMLTokenizer.h"
 #include "HTMLParamElement.h"
 #include "HTMLParserIdioms.h"
 #include "SecurityOrigin.h"
@@ -54,7 +55,7 @@ static bool isNonCanonicalCharacter(UChar c)
     // We remove all non-ASCII characters, including non-printable ASCII characters.
     //
     // Note, we don't remove backslashes like PHP stripslashes(), which among other things converts "\\0" to the \0 character.
-    // Instead, we remove backslashes and zeros (since the string "\\0" =(remove backslashes)=> "0"). However, this has the 
+    // Instead, we remove backslashes and zeros (since the string "\\0" =(remove backslashes)=> "0"). However, this has the
     // adverse effect that we remove any legitimate zeros from a string.
     //
     // For instance: new String("http://localhost:8000") => new String("http://localhost:8").
@@ -71,7 +72,7 @@ static bool isRequiredForInjection(UChar c)
     return (c == '\'' || c == '"' || c == '<' || c == '>');
 }
 
-static bool isTerminatingCharacter(UChar c) 
+static bool isTerminatingCharacter(UChar c)
 {
     return (c == '&' || c == '/' || c == '"' || c == '\'' || c == '<');
 }
@@ -81,26 +82,21 @@ static bool isHTMLQuote(UChar c)
     return (c == '"' || c == '\'');
 }
 
-static bool isHTMLNewline(UChar c)
+static bool isJSNewline(UChar c)
 {
-    return (c == '\n' || c == '\r');
+    // Per ecma-262 section 7.3 Line Terminators.
+    return (c == '\n' || c == '\r' || c == 0x2028 || c == 0x2029);
 }
 
-static bool startsHTMLEndTagAt(const String& string, size_t start)
-{
-    return (start + 1 < string.length() && string[start] == '<' && string[start+1] == '/');
-}    
-
-
 static bool startsHTMLCommentAt(const String& string, size_t start)
 {
     return (start + 3 < string.length() && string[start] == '<' && string[start+1] == '!' && string[start+2] == '-' && string[start+3] == '-');
-}    
+}
 
 static bool startsSingleLineCommentAt(const String& string, size_t start)
 {
     return (start + 1 < string.length() && string[start] == '/' && string[start+1] == '/');
-}    
+}
 
 static bool startsMultiLineCommentAt(const String& string, size_t start)
 {
@@ -137,23 +133,6 @@ static bool isDangerousHTTPEquiv(const String& value)
     return equalIgnoringCase(equiv, "refresh") || equalIgnoringCase(equiv, "set-cookie");
 }
 
-static bool containsJavaScriptURL(const Vector<UChar, 32>& value)
-{
-    static const char javaScriptScheme[] = "javascript:";
-    static const size_t lengthOfJavaScriptScheme = sizeof(javaScriptScheme) - 1;
-
-    size_t i;
-    for (i = 0; i < value.size(); ++i) {
-        if (!isHTMLSpace(value[i]))
-            break;
-    }
-
-    if (value.size() - i < lengthOfJavaScriptScheme)
-        return false;
-
-    return equalIgnoringCase(value.data() + i, javaScriptScheme, lengthOfJavaScriptScheme);
-}
-
 static inline String decode16BitUnicodeEscapeSequences(const String& string)
 {
     // Note, the encoding is ignored since each %u-escape sequence represents a UTF-16 code unit.
@@ -176,7 +155,6 @@ static String fullyDecodeString(const String& string, const TextResourceDecoder*
         oldWorkingStringLength = workingString.length();
         workingString = decode16BitUnicodeEscapeSequences(decodeStandardURLEscapeSequences(workingString, encoding));
     } while (workingString.length() < oldWorkingStringLength);
-    ASSERT(!workingString.isEmpty());
     workingString.replace('+', ' ');
     workingString = canonicalize(workingString);
     return workingString;
@@ -187,6 +165,8 @@ XSSAuditor::XSSAuditor(HTMLDocumentParser* parser)
     , m_isEnabled(false)
     , m_xssProtection(XSSProtectionEnabled)
     , m_state(Uninitialized)
+    , m_shouldAllowCDATA(false)
+    , m_scriptTagNestingLevel(0)
     , m_notifiedClient(false)
 {
     ASSERT(m_parser);
@@ -204,7 +184,7 @@ void XSSAuditor::init()
     const int suffixTreeDepth = 5;
 
     ASSERT(m_state == Uninitialized);
-    m_state = Initial;
+    m_state = Initialized;
 
     if (!m_isEnabled)
         return;
@@ -257,28 +237,21 @@ void XSSAuditor::init()
 
 void XSSAuditor::filterToken(HTMLToken& token)
 {
-    if (m_state == Uninitialized) {
+    if (m_state == Uninitialized)
         init();
-        ASSERT(m_state == Initial);
-    }
-
+   
+    ASSERT(m_state == Initialized);
     if (!m_isEnabled || m_xssProtection == XSSProtectionDisabled)
         return;
 
     bool didBlockScript = false;
-
-    switch (m_state) {
-    case Uninitialized:
-        ASSERT_NOT_REACHED();
-        break;
-    case Initial:
-        didBlockScript = filterTokenInitial(token);
-        break;
-    case AfterScriptStartTag:
-        didBlockScript = filterTokenAfterScriptStartTag(token);
-        ASSERT(m_state == Initial);
-        m_cachedSnippet = String();
-        break;
+    if (token.type() == HTMLTokenTypes::StartTag)
+        didBlockScript = filterStartToken(token);
+    else if (m_scriptTagNestingLevel) {
+        if (token.type() == HTMLTokenTypes::Character)
+            didBlockScript = filterCharacterToken(token);
+        else if (token.type() == HTMLTokenTypes::EndTag)
+            filterEndToken(token);
     }
 
     if (didBlockScript) {
@@ -300,18 +273,15 @@ void XSSAuditor::filterToken(HTMLToken& token)
     }
 }
 
-bool XSSAuditor::filterTokenInitial(HTMLToken& token)
+bool XSSAuditor::filterStartToken(HTMLToken& token)
 {
-    ASSERT(m_state == Initial);
-
-    if (token.type() != HTMLTokenTypes::StartTag)
-        return false;
-
     bool didBlockScript = eraseDangerousAttributesIfInjected(token);
 
-    if (hasName(token, scriptTag))
+    if (hasName(token, scriptTag)) {
         didBlockScript |= filterScriptToken(token);
-    else if (hasName(token, objectTag))
+        ASSERT(m_shouldAllowCDATA || !m_scriptTagNestingLevel);
+        m_scriptTagNestingLevel++;
+    } else if (hasName(token, objectTag))
         didBlockScript |= filterObjectToken(token);
     else if (hasName(token, paramTag))
         didBlockScript |= filterParamToken(token);
@@ -331,16 +301,18 @@ bool XSSAuditor::filterTokenInitial(HTMLToken& token)
     return didBlockScript;
 }
 
-bool XSSAuditor::filterTokenAfterScriptStartTag(HTMLToken& token)
+void XSSAuditor::filterEndToken(HTMLToken& token)
 {
-    ASSERT(m_state == AfterScriptStartTag);
-    m_state = Initial;
-
-    if (token.type() != HTMLTokenTypes::Character) {
-        ASSERT(token.type() == HTMLTokenTypes::EndTag || token.type() == HTMLTokenTypes::EndOfFile);
-        return false;
+    ASSERT(m_scriptTagNestingLevel);
+    if (hasName(token, scriptTag)) {
+        m_scriptTagNestingLevel--;
+        ASSERT(m_shouldAllowCDATA || !m_scriptTagNestingLevel);
     }
+}
 
+bool XSSAuditor::filterCharacterToken(HTMLToken& token)
+{
+    ASSERT(m_scriptTagNestingLevel);
     TextResourceDecoder* decoder = m_parser->document()->decoder();
     if (isContainedInRequest(fullyDecodeString(m_cachedSnippet, decoder))) {
         int start = 0;
@@ -357,21 +329,19 @@ bool XSSAuditor::filterTokenAfterScriptStartTag(HTMLToken& token)
 
 bool XSSAuditor::filterScriptToken(HTMLToken& token)
 {
-    ASSERT(m_state == Initial);
     ASSERT(token.type() == HTMLTokenTypes::StartTag);
     ASSERT(hasName(token, scriptTag));
 
     if (eraseAttributeIfInjected(token, srcAttr, blankURL().string(), SrcLikeAttribute))
         return true;
 
-    m_state = AfterScriptStartTag;
     m_cachedSnippet = m_parser->sourceForToken(token);
+    m_shouldAllowCDATA = m_parser->tokenizer()->shouldAllowCDATA();
     return false;
 }
 
 bool XSSAuditor::filterObjectToken(HTMLToken& token)
 {
-    ASSERT(m_state == Initial);
     ASSERT(token.type() == HTMLTokenTypes::StartTag);
     ASSERT(hasName(token, objectTag));
 
@@ -386,7 +356,6 @@ bool XSSAuditor::filterObjectToken(HTMLToken& token)
 
 bool XSSAuditor::filterParamToken(HTMLToken& token)
 {
-    ASSERT(m_state == Initial);
     ASSERT(token.type() == HTMLTokenTypes::StartTag);
     ASSERT(hasName(token, paramTag));
 
@@ -405,7 +374,6 @@ bool XSSAuditor::filterParamToken(HTMLToken& token)
 
 bool XSSAuditor::filterEmbedToken(HTMLToken& token)
 {
-    ASSERT(m_state == Initial);
     ASSERT(token.type() == HTMLTokenTypes::StartTag);
     ASSERT(hasName(token, embedTag));
 
@@ -420,7 +388,6 @@ bool XSSAuditor::filterEmbedToken(HTMLToken& token)
 
 bool XSSAuditor::filterAppletToken(HTMLToken& token)
 {
-    ASSERT(m_state == Initial);
     ASSERT(token.type() == HTMLTokenTypes::StartTag);
     ASSERT(hasName(token, appletTag));
 
@@ -434,7 +401,6 @@ bool XSSAuditor::filterAppletToken(HTMLToken& token)
 
 bool XSSAuditor::filterIframeToken(HTMLToken& token)
 {
-    ASSERT(m_state == Initial);
     ASSERT(token.type() == HTMLTokenTypes::StartTag);
     ASSERT(hasName(token, iframeTag));
 
@@ -443,7 +409,6 @@ bool XSSAuditor::filterIframeToken(HTMLToken& token)
 
 bool XSSAuditor::filterMetaToken(HTMLToken& token)
 {
-    ASSERT(m_state == Initial);
     ASSERT(token.type() == HTMLTokenTypes::StartTag);
     ASSERT(hasName(token, metaTag));
 
@@ -452,7 +417,6 @@ bool XSSAuditor::filterMetaToken(HTMLToken& token)
 
 bool XSSAuditor::filterBaseToken(HTMLToken& token)
 {
-    ASSERT(m_state == Initial);
     ASSERT(token.type() == HTMLTokenTypes::StartTag);
     ASSERT(hasName(token, baseTag));
 
@@ -461,7 +425,6 @@ bool XSSAuditor::filterBaseToken(HTMLToken& token)
 
 bool XSSAuditor::filterFormToken(HTMLToken& token)
 {
-    ASSERT(m_state == Initial);
     ASSERT(token.type() == HTMLTokenTypes::StartTag);
     ASSERT(hasName(token, formTag));
 
@@ -476,7 +439,7 @@ bool XSSAuditor::eraseDangerousAttributesIfInjected(HTMLToken& token)
     for (size_t i = 0; i < token.attributes().size(); ++i) {
         const HTMLToken::Attribute& attribute = token.attributes().at(i);
         bool isInlineEventHandler = isNameOfInlineEventHandler(attribute.m_name);
-        bool valueContainsJavaScriptURL = isInlineEventHandler ? false : containsJavaScriptURL(attribute.m_value);
+        bool valueContainsJavaScriptURL = !isInlineEventHandler && protocolIsJavaScript(stripLeadingAndTrailingHTMLSpaces(String(attribute.m_value.data(), attribute.m_value.size())));
         if (!isInlineEventHandler && !valueContainsJavaScriptURL)
             continue;
         // Beware of trailing characters which came from the page itself, not the 
@@ -540,8 +503,6 @@ String XSSAuditor::snippetForRange(const HTMLToken& token, int start, int end)
 
 String XSSAuditor::decodedSnippetForAttribute(const HTMLToken& token, const HTMLToken::Attribute& attribute, AttributeKind treatment)
 {
-    const size_t kMaximumSnippetLength = 100;
-
     // The range doesn't inlcude the character which terminates the value. So,
     // for an input of |name="value"|, the snippet is |name="value|. For an
     // unquoted input of |name=value |, the snippet is |name=value|.
@@ -549,7 +510,7 @@ String XSSAuditor::decodedSnippetForAttribute(const HTMLToken& token, const HTML
     int start = attribute.m_nameRange.m_start - token.startIndex();
     int end = attribute.m_valueRange.m_end - token.startIndex();
     String decodedSnippet = fullyDecodeString(snippetForRange(token, start, end), m_parser->document()->decoder());
-    decodedSnippet.truncate(kMaximumSnippetLength);
+    decodedSnippet.truncate(kMaximumFragmentLengthTarget);
     if (treatment == SrcLikeAttribute) {
         int slashCount;
         size_t currentLength;
@@ -592,8 +553,6 @@ bool XSSAuditor::isSameOriginResource(const String& url)
 
 String XSSAuditor::snippetForJavaScript(const String& string)
 {
-    const size_t kMaximumFragmentLengthTarget = 100;
-
     size_t startPosition = 0;
     size_t endPosition = string.length();
     size_t foundPosition = notFound;
@@ -602,8 +561,17 @@ String XSSAuditor::snippetForJavaScript(const String& string)
     while (startPosition < endPosition) {
         while (startPosition < endPosition && isHTMLSpace(string[startPosition]))
             startPosition++;
+
+        // Under SVG/XML rules, only HTML comment syntax matters and the parser returns
+        // these as a separate comment tokens. Having consumed whitespace, we need not look
+        // further for these.
+        if (m_shouldAllowCDATA)
+            break;
+
+        // Under HTML rules, both the HTML and JS comment synatx matters, and the HTML
+        // comment ends at the end of the line, not with -->.
         if (startsHTMLCommentAt(string, startPosition) || startsSingleLineCommentAt(string, startPosition)) {
-            while (startPosition < endPosition && !isHTMLNewline(string[startPosition]))
+            while (startPosition < endPosition && !isJSNewline(string[startPosition]))
                 startPosition++;
         } else if (startsMultiLineCommentAt(string, startPosition)) {
             if ((foundPosition = string.find("*/", startPosition)) != notFound)
@@ -614,29 +582,29 @@ String XSSAuditor::snippetForJavaScript(const String& string)
             break;
     }
 
-    // Stop at next comment, or at a closing script tag (which may have been included with
-    // the code fragment because of buffering in the HTMLSourceTracker), or when we exceed
-    // the maximum length target. After hitting the length target, we can only stop at a
-    // point where we know we are not in the middle of a %-escape sequence. For the sake of
-    // simplicity, approximate stopping at a close script tag by stopping at any close tag,
-    // and approximate not stopping inside a (possibly multiply encoded) %-esacpe sequence
-    // by breaking on whitespace only. We should have enough text in these cases to avoid
-    // false positives.
+    // Stop at next comment (using the same rules as above for SVG/XML vs HTML), or when
+    // we exceed the maximum length target. After hitting the length target, we can only
+    // stop at a point where we know we are not in the middle of a %-escape sequence. For
+    // the sake of simplicity, approximate not stopping inside a (possibly multiply encoded)
+    // %-esacpe sequence by breaking on whitespace only. We should have enough text in
+    // these cases to avoid false positives.
     for (foundPosition = startPosition; foundPosition < endPosition; foundPosition++) {
-        if (startsSingleLineCommentAt(string, foundPosition) || startsMultiLineCommentAt(string, foundPosition) || startsHTMLEndTagAt(string, foundPosition)) {
-            endPosition = foundPosition + 2;
-            break;
-        }
-        if (startsHTMLCommentAt(string, foundPosition)) {
-            endPosition = foundPosition + 4;
-            break;
+        if (!m_shouldAllowCDATA) {
+            if (startsSingleLineCommentAt(string, foundPosition) || startsMultiLineCommentAt(string, foundPosition)) {
+                endPosition = foundPosition + 2;
+                break;
+            }
+            if (startsHTMLCommentAt(string, foundPosition)) {
+                endPosition = foundPosition + 4;
+                break;
+            }
         }
         if (foundPosition > startPosition + kMaximumFragmentLengthTarget && isHTMLSpace(string[foundPosition])) {
             endPosition = foundPosition;
             break;
         }
     }
-    
+
     return string.substring(startPosition, endPosition - startPosition);
 }
 
diff --git a/Source/WebCore/html/parser/XSSAuditor.h b/Source/WebCore/html/parser/XSSAuditor.h
index 89b7b8c65..713cd0b6f 100644
--- a/Source/WebCore/html/parser/XSSAuditor.h
+++ b/Source/WebCore/html/parser/XSSAuditor.h
@@ -42,10 +42,11 @@ public:
     void filterToken(HTMLToken&);
 
 private:
+    static const size_t kMaximumFragmentLengthTarget = 100;
+
     enum State {
         Uninitialized,
-        Initial,
-        AfterScriptStartTag,
+        Initialized
     };
 
     enum AttributeKind {
@@ -55,9 +56,9 @@ private:
 
     void init();
 
-    bool filterTokenInitial(HTMLToken&);
-    bool filterTokenAfterScriptStartTag(HTMLToken&);
-
+    bool filterStartToken(HTMLToken&);
+    void filterEndToken(HTMLToken&);
+    bool filterCharacterToken(HTMLToken&);
     bool filterScriptToken(HTMLToken&);
     bool filterObjectToken(HTMLToken&);
     bool filterParamToken(HTMLToken&);
@@ -88,6 +89,8 @@ private:
 
     State m_state;
     String m_cachedSnippet;
+    bool m_shouldAllowCDATA;
+    unsigned m_scriptTagNestingLevel;
     bool m_notifiedClient;
 };
 
diff --git a/Source/WebCore/html/shadow/ContentInclusionSelector.h b/Source/WebCore/html/shadow/ContentInclusionSelector.h
deleted file mode 100644
index 0f0b1978e..000000000
--- a/Source/WebCore/html/shadow/ContentInclusionSelector.h
+++ /dev/null
@@ -1,150 +0,0 @@
-/*
- * Copyright (C) 2011 Google Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions are
- * met:
- *
- *     * Redistributions of source code must retain the above copyright
- * notice, this list of conditions and the following disclaimer.
- *     * Redistributions in binary form must reproduce the above
- * copyright notice, this list of conditions and the following disclaimer
- * in the documentation and/or other materials provided with the
- * distribution.
- *     * Neither the name of Google Inc. nor the names of its
- * contributors may be used to endorse or promote products derived from
- * this software without specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
- * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
- * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
- * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
- * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
- * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#ifndef ContentInclusionSelector_h
-#define ContentInclusionSelector_h
-
-#include <wtf/Forward.h>
-#include <wtf/HashSet.h>
-#include <wtf/RefCounted.h>
-#include <wtf/Vector.h>
-
-namespace WebCore {
-
-class Element;
-class HTMLContentElement;
-class Node;
-class ShadowRoot;
-
-class ShadowInclusion : public RefCounted<ShadowInclusion> {
-public:
-    static PassRefPtr<ShadowInclusion> create(HTMLContentElement*, Node*);
-
-    HTMLContentElement* includer() const { return m_includer; }
-    Node* content() const { return m_content.get(); }
-    ShadowInclusion* next() const { return m_next.get(); }
-    ShadowInclusion* previous() const { return m_previous.get(); }
-
-    void append(PassRefPtr<ShadowInclusion>);
-    void unlink();
-
-private:
-    ShadowInclusion(HTMLContentElement*, Node*);
-
-    HTMLContentElement* m_includer;
-    RefPtr<Node> m_content;
-    RefPtr<ShadowInclusion> m_next;
-    RefPtr<ShadowInclusion> m_previous;
-};
-
-inline ShadowInclusion::ShadowInclusion(HTMLContentElement* includer, Node* content)
-    : m_includer(includer), m_content(content)
-{ }
-
-inline PassRefPtr<ShadowInclusion> ShadowInclusion::create(HTMLContentElement* includer, Node* content)
-{
-    return adoptRef(new ShadowInclusion(includer, content));
-}
-
-class ShadowInclusionList {
-public:
-    ShadowInclusionList();
-    ~ShadowInclusionList();
-
-    ShadowInclusion* first() const { return m_first.get(); }
-    ShadowInclusion* last() const { return m_last.get(); }
-    ShadowInclusion* find(Node*) const;
-    bool isEmpty() const { return !m_first; }
-
-    void clear();
-    void append(PassRefPtr<ShadowInclusion>);
-
-private:
-    RefPtr<ShadowInclusion> m_first;
-    RefPtr<ShadowInclusion> m_last;
-};
-
-
-class ShadowInclusionSet {
-public:
-    void add(ShadowInclusion* value) { m_set.add(value); }
-    void remove(ShadowInclusion* value) { m_set.remove(value); }
-    bool isEmpty() const { return m_set.isEmpty(); }
-    ShadowInclusion* find(Node* key) const;
-
-private:
-    struct Translator {
-    public:
-        static unsigned hash(const Node* key) { return PtrHash<const Node*>::hash(key); }
-        static bool equal(const ShadowInclusion* inclusion, const Node* content) { return inclusion->content() == content; }
-    };
-
-    struct Hash {
-        static unsigned hash(ShadowInclusion* key) { return PtrHash<const Node*>::hash(key->content()); }
-        static bool equal(ShadowInclusion* a, ShadowInclusion* b) { return a->content() == b->content(); }
-        static const bool safeToCompareToEmptyOrDeleted = false;
-    };
-
-    typedef HashSet<ShadowInclusion*, Hash> PointerSet;
-
-    PointerSet m_set;
-};
-
-inline ShadowInclusion* ShadowInclusionSet::find(Node* key) const
-{
-    PointerSet::iterator found = m_set.find<Node*, ShadowInclusionSet::Translator>(key);
-    return found != m_set.end() ? *found : 0;
-}
-
-class ContentInclusionSelector {
-    WTF_MAKE_NONCOPYABLE(ContentInclusionSelector);
-public:
-    ContentInclusionSelector();
-    ~ContentInclusionSelector();
-
-    void select(HTMLContentElement*, ShadowInclusionList*);
-    void unselect(ShadowInclusionList*);
-    ShadowInclusion* findFor(Node* key) const;
-
-    void willSelectOver(ShadowRoot*);
-    void didSelect();
-    bool hasCandidates() const { return !m_candidates.isEmpty(); }
-
-private:
-    void removeFromSet(ShadowInclusionList*);
-    void addToSet(ShadowInclusionList*);
-
-    Vector<RefPtr<Node> > m_candidates;
-    ShadowInclusionSet m_inclusionSet;
-};
-
-}
-
-#endif
diff --git a/Source/WebCore/html/shadow/HTMLContentElement.cpp b/Source/WebCore/html/shadow/HTMLContentElement.cpp
index 961dd1d30..989acaee6 100644
--- a/Source/WebCore/html/shadow/HTMLContentElement.cpp
+++ b/Source/WebCore/html/shadow/HTMLContentElement.cpp
@@ -27,11 +27,12 @@
 #include "config.h"
 #include "HTMLContentElement.h"
 
-#include "ContentInclusionSelector.h"
 #include "ContentSelectorQuery.h"
+#include "HTMLContentSelector.h"
 #include "HTMLNames.h"
 #include "QualifiedName.h"
 #include "ShadowRoot.h"
+#include "ShadowRootList.h"
 #include <wtf/StdLibExtras.h>
 
 namespace WebCore {
@@ -59,8 +60,7 @@ PassRefPtr<HTMLContentElement> HTMLContentElement::create(const QualifiedName& t
 }
 
 HTMLContentElement::HTMLContentElement(const QualifiedName& name, Document* document)
-    : HTMLElement(name, document)
-    , m_inclusions(adoptPtr(new ShadowInclusionList()))
+    : InsertionPoint(name, document)
 {
 }
 
@@ -74,32 +74,32 @@ void HTMLContentElement::attach()
 
     // Before calling StyledElement::attach, selector must be calculated.
     if (root) {
-        ContentInclusionSelector* selector = root->ensureInclusions();
-        selector->unselect(m_inclusions.get());
-        selector->select(this, m_inclusions.get());
+        HTMLContentSelector* selector = root->list()->ensureSelector();
+        selector->unselect(&m_selections);
+        selector->select(this, &m_selections);
     }
 
-    HTMLElement::attach();
+    InsertionPoint::attach();
 
     if (root) {
-        for (ShadowInclusion* inclusion = m_inclusions->first(); inclusion; inclusion = inclusion->next())
-            inclusion->content()->attach();
+        for (HTMLContentSelection* selection = m_selections.first(); selection; selection = selection->next())
+            selection->node()->attach();
     }
 }
 
 void HTMLContentElement::detach()
 {
     if (ShadowRoot* root = toShadowRoot(shadowTreeRootNode())) {
-        if (ContentInclusionSelector* selector = root->inclusions())
-            selector->unselect(m_inclusions.get());
+        if (HTMLContentSelector* selector = root->list()->selector())
+            selector->unselect(&m_selections);
 
-        // When content element is detached, shadow tree should be recreated to re-calculate inclusions for
+        // When content element is detached, shadow tree should be recreated to re-calculate selector for
         // other content elements.
-        root->setNeedsReattachHostChildrenAndShadow();
+        root->list()->setNeedsReattachHostChildrenAndShadow();
     }
 
-    ASSERT(m_inclusions->isEmpty());
-    HTMLElement::detach();
+    ASSERT(m_selections.isEmpty());
+    InsertionPoint::detach();
 }
 
 const AtomicString& HTMLContentElement::select() const
@@ -122,9 +122,9 @@ void HTMLContentElement::parseAttribute(Attribute* attr)
 {
     if (attr->name() == selectAttr) {
         if (ShadowRoot* root = toShadowRoot(shadowTreeRootNode()))
-            root->setNeedsReattachHostChildrenAndShadow();
+            root->list()->setNeedsReattachHostChildrenAndShadow();
     } else
-        HTMLElement::parseAttribute(attr);
+        InsertionPoint::parseAttribute(attr);
 }
 
 }
diff --git a/Source/WebCore/html/shadow/HTMLContentElement.h b/Source/WebCore/html/shadow/HTMLContentElement.h
index 6e1816c78..c2a1c1e36 100644
--- a/Source/WebCore/html/shadow/HTMLContentElement.h
+++ b/Source/WebCore/html/shadow/HTMLContentElement.h
@@ -31,18 +31,14 @@
 #ifndef HTMLContentElement_h
 #define HTMLContentElement_h
 
-#include "ContentInclusionSelector.h"
-#include "HTMLElement.h"
+#include "InsertionPoint.h"
 #include <wtf/Forward.h>
 
 namespace WebCore {
 
-class ContentSelectorQuery;
-class ShadowInclusionList;
-
 // NOTE: Current implementation doesn't support dynamic insertion/deletion of HTMLContentElement.
 // You should create HTMLContentElement during the host construction.
-class HTMLContentElement : public HTMLElement {
+class HTMLContentElement : public InsertionPoint {
 public:
     static PassRefPtr<HTMLContentElement> create(const QualifiedName&, Document*);
     static PassRefPtr<HTMLContentElement> create(Document*);
@@ -60,9 +56,6 @@ public:
     // See https://bugs.webkit.org/show_bug.cgi?id=76261
     void setSelect(const AtomicString&);
 
-    const ShadowInclusionList* inclusions() const { return m_inclusions.get(); }
-    bool hasInclusion() const { return inclusions()->first(); }
-
     virtual bool isSelectValid() const;
 
 protected:
@@ -74,8 +67,6 @@ private:
     virtual RenderObject* createRenderer(RenderArena*, RenderStyle*) { return 0; }
 
     virtual void parseAttribute(Attribute*) OVERRIDE;
-
-    OwnPtr<ShadowInclusionList> m_inclusions;
 };
 
 inline HTMLContentElement* toHTMLContentElement(Node* node)
diff --git a/Source/WebCore/html/shadow/ContentInclusionSelector.cpp b/Source/WebCore/html/shadow/HTMLContentSelector.cpp
index 6b541a5ae..5c30ff6e1 100644
--- a/Source/WebCore/html/shadow/ContentInclusionSelector.cpp
+++ b/Source/WebCore/html/shadow/HTMLContentSelector.cpp
@@ -25,7 +25,7 @@
  */
 
 #include "config.h"
-#include "ContentInclusionSelector.h"
+#include "HTMLContentSelector.h"
 
 #include "ContentSelectorQuery.h"
 #include "HTMLContentElement.h"
@@ -34,7 +34,7 @@
 
 namespace WebCore {
 
-void ShadowInclusion::append(PassRefPtr<ShadowInclusion> next)
+void HTMLContentSelection::append(PassRefPtr<HTMLContentSelection> next)
 {
     ASSERT(!m_next);
     ASSERT(!next->previous());
@@ -42,13 +42,13 @@ void ShadowInclusion::append(PassRefPtr<ShadowInclusion> next)
     m_next->m_previous = this;
 }
 
-void ShadowInclusion::unlink()
+void HTMLContentSelection::unlink()
 {
     ASSERT(!m_previous); // Can be called only for a head.
-    RefPtr<ShadowInclusion> item = this;
+    RefPtr<HTMLContentSelection> item = this;
     while (item) {
         ASSERT(!item->previous());
-        RefPtr<ShadowInclusion> nextItem = item->m_next;
+        RefPtr<HTMLContentSelection> nextItem = item->m_next;
         item->m_next.clear();
         if (nextItem)
             nextItem->m_previous.clear();
@@ -56,26 +56,26 @@ void ShadowInclusion::unlink()
     }
 }
 
-ShadowInclusionList::ShadowInclusionList()
+HTMLContentSelectionList::HTMLContentSelectionList()
 {
 }
 
-ShadowInclusionList::~ShadowInclusionList()
+HTMLContentSelectionList::~HTMLContentSelectionList()
 {
     ASSERT(isEmpty());
 }
 
-ShadowInclusion* ShadowInclusionList::find(Node* content) const
+HTMLContentSelection* HTMLContentSelectionList::find(Node* node) const
 {
-    for (ShadowInclusion* item = first(); item; item = item->next()) {
-        if (content == item->content())
+    for (HTMLContentSelection* item = first(); item; item = item->next()) {
+        if (node == item->node())
             return item;
     }
     
     return 0;
 }
 
-void ShadowInclusionList::clear()
+void HTMLContentSelectionList::clear()
 {
     if (isEmpty()) {
         ASSERT(!m_last);
@@ -87,7 +87,7 @@ void ShadowInclusionList::clear()
     m_last.clear();
 }
 
-void ShadowInclusionList::append(PassRefPtr<ShadowInclusion> child)
+void HTMLContentSelectionList::append(PassRefPtr<HTMLContentSelection> child)
 {
     if (isEmpty()) {
         ASSERT(!m_last);
@@ -99,18 +99,18 @@ void ShadowInclusionList::append(PassRefPtr<ShadowInclusion> child)
     m_last = m_last->next();
 }
 
-ContentInclusionSelector::ContentInclusionSelector()
+HTMLContentSelector::HTMLContentSelector()
 {
 }
 
-ContentInclusionSelector::~ContentInclusionSelector()
+HTMLContentSelector::~HTMLContentSelector()
 {
     ASSERT(m_candidates.isEmpty());
 }
 
-void ContentInclusionSelector::select(HTMLContentElement* contentElement, ShadowInclusionList* inclusions)
+void HTMLContentSelector::select(HTMLContentElement* contentElement, HTMLContentSelectionList* selections)
 {
-    ASSERT(inclusions->isEmpty());
+    ASSERT(selections->isEmpty());
 
     ContentSelectorQuery query(contentElement);
     for (size_t i = 0; i < m_candidates.size(); ++i) {
@@ -120,35 +120,37 @@ void ContentInclusionSelector::select(HTMLContentElement* contentElement, Shadow
         if (!query.matches(child))
             continue;
 
-        RefPtr<ShadowInclusion> inclusion = ShadowInclusion::create(contentElement, child);
-        inclusions->append(inclusion);
-        m_inclusionSet.add(inclusion.get());
+        RefPtr<HTMLContentSelection> selection = HTMLContentSelection::create(contentElement, child);
+
+        selections->append(selection);
+        m_selectionSet.add(selection.get());
         m_candidates[i] = 0;
     }
 }
 
-void ContentInclusionSelector::unselect(ShadowInclusionList* list)
+void HTMLContentSelector::unselect(HTMLContentSelectionList* list)
 {
-    for (ShadowInclusion* inclusion = list->first(); inclusion; inclusion = inclusion->next())
-        m_inclusionSet.remove(inclusion);
+    for (HTMLContentSelection* selection = list->first(); selection; selection = selection->next())
+        m_selectionSet.remove(selection);
     list->clear();
 }
 
-ShadowInclusion* ContentInclusionSelector::findFor(Node* key) const
+HTMLContentSelection* HTMLContentSelector::findFor(Node* key) const
 {
-    return m_inclusionSet.find(key);
+    return m_selectionSet.find(key);
 }
 
-void ContentInclusionSelector::didSelect()
+void HTMLContentSelector::didSelect()
 {
     m_candidates.clear();
 }
 
-void ContentInclusionSelector::willSelectOver(ShadowRoot* scope)
+void HTMLContentSelector::willSelectOver(Element* shadowHost)
 {
     if (!m_candidates.isEmpty())
         return;
-    for (Node* node = scope->shadowHost()->firstChild(); node; node = node->nextSibling())
+    ASSERT(shadowHost);
+    for (Node* node = shadowHost->firstChild(); node; node = node->nextSibling())
         m_candidates.append(node);
 }
 
diff --git a/Source/WebCore/html/shadow/HTMLContentSelector.h b/Source/WebCore/html/shadow/HTMLContentSelector.h
new file mode 100644
index 000000000..29bd6163f
--- /dev/null
+++ b/Source/WebCore/html/shadow/HTMLContentSelector.h
@@ -0,0 +1,151 @@
+/*
+ * Copyright (C) 2011 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef HTMLContentSelector_h
+#define HTMLContentSelector_h
+
+#include <wtf/Forward.h>
+#include <wtf/HashSet.h>
+#include <wtf/RefCounted.h>
+#include <wtf/Vector.h>
+
+namespace WebCore {
+
+class Element;
+class HTMLContentElement;
+class InsertionPoint;
+class Node;
+class ShadowRoot;
+
+class HTMLContentSelection : public RefCounted<HTMLContentSelection> {
+public:
+    static PassRefPtr<HTMLContentSelection> create(InsertionPoint*, Node*);
+
+    InsertionPoint* insertionPoint() const { return m_insertionPoint; }
+    Node* node() const { return m_node.get(); }
+    HTMLContentSelection* next() const { return m_next.get(); }
+    HTMLContentSelection* previous() const { return m_previous.get(); }
+
+    void append(PassRefPtr<HTMLContentSelection>);
+    void unlink();
+
+private:
+    HTMLContentSelection(InsertionPoint*, Node*);
+
+    InsertionPoint* m_insertionPoint;
+    RefPtr<Node> m_node;
+    RefPtr<HTMLContentSelection> m_next;
+    RefPtr<HTMLContentSelection> m_previous;
+};
+
+inline HTMLContentSelection::HTMLContentSelection(InsertionPoint* insertionPoint, Node* node)
+    : m_insertionPoint(insertionPoint), m_node(node)
+{ }
+
+inline PassRefPtr<HTMLContentSelection> HTMLContentSelection::create(InsertionPoint* insertionPoint, Node* node)
+{
+    return adoptRef(new HTMLContentSelection(insertionPoint, node));
+}
+
+class HTMLContentSelectionList {
+public:
+    HTMLContentSelectionList();
+    ~HTMLContentSelectionList();
+
+    HTMLContentSelection* first() const { return m_first.get(); }
+    HTMLContentSelection* last() const { return m_last.get(); }
+    HTMLContentSelection* find(Node*) const;
+    bool isEmpty() const { return !m_first; }
+
+    void clear();
+    void append(PassRefPtr<HTMLContentSelection>);
+
+private:
+    RefPtr<HTMLContentSelection> m_first;
+    RefPtr<HTMLContentSelection> m_last;
+};
+
+
+class HTMLContentSelectionSet {
+public:
+    void add(HTMLContentSelection* value) { m_set.add(value); }
+    void remove(HTMLContentSelection* value) { m_set.remove(value); }
+    bool isEmpty() const { return m_set.isEmpty(); }
+    HTMLContentSelection* find(Node* key) const;
+
+private:
+    struct Translator {
+    public:
+        static unsigned hash(const Node* key) { return PtrHash<const Node*>::hash(key); }
+        static bool equal(const HTMLContentSelection* selection, const Node* node) { return selection->node() == node; }
+    };
+
+    struct Hash {
+        static unsigned hash(HTMLContentSelection* key) { return PtrHash<const Node*>::hash(key->node()); }
+        static bool equal(HTMLContentSelection* a, HTMLContentSelection* b) { return a->node() == b->node(); }
+        static const bool safeToCompareToEmptyOrDeleted = false;
+    };
+
+    typedef HashSet<HTMLContentSelection*, Hash> PointerSet;
+
+    PointerSet m_set;
+};
+
+inline HTMLContentSelection* HTMLContentSelectionSet::find(Node* key) const
+{
+    PointerSet::iterator found = m_set.find<Node*, HTMLContentSelectionSet::Translator>(key);
+    return found != m_set.end() ? *found : 0;
+}
+
+class HTMLContentSelector {
+    WTF_MAKE_NONCOPYABLE(HTMLContentSelector);
+public:
+    HTMLContentSelector();
+    ~HTMLContentSelector();
+
+    void select(HTMLContentElement*, HTMLContentSelectionList*);
+    void unselect(HTMLContentSelectionList*);
+    HTMLContentSelection* findFor(Node* key) const;
+
+    void willSelectOver(Element* shadowHost);
+    void didSelect();
+    bool hasCandidates() const { return !m_candidates.isEmpty(); }
+
+private:
+    void removeFromSet(HTMLContentSelectionList*);
+    void addToSet(HTMLContentSelectionList*);
+
+    Vector<RefPtr<Node> > m_candidates;
+    HTMLContentSelectionSet m_selectionSet;
+};
+
+}
+
+#endif
diff --git a/Source/WebCore/html/shadow/HTMLShadowElement.h b/Source/WebCore/html/shadow/HTMLShadowElement.h
index bfc85e2fb..151c7a2ab 100644
--- a/Source/WebCore/html/shadow/HTMLShadowElement.h
+++ b/Source/WebCore/html/shadow/HTMLShadowElement.h
@@ -45,6 +45,7 @@ public:
 
 private:
     HTMLShadowElement(const QualifiedName&, Document*);
+    virtual bool isShadowElement() const { return true; }
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/html/shadow/HTMLShadowElement.idl b/Source/WebCore/html/shadow/HTMLShadowElement.idl
index 1310a1482..94facb7be 100644
--- a/Source/WebCore/html/shadow/HTMLShadowElement.idl
+++ b/Source/WebCore/html/shadow/HTMLShadowElement.idl
@@ -32,7 +32,7 @@ module html {
 
     interface [
         Conditional=SHADOW_DOM,
-        EnabledAtRuntime=shadowDOM
+        V8EnabledAtRuntime=shadowDOM
     ] HTMLShadowElement : HTMLElement {
     };
 
diff --git a/Source/WebCore/html/shadow/InsertionPoint.cpp b/Source/WebCore/html/shadow/InsertionPoint.cpp
new file mode 100644
index 000000000..e99dc26d2
--- /dev/null
+++ b/Source/WebCore/html/shadow/InsertionPoint.cpp
@@ -0,0 +1,46 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "InsertionPoint.h"
+
+namespace WebCore {
+
+InsertionPoint::InsertionPoint(const QualifiedName& tagName, Document* document)
+    : HTMLElement(tagName, document)
+    , m_selections()
+{
+}
+
+InsertionPoint::~InsertionPoint()
+{
+}
+
+} // namespace WebCore
diff --git a/Source/WebCore/html/shadow/InsertionPoint.h b/Source/WebCore/html/shadow/InsertionPoint.h
new file mode 100644
index 000000000..292439032
--- /dev/null
+++ b/Source/WebCore/html/shadow/InsertionPoint.h
@@ -0,0 +1,69 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef InsertionPoint_h
+#define InsertionPoint_h
+
+#include "HTMLContentSelector.h"
+#include "HTMLElement.h"
+
+namespace WebCore {
+
+class InsertionPoint : public HTMLElement {
+public:
+    virtual ~InsertionPoint();
+
+    const HTMLContentSelectionList* selections() const { return &m_selections; }
+    bool hasSelection() const { return m_selections.first(); }
+
+protected:
+    InsertionPoint(const QualifiedName&, Document*);
+    HTMLContentSelectionList m_selections;
+};
+
+inline bool isInsertionPoint(Node* node)
+{
+    // FIXME: <shadow> should also be InsertionPoint.
+    // https://bugs.webkit.org/show_bug.cgi?id=78596
+    if (!node || node->isContentElement())
+        return true;
+
+    return false;
+}
+
+inline InsertionPoint* toInsertionPoint(Node* node)
+{
+    ASSERT(isInsertionPoint(node));
+    return static_cast<InsertionPoint*>(node);
+}
+
+} // namespace WebCore
+
+#endif // InsertionPoint_h
diff --git a/Source/WebCore/html/shadow/MediaControlElements.cpp b/Source/WebCore/html/shadow/MediaControlElements.cpp
index e932e73d3..1f69e3cc6 100644
--- a/Source/WebCore/html/shadow/MediaControlElements.cpp
+++ b/Source/WebCore/html/shadow/MediaControlElements.cpp
@@ -92,12 +92,12 @@ MediaControlElement::MediaControlElement(Document* document)
 
 void MediaControlElement::show()
 {
-    ensureInlineStyleDecl()->removeProperty(CSSPropertyDisplay);
+    removeInlineStyleProperty(CSSPropertyDisplay);
 }
 
 void MediaControlElement::hide()
 {
-    ensureInlineStyleDecl()->setProperty(CSSPropertyDisplay, CSSValueNone);
+    setInlineStyleProperty(CSSPropertyDisplay, CSSValueNone);
 }
 
 // ----------------------------
@@ -175,17 +175,15 @@ void MediaControlPanelElement::endDrag()
 
 void MediaControlPanelElement::setPosition(const LayoutPoint& position)
 {
-    StylePropertySet* style = ensureInlineStyleDecl();
-
     double left = position.x();
     double top = position.y();
 
     // Set the left and top to control the panel's position; this depends on it being absolute positioned.
     // Set the margin to zero since the position passed in will already include the effect of the margin.
-    style->setProperty(CSSPropertyLeft, left, CSSPrimitiveValue::CSS_PX);
-    style->setProperty(CSSPropertyTop, top, CSSPrimitiveValue::CSS_PX);
-    style->setProperty(CSSPropertyMarginLeft, 0.0, CSSPrimitiveValue::CSS_PX);
-    style->setProperty(CSSPropertyMarginTop, 0.0, CSSPrimitiveValue::CSS_PX);
+    setInlineStyleProperty(CSSPropertyLeft, left, CSSPrimitiveValue::CSS_PX);
+    setInlineStyleProperty(CSSPropertyTop, top, CSSPrimitiveValue::CSS_PX);
+    setInlineStyleProperty(CSSPropertyMarginLeft, 0.0, CSSPrimitiveValue::CSS_PX);
+    setInlineStyleProperty(CSSPropertyMarginTop, 0.0, CSSPrimitiveValue::CSS_PX);
 
     ExceptionCode ignored;
     classList()->add("dragged", ignored);
@@ -193,12 +191,10 @@ void MediaControlPanelElement::setPosition(const LayoutPoint& position)
 
 void MediaControlPanelElement::resetPosition()
 {
-    StylePropertySet* style = ensureInlineStyleDecl();
-
-    style->removeProperty(CSSPropertyLeft);
-    style->removeProperty(CSSPropertyTop);
-    style->removeProperty(CSSPropertyMarginLeft);
-    style->removeProperty(CSSPropertyMarginTop);
+    removeInlineStyleProperty(CSSPropertyLeft);
+    removeInlineStyleProperty(CSSPropertyTop);
+    removeInlineStyleProperty(CSSPropertyMarginLeft);
+    removeInlineStyleProperty(CSSPropertyMarginTop);
 
     ExceptionCode ignored;
     classList()->remove("dragged", ignored);
@@ -211,10 +207,9 @@ void MediaControlPanelElement::makeOpaque()
 
     double duration = document()->page() ? document()->page()->theme()->mediaControlsFadeInDuration() : 0;
 
-    StylePropertySet* style = ensureInlineStyleDecl();
-    style->setProperty(CSSPropertyWebkitTransitionProperty, CSSPropertyOpacity);
-    style->setProperty(CSSPropertyWebkitTransitionDuration, duration, CSSPrimitiveValue::CSS_S);
-    style->setProperty(CSSPropertyOpacity, 1.0, CSSPrimitiveValue::CSS_NUMBER);
+    setInlineStyleProperty(CSSPropertyWebkitTransitionProperty, CSSPropertyOpacity);
+    setInlineStyleProperty(CSSPropertyWebkitTransitionDuration, duration, CSSPrimitiveValue::CSS_S);
+    setInlineStyleProperty(CSSPropertyOpacity, 1.0, CSSPrimitiveValue::CSS_NUMBER);
 
     m_opaque = true;
 }
@@ -224,10 +219,9 @@ void MediaControlPanelElement::makeTransparent()
     if (!m_opaque)
         return;
 
-    StylePropertySet* style = ensureInlineStyleDecl();
-    style->setProperty(CSSPropertyWebkitTransitionProperty, CSSPropertyOpacity);
-    style->setProperty(CSSPropertyWebkitTransitionDuration, document()->page()->theme()->mediaControlsFadeOutDuration(), CSSPrimitiveValue::CSS_S);
-    style->setProperty(CSSPropertyOpacity, 0.0, CSSPrimitiveValue::CSS_NUMBER);
+    setInlineStyleProperty(CSSPropertyWebkitTransitionProperty, CSSPropertyOpacity);
+    setInlineStyleProperty(CSSPropertyWebkitTransitionDuration, document()->page()->theme()->mediaControlsFadeOutDuration(), CSSPrimitiveValue::CSS_S);
+    setInlineStyleProperty(CSSPropertyOpacity, 0.0, CSSPrimitiveValue::CSS_NUMBER);
 
     m_opaque = false;
 }
@@ -434,12 +428,12 @@ MediaControlInputElement::MediaControlInputElement(Document* document, MediaCont
 
 void MediaControlInputElement::show()
 {
-    ensureInlineStyleDecl()->removeProperty(CSSPropertyDisplay);
+    removeInlineStyleProperty(CSSPropertyDisplay);
 }
 
 void MediaControlInputElement::hide()
 {
-    ensureInlineStyleDecl()->setProperty(CSSPropertyDisplay, CSSValueNone);
+    setInlineStyleProperty(CSSPropertyDisplay, CSSValueNone);
 }
 
 
@@ -493,6 +487,7 @@ PassRefPtr<MediaControlPanelMuteButtonElement> MediaControlPanelMuteButtonElemen
     ASSERT(controls);
 
     RefPtr<MediaControlPanelMuteButtonElement> button = adoptRef(new MediaControlPanelMuteButtonElement(document, controls));
+    button->createShadowSubtree();
     button->setType("button");
     return button.release();
 }
@@ -521,6 +516,7 @@ inline MediaControlVolumeSliderMuteButtonElement::MediaControlVolumeSliderMuteBu
 PassRefPtr<MediaControlVolumeSliderMuteButtonElement> MediaControlVolumeSliderMuteButtonElement::create(Document* document)
 {
     RefPtr<MediaControlVolumeSliderMuteButtonElement> button = adoptRef(new MediaControlVolumeSliderMuteButtonElement(document));
+    button->createShadowSubtree();
     button->setType("button");
     return button.release();
 }
@@ -541,6 +537,7 @@ inline MediaControlPlayButtonElement::MediaControlPlayButtonElement(Document* do
 PassRefPtr<MediaControlPlayButtonElement> MediaControlPlayButtonElement::create(Document* document)
 {
     RefPtr<MediaControlPlayButtonElement> button = adoptRef(new MediaControlPlayButtonElement(document));
+    button->createShadowSubtree();
     button->setType("button");
     return button.release();
 }
@@ -660,6 +657,7 @@ inline MediaControlSeekForwardButtonElement::MediaControlSeekForwardButtonElemen
 PassRefPtr<MediaControlSeekForwardButtonElement> MediaControlSeekForwardButtonElement::create(Document* document)
 {
     RefPtr<MediaControlSeekForwardButtonElement> button = adoptRef(new MediaControlSeekForwardButtonElement(document));
+    button->createShadowSubtree();
     button->setType("button");
     return button.release();
 }
@@ -680,6 +678,7 @@ inline MediaControlSeekBackButtonElement::MediaControlSeekBackButtonElement(Docu
 PassRefPtr<MediaControlSeekBackButtonElement> MediaControlSeekBackButtonElement::create(Document* document)
 {
     RefPtr<MediaControlSeekBackButtonElement> button = adoptRef(new MediaControlSeekBackButtonElement(document));
+    button->createShadowSubtree();
     button->setType("button");
     return button.release();
 }
@@ -700,6 +699,7 @@ inline MediaControlRewindButtonElement::MediaControlRewindButtonElement(Document
 PassRefPtr<MediaControlRewindButtonElement> MediaControlRewindButtonElement::create(Document* document)
 {
     RefPtr<MediaControlRewindButtonElement> button = adoptRef(new MediaControlRewindButtonElement(document));
+    button->createShadowSubtree();
     button->setType("button");
     return button.release();
 }
@@ -730,6 +730,7 @@ inline MediaControlReturnToRealtimeButtonElement::MediaControlReturnToRealtimeBu
 PassRefPtr<MediaControlReturnToRealtimeButtonElement> MediaControlReturnToRealtimeButtonElement::create(Document* document)
 {
     RefPtr<MediaControlReturnToRealtimeButtonElement> button = adoptRef(new MediaControlReturnToRealtimeButtonElement(document));
+    button->createShadowSubtree();
     button->setType("button");
     button->hide();
     return button.release();
@@ -760,6 +761,7 @@ inline MediaControlToggleClosedCaptionsButtonElement::MediaControlToggleClosedCa
 PassRefPtr<MediaControlToggleClosedCaptionsButtonElement> MediaControlToggleClosedCaptionsButtonElement::create(Document* document)
 {
     RefPtr<MediaControlToggleClosedCaptionsButtonElement> button = adoptRef(new MediaControlToggleClosedCaptionsButtonElement(document));
+    button->createShadowSubtree();
     button->setType("button");
     button->hide();
     return button.release();
@@ -801,6 +803,7 @@ PassRefPtr<MediaControlTimelineElement> MediaControlTimelineElement::create(Docu
     ASSERT(controls);
 
     RefPtr<MediaControlTimelineElement> timeline = adoptRef(new MediaControlTimelineElement(document, controls));
+    timeline->createShadowSubtree();
     timeline->setType("range");
     timeline->setAttribute(precisionAttr, "float");
     return timeline.release();
@@ -865,6 +868,7 @@ inline MediaControlVolumeSliderElement::MediaControlVolumeSliderElement(Document
 PassRefPtr<MediaControlVolumeSliderElement> MediaControlVolumeSliderElement::create(Document* document)
 {
     RefPtr<MediaControlVolumeSliderElement> slider = adoptRef(new MediaControlVolumeSliderElement(document));
+    slider->createShadowSubtree();
     slider->setType("range");
     slider->setAttribute(precisionAttr, "float");
     slider->setAttribute(maxAttr, "1");
@@ -915,6 +919,7 @@ inline MediaControlFullscreenVolumeSliderElement::MediaControlFullscreenVolumeSl
 PassRefPtr<MediaControlFullscreenVolumeSliderElement> MediaControlFullscreenVolumeSliderElement::create(Document* document)
 {
     RefPtr<MediaControlFullscreenVolumeSliderElement> slider = adoptRef(new MediaControlFullscreenVolumeSliderElement(document));
+    slider->createShadowSubtree();
     slider->setType("range");
     slider->setAttribute(precisionAttr, "float");
     slider->setAttribute(maxAttr, "1");
@@ -940,6 +945,7 @@ PassRefPtr<MediaControlFullscreenButtonElement> MediaControlFullscreenButtonElem
     ASSERT(controls);
 
     RefPtr<MediaControlFullscreenButtonElement> button = adoptRef(new MediaControlFullscreenButtonElement(document, controls));
+    button->createShadowSubtree();
     button->setType("button");
     button->hide();
     return button.release();
@@ -983,6 +989,7 @@ inline MediaControlFullscreenVolumeMinButtonElement::MediaControlFullscreenVolum
 PassRefPtr<MediaControlFullscreenVolumeMinButtonElement> MediaControlFullscreenVolumeMinButtonElement::create(Document* document)
 {
     RefPtr<MediaControlFullscreenVolumeMinButtonElement> button = adoptRef(new MediaControlFullscreenVolumeMinButtonElement(document));
+    button->createShadowSubtree();
     button->setType("button");
     return button.release();
 }
@@ -1013,6 +1020,7 @@ inline MediaControlFullscreenVolumeMaxButtonElement::MediaControlFullscreenVolum
 PassRefPtr<MediaControlFullscreenVolumeMaxButtonElement> MediaControlFullscreenVolumeMaxButtonElement::create(Document* document)
 {
     RefPtr<MediaControlFullscreenVolumeMaxButtonElement> button = adoptRef(new MediaControlFullscreenVolumeMaxButtonElement(document));
+    button->createShadowSubtree();
     button->setType("button");
     return button.release();
 }
@@ -1197,13 +1205,13 @@ void MediaControlTextTrackContainerElement::updateSizes()
     float fontSize = m_videoDisplaySize.size().height() * videoHeightFontSizePercentage;
     if (fontSize != m_fontSize) {
         m_fontSize = fontSize;
-        ensureInlineStyleDecl()->setProperty(CSSPropertyFontSize, String::number(fontSize) + "px");
+        setInlineStyleProperty(CSSPropertyFontSize, String::number(fontSize) + "px");
     }
 
     LayoutUnit bottom = static_cast<LayoutUnit>(m_videoDisplaySize.y() + m_videoDisplaySize.height() - (m_videoDisplaySize.height() * trackBottomMultiplier));
     if (bottom != m_bottom) {
         m_bottom = bottom;
-        ensureInlineStyleDecl()->setProperty(CSSPropertyBottom, String::number(bottom) + "px");
+        setInlineStyleProperty(CSSPropertyBottom, String::number(bottom) + "px");
     }
 }
 
diff --git a/Source/WebCore/html/shadow/MeterShadowElement.cpp b/Source/WebCore/html/shadow/MeterShadowElement.cpp
index 410535414..bc5ea6295 100644
--- a/Source/WebCore/html/shadow/MeterShadowElement.cpp
+++ b/Source/WebCore/html/shadow/MeterShadowElement.cpp
@@ -93,7 +93,7 @@ const AtomicString& MeterValueElement::shadowPseudoId() const
 
 void MeterValueElement::setWidthPercentage(double width)
 {
-    ensureInlineStyleDecl()->setProperty(CSSPropertyWidth, width, CSSPrimitiveValue::CSS_PERCENTAGE);
+    setInlineStyleProperty(CSSPropertyWidth, width, CSSPrimitiveValue::CSS_PERCENTAGE);
 }
 
 
diff --git a/Source/WebCore/html/shadow/ProgressShadowElement.cpp b/Source/WebCore/html/shadow/ProgressShadowElement.cpp
index ecd35544f..548571302 100644
--- a/Source/WebCore/html/shadow/ProgressShadowElement.cpp
+++ b/Source/WebCore/html/shadow/ProgressShadowElement.cpp
@@ -73,7 +73,7 @@ const AtomicString& ProgressValueElement::shadowPseudoId() const
 
 void ProgressValueElement::setWidthPercentage(double width)
 {
-    ensureInlineStyleDecl()->setProperty(CSSPropertyWidth, width, CSSPrimitiveValue::CSS_PERCENTAGE);
+    setInlineStyleProperty(CSSPropertyWidth, width, CSSPrimitiveValue::CSS_PERCENTAGE);
 }
 
 }
diff --git a/Source/WebCore/html/shadow/SliderThumbElement.cpp b/Source/WebCore/html/shadow/SliderThumbElement.cpp
index 319a11e80..7558924ce 100644
--- a/Source/WebCore/html/shadow/SliderThumbElement.cpp
+++ b/Source/WebCore/html/shadow/SliderThumbElement.cpp
@@ -43,6 +43,7 @@
 #include "RenderSlider.h"
 #include "RenderTheme.h"
 #include "ShadowRoot.h"
+#include "ShadowRootList.h"
 #include "StepRange.h"
 #include <wtf/MathExtras.h>
 
@@ -66,7 +67,7 @@ inline static bool hasVerticalAppearance(HTMLInputElement* input)
 SliderThumbElement* sliderThumbElementOf(Node* node)
 {
     ASSERT(node);
-    ShadowRoot* shadow = node->toInputElement()->shadowRoot();
+    ShadowRoot* shadow = node->toInputElement()->shadowRootList()->oldestShadowRoot();
     ASSERT(shadow);
     Node* thumb = shadow->firstChild()->firstChild()->firstChild();
     ASSERT(thumb);
@@ -141,7 +142,7 @@ void RenderSliderContainer::layout()
     Length inputHeight = input->renderer()->style()->height();
     RenderObject* trackRenderer = node()->firstChild()->renderer();
     if (!isVertical && input->renderer()->isSlider() && !inputHeight.isFixed() && !inputHeight.isPercent()) {
-        RenderObject* thumbRenderer = input->shadowRoot()->firstChild()->firstChild()->firstChild()->renderer();
+        RenderObject* thumbRenderer = input->shadowRootList()->oldestShadowRoot()->firstChild()->firstChild()->firstChild()->renderer();
         if (thumbRenderer) {
             style()->setHeight(thumbRenderer->style()->height());
             if (trackRenderer)
@@ -334,9 +335,8 @@ PassRefPtr<TrackLimiterElement> TrackLimiterElement::create(Document* document)
 {
     RefPtr<TrackLimiterElement> element = adoptRef(new TrackLimiterElement(document));
 
-    StylePropertySet* style = element->ensureInlineStyleDecl();
-    style->setProperty(CSSPropertyVisibility, CSSValueHidden);
-    style->setProperty(CSSPropertyPosition, CSSValueStatic);
+    element->setInlineStyleProperty(CSSPropertyVisibility, CSSValueHidden);
+    element->setInlineStyleProperty(CSSPropertyPosition, CSSValueStatic);
 
     return element.release();
 }
@@ -355,7 +355,8 @@ const AtomicString& TrackLimiterElement::shadowPseudoId() const
 TrackLimiterElement* trackLimiterElementOf(Node* node)
 {
     ASSERT(node);
-    ShadowRoot* shadow = node->toInputElement()->shadowRoot();
+    ASSERT(node->toInputElement()->hasShadowRoot());
+    ShadowRoot* shadow = node->toInputElement()->shadowRootList()->oldestShadowRoot();
     ASSERT(shadow);
     Node* limiter = shadow->firstChild()->lastChild();
     ASSERT(limiter);
diff --git a/Source/WebCore/html/shadow/TextControlInnerElements.cpp b/Source/WebCore/html/shadow/TextControlInnerElements.cpp
index 808ffa31e..2fc35f20e 100644
--- a/Source/WebCore/html/shadow/TextControlInnerElements.cpp
+++ b/Source/WebCore/html/shadow/TextControlInnerElements.cpp
@@ -474,7 +474,7 @@ void InputFieldSpeechButtonElement::setState(SpeechInputState state)
 
 SpeechInput* InputFieldSpeechButtonElement::speechInput()
 {
-    return document()->page() ? document()->page()->speechInput() : 0;
+    return SpeechInput::from(document()->page());
 }
 
 void InputFieldSpeechButtonElement::didCompleteRecording(int)
@@ -520,7 +520,8 @@ void InputFieldSpeechButtonElement::setRecognitionResult(int, const SpeechInputR
 void InputFieldSpeechButtonElement::attach()
 {
     ASSERT(!m_listenerId);
-    m_listenerId = document()->page()->speechInput()->registerListener(this);
+    if (SpeechInput* input = SpeechInput::from(document()->page()))
+        m_listenerId = input->registerListener(this);
     HTMLDivElement::attach();
 }
 
@@ -550,7 +551,7 @@ void InputFieldSpeechButtonElement::startSpeechInput()
     AtomicString language = input->computeInheritedLanguage();
     String grammar = input->getAttribute(webkitgrammarAttr);
     // FIXME: this should probably respect transforms
-    IntRect rect = renderer()->view()->frameView()->contentsToWindow(renderer()->absoluteBoundingBoxRectIgnoringTransforms());
+    IntRect rect = pixelSnappedIntRect(renderer()->view()->frameView()->contentsToWindow(renderer()->absoluteBoundingBoxRectIgnoringTransforms()));
     if (speechInput()->startRecognition(m_listenerId, rect, language, grammar, document()->securityOrigin()))
         setState(Recording);
 }
diff --git a/Source/WebCore/html/LoadableTextTrack.cpp b/Source/WebCore/html/track/LoadableTextTrack.cpp
index b48d8c7cb..400b42c2c 100644
--- a/Source/WebCore/html/LoadableTextTrack.cpp
+++ b/Source/WebCore/html/track/LoadableTextTrack.cpp
@@ -125,9 +125,10 @@ void LoadableTextTrack::cueLoadingCompleted(TextTrackLoader* loader, bool loadin
 
 void LoadableTextTrack::fireCueChangeEvent()
 {
-    TextTrack::fireCueChangeEvent();
+    RefPtr<Event> event = Event::create(eventNames().cuechangeEvent, false, false);
     ExceptionCode ec = 0;
-    m_trackElement->dispatchEvent(Event::create(eventNames().cuechangeEvent, false, false), ec);
+
+    m_trackElement->dispatchEvent(event, ec);
 }
 
 size_t LoadableTextTrack::trackElementIndex()
diff --git a/Source/WebCore/html/LoadableTextTrack.h b/Source/WebCore/html/track/LoadableTextTrack.h
index b70122536..783cdfa7f 100644
--- a/Source/WebCore/html/LoadableTextTrack.h
+++ b/Source/WebCore/html/track/LoadableTextTrack.h
@@ -57,10 +57,12 @@ public:
     void scheduleLoad(const KURL&);
 
     virtual void clearClient();
-    
+
     size_t trackElementIndex();
     HTMLTrackElement* trackElement() { return m_trackElement; }
 
+    virtual void fireCueChangeEvent();
+
 private:
     // TextTrackLoaderClient
     virtual bool shouldLoadCues(TextTrackLoader*) { return true; }
@@ -71,8 +73,6 @@ private:
     LoadableTextTrack(HTMLTrackElement*, const String& kind, const String& label, const String& language, bool isDefault);
 
     void loadTimerFired(Timer<LoadableTextTrack>*);
-    
-    virtual void fireCueChangeEvent();
 
     HTMLTrackElement* m_trackElement;
     Timer<LoadableTextTrack> m_loadTimer;
diff --git a/Source/WebCore/html/TextTrack.cpp b/Source/WebCore/html/track/TextTrack.cpp
index bdfbaa205..175171fd3 100644
--- a/Source/WebCore/html/TextTrack.cpp
+++ b/Source/WebCore/html/track/TextTrack.cpp
@@ -37,11 +37,15 @@
 
 #include "Event.h"
 #include "ExceptionCode.h"
+#include "HTMLMediaElement.h"
 #include "TextTrackCueList.h"
+#include "TextTrackList.h"
 #include "TrackBase.h"
 
 namespace WebCore {
 
+static const int invalidTrackIndex = -1;
+
 const AtomicString& TextTrack::subtitlesKeyword()
 {
     DEFINE_STATIC_LOCAL(const AtomicString, subtitles, ("subtitles"));
@@ -82,6 +86,7 @@ TextTrack::TextTrack(ScriptExecutionContext* context, TextTrackClient* client, c
     , m_trackType(type)
     , m_readinessState(NotLoaded)
     , m_showingByDefault(false)
+    , m_trackIndex(invalidTrackIndex)
 {
     setKind(kind);
 }
@@ -155,16 +160,13 @@ TextTrack::Mode TextTrack::mode() const
 
 TextTrackCueList* TextTrack::cues()
 {
-    if (!m_cues)
-        m_cues = TextTrackCueList::create();    
-
     // 4.8.10.12.5 If the text track mode ... is not the text track disabled mode,
     // then the cues attribute must return a live TextTrackCueList object ...
     // Otherwise, it must return null. When an object is returned, the
     // same object must be returned each time.
     // http://www.whatwg.org/specs/web-apps/current-work/#dom-texttrack-cues
-    if (m_cues && m_mode != TextTrack::DISABLED)
-        return m_cues.get();
+    if (m_mode != TextTrack::DISABLED)
+        return ensureTextTrackCueList();
     return 0;
 }
 
@@ -208,7 +210,7 @@ void TextTrack::addCue(PassRefPtr<TextTrackCue> prpCue, ExceptionCode& ec)
     // 3. If the given cue is already listed in the method's TextTrack object's text
     // track's text track list of cues, then throw an InvalidStateError exception.
     // 4. Add cue to the method's TextTrack object's text track's text track list of cues.
-    if (!m_cues->add(cue)) {
+    if (!ensureTextTrackCueList()->add(cue)) {
         ec = INVALID_STATE_ERR;
         return;
     }
@@ -236,7 +238,7 @@ void TextTrack::removeCue(TextTrackCue* cue, ExceptionCode& ec)
     // 2. If the given cue is not currently listed in the method's TextTrack 
     // object's text track's text track list of cues, then throw a NotFoundError exception.
     // 3. Remove cue from the method's TextTrack object's text track's text track list of cues.
-    if (!m_cues->remove(cue)) {
+    if (!m_cues || !m_cues->remove(cue)) {
         ec = INVALID_STATE_ERR;
         return;
     }
@@ -246,12 +248,6 @@ void TextTrack::removeCue(TextTrackCue* cue, ExceptionCode& ec)
         m_client->textTrackRemoveCue(this, cue);
 }
 
-void TextTrack::fireCueChangeEvent()
-{
-    ExceptionCode ec = 0;
-    dispatchEvent(Event::create(eventNames().cuechangeEvent, false, false), ec);
-}
-    
 void TextTrack::cueWillChange(TextTrackCue* cue)
 {
     if (!m_client)
@@ -271,6 +267,29 @@ void TextTrack::cueDidChange(TextTrackCue* cue)
     m_client->textTrackAddCue(this, cue);
 }
 
+int TextTrack::trackIndex()
+{
+    ASSERT(m_mediaElement);
+
+    if (m_trackIndex == invalidTrackIndex)
+        m_trackIndex = m_mediaElement->textTracks()->getTrackIndex(this);
+
+    return m_trackIndex;
+}
+
+void TextTrack::invalidateTrackIndex()
+{
+    m_trackIndex = invalidTrackIndex;
+}
+
+TextTrackCueList* TextTrack::ensureTextTrackCueList()
+{
+    if (!m_cues)
+        m_cues = TextTrackCueList::create();
+
+    return m_cues.get();
+}
+
 } // namespace WebCore
 
 #endif
diff --git a/Source/WebCore/html/TextTrack.h b/Source/WebCore/html/track/TextTrack.h
index f6ecec848..9a8eb8bb4 100644
--- a/Source/WebCore/html/TextTrack.h
+++ b/Source/WebCore/html/track/TextTrack.h
@@ -59,7 +59,7 @@ public:
         return adoptRef(new TextTrack(context, client, kind, label, language, AddTrack));
     }
     virtual ~TextTrack();
-    
+
     void setMediaElement(HTMLMediaElement* element) { m_mediaElement = element; }
     HTMLMediaElement* mediaElement() { return m_mediaElement; }
 
@@ -99,21 +99,26 @@ public:
     void addCue(PassRefPtr<TextTrackCue>, ExceptionCode&);
     void removeCue(TextTrackCue*, ExceptionCode&);
 
+    virtual void fireCueChangeEvent() { };
+
     void cueWillChange(TextTrackCue*);
     void cueDidChange(TextTrackCue*);
-    
-    virtual void fireCueChangeEvent();
+
     DEFINE_ATTRIBUTE_EVENT_LISTENER(cuechange);
 
     enum TextTrackType { TrackElement, AddTrack, InBand };
     TextTrackType trackType() const { return m_trackType; }
 
+    int trackIndex();
+    void invalidateTrackIndex();
+
 protected:
     TextTrack(ScriptExecutionContext*, TextTrackClient*, const String& kind, const String& label, const String& language, TextTrackType);
 
     RefPtr<TextTrackCueList> m_cues;
 
 private:
+    TextTrackCueList* ensureTextTrackCueList();
     HTMLMediaElement* m_mediaElement;
     String m_kind;
     String m_label;
@@ -123,6 +128,7 @@ private:
     TextTrackType m_trackType;
     ReadinessState m_readinessState;
     bool m_showingByDefault;
+    int m_trackIndex;
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/html/TextTrack.idl b/Source/WebCore/html/track/TextTrack.idl
index 845a80c01..845a80c01 100644
--- a/Source/WebCore/html/TextTrack.idl
+++ b/Source/WebCore/html/track/TextTrack.idl
diff --git a/Source/WebCore/html/TextTrackCue.cpp b/Source/WebCore/html/track/TextTrackCue.cpp
index e1c01266e..59c3f3ea0 100644
--- a/Source/WebCore/html/TextTrackCue.cpp
+++ b/Source/WebCore/html/track/TextTrackCue.cpp
@@ -38,11 +38,14 @@
 #include "Event.h"
 #include "DocumentFragment.h"
 #include "TextTrack.h"
+#include "TextTrackCueList.h"
 #include "WebVTTParser.h"
 #include <wtf/text/StringBuilder.h>
 
 namespace WebCore {
 
+static const int invalidCueIndex = -1;
+
 static const AtomicString& startKeyword()
 {
     DEFINE_STATIC_LOCAL(const AtomicString, start, ("start"));
@@ -87,6 +90,7 @@ TextTrackCue::TextTrackCue(ScriptExecutionContext* context, const String& id, do
     , m_linePosition(-1)
     , m_textPosition(50)
     , m_cueSize(100)
+    , m_cueIndex(invalidCueIndex)
     , m_cueAlignment(Middle)
     , m_scriptExecutionContext(context)
     , m_isActive(false)
@@ -324,6 +328,19 @@ void TextTrackCue::setText(const String& text)
     cueDidChange();
 }
 
+int TextTrackCue::cueIndex()
+{
+    if (m_cueIndex == invalidCueIndex)
+        m_cueIndex = track()->cues()->getCueIndex(this);
+
+    return m_cueIndex;
+}
+
+void TextTrackCue::invalidateCueIndex()
+{
+    m_cueIndex = invalidCueIndex;
+}
+
 PassRefPtr<DocumentFragment> TextTrackCue::getCueAsHTML()
 {
     if (!m_documentFragment)
@@ -337,6 +354,20 @@ void TextTrackCue::setCueHTML(PassRefPtr<DocumentFragment> fragment)
     m_documentFragment = fragment;
 }
 
+bool TextTrackCue::dispatchEvent(PassRefPtr<Event> event)
+{
+    // When a TextTrack's mode is disabled: no cues are active, no events fired.
+    if (!track() || track()->mode() == TextTrack::DISABLED)
+        return false;
+
+    return EventTarget::dispatchEvent(event);
+}
+
+bool TextTrackCue::dispatchEvent(PassRefPtr<Event> event, ExceptionCode &ec)
+{
+    return EventTarget::dispatchEvent(event, ec);
+}
+
 bool TextTrackCue::isActive()
 {
     return m_isActive && track() && track()->mode() != TextTrack::DISABLED;
@@ -345,19 +376,6 @@ bool TextTrackCue::isActive()
 void TextTrackCue::setIsActive(bool active)
 {
     m_isActive = active;
-
-    // When a TextTrack's mode is disabled: No cues are active, no events are fired ...
-    if (!track() || track()->mode() == TextTrack::DISABLED)
-        return;
-
-    ExceptionCode ec = 0;
-    if (active)
-        dispatchEvent(Event::create(eventNames().enterEvent, false, false), ec);
-    else
-        dispatchEvent(Event::create(eventNames().exitEvent, false, false), ec);
-
-    if (m_track)
-        m_track->fireCueChangeEvent();
 }
 
 void TextTrackCue::parseSettings(const String& input)
diff --git a/Source/WebCore/html/TextTrackCue.h b/Source/WebCore/html/track/TextTrackCue.h
index 16faf63ca..b3e0f32a5 100644
--- a/Source/WebCore/html/TextTrackCue.h
+++ b/Source/WebCore/html/track/TextTrackCue.h
@@ -50,7 +50,7 @@ public:
     {
         return adoptRef(new TextTrackCue(context, id, start, end, content, settings, pauseOnExit));
     }
-    
+
     enum Direction { Horizontal, VerticalGrowingLeft, VerticalGrowingRight };
     enum Alignment { Start, Middle, End };
 
@@ -92,12 +92,18 @@ public:
     const String& text() const { return m_content; }
     void setText(const String&);
 
+    int cueIndex();
+    void invalidateCueIndex();
+
     PassRefPtr<DocumentFragment> getCueAsHTML();
     void setCueHTML(PassRefPtr<DocumentFragment>);
 
+    virtual bool dispatchEvent(PassRefPtr<Event>);
+    bool dispatchEvent(PassRefPtr<Event>, ExceptionCode&);
+
     bool isActive();
     void setIsActive(bool);
-    
+
     virtual const AtomicString& interfaceName() const;
     virtual ScriptExecutionContext* scriptExecutionContext() const;
 
@@ -118,10 +124,10 @@ private:
     void parseSettings(const String&);
     void cueWillChange();
     void cueDidChange();
-    
+
     virtual void refEventTarget() { ref(); }
     virtual void derefEventTarget() { deref(); }
-    
+
     String m_id;
     double m_startTime;
     double m_endTime;
@@ -130,6 +136,8 @@ private:
     int m_linePosition;
     int m_textPosition;
     int m_cueSize;
+    int m_cueIndex;
+
     Alignment m_cueAlignment;
     RefPtr<DocumentFragment> m_documentFragment;
     RefPtr<TextTrack> m_track;
diff --git a/Source/WebCore/html/TextTrackCue.idl b/Source/WebCore/html/track/TextTrackCue.idl
index 4f7a40bae..12a827959 100644
--- a/Source/WebCore/html/TextTrackCue.idl
+++ b/Source/WebCore/html/track/TextTrackCue.idl
@@ -29,7 +29,7 @@ module html {
         Conditional=VIDEO_TRACK,
         V8EnabledAtRuntime=webkitVideoTrack,
         JSGenerateToNativeObject,
-        Constructor(in DOMString id, in double startTime, in double endTime, in DOMString text, in [Optional=CallWithDefaultValue] DOMString settings, in [Optional=CallWithDefaultValue] boolean pauseOnExit),
+        Constructor(in DOMString id, in double startTime, in double endTime, in DOMString text, in [Optional=DefaultIsUndefined] DOMString settings, in [Optional=DefaultIsUndefined] boolean pauseOnExit),
         CallWith=ScriptExecutionContext,
         EventTarget,
         JSCustomMarkFunction,
diff --git a/Source/WebCore/html/TextTrackCueList.cpp b/Source/WebCore/html/track/TextTrackCueList.cpp
index 34b71ca1b..391b2f651 100644
--- a/Source/WebCore/html/TextTrackCueList.cpp
+++ b/Source/WebCore/html/track/TextTrackCueList.cpp
@@ -40,6 +40,11 @@ unsigned long TextTrackCueList::length() const
     return m_list.size();
 }
 
+unsigned long TextTrackCueList::getCueIndex(TextTrackCue* cue) const
+{
+    return m_list.find(cue);
+}
+
 TextTrackCue* TextTrackCueList::item(unsigned index) const
 {
     if (index < m_list.size())
@@ -88,6 +93,7 @@ bool TextTrackCueList::add(PassRefPtr<TextTrackCue> prpCue, size_t start, size_t
             return false;
 
        m_list.insert(start, cue);
+       invalidateCueIndexes(start);
        return true;
     }
 
@@ -119,6 +125,12 @@ void TextTrackCueList::clear()
     m_list.clear();
 }
 
+void TextTrackCueList::invalidateCueIndexes(size_t start)
+{
+    for (size_t i = start; i < m_list.size(); ++i)
+        m_list[i]->invalidateCueIndex();
+}
+
 } // namespace WebCore
 
 #endif
diff --git a/Source/WebCore/html/TextTrackCueList.h b/Source/WebCore/html/track/TextTrackCueList.h
index 7a7f90415..90b19a5be 100644
--- a/Source/WebCore/html/TextTrackCueList.h
+++ b/Source/WebCore/html/track/TextTrackCueList.h
@@ -45,6 +45,8 @@ public:
     ~TextTrackCueList() { }
 
     unsigned long length() const;
+    unsigned long getCueIndex(TextTrackCue*) const;
+
     TextTrackCue* item(unsigned index) const;
     TextTrackCue* getCueById(const String&) const;
     TextTrackCueList* activeCues();
@@ -57,10 +59,11 @@ private:
     TextTrackCueList();
     bool add(PassRefPtr<TextTrackCue>, size_t, size_t);
     void clear();
-    
+    void invalidateCueIndexes(size_t);
+
     Vector<RefPtr<TextTrackCue> > m_list;
     RefPtr<TextTrackCueList> m_activeCues;
-    
+
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/html/TextTrackCueList.idl b/Source/WebCore/html/track/TextTrackCueList.idl
index 551840fe9..551840fe9 100644
--- a/Source/WebCore/html/TextTrackCueList.idl
+++ b/Source/WebCore/html/track/TextTrackCueList.idl
diff --git a/Source/WebCore/html/track/TextTrackList.cpp b/Source/WebCore/html/track/TextTrackList.cpp
index 77d9673d4..ead195071 100644
--- a/Source/WebCore/html/track/TextTrackList.cpp
+++ b/Source/WebCore/html/track/TextTrackList.cpp
@@ -55,6 +55,19 @@ unsigned TextTrackList::length() const
     return m_addTrackTracks.size() + m_elementTracks.size();
 }
 
+unsigned TextTrackList::getTrackIndex(TextTrack *textTrack)
+{
+    if (textTrack->trackType() == TextTrack::TrackElement)
+        return static_cast<LoadableTextTrack*>(textTrack)->trackElementIndex();
+
+    if (textTrack->trackType() == TextTrack::AddTrack)
+        return m_elementTracks.size() + m_addTrackTracks.find(textTrack);
+
+    ASSERT_NOT_REACHED();
+
+    return -1;
+}
+
 TextTrack* TextTrackList::item(unsigned index)
 {
     // 4.8.10.12.1 Text track model
@@ -77,13 +90,21 @@ TextTrack* TextTrackList::item(unsigned index)
 void TextTrackList::append(PassRefPtr<TextTrack> prpTrack)
 {
     RefPtr<TextTrack> track = prpTrack;
-    
+
     if (track->trackType() == TextTrack::AddTrack)
         m_addTrackTracks.append(track);
     else if (track->trackType() == TextTrack::TrackElement) {
         // Insert tracks added for <track> element in tree order.
         size_t index = static_cast<LoadableTextTrack*>(track.get())->trackElementIndex();
         m_elementTracks.insert(index, track);
+
+        // Invalidate the cached index for all the following tracks.
+        for (size_t i = index; i < m_elementTracks.size(); ++i)
+            m_elementTracks[i]->invalidateTrackIndex();
+
+        for (size_t i = 0; i < m_addTrackTracks.size(); ++i)
+            m_addTrackTracks[i]->invalidateTrackIndex();
+
     } else
         ASSERT_NOT_REACHED();
 
diff --git a/Source/WebCore/html/track/TextTrackList.h b/Source/WebCore/html/track/TextTrackList.h
index 88d9af62e..f8f04ffa9 100644
--- a/Source/WebCore/html/track/TextTrackList.h
+++ b/Source/WebCore/html/track/TextTrackList.h
@@ -51,6 +51,8 @@ public:
     ~TextTrackList();
 
     unsigned length() const;
+    unsigned getTrackIndex(TextTrack*);
+
     TextTrack* item(unsigned index);
     void append(PassRefPtr<TextTrack>);
     void remove(TextTrack*);
diff --git a/Source/WebCore/inspector/CodeGeneratorInspector.py b/Source/WebCore/inspector/CodeGeneratorInspector.py
index 1bb5bdcdb..0bc7a254b 100755
--- a/Source/WebCore/inspector/CodeGeneratorInspector.py
+++ b/Source/WebCore/inspector/CodeGeneratorInspector.py
@@ -56,7 +56,8 @@ TYPE_NAME_FIX_MAP = {
 }
 
 
-TYPES_WITH_RUNTIME_CAST_SET = frozenset([])
+TYPES_WITH_RUNTIME_CAST_SET = frozenset(["Runtime.RemoteObject", "Runtime.PropertyDescriptor",
+                                         "Debugger.FunctionDetails", "Debugger.CallFrame"])
 
 
 cmdline_parser = optparse.OptionParser()
@@ -180,18 +181,6 @@ class DomainNameFixes:
     skip_js_bind_domains = set(["Runtime", "DOMDebugger"])
 
 
-class CParamType(object):
-    def __init__(self, type, setter_format="%s"):
-        self.type = type
-        self.setter_format = setter_format
-
-    def get_text(self):
-        return self.type
-
-    def get_setter_format(self):
-        return self.setter_format
-
-
 class RawTypes(object):
     @staticmethod
     def get(json_type):
@@ -236,14 +225,6 @@ class RawTypes(object):
         need_internal_runtime_cast_ = False
 
         @classmethod
-        def get_c_param_type(cls, param_type, optional):
-            return cls.default_c_param_type
-
-        @staticmethod
-        def is_event_param_check_optional():
-            return False
-
-        @classmethod
         def request_raw_internal_runtime_cast(cls):
             if not cls.need_internal_runtime_cast_:
                 RawTypes.types_to_generate_validator_.append(cls)
@@ -273,13 +254,6 @@ class RawTypes(object):
 
 
     class String(BaseType):
-        @classmethod
-        def get_c_param_type(cls, param_type, optional):
-            if param_type == ParamType.EVENT or param_type == ParamType.TYPE_BUILDER_OUTPUT:
-                return cls._ref_c_type
-            else:
-                return cls._plain_c_type
-
         @staticmethod
         def get_getter_name():
             return "String"
@@ -314,8 +288,9 @@ class RawTypes(object):
         def get_array_item_raw_c_type_text():
             return "String"
 
-        _plain_c_type = CParamType("String")
-        _ref_c_type = CParamType("const String&")
+        @staticmethod
+        def get_raw_type_model():
+            return TypeModel.String
 
     class Int(BaseType):
         @staticmethod
@@ -354,7 +329,9 @@ class RawTypes(object):
         def get_array_item_raw_c_type_text():
             return "int"
 
-        default_c_param_type = CParamType("int")
+        @staticmethod
+        def get_raw_type_model():
+            return TypeModel.Int
 
     class Number(BaseType):
         @staticmethod
@@ -389,19 +366,11 @@ class RawTypes(object):
         def get_array_item_raw_c_type_text():
             return "double"
 
-        default_c_param_type = CParamType("double")
+        @staticmethod
+        def get_raw_type_model():
+            return TypeModel.Number
 
     class Bool(BaseType):
-        @classmethod
-        def get_c_param_type(cls, param_type, optional):
-            if param_type == ParamType.EVENT:
-                if optional:
-                    return cls._ref_c_type
-                else:
-                    return cls._plain_c_type
-            else:
-                return cls._plain_c_type
-
         @staticmethod
         def get_getter_name():
             return "Boolean"
@@ -417,10 +386,6 @@ class RawTypes(object):
             return "boolean"
 
         @staticmethod
-        def is_event_param_check_optional():
-            return True
-
-        @staticmethod
         def get_validate_method_params():
             class ValidateMethodParams:
                 name = "Boolean"
@@ -440,17 +405,11 @@ class RawTypes(object):
         def get_array_item_raw_c_type_text():
             return "bool"
 
-        _plain_c_type = CParamType("bool")
-        _ref_c_type = CParamType("const bool* const", "*%s")
+        @staticmethod
+        def get_raw_type_model():
+            return TypeModel.Bool
 
     class Object(BaseType):
-        @classmethod
-        def get_c_param_type(cls, param_type, optional):
-            if param_type == ParamType.EVENT or param_type == ParamType.TYPE_BUILDER_OUTPUT:
-                return cls._ref_c_type
-            else:
-                return cls._plain_c_type
-
         @staticmethod
         def get_getter_name():
             return "Object"
@@ -466,10 +425,6 @@ class RawTypes(object):
             return "object"
 
         @staticmethod
-        def is_event_param_check_optional():
-            return True
-
-        @staticmethod
         def get_output_argument_prefix():
             return ""
 
@@ -489,17 +444,11 @@ class RawTypes(object):
         def get_array_item_raw_c_type_text():
             return "InspectorObject"
 
-        _plain_c_type = CParamType("RefPtr<InspectorObject>")
-        _ref_c_type = CParamType("PassRefPtr<InspectorObject>")
+        @staticmethod
+        def get_raw_type_model():
+            return TypeModel.Object
 
     class Any(BaseType):
-        @classmethod
-        def get_c_param_type(cls, param_type, optional):
-            if param_type == ParamType.EVENT or param_type == ParamType.TYPE_BUILDER_OUTPUT:
-                return cls._ref_c_type
-            else:
-                return cls._plain_c_type
-
         @staticmethod
         def get_getter_name():
             return "Value"
@@ -515,12 +464,8 @@ class RawTypes(object):
             raise Exception("Unsupported")
 
         @staticmethod
-        def is_event_param_check_optional():
-            return True
-
-        @staticmethod
         def generate_validate_method(writer):
-            writer.newline("static void assertAny(InspectorValue* value)\n")
+            writer.newline("static void assertAny(InspectorValue*)\n")
             writer.newline("{\n")
             writer.newline("    // No-op.\n")
             writer.newline("}\n\n\n")
@@ -541,19 +486,11 @@ class RawTypes(object):
         def get_array_item_raw_c_type_text():
             return "InspectorValue"
 
-        _plain_c_type = CParamType("RefPtr<InspectorValue>")
-        _ref_c_type = CParamType("PassRefPtr<InspectorValue>")
+        @staticmethod
+        def get_raw_type_model():
+            return TypeModel.Any
 
     class Array(BaseType):
-        @classmethod
-        def get_c_param_type(cls, param_type, optional):
-            if param_type == ParamType.OUTPUT:
-                return cls._plain_c_type
-            elif param_type == ParamType.INPUT:
-                return cls._plain_c_type
-            else:
-                return cls._ref_c_type
-
         @staticmethod
         def get_getter_name():
             return "Array"
@@ -569,10 +506,6 @@ class RawTypes(object):
             return "object"
 
         @staticmethod
-        def is_event_param_check_optional():
-            return True
-
-        @staticmethod
         def get_output_argument_prefix():
             return ""
 
@@ -592,15 +525,171 @@ class RawTypes(object):
         def get_array_item_raw_c_type_text():
             return "InspectorArray"
 
-        _plain_c_type = CParamType("RefPtr<InspectorArray>")
-        _ref_c_type = CParamType("PassRefPtr<InspectorArray>")
+        @staticmethod
+        def get_raw_type_model():
+            return TypeModel.Array
+
+
+def replace_right_shift(input_str):
+    return input_str.replace(">>", "> >")
+
 
+class CommandReturnPassModel:
+    class ByReference:
+        def __init__(self, var_type, set_condition):
+            self.var_type = var_type
+            self.set_condition = set_condition
+
+        def get_return_var_type(self):
+            return self.var_type
+
+        @staticmethod
+        def get_output_argument_prefix():
+            return ""
+
+        @staticmethod
+        def get_output_to_raw_expression():
+            return "%s"
+
+        def get_output_parameter_type(self):
+            return self.var_type + "&"
+
+        def get_set_return_condition(self):
+            return self.set_condition
+
+    class ByPointer:
+        def __init__(self, var_type):
+            self.var_type = var_type
+
+        def get_return_var_type(self):
+            return self.var_type
+
+        @staticmethod
+        def get_output_argument_prefix():
+            return "&"
+
+        @staticmethod
+        def get_output_to_raw_expression():
+            return "%s"
+
+        def get_output_parameter_type(self):
+            return self.var_type + "*"
+
+        @staticmethod
+        def get_set_return_condition():
+            return None
+
+
+class TypeModel:
+    class RefPtrBased:
+        def __init__(self, class_name):
+            self.class_name = class_name
+            self.optional = False
+
+        def get_optional(self):
+            result = TypeModel.RefPtrBased(self.class_name)
+            result.optional = True
+            return result
+
+        def get_command_return_pass_model(self):
+            if self.optional:
+                set_condition = "%s"
+            else:
+                set_condition = None
+            return CommandReturnPassModel.ByReference(replace_right_shift("RefPtr<%s>" % self.class_name), set_condition)
+
+        def get_input_param_type_text(self):
+            return replace_right_shift("PassRefPtr<%s>" % self.class_name)
+
+        @staticmethod
+        def get_event_setter_expression_pattern():
+            return "%s"
+
+    class Enum:
+        def __init__(self, base_type_name):
+            self.type_name = base_type_name + "::Enum"
+
+        def get_optional(base_self):
+            class EnumOptional:
+                @classmethod
+                def get_optional(cls):
+                    return cls
+
+                @staticmethod
+                def get_command_return_pass_model():
+                    # FIXME: to be replaced with OptOutput model.
+                    return CommandReturnPassModel.ByPointer(base_self.type_name)
+
+                @staticmethod
+                def get_input_param_type_text():
+                    return base_self.type_name + "*"
+
+                @staticmethod
+                def get_event_setter_expression_pattern():
+                    raise Exception("TODO")
+            return EnumOptional
+
+        def get_command_return_pass_model(self):
+            return CommandReturnPassModel.ByPointer(self.type_name)
+
+        def get_input_param_type_text(self):
+            return self.type_name
+
+        @staticmethod
+        def get_event_setter_expression_pattern():
+            return "%s"
+
+    class ValueType:
+        def __init__(self, type_name, is_heavy):
+            self.type_name = type_name
+            self.is_heavy = is_heavy
+
+        def get_optional(self):
+            return self.ValueOptional(self)
+
+        def get_command_return_pass_model(self):
+            return CommandReturnPassModel.ByPointer(self.type_name)
+
+        def get_input_param_type_text(self):
+            if self.is_heavy:
+                return "const %s&" % self.type_name
+            else:
+                return self.type_name
+
+        @staticmethod
+        def get_event_setter_expression_pattern():
+            return "%s"
+
+        class ValueOptional:
+            def __init__(self, base):
+                self.base = base
+
+            def get_optional(self):
+                return self
+
+            def get_command_return_pass_model(self):
+                # FIXME: to be replaced with OptOutput model.
+                return CommandReturnPassModel.ByPointer(self.base.type_name)
+
+            def get_input_param_type_text(self):
+                return "const %s* const" % self.base.type_name
+
+            @staticmethod
+            def get_event_setter_expression_pattern():
+                return "*%s"
+
+    @classmethod
+    def init_class(cls):
+        cls.Bool = cls.ValueType("bool", False)
+        cls.Int = cls.ValueType("int", False)
+        cls.Number = cls.ValueType("double", False)
+        cls.String = cls.ValueType("String", True)
+        cls.Object = cls.RefPtrBased("InspectorObject")
+        cls.Array = cls.RefPtrBased("InspectorArray")
+        cls.Any = cls.RefPtrBased("InspectorValue")
+
+TypeModel.init_class()
 
-class ParamType(object):
-    INPUT = "input"
-    OUTPUT = "output"
-    EVENT = "event"
-    TYPE_BUILDER_OUTPUT = "typeBuilderOutput"
 
 # Collection of InspectorObject class methods that are likely to be overloaded in generated class.
 # We must explicitly import all overloaded methods or they won't be available to user.
@@ -725,7 +814,7 @@ class TypeBindings:
     def create_ad_hoc_type_declaration(json_typable, context_domain_name, ad_hoc_type_context):
         class Helper:
             is_ad_hoc = True
-            full_name_prefix_for_use = ""
+            full_name_prefix_for_use = ad_hoc_type_context.container_relative_name_prefix
             full_name_prefix_for_impl = ad_hoc_type_context.container_full_name_prefix
 
             @staticmethod
@@ -832,21 +921,21 @@ class TypeBindings:
                         return helper.full_name_prefix_for_use + fixed_type_name.class_name + "::assertCorrectValue"
 
                     @classmethod
-                    def get_in_c_type_text(cls, optional):
-                        return helper.full_name_prefix_for_use + fixed_type_name.class_name + "::Enum"
-
-                    @classmethod
                     def get_array_item_c_type_text(cls):
-                        return cls.get_in_c_type_text(False)
+                        return helper.full_name_prefix_for_use + fixed_type_name.class_name + "::Enum"
 
                     @staticmethod
                     def get_setter_value_expression_pattern():
-                        return "getEnumConstantValue(%s)"
+                        return "TypeBuilder::getEnumConstantValue(%s)"
 
                     @staticmethod
                     def reduce_to_raw_type():
                         return RawTypes.String
 
+                    @staticmethod
+                    def get_type_model():
+                        return TypeModel.Enum(helper.full_name_prefix_for_use + fixed_type_name.class_name)
+
                 return EnumBinding
             else:
                 if helper.is_ad_hoc:
@@ -877,14 +966,14 @@ class TypeBindings:
                             return RawTypes.String
 
                         @staticmethod
+                        def get_type_model():
+                            return TypeModel.String
+
+                        @staticmethod
                         def get_setter_value_expression_pattern():
                             return None
 
                         @classmethod
-                        def get_in_c_type_text(cls, optional):
-                            return cls.reduce_to_raw_type().get_c_param_type(ParamType.EVENT, optional).get_text()
-
-                        @classmethod
                         def get_array_item_c_type_text(cls):
                             return cls.reduce_to_raw_type().get_array_item_raw_c_type_text()
 
@@ -935,16 +1024,16 @@ class TypeBindings:
                             return RawTypes.String
 
                         @staticmethod
+                        def get_type_model():
+                            return TypeModel.ValueType("%s%s" % (helper.full_name_prefix_for_use, fixed_type_name.class_name), True)
+
+                        @staticmethod
                         def get_setter_value_expression_pattern():
                             return None
 
                         @classmethod
-                        def get_in_c_type_text(cls, optional):
-                            return "const %s%s&" % (helper.full_name_prefix_for_use, fixed_type_name.class_name)
-
-                        @classmethod
                         def get_array_item_c_type_text(cls):
-                            return cls.get_in_c_type_text(False)
+                            return "const %s%s&" % (helper.full_name_prefix_for_use, fixed_type_name.class_name)
 
                     return TypedefString
 
@@ -1220,10 +1309,6 @@ class TypeBindings:
                         return helper.full_name_prefix_for_use + fixed_type_name.class_name + "::assertCorrectValue"
 
                     @classmethod
-                    def get_in_c_type_text(cls, optional):
-                        return "PassRefPtr<" + helper.full_name_prefix_for_use + fixed_type_name.class_name + ">"
-
-                    @classmethod
                     def get_array_item_c_type_text(cls):
                         return helper.full_name_prefix_for_use + fixed_type_name.class_name
 
@@ -1235,6 +1320,10 @@ class TypeBindings:
                     def reduce_to_raw_type():
                         return RawTypes.Object
 
+                    @staticmethod
+                    def get_type_model():
+                        return TypeModel.RefPtrBased(helper.full_name_prefix_for_use + fixed_type_name.class_name)
+
                     class AdHocTypeContextImpl:
                         def __init__(self, property_name, class_name, resolve_context, ad_hoc_type_list, parent_full_name_prefix):
                             self.property_name = property_name
@@ -1242,6 +1331,7 @@ class TypeBindings:
                             self.resolve_context = resolve_context
                             self.ad_hoc_type_list = ad_hoc_type_list
                             self.container_full_name_prefix = parent_full_name_prefix + class_name + "::"
+                            self.container_relative_name_prefix = ""
 
                         def get_type_name_fix(self):
                             class NameFix:
@@ -1281,10 +1371,6 @@ class TypeBindings:
                         raise Exception("Unsupported")
 
                     @classmethod
-                    def get_in_c_type_text(cls, optional):
-                        return cls.reduce_to_raw_type().get_c_param_type(ParamType.EVENT, optional).get_text()
-
-                    @classmethod
                     def get_array_item_c_type_text(cls):
                         return cls.reduce_to_raw_type().get_array_item_raw_c_type_text()
 
@@ -1296,6 +1382,10 @@ class TypeBindings:
                     def reduce_to_raw_type():
                         return RawTypes.Object
 
+                    @staticmethod
+                    def get_type_model():
+                        return TypeModel.Object
+
                 return PlainObjectBinding
         elif json_typable["type"] == "array":
             if "items" in json_typable:
@@ -1304,6 +1394,7 @@ class TypeBindings:
 
                 class AdHocTypeContext:
                     container_full_name_prefix = "<not yet defined>"
+                    container_relative_name_prefix = "<not yet defined>"
 
                     @staticmethod
                     def get_type_name_fix():
@@ -1378,12 +1469,8 @@ class TypeBindings:
                         return cls.get_array_item_c_type_text() + "::assertCorrectValue"
 
                     @classmethod
-                    def get_in_c_type_text(cls, optional):
-                        return "PassRefPtr<TypeBuilder::Array<%s > >" % cls.resolve_data_.item_type_binding.get_array_item_c_type_text()
-
-                    @classmethod
                     def get_array_item_c_type_text(cls):
-                        return "TypeBuilder::Array<%s >" % cls.resolve_data_.item_type_binding.get_array_item_c_type_text()
+                        return replace_right_shift("TypeBuilder::Array<%s>" % cls.resolve_data_.item_type_binding.get_array_item_c_type_text())
 
                     @staticmethod
                     def get_setter_value_expression_pattern():
@@ -1393,6 +1480,10 @@ class TypeBindings:
                     def reduce_to_raw_type():
                         return RawTypes.Array
 
+                    @classmethod
+                    def get_type_model(cls):
+                        return TypeModel.RefPtrBased(cls.get_array_item_c_type_text())
+
                 return ArrayBinding
             else:
                 # Fall-through to raw type.
@@ -1422,9 +1513,6 @@ class RawTypeBinding:
     def get_validator_call_text(self):
         return self.raw_type_.get_raw_validator_call_text()
 
-    def get_in_c_type_text(self, optional):
-        return self.raw_type_.get_c_param_type(ParamType.EVENT, optional).get_text()
-
     def get_array_item_c_type_text(self):
         return self.raw_type_.get_array_item_raw_c_type_text()
 
@@ -1434,6 +1522,9 @@ class RawTypeBinding:
     def reduce_to_raw_type(self):
         return self.raw_type_
 
+    def get_type_model(self):
+        return self.raw_type_.get_raw_type_model()
+
 
 class TypeData(object):
     def __init__(self, json_type, json_domain, domain_data):
@@ -2358,7 +2449,7 @@ class MethodGenerateModes:
     class StrictParameterMode:
         @staticmethod
         def get_c_param_type_text(type_binding):
-            return type_binding.get_in_c_type_text(False)
+            return type_binding.get_type_model().get_input_param_type_text()
 
         @staticmethod
         def get_setter_value_expression(param_type_binding, value_ref):
@@ -2371,7 +2462,7 @@ class MethodGenerateModes:
     class RawParameterMode:
         @staticmethod
         def get_c_param_type_text(type_binding):
-            return type_binding.reduce_to_raw_type().get_c_param_type(ParamType.TYPE_BUILDER_OUTPUT, False).get_text()
+            return type_binding.reduce_to_raw_type().get_raw_type_model().get_input_param_type_text()
 
         @staticmethod
         def get_setter_value_expression(param_type_binding, value_ref):
@@ -2380,8 +2471,8 @@ class MethodGenerateModes:
     class CombinedMode:
         @staticmethod
         def get_c_param_type_text(type_binding):
-            return get_annotated_type_text(type_binding.reduce_to_raw_type().get_c_param_type(ParamType.TYPE_BUILDER_OUTPUT, False).get_text(),
-                type_binding.get_in_c_type_text(False))
+            return get_annotated_type_text(type_binding.reduce_to_raw_type().get_raw_type_model().get_input_param_type_text(),
+                type_binding.get_type_model().get_input_param_type_text())
 
         @staticmethod
         def get_setter_value_expression(param_type_binding, value_ref):
@@ -2470,7 +2561,7 @@ class Generator:
             Generator.backend_agent_interface_list.append("    public:\n")
             if "commands" in json_domain:
                 for json_command in json_domain["commands"]:
-                    Generator.process_command(json_command, domain_name, agent_field_name)
+                    Generator.process_command(json_command, domain_name, agent_field_name, agent_interface_name)
             Generator.backend_agent_interface_list.append("\n    protected:\n")
             Generator.backend_agent_interface_list.append("        virtual ~%s() { }\n" % agent_interface_name)
             Generator.backend_agent_interface_list.append("    };\n\n")
@@ -2527,63 +2618,28 @@ class Generator:
             for json_parameter in json_event["parameters"]:
                 parameter_name = json_parameter["name"]
 
-                raw_type = resolve_param_raw_type(json_parameter, domain_name)
+                param_type_binding = Generator.resolve_type_and_generate_ad_hoc(json_parameter, event_name, domain_name, ad_hoc_type_writer, "")
 
-                json_optional = "optional" in json_parameter and json_parameter["optional"]
+                raw_type = param_type_binding.reduce_to_raw_type()
+                raw_type_binding = RawTypeBinding(raw_type)
 
-                optional_mask = raw_type.is_event_param_check_optional()
-                c_type = raw_type.get_c_param_type(ParamType.EVENT, json_optional)
+                optional = bool(json_parameter.get("optional"))
 
                 setter_type = raw_type.get_setter_name()
 
-                optional = optional_mask and json_optional
-
-                ad_hoc_type_list = []
-
-                class AdHocTypeContext:
-                    container_full_name_prefix = "<not yet defined>"
-
-                    @staticmethod
-                    def get_type_name_fix():
-                        class NameFix:
-                            class_name = Capitalizer.lower_camel_case_to_upper(parameter_name)
-
-                            @staticmethod
-                            def output_comment(writer):
-                                writer.newline("// Named after parameter name '%s' while generating event %s.\n" % (parameter_name, event_name))
-
-                        return NameFix
-
-                    @staticmethod
-                    def add_type(binding):
-                        ad_hoc_type_list.append(binding)
-
-                param_type_binding = resolve_param_type(json_parameter, domain_name, AdHocTypeContext)
-
-                class EventForwardListener:
-                    @staticmethod
-                    def add_type_data(type_data):
-                        pass
-
-                class EventResolveContext:
-                    forward_listener = EventForwardListener
-
-                for type in ad_hoc_type_list:
-                    type.resolve_inner(EventResolveContext)
-
-                class EventGenerateContext:
-                    validator_writer = "not supported in EventGenerateContext"
-
-                for type in ad_hoc_type_list:
-                    generator = type.get_code_generator()
-                    if generator:
-                        generator.generate_type_builder(ad_hoc_type_writer, EventGenerateContext)
+                type_model = param_type_binding.get_type_model()
+                raw_type_model = raw_type_binding.get_type_model()
+                if optional:
+                    type_model = type_model.get_optional()
+                    raw_type_model = raw_type_model.get_optional()
 
-                annotated_type = get_annotated_type_text(c_type.get_text(), param_type_binding.get_in_c_type_text(json_optional))
+                annotated_type = get_annotated_type_text(raw_type_model.get_input_param_type_text(), type_model.get_input_param_type_text())
 
                 parameter_list.append("%s %s" % (annotated_type, parameter_name))
 
-                setter_argument = c_type.get_setter_format() % parameter_name
+                setter_argument = raw_type_model.get_event_setter_expression_pattern() % parameter_name
+                if raw_type_binding.get_setter_value_expression_pattern():
+                    setter_argument = raw_type_binding.get_setter_value_expression_pattern() % setter_argument
 
                 setter_code = "    paramsObject->set%s(\"%s\", %s);\n" % (setter_type, parameter_name, setter_argument)
                 if optional:
@@ -2604,12 +2660,16 @@ class Generator:
             domain_name, event_name, join(backend_js_event_param_list, ", ")))
 
     @staticmethod
-    def process_command(json_command, domain_name, agent_field_name):
+    def process_command(json_command, domain_name, agent_field_name, agent_interface_name):
         json_command_name = json_command["name"]
         Generator.method_name_enum_list.append("        k%s_%sCmd," % (domain_name, json_command["name"]))
         Generator.method_handler_list.append("            &InspectorBackendDispatcherImpl::%s_%s," % (domain_name, json_command_name))
         Generator.backend_method_declaration_list.append("    void %s_%s(long callId, InspectorObject* requestMessageObject);" % (domain_name, json_command_name))
 
+        ad_hoc_type_output = []
+        Generator.backend_agent_interface_list.append(ad_hoc_type_output)
+        ad_hoc_type_writer = Writer(ad_hoc_type_output, "        ")
+
         Generator.backend_agent_interface_list.append("        virtual void %s(ErrorString*" % json_command_name)
 
         method_in_code = ""
@@ -2629,21 +2689,28 @@ class Generator:
                 json_param_name = json_parameter["name"]
                 param_raw_type = resolve_param_raw_type(json_parameter, domain_name)
 
-                var_type = param_raw_type.get_c_param_type(ParamType.INPUT, None)
-                formal_param_type = var_type
                 getter_name = param_raw_type.get_getter_name()
 
                 optional = json_parameter.get("optional")
+
+                non_optional_type_model = param_raw_type.get_raw_type_model()
+                if optional:
+                    type_model = non_optional_type_model.get_optional()
+                else:
+                    type_model = non_optional_type_model
+
                 if optional:
                     code = ("    bool %s_valueFound = false;\n"
                             "    %s in_%s = get%s(paramsContainerPtr, \"%s\", &%s_valueFound, protocolErrorsPtr);\n" %
-                           (json_param_name, var_type.get_text(), json_param_name, getter_name, json_param_name, json_param_name))
+                           (json_param_name, non_optional_type_model.get_command_return_pass_model().get_return_var_type(), json_param_name, getter_name, json_param_name, json_param_name))
                     param = ", %s_valueFound ? &in_%s : 0" % (json_param_name, json_param_name)
+                    # FIXME: pass optional refptr-values as PassRefPtr
                     formal_param_type_pattern = "const %s*"
                 else:
                     code = ("    %s in_%s = get%s(paramsContainerPtr, \"%s\", 0, protocolErrorsPtr);\n" %
-                            (var_type.get_text(), json_param_name, getter_name, json_param_name))
+                            (non_optional_type_model.get_command_return_pass_model().get_return_var_type(), json_param_name, getter_name, json_param_name))
                     param = ", in_%s" % json_param_name
+                    # FIXME: pass not-optional refptr-values as NonNullPassRefPtr
                     if param_raw_type.is_heavy_value():
                         formal_param_type_pattern = "const %s&"
                     else:
@@ -2651,7 +2718,7 @@ class Generator:
 
                 method_in_code += code
                 agent_call_param_list.append(param)
-                Generator.backend_agent_interface_list.append(", %s in_%s" % (formal_param_type_pattern % formal_param_type.get_text(), json_param_name))
+                Generator.backend_agent_interface_list.append(", %s in_%s" % (formal_param_type_pattern % non_optional_type_model.get_command_return_pass_model().get_return_var_type(), json_param_name))
 
                 js_bind_type = param_raw_type.get_js_bind_type()
                 js_param_text = "{\"name\": \"%s\", \"type\": \"%s\", \"optional\": %s}" % (
@@ -2671,28 +2738,46 @@ class Generator:
 
                 json_return_name = json_return["name"]
 
-                optional = "optional" in json_return and json_return["optional"]
+                optional = bool(json_return.get("optional"))
+
+                return_type_binding = Generator.resolve_type_and_generate_ad_hoc(json_return, json_command_name, domain_name, ad_hoc_type_writer, agent_interface_name + "::")
 
-                raw_type = resolve_param_raw_type(json_return, domain_name)
+                raw_type = return_type_binding.reduce_to_raw_type()
                 setter_type = raw_type.get_setter_name()
                 initializer = raw_type.get_c_initializer()
-                var_type = raw_type.get_c_param_type(ParamType.OUTPUT, None)
 
-                code = "    %s out_%s = %s;\n" % (var_type.get_text(), json_return_name, initializer)
+                type_model = return_type_binding.get_type_model()
+                if optional:
+                    type_model = type_model.get_optional()
+
+                raw_type_model = return_type_binding.get_type_model()
+                if optional:
+                    raw_type_model = raw_type_model.get_optional()
+
+                code = "    %s out_%s = %s;\n" % (raw_type.get_raw_type_model().get_command_return_pass_model().get_return_var_type(), json_return_name, initializer)
                 param = ", %sout_%s" % (raw_type.get_output_pass_model().get_argument_prefix(), json_return_name)
                 cook = "        result->set%s(\"%s\", out_%s);\n" % (setter_type, json_return_name, json_return_name)
                 if optional:
                     # FIXME: support optional properly. Probably an additional output parameter should be in each case.
                     # FIXME: refactor this condition; it's a hack now.
-                    if var_type.get_text() == "bool" or var_type.get_text().startswith("RefPtr<"):
+                    var_type_text = raw_type.get_raw_type_model().get_command_return_pass_model().get_return_var_type()
+                    if var_type_text == "bool" or var_type_text.startswith("RefPtr<"):
                         cook = ("        if (out_%s)\n    " % json_return_name) + cook
                     else:
                         cook = "        // FIXME: support optional here.\n" + cook
 
+                annotated_type = get_annotated_type_text(raw_type.get_raw_type_model().get_command_return_pass_model().get_return_var_type() + raw_type.get_output_pass_model().get_parameter_type_suffix(),
+                                                         type_model.get_command_return_pass_model().get_output_parameter_type())
+
+                param_name = "out_%s" % json_return_name
+                if optional:
+                    param_name = "opt_" + param_name
+
+                Generator.backend_agent_interface_list.append(", %s %s" % (annotated_type, param_name))
+                response_cook_list.append(cook)
+
                 method_out_code += code
                 agent_call_param_list.append(param)
-                Generator.backend_agent_interface_list.append(", %s%s out_%s" % (var_type.get_text(), raw_type.get_output_pass_model().get_parameter_type_suffix(), json_return_name))
-                response_cook_list.append(cook)
 
                 backend_js_reply_param_list.append("\"%s\"" % json_return_name)
 
@@ -2714,6 +2799,53 @@ class Generator:
         Generator.backend_agent_interface_list.append(") = 0;\n")
 
     @staticmethod
+    def resolve_type_and_generate_ad_hoc(json_param, method_name, domain_name, ad_hoc_type_writer, container_relative_name_prefix_param):
+        param_name = json_param["name"]
+        ad_hoc_type_list = []
+
+        class AdHocTypeContext:
+            container_full_name_prefix = "<not yet defined>"
+            container_relative_name_prefix = container_relative_name_prefix_param
+
+            @staticmethod
+            def get_type_name_fix():
+                class NameFix:
+                    class_name = Capitalizer.lower_camel_case_to_upper(param_name)
+
+                    @staticmethod
+                    def output_comment(writer):
+                        writer.newline("// Named after parameter '%s' while generating command/event %s.\n" % (param_name, method_name))
+
+                return NameFix
+
+            @staticmethod
+            def add_type(binding):
+                ad_hoc_type_list.append(binding)
+
+        type_binding = resolve_param_type(json_param, domain_name, AdHocTypeContext)
+
+        class InterfaceForwardListener:
+            @staticmethod
+            def add_type_data(type_data):
+                pass
+
+        class InterfaceResolveContext:
+            forward_listener = InterfaceForwardListener
+
+        for type in ad_hoc_type_list:
+            type.resolve_inner(InterfaceResolveContext)
+
+        class InterfaceGenerateContext:
+            validator_writer = "not supported in InterfaceGenerateContext"
+
+        for type in ad_hoc_type_list:
+            generator = type.get_code_generator()
+            if generator:
+                generator.generate_type_builder(ad_hoc_type_writer, InterfaceGenerateContext)
+
+        return type_binding
+
+    @staticmethod
     def process_types(type_map):
         output = Generator.type_builder_fragments
 
@@ -2807,7 +2939,7 @@ backend_js_file = open(output_cpp_dirname + "/InspectorBackendStub.js", "w")
 
 backend_h_file.write(Templates.backend_h.substitute(None,
     virtualSetters=join(Generator.backend_virtual_setters_list, "\n"),
-    agentInterfaces=join(Generator.backend_agent_interface_list, ""),
+    agentInterfaces=join(flatten_list(Generator.backend_agent_interface_list), ""),
     methodNamesEnumContent=join(Generator.method_name_enum_list, "\n")))
 
 backend_cpp_file.write(Templates.backend_cpp.substitute(None,
diff --git a/Source/WebCore/inspector/DOMEditor.cpp b/Source/WebCore/inspector/DOMEditor.cpp
index 63afa9639..e1cb23c10 100644
--- a/Source/WebCore/inspector/DOMEditor.cpp
+++ b/Source/WebCore/inspector/DOMEditor.cpp
@@ -33,424 +33,427 @@
 
 #if ENABLE(INSPECTOR)
 
-#include "Attribute.h"
-#include "Base64.h"
+#include "DOMPatchSupport.h"
 #include "Document.h"
-#include "DocumentFragment.h"
-#include "HTMLDocument.h"
-#include "HTMLDocumentParser.h"
-#include "HTMLElement.h"
-#include "HTMLHeadElement.h"
-#include "HTMLNames.h"
+#include "Element.h"
+#include "ExceptionCode.h"
+#include "InspectorHistory.h"
 #include "Node.h"
+#include "Text.h"
+
+#include "markup.h"
 
-#include <wtf/Deque.h>
 #include <wtf/RefPtr.h>
-#include <wtf/SHA1.h>
-#include <wtf/text/CString.h>
 
 using namespace std;
 
 namespace WebCore {
 
-using HTMLNames::bodyTag;
-using HTMLNames::headTag;
-using HTMLNames::htmlTag;
+class DOMEditor::RemoveChildAction : public InspectorHistory::Action {
+    WTF_MAKE_NONCOPYABLE(RemoveChildAction);
+public:
+    RemoveChildAction(Node* parentNode, Node* node)
+        : InspectorHistory::Action("RemoveChild")
+        , m_parentNode(parentNode)
+        , m_node(node)
+    {
+    }
 
-struct DOMEditor::Digest {
-    explicit Digest(Node* node) : m_node(node) { }
+    virtual bool perform(ExceptionCode& ec)
+    {
+        m_anchorNode = m_node->nextSibling();
+        return redo(ec);
+    }
 
-    String m_sha1;
-    String m_attrsSHA1;
-    Node* m_node;
-    Vector<OwnPtr<Digest> > m_children;
-};
+    virtual bool undo(ExceptionCode& ec)
+    {
+        return m_parentNode->insertBefore(m_node.get(), m_anchorNode.get(), ec);
+    }
 
-DOMEditor::DOMEditor(Document* document) : m_document(document) { }
+    virtual bool redo(ExceptionCode& ec)
+    {
+        return m_parentNode->removeChild(m_node.get(), ec);
+    }
 
-DOMEditor::~DOMEditor() { }
+private:
+    RefPtr<Node> m_parentNode;
+    RefPtr<Node> m_node;
+    RefPtr<Node> m_anchorNode;
+};
 
-void DOMEditor::patchDocument(const String& markup)
-{
-    RefPtr<HTMLDocument> newDocument = HTMLDocument::create(0, KURL());
-    RefPtr<DocumentParser> parser = HTMLDocumentParser::create(newDocument.get(), false);
-    parser->insert(markup); // Use insert() so that the parser will not yield.
-    parser->finish();
-    parser->detach();
+class DOMEditor::InsertBeforeAction : public InspectorHistory::Action {
+    WTF_MAKE_NONCOPYABLE(InsertBeforeAction);
+public:
+    InsertBeforeAction(Node* parentNode, PassRefPtr<Node> node, Node* anchorNode)
+        : InspectorHistory::Action("InsertBefore")
+        , m_parentNode(parentNode)
+        , m_node(node)
+        , m_anchorNode(anchorNode)
+    {
+    }
 
-    ExceptionCode ec = 0;
-    OwnPtr<Digest> oldInfo = createDigest(m_document->documentElement(), 0);
-    OwnPtr<Digest> newInfo = createDigest(newDocument->documentElement(), &m_unusedNodesMap);
-    innerPatchNode(oldInfo.get(), newInfo.get(), ec);
+    virtual bool perform(ExceptionCode& ec)
+    {
+        if (m_node->parentNode()) {
+            m_removeChildAction = adoptPtr(new RemoveChildAction(m_node->parentNode(), m_node.get()));
+            if (!m_removeChildAction->perform(ec))
+                return false;
+        }
+        return m_parentNode->insertBefore(m_node.get(), m_anchorNode.get(), ec);
+    }
 
-    if (ec) {
-        // Fall back to rewrite.
-        m_document->write(markup);
-        m_document->close();
+    virtual bool undo(ExceptionCode& ec)
+    {
+        if (!m_parentNode->removeChild(m_node.get(), ec))
+            return false;
+        if (m_removeChildAction)
+            return m_removeChildAction->undo(ec);
+        return true;
     }
-}
 
-Node* DOMEditor::patchNode(Node* node, const String& markup, ExceptionCode& ec)
-{
-    // Don't parse <html> as a fragment.
-    if (node->isDocumentNode() || (node->parentNode() && node->parentNode()->isDocumentNode())) {
-        patchDocument(markup);
-        return 0;
-    }
-
-    Node* previousSibling = node->previousSibling();
-    RefPtr<DocumentFragment> fragment = DocumentFragment::create(m_document);
-    fragment->parseHTML(markup, node->parentElement() ? node->parentElement() : m_document->documentElement());
-
-    // Compose the old list.
-    ContainerNode* parentNode = node->parentNode();
-    Vector<OwnPtr<Digest> > oldList;
-    for (Node* child = parentNode->firstChild(); child; child = child->nextSibling())
-        oldList.append(createDigest(child, 0));
-
-    // Compose the new list.
-    String markupCopy = markup;
-    markupCopy.makeLower();
-    Vector<OwnPtr<Digest> > newList;
-    for (Node* child = parentNode->firstChild(); child != node; child = child->nextSibling())
-        newList.append(createDigest(child, 0));
-    for (Node* child = fragment->firstChild(); child; child = child->nextSibling()) {
-        if (child->hasTagName(headTag) && !child->firstChild() && markupCopy.find("</head>") == notFound)
-            continue; // HTML5 parser inserts empty <head> tag whenever it parses <body>
-        if (child->hasTagName(bodyTag) && !child->firstChild() && markupCopy.find("</body>") == notFound)
-            continue; // HTML5 parser inserts empty <body> tag whenever it parses </head>
-        newList.append(createDigest(child, &m_unusedNodesMap));
-    }
-    for (Node* child = node->nextSibling(); child; child = child->nextSibling())
-        newList.append(createDigest(child, 0));
-
-    innerPatchChildren(parentNode, oldList, newList, ec);
-    if (ec) {
-        // Fall back to total replace.
-        ec = 0;
-        parentNode->replaceChild(fragment.release(), node, ec);
-        if (ec)
-            return 0;
+    virtual bool redo(ExceptionCode& ec)
+    {
+        if (m_removeChildAction && !m_removeChildAction->redo(ec))
+            return false;
+        return m_parentNode->insertBefore(m_node.get(), m_anchorNode.get(), ec);
     }
-    return previousSibling ? previousSibling->nextSibling() : parentNode->firstChild();
-}
 
-void DOMEditor::innerPatchNode(Digest* oldDigest, Digest* newDigest, ExceptionCode& ec)
-{
-    if (oldDigest->m_sha1 == newDigest->m_sha1)
-        return;
+private:
+    RefPtr<Node> m_parentNode;
+    RefPtr<Node> m_node;
+    RefPtr<Node> m_anchorNode;
+    OwnPtr<RemoveChildAction> m_removeChildAction;
+};
 
-    Node* oldNode = oldDigest->m_node;
-    Node* newNode = newDigest->m_node;
+class DOMEditor::RemoveAttributeAction : public InspectorHistory::Action {
+    WTF_MAKE_NONCOPYABLE(RemoveAttributeAction);
+public:
+    RemoveAttributeAction(Element* element, const String& name)
+        : InspectorHistory::Action("RemoveAttribute")
+        , m_element(element)
+        , m_name(name)
+    {
+    }
 
-    if (newNode->nodeType() != oldNode->nodeType() || newNode->nodeName() != oldNode->nodeName()) {
-        oldNode->parentNode()->replaceChild(newNode, oldNode, ec);
-        return;
+    virtual bool perform(ExceptionCode& ec)
+    {
+        m_value = m_element->getAttribute(m_name);
+        return redo(ec);
     }
 
-    if (oldNode->nodeValue() != newNode->nodeValue())
-        oldNode->setNodeValue(newNode->nodeValue(), ec);
-    if (ec)
-        return;
+    virtual bool undo(ExceptionCode& ec)
+    {
+        m_element->setAttribute(m_name, m_value, ec);
+        return true;
+    }
 
-    if (oldNode->nodeType() != Node::ELEMENT_NODE)
-        return;
+    virtual bool redo(ExceptionCode&)
+    {
+        m_element->removeAttribute(m_name);
+        return true;
+    }
 
-    // Patch attributes
-    Element* oldElement = static_cast<Element*>(oldNode);
-    Element* newElement = static_cast<Element*>(newNode);
-    if (oldDigest->m_attrsSHA1 != newDigest->m_attrsSHA1) {
-        // FIXME: Create a function in Element for removing all properties. Take in account whether did/willModifyAttribute are important.
-        if (oldElement->hasAttributesWithoutUpdate()) {
-            while (oldElement->attributeCount())
-                oldElement->removeAttribute(0);
-        }
+private:
+    RefPtr<Element> m_element;
+    String m_name;
+    String m_value;
+};
 
-        // FIXME: Create a function in Element for copying properties. setAttributesFromElement() is close but not enough for this case.
-        if (newElement->hasAttributesWithoutUpdate()) {
-            size_t numAttrs = newElement->attributeCount();
-            for (size_t i = 0; i < numAttrs; ++i) {
-                const Attribute* attribute = newElement->attributeItem(i);
-                oldElement->setAttribute(attribute->name(), attribute->value());
-            }
-        }
+class DOMEditor::SetAttributeAction : public InspectorHistory::Action {
+    WTF_MAKE_NONCOPYABLE(SetAttributeAction);
+public:
+    SetAttributeAction(Element* element, const String& name, const String& value)
+        : InspectorHistory::Action("SetAttribute")
+        , m_element(element)
+        , m_name(name)
+        , m_value(value)
+        , m_hadAttribute(false)
+    {
     }
 
-    innerPatchChildren(oldElement, oldDigest->m_children, newDigest->m_children, ec);
-    m_unusedNodesMap.remove(newDigest->m_sha1);
-}
+    virtual bool perform(ExceptionCode& ec)
+    {
+        m_hadAttribute = m_element->hasAttribute(m_name);
+        if (m_hadAttribute)
+            m_oldValue = m_element->getAttribute(m_name);
+        return redo(ec);
+    }
 
-pair<DOMEditor::ResultMap, DOMEditor::ResultMap>
-DOMEditor::diff(const Vector<OwnPtr<Digest> >& oldList, const Vector<OwnPtr<Digest> >& newList)
-{
-    ResultMap newMap(newList.size());
-    ResultMap oldMap(oldList.size());
+    virtual bool undo(ExceptionCode& ec)
+    {
+        if (m_hadAttribute)
+            m_element->setAttribute(m_name, m_oldValue, ec);
+        else
+            m_element->removeAttribute(m_name);
+        return true;
+    }
 
-    for (size_t i = 0; i < oldMap.size(); ++i) {
-        oldMap[i].first = 0;
-        oldMap[i].second = 0;
+    virtual bool redo(ExceptionCode& ec)
+    {
+        m_element->setAttribute(m_name, m_value, ec);
+        return true;
     }
 
-    for (size_t i = 0; i < newMap.size(); ++i) {
-        newMap[i].first = 0;
-        newMap[i].second = 0;
+private:
+    RefPtr<Element> m_element;
+    String m_name;
+    String m_value;
+    bool m_hadAttribute;
+    String m_oldValue;
+};
+
+class DOMEditor::SetOuterHTMLAction : public InspectorHistory::Action {
+    WTF_MAKE_NONCOPYABLE(SetOuterHTMLAction);
+public:
+    SetOuterHTMLAction(Node* node, const String& html)
+        : InspectorHistory::Action("SetOuterHTML")
+        , m_node(node)
+        , m_nextSibling(node->nextSibling())
+        , m_html(html)
+        , m_newNode(0)
+        , m_history(adoptPtr(new InspectorHistory()))
+        , m_domEditor(adoptPtr(new DOMEditor(m_history.get())))
+    {
     }
 
-    // Trim head and tail.
-    for (size_t i = 0; i < oldList.size() && i < newList.size() && oldList[i]->m_sha1 == newList[i]->m_sha1; ++i) {
-        oldMap[i].first = oldList[i].get();
-        oldMap[i].second = i;
-        newMap[i].first = newList[i].get();
-        newMap[i].second = i;
+    virtual bool perform(ExceptionCode& ec)
+    {
+        m_oldHTML = createMarkup(m_node.get());
+        DOMPatchSupport domPatchSupport(m_domEditor.get(), m_node->ownerDocument());
+        m_newNode = domPatchSupport.patchNode(m_node.get(), m_html, ec);
+        return !ec;
     }
-    for (size_t i = 0; i < oldList.size() && i < newList.size() && oldList[oldList.size() - i - 1]->m_sha1 == newList[newList.size() - i - 1]->m_sha1; ++i) {
-        size_t oldIndex = oldList.size() - i - 1;
-        size_t newIndex = newList.size() - i - 1;
-        oldMap[oldIndex].first = oldList[oldIndex].get();
-        oldMap[oldIndex].second = newIndex;
-        newMap[newIndex].first = newList[newIndex].get();
-        newMap[newIndex].second = oldIndex;
+
+    virtual bool undo(ExceptionCode& ec)
+    {
+        return m_history->undo(ec);
     }
 
-    typedef HashMap<String, Vector<size_t> > DiffTable;
-    DiffTable newTable;
-    DiffTable oldTable;
+    virtual bool redo(ExceptionCode& ec)
+    {
+        return m_history->redo(ec);
+    }
 
-    for (size_t i = 0; i < newList.size(); ++i) {
-        DiffTable::iterator it = newTable.add(newList[i]->m_sha1, Vector<size_t>()).first;
-        it->second.append(i);
+    Node* newNode()
+    {
+        return m_newNode;
     }
 
-    for (size_t i = 0; i < oldList.size(); ++i) {
-        DiffTable::iterator it = oldTable.add(oldList[i]->m_sha1, Vector<size_t>()).first;
-        it->second.append(i);
+private:
+    RefPtr<Node> m_node;
+    RefPtr<Node> m_nextSibling;
+    String m_html;
+    String m_oldHTML;
+    Node* m_newNode;
+    OwnPtr<InspectorHistory> m_history;
+    OwnPtr<DOMEditor> m_domEditor;
+};
+
+class DOMEditor::ReplaceWholeTextAction : public InspectorHistory::Action {
+    WTF_MAKE_NONCOPYABLE(ReplaceWholeTextAction);
+public:
+    ReplaceWholeTextAction(Text* textNode, const String& text)
+        : InspectorHistory::Action("ReplaceWholeText")
+        , m_textNode(textNode)
+        , m_text(text)
+    {
     }
 
-    for (DiffTable::iterator newIt = newTable.begin(); newIt != newTable.end(); ++newIt) {
-        if (newIt->second.size() != 1)
-            continue;
+    virtual bool perform(ExceptionCode& ec)
+    {
+        m_oldText = m_textNode->wholeText();
+        return redo(ec);
+    }
 
-        DiffTable::iterator oldIt = oldTable.find(newIt->first);
-        if (oldIt == oldTable.end() || oldIt->second.size() != 1)
-            continue;
+    virtual bool undo(ExceptionCode& ec)
+    {
+        m_textNode->replaceWholeText(m_oldText, ec);
+        return true;
+    }
 
-        newMap[newIt->second[0]] = make_pair(newList[newIt->second[0]].get(), oldIt->second[0]);
-        oldMap[oldIt->second[0]] = make_pair(oldList[oldIt->second[0]].get(), newIt->second[0]);
+    virtual bool redo(ExceptionCode& ec)
+    {
+        m_textNode->replaceWholeText(m_text, ec);
+        return true;
     }
 
-    for (size_t i = 0; newList.size() > 0 && i < newList.size() - 1; ++i) {
-        if (!newMap[i].first || newMap[i + 1].first)
-            continue;
+private:
+    RefPtr<Text> m_textNode;
+    String m_text;
+    String m_oldText;
+};
 
-        size_t j = newMap[i].second + 1;
-        if (j < oldMap.size() && !oldMap[j].first && newList[i + 1]->m_sha1 == oldList[j]->m_sha1) {
-            newMap[i + 1] = make_pair(newList[i + 1].get(), j);
-            oldMap[j] = make_pair(oldList[j].get(), i + 1);
-        }
+class DOMEditor::ReplaceChildNodeAction : public InspectorHistory::Action {
+    WTF_MAKE_NONCOPYABLE(ReplaceChildNodeAction);
+public:
+    ReplaceChildNodeAction(Node* parentNode, PassRefPtr<Node> newNode, Node* oldNode)
+        : InspectorHistory::Action("ReplaceChildNode")
+        , m_parentNode(parentNode)
+        , m_newNode(newNode)
+        , m_oldNode(oldNode)
+    {
     }
 
-    for (size_t i = newList.size() - 1; newList.size() > 0 && i > 0; --i) {
-        if (!newMap[i].first || newMap[i - 1].first || newMap[i].second <= 0)
-            continue;
+    virtual bool perform(ExceptionCode& ec)
+    {
+        return redo(ec);
+    }
 
-        size_t j = newMap[i].second - 1;
-        if (!oldMap[j].first && newList[i - 1]->m_sha1 == oldList[j]->m_sha1) {
-            newMap[i - 1] = make_pair(newList[i - 1].get(), j);
-            oldMap[j] = make_pair(oldList[j].get(), i - 1);
-        }
+    virtual bool undo(ExceptionCode& ec)
+    {
+        return m_parentNode->replaceChild(m_oldNode, m_newNode.get(), ec);
     }
 
-    return make_pair(oldMap, newMap);
-}
+    virtual bool redo(ExceptionCode& ec)
+    {
+        return m_parentNode->replaceChild(m_newNode, m_oldNode.get(), ec);
+    }
 
-void DOMEditor::innerPatchChildren(ContainerNode* parentNode, const Vector<OwnPtr<Digest> >& oldList, const Vector<OwnPtr<Digest> >& newList, ExceptionCode& ec)
-{
-    pair<ResultMap, ResultMap> resultMaps = diff(oldList, newList);
-    ResultMap& oldMap = resultMaps.first;
-    ResultMap& newMap = resultMaps.second;
-
-    Digest* oldHead = 0;
-    Digest* oldBody = 0;
-
-    // 1. First strip everything except for the nodes that retain. Collect pending merges.
-    HashMap<Digest*, Digest*> merges;
-    for (size_t i = 0; i < oldList.size(); ++i) {
-        if (oldMap[i].first)
-            continue;
-
-        // Always match <head> and <body> tags with each other - we can't remove them from the DOM
-        // upon patching.
-        if (oldList[i]->m_node->hasTagName(headTag)) {
-            oldHead = oldList[i].get();
-            continue;
-        }
-        if (oldList[i]->m_node->hasTagName(bodyTag)) {
-            oldBody = oldList[i].get();
-            continue;
-        }
+private:
+    RefPtr<Node> m_parentNode;
+    RefPtr<Node> m_newNode;
+    RefPtr<Node> m_oldNode;
+};
 
-        // Check if this change is between stable nodes. If it is, consider it as "modified".
-        if (!m_unusedNodesMap.contains(oldList[i]->m_sha1) && (!i || oldMap[i - 1].first) && (i == oldMap.size() - 1 || oldMap[i + 1].first)) {
-            size_t anchorCandidate = i ? oldMap[i - 1].second + 1 : 0;
-            size_t anchorAfter = i == oldMap.size() - 1 ? anchorCandidate + 1 : oldMap[i + 1].second;
-            if (anchorAfter - anchorCandidate == 1 && anchorCandidate < newList.size())
-                merges.set(newList[anchorCandidate].get(), oldList[i].get());
-            else {
-                removeChild(oldList[i].get(), ec);
-                if (ec)
-                    return;
-            }
-        } else {
-            removeChild(oldList[i].get(), ec);
-            if (ec)
-                return;
-        }
+class DOMEditor::SetNodeValueAction : public InspectorHistory::Action {
+    WTF_MAKE_NONCOPYABLE(SetNodeValueAction);
+public:
+    SetNodeValueAction(Node* node, const String& value)
+        : InspectorHistory::Action("SetNodeValue")
+        , m_node(node)
+        , m_value(value)
+    {
     }
 
-    // Mark retained nodes as used.
-    for (size_t i = 0; i < newList.size(); ++i) {
-        if (newMap[i].first)
-            markNodeAsUsed(newMap[i].first);
+    virtual bool perform(ExceptionCode& ec)
+    {
+        m_oldValue = m_node->nodeValue();
+        return redo(ec);
     }
 
-    // Mark <head> and <body> nodes for merge.
-    if (oldHead || oldBody) {
-        for (size_t i = 0; i < newList.size(); ++i) {
-            if (oldHead && newList[i]->m_node->hasTagName(headTag))
-                merges.set(newList[i].get(), oldHead);
-            if (oldBody && newList[i]->m_node->hasTagName(bodyTag))
-                merges.set(newList[i].get(), oldBody);
-        }
+    virtual bool undo(ExceptionCode& ec)
+    {
+        m_node->setNodeValue(m_oldValue, ec);
+        return !ec;
     }
 
-    // 2. Patch nodes marked for merge.
-    for (HashMap<Digest*, Digest*>::iterator it = merges.begin(); it != merges.end(); ++it) {
-        innerPatchNode(it->second, it->first, ec);
-        if (ec)
-            return;
+    virtual bool redo(ExceptionCode& ec)
+    {
+        m_node->setNodeValue(m_value, ec);
+        return !ec;
     }
 
-    // 3. Insert missing nodes.
-    for (size_t i = 0; i < newMap.size(); ++i) {
-        if (newMap[i].first || merges.contains(newList[i].get()))
-            continue;
+private:
+    RefPtr<Node> m_node;
+    String m_value;
+    String m_oldValue;
+};
 
-        ExceptionCode ec = 0;
-        insertBefore(parentNode, newList[i].get(), parentNode->childNode(i), ec);
-        if (ec)
-            return;
-    }
+DOMEditor::DOMEditor(InspectorHistory* history) : m_history(history) { }
 
-    // 4. Then put all nodes that retained into their slots (sort by new index).
-    for (size_t i = 0; i < oldMap.size(); ++i) {
-        if (!oldMap[i].first)
-            continue;
-        RefPtr<Node> node = oldMap[i].first->m_node;
-        Node* anchorNode = parentNode->childNode(oldMap[i].second);
-        if (node.get() == anchorNode)
-            continue;
-        if (node->hasTagName(bodyTag) || node->hasTagName(headTag))
-            continue; // Never move head or body, move the rest of the nodes around them.
+DOMEditor::~DOMEditor() { }
 
-        parentNode->insertBefore(node, anchorNode, ec);
-        if (ec)
-            return;
-    }
+bool DOMEditor::insertBefore(Node* parentNode, PassRefPtr<Node> node, Node* anchorNode, ExceptionCode& ec)
+{
+    return m_history->perform(adoptPtr(new InsertBeforeAction(parentNode, node, anchorNode)), ec);
 }
 
-static void addStringToSHA1(SHA1& sha1, const String& string)
+bool DOMEditor::removeChild(Node* parentNode, Node* node, ExceptionCode& ec)
 {
-    CString cString = string.utf8();
-    sha1.addBytes(reinterpret_cast<const uint8_t*>(cString.data()), cString.length());
+    return m_history->perform(adoptPtr(new RemoveChildAction(parentNode, node)), ec);
 }
 
-PassOwnPtr<DOMEditor::Digest> DOMEditor::createDigest(Node* node, UnusedNodesMap* unusedNodesMap)
+bool DOMEditor::setAttribute(Element* element, const String& name, const String& value, ExceptionCode& ec)
 {
-    Digest* digest = new Digest(node);
-
-    SHA1 sha1;
-
-    Node::NodeType nodeType = node->nodeType();
-    sha1.addBytes(reinterpret_cast<const uint8_t*>(&nodeType), sizeof(nodeType));
-    addStringToSHA1(sha1, node->nodeName());
-    addStringToSHA1(sha1, node->nodeValue());
-
-    if (node->nodeType() == Node::ELEMENT_NODE) {
-        Node* child = node->firstChild();
-        while (child) {
-            OwnPtr<Digest> childInfo = createDigest(child, unusedNodesMap);
-            addStringToSHA1(sha1, childInfo->m_sha1);
-            child = child->nextSibling();
-            digest->m_children.append(childInfo.release());
-        }
-        Element* element = static_cast<Element*>(node);
-
-        if (element->hasAttributesWithoutUpdate()) {
-            size_t numAttrs = element->attributeCount();
-            SHA1 attrsSHA1;
-            for (size_t i = 0; i < numAttrs; ++i) {
-                const Attribute* attribute = element->attributeItem(i);
-                addStringToSHA1(attrsSHA1, attribute->name().toString());
-                addStringToSHA1(attrsSHA1, attribute->value());
-            }
-            Vector<uint8_t, 20> attrsHash;
-            attrsSHA1.computeHash(attrsHash);
-            digest->m_attrsSHA1 = base64Encode(reinterpret_cast<const char*>(attrsHash.data()), 10);
-            addStringToSHA1(sha1, digest->m_attrsSHA1);
-        }
-    }
+    return m_history->perform(adoptPtr(new SetAttributeAction(element, name, value)), ec);
+}
+
+bool DOMEditor::removeAttribute(Element* element, const String& name, ExceptionCode& ec)
+{
+    return m_history->perform(adoptPtr(new RemoveAttributeAction(element, name)), ec);
+}
 
-    Vector<uint8_t, 20> hash;
-    sha1.computeHash(hash);
-    digest->m_sha1 = base64Encode(reinterpret_cast<const char*>(hash.data()), 10);
-    if (unusedNodesMap)
-        unusedNodesMap->add(digest->m_sha1, digest);
-    return adoptPtr(digest);
+bool DOMEditor::setOuterHTML(Node* node, const String& html, Node** newNode, ExceptionCode& ec)
+{
+    OwnPtr<SetOuterHTMLAction> action = adoptPtr(new SetOuterHTMLAction(node, html));
+    SetOuterHTMLAction* rawAction = action.get();
+    bool result = m_history->perform(action.release(), ec);
+    if (result)
+        *newNode = rawAction->newNode();
+    return result;
 }
 
-void DOMEditor::insertBefore(ContainerNode* parentNode, Digest* digest, Node* anchor, ExceptionCode& ec)
+bool DOMEditor::replaceWholeText(Text* textNode, const String& text, ExceptionCode& ec)
 {
-    parentNode->insertBefore(digest->m_node, anchor, ec);
-    markNodeAsUsed(digest);
+    return m_history->perform(adoptPtr(new ReplaceWholeTextAction(textNode, text)), ec);
 }
 
-void DOMEditor::removeChild(Digest* oldDigest, ExceptionCode& ec)
+bool DOMEditor::replaceChild(Node* parentNode, PassRefPtr<Node> newNode, Node* oldNode, ExceptionCode& ec)
 {
-    RefPtr<Node> oldNode = oldDigest->m_node;
-    oldNode->parentNode()->removeChild(oldNode.get(), ec);
-
-    // Diff works within levels. In order not to lose the node identity when user
-    // prepends his HTML with "<div>" (i.e. all nodes are shifted to the next nested level),
-    // prior to dropping the original node on the floor, check whether new DOM has a digest
-    // with matching sha1. If it does, replace it with the original DOM chunk. Chances are
-    // high that it will get merged back into the original DOM during the further patching.
-
-    UnusedNodesMap::iterator it = m_unusedNodesMap.find(oldDigest->m_sha1);
-    if (it != m_unusedNodesMap.end()) {
-        Digest* newDigest = it->second;
-        Node* newNode = newDigest->m_node;
-        newNode->parentNode()->replaceChild(oldNode, newNode, ec);
-        newDigest->m_node = oldNode.get();
-        markNodeAsUsed(newDigest);
-        return;
-    }
-
-    for (size_t i = 0; i < oldDigest->m_children.size(); ++i)
-        removeChild(oldDigest->m_children[i].get(), ec);
+    return m_history->perform(adoptPtr(new ReplaceChildNodeAction(parentNode, newNode, oldNode)), ec);
 }
 
-void DOMEditor::markNodeAsUsed(Digest* digest)
+bool DOMEditor::setNodeValue(Node* node, const String& value, ExceptionCode& ec)
 {
-    Deque<Digest*> queue;
-    queue.append(digest);
-    while (!queue.isEmpty()) {
-        Digest* first = queue.takeFirst();
-        m_unusedNodesMap.remove(first->m_sha1);
-        for (size_t i = 0; i < first->m_children.size(); ++i)
-            queue.append(first->m_children[i].get());
+    return m_history->perform(adoptPtr(new SetNodeValueAction(node, value)), ec);
+}
+
+static void populateErrorString(const ExceptionCode& ec, ErrorString* errorString)
+{
+    if (ec) {
+        ExceptionCodeDescription description(ec);
+        *errorString = description.name;
     }
 }
 
+bool DOMEditor::insertBefore(Node* parentNode, PassRefPtr<Node> node, Node* anchorNode, ErrorString* errorString)
+{
+    ExceptionCode ec = 0;
+    bool result = insertBefore(parentNode, node, anchorNode, ec);
+    populateErrorString(ec, errorString);
+    return result;
+}
+
+bool DOMEditor::removeChild(Node* parentNode, Node* node, ErrorString* errorString)
+{
+    ExceptionCode ec = 0;
+    bool result = removeChild(parentNode, node, ec);
+    populateErrorString(ec, errorString);
+    return result;
+}
+
+bool DOMEditor::setAttribute(Element* element, const String& name, const String& value, ErrorString* errorString)
+{
+    ExceptionCode ec = 0;
+    bool result = setAttribute(element, name, value, ec);
+    populateErrorString(ec, errorString);
+    return result;
+}
+
+bool DOMEditor::removeAttribute(Element* element, const String& name, ErrorString* errorString)
+{
+    ExceptionCode ec = 0;
+    bool result = removeAttribute(element, name, ec);
+    populateErrorString(ec, errorString);
+    return result;
+}
+
+bool DOMEditor::setOuterHTML(Node* node, const String& html, Node** newNode, ErrorString* errorString)
+{
+    ExceptionCode ec = 0;
+    bool result = setOuterHTML(node, html, newNode, ec);
+    populateErrorString(ec, errorString);
+    return result;
+}
+
+bool DOMEditor::replaceWholeText(Text* textNode, const String& text, ErrorString* errorString)
+{
+    ExceptionCode ec = 0;
+    bool result = replaceWholeText(textNode, text, ec);
+    populateErrorString(ec, errorString);
+    return result;
+}
+
 } // namespace WebCore
 
 #endif // ENABLE(INSPECTOR)
diff --git a/Source/WebCore/inspector/DOMEditor.h b/Source/WebCore/inspector/DOMEditor.h
index 4affb00b1..264913232 100644
--- a/Source/WebCore/inspector/DOMEditor.h
+++ b/Source/WebCore/inspector/DOMEditor.h
@@ -33,45 +33,53 @@
 
 #include "ExceptionCode.h"
 
-#include <wtf/HashMap.h>
-#include <wtf/OwnPtr.h>
-#include <wtf/PassOwnPtr.h>
-#include <wtf/Vector.h>
 #include <wtf/text/WTFString.h>
 
 namespace WebCore {
 
-class ContainerNode;
-class Document;
-class NamedNodeMap;
+class Element;
+class InspectorHistory;
 class Node;
+class Text;
 
 #if ENABLE(INSPECTOR)
 
+typedef String ErrorString;
+
 class DOMEditor {
+    WTF_MAKE_NONCOPYABLE(DOMEditor);
 public:
-    explicit DOMEditor(Document*);
-    virtual ~DOMEditor();
-
-    void patchDocument(const String& markup);
-    Node* patchNode(Node*, const String& markup, ExceptionCode&);
+    explicit DOMEditor(InspectorHistory*);
+    ~DOMEditor();
 
-private:
-    struct Digest;
-    typedef Vector<pair<Digest*, size_t> > ResultMap;
-    typedef HashMap<String, Digest*> UnusedNodesMap;
+    bool insertBefore(Node* parentNode, PassRefPtr<Node>, Node* anchorNode, ExceptionCode&);
+    bool removeChild(Node* parentNode, Node*, ExceptionCode&);
+    bool setAttribute(Element*, const String& name, const String& value, ExceptionCode&);
+    bool removeAttribute(Element*, const String& name, ExceptionCode&);
+    bool setOuterHTML(Node*, const String& html, Node** newNode, ExceptionCode&);
+    bool replaceWholeText(Text*, const String& text, ExceptionCode&);
+    bool replaceChild(Node* parentNode, PassRefPtr<Node> newNode, Node* oldNode, ExceptionCode&);
+    bool setNodeValue(Node* parentNode, const String& value, ExceptionCode&);
 
-    void innerPatchNode(Digest* oldNode, Digest* newNode, ExceptionCode&);
-    std::pair<ResultMap, ResultMap> diff(const Vector<OwnPtr<Digest> >& oldChildren, const Vector<OwnPtr<Digest> >& newChildren);
-    void innerPatchChildren(ContainerNode*, const Vector<OwnPtr<Digest> >& oldChildren, const Vector<OwnPtr<Digest> >& newChildren, ExceptionCode&);
-    PassOwnPtr<Digest> createDigest(Node*, UnusedNodesMap*);
-    void insertBefore(ContainerNode*, Digest*, Node* anchor, ExceptionCode&);
-    void removeChild(Digest*, ExceptionCode&);
-    void markNodeAsUsed(Digest*);
+    bool insertBefore(Node* parentNode, PassRefPtr<Node>, Node* anchorNode, ErrorString*);
+    bool removeChild(Node* parentNode, Node*, ErrorString*);
+    bool setAttribute(Element*, const String& name, const String& value, ErrorString*);
+    bool removeAttribute(Element*, const String& name, ErrorString*);
+    bool setOuterHTML(Node*, const String& html, Node** newNode, ErrorString*);
+    bool replaceWholeText(Text*, const String& text, ErrorString*);
 
-    Document* m_document;
+private:
+    class DOMAction;
+    class RemoveChildAction;
+    class InsertBeforeAction;
+    class RemoveAttributeAction;
+    class SetAttributeAction;
+    class SetOuterHTMLAction;
+    class ReplaceWholeTextAction;
+    class ReplaceChildNodeAction;
+    class SetNodeValueAction;
 
-    UnusedNodesMap m_unusedNodesMap;
+    InspectorHistory* m_history;
 };
 
 #endif // ENABLE(INSPECTOR)
diff --git a/Source/WebCore/inspector/DOMNodeHighlighter.cpp b/Source/WebCore/inspector/DOMNodeHighlighter.cpp
index 7b03c2e1a..70578c72a 100644
--- a/Source/WebCore/inspector/DOMNodeHighlighter.cpp
+++ b/Source/WebCore/inspector/DOMNodeHighlighter.cpp
@@ -514,6 +514,12 @@ void getHighlight(Document* document, HighlightData* highlightData, Highlight* h
         getOrDrawRectHighlight(0, document, highlightData, highlight);
 }
 
+void drawOutline(GraphicsContext& context, const LayoutRect& rect, const Color& color)
+{
+    FloatRect outlineRect = rect;
+    drawOutlinedQuad(context, outlineRect, Color(), color);
+}
+
 } // namespace DOMNodeHighlighter
 
 } // namespace WebCore
diff --git a/Source/WebCore/inspector/DOMNodeHighlighter.h b/Source/WebCore/inspector/DOMNodeHighlighter.h
index d063ae840..f7b6f00f4 100644
--- a/Source/WebCore/inspector/DOMNodeHighlighter.h
+++ b/Source/WebCore/inspector/DOMNodeHighlighter.h
@@ -31,6 +31,7 @@
 
 #include "Color.h"
 #include "FloatQuad.h"
+#include "LayoutTypes.h"
 
 #include <wtf/OwnPtr.h>
 #include <wtf/RefPtr.h>
@@ -40,8 +41,8 @@ namespace WebCore {
 
 class Color;
 class Document;
+class FrameView;
 class GraphicsContext;
-class IntRect;
 class Node;
 
 struct HighlightData {
@@ -78,6 +79,7 @@ namespace DOMNodeHighlighter {
 
 void drawHighlight(GraphicsContext&, Document*, HighlightData*);
 void getHighlight(Document*, HighlightData*, Highlight*);
+void drawOutline(GraphicsContext&, const LayoutRect&, const Color&);
 
 } // namespace DOMNodeHighlighter
 
diff --git a/Source/WebCore/inspector/DOMPatchSupport.cpp b/Source/WebCore/inspector/DOMPatchSupport.cpp
new file mode 100644
index 000000000..9ed89a33c
--- /dev/null
+++ b/Source/WebCore/inspector/DOMPatchSupport.cpp
@@ -0,0 +1,508 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "DOMPatchSupport.h"
+
+#if ENABLE(INSPECTOR)
+
+#include "Attribute.h"
+#include "Base64.h"
+#include "DOMEditor.h"
+#include "Document.h"
+#include "DocumentFragment.h"
+#include "HTMLDocument.h"
+#include "HTMLDocumentParser.h"
+#include "HTMLElement.h"
+#include "HTMLHeadElement.h"
+#include "HTMLNames.h"
+#include "InspectorHistory.h"
+#include "Node.h"
+
+#include <wtf/Deque.h>
+#include <wtf/HashTraits.h>
+#include <wtf/RefPtr.h>
+#include <wtf/SHA1.h>
+#include <wtf/text/CString.h>
+
+using namespace std;
+
+namespace WebCore {
+
+using HTMLNames::bodyTag;
+using HTMLNames::headTag;
+using HTMLNames::htmlTag;
+
+struct DOMPatchSupport::Digest {
+    explicit Digest(Node* node) : m_node(node) { }
+
+    String m_sha1;
+    String m_attrsSHA1;
+    Node* m_node;
+    Vector<OwnPtr<Digest> > m_children;
+};
+
+void DOMPatchSupport::patchDocument(Document* document, const String& markup)
+{
+    InspectorHistory history;
+    DOMEditor domEditor(&history);
+    DOMPatchSupport patchSupport(&domEditor, document);
+    patchSupport.patchDocument(markup);
+}
+
+DOMPatchSupport::DOMPatchSupport(DOMEditor* domEditor, Document* document)
+    : m_domEditor(domEditor)
+    , m_document(document)
+{
+}
+
+DOMPatchSupport::~DOMPatchSupport() { }
+
+void DOMPatchSupport::patchDocument(const String& markup)
+{
+    RefPtr<HTMLDocument> newDocument = HTMLDocument::create(0, KURL());
+    RefPtr<DocumentParser> parser = HTMLDocumentParser::create(newDocument.get(), false);
+    parser->insert(markup); // Use insert() so that the parser will not yield.
+    parser->finish();
+    parser->detach();
+
+    OwnPtr<Digest> oldInfo = createDigest(m_document->documentElement(), 0);
+    OwnPtr<Digest> newInfo = createDigest(newDocument->documentElement(), &m_unusedNodesMap);
+
+    ExceptionCode ec = 0;
+    if (!innerPatchNode(oldInfo.get(), newInfo.get(), ec)) {
+        // Fall back to rewrite.
+        m_document->write(markup);
+        m_document->close();
+    }
+}
+
+Node* DOMPatchSupport::patchNode(Node* node, const String& markup, ExceptionCode& ec)
+{
+    // Don't parse <html> as a fragment.
+    if (node->isDocumentNode() || (node->parentNode() && node->parentNode()->isDocumentNode())) {
+        patchDocument(markup);
+        return 0;
+    }
+
+    Node* previousSibling = node->previousSibling();
+    RefPtr<DocumentFragment> fragment = DocumentFragment::create(m_document);
+    fragment->parseHTML(markup, node->parentElement() ? node->parentElement() : m_document->documentElement());
+
+    // Compose the old list.
+    ContainerNode* parentNode = node->parentNode();
+    Vector<OwnPtr<Digest> > oldList;
+    for (Node* child = parentNode->firstChild(); child; child = child->nextSibling())
+        oldList.append(createDigest(child, 0));
+
+    // Compose the new list.
+    String markupCopy = markup;
+    markupCopy.makeLower();
+    Vector<OwnPtr<Digest> > newList;
+    for (Node* child = parentNode->firstChild(); child != node; child = child->nextSibling())
+        newList.append(createDigest(child, 0));
+    for (Node* child = fragment->firstChild(); child; child = child->nextSibling()) {
+        if (child->hasTagName(headTag) && !child->firstChild() && markupCopy.find("</head>") == notFound)
+            continue; // HTML5 parser inserts empty <head> tag whenever it parses <body>
+        if (child->hasTagName(bodyTag) && !child->firstChild() && markupCopy.find("</body>") == notFound)
+            continue; // HTML5 parser inserts empty <body> tag whenever it parses </head>
+        newList.append(createDigest(child, &m_unusedNodesMap));
+    }
+    for (Node* child = node->nextSibling(); child; child = child->nextSibling())
+        newList.append(createDigest(child, 0));
+
+    if (!innerPatchChildren(parentNode, oldList, newList, ec)) {
+        // Fall back to total replace.
+        ec = 0;
+        if (!m_domEditor->replaceChild(parentNode, fragment.release(), node, ec))
+            return 0;
+    }
+    return previousSibling ? previousSibling->nextSibling() : parentNode->firstChild();
+}
+
+bool DOMPatchSupport::innerPatchNode(Digest* oldDigest, Digest* newDigest, ExceptionCode& ec)
+{
+    if (oldDigest->m_sha1 == newDigest->m_sha1)
+        return true;
+
+    Node* oldNode = oldDigest->m_node;
+    Node* newNode = newDigest->m_node;
+
+    if (newNode->nodeType() != oldNode->nodeType() || newNode->nodeName() != oldNode->nodeName())
+        return m_domEditor->replaceChild(oldNode->parentNode(), newNode, oldNode, ec);
+
+    if (oldNode->nodeValue() != newNode->nodeValue()) {
+        if (!m_domEditor->setNodeValue(oldNode, newNode->nodeValue(), ec))
+            return false;
+    }
+
+    if (oldNode->nodeType() != Node::ELEMENT_NODE)
+        return true;
+
+    // Patch attributes
+    Element* oldElement = static_cast<Element*>(oldNode);
+    Element* newElement = static_cast<Element*>(newNode);
+    if (oldDigest->m_attrsSHA1 != newDigest->m_attrsSHA1) {
+        // FIXME: Create a function in Element for removing all properties. Take in account whether did/willModifyAttribute are important.
+        if (oldElement->hasAttributesWithoutUpdate()) {
+            while (oldElement->attributeCount()) {
+                Attribute* attr = oldElement->attributeItem(0);
+                if (!m_domEditor->removeAttribute(oldElement, attr->localName(), ec))
+                    return false;
+            }
+        }
+
+        // FIXME: Create a function in Element for copying properties. setAttributesFromElement() is close but not enough for this case.
+        if (newElement->hasAttributesWithoutUpdate()) {
+            size_t numAttrs = newElement->attributeCount();
+            for (size_t i = 0; i < numAttrs; ++i) {
+                const Attribute* attribute = newElement->attributeItem(i);
+                if (!m_domEditor->setAttribute(oldElement, attribute->name().localName(), attribute->value(), ec))
+                    return false;
+            }
+        }
+    }
+
+    bool result = innerPatchChildren(oldElement, oldDigest->m_children, newDigest->m_children, ec);
+    m_unusedNodesMap.remove(newDigest->m_sha1);
+    return result;
+}
+
+pair<DOMPatchSupport::ResultMap, DOMPatchSupport::ResultMap>
+DOMPatchSupport::diff(const Vector<OwnPtr<Digest> >& oldList, const Vector<OwnPtr<Digest> >& newList)
+{
+    ResultMap newMap(newList.size());
+    ResultMap oldMap(oldList.size());
+
+    for (size_t i = 0; i < oldMap.size(); ++i) {
+        oldMap[i].first = 0;
+        oldMap[i].second = 0;
+    }
+
+    for (size_t i = 0; i < newMap.size(); ++i) {
+        newMap[i].first = 0;
+        newMap[i].second = 0;
+    }
+
+    // Trim head and tail.
+    for (size_t i = 0; i < oldList.size() && i < newList.size() && oldList[i]->m_sha1 == newList[i]->m_sha1; ++i) {
+        oldMap[i].first = oldList[i].get();
+        oldMap[i].second = i;
+        newMap[i].first = newList[i].get();
+        newMap[i].second = i;
+    }
+    for (size_t i = 0; i < oldList.size() && i < newList.size() && oldList[oldList.size() - i - 1]->m_sha1 == newList[newList.size() - i - 1]->m_sha1; ++i) {
+        size_t oldIndex = oldList.size() - i - 1;
+        size_t newIndex = newList.size() - i - 1;
+        oldMap[oldIndex].first = oldList[oldIndex].get();
+        oldMap[oldIndex].second = newIndex;
+        newMap[newIndex].first = newList[newIndex].get();
+        newMap[newIndex].second = oldIndex;
+    }
+
+    typedef HashMap<String, Vector<size_t> > DiffTable;
+    DiffTable newTable;
+    DiffTable oldTable;
+
+    for (size_t i = 0; i < newList.size(); ++i) {
+        DiffTable::iterator it = newTable.add(newList[i]->m_sha1, Vector<size_t>()).first;
+        it->second.append(i);
+    }
+
+    for (size_t i = 0; i < oldList.size(); ++i) {
+        DiffTable::iterator it = oldTable.add(oldList[i]->m_sha1, Vector<size_t>()).first;
+        it->second.append(i);
+    }
+
+    for (DiffTable::iterator newIt = newTable.begin(); newIt != newTable.end(); ++newIt) {
+        if (newIt->second.size() != 1)
+            continue;
+
+        DiffTable::iterator oldIt = oldTable.find(newIt->first);
+        if (oldIt == oldTable.end() || oldIt->second.size() != 1)
+            continue;
+
+        newMap[newIt->second[0]] = make_pair(newList[newIt->second[0]].get(), oldIt->second[0]);
+        oldMap[oldIt->second[0]] = make_pair(oldList[oldIt->second[0]].get(), newIt->second[0]);
+    }
+
+    for (size_t i = 0; newList.size() > 0 && i < newList.size() - 1; ++i) {
+        if (!newMap[i].first || newMap[i + 1].first)
+            continue;
+
+        size_t j = newMap[i].second + 1;
+        if (j < oldMap.size() && !oldMap[j].first && newList[i + 1]->m_sha1 == oldList[j]->m_sha1) {
+            newMap[i + 1] = make_pair(newList[i + 1].get(), j);
+            oldMap[j] = make_pair(oldList[j].get(), i + 1);
+        }
+    }
+
+    for (size_t i = newList.size() - 1; newList.size() > 0 && i > 0; --i) {
+        if (!newMap[i].first || newMap[i - 1].first || newMap[i].second <= 0)
+            continue;
+
+        size_t j = newMap[i].second - 1;
+        if (!oldMap[j].first && newList[i - 1]->m_sha1 == oldList[j]->m_sha1) {
+            newMap[i - 1] = make_pair(newList[i - 1].get(), j);
+            oldMap[j] = make_pair(oldList[j].get(), i - 1);
+        }
+    }
+
+#ifdef DEBUG_DOM_PATCH_SUPPORT
+    dumpMap(oldMap, "OLD");
+    dumpMap(newMap, "NEW");
+#endif
+
+    return make_pair(oldMap, newMap);
+}
+
+bool DOMPatchSupport::innerPatchChildren(ContainerNode* parentNode, const Vector<OwnPtr<Digest> >& oldList, const Vector<OwnPtr<Digest> >& newList, ExceptionCode& ec)
+{
+    pair<ResultMap, ResultMap> resultMaps = diff(oldList, newList);
+    ResultMap& oldMap = resultMaps.first;
+    ResultMap& newMap = resultMaps.second;
+
+    Digest* oldHead = 0;
+    Digest* oldBody = 0;
+
+    // 1. First strip everything except for the nodes that retain. Collect pending merges.
+    HashMap<Digest*, Digest*> merges;
+    HashSet<size_t, WTF::IntHash<size_t>, WTF::UnsignedWithZeroKeyHashTraits<size_t> > usedNewOrdinals;
+    for (size_t i = 0; i < oldList.size(); ++i) {
+        if (oldMap[i].first) {
+            if (!usedNewOrdinals.contains(oldMap[i].second)) {
+                usedNewOrdinals.add(oldMap[i].second);
+                continue;
+            }
+            oldMap[i].first = 0;
+            oldMap[i].second = 0;
+        }
+
+        // Always match <head> and <body> tags with each other - we can't remove them from the DOM
+        // upon patching.
+        if (oldList[i]->m_node->hasTagName(headTag)) {
+            oldHead = oldList[i].get();
+            continue;
+        }
+        if (oldList[i]->m_node->hasTagName(bodyTag)) {
+            oldBody = oldList[i].get();
+            continue;
+        }
+
+        // Check if this change is between stable nodes. If it is, consider it as "modified".
+        if (!m_unusedNodesMap.contains(oldList[i]->m_sha1) && (!i || oldMap[i - 1].first) && (i == oldMap.size() - 1 || oldMap[i + 1].first)) {
+            size_t anchorCandidate = i ? oldMap[i - 1].second + 1 : 0;
+            size_t anchorAfter = i == oldMap.size() - 1 ? anchorCandidate + 1 : oldMap[i + 1].second;
+            if (anchorAfter - anchorCandidate == 1 && anchorCandidate < newList.size())
+                merges.set(newList[anchorCandidate].get(), oldList[i].get());
+            else {
+                if (!removeChildAndMoveToNew(oldList[i].get(), ec))
+                    return false;
+            }
+        } else {
+            if (!removeChildAndMoveToNew(oldList[i].get(), ec))
+                return false;
+        }
+    }
+
+    // Mark retained nodes as used, do not reuse node more than once.
+    HashSet<size_t, WTF::IntHash<size_t>, WTF::UnsignedWithZeroKeyHashTraits<size_t> >  usedOldOrdinals;
+    for (size_t i = 0; i < newList.size(); ++i) {
+        if (!newMap[i].first)
+            continue;
+        size_t oldOrdinal = newMap[i].second;
+        if (usedOldOrdinals.contains(oldOrdinal)) {
+            // Do not map node more than once
+            newMap[i].first = 0;
+            newMap[i].second = 0;
+            continue;
+        }
+        usedOldOrdinals.add(oldOrdinal);
+        markNodeAsUsed(newMap[i].first);
+    }
+
+    // Mark <head> and <body> nodes for merge.
+    if (oldHead || oldBody) {
+        for (size_t i = 0; i < newList.size(); ++i) {
+            if (oldHead && newList[i]->m_node->hasTagName(headTag))
+                merges.set(newList[i].get(), oldHead);
+            if (oldBody && newList[i]->m_node->hasTagName(bodyTag))
+                merges.set(newList[i].get(), oldBody);
+        }
+    }
+
+    // 2. Patch nodes marked for merge.
+    for (HashMap<Digest*, Digest*>::iterator it = merges.begin(); it != merges.end(); ++it) {
+        if (!innerPatchNode(it->second, it->first, ec))
+            return false;
+    }
+
+    // 3. Insert missing nodes.
+    for (size_t i = 0; i < newMap.size(); ++i) {
+        if (newMap[i].first || merges.contains(newList[i].get()))
+            continue;
+        if (!insertBeforeAndMarkAsUsed(parentNode, newList[i].get(), parentNode->childNode(i), ec))
+            return false;
+    }
+
+    // 4. Then put all nodes that retained into their slots (sort by new index).
+    for (size_t i = 0; i < oldMap.size(); ++i) {
+        if (!oldMap[i].first)
+            continue;
+        RefPtr<Node> node = oldMap[i].first->m_node;
+        Node* anchorNode = parentNode->childNode(oldMap[i].second);
+        if (node.get() == anchorNode)
+            continue;
+        if (node->hasTagName(bodyTag) || node->hasTagName(headTag))
+            continue; // Never move head or body, move the rest of the nodes around them.
+
+        if (!m_domEditor->insertBefore(parentNode, node.release(), anchorNode, ec))
+            return false;
+    }
+    return true;
+}
+
+static void addStringToSHA1(SHA1& sha1, const String& string)
+{
+    CString cString = string.utf8();
+    sha1.addBytes(reinterpret_cast<const uint8_t*>(cString.data()), cString.length());
+}
+
+PassOwnPtr<DOMPatchSupport::Digest> DOMPatchSupport::createDigest(Node* node, UnusedNodesMap* unusedNodesMap)
+{
+    Digest* digest = new Digest(node);
+
+    SHA1 sha1;
+
+    Node::NodeType nodeType = node->nodeType();
+    sha1.addBytes(reinterpret_cast<const uint8_t*>(&nodeType), sizeof(nodeType));
+    addStringToSHA1(sha1, node->nodeName());
+    addStringToSHA1(sha1, node->nodeValue());
+
+    if (node->nodeType() == Node::ELEMENT_NODE) {
+        Node* child = node->firstChild();
+        while (child) {
+            OwnPtr<Digest> childInfo = createDigest(child, unusedNodesMap);
+            addStringToSHA1(sha1, childInfo->m_sha1);
+            child = child->nextSibling();
+            digest->m_children.append(childInfo.release());
+        }
+        Element* element = static_cast<Element*>(node);
+
+        if (element->hasAttributesWithoutUpdate()) {
+            size_t numAttrs = element->attributeCount();
+            SHA1 attrsSHA1;
+            for (size_t i = 0; i < numAttrs; ++i) {
+                const Attribute* attribute = element->attributeItem(i);
+                addStringToSHA1(attrsSHA1, attribute->name().toString());
+                addStringToSHA1(attrsSHA1, attribute->value());
+            }
+            Vector<uint8_t, 20> attrsHash;
+            attrsSHA1.computeHash(attrsHash);
+            digest->m_attrsSHA1 = base64Encode(reinterpret_cast<const char*>(attrsHash.data()), 10);
+            addStringToSHA1(sha1, digest->m_attrsSHA1);
+        }
+    }
+
+    Vector<uint8_t, 20> hash;
+    sha1.computeHash(hash);
+    digest->m_sha1 = base64Encode(reinterpret_cast<const char*>(hash.data()), 10);
+    if (unusedNodesMap)
+        unusedNodesMap->add(digest->m_sha1, digest);
+    return adoptPtr(digest);
+}
+
+bool DOMPatchSupport::insertBeforeAndMarkAsUsed(ContainerNode* parentNode, Digest* digest, Node* anchor, ExceptionCode& ec)
+{
+    bool result = m_domEditor->insertBefore(parentNode, digest->m_node, anchor, ec);
+    markNodeAsUsed(digest);
+    return result;
+}
+
+bool DOMPatchSupport::removeChildAndMoveToNew(Digest* oldDigest, ExceptionCode& ec)
+{
+    RefPtr<Node> oldNode = oldDigest->m_node;
+    if (!m_domEditor->removeChild(oldNode->parentNode(), oldNode.get(), ec))
+        return false;
+
+    // Diff works within levels. In order not to lose the node identity when user
+    // prepends his HTML with "<div>" (i.e. all nodes are shifted to the next nested level),
+    // prior to dropping the original node on the floor, check whether new DOM has a digest
+    // with matching sha1. If it does, replace it with the original DOM chunk. Chances are
+    // high that it will get merged back into the original DOM during the further patching.
+    UnusedNodesMap::iterator it = m_unusedNodesMap.find(oldDigest->m_sha1);
+    if (it != m_unusedNodesMap.end()) {
+        Digest* newDigest = it->second;
+        Node* newNode = newDigest->m_node;
+        if (!m_domEditor->replaceChild(newNode->parentNode(), oldNode, newNode, ec))
+            return false;
+        newDigest->m_node = oldNode.get();
+        markNodeAsUsed(newDigest);
+        return true;
+    }
+
+    for (size_t i = 0; i < oldDigest->m_children.size(); ++i) {
+        if (!removeChildAndMoveToNew(oldDigest->m_children[i].get(), ec))
+            return false;
+    }
+    return true;
+}
+
+void DOMPatchSupport::markNodeAsUsed(Digest* digest)
+{
+    Deque<Digest*> queue;
+    queue.append(digest);
+    while (!queue.isEmpty()) {
+        Digest* first = queue.takeFirst();
+        m_unusedNodesMap.remove(first->m_sha1);
+        for (size_t i = 0; i < first->m_children.size(); ++i)
+            queue.append(first->m_children[i].get());
+    }
+}
+
+#ifdef DEBUG_DOM_PATCH_SUPPORT
+static String nodeName(Node* node)
+{
+    if (node->document()->isXHTMLDocument())
+         return node->nodeName();
+    return node->nodeName().lower();
+}
+
+void DOMPatchSupport::dumpMap(const ResultMap& map, const String& name)
+{
+    fprintf(stderr, "\n\n");
+    for (size_t i = 0; i < map.size(); ++i)
+        fprintf(stderr, "%s[%lu]: %s (%p) - [%lu]\n", name.utf8().data(), i, map[i].first ? nodeName(map[i].first->m_node).utf8().data() : "", map[i].first, map[i].second);
+}
+#endif
+
+} // namespace WebCore
+
+#endif // ENABLE(INSPECTOR)
diff --git a/Source/WebCore/inspector/DOMPatchSupport.h b/Source/WebCore/inspector/DOMPatchSupport.h
new file mode 100644
index 000000000..4d040f08b
--- /dev/null
+++ b/Source/WebCore/inspector/DOMPatchSupport.h
@@ -0,0 +1,89 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef DOMPatchSupport_h
+#define DOMPatchSupport_h
+
+#include "ExceptionCode.h"
+
+#include <wtf/HashMap.h>
+#include <wtf/OwnPtr.h>
+#include <wtf/PassOwnPtr.h>
+#include <wtf/Vector.h>
+#include <wtf/text/WTFString.h>
+
+namespace WebCore {
+
+class ContainerNode;
+class DOMEditor;
+class Document;
+class NamedNodeMap;
+class Node;
+
+#if ENABLE(INSPECTOR)
+
+class DOMPatchSupport {
+    WTF_MAKE_NONCOPYABLE(DOMPatchSupport);
+public:
+    static void patchDocument(Document*, const String& markup);
+
+    DOMPatchSupport(DOMEditor*, Document*);
+    virtual ~DOMPatchSupport();
+
+    void patchDocument(const String& markup);
+    Node* patchNode(Node*, const String& markup, ExceptionCode&);
+
+private:
+    struct Digest;
+    typedef Vector<pair<Digest*, size_t> > ResultMap;
+    typedef HashMap<String, Digest*> UnusedNodesMap;
+
+    bool innerPatchNode(Digest* oldNode, Digest* newNode, ExceptionCode&);
+    std::pair<ResultMap, ResultMap> diff(const Vector<OwnPtr<Digest> >& oldChildren, const Vector<OwnPtr<Digest> >& newChildren);
+    bool innerPatchChildren(ContainerNode*, const Vector<OwnPtr<Digest> >& oldChildren, const Vector<OwnPtr<Digest> >& newChildren, ExceptionCode&);
+    PassOwnPtr<Digest> createDigest(Node*, UnusedNodesMap*);
+    bool insertBeforeAndMarkAsUsed(ContainerNode*, Digest*, Node* anchor, ExceptionCode&);
+    bool removeChildAndMoveToNew(Digest*, ExceptionCode&);
+    void markNodeAsUsed(Digest*);
+#ifdef DEBUG_DOM_PATCH_SUPPORT
+    void dumpMap(const ResultMap&, const String& name);
+#endif
+
+    DOMEditor* m_domEditor;
+    Document* m_document;
+
+    UnusedNodesMap m_unusedNodesMap;
+};
+
+#endif // ENABLE(INSPECTOR)
+
+} // namespace WebCore
+
+#endif // !defined(DOMPatchSupport_h)
diff --git a/Source/WebCore/inspector/InjectedScript.cpp b/Source/WebCore/inspector/InjectedScript.cpp
index 6d09b2917..7a0abd70f 100644
--- a/Source/WebCore/inspector/InjectedScript.cpp
+++ b/Source/WebCore/inspector/InjectedScript.cpp
@@ -43,6 +43,12 @@
 #include "PlatformString.h"
 #include "ScriptFunctionCall.h"
 
+using WebCore::TypeBuilder::Array;
+using WebCore::TypeBuilder::Debugger::CallFrame;
+using WebCore::TypeBuilder::Runtime::PropertyDescriptor;
+using WebCore::TypeBuilder::Debugger::FunctionDetails;
+using WebCore::TypeBuilder::Runtime::RemoteObject;
+
 namespace WebCore {
 
 InjectedScript::InjectedScript()
@@ -76,7 +82,7 @@ void InjectedScript::callFunctionOn(ErrorString* errorString, const String& obje
     makeEvalCall(errorString, function, result, wasThrown);
 }
 
-void InjectedScript::evaluateOnCallFrame(ErrorString* errorString, const ScriptValue& callFrames, const String& callFrameId, const String& expression, const String& objectGroup, bool includeCommandLineAPI, bool returnByValue, RefPtr<InspectorObject>* result, bool* wasThrown)
+void InjectedScript::evaluateOnCallFrame(ErrorString* errorString, const ScriptValue& callFrames, const String& callFrameId, const String& expression, const String& objectGroup, bool includeCommandLineAPI, bool returnByValue, RefPtr<RemoteObject>* result, bool* wasThrown)
 {
     ScriptFunctionCall function(m_injectedScriptObject, "evaluateOnCallFrame");
     function.appendArgument(callFrames);
@@ -85,10 +91,12 @@ void InjectedScript::evaluateOnCallFrame(ErrorString* errorString, const ScriptV
     function.appendArgument(objectGroup);
     function.appendArgument(includeCommandLineAPI);
     function.appendArgument(returnByValue);
-    makeEvalCall(errorString, function, result, wasThrown);
+    RefPtr<InspectorObject> resultRaw;
+    makeEvalCall(errorString, function, &resultRaw, wasThrown);
+    *result = RemoteObject::runtimeCast(resultRaw);
 }
 
-void InjectedScript::getFunctionDetails(ErrorString* errorString, const String& functionId, RefPtr<InspectorObject>* result)
+void InjectedScript::getFunctionDetails(ErrorString* errorString, const String& functionId, RefPtr<FunctionDetails>* result)
 {
     ScriptFunctionCall function(m_injectedScriptObject, "getFunctionDetails");
     function.appendArgument(functionId);
@@ -99,7 +107,7 @@ void InjectedScript::getFunctionDetails(ErrorString* errorString, const String&
             *errorString = "Internal error";
         return;
     }
-    *result = resultValue->asObject();
+    *result = FunctionDetails::runtimeCast(resultValue);
 }
 
 void InjectedScript::getProperties(ErrorString* errorString, const String& objectId, bool ownProperties, RefPtr<InspectorArray>* properties)
@@ -114,7 +122,7 @@ void InjectedScript::getProperties(ErrorString* errorString, const String& objec
         *errorString = "Internal error";
         return;
     }
-    *properties = result->asArray();
+    *properties = Array<PropertyDescriptor>::runtimeCast(result);
 }
 
 Node* InjectedScript::nodeForObjectId(const String& objectId)
@@ -126,7 +134,7 @@ Node* InjectedScript::nodeForObjectId(const String& objectId)
     function.appendArgument(objectId);
 
     bool hadException = false;
-    ScriptValue resultValue = function.call(hadException);
+    ScriptValue resultValue = callFunctionWithEvalEnabled(function, hadException);
     ASSERT(!hadException);
 
     return InjectedScriptHost::scriptValueAsNode(resultValue);
@@ -141,20 +149,22 @@ void InjectedScript::releaseObject(const String& objectId)
 }
 
 #if ENABLE(JAVASCRIPT_DEBUGGER)
-PassRefPtr<InspectorArray> InjectedScript::wrapCallFrames(const ScriptValue& callFrames)
+PassRefPtr<Array<CallFrame> > InjectedScript::wrapCallFrames(const ScriptValue& callFrames)
 {
     ASSERT(!hasNoValue());
     ScriptFunctionCall function(m_injectedScriptObject, "wrapCallFrames");
     function.appendArgument(callFrames);
-    ScriptValue callFramesValue = function.call();
+    bool hadException = false;
+    ScriptValue callFramesValue = callFunctionWithEvalEnabled(function, hadException);
+    ASSERT(!hadException);
     RefPtr<InspectorValue> result = callFramesValue.toInspectorValue(m_injectedScriptObject.scriptState());
     if (result->type() == InspectorValue::TypeArray)
-        return result->asArray();
-    return InspectorArray::create();
+        return Array<CallFrame>::runtimeCast(result);
+    return Array<CallFrame>::create();
 }
 #endif
 
-PassRefPtr<InspectorObject> InjectedScript::wrapObject(ScriptValue value, const String& groupName)
+PassRefPtr<InspectorObject> InjectedScript::wrapObject(ScriptValue value, const String& groupName) const
 {
     ASSERT(!hasNoValue());
     ScriptFunctionCall wrapFunction(m_injectedScriptObject, "wrapObject");
@@ -162,7 +172,7 @@ PassRefPtr<InspectorObject> InjectedScript::wrapObject(ScriptValue value, const
     wrapFunction.appendArgument(groupName);
     wrapFunction.appendArgument(canAccessInspectedWindow());
     bool hadException = false;
-    ScriptValue r = wrapFunction.call(hadException);
+    ScriptValue r = callFunctionWithEvalEnabled(wrapFunction, hadException);
     if (hadException) {
         RefPtr<InspectorObject> result = InspectorObject::create();
         result->setString("description", "<exception>");
@@ -176,6 +186,12 @@ PassRefPtr<InspectorObject> InjectedScript::wrapNode(Node* node, const String& g
     return wrapObject(nodeAsScriptValue(node), groupName);
 }
 
+PassRefPtr<InspectorObject> InjectedScript::wrapSerializedObject(SerializedScriptValue* serializedScriptValue, const String& groupName) const
+{
+    ScriptValue scriptValue = serializedScriptValue->deserializeForInspector(m_injectedScriptObject.scriptState());
+    return scriptValue.hasNoValue() ? 0 : wrapObject(scriptValue, groupName);
+}
+
 void InjectedScript::inspectNode(Node* node)
 {
     ASSERT(!hasNoValue());
@@ -190,24 +206,20 @@ void InjectedScript::releaseObjectGroup(const String& objectGroup)
     ASSERT(!hasNoValue());
     ScriptFunctionCall releaseFunction(m_injectedScriptObject, "releaseObjectGroup");
     releaseFunction.appendArgument(objectGroup);
-    releaseFunction.call();
+    bool hadException = false;
+    callFunctionWithEvalEnabled(releaseFunction, hadException);
+    ASSERT(!hadException);
 }
 
-bool InjectedScript::canAccessInspectedWindow()
+bool InjectedScript::canAccessInspectedWindow() const
 {
     return m_inspectedStateAccessCheck(m_injectedScriptObject.scriptState());
 }
 
-void InjectedScript::makeCall(ScriptFunctionCall& function, RefPtr<InspectorValue>* result)
+ScriptValue InjectedScript::callFunctionWithEvalEnabled(ScriptFunctionCall& function, bool& hadException) const
 {
-    if (hasNoValue() || !canAccessInspectedWindow()) {
-        *result = InspectorValue::null();
-        return;
-    }
-
     DOMWindow* domWindow = domWindowFromScriptState(m_injectedScriptObject.scriptState());
     InspectorInstrumentationCookie cookie = domWindow && domWindow->frame() ? InspectorInstrumentation::willCallFunction(domWindow->frame()->page(), "InjectedScript", 1) : InspectorInstrumentationCookie();
-    bool hadException = false;
 
     ScriptState* scriptState = m_injectedScriptObject.scriptState();
     bool evalIsDisabled = false;
@@ -224,6 +236,18 @@ void InjectedScript::makeCall(ScriptFunctionCall& function, RefPtr<InspectorValu
         setEvalEnabled(scriptState, false);
 
     InspectorInstrumentation::didCallFunction(cookie);
+    return resultValue;
+}
+
+void InjectedScript::makeCall(ScriptFunctionCall& function, RefPtr<InspectorValue>* result)
+{
+    if (hasNoValue() || !canAccessInspectedWindow()) {
+        *result = InspectorValue::null();
+        return;
+    }
+
+    bool hadException = false;
+    ScriptValue resultValue = callFunctionWithEvalEnabled(function, hadException);
 
     ASSERT(!hadException);
     if (!hadException) {
diff --git a/Source/WebCore/inspector/InjectedScript.h b/Source/WebCore/inspector/InjectedScript.h
index f2b7ac152..84d9a78ed 100644
--- a/Source/WebCore/inspector/InjectedScript.h
+++ b/Source/WebCore/inspector/InjectedScript.h
@@ -32,6 +32,7 @@
 #define InjectedScript_h
 
 #include "InjectedScriptManager.h"
+#include "InspectorTypeBuilder.h"
 #include "ScriptObject.h"
 #include <wtf/Forward.h>
 #include <wtf/Noncopyable.h>
@@ -48,6 +49,8 @@ class ScriptFunctionCall;
 
 typedef String ErrorString;
 
+#if ENABLE(INSPECTOR)
+
 class InjectedScript {
 public:
     InjectedScript();
@@ -76,19 +79,20 @@ public:
                              const String& objectGroup,
                              bool includeCommandLineAPI,
                              bool returnByValue,
-                             RefPtr<InspectorObject>* result,
+                             RefPtr<TypeBuilder::Runtime::RemoteObject>* result,
                              bool* wasThrown);
-    void getFunctionDetails(ErrorString*, const String& functionId, RefPtr<InspectorObject>* result);
+    void getFunctionDetails(ErrorString*, const String& functionId, RefPtr<TypeBuilder::Debugger::FunctionDetails>* result);
     void getProperties(ErrorString*, const String& objectId, bool ownProperties, RefPtr<InspectorArray>* result);
     Node* nodeForObjectId(const String& objectId);
     void releaseObject(const String& objectId);
 
 #if ENABLE(JAVASCRIPT_DEBUGGER)
-    PassRefPtr<InspectorArray> wrapCallFrames(const ScriptValue&);
+    PassRefPtr<TypeBuilder::Array<TypeBuilder::Debugger::CallFrame> > wrapCallFrames(const ScriptValue&);
 #endif
 
-    PassRefPtr<InspectorObject> wrapObject(ScriptValue, const String& groupName);
+    PassRefPtr<InspectorObject> wrapObject(ScriptValue, const String& groupName) const;
     PassRefPtr<InspectorObject> wrapNode(Node*, const String& groupName);
+    PassRefPtr<InspectorObject> wrapSerializedObject(SerializedScriptValue*, const String& groupName) const;
     void inspectNode(Node*);
     void releaseObjectGroup(const String&);
     ScriptState* scriptState() const { return m_injectedScriptObject.scriptState(); }
@@ -98,7 +102,8 @@ private:
     typedef bool (*InspectedStateAccessCheck)(ScriptState*);
     InjectedScript(ScriptObject, InspectedStateAccessCheck);
 
-    bool canAccessInspectedWindow();
+    bool canAccessInspectedWindow() const;
+    ScriptValue callFunctionWithEvalEnabled(ScriptFunctionCall&, bool& hadException) const;
     void makeCall(ScriptFunctionCall&, RefPtr<InspectorValue>* result);
     void makeEvalCall(ErrorString*, ScriptFunctionCall&, RefPtr<InspectorObject>* result, bool* wasThrown);
     ScriptValue nodeAsScriptValue(Node*);
@@ -107,6 +112,8 @@ private:
     InspectedStateAccessCheck m_inspectedStateAccessCheck;
 };
 
+#endif
+
 } // namespace WebCore
 
 #endif
diff --git a/Source/WebCore/inspector/InjectedScriptHost.cpp b/Source/WebCore/inspector/InjectedScriptHost.cpp
index 47d408a57..6f5022afb 100644
--- a/Source/WebCore/inspector/InjectedScriptHost.cpp
+++ b/Source/WebCore/inspector/InjectedScriptHost.cpp
@@ -75,6 +75,7 @@ InjectedScriptHost::InjectedScriptHost()
     , m_domStorageAgent(0)
     , m_lastWorkerId(1 << 31) // Distinguish ids of fake workers from real ones, to minimize the chances they overlap.
 {
+    m_defaultInspectableObject = adoptPtr(new InspectableObject());
 }
 
 InjectedScriptHost::~InjectedScriptHost()
@@ -91,18 +92,6 @@ void InjectedScriptHost::disconnect()
     m_domStorageAgent = 0;
 }
 
-void InjectedScriptHost::addInspectedNode(Node* node)
-{
-    m_inspectedNodes.prepend(node);
-    while (m_inspectedNodes.size() > 5)
-        m_inspectedNodes.removeLast();
-}
-
-void InjectedScriptHost::clearInspectedNodes()
-{
-    m_inspectedNodes.clear();
-}
-
 void InjectedScriptHost::inspectImpl(PassRefPtr<InspectorValue> object, PassRefPtr<InspectorValue> hints)
 {
     if (m_inspectorAgent)
@@ -122,11 +111,28 @@ void InjectedScriptHost::copyText(const String& text)
     Pasteboard::generalPasteboard()->writePlainText(text);
 }
 
-Node* InjectedScriptHost::inspectedNode(unsigned int num)
+ScriptValue InjectedScriptHost::InspectableObject::get(ScriptState*)
 {
-    if (num < m_inspectedNodes.size())
-        return m_inspectedNodes[num].get();
-    return 0;
+    return ScriptValue();
+};
+
+void InjectedScriptHost::addInspectedObject(PassOwnPtr<InjectedScriptHost::InspectableObject> object)
+{
+    m_inspectedObjects.prepend(object);
+    while (m_inspectedObjects.size() > 5)
+        m_inspectedObjects.removeLast();
+}
+
+void InjectedScriptHost::clearInspectedObjects()
+{
+    m_inspectedObjects.clear();
+}
+
+InjectedScriptHost::InspectableObject* InjectedScriptHost::inspectedObject(unsigned int num)
+{
+    if (num >= m_inspectedObjects.size())
+        return m_defaultInspectableObject.get();
+    return m_inspectedObjects[num].get();
 }
 
 #if ENABLE(SQL_DATABASE)
diff --git a/Source/WebCore/inspector/InjectedScriptHost.h b/Source/WebCore/inspector/InjectedScriptHost.h
index 2db466a69..324670611 100644
--- a/Source/WebCore/inspector/InjectedScriptHost.h
+++ b/Source/WebCore/inspector/InjectedScriptHost.h
@@ -78,13 +78,18 @@ public:
 
     void disconnect();
 
-    void addInspectedNode(Node*);
-    void clearInspectedNodes();
+    class InspectableObject {
+    public:
+        virtual ScriptValue get(ScriptState*);
+        virtual ~InspectableObject() { }
+    };
+    void addInspectedObject(PassOwnPtr<InspectableObject>);
+    void clearInspectedObjects();
+    InspectableObject* inspectedObject(unsigned int num);
 
     void inspectImpl(PassRefPtr<InspectorValue> objectToInspect, PassRefPtr<InspectorValue> hints);
     void clearConsoleMessages();
     void copyText(const String& text);
-    Node* inspectedNode(unsigned int num);
 #if ENABLE(SQL_DATABASE)
     int databaseIdImpl(Database*);
 #endif
@@ -105,7 +110,8 @@ private:
 #endif
     InspectorDOMStorageAgent* m_domStorageAgent;
     long m_lastWorkerId;
-    Vector<RefPtr<Node> > m_inspectedNodes;
+    Vector<OwnPtr<InspectableObject> > m_inspectedObjects;
+    OwnPtr<InspectableObject> m_defaultInspectableObject;
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/inspector/InjectedScriptHost.idl b/Source/WebCore/inspector/InjectedScriptHost.idl
index b30a83587..ae146866b 100644
--- a/Source/WebCore/inspector/InjectedScriptHost.idl
+++ b/Source/WebCore/inspector/InjectedScriptHost.idl
@@ -38,7 +38,7 @@ module core {
 
         void copyText(in DOMString text);
         [Custom] void inspect(in DOMObject objectId, in DOMObject hints);
-        [Custom] DOMObject inspectedNode(in int num);
+        [Custom] DOMObject inspectedObject(in int num);
         [Custom] DOMObject internalConstructorName(in DOMObject object);
         [Custom] boolean isHTMLAllCollection(in DOMObject object);
         [Custom] DOMString type(in DOMObject object);
diff --git a/Source/WebCore/inspector/InjectedScriptSource.js b/Source/WebCore/inspector/InjectedScriptSource.js
index 27089a887..79e6c6d98 100644
--- a/Source/WebCore/inspector/InjectedScriptSource.js
+++ b/Source/WebCore/inspector/InjectedScriptSource.js
@@ -184,12 +184,17 @@ InjectedScript.prototype = {
 
         for (var i = 0; i < descriptors.length; ++i) {
             var descriptor = descriptors[i];
-            if (descriptor.get)
+            if ("get" in descriptor)
                 descriptor.get = this._wrapObject(descriptor.get, objectGroupName);
-            if (descriptor.set)
+            if ("set" in descriptor)
                 descriptor.set = this._wrapObject(descriptor.set, objectGroupName);
             if ("value" in descriptor)
                 descriptor.value = this._wrapObject(descriptor.value, objectGroupName);
+            if (!("configurable" in descriptor))
+                descriptor.configurable = false;
+            if (!("enumerable" in descriptor))
+                descriptor.enumerable = false;
+            
         }
         return descriptors;
     },
@@ -566,7 +571,7 @@ function CommandLineAPI(commandLineAPIImpl, callFrame)
         if (member in inspectedWindow || inScopeVariables(member))
             continue;
 
-        this.__defineGetter__("$" + i, bind(commandLineAPIImpl, commandLineAPIImpl._inspectedNode, i));
+        this.__defineGetter__("$" + i, bind(commandLineAPIImpl, commandLineAPIImpl._inspectedObject, i));
     }
 }
 
@@ -680,9 +685,9 @@ CommandLineAPIImpl.prototype = {
         InjectedScriptHost.clearConsoleMessages();
     },
 
-    _inspectedNode: function(num)
+    _inspectedObject: function(num)
     {
-        return InjectedScriptHost.inspectedNode(num);
+        return InjectedScriptHost.inspectedObject(num);
     },
 
     _normalizeEventTypes: function(types)
diff --git a/Source/WebCore/inspector/Inspector-0.1.json b/Source/WebCore/inspector/Inspector-0.1.json
index 0086d9a58..a5c03035c 100644
--- a/Source/WebCore/inspector/Inspector-0.1.json
+++ b/Source/WebCore/inspector/Inspector-0.1.json
@@ -265,7 +265,7 @@
                 "properties": [
                     { "name": "name", "type": "string", "description": "Property name." },
                     { "name": "value", "$ref": "RemoteObject", "optional": true, "description": "The value associated with the property." },
-                    { "name": "writable", "type": "boolean", "description": "True if the value associated with the property may be changed (data descriptors only)." },
+                    { "name": "writable", "type": "boolean", "optional": true, "description": "True if the value associated with the property may be changed (data descriptors only)." },
                     { "name": "get", "$ref": "RemoteObject", "optional": true, "description": "A function which serves as a getter for the property, or <code>undefined</code> if there is no getter (accessor descriptors only)." },
                     { "name": "set", "$ref": "RemoteObject", "optional": true, "description": "A function which serves as a setter for the property, or <code>undefined</code> if there is no setter (accessor descriptors only)." },
                     { "name": "configurable", "type": "boolean", "description": "True if the type of this property descriptor may be changed and if the property may be deleted from the corresponding object." },
diff --git a/Source/WebCore/inspector/Inspector-1.0.json b/Source/WebCore/inspector/Inspector-1.0.json
index 1d3cbdc02..e19e7e060 100644
--- a/Source/WebCore/inspector/Inspector-1.0.json
+++ b/Source/WebCore/inspector/Inspector-1.0.json
@@ -376,7 +376,7 @@
                 "properties": [
                     { "name": "name", "type": "string", "description": "Property name." },
                     { "name": "value", "$ref": "RemoteObject", "optional": true, "description": "The value associated with the property." },
-                    { "name": "writable", "type": "boolean", "description": "True if the value associated with the property may be changed (data descriptors only)." },
+                    { "name": "writable", "type": "boolean", "optional": true, "description": "True if the value associated with the property may be changed (data descriptors only)." },
                     { "name": "get", "$ref": "RemoteObject", "optional": true, "description": "A function which serves as a getter for the property, or <code>undefined</code> if there is no getter (accessor descriptors only)." },
                     { "name": "set", "$ref": "RemoteObject", "optional": true, "description": "A function which serves as a setter for the property, or <code>undefined</code> if there is no setter (accessor descriptors only)." },
                     { "name": "configurable", "type": "boolean", "description": "True if the type of this property descriptor may be changed and if the property may be deleted from the corresponding object." },
diff --git a/Source/WebCore/inspector/Inspector.json b/Source/WebCore/inspector/Inspector.json
index ffd22de21..24ec72ec9 100644
--- a/Source/WebCore/inspector/Inspector.json
+++ b/Source/WebCore/inspector/Inspector.json
@@ -137,7 +137,9 @@
                             "properties": [
                                 { "name": "url", "type": "string", "description": "Resource URL." },
                                 { "name": "type", "$ref": "ResourceType", "description": "Type of this resource." },
-                                { "name": "mimeType", "type": "string", "description": "Resource mimeType as determined by the browser." }
+                                { "name": "mimeType", "type": "string", "description": "Resource mimeType as determined by the browser." },
+                                { "name": "failed", "type": "boolean", "optional": true, "description": "True if the resource failed to load." },
+                                { "name": "canceled", "type": "boolean", "optional": true, "description": "True if the resource was canceled during loading." }
                             ]
                         },
                         "description": "Information about frame resources."
@@ -315,6 +317,14 @@
                     { "name": "height", "type": "integer", "description": "Overriding height value in pixels (minimum 0, maximum 10000000). 0 disables the override." }
                 ],
                 "hidden": true
+            },
+            {
+                "name": "setShowPaintRects",
+                "description": "Requests that backend shows paint rectangles",
+                "parameters": [
+                    { "name": "result", "type": "boolean", "description": "True for showing paint rectangles" }
+                ],
+                "hidden": true
             }
         ],
         "events": [
@@ -377,7 +387,7 @@
                 "properties": [
                     { "name": "name", "type": "string", "description": "Property name." },
                     { "name": "value", "$ref": "RemoteObject", "optional": true, "description": "The value associated with the property." },
-                    { "name": "writable", "type": "boolean", "description": "True if the value associated with the property may be changed (data descriptors only)." },
+                    { "name": "writable", "type": "boolean", "optional": true, "description": "True if the value associated with the property may be changed (data descriptors only)." },
                     { "name": "get", "$ref": "RemoteObject", "optional": true, "description": "A function which serves as a getter for the property, or <code>undefined</code> if there is no getter (accessor descriptors only)." },
                     { "name": "set", "$ref": "RemoteObject", "optional": true, "description": "A function which serves as a setter for the property, or <code>undefined</code> if there is no setter (accessor descriptors only)." },
                     { "name": "configurable", "type": "boolean", "description": "True if the type of this property descriptor may be changed and if the property may be deleted from the corresponding object." },
@@ -525,6 +535,12 @@
                 ],
                 "description": "Enables console to refer to the node with given id via $x (see Command Line API for more details $x functions).",
                 "hidden": true
+            },
+            {
+                "name": "addInspectedHeapObject",
+                "parameters": [
+                    { "name": "heapObjectId", "type": "integer" }
+		]
             }
         ],
         "events": [
@@ -971,6 +987,39 @@
                     { "name": "unique", "type": "boolean", "description": "If true, index is unique." },
                     { "name": "multiEntry", "type": "boolean", "description": "If true, index allows multiple entries for a key." }
                 ]
+            },
+            {
+                "id": "Key",
+                "type": "object",
+                "description": "Key.",
+                "properties": [
+                    { "name": "type", "type": "string", "enum": ["number", "string", "date", "array"], "description": "Key type." },
+                    { "name": "number", "type": "number", "optional": true, "description": "Number value." },
+                    { "name": "string", "type": "string", "optional": true, "description": "String value." },
+                    { "name": "date", "type": "number", "optional": true, "description": "Date value." },
+                    { "name": "array", "type": "array", "optional": true, "items": { "$ref": "Key" }, "description": "Array value." }
+                ]
+            },
+            {
+                "id": "KeyRange",
+                "type": "object",
+                "description": "Key range.",
+                "properties": [
+                    { "name": "lower", "$ref": "Key", "optional": true, "description": "Lower bound." },
+                    { "name": "upper", "$ref": "Key", "optional": true, "description": "Upper bound." },
+                    { "name": "lowerOpen", "type": "boolean", "description": "If true lower bound is open." },
+                    { "name": "upperOpen", "type": "boolean", "description": "If true upper bound is open." }
+                ]
+            },
+            {
+                "id": "DataEntry",
+                "type": "object",
+                "description": "Key.",
+                "properties": [
+                    { "name": "key", "$ref": "Key", "description": "Key." },
+                    { "name": "primaryKey", "$ref": "Key", "description": "Primary key." },
+                    { "name": "value", "$ref": "Runtime.RemoteObject", "description": "Value." }
+                ]
             }
         ],
         "commands": [
@@ -994,10 +1043,24 @@
                 "name": "requestDatabase",
                 "parameters": [
                     { "name": "requestId", "type": "integer", "description": "Request id." },
-                    { "name": "frameId", "$ref": "Network.FrameId" },
-                    { "name": "databaseName", "type": "string" }
+                    { "name": "frameId", "$ref": "Network.FrameId", "description": "Frame id." },
+                    { "name": "databaseName", "type": "string", "description": "Database name." }
                 ],
                 "description": "Requests database with given name in given frame."
+            },
+            {
+                "name": "requestData",
+                "parameters": [
+                    { "name": "requestId", "type": "integer", "description": "Request id." },
+                    { "name": "frameId", "$ref": "Network.FrameId", "description": "Frame id." },
+                    { "name": "databaseName", "type": "string", "description": "Database name." },
+                    { "name": "objectStoreName", "type": "string", "description": "Object store name." },
+                    { "name": "indexName", "type": "string", "description": "Index name, empty string for object store data requests." },
+                    { "name": "skipCount", "type": "integer", "description": "Number of records to skip." },
+                    { "name": "pageSize", "type": "integer", "description": "Number of records to fetch." },
+                    { "name": "keyRange", "$ref": "KeyRange", "optional": true, "description": "Key range." }
+                ],
+                "description": "Requests data from object store or index."
             }
         ],
         "events": [
@@ -1014,6 +1077,22 @@
                     { "name": "requestId", "type": "integer", "description": "Request id." },
                     { "name": "databaseWithObjectStores", "$ref": "DatabaseWithObjectStores", "description": "Database with an array of object stores." }
                 ]
+            },
+            {
+                "name": "objectStoreDataLoaded",
+                "parameters": [
+                    { "name": "requestId", "type": "integer", "description": "Request id." },
+                    { "name": "objectStoreDataEntries", "type": "array", "items": { "$ref": "DataEntry" }, "description": "Array of object store data entries." },
+                    { "name": "hasMore", "type": "boolean", "description": "If true, there are more entries to fetch in the given range." }
+                ]
+            },
+            {
+                "name": "indexDataLoaded",
+                "parameters": [
+                    { "name": "requestId", "type": "integer", "description": "Request id." },
+                    { "name": "indexDataEntries", "type": "array", "items": { "$ref": "DataEntry" }, "description": "Array of index data entries." },
+                    { "name": "hasMore", "type": "boolean", "description": "If true, there are more entries to fetch in the given range." }
+                ]
             }
         ]
     },
@@ -1523,6 +1602,11 @@
                 "hidden": true
             },
             {
+                "name": "redo",
+                "description": "Re-does the last undone action.",
+                "hidden": true
+            },
+            {
                 "name": "markUndoableState",
                 "description": "Marks last undoable state.",
                 "hidden": true
@@ -1607,10 +1691,14 @@
         "description": "This domain exposes CSS read/write operations. All CSS objects, like stylesheets, rules, and styles, have an associated <code>id</code> used in subsequent operations on the related object. Each object type has a specific <code>id</code> structure, and those are not interchangeable between objects of different kinds. CSS objects can be loaded using the <code>get*ForNode()</code> calls (which accept a DOM node id). Alternatively, a client can discover all the existing stylesheets with the <code>getAllStyleSheets()</code> method and subsequently load the required stylesheet contents using the <code>getStyleSheet[Text]()</code> methods.",
         "types": [
             {
+                "id": "StyleSheetId",
+                "type": "string"
+            },
+            {
                 "id": "CSSStyleId",
                 "type": "object",
                 "properties": [
-                    { "name": "styleSheetId", "type": "string", "description": "Enclosing stylesheet identifier." },
+                    { "name": "styleSheetId", "$ref": "StyleSheetId", "description": "Enclosing stylesheet identifier." },
                     { "name": "ordinal", "type": "integer", "description": "The style ordinal within the stylesheet." }
                 ],
                 "description": "This object identifies a CSS style in a unique way."
@@ -1619,7 +1707,7 @@
                 "id": "CSSRuleId",
                 "type": "object",
                 "properties": [
-                    { "name": "styleSheetId", "type": "string", "description": "Enclosing stylesheet identifier." },
+                    { "name": "styleSheetId", "$ref": "StyleSheetId", "description": "Enclosing stylesheet identifier." },
                     { "name": "ordinal", "type": "integer", "description": "The rule ordinal within the stylesheet." }
                 ],
                 "description": "This object identifies a CSS rule in a unique way."
@@ -1655,7 +1743,7 @@
                 "id": "CSSStyleSheetHeader",
                 "type": "object",
                 "properties": [
-                    { "name": "styleSheetId", "type": "string", "description": "The stylesheet identifier."},
+                    { "name": "styleSheetId", "$ref": "StyleSheetId", "description": "The stylesheet identifier."},
                     { "name": "sourceURL", "type": "string", "description": "Stylesheet resource URL."},
                     { "name": "title", "type": "string", "description": "Stylesheet title."},
                     { "name": "disabled", "type": "boolean", "description": "Denotes whether the stylesheet is disabled."}
@@ -1666,7 +1754,7 @@
                 "id": "CSSStyleSheetBody",
                 "type": "object",
                 "properties": [
-                    { "name": "styleSheetId", "type": "string", "description": "The stylesheet identifier."},
+                    { "name": "styleSheetId", "$ref": "StyleSheetId", "description": "The stylesheet identifier."},
                     { "name": "rules", "type": "array", "items": { "$ref": "CSSRule" }, "description": "Stylesheet resource URL."},
                     { "name": "text", "type": "string", "optional": true, "description": "Stylesheet resource contents (if available)."}
                 ],
@@ -1827,7 +1915,7 @@
             {
                 "name": "getStyleSheet",
                 "parameters": [
-                    { "name": "styleSheetId", "type": "string" }
+                    { "name": "styleSheetId", "$ref": "StyleSheetId" }
                 ],
                 "returns": [
                     { "name": "styleSheet", "$ref": "CSSStyleSheetBody", "description": "Stylesheet contents for the specified <code>styleSheetId</code>." }
@@ -1837,7 +1925,7 @@
             {
                 "name": "getStyleSheetText",
                 "parameters": [
-                    { "name": "styleSheetId", "type": "string" }
+                    { "name": "styleSheetId", "$ref": "StyleSheetId" }
                 ],
                 "returns": [
                     { "name": "text", "type": "string", "description": "The stylesheet text." }
@@ -1847,7 +1935,7 @@
             {
                 "name": "setStyleSheetText",
                 "parameters": [
-                    { "name": "styleSheetId", "type": "string" },
+                    { "name": "styleSheetId", "$ref": "StyleSheetId" },
                     { "name": "text", "type": "string" }
                 ],
                 "description": "Sets the new stylesheet text, thereby invalidating all existing <code>CSSStyleId</code>'s and <code>CSSRuleId</code>'s contained by this stylesheet."
@@ -1920,6 +2008,13 @@
             {
                 "name": "mediaQueryResultChanged",
                 "description": "Fires whenever a MediaQuery result changes (for example, after a browser window has been resized.) The current implementation considers only viewport-dependent media features."
+            },
+            {
+                "name": "styleSheetChanged",
+                "parameters": [
+                    { "name": "styleSheetId", "$ref": "StyleSheetId" }
+                ],
+                "description": "Fired whenever a stylesheet is changed as a result of the client operation."
             }
         ]
     },
diff --git a/Source/WebCore/inspector/InspectorAgent.cpp b/Source/WebCore/inspector/InspectorAgent.cpp
index ec4ce1d6c..31d516603 100644
--- a/Source/WebCore/inspector/InspectorAgent.cpp
+++ b/Source/WebCore/inspector/InspectorAgent.cpp
@@ -150,7 +150,7 @@ void InspectorAgent::disable(ErrorString*)
 
 void InspectorAgent::domContentLoadedEventFired()
 {
-    m_injectedScriptManager->injectedScriptHost()->clearInspectedNodes();
+    m_injectedScriptManager->injectedScriptHost()->clearInspectedObjects();
 }
 
 bool InspectorAgent::isMainResourceLoader(DocumentLoader* loader, const KURL& requestUrl)
diff --git a/Source/WebCore/inspector/InspectorAllInOne.cpp b/Source/WebCore/inspector/InspectorAllInOne.cpp
index 35173cb9e..b12230432 100644
--- a/Source/WebCore/inspector/InspectorAllInOne.cpp
+++ b/Source/WebCore/inspector/InspectorAllInOne.cpp
@@ -25,6 +25,15 @@
 
 // This all-in-one cpp file cuts down on template bloat to allow us to build our Windows release build.
 
+#include "ConsoleMessage.cpp"
+#include "ContentSearchUtils.cpp"
+#include "DOMEditor.cpp"
+#include "DOMNodeHighlighter.cpp"
+#include "DOMPatchSupport.cpp"
+#include "IdentifiersFactory.cpp"
+#include "InjectedScript.cpp"
+#include "InjectedScriptHost.cpp"
+#include "InjectedScriptManager.cpp"
 #include "InspectorAgent.cpp"
 #include "InspectorApplicationCacheAgent.cpp"
 #include "InspectorBaseAgent.cpp"
@@ -32,6 +41,7 @@
 #include "InspectorClient.cpp"
 #include "InspectorConsoleAgent.cpp"
 #include "InspectorController.cpp"
+#include "InspectorCounters.cpp"
 #include "InspectorDOMAgent.cpp"
 #include "InspectorDOMDebuggerAgent.cpp"
 #include "InspectorDOMStorageAgent.cpp"
@@ -56,3 +66,16 @@
 #include "InspectorTimelineAgent.cpp"
 #include "InspectorValues.cpp"
 #include "InspectorWorkerAgent.cpp"
+#include "InstrumentingAgents.cpp"
+#include "NetworkResourcesData.cpp"
+#include "PageConsoleAgent.cpp"
+#include "PageDebuggerAgent.cpp"
+#include "PageRuntimeAgent.cpp"
+#include "ScriptArguments.cpp"
+#include "ScriptCallFrame.cpp"
+#include "ScriptCallStack.cpp"
+#include "TimelineRecordFactory.cpp"
+#include "WorkerConsoleAgent.cpp"
+#include "WorkerDebuggerAgent.cpp"
+#include "WorkerInspectorController.cpp"
+#include "WorkerRuntimeAgent.cpp"
diff --git a/Source/WebCore/inspector/InspectorCSSAgent.cpp b/Source/WebCore/inspector/InspectorCSSAgent.cpp
index 05d22bd06..1f4f713a8 100644
--- a/Source/WebCore/inspector/InspectorCSSAgent.cpp
+++ b/Source/WebCore/inspector/InspectorCSSAgent.cpp
@@ -221,68 +221,63 @@ PassRefPtr<InspectorObject> SelectorProfile::toInspectorObject() const
 class InspectorCSSAgent::StyleSheetAction : public InspectorHistory::Action {
     WTF_MAKE_NONCOPYABLE(StyleSheetAction);
 public:
-    StyleSheetAction(const String& name, InspectorCSSAgent* cssAgent, const String& styleSheetId)
+    StyleSheetAction(const String& name, InspectorStyleSheet* styleSheet)
         : InspectorHistory::Action(name)
-        , m_cssAgent(cssAgent)
-        , m_styleSheetId(styleSheetId)
+        , m_styleSheet(styleSheet)
     {
     }
 
-    virtual bool perform(ErrorString* errorString)
-    {
-        InspectorStyleSheet* styleSheet = m_cssAgent->assertStyleSheetForId(errorString, m_styleSheetId);
-        if (!styleSheet)
-            return false;
-        return perform(styleSheet, errorString);
-    }
-
-    virtual bool undo(ErrorString* errorString)
-    {
-        InspectorStyleSheet* styleSheet = m_cssAgent->assertStyleSheetForId(errorString, m_styleSheetId);
-        if (!styleSheet)
-            return false;
-        return undo(styleSheet, errorString);
-    }
-
-    virtual bool perform(InspectorStyleSheet*, ErrorString*) = 0;
-
-    virtual bool undo(InspectorStyleSheet*, ErrorString*) = 0;
-
 protected:
-    InspectorCSSAgent* m_cssAgent;
-    String m_styleSheetId;
+    RefPtr<InspectorStyleSheet> m_styleSheet;
 };
 
 class InspectorCSSAgent::SetStyleSheetTextAction : public InspectorCSSAgent::StyleSheetAction {
     WTF_MAKE_NONCOPYABLE(SetStyleSheetTextAction);
 public:
-    SetStyleSheetTextAction(InspectorCSSAgent* cssAgent, const String& styleSheetId, const String& text)
-        : InspectorCSSAgent::StyleSheetAction("SetStyleSheetText", cssAgent, styleSheetId)
+    SetStyleSheetTextAction(InspectorStyleSheet* styleSheet, const String& text)
+        : InspectorCSSAgent::StyleSheetAction("SetStyleSheetText", styleSheet)
         , m_text(text)
     {
     }
 
-    virtual bool perform(InspectorStyleSheet* inspectorStyleSheet, ErrorString*)
+    virtual bool perform(ExceptionCode& ec)
     {
-        if (!inspectorStyleSheet->getText(&m_oldText))
+        if (!m_styleSheet->getText(&m_oldText))
             return false;
+        return redo(ec);
+    }
 
-        if (inspectorStyleSheet->setText(m_text)) {
-            inspectorStyleSheet->reparseStyleSheet(m_text);
+    virtual bool undo(ExceptionCode&)
+    {
+        if (m_styleSheet->setText(m_oldText)) {
+            m_styleSheet->reparseStyleSheet(m_oldText);
             return true;
         }
         return false;
     }
 
-    virtual bool undo(InspectorStyleSheet* inspectorStyleSheet, ErrorString*)
+    virtual bool redo(ExceptionCode&)
     {
-        if (inspectorStyleSheet->setText(m_oldText)) {
-            inspectorStyleSheet->reparseStyleSheet(m_oldText);
+        if (m_styleSheet->setText(m_text)) {
+            m_styleSheet->reparseStyleSheet(m_text);
             return true;
         }
         return false;
     }
 
+    virtual String mergeId()
+    {
+        return String::format("SetStyleSheetText %s", m_styleSheet->id().utf8().data());
+    }
+
+    virtual void merge(PassOwnPtr<Action> action)
+    {
+        ASSERT(action->mergeId() == mergeId());
+
+        SetStyleSheetTextAction* other = static_cast<SetStyleSheetTextAction*>(action.get());
+        m_text = other->m_text;
+    }
+
 private:
     String m_text;
     String m_oldText;
@@ -291,8 +286,8 @@ private:
 class InspectorCSSAgent::SetPropertyTextAction : public InspectorCSSAgent::StyleSheetAction {
     WTF_MAKE_NONCOPYABLE(SetPropertyTextAction);
 public:
-    SetPropertyTextAction(InspectorCSSAgent* cssAgent, const String& styleSheetId, const InspectorCSSId& cssId, unsigned propertyIndex, const String& text, bool overwrite)
-        : InspectorCSSAgent::StyleSheetAction("SetPropertyText", cssAgent, styleSheetId)
+    SetPropertyTextAction(InspectorStyleSheet* styleSheet, const InspectorCSSId& cssId, unsigned propertyIndex, const String& text, bool overwrite)
+        : InspectorCSSAgent::StyleSheetAction("SetPropertyText", styleSheet)
         , m_cssId(cssId)
         , m_propertyIndex(propertyIndex)
         , m_text(text)
@@ -305,10 +300,21 @@ public:
         return mergeId() + ": " + m_oldText + " -> " + m_text;
     }
 
-    virtual bool perform(InspectorStyleSheet* inspectorStyleSheet, ErrorString* errorString)
+    virtual bool perform(ExceptionCode& ec)
+    {
+        return redo(ec);
+    }
+
+    virtual bool undo(ExceptionCode& ec)
+    {
+        String placeholder;
+        return m_styleSheet->setPropertyText(m_cssId, m_propertyIndex, m_overwrite ? m_oldText : "", true, &placeholder, ec);
+    }
+
+    virtual bool redo(ExceptionCode& ec)
     {
         String oldText;
-        bool result = inspectorStyleSheet->setPropertyText(errorString, m_cssId, m_propertyIndex, m_text, m_overwrite, &oldText);
+        bool result = m_styleSheet->setPropertyText(m_cssId, m_propertyIndex, m_text, m_overwrite, &oldText, ec);
         m_oldText = oldText.stripWhiteSpace();
         // FIXME: remove this once the model handles this case.
         if (!m_oldText.endsWith(";"))
@@ -316,15 +322,9 @@ public:
         return result;
     }
 
-    virtual bool undo(InspectorStyleSheet* inspectorStyleSheet, ErrorString* errorString)
-    {
-        String placeholder;
-        return inspectorStyleSheet->setPropertyText(errorString, m_cssId, m_propertyIndex, m_overwrite ? m_oldText : "", true, &placeholder);
-    }
-
     virtual String mergeId()
     {
-        return String::format("SetPropertyText %s:%u:%s", m_styleSheetId.utf8().data(), m_propertyIndex, m_overwrite ? "true" : "false");
+        return String::format("SetPropertyText %s:%u:%s", m_styleSheet->id().utf8().data(), m_propertyIndex, m_overwrite ? "true" : "false");
     }
 
     virtual void merge(PassOwnPtr<Action> action)
@@ -346,22 +346,27 @@ private:
 class InspectorCSSAgent::TogglePropertyAction : public InspectorCSSAgent::StyleSheetAction {
     WTF_MAKE_NONCOPYABLE(TogglePropertyAction);
 public:
-    TogglePropertyAction(InspectorCSSAgent* cssAgent, const String& styleSheetId, const InspectorCSSId& cssId, unsigned propertyIndex, bool disable)
-        : InspectorCSSAgent::StyleSheetAction("ToggleProperty", cssAgent, styleSheetId)
+    TogglePropertyAction(InspectorStyleSheet* styleSheet, const InspectorCSSId& cssId, unsigned propertyIndex, bool disable)
+        : InspectorCSSAgent::StyleSheetAction("ToggleProperty", styleSheet)
         , m_cssId(cssId)
         , m_propertyIndex(propertyIndex)
         , m_disable(disable)
     {
     }
 
-    virtual bool perform(InspectorStyleSheet* inspectorStyleSheet, ErrorString* errorString)
+    virtual bool perform(ExceptionCode& ec)
+    {
+        return redo(ec);
+    }
+
+    virtual bool undo(ExceptionCode& ec)
     {
-        return inspectorStyleSheet->toggleProperty(errorString, m_cssId, m_propertyIndex, m_disable);
+        return m_styleSheet->toggleProperty(m_cssId, m_propertyIndex, !m_disable, ec);
     }
 
-    virtual bool undo(InspectorStyleSheet* inspectorStyleSheet, ErrorString* errorString)
+    virtual bool redo(ExceptionCode& ec)
     {
-      return inspectorStyleSheet->toggleProperty(errorString, m_cssId, m_propertyIndex, !m_disable);
+        return m_styleSheet->toggleProperty(m_cssId, m_propertyIndex, m_disable, ec);
     }
 
 private:
@@ -370,6 +375,76 @@ private:
     bool m_disable;
 };
 
+class InspectorCSSAgent::SetRuleSelectorAction : public InspectorCSSAgent::StyleSheetAction {
+    WTF_MAKE_NONCOPYABLE(SetRuleSelectorAction);
+public:
+    SetRuleSelectorAction(InspectorStyleSheet* styleSheet, const InspectorCSSId& cssId, const String& selector)
+        : InspectorCSSAgent::StyleSheetAction("SetRuleSelector", styleSheet)
+        , m_cssId(cssId)
+        , m_selector(selector)
+    {
+    }
+
+    virtual bool perform(ExceptionCode& ec)
+    {
+        m_oldSelector = m_styleSheet->ruleSelector(m_cssId, ec);
+        if (ec)
+            return false;
+        return redo(ec);
+    }
+
+    virtual bool undo(ExceptionCode& ec)
+    {
+        return m_styleSheet->setRuleSelector(m_cssId, m_oldSelector, ec);
+    }
+
+    virtual bool redo(ExceptionCode& ec)
+    {
+        return m_styleSheet->setRuleSelector(m_cssId, m_selector, ec);
+    }
+
+private:
+    InspectorCSSId m_cssId;
+    String m_selector;
+    String m_oldSelector;
+};
+
+class InspectorCSSAgent::AddRuleAction : public InspectorCSSAgent::StyleSheetAction {
+    WTF_MAKE_NONCOPYABLE(AddRuleAction);
+public:
+    AddRuleAction(InspectorStyleSheet* styleSheet, const String& selector)
+        : InspectorCSSAgent::StyleSheetAction("AddRule", styleSheet)
+        , m_selector(selector)
+    {
+    }
+
+    virtual bool perform(ExceptionCode& ec)
+    {
+        return redo(ec);
+    }
+
+    virtual bool undo(ExceptionCode& ec)
+    {
+        return m_styleSheet->deleteRule(m_newId, ec);
+    }
+
+    virtual bool redo(ExceptionCode& ec)
+    {
+        CSSStyleRule* cssStyleRule = m_styleSheet->addRule(m_selector, ec);
+        if (ec)
+            return false;
+        m_newId = m_styleSheet->ruleId(cssStyleRule);
+        return true;
+    }
+
+    InspectorCSSId newRuleId() { return m_newId; }
+
+private:
+    InspectorCSSId m_newId;
+    String m_selector;
+    String m_oldSelector;
+};
+
 // static
 CSSStyleRule* InspectorCSSAgent::asCSSStyleRule(CSSRule* rule)
 {
@@ -559,7 +634,7 @@ void InspectorCSSAgent::getComputedStyleForNode(ErrorString* errorString, int no
 
     recalcStyleForPseudoStateIfNeeded(element, forcedPseudoClasses ? forcedPseudoClasses->get() : 0);
 
-    RefPtr<CSSComputedStyleDeclaration> computedStyleInfo = computedStyle(element, true);
+    RefPtr<CSSComputedStyleDeclaration> computedStyleInfo = CSSComputedStyleDeclaration::create(element, true);
     RefPtr<InspectorStyle> inspectorStyle = InspectorStyle::create(InspectorCSSId(), computedStyleInfo, 0);
     style = inspectorStyle->buildArrayForComputedStyle();
 }
@@ -597,8 +672,13 @@ void InspectorCSSAgent::getStyleSheetText(ErrorString* errorString, const String
 
 void InspectorCSSAgent::setStyleSheetText(ErrorString* errorString, const String& styleSheetId, const String& text)
 {
-    m_domAgent->history()->perform(adoptPtr(new SetStyleSheetTextAction(this, styleSheetId, text)), errorString);
-    m_domAgent->history()->markUndoableState();
+    InspectorStyleSheet* inspectorStyleSheet = assertStyleSheetForId(errorString, styleSheetId);
+    if (!inspectorStyleSheet)
+        return;
+
+    ExceptionCode ec = 0;
+    m_domAgent->history()->perform(adoptPtr(new SetStyleSheetTextAction(inspectorStyleSheet, text)), ec);
+    *errorString = InspectorDOMAgent::toErrorString(ec);
 }
 
 void InspectorCSSAgent::setPropertyText(ErrorString* errorString, const RefPtr<InspectorObject>& fullStyleId, int propertyIndex, const String& text, bool overwrite, RefPtr<InspectorObject>& result)
@@ -610,9 +690,11 @@ void InspectorCSSAgent::setPropertyText(ErrorString* errorString, const RefPtr<I
     if (!inspectorStyleSheet)
         return;
 
-    bool success = m_domAgent->history()->perform(adoptPtr(new SetPropertyTextAction(this, compoundId.styleSheetId(), compoundId, propertyIndex, text, overwrite)), errorString);
+    ExceptionCode ec = 0;
+    bool success = m_domAgent->history()->perform(adoptPtr(new SetPropertyTextAction(inspectorStyleSheet, compoundId, propertyIndex, text, overwrite)), ec);
     if (success)
         result = inspectorStyleSheet->buildObjectForStyle(inspectorStyleSheet->styleForId(compoundId));
+    *errorString = InspectorDOMAgent::toErrorString(ec);
 }
 
 void InspectorCSSAgent::toggleProperty(ErrorString* errorString, const RefPtr<InspectorObject>& fullStyleId, int propertyIndex, bool disable, RefPtr<InspectorObject>& result)
@@ -624,10 +706,11 @@ void InspectorCSSAgent::toggleProperty(ErrorString* errorString, const RefPtr<In
     if (!inspectorStyleSheet)
         return;
 
-    bool success = m_domAgent->history()->perform(adoptPtr(new TogglePropertyAction(this, compoundId.styleSheetId(), compoundId, propertyIndex, disable)), errorString);
+    ExceptionCode ec = 0;
+    bool success = m_domAgent->history()->perform(adoptPtr(new TogglePropertyAction(inspectorStyleSheet, compoundId, propertyIndex, disable)), ec);
     if (success)
         result = inspectorStyleSheet->buildObjectForStyle(inspectorStyleSheet->styleForId(compoundId));
-    m_domAgent->history()->markUndoableState();
+    *errorString = InspectorDOMAgent::toErrorString(ec);
 }
 
 void InspectorCSSAgent::setRuleSelector(ErrorString* errorString, const RefPtr<InspectorObject>& fullRuleId, const String& selector, RefPtr<InspectorObject>& result)
@@ -639,27 +722,40 @@ void InspectorCSSAgent::setRuleSelector(ErrorString* errorString, const RefPtr<I
     if (!inspectorStyleSheet)
         return;
 
-    bool success = inspectorStyleSheet->setRuleSelector(compoundId, selector);
-    if (!success)
-        return;
+    ExceptionCode ec = 0;
+    bool success = m_domAgent->history()->perform(adoptPtr(new SetRuleSelectorAction(inspectorStyleSheet, compoundId, selector)), ec);
+    if (success)
+        result = inspectorStyleSheet->buildObjectForStyle(inspectorStyleSheet->styleForId(compoundId));
+    *errorString = InspectorDOMAgent::toErrorString(ec);
 
-    result = inspectorStyleSheet->buildObjectForRule(inspectorStyleSheet->ruleForId(compoundId));
+    if (success)
+        result = inspectorStyleSheet->buildObjectForRule(inspectorStyleSheet->ruleForId(compoundId));
 }
 
-void InspectorCSSAgent::addRule(ErrorString*, const int contextNodeId, const String& selector, RefPtr<InspectorObject>& result)
+void InspectorCSSAgent::addRule(ErrorString* errorString, const int contextNodeId, const String& selector, RefPtr<InspectorObject>& result)
 {
-    Node* node = m_domAgent->nodeForId(contextNodeId);
+    Node* node = m_domAgent->assertNode(errorString, contextNodeId);
     if (!node)
         return;
 
     InspectorStyleSheet* inspectorStyleSheet = viaInspectorStyleSheet(node->document(), true);
-    if (!inspectorStyleSheet)
+    if (!inspectorStyleSheet) {
+        *errorString = "No target stylesheet found";
         return;
-    CSSStyleRule* newRule = inspectorStyleSheet->addRule(selector);
-    if (!newRule)
+    }
+
+    ExceptionCode ec = 0;
+    OwnPtr<AddRuleAction> action = adoptPtr(new AddRuleAction(inspectorStyleSheet, selector));
+    AddRuleAction* rawAction = action.get();
+    bool success = m_domAgent->history()->perform(action.release(), ec);
+    if (!success) {
+        *errorString = InspectorDOMAgent::toErrorString(ec);
         return;
+    }
 
-    result = inspectorStyleSheet->buildObjectForRule(newRule);
+    InspectorCSSId ruleId = rawAction->newRuleId();
+    CSSStyleRule* rule = inspectorStyleSheet->ruleForId(ruleId);
+    result = inspectorStyleSheet->buildObjectForRule(rule);
 }
 
 void InspectorCSSAgent::getSupportedCSSProperties(ErrorString*, RefPtr<InspectorArray>& cssProperties)
@@ -725,7 +821,7 @@ InspectorStyleSheetForInlineStyle* InspectorCSSAgent::asInspectorStyleSheet(Elem
             return 0;
 
         String newStyleSheetId = String::number(m_lastStyleSheetId++);
-        RefPtr<InspectorStyleSheetForInlineStyle> inspectorStyleSheet = InspectorStyleSheetForInlineStyle::create(newStyleSheetId, element, "regular");
+        RefPtr<InspectorStyleSheetForInlineStyle> inspectorStyleSheet = InspectorStyleSheetForInlineStyle::create(newStyleSheetId, element, "regular", this);
         m_idToInspectorStyleSheet.set(newStyleSheetId, inspectorStyleSheet);
         m_nodeToInspectorStyleSheet.set(element, inspectorStyleSheet);
         return inspectorStyleSheet.get();
@@ -768,7 +864,7 @@ InspectorStyleSheet* InspectorCSSAgent::bindStyleSheet(CSSStyleSheet* styleSheet
     if (!inspectorStyleSheet) {
         String id = String::number(m_lastStyleSheetId++);
         Document* document = styleSheet->findDocument();
-        inspectorStyleSheet = InspectorStyleSheet::create(id, styleSheet, detectOrigin(styleSheet, document), InspectorDOMAgent::documentURLString(document));
+        inspectorStyleSheet = InspectorStyleSheet::create(id, styleSheet, detectOrigin(styleSheet, document), InspectorDOMAgent::documentURLString(document), this);
         m_idToInspectorStyleSheet.set(id, inspectorStyleSheet);
         m_cssStyleSheetToInspectorStyleSheet.set(styleSheet, inspectorStyleSheet);
     }
@@ -809,7 +905,7 @@ InspectorStyleSheet* InspectorCSSAgent::viaInspectorStyleSheet(Document* documen
         return 0;
     CSSStyleSheet* cssStyleSheet = static_cast<CSSStyleSheet*>(styleSheet);
     String id = String::number(m_lastStyleSheetId++);
-    inspectorStyleSheet = InspectorStyleSheet::create(id, cssStyleSheet, "inspector", InspectorDOMAgent::documentURLString(document));
+    inspectorStyleSheet = InspectorStyleSheet::create(id, cssStyleSheet, "inspector", InspectorDOMAgent::documentURLString(document), this);
     m_idToInspectorStyleSheet.set(id, inspectorStyleSheet);
     m_cssStyleSheetToInspectorStyleSheet.set(cssStyleSheet, inspectorStyleSheet);
     m_documentToInspectorStyleSheet.set(document, inspectorStyleSheet);
@@ -913,6 +1009,12 @@ void InspectorCSSAgent::didModifyDOMAttr(Element* element)
     it->second->didModifyElementAttribute();
 }
 
+void InspectorCSSAgent::styleSheetChanged(InspectorStyleSheet* styleSheet)
+{
+    if (m_frontend)
+        m_frontend->styleSheetChanged(styleSheet->id());
+}
+
 void InspectorCSSAgent::clearPseudoState(bool recalcStyles)
 {
     RefPtr<Element> element = m_lastElementWithPseudoState;
diff --git a/Source/WebCore/inspector/InspectorCSSAgent.h b/Source/WebCore/inspector/InspectorCSSAgent.h
index 4afd9fb1c..e7ee76572 100644
--- a/Source/WebCore/inspector/InspectorCSSAgent.h
+++ b/Source/WebCore/inspector/InspectorCSSAgent.h
@@ -54,7 +54,11 @@ class SelectorProfile;
 
 #if ENABLE(INSPECTOR)
 
-class InspectorCSSAgent : public InspectorBaseAgent<InspectorCSSAgent>, public InspectorDOMAgent::DOMListener, public InspectorBackendDispatcher::CSSCommandHandler {
+class InspectorCSSAgent
+    : public InspectorBaseAgent<InspectorCSSAgent>
+    , public InspectorDOMAgent::DOMListener
+    , public InspectorBackendDispatcher::CSSCommandHandler
+    , public InspectorStyleSheet::Listener {
     WTF_MAKE_NONCOPYABLE(InspectorCSSAgent);
 public:
     static CSSStyleRule* asCSSStyleRule(CSSRule*);
@@ -102,6 +106,8 @@ private:
     class SetStyleSheetTextAction;
     class SetPropertyTextAction;
     class TogglePropertyAction;
+    class SetRuleSelectorAction;
+    class AddRuleAction;
 
     InspectorCSSAgent(InstrumentingAgents*, InspectorState*, InspectorDOMAgent*);
 
@@ -123,11 +129,14 @@ private:
     PassRefPtr<InspectorArray> buildArrayForRuleList(CSSRuleList* ruleList);
     PassRefPtr<InspectorObject> buildObjectForAttributesStyle(Element*);
 
-    // InspectorDOMAgent::DOMListener interface
+    // InspectorDOMAgent::DOMListener implementation
     virtual void didRemoveDocument(Document*);
     virtual void didRemoveDOMNode(Node*);
     virtual void didModifyDOMAttr(Element*);
 
+    // InspectorCSSAgent::Listener implementation
+    virtual void styleSheetChanged(InspectorStyleSheet*);
+
     void clearPseudoState(bool recalcStyles);
 
     InspectorFrontend::CSS* m_frontend;
diff --git a/Source/WebCore/inspector/InspectorConsoleAgent.cpp b/Source/WebCore/inspector/InspectorConsoleAgent.cpp
index 4f7db0c6a..ad51add56 100644
--- a/Source/WebCore/inspector/InspectorConsoleAgent.cpp
+++ b/Source/WebCore/inspector/InspectorConsoleAgent.cpp
@@ -41,6 +41,8 @@
 #include "ScriptArguments.h"
 #include "ScriptCallFrame.h"
 #include "ScriptCallStack.h"
+#include "ScriptObject.h"
+#include "ScriptProfiler.h"
 #include <wtf/CurrentTime.h>
 #include <wtf/OwnPtr.h>
 #include <wtf/PassOwnPtr.h>
@@ -279,6 +281,22 @@ void InspectorConsoleAgent::addConsoleMessage(PassOwnPtr<ConsoleMessage> console
     }
 }
 
+class InspectableHeapObject : public InjectedScriptHost::InspectableObject {
+public:
+    explicit InspectableHeapObject(int heapObjectId) : m_heapObjectId(heapObjectId) { }
+    virtual ScriptValue get(ScriptState*)
+    {
+        return ScriptProfiler::objectByHeapObjectId(m_heapObjectId);
+    }
+private:
+    int m_heapObjectId;
+};
+
+void InspectorConsoleAgent::addInspectedHeapObject(ErrorString*, int inspectedHeapObjectId)
+{
+    m_injectedScriptManager->injectedScriptHost()->addInspectedObject(adoptPtr(new InspectableHeapObject(inspectedHeapObjectId)));
+}
+
 } // namespace WebCore
 
 #endif // ENABLE(INSPECTOR)
diff --git a/Source/WebCore/inspector/InspectorConsoleAgent.h b/Source/WebCore/inspector/InspectorConsoleAgent.h
index 302429a45..4ba4aaa2d 100644
--- a/Source/WebCore/inspector/InspectorConsoleAgent.h
+++ b/Source/WebCore/inspector/InspectorConsoleAgent.h
@@ -85,6 +85,7 @@ public:
 #endif
     virtual void setMonitoringXHREnabled(ErrorString*, bool enabled);
     virtual void addInspectedNode(ErrorString*, int nodeId) = 0;
+    virtual void addInspectedHeapObject(ErrorString*, int inspectedHeapObjectId);
 
 protected:
     void addConsoleMessage(PassOwnPtr<ConsoleMessage>);
diff --git a/Source/WebCore/inspector/InspectorController.cpp b/Source/WebCore/inspector/InspectorController.cpp
index a942d0888..c08721d9b 100644
--- a/Source/WebCore/inspector/InspectorController.cpp
+++ b/Source/WebCore/inspector/InspectorController.cpp
@@ -83,8 +83,9 @@ InspectorController::InspectorController(Page* page, InspectorClient* inspectorC
     m_inspectorAgent = inspectorAgentPtr.get();
     m_agents.append(inspectorAgentPtr.release());
 
-    OwnPtr<InspectorPageAgent> pageAgentPtr(InspectorPageAgent::create(m_instrumentingAgents.get(), page, m_state.get(), m_injectedScriptManager.get()));
+    OwnPtr<InspectorPageAgent> pageAgentPtr(InspectorPageAgent::create(m_instrumentingAgents.get(), page, m_state.get(), m_injectedScriptManager.get(), inspectorClient));
     InspectorPageAgent* pageAgent = pageAgentPtr.get();
+    m_pageAgent = pageAgentPtr.get();
     m_agents.append(pageAgentPtr.release());
 
     OwnPtr<InspectorDOMAgent> domAgentPtr(InspectorDOMAgent::create(m_instrumentingAgents.get(), pageAgent, inspectorClient, m_state.get(), m_injectedScriptManager.get()));
@@ -100,7 +101,7 @@ InspectorController::InspectorController(Page* page, InspectorClient* inspectorC
 #endif
 
 #if ENABLE(INDEXED_DATABASE)
-    m_agents.append(InspectorIndexedDBAgent::create(m_instrumentingAgents.get(), m_state.get(), pageAgent));
+    m_agents.append(InspectorIndexedDBAgent::create(m_instrumentingAgents.get(), m_state.get(), m_injectedScriptManager.get(), pageAgent));
 #endif
 
 #if ENABLE(FILE_SYSTEM)
@@ -109,13 +110,8 @@ InspectorController::InspectorController(Page* page, InspectorClient* inspectorC
     OwnPtr<InspectorDOMStorageAgent> domStorageAgentPtr(InspectorDOMStorageAgent::create(m_instrumentingAgents.get(), m_state.get()));
     InspectorDOMStorageAgent* domStorageAgent = domStorageAgentPtr.get();
     m_agents.append(domStorageAgentPtr.release());
-
-
-    OwnPtr<InspectorMemoryAgent>memoryAgentPtr = InspectorMemoryAgent::create(m_instrumentingAgents.get(), m_state.get(), m_page, m_domAgent);
-    InspectorMemoryAgent* memoryAgent = memoryAgentPtr.get();
-    m_agents.append(memoryAgentPtr.release());
-
-    m_agents.append(InspectorTimelineAgent::create(m_instrumentingAgents.get(), m_state.get(), memoryAgent));
+    m_agents.append(InspectorMemoryAgent::create(m_instrumentingAgents.get(), m_state.get(), m_page, m_domAgent));
+    m_agents.append(InspectorTimelineAgent::create(m_instrumentingAgents.get(), m_state.get()));
     m_agents.append(InspectorApplicationCacheAgent::create(m_instrumentingAgents.get(), m_state.get(), pageAgent));
 
     OwnPtr<InspectorResourceAgent> resourceAgentPtr(InspectorResourceAgent::create(m_instrumentingAgents.get(), pageAgent, inspectorClient, m_state.get()));
diff --git a/Source/WebCore/inspector/InspectorController.h b/Source/WebCore/inspector/InspectorController.h
index bbea2a6d6..5ee2330e1 100644
--- a/Source/WebCore/inspector/InspectorController.h
+++ b/Source/WebCore/inspector/InspectorController.h
@@ -51,6 +51,7 @@ class InspectorDOMAgent;
 class InspectorDebuggerAgent;
 class InspectorFrontend;
 class InspectorFrontendClient;
+class InspectorPageAgent;
 class InspectorProfilerAgent;
 class InspectorResourceAgent;
 class InspectorState;
@@ -68,7 +69,6 @@ public:
     ~InspectorController();
 
     static PassOwnPtr<InspectorController> create(Page*, InspectorClient*);
-
     void inspectedPageDestroyed();
 
     bool enabled() const;
@@ -108,6 +108,8 @@ public:
 
     void setResourcesDataSizeLimitsFromInternals(int maximumResourcesContentSize, int maximumSingleResourceContentSize);
 
+    InspectorPageAgent* pageAgent() const { return m_pageAgent; }
+
 private:
     InspectorController(Page*, InspectorClient*);
 
@@ -121,6 +123,7 @@ private:
     InspectorAgent* m_inspectorAgent;
     InspectorDOMAgent* m_domAgent;
     InspectorResourceAgent* m_resourceAgent;
+    InspectorPageAgent* m_pageAgent;
 #if ENABLE(JAVASCRIPT_DEBUGGER)
     InspectorDebuggerAgent* m_debuggerAgent;
     InspectorProfilerAgent* m_profilerAgent;
diff --git a/Source/WebCore/inspector/InspectorCounters.cpp b/Source/WebCore/inspector/InspectorCounters.cpp
new file mode 100644
index 000000000..70697077b
--- /dev/null
+++ b/Source/WebCore/inspector/InspectorCounters.cpp
@@ -0,0 +1,47 @@
+/*
+* Copyright (C) 2012 Google Inc. All rights reserved.
+*
+* Redistribution and use in source and binary forms, with or without
+* modification, are permitted provided that the following conditions are
+* met:
+*
+*     * Redistributions of source code must retain the above copyright
+* notice, this list of conditions and the following disclaimer.
+*     * Redistributions in binary form must reproduce the above
+* copyright notice, this list of conditions and the following disclaimer
+* in the documentation and/or other materials provided with the
+* distribution.
+*     * Neither the name of Google Inc. nor the names of its
+* contributors may be used to endorse or promote products derived from
+* this software without specific prior written permission.
+*
+* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+* "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+* LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+* A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+* OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+* LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+* DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+* THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+*/
+
+#include "config.h"
+#include "InspectorCounters.h"
+
+#if ENABLE(INSPECTOR)
+
+namespace WebCore {
+
+int InspectorCounters::s_counters[CounterTypeLength];
+
+int InspectorCounters::counterValue(CounterType type)
+{
+    return s_counters[type];
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(INSPECTOR)
diff --git a/Source/WebCore/inspector/InspectorCounters.h b/Source/WebCore/inspector/InspectorCounters.h
new file mode 100644
index 000000000..03dc11072
--- /dev/null
+++ b/Source/WebCore/inspector/InspectorCounters.h
@@ -0,0 +1,73 @@
+/*
+* Copyright (C) 2012 Google Inc. All rights reserved.
+*
+* Redistribution and use in source and binary forms, with or without
+* modification, are permitted provided that the following conditions are
+* met:
+*
+*     * Redistributions of source code must retain the above copyright
+* notice, this list of conditions and the following disclaimer.
+*     * Redistributions in binary form must reproduce the above
+* copyright notice, this list of conditions and the following disclaimer
+* in the documentation and/or other materials provided with the
+* distribution.
+*     * Neither the name of Google Inc. nor the names of its
+* contributors may be used to endorse or promote products derived from
+* this software without specific prior written permission.
+*
+* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+* "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+* LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+* A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+* OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+* LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+* DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+* THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+*/
+
+#ifndef InspectorCounters_h
+#define InspectorCounters_h
+
+namespace WebCore {
+
+class InspectorCounters {
+public:
+    enum CounterType {
+        DocumentCounter,
+        NodeCounter,
+        JSEventListenerCounter,
+        CounterTypeLength
+    };
+
+    static inline void incrementCounter(CounterType type)
+    {
+#if ENABLE(INSPECTOR)
+        ++s_counters[type];
+#endif
+    }
+
+    static inline void decrementCounter(CounterType type)
+    {
+#if ENABLE(INSPECTOR)
+        --s_counters[type];
+#endif
+    }
+
+#if ENABLE(INSPECTOR)
+    static int counterValue(CounterType);
+#endif
+
+private:
+    InspectorCounters();
+
+#if ENABLE(INSPECTOR)
+    static int s_counters[CounterTypeLength];
+#endif
+};
+
+} // namespace WebCore
+
+#endif // !defined(InspectorCounters_h)
diff --git a/Source/WebCore/inspector/InspectorDOMAgent.cpp b/Source/WebCore/inspector/InspectorDOMAgent.cpp
index 98185c178..0dea859fa 100644
--- a/Source/WebCore/inspector/InspectorDOMAgent.cpp
+++ b/Source/WebCore/inspector/InspectorDOMAgent.cpp
@@ -48,6 +48,7 @@
 #include "CookieJar.h"
 #include "DOMEditor.h"
 #include "DOMNodeHighlighter.h"
+#include "DOMPatchSupport.h"
 #include "DOMWindow.h"
 #include "Document.h"
 #include "DocumentFragment.h"
@@ -66,6 +67,7 @@
 #include "InjectedScriptManager.h"
 #include "InspectorClient.h"
 #include "InspectorFrontend.h"
+#include "InspectorHistory.h"
 #include "InspectorPageAgent.h"
 #include "InspectorState.h"
 #include "InstrumentingAgents.h"
@@ -177,250 +179,14 @@ void RevalidateStyleAttributeTask::onTimer(Timer<RevalidateStyleAttributeTask>*)
     m_elements.clear();
 }
 
-class InspectorDOMAgent::DOMAction : public InspectorHistory::Action {
-public:
-    DOMAction(const String& name) : InspectorHistory::Action(name) { }
-
-    virtual bool perform(ErrorString* errorString)
-    {
-        ExceptionCode ec = 0;
-        bool result = perform(ec);
-        if (ec) {
-            ExceptionCodeDescription description(ec);
-            *errorString = description.name;
-        }
-        return result && !ec;
-    }
-
-    virtual bool undo(ErrorString* errorString)
-    {
-        ExceptionCode ec = 0;
-        bool result = undo(ec);
-        if (ec) {
-            ExceptionCodeDescription description(ec);
-            *errorString = description.name;
-        }
-        return result && !ec;
-    }
-
-    virtual bool perform(ExceptionCode&) = 0;
-
-    virtual bool undo(ExceptionCode&) = 0;
-
-private:
-    RefPtr<Node> m_parentNode;
-    RefPtr<Node> m_node;
-    RefPtr<Node> m_anchorNode;
-};
-
-class InspectorDOMAgent::RemoveChildAction : public InspectorDOMAgent::DOMAction {
-    WTF_MAKE_NONCOPYABLE(RemoveChildAction);
-public:
-    RemoveChildAction(Node* parentNode, Node* node)
-        : InspectorDOMAgent::DOMAction("RemoveChild")
-        , m_parentNode(parentNode)
-        , m_node(node)
-    {
-    }
-
-    virtual bool perform(ExceptionCode& ec)
-    {
-        m_anchorNode = m_node->nextSibling();
-        return m_parentNode->removeChild(m_node.get(), ec);
-    }
-
-    virtual bool undo(ExceptionCode& ec)
-    {
-        return m_parentNode->insertBefore(m_node.get(), m_anchorNode.get(), ec);
-    }
-
-private:
-    RefPtr<Node> m_parentNode;
-    RefPtr<Node> m_node;
-    RefPtr<Node> m_anchorNode;
-};
-
-class InspectorDOMAgent::InsertBeforeAction : public InspectorDOMAgent::DOMAction {
-    WTF_MAKE_NONCOPYABLE(InsertBeforeAction);
-public:
-    InsertBeforeAction(Node* parentNode, Node* node, Node* anchorNode)
-        : InspectorDOMAgent::DOMAction("InsertBefore")
-        , m_parentNode(parentNode)
-        , m_node(node)
-        , m_anchorNode(anchorNode)
-    {
-    }
-
-    virtual bool perform(ExceptionCode& ec)
-    {
-        if (m_node->parentNode()) {
-            m_removeChildAction = adoptPtr(new RemoveChildAction(m_node->parentNode(), m_node.get()));
-            if (!m_removeChildAction->perform(ec))
-                return false;
-        }
-        return m_parentNode->insertBefore(m_node.get(), m_anchorNode.get(), ec);
-    }
-
-    virtual bool undo(ExceptionCode& ec)
-    {
-        if (m_removeChildAction)
-            return m_removeChildAction->undo(ec);
-
-        return m_parentNode->removeChild(m_node.get(), ec);
-    }
-
-private:
-    RefPtr<Node> m_parentNode;
-    RefPtr<Node> m_node;
-    RefPtr<Node> m_anchorNode;
-    OwnPtr<RemoveChildAction> m_removeChildAction;
-};
-
-class InspectorDOMAgent::RemoveAttributeAction : public InspectorDOMAgent::DOMAction {
-    WTF_MAKE_NONCOPYABLE(RemoveAttributeAction);
-public:
-    RemoveAttributeAction(Element* element, const String& name)
-        : InspectorDOMAgent::DOMAction("RemoveAttribute")
-        , m_element(element)
-        , m_name(name)
-    {
-    }
-
-    virtual bool perform(ExceptionCode&)
-    {
-        m_value = m_element->getAttribute(m_name);
-        m_element->removeAttribute(m_name);
-        return true;
-    }
-
-    virtual bool undo(ExceptionCode& ec)
-    {
-        m_element->setAttribute(m_name, m_value, ec);
-        return true;
-    }
-
-private:
-    RefPtr<Element> m_element;
-    String m_name;
-    String m_value;
-};
-
-class InspectorDOMAgent::SetAttributeAction : public InspectorDOMAgent::DOMAction {
-    WTF_MAKE_NONCOPYABLE(SetAttributeAction);
-public:
-    SetAttributeAction(Element* element, const String& name, const String& value)
-        : InspectorDOMAgent::DOMAction("SetAttribute")
-        , m_element(element)
-        , m_name(name)
-        , m_value(value)
-        , m_hadAttribute(false)
-    {
-    }
-
-    virtual bool perform(ExceptionCode& ec)
-    {
-        m_hadAttribute = m_element->hasAttribute(m_name);
-        if (m_hadAttribute)
-            m_oldValue = m_element->getAttribute(m_name);
-        m_element->setAttribute(m_name, m_value, ec);
-        return !ec;
-    }
-
-    virtual bool undo(ExceptionCode& ec)
-    {
-        if (m_hadAttribute)
-            m_element->setAttribute(m_name, m_oldValue, ec);
-        else
-            m_element->removeAttribute(m_name);
-        return true;
-    }
-
-private:
-    RefPtr<Element> m_element;
-    String m_name;
-    String m_value;
-    bool m_hadAttribute;
-    String m_oldValue;
-};
-
-class InspectorDOMAgent::SetOuterHTMLAction : public InspectorDOMAgent::DOMAction {
-    WTF_MAKE_NONCOPYABLE(SetOuterHTMLAction);
-public:
-    SetOuterHTMLAction(Node* node, const String& html)
-        : InspectorDOMAgent::DOMAction("SetOuterHTML")
-        , m_node(node)
-        , m_nextSibling(node->nextSibling())
-        , m_html(html)
-        , m_newNode(0)
-    {
-    }
-
-    virtual bool perform(ExceptionCode& ec)
-    {
-        m_oldHTML = createMarkup(m_node.get());
-        DOMEditor domEditor(m_node->ownerDocument());
-        m_newNode = domEditor.patchNode(m_node.get(), m_html, ec);
-        return !ec;
-    }
-
-    virtual bool undo(ExceptionCode& ec)
-    {
-        DOMEditor domEditor(m_newNode->ownerDocument());
-        Node* node = domEditor.patchNode(m_newNode, m_oldHTML, ec);
-        if (ec || !node)
-            return false;
-        // HTML editing could have produced extra nodes. Remove them if necessary.
-        node = node->nextSibling();
-
-        while (!ec && node && node != m_nextSibling.get()) {
-            Node* nodeToRemove = node;
-            node = node->nextSibling();
-            nodeToRemove->remove(ec);
-        }
-        return !ec;
-    }
-
-    Node* newNode()
-    {
-        return m_newNode;
-    }
-
-private:
-    RefPtr<Node> m_node;
-    RefPtr<Node> m_nextSibling;
-    String m_html;
-    String m_oldHTML;
-    Node* m_newNode;
-};
-
-class InspectorDOMAgent::ReplaceWholeTextAction : public InspectorDOMAgent::DOMAction {
-    WTF_MAKE_NONCOPYABLE(ReplaceWholeTextAction);
-public:
-    ReplaceWholeTextAction(Text* textNode, const String& text)
-        : DOMAction("ReplaceWholeText")
-        , m_textNode(textNode)
-        , m_text(text)
-    {
-    }
-
-    virtual bool perform(ExceptionCode& ec)
-    {
-        m_oldText = m_textNode->wholeText();
-        m_textNode->replaceWholeText(m_text, ec);
-        return true;
-    }
-
-    virtual bool undo(ExceptionCode& ec)
-    {
-        m_textNode->replaceWholeText(m_oldText, ec);
-        return true;
+String InspectorDOMAgent::toErrorString(const ExceptionCode& ec)
+{
+    if (ec) {
+        ExceptionCodeDescription description(ec);
+        return description.name;
     }
-
-private:
-    RefPtr<Text> m_textNode;
-    String m_text;
-    String m_oldText;
-};
+    return "";
+}
 
 InspectorDOMAgent::InspectorDOMAgent(InstrumentingAgents* instrumentingAgents, InspectorPageAgent* pageAgent, InspectorClient* client, InspectorState* inspectorState, InjectedScriptManager* injectedScriptManager)
     : InspectorBaseAgent<InspectorDOMAgent>("DOM", instrumentingAgents, inspectorState)
@@ -431,7 +197,7 @@ InspectorDOMAgent::InspectorDOMAgent(InstrumentingAgents* instrumentingAgents, I
     , m_domListener(0)
     , m_lastNodeId(1)
     , m_searchingForNode(false)
-    , m_history(adoptPtr(new InspectorHistory()))
+    , m_suppressAttributeModifiedEvent(false)
 {
 }
 
@@ -445,6 +211,9 @@ InspectorDOMAgent::~InspectorDOMAgent()
 void InspectorDOMAgent::setFrontend(InspectorFrontend* frontend)
 {
     ASSERT(!m_frontend);
+    m_history = adoptPtr(new InspectorHistory());
+    m_domEditor = adoptPtr(new DOMEditor(m_history.get()));
+
     m_frontend = frontend->dom();
     m_instrumentingAgents->setInspectorDOMAgent(this);
     m_document = m_pageAgent->mainFrame()->document();
@@ -456,6 +225,9 @@ void InspectorDOMAgent::setFrontend(InspectorFrontend* frontend)
 void InspectorDOMAgent::clearFrontend()
 {
     ASSERT(m_frontend);
+
+    m_history.clear();
+    m_domEditor.clear();
     setSearchingForNode(false, 0);
 
     ErrorString error;
@@ -499,7 +271,8 @@ Node* InspectorDOMAgent::highlightedNode() const
 
 void InspectorDOMAgent::reset()
 {
-    m_history->reset();
+    if (m_history)
+        m_history->reset();
     m_searchResults.clear();
     discardBindings();
     if (m_revalidateStyleAttrTask)
@@ -630,7 +403,7 @@ void InspectorDOMAgent::getDocument(ErrorString*, RefPtr<InspectorObject>& root)
 void InspectorDOMAgent::pushChildNodesToFrontend(int nodeId)
 {
     Node* node = nodeForId(nodeId);
-    if (!node || (node->nodeType() != Node::ELEMENT_NODE && node->nodeType() != Node::DOCUMENT_NODE && node->nodeType() != Node::DOCUMENT_FRAGMENT_NODE))
+    if (!node || (node->nodeType() != Node::ELEMENT_NODE && node->nodeType() != Node::DOCUMENT_NODE && node->nodeType() != Node::DOCUMENT_FRAGMENT_NODE) || node->isShadowRoot())
         return;
     if (m_childrenRequested.contains(nodeId))
         return;
@@ -765,8 +538,7 @@ void InspectorDOMAgent::setAttributeValue(ErrorString* errorString, int elementI
     if (!element)
         return;
 
-    m_history->perform(adoptPtr(new SetAttributeAction(element, name, value)), errorString);
-    m_history->markUndoableState();
+    m_domEditor->setAttribute(element, name, value, errorString);
 }
 
 void InspectorDOMAgent::setAttributesAsText(ErrorString* errorString, int elementId, const String& text, const String* const name)
@@ -778,13 +550,13 @@ void InspectorDOMAgent::setAttributesAsText(ErrorString* errorString, int elemen
     ExceptionCode ec = 0;
     RefPtr<Element> parsedElement = element->document()->createElement("span", ec);
     if (ec) {
-        *errorString = "Internal error: could not set attribute value";
+        *errorString = InspectorDOMAgent::toErrorString(ec);
         return;
     }
 
     toHTMLElement(parsedElement.get())->setInnerHTML("<span " + text + "></span>", ec);
     if (ec) {
-        *errorString = "Could not parse value as attributes";
+        *errorString = InspectorDOMAgent::toErrorString(ec);
         return;
     }
 
@@ -796,7 +568,7 @@ void InspectorDOMAgent::setAttributesAsText(ErrorString* errorString, int elemen
 
     Element* childElement = toElement(child);
     if (!childElement->hasAttributes() && name) {
-        m_history->perform(adoptPtr(new RemoveAttributeAction(element, *name)), errorString);
+        m_domEditor->removeAttribute(element, *name, errorString);
         return;
     }
 
@@ -806,14 +578,12 @@ void InspectorDOMAgent::setAttributesAsText(ErrorString* errorString, int elemen
         // Add attribute pair
         const Attribute* attribute = childElement->attributeItem(i);
         foundOriginalAttribute = foundOriginalAttribute || (name && attribute->name().toString() == *name);
-        if (!m_history->perform(adoptPtr(new SetAttributeAction(element, attribute->name().toString(), attribute->value())), errorString))
+        if (!m_domEditor->setAttribute(element, attribute->name().toString(), attribute->value(), errorString))
             return;
     }
 
     if (!foundOriginalAttribute && name && !name->stripWhiteSpace().isEmpty())
-        m_history->perform(adoptPtr(new RemoveAttributeAction(element, *name)), errorString);
-
-    m_history->markUndoableState();
+        m_domEditor->removeAttribute(element, *name, errorString);
 }
 
 void InspectorDOMAgent::removeAttribute(ErrorString* errorString, int elementId, const String& name)
@@ -822,8 +592,7 @@ void InspectorDOMAgent::removeAttribute(ErrorString* errorString, int elementId,
     if (!element)
         return;
 
-    m_history->perform(adoptPtr(new RemoveAttributeAction(element, name)), errorString);
-    m_history->markUndoableState();
+    m_domEditor->removeAttribute(element, name, errorString);
 }
 
 void InspectorDOMAgent::removeNode(ErrorString* errorString, int nodeId)
@@ -838,8 +607,7 @@ void InspectorDOMAgent::removeNode(ErrorString* errorString, int nodeId)
         return;
     }
 
-    m_history->perform(adoptPtr(new RemoveChildAction(parentNode, node)), errorString);
-    m_history->markUndoableState();
+    m_domEditor->removeChild(parentNode, node, errorString);
 }
 
 void InspectorDOMAgent::setNodeName(ErrorString* errorString, int nodeId, const String& tagName, int* newId)
@@ -861,17 +629,16 @@ void InspectorDOMAgent::setNodeName(ErrorString* errorString, int nodeId, const
     // Copy over the original node's children.
     Node* child;
     while ((child = oldNode->firstChild())) {
-        if (!m_history->perform(adoptPtr(new InsertBeforeAction(newElem.get(), child, 0)), errorString))
+        if (!m_domEditor->insertBefore(newElem.get(), child, 0, errorString))
             return;
     }
 
     // Replace the old node with the new node
     ContainerNode* parent = oldNode->parentNode();
-    if (!m_history->perform(adoptPtr(new InsertBeforeAction(parent, newElem.get(), oldNode->nextSibling())), errorString))
+    if (!m_domEditor->insertBefore(parent, newElem.get(), oldNode->nextSibling(), errorString))
         return;
-    if (!m_history->perform(adoptPtr(new RemoveChildAction(parent, oldNode)), errorString))
+    if (!m_domEditor->removeChild(parent, oldNode, errorString))
         return;
-    m_history->markUndoableState();
 
     *newId = pushNodePathToFrontend(newElem.get());
     if (m_childrenRequested.contains(nodeId))
@@ -890,8 +657,8 @@ void InspectorDOMAgent::getOuterHTML(ErrorString* errorString, int nodeId, WTF::
 void InspectorDOMAgent::setOuterHTML(ErrorString* errorString, int nodeId, const String& outerHTML)
 {
     if (!nodeId) {
-        DOMEditor domEditor(m_document.get());
-        domEditor.patchDocument(outerHTML);
+        DOMPatchSupport domPatchSupport(m_domEditor.get(), m_document.get());
+        domPatchSupport.patchDocument(outerHTML);
         return;
     }
 
@@ -905,16 +672,9 @@ void InspectorDOMAgent::setOuterHTML(ErrorString* errorString, int nodeId, const
         return;
     }
 
-    DOMEditor domEditor(document);
-
-    OwnPtr<SetOuterHTMLAction> action = adoptPtr(new SetOuterHTMLAction(node, outerHTML));
-    SetOuterHTMLAction* rawAction = action.get();
     Node* newNode = 0;
-    if (!m_history->perform(action.release(), errorString))
+    if (!m_domEditor->setOuterHTML(node, outerHTML, &newNode, errorString))
         return;
-    m_history->markUndoableState();
-
-    newNode = rawAction->newNode();
 
     if (!newNode) {
         // The only child node has been deleted.
@@ -939,7 +699,7 @@ void InspectorDOMAgent::setNodeValue(ErrorString* errorString, int nodeId, const
         return;
     }
 
-    m_history->perform(adoptPtr(new ReplaceWholeTextAction(static_cast<Text*>(node), value)), errorString);
+    m_domEditor->replaceWholeText(toText(node), value, errorString);
 }
 
 void InspectorDOMAgent::getEventListenersForNode(ErrorString*, int nodeId, RefPtr<InspectorArray>& listenersArray)
@@ -1297,9 +1057,8 @@ void InspectorDOMAgent::moveTo(ErrorString* errorString, int nodeId, int targetE
         }
     }
 
-    if (!m_history->perform(adoptPtr(new InsertBeforeAction(targetElement, node, anchorNode)), errorString))
+    if (!m_domEditor->insertBefore(targetElement, node, anchorNode, errorString))
         return;
-    m_history->markUndoableState();
 
     *newNodeId = pushNodePathToFrontend(node);
 }
@@ -1319,7 +1078,16 @@ void InspectorDOMAgent::setTouchEmulationEnabled(ErrorString* error, bool enable
 
 void InspectorDOMAgent::undo(ErrorString* errorString)
 {
-    m_history->undo(errorString);
+    ExceptionCode ec = 0;
+    m_history->undo(ec);
+    *errorString = InspectorDOMAgent::toErrorString(ec);
+}
+
+void InspectorDOMAgent::redo(ErrorString* errorString)
+{
+    ExceptionCode ec = 0;
+    m_history->redo(ec);
+    *errorString = InspectorDOMAgent::toErrorString(ec);
 }
 
 void InspectorDOMAgent::markUndoableState(ErrorString*)
@@ -1391,7 +1159,9 @@ PassRefPtr<InspectorObject> InspectorDOMAgent::buildObjectForNode(Node* node, in
         localName = node->localName();
         break;
     case Node::DOCUMENT_FRAGMENT_NODE:
-        break;
+        if (!node->isShadowRoot())
+            break;
+        // Fall through
     case Node::DOCUMENT_NODE:
     case Node::ELEMENT_NODE:
     default:
@@ -1632,8 +1402,18 @@ void InspectorDOMAgent::didRemoveDOMNode(Node* node)
     unbind(node, &m_documentNodeToIdMap);
 }
 
+void InspectorDOMAgent::willModifyDOMAttr(Element*, const AtomicString& oldValue, const AtomicString& newValue)
+{
+    m_suppressAttributeModifiedEvent = (oldValue == newValue);
+}
+
 void InspectorDOMAgent::didModifyDOMAttr(Element* element, const AtomicString& name, const AtomicString& value)
 {
+    bool shouldSuppressEvent = m_suppressAttributeModifiedEvent;
+    m_suppressAttributeModifiedEvent = false;
+    if (shouldSuppressEvent)
+        return;
+
     int id = boundNodeId(element);
     // If node is not mapped yet -> ignore the event.
     if (!id)
diff --git a/Source/WebCore/inspector/InspectorDOMAgent.h b/Source/WebCore/inspector/InspectorDOMAgent.h
index 40f0f81b2..e45d4636a 100644
--- a/Source/WebCore/inspector/InspectorDOMAgent.h
+++ b/Source/WebCore/inspector/InspectorDOMAgent.h
@@ -35,7 +35,6 @@
 #include "InjectedScriptManager.h"
 #include "InspectorBaseAgent.h"
 #include "InspectorFrontend.h"
-#include "InspectorHistory.h"
 #include "InspectorValues.h"
 #include "Timer.h"
 
@@ -52,13 +51,14 @@
 namespace WebCore {
 class ContainerNode;
 class CharacterData;
+class DOMEditor;
 class Document;
 class Element;
 class Event;
 class GraphicsContext;
 class InspectorClient;
-class InspectorDOMAgent;
 class InspectorFrontend;
+class InspectorHistory;
 class InspectorPageAgent;
 class IntRect;
 class HitTestResult;
@@ -107,6 +107,8 @@ public:
         return adoptPtr(new InspectorDOMAgent(instrumentingAgents, pageAgent, client, inspectorState, injectedScriptManager));
     }
 
+    static String toErrorString(const ExceptionCode&);
+
     ~InspectorDOMAgent();
 
     virtual void setFrontend(InspectorFrontend*);
@@ -145,6 +147,7 @@ public:
     virtual void moveTo(ErrorString*, int nodeId, int targetNodeId, const int* anchorNodeId, int* newNodeId);
     virtual void setTouchEmulationEnabled(ErrorString*, bool);
     virtual void undo(ErrorString*);
+    virtual void redo(ErrorString*);
     virtual void markUndoableState(ErrorString*);
 
     Node* highlightedNode() const;
@@ -158,6 +161,7 @@ public:
 
     void didInsertDOMNode(Node*);
     void didRemoveDOMNode(Node*);
+    void willModifyDOMAttr(Element*, const AtomicString& oldValue, const AtomicString& newValue);
     void didModifyDOMAttr(Element*, const AtomicString& name, const AtomicString& value);
     void didRemoveDOMAttr(Element*, const AtomicString& name);
     void styleAttributeInvalidated(const Vector<Element*>& elements);
@@ -193,14 +197,6 @@ public:
     Node* assertNode(ErrorString*, int nodeId);
 
 private:
-    class DOMAction;
-    class RemoveChildAction;
-    class InsertBeforeAction;
-    class RemoveAttributeAction;
-    class SetAttributeAction;
-    class SetOuterHTMLAction;
-    class ReplaceWholeTextAction;
-
     InspectorDOMAgent(InstrumentingAgents*, InspectorPageAgent*, InspectorClient*, InspectorState*, InjectedScriptManager*);
 
     void setSearchingForNode(bool enabled, InspectorObject* highlightConfig);
@@ -254,6 +250,8 @@ private:
     RefPtr<Node> m_nodeToFocus;
     bool m_searchingForNode;
     OwnPtr<InspectorHistory> m_history;
+    OwnPtr<DOMEditor> m_domEditor;
+    bool m_suppressAttributeModifiedEvent;
 };
 
 #endif // ENABLE(INSPECTOR)
diff --git a/Source/WebCore/inspector/InspectorDebuggerAgent.cpp b/Source/WebCore/inspector/InspectorDebuggerAgent.cpp
index 742d288df..6609e64ed 100644
--- a/Source/WebCore/inspector/InspectorDebuggerAgent.cpp
+++ b/Source/WebCore/inspector/InspectorDebuggerAgent.cpp
@@ -44,6 +44,10 @@
 #include "ScriptObject.h"
 #include <wtf/text/WTFString.h>
 
+using WebCore::TypeBuilder::Array;
+using WebCore::TypeBuilder::Debugger::FunctionDetails;
+using WebCore::TypeBuilder::Runtime::RemoteObject;
+
 namespace WebCore {
 
 namespace DebuggerAgentState {
@@ -210,8 +214,10 @@ static bool matches(const String& url, const String& pattern, bool isRegex)
     return url == pattern;
 }
 
-void InspectorDebuggerAgent::setBreakpointByUrl(ErrorString* errorString, int lineNumber, const String* const optionalURL, const String* const optionalURLRegex, const int* const optionalColumnNumber, const String* const optionalCondition, String* outBreakpointId, RefPtr<InspectorArray>& locations)
+void InspectorDebuggerAgent::setBreakpointByUrl(ErrorString* errorString, int lineNumber, const String* const optionalURL, const String* const optionalURLRegex, const int* const optionalColumnNumber, const String* const optionalCondition, String* outBreakpointId, RefPtr<InspectorArray>& locationsRaw)
 {
+    RefPtr<Array<TypeBuilder::Debugger::Location> > locations = Array<TypeBuilder::Debugger::Location>::create();
+    locationsRaw = locations;
     if (!optionalURL == !optionalURLRegex) {
         *errorString = "Either url or urlRegex must be specified.";
         return;
@@ -310,7 +316,7 @@ void InspectorDebuggerAgent::continueToLocation(ErrorString* errorString, const
     resume(errorString);
 }
 
-PassRefPtr<InspectorObject> InspectorDebuggerAgent::resolveBreakpoint(const String& breakpointId, const String& scriptId, const ScriptBreakpoint& breakpoint)
+PassRefPtr<TypeBuilder::Debugger::Location> InspectorDebuggerAgent::resolveBreakpoint(const String& breakpointId, const String& scriptId, const ScriptBreakpoint& breakpoint)
 {
     ScriptsMap::iterator scriptIterator = m_scripts.find(scriptId);
     if (scriptIterator == m_scripts.end())
@@ -380,14 +386,16 @@ void InspectorDebuggerAgent::getScriptSource(ErrorString* error, const String& s
         *error = "No script for id: " + scriptId;
 }
 
-void InspectorDebuggerAgent::getFunctionDetails(ErrorString* errorString, const String& functionId, RefPtr<InspectorObject>& details)
+void InspectorDebuggerAgent::getFunctionDetails(ErrorString* errorString, const String& functionId, RefPtr<InspectorObject>& detailsRaw)
 {
     InjectedScript injectedScript = m_injectedScriptManager->injectedScriptForObjectId(functionId);
     if (injectedScript.hasNoValue()) {
         *errorString = "Inspected frame has gone";
         return;
     }
+    RefPtr<FunctionDetails> details;
     injectedScript.getFunctionDetails(errorString, functionId, &details);
+    detailsRaw = details;
 }
 
 void InspectorDebuggerAgent::schedulePauseOnNextStatement(const String& breakReason, PassRefPtr<InspectorObject> data)
@@ -470,24 +478,26 @@ void InspectorDebuggerAgent::setPauseOnExceptionsImpl(ErrorString* errorString,
         m_state->setLong(DebuggerAgentState::pauseOnExceptionsState, pauseState);
 }
 
-void InspectorDebuggerAgent::evaluateOnCallFrame(ErrorString* errorString, const String& callFrameId, const String& expression, const String* const objectGroup, const bool* const includeCommandLineAPI, const bool* const returnByValue, RefPtr<InspectorObject>& result, bool* wasThrown)
+void InspectorDebuggerAgent::evaluateOnCallFrame(ErrorString* errorString, const String& callFrameId, const String& expression, const String* const objectGroup, const bool* const includeCommandLineAPI, const bool* const returnByValue, RefPtr<InspectorObject>& resultRaw, bool* wasThrown)
 {
     InjectedScript injectedScript = m_injectedScriptManager->injectedScriptForObjectId(callFrameId);
     if (injectedScript.hasNoValue()) {
         *errorString = "Inspected frame has gone";
         return;
     }
+    RefPtr<RemoteObject> result;
     injectedScript.evaluateOnCallFrame(errorString, m_currentCallStack, callFrameId, expression, objectGroup ? *objectGroup : "", includeCommandLineAPI ? *includeCommandLineAPI : false, returnByValue ? *returnByValue : false, &result, wasThrown);
+    resultRaw = result;
 }
 
-PassRefPtr<InspectorArray> InspectorDebuggerAgent::currentCallFrames()
+PassRefPtr<Array<TypeBuilder::Debugger::CallFrame> > InspectorDebuggerAgent::currentCallFrames()
 {
     if (!m_pausedScriptState)
-        return InspectorArray::create();
+        return Array<TypeBuilder::Debugger::CallFrame>::create();
     InjectedScript injectedScript = m_injectedScriptManager->injectedScriptFor(m_pausedScriptState);
     if (injectedScript.hasNoValue()) {
         ASSERT_NOT_REACHED();
-        return InspectorArray::create();
+        return Array<TypeBuilder::Debugger::CallFrame>::create();
     }
     return injectedScript.wrapCallFrames(m_currentCallStack);
 }
@@ -520,7 +530,8 @@ void InspectorDebuggerAgent::didParseSource(const String& scriptId, const Script
     // Don't send script content to the front end until it's really needed.
     const bool* isContentScript = script.isContentScript ? &script.isContentScript : 0;
     String sourceMapURL = sourceMapURLForScript(script);
-    m_frontend->scriptParsed(scriptId, script.url, script.startLine, script.startColumn, script.endLine, script.endColumn, isContentScript, sourceMapURL);
+    String* sourceMapURLParam = sourceMapURL.isNull() ? 0 : &sourceMapURL;
+    m_frontend->scriptParsed(scriptId, script.url, script.startLine, script.startColumn, script.endLine, script.endColumn, isContentScript, sourceMapURLParam);
 
     m_scripts.set(scriptId, script);
 
@@ -540,7 +551,7 @@ void InspectorDebuggerAgent::didParseSource(const String& scriptId, const Script
         breakpointObject->getNumber("lineNumber", &breakpoint.lineNumber);
         breakpointObject->getNumber("columnNumber", &breakpoint.columnNumber);
         breakpointObject->getString("condition", &breakpoint.condition);
-        RefPtr<InspectorObject> location = resolveBreakpoint(it->first, scriptId, breakpoint);
+        RefPtr<TypeBuilder::Debugger::Location> location = resolveBreakpoint(it->first, scriptId, breakpoint);
         if (location)
             m_frontend->breakpointResolved(it->first, location);
     }
diff --git a/Source/WebCore/inspector/InspectorDebuggerAgent.h b/Source/WebCore/inspector/InspectorDebuggerAgent.h
index b64fedc89..a6abfa435 100644
--- a/Source/WebCore/inspector/InspectorDebuggerAgent.h
+++ b/Source/WebCore/inspector/InspectorDebuggerAgent.h
@@ -130,7 +130,7 @@ private:
     void disable();
     bool enabled();
 
-    PassRefPtr<InspectorArray> currentCallFrames();
+    PassRefPtr<TypeBuilder::Array<TypeBuilder::Debugger::CallFrame> > currentCallFrames();
 
     virtual void didParseSource(const String& scriptId, const Script&);
     virtual void failedToParseSource(const String& url, const String& data, int firstLine, int errorLine, const String& errorMessage);
@@ -139,7 +139,7 @@ private:
 
     void setPauseOnExceptionsImpl(ErrorString*, int);
 
-    PassRefPtr<InspectorObject> resolveBreakpoint(const String& breakpointId, const String& scriptId, const ScriptBreakpoint&);
+    PassRefPtr<TypeBuilder::Debugger::Location> resolveBreakpoint(const String& breakpointId, const String& scriptId, const ScriptBreakpoint&);
     void clear();
     bool assertPaused(ErrorString*);
     void clearBreakDetails();
diff --git a/Source/WebCore/inspector/InspectorFrontendClientLocal.cpp b/Source/WebCore/inspector/InspectorFrontendClientLocal.cpp
index 117ae8b38..9841e2002 100644
--- a/Source/WebCore/inspector/InspectorFrontendClientLocal.cpp
+++ b/Source/WebCore/inspector/InspectorFrontendClientLocal.cpp
@@ -42,6 +42,7 @@
 #include "InspectorBackendDispatcher.h"
 #include "InspectorController.h"
 #include "InspectorFrontendHost.h"
+#include "InspectorPageAgent.h"
 #include "Page.h"
 #include "PlatformString.h"
 #include "ScriptFunctionCall.h"
@@ -159,10 +160,12 @@ void InspectorFrontendClientLocal::requestDetachWindow()
 
 bool InspectorFrontendClientLocal::canAttachWindow()
 {
-    unsigned inspectedPageHeight = m_inspectorController->inspectedPage()->mainFrame()->view()->visibleHeight();
-
     // Don't allow the attach if the window would be too small to accommodate the minimum inspector height.
-    return minimumAttachedHeight <= inspectedPageHeight * maximumAttachedHeightRatio;
+    // Also don't allow attaching to another inspector -- two inspectors in one window is too much!
+    bool isInspectorPage = m_inspectorController->inspectedPage()->inspectorController()->hasInspectorFrontendClient();
+    unsigned inspectedPageHeight = m_inspectorController->inspectedPage()->mainFrame()->view()->visibleHeight();
+    unsigned maximumAttachedHeight = inspectedPageHeight * maximumAttachedHeightRatio;
+    return minimumAttachedHeight <= maximumAttachedHeight && !isInspectorPage;
 }
 
 void InspectorFrontendClientLocal::changeAttachedWindowHeight(unsigned height)
@@ -263,6 +266,17 @@ void InspectorFrontendClientLocal::showConsole()
     evaluateOnLoad("[\"showConsole\"]");
 }
 
+void InspectorFrontendClientLocal::showResources()
+{
+    evaluateOnLoad("[\"showResources\"]");
+}
+
+void InspectorFrontendClientLocal::showMainResourceForFrame(Frame* frame)
+{
+    String frameId = m_inspectorController->pageAgent()->frameId(frame);
+    evaluateOnLoad(String::format("[\"showMainResourceForFrame\", \"%s\"]", frameId.ascii().data()));
+}
+
 unsigned InspectorFrontendClientLocal::constrainedAttachedWindowHeight(unsigned preferredHeight, unsigned totalWindowHeight)
 {
     using namespace std;
diff --git a/Source/WebCore/inspector/InspectorFrontendClientLocal.h b/Source/WebCore/inspector/InspectorFrontendClientLocal.h
index 2b1d187b5..8292d2289 100644
--- a/Source/WebCore/inspector/InspectorFrontendClientLocal.h
+++ b/Source/WebCore/inspector/InspectorFrontendClientLocal.h
@@ -93,6 +93,10 @@ public:
 
     void showConsole();
 
+    void showMainResourceForFrame(Frame*);
+    
+    void showResources();
+
 protected:
     virtual void setAttachedWindowHeight(unsigned) = 0;
     void setAttachedWindow(bool);
diff --git a/Source/WebCore/inspector/InspectorHistory.cpp b/Source/WebCore/inspector/InspectorHistory.cpp
index bf68c1ff5..1b6eacfa6 100644
--- a/Source/WebCore/inspector/InspectorHistory.cpp
+++ b/Source/WebCore/inspector/InspectorHistory.cpp
@@ -43,9 +43,11 @@ class UndoableStateMark : public InspectorHistory::Action {
 public:
     UndoableStateMark() : InspectorHistory::Action("[UndoableState]") { }
 
-    virtual bool perform(ErrorString*) { return true; }
+    virtual bool perform(ExceptionCode&) { return true; }
 
-    virtual bool undo(ErrorString*) { return true; }
+    virtual bool undo(ExceptionCode&) { return true; }
+
+    virtual bool redo(ExceptionCode&) { return true; }
 
     virtual bool isUndoableStateMark() { return true; }
 };
@@ -79,49 +81,71 @@ void InspectorHistory::Action::merge(PassOwnPtr<Action>)
 {
 }
 
-InspectorHistory::InspectorHistory() { }
+InspectorHistory::InspectorHistory() : m_afterLastActionIndex(0) { }
 
 InspectorHistory::~InspectorHistory() { }
 
-bool InspectorHistory::perform(PassOwnPtr<Action> action, ErrorString* errorString)
+bool InspectorHistory::perform(PassOwnPtr<Action> action, ExceptionCode& ec)
 {
-    if (!action->perform(errorString))
+    if (!action->perform(ec))
         return false;
 
-    if (!m_history.isEmpty() && !action->mergeId().isEmpty() && action->mergeId() == m_history.first()->mergeId())
-        m_history.first()->merge(action);
-    else
-        m_history.prepend(action);
-
+    if (!action->mergeId().isEmpty() && m_afterLastActionIndex > 0 && action->mergeId() == m_history[m_afterLastActionIndex - 1]->mergeId())
+        m_history[m_afterLastActionIndex - 1]->merge(action);
+    else {
+        m_history.resize(m_afterLastActionIndex);
+        m_history.append(action);
+        ++m_afterLastActionIndex;
+    }
     return true;
 }
 
 void InspectorHistory::markUndoableState()
 {
-    m_history.prepend(adoptPtr(new UndoableStateMark()));
+    ExceptionCode ec;
+    perform(adoptPtr(new UndoableStateMark()), ec);
 }
 
-bool InspectorHistory::undo(ErrorString* errorString)
+bool InspectorHistory::undo(ExceptionCode& ec)
 {
-    while (!m_history.isEmpty() && m_history.first()->isUndoableStateMark())
-        m_history.removeFirst();
+    while (m_afterLastActionIndex > 0 && m_history[m_afterLastActionIndex - 1]->isUndoableStateMark())
+        --m_afterLastActionIndex;
 
-    while (!m_history.isEmpty()) {
-        OwnPtr<Action> first = m_history.takeFirst();
-        if (!first->undo(errorString)) {
-            m_history.clear();
+    while (m_afterLastActionIndex > 0) {
+        Action* action = m_history[m_afterLastActionIndex - 1].get();
+        if (!action->undo(ec)) {
+            reset();
             return false;
         }
-
-        if (first->isUndoableStateMark())
+        --m_afterLastActionIndex;
+        if (action->isUndoableStateMark())
             break;
     }
 
     return true;
 }
 
+bool InspectorHistory::redo(ExceptionCode& ec)
+{
+    while (m_afterLastActionIndex < m_history.size() && m_history[m_afterLastActionIndex]->isUndoableStateMark())
+        ++m_afterLastActionIndex;
+
+    while (m_afterLastActionIndex < m_history.size()) {
+        Action* action = m_history[m_afterLastActionIndex].get();
+        if (!action->redo(ec)) {
+            reset();
+            return false;
+        }
+        ++m_afterLastActionIndex;
+        if (action->isUndoableStateMark())
+            break;
+    }
+    return true;
+}
+
 void InspectorHistory::reset()
 {
+    m_afterLastActionIndex = 0;
     m_history.clear();
 }
 
diff --git a/Source/WebCore/inspector/InspectorHistory.h b/Source/WebCore/inspector/InspectorHistory.h
index e506e05b9..037344b60 100644
--- a/Source/WebCore/inspector/InspectorHistory.h
+++ b/Source/WebCore/inspector/InspectorHistory.h
@@ -33,8 +33,8 @@
 
 #include "ExceptionCode.h"
 
-#include <wtf/Deque.h>
 #include <wtf/OwnPtr.h>
+#include <wtf/Vector.h>
 #include <wtf/text/WTFString.h>
 
 namespace WebCore {
@@ -43,8 +43,6 @@ class ContainerNode;
 class Element;
 class Node;
 
-typedef String ErrorString;
-
 #if ENABLE(INSPECTOR)
 
 class InspectorHistory {
@@ -56,13 +54,15 @@ public:
         virtual ~Action();
         virtual String toString();
 
-        virtual bool isUndoableStateMark();
-
         virtual String mergeId();
         virtual void merge(PassOwnPtr<Action>);
 
-        virtual bool perform(ErrorString*) = 0;
-        virtual bool undo(ErrorString*) = 0;
+        virtual bool perform(ExceptionCode&) = 0;
+
+        virtual bool undo(ExceptionCode&) = 0;
+        virtual bool redo(ExceptionCode&) = 0;
+
+        virtual bool isUndoableStateMark();
     private:
         String m_name;
     };
@@ -70,15 +70,16 @@ public:
     InspectorHistory();
     virtual ~InspectorHistory();
 
-    bool perform(PassOwnPtr<Action>, ErrorString*);
+    bool perform(PassOwnPtr<Action>, ExceptionCode&);
     void markUndoableState();
 
-    bool undo(ErrorString*);
+    bool undo(ExceptionCode&);
+    bool redo(ExceptionCode&);
     void reset();
 
 private:
-    void dump();
-    Deque<OwnPtr<Action> > m_history;
+    Vector<OwnPtr<Action> > m_history;
+    size_t m_afterLastActionIndex;
 };
 
 #endif // ENABLE(INSPECTOR)
diff --git a/Source/WebCore/inspector/InspectorIndexedDBAgent.cpp b/Source/WebCore/inspector/InspectorIndexedDBAgent.cpp
index b00525966..d767ff656 100644
--- a/Source/WebCore/inspector/InspectorIndexedDBAgent.cpp
+++ b/Source/WebCore/inspector/InspectorIndexedDBAgent.cpp
@@ -40,12 +40,17 @@
 #include "Frame.h"
 #include "GroupSettings.h"
 #include "IDBCallbacks.h"
+#include "IDBCursor.h"
 #include "IDBDatabaseBackendInterface.h"
 #include "IDBFactoryBackendInterface.h"
 #include "IDBIndexBackendInterface.h"
+#include "IDBKey.h"
+#include "IDBKeyRange.h"
 #include "IDBObjectStoreBackendInterface.h"
+#include "IDBPendingTransactionMonitor.h"
 #include "IDBTransaction.h"
 #include "IDBTransactionBackendInterface.h"
+#include "InjectedScript.h"
 #include "InspectorFrontend.h"
 #include "InspectorPageAgent.h"
 #include "InspectorState.h"
@@ -57,8 +62,12 @@
 
 #include <wtf/Vector.h>
 
+using WebCore::TypeBuilder::Array;
 using WebCore::TypeBuilder::IndexedDB::SecurityOriginWithDatabaseNames;
 using WebCore::TypeBuilder::IndexedDB::DatabaseWithObjectStores;
+using WebCore::TypeBuilder::IndexedDB::DataEntry;
+using WebCore::TypeBuilder::IndexedDB::Key;
+using WebCore::TypeBuilder::IndexedDB::KeyRange;
 using WebCore::TypeBuilder::IndexedDB::ObjectStore;
 using WebCore::TypeBuilder::IndexedDB::ObjectStoreIndex;
 
@@ -102,6 +111,21 @@ public:
     virtual void onBlocked() { }
 };
 
+class InspectorIDBTransactionCallback : public IDBTransactionCallbacks {
+public:
+    static PassRefPtr<InspectorIDBTransactionCallback> create()
+    {
+        return adoptRef(new InspectorIDBTransactionCallback());
+    }
+
+    virtual ~InspectorIDBTransactionCallback() { }
+
+    virtual void onAbort() { }
+    virtual void onComplete() { }
+private:
+    InspectorIDBTransactionCallback() { }
+};
+
 class GetDatabaseNamesCallback : public InspectorIDBCallback {
 public:
     static PassRefPtr<GetDatabaseNamesCallback> create(InspectorIndexedDBAgent::FrontendProvider* frontendProvider, int requestId, const String& securityOrigin)
@@ -262,10 +286,281 @@ private:
     int m_requestId;
 };
 
+static PassRefPtr<IDBKey> idbKeyFromInspectorObject(InspectorObject* key)
+{
+    RefPtr<IDBKey> idbKey;
+
+    String type;
+    if (!key->getString("type", &type))
+        return 0;
+
+    DEFINE_STATIC_LOCAL(String, number, ("number"));
+    DEFINE_STATIC_LOCAL(String, string, ("string"));
+    DEFINE_STATIC_LOCAL(String, date, ("date"));
+    DEFINE_STATIC_LOCAL(String, array, ("array"));
+
+    if (type == number) {
+        double number;
+        if (!key->getNumber("number", &number))
+            return 0;
+        idbKey = IDBKey::createNumber(number);
+    } else if (type == string) {
+        String string;
+        if (!key->getString("string", &string))
+            return 0;
+        idbKey = IDBKey::createString(string);
+    } else if (type == date) {
+        double date;
+        if (!key->getNumber("date", &date))
+            return 0;
+        idbKey = IDBKey::createDate(date);
+    } else if (type == array) {
+        IDBKey::KeyArray keyArray;
+        RefPtr<InspectorArray> array = key->getArray("array");
+        for (size_t i = 0; i < array->length(); ++i) {
+            RefPtr<InspectorValue> value = array->get(i);
+            RefPtr<InspectorObject> object;
+            if (!value->asObject(&object))
+                return 0;
+            keyArray.append(idbKeyFromInspectorObject(object.get()));
+        }
+        idbKey = IDBKey::createArray(keyArray);
+    } else
+        return 0;
+
+    return idbKey.release();
+}
+
+static PassRefPtr<IDBKeyRange> idbKeyRangeFromKeyRange(InspectorObject* keyRange)
+{
+    RefPtr<InspectorObject> lower = keyRange->getObject("lower");
+    RefPtr<IDBKey> idbLower = lower ? idbKeyFromInspectorObject(lower.get()) : 0;
+    if (lower && !idbLower)
+        return 0;
+
+    RefPtr<InspectorObject> upper = keyRange->getObject("upper");
+    RefPtr<IDBKey> idbUpper = upper ? idbKeyFromInspectorObject(upper.get()) : 0;
+    if (upper && !idbUpper)
+        return 0;
+
+    bool lowerOpen;
+    if (!keyRange->getBoolean("lowerOpen", &lowerOpen))
+        return 0;
+    IDBKeyRange::LowerBoundType lowerBoundType = lowerOpen ? IDBKeyRange::LowerBoundOpen : IDBKeyRange::LowerBoundClosed;
+
+    bool upperOpen;
+    if (!keyRange->getBoolean("upperOpen", &upperOpen))
+        return 0;
+    IDBKeyRange::UpperBoundType upperBoundType = upperOpen ? IDBKeyRange::UpperBoundOpen : IDBKeyRange::UpperBoundClosed;
+
+    RefPtr<IDBKeyRange> idbKeyRange = IDBKeyRange::create(idbLower, idbUpper, lowerBoundType, upperBoundType);
+    return idbKeyRange.release();
+}
+
+static PassRefPtr<Key> keyFromIDBKey(IDBKey* idbKey)
+{
+    if (!idbKey || !idbKey->valid())
+        return 0;
+
+    RefPtr<Key> key;
+    switch (idbKey->type()) {
+    case IDBKey::InvalidType:
+    case IDBKey::MinType:
+        return 0;
+    case IDBKey::NumberType: {
+        RefPtr<Key> tmpKey = Key::create().setType(Key::Type::Number);
+        key = tmpKey;
+        key->setNumber(idbKey->number());
+        break;
+    }
+    case IDBKey::StringType: {
+        RefPtr<Key> tmpKey = Key::create().setType(Key::Type::String);
+        key = tmpKey;
+        key->setString(idbKey->string());
+        break;
+    }
+    case IDBKey::DateType: {
+        RefPtr<Key> tmpKey = Key::create().setType(Key::Type::Date);
+        key = tmpKey;
+        key->setDate(idbKey->date());
+        break;
+    }
+    case IDBKey::ArrayType: {
+        RefPtr<Key> tmpKey = Key::create().setType(Key::Type::Array);
+        key = tmpKey;
+        RefPtr<InspectorArray> array = InspectorArray::create();
+        IDBKey::KeyArray keyArray = idbKey->array();
+        for (size_t i = 0; i < keyArray.size(); ++i)
+            array->pushObject(keyFromIDBKey(keyArray[i].get()));
+        key->setArray(array);
+        break;
+    }
+    }
+    return key.release();
+}
+
+class OpenCursorCallback : public InspectorIDBCallback {
+public:
+    enum CursorType {
+        ObjectStoreDataCursor,
+        IndexDataCursor
+    };
+
+    static PassRefPtr<OpenCursorCallback> create(PassRefPtr<InspectorIndexedDBAgent::FrontendProvider> frontendProvider, InjectedScript injectedScript, PassRefPtr<IDBTransactionBackendInterface> idbTransaction, CursorType cursorType, int requestId, int skipCount, unsigned pageSize)
+    {
+        return adoptRef(new OpenCursorCallback(frontendProvider, injectedScript, idbTransaction, cursorType, requestId, skipCount, pageSize));
+    }
+
+    virtual ~OpenCursorCallback() { }
+
+    virtual void onSuccess(PassRefPtr<SerializedScriptValue>)
+    {
+        end(false);
+    }
+
+    virtual void onSuccess(PassRefPtr<IDBCursorBackendInterface> idbCursor)
+    {
+        m_idbCursor = idbCursor;
+        onSuccessWithContinuation();
+    }
+
+    virtual void onSuccessWithContinuation()
+    {
+        if (m_skipCount) {
+            --m_skipCount;
+            next();
+            return;
+        }
+
+        if (m_result->length() == m_pageSize) {
+            end(true);
+            return;
+        }
+
+        RefPtr<IDBKey> key = m_idbCursor->key();
+        RefPtr<IDBKey> primaryKey = m_idbCursor->primaryKey();
+        RefPtr<SerializedScriptValue> value = m_idbCursor->value();
+        RefPtr<InspectorObject> wrappedValue = m_injectedScript.wrapSerializedObject(value.get(), String());
+        RefPtr<DataEntry> dataEntry = DataEntry::create()
+            .setKey(keyFromIDBKey(key.get()))
+            .setPrimaryKey(keyFromIDBKey(primaryKey.get()))
+            .setValue(wrappedValue);
+        m_result->addItem(dataEntry);
+
+        next();
+    }
+
+    void next()
+    {
+        ExceptionCode ec = 0;
+        m_idbCursor->continueFunction(0, this, ec);
+        m_idbTransaction->didCompleteTaskEvents();
+    }
+
+    void end(bool hasMore)
+    {
+        if (!m_frontendProvider->frontend())
+            return;
+
+        m_idbTransaction->didCompleteTaskEvents();
+
+        switch (m_cursorType) {
+        case ObjectStoreDataCursor:
+            m_frontendProvider->frontend()->objectStoreDataLoaded(m_requestId, m_result.release(), hasMore);
+            break;
+        case IndexDataCursor:
+            m_frontendProvider->frontend()->indexDataLoaded(m_requestId, m_result.release(), hasMore);
+            break;
+        }
+    }
+
+private:
+    OpenCursorCallback(PassRefPtr<InspectorIndexedDBAgent::FrontendProvider> frontendProvider, InjectedScript injectedScript, PassRefPtr<IDBTransactionBackendInterface> idbTransaction, CursorType cursorType, int requestId, int skipCount, unsigned pageSize)
+        : m_frontendProvider(frontendProvider)
+        , m_injectedScript(injectedScript)
+        , m_idbTransaction(idbTransaction)
+        , m_cursorType(cursorType)
+        , m_requestId(requestId)
+        , m_skipCount(skipCount)
+        , m_pageSize(pageSize)
+    {
+        m_result = Array<DataEntry>::create();
+        m_idbTransaction->setCallbacks(InspectorIDBTransactionCallback::create().get());
+    }
+    RefPtr<InspectorIndexedDBAgent::FrontendProvider> m_frontendProvider;
+    InjectedScript m_injectedScript;
+    RefPtr<IDBTransactionBackendInterface> m_idbTransaction;
+    CursorType m_cursorType;
+    int m_requestId;
+    int m_skipCount;
+    unsigned m_pageSize;
+    RefPtr<Array<DataEntry> > m_result;
+    RefPtr<IDBCursorBackendInterface> m_idbCursor;
+};
+
+class DataLoaderCallback : public ExecutableWithDatabase {
+public:
+    static PassRefPtr<DataLoaderCallback> create(PassRefPtr<InspectorIndexedDBAgent::FrontendProvider> frontendProvider, int requestId, const InjectedScript& injectedScript, const String& objectStoreName, const String& indexName, PassRefPtr<IDBKeyRange> idbKeyRange, int skipCount, unsigned pageSize)
+    {
+        return adoptRef(new DataLoaderCallback(frontendProvider, requestId, injectedScript, objectStoreName, indexName, idbKeyRange, skipCount, pageSize));
+    }
+
+    virtual ~DataLoaderCallback() { }
+
+    virtual void execute(PassRefPtr<IDBDatabaseBackendInterface> idbDatabase)
+    {
+        if (!m_frontendProvider->frontend())
+            return;
+
+        RefPtr<IDBTransactionBackendInterface> idbTransaction = transactionForDatabase(idbDatabase.get(), m_objectStoreName);
+        if (!idbTransaction)
+            return;
+        RefPtr<IDBObjectStoreBackendInterface> idbObjectStore = objectStoreForTransaction(idbTransaction.get(), m_objectStoreName);
+        if (!idbObjectStore)
+            return;
+
+        if (!m_indexName.isEmpty()) {
+            RefPtr<IDBIndexBackendInterface> idbIndex = indexForObjectStore(idbObjectStore.get(), m_indexName);
+            if (!idbIndex)
+                return;
+
+            RefPtr<OpenCursorCallback> openCursorCallback = OpenCursorCallback::create(m_frontendProvider, m_injectedScript, idbTransaction.get(), OpenCursorCallback::IndexDataCursor, m_requestId, m_skipCount, m_pageSize);
+
+            ExceptionCode ec = 0;
+            idbIndex->openCursor(m_idbKeyRange, IDBCursor::NEXT, openCursorCallback, idbTransaction.get(), ec);
+        } else {
+            RefPtr<OpenCursorCallback> openCursorCallback = OpenCursorCallback::create(m_frontendProvider, m_injectedScript, idbTransaction.get(), OpenCursorCallback::ObjectStoreDataCursor, m_requestId, m_skipCount, m_pageSize);
+
+            ExceptionCode ec = 0;
+            idbObjectStore->openCursor(m_idbKeyRange, IDBCursor::NEXT, openCursorCallback, idbTransaction.get(), ec);
+        }
+    }
+
+private:
+    DataLoaderCallback(PassRefPtr<InspectorIndexedDBAgent::FrontendProvider> frontendProvider, int requestId, const InjectedScript& injectedScript, const String& objectStoreName, const String& indexName, PassRefPtr<IDBKeyRange> idbKeyRange, int skipCount, unsigned pageSize)
+        : m_frontendProvider(frontendProvider)
+        , m_requestId(requestId)
+        , m_injectedScript(injectedScript)
+        , m_objectStoreName(objectStoreName)
+        , m_indexName(indexName)
+        , m_idbKeyRange(idbKeyRange)
+        , m_skipCount(skipCount)
+        , m_pageSize(pageSize) { }
+    RefPtr<InspectorIndexedDBAgent::FrontendProvider> m_frontendProvider;
+    int m_requestId;
+    InjectedScript m_injectedScript;
+    String m_objectStoreName;
+    String m_indexName;
+    RefPtr<IDBKeyRange> m_idbKeyRange;
+    int m_skipCount;
+    unsigned m_pageSize;
+};
+
 } // namespace
 
-InspectorIndexedDBAgent::InspectorIndexedDBAgent(InstrumentingAgents* instrumentingAgents, InspectorState* state, InspectorPageAgent* pageAgent)
+InspectorIndexedDBAgent::InspectorIndexedDBAgent(InstrumentingAgents* instrumentingAgents, InspectorState* state, InjectedScriptManager* injectedScriptManager, InspectorPageAgent* pageAgent)
     : InspectorBaseAgent<InspectorIndexedDBAgent>("IndexedDB", instrumentingAgents, state)
+    , m_injectedScriptManager(injectedScriptManager)
     , m_pageAgent(pageAgent)
 {
 }
@@ -304,34 +599,54 @@ void InspectorIndexedDBAgent::disable(ErrorString*)
     m_state->setBoolean(IndexedDBAgentState::indexedDBAgentEnabled, false);
 }
 
-static Document* assertDocument(const String& frameId, InspectorPageAgent* pageAgent, ErrorString* error)
+static Frame* assertFrame(ErrorString* errorString, const String& frameId, InspectorPageAgent* pageAgent)
 {
     Frame* frame = pageAgent->frameForId(frameId);
+
+    if (!frame)
+        *errorString = "Frame not found";
+
+    return frame;
+}
+
+static Document* assertDocument(ErrorString* errorString, Frame* frame)
+{
     Document* document = frame ? frame->document() : 0;
 
     if (!document)
-        *error = "No document for given frame found";
+        *errorString = "No document for given frame found";
 
     return document;
 }
 
-static IDBFactoryBackendInterface* assertIDBFactory(Document* document, ErrorString* error)
+static Document* assertDocument(ErrorString* errorString, const String& frameId, InspectorPageAgent* pageAgent)
+{
+    Frame* frame = pageAgent->frameForId(frameId);
+    Document* document = frame ? frame->document() : 0;
+
+    if (!document)
+        *errorString = "No document for given frame found";
+
+    return document;
+}
+
+static IDBFactoryBackendInterface* assertIDBFactory(ErrorString* errorString, Document* document)
 {
     Page* page = document ? document->page() : 0;
     IDBFactoryBackendInterface* idbFactory = page ? page->group().idbFactory() : 0;
 
     if (!idbFactory)
-        *error = "No IndexedDB factory for given frame found";
+        *errorString = "No IndexedDB factory for given frame found";
 
     return idbFactory;
 }
 
-void InspectorIndexedDBAgent::requestDatabaseNamesForFrame(ErrorString* error, int requestId, const String& frameId)
+void InspectorIndexedDBAgent::requestDatabaseNamesForFrame(ErrorString* errorString, int requestId, const String& frameId)
 {
-    Document* document = assertDocument(frameId, m_pageAgent, error);
+    Document* document = assertDocument(errorString, frameId, m_pageAgent);
     if (!document)
         return;
-    IDBFactoryBackendInterface* idbFactory = assertIDBFactory(document, error);
+    IDBFactoryBackendInterface* idbFactory = assertIDBFactory(errorString, document);
     if (!idbFactory)
         return;
 
@@ -340,12 +655,12 @@ void InspectorIndexedDBAgent::requestDatabaseNamesForFrame(ErrorString* error, i
     idbFactory->getDatabaseNames(callback.get(), document->securityOrigin(), document->frame(), groupSettings->indexedDBDatabasePath());
 }
 
-void InspectorIndexedDBAgent::requestDatabase(ErrorString* error, int requestId, const String& frameId, const String& databaseName)
+void InspectorIndexedDBAgent::requestDatabase(ErrorString* errorString, int requestId, const String& frameId, const String& databaseName)
 {
-    Document* document = assertDocument(frameId, m_pageAgent, error);
+    Document* document = assertDocument(errorString, frameId, m_pageAgent);
     if (!document)
         return;
-    IDBFactoryBackendInterface* idbFactory = assertIDBFactory(document, error);
+    IDBFactoryBackendInterface* idbFactory = assertIDBFactory(errorString, document);
     if (!idbFactory)
         return;
 
@@ -353,6 +668,30 @@ void InspectorIndexedDBAgent::requestDatabase(ErrorString* error, int requestId,
     databaseLoaderCallback->start(idbFactory, document->securityOrigin(), document->frame(), databaseName);
 }
 
+void InspectorIndexedDBAgent::requestData(ErrorString* errorString, int requestId, const String& frameId, const String& databaseName, const String& objectStoreName, const String& indexName, int skipCount, int pageSize, const RefPtr<InspectorObject>* keyRange)
+{
+    Frame* frame = assertFrame(errorString, frameId, m_pageAgent);
+    if (!frame)
+        return;
+    Document* document = assertDocument(errorString, frame);
+    if (!document)
+        return;
+    IDBFactoryBackendInterface* idbFactory = assertIDBFactory(errorString, document);
+    if (!idbFactory)
+        return;
+
+    InjectedScript injectedScript = m_injectedScriptManager->injectedScriptFor(mainWorldScriptState(frame));
+
+    RefPtr<IDBKeyRange> idbKeyRange = keyRange ? idbKeyRangeFromKeyRange(keyRange->get()) : 0;
+    if (keyRange && !idbKeyRange) {
+        *errorString = "Can not parse key range.";
+        return;
+    }
+
+    RefPtr<DataLoaderCallback> dataLoaderCallback = DataLoaderCallback::create(m_frontendProvider, requestId, injectedScript, objectStoreName, indexName, idbKeyRange, skipCount, pageSize);
+    dataLoaderCallback->start(idbFactory, document->securityOrigin(), document->frame(), databaseName);
+}
+
 } // namespace WebCore
 
 #endif // ENABLE(INSPECTOR) && ENABLE(INDEXED_DATABASE)
diff --git a/Source/WebCore/inspector/InspectorIndexedDBAgent.h b/Source/WebCore/inspector/InspectorIndexedDBAgent.h
index 1b46dd143..b19ed6e5f 100644
--- a/Source/WebCore/inspector/InspectorIndexedDBAgent.h
+++ b/Source/WebCore/inspector/InspectorIndexedDBAgent.h
@@ -39,6 +39,7 @@
 
 namespace WebCore {
 
+class InjectedScriptManager;
 class InspectorPageAgent;
 
 typedef String ErrorString;
@@ -47,9 +48,9 @@ class InspectorIndexedDBAgent : public InspectorBaseAgent<InspectorIndexedDBAgen
 public:
     class FrontendProvider;
 
-    static PassOwnPtr<InspectorIndexedDBAgent> create(InstrumentingAgents* instrumentingAgents, InspectorState* state, InspectorPageAgent* pageAgent)
+    static PassOwnPtr<InspectorIndexedDBAgent> create(InstrumentingAgents* instrumentingAgents, InspectorState* state, InjectedScriptManager* injectedScriptManager, InspectorPageAgent* pageAgent)
     {
-        return adoptPtr(new InspectorIndexedDBAgent(instrumentingAgents, state, pageAgent));
+        return adoptPtr(new InspectorIndexedDBAgent(instrumentingAgents, state, injectedScriptManager, pageAgent));
     }
     ~InspectorIndexedDBAgent();
 
@@ -62,9 +63,11 @@ public:
     virtual void disable(ErrorString*);
     virtual void requestDatabaseNamesForFrame(ErrorString*, int requestId, const String& frameId);
     virtual void requestDatabase(ErrorString*, int requestId, const String& frameId, const String& databaseName);
+    virtual void requestData(ErrorString*, int requestId, const String& frameId, const String& databaseName, const String& objectStoreName, const String& indexName, int skipCount, int pageSize, const RefPtr<InspectorObject>* keyRange);
 private:
-    InspectorIndexedDBAgent(InstrumentingAgents*, InspectorState*, InspectorPageAgent*);
+    InspectorIndexedDBAgent(InstrumentingAgents*, InspectorState*, InjectedScriptManager*, InspectorPageAgent*);
 
+    InjectedScriptManager* m_injectedScriptManager;
     InspectorPageAgent* m_pageAgent;
     RefPtr<FrontendProvider> m_frontendProvider;
     bool m_enabled;
diff --git a/Source/WebCore/inspector/InspectorInstrumentation.cpp b/Source/WebCore/inspector/InspectorInstrumentation.cpp
index 95d6f30c6..532eb8665 100644
--- a/Source/WebCore/inspector/InspectorInstrumentation.cpp
+++ b/Source/WebCore/inspector/InspectorInstrumentation.cpp
@@ -71,6 +71,9 @@
 
 namespace WebCore {
 
+static const char* const requestAnimationFrameEventName = "requestAnimationFrame";
+static const char* const cancelAnimationFrameEventName = "cancelAnimationFrame";
+static const char* const animationFrameFiredEventName = "animationFrameFired";
 static const char* const setTimerEventName = "setTimer";
 static const char* const clearTimerEventName = "clearTimer";
 static const char* const timerFiredEventName = "timerFired";
@@ -154,11 +157,13 @@ void InspectorInstrumentation::didRemoveDOMNodeImpl(InstrumentingAgents* instrum
         domAgent->didRemoveDOMNode(node);
 }
 
-void InspectorInstrumentation::willModifyDOMAttrImpl(InstrumentingAgents* instrumentingAgents, Element* element)
+void InspectorInstrumentation::willModifyDOMAttrImpl(InstrumentingAgents* instrumentingAgents, Element* element, const AtomicString& oldValue, const AtomicString& newValue)
 {
 #if ENABLE(JAVASCRIPT_DEBUGGER)
     if (InspectorDOMDebuggerAgent* domDebuggerAgent = instrumentingAgents->inspectorDOMDebuggerAgent())
         domDebuggerAgent->willModifyDOMAttr(element);
+    if (InspectorDOMAgent* domAgent = instrumentingAgents->inspectorDOMAgent())
+        domAgent->willModifyDOMAttr(element, oldValue, newValue);
 #endif
 }
 
@@ -397,8 +402,11 @@ void InspectorInstrumentation::didLoadXHRImpl(const InspectorInstrumentationCook
         timelineAgent->didLoadXHR();
 }
 
-InspectorInstrumentationCookie InspectorInstrumentation::willPaintImpl(InstrumentingAgents* instrumentingAgents, const LayoutRect& rect)
+InspectorInstrumentationCookie InspectorInstrumentation::willPaintImpl(InstrumentingAgents* instrumentingAgents, GraphicsContext* context, const LayoutRect& rect)
 {
+    if (InspectorPageAgent* pageAgent = instrumentingAgents->inspectorPageAgent())
+        pageAgent->willPaint(context, rect);
+
     int timelineAgentId = 0;
     if (InspectorTimelineAgent* timelineAgent = instrumentingAgents->inspectorTimelineAgent()) {
         timelineAgent->willPaint(rect);
@@ -411,6 +419,8 @@ void InspectorInstrumentation::didPaintImpl(const InspectorInstrumentationCookie
 {
     if (InspectorTimelineAgent* timelineAgent = retrieveTimelineAgent(cookie))
         timelineAgent->didPaint();
+    if (InspectorPageAgent* pageAgent = cookie.first ? cookie.first->inspectorPageAgent() : 0)
+        pageAgent->didPaint();
 }
 
 InspectorInstrumentationCookie InspectorInstrumentation::willRecalculateStyleImpl(InstrumentingAgents* instrumentingAgents)
@@ -983,32 +993,38 @@ void InspectorInstrumentation::cancelPauseOnNativeEvent(InstrumentingAgents* ins
 #endif
 }
 
-void InspectorInstrumentation::didRegisterAnimationFrameCallbackImpl(InstrumentingAgents* instrumentingAgents, int callbackId)
+void InspectorInstrumentation::didRequestAnimationFrameImpl(InstrumentingAgents* instrumentingAgents, int callbackId)
 {
+    pauseOnNativeEventIfNeeded(instrumentingAgents, false, requestAnimationFrameEventName, true);
+
     if (InspectorTimelineAgent* timelineAgent = instrumentingAgents->inspectorTimelineAgent())
-        timelineAgent->didRegisterAnimationFrameCallback(callbackId);
+        timelineAgent->didRequestAnimationFrame(callbackId);
 }
 
-void InspectorInstrumentation::didCancelAnimationFrameCallbackImpl(InstrumentingAgents* instrumentingAgents, int callbackId)
+void InspectorInstrumentation::didCancelAnimationFrameImpl(InstrumentingAgents* instrumentingAgents, int callbackId)
 {
+    pauseOnNativeEventIfNeeded(instrumentingAgents, false, cancelAnimationFrameEventName, true);
+
     if (InspectorTimelineAgent* timelineAgent = instrumentingAgents->inspectorTimelineAgent())
-        timelineAgent->didCancelAnimationFrameCallback(callbackId);
+        timelineAgent->didCancelAnimationFrame(callbackId);
 }
 
-InspectorInstrumentationCookie InspectorInstrumentation::willFireAnimationFrameEventImpl(InstrumentingAgents* instrumentingAgents, int callbackId)
+InspectorInstrumentationCookie InspectorInstrumentation::willFireAnimationFrameImpl(InstrumentingAgents* instrumentingAgents, int callbackId)
 {
+    pauseOnNativeEventIfNeeded(instrumentingAgents, false, animationFrameFiredEventName, false);
+
     int timelineAgentId = 0;
     if (InspectorTimelineAgent* timelineAgent = instrumentingAgents->inspectorTimelineAgent()) {
-        timelineAgent->willFireAnimationFrameEvent(callbackId);
+        timelineAgent->willFireAnimationFrame(callbackId);
         timelineAgentId = timelineAgent->id();
     }
     return InspectorInstrumentationCookie(instrumentingAgents, timelineAgentId);
 }
 
-void InspectorInstrumentation::didFireAnimationFrameEventImpl(const InspectorInstrumentationCookie& cookie)
+void InspectorInstrumentation::didFireAnimationFrameImpl(const InspectorInstrumentationCookie& cookie)
 {
     if (InspectorTimelineAgent* timelineAgent = retrieveTimelineAgent(cookie))
-        timelineAgent->didFireAnimationFrameEvent();
+        timelineAgent->didFireAnimationFrame();
 }
 
 InspectorTimelineAgent* InspectorInstrumentation::retrieveTimelineAgent(const InspectorInstrumentationCookie& cookie)
diff --git a/Source/WebCore/inspector/InspectorInstrumentation.h b/Source/WebCore/inspector/InspectorInstrumentation.h
index da7dfe019..5d5c2d3d3 100644
--- a/Source/WebCore/inspector/InspectorInstrumentation.h
+++ b/Source/WebCore/inspector/InspectorInstrumentation.h
@@ -51,6 +51,7 @@ class Database;
 class Element;
 class EventContext;
 class DocumentLoader;
+class GraphicsContext;
 class HitTestResult;
 class InspectorCSSAgent;
 class InspectorTimelineAgent;
@@ -85,7 +86,7 @@ public:
     static void willInsertDOMNode(Document*, Node*, Node* parent);
     static void didInsertDOMNode(Document*, Node*);
     static void willRemoveDOMNode(Document*, Node*);
-    static void willModifyDOMAttr(Document*, Element*);
+    static void willModifyDOMAttr(Document*, Element*, const AtomicString& oldValue, const AtomicString& newValue);
     static void didModifyDOMAttr(Document*, Element*, const AtomicString& name, const AtomicString& value);
     static void didRemoveDOMAttr(Document*, Element*, const AtomicString& name);
     static void characterDataModified(Document*, CharacterData*);
@@ -120,7 +121,7 @@ public:
     static void didLayout(const InspectorInstrumentationCookie&);
     static InspectorInstrumentationCookie willLoadXHR(ScriptExecutionContext*, XMLHttpRequest*);
     static void didLoadXHR(const InspectorInstrumentationCookie&);
-    static InspectorInstrumentationCookie willPaint(Frame*, const LayoutRect&);
+    static InspectorInstrumentationCookie willPaint(Frame*, GraphicsContext*, const LayoutRect&);
     static void didPaint(const InspectorInstrumentationCookie&);
     static InspectorInstrumentationCookie willRecalculateStyle(Document*);
     static void didRecalculateStyle(const InspectorInstrumentationCookie&);
@@ -173,10 +174,10 @@ public:
     static void stopConsoleTiming(Page*, const String& title, PassRefPtr<ScriptCallStack>);
     static void consoleTimeStamp(Page*, PassRefPtr<ScriptArguments>);
 
-    static void didRegisterAnimationFrameCallback(Document*, int callbackId);
-    static void didCancelAnimationFrameCallback(Document*, int callbackId);
-    static InspectorInstrumentationCookie willFireAnimationFrameEvent(Document*, int callbackId);
-    static void didFireAnimationFrameEvent(const InspectorInstrumentationCookie&);
+    static void didRequestAnimationFrame(Document*, int callbackId);
+    static void didCancelAnimationFrame(Document*, int callbackId);
+    static InspectorInstrumentationCookie willFireAnimationFrame(Document*, int callbackId);
+    static void didFireAnimationFrame(const InspectorInstrumentationCookie&);
 
 #if ENABLE(JAVASCRIPT_DEBUGGER)
     static void addStartProfilingMessageToConsole(Page*, const String& title, unsigned lineNumber, const String& sourceURL);
@@ -235,7 +236,7 @@ private:
     static void didInsertDOMNodeImpl(InstrumentingAgents*, Node*);
     static void willRemoveDOMNodeImpl(InstrumentingAgents*, Node*);
     static void didRemoveDOMNodeImpl(InstrumentingAgents*, Node*);
-    static void willModifyDOMAttrImpl(InstrumentingAgents*, Element*);
+    static void willModifyDOMAttrImpl(InstrumentingAgents*, Element*, const AtomicString& oldValue, const AtomicString& newValue);
     static void didModifyDOMAttrImpl(InstrumentingAgents*, Element*, const AtomicString& name, const AtomicString& value);
     static void didRemoveDOMAttrImpl(InstrumentingAgents*, Element*, const AtomicString& name);
     static void characterDataModifiedImpl(InstrumentingAgents*, CharacterData*);
@@ -270,7 +271,7 @@ private:
     static void didLayoutImpl(const InspectorInstrumentationCookie&);
     static InspectorInstrumentationCookie willLoadXHRImpl(InstrumentingAgents*, XMLHttpRequest*);
     static void didLoadXHRImpl(const InspectorInstrumentationCookie&);
-    static InspectorInstrumentationCookie willPaintImpl(InstrumentingAgents*, const LayoutRect&);
+    static InspectorInstrumentationCookie willPaintImpl(InstrumentingAgents*, GraphicsContext*, const LayoutRect&);
     static void didPaintImpl(const InspectorInstrumentationCookie&);
     static InspectorInstrumentationCookie willRecalculateStyleImpl(InstrumentingAgents*);
     static void didRecalculateStyleImpl(const InspectorInstrumentationCookie&);
@@ -320,10 +321,10 @@ private:
     static void stopConsoleTimingImpl(InstrumentingAgents*, const String& title, PassRefPtr<ScriptCallStack>);
     static void consoleTimeStampImpl(InstrumentingAgents*, PassRefPtr<ScriptArguments>);
 
-    static void didRegisterAnimationFrameCallbackImpl(InstrumentingAgents*, int callbackId);
-    static void didCancelAnimationFrameCallbackImpl(InstrumentingAgents*, int callbackId);
-    static InspectorInstrumentationCookie willFireAnimationFrameEventImpl(InstrumentingAgents*, int callbackId);
-    static void didFireAnimationFrameEventImpl(const InspectorInstrumentationCookie&);
+    static void didRequestAnimationFrameImpl(InstrumentingAgents*, int callbackId);
+    static void didCancelAnimationFrameImpl(InstrumentingAgents*, int callbackId);
+    static InspectorInstrumentationCookie willFireAnimationFrameImpl(InstrumentingAgents*, int callbackId);
+    static void didFireAnimationFrameImpl(const InspectorInstrumentationCookie&);
 
 #if ENABLE(JAVASCRIPT_DEBUGGER)
     static void addStartProfilingMessageToConsoleImpl(InstrumentingAgents*, const String& title, unsigned lineNumber, const String& sourceURL);
@@ -424,12 +425,12 @@ inline void InspectorInstrumentation::willRemoveDOMNode(Document* document, Node
 #endif
 }
 
-inline void InspectorInstrumentation::willModifyDOMAttr(Document* document, Element* element)
+inline void InspectorInstrumentation::willModifyDOMAttr(Document* document, Element* element, const AtomicString& oldValue, const AtomicString& newValue)
 {
 #if ENABLE(INSPECTOR)
     FAST_RETURN_IF_NO_FRONTENDS(void());
     if (InstrumentingAgents* instrumentingAgents = instrumentingAgentsForDocument(document))
-        willModifyDOMAttrImpl(instrumentingAgents, element);
+        willModifyDOMAttrImpl(instrumentingAgents, element, oldValue, newValue);
 #endif
 }
 
@@ -722,12 +723,12 @@ inline void InspectorInstrumentation::didLoadXHR(const InspectorInstrumentationC
 #endif
 }
 
-inline InspectorInstrumentationCookie InspectorInstrumentation::willPaint(Frame* frame, const LayoutRect& rect)
+inline InspectorInstrumentationCookie InspectorInstrumentation::willPaint(Frame* frame, GraphicsContext* context, const LayoutRect& rect)
 {
 #if ENABLE(INSPECTOR)
     FAST_RETURN_IF_NO_FRONTENDS(InspectorInstrumentationCookie());
     if (InstrumentingAgents* instrumentingAgents = instrumentingAgentsForFrame(frame))
-        return willPaintImpl(instrumentingAgents, rect);
+        return willPaintImpl(instrumentingAgents, context, rect);
 #endif
     return InspectorInstrumentationCookie();
 }
@@ -1172,37 +1173,37 @@ inline void InspectorInstrumentation::updateApplicationCacheStatus(Frame* frame)
 #endif
 }
 
-inline void InspectorInstrumentation::didRegisterAnimationFrameCallback(Document* document, int callbackId)
+inline void InspectorInstrumentation::didRequestAnimationFrame(Document* document, int callbackId)
 {
 #if ENABLE(INSPECTOR)
     if (InstrumentingAgents* instrumentingAgents = instrumentingAgentsForDocument(document))
-        didRegisterAnimationFrameCallbackImpl(instrumentingAgents, callbackId);
+        didRequestAnimationFrameImpl(instrumentingAgents, callbackId);
 #endif
 }
 
-inline void InspectorInstrumentation::didCancelAnimationFrameCallback(Document* document, int callbackId)
+inline void InspectorInstrumentation::didCancelAnimationFrame(Document* document, int callbackId)
 {
 #if ENABLE(INSPECTOR)
     if (InstrumentingAgents* instrumentingAgents = instrumentingAgentsForDocument(document))
-        didCancelAnimationFrameCallbackImpl(instrumentingAgents, callbackId);
+        didCancelAnimationFrameImpl(instrumentingAgents, callbackId);
 #endif
 }
 
-inline InspectorInstrumentationCookie InspectorInstrumentation::willFireAnimationFrameEvent(Document* document, int callbackId)
+inline InspectorInstrumentationCookie InspectorInstrumentation::willFireAnimationFrame(Document* document, int callbackId)
 {
 #if ENABLE(INSPECTOR)
     if (InstrumentingAgents* instrumentingAgents = instrumentingAgentsForDocument(document))
-        return willFireAnimationFrameEventImpl(instrumentingAgents, callbackId);
+        return willFireAnimationFrameImpl(instrumentingAgents, callbackId);
 #endif
     return InspectorInstrumentationCookie();
 }
 
-inline void InspectorInstrumentation::didFireAnimationFrameEvent(const InspectorInstrumentationCookie& cookie)
+inline void InspectorInstrumentation::didFireAnimationFrame(const InspectorInstrumentationCookie& cookie)
 {
 #if ENABLE(INSPECTOR)
     FAST_RETURN_IF_NO_FRONTENDS(void());
     if (cookie.first)
-        didFireAnimationFrameEventImpl(cookie);
+        didFireAnimationFrameImpl(cookie);
 #endif
 }
 
diff --git a/Source/WebCore/inspector/InspectorPageAgent.cpp b/Source/WebCore/inspector/InspectorPageAgent.cpp
index 44004bc8c..8e8b25abf 100644
--- a/Source/WebCore/inspector/InspectorPageAgent.cpp
+++ b/Source/WebCore/inspector/InspectorPageAgent.cpp
@@ -36,13 +36,17 @@
 
 #include "Base64.h"
 #include "CachedCSSStyleSheet.h"
+#include "CachedFont.h"
+#include "CachedImage.h"
 #include "CachedResource.h"
 #include "CachedResourceLoader.h"
 #include "CachedScript.h"
 #include "ContentSearchUtils.h"
 #include "Cookie.h"
 #include "CookieJar.h"
-#include "DOMEditor.h"
+#include "DOMImplementation.h"
+#include "DOMNodeHighlighter.h"
+#include "DOMPatchSupport.h"
 #include "Document.h"
 #include "DocumentLoader.h"
 #include "Frame.h"
@@ -51,6 +55,7 @@
 #include "HTMLNames.h"
 #include "IdentifiersFactory.h"
 #include "InjectedScriptManager.h"
+#include "InspectorClient.h"
 #include "InspectorFrontend.h"
 #include "InspectorInstrumentation.h"
 #include "InspectorState.h"
@@ -63,6 +68,7 @@
 #include "SecurityOrigin.h"
 #include "SharedBuffer.h"
 #include "TextEncoding.h"
+#include "TextResourceDecoder.h"
 #include "UserGestureIndicator.h"
 
 #include <wtf/CurrentTime.h>
@@ -78,6 +84,7 @@ static const char pageAgentEnabled[] = "pageAgentEnabled";
 static const char pageAgentScriptsToEvaluateOnLoad[] = "pageAgentScriptsToEvaluateOnLoad";
 static const char pageAgentScreenWidthOverride[] = "pageAgentScreenWidthOverride";
 static const char pageAgentScreenHeightOverride[] = "pageAgentScreenHeightOverride";
+static const char showPaintRects[] = "showPaintRects";
 }
 
 static bool decodeSharedBuffer(PassRefPtr<SharedBuffer> buffer, const String& textEncodingName, String* result)
@@ -121,7 +128,24 @@ static bool prepareCachedResourceBuffer(CachedResource* cachedResource, bool* ha
 static bool hasTextContent(CachedResource* cachedResource)
 {
     InspectorPageAgent::ResourceType type = InspectorPageAgent::cachedResourceType(*cachedResource);
-    return type == InspectorPageAgent::StylesheetResource || type == InspectorPageAgent::ScriptResource;
+    return type == InspectorPageAgent::StylesheetResource || type == InspectorPageAgent::ScriptResource || type == InspectorPageAgent::XHRResource;
+}
+
+// static
+PassRefPtr<TextResourceDecoder> InspectorPageAgent::createDecoder(const String& mimeType, const String& textEncodingName)
+{
+    RefPtr<TextResourceDecoder> decoder;
+    if (!textEncodingName.isEmpty())
+        decoder = TextResourceDecoder::create("text/plain", textEncodingName);
+    else if (mimeType == "text/plain")
+        decoder = TextResourceDecoder::create("text/plain", "ISO-8859-1");
+    else if (mimeType == "text/html")
+        decoder = TextResourceDecoder::create("text/html", "UTF-8");
+    else if (DOMImplementation::isXMLMIMEType(mimeType)) {
+        decoder = TextResourceDecoder::create("application/xml");
+        decoder->useLenientXMLDecoding();
+    }
+    return decoder;
 }
 
 bool InspectorPageAgent::cachedResourceContent(CachedResource* cachedResource, String* result, bool* base64Encoded)
@@ -142,6 +166,11 @@ bool InspectorPageAgent::cachedResourceContent(CachedResource* cachedResource, S
         return true;
     }
 
+    if (hasZeroSize) {
+        *result = "";
+        return true;
+    }
+
     if (cachedResource) {
         switch (cachedResource->type()) {
         case CachedResource::CSSStyleSheet:
@@ -150,11 +179,20 @@ bool InspectorPageAgent::cachedResourceContent(CachedResource* cachedResource, S
         case CachedResource::Script:
             *result = static_cast<CachedScript*>(cachedResource)->script();
             return true;
+        case CachedResource::RawResource: {
+            SharedBuffer* buffer = cachedResource->data();
+            if (!buffer)
+                return false;
+            RefPtr<TextResourceDecoder> decoder = InspectorPageAgent::createDecoder(cachedResource->response().mimeType(), cachedResource->response().textEncodingName());
+            // We show content for raw resources only for certain mime types (text, html and xml). Otherwise decoder will be null.
+            if (!decoder)
+                return false;
+            String content = decoder->decode(buffer->data(), buffer->size());
+            content += decoder->flush();
+            *result = content;
+            return true;
+        }
         default:
-            if (hasZeroSize) {
-                *result = "";
-                return true;
-            }
             return decodeSharedBuffer(cachedResource->data(), cachedResource->encoding(), result);
         }
     }
@@ -182,9 +220,9 @@ bool InspectorPageAgent::sharedBufferContent(PassRefPtr<SharedBuffer> buffer, co
     return decodeSharedBuffer(buffer, textEncodingName, result);
 }
 
-PassOwnPtr<InspectorPageAgent> InspectorPageAgent::create(InstrumentingAgents* instrumentingAgents, Page* page, InspectorState* state, InjectedScriptManager* injectedScriptManager)
+PassOwnPtr<InspectorPageAgent> InspectorPageAgent::create(InstrumentingAgents* instrumentingAgents, Page* page, InspectorState* state, InjectedScriptManager* injectedScriptManager, InspectorClient* client)
 {
-    return adoptPtr(new InspectorPageAgent(instrumentingAgents, page, state, injectedScriptManager));
+    return adoptPtr(new InspectorPageAgent(instrumentingAgents, page, state, injectedScriptManager, client));
 }
 
 // static
@@ -254,6 +292,8 @@ InspectorPageAgent::ResourceType InspectorPageAgent::cachedResourceType(const Ca
         return InspectorPageAgent::StylesheetResource;
     case CachedResource::Script:
         return InspectorPageAgent::ScriptResource;
+    case CachedResource::RawResource:
+        return InspectorPageAgent::XHRResource;
     default:
         break;
     }
@@ -265,13 +305,15 @@ String InspectorPageAgent::cachedResourceTypeString(const CachedResource& cached
     return resourceTypeString(cachedResourceType(cachedResource));
 }
 
-InspectorPageAgent::InspectorPageAgent(InstrumentingAgents* instrumentingAgents, Page* page, InspectorState* inspectorState, InjectedScriptManager* injectedScriptManager)
+InspectorPageAgent::InspectorPageAgent(InstrumentingAgents* instrumentingAgents, Page* page, InspectorState* inspectorState, InjectedScriptManager* injectedScriptManager, InspectorClient* client)
     : InspectorBaseAgent<InspectorPageAgent>("Page", instrumentingAgents, inspectorState)
     , m_page(page)
     , m_injectedScriptManager(injectedScriptManager)
+    , m_client(client)
     , m_frontend(0)
     , m_lastScriptIdentifier(0)
     , m_originalUseFixedLayout(false)
+    , m_lastPaintContext(0)
 {
 }
 
@@ -388,8 +430,27 @@ static Vector<CachedResource*> cachedResourcesForFrame(Frame* frame)
 
     const CachedResourceLoader::DocumentResourceMap& allResources = frame->document()->cachedResourceLoader()->allCachedResources();
     CachedResourceLoader::DocumentResourceMap::const_iterator end = allResources.end();
-    for (CachedResourceLoader::DocumentResourceMap::const_iterator it = allResources.begin(); it != end; ++it)
-        result.append(it->second.get());
+    for (CachedResourceLoader::DocumentResourceMap::const_iterator it = allResources.begin(); it != end; ++it) {
+        CachedResource* cachedResource = it->second.get();
+
+        switch (cachedResource->type()) {
+        case CachedResource::ImageResource:
+            // Skip images that were not auto loaded (images disabled in the user agent).
+            if (static_cast<CachedImage*>(cachedResource)->stillNeedsLoad())
+                continue;
+            break;
+        case CachedResource::FontResource:
+            // Skip fonts that were referenced in CSS but never used/downloaded.
+            if (static_cast<CachedFont*>(cachedResource)->stillNeedsLoad())
+                continue;
+            break;
+        default:
+            // All other CachedResource types download immediately.
+            break;
+        }
+
+        result.append(cachedResource);
+    }
 
     return result;
 }
@@ -571,8 +632,7 @@ void InspectorPageAgent::setDocumentContent(ErrorString* errorString, const Stri
         *errorString = "No Document instance to set HTML for";
         return;
     }
-    DOMEditor editor(document);
-    editor.patchDocument(html);
+    DOMPatchSupport::patchDocument(document, html);
 }
 
 void InspectorPageAgent::setScreenSizeOverride(ErrorString* errorString, const int width, const int height)
@@ -597,6 +657,13 @@ void InspectorPageAgent::setScreenSizeOverride(ErrorString* errorString, const i
     updateFrameViewFixedLayout(width, height);
 }
 
+void InspectorPageAgent::setShowPaintRects(ErrorString*, bool show)
+{
+    m_state->setBoolean(PageAgentState::showPaintRects, show);
+    if (!show)
+        m_page->mainFrame()->view()->invalidate();
+}
+
 void InspectorPageAgent::didClearWindowObjectInWorld(Frame* frame, DOMWrapperWorld* world)
 {
     if (world != mainThreadNormalWorld())
@@ -726,6 +793,32 @@ void InspectorPageAgent::applyScreenHeightOverride(long* height)
         *height = heightOverride;
 }
 
+void InspectorPageAgent::willPaint(GraphicsContext* context, const LayoutRect& rect)
+{
+    if (m_state->getBoolean(PageAgentState::showPaintRects)) {
+        m_lastPaintContext = context;
+        m_lastPaintRect = rect;
+        m_lastPaintRect.inflate(-1);
+    }
+}
+
+void InspectorPageAgent::didPaint()
+{
+    if (!m_lastPaintContext || !m_state->getBoolean(PageAgentState::showPaintRects))
+        return;
+
+    static int colorSelector = 0;
+    const Color colors[] = {
+        Color(0xFF, 0, 0, 0x3F),
+        Color(0xFF, 0, 0xFF, 0x3F),
+        Color(0, 0, 0xFF, 0x3F),
+    };
+
+    DOMNodeHighlighter::drawOutline(*m_lastPaintContext, m_lastPaintRect, colors[colorSelector++ % WTF_ARRAY_LENGTH(colors)]);
+
+    m_lastPaintContext = 0;
+}
+
 PassRefPtr<InspectorObject> InspectorPageAgent::buildObjectForFrame(Frame* frame)
 {
     RefPtr<InspectorObject> frameObject = InspectorObject::create();
@@ -733,7 +826,7 @@ PassRefPtr<InspectorObject> InspectorPageAgent::buildObjectForFrame(Frame* frame
     if (frame->tree()->parent())
         frameObject->setString("parentId", frameId(frame->tree()->parent()));
     if (frame->ownerElement()) {
-        String name = frame->ownerElement()->getAttribute(HTMLNames::nameAttr);
+        String name = frame->ownerElement()->getNameAttribute();
         if (name.isEmpty())
             name = frame->ownerElement()->getAttribute(HTMLNames::idAttr);
         frameObject->setString("name", name);
@@ -758,10 +851,15 @@ PassRefPtr<InspectorObject> InspectorPageAgent::buildObjectForFrameTree(Frame* f
     Vector<CachedResource*> allResources = cachedResourcesForFrame(frame);
     for (Vector<CachedResource*>::const_iterator it = allResources.begin(); it != allResources.end(); ++it) {
         CachedResource* cachedResource = *it;
+
         RefPtr<InspectorObject> resourceObject = InspectorObject::create();
         resourceObject->setString("url", cachedResource->url());
         resourceObject->setString("type", cachedResourceTypeString(*cachedResource));
         resourceObject->setString("mimeType", cachedResource->response().mimeType());
+        if (cachedResource->status() == CachedResource::LoadError)
+            resourceObject->setBoolean("failed", true);
+        if (cachedResource->status() == CachedResource::Canceled)
+            resourceObject->setBoolean("canceled", true);
         subresources->pushValue(resourceObject);
     }
 
diff --git a/Source/WebCore/inspector/InspectorPageAgent.h b/Source/WebCore/inspector/InspectorPageAgent.h
index 59ed709d7..8fd7b4208 100644
--- a/Source/WebCore/inspector/InspectorPageAgent.h
+++ b/Source/WebCore/inspector/InspectorPageAgent.h
@@ -50,6 +50,7 @@ class Frame;
 class Frontend;
 class InjectedScriptManager;
 class InspectorArray;
+class InspectorClient;
 class InspectorObject;
 class InspectorState;
 class InstrumentingAgents;
@@ -57,6 +58,7 @@ class KURL;
 class Page;
 class RegularExpression;
 class SharedBuffer;
+class TextResourceDecoder;
 
 typedef String ErrorString;
 
@@ -74,8 +76,9 @@ public:
         OtherResource
     };
 
-    static PassOwnPtr<InspectorPageAgent> create(InstrumentingAgents*, Page*, InspectorState*, InjectedScriptManager*);
+    static PassOwnPtr<InspectorPageAgent> create(InstrumentingAgents*, Page*, InspectorState*, InjectedScriptManager*, InspectorClient*);
 
+    static PassRefPtr<TextResourceDecoder> createDecoder(const String& mimeType, const String& textEncodingName);
     static bool cachedResourceContent(CachedResource*, String* result, bool* base64Encoded);
     static bool sharedBufferContent(PassRefPtr<SharedBuffer>, const String& textEncodingName, bool withBase64Encode, String* result);
     static void resourceContent(ErrorString*, Frame*, const KURL&, String* result, bool* base64Encoded);
@@ -101,6 +104,7 @@ public:
     virtual void searchInResources(ErrorString*, const String&, const bool* caseSensitive, const bool* isRegex, RefPtr<InspectorArray>&);
     virtual void setDocumentContent(ErrorString*, const String& frameId, const String& html);
     virtual void setScreenSizeOverride(ErrorString*, int width, int height);
+    virtual void setShowPaintRects(ErrorString*, bool show);
 
     // InspectorInstrumentation API
     void didClearWindowObjectInWorld(Frame*, DOMWrapperWorld*);
@@ -111,6 +115,8 @@ public:
     void loaderDetachedFromFrame(DocumentLoader*);
     void applyScreenWidthOverride(long*);
     void applyScreenHeightOverride(long*);
+    void willPaint(GraphicsContext*, const LayoutRect&);
+    void didPaint();
 
     // Inspector Controller API
     virtual void setFrontend(InspectorFrontend*);
@@ -127,7 +133,7 @@ public:
     static DocumentLoader* assertDocumentLoader(ErrorString*, Frame*);
 
 private:
-    InspectorPageAgent(InstrumentingAgents*, Page*, InspectorState*, InjectedScriptManager*);
+    InspectorPageAgent(InstrumentingAgents*, Page*, InspectorState*, InjectedScriptManager*, InspectorClient*);
     void updateFrameViewFixedLayout(int, int);
     void setFrameViewFixedLayout(int, int);
     void clearFrameViewFixedLayout();
@@ -136,6 +142,7 @@ private:
     PassRefPtr<InspectorObject> buildObjectForFrameTree(Frame*);
     Page* m_page;
     InjectedScriptManager* m_injectedScriptManager;
+    InspectorClient* m_client;
     InspectorFrontend::Page* m_frontend;
     long m_lastScriptIdentifier;
     String m_pendingScriptToEvaluateOnLoadOnce;
@@ -145,6 +152,8 @@ private:
     HashMap<DocumentLoader*, String> m_loaderToIdentifier;
     OwnPtr<IntSize> m_originalFixedLayoutSize;
     bool m_originalUseFixedLayout;
+    GraphicsContext* m_lastPaintContext;
+    LayoutRect m_lastPaintRect;
 };
 
 
diff --git a/Source/WebCore/inspector/InspectorProfilerAgent.cpp b/Source/WebCore/inspector/InspectorProfilerAgent.cpp
index 8774276cb..08e9ea63a 100644
--- a/Source/WebCore/inspector/InspectorProfilerAgent.cpp
+++ b/Source/WebCore/inspector/InspectorProfilerAgent.cpp
@@ -34,6 +34,7 @@
 
 #include "Console.h"
 #include "InjectedScript.h"
+#include "InjectedScriptHost.h"
 #include "InspectorConsoleAgent.h"
 #include "InspectorFrontend.h"
 #include "InspectorState.h"
@@ -264,6 +265,7 @@ void InspectorProfilerAgent::resetState()
     m_nextUserInitiatedProfileNumber = 1;
     m_nextUserInitiatedHeapSnapshotNumber = 1;
     resetFrontendProfiles();
+    m_injectedScriptManager->injectedScriptHost()->clearInspectedObjects();
 }
 
 void InspectorProfilerAgent::resetFrontendProfiles()
diff --git a/Source/WebCore/inspector/InspectorResourceAgent.cpp b/Source/WebCore/inspector/InspectorResourceAgent.cpp
index ca3b0e925..09cdc036a 100644
--- a/Source/WebCore/inspector/InspectorResourceAgent.cpp
+++ b/Source/WebCore/inspector/InspectorResourceAgent.cpp
@@ -253,7 +253,7 @@ void InspectorResourceAgent::didReceiveResponse(unsigned long identifier, Docume
             type = InspectorPageAgent::ScriptResource;
         else if (equalIgnoringFragmentIdentifier(response.url(), loader->frameLoader()->icon()->url()))
             type = InspectorPageAgent::ImageResource;
-        else if (equalIgnoringFragmentIdentifier(response.url(), loader->url()) && type == InspectorPageAgent::OtherResource)
+        else if (equalIgnoringFragmentIdentifier(response.url(), loader->url()) && !loader->isCommitted())
             type = InspectorPageAgent::DocumentResource;
 
         m_resourcesData->responseReceived(requestId, m_pageAgent->frameId(loader->frame()), response);
@@ -328,7 +328,10 @@ void InspectorResourceAgent::didReceiveScriptResponse(unsigned long identifier)
 
 void InspectorResourceAgent::setInitialXHRContent(unsigned long identifier, const String& sourceString)
 {
-    m_resourcesData->setResourceContent(IdentifiersFactory::requestId(identifier), sourceString);
+    // For Asynchronous XHRs, the inspector can grab the data directly off of the CachedResource. For sync XHRs, we need to
+    // provide the data here, since no CachedResource was involved.
+    if (m_loadingXHRSynchronously)
+        m_resourcesData->setResourceContent(IdentifiersFactory::requestId(identifier), sourceString);
 }
 
 void InspectorResourceAgent::didReceiveXHRResponse(unsigned long identifier)
@@ -529,6 +532,8 @@ void InspectorResourceAgent::clearBrowserCookies(ErrorString*)
 void InspectorResourceAgent::setCacheDisabled(ErrorString*, bool cacheDisabled)
 {
     m_state->setBoolean(ResourceAgentState::cacheDisabled, cacheDisabled);
+    if (cacheDisabled)
+        memoryCache()->evictResources();
 }
 
 void InspectorResourceAgent::mainFrameNavigated(DocumentLoader* loader)
diff --git a/Source/WebCore/inspector/InspectorStyleSheet.cpp b/Source/WebCore/inspector/InspectorStyleSheet.cpp
index c7c4edb77..b72461e17 100644
--- a/Source/WebCore/inspector/InspectorStyleSheet.cpp
+++ b/Source/WebCore/inspector/InspectorStyleSheet.cpp
@@ -280,13 +280,13 @@ PassRefPtr<InspectorArray> InspectorStyle::buildArrayForComputedStyle() const
 //
 // The propertyText (if not empty) is checked to be a valid style declaration (containing at least one property). If not,
 // the method returns false (denoting an error).
-bool InspectorStyle::setPropertyText(ErrorString* errorString, unsigned index, const String& propertyText, bool overwrite, String* oldText)
+bool InspectorStyle::setPropertyText(unsigned index, const String& propertyText, bool overwrite, String* oldText, ExceptionCode& ec)
 {
     ASSERT(m_parentStyleSheet);
     DEFINE_STATIC_LOCAL(String, bogusPropertyName, ("-webkit-boguz-propertee"));
 
     if (!m_parentStyleSheet->ensureParsedDataReady()) {
-        *errorString = "Internal error: no stylesheet parsed data available";
+        ec = NOT_FOUND_ERR;
         return false;
     }
 
@@ -303,27 +303,27 @@ bool InspectorStyle::setPropertyText(ErrorString* errorString, unsigned index, c
 
         // At least one property + the bogus property added just above should be present.
         if (propertyCount < 2) {
-            *errorString = "Invalid property value";
+            ec = SYNTAX_ERR;
             return false;
         }
 
         // Check for a proper propertyText termination (the parser could at least restore to the PROPERTY_NAME state).
         if (propertyData.at(propertyCount - 1).name != bogusPropertyName) {
-            *errorString = "Invalid property value";
+            ec = SYNTAX_ERR;
             return false;
         }
     }
 
     RefPtr<CSSRuleSourceData> sourceData = m_parentStyleSheet->ruleSourceDataFor(m_style.get());
     if (!sourceData) {
-        *errorString = "Internal error: no CSS rule source found";
+        ec = NOT_FOUND_ERR;
         return false;
     }
 
     String text;
     bool success = styleText(&text);
     if (!success) {
-        *errorString = "Internal error: could not fetch style text";
+        ec = NOT_FOUND_ERR;
         return false;
     }
 
@@ -337,31 +337,31 @@ bool InspectorStyle::setPropertyText(ErrorString* errorString, unsigned index, c
     return applyStyleText(editor.styleText());
 }
 
-bool InspectorStyle::toggleProperty(ErrorString* errorString, unsigned index, bool disable)
+bool InspectorStyle::toggleProperty(unsigned index, bool disable, ExceptionCode& ec)
 {
     ASSERT(m_parentStyleSheet);
     if (!m_parentStyleSheet->ensureParsedDataReady()) {
-        *errorString = "Can toggle only source-based properties";
+        ec = NO_MODIFICATION_ALLOWED_ERR;
         return false;
     }
 
     RefPtr<CSSRuleSourceData> sourceData = m_parentStyleSheet->ruleSourceDataFor(m_style.get());
     if (!sourceData) {
-        *errorString = "Internal error: No source data for the style found";
+        ec = NOT_FOUND_ERR;
         return false;
     }
 
     String text;
     bool success = styleText(&text);
     if (!success) {
-        *errorString = "Internal error: could not fetch style text";
+        ec = NOT_FOUND_ERR;
         return false;
     }
 
     Vector<InspectorStyleProperty> allProperties;
     populateAllProperties(&allProperties);
     if (index >= allProperties.size()) {
-        *errorString = "Property index is outside of property range";
+        ec = INDEX_SIZE_ERR;
         return false;
     }
 
@@ -653,9 +653,9 @@ NewLineAndWhitespace& InspectorStyle::newLineAndWhitespaceDelimiters() const
     return m_format;
 }
 
-PassRefPtr<InspectorStyleSheet> InspectorStyleSheet::create(const String& id, PassRefPtr<CSSStyleSheet> pageStyleSheet, const String& origin, const String& documentURL)
+PassRefPtr<InspectorStyleSheet> InspectorStyleSheet::create(const String& id, PassRefPtr<CSSStyleSheet> pageStyleSheet, const String& origin, const String& documentURL, Listener* listener)
 {
-    return adoptRef(new InspectorStyleSheet(id, pageStyleSheet, origin, documentURL));
+    return adoptRef(new InspectorStyleSheet(id, pageStyleSheet, origin, documentURL, listener));
 }
 
 // static
@@ -666,12 +666,13 @@ String InspectorStyleSheet::styleSheetURL(CSSStyleSheet* pageStyleSheet)
     return emptyString();
 }
 
-InspectorStyleSheet::InspectorStyleSheet(const String& id, PassRefPtr<CSSStyleSheet> pageStyleSheet, const String& origin, const String& documentURL)
+InspectorStyleSheet::InspectorStyleSheet(const String& id, PassRefPtr<CSSStyleSheet> pageStyleSheet, const String& origin, const String& documentURL, Listener* listener)
     : m_id(id)
     , m_pageStyleSheet(pageStyleSheet)
     , m_origin(origin)
     , m_documentURL(documentURL)
     , m_isRevalidating(false)
+    , m_listener(listener)
 {
     m_parsedStyleSheet = new ParsedStyleSheet();
 }
@@ -694,6 +695,7 @@ void InspectorStyleSheet::reparseStyleSheet(const String& text)
     m_pageStyleSheet->parseString(text, m_pageStyleSheet->useStrictParsing());
     m_pageStyleSheet->styleSheetChanged();
     m_inspectorStyles.clear();
+    fireStyleSheetChanged();
 }
 
 bool InspectorStyleSheet::setText(const String& text)
@@ -707,34 +709,52 @@ bool InspectorStyleSheet::setText(const String& text)
     return true;
 }
 
-bool InspectorStyleSheet::setRuleSelector(const InspectorCSSId& id, const String& selector)
+String InspectorStyleSheet::ruleSelector(const InspectorCSSId& id, ExceptionCode& ec)
 {
     CSSStyleRule* rule = ruleForId(id);
-    if (!rule)
+    if (!rule) {
+        ec = NOT_FOUND_ERR;
+        return "";
+    }
+    return rule->selectorText();
+}
+
+bool InspectorStyleSheet::setRuleSelector(const InspectorCSSId& id, const String& selector, ExceptionCode& ec)
+{
+    CSSStyleRule* rule = ruleForId(id);
+    if (!rule) {
+        ec = NOT_FOUND_ERR;
         return false;
+    }
     CSSStyleSheet* styleSheet = rule->parentStyleSheet();
-    if (!styleSheet || !ensureParsedDataReady())
+    if (!styleSheet || !ensureParsedDataReady()) {
+        ec = NOT_FOUND_ERR;
         return false;
+    }
 
     rule->setSelectorText(selector);
     RefPtr<CSSRuleSourceData> sourceData = ruleSourceDataFor(rule->style());
-    if (!sourceData)
+    if (!sourceData) {
+        ec = NOT_FOUND_ERR;
         return false;
+    }
 
     String sheetText = m_parsedStyleSheet->text();
     sheetText.replace(sourceData->selectorListRange.start, sourceData->selectorListRange.end - sourceData->selectorListRange.start, selector);
     m_parsedStyleSheet->setText(sheetText);
+    fireStyleSheetChanged();
     return true;
 }
 
-CSSStyleRule* InspectorStyleSheet::addRule(const String& selector)
+CSSStyleRule* InspectorStyleSheet::addRule(const String& selector, ExceptionCode& ec)
 {
     String styleSheetText;
     bool success = getText(&styleSheetText);
-    if (!success)
+    if (!success) {
+        ec = NOT_FOUND_ERR;
         return 0;
+    }
 
-    ExceptionCode ec = 0;
     m_pageStyleSheet->addRule(selector, "", ec);
     if (ec)
         return 0;
@@ -751,9 +771,41 @@ CSSStyleRule* InspectorStyleSheet::addRule(const String& selector)
     // Using setText() as this operation changes the style sheet rule set.
     setText(styleSheetText);
 
+    fireStyleSheetChanged();
+
     return rule;
 }
 
+bool InspectorStyleSheet::deleteRule(const InspectorCSSId& id, ExceptionCode& ec)
+{
+    RefPtr<CSSStyleRule> rule = ruleForId(id);
+    if (!rule) {
+        ec = NOT_FOUND_ERR;
+        return false;
+    }
+    CSSStyleSheet* styleSheet = rule->parentStyleSheet();
+    if (!styleSheet || !ensureParsedDataReady()) {
+        ec = NOT_FOUND_ERR;
+        return false;
+    }
+
+    styleSheet->deleteRule(id.ordinal(), ec);
+    if (ec)
+        return false;
+
+    RefPtr<CSSRuleSourceData> sourceData = ruleSourceDataFor(rule->style());
+    if (!sourceData) {
+        ec = NOT_FOUND_ERR;
+        return false;
+    }
+
+    String sheetText = m_parsedStyleSheet->text();
+    sheetText.remove(sourceData->selectorListRange.start, sourceData->styleSourceData->styleBodyRange.end - sourceData->selectorListRange.start + 1);
+    m_parsedStyleSheet->setText(sheetText);
+    fireStyleSheetChanged();
+    return true;
+}
+
 CSSStyleRule* InspectorStyleSheet::ruleForId(const InspectorCSSId& id) const
 {
     if (!m_pageStyleSheet)
@@ -868,31 +920,35 @@ PassRefPtr<InspectorObject> InspectorStyleSheet::buildObjectForStyle(CSSStyleDec
     return result.release();
 }
 
-bool InspectorStyleSheet::setPropertyText(ErrorString* errorString, const InspectorCSSId& id, unsigned propertyIndex, const String& text, bool overwrite, String* oldText)
+bool InspectorStyleSheet::setPropertyText(const InspectorCSSId& id, unsigned propertyIndex, const String& text, bool overwrite, String* oldText, ExceptionCode& ec)
 {
     RefPtr<InspectorStyle> inspectorStyle = inspectorStyleForId(id);
     if (!inspectorStyle) {
-        *errorString = "No style found for given id";
+        ec = NOT_FOUND_ERR;
         return false;
     }
 
-    return inspectorStyle->setPropertyText(errorString, propertyIndex, text, overwrite, oldText);
+    bool success = inspectorStyle->setPropertyText(propertyIndex, text, overwrite, oldText, ec);
+    if (success)
+        fireStyleSheetChanged();
+    return success;
 }
 
-bool InspectorStyleSheet::toggleProperty(ErrorString* errorString, const InspectorCSSId& id, unsigned propertyIndex, bool disable)
+bool InspectorStyleSheet::toggleProperty(const InspectorCSSId& id, unsigned propertyIndex, bool disable, ExceptionCode& ec)
 {
     RefPtr<InspectorStyle> inspectorStyle = inspectorStyleForId(id);
     if (!inspectorStyle) {
-        *errorString = "No style found for given id";
+        ec = NOT_FOUND_ERR;
         return false;
     }
 
-    bool success = inspectorStyle->toggleProperty(errorString, propertyIndex, disable);
+    bool success = inspectorStyle->toggleProperty(propertyIndex, disable, ec);
     if (success) {
         if (disable)
             rememberInspectorStyle(inspectorStyle);
         else if (!inspectorStyle->hasDisabledProperties())
             forgetInspectorStyle(inspectorStyle->cssStyle());
+        fireStyleSheetChanged();
     }
     return success;
 }
@@ -914,6 +970,12 @@ CSSStyleDeclaration* InspectorStyleSheet::styleForId(const InspectorCSSId& id) c
     return rule->style();
 }
 
+void InspectorStyleSheet::fireStyleSheetChanged()
+{
+    if (m_listener)
+        m_listener->styleSheetChanged(this);
+}
+
 PassRefPtr<InspectorStyle> InspectorStyleSheet::inspectorStyleForId(const InspectorCSSId& id)
 {
     CSSStyleDeclaration* style = styleForId(id);
@@ -1218,13 +1280,13 @@ void InspectorStyleSheet::collectFlatRules(PassRefPtr<CSSRuleList> ruleList, Vec
     }
 }
 
-PassRefPtr<InspectorStyleSheetForInlineStyle> InspectorStyleSheetForInlineStyle::create(const String& id, PassRefPtr<Element> element, const String& origin)
+PassRefPtr<InspectorStyleSheetForInlineStyle> InspectorStyleSheetForInlineStyle::create(const String& id, PassRefPtr<Element> element, const String& origin, Listener* listener)
 {
-    return adoptRef(new InspectorStyleSheetForInlineStyle(id, element, origin));
+    return adoptRef(new InspectorStyleSheetForInlineStyle(id, element, origin, listener));
 }
 
-InspectorStyleSheetForInlineStyle::InspectorStyleSheetForInlineStyle(const String& id, PassRefPtr<Element> element, const String& origin)
-    : InspectorStyleSheet(id, 0, origin, "")
+InspectorStyleSheetForInlineStyle::InspectorStyleSheetForInlineStyle(const String& id, PassRefPtr<Element> element, const String& origin, Listener* listener)
+    : InspectorStyleSheet(id, 0, origin, "", listener)
     , m_element(element)
     , m_ruleSourceData(0)
     , m_isStyleTextValid(false)
diff --git a/Source/WebCore/inspector/InspectorStyleSheet.h b/Source/WebCore/inspector/InspectorStyleSheet.h
index d627b1dda..aa293c2cd 100644
--- a/Source/WebCore/inspector/InspectorStyleSheet.h
+++ b/Source/WebCore/inspector/InspectorStyleSheet.h
@@ -26,6 +26,8 @@
 #define InspectorStyleSheet_h
 
 #include "CSSPropertySourceData.h"
+#include "CSSStyleDeclaration.h"
+#include "ExceptionCode.h"
 #include "InspectorStyleTextEditor.h"
 #include "InspectorValues.h"
 #include "PlatformString.h"
@@ -131,8 +133,8 @@ public:
     PassRefPtr<InspectorObject> buildObjectForStyle() const;
     PassRefPtr<InspectorArray> buildArrayForComputedStyle() const;
     bool hasDisabledProperties() const { return !m_disabledProperties.isEmpty(); }
-    bool setPropertyText(ErrorString*, unsigned index, const String& text, bool overwrite, String* oldText);
-    bool toggleProperty(ErrorString*, unsigned index, bool disable);
+    bool setPropertyText(unsigned index, const String& text, bool overwrite, String* oldText, ExceptionCode&);
+    bool toggleProperty(unsigned index, bool disable, ExceptionCode&);
 
 private:
     InspectorStyle(const InspectorCSSId& styleId, PassRefPtr<CSSStyleDeclaration> style, InspectorStyleSheet* parentStyleSheet);
@@ -156,8 +158,15 @@ private:
 
 class InspectorStyleSheet : public RefCounted<InspectorStyleSheet> {
 public:
+    class Listener {
+    public:
+        Listener() { }
+        virtual ~Listener() { }
+        virtual void styleSheetChanged(InspectorStyleSheet*) = 0;
+    };
+
     typedef HashMap<CSSStyleDeclaration*, RefPtr<InspectorStyle> > InspectorStyleMap;
-    static PassRefPtr<InspectorStyleSheet> create(const String& id, PassRefPtr<CSSStyleSheet> pageStyleSheet, const String& origin, const String& documentURL);
+    static PassRefPtr<InspectorStyleSheet> create(const String& id, PassRefPtr<CSSStyleSheet> pageStyleSheet, const String& origin, const String& documentURL, Listener*);
     static String styleSheetURL(CSSStyleSheet* pageStyleSheet);
 
     virtual ~InspectorStyleSheet();
@@ -167,21 +176,27 @@ public:
     CSSStyleSheet* pageStyleSheet() const { return m_pageStyleSheet.get(); }
     void reparseStyleSheet(const String&);
     bool setText(const String&);
-    bool setRuleSelector(const InspectorCSSId&, const String& selector);
-    CSSStyleRule* addRule(const String& selector);
+    String ruleSelector(const InspectorCSSId&, ExceptionCode&);
+    bool setRuleSelector(const InspectorCSSId&, const String& selector, ExceptionCode&);
+    CSSStyleRule* addRule(const String& selector, ExceptionCode&);
+    bool deleteRule(const InspectorCSSId&, ExceptionCode&);
     CSSStyleRule* ruleForId(const InspectorCSSId&) const;
     PassRefPtr<InspectorObject> buildObjectForStyleSheet();
     PassRefPtr<InspectorObject> buildObjectForStyleSheetInfo();
     PassRefPtr<InspectorObject> buildObjectForRule(CSSStyleRule*);
     PassRefPtr<InspectorObject> buildObjectForStyle(CSSStyleDeclaration*);
-    bool setPropertyText(ErrorString*, const InspectorCSSId&, unsigned propertyIndex, const String& text, bool overwrite, String* oldPropertyText);
-    bool toggleProperty(ErrorString*, const InspectorCSSId&, unsigned propertyIndex, bool disable);
+    bool setPropertyText(const InspectorCSSId&, unsigned propertyIndex, const String& text, bool overwrite, String* oldPropertyText, ExceptionCode&);
+    bool toggleProperty(const InspectorCSSId&, unsigned propertyIndex, bool disable, ExceptionCode&);
 
     virtual bool getText(String* result) const;
     virtual CSSStyleDeclaration* styleForId(const InspectorCSSId&) const;
+    void fireStyleSheetChanged();
+
+    InspectorCSSId ruleId(CSSStyleRule*) const;
+    InspectorCSSId styleId(CSSStyleDeclaration* style) const { return ruleOrStyleId(style); }
 
 protected:
-    InspectorStyleSheet(const String& id, PassRefPtr<CSSStyleSheet> pageStyleSheet, const String& origin, const String& documentURL);
+    InspectorStyleSheet(const String& id, PassRefPtr<CSSStyleSheet> pageStyleSheet, const String& origin, const String& documentURL, Listener*);
 
     bool canBind() const { return m_origin != "userAgent" && m_origin != "user"; }
     InspectorCSSId ruleOrStyleId(CSSStyleDeclaration* style) const;
@@ -197,14 +212,14 @@ protected:
     virtual bool setStyleText(CSSStyleDeclaration*, const String&);
 
 private:
+    friend class InspectorStyle;
+
     static void fixUnparsedPropertyRanges(CSSRuleSourceData* ruleData, const String& styleSheetText);
     static void collectFlatRules(PassRefPtr<CSSRuleList>, Vector<CSSStyleRule*>* result);
     bool ensureText() const;
     bool ensureSourceData();
     void ensureFlatRules() const;
     bool styleSheetTextWithChangedStyle(CSSStyleDeclaration*, const String& newStyleText, String* result);
-    InspectorCSSId ruleId(CSSStyleRule* rule) const;
-    InspectorCSSId styleId(CSSStyleDeclaration* style) const { return ruleOrStyleId(style); }
     void revalidateStyle(CSSStyleDeclaration*);
     bool originalStyleSheetText(String* result) const;
     bool resourceStyleSheetText(String* result) const;
@@ -219,20 +234,19 @@ private:
     ParsedStyleSheet* m_parsedStyleSheet;
     InspectorStyleMap m_inspectorStyles;
     mutable Vector<CSSStyleRule*> m_flatRules;
-
-    friend class InspectorStyle;
+    Listener* m_listener;
 };
 
 class InspectorStyleSheetForInlineStyle : public InspectorStyleSheet {
 public:
-    static PassRefPtr<InspectorStyleSheetForInlineStyle> create(const String& id, PassRefPtr<Element> element, const String& origin);
+    static PassRefPtr<InspectorStyleSheetForInlineStyle> create(const String& id, PassRefPtr<Element>, const String& origin, Listener*);
 
     void didModifyElementAttribute();
     virtual bool getText(String* result) const;
     virtual CSSStyleDeclaration* styleForId(const InspectorCSSId& id) const { ASSERT_UNUSED(id, !id.ordinal()); return inlineStyle(); }
 
 protected:
-    InspectorStyleSheetForInlineStyle(const String& id, PassRefPtr<Element> element, const String& origin);
+    InspectorStyleSheetForInlineStyle(const String& id, PassRefPtr<Element>, const String& origin, Listener*);
 
     virtual Document* ownerDocument() const;
     virtual RefPtr<CSSRuleSourceData> ruleSourceDataFor(CSSStyleDeclaration* style) const { ASSERT_UNUSED(style, style == inlineStyle()); return m_ruleSourceData; }
diff --git a/Source/WebCore/inspector/InspectorTimelineAgent.cpp b/Source/WebCore/inspector/InspectorTimelineAgent.cpp
index d23c1ea21..ed7d143d5 100644
--- a/Source/WebCore/inspector/InspectorTimelineAgent.cpp
+++ b/Source/WebCore/inspector/InspectorTimelineAgent.cpp
@@ -35,8 +35,8 @@
 
 #include "Event.h"
 #include "IdentifiersFactory.h"
+#include "InspectorCounters.h"
 #include "InspectorFrontend.h"
-#include "InspectorMemoryAgent.h"
 #include "InspectorState.h"
 #include "InstrumentingAgents.h"
 #include "IntRect.h"
@@ -85,9 +85,9 @@ static const char XHRLoad[] = "XHRLoad";
 static const char FunctionCall[] = "FunctionCall";
 static const char GCEvent[] = "GCEvent";
 
-static const char RegisterAnimationFrameCallback[] = "RegisterAnimationFrameCallback";
-static const char CancelAnimationFrameCallback[] = "CancelAnimationFrameCallback";
-static const char FireAnimationFrameEvent[] = "FireAnimationFrameEvent";
+static const char RequestAnimationFrame[] = "RequestAnimationFrame";
+static const char CancelAnimationFrame[] = "CancelAnimationFrame";
+static const char FireAnimationFrame[] = "FireAnimationFrame";
 }
 
 void InspectorTimelineAgent::pushGCEventRecords()
@@ -177,7 +177,6 @@ void InspectorTimelineAgent::willCallFunction(const String& scriptName, int scri
 
 void InspectorTimelineAgent::didCallFunction()
 {
-    collectDomCounters();
     didCompleteCurrentRecord(TimelineRecordType::FunctionCall);
 }
 
@@ -188,7 +187,6 @@ void InspectorTimelineAgent::willDispatchEvent(const Event& event)
 
 void InspectorTimelineAgent::didDispatchEvent()
 {
-    collectDomCounters();
     didCompleteCurrentRecord(TimelineRecordType::EventDispatch);
 }
 
@@ -232,7 +230,6 @@ void InspectorTimelineAgent::didWriteHTML(unsigned int endLine)
     if (!m_recordStack.isEmpty()) {
         TimelineRecordEntry entry = m_recordStack.last();
         entry.data->setNumber("endLine", endLine);
-        collectDomCounters();
         didCompleteCurrentRecord(TimelineRecordType::ParseHTML);
     }
 }
@@ -254,7 +251,6 @@ void InspectorTimelineAgent::willFireTimer(int timerId)
 
 void InspectorTimelineAgent::didFireTimer()
 {
-    collectDomCounters();
     didCompleteCurrentRecord(TimelineRecordType::TimerFire);
 }
 
@@ -285,7 +281,6 @@ void InspectorTimelineAgent::willEvaluateScript(const String& url, int lineNumbe
     
 void InspectorTimelineAgent::didEvaluateScript()
 {
-    collectDomCounters();
     didCompleteCurrentRecord(TimelineRecordType::EvaluateScript);
 }
 
@@ -352,24 +347,24 @@ void InspectorTimelineAgent::didCommitLoad()
     clearRecordStack();
 }
 
-void InspectorTimelineAgent::didRegisterAnimationFrameCallback(int callbackId)
+void InspectorTimelineAgent::didRequestAnimationFrame(int callbackId)
 {
-    appendRecord(TimelineRecordFactory::createAnimationFrameCallbackData(callbackId), TimelineRecordType::RegisterAnimationFrameCallback, true);
+    appendRecord(TimelineRecordFactory::createAnimationFrameData(callbackId), TimelineRecordType::RequestAnimationFrame, true);
 }
 
-void InspectorTimelineAgent::didCancelAnimationFrameCallback(int callbackId)
+void InspectorTimelineAgent::didCancelAnimationFrame(int callbackId)
 {
-    appendRecord(TimelineRecordFactory::createAnimationFrameCallbackData(callbackId), TimelineRecordType::CancelAnimationFrameCallback, true);
+    appendRecord(TimelineRecordFactory::createAnimationFrameData(callbackId), TimelineRecordType::CancelAnimationFrame, true);
 }
 
-void InspectorTimelineAgent::willFireAnimationFrameEvent(int callbackId)
+void InspectorTimelineAgent::willFireAnimationFrame(int callbackId)
 {
-    pushCurrentRecord(TimelineRecordFactory::createAnimationFrameCallbackData(callbackId), TimelineRecordType::FireAnimationFrameEvent, false);
+    pushCurrentRecord(TimelineRecordFactory::createAnimationFrameData(callbackId), TimelineRecordType::FireAnimationFrame, false);
 }
 
-void InspectorTimelineAgent::didFireAnimationFrameEvent()
+void InspectorTimelineAgent::didFireAnimationFrame()
 {
-    didCompleteCurrentRecord(TimelineRecordType::FireAnimationFrameEvent);
+    didCompleteCurrentRecord(TimelineRecordType::FireAnimationFrame);
 }
 
 void InspectorTimelineAgent::addRecordToTimeline(PassRefPtr<InspectorObject> prpRecord, const String& type)
@@ -394,22 +389,13 @@ void InspectorTimelineAgent::setHeapSizeStatistic(InspectorObject* record)
     record->setNumber("usedHeapSize", usedHeapSize);
     record->setNumber("totalHeapSize", totalHeapSize);
 
-}
-
-void InspectorTimelineAgent::collectDomCounters()
-{
-    if (!m_state->getBoolean(TimelineAgentState::includeMemoryDetails))
-        return;
-    if (m_recordStack.isEmpty())
-        return;
-
-    String error;
-    RefPtr<InspectorArray> domGroups;
-    RefPtr<InspectorObject> strings;
-    m_memoryAgent->getDOMNodeCount(&error, domGroups, strings);
-
-    if (domGroups)
-        m_recordStack.last().record->setArray("domGroups", domGroups.release());
+    if (m_state->getBoolean(TimelineAgentState::includeMemoryDetails)) {
+        RefPtr<InspectorObject> counters = InspectorObject::create();
+        counters->setNumber("nodes", InspectorCounters::counterValue(InspectorCounters::NodeCounter));
+        counters->setNumber("documents", InspectorCounters::counterValue(InspectorCounters::DocumentCounter));
+        counters->setNumber("jsEventListeners", InspectorCounters::counterValue(InspectorCounters::JSEventListenerCounter));
+        record->setObject("counters", counters.release());
+    }
 }
 
 void InspectorTimelineAgent::didCompleteCurrentRecord(const String& type)
@@ -428,12 +414,11 @@ void InspectorTimelineAgent::didCompleteCurrentRecord(const String& type)
     }
 }
 
-InspectorTimelineAgent::InspectorTimelineAgent(InstrumentingAgents* instrumentingAgents, InspectorState* state, InspectorMemoryAgent* memoryAgent)
+InspectorTimelineAgent::InspectorTimelineAgent(InstrumentingAgents* instrumentingAgents, InspectorState* state)
     : InspectorBaseAgent<InspectorTimelineAgent>("Timeline", instrumentingAgents, state)
     , m_frontend(0)
     , m_id(1)
     , m_maxCallStackDepth(5)
-    , m_memoryAgent(memoryAgent)
 {
 }
 
diff --git a/Source/WebCore/inspector/InspectorTimelineAgent.h b/Source/WebCore/inspector/InspectorTimelineAgent.h
index dc0b9e4f6..e8c34869a 100644
--- a/Source/WebCore/inspector/InspectorTimelineAgent.h
+++ b/Source/WebCore/inspector/InspectorTimelineAgent.h
@@ -45,7 +45,6 @@
 namespace WebCore {
 class Event;
 class InspectorFrontend;
-class InspectorMemoryAgent;
 class InspectorState;
 class InstrumentingAgents;
 class IntRect;
@@ -57,9 +56,9 @@ typedef String ErrorString;
 class InspectorTimelineAgent : public InspectorBaseAgent<InspectorTimelineAgent>, ScriptGCEventListener, public InspectorBackendDispatcher::TimelineCommandHandler {
     WTF_MAKE_NONCOPYABLE(InspectorTimelineAgent);
 public:
-    static PassOwnPtr<InspectorTimelineAgent> create(InstrumentingAgents* instrumentingAgents, InspectorState* state, InspectorMemoryAgent* memoryAgent)
+    static PassOwnPtr<InspectorTimelineAgent> create(InstrumentingAgents* instrumentingAgents, InspectorState* state)
     {
-        return adoptPtr(new InspectorTimelineAgent(instrumentingAgents, state, memoryAgent));
+        return adoptPtr(new InspectorTimelineAgent(instrumentingAgents, state));
     }
 
     ~InspectorTimelineAgent();
@@ -122,10 +121,10 @@ public:
     void willReceiveResourceData(unsigned long identifier);
     void didReceiveResourceData();
 
-    void didRegisterAnimationFrameCallback(int callbackId);
-    void didCancelAnimationFrameCallback(int callbackId);
-    void willFireAnimationFrameEvent(int callbackId);
-    void didFireAnimationFrameEvent();
+    void didRequestAnimationFrame(int callbackId);
+    void didCancelAnimationFrame(int callbackId);
+    void willFireAnimationFrame(int callbackId);
+    void didFireAnimationFrame();
 
     virtual void didGC(double, double, size_t);
 
@@ -141,11 +140,10 @@ private:
         String type;
     };
         
-    InspectorTimelineAgent(InstrumentingAgents*, InspectorState*, InspectorMemoryAgent*);
+    InspectorTimelineAgent(InstrumentingAgents*, InspectorState*);
 
     void pushCurrentRecord(PassRefPtr<InspectorObject>, const String& type, bool captureCallStack);
     void setHeapSizeStatistic(InspectorObject* record);
-    void collectDomCounters();
         
     void didCompleteCurrentRecord(const String& type);
     void appendRecord(PassRefPtr<InspectorObject> data, const String& type, bool captureCallStack);
@@ -172,7 +170,6 @@ private:
     typedef Vector<GCEvent> GCEvents;
     GCEvents m_gcEvents;
     int m_maxCallStackDepth;
-    InspectorMemoryAgent* m_memoryAgent;
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/inspector/NetworkResourcesData.cpp b/Source/WebCore/inspector/NetworkResourcesData.cpp
index 532dbaacf..bc519e670 100644
--- a/Source/WebCore/inspector/NetworkResourcesData.cpp
+++ b/Source/WebCore/inspector/NetworkResourcesData.cpp
@@ -29,7 +29,6 @@
 #include "config.h"
 #include "NetworkResourcesData.h"
 
-#include "DOMImplementation.h"
 #include "SharedBuffer.h"
 #include "TextResourceDecoder.h"
 
@@ -80,20 +79,6 @@ unsigned NetworkResourcesData::ResourceData::purgeContent()
     return result;
 }
 
-void NetworkResourcesData::ResourceData::createDecoder(const String& mimeType, const String& textEncodingName)
-{
-    if (!textEncodingName.isEmpty())
-        m_decoder = TextResourceDecoder::create("text/plain", textEncodingName);
-    else if (mimeType == "text/plain")
-        m_decoder = TextResourceDecoder::create("text/plain", "ISO-8859-1");
-    else if (mimeType == "text/html")
-        m_decoder = TextResourceDecoder::create("text/html", "UTF-8");
-    else if (DOMImplementation::isXMLMIMEType(mimeType)) {
-        m_decoder = TextResourceDecoder::create("application/xml");
-        m_decoder->useLenientXMLDecoding();
-    }
-}
-
 int NetworkResourcesData::ResourceData::dataLength() const
 {
     return m_dataBuffer ? m_dataBuffer->size() : 0;
@@ -113,6 +98,7 @@ int NetworkResourcesData::ResourceData::decodeDataToContent()
     ASSERT(!hasContent());
     int dataLength = m_dataBuffer->size();
     m_content = m_decoder->decode(m_dataBuffer->data(), m_dataBuffer->size());
+    m_content += m_decoder->flush();
     m_dataBuffer = nullptr;
     return 2 * m_content.length() - dataLength;
 }
@@ -143,7 +129,7 @@ void NetworkResourcesData::responseReceived(const String& requestId, const Strin
         return;
     resourceData->setFrameId(frameId);
     resourceData->setUrl(response.url());
-    resourceData->createDecoder(response.mimeType(), response.textEncodingName());
+    resourceData->setDecoder(InspectorPageAgent::createDecoder(response.mimeType(), response.textEncodingName()));
 }
 
 void NetworkResourcesData::setResourceType(const String& requestId, InspectorPageAgent::ResourceType type)
diff --git a/Source/WebCore/inspector/NetworkResourcesData.h b/Source/WebCore/inspector/NetworkResourcesData.h
index 2148685b7..8edd49997 100644
--- a/Source/WebCore/inspector/NetworkResourcesData.h
+++ b/Source/WebCore/inspector/NetworkResourcesData.h
@@ -31,6 +31,7 @@
 
 #include "CachedResourceHandle.h"
 #include "InspectorPageAgent.h"
+#include "TextResourceDecoder.h"
 
 #include <wtf/Deque.h>
 #include <wtf/HashMap.h>
@@ -75,8 +76,8 @@ public:
         String textEncodingName() const { return m_textEncodingName; }
         void setTextEncodingName(const String& textEncodingName) { m_textEncodingName = textEncodingName; }
 
-        TextResourceDecoder* decoder() const { return m_decoder.get(); }
-        void createDecoder(const String& mimeType, const String& textEncodingName);
+        PassRefPtr<TextResourceDecoder> decoder() const { return m_decoder; }
+        void setDecoder(PassRefPtr<TextResourceDecoder> decoder) { m_decoder = decoder; }
 
         PassRefPtr<SharedBuffer> buffer() const { return m_buffer; }
         void setBuffer(PassRefPtr<SharedBuffer> buffer) { m_buffer = buffer; }
diff --git a/Source/WebCore/inspector/PageConsoleAgent.cpp b/Source/WebCore/inspector/PageConsoleAgent.cpp
index eee4bfabf..fcd1f3d0b 100644
--- a/Source/WebCore/inspector/PageConsoleAgent.cpp
+++ b/Source/WebCore/inspector/PageConsoleAgent.cpp
@@ -39,6 +39,8 @@
 #include "InjectedScriptManager.h"
 #include "InspectorAgent.h"
 #include "InspectorDOMAgent.h"
+#include "Node.h"
+#include "ScriptObject.h"
 
 namespace WebCore {
 
@@ -61,12 +63,25 @@ void PageConsoleAgent::clearMessages(ErrorString* errorString)
     InspectorConsoleAgent::clearMessages(errorString);
 }
 
-void PageConsoleAgent::addInspectedNode(ErrorString*, int nodeId)
+class InspectableNode : public InjectedScriptHost::InspectableObject {
+public:
+    explicit InspectableNode(Node* node) : m_node(node) { }
+    virtual ScriptValue get(ScriptState* state)
+    {
+        return InjectedScriptHost::nodeAsScriptValue(state, m_node);
+    }
+private:
+    Node* m_node;
+};
+
+void PageConsoleAgent::addInspectedNode(ErrorString* errorString, int nodeId)
 {
     Node* node = m_inspectorDOMAgent->nodeForId(nodeId);
-    if (!node)
+    if (!node) {
+        *errorString = "nodeId is not valid";
         return;
-    m_injectedScriptManager->injectedScriptHost()->addInspectedNode(node);
+    }
+    m_injectedScriptManager->injectedScriptHost()->addInspectedObject(adoptPtr(new InspectableNode(node)));
 }
 
 bool PageConsoleAgent::developerExtrasEnabled()
@@ -74,7 +89,6 @@ bool PageConsoleAgent::developerExtrasEnabled()
     return m_inspectorAgent->developerExtrasEnabled();
 }
 
-
 } // namespace WebCore
 
 #endif // ENABLE(INSPECTOR)
diff --git a/Source/WebCore/inspector/ScriptProfile.idl b/Source/WebCore/inspector/ScriptProfile.idl
index 00b62a313..ebbee2e8e 100644
--- a/Source/WebCore/inspector/ScriptProfile.idl
+++ b/Source/WebCore/inspector/ScriptProfile.idl
@@ -28,7 +28,8 @@ module core {
 
     interface [
         Conditional=JAVASCRIPT_DEBUGGER,
-        OmitConstructor
+        OmitConstructor,
+        V8CustomToJSObject
     ] ScriptProfile {
         readonly attribute DOMString title;
         readonly attribute unsigned long uid;
diff --git a/Source/WebCore/inspector/ScriptProfileNode.idl b/Source/WebCore/inspector/ScriptProfileNode.idl
index 93908b5f6..008d3b3b3 100644
--- a/Source/WebCore/inspector/ScriptProfileNode.idl
+++ b/Source/WebCore/inspector/ScriptProfileNode.idl
@@ -28,7 +28,8 @@ module core {
 
     interface [
         Conditional=JAVASCRIPT_DEBUGGER,
-        OmitConstructor
+        OmitConstructor,
+        V8CustomToJSObject
     ] ScriptProfileNode {
         readonly attribute DOMString functionName;
         readonly attribute DOMString url;
diff --git a/Source/WebCore/inspector/TimelineRecordFactory.cpp b/Source/WebCore/inspector/TimelineRecordFactory.cpp
index 1ac171caf..df54529a0 100644
--- a/Source/WebCore/inspector/TimelineRecordFactory.cpp
+++ b/Source/WebCore/inspector/TimelineRecordFactory.cpp
@@ -185,7 +185,7 @@ PassRefPtr<InspectorObject> TimelineRecordFactory::createParseHTMLData(unsigned
     return data.release();
 }
 
-PassRefPtr<InspectorObject> TimelineRecordFactory::createAnimationFrameCallbackData(int callbackId)
+PassRefPtr<InspectorObject> TimelineRecordFactory::createAnimationFrameData(int callbackId)
 {
     RefPtr<InspectorObject> data = InspectorObject::create();
     data->setNumber("id", callbackId);
diff --git a/Source/WebCore/inspector/TimelineRecordFactory.h b/Source/WebCore/inspector/TimelineRecordFactory.h
index ed6080b4f..5d3e5aeba 100644
--- a/Source/WebCore/inspector/TimelineRecordFactory.h
+++ b/Source/WebCore/inspector/TimelineRecordFactory.h
@@ -79,7 +79,7 @@ namespace WebCore {
 
         static PassRefPtr<InspectorObject> createParseHTMLData(unsigned int length, unsigned int startLine);
 
-        static PassRefPtr<InspectorObject> createAnimationFrameCallbackData(int callbackId);
+        static PassRefPtr<InspectorObject> createAnimationFrameData(int callbackId);
 
     private:
         TimelineRecordFactory() { }
diff --git a/Source/WebCore/inspector/WorkerDebuggerAgent.cpp b/Source/WebCore/inspector/WorkerDebuggerAgent.cpp
index 31fdf49bf..e4fbf016a 100644
--- a/Source/WebCore/inspector/WorkerDebuggerAgent.cpp
+++ b/Source/WebCore/inspector/WorkerDebuggerAgent.cpp
@@ -34,9 +34,49 @@
 #if ENABLE(JAVASCRIPT_DEBUGGER) && ENABLE(INSPECTOR) && ENABLE(WORKERS)
 #include "ScriptDebugServer.h"
 #include "WorkerContext.h"
+#include "WorkerThread.h"
+#include <wtf/MessageQueue.h>
 
 namespace WebCore {
 
+namespace {
+
+Mutex& workerDebuggerAgentsMutex()
+{
+    AtomicallyInitializedStatic(Mutex&, mutex = *new Mutex);
+    return mutex;
+}
+
+typedef HashMap<WorkerThread*, WorkerDebuggerAgent*> WorkerDebuggerAgents;
+
+WorkerDebuggerAgents& workerDebuggerAgents()
+{
+    DEFINE_STATIC_LOCAL(WorkerDebuggerAgents, agents, ());
+    return agents;
+}
+
+
+class RunInspectorCommandsTask : public ScriptDebugServer::Task {
+public:
+    RunInspectorCommandsTask(WorkerThread* thread, WorkerContext* workerContext)
+        : m_thread(thread)
+        , m_workerContext(workerContext) { }
+    virtual ~RunInspectorCommandsTask() { }
+    virtual void run()
+    {
+        // Process all queued debugger commands. It is safe to use m_workerContext here
+        // because it is alive if RunWorkerLoop is not terminated, otherwise it will
+        // just be ignored.
+        while (MessageQueueMessageReceived == m_thread->runLoop().runInMode(m_workerContext, WorkerDebuggerAgent::debuggerTaskMode, WorkerRunLoop::DontWaitForMessage)) { }
+    }
+
+private:
+    RefPtr<WorkerThread> m_thread;
+    WorkerContext* m_workerContext;
+};
+
+} // namespace
+
 const char* WorkerDebuggerAgent::debuggerTaskMode = "debugger";
 
 PassOwnPtr<WorkerDebuggerAgent> WorkerDebuggerAgent::create(InstrumentingAgents* instrumentingAgents, InspectorState* inspectorState, WorkerContext* inspectedWorkerContext, InjectedScriptManager* injectedScriptManager)
@@ -46,22 +86,36 @@ PassOwnPtr<WorkerDebuggerAgent> WorkerDebuggerAgent::create(InstrumentingAgents*
 
 WorkerDebuggerAgent::WorkerDebuggerAgent(InstrumentingAgents* instrumentingAgents, InspectorState* inspectorState, WorkerContext* inspectedWorkerContext, InjectedScriptManager* injectedScriptManager)
     : InspectorDebuggerAgent(instrumentingAgents, inspectorState, injectedScriptManager)
+    , m_scriptDebugServer(inspectedWorkerContext)
     , m_inspectedWorkerContext(inspectedWorkerContext)
 {
+    MutexLocker lock(workerDebuggerAgentsMutex());
+    workerDebuggerAgents().set(inspectedWorkerContext->thread(), this);
 }
 
 WorkerDebuggerAgent::~WorkerDebuggerAgent()
 {
+    MutexLocker lock(workerDebuggerAgentsMutex());
+    ASSERT(workerDebuggerAgents().contains(m_inspectedWorkerContext->thread()));
+    workerDebuggerAgents().remove(m_inspectedWorkerContext->thread());
+}
+
+void WorkerDebuggerAgent::interruptAndDispatchInspectorCommands(WorkerThread* thread)
+{
+    MutexLocker lock(workerDebuggerAgentsMutex());
+    WorkerDebuggerAgent* agent = workerDebuggerAgents().get(thread);
+    if (agent)
+        agent->m_scriptDebugServer.interruptAndRunTask(adoptPtr(new RunInspectorCommandsTask(thread, agent->m_inspectedWorkerContext)));
 }
 
 void WorkerDebuggerAgent::startListeningScriptDebugServer()
 {
-    scriptDebugServer().addListener(this, m_inspectedWorkerContext);
+    scriptDebugServer().addListener(this);
 }
 
 void WorkerDebuggerAgent::stopListeningScriptDebugServer()
 {
-    scriptDebugServer().removeListener(this, m_inspectedWorkerContext);
+    scriptDebugServer().removeListener(this);
 }
 
 WorkerScriptDebugServer& WorkerDebuggerAgent::scriptDebugServer()
diff --git a/Source/WebCore/inspector/WorkerDebuggerAgent.h b/Source/WebCore/inspector/WorkerDebuggerAgent.h
index 9e25867e6..8017ac038 100644
--- a/Source/WebCore/inspector/WorkerDebuggerAgent.h
+++ b/Source/WebCore/inspector/WorkerDebuggerAgent.h
@@ -38,6 +38,7 @@
 namespace WebCore {
 
 class WorkerContext;
+class WorkerThread;
 
 class WorkerDebuggerAgent : public InspectorDebuggerAgent {
     WTF_MAKE_NONCOPYABLE(WorkerDebuggerAgent);
@@ -47,6 +48,7 @@ public:
     virtual ~WorkerDebuggerAgent();
 
     static const char* debuggerTaskMode;
+    static void interruptAndDispatchInspectorCommands(WorkerThread*);
 
 private:
     WorkerDebuggerAgent(InstrumentingAgents*, InspectorState*, WorkerContext*, InjectedScriptManager*);
diff --git a/Source/WebCore/inspector/compile-front-end.sh b/Source/WebCore/inspector/compile-front-end.sh
index 8d45ff94d..17ed1039d 100755
--- a/Source/WebCore/inspector/compile-front-end.sh
+++ b/Source/WebCore/inspector/compile-front-end.sh
@@ -76,7 +76,7 @@ java -jar ~/closure/compiler.jar --summary_detail_level 3 --compilation_level SI
         --js Source/WebCore/inspector/front-end/ResourceUtils.js \
         --js Source/WebCore/inspector/front-end/NetworkManager.js \
         --js Source/WebCore/inspector/front-end/UISourceCode.js \
-    --module jsmodule_ui:34:jsmodule_common \
+    --module jsmodule_ui:36:jsmodule_common \
         --js Source/WebCore/inspector/front-end/AdvancedSearchController.js \
         --js Source/WebCore/inspector/front-end/Checkbox.js \
         --js Source/WebCore/inspector/front-end/ContextMenu.js \
@@ -99,8 +99,10 @@ java -jar ~/closure/compiler.jar --summary_detail_level 3 --compilation_level SI
         --js Source/WebCore/inspector/front-end/SidebarTreeElement.js \
         --js Source/WebCore/inspector/front-end/ShortcutsScreen.js \
         --js Source/WebCore/inspector/front-end/ShowMoreDataGridNode.js \
+        --js Source/WebCore/inspector/front-end/SidebarOverlay.js \
         --js Source/WebCore/inspector/front-end/SoftContextMenu.js \
         --js Source/WebCore/inspector/front-end/SourceTokenizer.js \
+        --js Source/WebCore/inspector/front-end/Spectrum.js \
         --js Source/WebCore/inspector/front-end/SplitView.js \
         --js Source/WebCore/inspector/front-end/StatusBarButton.js \
         --js Source/WebCore/inspector/front-end/TabbedPane.js \
@@ -145,12 +147,13 @@ java -jar ~/closure/compiler.jar --summary_detail_level 3 --compilation_level SI
         --js Source/WebCore/inspector/front-end/ResourceTimingView.js \
         --js Source/WebCore/inspector/front-end/ResourceView.js \
         --js Source/WebCore/inspector/front-end/NetworkPanel.js \
-    --module jsmodule_resources:6:jsmodule_components \
+    --module jsmodule_resources:7:jsmodule_components \
         --js Source/WebCore/inspector/front-end/ApplicationCacheItemsView.js \
         --js Source/WebCore/inspector/front-end/CookieItemsView.js \
         --js Source/WebCore/inspector/front-end/DatabaseQueryView.js \
         --js Source/WebCore/inspector/front-end/DatabaseTableView.js \
         --js Source/WebCore/inspector/front-end/DOMStorageItemsView.js \
+        --js Source/WebCore/inspector/front-end/IndexedDBViews.js \
         --js Source/WebCore/inspector/front-end/ResourcesPanel.js \
     --module jsmodule_scripts:10:jsmodule_components \
         --js Source/WebCore/inspector/front-end/CallStackSidebarPane.js \
diff --git a/Source/WebCore/inspector/front-end/AuditCategories.js b/Source/WebCore/inspector/front-end/AuditCategories.js
index ac9e51835..b32b418d0 100644
--- a/Source/WebCore/inspector/front-end/AuditCategories.js
+++ b/Source/WebCore/inspector/front-end/AuditCategories.js
@@ -44,6 +44,7 @@ WebInspector.AuditCategories.PagePerformance.prototype = {
         this.addRule(new WebInspector.AuditRules.UnusedCssRule(), WebInspector.AuditRule.Severity.Warning);
         this.addRule(new WebInspector.AuditRules.CssInHeadRule(), WebInspector.AuditRule.Severity.Severe);
         this.addRule(new WebInspector.AuditRules.StylesScriptsOrderRule(), WebInspector.AuditRule.Severity.Severe);
+        this.addRule(new WebInspector.AuditRules.VendorPrefixedCSSProperties(), WebInspector.AuditRule.Severity.Warning);
     }
 }
 
diff --git a/Source/WebCore/inspector/front-end/AuditRules.js b/Source/WebCore/inspector/front-end/AuditRules.js
index 8430ffa1e..1a0dd9839 100644
--- a/Source/WebCore/inspector/front-end/AuditRules.js
+++ b/Source/WebCore/inspector/front-end/AuditRules.js
@@ -974,6 +974,167 @@ WebInspector.AuditRules.StylesScriptsOrderRule.prototype.__proto__ = WebInspecto
  * @constructor
  * @extends {WebInspector.AuditRule}
  */
+WebInspector.AuditRules.CSSRuleBase = function(id, name)
+{
+    WebInspector.AuditRule.call(this, id, name);
+}
+
+WebInspector.AuditRules.CSSRuleBase.prototype = {
+    doRun: function(resources, result, callback, progressMonitor)
+    {
+        CSSAgent.getAllStyleSheets(sheetsCallback.bind(this));
+
+        function sheetsCallback(error, headers)
+        {
+            if (error)
+                return callback(null);
+
+            for (var i = 0; i < headers.length; ++i) {
+                var header = headers[i];
+                if (header.disabled)
+                    continue; // Do not check disabled stylesheets.
+
+                this._visitStyleSheet(header.styleSheetId, i === headers.length - 1 ? finishedCallback : null, result, progressMonitor);
+            }
+        }
+
+        function finishedCallback()
+        {
+            callback(result);
+        }
+    },
+
+    _visitStyleSheet: function(styleSheetId, callback, result, progressMonitor)
+    {
+        WebInspector.CSSStyleSheet.createForId(styleSheetId, sheetCallback.bind(this));
+
+        function sheetCallback(styleSheet)
+        {
+            if (progressMonitor.canceled)
+                return;
+
+            if (!styleSheet) {
+                if (callback)
+                    callback();
+                return;
+            }
+
+            this.visitStyleSheet(styleSheet, result);
+
+            for (var i = 0; i < styleSheet.rules.length; ++i)
+                this._visitRule(styleSheet, styleSheet.rules[i], result);
+
+            this.didVisitStyleSheet(styleSheet, result);
+
+            if (callback)
+                callback();
+        }
+    },
+
+    _visitRule: function(styleSheet, rule, result)
+    {
+        this.visitRule(styleSheet, rule, result);
+        var allProperties = rule.style.allProperties;
+        for (var i = 0; i < allProperties.length; ++i)
+            this.visitProperty(styleSheet, allProperties[i], result);
+        this.didVisitRule(styleSheet, rule, result);
+    },
+
+    visitStyleSheet: function(styleSheet, result)
+    {
+        // Subclasses can implement.
+    },
+
+    didVisitStyleSheet: function(styleSheet, result)
+    {
+        // Subclasses can implement.
+    },
+    
+    visitRule: function(styleSheet, rule, result)
+    {
+        // Subclasses can implement.
+    },
+
+    didVisitRule: function(styleSheet, rule, result)
+    {
+        // Subclasses can implement.
+    },
+    
+    visitProperty: function(styleSheet, property, result)
+    {
+        // Subclasses can implement.
+    }
+}
+
+WebInspector.AuditRules.CSSRuleBase.prototype.__proto__ = WebInspector.AuditRule.prototype;
+
+/**
+ * @constructor
+ * @extends {WebInspector.AuditRules.CSSRuleBase}
+ */
+WebInspector.AuditRules.VendorPrefixedCSSProperties = function()
+{
+    WebInspector.AuditRules.CSSRuleBase.call(this, "page-vendorprefixedcss", "Use normal CSS property names instead of vendor-prefixed ones");
+    this._webkitPrefix = "-webkit-";
+}
+
+WebInspector.AuditRules.VendorPrefixedCSSProperties.supportedProperties = [
+    "background-clip", "background-origin", "background-size",
+    "border-radius", "border-bottom-left-radius", "border-bottom-right-radius", "border-top-left-radius", "border-top-right-radius",
+    "box-shadow", "box-sizing", "opacity", "text-shadow"
+].keySet();
+
+WebInspector.AuditRules.VendorPrefixedCSSProperties.prototype = {
+    didVisitStyleSheet: function(styleSheet)
+    {
+        delete this._styleSheetResult;
+    },
+
+    visitRule: function(rule)
+    {
+        this._mentionedProperties = {};
+    },
+
+    didVisitRule: function()
+    {
+        delete this._ruleResult;
+        delete this._mentionedProperties;
+    },
+
+    visitProperty: function(styleSheet, property, result)
+    {
+        if (property.name.indexOf(this._webkitPrefix) !== 0)
+            return;
+
+        var normalPropertyName = property.name.substring(this._webkitPrefix.length).toLowerCase(); // Start just after the "-webkit-" prefix.
+        if (WebInspector.AuditRules.VendorPrefixedCSSProperties.supportedProperties[normalPropertyName] && !this._mentionedProperties[normalPropertyName]) {
+            var style = property.ownerStyle;
+            var liveProperty = style.getLiveProperty(normalPropertyName);
+            if (liveProperty && !liveProperty.styleBased)
+                return; // WebCore can provide normal versions of prefixed properties automatically, so be careful to skip only normal source-based properties.
+
+            var rule = style.parentRule;
+            this._mentionedProperties[normalPropertyName] = true;
+            if (!this._styleSheetResult)
+                this._styleSheetResult = result.addChild(rule.sourceURL ? WebInspector.linkifyResourceAsNode(rule.sourceURL) : "<unknown>");
+            if (!this._ruleResult) {
+                var anchor = WebInspector.linkifyURLAsNode(rule.sourceURL, rule.selectorText);
+                anchor.preferredPanel = "resources";
+                anchor.lineNumber = rule.sourceLine;
+                this._ruleResult = this._styleSheetResult.addChild(anchor);
+            }
+            ++result.violationCount;
+            this._ruleResult.addSnippet(String.sprintf("\"" + this._webkitPrefix + "%s\" is used, but \"%s\" is supported.", normalPropertyName, normalPropertyName));
+        }
+    }
+}
+
+WebInspector.AuditRules.VendorPrefixedCSSProperties.prototype.__proto__ = WebInspector.AuditRules.CSSRuleBase.prototype;
+
+/**
+ * @constructor
+ * @extends {WebInspector.AuditRule}
+ */
 WebInspector.AuditRules.CookieRuleBase = function(id, name)
 {
     WebInspector.AuditRule.call(this, id, name);
diff --git a/Source/WebCore/inspector/front-end/BreakpointsSidebarPane.js b/Source/WebCore/inspector/front-end/BreakpointsSidebarPane.js
index 3bcf8f5cc..af489e64f 100644
--- a/Source/WebCore/inspector/front-end/BreakpointsSidebarPane.js
+++ b/Source/WebCore/inspector/front-end/BreakpointsSidebarPane.js
@@ -461,16 +461,17 @@ WebInspector.EventListenerBreakpointsSidebarPane = function()
     this.bodyElement.appendChild(this.categoriesElement);
 
     this._breakpointItems = {};
-    this._createCategory(WebInspector.UIString("Keyboard"), true, ["keydown", "keyup", "keypress", "textInput"]);
-    this._createCategory(WebInspector.UIString("Mouse"), true, ["click", "dblclick", "mousedown", "mouseup", "mouseover", "mousemove", "mouseout", "mousewheel"]);
     // FIXME: uncomment following once inspector stops being drop targer in major ports.
     // Otherwise, inspector page reacts on drop event and tries to load the event data.
     // this._createCategory(WebInspector.UIString("Drag"), true, ["drag", "drop", "dragstart", "dragend", "dragenter", "dragleave", "dragover"]);
+    this._createCategory(WebInspector.UIString("Animation"), false, ["requestAnimationFrame", "cancelAnimationFrame", "animationFrameFired"]);
     this._createCategory(WebInspector.UIString("Control"), true, ["resize", "scroll", "zoom", "focus", "blur", "select", "change", "submit", "reset"]);
     this._createCategory(WebInspector.UIString("Clipboard"), true, ["copy", "cut", "paste", "beforecopy", "beforecut", "beforepaste"]);
-    this._createCategory(WebInspector.UIString("Load"), true, ["load", "unload", "abort", "error"]);
     this._createCategory(WebInspector.UIString("DOM Mutation"), true, ["DOMActivate", "DOMFocusIn", "DOMFocusOut", "DOMAttrModified", "DOMCharacterDataModified", "DOMNodeInserted", "DOMNodeInsertedIntoDocument", "DOMNodeRemoved", "DOMNodeRemovedFromDocument", "DOMSubtreeModified", "DOMContentLoaded"]);
     this._createCategory(WebInspector.UIString("Device"), true, ["deviceorientation", "devicemotion"]);
+    this._createCategory(WebInspector.UIString("Keyboard"), true, ["keydown", "keyup", "keypress", "textInput"]);
+    this._createCategory(WebInspector.UIString("Load"), true, ["load", "unload", "abort", "error"]);
+    this._createCategory(WebInspector.UIString("Mouse"), true, ["click", "dblclick", "mousedown", "mouseup", "mouseover", "mousemove", "mouseout", "mousewheel"]);
     this._createCategory(WebInspector.UIString("Timer"), false, ["setTimer", "clearTimer", "timerFired"]);
     this._createCategory(WebInspector.UIString("Touch"), true, ["touchstart", "touchmove", "touchend", "touchcancel"]);
 
@@ -486,7 +487,10 @@ WebInspector.EventListenerBreakpointsSidebarPane.eventNameForUI = function(event
         WebInspector.EventListenerBreakpointsSidebarPane._eventNamesForUI = {
             "instrumentation:setTimer": WebInspector.UIString("Set Timer"),
             "instrumentation:clearTimer": WebInspector.UIString("Clear Timer"),
-            "instrumentation:timerFired": WebInspector.UIString("Timer Fired")
+            "instrumentation:timerFired": WebInspector.UIString("Timer Fired"),
+            "instrumentation:requestAnimationFrame": WebInspector.UIString("Request Animation Frame"),
+            "instrumentation:cancelAnimationFrame": WebInspector.UIString("Cancel Animation Frame"),
+            "instrumentation:animationFrameFired": WebInspector.UIString("Animation Frame Fired")
         };
     }
     return WebInspector.EventListenerBreakpointsSidebarPane._eventNamesForUI[eventName] || eventName.substring(eventName.indexOf(":") + 1);
diff --git a/Source/WebCore/inspector/front-end/CSSKeywordCompletions.js b/Source/WebCore/inspector/front-end/CSSKeywordCompletions.js
index 52ab70e87..b2b934d8d 100644
--- a/Source/WebCore/inspector/front-end/CSSKeywordCompletions.js
+++ b/Source/WebCore/inspector/front-end/CSSKeywordCompletions.js
@@ -86,9 +86,9 @@ WebInspector.CSSKeywordCompletions._colors = [
 
 WebInspector.CSSKeywordCompletions._colorAwareProperties = [
     "background", "background-color", "background-image", "border", "border-color", "border-top", "border-right", "border-bottom",
-    "border-left", "border-top-color", "border-right-color", "border-bottom-color", "border-left-color", "color",
+    "border-left", "border-top-color", "border-right-color", "border-bottom-color", "border-left-color", "box-shadow", "color",
     "outline", "outline-color", "text-line-through", "text-line-through-color", "text-overline", "text-overline-color",
-    "text-shadow", "text-underline", "text-underline-color", "-webkit-text-emphasis", "-webkit-text-emphasis-color"
+    "text-shadow", "text-underline", "text-underline-color", "-webkit-box-shadow", "-webkit-text-emphasis", "-webkit-text-emphasis-color"
 ].keySet();
 
 WebInspector.CSSKeywordCompletions._propertyKeywordMap = {
diff --git a/Source/WebCore/inspector/front-end/CSSStyleModel.js b/Source/WebCore/inspector/front-end/CSSStyleModel.js
index 50686bac4..ecdbfd308 100644
--- a/Source/WebCore/inspector/front-end/CSSStyleModel.js
+++ b/Source/WebCore/inspector/front-end/CSSStyleModel.js
@@ -34,6 +34,9 @@
  */
 WebInspector.CSSStyleModel = function()
 {
+    this._pendingCommandsMajorState = [];
+    WebInspector.domAgent.addEventListener(WebInspector.DOMAgent.Events.UndoRedoRequested, this._undoRedoRequested, this);
+    WebInspector.domAgent.addEventListener(WebInspector.DOMAgent.Events.UndoRedoCompleted, this._undoRedoCompleted, this);
     new WebInspector.CSSStyleModelResourceBinding(this);
     InspectorBackend.registerCSSDispatcher(new WebInspector.CSSDispatcher(this));
     CSSAgent.enable();
@@ -172,7 +175,6 @@ WebInspector.CSSStyleModel.prototype = {
             var doesAffectSelectedNode = (selectedNodeIds.indexOf(nodeId) >= 0);
             var rule = WebInspector.CSSRule.parsePayload(rulePayload);
             successCallback(rule, doesAffectSelectedNode);
-            this._fireStyleSheetChanged(rule.id.styleSheetId, true);
         }
 
         /**
@@ -185,9 +187,11 @@ WebInspector.CSSStyleModel.prototype = {
          */
         function callback(nodeId, successCallback, failureCallback, newSelector, error, rulePayload)
         {
+            this._pendingCommandsMajorState.pop();
             if (error)
                 failureCallback();
             else {
+                WebInspector.domAgent.markUndoableState();
                 var ownerDocumentId = this._ownerDocumentId(nodeId);
                 if (ownerDocumentId)
                     WebInspector.domAgent.querySelectorAll(ownerDocumentId, newSelector, checkAffectsCallback.bind(this, nodeId, successCallback, rulePayload));
@@ -196,6 +200,7 @@ WebInspector.CSSStyleModel.prototype = {
             }
         }
 
+        this._pendingCommandsMajorState.push(true);
         CSSAgent.setRuleSelector(ruleId, newSelector, callback.bind(this, nodeId, successCallback, failureCallback, newSelector));
     },
 
@@ -215,7 +220,6 @@ WebInspector.CSSStyleModel.prototype = {
             var doesAffectSelectedNode = (selectedNodeIds.indexOf(nodeId) >= 0);
             var rule = WebInspector.CSSRule.parsePayload(rulePayload);
             successCallback(rule, doesAffectSelectedNode);
-            this._fireStyleSheetChanged(rule.id.styleSheetId, true);
         }
 
         /**
@@ -227,10 +231,12 @@ WebInspector.CSSStyleModel.prototype = {
          */
         function callback(successCallback, failureCallback, selector, error, rulePayload)
         {
+            this._pendingCommandsMajorState.pop();
             if (error) {
                 // Invalid syntax for a selector
                 failureCallback();
             } else {
+                WebInspector.domAgent.markUndoableState();
                 var ownerDocumentId = this._ownerDocumentId(nodeId);
                 if (ownerDocumentId)
                     WebInspector.domAgent.querySelectorAll(ownerDocumentId, selector, checkAffectsCallback.bind(this, nodeId, successCallback, rulePayload));
@@ -239,6 +245,7 @@ WebInspector.CSSStyleModel.prototype = {
             }
         }
 
+        this._pendingCommandsMajorState.push(true);
         CSSAgent.addRule(nodeId, selector, callback.bind(this, successCallback, failureCallback, selector));
     },
 
@@ -255,36 +262,48 @@ WebInspector.CSSStyleModel.prototype = {
         return node.ownerDocument ? node.ownerDocument.id : null;
     },
 
-    /**
-     * @param {function()=} callback
-     */
-    _fireStyleSheetChanged: function(styleSheetId, majorChange, callback)
+    _fireStyleSheetChanged: function(styleSheetId)
     {
-        callback = callback || function() {};
+        if (!this._pendingCommandsMajorState.length)
+            return;
 
-        if (!majorChange || !styleSheetId || !this.hasEventListeners(WebInspector.CSSStyleModel.Events.StyleSheetChanged)) {
-            callback();
+        var majorChange = this._pendingCommandsMajorState[this._pendingCommandsMajorState.length - 1];
+        
+        if (!majorChange || !styleSheetId || !this.hasEventListeners(WebInspector.CSSStyleModel.Events.StyleSheetChanged))
             return;
-        }
 
-        function mycallback(error, content)
+        function callback(error, content)
         {
             if (!error)
                 this.dispatchEventToListeners(WebInspector.CSSStyleModel.Events.StyleSheetChanged, { styleSheetId: styleSheetId, content: content, majorChange: majorChange });
-            callback();
         }
 
-        CSSAgent.getStyleSheetText(styleSheetId, mycallback.bind(this));
+        CSSAgent.getStyleSheetText(styleSheetId, callback.bind(this));
     },
 
     setStyleSheetText: function(styleSheetId, newText, majorChange, userCallback)
     {
         function callback(error)
         {
-             if (!error)
-                 this._fireStyleSheetChanged(styleSheetId, majorChange, userCallback ? userCallback.bind(this, error) : null);
+            this._pendingCommandsMajorState.pop();
+            if (!error && majorChange)
+                WebInspector.domAgent.markUndoableState();
+            
+            if (!error && userCallback)
+                userCallback(error);
         }
+        this._pendingCommandsMajorState.push(majorChange);
         CSSAgent.setStyleSheetText(styleSheetId, newText, callback.bind(this));
+    },
+
+    _undoRedoRequested: function()
+    {
+        this._pendingCommandsMajorState.push(true);
+    },
+
+    _undoRedoCompleted: function()
+    {
+        this._pendingCommandsMajorState.pop();
     }
 }
 
@@ -468,6 +487,7 @@ WebInspector.CSSStyleDeclaration.prototype = {
     {
         function callback(userCallback, error, payload)
         {
+            WebInspector.cssModel._pendingCommandsMajorState.pop();
             if (!userCallback)
                 return;
 
@@ -476,10 +496,10 @@ WebInspector.CSSStyleDeclaration.prototype = {
                 userCallback(null);
             } else {
                 userCallback(WebInspector.CSSStyleDeclaration.parsePayload(payload));
-                WebInspector.cssModel._fireStyleSheetChanged(this.id.styleSheetId, true);
             }
         }
 
+        WebInspector.cssModel._pendingCommandsMajorState.push(true);
         CSSAgent.setPropertyText(this.id, index, name + ": " + value + ";", false, callback.bind(this, userCallback));
     },
 
@@ -604,15 +624,16 @@ WebInspector.CSSProperty.prototype = {
     {
         function enabledCallback(style)
         {
-            if (style)
-                WebInspector.cssModel._fireStyleSheetChanged(style.id.styleSheetId, majorChange, userCallback ? userCallback.bind(null, style) : null);
-            else if (userCallback)
+            if (userCallback)
                 userCallback(style);
         }
 
         function callback(error, stylePayload)
         {
+            WebInspector.cssModel._pendingCommandsMajorState.pop();
             if (!error) {
+                if (majorChange)
+                    WebInspector.domAgent.markUndoableState();
                 this.text = propertyText;
                 var style = WebInspector.CSSStyleDeclaration.parsePayload(stylePayload);
                 var newProperty = style.allProperties[this.index];
@@ -622,7 +643,8 @@ WebInspector.CSSProperty.prototype = {
                     return;
                 }
 
-                WebInspector.cssModel._fireStyleSheetChanged(style.id.styleSheetId, majorChange, userCallback ? userCallback.bind(null, style) : null);
+                if (userCallback)
+                    userCallback(style);
             } else {
                 if (userCallback)
                     userCallback(null);
@@ -633,9 +655,8 @@ WebInspector.CSSProperty.prototype = {
             throw "No ownerStyle for property";
 
         // An index past all the properties adds a new property to the style.
+        WebInspector.cssModel._pendingCommandsMajorState.push(majorChange);
         CSSAgent.setPropertyText(this.ownerStyle.id, this.index, propertyText, this.index < this.ownerStyle.pastLastSourcePropertyIndex(), callback.bind(this));
-        if (majorChange)
-            DOMAgent.markUndoableState();
     },
 
     setValue: function(newValue, majorChange, userCallback)
@@ -653,18 +674,20 @@ WebInspector.CSSProperty.prototype = {
 
         function callback(error, stylePayload)
         {
+            WebInspector.cssModel._pendingCommandsMajorState.pop();
             if (error) {
                 if (userCallback)
                     userCallback(null);
                 return;
             }
+            WebInspector.domAgent.markUndoableState();
             if (userCallback) {
                 var style = WebInspector.CSSStyleDeclaration.parsePayload(stylePayload);
                 userCallback(style);
             }
-            WebInspector.cssModel._fireStyleSheetChanged(this.ownerStyle.id.styleSheetId, false);
         }
 
+        WebInspector.cssModel._pendingCommandsMajorState.push(false);
         CSSAgent.toggleProperty(this.ownerStyle.id, this.index, disabled, callback.bind(this));
     }
 }
@@ -741,12 +764,15 @@ WebInspector.CSSStyleSheet.prototype = {
     {
         function callback(error)
         {
-             if (userCallback)
-                 userCallback(error);
-             if (!error)
-                 WebInspector.cssModel._fireStyleSheetChanged(this.id, majorChange);
+            if (!error)
+                WebInspector.domAgent.markUndoableState();
+
+            WebInspector.cssModel._pendingCommandsMajorState.pop();
+            if (userCallback)
+                userCallback(error);
         }
 
+        WebInspector.cssModel._pendingCommandsMajorState.push(majorChange);
         CSSAgent.setStyleSheetText(this.id, newText, callback.bind(this));
     }
 }
@@ -864,6 +890,11 @@ WebInspector.CSSDispatcher.prototype = {
     mediaQueryResultChanged: function()
     {
         this._cssModel.mediaQueryResultChanged();
+    },
+
+    styleSheetChanged: function(styleSheetId)
+    {
+        this._cssModel._fireStyleSheetChanged(styleSheetId);
     }
 }
 
diff --git a/Source/WebCore/inspector/front-end/CallStackSidebarPane.js b/Source/WebCore/inspector/front-end/CallStackSidebarPane.js
index 6dd59cc92..b2b388637 100644
--- a/Source/WebCore/inspector/front-end/CallStackSidebarPane.js
+++ b/Source/WebCore/inspector/front-end/CallStackSidebarPane.js
@@ -126,7 +126,7 @@ WebInspector.CallStackSidebarPane.prototype = {
     {
         var text = "";
         for (var i = 0; i < this.placards.length; ++i)
-            text += this.placards[i]._text + "\n";
+            text += this.placards[i].title + " (" + this.placards[i].subtitle + ")\n";
         InspectorFrontendHost.copyText(text);
     },
 
diff --git a/Source/WebCore/inspector/front-end/ConsoleMessage.js b/Source/WebCore/inspector/front-end/ConsoleMessage.js
index 82efcde03..f2a74efa8 100644
--- a/Source/WebCore/inspector/front-end/ConsoleMessage.js
+++ b/Source/WebCore/inspector/front-end/ConsoleMessage.js
@@ -310,22 +310,44 @@ WebInspector.ConsoleMessageImpl.prototype = {
             return;
 
         var elements = [];
+        var length = 0;
         for (var i = 0; i < properties.length; ++i) {
-            var name = properties[i].name;
+            var property = properties[i];
+            var name = property.name;
+            if (name === "length")
+                length = parseInt(property.value.description, 10);
             if (name == parseInt(name, 10))
-                elements[name] = this._formatAsArrayEntry(properties[i].value);
+                elements[name] = this._formatAsArrayEntry(property.value);
         }
 
         elem.appendChild(document.createTextNode("["));
-        for (var i = 0; i < elements.length; ++i) {
+        var lastNonEmptyIndex = -1;
+
+        function appendUndefined(elem, index)
+        {
+            if (index - lastNonEmptyIndex <= 1)
+                return;
+            var span = elem.createChild(span, "console-formatted-undefined");
+            span.textContent = WebInspector.UIString("undefined × %d", index - lastNonEmptyIndex - 1);
+        }
+
+        for (var i = 0; i < length; ++i) {
             var element = elements[i];
-            if (element)
-                elem.appendChild(element);
-            else
-                elem.appendChild(document.createTextNode("undefined"))
-            if (i < elements.length - 1)
+            if (!element)
+                continue;
+
+            if (i - lastNonEmptyIndex > 1) {
+                appendUndefined(elem, i);
                 elem.appendChild(document.createTextNode(", "));
-        }
+            }
+
+            elem.appendChild(element);
+            lastNonEmptyIndex = i;
+            if (i < length - 1)
+                elem.appendChild(document.createTextNode(", "));
+        }       
+        appendUndefined(elem, length);
+
         elem.appendChild(document.createTextNode("]"));
     },
 
diff --git a/Source/WebCore/inspector/front-end/DOMAgent.js b/Source/WebCore/inspector/front-end/DOMAgent.js
index c17f20394..2ef016943 100644
--- a/Source/WebCore/inspector/front-end/DOMAgent.js
+++ b/Source/WebCore/inspector/front-end/DOMAgent.js
@@ -660,9 +660,6 @@ WebInspector.DOMAgent = function() {
     this._document = null;
     this._attributeLoadNodeIds = {};
     InspectorBackend.registerDOMDispatcher(new WebInspector.DOMDispatcher(this));
-    if (WebInspector.experimentsSettings.freeFlowDOMEditing.isEnabled())
-        new WebInspector.DOMModelResourceBinding(this);
-
     if (WebInspector.settings.emulateTouchEvents.get())
         this._emulateTouchEventsChanged();
     WebInspector.settings.emulateTouchEvents.addChangeListener(this._emulateTouchEventsChanged, this);
@@ -677,7 +674,9 @@ WebInspector.DOMAgent.Events = {
     DocumentUpdated: "DocumentUpdated",
     ChildNodeCountUpdated: "ChildNodeCountUpdated",
     InspectElementRequested: "InspectElementRequested",
-    StyleInvalidated: "StyleInvalidated"
+    StyleInvalidated: "StyleInvalidated",
+    UndoRedoRequested: "UndoRedoRequested",
+    UndoRedoCompleted: "UndoRedoCompleted"
 }
 
 WebInspector.DOMAgent.prototype = {
@@ -1115,50 +1114,53 @@ WebInspector.DOMAgent.prototype = {
     {
         function wrapperFunction(error)
         {
+            if (!error)
+                this.markUndoableState();
+
             if (callback)
                 callback.apply(this, arguments);
-            if (error || !WebInspector.experimentsSettings.freeFlowDOMEditing.isEnabled())
-                return;
-            if (this._captureDOMTimer)
-               clearTimeout(this._captureDOMTimer);
-            this._captureDOMTimer = setTimeout(this._captureDOM.bind(this, node), 500);
         }
         return wrapperFunction.bind(this);
     },
 
+    _emulateTouchEventsChanged: function()
+    {
+        DOMAgent.setTouchEmulationEnabled(WebInspector.settings.emulateTouchEvents.get());
+    },
+
+    markUndoableState: function()
+    {
+        DOMAgent.markUndoableState();
+    },
+
     /**
-     * @param {WebInspector.DOMNode} node
+     * @param {function(?Protocol.Error)=} callback
      */
-    _captureDOM: function(node)
+    undo: function(callback)
     {
-        delete this._captureDOMTimer;
-        if (!node.ownerDocument)
-            return;
-
-        function callback(error, text)
+        function mycallback(error)
         {
-            if (error) {
-                console.error(error);
-                return;
-            }
-
-            var url = node.ownerDocument.documentURL;
-            if (!url)
-                return;
-
-            var resource = WebInspector.resourceForURL(url);
-            if (!resource)
-                return;
-
-            resource.addRevision(text);
+            this.dispatchEventToListeners(WebInspector.DOMAgent.Events.UndoRedoCompleted);
+            callback(error);
         }
-        DOMAgent.getOuterHTML(node.ownerDocument.id, callback);
-        
+
+        this.dispatchEventToListeners(WebInspector.DOMAgent.Events.UndoRedoRequested);
+        DOMAgent.undo(callback);
     },
 
-    _emulateTouchEventsChanged: function()
+    /**
+     * @param {function(?Protocol.Error)=} callback
+     */
+    redo: function(callback)
     {
-        DOMAgent.setTouchEmulationEnabled(WebInspector.settings.emulateTouchEvents.get());
+        function mycallback(error)
+        {
+            this.dispatchEventToListeners(WebInspector.DOMAgent.Events.UndoRedoCompleted);
+            callback(error);
+        }
+
+        this.dispatchEventToListeners(WebInspector.DOMAgent.Events.UndoRedoRequested);
+        DOMAgent.redo(callback);
     }
 }
 
@@ -1258,39 +1260,3 @@ WebInspector.DOMDispatcher.prototype = {
  * @type {?WebInspector.DOMAgent}
  */
 WebInspector.domAgent = null;
-
-/**
- * @constructor
- * @implements {WebInspector.ResourceDomainModelBinding}
- */
-WebInspector.DOMModelResourceBinding = function(domAgent)
-{
-    this._domAgent = domAgent;
-    WebInspector.Resource.registerDomainModelBinding(WebInspector.Resource.Type.Document, this);
-}
-
-WebInspector.DOMModelResourceBinding.prototype = {
-    setContent: function(resource, content, majorChange, userCallback)
-    {
-        var frameId = resource.frameId;
-        if (!frameId)
-            return;
-
-        PageAgent.setDocumentContent(frameId, content, callbackWrapper);
-
-        function callbackWrapper(error)
-        {
-            if (majorChange)
-                resource.addRevision(content);
-            if (userCallback)
-                userCallback(error);
-        }
-    },
-
-    canSetContent: function()
-    {
-        return true;
-    }
-}
-
-WebInspector.DOMModelResourceBinding.prototype.__proto__ = WebInspector.ResourceDomainModelBinding.prototype;
diff --git a/Source/WebCore/inspector/front-end/DataGrid.js b/Source/WebCore/inspector/front-end/DataGrid.js
index 036cb4ffb..10379534d 100644
--- a/Source/WebCore/inspector/front-end/DataGrid.js
+++ b/Source/WebCore/inspector/front-end/DataGrid.js
@@ -711,6 +711,8 @@ WebInspector.DataGrid.prototype = {
 
         if (this.expanded)
             child._attach();
+        if (!this.revealed)
+            child.revealed = false;
     },
 
     removeChild: function(child)
diff --git a/Source/WebCore/inspector/front-end/DebuggerPresentationModel.js b/Source/WebCore/inspector/front-end/DebuggerPresentationModel.js
index 8d83b137a..27b045758 100644
--- a/Source/WebCore/inspector/front-end/DebuggerPresentationModel.js
+++ b/Source/WebCore/inspector/front-end/DebuggerPresentationModel.js
@@ -183,6 +183,8 @@ WebInspector.DebuggerPresentationModel.prototype = {
     {
         var result = [];
         for (var i = 0; i < this._rawSourceCodes.length; ++i) {
+            if (!this._rawSourceCodes[i].sourceMapping)
+                continue;
             var uiSourceCodeList = this._rawSourceCodes[i].sourceMapping.uiSourceCodeList();
             for (var j = 0; j < uiSourceCodeList.length; ++j)
                 result.push(uiSourceCodeList[j]);
diff --git a/Source/WebCore/inspector/front-end/DetailedHeapshotGridNodes.js b/Source/WebCore/inspector/front-end/DetailedHeapshotGridNodes.js
index 66213163d..6e7efaca0 100644
--- a/Source/WebCore/inspector/front-end/DetailedHeapshotGridNodes.js
+++ b/Source/WebCore/inspector/front-end/DetailedHeapshotGridNodes.js
@@ -62,25 +62,27 @@ WebInspector.HeapSnapshotGridNode.prototype = {
 
     _toPercentString: function(num)
     {
-        return num.toFixed(2) + "%";
+        return num.toFixed(0) + "\u2009%"; // \u2009 is a thin space.
     },
 
     _createValueCell: function(columnIdentifier)
     {
         var cell = document.createElement("td");
         cell.className = columnIdentifier + "-column";
-        var div = document.createElement("div");
-        var valueSpan = document.createElement("span");
-        valueSpan.textContent = this.data[columnIdentifier];
-        var percentColumn = columnIdentifier + "-percent";
-        if (percentColumn in this.data) {
-            var percentSpan = document.createElement("span");
-            percentSpan.className = "percent-column";
-            percentSpan.textContent = this.data[percentColumn];
-            div.appendChild(percentSpan);
+        if (this.dataGrid.snapshot.totalSize !== 0) {
+            var div = document.createElement("div");
+            var valueSpan = document.createElement("span");
+            valueSpan.textContent = this.data[columnIdentifier];
+            div.appendChild(valueSpan);
+            var percentColumn = columnIdentifier + "-percent";
+            if (percentColumn in this.data) {
+                var percentSpan = document.createElement("span");
+                percentSpan.className = "percent-column";
+                percentSpan.textContent = this.data[percentColumn];
+                div.appendChild(percentSpan);
+            }
+            cell.appendChild(div);
         }
-        div.appendChild(valueSpan);
-        cell.appendChild(div);
         return cell;
     },
 
@@ -207,7 +209,7 @@ WebInspector.HeapSnapshotGenericObjectNode = function(tree, node)
     this.snapshotNodeIndex = node.nodeIndex;
     if (this._type === "string")
         this.hasHoverMessage = true;
-    else if (this._type === "object" && this.isDOMWindow(this._name)) {
+    else if (this._type === "object" && this.isWindow(this._name)) {
         this._name = this.shortenWindowURL(this._name, false);
         this.hasHoverMessage = true;
     } else if (node.flags & tree.snapshot.nodeFlags.canBeQueried)
@@ -300,10 +302,8 @@ WebInspector.HeapSnapshotGenericObjectNode.prototype = {
         var view = this.dataGrid.snapshotView;
         data["shallowSize"] = Number.withThousandsSeparator(this._shallowSize);
         data["retainedSize"] = Number.withThousandsSeparator(this._retainedSize);
-        if (view._showPercentage) {
-            data["shallowSize-percent"] = this._toPercentString(this._shallowSizePercent);
-            data["retainedSize-percent"] = this._toPercentString(this._retainedSizePercent);
-        }
+        data["shallowSize-percent"] = this._toPercentString(this._shallowSizePercent);
+        data["retainedSize-percent"] = this._toPercentString(this._retainedSizePercent);
 
         return this._enhanceData ? this._enhanceData(data) : data;
     },
@@ -343,9 +343,9 @@ WebInspector.HeapSnapshotGenericObjectNode.prototype = {
         this._provider.isEmpty(isEmptyCallback.bind(this));
     },
 
-    isDOMWindow: function(fullName)
+    isWindow: function(fullName)
     {
-        return fullName.substr(0, 9) === "DOMWindow";
+        return fullName.substr(0, 9) === "Window";
     },
 
     shortenWindowURL: function(fullName, hasObjectId)
@@ -381,16 +381,14 @@ WebInspector.HeapSnapshotObjectNode = function(tree, isFromBaseSnapshot, edge, p
 WebInspector.HeapSnapshotObjectNode.prototype = {
     updateHasChildren: function(parentGridNode)
     {
-        if (this.showRetainingEdges) {
-            this._parentGridNode = parentGridNode;
-            var ancestor = parentGridNode;
-            while (ancestor) {
-                if (ancestor.snapshotNodeId === this.snapshotNodeId) {
-                    this._cycledWithAncestorGridNode = ancestor;
-                    return;
-                }
-                ancestor = ancestor._parentGridNode;
+        this._parentGridNode = parentGridNode;
+        var ancestor = parentGridNode;
+        while (ancestor) {
+            if (ancestor.snapshotNodeId === this.snapshotNodeId) {
+                this._cycledWithAncestorGridNode = ancestor;
+                return;
             }
+            ancestor = ancestor._parentGridNode;
         }
         WebInspector.HeapSnapshotGenericObjectNode.prototype.updateHasChildren.call(this);
     },
@@ -470,7 +468,7 @@ WebInspector.HeapSnapshotObjectNode.prototype = {
 
     _prefixObjectCell: function(div, data)
     {
-        if (this.showRetainingEdges && this._cycledWithAncestorGridNode)
+        if (this._cycledWithAncestorGridNode)
             div.className += " cycled-ancessor-node";
 
         var nameSpan = document.createElement("span");
@@ -625,10 +623,9 @@ WebInspector.HeapSnapshotConstructorNode.prototype = {
         data["count"] =  Number.withThousandsSeparator(this._count);
         data["shallowSize"] = Number.withThousandsSeparator(this._shallowSize);
         data["retainedSize"] = Number.withThousandsSeparator(this._retainedSize);
-        if (view._showPercentage) {
-            data["shallowSize-percent"] = this._toPercentString(this._shallowSizePercent);
-            data["retainedSize-percent"] = this._toPercentString(this._retainedSizePercent);
-        }
+        data["count-percent"] =  this._toPercentString(this._countPercent);
+        data["shallowSize-percent"] = this._toPercentString(this._shallowSizePercent);
+        data["retainedSize-percent"] = this._toPercentString(this._retainedSizePercent);
         return data;
     },
 
diff --git a/Source/WebCore/inspector/front-end/DetailedHeapshotView.js b/Source/WebCore/inspector/front-end/DetailedHeapshotView.js
index 7db87f962..d35b20350 100644
--- a/Source/WebCore/inspector/front-end/DetailedHeapshotView.js
+++ b/Source/WebCore/inspector/front-end/DetailedHeapshotView.js
@@ -84,7 +84,9 @@ WebInspector.HeapSnapshotSortableDataGrid.prototype = {
         children.sort(sortFunction);
         for (var i = 0, l = children.length; i < l; ++i) {
             var child = children[i];
+            var revealed = child.revealed;
             this.appendChild(child);
+            child.revealed = revealed;
             if (child.expanded)
                 child.sort();
         }
@@ -296,6 +298,16 @@ WebInspector.HeapSnapshotConstructorsDataGrid.prototype = {
 
         loader(profileIndex, firstSnapshotLoaded.bind(this));
     },
+
+    _nameFilterChanged: function(filterString)
+    {
+        var filter = filterString.toLowerCase();
+        for (var i = 0, l = this.children.length; i < l; ++i) {
+            var node = this.children[i];
+            if (node.depth === 0)
+                node.revealed = node._name.toLowerCase().indexOf(filter) !== -1;
+        }
+    }
 };
 
 WebInspector.HeapSnapshotConstructorsDataGrid.prototype.__proto__ = WebInspector.HeapSnapshotSortableDataGrid.prototype;
@@ -430,8 +442,6 @@ WebInspector.DetailedHeapshotView = function(parent, profile)
     this.parent.addEventListener("profile added", this._updateBaseOptions, this);
     this.parent.addEventListener("profile added", this._updateFilterOptions, this);
 
-    this._showPercentage = false;
-
     this.viewsContainer = document.createElement("div");
     this.viewsContainer.addStyleClass("views-container");
     this.element.appendChild(this.viewsContainer);
@@ -445,7 +455,18 @@ WebInspector.DetailedHeapshotView = function(parent, profile)
 
     this.constructorsView = new WebInspector.View();
     this.constructorsView.element.addStyleClass("view");
+
+    this.constructorsViewToolbar = document.createElement("div");
+    this.constructorsViewToolbar.addStyleClass("constructors-view-toolbar");
+    this.constructorsViewFilter = document.createElement("input");
+    this.constructorsViewFilter.addStyleClass("constructors-view-filter");
+    this.constructorsViewFilter.setAttribute("placeholder", WebInspector.UIString("Class filter"));
+    this.constructorsViewFilter.addEventListener("keyup", this._changeNameFilter.bind(this), false);
+    this.constructorsViewToolbar.appendChild(this.constructorsViewFilter);
+    this.constructorsView.element.appendChild(this.constructorsViewToolbar);
+
     this.constructorsDataGrid = new WebInspector.HeapSnapshotConstructorsDataGrid();
+    this.constructorsDataGrid.element.addStyleClass("constructors-view-grid");
     this.constructorsDataGrid.element.addEventListener("mousedown", this._mouseDownInContentsGrid.bind(this), true);
     this.constructorsDataGrid.show(this.constructorsView.element);
     this.constructorsDataGrid.addEventListener(WebInspector.DataGrid.Events.SelectedNode, this._selectionChanged, this);
@@ -480,6 +501,7 @@ WebInspector.DetailedHeapshotView = function(parent, profile)
     this.retainmentDataGrid = new WebInspector.HeapSnapshotRetainmentDataGrid();
     this.retainmentDataGrid.element.addEventListener("click", this._mouseClickInRetainmentGrid.bind(this), true);
     this.retainmentDataGrid.show(this.retainmentView.element);
+    this.retainmentDataGrid.addEventListener(WebInspector.DataGrid.Events.SelectedNode, this._inspectedObjectChanged, this);
     this.retainmentView.show(this.element);
     this.retainmentDataGrid.reset();
 
@@ -514,8 +536,6 @@ WebInspector.DetailedHeapshotView = function(parent, profile)
     this.filterSelectElement.addEventListener("change", this._changeFilter.bind(this), false);
     this._updateFilterOptions();
 
-    this.percentButton = new WebInspector.StatusBarButton("", "percent-time-status-bar-item status-bar-item");
-    this.percentButton.addEventListener("click", this._percentClicked.bind(this), false);
     this.helpButton = new WebInspector.StatusBarButton("", "heapshot-help-status-bar-item status-bar-item");
     this.helpButton.addEventListener("click", this._helpClicked.bind(this), false);
 
@@ -539,7 +559,6 @@ WebInspector.DetailedHeapshotView = function(parent, profile)
         else
             this.baseSelectElement.selectedIndex = profileIndex;
         this.dataGrid.setDataSource(this, this.profileWrapper);
-        this._updatePercentButton();
     }
 }
 
@@ -558,7 +577,7 @@ WebInspector.DetailedHeapshotView.prototype = {
 
     get statusBarItems()
     {
-        return [this.viewSelectElement, this.baseSelectElement, this.filterSelectElement, this.percentButton.element, this.helpButton.element];
+        return [this.viewSelectElement, this.baseSelectElement, this.filterSelectElement, this.helpButton.element];
     },
 
     get profile()
@@ -612,12 +631,6 @@ WebInspector.DetailedHeapshotView.prototype = {
         this._updateRetainmentViewHeight(height);
     },
 
-    refreshShowPercents: function()
-    {
-        this._updatePercentButton();
-        this.refreshVisibleData();
-    },
-
     searchCanceled: function()
     {
         if (this._searchResults) {
@@ -787,6 +800,11 @@ WebInspector.DetailedHeapshotView.prototype = {
         this.performSearch(this.currentQuery, this._searchFinishedCallback);
     },
 
+    _changeNameFilter: function()
+    {
+        this.dataGrid._nameFilterChanged(this.constructorsViewFilter.value);
+    },
+
     _profiles: function()
     {
         return WebInspector.panels.profiles.getProfiles(WebInspector.DetailedHeapshotProfileType.TypeId);
@@ -824,6 +842,14 @@ WebInspector.DetailedHeapshotView.prototype = {
     {
         var selectedNode = event.target.selectedNode;
         this._setRetainmentDataGridSource(selectedNode);
+        this._inspectedObjectChanged(event);
+    },
+
+    _inspectedObjectChanged: function(event)
+    {
+        var selectedNode = event.target.selectedNode;
+        if (selectedNode instanceof WebInspector.HeapSnapshotGenericObjectNode)
+            ConsoleAgent.addInspectedHeapObject(selectedNode.snapshotNodeId);
     },
 
     _setRetainmentDataGridSource: function(nodeItem)
@@ -843,8 +869,6 @@ WebInspector.DetailedHeapshotView.prototype = {
         if (!cell || (!cell.hasStyleClass("count-column") && !cell.hasStyleClass("shallowSize-column") && !cell.hasStyleClass("retainedSize-column")))
             return;
 
-        this.refreshShowPercents();
-
         event.preventDefault();
         event.stopPropagation();
     },
@@ -946,12 +970,6 @@ WebInspector.DetailedHeapshotView.prototype = {
         return span;
     },
 
-    _percentClicked: function(event)
-    {
-        this._showPercentage = !this._showPercentage;
-        this.refreshShowPercents();
-    },
-
     _resolveObjectForPopover: function(element, showCallback, objectGroupName)
     {
         element.node.queryObjectContent(showCallback, objectGroupName);
@@ -1095,17 +1113,6 @@ WebInspector.DetailedHeapshotView.prototype = {
             filterOption.label = title;
             this.filterSelectElement.appendChild(filterOption);
         }
-    },
-
-    _updatePercentButton: function()
-    {
-        if (this._showPercentage) {
-            this.percentButton.title = WebInspector.UIString("Hide percentages of counts and sizes.");
-            this.percentButton.toggled = true;
-        } else {
-            this.percentButton.title = WebInspector.UIString("Show percentages of counts and sizes.");
-            this.percentButton.toggled = false;
-        }
     }
 };
 
diff --git a/Source/WebCore/inspector/front-end/Dialog.js b/Source/WebCore/inspector/front-end/Dialog.js
index 76d3fdaf9..853aa6fa9 100644
--- a/Source/WebCore/inspector/front-end/Dialog.js
+++ b/Source/WebCore/inspector/front-end/Dialog.js
@@ -45,7 +45,6 @@ WebInspector.Dialog = function(relativeToElement, delegate)
     this._glassPaneElement.addEventListener("focus", this._onGlassPaneFocus.bind(this), false);
 
     this._element = this._glassPaneElement.createChild("div");
-    this._element.className = "dialog";
     this._element.tabIndex = 0;
     this._element.addEventListener("focus", this._onFocus.bind(this), false);
     this._element.addEventListener("keydown", this._onKeyDown.bind(this), false);
@@ -54,8 +53,7 @@ WebInspector.Dialog = function(relativeToElement, delegate)
         WebInspector.KeyboardShortcut.Keys.Esc.code,
     ];
 
-    delegate.element.addStyleClass("dialog-contents");
-    this._element.appendChild(delegate.element);
+    delegate.show(this._element);
 
     this._position();
     this._windowResizeHandler = this._position.bind(this);
@@ -142,6 +140,7 @@ WebInspector.Dialog.prototype = {
 
 /**
  * @constructor
+ * @extends {WebInspector.Object}
  */
 WebInspector.DialogDelegate = function()
 {
@@ -150,6 +149,16 @@ WebInspector.DialogDelegate = function()
 WebInspector.DialogDelegate.prototype = {
     /**
      * @param {Element} element
+     */
+    show: function(element)
+    {
+        element.appendChild(this.element);
+        this.element.addStyleClass("dialog-contents");
+        element.addStyleClass("dialog");    
+    },
+
+    /**
+     * @param {Element} element
      * @param {Element} relativeToElement
      */
     position: function(element, relativeToElement)
@@ -172,3 +181,5 @@ WebInspector.DialogDelegate.prototype = {
 
     willHide: function() { }
 };
+
+WebInspector.DialogDelegate.prototype.__proto__ = WebInspector.Object.prototype;
diff --git a/Source/WebCore/inspector/front-end/ElementsPanel.js b/Source/WebCore/inspector/front-end/ElementsPanel.js
index 3585e32ae..535e70579 100644
--- a/Source/WebCore/inspector/front-end/ElementsPanel.js
+++ b/Source/WebCore/inspector/front-end/ElementsPanel.js
@@ -96,6 +96,9 @@ WebInspector.ElementsPanel = function()
 
     this._registerShortcuts();
 
+    this._popoverHelper = new WebInspector.PopoverHelper(document.body, this._getPopoverAnchor.bind(this), this._showPopover.bind(this));
+    this._popoverHelper.setTimeout(0);
+
     WebInspector.domAgent.addEventListener(WebInspector.DOMAgent.Events.NodeRemoved, this._nodeRemoved, this);
     WebInspector.domAgent.addEventListener(WebInspector.DOMAgent.Events.DocumentUpdated, this._documentUpdated, this);
     WebInspector.domAgent.addEventListener(WebInspector.DOMAgent.Events.InspectElementRequested, this._inspectElementRequested, this);
@@ -146,10 +149,16 @@ WebInspector.ElementsPanel.prototype = {
         WebInspector.domAgent.hideDOMNodeHighlight();
         this.setSearchingForNode(false);
         this.treeOutline.setVisible(false);
+        this._popoverHelper.hidePopover();
 
         // Detach heavy component on hide
         this.contentElement.removeChild(this.treeOutline.element);
 
+        for (var pane in this.sidebarPanes) {
+            if (this.sidebarPanes[pane].willHide)
+                this.sidebarPanes[pane].willHide();
+        }
+
         WebInspector.Panel.prototype.willHide.call(this);
     },
 
@@ -332,6 +341,124 @@ WebInspector.ElementsPanel.prototype = {
         }
     },
 
+    _getPopoverAnchor: function(element)
+    {
+        var anchor = element.enclosingNodeOrSelfWithClass("webkit-html-resource-link");
+        if (anchor) {
+            if (!anchor.href)
+                return null;
+
+            var resource = WebInspector.resourceTreeModel.resourceForURL(anchor.href);
+            if (!resource || resource.type !== WebInspector.Resource.Type.Image)
+                return null;
+
+            anchor.removeAttribute("title");
+        }
+        return anchor;
+    },
+    
+    _loadDimensionsForNode: function(treeElement, callback)
+    {
+        // We get here for CSS properties, too, so bail out early for non-DOM treeElements.
+        if (treeElement.treeOutline !== this.treeOutline) {
+            callback();
+            return;
+        }
+        
+        var node = /** @type {WebInspector.DOMNode} */ treeElement.representedObject;
+
+        if (!node.nodeName() || node.nodeName().toLowerCase() !== "img") {
+            callback();
+            return;
+        }
+
+        WebInspector.RemoteObject.resolveNode(node, "", resolvedNode);
+
+        function resolvedNode(object)
+        {
+            if (!object) {
+                callback();
+                return;
+            }
+
+            object.callFunctionJSON(dimensions, callback);
+            object.release();
+
+            function dimensions()
+            {
+                return { offsetWidth: this.offsetWidth, offsetHeight: this.offsetHeight, naturalWidth: this.naturalWidth, naturalHeight: this.naturalHeight };
+            }
+        }
+    },
+
+    _showPopover: function(anchor, popover)
+    {
+        var listItem = anchor.enclosingNodeOrSelfWithNodeNameInArray(["li"]);
+        if (listItem && listItem.treeElement)
+            this._loadDimensionsForNode(listItem.treeElement, dimensionsCallback);
+        else
+            dimensionsCallback();
+
+        /**
+         * @param {Object=} dimensions
+         */
+        function dimensionsCallback(dimensions)
+        {
+            var imageElement = document.createElement("img");
+            imageElement.addEventListener("load", showPopover.bind(null, imageElement, dimensions), false);
+            var resource = WebInspector.resourceTreeModel.resourceForURL(anchor.href);
+            if (!resource)
+                return;
+    
+            resource.populateImageSource(imageElement);
+        }
+
+        /**
+         * @param {Object=} dimensions
+         */
+        function showPopover(imageElement, dimensions)
+        {
+            var contents = buildPopoverContents(imageElement, dimensions);
+            popover.setCanShrink(false);
+            popover.show(contents, anchor);
+        }
+
+        /**
+         * @param {Object=} nodeDimensions
+         */
+        function buildPopoverContents(imageElement, nodeDimensions)
+        {
+            const maxImageWidth = 100;
+            const maxImageHeight = 100;
+            var container = document.createElement("table");
+            container.className = "image-preview-container";
+            var naturalWidth = nodeDimensions ? nodeDimensions.naturalWidth : imageElement.naturalWidth;
+            var naturalHeight = nodeDimensions ? nodeDimensions.naturalHeight : imageElement.naturalHeight;
+            var offsetWidth = nodeDimensions ? nodeDimensions.offsetWidth : naturalWidth;
+            var offsetHeight = nodeDimensions ? nodeDimensions.offsetHeight : naturalHeight;
+            var description;
+            if (offsetHeight === naturalHeight && offsetWidth === naturalWidth)
+                description = WebInspector.UIString("%d \xd7 %d pixels", offsetWidth, offsetHeight);
+            else
+                description = WebInspector.UIString("%d \xd7 %d pixels (Natural: %d \xd7 %d pixels)", offsetWidth, offsetHeight, naturalWidth, naturalHeight);
+
+            if (naturalWidth > naturalHeight) {
+                if (naturalWidth > maxImageWidth) {
+                    imageElement.style.width = maxImageWidth + "px";
+                    imageElement.style.height = (naturalHeight * maxImageWidth / naturalWidth) + "px";
+                }
+            } else {
+                if (naturalHeight > maxImageHeight) {
+                    imageElement.style.width = (naturalWidth * maxImageHeight / naturalHeight) + "px";
+                    imageElement.style.height = maxImageHeight + "px";
+                }
+            }
+            container.createChild("tr").createChild("td", "image-container").appendChild(imageElement);
+            container.createChild("tr").createChild("td").createChild("span", "description").textContent = description;
+            return container;
+        }
+    },
+
     jumpToNextSearchResult: function()
     {
         if (!this._searchResults)
@@ -927,8 +1054,17 @@ WebInspector.ElementsPanel.prototype = {
             return;
         }
 
-        if (WebInspector.KeyboardShortcut.eventHasCtrlOrMeta(event) && event.keyIdentifier === "U+005A") { // Z key
-            DOMAgent.undo(this._updateSidebars.bind(this));
+        if (WebInspector.KeyboardShortcut.eventHasCtrlOrMeta(event) && !event.shiftKey && event.keyIdentifier === "U+005A") { // Z key
+            WebInspector.domAgent.undo(this._updateSidebars.bind(this));
+            event.handled = true;
+            return;
+        }
+
+        var isRedoKey = WebInspector.isMac() ? event.metaKey && event.shiftKey && event.keyIdentifier === "U+005A" : // Z key
+                                               event.ctrlKey && event.keyIdentifier === "U+0059"; // Y key
+        if (isRedoKey) {
+            DOMAgent.redo(this._updateSidebars.bind(this));
+            event.handled = true;
             return;
         }
 
diff --git a/Source/WebCore/inspector/front-end/ElementsTreeOutline.js b/Source/WebCore/inspector/front-end/ElementsTreeOutline.js
index 7fc53b669..1367fdef6 100644
--- a/Source/WebCore/inspector/front-end/ElementsTreeOutline.js
+++ b/Source/WebCore/inspector/front-end/ElementsTreeOutline.js
@@ -292,10 +292,6 @@ WebInspector.ElementsTreeOutline.prototype = {
         if (element) {
             element.hovered = true;
             this._previousHoveredElement = element;
-
-            // Lazily compute tag-specific tooltips.
-            if (element.representedObject && !element.tooltip)
-                element._createTooltipForNode();
         }
 
         WebInspector.domAgent.highlightDOMNode(element ? element.representedObject.id : 0);
@@ -705,48 +701,6 @@ WebInspector.ElementsTreeElement.prototype = {
         return this.expandedChildCount > index;
     },
 
-    _createTooltipForNode: function()
-    {
-        var node = /** @type {WebInspector.DOMNode} */ this.representedObject;
-        if (!node.nodeName() || node.nodeName().toLowerCase() !== "img")
-            return;
-
-        function setTooltip(result)
-        {
-            if (!result || result.type !== "string")
-                return;
-
-            try {
-                var properties = JSON.parse(result.description);
-                var offsetWidth = properties[0];
-                var offsetHeight = properties[1];
-                var naturalWidth = properties[2];
-                var naturalHeight = properties[3];
-                if (offsetHeight === naturalHeight && offsetWidth === naturalWidth)
-                    this.tooltip = WebInspector.UIString("%d \xd7 %d pixels", offsetWidth, offsetHeight);
-                else
-                    this.tooltip = WebInspector.UIString("%d \xd7 %d pixels (Natural: %d \xd7 %d pixels)", offsetWidth, offsetHeight, naturalWidth, naturalHeight);
-            } catch (e) {
-                console.error(e);
-            }
-        }
-
-        function resolvedNode(object)
-        {
-            if (!object)
-                return;
-
-            function dimensions()
-            {
-                return "[" + this.offsetWidth + "," + this.offsetHeight + "," + this.naturalWidth + "," + this.naturalHeight + "]";
-            }
-
-            object.callFunction(dimensions, setTooltip.bind(this));
-            object.release();
-        }
-        WebInspector.RemoteObject.resolveNode(node, "", resolvedNode.bind(this));
-    },
-
     updateSelection: function()
     {
         var listItemElement = this.listItemElement;
@@ -778,8 +732,6 @@ WebInspector.ElementsTreeElement.prototype = {
         this.updateTitle();
         this._preventFollowingLinksOnDoubleClick();
         this.listItemElement.draggable = true;
-        this.listItemElement.addEventListener("click", this._mouseClick.bind(this));
-        this.listItemElement.addEventListener("mousedown", this._mouseDown.bind(this));
     },
 
     _preventFollowingLinksOnDoubleClick: function()
@@ -1054,20 +1006,6 @@ WebInspector.ElementsTreeElement.prototype = {
             this.expand();
     },
 
-    _mouseClick: function(event)
-    {
-        if (this._isSingleClickCandidate)
-            this._startEditingTarget(event.target);
-        this._isSingleClickCandidate = false;
-    },
-
-    _mouseDown: function(event)
-    {
-        if (event.handled || event.which !== 1 || this._editing || this._elementCloseTag || !this.selected)
-            return;
-        this._isSingleClickCandidate = true;
-    },
-
     _insertInLastAttributePosition: function(tag, node)
     {
         if (tag.getElementsByClassName("webkit-html-attribute").length > 0)
diff --git a/Source/WebCore/inspector/front-end/HeapSnapshot.js b/Source/WebCore/inspector/front-end/HeapSnapshot.js
index 084ad0e28..437cd9a6f 100644
--- a/Source/WebCore/inspector/front-end/HeapSnapshot.js
+++ b/Source/WebCore/inspector/front-end/HeapSnapshot.js
@@ -591,9 +591,9 @@ WebInspector.HeapSnapshotNode.prototype = {
         return this._type() === this._snapshot._nodeSyntheticType;
     },
 
-    get isDOMWindow()
+    get isWindow()
     {
-        return this.name.substr(0, 9) === "DOMWindow";
+        return this.name.substr(0, 9) === "Window";
     },
 
     get isDetachedDOMTreesRoot()
@@ -945,10 +945,10 @@ WebInspector.HeapSnapshot.prototype = {
     {
         this._distancesToWindow = new Array(this.nodeCount);
 
-        // bfs for DOMWindow roots
+        // bfs for Window roots
         var list = [];
         for (var iter = this.rootNode.edges; iter.hasNext(); iter.next()) {
-            if (iter.edge.node.isDOMWindow) {
+            if (iter.edge.node.isWindow) {
                 list.push(iter.edge.node);
                 this._distancesToWindow[iter.edge.node.nodeIndex] = 0;
             }
@@ -1174,14 +1174,14 @@ WebInspector.HeapSnapshot.prototype = {
 
     _markQueriableHeapObjects: function()
     {
-        // Allow runtime properties query for objects accessible from DOMWindow objects
+        // Allow runtime properties query for objects accessible from Window objects
         // via regular properties, and for DOM wrappers. Trying to access random objects
         // can cause a crash due to insonsistent state of internal properties of wrappers.
         var flag = this._nodeFlags.canBeQueried;
 
         var list = [];
         for (var iter = this.rootNode.edges; iter.hasNext(); iter.next()) {
-            if (iter.edge.node.isDOMWindow)
+            if (iter.edge.node.isWindow)
                 list.push(iter.edge.node);
         }
 
diff --git a/Source/WebCore/inspector/front-end/Images/indexedDB.png b/Source/WebCore/inspector/front-end/Images/indexedDB.png
new file mode 100644
index 000000000..155533946
--- /dev/null
+++ b/Source/WebCore/inspector/front-end/Images/indexedDB.png
diff --git a/Source/WebCore/inspector/front-end/Images/indexedDBIndex.png b/Source/WebCore/inspector/front-end/Images/indexedDBIndex.png
new file mode 100644
index 000000000..eaecc0e57
--- /dev/null
+++ b/Source/WebCore/inspector/front-end/Images/indexedDBIndex.png
diff --git a/Source/WebCore/inspector/front-end/Images/indexedDBObjectStore.png b/Source/WebCore/inspector/front-end/Images/indexedDBObjectStore.png
new file mode 100644
index 000000000..10fa04c92
--- /dev/null
+++ b/Source/WebCore/inspector/front-end/Images/indexedDBObjectStore.png
diff --git a/Source/WebCore/inspector/front-end/Images/navigatorPinButton.png b/Source/WebCore/inspector/front-end/Images/navigatorPinButton.png
new file mode 100644
index 000000000..577d416fc
--- /dev/null
+++ b/Source/WebCore/inspector/front-end/Images/navigatorPinButton.png
diff --git a/Source/WebCore/inspector/front-end/Images/navigatorShowHideButton.png b/Source/WebCore/inspector/front-end/Images/navigatorShowHideButton.png
new file mode 100644
index 000000000..499e4e018
--- /dev/null
+++ b/Source/WebCore/inspector/front-end/Images/navigatorShowHideButton.png
diff --git a/Source/WebCore/inspector/front-end/Images/statusbarButtonGlyphs.png b/Source/WebCore/inspector/front-end/Images/statusbarButtonGlyphs.png
index 553124b1c..a46d72888 100644
--- a/Source/WebCore/inspector/front-end/Images/statusbarButtonGlyphs.png
+++ b/Source/WebCore/inspector/front-end/Images/statusbarButtonGlyphs.png
diff --git a/Source/WebCore/inspector/front-end/Images/timelineBarBlue.png b/Source/WebCore/inspector/front-end/Images/timelineBarBlue.png
index 5af319589..14486c647 100644
--- a/Source/WebCore/inspector/front-end/Images/timelineBarBlue.png
+++ b/Source/WebCore/inspector/front-end/Images/timelineBarBlue.png
diff --git a/Source/WebCore/inspector/front-end/Images/timelineBarGray.png b/Source/WebCore/inspector/front-end/Images/timelineBarGray.png
index 4e11aa420..6e18b14ad 100644
--- a/Source/WebCore/inspector/front-end/Images/timelineBarGray.png
+++ b/Source/WebCore/inspector/front-end/Images/timelineBarGray.png
diff --git a/Source/WebCore/inspector/front-end/Images/timelineBarGreen.png b/Source/WebCore/inspector/front-end/Images/timelineBarGreen.png
index ec1955caa..819cf9aaf 100644
--- a/Source/WebCore/inspector/front-end/Images/timelineBarGreen.png
+++ b/Source/WebCore/inspector/front-end/Images/timelineBarGreen.png
diff --git a/Source/WebCore/inspector/front-end/Images/timelineBarOrange.png b/Source/WebCore/inspector/front-end/Images/timelineBarOrange.png
index 435b0f1fb..31e7e499d 100644
--- a/Source/WebCore/inspector/front-end/Images/timelineBarOrange.png
+++ b/Source/WebCore/inspector/front-end/Images/timelineBarOrange.png
diff --git a/Source/WebCore/inspector/front-end/Images/timelineBarPurple.png b/Source/WebCore/inspector/front-end/Images/timelineBarPurple.png
index 02649cde7..db49089b5 100644
--- a/Source/WebCore/inspector/front-end/Images/timelineBarPurple.png
+++ b/Source/WebCore/inspector/front-end/Images/timelineBarPurple.png
diff --git a/Source/WebCore/inspector/front-end/Images/timelineBarRed.png b/Source/WebCore/inspector/front-end/Images/timelineBarRed.png
index 9c47280c8..e55b7a474 100644
--- a/Source/WebCore/inspector/front-end/Images/timelineBarRed.png
+++ b/Source/WebCore/inspector/front-end/Images/timelineBarRed.png
diff --git a/Source/WebCore/inspector/front-end/Images/timelineBarYellow.png b/Source/WebCore/inspector/front-end/Images/timelineBarYellow.png
index 39716ea29..221cd6fdc 100644
--- a/Source/WebCore/inspector/front-end/Images/timelineBarYellow.png
+++ b/Source/WebCore/inspector/front-end/Images/timelineBarYellow.png
diff --git a/Source/WebCore/inspector/front-end/Images/timelineHollowPillBlue.png b/Source/WebCore/inspector/front-end/Images/timelineHollowPillBlue.png
index 92f7f720f..dc7242baf 100644
--- a/Source/WebCore/inspector/front-end/Images/timelineHollowPillBlue.png
+++ b/Source/WebCore/inspector/front-end/Images/timelineHollowPillBlue.png
diff --git a/Source/WebCore/inspector/front-end/Images/timelineHollowPillGray.png b/Source/WebCore/inspector/front-end/Images/timelineHollowPillGray.png
index fd8afe110..991a4f594 100644
--- a/Source/WebCore/inspector/front-end/Images/timelineHollowPillGray.png
+++ b/Source/WebCore/inspector/front-end/Images/timelineHollowPillGray.png
diff --git a/Source/WebCore/inspector/front-end/Images/timelineHollowPillGreen.png b/Source/WebCore/inspector/front-end/Images/timelineHollowPillGreen.png
index af34c3053..7045c49cb 100644
--- a/Source/WebCore/inspector/front-end/Images/timelineHollowPillGreen.png
+++ b/Source/WebCore/inspector/front-end/Images/timelineHollowPillGreen.png
diff --git a/Source/WebCore/inspector/front-end/Images/timelineHollowPillOrange.png b/Source/WebCore/inspector/front-end/Images/timelineHollowPillOrange.png
index b46eddeb7..67485f628 100644
--- a/Source/WebCore/inspector/front-end/Images/timelineHollowPillOrange.png
+++ b/Source/WebCore/inspector/front-end/Images/timelineHollowPillOrange.png
diff --git a/Source/WebCore/inspector/front-end/Images/timelineHollowPillPurple.png b/Source/WebCore/inspector/front-end/Images/timelineHollowPillPurple.png
index 6ce6640a3..8df8a56c0 100644
--- a/Source/WebCore/inspector/front-end/Images/timelineHollowPillPurple.png
+++ b/Source/WebCore/inspector/front-end/Images/timelineHollowPillPurple.png
diff --git a/Source/WebCore/inspector/front-end/Images/timelineHollowPillRed.png b/Source/WebCore/inspector/front-end/Images/timelineHollowPillRed.png
index 67cccfd22..020719e27 100644
--- a/Source/WebCore/inspector/front-end/Images/timelineHollowPillRed.png
+++ b/Source/WebCore/inspector/front-end/Images/timelineHollowPillRed.png
diff --git a/Source/WebCore/inspector/front-end/Images/timelineHollowPillYellow.png b/Source/WebCore/inspector/front-end/Images/timelineHollowPillYellow.png
index 9e71a9a14..9fdb533e5 100644
--- a/Source/WebCore/inspector/front-end/Images/timelineHollowPillYellow.png
+++ b/Source/WebCore/inspector/front-end/Images/timelineHollowPillYellow.png
diff --git a/Source/WebCore/inspector/front-end/Images/timelinePillBlue.png b/Source/WebCore/inspector/front-end/Images/timelinePillBlue.png
index aef365242..adf967f0a 100644
--- a/Source/WebCore/inspector/front-end/Images/timelinePillBlue.png
+++ b/Source/WebCore/inspector/front-end/Images/timelinePillBlue.png
diff --git a/Source/WebCore/inspector/front-end/Images/timelinePillGray.png b/Source/WebCore/inspector/front-end/Images/timelinePillGray.png
index 82ea80aea..bb48eb20b 100644
--- a/Source/WebCore/inspector/front-end/Images/timelinePillGray.png
+++ b/Source/WebCore/inspector/front-end/Images/timelinePillGray.png
diff --git a/Source/WebCore/inspector/front-end/Images/timelinePillGreen.png b/Source/WebCore/inspector/front-end/Images/timelinePillGreen.png
index 6973fdbf7..8cde46266 100644
--- a/Source/WebCore/inspector/front-end/Images/timelinePillGreen.png
+++ b/Source/WebCore/inspector/front-end/Images/timelinePillGreen.png
diff --git a/Source/WebCore/inspector/front-end/Images/timelinePillOrange.png b/Source/WebCore/inspector/front-end/Images/timelinePillOrange.png
index 09cfa4a27..a24de5a58 100644
--- a/Source/WebCore/inspector/front-end/Images/timelinePillOrange.png
+++ b/Source/WebCore/inspector/front-end/Images/timelinePillOrange.png
diff --git a/Source/WebCore/inspector/front-end/Images/timelinePillPurple.png b/Source/WebCore/inspector/front-end/Images/timelinePillPurple.png
index 6fb5b356e..73c8ec086 100644
--- a/Source/WebCore/inspector/front-end/Images/timelinePillPurple.png
+++ b/Source/WebCore/inspector/front-end/Images/timelinePillPurple.png
diff --git a/Source/WebCore/inspector/front-end/Images/timelinePillRed.png b/Source/WebCore/inspector/front-end/Images/timelinePillRed.png
index 64234f716..6e8b3c0ab 100644
--- a/Source/WebCore/inspector/front-end/Images/timelinePillRed.png
+++ b/Source/WebCore/inspector/front-end/Images/timelinePillRed.png
diff --git a/Source/WebCore/inspector/front-end/Images/timelinePillYellow.png b/Source/WebCore/inspector/front-end/Images/timelinePillYellow.png
index a2deee671..a3d60413e 100644
--- a/Source/WebCore/inspector/front-end/Images/timelinePillYellow.png
+++ b/Source/WebCore/inspector/front-end/Images/timelinePillYellow.png
diff --git a/Source/WebCore/inspector/front-end/IndexedDBModel.js b/Source/WebCore/inspector/front-end/IndexedDBModel.js
index 75716d2d1..a73fc7ed3 100644
--- a/Source/WebCore/inspector/front-end/IndexedDBModel.js
+++ b/Source/WebCore/inspector/front-end/IndexedDBModel.js
@@ -35,29 +35,119 @@
 WebInspector.IndexedDBModel = function()
 {
     this._indexedDBRequestManager = new WebInspector.IndexedDBRequestManager();
-    
+
+    WebInspector.resourceTreeModel.addEventListener(WebInspector.ResourceTreeModel.EventTypes.FrameAdded, this._frameNavigated, this);
     WebInspector.resourceTreeModel.addEventListener(WebInspector.ResourceTreeModel.EventTypes.FrameNavigated, this._frameNavigated, this);
     WebInspector.resourceTreeModel.addEventListener(WebInspector.ResourceTreeModel.EventTypes.FrameDetached, this._frameDetached, this);
-    
+
     this._frames = {};
+    this._databases = new Map();
     this._frameIdsBySecurityOrigin = {};
     this._databaseNamesBySecurityOrigin = {};
 
     this.refreshDatabaseNames();
 }
 
+WebInspector.IndexedDBModel.KeyTypes = {
+    NumberType:  "number",
+    StringType:  "string",
+    DateType:    "date",
+    ArrayType:   "array"
+};
+
+/**
+ * @param {IndexedDBAgent.Key} key
+ */
+WebInspector.IndexedDBModel.idbKeyFromKey = function(key)
+{
+    var idbKey;
+    switch (key.type) {
+    case WebInspector.IndexedDBModel.KeyTypes.NumberType:
+        idbKey = key.number;
+        break;
+    case WebInspector.IndexedDBModel.KeyTypes.StringType:
+        idbKey = key.string;
+        break;
+    case WebInspector.IndexedDBModel.KeyTypes.DateType:
+        idbKey = new Date(key.date);
+        break;
+    case WebInspector.IndexedDBModel.KeyTypes.ArrayType:
+        idbKey = [];
+        for (var i = 0; i < key.length; ++i)
+            idbKey.push(WebInspector.IndexedDBModel.idbKeyFromKey(key.array[i]));
+        break;
+    }
+    return idbKey;
+}
+
+WebInspector.IndexedDBModel.keyFromIDBKey = function(idbKey)
+{
+    if (typeof(idbKey) === "undefined" || idbKey === null)
+        return null;
+
+    var key = {};
+    switch (typeof(idbKey)) {
+    case "number":
+        key.number = idbKey;
+        key.type = WebInspector.IndexedDBModel.KeyTypes.NumberType;
+        break;
+    case "string":
+        key.string = idbKey;
+        key.type = WebInspector.IndexedDBModel.KeyTypes.StringType;
+        break;
+    case "object":
+        if (idbKey instanceof Date) {
+            key.date = idbKey.getTime();
+            key.type = WebInspector.IndexedDBModel.KeyTypes.DateType;
+        } else if (idbKey instanceof Array) {
+            key.array = [];
+            for (var i = 0; i < idbKey.length; ++i)
+                key.array.push(WebInspector.IndexedDBModel.keyFromIDBKey(idbKey[i]));
+            key.type = WebInspector.IndexedDBModel.KeyTypes.ArrayType;
+        }
+        break;
+    default:
+        return null;
+    }
+    return key;
+}
+
+WebInspector.IndexedDBModel.keyRangeFromIDBKeyRange = function(idbKeyRange)
+{
+    var IDBKeyRange = window.IDBKeyRange || window.webkitIDBKeyRange;
+    if (typeof(idbKeyRange) === "undefined" || idbKeyRange === null)
+        return null;
+
+    var keyRange = {};
+    keyRange.lower = WebInspector.IndexedDBModel.keyFromIDBKey(idbKeyRange.lower);
+    keyRange.upper = WebInspector.IndexedDBModel.keyFromIDBKey(idbKeyRange.upper);
+    keyRange.lowerOpen = idbKeyRange.lowerOpen;
+    keyRange.upperOpen = idbKeyRange.upperOpen;
+    return keyRange;
+}
+
+WebInspector.IndexedDBModel.EventTypes = {
+    DatabaseAdded: "DatabaseAdded",
+    DatabaseRemoved: "DatabaseRemoved",
+    DatabaseLoaded: "DatabaseLoaded"
+}
+
 WebInspector.IndexedDBModel.prototype = {
     refreshDatabaseNames: function()
     {
         this._reset();
-        this._framesNavigatedRecursively(WebInspector.resourceTreeModel.mainFrame);
+        if (WebInspector.resourceTreeModel.mainFrame)
+            this._framesNavigatedRecursively(WebInspector.resourceTreeModel.mainFrame);
     },
-    
-    refreshDatabase: function(frameId, databaseName)
+
+    /**
+     * @param {WebInspector.IndexedDBModel.DatabaseId} databaseId
+     */
+    refreshDatabase: function(databaseId)
     {
-        this._loadDatabase(frameId, databaseName);
+        this._loadDatabase(databaseId);
     },
-    
+
     /**
      * @param {WebInspector.ResourceTreeFrame} resourceTreeFrame
      */
@@ -65,9 +155,9 @@ WebInspector.IndexedDBModel.prototype = {
     {
         this._processFrameNavigated(resourceTreeFrame);
         for (var i = 0; i < resourceTreeFrame.childFrames.length; ++i)
-            this._framesNavigatedRecursively(resourceTreeFrame.childFrames[i]);            
+            this._framesNavigatedRecursively(resourceTreeFrame.childFrames[i]);
     },
-    
+
     /**
      * @param {WebInspector.Event} event
      */
@@ -76,7 +166,7 @@ WebInspector.IndexedDBModel.prototype = {
         var resourceTreeFrame = /** @type {WebInspector.ResourceTreeFrame} */ event.data;
         this._processFrameNavigated(resourceTreeFrame);
     },
-    
+
     /**
      * @param {WebInspector.Event} event
      */
@@ -89,11 +179,10 @@ WebInspector.IndexedDBModel.prototype = {
 
     _reset: function()
     {
-        this._frames = {};
-        this._frameIdsBySecurityOrigin = {};
-        this._databaseNamesBySecurityOrigin = {};
+        for (var frameId in this._frames)
+            this._originRemovedFromFrame(frameId);
+
         this._indexedDBRequestManager._reset();
-        // FIXME: dispatch events?
     },
 
     /**
@@ -119,7 +208,6 @@ WebInspector.IndexedDBModel.prototype = {
             this._frameIdsBySecurityOrigin[securityOrigin] = [];
             this._frameIdsBySecurityOrigin[securityOrigin].push(frameId);
             this._databaseNamesBySecurityOrigin[securityOrigin] = [];
-            // FIXME: dispatch origin added event.
         }
         this._frames[frameId] = new WebInspector.IndexedDBModel.Frame(frameId, securityOrigin);
     },
@@ -155,10 +243,9 @@ WebInspector.IndexedDBModel.prototype = {
         for (var i = 0; i < frameIdsForOrigin; ++i)
             delete this._frames[frameIdsForOrigin[i]];
         delete this._frameIdsBySecurityOrigin[securityOrigin];
-        for (var i = 0; i < this._databaseNamesBySecurityOrigin[securityOrigin]; ++i)
+        for (var i = 0; i < this._databaseNamesBySecurityOrigin[securityOrigin].length; ++i)
             this._databaseRemoved(securityOrigin, this._databaseNamesBySecurityOrigin[securityOrigin][i]);
         delete this._databaseNamesBySecurityOrigin[securityOrigin];
-        // FIXME: dispatch origin removed event.
     },
 
     /**
@@ -195,7 +282,8 @@ WebInspector.IndexedDBModel.prototype = {
      */
     _databaseAdded: function(securityOrigin, databaseName)
     {
-        // FIXME: dispatch database added event.
+        var databaseId = new WebInspector.IndexedDBModel.DatabaseId(securityOrigin, databaseName);
+        this.dispatchEventToListeners(WebInspector.IndexedDBModel.EventTypes.DatabaseAdded, databaseId);
     },
 
     /**
@@ -205,7 +293,9 @@ WebInspector.IndexedDBModel.prototype = {
     _databaseRemoved: function(securityOrigin, databaseName)
     {
         this._indexedDBRequestManager._databaseRemoved(this._frameIdsBySecurityOrigin[securityOrigin], databaseName);
-        // FIXME: dispatch database removed event.
+
+        var databaseId = new WebInspector.IndexedDBModel.DatabaseId(securityOrigin, databaseName);
+        this.dispatchEventToListeners(WebInspector.IndexedDBModel.EventTypes.DatabaseRemoved, databaseId);
     },
 
     /**
@@ -220,24 +310,38 @@ WebInspector.IndexedDBModel.prototype = {
         {
             var databaseNames = securityOriginWithDatabaseNames.databaseNames;
             var oldSecurityOrigin = this._frames[frameId] ? this._frames[frameId].securityOrigin : null;
-            if (oldSecurityOrigin && oldSecurityOrigin === securityOriginWithDatabaseNames.securityOrigin)
-                this._updateOriginDatabaseNames(securityOriginWithDatabaseNames.securityOrigin, securityOriginWithDatabaseNames.databaseNames);
-            else {
+            if (!oldSecurityOrigin || oldSecurityOrigin !== securityOriginWithDatabaseNames.securityOrigin) {
                 this._originRemovedFromFrame(frameId);
                 this._originAddedToFrame(frameId, securityOriginWithDatabaseNames.securityOrigin);
-                this._updateOriginDatabaseNames(securityOriginWithDatabaseNames.securityOrigin, securityOriginWithDatabaseNames.databaseNames);
             }
+            this._updateOriginDatabaseNames(securityOriginWithDatabaseNames.securityOrigin, securityOriginWithDatabaseNames.databaseNames);
         }
 
         this._indexedDBRequestManager.requestDatabaseNamesForFrame(frameId, callback.bind(this));
     },
 
     /**
-     * @param {string} frameId
-     * @param {string} databaseName
+     * @param {WebInspector.IndexedDBModel.DatabaseId} databaseId
+     * @return {string|null}
+     */
+    _assertFrameId: function(databaseId)
+    {
+        var frameIds = this._frameIdsBySecurityOrigin[databaseId.securityOrigin];
+        if (!frameIds || !frameIds.length)
+            return null;
+
+        return frameIds[0];
+    },
+
+    /**
+     * @param {WebInspector.IndexedDBModel.DatabaseId} databaseId
      */
-    _loadDatabase: function(frameId, databaseName)
+    _loadDatabase: function(databaseId)
     {
+        var frameId = this._assertFrameId(databaseId);
+        if (!frameId)
+            return;
+
         /**
          * @param {IndexedDBAgent.DatabaseWithObjectStores} databaseWithObjectStores
          */
@@ -246,23 +350,90 @@ WebInspector.IndexedDBModel.prototype = {
             if (!this._frames[frameId])
                 return;
 
-            var databaseModel = new WebInspector.IndexedDBModel.Database(databaseName, databaseWithObjectStores.version);
-            this._frames[frameId].databases[databaseName] = databaseModel;
+            var databaseModel = new WebInspector.IndexedDBModel.Database(databaseId, databaseWithObjectStores.version);
+            this._databases.put(databaseId, databaseModel); 
             for (var i = 0; i < databaseWithObjectStores.objectStores.length; ++i) {
                 var objectStore = databaseWithObjectStores.objectStores[i];
                 var objectStoreModel = new WebInspector.IndexedDBModel.ObjectStore(objectStore.name, objectStore.keyPath);
                 for (var j = 0; j < objectStore.indexes.length; ++j) {
-                     var objectStoreIndex = objectStore.indexes[j];
-                     var objectStoreIndexModel = new WebInspector.IndexedDBModel.ObjectStoreIndex(objectStoreIndex.name, objectStoreIndex.keyPath, objectStoreIndex.unique, objectStoreIndex.multiEntry);
-                     objectStoreModel.indexes[objectStoreIndexModel.name] = objectStoreIndexModel;
+                     var index = objectStore.indexes[j];
+                     var indexModel = new WebInspector.IndexedDBModel.Index(index.name, index.keyPath, index.unique, index.multiEntry);
+                     objectStoreModel.indexes[indexModel.name] = indexModel;
                 }
                 databaseModel.objectStores[objectStoreModel.name] = objectStoreModel;
             }
 
-            // FIXME: dispatch database loaded event.
+            this.dispatchEventToListeners(WebInspector.IndexedDBModel.EventTypes.DatabaseLoaded, databaseModel);
+        }
+
+        this._indexedDBRequestManager.requestDatabase(frameId, databaseId.name, callback.bind(this));
+    },
+
+    /**
+     * @param {WebInspector.IndexedDBModel.DatabaseId} databaseId
+     * @param {string} objectStoreName
+     * @param {webkitIDBKeyRange} idbKeyRange
+     * @param {number} skipCount
+     * @param {number} pageSize
+     * @param {function(Array.<WebInspector.IndexedDBModel.Entry>, boolean)} callback
+     */
+    loadObjectStoreData: function(databaseId, objectStoreName, idbKeyRange, skipCount, pageSize, callback)
+    {
+        var frameId = this._assertFrameId(databaseId);
+        if (!frameId)
+            return;
+
+        /**
+         * @param {Array.<IndexedDBAgent.DataEntry>} dataEntries
+         * @param {boolean} hasMore
+         */
+        function innerCallback(dataEntries, hasMore)
+        {
+            var entries = [];
+            for (var i = 0; i < dataEntries.length; ++i) {
+                var key = WebInspector.IndexedDBModel.idbKeyFromKey(dataEntries[i].key);
+                var primaryKey = WebInspector.IndexedDBModel.idbKeyFromKey(dataEntries[i].primaryKey);
+                var value = WebInspector.RemoteObject.fromPayload(dataEntries[i].value);
+                entries.push(new WebInspector.IndexedDBModel.Entry(key, primaryKey, value));
+            }
+            callback(entries, hasMore);
+        }
+
+        this._indexedDBRequestManager.requestObjectStoreData(frameId, databaseId.name, objectStoreName, idbKeyRange, skipCount, pageSize, innerCallback);
+    },
+
+    /**
+     * @param {WebInspector.IndexedDBModel.DatabaseId} databaseId
+     * @param {string} objectStoreName
+     * @param {string} indexName
+     * @param {webkitIDBKeyRange} idbKeyRange
+     * @param {number} skipCount
+     * @param {number} pageSize
+     * @param {function(Array.<WebInspector.IndexedDBModel.Entry>, boolean)} callback
+     */
+    loadIndexData: function(databaseId, objectStoreName, indexName, idbKeyRange, skipCount, pageSize, callback)
+    {
+        var frameId = this._assertFrameId(databaseId);
+        if (!frameId)
+            return;
+
+        /**
+         * @param {Array.<IndexedDBAgent.DataEntry>} dataEntries
+         * @param {boolean} hasMore
+         */
+        function innerCallback(dataEntries, hasMore)
+        {
+            var entries = [];
+            for (var i = 0; i < dataEntries.length; ++i) {
+                var key = WebInspector.IndexedDBModel.idbKeyFromKey(dataEntries[i].key);
+                var primaryKey = WebInspector.IndexedDBModel.idbKeyFromKey(dataEntries[i].primaryKey);
+                var value = WebInspector.RemoteObject.fromPayload(dataEntries[i].value);
+                entries.push(new WebInspector.IndexedDBModel.Entry(key, primaryKey, value));
+            }
+            callback(entries, hasMore);
         }
 
-        this._indexedDBRequestManager.requestDatabase(frameId, databaseName, callback.bind(this));
+        this._indexedDBRequestManager.requestIndexData(frameId, databaseId.name, objectStoreName, indexName, idbKeyRange, skipCount, pageSize, innerCallback.bind(this));
     }
 }
 
@@ -270,6 +441,19 @@ WebInspector.IndexedDBModel.prototype.__proto__ = WebInspector.Object.prototype;
 
 /**
  * @constructor
+ * @param {*} key
+ * @param {*} primaryKey
+ * @param {WebInspector.RemoteObject} value
+ */
+WebInspector.IndexedDBModel.Entry = function(key, primaryKey, value)
+{
+    this.key = key;
+    this.primaryKey = primaryKey;
+    this.value = value;
+}
+
+/**
+ * @constructor
  * @param {string} frameId
  * @param {string} securityOrigin
  */
@@ -277,16 +461,37 @@ WebInspector.IndexedDBModel.Frame = function(frameId, securityOrigin)
 {
     this.frameId = frameId;
     this.securityOrigin = securityOrigin;
-    this.databases = {};
+    this.databaseNames = {};
 }
 
 /**
  * @constructor
+ * @param {string} securityOrigin
  * @param {string} name
  */
-WebInspector.IndexedDBModel.Database = function(name, version)
+WebInspector.IndexedDBModel.DatabaseId = function(securityOrigin, name)
 {
+    this.securityOrigin = securityOrigin;
     this.name = name;
+}
+
+WebInspector.IndexedDBModel.DatabaseId.prototype = {
+    /**
+     * @param {WebInspector.IndexedDBModel.DatabaseId} databaseId
+     */
+    equals: function(databaseId)
+    {
+        return this.name === databaseId.name && this.securityOrigin === databaseId.securityOrigin;
+    },
+}
+/**
+ * @constructor
+ * @param {WebInspector.IndexedDBModel.DatabaseId} databaseId
+ * @param {string} version
+ */
+WebInspector.IndexedDBModel.Database = function(databaseId, version)
+{
+    this.databaseId = databaseId;
     this.version = version;
     this.objectStores = {};
 }
@@ -308,7 +513,7 @@ WebInspector.IndexedDBModel.ObjectStore = function(name, keyPath)
  * @param {string} name
  * @param {string} keyPath
  */
-WebInspector.IndexedDBModel.ObjectStoreIndex = function(name, keyPath, unique, multiEntry)
+WebInspector.IndexedDBModel.Index = function(name, keyPath, unique, multiEntry)
 {
     this.name = name;
     this.keyPath = keyPath;
@@ -323,6 +528,8 @@ WebInspector.IndexedDBRequestManager = function()
 {
     this._lastRequestId = 0;
     this._requestDatabaseNamesForFrameCallbacks = {};
+    this._requestDatabaseCallbacks = {};
+    this._requestDataCallbacks = {};
 
     IndexedDBAgent.enable();
     InspectorBackend.registerIndexedDBDispatcher(new WebInspector.IndexedDBDispatcher(this));
@@ -384,7 +591,7 @@ WebInspector.IndexedDBRequestManager.prototype = {
 
         IndexedDBAgent.requestDatabase(requestId, frameId, databaseName, innerCallback);
     },
-    
+
     /**
      * @param {number} requestId
      * @param {IndexedDBAgent.DatabaseWithObjectStores} databaseWithObjectStores
@@ -399,6 +606,91 @@ WebInspector.IndexedDBRequestManager.prototype = {
     },
 
     /**
+     * @param {string} frameId
+     * @param {string} databaseName
+     * @param {string} objectStoreName
+     * @param {string} indexName
+     * @param {webkitIDBKeyRange} idbKeyRange
+     * @param {number} skipCount
+     * @param {number} pageSize
+     * @param {function(Array.<IndexedDBAgent.DataEntry>, boolean)} callback
+     */
+    _requestData: function(frameId, databaseName, objectStoreName, indexName, idbKeyRange, skipCount, pageSize, callback)
+    {
+        var requestId = this._requestId();
+        var request = new WebInspector.IndexedDBRequestManager.DataRequest(frameId, databaseName, objectStoreName, indexName, callback);
+        this._requestDataCallbacks[requestId] = request;
+
+        function innerCallback(error)
+        {
+            if (error) {
+                console.error("IndexedDBAgent error: " + error);
+                return;
+            }
+        }
+
+        var keyRange = WebInspector.IndexedDBModel.keyRangeFromIDBKeyRange(idbKeyRange);
+        IndexedDBAgent.requestData(requestId, frameId, databaseName, objectStoreName, indexName, skipCount, pageSize, keyRange ? keyRange : undefined, innerCallback);
+    },
+
+    /**
+     * @param {string} frameId
+     * @param {string} databaseName
+     * @param {string} objectStoreName
+     * @param {webkitIDBKeyRange} idbKeyRange
+     * @param {number} skipCount
+     * @param {number} pageSize
+     * @param {function(Array.<IndexedDBAgent.DataEntry>, boolean)} callback
+     */
+    requestObjectStoreData: function(frameId, databaseName, objectStoreName, idbKeyRange, skipCount, pageSize, callback)
+    {
+        this._requestData(frameId, databaseName, objectStoreName, "", idbKeyRange, skipCount, pageSize, callback);
+    },
+
+    /**
+     * @param {number} requestId
+     * @param {Array.<IndexedDBAgent.DataEntry>} dataEntries
+     * @param {boolean} hasMore
+     */
+    _objectStoreDataLoaded: function(requestId, dataEntries, hasMore)
+    {
+        var request = this._requestDataCallbacks[requestId];
+        if (!request.callback)
+            return;
+
+        request.callback(dataEntries, hasMore);
+    },
+
+    /**
+     * @param {string} frameId
+     * @param {string} databaseName
+     * @param {string} objectStoreName
+     * @param {string} indexName
+     * @param {webkitIDBKeyRange} idbKeyRange
+     * @param {number} skipCount
+     * @param {number} pageSize
+     * @param {function(Array.<IndexedDBAgent.DataEntry>, boolean)} callback
+     */
+    requestIndexData: function(frameId, databaseName, objectStoreName, indexName, idbKeyRange, skipCount, pageSize, callback)
+    {
+        this._requestData(frameId, databaseName, objectStoreName, indexName, idbKeyRange, skipCount, pageSize, callback);
+    },
+
+    /**
+     * @param {number} requestId
+     * @param {Array.<IndexedDBAgent.DataEntry>} dataEntries
+     * @param {boolean} hasMore
+     */
+    _indexDataLoaded: function(requestId, dataEntries, hasMore)
+    {
+        var request = this._requestDataCallbacks[requestId];
+        if (!request.callback)
+            return;
+
+        request.callback(dataEntries, hasMore);
+    },
+
+    /**
      * @return {number}
      */
     _requestId: function()
@@ -415,11 +707,16 @@ WebInspector.IndexedDBRequestManager.prototype = {
             if (this._requestDatabaseNamesForFrameCallbacks[requestId].frameId === frameId)
                 delete this._requestDatabaseNamesForFrameCallbacks[requestId];
         }
-        
+
         for (var requestId in this._requestDatabaseCallbacks) {
             if (this._requestDatabaseCallbacks[requestId].frameId === frameId)
                 delete this._requestDatabaseCallbacks[requestId];
         }
+
+        for (var requestId in this._requestDataCallbacks) {
+            if (this._requestDataCallbacks[requestId].frameId === frameId)
+                delete this._requestDataCallbacks[requestId];
+        }
     },
 
     /**
@@ -431,19 +728,26 @@ WebInspector.IndexedDBRequestManager.prototype = {
             if (this._requestDatabaseCallbacks[requestId].frameId === frameId && this._requestDatabaseCallbacks[requestId].databaseName === databaseName)
                 delete this._requestDatabaseCallbacks[requestId];
         }
+
+        for (var requestId in this._requestDataCallbacks) {
+            if (this._requestDataCallbacks[requestId].frameId === frameId && this._requestDataCallbacks[requestId].databaseName === databaseName)
+                delete this._requestDataCallbacks[requestId];
+        }
     },
 
     _reset: function()
     {
         this._requestDatabaseNamesForFrameCallbacks = {};
         this._requestDatabaseCallbacks = {};
-
+        this._requestDataCallbacks = {};
     }
 }
 
 /**
  * @constructor
- */
+ * @param {string} frameId
+ * @param {function(IndexedDBAgent.SecurityOriginWithDatabaseNames)} callback
+*/
 WebInspector.IndexedDBRequestManager.DatabasesForFrameRequest = function(frameId, callback)
 {
     this.frameId = frameId;
@@ -452,6 +756,9 @@ WebInspector.IndexedDBRequestManager.DatabasesForFrameRequest = function(frameId
 
 /**
  * @constructor
+ * @param {string} frameId
+ * @param {string} databaseName
+ * @param {function(IndexedDBAgent.DatabaseWithObjectStores)} callback
  */
 WebInspector.IndexedDBRequestManager.DatabaseRequest = function(frameId, databaseName, callback)
 {
@@ -462,6 +769,23 @@ WebInspector.IndexedDBRequestManager.DatabaseRequest = function(frameId, databas
 
 /**
  * @constructor
+ * @param {string} frameId
+ * @param {string} databaseName
+ * @param {string} objectStoreName
+ * @param {string} indexName
+ * @param {function(Array.<IndexedDBAgent.DataEntry>, boolean)} callback
+ */
+WebInspector.IndexedDBRequestManager.DataRequest = function(frameId, databaseName, objectStoreName, indexName, callback)
+{
+    this.frameId = frameId;
+    this.databaseName = databaseName;
+    this.objectStoreName = objectStoreName;
+    this.indexName = indexName;
+    this.callback = callback;
+}
+
+/**
+ * @constructor
  * @implements {IndexedDBAgent.Dispatcher}
  * @param {WebInspector.IndexedDBRequestManager} indexedDBRequestManager
  */
@@ -487,5 +811,26 @@ WebInspector.IndexedDBDispatcher.prototype = {
     databaseLoaded: function(requestId, databaseWithObjectStores)
     {
         this._agentWrapper._databaseLoaded(requestId, databaseWithObjectStores);
+    },
+
+    /**
+     * @param {number} requestId
+     * @param {Array.<IndexedDBAgent.DataEntry>} dataEntries
+     * @param {boolean} hasMore
+     */
+    objectStoreDataLoaded: function(requestId, dataEntries, hasMore)
+    {
+        this._agentWrapper._objectStoreDataLoaded(requestId, dataEntries, hasMore);
+    },
+
+    /**
+     * @param {number} requestId
+     * @param {Array.<IndexedDBAgent.DataEntry>} dataEntries
+     * @param {boolean} hasMore
+     */
+    indexDataLoaded: function(requestId, dataEntries, hasMore)
+    {
+        this._agentWrapper._indexDataLoaded(requestId, dataEntries, hasMore);
     }
 }
+
diff --git a/Source/WebCore/inspector/front-end/IndexedDBViews.js b/Source/WebCore/inspector/front-end/IndexedDBViews.js
new file mode 100644
index 000000000..a14b791b9
--- /dev/null
+++ b/Source/WebCore/inspector/front-end/IndexedDBViews.js
@@ -0,0 +1,334 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+/**
+ * @constructor
+ * @extends {WebInspector.View}
+ * @param {WebInspector.IndexedDBModel.Database} database
+ */
+WebInspector.IDBDatabaseView = function(database)
+{
+    WebInspector.View.call(this);
+    this.registerRequiredCSS("indexedDBViews.css");
+    
+    this.element.addStyleClass("fill");
+    this.element.addStyleClass("indexed-db-database-view");
+    
+    this._headersListElement = this.element.createChild("ol", "outline-disclosure");
+    this._headersTreeOutline = new TreeOutline(this._headersListElement);
+    this._headersTreeOutline.expandTreeElementsWhenArrowing = true;
+    
+    this._securityOriginTreeElement = new TreeElement("", null, false);
+    this._securityOriginTreeElement.selectable = false;
+    this._headersTreeOutline.appendChild(this._securityOriginTreeElement);
+
+    this._nameTreeElement = new TreeElement("", null, false);
+    this._nameTreeElement.selectable = false;
+    this._headersTreeOutline.appendChild(this._nameTreeElement);
+
+    this._versionTreeElement = new TreeElement("", null, false);
+    this._versionTreeElement.selectable = false;
+    this._headersTreeOutline.appendChild(this._versionTreeElement);
+
+    this.update(database);
+}
+
+WebInspector.IDBDatabaseView.prototype = {
+    /**
+     * @param {string} name
+     * @param {string} value
+     */
+    _formatHeader: function(name, value)
+    {
+        var fragment = document.createDocumentFragment();
+        fragment.createChild("div", "attribute-name").textContent = name + ":";
+        fragment.createChild("div", "attribute-value source-code").textContent = value;
+
+        return fragment;
+    },
+
+    _refreshDatabase: function()
+    {
+        this._securityOriginTreeElement.title = this._formatHeader(WebInspector.UIString("Security origin"), this._database.databaseId.securityOrigin);
+        this._nameTreeElement.title = this._formatHeader(WebInspector.UIString("Name"), this._database.databaseId.name);
+        this._versionTreeElement.title = this._formatHeader(WebInspector.UIString("Version"), this._database.version);
+    },
+
+    /**
+     * @param {WebInspector.IndexedDBModel.Database} database
+     */
+    update: function(database)
+    {
+        this._database = database;
+        this._refreshDatabase();
+    },
+}
+
+WebInspector.IDBDatabaseView.prototype.__proto__ = WebInspector.View.prototype;
+
+/**
+ * @constructor
+ * @extends {WebInspector.View}
+ * @param {WebInspector.IndexedDBModel} model
+ * @param {WebInspector.IndexedDBModel.DatabaseId} databaseId
+ * @param {WebInspector.IndexedDBModel.ObjectStore} objectStore
+ * @param {WebInspector.IndexedDBModel.Index} index
+ */
+WebInspector.IDBDataView = function(model, databaseId, objectStore, index)
+{
+    WebInspector.View.call(this);
+    this.registerRequiredCSS("indexedDBViews.css");
+    
+    this._model = model; 
+    this._databaseId = databaseId;
+    this._isIndex = !!index;
+
+    this.element.addStyleClass("indexed-db-data-view");
+
+    var editorToolbar = this._createEditorToolbar();
+    this.element.appendChild(editorToolbar);
+    
+    this._dataGridContainer = this.element.createChild("div", "fill");
+    this._dataGridContainer.addStyleClass("data-grid-container");
+
+    this._pageSize = 50;
+    this._skipCount = 0;
+
+    this.update(objectStore, index);
+}
+
+WebInspector.IDBDataView.prototype = {
+    /**
+     * @return {WebInspector.DataGrid}
+     */
+    _createDataGrid: function()
+    {
+        var columns = {};
+        columns["number"] = {};
+        columns["number"].title = WebInspector.UIString("#");
+        columns["number"].width = "50px";
+        
+        var keyPath = this._isIndex ? this._index.keyPath : this._objectStore.keyPath;
+        columns["key"] = {};
+        var keyColumnTitle = WebInspector.UIString("Key") + (keyPath ? " (" + keyPath + ")" : "");
+        columns["key"].title = keyColumnTitle;
+        
+        if (this._isIndex) {
+            columns["primaryKey"] = {};
+            var primaryKeyColumnTitle = WebInspector.UIString("Primary key") + (this._objectStore.keyPath ? " (" + this._objectStore.keyPath + ")" : "");
+            columns["primaryKey"].title = primaryKeyColumnTitle;
+        }
+        
+        columns["value"] = {};
+        columns["value"].title = WebInspector.UIString("Value");
+
+        var dataGrid = new WebInspector.DataGrid(columns);
+        return dataGrid;
+    },
+
+    /**
+     * @return {Element}
+     */
+    _createEditorToolbar: function()
+    {
+        var editorToolbar = document.createElement("div");
+        editorToolbar.addStyleClass("status-bar");
+        editorToolbar.addStyleClass("data-view-toolbar");
+
+        this._pageBackButton = editorToolbar.createChild("button", "back-button");
+        this._pageBackButton.addStyleClass("status-bar-item");
+        this._pageBackButton.title = WebInspector.UIString("Show previous page.");
+        this._pageBackButton.disabled = true;
+        this._pageBackButton.appendChild(document.createElement("img"));
+        this._pageBackButton.addEventListener("click", this._pageBackButtonClicked.bind(this), false);
+        editorToolbar.appendChild(this._pageBackButton);
+        
+        this._pageForwardButton = editorToolbar.createChild("button", "forward-button");
+        this._pageForwardButton.addStyleClass("status-bar-item");
+        this._pageForwardButton.title = WebInspector.UIString("Show next page.");
+        this._pageForwardButton.disabled = true;
+        this._pageForwardButton.appendChild(document.createElement("img"));
+        this._pageForwardButton.addEventListener("click", this._pageForwardButtonClicked.bind(this), false);
+        editorToolbar.appendChild(this._pageForwardButton);
+        
+        this._keyInputElement = editorToolbar.createChild("input", "key-input");
+        this._keyInputElement.placeholder = WebInspector.UIString("Start from key");
+        this._keyInputElement.addEventListener("paste", this._keyInputChanged.bind(this));
+        this._keyInputElement.addEventListener("cut", this._keyInputChanged.bind(this));
+        this._keyInputElement.addEventListener("keypress", this._keyInputChanged.bind(this));
+        this._keyInputElement.addEventListener("keydown", this._keyInputChanged.bind(this));
+
+        return editorToolbar;
+    },
+
+    _pageBackButtonClicked: function()
+    {
+        this._skipCount = Math.max(0, this._skipCount - this._pageSize);
+        this._updateData(false);
+    },
+    
+    _pageForwardButtonClicked: function()
+    {
+        this._skipCount = this._skipCount + this._pageSize;
+        this._updateData(false);
+    },
+    
+    _keyInputChanged: function()
+    {
+        window.setTimeout(this._updateData.bind(this, false), 0);        
+    },
+    
+    /**
+     * @param {WebInspector.IndexedDBModel.ObjectStore} objectStore
+     * @param {WebInspector.IndexedDBModel.Index} index
+     */
+    update: function(objectStore, index)
+    {
+        this._objectStore = objectStore;
+        this._index = index;
+
+        if (this._dataGrid)
+            this._dataGrid.detach();
+        this._dataGrid = this._createDataGrid();
+        this._dataGrid.show(this._dataGridContainer);
+
+        this._skipCount = 0;
+        this._updateData(true); 
+    },
+    
+    /**
+     * @param {string} keyString
+     */
+    _parseKey: function(keyString)
+    {
+        var result;
+        try {
+            result = JSON.parse(keyString);
+        } catch (e) {
+            result = keyString;
+        }
+        return result;
+    },
+    
+    /**
+     * @return {string}
+     */
+    _stringifyKey: function(key)
+    {
+        if (typeof(key) === "string")
+            return key;
+        return JSON.stringify(key);
+    },
+
+    /**
+     * @param {boolean} force
+     */
+    _updateData: function(force)
+    {
+        var key = this._parseKey(this._keyInputElement.value);
+        var pageSize = this._pageSize;
+        var skipCount = this._skipCount;
+        
+        if (!force && this._lastKey === key && this._lastPageSize === pageSize && this._lastSkipCount === skipCount)
+            return;
+
+        if (this._lastKey !== key || this._lastPageSize !== pageSize) {
+            skipCount = 0;
+            this._skipCount = 0;
+        }
+        this._lastKey = key;
+        this._lastPageSize = pageSize;
+        this._lastSkipCount = skipCount;
+
+        /**
+         * @param {Array.<WebInspector.IndexedDBModel.Entry>} entries
+         * @param {boolean} hasMore
+         */
+        function callback(entries, hasMore)
+        {
+            this._dataGrid.removeChildren();
+            for (var i = 0; i < entries.length; ++i) {
+                var data = {};
+                data["number"] = i + skipCount;
+                data["key"] = this._stringifyKey(entries[i].key);
+                data["primaryKey"] = this._stringifyKey(entries[i].primaryKey);
+                data["value"] = entries[i].value;
+
+                var primaryKey = JSON.stringify(this._isIndex ? entries[i].primaryKey : entries[i].key);
+                var valueTitle = this._objectStore.name + "[" + primaryKey + "]";
+                var node = new WebInspector.IDBDataGridNode(valueTitle, data);
+                this._dataGrid.appendChild(node);
+            }
+            
+            this._pageBackButton.disabled = skipCount === 0;
+            this._pageForwardButton.disabled = !hasMore;
+        }
+        
+        var idbKeyRange = key ? window.webkitIDBKeyRange.lowerBound(key) : null;
+        if (this._isIndex)
+            this._model.loadIndexData(this._databaseId, this._objectStore.name, this._index.name, idbKeyRange, skipCount, pageSize, callback.bind(this));
+        else
+            this._model.loadObjectStoreData(this._databaseId, this._objectStore.name, idbKeyRange, skipCount, pageSize, callback.bind(this));
+    },
+}
+
+WebInspector.IDBDataView.prototype.__proto__ = WebInspector.View.prototype;
+
+/**
+ * @constructor
+ * @extends {WebInspector.DataGridNode}
+ * @param {string} valueTitle
+ * @param {*} data
+ */
+WebInspector.IDBDataGridNode = function(valueTitle, data)
+{
+    WebInspector.DataGridNode.call(this, data, false);
+    
+    this._valueTitle = valueTitle;
+    this.selectable = false;
+}
+
+WebInspector.IDBDataGridNode.prototype = {
+    /**
+     * @return {Element}
+     */
+    createCell: function(columnIdentifier)
+    {
+        if (columnIdentifier !== "value")
+            return WebInspector.DataGridNode.prototype.createCell.call(this, columnIdentifier);
+        
+        var section = new WebInspector.ObjectPropertiesSection(this.data["value"], this._valueTitle)
+        section.editable = false;
+        section.skipProto = true;
+        return section.element;
+    }
+};
+
+WebInspector.IDBDataGridNode.prototype.__proto__ = WebInspector.DataGridNode.prototype;
diff --git a/Source/WebCore/inspector/front-end/InspectorFrontendAPI.js b/Source/WebCore/inspector/front-end/InspectorFrontendAPI.js
index ec80b98bc..828c54032 100644
--- a/Source/WebCore/inspector/front-end/InspectorFrontendAPI.js
+++ b/Source/WebCore/inspector/front-end/InspectorFrontendAPI.js
@@ -85,6 +85,16 @@ InspectorFrontendAPI = {
         WebInspector.inspectorView.setCurrentPanel(WebInspector.panels.console);
     },
 
+    showMainResourceForFrame: function(frameId)
+    {
+        // FIXME: Implement this to show the source code for the main resource of a given frame.
+    },
+
+    showResources: function()
+    {
+        WebInspector.inspectorView.setCurrentPanel(WebInspector.panels.resources);
+    },
+
     dispatch: function(signature)
     {
         if (WebInspector.panels) {
diff --git a/Source/WebCore/inspector/front-end/JavaScriptSourceFrame.js b/Source/WebCore/inspector/front-end/JavaScriptSourceFrame.js
index 32d7afff1..c8b9528ce 100644
--- a/Source/WebCore/inspector/front-end/JavaScriptSourceFrame.js
+++ b/Source/WebCore/inspector/front-end/JavaScriptSourceFrame.js
@@ -254,28 +254,51 @@ WebInspector.JavaScriptSourceFrame.prototype = {
         delete this._javaScriptSourceFrameState;
     },
 
-    // Popover callbacks
-    _shouldShowPopover: function(element)
+    _getPopoverAnchor: function(element, event)
     {
         if (!this._model.paused)
-            return false;
-        if (!element.enclosingNodeOrSelfWithClass("webkit-line-content"))
-            return false;
+            return null;
         if (window.getSelection().type === "Range")
-            return false;
+            return null;
+        var lineElement = element.enclosingNodeOrSelfWithClass("webkit-line-content");
+        if (!lineElement)
+            return null;
 
-        // We are interested in identifiers and "this" keyword.
-        if (element.hasStyleClass("webkit-javascript-keyword"))
-            return element.textContent === "this";
+        if (element.hasStyleClass("webkit-javascript-ident"))
+            return element;
 
-        return element.hasStyleClass("webkit-javascript-ident");
-    },
+        if (element.hasStyleClass("source-frame-token"))
+            return element;
 
-    _getPopoverAnchor: function(element)
-    {
-        if (!this._shouldShowPopover(element))
-            return;
-        return element;
+        // We are interested in identifiers and "this" keyword.
+        if (element.hasStyleClass("webkit-javascript-keyword"))
+            return element.textContent === "this" ? element : null;
+
+        if (element !== lineElement || lineElement.childElementCount)
+            return null;
+
+        // Handle non-highlighted case
+        // 1. Collect ranges of identifier suspects
+        var lineContent = lineElement.textContent;
+        var ranges = [];
+        var regex = new RegExp("[a-zA-Z_\$0-9]+", "g");
+        var match;
+        while (regex.lastIndex < lineContent.length && (match = regex.exec(lineContent)))
+            ranges.push({offset: match.index, length: regex.lastIndex - match.index});
+
+        // 2. 'highlight' them with artificial style to detect word boundaries
+        var changes = [];
+        highlightRangesWithStyleClass(lineElement, ranges, "source-frame-token", changes);
+        var lineOffsetLeft = lineElement.totalOffsetLeft();
+        for (var child = lineElement.firstChild; child; child = child.nextSibling) {
+            if (child.nodeType !== Node.ELEMENT_NODE || !child.hasStyleClass("source-frame-token"))
+                continue;
+            if (event.x > lineOffsetLeft + child.offsetLeft && event.x < lineOffsetLeft + child.offsetLeft + child.offsetWidth) {
+                var text = child.textContent;
+                return (text === "this" || !WebInspector.SourceJavaScriptTokenizer.Keywords[text]) ? child : null;
+            }
+        }
+        return null;
     },
 
     _resolveObjectForPopover: function(element, showCallback, objectGroupName)
@@ -328,7 +351,7 @@ WebInspector.JavaScriptSourceFrame.prototype = {
         // Collect tokens belonging to evaluated expression.
         var tokens = [ element ];
         var token = element.previousSibling;
-        while (token && (token.className === "webkit-javascript-ident" || token.className === "webkit-javascript-keyword" || token.textContent.trim() === ".")) {
+        while (token && (token.className === "webkit-javascript-ident" || token.className === "source-frame-token" || token.className === "webkit-javascript-keyword" || token.textContent.trim() === ".")) {
             tokens.push(token);
             token = token.previousSibling;
         }
diff --git a/Source/WebCore/inspector/front-end/MemoryStatistics.js b/Source/WebCore/inspector/front-end/MemoryStatistics.js
index 49bf9d451..d9d2fbcff 100644
--- a/Source/WebCore/inspector/front-end/MemoryStatistics.js
+++ b/Source/WebCore/inspector/front-end/MemoryStatistics.js
@@ -48,16 +48,20 @@ WebInspector.MemoryStatistics = function(timelinePanel, sidebarWidth)
     this._canvasContainer = this._memorySplitView.mainElement;
     this._canvas = this._canvasContainer.createChild("canvas", "fill");
     this._canvas.id = "memory-counters-graph";
-    this._memoryMarker = this._canvasContainer.createChild("div", "timeline-marker");
+    this._lastMarkerXPosition = 0;
 
     this._canvasContainer.addEventListener("mouseover", this._onMouseOver.bind(this), true);
-    this._canvasContainer.addEventListener("mousemove", this._onMouseOver.bind(this), true);
+    this._canvasContainer.addEventListener("mousemove", this._onMouseMove.bind(this), true);
+    this._canvasContainer.addEventListener("mouseout", this._onMouseOut.bind(this), true);
 
     // Populate sidebar
     this._counterSidebarElements = [];
-    this._domGroups = this._createCounterSidebarElement(WebInspector.UIString("DOM group count:"), true);
-    this._domNodes = this._createCounterSidebarElement(WebInspector.UIString("DOM node count:"), true);
-    this._listeners = this._createCounterSidebarElement(WebInspector.UIString("Event listener count:"), false);
+    this._documents = this._createCounterSidebarElement(WebInspector.UIString("Document count"), true);
+    this._domNodes = this._createCounterSidebarElement(WebInspector.UIString("DOM node count"), true);
+    this._listeners = this._createCounterSidebarElement(WebInspector.UIString("Event listener count"), false);
+
+    this._savedImageData = [];
+    this._graphColors = ["rgba(100,0,0,0.8)", "rgba(0,100,0,0.8)", "rgba(0,0,100,0.8)"];
 
     TimelineAgent.setIncludeMemoryDetails(true);
 }
@@ -111,9 +115,20 @@ WebInspector.MemoryStatistics.prototype = {
     _createCounterSidebarElement: function(title, showBottomBorder)
     {
         var container = this._memorySplitView.sidebarElement.createChild("div", "memory-counter-sidebar-info");
-        var value = container.createChild("p");
-        value.textContent = title;
-        container._value = value.createChild("span");
+        container.createChild("div", "title").textContent = title;
+
+        var currentValue = container.createChild("div", "counter-value");
+        currentValue.createChild("span").textContent = WebInspector.UIString("Current: ");
+        container._value = currentValue.createChild("span");
+
+        var minValue = container.createChild("div", "counter-value");
+        minValue.createChild("span").textContent = WebInspector.UIString("Min: ");
+        container._minValue = minValue.createChild("span");
+
+        var maxValue = container.createChild("div", "counter-value");
+        maxValue.createChild("span").textContent = WebInspector.UIString("Max: ");
+        container._maxValue = maxValue.createChild("span");
+
         if (showBottomBorder)
             container.addStyleClass("bottom-border-visible");
         this._counterSidebarElements.push(container);
@@ -122,28 +137,12 @@ WebInspector.MemoryStatistics.prototype = {
 
     addTimlineEvent: function(event)
     {
-        var time = event.data.endTime;
-        var domGroups = event.data["domGroups"];
-
-        var nodeCount = 0;
-        for (var i = 0; i < domGroups.length; i++) {
-            var counters = domGroups[i].nodeCount;
-            for (var j = 0; j < counters.length; j++)
-                nodeCount += counters[j].count;
-        }
-
-        var listenerCount = 0;
-        for (var i = 0; i < domGroups.length; i++) {
-            var counters = domGroups[i].listenerCount;
-            for (var j = 0; j < counters.length; j++)
-                listenerCount += counters[j].count;
-        }
-
+        var counters = event.data["counters"];
         this._counters.push({
-            time: time,
-            domGroupCount: domGroups.length,
-            nodeCount: nodeCount,
-            listenerCount: listenerCount
+            time: event.data.endTime || event.data.startTime,
+            documentCount: counters["documents"],
+            nodeCount: counters["nodes"],
+            listenerCount: counters["jsEventListeners"]
         });
     },
 
@@ -154,21 +153,20 @@ WebInspector.MemoryStatistics.prototype = {
         this._clear();
         var graphHeight = Math.round(this._canvas.height / 3);
 
-        function getGroupCount(entry)
+        function getDocumentCount(entry)
         {
-            return entry.domGroupCount;
+            return entry.documentCount;
         }
         this._setVerticalClip(0 * graphHeight + 2, graphHeight - 4);
-        this._drawPolyline(getGroupCount, "rgba(100,0,0,0.8)");
+        this._drawPolyline(getDocumentCount, this._graphColors[0], this._documents);
         this._drawBottomBound("rgba(20,20,20,0.8)");
 
-
         function getNodeCount(entry)
         {
             return entry.nodeCount;
         }
         this._setVerticalClip(1 * graphHeight + 2, graphHeight - 4);
-        this._drawPolyline(getNodeCount, "rgba(0,100,0,0.8)");
+        this._drawPolyline(getNodeCount, this._graphColors[1], this._domNodes);
         this._drawBottomBound("rgba(20,20,20,0.8)");
 
         function getListenerCount(entry)
@@ -176,7 +174,7 @@ WebInspector.MemoryStatistics.prototype = {
             return entry.listenerCount;
         }
         this._setVerticalClip(2 * graphHeight + 2, graphHeight - 4);
-        this._drawPolyline(getListenerCount, "rgba(0,0,100,0.8)");
+        this._drawPolyline(getListenerCount, this._graphColors[2], this._listeners);
     },
 
     _calculateVisibleIndexes: function()
@@ -184,31 +182,68 @@ WebInspector.MemoryStatistics.prototype = {
         var calculator = this._timelinePanel.calculator;
         var start = calculator.minimumBoundary * 1000;
         var end = calculator.maximumBoundary * 1000;
-        var firstIndex;
-        var lastIndex;
+        var firstIndex = 0;
+        var lastIndex = this._counters.length - 1;
         for (var i = 0; i < this._counters.length; i++) {
             var time = this._counters[i].time;
-            if (start <= time && time <= end) {
-                if (firstIndex === undefined)
-                    firstIndex = i;
+            if (time <= start) {
+                firstIndex = i;
+            } else {
+                if (end < time)
+                    break;
                 lastIndex = i;
             }
         }
+        // Maximum index of element whose time <= start.
         this._minimumIndex = firstIndex;
+
+        // Maximum index of element whose time <= end.
         this._maximumIndex = lastIndex;
+
+        // Current window bounds.
+        this._minTime = start;
+        this._maxTime = end;
+    },
+
+    _onMouseOut: function(event)
+    {
+        this._clearMarkers();
+        delete this._markerXPosition;
+
+        this._documents._value.textContent = "";
+        this._domNodes._value.textContent = "";
+        this._listeners._value.textContent = "";
     },
 
     _onMouseOver: function(event)
     {
+        this._onMouseMove(event);
+    },
+
+    _onMouseMove: function(event)
+    {
         var x = event.x - event.target.offsetParent.offsetLeft
-        this._memoryMarker.style.left = x + "px";
-        this._refreshCurrentValues(x);
+        this._markerXPosition = x;
+        this._refreshCurrentValues();
     },
 
-    _refreshCurrentValues: function(x)
+    _refreshCurrentValues: function()
     {
         if (!this._counters.length)
             return;
+        if (this._markerXPosition === undefined)
+            return;
+        var i = this._recordIndexAt(this._markerXPosition);
+
+        this._documents._value.textContent = this._counters[i].documentCount;
+        this._domNodes._value.textContent = this._counters[i].nodeCount;
+        this._listeners._value.textContent = this._counters[i].listenerCount;
+
+        this._highlightCurrentPositionOnGraphs(this._markerXPosition, i);
+    },
+
+    _recordIndexAt: function(x)
+    {
         var i;
         for (i = this._minimumIndex + 1; i <= this._maximumIndex; i++) {
             var statX = this._counters[i].x;
@@ -216,9 +251,47 @@ WebInspector.MemoryStatistics.prototype = {
                 break;
         }
         i--;
-        this._domGroups._value.textContent = this._counters[i].domGroupCount;
-        this._domNodes._value.textContent = this._counters[i].nodeCount;
-        this._listeners._value.textContent = this._counters[i].listenerCount;
+        return i;
+    },
+
+    _highlightCurrentPositionOnGraphs: function(x, index)
+    {
+        var ctx = this._canvas.getContext("2d");
+        this._clearMarkers();
+        var yValues = this._counters[index].yValues;
+        for (var i = 0; i < yValues.length; i++) {
+            var y = yValues[i];
+            ctx.beginPath();
+            const radius = 2;
+            this._saveImageUnderMarker(ctx, x, y, radius);
+            ctx.arc(x, y, radius, 0, Math.PI*2, true);
+            ctx.lineWidth = 1;
+            ctx.fillStyle = this._graphColors[i];
+            ctx.strokeStyle = this._graphColors[i];
+            ctx.fill();
+            ctx.stroke();
+            ctx.closePath();
+        }
+    },
+
+    _clearMarkers: function()
+    {
+        var ctx = this._canvas.getContext("2d");
+        for (var i = 0; i < this._savedImageData.length; i++) {
+            var entry = this._savedImageData[i];
+            ctx.putImageData(entry.imageData, entry.x, entry.y);
+        }
+        this._savedImageData = [];
+    },
+
+    _saveImageUnderMarker: function(ctx, x, y, radius)
+    {
+        const w = radius + 1;
+        var imageData = ctx.getImageData(x - w, y - w, 2 * w, 2 * w);
+        this._savedImageData.push({
+            x: x - w,
+            y: y - w,
+            imageData: imageData });
     },
 
     visible: function()
@@ -238,7 +311,7 @@ WebInspector.MemoryStatistics.prototype = {
     {
         this._updateSize();
         this._draw();
-        this._refreshCurrentValues(this._memoryMarker.offsetLeft);
+        this._refreshCurrentValues();
     },
 
     hide: function()
@@ -257,19 +330,16 @@ WebInspector.MemoryStatistics.prototype = {
         if (!this._counters.length)
             return;
 
-        var minTime = this._counters[this._minimumIndex].time;
-        var maxTime = this._counters[this._maximumIndex].time;
-
         var width = this._canvas.width;
-        var xFactor = width / (maxTime - minTime);
+        var xFactor = width / (this._maxTime - this._minTime);
 
         this._counters[this._minimumIndex].x = 0;
         for (var i = this._minimumIndex + 1; i < this._maximumIndex; i++)
-             this._counters[i].x = xFactor * (this._counters[i].time - minTime);
+             this._counters[i].x = xFactor * (this._counters[i].time - this._minTime);
         this._counters[this._maximumIndex].x = width;
     },
 
-    _drawPolyline: function(valueGetter, color)
+    _drawPolyline: function(valueGetter, color, section)
     {
         var canvas = this._canvas;
         var ctx = canvas.getContext("2d");
@@ -299,18 +369,26 @@ WebInspector.MemoryStatistics.prototype = {
                 maxValue = value;
         }
 
+        section._minValue.textContent = minValue;
+        section._maxValue.textContent = maxValue;
+
         var originalValue = valueGetter(this._counters[this._minimumIndex]);
 
-        var yFactor = height / (2 * Math.max(maxValue - originalValue, originalValue - minValue));
+        var maxYRange = Math.max(maxValue - originalValue, originalValue - minValue);
+        var yFactor = maxYRange ? height / (2 * maxYRange) : 0.5;
 
         ctx.beginPath();
-        ctx.moveTo(0, originY + height / 2);
+        var currentY = originY + height / 2;
+        ctx.moveTo(0, currentY);
         for (var i = this._minimumIndex; i <= this._maximumIndex; i++) {
              var x = this._counters[i].x;
-             var y = originY + (height / 2 - (valueGetter(this._counters[i])- originalValue) * yFactor);
-             ctx.lineTo(x, y);
+             ctx.lineTo(x, currentY);
+             currentY = originY + (height / 2 - (valueGetter(this._counters[i])- originalValue) * yFactor);
+             ctx.lineTo(x, currentY);
+
+             this._counters[i].yValues.push(currentY);
         }
-        ctx.lineTo(width, originY + (height / 2 - (valueGetter(this._counters[this._maximumIndex]) - originalValue) * yFactor));
+        ctx.lineTo(width, currentY);
         ctx.lineWidth = 1;
         ctx.strokeStyle = color;
         ctx.stroke();
@@ -335,9 +413,10 @@ WebInspector.MemoryStatistics.prototype = {
 
     _clear: function() {
         var ctx = this._canvas.getContext("2d");
-        ctx.fillStyle = "rgb(255,255,255)";
-        ctx.fillRect(0, 0, ctx.canvas.width, ctx.canvas.height);
-        ctx.fill();
+        ctx.clearRect(0, 0, ctx.canvas.width, ctx.canvas.height);
+        for (var i = this._minimumIndex; i <= this._maximumIndex; i++)
+             this._counters[i].yValues = [];
+        this._savedImageData = [];
     }
 }
 
diff --git a/Source/WebCore/inspector/front-end/ObjectPropertiesSection.js b/Source/WebCore/inspector/front-end/ObjectPropertiesSection.js
index a4eeee16d..20acf9133 100644
--- a/Source/WebCore/inspector/front-end/ObjectPropertiesSection.js
+++ b/Source/WebCore/inspector/front-end/ObjectPropertiesSection.js
@@ -43,6 +43,7 @@ WebInspector.ObjectPropertiesSection = function(object, title, subtitle, emptyPl
     this.extraProperties = extraProperties;
     this.treeElementConstructor = treeElementConstructor || WebInspector.ObjectPropertyTreeElement;
     this.editable = true;
+    this.skipProto = false;
 
     WebInspector.PropertiesSection.call(this, title, subtitle);
 }
@@ -85,6 +86,9 @@ WebInspector.ObjectPropertiesSection.prototype = {
         this.propertiesTreeOutline.removeChildren();
 
         for (var i = 0; i < properties.length; ++i) {
+            if (this.skipProto && properties[i].name === "__proto__")
+                continue;
+
             properties[i].parentObject = this.object;
             this.propertiesTreeOutline.appendChild(new rootTreeElementConstructor(properties[i]));
         }
diff --git a/Source/WebCore/inspector/front-end/Popover.js b/Source/WebCore/inspector/front-end/Popover.js
index fbb54f921..1a84c3033 100644
--- a/Source/WebCore/inspector/front-end/Popover.js
+++ b/Source/WebCore/inspector/front-end/Popover.js
@@ -48,6 +48,10 @@ WebInspector.Popover = function(popoverHelper)
 }
 
 WebInspector.Popover.prototype = {
+    /**
+     * @param {number=} preferredWidth
+     * @param {number=} preferredHeight
+     */
     show: function(contentElement, anchor, preferredWidth, preferredHeight)
     {
         if (this._disposed)
@@ -100,10 +104,16 @@ WebInspector.Popover.prototype = {
         this._disposed = true;
     },
 
+    setCanShrink: function(canShrink)
+    {
+        this._hasFixedHeight = !canShrink;
+        this._contentDiv.addStyleClass("fixed-height");
+    },
+
     _positionElement: function(anchorElement, preferredWidth, preferredHeight)
     {
         const borderWidth = 25;
-        const scrollerWidth = 11;
+        const scrollerWidth = this._hasFixedHeight ? 0 : 11;
         const arrowHeight = 15;
         const arrowOffset = 10;
         const borderRadius = 10;
@@ -125,15 +135,24 @@ WebInspector.Popover.prototype = {
             if (anchorBox.y > newElementPosition.height + arrowHeight + borderRadius)
                 newElementPosition.y = anchorBox.y - newElementPosition.height - arrowHeight;
             else {
-                newElementPosition.y = borderRadius * 2;
+                newElementPosition.y = borderRadius;
                 newElementPosition.height = anchorBox.y - borderRadius * 2 - arrowHeight;
+                if (this._hasFixedHeight && newElementPosition.height < preferredHeight) {
+                    newElementPosition.y = borderRadius;
+                    newElementPosition.height = preferredHeight;
+                }
             }
             verticalAlignment = "bottom";
         } else {
             // Positioning below the anchor.
             newElementPosition.y = anchorBox.y + anchorBox.height + arrowHeight;
-            if (newElementPosition.y + newElementPosition.height + arrowHeight - borderWidth >= totalHeight)
+            if (newElementPosition.y + newElementPosition.height + arrowHeight - borderWidth >= totalHeight) {
                 newElementPosition.height = totalHeight - anchorBox.y - anchorBox.height - borderRadius * 2 - arrowHeight;
+                if (this._hasFixedHeight && newElementPosition.height < preferredHeight) {
+                    newElementPosition.y = totalHeight - preferredHeight - borderRadius;
+                    newElementPosition.height = preferredHeight;
+                }
+            }
             // Align arrow.
             verticalAlignment = "top";
         }
@@ -148,6 +167,7 @@ WebInspector.Popover.prototype = {
             // Position arrow accurately.
             var arrowRightPosition = Math.max(0, totalWidth - anchorBox.x - anchorBox.width - borderRadius - arrowOffset);
             arrowRightPosition += anchorBox.width / 2;
+            arrowRightPosition = Math.min(arrowRightPosition, newElementPosition.width - borderRadius - arrowOffset);
             this._popupArrowElement.style.right = arrowRightPosition + "px";
         } else {
             newElementPosition.x = borderRadius;
@@ -226,7 +246,7 @@ WebInspector.PopoverHelper.prototype = {
         this._resetHoverTimer();
         if (event.which && this._disableOnClick)
             return;
-        this._hoverElement = this._getAnchor(event.target);
+        this._hoverElement = this._getAnchor(event.target, event);
         if (!this._hoverElement)
             return;
         const toolTipDelay = isMouseDown ? 0 : (this._popup ? this._timeout * 0.6 : this._timeout);
diff --git a/Source/WebCore/inspector/front-end/Resource.js b/Source/WebCore/inspector/front-end/Resource.js
index ca754d57e..040c83a16 100644
--- a/Source/WebCore/inspector/front-end/Resource.js
+++ b/Source/WebCore/inspector/front-end/Resource.js
@@ -49,6 +49,7 @@ WebInspector.MIMETypes = {
     "image/x-xbitmap":             {2: true},
     "font/ttf":                    {3: true},
     "font/opentype":               {3: true},
+    "font/woff":                   {3: true},
     "application/x-font-type1":    {3: true},
     "application/x-font-ttf":      {3: true},
     "application/x-font-woff":     {3: true},
diff --git a/Source/WebCore/inspector/front-end/ResourceUtils.js b/Source/WebCore/inspector/front-end/ResourceUtils.js
index c0a31bf52..501df10ea 100644
--- a/Source/WebCore/inspector/front-end/ResourceUtils.js
+++ b/Source/WebCore/inspector/front-end/ResourceUtils.js
@@ -190,7 +190,7 @@ WebInspector.formatLinkText = function(url, lineNumber)
 
 /**
  * @param {string} url
- * @param {number} lineNumber
+ * @param {number=} lineNumber
  * @param {string=} classes
  * @param {string=} tooltipText
  * @return {Element}
diff --git a/Source/WebCore/inspector/front-end/ResourcesPanel.js b/Source/WebCore/inspector/front-end/ResourcesPanel.js
index 7c6e6b167..219b01b75 100644
--- a/Source/WebCore/inspector/front-end/ResourcesPanel.js
+++ b/Source/WebCore/inspector/front-end/ResourcesPanel.js
@@ -52,6 +52,11 @@ WebInspector.ResourcesPanel = function(database)
     this.databasesListTreeElement = new WebInspector.StorageCategoryTreeElement(this, WebInspector.UIString("Databases"), "Databases", ["database-storage-tree-item"]);
     this.sidebarTree.appendChild(this.databasesListTreeElement);
 
+    if (WebInspector.experimentsSettings.showIndexedDB.isEnabled()) {
+        this.indexedDBListTreeElement = new WebInspector.IndexedDBTreeElement(this);
+        this.sidebarTree.appendChild(this.indexedDBListTreeElement);
+    }
+
     this.localStorageListTreeElement = new WebInspector.StorageCategoryTreeElement(this, WebInspector.UIString("Local Storage"), "LocalStorage", ["domstorage-storage-tree-item", "local-storage"]);
     this.sidebarTree.appendChild(this.localStorageListTreeElement);
 
@@ -456,6 +461,14 @@ WebInspector.ResourcesPanel.prototype = {
         this._innerShowView(view);
     },
 
+    /**
+     * @param {WebInspector.View} view
+     */
+    showIndexedDB: function(view)
+    {
+        this._innerShowView(view);
+    },
+
     showDOMStorage: function(domStorage)
     {
         if (!domStorage)
@@ -565,11 +578,11 @@ WebInspector.ResourcesPanel.prototype = {
     _populateApplicationCacheTree: function()
     {
         this._applicationCacheModel = new WebInspector.ApplicationCacheModel();
-        
+
         this._applicationCacheViews = {};
         this._applicationCacheFrameElements = {};
         this._applicationCacheManifestElements = {};
-        
+
         this._applicationCacheModel.addEventListener(WebInspector.ApplicationCacheModel.EventTypes.FrameManifestAdded, this._applicationCacheFrameManifestAdded, this);
         this._applicationCacheModel.addEventListener(WebInspector.ApplicationCacheModel.EventTypes.FrameManifestRemoved, this._applicationCacheFrameManifestRemoved, this);
 
@@ -934,7 +947,7 @@ WebInspector.BaseStorageTreeElement.prototype = {
     _updateTitle: function()
     {
         this._updateDisplayName();
-        
+
         if (!this.titleElement)
             return;
 
@@ -944,7 +957,7 @@ WebInspector.BaseStorageTreeElement.prototype = {
     _updateSubtitle: function()
     {
         this._updateDisplayName();
-        
+
         if (!this.titleElement)
             return;
 
@@ -1484,6 +1497,288 @@ WebInspector.DatabaseTableTreeElement.prototype.__proto__ = WebInspector.BaseSto
 
 /**
  * @constructor
+ * @extends {WebInspector.StorageCategoryTreeElement}
+ * @param {WebInspector.ResourcesPanel} storagePanel
+ */
+WebInspector.IndexedDBTreeElement = function(storagePanel)
+{
+    WebInspector.StorageCategoryTreeElement.call(this, storagePanel, WebInspector.UIString("IndexedDB"), "IndexedDB", ["indexed-db-storage-tree-item"]);
+}
+
+WebInspector.IndexedDBTreeElement.prototype = {
+    onexpand: function()
+    {
+        WebInspector.StorageCategoryTreeElement.prototype.onexpand.call(this);
+        if (!this._indexedDBModel)
+            this._createIndexedDBModel();
+    },
+
+    _createIndexedDBModel: function()
+    {
+        this._indexedDBModel = new WebInspector.IndexedDBModel();
+        this._idbDatabaseTreeElements = [];
+        this._indexedDBModel.addEventListener(WebInspector.IndexedDBModel.EventTypes.DatabaseAdded, this._indexedDBAdded, this);
+        this._indexedDBModel.addEventListener(WebInspector.IndexedDBModel.EventTypes.DatabaseRemoved, this._indexedDBRemoved, this);
+        this._indexedDBModel.addEventListener(WebInspector.IndexedDBModel.EventTypes.DatabaseLoaded, this._indexedDBLoaded, this);
+    },
+
+    refreshIndexedDB: function()
+    {
+        if (!this._indexedDBModel) {
+            this._createIndexedDBModel();
+            return;
+        }
+
+        this._indexedDBModel.refreshDatabaseNames();
+    },
+
+    /**
+     * @param {WebInspector.Event} event
+     */
+    _indexedDBAdded: function(event)
+    {
+        var databaseId = /** @type {WebInspector.IndexedDBModel.DatabaseId} */ event.data;
+
+        var idbDatabaseTreeElement = new WebInspector.IDBDatabaseTreeElement(this._storagePanel, this._indexedDBModel, databaseId);
+        this._idbDatabaseTreeElements.push(idbDatabaseTreeElement);
+        this.appendChild(idbDatabaseTreeElement);
+
+        this._indexedDBModel.refreshDatabase(databaseId);
+    },
+
+    /**
+     * @param {WebInspector.Event} event
+     */
+    _indexedDBRemoved: function(event)
+    {
+        var databaseId = /** @type {WebInspector.IndexedDBModel.DatabaseId} */ event.data;
+
+        var idbDatabaseTreeElement = this._idbDatabaseTreeElement(databaseId)
+        if (!idbDatabaseTreeElement)
+            return;
+
+        this.removeChild(idbDatabaseTreeElement);
+        this._idbDatabaseTreeElements.remove(idbDatabaseTreeElement);
+    },
+
+    /**
+     * @param {WebInspector.Event} event
+     */
+    _indexedDBLoaded: function(event)
+    {
+        var database = /** @type {WebInspector.IndexedDBModel.Database} */ event.data;
+
+        var idbDatabaseTreeElement = this._idbDatabaseTreeElement(database.databaseId)
+        if (!idbDatabaseTreeElement)
+            return;
+
+        idbDatabaseTreeElement.update(database);
+    },
+
+    /**
+     * @param {WebInspector.IndexedDBModel.DatabaseId} databaseId
+     * @return {WebInspector.IDBDatabaseTreeElement}
+     */
+    _idbDatabaseTreeElement: function(databaseId)
+    {
+        var index = -1;
+        for (var i = 0; i < this._idbDatabaseTreeElements.length; ++i) {
+            if (this._idbDatabaseTreeElements[i]._databaseId.equals(databaseId)) {
+                index = i;
+                break;
+            }
+        }
+        if (index !== -1)
+            return this._idbDatabaseTreeElements[i];
+        return null;
+    }
+}
+
+WebInspector.IndexedDBTreeElement.prototype.__proto__ = WebInspector.StorageCategoryTreeElement.prototype;
+
+/**
+ * @constructor
+ * @extends {WebInspector.BaseStorageTreeElement}
+ * @param {WebInspector.ResourcesPanel} storagePanel
+ * @param {WebInspector.IndexedDBModel} model
+ * @param {WebInspector.IndexedDBModel.DatabaseId} databaseId
+ */
+WebInspector.IDBDatabaseTreeElement = function(storagePanel, model, databaseId)
+{
+    WebInspector.BaseStorageTreeElement.call(this, storagePanel, null, databaseId.name + " - " + databaseId.securityOrigin, ["indexed-db-storage-tree-item"]);
+    this._model = model;
+    this._databaseId = databaseId;
+    this._idbObjectStoreTreeElements = {};
+}
+
+WebInspector.IDBDatabaseTreeElement.prototype = {
+    get itemURL()
+    {
+        return "indexedDB://" + this._databaseId.securityOrigin + "/" + this._databaseId.name;
+    },
+
+    /**
+     * @param {WebInspector.IndexedDBModel.Database} database
+     */
+    update: function(database)
+    {
+        this._database = database;
+        var objectStoreNames = {};
+        for (var objectStoreName in this._database.objectStores) {
+            var objectStore = this._database.objectStores[objectStoreName];
+            objectStoreNames[objectStore.name] = true;
+            if (!this._idbObjectStoreTreeElements[objectStore.name]) {
+                var idbObjectStoreTreeElement = new WebInspector.IDBObjectStoreTreeElement(this._storagePanel, this._model, this._databaseId, objectStore);
+                this._idbObjectStoreTreeElements[objectStore.name] = idbObjectStoreTreeElement;
+                this.appendChild(idbObjectStoreTreeElement);
+            }
+            this._idbObjectStoreTreeElements[objectStore.name].update(objectStore);
+        }
+        for (var objectStoreName in this._idbObjectStoreTreeElements) {
+            if (!objectStoreNames[objectStoreName]) {
+                this.removeChild(this._idbObjectStoreTreeElements[objectStoreName]);
+                delete this._idbObjectStoreTreeElements[objectStoreName];
+            }
+        }
+        
+        if (this.children.length) {
+            this.hasChildren = true;
+            this.expand();
+        }
+
+        if (this._view)
+            this._view.update(database);
+    },
+
+    onselect: function()
+    {
+        WebInspector.BaseStorageTreeElement.prototype.onselect.call(this);
+        if (!this._view)
+            this._view = new WebInspector.IDBDatabaseView(this._database);
+
+        this._storagePanel.showIndexedDB(this._view);        
+    }
+}
+
+WebInspector.IDBDatabaseTreeElement.prototype.__proto__ = WebInspector.BaseStorageTreeElement.prototype;
+
+/**
+ * @constructor
+ * @extends {WebInspector.BaseStorageTreeElement}
+ * @param {WebInspector.ResourcesPanel} storagePanel
+ * @param {WebInspector.IndexedDBModel} model
+ * @param {WebInspector.IndexedDBModel.DatabaseId} databaseId
+ * @param {WebInspector.IndexedDBModel.ObjectStore} objectStore
+ */
+WebInspector.IDBObjectStoreTreeElement = function(storagePanel, model, databaseId, objectStore)
+{
+    WebInspector.BaseStorageTreeElement.call(this, storagePanel, null, objectStore.name, ["indexed-db-object-store-storage-tree-item"]);
+    this._model = model;
+    this._databaseId = databaseId;
+    this._idbIndexTreeElements = {};
+}
+
+WebInspector.IDBObjectStoreTreeElement.prototype = {
+    get itemURL()
+    {
+        return "indexedDB://" + this._databaseId.securityOrigin + "/" + this._databaseId.name + "/" + this._objectStore.name;
+    },
+
+   /**
+     * @param {WebInspector.IndexedDBModel.ObjectStore} objectStore
+     */
+    update: function(objectStore)
+    {
+        this._objectStore = objectStore;
+
+        var indexNames = {};
+        for (var indexName in this._objectStore.indexes) {
+            var index = this._objectStore.indexes[indexName];
+            indexNames[index.name] = true;
+            if (!this._idbIndexTreeElements[index.name]) {
+                var idbIndexTreeElement = new WebInspector.IDBIndexTreeElement(this._storagePanel, this._model, this._databaseId, this._objectStore, index);
+                this._idbIndexTreeElements[index.name] = idbIndexTreeElement;
+                this.appendChild(idbIndexTreeElement);
+            }
+            this._idbIndexTreeElements[index.name].update(index);
+        }
+        for (var indexName in this._idbIndexTreeElements) {
+            if (!indexNames[indexName]) {
+                this.removeChild(this._idbIndexTreeElements[indexName]);
+                delete this._idbIndexTreeElements[indexName];
+            }
+        }
+        
+        if (this.children.length) {
+            this.hasChildren = true;
+            this.expand();
+        }
+
+        if (this._view)
+            this._view.update(this._objectStore);
+    },
+
+    onselect: function()
+    {
+        WebInspector.BaseStorageTreeElement.prototype.onselect.call(this);
+        if (!this._view)
+            this._view = new WebInspector.IDBDataView(this._model, this._databaseId, this._objectStore, null);
+
+        this._storagePanel.showIndexedDB(this._view);        
+    }
+}
+
+WebInspector.IDBObjectStoreTreeElement.prototype.__proto__ = WebInspector.BaseStorageTreeElement.prototype;
+
+/**
+ * @constructor
+ * @extends {WebInspector.BaseStorageTreeElement}
+ * @param {WebInspector.ResourcesPanel} storagePanel
+ * @param {WebInspector.IndexedDBModel} model
+ * @param {WebInspector.IndexedDBModel.DatabaseId} databaseId
+ * @param {WebInspector.IndexedDBModel.ObjectStore} objectStore
+ * @param {WebInspector.IndexedDBModel.Index} index
+ */
+WebInspector.IDBIndexTreeElement = function(storagePanel, model, databaseId, objectStore, index)
+{
+    WebInspector.BaseStorageTreeElement.call(this, storagePanel, null, index.name, ["indexed-db-index-storage-tree-item"]);
+    this._model = model;
+    this._databaseId = databaseId;
+    this._objectStore = objectStore;
+    this._index = index;
+}
+
+WebInspector.IDBIndexTreeElement.prototype = {
+    get itemURL()
+    {
+        return "indexedDB://" + this._databaseId.securityOrigin + "/" + this._databaseId.name + "/" + this._objectStore.name + "/" + this._index.name;
+    },
+
+    /**
+     * @param {WebInspector.IndexedDBModel.Index} index
+     */
+    update: function(index)
+    {
+        this._index = index;
+        
+        if (this._view)
+            this._view.update(this._index);
+    },
+
+    onselect: function()
+    {
+        WebInspector.BaseStorageTreeElement.prototype.onselect.call(this);
+        if (!this._view)
+            this._view = new WebInspector.IDBDataView(this._model, this._databaseId, this._objectStore, this._index);
+
+        this._storagePanel.showIndexedDB(this._view);        
+    }
+}
+
+WebInspector.IDBIndexTreeElement.prototype.__proto__ = WebInspector.BaseStorageTreeElement.prototype;
+
+/**
+ * @constructor
  * @extends {WebInspector.BaseStorageTreeElement}
  */
 WebInspector.DOMStorageTreeElement = function(storagePanel, domStorage, className)
diff --git a/Source/WebCore/inspector/front-end/ScriptsNavigator.js b/Source/WebCore/inspector/front-end/ScriptsNavigator.js
index dad448ad7..0046517f5 100644
--- a/Source/WebCore/inspector/front-end/ScriptsNavigator.js
+++ b/Source/WebCore/inspector/front-end/ScriptsNavigator.js
@@ -31,19 +31,21 @@
  * @extends {WebInspector.Object}
  * @constructor
  */
-WebInspector.ScriptsNavigator = function(presentationModel)
+WebInspector.ScriptsNavigator = function()
 {
     WebInspector.Object.call(this);
     
     this._tabbedPane = new WebInspector.TabbedPane();
     this._tabbedPane.shrinkableTabs = true;
 
-    this._presentationModel = presentationModel;
-
     this._tabbedPane.element.id = "scripts-navigator-tabbed-pane";
+    
+    this._tabbedPane.element.tabIndex = 0;
+    this._tabbedPane.element.addEventListener("focus", this.focus.bind(this), false);
   
     this._treeSearchBox = document.createElement("div");
     this._treeSearchBox.id = "scripts-navigator-tree-search-box";
+    this._tabbedPane.element.appendChild(this._treeSearchBox);
 
     this._navigatorScriptsTreeElement = document.createElement("ol");
     var scriptsView = new WebInspector.View();
@@ -67,9 +69,6 @@ WebInspector.ScriptsNavigator = function(presentationModel)
     this._scriptTreeElementsByUISourceCode = new Map();
     
     WebInspector.settings.showScriptFolders.addChangeListener(this._showScriptFoldersSettingChanged.bind(this));
-    
-    WebInspector.debuggerModel.addEventListener(WebInspector.DebuggerModel.Events.DebuggerWasDisabled, this._reset, this);
-    this._presentationModel.addEventListener(WebInspector.DebuggerPresentationModel.Events.DebuggerReset, this._reset, this);
 }
 
 WebInspector.ScriptsNavigator.ScriptsTab = "scripts";
@@ -85,12 +84,35 @@ WebInspector.ScriptsNavigator.prototype = {
     },
 
     /**
+     * @type {WebInspector.View}
+     */
+    get view()
+    {
+        return this._tabbedPane;
+    },
+
+    /**
+     * @type {Element}
+     */
+    get element()
+    {
+        return this._tabbedPane.element;
+    },
+
+    /**
      * @param {Element} element
      */
     show: function(element)
     {
         this._tabbedPane.show(element);
-        element.appendChild(this._treeSearchBox);
+    },
+
+    focus: function()
+    {
+        if (this._tabbedPane.selectedTabId === WebInspector.ScriptsNavigator.ScriptsTab)
+            WebInspector.setCurrentFocusElement(this._navigatorScriptsTreeElement);
+        else
+            WebInspector.setCurrentFocusElement(this._navigatorContentScriptsTreeElement);
     },
 
     /**
@@ -195,20 +217,22 @@ WebInspector.ScriptsNavigator.prototype = {
             }
             treeElement = parent;
         }
+        this._scriptTreeElementsByUISourceCode.remove(uiSourceCode);
     },
     
     _showScriptFoldersSettingChanged: function()
     {
         var uiSourceCodes = this._navigatorScriptsTree.scriptTreeElements();
         uiSourceCodes = uiSourceCodes.concat(this._navigatorContentScriptsTree.scriptTreeElements());
-        this._reset();
+        this.reset();
         for (var i = 0; i < uiSourceCodes.length; ++i)
             this.addUISourceCode(uiSourceCodes[i]);
         
-        this.revealUISourceCode(this._lastSelectedUISourceCode);
+        if (this._lastSelectedUISourceCode)
+            this.revealUISourceCode(this._lastSelectedUISourceCode);
     },
     
-    _reset: function()
+    reset: function()
     {
         this._navigatorScriptsTree.stopSearch();
         this._navigatorScriptsTree.removeChildren();
diff --git a/Source/WebCore/inspector/front-end/ScriptsPanel.js b/Source/WebCore/inspector/front-end/ScriptsPanel.js
index 43325c00b..cd93e9ead 100644
--- a/Source/WebCore/inspector/front-end/ScriptsPanel.js
+++ b/Source/WebCore/inspector/front-end/ScriptsPanel.js
@@ -60,29 +60,33 @@ WebInspector.ScriptsPanel = function(presentationModel)
     this.debugSidebarResizeWidgetElement.id = "scripts-debug-sidebar-resizer-widget";
     this.splitView.installResizer(this.debugSidebarResizeWidgetElement);
 
-    if (WebInspector.experimentsSettings.useScriptsNavigator.isEnabled()) {
+    WebInspector.settings.useScriptsNavigator = WebInspector.settings.createSetting("useScriptsNavigator", true);
+    if (WebInspector.settings.useScriptsNavigator.get()) {
         const initialNavigatorWidth = 225;
         const minimalViewsContainerWidthPercent = 50;
         this.editorView = new WebInspector.SplitView(WebInspector.SplitView.SidebarPosition.Left, "scriptsPanelNavigatorSidebarWidth", initialNavigatorWidth);
+        this.editorView.element.id = "scripts-editor-view";
 
         this.editorView.minimalSidebarWidth = Preferences.minScriptsSidebarWidth;
         this.editorView.minimalMainWidthPercent = minimalViewsContainerWidthPercent;
         this.editorView.show(this.splitView.mainElement);
 
-        this._fileSelector = new WebInspector.ScriptsNavigator(this._presentationModel);
-
+        this._navigator = new WebInspector.ScriptsNavigator();
+        this._navigatorView = this._navigator.view;
+        this._fileSelector = this._navigator;
         this._fileSelector.show(this.editorView.sidebarElement);
 
-        this._navigatorResizeWidgetElement = document.createElement("div");
-        this._navigatorResizeWidgetElement.id = "scripts-navigator-resizer-widget";
-        this.editorView.installResizer(this._navigatorResizeWidgetElement);
-        this.editorView.sidebarElement.appendChild(this._navigatorResizeWidgetElement);
-
-        this._editorContainer = new WebInspector.TabbedEditorContainer(this);
+        this._tabbedEditorContainer = new WebInspector.TabbedEditorContainer(this);
+        this._editorContainer = this._tabbedEditorContainer;
         this._editorContainer.show(this.editorView.mainElement);
         WebInspector.OpenResourceDialog.install(this, this._presentationModel, this.editorView.mainElement);
+
+        this._createNavigatorControls();
+        WebInspector.settings.navigatorHidden = WebInspector.settings.createSetting("navigatorHidden", true);
+        if (WebInspector.settings.navigatorHidden.get())
+            this._toggleNavigator();
     } else {
-        this._fileSelector = new WebInspector.ScriptsPanel.ComboBoxFileSelector(this._presentationModel);
+        this._fileSelector = new WebInspector.ScriptsPanel.ComboBoxFileSelector();
         this._fileSelector.show(this.splitView.mainElement);
 
         this._editorContainer = new WebInspector.ScriptsPanel.SingleFileEditorContainer(this);
@@ -115,7 +119,7 @@ WebInspector.ScriptsPanel = function(presentationModel)
 
     this._debugSidebarContentsElement = document.createElement("div");
     this._debugSidebarContentsElement.id = "scripts-debug-sidebar-contents";
-    this.sidebarElement.appendChild(this._debugSidebarContentsElement);    
+    this.sidebarElement.appendChild(this._debugSidebarContentsElement);
 
     for (var pane in this.sidebarPanes)
         this._debugSidebarContentsElement.appendChild(this.sidebarPanes[pane].element);
@@ -179,13 +183,13 @@ WebInspector.ScriptsPanel = function(presentationModel)
     this._presentationModel.addEventListener(WebInspector.DebuggerPresentationModel.Events.ConsoleCommandEvaluatedInSelectedCallFrame, this._consoleCommandEvaluatedInSelectedCallFrame, this);
     this._presentationModel.addEventListener(WebInspector.DebuggerPresentationModel.Events.ExecutionLineChanged, this._executionLineChanged, this);
     this._presentationModel.addEventListener(WebInspector.DebuggerPresentationModel.Events.DebuggerReset, this._reset.bind(this, false));
-    
+
     var enableDebugger = !Capabilities.debuggerCausesRecompilation || WebInspector.settings.debuggerEnabled.get();
     if (enableDebugger)
         WebInspector.debuggerModel.enableDebugger();
 
     WebInspector.advancedSearchController.registerSearchScope(new WebInspector.ScriptsSearchScope());
-    
+
     this._sourceFramesByUISourceCode = new Map();
 }
 
@@ -223,6 +227,8 @@ WebInspector.ScriptsPanel.prototype = {
         if (Capabilities.nativeInstrumentationEnabled)
             this._debugSidebarContentsElement.insertBefore(this.sidebarPanes.domBreakpoints.element, this.sidebarPanes.xhrBreakpoints.element);
         this.sidebarPanes.watchExpressions.show();
+
+        window.setTimeout(this._maybeShowNavigatorOverlay.bind(this), 0);
     },
 
     breakpointsActivated: function()
@@ -255,6 +261,15 @@ WebInspector.ScriptsPanel.prototype = {
             // Anonymous sources are shown only when stepping.
             return;
         }
+
+        this._addUISourceCode(uiSourceCode);
+    },
+
+    /**
+     * @param {WebInspector.UISourceCode} uiSourceCode
+     */
+    _addUISourceCode: function(uiSourceCode)
+    {
         this._fileSelector.addUISourceCode(uiSourceCode);
         this._editorContainer.uiSourceCodeAdded(uiSourceCode);
     },
@@ -405,6 +420,7 @@ WebInspector.ScriptsPanel.prototype = {
         this._debuggerResumed();
 
         delete this._currentUISourceCode;
+        this._fileSelector.reset();
         this._editorContainer.reset();
         this._updateScriptViewStatusBarItems();
 
@@ -422,7 +438,7 @@ WebInspector.ScriptsPanel.prototype = {
     _updateScriptViewStatusBarItems: function()
     {
         this._scriptViewStatusBarItemsContainer.removeChildren();
-        
+
         var sourceFrame = this.visibleView;
         if (sourceFrame) {
             var statusBarItems = sourceFrame.statusBarItems || [];
@@ -600,7 +616,7 @@ WebInspector.ScriptsPanel.prototype = {
             return;
 
         // Anonymous scripts are not added to files select by default.
-        this._fileSelector.addUISourceCode(uiLocation.uiSourceCode);
+        this._addUISourceCode(uiLocation.uiSourceCode);
 
         var sourceFrame = this._showFile(uiLocation.uiSourceCode);
         sourceFrame.setExecutionLine(uiLocation.lineNumber);
@@ -631,9 +647,9 @@ WebInspector.ScriptsPanel.prototype = {
 
         if (this._currentUISourceCode === uiSourceCode)
             delete this._currentUISourceCode;
-        
+
         // We don't need to update file selector here regardless of whether useScriptsNavigator is set or not:
-        // SingleFileEditorContainer never dispatches EditorClosed, so no need to update ComboBoxFileSelector; 
+        // SingleFileEditorContainer never dispatches EditorClosed, so no need to update ComboBoxFileSelector;
         // ScriptsNavigator does not need to update on EditorClosed.
 
         this._updateScriptViewStatusBarItems();
@@ -647,6 +663,8 @@ WebInspector.ScriptsPanel.prototype = {
 
     _fileSelected: function(event)
     {
+        if (this._navigatorOverlayShown)
+            this._hideNavigatorOverlay();
         var uiSourceCode = /** @type {WebInspector.UISourceCode} */ event.data;
         this._showFile(uiSourceCode);
     },
@@ -897,7 +915,7 @@ WebInspector.ScriptsPanel.prototype = {
         shortcuts.push(WebInspector.KeyboardShortcut.makeDescriptor(WebInspector.KeyboardShortcut.Keys.Semicolon, WebInspector.KeyboardShortcut.Modifiers.Shift | platformSpecificModifier));
         this.stepOutButton = this._createButtonAndRegisterShortcuts("scripts-step-out", title, handler, shortcuts, WebInspector.UIString("Step out"));
         debugToolbar.appendChild(this.stepOutButton);
-        
+
         this.toggleBreakpointsButton = new WebInspector.StatusBarButton(WebInspector.UIString("Deactivate all breakpoints."), "toggle-breakpoints");
         this.toggleBreakpointsButton.toggled = true;
         this.toggleBreakpointsButton.addEventListener("click", this._toggleBreakpointsClicked, this);
@@ -906,10 +924,129 @@ WebInspector.ScriptsPanel.prototype = {
         this.debuggerStatusElement = document.createElement("div");
         this.debuggerStatusElement.id = "scripts-debugger-status";
         debugToolbar.appendChild(this.debuggerStatusElement);
-        
+
         return debugToolbar;
     },
 
+    _createNavigatorControls: function()
+    {
+        this._navigatorSidebarResizeWidgetElement = document.createElement("div");
+        this._navigatorSidebarResizeWidgetElement.addStyleClass("scripts-navigator-resizer-widget");
+        this.editorView.installResizer(this._navigatorSidebarResizeWidgetElement);
+        this._navigatorView.element.appendChild(this._navigatorSidebarResizeWidgetElement);
+
+        this._navigatorShowHideButton = this._createNavigatorControlButton(WebInspector.UIString("Show scripts navigator"), "scripts-navigator-show-hide-button", this._toggleNavigator.bind(this));
+        this._navigatorShowHideButton.addStyleClass("toggled-on");
+        this._navigatorShowHideButton.title = WebInspector.UIString("Hide scripts navigator");
+        this.editorView.element.appendChild(this._navigatorShowHideButton);
+
+        this._navigatorPinButton = this._createNavigatorControlButton(WebInspector.UIString("Pin scripts navigator"), "scripts-navigator-pin-button", this._pinNavigator.bind(this));
+        this._navigatorPinButton.addStyleClass("hidden");
+        this._navigatorView.element.appendChild(this._navigatorPinButton);
+    },
+
+    _createNavigatorControlButton: function(title, id, listener)
+    {
+        var button = document.createElement("button");
+        button.title = title;
+        button.id = id;
+        button.addStyleClass("scripts-navigator-control-button");
+        button.addEventListener("click", listener, false);
+        button.createChild("div", "glyph");
+        return button;
+    },
+
+    _maybeShowNavigatorOverlay: function()
+    {
+        if (this._navigator && WebInspector.settings.navigatorHidden.get() && !this._navigatorWasOnceHidden)
+            this._showNavigatorOverlay();
+    },
+
+    _toggleNavigator: function()
+    {
+        if (this._navigatorOverlayShown)
+            this._hideNavigatorOverlay();
+        else if (this._navigatorHidden)
+            this._showNavigatorOverlay();
+        else
+            this._hidePinnedNavigator();
+    },
+
+    _hidePinnedNavigator: function()
+    {
+        this._navigatorHidden = true;
+        this._navigatorShowHideButton.removeStyleClass("toggled-on");
+        this._navigatorShowHideButton.title = WebInspector.UIString("Show scripts navigator");
+        this._tabbedEditorContainer.element.addStyleClass("navigator-hidden");
+        this._navigatorSidebarResizeWidgetElement.addStyleClass("hidden");
+
+        this._navigatorPinButton.removeStyleClass("hidden");
+
+        this.editorView.hideSidebarElement();
+        this._navigatorView.detach();
+        WebInspector.settings.navigatorHidden.set(true);
+    },
+
+    _pinNavigator: function()
+    {
+        delete this._navigatorHidden;
+        this._hideNavigatorOverlay();
+
+        this._navigatorPinButton.addStyleClass("hidden");
+        this._navigatorShowHideButton.addStyleClass("toggled-on");
+        this._navigatorShowHideButton.title = WebInspector.UIString("Hide scripts navigator");
+
+        this._tabbedEditorContainer.element.removeStyleClass("navigator-hidden");
+        this._navigatorSidebarResizeWidgetElement.removeStyleClass("hidden");
+
+        this.editorView.showSidebarElement();
+        this._navigator.show(this.editorView.sidebarElement);
+        this._navigator.focus();
+        WebInspector.settings.navigatorHidden.set(false);
+    },
+
+    _showNavigatorOverlay: function()
+    {
+        if (this._navigatorOverlayShown)
+            return;
+
+        this._navigatorOverlayShown = true;
+        var sidebarOverlay = new WebInspector.SidebarOverlay(this._navigatorView, "scriptsPanelNavigatorOverlayWidth", Preferences.minScriptsSidebarWidth);
+        sidebarOverlay.addEventListener(WebInspector.SidebarOverlay.EventTypes.WasShown, this._navigatorOverlayWasShown, this);
+        sidebarOverlay.addEventListener(WebInspector.SidebarOverlay.EventTypes.WillHide, this._navigatorOverlayWillHide, this);
+
+        var navigatorOverlayResizeWidgetElement = document.createElement("div");
+        navigatorOverlayResizeWidgetElement.addStyleClass("scripts-navigator-resizer-widget");
+        sidebarOverlay.resizerWidgetElement = navigatorOverlayResizeWidgetElement;
+
+        sidebarOverlay.start(this.editorView.element);
+    },
+
+    _hideNavigatorOverlay: function()
+    {
+        if (!this._navigatorOverlayShown)
+            return;
+
+        WebInspector.Dialog.hide();
+    },
+
+    _navigatorOverlayWasShown: function(event)
+    {
+        this._navigatorView.element.appendChild(this._navigatorShowHideButton);
+        this._navigatorShowHideButton.addStyleClass("toggled-on");
+        this._navigatorShowHideButton.title = WebInspector.UIString("Hide scripts navigator");
+        this._navigator.focus();
+    },
+
+    _navigatorOverlayWillHide: function(event)
+    {
+        delete this._navigatorOverlayShown;
+        this._navigatorWasOnceHidden = true;
+        this.editorView.element.appendChild(this._navigatorShowHideButton);
+        this._navigatorShowHideButton.removeStyleClass("toggled-on");
+        this._navigatorShowHideButton.title = WebInspector.UIString("Show scripts navigator");
+    },
+
     _createButtonAndRegisterShortcuts: function(buttonId, buttonTitle, handler, shortcuts, shortcutDescription)
     {
         var button = document.createElement("button");
@@ -1047,7 +1184,7 @@ WebInspector.ScriptsPanel.FileSelector.prototype = {
      * @return {boolean}
      */
     isScriptSourceAdded: function(uiSourceCode) { },
-    
+
     /**
      * @param {WebInspector.UISourceCode} uiSourceCode
      */
@@ -1063,7 +1200,9 @@ WebInspector.ScriptsPanel.FileSelector.prototype = {
      * @param {Array.<WebInspector.UISourceCode>} oldUISourceCodeList
      * @param {Array.<WebInspector.UISourceCode>} uiSourceCodeList
      */
-    replaceUISourceCodes: function(oldUISourceCodeList, uiSourceCodeList) { }
+    replaceUISourceCodes: function(oldUISourceCodeList, uiSourceCodeList) { },
+
+    reset: function() { }
 }
 
 /**
@@ -1108,7 +1247,7 @@ WebInspector.EditorContainer.prototype = {
      * @param {Array.<WebInspector.UISourceCode>} uiSourceCodeList
      */
     replaceFiles: function(oldUISourceCodeList, uiSourceCodeList) { },
-    
+
     reset: function() { }
 }
 
@@ -1130,16 +1269,13 @@ WebInspector.EditorContainerDelegate.prototype = {
  * @extends {WebInspector.Object}
  * @constructor
  */
-WebInspector.ScriptsPanel.ComboBoxFileSelector = function(presentationModel)
+WebInspector.ScriptsPanel.ComboBoxFileSelector = function()
 {
     WebInspector.Object.call(this);
     this.editorToolbar = this._createEditorToolbar();
-    
-    this._presentationModel = presentationModel;
+
     WebInspector.settings.showScriptFolders.addChangeListener(this._showScriptFoldersSettingChanged.bind(this));
-    WebInspector.debuggerModel.addEventListener(WebInspector.DebuggerModel.Events.DebuggerWasDisabled, this._reset, this);
-    this._presentationModel.addEventListener(WebInspector.DebuggerPresentationModel.Events.DebuggerReset, this._reset, this);
-    
+
     this._backForwardList = [];
 }
 
@@ -1156,7 +1292,7 @@ WebInspector.ScriptsPanel.ComboBoxFileSelector.prototype = {
     {
         element.appendChild(this.editorToolbar);
     },
-    
+
     /**
      * @param {WebInspector.UISourceCode} uiSourceCode
      */
@@ -1164,7 +1300,7 @@ WebInspector.ScriptsPanel.ComboBoxFileSelector.prototype = {
     {
         if (uiSourceCode._option)
             return;
-        
+
         this._addOptionToFilesSelect(uiSourceCode);
     },
 
@@ -1186,7 +1322,7 @@ WebInspector.ScriptsPanel.ComboBoxFileSelector.prototype = {
             return;
         this._innerRevealUISourceCode(uiSourceCode, true);
     },
-    
+
     /**
      * @param {WebInspector.UISourceCode} uiSourceCode
      * @param {boolean} addToHistory
@@ -1198,12 +1334,12 @@ WebInspector.ScriptsPanel.ComboBoxFileSelector.prototype = {
 
         if (addToHistory)
             this._addToHistory(uiSourceCode);
-        
+
         this._updateBackAndForwardButtons();
         this._filesSelectElement.selectedIndex = uiSourceCode._option.index;
         this.dispatchEventToListeners(WebInspector.ScriptsPanel.FileSelector.Events.FileSelected, uiSourceCode);
     },
-    
+
     /**
      * @param {WebInspector.UISourceCode} uiSourceCode
      */
@@ -1238,25 +1374,25 @@ WebInspector.ScriptsPanel.ComboBoxFileSelector.prototype = {
             if (!option)
                 continue;
             added = true;
-            
+
             // FIXME: find out why we are getting here with option detached.
             if (this._filesSelectElement === option.parentElement)
                 this._filesSelectElement.removeChild(option);
-            
+
             if (selectedUISourceCode === oldUISourceCodeList[i])
                 selected = true;
         }
-            
+
         if (!added)
             return;
-        
+
         for (var i = 0; i < uiSourceCodeList.length; ++i)
             this._addOptionToFilesSelect(uiSourceCodeList[i]);
 
         if (selected)
             this._filesSelectElement.selectedIndex = uiSourceCodeList[0]._option.index;
     },
-    
+
     _showScriptFoldersSettingChanged: function()
     {
         var selectedOption = this._filesSelectElement[this._filesSelectElement.selectedIndex];
@@ -1275,8 +1411,8 @@ WebInspector.ScriptsPanel.ComboBoxFileSelector.prototype = {
                 this._filesSelectElement.selectedIndex = index;
         }
     },
-    
-    _reset: function()
+
+    reset: function()
     {
         this._backForwardList = [];
         this._currentBackForwardIndex = -1;
@@ -1534,11 +1670,11 @@ WebInspector.ScriptsPanel.SingleFileEditorContainer.prototype = {
             this._currentSourceFrame.detach();
 
         this._initialViewSelectionProcessed = true;
-        
+
         var sourceFrame = this._delegate.viewForFile(uiSourceCode);
         this._currentSourceFrame = sourceFrame;
         this._currentFile = uiSourceCode;
-        
+
         if (userGesture) {
             this._userSelectedFiles = true;
             WebInspector.settings.lastViewedScriptFile.set(uiSourceCode.url);
diff --git a/Source/WebCore/inspector/front-end/Settings.js b/Source/WebCore/inspector/front-end/Settings.js
index 68bc38b3a..fba3c0f25 100644
--- a/Source/WebCore/inspector/front-end/Settings.js
+++ b/Source/WebCore/inspector/front-end/Settings.js
@@ -89,6 +89,7 @@ WebInspector.Settings = function()
     this.showScriptFolders = this.createSetting("showScriptFolders", true);
     this.dockToRight = this.createSetting("dockToRight", false);
     this.emulateTouchEvents = this.createSetting("emulateTouchEvents", false);
+    this.showPaintRects = this.createSetting("showPaintRects", false);
 
     // If there are too many breakpoints in a storage, it is likely due to a recent bug that caused
     // periodical breakpoints duplication leading to inspector slowness.
@@ -134,19 +135,23 @@ WebInspector.Setting.prototype = {
 
     get: function()
     {
-        var value = this._defaultValue;
+        if (typeof this._value !== "undefined")
+            return this._value;
+
+        this._value = this._defaultValue;
         if (window.localStorage != null && this._name in window.localStorage) {
             try {
-                value = JSON.parse(window.localStorage[this._name]);
+                this._value = JSON.parse(window.localStorage[this._name]);
             } catch(e) {
                 window.localStorage.removeItem(this._name);
             }
         }
-        return value;
+        return this._value;
     },
 
     set: function(value)
     {
+        this._value = value;
         if (window.localStorage != null) {
             try {
                 window.localStorage[this._name] = JSON.stringify(value);
@@ -168,12 +173,12 @@ WebInspector.ExperimentsSettings = function()
     this._enabledForTest = {};
     
     // Add currently running experiments here.
-    // FIXME: Move out from experiments once navigator is production-ready.
-    this.useScriptsNavigator = this._createExperiment("useScriptsNavigator", "Use file navigator and tabbed editor container in scripts panel");
     this.sourceFrameAlwaysEditable = this._createExperiment("sourceFrameAlwaysEditable", "Make resources always editable");
-    this.freeFlowDOMEditing = this._createExperiment("freeFlowDOMEditing", "Enable free flow DOM editing");
     this.showMemoryCounters = this._createExperiment("showMemoryCounters", "Show memory counters in Timeline panel");
-    this.singleClickEditing = this._createExperiment("singleClickEditing", "Single click CSS editing");
+    this.timelineStartAtZero = this._createExperiment("timelineStartAtZero", "Enable start at zero mode in Timeline panel");
+    // FIXME: Enable http/tests/inspector/indexeddb/resources-panel.html when removed from experiments.
+    this.showIndexedDB = this._createExperiment("showIndexedDB", "Show IndexedDB in Resources panel");
+    this.debugCSS = this._createExperiment("debugCSS", "Load CSS via link tags for debugging");
 
     this._cleanUpSetting();
 }
diff --git a/Source/WebCore/inspector/front-end/SettingsScreen.js b/Source/WebCore/inspector/front-end/SettingsScreen.js
index 8d8eac08a..f92fb1e9b 100644
--- a/Source/WebCore/inspector/front-end/SettingsScreen.js
+++ b/Source/WebCore/inspector/front-end/SettingsScreen.js
@@ -47,6 +47,10 @@ WebInspector.SettingsScreen = function()
         if (Preferences.exposeDisableCache)
             p.appendChild(this._createCheckboxSetting(WebInspector.UIString("Disable cache"), WebInspector.settings.cacheDisabled));
     }
+    
+    p = this._appendSection(WebInspector.UIString("Rendering"));
+    p.appendChild(this._createCheckboxSetting(WebInspector.UIString("Show paint rectangles"), WebInspector.settings.showPaintRects));
+    WebInspector.settings.showPaintRects.addChangeListener(this._showPaintRectsChanged, this);
 
     p = this._appendSection(WebInspector.UIString("Elements"));
     p.appendChild(this._createCheckboxSetting(WebInspector.UIString("Word wrap"), WebInspector.settings.domWordWrap));
@@ -72,6 +76,7 @@ WebInspector.SettingsScreen = function()
     p.appendChild(this._createCheckboxSetting(WebInspector.UIString("Emulate touch events"), WebInspector.settings.emulateTouchEvents));
 
     p = this._appendSection(WebInspector.UIString("Scripts"), true);
+    p.appendChild(this._createCheckboxSetting(WebInspector.UIString("Use file navigator and tabbed editor container in scripts panel"), WebInspector.settings.useScriptsNavigator));
     p.appendChild(this._createCheckboxSetting(WebInspector.UIString("Show script folders"), WebInspector.settings.showScriptFolders));
     p.appendChild(this._createCheckboxSetting(WebInspector.UIString("Search in content scripts"), WebInspector.settings.searchInContentScripts));
     p.appendChild(this._createCheckboxSetting(WebInspector.UIString("Enable source maps"), WebInspector.settings.sourceMapsEnabled));
@@ -372,6 +377,11 @@ WebInspector.SettingsScreen.prototype = {
 
         selectionChanged.call(this);
         return fieldsetElement;
+    },
+
+    _showPaintRectsChanged: function()
+    {
+        PageAgent.setShowPaintRects(WebInspector.settings.showPaintRects.get());
     }
 }
 
diff --git a/Source/WebCore/inspector/front-end/SidebarOverlay.js b/Source/WebCore/inspector/front-end/SidebarOverlay.js
new file mode 100644
index 000000000..17c93e5c8
--- /dev/null
+++ b/Source/WebCore/inspector/front-end/SidebarOverlay.js
@@ -0,0 +1,194 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+/**
+ * @constructor
+ * @extends {WebInspector.DialogDelegate}
+ * @param {WebInspector.View} view
+ * @param {string} widthSettingName
+ * @param {number} minimalWidth
+ */
+WebInspector.SidebarOverlay = function(view, widthSettingName, minimalWidth)
+{
+    WebInspector.DialogDelegate.call(this);
+    
+    this._view = view;
+    this._widthSettingName = widthSettingName;
+    this._minimalWidth = minimalWidth;
+    this._savedWidth = minimalWidth || 300;
+    
+    if (this._widthSettingName)
+        WebInspector.settings[this._widthSettingName] = WebInspector.settings.createSetting(this._widthSettingName, undefined);
+    
+    this._resizerElement = document.createElement("div");
+    this._resizerElement.className = "sidebar-overlay-resizer";
+    this._installResizer(this._resizerElement);
+}
+
+WebInspector.SidebarOverlay.EventTypes = {
+    WasShown: "WasShown",
+    WillHide: "WillHide"
+}
+
+WebInspector.SidebarOverlay.prototype = {
+    /**
+     * @param {Element} element
+     */
+    show: function(element)
+    {
+        this._element = element;
+        element.addStyleClass("sidebar-overlay-dialog");
+        this._view.markAsRoot();
+        this._view.show(element);
+        this._element.appendChild(this._resizerElement);
+        if (this._resizerWidgetElement)
+            this._element.appendChild(this._resizerWidgetElement);
+
+        this.dispatchEventToListeners(WebInspector.SidebarOverlay.EventTypes.WasShown, null);
+    },
+
+    /**
+     * @param {Element} element
+     * @param {Element} relativeToElement
+     */
+    position: function(element, relativeToElement)
+    {
+        this._totalWidth = relativeToElement.offsetWidth;
+        
+        var offset = relativeToElement.offsetRelativeToWindow(window);
+        element.style.left = offset.x + "px";
+        element.style.top = offset.y + "px";
+        this._setWidth(this._preferredWidth());
+        element.style.height = relativeToElement.offsetHeight + "px";
+    },
+
+    focus: function()
+    {
+        WebInspector.setCurrentFocusElement(this._view.element);
+    },
+
+    willHide: function() {
+        this._view.detach();
+        this.dispatchEventToListeners(WebInspector.SidebarOverlay.EventTypes.WillHide, null);
+    },
+    
+    /**
+     * @param {Element} relativeToElement
+     */
+    start: function(relativeToElement)
+    {
+        WebInspector.Dialog.show(relativeToElement, this);
+    },
+    
+    /**
+     * @param {number} newWidth
+     */
+    _setWidth: function(newWidth)
+    {
+        var width = Number.constrain(newWidth, this._minimalWidth, this._totalWidth);
+        
+        if (this._width === width)
+            return;
+
+        this._element.style.width = width + "px";
+        this._resizerElement.style.left = (width - 3) + "px";
+        this._width = width;
+        this._view.doResize();
+        this._saveWidth();
+    },
+
+    /**
+     * @return {number}
+     */
+    _preferredWidth: function()
+    {
+        if (!this._widthSettingName)
+            return this._savedWidth;
+
+        return WebInspector.settings[this._widthSettingName].get() || this._savedWidth;
+    },
+    
+    _saveWidth: function()
+    {
+        this._savedWidth = this._width;
+        if (!this._widthSettingName)
+            return;
+
+        WebInspector.settings[this._widthSettingName].set(this._width);
+    },
+
+    /**
+     * @param {Event} event
+     */
+    _startResizerDragging: function(event)
+    {
+        var width = this._width;
+        this._dragOffset = width - event.pageX;
+        WebInspector.elementDragStart(this._resizerElement, this._resizerDragging.bind(this), this._endResizerDragging.bind(this), event, "ew-resize");
+    },
+
+    /**
+     * @param {Event} event
+     */
+    _resizerDragging: function(event)
+    {
+        var width = event.pageX + this._dragOffset;
+        this._setWidth(width);
+        event.preventDefault();
+    },
+
+    /**
+     * @param {Event} event
+     */
+    _endResizerDragging: function(event)
+    {
+        delete this._dragOffset;
+        WebInspector.elementDragEnd(event);
+    },
+
+    /**
+     * @param {Element} resizerElement
+     */
+    _installResizer: function(resizerElement)
+    {
+        resizerElement.addEventListener("mousedown", this._startResizerDragging.bind(this), false);
+    },
+
+    /**
+     * @type {Element}
+     */
+    set resizerWidgetElement(resizerWidgetElement)
+    {
+        this._resizerWidgetElement = resizerWidgetElement;
+        this._installResizer(resizerWidgetElement);
+    }
+}
+
+WebInspector.SidebarOverlay.prototype.__proto__ = WebInspector.DialogDelegate.prototype;
diff --git a/Source/WebCore/inspector/front-end/SourceJavaScriptTokenizer.js b/Source/WebCore/inspector/front-end/SourceJavaScriptTokenizer.js
index ca22c47d1..903e19d2a 100644
--- a/Source/WebCore/inspector/front-end/SourceJavaScriptTokenizer.js
+++ b/Source/WebCore/inspector/front-end/SourceJavaScriptTokenizer.js
@@ -50,13 +50,6 @@ WebInspector.SourceJavaScriptTokenizer = function()
 {
     WebInspector.SourceTokenizer.call(this);
 
-    this._keywords = [
-        "null", "true", "false", "break", "case", "catch", "const", "default", "finally", "for",
-        "instanceof", "new", "var", "continue", "function", "return", "void", "delete", "if",
-        "this", "do", "while", "else", "in", "switch", "throw", "try", "typeof", "debugger",
-        "class", "enum", "export", "extends", "import", "super", "get", "set", "with"
-    ].keySet();
-
     this._lexConditions = {
         DIV: 0,
         NODIV: 1,
@@ -76,6 +69,13 @@ WebInspector.SourceJavaScriptTokenizer = function()
     this.condition = this.createInitialCondition();
 }
 
+WebInspector.SourceJavaScriptTokenizer.Keywords = [
+        "null", "true", "false", "break", "case", "catch", "const", "default", "finally", "for",
+        "instanceof", "new", "var", "continue", "function", "return", "void", "delete", "if",
+        "this", "do", "while", "else", "in", "switch", "throw", "try", "typeof", "debugger",
+        "class", "enum", "export", "extends", "import", "super", "get", "set", "with"
+    ].keySet();
+
 WebInspector.SourceJavaScriptTokenizer.prototype = {
     createInitialCondition: function()
     {
@@ -257,7 +257,7 @@ case 20:
 case 21:
             {
                     var token = this._line.substring(cursorOnEnter, cursor);
-                    if (this._keywords[token] === true && token !== "__proto__")
+                    if (WebInspector.SourceJavaScriptTokenizer.Keywords[token] === true && token !== "__proto__")
                         this.tokenType = "javascript-keyword";
                     else
                         this.tokenType = "javascript-ident";
@@ -1189,7 +1189,7 @@ case 142:
             this.setLexCondition(this._lexConditions.DIV);
             {
                     var token = this._line.substring(cursorOnEnter, cursor);
-                    if (this._keywords[token] === true && token !== "__proto__")
+                    if (WebInspector.SourceJavaScriptTokenizer.Keywords[token] === true && token !== "__proto__")
                         this.tokenType = "javascript-keyword";
                     else
                         this.tokenType = "javascript-ident";
diff --git a/Source/WebCore/inspector/front-end/SourceJavaScriptTokenizer.re2js b/Source/WebCore/inspector/front-end/SourceJavaScriptTokenizer.re2js
index 17d6158cd..969c4db24 100644
--- a/Source/WebCore/inspector/front-end/SourceJavaScriptTokenizer.re2js
+++ b/Source/WebCore/inspector/front-end/SourceJavaScriptTokenizer.re2js
@@ -49,13 +49,6 @@ WebInspector.SourceJavaScriptTokenizer = function()
 {
     WebInspector.SourceTokenizer.call(this);
 
-    this._keywords = [
-        "null", "true", "false", "break", "case", "catch", "const", "default", "finally", "for",
-        "instanceof", "new", "var", "continue", "function", "return", "void", "delete", "if",
-        "this", "do", "while", "else", "in", "switch", "throw", "try", "typeof", "debugger",
-        "class", "enum", "export", "extends", "import", "super", "get", "set", "with"
-    ].keySet();
-
     this._lexConditions = {
         DIV: 0,
         NODIV: 1,
@@ -75,6 +68,13 @@ WebInspector.SourceJavaScriptTokenizer = function()
     this.condition = this.createInitialCondition();
 }
 
+WebInspector.SourceJavaScriptTokenizer.Keywords = [
+        "null", "true", "false", "break", "case", "catch", "const", "default", "finally", "for",
+        "instanceof", "new", "var", "continue", "function", "return", "void", "delete", "if",
+        "this", "do", "while", "else", "in", "switch", "throw", "try", "typeof", "debugger",
+        "class", "enum", "export", "extends", "import", "super", "get", "set", "with"
+    ].keySet();
+
 WebInspector.SourceJavaScriptTokenizer.prototype = {
     createInitialCondition: function()
     {
@@ -170,7 +170,7 @@ WebInspector.SourceJavaScriptTokenizer.prototype = {
                 <DIV,NODIV> Identifier => DIV
                 {
                     var token = this._line.substring(cursorOnEnter, cursor);
-                    if (this._keywords[token] === true && token !== "__proto__")
+                    if (WebInspector.SourceJavaScriptTokenizer.Keywords[token] === true && token !== "__proto__")
                         this.tokenType = "javascript-keyword";
                     else
                         this.tokenType = "javascript-ident";
diff --git a/Source/WebCore/inspector/front-end/Spectrum.js b/Source/WebCore/inspector/front-end/Spectrum.js
new file mode 100644
index 000000000..3f9a58e44
--- /dev/null
+++ b/Source/WebCore/inspector/front-end/Spectrum.js
@@ -0,0 +1,424 @@
+/*
+ * Copyright (C) 2011 Brian Grinstead All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+/**
+ * @constructor
+ * @extends {WebInspector.Object}
+ */
+WebInspector.Spectrum = function()
+{
+    this._popover = new WebInspector.Popover();
+    this._popover.setCanShrink(false);
+    this._popover.element.addEventListener("mousedown", stopPropagation, false);
+
+    this._containerElement = document.createElement('div');
+    this._containerElement.className = "spectrum-container";
+
+    var topElement = this._containerElement.createChild("div", "spectrum-top");
+    topElement.createChild("div", "spectrum-fill");
+
+    var topInnerElement = topElement.createChild("div", "spectrum-top-inner fill");
+    this._draggerElement = topInnerElement.createChild("div", "spectrum-color");
+    this._dragHelperElement = this._draggerElement.createChild("div", "spectrum-sat fill").createChild("div", "spectrum-val fill").createChild("div", "spectrum-dragger");
+
+    this._sliderElement = topInnerElement.createChild("div", "spectrum-hue");
+    this.slideHelper = this._sliderElement.createChild("div", "spectrum-slider");
+
+    var rangeContainer = this._containerElement.createChild("div", "spectrum-range-container");
+    var alphaLabel = rangeContainer.createChild("label");
+    alphaLabel.textContent = WebInspector.UIString("\u03B1:");
+
+    this._alphaElement = rangeContainer.createChild("input", "spectrum-range");
+    this._alphaElement.setAttribute("type", "range");
+    this._alphaElement.setAttribute("min", "0");
+    this._alphaElement.setAttribute("max", "100");
+    this._alphaElement.addEventListener("change", alphaDrag.bind(this), false);
+
+    var swatchElement = document.createElement("span");
+    swatchElement.className = "swatch";
+    this._swatchInnerElement = swatchElement.createChild("span", "swatch-inner");
+
+    var displayContainer = this._containerElement.createChild("div");
+    displayContainer.appendChild(swatchElement);
+    this._displayElement = displayContainer.createChild("span", "source-code spectrum-display-value");
+
+    WebInspector.Spectrum.draggable(this._sliderElement, hueDrag.bind(this));
+    WebInspector.Spectrum.draggable(this._draggerElement, colorDrag.bind(this));
+
+    function hueDrag(element, dragX, dragY)
+    {
+        this.hsv[0] = (dragY / this.slideHeight);
+
+        this._onchange();
+    }
+
+    function colorDrag(element, dragX, dragY)
+    {
+        this.hsv[1] = dragX / this.dragWidth;
+        this.hsv[2] = (this.dragHeight - dragY) / this.dragHeight;
+
+        this._onchange();
+    }
+
+    function alphaDrag()
+    {
+        this.hsv[3] = this._alphaElement.value / 100;
+
+        this._onchange();
+    }
+
+    this._hideProxy = this.hide.bind(this);
+};
+
+WebInspector.Spectrum.Events = {
+    ColorChanged: "ColorChanged",
+    Hidden: "Hidden"
+};
+
+WebInspector.Spectrum.hsvaToRGBA = function(h, s, v, a)
+{
+    var r, g, b;
+
+    var i = Math.floor(h * 6);
+    var f = h * 6 - i;
+    var p = v * (1 - s);
+    var q = v * (1 - f * s);
+    var t = v * (1 - (1 - f) * s);
+
+    switch(i % 6) {
+    case 0:
+        r = v, g = t, b = p;
+        break;
+    case 1:
+        r = q, g = v, b = p;
+        break;
+    case 2:
+        r = p, g = v, b = t;
+        break;
+    case 3:
+        r = p, g = q, b = v;
+        break;
+    case 4:
+        r = t, g = p, b = v;
+        break;
+    case 5:
+        r = v, g = p, b = q;
+        break;
+    }
+
+    return [Math.round(r * 255), Math.round(g * 255), Math.round(b * 255), a];
+};
+
+WebInspector.Spectrum.rgbaToHSVA = function(r, g, b, a)
+{
+    r = r / 255;
+    g = g / 255;
+    b = b / 255;
+
+    var max = Math.max(r, g, b);
+    var min = Math.min(r, g, b);
+    var h;
+    var s;
+    var v = max;
+
+    var d = max - min;
+    s = max ? d / max : 0;
+
+    if(max === min) {
+        // Achromatic.
+        h = 0;
+    } else {
+        switch(max) {
+        case r:
+            h = (g - b) / d + (g < b ? 6 : 0);
+            break;
+        case g:
+            h = (b - r) / d + 2;
+            break;
+        case b:
+            h = (r - g) / d + 4;
+            break;
+        }
+        h /= 6;
+    }
+    return [h, s, v, a];
+};
+
+//FIXME: migrate to WebInspector.elementDragStart
+/**
+ * @param {Function=} onmove
+ * @param {Function=} onstart
+ * @param {Function=} onstop
+ */
+WebInspector.Spectrum.draggable = function(element, onmove, onstart, onstop) {
+
+    var doc = document;
+    var dragging;
+    var offset;
+    var scrollOffset;
+    var maxHeight;
+    var maxWidth;
+
+    function prevent(e)
+    {
+        if (e.stopPropagation)
+            e.stopPropagation();
+
+        if (e.preventDefault)
+            e.preventDefault();
+    }
+
+    function move(e)
+    {
+        if (dragging) {
+            var dragX = Math.max(0, Math.min(e.pageX - offset.left + scrollOffset.left, maxWidth));
+            var dragY = Math.max(0, Math.min(e.pageY - offset.top + scrollOffset.top, maxHeight));
+
+            if (onmove)
+                onmove(element, dragX, dragY);
+        }
+    }
+
+    function start(e)
+    {
+        var rightClick = e.which ? (e.which === 3) : (e.button === 2);
+
+        if (!rightClick && !dragging) {
+
+            if (onstart)
+                onstart(element, e)
+
+            dragging = true;
+            maxHeight = element.clientHeight;
+            maxWidth = element.clientWidth;
+
+            scrollOffset = element.scrollOffset();
+            offset = element.totalOffset();
+
+            doc.addEventListener("selectstart", prevent, false);
+            doc.addEventListener("dragstart", prevent, false);
+            doc.addEventListener("mousemove", move, false);
+            doc.addEventListener("mouseup", stop, false);
+
+            move(e);
+            prevent(e);
+        }
+    }
+
+    function stop(e)
+    {
+        if (dragging) {
+            doc.removeEventListener("selectstart", prevent, false);
+            doc.removeEventListener("dragstart", prevent, false);
+            doc.removeEventListener("mousemove", move, false);
+            doc.removeEventListener("mouseup", stop, false);
+
+            if (onstop)
+                onstop(element, e);
+        }
+
+        dragging = false;
+    }
+
+    element.addEventListener("mousedown", start, false);
+};
+
+WebInspector.Spectrum.prototype = {
+    set color(color)
+    {
+        var rgba = (color.rgba || color.rgb).slice(0);
+
+        if (rgba.length === 3)
+            rgba[3] = 1;
+
+        this.hsv = WebInspector.Spectrum.rgbaToHSVA(rgba[0], rgba[1], rgba[2], rgba[3]);
+    },
+
+    get color()
+    {
+        var rgba = WebInspector.Spectrum.hsvaToRGBA(this.hsv[0], this.hsv[1], this.hsv[2], this.hsv[3]);
+        var color;
+
+        if (rgba[3] === 1)
+            color = WebInspector.Color.fromRGB(rgba[0], rgba[1], rgba[2]);
+        else
+            color = WebInspector.Color.fromRGBA(rgba[0], rgba[1], rgba[2], rgba[3]);
+
+        var colorValue = color.toString(this.outputColorFormat);
+        if (!colorValue)
+            colorValue = color.toString(); // this.outputColorFormat can be invalid for current color (e.g. "nickname").
+        return new WebInspector.Color(colorValue);
+    },
+
+    get outputColorFormat()
+    {
+        var cf = WebInspector.StylesSidebarPane.ColorFormat;
+        var format = this._originalFormat;
+
+        if (this.hsv[3] === 1) {
+            // Simplify transparent formats.
+            if (format === cf.RGBA)
+                format = cf.RGB;
+            else if (format === cf.HSLA)
+                format = cf.HSL;
+        } else {
+            // Everything except HSL(A) should be returned as RGBA if transparency is involved.
+            if (format === cf.HSL || format === cf.HSLA)
+                format = cf.HSLA;
+            else
+                format = cf.RGBA;
+        }
+
+        return format;
+    },
+
+    get colorHueOnly()
+    {
+        var rgba = WebInspector.Spectrum.hsvaToRGBA(this.hsv[0], 1, 1, 1);
+        return WebInspector.Color.fromRGBA(rgba[0], rgba[1], rgba[2], rgba[3]);
+    },
+
+    set displayText(text)
+    {
+        this._displayElement.textContent = text;
+    },
+
+    get visible()
+    {
+        return this._popover.visible;
+    },
+
+    _onchange: function()
+    {
+        this._updateUI();
+        this.dispatchEventToListeners(WebInspector.Spectrum.Events.ColorChanged, this.color);
+    },
+
+    _updateHelperLocations: function()
+    {
+        var h = this.hsv[0];
+        var s = this.hsv[1];
+        var v = this.hsv[2];
+
+        // Where to show the little circle that displays your current selected color.
+        var dragX = s * this.dragWidth;
+        var dragY = this.dragHeight - (v * this.dragHeight);
+
+        dragX = Math.max(-this._dragHelperElementHeight,
+                        Math.min(this.dragWidth - this._dragHelperElementHeight, dragX - this._dragHelperElementHeight));
+        dragY = Math.max(-this._dragHelperElementHeight,
+                        Math.min(this.dragHeight - this._dragHelperElementHeight, dragY - this._dragHelperElementHeight));
+
+        this._dragHelperElement.positionAt(dragX, dragY);
+
+        // Where to show the bar that displays your current selected hue.
+        var slideY = (h * this.slideHeight) - this.slideHelperHeight;
+        this.slideHelper.style.top = slideY + "px";
+
+        this._alphaElement.value = this.hsv[3] * 100;
+    },
+
+    _updateUI: function()
+    {
+        this._updateHelperLocations();
+
+        var rgb = (this.color.rgba || this.color.rgb).slice(0);
+
+        if (rgb.length === 3)
+            rgb[3] = 1;
+
+        var rgbHueOnly = this.colorHueOnly.rgb;
+
+        var flatColor = "rgb(" + rgbHueOnly[0] + ", " + rgbHueOnly[1] + ", " + rgbHueOnly[2] + ")";
+        var fullColor = "rgba(" + rgb[0] + ", " + rgb[1] + ", " + rgb[2] + ", " + rgb[3] + ")";
+
+        this._draggerElement.style.backgroundColor = flatColor;
+        this._swatchInnerElement.style.backgroundColor = fullColor;
+
+        this._alphaElement.value = this.hsv[3] * 100;
+    },
+
+    toggle: function(element, color, format)
+    {
+        if (this.visible)
+            this.hide();
+        else
+            this.show(element, color, format);
+
+        return this.visible;
+    },
+
+    show: function(element, color, format)
+    {
+        if (this.visible) {
+            if (this.anchorElement === element)
+                return false;
+
+            // Reopen the picker for another anchor element.
+            this.hide();
+        }
+
+        this.reposition(element);
+        this.anchorElement = element;
+
+        document.addEventListener("mousedown", this._hideProxy, false);
+        window.addEventListener("blur", this._hideProxy, false);
+
+        this.slideHeight = this._sliderElement.offsetHeight;
+        this.dragWidth = this._draggerElement.offsetWidth;
+        this.dragHeight = this._draggerElement.offsetHeight;
+        this._dragHelperElementHeight = this._dragHelperElement.offsetHeight / 2;
+        this.slideHelperHeight = this.slideHelper.offsetHeight / 2;
+
+        this.color = color;
+        this._originalFormat = format || color.format;
+
+        this._updateUI();
+
+        return true;
+    },
+
+    reposition: function(element)
+    {
+        this._popover.show(this._containerElement, element);
+    },
+
+    hide: function()
+    {
+        this._popover.hide();
+
+        document.removeEventListener("mousedown", this._hideProxy, false);
+        window.removeEventListener("blur", this._hideProxy, false);
+
+        this.dispatchEventToListeners(WebInspector.Spectrum.Events.Hidden);
+
+        delete this.anchorElement;
+    }
+};
+
+WebInspector.Spectrum.prototype.__proto__ = WebInspector.Object.prototype;
diff --git a/Source/WebCore/inspector/front-end/SplitView.js b/Source/WebCore/inspector/front-end/SplitView.js
index 71c12d8c5..5c5cf1783 100644
--- a/Source/WebCore/inspector/front-end/SplitView.js
+++ b/Source/WebCore/inspector/front-end/SplitView.js
@@ -73,7 +73,7 @@ WebInspector.SplitView = function(sidebarPosition, sidebarWidthSettingName, defa
 }
 
 WebInspector.SplitView.EventTypes = {
-    Resized: "Resized",
+    Resized: "Resized"
 }
 
 /**
@@ -114,7 +114,7 @@ WebInspector.SplitView.prototype = {
      */
     get resizable()
     {
-        return this._resizable && !this._mainElementHidden && !this._sidebarElementHidden
+        return this._resizable && !this._mainElementHidden && !this._sidebarElementHidden;
     },
 
     /**
@@ -288,6 +288,7 @@ WebInspector.SplitView.prototype = {
         this._mainElementHidden = true;
         this._updateResizer();
         this._restoreSidebarWidth();
+        this.doResize();
     },
 
     showMainElement: function()
@@ -306,6 +307,7 @@ WebInspector.SplitView.prototype = {
         this._mainElementHidden = false;
         this._updateResizer();
         this._restoreSidebarWidth();
+        this.doResize();
     },
 
     hideSidebarElement: function()
@@ -320,6 +322,7 @@ WebInspector.SplitView.prototype = {
         this._sidebarElementHidden = true;
         this._updateResizer();
         this._restoreSidebarWidth();
+        this.doResize();
     },
 
     showSidebarElement: function()
@@ -331,6 +334,7 @@ WebInspector.SplitView.prototype = {
         this._sidebarElementHidden = false;
         this._updateResizer();
         this._restoreSidebarWidth();
+        this.doResize();
     },
 
     wasShown: function()
@@ -366,7 +370,7 @@ WebInspector.SplitView.prototype = {
      */
     _resizerDragging: function(event)
     {
-        var leftWidth = event.pageX + this._dragOffset
+        var leftWidth = event.pageX + this._dragOffset;
         var rightWidth = this._totalWidth - leftWidth;
         var sidebarWidth = this.hasLeftSidebar ? leftWidth : rightWidth;
 
diff --git a/Source/WebCore/inspector/front-end/StylesSidebarPane.js b/Source/WebCore/inspector/front-end/StylesSidebarPane.js
index 4791b547b..dd273ae99 100644
--- a/Source/WebCore/inspector/front-end/StylesSidebarPane.js
+++ b/Source/WebCore/inspector/front-end/StylesSidebarPane.js
@@ -90,6 +90,8 @@ WebInspector.StylesSidebarPane = function(computedStylePane)
     this._sectionsContainer = document.createElement("div");
     this.bodyElement.appendChild(this._sectionsContainer);
 
+    this._spectrum = new WebInspector.Spectrum();
+
     WebInspector.cssModel.addEventListener(WebInspector.CSSStyleModel.Events.StyleSheetChanged, this._styleSheetOrMediaQueryResultChanged, this);
     WebInspector.cssModel.addEventListener(WebInspector.CSSStyleModel.Events.MediaQueryResultChanged, this._styleSheetOrMediaQueryResultChanged, this);
     WebInspector.domAgent.addEventListener(WebInspector.DOMAgent.Events.AttrModified, this._attributesModified, this);
@@ -204,6 +206,9 @@ WebInspector.StylesSidebarPane.prototype = {
 
     update: function(node, forceUpdate)
     {
+        if (this._spectrum.visible)
+            this._spectrum.hide();
+
         var refresh = false;
 
         if (forceUpdate)
@@ -223,20 +228,80 @@ WebInspector.StylesSidebarPane.prototype = {
         else
             node = this.node;
 
-        this._innerUpdate(refresh);
+        if (refresh)
+            this._refreshUpdate();
+        else
+            this._rebuildUpdate();
+    },
+
+    /**
+     * @param {WebInspector.StylePropertiesSection=} editedSection
+     * @param {boolean=} forceFetchComputedStyle
+     * @param {function()=} userCallback
+     */
+    _refreshUpdate: function(editedSection, forceFetchComputedStyle, userCallback)
+    {
+        if (this._refreshUpdateInProgress) {
+            this._lastNodeForInnerRefresh = this.node;
+            return;
+        }
+
+        var node = this._validateNode(userCallback);
+        if (!node)
+            return;
+
+        function computedStyleCallback(computedStyle)
+        {
+            delete this._refreshUpdateInProgress;
+
+            if (this._lastNodeForInnerRefresh) {
+                delete this._lastNodeForInnerRefresh;
+                this._refreshUpdate(editedSection, forceFetchComputedStyle, userCallback);
+                return;
+            }
+
+            if (this.node === node && computedStyle)
+                this._innerRefreshUpdate(node, computedStyle, editedSection);
+
+            if (userCallback)
+                userCallback();
+        }
+
+        if (this._computedStylePane.expanded || forceFetchComputedStyle) {
+            this._refreshUpdateInProgress = true;
+            WebInspector.cssModel.getComputedStyleAsync(node.id, this._forcedPseudoClasses, computedStyleCallback.bind(this));
+        } else {
+            this._innerRefreshUpdate(node, null, editedSection);
+            if (userCallback)
+                userCallback();
+        }
     },
 
-    _executeRebuildUpdate: function(node, callback)
+    /**
+     * @param {function()=} userCallback
+     */
+    _rebuildUpdate: function(userCallback)
     {
+        if (this._rebuildUpdateInProgress) {
+            this._lastNodeForInnerRebuild = this.node;
+            return;
+        }
+
+        var node = this._validateNode(userCallback);
+        if (!node)
+            return;
+
+        this._rebuildUpdateInProgress = true;
+
         var resultStyles = {};
 
         function stylesCallback(matchedResult)
         {
-            delete this._innerUpdateInProgress;
+            delete this._rebuildUpdateInProgress;
 
-            if (this._lastNodeForInnerUpdate) {
-                delete this._lastNodeForInnerUpdate;
-                this._innerUpdate(false, null, callback);
+            if (this._lastNodeForInnerRebuild) {
+                delete this._lastNodeForInnerRebuild;
+                this._rebuildUpdate(userCallback);
                 return;
             }
 
@@ -244,10 +309,10 @@ WebInspector.StylesSidebarPane.prototype = {
                 resultStyles.matchedCSSRules = matchedResult.matchedCSSRules;
                 resultStyles.pseudoElements = matchedResult.pseudoElements;
                 resultStyles.inherited = matchedResult.inherited;
-                this._rebuildUpdate(node, resultStyles);
+                this._innerRebuildUpdate(node, resultStyles);
             }
-            if (callback)
-                callback();
+            if (userCallback)
+                userCallback();
         }
 
         function inlineCallback(inlineStyle, attributesStyle)
@@ -267,55 +332,17 @@ WebInspector.StylesSidebarPane.prototype = {
         WebInspector.cssModel.getMatchedStylesAsync(node.id, this._forcedPseudoClasses, true, true, stylesCallback.bind(this));
     },
 
-    _refreshComputedStyleSection: function(callback)
+    _validateNode: function(userCallback)
     {
-        this._innerUpdate(true, null, callback);
-    },
-
-    /**
-     * @param {WebInspector.StylePropertiesSection=} editedSection
-     * @param {function()=} userCallback
-     */
-    _innerUpdate: function(refresh, editedSection, userCallback)
-    {
-        if (this._innerUpdateInProgress) {
-            this._lastNodeForInnerUpdate = this.node;
-            return;
-        }
-
-        var node = this.node;
-        if (!node) {
+        if (!this.node) {
             this._sectionsContainer.removeChildren();
             this._computedStylePane.bodyElement.removeChildren();
             this.sections = {};
             if (userCallback)
                 userCallback();
-            return;
-        }
-
-        function computedStyleCallback(computedStyle)
-        {
-            delete this._innerUpdateInProgress;
-
-            if (this._lastNodeForInnerUpdate) {
-                delete this._lastNodeForInnerUpdate;
-                this._innerUpdate(refresh, editedSection, userCallback);
-                return;
-            }
-
-            if (this.node === node && computedStyle)
-                this._refreshUpdate(node, computedStyle, editedSection);
-
-            if (userCallback)
-                userCallback();
+            return null;
         }
-
-        this._innerUpdateInProgress = true;
-
-        if (refresh)
-            WebInspector.cssModel.getComputedStyleAsync(node.id, this._forcedPseudoClasses, computedStyleCallback.bind(this));
-        else
-            this._executeRebuildUpdate(node, userCallback);
+        return this.node;
     },
 
     _styleSheetOrMediaQueryResultChanged: function()
@@ -323,7 +350,7 @@ WebInspector.StylesSidebarPane.prototype = {
         if (this._userOperation || this._isEditingStyle)
             return;
 
-        this._innerUpdate(false);
+        this._rebuildUpdate();
     },
 
     _attributesModified: function(event)
@@ -337,7 +364,7 @@ WebInspector.StylesSidebarPane.prototype = {
 
         // "class" (or any other) attribute might have changed. Update styles unless they are being edited.
         if (!this._isEditingStyle && !this._userOperation)
-            this._innerUpdate(false);
+            this._rebuildUpdate();
     },
 
     _attributesRemoved: function(event)
@@ -347,7 +374,7 @@ WebInspector.StylesSidebarPane.prototype = {
 
         // "style" attribute might have been removed.
         if (!this._isEditingStyle && !this._userOperation)
-            this._innerUpdate(false);
+            this._rebuildUpdate();
     },
 
     _styleInvalidated: function(event)
@@ -356,10 +383,10 @@ WebInspector.StylesSidebarPane.prototype = {
             return;
 
         if (!this._isEditingStyle && !this._userOperation)
-            this._innerUpdate(false);
+            this._rebuildUpdate();
     },
 
-    _refreshUpdate: function(node, computedStyle, editedSection)
+    _innerRefreshUpdate: function(node, computedStyle, editedSection)
     {
         for (var pseudoId in this.sections) {
             var styleRules = this._refreshStyleRules(this.sections[pseudoId], computedStyle);
@@ -367,13 +394,13 @@ WebInspector.StylesSidebarPane.prototype = {
             this._markUsedProperties(styleRules, usedProperties);
             this._refreshSectionsForStyleRules(styleRules, usedProperties, editedSection);
         }
-        // Trace the computed style.
-        this.sections[0][0].rebuildComputedTrace(this.sections[0]);
+        if (computedStyle)
+            this.sections[0][0].rebuildComputedTrace(this.sections[0]);
 
-        this._nodeStylesUpdatedForTest(node, true);
+        this._nodeStylesUpdatedForTest(node, false);
     },
 
-    _rebuildUpdate: function(node, styles)
+    _innerRebuildUpdate: function(node, styles)
     {
         this._sectionsContainer.removeChildren();
         this._computedStylePane.bodyElement.removeChildren();
@@ -383,8 +410,9 @@ WebInspector.StylesSidebarPane.prototype = {
         this._markUsedProperties(styleRules, usedProperties);
         this.sections[0] = this._rebuildSectionsForStyleRules(styleRules, usedProperties, 0, null);
         var anchorElement = this.sections[0].inheritedPropertiesSeparatorElement;
-        // Trace the computed style.
-        this.sections[0][0].rebuildComputedTrace(this.sections[0]);
+
+        if (styles.computedStyle)        
+            this.sections[0][0].rebuildComputedTrace(this.sections[0]);
 
         for (var i = 0; i < styles.pseudoElements.length; ++i) {
             var pseudoElementCSSRules = styles.pseudoElements[i];
@@ -405,10 +433,10 @@ WebInspector.StylesSidebarPane.prototype = {
             this.sections[pseudoId] = this._rebuildSectionsForStyleRules(styleRules, usedProperties, pseudoId, anchorElement);
         }
 
-        this._nodeStylesUpdatedForTest(node, false);
+        this._nodeStylesUpdatedForTest(node, true);
     },
 
-    _nodeStylesUpdatedForTest: function(node, refresh)
+    _nodeStylesUpdatedForTest: function(node, rebuild)
     {
         // Tests override this method.
     },
@@ -780,7 +808,7 @@ WebInspector.StylesSidebarPane.prototype = {
                 for (var i = 0; i < this._elementStatePane.inputs.length; ++i)
                     this._elementStatePane.inputs[i].checked = false;
                 delete this._forcedPseudoClasses;
-                this._innerUpdate(false);
+                this._rebuildUpdate();
             }
         }
     },
@@ -802,7 +830,7 @@ WebInspector.StylesSidebarPane.prototype = {
                     pseudoClasses.push(inputs[i].state);
             }
             this._forcedPseudoClasses = pseudoClasses.length ? pseudoClasses : undefined;
-            this._innerUpdate(false);
+            this._rebuildUpdate();
         }
 
         function createCheckbox(state)
@@ -835,7 +863,13 @@ WebInspector.StylesSidebarPane.prototype = {
 
     _showUserAgentStylesSettingChanged: function()
     {
-        this._innerUpdate(false);
+        this._rebuildUpdate();
+    },
+
+    willHide: function()
+    {
+        if (this._spectrum.visible)
+            this._spectrum.hide();
     }
 }
 
@@ -878,7 +912,7 @@ WebInspector.ComputedStyleSidebarPane.prototype = {
             WebInspector.SidebarPane.prototype.expand.call(this);
         }
 
-        this._stylesSidebarPane._refreshComputedStyleSection(callback.bind(this));
+        this._stylesSidebarPane._refreshUpdate(null, true, callback.bind(this));
     }
 }
 
@@ -891,7 +925,7 @@ WebInspector.ComputedStyleSidebarPane.prototype.__proto__ = WebInspector.Sidebar
 WebInspector.StylePropertiesSection = function(parentPane, styleRule, editable, isInherited, isFirstSection)
 {
     WebInspector.PropertiesSection.call(this, "");
-    this.element.className = "styles-section monospace" + (isFirstSection ? " first-styles-section" : "");
+    this.element.className = "styles-section matched-styles monospace" + (isFirstSection ? " first-styles-section" : "");
 
     if (styleRule.media) {
         for (var i = styleRule.media.length - 1; i >= 0; --i) {
@@ -913,7 +947,8 @@ WebInspector.StylePropertiesSection = function(parentPane, styleRule, editable,
 
             if (media.sourceURL) {
                 var refElement = mediaDataElement.createChild("div", "subtitle");
-                var anchor = WebInspector.linkifyResourceAsNode(media.sourceURL, media.sourceLine < 0 ? undefined : media.sourceLine, "subtitle");
+                var lineNumber = media.sourceLine < 0 ? undefined : media.sourceLine;
+                var anchor = WebInspector.linkifyResourceAsNode(media.sourceURL, lineNumber, "subtitle", media.sourceURL + (isNaN(lineNumber) ? "" : (":" + (lineNumber + 1))));
                 anchor.style.float = "right";
                 refElement.appendChild(anchor);
             }
@@ -937,9 +972,9 @@ WebInspector.StylePropertiesSection = function(parentPane, styleRule, editable,
     closeBrace.textContent = "}";
     this.element.appendChild(closeBrace);
 
-    var eventName = WebInspector.experimentsSettings.singleClickEditing.isEnabled() ? "click" : "dblclick";
-    this._selectorElement.addEventListener(eventName, this._handleSelectorDoubleClick.bind(this), false);
-    this.element.addEventListener(eventName, this._handleEmptySpaceDoubleClick.bind(this), false);
+    this._selectorElement.addEventListener("click", this._handleSelectorClick.bind(this), false);
+    this.element.addEventListener("mousedown", this._handleEmptySpaceMouseDown.bind(this), false);
+    this.element.addEventListener("click", this._handleEmptySpaceClick.bind(this), false);
 
     this._parentPane = parentPane;
     this.styleRule = styleRule;
@@ -1146,7 +1181,7 @@ WebInspector.StylePropertiesSection.prototype = {
     {
         function linkifyUncopyable(url, line)
         {
-            var link = WebInspector.linkifyResourceAsNode(url, line);
+            var link = WebInspector.linkifyResourceAsNode(url, line, "", url + ":" + (line + 1));
             link.classList.add("webkit-html-resource-link");
             link.setAttribute("data-uncopyable", link.textContent);
             link.textContent = "";
@@ -1168,8 +1203,18 @@ WebInspector.StylePropertiesSection.prototype = {
         return document.createTextNode(origin);
     },
 
-    _handleEmptySpaceDoubleClick: function(event)
+    _handleEmptySpaceMouseDown: function(event)
+    {
+        this._willCauseCancelEditing = this._parentPane._isEditingStyle;
+    },
+
+    _handleEmptySpaceClick: function(event)
     {
+        var willCauseCancelEditing = this._willCauseCancelEditing;
+        delete this._willCauseCancelEditing;
+        if (willCauseCancelEditing)
+            return;
+
         if (event.target.hasStyleClass("header") || this.element.hasStyleClass("read-only") || event.target.enclosingNodeOrSelfWithClass("media")) {
             event.stopPropagation();
             return;
@@ -1180,13 +1225,9 @@ WebInspector.StylePropertiesSection.prototype = {
 
     _handleSelectorClick: function(event)
     {
-        event.stopPropagation();
-    },
-
-    _handleSelectorDoubleClick: function(event)
-    {
         this._startEditingOnMouseEvent();
         event.stopPropagation();
+        event.preventDefault();
     },
 
     _startEditingOnMouseEvent: function()
@@ -1436,8 +1477,11 @@ WebInspector.BlankStylePropertiesSection.prototype = {
             this.expand();
             if (this.element.parentElement) // Might have been detached already.
                 this._moveEditorFromSelector(moveDirection);
+
+            delete this._parentPane._userOperation;
         }
 
+        this._parentPane._userOperation = true;
         WebInspector.cssModel.addRule(this.pane.node.id, newContent, successCallback.bind(this), this.editingSelectorCancelled.bind(this));
     },
 
@@ -1482,6 +1526,8 @@ WebInspector.StylePropertyTreeElement = function(section, parentPane, styleRule,
 
     // Pass an empty title, the title gets made later in onattach.
     TreeElement.call(this, "", null, shorthand);
+
+    this.selectable = false;
 }
 
 WebInspector.StylePropertyTreeElement.prototype = {
@@ -1561,14 +1607,9 @@ WebInspector.StylePropertyTreeElement.prototype = {
     onattach: function()
     {
         this.updateTitle();
-        var eventName;
-        if (WebInspector.experimentsSettings.singleClickEditing.isEnabled()) {
-            this.listItemElement.addEventListener("mousedown", this._mouseDown.bind(this));
-            this.listItemElement.addEventListener("mouseup", this._resetMouseDownElement.bind(this));
-            eventName = "click";
-        } else
-            eventName = "dblclick";
-        this.listItemElement.addEventListener(eventName, this._startEditing.bind(this));
+        this.listItemElement.addEventListener("mousedown", this._mouseDown.bind(this));
+        this.listItemElement.addEventListener("mouseup", this._resetMouseDownElement.bind(this));
+        this.listItemElement.addEventListener("click", this._startEditing.bind(this));
     },
 
     _mouseDown: function(event)
@@ -1580,9 +1621,11 @@ WebInspector.StylePropertyTreeElement.prototype = {
 
     _resetMouseDownElement: function()
     {
-        delete this._parentPane._mouseDownTreeElement;
-        delete this._parentPane._mouseDownTreeElementIsName;
-        delete this._parentPane._mouseDownTreeElementIsValue;
+        if (this._parentPane) {
+            delete this._parentPane._mouseDownTreeElement;
+            delete this._parentPane._mouseDownTreeElementIsName;
+            delete this._parentPane._mouseDownTreeElementIsValue;
+        }
     },
 
     updateTitle: function()
@@ -1603,8 +1646,12 @@ WebInspector.StylePropertyTreeElement.prototype = {
         var nameElement = document.createElement("span");
         nameElement.className = "webkit-css-property";
         nameElement.textContent = this.name;
+        nameElement.title = this.property.propertyText;
         this.nameElement = nameElement;
 
+        this._expandElement = document.createElement("span");
+        this._expandElement.className = "expand-element";
+
         var valueElement = document.createElement("span");
         valueElement.className = "value";
         this.valueElement = valueElement;
@@ -1662,28 +1709,93 @@ WebInspector.StylePropertyTreeElement.prototype = {
                     return document.createTextNode(text);
                 }
 
+                var format = getFormat();
+                var hasSpectrum = self._parentPane;
+                var spectrum = hasSpectrum ? self._parentPane._spectrum : null;
+
                 var swatchElement = document.createElement("span");
-                swatchElement.title = WebInspector.UIString("Click to change color format");
+                var swatchInnerElement = swatchElement.createChild("span", "swatch-inner");
+                swatchElement.title = WebInspector.UIString("Click to open a colorpicker. Shift-click to change color format");
+
                 swatchElement.className = "swatch";
-                swatchElement.style.setProperty("background-color", text);
-
-                swatchElement.addEventListener("click", changeColorDisplay, false);
-                swatchElement.addEventListener("dblclick", function(event) { event.stopPropagation() }, false);
-
-                var format;
-                var formatSetting = WebInspector.settings.colorFormat.get();
-                if (formatSetting === cf.Original)
-                    format = cf.Original;
-                else if (color.nickname)
-                    format = cf.Nickname;
-                else if (formatSetting === cf.RGB)
-                    format = (color.simple ? cf.RGB : cf.RGBA);
-                else if (formatSetting === cf.HSL)
-                    format = (color.simple ? cf.HSL : cf.HSLA);
-                else if (color.simple)
-                    format = (color.hasShortHex() ? cf.ShortHEX : cf.HEX);
-                else
-                    format = cf.RGBA;
+
+                swatchElement.addEventListener("mousedown", stopPropagation, false);
+                swatchElement.addEventListener("click", swatchClick, false);
+                swatchElement.addEventListener("dblclick", stopPropagation, false);
+
+                swatchInnerElement.style.backgroundColor = text;
+
+                var scrollerElement = hasSpectrum ? self._parentPane._computedStylePane.element.parentElement : null;
+
+                function spectrumChanged(e)
+                {
+                    color = e.data;
+
+                    var colorString = color.toString();
+
+                    colorValueElement.textContent = colorString;
+                    spectrum.displayText = colorString;
+                    swatchInnerElement.style.backgroundColor = colorString;
+
+                    self.applyStyleText(nameElement.textContent + ": " + valueElement.textContent, false, false, false);
+                }
+
+                function spectrumHidden()
+                {
+                    scrollerElement.removeEventListener("scroll", repositionSpectrum, false);
+                    self.applyStyleText(nameElement.textContent + ": " + valueElement.textContent, true, true, false);
+                    spectrum.removeEventListener(WebInspector.Spectrum.Events.ColorChanged, spectrumChanged);
+                    spectrum.removeEventListener(WebInspector.Spectrum.Events.Hidden, spectrumHidden);
+
+                    delete self._parentPane._isEditingStyle;
+                }
+
+                function repositionSpectrum()
+                {
+                    spectrum.reposition(swatchElement);
+                }
+
+                function swatchClick(e)
+                {
+                    // Shift + click toggles color formats.
+                    // Click opens colorpicker, only if the element is not in computed styles section.
+                    if (!spectrum || e.shiftKey)
+                        changeColorDisplay(e);
+                    else {
+                        var visible = spectrum.toggle(swatchElement, color, format);
+
+                        if (visible) {
+                            spectrum.displayText = color.toString(format);
+                            self._parentPane._isEditingStyle = true;
+                            spectrum.addEventListener(WebInspector.Spectrum.Events.ColorChanged, spectrumChanged);
+                            spectrum.addEventListener(WebInspector.Spectrum.Events.Hidden, spectrumHidden);
+
+                            scrollerElement.addEventListener("scroll", repositionSpectrum, false);
+                        }
+                    }
+                    e.stopPropagation();
+                    e.preventDefault();
+                }
+
+                function getFormat()
+                {
+                    var format;
+                    var formatSetting = WebInspector.settings.colorFormat.get();
+                    if (formatSetting === cf.Original)
+                        format = cf.Original;
+                    else if (color.nickname)
+                        format = cf.Nickname;
+                    else if (formatSetting === cf.RGB)
+                        format = (color.simple ? cf.RGB : cf.RGBA);
+                    else if (formatSetting === cf.HSL)
+                        format = (color.simple ? cf.HSL : cf.HSLA);
+                    else if (color.simple)
+                        format = (color.hasShortHex() ? cf.ShortHEX : cf.HEX);
+                    else
+                        format = cf.RGBA;
+
+                    return format;
+                }
 
                 var colorValueElement = document.createElement("span");
                 colorValueElement.textContent = color.toString(format);
@@ -1763,10 +1875,11 @@ WebInspector.StylePropertyTreeElement.prototype = {
             return;
 
         // Append the checkbox for root elements of an editable section.
-        if (enabledCheckboxElement && this.treeOutline.section && this.treeOutline.section.editable && this.parent.root)
+        if (enabledCheckboxElement && this.treeOutline.section && this.parent.root && !this.section.computedStyle)
             this.listItemElement.appendChild(enabledCheckboxElement);
         this.listItemElement.appendChild(nameElement);
         this.listItemElement.appendChild(document.createTextNode(": "));
+        this.listItemElement.appendChild(this._expandElement);
         this.listItemElement.appendChild(valueElement);
         this.listItemElement.appendChild(document.createTextNode(";"));
 
@@ -1783,14 +1896,12 @@ WebInspector.StylePropertyTreeElement.prototype = {
         }
         if (this.property.inactive)
             this.listItemElement.addStyleClass("inactive");
-
-        this.tooltip = this.property.propertyText;
     },
 
     _updatePane: function(userCallback)
     {
         if (this.treeOutline && this.treeOutline.section && this.treeOutline.section.pane)
-            this.treeOutline.section.pane._innerUpdate(true, this.treeOutline.section, userCallback);
+            this.treeOutline.section.pane._refreshUpdate(this.treeOutline.section, false, userCallback);
         else  {
             if (userCallback)
                 userCallback();
@@ -1831,7 +1942,6 @@ WebInspector.StylePropertyTreeElement.prototype = {
         else
             this.listItemElement.removeStyleClass("implicit");
 
-        this.selectable = !this.inherited;
         if (this.inherited)
             this.listItemElement.addStyleClass("inherited");
         else
@@ -1886,6 +1996,7 @@ WebInspector.StylePropertyTreeElement.prototype = {
     {
         this.startEditing(event.target);
         event.stopPropagation();
+        event.preventDefault();
     },
 
     _isNameElement: function(element)
@@ -1904,6 +2015,9 @@ WebInspector.StylePropertyTreeElement.prototype = {
         if (this.parent.shorthand)
             return;
 
+        if (selectElement === this._expandElement)
+            return;
+
         if (this.treeOutline.section && !this.treeOutline.section.editable)
             return;
 
@@ -2133,7 +2247,7 @@ WebInspector.StylePropertyTreeElement.prototype = {
         if (moveDirection === "forward" && !isEditingName || moveDirection === "backward" && isEditingName) {
             do {
                 moveTo = (moveDirection === "forward" ? moveTo.nextSibling : moveTo.previousSibling);
-            } while(moveTo && !moveTo.selectable);
+            } while(moveTo && moveTo.inherited);
 
             if (moveTo)
                 moveToPropertyName = moveTo.name;
@@ -2307,6 +2421,18 @@ WebInspector.StylePropertyTreeElement.prototype = {
         if (styleText.length && !/;\s*$/.test(styleText))
             styleText += ";";
         this.property.setText(styleText, majorChange, callback.bind(this, userOperationFinishedCallback.bind(null, this._parentPane, updateInterface), this.originalPropertyText));
+    },
+
+    ondblclick: function()
+    {
+        return true; // handled
+    },
+
+    isEventWithinDisclosureTriangle: function(event)
+    {
+        if (!this.section.computedStyle)
+            return event.target === this._expandElement;
+        return TreeElement.prototype.isEventWithinDisclosureTriangle.call(this, event);
     }
 }
 
diff --git a/Source/WebCore/inspector/front-end/TabbedEditorContainer.js b/Source/WebCore/inspector/front-end/TabbedEditorContainer.js
index e5caa2cfd..82f7447d3 100644
--- a/Source/WebCore/inspector/front-end/TabbedEditorContainer.js
+++ b/Source/WebCore/inspector/front-end/TabbedEditorContainer.js
@@ -65,6 +65,14 @@ WebInspector.TabbedEditorContainer.prototype = {
     },
 
     /**
+     * @type {Element}
+     */
+    get element()
+    {
+        return this._tabbedPane.element;
+    },
+
+    /**
      * @param {Element} parentElement
      */
     show: function(parentElement)
diff --git a/Source/WebCore/inspector/front-end/TextPrompt.js b/Source/WebCore/inspector/front-end/TextPrompt.js
index 2c479d81f..3c43f690d 100644
--- a/Source/WebCore/inspector/front-end/TextPrompt.js
+++ b/Source/WebCore/inspector/front-end/TextPrompt.js
@@ -400,6 +400,26 @@ WebInspector.TextPrompt.prototype = {
     },
 
     /**
+     * @param {Array.<string>} completions
+     * @param {number} wordPrefixLength
+     */
+    _buildCommonPrefix: function(completions, wordPrefixLength)
+    {
+        var commonPrefix = completions[0];
+        for (var i = 0; i < completions.length; ++i) {
+            var completion = completions[i];
+            var lastIndex = Math.min(commonPrefix.length, completion.length);
+            for (var j = wordPrefixLength; j < lastIndex; ++j) {
+                if (commonPrefix[j] !== completion[j]) {
+                    commonPrefix = commonPrefix.substr(0, j);
+                    break;
+                }
+            }
+        }
+        return commonPrefix;
+    },
+
+    /**
      * @param {Selection} selection
      * @param {boolean} auto
      * @param {Range} originalWordPrefixRange
@@ -430,24 +450,17 @@ WebInspector.TextPrompt.prototype = {
 
         var wordPrefixLength = originalWordPrefixRange.toString().length;
 
-        if (auto)
+        if (auto) {
             var completionText = completions[0];
-        else {
+            var commonPrefix = this._buildCommonPrefix(completions, wordPrefixLength);
+
+            this._commonPrefix = commonPrefix;
+        } else {
             if (completions.length === 1) {
                 var completionText = completions[0];
                 wordPrefixLength = completionText.length;
             } else {
-                var commonPrefix = completions[0];
-                for (var i = 0; i < completions.length; ++i) {
-                    var completion = completions[i];
-                    var lastIndex = Math.min(commonPrefix.length, completion.length);
-                    for (var j = wordPrefixLength; j < lastIndex; ++j) {
-                        if (commonPrefix[j] !== completion[j]) {
-                            commonPrefix = commonPrefix.substr(0, j);
-                            break;
-                        }
-                    }
-                }
+                var commonPrefix = this._buildCommonPrefix(completions, wordPrefixLength);
                 wordPrefixLength = commonPrefix.length;
 
                 if (selection.isCollapsed)
@@ -498,6 +511,20 @@ WebInspector.TextPrompt.prototype = {
             this.applySuggestion(completionText, completions.length > 1, originalWordPrefixRange);
     },
 
+    _completeCommonPrefix: function()
+    {
+        if (!this.autoCompleteElement || !this._commonPrefix || !this._userEnteredText || this._commonPrefix.indexOf(this._userEnteredText) !== 0)
+            return;
+
+        if (!this.isSuggestBoxVisible()) {
+            this.acceptAutoComplete();
+            return;
+        }
+
+        this.autoCompleteElement.textContent = this._commonPrefix.substring(this._userEnteredText.length);
+        this.acceptSuggestion(true)
+    },
+
     /**
      * @param {Range=} originalPrefixRange
      */
@@ -533,7 +560,10 @@ WebInspector.TextPrompt.prototype = {
             this.dispatchEventToListeners(WebInspector.TextPrompt.Events.ItemApplied, { itemText: completionText });
     },
 
-    acceptSuggestion: function()
+    /**
+     * @param {boolean=} prefixAccepted
+     */
+    acceptSuggestion: function(prefixAccepted)
     {
         if (this._isAcceptingSuggestion)
             return false;
@@ -554,8 +584,11 @@ WebInspector.TextPrompt.prototype = {
         selection.removeAllRanges();
         selection.addRange(finalSelectionRange);
 
-        this.hideSuggestBox();
-        this.dispatchEventToListeners(WebInspector.TextPrompt.Events.ItemAccepted);
+        if (!prefixAccepted) {
+            this.hideSuggestBox();
+            this.dispatchEventToListeners(WebInspector.TextPrompt.Events.ItemAccepted);
+        } else
+            this.autoCompleteSoon(true);
 
         return true;
     },
@@ -663,7 +696,9 @@ WebInspector.TextPrompt.prototype = {
 
     tabKeyPressed: function(event)
     {
-        // Just consume the key.
+        this._completeCommonPrefix();
+
+        // Consume the key.
         return true;
     },
 
@@ -892,8 +927,9 @@ WebInspector.TextPrompt.SuggestBox = function(textPrompt, inputElement, classNam
     window.addEventListener("scroll", this._boundOnScroll, true);
     window.addEventListener("resize", this._boundOnResize, true);
 
-    var bodyElement = inputElement.ownerDocument.body;
-    this._element = bodyElement.createChild("div", "suggest-box " + (className || ""));
+    this._bodyElement = inputElement.ownerDocument.body;
+    this._element = inputElement.ownerDocument.createElement("div");
+    this._element.className = "suggest-box " + (className || "");
     this._element.addEventListener("mousedown", this._onboxmousedown.bind(this), true);
     this.containerElement = this._element.createChild("div", "container");
     this.contentElement = this.containerElement.createChild("div", "content");
@@ -902,7 +938,7 @@ WebInspector.TextPrompt.SuggestBox = function(textPrompt, inputElement, classNam
 WebInspector.TextPrompt.SuggestBox.prototype = {
     get visible()
     {
-        return this._element.hasStyleClass("visible");
+        return !!this._element.parentElement;
     },
 
     get hasSelection()
@@ -985,7 +1021,7 @@ WebInspector.TextPrompt.SuggestBox.prototype = {
         if (!this.visible)
             return;
 
-        this._element.removeStyleClass("visible");
+        this._element.parentElement.removeChild(this._element);
         delete this._selectedElement;
     },
 
@@ -993,7 +1029,7 @@ WebInspector.TextPrompt.SuggestBox.prototype = {
     {
         window.removeEventListener("scroll", this._boundOnScroll, true);
         window.removeEventListener("resize", this._boundOnResize, true);
-        this._element.parentElement.removeChild(this._element);
+        this.hide();
     },
 
     /**
@@ -1190,7 +1226,8 @@ WebInspector.TextPrompt.SuggestBox.prototype = {
         if (this._canShowBox(completions, canShowForSingleItem)) {
             this._updateItems(completions, canShowForSingleItem);
             this._updateBoxPosition(anchorBox);
-            this._element.addStyleClass("visible");
+            if (!this.visible)
+                this._bodyElement.appendChild(this._element);
             this._rememberRowCountPerViewport();
         } else
             this.hide();
diff --git a/Source/WebCore/inspector/front-end/TimelineAgent.js b/Source/WebCore/inspector/front-end/TimelineAgent.js
index 979d6dfe8..46ad7eae0 100644
--- a/Source/WebCore/inspector/front-end/TimelineAgent.js
+++ b/Source/WebCore/inspector/front-end/TimelineAgent.js
@@ -66,7 +66,7 @@ WebInspector.TimelineAgent.RecordType = {
     FunctionCall: "FunctionCall",
     GCEvent: "GCEvent",
 
-    RegisterAnimationFrameCallback: "RegisterAnimationFrameCallback",
-    CancelAnimationFrameCallback: "CancelAnimationFrameCallback",
-    FireAnimationFrameEvent: "FireAnimationFrameEvent"
+    RequestAnimationFrame: "RequestAnimationFrame",
+    CancelAnimationFrame: "CancelAnimationFrame",
+    FireAnimationFrame: "FireAnimationFrame"
 }
diff --git a/Source/WebCore/inspector/front-end/TimelineOverviewPane.js b/Source/WebCore/inspector/front-end/TimelineOverviewPane.js
index 8718f19e0..858742c6c 100644
--- a/Source/WebCore/inspector/front-end/TimelineOverviewPane.js
+++ b/Source/WebCore/inspector/front-end/TimelineOverviewPane.js
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2009 Google Inc. All rights reserved.
+ * Copyright (C) 2012 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
@@ -32,65 +32,66 @@
  * @constructor
  * @extends {WebInspector.Object}
  */
-WebInspector.TimelineOverviewPane = function(categories)
+WebInspector.TimelineOverviewPane = function(presentationModel)
 {
-    this._categories = categories;
+    this.element = document.createElement("div");
+    this.element.className = "fill";
 
-    this.statusBarFilters = document.createElement("div");
-    this.statusBarFilters.className = "status-bar-items";
-    for (var categoryName in this._categories) {
-        var category = this._categories[categoryName];
-        this.statusBarFilters.appendChild(this._createTimelineCategoryStatusBarCheckbox(category, this._onCheckboxClicked.bind(this, category)));
-    }
+    this._startAtZero = false;
+
+    this._presentationModel = presentationModel;
+
+    this.element = document.createElement("div");
+    this.element.id = "timeline-overview-panel";
+
+    this._topPaneSidebarElement = document.createElement("div");
+    this._topPaneSidebarElement.id = "timeline-overview-sidebar";
+
+    var overviewTreeElement = document.createElement("ol");
+    overviewTreeElement.className = "sidebar-tree";
+    this._topPaneSidebarElement.appendChild(overviewTreeElement);
+    this.element.appendChild(this._topPaneSidebarElement);
+
+    var topPaneSidebarTree = new TreeOutline(overviewTreeElement);
+    this._timelinesOverviewItem = new WebInspector.SidebarTreeElement("resources-time-graph-sidebar-item", WebInspector.UIString("Timelines"));
+    topPaneSidebarTree.appendChild(this._timelinesOverviewItem);
+    this._timelinesOverviewItem.revealAndSelect(false);
+    this._timelinesOverviewItem.onselect = this._showTimelines.bind(this);
+
+    this._memoryOverviewItem = new WebInspector.SidebarTreeElement("resources-size-graph-sidebar-item", WebInspector.UIString("Memory"));
+    topPaneSidebarTree.appendChild(this._memoryOverviewItem);
+    this._memoryOverviewItem.onselect = this._showMemoryGraph.bind(this);
 
     this._overviewGrid = new WebInspector.TimelineGrid();
     this._overviewGrid.element.id = "timeline-overview-grid";
     this._overviewGrid.itemsGraphsElement.id = "timeline-overview-timelines";
-    this._overviewGrid.element.addEventListener("mousedown", this._dragWindow.bind(this), true);
-    this._overviewGrid.element.addEventListener("mousewheel", this.scrollWindow.bind(this), true);
-    this._overviewGrid.element.addEventListener("dblclick", this._resizeWindowMaximum.bind(this), true);
 
     this._heapGraph = new WebInspector.HeapGraph();
     this._heapGraph.element.id = "timeline-overview-memory";
     this._overviewGrid.element.insertBefore(this._heapGraph.element, this._overviewGrid.itemsGraphsElement);
 
-    this.element = this._overviewGrid.element;
+    this._overviewWindow = new WebInspector.TimelineOverviewWindow(this._overviewGrid.element);
+    this._overviewWindow.addEventListener(WebInspector.TimelineOverviewWindow.Events.WindowChanged, this._onWindowChanged, this);
 
+    this.element.appendChild(this._overviewGrid.element);
+
+    var separatorElement = document.createElement("div");
+    separatorElement.id = "timeline-overview-separator";
+    this.element.appendChild(separatorElement);
+ 
     this._categoryGraphs = {};
     var i = 0;
-    for (var category in this._categories) {
-        var categoryGraph = new WebInspector.TimelineCategoryGraph(this._categories[category], i++ % 2);
+    var categories = this._presentationModel.categories;
+    for (var category in categories) {
+        var categoryGraph = new WebInspector.TimelineCategoryGraph(categories[category], i++ % 2);
         this._categoryGraphs[category] = categoryGraph;
         this._overviewGrid.itemsGraphsElement.appendChild(categoryGraph.graphElement);
     }
-    this._overviewGrid.setScrollAndDividerTop(0, 0);
-
-    this._overviewWindowElement = document.createElement("div");
-    this._overviewWindowElement.id = "timeline-overview-window";
-    this._overviewGrid.element.appendChild(this._overviewWindowElement);
-
-    this._overviewWindowBordersElement = document.createElement("div");
-    this._overviewWindowBordersElement.className = "timeline-overview-window-rulers";
-    this._overviewGrid.element.appendChild(this._overviewWindowBordersElement);
-
-    var overviewDividersBackground = document.createElement("div");
-    overviewDividersBackground.className = "timeline-overview-dividers-background";
-    this._overviewGrid.element.appendChild(overviewDividersBackground);
+    this._presentationModel.addEventListener(WebInspector.TimelinePresentationModel.Events.CategoryVisibilityChanged, this._onCategoryVisibilityChanged, this);
 
-    this._leftResizeElement = document.createElement("div");
-    this._leftResizeElement.className = "timeline-window-resizer";
-    this._leftResizeElement.style.left = 0;
-    this._overviewGrid.element.appendChild(this._leftResizeElement);
-
-    this._rightResizeElement = document.createElement("div");
-    this._rightResizeElement.className = "timeline-window-resizer timeline-window-resizer-right";
-    this._rightResizeElement.style.right = 0;
-    this._overviewGrid.element.appendChild(this._rightResizeElement);
+    this._overviewGrid.setScrollAndDividerTop(0, 0);
 
     this._overviewCalculator = new WebInspector.TimelineOverviewCalculator();
-
-    this.windowLeft = 0.0;
-    this.windowRight = 1.0;
 }
 
 WebInspector.TimelineOverviewPane.MinSelectableSize = 12;
@@ -99,43 +100,93 @@ WebInspector.TimelineOverviewPane.WindowScrollSpeedFactor = .3;
 
 WebInspector.TimelineOverviewPane.ResizerOffset = 3.5; // half pixel because offset values are not rounded but ceiled
 
+WebInspector.TimelineOverviewPane.Mode = {
+    Events: "Events",
+    Memory: "Memory"
+};
+
+WebInspector.TimelineOverviewPane.Events = {
+    ModeChanged: "ModeChanged"
+};
+
 WebInspector.TimelineOverviewPane.prototype = {
-    showTimelines: function(event) {
+    _showTimelines: function()
+    {
+        this._timelinesOverviewItem.revealAndSelect(false);
         this._heapGraph.hide();
         this._overviewGrid.itemsGraphsElement.removeStyleClass("hidden");
+        this.dispatchEventToListeners(WebInspector.TimelineOverviewPane.Events.ModeChanged, WebInspector.TimelineOverviewPane.Mode.Events);
     },
 
-    showMemoryGraph: function(records) {
+    _showMemoryGraph: function()
+    {
+        this._memoryOverviewItem.revealAndSelect(false);
         this._heapGraph.show();
-        this._heapGraph.update(records);
+        this._heapGraph.update(this._records);
         this._overviewGrid.itemsGraphsElement.addStyleClass("hidden");
+        this.dispatchEventToListeners(WebInspector.TimelineOverviewPane.Events.ModeChanged, WebInspector.TimelineOverviewPane.Mode.Memory);
     },
 
-    _onCheckboxClicked: function (category, event) {
-        if (event.target.checked)
-            category.hidden = false;
-        else
-            category.hidden = true;
-        this._categoryGraphs[category.name].dimmed = !event.target.checked;
-        this.dispatchEventToListeners("filter changed");
+    /**
+     * @param {boolean} enabled
+     */
+    setStartAtZero: function(enabled)
+    {
+        if (this._startAtZero === enabled)
+            return;
+        this._startAtZero = enabled;
+        if (enabled) {
+            if (this._heapGraph.visible)
+                this._showTimelines();
+            this.element.addStyleClass("timeline-start-at-zero");
+            this._startAtZeroOverview = new WebInspector.TimelineStartAtZeroOverview(this._presentationModel);
+            this._startAtZeroOverview.show(this.element);
+            this._startAtZeroOverview.update(this._records);
+        } else {
+            this.element.removeStyleClass("timeline-start-at-zero");
+            this._startAtZeroOverview.detach();
+            this._startAtZeroOverview = null;
+            this._showTimelines();
+        }
+    },
+
+    _onWindowChanged: function()
+    {
+        this._presentationModel.setWindowPosition(this._overviewWindow.windowLeft, this._overviewWindow.windowRight);
+    },
+
+    _onCategoryVisibilityChanged: function(event)
+    {
+        var category = event.data;
+        this._categoryGraphs[category.name].dimmed = category.hidden;
     },
 
     _forAllRecords: function(recordsArray, callback)
     {
         if (!recordsArray)
             return;
-        for (var i = 0; i < recordsArray.length; ++i) {
-            callback(recordsArray[i]);
-            this._forAllRecords(recordsArray[i].children, callback);
+        var stack = [{array: recordsArray, index: 0}];
+        while (stack.length) {
+            var entry = stack[stack.length - 1];
+            var records = entry.array;
+            if (entry.index < records.length) {
+                 var record = records[entry.index];
+                 callback(record);
+                 if (record.children)
+                     stack.push({array: record.children, index: 0});
+                 ++entry.index;
+            } else
+                stack.pop();
         }
     },
 
     update: function(records, showShortEvents)
     {
+        this._records = records;
         this._showShortEvents = showShortEvents;
         // Clear summary bars.
         var timelines = {};
-        for (var category in this._categories) {
+        for (var category in this._presentationModel.categories) {
             timelines[category] = [];
             this._categoryGraphs[category].clearChunks();
         }
@@ -158,7 +209,7 @@ WebInspector.TimelineOverviewPane.prototype = {
         this._forAllRecords(records, markPercentagesForRecord.bind(this));
 
         // Convert sparse arrays to continuous segments, render graphs for each.
-        for (var category in this._categories) {
+        for (var category in this._presentationModel.categories) {
             var timeline = timelines[category];
             window.timelineSaved = timeline;
             var chunkStart = -1;
@@ -182,7 +233,8 @@ WebInspector.TimelineOverviewPane.prototype = {
         this._heapGraph.setSize(this._overviewGrid.element.offsetWidth, 60);
         if (this._heapGraph.visible)
             this._heapGraph.update(records);
-
+        if (this._startAtZeroOverview)
+            this._startAtZeroOverview.update(records);
         this._overviewGrid.updateDividers(true, this._overviewCalculator);
     },
 
@@ -206,22 +258,81 @@ WebInspector.TimelineOverviewPane.prototype = {
     sidebarResized: function(width)
     {
         this._overviewGrid.element.style.left = width + "px";
-        // Min width = <number of buttons on the left> * 31
-        this.statusBarFilters.style.left = Math.max(7 * 31, width) + "px";
+        this._topPaneSidebarElement.style.width = width + "px";
+    },
+
+    reset: function()
+    {
+        this._overviewWindow.reset();
+        this._overviewCalculator.reset();
+        this._overviewGrid.updateDividers(true, this._overviewCalculator);
+        if (this._startAtZeroOverview)
+            this._startAtZeroOverview.reset();
     },
 
+    scrollWindow: function(event)
+    {
+        this._overviewWindow.scrollWindow(event);
+    }
+}
+
+WebInspector.TimelineOverviewPane.prototype.__proto__ = WebInspector.Object.prototype;
+
+/**
+ * @constructor
+ * @extends {WebInspector.Object}
+ * @param {Element} parentElement
+ */
+WebInspector.TimelineOverviewWindow = function(parentElement)
+{
+    this._parentElement = parentElement;
+
+    this.windowLeft = 0.0;
+    this.windowRight = 1.0;
+
+    this._parentElement.addEventListener("mousedown", this._dragWindow.bind(this), true);
+    this._parentElement.addEventListener("mousewheel", this.scrollWindow.bind(this), true);
+    this._parentElement.addEventListener("dblclick", this._resizeWindowMaximum.bind(this), true);
+
+    this._overviewWindowElement = document.createElement("div");
+    this._overviewWindowElement.className = "timeline-overview-window";
+    parentElement.appendChild(this._overviewWindowElement);
+
+    this._overviewWindowBordersElement = document.createElement("div");
+    this._overviewWindowBordersElement.className = "timeline-overview-window-rulers";
+    parentElement.appendChild(this._overviewWindowBordersElement);
+
+    var overviewDividersBackground = document.createElement("div");
+    overviewDividersBackground.className = "timeline-overview-dividers-background";
+    parentElement.appendChild(overviewDividersBackground);
+
+    this._leftResizeElement = document.createElement("div");
+    this._leftResizeElement.className = "timeline-window-resizer";
+    this._leftResizeElement.style.left = 0;
+    parentElement.appendChild(this._leftResizeElement);
+
+    this._rightResizeElement = document.createElement("div");
+    this._rightResizeElement.className = "timeline-window-resizer timeline-window-resizer-right";
+    this._rightResizeElement.style.right = 0;
+    parentElement.appendChild(this._rightResizeElement);
+}
+
+WebInspector.TimelineOverviewWindow.Events = {
+    WindowChanged: "WindowChanged"
+}
+
+WebInspector.TimelineOverviewWindow.prototype = {
     reset: function()
     {
         this.windowLeft = 0.0;
         this.windowRight = 1.0;
+
         this._overviewWindowElement.style.left = "0%";
         this._overviewWindowElement.style.width = "100%";
         this._overviewWindowBordersElement.style.left = "0%";
         this._overviewWindowBordersElement.style.right = "0%";
         this._leftResizeElement.style.left = "0%";
         this._rightResizeElement.style.left = "100%";
-        this._overviewCalculator.reset();
-        this._overviewGrid.updateDividers(true, this._overviewCalculator);
     },
 
     _resizeWindow: function(resizeElement, event)
@@ -232,9 +343,9 @@ WebInspector.TimelineOverviewPane.prototype = {
     _windowResizeDragging: function(resizeElement, event)
     {
         if (resizeElement === this._leftResizeElement)
-            this._resizeWindowLeft(event.pageX - this._overviewGrid.element.offsetLeft);
+            this._resizeWindowLeft(event.pageX - this._parentElement.offsetLeft);
         else
-            this._resizeWindowRight(event.pageX - this._overviewGrid.element.offsetLeft);
+            this._resizeWindowRight(event.pageX - this._parentElement.offsetLeft);
         event.preventDefault();
     },
 
@@ -242,13 +353,13 @@ WebInspector.TimelineOverviewPane.prototype = {
     {
         var node = event.target;
         while (node) {
-            if (node === this._overviewGrid._dividersLabelBarElement) {
+            if (node.hasStyleClass("resources-dividers-label-bar")) {
                 WebInspector.elementDragStart(this._overviewWindowElement, this._windowDragging.bind(this, event.pageX,
                     this._leftResizeElement.offsetLeft + WebInspector.TimelineOverviewPane.ResizerOffset, this._rightResizeElement.offsetLeft + WebInspector.TimelineOverviewPane.ResizerOffset), this._endWindowDragging.bind(this), event, "ew-resize");
                 break;
-            } else if (node === this._overviewGrid.element) {
-                var position = event.pageX - this._overviewGrid.element.offsetLeft;
-                this._overviewWindowSelector = new WebInspector.TimelinePanel.WindowSelector(this._overviewGrid.element, position, event);
+            } else if (node === this._parentElement) {
+                var position = event.pageX - this._parentElement.offsetLeft;
+                this._overviewWindowSelector = new WebInspector.TimelinePanel.WindowSelector(this._parentElement, position);
                 WebInspector.elementDragStart(null, this._windowSelectorDragging.bind(this), this._endWindowSelectorDragging.bind(this), event, "ew-resize");
                 break;
             } else if (node === this._leftResizeElement || node === this._rightResizeElement) {
@@ -261,20 +372,21 @@ WebInspector.TimelineOverviewPane.prototype = {
 
     _windowSelectorDragging: function(event)
     {
-        this._overviewWindowSelector._updatePosition(event.pageX - this._overviewGrid.element.offsetLeft);
+        this._overviewWindowSelector._updatePosition(event.pageX - this._parentElement.offsetLeft);
         event.preventDefault();
     },
 
     _endWindowSelectorDragging: function(event)
     {
         WebInspector.elementDragEnd(event);
-        var window = this._overviewWindowSelector._close(event.pageX - this._overviewGrid.element.offsetLeft);
+        var window = this._overviewWindowSelector._close(event.pageX - this._parentElement.offsetLeft);
         delete this._overviewWindowSelector;
-        if (window.end - window.start < WebInspector.TimelineOverviewPane.MinSelectableSize)
-            if (this._overviewGrid.itemsGraphsElement.offsetWidth - window.end > WebInspector.TimelineOverviewPane.MinSelectableSize)
+        if (window.end - window.start < WebInspector.TimelineOverviewPane.MinSelectableSize) {
+            if (this._parentElement.clientWidth - window.end > WebInspector.TimelineOverviewPane.MinSelectableSize)
                 window.end = window.start + WebInspector.TimelineOverviewPane.MinSelectableSize;
             else
                 window.start = window.end - WebInspector.TimelineOverviewPane.MinSelectableSize;
+        }
         this._setWindowPosition(window.start, window.end);
     },
 
@@ -290,8 +402,8 @@ WebInspector.TimelineOverviewPane.prototype = {
             end = windowSize;
         }
 
-        if (end > this._overviewGrid.element.clientWidth) {
-            end = this._overviewGrid.element.clientWidth;
+        if (end > this._parentElement.clientWidth) {
+            end = this._parentElement.clientWidth;
             start = end - windowSize;
         }
         this._setWindowPosition(start, end);
@@ -312,8 +424,8 @@ WebInspector.TimelineOverviewPane.prototype = {
     _resizeWindowRight: function(end)
     {
         // Glue to edge.
-        if (end > this._overviewGrid.element.clientWidth - 10)
-            end = this._overviewGrid.element.clientWidth;
+        if (end > this._parentElement.clientWidth - 10)
+            end = this._parentElement.clientWidth;
         else if (end < this._leftResizeElement.offsetLeft + WebInspector.TimelineOverviewPane.MinSelectableSize)
             end = this._leftResizeElement.offsetLeft + WebInspector.TimelineOverviewPane.MinSelectableSize;
         this._setWindowPosition(null, end);
@@ -321,25 +433,26 @@ WebInspector.TimelineOverviewPane.prototype = {
 
     _resizeWindowMaximum: function()
     {
-        this._setWindowPosition(0, this._overviewGrid.element.clientWidth);
+        this._setWindowPosition(0, this._parentElement.clientWidth);
     },
 
     _setWindowPosition: function(start, end)
     {
-        const rulerAdjustment = 1 / this._overviewGrid.element.clientWidth;
+        var clientWidth = this._parentElement.clientWidth;
+        const rulerAdjustment = 1 / clientWidth;
         if (typeof start === "number") {
-            this.windowLeft = start / this._overviewGrid.element.clientWidth;
+            this.windowLeft = start / clientWidth;
             this._leftResizeElement.style.left = this.windowLeft * 100 + "%";
             this._overviewWindowElement.style.left = this.windowLeft * 100 + "%";
             this._overviewWindowBordersElement.style.left = (this.windowLeft - rulerAdjustment) * 100 + "%";
         }
         if (typeof end === "number") {
-            this.windowRight = end / this._overviewGrid.element.clientWidth;
+            this.windowRight = end / clientWidth;
             this._rightResizeElement.style.left = this.windowRight * 100 + "%";
         }
         this._overviewWindowElement.style.width = (this.windowRight - this.windowLeft) * 100 + "%";
         this._overviewWindowBordersElement.style.right = (1 - this.windowRight + 2 * rulerAdjustment) * 100 + "%";
-        this.dispatchEventToListeners("window changed");
+        this.dispatchEventToListeners(WebInspector.TimelineOverviewWindow.Events.WindowChanged);
     },
 
     _endWindowDragging: function(event)
@@ -349,37 +462,16 @@ WebInspector.TimelineOverviewPane.prototype = {
 
     scrollWindow: function(event)
     {
-        if (typeof event.wheelDeltaX === "number" && event.wheelDeltaX !== 0)
-            this._windowDragging(event.pageX + Math.round(event.wheelDeltaX * WebInspector.TimelineOverviewPane.WindowScrollSpeedFactor), this._leftResizeElement.offsetLeft + WebInspector.TimelineOverviewPane.ResizerOffset, this._rightResizeElement.offsetLeft + WebInspector.TimelineOverviewPane.ResizerOffset, event);
-    },
-
-    _createTimelineCategoryStatusBarCheckbox: function(category, onCheckboxClicked)
-    {
-        var labelContainer = document.createElement("div");
-        labelContainer.addStyleClass("timeline-category-statusbar-item");
-        labelContainer.addStyleClass("timeline-category-" + category.name);
-        labelContainer.addStyleClass("status-bar-item");
-
-        var label = document.createElement("label");
-        var checkElement = document.createElement("input");
-        checkElement.type = "checkbox";
-        checkElement.className = "timeline-category-checkbox";
-        checkElement.checked = true;
-        checkElement.addEventListener("click", onCheckboxClicked, false);
-        label.appendChild(checkElement);
-
-        var typeElement = document.createElement("span");
-        typeElement.className = "type";
-        typeElement.textContent = category.title;
-        label.appendChild(typeElement);
-
-        labelContainer.appendChild(label);
-        return labelContainer;
+        if (typeof event.wheelDeltaX === "number" && event.wheelDeltaX !== 0) {
+            this._windowDragging(event.pageX + Math.round(event.wheelDeltaX * WebInspector.TimelineOverviewPane.WindowScrollSpeedFactor),
+                this._leftResizeElement.offsetLeft + WebInspector.TimelineOverviewPane.ResizerOffset,
+                this._rightResizeElement.offsetLeft + WebInspector.TimelineOverviewPane.ResizerOffset,
+                event);
+        }
     }
-
 }
 
-WebInspector.TimelineOverviewPane.prototype.__proto__ = WebInspector.Object.prototype;
+WebInspector.TimelineOverviewWindow.prototype.__proto__ = WebInspector.Object.prototype;
 
 /**
  * @constructor
@@ -473,7 +565,7 @@ WebInspector.TimelineCategoryGraph.prototype = {
 /**
  * @constructor
  */
-WebInspector.TimelinePanel.WindowSelector = function(parent, position, event)
+WebInspector.TimelinePanel.WindowSelector = function(parent, position)
 {
     this._startPosition = position;
     this._width = parent.offsetWidth;
@@ -639,3 +731,100 @@ WebInspector.HeapGraph.prototype = {
 
     _forAllRecords: WebInspector.TimelineOverviewPane.prototype._forAllRecords
 }
+
+/**
+ * @constructor
+ * @param {WebInspector.TimelinePresentationModel} model
+ * @extends {WebInspector.View}
+ */
+WebInspector.TimelineStartAtZeroOverview = function(model) {
+    WebInspector.View.call(this);
+    this._presentationModel = model;
+    this.element.className = "timeline-overview-start-at-zero fill";
+    this._overviewElement = this.element.createChild("div", "timeline-overview-start-at-zero-bars fill");
+    this._overviewWindow = new WebInspector.TimelineOverviewWindow(this.element);
+    this._overviewWindow.addEventListener(WebInspector.TimelineOverviewWindow.Events.WindowChanged, this._onWindowChanged, this);
+    this._recordsPerBar = 1;
+    this._calculator = new WebInspector.TimelineStartAtZeroCalculator();
+}
+
+WebInspector.TimelineStartAtZeroOverview.prototype = {
+    reset: function()
+    {
+        this._recordsPerBar = 1;
+        this._overviewWindow.reset();
+    },
+
+    update: function(records)
+    {
+        this._calculator.reset();
+        records = this._filterRecords(records);
+        records.forEach(this._calculator.updateBoundaries, this._calculator);
+        this._calculator.calculateWindow();
+
+        var scale = (this._overviewElement.clientHeight - 4) / this._calculator.boundarySpan;
+        this._recordsPerBar = Math.max(1, records.length * 4 / this.element.clientWidth);
+        var numberOfBars = Math.ceil(records.length / this._recordsPerBar);
+
+        this._overviewElement.removeChildren();
+        var padding = this._overviewElement.createChild("div", "padding");
+
+        for (var i = 0; i < numberOfBars; ++i) {
+            var index = Math.floor(i * this._recordsPerBar);
+            var longestRecord = records[index];
+            var stopIndex = Math.min(Math.floor((i + 1) * this._recordsPerBar), records.length);
+            for (++index; index < stopIndex; ++index) {
+                var record = records[index];
+                if (longestRecord.endTime - longestRecord.startTime < record.endTime - record.startTime)
+                    longestRecord = record;
+            }
+            this._overviewElement.insertBefore(this._buildBar(longestRecord, scale), padding);
+        }
+    },
+
+    _filterRecords: function(records)
+    {
+        function filter(record)
+        {
+            return !record.category.hidden;
+        }
+        return records.filter(filter);
+    },
+
+    _buildBar: function(record, scale)
+    {
+        var outer = document.createElement("div");
+        outer.className = "timeline-bar-vertical";
+        var stats = record.aggregatedStats;
+        var categories = Object.keys(stats);
+        for (var i = 0; i < categories.length; ++i) {
+            var category = categories[i];
+            var duration = stats[category];
+            if (!duration)
+                continue;
+            var bar = outer.createChild("div", "timeline-" + category);
+            bar.style.height = (stats[category] * scale) + "px";
+        }
+        return outer;
+    },
+
+    _onWindowChanged: function()
+    {
+        var leftOffset = this._overviewWindow.windowLeft * this.element.clientWidth;
+        var rightOffset = this._overviewWindow.windowRight * this.element.clientWidth;
+        var bars = this._overviewElement.children;
+        var offset0 = bars[0] ? bars[0].offsetLeft : 4;
+        var barWidth = 9;
+        if (bars.length > 2) {
+            var offset1 = bars[bars.length - 2].offsetLeft;
+            barWidth = (offset1 - offset0) / (bars.length - 2);
+        }
+
+        var leftIndex = Math.floor((leftOffset - offset0) / barWidth * this._recordsPerBar);
+        var rightIndex = rightOffset + barWidth >= this.element.clientWidth ? null : Math.ceil((rightOffset - offset0 - 2) / barWidth * this._recordsPerBar);
+
+        this._presentationModel.setWindowIndices(leftIndex, rightIndex);
+    }
+}
+
+WebInspector.TimelineStartAtZeroOverview.prototype.__proto__ = WebInspector.View.prototype;
diff --git a/Source/WebCore/inspector/front-end/TimelinePanel.js b/Source/WebCore/inspector/front-end/TimelinePanel.js
index 28db4ed05..bf580cd21 100644
--- a/Source/WebCore/inspector/front-end/TimelinePanel.js
+++ b/Source/WebCore/inspector/front-end/TimelinePanel.js
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2011 Google Inc. All rights reserved.
+ * Copyright (C) 2012 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
@@ -37,7 +37,16 @@ WebInspector.TimelinePanel = function()
     WebInspector.Panel.call(this, "timeline");
     this.registerRequiredCSS("timelinePanel.css");
 
-    this.element.appendChild(this._createTopPane());
+    this._presentationModel = new WebInspector.TimelinePresentationModel();
+    this._presentationModel.addCategory(new WebInspector.TimelineCategory("loading", WebInspector.UIString("Loading"), "rgb(47,102,236)"));
+    this._presentationModel.addCategory(new WebInspector.TimelineCategory("scripting", WebInspector.UIString("Scripting"), "rgb(157,231,119)"));
+    this._presentationModel.addCategory(new WebInspector.TimelineCategory("rendering", WebInspector.UIString("Rendering"), "rgb(164,60,255)"));
+    this._presentationModel.addEventListener(WebInspector.TimelinePresentationModel.Events.WindowChanged, this._scheduleRefresh.bind(this, false));
+    this._presentationModel.addEventListener(WebInspector.TimelinePresentationModel.Events.CategoryVisibilityChanged, this._scheduleRefresh.bind(this, true));
+
+    this._overviewPane = new WebInspector.TimelineOverviewPane(this._presentationModel);
+
+    this.element.appendChild(this._overviewPane.element);
     this.element.addEventListener("contextmenu", this._contextMenu.bind(this), true);
     this.element.tabIndex = 0;
 
@@ -56,6 +65,7 @@ WebInspector.TimelinePanel = function()
         this._timelineMemorySplitter.addEventListener("mousedown", this._startSplitterDragging.bind(this), false);
         this._timelineMemorySplitter.addStyleClass("hidden");
         this._memoryStatistics = new WebInspector.MemoryStatistics(this, this.splitView.preferredSidebarWidth());
+        this._overviewPane.addEventListener(WebInspector.TimelineOverviewPane.Events.ModeChanged, this._timelinesOverviewModeChanged, this);
     }
 
     var itemsTreeElement = new WebInspector.SidebarSectionTreeElement(WebInspector.UIString("RECORDS"), {}, true);
@@ -92,10 +102,9 @@ WebInspector.TimelinePanel = function()
     this._sendRequestRecords = {};
     this._scheduledResourceRequests = {};
     this._timerRecords = {};
-    this._registeredAnimationCallbackRecords = {};
+    this._requestAnimationFrameRecords = {};
 
     this._calculator = new WebInspector.TimelineCalculator();
-    this._calculator._showShortEvents = false;
     var shortRecordThresholdTitle = Number.secondsToString(WebInspector.TimelinePanel.shortRecordThreshold);
     this._showShortRecordsTitleText = WebInspector.UIString("Show the records that are shorter than %s", shortRecordThresholdTitle);
     this._hideShortRecordsTitleText = WebInspector.UIString("Hide the records that are shorter than %s", shortRecordThresholdTitle);
@@ -110,15 +119,16 @@ WebInspector.TimelinePanel = function()
 
     // Disable short events filter by default.
     this.toggleFilterButton.toggled = true;
-    this._calculator._showShortEvents = this.toggleFilterButton.toggled;
+    this._showShortEvents = this.toggleFilterButton.toggled;
     this._timeStampRecords = [];
     this._expandOffset = 15;
 
     this._createFileSelector();
-    this._model = new WebInspector.TimelineModel(this);
+    this._model = new WebInspector.TimelineModel();
+    this._model.addEventListener(WebInspector.TimelineModel.Events.RecordAdded, this._onTimelineEventRecorded, this);
+    this._model.addEventListener(WebInspector.TimelineModel.Events.RecordsCleared, this._onRecordsCleared, this);
 
     this._registerShortcuts();
-    WebInspector.timelineManager.addEventListener(WebInspector.TimelineManager.EventTypes.TimelineEventRecorded, this._onTimelineEventRecorded, this);
     this._linkifier = WebInspector.debuggerPresentationModel.createLinkifier();
 }
 
@@ -181,39 +191,6 @@ WebInspector.TimelinePanel.prototype = {
         return this._linkifyLocation(callFrame.url, callFrame.lineNumber, callFrame.columnNumber);
     },
 
-    _createTopPane: function() {
-        var topPaneElement = document.createElement("div");
-        topPaneElement.id = "timeline-overview-panel";
-
-        this._topPaneSidebarElement = document.createElement("div");
-        this._topPaneSidebarElement.id = "timeline-overview-sidebar";
-
-        var overviewTreeElement = document.createElement("ol");
-        overviewTreeElement.className = "sidebar-tree";
-        this._topPaneSidebarElement.appendChild(overviewTreeElement);
-        topPaneElement.appendChild(this._topPaneSidebarElement);
-
-        var topPaneSidebarTree = new TreeOutline(overviewTreeElement);
-        var timelinesOverviewItem = new WebInspector.SidebarTreeElement("resources-time-graph-sidebar-item", WebInspector.UIString("Timelines"));
-        topPaneSidebarTree.appendChild(timelinesOverviewItem);
-        timelinesOverviewItem.revealAndSelect(false);
-        timelinesOverviewItem.onselect = this._timelinesOverviewItemSelected.bind(this);
-
-        var memoryOverviewItem = new WebInspector.SidebarTreeElement("resources-size-graph-sidebar-item", WebInspector.UIString("Memory"));
-        topPaneSidebarTree.appendChild(memoryOverviewItem);
-        memoryOverviewItem.onselect = this._memoryOverviewItemSelected.bind(this);
-
-        this._overviewPane = new WebInspector.TimelineOverviewPane(this.categories);
-        this._overviewPane.addEventListener("window changed", this._windowChanged, this);
-        this._overviewPane.addEventListener("filter changed", this._refresh, this);
-        topPaneElement.appendChild(this._overviewPane.element);
-
-        var separatorElement = document.createElement("div");
-        separatorElement.id = "timeline-overview-separator";
-        topPaneElement.appendChild(separatorElement);
-        return topPaneElement;
-    },
-
     get calculator()
     {
         return this._calculator;
@@ -226,23 +203,13 @@ WebInspector.TimelinePanel.prototype = {
 
     get statusBarItems()
     {
-        var result = [this.toggleFilterButton.element, this.toggleTimelineButton.element, this.garbageCollectButton.element, this.clearButton.element];
-        if (this._memoryStatisticsButton)
-            result.push(this._memoryStatisticsButton.element);
-        result.push(this._overviewPane.statusBarFilters);
-        return result;
-    },
+        var statusBarItems = [ this.toggleFilterButton.element, this.toggleTimelineButton.element, this.clearButton.element, this.garbageCollectButton.element, this._glueParentButton.element ];
 
-    get categories()
-    {
-        if (!this._categories) {
-            this._categories = {
-                loading: new WebInspector.TimelineCategory("loading", WebInspector.UIString("Loading"), "rgb(47,102,236)"),
-                scripting: new WebInspector.TimelineCategory("scripting", WebInspector.UIString("Scripting"), "rgb(157,231,119)"),
-                rendering: new WebInspector.TimelineCategory("rendering", WebInspector.UIString("Rendering"), "rgb(164,60,255)")
-            };
-        }
-        return this._categories;
+        if (WebInspector.experimentsSettings.timelineStartAtZero.isEnabled())
+            statusBarItems.push(this.toggleStartAtZeroButton.element);
+
+        statusBarItems.push(this.statusBarFilters);
+        return statusBarItems;
     },
 
     get defaultFocusedElement()
@@ -254,31 +221,33 @@ WebInspector.TimelinePanel.prototype = {
     {
         if (!this._recordStylesArray) {
             var recordTypes = WebInspector.TimelineAgent.RecordType;
+            var categories = this._presentationModel.categories;
+
             var recordStyles = {};
-            recordStyles[recordTypes.EventDispatch] = { title: WebInspector.UIString("Event"), category: this.categories.scripting };
-            recordStyles[recordTypes.Layout] = { title: WebInspector.UIString("Layout"), category: this.categories.rendering };
-            recordStyles[recordTypes.RecalculateStyles] = { title: WebInspector.UIString("Recalculate Style"), category: this.categories.rendering };
-            recordStyles[recordTypes.Paint] = { title: WebInspector.UIString("Paint"), category: this.categories.rendering };
-            recordStyles[recordTypes.ParseHTML] = { title: WebInspector.UIString("Parse"), category: this.categories.loading };
-            recordStyles[recordTypes.TimerInstall] = { title: WebInspector.UIString("Install Timer"), category: this.categories.scripting };
-            recordStyles[recordTypes.TimerRemove] = { title: WebInspector.UIString("Remove Timer"), category: this.categories.scripting };
-            recordStyles[recordTypes.TimerFire] = { title: WebInspector.UIString("Timer Fired"), category: this.categories.scripting };
-            recordStyles[recordTypes.XHRReadyStateChange] = { title: WebInspector.UIString("XHR Ready State Change"), category: this.categories.scripting };
-            recordStyles[recordTypes.XHRLoad] = { title: WebInspector.UIString("XHR Load"), category: this.categories.scripting };
-            recordStyles[recordTypes.EvaluateScript] = { title: WebInspector.UIString("Evaluate Script"), category: this.categories.scripting };
-            recordStyles[recordTypes.TimeStamp] = { title: WebInspector.UIString("Stamp"), category: this.categories.scripting };
-            recordStyles[recordTypes.ResourceSendRequest] = { title: WebInspector.UIString("Send Request"), category: this.categories.loading };
-            recordStyles[recordTypes.ResourceReceiveResponse] = { title: WebInspector.UIString("Receive Response"), category: this.categories.loading };
-            recordStyles[recordTypes.ResourceFinish] = { title: WebInspector.UIString("Finish Loading"), category: this.categories.loading };
-            recordStyles[recordTypes.FunctionCall] = { title: WebInspector.UIString("Function Call"), category: this.categories.scripting };
-            recordStyles[recordTypes.ResourceReceivedData] = { title: WebInspector.UIString("Receive Data"), category: this.categories.loading };
-            recordStyles[recordTypes.GCEvent] = { title: WebInspector.UIString("GC Event"), category: this.categories.scripting };
-            recordStyles[recordTypes.MarkDOMContent] = { title: WebInspector.UIString("DOMContent event"), category: this.categories.scripting };
-            recordStyles[recordTypes.MarkLoad] = { title: WebInspector.UIString("Load event"), category: this.categories.scripting };
-            recordStyles[recordTypes.ScheduleResourceRequest] = { title: WebInspector.UIString("Schedule Request"), category: this.categories.loading };
-            recordStyles[recordTypes.RegisterAnimationFrameCallback] = { title: WebInspector.UIString("Register Animation Callback"), category: this.categories.scripting };
-            recordStyles[recordTypes.CancelAnimationFrameCallback] = { title: WebInspector.UIString("Cancel Animation Callback"), category: this.categories.scripting };
-            recordStyles[recordTypes.FireAnimationFrameEvent] = { title: WebInspector.UIString("Animation Frame Event"), category: this.categories.scripting };
+            recordStyles[recordTypes.EventDispatch] = { title: WebInspector.UIString("Event"), category: categories["scripting"] };
+            recordStyles[recordTypes.Layout] = { title: WebInspector.UIString("Layout"), category: categories["rendering"] };
+            recordStyles[recordTypes.RecalculateStyles] = { title: WebInspector.UIString("Recalculate Style"), category: categories["rendering"] };
+            recordStyles[recordTypes.Paint] = { title: WebInspector.UIString("Paint"), category: categories["rendering"] };
+            recordStyles[recordTypes.ParseHTML] = { title: WebInspector.UIString("Parse"), category: categories["loading"] };
+            recordStyles[recordTypes.TimerInstall] = { title: WebInspector.UIString("Install Timer"), category: categories["scripting"] };
+            recordStyles[recordTypes.TimerRemove] = { title: WebInspector.UIString("Remove Timer"), category: categories["scripting"] };
+            recordStyles[recordTypes.TimerFire] = { title: WebInspector.UIString("Timer Fired"), category: categories["scripting"] };
+            recordStyles[recordTypes.XHRReadyStateChange] = { title: WebInspector.UIString("XHR Ready State Change"), category: categories["scripting"] };
+            recordStyles[recordTypes.XHRLoad] = { title: WebInspector.UIString("XHR Load"), category: categories["scripting"] };
+            recordStyles[recordTypes.EvaluateScript] = { title: WebInspector.UIString("Evaluate Script"), category: categories["scripting"] };
+            recordStyles[recordTypes.TimeStamp] = { title: WebInspector.UIString("Stamp"), category: categories["scripting"] };
+            recordStyles[recordTypes.ResourceSendRequest] = { title: WebInspector.UIString("Send Request"), category: categories["loading"] };
+            recordStyles[recordTypes.ResourceReceiveResponse] = { title: WebInspector.UIString("Receive Response"), category: categories["loading"] };
+            recordStyles[recordTypes.ResourceFinish] = { title: WebInspector.UIString("Finish Loading"), category: categories["loading"] };
+            recordStyles[recordTypes.FunctionCall] = { title: WebInspector.UIString("Function Call"), category: categories["scripting"] };
+            recordStyles[recordTypes.ResourceReceivedData] = { title: WebInspector.UIString("Receive Data"), category: categories["loading"] };
+            recordStyles[recordTypes.GCEvent] = { title: WebInspector.UIString("GC Event"), category: categories["scripting"] };
+            recordStyles[recordTypes.MarkDOMContent] = { title: WebInspector.UIString("DOMContent event"), category: categories["scripting"] };
+            recordStyles[recordTypes.MarkLoad] = { title: WebInspector.UIString("Load event"), category: categories["scripting"] };
+            recordStyles[recordTypes.ScheduleResourceRequest] = { title: WebInspector.UIString("Schedule Request"), category: categories["loading"] };
+            recordStyles[recordTypes.RequestAnimationFrame] = { title: WebInspector.UIString("Request Animation Frame"), category: categories["scripting"] };
+            recordStyles[recordTypes.CancelAnimationFrame] = { title: WebInspector.UIString("Cancel Animation Frame"), category: categories["scripting"] };
+            recordStyles[recordTypes.FireAnimationFrame] = { title: WebInspector.UIString("Animation Frame Fired"), category: categories["scripting"] };
             this._recordStylesArray = recordStyles;
         }
         return this._recordStylesArray;
@@ -298,13 +267,52 @@ WebInspector.TimelinePanel.prototype = {
         this.garbageCollectButton = new WebInspector.StatusBarButton(WebInspector.UIString("Collect Garbage"), "garbage-collect-status-bar-item");
         this.garbageCollectButton.addEventListener("click", this._garbageCollectButtonClicked, this);
 
-        if (WebInspector.experimentsSettings.showMemoryCounters.isEnabled()) {
-            this._memoryStatisticsButton = new WebInspector.StatusBarButton(WebInspector.UIString("Toggle DOM counters graphs"), "dom-counters-status-bar-item");
-            this._memoryStatisticsButton.addEventListener("click", this._toggleMemoryStatistics, this);
-        }
+        this.toggleStartAtZeroButton = new WebInspector.StatusBarButton(WebInspector.UIString("Display all top level events starting at zero"), "timeline-start-at-zero-status-bar-item");
+        this.toggleStartAtZeroButton.addEventListener("click", this._toggleStartAtZeroButtonClicked, this);
 
         this.recordsCounter = document.createElement("span");
         this.recordsCounter.className = "timeline-records-counter";
+
+        this._glueParentButton = new WebInspector.StatusBarButton(WebInspector.UIString("Glue asynchronous events to causes"), "glue-async-status-bar-item");
+        this._glueParentButton.toggled = true;
+        this._glueParentButton.addEventListener("click", this._glueParentButtonClicked, this);
+
+        this.statusBarFilters = document.createElement("div");
+        this.statusBarFilters.className = "status-bar-items";
+        var categories = this._presentationModel.categories;
+        for (var categoryName in categories) {
+            var category = categories[categoryName];
+            this.statusBarFilters.appendChild(this._createTimelineCategoryStatusBarCheckbox(category, this._onCategoryCheckboxClicked.bind(this, category)));
+        }
+    },
+
+    _createTimelineCategoryStatusBarCheckbox: function(category, onCheckboxClicked)
+    {
+        var labelContainer = document.createElement("div");
+        labelContainer.addStyleClass("timeline-category-statusbar-item");
+        labelContainer.addStyleClass("timeline-category-" + category.name);
+        labelContainer.addStyleClass("status-bar-item");
+
+        var label = document.createElement("label");
+        var checkElement = document.createElement("input");
+        checkElement.type = "checkbox";
+        checkElement.className = "timeline-category-checkbox";
+        checkElement.checked = true;
+        checkElement.addEventListener("click", onCheckboxClicked, false);
+        label.appendChild(checkElement);
+
+        var typeElement = document.createElement("span");
+        typeElement.className = "type";
+        typeElement.textContent = category.title;
+        label.appendChild(typeElement);
+
+        labelContainer.appendChild(label);
+        return labelContainer;
+    },
+
+    _onCategoryCheckboxClicked: function(category, event)
+    {
+        this._presentationModel.setCategoryVisibility(category, event.target.checked);
     },
 
     _registerShortcuts: function()
@@ -355,11 +363,10 @@ WebInspector.TimelinePanel.prototype = {
 
     _loadFromFile: function()
     {
-        if (this.toggleTimelineButton.toggled)
-            WebInspector.timelineManager.stop();
-
-        this._clearPanel();
-
+        if (this.toggleTimelineButton.toggled) {
+            this.toggleTimelineButton.toggled = false;
+            this._model.stopRecord();
+        }
         this._model._loadFromFile(this._fileSelectorElement.files[0]);
         this._createFileSelector();
     },
@@ -410,23 +417,33 @@ WebInspector.TimelinePanel.prototype = {
         return eventDividerPadding;
     },
 
-    _timelinesOverviewItemSelected: function(event)
-    {
-        this._overviewPane.showTimelines();
-    },
-
-    _memoryOverviewItemSelected: function(event)
+    _timelinesOverviewModeChanged: function(event)
     {
-        this._overviewPane.showMemoryGraph(this._rootRecord.children);
+        if (!this._memoryStatistics)
+            return;
+        var shouldShowMemory = event.data === WebInspector.TimelineOverviewPane.Mode.Memory;
+        if (shouldShowMemory === this._memoryStatistics.visible())
+            return;
+        if (!shouldShowMemory) {
+            this._timelineMemorySplitter.addStyleClass("hidden");
+            this._memoryStatistics.hide();
+            this.splitView.element.style.height = "auto";
+            this.splitView.element.style.bottom = "0";
+            this.onResize();
+        } else {
+            this._timelineMemorySplitter.removeStyleClass("hidden");
+            this._memoryStatistics.show();
+            this.splitView.element.style.bottom = "auto";
+            this._setSplitterPosition(600);
+        }
     },
 
     _toggleTimelineButtonClicked: function()
     {
         if (this.toggleTimelineButton.toggled)
-            WebInspector.timelineManager.stop();
+            this._model.stopRecord();
         else {
-            this._clearPanel();
-            WebInspector.timelineManager.start(30);
+            this._model.startRecord();
             WebInspector.userMetrics.TimelineStarted.record();
         }
         this.toggleTimelineButton.toggled = !this.toggleTimelineButton.toggled;
@@ -435,8 +452,8 @@ WebInspector.TimelinePanel.prototype = {
     _toggleFilterButtonClicked: function()
     {
         this.toggleFilterButton.toggled = !this.toggleFilterButton.toggled;
-        this._calculator._showShortEvents = this.toggleFilterButton.toggled;
-        this.toggleFilterButton.element.title = this._calculator._showShortEvents ? this._hideShortRecordsTitleText : this._showShortRecordsTitleText;
+        this._showShortEvents = this.toggleFilterButton.toggled;
+        this.toggleFilterButton.element.title = this._showShortEvents ? this._hideShortRecordsTitleText : this._showShortRecordsTitleText;
         this._scheduleRefresh(true);
     },
 
@@ -445,41 +462,50 @@ WebInspector.TimelinePanel.prototype = {
         ProfilerAgent.collectGarbage();
     },
 
-    _toggleMemoryStatistics: function()
+    _glueParentButtonClicked: function()
     {
-        if (this._memoryStatistics.visible()) {
-            this._timelineMemorySplitter.addStyleClass("hidden");
-            this._memoryStatistics.hide();
-            this.splitView.element.style.height = "auto";
-            this.splitView.element.style.bottom = "0";
-            this.onResize();
-        } else {
-            this._timelineMemorySplitter.removeStyleClass("hidden");
-            this._memoryStatistics.show();
-            this.splitView.element.style.bottom = "auto";
-            this._setSplitterPosition(600);
-        }
+        this._glueParentButton.toggled = !this._glueParentButton.toggled;
+        this._repopulateRecords();
     },
 
-    _onTimelineEventRecorded: function(event)
+    _toggleStartAtZeroButtonClicked: function()
     {
-        if (this.toggleTimelineButton.toggled) {
-            this._addRecordToTimeline(event.data);
+        var toggled = !this.toggleStartAtZeroButton.toggled
+        this._glueParentButton.disabled = toggled;
+        this.toggleStartAtZeroButton.toggled = toggled;
+        this._calculator = toggled ? new WebInspector.TimelineStartAtZeroCalculator() : new WebInspector.TimelineCalculator();
+        this._repopulateRecords();
+        this._overviewPane.setStartAtZero(toggled);
+    },
 
-            if (this._memoryStatistics && event.data["domGroups"])
-                this._memoryStatistics.addTimlineEvent(event);
-        }
+    _repopulateRecords: function()
+    {
+        this._resetPanel();
+        var records = this._model.records;
+        for (var i = 0; i < records.length; ++i)
+            this._innerAddRecordToTimeline(records[i], this._rootRecord);
+        this._scheduleRefresh(false);
     },
 
-    _addRecordToTimeline: function(record)
+    get _startAtZero()
     {
-        this._model._addRecord(record);
-        this._innerAddRecordToTimeline(record, this._rootRecord);
+        return this.toggleStartAtZeroButton.toggled;
+    },
+
+    _onTimelineEventRecorded: function(event)
+    {
+        this._innerAddRecordToTimeline(event.data, this._rootRecord);
         this._scheduleRefresh(false);
+
+        if (this._memoryStatistics && event.data["counters"])
+            this._memoryStatistics.addTimlineEvent(event);
     },
 
     _findParentRecord: function(record)
     {
+        if (!this._glueParentButton.toggled)
+            return null;
+
         var recordTypes = WebInspector.TimelineAgent.RecordType;
         var parentRecord;
         if (record.type === recordTypes.ResourceReceiveResponse ||
@@ -490,6 +516,8 @@ WebInspector.TimelinePanel.prototype = {
             parentRecord = this._timerRecords[record.data["timerId"]];
         else if (record.type === recordTypes.ResourceSendRequest)
             parentRecord = this._scheduledResourceRequests[record.data["url"]];
+        else if (record.type === recordTypes.FireAnimationFrame)
+            parentRecord = this._requestAnimationFrameRecords[record.data["id"]];
         return parentRecord;
     },
 
@@ -498,17 +526,13 @@ WebInspector.TimelinePanel.prototype = {
         var connectedToOldRecord = false;
         var recordTypes = WebInspector.TimelineAgent.RecordType;
 
-        if (record.type === recordTypes.RegisterAnimationFrameCallback) {
-            this._registeredAnimationCallbackRecords[record.data["id"]] = record;
-            return;
-        }
-
         if (record.type === recordTypes.MarkDOMContent || record.type === recordTypes.MarkLoad)
             parentRecord = null; // No bar entry for load events.
-        else if (parentRecord === this._rootRecord ||
-                 record.type === recordTypes.ResourceReceiveResponse ||
-                 record.type === recordTypes.ResourceFinish ||
-                 record.type === recordTypes.ResourceReceivedData) {
+        else if (!this._startAtZero &&
+                    (parentRecord === this._rootRecord ||
+                    record.type === recordTypes.ResourceReceiveResponse ||
+                    record.type === recordTypes.ResourceFinish ||
+                    record.type === recordTypes.ResourceReceivedData)) {
             var newParentRecord = this._findParentRecord(record);
             if (newParentRecord) {
                 parentRecord = newParentRecord;
@@ -525,7 +549,7 @@ WebInspector.TimelinePanel.prototype = {
             }
         };
 
-        if ((record.type === recordTypes.TimerFire || record.type === recordTypes.FireAnimationFrameEvent) && children && children.length) {
+        if ((record.type === recordTypes.TimerFire || record.type === recordTypes.FireAnimationFrame) && children && children.length) {
             var childRecord = children[0];
             if (childRecord.type === recordTypes.FunctionCall) {
                 scriptDetails = {
@@ -550,23 +574,22 @@ WebInspector.TimelinePanel.prototype = {
         for (var i = 0; i < childrenCount; ++i)
             this._innerAddRecordToTimeline(children[i], formattedRecord);
 
-        formattedRecord._calculateAggregatedStats(this.categories);
+        formattedRecord._calculateAggregatedStats(this._presentationModel.categories);
 
         if (connectedToOldRecord) {
             record = formattedRecord;
             do {
                 var parent = record.parent;
-                parent._cpuTime += formattedRecord._cpuTime;
                 if (parent._lastChildEndTime < record._lastChildEndTime)
                     parent._lastChildEndTime = record._lastChildEndTime;
                 for (var category in formattedRecord._aggregatedStats)
                     parent._aggregatedStats[category] += formattedRecord._aggregatedStats[category];
                 record = parent;
             } while (record.parent);
-        } else
+        } else {
             if (parentRecord !== this._rootRecord)
                 parentRecord._selfTime -= formattedRecord.endTime - formattedRecord.startTime;
-
+        }
         // Keep bar entry for mark timeline since nesting might be interesting to the user.
         if (record.type === recordTypes.TimeStamp)
             this._timeStampRecords.push(formattedRecord);
@@ -576,9 +599,11 @@ WebInspector.TimelinePanel.prototype = {
     {
         var width = event.data;
         this._sidebarBackgroundElement.style.width = width + "px";
-        this._topPaneSidebarElement.style.width = width + "px";
         this._scheduleRefresh(false);
         this._overviewPane.sidebarResized(width);
+        // Min width = <number of buttons on the left> * 31
+        this.statusBarFilters.style.left = Math.max((this.statusBarItems.length + 2) * 31, width) + "px";
+
         if (this._memoryStatistics)
             this._memoryStatistics.setSidebarWidth(width);
     },
@@ -601,18 +626,28 @@ WebInspector.TimelinePanel.prototype = {
 
     _clearPanel: function()
     {
+        this._model._reset();
+    },
+
+    _onRecordsCleared: function()
+    {
+        this._resetPanel();
+        this._refresh();
+    },
+
+    _resetPanel: function()
+    {
+        this._presentationModel.reset();
         this._timeStampRecords = [];
         this._sendRequestRecords = {};
         this._scheduledResourceRequests = {};
         this._timerRecords = {};
-        this._registeredAnimationCallbackRecords = {};
+        this._requestAnimationFrameRecords = {};
         this._rootRecord = this._createRootRecord();
         this._boundariesAreValid = false;
         this._overviewPane.reset();
         this._adjustScrollPosition(0);
-        this._refresh();
         this._closeRecordDetails();
-        this._model._reset();
         this._linkifier.reset();
     },
 
@@ -644,12 +679,6 @@ WebInspector.TimelinePanel.prototype = {
         this._scheduleRefresh(true);
     },
 
-    _windowChanged: function()
-    {
-        this._closeRecordDetails();
-        this._scheduleRefresh(false);
-    },
-
     _scheduleRefresh: function(preserveBoundaries)
     {
         this._closeRecordDetails();
@@ -660,9 +689,10 @@ WebInspector.TimelinePanel.prototype = {
 
         if (preserveBoundaries)
             this._refresh();
-        else
+        else {
             if (!this._refreshTimeout)
                 this._refreshTimeout = setTimeout(this._refresh.bind(this), 100);
+        }
     },
 
     _refresh: function()
@@ -672,8 +702,10 @@ WebInspector.TimelinePanel.prototype = {
             delete this._refreshTimeout;
         }
 
-        this._overviewPane.update(this._rootRecord.children, this._calculator._showShortEvents);
+        this._overviewPane.update(this._rootRecord.children, this._showShortEvents);
 
+        if (!this._boundariesAreValid)
+            this._updateBoundaries();
         this._refreshRecords(!this._boundariesAreValid);
         this._updateRecordsCounter();
         if(!this._boundariesAreValid)
@@ -686,8 +718,8 @@ WebInspector.TimelinePanel.prototype = {
     _updateBoundaries: function()
     {
         this._calculator.reset();
-        this._calculator.windowLeft = this._overviewPane.windowLeft;
-        this._calculator.windowRight = this._overviewPane.windowRight;
+        this._calculator.windowLeft = this._presentationModel.windowLeft;
+        this._calculator.windowRight = this._presentationModel.windowRight;
 
         for (var i = 0; i < this._rootRecord.children.length; ++i)
             this._calculator.updateBoundaries(this._rootRecord.children[i]);
@@ -695,42 +727,47 @@ WebInspector.TimelinePanel.prototype = {
         this._calculator.calculateWindow();
     },
 
-    /**
-     * @param {boolean=} parentIsCollapsed
-     */
-    _addToRecordsWindow: function(record, recordsWindow, parentIsCollapsed)
-    {
-        if (!this._calculator._showShortEvents && !record.isLong())
-            return;
-        var percentages = this._calculator.computeBarGraphPercentages(record);
-        if (percentages.start < 100 && percentages.endWithChildren >= 0 && !record.category.hidden) {
-            ++this._rootRecord._visibleRecordsCount;
-            ++record.parent._invisibleChildrenCount;
-            if (!parentIsCollapsed)
-                recordsWindow.push(record);
-        }
-
-        var index = recordsWindow.length;
-        record._invisibleChildrenCount = 0;
-        for (var i = 0; i < record.children.length; ++i)
-            this._addToRecordsWindow(record.children[i], recordsWindow, parentIsCollapsed || record.collapsed);
-        record._visibleChildrenCount = recordsWindow.length - index;
-    },
-
     _filterRecords: function()
     {
         var recordsInWindow = [];
+        var filter = this._startAtZero ? new WebInspector.TimelineStartAtZeroRecordFilter(this._presentationModel, this._rootRecord, this._showShortEvents)
+            : new WebInspector.TimelineRecordFilter(this._calculator, this._showShortEvents);
         this._rootRecord._visibleRecordsCount = 0;
-        for (var i = 0; i < this._rootRecord.children.length; ++i)
-            this._addToRecordsWindow(this._rootRecord.children[i], recordsInWindow);
+
+        var stack = [{children: this._rootRecord.children, index: 0, parentIsCollapsed: false}];
+        while (stack.length) {
+            var entry = stack[stack.length - 1];
+            var records = entry.children;
+            if (records && entry.index < records.length) {
+                 var record = records[entry.index];
+                 ++entry.index;
+
+                 if (filter.accept(record)) {
+                     ++this._rootRecord._visibleRecordsCount;
+                     ++record.parent._invisibleChildrenCount;
+                     if (!entry.parentIsCollapsed)
+                         recordsInWindow.push(record);
+                 }
+
+                 record._invisibleChildrenCount = 0;
+
+                 stack.push({children: record.children,
+                             index: 0,
+                             parentIsCollapsed: (entry.parentIsCollapsed || record.collapsed),
+                             parentRecord: record,
+                             windowLengthBeforeChildrenTraversal: recordsInWindow.length});
+            } else {
+                stack.pop();
+                if (entry.parentRecord)
+                    entry.parentRecord._visibleChildrenCount = recordsInWindow.length - entry.windowLengthBeforeChildrenTraversal;
+            }
+        }
+
         return recordsInWindow;
     },
 
     _refreshRecords: function(updateBoundaries)
     {
-        if (updateBoundaries)
-            this._updateBoundaries();
-
         var recordsInWindow = this._filterRecords();
 
         // Calculate the visible area.
@@ -856,7 +893,7 @@ WebInspector.TimelinePanel.prototype = {
     _showPopover: function(anchor, popover)
     {
         var record = anchor.row._record;
-        popover.show(record._generatePopupContent(this._calculator, this.categories), anchor);
+        popover.show(record._generatePopupContent(this._calculator, this._presentationModel.categories), anchor);
     },
 
     _closeRecordDetails: function()
@@ -893,8 +930,7 @@ WebInspector.TimelineCalculator.prototype = {
         var start = (record.startTime - this.minimumBoundary) / this.boundarySpan * 100;
         var end = (record.startTime + record._selfTime - this.minimumBoundary) / this.boundarySpan * 100;
         var endWithChildren = (record._lastChildEndTime - this.minimumBoundary) / this.boundarySpan * 100;
-        var cpuWidth = record._cpuTime / this.boundarySpan * 100;
-        return {start: start, end: end, endWithChildren: endWithChildren, cpuWidth: cpuWidth};
+        return {start: start, end: end, endWithChildren: endWithChildren};
     },
 
     computeBarGraphWindowPosition: function(record, clientWidth)
@@ -903,13 +939,13 @@ WebInspector.TimelineCalculator.prototype = {
         const borderWidth = 4;
         var workingArea = clientWidth - minWidth - borderWidth;
         var percentages = this.computeBarGraphPercentages(record);
+
         var left = percentages.start / 100 * workingArea;
         var width = (percentages.end - percentages.start) / 100 * workingArea + minWidth;
         var widthWithChildren =  (percentages.endWithChildren - percentages.start) / 100 * workingArea;
-        var cpuWidth = percentages.cpuWidth / 100 * workingArea + minWidth;
         if (percentages.endWithChildren > percentages.end)
             widthWithChildren += borderWidth + minWidth;
-        return {left: left, width: width, widthWithChildren: widthWithChildren, cpuWidth: cpuWidth};
+        return {left: left, width: width, widthWithChildren: widthWithChildren};
     },
 
     calculateWindow: function()
@@ -946,6 +982,74 @@ WebInspector.TimelineCalculator.prototype = {
 
 /**
  * @constructor
+ * @extends WebInspector.TimelineCalculator
+ */
+WebInspector.TimelineStartAtZeroCalculator = function()
+{
+    this.reset();
+    this.windowLeft = 0.0;
+    this.windowRight = 1.0;
+}
+
+WebInspector.TimelineStartAtZeroCalculator.prototype = {
+    computeBarGraphPercentages: function(record)
+    {
+        var scale = 100 / this.maximumBoundary;
+        return {
+            start: record._initiatorOffset * scale,
+            end: (record._initiatorOffset + record.endTime - record.startTime) * scale,
+            endWithChildren: (record._initiatorOffset + record._lastChildEndTime - record.startTime) * scale
+        };
+    },
+
+    computeBarGraphWindowPosition: function(record, clientWidth)
+    {
+        const minWidth = 5;
+        const borderWidth = 4;
+        var workingArea = clientWidth - minWidth - borderWidth;
+        var percentages = this.computeBarGraphPercentages(record);
+        var left = percentages.start / 100 * workingArea;
+        var width = (percentages.end - percentages.start) / 100 * workingArea + minWidth;
+        var widthWithChildren =  (percentages.endWithChildren - percentages.start) / 100 * workingArea;
+        if (percentages.endWithChildren > percentages.end)
+            widthWithChildren += borderWidth + minWidth;
+
+        return {left: left, width: width, widthWithChildren: widthWithChildren};
+    },
+
+    calculateWindow: function()
+    {
+        this.minimumBoundary = this._absoluteMinimumBoundary;
+        this.maximumBoundary = this._absoluteMaximumBoundary * 1.05;
+        this.boundarySpan = this.maximumBoundary >= 0 ? this.maximumBoundary : 0;
+    },
+
+    reset: function()
+    {
+        this._absoluteMinimumBoundary = -1;
+        this._absoluteMaximumBoundary = -1;
+    },
+
+    updateBoundaries: function(record)
+    {
+        var lowerBound = record.startTime;
+        if (this._absoluteMinimumBoundary === -1 || lowerBound < this._absoluteMinimumBoundary)
+            this._absoluteMinimumBoundary = lowerBound;
+
+        const minimumTimeFrame = 0.001;
+        var upperBound = Math.max(record.endTime - record.startTime, minimumTimeFrame);
+        if (this._absoluteMaximumBoundary === -1 || upperBound > this._absoluteMaximumBoundary)
+            this._absoluteMaximumBoundary = upperBound;
+    },
+
+    formatValue: function(value)
+    {
+        return Number.secondsToString(value, true);
+    }
+};
+
+/**
+ * @constructor
  */
 WebInspector.TimelineRecordListRow = function()
 {
@@ -1018,11 +1122,6 @@ WebInspector.TimelineRecordGraphRow = function(graphContainer, scheduleRefresh)
     this._barWithChildrenElement.row = this;
     this._barAreaElement.appendChild(this._barWithChildrenElement);
 
-    this._barCpuElement = document.createElement("div");
-    this._barCpuElement.className = "timeline-graph-bar cpu"
-    this._barCpuElement.row = this;
-    this._barAreaElement.appendChild(this._barCpuElement);
-
     this._barElement = document.createElement("div");
     this._barElement.className = "timeline-graph-bar";
     this._barElement.row = this;
@@ -1044,8 +1143,6 @@ WebInspector.TimelineRecordGraphRow.prototype = {
         this._barWithChildrenElement.style.width = barPosition.widthWithChildren + "px";
         this._barElement.style.left = barPosition.left + expandOffset + "px";
         this._barElement.style.width =  barPosition.width + "px";
-        this._barCpuElement.style.left = barPosition.left + expandOffset + "px";
-        this._barCpuElement.style.width = barPosition.cpuWidth + "px";
         this._expandElement._update(record, index, barPosition);
     },
 
@@ -1081,6 +1178,9 @@ WebInspector.TimelinePanel.FormattedRecord = function(record, parentRecord, pane
     this.endTime = (typeof record.endTime !== "undefined") ? record.endTime / 1000 : this.startTime;
     this._selfTime = this.endTime - this.startTime;
     this._lastChildEndTime = this.endTime;
+    this._initiatorOffset = (parentRecord && parentRecord !== panel._rootRecord) ?
+        parentRecord._initiatorOffset + this.startTime - parentRecord.startTime : 0;
+
     if (record.stackTrace && record.stackTrace.length)
         this.stackTrace = record.stackTrace;
     this.totalHeapSize = record.totalHeapSize;
@@ -1120,10 +1220,12 @@ WebInspector.TimelinePanel.FormattedRecord = function(record, parentRecord, pane
             this.timeout = timerInstalledRecord.timeout;
             this.singleShot = timerInstalledRecord.singleShot;
         }
-    } else if (record.type === recordTypes.FireAnimationFrameEvent) {
-        var registerCallbackRecord = panel._registeredAnimationCallbackRecords[record.data["id"]];
-        if (registerCallbackRecord)
-            this.callSiteStackTrace = registerCallbackRecord.stackTrace;
+    } else if (record.type === recordTypes.RequestAnimationFrame) {
+        panel._requestAnimationFrameRecords[record.data["id"]] = this;
+    } else if (record.type === recordTypes.FireAnimationFrame) {
+        var requestAnimationRecord = panel._requestAnimationFrameRecords[record.data["id"]];
+        if (requestAnimationRecord)
+            this.callSiteStackTrace = requestAnimationRecord.stackTrace;
     }
     this._refreshDetails();
 }
@@ -1150,7 +1252,7 @@ WebInspector.TimelinePanel.FormattedRecord.prototype = {
             label.className = "timeline-aggregated-category timeline-" + index;
             cell.appendChild(label);
             var text = document.createElement("span");
-            text.textContent = Number.secondsToString(this._aggregatedStats[index] + 0.0001);
+            text.textContent = Number.secondsToString(this._aggregatedStats[index], true);
             cell.appendChild(text);
         }
         return cell;
@@ -1161,10 +1263,10 @@ WebInspector.TimelinePanel.FormattedRecord.prototype = {
         var contentHelper = new WebInspector.TimelinePanel.PopupContentHelper(this.title, this._panel);
 
         if (this._children && this._children.length) {
-            contentHelper._appendTextRow(WebInspector.UIString("Self Time"), Number.secondsToString(this._selfTime + 0.0001));
+            contentHelper._appendTextRow(WebInspector.UIString("Self Time"), Number.secondsToString(this._selfTime, true));
             contentHelper._appendElementRow(WebInspector.UIString("Aggregated Time"), this._generateAggregatedInfo());
         }
-        var text = WebInspector.UIString("%s (at %s)", Number.secondsToString(this._lastChildEndTime - this.startTime),
+        var text = WebInspector.UIString("%s (at %s)", Number.secondsToString(this._lastChildEndTime - this.startTime, true),
             calculator.formatValue(this.startTime - calculator.minimumBoundary));
         contentHelper._appendTextRow(WebInspector.UIString("Duration"), text);
 
@@ -1183,7 +1285,7 @@ WebInspector.TimelinePanel.FormattedRecord.prototype = {
                     contentHelper._appendTextRow(WebInspector.UIString("Repeats"), !this.singleShot);
                 }
                 break;
-            case recordTypes.FireAnimationFrameEvent:
+            case recordTypes.FireAnimationFrame:
                 contentHelper._appendTextRow(WebInspector.UIString("Callback ID"), this.data["id"]);
                 break;
             case recordTypes.FunctionCall:
@@ -1246,7 +1348,7 @@ WebInspector.TimelinePanel.FormattedRecord.prototype = {
                 return this.scriptName ? this._panel._linkifyLocation(this.scriptName, this.scriptLine, 0) : this.data["timerId"];
             case WebInspector.TimelineAgent.RecordType.FunctionCall:
                 return this.scriptName ? this._panel._linkifyLocation(this.scriptName, this.scriptLine, 0) : null;
-            case WebInspector.TimelineAgent.RecordType.FireAnimationFrameEvent:
+            case WebInspector.TimelineAgent.RecordType.FireAnimationFrame:
                 return this.scriptName ? this._panel._linkifyLocation(this.scriptName, this.scriptLine, 0) : this.data["id"];
             case WebInspector.TimelineAgent.RecordType.EventDispatch:
                 return this.data ? this.data["type"] : null;
@@ -1255,8 +1357,8 @@ WebInspector.TimelinePanel.FormattedRecord.prototype = {
             case WebInspector.TimelineAgent.RecordType.TimerInstall:
             case WebInspector.TimelineAgent.RecordType.TimerRemove:
                 return this.stackTrace ? this._panel._linkifyCallFrame(this.stackTrace[0]) : this.data["timerId"];
-            case WebInspector.TimelineAgent.RecordType.RegisterAnimationFrameCallback:
-            case WebInspector.TimelineAgent.RecordType.CancelAnimationFrameCallback:
+            case WebInspector.TimelineAgent.RecordType.RequestAnimationFrame:
+            case WebInspector.TimelineAgent.RecordType.CancelAnimationFrame:
                 return this.stackTrace ? this._panel._linkifyCallFrame(this.stackTrace[0]) : this.data["id"];
             case WebInspector.TimelineAgent.RecordType.ParseHTML:
             case WebInspector.TimelineAgent.RecordType.RecalculateStyles:
@@ -1283,18 +1385,20 @@ WebInspector.TimelinePanel.FormattedRecord.prototype = {
         this._aggregatedStats = {};
         for (var category in categories)
             this._aggregatedStats[category] = 0;
-        this._cpuTime = this._selfTime;
 
         if (this._children) {
             for (var index = this._children.length; index; --index) {
                 var child = this._children[index - 1];
-                this._aggregatedStats[child.category.name] += child._selfTime;
                 for (var category in categories)
                     this._aggregatedStats[category] += child._aggregatedStats[category];
             }
-            for (var category in this._aggregatedStats)
-                this._cpuTime += this._aggregatedStats[category];
         }
+        this._aggregatedStats[this.category.name] += this._selfTime;
+    },
+
+    get aggregatedStats()
+    {
+        return this._aggregatedStats;
     }
 }
 
@@ -1427,23 +1531,60 @@ WebInspector.TimelineExpandableElement.prototype = {
 
 /**
  * @constructor
+ * @extends {WebInspector.Object}
  */
-WebInspector.TimelineModel = function(timelinePanel)
+WebInspector.TimelineModel = function()
 {
-    this._panel = timelinePanel;
     this._records = [];
+    this._collectionEnabled = false;
+
+    WebInspector.timelineManager.addEventListener(WebInspector.TimelineManager.EventTypes.TimelineEventRecorded, this._onRecordAdded, this);
+}
+
+WebInspector.TimelineModel.Events = {
+    RecordAdded: "RecordAdded",
+    RecordsCleared: "RecordsCleared"
 }
 
 WebInspector.TimelineModel.prototype = {
+    startRecord: function()
+    {
+        if (this._collectionEnabled)
+            return;
+        this._reset();
+        WebInspector.timelineManager.start(30);
+        this._collectionEnabled = true;
+    },
+
+    stopRecord: function()
+    {
+        if (!this._collectionEnabled)
+            return;
+        WebInspector.timelineManager.stop();
+        this._collectionEnabled = false;
+    },
+
+    get records()
+    {
+        return this._records;
+    },
+
+    _onRecordAdded: function(event)
+    {
+        if (this._collectionEnabled)
+            this._addRecord(event.data);
+    },
+
     _addRecord: function(record)
     {
         this._records.push(record);
+        this.dispatchEventToListeners(WebInspector.TimelineModel.Events.RecordAdded, record);
     },
 
     _loadNextChunk: function(data, index)
     {
         for (var i = 0; i < 20 && index < data.length; ++i, ++index)
-            this._panel._addRecordToTimeline(data[index]);
+            this._addRecord(data[index]);
 
         if (index !== data.length)
             setTimeout(this._loadNextChunk.bind(this, data, index), 0);
@@ -1454,7 +1595,7 @@ WebInspector.TimelineModel.prototype = {
         function onLoad(e)
         {
             var data = JSON.parse(e.target.result);
-            var version = data[0];
+            this._reset();
             this._loadNextChunk(data, 1);
         }
 
@@ -1495,6 +1636,140 @@ WebInspector.TimelineModel.prototype = {
 
     _reset: function()
     {
+        this.stopRecord();
         this._records = [];
+        this.dispatchEventToListeners(WebInspector.TimelineModel.Events.RecordsCleared);
     }
 }
+
+WebInspector.TimelineModel.prototype.__proto__ = WebInspector.Object.prototype;
+
+/**
+ * @constructor
+ * @extends {WebInspector.Object}
+ */
+WebInspector.TimelinePresentationModel = function()
+{
+    this._categories = {};
+    this.reset();
+}
+
+WebInspector.TimelinePresentationModel.Events = {
+    WindowChanged: "WindowChanged",
+    CategoryVisibilityChanged: "CategoryVisibilityChanged"
+}
+
+WebInspector.TimelinePresentationModel.prototype = {
+    reset: function()
+    {
+        this.windowLeft = 0.0;
+        this.windowRight = 1.0;
+        this.windowIndexLeft = 0;
+        this.windowIndexRight = null;
+    },
+
+    get categories()
+    {
+        return this._categories;
+    },
+
+    /**
+     * @param {WebInspector.TimelineCategory} category
+     */
+    addCategory: function(category)
+    {
+        this._categories[category.name] = category;
+    },
+
+    /**
+     * @param {number} left
+     * @param {number} right
+     */
+    setWindowPosition: function(left, right)
+    {
+        this.windowLeft = left;
+        this.windowRight = right;
+        this.dispatchEventToListeners(WebInspector.TimelinePresentationModel.Events.WindowChanged);
+    },
+
+    /**
+     * @param {number} left
+     * @param {?number} right
+     */
+    setWindowIndices: function(left, right)
+    {
+        this.windowIndexLeft = left;
+        this.windowIndexRight = right;
+        this.dispatchEventToListeners(WebInspector.TimelinePresentationModel.Events.WindowChanged);
+    },
+
+    /**
+     * @param {WebInspector.TimelineCategory} category
+     * @param {boolean} visible
+     */
+    setCategoryVisibility: function(category, visible)
+    {
+        category.hidden = !visible;
+        this.dispatchEventToListeners(WebInspector.TimelinePresentationModel.Events.CategoryVisibilityChanged, category);
+    }
+}
+
+/**
+ * @constructor
+ * @param {WebInspector.TimelineCalculator} calculator
+ * @param {boolean} showShortEvents
+ */
+WebInspector.TimelineRecordFilter = function(calculator, showShortEvents)
+{
+    this._calculator = calculator;
+    this._showShortEvents = showShortEvents;
+}
+
+WebInspector.TimelineRecordFilter.prototype = {
+    /**
+     * @param {WebInspector.TimelinePanel.FormattedRecord} record
+     */
+    accept: function(record)
+    {
+        if (record.category.hidden)
+            return false;
+        if (!this._showShortEvents && !record.isLong())
+            return false;
+        var percentages = this._calculator.computeBarGraphPercentages(record);
+        return percentages.start <= 100 && percentages.endWithChildren >= 0;
+    }
+}
+
+/**
+ * @constructor
+ * @param {WebInspector.TimelinePresentationModel} model
+ * @param {Object} rootRecord
+ * @param {boolean} showShortEvents
+ */
+WebInspector.TimelineStartAtZeroRecordFilter = function(model, rootRecord, showShortEvents)
+{
+    this._windowIndexLeft = model.windowIndexLeft;
+    this._windowIndexRight = model.windowIndexRight;
+    this._rootRecord = rootRecord;
+    this._topLevelRecordIndex = 0;
+    this._showShortEvents = showShortEvents;
+}
+
+WebInspector.TimelineStartAtZeroRecordFilter.prototype = {
+    /**
+     * @param {WebInspector.TimelinePanel.FormattedRecord} record
+     */
+    accept: function(record)
+    {
+        if (record.category.hidden)
+            return false;
+        if (record.parent === this._rootRecord)
+            ++this._topLevelRecordIndex;
+        if (!this._showShortEvents && !record.isLong())
+            return false;
+        return this._topLevelRecordIndex > this._windowIndexLeft &&
+            (typeof this._windowIndexRight !== "number" || this._topLevelRecordIndex <= this._windowIndexRight);
+    }
+}
+
+WebInspector.TimelinePresentationModel.prototype.__proto__ = WebInspector.Object.prototype;
diff --git a/Source/WebCore/inspector/front-end/UIUtils.js b/Source/WebCore/inspector/front-end/UIUtils.js
index 0e268634e..49ddec50b 100644
--- a/Source/WebCore/inspector/front-end/UIUtils.js
+++ b/Source/WebCore/inspector/front-end/UIUtils.js
@@ -447,7 +447,7 @@ Number.withThousandsSeparator = function(num)
     var str = num + "";
     var re = /(\d+)(\d{3})/;
     while (str.match(re))
-        str = str.replace(re, "$1,$2");
+        str = str.replace(re, "$1\u2009$2"); // \u2009 is a thin space.
     return str;
 }
 
diff --git a/Source/WebCore/inspector/front-end/View.js b/Source/WebCore/inspector/front-end/View.js
index b39dad5cd..f5a6dc847 100644
--- a/Source/WebCore/inspector/front-end/View.js
+++ b/Source/WebCore/inspector/front-end/View.js
@@ -278,13 +278,20 @@ WebInspector.View.prototype = {
             return;
         }
 
-        var xhr = new XMLHttpRequest();
-        xhr.open("GET", cssFile, false);
-        xhr.send(null);
-
-        styleElement = document.createElement("style");
-        styleElement.type = "text/css";
-        styleElement.textContent = xhr.responseText;
+        if (WebInspector.experimentsSettings.debugCSS.isEnabled()) {
+            styleElement = document.createElement("link");
+            styleElement.rel = "stylesheet";
+            styleElement.type = "text/css";
+            styleElement.href = cssFile;
+        } else {
+            var xhr = new XMLHttpRequest();
+            xhr.open("GET", cssFile, false);
+            xhr.send(null);
+
+            styleElement = document.createElement("style");
+            styleElement.type = "text/css";
+            styleElement.textContent = xhr.responseText;
+        }
         document.head.insertBefore(styleElement, document.head.firstChild);
 
         WebInspector.View._cssFileToStyleElement[cssFile] = styleElement;
diff --git a/Source/WebCore/inspector/front-end/WatchExpressionsSidebarPane.js b/Source/WebCore/inspector/front-end/WatchExpressionsSidebarPane.js
index e6d3db341..2887b1d62 100644
--- a/Source/WebCore/inspector/front-end/WatchExpressionsSidebarPane.js
+++ b/Source/WebCore/inspector/front-end/WatchExpressionsSidebarPane.js
@@ -270,8 +270,10 @@ WebInspector.WatchExpressionsSection.prototype = {
 
     _mouseOut: function()
     {
-        if (this._hoveredElement)
+        if (this._hoveredElement) {
             this._hoveredElement.removeStyleClass("hovered");
+            delete this._hoveredElement;
+        }
         delete this._lastMouseMovePageY;
     },
 
diff --git a/Source/WebCore/inspector/front-end/WebKit.qrc b/Source/WebCore/inspector/front-end/WebKit.qrc
index 869240c93..d1031e288 100644
--- a/Source/WebCore/inspector/front-end/WebKit.qrc
+++ b/Source/WebCore/inspector/front-end/WebKit.qrc
@@ -68,6 +68,7 @@
     <file>HelpScreen.js</file>
     <file>ImageView.js</file>
     <file>IndexedDBModel.js</file>
+    <file>IndexedDBViews.js</file>
     <file>InjectedFakeWorker.js</file>
     <file>inspector.js</file>
     <file>InspectorBackend.js</file>
@@ -126,6 +127,7 @@
     <file>SettingsScreen.js</file>
     <file>ShortcutsScreen.js</file>
     <file>ShowMoreDataGridNode.js</file>
+    <file>SidebarOverlay.js</file>
     <file>SidebarPane.js</file>
     <file>SidebarTreeElement.js</file>
     <file>SoftContextMenu.js</file>
@@ -134,6 +136,7 @@
     <file>SourceHTMLTokenizer.js</file>
     <file>SourceJavaScriptTokenizer.js</file>
     <file>SourceTokenizer.js</file>
+    <file>Spectrum.js</file>
     <file>SplitView.js</file>
     <file>StatusBarButton.js</file>
     <file>StylesSidebarPane.js</file>
@@ -168,6 +171,7 @@
     <file>filteredItemSelectionDialog.css</file>
     <file>heapProfiler.css</file>
     <file>helpScreen.css</file>
+    <file>indexedDBViews.css</file>
     <file>inspector.css</file>
     <file>inspectorCommon.css</file>
     <file>inspectorSyntaxHighlight.css</file>
@@ -223,7 +227,12 @@
     <file>Images/goArrow.png</file>
     <file>Images/graphLabelCalloutLeft.png</file>
     <file>Images/graphLabelCalloutRight.png</file>
+    <file>Images/indexedDB.png</file>
+    <file>Images/indexedDBObjectStore.png</file>
+    <file>Images/indexedDBIndex.png</file>
     <file>Images/localStorage.png</file>
+    <file>Images/navigatorShowHideButton.png</file>
+    <file>Images/navigatorPinButton.png</file>
     <file>Images/paneAddButtons.png</file>
     <file>Images/paneBottomGrow.png</file>
     <file>Images/paneBottomGrowActive.png</file>
diff --git a/Source/WebCore/inspector/front-end/dialog.css b/Source/WebCore/inspector/front-end/dialog.css
index ccfb3a443..20f3ee1ad 100644
--- a/Source/WebCore/inspector/front-end/dialog.css
+++ b/Source/WebCore/inspector/front-end/dialog.css
@@ -53,3 +53,24 @@
     background-color: rgb(215, 215, 215);
     background-image: -webkit-gradient(linear, left top, left bottom, from(rgb(194, 194, 194)), to(rgb(239, 239, 239)));
 }
+
+.sidebar-overlay-dialog {
+    position: absolute;
+    display: -webkit-box;
+    height: 0;
+    width: 0;
+    -webkit-box-orient: vertical;
+    z-index: -1;
+    background-color: white;
+    border-right: 1px solid gray;
+    -webkit-box-shadow: rgb(90,90,90) 20px 0px 50px -25px;
+}
+
+.sidebar-overlay-resizer {
+    position: absolute;
+    top: 0;
+    bottom: 0;
+    width: 5px;
+    z-index: 500;
+    cursor: ew-resize;
+}
diff --git a/Source/WebCore/inspector/front-end/elementsPanel.css b/Source/WebCore/inspector/front-end/elementsPanel.css
index a61197496..8f9224a69 100644
--- a/Source/WebCore/inspector/front-end/elementsPanel.css
+++ b/Source/WebCore/inspector/front-end/elementsPanel.css
@@ -248,8 +248,8 @@
     opacity: 0.75;
     width: 12px;
     height: 10px;
-    margin: 0;
-    padding-right: 2px;
+    margin: 0 6px 0 0;
+    padding: 0 1px;
     vertical-align: baseline;
     -webkit-user-select: none;
     cursor: default;
@@ -297,11 +297,15 @@
 .styles-section .properties {
     display: none;
     margin: 0;
-    padding: 2px 4px 0 8px;
+    padding: 2px 4px 0 6px;
     list-style: none;
     clear: both;
 }
 
+.styles-section.matched-styles .properties {
+    padding-left: 0;
+}
+
 .styles-section.no-affect .properties li {
     opacity: 0.5;
 }
@@ -321,9 +325,8 @@
     overflow: hidden;
     cursor: auto;
 }
-
-.styles-section .properties li.parent {
-    margin-left: 1px;
+.styles-section.matched-styles .properties li {
+    margin-left: 0 !important;
 }
 
 .styles-section .properties li.child-editing {
@@ -343,6 +346,25 @@
 }
 
 .styles-section .properties li.parent::before {
+    content: none;
+}
+
+.styles-section .properties li.parent.expanded::before {
+    content: none;
+}
+
+.styles-section.matched-styles .properties li.parent .expand-element {
+    content: url(Images/treeRightTriangleBlack.png);
+    margin-right: 1px;
+    margin-left: -5px;
+    opacity: 0.6;
+}
+
+.styles-section.matched-styles .properties li.parent.expanded .expand-element {
+    content: url(Images/treeDownTriangleBlack.png);
+}
+
+.styles-section.computed-style .properties li.parent::before {
     content: url(Images/treeRightTriangleBlack.png);
     opacity: 0.75;
     float: left;
@@ -354,7 +376,7 @@
     cursor: default;
 }
 
-.styles-section .properties li.parent.expanded::before {
+.styles-section.computed-style .properties li.parent.expanded::before {
     content: url(Images/treeDownTriangleBlack.png);
     margin-top: 1px;
 }
@@ -364,22 +386,28 @@
     padding-bottom: 3px;
 }
 
-.styles-section:hover .properties .enabled-button {
-    display: block;
+.styles-section.matched-styles:not(.read-only):hover .properties .enabled-button {
+    visibility: visible;
 }
 
-.styles-section .properties li.disabled .enabled-button {
-    display: block;
+.styles-section.matched-styles:not(.read-only) .properties li.disabled .enabled-button {
+    visibility: visible;
 }
 
 .styles-section .properties .enabled-button {
-    display: none;
-    float: right;
+    visibility: hidden;
+    float: left;
     font-size: 10px;
-    margin: 0 0 0 4px;
+    margin: 0;
     vertical-align: top;
     position: relative;
     z-index: 1;
+    width: 18px;
+    left: -2px;
+}
+
+.styles-section.matched-styles .properties ol.expanded {
+    margin-left: 16px;
 }
 
 .styles-section .properties .overloaded, .styles-section .properties .inactive, .styles-section .properties .disabled {
@@ -479,9 +507,137 @@
     width: 8px;
     height: 8px;
     opacity: 0.75;
-    content: url(Images/treeRightTriangleBlack.png);
+    content: url(Images/treeRightTriangleBlack.png) !important;
 }
 
 .event-bars .event-bar.expanded .header::before {
-    content: url(Images/treeDownTriangleBlack.png);
+    content: url(Images/treeDownTriangleBlack.png) !important;
+}
+
+.image-preview-container {
+    background: transparent;
+    text-align: center;
+    padding-left: 11px;
+}
+
+.image-preview-container img {
+    margin: 2px auto;
+    background-image: url(Images/checker.png);
+    -webkit-user-select: text;
+    -webkit-user-drag: auto;
+}
+
+/* https://github.com/bgrins/spectrum */
+.spectrum-container {
+    position: absolute;
+    top: 0;
+    left: 0;
+    display: inline-block;
+    background: rgba(230, 230, 230, 1) !important;
+    border: 1px solid #646464;
+    padding: 10px;
+    width: 220px;
+    z-index: 10;
+    -webkit-user-select: none;
+}
+
+.spectrum-top {
+    position: relative;
+    width: 100%;
+    display: inline-block;
+}
+
+.spectrum-color {
+    position: absolute;
+    top: 0;
+    left: 0;
+    bottom: 0;
+    right: 40px;
+}
+
+.spectrum-display-value {
+    -webkit-user-select: text;
+    position: relative;
+    left: 2px;
+    top: -6px;
+}
+
+.spectrum-hue {
+    position: absolute;
+    top: 0;
+    right: 0;
+    bottom: 0;
+    left: 170px;
+    -webkit-box-reflect: right -28px;
+}
+
+.spectrum-fill {
+    /* Same as spectrum-color width to force aspect ratio. */
+    margin-top: 150px;
+}
+
+.spectrum-range-container {
+    position: relative;
+    padding-bottom: 5px;
+}
+
+.spectrum-range-container * {
+    font-size: 11px;
+    vertical-align: middle;
+}
+
+.spectrum-range-container label {
+    display: inline-block;
+    padding-right: 4px;
+}
+
+.spectrum-range-container input {
+    position: absolute;
+    left: 15px;
+    right: 40px;
+    margin: 3px 0 0 0;
+}
+
+.swatch, .spectrum-dragger, .spectrum-slider {
+    -webkit-user-select: none;
+}
+
+.spectrum-sat {
+    background-image: -webkit-linear-gradient(left, white, rgba(204, 154, 129, 0));
+}
+
+.spectrum-val {
+    background-image: -webkit-linear-gradient(bottom, black, rgba(204, 154, 129, 0));
+}
+
+.spectrum-hue {
+    background: -webkit-linear-gradient(top, #ff0000 0%, #ffff00 17%, #00ff00 33%, #00ffff 50%, #0000ff 67%, #ff00ff 83%, #ff0000 100%);
+}
+
+.spectrum-dragger {
+    border-radius: 5px;
+    height: 5px;
+    width: 5px;
+    border: 1px solid white;
+    cursor: pointer;
+    position: absolute;
+    top: 0;
+    left: 0;
+    background: black;
+}
+
+.spectrum-slider {
+    position: absolute;
+    top: 0;
+    cursor: pointer;
+    border: 1px solid black;
+    height: 4px;
+    left: -1px;
+    right: -1px;
+}
+
+.spectrum-container .swatch {
+    width: 20px;
+    height:20px;
+    margin: 0;
 }
diff --git a/Source/WebCore/inspector/front-end/externs.js b/Source/WebCore/inspector/front-end/externs.js
index a7a4512bc..606cc9a1e 100644
--- a/Source/WebCore/inspector/front-end/externs.js
+++ b/Source/WebCore/inspector/front-end/externs.js
@@ -42,7 +42,7 @@ var JSON = {}
 /** @param {string} str */
 JSON.parse = function(str) {}
 /**
- * @param {Object} obj
+ * @param {*} obj
  * @param {Function=} replacer
  * @param {number=} space
  * @return {string}
@@ -191,3 +191,6 @@ WebInspector.showPanel = function(panel)
 WebInspector.inspectedPageDomain;
 
 WebInspector.isCompactMode = function() { return false; }
+
+WebInspector.SourceJavaScriptTokenizer = {}
+WebInspector.SourceJavaScriptTokenizer.Keywords = {}
diff --git a/Source/WebCore/inspector/front-end/heapProfiler.css b/Source/WebCore/inspector/front-end/heapProfiler.css
index 7f20296c1..d98e3823e 100644
--- a/Source/WebCore/inspector/front-end/heapProfiler.css
+++ b/Source/WebCore/inspector/front-end/heapProfiler.css
@@ -121,8 +121,8 @@ body.inactive .heap-snapshot-sidebar-tree-item.wait.selected .icon {
 
 .detailed-heapshot-view .data-grid span.percent-column {
     color: grey;
-    width: 42px;
-    float: left;
+    width: 32px;
+    float: right;
 }
 
 .detailed-heapshot-view .console-formatted-object, .console-formatted-node {
@@ -187,6 +187,30 @@ body.inactive .heap-snapshot-sidebar-tree-item.wait.selected .icon {
     right: 0;
 }
 
+.detailed-heapshot-view .constructors-view-grid {
+    top: 22px;
+}
+
+.detailed-heapshot-view .constructors-view-toolbar {
+    height: 22px;
+    background-color: #DDD;
+    display: block;
+    position: absolute;
+    left: 0;
+    right: 0;
+    top: 0;
+}
+
+.detailed-heapshot-view .constructors-view-toolbar input.constructors-view-filter {
+    width: 200px;
+    height: 18px;
+    font-size: 11px;
+    padding: 2px;
+    margin: 2px 10px;
+    background-color: white;
+    border: solid 1px #BBB;
+}
+
 .detailed-heapshot-view .retainers-view-header {
     background-image: url(Images/statusbarResizerVertical.png), url(Images/statusbarBackground.png);
     background-repeat: no-repeat, repeat-x;
diff --git a/Source/WebCore/inspector/front-end/indexedDBViews.css b/Source/WebCore/inspector/front-end/indexedDBViews.css
new file mode 100644
index 000000000..b5817d14e
--- /dev/null
+++ b/Source/WebCore/inspector/front-end/indexedDBViews.css
@@ -0,0 +1,101 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+.indexed-db-database-view {
+    -webkit-user-select: text;
+    margin-top: 5px;
+}
+
+.indexed-db-database-view .outline-disclosure {
+    padding-left: 0;
+}
+
+.indexed-db-database-view .outline-disclosure li {
+    white-space: nowrap;
+}
+
+.indexed-db-database-view .outline-disclosure .attribute-name {
+    color: rgb(33%, 33%, 33%);
+    display: inline-block;
+    margin-right: 0.5em;
+    font-weight: bold;
+    vertical-align: top;
+}
+
+.indexed-db-database-view .outline-disclosure .attribute-value {
+    display: inline;
+    margin-top: 1px;
+}
+
+.indexed-db-data-view .data-view-toolbar {
+    position: relative;
+    margin-top: -1px;
+    height: 24px;
+}
+
+.indexed-db-data-view .data-view-toolbar .back-button img {
+    content: url(Images/back.png);
+}
+
+.indexed-db-data-view .data-view-toolbar .forward-button img {
+    content: url(Images/forward.png);
+}
+
+.indexed-db-data-view .data-view-toolbar .key-input {
+    font-size: 10px;
+    margin-top: 3px;
+    margin-left: 3px;
+    width: 200px;
+}
+
+.indexed-db-data-view .data-grid-container {
+    top: 23px;
+}
+
+.indexed-db-data-view .data-grid {
+    height: 100%;
+    border: 0;
+}
+
+.indexed-db-data-view .data-grid .data-container tr:nth-child(even) {
+    background-color: white;
+}
+
+.indexed-db-data-view .data-grid .data-container tr:nth-child(odd) {
+    background-color: #EAF3FF;
+}
+
+.indexed-db-data-view .data-grid .data-container tr:nth-last-child(1) {
+    background-color: white;
+}
+
+.indexed-db-data-view .data-grid .data-container tr:nth-last-child(1) td {
+    border: 0;
+}
diff --git a/Source/WebCore/inspector/front-end/inspector.css b/Source/WebCore/inspector/front-end/inspector.css
index 70f0e136f..490c1f52b 100644
--- a/Source/WebCore/inspector/front-end/inspector.css
+++ b/Source/WebCore/inspector/front-end/inspector.css
@@ -1437,14 +1437,20 @@ li.editing .swatch, li.editing .enabled-button,  li.editing-sub-part .delete-but
 }
 
 .swatch {
-    display: inline-block;
-    vertical-align: baseline;
     margin-left: 1px;
     margin-right: 2px;
     margin-bottom: -1px;
     width: 1em;
     height: 1em;
     border: 1px solid rgba(128, 128, 128, 0.6);
+    background-image: url(Images/checker.png);
+    display: inline-block;
+}
+
+.swatch-inner {
+    width: 100%;
+    height: 100%;
+    display: block;
 }
 
 .swatch:hover {
diff --git a/Source/WebCore/inspector/front-end/inspector.html b/Source/WebCore/inspector/front-end/inspector.html
index 04e4ef1d6..ee56c86b2 100644
--- a/Source/WebCore/inspector/front-end/inspector.html
+++ b/Source/WebCore/inspector/front-end/inspector.html
@@ -82,7 +82,9 @@ THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
     <script type="text/javascript" src="ApplicationCacheModel.js"></script>
     <script type="text/javascript" src="ApplicationCacheItemsView.js"></script>
     <script type="text/javascript" src="IndexedDBModel.js"></script>
+    <script type="text/javascript" src="IndexedDBViews.js"></script>
     <script type="text/javascript" src="Script.js"></script>
+    <script type="text/javascript" src="Spectrum.js"></script>
     <script type="text/javascript" src="SidebarPane.js"></script>
     <script type="text/javascript" src="ElementsTreeOutline.js"></script>
     <script type="text/javascript" src="DOMPresentationUtils.js"></script>
@@ -181,6 +183,7 @@ THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
     <script type="text/javascript" src="Dialog.js"></script>
     <script type="text/javascript" src="GoToLineDialog.js"></script>
     <script type="text/javascript" src="FilteredItemSelectionDialog.js"></script>
+    <script type="text/javascript" src="SidebarOverlay.js"></script>
     <script type="text/javascript" src="SettingsScreen.js"></script>
     <script type="text/javascript" src="ShortcutsScreen.js"></script>
     <script type="text/javascript" src="HAREntry.js"></script>
diff --git a/Source/WebCore/inspector/front-end/inspector.js b/Source/WebCore/inspector/front-end/inspector.js
index 29d05fa70..05fa8e2e2 100644
--- a/Source/WebCore/inspector/front-end/inspector.js
+++ b/Source/WebCore/inspector/front-end/inspector.js
@@ -406,7 +406,6 @@ WebInspector._doLoadedDoneWithCapabilities = function()
     this._createPanels();
     this._createGlobalStatusBarItems();
 
-
     this.toolbar = new WebInspector.Toolbar();
     WebInspector._installDockToRight();
 
@@ -440,6 +439,9 @@ WebInspector._doLoadedDoneWithCapabilities = function()
     DatabaseAgent.enable();
     DOMStorageAgent.enable();
 
+    if (WebInspector.settings.showPaintRects.get())
+        PageAgent.setShowPaintRects(true);
+
     WebInspector.CSSCompletions.requestCSSNameCompletions();
     WebInspector.WorkerManager.loadCompleted();
     InspectorFrontendAPI.loadCompleted();
@@ -555,7 +557,7 @@ WebInspector.documentClick = function(event)
 
     function followLink()
     {
-        if (WebInspector._showAnchorLocation(anchor))
+        if (WebInspector.isInEditMode(event) || WebInspector._showAnchorLocation(anchor))
             return;
 
         const profileMatch = WebInspector.ProfileType.URLRegExp.exec(anchor.href);
diff --git a/Source/WebCore/inspector/front-end/inspectorCommon.css b/Source/WebCore/inspector/front-end/inspectorCommon.css
index 82dc5b865..526843140 100644
--- a/Source/WebCore/inspector/front-end/inspectorCommon.css
+++ b/Source/WebCore/inspector/front-end/inspectorCommon.css
@@ -13,7 +13,6 @@ body {
     font-family: Lucida Grande, sans-serif;
     font-size: 10px;
     margin: 0;
-    -webkit-text-size-adjust: none;
     -webkit-user-select: none;
 }
 
diff --git a/Source/WebCore/inspector/front-end/networkLogView.css b/Source/WebCore/inspector/front-end/networkLogView.css
index c525d9ac3..202e8b43d 100644
--- a/Source/WebCore/inspector/front-end/networkLogView.css
+++ b/Source/WebCore/inspector/front-end/networkLogView.css
@@ -311,10 +311,10 @@
     bottom: 0;
     margin: auto -7px;
     border-width: 6px 7px;
-    height: 13px;
+    height: 0;
     min-width: 14px;
     opacity: 0.65;
-    -webkit-border-image: url(Images/timelinePillGray.png) 6 7 6 7;
+    -webkit-border-image: url(Images/timelinePillGray.png) 7 7 7 7;
 }
 
 .network-graph-bar.waiting, .network-graph-bar.waiting-right {
@@ -325,23 +325,23 @@
 
 
 .resource-cached .network-graph-bar {
-    -webkit-border-image: url(Images/timelineHollowPillGray.png) 6 7 6 7;
+    -webkit-border-image: url(Images/timelineHollowPillGray.png) 7 7 7 7;
 }
 
 .network-category-documents .network-graph-bar {
-    -webkit-border-image: url(Images/timelinePillBlue.png) 6 7 6 7;
+    -webkit-border-image: url(Images/timelinePillBlue.png) 7 7 7 7;
 }
 
 .network-category-documents.resource-cached .network-graph-bar {
-    -webkit-border-image: url(Images/timelineHollowPillBlue.png) 6 7 6 7;
+    -webkit-border-image: url(Images/timelineHollowPillBlue.png) 7 7 7 7;
 }
 
 .network-category-stylesheets .network-graph-bar {
-    -webkit-border-image: url(Images/timelinePillGreen.png) 6 7 6 7;
+    -webkit-border-image: url(Images/timelinePillGreen.png) 7 7 7 7;
 }
 
 .network-category-stylesheets.resource-cached .network-graph-bar {
-    -webkit-border-image: url(Images/timelineHollowPillGreen.png) 6 7 6 7;
+    -webkit-border-image: url(Images/timelineHollowPillGreen.png) 7 7 7 7;
 }
 
 .network-category-images .network-graph-bar {
@@ -349,39 +349,39 @@
 }
 
 .network-category-images.resource-cached .network-graph-bar {
-    -webkit-border-image: url(Images/timelineHollowPillPurple.png) 6 7 6 7;
+    border-image: url(Images/timelineHollowPillPurple.png) 7 7 7 7;
 }
 
 .network-category-fonts .network-graph-bar {
-    -webkit-border-image: url(Images/timelinePillRed.png) 6 7 6 7;
+    -webkit-border-image: url(Images/timelinePillRed.png) 7 7 7 7;
 }
 
 .network-category-fonts.resource-cached .network-graph-bar {
-    -webkit-border-image: url(Images/timelineHollowPillRed.png) 6 7 6 7;
+    -webkit-border-image: url(Images/timelineHollowPillRed.png) 7 7 7 7;
 }
 
 .network-category-scripts .network-graph-bar {
-    -webkit-border-image: url(Images/timelinePillOrange.png) 6 7 6 7;
+    -webkit-border-image: url(Images/timelinePillOrange.png) 7 7 7 7;
 }
 
 .network-category-scripts.resource-cached .network-graph-bar {
-    -webkit-border-image: url(Images/timelineHollowPillOrange.png) 6 7 6 7;
+    -webkit-border-image: url(Images/timelineHollowPillOrange.png) 7 7 7 7;
 }
 
 .network-category-xhr .network-graph-bar {
-    -webkit-border-image: url(Images/timelinePillYellow.png) 6 7 6 7;
+    -webkit-border-image: url(Images/timelinePillYellow.png) 7 7 7 7;
 }
 
 .network-category-xhr.resource-cached .network-graph-bar {
-    -webkit-border-image: url(Images/timelineHollowPillYellow.png) 6 7 6 7;
+    -webkit-border-image: url(Images/timelineHollowPillYellow.png) 7 7 7 7;
 }
 
 .network-category-websockets .network-graph-bar {
-    -webkit-border-image: url(Images/timelinePillGray.png) 6 7 6 7;
+    -webkit-border-image: url(Images/timelinePillGray.png) 7 7 7 7;
 }
 
 .network-category-websockets.resource-cached .network-graph-bar {
-   -webkit-border-image: url(Images/timelineHollowPillGray.png) 6 7 6 7;
+   -webkit-border-image: url(Images/timelineHollowPillGray.png) 7 7 7 7;
 }
 
 .network-dim-cell {
diff --git a/Source/WebCore/inspector/front-end/popover.css b/Source/WebCore/inspector/front-end/popover.css
index cf14ed47e..e6e95f59c 100644
--- a/Source/WebCore/inspector/front-end/popover.css
+++ b/Source/WebCore/inspector/front-end/popover.css
@@ -17,6 +17,10 @@
     -webkit-user-select: text;
 }
 
+.popover .content.fixed-height {
+    overflow: hidden;
+} 
+
 .popover .arrow {
     position: absolute;
     background-image: url(Images/popoverArrows.png);
diff --git a/Source/WebCore/inspector/front-end/resourcesPanel.css b/Source/WebCore/inspector/front-end/resourcesPanel.css
index a82f35daf..a2b3ad3b5 100644
--- a/Source/WebCore/inspector/front-end/resourcesPanel.css
+++ b/Source/WebCore/inspector/front-end/resourcesPanel.css
@@ -298,6 +298,18 @@ li.selected .base-storage-tree-element-subtitle {
     content: url(Images/databaseTable.png);
 }
 
+.indexed-db-storage-tree-item .icon {
+    content: url(Images/indexedDB.png);
+}
+
+.indexed-db-object-store-storage-tree-item .icon {
+    content: url(Images/indexedDBObjectStore.png);
+}
+
+.indexed-db-index-storage-tree-item .icon {
+    content: url(Images/indexedDBIndex.png);
+}
+
 .domstorage-storage-tree-item.local-storage .icon {
     content: url(Images/localStorage.png);
 }
diff --git a/Source/WebCore/inspector/front-end/scriptsPanel.css b/Source/WebCore/inspector/front-end/scriptsPanel.css
index 9eac3e09b..b412f0207 100644
--- a/Source/WebCore/inspector/front-end/scriptsPanel.css
+++ b/Source/WebCore/inspector/front-end/scriptsPanel.css
@@ -142,7 +142,7 @@
     z-index: 13;
 }
 
-#scripts-navigator-resizer-widget {
+.scripts-navigator-resizer-widget {
     position: absolute;
     top: 0;
     right: 0;
@@ -154,6 +154,50 @@
     background-position: center;
 }
 
+.scripts-navigator-control-button {
+    position: absolute;
+    padding: 0;
+    margin: 0;
+    border: 0 transparent none;
+    background-color: transparent;
+}
+
+#scripts-navigator-show-hide-button {
+    top: 3px;
+    height: 16px;
+    left: 2px;
+    width: 16px;
+}
+
+#scripts-navigator-show-hide-button .glyph {
+    -webkit-mask-image: url(Images/navigatorShowHideButton.png);
+}
+
+#scripts-navigator-show-hide-button:active .glyph {
+    top: 1px;
+    bottom: -1px;
+}
+
+#scripts-navigator-show-hide-button.toggled-on .glyph {
+    background-color: #4281EB;
+}
+
+#scripts-navigator-pin-button {
+    top: 6px;
+    height: 10px;
+    right: 16px;
+    width: 10px;
+}
+
+#scripts-navigator-pin-button .glyph {
+    -webkit-mask-image: url(Images/navigatorPinButton.png);
+}
+
+#scripts-navigator-pin-button:active .glyph {
+    top: 1px;
+    bottom: -1px;
+}
+
 .scripts-views-container {
     position: absolute;
     top: 23px;
@@ -203,7 +247,7 @@
     content: url(Images/resourceJSIcon.png);
 }
 
-.scripts.panel .navigator {
+#scripts-navigator-tabbed-pane .navigator {
     padding-left: 0;
 }
 
@@ -234,8 +278,8 @@
 }
 
 #scripts-navigator-tabbed-pane .tabbed-pane-header-contents {
-    margin-left: 1px;
-    margin-right: 16px;
+    margin-left: 20px;
+    margin-right: 28px;
 }
 
 #scripts-editor-container-tabbed-pane .tabbed-pane-header {
@@ -247,48 +291,52 @@
     margin-right: 16px;
 }
 
+#scripts-editor-container-tabbed-pane.navigator-hidden .tabbed-pane-header-contents {
+    margin-left: 20px;
+}
+
 #scripts-editor-container-tabbed-pane .tabbed-pane-header-tab {
     border-bottom: 1px solid #BBB;
 }
 
-.scripts.panel .navigator li {
+#scripts-navigator-tabbed-pane .navigator li {
     height: 17px;
     white-space: nowrap;
 }
 
-.scripts.panel .navigator :focus li.selected {
+#scripts-navigator-tabbed-pane .navigator :focus li.selected {
     color: white;
 }
 
-.scripts.panel .navigator li.selected .selection {
+#scripts-navigator-tabbed-pane .navigator li.selected .selection {
     height: 17px;
     background-color: rgb(180, 180, 180);
 }
 
-.scripts.panel .navigator :focus li.selected .selection {
+#scripts-navigator-tabbed-pane .navigator :focus li.selected .selection {
     background-color: rgb(111, 140, 210);
 }
 
-.scripts.panel .navigator .search-match-found li.selected .selection {
+#scripts-navigator-tabbed-pane .navigator .search-match-found li.selected .selection {
     background-color: rgb(111, 140, 210);
 }
 
-.scripts.panel .navigator .search-match-not-found li.selected .selection {
+#scripts-navigator-tabbed-pane .navigator .search-match-not-found li.selected .selection {
     border-color: rgb(111, 140, 210);
     background-color: white;
 }
 
-.scripts.panel .navigator .searching li.selected .selection {
+#scripts-navigator-tabbed-pane .navigator .searching li.selected .selection {
     background-color: rgb(111, 140, 210);
 }
 
-.scripts.panel .navigator .icon {
+#scripts-navigator-tabbed-pane .navigator .icon {
     width: 16px;
     height: 16px;
     float: left;
 }
 
-.scripts.panel .base-navigator-tree-element-title {
+#scripts-navigator-tabbed-pane .navigator .base-navigator-tree-element-title {
     overflow: hidden;
     text-overflow: ellipsis;
     position: relative;
diff --git a/Source/WebCore/inspector/front-end/textPrompt.css b/Source/WebCore/inspector/front-end/textPrompt.css
index 217ae94ca..ca4ba07ce 100644
--- a/Source/WebCore/inspector/front-end/textPrompt.css
+++ b/Source/WebCore/inspector/front-end/textPrompt.css
@@ -31,16 +31,12 @@
 .suggest-box {
     position: absolute;
     background-color: #FFFFFF;
-    display: none;
+    display: block;
     border: 1px solid black;
     padding: 2px;
     z-index: 100;
 }
 
-.suggest-box.visible {
-    display: block;
-}
-
 .suggest-box .container {
     position: absolute;
     top: 0;
diff --git a/Source/WebCore/inspector/front-end/timelinePanel.css b/Source/WebCore/inspector/front-end/timelinePanel.css
index 3dc8c115f..fd44d59fe 100644
--- a/Source/WebCore/inspector/front-end/timelinePanel.css
+++ b/Source/WebCore/inspector/front-end/timelinePanel.css
@@ -72,6 +72,10 @@
     border-right: 1px solid rgb(163, 163, 163);
 }
 
+.timeline-start-at-zero #timeline-overview-sidebar {
+    display: none;
+}
+
 #timeline-overview-grid {
     position: absolute;
     top: 0px;
@@ -81,6 +85,10 @@
     background-color: rgb(255, 255, 255);
 }
 
+.timeline-start-at-zero #timeline-overview-grid {
+    display: none;
+}
+
 .timeline-window-selector {
     position: absolute;
     top: 0;
@@ -89,7 +97,7 @@
     z-index: 250;
 }
 
-#timeline-overview-window {
+.timeline-overview-window {
     background-color: white;
     position: absolute;
     left: 0;
@@ -99,6 +107,10 @@
     z-index: 150;
 }
 
+.timeline-start-at-zero .timeline-overview-window {
+    bottom: 0;
+}
+
 .timeline-overview-dividers-background {
     left: 0%;
     right: 0%;
@@ -108,6 +120,10 @@
     position: absolute;
 }
 
+.timeline-start-at-zero .timeline-overview-dividers-background {
+    bottom: 0;
+}
+
 .timeline-overview-window-rulers {
     top: 0;
     bottom: 0;
@@ -268,6 +284,10 @@
     z-index: 160;
 }
 
+.timeline-start-at-zero #timeline-overview-memory {
+    display: none;
+}
+
 #timeline-overview-memory > canvas {
     position: absolute;
     left: 0;
@@ -333,10 +353,6 @@
     opacity: 0.2;
 }
 
-.timeline-graph-bar.cpu {
-    opacity: 0.6;
-}
-
 .timeline-graph-side.even {
     background-color: rgba(0, 0, 0, 0.05);
 }
@@ -363,15 +379,15 @@
     width: 10px;
 }
 
-.timeline-loading {
+.popover .timeline-loading {
     -webkit-border-image: url(Images/timelineBarBlue.png) 4 4 5 4;
 }
 
-.timeline-scripting {
+.popover .timeline-scripting {
     -webkit-border-image: url(Images/timelineBarOrange.png) 4 4 5 4;
 }
 
-.timeline-rendering {
+.popover .timeline-rendering {
     -webkit-border-image: url(Images/timelineBarPurple.png) 4 4 5 4;
 }
 
@@ -435,6 +451,18 @@
     -webkit-mask-position: -128px -24px;
 }
 
+.glue-async-status-bar-item .glyph {
+    -webkit-mask-position: -128px -48px;
+}
+
+.timeline-start-at-zero-status-bar-item .glyph {
+    -webkit-mask-position: -160px -48px;
+}
+
+.timeline-start-at-zero-status-bar-item.toggled-on .glyph {
+    background-color: rgb(66, 129, 235) !important;
+}
+
 .timeline-records-counter, .storage-application-cache-status, .storage-application-cache-connectivity {
     font-size: 11px;
     text-shadow: white 0 1px 0;
@@ -531,21 +559,70 @@
     overflow: hidden;
 }
 
-.timeline-marker {
-    position: absolute;
-    left: 0;
-    top: 0;
-    bottom: 0;
-    border-left: 1px solid #AAA;
-}
-
 .memory-counter-sidebar-info {
     position: absolute;
     top: 0;
     left: 0;
     right: 0;
+    font-size: 11px;
 }
 
 .memory-counter-sidebar-info.bottom-border-visible {
     border-bottom: 1px solid #AAA;
 }
+
+.memory-counter-sidebar-info .title {
+    margin: 4px;
+    font-weight: bold;
+}
+
+.memory-counter-sidebar-info .counter-value {
+    margin: 4px;
+}
+
+.timeline-overview-start-at-zero {
+    background-color: white;
+}
+
+.timeline-overview-start-at-zero-bars {
+    display: -webkit-box;
+    -webkit-box-align: end;
+    background-color: white;
+    padding-left: 4px;
+    padding-right: 4px;
+    z-index: 200;
+    background-color: rgba(255, 255, 255, 0.8);
+}
+
+.timeline-overview-start-at-zero-bars .padding {
+    -webkit-box-flex: 100000;
+}
+
+.timeline-overview-start-at-zero-bars .timeline-bar-vertical {
+    display: -webkit-box;
+    -webkit-box-orient: vertical;
+    -webkit-box-pack: end;
+    width: 12px;
+    padding-right: 2px;
+    -webkit-box-flex: 1;
+}
+
+.timeline-bar-vertical div:first-child {
+    -webkit-border-top-left-radius: 2px;
+    -webkit-border-top-right-radius: 2px;
+}
+
+.timeline-bar-vertical .timeline-loading {
+    background: -webkit-linear-gradient(left, rgb(201, 220, 245), rgb(109, 157, 222));
+    border: solid 1px rgb(106, 152, 213);
+}
+
+.timeline-bar-vertical .timeline-scripting {
+    background: -webkit-linear-gradient(left, rgb(251, 222, 168), rgb(234, 182, 77));
+    border: solid 1px rgb(223, 175, 77);
+}
+
+.timeline-bar-vertical .timeline-rendering {
+    background: -webkit-linear-gradient(left, rgb(213, 185, 236), rgb(137, 62, 200));
+    border: solid 1px rgb(130, 59, 190);
+}
diff --git a/Source/WebCore/inspector/front-end/treeoutline.js b/Source/WebCore/inspector/front-end/treeoutline.js
index ce36fe82c..528f41b7e 100644
--- a/Source/WebCore/inspector/front-end/treeoutline.js
+++ b/Source/WebCore/inspector/front-end/treeoutline.js
@@ -859,9 +859,11 @@ TreeElement.treeElementDoubleClicked = function(event)
     if (!element || !element.treeElement)
         return;
 
-    if (element.treeElement.ondblclick)
-        element.treeElement.ondblclick.call(element.treeElement, event);
-    else if (element.treeElement.hasChildren && !element.treeElement.expanded)
+    if (element.treeElement.ondblclick) {
+        var handled = element.treeElement.ondblclick.call(element.treeElement, event);
+        if (handled)
+            return;
+    } else if (element.treeElement.hasChildren && !element.treeElement.expanded)
         element.treeElement.expand();
 }
 
diff --git a/Source/WebCore/inspector/front-end/utilities.js b/Source/WebCore/inspector/front-end/utilities.js
index ebe2ec7b1..663317c2a 100644
--- a/Source/WebCore/inspector/front-end/utilities.js
+++ b/Source/WebCore/inspector/front-end/utilities.js
@@ -342,8 +342,8 @@ Element.prototype.boxInWindow = function(targetWindow)
     targetWindow = targetWindow || this.ownerDocument.defaultView;
 
     var anchorBox = this.offsetRelativeToWindow(window);
-    anchorBox.width = this.offsetWidth;
-    anchorBox.height = this.offsetHeight;
+    anchorBox.width = Math.min(this.offsetWidth, window.innerWidth - anchorBox.x);
+    anchorBox.height = Math.min(this.offsetHeight, window.innerHeight - anchorBox.y);
 
     return anchorBox;
 }
diff --git a/Source/WebCore/loader/DocumentLoader.cpp b/Source/WebCore/loader/DocumentLoader.cpp
index 39f73139e..7b0bf8b20 100644
--- a/Source/WebCore/loader/DocumentLoader.cpp
+++ b/Source/WebCore/loader/DocumentLoader.cpp
@@ -448,6 +448,9 @@ bool DocumentLoader::isLoadingInAPISense() const
     // Once a frame has loaded, we no longer need to consider subresources,
     // but we still need to consider subframes.
     if (frameLoader()->state() != FrameStateComplete) {
+        if (m_frame->settings()->needsIsLoadingInAPISenseQuirk() && !m_subresourceLoaders.isEmpty())
+            return true;
+    
         Document* doc = m_frame->document();
         if ((!m_primaryLoadComplete || !m_frame->document()->loadEventFinished()) && isLoading())
             return true;
diff --git a/Source/WebCore/loader/EmptyClients.h b/Source/WebCore/loader/EmptyClients.h
index 2eb24a32b..8c4f00a52 100644
--- a/Source/WebCore/loader/EmptyClients.h
+++ b/Source/WebCore/loader/EmptyClients.h
@@ -233,7 +233,8 @@ public:
     virtual void needTouchEvents(bool) { }
 #endif
     
-    virtual void numWheelEventHandlersChanged(unsigned) { }
+    virtual void numWheelEventHandlersChanged(unsigned) OVERRIDE { }
+    virtual void numTouchEventHandlersChanged(unsigned) OVERRIDE { }
     
     virtual bool shouldRubberBandInDirection(WebCore::ScrollDirection) const { return false; }
 };
@@ -431,7 +432,7 @@ public:
 #endif
 
     virtual void getGuessesForWord(const String&, const String&, Vector<String>&) { }
-    virtual void requestCheckingOfString(SpellChecker*, int, TextCheckingTypeMask, const String&) { }
+    virtual void requestCheckingOfString(SpellChecker*, const TextCheckingRequest&) { }
 };
 
 class EmptyEditorClient : public EditorClient {
@@ -460,7 +461,7 @@ public:
     virtual bool shouldInsertText(const String&, Range*, EditorInsertAction) { return false; }
     virtual bool shouldChangeSelectedRange(Range*, Range*, EAffinity, bool) { return false; }
 
-    virtual bool shouldApplyStyle(CSSStyleDeclaration*, Range*) { return false; }
+    virtual bool shouldApplyStyle(StylePropertySet*, Range*) { return false; }
     virtual bool shouldMoveRangeAfterDelete(Range*, Range*) { return false; }
 
     virtual void didBeginEditing() { }
diff --git a/Source/WebCore/loader/FrameLoader.cpp b/Source/WebCore/loader/FrameLoader.cpp
index cd228d4ba..5635539d7 100644
--- a/Source/WebCore/loader/FrameLoader.cpp
+++ b/Source/WebCore/loader/FrameLoader.cpp
@@ -2439,8 +2439,8 @@ void FrameLoader::closeAndRemoveChild(Frame* child)
     child->setView(0);
     if (child->ownerElement() && child->page())
         child->page()->decrementFrameCount();
-    // FIXME: The page isn't being destroyed, so it's not right to call a function named pageDestroyed().
-    child->pageDestroyed();
+    child->willDetachPage();
+    child->detachFromPage();
 
     m_frame->tree()->removeChild(child);
 }
@@ -2518,8 +2518,8 @@ void FrameLoader::detachFromParent()
         parent->loader()->scheduleCheckCompleted();
     } else {
         m_frame->setView(0);
-        // FIXME: The page isn't being destroyed, so it's not right to call a function named pageDestroyed().
-        m_frame->pageDestroyed();
+        m_frame->willDetachPage();
+        m_frame->detachFromPage();
     }
 }
 
diff --git a/Source/WebCore/loader/ImageLoader.cpp b/Source/WebCore/loader/ImageLoader.cpp
index 56e675145..842175b5e 100644
--- a/Source/WebCore/loader/ImageLoader.cpp
+++ b/Source/WebCore/loader/ImageLoader.cpp
@@ -28,6 +28,7 @@
 #include "Document.h"
 #include "Element.h"
 #include "Event.h"
+#include "EventSender.h"
 #include "HTMLNames.h"
 #include "HTMLObjectElement.h"
 #include "HTMLParserIdioms.h"
@@ -62,32 +63,6 @@ template<> struct ValueCheck<WebCore::ImageLoader*> {
 
 namespace WebCore {
 
-class ImageEventSender {
-    WTF_MAKE_NONCOPYABLE(ImageEventSender); WTF_MAKE_FAST_ALLOCATED;
-public:
-    ImageEventSender(const AtomicString& eventType);
-
-    void dispatchEventSoon(ImageLoader*);
-    void cancelEvent(ImageLoader*);
-
-    void dispatchPendingEvents();
-
-#ifndef NDEBUG
-    bool hasPendingEvents(ImageLoader* loader) const
-    {
-        return m_dispatchSoonList.find(loader) != notFound || m_dispatchingList.find(loader) != notFound;
-    }
-#endif
-
-private:
-    void timerFired(Timer<ImageEventSender>*);
-
-    AtomicString m_eventType;
-    Timer<ImageEventSender> m_timer;
-    Vector<ImageLoader*> m_dispatchSoonList;
-    Vector<ImageLoader*> m_dispatchingList;
-};
-
 static ImageEventSender& beforeLoadEventSender()
 {
     DEFINE_STATIC_LOCAL(ImageEventSender, sender, (eventNames().beforeloadEvent));
@@ -302,6 +277,16 @@ void ImageLoader::updateRenderer()
         imageResource->setCachedImage(m_image.get());
 }
 
+void ImageLoader::dispatchPendingEvent(ImageEventSender* eventSender)
+{
+    ASSERT(eventSender == &beforeLoadEventSender() || eventSender == &loadEventSender());
+    const AtomicString& eventType = eventSender->eventType();
+    if (eventType == eventNames().beforeloadEvent)
+        dispatchPendingBeforeLoadEvent();
+    if (eventType == eventNames().loadEvent)
+        dispatchPendingLoadEvent();
+}
+
 void ImageLoader::dispatchPendingBeforeLoadEvent()
 {
     if (m_firedBeforeLoad)
@@ -354,66 +339,4 @@ void ImageLoader::elementDidMoveToNewDocument()
     setImage(0);
 }
 
-ImageEventSender::ImageEventSender(const AtomicString& eventType)
-    : m_eventType(eventType)
-    , m_timer(this, &ImageEventSender::timerFired)
-{
-}
-
-void ImageEventSender::dispatchEventSoon(ImageLoader* loader)
-{
-    m_dispatchSoonList.append(loader);
-    if (!m_timer.isActive())
-        m_timer.startOneShot(0);
-}
-
-void ImageEventSender::cancelEvent(ImageLoader* loader)
-{
-    // Remove instances of this loader from both lists.
-    // Use loops because we allow multiple instances to get into the lists.
-    size_t size = m_dispatchSoonList.size();
-    for (size_t i = 0; i < size; ++i) {
-        if (m_dispatchSoonList[i] == loader)
-            m_dispatchSoonList[i] = 0;
-    }
-    size = m_dispatchingList.size();
-    for (size_t i = 0; i < size; ++i) {
-        if (m_dispatchingList[i] == loader)
-            m_dispatchingList[i] = 0;
-    }
-    if (m_dispatchSoonList.isEmpty())
-        m_timer.stop();
-}
-
-void ImageEventSender::dispatchPendingEvents()
-{
-    // Need to avoid re-entering this function; if new dispatches are
-    // scheduled before the parent finishes processing the list, they
-    // will set a timer and eventually be processed.
-    if (!m_dispatchingList.isEmpty())
-        return;
-
-    m_timer.stop();
-
-    m_dispatchSoonList.checkConsistency();
-
-    m_dispatchingList.swap(m_dispatchSoonList);
-    size_t size = m_dispatchingList.size();
-    for (size_t i = 0; i < size; ++i) {
-        if (ImageLoader* loader = m_dispatchingList[i]) {
-            m_dispatchingList[i] = 0;
-            if (m_eventType == eventNames().beforeloadEvent)
-                loader->dispatchPendingBeforeLoadEvent();
-            else
-                loader->dispatchPendingLoadEvent();
-        }
-    }
-    m_dispatchingList.clear();
-}
-
-void ImageEventSender::timerFired(Timer<ImageEventSender>*)
-{
-    dispatchPendingEvents();
-}
-
 }
diff --git a/Source/WebCore/loader/ImageLoader.h b/Source/WebCore/loader/ImageLoader.h
index 5f4818997..0667b3dc4 100644
--- a/Source/WebCore/loader/ImageLoader.h
+++ b/Source/WebCore/loader/ImageLoader.h
@@ -30,9 +30,12 @@
 namespace WebCore {
 
 class Element;
-class ImageLoadEventSender;
+class ImageLoader;
 class RenderImageResource;
 
+template<typename T> class EventSender;
+typedef EventSender<ImageLoader> ImageEventSender;
+
 class ImageLoader : public CachedImageClient {
 public:
     ImageLoader(Element*);
@@ -59,6 +62,8 @@ public:
     bool haveFiredBeforeLoadEvent() const { return m_firedBeforeLoad; }
     bool haveFiredLoadEvent() const { return m_firedLoad; }
 
+    void dispatchPendingEvent(ImageEventSender*);
+
     static void dispatchPendingBeforeLoadEvents();
     static void dispatchPendingLoadEvents();
 
@@ -69,7 +74,6 @@ private:
     virtual void dispatchLoadEvent() = 0;
     virtual String sourceURI(const AtomicString&) const = 0;
 
-    friend class ImageEventSender;
     void dispatchPendingBeforeLoadEvent();
     void dispatchPendingLoadEvent();
 
diff --git a/Source/WebCore/loader/NavigationScheduler.cpp b/Source/WebCore/loader/NavigationScheduler.cpp
index d30413304..46267f932 100644
--- a/Source/WebCore/loader/NavigationScheduler.cpp
+++ b/Source/WebCore/loader/NavigationScheduler.cpp
@@ -422,6 +422,8 @@ void NavigationScheduler::schedule(PassOwnPtr<ScheduledNavigation> redirect)
 {
     ASSERT(m_frame->page());
 
+    RefPtr<Frame> protect(m_frame);
+
     // If a redirect was scheduled during a load, then stop the current load.
     // Otherwise when the current load transitions from a provisional to a 
     // committed state, pending redirects may be cancelled. 
@@ -437,6 +439,9 @@ void NavigationScheduler::schedule(PassOwnPtr<ScheduledNavigation> redirect)
     if (!m_frame->loader()->isComplete() && m_redirect->isLocationChange())
         m_frame->loader()->completed();
 
+    if (!m_frame->page())
+        return;
+
     startTimer();
 }
 
diff --git a/Source/WebCore/loader/cache/CachedFont.h b/Source/WebCore/loader/cache/CachedFont.h
index f857dade5..e0b5b7dac 100644
--- a/Source/WebCore/loader/cache/CachedFont.h
+++ b/Source/WebCore/loader/cache/CachedFont.h
@@ -60,6 +60,7 @@ public:
     void checkNotify();
 
     void beginLoadIfNeeded(CachedResourceLoader* dl);
+    bool stillNeedsLoad() const { return !m_loadInitiated; }
 
     bool ensureCustomFontData();
     FontPlatformData platformDataFromCustomData(float size, bool bold, bool italic, FontOrientation = Horizontal, TextOrientation = TextOrientationVerticalRight, FontWidthVariant = RegularWidth, FontRenderingMode = NormalRenderingMode);
diff --git a/Source/WebCore/loader/cache/CachedRawResource.cpp b/Source/WebCore/loader/cache/CachedRawResource.cpp
index 63f81c9a7..196d7a90d 100644
--- a/Source/WebCore/loader/cache/CachedRawResource.cpp
+++ b/Source/WebCore/loader/cache/CachedRawResource.cpp
@@ -37,7 +37,7 @@ namespace WebCore {
 
 CachedRawResource::CachedRawResource(ResourceRequest& resourceRequest)
     : CachedResource(resourceRequest, RawResource)
-    , m_dataLength(0)
+    , m_identifier(0)
 {
 }
 
@@ -48,7 +48,7 @@ void CachedRawResource::data(PassRefPtr<SharedBuffer> data, bool allDataReceived
         // If we are buffering data, then we are saving the buffer in m_data and need to manually
         // calculate the incremental data. If we are not buffering, then m_data will be null and
         // the buffer contains only the incremental data.
-        size_t previousDataLength = (m_options.shouldBufferData == BufferData) ? m_dataLength : 0;
+        size_t previousDataLength = (m_options.shouldBufferData == BufferData) ? encodedSize() : 0;
         ASSERT(data->size() >= previousDataLength);
         const char* incrementalData = data->data() + previousDataLength;
         size_t incrementalDataLength = data->size() - previousDataLength;
@@ -61,7 +61,8 @@ void CachedRawResource::data(PassRefPtr<SharedBuffer> data, bool allDataReceived
     }
     
     if (m_options.shouldBufferData == BufferData) {
-        m_dataLength = data ? data->size() : 0;
+        if (data)
+            setEncodedSize(data->size());
         m_data = data;
     }
     CachedResource::data(m_data, allDataReceived);
@@ -69,11 +70,16 @@ void CachedRawResource::data(PassRefPtr<SharedBuffer> data, bool allDataReceived
 
 void CachedRawResource::didAddClient(CachedResourceClient* c)
 {
-    if (m_data) {
-        static_cast<CachedRawResourceClient*>(c)->responseReceived(this, m_response);
-        static_cast<CachedRawResourceClient*>(c)->dataReceived(this, m_data->data(), m_data->size());
-    }
-    CachedResource::didAddClient(c);
+    if (m_response.isNull() || !hasClient(c))
+        return;
+    CachedRawResourceClient* client = static_cast<CachedRawResourceClient*>(c);
+    client->responseReceived(this, m_response);
+    if (!hasClient(c) || !m_data)
+        return;
+    client->dataReceived(this, m_data->data(), m_data->size());
+    if (!hasClient(c))
+       return;
+    CachedResource::didAddClient(client);
 }
 
 void CachedRawResource::allClientsRemoved()
@@ -94,6 +100,8 @@ void CachedRawResource::willSendRequest(ResourceRequest& request, const Resource
 
 void CachedRawResource::setResponse(const ResourceResponse& response)
 {
+    if (!m_identifier)
+        m_identifier = m_loader->identifier();
     CachedResource::setResponse(response);
     CachedResourceClientWalker<CachedRawResourceClient> w(m_clients);
     while (CachedRawResourceClient* c = w.next())
@@ -113,9 +121,15 @@ void CachedRawResource::setDefersLoading(bool defers)
         m_loader->setDefersLoading(defers);
 }
 
-unsigned long CachedRawResource::identifier() const
+bool CachedRawResource::canReuse() const
 {
-    return m_loader ? m_loader->identifier() : 0;
+    if (m_options.shouldBufferData == DoNotBufferData)
+        return false;
+
+    if (m_resourceRequest.httpMethod() != "GET")
+        return false;
+
+    return true;
 }
 
 } // namespace WebCore
diff --git a/Source/WebCore/loader/cache/CachedRawResource.h b/Source/WebCore/loader/cache/CachedRawResource.h
index 9b0cab523..f6eeb839e 100644
--- a/Source/WebCore/loader/cache/CachedRawResource.h
+++ b/Source/WebCore/loader/cache/CachedRawResource.h
@@ -27,6 +27,8 @@
 #include "CachedResourceClient.h"
 
 namespace WebCore {
+class CachedRawResourceCallback;
+class CachedRawResourceClient;
 
 class CachedRawResource : public CachedResource {
 public:
@@ -38,7 +40,9 @@ public:
     virtual void setDefersLoading(bool);
     
     // FIXME: This is exposed for the InpsectorInstrumentation for preflights in DocumentThreadableLoader. It's also really lame.
-    unsigned long identifier() const;
+    unsigned long identifier() const { return m_identifier; }
+
+    bool canReuse() const;
 
 private:
     virtual void didAddClient(CachedResourceClient*);
@@ -54,7 +58,7 @@ private:
     virtual void didDownloadData(int);
 #endif
 
-    size_t m_dataLength;
+    unsigned long m_identifier;
 };
 
 
diff --git a/Source/WebCore/loader/cache/CachedResource.cpp b/Source/WebCore/loader/cache/CachedResource.cpp
index 80d373c30..78a71c187 100644..100755
--- a/Source/WebCore/loader/cache/CachedResource.cpp
+++ b/Source/WebCore/loader/cache/CachedResource.cpp
@@ -61,6 +61,10 @@ static ResourceLoadPriority defaultPriorityForResourceType(CachedResource::Type
 #endif
             return ResourceLoadPriorityHigh;
         case CachedResource::Script:
+#if ENABLE(SVG)
+        case CachedResource::SVGDocumentResource:
+            return ResourceLoadPriorityLow;
+#endif
         case CachedResource::FontResource:
         case CachedResource::RawResource:
             return ResourceLoadPriorityMedium;
@@ -116,6 +120,10 @@ static ResourceRequest::TargetType cachedResourceTypeToTargetType(CachedResource
     case CachedResource::TextTrackResource:
         return ResourceRequest::TargetIsTextTrack;
 #endif
+#if ENABLE(SVG)
+    case CachedResource::SVGDocumentResource:
+        return ResourceRequest::TargetIsImage;
+#endif
     }
     ASSERT_NOT_REACHED();
     return ResourceRequest::TargetIsSubresource;
@@ -366,17 +374,21 @@ void CachedResource::stopLoading()
 
 void CachedResource::addClient(CachedResourceClient* client)
 {
-    addClientToSet(client);
-    didAddClient(client);
+    if (addClientToSet(client))
+        didAddClient(client);
 }
 
 void CachedResource::didAddClient(CachedResourceClient* c)
 {
+    if (m_clientsAwaitingCallback.contains(c)) {
+        m_clients.add(c);
+        m_clientsAwaitingCallback.remove(c);
+    }
     if (!isLoading())
         c->notifyFinished(this);
 }
 
-void CachedResource::addClientToSet(CachedResourceClient* client)
+bool CachedResource::addClientToSet(CachedResourceClient* client)
 {
     ASSERT(!isPurgeable());
 
@@ -390,13 +402,32 @@ void CachedResource::addClientToSet(CachedResourceClient* client)
     }
     if (!hasClients() && inCache())
         memoryCache()->addToLiveResourcesSize(this);
+
+    if (m_type == RawResource && !m_response.isNull() && !m_proxyResource) {
+        // Certain resources (especially XHRs) do crazy things if an asynchronous load returns
+        // synchronously (e.g., scripts may not have set all the state they need to handle the load).
+        // Therefore, rather than immediately sending callbacks on a cache hit like other CachedResources,
+        // we schedule the callbacks and ensure we never finish synchronously.
+        ASSERT(!m_clientsAwaitingCallback.contains(client));
+        m_clientsAwaitingCallback.add(client, CachedResourceCallback::schedule(this, client));
+        return false;
+    }
+
     m_clients.add(client);
+    return true;
 }
 
 void CachedResource::removeClient(CachedResourceClient* client)
 {
-    ASSERT(m_clients.contains(client));
-    m_clients.remove(client);
+    OwnPtr<CachedResourceCallback> callback = m_clientsAwaitingCallback.take(client);
+    if (callback) {
+        ASSERT(!m_clients.contains(client));
+        callback->cancel();
+        callback.clear();
+    } else {
+        ASSERT(m_clients.contains(client));
+        m_clients.remove(client);
+    }
 
     if (canDelete() && !inCache())
         delete this;
@@ -725,4 +756,24 @@ void CachedResource::setLoadPriority(ResourceLoadPriority loadPriority)
     m_loadPriority = loadPriority;
 }
 
+
+CachedResource::CachedResourceCallback::CachedResourceCallback(CachedResource* resource, CachedResourceClient* client)
+    : m_resource(resource)
+    , m_client(client)
+    , m_callbackTimer(this, &CachedResourceCallback::timerFired)
+{
+    m_callbackTimer.startOneShot(0);
+}
+
+void CachedResource::CachedResourceCallback::cancel()
+{
+    if (m_callbackTimer.isActive())
+        m_callbackTimer.stop();
+}
+
+void CachedResource::CachedResourceCallback::timerFired(Timer<CachedResourceCallback>*)
+{
+    m_resource->didAddClient(m_client);
+}
+
 }
diff --git a/Source/WebCore/loader/cache/CachedResource.h b/Source/WebCore/loader/cache/CachedResource.h
index b87da71ac..c07b231d4 100644
--- a/Source/WebCore/loader/cache/CachedResource.h
+++ b/Source/WebCore/loader/cache/CachedResource.h
@@ -31,6 +31,7 @@
 #include "ResourceLoadPriority.h"
 #include "ResourceRequest.h"
 #include "ResourceResponse.h"
+#include "Timer.h"
 #include <wtf/HashCountedSet.h>
 #include <wtf/HashSet.h>
 #include <wtf/OwnPtr.h>
@@ -65,6 +66,9 @@ public:
         Script,
         FontResource,
         RawResource
+#if ENABLE(SVG)
+        , SVGDocumentResource
+#endif
 #if ENABLE(XSLT)
         , XSLStyleSheet
 #endif
@@ -111,7 +115,7 @@ public:
 
     void addClient(CachedResourceClient*);
     void removeClient(CachedResourceClient*);
-    bool hasClients() const { return !m_clients.isEmpty(); }
+    bool hasClients() const { return !m_clients.isEmpty() || !m_clientsAwaitingCallback.isEmpty(); }
     void deleteIfPossible();
 
     enum PreloadResult {
@@ -254,6 +258,22 @@ protected:
     
     HashCountedSet<CachedResourceClient*> m_clients;
 
+    class CachedResourceCallback {
+    public:
+        static PassOwnPtr<CachedResourceCallback> schedule(CachedResource* resource, CachedResourceClient* client) { return adoptPtr(new CachedResourceCallback(resource, client)); }
+        void cancel();
+    private:
+        CachedResourceCallback(CachedResource*, CachedResourceClient*);
+        void timerFired(Timer<CachedResourceCallback>*);
+
+        CachedResource* m_resource;
+        CachedResourceClient* m_client;
+        Timer<CachedResourceCallback> m_callbackTimer;
+    };
+    HashMap<CachedResourceClient*, OwnPtr<CachedResourceCallback> > m_clientsAwaitingCallback;
+
+    bool hasClient(CachedResourceClient* client) { return m_clients.contains(client) || m_clientsAwaitingCallback.contains(client); }
+
     ResourceRequest m_resourceRequest;
     String m_accept;
     RefPtr<SubresourceLoader> m_loader;
@@ -267,7 +287,7 @@ protected:
     OwnPtr<PurgeableBuffer> m_purgeableData;
 
 private:
-    void addClientToSet(CachedResourceClient*);
+    bool addClientToSet(CachedResourceClient*);
 
     virtual PurgePriority purgePriority() const { return PurgeDefault; }
 
diff --git a/Source/WebCore/loader/cache/CachedResourceClient.h b/Source/WebCore/loader/cache/CachedResourceClient.h
index 4aa2dd2a7..df6bdd15f 100644
--- a/Source/WebCore/loader/cache/CachedResourceClient.h
+++ b/Source/WebCore/loader/cache/CachedResourceClient.h
@@ -39,6 +39,9 @@ public:
         ImageType,
         FontType,
         StyleSheetType,
+#if ENABLE(SVG)
+        SVGDocumentType,
+#endif
         RawResourceType
     };
 
diff --git a/Source/WebCore/loader/cache/CachedResourceLoader.cpp b/Source/WebCore/loader/cache/CachedResourceLoader.cpp
index 5df4a0dc3..aaf753eb8 100644
--- a/Source/WebCore/loader/cache/CachedResourceLoader.cpp
+++ b/Source/WebCore/loader/cache/CachedResourceLoader.cpp
@@ -28,6 +28,7 @@
 #include "CachedResourceLoader.h"
 
 #include "CachedCSSStyleSheet.h"
+#include "CachedSVGDocument.h"
 #include "CachedFont.h"
 #include "CachedImage.h"
 #include "CachedRawResource.h"
@@ -72,6 +73,10 @@ static CachedResource* createResource(CachedResource::Type type, ResourceRequest
         return new CachedCSSStyleSheet(request, charset);
     case CachedResource::Script:
         return new CachedScript(request, charset);
+#if ENABLE(SVG)
+    case CachedResource::SVGDocumentResource:
+        return new CachedSVGDocument(request);
+#endif
     case CachedResource::FontResource:
         return new CachedFont(request);
     case CachedResource::RawResource:
@@ -246,6 +251,9 @@ bool CachedResourceLoader::checkInsecureContent(CachedResource::Type type, const
 #if ENABLE(XSLT)
     case CachedResource::XSLStyleSheet:
 #endif
+#if ENABLE(SVG)
+    case CachedResource::SVGDocumentResource:
+#endif
     case CachedResource::CSSStyleSheet:
         // These resource can inject script into the current document (Script,
         // XSL) or exfiltrate the content of the current document (CSS).
@@ -313,6 +321,9 @@ bool CachedResourceLoader::canRequest(CachedResource::Type type, const KURL& url
         // These types of resources can be loaded from any origin.
         // FIXME: Are we sure about CachedResource::FontResource?
         break;
+#if ENABLE(SVG)
+    case CachedResource::SVGDocumentResource:
+#endif
 #if ENABLE(XSLT)
     case CachedResource::XSLStyleSheet:
         if (!m_document->securityOrigin()->canRequest(url)) {
@@ -347,6 +358,9 @@ bool CachedResourceLoader::canRequest(CachedResource::Type type, const KURL& url
         if (!m_document->contentSecurityPolicy()->allowStyleFromSource(url))
             return false;
         break;
+#if ENABLE(SVG)
+    case CachedResource::SVGDocumentResource:
+#endif
     case CachedResource::ImageResource:
         if (!m_document->contentSecurityPolicy()->allowImageFromSource(url))
             return false;
@@ -523,8 +537,18 @@ CachedResourceLoader::RevalidationPolicy CachedResourceLoader::determineRevalida
         return Reload;
     }
 
-    // FIXME: Currently, all CachedRawResources are always reloaded. Some of them should be cacheable.
-    if (existingResource->type() == CachedResource::RawResource)
+    if (existingResource->type() == CachedResource::RawResource && !static_cast<CachedRawResource*>(existingResource)->canReuse())
+         return Reload;
+
+    // Certain requests (e.g., XHRs) might have manually set headers that require revalidation.
+    // FIXME: In theory, this should be a Revalidate case. In practice, the MemoryCache revalidation path assumes a whole bunch
+    // of things about how revalidation works that manual headers violate, so punt to Reload instead.
+    if (request.isConditional())
+        return Reload;
+
+    // Re-using resources in the case of a Range header is very simple if the headers are identical and
+    // much tougher if they aren't.
+    if (existingResource->resourceRequest().httpHeaderField("Range") != request.httpHeaderField("Range"))
         return Reload;
     
     // Don't reload resources while pasting.
diff --git a/Source/WebCore/loader/cache/CachedSVGDocument.cpp b/Source/WebCore/loader/cache/CachedSVGDocument.cpp
new file mode 100755
index 000000000..f03fadb57
--- /dev/null
+++ b/Source/WebCore/loader/cache/CachedSVGDocument.cpp
@@ -0,0 +1,77 @@
+/*
+    Copyright (C) 2010 Rob Buis <rwlbuis@gmail.com>
+    Copyright (C) 2011 Cosmin Truta <ctruta@gmail.com>
+    Copyright (C) 2012 University of Szeged
+    Copyright (C) 2012 Renata Hodovan <reni@webkit.org>
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#include "config.h"
+
+#if ENABLE(SVG)
+#include "CachedSVGDocument.h"
+
+#include "CachedResourceClient.h"
+#include "CachedResourceHandle.h"
+#include "SharedBuffer.h"
+#include <wtf/text/StringBuilder.h>
+
+namespace WebCore {
+
+CachedSVGDocument::CachedSVGDocument(const ResourceRequest& request)
+    : CachedResource(request, SVGDocumentResource)
+    , m_decoder(TextResourceDecoder::create("application/xml"))
+{
+    setAccept("image/svg+xml");
+}
+
+CachedSVGDocument::~CachedSVGDocument()
+{
+}
+
+void CachedSVGDocument::setEncoding(const String& chs)
+{
+    m_decoder->setEncoding(chs, TextResourceDecoder::EncodingFromHTTPHeader);
+}
+
+String CachedSVGDocument::encoding() const
+{
+    return m_decoder->encoding().name();
+}
+
+void CachedSVGDocument::data(PassRefPtr<SharedBuffer> data, bool allDataReceived)
+{
+    if (!allDataReceived)
+        return;
+
+    if (data) {
+        StringBuilder decodedText;
+        decodedText.append(m_decoder->decode(data->data(), data->size()));
+        decodedText.append(m_decoder->flush());
+        // We don't need to create a new frame because the new document belongs to the parent UseElement.
+        m_document = SVGDocument::create(0, response().url());
+        m_document->setContent(decodedText.toString());
+    }
+
+    setLoading(false);
+    checkNotify();
+}
+
+}
+
+#endif
+
diff --git a/Source/WebCore/loader/cache/CachedSVGDocument.h b/Source/WebCore/loader/cache/CachedSVGDocument.h
new file mode 100755
index 000000000..84389ed51
--- /dev/null
+++ b/Source/WebCore/loader/cache/CachedSVGDocument.h
@@ -0,0 +1,62 @@
+/*
+    Copyright (C) 2010 Rob Buis <rwlbuis@gmail.com>
+    Copyright (C) 2011 Cosmin Truta <ctruta@gmail.com>
+    Copyright (C) 2012 University of Szeged
+    Copyright (C) 2012 Renata Hodovan <reni@webkit.org>
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#ifndef CachedSVGDocument_h
+#define CachedSVGDocument_h
+
+#if ENABLE(SVG)
+#include "CachedResource.h"
+#include "CachedResourceClient.h"
+#include "CachedResourceHandle.h"
+#include "SVGDocument.h"
+#include "TextResourceDecoder.h"
+
+namespace WebCore {
+
+class CachedSVGDocument : public CachedResource {
+public:
+    explicit CachedSVGDocument(const ResourceRequest&);
+    virtual ~CachedSVGDocument();
+
+    SVGDocument* document() const { return m_document.get(); }
+
+    virtual void setEncoding(const String&);
+    virtual String encoding() const;
+    virtual void data(PassRefPtr<SharedBuffer> data, bool allDataReceived);
+
+protected:
+    RefPtr<SVGDocument> m_document;
+    RefPtr<TextResourceDecoder> m_decoder;
+};
+
+class CachedSVGDocumentClient : public CachedResourceClient {
+public:
+    virtual ~CachedSVGDocumentClient() { }
+    static CachedResourceClientType expectedType() { return SVGDocumentType; }
+    virtual CachedResourceClientType resourceClientType() { return expectedType(); }
+};
+
+}
+
+#endif
+
+#endif // CachedSVGDocument_h
diff --git a/Source/WebCore/loader/icon/IconDatabase.cpp b/Source/WebCore/loader/icon/IconDatabase.cpp
index a8507a97d..5ae8005c0 100644
--- a/Source/WebCore/loader/icon/IconDatabase.cpp
+++ b/Source/WebCore/loader/icon/IconDatabase.cpp
@@ -156,7 +156,7 @@ void IconDatabase::close()
         wakeSyncThread();
         
         // Wait for the sync thread to terminate
-        waitForThreadCompletion(m_syncThread, 0);
+        waitForThreadCompletion(m_syncThread);
     }
 
     m_syncThreadRunning = false;    
@@ -949,14 +949,14 @@ bool IconDatabase::shouldStopThreadActivity() const
     return m_threadTerminationRequested || m_removeIconsRequested;
 }
 
-void* IconDatabase::iconDatabaseSyncThreadStart(void* vIconDatabase)
+void IconDatabase::iconDatabaseSyncThreadStart(void* vIconDatabase)
 {    
     IconDatabase* iconDB = static_cast<IconDatabase*>(vIconDatabase);
     
-    return iconDB->iconDatabaseSyncThread();
+    iconDB->iconDatabaseSyncThread();
 }
 
-void* IconDatabase::iconDatabaseSyncThread()
+void IconDatabase::iconDatabaseSyncThread()
 {
     // The call to create this thread might not complete before the thread actually starts, so we might fail this ASSERT_ICON_SYNC_THREAD() because the pointer 
     // to our thread structure hasn't been filled in yet.
@@ -988,12 +988,14 @@ void* IconDatabase::iconDatabaseSyncThread()
         MutexLocker locker(m_syncLock);
         if (!m_syncDB.open(m_completeDatabasePath)) {
             LOG_ERROR("Unable to open icon database at path %s - %s", m_completeDatabasePath.ascii().data(), m_syncDB.lastErrorMsg());
-            return 0;
+            return;
         }
     }
     
-    if (shouldStopThreadActivity())
-        return syncThreadMainLoop();
+    if (shouldStopThreadActivity()) {
+        syncThreadMainLoop();
+        return;
+    }
         
 #if !LOG_DISABLED
     double timeStamp = currentTime();
@@ -1001,8 +1003,10 @@ void* IconDatabase::iconDatabaseSyncThread()
 #endif    
 
     performOpenInitialization();
-    if (shouldStopThreadActivity())
-        return syncThreadMainLoop();
+    if (shouldStopThreadActivity()) {
+        syncThreadMainLoop();
+        return;
+    }
         
 #if !LOG_DISABLED
     double newStamp = currentTime();
@@ -1024,8 +1028,10 @@ void* IconDatabase::iconDatabaseSyncThread()
             importTransaction.rollback();
         }
         
-        if (shouldStopThreadActivity())
-            return syncThreadMainLoop();
+        if (shouldStopThreadActivity()) {
+            syncThreadMainLoop();
+            return;
+        }
             
 #if !LOG_DISABLED
         newStamp = currentTime();
@@ -1041,8 +1047,10 @@ void* IconDatabase::iconDatabaseSyncThread()
     LOG(IconDatabase, "(THREAD) Starting iconURL import");
     performURLImport();
     
-    if (shouldStopThreadActivity())
-        return syncThreadMainLoop();
+    if (shouldStopThreadActivity()) {
+        syncThreadMainLoop();
+        return;
+    }
 
 #if !LOG_DISABLED
     newStamp = currentTime();
@@ -1050,7 +1058,7 @@ void* IconDatabase::iconDatabaseSyncThread()
 #endif 
 
     LOG(IconDatabase, "(THREAD) Beginning sync");
-    return syncThreadMainLoop();
+    syncThreadMainLoop();
 }
 
 static int databaseVersionNumber(SQLiteDatabase& db)
@@ -1348,7 +1356,7 @@ void IconDatabase::performURLImport()
     callOnMainThread(notifyPendingLoadDecisionsOnMainThread, this);
 }
 
-void* IconDatabase::syncThreadMainLoop()
+void IconDatabase::syncThreadMainLoop()
 {
     ASSERT_ICON_SYNC_THREAD();
 
@@ -1461,8 +1469,6 @@ void* IconDatabase::syncThreadMainLoop()
         MutexLocker locker(m_syncLock);
         m_disabledSuddenTerminationForSyncThread = false;
     }
-
-    return 0;
 }
 
 bool IconDatabase::readFromDatabase()
diff --git a/Source/WebCore/loader/icon/IconDatabase.h b/Source/WebCore/loader/icon/IconDatabase.h
index 7ab08416f..f4abb8b13 100644
--- a/Source/WebCore/loader/icon/IconDatabase.h
+++ b/Source/WebCore/loader/icon/IconDatabase.h
@@ -183,15 +183,15 @@ public:
     virtual bool shouldStopThreadActivity() const;
 
 private:    
-    static void* iconDatabaseSyncThreadStart(void *);
-    void* iconDatabaseSyncThread();
+    static void iconDatabaseSyncThreadStart(void *);
+    void iconDatabaseSyncThread();
     
     // The following block of methods are called exclusively by the sync thread to manage i/o to and from the database
     // Each method should periodically monitor m_threadTerminationRequested when it makes sense to return early on shutdown
     void performOpenInitialization();
     bool checkIntegrity();
     void performURLImport();
-    void* syncThreadMainLoop();
+    void syncThreadMainLoop();
     bool readFromDatabase();
     bool writeToDatabase();
     void pruneUnretainedIcons();
diff --git a/Source/WebCore/mathml/MathMLElement.cpp b/Source/WebCore/mathml/MathMLElement.cpp
index 830ad45d0..4c00defa3 100644
--- a/Source/WebCore/mathml/MathMLElement.cpp
+++ b/Source/WebCore/mathml/MathMLElement.cpp
@@ -48,33 +48,42 @@ PassRefPtr<MathMLElement> MathMLElement::create(const QualifiedName& tagName, Do
     return adoptRef(new MathMLElement(tagName, document));
 }
 
-void MathMLElement::parseAttribute(Attribute* attr)
+bool MathMLElement::isPresentationAttribute(Attribute* attr) const
+{
+    if (attr->name() == mathbackgroundAttr || attr->name() == mathsizeAttr || attr->name() == mathcolorAttr || attr->name() == fontsizeAttr || attr->name() == backgroundAttr || attr->name() == colorAttr || attr->name() == fontstyleAttr || attr->name() == fontweightAttr || attr->name() == fontfamilyAttr)
+        return true;
+    return StyledElement::isPresentationAttribute(attr);
+}
+
+void MathMLElement::collectStyleForAttribute(Attribute* attr, StylePropertySet* style)
 {
     if (attr->name() == mathbackgroundAttr)
-        addCSSProperty(CSSPropertyBackgroundColor, attr->value());
+        addPropertyToAttributeStyle(style, CSSPropertyBackgroundColor, attr->value());
     else if (attr->name() == mathsizeAttr) {
         // The following three values of mathsize are handled in WebCore/css/mathml.css
         if (attr->value() != "normal" && attr->value() != "small" && attr->value() != "big")
-            addCSSProperty(CSSPropertyFontSize, attr->value());
+            addPropertyToAttributeStyle(style, CSSPropertyFontSize, attr->value());
     } else if (attr->name() == mathcolorAttr)
-        addCSSProperty(CSSPropertyColor, attr->value());
+        addPropertyToAttributeStyle(style, CSSPropertyColor, attr->value());
     // FIXME: deprecated attributes that should loose in a conflict with a non deprecated attribute
     else if (attr->name() == fontsizeAttr)
-        addCSSProperty(CSSPropertyFontSize, attr->value());
+        addPropertyToAttributeStyle(style, CSSPropertyFontSize, attr->value());
     else if (attr->name() == backgroundAttr)
-        addCSSProperty(CSSPropertyBackgroundColor, attr->value());
+        addPropertyToAttributeStyle(style, CSSPropertyBackgroundColor, attr->value());
     else if (attr->name() == colorAttr)
-        addCSSProperty(CSSPropertyColor, attr->value());
+        addPropertyToAttributeStyle(style, CSSPropertyColor, attr->value());
     else if (attr->name() == fontstyleAttr)
-        addCSSProperty(CSSPropertyFontStyle, attr->value());
+        addPropertyToAttributeStyle(style, CSSPropertyFontStyle, attr->value());
     else if (attr->name() == fontweightAttr)
-        addCSSProperty(CSSPropertyFontWeight, attr->value());
+        addPropertyToAttributeStyle(style, CSSPropertyFontWeight, attr->value());
     else if (attr->name() == fontfamilyAttr)
-        addCSSProperty(CSSPropertyFontFamily, attr->value());
-    else
-        StyledElement::parseAttribute(attr);
+        addPropertyToAttributeStyle(style, CSSPropertyFontFamily, attr->value());
+    else {
+        ASSERT(!isPresentationAttribute(attr));
+        StyledElement::collectStyleForAttribute(attr, style);
+    }
 }
-    
+
 }
 
 #endif // ENABLE(MATHML)
diff --git a/Source/WebCore/mathml/MathMLElement.h b/Source/WebCore/mathml/MathMLElement.h
index 201f0835c..4b092513f 100644
--- a/Source/WebCore/mathml/MathMLElement.h
+++ b/Source/WebCore/mathml/MathMLElement.h
@@ -42,7 +42,8 @@ protected:
 
 private:    
     virtual bool isMathMLElement() const { return true; }
-    virtual void parseAttribute(Attribute*) OVERRIDE;
+    virtual bool isPresentationAttribute(Attribute*) const OVERRIDE;
+    virtual void collectStyleForAttribute(Attribute*, StylePropertySet*) OVERRIDE;
 };
     
 }
diff --git a/Source/WebCore/mediastream/DOMWindowMediaStream.idl b/Source/WebCore/mediastream/DOMWindowMediaStream.idl
new file mode 100644
index 000000000..589878abe
--- /dev/null
+++ b/Source/WebCore/mediastream/DOMWindowMediaStream.idl
@@ -0,0 +1,30 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ */
+
+module window {
+
+    interface [
+        Conditional=MEDIA_STREAM,
+        Supplemental=DOMWindow
+    ] DOMWindowMediaStream {
+        attribute [V8EnabledAtRuntime] PeerConnectionConstructor webkitPeerConnection;
+        attribute MediaStreamEventConstructor MediaStreamEvent;
+    };
+
+}
diff --git a/Source/WebCore/mediastream/LocalMediaStream.idl b/Source/WebCore/mediastream/LocalMediaStream.idl
index 29d97215a..49360fff2 100644
--- a/Source/WebCore/mediastream/LocalMediaStream.idl
+++ b/Source/WebCore/mediastream/LocalMediaStream.idl
@@ -28,7 +28,7 @@ module core {
         Conditional=MEDIA_STREAM,
         JSGenerateToNativeObject,
         EventTarget,
-        JSGenerateToJS
+        JSGenerateToJSObject
     ] LocalMediaStream : MediaStream {
         void stop();
     };
diff --git a/Source/WebCore/mediastream/MediaStreamTrack.cpp b/Source/WebCore/mediastream/MediaStreamTrack.cpp
index 4fb93acdf..c34efa5f2 100644
--- a/Source/WebCore/mediastream/MediaStreamTrack.cpp
+++ b/Source/WebCore/mediastream/MediaStreamTrack.cpp
@@ -81,6 +81,9 @@ void MediaStreamTrack::setEnabled(bool enabled)
 
     m_component->setEnabled(enabled);
 
+    if (m_streamDescriptor->ended())
+        return;    
+
     MediaStreamCenter::instance().didSetMediaStreamTrackEnabled(m_streamDescriptor.get(), m_component.get());
 }
 
diff --git a/Source/WebCore/mediastream/NavigatorMediaStream.cpp b/Source/WebCore/mediastream/NavigatorMediaStream.cpp
new file mode 100644
index 000000000..204d6e3b7
--- /dev/null
+++ b/Source/WebCore/mediastream/NavigatorMediaStream.cpp
@@ -0,0 +1,73 @@
+/*
+ * Copyright (C) 2012, Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+ * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+ * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH
+ * DAMAGE.
+ */
+
+#include "config.h"
+#include "NavigatorMediaStream.h"
+
+#if ENABLE(MEDIA_STREAM)
+
+#include "Document.h"
+#include "ExceptionCode.h"
+#include "Frame.h"
+#include "Navigator.h"
+#include "NavigatorUserMediaErrorCallback.h"
+#include "NavigatorUserMediaSuccessCallback.h"
+#include "Page.h"
+#include "UserMediaController.h"
+#include "UserMediaRequest.h"
+
+namespace WebCore {
+
+NavigatorMediaStream::NavigatorMediaStream()
+{
+}
+
+NavigatorMediaStream::~NavigatorMediaStream()
+{
+}
+
+void NavigatorMediaStream::webkitGetUserMedia(Navigator* navigator, const String& options, PassRefPtr<NavigatorUserMediaSuccessCallback> successCallback, PassRefPtr<NavigatorUserMediaErrorCallback> errorCallback, ExceptionCode& ec)
+{
+    if (!successCallback)
+        return;
+
+    UserMediaController* userMedia = UserMediaController::from(navigator->frame());
+    if (!userMedia) {
+        ec = NOT_SUPPORTED_ERR;
+        return;
+    }
+
+    RefPtr<UserMediaRequest> request = UserMediaRequest::create(navigator->frame()->document(), userMedia, options, successCallback, errorCallback);
+    if (!request) {
+        ec = NOT_SUPPORTED_ERR;
+        return;
+    }
+
+    request->start();
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(MEDIA_STREAM)
diff --git a/Source/WebCore/mediastream/NavigatorMediaStream.h b/Source/WebCore/mediastream/NavigatorMediaStream.h
new file mode 100644
index 000000000..b7b01fa52
--- /dev/null
+++ b/Source/WebCore/mediastream/NavigatorMediaStream.h
@@ -0,0 +1,55 @@
+/*
+ * Copyright (C) 2012, Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+ * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+ * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH
+ * DAMAGE.
+ */
+
+#ifndef NavigatorMediaStream_h
+#define NavigatorMediaStream_h
+
+#if ENABLE(MEDIA_STREAM)
+
+#include <wtf/PassRefPtr.h>
+#include <wtf/text/WTFString.h>
+
+namespace WebCore {
+
+class Navigator;
+class NavigatorUserMediaErrorCallback;
+class NavigatorUserMediaSuccessCallback;
+
+typedef int ExceptionCode;
+
+class NavigatorMediaStream {
+public:
+    static void webkitGetUserMedia(Navigator*, const String& options, PassRefPtr<NavigatorUserMediaSuccessCallback>, PassRefPtr<NavigatorUserMediaErrorCallback>, ExceptionCode&);
+
+private:
+    NavigatorMediaStream();
+    ~NavigatorMediaStream();
+};
+
+} // namespace WebCore
+
+#endif // ENABLE(MEDIA_STREAM)
+
+#endif // NavigatorMediaStream_h
diff --git a/Source/WebCore/mediastream/NavigatorMediaStream.idl b/Source/WebCore/mediastream/NavigatorMediaStream.idl
new file mode 100644
index 000000000..84e062e64
--- /dev/null
+++ b/Source/WebCore/mediastream/NavigatorMediaStream.idl
@@ -0,0 +1,32 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ */
+
+module window {
+
+    interface [
+        Conditional=MEDIA_STREAM,
+        Supplemental=Navigator
+    ] NavigatorMediaStream {
+        [V8EnabledAtRuntime] void webkitGetUserMedia(in DOMString options,
+                                                     in [Callback] NavigatorUserMediaSuccessCallback successCallback,
+                                                     in [Callback, Optional] NavigatorUserMediaErrorCallback errorCallback)
+            raises(DOMException);
+    };
+
+}
diff --git a/Source/WebCore/mediastream/NavigatorUserMediaErrorCallback.idl b/Source/WebCore/mediastream/NavigatorUserMediaErrorCallback.idl
index 66748cd48..44928f81f 100644
--- a/Source/WebCore/mediastream/NavigatorUserMediaErrorCallback.idl
+++ b/Source/WebCore/mediastream/NavigatorUserMediaErrorCallback.idl
@@ -25,7 +25,7 @@
 module window {
     interface [
         Conditional=MEDIA_STREAM,
-        Callback=FunctionOnly
+        Callback
     ] NavigatorUserMediaErrorCallback {
         boolean handleEvent(in NavigatorUserMediaError error);
     };
diff --git a/Source/WebCore/mediastream/NavigatorUserMediaSuccessCallback.idl b/Source/WebCore/mediastream/NavigatorUserMediaSuccessCallback.idl
index 3938e73c7..0a661807b 100644
--- a/Source/WebCore/mediastream/NavigatorUserMediaSuccessCallback.idl
+++ b/Source/WebCore/mediastream/NavigatorUserMediaSuccessCallback.idl
@@ -25,7 +25,7 @@
 module window {
     interface [
         Conditional=MEDIA_STREAM,
-        Callback=FunctionOnly
+        Callback
     ] NavigatorUserMediaSuccessCallback {
         boolean handleEvent(in LocalMediaStream stream);
     };
diff --git a/Source/WebCore/mediastream/PeerConnection.cpp b/Source/WebCore/mediastream/PeerConnection.cpp
index 11944823b..4dd3bf0da 100644
--- a/Source/WebCore/mediastream/PeerConnection.cpp
+++ b/Source/WebCore/mediastream/PeerConnection.cpp
@@ -41,6 +41,7 @@ PassRefPtr<PeerConnection> PeerConnection::create(ScriptExecutionContext* contex
     RefPtr<PeerConnection> connection = adoptRef(new PeerConnection(context, serverConfiguration, signalingCallback));
     connection->setPendingActivity(connection.get());
     connection->scheduleInitialNegotiation();
+    connection->suspendIfNeeded();
 
     return connection.release();
 }
@@ -55,7 +56,7 @@ PeerConnection::PeerConnection(ScriptExecutionContext* context, const String& se
     , m_initialNegotiationTimer(this, &PeerConnection::initialNegotiationTimerFired)
     , m_streamChangeTimer(this, &PeerConnection::streamChangeTimerFired)
     , m_readyStateChangeTimer(this, &PeerConnection::readyStateChangeTimerFired)
-    , m_peerHandler(PeerConnectionHandler::create(this, serverConfiguration, context->securityOrigin()))
+    , m_peerHandler(PeerConnectionHandler::create(this, serverConfiguration, context->securityOrigin()->toString()))
 {
 }
 
diff --git a/Source/WebCore/mediastream/PeerConnection.idl b/Source/WebCore/mediastream/PeerConnection.idl
index afaebd705..7760d10ce 100644
--- a/Source/WebCore/mediastream/PeerConnection.idl
+++ b/Source/WebCore/mediastream/PeerConnection.idl
@@ -28,7 +28,7 @@ module p2p {
         Conditional=MEDIA_STREAM,
         ActiveDOMObject,
         ConstructorParameters=2,
-        Constructor(in DOMString serverConfiguration, in [Callback=FunctionOnly] SignalingCallback signalingCallback),
+        Constructor(in DOMString serverConfiguration, in [Callback] SignalingCallback signalingCallback),
         CallWith=ScriptExecutionContext,
         JSCustomConstructor,
         EventTarget
diff --git a/Source/WebCore/mediastream/SignalingCallback.idl b/Source/WebCore/mediastream/SignalingCallback.idl
index 0d32fcf0e..e2e0cebd2 100644
--- a/Source/WebCore/mediastream/SignalingCallback.idl
+++ b/Source/WebCore/mediastream/SignalingCallback.idl
@@ -26,7 +26,7 @@ module p2p {
 
     interface [
         Conditional=MEDIA_STREAM,
-        Callback=FunctionOnly
+        Callback
     ] SignalingCallback {
         boolean handleEvent(in DOMString message, in PeerConnection source);
     };
diff --git a/Source/WebCore/mediastream/UserMediaClient.h b/Source/WebCore/mediastream/UserMediaClient.h
index c8e2952ff..744711e42 100644
--- a/Source/WebCore/mediastream/UserMediaClient.h
+++ b/Source/WebCore/mediastream/UserMediaClient.h
@@ -38,6 +38,8 @@
 
 namespace WebCore {
 
+class Page;
+
 class UserMediaClient {
 public:
     virtual void pageDestroyed() = 0;
@@ -49,6 +51,8 @@ protected:
     virtual ~UserMediaClient() { }
 };
 
+void provideUserMediaTo(Page*, UserMediaClient*);
+
 } // namespace WebCore
 
 #endif // ENABLE(MEDIA_STREAM)
diff --git a/Source/WebCore/bindings/v8/custom/V8NavigatorCustom.cpp b/Source/WebCore/mediastream/UserMediaController.cpp
index dccb00581..3b4dd14e9 100644
--- a/Source/WebCore/bindings/v8/custom/V8NavigatorCustom.cpp
+++ b/Source/WebCore/mediastream/UserMediaController.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2011 Google Inc. All rights reserved.
+ * Copyright (C) 2012 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -23,44 +23,36 @@
  */
 
 #include "config.h"
-#include "V8Navigator.h"
+#include "UserMediaController.h"
 
 #if ENABLE(MEDIA_STREAM)
 
-#include "ExceptionCode.h"
-#include "Navigator.h"
-#include "V8Binding.h"
-#include "V8NavigatorUserMediaErrorCallback.h"
-#include "V8NavigatorUserMediaSuccessCallback.h"
-#include "V8Utilities.h"
-
-using namespace WTF;
-
 namespace WebCore {
 
-v8::Handle<v8::Value> V8Navigator::webkitGetUserMediaCallback(const v8::Arguments& args)
+const AtomicString& UserMediaController::supplementName()
 {
-    INC_STATS("DOM.Navigator.webkitGetUserMedia()");
+    DEFINE_STATIC_LOCAL(AtomicString, name, ("UserMediaController"));
+    return name;
+}
 
-    v8::TryCatch exceptionCatcher;
-    v8::Handle<v8::String> options = args[0]->ToString();
-    if (exceptionCatcher.HasCaught())
-        return throwError(exceptionCatcher.Exception());
+UserMediaController::UserMediaController(UserMediaClient* client)
+    : m_client(client)
+{
+}
 
-    bool succeeded = false;
-    RefPtr<NavigatorUserMediaSuccessCallback> successCallback = createFunctionOnlyCallback<V8NavigatorUserMediaSuccessCallback>(args[1], succeeded);
-    if (!succeeded)
-        return v8::Undefined();
+UserMediaController::~UserMediaController()
+{
+    m_client->pageDestroyed();
+}
 
-    // Argument is optional, hence undefined is allowed.
-    RefPtr<NavigatorUserMediaErrorCallback> errorCallback = createFunctionOnlyCallback<V8NavigatorUserMediaErrorCallback>(args[2], succeeded, CallbackAllowUndefined);
-    if (!succeeded)
-        return v8::Undefined();
+PassOwnPtr<UserMediaController> UserMediaController::create(UserMediaClient* client)
+{
+    return adoptPtr(new UserMediaController(client));
+}
 
-    ExceptionCode ec = 0;
-    Navigator* navigator = V8Navigator::toNative(args.Holder());
-    navigator->webkitGetUserMedia(toWebCoreString(options), successCallback.release(), errorCallback.release(), ec);
-    return throwError(ec);
+void provideUserMediaTo(Page* page, UserMediaClient* client)
+{
+    PageSupplement::provideTo(page, UserMediaController::supplementName(), UserMediaController::create(client));
 }
 
 } // namespace WebCore
diff --git a/Source/WebCore/mediastream/UserMediaController.h b/Source/WebCore/mediastream/UserMediaController.h
new file mode 100644
index 000000000..6b0590ecf
--- /dev/null
+++ b/Source/WebCore/mediastream/UserMediaController.h
@@ -0,0 +1,73 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef UserMediaController_h
+#define UserMediaController_h
+
+#if ENABLE(MEDIA_STREAM)
+
+#include "PageSupplement.h"
+#include "UserMediaClient.h"
+#include <wtf/PassOwnPtr.h>
+
+namespace WebCore {
+
+class Frame;
+class Page;
+
+class UserMediaController : public PageSupplement {
+public:
+    ~UserMediaController();
+
+    UserMediaClient* client() const { return m_client; }
+    void requestUserMedia(PassRefPtr<UserMediaRequest>, const MediaStreamSourceVector& audioSources,  const MediaStreamSourceVector& videoSources);
+    void cancelUserMediaRequest(UserMediaRequest*);
+
+    static PassOwnPtr<UserMediaController> create(UserMediaClient*);
+    static const AtomicString& supplementName();
+    static UserMediaController* from(Frame* frame) { return static_cast<UserMediaController*>(PageSupplement::from(frame, supplementName())); }
+    static UserMediaController* from(Page* page) { return static_cast<UserMediaController*>(PageSupplement::from(page, supplementName())); }
+
+protected:
+    UserMediaController(UserMediaClient*);
+
+private:
+    UserMediaClient* m_client;
+};
+
+inline void UserMediaController::requestUserMedia(PassRefPtr<UserMediaRequest> request, const MediaStreamSourceVector& audioSources,  const MediaStreamSourceVector& videoSources)
+{
+    m_client->requestUserMedia(request, audioSources, videoSources);
+}
+
+inline void UserMediaController::cancelUserMediaRequest(UserMediaRequest* request)
+{
+    m_client->cancelUserMediaRequest(request);
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(MEDIA_STREAM)
+
+#endif // UserMediaController_h
diff --git a/Source/WebCore/mediastream/UserMediaRequest.cpp b/Source/WebCore/mediastream/UserMediaRequest.cpp
index faf3d4d4f..3f3c9efe1 100644
--- a/Source/WebCore/mediastream/UserMediaRequest.cpp
+++ b/Source/WebCore/mediastream/UserMediaRequest.cpp
@@ -36,26 +36,26 @@
 
 #include "LocalMediaStream.h"
 #include "SpaceSplitString.h"
-#include "UserMediaClient.h"
+#include "UserMediaController.h"
 
 namespace WebCore {
 
-PassRefPtr<UserMediaRequest> UserMediaRequest::create(ScriptExecutionContext* context, UserMediaClient* client, const String& options, PassRefPtr<NavigatorUserMediaSuccessCallback> successCallback, PassRefPtr<NavigatorUserMediaErrorCallback> errorCallback)
+PassRefPtr<UserMediaRequest> UserMediaRequest::create(ScriptExecutionContext* context, UserMediaController* controller, const String& options, PassRefPtr<NavigatorUserMediaSuccessCallback> successCallback, PassRefPtr<NavigatorUserMediaErrorCallback> errorCallback)
 {
-    RefPtr<UserMediaRequest> request = adoptRef(new UserMediaRequest(context, client, options, successCallback, errorCallback));
+    RefPtr<UserMediaRequest> request = adoptRef(new UserMediaRequest(context, controller, options, successCallback, errorCallback));
     if (!request->audio() && !request->video())
         return 0;
 
     return request.release();
 }
 
-UserMediaRequest::UserMediaRequest(ScriptExecutionContext* context, UserMediaClient* client, const String& options, PassRefPtr<NavigatorUserMediaSuccessCallback> successCallback, PassRefPtr<NavigatorUserMediaErrorCallback> errorCallback)
+UserMediaRequest::UserMediaRequest(ScriptExecutionContext* context, UserMediaController* controller, const String& options, PassRefPtr<NavigatorUserMediaSuccessCallback> successCallback, PassRefPtr<NavigatorUserMediaErrorCallback> errorCallback)
     : ContextDestructionObserver(context)
     , m_audio(false)
     , m_video(false)
     , m_cameraPreferenceUser(false)
     , m_cameraPreferenceEnvironment(false)
-    , m_client(client)
+    , m_controller(controller)
     , m_successCallback(successCallback)
     , m_errorCallback(errorCallback)
 {
@@ -73,8 +73,8 @@ void UserMediaRequest::start()
 
 void UserMediaRequest::didCompleteQuery(const MediaStreamSourceVector& audioSources, const MediaStreamSourceVector& videoSources)
 {
-    if (m_client)
-        m_client->requestUserMedia(this, audioSources, videoSources);
+    if (m_controller)
+        m_controller->requestUserMedia(this, audioSources, videoSources);
 }
 
 void UserMediaRequest::succeed(const MediaStreamSourceVector& audioSources, const MediaStreamSourceVector& videoSources)
@@ -99,9 +99,9 @@ void UserMediaRequest::fail()
 
 void UserMediaRequest::contextDestroyed()
 {
-    if (m_client) {
-        m_client->cancelUserMediaRequest(this);
-        m_client = 0;
+    if (m_controller) {
+        m_controller->cancelUserMediaRequest(this);
+        m_controller = 0;
     }
 
     ContextDestructionObserver::contextDestroyed();
diff --git a/Source/WebCore/mediastream/UserMediaRequest.h b/Source/WebCore/mediastream/UserMediaRequest.h
index a71b5e93f..6af31f30b 100644
--- a/Source/WebCore/mediastream/UserMediaRequest.h
+++ b/Source/WebCore/mediastream/UserMediaRequest.h
@@ -44,11 +44,11 @@
 
 namespace WebCore {
 
-class UserMediaClient;
+class UserMediaController;
 
 class UserMediaRequest : public MediaStreamSourcesQueryClient, public ContextDestructionObserver {
 public:
-    static PassRefPtr<UserMediaRequest> create(ScriptExecutionContext*, UserMediaClient*, const String& options, PassRefPtr<NavigatorUserMediaSuccessCallback>, PassRefPtr<NavigatorUserMediaErrorCallback>);
+    static PassRefPtr<UserMediaRequest> create(ScriptExecutionContext*, UserMediaController*, const String& options, PassRefPtr<NavigatorUserMediaSuccessCallback>, PassRefPtr<NavigatorUserMediaErrorCallback>);
     ~UserMediaRequest();
 
     NavigatorUserMediaSuccessCallback* successCallback() const { return m_successCallback.get(); }
@@ -70,7 +70,7 @@ public:
     virtual void contextDestroyed();
 
 private:
-    UserMediaRequest(ScriptExecutionContext*, UserMediaClient*, const String& options, PassRefPtr<NavigatorUserMediaSuccessCallback>, PassRefPtr<NavigatorUserMediaErrorCallback>);
+    UserMediaRequest(ScriptExecutionContext*, UserMediaController*, const String& options, PassRefPtr<NavigatorUserMediaSuccessCallback>, PassRefPtr<NavigatorUserMediaErrorCallback>);
 
     void parseOptions(const String& options);
 
@@ -80,7 +80,7 @@ private:
     bool m_cameraPreferenceUser;
     bool m_cameraPreferenceEnvironment;
 
-    UserMediaClient* m_client;
+    UserMediaController* m_controller;
 
     RefPtr<NavigatorUserMediaSuccessCallback> m_successCallback;
     RefPtr<NavigatorUserMediaErrorCallback> m_errorCallback;
diff --git a/Source/WebCore/notifications/Notification.cpp b/Source/WebCore/notifications/Notification.cpp
index d7991f2d9..74964dc77 100644
--- a/Source/WebCore/notifications/Notification.cpp
+++ b/Source/WebCore/notifications/Notification.cpp
@@ -102,12 +102,16 @@ Notification::~Notification()
 
 PassRefPtr<Notification> Notification::create(const KURL& url, ScriptExecutionContext* context, ExceptionCode& ec, PassRefPtr<NotificationCenter> provider) 
 { 
-    return adoptRef(new Notification(url, context, ec, provider));
+    RefPtr<Notification> notification(adoptRef(new Notification(url, context, ec, provider)));
+    notification->suspendIfNeeded();
+    return notification.release();
 }
 
 PassRefPtr<Notification> Notification::create(const NotificationContents& contents, ScriptExecutionContext* context, ExceptionCode& ec, PassRefPtr<NotificationCenter> provider) 
 { 
-    return adoptRef(new Notification(contents, context, ec, provider));
+    RefPtr<Notification> notification(adoptRef(new Notification(contents, context, ec, provider)));
+    notification->suspendIfNeeded();
+    return notification.release();
 }
 
 const AtomicString& Notification::interfaceName() const
diff --git a/Source/WebCore/notifications/NotificationCenter.cpp b/Source/WebCore/notifications/NotificationCenter.cpp
index 37ed5473c..71146af8d 100644
--- a/Source/WebCore/notifications/NotificationCenter.cpp
+++ b/Source/WebCore/notifications/NotificationCenter.cpp
@@ -41,6 +41,13 @@
 
 namespace WebCore {
 
+PassRefPtr<NotificationCenter> NotificationCenter::create(ScriptExecutionContext* context, NotificationPresenter* presenter)
+{
+    RefPtr<NotificationCenter> notificationCenter(adoptRef(new NotificationCenter(context, presenter)));
+    notificationCenter->suspendIfNeeded();
+    return notificationCenter.release();
+}
+
 NotificationCenter::NotificationCenter(ScriptExecutionContext* context, NotificationPresenter* presenter)
     : ActiveDOMObject(context, this)
     , m_notificationPresenter(presenter) {}
diff --git a/Source/WebCore/notifications/NotificationCenter.h b/Source/WebCore/notifications/NotificationCenter.h
index 23b31e031..402ccba93 100644
--- a/Source/WebCore/notifications/NotificationCenter.h
+++ b/Source/WebCore/notifications/NotificationCenter.h
@@ -50,7 +50,7 @@ class VoidCallback;
 
 class NotificationCenter : public RefCounted<NotificationCenter>, public ActiveDOMObject {
 public:
-    static PassRefPtr<NotificationCenter> create(ScriptExecutionContext* context, NotificationPresenter* presenter) { return adoptRef(new NotificationCenter(context, presenter)); }
+    static PassRefPtr<NotificationCenter> create(ScriptExecutionContext*, NotificationPresenter*);
 
     PassRefPtr<Notification> createHTMLNotification(const String& URI, ExceptionCode& ec)
     {
diff --git a/Source/WebCore/notifications/NotificationCenter.idl b/Source/WebCore/notifications/NotificationCenter.idl
index ed6d07929..8be1ecc76 100644
--- a/Source/WebCore/notifications/NotificationCenter.idl
+++ b/Source/WebCore/notifications/NotificationCenter.idl
@@ -37,9 +37,9 @@ module threads {
         OmitConstructor
     ] NotificationCenter {
 #if !defined(ENABLE_TEXT_NOTIFICATIONS_ONLY) || !ENABLE_TEXT_NOTIFICATIONS_ONLY
-       [V8Custom] Notification createHTMLNotification(in DOMString url) raises(Exception);
+       [V8Custom] Notification createHTMLNotification(in DOMString url) raises(DOMException);
 #endif
-       [V8Custom] Notification createNotification(in DOMString iconUrl, in DOMString title, in DOMString body) raises(Exception);
+       [V8Custom] Notification createNotification(in DOMString iconUrl, in DOMString title, in DOMString body) raises(DOMException);
 
        int checkPermission();
        [Custom] void requestPermission(in VoidCallback callback);
diff --git a/Source/WebCore/notifications/NotificationController.cpp b/Source/WebCore/notifications/NotificationController.cpp
index c86aa128c..cbdc3ea45 100644
--- a/Source/WebCore/notifications/NotificationController.cpp
+++ b/Source/WebCore/notifications/NotificationController.cpp
@@ -50,6 +50,24 @@ PassOwnPtr<NotificationController> NotificationController::create(Page* page, No
     return adoptPtr(new NotificationController(page, client));
 }
 
+NotificationPresenter* NotificationController::clientFrom(Page* page)
+{
+    if (NotificationController* controller = NotificationController::from(page))
+        return controller->client();
+    return 0;
+}
+
+const AtomicString& NotificationController::supplementName()
+{
+    DEFINE_STATIC_LOCAL(AtomicString, name, ("NotificationController"));
+    return name;
+}
+
+void provideNotification(Page* page, NotificationPresenter* client)
+{
+    PageSupplement::provideTo(page, NotificationController::supplementName(), NotificationController::create(page, client));
+}
+
 } // namespace WebCore
 
 #endif // ENABLE(NOTIFICATIONS)
diff --git a/Source/WebCore/notifications/NotificationController.h b/Source/WebCore/notifications/NotificationController.h
index a958a057a..33a95d516 100644
--- a/Source/WebCore/notifications/NotificationController.h
+++ b/Source/WebCore/notifications/NotificationController.h
@@ -28,6 +28,7 @@
 
 #if ENABLE(NOTIFICATIONS)
 
+#include "PageSupplement.h"
 #include <wtf/Forward.h>
 #include <wtf/Noncopyable.h>
 
@@ -36,12 +37,16 @@ namespace WebCore {
 class NotificationPresenter;
 class Page;
 
-class NotificationController {
+class NotificationController : public PageSupplement {
     WTF_MAKE_NONCOPYABLE(NotificationController);
 public:
     ~NotificationController();
 
     static PassOwnPtr<NotificationController> create(Page*, NotificationPresenter*);
+    static const AtomicString& supplementName();
+    static NotificationController* from(Frame* frame) { return static_cast<NotificationController*>(PageSupplement::from(frame, supplementName())); }
+    static NotificationController* from(Page* page) { return static_cast<NotificationController*>(PageSupplement::from(page, supplementName())); }
+    static NotificationPresenter* clientFrom(Page*);
 
     NotificationPresenter* client() { return m_client; }
     
diff --git a/Source/WebCore/notifications/NotificationPresenter.h b/Source/WebCore/notifications/NotificationPresenter.h
index 108f05583..1935384dc 100644
--- a/Source/WebCore/notifications/NotificationPresenter.h
+++ b/Source/WebCore/notifications/NotificationPresenter.h
@@ -40,6 +40,7 @@ namespace WebCore {
 class Document;
 class Notification;
 class KURL;
+class Page;
 class ScriptExecutionContext;
 
 class NotificationPresenter {
@@ -84,6 +85,8 @@ protected:
     virtual ~NotificationPresenter() { }
 };
 
+void provideNotification(Page*, NotificationPresenter*);
+
 } // namespace WebCore
 
 #endif // NotificationPresenter_h
diff --git a/Source/WebCore/page/Chrome.cpp b/Source/WebCore/page/Chrome.cpp
index 8c3b03264..5e0122ddd 100644
--- a/Source/WebCore/page/Chrome.cpp
+++ b/Source/WebCore/page/Chrome.cpp
@@ -445,16 +445,6 @@ void Chrome::print(Frame* frame)
     m_client->print(frame);
 }
 
-void Chrome::requestGeolocationPermissionForFrame(Frame* frame, Geolocation* geolocation)
-{
-    m_client->requestGeolocationPermissionForFrame(frame, geolocation);
-}
-
-void Chrome::cancelGeolocationPermissionRequestForFrame(Frame* frame, Geolocation* geolocation)
-{
-    m_client->cancelGeolocationPermissionRequestForFrame(frame, geolocation);
-}
-
 #if ENABLE(DIRECTORY_UPLOAD)
 void Chrome::enumerateChosenDirectory(FileChooser* fileChooser)
 {
diff --git a/Source/WebCore/page/Chrome.h b/Source/WebCore/page/Chrome.h
index d5b39bfe2..c6704c97a 100644
--- a/Source/WebCore/page/Chrome.h
+++ b/Source/WebCore/page/Chrome.h
@@ -149,11 +149,6 @@ namespace WebCore {
 
         void print(Frame*);
 
-        // FIXME: Remove once all ports are using client-based geolocation. https://bugs.webkit.org/show_bug.cgi?id=40373
-        // For client-based geolocation, these two methods have moved to GeolocationClient. https://bugs.webkit.org/show_bug.cgi?id=50061
-        void requestGeolocationPermissionForFrame(Frame*, Geolocation*);
-        void cancelGeolocationPermissionRequestForFrame(Frame*, Geolocation*);
-
 #if ENABLE(INPUT_COLOR)
         PassOwnPtr<ColorChooser> createColorChooser(ColorChooserClient*, const Color& initialColor);
 #endif
diff --git a/Source/WebCore/page/ChromeClient.h b/Source/WebCore/page/ChromeClient.h
index 486625a98..33b1c4b87 100644
--- a/Source/WebCore/page/ChromeClient.h
+++ b/Source/WebCore/page/ChromeClient.h
@@ -325,6 +325,7 @@ namespace WebCore {
         virtual bool shouldRunModalDialogDuringPageDismissal(const DialogType&, const String& dialogMessage, FrameLoader::PageDismissalType) const { UNUSED_PARAM(dialogMessage); return true; }
 
         virtual void numWheelEventHandlersChanged(unsigned) = 0;
+        virtual void numTouchEventHandlersChanged(unsigned) = 0;
         
         virtual bool isSVGImageChromeClient() const { return false; }
 
diff --git a/Source/WebCore/page/Console.cpp b/Source/WebCore/page/Console.cpp
index 24e13a5fd..fe0f0af7c 100644
--- a/Source/WebCore/page/Console.cpp
+++ b/Source/WebCore/page/Console.cpp
@@ -236,7 +236,7 @@ void Console::trace(PassRefPtr<ScriptArguments> arguments, PassRefPtr<ScriptCall
     }
 }
 
-void Console::assertCondition(bool condition, PassRefPtr<ScriptArguments> arguments, PassRefPtr<ScriptCallStack> callStack)
+void Console::assertCondition(PassRefPtr<ScriptArguments> arguments, PassRefPtr<ScriptCallStack> callStack, bool condition)
 {
     if (condition)
         return;
@@ -299,16 +299,14 @@ void Console::time(const String& title)
 {
     InspectorInstrumentation::startConsoleTiming(page(), title);
 #if PLATFORM(CHROMIUM)
-    if (PlatformSupport::isTraceEventEnabled())
-        PlatformSupport::traceEventBegin(title.utf8().data(), 0, 0);
+    TRACE_EVENT_COPY_BEGIN0("webkit", title.utf8().data());
 #endif
 }
 
-void Console::timeEnd(const String& title, PassRefPtr<ScriptArguments>, PassRefPtr<ScriptCallStack> callStack)
+void Console::timeEnd(PassRefPtr<ScriptArguments>, PassRefPtr<ScriptCallStack> callStack, const String& title)
 {
 #if PLATFORM(CHROMIUM)
-    if (PlatformSupport::isTraceEventEnabled())
-        PlatformSupport::traceEventEnd(title.utf8().data(), 0, 0);
+    TRACE_EVENT_COPY_END0("webkit", title.utf8().data());
 #endif
     InspectorInstrumentation::stopConsoleTiming(page(), title, callStack);
 }
diff --git a/Source/WebCore/page/Console.h b/Source/WebCore/page/Console.h
index f30d191a8..89e2955d6 100644
--- a/Source/WebCore/page/Console.h
+++ b/Source/WebCore/page/Console.h
@@ -66,7 +66,7 @@ public:
     void dir(PassRefPtr<ScriptArguments>, PassRefPtr<ScriptCallStack>);
     void dirxml(PassRefPtr<ScriptArguments>, PassRefPtr<ScriptCallStack>);
     void trace(PassRefPtr<ScriptArguments>, PassRefPtr<ScriptCallStack>);
-    void assertCondition(bool condition, PassRefPtr<ScriptArguments>, PassRefPtr<ScriptCallStack>);
+    void assertCondition(PassRefPtr<ScriptArguments>, PassRefPtr<ScriptCallStack>, bool condition);
     void count(PassRefPtr<ScriptArguments>, PassRefPtr<ScriptCallStack>);
     void markTimeline(PassRefPtr<ScriptArguments>, PassRefPtr<ScriptCallStack>);
 #if ENABLE(JAVASCRIPT_DEBUGGER)
@@ -75,7 +75,7 @@ public:
     void profileEnd(const String&, ScriptState*, PassRefPtr<ScriptCallStack>);
 #endif
     void time(const String&);
-    void timeEnd(const String&, PassRefPtr<ScriptArguments>, PassRefPtr<ScriptCallStack>);
+    void timeEnd(PassRefPtr<ScriptArguments>, PassRefPtr<ScriptCallStack>, const String&);
     void timeStamp(PassRefPtr<ScriptArguments>, PassRefPtr<ScriptCallStack>);
     void group(PassRefPtr<ScriptArguments>, PassRefPtr<ScriptCallStack>);
     void groupCollapsed(PassRefPtr<ScriptArguments>, PassRefPtr<ScriptCallStack>);
diff --git a/Source/WebCore/page/Console.idl b/Source/WebCore/page/Console.idl
index 42cd187f9..2defe3213 100644
--- a/Source/WebCore/page/Console.idl
+++ b/Source/WebCore/page/Console.idl
@@ -33,17 +33,17 @@ module window {
         OmitConstructor
     ] Console {
 
-        [CustomArgumentHandling] void debug();
-        [CustomArgumentHandling] void error();
-        [CustomArgumentHandling] void info();
-        [CustomArgumentHandling] void log();
-        [CustomArgumentHandling] void warn();
-        [CustomArgumentHandling] void dir();
-        [CustomArgumentHandling] void dirxml();
-        [V8Custom, CustomArgumentHandling] void trace();
-        [V8Custom, CustomArgumentHandling, ImplementedAs=assertCondition] void assert(in boolean condition);
-        [CustomArgumentHandling] void count();
-        [CustomArgumentHandling] void markTimeline();
+        [CallWith=ScriptArguments|CallStack] void debug();
+        [CallWith=ScriptArguments|CallStack] void error();
+        [CallWith=ScriptArguments|CallStack] void info();
+        [CallWith=ScriptArguments|CallStack] void log();
+        [CallWith=ScriptArguments|CallStack] void warn();
+        [CallWith=ScriptArguments|CallStack] void dir();
+        [CallWith=ScriptArguments|CallStack] void dirxml();
+        [V8Custom, CallWith=ScriptArguments|CallStack] void trace();
+        [V8Custom, CallWith=ScriptArguments|CallStack, ImplementedAs=assertCondition] void assert(in boolean condition);
+        [CallWith=ScriptArguments|CallStack] void count();
+        [CallWith=ScriptArguments|CallStack] void markTimeline();
 
 #if defined(ENABLE_JAVASCRIPT_DEBUGGER) && ENABLE_JAVASCRIPT_DEBUGGER
         readonly attribute [CustomGetter] Array profiles;
@@ -51,11 +51,11 @@ module window {
         [Custom] void profileEnd(in DOMString title);
 #endif
 
-        void time(in [TreatNullAs=NullString, TreatUndefinedAs=NullString,Optional=CallWithDefaultValue] DOMString title);
-        [CustomArgumentHandling] void timeEnd(in [TreatNullAs=NullString, TreatUndefinedAs=NullString] DOMString title);
-        [CustomArgumentHandling] void timeStamp();
-        [CustomArgumentHandling] void group();
-        [CustomArgumentHandling] void groupCollapsed();
+        void time(in [TreatNullAs=NullString, TreatUndefinedAs=NullString,Optional=DefaultIsUndefined] DOMString title);
+        [CallWith=ScriptArguments|CallStack] void timeEnd(in [TreatNullAs=NullString, TreatUndefinedAs=NullString] DOMString title);
+        [CallWith=ScriptArguments|CallStack] void timeStamp();
+        [CallWith=ScriptArguments|CallStack] void group();
+        [CallWith=ScriptArguments|CallStack] void groupCollapsed();
         void groupEnd();
 
         readonly attribute [V8CustomGetter] MemoryInfo memory;
diff --git a/Source/WebCore/page/ContextMenuController.cpp b/Source/WebCore/page/ContextMenuController.cpp
index a214352b2..98b29817f 100644
--- a/Source/WebCore/page/ContextMenuController.cpp
+++ b/Source/WebCore/page/ContextMenuController.cpp
@@ -983,7 +983,12 @@ void ContextMenuController::addInspectElementItem()
         return;
 
     ContextMenuItem InspectElementItem(ActionType, ContextMenuItemTagInspectElement, contextMenuItemTagInspectElement());
-    appendItem(*separatorItem(), m_contextMenu.get());
+#if USE(CROSS_PLATFORM_CONTEXT_MENUS)
+    if (!m_contextMenu->items().isEmpty())
+#else
+    if (m_contextMenu->itemCount())
+#endif
+        appendItem(*separatorItem(), m_contextMenu.get());
     appendItem(InspectElementItem, m_contextMenu.get());
 }
 #endif // ENABLE(INSPECTOR)
diff --git a/Source/WebCore/page/DOMSelection.idl b/Source/WebCore/page/DOMSelection.idl
index ccd30e375..cd4b5938a 100644
--- a/Source/WebCore/page/DOMSelection.idl
+++ b/Source/WebCore/page/DOMSelection.idl
@@ -43,8 +43,8 @@ module window {
         readonly attribute boolean isCollapsed;
         readonly attribute long rangeCount;
 
-        void collapse(in [Optional=CallWithDefaultValue] Node node, 
-                      in [Optional=CallWithDefaultValue] long index)
+        void collapse(in [Optional=DefaultIsUndefined] Node node, 
+                      in [Optional=DefaultIsUndefined] long index)
             raises(DOMException);
         void collapseToEnd()
             raises(DOMException);
@@ -52,19 +52,19 @@ module window {
             raises(DOMException);
 
         void deleteFromDocument();
-        boolean containsNode(in [Optional=CallWithDefaultValue] Node node, 
-                             in [Optional=CallWithDefaultValue] boolean allowPartial);
-        void selectAllChildren(in [Optional=CallWithDefaultValue] Node node)
+        boolean containsNode(in [Optional=DefaultIsUndefined] Node node, 
+                             in [Optional=DefaultIsUndefined] boolean allowPartial);
+        void selectAllChildren(in [Optional=DefaultIsUndefined] Node node)
             raises(DOMException);
 
-        void extend(in [Optional=CallWithDefaultValue] Node node, 
-                    in [Optional=CallWithDefaultValue] long offset)
+        void extend(in [Optional=DefaultIsUndefined] Node node, 
+                    in [Optional=DefaultIsUndefined] long offset)
             raises(DOMException);
 
-        Range getRangeAt(in [Optional=CallWithDefaultValue] long index)
+        Range getRangeAt(in [Optional=DefaultIsUndefined] long index)
             raises(DOMException);
         void removeAllRanges();
-        void addRange(in [Optional=CallWithDefaultValue] Range range);
+        void addRange(in [Optional=DefaultIsUndefined] Range range);
 
 #if defined(LANGUAGE_JAVASCRIPT) && LANGUAGE_JAVASCRIPT
         [NotEnumerable] DOMString toString();
@@ -80,16 +80,16 @@ module window {
         // IE's type accessor returns "none", "text" and "control"
         readonly attribute DOMString type;
 
-        void modify(in [Optional=CallWithDefaultValue] DOMString alter, 
-                    in [Optional=CallWithDefaultValue] DOMString direction, 
-                    in [Optional=CallWithDefaultValue] DOMString granularity);
-        void setBaseAndExtent(in [Optional=CallWithDefaultValue] Node baseNode, 
-                              in [Optional=CallWithDefaultValue] long baseOffset, 
-                              in [Optional=CallWithDefaultValue] Node extentNode, 
-                              in [Optional=CallWithDefaultValue] long extentOffset)
+        void modify(in [Optional=DefaultIsUndefined] DOMString alter, 
+                    in [Optional=DefaultIsUndefined] DOMString direction, 
+                    in [Optional=DefaultIsUndefined] DOMString granularity);
+        void setBaseAndExtent(in [Optional=DefaultIsUndefined] Node baseNode, 
+                              in [Optional=DefaultIsUndefined] long baseOffset, 
+                              in [Optional=DefaultIsUndefined] Node extentNode, 
+                              in [Optional=DefaultIsUndefined] long extentOffset)
             raises(DOMException);
-        void setPosition(in [Optional=CallWithDefaultValue] Node node, 
-                         in [Optional=CallWithDefaultValue] long offset)
+        void setPosition(in [Optional=DefaultIsUndefined] Node node, 
+                         in [Optional=DefaultIsUndefined] long offset)
             raises(DOMException);
 
         // IE extentions
diff --git a/Source/WebCore/page/DOMTimer.cpp b/Source/WebCore/page/DOMTimer.cpp
index 0a94e7ef8..dad76f58d 100644
--- a/Source/WebCore/page/DOMTimer.cpp
+++ b/Source/WebCore/page/DOMTimer.cpp
@@ -92,6 +92,7 @@ int DOMTimer::install(ScriptExecutionContext* context, PassOwnPtr<ScheduledActio
     // or if it is a one-time timer and it has fired (DOMTimer::fired).
     DOMTimer* timer = new DOMTimer(context, action, timeout, singleShot);
 
+    timer->suspendIfNeeded();
     InspectorInstrumentation::didInstallTimer(context, timer->m_timeoutId, timeout, singleShot);
 
     return timer->m_timeoutId;
@@ -114,7 +115,7 @@ void DOMTimer::fired()
 {
     ScriptExecutionContext* context = scriptExecutionContext();
     timerNestingLevel = m_nestingLevel;
-    
+    ASSERT(!context->activeDOMObjectsAreSuspended());
     UserGestureIndicator gestureIndicator(m_shouldForwardUserGesture ? DefinitelyProcessingUserGesture : PossiblyProcessingUserGesture);
     
     // Only the first execution of a multi-shot timer should get an affirmative user gesture indicator.
diff --git a/Source/WebCore/page/DOMWindow.cpp b/Source/WebCore/page/DOMWindow.cpp
index 2597f864f..051bbf0db 100644
--- a/Source/WebCore/page/DOMWindow.cpp
+++ b/Source/WebCore/page/DOMWindow.cpp
@@ -102,17 +102,6 @@
 #include <wtf/MathExtras.h>
 #include <wtf/text/WTFString.h>
 
-#if ENABLE(FILE_SYSTEM)
-#include "AsyncFileSystem.h"
-#include "DOMFileSystem.h"
-#include "EntryCallback.h"
-#include "ErrorCallback.h"
-#include "FileError.h"
-#include "FileSystemCallback.h"
-#include "FileSystemCallbacks.h"
-#include "LocalFileSystem.h"
-#endif
-
 #if ENABLE(REQUEST_ANIMATION_FRAME)
 #include "RequestAnimationFrameCallback.h"
 #endif
@@ -480,6 +469,21 @@ void DOMWindow::frameDestroyed()
     clear();
 }
 
+void DOMWindow::willDetachPage()
+{
+    InspectorInstrumentation::frameWindowDiscarded(m_frame, this);
+
+#if ENABLE(NOTIFICATIONS)
+    // Clearing Notifications requests involves accessing the client so it must be done
+    // before the frame is detached.
+    resetNotifications();
+#endif
+
+    HashSet<DOMWindowProperty*>::iterator stop = m_properties.end();
+    for (HashSet<DOMWindowProperty*>::iterator it = m_properties.begin(); it != stop; ++it)
+        (*it)->willDetachPage();
+}
+
 void DOMWindow::registerProperty(DOMWindowProperty* property)
 {
     m_properties.add(property);
@@ -715,7 +719,7 @@ NotificationCenter* DOMWindow::webkitNotifications() const
     if (!page)
         return 0;
 
-    NotificationPresenter* provider = page->notificationController()->client();
+    NotificationPresenter* provider = NotificationController::clientFrom(page);
     if (provider) 
         m_notifications = NotificationCenter::create(document, provider);    
       
@@ -731,23 +735,6 @@ void DOMWindow::resetNotifications()
 }
 #endif
 
-void DOMWindow::pageDestroyed()
-{
-    InspectorInstrumentation::frameWindowDiscarded(m_frame, this);
-#if ENABLE(NOTIFICATIONS)
-    // Clearing Notifications requests involves accessing the client so it must be done
-    // before the frame is detached.
-    resetNotifications();
-#endif
-}
-
-void DOMWindow::resetGeolocation()
-{
-    // Geolocation should cancel activities and permission requests when the page is detached.
-    if (m_navigator)
-        m_navigator->resetGeolocation();
-}
-
 #if ENABLE(INDEXED_DATABASE)
 void DOMWindow::setIDBFactory(PassRefPtr<IDBFactory> idbFactory)
 {
@@ -755,61 +742,6 @@ void DOMWindow::setIDBFactory(PassRefPtr<IDBFactory> idbFactory)
 }
 #endif
 
-#if ENABLE(FILE_SYSTEM)
-void DOMWindow::webkitRequestFileSystem(int type, long long size, PassRefPtr<FileSystemCallback> successCallback, PassRefPtr<ErrorCallback> errorCallback)
-{
-    if (!isCurrentlyDisplayedInFrame())
-        return;
-
-    Document* document = this->document();
-    if (!document)
-        return;
-
-    if (!AsyncFileSystem::isAvailable() || !document->securityOrigin()->canAccessFileSystem()) {
-        DOMFileSystem::scheduleCallback(document, errorCallback, FileError::create(FileError::SECURITY_ERR));
-        return;
-    }
-
-    AsyncFileSystem::Type fileSystemType = static_cast<AsyncFileSystem::Type>(type);
-    if (!AsyncFileSystem::isValidType(fileSystemType)) {
-        DOMFileSystem::scheduleCallback(document, errorCallback, FileError::create(FileError::INVALID_MODIFICATION_ERR));
-        return;
-    }
-
-    LocalFileSystem::localFileSystem().requestFileSystem(document, fileSystemType, size, FileSystemCallbacks::create(successCallback, errorCallback, document), false);
-}
-
-void DOMWindow::webkitResolveLocalFileSystemURL(const String& url, PassRefPtr<EntryCallback> successCallback, PassRefPtr<ErrorCallback> errorCallback)
-{
-    if (!isCurrentlyDisplayedInFrame())
-        return;
-
-    Document* document = this->document();
-    if (!document)
-        return;
-
-    SecurityOrigin* securityOrigin = document->securityOrigin();
-    KURL completedURL = document->completeURL(url);
-    if (!AsyncFileSystem::isAvailable() || !securityOrigin->canAccessFileSystem() || !securityOrigin->canRequest(completedURL)) {
-        DOMFileSystem::scheduleCallback(document, errorCallback, FileError::create(FileError::SECURITY_ERR));
-        return;
-    }
-
-    AsyncFileSystem::Type type;
-    String filePath;
-    if (!completedURL.isValid() || !AsyncFileSystem::crackFileSystemURL(completedURL, type, filePath)) {
-        DOMFileSystem::scheduleCallback(document, errorCallback, FileError::create(FileError::ENCODING_ERR));
-        return;
-    }
-
-    LocalFileSystem::localFileSystem().readFileSystem(document, type, ResolveURICallbacks::create(successCallback, errorCallback, document, filePath));
-}
-
-COMPILE_ASSERT(static_cast<int>(DOMWindow::TEMPORARY) == static_cast<int>(AsyncFileSystem::Temporary), enum_mismatch);
-COMPILE_ASSERT(static_cast<int>(DOMWindow::PERSISTENT) == static_cast<int>(AsyncFileSystem::Persistent), enum_mismatch);
-
-#endif
-
 void DOMWindow::postMessage(PassRefPtr<SerializedScriptValue> message, MessagePort* port, const String& targetOrigin, DOMWindow* source, ExceptionCode& ec)
 {
     MessagePortArray ports;
@@ -1206,7 +1138,7 @@ unsigned DOMWindow::length() const
     if (!isCurrentlyDisplayedInFrame())
         return 0;
 
-    return m_frame->tree()->childCount();
+    return m_frame->tree()->scopedChildCount();
 }
 
 String DOMWindow::name() const
@@ -1321,7 +1253,7 @@ PassRefPtr<CSSStyleDeclaration> DOMWindow::getComputedStyle(Element* elt, const
     if (!elt)
         return 0;
 
-    return computedStyle(elt, false, pseudoElt);
+    return CSSComputedStyleDeclaration::create(elt, false, pseudoElt);
 }
 
 PassRefPtr<CSSRuleList> DOMWindow::getMatchedCSSRules(Element* element, const String& pseudoElement, bool authorOnly) const
@@ -1561,10 +1493,13 @@ bool DOMWindow::addEventListener(const AtomicString& eventType, PassRefPtr<Event
     else if (eventType == eventNames().beforeunloadEvent && allowsBeforeUnloadListeners(this))
         addBeforeUnloadEventListener(this);
 #if ENABLE(DEVICE_ORIENTATION)
-    else if (eventType == eventNames().devicemotionEvent && frame() && frame()->page() && frame()->page()->deviceMotionController())
-        frame()->page()->deviceMotionController()->addListener(this);
-    else if (eventType == eventNames().deviceorientationEvent && frame() && frame()->page() && frame()->page()->deviceOrientationController())
-        frame()->page()->deviceOrientationController()->addListener(this);
+    else if (eventType == eventNames().devicemotionEvent) {
+        if (DeviceMotionController* controller = DeviceMotionController::from(frame()))
+            controller->addListener(this);
+    } else if (eventType == eventNames().deviceorientationEvent) {
+        if (DeviceOrientationController* controller = DeviceOrientationController::from(frame()))
+            controller->addListener(this);
+    }
 #endif
 
     return true;
@@ -1585,10 +1520,13 @@ bool DOMWindow::removeEventListener(const AtomicString& eventType, EventListener
     else if (eventType == eventNames().beforeunloadEvent && allowsBeforeUnloadListeners(this))
         removeBeforeUnloadEventListener(this);
 #if ENABLE(DEVICE_ORIENTATION)
-    else if (eventType == eventNames().devicemotionEvent && frame() && frame()->page() && frame()->page()->deviceMotionController())
-        frame()->page()->deviceMotionController()->removeListener(this);
-    else if (eventType == eventNames().deviceorientationEvent && frame() && frame()->page() && frame()->page()->deviceOrientationController())
-        frame()->page()->deviceOrientationController()->removeListener(this);
+    else if (eventType == eventNames().devicemotionEvent) {
+        if (DeviceMotionController* controller = DeviceMotionController::from(frame()))
+            controller->removeListener(this);
+    } else if (eventType == eventNames().deviceorientationEvent) {
+        if (DeviceOrientationController* controller = DeviceOrientationController::from(frame()))
+            controller->removeListener(this);
+    }
 #endif
 
     return true;
@@ -1641,10 +1579,10 @@ void DOMWindow::removeAllEventListeners()
     EventTarget::removeAllEventListeners();
 
 #if ENABLE(DEVICE_ORIENTATION)
-    if (frame() && frame()->page() && frame()->page()->deviceMotionController())
-        frame()->page()->deviceMotionController()->removeAllListeners(this);
-    if (frame() && frame()->page() && frame()->page()->deviceOrientationController())
-        frame()->page()->deviceOrientationController()->removeAllListeners(this);
+    if (DeviceMotionController* controller = DeviceMotionController::from(frame()))
+        controller->removeAllListeners(this);
+    if (DeviceOrientationController* controller = DeviceOrientationController::from(frame()))
+        controller->removeAllListeners(this);
 #endif
 
     removeAllUnloadEventListeners(this);
diff --git a/Source/WebCore/page/DOMWindow.h b/Source/WebCore/page/DOMWindow.h
index 96a58e583..9fa6a5caf 100644
--- a/Source/WebCore/page/DOMWindow.h
+++ b/Source/WebCore/page/DOMWindow.h
@@ -46,10 +46,7 @@ namespace WebCore {
     class DatabaseCallback;
     class Document;
     class Element;
-    class EntryCallback;
-    class ErrorCallback;
     class EventListener;
-    class FileSystemCallback;
     class FloatRect;
     class Frame;
     class History;
@@ -92,8 +89,6 @@ namespace WebCore {
 
         virtual DOMWindow* toDOMWindow();
 
-        virtual void frameDestroyed() OVERRIDE;
-
         void registerProperty(DOMWindowProperty*);
         void unregisterProperty(DOMWindowProperty*);
 
@@ -231,9 +226,6 @@ namespace WebCore {
         void printErrorMessage(const String&);
         String crossDomainAccessErrorMessage(DOMWindow* activeWindow);
 
-        void pageDestroyed();
-        void resetGeolocation();
-
         void postMessage(PassRefPtr<SerializedScriptValue> message, const MessagePortArray*, const String& targetOrigin, DOMWindow* source, ExceptionCode&);
         // FIXME: remove this when we update the ObjC bindings (bug #28774).
         void postMessage(PassRefPtr<SerializedScriptValue> message, MessagePort*, const String& targetOrigin, DOMWindow* source, ExceptionCode&);
@@ -360,17 +352,6 @@ namespace WebCore {
         Storage* sessionStorage(ExceptionCode&) const;
         Storage* localStorage(ExceptionCode&) const;
 
-#if ENABLE(FILE_SYSTEM)
-        // They are placed here and in all capital letters so they can be checked against the constants in the
-        // IDL at compile time.
-        enum FileSystemType {
-            TEMPORARY,
-            PERSISTENT,
-        };
-        void webkitRequestFileSystem(int type, long long size, PassRefPtr<FileSystemCallback>, PassRefPtr<ErrorCallback>);
-        void webkitResolveLocalFileSystemURL(const String&, PassRefPtr<EntryCallback>, PassRefPtr<ErrorCallback>);
-#endif
-
 #if ENABLE(NOTIFICATIONS)
         NotificationCenter* webkitNotifications() const;
         // Renders webkitNotifications object safely inoperable, disconnects
@@ -419,6 +400,9 @@ namespace WebCore {
     private:
         explicit DOMWindow(Frame*);
 
+        virtual void frameDestroyed() OVERRIDE;
+        virtual void willDetachPage() OVERRIDE;
+
         virtual void refEventTarget() { ref(); }
         virtual void derefEventTarget() { deref(); }
         virtual EventTargetData* eventTargetData();
diff --git a/Source/WebCore/page/DOMWindow.idl b/Source/WebCore/page/DOMWindow.idl
index 41ace04d0..2d8691642 100644
--- a/Source/WebCore/page/DOMWindow.idl
+++ b/Source/WebCore/page/DOMWindow.idl
@@ -27,11 +27,11 @@
 module window {
 
     interface [
-        CheckDomainSecurity,
+        CheckSecurity,
         JSCustomDefineOwnProperty,
         CustomDeleteProperty,
         CustomGetOwnPropertySlot,
-        CustomGetPropertyNames,
+        CustomEnumerateProperty,
         JSCustomMarkFunction,
         JSCustomToNativeObject,
         CustomPutFunction,
@@ -39,11 +39,13 @@ module window {
         ExtendsDOMGlobalObject,
         JSGenerateToNativeObject,
         ReplaceableConstructor,
-        JSLegacyParent=JSDOMWindowBase
+        JSLegacyParent=JSDOMWindowBase,
+        V8CustomToJSObject,
+        InterfaceName=Window
     ] DOMWindow {
         // DOM Level 0
         attribute [Replaceable] Screen screen;
-        attribute [Replaceable, DoNotCheckDomainSecurityOnGetter, JSCustomGetter] History history;
+        attribute [Replaceable, DoNotCheckSecurityOnGetter, JSCustomGetter] History history;
         attribute [Replaceable] BarInfo locationbar;
         attribute [Replaceable] BarInfo menubar;
         attribute [Replaceable] BarInfo personalbar;
@@ -53,18 +55,18 @@ module window {
         attribute [Replaceable] Navigator navigator;
         attribute [Replaceable] Navigator clientInformation;
         readonly attribute Crypto crypto;
-        attribute [DoNotCheckDomainSecurity, JSCustom, V8CustomSetter, V8Unforgeable, CPPCustom] Location location;
-
+#if !defined(LANGUAGE_CPP) || !LANGUAGE_CPP
+        attribute [DoNotCheckSecurity, JSCustom, V8CustomSetter, V8Unforgeable] Location location;
+#endif
         attribute [Replaceable, CustomGetter, V8CustomSetter] Event event;
 
-
         DOMSelection getSelection();
 
-        readonly attribute [CheckAccessToNode] Element frameElement;
+        readonly attribute [CheckSecurityForNode] Element frameElement;
 
-        [DoNotCheckDomainSecurity] void focus();
-        [DoNotCheckDomainSecurity] void blur();
-        [DoNotCheckDomainSecurity, CallWith=ScriptExecutionContext] void close();
+        [DoNotCheckSecurity] void focus();
+        [DoNotCheckSecurity] void blur();
+        [DoNotCheckSecurity, CallWith=ScriptExecutionContext] void close();
 
         void print();
         void stop();
@@ -77,18 +79,18 @@ module window {
                                            in [Optional] DOMObject dialogArgs,
                                            in [Optional] DOMString featureArgs);
 
-        void alert(in [Optional=CallWithDefaultValue] DOMString message);
-        boolean confirm(in [Optional=CallWithDefaultValue] DOMString message);
-        [ConvertNullStringTo=Null] DOMString prompt(in [Optional=CallWithDefaultValue] DOMString message,
-                                                    in [TreatNullAs=NullString, TreatUndefinedAs=NullString,Optional=CallWithDefaultValue] DOMString defaultValue);
+        void alert(in [Optional=DefaultIsUndefined] DOMString message);
+        boolean confirm(in [Optional=DefaultIsUndefined] DOMString message);
+        [TreatReturnedNullStringAs=Null] DOMString prompt(in [Optional=DefaultIsUndefined] DOMString message,
+                                                    in [TreatNullAs=NullString, TreatUndefinedAs=NullString,Optional=DefaultIsUndefined] DOMString defaultValue);
 
-        boolean find(in [Optional=CallWithDefaultValue] DOMString string,
-                     in [Optional=CallWithDefaultValue] boolean caseSensitive,
-                     in [Optional=CallWithDefaultValue] boolean backwards,
-                     in [Optional=CallWithDefaultValue] boolean wrap,
-                     in [Optional=CallWithDefaultValue] boolean wholeWord,
-                     in [Optional=CallWithDefaultValue] boolean searchInFrames,
-                     in [Optional=CallWithDefaultValue] boolean showDialog);
+        boolean find(in [Optional=DefaultIsUndefined] DOMString string,
+                     in [Optional=DefaultIsUndefined] boolean caseSensitive,
+                     in [Optional=DefaultIsUndefined] boolean backwards,
+                     in [Optional=DefaultIsUndefined] boolean wrap,
+                     in [Optional=DefaultIsUndefined] boolean wholeWord,
+                     in [Optional=DefaultIsUndefined] boolean searchInFrames,
+                     in [Optional=DefaultIsUndefined] boolean showDialog);
 
         attribute [Replaceable] boolean offscreenBuffering;
 
@@ -105,17 +107,17 @@ module window {
         readonly attribute long pageXOffset;
         readonly attribute long pageYOffset;
 
-        void scrollBy(in [Optional=CallWithDefaultValue] long x, in [Optional=CallWithDefaultValue] long y);
-        void scrollTo(in [Optional=CallWithDefaultValue] long x, in [Optional=CallWithDefaultValue] long y);
-        void scroll(in [Optional=CallWithDefaultValue] long x, in [Optional=CallWithDefaultValue] long y);
-        void moveBy(in [Optional=CallWithDefaultValue] float x, in [Optional=CallWithDefaultValue] float y); // FIXME: this should take longs not floats.
-        void moveTo(in [Optional=CallWithDefaultValue] float x, in [Optional=CallWithDefaultValue] float y); // FIXME: this should take longs not floats.
-        void resizeBy(in [Optional=CallWithDefaultValue] float x, in [Optional=CallWithDefaultValue] float y); // FIXME: this should take longs not floats.
-        void resizeTo(in [Optional=CallWithDefaultValue] float width, in [Optional=CallWithDefaultValue] float height); // FIXME: this should take longs not floats.
+        void scrollBy(in [Optional=DefaultIsUndefined] long x, in [Optional=DefaultIsUndefined] long y);
+        void scrollTo(in [Optional=DefaultIsUndefined] long x, in [Optional=DefaultIsUndefined] long y);
+        void scroll(in [Optional=DefaultIsUndefined] long x, in [Optional=DefaultIsUndefined] long y);
+        void moveBy(in [Optional=DefaultIsUndefined] float x, in [Optional=DefaultIsUndefined] float y); // FIXME: this should take longs not floats.
+        void moveTo(in [Optional=DefaultIsUndefined] float x, in [Optional=DefaultIsUndefined] float y); // FIXME: this should take longs not floats.
+        void resizeBy(in [Optional=DefaultIsUndefined] float x, in [Optional=DefaultIsUndefined] float y); // FIXME: this should take longs not floats.
+        void resizeTo(in [Optional=DefaultIsUndefined] float width, in [Optional=DefaultIsUndefined] float height); // FIXME: this should take longs not floats.
 
-        readonly attribute [DoNotCheckDomainSecurity] boolean closed;
+        readonly attribute [DoNotCheckSecurity] boolean closed;
 
-        attribute [Replaceable, DoNotCheckDomainSecurityOnGetter] unsigned long length;
+        attribute [Replaceable, DoNotCheckSecurityOnGetter] unsigned long length;
 
         attribute DOMString name;
 
@@ -127,13 +129,13 @@ module window {
 #endif
 
         // Self referential attributes
-        attribute [Replaceable, DoNotCheckDomainSecurityOnGetter] DOMWindow self;
-        readonly attribute [DoNotCheckDomainSecurity, V8Unforgeable] DOMWindow window;
-        attribute [Replaceable, DoNotCheckDomainSecurityOnGetter] DOMWindow frames;
+        attribute [Replaceable, DoNotCheckSecurityOnGetter] DOMWindow self;
+        readonly attribute [DoNotCheckSecurity, V8Unforgeable] DOMWindow window;
+        attribute [Replaceable, DoNotCheckSecurityOnGetter] DOMWindow frames;
 
-        attribute [Replaceable, DoNotCheckDomainSecurityOnGetter, V8CustomSetter] DOMWindow opener;
-        attribute [Replaceable, DoNotCheckDomainSecurityOnGetter] DOMWindow parent;
-        attribute [Replaceable, DoNotCheckDomainSecurityOnGetter, V8Unforgeable, V8ReadOnly] DOMWindow top;
+        attribute [Replaceable, DoNotCheckSecurityOnGetter, V8CustomSetter] DOMWindow opener;
+        attribute [Replaceable, DoNotCheckSecurityOnGetter] DOMWindow parent;
+        attribute [Replaceable, DoNotCheckSecurityOnGetter, V8Unforgeable, V8ReadOnly] DOMWindow top;
 
         // DOM Level 2 AbstractView Interface
         readonly attribute Document document;
@@ -145,21 +147,21 @@ module window {
         readonly attribute StyleMedia styleMedia;
 
         // DOM Level 2 Style Interface
-        CSSStyleDeclaration getComputedStyle(in [Optional=CallWithDefaultValue] Element element,
-                                             in [TreatNullAs=NullString, TreatUndefinedAs=NullString,Optional=CallWithDefaultValue] DOMString pseudoElement);
+        CSSStyleDeclaration getComputedStyle(in [Optional=DefaultIsUndefined] Element element,
+                                             in [TreatNullAs=NullString, TreatUndefinedAs=NullString,Optional=DefaultIsUndefined] DOMString pseudoElement);
 
         // WebKit extensions
 #if defined(LANGUAGE_JAVASCRIPT) && LANGUAGE_JAVASCRIPT
-        CSSRuleList getMatchedCSSRules(in [Optional=CallWithDefaultValue] Element element,
-                                       in [Optional=CallWithDefaultValue] DOMString pseudoElement);
+        CSSRuleList getMatchedCSSRules(in [Optional=DefaultIsUndefined] Element element,
+                                       in [Optional=DefaultIsUndefined] DOMString pseudoElement);
 #endif
 
         attribute [Replaceable] double devicePixelRatio;
         
-        WebKitPoint webkitConvertPointFromPageToNode(in [Optional=CallWithDefaultValue] Node node, 
-                                                     in [Optional=CallWithDefaultValue] WebKitPoint p);
-        WebKitPoint webkitConvertPointFromNodeToPage(in [Optional=CallWithDefaultValue] Node node, 
-                                                     in [Optional=CallWithDefaultValue] WebKitPoint p);
+        WebKitPoint webkitConvertPointFromPageToNode(in [Optional=DefaultIsUndefined] Node node, 
+                                                     in [Optional=DefaultIsUndefined] WebKitPoint p);
+        WebKitPoint webkitConvertPointFromNodeToPage(in [Optional=DefaultIsUndefined] Node node, 
+                                                     in [Optional=DefaultIsUndefined] WebKitPoint p);
 
         readonly attribute [V8EnabledAtRuntime] DOMApplicationCache applicationCache;
 
@@ -171,12 +173,6 @@ module window {
 #if defined(ENABLE_NOTIFICATIONS) && ENABLE_NOTIFICATIONS
         readonly attribute [V8EnabledAtRuntime] NotificationCenter webkitNotifications;
 #endif
-#if defined(ENABLE_FILE_SYSTEM) && ENABLE_FILE_SYSTEM
-        const unsigned short TEMPORARY = 0;
-        const unsigned short PERSISTENT = 1;
-        [V8EnabledAtRuntime=FileSystem] void webkitRequestFileSystem(in unsigned short type, in long long size, in [Callback] FileSystemCallback successCallback, in [Callback, Optional] ErrorCallback errorCallback);
-        [V8EnabledAtRuntime=FileSystem] void webkitResolveLocalFileSystemURL(in DOMString url, in [Callback, Optional] EntryCallback successCallback, in [Callback, Optional] ErrorCallback errorCallback);
-#endif
 
 #if defined(ENABLE_ORIENTATION_EVENTS) && ENABLE_ORIENTATION_EVENTS
         // This is the interface orientation in degrees. Some examples are:
@@ -189,18 +185,18 @@ module window {
 
         // cross-document messaging
 #if defined(LANGUAGE_JAVASCRIPT) && LANGUAGE_JAVASCRIPT
-        [DoNotCheckDomainSecurity, Custom] void postMessage(in SerializedScriptValue message, in DOMString targetOrigin)
+        [DoNotCheckSecurity, Custom] void postMessage(in SerializedScriptValue message, in DOMString targetOrigin)
             raises(DOMException);
-        [DoNotCheckDomainSecurity, Custom] void postMessage(in SerializedScriptValue message, in DOMString targetOrigin, in Array messagePorts)
+        [DoNotCheckSecurity, Custom] void postMessage(in SerializedScriptValue message, in DOMString targetOrigin, in Array messagePorts)
             raises(DOMException);
 
-        [DoNotCheckDomainSecurity, Custom] void webkitPostMessage(in SerializedScriptValue message, in DOMString targetOrigin)
+        [DoNotCheckSecurity, Custom] void webkitPostMessage(in SerializedScriptValue message, in DOMString targetOrigin)
             raises(DOMException);
-        [DoNotCheckDomainSecurity, Custom] void webkitPostMessage(in SerializedScriptValue message, in DOMString targetOrigin, in Array transferList)
+        [DoNotCheckSecurity, Custom] void webkitPostMessage(in SerializedScriptValue message, in DOMString targetOrigin, in Array transferList)
             raises(DOMException);
 #else
         // There's no good way to expose an array via the ObjC bindings, so for now just allow passing in a single port.
-        [DoNotCheckDomainSecurity, Custom] void postMessage(in SerializedScriptValue message, in [Optional] MessagePort messagePort, in DOMString targetOrigin)
+        [DoNotCheckSecurity, Custom] void postMessage(in SerializedScriptValue message, in [Optional] MessagePort messagePort, in DOMString targetOrigin)
             raises(DOMException);
 #endif
 
@@ -209,27 +205,27 @@ module window {
 #endif
 
         // Timers
-        [Custom] long setTimeout(in [Optional=CallWithDefaultValue] TimeoutHandler handler, 
-                                 in [Optional=CallWithDefaultValue] long timeout);
+        [Custom] long setTimeout(in [Optional=DefaultIsUndefined] TimeoutHandler handler, 
+                                 in [Optional=DefaultIsUndefined] long timeout);
         // [Custom] long setTimeout(in TimeoutHandler handler, in long timeout, arguments...);
         // [Custom] long setTimeout(in DOMString code, in long timeout);
-        void clearTimeout(in [Optional=CallWithDefaultValue] long handle);
+        void clearTimeout(in [Optional=DefaultIsUndefined] long handle);
         [Custom] long setInterval(in TimeoutHandler handler, in long timeout);
         // [Custom] long setInterval(in TimeoutHandler handler, in long timeout, arguments...);
         // [Custom] long setInterval(in DOMString code, in long timeout);
-        void clearInterval(in [Optional=CallWithDefaultValue] long handle);
+        void clearInterval(in [Optional=DefaultIsUndefined] long handle);
 
 #if defined(ENABLE_REQUEST_ANIMATION_FRAME)
         // WebKit animation extensions, being standardized in the WebPerf WG
-        long webkitRequestAnimationFrame(in [Callback] RequestAnimationFrameCallback callback, in [Optional=CallWithDefaultValue] Element element);
+        long webkitRequestAnimationFrame(in [Callback] RequestAnimationFrameCallback callback, in [Optional=DefaultIsUndefined] Element element);
         void webkitCancelAnimationFrame(in long id);
         void webkitCancelRequestAnimationFrame(in long id); // This is a deprecated alias for webkitCancelAnimationFrame(). Remove this when removing vendor prefix.
 #endif
 
         // Base64
-        DOMString atob(in [TreatNullAs=NullString,Optional=CallWithDefaultValue] DOMString string)
+        DOMString atob(in [TreatNullAs=NullString,Optional=DefaultIsUndefined] DOMString string)
             raises(DOMException);
-        DOMString btoa(in [TreatNullAs=NullString,Optional=CallWithDefaultValue] DOMString string)
+        DOMString btoa(in [TreatNullAs=NullString,Optional=DefaultIsUndefined] DOMString string)
             raises(DOMException);
 
         // Events
@@ -321,8 +317,6 @@ module window {
         attribute [Conditional=DEVICE_ORIENTATION,V8EnabledAtRuntime] EventListener ondevicemotion;
         attribute [Conditional=DEVICE_ORIENTATION,V8EnabledAtRuntime] EventListener ondeviceorientation;
 
-        attribute [Conditional=MEDIA_STREAM,V8EnabledAtRuntime] PeerConnectionConstructor webkitPeerConnection;
-
         // EventTarget interface
         [Custom] void addEventListener(in DOMString type,
                                       in EventListener listener,
@@ -333,8 +327,8 @@ module window {
         boolean dispatchEvent(in Event evt)
             raises(EventException);
 
-        [V8Custom=DOMWindowNOP] void captureEvents(/*in long eventFlags*/);
-        [V8Custom=DOMWindowNOP] void releaseEvents(/*in long eventFlags*/);
+        [V8Custom] void captureEvents(/*in long eventFlags*/);
+        [V8Custom] void releaseEvents(/*in long eventFlags*/);
 
 #if defined(LANGUAGE_JAVASCRIPT) && LANGUAGE_JAVASCRIPT
         // Global constructors
@@ -399,94 +393,14 @@ module window {
         attribute ProcessingInstructionConstructor ProcessingInstruction;
         attribute [Conditional=SHADOW_DOM, V8EnabledAtRuntime=shadowDOM] ShadowRootConstructor WebKitShadowRoot;
 
-        attribute HTMLDocumentConstructor HTMLDocument;
-
-        attribute HTMLElementConstructor HTMLElement;
-        attribute HTMLAnchorElementConstructor HTMLAnchorElement;
-        attribute HTMLAppletElementConstructor HTMLAppletElement;
-        attribute HTMLAreaElementConstructor HTMLAreaElement;
-        attribute HTMLBRElementConstructor HTMLBRElement;
-        attribute HTMLBaseElementConstructor HTMLBaseElement;
-        attribute HTMLBaseFontElementConstructor HTMLBaseFontElement;
-        attribute HTMLBodyElementConstructor HTMLBodyElement;
-        attribute HTMLButtonElementConstructor HTMLButtonElement;
-        attribute HTMLCanvasElementConstructor HTMLCanvasElement;
-        attribute HTMLDListElementConstructor HTMLDListElement;
-        attribute HTMLDirectoryElementConstructor HTMLDirectoryElement;
-        attribute HTMLDivElementConstructor HTMLDivElement;
-        attribute HTMLEmbedElementConstructor HTMLEmbedElement;
-        attribute HTMLFieldSetElementConstructor HTMLFieldSetElement;
-        attribute HTMLFontElementConstructor HTMLFontElement;
-        attribute HTMLFormElementConstructor HTMLFormElement;
-        attribute HTMLFrameElementConstructor HTMLFrameElement;
-        attribute HTMLFrameSetElementConstructor HTMLFrameSetElement;
-        attribute HTMLHRElementConstructor HTMLHRElement;
-        attribute HTMLHeadElementConstructor HTMLHeadElement;
-        attribute HTMLHeadingElementConstructor HTMLHeadingElement;
-        attribute HTMLHtmlElementConstructor HTMLHtmlElement;
-        attribute HTMLIFrameElementConstructor HTMLIFrameElement;
-        attribute HTMLImageElementConstructor HTMLImageElement;
-        attribute HTMLInputElementConstructor HTMLInputElement;
-        attribute HTMLKeygenElementConstructor HTMLKeygenElement;
-        attribute HTMLLIElementConstructor HTMLLIElement;
-        attribute HTMLLabelElementConstructor HTMLLabelElement;
-        attribute HTMLLegendElementConstructor HTMLLegendElement;
-        attribute HTMLLinkElementConstructor HTMLLinkElement;
-        attribute HTMLMapElementConstructor HTMLMapElement;
-        attribute HTMLMarqueeElementConstructor HTMLMarqueeElement;
-        attribute HTMLMenuElementConstructor HTMLMenuElement;
-        attribute HTMLMetaElementConstructor HTMLMetaElement;
-#if defined(ENABLE_METER_TAG) && ENABLE_METER_TAG
-        attribute HTMLMeterElementConstructor HTMLMeterElement;
-#endif
-        attribute HTMLModElementConstructor HTMLModElement;
-        attribute HTMLOListElementConstructor HTMLOListElement;
-        attribute HTMLObjectElementConstructor HTMLObjectElement;
-        attribute HTMLOptGroupElementConstructor HTMLOptGroupElement;
-        attribute HTMLOptionElementConstructor HTMLOptionElement;
-        attribute HTMLOutputElementConstructor HTMLOutputElement;
-        attribute HTMLParagraphElementConstructor HTMLParagraphElement;
-        attribute HTMLParamElementConstructor HTMLParamElement;
-        attribute HTMLPreElementConstructor HTMLPreElement;
-#if defined(ENABLE_PROGRESS_TAG) && ENABLE_PROGRESS_TAG
-        attribute HTMLProgressElementConstructor HTMLProgressElement;
-#endif
-        attribute HTMLQuoteElementConstructor HTMLQuoteElement;
-        attribute HTMLScriptElementConstructor HTMLScriptElement;
-        attribute HTMLSelectElementConstructor HTMLSelectElement;
-        attribute HTMLSpanElementConstructor HTMLSpanElement;
-        attribute HTMLStyleElementConstructor HTMLStyleElement;
-        attribute HTMLTableCaptionElementConstructor HTMLTableCaptionElement;
-        attribute HTMLTableCellElementConstructor HTMLTableCellElement;
-        attribute HTMLTableColElementConstructor HTMLTableColElement;
-        attribute HTMLTableElementConstructor HTMLTableElement;
-        attribute HTMLTableRowElementConstructor HTMLTableRowElement;
-        attribute HTMLTableSectionElementConstructor HTMLTableSectionElement;
-        attribute HTMLTextAreaElementConstructor HTMLTextAreaElement;
-        attribute HTMLTitleElementConstructor HTMLTitleElement;
-        attribute HTMLUListElementConstructor HTMLUListElement;
-
-        attribute HTMLCollectionConstructor HTMLCollection;
-        attribute HTMLAllCollectionConstructor HTMLAllCollection;
-        attribute [Conditional=MICRODATA] HTMLPropertiesCollectionConstructor HTMLPropertiesCollection;
-        attribute HTMLUnknownElementConstructor HTMLUnknownElement;
-
-        attribute [JSCustomGetter, CustomConstructor] HTMLImageElementConstructorConstructor Image; // Usable with new operator
-        attribute [JSCustomGetter] HTMLOptionElementConstructorConstructor Option; // Usable with new operator
+        attribute DOMWindowConstructor Window;
 
+        // FIXME: Should these Canvas constructors move to html/DOMWindowHTML with the rest of canvas?
         attribute CanvasPatternConstructor CanvasPattern;
         attribute CanvasGradientConstructor CanvasGradient;
         attribute CanvasRenderingContext2DConstructor CanvasRenderingContext2D;
+
         attribute ImageDataConstructor ImageData;
-        attribute [Conditional=WEBGL] WebGLActiveInfoConstructor WebGLActiveInfo;
-        attribute [Conditional=WEBGL] WebGLBufferConstructor WebGLBuffer;
-        attribute [Conditional=WEBGL] WebGLFramebufferConstructor WebGLFramebuffer;
-        attribute [Conditional=WEBGL] WebGLProgramConstructor WebGLProgram;
-        attribute [Conditional=WEBGL] WebGLRenderbufferConstructor WebGLRenderbuffer;
-        attribute [Conditional=WEBGL] WebGLRenderingContextConstructor WebGLRenderingContext;
-        attribute [Conditional=WEBGL] WebGLShaderConstructor WebGLShader;
-        attribute [Conditional=WEBGL] WebGLTextureConstructor WebGLTexture;
-        attribute [Conditional=WEBGL] WebGLUniformLocationConstructor WebGLUniformLocation;
         attribute TextMetricsConstructor TextMetrics;
 
         attribute DOMStringMapConstructor DOMStringMap;
@@ -523,14 +437,11 @@ module window {
         attribute WebKitAnimationEventConstructor WebKitAnimationEvent;
         attribute WebKitTransitionEventConstructor WebKitTransitionEvent;
         attribute WheelEventConstructor WheelEvent;
-        attribute XMLHttpRequestProgressEventConstructor XMLHttpRequestProgressEvent;
-        attribute [Conditional=SVG] SVGZoomEventConstructor SVGZoomEvent;
         attribute [Conditional=DEVICE_ORIENTATION, V8EnabledAtRuntime] DeviceMotionEventConstructor DeviceMotionEvent;
         attribute [Conditional=DEVICE_ORIENTATION, V8EnabledAtRuntime] DeviceOrientationEventConstructor DeviceOrientationEvent;
         attribute [Conditional=TOUCH_EVENTS] TouchEventConstructor TouchEvent;
         attribute StorageEventConstructor StorageEvent;
         attribute [Conditional=INPUT_SPEECH] SpeechInputEventConstructor SpeechInputEvent;
-        attribute [Conditional=MEDIA_STREAM] MediaStreamEventConstructor MediaStreamEvent;
         attribute [Conditional=WEBGL] WebGLContextEventConstructor WebGLContextEvent;
 
         attribute EventExceptionConstructor EventException;
@@ -555,41 +466,11 @@ module window {
 
         attribute EventSourceConstructor EventSource; // Usable with new the operator
 
-        // Mozilla has a separate XMLDocument object for XML documents. 
-        // We just use Document for this.
-        attribute DocumentConstructor XMLDocument;
-
-        attribute DOMParserConstructor DOMParser;
-        attribute XMLSerializerConstructor XMLSerializer;
-
-        attribute XMLHttpRequestConstructor XMLHttpRequest; // Usable with the new operator
-        attribute XMLHttpRequestUploadConstructor XMLHttpRequestUpload;
-        attribute XMLHttpRequestExceptionConstructor XMLHttpRequestException;
-
-        attribute [Conditional=XSLT] XSLTProcessorConstructor XSLTProcessor; // Usable with the new operator
-
 #if defined(ENABLE_CHANNEL_MESSAGING) && ENABLE_CHANNEL_MESSAGING
         attribute MessagePortConstructor MessagePort;
         attribute MessageChannelConstructor MessageChannel; // Usable with the new operator
 #endif
 
-#if defined(ENABLE_WORKERS) && ENABLE_WORKERS
-        attribute WorkerConstructor Worker; // Usable with the new operator
-#endif
-
-#if defined(ENABLE_SHARED_WORKERS) && ENABLE_SHARED_WORKERS
-        attribute [JSCustomGetter, V8EnabledAtRuntime] SharedWorkerConstructor SharedWorker; // Usable with the new operator
-#endif
-
-#if defined(ENABLE_VIDEO_TRACK) && ENABLE_VIDEO_TRACK
-        attribute [V8EnabledAtRuntime=webkitVideoTrack] HTMLTrackElementConstructor HTMLTrackElement;
-        attribute [V8EnabledAtRuntime=webkitVideoTrack] TextTrackConstructor TextTrack;
-        attribute [V8EnabledAtRuntime=webkitVideoTrack] TextTrackCueConstructor TextTrackCue; // Usable with the new operator
-        attribute [V8EnabledAtRuntime=webkitVideoTrack] TextTrackCueListConstructor TextTrackCueList;
-        attribute [V8EnabledAtRuntime=webkitVideoTrack] TextTrackListConstructor TextTrackList;
-        attribute [V8EnabledAtRuntime=webkitVideoTrack] TrackEventConstructor TrackEvent;
-#endif
-
         attribute DOMPluginConstructor Plugin;
         attribute DOMPluginArrayConstructor PluginArray;
 
@@ -601,15 +482,6 @@ module window {
 
         attribute StorageConstructor Storage;
 
-        attribute [JSCustomGetter, Conditional=VIDEO, V8EnabledAtRuntime] HTMLAudioElementConstructorConstructor Audio; // Usable with the new operator
-        attribute [Conditional=VIDEO, V8EnabledAtRuntime] HTMLAudioElementConstructor HTMLAudioElement;
-        attribute [Conditional=VIDEO, V8EnabledAtRuntime] HTMLMediaElementConstructor HTMLMediaElement;
-        attribute [Conditional=VIDEO, V8EnabledAtRuntime] HTMLVideoElementConstructor HTMLVideoElement;
-        attribute [Conditional=VIDEO, V8EnabledAtRuntime] MediaErrorConstructor MediaError;
-        attribute [Conditional=VIDEO, V8EnabledAtRuntime] TimeRangesConstructor TimeRanges;
-        attribute [Conditional=VIDEO, V8EnabledAtRuntime] HTMLSourceElementConstructor HTMLSourceElement;
-        attribute [Conditional=VIDEO, V8EnabledAtRuntime] MediaControllerConstructor MediaController;
-
 #if defined(ENABLE_ANIMATION_API) && ENABLE_ANIMATION_API
         attribute WebKitAnimationConstructor WebKitAnimation;
         attribute WebKitAnimationListConstructor WebKitAnimationList;
@@ -619,162 +491,6 @@ module window {
         attribute XPathResultConstructor XPathResult;
         attribute XPathExceptionConstructor XPathException;
 
-#if defined(ENABLE_SVG) && ENABLE_SVG
-        // Expose all implemented SVG 1.1 interfaces, excluding the SVG MI interfaces:
-        // SVGAnimatedPathData, SVGAnimatedPoints, SVGExternalResourcesRequired,
-        // SVGFilterPrimitiveStandardAttributes, SVGFitToViewBox, SVGLangSpace, SVGLocatable
-        // SVGStylable, SVGTests, SVGTransformable, SVGURIReference, SVGZoomAndPan
-        attribute SVGAElementConstructor SVGAElement;
-        attribute SVGAngleConstructor SVGAngle;
-        attribute SVGAnimatedAngleConstructor SVGAnimatedAngle;
-        attribute SVGAnimatedBooleanConstructor SVGAnimatedBoolean;
-        attribute SVGAnimatedEnumerationConstructor SVGAnimatedEnumeration;
-        attribute SVGAnimatedIntegerConstructor SVGAnimatedInteger;
-        attribute SVGAnimatedLengthConstructor SVGAnimatedLength;
-        attribute SVGAnimatedLengthListConstructor SVGAnimatedLengthList;
-        attribute SVGAnimatedNumberConstructor SVGAnimatedNumber;
-        attribute SVGAnimatedNumberListConstructor SVGAnimatedNumberList;
-        attribute SVGAnimatedPreserveAspectRatioConstructor SVGAnimatedPreserveAspectRatio;
-        attribute SVGAnimatedRectConstructor SVGAnimatedRect;
-        attribute SVGAnimatedStringConstructor SVGAnimatedString;
-        attribute SVGAnimatedTransformListConstructor SVGAnimatedTransformList;
-        attribute SVGCircleElementConstructor SVGCircleElement;
-        attribute SVGClipPathElementConstructor SVGClipPathElement;
-        attribute SVGColorConstructor SVGColor;
-        attribute SVGCursorElementConstructor SVGCursorElement;
-//      attribute SVGCSSRuleConstructor SVGCSSRule;
-        attribute SVGDefsElementConstructor SVGDefsElement;
-        attribute SVGDescElementConstructor SVGDescElement;
-        attribute SVGDocumentConstructor SVGDocument;
-        attribute SVGElementConstructor SVGElement;
-        attribute SVGElementInstanceConstructor SVGElementInstance;
-        attribute SVGElementInstanceListConstructor SVGElementInstanceList;
-        attribute SVGEllipseElementConstructor SVGEllipseElement;
-        attribute SVGForeignObjectElementConstructor SVGForeignObjectElement;
-        attribute SVGExceptionConstructor SVGException;
-        attribute SVGGElementConstructor SVGGElement;
-        attribute SVGGradientElementConstructor SVGGradientElement;
-        attribute SVGImageElementConstructor SVGImageElement;
-        attribute SVGLengthConstructor SVGLength;
-        attribute SVGLengthListConstructor SVGLengthList;
-        attribute SVGLinearGradientElementConstructor SVGLinearGradientElement;
-        attribute SVGLineElementConstructor SVGLineElement;
-        attribute SVGMarkerElementConstructor SVGMarkerElement;
-        attribute SVGMaskElementConstructor SVGMaskElement;
-        attribute SVGMatrixConstructor SVGMatrix;
-        attribute SVGMetadataElementConstructor SVGMetadataElement;
-        attribute SVGNumberConstructor SVGNumber;
-        attribute SVGNumberListConstructor SVGNumberList;
-        attribute SVGPaintConstructor SVGPaint;
-        attribute SVGPathElementConstructor SVGPathElement;
-        attribute SVGPathSegConstructor SVGPathSeg;
-        attribute SVGPathSegArcAbsConstructor SVGPathSegArcAbs;
-        attribute SVGPathSegArcRelConstructor SVGPathSegArcRel;
-        attribute SVGPathSegClosePathConstructor SVGPathSegClosePath;
-        attribute SVGPathSegCurvetoCubicAbsConstructor SVGPathSegCurvetoCubicAbs;
-        attribute SVGPathSegCurvetoCubicRelConstructor SVGPathSegCurvetoCubicRel;
-        attribute SVGPathSegCurvetoCubicSmoothAbsConstructor SVGPathSegCurvetoCubicSmoothAbs;
-        attribute SVGPathSegCurvetoCubicSmoothRelConstructor SVGPathSegCurvetoCubicSmoothRel;
-        attribute SVGPathSegCurvetoQuadraticAbsConstructor SVGPathSegCurvetoQuadraticAbs;
-        attribute SVGPathSegCurvetoQuadraticRelConstructor SVGPathSegCurvetoQuadraticRel;
-        attribute SVGPathSegCurvetoQuadraticSmoothAbsConstructor SVGPathSegCurvetoQuadraticSmoothAbs;
-        attribute SVGPathSegCurvetoQuadraticSmoothRelConstructor SVGPathSegCurvetoQuadraticSmoothRel;
-        attribute SVGPathSegLinetoAbsConstructor SVGPathSegLinetoAbs;
-        attribute SVGPathSegLinetoHorizontalAbsConstructor SVGPathSegLinetoHorizontalAbs;
-        attribute SVGPathSegLinetoHorizontalRelConstructor SVGPathSegLinetoHorizontalRel;
-        attribute SVGPathSegLinetoRelConstructor SVGPathSegLinetoRel;
-        attribute SVGPathSegLinetoVerticalAbsConstructor SVGPathSegLinetoVerticalAbs;
-        attribute SVGPathSegLinetoVerticalRelConstructor SVGPathSegLinetoVerticalRel;
-        attribute SVGPathSegListConstructor SVGPathSegList;
-        attribute SVGPathSegMovetoAbsConstructor SVGPathSegMovetoAbs;
-        attribute SVGPathSegMovetoRelConstructor SVGPathSegMovetoRel;
-        attribute SVGPatternElementConstructor SVGPatternElement;
-        attribute SVGPointConstructor SVGPoint;
-        attribute SVGPointListConstructor SVGPointList;
-        attribute SVGPolygonElementConstructor SVGPolygonElement;
-        attribute SVGPolylineElementConstructor SVGPolylineElement;
-        attribute SVGPreserveAspectRatioConstructor SVGPreserveAspectRatio;
-        attribute SVGRadialGradientElementConstructor SVGRadialGradientElement;
-        attribute SVGRectConstructor SVGRect;
-        attribute SVGRectElementConstructor SVGRectElement;
-        attribute SVGRenderingIntentConstructor SVGRenderingIntent;
-        attribute SVGScriptElementConstructor SVGScriptElement;
-        attribute SVGStopElementConstructor SVGStopElement;
-        attribute SVGStringListConstructor SVGStringList;
-        attribute SVGStyleElementConstructor SVGStyleElement;
-        attribute SVGSVGElementConstructor SVGSVGElement;
-        attribute SVGSwitchElementConstructor SVGSwitchElement;
-        attribute SVGSymbolElementConstructor SVGSymbolElement;
-        attribute SVGTextContentElementConstructor SVGTextContentElement;
-        attribute SVGTextElementConstructor SVGTextElement;
-        attribute SVGTextPathElementConstructor SVGTextPathElement;
-        attribute SVGTextPositioningElementConstructor SVGTextPositioningElement;
-        attribute SVGTitleElementConstructor SVGTitleElement;
-        attribute SVGTransformConstructor SVGTransform;
-        attribute SVGTransformListConstructor SVGTransformList;
-        attribute SVGTRefElementConstructor SVGTRefElement;
-        attribute SVGTSpanElementConstructor SVGTSpanElement;
-        attribute SVGUnitTypesConstructor SVGUnitTypes;
-        attribute SVGUseElementConstructor SVGUseElement;
-        attribute SVGViewElementConstructor SVGViewElement;
-//      attribute SVGViewSpecConstructor SVGViewSpec;
-
-        attribute SVGAnimateColorElementConstructor SVGAnimateColorElement;
-        attribute SVGAnimateElementConstructor SVGAnimateElement;
-        attribute SVGAnimateMotionElementConstructor SVGAnimateMotionElement;
-        attribute SVGAnimateTransformElementConstructor SVGAnimateTransformElement;
-        attribute SVGMPathElementConstructor SVGMPathElement;
-        attribute SVGSetElementConstructor SVGSetElement;
-
-#if defined(ENABLE_SVG_FONTS) && ENABLE_SVG_FONTS
-        attribute SVGAltGlyphDefElementConstructor SVGAltGlyphDefElement;
-        attribute SVGAltGlyphElementConstructor SVGAltGlyphElement;
-        attribute SVGAltGlyphItemElementConstructor SVGAltGlyphItemElement;
-//      attribute SVGDefinitionSrcElementConstructor SVGDefinitionSrcElement;
-        attribute SVGFontElementConstructor SVGFontElement;
-        attribute SVGFontFaceElementConstructor SVGFontFaceElement;
-        attribute SVGFontFaceFormatElementConstructor SVGFontFaceFormatElement;
-        attribute SVGFontFaceNameElementConstructor SVGFontFaceNameElement;
-        attribute SVGFontFaceSrcElementConstructor SVGFontFaceSrcElement;
-        attribute SVGFontFaceUriElementConstructor SVGFontFaceUriElement;
-        attribute SVGGlyphElementConstructor SVGGlyphElement;
-        attribute SVGGlyphRefElementConstructor SVGGlyphRefElement;
-        attribute SVGHKernElementConstructor SVGHKernElement;
-        attribute SVGMissingGlyphElementConstructor SVGMissingGlyphElement;
-        attribute SVGVKernElementConstructor SVGVKernElement;
-#endif
-
-#if defined(ENABLE_FILTERS) && ENABLE_FILTERS
-        attribute SVGComponentTransferFunctionElementConstructor SVGComponentTransferFunctionElement;
-        attribute SVGFEBlendElementConstructor SVGFEBlendElement;
-        attribute SVGFEColorMatrixElementConstructor SVGFEColorMatrixElement;
-        attribute SVGFEComponentTransferElementConstructor SVGFEComponentTransferElement;
-        attribute SVGFECompositeElementConstructor SVGFECompositeElement;
-        attribute SVGFEConvolveMatrixElementConstructor SVGFEConvolveMatrixElement;
-        attribute SVGFEDiffuseLightingElementConstructor SVGFEDiffuseLightingElement;
-        attribute SVGFEDisplacementMapElementConstructor SVGFEDisplacementMapElement;
-        attribute SVGFEDistantLightElementConstructor SVGFEDistantLightElement;
-        attribute SVGFEDropShadowElementConstructor SVGFEDropShadowElement;
-        attribute SVGFEFloodElementConstructor SVGFEFloodElement;
-        attribute SVGFEFuncAElementConstructor SVGFEFuncAElement;
-        attribute SVGFEFuncBElementConstructor SVGFEFuncBElement;
-        attribute SVGFEFuncGElementConstructor SVGFEFuncGElement;
-        attribute SVGFEFuncRElementConstructor SVGFEFuncRElement;
-        attribute SVGFEGaussianBlurElementConstructor SVGFEGaussianBlurElement;
-        attribute SVGFEImageElementConstructor SVGFEImageElement;
-        attribute SVGFEMergeElementConstructor SVGFEMergeElement;
-        attribute SVGFEMergeNodeElementConstructor SVGFEMergeNodeElement;
-        attribute SVGFEMorphologyElementConstructor SVGFEMorphologyElement;
-        attribute SVGFEOffsetElementConstructor SVGFEOffsetElement;
-        attribute SVGFEPointLightElementConstructor SVGFEPointLightElement;
-        attribute SVGFESpecularLightingElementConstructor SVGFESpecularLightingElement;
-        attribute SVGFESpotLightElementConstructor SVGFESpotLightElement;
-        attribute SVGFETileElementConstructor SVGFETileElement;
-        attribute SVGFETurbulenceElementConstructor SVGFETurbulenceElement;
-        attribute SVGFilterElementConstructor SVGFilterElement;
-#endif
-#endif
-
         attribute DOMFormDataConstructor FormData;
 
         attribute [Conditional=BLOB|FILE_SYSTEM] FileErrorConstructor FileError;
@@ -794,7 +510,7 @@ module window {
 
 #if defined(V8_BINDING) && V8_BINDING
         // window.toString() requires special handling in V8
-        [V8DoNotCheckSignature, DoNotCheckDomainSecurity, Custom, NotEnumerable] DOMString toString();
+        [V8DoNotCheckSignature, DoNotCheckSecurity, Custom, NotEnumerable] DOMString toString();
 #endif // defined(V8_BINDING)
     };
 
diff --git a/Source/WebCore/page/DOMWindowProperty.cpp b/Source/WebCore/page/DOMWindowProperty.cpp
index b6a9aba43..82f9316f7 100644
--- a/Source/WebCore/page/DOMWindowProperty.cpp
+++ b/Source/WebCore/page/DOMWindowProperty.cpp
@@ -49,4 +49,9 @@ void DOMWindowProperty::disconnectFrame()
     m_frame = 0;
 }
 
+void DOMWindowProperty::willDetachPage()
+{
+    // Subclasses should override this function to handle this notification.
+}
+
 }
diff --git a/Source/WebCore/page/DOMWindowProperty.h b/Source/WebCore/page/DOMWindowProperty.h
index 41baf437e..cd2d83724 100644
--- a/Source/WebCore/page/DOMWindowProperty.h
+++ b/Source/WebCore/page/DOMWindowProperty.h
@@ -33,7 +33,9 @@ class Frame;
 class DOMWindowProperty {
 public:
     explicit DOMWindowProperty(Frame*);
+
     virtual void disconnectFrame();
+    virtual void willDetachPage();
 
     Frame* frame() const { return m_frame; }
 
diff --git a/Source/WebCore/page/DragClient.h b/Source/WebCore/page/DragClient.h
index 090c29d62..1d9b25bdb 100644
--- a/Source/WebCore/page/DragClient.h
+++ b/Source/WebCore/page/DragClient.h
@@ -61,7 +61,7 @@ namespace WebCore {
 #if PLATFORM(MAC)
         // Mac-specific helper function to allow access to web archives and NSPasteboard extras in WebKit.
         // This is not abstract as that would require another #if PLATFORM(MAC) for the SVGImage client empty implentation.
-        virtual void declareAndWriteDragImage(NSPasteboard *, DOMElement*, NSURL *, NSString *, Frame*) { }
+        virtual void declareAndWriteDragImage(const String&, DOMElement*, NSURL *, NSString *, Frame*) { }
 #endif
         
         virtual void dragEnded() { }
diff --git a/Source/WebCore/page/DragController.cpp b/Source/WebCore/page/DragController.cpp
index 7919d761e..4891aad0b 100644
--- a/Source/WebCore/page/DragController.cpp
+++ b/Source/WebCore/page/DragController.cpp
@@ -449,10 +449,10 @@ bool DragController::concludeEditDrag(DragData* dragData)
         RefPtr<Range> innerRange = innerFrame->selection()->toNormalizedRange();
         RefPtr<StylePropertySet> style = StylePropertySet::create();
         style->setProperty(CSSPropertyColor, color.serialized(), false);
-        if (!innerFrame->editor()->shouldApplyStyle(style->ensureCSSStyleDeclaration(), innerRange.get()))
+        if (!innerFrame->editor()->shouldApplyStyle(style.get(), innerRange.get()))
             return false;
         m_client->willPerformDragDestinationAction(DragDestinationActionEdit, dragData);
-        innerFrame->editor()->applyStyle(style->ensureCSSStyleDeclaration(), EditActionSetColor);
+        innerFrame->editor()->applyStyle(style.get(), EditActionSetColor);
         return true;
     }
 
diff --git a/Source/WebCore/page/EditorClient.h b/Source/WebCore/page/EditorClient.h
index 4d33e9f3d..2bb4f5129 100644
--- a/Source/WebCore/page/EditorClient.h
+++ b/Source/WebCore/page/EditorClient.h
@@ -45,7 +45,6 @@ OBJC_CLASS NSURL;
 namespace WebCore {
 
 class ArchiveResource;
-class CSSStyleDeclaration;
 class DocumentFragment;
 class Editor;
 class Element;
@@ -55,6 +54,7 @@ class KeyboardEvent;
 class Node;
 class Range;
 class SpellChecker;
+class StylePropertySet;
 class TextCheckerClient;
 class VisibleSelection;
 class VisiblePosition;
@@ -82,7 +82,7 @@ public:
     virtual bool shouldInsertText(const String&, Range*, EditorInsertAction) = 0;
     virtual bool shouldChangeSelectedRange(Range* fromRange, Range* toRange, EAffinity, bool stillSelecting) = 0;
     
-    virtual bool shouldApplyStyle(CSSStyleDeclaration*, Range*) = 0;
+    virtual bool shouldApplyStyle(StylePropertySet*, Range*) = 0;
     virtual bool shouldMoveRangeAfterDelete(Range*, Range*) = 0;
 
     virtual void didBeginEditing() = 0;
diff --git a/Source/WebCore/page/EventHandler.cpp b/Source/WebCore/page/EventHandler.cpp
index 9acfc54d2..4f0ddeee3 100644
--- a/Source/WebCore/page/EventHandler.cpp
+++ b/Source/WebCore/page/EventHandler.cpp
@@ -531,6 +531,8 @@ bool EventHandler::handleMousePressEvent(const MouseEventWithHitTestResults& eve
 
     cancelFakeMouseMoveEvent();
 
+    m_frame->document()->updateLayoutIgnorePendingStylesheets();
+
     if (ScrollView* scrollView = m_frame->view()) {
         if (scrollView->isPointInScrollbarCorner(event.event().position()))
             return false;
@@ -697,7 +699,7 @@ bool EventHandler::eventMayStartDrag(const PlatformMouseEvent& event) const
     HitTestResult result(view->windowToContents(event.position()));
     m_frame->contentRenderer()->layer()->hitTest(request, result);
     DragState state;
-    return result.innerNode() && page->dragController()->draggableNode(m_frame, result.innerNode(), result.point(), state);
+    return result.innerNode() && page->dragController()->draggableNode(m_frame, result.innerNode(), roundedIntPoint(result.point()), state);
 }
 
 void EventHandler::updateSelectionForMouseDrag()
@@ -1031,7 +1033,7 @@ HitTestResult EventHandler::hitTestResultAtPoint(const LayoutPoint& point, bool
         result = widgetHitTestResult;
 
         if (testScrollbars == ShouldHitTestScrollbars) {
-            Scrollbar* eventScrollbar = view->scrollbarAtPoint(point);
+            Scrollbar* eventScrollbar = view->scrollbarAtPoint(roundedIntPoint(point));
             if (eventScrollbar)
                 result.setScrollbar(eventScrollbar);
         }
@@ -1046,7 +1048,7 @@ HitTestResult EventHandler::hitTestResultAtPoint(const LayoutPoint& point, bool
             FrameView* resultView = resultFrame->view();
             FrameView* mainView = mainFrame->view();
             if (resultView && mainView) {
-                LayoutPoint mainFramePoint = mainView->rootViewToContents(resultView->contentsToRootView(result.point()));
+                IntPoint mainFramePoint = mainView->rootViewToContents(resultView->contentsToRootView(roundedIntPoint(result.point())));
                 result = mainFrame->eventHandler()->hitTestResultAtPoint(mainFramePoint, allowShadowContent, ignoreClipping, testScrollbars, hitType, padding);
             }
         }
@@ -1265,7 +1267,7 @@ OptionalCursor EventHandler::selectCursor(const MouseEventWithHitTestResults& ev
 
     if (renderer) {
         Cursor overrideCursor;
-        switch (renderer->getCursor(event.localPoint(), overrideCursor)) {
+        switch (renderer->getCursor(roundedIntPoint(event.localPoint()), overrideCursor)) {
         case SetCursorBasedOnStyle:
             break;
         case SetCursor:
@@ -2363,14 +2365,8 @@ bool EventHandler::handleGestureEvent(const PlatformGestureEvent& gestureEvent)
     }
     case PlatformEvent::GestureDoubleTap:
     case PlatformEvent::GestureScrollBegin:
-    case PlatformEvent::GestureScrollEnd: {
-        FrameView* view = m_frame->view();
-        if (!view)
-            return false;
-
-        view->handleGestureEvent(gestureEvent);
-        return true;
-    }
+    case PlatformEvent::GestureScrollEnd:
+        break;
     default:
         ASSERT_NOT_REACHED();
     }
diff --git a/Source/WebCore/page/EventSource.cpp b/Source/WebCore/page/EventSource.cpp
index ea06600b1..543f1e1ac 100644
--- a/Source/WebCore/page/EventSource.cpp
+++ b/Source/WebCore/page/EventSource.cpp
@@ -98,6 +98,7 @@ PassRefPtr<EventSource> EventSource::create(ScriptExecutionContext* context, con
 
     source->setPendingActivity(source.get());
     source->connect();
+    source->suspendIfNeeded();
 
     return source.release();
 }
diff --git a/Source/WebCore/page/FocusController.cpp b/Source/WebCore/page/FocusController.cpp
index 51426a308..aa98c0249 100644
--- a/Source/WebCore/page/FocusController.cpp
+++ b/Source/WebCore/page/FocusController.cpp
@@ -54,6 +54,7 @@
 #include "ScrollAnimator.h"
 #include "Settings.h"
 #include "ShadowRoot.h"
+#include "ShadowRootList.h"
 #include "SpatialNavigation.h"
 #include "Widget.h"
 #include "htmlediting.h" // For firstPositionInOrBeforeNode
@@ -154,7 +155,7 @@ void FocusController::setFocused(bool focused)
 
 static inline ShadowRoot* shadowRoot(Node* node)
 {
-    return node->isElementNode() ? toElement(node)->shadowRoot() : 0;
+    return node->isElementNode() && toElement(node)->hasShadowRoot() ? toElement(node)->shadowRootList()->youngestShadowRoot() : 0;
 }
 
 static inline bool isTreeScopeOwner(Node* node)
diff --git a/Source/WebCore/page/Frame.cpp b/Source/WebCore/page/Frame.cpp
index 72ddd62cb..ee3c068c8 100644
--- a/Source/WebCore/page/Frame.cpp
+++ b/Source/WebCore/page/Frame.cpp
@@ -229,6 +229,15 @@ Frame::~Frame()
     }
 }
 
+bool Frame::inScope(TreeScope* scope) const
+{
+    ASSERT(scope);
+    HTMLFrameOwnerElement* owner = document()->ownerElement();
+    // Scoping test should be done only for child frames.
+    ASSERT(owner);
+    return owner->treeScope() == scope;
+}
+
 void Frame::addDestructionObserver(FrameDestructionObserver* observer)
 {
     m_destructionObservers.add(observer);
@@ -293,8 +302,10 @@ void Frame::setDocument(PassRefPtr<Document> newDoc)
     if (m_doc)
         m_doc->updateViewportArguments();
 
-    if (m_page && m_page->mainFrame() == this)
+    if (m_page && m_page->mainFrame() == this) {
         notifyChromeClientWheelEventHandlerCountChanged();
+        notifyChromeClientTouchEventHandlerCountChanged();
+    }
 }
 
 #if ENABLE(ORIENTATION_EVENTS)
@@ -481,7 +492,7 @@ String Frame::matchLabelsAgainstElement(const Vector<String>& labels, Element* e
     // See 7538330 for one popular site that benefits from the id element check.
     // FIXME: This code is mirrored in FrameMac.mm. It would be nice to make the Mac code call the platform-agnostic
     // code, which would require converting the NSArray of NSStrings to a Vector of Strings somewhere along the way.
-    String resultFromNameAttribute = matchLabelsAgainstString(labels, element->getAttribute(nameAttr));
+    String resultFromNameAttribute = matchLabelsAgainstString(labels, element->getNameAttribute());
     if (!resultFromNameAttribute.isEmpty())
         return resultFromNameAttribute;
     
@@ -658,21 +669,19 @@ DOMWindow* Frame::domWindow() const
     return m_domWindow.get();
 }
 
-void Frame::pageDestroyed()
+void Frame::willDetachPage()
 {
-    // FIXME: Rename this function, since it's called not only from Page destructor, but in several other cases.
-    // This cleanup is needed whenever we remove a frame from page.
-
     if (Frame* parent = tree()->parent())
         parent->loader()->checkLoadComplete();
 
-    if (m_domWindow) {
-        m_domWindow->resetGeolocation();
 #if ENABLE(NOTIFICATIONS)
+    if (m_domWindow)
         m_domWindow->resetNotifications();
 #endif
-        m_domWindow->pageDestroyed();
-    }
+
+    HashSet<FrameDestructionObserver*>::iterator stop = m_destructionObservers.end();
+    for (HashSet<FrameDestructionObserver*>::iterator it = m_destructionObservers.begin(); it != stop; ++it)
+        (*it)->willDetachPage();
 
     // FIXME: It's unclear as to why this is called more than once, but it is,
     // so page() could be NULL.
@@ -681,8 +690,6 @@ void Frame::pageDestroyed()
 
     script()->clearScriptObjects();
     script()->updatePlatformScriptObjects();
-
-    detachFromPage();
 }
 
 void Frame::disconnectOwnerElement()
@@ -716,17 +723,16 @@ void Frame::transferChildFrameToNewDocument()
              m_page->decrementFrameCount();
         }
 
-        // FIXME: We should ideally allow existing Geolocation activities to continue
-        // when the Geolocation's iframe is reparented.
-        // See https://bugs.webkit.org/show_bug.cgi?id=55577
-        // and https://bugs.webkit.org/show_bug.cgi?id=52877
         if (m_domWindow) {
-            m_domWindow->resetGeolocation();
 #if ENABLE(NOTIFICATIONS)
             m_domWindow->resetNotifications();
 #endif
         }
 
+        HashSet<FrameDestructionObserver*>::iterator stop = m_destructionObservers.end();
+        for (HashSet<FrameDestructionObserver*>::iterator it = m_destructionObservers.begin(); it != stop; ++it)
+            (*it)->willDetachPage();
+
         m_page = newPage;
 
         if (newPage)
@@ -1020,16 +1026,30 @@ void Frame::notifyChromeClientWheelEventHandlerCountChanged() const
 {
     // Ensure that this method is being called on the main frame of the page.
     ASSERT(m_page && m_page->mainFrame() == this);
-    
+
     unsigned count = 0;
     for (const Frame* frame = this; frame; frame = frame->tree()->traverseNext()) {
         if (frame->document())
             count += frame->document()->wheelEventHandlerCount();
     }
-    
+
     m_page->chrome()->client()->numWheelEventHandlersChanged(count);
 }
 
+void Frame::notifyChromeClientTouchEventHandlerCountChanged() const
+{
+    // Ensure that this method is being called on the main frame of the page.
+    ASSERT(m_page && m_page->mainFrame() == this);
+
+    unsigned count = 0;
+    for (const Frame* frame = this; frame; frame = frame->tree()->traverseNext()) {
+        if (frame->document())
+            count += frame->document()->touchEventHandlerCount();
+    }
+
+    m_page->chrome()->client()->numTouchEventHandlersChanged(count);
+}
+
 #if !PLATFORM(MAC) && !PLATFORM(WIN)
 struct ScopedFramePaintingState {
     ScopedFramePaintingState(Frame* theFrame, RenderObject* theRenderer)
@@ -1072,7 +1092,7 @@ DragImageRef Frame::nodeImage(Node* node)
     m_view->setNodeToDraw(node); // Enable special sub-tree drawing mode.
 
     LayoutRect topLevelRect;
-    IntRect paintingRect = renderer->paintingRootRect(topLevelRect);
+    IntRect paintingRect = pixelSnappedIntRect(renderer->paintingRootRect(topLevelRect));
 
     OwnPtr<ImageBuffer> buffer(ImageBuffer::create(paintingRect.size()));
     if (!buffer)
diff --git a/Source/WebCore/page/Frame.h b/Source/WebCore/page/Frame.h
index 18da5f36a..e06c0dfc7 100644
--- a/Source/WebCore/page/Frame.h
+++ b/Source/WebCore/page/Frame.h
@@ -74,6 +74,8 @@ namespace WebCore {
     class TiledBackingStoreClient { };
 #endif
 
+    class TreeScope;
+
     class Frame : public RefCounted<Frame>, public TiledBackingStoreClient {
     public:
         static PassRefPtr<Frame> create(Page*, HTMLFrameOwnerElement*, FrameLoaderClient*);
@@ -89,8 +91,8 @@ namespace WebCore {
         void addDestructionObserver(FrameDestructionObserver*);
         void removeDestructionObserver(FrameDestructionObserver*);
 
+        void willDetachPage();
         void detachFromPage();
-        void pageDestroyed();
         void disconnectOwnerElement();
 
         Page* page() const;
@@ -123,6 +125,7 @@ namespace WebCore {
         void setIsDisconnected(bool);
         bool excludeFromTextSearch() const;
         void setExcludeFromTextSearch(bool);
+        bool inScope(TreeScope*) const;
 
         void injectUserScripts(UserScriptInjectionTime);
         
@@ -195,6 +198,7 @@ namespace WebCore {
 
         // Should only be called on the main frame of a page.
         void notifyChromeClientWheelEventHandlerCountChanged() const;
+        void notifyChromeClientTouchEventHandlerCountChanged() const;
 
     // ========
 
diff --git a/Source/WebCore/page/FrameDestructionObserver.cpp b/Source/WebCore/page/FrameDestructionObserver.cpp
index 358bf948e..94bf33687 100644
--- a/Source/WebCore/page/FrameDestructionObserver.cpp
+++ b/Source/WebCore/page/FrameDestructionObserver.cpp
@@ -58,4 +58,9 @@ void FrameDestructionObserver::frameDestroyed()
     m_frame = 0;
 }
 
+void FrameDestructionObserver::willDetachPage()
+{
+    // Subclasses should override this function to handle this notification.
+}
+
 }
diff --git a/Source/WebCore/page/FrameDestructionObserver.h b/Source/WebCore/page/FrameDestructionObserver.h
index 7110922ad..8989e4a9f 100644
--- a/Source/WebCore/page/FrameDestructionObserver.h
+++ b/Source/WebCore/page/FrameDestructionObserver.h
@@ -33,7 +33,10 @@ class Frame;
 class FrameDestructionObserver {
 public:
     explicit FrameDestructionObserver(Frame*);
+
     virtual void frameDestroyed();
+    virtual void willDetachPage();
+
     Frame* frame() const { return m_frame; }
 
 protected:
diff --git a/Source/WebCore/page/FrameTree.cpp b/Source/WebCore/page/FrameTree.cpp
index fa4982c9b..ced620072 100644
--- a/Source/WebCore/page/FrameTree.cpp
+++ b/Source/WebCore/page/FrameTree.cpp
@@ -103,7 +103,7 @@ void FrameTree::actuallyAppendChild(PassRefPtr<Frame> child)
     } else
         m_firstChild = child;
 
-    m_childCount++;
+    m_scopedChildCount = invalidCount;
 
     ASSERT(!m_lastChild->tree()->m_nextSibling);
 }
@@ -125,7 +125,7 @@ void FrameTree::removeChild(Frame* child)
     child->tree()->m_previousSibling = 0;
     child->tree()->m_nextSibling = 0;
 
-    m_childCount--;
+    m_scopedChildCount = invalidCount;
 }
 
 AtomicString FrameTree::uniqueChildName(const AtomicString& requestedName) const
@@ -177,6 +177,64 @@ AtomicString FrameTree::uniqueChildName(const AtomicString& requestedName) const
     return AtomicString(name);
 }
 
+inline Frame* FrameTree::scopedChild(unsigned index, TreeScope* scope) const
+{
+    unsigned scopedIndex = 0;
+    for (Frame* result = firstChild(); result; result = result->tree()->nextSibling()) {
+        if (result->inScope(scope)) {
+            if (scopedIndex == index)
+                return result;
+            scopedIndex++;
+        }
+    }
+
+    return 0;
+}
+
+inline Frame* FrameTree::scopedChild(const AtomicString& name, TreeScope* scope) const
+{
+    for (Frame* child = firstChild(); child; child = child->tree()->nextSibling())
+        if (child->tree()->uniqueName() == name && child->inScope(scope))
+            return child;
+    return 0;
+}
+
+inline unsigned FrameTree::scopedChildCount(TreeScope* scope) const
+{
+    unsigned scopedCount = 0;
+    for (Frame* result = firstChild(); result; result = result->tree()->nextSibling()) {
+        if (result->inScope(scope))
+            scopedCount++;
+    }
+
+    return scopedCount;
+}
+
+Frame* FrameTree::scopedChild(unsigned index) const
+{
+    return scopedChild(index, m_thisFrame->document());
+}
+
+Frame* FrameTree::scopedChild(const AtomicString& name) const
+{
+    return scopedChild(name, m_thisFrame->document());
+}
+
+unsigned FrameTree::scopedChildCount() const
+{
+    if (m_scopedChildCount == invalidCount)
+        m_scopedChildCount = scopedChildCount(m_thisFrame->document());
+    return m_scopedChildCount;
+}
+
+unsigned FrameTree::childCount() const
+{
+    unsigned count = 0;
+    for (Frame* result = firstChild(); result; result = result->tree()->nextSibling())
+        ++count;
+    return count;
+}
+
 Frame* FrameTree::child(unsigned index) const
 {
     Frame* result = firstChild();
diff --git a/Source/WebCore/page/FrameTree.h b/Source/WebCore/page/FrameTree.h
index d8291f7b6..5f9e317a9 100644
--- a/Source/WebCore/page/FrameTree.h
+++ b/Source/WebCore/page/FrameTree.h
@@ -20,23 +20,28 @@
 #ifndef FrameTree_h
 #define FrameTree_h
 
+#include <wtf/NotFound.h>
 #include <wtf/text/AtomicString.h>
 
 namespace WebCore {
 
     class Frame;
+    class TreeScope;
 
     class FrameTree {
         WTF_MAKE_NONCOPYABLE(FrameTree);
     public:
+        const static unsigned invalidCount = static_cast<unsigned>(WTF::notFound);
+
         FrameTree(Frame* thisFrame, Frame* parentFrame) 
             : m_thisFrame(thisFrame)
             , m_parent(parentFrame)
             , m_previousSibling(0)
             , m_lastChild(0)
-            , m_childCount(0)
+            , m_scopedChildCount(invalidCount)
         {
         }
+
         ~FrameTree();
 
         const AtomicString& name() const { return m_name; }
@@ -50,7 +55,6 @@ namespace WebCore {
         Frame* previousSibling() const { return m_previousSibling; }
         Frame* firstChild() const { return m_firstChild.get(); }
         Frame* lastChild() const { return m_lastChild; }
-        unsigned childCount() const { return m_childCount; }
 
         bool isDescendantOf(const Frame* ancestor) const;
         Frame* traverseNext(const Frame* stayWithin = 0) const;
@@ -65,15 +69,25 @@ namespace WebCore {
         Frame* child(unsigned index) const;
         Frame* child(const AtomicString& name) const;
         Frame* find(const AtomicString& name) const;
+        unsigned childCount() const;
 
         AtomicString uniqueChildName(const AtomicString& requestedName) const;
 
         Frame* top(bool checkForDisconnectedFrame = false) const;
 
+        Frame* scopedChild(unsigned index) const;
+        Frame* scopedChild(const AtomicString& name) const;
+        unsigned scopedChildCount() const;
+
     private:
         Frame* deepLastChild() const;
         void actuallyAppendChild(PassRefPtr<Frame>);
 
+        bool scopedBy(TreeScope*) const;
+        Frame* scopedChild(unsigned index, TreeScope*) const;
+        Frame* scopedChild(const AtomicString& name, TreeScope*) const;
+        unsigned scopedChildCount(TreeScope*) const;
+
         Frame* m_thisFrame;
 
         Frame* m_parent;
@@ -85,7 +99,7 @@ namespace WebCore {
         Frame* m_previousSibling;
         RefPtr<Frame> m_firstChild;
         Frame* m_lastChild;
-        unsigned m_childCount;
+        mutable unsigned m_scopedChildCount;
     };
 
 } // namespace WebCore
diff --git a/Source/WebCore/page/FrameView.cpp b/Source/WebCore/page/FrameView.cpp
index baba068e4..024c484f0 100644
--- a/Source/WebCore/page/FrameView.cpp
+++ b/Source/WebCore/page/FrameView.cpp
@@ -61,6 +61,7 @@
 #include "RenderTheme.h"
 #include "RenderView.h"
 #include "ScrollAnimator.h"
+#include "ScrollingCoordinator.h"
 #include "Settings.h"
 #include "TextResourceDecoder.h"
 
@@ -70,9 +71,6 @@
 
 #if USE(ACCELERATED_COMPOSITING)
 #include "RenderLayerCompositor.h"
-#if PLATFORM(CHROMIUM)
-#include "TraceEvent.h"
-#endif
 #endif
 
 #if ENABLE(SVG)
@@ -85,10 +83,6 @@
 #include "TiledBackingStore.h"
 #endif
 
-#if ENABLE(THREADED_SCROLLING)
-#include "ScrollingCoordinator.h"
-#endif
-
 namespace WebCore {
 
 using namespace HTMLNames;
@@ -296,8 +290,6 @@ void FrameView::init()
             setCanHaveScrollbars(false);
         LayoutUnit marginWidth = frameElt->marginWidth();
         LayoutUnit marginHeight = frameElt->marginHeight();
-        // FIXME: Change to roughlyEquals or >= 0 when we move to floats. 
-        // See https://bugs.webkit.org/show_bug.cgi?id=66148
         if (marginWidth != -1)
             setMarginWidth(marginWidth);
         if (marginHeight != -1)
@@ -327,6 +319,13 @@ void FrameView::recalculateScrollbarOverlayStyle()
     ScrollbarOverlayStyle overlayStyle = ScrollbarOverlayStyleDefault;
 
     Color backgroundColor = documentBackgroundColor();
+#if USE(ACCELERATED_COMPOSITING)
+    if (RenderView* root = rootRenderer(this)) {
+        RenderLayerCompositor* compositor = root->compositor();
+        compositor->documentBackgroundColorDidChange();
+    }
+#endif
+
     if (backgroundColor.isValid()) {
         // Reduce the background color from RGB to a lightness value
         // and determine which scrollbar style to use based on a lightness
@@ -1222,26 +1221,6 @@ void FrameView::removeWidgetToUpdate(RenderEmbeddedObject* object)
     m_widgetUpdateSet->remove(object);
 }
 
-void FrameView::zoomAnimatorTransformChanged(float scale, float x, float y, ZoomAnimationState state)
-{
-    if (state == ZoomAnimationFinishing) {
-        if (Page* page = m_frame->page())
-            page->setPageScaleFactor(page->pageScaleFactor() * scale, IntPoint(scale * scrollX() - x, scale * scrollY() - y));
-        scrollAnimator()->resetZoom();
-    }
-
-#if USE(ACCELERATED_COMPOSITING)
-    if (RenderView* root = rootRenderer(this)) {
-        if (root->usesCompositing()) {
-            root->compositor()->scheduleLayerFlush();
-#if PLATFORM(CHROMIUM)
-            TRACE_EVENT("FrameView::zoomAnimatorTransformChanged", this, 0);
-#endif
-        }
-    }
-#endif
-}
-
 void FrameView::setMediaType(const String& mediaType)
 {
     m_mediaType = mediaType;
@@ -1328,32 +1307,58 @@ void FrameView::setCannotBlitToWindow()
 
 void FrameView::addSlowRepaintObject()
 {
-    if (!m_slowRepaintObjectCount)
+    if (!m_slowRepaintObjectCount++) {
         updateCanBlitOnScrollRecursively();
-    m_slowRepaintObjectCount++;
+
+        if (Page* page = m_frame->page()) {
+            if (ScrollingCoordinator* scrollingCoordinator = page->scrollingCoordinator())
+                scrollingCoordinator->frameViewHasSlowRepaintObjectsDidChange(this);
+        }
+    }
 }
 
 void FrameView::removeSlowRepaintObject()
 {
     ASSERT(m_slowRepaintObjectCount > 0);
     m_slowRepaintObjectCount--;
-    if (!m_slowRepaintObjectCount)
+    if (!m_slowRepaintObjectCount) {
         updateCanBlitOnScrollRecursively();
+
+        if (Page* page = m_frame->page()) {
+            if (ScrollingCoordinator* scrollingCoordinator = page->scrollingCoordinator())
+                scrollingCoordinator->frameViewHasSlowRepaintObjectsDidChange(this);
+        }
+    }
 }
 
 void FrameView::addFixedObject()
 {
-    if (!m_fixedObjectCount && platformWidget())
-        updateCanBlitOnScrollRecursively();
-    ++m_fixedObjectCount;
+    if (!m_fixedObjectCount++) {
+        if (platformWidget())
+            updateCanBlitOnScrollRecursively();
+
+        if (Page* page = m_frame->page()) {
+            if (ScrollingCoordinator* scrollingCoordinator = page->scrollingCoordinator())
+                scrollingCoordinator->frameViewHasFixedObjectsDidChange(this);
+        }
+    }
 }
 
 void FrameView::removeFixedObject()
 {
     ASSERT(m_fixedObjectCount > 0);
     --m_fixedObjectCount;
-    if (!m_fixedObjectCount)
+
+    if (!m_fixedObjectCount) {
+        if (Page* page = m_frame->page()) {
+            if (ScrollingCoordinator* scrollingCoordinator = page->scrollingCoordinator())
+                scrollingCoordinator->frameViewHasFixedObjectsDidChange(this);
+        }
+
+        // FIXME: In addFixedObject() we only call this if there's a platform widget,
+        // why isn't the same check being made here?
         updateCanBlitOnScrollRecursively();
+    }
 }
 
 int FrameView::scrollXForFixedPosition() const
@@ -1463,6 +1468,10 @@ bool FrameView::scrollContentsFastPath(const IntSize& scrollDelta, const IntRect
         RenderBox* renderBox = *it;
         if (renderBox->style()->position() != FixedPosition)
             continue;
+#if USE(ACCELERATED_COMPOSITING)
+        if (renderBox->layer()->isComposited())
+            continue;
+#endif
         IntRect updateRect = renderBox->layer()->repaintRectIncludingDescendants();
         updateRect = contentsToRootView(updateRect);
         if (!isCompositedContentLayer && clipsRepaints())
@@ -1740,6 +1749,20 @@ bool FrameView::shouldRubberBandInDirection(ScrollDirection direction) const
     return page->chrome()->client()->shouldRubberBandInDirection(direction);
 }
 
+bool FrameView::requestScrollPositionUpdate(const IntPoint& position)
+{
+#if ENABLE(THREADED_SCROLLING)
+    if (Page* page = m_frame->page()) {
+        if (ScrollingCoordinator* scrollingCoordinator = page->scrollingCoordinator())
+            return scrollingCoordinator->requestScrollPositionUpdate(this, position);
+    }
+#else
+    UNUSED_PARAM(position);
+#endif
+
+    return false;
+}
+
 HostWindow* FrameView::hostWindow() const
 {
     Page* page = frame() ? frame()->page() : 0;
@@ -1770,7 +1793,7 @@ void FrameView::repaintContentRectangle(const IntRect& r, bool immediate)
         if (m_repaintCount == cRepaintRectUnionThreshold) {
             IntRect unionedRect;
             for (unsigned i = 0; i < cRepaintRectUnionThreshold; ++i)
-                unionedRect.unite(m_repaintRects[i]);
+                unionedRect.unite(pixelSnappedIntRect(m_repaintRects[i]));
             m_repaintRects.clear();
             m_repaintRects.append(unionedRect);
         }
@@ -1885,11 +1908,11 @@ void FrameView::doDeferredRepaints()
     for (unsigned i = 0; i < size; i++) {
 #if USE(TILED_BACKING_STORE)
         if (frame()->tiledBackingStore()) {
-            frame()->tiledBackingStore()->invalidate(m_repaintRects[i]);
+            frame()->tiledBackingStore()->invalidate(pixelSnappedIntRect(m_repaintRects[i]));
             continue;
         }
 #endif
-        ScrollView::repaintContentRectangle(m_repaintRects[i], false);
+        ScrollView::repaintContentRectangle(pixelSnappedIntRect(m_repaintRects[i]), false);
     }
     m_repaintRects.clear();
     m_repaintCount = 0;
@@ -2080,8 +2103,11 @@ void FrameView::unscheduleRelayout()
 #if ENABLE(REQUEST_ANIMATION_FRAME)
 void FrameView::serviceScriptedAnimations(DOMTimeStamp time)
 {
-    Vector<RefPtr<Document> > documents;
+    Vector<AnimationController*> animations;
+    for (Frame* frame = m_frame.get(); frame; frame = frame->tree()->traverseNext())
+        frame->animation()->serviceAnimations();
 
+    Vector<RefPtr<Document> > documents;
     for (Frame* frame = m_frame.get(); frame; frame = frame->tree()->traverseNext())
         documents.append(frame->document());
 
@@ -2290,12 +2316,10 @@ void FrameView::performPostLayoutTasks()
             break;
     }
 
-#if ENABLE(THREADED_SCROLLING)
     if (Page* page = m_frame->page()) {
         if (ScrollingCoordinator* scrollingCoordinator = page->scrollingCoordinator())
             scrollingCoordinator->frameViewLayoutUpdated(this);
     }
-#endif
 
     scrollToAnchor();
 
@@ -2464,9 +2488,9 @@ IntRect FrameView::windowClipRectForLayer(const RenderLayer* layer, bool clipToL
     // Apply the clip from the layer.
     IntRect clipRect;
     if (clipToLayerContents)
-        clipRect = layer->childrenClipRect();
+        clipRect = pixelSnappedIntRect(layer->childrenClipRect());
     else
-        clipRect = layer->selfClipRect();
+        clipRect = pixelSnappedIntRect(layer->selfClipRect());
     clipRect = contentsToWindow(clipRect); 
     return intersection(clipRect, windowClipRect());
 }
@@ -2817,7 +2841,7 @@ void FrameView::paintContents(GraphicsContext* p, const IntRect& rect)
     if (!frame())
         return;
 
-    InspectorInstrumentationCookie cookie = InspectorInstrumentation::willPaint(m_frame.get(), rect);
+    InspectorInstrumentationCookie cookie = InspectorInstrumentation::willPaint(m_frame.get(), p, rect);
 
     Document* document = m_frame->document();
 
@@ -3293,6 +3317,30 @@ void FrameView::removeChild(Widget* widget)
     ScrollView::removeChild(widget);
 }
 
+bool FrameView::wheelEvent(const PlatformWheelEvent& wheelEvent)
+{
+    // We don't allow mouse wheeling to happen in a ScrollView that has had its scrollbars explicitly disabled.
+    if (!canHaveScrollbars())
+        return false;
+
+#if !PLATFORM(WX)
+    if (platformWidget())
+        return false;
+#endif
+
+#if ENABLE(THREADED_SCROLLING)
+    if (Page* page = m_frame->page()) {
+        if (ScrollingCoordinator* scrollingCoordinator = page->scrollingCoordinator()) {
+            if (scrollingCoordinator->coordinatesScrollingForFrameView(this))
+                return scrollingCoordinator->handleWheelEvent(this, wheelEvent);
+        }
+    }
+#endif
+
+    return ScrollableArea::handleWheelEvent(wheelEvent);
+}
+
+
 bool FrameView::isVerticalDocument() const
 {
     RenderView* root = rootRenderer(this);
diff --git a/Source/WebCore/page/FrameView.h b/Source/WebCore/page/FrameView.h
index 51fe7c370..cfd35a36c 100644
--- a/Source/WebCore/page/FrameView.h
+++ b/Source/WebCore/page/FrameView.h
@@ -169,8 +169,7 @@ public:
     void scrollPositionChangedViaPlatformWidget();
     virtual void repaintFixedElementsAfterScrolling();
     virtual bool shouldRubberBandInDirection(ScrollDirection) const;
-
-    virtual void zoomAnimatorTransformChanged(float, float, float, ZoomAnimationState);
+    virtual bool requestScrollPositionUpdate(const IntPoint&) OVERRIDE;
 
     String mediaType() const;
     void setMediaType(const String&);
@@ -184,9 +183,11 @@ public:
 
     void addSlowRepaintObject();
     void removeSlowRepaintObject();
+    bool hasSlowRepaintObjects() const { return m_slowRepaintObjectCount; }
 
     void addFixedObject();
     void removeFixedObject();
+    bool hasFixedObjects() const { return m_fixedObjectCount > 0; }
 
     // Functions for querying the current scrolled position, negating the effects of overhang
     // and adjusting for page scale.
@@ -315,6 +316,11 @@ public:
     virtual void addChild(PassRefPtr<Widget>) OVERRIDE;
     virtual void removeChild(Widget*) OVERRIDE;
 
+    // This function exists for ports that need to handle wheel events manually.
+    // On Mac WebKit1 the underlying NSScrollView just does the scrolling, but on most other platforms
+    // we need this function in order to do the scroll ourselves.
+    bool wheelEvent(const PlatformWheelEvent&);
+
 protected:
     virtual bool scrollContentsFastPath(const IntSize& scrollDelta, const IntRect& rectToScroll, const IntRect& clipRect);
     virtual void scrollContentsSlowPath(const IntRect& updateRect);
@@ -336,8 +342,6 @@ private:
     void updateCanBlitOnScrollRecursively();
     bool contentsInCompositedLayer() const;
 
-    bool hasFixedObjects() const { return m_fixedObjectCount > 0; }
-
     void applyOverflowToViewport(RenderObject*, ScrollbarMode& hMode, ScrollbarMode& vMode);
 
     void updateOverflowStatus(bool horizontalOverflow, bool verticalOverflow);
diff --git a/Source/WebCore/page/GestureTapHighlighter.cpp b/Source/WebCore/page/GestureTapHighlighter.cpp
index 2038b0af6..4ed7c55c2 100644
--- a/Source/WebCore/page/GestureTapHighlighter.cpp
+++ b/Source/WebCore/page/GestureTapHighlighter.cpp
@@ -55,7 +55,7 @@ inline LayoutPoint ownerFrameToMainFrameOffset(const RenderObject* o)
 
     Frame* mainFrame = containingFrame->page()->mainFrame();
 
-    LayoutPoint mainFramePoint = mainFrame->view()->rootViewToContents(containingFrame->view()->contentsToRootView(LayoutPoint()));
+    LayoutPoint mainFramePoint = mainFrame->view()->rootViewToContents(containingFrame->view()->contentsToRootView(IntPoint()));
     return mainFramePoint;
 }
 
@@ -95,8 +95,8 @@ inline bool strikes(const LayoutRect& a, const LayoutRect& b)
 
 inline void shiftXEdgesToContainIfStrikes(LayoutRect& rect, const LayoutRect& other)
 {
-    int leftSide = rect.x();
-    int rightSide = rect.maxX();
+    LayoutUnit leftSide = rect.x();
+    LayoutUnit rightSide = rect.maxX();
 
     if (!other.isEmpty() && strikes(rect, other)) {
         leftSide = std::min(leftSide, other.x());
@@ -146,7 +146,7 @@ Path pathForRenderer(RenderObject* o)
 
     // Merge all center boxes (all but the first and the last).
     LayoutRect mid;
-    for (int i = 1; i < rects.size() - 1; ++i)
+    for (size_t i = 1; i < rects.size() - 1; ++i)
         mid.uniteIfNonZero(rects.at(i));
 
     Vector<LayoutRect> drawableRects;
@@ -177,9 +177,9 @@ Path pathForRenderer(RenderObject* o)
         shiftXEdgesToContainIfStrikes(middle, drawableRects.at(2));
     }
 
-    for (int i = 0; i < drawableRects.size(); ++i) {
-        LayoutRect prev = (i - 1) >= 0 ? drawableRects.at(i - 1) : LayoutRect();
-        LayoutRect next = (i + 1) < drawableRects.size() ? drawableRects.at(i + 1) : LayoutRect();
+    for (size_t i = 0; i < drawableRects.size(); ++i) {
+        LayoutRect prev = i ? drawableRects.at(i - 1) : LayoutRect();
+        LayoutRect next = i < (drawableRects.size() - 1) ? drawableRects.at(i + 1) : LayoutRect();
         addHighlightRect(path, drawableRects.at(i), prev, next);
     }
 
diff --git a/Source/WebCore/page/History.cpp b/Source/WebCore/page/History.cpp
index a1f9a05f6..f38a8c92b 100644
--- a/Source/WebCore/page/History.cpp
+++ b/Source/WebCore/page/History.cpp
@@ -77,6 +77,11 @@ bool History::stateChanged() const
     return m_lastStateObjectRequested != stateInternal();
 }
 
+bool History::isSameAsCurrentState(SerializedScriptValue* state) const
+{
+    return state == stateInternal();
+}
+
 void History::back()
 {
     go(-1);
diff --git a/Source/WebCore/page/History.h b/Source/WebCore/page/History.h
index bd6f6aa21..889c37410 100644
--- a/Source/WebCore/page/History.h
+++ b/Source/WebCore/page/History.h
@@ -45,7 +45,6 @@ public:
 
     unsigned length() const;
     SerializedScriptValue* state();
-    bool stateChanged() const;
     void back();
     void forward();
     void go(int distance);
@@ -54,6 +53,9 @@ public:
     void forward(ScriptExecutionContext*);
     void go(ScriptExecutionContext*, int distance);
 
+    bool stateChanged() const;
+    bool isSameAsCurrentState(SerializedScriptValue*) const;
+
     enum StateObjectType {
         StateObjectPush,
         StateObjectReplace
diff --git a/Source/WebCore/page/History.idl b/Source/WebCore/page/History.idl
index f7036403a..6e8f6ab06 100644
--- a/Source/WebCore/page/History.idl
+++ b/Source/WebCore/page/History.idl
@@ -27,21 +27,21 @@ module window {
 
     interface [
 #if defined(V8_BINDING) && V8_BINDING
-        CheckDomainSecurity,
+        CheckSecurity,
 #endif
-        JSCustomGetOwnPropertySlotDelegate,
+        JSCustomGetOwnPropertySlotAndDescriptor,
         CustomNamedSetter,
         JSGenerateIsReachable=ImplFrame,
         CustomDeleteProperty,
-        CustomGetPropertyNames,
+        CustomEnumerateProperty,
         OmitConstructor
     ] History {
         readonly attribute unsigned long length;
         readonly attribute [CachedAttribute, Custom] SerializedScriptValue state;
 
-        [DoNotCheckDomainSecurity, CallWith=ScriptExecutionContext] void back();
-        [DoNotCheckDomainSecurity, CallWith=ScriptExecutionContext] void forward();
-        [DoNotCheckDomainSecurity, CallWith=ScriptExecutionContext] void go(in [Optional=CallWithDefaultValue] long distance);
+        [DoNotCheckSecurity, CallWith=ScriptExecutionContext] void back();
+        [DoNotCheckSecurity, CallWith=ScriptExecutionContext] void forward();
+        [DoNotCheckSecurity, CallWith=ScriptExecutionContext] void go(in [Optional=DefaultIsUndefined] long distance);
         
         [Custom, V8EnabledAtRuntime] void pushState(in any data, in DOMString title, in [Optional] DOMString url)
             raises(DOMException);
diff --git a/Source/WebCore/page/Location.idl b/Source/WebCore/page/Location.idl
index d5d27e2c6..4f196fc0d 100644
--- a/Source/WebCore/page/Location.idl
+++ b/Source/WebCore/page/Location.idl
@@ -30,25 +30,26 @@ module window {
 
     interface [
 #if defined(V8_BINDING) && V8_BINDING
-        CheckDomainSecurity,
+        CheckSecurity,
 #endif
-        JSCustomGetOwnPropertySlotDelegate,
+        JSCustomGetOwnPropertySlotAndDescriptor,
         CustomNamedSetter,
         JSGenerateIsReachable=ImplFrame,
         CustomDeleteProperty,
-        CustomGetPropertyNames,
+        CustomEnumerateProperty,
         JSCustomDefineOwnProperty,
-        JSCustomPrototypePutDelegate,
-        JSCustomPrototypeDefineOwnProperty,
-        OmitConstructor
+        JSCustomNamedGetterOnPrototype,
+        JSCustomDefineOwnPropertyOnPrototype,
+        OmitConstructor,
+        V8CustomToJSObject
     ] Location {
 #if !defined(LANGUAGE_CPP) || !LANGUAGE_CPP
-                 attribute [DoNotCheckDomainSecurityOnSetter, CustomSetter, V8Unforgeable] DOMString href;
+                 attribute [DoNotCheckSecurityOnSetter, CustomSetter, V8Unforgeable] DOMString href;
 #endif
 
-        [Custom, V8OnInstance] void assign(in [Optional=CallWithDefaultValue] DOMString url);
-        [Custom, V8OnInstance] void replace(in [Optional=CallWithDefaultValue] DOMString url);
-        [Custom, V8OnInstance] void reload();
+        [Custom, V8Unforgeable] void assign(in [Optional=DefaultIsUndefined] DOMString url);
+        [Custom, V8Unforgeable] void replace(in [Optional=DefaultIsUndefined] DOMString url);
+        [Custom, V8Unforgeable] void reload();
 
         // URI decomposition attributes
 #if !defined(LANGUAGE_CPP) || !LANGUAGE_CPP
@@ -64,10 +65,10 @@ module window {
 #endif
 
 #if defined(LANGUAGE_JAVASCRIPT) && LANGUAGE_JAVASCRIPT
-        [NotEnumerable, Custom, V8OnInstance, V8ReadOnly, ImplementedAs=toStringFunction] DOMString toString();
+        [NotEnumerable, Custom, V8Unforgeable, V8ReadOnly, ImplementedAs=toStringFunction] DOMString toString();
 #endif
 #if defined(V8_BINDING) && V8_BINDING
-        [NotEnumerable, Custom, V8OnInstance, V8ReadOnly] DOMObject valueOf();
+        [NotEnumerable, Custom, V8Unforgeable, V8ReadOnly] DOMObject valueOf();
 #endif
     };
 
diff --git a/Source/WebCore/page/Navigator.cpp b/Source/WebCore/page/Navigator.cpp
index b394cd8d1..76328a7a5 100644
--- a/Source/WebCore/page/Navigator.cpp
+++ b/Source/WebCore/page/Navigator.cpp
@@ -23,39 +23,23 @@
 #include "config.h"
 #include "Navigator.h"
 
-#include "Chrome.h"
 #include "CookieJar.h"
 #include "DOMMimeTypeArray.h"
 #include "DOMPluginArray.h"
 #include "Document.h"
-#include "ExceptionCode.h"
 #include "Frame.h"
 #include "FrameLoader.h"
 #include "FrameLoaderClient.h"
 #include "Geolocation.h"
+#include "Page.h"
 #include "PointerLock.h"
-#include "KURL.h"
 #include "Language.h"
-#include "Page.h"
-#include "PageGroup.h"
-#include "PlatformString.h"
 #include "PluginData.h"
 #include "Settings.h"
 #include "StorageNamespace.h"
 #include <wtf/HashSet.h>
 #include <wtf/StdLibExtras.h>
 
-#if ENABLE(GAMEPAD)
-#include "GamepadList.h"
-#include "Gamepads.h"
-#endif
-
-#if ENABLE(MEDIA_STREAM)
-#include "NavigatorUserMediaErrorCallback.h"
-#include "NavigatorUserMediaSuccessCallback.h"
-#include "UserMediaRequest.h"
-#endif
-
 namespace WebCore {
 
 Navigator::Navigator(Frame* frame)
@@ -67,10 +51,15 @@ Navigator::~Navigator()
 {
 }
 
-void Navigator::resetGeolocation()
+void Navigator::provideSupplement(const AtomicString& name, PassOwnPtr<NavigatorSupplement> supplement)
 {
-    if (m_geolocation)
-        m_geolocation->reset();
+    ASSERT(!m_suppliments.get(name.impl()));
+    m_suppliments.set(name.impl(), supplement);
+}
+
+NavigatorSupplement* Navigator::requireSupplement(const AtomicString& name)
+{
+    return m_suppliments.get(name.impl());
 }
 
 // If this function returns true, we need to hide the substring "4." that would otherwise
@@ -151,13 +140,6 @@ bool Navigator::javaEnabled() const
     return m_frame->settings()->isJavaEnabled();
 }
 
-Geolocation* Navigator::geolocation() const
-{
-    if (!m_geolocation)
-        m_geolocation = Geolocation::create(m_frame);
-    return m_geolocation.get();
-}
-
 #if ENABLE(POINTER_LOCK)
 PointerLock* Navigator::webkitPointer() const
 {
@@ -172,133 +154,4 @@ void Navigator::getStorageUpdates()
     // FIXME: Remove this method or rename to yieldForStorageUpdates.
 }
 
-#if ENABLE(REGISTER_PROTOCOL_HANDLER)
-static HashSet<String>* protocolWhitelist;
-
-static void initProtocolHandlerWhitelist()
-{
-    protocolWhitelist = new HashSet<String>;
-    static const char* protocols[] = {
-        "irc",
-        "mailto",
-        "mms",
-        "news",
-        "nntp",
-        "sms",
-        "smsto",
-        "tel",
-        "urn",
-        "webcal",
-    };
-    for (size_t i = 0; i < WTF_ARRAY_LENGTH(protocols); ++i)
-        protocolWhitelist->add(protocols[i]);
-}
-
-static bool verifyCustomHandlerURL(const String& baseURL, const String& url, ExceptionCode& ec)
-{
-    // The specification requires that it is a SYNTAX_ERR if the "%s" token is
-    // not present.
-    static const char token[] = "%s";
-    int index = url.find(token);
-    if (-1 == index) {
-        ec = SYNTAX_ERR;
-        return false;
-    }
-
-    // It is also a SYNTAX_ERR if the custom handler URL, as created by removing
-    // the "%s" token and prepending the base url, does not resolve.
-    String newURL = url;
-    newURL.remove(index, WTF_ARRAY_LENGTH(token) - 1);
-
-    KURL base(ParsedURLString, baseURL);
-    KURL kurl(base, newURL);
-
-    if (kurl.isEmpty() || !kurl.isValid()) {
-        ec = SYNTAX_ERR;
-        return false;
-    }
-
-    return true;
-}
-
-static bool isProtocolWhitelisted(const String& scheme)
-{
-    if (!protocolWhitelist)
-        initProtocolHandlerWhitelist();
-    return protocolWhitelist->contains(scheme);
-}
-
-static bool verifyProtocolHandlerScheme(const String& scheme, ExceptionCode& ec)
-{
-    if (scheme.startsWith("web+")) {
-        if (isValidProtocol(scheme))
-            return true;
-        ec = SECURITY_ERR;
-        return false;
-    }
-
-    if (isProtocolWhitelisted(scheme))
-        return true;
-    ec = SECURITY_ERR;
-    return false;
-}
-
-void Navigator::registerProtocolHandler(const String& scheme, const String& url, const String& title, ExceptionCode& ec)
-{
-    if (!m_frame)
-        return;
-
-    Document* document = m_frame->document();
-    if (!document)
-        return;
-
-    String baseURL = document->baseURL().baseAsString();
-
-    if (!verifyCustomHandlerURL(baseURL, url, ec))
-        return;
-
-    if (!verifyProtocolHandlerScheme(scheme, ec))
-        return;
-
-    Page* page = m_frame->page();
-    if (!page)
-        return;
-
-    page->chrome()->registerProtocolHandler(scheme, baseURL, url, m_frame->displayStringModifiedByEncoding(title));
-}
-#endif
-
-#if ENABLE(MEDIA_STREAM)
-void Navigator::webkitGetUserMedia(const String& options, PassRefPtr<NavigatorUserMediaSuccessCallback> successCallback, PassRefPtr<NavigatorUserMediaErrorCallback> errorCallback, ExceptionCode& ec)
-{
-    if (!successCallback)
-        return;
-
-    if (!m_frame)
-        return;
-
-    Page* page = m_frame->page();
-    if (!page)
-        return;
-
-    RefPtr<UserMediaRequest> request = UserMediaRequest::create(m_frame->document(), page->userMediaClient(), options, successCallback, errorCallback);
-    if (!request) {
-        ec = NOT_SUPPORTED_ERR;
-        return;
-    }
-
-    request->start();
-}
-#endif
-
-#if ENABLE(GAMEPAD)
-GamepadList* Navigator::gamepads()
-{
-    if (!m_gamepads)
-        m_gamepads = GamepadList::create();
-    sampleGamepads(m_gamepads.get());
-    return m_gamepads.get();
-}
-#endif
-
 } // namespace WebCore
diff --git a/Source/WebCore/page/Navigator.h b/Source/WebCore/page/Navigator.h
index 07c9d2b4b..750eeaa57 100644
--- a/Source/WebCore/page/Navigator.h
+++ b/Source/WebCore/page/Navigator.h
@@ -22,7 +22,9 @@
 
 #include "DOMWindowProperty.h"
 #include "NavigatorBase.h"
+#include "NavigatorSupplement.h"
 #include <wtf/Forward.h>
+#include <wtf/HashMap.h>
 #include <wtf/PassRefPtr.h>
 #include <wtf/RefCounted.h>
 #include <wtf/RefPtr.h>
@@ -32,11 +34,7 @@ namespace WebCore {
 class DOMMimeTypeArray;
 class DOMPluginArray;
 class Frame;
-class GamepadList;
-class Geolocation;
 class PointerLock;
-class NavigatorUserMediaErrorCallback;
-class NavigatorUserMediaSuccessCallback;
 class PluginData;
 
 typedef int ExceptionCode;
@@ -46,8 +44,6 @@ public:
     static PassRefPtr<Navigator> create(Frame* frame) { return adoptRef(new Navigator(frame)); }
     virtual ~Navigator();
 
-    void resetGeolocation();
-
     String appVersion() const;
     String language() const;
     DOMPluginArray* plugins() const;
@@ -57,8 +53,6 @@ public:
 
     virtual String userAgent() const;
 
-    Geolocation* geolocation() const;
-
 #if ENABLE(POINTER_LOCK)
     PointerLock* webkitPointer() const;
 #endif
@@ -66,29 +60,17 @@ public:
     // Relinquishes the storage lock, if one exists.
     void getStorageUpdates();
 
-#if ENABLE(REGISTER_PROTOCOL_HANDLER)
-    void registerProtocolHandler(const String& scheme, const String& url, const String& title, ExceptionCode&);
-#endif
-
-#if ENABLE(MEDIA_STREAM)
-    virtual void webkitGetUserMedia(const String& options, PassRefPtr<NavigatorUserMediaSuccessCallback>, PassRefPtr<NavigatorUserMediaErrorCallback>, ExceptionCode&);
-#endif
-
-#if ENABLE(GAMEPAD)
-    // FIXME: This method should be in WebCore/Modules/gamepad.
-    GamepadList* gamepads();
-#endif
+    void provideSupplement(const AtomicString&, PassOwnPtr<NavigatorSupplement>);
+    NavigatorSupplement* requireSupplement(const AtomicString&);
 
 private:
     explicit Navigator(Frame*);
 
+    typedef HashMap<AtomicStringImpl*, OwnPtr<NavigatorSupplement> > NavigatorSupplementMap;
+    NavigatorSupplementMap m_suppliments;
+
     mutable RefPtr<DOMPluginArray> m_plugins;
     mutable RefPtr<DOMMimeTypeArray> m_mimeTypes;
-    mutable RefPtr<Geolocation> m_geolocation;
-#if ENABLE(GAMEPAD)
-    // FIXME: This state should be in WebCore/Modules/gamepad.
-    mutable RefPtr<GamepadList> m_gamepads;
-#endif
 #if ENABLE(POINTER_LOCK)
     mutable RefPtr<PointerLock> m_pointer;
 #endif
diff --git a/Source/WebCore/page/Navigator.idl b/Source/WebCore/page/Navigator.idl
index 213fab125..400d8e010 100644
--- a/Source/WebCore/page/Navigator.idl
+++ b/Source/WebCore/page/Navigator.idl
@@ -40,27 +40,11 @@ module window {
 
         readonly attribute boolean onLine;
 
-#if defined(ENABLE_GEOLOCATION) && ENABLE_GEOLOCATION
-        readonly attribute [V8EnabledAtRuntime] Geolocation geolocation;
-#endif
-
 #if defined(ENABLE_POINTER_LOCK) && ENABLE_POINTER_LOCK
         readonly attribute [V8EnabledAtRuntime] PointerLock webkitPointer;
 #endif
 
         void getStorageUpdates(); // FIXME: Remove this method or rename to yieldForStorageUpdates.
-
-#if defined(ENABLE_REGISTER_PROTOCOL_HANDLER) && ENABLE_REGISTER_PROTOCOL_HANDLER
-        void registerProtocolHandler(in DOMString scheme, in DOMString url, in DOMString title)
-            raises(DomException);
-#endif
-
-#if defined(ENABLE_MEDIA_STREAM) && ENABLE_MEDIA_STREAM
-        [Custom, V8EnabledAtRuntime] void webkitGetUserMedia(in DOMString options,
-                                                           in [Callback=FunctionOnly] NavigatorUserMediaSuccessCallback successCallback,
-                                                           in [Callback=FunctionOnly, Optional] NavigatorUserMediaErrorCallback errorCallback)
-            raises(DOMException);
-#endif
     };
 
 }
diff --git a/Source/WebCore/page/NavigatorRegisterProtocolHandler.cpp b/Source/WebCore/page/NavigatorRegisterProtocolHandler.cpp
new file mode 100644
index 000000000..a773b57dd
--- /dev/null
+++ b/Source/WebCore/page/NavigatorRegisterProtocolHandler.cpp
@@ -0,0 +1,145 @@
+/*
+ * Copyright (C) 2011, Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+ * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+ * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH
+ * DAMAGE.
+ */
+
+#include "config.h"
+#include "NavigatorRegisterProtocolHandler.h"
+
+#if ENABLE(REGISTER_PROTOCOL_HANDLER)
+
+#include "Chrome.h"
+#include "Document.h"
+#include "ExceptionCode.h"
+#include "Frame.h"
+#include "Navigator.h"
+#include "Page.h"
+#include <wtf/HashSet.h>
+
+namespace WebCore {
+
+static HashSet<String>* protocolWhitelist;
+
+static void initProtocolHandlerWhitelist()
+{
+    protocolWhitelist = new HashSet<String>;
+    static const char* protocols[] = {
+        "irc",
+        "mailto",
+        "mms",
+        "news",
+        "nntp",
+        "sms",
+        "smsto",
+        "tel",
+        "urn",
+        "webcal",
+    };
+    for (size_t i = 0; i < WTF_ARRAY_LENGTH(protocols); ++i)
+        protocolWhitelist->add(protocols[i]);
+}
+
+static bool verifyCustomHandlerURL(const String& baseURL, const String& url, ExceptionCode& ec)
+{
+    // The specification requires that it is a SYNTAX_ERR if the "%s" token is
+    // not present.
+    static const char token[] = "%s";
+    int index = url.find(token);
+    if (-1 == index) {
+        ec = SYNTAX_ERR;
+        return false;
+    }
+
+    // It is also a SYNTAX_ERR if the custom handler URL, as created by removing
+    // the "%s" token and prepending the base url, does not resolve.
+    String newURL = url;
+    newURL.remove(index, WTF_ARRAY_LENGTH(token) - 1);
+
+    KURL base(ParsedURLString, baseURL);
+    KURL kurl(base, newURL);
+
+    if (kurl.isEmpty() || !kurl.isValid()) {
+        ec = SYNTAX_ERR;
+        return false;
+    }
+
+    return true;
+}
+
+static bool isProtocolWhitelisted(const String& scheme)
+{
+    if (!protocolWhitelist)
+        initProtocolHandlerWhitelist();
+    return protocolWhitelist->contains(scheme);
+}
+
+static bool verifyProtocolHandlerScheme(const String& scheme, ExceptionCode& ec)
+{
+    if (scheme.startsWith("web+")) {
+        if (isValidProtocol(scheme))
+            return true;
+        ec = SECURITY_ERR;
+        return false;
+    }
+
+    if (isProtocolWhitelisted(scheme))
+        return true;
+    ec = SECURITY_ERR;
+    return false;
+}
+
+NavigatorRegisterProtocolHandler::NavigatorRegisterProtocolHandler()
+{
+}
+
+NavigatorRegisterProtocolHandler::~NavigatorRegisterProtocolHandler()
+{
+}
+
+void NavigatorRegisterProtocolHandler::registerProtocolHandler(Navigator* navigator, const String& scheme, const String& url, const String& title, ExceptionCode& ec)
+{
+    if (!navigator->frame())
+        return;
+
+    Document* document = navigator->frame()->document();
+    if (!document)
+        return;
+
+    String baseURL = document->baseURL().baseAsString();
+
+    if (!verifyCustomHandlerURL(baseURL, url, ec))
+        return;
+
+    if (!verifyProtocolHandlerScheme(scheme, ec))
+        return;
+
+    Page* page = navigator->frame()->page();
+    if (!page)
+        return;
+
+    page->chrome()->registerProtocolHandler(scheme, baseURL, url, navigator->frame()->displayStringModifiedByEncoding(title));
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(WEB_INTENTS)
diff --git a/Source/WebCore/page/NavigatorRegisterProtocolHandler.h b/Source/WebCore/page/NavigatorRegisterProtocolHandler.h
new file mode 100644
index 000000000..15e25ec01
--- /dev/null
+++ b/Source/WebCore/page/NavigatorRegisterProtocolHandler.h
@@ -0,0 +1,53 @@
+/*
+ * Copyright (C) 2011, Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+ * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+ * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH
+ * DAMAGE.
+ */
+
+#ifndef NavigatorRegisterProtocolHandler_h
+#define NavigatorRegisterProtocolHandler_h
+
+#if ENABLE(REGISTER_PROTOCOL_HANDLER)
+
+#include <wtf/PassRefPtr.h>
+#include <wtf/text/WTFString.h>
+
+namespace WebCore {
+
+class Navigator;
+
+typedef int ExceptionCode;
+
+class NavigatorRegisterProtocolHandler {
+public:
+    static void registerProtocolHandler(Navigator*, const String& scheme, const String& url, const String& title, ExceptionCode&);
+
+private:
+    NavigatorRegisterProtocolHandler();
+    ~NavigatorRegisterProtocolHandler();
+};
+
+} // namespace WebCore
+
+#endif // ENABLE(REGISTER_PROTOCOL_HANDLER)
+
+#endif // NavigatorRegisterProtocolHandler_h
diff --git a/Source/WebCore/page/NavigatorRegisterProtocolHandler.idl b/Source/WebCore/page/NavigatorRegisterProtocolHandler.idl
new file mode 100644
index 000000000..174d06343
--- /dev/null
+++ b/Source/WebCore/page/NavigatorRegisterProtocolHandler.idl
@@ -0,0 +1,30 @@
+/*
+    Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies)
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+module window {
+
+    interface [
+        Conditional=REGISTER_PROTOCOL_HANDLER,
+        Supplemental=Navigator
+    ] NavigatorRegisterProtocolHandler {
+        void registerProtocolHandler(in DOMString scheme, in DOMString url, in DOMString title)
+            raises(DOMException);
+    };
+
+}
diff --git a/Source/WebCore/page/NavigatorSupplement.cpp b/Source/WebCore/page/NavigatorSupplement.cpp
new file mode 100644
index 000000000..bb424d4d6
--- /dev/null
+++ b/Source/WebCore/page/NavigatorSupplement.cpp
@@ -0,0 +1,50 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *  * Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *  * Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE COPYRIGHT OWNER OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "NavigatorSupplement.h"
+
+#include "Navigator.h"
+#include <wtf/PassOwnPtr.h>
+
+namespace WebCore {
+
+NavigatorSupplement::~NavigatorSupplement()
+{
+}
+
+void NavigatorSupplement::provideTo(Navigator* navigator, const AtomicString& key, PassOwnPtr<NavigatorSupplement> supplement)
+{
+    navigator->provideSupplement(key, supplement);
+}
+
+NavigatorSupplement* NavigatorSupplement::from(Navigator* navigator, const AtomicString& name)
+{
+    if (!navigator)
+        return 0;
+    return navigator->requireSupplement(name);
+}
+
+} // namespace WebCore
diff --git a/Source/WebCore/page/NavigatorSupplement.h b/Source/WebCore/page/NavigatorSupplement.h
new file mode 100644
index 000000000..fc958fd96
--- /dev/null
+++ b/Source/WebCore/page/NavigatorSupplement.h
@@ -0,0 +1,48 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *  * Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *  * Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE COPYRIGHT OWNER OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef NavigatorSupplement_h
+#define NavigatorSupplement_h
+
+#include <wtf/Forward.h>
+#include <wtf/Noncopyable.h>
+#include <wtf/OwnPtr.h>
+#include <wtf/text/AtomicString.h>
+
+namespace WebCore {
+
+class Navigator;
+
+class NavigatorSupplement {
+public:
+    virtual ~NavigatorSupplement();
+
+    static void provideTo(Navigator*, const AtomicString&, PassOwnPtr<NavigatorSupplement>);
+    static NavigatorSupplement* from(Navigator*, const AtomicString&);
+};
+
+} // namespace WebCore
+
+#endif // NavigatorSupplement_h
diff --git a/Source/WebCore/page/Page.cpp b/Source/WebCore/page/Page.cpp
index 492e949ee..1bad0a47b 100644
--- a/Source/WebCore/page/Page.cpp
+++ b/Source/WebCore/page/Page.cpp
@@ -29,8 +29,6 @@
 #include "ContextMenuClient.h"
 #include "ContextMenuController.h"
 #include "DOMWindow.h"
-#include "DeviceMotionController.h"
-#include "DeviceOrientationController.h"
 #include "DocumentMarkerController.h"
 #include "DragController.h"
 #include "EditorClient.h"
@@ -53,8 +51,6 @@
 #include "MediaCanStartListener.h"
 #include "Navigator.h"
 #include "NetworkStateNotifier.h"
-#include "NotificationController.h"
-#include "NotificationPresenter.h"
 #include "PageGroup.h"
 #include "PluginData.h"
 #include "PluginView.h"
@@ -66,13 +62,13 @@
 #include "RenderWidget.h"
 #include "RuntimeEnabledFeatures.h"
 #include "SchemeRegistry.h"
+#include "ScrollingCoordinator.h"
 #include "Settings.h"
 #include "SharedBuffer.h"
-#include "SpeechInput.h"
-#include "SpeechInputClient.h"
 #include "StorageArea.h"
 #include "StorageNamespace.h"
 #include "TextResourceDecoder.h"
+#include "VoidCallback.h"
 #include "Widget.h"
 #include <wtf/HashMap.h>
 #include <wtf/RefCountedLeakCounter.h>
@@ -83,14 +79,6 @@
 #include "GeolocationController.h"
 #endif
 
-#if ENABLE(MEDIA_STREAM)
-#include "UserMediaClient.h"
-#endif
-
-#if ENABLE(THREADED_SCROLLING)
-#include "ScrollingCoordinator.h"
-#endif
-
 namespace WebCore {
 
 static HashSet<Page*>* allPages;
@@ -140,22 +128,9 @@ Page::Page(PageClients& pageClients)
 #if ENABLE(CLIENT_BASED_GEOLOCATION)
     , m_geolocationController(GeolocationController::create(this, pageClients.geolocationClient))
 #endif
-#if ENABLE(DEVICE_ORIENTATION)
-    , m_deviceMotionController(RuntimeEnabledFeatures::deviceMotionEnabled() ? DeviceMotionController::create(pageClients.deviceMotionClient) : nullptr)
-    , m_deviceOrientationController(RuntimeEnabledFeatures::deviceOrientationEnabled() ? DeviceOrientationController::create(this, pageClients.deviceOrientationClient) : nullptr)
-#endif
-#if ENABLE(NOTIFICATIONS)
-    , m_notificationController(NotificationController::create(this, pageClients.notificationClient))
-#endif
 #if ENABLE(POINTER_LOCK)
     , m_pointerLockController(PointerLockController::create(this))
 #endif
-#if ENABLE(INPUT_SPEECH)
-    , m_speechInputClient(pageClients.speechInputClient)
-#endif
-#if ENABLE(MEDIA_STREAM)
-    , m_userMediaClient(pageClients.userMediaClient)
-#endif
     , m_settings(Settings::create(this))
     , m_progress(ProgressTracker::create())
     , m_backForwardController(BackForwardController::create(this, pageClients.backForwardClient))
@@ -208,8 +183,10 @@ Page::~Page()
     setGroupName(String());
     allPages->remove(this);
     
-    for (Frame* frame = mainFrame(); frame; frame = frame->tree()->traverseNext())
-        frame->pageDestroyed();
+    for (Frame* frame = mainFrame(); frame; frame = frame->tree()->traverseNext()) {
+        frame->willDetachPage();
+        frame->detachFromPage();
+    }
 
     m_editorClient->pageDestroyed();
 
@@ -217,21 +194,15 @@ Page::~Page()
     m_inspectorController->inspectedPageDestroyed();
 #endif
 
-#if ENABLE(MEDIA_STREAM)
-    if (m_userMediaClient)
-        m_userMediaClient->pageDestroyed();
-#endif
-
-#if ENABLE(THREADED_SCROLLING)
     if (m_scrollingCoordinator)
         m_scrollingCoordinator->pageDestroyed();
-#endif
 
     backForward()->close();
 
 #ifndef NDEBUG
     pageCounter.decrement();
 #endif
+
 }
 
 ViewportArguments Page::viewportArguments() const
@@ -239,7 +210,6 @@ ViewportArguments Page::viewportArguments() const
     return mainFrame() && mainFrame()->document() ? mainFrame()->document()->viewportArguments() : ViewportArguments();
 }
 
-#if ENABLE(THREADED_SCROLLING)
 ScrollingCoordinator* Page::scrollingCoordinator()
 {
     if (!m_scrollingCoordinator && m_settings->scrollingCoordinatorEnabled())
@@ -247,7 +217,6 @@ ScrollingCoordinator* Page::scrollingCoordinator()
 
     return m_scrollingCoordinator.get();
 }
-#endif
 
 struct ViewModeInfo {
     const char* name;
@@ -974,16 +943,6 @@ double Page::minimumTimerInterval() const
     return m_minimumTimerInterval;
 }
 
-#if ENABLE(INPUT_SPEECH)
-SpeechInput* Page::speechInput()
-{
-    ASSERT(m_speechInputClient);
-    if (!m_speechInput.get())
-        m_speechInput = SpeechInput::create(m_speechInputClient);
-    return m_speechInput.get();
-}
-#endif
-
 void Page::dnsPrefetchingStateChanged()
 {
     for (Frame* frame = mainFrame(); frame; frame = frame->tree()->traverseNext())
@@ -1076,7 +1035,7 @@ void Page::addRelevantRepaintedObject(RenderObject* object, const IntRect& objec
 
     // The objects are only relevant if they are being painted within the viewRect().
     if (RenderView* view = object->view()) {
-        if (!objectPaintRect.intersects(view->viewRect()))
+        if (!objectPaintRect.intersects(pixelSnappedIntRect(view->viewRect())))
             return;
     }
 
@@ -1090,6 +1049,17 @@ void Page::addRelevantRepaintedObject(RenderObject* object, const IntRect& objec
     }
 }
 
+void Page::provideSupplement(const AtomicString& name, PassOwnPtr<PageSupplement> supplement)
+{
+    ASSERT(!m_supplements.get(name.impl()));
+    m_supplements.set(name.impl(), supplement);
+}
+
+PageSupplement* Page::requireSupplement(const AtomicString& name)
+{
+    return m_supplements.get(name.impl());
+}
+
 Page::PageClients::PageClients()
     : chromeClient(0)
     , contextMenuClient(0)
@@ -1097,11 +1067,6 @@ Page::PageClients::PageClients()
     , dragClient(0)
     , inspectorClient(0)
     , geolocationClient(0)
-    , deviceMotionClient(0)
-    , deviceOrientationClient(0)
-    , speechInputClient(0)
-    , notificationClient(0)
-    , userMediaClient(0)
 {
 }
 
diff --git a/Source/WebCore/page/Page.h b/Source/WebCore/page/Page.h
index 5f6e20649..685eed7e7 100644
--- a/Source/WebCore/page/Page.h
+++ b/Source/WebCore/page/Page.h
@@ -24,11 +24,13 @@
 #include "FrameLoaderTypes.h"
 #include "FindOptions.h"
 #include "LayoutTypes.h"
+#include "PageSupplement.h"
 #include "PageVisibilityState.h"
 #include "PlatformScreen.h"
 #include "PlatformString.h"
 #include "ViewportArguments.h"
 #include <wtf/Forward.h>
+#include <wtf/HashMap.h>
 #include <wtf/HashSet.h>
 #include <wtf/Noncopyable.h>
 
@@ -52,10 +54,6 @@ namespace WebCore {
     class ChromeClient;
     class ContextMenuClient;
     class ContextMenuController;
-    class DeviceMotionClient;
-    class DeviceMotionController;
-    class DeviceOrientationClient;
-    class DeviceOrientationController;
     class Document;
     class DragCaretController;
     class DragClient;
@@ -72,8 +70,6 @@ namespace WebCore {
     class InspectorController;
     class MediaCanStartListener;
     class Node;
-    class NotificationController;
-    class NotificationPresenter;
     class PageGroup;
     class PluginData;
     class PointerLockController;
@@ -85,13 +81,7 @@ namespace WebCore {
     class ScrollableArea;
     class ScrollingCoordinator;
     class Settings;
-    class SpeechInput;
-    class SpeechInputClient;
-    class UserMediaClient;
     class StorageNamespace;
-#if ENABLE(NOTIFICATIONS)
-    class NotificationPresenter;
-#endif
 
     typedef uint64_t LinkHash;
 
@@ -118,12 +108,7 @@ namespace WebCore {
             DragClient* dragClient;
             InspectorClient* inspectorClient;
             GeolocationClient* geolocationClient;
-            DeviceMotionClient* deviceMotionClient;
-            DeviceOrientationClient* deviceOrientationClient;
             RefPtr<BackForwardList> backForwardClient;
-            SpeechInputClient* speechInputClient;
-            NotificationPresenter* notificationClient;
-            UserMediaClient* userMediaClient;
         };
 
         Page(PageClients&);
@@ -184,25 +169,11 @@ namespace WebCore {
 #if ENABLE(CLIENT_BASED_GEOLOCATION)
         GeolocationController* geolocationController() const { return m_geolocationController.get(); }
 #endif
-#if ENABLE(DEVICE_ORIENTATION)
-        DeviceMotionController* deviceMotionController() const { return m_deviceMotionController.get(); }
-        DeviceOrientationController* deviceOrientationController() const { return m_deviceOrientationController.get(); }
-#endif
-#if ENABLE(NOTIFICATIONS)
-        NotificationController* notificationController() const { return m_notificationController.get(); }
-#endif
 #if ENABLE(POINTER_LOCK)
         PointerLockController* pointerLockController() const { return m_pointerLockController.get(); }
 #endif
-#if ENABLE(INPUT_SPEECH)
-        SpeechInput* speechInput();
-#endif
-#if ENABLE(MEDIA_STREAM)
-        UserMediaClient* userMediaClient() const { return m_userMediaClient; }
-#endif
-#if ENABLE(THREADED_SCROLLING)
+
         ScrollingCoordinator* scrollingCoordinator();
-#endif
 
         Settings* settings() const { return m_settings.get(); }
         ProgressTracker* progress() const { return m_progress.get(); }
@@ -352,10 +323,16 @@ namespace WebCore {
         void setRelevantRepaintedObjectsCounterThreshold(uint64_t);
         void startCountingRelevantRepaintedObjects();
         void addRelevantRepaintedObject(RenderObject*, const IntRect& objectPaintRect);
-        
+
+        void provideSupplement(const AtomicString&, PassOwnPtr<PageSupplement>);
+        PageSupplement* requireSupplement(const AtomicString&);
+
     private:
         void initGroup();
 
+        typedef HashMap<AtomicStringImpl*, OwnPtr<PageSupplement> > PageSupplementMap;
+        PageSupplementMap m_supplements;
+
 #if ASSERT_DISABLED
         void checkFrameCountConsistency() const { }
 #else
@@ -383,26 +360,11 @@ namespace WebCore {
 #if ENABLE(CLIENT_BASED_GEOLOCATION)
         OwnPtr<GeolocationController> m_geolocationController;
 #endif
-#if ENABLE(DEVICE_ORIENTATION)
-        OwnPtr<DeviceMotionController> m_deviceMotionController;
-        OwnPtr<DeviceOrientationController> m_deviceOrientationController;
-#endif
-#if ENABLE(NOTIFICATIONS)
-        OwnPtr<NotificationController> m_notificationController;
-#endif
 #if ENABLE(POINTER_LOCK)
         OwnPtr<PointerLockController> m_pointerLockController;
 #endif
-#if ENABLE(INPUT_SPEECH)
-        SpeechInputClient* m_speechInputClient;
-        OwnPtr<SpeechInput> m_speechInput;
-#endif
-#if ENABLE(MEDIA_STREAM)
-        UserMediaClient* m_userMediaClient;
-#endif
-#if ENABLE(THREADED_SCROLLING)
         RefPtr<ScrollingCoordinator> m_scrollingCoordinator;
-#endif
+
         OwnPtr<Settings> m_settings;
         OwnPtr<ProgressTracker> m_progress;
         
@@ -451,10 +413,6 @@ namespace WebCore {
 
         RefPtr<StorageNamespace> m_sessionStorage;
 
-#if ENABLE(NOTIFICATIONS)
-        NotificationPresenter* m_notificationPresenter;
-#endif
-
         ViewMode m_viewMode;
 
         double m_minimumTimerInterval;
diff --git a/Source/WebCore/page/PageSupplement.cpp b/Source/WebCore/page/PageSupplement.cpp
new file mode 100644
index 000000000..fb8c1e77e
--- /dev/null
+++ b/Source/WebCore/page/PageSupplement.cpp
@@ -0,0 +1,57 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *  * Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *  * Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE COPYRIGHT OWNER OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "PageSupplement.h"
+
+#include "Frame.h"
+#include "Page.h"
+
+namespace WebCore {
+
+PageSupplement::~PageSupplement()
+{
+}
+
+void PageSupplement::provideTo(Page* page, const AtomicString& key, PassOwnPtr<PageSupplement> supplement)
+{
+    page->provideSupplement(key, supplement);
+}
+
+PageSupplement* PageSupplement::from(Page* page, const AtomicString& name)
+{
+    if (!page)
+        return 0;
+    return page->requireSupplement(name);
+}
+
+PageSupplement* PageSupplement::from(Frame* frame, const AtomicString& name)
+{
+    if (!frame || !frame->page())
+        return 0;
+    return frame->page()->requireSupplement(name);
+}
+
+} // namespace WebCore
diff --git a/Source/WebCore/page/PageSupplement.h b/Source/WebCore/page/PageSupplement.h
new file mode 100644
index 000000000..e1b48aa90
--- /dev/null
+++ b/Source/WebCore/page/PageSupplement.h
@@ -0,0 +1,50 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *  * Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *  * Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE COPYRIGHT OWNER OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef PageSupplement_h
+#define PageSupplement_h
+
+#include <wtf/Forward.h>
+#include <wtf/Noncopyable.h>
+#include <wtf/OwnPtr.h>
+#include <wtf/text/AtomicString.h>
+
+namespace WebCore {
+
+class Page;
+class Frame;
+
+class PageSupplement {
+public:
+    virtual ~PageSupplement();
+
+    static void provideTo(Page*, const AtomicString&, PassOwnPtr<PageSupplement>);
+    static PageSupplement* from(Page*, const AtomicString&);
+    static PageSupplement* from(Frame*, const AtomicString&);
+};
+
+} // namespace WebCore
+
+#endif // PageSupplement_h
diff --git a/Source/WebCore/page/Settings.cpp b/Source/WebCore/page/Settings.cpp
index b5cb963bb..ec50f88c8 100644
--- a/Source/WebCore/page/Settings.cpp
+++ b/Source/WebCore/page/Settings.cpp
@@ -173,6 +173,7 @@ Settings::Settings(Page* page)
     , m_acceleratedDrawingEnabled(false)
     , m_acceleratedFiltersEnabled(false)
     , m_isCSSCustomFilterEnabled(false)
+    , m_cssRegionsEnabled(false)
     // FIXME: This should really be disabled by default as it makes platforms that don't support the feature download files
     // they can't use by. Leaving enabled for now to not change existing behavior.
     , m_downloadableBinaryFontsEnabled(true)
@@ -227,7 +228,7 @@ Settings::Settings(Page* page)
     , m_mediaPlaybackRequiresUserGesture(false)
     , m_mediaPlaybackAllowsInline(true)
     , m_passwordEchoEnabled(false)
-    , m_suppressIncrementalRendering(false)
+    , m_suppressesIncrementalRendering(false)
     , m_backspaceKeyNavigationEnabled(true)
     , m_visualWordMovementEnabled(false)
 #if ENABLE(VIDEO_TRACK)
@@ -237,13 +238,13 @@ Settings::Settings(Page* page)
 #endif
     , m_perTileDrawingEnabled(false)
     , m_partialSwapEnabled(false)
-#if ENABLE(THREADED_SCROLLING)
     , m_scrollingCoordinatorEnabled(false)
-#endif
     , m_notificationsEnabled(true)
+    , m_needsIsLoadingInAPISenseQuirk(false)
 #if ENABLE(TOUCH_EVENTS)
     , m_touchEventEmulationEnabled(false)
 #endif
+    , m_threadedAnimationEnabled(false)
     , m_loadsImagesAutomaticallyTimer(this, &Settings::loadsImagesAutomaticallyTimerFired)
 {
     // A Frame may not have been created yet, so we initialize the AtomicString 
diff --git a/Source/WebCore/page/Settings.h b/Source/WebCore/page/Settings.h
index 3a1406601..d3906f1e5 100644
--- a/Source/WebCore/page/Settings.h
+++ b/Source/WebCore/page/Settings.h
@@ -313,6 +313,9 @@ namespace WebCore {
         void setCSSCustomFilterEnabled(bool enabled) { m_isCSSCustomFilterEnabled = enabled; }
         bool isCSSCustomFilterEnabled() const { return m_isCSSCustomFilterEnabled; }
 
+        void setCSSRegionsEnabled(bool enabled) { m_cssRegionsEnabled = enabled; }
+        bool cssRegionsEnabled() const { return m_cssRegionsEnabled; }
+
         void setAcceleratedCompositingEnabled(bool);
         bool acceleratedCompositingEnabled() const { return m_acceleratedCompositingEnabled; }
 
@@ -480,8 +483,8 @@ namespace WebCore {
         void setPasswordEchoEnabled(bool flag) { m_passwordEchoEnabled = flag; }
         bool passwordEchoEnabled() const { return m_passwordEchoEnabled; }
 
-        void setSuppressIncrementalRendering(bool flag) { m_suppressIncrementalRendering = flag; }
-        bool suppressIncrementalRendering() const { return m_suppressIncrementalRendering; }
+        void setSuppressesIncrementalRendering(bool flag) { m_suppressesIncrementalRendering = flag; }
+        bool suppressesIncrementalRendering() const { return m_suppressesIncrementalRendering; }
         
         void setBackspaceKeyNavigationEnabled(bool flag) { m_backspaceKeyNavigationEnabled = flag; }
         bool backspaceKeyNavigationEnabled() const { return m_backspaceKeyNavigationEnabled; }
@@ -518,19 +521,24 @@ namespace WebCore {
         void setPartialSwapEnabled(bool enabled) { m_partialSwapEnabled = enabled; }
         bool partialSwapEnabled() const { return m_partialSwapEnabled; }
 
-#if ENABLE(THREADED_SCROLLING)
         void setScrollingCoordinatorEnabled(bool enabled) { m_scrollingCoordinatorEnabled = enabled; }
         bool scrollingCoordinatorEnabled() const { return m_scrollingCoordinatorEnabled; }
-#endif
 
         void setNotificationsEnabled(bool enabled) { m_notificationsEnabled = enabled; }
         bool notificationsEnabled() const { return m_notificationsEnabled; }
 
+        // Some apps needs isLoadingInAPISense to account for active subresource loaders.
+        void setNeedsIsLoadingInAPISenseQuirk(bool enabled) { m_needsIsLoadingInAPISenseQuirk = enabled; }
+        bool needsIsLoadingInAPISenseQuirk() const { return m_needsIsLoadingInAPISenseQuirk; }
+
 #if ENABLE(TOUCH_EVENTS)
         void setTouchEventEmulationEnabled(bool enabled) { m_touchEventEmulationEnabled = enabled; }
         bool isTouchEventEmulationEnabled() const { return m_touchEventEmulationEnabled; }
 #endif
 
+        void setThreadedAnimationEnabled(bool enabled) { m_threadedAnimationEnabled = enabled; }
+        bool threadedAnimationEnabled() const { return m_threadedAnimationEnabled; }
+
     private:
         Settings(Page*);
 
@@ -612,6 +620,7 @@ namespace WebCore {
         bool m_acceleratedDrawingEnabled : 1;
         bool m_acceleratedFiltersEnabled : 1;
         bool m_isCSSCustomFilterEnabled : 1;
+        bool m_cssRegionsEnabled : 1;
         bool m_downloadableBinaryFontsEnabled : 1;
         bool m_xssAuditorEnabled : 1;
         bool m_acceleratedCompositingEnabled : 1;
@@ -660,7 +669,7 @@ namespace WebCore {
         bool m_mediaPlaybackRequiresUserGesture : 1;
         bool m_mediaPlaybackAllowsInline : 1;
         bool m_passwordEchoEnabled : 1;
-        bool m_suppressIncrementalRendering : 1;
+        bool m_suppressesIncrementalRendering : 1;
         bool m_backspaceKeyNavigationEnabled : 1;
         bool m_visualWordMovementEnabled : 1;
 
@@ -672,15 +681,15 @@ namespace WebCore {
         bool m_perTileDrawingEnabled : 1;
         bool m_partialSwapEnabled : 1;
 
-#if ENABLE(THREADED_SCROLLING)
         bool m_scrollingCoordinatorEnabled : 1;
-#endif
 
         bool m_notificationsEnabled : 1;
+        bool m_needsIsLoadingInAPISenseQuirk : 1;
 
 #if ENABLE(TOUCH_EVENTS)
         bool m_touchEventEmulationEnabled : 1;
 #endif
+        bool m_threadedAnimationEnabled : 1;
 
         Timer<Settings> m_loadsImagesAutomaticallyTimer;
         void loadsImagesAutomaticallyTimerFired(Timer<Settings>*);
diff --git a/Source/WebCore/page/SpeechInput.cpp b/Source/WebCore/page/SpeechInput.cpp
index 6a8620a8f..4d7290c3f 100644
--- a/Source/WebCore/page/SpeechInput.cpp
+++ b/Source/WebCore/page/SpeechInput.cpp
@@ -117,6 +117,17 @@ void SpeechInput::cancelRecognition(int listenerId)
     m_client->cancelRecognition(listenerId);
 }
 
+const AtomicString& SpeechInput::supplementName()
+{
+    DEFINE_STATIC_LOCAL(AtomicString, name, ("SpeechInput"));
+    return name;
+}
+
+void provideSpeechInputTo(Page* page, SpeechInputClient* client)
+{
+    PageSupplement::provideTo(page, SpeechInput::supplementName(), SpeechInput::create(client));
+}
+
 } // namespace WebCore
 
 #endif // ENABLE(INPUT_SPEECH)
diff --git a/Source/WebCore/page/SpeechInput.h b/Source/WebCore/page/SpeechInput.h
index 6fee65ceb..bab9e3643 100644
--- a/Source/WebCore/page/SpeechInput.h
+++ b/Source/WebCore/page/SpeechInput.h
@@ -33,6 +33,7 @@
 
 #if ENABLE(INPUT_SPEECH)
 
+#include "PageSupplement.h"
 #include "SpeechInputListener.h"
 #include <wtf/Forward.h>
 #include <wtf/HashMap.h>
@@ -47,12 +48,16 @@ class SpeechInputListener;
 // This class connects the input elements requiring speech input with the platform specific
 // speech recognition engine. It provides methods for the input elements to activate speech
 // recognition and methods for the speech recognition engine to return back the results.
-class SpeechInput : public SpeechInputListener {
+class SpeechInput : public SpeechInputListener,
+                    public PageSupplement {
     WTF_MAKE_NONCOPYABLE(SpeechInput);
 public:
     virtual ~SpeechInput();
 
     static PassOwnPtr<SpeechInput> create(SpeechInputClient*);
+    static const AtomicString& supplementName();
+    static SpeechInput* from(Frame* frame) { return static_cast<SpeechInput*>(PageSupplement::from(frame, supplementName())); }
+    static SpeechInput* from(Page* page) { return static_cast<SpeechInput*>(PageSupplement::from(page, supplementName())); }
 
     // Generates a unique ID for the given listener to be used for speech requests.
     // This should be the first call made by listeners before anything else.
diff --git a/Source/WebCore/page/SpeechInputClient.h b/Source/WebCore/page/SpeechInputClient.h
index 4f8fd5e25..e26f979f8 100644
--- a/Source/WebCore/page/SpeechInputClient.h
+++ b/Source/WebCore/page/SpeechInputClient.h
@@ -40,6 +40,7 @@ namespace WebCore {
 class IntRect;
 class SecurityOrigin;
 class SpeechInputListener;
+class Page;
 
 // Provides an interface for SpeechInput to call into the embedder.
 class SpeechInputClient {
@@ -65,6 +66,8 @@ protected:
     virtual ~SpeechInputClient() { }
 };
 
+void provideSpeechInputTo(Page*, SpeechInputClient*);
+
 } // namespace WebCore
 
 #endif // ENABLE(INPUT_SPEECH)
diff --git a/Source/WebCore/page/SuspendableTimer.cpp b/Source/WebCore/page/SuspendableTimer.cpp
index 2a4d2e521..dd3e89f18 100644
--- a/Source/WebCore/page/SuspendableTimer.cpp
+++ b/Source/WebCore/page/SuspendableTimer.cpp
@@ -35,8 +35,8 @@ SuspendableTimer::SuspendableTimer(ScriptExecutionContext* context)
     : ActiveDOMObject(context, this)
     , m_nextFireInterval(0)
     , m_repeatInterval(0)
-#if !ASSERT_DISABLED
     , m_active(false)
+#if !ASSERT_DISABLED
     , m_suspended(false)
 #endif
 {
diff --git a/Source/WebCore/page/animation/AnimationBase.cpp b/Source/WebCore/page/animation/AnimationBase.cpp
index 4fd0409ec..1e665ec56 100644
--- a/Source/WebCore/page/animation/AnimationBase.cpp
+++ b/Source/WebCore/page/animation/AnimationBase.cpp
@@ -451,6 +451,23 @@ public:
         dst->setTransform(blendFunc(anim, a->transform(), b->transform(), progress));
     }
 };
+
+#if ENABLE(CSS_FILTERS)
+class PropertyWrapperAcceleratedFilter : public PropertyWrapper<const FilterOperations&> {
+public:
+    PropertyWrapperAcceleratedFilter()
+        : PropertyWrapper<const FilterOperations&>(CSSPropertyWebkitFilter, &RenderStyle::filter, &RenderStyle::setFilter)
+    {
+    }
+    
+    virtual bool animationIsAccelerated() const { return true; }
+
+    virtual void blend(const AnimationBase* anim, RenderStyle* dst, const RenderStyle* a, const RenderStyle* b, double progress) const
+    {
+        dst->setFilter(blendFunc(anim, a->filter(), b->filter(), progress));
+    }
+};
+#endif
 #endif // USE(ACCELERATED_COMPOSITING)
 
 static inline size_t shadowListLength(const ShadowData* shadow)
@@ -1025,14 +1042,16 @@ void AnimationBase::ensurePropertyMap()
 #if USE(ACCELERATED_COMPOSITING)
         gPropertyWrappers->append(new PropertyWrapperAcceleratedOpacity());
         gPropertyWrappers->append(new PropertyWrapperAcceleratedTransform());
+#if ENABLE(CSS_FILTERS)
+        gPropertyWrappers->append(new PropertyWrapperAcceleratedFilter());
+#endif
 #else
         gPropertyWrappers->append(new PropertyWrapper<float>(CSSPropertyOpacity, &RenderStyle::opacity, &RenderStyle::setOpacity));
         gPropertyWrappers->append(new PropertyWrapper<const TransformOperations&>(CSSPropertyWebkitTransform, &RenderStyle::transform, &RenderStyle::setTransform));
-#endif
-
 #if ENABLE(CSS_FILTERS)
         gPropertyWrappers->append(new PropertyWrapper<const FilterOperations&>(CSSPropertyWebkitFilter, &RenderStyle::filter, &RenderStyle::setFilter));
 #endif
+#endif
 
         gPropertyWrappers->append(new PropertyWrapperVisitedAffectedColor(CSSPropertyWebkitColumnRuleColor, MaybeInvalidColor, &RenderStyle::columnRuleColor, &RenderStyle::setColumnRuleColor, &RenderStyle::visitedLinkColumnRuleColor, &RenderStyle::setVisitedLinkColumnRuleColor));
         gPropertyWrappers->append(new PropertyWrapperVisitedAffectedColor(CSSPropertyWebkitTextStrokeColor, MaybeInvalidColor, &RenderStyle::textStrokeColor, &RenderStyle::setTextStrokeColor, &RenderStyle::visitedLinkTextStrokeColor, &RenderStyle::setVisitedLinkTextStrokeColor));
diff --git a/Source/WebCore/page/animation/AnimationController.cpp b/Source/WebCore/page/animation/AnimationController.cpp
index 745d5146b..4930b54f4 100644
--- a/Source/WebCore/page/animation/AnimationController.cpp
+++ b/Source/WebCore/page/animation/AnimationController.cpp
@@ -35,6 +35,7 @@
 #include "CompositeAnimation.h"
 #include "EventNames.h"
 #include "Frame.h"
+#include "FrameView.h"
 #include "RenderView.h"
 #include "WebKitAnimationEvent.h"
 #include "WebKitAnimationList.h"
@@ -44,7 +45,6 @@
 
 namespace WebCore {
 
-// FIXME: Why isn't this set to 60fps or something?
 static const double cAnimationTimerDelay = 0.025;
 static const double cBeginAnimationUpdateTimeNotSet = -1;
 
@@ -84,9 +84,9 @@ bool AnimationControllerPrivate::clear(RenderObject* renderer)
     return animation->suspended();
 }
 
-void AnimationControllerPrivate::updateAnimationTimer(bool callSetChanged/* = false*/)
+double AnimationControllerPrivate::updateAnimations(SetChanged callSetChanged/* = DoNotCallSetChanged*/)
 {
-    double needsService = -1;
+    double timeToNextService = -1;
     bool calledSetChanged = false;
 
     RenderObjectAnimationMap::const_iterator animationsEnd = m_compositeAnimations.end();
@@ -94,10 +94,10 @@ void AnimationControllerPrivate::updateAnimationTimer(bool callSetChanged/* = fa
         CompositeAnimation* compAnim = it->second.get();
         if (!compAnim->suspended() && compAnim->hasAnimations()) {
             double t = compAnim->timeToNextService();
-            if (t != -1 && (t < needsService || needsService == -1))
-                needsService = t;
-            if (needsService == 0) {
-                if (callSetChanged) {
+            if (t != -1 && (t < timeToNextService || timeToNextService == -1))
+                timeToNextService = t;
+            if (!timeToNextService) {
+                if (callSetChanged == CallSetChanged) {
                     Node* node = it->first->node();
                     ASSERT(!node || (node->document() && !node->document()->inPageCache()));
                     node->setNeedsStyleRecalc(SyntheticStyleChange);
@@ -108,28 +108,48 @@ void AnimationControllerPrivate::updateAnimationTimer(bool callSetChanged/* = fa
             }
         }
     }
-    
+
     if (calledSetChanged)
         m_frame->document()->updateStyleIfNeeded();
-    
+
+    return timeToNextService;
+}
+
+void AnimationControllerPrivate::updateAnimationTimerForRenderer(RenderObject* renderer)
+{
+    double timeToNextService = 0;
+
+    RefPtr<CompositeAnimation> compAnim = m_compositeAnimations.get(renderer);
+    if (!compAnim->suspended() && compAnim->hasAnimations())
+        timeToNextService = compAnim->timeToNextService();
+
+    if (m_animationTimer.isActive())
+        m_animationTimer.stop();
+    m_animationTimer.startOneShot(timeToNextService);
+}
+
+void AnimationControllerPrivate::updateAnimationTimer(SetChanged callSetChanged/* = DoNotCallSetChanged*/)
+{
+    double timeToNextService = updateAnimations(callSetChanged);
+
     // If we want service immediately, we start a repeating timer to reduce the overhead of starting
-    if (needsService == 0) {
+    if (!timeToNextService) {
         if (!m_animationTimer.isActive() || m_animationTimer.repeatInterval() == 0)
             m_animationTimer.startRepeating(cAnimationTimerDelay);
         return;
     }
-    
+
     // If we don't need service, we want to make sure the timer is no longer running
-    if (needsService < 0) {
+    if (timeToNextService < 0) {
         if (m_animationTimer.isActive())
             m_animationTimer.stop();
         return;
     }
-    
+
     // Otherwise, we want to start a one-shot timer so we get here again
     if (m_animationTimer.isActive())
         m_animationTimer.stop();
-    m_animationTimer.startOneShot(needsService);
+    m_animationTimer.startOneShot(timeToNextService);
 }
 
 void AnimationControllerPrivate::updateStyleIfNeededDispatcherFired(Timer<AnimationControllerPrivate>*)
@@ -143,7 +163,7 @@ void AnimationControllerPrivate::fireEventsAndUpdateStyle()
     RefPtr<Frame> protector = m_frame;
 
     bool updateStyle = !m_eventsToDispatch.isEmpty() || !m_nodeChangesToDispatch.isEmpty();
-    
+
     // fire all the events
     Vector<EventToDispatch> eventsToDispatch = m_eventsToDispatch;
     m_eventsToDispatch.clear();
@@ -154,14 +174,14 @@ void AnimationControllerPrivate::fireEventsAndUpdateStyle()
         else
             it->element->dispatchEvent(WebKitAnimationEvent::create(it->eventType, it->name, it->elapsedTime));
     }
-    
+
     // call setChanged on all the elements
     Vector<RefPtr<Node> >::const_iterator nodeChangesToDispatchEnd = m_nodeChangesToDispatch.end();
     for (Vector<RefPtr<Node> >::const_iterator it = m_nodeChangesToDispatch.begin(); it != nodeChangesToDispatchEnd; ++it)
         (*it)->setNeedsStyleRecalc(SyntheticStyleChange);
-    
+
     m_nodeChangesToDispatch.clear();
-    
+
     if (updateStyle && m_frame)
         m_frame->document()->updateStyleIfNeeded();
 }
@@ -194,6 +214,16 @@ void AnimationControllerPrivate::addNodeChangeToDispatch(PassRefPtr<Node> node)
     startUpdateStyleIfNeededDispatcher();
 }
 
+#if ENABLE(REQUEST_ANIMATION_FRAME)
+void AnimationControllerPrivate::animationFrameCallbackFired()
+{
+    double timeToNextService = updateAnimations(CallSetChanged);
+
+    if (timeToNextService >= 0)
+        m_frame->document()->view()->scheduleAnimation();
+}
+#endif
+
 void AnimationControllerPrivate::animationTimerFired(Timer<AnimationControllerPrivate>*)
 {
     // Make sure animationUpdateTime is updated, so that it is current even if no
@@ -202,7 +232,7 @@ void AnimationControllerPrivate::animationTimerFired(Timer<AnimationControllerPr
 
     // When the timer fires, all we do is call setChanged on all DOM nodes with running animations and then do an immediate
     // updateStyleIfNeeded.  It will then call back to us with new information.
-    updateAnimationTimer(true);
+    updateAnimationTimer(CallSetChanged);
 
     // Fire events right away, to avoid a flash of unanimated style after an animation completes, and before
     // the 'end' event fires.
@@ -499,8 +529,13 @@ PassRefPtr<RenderStyle> AnimationController::updateAnimations(RenderObject* rend
     RefPtr<CompositeAnimation> rendererAnimations = m_data->accessCompositeAnimation(renderer);
     RefPtr<RenderStyle> blendedStyle = rendererAnimations->animate(renderer, oldStyle, newStyle);
 
-    if (renderer->parent() || newStyle->animations() || (oldStyle && oldStyle->animations()))
-        m_data->updateAnimationTimer();
+    if (renderer->parent() || newStyle->animations() || (oldStyle && oldStyle->animations())) {
+        m_data->updateAnimationTimerForRenderer(renderer);
+#if ENABLE(REQUEST_ANIMATION_FRAME)
+        if (FrameView* view = renderer->document()->view())
+            view->scheduleAnimation();
+#endif
+    }
 
     if (blendedStyle != newStyle) {
         // If the animations/transitions change opacity or transform, we need to update
@@ -557,6 +592,13 @@ void AnimationController::resumeAnimations()
     m_data->resumeAnimations();
 }
 
+#if ENABLE(REQUEST_ANIMATION_FRAME)
+void AnimationController::serviceAnimations()
+{
+    m_data->animationFrameCallbackFired();
+}
+#endif
+
 void AnimationController::suspendAnimationsForDocument(Document* document)
 {
     m_data->suspendAnimationsForDocument(document);
diff --git a/Source/WebCore/page/animation/AnimationController.h b/Source/WebCore/page/animation/AnimationController.h
index ccdc6c4a4..18772dd59 100644
--- a/Source/WebCore/page/animation/AnimationController.h
+++ b/Source/WebCore/page/animation/AnimationController.h
@@ -66,6 +66,9 @@ public:
 
     void suspendAnimations();
     void resumeAnimations();
+#if ENABLE(REQUEST_ANIMATION_FRAME)
+    void serviceAnimations();
+#endif
 
     void suspendAnimationsForDocument(Document*);
     void resumeAnimationsForDocument(Document*);
diff --git a/Source/WebCore/page/animation/AnimationControllerPrivate.h b/Source/WebCore/page/animation/AnimationControllerPrivate.h
index 41eebff16..8f3ee7f6c 100644
--- a/Source/WebCore/page/animation/AnimationControllerPrivate.h
+++ b/Source/WebCore/page/animation/AnimationControllerPrivate.h
@@ -51,13 +51,20 @@ class RenderObject;
 class RenderStyle;
 class WebKitAnimationList;
 
+enum SetChanged {
+    DoNotCallSetChanged = 0,
+    CallSetChanged = 1
+};
+
 class AnimationControllerPrivate {
     WTF_MAKE_NONCOPYABLE(AnimationControllerPrivate); WTF_MAKE_FAST_ALLOCATED;
 public:
     AnimationControllerPrivate(Frame*);
     ~AnimationControllerPrivate();
 
-    void updateAnimationTimer(bool callSetChanged = false);
+    // Returns the time until the next animation needs to be serviced, or -1 if there are none.
+    double updateAnimations(SetChanged callSetChanged = DoNotCallSetChanged);
+    void updateAnimationTimer(SetChanged callSetChanged = DoNotCallSetChanged);
 
     PassRefPtr<CompositeAnimation> accessCompositeAnimation(RenderObject*);
     bool clear(RenderObject*);
@@ -71,6 +78,9 @@ public:
 
     void suspendAnimations();
     void resumeAnimations();
+#if ENABLE(REQUEST_ANIMATION_FRAME)
+    void animationFrameCallbackFired();
+#endif
 
     void suspendAnimationsForDocument(Document*);
     void resumeAnimationsForDocument(Document*);
@@ -98,6 +108,8 @@ public:
     void animationWillBeRemoved(AnimationBase*);
 
     PassRefPtr<WebKitAnimationList> animationsForRenderer(RenderObject*) const;
+
+    void updateAnimationTimerForRenderer(RenderObject*);
     
 private:
     void animationTimerFired(Timer<AnimationControllerPrivate>*);
diff --git a/Source/WebCore/page/mac/EventHandlerMac.mm b/Source/WebCore/page/mac/EventHandlerMac.mm
index 2630dbb8a..55dd8169d 100644
--- a/Source/WebCore/page/mac/EventHandlerMac.mm
+++ b/Source/WebCore/page/mac/EventHandlerMac.mm
@@ -41,6 +41,7 @@
 #include "MouseEventWithHitTestResults.h"
 #include "NotImplemented.h"
 #include "Page.h"
+#include "Pasteboard.h"
 #include "PlatformEventFactoryMac.h"
 #include "RenderWidget.h"
 #include "RuntimeApplicationChecks.h"
@@ -668,11 +669,11 @@ bool EventHandler::eventActivatedView(const PlatformMouseEvent& event) const
 
 PassRefPtr<Clipboard> EventHandler::createDraggingClipboard() const
 {
-    NSPasteboard *pasteboard = [NSPasteboard pasteboardWithName:NSDragPboard];
     // Must be done before ondragstart adds types and data to the pboard,
     // also done for security, as it erases data from the last drag
-    [pasteboard declareTypes:[NSArray array] owner:nil];
-    return ClipboardMac::create(Clipboard::DragAndDrop, pasteboard, ClipboardWritable, m_frame);
+    Pasteboard pasteboard(NSDragPboard);
+    pasteboard.clear();
+    return ClipboardMac::create(Clipboard::DragAndDrop, String(NSDragPboard), ClipboardWritable, m_frame);
 }
 
 #endif
diff --git a/Source/WebCore/page/mac/FrameMac.mm b/Source/WebCore/page/mac/FrameMac.mm
index 1c835afac..7b45a395e 100644
--- a/Source/WebCore/page/mac/FrameMac.mm
+++ b/Source/WebCore/page/mac/FrameMac.mm
@@ -158,7 +158,7 @@ NSImage* Frame::snapshotDragImage(Node* node, NSRect* imageRect, NSRect* element
     m_doc->updateLayout();        // forces style recalc - needed since changing the drag state might
                                         // imply new styles, plus JS could have changed other things
     LayoutRect topLevelRect;
-    NSRect paintingRect = renderer->paintingRootRect(topLevelRect);
+    NSRect paintingRect = pixelSnappedIntRect(renderer->paintingRootRect(topLevelRect));
 
     m_view->setNodeToDraw(node);              // invoke special sub-tree drawing mode
     NSImage* result = imageFromRect(paintingRect);
@@ -167,7 +167,7 @@ NSImage* Frame::snapshotDragImage(Node* node, NSRect* imageRect, NSRect* element
     m_view->setNodeToDraw(0);
 
     if (elementRect)
-        *elementRect = topLevelRect;
+        *elementRect = pixelSnappedIntRect(topLevelRect);
     if (imageRect)
         *imageRect = paintingRect;
     return result;
@@ -182,7 +182,7 @@ DragImageRef Frame::nodeImage(Node* node)
     m_doc->updateLayout(); // forces style recalc
 
     LayoutRect topLevelRect;
-    NSRect paintingRect = renderer->paintingRootRect(topLevelRect);
+    NSRect paintingRect = pixelSnappedIntRect(renderer->paintingRootRect(topLevelRect));
 
     m_view->setNodeToDraw(node); // invoke special sub-tree drawing mode
     NSImage* result = imageFromRect(paintingRect);
diff --git a/Source/WebCore/page/qt/EventHandlerQt.cpp b/Source/WebCore/page/qt/EventHandlerQt.cpp
index 06db10455..8aebb9c9a 100644
--- a/Source/WebCore/page/qt/EventHandlerQt.cpp
+++ b/Source/WebCore/page/qt/EventHandlerQt.cpp
@@ -50,9 +50,11 @@
 #include "RenderWidget.h"
 #include "Scrollbar.h"
 
+#if QT_VERSION < QT_VERSION_CHECK(5, 0, 0)
 QT_BEGIN_NAMESPACE
 Q_GUI_EXPORT extern bool qt_tab_all_widgets; // from qapplication.cpp
 QT_END_NAMESPACE
+#endif
 
 namespace WebCore {
 
@@ -64,7 +66,11 @@ const double EventHandler::TextDragDelay = 0.0;
 
 bool EventHandler::tabsToAllFormControls(KeyboardEvent* event) const
 {
+#if QT_VERSION >= QT_VERSION_CHECK(5, 0, 0)
+    return !isKeyboardOptionTab(event);
+#else
     return (isKeyboardOptionTab(event) ? !qt_tab_all_widgets : qt_tab_all_widgets);
+#endif
 }
 
 void EventHandler::focusDocumentView()
diff --git a/Source/WebCore/page/scrolling/ScrollingCoordinator.cpp b/Source/WebCore/page/scrolling/ScrollingCoordinator.cpp
index e569b2c25..5c14d995d 100644
--- a/Source/WebCore/page/scrolling/ScrollingCoordinator.cpp
+++ b/Source/WebCore/page/scrolling/ScrollingCoordinator.cpp
@@ -25,8 +25,6 @@
 
 #include "config.h"
 
-#if ENABLE(THREADED_SCROLLING)
-
 #include "ScrollingCoordinator.h"
 
 #include "Frame.h"
@@ -35,49 +33,54 @@
 #include "Page.h"
 #include "PlatformWheelEvent.h"
 #include "Region.h"
+#include "RenderView.h"
 #include "ScrollAnimator.h"
+#include "ScrollingTreeState.h"
+#include <wtf/MainThread.h>
+
+#if USE(ACCELERATED_COMPOSITING)
+#include "RenderLayerCompositor.h"
+#endif
+
+#if ENABLE(THREADED_SCROLLING)
 #include "ScrollingThread.h"
 #include "ScrollingTree.h"
-#include "ScrollingTreeState.h"
 #include <wtf/Functional.h>
-#include <wtf/MainThread.h>
 #include <wtf/PassRefPtr.h>
+#endif
 
 namespace WebCore {
 
-PassRefPtr<ScrollingCoordinator> ScrollingCoordinator::create(Page* page)
-{
-    return adoptRef(new ScrollingCoordinator(page));
-}
-
 ScrollingCoordinator::ScrollingCoordinator(Page* page)
     : m_page(page)
-    , m_scrollingTree(ScrollingTree::create(this))
+#if ENABLE(THREADED_SCROLLING)
     , m_scrollingTreeState(ScrollingTreeState::create())
+    , m_scrollingTree(ScrollingTree::create(this))
     , m_scrollingTreeStateCommitterTimer(this, &ScrollingCoordinator::scrollingTreeStateCommitterTimerFired)
+#endif
 {
 }
 
-ScrollingCoordinator::~ScrollingCoordinator()
-{
-    ASSERT(!m_page);
-    ASSERT(!m_scrollingTree);
-}
-
 void ScrollingCoordinator::pageDestroyed()
 {
     ASSERT(m_page);
     m_page = 0;
 
+#if ENABLE(THREADED_SCROLLING)
+    m_scrollingTreeStateCommitterTimer.stop();
+
     // Invalidating the scrolling tree will break the reference cycle between the ScrollingCoordinator and ScrollingTree objects.
     ScrollingThread::dispatch(bind(&ScrollingTree::invalidate, m_scrollingTree.release()));
+#endif
 }
 
+#if ENABLE(THREADED_SCROLLING)
 ScrollingTree* ScrollingCoordinator::scrollingTree() const
 {
     ASSERT(m_scrollingTree);
     return m_scrollingTree.get();
 }
+#endif
 
 bool ScrollingCoordinator::coordinatesScrollingForFrameView(FrameView* frameView) const
 {
@@ -88,37 +91,66 @@ bool ScrollingCoordinator::coordinatesScrollingForFrameView(FrameView* frameView
     if (frameView->frame() != m_page->mainFrame())
         return false;
 
-    return true;
+    // We currently only support composited mode.
+#if USE(ACCELERATED_COMPOSITING)
+    RenderView* renderView = m_page->mainFrame()->contentRenderer();
+    if (!renderView)
+        return false;
+    return renderView->usesCompositing();
+#else
+    return false;
+#endif
 }
 
-void ScrollingCoordinator::frameViewLayoutUpdated(FrameView* frameView)
+static Region computeNonFastScrollableRegion(FrameView* frameView)
 {
-    ASSERT(isMainThread());
-    ASSERT(m_page);
+    Region nonFastScrollableRegion;
 
-    if (!coordinatesScrollingForFrameView(frameView))
-        return;
+    HashSet<FrameView*> childFrameViews;
+    for (HashSet<RefPtr<Widget> >::const_iterator it = frameView->children()->begin(), end = frameView->children()->end(); it != end; ++it) {
+        if ((*it)->isFrameView())
+            childFrameViews.add(static_cast<FrameView*>(it->get()));
+    }
 
-    // Compute the region of the page that we can't do fast scrolling for. This currently includes
-    // all scrollable areas, such as subframes, overflow divs and list boxes.
-    Region nonScrollableRegion;
     if (const FrameView::ScrollableAreaSet* scrollableAreas = frameView->scrollableAreas()) {
         for (FrameView::ScrollableAreaSet::const_iterator it = scrollableAreas->begin(), end = scrollableAreas->end(); it != end; ++it) {
             ScrollableArea* scrollableArea = *it;
 
             // Check if this area can be scrolled at all.
+            // If this scrollable area is a frame view that itself has scrollable areas, then we need to add it to the region.
             if ((!scrollableArea->horizontalScrollbar() || !scrollableArea->horizontalScrollbar()->enabled())
-                && (!scrollableArea->verticalScrollbar() || !scrollableArea->verticalScrollbar()->enabled()))
-                continue;
+                && (!scrollableArea->verticalScrollbar() || !scrollableArea->verticalScrollbar()->enabled())
+                && (!childFrameViews.contains(static_cast<FrameView*>(scrollableArea)) || !static_cast<FrameView*>(scrollableArea)->scrollableAreas()))
+                    continue;
 
-            nonScrollableRegion.unite(scrollableArea->scrollableAreaBoundingBox());
+            nonFastScrollableRegion.unite(scrollableArea->scrollableAreaBoundingBox());
         }
     }
 
-    m_scrollingTreeState->setViewportRect(IntRect(IntPoint(), frameView->visibleContentRect().size()));
-    m_scrollingTreeState->setContentsSize(frameView->contentsSize());
-    m_scrollingTreeState->setNonFastScrollableRegion(nonScrollableRegion);
-    scheduleTreeStateCommit();
+    return nonFastScrollableRegion;
+}
+
+void ScrollingCoordinator::frameViewLayoutUpdated(FrameView* frameView)
+{
+    ASSERT(isMainThread());
+    ASSERT(m_page);
+
+    // Compute the region of the page that we can't do fast scrolling for. This currently includes
+    // all scrollable areas, such as subframes, overflow divs and list boxes. We need to do this even if the
+    // frame view whose layout was updated is not the main frame.
+    Region nonFastScrollableRegion = computeNonFastScrollableRegion(m_page->mainFrame()->view());
+    setNonFastScrollableRegion(nonFastScrollableRegion);
+
+    if (!coordinatesScrollingForFrameView(frameView))
+        return;
+
+    setScrollParameters(frameView->horizontalScrollElasticity(),
+                        frameView->verticalScrollElasticity(),
+                        frameView->horizontalScrollbar() && frameView->horizontalScrollbar()->enabled(),
+                        frameView->verticalScrollbar() && frameView->verticalScrollbar()->enabled(),
+                        IntRect(IntPoint(), frameView->visibleContentRect().size()),
+                        frameView->contentsSize());
+
 }
 
 void ScrollingCoordinator::frameViewWheelEventHandlerCountChanged(FrameView*)
@@ -129,6 +161,91 @@ void ScrollingCoordinator::frameViewWheelEventHandlerCountChanged(FrameView*)
     recomputeWheelEventHandlerCount();
 }
 
+void ScrollingCoordinator::frameViewHasSlowRepaintObjectsDidChange(FrameView* frameView)
+{
+    ASSERT(isMainThread());
+    ASSERT(m_page);
+
+    if (!coordinatesScrollingForFrameView(frameView))
+        return;
+
+    updateShouldUpdateScrollLayerPositionOnMainThread();
+}
+
+void ScrollingCoordinator::frameViewHasFixedObjectsDidChange(FrameView* frameView)
+{
+    ASSERT(isMainThread());
+    ASSERT(m_page);
+
+    if (!coordinatesScrollingForFrameView(frameView))
+        return;
+
+    updateShouldUpdateScrollLayerPositionOnMainThread();
+}
+
+static GraphicsLayer* scrollLayerForFrameView(FrameView* frameView)
+{
+#if USE(ACCELERATED_COMPOSITING)
+    Frame* frame = frameView->frame();
+    if (!frame)
+        return 0;
+
+    RenderView* renderView = frame->contentRenderer();
+    if (!renderView)
+        return 0;
+    return renderView->compositor()->scrollLayer();
+#else
+    return 0;
+#endif
+}
+
+void ScrollingCoordinator::frameViewRootLayerDidChange(FrameView* frameView)
+{
+    ASSERT(isMainThread());
+    ASSERT(m_page);
+
+    if (frameView->frame() != m_page->mainFrame())
+        return;
+
+    frameViewLayoutUpdated(frameView);
+    recomputeWheelEventHandlerCount();
+    updateShouldUpdateScrollLayerPositionOnMainThread();
+    setScrollLayer(scrollLayerForFrameView(frameView));
+}
+
+bool ScrollingCoordinator::requestScrollPositionUpdate(FrameView* frameView, const IntPoint& scrollPosition)
+{
+    ASSERT(isMainThread());
+    ASSERT(m_page);
+
+    if (!coordinatesScrollingForFrameView(frameView))
+        return false;
+
+#if ENABLE(THREADED_SCROLLING)
+    ScrollingThread::dispatch(bind(&ScrollingTree::setMainFrameScrollPosition, m_scrollingTree.get(), scrollPosition));
+    return true;
+#else
+    UNUSED_PARAM(scrollPosition);
+    return false;
+#endif
+}
+
+bool ScrollingCoordinator::handleWheelEvent(FrameView*, const PlatformWheelEvent& wheelEvent)
+{
+    ASSERT(isMainThread());
+    ASSERT(m_page);
+
+#if ENABLE(THREADED_SCROLLING)
+    if (m_scrollingTree->willWheelEventStartSwipeGesture(wheelEvent))
+        return false;
+
+    ScrollingThread::dispatch(bind(&ScrollingTree::handleWheelEvent, m_scrollingTree.get(), wheelEvent));
+#else
+    UNUSED_PARAM(wheelEvent);
+#endif
+    return true;
+}
+
 void ScrollingCoordinator::updateMainFrameScrollPosition(const IntPoint& scrollPosition)
 {
     ASSERT(isMainThread());
@@ -141,8 +258,25 @@ void ScrollingCoordinator::updateMainFrameScrollPosition(const IntPoint& scrollP
         return;
 
     frameView->setConstrainsScrollingToContentEdge(false);
-    frameView->scrollToOffsetWithoutAnimation(scrollPosition);
+    frameView->notifyScrollPositionChanged(scrollPosition);
+    frameView->setConstrainsScrollingToContentEdge(true);
+}
+
+void ScrollingCoordinator::updateMainFrameScrollPositionAndScrollLayerPosition(const IntPoint& scrollPosition)
+{
+#if USE(ACCELERATED_COMPOSITING)
+    FrameView* frameView = m_page->mainFrame()->view();
+
+    // Make sure to update the main frame scroll position before changing the scroll layer position,
+    // otherwise we'll introduce jittering on pages with slow repaint objects (like background-attachment: fixed).
+    frameView->updateCompositingLayers();
+    frameView->setConstrainsScrollingToContentEdge(false);
+    frameView->notifyScrollPositionChanged(scrollPosition);
     frameView->setConstrainsScrollingToContentEdge(true);
+
+    if (GraphicsLayer* scrollLayer = scrollLayerForFrameView(frameView))
+        scrollLayer->setPosition(-frameView->scrollPosition());
+#endif
 }
 
 void ScrollingCoordinator::recomputeWheelEventHandlerCount()
@@ -152,11 +286,60 @@ void ScrollingCoordinator::recomputeWheelEventHandlerCount()
         if (frame->document())
             wheelEventHandlerCount += frame->document()->wheelEventHandlerCount();
     }
+    setWheelEventHandlerCount(wheelEventHandlerCount);
+}
+
+void ScrollingCoordinator::updateShouldUpdateScrollLayerPositionOnMainThread()
+{
+    FrameView* frameView = m_page->mainFrame()->view();
+
+    // FIXME: Having fixed objects on the page should not trigger the slow path.
+    setShouldUpdateScrollLayerPositionOnMainThread(frameView->hasSlowRepaintObjects() || frameView->hasFixedObjects());
+}
+
+#if ENABLE(THREADED_SCROLLING)
+void ScrollingCoordinator::setScrollLayer(GraphicsLayer* scrollLayer)
+{
+    m_scrollingTreeState->setScrollLayer(scrollLayer);
+    scheduleTreeStateCommit();
+}
 
+void ScrollingCoordinator::setNonFastScrollableRegion(const Region& region)
+{
+    m_scrollingTreeState->setNonFastScrollableRegion(region);
+    scheduleTreeStateCommit();
+}
+
+void ScrollingCoordinator::setScrollParameters(ScrollElasticity horizontalScrollElasticity,
+                                               ScrollElasticity verticalScrollElasticity,
+                                               bool hasEnabledHorizontalScrollbar,
+                                               bool hasEnabledVerticalScrollbar,
+                                               const IntRect& viewportRect,
+                                               const IntSize& contentsSize)
+{
+    m_scrollingTreeState->setHorizontalScrollElasticity(horizontalScrollElasticity);
+    m_scrollingTreeState->setVerticalScrollElasticity(verticalScrollElasticity);
+    m_scrollingTreeState->setHasEnabledHorizontalScrollbar(hasEnabledHorizontalScrollbar);
+    m_scrollingTreeState->setHasEnabledVerticalScrollbar(hasEnabledVerticalScrollbar);
+
+    m_scrollingTreeState->setViewportRect(viewportRect);
+    m_scrollingTreeState->setContentsSize(contentsSize);
+    scheduleTreeStateCommit();
+}
+
+
+void ScrollingCoordinator::setWheelEventHandlerCount(unsigned wheelEventHandlerCount)
+{
     m_scrollingTreeState->setWheelEventHandlerCount(wheelEventHandlerCount);
     scheduleTreeStateCommit();
 }
 
+void ScrollingCoordinator::setShouldUpdateScrollLayerPositionOnMainThread(bool shouldUpdateScrollLayerPositionOnMainThread)
+{
+    m_scrollingTreeState->setShouldUpdateScrollLayerPositionOnMainThread(shouldUpdateScrollLayerPositionOnMainThread);
+    scheduleTreeStateCommit();
+}
+
 void ScrollingCoordinator::scheduleTreeStateCommit()
 {
     if (m_scrollingTreeStateCommitterTimer.isActive())
@@ -189,7 +372,6 @@ void ScrollingCoordinator::commitTreeState()
     OwnPtr<ScrollingTreeState> treeState = m_scrollingTreeState->commit();
     ScrollingThread::dispatch(bind(&ScrollingTree::commitNewTreeState, m_scrollingTree.get(), treeState.release()));
 }
+#endif
 
 } // namespace WebCore
-
-#endif // ENABLE(THREADED_SCROLLING)
diff --git a/Source/WebCore/page/scrolling/ScrollingCoordinator.h b/Source/WebCore/page/scrolling/ScrollingCoordinator.h
index eb597b8b0..00b289fe2 100644
--- a/Source/WebCore/page/scrolling/ScrollingCoordinator.h
+++ b/Source/WebCore/page/scrolling/ScrollingCoordinator.h
@@ -26,14 +26,16 @@
 #ifndef ScrollingCoordinator_h
 #define ScrollingCoordinator_h
 
-#if ENABLE(THREADED_SCROLLING)
-
 #include "GraphicsLayer.h"
 #include "IntRect.h"
+#include "ScrollTypes.h"
 #include "Timer.h"
 #include <wtf/Forward.h>
+
+#if ENABLE(THREADED_SCROLLING)
 #include <wtf/ThreadSafeRefCounted.h>
 #include <wtf/Threading.h>
+#endif
 
 #if PLATFORM(MAC)
 #include <wtf/RetainPtr.h>
@@ -45,11 +47,12 @@ class FrameView;
 class GraphicsLayer;
 class Page;
 class PlatformWheelEvent;
-class ScrollingTree;
+class Region;
+class ScrollingCoordinatorPrivate;
 class ScrollingTreeState;
 
-#if ENABLE(GESTURE_EVENTS)
-class PlatformGestureEvent;
+#if ENABLE(THREADED_SCROLLING)
+class ScrollingTree;
 #endif
 
 class ScrollingCoordinator : public ThreadSafeRefCounted<ScrollingCoordinator> {
@@ -59,7 +62,9 @@ public:
 
     void pageDestroyed();
 
+#if ENABLE(THREADED_SCROLLING)
     ScrollingTree* scrollingTree() const;
+#endif
 
     // Return whether this scrolling coordinator handles scrolling for the given frame view.
     bool coordinatesScrollingForFrameView(FrameView*) const;
@@ -71,37 +76,68 @@ public:
     // frame view's underlying document.
     void frameViewWheelEventHandlerCountChanged(FrameView*);
 
-    // Should be called whenever the scroll layer for the given frame view changes.
-    void frameViewScrollLayerDidChange(FrameView*, const GraphicsLayer*);
+    // Should be called whenever the slow repaint objects counter changes between zero and one.
+    void frameViewHasSlowRepaintObjectsDidChange(FrameView*);
+
+    // Should be called whenever the fixed objects counter changes between zero and one.
+    // FIXME: This is a temporary workaround so that we'll fall into main thread scrolling mode
+    // if a page has fixed elements. The scrolling tree should know about the fixed elements
+    // so it can make sure they stay fixed even when we scroll on the scrolling thread.
+    void frameViewHasFixedObjectsDidChange(FrameView*);
+
+    // Should be called whenever the root layer for the given frame view changes.
+    void frameViewRootLayerDidChange(FrameView*);
 
     // Should be called whenever the horizontal scrollbar layer for the given frame view changes.
     void frameViewHorizontalScrollbarLayerDidChange(FrameView*, GraphicsLayer* horizontalScrollbarLayer);
 
-    // Should be called whenever the horizontal scrollbar layer for the given frame view changes.
+    // Should be called whenever the vertical scrollbar layer for the given frame view changes.
     void frameViewVerticalScrollbarLayerDidChange(FrameView*, GraphicsLayer* verticalScrollbarLayer);
 
+    // Requests that the scrolling coordinator updates the scroll position of the given frame view. If this function returns true, it means that the
+    // position will be updated asynchronously. If it returns false, the caller should update the scrolling position itself.
+    bool requestScrollPositionUpdate(FrameView*, const IntPoint&);
+
+    // Handle the wheel event on the scrolling thread. Returns whether the event was handled or not.
+    bool handleWheelEvent(FrameView*, const PlatformWheelEvent&);
+
     // Dispatched by the scrolling tree whenever the main frame scroll position changes.
     void updateMainFrameScrollPosition(const IntPoint&);
 
+    // Dispatched by the scrolling tree whenever the main frame scroll position changes and the scroll layer position needs to be updated as well.
+    void updateMainFrameScrollPositionAndScrollLayerPosition(const IntPoint&);
+
 private:
     explicit ScrollingCoordinator(Page*);
 
     void recomputeWheelEventHandlerCount();
+    void updateShouldUpdateScrollLayerPositionOnMainThread();
 
+    void setScrollLayer(GraphicsLayer*);
+    void setNonFastScrollableRegion(const Region&);
+    void setScrollParameters(ScrollElasticity horizontalScrollElasticity, ScrollElasticity verticalScrollElasticity,
+                             bool hasEnabledHorizontalScrollbar, bool hasEnabledVerticalScrollbar,
+                             const IntRect& viewportRect, const IntSize& contentsSize);
+    void setWheelEventHandlerCount(unsigned);
+    void setShouldUpdateScrollLayerPositionOnMainThread(bool);
+
+    Page* m_page;
+
+#if ENABLE(THREADED_SCROLLING)
     void scheduleTreeStateCommit();
+
     void scrollingTreeStateCommitterTimerFired(Timer<ScrollingCoordinator>*);
     void commitTreeStateIfNeeded();
     void commitTreeState();
 
-    Page* m_page;
-    RefPtr<ScrollingTree> m_scrollingTree;
-
     OwnPtr<ScrollingTreeState> m_scrollingTreeState;
+    RefPtr<ScrollingTree> m_scrollingTree;
     Timer<ScrollingCoordinator> m_scrollingTreeStateCommitterTimer;
+#endif
+
+    ScrollingCoordinatorPrivate* m_private;
 };
 
 } // namespace WebCore
 
-#endif // ENABLE(THREADED_SCROLLING)
-
 #endif // ScrollingCoordinator_h
diff --git a/Source/WebCore/page/scrolling/ScrollingCoordinatorNone.cpp b/Source/WebCore/page/scrolling/ScrollingCoordinatorNone.cpp
new file mode 100644
index 000000000..d06d6bb34
--- /dev/null
+++ b/Source/WebCore/page/scrolling/ScrollingCoordinatorNone.cpp
@@ -0,0 +1,77 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#include "ScrollingCoordinator.h"
+
+namespace WebCore {
+
+class ScrollingCoordinatorPrivate {
+};
+
+#if !ENABLE(THREADED_SCROLLING)
+PassRefPtr<ScrollingCoordinator> ScrollingCoordinator::create(Page* page)
+{
+    return adoptRef(new ScrollingCoordinator(page));
+}
+
+ScrollingCoordinator::~ScrollingCoordinator()
+{
+    ASSERT(!m_page);
+}
+
+void ScrollingCoordinator::frameViewHorizontalScrollbarLayerDidChange(FrameView*, GraphicsLayer*)
+{
+}
+
+void ScrollingCoordinator::frameViewVerticalScrollbarLayerDidChange(FrameView*, GraphicsLayer*)
+{
+}
+
+void ScrollingCoordinator::setScrollLayer(GraphicsLayer*)
+{
+}
+
+void ScrollingCoordinator::setNonFastScrollableRegion(const Region&)
+{
+}
+
+void ScrollingCoordinator::setScrollParameters(ScrollElasticity, ScrollElasticity, bool, bool, const IntRect&, const IntSize&)
+{
+}
+
+void ScrollingCoordinator::setWheelEventHandlerCount(unsigned)
+{
+}
+
+void ScrollingCoordinator::setShouldUpdateScrollLayerPositionOnMainThread(bool)
+{
+}
+
+#endif // !ENABLE(THREADED_SCROLLING)
+
+}
+
diff --git a/Source/WebCore/page/scrolling/ScrollingThread.cpp b/Source/WebCore/page/scrolling/ScrollingThread.cpp
index fc5a405da..f92969cc5 100644
--- a/Source/WebCore/page/scrolling/ScrollingThread.cpp
+++ b/Source/WebCore/page/scrolling/ScrollingThread.cpp
@@ -71,17 +71,16 @@ void ScrollingThread::createThreadIfNeeded()
     // Wait for the thread to initialize the run loop.
     {
         MutexLocker locker(m_initializeRunLoopConditionMutex);
-
+#if PLATFORM(MAC)
         while (!m_threadRunLoop)
             m_initializeRunLoopCondition.wait(m_initializeRunLoopConditionMutex);
+#endif
     }
 }
 
-void* ScrollingThread::threadCallback(void* scrollingThread)
+void ScrollingThread::threadCallback(void* scrollingThread)
 {
     static_cast<ScrollingThread*>(scrollingThread)->threadBody();
-
-    return 0;
 }
 
 void ScrollingThread::threadBody()
diff --git a/Source/WebCore/page/scrolling/ScrollingThread.h b/Source/WebCore/page/scrolling/ScrollingThread.h
index 22671e4f5..d8dfa2de0 100644
--- a/Source/WebCore/page/scrolling/ScrollingThread.h
+++ b/Source/WebCore/page/scrolling/ScrollingThread.h
@@ -52,7 +52,7 @@ private:
     static ScrollingThread& shared();
 
     void createThreadIfNeeded();
-    static void* threadCallback(void* scrollingThread);
+    static void threadCallback(void* scrollingThread);
     void threadBody();
     void dispatchFunctionsFromScrollingThread();
 
diff --git a/Source/WebCore/page/scrolling/ScrollingTree.cpp b/Source/WebCore/page/scrolling/ScrollingTree.cpp
index bc1c50d9f..d58c62bd3 100644
--- a/Source/WebCore/page/scrolling/ScrollingTree.cpp
+++ b/Source/WebCore/page/scrolling/ScrollingTree.cpp
@@ -46,6 +46,10 @@ ScrollingTree::ScrollingTree(ScrollingCoordinator* scrollingCoordinator)
     : m_scrollingCoordinator(scrollingCoordinator)
     , m_rootNode(ScrollingTreeNode::create(this))
     , m_hasWheelEventHandlers(false)
+    , m_canGoBack(false)
+    , m_canGoForward(false)
+    , m_mainFramePinnedToTheLeft(false)
+    , m_mainFramePinnedToTheRight(false)
 {
 }
 
@@ -54,25 +58,36 @@ ScrollingTree::~ScrollingTree()
     ASSERT(!m_scrollingCoordinator);
 }
 
-bool ScrollingTree::tryToHandleWheelEvent(const PlatformWheelEvent& wheelEvent)
+ScrollingTree::EventResult ScrollingTree::tryToHandleWheelEvent(const PlatformWheelEvent& wheelEvent)
 {
     {
         MutexLocker lock(m_mutex);
 
         if (m_hasWheelEventHandlers)
-            return false;
+            return SendToMainThread;
 
         if (!m_nonFastScrollableRegion.isEmpty()) {
             // FIXME: This is not correct for non-default scroll origins.
             IntPoint position = wheelEvent.position();
             position.moveBy(m_mainFrameScrollPosition);
             if (m_nonFastScrollableRegion.contains(position))
-                return false;
+                return SendToMainThread;
         }
     }
 
+    if (willWheelEventStartSwipeGesture(wheelEvent))
+        return DidNotHandleEvent;
+
     ScrollingThread::dispatch(bind(&ScrollingTree::handleWheelEvent, this, wheelEvent));
-    return true;
+    return DidHandleEvent;
+}
+
+void ScrollingTree::updateBackForwardState(bool canGoBack, bool canGoForward)
+{
+    MutexLocker locker(m_swipeStateMutex);
+
+    m_canGoBack = canGoBack;
+    m_canGoForward = canGoForward;
 }
 
 void ScrollingTree::handleWheelEvent(const PlatformWheelEvent& wheelEvent)
@@ -82,13 +97,31 @@ void ScrollingTree::handleWheelEvent(const PlatformWheelEvent& wheelEvent)
     m_rootNode->handleWheelEvent(wheelEvent);
 }
 
+void ScrollingTree::setMainFrameScrollPosition(const IntPoint& scrollPosition)
+{
+    ASSERT(ScrollingThread::isCurrentThread());
+
+    m_rootNode->setScrollPosition(scrollPosition);
+}
+
+static void derefScrollingCoordinator(ScrollingCoordinator* scrollingCoordinator)
+{
+    ASSERT(isMainThread());
+
+    scrollingCoordinator->deref();
+}
+
 void ScrollingTree::invalidate()
 {
     // Invalidate is dispatched by the ScrollingCoordinator class on the ScrollingThread
     // to break the reference cycle between ScrollingTree and ScrollingCoordinator when the
     // ScrollingCoordinator's page is destroyed.
     ASSERT(ScrollingThread::isCurrentThread());
-    m_scrollingCoordinator = nullptr;
+
+    // Since this can potentially be the last reference to the scrolling coordinator,
+    // we need to release it on the main thread since it has member variables (such as timers)
+    // that expect to be destroyed from the main thread.
+    callOnMainThread(bind(derefScrollingCoordinator, m_scrollingCoordinator.release().leakRef()));
 }
 
 void ScrollingTree::commitNewTreeState(PassOwnPtr<ScrollingTreeState> scrollingTreeState)
@@ -107,6 +140,14 @@ void ScrollingTree::commitNewTreeState(PassOwnPtr<ScrollingTreeState> scrollingT
     m_rootNode->update(scrollingTreeState.get());
 }
 
+void ScrollingTree::setMainFramePinState(bool pinnedToTheLeft, bool pinnedToTheRight)
+{
+    MutexLocker locker(m_swipeStateMutex);
+
+    m_mainFramePinnedToTheLeft = pinnedToTheLeft;
+    m_mainFramePinnedToTheRight = pinnedToTheRight;
+}
+
 void ScrollingTree::updateMainFrameScrollPosition(const IntPoint& scrollPosition)
 {
     if (!m_scrollingCoordinator)
@@ -120,6 +161,50 @@ void ScrollingTree::updateMainFrameScrollPosition(const IntPoint& scrollPosition
     callOnMainThread(bind(&ScrollingCoordinator::updateMainFrameScrollPosition, m_scrollingCoordinator.get(), scrollPosition));
 }
 
+void ScrollingTree::updateMainFrameScrollPositionAndScrollLayerPosition(const IntPoint& scrollPosition)
+{
+    if (!m_scrollingCoordinator)
+        return;
+
+    {
+        MutexLocker lock(m_mutex);
+        m_mainFrameScrollPosition = scrollPosition;
+    }
+
+    callOnMainThread(bind(&ScrollingCoordinator::updateMainFrameScrollPositionAndScrollLayerPosition, m_scrollingCoordinator.get(), scrollPosition));
+}
+
+bool ScrollingTree::canGoBack()
+{
+    MutexLocker lock(m_swipeStateMutex);
+
+    return m_canGoBack;
+}
+
+bool ScrollingTree::canGoForward()
+{
+    MutexLocker lock(m_swipeStateMutex);
+
+    return m_canGoForward;
+}
+
+bool ScrollingTree::willWheelEventStartSwipeGesture(const PlatformWheelEvent& wheelEvent)
+{
+    if (wheelEvent.phase() != PlatformWheelEventPhaseBegan)
+        return false;
+    if (!wheelEvent.deltaX())
+        return false;
+
+    MutexLocker lock(m_swipeStateMutex);
+
+    if (wheelEvent.deltaX() > 0 && m_mainFramePinnedToTheLeft && m_canGoBack)
+        return true;
+    if (wheelEvent.deltaX() < 0 && m_mainFramePinnedToTheRight && m_canGoForward)
+        return true;
+
+    return false;
+}
+
 } // namespace WebCore
 
 #endif // ENABLE(THREADED_SCROLLING)
diff --git a/Source/WebCore/page/scrolling/ScrollingTree.h b/Source/WebCore/page/scrolling/ScrollingTree.h
index 76cbfda0a..00d2584c0 100644
--- a/Source/WebCore/page/scrolling/ScrollingTree.h
+++ b/Source/WebCore/page/scrolling/ScrollingTree.h
@@ -29,6 +29,7 @@
 #if ENABLE(THREADED_SCROLLING)
 
 #include "Region.h"
+#include <wtf/Functional.h>
 #include <wtf/OwnPtr.h>
 #include <wtf/PassOwnPtr.h>
 #include <wtf/PassRefPtr.h>
@@ -52,18 +53,37 @@ public:
     static PassRefPtr<ScrollingTree> create(ScrollingCoordinator*);
     ~ScrollingTree();
 
+    enum EventResult {
+        DidNotHandleEvent,
+        DidHandleEvent,
+        SendToMainThread
+    };
+
     // Can be called from any thread. Will try to handle the wheel event on the scrolling thread.
     // Returns true if the wheel event can be handled on the scrolling thread and false if the
     // event must be sent again to the WebCore event handler.
-    bool tryToHandleWheelEvent(const PlatformWheelEvent&);
+    EventResult tryToHandleWheelEvent(const PlatformWheelEvent&);
+
+    // Can be called from any thread. Will update the back forward state of the page, used for rubber-banding.
+    void updateBackForwardState(bool canGoBack, bool canGoForward);
 
     // Must be called from the scrolling thread. Handles the wheel event.
     void handleWheelEvent(const PlatformWheelEvent&);
 
+    void setMainFrameScrollPosition(const IntPoint&);
+
     void invalidate();
     void commitNewTreeState(PassOwnPtr<ScrollingTreeState>);
 
+    void setMainFramePinState(bool pinnedToTheLeft, bool pinnedToTheRight);
+
     void updateMainFrameScrollPosition(const IntPoint& scrollPosition);
+    void updateMainFrameScrollPositionAndScrollLayerPosition(const IntPoint& scrollPosition);
+
+    bool canGoBack();
+    bool canGoForward();
+
+    bool willWheelEventStartSwipeGesture(const PlatformWheelEvent&);
 
 private:
     explicit ScrollingTree(ScrollingCoordinator*);
@@ -75,6 +95,12 @@ private:
     Region m_nonFastScrollableRegion;
     IntPoint m_mainFrameScrollPosition;
     bool m_hasWheelEventHandlers;
+
+    Mutex m_swipeStateMutex;
+    bool m_canGoBack;
+    bool m_canGoForward;
+    bool m_mainFramePinnedToTheLeft;
+    bool m_mainFramePinnedToTheRight;
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/page/scrolling/ScrollingTreeNode.cpp b/Source/WebCore/page/scrolling/ScrollingTreeNode.cpp
index bd94f00dc..8626b89ff 100644
--- a/Source/WebCore/page/scrolling/ScrollingTreeNode.cpp
+++ b/Source/WebCore/page/scrolling/ScrollingTreeNode.cpp
@@ -34,6 +34,11 @@ namespace WebCore {
 
 ScrollingTreeNode::ScrollingTreeNode(ScrollingTree* scrollingTree)
     : m_scrollingTree(scrollingTree)
+    , m_shouldUpdateScrollLayerPositionOnMainThread(false)
+    , m_horizontalScrollElasticity(ScrollElasticityNone)
+    , m_verticalScrollElasticity(ScrollElasticityNone)
+    , m_hasEnabledHorizontalScrollbar(false)
+    , m_hasEnabledVerticalScrollbar(false)
 {
 }
 
@@ -48,6 +53,21 @@ void ScrollingTreeNode::update(ScrollingTreeState* state)
 
     if (state->changedProperties() & ScrollingTreeState::ContentsSize)
         m_contentsSize = state->contentsSize();
+
+    if (state->changedProperties() & ScrollingTreeState::ShouldUpdateScrollLayerPositionOnMainThread)
+        m_shouldUpdateScrollLayerPositionOnMainThread = state->shouldUpdateScrollLayerPositionOnMainThread();
+
+    if (state->changedProperties() & ScrollingTreeState::HorizontalScrollElasticity)
+        m_horizontalScrollElasticity = state->horizontalScrollElasticity();
+
+    if (state->changedProperties() & ScrollingTreeState::VerticalScrollElasticity)
+        m_verticalScrollElasticity = state->verticalScrollElasticity();
+
+    if (state->changedProperties() & ScrollingTreeState::HasEnabledHorizontalScrollbar)
+        m_hasEnabledHorizontalScrollbar = state->hasEnabledHorizontalScrollbar();
+
+    if (state->changedProperties() & ScrollingTreeState::HasEnabledVerticalScrollbar)
+        m_hasEnabledVerticalScrollbar = state->hasEnabledVerticalScrollbar();
 }
 
 } // namespace WebCore
diff --git a/Source/WebCore/page/scrolling/ScrollingTreeNode.h b/Source/WebCore/page/scrolling/ScrollingTreeNode.h
index d26293a89..258783e7d 100644
--- a/Source/WebCore/page/scrolling/ScrollingTreeNode.h
+++ b/Source/WebCore/page/scrolling/ScrollingTreeNode.h
@@ -29,6 +29,7 @@
 #if ENABLE(THREADED_SCROLLING)
 
 #include "IntRect.h"
+#include "ScrollTypes.h"
 #include <wtf/PassOwnPtr.h>
 
 namespace WebCore {
@@ -44,19 +45,37 @@ public:
 
     virtual void update(ScrollingTreeState*);
     virtual void handleWheelEvent(const PlatformWheelEvent&) = 0;
+    virtual void setScrollPosition(const IntPoint&) = 0;
 
 protected:
     explicit ScrollingTreeNode(ScrollingTree*);
 
     ScrollingTree* scrollingTree() const { return m_scrollingTree; }
+
     const IntRect& viewportRect() const { return m_viewportRect; }
     const IntSize& contentsSize() const { return m_contentsSize; }
 
+    bool shouldUpdateScrollLayerPositionOnMainThread() const { return m_shouldUpdateScrollLayerPositionOnMainThread; }
+
+    ScrollElasticity horizontalScrollElasticity() const { return m_horizontalScrollElasticity; }
+    ScrollElasticity verticalScrollElasticity() const { return m_verticalScrollElasticity; }
+
+    bool hasEnabledHorizontalScrollbar() const { return m_hasEnabledHorizontalScrollbar; }
+    bool hasEnabledVerticalScrollbar() const { return m_hasEnabledVerticalScrollbar; }
+
 private:
     ScrollingTree* m_scrollingTree;
 
     IntRect m_viewportRect;
     IntSize m_contentsSize;
+
+    bool m_shouldUpdateScrollLayerPositionOnMainThread;
+
+    ScrollElasticity m_horizontalScrollElasticity;
+    ScrollElasticity m_verticalScrollElasticity;
+    
+    bool m_hasEnabledHorizontalScrollbar;
+    bool m_hasEnabledVerticalScrollbar;
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/page/scrolling/ScrollingTreeState.cpp b/Source/WebCore/page/scrolling/ScrollingTreeState.cpp
index c368152c3..ebf648d2b 100644
--- a/Source/WebCore/page/scrolling/ScrollingTreeState.cpp
+++ b/Source/WebCore/page/scrolling/ScrollingTreeState.cpp
@@ -38,6 +38,11 @@ PassOwnPtr<ScrollingTreeState> ScrollingTreeState::create()
 ScrollingTreeState::ScrollingTreeState()
     : m_changedProperties(0)
     , m_wheelEventHandlerCount(0)
+    , m_shouldUpdateScrollLayerPositionOnMainThread(false)
+    , m_horizontalScrollElasticity(ScrollElasticityNone)
+    , m_verticalScrollElasticity(ScrollElasticityNone)
+    , m_hasEnabledHorizontalScrollbar(false)
+    , m_hasEnabledVerticalScrollbar(false)
 {
 }
 
@@ -81,6 +86,51 @@ void ScrollingTreeState::setWheelEventHandlerCount(unsigned wheelEventHandlerCou
     m_changedProperties |= WheelEventHandlerCount;
 }
 
+void ScrollingTreeState::setShouldUpdateScrollLayerPositionOnMainThread(bool shouldUpdateScrollLayerPositionOnMainThread)
+{
+    if (m_shouldUpdateScrollLayerPositionOnMainThread == shouldUpdateScrollLayerPositionOnMainThread)
+        return;
+
+    m_shouldUpdateScrollLayerPositionOnMainThread = shouldUpdateScrollLayerPositionOnMainThread;
+    m_changedProperties |= ShouldUpdateScrollLayerPositionOnMainThread;
+}
+
+void ScrollingTreeState::setHorizontalScrollElasticity(ScrollElasticity horizontalScrollElasticity)
+{
+    if (m_horizontalScrollElasticity == horizontalScrollElasticity)
+        return;
+
+    m_horizontalScrollElasticity = horizontalScrollElasticity;
+    m_changedProperties |= HorizontalScrollElasticity;
+}
+
+void ScrollingTreeState::setVerticalScrollElasticity(ScrollElasticity verticalScrollElasticity)
+{
+    if (m_verticalScrollElasticity == verticalScrollElasticity)
+        return;
+
+    m_verticalScrollElasticity = verticalScrollElasticity;
+    m_changedProperties |= VerticalScrollElasticity;
+}
+
+void ScrollingTreeState::setHasEnabledHorizontalScrollbar(bool hasEnabledHorizontalScrollbar)
+{
+    if (m_hasEnabledHorizontalScrollbar == hasEnabledHorizontalScrollbar)
+        return;
+
+    m_hasEnabledHorizontalScrollbar = hasEnabledHorizontalScrollbar;
+    m_changedProperties |= HasEnabledHorizontalScrollbar;
+}
+
+void ScrollingTreeState::setHasEnabledVerticalScrollbar(bool hasEnabledVerticalScrollbar)
+{
+    if (m_hasEnabledVerticalScrollbar == hasEnabledVerticalScrollbar)
+        return;
+
+    m_hasEnabledVerticalScrollbar = hasEnabledVerticalScrollbar;
+    m_changedProperties |= HasEnabledVerticalScrollbar;
+}
+
 PassOwnPtr<ScrollingTreeState> ScrollingTreeState::commit()
 {
     OwnPtr<ScrollingTreeState> treeState = adoptPtr(new ScrollingTreeState(*this));
diff --git a/Source/WebCore/page/scrolling/ScrollingTreeState.h b/Source/WebCore/page/scrolling/ScrollingTreeState.h
index fde884922..97cc77a94 100644
--- a/Source/WebCore/page/scrolling/ScrollingTreeState.h
+++ b/Source/WebCore/page/scrolling/ScrollingTreeState.h
@@ -31,6 +31,7 @@
 #include "GraphicsLayer.h"
 #include "IntRect.h"
 #include "Region.h"
+#include "ScrollTypes.h"
 #include <wtf/PassOwnPtr.h>
 
 #if PLATFORM(MAC)
@@ -53,7 +54,12 @@ public:
         ContentsSize = 1 << 1,
         NonFastScrollableRegion = 1 << 2,
         WheelEventHandlerCount = 1 << 3,
-        ScrollLayer = 1 << 4,
+        ShouldUpdateScrollLayerPositionOnMainThread = 1 << 4,
+        HorizontalScrollElasticity = 1 << 5,
+        VerticalScrollElasticity = 1 << 6,
+        HasEnabledHorizontalScrollbar = 1 << 7,
+        HasEnabledVerticalScrollbar = 1 << 8,
+        ScrollLayer = 1 << 9,
     };
 
     bool hasChangedProperties() const { return m_changedProperties; }
@@ -71,6 +77,21 @@ public:
     unsigned wheelEventHandlerCount() const { return m_wheelEventHandlerCount; }
     void setWheelEventHandlerCount(unsigned);
 
+    bool shouldUpdateScrollLayerPositionOnMainThread() const { return m_shouldUpdateScrollLayerPositionOnMainThread; }
+    void setShouldUpdateScrollLayerPositionOnMainThread(bool);
+
+    ScrollElasticity horizontalScrollElasticity() const { return m_horizontalScrollElasticity; }
+    void setHorizontalScrollElasticity(ScrollElasticity);
+
+    ScrollElasticity verticalScrollElasticity() const { return m_verticalScrollElasticity; }
+    void setVerticalScrollElasticity(ScrollElasticity);
+
+    bool hasEnabledHorizontalScrollbar() const { return m_hasEnabledHorizontalScrollbar; }
+    void setHasEnabledHorizontalScrollbar(bool);
+
+    bool hasEnabledVerticalScrollbar() const { return m_hasEnabledVerticalScrollbar; }
+    void setHasEnabledVerticalScrollbar(bool);
+
     PlatformLayer* platformScrollLayer() const;
     void setScrollLayer(const GraphicsLayer*);
 
@@ -89,6 +110,14 @@ private:
 
     unsigned m_wheelEventHandlerCount;
 
+    bool m_shouldUpdateScrollLayerPositionOnMainThread;
+
+    ScrollElasticity m_horizontalScrollElasticity;
+    ScrollElasticity m_verticalScrollElasticity;
+
+    bool m_hasEnabledHorizontalScrollbar;
+    bool m_hasEnabledVerticalScrollbar;
+
 #if PLATFORM(MAC)
     RetainPtr<PlatformLayer> m_platformScrollLayer;
 #endif
diff --git a/Source/WebCore/page/scrolling/chromium/ScrollingCoordinatorChromium.cpp b/Source/WebCore/page/scrolling/chromium/ScrollingCoordinatorChromium.cpp
new file mode 100644
index 000000000..e590138a6
--- /dev/null
+++ b/Source/WebCore/page/scrolling/chromium/ScrollingCoordinatorChromium.cpp
@@ -0,0 +1,99 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#include "ScrollingCoordinator.h"
+
+#include "LayerChromium.h"
+#include "Region.h"
+
+namespace WebCore {
+
+class ScrollingCoordinatorPrivate {
+WTF_MAKE_NONCOPYABLE(ScrollingCoordinatorPrivate);
+public:
+    ScrollingCoordinatorPrivate() { }
+    ~ScrollingCoordinatorPrivate() { }
+
+    void setScrollLayer(LayerChromium* layer) { m_scrollLayer = layer; }
+    LayerChromium* scrollLayer() const { return m_scrollLayer.get(); }
+
+private:
+    RefPtr<LayerChromium> m_scrollLayer;
+};
+
+PassRefPtr<ScrollingCoordinator> ScrollingCoordinator::create(Page* page)
+{
+    RefPtr<ScrollingCoordinator> coordinator(adoptRef(new ScrollingCoordinator(page)));
+    coordinator->m_private = new ScrollingCoordinatorPrivate;
+    return coordinator.release();
+}
+
+ScrollingCoordinator::~ScrollingCoordinator()
+{
+    ASSERT(!m_page);
+    delete m_private;
+}
+
+void ScrollingCoordinator::frameViewHorizontalScrollbarLayerDidChange(FrameView*, GraphicsLayer* horizontalScrollbarLayer)
+{
+    // FIXME: Implement!
+}
+
+void ScrollingCoordinator::frameViewVerticalScrollbarLayerDidChange(FrameView*, GraphicsLayer* verticalScrollbarLayer)
+{
+    // FIXME: Implement!
+}
+
+void ScrollingCoordinator::setScrollLayer(GraphicsLayer* scrollLayer)
+{
+    m_private->setScrollLayer(scrollLayer ? scrollLayer->platformLayer() : 0);
+}
+
+void ScrollingCoordinator::setNonFastScrollableRegion(const Region&)
+{
+    // FIXME: Implement!
+}
+
+void ScrollingCoordinator::setScrollParameters(ScrollElasticity horizontalScrollElasticity, ScrollElasticity verticalScrollElasticity,
+                                               bool hasEnabledHorizontalScrollbar, bool hasEnabledVerticalScrollbar,
+                                               const IntRect& viewportRect, const IntSize& contentsSize)
+{
+    // FIXME: Implement!
+}
+
+void ScrollingCoordinator::setWheelEventHandlerCount(unsigned wheelEventHandlerCount)
+{
+    if (LayerChromium* layer = m_private->scrollLayer())
+        layer->setHaveWheelEventHandlers(wheelEventHandlerCount > 0);
+}
+
+void ScrollingCoordinator::setShouldUpdateScrollLayerPositionOnMainThread(bool should)
+{
+    // FIXME: Implement!
+}
+
+}
diff --git a/Source/WebCore/page/scrolling/mac/ScrollingCoordinatorMac.mm b/Source/WebCore/page/scrolling/mac/ScrollingCoordinatorMac.mm
index 31fa76683..94335b0b2 100644
--- a/Source/WebCore/page/scrolling/mac/ScrollingCoordinatorMac.mm
+++ b/Source/WebCore/page/scrolling/mac/ScrollingCoordinatorMac.mm
@@ -42,6 +42,20 @@
 
 namespace WebCore {
 
+class ScrollingCoordinatorPrivate {
+};
+
+PassRefPtr<ScrollingCoordinator> ScrollingCoordinator::create(Page* page)
+{
+    return adoptRef(new ScrollingCoordinator(page));
+}
+
+ScrollingCoordinator::~ScrollingCoordinator()
+{
+    ASSERT(!m_page);
+    ASSERT(!m_scrollingTree);
+}
+
 void ScrollingCoordinator::frameViewHorizontalScrollbarLayerDidChange(FrameView* frameView, GraphicsLayer*)
 {
     ASSERT(isMainThread());
@@ -64,18 +78,6 @@ void ScrollingCoordinator::frameViewVerticalScrollbarLayerDidChange(FrameView* f
     // FIXME: Implement.
 }
 
-void ScrollingCoordinator::frameViewScrollLayerDidChange(FrameView* frameView, const GraphicsLayer* scrollLayer)
-{
-    ASSERT(isMainThread());
-    ASSERT(m_page);
-
-    if (frameView->frame() != m_page->mainFrame())
-        return;
-
-    m_scrollingTreeState->setScrollLayer(scrollLayer);
-    scheduleTreeStateCommit();
-}
-
 } // namespace WebCore
 
 #endif // ENABLE(THREADED_SCROLLING)
diff --git a/Source/WebCore/page/scrolling/mac/ScrollingTreeNodeMac.h b/Source/WebCore/page/scrolling/mac/ScrollingTreeNodeMac.h
index b1ae6ee76..97b3d22bc 100644
--- a/Source/WebCore/page/scrolling/mac/ScrollingTreeNodeMac.h
+++ b/Source/WebCore/page/scrolling/mac/ScrollingTreeNodeMac.h
@@ -28,6 +28,7 @@
 
 #if ENABLE(THREADED_SCROLLING)
 
+#include "ScrollElasticityController.h"
 #include "ScrollingTreeNode.h"
 #include <wtf/RetainPtr.h>
 
@@ -35,18 +36,44 @@ OBJC_CLASS CALayer;
 
 namespace WebCore {
 
-class ScrollingTreeNodeMac : public ScrollingTreeNode {
+class ScrollingTreeNodeMac : public ScrollingTreeNode, private ScrollElasticityControllerClient {
 public:
     explicit ScrollingTreeNodeMac(ScrollingTree*);
+    virtual ~ScrollingTreeNodeMac();
 
 private:
+    // ScrollingTreeNode member functions.
     virtual void update(ScrollingTreeState*) OVERRIDE;
     virtual void handleWheelEvent(const PlatformWheelEvent&) OVERRIDE;
+    virtual void setScrollPosition(const IntPoint&) OVERRIDE;
+
+    // ScrollElasticityController member functions.
+    virtual bool allowsHorizontalStretching() OVERRIDE;
+    virtual bool allowsVerticalStretching() OVERRIDE;
+    virtual IntSize stretchAmount() OVERRIDE;
+    virtual bool pinnedInDirection(const FloatSize&) OVERRIDE;
+    virtual bool canScrollHorizontally() OVERRIDE;
+    virtual bool canScrollVertically() OVERRIDE;
+    virtual bool shouldRubberBandInDirection(ScrollDirection) OVERRIDE;
+    virtual IntPoint absoluteScrollPosition() OVERRIDE;
+    virtual void immediateScrollBy(const FloatSize&) OVERRIDE;
+    virtual void immediateScrollByWithoutContentEdgeConstraints(const FloatSize&) OVERRIDE;
+    virtual void startSnapRubberbandTimer() OVERRIDE;
+    virtual void stopSnapRubberbandTimer() OVERRIDE;
 
     IntPoint scrollPosition() const;
-    void setScrollPosition(const IntPoint&);
+    void setScrollLayerPosition(const IntPoint&);
+
+    IntPoint minimumScrollPosition() const;
+    IntPoint maximumScrollPosition() const;
 
     void scrollBy(const IntSize&);
+    void scrollByWithoutContentEdgeConstraints(const IntSize&);
+
+    void updateMainFramePinState(const IntPoint& scrollPosition);
+
+    ScrollElasticityController m_scrollElasticityController;
+    RetainPtr<CFRunLoopTimerRef> m_snapRubberbandTimer;
 
     RetainPtr<CALayer> m_scrollLayer;
 };
diff --git a/Source/WebCore/page/scrolling/mac/ScrollingTreeNodeMac.mm b/Source/WebCore/page/scrolling/mac/ScrollingTreeNodeMac.mm
index 76a8e3eaf..966b2e18f 100644
--- a/Source/WebCore/page/scrolling/mac/ScrollingTreeNodeMac.mm
+++ b/Source/WebCore/page/scrolling/mac/ScrollingTreeNodeMac.mm
@@ -41,21 +41,175 @@ PassOwnPtr<ScrollingTreeNode> ScrollingTreeNode::create(ScrollingTree* scrolling
 
 ScrollingTreeNodeMac::ScrollingTreeNodeMac(ScrollingTree* scrollingTree)
     : ScrollingTreeNode(scrollingTree)
+    , m_scrollElasticityController(this)
 {
 }
 
+ScrollingTreeNodeMac::~ScrollingTreeNodeMac()
+{
+    if (m_snapRubberbandTimer)
+        CFRunLoopTimerInvalidate(m_snapRubberbandTimer.get());
+}
+
 void ScrollingTreeNodeMac::update(ScrollingTreeState* state)
 {
     ScrollingTreeNode::update(state);
 
     if (state->changedProperties() & ScrollingTreeState::ScrollLayer)
         m_scrollLayer = state->platformScrollLayer();
+
+    if (state->changedProperties() & (ScrollingTreeState::ScrollLayer | ScrollingTreeState::ContentsSize | ScrollingTreeState::ViewportRect))
+        updateMainFramePinState(scrollPosition());
 }
 
 void ScrollingTreeNodeMac::handleWheelEvent(const PlatformWheelEvent& wheelEvent)
 {
-    // FXIME: This needs to handle rubberbanding.
-    scrollBy(IntSize(-wheelEvent.deltaX(), -wheelEvent.deltaY()));
+    m_scrollElasticityController.handleWheelEvent(wheelEvent);
+}
+
+void ScrollingTreeNodeMac::setScrollPosition(const IntPoint& scrollPosition)
+{
+    updateMainFramePinState(scrollPosition);
+
+    if (shouldUpdateScrollLayerPositionOnMainThread()) {
+        scrollingTree()->updateMainFrameScrollPositionAndScrollLayerPosition(scrollPosition);
+        return;
+    }
+
+    setScrollLayerPosition(scrollPosition);
+    scrollingTree()->updateMainFrameScrollPosition(scrollPosition);
+}
+
+bool ScrollingTreeNodeMac::allowsHorizontalStretching()
+{
+    switch (horizontalScrollElasticity()) {
+    case ScrollElasticityAutomatic:
+        return hasEnabledHorizontalScrollbar() || !hasEnabledVerticalScrollbar();
+    case ScrollElasticityNone:
+        return false;
+    case ScrollElasticityAllowed:
+        return true;
+    }
+
+    ASSERT_NOT_REACHED();
+    return false;
+}
+
+bool ScrollingTreeNodeMac::allowsVerticalStretching()
+{
+    switch (verticalScrollElasticity()) {
+    case ScrollElasticityAutomatic:
+        return hasEnabledVerticalScrollbar() || !hasEnabledHorizontalScrollbar();
+    case ScrollElasticityNone:
+        return false;
+    case ScrollElasticityAllowed:
+        return true;
+    }
+
+    ASSERT_NOT_REACHED();
+    return false;
+}
+
+IntSize ScrollingTreeNodeMac::stretchAmount()
+{
+    IntSize stretch;
+
+    if (scrollPosition().y() < minimumScrollPosition().y())
+        stretch.setHeight(scrollPosition().y() - minimumScrollPosition().y());
+    else if (scrollPosition().y() > maximumScrollPosition().y())
+        stretch.setHeight(scrollPosition().y() - maximumScrollPosition().y());
+
+    if (scrollPosition().x() < minimumScrollPosition().x())
+        stretch.setWidth(scrollPosition().x() - minimumScrollPosition().x());
+    else if (scrollPosition().x() > maximumScrollPosition().x())
+        stretch.setWidth(scrollPosition().x() - maximumScrollPosition().x());
+
+    return stretch;
+}
+
+bool ScrollingTreeNodeMac::pinnedInDirection(const FloatSize& delta)
+{
+    FloatSize limitDelta;
+
+    if (fabsf(delta.height()) >= fabsf(delta.width())) {
+        if (delta.height() < 0) {
+            // We are trying to scroll up.  Make sure we are not pinned to the top
+            limitDelta.setHeight(scrollPosition().y() - minimumScrollPosition().y());
+        } else {
+            // We are trying to scroll down.  Make sure we are not pinned to the bottom
+            limitDelta.setHeight(maximumScrollPosition().y() - scrollPosition().y());
+        }
+    } else if (delta.width()) {
+        if (delta.width() < 0) {
+            // We are trying to scroll left.  Make sure we are not pinned to the left
+            limitDelta.setHeight(scrollPosition().x() - minimumScrollPosition().x());
+        } else {
+            // We are trying to scroll right.  Make sure we are not pinned to the right
+            limitDelta.setHeight(maximumScrollPosition().x() - scrollPosition().x());
+        }
+    }
+
+    if ((delta.width() || delta.height()) && (limitDelta.width() < 1 && limitDelta.height() < 1))        
+        return true;
+
+    return false;
+}
+
+bool ScrollingTreeNodeMac::canScrollHorizontally()
+{
+    return hasEnabledHorizontalScrollbar();
+}
+
+bool ScrollingTreeNodeMac::canScrollVertically()
+{
+    return hasEnabledVerticalScrollbar();
+}
+
+bool ScrollingTreeNodeMac::shouldRubberBandInDirection(ScrollDirection direction)
+{
+    if (direction == ScrollLeft)
+        return !scrollingTree()->canGoBack();
+    if (direction == ScrollRight)
+        return !scrollingTree()->canGoForward();
+
+    ASSERT_NOT_REACHED();
+    return false;
+}
+
+IntPoint ScrollingTreeNodeMac::absoluteScrollPosition()
+{
+    return scrollPosition();
+}
+
+void ScrollingTreeNodeMac::immediateScrollBy(const FloatSize& offset)
+{
+    scrollBy(roundedIntSize(offset));
+}
+
+void ScrollingTreeNodeMac::immediateScrollByWithoutContentEdgeConstraints(const FloatSize& offset)
+{
+    scrollByWithoutContentEdgeConstraints(roundedIntSize(offset));
+}
+
+void ScrollingTreeNodeMac::startSnapRubberbandTimer()
+{
+    ASSERT(!m_snapRubberbandTimer);
+
+    CFTimeInterval timerInterval = 1.0 / 60.0;
+
+    m_snapRubberbandTimer = adoptCF(CFRunLoopTimerCreateWithHandler(kCFAllocatorDefault, CFAbsoluteTimeGetCurrent() + timerInterval, timerInterval, 0, 0, ^(CFRunLoopTimerRef) {
+        m_scrollElasticityController.snapRubberBandTimerFired();
+    }));
+    CFRunLoopAddTimer(CFRunLoopGetCurrent(), m_snapRubberbandTimer.get(), kCFRunLoopDefaultMode);
+}
+
+void ScrollingTreeNodeMac::stopSnapRubberbandTimer()
+{
+    if (!m_snapRubberbandTimer)
+        return;
+
+    CFRunLoopTimerInvalidate(m_snapRubberbandTimer.get());
+    m_snapRubberbandTimer = nullptr;
 }
 
 IntPoint ScrollingTreeNodeMac::scrollPosition() const
@@ -64,16 +218,49 @@ IntPoint ScrollingTreeNodeMac::scrollPosition() const
     return IntPoint(-scrollLayerPosition.x, -scrollLayerPosition.y);
 }
 
-void ScrollingTreeNodeMac::setScrollPosition(const IntPoint& position)
+void ScrollingTreeNodeMac::setScrollLayerPosition(const IntPoint& position)
 {
+    ASSERT(!shouldUpdateScrollLayerPositionOnMainThread());
     m_scrollLayer.get().position = CGPointMake(-position.x(), -position.y());
 }
 
-void ScrollingTreeNodeMac::scrollBy(const IntSize &offset)
+IntPoint ScrollingTreeNodeMac::minimumScrollPosition() const
+{
+    // FIXME: This should take the scroll origin into account.
+    return IntPoint(0, 0);
+}
+
+IntPoint ScrollingTreeNodeMac::maximumScrollPosition() const
+{
+    // FIXME: This should take the scroll origin into account.
+    IntPoint position(contentsSize().width() - viewportRect().width(),
+                      contentsSize().height() - viewportRect().height());
+
+    position.clampNegativeToZero();
+
+    return position;
+}
+
+void ScrollingTreeNodeMac::scrollBy(const IntSize& offset)
+{
+    IntPoint newScrollPosition = scrollPosition() + offset;
+    newScrollPosition = newScrollPosition.shrunkTo(maximumScrollPosition());
+    newScrollPosition = newScrollPosition.expandedTo(minimumScrollPosition());
+
+    setScrollPosition(newScrollPosition);
+}
+
+void ScrollingTreeNodeMac::scrollByWithoutContentEdgeConstraints(const IntSize& offset)
 {
     setScrollPosition(scrollPosition() + offset);
+}
+
+void ScrollingTreeNodeMac::updateMainFramePinState(const IntPoint& scrollPosition)
+{
+    bool pinnedToTheLeft = scrollPosition.x() <= minimumScrollPosition().x();
+    bool pinnedToTheRight = scrollPosition.x() >= maximumScrollPosition().x();
 
-    scrollingTree()->updateMainFrameScrollPosition(scrollPosition());
+    scrollingTree()->setMainFramePinState(pinnedToTheLeft, pinnedToTheRight);
 }
 
 } // namespace WebCore
diff --git a/Source/WebCore/page/win/FrameCGWin.cpp b/Source/WebCore/page/win/FrameCGWin.cpp
index ea2c391e7..ab6a8a57c 100644
--- a/Source/WebCore/page/win/FrameCGWin.cpp
+++ b/Source/WebCore/page/win/FrameCGWin.cpp
@@ -98,7 +98,7 @@ DragImageRef Frame::nodeImage(Node* node)
         return 0;
 
     LayoutRect topLevelRect;
-    IntRect paintingRect = renderer->paintingRootRect(topLevelRect);
+    IntRect paintingRect = pixelSnappedIntRect(renderer->paintingRootRect(topLevelRect));
 
     document()->updateLayout();
 
diff --git a/Source/WebCore/platform/AsyncFileSystem.cpp b/Source/WebCore/platform/AsyncFileSystem.cpp
index c3c241224..7b811d4c3 100644
--- a/Source/WebCore/platform/AsyncFileSystem.cpp
+++ b/Source/WebCore/platform/AsyncFileSystem.cpp
@@ -34,6 +34,7 @@
 #if ENABLE(FILE_SYSTEM)
 
 #include "AsyncFileSystemCallbacks.h"
+#include "ExceptionCode.h"
 #include "FileSystem.h"
 #include "NotImplemented.h"
 
@@ -44,7 +45,7 @@ const size_t AsyncFileSystem::persistentPathPrefixLength = sizeof(AsyncFileSyste
 const char AsyncFileSystem::temporaryPathPrefix[] = "temporary";
 const size_t AsyncFileSystem::temporaryPathPrefixLength = sizeof(AsyncFileSystem::temporaryPathPrefix) - 1;
 
-#if !PLATFORM(CHROMIUM)
+#if !PLATFORM(CHROMIUM) && !PLATFORM(GTK)
 bool AsyncFileSystem::isAvailable()
 {
     notImplemented();
@@ -56,10 +57,10 @@ bool AsyncFileSystem::isValidType(Type type)
     return type == Temporary || type == Persistent;
 }
 
-PassOwnPtr<AsyncFileSystem> AsyncFileSystem::create(Type, const String&)
+PassOwnPtr<AsyncFileSystem> AsyncFileSystem::create(Type)
 {
     notImplemented();
-    return 0;
+    return nullptr;
 }
 
 void AsyncFileSystem::openFileSystem(const String& basePath, const String& storageIdentifier, Type type, bool, PassOwnPtr<AsyncFileSystemCallbacks> callbacks)
diff --git a/Source/WebCore/platform/CalculationValue.h b/Source/WebCore/platform/CalculationValue.h
index 44a52d5ed..d89445e80 100755
--- a/Source/WebCore/platform/CalculationValue.h
+++ b/Source/WebCore/platform/CalculationValue.h
@@ -43,8 +43,12 @@ enum CalcOperator {
     CalcAdd = '+',
     CalcSubtract = '-',
     CalcMultiply = '*',
-    CalcDivide = '/',
-    CalcMod = '%'
+    CalcDivide = '/'
+};
+
+enum CalculationPermittedValueRange {
+    CalculationRangeAll,
+    CalculationRangeNonNegative
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/platform/ContextMenu.h b/Source/WebCore/platform/ContextMenu.h
index 2c50a920b..00ceb2009 100644
--- a/Source/WebCore/platform/ContextMenu.h
+++ b/Source/WebCore/platform/ContextMenu.h
@@ -33,8 +33,6 @@
 #include "PlatformString.h"
 #if PLATFORM(MAC)
 #include <wtf/RetainPtr.h>
-#elif PLATFORM(QT)
-#include <QMenu>
 #elif PLATFORM(WIN)
 #include <windows.h>
 #endif
diff --git a/Source/WebCore/platform/ContextMenuItem.h b/Source/WebCore/platform/ContextMenuItem.h
index 2520c64e6..15bff4839 100644
--- a/Source/WebCore/platform/ContextMenuItem.h
+++ b/Source/WebCore/platform/ContextMenuItem.h
@@ -39,8 +39,6 @@ typedef struct tagMENUITEMINFOW MENUITEMINFO;
 #elif PLATFORM(GTK)
 typedef struct _GtkMenuItem GtkMenuItem;
 typedef struct _GtkAction GtkAction;
-#elif PLATFORM(QT)
-#include <QAction>
 #elif PLATFORM(WX)
 class wxMenuItem;
 #endif
diff --git a/Source/WebCore/platform/CrossThreadCopier.h b/Source/WebCore/platform/CrossThreadCopier.h
index 39d11b501..3b6076142 100644
--- a/Source/WebCore/platform/CrossThreadCopier.h
+++ b/Source/WebCore/platform/CrossThreadCopier.h
@@ -42,6 +42,7 @@
 namespace WebCore {
 
     class IntRect;
+    class IntSize;
     class KURL;
     class ResourceError;
     class ResourceRequest;
@@ -72,6 +73,9 @@ namespace WebCore {
     template<> struct CrossThreadCopierBase<false, false, IntRect> : public CrossThreadCopierPassThrough<IntRect> {
     };
 
+    template<> struct CrossThreadCopierBase<false, false, IntSize> : public CrossThreadCopierPassThrough<IntSize> {
+    };
+
     // Custom copy methods.
     template<typename T> struct CrossThreadCopierBase<false, true, T> {
         typedef typename WTF::RemoveTemplate<T, RefPtr>::Type TypeWithoutRefPtr;
diff --git a/Source/WebCore/platform/DefaultLocalizationStrategy.cpp b/Source/WebCore/platform/DefaultLocalizationStrategy.cpp
deleted file mode 100644
index 2a5f0f964..000000000
--- a/Source/WebCore/platform/DefaultLocalizationStrategy.cpp
+++ /dev/null
@@ -1,961 +0,0 @@
-/*
- * Copyright (C) 2010, 2011 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
- * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
- * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
- * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
- * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
- * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
- * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
- * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
- * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
- * THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "config.h"
-#include "DefaultLocalizationStrategy.h"
-
-#if USE(PLATFORM_STRATEGIES)
-
-#include "IntSize.h"
-#include "LocalizedStrings.h"
-#include "NotImplemented.h"
-#include "PlatformString.h"
-#include <wtf/MathExtras.h>
-#include <wtf/text/CString.h>
-#include <wtf/unicode/CharacterNames.h>
-#include <wtf/UnusedParam.h>
-
-#if USE(CF)
-#include <wtf/RetainPtr.h>
-#endif
-
-#if PLATFORM(MAC)
-#include "WebCoreSystemInterface.h"
-#endif
-
-namespace WebCore {
-
-// We can't use String::format for two reasons:
-//  1) It doesn't handle non-ASCII characters in the format string.
-//  2) It doesn't handle the %2$d syntax.
-// Note that because |format| is used as the second parameter to va_start, it cannot be a reference
-// type according to section 18.7/3 of the C++ N1905 standard.
-static String formatLocalizedString(String format, ...)
-{
-#if USE(CF)
-    va_list arguments;
-    va_start(arguments, format);
-    RetainPtr<CFStringRef> formatCFString(AdoptCF, format.createCFString());
-    RetainPtr<CFStringRef> result(AdoptCF, CFStringCreateWithFormatAndArguments(0, 0, formatCFString.get(), arguments));
-    va_end(arguments);
-    return result.get();
-#elif PLATFORM(QT)
-    va_list arguments;
-    va_start(arguments, format);
-    QString result;
-    result.vsprintf(format.latin1().data(), arguments);
-    va_end(arguments);
-    return result;
-#else
-    notImplemented();
-    return format;
-#endif
-}
-
-#if !defined(BUILDING_ON_LEOPARD) && !defined(BUILDING_ON_SNOW_LEOPARD)
-static String truncatedStringForLookupMenuItem(const String& original)
-{
-    if (original.isEmpty())
-        return original;
-    
-    // Truncate the string if it's too long. This is in consistency with AppKit.
-    unsigned maxNumberOfGraphemeClustersInLookupMenuItem = 24;
-    DEFINE_STATIC_LOCAL(String, ellipsis, (&horizontalEllipsis, 1));
-    
-    String trimmed = original.stripWhiteSpace();
-    unsigned numberOfCharacters = numCharactersInGraphemeClusters(trimmed, maxNumberOfGraphemeClustersInLookupMenuItem);
-    return numberOfCharacters == trimmed.length() ? trimmed : trimmed.left(numberOfCharacters) + ellipsis;
-}
-#endif
-
-DefaultLocalizationStrategy& DefaultLocalizationStrategy::shared()
-{
-    DEFINE_STATIC_LOCAL(DefaultLocalizationStrategy, defaultLocalizationStrategy, ());
-    return defaultLocalizationStrategy;
-}
-
-DefaultLocalizationStrategy::DefaultLocalizationStrategy()
-{
-}
-
-String DefaultLocalizationStrategy::inputElementAltText()
-{
-    return WEB_UI_STRING_KEY("Submit", "Submit (input element)", "alt text for <input> elements with no alt, title, or value");
-}
-
-String DefaultLocalizationStrategy::resetButtonDefaultLabel()
-{
-    return WEB_UI_STRING("Reset", "default label for Reset buttons in forms on web pages");
-}
-
-String DefaultLocalizationStrategy::searchableIndexIntroduction()
-{
-    return WEB_UI_STRING("This is a searchable index. Enter search keywords: ",
-        "text that appears at the start of nearly-obsolete web pages in the form of a 'searchable index'");
-}
-
-String DefaultLocalizationStrategy::submitButtonDefaultLabel()
-{
-    return WEB_UI_STRING("Submit", "default label for Submit buttons in forms on web pages");
-}
-
-String DefaultLocalizationStrategy::fileButtonChooseFileLabel()
-{
-    return WEB_UI_STRING("Choose File", "title for a single file chooser button used in HTML forms");
-}
-
-String DefaultLocalizationStrategy::fileButtonChooseMultipleFilesLabel()
-{
-    return WEB_UI_STRING("Choose Files", "title for a multiple file chooser button used in HTML forms. This title should be as short as possible.");
-}
-
-String DefaultLocalizationStrategy::fileButtonNoFileSelectedLabel()
-{
-    return WEB_UI_STRING("no file selected", "text to display in file button used in HTML forms when no file is selected");
-}
-
-String DefaultLocalizationStrategy::fileButtonNoFilesSelectedLabel()
-{
-    return WEB_UI_STRING("no files selected", "text to display in file button used in HTML forms when no files are selected and the button allows multiple files to be selected");
-}
-
-String DefaultLocalizationStrategy::defaultDetailsSummaryText()
-{
-    return WEB_UI_STRING("Details", "text to display in <details> tag when it has no <summary> child");
-}
-
-#if PLATFORM(MAC)
-String DefaultLocalizationStrategy::copyImageUnknownFileLabel()
-{
-    return WEB_UI_STRING("unknown", "Unknown filename");
-}
-#endif
-
-#if ENABLE(CONTEXT_MENUS)
-
-String DefaultLocalizationStrategy::contextMenuItemTagOpenLinkInNewWindow()
-{
-    return WEB_UI_STRING("Open Link in New Window", "Open in New Window context menu item");
-}
-
-String DefaultLocalizationStrategy::contextMenuItemTagDownloadLinkToDisk()
-{
-    return WEB_UI_STRING("Download Linked File", "Download Linked File context menu item");
-}
-
-String DefaultLocalizationStrategy::contextMenuItemTagCopyLinkToClipboard()
-{
-    return WEB_UI_STRING("Copy Link", "Copy Link context menu item");
-}
-
-String DefaultLocalizationStrategy::contextMenuItemTagOpenImageInNewWindow()
-{
-    return WEB_UI_STRING("Open Image in New Window", "Open Image in New Window context menu item");
-}
-
-String DefaultLocalizationStrategy::contextMenuItemTagDownloadImageToDisk()
-{
-    return WEB_UI_STRING("Download Image", "Download Image context menu item");
-}
-
-String DefaultLocalizationStrategy::contextMenuItemTagCopyImageToClipboard()
-{
-    return WEB_UI_STRING("Copy Image", "Copy Image context menu item");
-}
-
-#if PLATFORM(QT)
-String DefaultLocalizationStrategy::contextMenuItemTagCopyImageUrlToClipboard()
-{
-    return WEB_UI_STRING("Copy Image Address", "Copy Image Address menu item");
-}
-#endif
-
-String DefaultLocalizationStrategy::contextMenuItemTagOpenVideoInNewWindow()
-{
-    return WEB_UI_STRING("Open Video in New Window", "Open Video in New Window context menu item");
-}
-
-String DefaultLocalizationStrategy::contextMenuItemTagOpenAudioInNewWindow()
-{
-    return WEB_UI_STRING("Open Audio in New Window", "Open Audio in New Window context menu item");
-}
-
-String DefaultLocalizationStrategy::contextMenuItemTagCopyVideoLinkToClipboard()
-{
-    return WEB_UI_STRING("Copy Video Address", "Copy Video Address Location context menu item");
-}
-
-String DefaultLocalizationStrategy::contextMenuItemTagCopyAudioLinkToClipboard()
-{
-    return WEB_UI_STRING("Copy Audio Address", "Copy Audio Address Location context menu item");
-}
-
-String DefaultLocalizationStrategy::contextMenuItemTagToggleMediaControls()
-{
-    return WEB_UI_STRING("Controls", "Media Controls context menu item");
-}
-
-String DefaultLocalizationStrategy::contextMenuItemTagToggleMediaLoop()
-{
-    return WEB_UI_STRING("Loop", "Media Loop context menu item");
-}
-
-String DefaultLocalizationStrategy::contextMenuItemTagEnterVideoFullscreen()
-{
-    return WEB_UI_STRING("Enter Fullscreen", "Video Enter Fullscreen context menu item");
-}
-
-String DefaultLocalizationStrategy::contextMenuItemTagMediaPlay()
-{
-    return WEB_UI_STRING("Play", "Media Play context menu item");
-}
-
-String DefaultLocalizationStrategy::contextMenuItemTagMediaPause()
-{
-    return WEB_UI_STRING("Pause", "Media Pause context menu item");
-}
-
-String DefaultLocalizationStrategy::contextMenuItemTagMediaMute()
-{
-    return WEB_UI_STRING("Mute", "Media Mute context menu item");
-}
-
-String DefaultLocalizationStrategy::contextMenuItemTagOpenFrameInNewWindow()
-{
-    return WEB_UI_STRING("Open Frame in New Window", "Open Frame in New Window context menu item");
-}
-
-String DefaultLocalizationStrategy::contextMenuItemTagCopy()
-{
-    return WEB_UI_STRING("Copy", "Copy context menu item");
-}
-
-String DefaultLocalizationStrategy::contextMenuItemTagGoBack()
-{
-    return WEB_UI_STRING("Back", "Back context menu item");
-}
-
-String DefaultLocalizationStrategy::contextMenuItemTagGoForward()
-{
-    return WEB_UI_STRING("Forward", "Forward context menu item");
-}
-
-String DefaultLocalizationStrategy::contextMenuItemTagStop()
-{
-    return WEB_UI_STRING("Stop", "Stop context menu item");
-}
-
-String DefaultLocalizationStrategy::contextMenuItemTagReload()
-{
-    return WEB_UI_STRING("Reload", "Reload context menu item");
-}
-
-String DefaultLocalizationStrategy::contextMenuItemTagCut()
-{
-    return WEB_UI_STRING("Cut", "Cut context menu item");
-}
-
-String DefaultLocalizationStrategy::contextMenuItemTagPaste()
-{
-    return WEB_UI_STRING("Paste", "Paste context menu item");
-}
-
-#if PLATFORM(GTK)
-
-String DefaultLocalizationStrategy::contextMenuItemTagDelete()
-{
-    notImplemented();
-    return "Delete";
-}
-
-String DefaultLocalizationStrategy::contextMenuItemTagInputMethods()
-{
-    notImplemented();
-    return "Input Methods";
-}
-
-String DefaultLocalizationStrategy::contextMenuItemTagUnicode()
-{
-    notImplemented();
-    return "Unicode";
-}
-
-#endif
-
-#if PLATFORM(GTK) || PLATFORM(QT)
-
-String DefaultLocalizationStrategy::contextMenuItemTagSelectAll()
-{
-    notImplemented();
-    return "Select All";
-}
-
-#endif
-
-String DefaultLocalizationStrategy::contextMenuItemTagNoGuessesFound()
-{
-    return WEB_UI_STRING("No Guesses Found", "No Guesses Found context menu item");
-}
-
-String DefaultLocalizationStrategy::contextMenuItemTagIgnoreSpelling()
-{
-    return WEB_UI_STRING("Ignore Spelling", "Ignore Spelling context menu item");
-}
-
-String DefaultLocalizationStrategy::contextMenuItemTagLearnSpelling()
-{
-    return WEB_UI_STRING("Learn Spelling", "Learn Spelling context menu item");
-}
-
-String DefaultLocalizationStrategy::contextMenuItemTagSearchWeb()
-{
-#if PLATFORM(MAC) && !defined(BUILDING_ON_LEOPARD) && !defined(BUILDING_ON_SNOW_LEOPARD)
-    RetainPtr<CFStringRef> searchProviderName(AdoptCF, wkCopyDefaultSearchProviderDisplayName());
-    return formatLocalizedString(WEB_UI_STRING("Search with %@", "Search with search provider context menu item with provider name inserted"), searchProviderName.get());
-#else
-    return WEB_UI_STRING("Search with Google", "Search with Google context menu item");
-#endif
-}
-
-String DefaultLocalizationStrategy::contextMenuItemTagLookUpInDictionary(const String& selectedString)
-{
-#if defined(BUILDING_ON_LEOPARD) || defined(BUILDING_ON_SNOW_LEOPARD)
-    UNUSED_PARAM(selectedString);
-    return WEB_UI_STRING("Look Up in Dictionary", "Look Up in Dictionary context menu item");
-#else
-#if USE(CF)
-    RetainPtr<CFStringRef> selectedCFString(AdoptCF, truncatedStringForLookupMenuItem(selectedString).createCFString());
-    return formatLocalizedString(WEB_UI_STRING("Look Up “%@”", "Look Up context menu item with selected word"), selectedCFString.get());
-#else
-    return WEB_UI_STRING("Look Up “<selection>”", "Look Up context menu item with selected word").replace("<selection>", truncatedStringForLookupMenuItem(selectedString));
-#endif
-#endif
-}
-
-String DefaultLocalizationStrategy::contextMenuItemTagOpenLink()
-{
-    return WEB_UI_STRING("Open Link", "Open Link context menu item");
-}
-
-String DefaultLocalizationStrategy::contextMenuItemTagIgnoreGrammar()
-{
-    return WEB_UI_STRING("Ignore Grammar", "Ignore Grammar context menu item");
-}
-
-String DefaultLocalizationStrategy::contextMenuItemTagSpellingMenu()
-{
-    return WEB_UI_STRING("Spelling and Grammar", "Spelling and Grammar context sub-menu item");
-}
-
-String DefaultLocalizationStrategy::contextMenuItemTagShowSpellingPanel(bool show)
-{
-    if (show)
-        return WEB_UI_STRING("Show Spelling and Grammar", "menu item title");
-    return WEB_UI_STRING("Hide Spelling and Grammar", "menu item title");
-}
-
-String DefaultLocalizationStrategy::contextMenuItemTagCheckSpelling()
-{
-    return WEB_UI_STRING("Check Document Now", "Check spelling context menu item");
-}
-
-String DefaultLocalizationStrategy::contextMenuItemTagCheckSpellingWhileTyping()
-{
-    return WEB_UI_STRING("Check Spelling While Typing", "Check spelling while typing context menu item");
-}
-
-String DefaultLocalizationStrategy::contextMenuItemTagCheckGrammarWithSpelling()
-{
-    return WEB_UI_STRING("Check Grammar With Spelling", "Check grammar with spelling context menu item");
-}
-
-String DefaultLocalizationStrategy::contextMenuItemTagFontMenu()
-{
-    return WEB_UI_STRING("Font", "Font context sub-menu item");
-}
-
-String DefaultLocalizationStrategy::contextMenuItemTagBold()
-{
-    return WEB_UI_STRING("Bold", "Bold context menu item");
-}
-
-String DefaultLocalizationStrategy::contextMenuItemTagItalic()
-{
-    return WEB_UI_STRING("Italic", "Italic context menu item");
-}
-
-String DefaultLocalizationStrategy::contextMenuItemTagUnderline()
-{
-    return WEB_UI_STRING("Underline", "Underline context menu item");
-}
-
-String DefaultLocalizationStrategy::contextMenuItemTagOutline()
-{
-    return WEB_UI_STRING("Outline", "Outline context menu item");
-}
-
-String DefaultLocalizationStrategy::contextMenuItemTagWritingDirectionMenu()
-{
-    return WEB_UI_STRING("Paragraph Direction", "Paragraph direction context sub-menu item");
-}
-
-String DefaultLocalizationStrategy::contextMenuItemTagTextDirectionMenu()
-{
-    return WEB_UI_STRING("Selection Direction", "Selection direction context sub-menu item");
-}
-
-String DefaultLocalizationStrategy::contextMenuItemTagDefaultDirection()
-{
-    return WEB_UI_STRING("Default", "Default writing direction context menu item");
-}
-
-String DefaultLocalizationStrategy::contextMenuItemTagLeftToRight()
-{
-    return WEB_UI_STRING("Left to Right", "Left to Right context menu item");
-}
-
-String DefaultLocalizationStrategy::contextMenuItemTagRightToLeft()
-{
-    return WEB_UI_STRING("Right to Left", "Right to Left context menu item");
-}
-
-#if PLATFORM(MAC)
-
-String DefaultLocalizationStrategy::contextMenuItemTagSearchInSpotlight()
-{
-    return WEB_UI_STRING("Search in Spotlight", "Search in Spotlight context menu item");
-}
-
-String DefaultLocalizationStrategy::contextMenuItemTagShowFonts()
-{
-    return WEB_UI_STRING("Show Fonts", "Show fonts context menu item");
-}
-
-String DefaultLocalizationStrategy::contextMenuItemTagStyles()
-{
-    return WEB_UI_STRING("Styles...", "Styles context menu item");
-}
-
-String DefaultLocalizationStrategy::contextMenuItemTagShowColors()
-{
-    return WEB_UI_STRING("Show Colors", "Show colors context menu item");
-}
-
-String DefaultLocalizationStrategy::contextMenuItemTagSpeechMenu()
-{
-    return WEB_UI_STRING("Speech", "Speech context sub-menu item");
-}
-
-String DefaultLocalizationStrategy::contextMenuItemTagStartSpeaking()
-{
-    return WEB_UI_STRING("Start Speaking", "Start speaking context menu item");
-}
-
-String DefaultLocalizationStrategy::contextMenuItemTagStopSpeaking()
-{
-    return WEB_UI_STRING("Stop Speaking", "Stop speaking context menu item");
-}
-
-String DefaultLocalizationStrategy::contextMenuItemTagCorrectSpellingAutomatically()
-{
-    return WEB_UI_STRING("Correct Spelling Automatically", "Correct Spelling Automatically context menu item");
-}
-
-String DefaultLocalizationStrategy::contextMenuItemTagSubstitutionsMenu()
-{
-    return WEB_UI_STRING("Substitutions", "Substitutions context sub-menu item");
-}
-
-String DefaultLocalizationStrategy::contextMenuItemTagShowSubstitutions(bool show)
-{
-    if (show) 
-        return WEB_UI_STRING("Show Substitutions", "menu item title");
-    return WEB_UI_STRING("Hide Substitutions", "menu item title");
-}
-
-String DefaultLocalizationStrategy::contextMenuItemTagSmartCopyPaste()
-{
-    return WEB_UI_STRING("Smart Copy/Paste", "Smart Copy/Paste context menu item");
-}
-
-String DefaultLocalizationStrategy::contextMenuItemTagSmartQuotes()
-{
-    return WEB_UI_STRING("Smart Quotes", "Smart Quotes context menu item");
-}
-
-String DefaultLocalizationStrategy::contextMenuItemTagSmartDashes()
-{
-    return WEB_UI_STRING("Smart Dashes", "Smart Dashes context menu item");
-}
-
-String DefaultLocalizationStrategy::contextMenuItemTagSmartLinks()
-{
-    return WEB_UI_STRING("Smart Links", "Smart Links context menu item");
-}
-
-String DefaultLocalizationStrategy::contextMenuItemTagTextReplacement()
-{
-    return WEB_UI_STRING("Text Replacement", "Text Replacement context menu item");
-}
-
-String DefaultLocalizationStrategy::contextMenuItemTagTransformationsMenu()
-{
-    return WEB_UI_STRING("Transformations", "Transformations context sub-menu item");
-}
-
-String DefaultLocalizationStrategy::contextMenuItemTagMakeUpperCase()
-{
-    return WEB_UI_STRING("Make Upper Case", "Make Upper Case context menu item");
-}
-
-String DefaultLocalizationStrategy::contextMenuItemTagMakeLowerCase()
-{
-    return WEB_UI_STRING("Make Lower Case", "Make Lower Case context menu item");
-}
-
-String DefaultLocalizationStrategy::contextMenuItemTagCapitalize()
-{
-    return WEB_UI_STRING("Capitalize", "Capitalize context menu item");
-}
-
-String DefaultLocalizationStrategy::contextMenuItemTagChangeBack(const String& replacedString)
-{
-    notImplemented();
-    return replacedString;
-}
-
-#endif
-
-String DefaultLocalizationStrategy::contextMenuItemTagInspectElement()
-{
-    return WEB_UI_STRING("Inspect Element", "Inspect Element context menu item");
-}
-
-#endif // ENABLE(CONTEXT_MENUS)
-
-String DefaultLocalizationStrategy::searchMenuNoRecentSearchesText()
-{
-    return WEB_UI_STRING("No recent searches", "Label for only item in menu that appears when clicking on the search field image, when no searches have been performed");
-}
-
-String DefaultLocalizationStrategy::searchMenuRecentSearchesText()
-{
-    return WEB_UI_STRING("Recent Searches", "label for first item in the menu that appears when clicking on the search field image, used as embedded menu title");
-}
-
-String DefaultLocalizationStrategy::searchMenuClearRecentSearchesText()
-{
-    return WEB_UI_STRING("Clear Recent Searches", "menu item in Recent Searches menu that empties menu's contents");
-}
-
-String DefaultLocalizationStrategy::AXWebAreaText()
-{
-    return WEB_UI_STRING("HTML content", "accessibility role description for web area");
-}
-
-String DefaultLocalizationStrategy::AXLinkText()
-{
-    return WEB_UI_STRING("link", "accessibility role description for link");
-}
-
-String DefaultLocalizationStrategy::AXListMarkerText()
-{
-    return WEB_UI_STRING("list marker", "accessibility role description for list marker");
-}
-
-String DefaultLocalizationStrategy::AXImageMapText()
-{
-    return WEB_UI_STRING("image map", "accessibility role description for image map");
-}
-
-String DefaultLocalizationStrategy::AXHeadingText()
-{
-    return WEB_UI_STRING("heading", "accessibility role description for headings");
-}
-
-String DefaultLocalizationStrategy::AXDefinitionListTermText()
-{
-    return WEB_UI_STRING("term", "term word of a definition");
-}
-
-String DefaultLocalizationStrategy::AXDefinitionListDefinitionText()
-{
-    return WEB_UI_STRING("definition", "definition phrase");
-}
-
-#if PLATFORM(MAC)
-String DefaultLocalizationStrategy::AXARIAContentGroupText(const String& ariaType)
-{
-    if (ariaType == "ARIAApplicationAlert")
-        return WEB_UI_STRING("alert", "An ARIA accessibility group that acts as an alert.");
-    if (ariaType == "ARIAApplicationAlertDialog")
-        return WEB_UI_STRING("alert dialog", "An ARIA accessibility group that acts as an alert dialog.");
-    if (ariaType == "ARIAApplicationDialog")
-        return WEB_UI_STRING("dialog", "An ARIA accessibility group that acts as an dialog.");
-    if (ariaType == "ARIAApplicationLog")
-        return WEB_UI_STRING("log", "An ARIA accessibility group that acts as a console log.");
-    if (ariaType == "ARIAApplicationMarquee")
-        return WEB_UI_STRING("marquee", "An ARIA accessibility group that acts as a marquee.");    
-    if (ariaType == "ARIAApplicationStatus")
-        return WEB_UI_STRING("application status", "An ARIA accessibility group that acts as a status update.");    
-    if (ariaType == "ARIAApplicationTimer")
-        return WEB_UI_STRING("timer", "An ARIA accessibility group that acts as an updating timer.");    
-    if (ariaType == "ARIADocument")
-        return WEB_UI_STRING("document", "An ARIA accessibility group that acts as a document.");    
-    if (ariaType == "ARIADocumentArticle")
-        return WEB_UI_STRING("article", "An ARIA accessibility group that acts as an article.");    
-    if (ariaType == "ARIADocumentNote")
-        return WEB_UI_STRING("note", "An ARIA accessibility group that acts as a note in a document.");    
-    if (ariaType == "ARIADocumentRegion")
-        return WEB_UI_STRING("region", "An ARIA accessibility group that acts as a distinct region in a document.");    
-    if (ariaType == "ARIALandmarkApplication")
-        return WEB_UI_STRING("application", "An ARIA accessibility group that acts as an application.");    
-    if (ariaType == "ARIALandmarkBanner")
-        return WEB_UI_STRING("banner", "An ARIA accessibility group that acts as a banner.");    
-    if (ariaType == "ARIALandmarkComplementary")
-        return WEB_UI_STRING("complementary", "An ARIA accessibility group that acts as a region of complementary information.");    
-    if (ariaType == "ARIALandmarkContentInfo")
-        return WEB_UI_STRING("content", "An ARIA accessibility group that contains content.");    
-    if (ariaType == "ARIALandmarkMain")
-        return WEB_UI_STRING("main", "An ARIA accessibility group that is the main portion of the website.");    
-    if (ariaType == "ARIALandmarkNavigation")
-        return WEB_UI_STRING("navigation", "An ARIA accessibility group that contains the main navigation elements of a website.");    
-    if (ariaType == "ARIALandmarkSearch")
-        return WEB_UI_STRING("search", "An ARIA accessibility group that contains a search feature of a website.");    
-    if (ariaType == "ARIAUserInterfaceTooltip")
-        return WEB_UI_STRING("tooltip", "An ARIA accessibility group that acts as a tooltip.");    
-    if (ariaType == "ARIATabPanel")
-        return WEB_UI_STRING("tab panel", "An ARIA accessibility group that contains the content of a tab.");
-    if (ariaType == "ARIADocumentMath")
-        return WEB_UI_STRING("math", "An ARIA accessibility group that contains mathematical symbols.");
-    return String();
-}
-#endif
-
-String DefaultLocalizationStrategy::AXButtonActionVerb()
-{
-    return WEB_UI_STRING("press", "Verb stating the action that will occur when a button is pressed, as used by accessibility");
-}
-
-String DefaultLocalizationStrategy::AXRadioButtonActionVerb() 
-{
-    return WEB_UI_STRING("select", "Verb stating the action that will occur when a radio button is clicked, as used by accessibility");
-}
-
-String DefaultLocalizationStrategy::AXTextFieldActionVerb()
-{
-    return WEB_UI_STRING("activate", "Verb stating the action that will occur when a text field is selected, as used by accessibility");
-}
-
-String DefaultLocalizationStrategy::AXCheckedCheckBoxActionVerb()
-{
-    return WEB_UI_STRING("uncheck", "Verb stating the action that will occur when a checked checkbox is clicked, as used by accessibility");
-}
-
-String DefaultLocalizationStrategy::AXUncheckedCheckBoxActionVerb()
-{
-    return WEB_UI_STRING("check", "Verb stating the action that will occur when an unchecked checkbox is clicked, as used by accessibility");
-}
-
-String DefaultLocalizationStrategy::AXMenuListActionVerb()
-{
-    notImplemented();
-    return "select";
-}
-
-String DefaultLocalizationStrategy::AXMenuListPopupActionVerb()
-{
-    notImplemented();
-    return "select";
-}
-
-String DefaultLocalizationStrategy::AXLinkActionVerb()
-{
-    return WEB_UI_STRING("jump", "Verb stating the action that will occur when a link is clicked, as used by accessibility");
-}
-
-String DefaultLocalizationStrategy::missingPluginText()
-{
-    return WEB_UI_STRING("Missing Plug-in", "Label text to be used when a plugin is missing");
-}
-
-String DefaultLocalizationStrategy::crashedPluginText()
-{
-    return WEB_UI_STRING("Plug-in Failure", "Label text to be used if plugin host process has crashed");
-}
-
-String DefaultLocalizationStrategy::multipleFileUploadText(unsigned numberOfFiles)
-{
-    return formatLocalizedString(WEB_UI_STRING("%d files", "Label to describe the number of files selected in a file upload control that allows multiple files"), numberOfFiles);
-}
-
-String DefaultLocalizationStrategy::unknownFileSizeText()
-{
-    return WEB_UI_STRING("Unknown", "Unknown filesize FTP directory listing item");
-}
-
-#if PLATFORM(WIN)
-
-String DefaultLocalizationStrategy::uploadFileText()
-{
-    notImplemented();
-    return "upload";
-}
-
-String DefaultLocalizationStrategy::allFilesText()
-{
-    notImplemented();
-    return "all files";
-}
-
-#endif
-
-#if PLATFORM(MAC)
-
-String DefaultLocalizationStrategy::builtInPDFPluginName()
-{
-    // Also exposed to DOM.
-    return WEB_UI_STRING("WebKit built-in PDF", "Pseudo plug-in name, visible in Installed Plug-ins page in Safari.");
-}
-
-String DefaultLocalizationStrategy::pdfDocumentTypeDescription()
-{
-    // Also exposed to DOM.
-    return WEB_UI_STRING("Portable Document Format", "Description of the (only) type supported by PDF pseudo plug-in. Visible in Installed Plug-ins page in Safari.");
-}
-
-String DefaultLocalizationStrategy::keygenMenuItem512()
-{
-    return WEB_UI_STRING("512 (Low Grade)", "Menu item title for KEYGEN pop-up menu");
-}
-
-String DefaultLocalizationStrategy::keygenMenuItem1024()
-{
-    return WEB_UI_STRING("1024 (Medium Grade)", "Menu item title for KEYGEN pop-up menu");
-}
-
-String DefaultLocalizationStrategy::keygenMenuItem2048()
-{
-    return WEB_UI_STRING("2048 (High Grade)", "Menu item title for KEYGEN pop-up menu");
-}
-
-String DefaultLocalizationStrategy::keygenKeychainItemName(const String& host)
-{
-    RetainPtr<CFStringRef> hostCFString(AdoptCF, host.createCFString());
-    return formatLocalizedString(WEB_UI_STRING("Key from %@", "Name of keychain key generated by the KEYGEN tag"), hostCFString.get());
-}
-
-#if PLATFORM(IOS)
-String DefaultLocalizationStrategy::htmlSelectMultipleItems(int count)
-{
-    return formatLocalizedString(WEB_UI_STRING("%d Items", "Present the number of selected <option> items in a <select multiple> element (iOS only)"), count);
-}
-#endif // PLATFORM(IOS)
-#endif // PLATFORM(MAC)
-
-String DefaultLocalizationStrategy::imageTitle(const String& filename, const IntSize& size)
-{
-#if USE(CF)
-#if !defined(BUILDING_ON_LEOPARD)
-    RetainPtr<CFStringRef> filenameCFString(AdoptCF, filename.createCFString());
-    RetainPtr<CFLocaleRef> locale(AdoptCF, CFLocaleCopyCurrent());
-    RetainPtr<CFNumberFormatterRef> formatter(AdoptCF, CFNumberFormatterCreate(0, locale.get(), kCFNumberFormatterDecimalStyle));
-
-    int widthInt = size.width();
-    RetainPtr<CFNumberRef> width(AdoptCF, CFNumberCreate(0, kCFNumberIntType, &widthInt));
-    RetainPtr<CFStringRef> widthString(AdoptCF, CFNumberFormatterCreateStringWithNumber(0, formatter.get(), width.get()));
-
-    int heightInt = size.height();
-    RetainPtr<CFNumberRef> height(AdoptCF, CFNumberCreate(0, kCFNumberIntType, &heightInt));
-    RetainPtr<CFStringRef> heightString(AdoptCF, CFNumberFormatterCreateStringWithNumber(0, formatter.get(), height.get()));
-
-    return formatLocalizedString(WEB_UI_STRING("%@ %@×%@ pixels", "window title for a standalone image (uses multiplication symbol, not x)"), filenameCFString.get(), widthString.get(), heightString.get());
-#else
-    RetainPtr<CFStringRef> filenameCFString(AdoptCF, filename.createCFString());
-    return formatLocalizedString(WEB_UI_STRING("%@ %d×%d pixels", "window title for a standalone image (uses multiplication symbol, not x)"), filenameCFString.get(), size.width(), size.height());
-#endif
-#else
-    return formatLocalizedString(WEB_UI_STRING("<filename> %d×%d pixels", "window title for a standalone image (uses multiplication symbol, not x)"), size.width(), size.height()).replace("<filename>", filename);
-#endif
-}
-
-String DefaultLocalizationStrategy::mediaElementLoadingStateText()
-{
-    return WEB_UI_STRING("Loading...", "Media controller status message when the media is loading");
-}
-
-String DefaultLocalizationStrategy::mediaElementLiveBroadcastStateText()
-{
-    return WEB_UI_STRING("Live Broadcast", "Media controller status message when watching a live broadcast");
-}
-
-String DefaultLocalizationStrategy::localizedMediaControlElementString(const String& name)
-{
-    if (name == "AudioElement")
-        return WEB_UI_STRING("audio element controller", "accessibility role description for audio element controller");
-    if (name == "VideoElement")
-        return WEB_UI_STRING("video element controller", "accessibility role description for video element controller");
-    if (name == "MuteButton")
-        return WEB_UI_STRING("mute", "accessibility role description for mute button");
-    if (name == "UnMuteButton")
-        return WEB_UI_STRING("unmute", "accessibility role description for turn mute off button");
-    if (name == "PlayButton")
-        return WEB_UI_STRING("play", "accessibility role description for play button");
-    if (name == "PauseButton")
-        return WEB_UI_STRING("pause", "accessibility role description for pause button");
-    if (name == "Slider")
-        return WEB_UI_STRING("movie time", "accessibility role description for timeline slider");
-    if (name == "SliderThumb")
-        return WEB_UI_STRING("timeline slider thumb", "accessibility role description for timeline thumb");
-    if (name == "RewindButton")
-        return WEB_UI_STRING("back 30 seconds", "accessibility role description for seek back 30 seconds button");
-    if (name == "ReturnToRealtimeButton")
-        return WEB_UI_STRING("return to realtime", "accessibility role description for return to real time button");
-    if (name == "CurrentTimeDisplay")
-        return WEB_UI_STRING("elapsed time", "accessibility role description for elapsed time display");
-    if (name == "TimeRemainingDisplay")
-        return WEB_UI_STRING("remaining time", "accessibility role description for time remaining display");
-    if (name == "StatusDisplay")
-        return WEB_UI_STRING("status", "accessibility role description for movie status");
-    if (name == "FullscreenButton")
-        return WEB_UI_STRING("fullscreen", "accessibility role description for enter fullscreen button");
-    if (name == "SeekForwardButton")
-        return WEB_UI_STRING("fast forward", "accessibility role description for fast forward button");
-    if (name == "SeekBackButton")
-        return WEB_UI_STRING("fast reverse", "accessibility role description for fast reverse button");
-    if (name == "ShowClosedCaptionsButton")
-        return WEB_UI_STRING("show closed captions", "accessibility role description for show closed captions button");
-    if (name == "HideClosedCaptionsButton")
-        return WEB_UI_STRING("hide closed captions", "accessibility role description for hide closed captions button");
-
-    // FIXME: the ControlsPanel container should never be visible in the accessibility hierarchy.
-    if (name == "ControlsPanel")
-        return String();
-
-    ASSERT_NOT_REACHED();
-    return String();
-}
-
-String DefaultLocalizationStrategy::localizedMediaControlElementHelpText(const String& name)
-{
-    if (name == "AudioElement")
-        return WEB_UI_STRING("audio element playback controls and status display", "accessibility role description for audio element controller");
-    if (name == "VideoElement")
-        return WEB_UI_STRING("video element playback controls and status display", "accessibility role description for video element controller");
-    if (name == "MuteButton")
-        return WEB_UI_STRING("mute audio tracks", "accessibility help text for mute button");
-    if (name == "UnMuteButton")
-        return WEB_UI_STRING("unmute audio tracks", "accessibility help text for un mute button");
-    if (name == "PlayButton")
-        return WEB_UI_STRING("begin playback", "accessibility help text for play button");
-    if (name == "PauseButton")
-        return WEB_UI_STRING("pause playback", "accessibility help text for pause button");
-    if (name == "Slider")
-        return WEB_UI_STRING("movie time scrubber", "accessibility help text for timeline slider");
-    if (name == "SliderThumb")
-        return WEB_UI_STRING("movie time scrubber thumb", "accessibility help text for timeline slider thumb");
-    if (name == "RewindButton")
-        return WEB_UI_STRING("seek movie back 30 seconds", "accessibility help text for jump back 30 seconds button");
-    if (name == "ReturnToRealtimeButton")
-        return WEB_UI_STRING("return streaming movie to real time", "accessibility help text for return streaming movie to real time button");
-    if (name == "CurrentTimeDisplay")
-        return WEB_UI_STRING("current movie time in seconds", "accessibility help text for elapsed time display");
-    if (name == "TimeRemainingDisplay")
-        return WEB_UI_STRING("number of seconds of movie remaining", "accessibility help text for remaining time display");
-    if (name == "StatusDisplay")
-        return WEB_UI_STRING("current movie status", "accessibility help text for movie status display");
-    if (name == "SeekBackButton")
-        return WEB_UI_STRING("seek quickly back", "accessibility help text for fast rewind button");
-    if (name == "SeekForwardButton")
-        return WEB_UI_STRING("seek quickly forward", "accessibility help text for fast forward button");
-    if (name == "FullscreenButton")
-        return WEB_UI_STRING("Play movie in fullscreen mode", "accessibility help text for enter fullscreen button");
-    if (name == "ShowClosedCaptionsButton")
-        return WEB_UI_STRING("start displaying closed captions", "accessibility help text for show closed captions button");
-    if (name == "HideClosedCaptionsButton")
-        return WEB_UI_STRING("stop displaying closed captions", "accessibility help text for hide closed captions button");
-
-    ASSERT_NOT_REACHED();
-    return String();
-}
-
-String DefaultLocalizationStrategy::localizedMediaTimeDescription(float time)
-{
-    if (!isfinite(time))
-        return WEB_UI_STRING("indefinite time", "accessibility help text for an indefinite media controller time value");
-
-    int seconds = static_cast<int>(fabsf(time)); 
-    int days = seconds / (60 * 60 * 24);
-    int hours = seconds / (60 * 60);
-    int minutes = (seconds / 60) % 60;
-    seconds %= 60;
-
-    if (days)
-        return formatLocalizedString(WEB_UI_STRING("%1$d days %2$d hours %3$d minutes %4$d seconds", "accessibility help text for media controller time value >= 1 day"), days, hours, minutes, seconds);
-    if (hours)
-        return formatLocalizedString(WEB_UI_STRING("%1$d hours %2$d minutes %3$d seconds", "accessibility help text for media controller time value >= 60 minutes"), hours, minutes, seconds);
-    if (minutes)
-        return formatLocalizedString(WEB_UI_STRING("%1$d minutes %2$d seconds", "accessibility help text for media controller time value >= 60 seconds"), minutes, seconds);
-    return formatLocalizedString(WEB_UI_STRING("%1$d seconds", "accessibility help text for media controller time value < 60 seconds"), seconds);
-}
-
-String DefaultLocalizationStrategy::validationMessageValueMissingText()
-{
-    return WEB_UI_STRING("value missing", "Validation message for required form control elements that have no value");
-}
-
-String DefaultLocalizationStrategy::validationMessageTypeMismatchText()
-{
-    return WEB_UI_STRING("type mismatch", "Validation message for input form controls with a value not matching type");
-}
-
-String DefaultLocalizationStrategy::validationMessagePatternMismatchText()
-{
-    return WEB_UI_STRING("pattern mismatch", "Validation message for input form controls requiring a constrained value according to pattern");
-}
-
-String DefaultLocalizationStrategy::validationMessageTooLongText()
-{
-    return WEB_UI_STRING("too long", "Validation message for form control elements with a value longer than maximum allowed length");
-}
-
-String DefaultLocalizationStrategy::validationMessageRangeUnderflowText()
-{
-    return WEB_UI_STRING("range underflow", "Validation message for input form controls with value lower than allowed minimum");
-}
-
-String DefaultLocalizationStrategy::validationMessageRangeOverflowText()
-{
-    return WEB_UI_STRING("range overflow", "Validation message for input form controls with value higher than allowed maximum");
-}
-
-String DefaultLocalizationStrategy::validationMessageStepMismatchText()
-{
-    return WEB_UI_STRING("step mismatch", "Validation message for input form controls with value not respecting the step attribute");
-}
-
-} // namespace WebCore
-
-#endif // USE(PLATFORM_STRATEGIES)
diff --git a/Source/WebCore/platform/DefaultLocalizationStrategy.h b/Source/WebCore/platform/DefaultLocalizationStrategy.h
deleted file mode 100644
index 4fa4d9c5c..000000000
--- a/Source/WebCore/platform/DefaultLocalizationStrategy.h
+++ /dev/null
@@ -1,195 +0,0 @@
-/*
- * Copyright (C) 2010, 2011 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
- * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
- * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
- * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
- * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
- * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
- * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
- * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
- * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
- * THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#ifndef DefaultLocalizationStrategy_h
-#define DefaultLocalizationStrategy_h
-
-#if USE(PLATFORM_STRATEGIES)
-
-#include "LocalizationStrategy.h"
-#include <wtf/text/WTFString.h>
-
-namespace WebCore {
-
-class DefaultLocalizationStrategy : public LocalizationStrategy {
-public:
-    DefaultLocalizationStrategy();
-
-    static DefaultLocalizationStrategy& shared();
-
-    virtual String inputElementAltText();
-    virtual String resetButtonDefaultLabel();
-    virtual String searchableIndexIntroduction();
-    virtual String submitButtonDefaultLabel();
-    virtual String fileButtonChooseFileLabel();
-    virtual String fileButtonChooseMultipleFilesLabel();
-    virtual String fileButtonNoFileSelectedLabel();
-    virtual String fileButtonNoFilesSelectedLabel();
-    virtual String defaultDetailsSummaryText();
-#if PLATFORM(MAC)
-    virtual String copyImageUnknownFileLabel();
-#endif
-#if ENABLE(CONTEXT_MENUS)
-    virtual String contextMenuItemTagOpenLinkInNewWindow();
-    virtual String contextMenuItemTagDownloadLinkToDisk();
-    virtual String contextMenuItemTagCopyLinkToClipboard();
-    virtual String contextMenuItemTagOpenImageInNewWindow();
-    virtual String contextMenuItemTagDownloadImageToDisk();
-    virtual String contextMenuItemTagCopyImageToClipboard();
-#if PLATFORM(QT)
-    virtual String contextMenuItemTagCopyImageUrlToClipboard();
-#endif
-    virtual String contextMenuItemTagOpenFrameInNewWindow();
-    virtual String contextMenuItemTagCopy();
-    virtual String contextMenuItemTagGoBack();
-    virtual String contextMenuItemTagGoForward();
-    virtual String contextMenuItemTagStop();
-    virtual String contextMenuItemTagReload();
-    virtual String contextMenuItemTagCut();
-    virtual String contextMenuItemTagPaste();
-#if PLATFORM(GTK)
-    virtual String contextMenuItemTagDelete();
-    virtual String contextMenuItemTagInputMethods();
-    virtual String contextMenuItemTagUnicode();
-#endif
-#if PLATFORM(GTK) || PLATFORM(QT)
-    virtual String contextMenuItemTagSelectAll();
-#endif
-    virtual String contextMenuItemTagNoGuessesFound();
-    virtual String contextMenuItemTagIgnoreSpelling();
-    virtual String contextMenuItemTagLearnSpelling();
-    virtual String contextMenuItemTagSearchWeb();
-    virtual String contextMenuItemTagLookUpInDictionary(const String& selectedString);
-    virtual String contextMenuItemTagOpenLink();
-    virtual String contextMenuItemTagIgnoreGrammar();
-    virtual String contextMenuItemTagSpellingMenu();
-    virtual String contextMenuItemTagShowSpellingPanel(bool show);
-    virtual String contextMenuItemTagCheckSpelling();
-    virtual String contextMenuItemTagCheckSpellingWhileTyping();
-    virtual String contextMenuItemTagCheckGrammarWithSpelling();
-    virtual String contextMenuItemTagFontMenu();
-    virtual String contextMenuItemTagBold();
-    virtual String contextMenuItemTagItalic();
-    virtual String contextMenuItemTagUnderline();
-    virtual String contextMenuItemTagOutline();
-    virtual String contextMenuItemTagWritingDirectionMenu();
-    virtual String contextMenuItemTagTextDirectionMenu();
-    virtual String contextMenuItemTagDefaultDirection();
-    virtual String contextMenuItemTagLeftToRight();
-    virtual String contextMenuItemTagRightToLeft();
-#if PLATFORM(MAC)
-    virtual String contextMenuItemTagSearchInSpotlight();
-    virtual String contextMenuItemTagShowFonts();
-    virtual String contextMenuItemTagStyles();
-    virtual String contextMenuItemTagShowColors();
-    virtual String contextMenuItemTagSpeechMenu();
-    virtual String contextMenuItemTagStartSpeaking();
-    virtual String contextMenuItemTagStopSpeaking();
-    virtual String contextMenuItemTagCorrectSpellingAutomatically();
-    virtual String contextMenuItemTagSubstitutionsMenu();
-    virtual String contextMenuItemTagShowSubstitutions(bool show);
-    virtual String contextMenuItemTagSmartCopyPaste();
-    virtual String contextMenuItemTagSmartQuotes();
-    virtual String contextMenuItemTagSmartDashes();
-    virtual String contextMenuItemTagSmartLinks();
-    virtual String contextMenuItemTagTextReplacement();
-    virtual String contextMenuItemTagTransformationsMenu();
-    virtual String contextMenuItemTagMakeUpperCase();
-    virtual String contextMenuItemTagMakeLowerCase();
-    virtual String contextMenuItemTagCapitalize();
-    virtual String contextMenuItemTagChangeBack(const String& replacedString);
-#endif
-    virtual String contextMenuItemTagInspectElement();
-    virtual String contextMenuItemTagOpenVideoInNewWindow();
-    virtual String contextMenuItemTagOpenAudioInNewWindow();
-    virtual String contextMenuItemTagCopyVideoLinkToClipboard();
-    virtual String contextMenuItemTagCopyAudioLinkToClipboard();
-    virtual String contextMenuItemTagToggleMediaControls();
-    virtual String contextMenuItemTagToggleMediaLoop();
-    virtual String contextMenuItemTagEnterVideoFullscreen();
-    virtual String contextMenuItemTagMediaPlay();
-    virtual String contextMenuItemTagMediaPause();
-    virtual String contextMenuItemTagMediaMute();
-#endif // ENABLE(CONTEXT_MENUS)
-    virtual String searchMenuNoRecentSearchesText();
-    virtual String searchMenuRecentSearchesText();
-    virtual String searchMenuClearRecentSearchesText();
-    virtual String AXWebAreaText();
-    virtual String AXLinkText();
-    virtual String AXListMarkerText();
-    virtual String AXImageMapText();
-    virtual String AXHeadingText();
-    virtual String AXDefinitionListTermText();
-    virtual String AXDefinitionListDefinitionText();
-#if PLATFORM(MAC)
-    virtual String AXARIAContentGroupText(const String& ariaType);
-#endif
-    virtual String AXButtonActionVerb();
-    virtual String AXRadioButtonActionVerb();
-    virtual String AXTextFieldActionVerb();
-    virtual String AXCheckedCheckBoxActionVerb();
-    virtual String AXUncheckedCheckBoxActionVerb();
-    virtual String AXMenuListActionVerb();
-    virtual String AXMenuListPopupActionVerb();
-    virtual String AXLinkActionVerb();
-    virtual String missingPluginText();
-    virtual String crashedPluginText();
-    virtual String multipleFileUploadText(unsigned numberOfFiles);
-    virtual String unknownFileSizeText();
-#if PLATFORM(WIN)
-    virtual String uploadFileText();
-    virtual String allFilesText();
-#endif
-#if PLATFORM(MAC)
-    virtual String builtInPDFPluginName();
-    virtual String pdfDocumentTypeDescription();
-    virtual String keygenMenuItem512();
-    virtual String keygenMenuItem1024();
-    virtual String keygenMenuItem2048();
-    virtual String keygenKeychainItemName(const String& host);
-#if PLATFORM(IOS)
-    virtual String htmlSelectMultipleItems(int);
-#endif // PLATFORM(IOS)
-#endif // PLATFORM(MAC)
-    virtual String imageTitle(const String& filename, const IntSize&);
-    virtual String mediaElementLoadingStateText();
-    virtual String mediaElementLiveBroadcastStateText();
-    virtual String localizedMediaControlElementString(const String&);
-    virtual String localizedMediaControlElementHelpText(const String&);
-    virtual String localizedMediaTimeDescription(float);
-    virtual String validationMessageValueMissingText();
-    virtual String validationMessageTypeMismatchText();
-    virtual String validationMessagePatternMismatchText();
-    virtual String validationMessageTooLongText();
-    virtual String validationMessageRangeUnderflowText();
-    virtual String validationMessageRangeOverflowText();
-    virtual String validationMessageStepMismatchText();
-};
-
-} // namespace WebCore
-
-#endif // USE(PLATFORM_STRATEGIES)
-
-#endif // DefaultLocalizationStrategy_h
diff --git a/Source/WebCore/platform/DragData.h b/Source/WebCore/platform/DragData.h
index 17abd44fa..ff818de4a 100644
--- a/Source/WebCore/platform/DragData.h
+++ b/Source/WebCore/platform/DragData.h
@@ -36,6 +36,7 @@
 
 #if PLATFORM(MAC)
 #include <wtf/RetainPtr.h>
+#include <wtf/text/WTFString.h>
 
 #ifdef __OBJC__ 
 #import <Foundation/Foundation.h>
@@ -120,7 +121,7 @@ public:
     bool containsFiles() const;
     unsigned numberOfFiles() const;
 #if PLATFORM(MAC)
-    NSPasteboard *pasteboard() { return m_pasteboard.get(); }
+    const String& pasteboardName() { return m_pasteboardName; }
 #endif
 
 #if PLATFORM(QT) || PLATFORM(GTK)
@@ -146,7 +147,7 @@ private:
     DragOperation m_draggingSourceOperationMask;
     DragApplicationFlags m_applicationFlags;
 #if PLATFORM(MAC)
-    RetainPtr<NSPasteboard> m_pasteboard;
+    String m_pasteboardName;
 #endif
 #if PLATFORM(WIN)
     DragDataMap m_dragDataMap;
diff --git a/Source/WebCore/platform/FileSystem.h b/Source/WebCore/platform/FileSystem.h
index 33c643e6d..9168ea6bb 100644
--- a/Source/WebCore/platform/FileSystem.h
+++ b/Source/WebCore/platform/FileSystem.h
@@ -198,12 +198,16 @@ RetainPtr<CFURLRef> pathAsURL(const String&);
 String filenameToString(const char*);
 String filenameForDisplay(const String&);
 CString applicationDirectoryPath();
+CString sharedResourcesPath();
 uint64_t getVolumeFreeSizeForPath(const char*);
 #endif
 
 #if PLATFORM(WIN) && !OS(WINCE)
 String localUserSpecificStorageDirectory();
 String roamingUserSpecificStorageDirectory();
+#endif
+
+#if PLATFORM(WIN) && USE(CF)
 bool safeCreateFile(const String&, CFDataRef);
 #endif
 
diff --git a/Source/WebCore/platform/FractionalLayoutUnit.h b/Source/WebCore/platform/FractionalLayoutUnit.h
new file mode 100644
index 000000000..77adaa796
--- /dev/null
+++ b/Source/WebCore/platform/FractionalLayoutUnit.h
@@ -0,0 +1,512 @@
+/*
+ * Copyright (c) 2012, Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef FractionalLayoutUnit_h
+#define FractionalLayoutUnit_h
+
+#include <limits.h>
+#include <limits>
+#include <stdlib.h>
+
+namespace WebCore {
+
+static const int kFixedPointDenominator = 60;
+const int intMaxForLayoutUnit = INT_MAX / kFixedPointDenominator;
+const int intMinForLayoutUnit = -intMaxForLayoutUnit;
+
+class FractionalLayoutUnit {
+public:
+    FractionalLayoutUnit() : m_value(0) { }
+    FractionalLayoutUnit(int value) { ASSERT(isInBounds(value)); m_value = value * kFixedPointDenominator; }
+    FractionalLayoutUnit(unsigned short value) { ASSERT(isInBounds(value)); m_value = value * kFixedPointDenominator; }
+    FractionalLayoutUnit(unsigned int value) { ASSERT(isInBounds(value)); m_value = value * kFixedPointDenominator; }
+    FractionalLayoutUnit(float value) { ASSERT(isInBounds(value)); m_value = value * kFixedPointDenominator; }
+    FractionalLayoutUnit(double value) { ASSERT(isInBounds(value)); m_value = value * kFixedPointDenominator; }
+    FractionalLayoutUnit(const FractionalLayoutUnit& value) { m_value = value.rawValue(); }
+
+    inline int toInt() const { return m_value / kFixedPointDenominator; }
+    inline unsigned toUnsigned() const { ASSERT(m_value >= 0); return toInt(); }
+    inline float toFloat() const { return static_cast<float>(m_value) / kFixedPointDenominator; }
+    inline double toDouble() const { return static_cast<double>(m_value) / kFixedPointDenominator; }
+
+    operator int() const { return toInt(); }
+    operator unsigned() const { return toUnsigned(); }
+    operator float() const { return toFloat(); }
+    operator double() const { return toDouble(); }
+    operator bool() const { return m_value; }
+
+    inline int rawValue() const { return m_value; }
+    inline void setRawValue(int value) { m_value = value; }
+    inline void setRawValue(long long value)
+    {
+        ASSERT(value > std::numeric_limits<int>::min() && value < std::numeric_limits<int>::max());
+        m_value = static_cast<int>(value);
+    }
+
+    inline FractionalLayoutUnit abs()
+    {
+        FractionalLayoutUnit returnValue;
+        returnValue.setRawValue(::abs(m_value));
+        return returnValue;
+    }
+#if OS(DARWIN)
+    inline int wtf_ceil()
+#else
+    inline int ceil()
+#endif
+    {
+        if (m_value > 0)
+            return (m_value + kFixedPointDenominator - 1) / kFixedPointDenominator;
+        return (m_value - kFixedPointDenominator + 1) / kFixedPointDenominator;
+    }
+    inline int round()
+    {
+        if (m_value > 0)
+            return (m_value + (kFixedPointDenominator / 2)) / kFixedPointDenominator;
+        return (m_value - (kFixedPointDenominator / 2)) / kFixedPointDenominator;
+    }
+
+    inline int floor()
+    {
+        return toInt();
+    }
+
+    static float epsilon() { return 1 / kFixedPointDenominator; }
+    static const FractionalLayoutUnit max()
+    {
+        FractionalLayoutUnit m;
+        m.m_value = std::numeric_limits<int>::max();
+        return m;
+    }
+    static const FractionalLayoutUnit min()
+    {
+        FractionalLayoutUnit m;
+        m.m_value = std::numeric_limits<int>::min();
+        return m;
+    }
+    
+private:
+    inline bool isInBounds(int value)
+    {
+        return ::abs(value) < std::numeric_limits<int>::max() / kFixedPointDenominator;
+    }
+    inline bool isInBounds(unsigned value)
+    {
+        return value < static_cast<unsigned>(std::numeric_limits<int>::max()) / kFixedPointDenominator;
+    }
+    inline bool isInBounds(double value)
+    {
+        return ::fabs(value) < std::numeric_limits<int>::max() / kFixedPointDenominator;
+    }
+
+    int m_value;
+};
+
+inline bool operator<=(const FractionalLayoutUnit& a, const FractionalLayoutUnit& b)
+{
+    return a.rawValue() <= b.rawValue();
+}
+
+inline bool operator<=(const FractionalLayoutUnit& a, float b)
+{
+    return a.toFloat() <= b;
+}
+
+inline bool operator<=(const FractionalLayoutUnit& a, int b)
+{
+    return a <= FractionalLayoutUnit(b);
+}
+
+inline bool operator<=(const float a, const FractionalLayoutUnit& b)
+{
+    return a <= b.toFloat();
+}
+
+inline bool operator<=(const int a, const FractionalLayoutUnit& b)
+{
+    return FractionalLayoutUnit(a) <= b;
+}
+
+inline bool operator>=(const FractionalLayoutUnit& a, const FractionalLayoutUnit& b)
+{
+    return a.rawValue() >= b.rawValue();
+}
+
+inline bool operator>=(const FractionalLayoutUnit& a, int b)
+{
+    return a >= FractionalLayoutUnit(b);
+}
+
+inline bool operator>=(const float a, const FractionalLayoutUnit& b)
+{
+    return a >= b.toFloat();
+}
+
+inline bool operator>=(const FractionalLayoutUnit& a, float b)
+{
+    return a.toFloat() >= b;
+}
+
+inline bool operator>=(const int a, const FractionalLayoutUnit& b)
+{
+    return FractionalLayoutUnit(a) >= b;
+}
+
+inline bool operator<(const FractionalLayoutUnit& a, const FractionalLayoutUnit& b)
+{
+    return a.rawValue() < b.rawValue();
+}
+
+inline bool operator<(const FractionalLayoutUnit& a, int b)
+{
+    return a < FractionalLayoutUnit(b);
+}
+
+inline bool operator<(const FractionalLayoutUnit& a, float b)
+{
+    return a.toFloat() < b;
+}
+
+inline bool operator<(const int a, const FractionalLayoutUnit& b)
+{
+    return FractionalLayoutUnit(a) < b;
+}
+
+inline bool operator<(const float a, const FractionalLayoutUnit& b)
+{
+    return a < b.toFloat();
+}
+
+inline bool operator>(const FractionalLayoutUnit& a, const FractionalLayoutUnit& b)
+{
+    return a.rawValue() > b.rawValue();
+}
+
+inline bool operator>(const FractionalLayoutUnit& a, double b)
+{
+    return a.toDouble() > b;
+}
+
+inline bool operator>(const FractionalLayoutUnit& a, float b)
+{
+    return a.toFloat() > b;
+}
+
+inline bool operator>(const FractionalLayoutUnit& a, int b)
+{
+    return a > FractionalLayoutUnit(b);
+}
+
+inline bool operator>(const int a, const FractionalLayoutUnit& b)
+{
+    return FractionalLayoutUnit(a) > b;
+}
+
+inline bool operator>(const float a, const FractionalLayoutUnit& b)
+{
+    return a > b.toFloat();
+}
+
+inline bool operator>(const double a, const FractionalLayoutUnit& b)
+{
+    return a > b.toDouble();
+}
+
+inline bool operator!=(const FractionalLayoutUnit& a, const FractionalLayoutUnit& b)
+{
+    return a.rawValue() != b.rawValue();
+}
+
+inline bool operator!=(const FractionalLayoutUnit& a, float b)
+{
+    return a != FractionalLayoutUnit(b);
+}
+
+inline bool operator!=(const int a, const FractionalLayoutUnit& b)
+{
+    return FractionalLayoutUnit(a) != b;
+}
+
+inline bool operator!=(const FractionalLayoutUnit& a, int b)
+{
+    return a != FractionalLayoutUnit(b);
+}
+
+inline bool operator==(const FractionalLayoutUnit& a, const FractionalLayoutUnit& b)
+{
+    return a.rawValue() == b.rawValue();
+}
+
+inline bool operator==(const FractionalLayoutUnit& a, int b)
+{
+    return a == FractionalLayoutUnit(b);
+}
+
+inline bool operator==(const int a, const FractionalLayoutUnit& b)
+{
+    return FractionalLayoutUnit(a) == b;
+}
+
+inline bool operator==(const FractionalLayoutUnit& a, float b)
+{
+    return a.toFloat() == b;
+}
+
+inline bool operator==(const float a, const FractionalLayoutUnit& b)
+{
+    return a == b.toFloat();
+}
+
+// For multiplication that's prone to overflow, this bounds it to FractionalLayoutUnit::max() and ::min()
+inline FractionalLayoutUnit boundedMultiply(const FractionalLayoutUnit& a, const FractionalLayoutUnit& b)
+{
+    FractionalLayoutUnit returnVal;
+    long long rawVal = static_cast<long long>(a.rawValue()) * b.rawValue() / kFixedPointDenominator;
+    if (rawVal > std::numeric_limits<int>::max())
+        return FractionalLayoutUnit::max();
+    if (rawVal < std::numeric_limits<int>::min())
+        return FractionalLayoutUnit::min();
+    returnVal.setRawValue(rawVal);
+    return returnVal;
+}
+
+inline FractionalLayoutUnit operator*(const FractionalLayoutUnit& a, const FractionalLayoutUnit& b)
+{
+    FractionalLayoutUnit returnVal;
+    long long rawVal = static_cast<long long>(a.rawValue()) * b.rawValue() / kFixedPointDenominator;
+    returnVal.setRawValue(rawVal);
+    return returnVal;
+}    
+
+inline double operator*(const FractionalLayoutUnit& a, double b)
+{
+    return a.toDouble() * b;
+}
+
+inline float operator*(const FractionalLayoutUnit& a, float b)
+{
+    return a.toFloat() * b;
+}
+
+inline FractionalLayoutUnit operator*(const FractionalLayoutUnit& a, int b)
+{
+    return a * FractionalLayoutUnit(b);
+}
+
+inline FractionalLayoutUnit operator*(const FractionalLayoutUnit& a, unsigned b)
+{
+    return a * FractionalLayoutUnit(b);
+}
+
+inline FractionalLayoutUnit operator*(unsigned a, const FractionalLayoutUnit& b)
+{
+    return FractionalLayoutUnit(a) * b;
+}
+
+inline FractionalLayoutUnit operator*(const int a, const FractionalLayoutUnit& b)
+{
+    return FractionalLayoutUnit(a) * b;
+}
+
+inline float operator*(const float a, const FractionalLayoutUnit& b)
+{
+    return a * b.toFloat();
+}
+
+inline double operator*(const double a, const FractionalLayoutUnit& b)
+{
+    return a * b.toDouble();
+}
+
+inline FractionalLayoutUnit operator/(const FractionalLayoutUnit& a, const FractionalLayoutUnit& b)
+{
+    FractionalLayoutUnit returnVal;
+    long long rawVal = static_cast<long long>(kFixedPointDenominator) * a.rawValue() / b.rawValue();
+    returnVal.setRawValue(rawVal);
+    return returnVal;
+}    
+
+inline float operator/(const FractionalLayoutUnit& a, float b)
+{
+    return a.toFloat() / b;
+}
+
+inline double operator/(const FractionalLayoutUnit& a, double b)
+{
+    return a.toDouble() / b;
+}
+
+inline FractionalLayoutUnit operator/(const FractionalLayoutUnit& a, int b)
+{
+    return a / FractionalLayoutUnit(b);
+}
+
+inline FractionalLayoutUnit operator/(const FractionalLayoutUnit& a, unsigned int b)
+{
+    return a / FractionalLayoutUnit(b);
+}
+
+inline float operator/(const float a, const FractionalLayoutUnit& b)
+{
+    return a / b.toFloat();
+}
+
+inline FractionalLayoutUnit operator/(const int a, const FractionalLayoutUnit& b)
+{
+    return FractionalLayoutUnit(a) / b;
+}
+
+inline FractionalLayoutUnit operator/(unsigned int a, const FractionalLayoutUnit& b)
+{
+    return FractionalLayoutUnit(a) / b;
+}
+
+inline FractionalLayoutUnit operator+(const FractionalLayoutUnit& a, const FractionalLayoutUnit& b)
+{
+    FractionalLayoutUnit returnVal;
+    returnVal.setRawValue(a.rawValue() + b.rawValue());
+    return returnVal;
+}
+
+inline FractionalLayoutUnit operator+(const FractionalLayoutUnit& a, int b)
+{
+    return a + FractionalLayoutUnit(b);
+}
+
+inline float operator+(const FractionalLayoutUnit& a, float b)
+{
+    return a.toFloat() + b;
+}
+
+inline double operator+(const FractionalLayoutUnit& a, double b)
+{
+    return a.toDouble() + b;
+}
+
+inline FractionalLayoutUnit operator+(const int a, const FractionalLayoutUnit& b)
+{
+    return FractionalLayoutUnit(a) + b;
+}
+
+inline float operator+(const float a, const FractionalLayoutUnit& b)
+{
+    return a + b.toFloat();
+}
+
+inline FractionalLayoutUnit operator-(const FractionalLayoutUnit& a, const FractionalLayoutUnit& b)
+{
+    FractionalLayoutUnit returnVal;
+    returnVal.setRawValue(a.rawValue() - b.rawValue());
+    return returnVal;
+}
+
+inline FractionalLayoutUnit operator-(const FractionalLayoutUnit& a, int b)
+{
+    return a - FractionalLayoutUnit(b);
+}
+
+inline float operator-(const FractionalLayoutUnit& a, float b)
+{
+    return a.toFloat() - b;
+}
+
+inline FractionalLayoutUnit operator-(const int a, const FractionalLayoutUnit& b)
+{
+    return FractionalLayoutUnit(a) - b;
+}
+
+inline float operator-(const float a, const FractionalLayoutUnit& b)
+{
+    return a - b.toFloat();
+}
+
+inline FractionalLayoutUnit operator-(const FractionalLayoutUnit& a)
+{
+    FractionalLayoutUnit returnVal;
+    returnVal.setRawValue(-a.rawValue());
+    return returnVal;
+}
+
+inline FractionalLayoutUnit& operator+=(FractionalLayoutUnit& a, const FractionalLayoutUnit& b)
+{
+    a = a + b;
+    return a;
+}
+
+inline FractionalLayoutUnit& operator+=(FractionalLayoutUnit& a, int b)
+{
+    a = a + b;
+    return a;
+}
+
+inline float& operator+=(float& a, const FractionalLayoutUnit& b)
+{
+    a = a + b;
+    return a;
+}
+
+inline FractionalLayoutUnit& operator-=(FractionalLayoutUnit& a, int b)
+{
+    a = a - b;
+    return a;
+}
+
+inline FractionalLayoutUnit& operator-=(FractionalLayoutUnit& a, const FractionalLayoutUnit& b)
+{
+    a = a - b;
+    return a;
+}
+
+inline float& operator-=(float& a, const FractionalLayoutUnit& b)
+{
+    a = a - b;
+    return a;
+}
+
+inline FractionalLayoutUnit& operator*=(FractionalLayoutUnit& a, int b)
+{
+    a = a * b;
+    return a;
+}
+
+inline FractionalLayoutUnit& operator*=(FractionalLayoutUnit& a, float b)
+{
+    a = a * b;
+    return a;
+}
+
+inline int snapSizeToPixel(FractionalLayoutUnit size, FractionalLayoutUnit location) 
+{
+    return (location + size).round() - location.round();
+}
+
+} // namespace WebCore
+
+#endif // FractionalLayoutUnit_h
diff --git a/Source/WebCore/platform/KURL.cpp b/Source/WebCore/platform/KURL.cpp
index 606280ab4..a3812c6a2 100644
--- a/Source/WebCore/platform/KURL.cpp
+++ b/Source/WebCore/platform/KURL.cpp
@@ -339,12 +339,6 @@ KURL::KURL(ParsedURLStringTag, const String& url)
     ASSERT(url == m_string);
 }
 
-KURL::KURL(ParsedURLStringTag, const URLString& url)
-{
-    parse(url.string());
-    ASSERT(url.string() == m_string);
-}
-
 KURL::KURL(const KURL& base, const String& relative)
 {
     init(base, relative, UTF8Encoding());
diff --git a/Source/WebCore/platform/KURL.h b/Source/WebCore/platform/KURL.h
index 9afced50e..a464dc3de 100644
--- a/Source/WebCore/platform/KURL.h
+++ b/Source/WebCore/platform/KURL.h
@@ -27,7 +27,6 @@
 #define KURL_h
 
 #include "PlatformString.h"
-#include "URLString.h"
 #include <wtf/HashMap.h>
 
 #if USE(CF)
@@ -70,7 +69,6 @@ public:
     // KURL object, or indiscernible from such.
     // It is usually best to avoid repeatedly parsing a string, unless memory saving outweigh the possible slow-downs.
     KURL(ParsedURLStringTag, const String&);
-    KURL(ParsedURLStringTag, const URLString&);
 #if USE(GOOGLEURL)
     KURL(WTF::HashTableDeletedValueType) : m_url(WTF::HashTableDeletedValue) { }
 #else
@@ -123,10 +121,8 @@ public:
 
 #if USE(GOOGLEURL)
     const String& string() const { return m_url.string(); }
-    URLString urlString() const { return URLString(m_url.string()); }
 #else
     const String& string() const { return m_string; }
-    URLString urlString() const { return URLString(m_string); }
 #endif
 
     String protocol() const;
diff --git a/Source/WebCore/platform/Length.cpp b/Source/WebCore/platform/Length.cpp
index 855d02f93..a6bc01939 100644
--- a/Source/WebCore/platform/Length.cpp
+++ b/Source/WebCore/platform/Length.cpp
@@ -149,4 +149,10 @@ PassOwnArrayPtr<Length> newLengthArray(const String& string, int& len)
     return r.release();
 }
 
+class SameSizeAsLength {
+    int32_t value;
+    int32_t metaData;
+};
+COMPILE_ASSERT(sizeof(Length) == sizeof(SameSizeAsLength), length_should_stay_small);
+
 } // namespace WebCore
diff --git a/Source/WebCore/platform/LocalizationStrategy.h b/Source/WebCore/platform/LocalizationStrategy.h
deleted file mode 100644
index 8fab764b8..000000000
--- a/Source/WebCore/platform/LocalizationStrategy.h
+++ /dev/null
@@ -1,207 +0,0 @@
-/*
- * Copyright (C) 2010 Apple Inc. All rights reserved.
- * Copyright (C) 2010 Igalia S.L
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
- * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
- * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
- * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
- * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
- * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
- * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
- * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
- * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
- * THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#ifndef LocalizationStrategy_h
-#define LocalizationStrategy_h
-
-#if USE(PLATFORM_STRATEGIES)
-
-#include <wtf/Forward.h>
-
-namespace WebCore {
-
-class IntSize;
-
-class LocalizationStrategy {
-public:    
-    virtual String inputElementAltText() = 0;
-    virtual String resetButtonDefaultLabel() = 0;
-    virtual String searchableIndexIntroduction() = 0;
-    virtual String submitButtonDefaultLabel() = 0;
-    virtual String fileButtonChooseFileLabel() = 0;
-    virtual String fileButtonChooseMultipleFilesLabel() = 0;
-    virtual String fileButtonNoFileSelectedLabel() = 0;
-    virtual String fileButtonNoFilesSelectedLabel() = 0;
-    virtual String defaultDetailsSummaryText() = 0;
-
-#if PLATFORM(MAC)
-    virtual String copyImageUnknownFileLabel() = 0;
-#endif
-
-#if ENABLE(CONTEXT_MENUS)
-    virtual String contextMenuItemTagOpenLinkInNewWindow() = 0;
-    virtual String contextMenuItemTagDownloadLinkToDisk() = 0;
-    virtual String contextMenuItemTagCopyLinkToClipboard() = 0;
-    virtual String contextMenuItemTagOpenImageInNewWindow() = 0;
-    virtual String contextMenuItemTagDownloadImageToDisk() = 0;
-    virtual String contextMenuItemTagCopyImageToClipboard() = 0;
-#if PLATFORM(QT) || PLATFORM(GTK) || PLATFORM(EFL)
-    virtual String contextMenuItemTagCopyImageUrlToClipboard() = 0;
-#endif
-    virtual String contextMenuItemTagOpenFrameInNewWindow() = 0;
-    virtual String contextMenuItemTagCopy() = 0;
-    virtual String contextMenuItemTagGoBack() = 0;
-    virtual String contextMenuItemTagGoForward() = 0;
-    virtual String contextMenuItemTagStop() = 0;
-    virtual String contextMenuItemTagReload() = 0;
-    virtual String contextMenuItemTagCut() = 0;
-    virtual String contextMenuItemTagPaste() = 0;
-#if PLATFORM(GTK)
-    virtual String contextMenuItemTagDelete() = 0;
-    virtual String contextMenuItemTagInputMethods() = 0;
-    virtual String contextMenuItemTagUnicode() = 0;
-#endif
-#if PLATFORM(GTK) || PLATFORM(QT) || PLATFORM(EFL)
-    virtual String contextMenuItemTagSelectAll() = 0;
-#endif
-    virtual String contextMenuItemTagNoGuessesFound() = 0;
-    virtual String contextMenuItemTagIgnoreSpelling() = 0;
-    virtual String contextMenuItemTagLearnSpelling() = 0;
-    virtual String contextMenuItemTagSearchWeb() = 0;
-    virtual String contextMenuItemTagLookUpInDictionary(const String& selectedString) = 0;
-    virtual String contextMenuItemTagOpenLink() = 0;
-    virtual String contextMenuItemTagIgnoreGrammar() = 0;
-    virtual String contextMenuItemTagSpellingMenu() = 0;
-    virtual String contextMenuItemTagShowSpellingPanel(bool show) = 0;
-    virtual String contextMenuItemTagCheckSpelling() = 0;
-    virtual String contextMenuItemTagCheckSpellingWhileTyping() = 0;
-    virtual String contextMenuItemTagCheckGrammarWithSpelling() = 0;
-    virtual String contextMenuItemTagFontMenu() = 0;
-    virtual String contextMenuItemTagBold() = 0;
-    virtual String contextMenuItemTagItalic() = 0;
-    virtual String contextMenuItemTagUnderline() = 0;
-    virtual String contextMenuItemTagOutline() = 0;
-    virtual String contextMenuItemTagWritingDirectionMenu() = 0;
-    virtual String contextMenuItemTagTextDirectionMenu() = 0;
-    virtual String contextMenuItemTagDefaultDirection() = 0;
-    virtual String contextMenuItemTagLeftToRight() = 0;
-    virtual String contextMenuItemTagRightToLeft() = 0;
-#if PLATFORM(MAC)
-    virtual String contextMenuItemTagSearchInSpotlight() = 0;
-    virtual String contextMenuItemTagShowFonts() = 0;
-    virtual String contextMenuItemTagStyles() = 0;
-    virtual String contextMenuItemTagShowColors() = 0;
-    virtual String contextMenuItemTagSpeechMenu() = 0;
-    virtual String contextMenuItemTagStartSpeaking() = 0;
-    virtual String contextMenuItemTagStopSpeaking() = 0;
-    virtual String contextMenuItemTagCorrectSpellingAutomatically() = 0;
-    virtual String contextMenuItemTagSubstitutionsMenu() = 0;
-    virtual String contextMenuItemTagShowSubstitutions(bool show) = 0;
-    virtual String contextMenuItemTagSmartCopyPaste() = 0;
-    virtual String contextMenuItemTagSmartQuotes() = 0;
-    virtual String contextMenuItemTagSmartDashes() = 0;
-    virtual String contextMenuItemTagSmartLinks() = 0;
-    virtual String contextMenuItemTagTextReplacement() = 0;
-    virtual String contextMenuItemTagTransformationsMenu() = 0;
-    virtual String contextMenuItemTagMakeUpperCase() = 0;
-    virtual String contextMenuItemTagMakeLowerCase() = 0;
-    virtual String contextMenuItemTagCapitalize() = 0;
-    virtual String contextMenuItemTagChangeBack(const String& replacedString) = 0;
-#endif
-    virtual String contextMenuItemTagOpenVideoInNewWindow() = 0;
-    virtual String contextMenuItemTagOpenAudioInNewWindow() = 0;
-    virtual String contextMenuItemTagCopyVideoLinkToClipboard() = 0;
-    virtual String contextMenuItemTagCopyAudioLinkToClipboard() = 0;
-    virtual String contextMenuItemTagToggleMediaControls() = 0;
-    virtual String contextMenuItemTagToggleMediaLoop() = 0;
-    virtual String contextMenuItemTagEnterVideoFullscreen() = 0;
-    virtual String contextMenuItemTagMediaPlay() = 0;
-    virtual String contextMenuItemTagMediaPause() = 0;
-    virtual String contextMenuItemTagMediaMute() = 0;
-    virtual String contextMenuItemTagInspectElement() = 0;
-#endif // ENABLE(CONTEXT_MENUS)
-
-    virtual String searchMenuNoRecentSearchesText() = 0;
-    virtual String searchMenuRecentSearchesText() = 0;
-    virtual String searchMenuClearRecentSearchesText() = 0;
-
-    virtual String AXWebAreaText() = 0;
-    virtual String AXLinkText() = 0;
-    virtual String AXListMarkerText() = 0;
-    virtual String AXImageMapText() = 0;
-    virtual String AXHeadingText() = 0;
-    virtual String AXDefinitionListTermText() = 0;
-    virtual String AXDefinitionListDefinitionText() = 0;
-
-#if PLATFORM(MAC)
-    virtual String AXARIAContentGroupText(const String& ariaType) = 0;
-#endif
-    
-    virtual String AXButtonActionVerb() = 0;
-    virtual String AXRadioButtonActionVerb() = 0;
-    virtual String AXTextFieldActionVerb() = 0;
-    virtual String AXCheckedCheckBoxActionVerb() = 0;
-    virtual String AXUncheckedCheckBoxActionVerb() = 0;
-    virtual String AXMenuListActionVerb() = 0;
-    virtual String AXMenuListPopupActionVerb() = 0;
-    virtual String AXLinkActionVerb() = 0;
-
-    virtual String missingPluginText() = 0;
-    virtual String crashedPluginText() = 0;
-    virtual String multipleFileUploadText(unsigned numberOfFiles) = 0;
-    virtual String unknownFileSizeText() = 0;
-
-#if PLATFORM(WIN)
-    virtual String uploadFileText() = 0;
-    virtual String allFilesText() = 0;
-#endif
-
-#if PLATFORM(MAC)
-    virtual String builtInPDFPluginName() = 0;
-    virtual String pdfDocumentTypeDescription() = 0;
-    virtual String keygenMenuItem512() = 0;
-    virtual String keygenMenuItem1024() = 0;
-    virtual String keygenMenuItem2048() = 0;
-    virtual String keygenKeychainItemName(const String& host) = 0;
-#endif
-
-    virtual String imageTitle(const String& filename, const IntSize& size) = 0;
-
-    virtual String mediaElementLoadingStateText() = 0;
-    virtual String mediaElementLiveBroadcastStateText() = 0;
-    virtual String localizedMediaControlElementString(const String&) = 0;
-    virtual String localizedMediaControlElementHelpText(const String&) = 0;
-    virtual String localizedMediaTimeDescription(float) = 0;
-
-    virtual String validationMessageValueMissingText() = 0;
-    virtual String validationMessageTypeMismatchText() = 0;
-    virtual String validationMessagePatternMismatchText() = 0;
-    virtual String validationMessageTooLongText() = 0;
-    virtual String validationMessageRangeUnderflowText() = 0;
-    virtual String validationMessageRangeOverflowText() = 0;
-    virtual String validationMessageStepMismatchText() = 0;
-
-protected:
-    virtual ~LocalizationStrategy()
-    {
-    }
-};
-
-} // namespace WebCore
-
-#endif // USE(PLATFORM_STRATEGIES)
-
-#endif // LocalizationStrategy_h
diff --git a/Source/WebCore/platform/LocalizedStrings.cpp b/Source/WebCore/platform/LocalizedStrings.cpp
index 1409bbf31..0383de6f7 100644
--- a/Source/WebCore/platform/LocalizedStrings.cpp
+++ b/Source/WebCore/platform/LocalizedStrings.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2003, 2006, 2009, 2010 Apple Inc. All rights reserved.
+ * Copyright (C) 2003, 2006, 2009, 2010, 2012 Apple Inc. All rights reserved.
  * Copyright (C) 2010 Igalia S.L
  *
  * Redistribution and use in source and binary forms, with or without
@@ -27,711 +27,931 @@
 #include "config.h"
 #include "LocalizedStrings.h"
 
-#include "DefaultLocalizationStrategy.h"
 #include "IntSize.h"
-#include "PlatformStrategies.h"
+#include "NotImplemented.h"
 #include "PlatformString.h"
+#include <wtf/MathExtras.h>
+#if USE(CF)
+#include <wtf/RetainPtr.h>
+#endif
+#include <wtf/UnusedParam.h>
+#include <wtf/unicode/CharacterNames.h>
+
+#if PLATFORM(MAC)
+#include "WebCoreSystemInterface.h"
+#endif
 
 namespace WebCore {
 
-#if USE(PLATFORM_STRATEGIES)
+// We can't use String::format for two reasons:
+//  1) It doesn't handle non-ASCII characters in the format string.
+//  2) It doesn't handle the %2$d syntax.
+// Note that because |format| is used as the second parameter to va_start, it cannot be a reference
+// type according to section 18.7/3 of the C++ N1905 standard.
+static String formatLocalizedString(String format, ...)
+{
+#if USE(CF)
+    va_list arguments;
+    va_start(arguments, format);
+    RetainPtr<CFStringRef> formatCFString(AdoptCF, format.createCFString());
+    RetainPtr<CFStringRef> result(AdoptCF, CFStringCreateWithFormatAndArguments(0, 0, formatCFString.get(), arguments));
+    va_end(arguments);
+    return result.get();
+#else
+    notImplemented();
+    return format;
+#endif
+}
 
-static inline LocalizationStrategy* localizationStrategy()
+#if !defined(BUILDING_ON_LEOPARD) && !defined(BUILDING_ON_SNOW_LEOPARD)
+static String truncatedStringForLookupMenuItem(const String& original)
 {
-    if (hasPlatformStrategies())
-        return platformStrategies()->localizationStrategy();
+    if (original.isEmpty())
+        return original;
+
+    // Truncate the string if it's too long. This is in consistency with AppKit.
+    unsigned maxNumberOfGraphemeClustersInLookupMenuItem = 24;
+    DEFINE_STATIC_LOCAL(String, ellipsis, (&horizontalEllipsis, 1));
 
-    return &DefaultLocalizationStrategy::shared();
+    String trimmed = original.stripWhiteSpace();
+    unsigned numberOfCharacters = numCharactersInGraphemeClusters(trimmed, maxNumberOfGraphemeClustersInLookupMenuItem);
+    return numberOfCharacters == trimmed.length() ? trimmed : trimmed.left(numberOfCharacters) + ellipsis;
 }
+#endif
 
 String inputElementAltText()
 {
-    return localizationStrategy()->inputElementAltText();
+    return WEB_UI_STRING_KEY("Submit", "Submit (input element)", "alt text for <input> elements with no alt, title, or value");
 }
 
 String resetButtonDefaultLabel()
 {
-    return localizationStrategy()->resetButtonDefaultLabel();
+    return WEB_UI_STRING("Reset", "default label for Reset buttons in forms on web pages");
 }
 
 String searchableIndexIntroduction()
 {
-    return localizationStrategy()->searchableIndexIntroduction();
+    return WEB_UI_STRING("This is a searchable index. Enter search keywords: ",
+                         "text that appears at the start of nearly-obsolete web pages in the form of a 'searchable index'");
 }
 
 String submitButtonDefaultLabel()
 {
-    return localizationStrategy()->submitButtonDefaultLabel();
+    return WEB_UI_STRING("Submit", "default label for Submit buttons in forms on web pages");
 }
 
 String fileButtonChooseFileLabel()
 {
-    return localizationStrategy()->fileButtonChooseFileLabel();
+    return WEB_UI_STRING("Choose File", "title for a single file chooser button used in HTML forms");
 }
 
 String fileButtonChooseMultipleFilesLabel()
 {
-    return localizationStrategy()->fileButtonChooseMultipleFilesLabel();
+    return WEB_UI_STRING("Choose Files", "title for a multiple file chooser button used in HTML forms. This title should be as short as possible.");
 }
 
 String fileButtonNoFileSelectedLabel()
 {
-    return localizationStrategy()->fileButtonNoFileSelectedLabel();
+    return WEB_UI_STRING("no file selected", "text to display in file button used in HTML forms when no file is selected");
 }
 
 String fileButtonNoFilesSelectedLabel()
 {
-    return localizationStrategy()->fileButtonNoFilesSelectedLabel();
+    return WEB_UI_STRING("no files selected", "text to display in file button used in HTML forms when no files are selected and the button allows multiple files to be selected");
 }
 
 String defaultDetailsSummaryText()
 {
-    return localizationStrategy()->defaultDetailsSummaryText();
+    return WEB_UI_STRING("Details", "text to display in <details> tag when it has no <summary> child");
 }
 
 #if PLATFORM(MAC)
 String copyImageUnknownFileLabel()
 {
-    return localizationStrategy()->copyImageUnknownFileLabel();
+    return WEB_UI_STRING("unknown", "Unknown filename");
 }
 #endif
 
 #if ENABLE(CONTEXT_MENUS)
 String contextMenuItemTagOpenLinkInNewWindow()
 {
-    return localizationStrategy()->contextMenuItemTagOpenLinkInNewWindow();
+    return WEB_UI_STRING("Open Link in New Window", "Open in New Window context menu item");
 }
 
 String contextMenuItemTagDownloadLinkToDisk()
 {
-    return localizationStrategy()->contextMenuItemTagDownloadLinkToDisk();
+    return WEB_UI_STRING("Download Linked File", "Download Linked File context menu item");
 }
 
 String contextMenuItemTagCopyLinkToClipboard()
 {
-    return localizationStrategy()->contextMenuItemTagCopyLinkToClipboard();
+    return WEB_UI_STRING("Copy Link", "Copy Link context menu item");
 }
 
 String contextMenuItemTagOpenImageInNewWindow()
 {
-    return localizationStrategy()->contextMenuItemTagOpenImageInNewWindow();
+    return WEB_UI_STRING("Open Image in New Window", "Open Image in New Window context menu item");
 }
 
 String contextMenuItemTagDownloadImageToDisk()
 {
-    return localizationStrategy()->contextMenuItemTagDownloadImageToDisk();
+    return WEB_UI_STRING("Download Image", "Download Image context menu item");
 }
 
 String contextMenuItemTagCopyImageToClipboard()
 {
-    return localizationStrategy()->contextMenuItemTagCopyImageToClipboard();
-}
-
-#if PLATFORM(QT) || PLATFORM(GTK) || PLATFORM(EFL)
-String contextMenuItemTagCopyImageUrlToClipboard()
-{
-    return localizationStrategy()->contextMenuItemTagCopyImageUrlToClipboard();
+    return WEB_UI_STRING("Copy Image", "Copy Image context menu item");
 }
-#endif
 
 String contextMenuItemTagOpenFrameInNewWindow()
 {
-    return localizationStrategy()->contextMenuItemTagOpenFrameInNewWindow();
+    return WEB_UI_STRING("Open Frame in New Window", "Open Frame in New Window context menu item");
 }
 
 String contextMenuItemTagCopy()
 {
-    return localizationStrategy()->contextMenuItemTagCopy();
+    return WEB_UI_STRING("Copy", "Copy context menu item");
 }
 
 String contextMenuItemTagGoBack()
 {
-    return localizationStrategy()->contextMenuItemTagGoBack();
+    return WEB_UI_STRING("Back", "Back context menu item");
 }
 
 String contextMenuItemTagGoForward()
 {
-    return localizationStrategy()->contextMenuItemTagGoForward();
+    return WEB_UI_STRING("Forward", "Forward context menu item");
 }
 
 String contextMenuItemTagStop()
 {
-    return localizationStrategy()->contextMenuItemTagStop();
+    return WEB_UI_STRING("Stop", "Stop context menu item");
 }
 
 String contextMenuItemTagReload()
 {
-    return localizationStrategy()->contextMenuItemTagReload();
+    return WEB_UI_STRING("Reload", "Reload context menu item");
 }
 
 String contextMenuItemTagCut()
 {
-    return localizationStrategy()->contextMenuItemTagCut();
+    return WEB_UI_STRING("Cut", "Cut context menu item");
 }
 
 String contextMenuItemTagPaste()
 {
-    return localizationStrategy()->contextMenuItemTagPaste();
+    return WEB_UI_STRING("Paste", "Paste context menu item");
 }
 
 #if PLATFORM(QT)
 String contextMenuItemTagSelectAll()
 {
-    return localizationStrategy()->contextMenuItemTagSelectAll();
+    notImplemented();
+    return "Select All";
 }
 #endif
 
 String contextMenuItemTagNoGuessesFound()
 {
-    return localizationStrategy()->contextMenuItemTagNoGuessesFound();
+    return WEB_UI_STRING("No Guesses Found", "No Guesses Found context menu item");
 }
 
 String contextMenuItemTagIgnoreSpelling()
 {
-    return localizationStrategy()->contextMenuItemTagIgnoreSpelling();
+    return WEB_UI_STRING("Ignore Spelling", "Ignore Spelling context menu item");
 }
 
 String contextMenuItemTagLearnSpelling()
 {
-    return localizationStrategy()->contextMenuItemTagLearnSpelling();
+    return WEB_UI_STRING("Learn Spelling", "Learn Spelling context menu item");
 }
 
 #if PLATFORM(MAC)
 String contextMenuItemTagSearchInSpotlight()
 {
-    return localizationStrategy()->contextMenuItemTagSearchInSpotlight();
+    return WEB_UI_STRING("Search in Spotlight", "Search in Spotlight context menu item");
 }
 #endif
 
 String contextMenuItemTagSearchWeb()
 {
-    return localizationStrategy()->contextMenuItemTagSearchWeb();
+#if PLATFORM(MAC) && !defined(BUILDING_ON_LEOPARD) && !defined(BUILDING_ON_SNOW_LEOPARD)
+    RetainPtr<CFStringRef> searchProviderName(AdoptCF, wkCopyDefaultSearchProviderDisplayName());
+    return formatLocalizedString(WEB_UI_STRING("Search with %@", "Search with search provider context menu item with provider name inserted"), searchProviderName.get());
+#else
+    return WEB_UI_STRING("Search with Google", "Search with Google context menu item");
+#endif
 }
 
 String contextMenuItemTagLookUpInDictionary(const String& selectedString)
 {
-    return localizationStrategy()->contextMenuItemTagLookUpInDictionary(selectedString);
+#if defined(BUILDING_ON_LEOPARD) || defined(BUILDING_ON_SNOW_LEOPARD)
+    UNUSED_PARAM(selectedString);
+    return WEB_UI_STRING("Look Up in Dictionary", "Look Up in Dictionary context menu item");
+#else
+#if USE(CF)
+    RetainPtr<CFStringRef> selectedCFString(AdoptCF, truncatedStringForLookupMenuItem(selectedString).createCFString());
+    return formatLocalizedString(WEB_UI_STRING("Look Up “%@”", "Look Up context menu item with selected word"), selectedCFString.get());
+#else
+    return WEB_UI_STRING("Look Up “<selection>”", "Look Up context menu item with selected word").replace("<selection>", truncatedStringForLookupMenuItem(selectedString));
+#endif
+#endif
 }
 
 String contextMenuItemTagOpenLink()
 {
-    return localizationStrategy()->contextMenuItemTagOpenLink();
+    return WEB_UI_STRING("Open Link", "Open Link context menu item");
 }
 
 String contextMenuItemTagIgnoreGrammar()
 {
-    return localizationStrategy()->contextMenuItemTagIgnoreGrammar();
+    return WEB_UI_STRING("Ignore Grammar", "Ignore Grammar context menu item");
 }
 
 String contextMenuItemTagSpellingMenu()
 {
-    return localizationStrategy()->contextMenuItemTagSpellingMenu();
+    return WEB_UI_STRING("Spelling and Grammar", "Spelling and Grammar context sub-menu item");
 }
 
 String contextMenuItemTagShowSpellingPanel(bool show)
 {
-    return localizationStrategy()->contextMenuItemTagShowSpellingPanel(show);
+    if (show)
+        return WEB_UI_STRING("Show Spelling and Grammar", "menu item title");
+    return WEB_UI_STRING("Hide Spelling and Grammar", "menu item title");
 }
 
 String contextMenuItemTagCheckSpelling()
 {
-    return localizationStrategy()->contextMenuItemTagCheckSpelling();
+    return WEB_UI_STRING("Check Document Now", "Check spelling context menu item");
 }
 
 String contextMenuItemTagCheckSpellingWhileTyping()
 {
-    return localizationStrategy()->contextMenuItemTagCheckSpellingWhileTyping();
+    return WEB_UI_STRING("Check Spelling While Typing", "Check spelling while typing context menu item");
 }
 
 String contextMenuItemTagCheckGrammarWithSpelling()
 {
-    return localizationStrategy()->contextMenuItemTagCheckGrammarWithSpelling();
+    return WEB_UI_STRING("Check Grammar With Spelling", "Check grammar with spelling context menu item");
 }
 
 String contextMenuItemTagFontMenu()
 {
-    return localizationStrategy()->contextMenuItemTagFontMenu();
+    return WEB_UI_STRING("Font", "Font context sub-menu item");
 }
 
 #if PLATFORM(MAC)
 String contextMenuItemTagShowFonts()
 {
-    return localizationStrategy()->contextMenuItemTagShowFonts();
+    return WEB_UI_STRING("Show Fonts", "Show fonts context menu item");
 }
 #endif
 
 String contextMenuItemTagBold()
 {
-    return localizationStrategy()->contextMenuItemTagBold();
+    return WEB_UI_STRING("Bold", "Bold context menu item");
 }
 
 String contextMenuItemTagItalic()
 {
-    return localizationStrategy()->contextMenuItemTagItalic();
+    return WEB_UI_STRING("Italic", "Italic context menu item");
 }
 
 String contextMenuItemTagUnderline()
 {
-    return localizationStrategy()->contextMenuItemTagUnderline();
+    return WEB_UI_STRING("Underline", "Underline context menu item");
 }
 
 String contextMenuItemTagOutline()
 {
-    return localizationStrategy()->contextMenuItemTagOutline();
+    return WEB_UI_STRING("Outline", "Outline context menu item");
 }
 
 #if PLATFORM(MAC)
 String contextMenuItemTagStyles()
 {
-    return localizationStrategy()->contextMenuItemTagStyles();
+    return WEB_UI_STRING("Styles...", "Styles context menu item");
 }
 
 String contextMenuItemTagShowColors()
 {
-    return localizationStrategy()->contextMenuItemTagShowColors();
+    return WEB_UI_STRING("Show Colors", "Show colors context menu item");
 }
 
 String contextMenuItemTagSpeechMenu()
 {
-    return localizationStrategy()->contextMenuItemTagSpeechMenu();
+    return WEB_UI_STRING("Speech", "Speech context sub-menu item");
 }
 
 String contextMenuItemTagStartSpeaking()
 {
-    return localizationStrategy()->contextMenuItemTagStartSpeaking();
+    return WEB_UI_STRING("Start Speaking", "Start speaking context menu item");
 }
 
 String contextMenuItemTagStopSpeaking()
 {
-    return localizationStrategy()->contextMenuItemTagStopSpeaking();
+    return WEB_UI_STRING("Stop Speaking", "Stop speaking context menu item");
 }
 #endif
 
 String contextMenuItemTagWritingDirectionMenu()
 {
-    return localizationStrategy()->contextMenuItemTagWritingDirectionMenu();
+    return WEB_UI_STRING("Paragraph Direction", "Paragraph direction context sub-menu item");
 }
 
 String contextMenuItemTagTextDirectionMenu()
 {
-    return localizationStrategy()->contextMenuItemTagTextDirectionMenu();
+    return WEB_UI_STRING("Selection Direction", "Selection direction context sub-menu item");
 }
 
 String contextMenuItemTagDefaultDirection()
 {
-    return localizationStrategy()->contextMenuItemTagDefaultDirection();
+    return WEB_UI_STRING("Default", "Default writing direction context menu item");
 }
 
 String contextMenuItemTagLeftToRight()
 {
-    return localizationStrategy()->contextMenuItemTagLeftToRight();
+    return WEB_UI_STRING("Left to Right", "Left to Right context menu item");
 }
 
 String contextMenuItemTagRightToLeft()
 {
-    return localizationStrategy()->contextMenuItemTagRightToLeft();
+    return WEB_UI_STRING("Right to Left", "Right to Left context menu item");
 }
 
 #if PLATFORM(MAC)
 
 String contextMenuItemTagCorrectSpellingAutomatically()
 {
-    return localizationStrategy()->contextMenuItemTagCorrectSpellingAutomatically();
+    return WEB_UI_STRING("Correct Spelling Automatically", "Correct Spelling Automatically context menu item");
 }
 
 String contextMenuItemTagSubstitutionsMenu()
 {
-    return localizationStrategy()->contextMenuItemTagSubstitutionsMenu();
+    return WEB_UI_STRING("Substitutions", "Substitutions context sub-menu item");
 }
 
 String contextMenuItemTagShowSubstitutions(bool show)
 {
-    return localizationStrategy()->contextMenuItemTagShowSubstitutions(show);
+    if (show)
+        return WEB_UI_STRING("Show Substitutions", "menu item title");
+    return WEB_UI_STRING("Hide Substitutions", "menu item title");
 }
 
 String contextMenuItemTagSmartCopyPaste()
 {
-    return localizationStrategy()->contextMenuItemTagSmartCopyPaste();
+    return WEB_UI_STRING("Smart Copy/Paste", "Smart Copy/Paste context menu item");
 }
 
 String contextMenuItemTagSmartQuotes()
 {
-    return localizationStrategy()->contextMenuItemTagSmartQuotes();
+    return WEB_UI_STRING("Smart Quotes", "Smart Quotes context menu item");
 }
 
 String contextMenuItemTagSmartDashes()
 {
-    return localizationStrategy()->contextMenuItemTagSmartDashes();
+    return WEB_UI_STRING("Smart Dashes", "Smart Dashes context menu item");
 }
 
 String contextMenuItemTagSmartLinks()
 {
-    return localizationStrategy()->contextMenuItemTagSmartLinks();
+    return WEB_UI_STRING("Smart Links", "Smart Links context menu item");
 }
 
 String contextMenuItemTagTextReplacement()
 {
-    return localizationStrategy()->contextMenuItemTagTextReplacement();
+    return WEB_UI_STRING("Text Replacement", "Text Replacement context menu item");
 }
 
 String contextMenuItemTagTransformationsMenu()
 {
-    return localizationStrategy()->contextMenuItemTagTransformationsMenu();
+    return WEB_UI_STRING("Transformations", "Transformations context sub-menu item");
 }
 
 String contextMenuItemTagMakeUpperCase()
 {
-    return localizationStrategy()->contextMenuItemTagMakeUpperCase();
+    return WEB_UI_STRING("Make Upper Case", "Make Upper Case context menu item");
 }
 
 String contextMenuItemTagMakeLowerCase()
 {
-    return localizationStrategy()->contextMenuItemTagMakeLowerCase();
+    return WEB_UI_STRING("Make Lower Case", "Make Lower Case context menu item");
 }
 
 String contextMenuItemTagCapitalize()
 {
-    return localizationStrategy()->contextMenuItemTagCapitalize();
+    return WEB_UI_STRING("Capitalize", "Capitalize context menu item");
 }
 
 String contextMenuItemTagChangeBack(const String& replacedString)
 {
-    return localizationStrategy()->contextMenuItemTagChangeBack(replacedString);
+    notImplemented();
+    return replacedString;
 }
 
 #endif // PLATFORM(MAC)
 
 String contextMenuItemTagOpenVideoInNewWindow()
 {
-    return localizationStrategy()->contextMenuItemTagOpenVideoInNewWindow();
+    return WEB_UI_STRING("Open Video in New Window", "Open Video in New Window context menu item");
 }
 
 String contextMenuItemTagOpenAudioInNewWindow()
 {
-    return localizationStrategy()->contextMenuItemTagOpenAudioInNewWindow();
+    return WEB_UI_STRING("Open Audio in New Window", "Open Audio in New Window context menu item");
 }
 
 String contextMenuItemTagCopyVideoLinkToClipboard()
 {
-    return localizationStrategy()->contextMenuItemTagCopyVideoLinkToClipboard();
+    return WEB_UI_STRING("Copy Video Address", "Copy Video Address Location context menu item");
 }
 
 String contextMenuItemTagCopyAudioLinkToClipboard()
 {
-    return localizationStrategy()->contextMenuItemTagCopyAudioLinkToClipboard();
+    return WEB_UI_STRING("Copy Audio Address", "Copy Audio Address Location context menu item");
 }
 
 String contextMenuItemTagToggleMediaControls()
 {
-    return localizationStrategy()->contextMenuItemTagToggleMediaControls();
+    return WEB_UI_STRING("Controls", "Media Controls context menu item");
 }
 
 String contextMenuItemTagToggleMediaLoop()
 {
-    return localizationStrategy()->contextMenuItemTagToggleMediaLoop();
+    return WEB_UI_STRING("Loop", "Media Loop context menu item");
 }
 
 String contextMenuItemTagEnterVideoFullscreen()
 {
-    return localizationStrategy()->contextMenuItemTagEnterVideoFullscreen();
+    return WEB_UI_STRING("Enter Fullscreen", "Video Enter Fullscreen context menu item");
 }
 
 String contextMenuItemTagMediaPlay()
 {
-    return localizationStrategy()->contextMenuItemTagMediaPlay();
+    return WEB_UI_STRING("Play", "Media Play context menu item");
 }
 
 String contextMenuItemTagMediaPause()
 {
-    return localizationStrategy()->contextMenuItemTagMediaPause();
+    return WEB_UI_STRING("Pause", "Media Pause context menu item");
 }
 
 String contextMenuItemTagMediaMute()
 {
-    return localizationStrategy()->contextMenuItemTagMediaMute();
+    return WEB_UI_STRING("Mute", "Media Mute context menu item");
 }
     
 String contextMenuItemTagInspectElement()
 {
-    return localizationStrategy()->contextMenuItemTagInspectElement();
+    return WEB_UI_STRING("Inspect Element", "Inspect Element context menu item");
 }
 
 #endif // ENABLE(CONTEXT_MENUS)
 
 String searchMenuNoRecentSearchesText()
 {
-    return localizationStrategy()->searchMenuNoRecentSearchesText();
+    return WEB_UI_STRING("No recent searches", "Label for only item in menu that appears when clicking on the search field image, when no searches have been performed");
 }
 
-String searchMenuRecentSearchesText ()
+String searchMenuRecentSearchesText()
 {
-    return localizationStrategy()->searchMenuRecentSearchesText ();
+    return WEB_UI_STRING("Recent Searches", "label for first item in the menu that appears when clicking on the search field image, used as embedded menu title");
 }
 
 String searchMenuClearRecentSearchesText()
 {
-    return localizationStrategy()->searchMenuClearRecentSearchesText();
+    return WEB_UI_STRING("Clear Recent Searches", "menu item in Recent Searches menu that empties menu's contents");
 }
 
 String AXWebAreaText()
 {
-    return localizationStrategy()->AXWebAreaText();
+    return WEB_UI_STRING("HTML content", "accessibility role description for web area");
 }
 
 String AXLinkText()
 {
-    return localizationStrategy()->AXLinkText();
+    return WEB_UI_STRING("link", "accessibility role description for link");
 }
 
 String AXListMarkerText()
 {
-    return localizationStrategy()->AXListMarkerText();
+    return WEB_UI_STRING("list marker", "accessibility role description for list marker");
 }
 
 String AXImageMapText()
 {
-    return localizationStrategy()->AXImageMapText();
+    return WEB_UI_STRING("image map", "accessibility role description for image map");
 }
 
 String AXHeadingText()
 {
-    return localizationStrategy()->AXHeadingText();
+    return WEB_UI_STRING("heading", "accessibility role description for headings");
 }
 
 String AXDefinitionListTermText()
 {
-    return localizationStrategy()->AXDefinitionListTermText();
+    return WEB_UI_STRING("term", "term word of a definition");
 }
 
 String AXDefinitionListDefinitionText()
 {
-    return localizationStrategy()->AXDefinitionListDefinitionText();
+    return WEB_UI_STRING("definition", "definition phrase");
 }
 
 #if PLATFORM(MAC)
 String AXARIAContentGroupText(const String& ariaType)
 {
-    return localizationStrategy()->AXARIAContentGroupText(ariaType);
+    if (ariaType == "ARIAApplicationAlert")
+        return WEB_UI_STRING("alert", "An ARIA accessibility group that acts as an alert.");
+    if (ariaType == "ARIAApplicationAlertDialog")
+        return WEB_UI_STRING("alert dialog", "An ARIA accessibility group that acts as an alert dialog.");
+    if (ariaType == "ARIAApplicationDialog")
+        return WEB_UI_STRING("dialog", "An ARIA accessibility group that acts as an dialog.");
+    if (ariaType == "ARIAApplicationLog")
+        return WEB_UI_STRING("log", "An ARIA accessibility group that acts as a console log.");
+    if (ariaType == "ARIAApplicationMarquee")
+        return WEB_UI_STRING("marquee", "An ARIA accessibility group that acts as a marquee.");
+    if (ariaType == "ARIAApplicationStatus")
+        return WEB_UI_STRING("application status", "An ARIA accessibility group that acts as a status update.");
+    if (ariaType == "ARIAApplicationTimer")
+        return WEB_UI_STRING("timer", "An ARIA accessibility group that acts as an updating timer.");
+    if (ariaType == "ARIADocument")
+        return WEB_UI_STRING("document", "An ARIA accessibility group that acts as a document.");
+    if (ariaType == "ARIADocumentArticle")
+        return WEB_UI_STRING("article", "An ARIA accessibility group that acts as an article.");
+    if (ariaType == "ARIADocumentNote")
+        return WEB_UI_STRING("note", "An ARIA accessibility group that acts as a note in a document.");
+    if (ariaType == "ARIADocumentRegion")
+        return WEB_UI_STRING("region", "An ARIA accessibility group that acts as a distinct region in a document.");
+    if (ariaType == "ARIALandmarkApplication")
+        return WEB_UI_STRING("application", "An ARIA accessibility group that acts as an application.");
+    if (ariaType == "ARIALandmarkBanner")
+        return WEB_UI_STRING("banner", "An ARIA accessibility group that acts as a banner.");
+    if (ariaType == "ARIALandmarkComplementary")
+        return WEB_UI_STRING("complementary", "An ARIA accessibility group that acts as a region of complementary information.");
+    if (ariaType == "ARIALandmarkContentInfo")
+        return WEB_UI_STRING("content", "An ARIA accessibility group that contains content.");
+    if (ariaType == "ARIALandmarkMain")
+        return WEB_UI_STRING("main", "An ARIA accessibility group that is the main portion of the website.");
+    if (ariaType == "ARIALandmarkNavigation")
+        return WEB_UI_STRING("navigation", "An ARIA accessibility group that contains the main navigation elements of a website.");
+    if (ariaType == "ARIALandmarkSearch")
+        return WEB_UI_STRING("search", "An ARIA accessibility group that contains a search feature of a website.");
+    if (ariaType == "ARIAUserInterfaceTooltip")
+        return WEB_UI_STRING("tooltip", "An ARIA accessibility group that acts as a tooltip.");
+    if (ariaType == "ARIATabPanel")
+        return WEB_UI_STRING("tab panel", "An ARIA accessibility group that contains the content of a tab.");
+    if (ariaType == "ARIADocumentMath")
+        return WEB_UI_STRING("math", "An ARIA accessibility group that contains mathematical symbols.");
+    return String();
 }
 #endif
     
 String AXButtonActionVerb()
 {
-    return localizationStrategy()->AXButtonActionVerb();
+    return WEB_UI_STRING("press", "Verb stating the action that will occur when a button is pressed, as used by accessibility");
 }
 
 String AXRadioButtonActionVerb()
 {
-    return localizationStrategy()->AXRadioButtonActionVerb();
+    return WEB_UI_STRING("select", "Verb stating the action that will occur when a radio button is clicked, as used by accessibility");
 }
 
 String AXTextFieldActionVerb()
 {
-    return localizationStrategy()->AXTextFieldActionVerb();
+    return WEB_UI_STRING("activate", "Verb stating the action that will occur when a text field is selected, as used by accessibility");
 }
 
 String AXCheckedCheckBoxActionVerb()
 {
-    return localizationStrategy()->AXCheckedCheckBoxActionVerb();
+    return WEB_UI_STRING("uncheck", "Verb stating the action that will occur when a checked checkbox is clicked, as used by accessibility");
 }
 
 String AXUncheckedCheckBoxActionVerb()
 {
-    return localizationStrategy()->AXUncheckedCheckBoxActionVerb();
+    return WEB_UI_STRING("check", "Verb stating the action that will occur when an unchecked checkbox is clicked, as used by accessibility");
 }
 
 String AXLinkActionVerb()
 {
-    return localizationStrategy()->AXLinkActionVerb();
+    return WEB_UI_STRING("jump", "Verb stating the action that will occur when a link is clicked, as used by accessibility");
 }
 
 String AXMenuListPopupActionVerb()
 {
-    return localizationStrategy()->AXMenuListPopupActionVerb();
+    notImplemented();
+    return "select";
 }
 
 String AXMenuListActionVerb()
 {
-    return localizationStrategy()->AXMenuListActionVerb();
+    notImplemented();
+    return "select";
 }
 
 String missingPluginText()
 {
-    return localizationStrategy()->missingPluginText();
+    return WEB_UI_STRING("Missing Plug-in", "Label text to be used when a plugin is missing");
 }
 
 String crashedPluginText()
 {
-    return localizationStrategy()->crashedPluginText();
+    return WEB_UI_STRING("Plug-in Failure", "Label text to be used if plugin host process has crashed");
 }
 
 String multipleFileUploadText(unsigned numberOfFiles)
 {
-    return localizationStrategy()->multipleFileUploadText(numberOfFiles);
+    return formatLocalizedString(WEB_UI_STRING("%d files", "Label to describe the number of files selected in a file upload control that allows multiple files"), numberOfFiles);
 }
 
 String unknownFileSizeText()
 {
-    return localizationStrategy()->unknownFileSizeText();
+    return WEB_UI_STRING("Unknown", "Unknown filesize FTP directory listing item");
 }
 
 #if PLATFORM(WIN)
 String uploadFileText()
 {
-    return localizationStrategy()->uploadFileText();
+    notImplemented();
+    return "upload";
 }
 
 String allFilesText()
 {
-    return localizationStrategy()->allFilesText();
+    notImplemented();
+    return "all files";
 }
 #endif
 
 #if PLATFORM(MAC)
 String builtInPDFPluginName()
 {
-    return localizationStrategy()->builtInPDFPluginName();
+    // Also exposed to DOM.
+    return WEB_UI_STRING("WebKit built-in PDF", "Pseudo plug-in name, visible in Installed Plug-ins page in Safari.");
 }
 
 String pdfDocumentTypeDescription()
 {
-    return localizationStrategy()->pdfDocumentTypeDescription();
+    // Also exposed to DOM.
+    return WEB_UI_STRING("Portable Document Format", "Description of the (only) type supported by PDF pseudo plug-in. Visible in Installed Plug-ins page in Safari.");
 }
 
 String keygenMenuItem512()
 {
-    return localizationStrategy()->keygenMenuItem512();
+    return WEB_UI_STRING("512 (Low Grade)", "Menu item title for KEYGEN pop-up menu");
 }
 
 String keygenMenuItem1024()
 {
-    return localizationStrategy()->keygenMenuItem1024();
+    return WEB_UI_STRING("1024 (Medium Grade)", "Menu item title for KEYGEN pop-up menu");
 }
 
 String keygenMenuItem2048()
 {
-    return localizationStrategy()->keygenMenuItem2048();
+    return WEB_UI_STRING("2048 (High Grade)", "Menu item title for KEYGEN pop-up menu");
 }
 
 String keygenKeychainItemName(const String& host)
 {
-    return localizationStrategy()->keygenKeychainItemName(host);
+    RetainPtr<CFStringRef> hostCFString(AdoptCF, host.createCFString());
+    return formatLocalizedString(WEB_UI_STRING("Key from %@", "Name of keychain key generated by the KEYGEN tag"), hostCFString.get());
 }
 
 #endif
 
-String imageTitle(const String& filename, const IntSize& size)
+#if PLATFORM(IOS)
+String htmlSelectMultipleItems(size_t count)
 {
-    return localizationStrategy()->imageTitle(filename, size);
+    switch (count) {
+    case 0:
+        return WEB_UI_STRING("0 Items", "Present the element <select multiple> when no <option> items are selected (iOS only)");
+    case 1:
+        return WEB_UI_STRING("1 Item", "Present the element <select multiple> when a single <option> is selected (iOS only)");
+    default:
+        return formatLocalizedString(WEB_UI_STRING("%zu Items", "Present the number of selected <option> items in a <select multiple> element (iOS only)"), count);
+    }
 }
+#endif
 
-String mediaElementLoadingStateText()
+String imageTitle(const String& filename, const IntSize& size)
 {
-    return localizationStrategy()->mediaElementLoadingStateText();
-}
+#if USE(CF)
+#if !defined(BUILDING_ON_LEOPARD)
+    RetainPtr<CFStringRef> filenameCFString(AdoptCF, filename.createCFString());
+    RetainPtr<CFLocaleRef> locale(AdoptCF, CFLocaleCopyCurrent());
+    RetainPtr<CFNumberFormatterRef> formatter(AdoptCF, CFNumberFormatterCreate(0, locale.get(), kCFNumberFormatterDecimalStyle));
 
-String mediaElementLiveBroadcastStateText()
-{
-    return localizationStrategy()->mediaElementLiveBroadcastStateText();
+    int widthInt = size.width();
+    RetainPtr<CFNumberRef> width(AdoptCF, CFNumberCreate(0, kCFNumberIntType, &widthInt));
+    RetainPtr<CFStringRef> widthString(AdoptCF, CFNumberFormatterCreateStringWithNumber(0, formatter.get(), width.get()));
+
+    int heightInt = size.height();
+    RetainPtr<CFNumberRef> height(AdoptCF, CFNumberCreate(0, kCFNumberIntType, &heightInt));
+    RetainPtr<CFStringRef> heightString(AdoptCF, CFNumberFormatterCreateStringWithNumber(0, formatter.get(), height.get()));
+
+    return formatLocalizedString(WEB_UI_STRING("%@ %@×%@ pixels", "window title for a standalone image (uses multiplication symbol, not x)"), filenameCFString.get(), widthString.get(), heightString.get());
+#else
+    RetainPtr<CFStringRef> filenameCFString(AdoptCF, filename.createCFString());
+    return formatLocalizedString(WEB_UI_STRING("%@ %d×%d pixels", "window title for a standalone image (uses multiplication symbol, not x)"), filenameCFString.get(), size.width(), size.height());
+#endif
+#else
+    return formatLocalizedString(WEB_UI_STRING("<filename> %d×%d pixels", "window title for a standalone image (uses multiplication symbol, not x)"), size.width(), size.height()).replace("<filename>", filename);
+#endif
 }
 
-String localizedMediaControlElementString(const String& controlName)
+String mediaElementLoadingStateText()
 {
-    return localizationStrategy()->localizedMediaControlElementString(controlName);
+    return WEB_UI_STRING("Loading...", "Media controller status message when the media is loading");
 }
 
-String localizedMediaControlElementHelpText(const String& controlName)
+String mediaElementLiveBroadcastStateText()
 {
-    return localizationStrategy()->localizedMediaControlElementHelpText(controlName);
+    return WEB_UI_STRING("Live Broadcast", "Media controller status message when watching a live broadcast");
+}
+
+String localizedMediaControlElementString(const String& name)
+{
+    if (name == "AudioElement")
+        return WEB_UI_STRING("audio element controller", "accessibility role description for audio element controller");
+    if (name == "VideoElement")
+        return WEB_UI_STRING("video element controller", "accessibility role description for video element controller");
+    if (name == "MuteButton")
+        return WEB_UI_STRING("mute", "accessibility role description for mute button");
+    if (name == "UnMuteButton")
+        return WEB_UI_STRING("unmute", "accessibility role description for turn mute off button");
+    if (name == "PlayButton")
+        return WEB_UI_STRING("play", "accessibility role description for play button");
+    if (name == "PauseButton")
+        return WEB_UI_STRING("pause", "accessibility role description for pause button");
+    if (name == "Slider")
+        return WEB_UI_STRING("movie time", "accessibility role description for timeline slider");
+    if (name == "SliderThumb")
+        return WEB_UI_STRING("timeline slider thumb", "accessibility role description for timeline thumb");
+    if (name == "RewindButton")
+        return WEB_UI_STRING("back 30 seconds", "accessibility role description for seek back 30 seconds button");
+    if (name == "ReturnToRealtimeButton")
+        return WEB_UI_STRING("return to realtime", "accessibility role description for return to real time button");
+    if (name == "CurrentTimeDisplay")
+        return WEB_UI_STRING("elapsed time", "accessibility role description for elapsed time display");
+    if (name == "TimeRemainingDisplay")
+        return WEB_UI_STRING("remaining time", "accessibility role description for time remaining display");
+    if (name == "StatusDisplay")
+        return WEB_UI_STRING("status", "accessibility role description for movie status");
+    if (name == "FullscreenButton")
+        return WEB_UI_STRING("fullscreen", "accessibility role description for enter fullscreen button");
+    if (name == "SeekForwardButton")
+        return WEB_UI_STRING("fast forward", "accessibility role description for fast forward button");
+    if (name == "SeekBackButton")
+        return WEB_UI_STRING("fast reverse", "accessibility role description for fast reverse button");
+    if (name == "ShowClosedCaptionsButton")
+        return WEB_UI_STRING("show closed captions", "accessibility role description for show closed captions button");
+    if (name == "HideClosedCaptionsButton")
+        return WEB_UI_STRING("hide closed captions", "accessibility role description for hide closed captions button");
+
+    // FIXME: the ControlsPanel container should never be visible in the accessibility hierarchy.
+    if (name == "ControlsPanel")
+        return String();
+
+    ASSERT_NOT_REACHED();
+    return String();
+}
+
+String localizedMediaControlElementHelpText(const String& name)
+{
+    if (name == "AudioElement")
+        return WEB_UI_STRING("audio element playback controls and status display", "accessibility role description for audio element controller");
+    if (name == "VideoElement")
+        return WEB_UI_STRING("video element playback controls and status display", "accessibility role description for video element controller");
+    if (name == "MuteButton")
+        return WEB_UI_STRING("mute audio tracks", "accessibility help text for mute button");
+    if (name == "UnMuteButton")
+        return WEB_UI_STRING("unmute audio tracks", "accessibility help text for un mute button");
+    if (name == "PlayButton")
+        return WEB_UI_STRING("begin playback", "accessibility help text for play button");
+    if (name == "PauseButton")
+        return WEB_UI_STRING("pause playback", "accessibility help text for pause button");
+    if (name == "Slider")
+        return WEB_UI_STRING("movie time scrubber", "accessibility help text for timeline slider");
+    if (name == "SliderThumb")
+        return WEB_UI_STRING("movie time scrubber thumb", "accessibility help text for timeline slider thumb");
+    if (name == "RewindButton")
+        return WEB_UI_STRING("seek movie back 30 seconds", "accessibility help text for jump back 30 seconds button");
+    if (name == "ReturnToRealtimeButton")
+        return WEB_UI_STRING("return streaming movie to real time", "accessibility help text for return streaming movie to real time button");
+    if (name == "CurrentTimeDisplay")
+        return WEB_UI_STRING("current movie time in seconds", "accessibility help text for elapsed time display");
+    if (name == "TimeRemainingDisplay")
+        return WEB_UI_STRING("number of seconds of movie remaining", "accessibility help text for remaining time display");
+    if (name == "StatusDisplay")
+        return WEB_UI_STRING("current movie status", "accessibility help text for movie status display");
+    if (name == "SeekBackButton")
+        return WEB_UI_STRING("seek quickly back", "accessibility help text for fast rewind button");
+    if (name == "SeekForwardButton")
+        return WEB_UI_STRING("seek quickly forward", "accessibility help text for fast forward button");
+    if (name == "FullscreenButton")
+        return WEB_UI_STRING("Play movie in fullscreen mode", "accessibility help text for enter fullscreen button");
+    if (name == "ShowClosedCaptionsButton")
+        return WEB_UI_STRING("start displaying closed captions", "accessibility help text for show closed captions button");
+    if (name == "HideClosedCaptionsButton")
+        return WEB_UI_STRING("stop displaying closed captions", "accessibility help text for hide closed captions button");
+
+    ASSERT_NOT_REACHED();
+    return String();
 }
 
 String localizedMediaTimeDescription(float time)
 {
-    return localizationStrategy()->localizedMediaTimeDescription(time);
+    if (!isfinite(time))
+        return WEB_UI_STRING("indefinite time", "accessibility help text for an indefinite media controller time value");
+
+    int seconds = static_cast<int>(fabsf(time));
+    int days = seconds / (60 * 60 * 24);
+    int hours = seconds / (60 * 60);
+    int minutes = (seconds / 60) % 60;
+    seconds %= 60;
+
+    if (days)
+        return formatLocalizedString(WEB_UI_STRING("%1$d days %2$d hours %3$d minutes %4$d seconds", "accessibility help text for media controller time value >= 1 day"), days, hours, minutes, seconds);
+    if (hours)
+        return formatLocalizedString(WEB_UI_STRING("%1$d hours %2$d minutes %3$d seconds", "accessibility help text for media controller time value >= 60 minutes"), hours, minutes, seconds);
+    if (minutes)
+        return formatLocalizedString(WEB_UI_STRING("%1$d minutes %2$d seconds", "accessibility help text for media controller time value >= 60 seconds"), minutes, seconds);
+    return formatLocalizedString(WEB_UI_STRING("%1$d seconds", "accessibility help text for media controller time value < 60 seconds"), seconds);
 }
 
 String validationMessageValueMissingText()
 {
-    return localizationStrategy()->validationMessageValueMissingText();
+    return WEB_UI_STRING("value missing", "Validation message for required form control elements that have no value");
 }
 
 String validationMessageValueMissingForCheckboxText()
 {
-    return localizationStrategy()->validationMessageValueMissingText();
+    return validationMessageValueMissingText();
 }
 
 String validationMessageValueMissingForFileText()
 {
-    return localizationStrategy()->validationMessageValueMissingText();
+    return validationMessageValueMissingText();
 }
 
 String validationMessageValueMissingForMultipleFileText()
 {
-    return localizationStrategy()->validationMessageValueMissingText();
+    return validationMessageValueMissingText();
 }
 
 String validationMessageValueMissingForRadioText()
 {
-    return localizationStrategy()->validationMessageValueMissingText();
+    return validationMessageValueMissingText();
 }
 
 String validationMessageValueMissingForSelectText()
 {
-    return localizationStrategy()->validationMessageValueMissingText();
+    return validationMessageValueMissingText();
 }
 
 String validationMessageTypeMismatchText()
 {
-    return localizationStrategy()->validationMessageTypeMismatchText();
+    return WEB_UI_STRING("type mismatch", "Validation message for input form controls with a value not matching type");
 }
 
 String validationMessageTypeMismatchForEmailText()
 {
-    return localizationStrategy()->validationMessageTypeMismatchText();
+    return validationMessageTypeMismatchText();
 }
 
 String validationMessageTypeMismatchForMultipleEmailText()
 {
-    return localizationStrategy()->validationMessageTypeMismatchText();
+    return validationMessageTypeMismatchText();
 }
 
 String validationMessageTypeMismatchForURLText()
 {
-    return localizationStrategy()->validationMessageTypeMismatchText();
+    return validationMessageTypeMismatchText();
 }
 
 String validationMessagePatternMismatchText()
 {
-    return localizationStrategy()->validationMessagePatternMismatchText();
+    return WEB_UI_STRING("pattern mismatch", "Validation message for input form controls requiring a constrained value according to pattern");
 }
 
 String validationMessageTooLongText(int, int)
 {
-    return localizationStrategy()->validationMessageTooLongText();
+    return WEB_UI_STRING("too long", "Validation message for form control elements with a value longer than maximum allowed length");
 }
 
 String validationMessageRangeUnderflowText(const String&)
 {
-    return localizationStrategy()->validationMessageRangeUnderflowText();
+    return WEB_UI_STRING("range underflow", "Validation message for input form controls with value lower than allowed minimum");
 }
 
 String validationMessageRangeOverflowText(const String&)
 {
-    return localizationStrategy()->validationMessageRangeOverflowText();
+    return WEB_UI_STRING("range overflow", "Validation message for input form controls with value higher than allowed maximum");
 }
 
 String validationMessageStepMismatchText(const String&, const String&)
 {
-    return localizationStrategy()->validationMessageStepMismatchText();
-}
-
-#endif // USE(PLATFORM_STRATEGIES)
-
-#if !PLATFORM(MAC) && !PLATFORM(WIN)
-String localizedString(const char* key)
-{
-    return String::fromUTF8(key, strlen(key));
+    return WEB_UI_STRING("step mismatch", "Validation message for input form controls with value not respecting the step attribute");
 }
-#endif
 
 } // namespace WebCore
diff --git a/Source/WebCore/platform/LocalizedStrings.h b/Source/WebCore/platform/LocalizedStrings.h
index a73c991fe..3ebbef722 100644
--- a/Source/WebCore/platform/LocalizedStrings.h
+++ b/Source/WebCore/platform/LocalizedStrings.h
@@ -174,6 +174,10 @@ namespace WebCore {
     String keygenKeychainItemName(const String& host);
 #endif
 
+#if PLATFORM(IOS)
+    String htmlSelectMultipleItems(size_t num);
+#endif
+
     String imageTitle(const String& filename, const IntSize& size);
 
     String mediaElementLoadingStateText();
@@ -198,11 +202,12 @@ namespace WebCore {
     String validationMessageRangeOverflowText(const String& maximum);
     String validationMessageStepMismatchText(const String& base, const String& step);
 
-
+#if !PLATFORM(CHROMIUM)
 #define WEB_UI_STRING(string, description) WebCore::localizedString(string)
 #define WEB_UI_STRING_KEY(string, key, description) WebCore::localizedString(key)
 
     String localizedString(const char* key);
+#endif
 
 } // namespace WebCore
 
diff --git a/Source/WebCore/platform/Pasteboard.h b/Source/WebCore/platform/Pasteboard.h
index 8e5f91bb8..17dadd072 100644
--- a/Source/WebCore/platform/Pasteboard.h
+++ b/Source/WebCore/platform/Pasteboard.h
@@ -29,14 +29,14 @@
 #include <wtf/Forward.h>
 #include <wtf/HashSet.h>
 #include <wtf/Noncopyable.h>
-
+#include <wtf/text/WTFString.h>
 #if PLATFORM(MAC)
 #include <wtf/RetainPtr.h>
 #endif
-
 #if PLATFORM(GTK)
 #include <PasteboardHelper.h>
 #endif
+#include <wtf/Vector.h>
 
 // FIXME: This class is too high-level to be in the platform directory, since it
 // uses the DOM and makes calls to Editor. It should either be divested of its
@@ -60,11 +60,11 @@ typedef struct HWND__* HWND;
 namespace WebCore {
 
 #if PLATFORM(MAC)
-extern NSString *WebArchivePboardType;
-extern NSString *WebSmartPastePboardType;
-extern NSString *WebURLNamePboardType;
-extern NSString *WebURLPboardType;
-extern NSString *WebURLsWithTitlesPboardType;
+extern const char* WebArchivePboardType;
+extern const char* WebSmartPastePboardType;
+extern const char* WebURLNamePboardType;
+extern const char* WebURLPboardType;
+extern const char* WebURLsWithTitlesPboardType;
 #endif
 
 class Clipboard;
@@ -81,7 +81,7 @@ class Pasteboard {
 public:
 #if PLATFORM(MAC)
     // This is required to support OS X services.
-    void writeSelectionForTypes(NSArray* pasteboardTypes, Range* selectedRange, bool canSmartCopyOrDelete, Frame*);
+    void writeSelectionForTypes(const Vector<String>& pasteboardTypes, Range* selectedRange, bool canSmartCopyOrDelete, Frame*);
     Pasteboard(const String& pasteboardName);
 #endif
     
@@ -109,7 +109,7 @@ private:
     Pasteboard();
 
 #if PLATFORM(MAC)
-    RetainPtr<NSPasteboard> m_pasteboard;
+    String m_pasteboardName;
 #endif
 
 #if PLATFORM(WIN)
diff --git a/Source/WebCore/platform/PasteboardStrategy.h b/Source/WebCore/platform/PasteboardStrategy.h
new file mode 100644
index 000000000..515f55d49
--- /dev/null
+++ b/Source/WebCore/platform/PasteboardStrategy.h
@@ -0,0 +1,66 @@
+/*
+ * Copyright (C) 2012 Apple Inc.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef PasteboardStrategy_h
+#define PasteboardStrategy_h
+
+#if USE(PLATFORM_STRATEGIES)
+
+#include "SharedBuffer.h"
+#include <wtf/Forward.h>
+#include <wtf/RefCounted.h>
+#include <wtf/Vector.h>
+
+namespace WebCore {
+
+class Color;
+    
+class PasteboardStrategy {
+public:
+#if PLATFORM(MAC)
+    virtual void getTypes(Vector<String>& types, const String& pasteboardName) = 0;
+    virtual PassRefPtr<SharedBuffer> bufferForType(const String& pasteboardType, const String& pasteboardName) = 0;
+    virtual void getPathnamesForType(Vector<String>& pathnames, const String& pasteboardType, const String& pasteboardName) = 0;
+    virtual String stringForType(const String& pasteboardType, const String& pasteboardName) = 0;
+    virtual int changeCount(const String& pasteboardName) = 0;
+    virtual String uniqueName() = 0;
+    virtual Color color(const String& pasteboardName) = 0;
+    
+    virtual void copy(const String& fromPasteboard, const String& toPasteboard) = 0;
+    virtual void setTypes(const Vector<String>& pasteboardTypes, const String& pasteboardName) = 0;
+    virtual void setBufferForType(PassRefPtr<SharedBuffer>, const String& pasteboardType, const String& pasteboardName) = 0;
+    virtual void setPathnamesForType(const Vector<String>&, const String& pasteboardType, const String& pasteboardName) = 0;
+    virtual void setStringForType(const String&, const String& pasteboardType, const String& pasteboardName) = 0;
+#endif
+protected:
+    virtual ~PasteboardStrategy()
+    {
+    }
+};
+
+}
+#endif // USE(PLATFORM_STRATEGIES)
+
+#endif // !PasteboardStrategy_h
diff --git a/Source/WebCore/platform/PlatformMouseEvent.h b/Source/WebCore/platform/PlatformMouseEvent.h
index a3dcce490..20aecf107 100644
--- a/Source/WebCore/platform/PlatformMouseEvent.h
+++ b/Source/WebCore/platform/PlatformMouseEvent.h
@@ -40,13 +40,6 @@ typedef struct _Evas_Event_Mouse_Up Evas_Event_Mouse_Up;
 typedef struct _Evas_Event_Mouse_Move Evas_Event_Mouse_Move;
 #endif
 
-#if PLATFORM(QT)
-QT_BEGIN_NAMESPACE
-class QInputEvent;
-class QGraphicsSceneMouseEvent;
-QT_END_NAMESPACE
-#endif
-
 #if PLATFORM(WIN)
 typedef struct HWND__* HWND;
 typedef unsigned UINT;
@@ -122,11 +115,6 @@ namespace WebCore {
         int eventNumber() const { return m_eventNumber; }
 #endif
 
-#if PLATFORM(QT)
-        PlatformMouseEvent(QInputEvent*, int clickCount);
-        PlatformMouseEvent(QGraphicsSceneMouseEvent*, int clickCount);
-#endif
-
 #if PLATFORM(WIN)
         PlatformMouseEvent(HWND, UINT, WPARAM, LPARAM, bool didActivateWebView = false);
         void setClickCount(int count) { m_clickCount = count; }
diff --git a/Source/WebCore/platform/PlatformPasteboard.h b/Source/WebCore/platform/PlatformPasteboard.h
new file mode 100644
index 000000000..2f94a667a
--- /dev/null
+++ b/Source/WebCore/platform/PlatformPasteboard.h
@@ -0,0 +1,68 @@
+/*
+ * Copyright (C) 2012 Apple Inc.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef PlatformPasteboard_h
+#define PlatformPasteboard_h
+
+#include "SharedBuffer.h"
+#include <wtf/Forward.h>
+#include <wtf/RefCounted.h>
+#include <wtf/Vector.h>
+
+#if PLATFORM(MAC)
+OBJC_CLASS NSPasteboard;
+#endif
+
+namespace WebCore {
+
+class Color;
+
+class PlatformPasteboard {
+public:
+    PlatformPasteboard(const String& pasteboardName);
+    static String uniqueName();
+    
+    void getTypes(Vector<String>& types);
+    PassRefPtr<SharedBuffer> bufferForType(const String& pasteboardType);
+    void getPathnamesForType(Vector<String>& pathnames, const String& pasteboardType);
+    String stringForType(const String& pasteboardType);
+    int changeCount() const;
+    Color color();
+    
+    void copy(const String& fromPasteboard);
+    void setTypes(const Vector<String>& pasteboardTypes);
+    void setBufferForType(PassRefPtr<SharedBuffer>, const String& pasteboardType);
+    void setPathnamesForType(const Vector<String>& pathnames, const String& pasteboardType);
+    void setStringForType(const String&, const String& pasteboardType);
+
+private:
+#if PLATFORM(MAC)
+    RetainPtr<NSPasteboard> m_pasteboard;
+#endif
+};
+
+}
+
+#endif // !PlatformPasteboard_h
diff --git a/Source/WebCore/platform/PlatformStrategies.cpp b/Source/WebCore/platform/PlatformStrategies.cpp
index dc9fc35a7..643f37505 100644
--- a/Source/WebCore/platform/PlatformStrategies.cpp
+++ b/Source/WebCore/platform/PlatformStrategies.cpp
@@ -29,8 +29,6 @@
 
 #include "PlatformStrategies.h"
 
-#include "DefaultLocalizationStrategy.h"
-
 namespace WebCore {
 
 static PlatformStrategies* s_platformStrategies;
@@ -59,11 +57,6 @@ bool hasPlatformStrategies()
     return s_platformStrategies;
 }
 
-LocalizationStrategy* PlatformStrategies::createLocalizationStrategy()
-{
-    return new DefaultLocalizationStrategy;
-}
-
 } // namespace WebCore
 
 #endif // USE(PLATFORM_STRATEGIES)
diff --git a/Source/WebCore/platform/PlatformStrategies.h b/Source/WebCore/platform/PlatformStrategies.h
index 7482d6005..c85ee5903 100644
--- a/Source/WebCore/platform/PlatformStrategies.h
+++ b/Source/WebCore/platform/PlatformStrategies.h
@@ -31,8 +31,8 @@
 namespace WebCore {
 
 class CookiesStrategy;
+class PasteboardStrategy;
 class PluginStrategy;
-class LocalizationStrategy;
 class VisitedLinkStrategy;
 
 class PlatformStrategies {
@@ -51,26 +51,25 @@ public:
         return m_pluginStrategy;
     }
 
-    LocalizationStrategy* localizationStrategy()
-    {
-        if (!m_localizationStrategy)
-            m_localizationStrategy = createLocalizationStrategy();
-        return m_localizationStrategy;
-    }
-
     VisitedLinkStrategy* visitedLinkStrategy()
     {
         if (!m_visitedLinkStrategy)
             m_visitedLinkStrategy = createVisitedLinkStrategy();
         return m_visitedLinkStrategy;
     }
+    PasteboardStrategy* pasteboardStrategy()
+    {
+        if (!m_pasteboardStrategy)
+            m_pasteboardStrategy = createPasteboardStrategy();
+        return m_pasteboardStrategy;
+    }
 
 protected:
     PlatformStrategies()
         : m_cookiesStrategy(0)
         , m_pluginStrategy(0)
-        , m_localizationStrategy(0)
         , m_visitedLinkStrategy(0)
+        , m_pasteboardStrategy(0)
     {
     }
 
@@ -81,13 +80,13 @@ protected:
 private:
     virtual CookiesStrategy* createCookiesStrategy() = 0;
     virtual PluginStrategy* createPluginStrategy() = 0;
-    virtual LocalizationStrategy* createLocalizationStrategy();
     virtual VisitedLinkStrategy* createVisitedLinkStrategy() = 0;
+    virtual PasteboardStrategy* createPasteboardStrategy() = 0; 
 
     CookiesStrategy* m_cookiesStrategy;
     PluginStrategy* m_pluginStrategy;
-    LocalizationStrategy* m_localizationStrategy;
     VisitedLinkStrategy* m_visitedLinkStrategy;
+    PasteboardStrategy* m_pasteboardStrategy;
 };
 
 PlatformStrategies* platformStrategies();
diff --git a/Source/WebCore/platform/PlatformTouchPoint.h b/Source/WebCore/platform/PlatformTouchPoint.h
index b18192d90..6e1594f30 100644
--- a/Source/WebCore/platform/PlatformTouchPoint.h
+++ b/Source/WebCore/platform/PlatformTouchPoint.h
@@ -48,7 +48,7 @@ public:
     PlatformTouchPoint() { };
 
 #if PLATFORM(QT)
-    PlatformTouchPoint(const QTouchEvent::TouchPoint&);
+    PlatformTouchPoint(const QTouchEvent::TouchPoint&, State);
 #elif PLATFORM(EFL)
     PlatformTouchPoint(unsigned id, const IntPoint& windowPos, State);
 #endif
diff --git a/Source/WebCore/platform/PlatformWheelEvent.h b/Source/WebCore/platform/PlatformWheelEvent.h
index f76f4c958..64e0f2463 100644
--- a/Source/WebCore/platform/PlatformWheelEvent.h
+++ b/Source/WebCore/platform/PlatformWheelEvent.h
@@ -37,13 +37,6 @@ typedef struct _GdkEventScroll GdkEventScroll;
 typedef struct _Evas_Event_Mouse_Wheel Evas_Event_Mouse_Wheel;
 #endif
 
-#if PLATFORM(QT)
-QT_BEGIN_NAMESPACE
-class QWheelEvent;
-class QGraphicsSceneWheelEvent;
-QT_END_NAMESPACE
-#endif
-
 #if PLATFORM(WIN)
 typedef struct HWND__* HWND;
 typedef unsigned WPARAM;
@@ -161,12 +154,6 @@ namespace WebCore {
         bool hasPreciseScrollingDeltas() const { return m_hasPreciseScrollingDeltas; }
 #endif
 
-#if PLATFORM(QT)
-        PlatformWheelEvent(QWheelEvent*);
-        PlatformWheelEvent(QGraphicsSceneWheelEvent*);
-        void applyDelta(int delta, Qt::Orientation);
-#endif
-
 #if PLATFORM(WIN)
         PlatformWheelEvent(HWND, WPARAM, LPARAM, bool isMouseHWheel);
         PlatformWheelEvent(HWND, const FloatSize& delta, const FloatPoint& location);
diff --git a/Source/WebCore/platform/ScrollAnimator.cpp b/Source/WebCore/platform/ScrollAnimator.cpp
index f73c5cc06..d4ded3483 100644
--- a/Source/WebCore/platform/ScrollAnimator.cpp
+++ b/Source/WebCore/platform/ScrollAnimator.cpp
@@ -52,9 +52,6 @@ ScrollAnimator::ScrollAnimator(ScrollableArea* scrollableArea)
     : m_scrollableArea(scrollableArea)
     , m_currentPosX(0)
     , m_currentPosY(0)
-    , m_currentZoomScale(1)
-    , m_currentZoomTransX(0)
-    , m_currentZoomTransY(0)
 {
 }
 
@@ -125,12 +122,6 @@ bool ScrollAnimator::handleWheelEvent(const PlatformWheelEvent& e)
     return handled;
 }
 
-#if ENABLE(GESTURE_EVENTS)
-void ScrollAnimator::handleGestureEvent(const PlatformGestureEvent&)
-{
-}
-#endif
-
 FloatPoint ScrollAnimator::currentPosition() const
 {
     return FloatPoint(m_currentPosX, m_currentPosY);
@@ -141,31 +132,4 @@ void ScrollAnimator::notifyPositionChanged()
     m_scrollableArea->setScrollOffsetFromAnimation(IntPoint(m_currentPosX, m_currentPosY));
 }
 
-void ScrollAnimator::notifyZoomChanged(ZoomAnimationState state)
-{
-    m_scrollableArea->zoomAnimatorTransformChanged(m_currentZoomScale, m_currentZoomTransX, m_currentZoomTransY,
-                                                   state == ZoomAnimationContinuing ? ScrollableArea::ZoomAnimationContinuing
-                                                                                    : ScrollableArea::ZoomAnimationFinishing);
-}
-
-FloatPoint ScrollAnimator::zoomTranslation() const
-{
-    return FloatPoint(m_currentZoomTransX, m_currentZoomTransY);
-}
-
-void ScrollAnimator::resetZoom()
-{
-    m_currentZoomScale = 1;
-    m_currentZoomTransX = 0;
-    m_currentZoomTransY = 0;
-}
-
-void ScrollAnimator::setZoomParametersForTest(float scale, float x, float y)
-{
-    m_currentZoomScale = scale;
-    m_currentZoomTransX = (1 - scale) * x;
-    m_currentZoomTransY = (1 - scale) * y;
-    notifyZoomChanged(ZoomAnimationContinuing); // Don't let page re-scale.
-}
-
 } // namespace WebCore
diff --git a/Source/WebCore/platform/ScrollAnimator.h b/Source/WebCore/platform/ScrollAnimator.h
index b33c45812..814d674e3 100644
--- a/Source/WebCore/platform/ScrollAnimator.h
+++ b/Source/WebCore/platform/ScrollAnimator.h
@@ -47,8 +47,6 @@ class PlatformGestureEvent;
 
 class ScrollAnimator {
 public:
-    enum ZoomAnimationState { ZoomAnimationContinuing, ZoomAnimationFinishing };
-
     static PassOwnPtr<ScrollAnimator> create(ScrollableArea*);
 
     virtual ~ScrollAnimator();
@@ -66,9 +64,6 @@ public:
     virtual void setIsActive() { }
 
     virtual bool handleWheelEvent(const PlatformWheelEvent&);
-#if ENABLE(GESTURE_EVENTS)
-    virtual void handleGestureEvent(const PlatformGestureEvent&);
-#endif
 
     FloatPoint currentPosition() const;
 
@@ -91,26 +86,18 @@ public:
     virtual void didAddHorizontalScrollbar(Scrollbar*) { }
     virtual void willRemoveHorizontalScrollbar(Scrollbar*) { }
 
-    float zoomScale() const { return m_currentZoomScale; }
-    FloatPoint zoomTranslation() const;
-    virtual void resetZoom();
-    virtual void setZoomParametersForTest(float, float, float);
-
     virtual bool shouldScrollbarParticipateInHitTesting(Scrollbar*) { return true; }
 
+    virtual void notifyContentAreaScrolled() { }
+
 protected:
     ScrollAnimator(ScrollableArea*);
 
     virtual void notifyPositionChanged();
-    virtual void notifyZoomChanged(ZoomAnimationState);
 
     ScrollableArea* m_scrollableArea;
     float m_currentPosX; // We avoid using a FloatPoint in order to reduce
     float m_currentPosY; // subclass code complexity.
-
-    float m_currentZoomScale;
-    float m_currentZoomTransX;
-    float m_currentZoomTransY;
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/platform/ScrollAnimatorNone.cpp b/Source/WebCore/platform/ScrollAnimatorNone.cpp
index 3d1472b38..083a18a70 100644
--- a/Source/WebCore/platform/ScrollAnimatorNone.cpp
+++ b/Source/WebCore/platform/ScrollAnimatorNone.cpp
@@ -371,36 +371,10 @@ void ScrollAnimatorNone::PerAxisData::updateVisibleLength(int visibleLength)
     m_visibleLength = visibleLength;
 }
 
-ScrollAnimatorNone::ZoomData::ZoomData(WebCore::ScrollAnimatorNone* parent)
-    : m_parent(parent)
-    , m_isAnimating(false)
-{
-}
-
-bool ScrollAnimatorNone::ZoomData::animateZoom(double currentTime)
-{
-    m_lastAnimationTime = currentTime;
-    double deltaTime = currentTime - m_startTime;
-
-    if (deltaTime > m_animationTime) {
-        m_parent->m_currentZoomScale = m_desiredScale;
-        m_parent->m_currentZoomTransX = m_desiredTransX;
-        m_parent->m_currentZoomTransY = m_desiredTransY;
-        return false;
-    }
-
-    double elapsedTimeFraction = deltaTime / m_animationTime;
-    m_parent->m_currentZoomScale = elapsedTimeFraction * (m_desiredScale - m_startScale) + m_startScale;
-    m_parent->m_currentZoomTransX = elapsedTimeFraction * m_desiredTransX;
-    m_parent->m_currentZoomTransY = elapsedTimeFraction * m_desiredTransY;
-    return true;
-}
-
 ScrollAnimatorNone::ScrollAnimatorNone(ScrollableArea* scrollableArea)
     : ScrollAnimator(scrollableArea)
     , m_horizontalData(this, &m_currentPosX, scrollableArea->visibleWidth())
     , m_verticalData(this, &m_currentPosY, scrollableArea->visibleHeight())
-    , m_zoomData(this)
     , m_animationTimer(this, &ScrollAnimatorNone::animationTimerFired)
 {
 }
@@ -470,63 +444,6 @@ void ScrollAnimatorNone::scrollToOffsetWithoutAnimation(const FloatPoint& offset
     notifyPositionChanged();
 }
 
-#if ENABLE(GESTURE_EVENTS)
-void ScrollAnimatorNone::zoom(const PlatformGestureEvent& pge)
-{
-    ASSERT(pge.type() == PlatformEvent::GestureDoubleTap);
-    // FIXME: modify this so we can start even if the timer is active.
-    if (!m_animationTimer.isActive()) {
-        m_currentZoomScale = 1;
-        m_currentZoomTransX = 0;
-        m_currentZoomTransY = 0;
-
-        double currentTime = WTF::monotonicallyIncreasingTime();
-        float scale = pge.deltaX();
-
-        m_zoomData.m_startTime = currentTime - kTickTime / 2;
-        m_zoomData.m_startScale = m_currentZoomScale;
-        m_zoomData.m_desiredScale = scale;
-        // FIXME: Document then simplify the following equations.
-        m_zoomData.m_desiredTransX = (1 - scale) * pge.globalPosition().x();
-        m_zoomData.m_desiredTransY = (1 - scale) * pge.globalPosition().y();
-#if ENABLE(DOUBLE_TAP_CENTERS)
-        if (pge.type() == PlatformEvent::GestureDoubleTap) {
-            // Zoom to centre of display. Pinch-to-zoom may not want this behaviour.
-            m_zoomData.m_desiredTransX += m_scrollableArea->visibleWidth() / 2 - pge.globalPosition().x();
-            m_zoomData.m_desiredTransY += m_scrollableArea->visibleHeight() / 2 - pge.globalPosition().y();
-        }
-#endif
-        m_zoomData.m_lastAnimationTime = currentTime;
-        m_zoomData.m_animationTime = kZoomTicks * kTickTime;
-
-        bool isContinuing = m_zoomData.animateZoom(currentTime);
-
-        double deltaToNextFrame = ceil((currentTime - m_startTime) * kFrameRate) / kFrameRate - (currentTime - m_startTime);
-        double nextTimerInterval = max(kMinimumTimerInterval, deltaToNextFrame);
-        if (isContinuing) {
-            m_animationTimer.startOneShot(nextTimerInterval);
-            m_zoomData.m_isAnimating = true;
-            notifyZoomChanged(ZoomAnimationContinuing);
-        } else
-            notifyZoomChanged(ZoomAnimationFinishing);
-    }
-}
-
-void ScrollAnimatorNone::handleGestureEvent(const PlatformGestureEvent& pge)
-{
-    TRACE_EVENT("ScrollAnimatorNone::handleGestureEvent", this, 0);
-    switch (pge.type()) {
-    case PlatformEvent::GestureDoubleTap:
-        zoom(pge);
-        break;
-
-    default:
-        // TODO: add any other event types we should handle
-        { }
-    }
-}
-#endif
-
 void ScrollAnimatorNone::willEndLiveResize()
 {
     updateVisibleLengths();
@@ -563,19 +480,6 @@ void ScrollAnimatorNone::animationTimerFired(Timer<ScrollAnimatorNone>* timer)
     if (m_verticalData.m_startTime && m_verticalData.animateScroll(currentTime + deltaToNextFrame))
         continueAnimation = true;
 
-    if (m_zoomData.m_isAnimating) {
-#if PLATFORM(CHROMIUM)
-        TRACE_EVENT("ScrollAnimatorNone::notifyZoomChanged", this, 0);
-#endif
-        if (m_zoomData.m_startTime && m_zoomData.animateZoom(currentTime + deltaToNextFrame)) {
-            continueAnimation = true;
-            notifyZoomChanged(ZoomAnimationContinuing);
-        } else {
-            notifyZoomChanged(ZoomAnimationFinishing);
-            m_zoomData.m_isAnimating = false;
-        }
-    }
-
     if (continueAnimation) {
         double nextTimerInterval = max(kMinimumTimerInterval, deltaToNextFrame);
         timer->startOneShot(nextTimerInterval);
diff --git a/Source/WebCore/platform/ScrollAnimatorNone.h b/Source/WebCore/platform/ScrollAnimatorNone.h
index f94d5239b..4d69a7c4a 100644
--- a/Source/WebCore/platform/ScrollAnimatorNone.h
+++ b/Source/WebCore/platform/ScrollAnimatorNone.h
@@ -50,11 +50,6 @@ public:
     virtual bool scroll(ScrollbarOrientation, ScrollGranularity, float step, float multiplier);
     virtual void scrollToOffsetWithoutAnimation(const FloatPoint&);
 
-#if ENABLE(GESTURE_EVENTS)
-    virtual void zoom(const PlatformGestureEvent&);
-    virtual void handleGestureEvent(const PlatformGestureEvent&);
-#endif
-
     virtual void willEndLiveResize();
     virtual void didAddVerticalScrollbar(Scrollbar*);
     virtual void didAddHorizontalScrollbar(Scrollbar*);
@@ -131,35 +126,12 @@ protected:
         int m_visibleLength;
     };
 
-    // While zooming, scale, posX and posY need to stay tightly coupled, so use a separate
-    // data structure.
-    struct ZoomData {
-        ZoomData(ScrollAnimatorNone* parent);
-        bool animateZoom(double currentTime);
-
-        ScrollAnimatorNone* m_parent;
-        bool m_isAnimating;
-
-        double m_startTime;
-
-        double m_animationTime;
-        double m_lastAnimationTime;
-
-        double m_startScale;
-        double m_desiredScale;
-        double m_desiredTransX;
-        double m_desiredTransY;
-    };
-
-    friend struct ZoomData;
-
     void animationTimerFired(Timer<ScrollAnimatorNone>*);
     void stopAnimationTimerIfNeeded();
     void updateVisibleLengths();
 
     PerAxisData m_horizontalData;
     PerAxisData m_verticalData;
-    ZoomData m_zoomData;
 
     double m_startTime;
     Timer<ScrollAnimatorNone> m_animationTimer;
diff --git a/Source/WebCore/platform/ScrollView.cpp b/Source/WebCore/platform/ScrollView.cpp
index f2bb054a3..4d14805ef 100644
--- a/Source/WebCore/platform/ScrollView.cpp
+++ b/Source/WebCore/platform/ScrollView.cpp
@@ -302,6 +302,7 @@ void ScrollView::setContentsSize(const IntSize& newSize)
         platformSetContentsSize();
     else
         updateScrollbars(scrollOffset());
+    updateOverhangAreas();
 }
 
 IntPoint ScrollView::maximumScrollPosition() const
@@ -500,7 +501,7 @@ void ScrollView::updateScrollbars(const IntSize& desiredOffset)
 
         if (hasHorizontalScrollbar != newHasHorizontalScrollbar && (hasHorizontalScrollbar || !avoidScrollbarCreation())) {
             if (scrollOrigin().y() && !newHasHorizontalScrollbar)
-                setScrollOriginY(scrollOrigin().y() - m_horizontalScrollbar->height());
+                ScrollableArea::setScrollOrigin(IntPoint(scrollOrigin().x(), scrollOrigin().y() - m_horizontalScrollbar->height()));
             if (m_horizontalScrollbar)
                 m_horizontalScrollbar->invalidate();
             setHasHorizontalScrollbar(newHasHorizontalScrollbar);
@@ -509,7 +510,7 @@ void ScrollView::updateScrollbars(const IntSize& desiredOffset)
 
         if (hasVerticalScrollbar != newHasVerticalScrollbar && (hasVerticalScrollbar || !avoidScrollbarCreation())) {
             if (scrollOrigin().x() && !newHasVerticalScrollbar)
-                setScrollOriginX(scrollOrigin().x() - m_verticalScrollbar->width());
+                ScrollableArea::setScrollOrigin(IntPoint(scrollOrigin().x() - m_verticalScrollbar->width(), scrollOrigin().y()));
             if (m_verticalScrollbar)
                 m_verticalScrollbar->invalidate();
             setHasVerticalScrollbar(newHasVerticalScrollbar);
@@ -655,21 +656,7 @@ void ScrollView::scrollContents(const IntSize& scrollDelta)
     }
 
     // Invalidate the overhang areas if they are visible.
-    IntRect horizontalOverhangRect;
-    IntRect verticalOverhangRect;
-    calculateOverhangAreasForPainting(horizontalOverhangRect, verticalOverhangRect);
-#if USE(ACCELERATED_COMPOSITING) && PLATFORM(CHROMIUM) && ENABLE(RUBBER_BANDING)
-    if (GraphicsLayer* overhangLayer = layerForOverhangAreas()) {
-        bool hasOverhangArea = !horizontalOverhangRect.isEmpty() || !verticalOverhangRect.isEmpty();
-        overhangLayer->setDrawsContent(hasOverhangArea);
-        if (hasOverhangArea)
-            overhangLayer->setNeedsDisplay();
-    }
-#endif
-    if (!horizontalOverhangRect.isEmpty())
-        hostWindow()->invalidateContentsAndRootView(horizontalOverhangRect, false /*immediate*/);
-    if (!verticalOverhangRect.isEmpty())
-        hostWindow()->invalidateContentsAndRootView(verticalOverhangRect, false /*immediate*/);
+    updateOverhangAreas();
 
     // This call will move children with native widgets (plugins) and invalidate them as well.
     frameRectsChanged();
@@ -845,30 +832,6 @@ void ScrollView::setScrollbarOverlayStyle(ScrollbarOverlayStyle overlayStyle)
     platformSetScrollbarOverlayStyle(overlayStyle);
 }
 
-bool ScrollView::wheelEvent(const PlatformWheelEvent& e)
-{
-    // We don't allow mouse wheeling to happen in a ScrollView that has had its scrollbars explicitly disabled.
-#if PLATFORM(WX)
-    if (!canHaveScrollbars()) {
-#else
-    if (!canHaveScrollbars() || platformWidget()) {
-#endif
-        return false;
-    }
-
-    return ScrollableArea::handleWheelEvent(e);
-}
-
-#if ENABLE(GESTURE_EVENTS)
-void ScrollView::gestureEvent(const PlatformGestureEvent& gestureEvent)
-{
-    if (platformWidget())
-        return;
-
-    ScrollableArea::handleGestureEvent(gestureEvent);
-}
-#endif
-
 void ScrollView::setFrameRect(const IntRect& newRect)
 {
     IntRect oldRect = frameRect();
@@ -1144,6 +1107,28 @@ void ScrollView::calculateOverhangAreasForPainting(IntRect& horizontalOverhangRe
     }
 }
 
+void ScrollView::updateOverhangAreas()
+{
+    if (!hostWindow())
+        return;
+
+    IntRect horizontalOverhangRect;
+    IntRect verticalOverhangRect;
+    calculateOverhangAreasForPainting(horizontalOverhangRect, verticalOverhangRect);
+#if USE(ACCELERATED_COMPOSITING) && PLATFORM(CHROMIUM) && ENABLE(RUBBER_BANDING)
+    if (GraphicsLayer* overhangLayer = layerForOverhangAreas()) {
+        bool hasOverhangArea = !horizontalOverhangRect.isEmpty() || !verticalOverhangRect.isEmpty();
+        overhangLayer->setDrawsContent(hasOverhangArea);
+        if (hasOverhangArea)
+            overhangLayer->setNeedsDisplay();
+    }
+#endif
+    if (!horizontalOverhangRect.isEmpty())
+        hostWindow()->invalidateContentsAndRootView(horizontalOverhangRect, false /*immediate*/);
+    if (!verticalOverhangRect.isEmpty())
+        hostWindow()->invalidateContentsAndRootView(verticalOverhangRect, false /*immediate*/);
+}
+
 void ScrollView::paintOverhangAreas(GraphicsContext* context, const IntRect& horizontalOverhangRect, const IntRect& verticalOverhangRect, const IntRect& dirtyRect)
 {
     ScrollbarTheme::theme()->paintOverhangAreas(this, context, horizontalOverhangRect, verticalOverhangRect, dirtyRect);
diff --git a/Source/WebCore/platform/ScrollView.h b/Source/WebCore/platform/ScrollView.h
index cb6ab4e3d..70511f16f 100644
--- a/Source/WebCore/platform/ScrollView.h
+++ b/Source/WebCore/platform/ScrollView.h
@@ -235,14 +235,6 @@ public:
     // For platforms that need to hit test scrollbars from within the engine's event handlers (like Win32).
     Scrollbar* scrollbarAtPoint(const IntPoint& windowPoint);
 
-    // This function exists for scrollviews that need to handle wheel events manually.
-    // On Mac the underlying NSScrollView just does the scrolling, but on other platforms
-    // (like Windows), we need this function in order to do the scroll ourselves.
-    bool wheelEvent(const PlatformWheelEvent&);
-#if ENABLE(GESTURE_EVENTS)
-    void gestureEvent(const PlatformGestureEvent&);
-#endif
-
     IntPoint convertChildToSelf(const Widget* child, const IntPoint& point) const
     {
         IntPoint newPoint = point;
@@ -297,7 +289,6 @@ protected:
     virtual void repaintContentRectangle(const IntRect&, bool now = false);
     virtual void paintContents(GraphicsContext*, const IntRect& damageRect) = 0;
 
-    void calculateOverhangAreasForPainting(IntRect& horizontalOverhangRect, IntRect& verticalOverhangRect);
     virtual void paintOverhangAreas(GraphicsContext*, const IntRect& horizontalOverhangArea, const IntRect& verticalOverhangArea, const IntRect& dirtyRect);
 
     virtual void visibleContentsResized() = 0;
@@ -393,6 +384,9 @@ private:
    
     void platformSetScrollOrigin(const IntPoint&, bool updatePositionAtAll, bool updatePositionSynchronously);
 
+    void calculateOverhangAreasForPainting(IntRect& horizontalOverhangRect, IntRect& verticalOverhangRect);
+    void updateOverhangAreas();
+
 #if PLATFORM(MAC) && defined __OBJC__
 public:
     NSView* documentView() const;
diff --git a/Source/WebCore/platform/ScrollableArea.cpp b/Source/WebCore/platform/ScrollableArea.cpp
index 99b9babc3..58ad24205 100644
--- a/Source/WebCore/platform/ScrollableArea.cpp
+++ b/Source/WebCore/platform/ScrollableArea.cpp
@@ -71,22 +71,6 @@ void ScrollableArea::setScrollOrigin(const IntPoint& origin)
         m_scrollOriginChanged = true;
     }
 }
- 
-void ScrollableArea::setScrollOriginX(int x)
-{
-    if (m_scrollOrigin.x() != x) {
-        m_scrollOrigin.setX(x);
-        m_scrollOriginChanged = true;
-    }
-}
-
-void ScrollableArea::setScrollOriginY(int y)
-{
-    if (m_scrollOrigin.y() != y) {
-        m_scrollOrigin.setY(y);
-        m_scrollOriginChanged = true;
-    }
-}
 
 bool ScrollableArea::scroll(ScrollDirection direction, ScrollGranularity granularity, float multiplier)
 {
@@ -133,48 +117,15 @@ void ScrollableArea::scrollToOffsetWithoutAnimation(const FloatPoint& offset)
 void ScrollableArea::scrollToOffsetWithoutAnimation(ScrollbarOrientation orientation, float offset)
 {
     if (orientation == HorizontalScrollbar)
-        scrollToXOffsetWithoutAnimation(offset);
+        scrollToOffsetWithoutAnimation(FloatPoint(offset, scrollAnimator()->currentPosition().y()));
     else
-        scrollToYOffsetWithoutAnimation(offset);
-}
-
-void ScrollableArea::scrollToXOffsetWithoutAnimation(float x)
-{
-    scrollToOffsetWithoutAnimation(FloatPoint(x, scrollAnimator()->currentPosition().y()));
-}
-
-void ScrollableArea::scrollToYOffsetWithoutAnimation(float y)
-{
-    scrollToOffsetWithoutAnimation(FloatPoint(scrollAnimator()->currentPosition().x(), y));
-}
-
-void ScrollableArea::zoomAnimatorTransformChanged(float, float, float, ZoomAnimationState)
-{
-    // Requires FrameView to override this.
-}
-
-bool ScrollableArea::handleWheelEvent(const PlatformWheelEvent& wheelEvent)
-{
-    return scrollAnimator()->handleWheelEvent(wheelEvent);
-}
-
-#if ENABLE(GESTURE_EVENTS)
-void ScrollableArea::handleGestureEvent(const PlatformGestureEvent& gestureEvent)
-{
-    scrollAnimator()->handleGestureEvent(gestureEvent);
+        scrollToOffsetWithoutAnimation(FloatPoint(scrollAnimator()->currentPosition().x(), offset));
 }
-#endif
 
-// NOTE: Only called from Internals for testing.
-void ScrollableArea::setScrollOffsetFromInternals(const IntPoint& offset)
-{
-    setScrollOffsetFromAnimation(offset);
-}
-
-void ScrollableArea::setScrollOffsetFromAnimation(const IntPoint& offset)
+void ScrollableArea::notifyScrollPositionChanged(const IntPoint& position)
 {
     // Tell the derived class to scroll its contents.
-    setScrollOffset(offset);
+    setScrollOffset(position);
 
     Scrollbar* verticalScrollbar = this->verticalScrollbar();
 
@@ -198,6 +149,27 @@ void ScrollableArea::setScrollOffsetFromAnimation(const IntPoint& offset)
         if (verticalScrollbar->isOverlayScrollbar() && !hasLayerForVerticalScrollbar())
             verticalScrollbar->invalidate();
     }
+
+    scrollAnimator()->notifyContentAreaScrolled();
+}
+
+bool ScrollableArea::handleWheelEvent(const PlatformWheelEvent& wheelEvent)
+{
+    return scrollAnimator()->handleWheelEvent(wheelEvent);
+}
+
+// NOTE: Only called from Internals for testing.
+void ScrollableArea::setScrollOffsetFromInternals(const IntPoint& offset)
+{
+    setScrollOffsetFromAnimation(offset);
+}
+
+void ScrollableArea::setScrollOffsetFromAnimation(const IntPoint& offset)
+{
+    if (requestScrollPositionUpdate(offset))
+        return;
+
+    notifyScrollPositionChanged(offset);
 }
 
 void ScrollableArea::willStartLiveResize()
@@ -308,29 +280,6 @@ void ScrollableArea::setScrollbarOverlayStyle(ScrollbarOverlayStyle overlayStyle
     }
 }
 
-bool ScrollableArea::isPinnedInBothDirections(const IntSize& scrollDelta) const
-{
-    return isPinnedHorizontallyInDirection(scrollDelta.width()) && isPinnedVerticallyInDirection(scrollDelta.height());
-}
-
-bool ScrollableArea::isPinnedHorizontallyInDirection(int horizontalScrollDelta) const
-{
-    if (horizontalScrollDelta < 0 && isHorizontalScrollerPinnedToMinimumPosition())
-        return true;
-    if (horizontalScrollDelta > 0 && isHorizontalScrollerPinnedToMaximumPosition())
-        return true;
-    return false;
-}
-
-bool ScrollableArea::isPinnedVerticallyInDirection(int verticalScrollDelta) const
-{
-    if (verticalScrollDelta < 0 && isVerticalScrollerPinnedToMinimumPosition())
-        return true;
-    if (verticalScrollDelta > 0 && isVerticalScrollerPinnedToMaximumPosition())
-        return true;
-    return false;
-}
-
 void ScrollableArea::invalidateScrollbar(Scrollbar* scrollbar, const IntRect& rect)
 {
 #if USE(ACCELERATED_COMPOSITING)
diff --git a/Source/WebCore/platform/ScrollableArea.h b/Source/WebCore/platform/ScrollableArea.h
index 353b6f074..8244ce833 100644
--- a/Source/WebCore/platform/ScrollableArea.h
+++ b/Source/WebCore/platform/ScrollableArea.h
@@ -42,20 +42,20 @@ class GraphicsLayer;
 
 class ScrollableArea {
 public:
-    enum ZoomAnimationState { ZoomAnimationContinuing, ZoomAnimationFinishing };
-
     bool scroll(ScrollDirection, ScrollGranularity, float multiplier = 1);
     void scrollToOffsetWithoutAnimation(const FloatPoint&);
     void scrollToOffsetWithoutAnimation(ScrollbarOrientation, float offset);
-    void scrollToXOffsetWithoutAnimation(float x);
-    void scrollToYOffsetWithoutAnimation(float x);
 
-    virtual void zoomAnimatorTransformChanged(float, float, float, ZoomAnimationState);
+    // Should be called when the scroll position changes externally, for example if the scroll layer position
+    // is updated on the scrolling thread and we need to notify the main thread.
+    void notifyScrollPositionChanged(const IntPoint&);
+
+    // Allows subclasses to handle scroll position updates themselves. If this member function
+    // returns true, the scrollable area won't actually update the scroll position and instead
+    // expect it to happen sometime in the future.
+    virtual bool requestScrollPositionUpdate(const IntPoint&) { return false; }
 
     bool handleWheelEvent(const PlatformWheelEvent&);
-#if ENABLE(GESTURE_EVENTS)
-    void handleGestureEvent(const PlatformGestureEvent&);
-#endif
 
     // Functions for controlling if you can scroll past the end of the document.
     bool constrainsScrollingToContentEdge() const { return m_constrainsScrollingToContentEdge; }
@@ -104,10 +104,6 @@ public:
     void invalidateScrollCorner(const IntRect&);
     virtual void getTickmarks(Vector<IntRect>&) const { }
 
-    // This function should be overriden by subclasses to perform the actual
-    // scroll of the content.
-    virtual void setScrollOffset(const IntPoint&) = 0;
-
     // Convert points and rects between the scrollbar and its containing view.
     // The client needs to implement these in order to be aware of layout effects
     // like CSS transforms.
@@ -147,21 +143,12 @@ public:
 
     virtual bool isOnActivePage() const { ASSERT_NOT_REACHED(); return true; }
     
-    bool isHorizontalScrollerPinnedToMinimumPosition() const { return !horizontalScrollbar() || scrollPosition(horizontalScrollbar()) <= minimumScrollPosition().x(); }
-    bool isHorizontalScrollerPinnedToMaximumPosition() const { return !horizontalScrollbar() || scrollPosition(horizontalScrollbar()) >= maximumScrollPosition().x(); }
-    bool isVerticalScrollerPinnedToMinimumPosition() const { return !verticalScrollbar() || scrollPosition(verticalScrollbar()) <= minimumScrollPosition().y(); }
-    bool isVerticalScrollerPinnedToMaximumPosition() const { return !verticalScrollbar() || scrollPosition(verticalScrollbar()) >= maximumScrollPosition().y(); }
-
     // Note that this only returns scrollable areas that can actually be scrolled.
     virtual ScrollableArea* enclosingScrollableArea() const = 0;
 
     // Returns the bounding box of this scrollable area, in the coordinate system of the enclosing scroll view.
     virtual IntRect scrollableAreaBoundingBox() const { ASSERT_NOT_REACHED(); return IntRect(); }
 
-    bool isPinnedInBothDirections(const IntSize&) const;
-    bool isPinnedHorizontallyInDirection(int horizontalScrollDelta) const;
-    bool isPinnedVerticallyInDirection(int verticalScrollDelta) const;
-
     virtual bool shouldRubberBandInDirection(ScrollDirection) const { return true; }
 
     virtual bool scrollAnimatorEnabled() const { return false; }
@@ -174,8 +161,6 @@ protected:
     virtual ~ScrollableArea();
 
     void setScrollOrigin(const IntPoint&);
-    void setScrollOriginX(int);
-    void setScrollOriginY(int);
     void resetScrollOriginChanged() { m_scrollOriginChanged = false; }
 
     virtual void invalidateScrollbarRect(Scrollbar*, const IntRect&) = 0;
@@ -198,6 +183,10 @@ private:
     friend class ScrollAnimator;
     void setScrollOffsetFromAnimation(const IntPoint&);
 
+    // This function should be overriden by subclasses to perform the actual
+    // scroll of the content.
+    virtual void setScrollOffset(const IntPoint&) = 0;
+
     mutable OwnPtr<ScrollAnimator> m_scrollAnimator;
     bool m_constrainsScrollingToContentEdge : 1;
 
diff --git a/Source/WebCore/platform/Scrollbar.h b/Source/WebCore/platform/Scrollbar.h
index e4e72465b..39ac25465 100644
--- a/Source/WebCore/platform/Scrollbar.h
+++ b/Source/WebCore/platform/Scrollbar.h
@@ -103,13 +103,6 @@ public:
 
     bool mouseDown(const PlatformMouseEvent&);
 
-#if PLATFORM(QT)
-    // For platforms that wish to handle context menu events.
-    // FIXME: This is misplaced.  Normal hit testing should be used to populate a correct
-    // context menu.  There's no reason why the scrollbar should have to do it.
-    bool contextMenu(const PlatformMouseEvent& event);
-#endif
-
     ScrollbarTheme* theme() const { return m_theme; }
 
     virtual void setParent(ScrollView*);
@@ -128,6 +121,8 @@ public:
     virtual IntPoint convertToContainingView(const IntPoint&) const;
     virtual IntPoint convertFromContainingView(const IntPoint&) const;
 
+    void moveThumb(int pos, bool draggingDocument = false);
+
 protected:
     Scrollbar(ScrollableArea*, ScrollbarOrientation, ScrollbarControlSize, ScrollbarTheme* = 0);
 
@@ -142,8 +137,6 @@ protected:
     ScrollDirection pressedPartScrollDirection();
     ScrollGranularity pressedPartScrollGranularity();
     
-    void moveThumb(int pos, bool draggingDocument = false);
-
     ScrollableArea* m_scrollableArea;
     ScrollbarOrientation m_orientation;
     ScrollbarControlSize m_controlSize;
diff --git a/Source/WebCore/platform/ScrollbarThemeComposite.cpp b/Source/WebCore/platform/ScrollbarThemeComposite.cpp
index fcbf484c0..62fd5e5d2 100644
--- a/Source/WebCore/platform/ScrollbarThemeComposite.cpp
+++ b/Source/WebCore/platform/ScrollbarThemeComposite.cpp
@@ -226,7 +226,11 @@ static float usedTotalSize(Scrollbar* scrollbar)
 int ScrollbarThemeComposite::thumbPosition(Scrollbar* scrollbar)
 {
     if (scrollbar->enabled()) {
-        float pos = max(0.0f, scrollbar->currentPos()) * (trackLength(scrollbar) - thumbLength(scrollbar)) / (usedTotalSize(scrollbar) - scrollbar->visibleSize());
+        float size = usedTotalSize(scrollbar) - scrollbar->visibleSize();
+        // Avoid doing a floating point divide by zero and return 1 when usedTotalSize == visibleSize.
+        if (!size)
+            return 1;
+        float pos = max(0.0f, scrollbar->currentPos()) * (trackLength(scrollbar) - thumbLength(scrollbar)) / size;
         return (pos < 1 && pos > 0) ? 1 : pos;
     }
     return 0;
diff --git a/Source/WebCore/platform/SharedBuffer.cpp b/Source/WebCore/platform/SharedBuffer.cpp
index 77aef2aa7..5b5953edc 100644
--- a/Source/WebCore/platform/SharedBuffer.cpp
+++ b/Source/WebCore/platform/SharedBuffer.cpp
@@ -233,16 +233,19 @@ const Vector<char>& SharedBuffer::buffer() const
 
 unsigned SharedBuffer::getSomeData(const char*& someData, unsigned position) const
 {
-    if (hasPlatformData() || m_purgeableBuffer) {
-        someData = data() + position;
-        return size() - position;
-    }
-
-    if (position >= m_size) {
+    unsigned totalSize = size();
+    if (position >= totalSize) {
         someData = 0;
         return 0;
     }
 
+    if (hasPlatformData() || m_purgeableBuffer) {
+        ASSERT(position < size());
+        someData = data() + position;
+        return totalSize - position;
+    }
+
+    ASSERT(position < m_size);
     unsigned consecutiveSize = m_buffer.size();
     if (position < consecutiveSize) {
         someData = m_buffer.data() + position;
@@ -250,14 +253,25 @@ unsigned SharedBuffer::getSomeData(const char*& someData, unsigned position) con
     }
  
     position -= consecutiveSize;
-    unsigned segmentedSize = m_size - consecutiveSize;
     unsigned segments = m_segments.size();
+    unsigned maxSegmentedSize = segments * segmentSize;
     unsigned segment = segmentIndex(position);
-    ASSERT(segment < segments);
+    if (segment < segments) {
+        unsigned bytesLeft = totalSize - consecutiveSize;
+        unsigned segmentedSize = min(maxSegmentedSize, bytesLeft);
 
-    unsigned positionInSegment = offsetInSegment(position);
-    someData = m_segments[segment] + positionInSegment;
-    return segment == segments - 1 ? segmentedSize - position : segmentSize - positionInSegment;
+        unsigned positionInSegment = offsetInSegment(position);
+        someData = m_segments[segment] + positionInSegment;
+        return segment == segments - 1 ? segmentedSize - position : segmentSize - positionInSegment;
+    }
+#if HAVE(NETWORK_CFDATA_ARRAY_CALLBACK)
+    ASSERT(maxSegmentedSize <= position);
+    position -= maxSegmentedSize;
+    return copySomeDataFromDataArray(someData, position);
+#else
+    ASSERT_NOT_REACHED();
+    return 0;
+#endif
 }
 
 #if !USE(CF) || PLATFORM(QT)
diff --git a/Source/WebCore/platform/SharedBuffer.h b/Source/WebCore/platform/SharedBuffer.h
index 57cfc2949..fe3e4b6b8 100644
--- a/Source/WebCore/platform/SharedBuffer.h
+++ b/Source/WebCore/platform/SharedBuffer.h
@@ -136,6 +136,7 @@ private:
 #if HAVE(NETWORK_CFDATA_ARRAY_CALLBACK)
     mutable Vector<RetainPtr<CFDataRef> > m_dataArray;
     void copyDataArrayAndClear(char *destination, unsigned bytesToCopy) const;
+    unsigned copySomeDataFromDataArray(const char*& someData, unsigned position) const;
 #endif
 #if USE(CF)
     SharedBuffer(CFDataRef);
diff --git a/Source/WebCore/platform/Widget.h b/Source/WebCore/platform/Widget.h
index 3f19b61e2..d710716ba 100644
--- a/Source/WebCore/platform/Widget.h
+++ b/Source/WebCore/platform/Widget.h
@@ -63,9 +63,9 @@ typedef GtkWidget* PlatformWidget;
 
 #if PLATFORM(QT)
 QT_BEGIN_NAMESPACE
-class QWidget;
+class QObject;
 QT_END_NAMESPACE
-typedef QWidget* PlatformWidget;
+typedef QObject* PlatformWidget;
 #endif
 
 #if PLATFORM(WX)
diff --git a/Source/WebCore/platform/audio/AudioBus.cpp b/Source/WebCore/platform/audio/AudioBus.cpp
index d6aa35002..e7f8902f7 100644
--- a/Source/WebCore/platform/audio/AudioBus.cpp
+++ b/Source/WebCore/platform/audio/AudioBus.cpp
@@ -225,6 +225,32 @@ void AudioBus::copyFrom(const AudioBus& sourceBus)
         vadd(sourceL, 1, sourceR, 1, destination, 1, length());
         float scale = 0.5;
         vsmul(destination, 1, &scale, destination, 1, length());
+    } else if (numberOfDestinationChannels == 6 && numberOfSourceChannels == 1) {
+        // Handle mono -> 5.1 case, copy mono channel to center. 
+        channel(2)->copyFrom(sourceBus.channel(0));
+        channel(0)->zero();
+        channel(1)->zero();
+        channel(3)->zero();
+        channel(4)->zero();
+        channel(5)->zero();
+    } else if (numberOfDestinationChannels == 1 && numberOfSourceChannels == 6) {
+        // Handle 5.1 -> mono case, copy center channel into mono.
+        // FIXME: We should have a better algorithm for this down mixing.
+        channel(0)->copyFrom(sourceBus.channel(2));
+    } else if (numberOfDestinationChannels < numberOfSourceChannels) {
+        // Default down mixing handling, just match the source channels with the first available destination channels. 
+        // 5.1 -> stereo case covered here. 
+        // FIXME: We should have a better algorithm for down mixing 5.1 to stereo.
+        // https://bugs.webkit.org/show_bug.cgi?id=79192
+        for (unsigned i = 0; i < numberOfDestinationChannels; ++i)
+            channel(i)->copyFrom(sourceBus.channel(i));
+    } else if (numberOfDestinationChannels > numberOfSourceChannels) {
+        // Default up mixing handling, just match the destination channels with the first available source channels. 
+        // Stereo -> 5.1 case covered here. 
+        for (unsigned i = 0; i < numberOfSourceChannels; ++i) 
+            channel(i)->copyFrom(sourceBus.channel(i));
+        for (unsigned i = numberOfSourceChannels; i < numberOfDestinationChannels; ++i)
+            channel(i)->zero();
     } else {
         // Case not handled
         ASSERT_NOT_REACHED();
@@ -256,6 +282,25 @@ void AudioBus::sumFrom(const AudioBus &sourceBus)
         float scale = 0.5;
         vsma(sourceL, 1, &scale, destination, 1, length());
         vsma(sourceR, 1, &scale, destination, 1, length());
+    } else if (numberOfDestinationChannels == 6 && numberOfSourceChannels == 1) {
+        // Handle mono -> 5.1 case, sum mono channel into center.
+        channel(2)->sumFrom(sourceBus.channel(0));
+    } else if (numberOfDestinationChannels == 1 && numberOfSourceChannels == 6) {
+        // Handle 5.1 -> mono case, sum center channel into mono.
+        // FIXME: We should have a better algorithm for this down mixing.
+        channel(0)->sumFrom(sourceBus.channel(2));
+    } else if (numberOfDestinationChannels < numberOfSourceChannels) {
+        // Default down mixing, just summing the first available destination channels. 
+        // 5.1 -> stereo case covered here.
+        // FIXME: We should have a better algorithm for down mixing 5.1 to stereo.
+        // https://bugs.webkit.org/show_bug.cgi?id=79192
+        for (unsigned i = 0; i < numberOfDestinationChannels; ++i) 
+            channel(i)->sumFrom(sourceBus.channel(i));
+    } else if (numberOfDestinationChannels > numberOfSourceChannels) {
+        // Default up mixing, just summing the first available source channels. 
+        // stereo -> 5.1 case covered here.
+        for (unsigned i = 0; i < numberOfSourceChannels; ++i) 
+            channel(i)->sumFrom(sourceBus.channel(i));
     } else {
         // Case not handled
         ASSERT_NOT_REACHED();
@@ -409,10 +454,6 @@ void AudioBus::processWithGainFromMonoStereo(const AudioBus &sourceBus, float* l
         }
     } else {
         // Process directly (without summing) to our bus
-        // If it is from the same bus and no need to change gain, just return
-        if (this == &sourceBus && *lastMixGain == targetGain && targetGain == 1.0)
-            return;
-
         if (sourceR && destinationR) {
             // Stereo
             PROCESS_WITH_GAIN(STEREO_NO_SUM)
@@ -437,6 +478,9 @@ void AudioBus::processWithGainFrom(const AudioBus &sourceBus, float* lastMixGain
         ASSERT_NOT_REACHED();
         return;
     }
+    // If it is copying from the same bus and no need to change gain, just return
+    if (!sumToBus && this == &sourceBus && *lastMixGain == targetGain && targetGain == 1.0)
+        return;
 
     // Dispatch for different channel layouts
     switch (numberOfChannels()) {
diff --git a/Source/WebCore/platform/audio/AudioUtilities.cpp b/Source/WebCore/platform/audio/AudioUtilities.cpp
index ff19cee69..7ec833ccd 100644
--- a/Source/WebCore/platform/audio/AudioUtilities.cpp
+++ b/Source/WebCore/platform/audio/AudioUtilities.cpp
@@ -56,38 +56,10 @@ float discreteTimeConstantForSampleRate(float timeConstant, float sampleRate)
     return 1 - powf(1 / 2.718282f, 1 / (sampleRate * timeConstant));
 }
 
-#if OS(WINDOWS) && COMPILER(MSVC) && !_M_IX86_FP
-// When compiling with MSVC with x87 FPU instructions using 80-bit
-// floats, we want very precise control over the arithmetic so that
-// rounding is done according to the IEEE 754 specification for
-// single- and double-precision floats. We want each operation to be
-// done with specified arithmetic precision and rounding consistent
-// with gcc, not extended to 80 bits automatically.
-//
-// These pragmas are equivalent to /fp:strict flag, but we only need
-// it for the function here.  (Using fp:strict everywhere can have
-// severe impact on floating point performance.)
-#pragma float_control(push)
-#pragma float_control(precise, on)
-#pragma fenv_access(on)
-#pragma float_control(except, on)
-#endif
-
 size_t timeToSampleFrame(double time, double sampleRate)
 {
-    // DO NOT CONSOLIDATE THESE ASSIGNMENTS INTO ONE! When compiling
-    // with Visual Studio, these assignments force the rounding of
-    // each operation according to IEEE 754, instead of leaving
-    // intermediate results in 80-bit precision which is not
-    // consistent with IEEE 754 double-precision rounding.
-    double r = time * sampleRate;
-    r += 0.5;
-    return static_cast<size_t>(r);
+    return static_cast<size_t>(round(time * sampleRate));
 }
-#if OS(WINDOWS) && COMPILER(MSVC) && !_M_IX86_FP
-// Restore normal floating-point semantics.
-#pragma float_control(pop)
-#endif
 } // AudioUtilites
 
 } // WebCore
diff --git a/Source/WebCore/platform/audio/DynamicsCompressor.cpp b/Source/WebCore/platform/audio/DynamicsCompressor.cpp
index a55205705..d0f27b05f 100644
--- a/Source/WebCore/platform/audio/DynamicsCompressor.cpp
+++ b/Source/WebCore/platform/audio/DynamicsCompressor.cpp
@@ -40,16 +40,16 @@ namespace WebCore {
 
 using namespace AudioUtilities;
     
-DynamicsCompressor::DynamicsCompressor(bool isStereo, float sampleRate)
-    : m_isStereo(isStereo)
-    , m_sampleRate(sampleRate)
-    , m_compressor(sampleRate)
+DynamicsCompressor::DynamicsCompressor(float sampleRate, unsigned numberOfChannels)
+    : m_numberOfChannels(numberOfChannels)
+    , m_compressor(sampleRate, numberOfChannels)
 {
     // Uninitialized state - for parameter recalculation.
     m_lastFilterStageRatio = -1;
     m_lastAnchor = -1;
     m_lastFilterStageGain = -1;
 
+    setNumberOfChannels(numberOfChannels);
     initializeParameters();
 }
 
@@ -93,18 +93,20 @@ void DynamicsCompressor::setEmphasisStageParameters(unsigned stageIndex, float g
     float r1 = expf(-f1 * piFloat);
     float r2 = expf(-f2 * piFloat);
 
-    // Set pre-filter zero and pole to create an emphasis filter.
-    m_preFilter[stageIndex].setZero(r1);
-    m_preFilter[stageIndex].setPole(r2);
-    m_preFilterR[stageIndex].setZero(r1);
-    m_preFilterR[stageIndex].setPole(r2);
-
-    // Set post-filter with zero and pole reversed to create the de-emphasis filter.
-    // If there were no compressor kernel in between, they would cancel each other out (allpass filter).
-    m_postFilter[stageIndex].setZero(r2);
-    m_postFilter[stageIndex].setPole(r1);
-    m_postFilterR[stageIndex].setZero(r2);
-    m_postFilterR[stageIndex].setPole(r1);
+    ASSERT(m_numberOfChannels == m_preFilterPacks.size());
+
+    for (unsigned i = 0; i < m_numberOfChannels; ++i) {
+        // Set pre-filter zero and pole to create an emphasis filter.
+        ZeroPole& preFilter = m_preFilterPacks[i]->filters[stageIndex];
+        preFilter.setZero(r1);
+        preFilter.setPole(r2);
+
+        // Set post-filter with zero and pole reversed to create the de-emphasis filter.
+        // If there were no compressor kernel in between, they would cancel each other out (allpass filter).
+        ZeroPole& postFilter = m_postFilterPacks[i]->filters[stageIndex];
+        postFilter.setZero(r2);
+        postFilter.setPole(r1);
+    }
 }
 
 void DynamicsCompressor::setEmphasisParameters(float gain, float anchorFreq, float filterStageRatio)
@@ -117,18 +119,40 @@ void DynamicsCompressor::setEmphasisParameters(float gain, float anchorFreq, flo
 
 void DynamicsCompressor::process(const AudioBus* sourceBus, AudioBus* destinationBus, unsigned framesToProcess)
 {
-    const float* sourceL = sourceBus->channel(0)->data();
-    const float* sourceR;
+    // Though numberOfChannels is retrived from destinationBus, we still name it numberOfChannels instead of numberOfDestinationChannels.
+    // It's because we internally match sourceChannels's size to destinationBus by channel up/down mix. Thus we need numberOfChannels
+    // to do the loop work for both m_sourceChannels and m_destinationChannels.
+
+    unsigned numberOfChannels = destinationBus->numberOfChannels();
+    unsigned numberOfSourceChannels = sourceBus->numberOfChannels();
 
-    if (sourceBus->numberOfChannels() > 1)
-        sourceR = sourceBus->channel(1)->data();
-    else
-        sourceR = sourceL;
+    ASSERT(numberOfChannels == m_numberOfChannels && numberOfSourceChannels);
 
-    ASSERT(destinationBus->numberOfChannels() == 2);
+    if (numberOfChannels != m_numberOfChannels || !numberOfSourceChannels) {
+        destinationBus->zero();
+        return;
+    }
+
+    switch (numberOfChannels) {
+    case 2: // stereo
+        m_sourceChannels[0] = sourceBus->channel(0)->data();
+
+        if (numberOfSourceChannels > 1)
+            m_sourceChannels[1] = sourceBus->channel(1)->data();
+        else
+            // Simply duplicate mono channel input data to right channel for stereo processing.
+            m_sourceChannels[1] = m_sourceChannels[0];
+
+        break;
+    default:
+        // FIXME : support other number of channels.
+        ASSERT_NOT_REACHED();
+        destinationBus->zero();
+        return;
+    }
 
-    float* destinationL = destinationBus->channel(0)->mutableData();
-    float* destinationR = destinationBus->channel(1)->mutableData();
+    for (unsigned i = 0; i < numberOfChannels; ++i)
+        m_destinationChannels[i] = destinationBus->channel(i)->mutableData();
 
     float filterStageGain = parameterValue(ParamFilterStageGain);
     float filterStageRatio = parameterValue(ParamFilterStageRatio);
@@ -144,16 +168,15 @@ void DynamicsCompressor::process(const AudioBus* sourceBus, AudioBus* destinatio
 
     // Apply pre-emphasis filter.
     // Note that the final three stages are computed in-place in the destination buffer.
-    m_preFilter[0].process(sourceL, destinationL, framesToProcess);
-    m_preFilter[1].process(destinationL, destinationL, framesToProcess);
-    m_preFilter[2].process(destinationL, destinationL, framesToProcess);
-    m_preFilter[3].process(destinationL, destinationL, framesToProcess);
-
-    if (isStereo()) {
-        m_preFilterR[0].process(sourceR, destinationR, framesToProcess);
-        m_preFilterR[1].process(destinationR, destinationR, framesToProcess);
-        m_preFilterR[2].process(destinationR, destinationR, framesToProcess);
-        m_preFilterR[3].process(destinationR, destinationR, framesToProcess);
+    for (unsigned i = 0; i < numberOfChannels; ++i) {
+        const float* sourceData = m_sourceChannels[i];
+        float* destinationData = m_destinationChannels[i];
+        ZeroPole* preFilters = m_preFilterPacks[i]->filters;
+
+        preFilters[0].process(sourceData, destinationData, framesToProcess);
+        preFilters[1].process(destinationData, destinationData, framesToProcess);
+        preFilters[2].process(destinationData, destinationData, framesToProcess);
+        preFilters[3].process(destinationData, destinationData, framesToProcess);
     }
 
     float dbThreshold = parameterValue(ParamThreshold);
@@ -177,10 +200,9 @@ void DynamicsCompressor::process(const AudioBus* sourceBus, AudioBus* destinatio
 
     // Apply compression to the pre-filtered signal.
     // The processing is performed in place.
-    m_compressor.process(destinationL,
-                         destinationL,
-                         destinationR,
-                         destinationR,
+    m_compressor.process(m_destinationChannels.get(),
+                         m_destinationChannels.get(),
+                         numberOfChannels,
                          framesToProcess,
 
                          dbThreshold,
@@ -198,16 +220,14 @@ void DynamicsCompressor::process(const AudioBus* sourceBus, AudioBus* destinatio
                          );
 
     // Apply de-emphasis filter.
-    m_postFilter[0].process(destinationL, destinationL, framesToProcess);
-    m_postFilter[1].process(destinationL, destinationL, framesToProcess);
-    m_postFilter[2].process(destinationL, destinationL, framesToProcess);
-    m_postFilter[3].process(destinationL, destinationL, framesToProcess);
-
-    if (isStereo()) {
-        m_postFilterR[0].process(destinationR, destinationR, framesToProcess);
-        m_postFilterR[1].process(destinationR, destinationR, framesToProcess);
-        m_postFilterR[2].process(destinationR, destinationR, framesToProcess);
-        m_postFilterR[3].process(destinationR, destinationR, framesToProcess);
+    for (unsigned i = 0; i < numberOfChannels; ++i) {
+        float* destinationData = m_destinationChannels[i];
+        ZeroPole* postFilters = m_postFilterPacks[i]->filters;
+
+        postFilters[0].process(destinationData, destinationData, framesToProcess);
+        postFilters[1].process(destinationData, destinationData, framesToProcess);
+        postFilters[2].process(destinationData, destinationData, framesToProcess);
+        postFilters[3].process(destinationData, destinationData, framesToProcess);
     }
 }
 
@@ -217,16 +237,35 @@ void DynamicsCompressor::reset()
     m_lastAnchor = -1;
     m_lastFilterStageGain = -1;
 
-    for (unsigned i = 0; i < 4; ++i) {
-        m_preFilter[i].reset();
-        m_preFilterR[i].reset();
-        m_postFilter[i].reset();
-        m_postFilterR[i].reset();
+    for (unsigned channel = 0; channel < m_numberOfChannels; ++channel) {
+        for (unsigned stageIndex = 0; stageIndex < 4; ++stageIndex) {
+            m_preFilterPacks[channel]->filters[stageIndex].reset();
+            m_postFilterPacks[channel]->filters[stageIndex].reset();
+        }
     }
 
     m_compressor.reset();
 }
 
+void DynamicsCompressor::setNumberOfChannels(unsigned numberOfChannels)
+{
+    if (m_preFilterPacks.size() == numberOfChannels)
+        return;
+
+    m_preFilterPacks.clear();
+    m_postFilterPacks.clear();
+    for (unsigned i = 0; i < numberOfChannels; ++i) {
+        m_preFilterPacks.append(adoptPtr(new ZeroPoleFilterPack4()));
+        m_postFilterPacks.append(adoptPtr(new ZeroPoleFilterPack4()));
+    }
+
+    m_sourceChannels = adoptArrayPtr(new const float* [numberOfChannels]);
+    m_destinationChannels = adoptArrayPtr(new float* [numberOfChannels]);
+
+    m_compressor.setNumberOfChannels(numberOfChannels);
+    m_numberOfChannels = numberOfChannels;
+}
+
 } // namespace WebCore
 
 #endif // ENABLE(WEB_AUDIO)
diff --git a/Source/WebCore/platform/audio/DynamicsCompressor.h b/Source/WebCore/platform/audio/DynamicsCompressor.h
index e0115ee27..d949f3068 100644
--- a/Source/WebCore/platform/audio/DynamicsCompressor.h
+++ b/Source/WebCore/platform/audio/DynamicsCompressor.h
@@ -33,6 +33,8 @@
 #include "DynamicsCompressorKernel.h"
 #include "ZeroPole.h"
 
+#include <wtf/OwnArrayPtr.h>
+
 namespace WebCore {
 
 class AudioBus;
@@ -62,25 +64,26 @@ public:
         ParamLast
     };
 
-    DynamicsCompressor(bool isStereo, float sampleRate);
+    DynamicsCompressor(float sampleRate, unsigned numberOfChannels);
 
     void process(const AudioBus* sourceBus, AudioBus* destinationBus, unsigned framesToProcess);
     void reset();
+    void setNumberOfChannels(unsigned);
 
     float parameterValue(unsigned parameterID);
 
-    bool isStereo() const { return m_isStereo; }
     float sampleRate() const { return m_sampleRate; }
     float nyquist() const { return m_sampleRate / 2; }
 
 protected:
+    unsigned m_numberOfChannels;
+
     // m_parameters holds the tweakable compressor parameters.
     // FIXME: expose some of the most important ones (such as threshold, attack, release)
     // as DynamicsCompressorNode attributes.
     float m_parameters[ParamLast];
     void initializeParameters();
 
-    bool m_isStereo;
     float m_sampleRate;
 
     // Emphasis filter controls.
@@ -88,11 +91,16 @@ protected:
     float m_lastAnchor;
     float m_lastFilterStageGain;
 
-    // Emphasis filters.
-    ZeroPole m_preFilter[4];
-    ZeroPole m_preFilterR[4];
-    ZeroPole m_postFilter[4];
-    ZeroPole m_postFilterR[4];
+    typedef struct {
+        ZeroPole filters[4];
+    } ZeroPoleFilterPack4;
+
+    // Per-channel emphasis filters.
+    Vector<OwnPtr<ZeroPoleFilterPack4> > m_preFilterPacks;
+    Vector<OwnPtr<ZeroPoleFilterPack4> > m_postFilterPacks;
+
+    OwnArrayPtr<const float*> m_sourceChannels;
+    OwnArrayPtr<float*> m_destinationChannels;
 
     void setEmphasisStageParameters(unsigned stageIndex, float gain, float normalizedFrequency /* 0 -> 1 */);
     void setEmphasisParameters(float gain, float anchorFreq, float filterStageRatio);
diff --git a/Source/WebCore/platform/audio/DynamicsCompressorKernel.cpp b/Source/WebCore/platform/audio/DynamicsCompressorKernel.cpp
index a322a3302..3e943d120 100644
--- a/Source/WebCore/platform/audio/DynamicsCompressorKernel.cpp
+++ b/Source/WebCore/platform/audio/DynamicsCompressorKernel.cpp
@@ -52,20 +52,30 @@ static float saturate(float x, float k)
     return 1 - exp(-k * x);
 }
 
-DynamicsCompressorKernel::DynamicsCompressorKernel(float sampleRate)
+DynamicsCompressorKernel::DynamicsCompressorKernel(float sampleRate, unsigned numberOfChannels)
     : m_sampleRate(sampleRate)
     , m_lastPreDelayFrames(DefaultPreDelayFrames)
-    , m_preDelayBufferL(MaxPreDelayFrames)
-    , m_preDelayBufferR(MaxPreDelayFrames)
     , m_preDelayReadIndex(0)
     , m_preDelayWriteIndex(DefaultPreDelayFrames)
 {
+    setNumberOfChannels(numberOfChannels);
+
     // Initializes most member variables
     reset();
     
     m_meteringReleaseK = discreteTimeConstantForSampleRate(meteringReleaseTimeConstant, sampleRate);
 }
 
+void DynamicsCompressorKernel::setNumberOfChannels(unsigned numberOfChannels)
+{
+    if (m_preDelayBuffers.size() == numberOfChannels)
+        return;
+
+    m_preDelayBuffers.clear();
+    for (unsigned i = 0; i < numberOfChannels; ++i)
+        m_preDelayBuffers.append(adoptPtr(new AudioFloatArray(MaxPreDelayFrames)));
+}
+
 void DynamicsCompressorKernel::setPreDelayTime(float preDelayTime)
 {
     // Re-configure look-ahead section pre-delay if delay time has changed.
@@ -75,17 +85,17 @@ void DynamicsCompressorKernel::setPreDelayTime(float preDelayTime)
         
     if (m_lastPreDelayFrames != preDelayFrames) {
         m_lastPreDelayFrames = preDelayFrames;
-        m_preDelayBufferL.zero();
-        m_preDelayBufferR.zero();
+        for (unsigned i = 0; i < m_preDelayBuffers.size(); ++i)
+            m_preDelayBuffers[i]->zero();
+
         m_preDelayReadIndex = 0;
         m_preDelayWriteIndex = preDelayFrames;
     }
 }
 
-void DynamicsCompressorKernel::process(const float* sourceL,
-                                       float* destinationL,
-                                       const float* sourceR, /* stereo-linked */
-                                       float* destinationR,
+void DynamicsCompressorKernel::process(float* sourceChannels[],
+                                       float* destinationChannels[],
+                                       unsigned numberOfChannels,
                                        unsigned framesToProcess,
 
                                        float dbThreshold,
@@ -102,7 +112,8 @@ void DynamicsCompressorKernel::process(const float* sourceL,
                                        float releaseZone4
                                        )
 {
-    bool isStereo = destinationR;
+    ASSERT(m_preDelayBuffers.size() == numberOfChannels);
+
     float sampleRate = this->sampleRate();
 
     float dryMix = 1 - effectBlend;
@@ -164,6 +175,7 @@ void DynamicsCompressorKernel::process(const float* sourceL,
 
     const int nDivisions = framesToProcess / nDivisionFrames;
 
+    unsigned frameIndex = 0;
     for (int i = 0; i < nDivisions; ++i) {
         // ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
         // Calculate desired gain
@@ -247,8 +259,6 @@ void DynamicsCompressorKernel::process(const float* sourceL,
         // ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
         {
-            float* delayBufferL = m_preDelayBufferL.data();
-            float* delayBufferR = m_preDelayBufferR.data();
             int preDelayReadIndex = m_preDelayReadIndex;
             int preDelayWriteIndex = m_preDelayWriteIndex;
             float detectorAverage = m_detectorAverage;
@@ -256,32 +266,19 @@ void DynamicsCompressorKernel::process(const float* sourceL,
 
             int loopFrames = nDivisionFrames;
             while (loopFrames--) {
-                float compressorInput;
-                float inputL;
-                float inputR = 0;
+                float compressorInput = 0;
 
                 // Predelay signal, computing compression amount from un-delayed version.
-                if (isStereo) {
-                    float undelayedL = *sourceL++;
-                    float undelayedR = *sourceR++;
-
-                    compressorInput = 0.5f * (undelayedL + undelayedR);
-
-                    inputL = delayBufferL[preDelayReadIndex];
-                    inputR = delayBufferR[preDelayReadIndex];
-
-                    delayBufferL[preDelayWriteIndex] = undelayedL;
-                    delayBufferR[preDelayWriteIndex] = undelayedR;
-                } else {
-                    compressorInput = *sourceL++;
-
-                    inputL = delayBufferL[preDelayReadIndex];
-                    delayBufferL[preDelayWriteIndex] = compressorInput;
+                for (unsigned i = 0; i < numberOfChannels; ++i) {
+                    float* delayBuffer = m_preDelayBuffers[i]->data();
+                    float undelayedSource = sourceChannels[i][frameIndex];
+                    delayBuffer[preDelayWriteIndex] = undelayedSource;
+
+                    float absUndelayedSource = undelayedSource > 0 ? undelayedSource : -undelayedSource;
+                    if (compressorInput < absUndelayedSource)
+                        compressorInput = absUndelayedSource;
                 }
 
-                preDelayReadIndex = (preDelayReadIndex + 1) & MaxPreDelayFramesMask;
-                preDelayWriteIndex = (preDelayWriteIndex + 1) & MaxPreDelayFramesMask;
-
                 // Calculate shaped power on undelayed input.
 
                 float scaledInput = compressorInput;
@@ -337,17 +334,14 @@ void DynamicsCompressorKernel::process(const float* sourceL,
                     m_meteringGain += (dbRealGain - m_meteringGain) * m_meteringReleaseK;
 
                 // Apply final gain.
-                if (isStereo) {
-                    float outputL = inputL;
-                    float outputR = inputR;
-
-                    outputL *= totalGain;
-                    outputR *= totalGain;
+                for (unsigned i = 0; i < numberOfChannels; ++i) {
+                    float* delayBuffer = m_preDelayBuffers[i]->data();
+                    destinationChannels[i][frameIndex] = delayBuffer[preDelayReadIndex] * totalGain;
+                }
 
-                    *destinationL++ = outputL;
-                    *destinationR++ = outputR;
-                } else
-                    *destinationL++ = inputL * totalGain;
+                frameIndex++;
+                preDelayReadIndex = (preDelayReadIndex + 1) & MaxPreDelayFramesMask;
+                preDelayWriteIndex = (preDelayWriteIndex + 1) & MaxPreDelayFramesMask;
             }
 
             // Locals back to member variables.
@@ -366,8 +360,9 @@ void DynamicsCompressorKernel::reset()
     m_meteringGain = 1;
 
     // Predelay section.
-    m_preDelayBufferL.zero();
-    m_preDelayBufferR.zero();
+    for (unsigned i = 0; i < m_preDelayBuffers.size(); ++i)
+        m_preDelayBuffers[i]->zero();
+
     m_preDelayReadIndex = 0;
     m_preDelayWriteIndex = DefaultPreDelayFrames;
 
diff --git a/Source/WebCore/platform/audio/DynamicsCompressorKernel.h b/Source/WebCore/platform/audio/DynamicsCompressorKernel.h
index cf319b378..da8e4c8be 100644
--- a/Source/WebCore/platform/audio/DynamicsCompressorKernel.h
+++ b/Source/WebCore/platform/audio/DynamicsCompressorKernel.h
@@ -31,17 +31,21 @@
 
 #include "AudioArray.h"
 
+#include <wtf/OwnPtr.h>
+#include <wtf/PassOwnPtr.h>
+
 namespace WebCore {
 
 class DynamicsCompressorKernel {
 public:
-    DynamicsCompressorKernel(float sampleRate);
+    DynamicsCompressorKernel(float sampleRate, unsigned numberOfChannels);
+
+    void setNumberOfChannels(unsigned);
 
     // Performs stereo-linked compression.
-    void process(const float *sourceL,
-                 float *destinationL,
-                 const float *sourceR,
-                 float *destinationR,
+    void process(float* sourceChannels[],
+                 float* destinationChannels[],
+                 unsigned numberOfChannels,
                  unsigned framesToProcess,
 
                  float dbThreshold,
@@ -66,7 +70,7 @@ public:
 
 protected:
     float m_sampleRate;
-    
+
     float m_detectorAverage;
     float m_compressorGain;
 
@@ -81,8 +85,7 @@ protected:
     unsigned m_lastPreDelayFrames;
     void setPreDelayTime(float);
 
-    AudioFloatArray m_preDelayBufferL;
-    AudioFloatArray m_preDelayBufferR;
+    Vector<OwnPtr<AudioFloatArray> > m_preDelayBuffers;
     int m_preDelayReadIndex;
     int m_preDelayWriteIndex;
 
diff --git a/Source/WebCore/platform/audio/HRTFDatabaseLoader.cpp b/Source/WebCore/platform/audio/HRTFDatabaseLoader.cpp
index cb7355aa8..8f96c9694 100644
--- a/Source/WebCore/platform/audio/HRTFDatabaseLoader.cpp
+++ b/Source/WebCore/platform/audio/HRTFDatabaseLoader.cpp
@@ -80,13 +80,11 @@ HRTFDatabaseLoader::~HRTFDatabaseLoader()
 
 
 // Asynchronously load the database in this thread.
-static void* databaseLoaderEntry(void* threadData)
+static void databaseLoaderEntry(void* threadData)
 {
     HRTFDatabaseLoader* loader = reinterpret_cast<HRTFDatabaseLoader*>(threadData);
     ASSERT(loader);
     loader->load();
-    
-    return 0;
 }
 
 void HRTFDatabaseLoader::load()
@@ -121,7 +119,7 @@ void HRTFDatabaseLoader::waitForLoaderThreadCompletion()
     
     // waitForThreadCompletion() should not be called twice for the same thread.
     if (m_databaseLoaderThread)
-        waitForThreadCompletion(m_databaseLoaderThread, 0);
+        waitForThreadCompletion(m_databaseLoaderThread);
     m_databaseLoaderThread = 0;
 }
 
diff --git a/Source/WebCore/platform/audio/ReverbConvolver.cpp b/Source/WebCore/platform/audio/ReverbConvolver.cpp
index c611414cb..c6ab54e8e 100644
--- a/Source/WebCore/platform/audio/ReverbConvolver.cpp
+++ b/Source/WebCore/platform/audio/ReverbConvolver.cpp
@@ -53,11 +53,10 @@ const size_t RealtimeFrameLimit = 8192  + 4096; // ~278msec @ 44.1KHz
 const size_t MinFFTSize = 256;
 const size_t MaxRealtimeFFTSize = 2048;
 
-static void* backgroundThreadEntry(void* threadData)
+static void backgroundThreadEntry(void* threadData)
 {
     ReverbConvolver* reverbConvolver = static_cast<ReverbConvolver*>(threadData);
     reverbConvolver->backgroundThreadEntry();
-    return 0;
 }
 
 ReverbConvolver::ReverbConvolver(AudioChannel* impulseResponse, size_t renderSliceSize, size_t maxFFTSize, size_t convolverRenderPhase, bool useBackgroundThreads)
@@ -142,7 +141,7 @@ ReverbConvolver::~ReverbConvolver()
             m_backgroundThreadCondition.signal();
         }
 
-        waitForThreadCompletion(m_backgroundThread, 0);
+        waitForThreadCompletion(m_backgroundThread);
     }
 }
 
diff --git a/Source/WebCore/platform/audio/gstreamer/WebKitWebAudioSourceGStreamer.cpp b/Source/WebCore/platform/audio/gstreamer/WebKitWebAudioSourceGStreamer.cpp
index 2cae4acab..2228f41d0 100644
--- a/Source/WebCore/platform/audio/gstreamer/WebKitWebAudioSourceGStreamer.cpp
+++ b/Source/WebCore/platform/audio/gstreamer/WebKitWebAudioSourceGStreamer.cpp
@@ -93,7 +93,7 @@ static GstCaps* getGStreamerMonoAudioCaps(float sampleRate)
 
 static GstAudioChannelPosition webKitWebAudioGStreamerChannelPosition(int channelIndex)
 {
-    GstAudioChannelPosition position;
+    GstAudioChannelPosition position = GST_AUDIO_CHANNEL_POSITION_NONE;
 
     switch (channelIndex) {
     case AudioBus::ChannelLeft:
diff --git a/Source/WebCore/platform/audio/gtk/AudioBusGtk.cpp b/Source/WebCore/platform/audio/gtk/AudioBusGtk.cpp
index ade778f5b..f9d635b44 100644
--- a/Source/WebCore/platform/audio/gtk/AudioBusGtk.cpp
+++ b/Source/WebCore/platform/audio/gtk/AudioBusGtk.cpp
@@ -23,6 +23,8 @@
 #include "AudioBus.h"
 
 #include "AudioFileReader.h"
+#include "CString.h"
+#include "FileSystem.h"
 #include "GOwnPtr.h"
 
 #include <gio/gio.h>
@@ -33,7 +35,7 @@ namespace WebCore {
 PassOwnPtr<AudioBus> AudioBus::loadPlatformResource(const char* name, float sampleRate)
 {
     GOwnPtr<gchar> filename(g_strdup_printf("%s.wav", name));
-    GOwnPtr<gchar> absoluteFilename(g_build_filename(DATA_DIR, "webkitgtk-"WEBKITGTK_API_VERSION_STRING, "resources", "audio", filename.get(), NULL));
+    GOwnPtr<gchar> absoluteFilename(g_build_filename(sharedResourcesPath().data(), "resources", "audio", filename.get(), NULL));
 
     GFile* file = g_file_new_for_path(filename.get());
     if (!g_file_query_exists(file, 0)) {
diff --git a/Source/WebCore/platform/blackberry/ClipboardBlackBerry.cpp b/Source/WebCore/platform/blackberry/ClipboardBlackBerry.cpp
index 16127376e..b224d5cb0 100644
--- a/Source/WebCore/platform/blackberry/ClipboardBlackBerry.cpp
+++ b/Source/WebCore/platform/blackberry/ClipboardBlackBerry.cpp
@@ -19,6 +19,7 @@
 #include "config.h"
 #include "ClipboardBlackBerry.h"
 
+#include "DOMStringList.h"
 #include "FileList.h"
 #include "NotImplemented.h"
 
@@ -72,14 +73,14 @@ bool ClipboardBlackBerry::setData(const String& type, const String& text)
     return true;
 }
 
-HashSet<String> ClipboardBlackBerry::types() const
+PassRefPtr<DOMStringList> ClipboardBlackBerry::types() const
 {
     // We use hardcoded list here since there seems to be no API to get the list.
-    HashSet<String> ret;
-    ret.add("text/plain");
-    ret.add("text/html");
-    ret.add("text/url");
-    return ret;
+    RefPtr<DOMStringList> ret = DOMStringList::create();
+    ret->append("text/plain");
+    ret->append("text/html");
+    ret->append("text/url");
+    return ret.release();
 }
 
 PassRefPtr<FileList> ClipboardBlackBerry::files() const
diff --git a/Source/WebCore/platform/blackberry/ClipboardBlackBerry.h b/Source/WebCore/platform/blackberry/ClipboardBlackBerry.h
index 2f39f465e..255d6aa28 100644
--- a/Source/WebCore/platform/blackberry/ClipboardBlackBerry.h
+++ b/Source/WebCore/platform/blackberry/ClipboardBlackBerry.h
@@ -36,7 +36,7 @@ public:
     bool setData(const String& type, const String& data);
 
     // extensions beyond IE's API
-    virtual HashSet<String> types() const;
+    virtual PassRefPtr<DOMStringList> types() const;
     virtual PassRefPtr<FileList> files() const;
     virtual DragImageRef createDragImage(IntPoint&) const;
     virtual void declareAndWriteDragImage(Element*, const KURL&, const String& title, Frame*);
diff --git a/Source/WebCore/platform/blackberry/CookieDatabaseBackingStore/CookieDatabaseBackingStore.cpp b/Source/WebCore/platform/blackberry/CookieDatabaseBackingStore/CookieDatabaseBackingStore.cpp
new file mode 100644
index 000000000..7319cb045
--- /dev/null
+++ b/Source/WebCore/platform/blackberry/CookieDatabaseBackingStore/CookieDatabaseBackingStore.cpp
@@ -0,0 +1,522 @@
+/*
+ * Copyright (C) 2009 Julien Chaffraix <jchaffraix@pleyo.com>
+ * Copyright (C) 2010, 2011, 2012 Research In Motion Limited. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+*/
+#define ENABLE_COOKIE_DEBUG 0
+
+#include "config.h"
+#include "CookieDatabaseBackingStore.h"
+
+#include "CookieManager.h"
+#include "Logging.h"
+#include "ParsedCookie.h"
+#include "SQLiteStatement.h"
+#include "SQLiteTransaction.h"
+#include <wtf/text/StringBuilder.h>
+#include <wtf/text/WTFString.h>
+
+#if ENABLE_COOKIE_DEBUG
+#include <BlackBerryPlatformLog.h>
+#define CookieLog(format, ...) BlackBerry::Platform::logAlways(BlackBerry::Platform::LogLevelInfo, format, ## __VA_ARGS__)
+#else
+#define CookieLog(format, ...)
+#endif
+
+#include <BlackBerryPlatformExecutableMessage.h>
+
+using BlackBerry::Platform::MessageClient;
+using BlackBerry::Platform::TypedReplyBuffer;
+using BlackBerry::Platform::createMethodCallMessage;
+
+static const double s_databaseTimerInterval = 2;
+
+namespace WebCore {
+
+CookieDatabaseBackingStore::CookieDatabaseBackingStore()
+    : MessageClient(MessageClient::ReplyFeature | MessageClient::SyncFeature)
+    , m_tableName("cookies") // This is chosen to match Mozilla's table name.
+    , m_dbTimer(this, &CookieDatabaseBackingStore::sendChangesToDatabaseTimerFired)
+    , m_insertStatement(0)
+    , m_updateStatement(0)
+    , m_deleteStatement(0)
+{
+    m_dbTimerClient = new BlackBerry::Platform::GenericTimerClient(this);
+    m_dbTimer.setClient(m_dbTimerClient);
+
+    pthread_attr_t threadAttrs;
+    pthread_attr_init(&threadAttrs);
+    createThread("cookie_database", threadAttrs);
+}
+
+CookieDatabaseBackingStore::~CookieDatabaseBackingStore()
+{
+    delete m_dbTimerClient;
+    m_dbTimerClient = 0;
+    // FIXME: This object will never be deleted due to the set up of CookieManager (it's a singleton)
+    CookieLog("CookieBackingStore - Destructing");
+#ifndef NDEBUG
+    {
+        MutexLocker lock(m_mutex);
+        ASSERT(m_changedCookies.isEmpty());
+    }
+#endif
+}
+
+void CookieDatabaseBackingStore::upgradeTableIfNeeded(const String& databaseFields, const String& primaryKeyFields)
+{
+    ASSERT(isCurrentThread());
+
+    bool creationTimeExists = false;
+    bool protocolExists = false;
+
+    if (!m_db.tableExists(m_tableName))
+        return;
+
+    // Check if the existing table has the required database fields
+    {
+        String query = "PRAGMA table_info(" + m_tableName + ");";
+
+        SQLiteStatement statement(m_db, query);
+        if (statement.prepare()) {
+            LOG_ERROR("Cannot prepare statement to query cookie table info. sql:%s", query.utf8().data());
+            LOG_ERROR("SQLite Error Message: %s", m_db.lastErrorMsg());
+            return;
+        }
+
+        while (statement.step() == SQLResultRow) {
+            DEFINE_STATIC_LOCAL(String, creationTime, ("creationTime"));
+            DEFINE_STATIC_LOCAL(String, protocol, ("protocol"));
+            String name = statement.getColumnText(1);
+            if (name == creationTime)
+                creationTimeExists = true;
+            if (name == protocol)
+                protocolExists = true;
+            if (creationTimeExists && protocolExists)
+                return;
+        }
+        LOG(Network, "Need to update cookie table schema.");
+    }
+
+    // Drop and recreate the cookie table to update to the latest database fields.
+    // We do not use alter table - add column because that method cannot add primary keys.
+    Vector<String> commands;
+
+    // Backup existing table
+    String renameQuery = "ALTER TABLE " + m_tableName + " RENAME TO Backup_" + m_tableName + ";";
+    commands.append(renameQuery);
+
+    // Recreate the cookie table using the new database and primary key fields
+    String createTableQuery("CREATE TABLE ");
+    createTableQuery += m_tableName;
+    createTableQuery += " (" + databaseFields + ", " + primaryKeyFields + ");";
+    commands.append(createTableQuery);
+
+    // Copy the old data into the new table. If a column does not exists,
+    // we have to put a '' in the select statement to make the number of columns
+    // equal in the insert statement.
+    String migrationQuery("INSERT OR REPLACE INTO ");
+    migrationQuery += m_tableName;
+    migrationQuery += " SELECT *";
+    if (!creationTimeExists)
+        migrationQuery += ",''";
+    if (!protocolExists)
+        migrationQuery += ",''";
+    migrationQuery += " FROM Backup_" + m_tableName;
+    commands.append(migrationQuery);
+
+    // The new columns will be blank, set the new values.
+    if (!creationTimeExists) {
+        String setCreationTimeQuery = "UPDATE " + m_tableName + " SET creationTime = lastAccessed;";
+        commands.append(setCreationTimeQuery);
+    }
+
+    if (!protocolExists) {
+        String setProtocolQuery = "UPDATE " + m_tableName + " SET protocol = 'http' WHERE isSecure = '0';";
+        String setProtocolQuery2 = "UPDATE " + m_tableName + " SET protocol = 'https' WHERE isSecure = '1';";
+        commands.append(setProtocolQuery);
+        commands.append(setProtocolQuery2);
+    }
+
+    // Drop the backup table
+    String dropBackupQuery = "DROP TABLE IF EXISTS Backup_" + m_tableName + ";";
+    commands.append(dropBackupQuery);
+
+    SQLiteTransaction transaction(m_db, false);
+    transaction.begin();
+    size_t commandSize = commands.size();
+    for (size_t i = 0; i < commandSize; ++i) {
+        if (!m_db.executeCommand(commands[i])) {
+            LOG_ERROR("Failed to alter cookie table when executing sql:%s", commands[i].utf8().data());
+            LOG_ERROR("SQLite Error Message: %s", m_db.lastErrorMsg());
+            transaction.rollback();
+
+            // We should never get here, but if we do, rename the current cookie table for future restoration. This has the side effect of
+            // clearing the current cookie table, but that's better than continually hitting this case and hence never being able to use the
+            // cookie table.
+            ASSERT_NOT_REACHED();
+            String renameQuery = "ALTER TABLE " + m_tableName + " RENAME TO Backup2_" + m_tableName + ";";
+            if (!m_db.executeCommand(renameQuery)) {
+                LOG_ERROR("Failed to backup existing cookie table.");
+                LOG_ERROR("SQLite Error Message: %s", m_db.lastErrorMsg());
+            }
+            return;
+        }
+    }
+    transaction.commit();
+    LOG(Network, "Successfully updated cookie table schema.");
+}
+
+void CookieDatabaseBackingStore::open(const String& cookieJar)
+{
+    dispatchMessage(createMethodCallMessage(&CookieDatabaseBackingStore::invokeOpen, this, cookieJar));
+}
+
+void CookieDatabaseBackingStore::invokeOpen(const String& cookieJar)
+{
+    ASSERT(isCurrentThread());
+    if (m_db.isOpen())
+        close();
+
+    if (!m_db.open(cookieJar)) {
+        LOG_ERROR("Could not open the cookie database. No cookie will be stored!");
+        LOG_ERROR("SQLite Error Message: %s", m_db.lastErrorMsg());
+        return;
+    }
+
+    m_db.executeCommand("PRAGMA locking_mode=EXCLUSIVE;");
+    m_db.executeCommand("PRAGMA journal_mode=TRUNCATE;");
+
+    const String primaryKeyFields("PRIMARY KEY (protocol, host, path, name)");
+    const String databaseFields("name TEXT, value TEXT, host TEXT, path TEXT, expiry DOUBLE, lastAccessed DOUBLE, isSecure INTEGER, isHttpOnly INTEGER, creationTime DOUBLE, protocol TEXT");
+    // Update table to add the new column creationTime and protocol for backwards compatability.
+    upgradeTableIfNeeded(databaseFields, primaryKeyFields);
+
+    // Create table if not exsist in case that the upgradeTableIfNeeded() failed accidentally.
+    String createTableQuery("CREATE TABLE IF NOT EXISTS ");
+    createTableQuery += m_tableName;
+    // This table schema is compliant with Mozilla's.
+    createTableQuery += " (" + databaseFields + ", " + primaryKeyFields+");";
+
+    if (!m_db.executeCommand(createTableQuery)) {
+        LOG_ERROR("Could not create the table to store the cookies into. No cookie will be stored!");
+        LOG_ERROR("SQLite Error Message: %s", m_db.lastErrorMsg());
+        close();
+        return;
+    }
+
+    String insertQuery("INSERT OR REPLACE INTO ");
+    insertQuery += m_tableName;
+    insertQuery += " (name, value, host, path, expiry, lastAccessed, isSecure, isHttpOnly, creationTime, protocol) VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8, ?9, ?10);";
+
+    m_insertStatement = new SQLiteStatement(m_db, insertQuery);
+    if (m_insertStatement->prepare()) {
+        LOG_ERROR("Cannot save cookies");
+        LOG_ERROR("SQLite Error Message: %s", m_db.lastErrorMsg());
+    }
+
+    String updateQuery("UPDATE ");
+    updateQuery += m_tableName;
+    // The where statement is chosen to match CookieMap key.
+    updateQuery += " SET name = ?1, value = ?2, host = ?3, path = ?4, expiry = ?5, lastAccessed = ?6, isSecure = ?7, isHttpOnly = ?8, creationTime = ?9, protocol = ?10 where protocol = ?10 and name = ?1 and host = ?3 and path = ?4;";
+    m_updateStatement = new SQLiteStatement(m_db, updateQuery);
+
+    if (m_updateStatement->prepare()) {
+        LOG_ERROR("Cannot update cookies");
+        LOG_ERROR("SQLite Error Message: %s", m_db.lastErrorMsg());
+    }
+
+    String deleteQuery("DELETE FROM ");
+    deleteQuery += m_tableName;
+    // The where statement is chosen to match CookieMap key.
+    deleteQuery += " WHERE name=?1 and host=?2 and path=?3 and protocol=?4;";
+    m_deleteStatement = new SQLiteStatement(m_db, deleteQuery);
+
+    if (m_deleteStatement->prepare()) {
+        LOG_ERROR("Cannot delete cookies");
+        LOG_ERROR("SQLite Error Message: %s", m_db.lastErrorMsg());
+    }
+
+}
+
+void CookieDatabaseBackingStore::close()
+{
+    ASSERT(isCurrentThread());
+    CookieLog("CookieBackingStore - Closing");
+
+    size_t changedCookiesSize;
+    {
+        MutexLocker lock(m_mutex);
+        if (m_dbTimer.started())
+            m_dbTimer.stop();
+        changedCookiesSize = m_changedCookies.size();
+    }
+
+    if (changedCookiesSize > 0)
+        invokeSendChangesToDatabase();
+
+    delete m_insertStatement;
+    m_insertStatement = 0;
+    delete m_updateStatement;
+    m_updateStatement = 0;
+    delete m_deleteStatement;
+    m_deleteStatement = 0;
+
+    if (m_db.isOpen())
+        m_db.close();
+}
+
+void CookieDatabaseBackingStore::insert(const ParsedCookie* cookie)
+{
+    CookieLog("CookieBackingStore - adding inserting cookie %s to queue.", cookie->toString().utf8().data());
+    addToChangeQueue(cookie, Insert);
+}
+
+void CookieDatabaseBackingStore::update(const ParsedCookie* cookie)
+{
+    CookieLog("CookieBackingStore - adding updating cookie %s to queue.", cookie->toString().utf8().data());
+    addToChangeQueue(cookie, Update);
+}
+
+void CookieDatabaseBackingStore::remove(const ParsedCookie* cookie)
+{
+    CookieLog("CookieBackingStore - adding deleting cookie %s to queue.", cookie->toString().utf8().data());
+    addToChangeQueue(cookie, Delete);
+}
+
+void CookieDatabaseBackingStore::removeAll()
+{
+    dispatchMessage(createMethodCallMessage(&CookieDatabaseBackingStore::invokeRemoveAll, this));
+}
+
+void CookieDatabaseBackingStore::invokeRemoveAll()
+{
+    ASSERT(isCurrentThread());
+    if (!m_db.isOpen())
+        return;
+
+    CookieLog("CookieBackingStore - remove All cookies from backingstore");
+
+    {
+        MutexLocker lock(m_mutex);
+        m_changedCookies.clear();
+    }
+
+    String deleteQuery("DELETE FROM ");
+    deleteQuery += m_tableName;
+    deleteQuery += ";";
+
+    SQLiteStatement deleteStatement(m_db, deleteQuery);
+    if (deleteStatement.prepare()) {
+        LOG_ERROR("Could not prepare DELETE * statement");
+        LOG_ERROR("SQLite Error Message: %s", m_db.lastErrorMsg());
+        return;
+    }
+
+    if (!deleteStatement.executeCommand()) {
+        LOG_ERROR("Cannot delete cookie from database");
+        LOG_ERROR("SQLite Error Message: %s", m_db.lastErrorMsg());
+        return;
+    }
+}
+
+void CookieDatabaseBackingStore::getCookiesFromDatabase(Vector<ParsedCookie*>& stackOfCookies, unsigned int limit)
+{
+    // It is not a huge performance hit to wait on the reply here because this is only done once during setup and when turning off private mode.
+    TypedReplyBuffer< Vector<ParsedCookie*>* > replyBuffer(0);
+    dispatchMessage(createMethodCallMessageWithReturn(&CookieDatabaseBackingStore::invokeGetCookiesWithLimit, &replyBuffer, this, limit));
+    Vector<ParsedCookie*>* cookies = replyBuffer.pointer();
+    stackOfCookies.swap(*cookies);
+    delete cookies;
+}
+
+Vector<ParsedCookie*>* CookieDatabaseBackingStore::invokeGetCookiesWithLimit(unsigned int limit)
+{
+    ASSERT(isCurrentThread());
+
+    // Check that the table exists to avoid doing an unnecessary request.
+    if (!m_db.isOpen())
+        return 0;
+
+    StringBuilder selectQuery;
+    selectQuery.append("SELECT name, value, host, path, expiry, lastAccessed, isSecure, isHttpOnly, creationTime, protocol FROM ");
+    selectQuery.append(m_tableName);
+    if (limit > 0) {
+        selectQuery.append(" ORDER BY lastAccessed ASC");
+        selectQuery.append(" LIMIT " + String::number(limit));
+    }
+    selectQuery.append(";");
+
+    CookieLog("CookieBackingStore - invokeGetAllCookies with select query %s", selectQuery.toString().utf8().data());
+
+    SQLiteStatement selectStatement(m_db, selectQuery.toString());
+
+    if (selectStatement.prepare()) {
+        LOG_ERROR("Cannot retrieved cookies from the database");
+        LOG_ERROR("SQLite Error Message: %s", m_db.lastErrorMsg());
+        return 0;
+    }
+
+    Vector<ParsedCookie*>* cookies = new Vector<ParsedCookie*>;
+    while (selectStatement.step() == SQLResultRow) {
+        // There is a row to fetch
+
+        String name = selectStatement.getColumnText(0);
+        String value = selectStatement.getColumnText(1);
+        String domain = selectStatement.getColumnText(2);
+        String path = selectStatement.getColumnText(3);
+        double expiry = selectStatement.getColumnDouble(4);
+        double lastAccessed = selectStatement.getColumnDouble(5);
+        bool isSecure = selectStatement.getColumnInt(6);
+        bool isHttpOnly = selectStatement.getColumnInt(7);
+        double creationTime = selectStatement.getColumnDouble(8);
+        String protocol = selectStatement.getColumnText(9);
+
+        cookies->append(new ParsedCookie(name, value, domain, protocol, path, expiry, lastAccessed, creationTime, isSecure, isHttpOnly));
+    }
+
+    return cookies;
+}
+
+void CookieDatabaseBackingStore::sendChangesToDatabaseSynchronously()
+{
+    CookieLog("CookieBackingStore - sending to database immediately");
+    {
+        MutexLocker lock(m_mutex);
+        if (m_dbTimer.started())
+            m_dbTimer.stop();
+    }
+    dispatchSyncMessage(createMethodCallMessage(&CookieDatabaseBackingStore::invokeSendChangesToDatabase, this));
+}
+
+void CookieDatabaseBackingStore::sendChangesToDatabase(int nextInterval)
+{
+    MutexLocker lock(m_mutex);
+    if (!m_dbTimer.started()) {
+        CookieLog("CookieBackingStore - Starting one shot send to database");
+        m_dbTimer.start(nextInterval);
+    } else {
+#if !NDEBUG
+        CookieLog("CookieBackingStore - Timer already running, skipping this request");
+#endif
+    }
+}
+
+void CookieDatabaseBackingStore::sendChangesToDatabaseTimerFired()
+{
+    dispatchMessage(createMethodCallMessage(&CookieDatabaseBackingStore::invokeSendChangesToDatabase, this));
+}
+
+void CookieDatabaseBackingStore::invokeSendChangesToDatabase()
+{
+    ASSERT(isCurrentThread());
+
+    if (!m_db.isOpen()) {
+        LOG_ERROR("Timer Fired, but database is closed.");
+        return;
+    }
+
+    Vector<CookieAction> changedCookies;
+    {
+        MutexLocker lock(m_mutex);
+        changedCookies.swap(m_changedCookies);
+        ASSERT(m_changedCookies.isEmpty());
+    }
+
+    if (changedCookies.isEmpty()) {
+        CookieLog("CookieBackingStore - Timer fired, but no cookies in changelist");
+        return;
+    }
+    CookieLog("CookieBackingStore - Timer fired, sending changes to database. We have %d changes", changedCookies.size());
+    SQLiteTransaction transaction(m_db, false);
+    transaction.begin();
+
+    // Iterate through every element in the change list to make calls
+    // If error occurs, ignore it and continue to the next statement
+    size_t sizeOfChange = changedCookies.size();
+    for (size_t i = 0; i < sizeOfChange; i++) {
+        SQLiteStatement* m_statement;
+        const ParsedCookie cookie = changedCookies[i].first;
+        UpdateParameter action = changedCookies[i].second;
+
+        if (action == Delete) {
+            m_statement = m_deleteStatement;
+            CookieLog("CookieBackingStore - deleting cookie %s.", cookie.toString().utf8().data());
+
+            // Binds all the values
+            if (m_statement->bindText(1, cookie.name()) || m_statement->bindText(2, cookie.domain())
+                || m_statement->bindText(3, cookie.path()) || m_statement->bindText(4, cookie.protocol())) {
+                LOG_ERROR("Cannot bind cookie data to delete");
+                LOG_ERROR("SQLite Error Message: %s", m_db.lastErrorMsg());
+                ASSERT_NOT_REACHED();
+                continue;
+            }
+        } else {
+            if (action == Update) {
+                CookieLog("CookieBackingStore - updating cookie %s.", cookie.toString().utf8().data());
+                m_statement = m_updateStatement;
+            } else {
+                CookieLog("CookieBackingStore - inserting cookie %s.", cookie.toString().utf8().data());
+                m_statement = m_insertStatement;
+            }
+
+            // Binds all the values
+            if (m_statement->bindText(1, cookie.name()) || m_statement->bindText(2, cookie.value())
+                || m_statement->bindText(3, cookie.domain()) || m_statement->bindText(4, cookie.path())
+                || m_statement->bindDouble(5, cookie.expiry()) || m_statement->bindDouble(6, cookie.lastAccessed())
+                || m_statement->bindInt64(7, cookie.isSecure()) || m_statement->bindInt64(8, cookie.isHttpOnly())
+                || m_statement->bindDouble(9, cookie.creationTime()) || m_statement->bindText(10, cookie.protocol())) {
+                LOG_ERROR("Cannot bind cookie data to save");
+                LOG_ERROR("SQLite Error Message: %s", m_db.lastErrorMsg());
+                ASSERT_NOT_REACHED();
+                continue;
+            }
+        }
+
+        int rc = m_statement->step();
+        m_statement->reset();
+        if (rc != SQLResultOk && rc != SQLResultDone) {
+            LOG_ERROR("Cannot make call to the database");
+            LOG_ERROR("SQLite Error Message: %s", m_db.lastErrorMsg());
+            ASSERT_NOT_REACHED();
+            continue;
+        }
+    }
+    transaction.commit();
+    CookieLog("CookieBackingStore - transaction complete");
+}
+
+void CookieDatabaseBackingStore::addToChangeQueue(const ParsedCookie* changedCookie, UpdateParameter actionParam)
+{
+    ASSERT(!changedCookie->isSession());
+    ParsedCookie cookieCopy(changedCookie);
+    CookieAction action(cookieCopy, actionParam);
+    {
+        MutexLocker lock(m_mutex);
+        m_changedCookies.append(action);
+        CookieLog("CookieBackingStore - m_changedcookies has %d.", m_changedCookies.size());
+    }
+    sendChangesToDatabase(s_databaseTimerInterval);
+}
+
+} // namespace WebCore
diff --git a/Source/WebCore/platform/blackberry/CookieDatabaseBackingStore/CookieDatabaseBackingStore.h b/Source/WebCore/platform/blackberry/CookieDatabaseBackingStore/CookieDatabaseBackingStore.h
new file mode 100644
index 000000000..b9b7decdd
--- /dev/null
+++ b/Source/WebCore/platform/blackberry/CookieDatabaseBackingStore/CookieDatabaseBackingStore.h
@@ -0,0 +1,109 @@
+/*
+ * Copyright (C) 2009 Julien Chaffraix <jchaffraix@pleyo.com>
+ * Copyright (C) 2011, 2012 Research In Motion Limited. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef CookieDatabaseBackingStore_h
+#define CookieDatabaseBackingStore_h
+
+#include "PlatformString.h"
+#include "SQLiteDatabase.h"
+#include "Timer.h"
+
+#include <BlackBerryPlatformMessageClient.h>
+#include <BlackBerryPlatformTimer.h>
+#include <GenericTimerClient.h>
+#include <ThreadTimerClient.h>
+#include <wtf/ThreadingPrimitives.h>
+#include <wtf/Vector.h>
+#include <wtf/text/StringHash.h>
+
+namespace WebCore {
+
+class ParsedCookie;
+
+class CookieDatabaseBackingStore : public BlackBerry::Platform::MessageClient
+                                 , public BlackBerry::Platform::ThreadTimerClient {
+public:
+    static CookieDatabaseBackingStore* create() { return new CookieDatabaseBackingStore; }
+
+    void open(const String& cookieJar);
+
+    void insert(const ParsedCookie*);
+    void update(const ParsedCookie*);
+    void remove(const ParsedCookie*);
+
+    void removeAll();
+
+    // If a limit is not set, the method will return all cookies in the database
+    void getCookiesFromDatabase(Vector<ParsedCookie*>& stackOfCookies, unsigned int limit = 0);
+
+    void sendChangesToDatabaseSynchronously();
+
+    // ThreadTimerClient methods
+    virtual bool willFireTimer() { return true; }
+    virtual int getPulseCode() const { return pulseCode(); }
+    virtual int getConnectionId() const { return connectionId(); }
+    virtual int defaultTimerPriority() const { return threadPriority(); }
+
+private:
+    enum UpdateParameter {
+        Insert,
+        Update,
+        Delete,
+    };
+
+    CookieDatabaseBackingStore();
+    ~CookieDatabaseBackingStore();
+
+    void addToChangeQueue(const ParsedCookie* changedCookie, UpdateParameter actionParam);
+    void sendChangesToDatabase(int interval);
+    void sendChangesToDatabaseTimerFired();
+    void upgradeTableIfNeeded(const String& databaseSchema, const String& primarykeyFields);
+
+    void invokeOpen(const String& cookieJar);
+    void invokeRemoveAll();
+    Vector<ParsedCookie*>* invokeGetCookiesWithLimit(unsigned int limit);
+    void invokeSendChangesToDatabase();
+
+    void close();
+
+    typedef pair<const ParsedCookie, UpdateParameter> CookieAction;
+    Vector<CookieAction> m_changedCookies;
+    Mutex m_mutex;
+
+    String m_tableName;
+    BlackBerry::Platform::Timer<CookieDatabaseBackingStore> m_dbTimer;
+    BlackBerry::Platform::GenericTimerClient* m_dbTimerClient;
+    SQLiteDatabase m_db;
+    SQLiteStatement *m_insertStatement;
+    SQLiteStatement *m_updateStatement;
+    SQLiteStatement *m_deleteStatement;
+};
+
+CookieDatabaseBackingStore& cookieBackingStore();
+
+} // namespace WebCore
+
+#endif // CookieDatabaseBackingStore_h
diff --git a/Source/WebCore/platform/blackberry/CookieJarBlackBerry.cpp b/Source/WebCore/platform/blackberry/CookieJarBlackBerry.cpp
new file mode 100644
index 000000000..395c6af27
--- /dev/null
+++ b/Source/WebCore/platform/blackberry/CookieJarBlackBerry.cpp
@@ -0,0 +1,110 @@
+/*
+ * Copyright (C) 2011, 2012 Research In Motion Limited. All rights reserved.
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Lesser General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Lesser General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Lesser General Public
+ *  License along with this library; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ * Copyright (C) 2009 Torch Mobile Inc. http://www.torchmobile.com/
+ * Copyright (C) Research In Motion Limited 2010-2011. All rights reserved.
+ */
+
+#include "config.h"
+#include "CookieJar.h"
+
+#include "Cookie.h"
+#include "CookieManager.h"
+#include "Document.h"
+#include "Frame.h"
+#include "FrameLoaderClientBlackBerry.h"
+#include "KURL.h"
+#include "NotImplemented.h"
+#include "Page.h"
+#include "PageGroupLoadDeferrer.h"
+#include "Settings.h"
+#include <wtf/text/CString.h>
+
+namespace WebCore {
+
+String cookies(Document const* document, KURL const& url)
+{
+    Frame* frame = document->frame();
+    Page* page = frame ? frame->page() : 0;
+
+    if (!page)
+        return String();
+
+    if (!(frame && frame->loader() && frame->loader()->client()))
+        return String();
+
+    if (!static_cast<FrameLoaderClientBlackBerry*>(frame->loader()->client())->cookiesEnabled())
+        return String();
+
+    ASSERT(document && url == document->cookieURL());
+    // 'HttpOnly' cookies should no be accessible from scripts, so we filter them out here
+    return cookieManager().getCookie(url, NoHttpOnlyCookie);
+}
+
+void setCookies(Document* document, KURL const& url, String const& value)
+{
+    Frame* frame = document->frame();
+    Page* page = frame ? frame->page() : 0;
+
+    if (!page)
+        return;
+
+    if (!(frame && frame->loader() && frame->loader()->client()))
+        return;
+
+    if (!static_cast<FrameLoaderClientBlackBerry*>(frame->loader()->client())->cookiesEnabled())
+        return;
+
+    ASSERT(document && url == document->cookieURL());
+    cookieManager().setCookies(url, value);
+}
+
+bool cookiesEnabled(Document const*)
+{
+    // FIXME. Currently cookie is enabled by default, no setting on property page.
+    return true;
+}
+
+bool getRawCookies(const Document* document, const KURL& url, Vector<Cookie>& rawCookies)
+{
+    Vector<ParsedCookie*> result;
+    cookieManager().getRawCookies(result, url, WithHttpOnlyCookies);
+    for (size_t i = 0; i < result.size(); i++)
+        result[i]->appendWebCoreCookie(rawCookies);
+    return true;
+}
+
+void deleteCookie(const Document* document, const KURL& url, const String& cookieName)
+{
+    // Cookies are not bound to the document. Therefore, we don't need to pass
+    // in the document object to find the targeted cookies in cookie manager.
+    cookieManager().removeCookieWithName(url, cookieName);
+}
+
+String cookieRequestHeaderFieldValue(const Document* document, const KURL &url)
+{
+    ASSERT(document);
+
+    if (!(document->frame() && document->frame()->loader() && document->frame()->loader()->client()))
+        return String();
+
+    if (!static_cast<FrameLoaderClientBlackBerry*>(document->frame()->loader()->client())->cookiesEnabled())
+        return String();
+
+    return cookieManager().getCookie(url, WithHttpOnlyCookies);
+}
+
+} // namespace WebCore
diff --git a/Source/WebCore/platform/blackberry/CookieManager.cpp b/Source/WebCore/platform/blackberry/CookieManager.cpp
new file mode 100644
index 000000000..d79380fd9
--- /dev/null
+++ b/Source/WebCore/platform/blackberry/CookieManager.cpp
@@ -0,0 +1,598 @@
+/*
+ * Copyright (C) 2008, 2009 Julien Chaffraix <julien.chaffraix@gmail.com>
+ * Copyright (C) 2010, 2011, 2012 Research In Motion Limited. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#define ENABLE_COOKIE_DEBUG 0
+#define ENABLE_COOKIE_SUPER_VERBOSE_DEBUG 0
+#define ENABLE_COOKIE_LIMIT_DEBUG 0
+
+#include "config.h"
+#include "CookieManager.h"
+
+#include "CookieDatabaseBackingStore.h"
+#include "CookieParser.h"
+#include "CurrentTime.h"
+#include "FileSystem.h"
+#include "Logging.h"
+#include "WebSettings.h"
+#include <BlackBerryPlatformClient.h>
+#include <BlackBerryPlatformExecutableMessage.h>
+#include <BlackBerryPlatformMessageClient.h>
+#include <BlackBerryPlatformNavigatorHandler.h>
+#include <stdlib.h>
+#include <wtf/text/CString.h>
+#include <wtf/text/StringBuilder.h>
+#include <wtf/text/WTFString.h>
+
+#if ENABLE_COOKIE_DEBUG
+#include <BlackBerryPlatformLog.h>
+#endif
+
+#if ENABLE_COOKIE_SUPER_VERBOSE_DEBUG
+#define CookieLog(format, ...) BlackBerry::Platform::logAlways(BlackBerry::Platform::LogLevelInfo, format, ## __VA_ARGS__)
+#else
+#define CookieLog(format, ...)
+#endif // ENABLE_COOKIE_SUPER_VERBOSE_DEBUG
+
+#if ENABLE_COOKIE_LIMIT_DEBUG
+#define CookieLimitLog(format, ...) BlackBerry::Platform::logAlways(BlackBerry::Platform::LogLevelInfo, format, ## __VA_ARGS__)
+#else
+#define CookieLimitLog(format, ...)
+#endif // ENABLE_COOKIE_LIMIT_DEBUG
+
+namespace WebCore {
+
+// Max count constants.
+static const unsigned s_globalMaxCookieCount = 6000;
+static const unsigned s_maxCookieCountPerHost = 60;
+static const unsigned s_cookiesToDeleteWhenLimitReached = 60;
+static const unsigned s_delayToStartCookieCleanup = 10;
+
+static void flushCookiesOnExit(void)
+{
+    cookieManager().flushCookiesToBackingStore();
+}
+
+CookieManager& cookieManager()
+{
+    static CookieManager *cookieManager = 0;
+    if (!cookieManager) {
+        // Open the cookieJar now and get the backing store cookies to fill the manager.
+        cookieManager = new CookieManager;
+        cookieManager->m_cookieBackingStore->open(cookieManager->cookieJar());
+        cookieManager->getBackingStoreCookies();
+        CookieLog("CookieManager - Backingstore load complete.\n");
+
+        atexit(&flushCookiesOnExit);
+    }
+    return *cookieManager;
+}
+
+CookieManager::CookieManager()
+    : m_count(0)
+    , m_privateMode(false)
+    , m_shouldDumpAllCookies(false)
+    , m_cookieJarFileName(pathByAppendingComponent(BlackBerry::Platform::Client::get()->getApplicationDataDirectory().c_str(), "/cookieCollection.db"))
+    , m_policy(CookieStorageAcceptPolicyAlways)
+    , m_cookieBackingStore(CookieDatabaseBackingStore::create())
+    , m_limitTimer(this, &CookieManager::cookieLimitCleanUp)
+{
+}
+
+CookieManager::~CookieManager()
+{
+    removeAllCookies(DoNotRemoveFromBackingStore);
+    // FIXME: m_managerMap and the top layer protocolMaps are not properly deleted.
+    // Do not delete any protocol maps to avoid double-deletion of the maps that are
+    // being used for both secure and non-secure protocols; this leak is OK since
+    // there's nothing important in the hashtable destructors, and the memory will be reclaimed on exit
+
+    // FIXME: CookieDatabaseBackingStore is not deleted, only flushed
+    // (currently the destructor is never called since this class is a
+    // singleton; on exit, the db is flushed manually. This call is only here
+    // as a fallback in case this class is made a non-singleton.
+    m_cookieBackingStore->sendChangesToDatabaseSynchronously();
+}
+
+// Sorting logic is based on Cookie Spec RFC6265, section 5.4.2
+static bool cookieSorter(ParsedCookie* a, ParsedCookie* b)
+{
+    if (a->path().length() == b->path().length())
+        return a->creationTime() <= b->creationTime();
+    return a->path().length() > b->path().length();
+}
+
+// Returns whether the protocol supports domains
+static bool shouldIgnoreDomain(const String protocol)
+{
+    // ignore domain security for file and local
+    return protocol == "file" || protocol == "local";
+}
+
+void CookieManager::setCookies(const KURL& url, const String& value)
+{
+    CookieLog("CookieManager - Setting cookies");
+    CookieParser parser(url);
+    Vector<ParsedCookie*> cookies = parser.parse(value);
+
+    for (size_t i = 0; i < cookies.size(); ++i) {
+        ParsedCookie* cookie = cookies[i];
+        if (!shouldRejectForSecurityReason(cookie, url)) {
+            BackingStoreRemovalPolicy treatment = m_privateMode ? DoNotRemoveFromBackingStore : RemoveFromBackingStore;
+            checkAndTreatCookie(cookie, treatment);
+        } else
+            delete cookie;
+    }
+}
+
+bool CookieManager::shouldRejectForSecurityReason(const ParsedCookie* cookie, const KURL& url)
+{
+    // We have to disable the following check because sites like Facebook and
+    // Gmail currently do not follow the spec.
+#if 0
+    // Check if path attribute is a prefix of the request URI.
+    if (!url.path().startsWith(cookie->path())) {
+        LOG_ERROR("Cookie %s is rejected because its path does not math the URL %s\n", cookie->toString().utf8().data(), url.string().utf8().data());
+        return true;
+    }
+#endif
+
+    // ignore domain security if protocol doesn't have domains
+    if (shouldIgnoreDomain(cookie->protocol()))
+        return false;
+
+    // Reject Cookie if domain is empty
+    if (!cookie->domain().length())
+        return true;
+
+    if (!cookie->hasDefaultDomain()) {
+        // Check if the domain contains an embedded dot.
+        int dotPosition = cookie->domain().find(".", 1);
+        if (dotPosition == -1 || static_cast<unsigned int>(dotPosition) == cookie->domain().length()) {
+            LOG_ERROR("Cookie %s is rejected because its domain does not contain an embedded dot.\n", cookie->toString().utf8().data());
+            return true;
+        }
+    }
+
+    // The request host should domain match the Domain attribute.
+    // Domain string starts with a dot, so a.b.com should domain match .a.b.com.
+    // add a "." at beginning of host name, because it can handle many cases such as
+    // a.b.com matches b.com, a.b.com matches .B.com and a.b.com matches .A.b.Com
+    // and so on.
+    String hostDomainName = url.host();
+    hostDomainName = hostDomainName.startsWith(".") ? hostDomainName : "." + hostDomainName;
+    if (!hostDomainName.endsWith(cookie->domain(), false)) {
+        LOG_ERROR("Cookie %s is rejected because its domain does not domain match the URL %s\n", cookie->toString().utf8().data(), url.string().utf8().data());
+        return true;
+    }
+    // We should check for an embedded dot in the portion of string in the host not in the domain
+    // but to match firefox behaviour we do not.
+
+    return false;
+}
+
+String CookieManager::getCookie(const KURL& url, CookieFilter filter) const
+{
+    Vector<ParsedCookie*> rawCookies;
+    rawCookies.reserveInitialCapacity(s_maxCookieCountPerHost);
+
+    // Retrieve cookies related to this url
+    getRawCookies(rawCookies, url, filter);
+
+    CookieLog("CookieManager - there are %d cookies in raw cookies\n", rawCookies.size());
+
+    // Generate the cookie header string using the retrieved cookies
+    StringBuilder cookieStringBuilder;
+    cookieStringBuilder.reserveCapacity(512);
+    size_t cookieSize = rawCookies.size();
+    for (size_t i = 0; i < cookieSize; i++) {
+        cookieStringBuilder.append(rawCookies[i]->toNameValuePair());
+        if (i != cookieSize-1)
+            cookieStringBuilder.append("; ");
+    }
+
+    CookieLog("CookieManager - cookieString is - %s\n", cookieStringBuilder.toString().utf8().data());
+
+    return cookieStringBuilder.toString();
+}
+
+void CookieManager::getRawCookies(Vector<ParsedCookie*> &stackOfCookies, const KURL& requestURL, CookieFilter filter) const
+{
+    CookieLog("CookieManager - getRawCookies - processing url with domain - %s & protocol: %s & path: %s\n", requestURL.host().utf8().data(), requestURL.protocol().utf8().data(), requestURL.path().utf8().data());
+
+    bool specialCaseForLocal = (requestURL.protocolIs("local") || requestURL.protocolIs("file")) && m_shouldDumpAllCookies;
+    bool isConnectionSecure = requestURL.protocolIs("https") || requestURL.protocolIs("wss") || specialCaseForLocal;
+
+    Vector<ParsedCookie*> cookieCandidates;
+    Vector<CookieMap*> protocolsToSearch;
+
+    if (specialCaseForLocal)
+        copyValuesToVector(m_managerMap, protocolsToSearch);
+    else {
+        protocolsToSearch.append(m_managerMap.get(requestURL.protocol()));
+        // FIXME: this is a hack for webworks apps; RFC 6265 says "Cookies do not provide isolation by scheme"
+        // so we should not be checking protocols at all. See PR 135595
+        if (m_shouldDumpAllCookies) {
+            protocolsToSearch.append(m_managerMap.get("file"));
+            protocolsToSearch.append(m_managerMap.get("local"));
+       }
+    }
+
+    Vector<String> delimitedHost;
+    requestURL.host().lower().split(".", true, delimitedHost);
+
+    // Go through all the protocol trees that we need to search for
+    // and get all cookies that are valid for this domain
+    for (size_t k = 0; k < protocolsToSearch.size(); k++) {
+        CookieMap* currentMap = protocolsToSearch[k];
+
+        // if no cookies exist for this protocol, break right away
+        if (!currentMap)
+            continue;
+
+        CookieLog("CookieManager - looking at protocol map %s \n", currentMap->getName().utf8().data());
+
+        // Special case for local and files - because WebApps expect to get ALL cookies from the backing-store on local protocol
+        if (specialCaseForLocal) {
+            CookieLog("CookieManager - special case find in protocol map - %s\n", currentMap->getName().utf8().data());
+            currentMap->getAllChildCookies(&cookieCandidates);
+        } else {
+            // Get cookies from the null domain map
+            currentMap->getAllCookies(&cookieCandidates);
+
+            // Get cookies from the valid domain maps
+            int i = delimitedHost.size() - 1;
+            while (i >= 0) {
+                CookieLog("CookieManager - finding %s in currentmap\n", delimitedHost[i].utf8().data());
+                currentMap = currentMap->getSubdomainMap(delimitedHost[i]);
+                // if this subdomain/domain does not exist in our mapping then we simply exit
+                if (!currentMap) {
+                    CookieLog("CookieManager - cannot find next map exiting the while loop.\n");
+                    break;
+                }
+                CookieLog("CookieManager - found the map, grabbing cookies from this map\n");
+                currentMap->getAllCookies(&cookieCandidates);
+                i--;
+            }
+        }
+    }
+
+    CookieLog("CookieManager - there are %d cookies in candidate\n", cookieCandidates.size());
+
+    for (size_t i = 0; i < cookieCandidates.size(); ++i) {
+        ParsedCookie* cookie = cookieCandidates[i];
+
+        // According to the path-matches rules in RFC6265, section 5.1.4,
+        // we should add a '/' at the end of cookie-path for comparison if the cookie-path is not end with '/'.
+        String path = cookie->path();
+        CookieLog("CookieManager - comparing cookie path %s (len %d) to request path %s (len %d)", path.utf8().data(), path.length(), requestURL.path().utf8().data(), path.length());
+        if (!equalIgnoringCase(path, requestURL.path()) && !path.endsWith("/", false))
+            path += "/";
+
+        // Only secure connections have access to secure cookies. Unless specialCaseForLocal is true
+        // Get the cookies filtering out HttpOnly cookies if requested.
+        if (requestURL.path().startsWith(path, false) && (isConnectionSecure || !cookie->isSecure()) && (filter == WithHttpOnlyCookies || !cookie->isHttpOnly())) {
+            CookieLog("CookieManager - cookie chosen - %s\n", cookie->toString().utf8().data());
+            cookie->setLastAccessed(currentTime());
+            stackOfCookies.append(cookie);
+        }
+    }
+
+    std::sort(stackOfCookies.begin(), stackOfCookies.end(), cookieSorter);
+}
+
+void CookieManager::removeAllCookies(BackingStoreRemovalPolicy backingStoreRemoval)
+{
+    HashMap<String, CookieMap*>::iterator first = m_managerMap.begin();
+    HashMap<String, CookieMap*>::iterator end = m_managerMap.end();
+    for (HashMap<String, CookieMap*>::iterator it = first; it != end; ++it)
+        it->second->deleteAllCookiesAndDomains();
+
+    if (backingStoreRemoval == RemoveFromBackingStore)
+        m_cookieBackingStore->removeAll();
+    m_count = 0;
+}
+
+void CookieManager::setCookieJar(const char* fileName)
+{
+    m_cookieJarFileName = String(fileName);
+    m_cookieBackingStore->open(m_cookieJarFileName);
+}
+
+void CookieManager::checkAndTreatCookie(ParsedCookie* candidateCookie, BackingStoreRemovalPolicy postToBackingStore)
+{
+    CookieLog("CookieManager - checkAndTreatCookie - processing url with domain - %s & protocol %s\n", candidateCookie->domain().utf8().data(), candidateCookie->protocol().utf8().data());
+
+    const bool ignoreDomain = shouldIgnoreDomain(candidateCookie->protocol());
+
+    // Determine which protocol tree to add the cookie to. Create one if necessary.
+    CookieMap* curMap = 0;
+    if (m_managerMap.contains(candidateCookie->protocol()))
+        curMap = m_managerMap.get(candidateCookie->protocol());
+    else {
+        // Check if it is a secure version, if it is, link it to the non-secure version
+        // Link curMap to the new protocol as well as the old one if it doesn't exist
+        if (candidateCookie->protocol() == "https") {
+            curMap = m_managerMap.get("http");
+            if (!curMap) {
+                curMap = new CookieMap("http");
+                m_managerMap.add("http", curMap);
+            }
+        } else if (candidateCookie->protocol() == "wss") {
+            curMap = m_managerMap.get("ws");
+            if (!curMap) {
+                curMap = new CookieMap("ws");
+                m_managerMap.add("ws", curMap);
+            }
+        } else
+            curMap = new CookieMap(candidateCookie->protocol());
+
+        CookieLog("CookieManager - adding protocol cookiemap - %s\n", curMap->getName().utf8().data());
+
+        m_managerMap.add(candidateCookie->protocol(), curMap);
+    }
+
+    // If protocol support domain, we have to traverse the domain tree to find the right
+    // cookieMap to handle with
+    if (!ignoreDomain)
+        curMap = findOrCreateCookieMap(curMap, candidateCookie->domain(), candidateCookie->hasExpired());
+
+    // Now that we have the proper map for this cookie, we can modify it
+    // If cookie does not exist and has expired, delete it
+    // If cookie exists and it has expired, so we must remove it from the map, if not update it
+    // If cookie expired and came from the BackingStore (therefore does not exist), we have to remove from database
+    // If cookie does not exist & it's valid, add it to the current map
+
+    if (candidateCookie->hasExpired() || candidateCookie->isForceExpired()) {
+        // Special case for getBackingStoreCookies() to catch expired cookies
+        if (postToBackingStore == BackingStoreCookieEntry)
+            m_cookieBackingStore->remove(candidateCookie);
+        else if (curMap) {
+            bool cookieAlreadyExists = curMap->existsCookie(candidateCookie);
+            if (cookieAlreadyExists) {
+                CookieLog("CookieManager - expired cookie exists in memory");
+                ParsedCookie* expired = curMap->removeCookie(candidateCookie);
+                // Cookie is useless, Remove the cookie from the backingstore if it exists
+                // Backup check for BackingStoreCookieEntry incase someone incorrectly uses this enum
+                if (postToBackingStore != BackingStoreCookieEntry && !expired->isSession()) {
+                    CookieLog("CookieManager - expired cookie is nonsession, deleting from db");
+                    m_cookieBackingStore->remove(expired);
+                }
+                delete expired;
+            }
+        } else
+            delete candidateCookie;
+    } else {
+        ASSERT(curMap);
+        bool cookieAlreadyExists = curMap->existsCookie(candidateCookie);
+        if (cookieAlreadyExists)
+            update(curMap, candidateCookie, postToBackingStore);
+        else
+            addCookieToMap(curMap, candidateCookie, postToBackingStore);
+    }
+}
+
+void CookieManager::addCookieToMap(CookieMap* targetMap, ParsedCookie* candidateCookie, BackingStoreRemovalPolicy postToBackingStore)
+{
+    ParsedCookie* oldestCookie = 0;
+    // Check if we have not reached the per cookie domain limit.
+    // If that is not true, we check if the global limit has been reached if backingstore mode is on
+    // Two points:
+    // 1) We only do a global check if backingstore mode is on because the global cookie limit only
+    //    counts session cookies that are saved in the database. If the user goes over the limit
+    //    when they are in private mode, we know that the total cookie limit will be under the limit
+    //    once the user goes back to normal mode (memory deleted and reloaded from the database)
+    // 2) We use else if for this statement because if we remove a cookie in the 1st statement
+    //    then it means the global count will never exceed the limit
+
+    CookieLimitLog("CookieManager - local count: %d  global count: %d", targetMap->count(), m_count);
+    if (targetMap->count() >= s_maxCookieCountPerHost) {
+        CookieLog("CookieManager - deleting oldest cookie from this map due to domain count.\n");
+        oldestCookie = targetMap->removeOldestCookie();
+    } else if (m_count >= s_globalMaxCookieCount && (postToBackingStore != DoNotRemoveFromBackingStore)) {
+        CookieLimitLog("CookieManager - Global limit reached, initiate cookie limit clean up.");
+        initiateCookieLimitCleanUp();
+    }
+
+    CookieLog("CookieManager - adding new cookie - %s.\n", candidateCookie->toString().utf8().data());
+
+    targetMap->addCookie(candidateCookie);
+
+    // Only add non session cookie to the backing store.
+    if (postToBackingStore == RemoveFromBackingStore) {
+        if (oldestCookie && !oldestCookie->isSession()) {
+            CookieLog("CookieManager - oldestCookie exists, deleting it from backingstore and destructing.\n");
+            m_cookieBackingStore->remove(oldestCookie);
+        }
+        if (!candidateCookie->isSession())
+            m_cookieBackingStore->insert(candidateCookie);
+    }
+    if (oldestCookie)
+        delete oldestCookie;
+}
+
+void CookieManager::update(CookieMap* targetMap, ParsedCookie* newCookie, BackingStoreRemovalPolicy postToBackingStore)
+{
+    // If old cookie is non-session and new one is, we have to delete it from backingstore
+    // If new cookie is non-session and old one is, we have to add it to backingstore
+    // If both sessions are non-session, then we update it in the backingstore
+
+    CookieLog("CookieManager - updating new cookie - %s.\n", newCookie->toString().utf8().data());
+
+    ParsedCookie* oldCookie = targetMap->updateCookie(newCookie);
+
+    ASSERT(oldCookie);
+
+    if (postToBackingStore == RemoveFromBackingStore) {
+        bool newIsSession = newCookie->isSession();
+        bool oldIsSession = oldCookie->isSession();
+        if (!newIsSession && !oldIsSession)
+            m_cookieBackingStore->update(newCookie);
+        else if (newIsSession && !oldIsSession) {
+            // Must manually decrease the counter because it was not counted when
+            // the cookie was removed in cookieMap.
+            removedCookie();
+            m_cookieBackingStore->remove(oldCookie);
+        } else if (!newIsSession && oldIsSession) {
+            // Must manually increase the counter because it was not counted when
+            // the cookie was added in cookieMap.
+            addedCookie();
+            m_cookieBackingStore->insert(newCookie);
+        }
+    }
+    delete oldCookie;
+}
+
+void CookieManager::getBackingStoreCookies()
+{
+    // This method should be called just after having created the cookieManager
+    // NEVER afterwards!
+    ASSERT(!m_count);
+
+    Vector<ParsedCookie*> cookies;
+    m_cookieBackingStore->getCookiesFromDatabase(cookies);
+    CookieLog("CookieManager - Backingstore has %d cookies, loading them in memory now", cookies.size());
+    for (size_t i = 0; i < cookies.size(); ++i) {
+        ParsedCookie* newCookie = cookies[i];
+        checkAndTreatCookie(newCookie, BackingStoreCookieEntry);
+    }
+}
+
+void CookieManager::setPrivateMode(const bool mode)
+{
+    if (m_privateMode == mode)
+        return;
+
+    m_privateMode = mode;
+    if (!mode) {
+        removeAllCookies(DoNotRemoveFromBackingStore);
+        getBackingStoreCookies();
+    }
+}
+
+CookieMap* CookieManager::findOrCreateCookieMap(CookieMap* protocolMap, const String& domain, bool findOnly)
+{
+    // Explode the domain with the '.' delimiter
+    Vector<String> delimitedHost;
+    domain.split(".", delimitedHost);
+
+    CookieMap* curMap = protocolMap;
+    size_t hostSize = delimitedHost.size();
+
+    CookieLog("CookieManager - looking at protocol map %s \n", protocolMap->getName().utf8().data());
+
+    // Find & create necessary CookieMaps by traversing down the domain tree
+    // Each CookieMap represent a subsection of the domain, delimited by "."
+    int i = hostSize - 1;
+    while (i >= 0) {
+        CookieLog("CookieManager - finding %s in currentmap\n", delimitedHost[i].utf8().data());
+        CookieMap* nextMap = curMap->getSubdomainMap(delimitedHost[i]);
+        if (!nextMap) {
+            CookieLog("CookieManager - cannot find map\n");
+            if (findOnly)
+                return 0;
+            CookieLog("CookieManager - creating %s in currentmap %s\n", delimitedHost[i].utf8().data(), curMap->getName().utf8().data());
+            nextMap = new CookieMap(delimitedHost[i]);
+            CookieLog("CookieManager - adding subdomain to map\n");
+            curMap->addSubdomainMap(delimitedHost[i], nextMap);
+        }
+        curMap = nextMap;
+        i--;
+    }
+    return curMap;
+}
+
+
+void CookieManager::removeCookieWithName(const KURL& url, const String& cookieName)
+{
+    // We get all cookies from all domains that domain matches the request domain
+    // and delete any cookies with the specified name that path matches the request path
+    Vector<ParsedCookie*> results;
+    getRawCookies(results, url, WithHttpOnlyCookies);
+    // Delete the cookies that path matches the request path
+    for (size_t i = 0; i < results.size(); i++) {
+        ParsedCookie* cookie = results[i];
+        if (!equalIgnoringCase(cookie->name(), cookieName))
+            continue;
+        if (url.path().startsWith(cookie->path(), false)) {
+            cookie->forceExpire();
+            checkAndTreatCookie(cookie, RemoveFromBackingStore);
+        }
+    }
+}
+
+void CookieManager::initiateCookieLimitCleanUp()
+{
+    if (!m_limitTimer.isActive()) {
+        CookieLog("CookieManager - Starting a timer for cookie cleanup");
+        m_limitTimer.startOneShot(s_delayToStartCookieCleanup);
+    } else {
+#if !NDEBUG
+        CookieLog("CookieManager - Cookie cleanup timer already running");
+#endif
+    }
+}
+
+void CookieManager::cookieLimitCleanUp(Timer<CookieManager>* timer)
+{
+    ASSERT_UNUSED(timer, timer == &m_limitTimer);
+
+    CookieLimitLog("CookieManager - Starting cookie clean up");
+
+    size_t numberOfCookiesOverLimit = (m_count > s_globalMaxCookieCount) ? m_count - s_globalMaxCookieCount : 0;
+    size_t amountToDelete = s_cookiesToDeleteWhenLimitReached + numberOfCookiesOverLimit;
+
+    CookieLimitLog("CookieManager - Excess: %d  Amount to Delete: %d", numberOfCookiesOverLimit, amountToDelete);
+
+    // Call the database to delete 'amountToDelete' of cookies
+    Vector<ParsedCookie*> cookiesToDelete;
+    cookiesToDelete.reserveInitialCapacity(amountToDelete);
+
+    CookieLimitLog("CookieManager - Calling database to clean up");
+    m_cookieBackingStore->getCookiesFromDatabase(cookiesToDelete, amountToDelete);
+
+    // Cookies are ordered in ASC order by lastAccessed
+    for (size_t i = 0; i < amountToDelete; ++i) {
+        // Expire them and call checkandtreat to delete them from memory and database
+        ParsedCookie* newCookie = cookiesToDelete[i];
+        CookieLimitLog("CookieManager - Expire cookie: %s and delete", newCookie->toString().utf8().data());
+        newCookie->forceExpire();
+        checkAndTreatCookie(newCookie, RemoveFromBackingStore);
+    }
+
+    CookieLimitLog("CookieManager - Cookie clean up complete.");
+}
+
+void CookieManager::flushCookiesToBackingStore()
+{
+    CookieLog("CookieManager - flushCookiesToBackingStore starting.\n");
+    // This is called from shutdown, so we need to be sure the OS doesn't kill us before the db write finishes.
+    // Once should be enough since this extends terimination by 2 seconds.
+    BlackBerry::Platform::NavigatorHandler::sendExtendTerminate();
+    m_cookieBackingStore->sendChangesToDatabaseSynchronously();
+    CookieLog("CookieManager - flushCookiesToBackingStore finished.\n");
+}
+
+} // namespace WebCore
diff --git a/Source/WebCore/platform/blackberry/CookieManager.h b/Source/WebCore/platform/blackberry/CookieManager.h
new file mode 100644
index 000000000..b97b9f962
--- /dev/null
+++ b/Source/WebCore/platform/blackberry/CookieManager.h
@@ -0,0 +1,158 @@
+/*
+ * Copyright (C) 2008, 2009 Julien Chaffraix <julien.chaffraix@gmail.com>
+ * Copyright (C) 2010, 2012 Research In Motion Limited. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef CookieManager_h
+#define CookieManager_h
+
+#include "CookieMap.h"
+#include "ParsedCookie.h"
+#include "PlatformString.h"
+#include "Timer.h"
+#include <BlackBerryPlatformGuardedPointer.h>
+#include <wtf/HashMap.h>
+
+namespace WTF {
+class String;
+}
+
+namespace WebCore {
+
+class CookieDatabaseBackingStore;
+class KURL;
+
+enum BackingStoreRemovalPolicy {
+    RemoveFromBackingStore,
+    BackingStoreCookieEntry,
+    DoNotRemoveFromBackingStore
+};
+
+enum CookieFilter {
+    NoHttpOnlyCookie,
+    WithHttpOnlyCookies,
+};
+
+enum CookieStorageAcceptPolicy {
+    CookieStorageAcceptPolicyAlways,
+    CookieStorageAcceptPolicyNever,
+    CookieStorageAcceptPolicyOnlyFromMainDocumentDomain
+};
+
+/*
+  * The CookieManager class is a singleton class that handles and selectively persists
+  * incoming cookies. This class contains a tree of domains for quicker
+  * cookie domain lookup. The top of the tree represents a null value for a null domain.
+  * The null domain contains references to top level domains and each node below
+  * represents a sub-section of a domain, delimited by "."
+  *
+  * If a cookie has a domain "a.b.com", it will be stored in the node named "a" in this tree.
+  * in the branch ""->"com"->"b"->"a"
+  *
+  * Cookie specs follow the RFC 6265 spec sheet.
+  * http://tools.ietf.org/html/rfc6265
+  */
+
+class CookieManager: public BlackBerry::Platform::GuardedPointerBase {
+public:
+    bool canLocalAccessAllCookies() const { return m_shouldDumpAllCookies; }
+    void setCanLocalAccessAllCookies(bool enabled) { m_shouldDumpAllCookies = enabled; }
+
+    void setCookies(const KURL&, const String& value);
+
+    void removeAllCookies(BackingStoreRemovalPolicy);
+    void removeCookieWithName(const KURL&, const String& cookieName);
+
+    unsigned short cookiesCount() const { return m_count; }
+
+    void setCookieJar(const char*);
+    const String& cookieJar() const { return m_cookieJarFileName; }
+
+    // Count update method
+    void removedCookie()
+    {
+        ASSERT(m_count > 0);
+        --m_count;
+    }
+    void addedCookie() { ++m_count; }
+
+    static unsigned maxCookieLength() { return s_maxCookieLength; }
+
+    void setCookiePolicy(CookieStorageAcceptPolicy policy) { m_policy = policy; }
+    CookieStorageAcceptPolicy cookiePolicy() const { return m_policy; }
+    void setPrivateMode(const bool);
+
+    String getCookie(const KURL& requestURL, CookieFilter) const;
+
+    // Returns all cookies that are associated with the specified URL as raw cookies.
+    void getRawCookies(Vector<ParsedCookie*>& stackOfCookies, const KURL& requestURL, CookieFilter = WithHttpOnlyCookies) const;
+
+    void flushCookiesToBackingStore();
+
+private:
+    friend CookieManager& cookieManager();
+
+    CookieManager();
+    ~CookieManager();
+
+    void checkAndTreatCookie(ParsedCookie*, BackingStoreRemovalPolicy);
+
+    bool shouldRejectForSecurityReason(const ParsedCookie*, const KURL&);
+
+    void addCookieToMap(CookieMap*, ParsedCookie*, BackingStoreRemovalPolicy);
+    void update(CookieMap*, ParsedCookie*, BackingStoreRemovalPolicy);
+
+    CookieMap* findOrCreateCookieMap(CookieMap* protocolMap, const String& domain, bool findOnly);
+
+    void initiateCookieLimitCleanUp();
+    void cookieLimitCleanUp(Timer<CookieManager>*);
+
+    HashMap<String, CookieMap*> m_managerMap;
+
+    unsigned short m_count;
+
+    bool m_privateMode;
+    bool m_shouldDumpAllCookies;
+
+    String m_cookieJarFileName;
+
+    // FIXME: This method should be removed.
+    void getBackingStoreCookies();
+
+    // Cookie size limit of 4kB as advised per RFC2109
+    static const unsigned s_maxCookieLength = 4096;
+
+    CookieStorageAcceptPolicy m_policy;
+
+    CookieDatabaseBackingStore* m_cookieBackingStore;
+    Timer<CookieManager> m_limitTimer;
+
+};
+
+// Get the global instance.
+CookieManager& cookieManager();
+
+} // namespace WebCore
+
+#endif // CookieManager_h
diff --git a/Source/WebCore/platform/blackberry/CookieMap.cpp b/Source/WebCore/platform/blackberry/CookieMap.cpp
new file mode 100644
index 000000000..4c6d541ad
--- /dev/null
+++ b/Source/WebCore/platform/blackberry/CookieMap.cpp
@@ -0,0 +1,210 @@
+/*
+ * Copyright (C) 2008, 2009 Julien Chaffraix <julien.chaffraix@gmail.com>
+ * Copyright (C) 2011, 2012 Research In Motion Limited. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#define ENABLE_COOKIE_DEBUG 0
+
+#include "config.h"
+#include "CookieMap.h"
+
+#include "CookieManager.h"
+#include "Logging.h"
+#include "ParsedCookie.h"
+#include <wtf/text/CString.h>
+
+#if ENABLE_COOKIE_DEBUG
+#include <BlackBerryPlatformLog.h>
+#define CookieLog(format, ...) BlackBerry::Platform::logAlways(BlackBerry::Platform::LogLevelInfo, format, ## __VA_ARGS__)
+#else
+#define CookieLog(format, ...)
+#endif // ENABLE_COOKIE_DEBUG
+
+namespace WebCore {
+
+CookieMap::CookieMap(const String& name)
+    : m_oldestCookie(0)
+    , m_name(name)
+{
+}
+
+CookieMap::~CookieMap()
+{
+    deleteAllCookiesAndDomains();
+}
+
+bool CookieMap::existsCookie(const ParsedCookie* cookie) const
+{
+    String key = cookie->name() + cookie->path();
+    return m_cookieMap.contains(key);
+}
+
+void CookieMap::addCookie(ParsedCookie* cookie)
+{
+    String key = cookie->name() + cookie->path();
+
+    CookieLog("CookieMap - Attempting to add cookie - %s", cookie->name().utf8().data());
+
+    ASSERT(!m_cookieMap.contains(key));
+    m_cookieMap.add(key, cookie);
+    if (!cookie->isSession())
+        cookieManager().addedCookie();
+    if (!m_oldestCookie || m_oldestCookie->lastAccessed() > cookie->lastAccessed())
+        m_oldestCookie = cookie;
+}
+
+ParsedCookie* CookieMap::updateCookie(ParsedCookie* newCookie)
+{
+    String key = newCookie->name() + newCookie->path();
+    ParsedCookie* oldCookie = m_cookieMap.take(key);
+    ASSERT(oldCookie);
+    m_cookieMap.add(key, newCookie);
+    if (oldCookie == m_oldestCookie)
+        updateOldestCookie();
+    return oldCookie;
+}
+
+ParsedCookie* CookieMap::removeCookie(const ParsedCookie* cookie)
+{
+    // Find a previous entry for deletion
+    String key = cookie->name() + cookie->path();
+    ParsedCookie* prevCookie = m_cookieMap.take(key);
+
+    if (!prevCookie)
+        return 0;
+
+    if (prevCookie == m_oldestCookie)
+        updateOldestCookie();
+    else if (prevCookie != cookie) {
+        // The cookie we used to search is force expired, we must do the same
+        // to the cookie in memory too.
+        if (cookie->isForceExpired())
+            prevCookie->forceExpire();
+        delete cookie;
+    }
+
+    if (!prevCookie->isSession())
+        cookieManager().removedCookie();
+    return prevCookie;
+}
+
+CookieMap* CookieMap::getSubdomainMap(const String& subdomain)
+{
+#if ENABLE_COOKIE_DEBUG
+    if (!m_subdomains.contains(subdomain))
+        CookieLog("CookieMap - %s does not exist in this map", subdomain.utf8().data());
+#endif
+    return m_subdomains.get(subdomain);
+}
+
+void CookieMap::addSubdomainMap(const String& subdomain, CookieMap* newDomain)
+{
+    CookieLog("CookieMap - Attempting to add subdomain - %s", subdomain.utf8().data());
+    m_subdomains.add(subdomain, newDomain);
+}
+
+void CookieMap::getAllCookies(Vector<ParsedCookie*>* stackOfCookies)
+{
+    CookieLog("CookieMap - Attempting to copy Map:%s cookies with %d cookies into vectors", m_name.utf8().data(), m_cookieMap.size());
+
+    Vector<ParsedCookie*> newCookies;
+    copyValuesToVector(m_cookieMap, newCookies);
+    for (size_t i = 0; i < newCookies.size(); i++) {
+        ParsedCookie* newCookie = newCookies[i];
+        if (newCookie->hasExpired()) {
+            // Notice that we don't delete from backingstore. These expired cookies will be
+            // deleted when manager loads the backingstore again.
+            ParsedCookie* expired = removeCookie(newCookie);
+            delete expired;
+        } else
+            stackOfCookies->append(newCookie);
+    }
+
+    CookieLog("CookieMap - stack of cookies now have %d cookies in it", (*stackOfCookies).size());
+}
+
+ParsedCookie* CookieMap::removeOldestCookie()
+{
+    // FIXME: Make sure it finds the GLOBAL oldest cookie, not the first oldestcookie it finds.
+    ParsedCookie* oldestCookie = m_oldestCookie;
+
+    // If this map has an oldestCookie, remove it. If not, do a DFS to search for a child that does
+    if (!oldestCookie) {
+
+        CookieLog("CookieMap - no oldestCookie exist");
+
+        // Base case is if the map has no child and no cookies, we return a null.
+        if (!m_subdomains.size()) {
+            CookieLog("CookieMap - no subdomains, base case reached, return 0");
+            return 0;
+        }
+
+        CookieLog("CookieMap - looking into subdomains");
+
+        for (HashMap<String, CookieMap*>::iterator it = m_subdomains.begin(); it != m_subdomains.end(); ++it) {
+            oldestCookie = it->second->removeOldestCookie();
+            if (oldestCookie)
+                break;
+        }
+    } else {
+        CookieLog("CookieMap - oldestCookie exist.");
+        oldestCookie = removeCookie(m_oldestCookie);
+    }
+
+    return oldestCookie;
+}
+
+void CookieMap::updateOldestCookie()
+{
+    if (!m_cookieMap.size())
+        m_oldestCookie = 0;
+    else {
+        HashMap<String, ParsedCookie*>::iterator it = m_cookieMap.begin();
+        m_oldestCookie = it->second;
+        ++it;
+        for (; it != m_cookieMap.end(); ++it)
+            if (m_oldestCookie->lastAccessed() > it->second->lastAccessed())
+                m_oldestCookie = it->second;
+    }
+}
+
+void CookieMap::deleteAllCookiesAndDomains()
+{
+    deleteAllValues(m_subdomains);
+    m_subdomains.clear();
+    deleteAllValues(m_cookieMap);
+    m_cookieMap.clear();
+
+    m_oldestCookie = 0;
+}
+
+void CookieMap::getAllChildCookies(Vector<ParsedCookie*>* stackOfCookies)
+{
+    CookieLog("CookieMap - getAllChildCookies in Map - %s", getName().utf8().data());
+    getAllCookies(stackOfCookies);
+    for (HashMap<String, CookieMap*>::iterator it = m_subdomains.begin(); it != m_subdomains.end(); ++it)
+        it->second->getAllChildCookies(stackOfCookies);
+}
+
+} // namespace WebCore
diff --git a/Source/WebCore/platform/blackberry/CookieMap.h b/Source/WebCore/platform/blackberry/CookieMap.h
new file mode 100644
index 000000000..73ba13fac
--- /dev/null
+++ b/Source/WebCore/platform/blackberry/CookieMap.h
@@ -0,0 +1,96 @@
+/*
+ * Copyright (C) Julien Chaffraix <julien.chaffraix@gmail.com>
+ * Copyright (C) 2011, 2012 Research In Motion Limited. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef CookieMap_h
+#define CookieMap_h
+
+#include "HashMap.h"
+#include "PlatformString.h"
+#include "Vector.h"
+#include <wtf/text/StringHash.h>
+
+namespace WebCore {
+
+class ParsedCookie;
+
+/* A cookie map is a node in the tree held by CookieManager that represents
+ * cookies that matches a common domain.
+ *
+ * A CookieMap holds reference to the cookies that it contains and the child
+ * domains that exist within the tree.
+ *
+ * The number of cookie per host is limited by CookieManager::s_maxCookieCountPerHost
+ */
+
+class CookieMap {
+
+public:
+    CookieMap(const String& name = "");
+    ~CookieMap();
+
+    unsigned int count() const { return m_cookieMap.size(); }
+    const String& getName() const { return m_name; }
+
+    void addCookie(ParsedCookie*);
+
+    // Returning the original cookie object so manager can keep a reference to the updates in the database queue.
+    ParsedCookie* updateCookie(ParsedCookie*);
+
+    // Need to return the reference to the removed cookie so manager can deal with it (garbage collect).
+    ParsedCookie* removeCookie(const ParsedCookie*);
+    bool existsCookie(const ParsedCookie*) const;
+
+    // Returns a map with that given subdomain.
+    CookieMap* getSubdomainMap(const String&);
+    void addSubdomainMap(const String&, CookieMap*);
+    void deleteAllCookiesAndDomains();
+
+    void getAllCookies(Vector<ParsedCookie*>*);
+    void getAllChildCookies(Vector<ParsedCookie*>* stackOfCookies);
+    ParsedCookie* removeOldestCookie();
+
+private:
+    void updateOldestCookie();
+
+    // The key is the tuple (name, path).
+    // The spec asks to have also domain, which is implied by choosing the CookieMap relevant to the domain.
+    HashMap<String, ParsedCookie*> m_cookieMap;
+
+    // The key is a subsection of the domain.
+    // ex: if inserting accounts.google.com & this cookiemap is "com", this subdomain map will contain "google"
+    // the "google" cookiemap will contain "accounts" in its subdomain map.
+    HashMap<String, CookieMap*> m_subdomains;
+
+    // Store the oldest cookie to speed up LRU checks.
+    ParsedCookie* m_oldestCookie;
+    const String m_name;
+
+    // FIXME : should have a m_shouldUpdate flag to update the network layer only when the map has changed.
+};
+
+} // namespace WebCore
+
+#endif // CookieMap_h
diff --git a/Source/WebCore/platform/blackberry/CookieParser.cpp b/Source/WebCore/platform/blackberry/CookieParser.cpp
new file mode 100644
index 000000000..e1eb44aa4
--- /dev/null
+++ b/Source/WebCore/platform/blackberry/CookieParser.cpp
@@ -0,0 +1,369 @@
+/*
+ * Copyright (C) 2009 Julien Chaffraix <jchaffraix@pleyo.com>
+ * Copyright (C) 2010, 2011, 2012 Research In Motion Limited. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */ 
+
+#include "config.h"
+#include "CookieParser.h"
+
+#include "CurrentTime.h"
+#include "Logging.h"
+#include "ParsedCookie.h"
+#include <wtf/text/CString.h>
+
+namespace WebCore {
+
+#define LOG_AND_DELETE(format, ...) \
+    { \
+        LOG_ERROR(format, ## __VA_ARGS__); \
+        delete res; \
+        return 0; \
+    }
+
+static inline bool isCookieHeaderSeparator(UChar c)
+{
+    return (c == '\r' || c =='\n');
+}
+
+static inline bool isLightweightSpace(UChar c)
+{
+    return (c == ' ' || c == '\t');
+}
+
+CookieParser::CookieParser(const KURL& defaultCookieURL)
+    : m_defaultCookieURL(defaultCookieURL)
+{
+}
+
+CookieParser::~CookieParser()
+{
+}
+
+Vector<ParsedCookie*> CookieParser::parse(const String& cookies)
+{
+    unsigned cookieStart, cookieEnd = 0;
+    double curTime = currentTime();
+    Vector<ParsedCookie*, 4> parsedCookies;
+
+    unsigned cookiesLength = cookies.length();
+    if (!cookiesLength) // Code below doesn't handle this case
+        return parsedCookies;
+
+    // Iterate over the header to parse all the cookies.
+    while (cookieEnd <= cookiesLength) {
+        cookieStart = cookieEnd;
+        
+        // Find a cookie separator.
+        while (cookieEnd <= cookiesLength && !isCookieHeaderSeparator(cookies[cookieEnd]))
+            cookieEnd++;
+
+        // Detect an empty cookie and go to the next one.
+        if (cookieStart == cookieEnd) {
+            ++cookieEnd;
+            continue;
+        }
+
+        if (cookieEnd < cookiesLength && isCookieHeaderSeparator(cookies[cookieEnd]))
+            ++cookieEnd;
+
+        ParsedCookie* cookie = parseOneCookie(cookies, cookieStart, cookieEnd - 1, curTime);
+        if (cookie)
+            parsedCookies.append(cookie);
+    }
+    return parsedCookies;
+}
+
+// The cookie String passed into this method will only contian the name value pairs as well as other related cookie
+// attributes such as max-age and domain. Set-Cookie should never be part of this string.
+ParsedCookie* CookieParser::parseOneCookie(const String& cookie, unsigned start, unsigned end, double curTime)
+{
+    ParsedCookie* res = new ParsedCookie(curTime);
+
+    if (!res)
+        LOG_AND_DELETE("Out of memory");
+
+    res->setProtocol(m_defaultCookieURL.protocol());
+
+    // Parse [NAME "="] VALUE
+    unsigned tokenEnd = start; // Token end contains the position of the '=' or the end of a token
+    unsigned pairEnd = start; // Pair end contains always the position of the ';'
+
+    // find the *first* ';' and the '=' (if they exist)
+    bool quoteFound = false;
+    bool foundEqual = false;
+    while (pairEnd < end && (cookie[pairEnd] != ';' || quoteFound)) {
+        if (tokenEnd == start && cookie[pairEnd] == '=') {
+            tokenEnd = pairEnd;
+            foundEqual = true;
+        }
+        if (cookie[pairEnd] == '"')
+            quoteFound = !quoteFound;
+        pairEnd++;
+    }
+
+    unsigned tokenStart = start;
+
+    bool hasName = false; // This is a hack to avoid changing too much in this
+                          // brutally brittle code.
+    if (tokenEnd != start) {
+        // There is a '=' so parse the NAME
+        unsigned nameEnd = tokenEnd;
+
+        // The tokenEnd is the position of the '=' so the nameEnd is one less
+        nameEnd--;
+
+        // Remove lightweight spaces.
+        while (nameEnd && isLightweightSpace(cookie[nameEnd]))
+            nameEnd--;
+
+        while (tokenStart < nameEnd && isLightweightSpace(cookie[tokenStart]))
+            tokenStart++;
+
+        if (nameEnd + 1 <= tokenStart)
+            LOG_AND_DELETE("Empty name. Rejecting the cookie");
+
+        String name = cookie.substring(tokenStart, nameEnd + 1 - start);
+        res->setName(name);
+        hasName = true;
+    }
+
+    // Now parse the VALUE
+    tokenStart = tokenEnd + 1;
+    if (!hasName)
+        --tokenStart;
+
+    // Skip lightweight spaces in our token
+    while (tokenStart < pairEnd && isLightweightSpace(cookie[tokenStart]))
+        tokenStart++;
+
+    tokenEnd = pairEnd;
+    while (tokenEnd > tokenStart && isLightweightSpace(cookie[tokenEnd - 1]))
+        tokenEnd--;
+
+    String value;
+    if (tokenEnd == tokenStart) {
+        // Firefox accepts empty value so we will do the same
+        value = String();
+    } else
+        value = cookie.substring(tokenStart, tokenEnd - tokenStart);
+
+    if (hasName)
+        res->setValue(value);
+    else if (foundEqual) {
+        delete res;
+        return 0;
+    } else
+        res->setName(value); // No NAME=VALUE, only NAME
+
+    while (pairEnd < end) {
+        // Switch to the next pair as pairEnd is on the ';' and fast-forward any lightweight spaces.
+        pairEnd++;
+        while (pairEnd < end && isLightweightSpace(cookie[pairEnd]))
+            pairEnd++;
+
+        tokenStart = pairEnd;
+        tokenEnd = tokenStart; // initialize token end to catch first '='
+
+        while (pairEnd < end && cookie[pairEnd] != ';') {
+            if (tokenEnd == tokenStart && cookie[pairEnd] == '=')
+                tokenEnd = pairEnd;
+            pairEnd++;
+        }
+
+        // FIXME : should we skip lightweight spaces here ?
+
+        unsigned length = tokenEnd - tokenStart;
+        unsigned tokenStartSvg = tokenStart;
+
+        String parsedValue;
+        if (tokenStart != tokenEnd) {
+            // There is an equal sign so remove lightweight spaces in VALUE
+            tokenStart = tokenEnd + 1;
+            while (tokenStart < pairEnd && isLightweightSpace(cookie[tokenStart]))
+                tokenStart++;
+
+            tokenEnd = pairEnd;
+            while (tokenEnd > tokenStart && isLightweightSpace(cookie[tokenEnd - 1]))
+                tokenEnd--;
+
+            parsedValue = cookie.substring(tokenStart, tokenEnd - tokenStart);
+        } else {
+            // If the parsedValue is empty, initialise it in case we need it
+            parsedValue = String();
+            // Handle a token without value.
+            length = pairEnd - tokenStart;
+        }
+
+       // Detect which "cookie-av" is parsed
+       // Look at the first char then parse the whole for performance issue
+        switch (cookie[tokenStartSvg]) {
+        case 'P':
+        case 'p' : {
+            if (length >= 4 && cookie.find("ath", tokenStartSvg + 1, false)) {
+                // We need the path to be decoded to match those returned from KURL::path().
+                // The path attribute may or may not include percent-encoded characters. Fortunately
+                // if there are no percent-encoded characters, decoding the url is a no-op.
+                res->setPath(decodeURLEscapeSequences(parsedValue));
+            } else
+                LOG_AND_DELETE("Invalid cookie %s (path)", cookie.ascii().data());
+            break;
+        }
+
+        case 'D':
+        case 'd' : {
+            if (length >= 6 && cookie.find("omain", tokenStartSvg + 1, false)) {
+                if (parsedValue.length() > 1 && parsedValue[0] == '"' && parsedValue[parsedValue.length() - 1] == '"')
+                    parsedValue = parsedValue.substring(1, parsedValue.length() - 2);
+                // If the domain does not start with a dot, add one for security checks,
+                // For example: ab.c.com dose not domain match b.c.com;
+                String realDomain = parsedValue[0] == '.' ? parsedValue : "." + parsedValue;
+                res->setDomain(realDomain);
+            } else
+                LOG_AND_DELETE("Invalid cookie %s (domain)", cookie.ascii().data());
+            break;
+        }
+
+        case 'E' :
+        case 'e' : {
+            if (length >= 7 && cookie.find("xpires", tokenStartSvg + 1, false))
+                res->setExpiry(parsedValue);
+            else
+                LOG_AND_DELETE("Invalid cookie %s (expires)", cookie.ascii().data());
+            break;
+        }
+
+        case 'M' :
+        case 'm' : {
+            if (length >= 7 && cookie.find("ax-age", tokenStartSvg + 1, false))
+                res->setMaxAge(parsedValue);
+            else
+                LOG_AND_DELETE("Invalid cookie %s (max-age)", cookie.ascii().data());
+            break;
+        }
+
+        case 'C' :
+        case 'c' : {
+            if (length >= 7 && cookie.find("omment", tokenStartSvg + 1, false))
+                // We do not have room for the comment part (and so do Mozilla) so just log the comment.
+                LOG(Network, "Comment %s for ParsedCookie : %s\n", parsedValue.ascii().data(), cookie.ascii().data());
+            else
+                LOG_AND_DELETE("Invalid cookie %s (comment)", cookie.ascii().data());
+            break;
+        }
+
+        case 'V' :
+        case 'v' : {
+            if (length >= 7 && cookie.find("ersion", tokenStartSvg + 1, false)) {
+                // Although the out-of-dated Cookie Spec(RFC2965, http://tools.ietf.org/html/rfc2965) defined
+                // the value of version can only contain DIGIT, some random sites, e.g. https://devforums.apple.com
+                // would use double quotation marks to quote the digit. So we need to get rid of them for compliance.
+                if (parsedValue.length() > 1 && parsedValue[0] == '"' && parsedValue[parsedValue.length() - 1] == '"')
+                    parsedValue = parsedValue.substring(1, parsedValue.length() - 2);
+
+                if (parsedValue.toInt() != 1)
+                    LOG_AND_DELETE("ParsedCookie version %d not supported (only support version=1)", parsedValue.toInt());
+            } else
+                LOG_AND_DELETE("Invalid cookie %s (version)", cookie.ascii().data());
+            break;
+        }
+
+        case 'S' :
+        case 's' : {
+            // Secure is a standalone token ("Secure;")
+            if (length >= 6 && cookie.find("ecure", tokenStartSvg + 1, false))
+                res->setSecureFlag(true);
+            else
+                LOG_AND_DELETE("Invalid cookie %s (secure)", cookie.ascii().data());
+            break;
+        }
+        case 'H':
+        case 'h': {
+            // HttpOnly is a standalone token ("HttpOnly;")
+            if (length >= 8 && cookie.find("ttpOnly", tokenStartSvg + 1, false))
+                res->setIsHttpOnly(true);
+            else
+                LOG_AND_DELETE("Invalid cookie %s (HttpOnly)", cookie.ascii().data());
+            break;
+        }
+
+        default : {
+            // If length == 0, we should be at the end of the cookie (case : ";\r") so ignore it
+            if (length)
+                LOG_ERROR("Invalid token for cookie %s", cookie.ascii().data());
+        }
+        }
+    }
+
+    // Check if the cookie is valid with respect to the size limit.
+    if (!res->isUnderSizeLimit())
+        LOG_AND_DELETE("ParsedCookie %s is above the 4kb in length : REJECTED", cookie.ascii().data());
+
+    // If some pair was not provided, during parsing then apply some default value
+    // the rest has been done in the constructor.
+
+    // If no domain was provided, set it to the host
+    if (!res->domain())
+        res->setDefaultDomain(m_defaultCookieURL);
+
+    // According to the Cookie Specificaiton (RFC6265, section 4.1.2.4 and 5.2.4, http://tools.ietf.org/html/rfc6265),
+    // If no path was provided or the first character of the path value is not '/', set it to the host's path
+    //
+    // REFERENCE
+    // 4.1.2.4. The Path Attribute
+    //
+    // The scope of each cookie is limited to a set of paths, controlled by
+    // the Path attribute. If the server omits the Path attribute, the user
+    // agent will use the "directory" of the request-uri's path component as
+    // the default value. (See Section 5.1.4 for more details.)
+    // ...........
+    // 5.2.4. The Path Attribute
+    //
+    // If the attribute-name case-insensitively matches the string "Path",
+    // the user agent MUST process the cookie-av as follows.
+    //
+    // If the attribute-value is empty or if the first character of the
+    // attribute-value is not %x2F ("/"):
+    //
+    // Let cookie-path be the default-path.
+    //
+    // Otherwise:
+    //
+    // Let cookie-path be the attribute-value.
+    //
+    // Append an attribute to the cookie-attribute-list with an attribute-
+    // name of Path and an attribute-value of cookie-path.
+    if (!res->path() || !res->path().length() || !res->path().startsWith("/", false)) {
+        String path = m_defaultCookieURL.string().substring(m_defaultCookieURL.pathStart(), m_defaultCookieURL.pathAfterLastSlash() - m_defaultCookieURL.pathStart() - 1);
+        if (path.isEmpty())
+            path = "/";
+        // Since this is reading the raw url string, it could contain percent-encoded sequences. We
+        // want it to be comparable to the return value of url.path(), which is not percent-encoded,
+        // so we must remove the escape sequences.
+        res->setPath(decodeURLEscapeSequences(path));
+    }
+ 
+    return res;
+}
+
+} // namespace WebCore
diff --git a/Source/WebCore/platform/blackberry/CookieParser.h b/Source/WebCore/platform/blackberry/CookieParser.h
new file mode 100644
index 000000000..92e48d36e
--- /dev/null
+++ b/Source/WebCore/platform/blackberry/CookieParser.h
@@ -0,0 +1,57 @@
+/*
+ * Copyright (C) 2009 Julien Chaffraix <jchaffraix@pleyo.com>
+ * Copyright (C) 2010, 2012 Research In Motion Limited. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef CookieParser_h
+#define CookieParser_h
+
+#include "KURL.h"
+#include "Vector.h"
+
+namespace WTF {
+class String;
+}
+namespace WebCore {
+
+class ParsedCookie;
+
+class CookieParser {
+public:
+    CookieParser(const KURL& defaultCookieURL);
+    ~CookieParser();
+
+    // Parses a sequence of "Cookie:" header and return the parsed cookies.
+    Vector<ParsedCookie*> parse(const String& cookies);
+
+private:
+    // FIXME: curTime, start, end parameters should be removed. And this method can be public.
+    ParsedCookie* parseOneCookie(const String& cookie, unsigned start, unsigned end, double curTime);
+
+    KURL m_defaultCookieURL;
+};
+
+} // namespace WebCore
+
+#endif // CookieParser_h
diff --git a/Source/WebCore/platform/blackberry/ParsedCookie.cpp b/Source/WebCore/platform/blackberry/ParsedCookie.cpp
new file mode 100644
index 000000000..1ff7fe600
--- /dev/null
+++ b/Source/WebCore/platform/blackberry/ParsedCookie.cpp
@@ -0,0 +1,190 @@
+/*
+ * Copyright (C) 2008, 2009 Julien Chaffraix <julien.chaffraix@gmail.com>
+ * Copyright (C) 2011, 2012 Research In Motion Limited. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "ParsedCookie.h"
+
+#include "CookieManager.h"
+#include "CurrentTime.h"
+#include "KURL.h"
+#include "Logging.h"
+#include <curl/curl.h>
+#include <wtf/text/CString.h>
+#include <wtf/text/StringBuilder.h>
+
+namespace WebCore {
+
+ParsedCookie::ParsedCookie(double currentTime)
+    : m_expiry(0)
+    , m_creationTime(currentTime)
+    , m_lastAccessed(currentTime)
+    , m_isMaxAgeSet(false)
+    , m_hasDefaultDomain(false)
+    , m_isSecure(false)
+    , m_isHttpOnly(false)
+    , m_isSession(true)
+    , m_isForceExpired(false)
+{
+}
+
+ParsedCookie::ParsedCookie(const String& name, const String& value, const String& domain, const String& protocol, const String& path, double expiry, double lastAccessed, double creationTime, bool isSecure, bool isHttpOnly)
+    : m_name(name)
+    , m_value(value)
+    , m_domain(domain)
+    , m_protocol(protocol)
+    , m_path(path)
+    , m_expiry(expiry)
+    , m_creationTime(creationTime)
+    , m_lastAccessed(lastAccessed)
+    , m_isMaxAgeSet(false)
+    , m_hasDefaultDomain(false)
+    , m_isSecure(isSecure)
+    , m_isHttpOnly(isHttpOnly)
+    , m_isSession(false)
+    , m_isForceExpired(false)
+{
+}
+
+ParsedCookie::ParsedCookie(const ParsedCookie* cookie)
+    : m_name(String(cookie->m_name))
+    , m_value(String(cookie->m_value))
+    , m_domain(String(cookie->m_domain))
+    , m_protocol(String(cookie->m_protocol))
+    , m_path(String(cookie->m_path))
+    , m_expiry(cookie->m_expiry)
+    , m_creationTime(cookie->m_creationTime)
+    , m_lastAccessed(cookie->m_lastAccessed)
+    , m_isMaxAgeSet(cookie->m_isMaxAgeSet)
+    , m_hasDefaultDomain(cookie->m_hasDefaultDomain)
+    , m_isSecure(cookie->m_isSecure)
+    , m_isHttpOnly(cookie->m_isHttpOnly)
+    , m_isSession(cookie->m_isSession)
+    , m_isForceExpired(cookie->m_isForceExpired)
+{
+}
+
+ParsedCookie::~ParsedCookie()
+{
+}
+
+void ParsedCookie::setExpiry(const String& expiry)
+{
+    // If a cookie has both the Max-Age and the Expires attribute,
+    // the Max-Age attribute has precedence and controls the expiration date of the cookie.
+    if (m_isMaxAgeSet || expiry.isEmpty())
+        return;
+
+    m_isSession = false;
+
+    m_expiry = static_cast<double>(curl_getdate(expiry.utf8().data(), 0));
+
+    if (m_expiry == -1) {
+        LOG_ERROR("Could not parse date");
+        // In this case, consider that the cookie is session only
+        m_isSession = true;
+    }
+}
+
+void ParsedCookie::setMaxAge(const String& maxAge)
+{
+    // According to the HTTP Cookie specification (RFC6265, http://tools.ietf.org/html/rfc6265),
+    // the first character can be a DIGIT or a "-", and the reminder
+    // of the value can only contain DIGIT characters.
+    if (maxAge.isEmpty() || (maxAge[0] != '-' && !isASCIIDigit(maxAge[0]))) {
+        LOG_ERROR("Could not parse Max-Age : %s, first character can only be '-' or ascii digit.", maxAge.ascii().data());
+        return;
+    }
+
+    bool ok;
+    int value = maxAge.toIntStrict(&ok);
+
+    if (!ok) {
+        LOG_ERROR("Could not parse Max-Age : %s", maxAge.ascii().data());
+        return;
+    }
+    m_expiry = value;
+    m_isMaxAgeSet = true;
+    m_isSession = false;
+
+    // If maxAge value is not positive, let expiry-time be the earliest representable time.
+    if (m_expiry > 0)
+        m_expiry += currentTime();
+    else
+        m_expiry = 0;
+}
+
+void ParsedCookie::setDefaultDomain(const KURL& requestURL)
+{
+    setDomain(requestURL.host());
+    m_hasDefaultDomain = true;
+}
+
+bool ParsedCookie::hasExpired() const
+{
+    // Session cookies do not expire, they will just not be saved to the backing store.
+    return !m_isSession && (m_isForceExpired || m_expiry < currentTime());
+}
+
+bool ParsedCookie::isUnderSizeLimit() const
+{
+    return m_value.length() <= CookieManager::maxCookieLength() && m_name.length() <= CookieManager::maxCookieLength();
+}
+
+String ParsedCookie::toString() const
+{
+    StringBuilder builder;
+    builder.append(name());
+    builder.append(" = ");
+    builder.append(value());
+    builder.append("; Domain = ");
+    builder.append(domain());
+    builder.append("; Path = ");
+    builder.append(path());
+    builder.append("; Protocol = ");
+    builder.append(protocol());
+    return builder.toString();
+}
+
+String ParsedCookie::toNameValuePair() const
+{
+    static const String equal("=");
+
+    size_t cookieLength = m_name.length() + m_value.length() + 2;
+    Vector<UChar> result;
+    result.reserveInitialCapacity(cookieLength);
+    append(result, m_name);
+    append(result, equal);
+    append(result, m_value);
+
+    return String::adopt(result);
+}
+
+void ParsedCookie::appendWebCoreCookie(Vector<Cookie>& cookieVector) const
+{
+    cookieVector.append(Cookie(String(m_name), String(m_value), String(m_domain),
+            String(m_path), m_expiry, m_isHttpOnly, m_isSecure, m_isSession));
+}
+} // namespace WebCore
diff --git a/Source/WebCore/platform/blackberry/ParsedCookie.h b/Source/WebCore/platform/blackberry/ParsedCookie.h
new file mode 100644
index 000000000..ca343d13f
--- /dev/null
+++ b/Source/WebCore/platform/blackberry/ParsedCookie.h
@@ -0,0 +1,123 @@
+/*
+ * Copyright (C) 2008, 2009 Julien Chaffraix <julien.chaffraix@gmail.com>
+ * Copyright (C) 2011, 2012 Research In Motion Limited. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef ParsedCookie_h
+#define ParsedCookie_h
+
+#include "Cookie.h"
+#include <wtf/FastAllocBase.h>
+
+namespace WTF {
+class String;
+}
+namespace WebCore {
+
+class KURL;
+
+// This class represents a cookie internally
+// It can either be created by the CookieParser which will then fill it
+// or it can be created by the backing store filling it in the constructor.
+class ParsedCookie {
+WTF_MAKE_FAST_ALLOCATED;
+public:
+    // Default cookie : empty domain, non secure and session
+    ParsedCookie(double currentTime);
+
+    // For backing store cookies (those cookies are never session cookies).
+    ParsedCookie(const String& name, const String& value, const String& domain, const String& protocol, const String& path, double expiry, double lastAccessed, double creationTime, bool isSecure, bool isHttpOnly);
+
+    ParsedCookie(const ParsedCookie*);
+
+    ~ParsedCookie();
+
+    const String& name() const { return m_name; }
+    void setName(const String& name) { m_name = name; }
+
+    const String& value() const { return m_value; }
+    void setValue(const String& value) { m_value = value; }
+
+    const String& path() const { return m_path; }
+    void setPath(const String& path) { m_path = path; }
+
+    const String& domain() const { return m_domain; }
+    void setDomain(const String& domain) { m_domain = domain.lower(); }
+
+    const String& protocol() const { return m_protocol; }
+    void setProtocol(const String& protocol) { m_protocol = protocol; }
+
+    // This is a special method used to set the domain to the request's url.
+    void setDefaultDomain(const KURL&);
+    bool hasDefaultDomain() const { return m_hasDefaultDomain; }
+
+    double expiry() const { return m_expiry; }
+    void setExpiry(const String&);
+    void forceExpire() { m_isForceExpired  = true; }
+    void setMaxAge(const String&);
+
+    double lastAccessed() const { return m_lastAccessed; }
+    void setLastAccessed(double lastAccessed) { m_lastAccessed = lastAccessed;}
+
+    double creationTime() const { return m_creationTime; }
+    void setCreationTime(double creationTime) { m_creationTime = creationTime; }
+
+    bool isSecure() const { return m_isSecure; }
+    void setSecureFlag(bool secure) { m_isSecure = secure; }
+
+    bool isHttpOnly() const { return m_isHttpOnly; }
+    void setIsHttpOnly(bool isHttpOnly) { m_isHttpOnly = isHttpOnly; }
+
+    bool isSession() const { return m_isSession; }
+
+    bool hasExpired() const;
+    bool isForceExpired() const { return m_isForceExpired; }
+    bool isUnderSizeLimit() const;
+
+    String toString() const;
+    String toNameValuePair() const;
+    void appendWebCoreCookie(Vector<Cookie>& cookieVector) const;
+
+private:
+    String m_name;
+    String m_value;
+    String m_domain;
+    String m_protocol;
+    String m_path;
+    double m_expiry;
+    double m_creationTime;
+    // This is used for the LRU replacement policy.
+    double m_lastAccessed;
+
+    bool m_isMaxAgeSet;
+    bool m_hasDefaultDomain;
+    bool m_isSecure;
+    bool m_isHttpOnly;
+    bool m_isSession;
+    bool m_isForceExpired;
+};
+
+} // namespace WebCore
+
+#endif // ParsedCookie_h
diff --git a/Source/WebCore/platform/blackberry/RenderThemeBlackBerry.cpp b/Source/WebCore/platform/blackberry/RenderThemeBlackBerry.cpp
new file mode 100644
index 000000000..c57813f1c
--- /dev/null
+++ b/Source/WebCore/platform/blackberry/RenderThemeBlackBerry.cpp
@@ -0,0 +1,978 @@
+/*
+ * Copyright (C) 2006, 2007 Apple Inc.
+ * Copyright (C) 2009 Google Inc.
+ * Copyright (C) 2009, 2010, 2011, 2012 Research In Motion Limited. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+#include "config.h"
+#include "RenderThemeBlackBerry.h"
+
+#include "CSSValueKeywords.h"
+#include "Frame.h"
+#include "MediaControlElements.h"
+#include "MediaPlayerPrivateBlackBerry.h"
+#include "PaintInfo.h"
+#include "RenderProgress.h"
+#include "RenderSlider.h"
+#include "RenderView.h"
+#include "UserAgentStyleSheets.h"
+
+namespace WebCore {
+
+// Sizes (unit px)
+const unsigned smallRadius = 1;
+const unsigned largeRadius = 3;
+const unsigned lineWidth = 1;
+const int marginSize = 4;
+const int mediaSliderThumbWidth = 40;
+const int mediaSliderThumbHeight = 13;
+const int mediaSliderThumbRadius = 5;
+const int sliderThumbWidth = 15;
+const int sliderThumbHeight = 25;
+
+// Checkbox check scalers
+const float checkboxLeftX = 7 / 40.0;
+const float checkboxLeftY = 1 / 2.0;
+const float checkboxMiddleX = 19 / 50.0;
+const float checkboxMiddleY = 7 / 25.0;
+const float checkboxRightX = 33 / 40.0;
+const float checkboxRightY = 1 / 5.0;
+const float checkboxStrokeThickness = 6.5;
+
+// Radio button scaler
+const float radioButtonCheckStateScaler = 7 / 30.0;
+
+// Multipliers
+const unsigned paddingDivisor = 5;
+
+// Colors
+const RGBA32 caretBottom = 0xff2163bf;
+const RGBA32 caretTop = 0xff69a5fa;
+
+const RGBA32 regularBottom = 0xffdcdee4;
+const RGBA32 regularTop = 0xfff7f2ee;
+const RGBA32 hoverBottom = 0xffb5d3fc;
+const RGBA32 hoverTop = 0xffcceaff;
+const RGBA32 depressedBottom = 0xff3388ff;
+const RGBA32 depressedTop = 0xff66a0f2;
+const RGBA32 disabledBottom = 0xffe7e7e7;
+const RGBA32 disabledTop = 0xffefefef;
+
+const RGBA32 regularBottomOutline = 0xff6e7073;
+const RGBA32 regularTopOutline = 0xffb9b8b8;
+const RGBA32 hoverBottomOutline = 0xff2163bf;
+const RGBA32 hoverTopOutline = 0xff69befa;
+const RGBA32 depressedBottomOutline = 0xff0c3d81;
+const RGBA32 depressedTopOutline = 0xff1d4d70;
+const RGBA32 disabledOutline = 0xffd5d9de;
+
+const RGBA32 progressRegularBottom = caretTop;
+const RGBA32 progressRegularTop = caretBottom;
+
+const RGBA32 rangeSliderRegularBottom = 0xfff6f2ee;
+const RGBA32 rangeSliderRegularTop = 0xffdee0e5;
+const RGBA32 rangeSliderRollBottom = 0xffc9e8fe;
+const RGBA32 rangeSliderRollTop = 0xffb5d3fc;
+
+const RGBA32 rangeSliderRegularBottomOutline = 0xffb9babd;
+const RGBA32 rangeSliderRegularTopOutline = 0xffb7b7b7;
+const RGBA32 rangeSliderRollBottomOutline = 0xff67abe0;
+const RGBA32 rangeSliderRollTopOutline = 0xff69adf9;
+
+const RGBA32 dragRegularLight = 0xfffdfdfd;
+const RGBA32 dragRegularDark = 0xffbababa;
+const RGBA32 dragRollLight = 0xfff2f2f2;
+const RGBA32 dragRollDark = 0xff69a8ff;
+
+const RGBA32 selection = 0xff2b8fff;
+
+const RGBA32 blackPen = Color::black;
+const RGBA32 focusRingPen = 0xffa3c8fe;
+
+float RenderThemeBlackBerry::defaultFontSize = 16;
+
+// We aim to match IE here.
+// -IE uses a font based on the encoding as the default font for form controls.
+// -Gecko uses MS Shell Dlg (actually calls GetStockObject(DEFAULT_GUI_FONT),
+// which returns MS Shell Dlg)
+// -Safari uses Lucida Grande.
+//
+// FIXME: The only case where we know we don't match IE is for ANSI encodings.
+// IE uses MS Shell Dlg there, which we render incorrectly at certain pixel
+// sizes (e.g. 15px). So we just use Arial for now.
+const String& RenderThemeBlackBerry::defaultGUIFont()
+{
+    DEFINE_STATIC_LOCAL(String, fontFace, ("Arial"));
+    return fontFace;
+}
+
+static PassRefPtr<Gradient> createLinearGradient(RGBA32 top, RGBA32 bottom, const IntPoint& a, const IntPoint& b)
+{
+    RefPtr<Gradient> gradient = Gradient::create(a, b);
+    gradient->addColorStop(0.0, Color(top));
+    gradient->addColorStop(1.0, Color(bottom));
+    return gradient.release();
+}
+
+static Path roundedRectForBorder(RenderObject* object, const IntRect& rect)
+{
+    RenderStyle* style = object->style();
+    LengthSize topLeftRadius = style->borderTopLeftRadius();
+    LengthSize topRightRadius = style->borderTopRightRadius();
+    LengthSize bottomLeftRadius = style->borderBottomLeftRadius();
+    LengthSize bottomRightRadius = style->borderBottomRightRadius();
+
+    Path roundedRect;
+    roundedRect.addRoundedRect(rect, IntSize(topLeftRadius.width().value(), topLeftRadius.height().value()),
+                                     IntSize(topRightRadius.width().value(), topRightRadius.height().value()),
+                                     IntSize(bottomLeftRadius.width().value(), bottomLeftRadius.height().value()),
+                                     IntSize(bottomRightRadius.width().value(), bottomRightRadius.height().value()));
+    return roundedRect;
+}
+
+PassRefPtr<RenderTheme> RenderTheme::themeForPage(Page* page)
+{
+    static RenderTheme* theme = RenderThemeBlackBerry::create().leakRef();
+    return theme;
+}
+
+PassRefPtr<RenderTheme> RenderThemeBlackBerry::create()
+{
+    return adoptRef(new RenderThemeBlackBerry());
+}
+
+RenderThemeBlackBerry::RenderThemeBlackBerry()
+{
+}
+
+RenderThemeBlackBerry::~RenderThemeBlackBerry()
+{
+}
+
+String RenderThemeBlackBerry::extraDefaultStyleSheet()
+{
+    return String(themeBlackBerryUserAgentStyleSheet, sizeof(themeBlackBerryUserAgentStyleSheet));
+}
+
+#if ENABLE(VIDEO)
+String RenderThemeBlackBerry::extraMediaControlsStyleSheet()
+{
+    return String(mediaControlsBlackBerryUserAgentStyleSheet, sizeof(mediaControlsBlackBerryUserAgentStyleSheet));
+}
+
+String RenderThemeBlackBerry::formatMediaControlsRemainingTime(float, float duration) const
+{
+    // This is a workaround to make the appearance of media time controller in
+    // in-page mode the same as in fullscreen mode.
+    return formatMediaControlsTime(duration);
+}
+#endif
+
+double RenderThemeBlackBerry::caretBlinkInterval() const
+{
+    return 0; // Turn off caret blinking.
+}
+
+void RenderThemeBlackBerry::systemFont(int propId, FontDescription& fontDescription) const
+{
+    float fontSize = defaultFontSize;
+
+    if (propId == CSSValueWebkitMiniControl || propId ==  CSSValueWebkitSmallControl || propId == CSSValueWebkitControl) {
+        // Why 2 points smaller? Because that's what Gecko does. Note that we
+        // are assuming a 96dpi screen, which is the default value we use on Windows.
+        static const float pointsPerInch = 72.0f;
+        static const float pixelsPerInch = 96.0f;
+        fontSize -= (2.0f / pointsPerInch) * pixelsPerInch;
+    }
+
+    fontDescription.firstFamily().setFamily(defaultGUIFont());
+    fontDescription.setSpecifiedSize(fontSize);
+    fontDescription.setIsAbsoluteSize(true);
+    fontDescription.setGenericFamily(FontDescription::NoFamily);
+    fontDescription.setWeight(FontWeightNormal);
+    fontDescription.setItalic(false);
+}
+
+void RenderThemeBlackBerry::setButtonStyle(RenderStyle* style) const
+{
+    Length vertPadding(int(style->fontSize() / paddingDivisor), Fixed);
+    style->setPaddingTop(vertPadding);
+    style->setPaddingBottom(vertPadding);
+}
+
+void RenderThemeBlackBerry::adjustButtonStyle(CSSStyleSelector*, RenderStyle* style, Element*) const
+{
+    setButtonStyle(style);
+    style->setCursor(CURSOR_WEBKIT_GRAB);
+}
+
+void RenderThemeBlackBerry::adjustTextAreaStyle(CSSStyleSelector*, RenderStyle* style, Element*) const
+{
+    setButtonStyle(style);
+}
+
+bool RenderThemeBlackBerry::paintTextArea(RenderObject* object, const PaintInfo& info, const IntRect& rect)
+{
+    return paintTextFieldOrTextAreaOrSearchField(object, info, rect);
+}
+
+void RenderThemeBlackBerry::adjustTextFieldStyle(CSSStyleSelector*, RenderStyle* style, Element*) const
+{
+    setButtonStyle(style);
+}
+
+bool RenderThemeBlackBerry::paintTextFieldOrTextAreaOrSearchField(RenderObject* object, const PaintInfo& info, const IntRect& rect)
+{
+    ASSERT(info.context);
+    GraphicsContext* context = info.context;
+
+    context->save();
+    context->setStrokeStyle(SolidStroke);
+    context->setStrokeThickness(lineWidth);
+    if (!isEnabled(object))
+        context->setStrokeColor(disabledOutline, ColorSpaceDeviceRGB);
+    else if (isPressed(object))
+        info.context->setStrokeGradient(createLinearGradient(depressedTopOutline, depressedBottomOutline, rect.maxXMinYCorner(), rect.maxXMaxYCorner()));
+    else if (isHovered(object) || isFocused(object))
+        context->setStrokeGradient(createLinearGradient(hoverTopOutline, hoverBottomOutline, rect.maxXMinYCorner(), rect.maxXMaxYCorner()));
+    else
+        context->setStrokeGradient(createLinearGradient(regularTopOutline, regularBottomOutline, rect.maxXMinYCorner(), rect.maxXMaxYCorner()));
+
+    Path textFieldRoundedRectangle = roundedRectForBorder(object, rect);
+    if (object->style()->appearance() == SearchFieldPart) {
+        // We force the fill color to White so as to match the background color of the search cancel button graphic.
+        context->setFillColor(Color::white, ColorSpaceDeviceRGB);
+        context->drawPath(textFieldRoundedRectangle);
+    } else
+        context->strokePath(textFieldRoundedRectangle);
+    context->restore();
+    return false;
+}
+
+bool RenderThemeBlackBerry::paintTextField(RenderObject* object, const PaintInfo& info, const IntRect& rect)
+{
+    return paintTextFieldOrTextAreaOrSearchField(object, info, rect);
+}
+
+void RenderThemeBlackBerry::adjustSearchFieldStyle(CSSStyleSelector*, RenderStyle* style, Element*) const
+{
+    setButtonStyle(style);
+}
+
+void RenderThemeBlackBerry::adjustSearchFieldCancelButtonStyle(CSSStyleSelector*, RenderStyle* style, Element*) const
+{
+    static const float defaultControlFontPixelSize = 13;
+    static const float defaultCancelButtonSize = 9;
+    static const float minCancelButtonSize = 5;
+    static const float maxCancelButtonSize = 21;
+
+    // Scale the button size based on the font size
+    float fontScale = style->fontSize() / defaultControlFontPixelSize;
+    int cancelButtonSize = lroundf(std::min(std::max(minCancelButtonSize, defaultCancelButtonSize * fontScale), maxCancelButtonSize));
+    Length length(cancelButtonSize, Fixed);
+    style->setWidth(length);
+    style->setHeight(length);
+}
+
+bool RenderThemeBlackBerry::paintSearchField(RenderObject* object, const PaintInfo& info, const IntRect& rect)
+{
+    return paintTextFieldOrTextAreaOrSearchField(object, info, rect);
+}
+
+bool RenderThemeBlackBerry::paintSearchFieldCancelButton(RenderObject* object, const PaintInfo& paintInfo, const IntRect& rect)
+{
+    ASSERT(object->parent());
+    if (!object->parent() || !object->parent()->isBox())
+        return false;
+
+    RenderBox* parentRenderBox = toRenderBox(object->parent());
+
+    IntRect parentBox = parentRenderBox->absoluteContentBox();
+    IntRect bounds = rect;
+    // Make sure the scaled button stays square and fits in its parent's box.
+    bounds.setHeight(std::min(parentBox.width(), std::min(parentBox.height(), bounds.height())));
+    bounds.setWidth(bounds.height());
+
+    // Put the button in the middle vertically, and round up the value.
+    // So if it has to be one pixel off-center, it would be one pixel closer
+    // to the bottom of the field. This would look better with the text.
+    bounds.setY(parentBox.y() + (parentBox.height() - bounds.height() + 1) / 2);
+
+    static Image* cancelImage = Image::loadPlatformResource("searchCancel").leakRef();
+    static Image* cancelPressedImage = Image::loadPlatformResource("searchCancelPressed").leakRef();
+    paintInfo.context->drawImage(isPressed(object) ? cancelPressedImage : cancelImage, object->style()->colorSpace(), bounds);
+    return false;
+}
+
+void RenderThemeBlackBerry::adjustMenuListButtonStyle(CSSStyleSelector*, RenderStyle* style, Element*) const
+{
+    // These seem to be reasonable padding values from observation.
+    const int paddingLeft = 8;
+    const int paddingRight = 4;
+
+    const int minHeight = style->fontSize() * 2;
+
+    style->resetPadding();
+    style->setHeight(Length(Auto));
+
+    style->setPaddingRight(Length(minHeight + paddingRight, Fixed));
+    style->setPaddingLeft(Length(paddingLeft, Fixed));
+    style->setCursor(CURSOR_WEBKIT_GRAB);
+}
+
+void RenderThemeBlackBerry::calculateButtonSize(RenderStyle* style) const
+{
+    int size = style->fontSize();
+    Length length(size, Fixed);
+    if (style->appearance() == CheckboxPart || style->appearance() == RadioPart) {
+        style->setWidth(length);
+        style->setHeight(length);
+        return;
+    }
+
+    // If the width and height are both specified, then we have nothing to do.
+    if (!style->width().isIntrinsicOrAuto() && !style->height().isAuto())
+        return;
+
+    if (style->width().isIntrinsicOrAuto())
+        style->setWidth(length);
+
+    if (style->height().isAuto())
+        style->setHeight(length);
+}
+
+bool RenderThemeBlackBerry::paintCheckbox(RenderObject* object, const PaintInfo& info, const IntRect& rect)
+{
+    return paintButton(object, info, rect);
+}
+
+void RenderThemeBlackBerry::setCheckboxSize(RenderStyle* style) const
+{
+    calculateButtonSize(style);
+}
+
+bool RenderThemeBlackBerry::paintRadio(RenderObject* object, const PaintInfo& info, const IntRect& rect)
+{
+    return paintButton(object, info, rect);
+}
+
+void RenderThemeBlackBerry::setRadioSize(RenderStyle* style) const
+{
+    calculateButtonSize(style);
+}
+
+// If this function returns false, WebCore assumes the button is fully decorated
+bool RenderThemeBlackBerry::paintButton(RenderObject* object, const PaintInfo& info, const IntRect& rect)
+{
+    ASSERT(info.context);
+    info.context->save();
+
+    info.context->setStrokeStyle(SolidStroke);
+    info.context->setStrokeThickness(lineWidth);
+
+    Color check(blackPen);
+    if (!isEnabled(object)) {
+        info.context->setFillGradient(createLinearGradient(disabledTop, disabledBottom, rect.maxXMinYCorner(), rect.maxXMaxYCorner()));
+        info.context->setStrokeColor(disabledOutline, ColorSpaceDeviceRGB);
+    } else if (isPressed(object)) {
+        info.context->setFillGradient(createLinearGradient(depressedTop, depressedBottom, rect.maxXMinYCorner(), rect.maxXMaxYCorner()));
+        info.context->setStrokeGradient(createLinearGradient(depressedTopOutline, depressedBottomOutline, rect.maxXMinYCorner(), rect.maxXMaxYCorner()));
+    } else if (isHovered(object)) {
+        info.context->setFillGradient(createLinearGradient(hoverTop, hoverBottom, rect.maxXMinYCorner(), rect.maxXMaxYCorner()));
+        info.context->setStrokeGradient(createLinearGradient(hoverTopOutline, hoverBottomOutline, rect.maxXMinYCorner(), rect.maxXMaxYCorner()));
+    } else {
+        info.context->setFillGradient(createLinearGradient(regularTop, regularBottom, rect.maxXMinYCorner(), rect.maxXMaxYCorner()));
+        info.context->setStrokeGradient(createLinearGradient(regularTopOutline, regularBottomOutline, rect.maxXMinYCorner(), rect.maxXMaxYCorner()));
+    }
+
+    ControlPart part = object->style()->appearance();
+    switch (part) {
+    case CheckboxPart: {
+        FloatSize smallCorner(smallRadius, smallRadius);
+        Path path;
+        path.addRoundedRect(rect, smallCorner);
+        info.context->drawPath(path);
+
+        if (isChecked(object)) {
+            Path checkPath;
+            IntRect rect2 = rect;
+            rect2.inflate(-1);
+            checkPath.moveTo(FloatPoint(rect2.x() + rect2.width() * checkboxLeftX, rect2.y() + rect2.height() * checkboxLeftY));
+            checkPath.addLineTo(FloatPoint(rect2.x() + rect2.width() * checkboxMiddleX, rect2.maxY() - rect2.height() * checkboxMiddleY));
+            checkPath.addLineTo(FloatPoint(rect2.x() + rect2.width() * checkboxRightX, rect2.y() + rect2.height() * checkboxRightY));
+            info.context->setLineCap(RoundCap);
+            info.context->setStrokeColor(blackPen, ColorSpaceDeviceRGB);
+            info.context->setStrokeThickness(rect2.width() / checkboxStrokeThickness);
+            info.context->drawPath(checkPath);
+        }
+        break;
+    }
+    case RadioPart:
+        info.context->drawEllipse(rect);
+        if (isChecked(object)) {
+            IntRect rect2 = rect;
+            rect2.inflate(-rect.width() * radioButtonCheckStateScaler);
+            info.context->setFillColor(check, ColorSpaceDeviceRGB);
+            info.context->setStrokeColor(check, ColorSpaceDeviceRGB);
+            info.context->drawEllipse(rect2);
+        }
+        break;
+    case ButtonPart:
+    case PushButtonPart: {
+        FloatSize largeCorner(largeRadius, largeRadius);
+        Path path;
+        path.addRoundedRect(rect, largeCorner);
+        info.context->drawPath(path);
+        break;
+    }
+    case SquareButtonPart: {
+        Path path;
+        path.addRect(rect);
+        info.context->drawPath(path);
+        break;
+    }
+    default:
+        info.context->restore();
+        return true;
+    }
+
+    info.context->restore();
+    return false;
+}
+
+void RenderThemeBlackBerry::adjustMenuListStyle(CSSStyleSelector* css, RenderStyle* style, Element* element) const
+{
+    adjustMenuListButtonStyle(css, style, element);
+}
+
+void RenderThemeBlackBerry::adjustCheckboxStyle(CSSStyleSelector*, RenderStyle* style, Element*) const
+{
+    setCheckboxSize(style);
+    style->setBoxShadow(nullptr);
+    Length margin(marginSize, Fixed);
+    style->setMarginBottom(margin);
+    style->setMarginRight(margin);
+    style->setCursor(CURSOR_WEBKIT_GRAB);
+}
+
+void RenderThemeBlackBerry::adjustRadioStyle(CSSStyleSelector*, RenderStyle* style, Element*) const
+{
+    setRadioSize(style);
+    style->setBoxShadow(nullptr);
+    Length margin(marginSize, Fixed);
+    style->setMarginBottom(margin);
+    style->setMarginRight(margin);
+    style->setCursor(CURSOR_WEBKIT_GRAB);
+}
+
+void RenderThemeBlackBerry::paintMenuListButtonGradientAndArrow(GraphicsContext* context, RenderObject* object, IntRect buttonRect, const Path& clipPath)
+{
+    ASSERT(context);
+    context->save();
+    if (!isEnabled(object))
+        context->setFillGradient(createLinearGradient(disabledTop, disabledBottom, buttonRect.maxXMinYCorner(), buttonRect.maxXMaxYCorner()));
+    else if (isPressed(object))
+        context->setFillGradient(createLinearGradient(depressedTop, depressedBottom, buttonRect.maxXMinYCorner(), buttonRect.maxXMaxYCorner()));
+    else if (isHovered(object))
+        context->setFillGradient(createLinearGradient(hoverTop, hoverBottom, buttonRect.maxXMinYCorner(), buttonRect.maxXMaxYCorner()));
+    else
+        context->setFillGradient(createLinearGradient(regularTop, regularBottom, buttonRect.maxXMinYCorner(), buttonRect.maxXMaxYCorner()));
+
+    // 1. Paint the background of the button.
+    context->clip(clipPath);
+    context->drawRect(buttonRect);
+    context->restore();
+
+    // 2. Paint the button arrow.
+    buttonRect.inflate(-buttonRect.width() / 3);
+    buttonRect.move(0, buttonRect.height() * 7 / 20);
+    Path path;
+    path.moveTo(FloatPoint(buttonRect.x(), buttonRect.y()));
+    path.addLineTo(FloatPoint(buttonRect.x() + buttonRect.width(), buttonRect.y()));
+    path.addLineTo(FloatPoint(buttonRect.x() + buttonRect.width() / 2.0, buttonRect.y() + buttonRect.height() / 2.0));
+    path.closeSubpath();
+
+    context->save();
+    context->setStrokeStyle(SolidStroke);
+    context->setStrokeThickness(lineWidth);
+    context->setStrokeColor(Color::black, ColorSpaceDeviceRGB);
+    context->setFillColor(Color::black, ColorSpaceDeviceRGB);
+    context->setLineJoin(BevelJoin);
+    context->fillPath(path);
+    context->restore();
+}
+
+static IntRect computeMenuListArrowButtonRect(const IntRect& rect)
+{
+    // FIXME: The menu list arrow button should have a minimum and maximum width (to ensure usability) or
+    // scale with respect to the font size used in the menu list control or some combination of both.
+    return IntRect(IntPoint(rect.maxX() - rect.height(), rect.y()), IntSize(rect.height(), rect.height()));
+}
+
+static void paintMenuListBackground(GraphicsContext* context, const Path& menuListPath, const Color& backgroundColor)
+{
+    ASSERT(context);
+    context->save();
+    context->setFillColor(backgroundColor, ColorSpaceDeviceRGB);
+    context->fillPath(menuListPath);
+    context->restore();
+}
+
+bool RenderThemeBlackBerry::paintMenuList(RenderObject* object, const PaintInfo& info, const IntRect& rect)
+{
+    // Note, this method is not called if the menu list explicitly specifies either a border or background color.
+    // Instead, RenderThemeBlackBerry::paintMenuListButton is called. Therefore, when this method is called, we don't
+    // have to adjust rect with respect to the border dimensions.
+
+    ASSERT(info.context);
+    GraphicsContext* context = info.context;
+
+    Path menuListRoundedRectangle = roundedRectForBorder(object, rect);
+
+    // 1. Paint the background of the entire control.
+    paintMenuListBackground(context, menuListRoundedRectangle, Color::white);
+
+    // 2. Paint the background of the button and its arrow.
+    IntRect arrowButtonRectangle = computeMenuListArrowButtonRect(rect);
+    paintMenuListButtonGradientAndArrow(context, object, arrowButtonRectangle, menuListRoundedRectangle);
+
+    // 4. Stroke an outline around the entire control.
+    context->save();
+    context->setStrokeStyle(SolidStroke);
+    context->setStrokeThickness(lineWidth);
+    if (!isEnabled(object))
+        context->setStrokeColor(disabledOutline, ColorSpaceDeviceRGB);
+    else if (isPressed(object))
+        context->setStrokeGradient(createLinearGradient(depressedTopOutline, depressedBottomOutline, rect.maxXMinYCorner(), rect.maxXMaxYCorner()));
+    else if (isHovered(object))
+        context->setStrokeGradient(createLinearGradient(hoverTopOutline, hoverBottomOutline, rect.maxXMinYCorner(), rect.maxXMaxYCorner()));
+    else
+        context->setStrokeGradient(createLinearGradient(regularTopOutline, regularBottomOutline, rect.maxXMinYCorner(), rect.maxXMaxYCorner()));
+
+    context->strokePath(menuListRoundedRectangle);
+    context->restore();
+    return false;
+}
+
+bool RenderThemeBlackBerry::paintMenuListButton(RenderObject* object, const PaintInfo& info, const IntRect& rect)
+{
+    // Note, this method is only called if the menu list explicitly specifies either a border or background color.
+    // Otherwise, RenderThemeBlackBerry::paintMenuList is called. We need to fit the arrow button with the border box
+    // of the menu-list so as to not occlude the custom border.
+
+    // We compute menuListRoundedRectangle with respect to the dimensions of the entire menu-list control (i.e. rect) and
+    // its border radius so that we clip the contour of the arrow button (when we paint it below) to match the contour of
+    // the control.
+    Path menuListRoundedRectangle = roundedRectForBorder(object, rect);
+
+    // 1. Paint the background of the entire control.
+    Color fillColor = object->style()->visitedDependentColor(CSSPropertyBackgroundColor);
+    if (!fillColor.isValid())
+        fillColor = Color::white;
+    paintMenuListBackground(info.context, menuListRoundedRectangle, fillColor);
+
+    // 2. Paint the background of the button and its arrow.
+    IntRect bounds = IntRect(rect.x() + object->style()->borderLeftWidth(),
+                         rect.y() + object->style()->borderTopWidth(),
+                         rect.width() - object->style()->borderLeftWidth() - object->style()->borderRightWidth(),
+                         rect.height() - object->style()->borderTopWidth() - object->style()->borderBottomWidth());
+
+    IntRect arrowButtonRectangle = computeMenuListArrowButtonRect(bounds); // Fit the arrow button within the border box of the menu-list.
+    paintMenuListButtonGradientAndArrow(info.context, object, arrowButtonRectangle, menuListRoundedRectangle);
+    return false;
+}
+
+void RenderThemeBlackBerry::adjustSliderThumbSize(RenderStyle* style) const
+{
+    ControlPart part = style->appearance();
+    if (part == MediaVolumeSliderThumbPart || part == SliderThumbHorizontalPart || part == SliderThumbVerticalPart) {
+        style->setWidth(Length(part == SliderThumbVerticalPart ? sliderThumbHeight : sliderThumbWidth, Fixed));
+        style->setHeight(Length(part == SliderThumbVerticalPart ? sliderThumbWidth : sliderThumbHeight, Fixed));
+    } else if (part == MediaSliderThumbPart) {
+        style->setWidth(Length(mediaSliderThumbWidth, Fixed));
+        style->setHeight(Length(mediaSliderThumbHeight, Fixed));
+    }
+}
+
+bool RenderThemeBlackBerry::paintSliderTrack(RenderObject* object, const PaintInfo& info, const IntRect& rect)
+{
+    const static int SliderTrackHeight = 5;
+    IntRect rect2;
+    if (object->style()->appearance() == SliderHorizontalPart) {
+        rect2.setHeight(SliderTrackHeight);
+        rect2.setWidth(rect.width());
+        rect2.setX(rect.x());
+        rect2.setY(rect.y() + (rect.height() - SliderTrackHeight) / 2);
+    } else {
+        rect2.setHeight(rect.height());
+        rect2.setWidth(SliderTrackHeight);
+        rect2.setX(rect.x() + (rect.width() - SliderTrackHeight) / 2);
+        rect2.setY(rect.y());
+    }
+    return paintSliderTrackRect(object, info, rect2);
+}
+
+bool RenderThemeBlackBerry::paintSliderTrackRect(RenderObject* object, const PaintInfo& info, const IntRect& rect)
+{
+    return paintSliderTrackRect(object, info, rect, rangeSliderRegularTopOutline, rangeSliderRegularBottomOutline,
+                rangeSliderRegularTop, rangeSliderRegularBottom);
+}
+
+bool RenderThemeBlackBerry::paintSliderTrackRect(RenderObject* object, const PaintInfo& info, const IntRect& rect,
+        RGBA32 strokeColorStart, RGBA32 strokeColorEnd, RGBA32 fillColorStart, RGBA32 fillColorEnd)
+{
+    FloatSize smallCorner(smallRadius, smallRadius);
+
+    info.context->save();
+    info.context->setStrokeStyle(SolidStroke);
+    info.context->setStrokeThickness(lineWidth);
+
+    info.context->setStrokeGradient(createLinearGradient(strokeColorStart, strokeColorEnd, rect.maxXMinYCorner(), rect. maxXMaxYCorner()));
+    info.context->setFillGradient(createLinearGradient(fillColorStart, fillColorEnd, rect.maxXMinYCorner(), rect.maxXMaxYCorner()));
+
+    Path path;
+    path.addRoundedRect(rect, smallCorner);
+    info.context->fillPath(path);
+
+    info.context->restore();
+    return false;
+}
+
+bool RenderThemeBlackBerry::paintSliderThumb(RenderObject* object, const PaintInfo& info, const IntRect& rect)
+{
+    FloatSize largeCorner(largeRadius, largeRadius);
+
+    info.context->save();
+    info.context->setStrokeStyle(SolidStroke);
+    info.context->setStrokeThickness(lineWidth);
+
+    if (isPressed(object) || isHovered(object)) {
+        info.context->setStrokeGradient(createLinearGradient(hoverTopOutline, hoverBottomOutline, rect.maxXMinYCorner(), rect. maxXMaxYCorner()));
+        info.context->setFillGradient(createLinearGradient(hoverTop, hoverBottom, rect.maxXMinYCorner(), rect.maxXMaxYCorner()));
+    } else {
+        info.context->setStrokeGradient(createLinearGradient(regularTopOutline, regularBottomOutline, rect.maxXMinYCorner(), rect. maxXMaxYCorner()));
+        info.context->setFillGradient(createLinearGradient(regularTop, regularBottom, rect.maxXMinYCorner(), rect.maxXMaxYCorner()));
+    }
+
+    Path path;
+    path.addRoundedRect(rect, largeCorner);
+    info.context->fillPath(path);
+
+    bool isVertical = rect.width() > rect.height();
+    IntPoint startPoint(rect.x() + (isVertical ? 5 : 2), rect.y() + (isVertical ? 2 : 5));
+    IntPoint endPoint(rect.x() + (isVertical ? 20 : 2), rect.y() + (isVertical ? 2 : 20));
+    const int lineOffset = 2;
+    const int shadowOffset = 1;
+
+    for (int i = 0; i < 3; i++) {
+        if (isVertical) {
+            startPoint.setY(startPoint.y() + lineOffset);
+            endPoint.setY(endPoint.y() + lineOffset);
+        } else {
+            startPoint.setX(startPoint.x() + lineOffset);
+            endPoint.setX(endPoint.x() + lineOffset);
+        }
+        if (isPressed(object) || isHovered(object))
+            info.context->setStrokeColor(dragRollLight, ColorSpaceDeviceRGB);
+        else
+            info.context->setStrokeColor(dragRegularLight, ColorSpaceDeviceRGB);
+        info.context->drawLine(startPoint, endPoint);
+
+        if (isVertical) {
+            startPoint.setY(startPoint.y() + shadowOffset);
+            endPoint.setY(endPoint.y() + shadowOffset);
+        } else {
+            startPoint.setX(startPoint.x() + shadowOffset);
+            endPoint.setX(endPoint.x() + shadowOffset);
+        }
+        if (isPressed(object) || isHovered(object))
+            info.context->setStrokeColor(dragRollDark, ColorSpaceDeviceRGB);
+        else
+            info.context->setStrokeColor(dragRegularDark, ColorSpaceDeviceRGB);
+        info.context->drawLine(startPoint, endPoint);
+    }
+    info.context->restore();
+    return false;
+}
+
+static bool paintMediaButton(GraphicsContext* context, const IntRect& rect, Image* image)
+{
+    context->drawImage(image, ColorSpaceDeviceRGB, rect);
+    return false;
+}
+
+bool RenderThemeBlackBerry::paintMediaPlayButton(RenderObject* object, const PaintInfo& paintInfo, const IntRect& rect)
+{
+#if ENABLE(VIDEO)
+    HTMLMediaElement* mediaElement = toParentMediaElement(object);
+
+    if (!mediaElement)
+        return false;
+
+    static Image* mediaPlay = Image::loadPlatformResource("play").leakRef();
+    static Image* mediaPause = Image::loadPlatformResource("pause").leakRef();
+
+    return paintMediaButton(paintInfo.context, rect, mediaElement->canPlay() ? mediaPlay : mediaPause);
+#else
+    UNUSED_PARAM(object);
+    UNUSED_PARAM(paintInfo);
+    UNUSED_PARAM(rect);
+    return false;
+#endif
+}
+
+bool RenderThemeBlackBerry::paintMediaMuteButton(RenderObject* object, const PaintInfo& paintInfo, const IntRect& rect)
+{
+#if ENABLE(VIDEO)
+    HTMLMediaElement* mediaElement = toParentMediaElement(object);
+
+    if (!mediaElement)
+        return false;
+
+    static Image* mediaMute = Image::loadPlatformResource("speaker").leakRef();
+    static Image* mediaUnmute = Image::loadPlatformResource("speaker_mute").leakRef();
+
+    return paintMediaButton(paintInfo.context, rect, mediaElement->muted() || !mediaElement->volume() ? mediaUnmute : mediaMute);
+#else
+    UNUSED_PARAM(object);
+    UNUSED_PARAM(paintInfo);
+    UNUSED_PARAM(rect);
+    return false;
+#endif
+}
+
+bool RenderThemeBlackBerry::paintMediaFullscreenButton(RenderObject* object, const PaintInfo& paintInfo, const IntRect& rect)
+{
+#if ENABLE(VIDEO)
+    if (!toParentMediaElement(object))
+        return false;
+
+    static Image* mediaFullscreen = Image::loadPlatformResource("fullscreen").leakRef();
+
+    return paintMediaButton(paintInfo.context, rect, mediaFullscreen);
+#else
+    UNUSED_PARAM(object);
+    UNUSED_PARAM(paintInfo);
+    UNUSED_PARAM(rect);
+    return false;
+#endif
+}
+
+bool RenderThemeBlackBerry::paintMediaSliderTrack(RenderObject* object, const PaintInfo& paintInfo, const IntRect& rect)
+{
+#if ENABLE(VIDEO)
+    IntRect rect2(rect.x() + 3, rect.y() + 14, rect.width() - 6, 2);
+
+    HTMLMediaElement* mediaElement = toParentMediaElement(object);
+
+    if (!mediaElement)
+        return false;
+
+    float loaded = 0;
+    // FIXME: replace loaded with commented out one when buffer bug is fixed (see comment in
+    // MediaPlayerPrivateMMrenderer::percentLoaded).
+    // loaded = mediaElement->percentLoaded();
+    if (mediaElement->player())
+        loaded = static_cast<MediaPlayerPrivate *>(mediaElement->player()->implementation())->percentLoaded();
+    float position = mediaElement->duration() > 0 ? (mediaElement->currentTime() / mediaElement->duration()) : 0;
+
+    int x = rect.x() + 3;
+    int y = rect.y() + 14;
+    int w = rect.width() - 6;
+    int h = 2;
+
+    int wPlayed = (w * position);
+    int wLoaded = (w - mediaSliderThumbWidth) * loaded + mediaSliderThumbWidth;
+
+    IntRect played(x, y, wPlayed, h);
+    IntRect buffered(x, y, wLoaded, h);
+
+    // This is to paint main slider bar.
+    bool result = paintSliderTrackRect(object, paintInfo, rect2);
+
+    if (loaded > 0 || position > 0) {
+        // This is to paint buffered bar.
+        paintSliderTrackRect(object, paintInfo, buffered, Color::darkGray, Color::darkGray, Color::darkGray, Color::darkGray);
+
+        // This is to paint played part of bar (left of slider thumb) using selection color.
+        paintSliderTrackRect(object, paintInfo, played, selection, selection, selection, selection);
+    }
+    return result;
+
+#else
+    UNUSED_PARAM(object);
+    UNUSED_PARAM(paintInfo);
+    UNUSED_PARAM(rect);
+    return false;
+#endif
+}
+
+bool RenderThemeBlackBerry::paintMediaSliderThumb(RenderObject* object, const PaintInfo& paintInfo, const IntRect& rect)
+{
+#if ENABLE(VIDEO)
+    if (!object->parent())
+        return false;
+
+    RenderSlider* slider = toRenderSlider(object->parent()->parent()->parent());
+    if (!slider)
+        return false;
+
+    paintInfo.context->save();
+    Path mediaThumbRoundedRectangle;
+    mediaThumbRoundedRectangle.addRoundedRect(rect, FloatSize(mediaSliderThumbRadius, mediaSliderThumbRadius));
+    paintInfo.context->setStrokeStyle(SolidStroke);
+    paintInfo.context->setStrokeThickness(0.5);
+    paintInfo.context->setStrokeColor(Color::black, ColorSpaceDeviceRGB);
+
+    if (isPressed(object) || isHovered(object) || slider->inDragMode()) {
+        paintInfo.context->setFillGradient(createLinearGradient(selection, Color(selection).dark().rgb(),
+                rect.maxXMinYCorner(), rect.maxXMaxYCorner()));
+    } else {
+        paintInfo.context->setFillGradient(createLinearGradient(Color::white, Color(Color::white).dark().rgb(),
+                rect.maxXMinYCorner(), rect.maxXMaxYCorner()));
+    }
+    paintInfo.context->fillPath(mediaThumbRoundedRectangle);
+    paintInfo.context->restore();
+
+    return true;
+#else
+    UNUSED_PARAM(object);
+    UNUSED_PARAM(paintInfo);
+    UNUSED_PARAM(rect);
+    return false;
+#endif
+}
+
+bool RenderThemeBlackBerry::paintMediaVolumeSliderTrack(RenderObject* object, const PaintInfo& paintInfo, const IntRect& rect)
+{
+#if ENABLE(VIDEO)
+    float pad = rect.width() * 0.45;
+    float x = rect.x() + pad;
+    float y = rect.y() + pad;
+    float width = rect.width() * 0.1;
+    float height = rect.height() - (2.0 * pad);
+
+    IntRect rect2(x, y, width, height);
+
+    return paintSliderTrackRect(object, paintInfo, rect2);
+#else
+    UNUSED_PARAM(object);
+    UNUSED_PARAM(paintInfo);
+    UNUSED_PARAM(rect);
+    return false;
+#endif
+}
+
+bool RenderThemeBlackBerry::paintMediaVolumeSliderThumb(RenderObject* object, const PaintInfo& paintInfo, const IntRect& rect)
+{
+#if ENABLE(VIDEO)
+    static Image* mediaVolumeThumb = Image::loadPlatformResource("volume_thumb").leakRef();
+
+    return paintMediaButton(paintInfo.context, rect, mediaVolumeThumb);
+#else
+    UNUSED_PARAM(object);
+    UNUSED_PARAM(paintInfo);
+    UNUSED_PARAM(rect);
+    return false;
+#endif
+}
+
+Color RenderThemeBlackBerry::platformFocusRingColor() const
+{
+    return focusRingPen;
+}
+
+#if ENABLE(TOUCH_EVENTS)
+Color RenderThemeBlackBerry::platformTapHighlightColor() const
+{
+    // Same color as 'focusRingPen' + 80 of alpha channel.
+    return Color(163, 200, 254, 80);
+}
+#endif
+
+Color RenderThemeBlackBerry::platformActiveSelectionBackgroundColor() const
+{
+    return Color(selection);
+}
+
+double RenderThemeBlackBerry::animationRepeatIntervalForProgressBar(RenderProgress* renderProgress) const
+{
+    return renderProgress->isDeterminate() ? 0.0 : 0.1;
+}
+
+double RenderThemeBlackBerry::animationDurationForProgressBar(RenderProgress* renderProgress) const
+{
+    return renderProgress->isDeterminate() ? 0.0 : 2.0;
+}
+
+bool RenderThemeBlackBerry::paintProgressBar(RenderObject* object, const PaintInfo& info, const IntRect& rect)
+{
+    if (!object->isProgress())
+        return true;
+
+    RenderProgress* renderProgress = toRenderProgress(object);
+
+    FloatSize smallCorner(smallRadius, smallRadius);
+
+    info.context->save();
+    info.context->setStrokeStyle(SolidStroke);
+    info.context->setStrokeThickness(lineWidth);
+
+    info.context->setStrokeGradient(createLinearGradient(rangeSliderRegularTopOutline, rangeSliderRegularBottomOutline, rect.maxXMinYCorner(), rect.maxXMaxYCorner()));
+    info.context->setFillGradient(createLinearGradient(rangeSliderRegularTop, rangeSliderRegularBottom, rect.maxXMinYCorner(), rect.maxXMaxYCorner()));
+
+    Path path;
+    path.addRoundedRect(rect, smallCorner);
+    info.context->fillPath(path);
+
+    IntRect rect2 = rect;
+    rect2.setX(rect2.x() + 1);
+    rect2.setHeight(rect2.height() - 2);
+    rect2.setY(rect2.y() + 1);
+    info.context->setStrokeStyle(NoStroke);
+    info.context->setStrokeThickness(0);
+    if (renderProgress->isDeterminate()) {
+        rect2.setWidth(rect2.width() * renderProgress->position() - 2);
+        info.context->setFillGradient(createLinearGradient(progressRegularTop, progressRegularBottom, rect2.maxXMinYCorner(), rect2.maxXMaxYCorner()));
+    } else {
+        // Animating
+        rect2.setWidth(rect2.width() - 2);
+        RefPtr<Gradient> gradient = Gradient::create(rect2.minXMaxYCorner(), rect2.maxXMaxYCorner());
+        gradient->addColorStop(0.0, Color(progressRegularBottom));
+        gradient->addColorStop(renderProgress->animationProgress(), Color(progressRegularTop));
+        gradient->addColorStop(1.0, Color(progressRegularBottom));
+        info.context->setFillGradient(gradient);
+    }
+    Path path2;
+    path2.addRoundedRect(rect2, smallCorner);
+    info.context->fillPath(path2);
+
+    info.context->restore();
+    return false;
+}
+
+Color RenderThemeBlackBerry::platformActiveTextSearchHighlightColor() const
+{
+    return Color(255, 150, 50); // Orange.
+}
+
+Color RenderThemeBlackBerry::platformInactiveTextSearchHighlightColor() const
+{
+    return Color(255, 255, 0); // Yellow.
+}
+
+} // namespace WebCore
diff --git a/Source/WebCore/platform/blackberry/RenderThemeBlackBerry.h b/Source/WebCore/platform/blackberry/RenderThemeBlackBerry.h
new file mode 100644
index 000000000..62cb739d8
--- /dev/null
+++ b/Source/WebCore/platform/blackberry/RenderThemeBlackBerry.h
@@ -0,0 +1,116 @@
+/*
+ * Copyright (C) 2009, 2010, 2011, 2012 Research In Motion Limited. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+#ifndef RenderThemeBlackBerry_h
+#define RenderThemeBlackBerry_h
+
+#include "RenderTheme.h"
+
+namespace WebCore {
+
+class RenderThemeBlackBerry : public RenderTheme {
+public:
+    static PassRefPtr<RenderTheme> create();
+    virtual ~RenderThemeBlackBerry();
+
+    virtual String extraDefaultStyleSheet();
+
+#if ENABLE(VIDEO)
+    virtual String extraMediaControlsStyleSheet();
+    virtual String formatMediaControlsRemainingTime(float currentTime, float duration) const;
+#endif
+    virtual bool supportsHover(const RenderStyle*) const { return true; }
+
+    virtual double caretBlinkInterval() const;
+
+    virtual void systemFont(int cssValueId, FontDescription&) const;
+    virtual bool paintCheckbox(RenderObject*, const PaintInfo&, const IntRect&);
+    virtual void setCheckboxSize(RenderStyle*) const;
+    virtual bool paintRadio(RenderObject*, const PaintInfo&, const IntRect&);
+    virtual void setRadioSize(RenderStyle*) const;
+    virtual bool paintButton(RenderObject*, const PaintInfo&, const IntRect&);
+    void calculateButtonSize(RenderStyle*) const;
+    virtual void adjustMenuListStyle(CSSStyleSelector*, RenderStyle*, Element*) const;
+    virtual bool paintMenuListButton(RenderObject*, const PaintInfo&, const IntRect&);
+    virtual void adjustSliderThumbSize(RenderStyle*) const;
+    virtual bool paintSliderTrack(RenderObject*, const PaintInfo&, const IntRect&);
+    virtual bool paintSliderThumb(RenderObject*, const PaintInfo&, const IntRect&);
+
+#if ENABLE(TOUCH_EVENTS)
+    virtual Color platformTapHighlightColor() const;
+#endif
+
+    virtual Color platformFocusRingColor() const;
+    virtual bool supportsFocusRing(const RenderStyle* style) const { return style->hasAppearance(); }
+
+    virtual void adjustButtonStyle(CSSStyleSelector*, RenderStyle*, Element*) const;
+    virtual void adjustTextFieldStyle(CSSStyleSelector*, RenderStyle*, Element*) const;
+    virtual bool paintTextField(RenderObject*, const PaintInfo&, const IntRect&);
+
+    virtual void adjustTextAreaStyle(CSSStyleSelector*, RenderStyle*, Element*) const;
+    virtual bool paintTextArea(RenderObject*, const PaintInfo&, const IntRect&);
+
+    virtual void adjustSearchFieldStyle(CSSStyleSelector*, RenderStyle*, Element*) const;
+    virtual void adjustSearchFieldCancelButtonStyle(CSSStyleSelector*, RenderStyle*, Element*) const;
+    virtual bool paintSearchField(RenderObject*, const PaintInfo&, const IntRect&);
+    virtual bool paintSearchFieldCancelButton(RenderObject*, const PaintInfo&, const IntRect&);
+
+    virtual void adjustMenuListButtonStyle(CSSStyleSelector*, RenderStyle*, Element*) const;
+    virtual void adjustCheckboxStyle(CSSStyleSelector*, RenderStyle*, Element*) const;
+    virtual void adjustRadioStyle(CSSStyleSelector*, RenderStyle*, Element*) const;
+    virtual bool paintMenuList(RenderObject*, const PaintInfo&, const IntRect&);
+
+    virtual bool paintMediaFullscreenButton(RenderObject*, const PaintInfo&, const IntRect&);
+    virtual bool paintMediaSliderTrack(RenderObject*, const PaintInfo&, const IntRect&);
+    virtual bool paintMediaVolumeSliderTrack(RenderObject*, const PaintInfo&, const IntRect&);
+    virtual bool paintMediaSliderThumb(RenderObject*, const PaintInfo&, const IntRect&);
+    virtual bool paintMediaVolumeSliderThumb(RenderObject*, const PaintInfo&, const IntRect&);
+    virtual bool paintMediaPlayButton(RenderObject*, const PaintInfo&, const IntRect&);
+    virtual bool paintMediaMuteButton(RenderObject*, const PaintInfo&, const IntRect&);
+    virtual bool paintProgressBar(RenderObject*, const PaintInfo&, const IntRect&);
+    virtual double animationRepeatIntervalForProgressBar(RenderProgress*) const;
+    virtual double animationDurationForProgressBar(RenderProgress*) const;
+
+    virtual Color platformActiveSelectionBackgroundColor() const;
+
+    // Highlighting colors for TextMatches.
+    virtual Color platformActiveTextSearchHighlightColor() const;
+    virtual Color platformInactiveTextSearchHighlightColor() const;
+
+private:
+    static const String& defaultGUIFont();
+
+    // The default variable-width font size. We use this as the default font
+    // size for the "system font", and as a base size (which we then shrink) for
+    // form control fonts.
+    static float defaultFontSize;
+
+    RenderThemeBlackBerry();
+    void setButtonStyle(RenderStyle*) const;
+
+    void paintMenuListButtonGradientAndArrow(GraphicsContext*, RenderObject*, IntRect buttonRect, const Path& clipPath);
+    bool paintTextFieldOrTextAreaOrSearchField(RenderObject*, const PaintInfo&, const IntRect&);
+    bool paintSliderTrackRect(RenderObject*, const PaintInfo&, const IntRect&);
+    bool paintSliderTrackRect(RenderObject*, const PaintInfo&, const IntRect&, RGBA32 strokeColorStart,
+                RGBA32 strokeColorEnd, RGBA32 fillColorStart, RGBA32 fillColorEnd);
+
+};
+
+} // namespace WebCore
+
+#endif // RenderThemeBlackBerry_h
diff --git a/Source/WebCore/platform/cf/SharedBufferCF.cpp b/Source/WebCore/platform/cf/SharedBufferCF.cpp
index 30a5e890c..d0b0ea9f0 100644
--- a/Source/WebCore/platform/cf/SharedBufferCF.cpp
+++ b/Source/WebCore/platform/cf/SharedBufferCF.cpp
@@ -115,6 +115,23 @@ void SharedBuffer::copyDataArrayAndClear(char *destination, unsigned bytesToCopy
     }
     m_dataArray.clear();
 }
+
+unsigned SharedBuffer::copySomeDataFromDataArray(const char*& someData, unsigned position) const
+{
+    Vector<RetainPtr<CFDataRef> >::const_iterator end = m_dataArray.end();
+    unsigned totalOffset = 0;
+    for (Vector<RetainPtr<CFDataRef> >::const_iterator it = m_dataArray.begin(); it != end; ++it) {
+        unsigned dataLen = static_cast<unsigned>(CFDataGetLength(it->get()));
+        ASSERT(totalOffset <= position);
+        unsigned localOffset = position - totalOffset;
+        if (localOffset < dataLen) {
+            someData = reinterpret_cast<const char *>(CFDataGetBytePtr(it->get())) + localOffset;
+            return dataLen - localOffset;
+        }
+        totalOffset += dataLen;
+    }
+    return 0;
+}
 #endif
 
 }
diff --git a/Source/WebCore/platform/chromium/ChromiumDataObject.cpp b/Source/WebCore/platform/chromium/ChromiumDataObject.cpp
index 6ad10c7da..d6b73e5f0 100644
--- a/Source/WebCore/platform/chromium/ChromiumDataObject.cpp
+++ b/Source/WebCore/platform/chromium/ChromiumDataObject.cpp
@@ -101,33 +101,36 @@ bool ChromiumDataObject::hasData() const
         || m_fileContent;
 }
 
-HashSet<String> ChromiumDataObject::types() const
+PassRefPtr<DOMStringList> ChromiumDataObject::types() const
 {
+    RefPtr<DOMStringList> results = DOMStringList::create();
+
     if (m_storageMode == Pasteboard) {
         bool ignoredContainsFilenames;
-        return PlatformSupport::clipboardReadAvailableTypes(currentPasteboardBuffer(),
-                                                            &ignoredContainsFilenames);
+        HashSet<String> hashedResults = PlatformSupport::clipboardReadAvailableTypes(
+            currentPasteboardBuffer(), &ignoredContainsFilenames);
+        for (HashSet<String>::const_iterator it = hashedResults.begin(); it != hashedResults.end(); ++it)
+          results->append(*it);
+        return results.release();
     }
 
-    HashSet<String> results;
-
     if (!m_plainText.isEmpty()) {
-        results.add(mimeTypeText);
-        results.add(mimeTypeTextPlain);
+        results->append(mimeTypeText);
+        results->append(mimeTypeTextPlain);
     }
 
     if (!m_uriList.isEmpty())
-        results.add(mimeTypeTextURIList);
+        results->append(mimeTypeTextURIList);
 
     if (!m_textHtml.isEmpty())
-        results.add(mimeTypeTextHTML);
+        results->append(mimeTypeTextHTML);
 
     for (HashMap<String, String>::const_iterator::Keys it = m_customData.begin().keys();
          it != m_customData.end().keys(); ++it) {
-        results.add(*it);
+        results->append(*it);
     }
 
-    return results;
+    return results.release();
 }
 
 String ChromiumDataObject::getData(const String& type, bool& success) const
diff --git a/Source/WebCore/platform/chromium/ChromiumDataObject.h b/Source/WebCore/platform/chromium/ChromiumDataObject.h
index 7e675bf93..9a6f562d1 100644
--- a/Source/WebCore/platform/chromium/ChromiumDataObject.h
+++ b/Source/WebCore/platform/chromium/ChromiumDataObject.h
@@ -31,11 +31,11 @@
 #ifndef ChromiumDataObject_h
 #define ChromiumDataObject_h
 
+#include "DOMStringList.h"
 #include "KURL.h"
 #include "PlatformString.h"
 #include "SharedBuffer.h"
 #include <wtf/HashMap.h>
-#include <wtf/HashSet.h>
 #include <wtf/RefPtr.h>
 #include <wtf/Vector.h>
 #include <wtf/text/StringHash.h>
@@ -75,7 +75,7 @@ public:
 
     bool hasData() const;
 
-    HashSet<String> types() const;
+    PassRefPtr<DOMStringList> types() const;
     String getData(const String& type, bool& success) const;
     bool setData(const String& type, const String& data);
 
diff --git a/Source/WebCore/platform/chromium/ClipboardChromium.cpp b/Source/WebCore/platform/chromium/ClipboardChromium.cpp
index 75f8f630c..1b1536e35 100644
--- a/Source/WebCore/platform/chromium/ClipboardChromium.cpp
+++ b/Source/WebCore/platform/chromium/ClipboardChromium.cpp
@@ -31,6 +31,7 @@
 #include "ChromiumDataObject.h"
 #include "ClipboardMimeTypes.h"
 #include "ClipboardUtilitiesChromium.h"
+#include "DOMStringList.h"
 #include "DataTransferItemChromium.h"
 #include "DataTransferItemListChromium.h"
 #include "Document.h"
@@ -289,21 +290,20 @@ bool ClipboardChromium::platformClipboardChanged() const
 }
 
 // extensions beyond IE's API
-HashSet<String> ClipboardChromium::types() const
+PassRefPtr<DOMStringList> ClipboardChromium::types() const
 {
-    HashSet<String> results;
     if (policy() != ClipboardReadable && policy() != ClipboardTypesReadable)
-        return results;
+        return DOMStringList::create();
 
     if (!m_dataObject)
-        return results;
+        return DOMStringList::create();
 
-    results = m_dataObject->types();
+    RefPtr<DOMStringList> results = m_dataObject->types();
 
     if (m_dataObject->containsFilenames())
-        results.add(mimeTypeFiles);
+        results->append(mimeTypeFiles);
 
-    return results;
+    return results.release();
 }
 
 PassRefPtr<FileList> ClipboardChromium::files() const
@@ -518,9 +518,9 @@ void ClipboardChromium::mayUpdateItems(Vector<RefPtr<DataTransferItem> >& items)
 
     if (isForCopyAndPaste() && policy() == ClipboardReadable) {
         // Iterate through the types and add them.
-        HashSet<String> types = m_dataObject->types();
-        for (HashSet<String>::const_iterator it = types.begin(); it != types.end(); ++it)
-            items.append(DataTransferItemChromium::createFromPasteboard(this, scriptExecutionContext, *it));
+        RefPtr<DOMStringList> types = m_dataObject->types();
+        for (size_t i = 0; i < types->length(); ++i)
+            items.append(DataTransferItemChromium::createFromPasteboard(this, scriptExecutionContext, types->item(i)));
         return;
     }
 
diff --git a/Source/WebCore/platform/chromium/ClipboardChromium.h b/Source/WebCore/platform/chromium/ClipboardChromium.h
index 924226df3..ae9eb711b 100644
--- a/Source/WebCore/platform/chromium/ClipboardChromium.h
+++ b/Source/WebCore/platform/chromium/ClipboardChromium.h
@@ -63,7 +63,7 @@ namespace WebCore {
         bool platformClipboardChanged() const;
 
         // extensions beyond IE's API
-        virtual HashSet<String> types() const;
+        virtual PassRefPtr<DOMStringList> types() const;
         virtual PassRefPtr<FileList> files() const;
 
         void setDragImage(CachedImage*, const IntPoint&);
diff --git a/Source/WebCore/platform/chromium/DragDataChromium.cpp b/Source/WebCore/platform/chromium/DragDataChromium.cpp
index 3d94a19b2..a7a853559 100644
--- a/Source/WebCore/platform/chromium/DragDataChromium.cpp
+++ b/Source/WebCore/platform/chromium/DragDataChromium.cpp
@@ -45,19 +45,19 @@ namespace WebCore {
 
 static bool containsHTML(const ChromiumDataObject* dropData)
 {
-    return dropData->types().contains(mimeTypeTextHTML);
+    return dropData->types()->contains(mimeTypeTextHTML);
 }
 
 bool DragData::containsURL(Frame*, FilenameConversionPolicy filenamePolicy) const
 {
-    return m_platformDragData->types().contains(mimeTypeTextURIList)
+    return m_platformDragData->types()->contains(mimeTypeTextURIList)
         || (filenamePolicy == ConvertFilenames && m_platformDragData->containsFilenames());
 }
 
 String DragData::asURL(Frame*, FilenameConversionPolicy filenamePolicy, String* title) const
 {
     String url;
-    if (m_platformDragData->types().contains(mimeTypeTextURIList)) {
+    if (m_platformDragData->types()->contains(mimeTypeTextURIList)) {
         bool ignoredSuccess;
         url = m_platformDragData->getData(mimeTypeURL, ignoredSuccess);
         if (title)
@@ -87,7 +87,7 @@ void DragData::asFilenames(Vector<String>& result) const
 
 bool DragData::containsPlainText() const
 {
-    return m_platformDragData->types().contains(mimeTypeTextPlain);
+    return m_platformDragData->types()->contains(mimeTypeTextPlain);
 }
 
 String DragData::asPlainText(Frame*) const
@@ -108,8 +108,8 @@ bool DragData::canSmartReplace() const
     // This is allowed whenever the drag data contains a 'range' (ie.,
     // ClipboardWin::writeRange is called).  For example, dragging a link
     // should not result in a space being added.
-    return m_platformDragData->types().contains(mimeTypeTextPlain)
-        && !m_platformDragData->types().contains(mimeTypeTextURIList);
+    return m_platformDragData->types()->contains(mimeTypeTextPlain)
+        && !m_platformDragData->types()->contains(mimeTypeTextURIList);
 }
 
 bool DragData::containsCompatibleContent() const
@@ -141,7 +141,7 @@ PassRefPtr<DocumentFragment> DragData::asFragment(Frame* frame, PassRefPtr<Range
         //    return fragment;
     }
 
-    if (m_platformDragData->types().contains(mimeTypeTextHTML)) {
+    if (m_platformDragData->types()->contains(mimeTypeTextHTML)) {
         bool ignoredSuccess;
         RefPtr<DocumentFragment> fragment = createFragmentFromMarkup(frame->document(),
             m_platformDragData->getData(mimeTypeTextHTML, ignoredSuccess), m_platformDragData->htmlBaseUrl(), FragmentScriptingNotAllowed);
diff --git a/Source/WebCore/platform/chromium/PlatformSupport.h b/Source/WebCore/platform/chromium/PlatformSupport.h
index 170177507..128d2a3e9 100644
--- a/Source/WebCore/platform/chromium/PlatformSupport.h
+++ b/Source/WebCore/platform/chromium/PlatformSupport.h
@@ -415,9 +415,18 @@ public:
 #endif
 
     // Trace Event --------------------------------------------------------
-    static bool isTraceEventEnabled();
-    static void traceEventBegin(const char* name, void*, const char* extra);
-    static void traceEventEnd(const char* name, void*, const char* extra);
+    static const unsigned char* getTraceCategoryEnabledFlag(const char* categoryName);
+    static int addTraceEvent(char phase,
+                             const unsigned char* categoryEnabledFlag,
+                             const char* name,
+                             unsigned long long id,
+                             int numArgs,
+                             const char** argNames,
+                             const unsigned char* argTypes,
+                             const unsigned long long* argValues,
+                             int thresholdBeginId,
+                             long long threshold,
+                             unsigned char flags);
 
     // Visited links ------------------------------------------------------
     static LinkHash visitedLinkHash(const UChar* url, unsigned length);
diff --git a/Source/WebCore/platform/chromium/PopupListBox.cpp b/Source/WebCore/platform/chromium/PopupListBox.cpp
index 11164ccc3..c980ad623 100644
--- a/Source/WebCore/platform/chromium/PopupListBox.cpp
+++ b/Source/WebCore/platform/chromium/PopupListBox.cpp
@@ -154,9 +154,7 @@ bool PopupListBox::handleWheelEvent(const PlatformWheelEvent& event)
         return true;
     }
 
-    // Pass it off to the scroll view.
-    // Sadly, WebCore devs don't understand the whole "const" thing.
-    wheelEvent(const_cast<PlatformWheelEvent&>(event));
+    ScrollableArea::handleWheelEvent(event);
     return true;
 }
 
diff --git a/Source/WebCore/platform/chromium/TraceEvent.h b/Source/WebCore/platform/chromium/TraceEvent.h
index 652f5407c..5bb600fb3 100644
--- a/Source/WebCore/platform/chromium/TraceEvent.h
+++ b/Source/WebCore/platform/chromium/TraceEvent.h
@@ -22,53 +22,843 @@
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
+
+// Trace events are for tracking application performance and resource usage.
+// Macros are provided to track:
+//    Begin and end of function calls
+//    Counters
+//
+// Events are issued against categories. Whereas LOG's
+// categories are statically defined, TRACE categories are created
+// implicitly with a string. For example:
+//   TRACE_EVENT_INSTANT0("MY_SUBSYSTEM", "SomeImportantEvent")
+//
+// Events can be INSTANT, or can be pairs of BEGIN and END in the same scope:
+//   TRACE_EVENT_BEGIN0("MY_SUBSYSTEM", "SomethingCostly")
+//   doSomethingCostly()
+//   TRACE_EVENT_END0("MY_SUBSYSTEM", "SomethingCostly")
+// Note: our tools can't always determine the correct BEGIN/END pairs unless
+// these are used in the same scope. Use START/FINISH macros if you need them
+// to be in separate scopes.
+//
+// A common use case is to trace entire function scopes. This
+// issues a trace BEGIN and END automatically:
+//   void doSomethingCostly() {
+//     TRACE_EVENT0("MY_SUBSYSTEM", "doSomethingCostly");
+//     ...
+//   }
+//
+// Additional parameters can be associated with an event:
+//   void doSomethingCostly2(int howMuch) {
+//     TRACE_EVENT1("MY_SUBSYSTEM", "doSomethingCostly",
+//         "howMuch", howMuch);
+//     ...
+//   }
+//
+// The trace system will automatically add to this information the
+// current process id, thread id, and a timestamp in microseconds.
+//
+// To trace an asynchronous procedure such as an IPC send/receive, use START and
+// FINISH:
+//   [single threaded sender code]
+//     static int send_count = 0;
+//     ++send_count;
+//     TRACE_EVENT_START0("ipc", "message", send_count);
+//     Send(new MyMessage(send_count));
+//   [receive code]
+//     void OnMyMessage(send_count) {
+//       TRACE_EVENT_FINISH0("ipc", "message", send_count);
+//     }
+// The third parameter is a unique ID to match START/FINISH pairs.
+// START and FINISH can occur on any thread of any traced process. Pointers can
+// be used for the ID parameter, and they will be mangled internally so that
+// the same pointer on two different processes will not match. For example:
+//   class MyTracedClass {
+//    public:
+//     MyTracedClass() {
+//       TRACE_EVENT_START0("category", "MyTracedClass", this);
+//     }
+//     ~MyTracedClass() {
+//       TRACE_EVENT_FINISH0("category", "MyTracedClass", this);
+//     }
+//   }
+//
+// Trace event also supports counters, which is a way to track a quantity
+// as it varies over time. Counters are created with the following macro:
+//   TRACE_COUNTER1("MY_SUBSYSTEM", "myCounter", g_myCounterValue);
+//
+// Counters are process-specific. The macro itself can be issued from any
+// thread, however.
+//
+// Sometimes, you want to track two counters at once. You can do this with two
+// counter macros:
+//   TRACE_COUNTER1("MY_SUBSYSTEM", "myCounter0", g_myCounterValue[0]);
+//   TRACE_COUNTER1("MY_SUBSYSTEM", "myCounter1", g_myCounterValue[1]);
+// Or you can do it with a combined macro:
+//   TRACE_COUNTER2("MY_SUBSYSTEM", "myCounter",
+//       "bytesPinned", g_myCounterValue[0],
+//       "bytesAllocated", g_myCounterValue[1]);
+// This indicates to the tracing UI that these counters should be displayed
+// in a single graph, as a summed area chart.
+//
+// Since counters are in a global namespace, you may want to disembiguate with a
+// unique ID, by using the TRACE_COUNTER_ID* variations.
+//
+// By default, trace collection is compiled in, but turned off at runtime.
+// Collecting trace data is the responsibility of the embedding
+// application. In Chrome's case, navigating to about:tracing will turn on
+// tracing and display data collected across all active processes.
+//
+//
+// Memory scoping note:
+// Tracing copies the pointers, not the string content, of the strings passed
+// in for category, name, and arg_names. Thus, the following code will
+// cause problems:
+//     char* str = strdup("impprtantName");
+//     TRACE_EVENT_INSTANT0("SUBSYSTEM", str);  // BAD!
+//     free(str);                   // Trace system now has dangling pointer
+//
+// To avoid this issue with the |name| and |arg_name| parameters, use the
+// TRACE_EVENT_COPY_XXX overloads of the macros at additional runtime overhead.
+// Notes: The category must always be in a long-lived char* (i.e. static const).
+//        The |arg_values|, when used, are always deep copied with the _COPY
+//        macros.
+//
+// When are string argument values copied:
+// const char* arg_values are only referenced by default:
+//     TRACE_EVENT1("category", "name",
+//                  "arg1", "literal string is only referenced");
+// Use TRACE_STR_COPY to force copying of a const char*:
+//     TRACE_EVENT1("category", "name",
+//                  "arg1", TRACE_STR_COPY("string will be copied"));
+// std::string arg_values are always copied:
+//     TRACE_EVENT1("category", "name",
+//                  "arg1", std::string("string will be copied"));
+//
+//
+// Thread Safety:
+// A thread safe singleton and mutex are used for thread safety. Category
+// enabled flags are used to limit the performance impact when the system
+// is not enabled.
+//
+// TRACE_EVENT macros first cache a pointer to a category. The categories are
+// statically allocated and safe at all times, even after exit. Fetching a
+// category is protected by the TraceLog::lock_. Multiple threads initializing
+// the static variable is safe, as they will be serialized by the lock and
+// multiple calls will return the same pointer to the category.
+//
+// Then the category_enabled flag is checked. This is a unsigned char, and
+// not intended to be multithread safe. It optimizes access to addTraceEvent
+// which is threadsafe internally via TraceLog::lock_. The enabled flag may
+// cause some threads to incorrectly call or skip calling addTraceEvent near
+// the time of the system being enabled or disabled. This is acceptable as
+// we tolerate some data loss while the system is being enabled/disabled and
+// because addTraceEvent is threadsafe internally and checks the enabled state
+// again under lock.
+//
+// Without the use of these static category pointers and enabled flags all
+// trace points would carry a significant performance cost of aquiring a lock
+// and resolving the category.
+
 #ifndef TraceEvent_h
 #define TraceEvent_h
 
+#include "DynamicAnnotations.h"
 #include "PlatformSupport.h"
-#include <wtf/OwnArrayPtr.h>
+
+#include <wtf/text/CString.h>
+
+// Issues begin trace event here and end trace event when the current scope ends.
+#define TRACE_EVENT(name, id, extra) TRACE_EVENT2("webkit", name, "id", id, "extra", extra)
+
+// By default, const char* argument values are assumed to have long-lived scope
+// and will not be copied. Use this macro to force a const char* to be copied.
+#define TRACE_STR_COPY(str) \
+    WebCore::TraceEvent::TraceStringWithCopy(str)
+
+// Records a pair of begin and end events called "name" for the current
+// scope, with 0, 1 or 2 associated arguments. If the category is not
+// enabled, then this does nothing.
+// - category and name strings must have application lifetime (statics or
+//   literals). They may not include " chars.
+#define TRACE_EVENT0(category, name) \
+    INTERNAL_TRACE_EVENT_ADD_SCOPED(category, name)
+#define TRACE_EVENT1(category, name, arg1_name, arg1_val) \
+    INTERNAL_TRACE_EVENT_ADD_SCOPED(category, name, arg1_name, arg1_val)
+#define TRACE_EVENT2(category, name, arg1_name, arg1_val, arg2_name, arg2_val) \
+    INTERNAL_TRACE_EVENT_ADD_SCOPED(category, name, arg1_name, arg1_val, \
+        arg2_name, arg2_val)
+
+// Records a single event called "name" immediately, with 0, 1 or 2
+// associated arguments. If the category is not enabled, then this
+// does nothing.
+// - category and name strings must have application lifetime (statics or
+//   literals). They may not include " chars.
+#define TRACE_EVENT_INSTANT0(category, name) \
+    INTERNAL_TRACE_EVENT_ADD(TRACE_EVENT_PHASE_INSTANT, \
+        category, name, TRACE_EVENT_FLAG_NONE)
+#define TRACE_EVENT_INSTANT1(category, name, arg1_name, arg1_val) \
+    INTERNAL_TRACE_EVENT_ADD(TRACE_EVENT_PHASE_INSTANT, \
+        category, name, TRACE_EVENT_FLAG_NONE, arg1_name, arg1_val)
+#define TRACE_EVENT_INSTANT2(category, name, arg1_name, arg1_val, \
+        arg2_name, arg2_val) \
+    INTERNAL_TRACE_EVENT_ADD(TRACE_EVENT_PHASE_INSTANT, \
+        category, name, TRACE_EVENT_FLAG_NONE, arg1_name, arg1_val, \
+        arg2_name, arg2_val)
+#define TRACE_EVENT_COPY_INSTANT0(category, name) \
+    INTERNAL_TRACE_EVENT_ADD(TRACE_EVENT_PHASE_INSTANT, \
+        category, name, TRACE_EVENT_FLAG_COPY)
+#define TRACE_EVENT_COPY_INSTANT1(category, name, arg1_name, arg1_val) \
+    INTERNAL_TRACE_EVENT_ADD(TRACE_EVENT_PHASE_INSTANT, \
+        category, name, TRACE_EVENT_FLAG_COPY, arg1_name, arg1_val)
+#define TRACE_EVENT_COPY_INSTANT2(category, name, arg1_name, arg1_val, \
+        arg2_name, arg2_val) \
+    INTERNAL_TRACE_EVENT_ADD(TRACE_EVENT_PHASE_INSTANT, \
+        category, name, TRACE_EVENT_FLAG_COPY, arg1_name, arg1_val, \
+        arg2_name, arg2_val)
+
+// Records a single BEGIN event called "name" immediately, with 0, 1 or 2
+// associated arguments. If the category is not enabled, then this
+// does nothing.
+// - category and name strings must have application lifetime (statics or
+//   literals). They may not include " chars.
+#define TRACE_EVENT_BEGIN0(category, name) \
+    INTERNAL_TRACE_EVENT_ADD(TRACE_EVENT_PHASE_BEGIN, \
+        category, name, TRACE_EVENT_FLAG_NONE)
+#define TRACE_EVENT_BEGIN1(category, name, arg1_name, arg1_val) \
+    INTERNAL_TRACE_EVENT_ADD(TRACE_EVENT_PHASE_BEGIN, \
+        category, name, TRACE_EVENT_FLAG_NONE, arg1_name, arg1_val)
+#define TRACE_EVENT_BEGIN2(category, name, arg1_name, arg1_val, \
+        arg2_name, arg2_val) \
+    INTERNAL_TRACE_EVENT_ADD(TRACE_EVENT_PHASE_BEGIN, \
+        category, name, TRACE_EVENT_FLAG_NONE, arg1_name, arg1_val, \
+        arg2_name, arg2_val)
+#define TRACE_EVENT_COPY_BEGIN0(category, name) \
+    INTERNAL_TRACE_EVENT_ADD(TRACE_EVENT_PHASE_BEGIN, \
+        category, name, TRACE_EVENT_FLAG_COPY)
+#define TRACE_EVENT_COPY_BEGIN1(category, name, arg1_name, arg1_val) \
+    INTERNAL_TRACE_EVENT_ADD(TRACE_EVENT_PHASE_BEGIN, \
+        category, name, TRACE_EVENT_FLAG_COPY, arg1_name, arg1_val)
+#define TRACE_EVENT_COPY_BEGIN2(category, name, arg1_name, arg1_val, \
+        arg2_name, arg2_val) \
+    INTERNAL_TRACE_EVENT_ADD(TRACE_EVENT_PHASE_BEGIN, \
+        category, name, TRACE_EVENT_FLAG_COPY, arg1_name, arg1_val, \
+        arg2_name, arg2_val)
+
+// Records a single END event for "name" immediately. If the category
+// is not enabled, then this does nothing.
+// - category and name strings must have application lifetime (statics or
+//   literals). They may not include " chars.
+#define TRACE_EVENT_END0(category, name) \
+    INTERNAL_TRACE_EVENT_ADD(TRACE_EVENT_PHASE_END, \
+        category, name, TRACE_EVENT_FLAG_NONE)
+#define TRACE_EVENT_END1(category, name, arg1_name, arg1_val) \
+    INTERNAL_TRACE_EVENT_ADD(TRACE_EVENT_PHASE_END, \
+        category, name, TRACE_EVENT_FLAG_NONE, arg1_name, arg1_val)
+#define TRACE_EVENT_END2(category, name, arg1_name, arg1_val, \
+        arg2_name, arg2_val) \
+    INTERNAL_TRACE_EVENT_ADD(TRACE_EVENT_PHASE_END, \
+        category, name, TRACE_EVENT_FLAG_NONE, arg1_name, arg1_val, \
+        arg2_name, arg2_val)
+#define TRACE_EVENT_COPY_END0(category, name) \
+    INTERNAL_TRACE_EVENT_ADD(TRACE_EVENT_PHASE_END, \
+        category, name, TRACE_EVENT_FLAG_COPY)
+#define TRACE_EVENT_COPY_END1(category, name, arg1_name, arg1_val) \
+    INTERNAL_TRACE_EVENT_ADD(TRACE_EVENT_PHASE_END, \
+        category, name, TRACE_EVENT_FLAG_COPY, arg1_name, arg1_val)
+#define TRACE_EVENT_COPY_END2(category, name, arg1_name, arg1_val, \
+        arg2_name, arg2_val) \
+    INTERNAL_TRACE_EVENT_ADD(TRACE_EVENT_PHASE_END, \
+        category, name, TRACE_EVENT_FLAG_COPY, arg1_name, arg1_val, \
+        arg2_name, arg2_val)
+
+// Time threshold event:
+// Only record the event if the duration is greater than the specified
+// threshold_us (time in microseconds).
+// Records a pair of begin and end events called "name" for the current
+// scope, with 0, 1 or 2 associated arguments. If the category is not
+// enabled, then this does nothing.
+// - category and name strings must have application lifetime (statics or
+//   literals). They may not include " chars.
+#define TRACE_EVENT_IF_LONGER_THAN0(threshold_us, category, name) \
+    INTERNAL_TRACE_EVENT_ADD_SCOPED_IF_LONGER_THAN(threshold_us, category, name)
+#define TRACE_EVENT_IF_LONGER_THAN1( \
+    threshold_us, category, name, arg1_name, arg1_val) \
+    INTERNAL_TRACE_EVENT_ADD_SCOPED_IF_LONGER_THAN( \
+        threshold_us, category, name, arg1_name, arg1_val)
+#define TRACE_EVENT_IF_LONGER_THAN2( \
+    threshold_us, category, name, arg1_name, arg1_val, arg2_name, arg2_val) \
+    INTERNAL_TRACE_EVENT_ADD_SCOPED_IF_LONGER_THAN( \
+        threshold_us, category, name, arg1_name, arg1_val, arg2_name, arg2_val)
+
+// Records the value of a counter called "name" immediately. Value
+// must be representable as a 32 bit integer.
+// - category and name strings must have application lifetime (statics or
+//   literals). They may not include " chars.
+#define TRACE_COUNTER1(category, name, value) \
+    INTERNAL_TRACE_EVENT_ADD(TRACE_EVENT_PHASE_COUNTER, \
+        category, name, TRACE_EVENT_FLAG_NONE, \
+        "value", static_cast<int>(value))
+#define TRACE_COPY_COUNTER1(category, name, value) \
+    INTERNAL_TRACE_EVENT_ADD(TRACE_EVENT_PHASE_COUNTER, \
+        category, name, TRACE_EVENT_FLAG_COPY, \
+        "value", static_cast<int>(value))
+
+// Records the values of a multi-parted counter called "name" immediately.
+// The UI will treat value1 and value2 as parts of a whole, displaying their
+// values as a stacked-bar chart.
+// - category and name strings must have application lifetime (statics or
+//   literals). They may not include " chars.
+#define TRACE_COUNTER2(category, name, value1_name, value1_val, \
+        value2_name, value2_val) \
+    INTERNAL_TRACE_EVENT_ADD(TRACE_EVENT_PHASE_COUNTER, \
+        category, name, TRACE_EVENT_FLAG_NONE, \
+        value1_name, static_cast<int>(value1_val), \
+        value2_name, static_cast<int>(value2_val))
+#define TRACE_COPY_COUNTER2(category, name, value1_name, value1_val, \
+        value2_name, value2_val) \
+    INTERNAL_TRACE_EVENT_ADD(TRACE_EVENT_PHASE_COUNTER, \
+        category, name, TRACE_EVENT_FLAG_COPY, \
+        value1_name, static_cast<int>(value1_val), \
+        value2_name, static_cast<int>(value2_val))
+
+// Records the value of a counter called "name" immediately. Value
+// must be representable as a 32 bit integer.
+// - category and name strings must have application lifetime (statics or
+//   literals). They may not include " chars.
+// - |id| is used to disambiguate counters with the same name. It must either
+//   be a pointer or an integer value up to 64 bits. If it's a pointer, the bits
+//   will be xored with a hash of the process ID so that the same pointer on
+//   two different processes will not collide.
+#define TRACE_COUNTER_ID1(category, name, id, value) \
+    INTERNAL_TRACE_EVENT_ADD_WITH_ID(TRACE_EVENT_PHASE_COUNTER, \
+        category, name, id, TRACE_EVENT_FLAG_NONE, \
+        "value", static_cast<int>(value))
+#define TRACE_COPY_COUNTER_ID1(category, name, id, value) \
+    INTERNAL_TRACE_EVENT_ADD_WITH_ID(TRACE_EVENT_PHASE_COUNTER, \
+        category, name, id, TRACE_EVENT_FLAG_COPY, \
+        "value", static_cast<int>(value))
+
+// Records the values of a multi-parted counter called "name" immediately.
+// The UI will treat value1 and value2 as parts of a whole, displaying their
+// values as a stacked-bar chart.
+// - category and name strings must have application lifetime (statics or
+//   literals). They may not include " chars.
+// - |id| is used to disambiguate counters with the same name. It must either
+//   be a pointer or an integer value up to 64 bits. If it's a pointer, the bits
+//   will be xored with a hash of the process ID so that the same pointer on
+//   two different processes will not collide.
+#define TRACE_COUNTER_ID2(category, name, id, value1_name, value1_val, \
+        value2_name, value2_val) \
+    INTERNAL_TRACE_EVENT_ADD_WITH_ID(TRACE_EVENT_PHASE_COUNTER, \
+        category, name, id, TRACE_EVENT_FLAG_NONE, \
+        value1_name, static_cast<int>(value1_val), \
+        value2_name, static_cast<int>(value2_val))
+#define TRACE_COPY_COUNTER_ID2(category, name, id, value1_name, value1_val, \
+        value2_name, value2_val) \
+    INTERNAL_TRACE_EVENT_ADD_WITH_ID(TRACE_EVENT_PHASE_COUNTER, \
+        category, name, id, TRACE_EVENT_FLAG_COPY, \
+        value1_name, static_cast<int>(value1_val), \
+        value2_name, static_cast<int>(value2_val))
+
+// Records a single START event called "name" immediately, with 0, 1 or 2
+// associated arguments. If the category is not enabled, then this
+// does nothing.
+// - category and name strings must have application lifetime (statics or
+//   literals). They may not include " chars.
+// - |id| is used to match the START event with the FINISH event. It must either
+//   be a pointer or an integer value up to 64 bits. If it's a pointer, the bits
+//   will be xored with a hash of the process ID so that the same pointer on
+//   two different processes will not collide.
+#define TRACE_EVENT_START0(category, name, id) \
+    INTERNAL_TRACE_EVENT_ADD_WITH_ID(TRACE_EVENT_PHASE_START, \
+        category, name, id, TRACE_EVENT_FLAG_NONE)
+#define TRACE_EVENT_START1(category, name, id, arg1_name, arg1_val) \
+    INTERNAL_TRACE_EVENT_ADD_WITH_ID(TRACE_EVENT_PHASE_START, \
+        category, name, id, TRACE_EVENT_FLAG_NONE, arg1_name, arg1_val)
+#define TRACE_EVENT_START2(category, name, id, arg1_name, arg1_val, \
+        arg2_name, arg2_val) \
+    INTERNAL_TRACE_EVENT_ADD_WITH_ID(TRACE_EVENT_PHASE_START, \
+        category, name, id, TRACE_EVENT_FLAG_NONE, \
+        arg1_name, arg1_val, arg2_name, arg2_val)
+#define TRACE_EVENT_COPY_START0(category, name, id) \
+    INTERNAL_TRACE_EVENT_ADD_WITH_ID(TRACE_EVENT_PHASE_START, \
+        category, name, id, TRACE_EVENT_FLAG_COPY)
+#define TRACE_EVENT_COPY_START1(category, name, id, arg1_name, arg1_val) \
+    INTERNAL_TRACE_EVENT_ADD_WITH_ID(TRACE_EVENT_PHASE_START, \
+        category, name, id, TRACE_EVENT_FLAG_COPY, \
+        arg1_name, arg1_val)
+#define TRACE_EVENT_COPY_START2(category, name, id, arg1_name, arg1_val, \
+        arg2_name, arg2_val) \
+    INTERNAL_TRACE_EVENT_ADD_WITH_ID(TRACE_EVENT_PHASE_START, \
+        category, name, id, TRACE_EVENT_FLAG_COPY, \
+        arg1_name, arg1_val, arg2_name, arg2_val)
+
+// Records a single FINISH event for "name" immediately. If the category
+// is not enabled, then this does nothing.
+#define TRACE_EVENT_FINISH0(category, name, id) \
+    INTERNAL_TRACE_EVENT_ADD_WITH_ID(TRACE_EVENT_PHASE_FINISH, \
+        category, name, id, TRACE_EVENT_FLAG_NONE)
+#define TRACE_EVENT_FINISH1(category, name, id, arg1_name, arg1_val) \
+    INTERNAL_TRACE_EVENT_ADD_WITH_ID(TRACE_EVENT_PHASE_FINISH, \
+        category, name, id, TRACE_EVENT_FLAG_NONE, arg1_name, arg1_val)
+#define TRACE_EVENT_FINISH2(category, name, id, arg1_name, arg1_val, \
+        arg2_name, arg2_val) \
+    INTERNAL_TRACE_EVENT_ADD_WITH_ID(TRACE_EVENT_PHASE_FINISH, \
+        category, name, id, TRACE_EVENT_FLAG_NONE, \
+        arg1_name, arg1_val, arg2_name, arg2_val)
+#define TRACE_EVENT_COPY_FINISH0(category, name, id) \
+    INTERNAL_TRACE_EVENT_ADD_WITH_ID(TRACE_EVENT_PHASE_FINISH, \
+        category, name, id, TRACE_EVENT_FLAG_COPY)
+#define TRACE_EVENT_COPY_FINISH1(category, name, id, arg1_name, arg1_val) \
+    INTERNAL_TRACE_EVENT_ADD_WITH_ID(TRACE_EVENT_PHASE_FINISH, \
+        category, name, id, TRACE_EVENT_FLAG_COPY, \
+        arg1_name, arg1_val)
+#define TRACE_EVENT_COPY_FINISH2(category, name, id, arg1_name, arg1_val, \
+        arg2_name, arg2_val) \
+    INTERNAL_TRACE_EVENT_ADD_WITH_ID(TRACE_EVENT_PHASE_FINISH, \
+        category, name, id, TRACE_EVENT_FLAG_COPY, \
+        arg1_name, arg1_val, arg2_name, arg2_val)
+
+////////////////////////////////////////////////////////////////////////////////
+// Implementation specific tracing API definitions.
+
+// Get a pointer to the enabled state of the given trace category. Only
+// long-lived literal strings should be given as the category name. The returned
+// pointer can be held permanently in a local static for example. If the
+// unsigned char is non-zero, tracing is enabled. If tracing is enabled,
+// TRACE_EVENT_API_ADD_TRACE_EVENT can be called. It's OK if tracing is disabled
+// between the load of the tracing state and the call to
+// TRACE_EVENT_API_ADD_TRACE_EVENT, because this flag only provides an early out
+// for best performance when tracing is disabled.
+// const unsigned char*
+//     TRACE_EVENT_API_GET_CATEGORY_ENABLED(const char* category_name)
+#define TRACE_EVENT_API_GET_CATEGORY_ENABLED \
+    WebCore::PlatformSupport::getTraceCategoryEnabledFlag
+
+// Add a trace event to the platform tracing system. Returns thresholdBeginId
+// for use in a corresponding end TRACE_EVENT_API_ADD_TRACE_EVENT call.
+// int TRACE_EVENT_API_ADD_TRACE_EVENT(
+//                    char phase,
+//                    const unsigned char* category_enabled,
+//                    const char* name,
+//                    unsigned long long id,
+//                    int num_args,
+//                    const char** arg_names,
+//                    const unsigned char* arg_types,
+//                    const unsigned long long* arg_values,
+//                    int thresholdBeginID,
+//                    long long threshold,
+//                    unsigned char flags)
+#define TRACE_EVENT_API_ADD_TRACE_EVENT \
+    WebCore::PlatformSupport::addTraceEvent
+
+////////////////////////////////////////////////////////////////////////////////
 
 // Implementation detail: trace event macros create temporary variables
 // to keep instrumentation overhead low. These macros give each temporary
 // variable a unique name based on the line number to prevent name collissions.
-#define TRACE_EVENT_MAKE_UNIQUE_IDENTIFIER3(a, b) a##b
-#define TRACE_EVENT_MAKE_UNIQUE_IDENTIFIER2(a, b) TRACE_EVENT_MAKE_UNIQUE_IDENTIFIER3(a, b)
-#define TRACE_EVENT_MAKE_UNIQUE_IDENTIFIER(name_prefix) TRACE_EVENT_MAKE_UNIQUE_IDENTIFIER2(name_prefix, __LINE__)
+#define INTERNAL_TRACE_EVENT_UID3(a, b) \
+    trace_event_unique_##a##b
+#define INTERNAL_TRACE_EVENT_UID2(a, b) \
+    INTERNAL_TRACE_EVENT_UID3(a, b)
+#define INTERNALTRACEEVENTUID(name_prefix) \
+    INTERNAL_TRACE_EVENT_UID2(name_prefix, __LINE__)
+
+// Implementation detail: internal macro to create static category.
+// - WTF_ANNOTATE_BENIGN_RACE, see Thread Safety above.
+#define INTERNAL_TRACE_EVENT_GET_CATEGORY_INFO(category) \
+    static const unsigned char* INTERNALTRACEEVENTUID(catstatic) = 0; \
+    WTF_ANNOTATE_BENIGN_RACE(&INTERNALTRACEEVENTUID(catstatic), \
+                             "trace_event category"); \
+    if (!INTERNALTRACEEVENTUID(catstatic)) \
+      INTERNALTRACEEVENTUID(catstatic) = \
+          TRACE_EVENT_API_GET_CATEGORY_ENABLED(category);
+
+// Implementation detail: internal macro to create static category and add
+// event if the category is enabled.
+#if COMPILER(MSVC7_OR_LOWER)
+#define INTERNAL_TRACE_EVENT_ADD(ignore) ((void)0)
+#else
+#define INTERNAL_TRACE_EVENT_ADD(phase, category, name, flags, ...) \
+    INTERNAL_TRACE_EVENT_GET_CATEGORY_INFO(category); \
+    if (*INTERNALTRACEEVENTUID(catstatic)) { \
+      WebCore::TraceEvent::addTraceEvent( \
+          phase, INTERNALTRACEEVENTUID(catstatic), name, \
+          WebCore::TraceEvent::noEventId, flags, ##__VA_ARGS__); \
+    }
+#endif
+
+// Implementation detail: internal macro to create static category and add begin
+// event if the category is enabled. Also adds the end event when the scope
+// ends.
+#if COMPILER(MSVC7_OR_LOWER)
+#define INTERNAL_TRACE_EVENT_ADD_SCOPED(ignore) ((void)0)
+#else
+#define INTERNAL_TRACE_EVENT_ADD_SCOPED(category, name, ...) \
+    INTERNAL_TRACE_EVENT_GET_CATEGORY_INFO(category); \
+    WebCore::TraceEvent::TraceEndOnScopeClose \
+        INTERNALTRACEEVENTUID(profileScope); \
+    if (*INTERNALTRACEEVENTUID(catstatic)) { \
+      WebCore::TraceEvent::addTraceEvent( \
+          TRACE_EVENT_PHASE_BEGIN, \
+          INTERNALTRACEEVENTUID(catstatic), \
+          name, WebCore::TraceEvent::noEventId, \
+          TRACE_EVENT_FLAG_NONE, ##__VA_ARGS__); \
+      INTERNALTRACEEVENTUID(profileScope).initialize( \
+          INTERNALTRACEEVENTUID(catstatic), name); \
+    }
+#endif
+
+// Implementation detail: internal macro to create static category and add begin
+// event if the category is enabled. Also adds the end event when the scope
+// ends. If the elapsed time is < threshold time, the begin/end pair is erased.
+#if COMPILER(MSVC7_OR_LOWER)
+#define INTERNAL_TRACE_EVENT_ADD_SCOPED_IF_LONGER_THAN(ignore) ((void)0)
+#else
+#define INTERNAL_TRACE_EVENT_ADD_SCOPED_IF_LONGER_THAN(threshold, \
+        category, name, ...) \
+    INTERNAL_TRACE_EVENT_GET_CATEGORY_INFO(category); \
+    WebCore::TraceEvent::TraceEndOnScopeCloseThreshold \
+        INTERNALTRACEEVENTUID(profileScope); \
+    if (*INTERNALTRACEEVENTUID(catstatic)) { \
+      int INTERNALTRACEEVENTUID(begin_event_id) = \
+        WebCore::TraceEvent::addTraceEvent( \
+            TRACE_EVENT_PHASE_BEGIN, \
+            INTERNALTRACEEVENTUID(catstatic), \
+            name, WebCore::TraceEvent::noEventId, \
+            TRACE_EVENT_FLAG_NONE, ##__VA_ARGS__); \
+      INTERNALTRACEEVENTUID(profileScope).initialize( \
+          INTERNALTRACEEVENTUID(catstatic), name, \
+          INTERNALTRACEEVENTUID(begin_event_id), threshold); \
+    }
+#endif
+
+// Implementation detail: internal macro to create static category and add
+// event if the category is enabled.
+#if COMPILER(MSVC7_OR_LOWER)
+#define INTERNAL_TRACE_EVENT_ADD_WITH_ID(ignore) ((void)0)
+#else
+#define INTERNAL_TRACE_EVENT_ADD_WITH_ID(phase, category, name, id, flags, \
+                                         ...) \
+    INTERNAL_TRACE_EVENT_GET_CATEGORY_INFO(category); \
+    if (*INTERNALTRACEEVENTUID(catstatic)) { \
+      unsigned char traceEventFlags = flags | TRACE_EVENT_FLAG_HAS_ID; \
+      WebCore::TraceEvent::TraceID traceEventTraceID( \
+          id, &traceEventFlags); \
+      WebCore::TraceEvent::addTraceEvent( \
+          phase, INTERNALTRACEEVENTUID(catstatic), \
+          name, traceEventTraceID.data(), traceEventFlags, \
+          ##__VA_ARGS__); \
+    }
+#endif
+
+// Notes regarding the following definitions:
+// New values can be added and propagated to third party libraries, but existing
+// definitions must never be changed, because third party libraries may use old
+// definitions.
+
+// Phase indicates the nature of an event entry. E.g. part of a begin/end pair.
+#define TRACE_EVENT_PHASE_BEGIN    ('B')
+#define TRACE_EVENT_PHASE_END      ('E')
+#define TRACE_EVENT_PHASE_INSTANT  ('I')
+#define TRACE_EVENT_PHASE_START    ('S')
+#define TRACE_EVENT_PHASE_FINISH   ('F')
+#define TRACE_EVENT_PHASE_METADATA ('M')
+#define TRACE_EVENT_PHASE_COUNTER  ('C')
+
+// Flags for changing the behavior of TRACE_EVENT_API_ADD_TRACE_EVENT.
+#define TRACE_EVENT_FLAG_NONE        (static_cast<unsigned char>(0))
+#define TRACE_EVENT_FLAG_COPY        (static_cast<unsigned char>(1 << 0))
+#define TRACE_EVENT_FLAG_HAS_ID      (static_cast<unsigned char>(1 << 1))
+#define TRACE_EVENT_FLAG_MANGLE_ID   (static_cast<unsigned char>(1 << 2))
+
+// Type values for identifying types in the TraceValue union.
+#define TRACE_VALUE_TYPE_BOOL         (static_cast<unsigned char>(1))
+#define TRACE_VALUE_TYPE_UINT         (static_cast<unsigned char>(2))
+#define TRACE_VALUE_TYPE_INT          (static_cast<unsigned char>(3))
+#define TRACE_VALUE_TYPE_DOUBLE       (static_cast<unsigned char>(4))
+#define TRACE_VALUE_TYPE_POINTER      (static_cast<unsigned char>(5))
+#define TRACE_VALUE_TYPE_STRING       (static_cast<unsigned char>(6))
+#define TRACE_VALUE_TYPE_COPY_STRING  (static_cast<unsigned char>(7))
 
-// Issues PlatformSupport::traceEventBegin and traceEventEnd calls for the enclosing scope
-#define TRACE_EVENT(name, id, extra) WebCore::internal::ScopeTracer TRACE_EVENT_MAKE_UNIQUE_IDENTIFIER(__traceEventScope)(name, id, extra);
 
 namespace WebCore {
 
-namespace internal {
+namespace TraceEvent {
+
+// Specify these values when the corresponding argument of addTraceEvent is not
+// used.
+const int zeroNumArgs = 0;
+const int noThresholdBeginId = -1;
+const long long noThresholdValue = 0;
+const unsigned long long noEventId = 0;
 
-// Used by TRACE_EVENT macro. Do not use directly.
-class ScopeTracer {
+// TraceID encapsulates an ID that can either be an integer or pointer. Pointers
+// are mangled with the Process ID so that they are unlikely to collide when the
+// same pointer is used on different processes.
+class TraceID {
 public:
-    ScopeTracer(const char* name, void*, const char* extra);
-    ~ScopeTracer();
+    explicit TraceID(const void* id, unsigned char* flags) :
+        m_data(static_cast<unsigned long long>(reinterpret_cast<unsigned long>(id)))
+    {
+        *flags |= TRACE_EVENT_FLAG_MANGLE_ID;
+    }
+    explicit TraceID(unsigned long long id, unsigned char* flags) : m_data(id) { (void)flags; }
+    explicit TraceID(unsigned long id, unsigned char* flags) : m_data(id) { (void)flags; }
+    explicit TraceID(unsigned int id, unsigned char* flags) : m_data(id) { (void)flags; }
+    explicit TraceID(unsigned short id, unsigned char* flags) : m_data(id) { (void)flags; }
+    explicit TraceID(unsigned char id, unsigned char* flags) : m_data(id) { (void)flags; }
+    explicit TraceID(long long id, unsigned char* flags) :
+        m_data(static_cast<unsigned long long>(id)) { (void)flags; }
+    explicit TraceID(long id, unsigned char* flags) :
+        m_data(static_cast<unsigned long long>(id)) { (void)flags; }
+    explicit TraceID(int id, unsigned char* flags) :
+        m_data(static_cast<unsigned long long>(id)) { (void)flags; }
+    explicit TraceID(short id, unsigned char* flags) :
+        m_data(static_cast<unsigned long long>(id)) { (void)flags; }
+    explicit TraceID(signed char id, unsigned char* flags) :
+        m_data(static_cast<unsigned long long>(id)) { (void)flags; }
+
+    unsigned long long data() const { return m_data; }
+
+private:
+    unsigned long long m_data;
+};
+
+// Simple union to store various types as unsigned long long.
+union TraceValueUnion {
+    bool m_bool;
+    unsigned long long m_uint;
+    long long m_int;
+    double m_double;
+    const void* m_pointer;
+    const char* m_string;
+};
 
+// Simple container for const char* that should be copied instead of retained.
+class TraceStringWithCopy {
+public:
+    explicit TraceStringWithCopy(const char* str) : m_str(str) { }
+    operator const char* () const { return m_str; }
 private:
-    const char* m_name;
-    void* m_id;
-    OwnArrayPtr<char> m_extra;
+    const char* m_str;
 };
 
-inline ScopeTracer::ScopeTracer(const char* name, void* id, const char* extra)
-    : m_name(name)
-    , m_id(id)
-{
-    PlatformSupport::traceEventBegin(name, id, extra); \
-    if (extra && PlatformSupport::isTraceEventEnabled())
-        m_extra = adoptArrayPtr(strdup(extra));
+// Define setTraceValue for each allowed type. It stores the type and
+// value in the return arguments. This allows this API to avoid declaring any
+// structures so that it is portable to third_party libraries.
+#define INTERNAL_DECLARE_SET_TRACE_VALUE(actual_type, \
+                                         union_member, \
+                                         value_type_id) \
+    static inline void setTraceValue(actual_type arg, \
+                                     unsigned char* type, \
+                                     unsigned long long* value) { \
+        TraceValueUnion typeValue; \
+        typeValue.union_member = arg; \
+        *type = value_type_id; \
+        *value = typeValue.m_uint; \
+    }
+// Simpler form for int types that can be safely casted.
+#define INTERNAL_DECLARE_SET_TRACE_VALUE_INT(actual_type, \
+                                             value_type_id) \
+    static inline void setTraceValue(actual_type arg, \
+                                     unsigned char* type, \
+                                     unsigned long long* value) { \
+        *type = value_type_id; \
+        *value = static_cast<unsigned long long>(arg); \
+    }
+
+INTERNAL_DECLARE_SET_TRACE_VALUE_INT(unsigned long long, TRACE_VALUE_TYPE_UINT)
+INTERNAL_DECLARE_SET_TRACE_VALUE_INT(unsigned int, TRACE_VALUE_TYPE_UINT)
+INTERNAL_DECLARE_SET_TRACE_VALUE_INT(unsigned short, TRACE_VALUE_TYPE_UINT)
+INTERNAL_DECLARE_SET_TRACE_VALUE_INT(unsigned char, TRACE_VALUE_TYPE_UINT)
+INTERNAL_DECLARE_SET_TRACE_VALUE_INT(long long, TRACE_VALUE_TYPE_INT)
+INTERNAL_DECLARE_SET_TRACE_VALUE_INT(int, TRACE_VALUE_TYPE_INT)
+INTERNAL_DECLARE_SET_TRACE_VALUE_INT(short, TRACE_VALUE_TYPE_INT)
+INTERNAL_DECLARE_SET_TRACE_VALUE_INT(signed char, TRACE_VALUE_TYPE_INT)
+INTERNAL_DECLARE_SET_TRACE_VALUE(bool, m_bool, TRACE_VALUE_TYPE_BOOL)
+INTERNAL_DECLARE_SET_TRACE_VALUE(double, m_double, TRACE_VALUE_TYPE_DOUBLE)
+INTERNAL_DECLARE_SET_TRACE_VALUE(const void*, m_pointer,
+                                 TRACE_VALUE_TYPE_POINTER)
+INTERNAL_DECLARE_SET_TRACE_VALUE(const char*, m_string,
+                                 TRACE_VALUE_TYPE_STRING)
+INTERNAL_DECLARE_SET_TRACE_VALUE(const TraceStringWithCopy&, m_string,
+                                 TRACE_VALUE_TYPE_COPY_STRING)
+
+#undef INTERNAL_DECLARE_SET_TRACE_VALUE
+#undef INTERNAL_DECLARE_SET_TRACE_VALUE_INT
+
+// WTF::String version of setTraceValue so that trace arguments can be strings.
+static inline void setTraceValue(const WTF::CString& arg,
+                                 unsigned char* type,
+                                 unsigned long long* value) {
+    TraceValueUnion typeValue;
+    typeValue.m_string = arg.data();
+    *type = TRACE_VALUE_TYPE_COPY_STRING;
+    *value = typeValue.m_uint;
 }
 
-inline ScopeTracer::~ScopeTracer()
-{
-    PlatformSupport::traceEventEnd(m_name, m_id, m_extra.get());
+// These addTraceEvent template functions are defined here instead of in the
+// macro, because the arg values could be temporary string objects. In order to
+// store pointers to the internal c_str and pass through to the tracing API, the
+// arg values must live throughout these procedures.
+
+static inline int addTraceEvent(char phase,
+                                const unsigned char* categoryEnabled,
+                                const char* name,
+                                unsigned long long id,
+                                unsigned char flags) {
+    return TRACE_EVENT_API_ADD_TRACE_EVENT(
+        phase, categoryEnabled, name, id,
+        zeroNumArgs, 0, 0, 0,
+        noThresholdBeginId, noThresholdValue, flags);
+}
+
+template<class ARG1_TYPE>
+static inline int addTraceEvent(char phase,
+                                const unsigned char* categoryEnabled,
+                                const char* name,
+                                unsigned long long id,
+                                unsigned char flags,
+                                const char* arg1Name,
+                                const ARG1_TYPE& arg1Val) {
+    const int numArgs = 1;
+    unsigned char argTypes[1];
+    unsigned long long argValues[1];
+    setTraceValue(arg1Val, &argTypes[0], &argValues[0]);
+    return TRACE_EVENT_API_ADD_TRACE_EVENT(
+        phase, categoryEnabled, name, id,
+        numArgs, &arg1Name, argTypes, argValues,
+        noThresholdBeginId, noThresholdValue, flags);
 }
 
-} // namespace internal
+template<class ARG1_TYPE, class ARG2_TYPE>
+static inline int addTraceEvent(char phase,
+                                const unsigned char* categoryEnabled,
+                                const char* name,
+                                unsigned long long id,
+                                unsigned char flags,
+                                const char* arg1Name,
+                                const ARG1_TYPE& arg1Val,
+                                const char* arg2Name,
+                                const ARG2_TYPE& arg2Val) {
+    const int numArgs = 2;
+    const char* argNames[2] = { arg1Name, arg2Name };
+    unsigned char argTypes[2];
+    unsigned long long argValues[2];
+    setTraceValue(arg1Val, &argTypes[0], &argValues[0]);
+    setTraceValue(arg2Val, &argTypes[1], &argValues[1]);
+    return TRACE_EVENT_API_ADD_TRACE_EVENT(
+        phase, categoryEnabled, name, id,
+        numArgs, argNames, argTypes, argValues,
+        noThresholdBeginId, noThresholdValue, flags);
+}
+
+// Used by TRACE_EVENTx macro. Do not use directly.
+class TraceEndOnScopeClose {
+public:
+    // Note: members of m_data intentionally left uninitialized. See initialize.
+    TraceEndOnScopeClose() : m_pdata(0) { }
+    ~TraceEndOnScopeClose()
+    {
+        if (m_pdata)
+            addEventIfEnabled();
+    }
+
+    void initialize(const unsigned char* categoryEnabled,
+                    const char* name)
+    {
+        m_data.categoryEnabled = categoryEnabled;
+        m_data.name = name;
+        m_pdata = &m_data;
+    }
+
+private:
+    // Add the end event if the category is still enabled.
+    void addEventIfEnabled()
+    {
+        // Only called when m_pdata is non-null.
+        if (*m_pdata->categoryEnabled) {
+            TRACE_EVENT_API_ADD_TRACE_EVENT(
+                TRACE_EVENT_PHASE_END,
+                m_pdata->categoryEnabled,
+                m_pdata->name, noEventId,
+                zeroNumArgs, 0, 0, 0,
+                noThresholdBeginId, noThresholdValue, TRACE_EVENT_FLAG_NONE);
+        }
+    }
+
+    // This Data struct workaround is to avoid initializing all the members
+    // in Data during construction of this object, since this object is always
+    // constructed, even when tracing is disabled. If the members of Data were
+    // members of this class instead, compiler warnings occur about potential
+    // uninitialized accesses.
+    struct Data {
+        const unsigned char* categoryEnabled;
+        const char* name;
+    };
+    Data* m_pdata;
+    Data m_data;
+};
+
+// Used by TRACE_EVENTx macro. Do not use directly.
+class TraceEndOnScopeCloseThreshold {
+public:
+    // Note: members of m_data intentionally left uninitialized. See initialize.
+    TraceEndOnScopeCloseThreshold() : m_pdata(0) { }
+    ~TraceEndOnScopeCloseThreshold()
+    {
+        if (m_pdata)
+            addEventIfEnabled();
+    }
+
+    // Called by macros only when tracing is enabled at the point when the begin
+    // event is added.
+    void initialize(const unsigned char* categoryEnabled,
+                    const char* name,
+                    int thresholdBeginID,
+                    long long threshold)
+    {
+        m_data.categoryEnabled = categoryEnabled;
+        m_data.name = name;
+        m_data.thresholdBeginID = thresholdBeginID;
+        m_data.threshold = threshold;
+        m_pdata = &m_data;
+    }
+
+private:
+    // Add the end event if the category is still enabled.
+    void addEventIfEnabled()
+    {
+        // Only called when m_pdata is non-null.
+        if (*m_pdata->categoryEnabled) {
+            TRACE_EVENT_API_ADD_TRACE_EVENT(
+                TRACE_EVENT_PHASE_END,
+                m_pdata->categoryEnabled,
+                m_pdata->name, noEventId,
+                zeroNumArgs, 0, 0, 0,
+                m_pdata->thresholdBeginID, m_pdata->threshold,
+                TRACE_EVENT_FLAG_NONE);
+        }
+    }
+
+    // This Data struct workaround is to avoid initializing all the members
+    // in Data during construction of this object, since this object is always
+    // constructed, even when tracing is disabled. If the members of Data were
+    // members of this class instead, compiler warnings occur about potential
+    // uninitialized accesses.
+    struct Data {
+        long long threshold;
+        const unsigned char* categoryEnabled;
+        const char* name;
+        int thresholdBeginID;
+    };
+    Data* m_pdata;
+    Data m_data;
+};
+
+} // namespace TraceEvent
 
 } // namespace WebCore
 
diff --git a/Source/WebCore/platform/efl/ClipboardEfl.cpp b/Source/WebCore/platform/efl/ClipboardEfl.cpp
index 8dc95e865..60152726a 100644
--- a/Source/WebCore/platform/efl/ClipboardEfl.cpp
+++ b/Source/WebCore/platform/efl/ClipboardEfl.cpp
@@ -21,6 +21,7 @@
 #include "config.h"
 #include "ClipboardEfl.h"
 
+#include "DOMStringList.h"
 #include "DataTransferItemList.h"
 #include "Editor.h"
 #include "FileList.h"
@@ -77,10 +78,10 @@ bool ClipboardEfl::setData(const String&, const String&)
     return false;
 }
 
-HashSet<String> ClipboardEfl::types() const
+PassRefPtr<DOMStringList> ClipboardEfl::types() const
 {
     notImplemented();
-    return HashSet<String>();
+    return DOMStringList::create();
 }
 
 PassRefPtr<FileList> ClipboardEfl::files() const
diff --git a/Source/WebCore/platform/efl/ClipboardEfl.h b/Source/WebCore/platform/efl/ClipboardEfl.h
index 575382f7f..56455190f 100644
--- a/Source/WebCore/platform/efl/ClipboardEfl.h
+++ b/Source/WebCore/platform/efl/ClipboardEfl.h
@@ -39,7 +39,7 @@ public:
     String getData(const String&, bool&) const;
     bool setData(const String&, const String&);
 
-    HashSet<String> types() const;
+    PassRefPtr<DOMStringList> types() const;
     virtual PassRefPtr<FileList> files() const;
 
     IntPoint dragLocation() const;
diff --git a/Source/WebCore/platform/efl/FileSystemEfl.cpp b/Source/WebCore/platform/efl/FileSystemEfl.cpp
index 01c6c6726..d521d5404 100644
--- a/Source/WebCore/platform/efl/FileSystemEfl.cpp
+++ b/Source/WebCore/platform/efl/FileSystemEfl.cpp
@@ -42,9 +42,7 @@
 #include <dlfcn.h>
 #include <errno.h>
 #include <fnmatch.h>
-#if ENABLE(GLIB_SUPPORT)
 #include <glib.h> // TODO: remove me after following TODO is solved.
-#endif
 #include <limits.h>
 #include <stdio.h>
 #include <sys/stat.h>
diff --git a/Source/WebCore/platform/efl/GeolocationServiceEfl.cpp b/Source/WebCore/platform/efl/GeolocationServiceEfl.cpp
deleted file mode 100644
index 975c72098..000000000
--- a/Source/WebCore/platform/efl/GeolocationServiceEfl.cpp
+++ /dev/null
@@ -1,72 +0,0 @@
-/*
- * Copyright (C) 2008 Holger Hans Peter Freyther
- * Copyright (C) 2011 Samsung Electronics
- *
- * This library is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Library General Public
- * License as published by the Free Software Foundation; either
- * version 2 of the License, or (at your option) any later version.
- *
- * This library is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Library General Public License for more details.
- *
- * You should have received a copy of the GNU Library General Public License
- * along with this library; see the file COPYING.LIB.  If not, write to
- * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
- * Boston, MA 02110-1301, USA.
- */
-
-#include "config.h"
-#include "GeolocationServiceEfl.h"
-
-#if ENABLE(GEOLOCATION)
-#include "NotImplemented.h"
-#include "PositionOptions.h"
-#include <wtf/text/CString.h>
-
-namespace WebCore {
-
-#if !ENABLE(CLIENT_BASED_GEOLOCATION)
-GeolocationService::FactoryFunction* GeolocationService::s_factoryFunction = &GeolocationServiceEfl::create;
-#endif
-
-PassOwnPtr<GeolocationService> GeolocationServiceEfl::create(GeolocationServiceClient* client)
-{
-    return adoptPtr(new GeolocationServiceEfl(client));
-}
-
-GeolocationServiceEfl::GeolocationServiceEfl(GeolocationServiceClient* client)
-    : GeolocationService(client)
-{
-}
-
-GeolocationServiceEfl::~GeolocationServiceEfl()
-{
-    notImplemented();
-}
-
-bool GeolocationServiceEfl::startUpdating(PositionOptions* options)
-{
-    notImplemented();
-    return false;
-}
-
-void GeolocationServiceEfl::stopUpdating()
-{
-    notImplemented();
-}
-
-Geoposition* GeolocationServiceEfl::lastPosition() const
-{
-    return m_lastPosition.get();
-}
-
-PositionError* GeolocationServiceEfl::lastError() const
-{
-    return m_lastError.get();
-}
-
-}
-#endif // ENABLE(GEOLOCATION)
diff --git a/Source/WebCore/platform/efl/GeolocationServiceEfl.h b/Source/WebCore/platform/efl/GeolocationServiceEfl.h
deleted file mode 100644
index 0cd3e8be7..000000000
--- a/Source/WebCore/platform/efl/GeolocationServiceEfl.h
+++ /dev/null
@@ -1,53 +0,0 @@
-/*
- * Copyright (C) 2008 Holger Hans Peter Freyther
- * Copyright (C) 2011 Samsung Electronics
- *
- * This library is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Library General Public
- * License as published by the Free Software Foundation; either
- * version 2 of the License, or (at your option) any later version.
- *
- * This library is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Library General Public License for more details.
- *
- * You should have received a copy of the GNU Library General Public License
- * along with this library; see the file COPYING.LIB.  If not, write to
- * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
- * Boston, MA 02110-1301, USA.
- */
-
-#ifndef GeolocationServiceEfl_h
-#define GeolocationServiceEfl_h
-
-#if ENABLE(GEOLOCATION)
-#include "GeolocationService.h"
-#include "Geoposition.h"
-#include "PositionError.h"
-#include "RefPtr.h"
-
-namespace WebCore {
-
-class GeolocationServiceEfl : public GeolocationService {
-public:
-    static PassOwnPtr<GeolocationService> create(GeolocationServiceClient*);
-    ~GeolocationServiceEfl();
-
-    virtual bool startUpdating(PositionOptions*);
-    virtual void stopUpdating();
-
-    virtual Geoposition* lastPosition() const;
-    virtual PositionError* lastError() const;
-
-private:
-    GeolocationServiceEfl(GeolocationServiceClient*);
-
-    RefPtr<Geoposition> m_lastPosition;
-    RefPtr<PositionError> m_lastError;
-
-};
-
-}
-#endif // ENABLE(GEOLOCATION)
-#endif
diff --git a/Source/WebCore/platform/graphics/FloatPoint.cpp b/Source/WebCore/platform/graphics/FloatPoint.cpp
index abe9b86d9..d3ccc80c4 100644
--- a/Source/WebCore/platform/graphics/FloatPoint.cpp
+++ b/Source/WebCore/platform/graphics/FloatPoint.cpp
@@ -28,9 +28,11 @@
 #include "FloatPoint.h"
 
 #include "AffineTransform.h"
-#include "TransformationMatrix.h"
+#include "FractionalLayoutPoint.h"
 #include "FloatConversion.h"
+#include "FractionalLayoutSize.h"
 #include "IntPoint.h"
+#include "TransformationMatrix.h"
 #include <limits>
 #include <math.h>
 
@@ -40,6 +42,10 @@ FloatPoint::FloatPoint(const IntPoint& p) : m_x(p.x()), m_y(p.y())
 {
 }
 
+FloatPoint::FloatPoint(const FractionalLayoutPoint& p) : m_x(p.x()), m_y(p.y())
+{
+}
+
 void FloatPoint::normalize()
 {
     float tempLength = length();
@@ -55,6 +61,18 @@ float FloatPoint::length() const
     return sqrtf(lengthSquared());
 }
 
+void FloatPoint::move(const FractionalLayoutSize& size)
+{
+    m_x += size.width();
+    m_y += size.height();
+}
+
+void FloatPoint::moveBy(const FractionalLayoutPoint& point)
+{
+    m_x += point.x();
+    m_y += point.y();
+}
+
 FloatPoint FloatPoint::matrixTransform(const AffineTransform& transform) const
 {
     double newX, newY;
diff --git a/Source/WebCore/platform/graphics/FloatPoint.h b/Source/WebCore/platform/graphics/FloatPoint.h
index ea4bdf4fd..094304d83 100644
--- a/Source/WebCore/platform/graphics/FloatPoint.h
+++ b/Source/WebCore/platform/graphics/FloatPoint.h
@@ -60,13 +60,15 @@ class AffineTransform;
 class TransformationMatrix;
 class IntPoint;
 class IntSize;
+class FractionalLayoutPoint;
+class FractionalLayoutSize;
 
 class FloatPoint {
 public:
     FloatPoint() : m_x(0), m_y(0) { }
     FloatPoint(float x, float y) : m_x(x), m_y(y) { }
     FloatPoint(const IntPoint&);
-
+    FloatPoint(const FractionalLayoutPoint&);
 
     static FloatPoint zero() { return FloatPoint(); }
 
@@ -92,6 +94,7 @@ public:
         m_x += a.width();
         m_y += a.height();
     }
+    void move(const FractionalLayoutSize&);
     void move(const FloatSize& a)
     {
         m_x += a.width();
@@ -102,6 +105,7 @@ public:
         m_x += a.x();
         m_y += a.y();
     }
+    void moveBy(const FractionalLayoutPoint&);
     void moveBy(const FloatPoint& a)
     {
         m_x += a.x();
diff --git a/Source/WebCore/platform/graphics/FloatRect.cpp b/Source/WebCore/platform/graphics/FloatRect.cpp
index 595af2a32..737473c3f 100644
--- a/Source/WebCore/platform/graphics/FloatRect.cpp
+++ b/Source/WebCore/platform/graphics/FloatRect.cpp
@@ -28,6 +28,7 @@
 #include "FloatRect.h"
 
 #include "FloatConversion.h"
+#include "FractionalLayoutRect.h"
 #include "IntRect.h"
 #include <algorithm>
 #include <math.h>
@@ -42,6 +43,10 @@ FloatRect::FloatRect(const IntRect& r) : m_location(r.location()), m_size(r.size
 {
 }
 
+FloatRect::FloatRect(const FractionalLayoutRect& r) : m_location(r.location()), m_size(r.size())
+{
+}
+
 FloatRect FloatRect::narrowPrecision(double x, double y, double width, double height)
 {
     return FloatRect(narrowPrecisionToFloat(x), narrowPrecisionToFloat(y), narrowPrecisionToFloat(width), narrowPrecisionToFloat(height));
diff --git a/Source/WebCore/platform/graphics/FloatRect.h b/Source/WebCore/platform/graphics/FloatRect.h
index 22c171c5a..4d4eadfd0 100644
--- a/Source/WebCore/platform/graphics/FloatRect.h
+++ b/Source/WebCore/platform/graphics/FloatRect.h
@@ -66,6 +66,7 @@ namespace WebCore {
 class VGRect;
 #endif
 
+class FractionalLayoutRect;
 class IntRect;
 class IntPoint;
 
@@ -82,6 +83,7 @@ public:
     FloatRect(float x, float y, float width, float height)
         : m_location(FloatPoint(x, y)), m_size(FloatSize(width, height)) { }
     FloatRect(const IntRect&);
+    FloatRect(const FractionalLayoutRect&);
 
     static FloatRect narrowPrecision(double x, double y, double width, double height);
 
diff --git a/Source/WebCore/platform/graphics/FloatSize.cpp b/Source/WebCore/platform/graphics/FloatSize.cpp
index 25512a7f8..2b62a9d17 100644
--- a/Source/WebCore/platform/graphics/FloatSize.cpp
+++ b/Source/WebCore/platform/graphics/FloatSize.cpp
@@ -27,6 +27,7 @@
 #include "config.h"
 #include "FloatSize.h"
 
+#include "FractionalLayoutSize.h"
 #include "FloatConversion.h"
 #include "IntSize.h"
 #include <limits>
@@ -40,6 +41,10 @@ FloatSize::FloatSize(const IntSize& size) : m_width(size.width()), m_height(size
 {
 }
 
+FloatSize::FloatSize(const FractionalLayoutSize& size) : m_width(size.width()), m_height(size.height())
+{
+}
+
 float FloatSize::diagonalLength() const
 {
     return sqrtf(diagonalLengthSquared());
diff --git a/Source/WebCore/platform/graphics/FloatSize.h b/Source/WebCore/platform/graphics/FloatSize.h
index 1cee681c2..2b5545030 100644
--- a/Source/WebCore/platform/graphics/FloatSize.h
+++ b/Source/WebCore/platform/graphics/FloatSize.h
@@ -46,12 +46,14 @@ typedef struct _NSSize NSSize;
 namespace WebCore {
 
 class IntSize;
+class FractionalLayoutSize;
 
 class FloatSize {
 public:
     FloatSize() : m_width(0), m_height(0) { }
     FloatSize(float width, float height) : m_width(width), m_height(height) { }
     FloatSize(const IntSize&);
+    FloatSize(const FractionalLayoutSize&);
 
     static FloatSize narrowPrecision(double width, double height);
 
diff --git a/Source/WebCore/platform/graphics/Font.cpp b/Source/WebCore/platform/graphics/Font.cpp
index c2d9c58c3..50eee53a7 100644
--- a/Source/WebCore/platform/graphics/Font.cpp
+++ b/Source/WebCore/platform/graphics/Font.cpp
@@ -120,11 +120,12 @@ bool Font::operator==(const Font& other) const
     
     FontSelector* first = m_fontList ? m_fontList->fontSelector() : 0;
     FontSelector* second = other.m_fontList ? other.m_fontList->fontSelector() : 0;
-    
+
     return first == second
            && m_fontDescription == other.m_fontDescription
            && m_letterSpacing == other.m_letterSpacing
            && m_wordSpacing == other.m_wordSpacing
+           && (m_fontList ? m_fontList->fontSelectorVersion() : 0) == (other.m_fontList ? other.m_fontList->fontSelectorVersion() : 0)
            && (m_fontList ? m_fontList->generation() : 0) == (other.m_fontList ? other.m_fontList->generation() : 0);
 }
 
diff --git a/Source/WebCore/platform/graphics/FontCache.cpp b/Source/WebCore/platform/graphics/FontCache.cpp
index 870c649ed..47f251c84 100644
--- a/Source/WebCore/platform/graphics/FontCache.cpp
+++ b/Source/WebCore/platform/graphics/FontCache.cpp
@@ -252,7 +252,7 @@ typedef HashMap<FontPlatformData, pair<SimpleFontData*, unsigned>, FontDataCache
 
 static FontDataCache* gFontDataCache = 0;
 
-#if PLATFORM(CHROMIUM)
+#if PLATFORM(CHROMIUM) && !OS(ANDROID)
 const int cMaxInactiveFontData = 250;
 const int cTargetInactiveFontData = 200;
 #else
diff --git a/Source/WebCore/platform/graphics/FontFallbackList.cpp b/Source/WebCore/platform/graphics/FontFallbackList.cpp
index 2f1b68f8b..6d11c09e3 100644
--- a/Source/WebCore/platform/graphics/FontFallbackList.cpp
+++ b/Source/WebCore/platform/graphics/FontFallbackList.cpp
@@ -39,6 +39,7 @@ FontFallbackList::FontFallbackList()
     : m_pageZero(0)
     , m_cachedPrimarySimpleFontData(0)
     , m_fontSelector(0)
+    , m_fontSelectorVersion(0)
     , m_familyIndex(0)
     , m_generation(fontCache()->generation())
     , m_pitch(UnknownPitch)
@@ -57,6 +58,7 @@ void FontFallbackList::invalidate(PassRefPtr<FontSelector> fontSelector)
     m_pitch = UnknownPitch;
     m_loadingCustomFonts = false;
     m_fontSelector = fontSelector;
+    m_fontSelectorVersion = m_fontSelector ? m_fontSelector->version() : 0;
     m_generation = fontCache()->generation();
 }
 
diff --git a/Source/WebCore/platform/graphics/FontFallbackList.h b/Source/WebCore/platform/graphics/FontFallbackList.h
index 10251a4eb..12479b2c9 100644
--- a/Source/WebCore/platform/graphics/FontFallbackList.h
+++ b/Source/WebCore/platform/graphics/FontFallbackList.h
@@ -51,6 +51,8 @@ public:
     bool loadingCustomFonts() const { return m_loadingCustomFonts; }
 
     FontSelector* fontSelector() const { return m_fontSelector.get(); }
+    // FIXME: It should be possible to combine fontSelectorVersion and generation.
+    unsigned fontSelectorVersion() const { return m_fontSelectorVersion; }
     unsigned generation() const { return m_generation; }
 
     struct GlyphPagesHashTraits : HashTraits<int> {
@@ -87,6 +89,7 @@ private:
     mutable GlyphPageTreeNode* m_pageZero;
     mutable const SimpleFontData* m_cachedPrimarySimpleFontData;
     RefPtr<FontSelector> m_fontSelector;
+    unsigned m_fontSelectorVersion;
     mutable int m_familyIndex;
     unsigned short m_generation;
     mutable unsigned m_pitch : 3; // Pitch
diff --git a/Source/WebCore/platform/graphics/FontSelector.h b/Source/WebCore/platform/graphics/FontSelector.h
index e18161bb8..2c7d1494e 100644
--- a/Source/WebCore/platform/graphics/FontSelector.h
+++ b/Source/WebCore/platform/graphics/FontSelector.h
@@ -44,6 +44,8 @@ public:
 
     virtual void registerForInvalidationCallbacks(FontSelectorClient*) = 0;
     virtual void unregisterForInvalidationCallbacks(FontSelectorClient*) = 0;
+    
+    virtual unsigned version() const = 0;
 };
 
 class FontSelectorClient {
diff --git a/Source/WebCore/platform/graphics/FractionalLayoutPoint.h b/Source/WebCore/platform/graphics/FractionalLayoutPoint.h
new file mode 100644
index 000000000..c9863fa5b
--- /dev/null
+++ b/Source/WebCore/platform/graphics/FractionalLayoutPoint.h
@@ -0,0 +1,163 @@
+/*
+ * Copyright (c) 2012, Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef FractionalLayoutPoint_h
+#define FractionalLayoutPoint_h
+
+#include "FloatPoint.h"
+#include "FractionalLayoutSize.h"
+#include <wtf/MathExtras.h>
+
+namespace WebCore {
+
+class FractionalLayoutPoint {
+public:
+    FractionalLayoutPoint() : m_x(0), m_y(0) { }
+    FractionalLayoutPoint(FractionalLayoutUnit x, FractionalLayoutUnit y) : m_x(x), m_y(y) { }
+    FractionalLayoutPoint(const IntPoint& point) : m_x(point.x()), m_y(point.y()) { }
+    explicit FractionalLayoutPoint(const FloatPoint& size) : m_x(size.x()), m_y(size.y()) { }
+
+    static FractionalLayoutPoint zero() { return FractionalLayoutPoint(); }
+
+    FractionalLayoutUnit x() const { return m_x; }
+    FractionalLayoutUnit y() const { return m_y; }
+
+    void setX(FractionalLayoutUnit x) { m_x = x; }
+    void setY(FractionalLayoutUnit y) { m_y = y; }
+
+    void move(const FractionalLayoutSize& s) { move(s.width(), s.height()); } 
+    void moveBy(const FractionalLayoutPoint& offset) { move(offset.x(), offset.y()); }
+    void move(FractionalLayoutUnit dx, FractionalLayoutUnit dy) { m_x += dx; m_y += dy; }
+    void scale(float sx, float sy)
+    {
+        m_x *= sx;
+        m_y *= sy;
+    }
+    
+    FractionalLayoutPoint expandedTo(const FractionalLayoutPoint& other) const
+    {
+        return FractionalLayoutPoint(std::max(m_x, other.m_x), std::max(m_y, other.m_y));
+    }
+
+    FractionalLayoutPoint shrunkTo(const FractionalLayoutPoint& other) const
+    {
+        return FractionalLayoutPoint(std::min(m_x, other.m_x), std::min(m_y, other.m_y));
+    }
+
+    void clampNegativeToZero()
+    {
+        *this = expandedTo(zero());
+    }
+
+    FractionalLayoutPoint transposedPoint() const
+    {
+        return FractionalLayoutPoint(m_y, m_x);
+    }
+
+private:
+    FractionalLayoutUnit m_x, m_y;
+};
+
+inline FractionalLayoutPoint& operator+=(FractionalLayoutPoint& a, const FractionalLayoutSize& b)
+{
+    a.move(b.width(), b.height());
+    return a;
+}
+
+inline FractionalLayoutPoint& operator-=(FractionalLayoutPoint& a, const FractionalLayoutSize& b)
+{
+    a.move(-b.width(), -b.height());
+    return a;
+}
+
+inline FractionalLayoutPoint operator+(const FractionalLayoutPoint& a, const FractionalLayoutSize& b)
+{
+    return FractionalLayoutPoint(a.x() + b.width(), a.y() + b.height());
+}
+
+inline FractionalLayoutPoint operator+(const FractionalLayoutPoint& a, const FractionalLayoutPoint& b)
+{
+    return FractionalLayoutPoint(a.x() + b.x(), a.y() + b.y());
+}
+
+inline FractionalLayoutSize operator-(const FractionalLayoutPoint& a, const FractionalLayoutPoint& b)
+{
+    return FractionalLayoutSize(a.x() - b.x(), a.y() - b.y());
+}
+
+inline FractionalLayoutPoint operator-(const FractionalLayoutPoint& a, const FractionalLayoutSize& b)
+{
+    return FractionalLayoutPoint(a.x() - b.width(), a.y() - b.height());
+}
+
+inline FractionalLayoutPoint operator-(const FractionalLayoutPoint& point)
+{
+    return FractionalLayoutPoint(-point.x(), -point.y());
+}
+
+inline bool operator==(const FractionalLayoutPoint& a, const FractionalLayoutPoint& b)
+{
+    return a.x() == b.x() && a.y() == b.y();
+}
+
+inline bool operator!=(const FractionalLayoutPoint& a, const FractionalLayoutPoint& b)
+{
+    return a.x() != b.x() || a.y() != b.y();
+}
+
+inline FractionalLayoutPoint toPoint(const FractionalLayoutSize& size)
+{
+    return FractionalLayoutPoint(size.width(), size.height());
+}
+
+inline FractionalLayoutSize toSize(const FractionalLayoutPoint& a)
+{
+    return FractionalLayoutSize(a.x(), a.y());
+}
+
+inline IntPoint flooredIntPoint(const FractionalLayoutPoint& point)
+{
+    return IntPoint(point.x().toInt(), point.y().toInt());
+}
+
+inline IntPoint roundedIntPoint(const FractionalLayoutPoint& point)
+{
+    return IntPoint(point.x().round(), point.y().round());
+}
+
+inline IntPoint ceiledIntPoint(const FractionalLayoutPoint& point)
+{
+    return IntPoint(point.x().ceil(), point.y().ceil());
+}
+
+
+} // namespace WebCore
+
+#endif // FractionalLayoutPoint_h
diff --git a/Source/WebCore/platform/graphics/FractionalLayoutRect.cpp b/Source/WebCore/platform/graphics/FractionalLayoutRect.cpp
new file mode 100644
index 000000000..62986e977
--- /dev/null
+++ b/Source/WebCore/platform/graphics/FractionalLayoutRect.cpp
@@ -0,0 +1,154 @@
+/*
+ * Copyright (c) 2012, Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "FractionalLayoutRect.h"
+
+#include "FloatRect.h"
+#include "FractionalLayoutUnit.h"
+#include <algorithm>
+
+using std::max;
+using std::min;
+
+namespace WebCore {
+
+FractionalLayoutRect::FractionalLayoutRect(const FloatRect& r)
+    : m_location(FractionalLayoutPoint(r.location()))
+    , m_size(FractionalLayoutSize(r.size()))
+{
+}
+
+bool FractionalLayoutRect::intersects(const FractionalLayoutRect& other) const
+{
+    // Checking emptiness handles negative widths as well as zero.
+    return !isEmpty() && !other.isEmpty()
+        && x() < other.maxX() && other.x() < maxX()
+        && y() < other.maxY() && other.y() < maxY();
+}
+
+bool FractionalLayoutRect::contains(const FractionalLayoutRect& other) const
+{
+    return x() <= other.x() && maxX() >= other.maxX()
+        && y() <= other.y() && maxY() >= other.maxY();
+}
+
+void FractionalLayoutRect::intersect(const FractionalLayoutRect& other)
+{
+    FractionalLayoutPoint newLocation(max(x(), other.x()), max(y(), other.y()));
+    FractionalLayoutPoint newMaxPoint(min(maxX(), other.maxX()), min(maxY(), other.maxY()));
+
+    // Return a clean empty rectangle for non-intersecting cases.
+    if (newLocation.x() >= newMaxPoint.x() || newLocation.y() >= newMaxPoint.y()) {
+        newLocation = FractionalLayoutPoint(0, 0);
+        newMaxPoint = FractionalLayoutPoint(0, 0);
+    }
+
+    m_location = newLocation;
+    m_size = newMaxPoint - newLocation;
+}
+
+void FractionalLayoutRect::unite(const FractionalLayoutRect& other)
+{
+    // Handle empty special cases first.
+    if (other.isEmpty())
+        return;
+    if (isEmpty()) {
+        *this = other;
+        return;
+    }
+
+    FractionalLayoutPoint newLocation(min(x(), other.x()), min(y(), other.y()));
+    FractionalLayoutPoint newMaxPoint(max(maxX(), other.maxX()), max(maxY(), other.maxY()));
+
+    m_location = newLocation;
+    m_size = newMaxPoint - newLocation;
+}
+
+void FractionalLayoutRect::uniteIfNonZero(const FractionalLayoutRect& other)
+{
+    // Handle empty special cases first.
+    if (!other.width() && !other.height())
+        return;
+    if (!width() && !height()) {
+        *this = other;
+        return;
+    }
+
+    FractionalLayoutPoint newLocation(min(x(), other.x()), min(y(), other.y()));
+    FractionalLayoutPoint newMaxPoint(max(maxX(), other.maxX()), max(maxY(), other.maxY()));
+
+    m_location = newLocation;
+    m_size = newMaxPoint - newLocation;
+}
+
+void FractionalLayoutRect::scale(float s)
+{
+    m_location.scale(s, s);
+    m_size.scale(s);
+}
+
+FractionalLayoutRect unionRect(const Vector<FractionalLayoutRect>& rects)
+{
+    FractionalLayoutRect result;
+
+    size_t count = rects.size();
+    for (size_t i = 0; i < count; ++i)
+        result.unite(rects[i]);
+
+    return result;
+}
+
+IntRect enclosingIntRect(const FractionalLayoutRect& rect)
+{
+    float x = floorf(rect.x().toFloat());
+    float y = floorf(rect.y().toFloat());
+    float width = ceilf(rect.maxX().toFloat()) - x;
+    float height = ceilf(rect.maxY().toFloat()) - y;
+
+    return IntRect(clampToInteger(x), clampToInteger(y), 
+                   clampToInteger(width), clampToInteger(height));
+}
+
+FractionalLayoutRect enclosingFractionalLayoutRect(const FloatRect& rect)
+{
+    return FractionalLayoutRect(rect.x(), rect.y(),
+                     rect.maxX() - rect.x() + FractionalLayoutUnit::epsilon(),
+                     rect.maxY() - rect.y() + FractionalLayoutUnit::epsilon());
+}
+
+IntRect pixelSnappedIntRect(const FractionalLayoutRect& rect)
+{
+    IntPoint roundedLocation = roundedIntPoint(rect.location());
+    return IntRect(roundedLocation, IntSize((rect.x() + rect.width()).round() - roundedLocation.x(),
+                                            (rect.y() + rect.height()).round() - roundedLocation.y()));
+}
+
+} // namespace WebCore
diff --git a/Source/WebCore/platform/graphics/FractionalLayoutRect.h b/Source/WebCore/platform/graphics/FractionalLayoutRect.h
new file mode 100644
index 000000000..e16655517
--- /dev/null
+++ b/Source/WebCore/platform/graphics/FractionalLayoutRect.h
@@ -0,0 +1,183 @@
+/*
+ * Copyright (c) 2012, Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef FractionalLayoutRect_h
+#define FractionalLayoutRect_h
+
+#include "FractionalLayoutPoint.h"
+#include "IntRect.h"
+#include <wtf/Vector.h>
+
+namespace WebCore {
+
+class FloatRect;
+
+class FractionalLayoutRect {
+public:
+    FractionalLayoutRect() { }
+    FractionalLayoutRect(const FractionalLayoutPoint& location, const FractionalLayoutSize& size)
+        : m_location(location), m_size(size) { }
+    FractionalLayoutRect(FractionalLayoutUnit x, FractionalLayoutUnit y, FractionalLayoutUnit width, FractionalLayoutUnit height)
+        : m_location(FractionalLayoutPoint(x, y)), m_size(FractionalLayoutSize(width, height)) { }
+    FractionalLayoutRect(const FloatPoint& location, const FloatSize& size)
+        : m_location(location), m_size(size) { }
+    FractionalLayoutRect(const IntRect& rect) : m_location(rect.location()), m_size(rect.size()) { }
+
+    explicit FractionalLayoutRect(const FloatRect&); // don't do this implicitly since it's lossy
+        
+    FractionalLayoutPoint location() const { return m_location; }
+    FractionalLayoutSize size() const { return m_size; }
+
+    void setLocation(const FractionalLayoutPoint& location) { m_location = location; }
+    void setSize(const FractionalLayoutSize& size) { m_size = size; }
+
+    FractionalLayoutUnit x() const { return m_location.x(); }
+    FractionalLayoutUnit y() const { return m_location.y(); }
+    FractionalLayoutUnit maxX() const { return x() + width(); }
+    FractionalLayoutUnit maxY() const { return y() + height(); }
+    FractionalLayoutUnit width() const { return m_size.width(); }
+    FractionalLayoutUnit height() const { return m_size.height(); }
+
+    void setX(FractionalLayoutUnit x) { m_location.setX(x); }
+    void setY(FractionalLayoutUnit y) { m_location.setY(y); }
+    void setWidth(FractionalLayoutUnit width) { m_size.setWidth(width); }
+    void setHeight(FractionalLayoutUnit height) { m_size.setHeight(height); }
+
+    bool isEmpty() const { return m_size.isEmpty(); }
+
+    // NOTE: The result is rounded to integer values, and thus may be not the exact
+    // center point.
+    FractionalLayoutPoint center() const { return FractionalLayoutPoint(x() + width() / 2, y() + height() / 2); }
+
+    void move(const FractionalLayoutSize& size) { m_location += size; } 
+    void moveBy(const FractionalLayoutPoint& offset) { m_location.move(offset.x(), offset.y()); }
+    void move(FractionalLayoutUnit dx, FractionalLayoutUnit dy) { m_location.move(dx, dy); } 
+
+    void expand(const FractionalLayoutSize& size) { m_size += size; }
+    void expand(FractionalLayoutUnit dw, FractionalLayoutUnit dh) { m_size.expand(dw, dh); }
+    void contract(const FractionalLayoutSize& size) { m_size -= size; }
+    void contract(FractionalLayoutUnit dw, FractionalLayoutUnit dh) { m_size.expand(-dw, -dh); }
+
+    void shiftXEdgeTo(FractionalLayoutUnit edge)
+    {
+        FractionalLayoutUnit delta = edge - x();
+        setX(edge);
+        setWidth(std::max<FractionalLayoutUnit>(0, width() - delta));
+    }
+    void shiftMaxXEdgeTo(FractionalLayoutUnit edge)
+    {
+        FractionalLayoutUnit delta = edge - maxX();
+        setWidth(std::max<FractionalLayoutUnit>(0, width() + delta));
+    }
+    void shiftYEdgeTo(FractionalLayoutUnit edge)
+    {
+        FractionalLayoutUnit delta = edge - y();
+        setY(edge);
+        setHeight(std::max<FractionalLayoutUnit>(0, height() - delta));
+    }
+    void shiftMaxYEdgeTo(FractionalLayoutUnit edge)
+    {
+        FractionalLayoutUnit delta = edge - maxY();
+        setHeight(std::max<FractionalLayoutUnit>(0, height() + delta));
+    }
+
+    FractionalLayoutPoint minXMinYCorner() const { return m_location; } // typically topLeft
+    FractionalLayoutPoint maxXMinYCorner() const { return FractionalLayoutPoint(m_location.x() + m_size.width(), m_location.y()); } // typically topRight
+    FractionalLayoutPoint minXMaxYCorner() const { return FractionalLayoutPoint(m_location.x(), m_location.y() + m_size.height()); } // typically bottomLeft
+    FractionalLayoutPoint maxXMaxYCorner() const { return FractionalLayoutPoint(m_location.x() + m_size.width(), m_location.y() + m_size.height()); } // typically bottomRight
+    
+    bool intersects(const FractionalLayoutRect&) const;
+    bool contains(const FractionalLayoutRect&) const;
+
+    // This checks to see if the rect contains x,y in the traditional sense.
+    // Equivalent to checking if the rect contains a 1x1 rect below and to the right of (px,py).
+    bool contains(FractionalLayoutUnit px, FractionalLayoutUnit py) const
+        { return px >= x() && px < maxX() && py >= y() && py < maxY(); }
+    bool contains(const FractionalLayoutPoint& point) const { return contains(point.x(), point.y()); }
+
+    void intersect(const FractionalLayoutRect&);
+    void unite(const FractionalLayoutRect&);
+    void uniteIfNonZero(const FractionalLayoutRect&);
+
+    void inflateX(FractionalLayoutUnit dx)
+    {
+        m_location.setX(m_location.x() - dx);
+        m_size.setWidth(m_size.width() + dx + dx);
+    }
+    void inflateY(FractionalLayoutUnit dy)
+    {
+        m_location.setY(m_location.y() - dy);
+        m_size.setHeight(m_size.height() + dy + dy);
+    }
+    void inflate(FractionalLayoutUnit d) { inflateX(d); inflateY(d); }
+    void scale(float s);
+
+    FractionalLayoutRect transposedRect() const { return FractionalLayoutRect(m_location.transposedPoint(), m_size.transposedSize()); }
+
+    static FractionalLayoutRect infiniteRect() {return FractionalLayoutRect(FractionalLayoutUnit::min() / 2, FractionalLayoutUnit::min() / 2, FractionalLayoutUnit::max(), FractionalLayoutUnit::max()); }
+
+private:
+    FractionalLayoutPoint m_location;
+    FractionalLayoutSize m_size;
+};
+
+inline FractionalLayoutRect intersection(const FractionalLayoutRect& a, const FractionalLayoutRect& b)
+{
+    FractionalLayoutRect c = a;
+    c.intersect(b);
+    return c;
+}
+
+inline FractionalLayoutRect unionRect(const FractionalLayoutRect& a, const FractionalLayoutRect& b)
+{
+    FractionalLayoutRect c = a;
+    c.unite(b);
+    return c;
+}
+
+FractionalLayoutRect unionRect(const Vector<FractionalLayoutRect>&);
+
+inline bool operator==(const FractionalLayoutRect& a, const FractionalLayoutRect& b)
+{
+    return a.location() == b.location() && a.size() == b.size();
+}
+
+inline bool operator!=(const FractionalLayoutRect& a, const FractionalLayoutRect& b)
+{
+    return a.location() != b.location() || a.size() != b.size();
+}
+
+IntRect enclosingIntRect(const FractionalLayoutRect&);
+FractionalLayoutRect enclosingFractionalLayoutRect(const FloatRect&);
+IntRect pixelSnappedIntRect(const FractionalLayoutRect&);
+
+} // namespace WebCore
+
+#endif // FractionalLayoutRect_h
diff --git a/Source/WebCore/platform/graphics/FractionalLayoutSize.cpp b/Source/WebCore/platform/graphics/FractionalLayoutSize.cpp
new file mode 100644
index 000000000..b10152227
--- /dev/null
+++ b/Source/WebCore/platform/graphics/FractionalLayoutSize.cpp
@@ -0,0 +1,43 @@
+/*
+ * Copyright (c) 2012, Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "FractionalLayoutSize.h"
+
+#include "FractionalLayoutPoint.h"
+
+namespace WebCore {
+
+IntSize pixelSnappedIntSize(const FractionalLayoutSize& s, const FractionalLayoutPoint& p)
+{
+    return IntSize(snapSizeToPixel(s.width(), p.x()), snapSizeToPixel(s.height(), p.y()));
+}
+
+} // namespace WebCore
diff --git a/Source/WebCore/platform/graphics/FractionalLayoutSize.h b/Source/WebCore/platform/graphics/FractionalLayoutSize.h
new file mode 100644
index 000000000..1b9e942ff
--- /dev/null
+++ b/Source/WebCore/platform/graphics/FractionalLayoutSize.h
@@ -0,0 +1,152 @@
+/*
+ * Copyright (c) 2012, Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef FractionalLayoutSize_h
+#define FractionalLayoutSize_h
+
+#include "FloatSize.h"
+#include "FractionalLayoutUnit.h"
+#include "IntSize.h"
+
+namespace WebCore {
+
+class FractionalLayoutPoint;
+
+class FractionalLayoutSize {
+public:
+    FractionalLayoutSize() : m_width(0), m_height(0) { }
+    FractionalLayoutSize(const IntSize& size) : m_width(size.width()), m_height(size.height()) { }
+    FractionalLayoutSize(FractionalLayoutUnit width, FractionalLayoutUnit height) : m_width(width), m_height(height) { }
+
+    explicit FractionalLayoutSize(const FloatSize& size) : m_width(size.width()), m_height(size.height()) { }
+    
+    FractionalLayoutUnit width() const { return m_width; }
+    FractionalLayoutUnit height() const { return m_height; }
+
+    void setWidth(FractionalLayoutUnit width) { m_width = width; }
+    void setHeight(FractionalLayoutUnit height) { m_height = height; }
+
+    bool isEmpty() const { return m_width <= 0 || m_height <= 0; }
+    bool isZero() const { return !m_width && !m_height; }
+
+    float aspectRatio() const { return static_cast<float>(m_width) / static_cast<float>(m_height); }
+    
+    void expand(FractionalLayoutUnit width, FractionalLayoutUnit height)
+    {
+        m_width += width;
+        m_height += height;
+    }
+    
+    void scale(float scale)
+    {
+        m_width = static_cast<int>(static_cast<float>(m_width) * scale);
+        m_height = static_cast<int>(static_cast<float>(m_height) * scale);
+    }
+    
+    FractionalLayoutSize expandedTo(const FractionalLayoutSize& other) const
+    {
+        return FractionalLayoutSize(m_width > other.m_width ? m_width : other.m_width,
+            m_height > other.m_height ? m_height : other.m_height);
+    }
+
+    FractionalLayoutSize shrunkTo(const FractionalLayoutSize& other) const
+    {
+        return FractionalLayoutSize(m_width < other.m_width ? m_width : other.m_width,
+            m_height < other.m_height ? m_height : other.m_height);
+    }
+
+    void clampNegativeToZero()
+    {
+        *this = expandedTo(FractionalLayoutSize());
+    }
+
+    FractionalLayoutSize transposedSize() const
+    {
+        return FractionalLayoutSize(m_height, m_width);
+    }
+
+private:
+    FractionalLayoutUnit m_width, m_height;
+};
+
+inline FractionalLayoutSize& operator+=(FractionalLayoutSize& a, const FractionalLayoutSize& b)
+{
+    a.setWidth(a.width() + b.width());
+    a.setHeight(a.height() + b.height());
+    return a;
+}
+
+inline FractionalLayoutSize& operator-=(FractionalLayoutSize& a, const FractionalLayoutSize& b)
+{
+    a.setWidth(a.width() - b.width());
+    a.setHeight(a.height() - b.height());
+    return a;
+}
+
+inline FractionalLayoutSize operator+(const FractionalLayoutSize& a, const FractionalLayoutSize& b)
+{
+    return FractionalLayoutSize(a.width() + b.width(), a.height() + b.height());
+}
+
+inline FractionalLayoutSize operator-(const FractionalLayoutSize& a, const FractionalLayoutSize& b)
+{
+    return FractionalLayoutSize(a.width() - b.width(), a.height() - b.height());
+}
+
+inline FractionalLayoutSize operator-(const FractionalLayoutSize& size)
+{
+    return FractionalLayoutSize(-size.width(), -size.height());
+}
+
+inline bool operator==(const FractionalLayoutSize& a, const FractionalLayoutSize& b)
+{
+    return a.width() == b.width() && a.height() == b.height();
+}
+
+inline bool operator!=(const FractionalLayoutSize& a, const FractionalLayoutSize& b)
+{
+    return a.width() != b.width() || a.height() != b.height();
+}
+
+inline IntSize flooredIntSize(const FractionalLayoutSize& s)
+{
+    return IntSize(s.width().toInt(), s.height().toInt());
+}
+
+inline IntSize roundedIntSize(const FractionalLayoutSize& s)
+{
+    return IntSize(s.width().round(), s.height().round());
+}
+
+IntSize pixelSnappedIntSize(const FractionalLayoutSize&, const FractionalLayoutPoint&);
+
+} // namespace WebCore
+
+#endif // FractionalLayoutSize_h
diff --git a/Source/WebCore/platform/graphics/GraphicsContext3D.h b/Source/WebCore/platform/graphics/GraphicsContext3D.h
index 96e66ca33..17ae9845f 100644
--- a/Source/WebCore/platform/graphics/GraphicsContext3D.h
+++ b/Source/WebCore/platform/graphics/GraphicsContext3D.h
@@ -55,6 +55,10 @@ OBJC_CLASS WebGLLayer;
 QT_BEGIN_NAMESPACE
 class QPainter;
 class QRect;
+class QGLWidget;
+class QGLContext;
+class QOpenGLContext;
+class QSurface;
 QT_END_NAMESPACE
 #elif PLATFORM(GTK) || PLATFORM(EFL)
 typedef unsigned int GLuint;
@@ -62,6 +66,14 @@ typedef unsigned int GLuint;
 
 #if PLATFORM(MAC)
 typedef CGLContextObj PlatformGraphicsContext3D;
+#elif PLATFORM(QT)
+#if QT_VERSION >= QT_VERSION_CHECK(5, 0, 0)
+typedef QOpenGLContext* PlatformGraphicsContext3D;
+typedef QSurface* PlatformGraphicsSurface3D;
+#else
+typedef QGLContext* PlatformGraphicsContext3D;
+typedef QGLWidget* PlatformGraphicsSurface3D;
+#endif
 #else
 typedef void* PlatformGraphicsContext3D;
 #endif
@@ -789,6 +801,9 @@ public:
 #elif PLATFORM(GTK) || PLATFORM(EFL)
     void paintToCanvas(const unsigned char* imagePixels, int imageWidth, int imageHeight,
                        int canvasWidth, int canvasHeight, PlatformContextCairo* context);
+#elif PLATFORM(QT)
+    void paintToCanvas(const unsigned char* imagePixels, int imageWidth, int imageHeight,
+                       int canvasWidth, int canvasHeight, QPainter* context);
 #endif
 
     void markContextChanged();
@@ -799,18 +814,6 @@ public:
     PassRefPtr<ImageData> paintRenderingResultsToImageData(DrawingBuffer*);
     bool paintCompositedResultsToCanvas(CanvasRenderingContext*);
 
-#if PLATFORM(QT)
-    bool paintsIntoCanvasBuffer() const { return true; }
-#elif PLATFORM(CHROMIUM)
-    bool paintsIntoCanvasBuffer() const;
-#elif PLATFORM(GTK)
-    bool paintsIntoCanvasBuffer() const { return true; }
-#elif PLATFORM(EFL)
-    bool paintsIntoCanvasBuffer() const { return true; }
-#else
-    bool paintsIntoCanvasBuffer() const { return false; }
-#endif
-
     // Support for buffer creation and deletion
     Platform3DObject createBuffer();
     Platform3DObject createFramebuffer();
diff --git a/Source/WebCore/platform/graphics/GraphicsLayer.cpp b/Source/WebCore/platform/graphics/GraphicsLayer.cpp
index c7a22755b..30eb41da1 100644
--- a/Source/WebCore/platform/graphics/GraphicsLayer.cpp
+++ b/Source/WebCore/platform/graphics/GraphicsLayer.cpp
@@ -298,7 +298,7 @@ void GraphicsLayer::paintGraphicsLayerContents(GraphicsContext& context, const I
         LayoutRect clipRect(clip);
         clipRect.move(offset);
 
-        m_client->paintContents(this, context, m_paintingPhase, clipRect);
+        m_client->paintContents(this, context, m_paintingPhase, pixelSnappedIntRect(clipRect));
     }
 #ifndef NDEBUG
     s_inPaintContents = false;
@@ -380,6 +380,46 @@ void GraphicsLayer::setGraphicsLayerFactory(GraphicsLayer::GraphicsLayerFactory
 }
 #endif
 
+#if ENABLE(CSS_FILTERS)
+static inline const FilterOperations* filterOperationsAt(const KeyframeValueList& valueList, size_t index)
+{
+    return static_cast<const FilterAnimationValue*>(valueList.at(index))->value();
+}
+
+int GraphicsLayer::validateFilterOperations(const KeyframeValueList& valueList)
+{
+    ASSERT(valueList.property() == AnimatedPropertyWebkitFilter);
+
+    if (valueList.size() < 2)
+        return -1;
+
+    // Empty filters match anything, so find the first non-empty entry as the reference
+    size_t firstIndex = 0;
+    for ( ; firstIndex < valueList.size(); ++firstIndex) {
+        if (filterOperationsAt(valueList, firstIndex)->operations().size() > 0)
+            break;
+    }
+
+    if (firstIndex >= valueList.size())
+        return -1;
+
+    const FilterOperations* firstVal = filterOperationsAt(valueList, firstIndex);
+    
+    for (size_t i = firstIndex + 1; i < valueList.size(); ++i) {
+        const FilterOperations* val = filterOperationsAt(valueList, i);
+        
+        // An emtpy filter list matches anything.
+        if (val->operations().isEmpty())
+            continue;
+        
+        if (!firstVal->operationsMatch(*val))
+            return -1;
+    }
+    
+    return firstIndex;
+}
+#endif
+
 // An "invalid" list is one whose functions don't match, and therefore has to be animated as a Matrix
 // The hasBigRotation flag will always return false if isValid is false. Otherwise hasBigRotation is 
 // true if the rotation between any two keyframes is >= 180 degrees.
diff --git a/Source/WebCore/platform/graphics/GraphicsLayer.h b/Source/WebCore/platform/graphics/GraphicsLayer.h
index 9f75624ff..dabbdaf1e 100644
--- a/Source/WebCore/platform/graphics/GraphicsLayer.h
+++ b/Source/WebCore/platform/graphics/GraphicsLayer.h
@@ -153,6 +153,25 @@ private:
     TransformOperations m_value;
 };
 
+#if ENABLE(CSS_FILTERS)
+// Used to store one filter value in a keyframe list.
+class FilterAnimationValue : public AnimationValue {
+public:
+    FilterAnimationValue(float keyTime, const FilterOperations* value = 0, PassRefPtr<TimingFunction> timingFunction = 0)
+        : AnimationValue(keyTime, timingFunction)
+    {
+        if (value)
+            m_value = *value;
+    }
+    virtual AnimationValue* clone() const { return new FilterAnimationValue(*this); }
+
+    const FilterOperations* value() const { return &m_value; }
+
+private:
+    FilterOperations m_value;
+};
+#endif
+
 // Used to store a series of values in a keyframe list. Values will all be of the same type,
 // which can be inferred from the property.
 class KeyframeValueList {
@@ -424,6 +443,9 @@ protected:
     // when compositing is not done in hardware. It is not virtual, so the caller
     // needs to notifiy the change to the platform layer as needed.
     void clearFilters() { m_filters.clear(); }
+
+    // Given a KeyframeValueList containing filterOperations, return true if the operations are valid.
+    static int validateFilterOperations(const KeyframeValueList&);
 #endif
 
     // Given a list of TransformAnimationValues, see if all the operations for each keyframe match. If so
diff --git a/Source/WebCore/platform/graphics/GraphicsLayerClient.h b/Source/WebCore/platform/graphics/GraphicsLayerClient.h
index 81272ddbe..4058b65f0 100644
--- a/Source/WebCore/platform/graphics/GraphicsLayerClient.h
+++ b/Source/WebCore/platform/graphics/GraphicsLayerClient.h
@@ -47,7 +47,8 @@ enum AnimatedPropertyID {
     AnimatedPropertyInvalid,
     AnimatedPropertyWebkitTransform,
     AnimatedPropertyOpacity,
-    AnimatedPropertyBackgroundColor
+    AnimatedPropertyBackgroundColor,
+    AnimatedPropertyWebkitFilter
 };
 
 class GraphicsLayerClient {
diff --git a/Source/WebCore/platform/graphics/Icon.h b/Source/WebCore/platform/graphics/Icon.h
index 781a08cb2..b703c7141 100644
--- a/Source/WebCore/platform/graphics/Icon.h
+++ b/Source/WebCore/platform/graphics/Icon.h
@@ -32,7 +32,7 @@ OBJC_CLASS NSImage;
 #elif PLATFORM(WIN)
 typedef struct HICON__* HICON;
 #elif PLATFORM(QT)
-#include <QIcon>
+#include <QImage>
 #elif PLATFORM(GTK)
 typedef struct _GdkPixbuf GdkPixbuf;
 #elif PLATFORM(EFL)
@@ -70,7 +70,7 @@ private:
     HICON m_hIcon;
 #elif PLATFORM(QT)
     Icon();
-    QIcon m_icon;
+    QImage m_image;
 #elif PLATFORM(GTK)
     Icon();
     GdkPixbuf* m_icon;
diff --git a/Source/WebCore/platform/graphics/IntPoint.h b/Source/WebCore/platform/graphics/IntPoint.h
index 8d7fd7ffe..ddc41b423 100644
--- a/Source/WebCore/platform/graphics/IntPoint.h
+++ b/Source/WebCore/platform/graphics/IntPoint.h
@@ -55,6 +55,12 @@ class QPoint;
 QT_END_NAMESPACE
 #elif PLATFORM(GTK)
 typedef struct _GdkPoint GdkPoint;
+#elif PLATFORM(BLACKBERRY)
+namespace BlackBerry {
+namespace Platform {
+class IntPoint;
+}
+}
 #elif PLATFORM(EFL)
 typedef struct _Evas_Point Evas_Point;
 #endif
@@ -136,6 +142,9 @@ public:
 #elif PLATFORM(GTK)
     IntPoint(const GdkPoint&);
     operator GdkPoint() const;
+#elif PLATFORM(BLACKBERRY)
+    IntPoint(const BlackBerry::Platform::IntPoint&);
+    operator BlackBerry::Platform::IntPoint() const;
 #elif PLATFORM(EFL)
     explicit IntPoint(const Evas_Point&);
     operator Evas_Point() const;
diff --git a/Source/WebCore/platform/graphics/IntRect.cpp b/Source/WebCore/platform/graphics/IntRect.cpp
index 9507406d8..03c35e83b 100644
--- a/Source/WebCore/platform/graphics/IntRect.cpp
+++ b/Source/WebCore/platform/graphics/IntRect.cpp
@@ -26,6 +26,7 @@
 #include "config.h"
 #include "IntRect.h"
 
+#include "FractionalLayoutRect.h"
 #include "FloatRect.h"
 #include <algorithm>
 
@@ -40,6 +41,12 @@ IntRect::IntRect(const FloatRect& r)
 {
 }
 
+IntRect::IntRect(const FractionalLayoutRect& r)
+    : m_location(flooredIntPoint(r.location()))
+    , m_size(flooredIntSize(r.size()))
+{
+}
+
 bool IntRect::intersects(const IntRect& other) const
 {
     // Checking emptiness handles negative widths as well as zero.
diff --git a/Source/WebCore/platform/graphics/IntRect.h b/Source/WebCore/platform/graphics/IntRect.h
index 2e2ff0bb9..3ea8229f4 100644
--- a/Source/WebCore/platform/graphics/IntRect.h
+++ b/Source/WebCore/platform/graphics/IntRect.h
@@ -71,6 +71,7 @@ struct SkIRect;
 namespace WebCore {
 
 class FloatRect;
+class FractionalLayoutRect;
 
 class IntRect {
 public:
@@ -80,7 +81,8 @@ public:
     IntRect(int x, int y, int width, int height)
         : m_location(IntPoint(x, y)), m_size(IntSize(width, height)) { }
 
-    explicit IntRect(const FloatRect& rect); // don't do this implicitly since it's lossy
+    explicit IntRect(const FloatRect&); // don't do this implicitly since it's lossy
+    explicit IntRect(const FractionalLayoutRect&); // don't do this implicitly since it's lossy
         
     IntPoint location() const { return m_location; }
     IntSize size() const { return m_size; }
diff --git a/Source/WebCore/platform/graphics/IntSize.h b/Source/WebCore/platform/graphics/IntSize.h
index 625db3ce5..163984766 100644
--- a/Source/WebCore/platform/graphics/IntSize.h
+++ b/Source/WebCore/platform/graphics/IntSize.h
@@ -45,6 +45,12 @@ typedef struct tagSIZE SIZE;
 QT_BEGIN_NAMESPACE
 class QSize;
 QT_END_NAMESPACE
+#elif PLATFORM(BLACKBERRY)
+namespace BlackBerry {
+namespace Platform {
+class IntSize;
+}
+}
 #endif
 
 #if PLATFORM(WX)
@@ -128,6 +134,11 @@ public:
     operator wxSize() const;
 #endif
 
+#if PLATFORM(BLACKBERRY)
+    IntSize(const BlackBerry::Platform::IntSize&);
+    operator BlackBerry::Platform::IntSize() const;
+#endif
+
 private:
     int m_width, m_height;
 };
diff --git a/Source/WebCore/platform/graphics/MediaPlayer.cpp b/Source/WebCore/platform/graphics/MediaPlayer.cpp
index 54d7d7527..9813eeee1 100644
--- a/Source/WebCore/platform/graphics/MediaPlayer.cpp
+++ b/Source/WebCore/platform/graphics/MediaPlayer.cpp
@@ -46,6 +46,7 @@
 
 #if USE(GSTREAMER)
 #include "MediaPlayerPrivateGStreamer.h"
+#define PlatformMediaEngineClassName MediaPlayerPrivateGStreamer
 #endif
 
 #if PLATFORM(MAC) || (PLATFORM(QT) && USE(QTKIT))
@@ -193,10 +194,6 @@ static Vector<MediaPlayerFactory*>& installedMediaEngines()
     if (!enginesQueried) {
         enginesQueried = true;
 
-#if USE(GSTREAMER)
-        MediaPlayerPrivateGStreamer::registerMediaEngine(addMediaEngine);
-#endif
-
 #if USE(AVFOUNDATION)
         if (Settings::isAVFoundationEnabled()) {
 #if PLATFORM(MAC)
@@ -207,7 +204,7 @@ static Vector<MediaPlayerFactory*>& installedMediaEngines()
         }
 #endif
 
-#if !PLATFORM(GTK) && !PLATFORM(EFL) && !(PLATFORM(QT) && USE(GSTREAMER))
+#if defined(PlatformMediaEngineClassName)
         PlatformMediaEngineClassName::registerMediaEngine(addMediaEngine);
 #endif
     }
@@ -931,6 +928,14 @@ AudioSourceProvider* MediaPlayer::audioSourceProvider()
     return m_private->audioSourceProvider();
 }
 #endif // WEB_AUDIO
+    
+String MediaPlayer::referrer() const
+{
+    if (!m_mediaPlayerClient)
+        return String();
+
+    return m_mediaPlayerClient->mediaPlayerReferrer();
+}
 
 }
 
diff --git a/Source/WebCore/platform/graphics/MediaPlayer.h b/Source/WebCore/platform/graphics/MediaPlayer.h
index 26ca3aada..2ccfb72ac 100644
--- a/Source/WebCore/platform/graphics/MediaPlayer.h
+++ b/Source/WebCore/platform/graphics/MediaPlayer.h
@@ -167,6 +167,8 @@ public:
     virtual void mediaPlayerSourceOpened() { }
     virtual String mediaPlayerSourceURL() const { return "x-media-source-unsupported:"; }
 #endif
+
+    virtual String mediaPlayerReferrer() const { return String(); }
 };
 
 class MediaPlayer {
@@ -286,7 +288,6 @@ public:
     void firstVideoFrameAvailable();
     void characteristicChanged();
 
-
     void repaint();
 
     MediaPlayerClient* mediaPlayerClient() const { return m_mediaPlayerClient; }
@@ -334,6 +335,8 @@ public:
     String sourceURL() const;
 #endif
 
+    String referrer() const;
+
 private:
     MediaPlayer(MediaPlayerClient*);
     void loadWithNextMediaEngine(MediaPlayerFactory*);
diff --git a/Source/WebCore/platform/graphics/cairo/OpenGLShims.cpp b/Source/WebCore/platform/graphics/OpenGLShims.cpp
index 2994cd2c9..f59f26c60 100644
--- a/Source/WebCore/platform/graphics/cairo/OpenGLShims.cpp
+++ b/Source/WebCore/platform/graphics/OpenGLShims.cpp
@@ -42,7 +42,11 @@ OpenGLFunctionTable* openGLFunctionTable()
 #if PLATFORM(QT)
 static void* getProcAddress(const char* procName)
 {
+#if QT_VERSION >= QT_VERSION_CHECK(5, 0, 0)
+    return reinterpret_cast<void*>(QOpenGLContext::currentContext()->getProcAddress(procName));
+#else
     return reinterpret_cast<void*>(QGLContext::currentContext()->getProcAddress(QString::fromLatin1(procName)));
+#endif
 }
 #else
 typedef void* (*glGetProcAddressType) (const char* procName);
diff --git a/Source/WebCore/platform/graphics/cairo/OpenGLShims.h b/Source/WebCore/platform/graphics/OpenGLShims.h
index a5c3c7779..1d5f37d9e 100644
--- a/Source/WebCore/platform/graphics/cairo/OpenGLShims.h
+++ b/Source/WebCore/platform/graphics/OpenGLShims.h
@@ -17,8 +17,18 @@
  *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
  */
 
+#ifndef OpenGLShims_h
+#define OpenGLShims_h
+
 #if PLATFORM(QT)
+#include <qglobal.h>
+#if QT_VERSION >= QT_VERSION_CHECK(5, 0, 0)
+#include <qopenglfunctions.h>
+#include <QOpenGLContext>
+#include <QSurface>
+#else
 #include <QGLContext>
+#endif
 #else
 #include <GL/gl.h>
 #endif
@@ -339,3 +349,5 @@ typedef struct _OpenGLFunctionTable {
 #define glVertexAttrib4fv                      LOOKUP_GL_FUNCTION(glVertexAttrib4fv)
 #define glVertexAttribPointer                  LOOKUP_GL_FUNCTION(glVertexAttribPointer)
 #endif
+
+#endif
diff --git a/Source/WebCore/platform/graphics/Region.cpp b/Source/WebCore/platform/graphics/Region.cpp
index 584a3a5fd..789556496 100644
--- a/Source/WebCore/platform/graphics/Region.cpp
+++ b/Source/WebCore/platform/graphics/Region.cpp
@@ -443,6 +443,9 @@ void Region::intersect(const Region& region)
 
 void Region::unite(const Region& region)
 {
+    if (region.isEmpty())
+        return;
+
     Shape unitedShape = Shape::unionShapes(m_shape, region.m_shape);
 
     m_shape.swap(unitedShape);
diff --git a/Source/WebCore/platform/graphics/ShadowBlur.cpp b/Source/WebCore/platform/graphics/ShadowBlur.cpp
index b00231215..0f207f83d 100644
--- a/Source/WebCore/platform/graphics/ShadowBlur.cpp
+++ b/Source/WebCore/platform/graphics/ShadowBlur.cpp
@@ -79,22 +79,32 @@ public:
         // Round to the nearest 32 pixels so we do not grow the buffer for similar sized requests.
         IntSize roundedSize(roundUpToMultipleOf32(size.width()), roundUpToMultipleOf32(size.height()));
 
+        clearScratchBuffer();
         m_imageBuffer = ImageBuffer::create(roundedSize);
         return m_imageBuffer.get();
     }
 
-    void setLastShadowValues(const FloatSize& radius, const Color& color, ColorSpace colorSpace, const FloatRect& shadowRect, const RoundedRect::Radii& radii)
+    bool setCachedShadowValues(const FloatSize& radius, const Color& color, ColorSpace colorSpace, const FloatRect& shadowRect, const RoundedRect::Radii& radii, const FloatSize& layerSize)
     {
+        if (!m_lastWasInset && m_lastRadius == radius && m_lastColor == color && m_lastColorSpace == colorSpace && m_lastShadowRect == shadowRect &&  m_lastRadii == radii && m_lastLayerSize == layerSize)
+            return false;
+
         m_lastWasInset = false;
         m_lastRadius = radius;
         m_lastColor = color;
         m_lastColorSpace = colorSpace;
         m_lastShadowRect = shadowRect;
         m_lastRadii = radii;
+        m_lastLayerSize = layerSize;
+
+        return true;
     }
 
-    void setLastInsetShadowValues(const FloatSize& radius, const Color& color, ColorSpace colorSpace, const FloatRect& bounds, const FloatRect& shadowRect, const RoundedRect::Radii& radii)
+    bool setCachedInsetShadowValues(const FloatSize& radius, const Color& color, ColorSpace colorSpace, const FloatRect& bounds, const FloatRect& shadowRect, const RoundedRect::Radii& radii)
     {
+        if (m_lastWasInset && m_lastRadius == radius && m_lastColor == color && m_lastColorSpace == colorSpace && m_lastInsetBounds == bounds && shadowRect == m_lastShadowRect && radii == m_lastRadii)
+            return false;
+
         m_lastWasInset = true;
         m_lastInsetBounds = bounds;
         m_lastRadius = radius;
@@ -102,20 +112,8 @@ public:
         m_lastColorSpace = colorSpace;
         m_lastShadowRect = shadowRect;
         m_lastRadii = radii;
-    }
-    
-    bool matchesLastShadow(const FloatSize& radius, const Color& color, ColorSpace colorSpace, const FloatRect& shadowRect, const RoundedRect::Radii& radii) const
-    {
-        if (m_lastWasInset)
-            return false;
-        return m_lastRadius == radius && m_lastColor == color && m_lastColorSpace == colorSpace && shadowRect == m_lastShadowRect && radii == m_lastRadii;
-    }
 
-    bool matchesLastInsetShadow(const FloatSize& radius, const Color& color, ColorSpace colorSpace, const FloatRect& bounds, const FloatRect& shadowRect, const RoundedRect::Radii& radii) const
-    {
-        if (!m_lastWasInset)
-            return false;
-        return m_lastRadius == radius && m_lastColor == color && m_lastColorSpace == colorSpace && m_lastInsetBounds == bounds && shadowRect == m_lastShadowRect && radii == m_lastRadii;
+        return true;
     }
 
     void scheduleScratchBufferPurge()
@@ -154,6 +152,7 @@ private:
     ColorSpace m_lastColorSpace;
     FloatSize m_lastRadius;
     bool m_lastWasInset;
+    FloatSize m_lastLayerSize;
     
 #if !ASSERT_DISABLED
     bool m_bufferInUse;
@@ -543,7 +542,10 @@ void ShadowBlur::drawRectShadowWithoutTiling(GraphicsContext* graphicsContext, c
 
     FloatRect bufferRelativeShadowedRect = shadowedRect;
     bufferRelativeShadowedRect.move(m_layerContextTranslation);
-    if (!ScratchBuffer::shared().matchesLastShadow(m_blurRadius, Color::black, ColorSpaceDeviceRGB, bufferRelativeShadowedRect, radii)) {
+
+    // Only redraw in the scratch buffer if its cached contents don't match our needs
+    bool redrawNeeded = ScratchBuffer::shared().setCachedShadowValues(m_blurRadius, Color::black, ColorSpaceDeviceRGB, bufferRelativeShadowedRect, radii, m_layerSize);
+    if (redrawNeeded) {
         GraphicsContext* shadowContext = m_layerImage->context();
         GraphicsContextStateSaver stateSaver(*shadowContext);
 
@@ -560,8 +562,6 @@ void ShadowBlur::drawRectShadowWithoutTiling(GraphicsContext* graphicsContext, c
         }
 
         blurShadowBuffer(expandedIntSize(m_layerSize));
-        
-        ScratchBuffer::shared().setLastShadowValues(m_blurRadius, Color::black, ColorSpaceDeviceRGB, bufferRelativeShadowedRect, radii);
     }
     
     drawShadowBuffer(graphicsContext);
@@ -581,7 +581,9 @@ void ShadowBlur::drawInsetShadowWithoutTiling(GraphicsContext* graphicsContext,
     FloatRect bufferRelativeHoleRect = holeRect;
     bufferRelativeHoleRect.move(m_layerContextTranslation);
 
-    if (!ScratchBuffer::shared().matchesLastInsetShadow(m_blurRadius, Color::black, ColorSpaceDeviceRGB, bufferRelativeRect, bufferRelativeHoleRect, holeRadii)) {
+    // Only redraw in the scratch buffer if its cached contents don't match our needs
+    bool redrawNeeded = ScratchBuffer::shared().setCachedInsetShadowValues(m_blurRadius, Color::black, ColorSpaceDeviceRGB, bufferRelativeRect, bufferRelativeHoleRect, holeRadii);
+    if (redrawNeeded) {
         GraphicsContext* shadowContext = m_layerImage->context();
         GraphicsContextStateSaver stateSaver(*shadowContext);
 
@@ -601,8 +603,6 @@ void ShadowBlur::drawInsetShadowWithoutTiling(GraphicsContext* graphicsContext,
         shadowContext->fillPath(path);
 
         blurShadowBuffer(expandedIntSize(m_layerSize));
-
-        ScratchBuffer::shared().setLastInsetShadowValues(m_blurRadius, Color::black, ColorSpaceDeviceRGB, bufferRelativeRect, bufferRelativeHoleRect, holeRadii);
     }
     
     drawShadowBuffer(graphicsContext);
@@ -652,7 +652,9 @@ void ShadowBlur::drawInsetShadowWithTiling(GraphicsContext* graphicsContext, con
     FloatRect templateBounds(0, 0, templateSize.width(), templateSize.height());
     FloatRect templateHole = FloatRect(edgeSize.width(), edgeSize.height(), templateSize.width() - 2 * edgeSize.width(), templateSize.height() - 2 * edgeSize.height());
 
-    if (!ScratchBuffer::shared().matchesLastInsetShadow(m_blurRadius, m_color, m_colorSpace, templateBounds, templateHole, radii)) {
+    // Only redraw in the scratch buffer if its cached contents don't match our needs
+    bool redrawNeeded = ScratchBuffer::shared().setCachedInsetShadowValues(m_blurRadius, m_color, m_colorSpace, templateBounds, templateHole, radii);
+    if (redrawNeeded) {
         // Draw shadow into a new ImageBuffer.
         GraphicsContext* shadowContext = m_layerImage->context();
         GraphicsContextStateSaver shadowStateSaver(*shadowContext);
@@ -670,8 +672,6 @@ void ShadowBlur::drawInsetShadowWithTiling(GraphicsContext* graphicsContext, con
         shadowContext->fillPath(path);
 
         blurAndColorShadowBuffer(templateSize);
-    
-        ScratchBuffer::shared().setLastInsetShadowValues(m_blurRadius, m_color, m_colorSpace, templateBounds, templateHole, radii);
     }
 
     FloatRect boundingRect = rect;
@@ -710,7 +710,9 @@ void ShadowBlur::drawRectShadowWithTiling(GraphicsContext* graphicsContext, cons
 
     FloatRect templateShadow = FloatRect(edgeSize.width(), edgeSize.height(), templateSize.width() - 2 * edgeSize.width(), templateSize.height() - 2 * edgeSize.height());
 
-    if (!ScratchBuffer::shared().matchesLastShadow(m_blurRadius, m_color, m_colorSpace, templateShadow, radii)) {
+    // Only redraw in the scratch buffer if its cached contents don't match our needs
+    bool redrawNeeded = ScratchBuffer::shared().setCachedShadowValues(m_blurRadius, m_color, m_colorSpace, templateShadow, radii, m_layerSize);
+    if (redrawNeeded) {
         // Draw shadow into the ImageBuffer.
         GraphicsContext* shadowContext = m_layerImage->context();
         GraphicsContextStateSaver shadowStateSaver(*shadowContext);
@@ -727,8 +729,6 @@ void ShadowBlur::drawRectShadowWithTiling(GraphicsContext* graphicsContext, cons
         }
 
         blurAndColorShadowBuffer(templateSize);
-
-        ScratchBuffer::shared().setLastShadowValues(m_blurRadius, m_color, m_colorSpace, templateShadow, radii);
     }
 
     FloatRect shadowBounds = shadowedRect;
@@ -854,7 +854,7 @@ GraphicsContext* ShadowBlur::beginShadowLayer(GraphicsContext *context, const Fl
 
     // We reset the scratch buffer values here, because the buffer will no longer contain
     // data from any previous rectangle or inset shadows drawn via the tiling path.
-    ScratchBuffer::shared().setLastShadowValues(FloatSize(), Color::black, ColorSpaceDeviceRGB, IntRect(), RoundedRect::Radii());
+    ScratchBuffer::shared().setCachedShadowValues(FloatSize(), Color::black, ColorSpaceDeviceRGB, IntRect(), RoundedRect::Radii(), m_layerSize);
     m_layerImage = ScratchBuffer::shared().getScratchBuffer(layerRect.size());
 
     GraphicsContext* shadowContext = m_layerImage->context();
diff --git a/Source/WebCore/platform/graphics/TiledBackingStore.cpp b/Source/WebCore/platform/graphics/TiledBackingStore.cpp
index ceb489e60..acf4c8957 100644
--- a/Source/WebCore/platform/graphics/TiledBackingStore.cpp
+++ b/Source/WebCore/platform/graphics/TiledBackingStore.cpp
@@ -27,8 +27,7 @@
 
 namespace WebCore {
     
-static const int defaultTileWidth = 512;
-static const int defaultTileHeight = 512;
+static const int defaultTileDimension = 512;
 
 static IntPoint innerBottomRight(const IntRect& rect)
 {
@@ -41,15 +40,14 @@ TiledBackingStore::TiledBackingStore(TiledBackingStoreClient* client, PassOwnPtr
     , m_backend(backend)
     , m_tileBufferUpdateTimer(new TileTimer(this, &TiledBackingStore::tileBufferUpdateTimerFired))
     , m_tileCreationTimer(new TileTimer(this, &TiledBackingStore::tileCreationTimerFired))
-    , m_tileSize(defaultTileWidth, defaultTileHeight)
+    , m_tileSize(defaultTileDimension, defaultTileDimension)
     , m_tileCreationDelay(0.01)
-    , m_keepAreaMultiplier(3.5f)
-    , m_coverAreaMultiplier(2.5f)
+    , m_coverAreaMultiplier(2.0f)
     , m_contentsScale(1.f)
     , m_pendingScale(0)
     , m_contentsFrozen(false)
+    , m_supportsAlpha(false)
 {
-    ASSERT(m_coverAreaMultiplier <= m_keepAreaMultiplier);
 }
 
 TiledBackingStore::~TiledBackingStore()
@@ -57,7 +55,7 @@ TiledBackingStore::~TiledBackingStore()
     delete m_tileBufferUpdateTimer;
     delete m_tileCreationTimer;
 }
-    
+
 void TiledBackingStore::setTileSize(const IntSize& size)
 {
     m_tileSize = size;
@@ -70,20 +68,15 @@ void TiledBackingStore::setTileCreationDelay(double delay)
     m_tileCreationDelay = delay;
 }
 
-void TiledBackingStore::setKeepAndCoverAreaMultipliers(float keepMultiplier, float coverMultiplier)
-{
-    ASSERT(coverMultiplier <= keepMultiplier);
-    m_keepAreaMultiplier = keepMultiplier;
-    m_coverAreaMultiplier = coverMultiplier;
-    startTileCreationTimer();
-}
-
-void TiledBackingStore::setVisibleRectTrajectoryVector(const FloatPoint& vector)
+void TiledBackingStore::coverWithTilesIfNeeded(const FloatPoint& panningTrajectoryVector)
 {
-    if (m_visibleRectTrajectoryVector == vector)
+    IntRect visibleRect = visibleContentsRect();
+    if (m_visibleRectTrajectoryVector == panningTrajectoryVector && m_previousVisibleRect == visibleRect)
         return;
 
-    m_visibleRectTrajectoryVector = vector;
+    m_visibleRectTrajectoryVector = panningTrajectoryVector;
+    m_previousVisibleRect = visibleRect;
+
     startTileCreationTimer();
 }
 
@@ -171,17 +164,7 @@ void TiledBackingStore::paint(GraphicsContext* context, const IntRect& rect)
     context->restore();
 }
 
-void TiledBackingStore::adjustVisibleRect()
-{
-    IntRect visibleRect = visibleContentsRect();
-    if (m_previousVisibleRect == visibleRect)
-        return;
-    m_previousVisibleRect = visibleRect;
-
-    startTileCreationTimer();
-}
-
-IntRect TiledBackingStore::visibleContentsRect()
+IntRect TiledBackingStore::visibleContentsRect() const
 {
     return mapFromContents(intersection(m_client->tiledBackingStoreVisibleRect(), m_client->tiledBackingStoreContentsRect()));
 }
@@ -220,7 +203,7 @@ double TiledBackingStore::tileDistance(const IntRect& viewport, const Tile::Coor
 }
 
 // Returns a ratio between 0.0f and 1.0f of the surface of contentsRect covered by rendered tiles.
-float TiledBackingStore::coverageRatio(const WebCore::IntRect& contentsRect)
+float TiledBackingStore::coverageRatio(const WebCore::IntRect& contentsRect) const
 {
     IntRect dirtyRect = mapFromContents(contentsRect);
     float rectArea = dirtyRect.width() * dirtyRect.height();
@@ -242,6 +225,11 @@ float TiledBackingStore::coverageRatio(const WebCore::IntRect& contentsRect)
     return coverArea / rectArea;
 }
 
+bool TiledBackingStore::visibleAreaIsCovered() const
+{
+    return coverageRatio(visibleContentsRect()) == 1.0f;
+}
+
 void TiledBackingStore::createTiles()
 {
     if (m_contentsFrozen)
@@ -256,18 +244,18 @@ void TiledBackingStore::createTiles()
     // Resize tiles on edges in case the contents size has changed.
     bool didResizeTiles = resizeEdgeTiles();
 
-    IntRect keepRect = computeKeepRect(visibleRect);
-    
+    IntRect keepRect;
+    IntRect coverRect;
+    computeCoverAndKeepRect(visibleRect, coverRect, keepRect);
+
     dropTilesOutsideRect(keepRect);
     
-    IntRect coverRect = computeCoverRect(visibleRect);
-    ASSERT(keepRect.contains(coverRect));
-    
     // Search for the tile position closest to the viewport center that does not yet contain a tile. 
     // Which position is considered the closest depends on the tileDistance function.
     double shortestDistance = std::numeric_limits<double>::infinity();
     Vector<Tile::Coordinate> tilesToCreate;
     unsigned requiredTileCount = 0;
+
     Tile::Coordinate topLeft = tileCoordinateForPoint(coverRect.location());
     Tile::Coordinate bottomRight = tileCoordinateForPoint(innerBottomRight(coverRect));
     for (unsigned yCoordinate = topLeft.y(); yCoordinate <= bottomRight.y(); ++yCoordinate) {
@@ -276,7 +264,7 @@ void TiledBackingStore::createTiles()
             if (tileAt(currentCoordinate))
                 continue;
             ++requiredTileCount;
-            // Distance is 0 for all currently visible tiles.
+            // Distance is 0 for all tiles inside the visibleRect.
             double distance = tileDistance(visibleRect, currentCoordinate);
             if (distance > shortestDistance)
                 continue;
@@ -287,60 +275,96 @@ void TiledBackingStore::createTiles()
             tilesToCreate.append(currentCoordinate);
         }
     }
-    
-    // Now construct the tile(s)
+
+    // Now construct the tile(s) within the shortest distance.
     unsigned tilesToCreateCount = tilesToCreate.size();
     for (unsigned n = 0; n < tilesToCreateCount; ++n) {
         Tile::Coordinate coordinate = tilesToCreate[n];
         setTile(coordinate, m_backend->createTile(this, coordinate));
     }
     requiredTileCount -= tilesToCreateCount;
-    
-    // Paint the content of the newly created tiles
+
+    // Paint the content of the newly created tiles.
     if (tilesToCreateCount || didResizeTiles)
         updateTileBuffers();
 
-    // Keep creating tiles until the whole coverRect is covered.
+    // Re-call createTiles on a timer to cover the visible area with the newest shortest distance.
     if (requiredTileCount)
         m_tileCreationTimer->startOneShot(m_tileCreationDelay);
 }
 
-IntRect TiledBackingStore::computeKeepRect(const IntRect& visibleRect) const
-{
-    IntRect result = visibleRect;
-    // Inflates to both sides, so divide the inflate delta by 2.
-    result.inflateX(visibleRect.width() * (m_keepAreaMultiplier - 1) / 2);
-    result.inflateY(visibleRect.height() * (m_keepAreaMultiplier - 1) / 2);
-    result.intersect(contentsRect());
-
-    return result;
-}
-
-// A null trajectory vector means that tiles intersecting all the coverArea (i.e. visibleRect * coverMultiplier) will be created.
-// A non-null trajectory vector will shrink the intersection rect to visibleRect plus its expansion from its
-// center toward the cover area edges in the direction of the given vector.
-// E.g. if visibleRect == (10,10)5x5 and coverMultiplier == 3.0:
-// a (0,0) trajectory vector will create tiles intersecting (5,5)15x15,
-// a (1,0) trajectory vector will create tiles intersecting (10,10)10x5,
-// and a (1,1) trajectory vector will create tiles intersecting (10,10)10x10.
-IntRect TiledBackingStore::computeCoverRect(const IntRect& visibleRect) const
-{
-    IntRect result = visibleRect;
-    float trajectoryVectorNorm = sqrt(pow(m_visibleRectTrajectoryVector.x(), 2) + pow(m_visibleRectTrajectoryVector.y(), 2));
-    if (trajectoryVectorNorm > 0) {
-        // Multiply the vector by the distance to the edge of the cover area.
-        float trajectoryVectorMultiplier = (m_coverAreaMultiplier - 1) / 2;
-        // Unite the visible rect with a "ghost" of the visible rect moved in the direction of the trajectory vector.
-        result.move(result.width() * m_visibleRectTrajectoryVector.x() / trajectoryVectorNorm * trajectoryVectorMultiplier,
-                    result.height() * m_visibleRectTrajectoryVector.y() / trajectoryVectorNorm * trajectoryVectorMultiplier);
-        result.unite(visibleRect);
-    } else {
-        result.inflateX(visibleRect.width() * (m_coverAreaMultiplier - 1) / 2);
-        result.inflateY(visibleRect.height() * (m_coverAreaMultiplier - 1) / 2);
+void TiledBackingStore::adjustForContentsRect(IntRect& rect) const
+{
+    IntRect bounds = contentsRect();
+    IntSize candidateSize = rect.size();
+
+    // We will try to keep the cover and keep rect the same size at all time, which
+    // might not be the case when at the content edges.
+
+    // We start by moving when at the edges.
+    rect.move(std::max(0, bounds.x() - rect.x()), std::max(0, bounds.y() - rect.y()));
+    rect.move(std::min(0, bounds.maxX() - rect.maxX()), std::min(0, bounds.maxY() - rect.maxY()));
+
+    rect.intersect(bounds);
+
+    if (rect.size() == candidateSize)
+        return;
+
+    // Even now we might cover more than the content area so let's inflate in the
+    // opposite directions.
+    int pixelsCovered = candidateSize.width() * candidateSize.height();
+
+    if (rect.width() != candidateSize.width())
+        rect.inflateY(((pixelsCovered / rect.width()) - rect.height()) / 2);
+    if (rect.height() != candidateSize.height())
+        rect.inflateX(((pixelsCovered / rect.height()) - rect.width()) / 2);
+
+    rect.intersect(bounds);
+}
+
+void TiledBackingStore::computeCoverAndKeepRect(const IntRect& visibleRect, IntRect& coverRect, IntRect& keepRect) const
+{
+    coverRect = visibleRect;
+    keepRect = visibleRect;
+
+    // If we cover more that the actual viewport we can be smart about which tiles we choose to render.
+    if (m_coverAreaMultiplier > 1) {
+        // The initial cover area covers equally in each direction, according to the coverAreaMultiplier.
+        coverRect.inflateX(visibleRect.width() * (m_coverAreaMultiplier - 1) / 2);
+        coverRect.inflateY(visibleRect.height() * (m_coverAreaMultiplier - 1) / 2);
+        keepRect = coverRect;
+
+        float trajectoryVectorNorm = sqrt(pow(m_visibleRectTrajectoryVector.x(), 2) + pow(m_visibleRectTrajectoryVector.y(), 2));
+        if (trajectoryVectorNorm) {
+            // A null trajectory vector (no motion) means that tiles for the coverArea will be created.
+            // A non-null trajectory vector will shrink the covered rect to visibleRect plus its expansion from its
+            // center toward the cover area edges in the direction of the given vector.
+
+            // E.g. if visibleRect == (10,10)5x5 and coverAreaMultiplier == 3.0:
+            // a (0,0) trajectory vector will create tiles intersecting (5,5)15x15,
+            // a (1,0) trajectory vector will create tiles intersecting (10,10)10x5,
+            // and a (1,1) trajectory vector will create tiles intersecting (10,10)10x10.
+
+            // Multiply the vector by the distance to the edge of the cover area.
+            float trajectoryVectorMultiplier = (m_coverAreaMultiplier - 1) / 2;
+
+            // Unite the visible rect with a "ghost" of the visible rect moved in the direction of the trajectory vector.
+            coverRect = visibleRect;
+            coverRect.move(coverRect.width() * m_visibleRectTrajectoryVector.x() / trajectoryVectorNorm * trajectoryVectorMultiplier,
+                           coverRect.height() * m_visibleRectTrajectoryVector.y() / trajectoryVectorNorm * trajectoryVectorMultiplier);
+
+            coverRect.unite(visibleRect);
+        }
     }
-    result.intersect(contentsRect());
 
-    return result;
+    ASSERT(keepRect.contains(coverRect));
+
+    // The keep rect is an inflated version of the cover rect, inflated in tile dimensions.
+    keepRect.inflateX(m_tileSize.width() / 2);
+    keepRect.inflateY(m_tileSize.height() / 2);
+
+    adjustForContentsRect(coverRect);
+    adjustForContentsRect(keepRect);
 }
 
 bool TiledBackingStore::resizeEdgeTiles()
@@ -383,6 +407,11 @@ void TiledBackingStore::dropTilesOutsideRect(const IntRect& keepRect)
         removeTile(toRemove[n]);
 }
 
+void TiledBackingStore::removeAllNonVisibleTiles()
+{
+    dropTilesOutsideRect(visibleContentsRect());
+}
+
 PassRefPtr<Tile> TiledBackingStore::tileAt(const Tile::Coordinate& coordinate) const
 {
     return m_tiles.get(coordinate);
@@ -422,9 +451,9 @@ IntRect TiledBackingStore::contentsRect() const
 IntRect TiledBackingStore::tileRectForCoordinate(const Tile::Coordinate& coordinate) const
 {
     IntRect rect(coordinate.x() * m_tileSize.width(),
-        coordinate.y() * m_tileSize.height(),
-        m_tileSize.width(),
-        m_tileSize.height());
+                 coordinate.y() * m_tileSize.height(),
+                 m_tileSize.width(),
+                 m_tileSize.height());
 
     rect.intersect(contentsRect());
     return rect;
@@ -482,6 +511,14 @@ void TiledBackingStore::setContentsFrozen(bool freeze)
     }
 }
 
+void TiledBackingStore::setSupportsAlpha(bool a)
+{
+    if (a == supportsAlpha())
+        return;
+    m_supportsAlpha = a;
+    invalidate(contentsRect());
+}
+
 }
 
 #endif
diff --git a/Source/WebCore/platform/graphics/TiledBackingStore.h b/Source/WebCore/platform/graphics/TiledBackingStore.h
index 0a02ac562..ea5607b16 100644
--- a/Source/WebCore/platform/graphics/TiledBackingStore.h
+++ b/Source/WebCore/platform/graphics/TiledBackingStore.h
@@ -44,33 +44,26 @@ public:
     TiledBackingStore(TiledBackingStoreClient*, PassOwnPtr<TiledBackingStoreBackend> = TiledBackingStoreBackend::create());
     ~TiledBackingStore();
 
-    void adjustVisibleRect();
-    
     TiledBackingStoreClient* client() { return m_client; }
+
+    void coverWithTilesIfNeeded(const FloatPoint& panningTrajectoryVector = FloatPoint());
+
     float contentsScale() { return m_contentsScale; }
     void setContentsScale(float);
-    
+
     bool contentsFrozen() const { return m_contentsFrozen; }
     void setContentsFrozen(bool);
+
     void updateTileBuffers();
 
     void invalidate(const IntRect& dirtyRect);
     void paint(GraphicsContext*, const IntRect&);
-    
+
     IntSize tileSize() { return m_tileSize; }
     void setTileSize(const IntSize&);
-    
+
     double tileCreationDelay() const { return m_tileCreationDelay; }
     void setTileCreationDelay(double delay);
-    
-    // Tiled are dropped outside the keep area, and created for cover area. The values a relative to the viewport size.
-    void getKeepAndCoverAreaMultipliers(float& keepMultiplier, float& coverMultiplier)
-    {
-        keepMultiplier = m_keepAreaMultiplier;
-        coverMultiplier = m_coverAreaMultiplier;
-    }
-    void setKeepAndCoverAreaMultipliers(float keepMultiplier, float coverMultiplier);
-    void setVisibleRectTrajectoryVector(const FloatPoint&);
 
     IntRect mapToContents(const IntRect&) const;
     IntRect mapFromContents(const IntRect&) const;
@@ -78,34 +71,41 @@ public:
     IntRect tileRectForCoordinate(const Tile::Coordinate&) const;
     Tile::Coordinate tileCoordinateForPoint(const IntPoint&) const;
     double tileDistance(const IntRect& viewport, const Tile::Coordinate&) const;
-    float coverageRatio(const WebCore::IntRect& contentsRect);
+
+    bool visibleAreaIsCovered() const;
+    void removeAllNonVisibleTiles();
+
+    void setSupportsAlpha(bool);
+    bool supportsAlpha() const { return m_supportsAlpha; }
 
 private:
     void startTileBufferUpdateTimer();
     void startTileCreationTimer();
-    
+
     typedef Timer<TiledBackingStore> TileTimer;
 
     void tileBufferUpdateTimerFired(TileTimer*);
     void tileCreationTimerFired(TileTimer*);
-    
+
     void createTiles();
-    IntRect computeKeepRect(const IntRect& visibleRect) const;
-    IntRect computeCoverRect(const IntRect& visibleRect) const;
-    
+    void computeCoverAndKeepRect(const IntRect& visibleRect, IntRect& coverRect, IntRect& keepRect) const;
+
     void commitScaleChange();
 
     bool resizeEdgeTiles();
     void dropTilesOutsideRect(const IntRect&);
-    
+
     PassRefPtr<Tile> tileAt(const Tile::Coordinate&) const;
     void setTile(const Tile::Coordinate& coordinate, PassRefPtr<Tile> tile);
     void removeTile(const Tile::Coordinate& coordinate);
 
     IntRect contentsRect() const;
-    
+    IntRect visibleContentsRect() const;
+
+    float coverageRatio(const IntRect&) const;
+    void adjustForContentsRect(IntRect&) const;
+
     void paintCheckerPattern(GraphicsContext*, const IntRect&, const Tile::Coordinate&);
-    IntRect visibleContentsRect();
 
 private:
     TiledBackingStoreClient* m_client;
@@ -119,7 +119,6 @@ private:
 
     IntSize m_tileSize;
     double m_tileCreationDelay;
-    float m_keepAreaMultiplier;
     float m_coverAreaMultiplier;
     FloatPoint m_visibleRectTrajectoryVector;
     
@@ -128,6 +127,7 @@ private:
     float m_pendingScale;
 
     bool m_contentsFrozen;
+    bool m_supportsAlpha;
 
     friend class Tile;
 };
diff --git a/Source/WebCore/platform/graphics/avfoundation/MediaPlayerPrivateAVFoundation.h b/Source/WebCore/platform/graphics/avfoundation/MediaPlayerPrivateAVFoundation.h
index b49791e24..72302346f 100644
--- a/Source/WebCore/platform/graphics/avfoundation/MediaPlayerPrivateAVFoundation.h
+++ b/Source/WebCore/platform/graphics/avfoundation/MediaPlayerPrivateAVFoundation.h
@@ -242,6 +242,8 @@ protected:
 
     const String& assetURL() const { return m_assetURL; }
 
+    MediaPlayer* player() { return m_player; }
+
 private:
     MediaPlayer* m_player;
 
diff --git a/Source/WebCore/platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.mm b/Source/WebCore/platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.mm
index bd28dd33b..0b30b2ec9 100644
--- a/Source/WebCore/platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.mm
+++ b/Source/WebCore/platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.mm
@@ -256,11 +256,21 @@ void MediaPlayerPrivateAVFoundationObjC::createAVAssetForURL(const String& url)
 
     setDelayCallbacks(true);
 
-    NSDictionary *options = [NSDictionary dictionaryWithObjectsAndKeys:
-                        [NSNumber numberWithInt:AVAssetReferenceRestrictionForbidRemoteReferenceToLocal | AVAssetReferenceRestrictionForbidLocalReferenceToRemote], AVURLAssetReferenceRestrictionsKey, 
-                        nil];
+    RetainPtr<NSMutableDictionary> options(AdoptNS, [[NSMutableDictionary alloc] init]);    
+
+    [options.get() setObject:[NSNumber numberWithInt:AVAssetReferenceRestrictionForbidRemoteReferenceToLocal | AVAssetReferenceRestrictionForbidLocalReferenceToRemote] forKey:AVURLAssetReferenceRestrictionsKey];
+
+#if !defined(BUILDING_ON_SNOW_LEOPARD) && !defined(BUILDING_ON_LION)
+    String referrer = player()->referrer();
+    if (!referrer.isEmpty()) {
+        RetainPtr<NSMutableDictionary> headerFields(AdoptNS, [[NSMutableDictionary alloc] init]);
+        [headerFields.get() setObject:referrer forKey:@"Referer"];
+        [options.get() setObject:headerFields.get() forKey:@"AVURLAssetHTTPHeaderFieldsKey"];
+    }
+#endif
+
     NSURL *cocoaURL = KURL(ParsedURLString, url);
-    m_avAsset.adoptNS([[AVURLAsset alloc] initWithURL:cocoaURL options:options]);
+    m_avAsset.adoptNS([[AVURLAsset alloc] initWithURL:cocoaURL options:options.get()]);
 
     m_haveCheckedPlayability = false;
 
diff --git a/Source/WebCore/platform/graphics/blackberry/FloatPointBlackBerry.cpp b/Source/WebCore/platform/graphics/blackberry/FloatPointBlackBerry.cpp
new file mode 100644
index 000000000..3dca04325
--- /dev/null
+++ b/Source/WebCore/platform/graphics/blackberry/FloatPointBlackBerry.cpp
@@ -0,0 +1,37 @@
+/*
+ * Copyright (C) 2011 Research In Motion Limited. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+#include "config.h"
+#include "FloatPoint.h"
+
+#include <BlackBerryPlatformPrimitives.h>
+
+namespace WebCore {
+
+FloatPoint::FloatPoint(const BlackBerry::Platform::FloatPoint& p)
+    : m_x(p.x())
+    , m_y(p.y())
+{
+}
+
+FloatPoint::operator BlackBerry::Platform::FloatPoint() const
+{
+    return BlackBerry::Platform::FloatPoint(m_x, m_y);
+}
+
+} // namespace WebCore
diff --git a/Source/WebCore/platform/graphics/blackberry/FloatRectBlackBerry.cpp b/Source/WebCore/platform/graphics/blackberry/FloatRectBlackBerry.cpp
new file mode 100644
index 000000000..d41139720
--- /dev/null
+++ b/Source/WebCore/platform/graphics/blackberry/FloatRectBlackBerry.cpp
@@ -0,0 +1,37 @@
+/*
+ * Copyright (C) 2011 Research In Motion Limited. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+#include "config.h"
+#include "FloatRect.h"
+
+#include <BlackBerryPlatformPrimitives.h>
+
+namespace WebCore {
+
+FloatRect::FloatRect(const BlackBerry::Platform::FloatRect& rect)
+    : m_location(rect.x(), rect.y())
+    , m_size(rect.width(), rect.height())
+{
+}
+
+FloatRect::operator BlackBerry::Platform::FloatRect() const
+{
+    return BlackBerry::Platform::FloatRect(x(), y(), width(), height());
+}
+
+} // namespace WebCore
diff --git a/Source/WebCore/platform/graphics/blackberry/FloatSizeBlackBerry.cpp b/Source/WebCore/platform/graphics/blackberry/FloatSizeBlackBerry.cpp
new file mode 100644
index 000000000..c2bd9e81c
--- /dev/null
+++ b/Source/WebCore/platform/graphics/blackberry/FloatSizeBlackBerry.cpp
@@ -0,0 +1,37 @@
+/*
+ * Copyright (C) 2011 Research In Motion Limited. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+#include "config.h"
+#include "FloatSize.h"
+
+#include <BlackBerryPlatformPrimitives.h>
+
+namespace WebCore {
+
+FloatSize::FloatSize(const BlackBerry::Platform::FloatSize& size)
+    : m_width(size.width())
+    , m_height(size.height())
+{
+}
+
+FloatSize::operator BlackBerry::Platform::FloatSize() const
+{
+    return BlackBerry::Platform::FloatSize(m_width, m_height);
+}
+
+} // namespace WebCore
diff --git a/Source/WebCore/platform/graphics/blackberry/IconBlackBerry.cpp b/Source/WebCore/platform/graphics/blackberry/IconBlackBerry.cpp
new file mode 100644
index 000000000..93a4b0faa
--- /dev/null
+++ b/Source/WebCore/platform/graphics/blackberry/IconBlackBerry.cpp
@@ -0,0 +1,46 @@
+/*
+ * Copyright (C) 2011 Research In Motion Limited. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+#include "config.h"
+#include "Icon.h"
+
+#include "GraphicsContext.h"
+#include "IntRect.h"
+#include "NotImplemented.h"
+#include "PlatformString.h"
+
+namespace WebCore {
+
+Icon::~Icon()
+{
+    notImplemented();
+}
+
+void Icon::paint(GraphicsContext*, IntRect const&)
+{
+    notImplemented();
+}
+
+PassRefPtr<Icon> Icon::createIconForFiles(const Vector<String>&)
+{
+    // FIXME: remove 0 template param when this is implemented
+    notImplemented();
+    return 0;
+}
+
+} // namespace WebCore
diff --git a/Source/WebCore/platform/graphics/blackberry/ImageBlackBerry.cpp b/Source/WebCore/platform/graphics/blackberry/ImageBlackBerry.cpp
new file mode 100644
index 000000000..7a80d98c7
--- /dev/null
+++ b/Source/WebCore/platform/graphics/blackberry/ImageBlackBerry.cpp
@@ -0,0 +1,74 @@
+/*
+ * Copyright (C) 2010, 2011, 2012 Research In Motion Limited. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+#include "config.h"
+#include "Image.h"
+
+#include "BitmapImage.h"
+#include "ImageBuffer.h"
+#include "SharedBuffer.h"
+
+namespace WebCore {
+
+PassRefPtr<Image> Image::loadPlatformResource(const char *name)
+{
+    if (!strcmp(name, "searchCancel") || !strcmp(name, "searchCancelPressed")) {
+        OwnPtr<ImageBuffer> imageBuffer = ImageBuffer::create(IntSize(16, 16));
+        if (!imageBuffer)
+            return 0;
+
+        // Draw a more subtle, gray x-shaped icon.
+        GraphicsContext* context = imageBuffer->context();
+        context->save();
+
+        context->fillRect(FloatRect(0, 0, 16, 16), Color::white, ColorSpaceDeviceRGB);
+
+        if (!strcmp(name, "searchCancel"))
+            context->setFillColor(Color(128, 128, 128), ColorSpaceDeviceRGB);
+        else
+            context->setFillColor(Color(64, 64, 64), ColorSpaceDeviceRGB);
+
+        context->translate(8, 8);
+
+        context->rotate(piDouble / 4.0);
+        context->fillRect(FloatRect(-1, -7, 2, 14));
+
+        context->rotate(-piDouble / 2.0);
+        context->fillRect(FloatRect(-1, -7, 2, 14));
+
+        context->restore();
+        return imageBuffer->copyImage();
+    }
+
+    // RESOURCE_PATH is set by CMake in OptionsBlackBerry.cmake
+    String fullPath(RESOURCE_PATH);
+    String extension(".png");
+
+    fullPath += name;
+    fullPath += extension;
+
+    RefPtr<SharedBuffer> buffer = SharedBuffer::createWithContentsOfFile(fullPath);
+    if (!buffer)
+        return BitmapImage::nullImage();
+
+    RefPtr<BitmapImage> img = BitmapImage::create();
+    img->setData(buffer.release(), true /* allDataReceived */);
+    return img.release();
+}
+
+} // namespace WebCore
diff --git a/Source/WebCore/platform/graphics/blackberry/IntPointBlackBerry.cpp b/Source/WebCore/platform/graphics/blackberry/IntPointBlackBerry.cpp
new file mode 100644
index 000000000..4f60a053e
--- /dev/null
+++ b/Source/WebCore/platform/graphics/blackberry/IntPointBlackBerry.cpp
@@ -0,0 +1,37 @@
+/*
+ * Copyright (C) 2010, 2011 Research In Motion Limited. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+#include "config.h"
+#include "IntPoint.h"
+
+#include <BlackBerryPlatformPrimitives.h>
+
+namespace WebCore {
+
+IntPoint::IntPoint(const BlackBerry::Platform::IntPoint& p)
+    : m_x(p.x())
+    , m_y(p.y())
+{
+}
+
+IntPoint::operator BlackBerry::Platform::IntPoint() const
+{
+    return BlackBerry::Platform::IntPoint(m_x, m_y);
+}
+
+} // namespace WebCore
diff --git a/Source/WebCore/platform/graphics/blackberry/IntRectBlackBerry.cpp b/Source/WebCore/platform/graphics/blackberry/IntRectBlackBerry.cpp
new file mode 100644
index 000000000..979ceaf6d
--- /dev/null
+++ b/Source/WebCore/platform/graphics/blackberry/IntRectBlackBerry.cpp
@@ -0,0 +1,36 @@
+/*
+ * Copyright (C) 2010, 2011 Research In Motion Limited. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+#include "config.h"
+#include "IntRect.h"
+
+#include <BlackBerryPlatformPrimitives.h>
+
+namespace WebCore {
+
+IntRect::IntRect(const BlackBerry::Platform::IntRect& rect)
+        : m_location(rect.x(), rect.y()), m_size(rect.width(), rect.height())
+{
+}
+
+IntRect::operator BlackBerry::Platform::IntRect() const
+{
+    return BlackBerry::Platform::IntRect(x(), y(), width(), height());
+}
+
+} // namespace WebCore
diff --git a/Source/WebCore/platform/graphics/blackberry/IntSizeBlackBerry.cpp b/Source/WebCore/platform/graphics/blackberry/IntSizeBlackBerry.cpp
new file mode 100644
index 000000000..f1b678da1
--- /dev/null
+++ b/Source/WebCore/platform/graphics/blackberry/IntSizeBlackBerry.cpp
@@ -0,0 +1,37 @@
+/*
+ * Copyright (C) 2010, 2011 Research In Motion Limited. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+#include "config.h"
+#include "IntSize.h"
+
+#include <BlackBerryPlatformPrimitives.h>
+
+namespace WebCore {
+
+IntSize::IntSize(const BlackBerry::Platform::IntSize& size)
+    : m_width(size.width())
+    , m_height(size.height())
+{
+}
+
+IntSize::operator BlackBerry::Platform::IntSize() const
+{
+    return BlackBerry::Platform::IntSize(m_width, m_height);
+}
+
+} // namespace WebCore
diff --git a/Source/WebCore/platform/graphics/blackberry/skia/ImageBufferData.h b/Source/WebCore/platform/graphics/blackberry/skia/ImageBufferData.h
new file mode 100644
index 000000000..409197ea6
--- /dev/null
+++ b/Source/WebCore/platform/graphics/blackberry/skia/ImageBufferData.h
@@ -0,0 +1,53 @@
+/*
+ * Copyright (c) 2008, 2009, Google Inc. All rights reserved.
+ * Copyright (c) 2011, Research In Motion. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef ImageBufferData_h
+#define ImageBufferData_h
+
+#include "BlackBerryPlatformGraphics.h"
+#include "PlatformContextSkia.h"
+
+#include "skia/ext/platform_canvas.h"
+
+namespace WebCore {
+
+class ImageBufferData {
+public:
+    ImageBufferData(const IntSize&);
+
+    OwnPtr<SkCanvas> m_canvas;
+    PlatformContextSkia m_platformContext;
+    BlackBerry::Platform::Graphics::Buffer* m_buffer;
+};
+
+} // namespace WebCore
+
+#endif // ImageBufferData_h
diff --git a/Source/WebCore/platform/graphics/blackberry/skia/PlatformSupport.cpp b/Source/WebCore/platform/graphics/blackberry/skia/PlatformSupport.cpp
new file mode 100644
index 000000000..408fe453b
--- /dev/null
+++ b/Source/WebCore/platform/graphics/blackberry/skia/PlatformSupport.cpp
@@ -0,0 +1,214 @@
+/*
+ * Copyright (c) 2009-2010, Google Inc. All rights reserved.
+ * Copyright (c) 2011, Research In Motion. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "PlatformSupport.h"
+
+#include "FontRenderStyle.h"
+
+#include <fontconfig/fontconfig.h>
+#include <string.h>
+#include <unicode/utf16.h>
+#include <wtf/text/CString.h>
+
+namespace WebCore {
+
+static void setFontRenderStyleDefaults(FontRenderStyle* style)
+{
+    style->useBitmaps = 2;
+    style->useAutoHint = 2;
+    style->useHinting = 2;
+    style->hintStyle = 0;
+    style->useAntiAlias = 2;
+    style->useSubpixel = 2;
+}
+
+void PlatformSupport::getRenderStyleForStrike(const char* family, int sizeAndStyle, FontRenderStyle* out)
+{
+    bool isBold = sizeAndStyle & 1;
+    bool isItalic = sizeAndStyle & 2;
+    int pixelSize = sizeAndStyle >> 2;
+
+    FcPattern* pattern = FcPatternCreate();
+    FcValue fcvalue;
+
+    fcvalue.type = FcTypeString;
+    fcvalue.u.s = reinterpret_cast<const FcChar8 *>(family);
+    FcPatternAdd(pattern, FC_FAMILY, fcvalue, FcFalse);
+
+    fcvalue.type = FcTypeInteger;
+    fcvalue.u.i = isBold ? FC_WEIGHT_BOLD : FC_WEIGHT_NORMAL;
+    FcPatternAdd(pattern, FC_WEIGHT, fcvalue, FcFalse);
+
+    fcvalue.type = FcTypeInteger;
+    fcvalue.u.i = isItalic ? FC_SLANT_ITALIC : FC_SLANT_ROMAN;
+    FcPatternAdd(pattern, FC_SLANT, fcvalue, FcFalse);
+
+    fcvalue.type = FcTypeBool;
+    fcvalue.u.b = FcTrue;
+    FcPatternAdd(pattern, FC_SCALABLE, fcvalue, FcFalse);
+
+    fcvalue.type = FcTypeDouble;
+    fcvalue.u.d = pixelSize;
+    FcPatternAdd(pattern, FC_SIZE, fcvalue, FcFalse);
+
+    FcConfigSubstitute(0, pattern, FcMatchPattern);
+    FcDefaultSubstitute(pattern);
+
+    FcResult result;
+    // Some versions of fontconfig don't actually write a value into result.
+    // However, it's not clear from the documentation if result should be a
+    // non-0 pointer: future versions might expect to be able to write to
+    // it. So we pass in a valid pointer and ignore it.
+    FcPattern* match = FcFontMatch(0, pattern, &result);
+    FcPatternDestroy(pattern);
+
+    setFontRenderStyleDefaults(out);
+
+    if (!match)
+        return;
+
+    FcBool boolValue;
+    int intValue;
+
+    if (FcPatternGetBool(match, FC_ANTIALIAS, 0, &boolValue) == FcResultMatch)
+        out->useAntiAlias = boolValue;
+    if (FcPatternGetBool(match, FC_EMBEDDED_BITMAP, 0, &boolValue) == FcResultMatch)
+        out->useBitmaps = boolValue;
+    if (FcPatternGetBool(match, FC_AUTOHINT, 0, &boolValue) == FcResultMatch)
+        out->useAutoHint = boolValue;
+    if (FcPatternGetBool(match, FC_HINTING, 0, &boolValue) == FcResultMatch)
+        out->useHinting = boolValue;
+
+    if (FcPatternGetInteger(match, FC_RGBA, 0, &intValue) == FcResultMatch) {
+        switch (intValue) {
+        case FC_RGBA_NONE:
+            out->useSubpixel = 0;
+            break;
+        case FC_RGBA_RGB:
+        case FC_RGBA_BGR:
+        case FC_RGBA_VRGB:
+        case FC_RGBA_VBGR:
+            out->useSubpixel = 1;
+            break;
+        default:
+            // This includes FC_RGBA_UNKNOWN.
+            out->useSubpixel = 2;
+            break;
+        }
+    }
+
+    FcPatternDestroy(match);
+}
+
+void PlatformSupport::getFontFamilyForCharacters(const UChar* characters, size_t numCharacters, const char*, FontFamily* family)
+{
+    FcCharSet* cset = FcCharSetCreate();
+    for (size_t i = 0; i < numCharacters; ++i) {
+        if (U16_IS_SURROGATE(characters[i])
+            && U16_IS_SURROGATE_LEAD(characters[i])
+            && i != numCharacters - 1
+            && U16_IS_TRAIL(characters[i + 1])) {
+            FcCharSetAddChar(cset, U16_GET_SUPPLEMENTARY(characters[i], characters[i+1]));
+            i++;
+        } else
+              FcCharSetAddChar(cset, characters[i]);
+    }
+    FcPattern* pattern = FcPatternCreate();
+
+    FcValue fcvalue;
+    fcvalue.type = FcTypeCharSet;
+    fcvalue.u.c = cset;
+    FcPatternAdd(pattern, FC_CHARSET, fcvalue, FcFalse);
+
+    fcvalue.type = FcTypeBool;
+    fcvalue.u.b = FcTrue;
+    FcPatternAdd(pattern, FC_SCALABLE, fcvalue, FcFalse);
+
+    FcConfigSubstitute(0, pattern, FcMatchPattern);
+    FcDefaultSubstitute(pattern);
+
+    FcResult result;
+    FcFontSet* fontSet = FcFontSort(0, pattern, 0, 0, &result);
+    FcPatternDestroy(pattern);
+    FcCharSetDestroy(cset);
+
+    if (!fontSet) {
+        family->name = String();
+        family->isBold = false;
+        family->isItalic = false;
+        return;
+    }
+
+    // Older versions of fontconfig have a bug where they cannot select
+    // only scalable fonts so we have to manually filter the results.
+    for (int i = 0; i < fontSet->nfont; ++i) {
+        FcPattern* current = fontSet->fonts[i];
+        FcBool isScalable;
+
+        if (FcPatternGetBool(current, FC_SCALABLE, 0, &isScalable) != FcResultMatch
+            || !isScalable)
+            continue;
+
+        // fontconfig can also return fonts which are unreadable
+        FcChar8* cFilename;
+        if (FcPatternGetString(current, FC_FILE, 0, &cFilename) != FcResultMatch)
+            continue;
+
+        if (access(reinterpret_cast<char*>(cFilename), R_OK))
+            continue;
+
+        FcChar8* familyName;
+        if (FcPatternGetString(current, FC_FAMILY, 0, &familyName) == FcResultMatch) {
+            const char* charFamily = reinterpret_cast<char*>(familyName);
+            family->name = String::fromUTF8(charFamily, strlen(charFamily));
+        }
+
+        int weight;
+        if (FcPatternGetInteger(current, FC_WEIGHT, 0, &weight) == FcResultMatch)
+            family->isBold = weight >= FC_WEIGHT_BOLD;
+        else
+            family->isBold = false;
+
+        int slant;
+        if (FcPatternGetInteger(current, FC_SLANT, 0, &slant) == FcResultMatch)
+            family->isItalic = slant != FC_SLANT_ROMAN;
+        else
+            family->isItalic = false;
+
+        FcFontSetDestroy(fontSet);
+        return;
+    }
+
+    FcFontSetDestroy(fontSet);
+}
+
+}; // namespace WebCore
diff --git a/Source/WebCore/platform/graphics/blackberry/skia/PlatformSupport.h b/Source/WebCore/platform/graphics/blackberry/skia/PlatformSupport.h
new file mode 100644
index 000000000..bd22d86d7
--- /dev/null
+++ b/Source/WebCore/platform/graphics/blackberry/skia/PlatformSupport.h
@@ -0,0 +1,55 @@
+/*
+ * Copyright (c) 2010, Google Inc. All rights reserved.
+ * Copyright (c) 2011, Research In Motion. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef PlatformSupport_h
+#define PlatformSupport_h
+
+#include "PlatformString.h"
+
+namespace WebCore {
+
+struct FontRenderStyle;
+
+// This is a minimal version of the Chromium PlatformSupport/WebFontInfo classes used for font support.
+class PlatformSupport {
+public:
+    static void getRenderStyleForStrike(const char* family, int sizeAndStyle, FontRenderStyle* result);
+    struct FontFamily {
+        String name;
+        bool isBold;
+        bool isItalic;
+    };
+    static void getFontFamilyForCharacters(const UChar*, size_t numCharacters, const char* preferredLocale, FontFamily*);
+};
+
+} // namespace WebCore
+
+#endif
diff --git a/Source/WebCore/platform/graphics/ca/GraphicsLayerCA.cpp b/Source/WebCore/platform/graphics/ca/GraphicsLayerCA.cpp
index ad3ac04a2..f6e714b2a 100644
--- a/Source/WebCore/platform/graphics/ca/GraphicsLayerCA.cpp
+++ b/Source/WebCore/platform/graphics/ca/GraphicsLayerCA.cpp
@@ -211,6 +211,12 @@ static String propertyIdToString(AnimatedPropertyID property)
         return "opacity";
     case AnimatedPropertyBackgroundColor:
         return "backgroundColor";
+    case AnimatedPropertyWebkitFilter:
+#if ENABLE(CSS_FILTERS)
+        return "filters";
+#else
+        ASSERT_NOT_REACHED();
+#endif
     case AnimatedPropertyInvalid:
         ASSERT_NOT_REACHED();
     }
@@ -444,7 +450,7 @@ void GraphicsLayerCA::moveOrCopyLayerAnimation(MoveOrCopy operation, const Strin
     }
 }
 
-void GraphicsLayerCA::moveOrCopyAnimationsForProperty(MoveOrCopy operation, AnimatedPropertyID property, PlatformCALayer *fromLayer, PlatformCALayer *toLayer)
+void GraphicsLayerCA::moveOrCopyAnimations(MoveOrCopy operation, PlatformCALayer *fromLayer, PlatformCALayer *toLayer)
 {
     // Look for running animations affecting this property.
     AnimationsMap::const_iterator end = m_runningAnimations.end();
@@ -453,7 +459,13 @@ void GraphicsLayerCA::moveOrCopyAnimationsForProperty(MoveOrCopy operation, Anim
         size_t numAnimations = propertyAnimations.size();
         for (size_t i = 0; i < numAnimations; ++i) {
             const LayerPropertyAnimation& currAnimation = propertyAnimations[i];
-            if (currAnimation.m_property == property)
+            
+            if (currAnimation.m_property == AnimatedPropertyWebkitTransform || currAnimation.m_property == AnimatedPropertyOpacity
+                    || currAnimation.m_property == AnimatedPropertyBackgroundColor
+#if ENABLE(CSS_FILTERS)
+                    || currAnimation.m_property == AnimatedPropertyWebkitFilter
+#endif
+                )
                 moveOrCopyLayerAnimation(operation, animationIdentifier(currAnimation.m_name, currAnimation.m_property, currAnimation.m_index), fromLayer, toLayer);
         }
     }
@@ -648,6 +660,10 @@ bool GraphicsLayerCA::addAnimation(const KeyframeValueList& valueList, const Int
     bool createdAnimations = false;
     if (valueList.property() == AnimatedPropertyWebkitTransform)
         createdAnimations = createTransformAnimationsFromKeyframes(valueList, anim, animationName, timeOffset, boxSize);
+#if ENABLE(CSS_FILTERS)
+    else if (valueList.property() == AnimatedPropertyWebkitFilter)
+        createdAnimations = createFilterAnimationsFromKeyframes(valueList, anim, animationName, timeOffset);
+#endif
     else
         createdAnimations = createAnimationFromKeyframes(valueList, anim, animationName, timeOffset);
 
@@ -1299,8 +1315,7 @@ void GraphicsLayerCA::ensureStructuralLayer(StructuralLayerPurpose purpose, floa
             ASSERT(m_structuralLayer->superlayer());
             m_structuralLayer->superlayer()->replaceSublayer(m_structuralLayer.get(), m_layer.get());
 
-            moveOrCopyAnimationsForProperty(Move, AnimatedPropertyWebkitTransform, m_structuralLayer.get(), m_layer.get());
-            moveOrCopyAnimationsForProperty(Move, AnimatedPropertyOpacity, m_structuralLayer.get(), m_layer.get());
+            moveOrCopyAnimations(Move, m_structuralLayer.get(), m_layer.get());
 
             // Release the structural layer.
             m_structuralLayer = 0;
@@ -1380,8 +1395,7 @@ void GraphicsLayerCA::ensureStructuralLayer(StructuralLayerPurpose purpose, floa
     m_layer->superlayer()->replaceSublayer(m_layer.get(), m_structuralLayer.get());
     m_structuralLayer->appendSublayer(m_layer.get());
 
-    moveOrCopyAnimationsForProperty(Move, AnimatedPropertyWebkitTransform, m_layer.get(), m_structuralLayer.get());
-    moveOrCopyAnimationsForProperty(Move, AnimatedPropertyOpacity, m_layer.get(), m_structuralLayer.get());
+    moveOrCopyAnimations(Move, m_layer.get(), m_structuralLayer.get());
     
     updateSublayerList();
     updateOpacityOnLayer();
@@ -1424,6 +1438,11 @@ void GraphicsLayerCA::updateAcceleratesDrawing()
     
 void GraphicsLayerCA::updateLayerBackgroundColor()
 {
+    if (m_layer->layerType() == PlatformCALayer::LayerTypeTileCacheLayer) {
+        m_layer->setBackgroundColor(m_backgroundColor);
+        return;
+    }
+
     if (!m_contentsLayer)
         return;
 
@@ -1744,7 +1763,7 @@ void GraphicsLayerCA::updateContentsNeedsDisplay()
 
 bool GraphicsLayerCA::createAnimationFromKeyframes(const KeyframeValueList& valueList, const Animation* animation, const String& animationName, double timeOffset)
 {
-    ASSERT(valueList.property() != AnimatedPropertyWebkitTransform);
+    ASSERT(valueList.property() != AnimatedPropertyWebkitTransform && valueList.property() != AnimatedPropertyWebkitFilter);
     
     bool isKeyframe = valueList.size() > 2;
     bool valuesOK;
@@ -1755,10 +1774,10 @@ bool GraphicsLayerCA::createAnimationFromKeyframes(const KeyframeValueList& valu
     RefPtr<PlatformCAAnimation> caAnimation;
     
     if (isKeyframe) {
-        caAnimation = createKeyframeAnimation(animation, valueList.property(), additive);
+        caAnimation = createKeyframeAnimation(animation, propertyIdToString(valueList.property()), additive);
         valuesOK = setAnimationKeyframes(valueList, animation, caAnimation.get());
     } else {
-        caAnimation = createBasicAnimation(animation, valueList.property(), additive);
+        caAnimation = createBasicAnimation(animation, propertyIdToString(valueList.property()), additive);
         valuesOK = setAnimationEndpoints(valueList, animation, caAnimation.get());
     }
     
@@ -1779,10 +1798,10 @@ bool GraphicsLayerCA::appendToUncommittedAnimations(const KeyframeValueList& val
     RefPtr<PlatformCAAnimation> caAnimation;
     bool validMatrices = true;
     if (isKeyframe) {
-        caAnimation = createKeyframeAnimation(animation, valueList.property(), additive);
+        caAnimation = createKeyframeAnimation(animation, propertyIdToString(valueList.property()), additive);
         validMatrices = setTransformAnimationKeyframes(valueList, animation, caAnimation.get(), animationIndex, transformOp, isMatrixAnimation, boxSize);
     } else {
-        caAnimation = createBasicAnimation(animation, valueList.property(), additive);
+        caAnimation = createBasicAnimation(animation, propertyIdToString(valueList.property()), additive);
         validMatrices = setTransformAnimationEndpoints(valueList, animation, caAnimation.get(), animationIndex, transformOp, isMatrixAnimation, boxSize);
     }
     
@@ -1845,16 +1864,79 @@ bool GraphicsLayerCA::createTransformAnimationsFromKeyframes(const KeyframeValue
     return validMatrices;
 }
 
-PassRefPtr<PlatformCAAnimation> GraphicsLayerCA::createBasicAnimation(const Animation* anim, AnimatedPropertyID property, bool additive)
+#if ENABLE(CSS_FILTERS)
+bool GraphicsLayerCA::appendToUncommittedAnimations(const KeyframeValueList& valueList, const FilterOperation* operation, const Animation* animation, const String& animationName, int animationIndex, double timeOffset)
+{
+    bool isKeyframe = valueList.size() > 2;
+    
+    FilterOperation::OperationType filterOp = operation->getOperationType();
+    int numAnimatedProperties = PlatformCAAnimation::numAnimatedFilterProperties(filterOp);
+    
+    // Each filter might need to animate multiple properties, each with their own keyPath. The keyPath is always of the form:
+    //
+    //      filter.filter_<animationIndex>.<filterPropertyName>
+    //
+    // PlatformCAAnimation tells us how many properties each filter has and we iterate that many times and create an animation
+    // for each. This internalFilterPropertyIndex gets passed to PlatformCAAnimation so it can properly create the property animation
+    // values.
+    for (int internalFilterPropertyIndex = 0; internalFilterPropertyIndex < numAnimatedProperties; ++internalFilterPropertyIndex) {
+        bool valuesOK;
+        RefPtr<PlatformCAAnimation> caAnimation;
+        String keyPath = String::format("filters.filter_%d.%s", animationIndex, PlatformCAAnimation::animatedFilterPropertyName(filterOp, internalFilterPropertyIndex));
+        
+        if (isKeyframe) {
+            caAnimation = createKeyframeAnimation(animation, keyPath, false);
+            valuesOK = setFilterAnimationKeyframes(valueList, animation, caAnimation.get(), animationIndex, internalFilterPropertyIndex, filterOp);
+        } else {
+            caAnimation = createBasicAnimation(animation, keyPath, false);
+            valuesOK = setFilterAnimationEndpoints(valueList, animation, caAnimation.get(), animationIndex, internalFilterPropertyIndex);
+        }
+        
+        ASSERT(valuesOK);
+
+        m_uncomittedAnimations.append(LayerPropertyAnimation(caAnimation, animationName, valueList.property(), animationIndex, timeOffset));
+    }
+
+    return true;
+}
+
+bool GraphicsLayerCA::createFilterAnimationsFromKeyframes(const KeyframeValueList& valueList, const Animation* animation, const String& animationName, double timeOffset)
+{
+    ASSERT(valueList.property() == AnimatedPropertyWebkitFilter);
+
+    int listIndex = validateFilterOperations(valueList);
+    if (listIndex < 0)
+        return false;
+        
+    const FilterOperations* operations = static_cast<const FilterAnimationValue*>(valueList.at(listIndex))->value();
+    int numAnimations = operations->size();
+
+    // FIXME: We can't currently hardware animate shadows. There is an open question about removing shadows from filters 
+    // entirely, in which case this issue is moot.
+    for (int i = 0; i < numAnimations; ++i) {
+        if (operations->at(i)->getOperationType() == FilterOperation::DROP_SHADOW)
+            return false;
+    }
+
+    for (int animationIndex = 0; animationIndex < numAnimations; ++animationIndex) {
+        if (!appendToUncommittedAnimations(valueList, operations->operations().at(animationIndex).get(), animation, animationName, animationIndex, timeOffset))
+            return false;
+    }
+
+    return true;
+}
+#endif
+
+PassRefPtr<PlatformCAAnimation> GraphicsLayerCA::createBasicAnimation(const Animation* anim, const String& keyPath, bool additive)
 {
-    RefPtr<PlatformCAAnimation> basicAnim = PlatformCAAnimation::create(PlatformCAAnimation::Basic, propertyIdToString(property));
+    RefPtr<PlatformCAAnimation> basicAnim = PlatformCAAnimation::create(PlatformCAAnimation::Basic, keyPath);
     setupAnimation(basicAnim.get(), anim, additive);
     return basicAnim;
 }
 
-PassRefPtr<PlatformCAAnimation>GraphicsLayerCA::createKeyframeAnimation(const Animation* anim, AnimatedPropertyID property, bool additive)
+PassRefPtr<PlatformCAAnimation>GraphicsLayerCA::createKeyframeAnimation(const Animation* anim, const String& keyPath, bool additive)
 {
-    RefPtr<PlatformCAAnimation> keyframeAnim = PlatformCAAnimation::create(PlatformCAAnimation::Keyframe, propertyIdToString(property));
+    RefPtr<PlatformCAAnimation> keyframeAnim = PlatformCAAnimation::create(PlatformCAAnimation::Keyframe, keyPath);
     setupAnimation(keyframeAnim.get(), anim, additive);
     return keyframeAnim;
 }
@@ -2081,6 +2163,76 @@ bool GraphicsLayerCA::setTransformAnimationKeyframes(const KeyframeValueList& va
     return true;
 }
 
+#if ENABLE(CSS_FILTERS)
+bool GraphicsLayerCA::setFilterAnimationEndpoints(const KeyframeValueList& valueList, const Animation* animation, PlatformCAAnimation* basicAnim, int functionIndex, int internalFilterPropertyIndex)
+{
+    ASSERT(valueList.size() == 2);
+    
+    const FilterAnimationValue* fromValue = static_cast<const FilterAnimationValue*>(valueList.at(0));
+    const FilterAnimationValue* toValue = static_cast<const FilterAnimationValue*>(valueList.at(1));
+    
+    const FilterOperation* fromOperation = fromValue->value()->at(functionIndex);
+    const FilterOperation* toOperation = toValue->value()->at(functionIndex);
+    
+    RefPtr<DefaultFilterOperation> defaultFromOperation;
+    RefPtr<DefaultFilterOperation> defaultToOperation;
+    
+    ASSERT(fromOperation || toOperation);
+    
+    if (!fromOperation) {
+        defaultFromOperation = DefaultFilterOperation::create(toOperation->getOperationType());
+        fromOperation = defaultFromOperation.get();
+    }
+    
+    if (!toOperation) {
+        defaultToOperation = DefaultFilterOperation::create(fromOperation->getOperationType());
+        toOperation = defaultToOperation.get();
+    }
+    
+    basicAnim->setFromValue(fromOperation, internalFilterPropertyIndex);
+    basicAnim->setToValue(toOperation, internalFilterPropertyIndex);
+    
+    // This codepath is used for 2-keyframe animations, so we still need to look in the start for a timing function.
+    const TimingFunction* timingFunction = timingFunctionForAnimationValue(valueList.at(0), animation);
+    basicAnim->setTimingFunction(timingFunction);
+
+    return true;
+}
+
+bool GraphicsLayerCA::setFilterAnimationKeyframes(const KeyframeValueList& valueList, const Animation* animation, PlatformCAAnimation* keyframeAnim, int functionIndex, int internalFilterPropertyIndex, FilterOperation::OperationType filterOp)
+{
+    Vector<float> keyTimes;
+    Vector<RefPtr<FilterOperation> > values;
+    Vector<const TimingFunction*> timingFunctions;
+    RefPtr<DefaultFilterOperation> defaultOperation;
+
+    for (unsigned i = 0; i < valueList.size(); ++i) {
+        const FilterAnimationValue* curValue = static_cast<const FilterAnimationValue*>(valueList.at(i));
+        keyTimes.append(curValue->keyTime());
+
+        if (curValue->value()->operations().size() > static_cast<size_t>(functionIndex))
+            values.append(curValue->value()->operations()[functionIndex]);
+        else {
+            if (!defaultOperation)
+                defaultOperation = DefaultFilterOperation::create(filterOp);
+            values.append(defaultOperation);
+        }
+
+        const TimingFunction* timingFunction = timingFunctionForAnimationValue(curValue, animation);
+        timingFunctions.append(timingFunction);
+    }
+    
+    // We toss the last timing function because it has to be one shorter than the others.
+    timingFunctions.removeLast();
+
+    keyframeAnim->setKeyTimes(keyTimes);
+    keyframeAnim->setValues(values, internalFilterPropertyIndex);
+    keyframeAnim->setTimingFunctions(timingFunctions);
+
+    return true;
+}
+#endif
+
 void GraphicsLayerCA::suspendAnimations(double time)
 {
     double t = PlatformCALayer::currentTimeToMediaTime(time ? time : currentTime());
@@ -2269,9 +2421,7 @@ void GraphicsLayerCA::swapFromOrToTiledLayer(bool useTiledLayer, float pageScale
 #endif
 
     // move over animations
-    moveOrCopyAnimationsForProperty(Move, AnimatedPropertyWebkitTransform, oldLayer.get(), m_layer.get());
-    moveOrCopyAnimationsForProperty(Move, AnimatedPropertyOpacity, oldLayer.get(), m_layer.get());
-    moveOrCopyAnimationsForProperty(Move, AnimatedPropertyBackgroundColor, oldLayer.get(), m_layer.get());
+    moveOrCopyAnimations(Move, oldLayer.get(), m_layer.get());
     
     // need to tell new layer to draw itself
     setNeedsDisplay();
@@ -2491,8 +2641,7 @@ PassRefPtr<PlatformCALayer> GraphicsLayerCA::cloneLayer(PlatformCALayer *layer,
 
     if (cloneLevel == IntermediateCloneLevel) {
         newLayer->setOpacity(layer->opacity());
-        moveOrCopyAnimationsForProperty(Copy, AnimatedPropertyWebkitTransform, layer, newLayer.get());
-        moveOrCopyAnimationsForProperty(Copy, AnimatedPropertyOpacity, layer, newLayer.get());
+        moveOrCopyAnimations(Copy, layer, newLayer.get());
     }
     
     if (showDebugBorders()) {
diff --git a/Source/WebCore/platform/graphics/ca/GraphicsLayerCA.h b/Source/WebCore/platform/graphics/ca/GraphicsLayerCA.h
index 80b237641..77dafc523 100644
--- a/Source/WebCore/platform/graphics/ca/GraphicsLayerCA.h
+++ b/Source/WebCore/platform/graphics/ca/GraphicsLayerCA.h
@@ -179,10 +179,13 @@ private:
 
     bool createAnimationFromKeyframes(const KeyframeValueList&, const Animation*, const String& animationName, double timeOffset);
     bool createTransformAnimationsFromKeyframes(const KeyframeValueList&, const Animation*, const String& animationName, double timeOffset, const IntSize& boxSize);
+#if ENABLE(CSS_FILTERS)
+    bool createFilterAnimationsFromKeyframes(const KeyframeValueList&, const Animation*, const String& animationName, double timeOffset);
+#endif
 
     // Return autoreleased animation (use RetainPtr?)
-    PassRefPtr<PlatformCAAnimation> createBasicAnimation(const Animation*, AnimatedPropertyID, bool additive);
-    PassRefPtr<PlatformCAAnimation> createKeyframeAnimation(const Animation*, AnimatedPropertyID, bool additive);
+    PassRefPtr<PlatformCAAnimation> createBasicAnimation(const Animation*, const String& keyPath, bool additive);
+    PassRefPtr<PlatformCAAnimation> createKeyframeAnimation(const Animation*, const String&, bool additive);
     void setupAnimation(PlatformCAAnimation*, const Animation*, bool additive);
     
     const TimingFunction* timingFunctionForAnimationValue(const AnimationValue*, const Animation*);
@@ -193,6 +196,11 @@ private:
     bool setTransformAnimationEndpoints(const KeyframeValueList&, const Animation*, PlatformCAAnimation*, int functionIndex, TransformOperation::OperationType, bool isMatrixAnimation, const IntSize& boxSize);
     bool setTransformAnimationKeyframes(const KeyframeValueList&, const Animation*, PlatformCAAnimation*, int functionIndex, TransformOperation::OperationType, bool isMatrixAnimation, const IntSize& boxSize);
     
+#if ENABLE(CSS_FILTERS)
+    bool setFilterAnimationEndpoints(const KeyframeValueList&, const Animation*, PlatformCAAnimation*, int functionIndex, int internalFilterPropertyIndex);
+    bool setFilterAnimationKeyframes(const KeyframeValueList&, const Animation*, PlatformCAAnimation*, int functionIndex, int internalFilterPropertyIndex, FilterOperation::OperationType);
+#endif
+
     bool animationIsRunning(const String& animationName) const
     {
         return m_runningAnimations.find(animationName) != m_runningAnimations.end();
@@ -322,9 +330,12 @@ private:
 
     enum MoveOrCopy { Move, Copy };
     static void moveOrCopyLayerAnimation(MoveOrCopy, const String& animationIdentifier, PlatformCALayer *fromLayer, PlatformCALayer *toLayer);
-    void moveOrCopyAnimationsForProperty(MoveOrCopy, AnimatedPropertyID, PlatformCALayer * fromLayer, PlatformCALayer * toLayer);
+    void moveOrCopyAnimations(MoveOrCopy, PlatformCALayer * fromLayer, PlatformCALayer * toLayer);
     
     bool appendToUncommittedAnimations(const KeyframeValueList&, const TransformOperations*, const Animation*, const String& animationName, const IntSize& boxSize, int animationIndex, double timeOffset, bool isMatrixAnimation);
+#if ENABLE(CSS_FILTERS)
+    bool appendToUncommittedAnimations(const KeyframeValueList&, const FilterOperation*, const Animation*, const String& animationName, int animationIndex, double timeOffset);
+#endif
     
     enum LayerChange {
         NoChange = 0,
diff --git a/Source/WebCore/platform/graphics/ca/PlatformCAAnimation.h b/Source/WebCore/platform/graphics/ca/PlatformCAAnimation.h
index b2d325956..280d763b3 100644
--- a/Source/WebCore/platform/graphics/ca/PlatformCAAnimation.h
+++ b/Source/WebCore/platform/graphics/ca/PlatformCAAnimation.h
@@ -29,6 +29,7 @@
 #if USE(ACCELERATED_COMPOSITING)
 
 #include "Color.h"
+#include "FilterOperation.h"
 #include "FloatPoint3D.h"
 #include "TransformationMatrix.h"
 #include <wtf/RefCounted.h>
@@ -109,12 +110,18 @@ public:
     void setFromValue(const WebCore::TransformationMatrix&);
     void setFromValue(const FloatPoint3D&);
     void setFromValue(const WebCore::Color&);
+#if ENABLE(CSS_FILTERS)
+    void setFromValue(const FilterOperation*, int internalFilterPropertyIndex);
+#endif
     void copyFromValueFrom(const PlatformCAAnimation*);
 
     void setToValue(float);
     void setToValue(const WebCore::TransformationMatrix&);
     void setToValue(const FloatPoint3D&);
     void setToValue(const WebCore::Color&);
+#if ENABLE(CSS_FILTERS)
+    void setToValue(const FilterOperation*, int internalFilterPropertyIndex);
+#endif
     void copyToValueFrom(const PlatformCAAnimation*);
 
     // Keyframe-animation properties.
@@ -122,6 +129,9 @@ public:
     void setValues(const Vector<WebCore::TransformationMatrix>&);
     void setValues(const Vector<FloatPoint3D>&);
     void setValues(const Vector<WebCore::Color>&);
+#if ENABLE(CSS_FILTERS)
+    void setValues(const Vector<RefPtr<FilterOperation> >&, int internalFilterPropertyIndex);
+#endif
     void copyValuesFrom(const PlatformCAAnimation*);
 
     void setKeyTimes(const Vector<float>&);
@@ -130,6 +140,11 @@ public:
     void setTimingFunctions(const Vector<const TimingFunction*>&);
     void copyTimingFunctionsFrom(const PlatformCAAnimation*);
     
+#if ENABLE(CSS_FILTERS)
+    static int numAnimatedFilterProperties(FilterOperation::OperationType);
+    static const char* animatedFilterPropertyName(FilterOperation::OperationType, int internalFilterPropertyIndex);
+#endif
+
 protected:
     PlatformCAAnimation(AnimationType, const String& keyPath);
     PlatformCAAnimation(PlatformAnimationRef);
diff --git a/Source/WebCore/platform/graphics/ca/mac/PlatformCAAnimationMac.mm b/Source/WebCore/platform/graphics/ca/mac/PlatformCAAnimationMac.mm
index f14232590..11be28883 100644
--- a/Source/WebCore/platform/graphics/ca/mac/PlatformCAAnimationMac.mm
+++ b/Source/WebCore/platform/graphics/ca/mac/PlatformCAAnimationMac.mm
@@ -396,6 +396,131 @@ void PlatformCAAnimation::setFromValue(const WebCore::Color& value)
     [static_cast<CABasicAnimation*>(m_animation.get()) setFromValue:array];
 }
 
+#if ENABLE(CSS_FILTERS)
+static double sepiaFullConstants[3][3] = {
+    { 0.393, 0.769, 0.189 },
+    { 0.349, 0.686, 0.168 },
+    { 0.272, 0.534, 0.131 }
+};
+
+static double sepiaNoneConstants[3][3] = {
+    { 1, 0, 0 },
+    { 0, 1, 0 },
+    { 0, 0, 1 }
+};
+
+static double invertConstants[3][3] = {
+    { 1, 0, 0 },
+    { 0, 1, 0 },
+    { 0, 0, 1 }
+};
+
+static RetainPtr<id> filterValueForOperation(const FilterOperation* operation, int internalFilterPropertyIndex)
+{
+    FilterOperation::OperationType type = operation->getOperationType();
+    RetainPtr<id> value;
+    
+    switch(type) {
+    case FilterOperation::GRAYSCALE:
+    case FilterOperation::SATURATE:
+    case FilterOperation::HUE_ROTATE: {
+        double amount = 0;
+        
+        if (!operation->isDefault()) {
+            const BasicColorMatrixFilterOperation* op = static_cast<const BasicColorMatrixFilterOperation*>(operation);
+            amount = op->amount();
+        }
+        
+        if (type == FilterOperation::HUE_ROTATE)
+            amount = deg2rad(amount);
+
+        value.adoptNS([[NSNumber numberWithDouble:amount] retain]);
+        break;
+    }
+    case FilterOperation::SEPIA: {
+        double amount = 0;
+
+        if (!operation->isDefault()) {
+            const BasicColorMatrixFilterOperation* op = static_cast<const BasicColorMatrixFilterOperation*>(operation);
+            amount = op->amount();
+        }
+        
+        value.adoptNS([[NSArray arrayWithObjects:
+            [NSNumber numberWithDouble:WebCore::blend(sepiaNoneConstants[internalFilterPropertyIndex][0], sepiaFullConstants[0][internalFilterPropertyIndex], amount)],
+            [NSNumber numberWithDouble:WebCore::blend(sepiaNoneConstants[internalFilterPropertyIndex][1], sepiaFullConstants[1][internalFilterPropertyIndex], amount)],
+            [NSNumber numberWithDouble:WebCore::blend(sepiaNoneConstants[internalFilterPropertyIndex][2], sepiaFullConstants[2][internalFilterPropertyIndex], amount)],
+            [NSNumber numberWithDouble:0],
+            nil] retain]);
+        break;
+    }
+    case FilterOperation::INVERT: {
+        double amount = 0;
+
+        if (!operation->isDefault()) {
+            const BasicComponentTransferFilterOperation* op = static_cast<const BasicComponentTransferFilterOperation*>(operation);
+            amount = op->amount();
+        }
+        
+        // The color matrix animation for invert does a scale of each color component by a value that goes from 
+        // 1 (when amount is 0) to -1 (when amount is 1). Then the color values are offset by amount. This has the
+        // effect of performing the operation: c' = c * -1 + 1, which inverts the color.
+        if (internalFilterPropertyIndex < 3) {
+            // the first 3 properties are the red, green and blue multipliers
+            double multiplier = 1 - amount * 2;
+            value.adoptNS([[NSArray arrayWithObjects:
+                [NSNumber numberWithDouble:invertConstants[internalFilterPropertyIndex][0] * multiplier],
+                [NSNumber numberWithDouble:invertConstants[internalFilterPropertyIndex][1] * multiplier],
+                [NSNumber numberWithDouble:invertConstants[internalFilterPropertyIndex][2] * multiplier],
+                [NSNumber numberWithDouble:0],
+                nil] retain]);
+        } else {
+            // the last property is the color offset
+            value.adoptNS([[NSArray arrayWithObjects:
+                [NSNumber numberWithDouble:amount],
+                [NSNumber numberWithDouble:amount],
+                [NSNumber numberWithDouble:amount],
+                [NSNumber numberWithDouble:0],
+                nil] retain]);
+        }
+        break;
+    }
+    case FilterOperation::OPACITY:
+    case FilterOperation::CONTRAST:
+    case FilterOperation::BRIGHTNESS: {
+        double amount = 0;
+
+        if (!operation->isDefault()) {
+            const BasicComponentTransferFilterOperation* op = static_cast<const BasicComponentTransferFilterOperation*>(operation);
+            amount = op->amount();
+        }
+        
+        value.adoptNS([[NSNumber numberWithDouble:amount] retain]);
+        break;
+    }
+    case FilterOperation::BLUR: {
+        double amount = 0;
+
+        if (!operation->isDefault()) {
+            const BlurFilterOperation* op = static_cast<const BlurFilterOperation*>(operation);
+            amount = op->stdDeviation().calcFloatValue(0);
+        }
+        
+        value.adoptNS([[NSNumber numberWithDouble:amount] retain]);
+        break;
+    }
+    default: break;
+    }
+    
+    return value;
+}
+
+void PlatformCAAnimation::setFromValue(const FilterOperation* operation, int internalFilterPropertyIndex)
+{
+    RetainPtr<id> value = filterValueForOperation(operation, internalFilterPropertyIndex);
+    [static_cast<CABasicAnimation*>(m_animation.get()) setFromValue:value.get()];
+}
+#endif
+
 void PlatformCAAnimation::copyFromValueFrom(const PlatformCAAnimation* value)
 {
     if (animationType() != Basic || value->animationType() != Basic)
@@ -447,6 +572,14 @@ void PlatformCAAnimation::setToValue(const WebCore::Color& value)
     [static_cast<CABasicAnimation*>(m_animation.get()) setToValue:array];
 }
 
+#if ENABLE(CSS_FILTERS)
+void PlatformCAAnimation::setToValue(const FilterOperation* operation, int internalFilterPropertyIndex)
+{
+    RetainPtr<id> value = filterValueForOperation(operation, internalFilterPropertyIndex);
+    [static_cast<CABasicAnimation*>(m_animation.get()) setToValue:value.get()];
+}
+#endif
+
 void PlatformCAAnimation::copyToValueFrom(const PlatformCAAnimation* value)
 {
     if (animationType() != Basic || value->animationType() != Basic)
@@ -519,6 +652,22 @@ void PlatformCAAnimation::setValues(const Vector<WebCore::Color>& value)
     [static_cast<CAKeyframeAnimation*>(m_animation.get()) setValues:array];
 }
 
+#if ENABLE(CSS_FILTERS)
+void PlatformCAAnimation::setValues(const Vector<RefPtr<FilterOperation> >& values, int internalFilterPropertyIndex)
+{
+    if (animationType() != Keyframe)
+        return;
+        
+    NSMutableArray* array = [NSMutableArray array];
+
+    for (size_t i = 0; i < values.size(); ++i) {
+        RetainPtr<id> value = filterValueForOperation(values[i].get(), internalFilterPropertyIndex);
+        [array addObject:value.get()];
+    }
+    [static_cast<CAKeyframeAnimation*>(m_animation.get()) setValues:array];
+}
+#endif
+
 void PlatformCAAnimation::copyValuesFrom(const PlatformCAAnimation* value)
 {
     if (animationType() != Keyframe || value->animationType() != Keyframe)
@@ -560,4 +709,51 @@ void PlatformCAAnimation::copyTimingFunctionsFrom(const PlatformCAAnimation* val
     [static_cast<CAKeyframeAnimation*>(m_animation.get()) setTimingFunctions:[other timingFunctions]];
 }
 
+#if ENABLE(CSS_FILTERS)
+int PlatformCAAnimation::numAnimatedFilterProperties(FilterOperation::OperationType type)
+{
+    switch(type) {
+    case FilterOperation::GRAYSCALE: return 1;
+    case FilterOperation::SEPIA: return 3;
+    case FilterOperation::SATURATE: return 1;
+    case FilterOperation::HUE_ROTATE: return 1;
+    case FilterOperation::INVERT: return 4;
+    case FilterOperation::OPACITY: return 1;
+    case FilterOperation::BLUR: return 1;
+    case FilterOperation::CONTRAST: return 1;
+    case FilterOperation::BRIGHTNESS: return 1;
+    default: return 0;
+    }
+}
+
+const char* PlatformCAAnimation::animatedFilterPropertyName(FilterOperation::OperationType type, int internalFilterPropertyIndex)
+{
+    switch(type) {
+    case FilterOperation::GRAYSCALE: return "inputIntensity";
+    case FilterOperation::SEPIA:
+        switch(internalFilterPropertyIndex) {
+        case 0: return "inputRVector";
+        case 1: return "inputGVector";
+        case 2: return "inputBVector";
+        default: return "";
+        }
+    case FilterOperation::SATURATE: return "inputSaturation";
+    case FilterOperation::HUE_ROTATE: return "inputAngle";
+    case FilterOperation::INVERT:
+        switch(internalFilterPropertyIndex) {
+        case 0: return "inputRVector";
+        case 1: return "inputGVector";
+        case 2: return "inputBVector";
+        case 3: return "inputBiasVector";
+        default: return "";
+        }
+    case FilterOperation::OPACITY: return "inputAVector";
+    case FilterOperation::BLUR: return "inputRadius";
+    case FilterOperation::CONTRAST: return "inputContrast";
+    case FilterOperation::BRIGHTNESS: return "inputBrightness";
+    default: return "";
+    }
+}
+#endif
+
 #endif // USE(ACCELERATED_COMPOSITING)
diff --git a/Source/WebCore/platform/graphics/ca/mac/TileCache.h b/Source/WebCore/platform/graphics/ca/mac/TileCache.h
index 2c290e500..675b85af6 100644
--- a/Source/WebCore/platform/graphics/ca/mac/TileCache.h
+++ b/Source/WebCore/platform/graphics/ca/mac/TileCache.h
@@ -27,7 +27,7 @@
 #define TileCache_h
 
 #include "IntPointHash.h"
-#include "IntSize.h"
+#include "IntRect.h"
 #include "Timer.h"
 #include <wtf/HashMap.h>
 #include <wtf/Noncopyable.h>
@@ -49,12 +49,14 @@ class TileCache {
 
 public:
     static PassOwnPtr<TileCache> create(WebTileCacheLayer*, const IntSize& tileSize);
+    ~TileCache();
 
     void tileCacheLayerBoundsChanged();
 
     void setNeedsDisplay();
     void setNeedsDisplayInRect(const IntRect&);
     void drawLayer(WebTileLayer*, CGContextRef);
+    void setContentsScale(CGFloat);
 
     bool acceleratesDrawing() const { return m_acceleratesDrawing; }
     void setAcceleratesDrawing(bool);
@@ -95,6 +97,7 @@ private:
     typedef HashMap<TileIndex, RetainPtr<WebTileLayer> > TileMap;
     TileMap m_tiles;
     Timer<TileCache> m_tileRevalidationTimer;
+    IntRect m_tileCoverageRect;
 
     bool m_acceleratesDrawing;
 
diff --git a/Source/WebCore/platform/graphics/ca/mac/TileCache.mm b/Source/WebCore/platform/graphics/ca/mac/TileCache.mm
index 2550b3dd6..a74ff7215 100644
--- a/Source/WebCore/platform/graphics/ca/mac/TileCache.mm
+++ b/Source/WebCore/platform/graphics/ca/mac/TileCache.mm
@@ -31,6 +31,7 @@
 #import "WebLayer.h"
 #import "WebTileCacheLayer.h"
 #import "WebTileLayer.h"
+#import <wtf/MainThread.h>
 #import <utility>
 
 using namespace std;
@@ -62,6 +63,11 @@ TileCache::TileCache(WebTileCacheLayer* tileCacheLayer, const IntSize& tileSize)
     [CATransaction commit];
 }
 
+TileCache::~TileCache()
+{
+    ASSERT(isMainThread());
+}
+
 void TileCache::tileCacheLayerBoundsChanged()
 {
     if (m_tiles.isEmpty()) {
@@ -87,7 +93,7 @@ void TileCache::setNeedsDisplayInRect(const IntRect& rect)
     // Find the tiles that need to be invalidated.
     TileIndex topLeft;
     TileIndex bottomRight;
-    getTileIndexRangeForRect(rect, topLeft, bottomRight);
+    getTileIndexRangeForRect(intersection(rect, m_tileCoverageRect), topLeft, bottomRight);
 
     for (int y = topLeft.y(); y <= bottomRight.y(); ++y) {
         for (int x = topLeft.x(); x <= bottomRight.x(); ++x) {
@@ -156,6 +162,22 @@ void TileCache::drawLayer(WebTileLayer* layer, CGContextRef context)
     CGContextRestoreGState(context);
 }
 
+void TileCache::setContentsScale(CGFloat contentsScale)
+{
+#if !defined(BUILDING_ON_LEOPARD) && !defined(BUILDING_ON_SNOW_LEOPARD)
+    for (TileMap::const_iterator it = m_tiles.begin(), end = m_tiles.end(); it != end; ++it) {
+        [it->second.get() setContentsScale:contentsScale];
+        [it->second.get() setNeedsDisplay];
+    }
+
+    PlatformCALayer* platformLayer = PlatformCALayer::platformCALayer(m_tileCacheLayer);
+    platformLayer->owner()->platformCALayerDidCreateTiles();
+    revalidateTiles();
+#else
+    UNUSED_PARAM(contentsScale);
+#endif
+}
+
 void TileCache::setAcceleratesDrawing(bool acceleratesDrawing)
 {
 #if !defined(BUILDING_ON_LEOPARD) && !defined(BUILDING_ON_SNOW_LEOPARD)
@@ -311,6 +333,13 @@ void TileCache::revalidateTiles()
         }
     }
 
+    m_tileCoverageRect = IntRect();
+    for (TileMap::iterator it = m_tiles.begin(), end = m_tiles.end(); it != end; ++it) {
+        const TileIndex& tileIndex = it->first;
+
+        m_tileCoverageRect.unite(rectForTileIndex(tileIndex));
+    }
+
     if (!didCreateNewTiles)
         return;
 
@@ -331,8 +360,10 @@ RetainPtr<WebTileLayer> TileCache::createTileLayer()
     [layer.get() setTileCache:this];
     [layer.get() setBorderColor:m_tileDebugBorderColor.get()];
     [layer.get() setBorderWidth:m_tileDebugBorderWidth];
+    [layer.get() setEdgeAntialiasingMask:0];
 
 #if !defined(BUILDING_ON_LEOPARD) && !defined(BUILDING_ON_SNOW_LEOPARD)
+    [layer.get() setContentsScale:[m_tileCacheLayer contentsScale]];
     [layer.get() setAcceleratesDrawing:m_acceleratesDrawing];
 #endif
 
diff --git a/Source/WebCore/platform/graphics/ca/mac/WebTileCacheLayer.mm b/Source/WebCore/platform/graphics/ca/mac/WebTileCacheLayer.mm
index 059f1777c..f992c270c 100644
--- a/Source/WebCore/platform/graphics/ca/mac/WebTileCacheLayer.mm
+++ b/Source/WebCore/platform/graphics/ca/mac/WebTileCacheLayer.mm
@@ -28,6 +28,7 @@
 
 #import "IntRect.h"
 #import "TileCache.h"
+#import <wtf/MainThread.h>
 
 using namespace WebCore;
 
@@ -45,6 +46,18 @@ using namespace WebCore;
     return self;
 }
 
+- (void)dealloc
+{
+    if (!isMainThread()) {
+        TileCache* tileCache = _tileCache.leakPtr();
+        dispatch_async(dispatch_get_main_queue(), ^{
+            delete tileCache;
+        });
+    }
+
+    [super dealloc];
+}
+
 - (void)setBounds:(CGRect)bounds
 {
     [super setBounds:bounds];
@@ -72,6 +85,20 @@ using namespace WebCore;
     return _tileCache->acceleratesDrawing();
 }
 
+- (void)setContentsScale:(CGFloat)contentsScale
+{
+#if !defined(BUILDING_ON_LEOPARD) && !defined(BUILDING_ON_SNOW_LEOPARD)
+    CGFloat oldContentsScale = [self contentsScale];
+
+    [super setContentsScale:contentsScale];
+
+    if (contentsScale != oldContentsScale)
+        _tileCache->setContentsScale(contentsScale);
+#else
+    UNUSED_PARAM(contentsScale);
+#endif
+}
+
 - (CALayer *)tileContainerLayer
 {
     return _tileCache->tileContainerLayer();
diff --git a/Source/WebCore/platform/graphics/ca/win/CACFLayerTreeHost.cpp b/Source/WebCore/platform/graphics/ca/win/CACFLayerTreeHost.cpp
index e7d2dd19e..2e4ec5ed6 100644
--- a/Source/WebCore/platform/graphics/ca/win/CACFLayerTreeHost.cpp
+++ b/Source/WebCore/platform/graphics/ca/win/CACFLayerTreeHost.cpp
@@ -274,6 +274,10 @@ void CACFLayerTreeHost::flushPendingGraphicsLayerChangesSoon()
     LayerChangesFlusher::shared().flushPendingLayerChangesSoon(this);
 }
 
+void CACFLayerTreeHost::setShouldInvertColors(bool)
+{
+}
+
 void CACFLayerTreeHost::flushPendingLayerChangesNow()
 {
     // Calling out to the client could cause our last reference to go away.
diff --git a/Source/WebCore/platform/graphics/ca/win/CACFLayerTreeHost.h b/Source/WebCore/platform/graphics/ca/win/CACFLayerTreeHost.h
index 507af0fab..2b82377d8 100644
--- a/Source/WebCore/platform/graphics/ca/win/CACFLayerTreeHost.h
+++ b/Source/WebCore/platform/graphics/ca/win/CACFLayerTreeHost.h
@@ -65,6 +65,7 @@ public:
     virtual void paint();
     virtual void resize() = 0;
     void flushPendingGraphicsLayerChangesSoon();
+    virtual void setShouldInvertColors(bool);
 
     // AbstractCACFLayerTreeHost
     virtual void flushPendingLayerChangesNow();
diff --git a/Source/WebCore/platform/graphics/ca/win/PlatformCAAnimationWin.cpp b/Source/WebCore/platform/graphics/ca/win/PlatformCAAnimationWin.cpp
index 683d70353..944288ca7 100644
--- a/Source/WebCore/platform/graphics/ca/win/PlatformCAAnimationWin.cpp
+++ b/Source/WebCore/platform/graphics/ca/win/PlatformCAAnimationWin.cpp
@@ -368,6 +368,13 @@ void PlatformCAAnimation::setFromValue(const WebCore::Color& value)
     CACFAnimationSetFromValue(m_animation.get(), v.get());
 }
 
+#if ENABLE(CSS_FILTERS)
+void PlatformCAAnimation::setFromValue(const FilterOperation*, int)
+{
+    // FIXME: Hardware filter animation not implemented on Windows
+}
+#endif
+
 void PlatformCAAnimation::copyFromValueFrom(const PlatformCAAnimation* value)
 {
     if (animationType() != Basic || value->animationType() != Basic)
@@ -414,6 +421,13 @@ void PlatformCAAnimation::setToValue(const WebCore::Color& value)
     CACFAnimationSetToValue(m_animation.get(), v.get());
 }
 
+#if ENABLE(CSS_FILTERS)
+void PlatformCAAnimation::setToValue(const FilterOperation*, int)
+{
+    // FIXME: Hardware filter animation not implemented on Windows
+}
+#endif
+
 void PlatformCAAnimation::copyToValueFrom(const PlatformCAAnimation* value)
 {
     if (animationType() != Basic || value->animationType() != Basic)
@@ -482,6 +496,13 @@ void PlatformCAAnimation::setValues(const Vector<WebCore::Color>& value)
     CACFAnimationSetValues(m_animation.get(), array.get());
 }
 
+#if ENABLE(CSS_FILTERS)
+void PlatformCAAnimation::setValues(const Vector<RefPtr<FilterOperation> >&, int)
+{
+    // FIXME: Hardware filter animation not implemented on Windows
+}
+#endif
+
 void PlatformCAAnimation::copyValuesFrom(const PlatformCAAnimation* value)
 {
     if (animationType() != Keyframe || value->animationType() != Keyframe)
@@ -531,4 +552,18 @@ void PlatformCAAnimation::copyTimingFunctionsFrom(const PlatformCAAnimation* val
     CACFAnimationSetTimingFunctions(m_animation.get(), CACFAnimationGetTimingFunctions(value->platformAnimation()));
 }
 
+#if ENABLE(CSS_FILTERS)
+int PlatformCAAnimation::numAnimatedFilterProperties(FilterOperation::OperationType)
+{
+    // FIXME: Hardware filter animation not implemented on Windows
+    return 0;
+}
+
+const char* PlatformCAAnimation::animatedFilterPropertyName(FilterOperation::OperationType, int)
+{
+    // FIXME: Hardware filter animation not implemented on Windows
+    return "";
+}
+#endif
+
 #endif // USE(ACCELERATED_COMPOSITING)
diff --git a/Source/WebCore/platform/graphics/ca/win/PlatformCALayerWin.cpp b/Source/WebCore/platform/graphics/ca/win/PlatformCALayerWin.cpp
index 47de3f871..633d4e321 100644
--- a/Source/WebCore/platform/graphics/ca/win/PlatformCALayerWin.cpp
+++ b/Source/WebCore/platform/graphics/ca/win/PlatformCALayerWin.cpp
@@ -566,6 +566,8 @@ void PlatformCALayer::setOpacity(float value)
     setNeedsCommit();
 }
 
+#if ENABLE(CSS_FILTERS)
+
 void PlatformCALayer::setFilters(const FilterOperations&)
 {
 }
@@ -575,6 +577,8 @@ bool PlatformCALayer::filtersCanBeComposited(const FilterOperations&)
     return false;
 }
 
+#endif // ENABLE(CSS_FILTERS)
+
 String PlatformCALayer::name() const
 {
     return CACFLayerGetName(m_layer.get());
diff --git a/Source/WebCore/platform/graphics/ca/win/WKCACFViewLayerTreeHost.cpp b/Source/WebCore/platform/graphics/ca/win/WKCACFViewLayerTreeHost.cpp
index f3cf39e74..2b47a3e1d 100644
--- a/Source/WebCore/platform/graphics/ca/win/WKCACFViewLayerTreeHost.cpp
+++ b/Source/WebCore/platform/graphics/ca/win/WKCACFViewLayerTreeHost.cpp
@@ -60,6 +60,7 @@ typedef void (*WKCACFViewContextDidChangeCallback)(WKCACFViewRef view, void* inf
 SOFT_LINK(WebKitQuartzCoreAdditions, WKCACFViewSetContextDidChangeCallback, void, __cdecl, (WKCACFViewRef view, WKCACFViewContextDidChangeCallback callback, void* info), (view, callback, info))
 SOFT_LINK(WebKitQuartzCoreAdditions, WKCACFViewGetLastCommitTime, CFTimeInterval, __cdecl, (WKCACFViewRef view), (view))
 SOFT_LINK(WebKitQuartzCoreAdditions, WKCACFViewSetContextUserData, void, __cdecl, (WKCACFViewRef view, void* userData), (view, userData))
+SOFT_LINK_OPTIONAL(WebKitQuartzCoreAdditions, WKCACFViewSetShouldInvertColors, void, _cdecl, (WKCACFViewRef view, bool shouldInvertColors))
 
 PassRefPtr<WKCACFViewLayerTreeHost> WKCACFViewLayerTreeHost::create()
 {
@@ -168,6 +169,12 @@ void WKCACFViewLayerTreeHost::render(const Vector<CGRect>& dirtyRects)
     WKCACFViewDraw(m_view.get());
 }
 
+void WKCACFViewLayerTreeHost::setShouldInvertColors(bool shouldInvertColors)
+{
+    if (WKCACFViewSetShouldInvertColorsPtr())
+        WKCACFViewSetShouldInvertColorsPtr()(m_view.get(), shouldInvertColors);
+}
+
 } // namespace WebCore
 
 #endif // USE(ACCELERATED_COMPOSITING)
diff --git a/Source/WebCore/platform/graphics/ca/win/WKCACFViewLayerTreeHost.h b/Source/WebCore/platform/graphics/ca/win/WKCACFViewLayerTreeHost.h
index af09f76d1..2660e43d1 100644
--- a/Source/WebCore/platform/graphics/ca/win/WKCACFViewLayerTreeHost.h
+++ b/Source/WebCore/platform/graphics/ca/win/WKCACFViewLayerTreeHost.h
@@ -53,6 +53,7 @@ private:
     virtual void paint();
     virtual void render(const Vector<CGRect>& dirtyRects = Vector<CGRect>());
     virtual CFTimeInterval lastCommitTime() const;
+    virtual void setShouldInvertColors(bool);
 
     RetainPtr<WKCACFViewRef> m_view;
     bool m_viewNeedsUpdate;
diff --git a/Source/WebCore/platform/graphics/gtk/DrawingBufferGtk.cpp b/Source/WebCore/platform/graphics/cairo/DrawingBufferCairo.cpp
index 067b9c7b3..067b9c7b3 100644
--- a/Source/WebCore/platform/graphics/gtk/DrawingBufferGtk.cpp
+++ b/Source/WebCore/platform/graphics/cairo/DrawingBufferCairo.cpp
diff --git a/Source/WebCore/platform/graphics/cairo/GraphicsContext3DCairo.cpp b/Source/WebCore/platform/graphics/cairo/GraphicsContext3DCairo.cpp
index c85aab416..f542fb9ed 100644
--- a/Source/WebCore/platform/graphics/cairo/GraphicsContext3DCairo.cpp
+++ b/Source/WebCore/platform/graphics/cairo/GraphicsContext3DCairo.cpp
@@ -31,13 +31,116 @@
 
 #if ENABLE(WEBGL)
 
+#include "Extensions3DOpenGL.h"
+#include "GraphicsContext3DPrivate.h"
 #include "Image.h"
+#include "OpenGLShims.h"
 #include "RefPtrCairo.h"
+#include "ShaderLang.h"
 #include <cairo.h>
 #include <wtf/PassOwnPtr.h>
 
 namespace WebCore {
 
+PassRefPtr<GraphicsContext3D> GraphicsContext3D::create(GraphicsContext3D::Attributes attributes, HostWindow* hostWindow, GraphicsContext3D::RenderStyle renderStyle)
+{
+    // This implementation doesn't currently support rendering directly to the HostWindow.
+    if (renderStyle == RenderDirectlyToHostWindow)
+        return 0;
+
+    OwnPtr<GraphicsContext3DPrivate> priv = GraphicsContext3DPrivate::create();
+    if (!priv)
+        return 0;
+
+    RefPtr<GraphicsContext3D> context = adoptRef(new GraphicsContext3D(attributes, hostWindow, false));
+    context->m_private = priv.release();
+    return context.release();
+}
+
+GraphicsContext3D::GraphicsContext3D(GraphicsContext3D::Attributes attributes, HostWindow*, bool)
+    : m_currentWidth(0)
+    , m_currentHeight(0)
+    , m_attrs(attributes)
+    , m_texture(0)
+    , m_fbo(0)
+    , m_depthStencilBuffer(0)
+    , m_boundFBO(0)
+    , m_multisampleFBO(0)
+    , m_multisampleDepthStencilBuffer(0)
+    , m_multisampleColorBuffer(0)
+{
+    GraphicsContext3DPrivate::addActiveGraphicsContext(this);
+
+    validateAttributes();
+
+    // Create a texture to render into.
+    ::glGenTextures(1, &m_texture);
+    ::glBindTexture(GL_TEXTURE_2D, m_texture);
+    ::glTexParameterf(GL_TEXTURE_2D, GL_TEXTURE_MAG_FILTER, GL_LINEAR);
+    ::glTexParameterf(GL_TEXTURE_2D, GL_TEXTURE_MIN_FILTER, GL_LINEAR);
+    ::glTexParameteri(GL_TEXTURE_2D, GL_TEXTURE_WRAP_S, GL_CLAMP);
+    ::glTexParameteri(GL_TEXTURE_2D, GL_TEXTURE_WRAP_T, GL_CLAMP);
+    ::glBindTexture(GL_TEXTURE_2D, 0);
+
+    // Create an FBO.
+    ::glGenFramebuffersEXT(1, &m_fbo);
+    ::glBindFramebufferEXT(GL_FRAMEBUFFER_EXT, m_fbo);
+
+    m_boundFBO = m_fbo;
+    if (!m_attrs.antialias && (m_attrs.stencil || m_attrs.depth))
+        ::glGenRenderbuffersEXT(1, &m_depthStencilBuffer);
+    
+    // Create a multisample FBO.
+    if (m_attrs.antialias) {
+        ::glGenFramebuffersEXT(1, &m_multisampleFBO);
+        ::glBindFramebufferEXT(GL_FRAMEBUFFER_EXT, m_multisampleFBO);
+        m_boundFBO = m_multisampleFBO;
+        ::glGenRenderbuffersEXT(1, &m_multisampleColorBuffer);
+        if (m_attrs.stencil || m_attrs.depth)
+            ::glGenRenderbuffersEXT(1, &m_multisampleDepthStencilBuffer);
+    }
+
+    // ANGLE initialization.
+    ShBuiltInResources ANGLEResources;
+    ShInitBuiltInResources(&ANGLEResources);
+
+    getIntegerv(GraphicsContext3D::MAX_VERTEX_ATTRIBS, &ANGLEResources.MaxVertexAttribs);
+    getIntegerv(GraphicsContext3D::MAX_VERTEX_UNIFORM_VECTORS, &ANGLEResources.MaxVertexUniformVectors);
+    getIntegerv(GraphicsContext3D::MAX_VARYING_VECTORS, &ANGLEResources.MaxVaryingVectors);
+    getIntegerv(GraphicsContext3D::MAX_VERTEX_TEXTURE_IMAGE_UNITS, &ANGLEResources.MaxVertexTextureImageUnits);
+    getIntegerv(GraphicsContext3D::MAX_COMBINED_TEXTURE_IMAGE_UNITS, &ANGLEResources.MaxCombinedTextureImageUnits);
+    getIntegerv(GraphicsContext3D::MAX_TEXTURE_IMAGE_UNITS, &ANGLEResources.MaxTextureImageUnits);
+    getIntegerv(GraphicsContext3D::MAX_FRAGMENT_UNIFORM_VECTORS, &ANGLEResources.MaxFragmentUniformVectors);
+
+    // Always set to 1 for OpenGL ES.
+    ANGLEResources.MaxDrawBuffers = 1;
+    m_compiler.setResources(ANGLEResources);
+
+    ::glEnable(GL_VERTEX_PROGRAM_POINT_SIZE);
+    ::glEnable(GL_POINT_SPRITE);
+    ::glClearColor(0, 0, 0, 0);
+}
+
+GraphicsContext3D::~GraphicsContext3D()
+{
+    GraphicsContext3DPrivate::removeActiveGraphicsContext(this);
+    if (!m_private->m_context)
+        return;
+
+    makeContextCurrent();
+    ::glDeleteTextures(1, &m_texture);
+    if (m_attrs.antialias) {
+        ::glDeleteRenderbuffersEXT(1, &m_multisampleColorBuffer);
+        if (m_attrs.stencil || m_attrs.depth)
+            ::glDeleteRenderbuffersEXT(1, &m_multisampleDepthStencilBuffer);
+        ::glDeleteFramebuffersEXT(1, &m_multisampleFBO);
+    } else {
+        if (m_attrs.stencil || m_attrs.depth)
+            ::glDeleteRenderbuffersEXT(1, &m_depthStencilBuffer);
+    }
+    ::glDeleteFramebuffersEXT(1, &m_fbo);
+}
+
 bool GraphicsContext3D::getImageData(Image* image, unsigned int format, unsigned int type, bool premultiplyAlpha, bool ignoreGammaAndColorProfile, Vector<uint8_t>& outputVector)
 {
     if (!image)
@@ -119,6 +222,23 @@ void GraphicsContext3D::setErrorMessageCallback(PassOwnPtr<ErrorMessageCallback>
 {
 }
 
+bool GraphicsContext3D::makeContextCurrent()
+{
+    if (!m_private)
+        return false;
+    return m_private->makeContextCurrent();
+}
+
+PlatformGraphicsContext3D GraphicsContext3D::platformGraphicsContext3D()
+{
+    return m_private->m_context;
+}
+
+bool GraphicsContext3D::isGLES2Compliant() const
+{
+    return false;
+}
+
 #if USE(ACCELERATED_COMPOSITING)
 PlatformLayer* GraphicsContext3D::platformLayer() const
 {
diff --git a/Source/WebCore/platform/graphics/chromium/BitmapSkPictureCanvasLayerTextureUpdater.cpp b/Source/WebCore/platform/graphics/chromium/BitmapSkPictureCanvasLayerTextureUpdater.cpp
index 4cc6bcc90..9b912a44f 100644
--- a/Source/WebCore/platform/graphics/chromium/BitmapSkPictureCanvasLayerTextureUpdater.cpp
+++ b/Source/WebCore/platform/graphics/chromium/BitmapSkPictureCanvasLayerTextureUpdater.cpp
@@ -45,21 +45,22 @@ BitmapSkPictureCanvasLayerTextureUpdater::Texture::Texture(BitmapSkPictureCanvas
 
 void BitmapSkPictureCanvasLayerTextureUpdater::Texture::prepareRect(const IntRect& sourceRect)
 {
-    m_device = adoptPtr(new SkDevice(SkBitmap::kARGB_8888_Config, sourceRect.width(), sourceRect.height()));
-    OwnPtr<SkCanvas> canvas = adoptPtr(new SkCanvas(m_device.get()));
-    textureUpdater()->paintContentsRect(canvas.get(), sourceRect);
+    m_bitmap.setConfig(SkBitmap::kARGB_8888_Config, sourceRect.width(), sourceRect.height());
+    m_bitmap.allocPixels();
+    m_bitmap.setIsOpaque(m_textureUpdater->layerIsOpaque());
+    SkDevice device(m_bitmap);
+    SkCanvas canvas(&device);
+    textureUpdater()->paintContentsRect(&canvas, sourceRect);
 }
 
 void BitmapSkPictureCanvasLayerTextureUpdater::Texture::updateRect(GraphicsContext3D* context, TextureAllocator* allocator, const IntRect& sourceRect, const IntRect& destRect)
 {
     texture()->bindTexture(context, allocator);
 
-    ASSERT(m_device);
-    const SkBitmap* bitmap = &m_device->accessBitmap(false);
-    bitmap->lockPixels();
-    textureUpdater()->updateTextureRect(context, texture()->format(), destRect, static_cast<uint8_t*>(bitmap->getPixels()));
-    bitmap->unlockPixels();
-    m_device.clear();
+    m_bitmap.lockPixels();
+    textureUpdater()->updateTextureRect(context, texture()->format(), destRect, static_cast<uint8_t*>(m_bitmap.getPixels()));
+    m_bitmap.unlockPixels();
+    m_bitmap.reset();
 }
 
 PassRefPtr<BitmapSkPictureCanvasLayerTextureUpdater> BitmapSkPictureCanvasLayerTextureUpdater::create(PassOwnPtr<LayerPainterChromium> painter, bool useMapTexSubImage)
diff --git a/Source/WebCore/platform/graphics/chromium/BitmapSkPictureCanvasLayerTextureUpdater.h b/Source/WebCore/platform/graphics/chromium/BitmapSkPictureCanvasLayerTextureUpdater.h
index 8d52433d0..838b4b3e7 100644
--- a/Source/WebCore/platform/graphics/chromium/BitmapSkPictureCanvasLayerTextureUpdater.h
+++ b/Source/WebCore/platform/graphics/chromium/BitmapSkPictureCanvasLayerTextureUpdater.h
@@ -32,10 +32,9 @@
 
 #include "LayerTextureSubImage.h"
 #include "PlatformColor.h"
+#include "SkBitmap.h"
 #include "SkPictureCanvasLayerTextureUpdater.h"
 
-class SkDevice;
-
 namespace WebCore {
 
 // This class records the contentRect into an SkPicture, then software rasterizes
@@ -52,7 +51,7 @@ public:
     private:
         BitmapSkPictureCanvasLayerTextureUpdater* textureUpdater() { return m_textureUpdater; }
 
-        OwnPtr<SkDevice> m_device;
+        SkBitmap m_bitmap;
         BitmapSkPictureCanvasLayerTextureUpdater* m_textureUpdater;
     };
 
diff --git a/Source/WebCore/platform/graphics/chromium/Canvas2DLayerChromium.cpp b/Source/WebCore/platform/graphics/chromium/Canvas2DLayerChromium.cpp
index 14fe35a58..d8b4bbe08 100644
--- a/Source/WebCore/platform/graphics/chromium/Canvas2DLayerChromium.cpp
+++ b/Source/WebCore/platform/graphics/chromium/Canvas2DLayerChromium.cpp
@@ -97,6 +97,7 @@ void Canvas2DLayerChromium::setCanvas(SkCanvas* canvas)
 
 void Canvas2DLayerChromium::paintContentsIfDirty(const Region& /* occludedScreenSpace */)
 {
+    TRACE_EVENT("Canvas2DLayerChromium::paintContentsIfDirty", this, 0);
     if (!drawsContent())
         return;
 
@@ -111,9 +112,12 @@ void Canvas2DLayerChromium::paintContentsIfDirty(const Region& /* occludedScreen
     bool success = m_context->makeContextCurrent();
     ASSERT_UNUSED(success, success);
 
-    if (m_canvas)
+    if (m_canvas) {
+        TRACE_EVENT("SkDeferredCanvas::flush", m_canvas, 0);
         m_canvas->flush();
+    }
 
+    TRACE_EVENT("GrContext::flush", m_context, 0);
     m_context->flush();
 }
 
diff --git a/Source/WebCore/platform/graphics/chromium/Extensions3DChromium.h b/Source/WebCore/platform/graphics/chromium/Extensions3DChromium.h
index e164609ae..53322f0f2 100644
--- a/Source/WebCore/platform/graphics/chromium/Extensions3DChromium.h
+++ b/Source/WebCore/platform/graphics/chromium/Extensions3DChromium.h
@@ -63,6 +63,9 @@ public:
     virtual String getTranslatedShaderSourceANGLE(Platform3DObject);
 
     enum {
+        // GL_OES_EGL_image_external
+        GL_TEXTURE_EXTERNAL_OES = 0x8D65,
+
         // GL_CHROMIUM_map_sub (enums inherited from GL_ARB_vertex_buffer_object)
         READ_ONLY = 0x88B8,
         WRITE_ONLY = 0x88B9,
@@ -87,6 +90,14 @@ public:
     // GL_CHROMIUM_set_visibility
     void setVisibilityCHROMIUM(bool);
 
+    // GL_CHROMIUM_gpu_memory_manager
+    class GpuMemoryAllocationChangedCallbackCHROMIUM {
+    public:
+        virtual void onGpuMemoryAllocationChanged(size_t gpuResourceSizeInBytes) = 0;
+        virtual ~GpuMemoryAllocationChangedCallbackCHROMIUM() { }
+    };
+    void setGpuMemoryAllocationChangedCallbackCHROMIUM(PassOwnPtr<GpuMemoryAllocationChangedCallbackCHROMIUM>);
+
     // GL_CHROMIUM_swapbuffers_complete_callback
     class SwapBuffersCompleteCallbackCHROMIUM {
     public:
diff --git a/Source/WebCore/platform/graphics/chromium/GraphicsLayerChromium.cpp b/Source/WebCore/platform/graphics/chromium/GraphicsLayerChromium.cpp
index 31a5118ff..cdecf5917 100644
--- a/Source/WebCore/platform/graphics/chromium/GraphicsLayerChromium.cpp
+++ b/Source/WebCore/platform/graphics/chromium/GraphicsLayerChromium.cpp
@@ -61,6 +61,10 @@
 
 using namespace std;
 
+namespace {
+static int s_nextGroupId = 0;
+}
+
 namespace WebCore {
 
 PassOwnPtr<GraphicsLayer> GraphicsLayer::create(GraphicsLayerClient* client)
@@ -124,7 +128,7 @@ bool GraphicsLayerChromium::setChildren(const Vector<GraphicsLayer*>& children)
 void GraphicsLayerChromium::addChild(GraphicsLayer* childLayer)
 {
     GraphicsLayer::addChild(childLayer);
-    if (!m_inSetChildren) 
+    if (!m_inSetChildren)
         updateChildList();
 }
 
@@ -175,10 +179,17 @@ void GraphicsLayerChromium::setAnchorPoint(const FloatPoint3D& point)
 
 void GraphicsLayerChromium::setSize(const FloatSize& size)
 {
-    if (size == m_size)
+    // We are receiving negative sizes here that cause assertions to fail in the compositor. Clamp them to 0 to
+    // avoid those assertions.
+    // FIXME: This should be an ASSERT instead, as negative sizes should not exist in WebCore.
+    FloatSize clampedSize = size;
+    if (clampedSize.width() < 0 || clampedSize.height() < 0)
+        clampedSize = FloatSize();
+
+    if (clampedSize == m_size)
         return;
 
-    GraphicsLayer::setSize(size);
+    GraphicsLayer::setSize(clampedSize);
     updateLayerSize();
 }
 
@@ -254,6 +265,12 @@ void GraphicsLayerChromium::setContentsOpaque(bool opaque)
     m_layer->setOpaque(m_contentsOpaque);
 }
 
+bool GraphicsLayerChromium::setFilters(const FilterOperations& filters)
+{
+    m_layer->setFilters(filters);
+    return GraphicsLayer::setFilters(filters);
+}
+
 void GraphicsLayerChromium::setMaskLayer(GraphicsLayer* maskLayer)
 {
     if (maskLayer == m_maskLayer)
@@ -369,6 +386,31 @@ void GraphicsLayerChromium::setContentsToCanvas(PlatformLayer* platformLayer)
         updateChildList();
 }
 
+bool GraphicsLayerChromium::addAnimation(const KeyframeValueList& values, const IntSize& boxSize, const Animation* animation, const String& animationName, double timeOffset)
+{
+    return m_layer->addAnimation(values, boxSize, animation, mapAnimationNameToId(animationName), s_nextGroupId++, timeOffset);
+}
+
+void GraphicsLayerChromium::pauseAnimation(const String& animationName, double timeOffset)
+{
+    m_layer->pauseAnimation(mapAnimationNameToId(animationName), timeOffset);
+}
+
+void GraphicsLayerChromium::removeAnimation(const String& animationName)
+{
+    m_layer->removeAnimation(mapAnimationNameToId(animationName));
+}
+
+void GraphicsLayerChromium::suspendAnimations(double time)
+{
+    m_layer->suspendAnimations(time);
+}
+
+void GraphicsLayerChromium::resumeAnimations()
+{
+    m_layer->resumeAnimations();
+}
+
 void GraphicsLayerChromium::setContentsToMedia(PlatformLayer* layer)
 {
     bool childrenChanged = false;
@@ -383,12 +425,12 @@ void GraphicsLayerChromium::setContentsToMedia(PlatformLayer* layer)
     } else {
         if (m_contentsLayer) {
             childrenChanged = true;
-  
+
             // The old contents layer will be removed via updateChildList.
             m_contentsLayer = 0;
         }
     }
-  
+
     if (childrenChanged)
         updateChildList();
 }
@@ -537,7 +579,7 @@ void GraphicsLayerChromium::updateLayerPreserves3D()
         m_layer->setAnchorPoint(FloatPoint(0.5f, 0.5f));
         TransformationMatrix identity;
         m_layer->setTransform(identity);
-        
+
         // Set the old layer to opacity of 1. Further down we will set the opacity on the transform layer.
         m_layer->setOpacity(1);
 
@@ -676,6 +718,12 @@ void GraphicsLayerChromium::paintContents(GraphicsContext& context, const IntRec
     paintGraphicsLayerContents(context, clip);
 }
 
+int GraphicsLayerChromium::mapAnimationNameToId(const String& animationName)
+{
+    // FIXME: need to maintain a name to id mapping in this class.
+    return 0;
+}
+
 } // namespace WebCore
 
 #endif // USE(ACCELERATED_COMPOSITING)
diff --git a/Source/WebCore/platform/graphics/chromium/GraphicsLayerChromium.h b/Source/WebCore/platform/graphics/chromium/GraphicsLayerChromium.h
index 39b367b9d..eb3146bbd 100644
--- a/Source/WebCore/platform/graphics/chromium/GraphicsLayerChromium.h
+++ b/Source/WebCore/platform/graphics/chromium/GraphicsLayerChromium.h
@@ -82,6 +82,9 @@ public:
 
     virtual void setOpacity(float);
 
+    // Returns true if filter can be rendered by the compositor
+    virtual bool setFilters(const FilterOperations&);
+
     virtual void setNeedsDisplay();
     virtual void setNeedsDisplayInRect(const FloatRect&);
     virtual void setContentsNeedsDisplay();
@@ -92,6 +95,12 @@ public:
     virtual void setContentsToMedia(PlatformLayer*);
     virtual void setContentsToCanvas(PlatformLayer*);
 
+    virtual bool addAnimation(const KeyframeValueList&, const IntSize& boxSize, const Animation*, const String&, double timeOffset);
+    virtual void pauseAnimation(const String& animationName, double timeOffset);
+    virtual void removeAnimation(const String& animationName);
+    virtual void suspendAnimations(double time);
+    virtual void resumeAnimations();
+
     virtual PlatformLayer* platformLayer() const;
 
     virtual void setDebugBackgroundColor(const Color&);
@@ -129,6 +138,8 @@ private:
     void setupContentsLayer(LayerChromium*);
     float contentsScale() const;
 
+    int mapAnimationNameToId(const String& animationName);
+
     String m_nameBase;
 
     RefPtr<ContentLayerChromium> m_layer;
diff --git a/Source/WebCore/platform/graphics/chromium/LayerChromium.cpp b/Source/WebCore/platform/graphics/chromium/LayerChromium.cpp
index 8d0fe03b6..8eeda68a4 100644
--- a/Source/WebCore/platform/graphics/chromium/LayerChromium.cpp
+++ b/Source/WebCore/platform/graphics/chromium/LayerChromium.cpp
@@ -33,6 +33,7 @@
 #if USE(ACCELERATED_COMPOSITING)
 #include "LayerChromium.h"
 
+#include "cc/CCLayerAnimationController.h"
 #include "cc/CCLayerImpl.h"
 #include "cc/CCLayerTreeHost.h"
 #if USE(SKIA)
@@ -59,7 +60,9 @@ LayerChromium::LayerChromium()
     : m_needsDisplay(false)
     , m_layerId(s_nextLayerId++)
     , m_parent(0)
+    , m_layerAnimationController(CCLayerAnimationController::create())
     , m_scrollable(false)
+    , m_haveWheelEventHandlers(false)
     , m_anchorPoint(0.5, 0.5)
     , m_backgroundColor(0, 0, 0, 0)
     , m_backgroundCoversViewport(false)
@@ -92,6 +95,52 @@ LayerChromium::~LayerChromium()
     removeAllChildren();
 }
 
+bool LayerChromium::addAnimation(const KeyframeValueList& values, const IntSize& boxSize, const Animation* animation, int animationId, int groupId, double timeOffset)
+{
+    if (!m_layerTreeHost || !m_layerTreeHost->settings().threadedAnimationEnabled)
+        return false;
+
+    bool addedAnimation = m_layerAnimationController->addAnimation(values, boxSize, animation, animationId, groupId, timeOffset);
+    if (addedAnimation)
+        setNeedsCommit();
+    return addedAnimation;
+}
+
+void LayerChromium::pauseAnimation(int animationId, double timeOffset)
+{
+    m_layerAnimationController->pauseAnimation(animationId, timeOffset);
+    setNeedsCommit();
+}
+
+void LayerChromium::removeAnimation(int animationId)
+{
+    m_layerAnimationController->removeAnimation(animationId);
+    setNeedsCommit();
+}
+
+void LayerChromium::suspendAnimations(double time)
+{
+    m_layerAnimationController->suspendAnimations(time);
+    setNeedsCommit();
+}
+
+void LayerChromium::resumeAnimations()
+{
+    m_layerAnimationController->resumeAnimations();
+    setNeedsCommit();
+}
+
+void LayerChromium::setLayerAnimationController(PassOwnPtr<CCLayerAnimationController> layerAnimationController)
+{
+    m_layerAnimationController = layerAnimationController;
+    setNeedsCommit();
+}
+
+bool LayerChromium::hasActiveAnimation() const
+{
+    return m_layerAnimationController->hasActiveAnimation();
+}
+
 void LayerChromium::setIsNonCompositedContent(bool isNonCompositedContent)
 {
     m_isNonCompositedContent = isNonCompositedContent;
@@ -305,6 +354,14 @@ void LayerChromium::setReplicaLayer(LayerChromium* layer)
     setNeedsCommit();
 }
 
+void LayerChromium::setFilters(const FilterOperations& filters)
+{
+    if (m_filters == filters)
+        return;
+    m_filters = filters;
+    setNeedsCommit();
+}
+
 void LayerChromium::setOpacity(float opacity)
 {
     if (m_opacity == opacity)
@@ -361,6 +418,14 @@ void LayerChromium::setScrollable(bool scrollable)
     setNeedsCommit();
 }
 
+void LayerChromium::setHaveWheelEventHandlers(bool haveWheelEventHandlers)
+{
+    if (m_haveWheelEventHandlers == haveWheelEventHandlers)
+        return;
+    m_haveWheelEventHandlers = haveWheelEventHandlers;
+    setNeedsCommit();
+}
+
 void LayerChromium::setDoubleSided(bool doubleSided)
 {
     if (m_doubleSided == doubleSided)
@@ -411,9 +476,11 @@ void LayerChromium::pushPropertiesTo(CCLayerImpl* layer)
     layer->setDebugBorderWidth(m_debugBorderWidth);
     layer->setDoubleSided(m_doubleSided);
     layer->setDrawsContent(drawsContent());
+    layer->setFilters(filters());
     layer->setIsNonCompositedContent(m_isNonCompositedContent);
     layer->setMasksToBounds(m_masksToBounds);
     layer->setScrollable(m_scrollable);
+    layer->setHaveWheelEventHandlers(m_haveWheelEventHandlers);
     layer->setName(m_name);
     layer->setOpaque(m_opaque);
     layer->setOpacity(m_opacity);
@@ -432,6 +499,8 @@ void LayerChromium::pushPropertiesTo(CCLayerImpl* layer)
     if (replicaLayer())
         replicaLayer()->pushPropertiesTo(layer->replicaLayer());
 
+    m_layerAnimationController->synchronizeAnimations(layer->layerAnimationController());
+
     // Reset any state that should be cleared for the next update.
     m_updateRect = FloatRect();
 }
@@ -494,6 +563,7 @@ void LayerChromium::createRenderSurface()
 {
     ASSERT(!m_renderSurface);
     m_renderSurface = adoptPtr(new RenderSurfaceChromium(this));
+    setTargetRenderSurface(m_renderSurface.get());
 }
 
 bool LayerChromium::descendantDrawsContent()
diff --git a/Source/WebCore/platform/graphics/chromium/LayerChromium.h b/Source/WebCore/platform/graphics/chromium/LayerChromium.h
index a0758131f..897647d2d 100644
--- a/Source/WebCore/platform/graphics/chromium/LayerChromium.h
+++ b/Source/WebCore/platform/graphics/chromium/LayerChromium.h
@@ -34,6 +34,7 @@
 
 #if USE(ACCELERATED_COMPOSITING)
 
+#include "FilterOperations.h"
 #include "FloatPoint.h"
 #include "GraphicsContext.h"
 #include "PlatformString.h"
@@ -51,6 +52,7 @@
 
 namespace WebCore {
 
+class CCLayerAnimationController;
 class CCLayerImpl;
 class CCLayerTreeHost;
 class CCTextureUpdater;
@@ -60,7 +62,6 @@ class Region;
 // Base class for composited layers. Special layer types are derived from
 // this class.
 class LayerChromium : public RefCounted<LayerChromium> {
-    friend class LayerTilerChromium;
 public:
     static PassRefPtr<LayerChromium> create();
 
@@ -102,12 +103,15 @@ public:
     LayerChromium* maskLayer() const { return m_maskLayer.get(); }
 
     virtual void setNeedsDisplayRect(const FloatRect& dirtyRect);
-    void setNeedsDisplay() { setNeedsDisplayRect(FloatRect(FloatPoint(), contentBounds())); }
+    void setNeedsDisplay() { setNeedsDisplayRect(FloatRect(FloatPoint(), bounds())); }
     virtual bool needsDisplay() const { return m_needsDisplay; }
 
     void setOpacity(float);
     float opacity() const { return m_opacity; }
 
+    void setFilters(const FilterOperations&);
+    const FilterOperations& filters() const { return m_filters; }
+
     virtual void setOpaque(bool);
     bool opaque() const { return m_opaque; }
 
@@ -127,7 +131,7 @@ public:
     const IntPoint& scrollPosition() const { return m_scrollPosition; }
 
     void setScrollable(bool);
-    bool scrollable() const { return m_scrollable; }
+    void setHaveWheelEventHandlers(bool);
 
     IntSize scrollDelta() const { return IntSize(); }
 
@@ -211,7 +215,22 @@ public:
     void setAlwaysReserveTextures(bool alwaysReserveTextures) { m_alwaysReserveTextures = alwaysReserveTextures; }
     bool alwaysReserveTextures() const { return m_alwaysReserveTextures; }
 
+    bool addAnimation(const KeyframeValueList&, const IntSize& boxSize, const Animation*, int animationId, int groupId, double timeOffset);
+    void pauseAnimation(int animationId, double timeOffset);
+    void removeAnimation(int animationId);
+
+    void suspendAnimations(double time);
+    void resumeAnimations();
+
+    CCLayerAnimationController* layerAnimationController() { return m_layerAnimationController.get(); }
+    void setLayerAnimationController(PassOwnPtr<CCLayerAnimationController>);
+    bool hasActiveAnimation() const;
+
 protected:
+    friend class CCLayerImpl;
+    friend class LayerTilerChromium;
+    friend class TreeSynchronizer;
+
     LayerChromium();
 
     bool isPaintedAxisAlignedInScreen() const;
@@ -229,8 +248,6 @@ protected:
 
     RefPtr<LayerChromium> m_maskLayer;
 
-    friend class TreeSynchronizer;
-    friend class CCLayerImpl;
     // Constructs a CCLayerImpl of the correct runtime type for this LayerChromium type.
     virtual PassRefPtr<CCLayerImpl> createCCLayerImpl();
     int m_layerId;
@@ -239,10 +256,7 @@ private:
     void setParent(LayerChromium*);
     bool hasAncestor(LayerChromium*) const;
 
-    size_t numChildren() const
-    {
-        return m_children.size();
-    }
+    size_t numChildren() const { return m_children.size(); }
 
     // Returns the index of the child or -1 if not found.
     int indexOfChild(const LayerChromium*);
@@ -255,11 +269,14 @@ private:
 
     RefPtr<CCLayerTreeHost> m_layerTreeHost;
 
+    OwnPtr<CCLayerAnimationController> m_layerAnimationController;
+
     // Layer properties.
     IntSize m_bounds;
     IntRect m_visibleLayerRect;
     IntPoint m_scrollPosition;
     bool m_scrollable;
+    bool m_haveWheelEventHandlers;
     FloatPoint m_position;
     FloatPoint m_anchorPoint;
     Color m_backgroundColor;
@@ -267,6 +284,7 @@ private:
     Color m_debugBorderColor;
     float m_debugBorderWidth;
     float m_opacity;
+    FilterOperations m_filters;
     float m_anchorPointZ;
     bool m_isDrawable;
     bool m_masksToBounds;
diff --git a/Source/WebCore/platform/graphics/chromium/LayerRendererChromium.cpp b/Source/WebCore/platform/graphics/chromium/LayerRendererChromium.cpp
index 1e5ee563f..542b3ad1c 100644
--- a/Source/WebCore/platform/graphics/chromium/LayerRendererChromium.cpp
+++ b/Source/WebCore/platform/graphics/chromium/LayerRendererChromium.cpp
@@ -477,7 +477,7 @@ void LayerRendererChromium::drawSolidColorQuad(const CCSolidColorDrawQuad* quad)
 
     const Color& color = quad->color();
 
-    GLC(context(), context()->uniform4f(solidColorProgram->fragmentShader().colorLocation(), color.red(), color.green(), color.blue(), color.alpha()));
+    GLC(context(), context()->uniform4f(solidColorProgram->fragmentShader().colorLocation(), color.red() / 255.0, color.green() / 255.0, color.blue() / 255.0, color.alpha() / 255.0));
 
     float opacity = quad->opacity();
     drawTexturedQuad(tileTransform,
@@ -694,10 +694,154 @@ void LayerRendererChromium::drawCanvasQuad(const CCCanvasDrawQuad* quad)
     GLC(m_context.get(), m_context->blendFunc(GraphicsContext3D::ONE, GraphicsContext3D::ONE_MINUS_SRC_ALPHA));
 }
 
+void LayerRendererChromium::drawYUV(const CCVideoDrawQuad* quad)
+{
+    const CCVideoLayerImpl::YUVProgram* program = videoLayerYUVProgram();
+    ASSERT(program && program->initialized());
+
+    const CCVideoLayerImpl::Texture& yTexture = quad->textures()[VideoFrameChromium::yPlane];
+    const CCVideoLayerImpl::Texture& uTexture = quad->textures()[VideoFrameChromium::uPlane];
+    const CCVideoLayerImpl::Texture& vTexture = quad->textures()[VideoFrameChromium::vPlane];
+
+    GLC(context(), context()->activeTexture(GraphicsContext3D::TEXTURE1));
+    GLC(context(), context()->bindTexture(GraphicsContext3D::TEXTURE_2D, yTexture.m_texture->textureId()));
+    GLC(context(), context()->activeTexture(GraphicsContext3D::TEXTURE2));
+    GLC(context(), context()->bindTexture(GraphicsContext3D::TEXTURE_2D, uTexture.m_texture->textureId()));
+    GLC(context(), context()->activeTexture(GraphicsContext3D::TEXTURE3));
+    GLC(context(), context()->bindTexture(GraphicsContext3D::TEXTURE_2D, vTexture.m_texture->textureId()));
+
+    GLC(context(), context()->useProgram(program->program()));
+
+    float yWidthScaleFactor = static_cast<float>(yTexture.m_visibleSize.width()) / yTexture.m_texture->size().width();
+    // Arbitrarily take the u sizes because u and v dimensions are identical.
+    float uvWidthScaleFactor = static_cast<float>(uTexture.m_visibleSize.width()) / uTexture.m_texture->size().width();
+    GLC(context(), context()->uniform1f(program->vertexShader().yWidthScaleFactorLocation(), yWidthScaleFactor));
+    GLC(context(), context()->uniform1f(program->vertexShader().uvWidthScaleFactorLocation(), uvWidthScaleFactor));
+
+    GLC(context(), context()->uniform1i(program->fragmentShader().yTextureLocation(), 1));
+    GLC(context(), context()->uniform1i(program->fragmentShader().uTextureLocation(), 2));
+    GLC(context(), context()->uniform1i(program->fragmentShader().vTextureLocation(), 3));
+
+    GLC(context(), context()->uniformMatrix3fv(program->fragmentShader().ccMatrixLocation(), 0, const_cast<float*>(CCVideoLayerImpl::yuv2RGB), 1));
+    GLC(context(), context()->uniform3fv(program->fragmentShader().yuvAdjLocation(), const_cast<float*>(CCVideoLayerImpl::yuvAdjust), 1));
+
+    const IntSize& bounds = quad->quadRect().size();
+    drawTexturedQuad(quad->layerTransform(), bounds.width(), bounds.height(), quad->opacity(), FloatQuad(),
+                                    program->vertexShader().matrixLocation(),
+                                    program->fragmentShader().alphaLocation(),
+                                    -1);
+
+    // Reset active texture back to texture 0.
+    GLC(context(), context()->activeTexture(GraphicsContext3D::TEXTURE0));
+}
+
+template<class Program>
+void LayerRendererChromium::drawSingleTextureVideoQuad(const CCVideoDrawQuad* quad, Program* program, float widthScaleFactor, Platform3DObject textureId, GC3Denum target)
+{
+    ASSERT(program && program->initialized());
+
+    GLC(context(), context()->activeTexture(GraphicsContext3D::TEXTURE0));
+    GLC(context(), context()->bindTexture(target, textureId));
+
+    GLC(context(), context()->useProgram(program->program()));
+    GLC(context(), context()->uniform4f(program->vertexShader().texTransformLocation(), 0, 0, widthScaleFactor, 1));
+    GLC(context(), context()->uniform1i(program->fragmentShader().samplerLocation(), 0));
+
+    const IntSize& bounds = quad->quadRect().size();
+    drawTexturedQuad(quad->layerTransform(), bounds.width(), bounds.height(), quad->opacity(), sharedGeometryQuad(),
+                                    program->vertexShader().matrixLocation(),
+                                    program->fragmentShader().alphaLocation(),
+                                    -1);
+}
+
+void LayerRendererChromium::drawRGBA(const CCVideoDrawQuad* quad)
+{
+    const CCVideoLayerImpl::RGBAProgram* program = videoLayerRGBAProgram();
+    const CCVideoLayerImpl::Texture& texture = quad->textures()[VideoFrameChromium::rgbPlane];
+    float widthScaleFactor = static_cast<float>(texture.m_visibleSize.width()) / texture.m_texture->size().width();
+    drawSingleTextureVideoQuad(quad, program, widthScaleFactor, texture.m_texture->textureId(), GraphicsContext3D::TEXTURE_2D);
+}
+
+void LayerRendererChromium::drawNativeTexture2D(const CCVideoDrawQuad* quad)
+{
+    const CCVideoLayerImpl::NativeTextureProgram* program = videoLayerNativeTextureProgram();
+    drawSingleTextureVideoQuad(quad, program, 1, quad->frame()->textureId(), GraphicsContext3D::TEXTURE_2D);
+}
+
+void LayerRendererChromium::drawStreamTexture(const CCVideoDrawQuad* quad)
+{
+    ASSERT(context()->getExtensions()->supports("GL_OES_EGL_image_external") && context()->getExtensions()->isEnabled("GL_OES_EGL_image_external"));
+
+    const CCVideoLayerImpl::StreamTextureProgram* program = streamTextureLayerProgram();
+    GLC(context(), context()->useProgram(program->program()));
+    ASSERT(quad->matrix());
+    GLC(context(), context()->uniformMatrix4fv(program->vertexShader().texMatrixLocation(), false, const_cast<float*>(quad->matrix()), 1));
+
+    drawSingleTextureVideoQuad(quad, program, 1, quad->frame()->textureId(), Extensions3DChromium::GL_TEXTURE_EXTERNAL_OES);
+}
+
+bool LayerRendererChromium::copyFrameToTextures(const CCVideoDrawQuad* quad)
+{
+    const VideoFrameChromium* frame = quad->frame();
+
+    for (unsigned plane = 0; plane < frame->planes(); ++plane) {
+        ASSERT(quad->frame()->requiredTextureSize(plane) == quad->textures()[plane].m_texture->size());
+        copyPlaneToTexture(quad, frame->data(plane), plane);
+    }
+    for (unsigned plane = frame->planes(); plane < CCVideoLayerImpl::MaxPlanes; ++plane) {
+        CCVideoLayerImpl::Texture* texture = &quad->textures()[plane];
+        texture->m_texture.clear();
+        texture->m_visibleSize = IntSize();
+    }
+    return true;
+}
+
+void LayerRendererChromium::copyPlaneToTexture(const CCVideoDrawQuad* quad, const void* plane, int index)
+{
+    CCVideoLayerImpl::Texture& texture = quad->textures()[index];
+    TextureAllocator* allocator = renderSurfaceTextureAllocator();
+    texture.m_texture->bindTexture(context(), allocator);
+    GC3Denum format = texture.m_texture->format();
+    IntSize dimensions = texture.m_texture->size();
+
+    void* mem = static_cast<Extensions3DChromium*>(context()->getExtensions())->mapTexSubImage2DCHROMIUM(GraphicsContext3D::TEXTURE_2D, 0, 0, 0, dimensions.width(), dimensions.height(), format, GraphicsContext3D::UNSIGNED_BYTE, Extensions3DChromium::WRITE_ONLY);
+    if (mem) {
+        memcpy(mem, plane, dimensions.width() * dimensions.height());
+        GLC(context(), static_cast<Extensions3DChromium*>(context()->getExtensions())->unmapTexSubImage2DCHROMIUM(mem));
+    } else {
+        // If mapTexSubImage2DCHROMIUM fails, then do the slower texSubImage2D
+        // upload. This does twice the copies as mapTexSubImage2DCHROMIUM, one
+        // in the command buffer and another to the texture.
+        GLC(context(), context()->texSubImage2D(GraphicsContext3D::TEXTURE_2D, 0, 0, 0, dimensions.width(), dimensions.height(), format, GraphicsContext3D::UNSIGNED_BYTE, plane));
+    }
+}
+
 void LayerRendererChromium::drawVideoQuad(const CCVideoDrawQuad* quad)
 {
-    CCLayerImpl* layer = quad->layer();
-    layer->draw(this);
+    ASSERT(CCProxy::isImplThread());
+
+    if (!quad->frame())
+        return;
+
+    if (!copyFrameToTextures(quad))
+        return;
+
+    switch (quad->format()) {
+    case GraphicsContext3D::LUMINANCE:
+        drawYUV(quad);
+        break;
+    case GraphicsContext3D::RGBA:
+        drawRGBA(quad);
+        break;
+    case GraphicsContext3D::TEXTURE_2D:
+        drawNativeTexture2D(quad);
+        break;
+    case Extensions3DChromium::GL_TEXTURE_EXTERNAL_OES:
+        drawStreamTexture(quad);
+        break;
+    default:
+        CRASH(); // Someone updated convertVFCFormatToGC3DFormat above but update this!
+    }
 }
 
 struct PluginProgramBinding {
@@ -1255,6 +1399,16 @@ const CCVideoLayerImpl::NativeTextureProgram* LayerRendererChromium::videoLayerN
     return m_videoLayerNativeTextureProgram.get();
 }
 
+const CCVideoLayerImpl::StreamTextureProgram* LayerRendererChromium::streamTextureLayerProgram()
+{
+    if (!m_streamTextureLayerProgram)
+        m_streamTextureLayerProgram = adoptPtr(new CCVideoLayerImpl::StreamTextureProgram(m_context.get()));
+    if (!m_streamTextureLayerProgram->initialized()) {
+        TRACE_EVENT("LayerRendererChromium::streamTextureLayerProgram::initialize", this, 0);
+        m_streamTextureLayerProgram->initialize(m_context.get());
+    }
+    return m_streamTextureLayerProgram.get();
+}
 
 void LayerRendererChromium::cleanupSharedObjects()
 {
@@ -1296,6 +1450,8 @@ void LayerRendererChromium::cleanupSharedObjects()
         m_videoLayerRGBAProgram->cleanup(m_context.get());
     if (m_videoLayerYUVProgram)
         m_videoLayerYUVProgram->cleanup(m_context.get());
+    if (m_streamTextureLayerProgram)
+        m_streamTextureLayerProgram->cleanup(m_context.get());
 
     m_borderProgram.clear();
     m_headsUpDisplayProgram.clear();
@@ -1314,6 +1470,7 @@ void LayerRendererChromium::cleanupSharedObjects()
     m_renderSurfaceProgramAA.clear();
     m_videoLayerRGBAProgram.clear();
     m_videoLayerYUVProgram.clear();
+    m_streamTextureLayerProgram.clear();
     if (m_offscreenFramebufferId)
         GLC(m_context.get(), m_context->deleteFramebuffer(m_offscreenFramebufferId));
 
diff --git a/Source/WebCore/platform/graphics/chromium/LayerRendererChromium.h b/Source/WebCore/platform/graphics/chromium/LayerRendererChromium.h
index bea4baa41..ee9895ae1 100644
--- a/Source/WebCore/platform/graphics/chromium/LayerRendererChromium.h
+++ b/Source/WebCore/platform/graphics/chromium/LayerRendererChromium.h
@@ -130,6 +130,7 @@ public:
     const CCVideoLayerImpl::RGBAProgram* videoLayerRGBAProgram();
     const CCVideoLayerImpl::YUVProgram* videoLayerYUVProgram();
     const CCVideoLayerImpl::NativeTextureProgram* videoLayerNativeTextureProgram();
+    const CCVideoLayerImpl::StreamTextureProgram* streamTextureLayerProgram();
 
     void getFramebufferPixels(void *pixels, const IntRect&);
 
@@ -168,6 +169,14 @@ private:
     void drawPluginQuad(const CCPluginDrawQuad*);
 
     ManagedTexture* getOffscreenLayerTexture();
+    void copyPlaneToTexture(const CCVideoDrawQuad*, const void* plane, int index);
+    bool copyFrameToTextures(const CCVideoDrawQuad*);
+    template<class Program> void drawSingleTextureVideoQuad(const CCVideoDrawQuad*, Program*, float widthScaleFactor, Platform3DObject textureId, GC3Denum target);
+    void drawNativeTexture2D(const CCVideoDrawQuad*);
+    void drawStreamTexture(const CCVideoDrawQuad*);
+    void drawRGBA(const CCVideoDrawQuad*);
+    void drawYUV(const CCVideoDrawQuad*);
+
     void copyOffscreenTextureToDisplay();
 
     void setDrawViewportRect(const IntRect&, bool flipY);
@@ -226,6 +235,7 @@ private:
     OwnPtr<CCVideoLayerImpl::RGBAProgram> m_videoLayerRGBAProgram;
     OwnPtr<CCVideoLayerImpl::YUVProgram> m_videoLayerYUVProgram;
     OwnPtr<CCVideoLayerImpl::NativeTextureProgram> m_videoLayerNativeTextureProgram;
+    OwnPtr<CCVideoLayerImpl::StreamTextureProgram> m_streamTextureLayerProgram;
 
     OwnPtr<TextureManager> m_renderSurfaceTextureManager;
     OwnPtr<TrackingTextureAllocator> m_contentsTextureAllocator;
diff --git a/Source/WebCore/platform/graphics/chromium/RenderSurfaceChromium.cpp b/Source/WebCore/platform/graphics/chromium/RenderSurfaceChromium.cpp
index 73f3ab27a..69ce9526c 100644
--- a/Source/WebCore/platform/graphics/chromium/RenderSurfaceChromium.cpp
+++ b/Source/WebCore/platform/graphics/chromium/RenderSurfaceChromium.cpp
@@ -29,6 +29,7 @@
 
 #include "RenderSurfaceChromium.h"
 
+#include "FilterOperations.h"
 #include "GraphicsContext3D.h"
 #include "LayerChromium.h"
 #include "LayerRendererChromium.h"
@@ -41,6 +42,7 @@ RenderSurfaceChromium::RenderSurfaceChromium(LayerChromium* owningLayer)
     , m_maskLayer(0)
     , m_skipsDraw(false)
     , m_drawOpacity(1)
+    , m_nearestAncestorThatMovesPixels(0)
 {
 }
 
diff --git a/Source/WebCore/platform/graphics/chromium/RenderSurfaceChromium.h b/Source/WebCore/platform/graphics/chromium/RenderSurfaceChromium.h
index 3c6f1649a..9045425bc 100644
--- a/Source/WebCore/platform/graphics/chromium/RenderSurfaceChromium.h
+++ b/Source/WebCore/platform/graphics/chromium/RenderSurfaceChromium.h
@@ -39,6 +39,7 @@
 
 namespace WebCore {
 
+class FilterOperations;
 class LayerChromium;
 class LayerRendererChromium;
 class ManagedTexture;
@@ -76,6 +77,9 @@ public:
     const IntRect& clipRect() const { return m_clipRect; }
     void setClipRect(const IntRect& clipRect) { m_clipRect = clipRect; }
 
+    void setFilters(const FilterOperations& filters) { m_filters = filters; }
+    const FilterOperations& filters() const { return m_filters; }
+
     bool skipsDraw() const { return m_skipsDraw; }
     void setSkipsDraw(bool skipsDraw) { m_skipsDraw = skipsDraw; }
 
@@ -84,6 +88,9 @@ public:
 
     void setMaskLayer(LayerChromium* maskLayer) { m_maskLayer = maskLayer; }
 
+    void setNearestAncestorThatMovesPixels(RenderSurfaceChromium* surface) { m_nearestAncestorThatMovesPixels = surface; }
+    const RenderSurfaceChromium* nearestAncestorThatMovesPixels() const { return m_nearestAncestorThatMovesPixels; }
+
 private:
     LayerChromium* m_owningLayer;
     LayerChromium* m_maskLayer;
@@ -95,9 +102,14 @@ private:
     TransformationMatrix m_drawTransform;
     TransformationMatrix m_replicaDrawTransform;
     TransformationMatrix m_originTransform;
+    FilterOperations m_filters;
     IntRect m_clipRect;
     Vector<RefPtr<LayerChromium> > m_layerList;
 
+    // The nearest ancestor target surface that will contain the contents of this surface, and that is going
+    // to move pixels within the surface (such as with a blur). This can point to itself.
+    RenderSurfaceChromium* m_nearestAncestorThatMovesPixels;
+
     // For CCLayerIteratorActions
     int m_targetRenderSurfaceLayerIndexHistory;
     int m_currentLayerIndexHistory;
diff --git a/Source/WebCore/platform/graphics/chromium/ShaderChromium.cpp b/Source/WebCore/platform/graphics/chromium/ShaderChromium.cpp
index f69b6b18a..71d4d1fd1 100644
--- a/Source/WebCore/platform/graphics/chromium/ShaderChromium.cpp
+++ b/Source/WebCore/platform/graphics/chromium/ShaderChromium.cpp
@@ -255,6 +255,39 @@ String VertexShaderTile::getShaderString() const
     );
 }
 
+VertexShaderVideoTransform::VertexShaderVideoTransform()
+    : m_matrixLocation(-1)
+    , m_texTransformLocation(-1)
+    , m_texMatrixLocation(-1)
+{
+}
+
+bool VertexShaderVideoTransform::init(GraphicsContext3D* context, unsigned program)
+{
+    m_matrixLocation = context->getUniformLocation(program, "matrix");
+    m_texTransformLocation = context->getUniformLocation(program, "texTransform");
+    m_texMatrixLocation = context->getUniformLocation(program, "texMatrix");
+    return m_matrixLocation != -1 && m_texTransformLocation != -1 && m_texMatrixLocation != -1;
+}
+
+String VertexShaderVideoTransform::getShaderString() const
+{
+    return SHADER(
+        attribute vec4 a_position;
+        attribute vec2 a_texCoord;
+        uniform mat4 matrix;
+        uniform vec4 texTransform;
+        uniform mat4 texMatrix;
+        varying vec2 v_texCoord;
+        void main()
+        {
+            gl_Position = matrix * a_position;
+            vec2 texCoord = vec2(texMatrix * vec4(a_texCoord.x, 1.0 - a_texCoord.y, 0.0, 1.0));
+            v_texCoord = texCoord * texTransform.zw + texTransform.xy;
+        }
+    );
+}
+
 FragmentTexAlphaBinding::FragmentTexAlphaBinding()
     : m_samplerLocation(-1)
     , m_alphaLocation(-1)
@@ -296,6 +329,27 @@ String FragmentShaderRGBATexFlipAlpha::getShaderString() const
     );
 }
 
+bool FragmentShaderOESImageExternal::init(GraphicsContext3D* context, unsigned program)
+{
+    m_samplerLocation = context->getUniformLocation(program, "s_texture");
+
+    return m_samplerLocation != -1;
+}
+
+String FragmentShaderOESImageExternal::getShaderString() const
+{
+    // Cannot use the SHADER() macro because of the '#' char
+    return "#extension GL_OES_EGL_image_external : require \n"
+           "precision mediump float;\n"
+           "varying vec2 v_texCoord;\n"
+           "uniform samplerExternalOES s_texture;\n"
+           "void main()\n"
+           "{\n"
+           "    vec4 texColor = texture2D(s_texture, v_texCoord);\n"
+           "    gl_FragColor = vec4(texColor.x, texColor.y, texColor.z, texColor.w);\n"
+           "}\n";
+}
+
 String FragmentShaderRGBATexAlpha::getShaderString() const
 {
     return SHADER(
diff --git a/Source/WebCore/platform/graphics/chromium/ShaderChromium.h b/Source/WebCore/platform/graphics/chromium/ShaderChromium.h
index 34323e6d3..9499ac7fd 100644
--- a/Source/WebCore/platform/graphics/chromium/ShaderChromium.h
+++ b/Source/WebCore/platform/graphics/chromium/ShaderChromium.h
@@ -145,6 +145,23 @@ private:
     int m_vertexTexTransformLocation;
 };
 
+class VertexShaderVideoTransform {
+public:
+    VertexShaderVideoTransform();
+
+    bool init(GraphicsContext3D*, unsigned program);
+    String getShaderString() const;
+
+    int matrixLocation() const { return m_matrixLocation; }
+    int texTransformLocation() const { return m_texTransformLocation; }
+    int texMatrixLocation() const { return m_texMatrixLocation; }
+
+private:
+    int m_matrixLocation;
+    int m_texTransformLocation;
+    int m_texMatrixLocation;
+};
+
 class FragmentTexAlphaBinding {
 public:
     FragmentTexAlphaBinding();
@@ -211,6 +228,15 @@ public:
     String getShaderString() const;
 };
 
+// Fragment shader for external textures.
+class FragmentShaderOESImageExternal : public FragmentTexAlphaBinding {
+public:
+    String getShaderString() const;
+    bool init(GraphicsContext3D*, unsigned program);
+private:
+    int m_samplerLocation;
+};
+
 class FragmentShaderRGBATexAlphaAA {
 public:
     FragmentShaderRGBATexAlphaAA();
diff --git a/Source/WebCore/platform/graphics/chromium/SkPictureCanvasLayerTextureUpdater.h b/Source/WebCore/platform/graphics/chromium/SkPictureCanvasLayerTextureUpdater.h
index 7fcc6059f..ecdefa411 100644
--- a/Source/WebCore/platform/graphics/chromium/SkPictureCanvasLayerTextureUpdater.h
+++ b/Source/WebCore/platform/graphics/chromium/SkPictureCanvasLayerTextureUpdater.h
@@ -48,13 +48,15 @@ class SkPictureCanvasLayerTextureUpdater : public CanvasLayerTextureUpdater {
 public:
     virtual ~SkPictureCanvasLayerTextureUpdater();
 
+    virtual void setOpaque(bool);
+
 protected:
     explicit SkPictureCanvasLayerTextureUpdater(PassOwnPtr<LayerPainterChromium>);
 
     virtual void prepareToUpdate(const IntRect& contentRect, const IntSize& tileSize, int borderTexels, float contentsScale, IntRect* resultingOpaqueRect);
     void drawPicture(SkCanvas*);
 
-    virtual void setOpaque(bool);
+    bool layerIsOpaque() const { return m_layerIsOpaque; }
 
 private:
     // Recording canvas.
diff --git a/Source/WebCore/platform/graphics/chromium/TextureManager.cpp b/Source/WebCore/platform/graphics/chromium/TextureManager.cpp
index 131a9c70e..0c6fe14f9 100644
--- a/Source/WebCore/platform/graphics/chromium/TextureManager.cpp
+++ b/Source/WebCore/platform/graphics/chromium/TextureManager.cpp
@@ -184,6 +184,12 @@ void TextureManager::unprotectAllTextures()
         it->second.isProtected = false;
 }
 
+void TextureManager::evictTexture(TextureToken token, TextureInfo info)
+{
+    TRACE_EVENT("TextureManager::evictTexture", this, 0);
+    removeTexture(token, info);
+}
+
 void TextureManager::reduceMemoryToLimit(size_t limit)
 {
     while (m_memoryUseBytes > limit) {
@@ -194,7 +200,7 @@ void TextureManager::reduceMemoryToLimit(size_t limit)
             TextureInfo info = m_textures.get(token);
             if (info.isProtected)
                 continue;
-            removeTexture(token, info);
+            evictTexture(token, info);
             foundCandidate = true;
             break;
         }
diff --git a/Source/WebCore/platform/graphics/chromium/TextureManager.h b/Source/WebCore/platform/graphics/chromium/TextureManager.h
index 8259adb10..e4d6d38b8 100644
--- a/Source/WebCore/platform/graphics/chromium/TextureManager.h
+++ b/Source/WebCore/platform/graphics/chromium/TextureManager.h
@@ -109,6 +109,7 @@ private:
 
     void addTexture(TextureToken, TextureInfo);
     void removeTexture(TextureToken, TextureInfo);
+    void evictTexture(TextureToken, TextureInfo);
 
     HashSet<ManagedTexture*> m_registeredTextures;
 
diff --git a/Source/WebCore/platform/graphics/chromium/TiledLayerChromium.cpp b/Source/WebCore/platform/graphics/chromium/TiledLayerChromium.cpp
index d9e2487d8..a9cf7d6fd 100644
--- a/Source/WebCore/platform/graphics/chromium/TiledLayerChromium.cpp
+++ b/Source/WebCore/platform/graphics/chromium/TiledLayerChromium.cpp
@@ -53,10 +53,9 @@ namespace WebCore {
 class UpdatableTile : public CCLayerTilingData::Tile {
     WTF_MAKE_NONCOPYABLE(UpdatableTile);
 public:
-    explicit UpdatableTile(PassOwnPtr<LayerTextureUpdater::Texture> texture)
-        : m_partialUpdate(false)
-        , m_texture(texture)
+    static PassOwnPtr<UpdatableTile> create(PassOwnPtr<LayerTextureUpdater::Texture> texture)
     {
+        return adoptPtr(new UpdatableTile(texture));
     }
 
     LayerTextureUpdater::Texture* texture() { return m_texture.get(); }
@@ -74,6 +73,12 @@ public:
     IntRect m_opaqueRect;
     bool m_partialUpdate;
 private:
+    explicit UpdatableTile(PassOwnPtr<LayerTextureUpdater::Texture> texture)
+        : m_partialUpdate(false)
+        , m_texture(texture)
+    {
+    }
+
     OwnPtr<LayerTextureUpdater::Texture> m_texture;
 };
 
@@ -292,16 +297,19 @@ UpdatableTile* TiledLayerChromium::tileAt(int i, int j) const
 
 UpdatableTile* TiledLayerChromium::createTile(int i, int j)
 {
-    RefPtr<UpdatableTile> tile = adoptRef(new UpdatableTile(textureUpdater()->createTexture(textureManager())));
-    m_tiler->addTile(tile, i, j);
-    tile->m_dirtyRect = m_tiler->tileRect(tile.get());
+    OwnPtr<UpdatableTile> tile(UpdatableTile::create(textureUpdater()->createTexture(textureManager())));
+    UpdatableTile* addedTile = tile.get();
+    m_tiler->addTile(tile.release(), i, j);
 
-    return tile.get();
+    addedTile->m_dirtyRect = m_tiler->tileRect(addedTile);
+    return addedTile;
 }
 
 void TiledLayerChromium::setNeedsDisplayRect(const FloatRect& dirtyRect)
 {
-    IntRect dirty = enclosingIntRect(dirtyRect);
+    FloatRect scaledDirtyRect(dirtyRect);
+    scaledDirtyRect.scale(contentsScale());
+    IntRect dirty = enclosingIntRect(scaledDirtyRect);
     invalidateRect(dirty);
     LayerChromium::setNeedsDisplayRect(dirtyRect);
 }
@@ -337,7 +345,7 @@ void TiledLayerChromium::invalidateRect(const IntRect& layerRect)
 
 void TiledLayerChromium::protectVisibleTileTextures()
 {
-    protectTileTextures(IntRect(IntPoint::zero(), contentBounds()));
+    protectTileTextures(visibleLayerRect());
 }
 
 void TiledLayerChromium::protectTileTextures(const IntRect& layerRect)
@@ -466,12 +474,18 @@ void TiledLayerChromium::prepareToUpdateTiles(bool idle, int left, int top, int
 
             IntRect tileRect = m_tiler->tileBounds(i, j);
 
-            // Save what was painted opaque in the tile. If everything painted in the tile was opaque, and the area is a subset of an
-            // already opaque area, keep the old area.
+            // Save what was painted opaque in the tile. Keep the old area if the paint didn't touch it, and didn't paint some
+            // other part of the tile opaque.
             IntRect tilePaintedRect = intersection(tileRect, m_paintRect);
             IntRect tilePaintedOpaqueRect = intersection(tileRect, paintedOpaqueRect);
-            if (tilePaintedOpaqueRect != tilePaintedRect || !tile->m_opaqueRect.contains(tilePaintedOpaqueRect))
-                tile->m_opaqueRect = tilePaintedOpaqueRect;
+            if (!tilePaintedRect.isEmpty()) {
+                IntRect paintInsideTileOpaqueRect = intersection(tile->m_opaqueRect, tilePaintedRect);
+                bool paintInsideTileOpaqueRectIsNonOpaque = !tilePaintedOpaqueRect.contains(paintInsideTileOpaqueRect);
+                bool opaquePaintNotInsideTileOpaqueRect = !tilePaintedOpaqueRect.isEmpty() && !tile->m_opaqueRect.contains(tilePaintedOpaqueRect);
+
+                if (paintInsideTileOpaqueRectIsNonOpaque || opaquePaintNotInsideTileOpaqueRect)
+                    tile->m_opaqueRect = tilePaintedOpaqueRect;
+            }
 
             // Use m_updateRect as copyAndClearDirty above moved the existing dirty rect to m_updateRect.
             const IntRect& dirtyRect = tile->m_updateRect;
@@ -544,7 +558,9 @@ void TiledLayerChromium::addSelfToOccludedScreenSpace(Region& occludedScreenSpac
             if (tile) {
                 IntRect visibleTileOpaqueRect = intersection(visibleRect, tile->m_opaqueRect);
                 FloatRect screenRect = contentTransform.mapRect(FloatRect(visibleTileOpaqueRect));
-                occludedScreenSpace.unite(enclosedIntRect(screenRect));
+                IntRect screenIntRect = enclosedIntRect(screenRect);
+                if (!screenIntRect.isEmpty())
+                    occludedScreenSpace.unite(screenIntRect);
             }
         }
     }
diff --git a/Source/WebCore/platform/graphics/chromium/VideoFrameChromium.h b/Source/WebCore/platform/graphics/chromium/VideoFrameChromium.h
index c4abd969d..2d76c4755 100644
--- a/Source/WebCore/platform/graphics/chromium/VideoFrameChromium.h
+++ b/Source/WebCore/platform/graphics/chromium/VideoFrameChromium.h
@@ -75,6 +75,7 @@ public:
     virtual const IntSize requiredTextureSize(unsigned plane) const = 0;
     virtual bool hasPaddingBytes(unsigned plane) const = 0;
     virtual unsigned textureId() const = 0;
+    virtual unsigned textureTarget() const = 0;
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/platform/graphics/chromium/VideoFrameProvider.h b/Source/WebCore/platform/graphics/chromium/VideoFrameProvider.h
index 3d43a90c3..9794794a7 100644
--- a/Source/WebCore/platform/graphics/chromium/VideoFrameProvider.h
+++ b/Source/WebCore/platform/graphics/chromium/VideoFrameProvider.h
@@ -43,6 +43,8 @@ public:
     public:
         // Provider will call this method to tell the client to stop using it.
         virtual void stopUsingProvider() = 0;
+        virtual void didReceiveFrame() = 0;
+        virtual void didUpdateMatrix(const float*) = 0;
     };
 
     virtual void setVideoFrameProviderClient(Client*) = 0;
diff --git a/Source/WebCore/platform/graphics/chromium/VideoLayerChromium.cpp b/Source/WebCore/platform/graphics/chromium/VideoLayerChromium.cpp
index ae2ae8c80..3b44eda38 100644
--- a/Source/WebCore/platform/graphics/chromium/VideoLayerChromium.cpp
+++ b/Source/WebCore/platform/graphics/chromium/VideoLayerChromium.cpp
@@ -57,6 +57,12 @@ PassRefPtr<CCLayerImpl> VideoLayerChromium::createCCLayerImpl()
     return CCVideoLayerImpl::create(m_layerId, m_provider);
 }
 
+void VideoLayerChromium::contentChanged()
+{
+    m_updateRect = FloatRect(FloatPoint(), contentBounds());
+    setNeedsDisplay();
+}
+
 } // namespace WebCore
 
 #endif // USE(ACCELERATED_COMPOSITING)
diff --git a/Source/WebCore/platform/graphics/chromium/VideoLayerChromium.h b/Source/WebCore/platform/graphics/chromium/VideoLayerChromium.h
index 878806e26..65cf5c668 100644
--- a/Source/WebCore/platform/graphics/chromium/VideoLayerChromium.h
+++ b/Source/WebCore/platform/graphics/chromium/VideoLayerChromium.h
@@ -50,6 +50,8 @@ public:
 
     virtual PassRefPtr<CCLayerImpl> createCCLayerImpl();
 
+    void contentChanged();
+
 private:
     explicit VideoLayerChromium(VideoFrameProvider*);
 
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCActiveAnimation.cpp b/Source/WebCore/platform/graphics/chromium/cc/CCActiveAnimation.cpp
index 21e6cc7a9..8c0303ed6 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCActiveAnimation.cpp
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCActiveAnimation.cpp
@@ -32,9 +32,15 @@
 
 namespace WebCore {
 
-CCActiveAnimation::CCActiveAnimation(PassOwnPtr<CCAnimationCurve> curve, GroupID group, TargetProperty targetProperty)
-    : m_animationCurve(curve)
-    , m_group(group)
+PassOwnPtr<CCActiveAnimation> CCActiveAnimation::create(PassOwnPtr<CCAnimationCurve> curve, int animationId, int groupId, TargetProperty targetProperty)
+{
+    return adoptPtr(new CCActiveAnimation(curve, animationId, groupId, targetProperty));
+}
+
+CCActiveAnimation::CCActiveAnimation(PassOwnPtr<CCAnimationCurve> curve, int animationId, int groupId, TargetProperty targetProperty)
+    : m_curve(curve)
+    , m_id(animationId)
+    , m_group(groupId)
     , m_targetProperty(targetProperty)
     , m_runState(WaitingForTargetAvailability)
     , m_iterations(1)
@@ -44,6 +50,10 @@ CCActiveAnimation::CCActiveAnimation(PassOwnPtr<CCAnimationCurve> curve, GroupID
 {
 }
 
+CCActiveAnimation::~CCActiveAnimation()
+{
+}
+
 void CCActiveAnimation::setRunState(RunState runState, double now)
 {
     if (runState == Running && m_runState == Paused)
@@ -60,7 +70,22 @@ bool CCActiveAnimation::isFinishedAt(double time) const
 
     return m_runState == Running
         && m_iterations >= 0
-        && m_iterations * m_animationCurve->duration() <= time - startTime() - m_totalPausedTime;
+        && m_iterations * m_curve->duration() <= time - startTime() - m_totalPausedTime;
+}
+
+bool CCActiveAnimation::isWaiting() const
+{
+    return m_runState == WaitingForNextTick
+        || m_runState == WaitingForTargetAvailability
+        || m_runState == WaitingForStartTime;
+}
+
+bool CCActiveAnimation::isRunningOrHasRun() const
+{
+    return m_runState == Running
+        || m_runState == Finished
+        || m_runState == Aborted
+        || m_runState == Paused;
 }
 
 double CCActiveAnimation::trimTimeToCurrentIteration(double now) const
@@ -84,15 +109,47 @@ double CCActiveAnimation::trimTimeToCurrentIteration(double now) const
         return 0;
 
     // If less than an iteration duration, just return trimmed.
-    if (trimmed < m_animationCurve->duration())
+    if (trimmed < m_curve->duration())
         return trimmed;
 
     // If greater than or equal to the total duration, return iteration duration.
-    if (m_iterations >= 0 && trimmed >= m_animationCurve->duration() * m_iterations)
-        return m_animationCurve->duration();
+    if (m_iterations >= 0 && trimmed >= m_curve->duration() * m_iterations)
+        return m_curve->duration();
 
     // Finally, return x where trimmed = x + n * m_animation->duration() for some positive integer n.
-    return fmod(trimmed, m_animationCurve->duration());
+    return fmod(trimmed, m_curve->duration());
+}
+
+PassOwnPtr<CCActiveAnimation> CCActiveAnimation::cloneForImplThread() const
+{
+    OwnPtr<CCActiveAnimation> toReturn(adoptPtr(new CCActiveAnimation(m_curve->clone(), m_id, m_group, m_targetProperty)));
+    toReturn->m_runState = m_runState;
+    toReturn->m_iterations = m_iterations;
+    toReturn->m_startTime = m_startTime;
+    toReturn->m_pauseTime = m_pauseTime;
+    toReturn->m_totalPausedTime = m_totalPausedTime;
+    return toReturn.release();
+}
+
+void CCActiveAnimation::synchronizeProperties(CCActiveAnimation* other)
+{
+    // It is possible for the impl thread to initiate a run state change.
+    // This happens when the animation was waiting for a future event to take
+    // place, and the event has happened. In that case, we want 'this' to
+    // assume the impl thread's run state and start time.
+    if (isWaiting() && other->isRunningOrHasRun()) {
+        m_runState = other->m_runState;
+        m_startTime = other->m_startTime;
+    } else {
+        other->m_runState = m_runState;
+        other->m_startTime = m_startTime;
+    }
+
+    // Change in state related to iterations and pause is always initiated from
+    // the main thread, so it is safe to push properties in that direction.
+    other->m_iterations = m_iterations;
+    other->m_pauseTime = m_pauseTime;
+    other->m_totalPausedTime = m_totalPausedTime;
 }
 
 } // namespace WebCore
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCActiveAnimation.h b/Source/WebCore/platform/graphics/chromium/cc/CCActiveAnimation.h
index c22227941..2093421a7 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCActiveAnimation.h
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCActiveAnimation.h
@@ -25,25 +25,20 @@
 #ifndef CCActiveAnimation_h
 #define CCActiveAnimation_h
 
+#include "cc/CCAnimationCurve.h"
+
+#include <wtf/Noncopyable.h>
 #include <wtf/OwnPtr.h>
 #include <wtf/PassOwnPtr.h>
 
 namespace WebCore {
 
-class CCAnimationCurve;
-
 // A CCActiveAnimation, contains all the state required to play a CCAnimationCurve.
 // Specifically, the affected property, the run state (paused, finished, etc.),
 // loop count, last pause time, and the total time spent paused.
 class CCActiveAnimation {
+    WTF_MAKE_NONCOPYABLE(CCActiveAnimation);
 public:
-    // Animations that must be run together are called 'grouped' and have the same GroupID
-    // Grouped animations are guaranteed to start at the same time and no other animations
-    // may animate any of the group's target properties until all animations in the
-    // group have finished animating. Note: an active animation's group id and target
-    // property uniquely identify that animation.
-    typedef int GroupID;
-
     // Animations begin in one of the 'waiting' states. Animations waiting for the next tick
     // will start the next time the controller animates. Animations waiting for target
     // availibility will run as soon as their target property is free (and all the animations
@@ -68,14 +63,20 @@ public:
         Opacity
     };
 
-    static PassOwnPtr<CCActiveAnimation> create(PassOwnPtr<CCAnimationCurve> curve, GroupID group, TargetProperty targetProperty)
-    {
-        return adoptPtr(new CCActiveAnimation(curve, group, targetProperty));
-    }
+    struct AnimationSignature {
+        AnimationSignature(int groupId, TargetProperty targetProperty)
+            : groupId(groupId)
+            , targetProperty(targetProperty) { }
+        int groupId;
+        TargetProperty targetProperty;
+    };
 
-    virtual ~CCActiveAnimation() { }
+    static PassOwnPtr<CCActiveAnimation> create(PassOwnPtr<CCAnimationCurve>, int animationId, int groupId, TargetProperty);
 
-    GroupID group() const { return m_group; }
+    virtual ~CCActiveAnimation();
+
+    int id() const { return m_id; }
+    int group() const { return m_group; }
     TargetProperty targetProperty() const { return m_targetProperty; }
 
     RunState runState() const { return m_runState; }
@@ -93,18 +94,37 @@ public:
     bool isFinishedAt(double time) const;
     bool isFinished() const { return m_runState == Finished || m_runState == Aborted; }
 
-    CCAnimationCurve* animationCurve() { return m_animationCurve.get(); }
-    const CCAnimationCurve* animationCurve() const { return m_animationCurve.get(); }
+    bool isWaiting() const;
+    bool isRunningOrHasRun() const;
+
+    CCAnimationCurve* curve() { return m_curve.get(); }
+    const CCAnimationCurve* curve() const { return m_curve.get(); }
 
     // Takes the given absolute time, and using the start time and the number
     // of iterations, returns the relative time in the current iteration.
     double trimTimeToCurrentIteration(double now) const;
 
+    AnimationSignature signature() const { return AnimationSignature(m_group, m_targetProperty); }
+
+    PassOwnPtr<CCActiveAnimation> cloneForImplThread() const;
+
+    void synchronizeProperties(CCActiveAnimation*);
+
 private:
-    CCActiveAnimation(PassOwnPtr<CCAnimationCurve>, GroupID, TargetProperty);
+    CCActiveAnimation(PassOwnPtr<CCAnimationCurve>, int animationId, int groupId, TargetProperty);
+
+    OwnPtr<CCAnimationCurve> m_curve;
+
+    // IDs are not necessarily unique.
+    int m_id;
+
+    // Animations that must be run together are called 'grouped' and have the same group id
+    // Grouped animations are guaranteed to start at the same time and no other animations
+    // may animate any of the group's target properties until all animations in the
+    // group have finished animating. Note: an active animation's group id and target
+    // property uniquely identify that animation.
+    int m_group;
 
-    OwnPtr<CCAnimationCurve> m_animationCurve;
-    GroupID m_group;
     TargetProperty m_targetProperty;
     RunState m_runState;
     int m_iterations;
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCAnimationCurve.h b/Source/WebCore/platform/graphics/chromium/cc/CCAnimationCurve.h
index de97e38c0..533abafef 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCAnimationCurve.h
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCAnimationCurve.h
@@ -25,6 +25,10 @@
 #ifndef CCAnimationCurve_h
 #define CCAnimationCurve_h
 
+#include "TransformationMatrix.h"
+
+#include <wtf/PassOwnPtr.h>
+
 namespace WebCore {
 
 class CCFloatAnimationCurve;
@@ -41,6 +45,7 @@ public:
 
     virtual double duration() const = 0;
     virtual Type type() const = 0;
+    virtual PassOwnPtr<CCAnimationCurve> clone() const = 0;
 
     const CCFloatAnimationCurve* toFloatAnimationCurve() const;
     const CCTransformAnimationCurve* toTransformAnimationCurve() const;
@@ -60,7 +65,7 @@ class CCTransformAnimationCurve : public CCAnimationCurve {
 public:
     virtual ~CCTransformAnimationCurve() { }
 
-    virtual TransformOperations getValue(double t) const = 0;
+    virtual TransformationMatrix getValue(double t, const IntSize& layerSize) const = 0;
 
     // Partial CCAnimation implementation.
     virtual Type type() const { return Transform; }
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCAnimationEvents.h b/Source/WebCore/platform/graphics/chromium/cc/CCAnimationEvents.h
new file mode 100644
index 000000000..b21a79e31
--- /dev/null
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCAnimationEvents.h
@@ -0,0 +1,45 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef CCAnimationEvents_h
+#define CCAnimationEvents_h
+
+#include <wtf/Vector.h>
+
+namespace WebCore {
+
+// Indicates that an animation has started on a particular layer.
+struct CCAnimationStartedEvent {
+    CCAnimationStartedEvent(int layerID, double time)
+        : layerID(layerID)
+        , time(time) { }
+    int layerID;
+    double time;
+};
+
+typedef Vector<CCAnimationStartedEvent> CCAnimationEventsVector;
+
+} // namespace WebCore
+
+#endif // CCAnimationEvents_h
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCHeadsUpDisplay.cpp b/Source/WebCore/platform/graphics/chromium/cc/CCHeadsUpDisplay.cpp
index 708bcff88..3ddc123c0 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCHeadsUpDisplay.cpp
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCHeadsUpDisplay.cpp
@@ -32,6 +32,7 @@
 #include "FontCache.h"
 #include "FontDescription.h"
 #include "GraphicsContext3D.h"
+#include "InspectorController.h"
 #include "LayerChromium.h"
 #include "LayerRendererChromium.h"
 #include "ManagedTexture.h"
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCInputHandler.h b/Source/WebCore/platform/graphics/chromium/cc/CCInputHandler.h
index 057d79b1a..6c055994c 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCInputHandler.h
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCInputHandler.h
@@ -46,13 +46,14 @@ public:
     virtual void setNeedsRedraw() = 0;
 
     enum ScrollStatus { ScrollFailed, ScrollStarted, ScrollIgnored };
+    enum ScrollInputType { Gesture, Wheel };
 
     // Attempt to start scrolling a layer at a given point in window
     // coordinates. Returns ScrollStarted if the layer at the coordinates can
     // be scrolled, ScrollFailed if the scroll event should instead be
     // delegated to the main thread, or ScrollIgnored if there is nothing to
     // be scrolled at the given coordinates.
-    virtual ScrollStatus scrollBegin(const IntPoint&) = 0;
+    virtual ScrollStatus scrollBegin(const IntPoint&, ScrollInputType) = 0;
 
     // Scroll the layer selected with scrollBegin(). If there is no room to
     // move the layer in the requested direction, its first ancestor layer that
@@ -64,7 +65,6 @@ public:
     // called if scrollBegin() returned ScrollStarted.
     virtual void scrollEnd() = 0;
 
-    virtual bool haveWheelEventHandlers() = 0;
     virtual void pinchGestureBegin() = 0;
     virtual void pinchGestureUpdate(float magnifyDelta, const IntPoint& anchor) = 0;
     virtual void pinchGestureEnd() = 0;
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCKeyframedAnimationCurve.cpp b/Source/WebCore/platform/graphics/chromium/cc/CCKeyframedAnimationCurve.cpp
new file mode 100644
index 000000000..b615c736c
--- /dev/null
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCKeyframedAnimationCurve.cpp
@@ -0,0 +1,237 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#include "cc/CCKeyframedAnimationCurve.h"
+
+#include "IdentityTransformOperation.h"
+#include "Matrix3DTransformOperation.h"
+#include "MatrixTransformOperation.h"
+#include "PerspectiveTransformOperation.h"
+#include "RotateTransformOperation.h"
+#include "ScaleTransformOperation.h"
+#include "SkewTransformOperation.h"
+#include "TranslateTransformOperation.h"
+
+#include <wtf/OwnPtr.h>
+
+namespace WebCore {
+
+namespace {
+
+template <class Keyframe>
+bool keyframesAreSorted(const Vector<Keyframe>& keyframes)
+{
+    if (!keyframes.size())
+        return true;
+
+    for (size_t i = 0; i < keyframes.size() - 1; ++i) {
+        if (keyframes[i].time > keyframes[i+1].time)
+            return false;
+    }
+
+    return true;
+}
+
+} // namespace
+
+PassOwnPtr<CCKeyframedFloatAnimationCurve> CCKeyframedFloatAnimationCurve::create(const Vector<CCFloatKeyframe>& keyframes)
+{
+    if (!keyframes.size() || !keyframesAreSorted(keyframes))
+        return nullptr;
+
+    return adoptPtr(new CCKeyframedFloatAnimationCurve(keyframes));
+}
+
+CCKeyframedFloatAnimationCurve::CCKeyframedFloatAnimationCurve(const Vector<CCFloatKeyframe>& keyframes)
+    : m_keyframes(keyframes)
+{
+}
+
+CCKeyframedFloatAnimationCurve::~CCKeyframedFloatAnimationCurve()
+{
+}
+
+double CCKeyframedFloatAnimationCurve::duration() const
+{
+    return m_keyframes.last().time - m_keyframes.first().time;
+}
+
+PassOwnPtr<CCAnimationCurve> CCKeyframedFloatAnimationCurve::clone() const
+{
+    return adoptPtr(new CCKeyframedFloatAnimationCurve(*this));
+}
+
+float CCKeyframedFloatAnimationCurve::getValue(double t) const
+{
+    if (t <= m_keyframes.first().time)
+        return m_keyframes.first().value;
+
+    if (t >= m_keyframes.last().time)
+        return m_keyframes.last().value;
+
+    size_t i = 0;
+    for (; i < m_keyframes.size() - 1; ++i) {
+        if (t < m_keyframes[i+1].time)
+            break;
+    }
+
+    float progress = static_cast<float>((t - m_keyframes[i].time) / (m_keyframes[i+1].time - m_keyframes[i].time));
+    // FIXME: apply timing function here.
+    return m_keyframes[i].value + (m_keyframes[i+1].value - m_keyframes[i].value) * progress;
+}
+
+PassOwnPtr<CCKeyframedTransformAnimationCurve> CCKeyframedTransformAnimationCurve::create(const Vector<CCTransformKeyframe>& keyframes)
+{
+    if (!keyframes.size() || !keyframesAreSorted(keyframes))
+        return nullptr;
+
+    return adoptPtr(new CCKeyframedTransformAnimationCurve(keyframes));
+}
+
+CCKeyframedTransformAnimationCurve::CCKeyframedTransformAnimationCurve(const Vector<CCTransformKeyframe>& keyframes)
+    : m_keyframes(keyframes)
+{
+}
+
+CCKeyframedTransformAnimationCurve::~CCKeyframedTransformAnimationCurve() { }
+
+double CCKeyframedTransformAnimationCurve::duration() const
+{
+    return m_keyframes.last().time - m_keyframes.first().time;
+}
+
+PassOwnPtr<CCAnimationCurve> CCKeyframedTransformAnimationCurve::clone() const
+{
+    Vector<CCTransformKeyframe> keyframes;
+    // We need to do a deep copy of all of the keyframes since they contain ref
+    // pointers to TransformOperation objects.
+    for (size_t i = 0; i < m_keyframes.size(); ++i) {
+        CCTransformKeyframe keyframe(m_keyframes[i].time);
+        for (size_t j = 0; j < m_keyframes[i].value.size(); ++j) {
+            TransformOperation::OperationType operationType = m_keyframes[i].value.operations()[j]->getOperationType();
+            switch (operationType) {
+            case TransformOperation::SCALE_X:
+            case TransformOperation::SCALE_Y:
+            case TransformOperation::SCALE_Z:
+            case TransformOperation::SCALE_3D:
+            case TransformOperation::SCALE: {
+                ScaleTransformOperation* transform = static_cast<ScaleTransformOperation*>(m_keyframes[i].value.operations()[j].get());
+                keyframe.value.operations().append(ScaleTransformOperation::create(transform->x(), transform->y(), transform->z(), operationType));
+                break;
+            }
+            case TransformOperation::TRANSLATE_X:
+            case TransformOperation::TRANSLATE_Y:
+            case TransformOperation::TRANSLATE_Z:
+            case TransformOperation::TRANSLATE_3D:
+            case TransformOperation::TRANSLATE: {
+                TranslateTransformOperation* transform = static_cast<TranslateTransformOperation*>(m_keyframes[i].value.operations()[j].get());
+                keyframe.value.operations().append(TranslateTransformOperation::create(transform->x(), transform->y(), transform->z(), operationType));
+                break;
+            }
+            case TransformOperation::ROTATE_X:
+            case TransformOperation::ROTATE_Y:
+            case TransformOperation::ROTATE_3D:
+            case TransformOperation::ROTATE: {
+                RotateTransformOperation* transform = static_cast<RotateTransformOperation*>(m_keyframes[i].value.operations()[j].get());
+                keyframe.value.operations().append(RotateTransformOperation::create(transform->x(), transform->y(), transform->z(), transform->angle(), operationType));
+                break;
+            }
+            case TransformOperation::SKEW_X:
+            case TransformOperation::SKEW_Y:
+            case TransformOperation::SKEW: {
+                SkewTransformOperation* transform = static_cast<SkewTransformOperation*>(m_keyframes[i].value.operations()[j].get());
+                keyframe.value.operations().append(SkewTransformOperation::create(transform->angleX(), transform->angleY(), operationType));
+                break;
+            }
+            case TransformOperation::MATRIX: {
+                MatrixTransformOperation* transform = static_cast<MatrixTransformOperation*>(m_keyframes[i].value.operations()[j].get());
+                TransformationMatrix m = transform->matrix();
+                keyframe.value.operations().append(MatrixTransformOperation::create(m.a(), m.b(), m.c(), m.d(), m.e(), m.f()));
+                break;
+            }
+            case TransformOperation::MATRIX_3D: {
+                Matrix3DTransformOperation* transform = static_cast<Matrix3DTransformOperation*>(m_keyframes[i].value.operations()[j].get());
+                keyframe.value.operations().append(Matrix3DTransformOperation::create(transform->matrix()));
+                break;
+            }
+            case TransformOperation::PERSPECTIVE: {
+                PerspectiveTransformOperation* transform = static_cast<PerspectiveTransformOperation*>(m_keyframes[i].value.operations()[j].get());
+                keyframe.value.operations().append(PerspectiveTransformOperation::create(transform->perspective()));
+                break;
+            }
+            case TransformOperation::IDENTITY: {
+                keyframe.value.operations().append(IdentityTransformOperation::create());
+                break;
+            }
+            case TransformOperation::NONE:
+                // Do nothing.
+                break;
+            } // switch
+        } // for each operation
+        keyframes.append(keyframe);
+    }
+    return CCKeyframedTransformAnimationCurve::create(keyframes);
+}
+
+TransformationMatrix CCKeyframedTransformAnimationCurve::getValue(double t, const IntSize& layerSize) const
+{
+    TransformationMatrix transformMatrix;
+
+    if (t <= m_keyframes.first().time) {
+        m_keyframes.first().value.apply(layerSize, transformMatrix);
+        return transformMatrix;
+    }
+
+    if (t >= m_keyframes.last().time) {
+        m_keyframes.last().value.apply(layerSize, transformMatrix);
+        return transformMatrix;
+    }
+
+    size_t i = 0;
+    for (; i < m_keyframes.size() - 1; ++i) {
+        if (t < m_keyframes[i+1].time)
+            break;
+    }
+
+    // FIXME: apply timing function here.
+    double progress = (t - m_keyframes[i].time) / (m_keyframes[i+1].time - m_keyframes[i].time);
+
+    if (m_keyframes[i].value.operationsMatch(m_keyframes[i+1].value)) {
+        for (size_t j = 0; j < m_keyframes[i+1].value.size(); ++j)
+            m_keyframes[i+1].value.operations()[j]->blend(m_keyframes[i].value.at(j), progress)->apply(transformMatrix, layerSize);
+    } else {
+        TransformationMatrix source;
+
+        m_keyframes[i].value.apply(layerSize, source);
+        m_keyframes[i+1].value.apply(layerSize, transformMatrix);
+
+        transformMatrix.blend(source, progress);
+    }
+
+    return transformMatrix;
+}
+
+} // namespace WebCore
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCKeyframedAnimationCurve.h b/Source/WebCore/platform/graphics/chromium/cc/CCKeyframedAnimationCurve.h
new file mode 100644
index 000000000..1c4d64adb
--- /dev/null
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCKeyframedAnimationCurve.h
@@ -0,0 +1,109 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef CCKeyframedAnimationCurve_h
+#define CCKeyframedAnimationCurve_h
+
+#include "TransformOperations.h"
+#include "cc/CCAnimationCurve.h"
+
+#include <wtf/OwnPtr.h>
+#include <wtf/PassOwnPtr.h>
+
+namespace WebCore {
+
+struct CCFloatKeyframe {
+    CCFloatKeyframe(double time, float value)
+        : time(time)
+        , value(value)
+    {
+    }
+
+    double time;
+    float value;
+};
+
+struct CCTransformKeyframe {
+    explicit CCTransformKeyframe(double time)
+        : time(time)
+    {
+    }
+
+    CCTransformKeyframe(double time, const TransformOperations& value)
+        : time(time)
+        , value(value)
+    {
+    }
+
+    double time;
+    TransformOperations value;
+};
+
+class CCKeyframedFloatAnimationCurve : public CCFloatAnimationCurve {
+public:
+    // It is required that the keyframes be sorted by time.
+    static PassOwnPtr<CCKeyframedFloatAnimationCurve> create(const Vector<CCFloatKeyframe>& keyframes);
+
+    virtual ~CCKeyframedFloatAnimationCurve();
+
+    // CCAnimationCurve implementation
+    virtual double duration() const;
+    virtual PassOwnPtr<CCAnimationCurve> clone() const;
+
+    // CCFloatAnimationCurve implementation
+    virtual float getValue(double t) const;
+
+private:
+    explicit CCKeyframedFloatAnimationCurve(const Vector<CCFloatKeyframe>&);
+
+    // Always sorted in order of increasing time. No two keyframes have the
+    // same time.
+    Vector<CCFloatKeyframe> m_keyframes;
+};
+
+class CCKeyframedTransformAnimationCurve : public CCTransformAnimationCurve {
+public:
+    // It is required that the keyframes be sorted by time.
+    static PassOwnPtr<CCKeyframedTransformAnimationCurve> create(const Vector<CCTransformKeyframe>& keyframes);
+
+    virtual ~CCKeyframedTransformAnimationCurve();
+
+    // CCAnimationCurve implementation
+    virtual double duration() const;
+    virtual PassOwnPtr<CCAnimationCurve> clone() const;
+
+    // CCTransformAnimationCurve implementation
+    virtual TransformationMatrix getValue(double t, const IntSize&) const;
+
+private:
+    explicit CCKeyframedTransformAnimationCurve(const Vector<CCTransformKeyframe>&);
+
+    // Always sorted in order of increasing time. No two keyframes have the
+    // same time.
+    Vector<CCTransformKeyframe> m_keyframes;
+};
+
+} // namespace WebCore
+
+#endif // CCKeyframedAnimationCurve_h
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCLayerAnimationController.cpp b/Source/WebCore/platform/graphics/chromium/cc/CCLayerAnimationController.cpp
new file mode 100644
index 000000000..d9e72efc4
--- /dev/null
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCLayerAnimationController.cpp
@@ -0,0 +1,229 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#include "cc/CCLayerAnimationController.h"
+
+#include "GraphicsLayer.h" // for KeyframeValueList
+#include "cc/CCActiveAnimation.h"
+#include "cc/CCKeyframedAnimationCurve.h"
+#include "cc/CCLayerAnimationControllerImpl.h"
+#include <wtf/CurrentTime.h>
+#include <wtf/HashMap.h>
+
+namespace WebCore {
+
+namespace {
+
+template <typename Keyframe, typename Value>
+void appendKeyframe(Vector<Keyframe>& keyframes, double keyTime, const Value* value)
+{
+    keyframes.append(Keyframe(keyTime, value->value()));
+}
+
+template <>
+void appendKeyframe<CCTransformKeyframe, TransformAnimationValue>(Vector<CCTransformKeyframe>& keyframes, double keyTime, const TransformAnimationValue* value)
+{
+    keyframes.append(CCTransformKeyframe(keyTime, *value->value()));
+}
+
+template <class Value, class Keyframe, class Curve>
+PassOwnPtr<CCActiveAnimation> createActiveAnimation(const KeyframeValueList& valueList, const Animation* animation, size_t animationId, size_t groupId, double timeOffset, CCActiveAnimation::TargetProperty targetProperty)
+{
+    // FIXME: add support for different directions.
+    if (animation && animation->isDirectionSet() && animation->direction() == Animation::AnimationDirectionAlternate)
+        return nullptr;
+
+    // FIXME: add support for delay
+    if (animation && animation->isDelaySet() && animation->delay() > 0)
+        return nullptr;
+
+    // FIXME: add support for fills forwards and fills backwards
+    if (animation && animation->isFillModeSet() && (animation->fillsForwards() || animation->fillsBackwards()))
+        return nullptr;
+
+    Vector<Keyframe> keyframes;
+
+    for (size_t i = 0; i < valueList.size(); i++) {
+        const Value* originalValue = static_cast<const Value*>(valueList.at(i));
+
+        // FIXME: add support for timing functions.
+        if (originalValue->timingFunction() && originalValue->timingFunction()->type() != TimingFunction::LinearFunction)
+            return nullptr;
+
+        double duration = (animation && animation->isDurationSet()) ? animation->duration() : 1;
+        appendKeyframe(keyframes, originalValue->keyTime() * duration, originalValue);
+    }
+
+    OwnPtr<Curve> curve = Curve::create(keyframes);
+
+    OwnPtr<CCActiveAnimation> anim = CCActiveAnimation::create(curve.release(), animationId, groupId, targetProperty);
+
+    ASSERT(anim.get());
+
+    if (anim.get()) {
+        int iterations = (animation && animation->isIterationCountSet()) ? animation->iterationCount() : 1;
+        anim->setIterations(iterations);
+    }
+
+    return anim.release();
+}
+
+} // namepace
+
+CCLayerAnimationController::CCLayerAnimationController()
+{
+}
+
+CCLayerAnimationController::~CCLayerAnimationController()
+{
+}
+
+PassOwnPtr<CCLayerAnimationController> CCLayerAnimationController::create()
+{
+    return adoptPtr(new CCLayerAnimationController);
+}
+
+bool CCLayerAnimationController::addAnimation(const KeyframeValueList& valueList, const IntSize&, const Animation* animation, int animationId, int groupId, double timeOffset)
+{
+    if (!animation)
+        return false;
+
+    OwnPtr<CCActiveAnimation> toAdd;
+    if (valueList.property() == AnimatedPropertyWebkitTransform)
+        toAdd = createActiveAnimation<TransformAnimationValue, CCTransformKeyframe, CCKeyframedTransformAnimationCurve>(valueList, animation, animationId, groupId, timeOffset, CCActiveAnimation::Transform);
+    else if (valueList.property() == AnimatedPropertyOpacity)
+        toAdd = createActiveAnimation<FloatAnimationValue, CCFloatKeyframe, CCKeyframedFloatAnimationCurve>(valueList, animation, animationId, groupId, timeOffset, CCActiveAnimation::Opacity);
+
+    if (toAdd.get()) {
+        m_activeAnimations.append(toAdd.release());
+        return true;
+    }
+
+    return false;
+}
+
+void CCLayerAnimationController::pauseAnimation(int animationId, double timeOffset)
+{
+    for (size_t i = 0; i < m_activeAnimations.size(); ++i) {
+        if (m_activeAnimations[i]->id() == animationId)
+            m_activeAnimations[i]->setRunState(CCActiveAnimation::Paused, timeOffset);
+    }
+}
+
+void CCLayerAnimationController::removeAnimation(int animationId)
+{
+    for (size_t i = 0; i < m_activeAnimations.size();) {
+        if (m_activeAnimations[i]->id() == animationId)
+            m_activeAnimations.remove(i);
+        else
+            i++;
+    }
+}
+
+// According to render layer backing, these are for testing only.
+void CCLayerAnimationController::suspendAnimations(double time)
+{
+}
+
+// Looking at GraphicsLayerCA, this appears to be the analog to suspendAnimations, which is for testing.
+void CCLayerAnimationController::resumeAnimations()
+{
+}
+
+// Ensures that the list of active animations on the main thread and the impl thread
+// are kept in sync.
+void CCLayerAnimationController::synchronizeAnimations(CCLayerAnimationControllerImpl* controllerImpl)
+{
+    removeCompletedAnimations(controllerImpl);
+    pushNewAnimationsToImplThread(controllerImpl);
+    removeAnimationsCompletedOnMainThread(controllerImpl);
+    pushAnimationProperties(controllerImpl);
+}
+
+void CCLayerAnimationController::removeCompletedAnimations(CCLayerAnimationControllerImpl* controllerImpl)
+{
+    // Any animations finished on the impl thread are removed from the main thread's collection.
+    for (size_t i = 0; i < controllerImpl->m_finishedAnimations.size(); ++i)
+        remove(controllerImpl->m_finishedAnimations[i].groupId, controllerImpl->m_finishedAnimations[i].targetProperty);
+    controllerImpl->m_finishedAnimations.clear();
+}
+
+void CCLayerAnimationController::pushNewAnimationsToImplThread(CCLayerAnimationControllerImpl* controllerImpl)
+{
+    // Any new animations owned by the main thread's controller are cloned and adde to the impl thread's controller.
+    for (size_t i = 0; i < m_activeAnimations.size(); ++i) {
+        if (!controllerImpl->getActiveAnimation(m_activeAnimations[i]->group(), m_activeAnimations[i]->targetProperty()))
+            controllerImpl->add(m_activeAnimations[i]->cloneForImplThread());
+    }
+}
+
+void CCLayerAnimationController::removeAnimationsCompletedOnMainThread(CCLayerAnimationControllerImpl* controllerImpl)
+{
+    // Delete all impl thread animations for which there is no corresponding main thread animation.
+    // Each iteration, controller->m_activeAnimations.size() is decremented or i is incremented
+    // guaranteeing progress towards loop termination.
+    for (size_t i = 0; i < controllerImpl->m_activeAnimations.size();) {
+        CCActiveAnimation* current = getActiveAnimation(controllerImpl->m_activeAnimations[i]->group(), controllerImpl->m_activeAnimations[i]->targetProperty());
+        if (!current)
+            controllerImpl->m_activeAnimations.remove(i);
+        else
+            i++;
+    }
+}
+
+void CCLayerAnimationController::pushAnimationProperties(CCLayerAnimationControllerImpl* controllerImpl)
+{
+    // Delete all impl thread animations for which there is no corresponding main thread animation.
+    // Each iteration, controller->m_activeAnimations.size() is decremented or i is incremented
+    // guaranteeing progress towards loop termination.
+    for (size_t i = 0; i < controllerImpl->m_activeAnimations.size(); ++i) {
+        CCActiveAnimation* currentImpl = controllerImpl->m_activeAnimations[i].get();
+        CCActiveAnimation* current = getActiveAnimation(currentImpl->group(), currentImpl->targetProperty());
+        ASSERT(current);
+        if (current)
+            current->synchronizeProperties(currentImpl);
+    }
+}
+
+CCActiveAnimation* CCLayerAnimationController::getActiveAnimation(int groupId, CCActiveAnimation::TargetProperty targetProperty)
+{
+    for (size_t i = 0; i < m_activeAnimations.size(); ++i)
+        if (m_activeAnimations[i]->group() == groupId && m_activeAnimations[i]->targetProperty() == targetProperty)
+            return m_activeAnimations[i].get();
+    return 0;
+}
+
+void CCLayerAnimationController::remove(int groupId, CCActiveAnimation::TargetProperty targetProperty)
+{
+    for (size_t i = 0; i < m_activeAnimations.size(); ++i) {
+        if (m_activeAnimations[i]->group() == groupId && m_activeAnimations[i]->targetProperty() == targetProperty) {
+            m_activeAnimations.remove(i);
+            return;
+        }
+    }
+}
+
+} // namespace WebCore
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCLayerAnimationController.h b/Source/WebCore/platform/graphics/chromium/cc/CCLayerAnimationController.h
new file mode 100644
index 000000000..068213047
--- /dev/null
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCLayerAnimationController.h
@@ -0,0 +1,78 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef CCLayerAnimationController_h
+#define CCLayerAnimationController_h
+
+#include "cc/CCActiveAnimation.h"
+
+#include <wtf/OwnPtr.h>
+#include <wtf/PassOwnPtr.h>
+#include <wtf/Vector.h>
+
+namespace WebCore {
+
+class Animation;
+class CCLayerAnimationControllerImpl;
+class IntSize;
+class KeyframeValueList;
+
+class CCLayerAnimationController {
+    WTF_MAKE_NONCOPYABLE(CCLayerAnimationController);
+public:
+    static PassOwnPtr<CCLayerAnimationController> create();
+
+    virtual ~CCLayerAnimationController();
+
+    // These are virtual for testing.
+    virtual bool addAnimation(const KeyframeValueList&, const IntSize& boxSize, const Animation*, int animationId, int groupId, double timeOffset);
+    virtual void pauseAnimation(int animationId, double timeOffset);
+    virtual void removeAnimation(int animationId);
+    virtual void suspendAnimations(double time);
+    virtual void resumeAnimations();
+
+    // Ensures that the list of active animations on the main thread and the impl thread
+    // are kept in sync. This function does not take ownership of the impl thread controller.
+    virtual void synchronizeAnimations(CCLayerAnimationControllerImpl*);
+
+    bool hasActiveAnimation() const { return m_activeAnimations.size(); }
+    CCActiveAnimation* getActiveAnimation(int groupId, CCActiveAnimation::TargetProperty);
+
+protected:
+    CCLayerAnimationController();
+
+private:
+    void removeCompletedAnimations(CCLayerAnimationControllerImpl*);
+    void pushNewAnimationsToImplThread(CCLayerAnimationControllerImpl*);
+    void removeAnimationsCompletedOnMainThread(CCLayerAnimationControllerImpl*);
+    void pushAnimationProperties(CCLayerAnimationControllerImpl*);
+
+    void remove(int groupId, CCActiveAnimation::TargetProperty);
+
+    Vector<OwnPtr<CCActiveAnimation> > m_activeAnimations;
+};
+
+} // namespace WebCore
+
+#endif // CCLayerAnimationController_h
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCLayerAnimationControllerImpl.cpp b/Source/WebCore/platform/graphics/chromium/cc/CCLayerAnimationControllerImpl.cpp
index bbca9cbd9..2096ce398 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCLayerAnimationControllerImpl.cpp
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCLayerAnimationControllerImpl.cpp
@@ -26,6 +26,7 @@
 
 #include "cc/CCLayerAnimationControllerImpl.h"
 
+#include "TransformationMatrix.h"
 #include "TransformOperations.h"
 
 namespace WebCore {
@@ -44,28 +45,30 @@ CCLayerAnimationControllerImpl::CCLayerAnimationControllerImpl(CCLayerAnimationC
 {
 }
 
-void CCLayerAnimationControllerImpl::animate(double frameBeginTimeSecs)
+CCLayerAnimationControllerImpl::~CCLayerAnimationControllerImpl()
 {
-    startAnimationsWaitingForNextTick(frameBeginTimeSecs);
-    startAnimationsWaitingForStartTime(frameBeginTimeSecs);
-    startAnimationsWaitingForTargetAvailability(frameBeginTimeSecs);
+}
+
+void CCLayerAnimationControllerImpl::animate(double frameBeginTimeSecs, CCAnimationEventsVector& events)
+{
+    startAnimationsWaitingForNextTick(frameBeginTimeSecs, events);
+    startAnimationsWaitingForStartTime(frameBeginTimeSecs, events);
+    startAnimationsWaitingForTargetAvailability(frameBeginTimeSecs, events);
     resolveConflicts(frameBeginTimeSecs);
     tickAnimations(frameBeginTimeSecs);
     purgeFinishedAnimations();
-    startAnimationsWaitingForTargetAvailability(frameBeginTimeSecs);
+    startAnimationsWaitingForTargetAvailability(frameBeginTimeSecs, events);
 }
 
 void CCLayerAnimationControllerImpl::add(PassOwnPtr<CCActiveAnimation> anim)
 {
     m_activeAnimations.append(anim);
-    if (m_client)
-        m_client->animationControllerImplDidActivate(this);
 }
 
-CCActiveAnimation* CCLayerAnimationControllerImpl::getActiveAnimation(CCActiveAnimation::GroupID group, CCActiveAnimation::TargetProperty property)
+CCActiveAnimation* CCLayerAnimationControllerImpl::getActiveAnimation(int groupId, CCActiveAnimation::TargetProperty property)
 {
     for (size_t i = 0; i < m_activeAnimations.size(); ++i) {
-        if (m_activeAnimations[i]->group() == group && m_activeAnimations[i]->targetProperty() == property)
+        if (m_activeAnimations[i]->group() == groupId && m_activeAnimations[i]->targetProperty() == property)
             return m_activeAnimations[i].get();
     }
     return 0;
@@ -80,25 +83,28 @@ bool CCLayerAnimationControllerImpl::hasActiveAnimation() const
     return false;
 }
 
-void CCLayerAnimationControllerImpl::startAnimationsWaitingForNextTick(double now)
+void CCLayerAnimationControllerImpl::startAnimationsWaitingForNextTick(double now, CCAnimationEventsVector& events)
 {
     for (size_t i = 0; i < m_activeAnimations.size(); ++i) {
         if (m_activeAnimations[i]->runState() == CCActiveAnimation::WaitingForNextTick) {
             m_activeAnimations[i]->setRunState(CCActiveAnimation::Running, now);
             m_activeAnimations[i]->setStartTime(now);
+            events.append(CCAnimationStartedEvent(m_client->id(), now));
         }
     }
 }
 
-void CCLayerAnimationControllerImpl::startAnimationsWaitingForStartTime(double now)
+void CCLayerAnimationControllerImpl::startAnimationsWaitingForStartTime(double now, CCAnimationEventsVector& events)
 {
     for (size_t i = 0; i < m_activeAnimations.size(); ++i) {
-        if (m_activeAnimations[i]->runState() == CCActiveAnimation::WaitingForStartTime && m_activeAnimations[i]->startTime() <= now)
+        if (m_activeAnimations[i]->runState() == CCActiveAnimation::WaitingForStartTime && m_activeAnimations[i]->startTime() <= now) {
             m_activeAnimations[i]->setRunState(CCActiveAnimation::Running, now);
+            events.append(CCAnimationStartedEvent(m_client->id(), now));
+        }
     }
 }
 
-void CCLayerAnimationControllerImpl::startAnimationsWaitingForTargetAvailability(double now)
+void CCLayerAnimationControllerImpl::startAnimationsWaitingForTargetAvailability(double now, CCAnimationEventsVector& events)
 {
     // First collect running properties.
     TargetProperties blockedProperties;
@@ -130,6 +136,7 @@ void CCLayerAnimationControllerImpl::startAnimationsWaitingForTargetAvailability
             if (nullIntersection) {
                 m_activeAnimations[i]->setRunState(CCActiveAnimation::Running, now);
                 m_activeAnimations[i]->setStartTime(now);
+                events.append(CCAnimationStartedEvent(m_client->id(), now));
                 for (size_t j = i + 1; j < m_activeAnimations.size(); ++j) {
                     if (m_activeAnimations[i]->group() == m_activeAnimations[j]->group()) {
                         m_activeAnimations[j]->setRunState(CCActiveAnimation::Running, now);
@@ -178,9 +185,10 @@ void CCLayerAnimationControllerImpl::purgeFinishedAnimations()
                 }
             }
         }
-        if (allAnimsWithSameIdAreFinished)
+        if (allAnimsWithSameIdAreFinished) {
+            m_finishedAnimations.append(m_activeAnimations[i]->signature());
             m_activeAnimations.remove(i);
-        else
+        } else
             i++;
     }
 }
@@ -193,20 +201,17 @@ void CCLayerAnimationControllerImpl::tickAnimations(double now)
             switch (m_activeAnimations[i]->targetProperty()) {
 
             case CCActiveAnimation::Transform: {
-                const CCTransformAnimationCurve* transformAnimationCurve = m_activeAnimations[i]->animationCurve()->toTransformAnimationCurve();
-                const TransformOperations operations = transformAnimationCurve->getValue(trimmed);
+                const CCTransformAnimationCurve* transformAnimationCurve = m_activeAnimations[i]->curve()->toTransformAnimationCurve();
+                const TransformationMatrix matrix = transformAnimationCurve->getValue(trimmed, m_client->bounds());
                 if (m_activeAnimations[i]->isFinishedAt(now))
                     m_activeAnimations[i]->setRunState(CCActiveAnimation::Finished, now);
 
-                // Decide here if absolute or relative. Absolute for now.
-                TransformationMatrix toApply;
-                operations.apply(FloatSize(), toApply);
-                m_client->setTransform(toApply);
+                m_client->setTransform(matrix);
                 break;
             }
 
             case CCActiveAnimation::Opacity: {
-                const CCFloatAnimationCurve* floatAnimationCurve = m_activeAnimations[i]->animationCurve()->toFloatAnimationCurve();
+                const CCFloatAnimationCurve* floatAnimationCurve = m_activeAnimations[i]->curve()->toFloatAnimationCurve();
                 const float opacity = floatAnimationCurve->getValue(trimmed);
                 if (m_activeAnimations[i]->isFinishedAt(now))
                     m_activeAnimations[i]->setRunState(CCActiveAnimation::Finished, now);
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCLayerAnimationControllerImpl.h b/Source/WebCore/platform/graphics/chromium/cc/CCLayerAnimationControllerImpl.h
index 1ad223dba..296066de0 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCLayerAnimationControllerImpl.h
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCLayerAnimationControllerImpl.h
@@ -27,8 +27,10 @@
 
 #include "cc/CCActiveAnimation.h"
 #include "cc/CCAnimationCurve.h"
+#include "cc/CCAnimationEvents.h"
 
 #include <wtf/HashSet.h>
+#include <wtf/Noncopyable.h>
 #include <wtf/OwnPtr.h>
 #include <wtf/PassOwnPtr.h>
 #include <wtf/Vector.h>
@@ -44,35 +46,41 @@ class CCLayerAnimationControllerImplClient {
 public:
     virtual ~CCLayerAnimationControllerImplClient() { }
 
+    virtual int id() const = 0;
     virtual float opacity() const = 0;
     virtual void setOpacity(float) = 0;
     virtual const TransformationMatrix& transform() const = 0;
     virtual void setTransform(const TransformationMatrix&) = 0;
-    virtual void animationControllerImplDidActivate(CCLayerAnimationControllerImpl*) = 0;
+    virtual const IntSize& bounds() const = 0;
 };
 
 class CCLayerAnimationControllerImpl {
+    WTF_MAKE_NONCOPYABLE(CCLayerAnimationControllerImpl);
 public:
     static PassOwnPtr<CCLayerAnimationControllerImpl> create(CCLayerAnimationControllerImplClient*);
 
-    void animate(double frameBeginTimeSecs);
+    virtual ~CCLayerAnimationControllerImpl();
+
+    void animate(double frameBeginTimeSecs, CCAnimationEventsVector&);
 
     void add(PassOwnPtr<CCActiveAnimation>);
 
     // Returns the active animation in the given group, animating the given property if such an
     // animation exists.
-    CCActiveAnimation* getActiveAnimation(CCActiveAnimation::GroupID, CCActiveAnimation::TargetProperty);
+    CCActiveAnimation* getActiveAnimation(int groupId, CCActiveAnimation::TargetProperty);
 
     // Returns true if there are any animations that are neither finished nor aborted.
     bool hasActiveAnimation() const;
 
 private:
+    friend class CCLayerAnimationController;
+
     // The animator is owned by the layer.
     explicit CCLayerAnimationControllerImpl(CCLayerAnimationControllerImplClient*);
 
-    void startAnimationsWaitingForNextTick(double now);
-    void startAnimationsWaitingForStartTime(double now);
-    void startAnimationsWaitingForTargetAvailability(double now);
+    void startAnimationsWaitingForNextTick(double now, CCAnimationEventsVector&);
+    void startAnimationsWaitingForStartTime(double now, CCAnimationEventsVector&);
+    void startAnimationsWaitingForTargetAvailability(double now, CCAnimationEventsVector&);
     void resolveConflicts(double now);
     void purgeFinishedAnimations();
 
@@ -80,6 +88,7 @@ private:
 
     CCLayerAnimationControllerImplClient* m_client;
     Vector<OwnPtr<CCActiveAnimation> > m_activeAnimations;
+    Vector<CCActiveAnimation::AnimationSignature> m_finishedAnimations;
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCLayerImpl.cpp b/Source/WebCore/platform/graphics/chromium/cc/CCLayerImpl.cpp
index 81f9712e0..0589dca8a 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCLayerImpl.cpp
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCLayerImpl.cpp
@@ -33,6 +33,7 @@
 #include "LayerChromium.h"
 #include "LayerRendererChromium.h"
 #include "cc/CCDebugBorderDrawQuad.h"
+#include "cc/CCLayerAnimationControllerImpl.h"
 #include "cc/CCLayerSorter.h"
 #include "cc/CCSolidColorDrawQuad.h"
 #include <wtf/text/WTFString.h>
@@ -45,6 +46,7 @@ CCLayerImpl::CCLayerImpl(int id)
     , m_anchorPoint(0.5, 0.5)
     , m_anchorPointZ(0)
     , m_scrollable(false)
+    , m_haveWheelEventHandlers(false)
     , m_backgroundCoversViewport(false)
     , m_doubleSided(true)
     , m_layerPropertyChanged(false)
@@ -61,6 +63,7 @@ CCLayerImpl::CCLayerImpl(int id)
     , m_drawOpacity(0)
     , m_debugBorderColor(0, 0, 0, 0)
     , m_debugBorderWidth(0)
+    , m_layerAnimationController(CCLayerAnimationControllerImpl::create(this))
 {
     ASSERT(CCProxy::isImplThread());
 }
@@ -104,6 +107,7 @@ void CCLayerImpl::createRenderSurface()
 {
     ASSERT(!m_renderSurface);
     m_renderSurface = adoptPtr(new CCRenderSurface(this));
+    setTargetRenderSurface(m_renderSurface.get());
 }
 
 bool CCLayerImpl::descendantDrawsContent()
@@ -115,11 +119,6 @@ bool CCLayerImpl::descendantDrawsContent()
     return false;
 }
 
-void CCLayerImpl::draw(LayerRendererChromium*)
-{
-    ASSERT_NOT_REACHED();
-}
-
 PassOwnPtr<CCSharedQuadState> CCLayerImpl::createSharedQuadState() const
 {
     IntRect layerClipRect;
@@ -383,6 +382,15 @@ void CCLayerImpl::setBackgroundCoversViewport(bool backgroundCoversViewport)
     m_layerPropertyChanged = true;
 }
 
+void CCLayerImpl::setFilters(const FilterOperations& filters)
+{
+    if (m_filters == filters)
+        return;
+
+    m_filters = filters;
+    noteLayerPropertyChangedForSubtree();
+}
+
 void CCLayerImpl::setMasksToBounds(bool masksToBounds)
 {
     if (m_masksToBounds == masksToBounds)
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCLayerImpl.h b/Source/WebCore/platform/graphics/chromium/cc/CCLayerImpl.h
index 7bae20174..c7a4f0856 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCLayerImpl.h
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCLayerImpl.h
@@ -27,10 +27,12 @@
 #define CCLayerImpl_h
 
 #include "Color.h"
+#include "FilterOperations.h"
 #include "FloatRect.h"
 #include "IntRect.h"
 #include "TextStream.h"
 #include "TransformationMatrix.h"
+#include "cc/CCLayerAnimationControllerImpl.h"
 #include "cc/CCRenderPass.h"
 #include "cc/CCRenderSurface.h"
 #include <wtf/OwnPtr.h>
@@ -44,12 +46,21 @@ class CCLayerSorter;
 class LayerChromium;
 class LayerRendererChromium;
 
-class CCLayerImpl : public RefCounted<CCLayerImpl> {
+class CCLayerImpl : public RefCounted<CCLayerImpl>, public CCLayerAnimationControllerImplClient {
 public:
     static PassRefPtr<CCLayerImpl> create(int id)
     {
         return adoptRef(new CCLayerImpl(id));
     }
+
+    // CCLayerAnimationControllerImplClient implementation.
+    virtual int id() const { return m_layerId; }
+    virtual void setOpacity(float);
+    virtual float opacity() const { return m_opacity; }
+    virtual void setTransform(const TransformationMatrix&);
+    virtual const TransformationMatrix& transform() const { return m_transform; }
+    virtual const IntSize& bounds() const { return m_bounds; }
+
     virtual ~CCLayerImpl();
 
     // Tree structure.
@@ -65,8 +76,6 @@ public:
     void setReplicaLayer(PassRefPtr<CCLayerImpl>);
     CCLayerImpl* replicaLayer() const { return m_replicaLayer.get(); }
 
-    int id() const { return m_layerId; }
-
 #ifndef NDEBUG
     int debugID() const { return m_debugID; }
 #endif
@@ -74,9 +83,9 @@ public:
     PassOwnPtr<CCSharedQuadState> createSharedQuadState() const;
     virtual void willDraw(LayerRendererChromium*) { }
     virtual void appendQuads(CCQuadList&, const CCSharedQuadState*);
+    virtual void didDraw() { }
     void appendDebugBorderQuad(CCQuadList&, const CCSharedQuadState*) const;
 
-    virtual void draw(LayerRendererChromium*);
     void unreserveContentsTexture();
     virtual void bindContentsTexture(LayerRendererChromium*);
 
@@ -101,15 +110,15 @@ public:
     void setBackgroundCoversViewport(bool);
     bool backgroundCoversViewport() const { return m_backgroundCoversViewport; }
 
+    void setFilters(const FilterOperations&);
+    const FilterOperations& filters() const { return m_filters; }
+
     void setMasksToBounds(bool);
     bool masksToBounds() const { return m_masksToBounds; }
 
     void setOpaque(bool);
     bool opaque() const { return m_opaque; }
 
-    void setOpacity(float);
-    float opacity() const { return m_opacity; }
-
     void setPosition(const FloatPoint&);
     const FloatPoint& position() const { return m_position; }
 
@@ -125,9 +134,6 @@ public:
     void setSublayerTransform(const TransformationMatrix&);
     const TransformationMatrix& sublayerTransform() const { return m_sublayerTransform; }
 
-    void setTransform(const TransformationMatrix&);
-    const TransformationMatrix& transform() const { return m_transform; }
-
     void setName(const String& name) { m_name = name; }
     const String& name() const { return m_name; }
 
@@ -150,7 +156,6 @@ public:
     CCRenderSurface* targetRenderSurface() const { return m_targetRenderSurface; }
     void setTargetRenderSurface(CCRenderSurface* surface) { m_targetRenderSurface = surface; }
 
-    const IntSize& bounds() const { return m_bounds; }
     void setBounds(const IntSize&);
 
     const IntSize& contentBounds() const { return m_contentBounds; }
@@ -176,6 +181,9 @@ public:
     bool scrollable() const { return m_scrollable; }
     void setScrollable(bool scrollable) { m_scrollable = scrollable; }
 
+    bool haveWheelEventHandlers() const { return m_haveWheelEventHandlers; }
+    void setHaveWheelEventHandlers(bool haveWheelEventHandlers) { m_haveWheelEventHandlers = haveWheelEventHandlers; }
+
     const IntRect& visibleLayerRect() const { return m_visibleLayerRect; }
     void setVisibleLayerRect(const IntRect& visibleLayerRect) { m_visibleLayerRect = visibleLayerRect; }
 
@@ -199,6 +207,8 @@ public:
     bool layerPropertyChanged() const { return m_layerPropertyChanged; }
     void resetAllChangeTrackingForSubtree();
 
+    CCLayerAnimationControllerImpl* layerAnimationController() { return m_layerAnimationController.get(); }
+
 protected:
     explicit CCLayerImpl(int);
 
@@ -238,6 +248,7 @@ private:
     IntSize m_contentBounds;
     IntPoint m_scrollPosition;
     bool m_scrollable;
+    bool m_haveWheelEventHandlers;
     Color m_backgroundColor;
     bool m_backgroundCoversViewport;
 
@@ -288,6 +299,8 @@ private:
     Color m_debugBorderColor;
     float m_debugBorderWidth;
 
+    FilterOperations m_filters;
+
     TransformationMatrix m_drawTransform;
     TransformationMatrix m_screenSpaceTransform;
 
@@ -306,6 +319,9 @@ private:
     // Rect indicating what was repainted/updated during update.
     // Note that plugin layers bypass this and leave it empty.
     FloatRect m_updateRect;
+
+    // Manages animations for this layer.
+    OwnPtr<CCLayerAnimationControllerImpl> m_layerAnimationController;
 };
 
 void sortLayers(Vector<RefPtr<CCLayerImpl> >::iterator first, Vector<RefPtr<CCLayerImpl> >::iterator end, CCLayerSorter*);
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCLayerIterator.cpp b/Source/WebCore/platform/graphics/chromium/cc/CCLayerIterator.cpp
index 0767ff0e7..97d6d185a 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCLayerIterator.cpp
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCLayerIterator.cpp
@@ -35,73 +35,73 @@
 
 namespace WebCore {
 
-template <typename LayerType, typename RenderSurfaceType>
-void CCLayerIteratorActions::BackToFront::begin(CCLayerIteratorPosition<LayerType, RenderSurfaceType>& pos)
+template <typename LayerType, typename RenderSurfaceType, typename ActionType>
+void CCLayerIteratorActions::BackToFront::begin(CCLayerIterator<LayerType, RenderSurfaceType, ActionType>& it)
 {
-    pos.targetRenderSurfaceLayerIndex = 0;
-    pos.currentLayerIndex = CCLayerIteratorPositionValue::LayerIndexRepresentingTargetRenderSurface;
+    it.m_targetRenderSurfaceLayerIndex = 0;
+    it.m_currentLayerIndex = CCLayerIteratorValue::LayerIndexRepresentingTargetRenderSurface;
 
     m_highestTargetRenderSurfaceLayer = 0;
 }
 
-template <typename LayerType, typename RenderSurfaceType>
-void CCLayerIteratorActions::BackToFront::end(CCLayerIteratorPosition<LayerType, RenderSurfaceType>& pos)
+template <typename LayerType, typename RenderSurfaceType, typename ActionType>
+void CCLayerIteratorActions::BackToFront::end(CCLayerIterator<LayerType, RenderSurfaceType, ActionType>& it)
 {
-    pos.targetRenderSurfaceLayerIndex = CCLayerIteratorPositionValue::InvalidTargetRenderSurfaceLayerIndex;
-    pos.currentLayerIndex = 0;
+    it.m_targetRenderSurfaceLayerIndex = CCLayerIteratorValue::InvalidTargetRenderSurfaceLayerIndex;
+    it.m_currentLayerIndex = 0;
 }
 
-template <typename LayerType, typename RenderSurfaceType>
-void CCLayerIteratorActions::BackToFront::next(CCLayerIteratorPosition<LayerType, RenderSurfaceType>& pos)
+template <typename LayerType, typename RenderSurfaceType, typename ActionType>
+void CCLayerIteratorActions::BackToFront::next(CCLayerIterator<LayerType, RenderSurfaceType, ActionType>& it)
 {
     // If the current layer has a RS, move to its layer list. Otherwise, visit the next layer in the current RS layer list.
-    if (pos.currentLayerRepresentsContributingRenderSurface()) {
+    if (it.currentLayerRepresentsContributingRenderSurface()) {
         // Save our position in the childLayer list for the RenderSurface, then jump to the next RenderSurface. Save where we
         // came from in the next RenderSurface so we can get back to it.
-        pos.targetRenderSurface()->m_currentLayerIndexHistory = pos.currentLayerIndex;
-        int previousTargetRenderSurfaceLayer = pos.targetRenderSurfaceLayerIndex;
+        it.targetRenderSurface()->m_currentLayerIndexHistory = it.m_currentLayerIndex;
+        int previousTargetRenderSurfaceLayer = it.m_targetRenderSurfaceLayerIndex;
 
-        pos.targetRenderSurfaceLayerIndex = ++m_highestTargetRenderSurfaceLayer;
-        pos.currentLayerIndex = CCLayerIteratorPositionValue::LayerIndexRepresentingTargetRenderSurface;
+        it.m_targetRenderSurfaceLayerIndex = ++m_highestTargetRenderSurfaceLayer;
+        it.m_currentLayerIndex = CCLayerIteratorValue::LayerIndexRepresentingTargetRenderSurface;
 
-        pos.targetRenderSurface()->m_targetRenderSurfaceLayerIndexHistory = previousTargetRenderSurfaceLayer;
+        it.targetRenderSurface()->m_targetRenderSurfaceLayerIndexHistory = previousTargetRenderSurfaceLayer;
     } else {
-        ++pos.currentLayerIndex;
+        ++it.m_currentLayerIndex;
 
-        int targetRenderSurfaceNumChildren = pos.targetRenderSurfaceChildren().size();
-        while (pos.currentLayerIndex == targetRenderSurfaceNumChildren) {
+        int targetRenderSurfaceNumChildren = it.targetRenderSurfaceChildren().size();
+        while (it.m_currentLayerIndex == targetRenderSurfaceNumChildren) {
             // Jump back to the previous RenderSurface, and get back the position where we were in that list, and move to the next position there.
-            if (!pos.targetRenderSurfaceLayerIndex) {
+            if (!it.m_targetRenderSurfaceLayerIndex) {
                 // End of the list
-                pos.targetRenderSurfaceLayerIndex = CCLayerIteratorPositionValue::InvalidTargetRenderSurfaceLayerIndex;
-                pos.currentLayerIndex = 0;
+                it.m_targetRenderSurfaceLayerIndex = CCLayerIteratorValue::InvalidTargetRenderSurfaceLayerIndex;
+                it.m_currentLayerIndex = 0;
                 return;
             }
-            pos.targetRenderSurfaceLayerIndex = pos.targetRenderSurface()->m_targetRenderSurfaceLayerIndexHistory;
-            pos.currentLayerIndex = pos.targetRenderSurface()->m_currentLayerIndexHistory + 1;
+            it.m_targetRenderSurfaceLayerIndex = it.targetRenderSurface()->m_targetRenderSurfaceLayerIndexHistory;
+            it.m_currentLayerIndex = it.targetRenderSurface()->m_currentLayerIndexHistory + 1;
 
-            targetRenderSurfaceNumChildren = pos.targetRenderSurfaceChildren().size();
+            targetRenderSurfaceNumChildren = it.targetRenderSurfaceChildren().size();
         }
     }
 }
 
-template <typename LayerType, typename RenderSurfaceType>
-void CCLayerIteratorActions::FrontToBack::begin(CCLayerIteratorPosition<LayerType, RenderSurfaceType>& pos)
+template <typename LayerType, typename RenderSurfaceType, typename ActionType>
+void CCLayerIteratorActions::FrontToBack::begin(CCLayerIterator<LayerType, RenderSurfaceType, ActionType>& it)
 {
-    pos.targetRenderSurfaceLayerIndex = 0;
-    pos.currentLayerIndex = pos.targetRenderSurfaceChildren().size() - 1;
-    goToHighestInSubtree(pos);
+    it.m_targetRenderSurfaceLayerIndex = 0;
+    it.m_currentLayerIndex = it.targetRenderSurfaceChildren().size() - 1;
+    goToHighestInSubtree(it);
 }
 
-template <typename LayerType, typename RenderSurfaceType>
-void CCLayerIteratorActions::FrontToBack::end(CCLayerIteratorPosition<LayerType, RenderSurfaceType>& pos)
+template <typename LayerType, typename RenderSurfaceType, typename ActionType>
+void CCLayerIteratorActions::FrontToBack::end(CCLayerIterator<LayerType, RenderSurfaceType, ActionType>& it)
 {
-    pos.targetRenderSurfaceLayerIndex = CCLayerIteratorPositionValue::InvalidTargetRenderSurfaceLayerIndex;
-    pos.currentLayerIndex = 0;
+    it.m_targetRenderSurfaceLayerIndex = CCLayerIteratorValue::InvalidTargetRenderSurfaceLayerIndex;
+    it.m_currentLayerIndex = 0;
 }
 
-template <typename LayerType, typename RenderSurfaceType>
-void CCLayerIteratorActions::FrontToBack::next(CCLayerIteratorPosition<LayerType, RenderSurfaceType>& pos)
+template <typename LayerType, typename RenderSurfaceType, typename ActionType>
+void CCLayerIteratorActions::FrontToBack::next(CCLayerIterator<LayerType, RenderSurfaceType, ActionType>& it)
 {
     // Moves to the previous layer in the current RS layer list. Then we check if the
     // new current layer has its own RS, in which case there are things in that RS layer list that are higher, so
@@ -109,61 +109,61 @@ void CCLayerIteratorActions::FrontToBack::next(CCLayerIteratorPosition<LayerType
     // If we move back past the front of the list, we jump up to the previous RS layer list, picking up again where we
     // had previously recursed into the current RS layer list.
 
-    if (!pos.currentLayerRepresentsTargetRenderSurface()) {
+    if (!it.currentLayerRepresentsTargetRenderSurface()) {
         // Subtracting one here will eventually cause the current layer to become that layer
         // representing the target render surface.
-        --pos.currentLayerIndex;
-        goToHighestInSubtree(pos);
+        --it.m_currentLayerIndex;
+        goToHighestInSubtree(it);
     } else {
-        while (pos.currentLayerRepresentsTargetRenderSurface()) {
-            if (!pos.targetRenderSurfaceLayerIndex) {
+        while (it.currentLayerRepresentsTargetRenderSurface()) {
+            if (!it.m_targetRenderSurfaceLayerIndex) {
                 // End of the list
-                pos.targetRenderSurfaceLayerIndex = CCLayerIteratorPositionValue::InvalidTargetRenderSurfaceLayerIndex;
-                pos.currentLayerIndex = 0;
+                it.m_targetRenderSurfaceLayerIndex = CCLayerIteratorValue::InvalidTargetRenderSurfaceLayerIndex;
+                it.m_currentLayerIndex = 0;
                 return;
             }
-            pos.targetRenderSurfaceLayerIndex = pos.targetRenderSurface()->m_targetRenderSurfaceLayerIndexHistory;
-            pos.currentLayerIndex = pos.targetRenderSurface()->m_currentLayerIndexHistory;
+            it.m_targetRenderSurfaceLayerIndex = it.targetRenderSurface()->m_targetRenderSurfaceLayerIndexHistory;
+            it.m_currentLayerIndex = it.targetRenderSurface()->m_currentLayerIndexHistory;
         }
     }
 }
 
-template <typename LayerType, typename RenderSurfaceType>
-void CCLayerIteratorActions::FrontToBack::goToHighestInSubtree(CCLayerIteratorPosition<LayerType, RenderSurfaceType>& pos)
+template <typename LayerType, typename RenderSurfaceType, typename ActionType>
+void CCLayerIteratorActions::FrontToBack::goToHighestInSubtree(CCLayerIterator<LayerType, RenderSurfaceType, ActionType>& it)
 {
-    if (pos.currentLayerRepresentsTargetRenderSurface())
+    if (it.currentLayerRepresentsTargetRenderSurface())
         return;
-    while (pos.currentLayerRepresentsContributingRenderSurface()) {
+    while (it.currentLayerRepresentsContributingRenderSurface()) {
         // Save where we were in the current target surface, move to the next one, and save the target surface that we
         // came from there so we can go back to it.
-        pos.targetRenderSurface()->m_currentLayerIndexHistory = pos.currentLayerIndex;
-        int previousTargetRenderSurfaceLayer = pos.targetRenderSurfaceLayerIndex;
+        it.targetRenderSurface()->m_currentLayerIndexHistory = it.m_currentLayerIndex;
+        int previousTargetRenderSurfaceLayer = it.m_targetRenderSurfaceLayerIndex;
 
-        for (LayerType* layer = pos.currentLayer(); pos.targetRenderSurfaceLayer() != layer; ++pos.targetRenderSurfaceLayerIndex) { }
-        pos.currentLayerIndex = pos.targetRenderSurfaceChildren().size() - 1;
+        for (LayerType* layer = it.currentLayer(); it.targetRenderSurfaceLayer() != layer; ++it.m_targetRenderSurfaceLayerIndex) { }
+        it.m_currentLayerIndex = it.targetRenderSurfaceChildren().size() - 1;
 
-        pos.targetRenderSurface()->m_targetRenderSurfaceLayerIndexHistory = previousTargetRenderSurfaceLayer;
+        it.targetRenderSurface()->m_targetRenderSurfaceLayerIndexHistory = previousTargetRenderSurfaceLayer;
     }
 }
 
 // Declare each of the above functions for LayerChromium and CCLayerImpl classes so that they are linked.
-template void CCLayerIteratorActions::BackToFront::begin(CCLayerIteratorPosition<LayerChromium, RenderSurfaceChromium>&);
-template void CCLayerIteratorActions::BackToFront::end(CCLayerIteratorPosition<LayerChromium, RenderSurfaceChromium>&);
-template void CCLayerIteratorActions::BackToFront::next(CCLayerIteratorPosition<LayerChromium, RenderSurfaceChromium>&);
-
-template void CCLayerIteratorActions::BackToFront::begin(CCLayerIteratorPosition<CCLayerImpl, CCRenderSurface>&);
-template void CCLayerIteratorActions::BackToFront::end(CCLayerIteratorPosition<CCLayerImpl, CCRenderSurface>&);
-template void CCLayerIteratorActions::BackToFront::next(CCLayerIteratorPosition<CCLayerImpl, CCRenderSurface>&);
-
-template void CCLayerIteratorActions::FrontToBack::next(CCLayerIteratorPosition<LayerChromium, RenderSurfaceChromium>&);
-template void CCLayerIteratorActions::FrontToBack::end(CCLayerIteratorPosition<LayerChromium, RenderSurfaceChromium>&);
-template void CCLayerIteratorActions::FrontToBack::begin(CCLayerIteratorPosition<LayerChromium, RenderSurfaceChromium>&);
-template void CCLayerIteratorActions::FrontToBack::goToHighestInSubtree(CCLayerIteratorPosition<LayerChromium, RenderSurfaceChromium>&);
-
-template void CCLayerIteratorActions::FrontToBack::next(CCLayerIteratorPosition<CCLayerImpl, CCRenderSurface>&);
-template void CCLayerIteratorActions::FrontToBack::end(CCLayerIteratorPosition<CCLayerImpl, CCRenderSurface>&);
-template void CCLayerIteratorActions::FrontToBack::begin(CCLayerIteratorPosition<CCLayerImpl, CCRenderSurface>&);
-template void CCLayerIteratorActions::FrontToBack::goToHighestInSubtree(CCLayerIteratorPosition<CCLayerImpl, CCRenderSurface>&);
+template void CCLayerIteratorActions::BackToFront::begin(CCLayerIterator<LayerChromium, RenderSurfaceChromium, BackToFront> &);
+template void CCLayerIteratorActions::BackToFront::end(CCLayerIterator<LayerChromium, RenderSurfaceChromium, BackToFront>&);
+template void CCLayerIteratorActions::BackToFront::next(CCLayerIterator<LayerChromium, RenderSurfaceChromium, BackToFront>&);
+
+template void CCLayerIteratorActions::BackToFront::begin(CCLayerIterator<CCLayerImpl, CCRenderSurface, BackToFront>&);
+template void CCLayerIteratorActions::BackToFront::end(CCLayerIterator<CCLayerImpl, CCRenderSurface, BackToFront>&);
+template void CCLayerIteratorActions::BackToFront::next(CCLayerIterator<CCLayerImpl, CCRenderSurface, BackToFront>&);
+
+template void CCLayerIteratorActions::FrontToBack::next(CCLayerIterator<LayerChromium, RenderSurfaceChromium, FrontToBack>&);
+template void CCLayerIteratorActions::FrontToBack::end(CCLayerIterator<LayerChromium, RenderSurfaceChromium, FrontToBack>&);
+template void CCLayerIteratorActions::FrontToBack::begin(CCLayerIterator<LayerChromium, RenderSurfaceChromium, FrontToBack>&);
+template void CCLayerIteratorActions::FrontToBack::goToHighestInSubtree(CCLayerIterator<LayerChromium, RenderSurfaceChromium, FrontToBack>&);
+
+template void CCLayerIteratorActions::FrontToBack::next(CCLayerIterator<CCLayerImpl, CCRenderSurface, FrontToBack>&);
+template void CCLayerIteratorActions::FrontToBack::end(CCLayerIterator<CCLayerImpl, CCRenderSurface, FrontToBack>&);
+template void CCLayerIteratorActions::FrontToBack::begin(CCLayerIterator<CCLayerImpl, CCRenderSurface, FrontToBack>&);
+template void CCLayerIteratorActions::FrontToBack::goToHighestInSubtree(CCLayerIterator<CCLayerImpl, CCRenderSurface, FrontToBack>&);
 
 } // namespace WebCore
 
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCLayerIterator.h b/Source/WebCore/platform/graphics/chromium/cc/CCLayerIterator.h
index 8f412c44d..be985e153 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCLayerIterator.h
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCLayerIterator.h
@@ -25,7 +25,7 @@
 #ifndef CCLayerIterator_h
 #define CCLayerIterator_h
 
-#include "cc/CCLayerIteratorPosition.h"
+#include "cc/CCLayerTreeHostCommon.h"
 
 #include <wtf/PassOwnPtr.h>
 #include <wtf/RefPtr.h>
@@ -82,43 +82,78 @@ namespace WebCore {
 
 //////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
 
+// Non-templated constants
+struct CCLayerIteratorValue {
+    static const int InvalidTargetRenderSurfaceLayerIndex = -1;
+    // This must be -1 since the iterator action code assumes that this value can be
+    // reached by subtracting one from the position of the first layer in the current
+    // target surface's child layer list, which is 0.
+    static const int LayerIndexRepresentingTargetRenderSurface = -1;
+};
+
 // An iterator class for walking over layers in the RenderSurface-Layer tree.
 template <typename LayerType, typename RenderSurfaceType, typename IteratorActionType>
 class CCLayerIterator {
     typedef CCLayerIterator<LayerType, RenderSurfaceType, IteratorActionType> CCLayerIteratorType;
 
 public:
-    CCLayerIterator() { }
+    CCLayerIterator() : m_renderSurfaceLayerList(0) { }
 
     static CCLayerIteratorType begin(const Vector<RefPtr<LayerType> >* renderSurfaceLayerList) { return CCLayerIteratorType(renderSurfaceLayerList, true); }
     static CCLayerIteratorType end(const Vector<RefPtr<LayerType> >* renderSurfaceLayerList) { return CCLayerIteratorType(renderSurfaceLayerList, false); }
 
-    CCLayerIteratorType& operator++() { ASSERT(m_actions); m_actions->next(m_position); return *this; }
-    bool operator==(const CCLayerIteratorType& other) const { return m_position == other.m_position; }
+    CCLayerIteratorType& operator++() { m_actions.next(*this); return *this; }
+    bool operator==(const CCLayerIterator& other) const
+    {
+        return m_targetRenderSurfaceLayerIndex == other.m_targetRenderSurfaceLayerIndex
+            && m_currentLayerIndex == other.m_currentLayerIndex;
+    }
     bool operator!=(const CCLayerIteratorType& other) const { return !(*this == other); }
 
-    LayerType* operator->() const { return m_position.currentLayer(); }
-    LayerType* operator*() const { return m_position.currentLayer(); }
+    LayerType* operator->() const { return currentLayer(); }
+    LayerType* operator*() const { return currentLayer(); }
 
-    bool representsTargetRenderSurface() const { return m_position.currentLayerRepresentsTargetRenderSurface(); }
-    bool representsContributingRenderSurface() const { return !representsTargetRenderSurface() && m_position.currentLayerRepresentsContributingRenderSurface(); }
+    bool representsTargetRenderSurface() const { return currentLayerRepresentsTargetRenderSurface(); }
+    bool representsContributingRenderSurface() const { return !representsTargetRenderSurface() && currentLayerRepresentsContributingRenderSurface(); }
     bool representsItself() const { return !representsTargetRenderSurface() && !representsContributingRenderSurface(); }
 
-    LayerType* targetRenderSurfaceLayer() const { return m_position.targetRenderSurfaceLayer(); }
+    LayerType* targetRenderSurfaceLayer() const { return (*m_renderSurfaceLayerList)[m_targetRenderSurfaceLayerIndex].get(); }
 
 private:
     CCLayerIterator(const Vector<RefPtr<LayerType> >* renderSurfaceLayerList, bool start)
-        : m_position(renderSurfaceLayerList)
-        , m_actions(adoptPtr(new IteratorActionType()))
+        : m_renderSurfaceLayerList(renderSurfaceLayerList)
     {
         if (start && !renderSurfaceLayerList->isEmpty())
-            m_actions->begin(m_position);
+            m_actions.begin(*this);
         else
-            m_actions->end(m_position);
+            m_actions.end(*this);
     }
 
-    CCLayerIteratorPosition<LayerType, RenderSurfaceType> m_position;
-    OwnPtr<IteratorActionType> m_actions;
+    inline LayerType* currentLayer() const { return currentLayerRepresentsTargetRenderSurface() ? targetRenderSurfaceLayer() : targetRenderSurfaceChildren()[m_currentLayerIndex].get(); }
+
+    inline bool currentLayerRepresentsContributingRenderSurface() const { return CCLayerTreeHostCommon::renderSurfaceContributesToTarget<LayerType>(currentLayer(), targetRenderSurfaceLayer()->id()); }
+    inline bool currentLayerRepresentsTargetRenderSurface() const { return m_currentLayerIndex == CCLayerIteratorValue::LayerIndexRepresentingTargetRenderSurface; }
+
+    inline RenderSurfaceType* targetRenderSurface() const { return targetRenderSurfaceLayer()->renderSurface(); }
+    inline const Vector<RefPtr<LayerType> >& targetRenderSurfaceChildren() const { return targetRenderSurface()->layerList(); }
+
+    IteratorActionType m_actions;
+    const Vector<RefPtr<LayerType> >* m_renderSurfaceLayerList;
+
+    // The iterator's current position.
+
+    // A position in the renderSurfaceLayerList. This points to a layer which owns the current target surface.
+    // This is a value from 0 to n-1 (n = size of renderSurfaceLayerList = number of surfaces). A value outside of
+    // this range (for example, CCLayerIteratorValue::InvalidTargetRenderSurfaceLayerIndex) is used to
+    // indicate a position outside the bounds of the tree.
+    int m_targetRenderSurfaceLayerIndex;
+    // A position in the list of layers that are children of the current target surface. When pointing to one of
+    // these layers, this is a value from 0 to n-1 (n = number of children). Since the iterator must also stop at
+    // the layers representing the target surface, this is done by setting the currentLayerIndex to a value of
+    // CCLayerIteratorValue::LayerRepresentingTargetRenderSurface.
+    int m_currentLayerIndex;
+
+    friend struct CCLayerIteratorActions;
 };
 
 // Orderings for iterating over the RenderSurface-Layer tree.
@@ -126,14 +161,14 @@ struct CCLayerIteratorActions {
     // Walks layers sorted by z-order from back to front.
     class BackToFront {
     public:
-        template <typename LayerType, typename RenderSurfaceType>
-        void begin(CCLayerIteratorPosition<LayerType, RenderSurfaceType>&);
+        template <typename LayerType, typename RenderSurfaceType, typename ActionType>
+        void begin(CCLayerIterator<LayerType, RenderSurfaceType, ActionType>&);
 
-        template <typename LayerType, typename RenderSurfaceType>
-        void end(CCLayerIteratorPosition<LayerType, RenderSurfaceType>&);
+        template <typename LayerType, typename RenderSurfaceType, typename ActionType>
+        void end(CCLayerIterator<LayerType, RenderSurfaceType, ActionType>&);
 
-        template <typename LayerType, typename RenderSurfaceType>
-        void next(CCLayerIteratorPosition<LayerType, RenderSurfaceType>&);
+        template <typename LayerType, typename RenderSurfaceType, typename ActionType>
+        void next(CCLayerIterator<LayerType, RenderSurfaceType, ActionType>&);
 
     private:
         int m_highestTargetRenderSurfaceLayer;
@@ -142,18 +177,18 @@ struct CCLayerIteratorActions {
     // Walks layers sorted by z-order from front to back
     class FrontToBack {
     public:
-        template <typename LayerType, typename RenderSurfaceType>
-        void begin(CCLayerIteratorPosition<LayerType, RenderSurfaceType>&);
+        template <typename LayerType, typename RenderSurfaceType, typename ActionType>
+        void begin(CCLayerIterator<LayerType, RenderSurfaceType, ActionType>&);
 
-        template <typename LayerType, typename RenderSurfaceType>
-        void end(CCLayerIteratorPosition<LayerType, RenderSurfaceType>&);
+        template <typename LayerType, typename RenderSurfaceType, typename ActionType>
+        void end(CCLayerIterator<LayerType, RenderSurfaceType, ActionType>&);
 
-        template <typename LayerType, typename RenderSurfaceType>
-        void next(CCLayerIteratorPosition<LayerType, RenderSurfaceType>&);
+        template <typename LayerType, typename RenderSurfaceType, typename ActionType>
+        void next(CCLayerIterator<LayerType, RenderSurfaceType, ActionType>&);
 
     private:
-        template <typename LayerType, typename RenderSurfaceType>
-        void goToHighestInSubtree(CCLayerIteratorPosition<LayerType, RenderSurfaceType>&);
+        template <typename LayerType, typename RenderSurfaceType, typename ActionType>
+        void goToHighestInSubtree(CCLayerIterator<LayerType, RenderSurfaceType, ActionType>&);
     };
 };
 
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCLayerIteratorPosition.h b/Source/WebCore/platform/graphics/chromium/cc/CCLayerIteratorPosition.h
deleted file mode 100644
index b1f63c45f..000000000
--- a/Source/WebCore/platform/graphics/chromium/cc/CCLayerIteratorPosition.h
+++ /dev/null
@@ -1,86 +0,0 @@
-/*
- * Copyright (C) 2012 Google Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1.  Redistributions of source code must retain the above copyright
- *     notice, this list of conditions and the following disclaimer.
- * 2.  Redistributions in binary form must reproduce the above copyright
- *     notice, this list of conditions and the following disclaimer in the
- *     documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
- * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
- * DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE FOR ANY
- * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
- * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
- * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
- * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
- * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#ifndef CCLayerIteratorPosition_h
-#define CCLayerIteratorPosition_h
-
-#include "cc/CCLayerTreeHostCommon.h"
-
-#include <wtf/RefPtr.h>
-#include <wtf/Vector.h>
-
-namespace WebCore {
-
-// Non-templated constants
-struct CCLayerIteratorPositionValue {
-    static const int InvalidTargetRenderSurfaceLayerIndex = -1;
-    // This must be -1 since the iterator action code assumes that this value can be
-    // reached by subtracting one from the position of the first layer in the current
-    // target surface's child layer list, which is 0.
-    static const int LayerIndexRepresentingTargetRenderSurface = -1;
-};
-
-// A struct to hold the iterator's current position, which is passed to the various CCLayerIteratorAction functions, for them to
-// read and update. This struct exists so the templated action functions don't need to access the CCLayerIterator class.
-//
-// There is a 1:1 relationship between an instance of the CCLayerIteratorPosition class and a CCLayerIteratorActions::Foo class,
-// so an iterator action class can hold extra position data, if required, in its own class instance.
-//
-// The current position of the iterator is held in two integer variables.
-// - The targetRenderSurfaceLayerIndex is a position in the renderSurfaceLayerList. This points to a layer which owns the current
-// target surface. This is a value from 0 to n-1 (n = size of renderSurfaceLayerList = number of surfaces). A value outside of
-// this range (for example, CCLayerIteratorPositionValue::InvalidTargetRenderSurfaceLayerIndex) is used to indicate a position
-// outside the bounds of the tree.
-// - The currentLayerIndex is a position in the list of layers that are children of the current target surface. When pointing to
-// one of these layers, this is a value from 0 to n-1 (n = number of children). Since the iterator must also stop at the layers
-// representing the target surface, this is done by setting the currentLayerIndex to a value of
-// CCLayerIteratorPositionValue::LayerRepresentingTargetRenderSurface.
-template<typename LayerType, typename RenderSurfaceType>
-struct CCLayerIteratorPosition {
-    CCLayerIteratorPosition() : renderSurfaceLayerList(0) { }
-    explicit CCLayerIteratorPosition(const Vector<RefPtr<LayerType> >* renderSurfaceLayerList) : renderSurfaceLayerList(renderSurfaceLayerList) { }
-
-    inline LayerType* currentLayer() const { return currentLayerRepresentsTargetRenderSurface() ? targetRenderSurfaceLayer() : targetRenderSurfaceChildren()[currentLayerIndex].get(); }
-
-    inline bool currentLayerRepresentsContributingRenderSurface() const { return CCLayerTreeHostCommon::renderSurfaceContributesToTarget<LayerType>(currentLayer(), targetRenderSurfaceLayer()->id()); }
-    inline bool currentLayerRepresentsTargetRenderSurface() const { return currentLayerIndex == CCLayerIteratorPositionValue::LayerIndexRepresentingTargetRenderSurface; }
-
-    inline LayerType* targetRenderSurfaceLayer() const { return (*renderSurfaceLayerList)[targetRenderSurfaceLayerIndex].get(); }
-    inline RenderSurfaceType* targetRenderSurface() const { return targetRenderSurfaceLayer()->renderSurface(); }
-    inline const Vector<RefPtr<LayerType> >& targetRenderSurfaceChildren() const { return targetRenderSurface()->layerList(); }
-
-    inline bool operator==(const CCLayerIteratorPosition& other) const
-    {
-        return targetRenderSurfaceLayerIndex == other.targetRenderSurfaceLayerIndex
-            && currentLayerIndex == other.currentLayerIndex;
-    }
-
-    const Vector<RefPtr<LayerType> >* renderSurfaceLayerList;
-    int targetRenderSurfaceLayerIndex;
-    int currentLayerIndex;
-};
-
-} // namespace WebCore
-
-#endif
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCLayerTilingData.cpp b/Source/WebCore/platform/graphics/chromium/cc/CCLayerTilingData.cpp
index 27705f324..cfefbd2b8 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCLayerTilingData.cpp
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCLayerTilingData.cpp
@@ -74,23 +74,21 @@ const CCLayerTilingData& CCLayerTilingData::operator=(const CCLayerTilingData& t
     return *this;
 }
 
-void CCLayerTilingData::addTile(PassRefPtr<Tile> tile, int i, int j)
+void CCLayerTilingData::addTile(PassOwnPtr<Tile> tile, int i, int j)
 {
     ASSERT(!tileAt(i, j));
     tile->moveTo(i, j);
     m_tiles.add(make_pair(i, j), tile);
 }
 
-PassRefPtr<CCLayerTilingData::Tile> CCLayerTilingData::takeTile(int i, int j)
+PassOwnPtr<CCLayerTilingData::Tile> CCLayerTilingData::takeTile(int i, int j)
 {
     return m_tiles.take(make_pair(i, j));
 }
 
 CCLayerTilingData::Tile* CCLayerTilingData::tileAt(int i, int j) const
 {
-    Tile* tile = m_tiles.get(make_pair(i, j)).get();
-    ASSERT(!tile || tile->refCount() == 1);
-    return tile;
+    return m_tiles.get(make_pair(i, j));
 }
 
 void CCLayerTilingData::reset()
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCLayerTilingData.h b/Source/WebCore/platform/graphics/chromium/cc/CCLayerTilingData.h
index 46ae88117..869d42e15 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCLayerTilingData.h
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCLayerTilingData.h
@@ -34,7 +34,6 @@
 #include <wtf/HashMap.h>
 #include <wtf/HashTraits.h>
 #include <wtf/PassOwnPtr.h>
-#include <wtf/RefCounted.h>
 
 namespace WebCore {
 
@@ -61,7 +60,7 @@ public:
 
     const CCLayerTilingData& operator=(const CCLayerTilingData&);
 
-    class Tile: public RefCounted<Tile> {
+    class Tile {
         WTF_MAKE_NONCOPYABLE(Tile);
     public:
         Tile() : m_i(-1), m_j(-1) { }
@@ -84,13 +83,10 @@ public:
         static void constructDeletedValue(TileMapKey& slot) { slot = std::make_pair(-2, -2); }
         static bool isDeletedValue(TileMapKey value) { return value.first == -2 && value.second == -2; }
     };
-    // FIXME: The mapped value in TileMap should really be an OwnPtr, as the
-    // refcount of a Tile should never be more than 1. However, HashMap
-    // doesn't easily support OwnPtr as a value.
-    typedef HashMap<TileMapKey, RefPtr<Tile>, DefaultHash<TileMapKey>::Hash, TileMapKeyTraits> TileMap;
+    typedef HashMap<TileMapKey, OwnPtr<Tile>, DefaultHash<TileMapKey>::Hash, TileMapKeyTraits> TileMap;
 
-    void addTile(PassRefPtr<Tile>, int, int);
-    PassRefPtr<Tile> takeTile(int, int);
+    void addTile(PassOwnPtr<Tile>, int, int);
+    PassOwnPtr<Tile> takeTile(int, int);
     Tile* tileAt(int, int) const;
     const TileMap& tiles() const { return m_tiles; }
 
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCLayerTreeHost.cpp b/Source/WebCore/platform/graphics/chromium/cc/CCLayerTreeHost.cpp
index 15a3074eb..501ee17de 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCLayerTreeHost.cpp
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCLayerTreeHost.cpp
@@ -68,10 +68,9 @@ CCLayerTreeHost::CCLayerTreeHost(CCLayerTreeHostClient* client, const CCSettings
     , m_layerRendererInitialized(false)
     , m_settings(settings)
     , m_visible(true)
-    , m_haveWheelEventHandlers(false)
-    , m_pageScale(1)
-    , m_minPageScale(1)
-    , m_maxPageScale(1)
+    , m_pageScaleFactor(1)
+    , m_minPageScaleFactor(1)
+    , m_maxPageScaleFactor(1)
     , m_triggerIdlePaints(true)
     , m_partialTextureUpdateRequests(0)
 {
@@ -171,15 +170,16 @@ void CCLayerTreeHost::finishCommitOnImplThread(CCLayerTreeHostImpl* hostImpl)
     ASSERT(CCProxy::isImplThread());
 
     // Synchronize trees, if one exists at all...
-    if (rootLayer())
+    if (rootLayer()) {
         hostImpl->setRootLayer(TreeSynchronizer::synchronizeTrees(rootLayer(), hostImpl->rootLayer()));
-    else
+        // We may have added an animation during the tree sync. This will cause hostImpl to visit its controllers.
+        hostImpl->setNeedsAnimateLayers();
+    } else
         hostImpl->setRootLayer(0);
 
     hostImpl->setSourceFrameNumber(frameNumber());
-    hostImpl->setHaveWheelEventHandlers(m_haveWheelEventHandlers);
     hostImpl->setViewportSize(viewportSize());
-    hostImpl->setPageScaleFactorAndLimits(pageScale(), m_minPageScale, m_maxPageScale);
+    hostImpl->setPageScaleFactorAndLimits(m_pageScaleFactor, m_minPageScaleFactor, m_maxPageScaleFactor);
 
     m_frameNumber++;
 }
@@ -254,12 +254,17 @@ void CCLayerTreeHost::setNeedsCommit()
 
 void CCLayerTreeHost::setNeedsRedraw()
 {
-    if (CCThreadProxy::implThread())
-        m_proxy->setNeedsRedraw();
-    else
+    m_proxy->setNeedsRedraw();
+    if (!CCThreadProxy::implThread())
         m_client->scheduleComposite();
 }
 
+void CCLayerTreeHost::setAnimationEvents(PassOwnPtr<CCAnimationEventsVector> events)
+{
+    ASSERT(CCThreadProxy::isMainThread());
+    // FIXME: need to walk the tree.
+}
+
 void CCLayerTreeHost::setRootLayer(PassRefPtr<LayerChromium> rootLayer)
 {
     if (m_rootLayer == rootLayer)
@@ -286,22 +291,14 @@ void CCLayerTreeHost::setViewportSize(const IntSize& viewportSize)
     setNeedsCommit();
 }
 
-void CCLayerTreeHost::setPageScale(float pageScale)
+void CCLayerTreeHost::setPageScaleFactorAndLimits(float pageScaleFactor, float minPageScaleFactor, float maxPageScaleFactor)
 {
-    if (pageScale == m_pageScale)
+    if (pageScaleFactor == m_pageScaleFactor && minPageScaleFactor == m_minPageScaleFactor && maxPageScaleFactor == m_maxPageScaleFactor)
         return;
 
-    m_pageScale = pageScale;
-    setNeedsCommit();
-}
-
-void CCLayerTreeHost::setPageScaleFactorLimits(float minScale, float maxScale)
-{
-    if (minScale == m_minPageScale && maxScale == m_maxPageScale)
-        return;
-
-    m_minPageScale = minScale;
-    m_maxPageScale = maxScale;
+    m_pageScaleFactor = pageScaleFactor;
+    m_minPageScaleFactor = minPageScaleFactor;
+    m_maxPageScaleFactor = maxPageScaleFactor;
     setNeedsCommit();
 }
 
@@ -343,21 +340,20 @@ void CCLayerTreeHost::didBecomeInvisibleOnImplThread(CCLayerTreeHostImpl* hostIm
         hostImpl->setRootLayer(0);
         return;
     }
-    if (rootLayer())
+
+    if (rootLayer()) {
         hostImpl->setRootLayer(TreeSynchronizer::synchronizeTrees(rootLayer(), hostImpl->rootLayer()));
-    else
+        // We may have added an animation during the tree sync. This will cause hostImpl to visit its controllers.
+        hostImpl->setNeedsAnimateLayers();
+    } else
         hostImpl->setRootLayer(0);
 }
 
-void CCLayerTreeHost::setHaveWheelEventHandlers(bool haveWheelEventHandlers)
+void CCLayerTreeHost::startPageScaleAnimation(const IntSize& targetPosition, bool useAnchor, float scale, double durationSec)
 {
-    if (m_haveWheelEventHandlers == haveWheelEventHandlers)
-        return;
-    m_haveWheelEventHandlers = haveWheelEventHandlers;
-    m_proxy->setNeedsCommit();
+    m_proxy->startPageScaleAnimation(targetPosition, useAnchor, scale, durationSec);
 }
 
-
 void CCLayerTreeHost::loseCompositorContext(int numTimes)
 {
     m_proxy->loseCompositorContext(numTimes);
@@ -448,7 +444,7 @@ void CCLayerTreeHost::reserveTextures()
 
     CCLayerIteratorType end = CCLayerIteratorType::end(&m_updateList);
     for (CCLayerIteratorType it = CCLayerIteratorType::begin(&m_updateList); it != end; ++it) {
-        if (it.representsTargetRenderSurface() || !it->alwaysReserveTextures())
+        if (!it.representsItself() || !it->alwaysReserveTextures())
             continue;
         it->reserveTextures();
     }
@@ -502,10 +498,18 @@ static void enterTargetRenderSurface(Vector<RenderSurfaceRegion>& stack, RenderS
         stack.append(RenderSurfaceRegion());
         stack.last().surface = newTarget;
     } else if (stack.last().surface != newTarget) {
+        // If we are entering a subtree that is going to move pixels around, then the occlusion we've computed
+        // so far won't apply to the pixels we're drawing here in the same way. We discard the occlusion thus
+        // far to be safe, and ensure we don't cull any pixels that are moved such that they become visible.
+        const RenderSurfaceChromium* oldAncestorThatMovesPixels = stack.last().surface->nearestAncestorThatMovesPixels();
+        const RenderSurfaceChromium* newAncestorThatMovesPixels = newTarget->nearestAncestorThatMovesPixels();
+        bool enteringSubtreeThatMovesPixels = newAncestorThatMovesPixels && newAncestorThatMovesPixels != oldAncestorThatMovesPixels;
+
         stack.append(RenderSurfaceRegion());
         stack.last().surface = newTarget;
         int lastIndex = stack.size() - 1;
-        stack[lastIndex].occludedInScreen = stack[lastIndex - 1].occludedInScreen;
+        if (!enteringSubtreeThatMovesPixels)
+            stack[lastIndex].occludedInScreen = stack[lastIndex - 1].occludedInScreen;
     }
 }
 
@@ -548,7 +552,7 @@ void CCLayerTreeHost::paintLayerContents(const LayerList& renderSurfaceLayerList
             paintMaskAndReplicaForRenderSurface(*it, paintType);
             // FIXME: add the replica layer to the current occlusion
 
-            if (it->maskLayer() || it->renderSurface()->drawOpacity() < 1)
+            if (it->maskLayer() || it->renderSurface()->drawOpacity() < 1 || it->renderSurface()->filters().hasFilterThatAffectsOpacity())
                 targetSurfaceStack.last().occludedInScreen = Region();
         } else if (it.representsItself()) {
             ASSERT(!it->bounds().isEmpty());
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCLayerTreeHost.h b/Source/WebCore/platform/graphics/chromium/cc/CCLayerTreeHost.h
index e82f29830..1662f50c3 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCLayerTreeHost.h
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCLayerTreeHost.h
@@ -30,6 +30,7 @@
 #include "LayerChromium.h"
 #include "RateLimiter.h"
 #include "TransformationMatrix.h"
+#include "cc/CCAnimationEvents.h"
 #include "cc/CCLayerTreeHostCommon.h"
 #include "cc/CCProxy.h"
 
@@ -75,6 +76,7 @@ struct CCSettings {
             , refreshRate(0)
             , perTilePainting(false)
             , partialSwapEnabled(false)
+            , threadedAnimationEnabled(false)
             , maxPartialTextureUpdates(std::numeric_limits<size_t>::max()) { }
 
     bool acceleratePainting;
@@ -84,6 +86,7 @@ struct CCSettings {
     double refreshRate;
     bool perTilePainting;
     bool partialSwapEnabled;
+    bool threadedAnimationEnabled;
     size_t maxPartialTextureUpdates;
 };
 
@@ -163,6 +166,8 @@ public:
     virtual void setNeedsCommit();
     void setNeedsRedraw();
 
+    void setAnimationEvents(PassOwnPtr<CCAnimationEventsVector>);
+
     LayerChromium* rootLayer() { return m_rootLayer.get(); }
     const LayerChromium* rootLayer() const { return m_rootLayer.get(); }
     void setRootLayer(PassRefPtr<LayerChromium>);
@@ -173,21 +178,18 @@ public:
 
     const IntSize& viewportSize() const { return m_viewportSize; }
 
-    void setPageScale(float);
-    float pageScale() const { return m_pageScale; }
-
-    void setPageScaleFactorLimits(float minScale, float maxScale);
+    void setPageScaleFactorAndLimits(float pageScaleFactor, float minPageScaleFactor, float maxPageScaleFactor);
 
     TextureManager* contentsTextureManager() const;
 
     bool visible() const { return m_visible; }
     void setVisible(bool);
 
-    void setHaveWheelEventHandlers(bool);
-
     // Returns false if we should abort this frame due to initialization failure.
     bool updateLayers();
 
+    void startPageScaleAnimation(const IntSize& targetPosition, bool useAnchor, float scale, double durationSec);
+
     void updateCompositorResources(GraphicsContext3D*, CCTextureUpdater&);
     void applyScrollAndScale(const CCScrollAndScaleSet&);
     void startRateLimiter(GraphicsContext3D*);
@@ -236,12 +238,11 @@ private:
 
     IntSize m_viewportSize;
     bool m_visible;
-    bool m_haveWheelEventHandlers;
     typedef HashMap<GraphicsContext3D*, RefPtr<RateLimiter> > RateLimiterMap;
     RateLimiterMap m_rateLimiters;
 
-    float m_pageScale;
-    float m_minPageScale, m_maxPageScale;
+    float m_pageScaleFactor;
+    float m_minPageScaleFactor, m_maxPageScaleFactor;
     bool m_triggerIdlePaints;
 
     TextureList m_deleteTextureAfterCommitList;
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCLayerTreeHostCommon.cpp b/Source/WebCore/platform/graphics/chromium/cc/CCLayerTreeHostCommon.cpp
index b4e7be415..4fc869400 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCLayerTreeHostCommon.cpp
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCLayerTreeHostCommon.cpp
@@ -72,7 +72,7 @@ static bool isScaleOrTranslation(const TransformationMatrix& m)
 }
 
 template<typename LayerType>
-bool layerShouldBeSkipped(LayerType* layer)
+static bool layerShouldBeSkipped(LayerType* layer)
 {
     // Layers can be skipped if any of these conditions are met.
     //   - does not draw content.
@@ -104,10 +104,53 @@ bool layerShouldBeSkipped(LayerType* layer)
     return false;
 }
 
+template<typename LayerType>
+static bool subtreeShouldRenderToSeparateSurface(LayerType* layer, bool axisAlignedWithRespectToParent)
+{
+    // FIXME: If we decide to create a render surface here while this layer does
+    //        preserve-3d, then we may be sorting incorrectly because we will not be
+    //        sorting the individual layers of this subtree with other layers outside of
+    //        this subtree.
+
+    // Cache this value, because otherwise it walks the entire subtree several times.
+    bool descendantDrawsContent = layer->descendantDrawsContent();
+
+    //
+    // A layer and its descendants should render onto a new RenderSurface if any of these rules hold:
+    //
+
+    // If the layer uses a mask.
+    if (layer->maskLayer())
+        return true;
+
+    // If the layer has a reflection.
+    if (layer->replicaLayer())
+        return true;
+
+    // If the layer uses a CSS filter.
+    if (!layer->filters().isEmpty())
+        return true;
+
+    // If the layer flattens its subtree (i.e. the layer doesn't preserve-3d), but it is
+    // treated as a 3D object by its parent (i.e. parent does preserve-3d).
+    if (layer->parent() && layer->parent()->preserves3D() && !layer->preserves3D() && descendantDrawsContent)
+        return true;
+
+    // If the layer clips its descendants but it is not axis-aligned with respect to its parent.
+    if (layer->masksToBounds() && !axisAlignedWithRespectToParent && descendantDrawsContent)
+        return true;
+
+    // If the layer has opacity != 1 and does not have a preserves-3d transform style.
+    if (layer->opacity() != 1 && !layer->preserves3D() && descendantDrawsContent)
+        return true;
+
+    return false;
+}
+
 // Recursively walks the layer tree starting at the given node and computes all the
 // necessary transformations, clipRects, render surfaces, etc.
 template<typename LayerType, typename RenderSurfaceType, typename LayerSorter>
-static bool calculateDrawTransformsAndVisibilityInternal(LayerType* layer, LayerType* rootLayer, const TransformationMatrix& parentMatrix, const TransformationMatrix& fullHierarchyMatrix, Vector<RefPtr<LayerType> >& renderSurfaceLayerList, Vector<RefPtr<LayerType> >& layerList, LayerSorter* layerSorter, int maxTextureSize)
+static bool calculateDrawTransformsAndVisibilityInternal(LayerType* layer, LayerType* rootLayer, const TransformationMatrix& parentMatrix, const TransformationMatrix& fullHierarchyMatrix, RenderSurfaceType* nearestAncestorThatMovesPixels, Vector<RefPtr<LayerType> >& renderSurfaceLayerList, Vector<RefPtr<LayerType> >& layerList, LayerSorter* layerSorter, int maxTextureSize)
 {
     typedef Vector<RefPtr<LayerType> > LayerList;
 
@@ -229,22 +272,7 @@ static bool calculateDrawTransformsAndVisibilityInternal(LayerType* layer, Layer
     // FIXME: This seems like the wrong place to set this
     layer->setUsesLayerClipping(false);
 
-    // The layer and its descendants render on a new RenderSurface if any of
-    // these conditions hold:
-    // 1. The layer clips its descendants and its transform is not a simple translation.
-    // 2. If the layer has opacity != 1 and does not have a preserves-3d transform style.
-    // 3. The layer uses a mask
-    // 4. The layer has a replica (used for reflections)
-    // 5. The layer doesn't preserve-3d but is the child of a layer which does.
-    // If a layer preserves-3d then we don't create a RenderSurface for it to avoid flattening
-    // out its children. The opacity value of the children layers is multiplied by the opacity
-    // of their parent.
-    bool useSurfaceForClipping = layer->masksToBounds() && !isScaleOrTranslation(combinedTransform);
-    bool useSurfaceForOpacity = layer->opacity() != 1 && !layer->preserves3D();
-    bool useSurfaceForMasking = layer->maskLayer();
-    bool useSurfaceForReflection = layer->replicaLayer();
-    bool useSurfaceForFlatDescendants = layer->parent() && layer->parent()->preserves3D() && !layer->preserves3D() && layer->descendantDrawsContent();
-    if (useSurfaceForMasking || useSurfaceForReflection || useSurfaceForFlatDescendants || ((useSurfaceForClipping || useSurfaceForOpacity) && layer->descendantDrawsContent())) {
+    if (subtreeShouldRenderToSeparateSurface(layer, isScaleOrTranslation(combinedTransform))) {
         if (!layer->renderSurface())
             layer->createRenderSurface();
 
@@ -258,6 +286,7 @@ static bool calculateDrawTransformsAndVisibilityInternal(LayerType* layer, Layer
 
         transformedLayerRect = IntRect(0, 0, bounds.width(), bounds.height());
 
+        // The opacity value is moved from the layer to its surface, so that the entire subtree properly inherits opacity.
         renderSurface->setDrawOpacity(drawOpacity);
         layer->setDrawOpacity(1);
 
@@ -282,6 +311,11 @@ static bool calculateDrawTransformsAndVisibilityInternal(LayerType* layer, Layer
         if (layer->replicaLayer() && layer->replicaLayer()->maskLayer())
             layer->replicaLayer()->maskLayer()->setTargetRenderSurface(renderSurface);
 
+        renderSurface->setFilters(layer->filters());
+        if (renderSurface->filters().hasFilterThatMovesPixels())
+            nearestAncestorThatMovesPixels = renderSurface;
+        renderSurface->setNearestAncestorThatMovesPixels(nearestAncestorThatMovesPixels);
+
         renderSurfaceLayerList.append(layer);
     } else {
         layer->setDrawTransform(combinedTransform);
@@ -289,18 +323,19 @@ static bool calculateDrawTransformsAndVisibilityInternal(LayerType* layer, Layer
 
         layer->setDrawOpacity(drawOpacity);
 
-        if (layer->parent()) {
+        if (layer != rootLayer) {
+            ASSERT(layer->parent());
+            layer->clearRenderSurface();
+
             // Layers inherit the clip rect from their parent.
             layer->setClipRect(layer->parent()->clipRect());
             if (layer->parent()->usesLayerClipping())
                 layer->setUsesLayerClipping(true);
 
+            // Layers without their own renderSurface will render into the nearest ancestor surface.
             layer->setTargetRenderSurface(layer->parent()->targetRenderSurface());
         }
 
-        if (layer != rootLayer)
-            layer->clearRenderSurface();
-
         if (layer->masksToBounds()) {
             IntRect clipRect = transformedLayerRect;
             clipRect.intersect(layer->clipRect());
@@ -316,13 +351,6 @@ static bool calculateDrawTransformsAndVisibilityInternal(LayerType* layer, Layer
     layerScreenSpaceTransform.translate3d(-0.5 * bounds.width(), -0.5 * bounds.height(), 0);
     layer->setScreenSpaceTransform(layerScreenSpaceTransform);
 
-    if (layer->renderSurface())
-        layer->setTargetRenderSurface(layer->renderSurface());
-    else {
-        ASSERT(layer->parent());
-        layer->setTargetRenderSurface(layer->parent()->targetRenderSurface());
-    }
-
     // drawableContentRect() is always stored in the coordinate system of the
     // RenderSurface the layer draws into.
     if (layer->drawsContent()) {
@@ -362,7 +390,7 @@ static bool calculateDrawTransformsAndVisibilityInternal(LayerType* layer, Layer
 
     for (size_t i = 0; i < layer->children().size(); ++i) {
         LayerType* child = layer->children()[i].get();
-        bool drawsContent = calculateDrawTransformsAndVisibilityInternal<LayerType, RenderSurfaceType, LayerSorter>(child, rootLayer, sublayerMatrix, nextHierarchyMatrix, renderSurfaceLayerList, descendants, layerSorter, maxTextureSize);
+        bool drawsContent = calculateDrawTransformsAndVisibilityInternal<LayerType, RenderSurfaceType, LayerSorter>(child, rootLayer, sublayerMatrix, nextHierarchyMatrix, nearestAncestorThatMovesPixels, renderSurfaceLayerList, descendants, layerSorter, maxTextureSize);
 
         if (drawsContent) {
             if (child->renderSurface()) {
@@ -379,7 +407,7 @@ static bool calculateDrawTransformsAndVisibilityInternal(LayerType* layer, Layer
         }
     }
 
-    if (layer->masksToBounds() || useSurfaceForMasking) {
+    if (layer->masksToBounds() || layer->maskLayer()) {
         IntRect drawableContentRect = layer->drawableContentRect();
         drawableContentRect.intersect(transformedLayerRect);
         layer->setDrawableContentRect(drawableContentRect);
@@ -484,13 +512,13 @@ static void walkLayersAndCalculateVisibleLayerRects(const Vector<RefPtr<LayerTyp
 
 void CCLayerTreeHostCommon::calculateDrawTransformsAndVisibility(LayerChromium* layer, LayerChromium* rootLayer, const TransformationMatrix& parentMatrix, const TransformationMatrix& fullHierarchyMatrix, Vector<RefPtr<LayerChromium> >& renderSurfaceLayerList, Vector<RefPtr<LayerChromium> >& layerList, int maxTextureSize)
 {
-    WebCore::calculateDrawTransformsAndVisibilityInternal<LayerChromium, RenderSurfaceChromium, void*>(layer, rootLayer, parentMatrix, fullHierarchyMatrix, renderSurfaceLayerList, layerList, 0, maxTextureSize);
+    WebCore::calculateDrawTransformsAndVisibilityInternal<LayerChromium, RenderSurfaceChromium, void*>(layer, rootLayer, parentMatrix, fullHierarchyMatrix, 0, renderSurfaceLayerList, layerList, 0, maxTextureSize);
     walkLayersAndCalculateVisibleLayerRects<LayerChromium, RenderSurfaceChromium>(renderSurfaceLayerList);
 }
 
 void CCLayerTreeHostCommon::calculateDrawTransformsAndVisibility(CCLayerImpl* layer, CCLayerImpl* rootLayer, const TransformationMatrix& parentMatrix, const TransformationMatrix& fullHierarchyMatrix, Vector<RefPtr<CCLayerImpl> >& renderSurfaceLayerList, Vector<RefPtr<CCLayerImpl> >& layerList, CCLayerSorter* layerSorter, int maxTextureSize)
 {
-    calculateDrawTransformsAndVisibilityInternal<CCLayerImpl, CCRenderSurface, CCLayerSorter>(layer, rootLayer, parentMatrix, fullHierarchyMatrix, renderSurfaceLayerList, layerList, layerSorter, maxTextureSize);
+    calculateDrawTransformsAndVisibilityInternal<CCLayerImpl, CCRenderSurface, CCLayerSorter>(layer, rootLayer, parentMatrix, fullHierarchyMatrix, 0, renderSurfaceLayerList, layerList, layerSorter, maxTextureSize);
     walkLayersAndCalculateVisibleLayerRects<CCLayerImpl, CCRenderSurface>(renderSurfaceLayerList);
 }
 
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCLayerTreeHostImpl.cpp b/Source/WebCore/platform/graphics/chromium/cc/CCLayerTreeHostImpl.cpp
index 088377cdd..d30c68c37 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCLayerTreeHostImpl.cpp
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCLayerTreeHostImpl.cpp
@@ -31,6 +31,7 @@
 #include "LayerRendererChromium.h"
 #include "TraceEvent.h"
 #include "cc/CCDamageTracker.h"
+#include "cc/CCLayerIterator.h"
 #include "cc/CCLayerTreeHost.h"
 #include "cc/CCLayerTreeHostCommon.h"
 #include "cc/CCPageScaleAnimation.h"
@@ -51,12 +52,12 @@ CCLayerTreeHostImpl::CCLayerTreeHostImpl(const CCSettings& settings, CCLayerTree
     , m_frameNumber(0)
     , m_settings(settings)
     , m_visible(true)
-    , m_haveWheelEventHandlers(false)
     , m_pageScale(1)
     , m_pageScaleDelta(1)
     , m_sentPageScaleDelta(1)
     , m_minPageScale(0)
     , m_maxPageScale(0)
+    , m_needsAnimateLayers(false)
     , m_pinchGestureActive(false)
 {
     ASSERT(CCProxy::isImplThread());
@@ -97,21 +98,8 @@ GraphicsContext3D* CCLayerTreeHostImpl::context()
 
 void CCLayerTreeHostImpl::animate(double frameBeginTimeMs)
 {
-    if (!m_pageScaleAnimation)
-        return;
-
-    IntSize scrollTotal = toSize(m_scrollLayerImpl->scrollPosition() + m_scrollLayerImpl->scrollDelta());
-
-    setPageScaleDelta(m_pageScaleAnimation->pageScaleAtTime(frameBeginTimeMs) / m_pageScale);
-    IntSize nextScroll = m_pageScaleAnimation->scrollOffsetAtTime(frameBeginTimeMs);
-    nextScroll.scale(1 / m_pageScaleDelta);
-    m_scrollLayerImpl->scrollBy(nextScroll - scrollTotal);
-    m_client->setNeedsRedrawOnImplThread();
-
-    if (m_pageScaleAnimation->isAnimationCompleteAtTime(frameBeginTimeMs)) {
-        m_pageScaleAnimation.clear();
-        m_client->setNeedsCommitOnImplThread();
-    }
+    animatePageScale(frameBeginTimeMs);
+    animateLayers(frameBeginTimeMs);
 }
 
 void CCLayerTreeHostImpl::startPageScaleAnimation(const IntSize& targetPosition, bool anchorPoint, float pageScale, double startTimeMs, double durationMs)
@@ -136,6 +124,7 @@ void CCLayerTreeHostImpl::startPageScaleAnimation(const IntSize& targetPosition,
         m_pageScaleAnimation->zoomTo(targetPosition, pageScale, durationMs);
 
     m_client->setNeedsRedrawOnImplThread();
+    m_client->setNeedsCommitOnImplThread();
 }
 
 void CCLayerTreeHostImpl::trackDamageForAllSurfaces(CCLayerImpl* rootDrawLayer, const CCLayerList& renderSurfaceLayerList)
@@ -187,9 +176,8 @@ static FloatRect damageInSurfaceSpace(CCLayerImpl* renderSurfaceLayer, const Flo
     return surfaceDamageRect;
 }
 
-void CCLayerTreeHostImpl::calculateRenderPasses(CCRenderPassList& passes)
+void CCLayerTreeHostImpl::calculateRenderPasses(CCRenderPassList& passes, CCLayerList& renderSurfaceLayerList)
 {
-    CCLayerList renderSurfaceLayerList;
     renderSurfaceLayerList.append(rootLayer());
 
     if (!rootLayer()->renderSurface())
@@ -241,8 +229,42 @@ void CCLayerTreeHostImpl::calculateRenderPasses(CCRenderPassList& passes)
 
 void CCLayerTreeHostImpl::optimizeRenderPasses(CCRenderPassList& passes)
 {
-    for (unsigned i = 0; i < passes.size(); ++i)
-        passes[i]->optimizeQuads();
+    TRACE_EVENT1("webkit", "CCLayerTreeHostImpl::optimizeRenderPasses", "passes.size()", static_cast<long long unsigned>(passes.size()));
+
+    bool haveDamageRect = layerRendererCapabilities().usingPartialSwap;
+
+    for (unsigned i = 0; i < passes.size(); ++i) {
+        FloatRect damageRect = passes[i]->targetSurface()->damageTracker()->currentDamageRect();
+        passes[i]->optimizeQuads(haveDamageRect, damageRect);
+    }
+}
+
+void CCLayerTreeHostImpl::animateLayersRecursive(CCLayerImpl* current, double frameBeginTimeSecs, CCAnimationEventsVector& events, bool& didAnimate, bool& needsAnimateLayers)
+{
+    bool subtreeNeedsAnimateLayers = false;
+
+    CCLayerAnimationControllerImpl* currentController = current->layerAnimationController();
+
+    bool hadActiveAnimation = currentController->hasActiveAnimation();
+    currentController->animate(frameBeginTimeSecs, events);
+    bool startedAnimation = events.size() > 0;
+
+    // We animated if we either ticked a running animation, or started a new animation.
+    if (hadActiveAnimation || startedAnimation)
+        didAnimate = true;
+
+    // If the current controller still has an active animation, we must continue animating layers.
+    if (currentController->hasActiveAnimation())
+         subtreeNeedsAnimateLayers = true;
+
+    for (size_t i = 0; i < current->children().size(); ++i) {
+        bool childNeedsAnimateLayers = false;
+        animateLayersRecursive(current->children()[i].get(), frameBeginTimeSecs, events, didAnimate, childNeedsAnimateLayers);
+        if (childNeedsAnimateLayers)
+            subtreeNeedsAnimateLayers = true;
+    }
+
+    needsAnimateLayers = subtreeNeedsAnimateLayers;
 }
 
 IntSize CCLayerTreeHostImpl::contentSize() const
@@ -263,13 +285,22 @@ void CCLayerTreeHostImpl::drawLayers()
         return;
 
     CCRenderPassList passes;
-    calculateRenderPasses(passes);
+    CCLayerList renderSurfaceLayerList;
+    calculateRenderPasses(passes, renderSurfaceLayerList);
 
     optimizeRenderPasses(passes);
 
     m_layerRenderer->beginDrawingFrame();
     for (size_t i = 0; i < passes.size(); ++i)
         m_layerRenderer->drawRenderPass(passes[i].get());
+
+    typedef CCLayerIterator<CCLayerImpl, CCRenderSurface, CCLayerIteratorActions::BackToFront> CCLayerIteratorType;
+
+    CCLayerIteratorType end = CCLayerIteratorType::end(&renderSurfaceLayerList);
+    for (CCLayerIteratorType it = CCLayerIteratorType::begin(&renderSurfaceLayerList); it != end; ++it) {
+        if (it.representsItself() && !it->visibleLayerRect().isEmpty())
+            it->didDraw();
+    }
     m_layerRenderer->finishDrawingFrame();
 
     ++m_frameNumber;
@@ -456,11 +487,18 @@ void CCLayerTreeHostImpl::setNeedsRedraw()
     m_client->setNeedsRedrawOnImplThread();
 }
 
-CCInputHandlerClient::ScrollStatus CCLayerTreeHostImpl::scrollBegin(const IntPoint&)
+CCInputHandlerClient::ScrollStatus CCLayerTreeHostImpl::scrollBegin(const IntPoint& point, CCInputHandlerClient::ScrollInputType type)
 {
     // TODO: Check for scrollable sublayers.
-    if (!m_scrollLayerImpl || !m_scrollLayerImpl->scrollable())
+    if (!m_scrollLayerImpl || !m_scrollLayerImpl->scrollable()) {
+        TRACE_EVENT("scrollBegin Ignored no scrollable", this, 0);
         return ScrollIgnored;
+    }
+
+    if (type == CCInputHandlerClient::Wheel && m_scrollLayerImpl->haveWheelEventHandlers()) {
+        TRACE_EVENT("scrollBegin Failed wheelEventHandlers", this, 0);
+        return ScrollFailed;
+    }
 
     return ScrollStarted;
 }
@@ -480,14 +518,10 @@ void CCLayerTreeHostImpl::scrollEnd()
 {
 }
 
-bool CCLayerTreeHostImpl::haveWheelEventHandlers()
-{
-    return m_haveWheelEventHandlers;
-}
-
 void CCLayerTreeHostImpl::pinchGestureBegin()
 {
     m_pinchGestureActive = true;
+    m_previousPinchAnchor = IntPoint();
 }
 
 void CCLayerTreeHostImpl::pinchGestureUpdate(float magnifyDelta,
@@ -495,18 +529,20 @@ void CCLayerTreeHostImpl::pinchGestureUpdate(float magnifyDelta,
 {
     TRACE_EVENT("CCLayerTreeHostImpl::pinchGestureUpdate", this, 0);
 
-    if (magnifyDelta == 1.0)
-        return;
     if (!m_scrollLayerImpl)
         return;
 
+    if (m_previousPinchAnchor == IntPoint::zero())
+        m_previousPinchAnchor = anchor;
+
     // Keep the center-of-pinch anchor specified by (x, y) in a stable
     // position over the course of the magnify.
-    FloatPoint prevScaleAnchor(anchor.x() / m_pageScaleDelta, anchor.y() / m_pageScaleDelta);
+    FloatPoint previousScaleAnchor(m_previousPinchAnchor.x() / m_pageScaleDelta, m_previousPinchAnchor.y() / m_pageScaleDelta);
     setPageScaleDelta(m_pageScaleDelta * magnifyDelta);
     FloatPoint newScaleAnchor(anchor.x() / m_pageScaleDelta, anchor.y() / m_pageScaleDelta);
+    FloatSize move = previousScaleAnchor - newScaleAnchor;
 
-    FloatSize move = prevScaleAnchor - newScaleAnchor;
+    m_previousPinchAnchor = anchor;
 
     m_scrollLayerImpl->scrollBy(roundedIntSize(move));
     m_client->setNeedsCommitOnImplThread();
@@ -520,12 +556,68 @@ void CCLayerTreeHostImpl::pinchGestureEnd()
     m_client->setNeedsCommitOnImplThread();
 }
 
+void CCLayerTreeHostImpl::computeDoubleTapZoomDeltas(CCScrollAndScaleSet* scrollInfo)
+{
+    float pageScale = m_pageScaleAnimation->finalPageScale();
+    IntSize scrollOffset = m_pageScaleAnimation->finalScrollOffset();
+    scrollOffset.scale(m_pageScale / pageScale);
+    makeScrollAndScaleSet(scrollInfo, scrollOffset, pageScale);
+}
+
+void CCLayerTreeHostImpl::computePinchZoomDeltas(CCScrollAndScaleSet* scrollInfo)
+{
+    if (!m_scrollLayerImpl)
+        return;
+
+    // Only send fake scroll/zoom deltas if we're pinch zooming out by a
+    // significant amount. This also ensures only one fake delta set will be
+    // sent.
+    const float pinchZoomOutSensitivity = 0.95;
+    if (m_pageScaleDelta > pinchZoomOutSensitivity)
+        return;
+
+    // Compute where the scroll offset/page scale would be if fully pinch-zoomed
+    // out from the anchor point.
+    FloatSize scrollBegin = toSize(m_scrollLayerImpl->scrollPosition() + m_scrollLayerImpl->scrollDelta());
+    scrollBegin.scale(m_pageScaleDelta);
+    float scaleBegin = m_pageScale * m_pageScaleDelta;
+    float pageScaleDeltaToSend = m_minPageScale / m_pageScale;
+    FloatSize scaledContentsSize = contentSize();
+    scaledContentsSize.scale(pageScaleDeltaToSend);
+
+    FloatSize anchor = toSize(m_previousPinchAnchor);
+    FloatSize scrollEnd = scrollBegin + anchor;
+    scrollEnd.scale(m_minPageScale / scaleBegin);
+    scrollEnd -= anchor;
+    scrollEnd = scrollEnd.shrunkTo(roundedIntSize(scaledContentsSize - m_viewportSize)).expandedTo(FloatSize(0, 0));
+    scrollEnd.scale(1 / pageScaleDeltaToSend);
+
+    makeScrollAndScaleSet(scrollInfo, roundedIntSize(scrollEnd), m_minPageScale);
+}
+
+void CCLayerTreeHostImpl::makeScrollAndScaleSet(CCScrollAndScaleSet* scrollInfo, const IntSize& scrollOffset, float pageScale)
+{
+    if (!m_scrollLayerImpl)
+        return;
+
+    CCLayerTreeHostCommon::ScrollUpdateInfo scroll;
+    scroll.layerId = m_scrollLayerImpl->id();
+    scroll.scrollDelta = scrollOffset - toSize(m_scrollLayerImpl->scrollPosition());
+    scrollInfo->scrolls.append(scroll);
+    m_scrollLayerImpl->setSentScrollDelta(scroll.scrollDelta);
+    m_sentPageScaleDelta = scrollInfo->pageScaleDelta = pageScale / m_pageScale;
+}
+
 PassOwnPtr<CCScrollAndScaleSet> CCLayerTreeHostImpl::processScrollDeltas()
 {
     OwnPtr<CCScrollAndScaleSet> scrollInfo = adoptPtr(new CCScrollAndScaleSet());
     bool didMove = m_scrollLayerImpl && (!m_scrollLayerImpl->scrollDelta().isZero() || m_pageScaleDelta != 1.0f);
     if (!didMove || m_pinchGestureActive || m_pageScaleAnimation) {
         m_sentPageScaleDelta = scrollInfo->pageScaleDelta = 1;
+        if (m_pinchGestureActive)
+            computePinchZoomDeltas(scrollInfo.get());
+        else if (m_pageScaleAnimation.get())
+            computeDoubleTapZoomDeltas(scrollInfo.get());
         return scrollInfo.release();
     }
 
@@ -542,4 +634,51 @@ PassOwnPtr<CCScrollAndScaleSet> CCLayerTreeHostImpl::processScrollDeltas()
     return scrollInfo.release();
 }
 
+void CCLayerTreeHostImpl::setFullRootLayerDamage()
+{
+    if (rootLayer()) {
+        CCRenderSurface* renderSurface = rootLayer()->renderSurface();
+        if (renderSurface)
+            renderSurface->damageTracker()->forceFullDamageNextUpdate();
+    }
 }
+
+void CCLayerTreeHostImpl::animatePageScale(double frameBeginTimeMs)
+{
+    if (!m_pageScaleAnimation)
+        return;
+
+    IntSize scrollTotal = toSize(m_scrollLayerImpl->scrollPosition() + m_scrollLayerImpl->scrollDelta());
+
+    setPageScaleDelta(m_pageScaleAnimation->pageScaleAtTime(frameBeginTimeMs) / m_pageScale);
+    IntSize nextScroll = m_pageScaleAnimation->scrollOffsetAtTime(frameBeginTimeMs);
+    nextScroll.scale(1 / m_pageScaleDelta);
+    m_scrollLayerImpl->scrollBy(nextScroll - scrollTotal);
+    m_client->setNeedsRedrawOnImplThread();
+
+    if (m_pageScaleAnimation->isAnimationCompleteAtTime(frameBeginTimeMs)) {
+        m_pageScaleAnimation.clear();
+        m_client->setNeedsCommitOnImplThread();
+    }
+}
+
+void CCLayerTreeHostImpl::animateLayers(double frameBeginTimeMs)
+{
+    if (!m_settings.threadedAnimationEnabled || !m_needsAnimateLayers || !m_rootLayerImpl)
+        return;
+
+    TRACE_EVENT("CCLayerTreeHostImpl::animateLayers", this, 0);
+
+    OwnPtr<CCAnimationEventsVector> events(adoptPtr(new CCAnimationEventsVector));
+
+    bool didAnimate = false;
+    animateLayersRecursive(m_rootLayerImpl.get(), frameBeginTimeMs / 1000, *events, didAnimate, m_needsAnimateLayers);
+
+    if (!events->isEmpty())
+        m_client->postAnimationEventsToMainThreadOnImplThread(events.release());
+
+    if (didAnimate)
+        m_client->setNeedsRedrawOnImplThread();
+}
+
+} // namespace WebCore
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCLayerTreeHostImpl.h b/Source/WebCore/platform/graphics/chromium/cc/CCLayerTreeHostImpl.h
index 569d69fa3..e438db0c4 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCLayerTreeHostImpl.h
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCLayerTreeHostImpl.h
@@ -25,11 +25,13 @@
 #ifndef CCLayerTreeHostImpl_h
 #define CCLayerTreeHostImpl_h
 
+#include "cc/CCAnimationEvents.h"
 #include "cc/CCInputHandler.h"
 #include "cc/CCLayerSorter.h"
 #include "cc/CCLayerTreeHost.h"
 #include "cc/CCLayerTreeHostCommon.h"
 #include "cc/CCRenderPass.h"
+#include <wtf/PassOwnPtr.h>
 #include <wtf/RefPtr.h>
 
 namespace WebCore {
@@ -48,6 +50,7 @@ public:
     virtual void onSwapBuffersCompleteOnImplThread() = 0;
     virtual void setNeedsRedrawOnImplThread() = 0;
     virtual void setNeedsCommitOnImplThread() = 0;
+    virtual void postAnimationEventsToMainThreadOnImplThread(PassOwnPtr<CCAnimationEventsVector>) = 0;
 };
 
 // CCLayerTreeHostImpl owns the CCLayerImpl tree as well as associated rendering state
@@ -59,16 +62,15 @@ public:
 
     // CCInputHandlerClient implementation
     virtual void setNeedsRedraw();
-    virtual CCInputHandlerClient::ScrollStatus scrollBegin(const IntPoint&);
+    virtual CCInputHandlerClient::ScrollStatus scrollBegin(const IntPoint&, CCInputHandlerClient::ScrollInputType);
     virtual void scrollBy(const IntSize&);
     virtual void scrollEnd();
-    virtual bool haveWheelEventHandlers();
     virtual void pinchGestureBegin();
     virtual void pinchGestureUpdate(float, const IntPoint&);
     virtual void pinchGestureEnd();
     virtual void startPageScaleAnimation(const IntSize& targetPosition, bool anchorPoint, float pageScale, double startTimeMs, double durationMs);
 
-    // Virtual for testing
+    // Virtual for testing.
     virtual void beginCommit();
     virtual void commitComplete();
     virtual void animate(double frameDisplayTimeMs);
@@ -98,7 +100,6 @@ public:
 
     bool visible() const { return m_visible; }
     void setVisible(bool);
-    void setHaveWheelEventHandlers(bool haveWheelEventHandlers) { m_haveWheelEventHandlers = haveWheelEventHandlers; }
 
     int sourceFrameNumber() const { return m_sourceFrameNumber; }
     void setSourceFrameNumber(int frameNumber) { m_sourceFrameNumber = frameNumber; }
@@ -113,8 +114,23 @@ public:
 
     PassOwnPtr<CCScrollAndScaleSet> processScrollDeltas();
 
+    // Where possible, redraws are scissored to a damage region calculated from changes to
+    // layer properties. This function overrides the damage region for the next draw cycle.
+    void setFullRootLayerDamage();
+
+    void startPageScaleAnimation(const IntSize& tragetPosition, bool useAnchor, float scale, double durationSec);
+
+    bool needsAnimateLayers() const { return m_needsAnimateLayers; }
+    void setNeedsAnimateLayers() { m_needsAnimateLayers = true; }
+
 protected:
     CCLayerTreeHostImpl(const CCSettings&, CCLayerTreeHostImplClient*);
+
+    void animatePageScale(double frameBeginTimeMs);
+
+    // Virtual for testing.
+    virtual void animateLayers(double frameBeginTimeMs);
+
     CCLayerTreeHostImplClient* m_client;
     int m_sourceFrameNumber;
     int m_frameNumber;
@@ -122,13 +138,18 @@ protected:
 private:
     typedef Vector<RefPtr<CCLayerImpl> > CCLayerList;
 
+    void computeDoubleTapZoomDeltas(CCScrollAndScaleSet* scrollInfo);
+    void computePinchZoomDeltas(CCScrollAndScaleSet* scrollInfo);
+    void makeScrollAndScaleSet(CCScrollAndScaleSet* scrollInfo, const IntSize& scrollOffset, float pageScale);
+
     void setPageScaleDelta(float);
     void applyPageScaleDeltaToScrollLayer();
     void adjustScrollsForPageScaleChange(float);
     void updateMaxScrollPosition();
     void trackDamageForAllSurfaces(CCLayerImpl* rootDrawLayer, const CCLayerList& renderSurfaceLayerList);
-    void calculateRenderPasses(CCRenderPassList&);
+    void calculateRenderPasses(CCRenderPassList&, CCLayerList& renderSurfaceLayerList);
     void optimizeRenderPasses(CCRenderPassList&);
+    void animateLayersRecursive(CCLayerImpl*, double frameBeginTimeSecs, CCAnimationEventsVector&, bool& didAnimate, bool& needsAnimateLayers);
     IntSize contentSize() const;
 
     OwnPtr<LayerRendererChromium> m_layerRenderer;
@@ -137,14 +158,16 @@ private:
     CCSettings m_settings;
     IntSize m_viewportSize;
     bool m_visible;
-    bool m_haveWheelEventHandlers;
 
     float m_pageScale;
     float m_pageScaleDelta;
     float m_sentPageScaleDelta;
     float m_minPageScale, m_maxPageScale;
 
+    // If this is true, it is necessary to traverse the layer tree ticking the animators.
+    bool m_needsAnimateLayers;
     bool m_pinchGestureActive;
+    IntPoint m_previousPinchAnchor;
 
     OwnPtr<CCPageScaleAnimation> m_pageScaleAnimation;
 
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCOcclusionTracker.cpp b/Source/WebCore/platform/graphics/chromium/cc/CCOcclusionTracker.cpp
new file mode 100644
index 000000000..c5611ac27
--- /dev/null
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCOcclusionTracker.cpp
@@ -0,0 +1,351 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#if USE(ACCELERATED_COMPOSITING)
+
+#include "cc/CCOcclusionTracker.h"
+
+#include "LayerChromium.h"
+#include "cc/CCLayerImpl.h"
+
+#include <algorithm>
+
+using namespace std;
+
+namespace WebCore {
+
+template<typename LayerType, typename RenderSurfaceType>
+void CCOcclusionTrackerBase<LayerType, RenderSurfaceType>::enterTargetRenderSurface(const RenderSurfaceType* newTarget)
+{
+    if (!m_stack.isEmpty() && m_stack.last().surface == newTarget)
+        return;
+
+    const RenderSurfaceType* oldTarget = m_stack.isEmpty() ? 0 : m_stack.last().surface;
+    const RenderSurfaceType* oldAncestorThatMovesPixels = !oldTarget ? 0 : oldTarget->nearestAncestorThatMovesPixels();
+    const RenderSurfaceType* newAncestorThatMovesPixels = newTarget->nearestAncestorThatMovesPixels();
+
+    m_stack.append(StackObject());
+    m_stack.last().surface = newTarget;
+
+    // We copy the screen occlusion into the new RenderSurface subtree, but we never copy in the
+    // target occlusion, since we are looking at a new RenderSurface target.
+
+    // If we are entering a subtree that is going to move pixels around, then the occlusion we've computed
+    // so far won't apply to the pixels we're drawing here in the same way. We discard the occlusion thus
+    // far to be safe, and ensure we don't cull any pixels that are moved such that they become visible.
+    bool enteringSubtreeThatMovesPixels = newAncestorThatMovesPixels && newAncestorThatMovesPixels != oldAncestorThatMovesPixels;
+
+    bool copyScreenOcclusionForward = m_stack.size() > 1 && !enteringSubtreeThatMovesPixels;
+    if (copyScreenOcclusionForward) {
+        int lastIndex = m_stack.size() - 1;
+        m_stack[lastIndex].occlusionInScreen = m_stack[lastIndex - 1].occlusionInScreen;
+    }
+}
+
+template<typename LayerType, typename RenderSurfaceType>
+void CCOcclusionTrackerBase<LayerType, RenderSurfaceType>::finishedTargetRenderSurface(const LayerType* owningLayer, const RenderSurfaceType* finishedTarget)
+{
+    // FIXME: Remove the owningLayer parameter when we can get all the info from the surface.
+    ASSERT(owningLayer->renderSurface() == finishedTarget);
+
+    // Make sure we know about the target surface.
+    enterTargetRenderSurface(finishedTarget);
+
+    if (owningLayer->maskLayer() || finishedTarget->drawOpacity() < 1 || finishedTarget->filters().hasFilterThatAffectsOpacity()) {
+        m_stack.last().occlusionInScreen = Region();
+        m_stack.last().occlusionInTarget = Region();
+    }
+}
+
+template<typename RenderSurfaceType>
+static inline Region transformSurfaceOpaqueRegion(const RenderSurfaceType* surface, const Region& region, const TransformationMatrix& transform)
+{
+    // Verify that rects within the |surface| will remain rects in its target surface after applying |transform|. If this is true, then
+    // apply |transform| to each rect within |region| in order to transform the entire Region.
+
+    IntRect bounds = region.bounds();
+    FloatRect centeredBounds(-bounds.width() / 2.0, -bounds.height() / 2.0, bounds.width(), bounds.height());
+    FloatQuad transformedBoundsQuad = transform.mapQuad(FloatQuad(centeredBounds));
+    if (!transformedBoundsQuad.isRectilinear())
+        return Region();
+
+    Region transformedRegion;
+
+    IntRect surfaceBounds = surface->contentRect();
+    Vector<IntRect> rects = region.rects();
+    Vector<IntRect>::const_iterator end = rects.end();
+    for (Vector<IntRect>::const_iterator i = rects.begin(); i != end; ++i) {
+        FloatRect centeredOriginRect(-i->width() / 2.0 + i->x() - surfaceBounds.x(), -i->height() / 2.0 + i->y() - surfaceBounds.y(), i->width(), i->height());
+        FloatRect transformedRect = transform.mapRect(FloatRect(centeredOriginRect));
+        transformedRegion.unite(enclosedIntRect(transformedRect));
+    }
+    return transformedRegion;
+}
+
+template<typename LayerType, typename RenderSurfaceType>
+void CCOcclusionTrackerBase<LayerType, RenderSurfaceType>::leaveToTargetRenderSurface(const RenderSurfaceType* newTarget)
+{
+    int lastIndex = m_stack.size() - 1;
+    bool surfaceWillBeAtTopAfterPop = m_stack.size() > 1 && m_stack[lastIndex - 1].surface == newTarget;
+
+    // We merge the screen occlusion from the current RenderSurface subtree out to its parent target RenderSurface.
+    // The target occlusion can be merged out as well but needs to be transformed to the new target.
+
+    const RenderSurfaceType* oldTarget = m_stack[lastIndex].surface;
+    Region oldTargetOcclusionInNewTarget = transformSurfaceOpaqueRegion<RenderSurfaceType>(oldTarget, m_stack[lastIndex].occlusionInTarget, oldTarget->drawTransform());
+
+    if (surfaceWillBeAtTopAfterPop) {
+        // Merge the top of the stack down.
+
+        m_stack[lastIndex - 1].occlusionInScreen.unite(m_stack[lastIndex].occlusionInScreen);
+        m_stack[lastIndex - 1].occlusionInTarget.unite(oldTargetOcclusionInNewTarget);
+        m_stack.removeLast();
+    } else {
+        // Replace the top of the stack with the new pushed surface. Copy the occluded screen region to the top.
+        m_stack.last().surface = newTarget;
+        m_stack.last().occlusionInTarget = oldTargetOcclusionInNewTarget;
+    }
+}
+
+template<typename LayerType>
+static inline TransformationMatrix contentToScreenSpaceTransform(const LayerType* layer)
+{
+    IntSize boundsInLayerSpace = layer->bounds();
+    IntSize boundsInContentSpace = layer->contentBounds();
+
+    TransformationMatrix transform = layer->screenSpaceTransform();
+
+    if (boundsInContentSpace.isEmpty())
+        return transform;
+
+    // Scale from content space to layer space
+    transform.scaleNonUniform(boundsInLayerSpace.width() / static_cast<double>(boundsInContentSpace.width()),
+                              boundsInLayerSpace.height() / static_cast<double>(boundsInContentSpace.height()));
+
+    return transform;
+}
+
+template<typename LayerType>
+static inline TransformationMatrix contentToTargetSurfaceTransform(const LayerType* layer)
+{
+    IntSize boundsInLayerSpace = layer->bounds();
+    IntSize boundsInContentSpace = layer->contentBounds();
+
+    TransformationMatrix transform = layer->drawTransform();
+
+    if (boundsInContentSpace.isEmpty())
+        return transform;
+
+    // Scale from content space to layer space
+    transform.scaleNonUniform(boundsInLayerSpace.width() / static_cast<double>(boundsInContentSpace.width()),
+                              boundsInLayerSpace.height() / static_cast<double>(boundsInContentSpace.height()));
+
+    // The draw transform expects the origin to be in the middle of the layer.
+    transform.translate(-boundsInContentSpace.width() / 2.0, -boundsInContentSpace.height() / 2.0);
+
+    return transform;
+}
+
+template<typename LayerType>
+static inline Region computeOcclusionBehindLayer(const LayerType* layer, const TransformationMatrix& transform)
+{
+    Region opaqueRegion;
+
+    FloatQuad unoccludedQuad = transform.mapQuad(FloatQuad(layer->visibleLayerRect()));
+    bool isPaintedAxisAligned = unoccludedQuad.isRectilinear();
+    if (!isPaintedAxisAligned)
+        return opaqueRegion;
+
+    if (layer->opaque())
+        opaqueRegion = enclosedIntRect(unoccludedQuad.boundingBox());
+    // FIXME: Capture opaque paints: else opaqueRegion = layer->opaqueContentsRegion(transform);
+    return opaqueRegion;
+}
+
+template<typename LayerType, typename RenderSurfaceType>
+void CCOcclusionTrackerBase<LayerType, RenderSurfaceType>::markOccludedBehindLayer(const LayerType* layer)
+{
+    ASSERT(!m_stack.isEmpty());
+    ASSERT(layer->targetRenderSurface() == m_stack.last().surface);
+
+    if (layer->drawOpacity() != 1)
+        return;
+
+    TransformationMatrix contentToScreenSpace = contentToScreenSpaceTransform<LayerType>(layer);
+    TransformationMatrix contentToTargetSurface = contentToTargetSurfaceTransform<LayerType>(layer);
+
+    m_stack.last().occlusionInScreen.unite(computeOcclusionBehindLayer<LayerType>(layer, contentToScreenSpace));
+    m_stack.last().occlusionInTarget.unite(computeOcclusionBehindLayer<LayerType>(layer, contentToTargetSurface));
+}
+
+static inline bool testContentRectOccluded(const IntRect& contentRect, const TransformationMatrix& contentSpaceTransform, const Region& occlusion)
+{
+    FloatQuad transformedQuad = contentSpaceTransform.mapQuad(FloatQuad(contentRect));
+    return occlusion.contains(transformedQuad.enclosingBoundingBox());
+}
+
+template<typename LayerType, typename RenderSurfaceType>
+bool CCOcclusionTrackerBase<LayerType, RenderSurfaceType>::occluded(const LayerType* layer, const IntRect& contentRect) const
+{
+    if (m_stack.isEmpty())
+        return false;
+
+    ASSERT(layer->targetRenderSurface() == m_stack.last().surface);
+
+    if (testContentRectOccluded(contentRect, contentToScreenSpaceTransform<LayerType>(layer), m_stack.last().occlusionInScreen))
+        return true;
+    if (testContentRectOccluded(contentRect, contentToTargetSurfaceTransform<LayerType>(layer), m_stack.last().occlusionInTarget))
+        return true;
+    return false;
+}
+
+template<typename LayerType, typename RenderSurfaceType>
+bool CCOcclusionTrackerBase<LayerType, RenderSurfaceType>::surfaceOccluded(const LayerType* layer, const IntRect& surfaceContentRect) const
+{
+    // A surface is not occluded by layers drawing into itself, so we need to use occlusion from one spot down on the stack.
+    if (m_stack.size() < 2)
+        return false;
+
+    ASSERT(layer->renderSurface());
+    ASSERT(layer->renderSurface() == m_stack.last().surface);
+
+    TransformationMatrix surfaceContentToScreenSpace = contentToScreenSpaceTransform<LayerType>(layer);
+
+    const StackObject& secondLast = m_stack[m_stack.size()-2];
+    if (testContentRectOccluded(surfaceContentRect, surfaceContentToScreenSpace, secondLast.occlusionInScreen))
+        return true;
+    return false;
+}
+
+// Determines what portion of rect, if any, is unoccluded (not occluded by region). If
+// the resulting unoccluded region is not rectangular, we return a rect containing it.
+static inline IntRect rectSubtractRegion(const IntRect& rect, const Region& region)
+{
+    Region rectRegion(rect);
+    Region intersectRegion(intersect(region, rectRegion));
+
+    if (intersectRegion.isEmpty())
+        return rect;
+
+    rectRegion.subtract(intersectRegion);
+    IntRect boundsRect = rectRegion.bounds();
+    return boundsRect;
+}
+
+static IntRect computeUnoccludedContentRect(const IntRect& contentRect, const TransformationMatrix& contentSpaceTransform, const Region& occlusion)
+{
+    FloatQuad transformedQuad = contentSpaceTransform.mapQuad(FloatQuad(contentRect));
+    if (!transformedQuad.isRectilinear())
+        return contentRect;
+    // Take the enclosingIntRect at each step here, as we want to contain any unoccluded partial pixels in the resulting IntRect.
+    IntRect shrunkRect = rectSubtractRegion(enclosingIntRect(transformedQuad.boundingBox()), occlusion);
+    IntRect unoccludedRect = enclosingIntRect(contentSpaceTransform.inverse().mapRect(FloatRect(shrunkRect)));
+    // The use of enclosingIntRect, with floating point rounding, can give us a result that is not a sub-rect of contentRect, but our
+    // return value should be a sub-rect.
+    return intersection(unoccludedRect, contentRect);
+}
+
+template<typename LayerType, typename RenderSurfaceType>
+IntRect CCOcclusionTrackerBase<LayerType, RenderSurfaceType>::unoccludedContentRect(const LayerType* layer, const IntRect& contentRect) const
+{
+    if (m_stack.isEmpty())
+        return contentRect;
+
+    // We want to return a rect that contains all the visible parts of |contentRect| in both screen space and in the target surface.
+    // So we find the visible parts of |contentRect| in each space, and take the intersection.
+
+    TransformationMatrix contentToScreenSpace = contentToScreenSpaceTransform<LayerType>(layer);
+    TransformationMatrix contentToTargetSurface = contentToTargetSurfaceTransform<LayerType>(layer);
+
+    IntRect unoccludedInScreen = computeUnoccludedContentRect(contentRect, contentToScreenSpace, m_stack.last().occlusionInScreen);
+    IntRect unoccludedInTarget = computeUnoccludedContentRect(contentRect, contentToTargetSurface, m_stack.last().occlusionInTarget);
+
+    return intersection(unoccludedInScreen, unoccludedInTarget);
+}
+
+template<typename LayerType, typename RenderSurfaceType>
+IntRect CCOcclusionTrackerBase<LayerType, RenderSurfaceType>::surfaceUnoccludedContentRect(const LayerType* layer, const IntRect& surfaceContentRect) const
+{
+    // A surface is not occluded by layers drawing into itself, so we need to use occlusion from one spot down on the stack.
+    if (m_stack.size() < 2)
+        return surfaceContentRect;
+
+    ASSERT(layer->renderSurface());
+    ASSERT(layer->renderSurface() == m_stack.last().surface);
+
+    // We want to return a rect that contains all the visible parts of |contentRect| in both screen space and in the target surface.
+    // So we find the visible parts of |contentRect| in each space, and take the intersection.
+
+    TransformationMatrix contentToScreenSpace = contentToScreenSpaceTransform<LayerType>(layer);
+
+    const StackObject& secondLast = m_stack[m_stack.size()-2];
+    IntRect unoccludedInScreen = computeUnoccludedContentRect(surfaceContentRect, contentToScreenSpace, secondLast.occlusionInScreen);
+
+    return unoccludedInScreen;
+}
+
+template<typename LayerType, typename RenderSurfaceType>
+const Region& CCOcclusionTrackerBase<LayerType, RenderSurfaceType>::currentOcclusionInScreenSpace() const
+{
+    ASSERT(!m_stack.isEmpty());
+    return m_stack.last().occlusionInScreen;
+}
+
+template<typename LayerType, typename RenderSurfaceType>
+const Region& CCOcclusionTrackerBase<LayerType, RenderSurfaceType>::currentOcclusionInTargetSurface() const
+{
+    ASSERT(!m_stack.isEmpty());
+    return m_stack.last().occlusionInTarget;
+}
+
+
+// Declare the possible functions here for the linker.
+template void CCOcclusionTrackerBase<LayerChromium, RenderSurfaceChromium>::enterTargetRenderSurface(const RenderSurfaceChromium* newTarget);
+template void CCOcclusionTrackerBase<LayerChromium, RenderSurfaceChromium>::finishedTargetRenderSurface(const LayerChromium* owningLayer, const RenderSurfaceChromium* finishedTarget);
+template void CCOcclusionTrackerBase<LayerChromium, RenderSurfaceChromium>::leaveToTargetRenderSurface(const RenderSurfaceChromium* newTarget);
+template void CCOcclusionTrackerBase<LayerChromium, RenderSurfaceChromium>::markOccludedBehindLayer(const LayerChromium*);
+template bool CCOcclusionTrackerBase<LayerChromium, RenderSurfaceChromium>::occluded(const LayerChromium*, const IntRect& contentRect) const;
+template bool CCOcclusionTrackerBase<LayerChromium, RenderSurfaceChromium>::surfaceOccluded(const LayerChromium*, const IntRect& surfaceContentRect) const;
+template IntRect CCOcclusionTrackerBase<LayerChromium, RenderSurfaceChromium>::unoccludedContentRect(const LayerChromium*, const IntRect& contentRect) const;
+template IntRect CCOcclusionTrackerBase<LayerChromium, RenderSurfaceChromium>::surfaceUnoccludedContentRect(const LayerChromium*, const IntRect& surfaceContentRect) const;
+template const Region& CCOcclusionTrackerBase<LayerChromium, RenderSurfaceChromium>::currentOcclusionInScreenSpace() const;
+template const Region& CCOcclusionTrackerBase<LayerChromium, RenderSurfaceChromium>::currentOcclusionInTargetSurface() const;
+
+template void CCOcclusionTrackerBase<CCLayerImpl, CCRenderSurface>::enterTargetRenderSurface(const CCRenderSurface* newTarget);
+template void CCOcclusionTrackerBase<CCLayerImpl, CCRenderSurface>::finishedTargetRenderSurface(const CCLayerImpl* owningLayer, const CCRenderSurface* finishedTarget);
+template void CCOcclusionTrackerBase<CCLayerImpl, CCRenderSurface>::leaveToTargetRenderSurface(const CCRenderSurface* newTarget);
+template void CCOcclusionTrackerBase<CCLayerImpl, CCRenderSurface>::markOccludedBehindLayer(const CCLayerImpl*);
+template bool CCOcclusionTrackerBase<CCLayerImpl, CCRenderSurface>::occluded(const CCLayerImpl*, const IntRect& contentRect) const;
+template bool CCOcclusionTrackerBase<CCLayerImpl, CCRenderSurface>::surfaceOccluded(const CCLayerImpl*, const IntRect& surfaceContentRect) const;
+template IntRect CCOcclusionTrackerBase<CCLayerImpl, CCRenderSurface>::unoccludedContentRect(const CCLayerImpl*, const IntRect& contentRect) const;
+template IntRect CCOcclusionTrackerBase<CCLayerImpl, CCRenderSurface>::surfaceUnoccludedContentRect(const CCLayerImpl*, const IntRect& surfaceContentRect) const;
+template const Region& CCOcclusionTrackerBase<CCLayerImpl, CCRenderSurface>::currentOcclusionInScreenSpace() const;
+template const Region& CCOcclusionTrackerBase<CCLayerImpl, CCRenderSurface>::currentOcclusionInTargetSurface() const;
+
+
+} // namespace WebCore
+#endif // USE(ACCELERATED_COMPOSITING)
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCOcclusionTracker.h b/Source/WebCore/platform/graphics/chromium/cc/CCOcclusionTracker.h
new file mode 100644
index 000000000..d1c833e1a
--- /dev/null
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCOcclusionTracker.h
@@ -0,0 +1,101 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef CCOcclusionTracker_h
+#define CCOcclusionTracker_h
+
+#include "FloatQuad.h"
+#include "Region.h"
+#include "TransformationMatrix.h"
+
+namespace WebCore {
+class CCLayerImpl;
+class CCRenderSurface;
+class LayerChromium;
+class RenderSurfaceChromium;
+
+// This class is used to track occlusion of layers while traversing them in a front-to-back order. As each layer is visited, one of the
+// methods in this class is called to notify it about the current target surface.
+// Then, occlusion in the content space of the current layer may be queried, via methods such as occluded() and unoccludedContentRect().
+// If the current layer owns a RenderSurface, then occlusion on that RenderSurface may also be queried via surfaceOccluded() and surfaceUnoccludedContentRect().
+// Finally, once finished with the layer, occlusion behind the layer should be marked by calling markOccludedBehindLayer().
+template<typename LayerType, typename RenderSurfaceType>
+class CCOcclusionTrackerBase {
+public:
+    CCOcclusionTrackerBase() { }
+
+    // Called when visiting a layer representing itself. If the target was not already current, then this indicates we have entered a new surface subtree.
+    void enterTargetRenderSurface(const RenderSurfaceType* newTarget);
+
+    // Called when visiting a layer representing a target surface. This indicates we have visited all the layers within the surface, and we may
+    // perform any surface-wide operations.
+    void finishedTargetRenderSurface(const LayerType*, const RenderSurfaceType* finishedTarget);
+
+    // Called when visiting a layer representing a contributing surface. This  indicates that we are leaving our current surface, and
+    // entering the new one. We then perform any operations required for merging results from the child subtree into its parent.
+    void leaveToTargetRenderSurface(const RenderSurfaceType* newTarget);
+
+    // Add the layer's occlusion to the tracked state.
+    void markOccludedBehindLayer(const LayerType*);
+
+    // Returns true if the given rect in content space for the layer is fully occluded in either screen space or the layer's target surface.
+    bool occluded(const LayerType*, const IntRect& contentRect) const;
+    // Gives an unoccluded sub-rect of |contentRect| in the content space of the layer. Used when considering occlusion for a layer that paints/draws something.
+    IntRect unoccludedContentRect(const LayerType*, const IntRect& contentRect) const;
+
+    // Returns true if the given rect in content space for the RenderSurface owned by the layer is fully occluded in either screen space or the layer's target surface.
+    bool surfaceOccluded(const LayerType*, const IntRect& contentRect) const;
+    // Gives an unoccluded sub-rect of |contentRect| in the content space of the RenderSurface owned by the layer. Used when considering occlusion for a target surface.
+    IntRect surfaceUnoccludedContentRect(const LayerType*, const IntRect& contentRect) const;
+
+    // FIXME: Remove these in future, they are to make CLs for transitioning to this easier.
+    const Region& currentOcclusionInScreenSpace() const;
+    const Region& currentOcclusionInTargetSurface() const;
+
+protected:
+    struct StackObject {
+        const RenderSurfaceType* surface;
+        Region occlusionInScreen;
+        Region occlusionInTarget;
+    };
+
+    // The stack holds occluded regions for subtrees in the RenderSurface-Layer tree, so that when we leave a subtree we may
+    // apply a mask to it, but not to the parts outside the subtree.
+    // - The first time we see a new subtree under a target, we add that target to the top of the stack. This can happen as a layer representing itself, or as a target surface.
+    // - When we visit a target surface, we apply its mask to its subtree, which is at the top of the stack.
+    // - When we visit a layer representing itself, we add its occlusion to the current subtree, which is at the top of the stack.
+    // - When we visit a layer representing a contributing surface, the current target will never be the top of the stack since we just came from the contributing surface.
+    // We merge the occlusion at the top of the stack with the new current subtree. This new target is pushed onto the stack if not already there.
+    Vector<StackObject, 1> m_stack;
+
+private:
+    WTF_MAKE_NONCOPYABLE(CCOcclusionTrackerBase);
+};
+
+typedef CCOcclusionTrackerBase<LayerChromium, RenderSurfaceChromium> CCOcclusionTracker;
+typedef CCOcclusionTrackerBase<CCLayerImpl, CCRenderSurface> CCOcclusionTrackerImpl;
+
+}
+#endif // CCOcclusionTracker_h
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCProxy.h b/Source/WebCore/platform/graphics/chromium/cc/CCProxy.h
index 44aacceb0..b4358aadd 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCProxy.h
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCProxy.h
@@ -57,6 +57,8 @@ public:
 
     virtual bool compositeAndReadback(void *pixels, const IntRect&) = 0;
 
+    virtual void startPageScaleAnimation(const IntSize& targetPosition, bool useAnchor, float scale, double durationSec) = 0;
+
     virtual void finishAllRendering() = 0;
 
     virtual bool isStarted() const = 0;
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCQuadCuller.cpp b/Source/WebCore/platform/graphics/chromium/cc/CCQuadCuller.cpp
index c8bd9b0f3..4f6435dc0 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCQuadCuller.cpp
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCQuadCuller.cpp
@@ -75,7 +75,7 @@ static IntRect rectSubtractRegion(const Region& region, const IntRect& rect)
     return rect;
 }
 
-void CCQuadCuller::cullOccludedQuads(CCQuadList& quadList)
+void CCQuadCuller::cullOccludedQuads(CCQuadList& quadList, bool haveDamageRect, const FloatRect& damageRect)
 {
     if (!quadList.size())
         return;
@@ -89,25 +89,28 @@ void CCQuadCuller::cullOccludedQuads(CCQuadList& quadList)
         CCDrawQuad* drawQuad = quadList[i].get();
 
         FloatRect floatTransformedRect = drawQuad->quadTransform().mapRect(FloatRect(drawQuad->quadRect()));
+        if (haveDamageRect)
+            floatTransformedRect.intersect(damageRect);
         // Inflate rect to be tested to stay conservative.
         IntRect transformedQuadRect(enclosingIntRect(floatTransformedRect));
 
         IntRect transformedVisibleQuadRect = rectSubtractRegion(opaqueCoverageThusFar, transformedQuadRect);
         bool keepQuad = !transformedVisibleQuadRect.isEmpty();
+        if (!keepQuad)
+            continue;
 
         // See if we can reduce the number of pixels to draw by reducing the size of the draw
         // quad - we do this by changing its visible rect.
-        if (keepQuad && transformedVisibleQuadRect != transformedQuadRect && drawQuad->isLayerAxisAlignedIntRect())
+        if (transformedVisibleQuadRect != transformedQuadRect && drawQuad->isLayerAxisAlignedIntRect())
             drawQuad->setQuadVisibleRect(drawQuad->quadTransform().inverse().mapRect(transformedVisibleQuadRect));
 
         // When adding rect to opaque region, deflate it to stay conservative.
-        if (keepQuad && drawQuad->isLayerAxisAlignedIntRect()) {
+        if (drawQuad->isLayerAxisAlignedIntRect() && !drawQuad->opaqueRect().isEmpty()) {
             FloatRect floatOpaqueRect = drawQuad->quadTransform().mapRect(FloatRect(drawQuad->opaqueRect()));
             opaqueCoverageThusFar.unite(Region(enclosedIntRect(floatOpaqueRect)));
         }
 
-        if (keepQuad)
-            culledList.append(quadList[i].release());
+        culledList.append(quadList[i].release());
     }
     quadList.clear(); // Release anything that remains.
 
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCQuadCuller.h b/Source/WebCore/platform/graphics/chromium/cc/CCQuadCuller.h
index 7179285ac..3cc315ec4 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCQuadCuller.h
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCQuadCuller.h
@@ -32,7 +32,7 @@ namespace WebCore {
 
 class CCQuadCuller {
 public:
-    static void cullOccludedQuads(CCQuadList&);
+    static void cullOccludedQuads(CCQuadList&, bool haveDamageRect, const FloatRect& damageRect);
 
 private:
     // Make non-instantiable.
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCRenderPass.cpp b/Source/WebCore/platform/graphics/chromium/cc/CCRenderPass.cpp
index 6f51fbcde..da4b2222c 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCRenderPass.cpp
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCRenderPass.cpp
@@ -27,6 +27,7 @@
 
 #include "cc/CCRenderPass.h"
 
+#include "cc/CCDamageTracker.h"
 #include "cc/CCLayerImpl.h"
 #include "cc/CCQuadCuller.h"
 #include "cc/CCRenderSurfaceDrawQuad.h"
@@ -64,9 +65,9 @@ void CCRenderPass::appendQuadsForRenderSurfaceLayer(CCLayerImpl* layer)
     m_sharedQuadStateList.append(sharedQuadState.release());
 }
 
-void CCRenderPass::optimizeQuads()
+void CCRenderPass::optimizeQuads(bool haveDamageRect, const FloatRect& damageRect)
 {
-    CCQuadCuller::cullOccludedQuads(m_quadList);
+    CCQuadCuller::cullOccludedQuads(m_quadList, haveDamageRect, damageRect);
 }
 
 }
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCRenderPass.h b/Source/WebCore/platform/graphics/chromium/cc/CCRenderPass.h
index 9fb77166c..11fbd4016 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCRenderPass.h
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCRenderPass.h
@@ -46,7 +46,7 @@ public:
     void appendQuadsForLayer(CCLayerImpl*);
     void appendQuadsForRenderSurfaceLayer(CCLayerImpl*);
 
-    void optimizeQuads();
+    void optimizeQuads(bool haveDamageRect, const FloatRect& damageRect);
 
     const CCQuadList& quadList() const { return m_quadList; }
     CCRenderSurface* targetSurface() const { return m_targetSurface; }
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCRenderSurface.cpp b/Source/WebCore/platform/graphics/chromium/cc/CCRenderSurface.cpp
index a4c92569d..169999808 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCRenderSurface.cpp
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCRenderSurface.cpp
@@ -29,13 +29,18 @@
 
 #include "cc/CCRenderSurface.h"
 
+#include "GeometryBinding.h"
+#include "GrTexture.h"
 #include "GraphicsContext3D.h"
 #include "LayerChromium.h"
 #include "LayerRendererChromium.h"
 #include "ManagedTexture.h"
+#include "SharedGraphicsContext3D.h"
 #include "TextStream.h"
 #include "cc/CCDamageTracker.h"
 #include "cc/CCLayerImpl.h"
+#include "cc/CCProxy.h"
+#include "cc/CCRenderSurfaceFilters.h"
 #include <wtf/text/CString.h>
 
 namespace WebCore {
@@ -46,6 +51,7 @@ CCRenderSurface::CCRenderSurface(CCLayerImpl* owningLayer)
     , m_skipsDraw(false)
     , m_surfacePropertyChanged(false)
     , m_drawOpacity(1)
+    , m_nearestAncestorThatMovesPixels(0)
 {
     m_damageTracker = CCDamageTracker::create();
 }
@@ -105,6 +111,8 @@ void CCRenderSurface::draw(LayerRendererChromium* layerRenderer, const FloatRect
 {
     if (m_skipsDraw || !m_contentsTexture)
         return;
+
+    SkBitmap filterBitmap = applyFilters(layerRenderer);
     // FIXME: By using the same RenderSurface for both the content and its reflection,
     // it's currently not possible to apply a separate mask to the reflection layer
     // or correctly handle opacity in reflections (opacity must be applied after drawing
@@ -128,12 +136,12 @@ void CCRenderSurface::draw(LayerRendererChromium* layerRenderer, const FloatRect
 
     // Reflection draws before the layer.
     if (m_owningLayer->replicaLayer())
-        drawLayer(layerRenderer, replicaMaskLayer, m_replicaDrawTransform);
+        drawLayer(layerRenderer, replicaMaskLayer, m_replicaDrawTransform, filterBitmap);
 
-    drawLayer(layerRenderer, m_maskLayer, m_drawTransform);
+    drawLayer(layerRenderer, m_maskLayer, m_drawTransform, filterBitmap);
 }
 
-void CCRenderSurface::drawLayer(LayerRendererChromium* layerRenderer, CCLayerImpl* maskLayer, const TransformationMatrix& drawTransform)
+void CCRenderSurface::drawLayer(LayerRendererChromium* layerRenderer, CCLayerImpl* maskLayer, const TransformationMatrix& drawTransform, const SkBitmap& filterBitmap)
 {
     TransformationMatrix renderMatrix = drawTransform;
     // Apply a scaling factor to size the quad from 1x1 to its intended size.
@@ -165,24 +173,24 @@ void CCRenderSurface::drawLayer(LayerRendererChromium* layerRenderer, CCLayerImp
     if (useMask) {
         if (useAA) {
             const MaskProgramAA* program = layerRenderer->renderSurfaceMaskProgramAA();
-            drawSurface(layerRenderer, maskLayer, drawTransform, deviceMatrix, deviceRect, layerQuad, program, program->fragmentShader().maskSamplerLocation(), program->vertexShader().pointLocation(), program->fragmentShader().edgeLocation());
+            drawSurface(layerRenderer, maskLayer, drawTransform, deviceMatrix, deviceRect, layerQuad, program, program->fragmentShader().maskSamplerLocation(), program->vertexShader().pointLocation(), program->fragmentShader().edgeLocation(), filterBitmap);
         } else {
             const MaskProgram* program = layerRenderer->renderSurfaceMaskProgram();
-            drawSurface(layerRenderer, maskLayer, drawTransform, deviceMatrix, deviceRect, layerQuad, program, program->fragmentShader().maskSamplerLocation(), -1, -1);
+            drawSurface(layerRenderer, maskLayer, drawTransform, deviceMatrix, deviceRect, layerQuad, program, program->fragmentShader().maskSamplerLocation(), -1, -1, filterBitmap);
         }
     } else {
         if (useAA) {
             const ProgramAA* program = layerRenderer->renderSurfaceProgramAA();
-            drawSurface(layerRenderer, maskLayer, drawTransform, deviceMatrix, deviceRect, layerQuad, program, -1, program->vertexShader().pointLocation(), program->fragmentShader().edgeLocation());
+            drawSurface(layerRenderer, maskLayer, drawTransform, deviceMatrix, deviceRect, layerQuad, program, -1, program->vertexShader().pointLocation(), program->fragmentShader().edgeLocation(), filterBitmap);
         } else {
             const Program* program = layerRenderer->renderSurfaceProgram();
-            drawSurface(layerRenderer, maskLayer, drawTransform, deviceMatrix, deviceRect, layerQuad, program, -1, -1, -1);
+            drawSurface(layerRenderer, maskLayer, drawTransform, deviceMatrix, deviceRect, layerQuad, program, -1, -1, -1, filterBitmap);
         }
     }
 }
 
 template <class T>
-void CCRenderSurface::drawSurface(LayerRendererChromium* layerRenderer, CCLayerImpl* maskLayer, const TransformationMatrix& drawTransform, const TransformationMatrix& deviceTransform, const CCLayerQuad& deviceRect, const CCLayerQuad& layerQuad, const T* program, int shaderMaskSamplerLocation, int shaderQuadLocation, int shaderEdgeLocation)
+void CCRenderSurface::drawSurface(LayerRendererChromium* layerRenderer, CCLayerImpl* maskLayer, const TransformationMatrix& drawTransform, const TransformationMatrix& deviceTransform, const CCLayerQuad& deviceRect, const CCLayerQuad& layerQuad, const T* program, int shaderMaskSamplerLocation, int shaderQuadLocation, int shaderEdgeLocation, const SkBitmap& filterBitmap)
 {
     GraphicsContext3D* context3D = layerRenderer->context();
 
@@ -191,7 +199,11 @@ void CCRenderSurface::drawSurface(LayerRendererChromium* layerRenderer, CCLayerI
 
     GLC(context3D, context3D->activeTexture(GraphicsContext3D::TEXTURE0));
     GLC(context3D, context3D->uniform1i(program->fragmentShader().samplerLocation(), 0));
-    m_contentsTexture->bindTexture(context3D, layerRenderer->renderSurfaceTextureAllocator());
+    if (filterBitmap.getTexture()) {
+        GrTexture* texture = reinterpret_cast<GrTexture*>(filterBitmap.getTexture());
+        context3D->bindTexture(GraphicsContext3D::TEXTURE_2D, texture->getTextureHandle());
+    } else
+        m_contentsTexture->bindTexture(context3D, layerRenderer->renderSurfaceTextureAllocator());
 
     if (shaderMaskSamplerLocation != -1) {
         GLC(context3D, context3D->activeTexture(GraphicsContext3D::TEXTURE1));
@@ -214,6 +226,17 @@ void CCRenderSurface::drawSurface(LayerRendererChromium* layerRenderer, CCLayerI
                                     program->vertexShader().matrixLocation(), program->fragmentShader().alphaLocation(), shaderQuadLocation);
 }
 
+SkBitmap CCRenderSurface::applyFilters(LayerRendererChromium* layerRenderer)
+{
+    // Don't use the utility context if we have a compositor thread, since
+    // it can race with canvas's use.
+    if (!m_contentsTexture || !m_filters.size() || CCProxy::hasImplThread())
+        return SkBitmap();
+
+    layerRenderer->context()->flush();
+    return CCRenderSurfaceFilters::apply(m_filters, m_contentsTexture->textureId(), m_contentRect.size(), SharedGraphicsContext3D::get());
+}
+
 String CCRenderSurface::name() const
 {
     return String::format("RenderSurface(id=%i,owner=%s)", m_owningLayer->id(), m_owningLayer->name().utf8().data());
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCRenderSurface.h b/Source/WebCore/platform/graphics/chromium/cc/CCRenderSurface.h
index ab8386d5d..1bcec9260 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCRenderSurface.h
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCRenderSurface.h
@@ -29,10 +29,12 @@
 
 #if USE(ACCELERATED_COMPOSITING)
 
+#include "FilterOperations.h"
 #include "FloatRect.h"
 #include "IntRect.h"
 #include "ProgramBinding.h"
 #include "ShaderChromium.h"
+#include "SkBitmap.h"
 #include "TextureManager.h"
 #include "TransformationMatrix.h"
 #include "cc/CCLayerQuad.h"
@@ -70,6 +72,13 @@ public:
     void setDrawTransform(const TransformationMatrix& drawTransform) { m_drawTransform = drawTransform; }
     const TransformationMatrix& drawTransform() const { return m_drawTransform; }
 
+    void setFilters(const FilterOperations& filters) { m_filters = filters; }
+    const FilterOperations& filters() const { return m_filters; }
+    SkBitmap applyFilters(LayerRendererChromium*);
+
+    void setNearestAncestorThatMovesPixels(CCRenderSurface* surface) { m_nearestAncestorThatMovesPixels = surface; }
+    const CCRenderSurface* nearestAncestorThatMovesPixels() const { return m_nearestAncestorThatMovesPixels; }
+
     void setReplicaDrawTransform(const TransformationMatrix& replicaDrawTransform) { m_replicaDrawTransform = replicaDrawTransform; }
     const TransformationMatrix& replicaDrawTransform() const { return m_replicaDrawTransform; }
 
@@ -106,9 +115,9 @@ public:
     CCDamageTracker* damageTracker() const { return m_damageTracker.get(); }
 
 private:
-    void drawLayer(LayerRendererChromium*, CCLayerImpl*, const TransformationMatrix&);
+    void drawLayer(LayerRendererChromium*, CCLayerImpl*, const TransformationMatrix&, const SkBitmap& filterBitmap);
     template <class T>
-    void drawSurface(LayerRendererChromium*, CCLayerImpl*, const TransformationMatrix& drawTransform, const TransformationMatrix& deviceTransform, const CCLayerQuad& deviceRect, const CCLayerQuad&, const T* program, int shaderMaskSamplerLocation, int shaderQuadLocation, int shaderEdgeLocation);
+    void drawSurface(LayerRendererChromium*, CCLayerImpl*, const TransformationMatrix& drawTransform, const TransformationMatrix& deviceTransform, const CCLayerQuad& deviceRect, const CCLayerQuad&, const T* program, int shaderMaskSamplerLocation, int shaderQuadLocation, int shaderEdgeLocation, const SkBitmap& filterBitmap);
 
     CCLayerImpl* m_owningLayer;
     CCLayerImpl* m_maskLayer;
@@ -122,9 +131,14 @@ private:
     TransformationMatrix m_drawTransform;
     TransformationMatrix m_replicaDrawTransform;
     TransformationMatrix m_originTransform;
+    FilterOperations m_filters;
     IntRect m_clipRect;
     Vector<RefPtr<CCLayerImpl> > m_layerList;
 
+    // The nearest ancestor target surface that will contain the contents of this surface, and that is going
+    // to move pixels within the surface (such as with a blur). This can point to itself.
+    CCRenderSurface* m_nearestAncestorThatMovesPixels;
+
     OwnPtr<CCDamageTracker> m_damageTracker;
 
     // Stored in the "surface space" where this damage can be used for scissoring.
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCRenderSurfaceFilters.cpp b/Source/WebCore/platform/graphics/chromium/cc/CCRenderSurfaceFilters.cpp
new file mode 100644
index 000000000..b175d112d
--- /dev/null
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCRenderSurfaceFilters.cpp
@@ -0,0 +1,315 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#if USE(ACCELERATED_COMPOSITING)
+
+#include "cc/CCRenderSurfaceFilters.h"
+
+#include "GraphicsContext3D.h"
+#include "SkBlurImageFilter.h"
+#include "SkCanvas.h"
+#include "SkColorMatrixFilter.h"
+#include "SkGpuDevice.h"
+#include "SkGrTexturePixelRef.h"
+
+namespace {
+
+void getBrightnessMatrix(float amount, SkScalar matrix[20])
+{
+    memset(matrix, 0, 20 * sizeof(SkScalar));
+    //    Old implementation, a la the draft spec, a straight-up scale,
+    //    representing <feFunc[R|G|B] type="linear" slope="[amount]">
+    //    (See http://dvcs.w3.org/hg/FXTF/raw-file/tip/filters/index.html#brightnessEquivalent)
+    // matrix[0] = matrix[6] = matrix[12] = amount;
+    // matrix[18] = 1;
+    //    New implementation, a translation in color space, representing
+    //    <feFunc[R|G|B] type="linear" intercept="[amount]"/>
+    //    (See https://www.w3.org/Bugs/Public/show_bug.cgi?id=15647)
+    matrix[0] = matrix[6] = matrix[12] = matrix[18] = 1;
+    matrix[4] = matrix[9] = matrix[14] = amount * 255;
+}
+
+void getContrastMatrix(float amount, SkScalar matrix[20])
+{
+    memset(matrix, 0, 20 * sizeof(SkScalar));
+    matrix[0] = matrix[6] = matrix[12] = amount;
+    matrix[4] = matrix[9] = matrix[14] = (-0.5f * amount + 0.5f) * 255;
+    matrix[18] = 1;
+}
+
+void getSaturateMatrix(float amount, SkScalar matrix[20])
+{
+    matrix[0] = 0.213f + 0.787f * amount;
+    matrix[1] = 0.715f - 0.715f * amount;
+    matrix[2] = 0.072f - 0.072f * amount;
+    matrix[3] = matrix[4] = 0;
+    matrix[5] = 0.213f - 0.213f * amount;
+    matrix[6] = 0.715f + 0.285f * amount;
+    matrix[7] = 0.072f - 0.072f * amount;
+    matrix[8] = matrix[9] = 0;
+    matrix[10] = 0.213f - 0.213f * amount;
+    matrix[11] = 0.715f - 0.715f * amount;
+    matrix[12] = 0.072f + 0.928f * amount;
+    matrix[13] = matrix[14] = 0;
+    matrix[15] = matrix[16] = matrix[17] = matrix[19] = 0;
+    matrix[18] = 1;
+}
+
+void getHueRotateMatrix(float hue, SkScalar matrix[20])
+{
+    float cosHue = cosf(hue * piFloat / 180); 
+    float sinHue = sinf(hue * piFloat / 180); 
+    matrix[0] = 0.213f + cosHue * 0.787f - sinHue * 0.213f;
+    matrix[1] = 0.715f - cosHue * 0.715f - sinHue * 0.715f;
+    matrix[2] = 0.072f - cosHue * 0.072f + sinHue * 0.928f;
+    matrix[3] = matrix[4] = 0;
+    matrix[5] = 0.213f - cosHue * 0.213f + sinHue * 0.143f;
+    matrix[6] = 0.715f + cosHue * 0.285f + sinHue * 0.140f;
+    matrix[7] = 0.072f - cosHue * 0.072f - sinHue * 0.283f;
+    matrix[8] = matrix[9] = 0;
+    matrix[10] = 0.213f - cosHue * 0.213f - sinHue * 0.787f;
+    matrix[11] = 0.715f - cosHue * 0.715f + sinHue * 0.715f;
+    matrix[12] = 0.072f + cosHue * 0.928f + sinHue * 0.072f;
+    matrix[13] = matrix[14] = 0;
+    matrix[15] = matrix[16] = matrix[17] = 0;
+    matrix[18] = 1;
+    matrix[19] = 0;
+}
+
+void getInvertMatrix(float amount, SkScalar matrix[20])
+{
+    memset(matrix, 0, 20 * sizeof(SkScalar));
+    matrix[0] = matrix[6] = matrix[12] = 1 - 2 * amount;
+    matrix[4] = matrix[9] = matrix[14] = amount * 255;
+    matrix[18] = 1;
+}
+
+void getOpacityMatrix(float amount, SkScalar matrix[20])
+{
+    memset(matrix, 0, 20 * sizeof(SkScalar));
+    matrix[0] = matrix[6] = matrix[12] = 1;
+    matrix[18] = amount;
+}
+
+void getGrayscaleMatrix(float amount, SkScalar matrix[20])
+{
+    matrix[0] = 0.2126f + 0.7874f * amount;
+    matrix[1] = 0.7152f - 0.7152f * amount;
+    matrix[2] = 0.0722f - 0.0722f * amount;
+    matrix[3] = matrix[4] = 0;
+
+    matrix[5] = 0.2126f - 0.2126f * amount;
+    matrix[6] = 0.7152f + 0.2848f * amount;
+    matrix[7] = 0.0722f - 0.0722f * amount;
+    matrix[8] = matrix[9] = 0;
+
+    matrix[10] = 0.2126f - 0.2126f * amount;
+    matrix[11] = 0.7152f - 0.7152f * amount;
+    matrix[12] = 0.0722f + 0.9278f * amount;
+    matrix[13] = matrix[14] = 0;
+
+    matrix[15] = matrix[16] = matrix[17] = matrix[19] = 0;
+    matrix[18] = 1;
+}
+
+void getSepiaMatrix(float amount, SkScalar matrix[20])
+{
+    matrix[0] = 0.393f + 0.607f * amount;
+    matrix[1] = 0.769f - 0.769f * amount;
+    matrix[2] = 0.189f - 0.189f * amount;
+    matrix[3] = matrix[4] = 0;
+
+    matrix[5] = 0.349f - 0.349f * amount;
+    matrix[6] = 0.686f + 0.314f * amount;
+    matrix[7] = 0.168f - 0.168f * amount;
+    matrix[8] = matrix[9] = 0;
+
+    matrix[10] = 0.272f - 0.272f * amount;
+    matrix[11] = 0.534f - 0.534f * amount;
+    matrix[12] = 0.131f + 0.869f * amount;
+    matrix[13] = matrix[14] = 0;
+
+    matrix[15] = matrix[16] = matrix[17] = matrix[19] = 0;
+    matrix[18] = 1;
+}
+
+bool applyColorMatrix(SkCanvas* canvas, SkBitmap source, SkScalar matrix[20])
+{
+    SkPaint paint;
+    paint.setColorFilter(new SkColorMatrixFilter(matrix))->unref();
+    canvas->drawBitmap(source, 0, 0, &paint);
+    return true;
+}
+
+}
+
+namespace WebCore {
+
+SkBitmap CCRenderSurfaceFilters::apply(const FilterOperations& filters, unsigned textureId, const FloatSize& size, GraphicsContext3D* context3D)
+{
+    SkBitmap source;
+    if (!context3D)
+        return source;
+
+    GrContext* gr = context3D->grContext();
+    if (!gr)
+        return source;
+    // Wrap the RenderSurface's texture in a Ganesh platform texture.
+    GrPlatformTextureDesc platformTexDesc;
+    platformTexDesc.fWidth = size.width();
+    platformTexDesc.fHeight = size.height();
+    platformTexDesc.fConfig = kSkia8888_PM_GrPixelConfig;
+    platformTexDesc.fTextureHandle = textureId;
+    SkAutoTUnref<GrTexture> texture(gr->createPlatformTexture(platformTexDesc));
+    // Place the platform texture inside an SkBitmap.
+    source.setConfig(SkBitmap::kARGB_8888_Config, size.width(), size.height());
+    source.setPixelRef(new SkGrTexturePixelRef(texture.get()))->unref();
+    
+    GrContext::TextureCacheEntry dest;
+
+    for (unsigned i = 0; i < filters.size(); ++i) {
+        // Save the previous texture cache destination (if any), and keep it
+        // locked during draw to prevent it be re-used as destination.
+        GrContext::TextureCacheEntry sourceEntry = dest;
+        const FilterOperation* filterOperation = filters.at(i);
+        // Allocate a destination texture.
+        GrTextureDesc desc;
+        desc.fFlags = kRenderTarget_GrTextureFlagBit | kNoStencil_GrTextureFlagBit;
+        desc.fSampleCnt = 0;
+        desc.fWidth = size.width();
+        desc.fHeight = size.height();
+        desc.fConfig = kRGBA_8888_GrPixelConfig;
+        // FIXME: could we use approximate match, and fix texcoords on draw
+        dest = gr->lockScratchTexture(desc, GrContext::kExact_ScratchTexMatch);
+        if (!dest.texture())
+            return SkBitmap();
+        SkGpuDevice device(gr, dest.texture());
+        SkCanvas canvas(&device);
+        canvas.clear(0x0);
+        switch (filterOperation->getOperationType()) {
+        case FilterOperation::BRIGHTNESS: {
+            const BasicColorMatrixFilterOperation* op = static_cast<const BasicColorMatrixFilterOperation*>(filterOperation);
+            SkScalar matrix[20];
+            getBrightnessMatrix(op->amount(), matrix);
+            applyColorMatrix(&canvas, source, matrix);
+            break;
+        }
+        case FilterOperation::CONTRAST: {
+            const BasicColorMatrixFilterOperation* op = static_cast<const BasicColorMatrixFilterOperation*>(filterOperation);
+            SkScalar matrix[20];
+            getContrastMatrix(op->amount(), matrix);
+            applyColorMatrix(&canvas, source, matrix);
+            break;
+        }
+        case FilterOperation::GRAYSCALE: {
+            const BasicColorMatrixFilterOperation* op = static_cast<const BasicColorMatrixFilterOperation*>(filterOperation);
+            SkScalar matrix[20];
+            getGrayscaleMatrix(1 - op->amount(), matrix);
+            applyColorMatrix(&canvas, source, matrix);
+            break;
+        }
+        case FilterOperation::SEPIA: {
+            const BasicColorMatrixFilterOperation* op = static_cast<const BasicColorMatrixFilterOperation*>(filterOperation);
+            SkScalar matrix[20];
+            getSepiaMatrix(1 - op->amount(), matrix);
+            applyColorMatrix(&canvas, source, matrix);
+            break;
+        }
+        case FilterOperation::SATURATE: {
+            const BasicColorMatrixFilterOperation* op = static_cast<const BasicColorMatrixFilterOperation*>(filterOperation);
+            SkScalar matrix[20];
+            getSaturateMatrix(op->amount(), matrix);
+            applyColorMatrix(&canvas, source, matrix);
+            break;
+        }
+        case FilterOperation::HUE_ROTATE: {
+            const BasicColorMatrixFilterOperation* op = static_cast<const BasicColorMatrixFilterOperation*>(filterOperation);
+            SkScalar matrix[20];
+            getHueRotateMatrix(op->amount(), matrix);
+            applyColorMatrix(&canvas, source, matrix);
+            break;
+        }
+        case FilterOperation::INVERT: {
+            const BasicColorMatrixFilterOperation* op = static_cast<const BasicColorMatrixFilterOperation*>(filterOperation);
+            SkScalar matrix[20];
+            getInvertMatrix(op->amount(), matrix);
+            applyColorMatrix(&canvas, source, matrix);
+            break;
+        }
+        case FilterOperation::OPACITY: {
+            const BasicComponentTransferFilterOperation* op = static_cast<const BasicComponentTransferFilterOperation*>(filterOperation);
+            SkScalar matrix[20];
+            getOpacityMatrix(op->amount(), matrix);
+            applyColorMatrix(&canvas, source, matrix);
+            break;
+        }
+        case FilterOperation::BLUR: {
+            const BlurFilterOperation* op = static_cast<const BlurFilterOperation*>(filterOperation);
+            float stdX = op->stdDeviation().calcFloatValue(0);
+            float stdY = op->stdDeviation().calcFloatValue(1);
+            SkAutoTUnref<SkImageFilter> filter(new SkBlurImageFilter(stdX, stdY));
+            SkPaint paint;
+            paint.setImageFilter(filter.get());
+            paint.setColor(0xFFFFFFFF);
+            canvas.saveLayer(0, &paint);
+            canvas.drawBitmap(source, 0, 0);
+            canvas.restore();
+            break;
+        }
+        case FilterOperation::DROP_SHADOW: {
+            const DropShadowFilterOperation* op = static_cast<const DropShadowFilterOperation*>(filterOperation);
+            SkAutoTUnref<SkImageFilter> blurFilter(new SkBlurImageFilter(op->stdDeviation(), op->stdDeviation()));
+            SkAutoTUnref<SkColorFilter> colorFilter(SkColorFilter::CreateModeFilter(op->color().rgb(), SkXfermode::kSrcIn_Mode));
+            SkPaint paint;
+            paint.setImageFilter(blurFilter.get());
+            paint.setColorFilter(colorFilter.get());
+            paint.setXfermodeMode(SkXfermode::kSrcOver_Mode);
+            canvas.saveLayer(0, &paint);
+            canvas.drawBitmap(source, op->x(), -op->y());
+            canvas.restore();
+            canvas.drawBitmap(source, 0, 0);
+            break;
+        }
+        case FilterOperation::PASSTHROUGH:
+        default:
+            canvas.drawBitmap(source, 0, 0);
+            break;
+        }
+        // Dest texture from this filter becomes source bitmap for next filter.
+        source.setPixelRef(new SkGrTexturePixelRef(dest.texture()))->unref();
+        // Unlock the previous texture cache entry.
+        if (sourceEntry.texture())
+            gr->unlockTexture(sourceEntry);
+    }
+    if (dest.texture())
+        gr->unlockTexture(dest);
+    context3D->flush();
+    return source;
+}
+
+}
+#endif // USE(ACCELERATED_COMPOSITING)
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCRenderSurfaceFilters.h b/Source/WebCore/platform/graphics/chromium/cc/CCRenderSurfaceFilters.h
new file mode 100644
index 000000000..68c88d97c
--- /dev/null
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCRenderSurfaceFilters.h
@@ -0,0 +1,49 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+
+#ifndef CCRenderSurfaceFilters_h
+#define CCRenderSurfaceFilters_h
+
+#if USE(ACCELERATED_COMPOSITING)
+
+class SkBitmap;
+
+namespace WebCore {
+class FilterOperations;
+class FloatSize;
+class GraphicsContext3D;
+
+class CCRenderSurfaceFilters {
+public:
+    static SkBitmap apply(const FilterOperations& filters, unsigned textureId, const FloatSize&, GraphicsContext3D*);
+private:
+    CCRenderSurfaceFilters();
+};
+
+}
+#endif // USE(ACCELERATED_COMPOSITING)
+
+#endif
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCSingleThreadProxy.cpp b/Source/WebCore/platform/graphics/chromium/cc/CCSingleThreadProxy.cpp
index 2e48e10f5..ea8c40f12 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCSingleThreadProxy.cpp
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCSingleThreadProxy.cpp
@@ -93,6 +93,11 @@ bool CCSingleThreadProxy::compositeAndReadback(void *pixels, const IntRect& rect
     return true;
 }
 
+void CCSingleThreadProxy::startPageScaleAnimation(const IntSize& targetPosition, bool useAnchor, float scale, double durationSec)
+{
+    m_layerTreeHostImpl->startPageScaleAnimation(targetPosition, useAnchor, scale, monotonicallyIncreasingTime() * 1000.0, durationSec * 1000.0);
+}
+
 GraphicsContext3D* CCSingleThreadProxy::context()
 {
     ASSERT(CCProxy::isMainThread());
@@ -201,6 +206,7 @@ void CCSingleThreadProxy::setNeedsRedraw()
 {
     // FIXME: Once we move render_widget scheduling into this class, we can
     // treat redraw requests more efficiently than commitAndRedraw requests.
+    m_layerTreeHostImpl->setFullRootLayerDamage();
     setNeedsCommit();
 }
 
@@ -227,6 +233,13 @@ void CCSingleThreadProxy::stop()
     m_layerTreeHost = 0;
 }
 
+void CCSingleThreadProxy::postAnimationEventsToMainThreadOnImplThread(PassOwnPtr<CCAnimationEventsVector> events)
+{
+    ASSERT(CCProxy::isImplThread());
+    DebugScopedSetMainThread main;
+    m_layerTreeHost->setAnimationEvents(events);
+}
+
 // Called by the legacy scheduling path (e.g. where render_widget does the scheduling)
 void CCSingleThreadProxy::compositeImmediately()
 {
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCSingleThreadProxy.h b/Source/WebCore/platform/graphics/chromium/cc/CCSingleThreadProxy.h
index a94405f3d..71b5e99b2 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCSingleThreadProxy.h
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCSingleThreadProxy.h
@@ -25,6 +25,7 @@
 #ifndef CCSingleThreadProxy_h
 #define CCSingleThreadProxy_h
 
+#include "cc/CCAnimationEvents.h"
 #include "cc/CCCompletionEvent.h"
 #include "cc/CCLayerTreeHostImpl.h"
 #include "cc/CCProxy.h"
@@ -42,6 +43,7 @@ public:
 
     // CCProxy implementation
     virtual bool compositeAndReadback(void *pixels, const IntRect&);
+    virtual void startPageScaleAnimation(const IntSize& targetPosition, bool useAnchor, float scale, double durationSec);
     virtual GraphicsContext3D* context();
     virtual void finishAllRendering();
     virtual bool isStarted() const;
@@ -62,6 +64,7 @@ public:
     virtual void onSwapBuffersCompleteOnImplThread() { ASSERT_NOT_REACHED(); }
     virtual void setNeedsRedrawOnImplThread() { m_layerTreeHost->setNeedsCommit(); }
     virtual void setNeedsCommitOnImplThread() { m_layerTreeHost->setNeedsCommit(); }
+    virtual void postAnimationEventsToMainThreadOnImplThread(PassOwnPtr<CCAnimationEventsVector>);
 
     // Called by the legacy path where RenderWidget does the scheduling.
     void compositeImmediately();
@@ -110,6 +113,24 @@ public:
     }
 };
 
+// For use in the single-threaded case. In debug builds, it pretends that the
+// code is running on the main thread to satisfy assertion checks.
+class DebugScopedSetMainThread {
+public:
+    DebugScopedSetMainThread()
+    {
+#if !ASSERT_DISABLED
+        CCProxy::setCurrentThreadIsImplThread(false);
+#endif
+    }
+    ~DebugScopedSetMainThread()
+    {
+#if !ASSERT_DISABLED
+        CCProxy::setCurrentThreadIsImplThread(true);
+#endif
+    }
+};
+
 } // namespace WebCore
 
 #endif
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCThreadProxy.cpp b/Source/WebCore/platform/graphics/chromium/cc/CCThreadProxy.cpp
index 8ca852dda..75ef13623 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCThreadProxy.cpp
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCThreadProxy.cpp
@@ -133,6 +133,19 @@ void CCThreadProxy::requestReadbackOnImplThread(ReadbackRequest* request)
     m_schedulerOnImplThread->setNeedsForcedRedraw();
 }
 
+void CCThreadProxy::startPageScaleAnimation(const IntSize& targetPosition, bool useAnchor, float scale, double durationSec)
+{
+    ASSERT(CCProxy::isMainThread());
+    CCProxy::implThread()->postTask(createCCThreadTask(this, &CCThreadProxy::requestStartPageScaleAnimationOnImplThread, targetPosition, useAnchor, scale, durationSec));
+}
+
+void CCThreadProxy::requestStartPageScaleAnimationOnImplThread(IntSize targetPosition, bool useAnchor, float scale, double durationSec)
+{
+    ASSERT(CCProxy::isImplThread());
+    if (m_layerTreeHostImpl)
+        m_layerTreeHostImpl->startPageScaleAnimation(targetPosition, useAnchor, scale, monotonicallyIncreasingTime() * 1000.0, durationSec * 1000.0);
+}
+
 GraphicsContext3D* CCThreadProxy::context()
 {
     return 0;
@@ -246,10 +259,18 @@ void CCThreadProxy::setNeedsCommitOnImplThread()
     m_schedulerOnImplThread->setNeedsCommit();
 }
 
+void CCThreadProxy::postAnimationEventsToMainThreadOnImplThread(PassOwnPtr<CCAnimationEventsVector> events)
+{
+    ASSERT(isImplThread());
+    TRACE_EVENT("CCThreadProxy::postAnimationEventsToMainThreadOnImplThread", this, 0);
+    m_mainThreadProxy->postTask(createCCThreadTask(this, &CCThreadProxy::setAnimationEvents, events));
+}
+
 void CCThreadProxy::setNeedsRedraw()
 {
     ASSERT(isMainThread());
     TRACE_EVENT("CCThreadProxy::setNeedsRedraw", this, 0);
+    CCProxy::implThread()->postTask(createCCThreadTask(this, &CCThreadProxy::setFullRootLayerDamageOnImplThread));
     CCProxy::implThread()->postTask(createCCThreadTask(this, &CCThreadProxy::setNeedsRedrawOnImplThread));
 }
 
@@ -548,6 +569,14 @@ void CCThreadProxy::didCompleteSwapBuffers()
     m_layerTreeHost->didCompleteSwapBuffers();
 }
 
+void CCThreadProxy::setAnimationEvents(PassOwnPtr<CCAnimationEventsVector> events)
+{
+    ASSERT(isMainThread());
+    if (!m_layerTreeHost)
+        return;
+    m_layerTreeHost->setAnimationEvents(events);
+}
+
 void CCThreadProxy::initializeImplOnImplThread(CCCompletionEvent* completion)
 {
     TRACE_EVENT("CCThreadProxy::initializeImplOnImplThread", this, 0);
@@ -597,6 +626,12 @@ void CCThreadProxy::layerTreeHostClosedOnImplThread(CCCompletionEvent* completio
     completion->signal();
 }
 
+void CCThreadProxy::setFullRootLayerDamageOnImplThread()
+{
+    ASSERT(isImplThread());
+    m_layerTreeHostImpl->setFullRootLayerDamage();
+}
+
 size_t CCThreadProxy::maxPartialTextureUpdates() const
 {
     return textureUpdatesPerFrame;
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCThreadProxy.h b/Source/WebCore/platform/graphics/chromium/cc/CCThreadProxy.h
index d304acd96..330ef51ca 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCThreadProxy.h
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCThreadProxy.h
@@ -25,6 +25,7 @@
 #ifndef CCThreadProxy_h
 #define CCThreadProxy_h
 
+#include "cc/CCAnimationEvents.h"
 #include "cc/CCCompletionEvent.h"
 #include "cc/CCLayerTreeHostImpl.h"
 #include "cc/CCProxy.h"
@@ -49,6 +50,7 @@ public:
 
     // CCProxy implementation
     virtual bool compositeAndReadback(void *pixels, const IntRect&);
+    virtual void startPageScaleAnimation(const IntSize& targetPosition, bool useAnchor, float scale, double durationSec);
     virtual GraphicsContext3D* context();
     virtual void finishAllRendering();
     virtual bool isStarted() const;
@@ -69,6 +71,7 @@ public:
     virtual void onSwapBuffersCompleteOnImplThread();
     virtual void setNeedsRedrawOnImplThread();
     virtual void setNeedsCommitOnImplThread();
+    virtual void postAnimationEventsToMainThreadOnImplThread(PassOwnPtr<CCAnimationEventsVector>);
 
     // CCSchedulerClient implementation
     virtual bool canDraw();
@@ -85,6 +88,7 @@ private:
     void beginFrameAndCommit(int sequenceNumber, double frameBeginTime, PassOwnPtr<CCScrollAndScaleSet>);
     void didCommitAndDrawFrame();
     void didCompleteSwapBuffers();
+    void setAnimationEvents(PassOwnPtr<CCAnimationEventsVector>);
 
     // Called on impl thread
     struct ReadbackRequest {
@@ -97,12 +101,14 @@ private:
     void obtainBeginFrameAndCommitTaskFromCCThread(CCCompletionEvent*, CCThread::Task**);
     void beginFrameCompleteOnImplThread(CCCompletionEvent*);
     void requestReadbackOnImplThread(ReadbackRequest*);
+    void requestStartPageScaleAnimationOnImplThread(IntSize targetPosition, bool useAnchor, float scale, double durationSec);
     void finishAllRenderingOnImplThread(CCCompletionEvent*);
     void initializeImplOnImplThread(CCCompletionEvent*);
     void initializeContextOnImplThread(GraphicsContext3D*);
     void initializeLayerRendererOnImplThread(CCCompletionEvent*, bool* initializeSucceeded, LayerRendererCapabilities*);
     void setVisibleOnImplThread(CCCompletionEvent*, bool visible);
     void layerTreeHostClosedOnImplThread(CCCompletionEvent*);
+    void setFullRootLayerDamageOnImplThread();
 
     // Accessed on main thread only.
     bool m_animateRequested;
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCTiledLayerImpl.cpp b/Source/WebCore/platform/graphics/chromium/cc/CCTiledLayerImpl.cpp
index 80a0435fd..47d0a708c 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCTiledLayerImpl.cpp
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCTiledLayerImpl.cpp
@@ -47,7 +47,7 @@ class ManagedTexture;
 class DrawableTile : public CCLayerTilingData::Tile {
     WTF_MAKE_NONCOPYABLE(DrawableTile);
 public:
-    DrawableTile() : m_textureId(0) { }
+    static PassOwnPtr<DrawableTile> create() { return adoptPtr(new DrawableTile()); }
 
     Platform3DObject textureId() const { return m_textureId; }
     void setTextureId(Platform3DObject textureId) { m_textureId = textureId; }
@@ -56,6 +56,8 @@ public:
     void setOpaqueRect(const IntRect& opaqueRect) { m_opaqueRect = opaqueRect; }
 
 private:
+    DrawableTile() : m_textureId(0) { }
+
     Platform3DObject m_textureId;
     IntRect m_opaqueRect;
 };
@@ -103,9 +105,10 @@ DrawableTile* CCTiledLayerImpl::tileAt(int i, int j) const
 
 DrawableTile* CCTiledLayerImpl::createTile(int i, int j)
 {
-    RefPtr<DrawableTile> tile = adoptRef(new DrawableTile());
-    m_tiler->addTile(tile, i, j);
-    return tile.get();
+    OwnPtr<DrawableTile> tile(DrawableTile::create());
+    DrawableTile* addedTile = tile.get();
+    m_tiler->addTile(tile.release(), i, j);
+    return addedTile;
 }
 
 TransformationMatrix CCTiledLayerImpl::quadTransform() const
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCVideoDrawQuad.cpp b/Source/WebCore/platform/graphics/chromium/cc/CCVideoDrawQuad.cpp
index 3de38e90f..ba5734909 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCVideoDrawQuad.cpp
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCVideoDrawQuad.cpp
@@ -29,16 +29,18 @@
 
 namespace WebCore {
 
-PassOwnPtr<CCVideoDrawQuad> CCVideoDrawQuad::create(const CCSharedQuadState* sharedQuadState, const IntRect& quadRect, CCLayerImpl* layer)
+PassOwnPtr<CCVideoDrawQuad> CCVideoDrawQuad::create(const CCSharedQuadState* sharedQuadState, const IntRect& quadRect, CCVideoLayerImpl::Texture* textures, VideoFrameChromium* frame, GC3Denum format)
 {
-    return adoptPtr(new CCVideoDrawQuad(sharedQuadState, quadRect, layer));
+    return adoptPtr(new CCVideoDrawQuad(sharedQuadState, quadRect, textures, frame, format));
 }
 
-CCVideoDrawQuad::CCVideoDrawQuad(const CCSharedQuadState* sharedQuadState, const IntRect& quadRect, CCLayerImpl* layer)
+CCVideoDrawQuad::CCVideoDrawQuad(const CCSharedQuadState* sharedQuadState, const IntRect& quadRect, CCVideoLayerImpl::Texture* textures, VideoFrameChromium* frame, GC3Denum format)
     : CCDrawQuad(sharedQuadState, CCDrawQuad::VideoContent, quadRect)
-    , m_layer(layer)
+    , m_textures(textures)
+    , m_frame(frame)
+    , m_format(format)
+    , m_matrix(0)
 {
-    ASSERT(m_layer);
 }
 
 }
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCVideoDrawQuad.h b/Source/WebCore/platform/graphics/chromium/cc/CCVideoDrawQuad.h
index b18bc5541..aef78472a 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCVideoDrawQuad.h
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCVideoDrawQuad.h
@@ -26,23 +26,32 @@
 #ifndef CCVideoDrawQuad_h
 #define CCVideoDrawQuad_h
 
+#include "GraphicsTypes3D.h"
 #include "cc/CCDrawQuad.h"
+#include "cc/CCVideoLayerImpl.h"
 #include <wtf/PassOwnPtr.h>
 
 namespace WebCore {
 
-class CCLayerImpl;
 class CCVideoDrawQuad : public CCDrawQuad {
     WTF_MAKE_NONCOPYABLE(CCVideoDrawQuad);
 public:
-    static PassOwnPtr<CCVideoDrawQuad> create(const CCSharedQuadState*, const IntRect&, CCLayerImpl*);
+    static PassOwnPtr<CCVideoDrawQuad> create(const CCSharedQuadState*, const IntRect&, CCVideoLayerImpl::Texture* textures, VideoFrameChromium*, GC3Denum format);
 
-    CCLayerImpl* layer() const { return m_layer; }
+    CCVideoLayerImpl::Texture* textures() const { return m_textures; }
+    VideoFrameChromium* frame() const { return m_frame; }
+    GC3Denum format() const { return m_format; }
+    const float* matrix() const { return m_matrix; }
+
+    void setMatrix(const float* matrix) { m_matrix = matrix; }
 
 private:
-    CCVideoDrawQuad(const CCSharedQuadState*, const IntRect&, CCLayerImpl*);
+    CCVideoDrawQuad(const CCSharedQuadState*, const IntRect&, CCVideoLayerImpl::Texture* textures, VideoFrameChromium*, GC3Denum format);
 
-    CCLayerImpl* m_layer;
+    CCVideoLayerImpl::Texture* m_textures;
+    VideoFrameChromium* m_frame;
+    GC3Denum m_format;
+    const float* m_matrix;
 };
 
 }
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCVideoLayerImpl.cpp b/Source/WebCore/platform/graphics/chromium/cc/CCVideoLayerImpl.cpp
index eef0ca3e9..35f269f50 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCVideoLayerImpl.cpp
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCVideoLayerImpl.cpp
@@ -62,10 +62,21 @@ const float CCVideoLayerImpl::yuvAdjust[3] = {
     -0.5f,
 };
 
+// This matrix is the default transformation for stream textures.
+const float CCVideoLayerImpl::flipTransform[16] = {
+    1, 0, 0, 0,
+    0, -1, 0, 0,
+    0, 0, 1, 0,
+    0, 1, 0, 1,
+};
+
 CCVideoLayerImpl::CCVideoLayerImpl(int id, VideoFrameProvider* provider)
     : CCLayerImpl(id)
     , m_provider(provider)
+    , m_layerTreeHostImpl(0)
+    , m_frame(0)
 {
+    memcpy(m_streamTextureMatrix, flipTransform, sizeof(m_streamTextureMatrix));
     provider->setVideoFrameProviderClient(this);
 }
 
@@ -88,16 +99,16 @@ void CCVideoLayerImpl::stopUsingProvider()
 }
 
 // Convert VideoFrameChromium::Format to GraphicsContext3D's format enum values.
-static GC3Denum convertVFCFormatToGC3DFormat(VideoFrameChromium::Format format)
+static GC3Denum convertVFCFormatToGC3DFormat(const VideoFrameChromium* frame)
 {
-    switch (format) {
+    switch (frame->format()) {
     case VideoFrameChromium::YV12:
     case VideoFrameChromium::YV16:
         return GraphicsContext3D::LUMINANCE;
     case VideoFrameChromium::RGBA:
         return GraphicsContext3D::RGBA;
     case VideoFrameChromium::NativeTexture:
-        return GraphicsContext3D::TEXTURE_2D;
+        return frame->textureTarget();
     case VideoFrameChromium::Invalid:
     case VideoFrameChromium::RGB555:
     case VideoFrameChromium::RGB565:
@@ -112,101 +123,63 @@ static GC3Denum convertVFCFormatToGC3DFormat(VideoFrameChromium::Format format)
     return GraphicsContext3D::INVALID_VALUE;
 }
 
-void CCVideoLayerImpl::draw(LayerRendererChromium* layerRenderer)
+void CCVideoLayerImpl::willDraw(LayerRendererChromium* layerRenderer)
 {
     ASSERT(CCProxy::isImplThread());
 
     MutexLocker locker(m_providerMutex);
 
-    if (!m_provider)
+    if (!m_provider) {
+        m_frame = 0;
         return;
+    }
 
-    VideoFrameChromium* frame = m_provider->getCurrentFrame();
-    if (!frame)
-        return;
-    GC3Denum format = convertVFCFormatToGC3DFormat(frame->format());
+    m_frame = m_provider->getCurrentFrame();
 
-    if (format == GraphicsContext3D::INVALID_VALUE) {
-        m_provider->putCurrentFrame(frame);
+    if (!m_frame)
         return;
-    }
 
-    if (!copyFrameToTextures(frame, format, layerRenderer)) {
-        m_provider->putCurrentFrame(frame);
+    m_format = convertVFCFormatToGC3DFormat(m_frame);
+
+    if (m_format == GraphicsContext3D::INVALID_VALUE) {
+        m_provider->putCurrentFrame(m_frame);
+        m_frame = 0;
         return;
     }
 
-    switch (format) {
-    case GraphicsContext3D::LUMINANCE:
-        drawYUV(layerRenderer);
-        break;
-    case GraphicsContext3D::RGBA:
-        drawRGBA(layerRenderer);
-        break;
-    case GraphicsContext3D::TEXTURE_2D:
-        drawNativeTexture(layerRenderer);
-        break;
-    default:
-        CRASH(); // Someone updated convertVFCFormatToGC3DFormat above but update this!
+    if (!reserveTextures(m_frame, m_format, layerRenderer)) {
+        m_provider->putCurrentFrame(m_frame);
+        m_frame = 0;
     }
-
-    for (unsigned plane = 0; plane < frame->planes(); ++plane)
-        m_textures[plane].m_texture->unreserve();
-    m_provider->putCurrentFrame(frame);
 }
 
 void CCVideoLayerImpl::appendQuads(CCQuadList& quadList, const CCSharedQuadState* sharedQuadState)
 {
     IntRect quadRect(IntPoint(), bounds());
-    quadList.append(CCVideoDrawQuad::create(sharedQuadState, quadRect, this));
+    OwnPtr<CCVideoDrawQuad> videoQuad = CCVideoDrawQuad::create(sharedQuadState, quadRect, m_textures, m_frame, m_format);
+
+    if (m_format == Extensions3DChromium::GL_TEXTURE_EXTERNAL_OES)
+        videoQuad->setMatrix(m_streamTextureMatrix);
+
+    quadList.append(videoQuad.release());
 }
 
-bool CCVideoLayerImpl::copyFrameToTextures(const VideoFrameChromium* frame, GC3Denum format, LayerRendererChromium* layerRenderer)
+void CCVideoLayerImpl::didDraw()
 {
-    if (frame->format() == VideoFrameChromium::NativeTexture) {
-        m_nativeTextureId = frame->textureId();
-        m_nativeTextureSize = IntSize(frame->width(), frame->height());
-        return true;
-    }
+    ASSERT(CCProxy::isImplThread());
 
-    if (!reserveTextures(frame, format, layerRenderer))
-        return false;
+    MutexLocker locker(m_providerMutex);
 
-    for (unsigned plane = 0; plane < frame->planes(); ++plane) {
-        ASSERT(frame->requiredTextureSize(plane) == m_textures[plane].m_texture->size());
-        copyPlaneToTexture(layerRenderer, frame->data(plane), plane);
-    }
-    for (unsigned plane = frame->planes(); plane < MaxPlanes; ++plane) {
-        Texture& texture = m_textures[plane];
-        texture.m_texture.clear();
-        texture.m_visibleSize = IntSize();
-    }
-    m_planes = frame->planes();
-    return true;
-}
+    if (!m_provider || !m_frame)
+        return;
 
-void CCVideoLayerImpl::copyPlaneToTexture(LayerRendererChromium* layerRenderer, const void* plane, int index)
-{
-    Texture& texture = m_textures[index];
-    GraphicsContext3D* context = layerRenderer->context();
-    TextureAllocator* allocator = layerRenderer->renderSurfaceTextureAllocator();
-    texture.m_texture->bindTexture(context, allocator);
-    GC3Denum format = texture.m_texture->format();
-    IntSize dimensions = texture.m_texture->size();
-
-    void* mem = static_cast<Extensions3DChromium*>(context->getExtensions())->mapTexSubImage2DCHROMIUM(GraphicsContext3D::TEXTURE_2D, 0, 0, 0, dimensions.width(), dimensions.height(), format, GraphicsContext3D::UNSIGNED_BYTE, Extensions3DChromium::WRITE_ONLY);
-    if (mem) {
-        memcpy(mem, plane, dimensions.width() * dimensions.height());
-        GLC(context, static_cast<Extensions3DChromium*>(context->getExtensions())->unmapTexSubImage2DCHROMIUM(mem));
-    } else {
-        // If mapTexSubImage2DCHROMIUM fails, then do the slower texSubImage2D
-        // upload. This does twice the copies as mapTexSubImage2DCHROMIUM, one
-        // in the command buffer and another to the texture.
-        GLC(context, context->texSubImage2D(GraphicsContext3D::TEXTURE_2D, 0, 0, 0, dimensions.width(), dimensions.height(), format, GraphicsContext3D::UNSIGNED_BYTE, plane));
-    }
+    for (unsigned plane = 0; plane < m_frame->planes(); ++plane)
+        m_textures[plane].m_texture->unreserve();
+    m_provider->putCurrentFrame(m_frame);
+    m_frame = 0;
 }
 
-static IntSize computeVisibleSize(const VideoFrameChromium* frame, unsigned plane)
+IntSize CCVideoLayerImpl::computeVisibleSize(const VideoFrameChromium* frame, unsigned plane)
 {
     int visibleWidth = frame->width(plane);
     int visibleHeight = frame->height(plane);
@@ -259,79 +232,21 @@ bool CCVideoLayerImpl::reserveTextures(const VideoFrameChromium* frame, GC3Denum
     return true;
 }
 
-void CCVideoLayerImpl::drawYUV(LayerRendererChromium* layerRenderer) const
+void CCVideoLayerImpl::didReceiveFrame()
 {
-    const YUVProgram* program = layerRenderer->videoLayerYUVProgram();
-    ASSERT(program && program->initialized());
-
-    GraphicsContext3D* context = layerRenderer->context();
-    const Texture& yTexture = m_textures[VideoFrameChromium::yPlane];
-    const Texture& uTexture = m_textures[VideoFrameChromium::uPlane];
-    const Texture& vTexture = m_textures[VideoFrameChromium::vPlane];
-
-    GLC(context, context->activeTexture(GraphicsContext3D::TEXTURE1));
-    GLC(context, context->bindTexture(GraphicsContext3D::TEXTURE_2D, yTexture.m_texture->textureId()));
-    GLC(context, context->activeTexture(GraphicsContext3D::TEXTURE2));
-    GLC(context, context->bindTexture(GraphicsContext3D::TEXTURE_2D, uTexture.m_texture->textureId()));
-    GLC(context, context->activeTexture(GraphicsContext3D::TEXTURE3));
-    GLC(context, context->bindTexture(GraphicsContext3D::TEXTURE_2D, vTexture.m_texture->textureId()));
-
-    GLC(context, context->useProgram(program->program()));
-
-    float yWidthScaleFactor = static_cast<float>(yTexture.m_visibleSize.width()) / yTexture.m_texture->size().width();
-    // Arbitrarily take the u sizes because u and v dimensions are identical.
-    float uvWidthScaleFactor = static_cast<float>(uTexture.m_visibleSize.width()) / uTexture.m_texture->size().width();
-    GLC(context, context->uniform1f(program->vertexShader().yWidthScaleFactorLocation(), yWidthScaleFactor));
-    GLC(context, context->uniform1f(program->vertexShader().uvWidthScaleFactorLocation(), uvWidthScaleFactor));
-
-    GLC(context, context->uniform1i(program->fragmentShader().yTextureLocation(), 1));
-    GLC(context, context->uniform1i(program->fragmentShader().uTextureLocation(), 2));
-    GLC(context, context->uniform1i(program->fragmentShader().vTextureLocation(), 3));
-
-    GLC(context, context->uniformMatrix3fv(program->fragmentShader().ccMatrixLocation(), 0, const_cast<float*>(yuv2RGB), 1));
-    GLC(context, context->uniform3fv(program->fragmentShader().yuvAdjLocation(), const_cast<float*>(yuvAdjust), 1));
-
-    layerRenderer->drawTexturedQuad(drawTransform(), bounds().width(), bounds().height(), drawOpacity(), FloatQuad(),
-                                    program->vertexShader().matrixLocation(),
-                                    program->fragmentShader().alphaLocation(),
-                                    -1);
-
-    // Reset active texture back to texture 0.
-    GLC(context, context->activeTexture(GraphicsContext3D::TEXTURE0));
-}
-
-template<class Program>
-void CCVideoLayerImpl::drawCommon(LayerRendererChromium* layerRenderer, Program* program, float widthScaleFactor, Platform3DObject textureId) const
-{
-    ASSERT(program && program->initialized());
-
-    GraphicsContext3D* context = layerRenderer->context();
-
-    GLC(context, context->activeTexture(GraphicsContext3D::TEXTURE0));
-    GLC(context, context->bindTexture(GraphicsContext3D::TEXTURE_2D, textureId));
-
-    GLC(context, context->useProgram(program->program()));
-    GLC(context, context->uniform4f(program->vertexShader().texTransformLocation(), 0, 0, widthScaleFactor, 1));
-    GLC(context, context->uniform1i(program->fragmentShader().samplerLocation(), 0));
-
-    layerRenderer->drawTexturedQuad(drawTransform(), bounds().width(), bounds().height(), drawOpacity(), layerRenderer->sharedGeometryQuad(),
-                                    program->vertexShader().matrixLocation(),
-                                    program->fragmentShader().alphaLocation(),
-                                    -1);
+    setNeedsRedraw();
 }
 
-void CCVideoLayerImpl::drawRGBA(LayerRendererChromium* layerRenderer) const
+void CCVideoLayerImpl::didUpdateMatrix(const float matrix[16])
 {
-    const RGBAProgram* program = layerRenderer->videoLayerRGBAProgram();
-    const Texture& texture = m_textures[VideoFrameChromium::rgbPlane];
-    float widthScaleFactor = static_cast<float>(texture.m_visibleSize.width()) / texture.m_texture->size().width();
-    drawCommon(layerRenderer, program, widthScaleFactor, texture.m_texture->textureId());
+    memcpy(m_streamTextureMatrix, matrix, sizeof(m_streamTextureMatrix));
+    setNeedsRedraw();
 }
 
-void CCVideoLayerImpl::drawNativeTexture(LayerRendererChromium* layerRenderer) const
+void CCVideoLayerImpl::setNeedsRedraw()
 {
-    const NativeTextureProgram* program = layerRenderer->videoLayerNativeTextureProgram();
-    drawCommon(layerRenderer, program, 1, m_nativeTextureId);
+    if (m_layerTreeHostImpl)
+        m_layerTreeHostImpl->setNeedsRedraw();
 }
 
 void CCVideoLayerImpl::dumpLayerProperties(TextStream& ts, int indent) const
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCVideoLayerImpl.h b/Source/WebCore/platform/graphics/chromium/cc/CCVideoLayerImpl.h
index 182f7b582..caa72dfb9 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCVideoLayerImpl.h
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCVideoLayerImpl.h
@@ -35,6 +35,9 @@
 
 namespace WebCore {
 
+class CCLayerTreeHostImpl;
+class CCVideoLayerImpl;
+
 template<class VertexShader, class FragmentShader> class ProgramBinding;
 
 class CCVideoLayerImpl : public CCLayerImpl
@@ -46,48 +49,55 @@ public:
     }
     virtual ~CCVideoLayerImpl();
 
+    virtual void willDraw(LayerRendererChromium*);
     virtual void appendQuads(CCQuadList&, const CCSharedQuadState*);
+    virtual void didDraw();
 
     typedef ProgramBinding<VertexShaderPosTexTransform, FragmentShaderRGBATexFlipAlpha> RGBAProgram;
     typedef ProgramBinding<VertexShaderPosTexYUVStretch, FragmentShaderYUVVideo> YUVProgram;
     typedef ProgramBinding<VertexShaderPosTexTransform, FragmentShaderRGBATexFlipAlpha> NativeTextureProgram;
-
-    virtual void draw(LayerRendererChromium*);
+    typedef ProgramBinding<VertexShaderVideoTransform, FragmentShaderOESImageExternal> StreamTextureProgram;
 
     virtual void dumpLayerProperties(TextStream&, int indent) const;
 
-    // VideoFrameProvider::Client implementation (callable on any thread).
-    virtual void stopUsingProvider();
+    Mutex& providerMutex() { return m_providerMutex; }
+    VideoFrameProvider* provider() const { return m_provider; }
 
-private:
-    explicit CCVideoLayerImpl(int, VideoFrameProvider*);
+    // VideoFrameProvider::Client implementation.
+    virtual void stopUsingProvider(); // Callable on any thread.
+    virtual void didReceiveFrame(); // Callable on impl thread.
+    virtual void didUpdateMatrix(const float*); // Callable on impl thread.
 
-    virtual const char* layerTypeAsString() const { return "VideoLayer"; }
-
-    bool copyFrameToTextures(const VideoFrameChromium*, GC3Denum format, LayerRendererChromium*);
-    void copyPlaneToTexture(LayerRendererChromium*, const void* plane, int index);
-    bool reserveTextures(const VideoFrameChromium*, GC3Denum format, LayerRendererChromium*);
-    void drawYUV(LayerRendererChromium*) const;
-    void drawRGBA(LayerRendererChromium*) const;
-    void drawNativeTexture(LayerRendererChromium*) const;
-    template<class Program> void drawCommon(LayerRendererChromium*, Program*, float widthScaleFactor, Platform3DObject textureId) const;
-
-    Mutex m_providerMutex; // Guards m_provider below.
-    VideoFrameProvider* m_provider;
+    void setNeedsRedraw();
 
     static const float yuv2RGB[9];
     static const float yuvAdjust[3];
+    static const float flipTransform[16];
 
     struct Texture {
         OwnPtr<ManagedTexture> m_texture;
         IntSize m_visibleSize;
     };
     enum { MaxPlanes = 3 };
+
+private:
+    explicit CCVideoLayerImpl(int, VideoFrameProvider*);
+
+    static IntSize computeVisibleSize(const VideoFrameChromium*, unsigned plane);
+    virtual const char* layerTypeAsString() const { return "VideoLayer"; }
+
+    bool reserveTextures(const VideoFrameChromium*, GC3Denum format, LayerRendererChromium*);
+
+    Mutex m_providerMutex; // Guards m_provider below.
+    VideoFrameProvider* m_provider;
+
     Texture m_textures[MaxPlanes];
-    int m_planes;
 
-    Platform3DObject m_nativeTextureId;
-    IntSize m_nativeTextureSize;
+    float m_streamTextureMatrix[16];
+    CCLayerTreeHostImpl* m_layerTreeHostImpl;
+
+    VideoFrameChromium* m_frame;
+    GC3Denum m_format;
 };
 
 }
diff --git a/Source/WebCore/platform/graphics/efl/DrawingBufferEfl.cpp b/Source/WebCore/platform/graphics/efl/DrawingBufferEfl.cpp
deleted file mode 100644
index babe5e42a..000000000
--- a/Source/WebCore/platform/graphics/efl/DrawingBufferEfl.cpp
+++ /dev/null
@@ -1,93 +0,0 @@
-/*
- * Copyright (C) 2010 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#include "config.h"
-
-#if ENABLE(ACCELERATED_2D_CANVAS) || ENABLE(WEBGL)
-
-#include "DrawingBuffer.h"
-
-#include "Extensions3D.h"
-
-namespace WebCore {
-
-DrawingBuffer::DrawingBuffer(GraphicsContext3D* context, const IntSize& size, bool multisampleExtensionSupported, bool packedDepthStencilExtensionSupported, bool separateBackingTexture)
-    : m_separateBackingTexture(separateBackingTexture)
-    , m_scissorEnabled(false)
-    , m_texture2DBinding(0)
-    , m_activeTextureUnit(GraphicsContext3D::TEXTURE0)
-    , m_context(context)
-    , m_size(-1, -1)
-    , m_multisampleExtensionSupported(multisampleExtensionSupported)
-    , m_packedDepthStencilExtensionSupported(packedDepthStencilExtensionSupported)
-    , m_fbo(context->createFramebuffer())
-    , m_colorBuffer(0)
-    , m_depthStencilBuffer(0)
-    , m_depthBuffer(0)
-    , m_stencilBuffer(0)
-    , m_multisampleFBO(0)
-    , m_multisampleColorBuffer(0)
-{
-    // Support for a separate backing texture has only been enabled for
-    // the chromium port.
-    ASSERT(!m_separateBackingTexture);
-    ASSERT(m_fbo);
-    if (!m_fbo) {
-        clear();
-        return;
-    }
-
-    // Create a texture to render into.
-    m_colorBuffer = context->createTexture();
-    context->bindTexture(GraphicsContext3D::TEXTURE_2D, m_colorBuffer);
-    context->texParameterf(GraphicsContext3D::TEXTURE_2D, GraphicsContext3D::TEXTURE_MAG_FILTER, GraphicsContext3D::LINEAR);
-    context->texParameterf(GraphicsContext3D::TEXTURE_2D, GraphicsContext3D::TEXTURE_MIN_FILTER, GraphicsContext3D::LINEAR);
-    context->texParameteri(GraphicsContext3D::TEXTURE_2D, GraphicsContext3D::TEXTURE_WRAP_S, GraphicsContext3D::CLAMP_TO_EDGE);
-    context->texParameteri(GraphicsContext3D::TEXTURE_2D, GraphicsContext3D::TEXTURE_WRAP_T, GraphicsContext3D::CLAMP_TO_EDGE);
-    context->bindTexture(GraphicsContext3D::TEXTURE_2D, 0);
-
-    createSecondaryBuffers();
-    reset(size);
-}
-
-DrawingBuffer::~DrawingBuffer()
-{
-    clear();
-}
-
-Platform3DObject DrawingBuffer::platformColorBuffer() const
-{
-    return m_colorBuffer;
-}
-
-#if USE(ACCELERATED_COMPOSITING)
-void DrawingBuffer::paintCompositedResultsToCanvas(CanvasRenderingContext* context)
-{
-}
-#endif
-
-}
-
-#endif
diff --git a/Source/WebCore/platform/graphics/efl/GraphicsContext3DEfl.cpp b/Source/WebCore/platform/graphics/efl/GraphicsContext3DEfl.cpp
deleted file mode 100644
index 1f1eda21c..000000000
--- a/Source/WebCore/platform/graphics/efl/GraphicsContext3DEfl.cpp
+++ /dev/null
@@ -1,150 +0,0 @@
-/*
- * Copyright (C) 2011, 2012 Samsung Electronics
- *
- * This library is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Library General Public
- * License as published by the Free Software Foundation; either
- * version 2 of the License, or (at your option) any later version.
- *
- * This library is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Library General Public License for more details.
- *
- * You should have received a copy of the GNU Library General Public License
- * along with this library; see the file COPYING.LIB.  If not, write to
- * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
- * Boston, MA 02110-1301, USA.
- */
-
-#include "config.h"
-#include "GraphicsContext3D.h"
-
-#if ENABLE(WEBGL)
-#include "Extensions3DOpenGL.h"
-#include "GraphicsContext3DPrivate.h"
-#include "OpenGLShims.h"
-#include "ShaderLang.h"
-
-namespace WebCore {
-
-PassRefPtr<GraphicsContext3D> GraphicsContext3D::create(GraphicsContext3D::Attributes attributes, HostWindow* hostWindow, GraphicsContext3D::RenderStyle renderStyle)
-{
-    bool renderDirectlyToHostWindow = (renderStyle == RenderDirectlyToHostWindow);
-    // This implementation doesn't currently support rendering directly to the HostWindow.
-    if (renderDirectlyToHostWindow)
-        return 0;
-
-    OwnPtr<GraphicsContext3DPrivate> priv = GraphicsContext3DPrivate::create();
-    if (!priv)
-        return 0;
-
-    RefPtr<GraphicsContext3D> context = adoptRef(new GraphicsContext3D(attributes, hostWindow, renderDirectlyToHostWindow));
-    context->m_private = priv.release();
-    return context.release();
-}
-
-GraphicsContext3D::GraphicsContext3D(GraphicsContext3D::Attributes attributes, HostWindow* hostWindow, bool renderDirectlyToHostWindow)
-    : m_currentWidth(0)
-    , m_currentHeight(0)
-    , m_attrs(attributes)
-    , m_texture(0)
-    , m_fbo(0)
-    , m_depthStencilBuffer(0)
-    , m_boundFBO(0)
-    , m_multisampleFBO(0)
-    , m_multisampleDepthStencilBuffer(0)
-    , m_multisampleColorBuffer(0)
-{
-    GraphicsContext3DPrivate::addActiveGraphicsContext(this);
-
-    validateAttributes();
-
-    // Create a texture to render into.
-    ::glGenTextures(1, &m_texture);
-    ::glBindTexture(GL_TEXTURE_2D, m_texture);
-    ::glTexParameterf(GL_TEXTURE_2D, GL_TEXTURE_MAG_FILTER, GL_LINEAR);
-    ::glTexParameterf(GL_TEXTURE_2D, GL_TEXTURE_MIN_FILTER, GL_LINEAR);
-    ::glTexParameteri(GL_TEXTURE_2D, GL_TEXTURE_WRAP_S, GL_CLAMP);
-    ::glTexParameteri(GL_TEXTURE_2D, GL_TEXTURE_WRAP_T, GL_CLAMP);
-    ::glBindTexture(GL_TEXTURE_2D, 0);
-
-    // Create an FBO.
-    ::glGenFramebuffersEXT(1, &m_fbo);
-    ::glBindFramebufferEXT(GL_FRAMEBUFFER_EXT, m_fbo);
-
-    m_boundFBO = m_fbo;
-    if (!m_attrs.antialias && (m_attrs.stencil || m_attrs.depth))
-        ::glGenRenderbuffersEXT(1, &m_depthStencilBuffer);
-
-    // Create a multisample FBO.
-    if (m_attrs.antialias) {
-        ::glGenFramebuffersEXT(1, &m_multisampleFBO);
-        ::glBindFramebufferEXT(GL_FRAMEBUFFER_EXT, m_multisampleFBO);
-        m_boundFBO = m_multisampleFBO;
-        ::glGenRenderbuffersEXT(1, &m_multisampleColorBuffer);
-        if (m_attrs.stencil || m_attrs.depth)
-            ::glGenRenderbuffersEXT(1, &m_multisampleDepthStencilBuffer);
-    }
-
-    // ANGLE initialization.
-    ShBuiltInResources ANGLEResources;
-    ShInitBuiltInResources(&ANGLEResources);
-
-    getIntegerv(GraphicsContext3D::MAX_VERTEX_ATTRIBS, &ANGLEResources.MaxVertexAttribs);
-    getIntegerv(GraphicsContext3D::MAX_VERTEX_UNIFORM_VECTORS, &ANGLEResources.MaxVertexUniformVectors);
-    getIntegerv(GraphicsContext3D::MAX_VARYING_VECTORS, &ANGLEResources.MaxVaryingVectors);
-    getIntegerv(GraphicsContext3D::MAX_VERTEX_TEXTURE_IMAGE_UNITS, &ANGLEResources.MaxVertexTextureImageUnits);
-    getIntegerv(GraphicsContext3D::MAX_COMBINED_TEXTURE_IMAGE_UNITS, &ANGLEResources.MaxCombinedTextureImageUnits);
-    getIntegerv(GraphicsContext3D::MAX_TEXTURE_IMAGE_UNITS, &ANGLEResources.MaxTextureImageUnits);
-    getIntegerv(GraphicsContext3D::MAX_FRAGMENT_UNIFORM_VECTORS, &ANGLEResources.MaxFragmentUniformVectors);
-
-    // Always set to 1 for OpenGL ES.
-    ANGLEResources.MaxDrawBuffers = 1;
-    m_compiler.setResources(ANGLEResources);
-
-    ::glEnable(GL_VERTEX_PROGRAM_POINT_SIZE);
-    ::glEnable(GL_POINT_SPRITE);
-    ::glClearColor(0, 0, 0, 0);
-}
-
-GraphicsContext3D::~GraphicsContext3D()
-{
-    GraphicsContext3DPrivate::removeActiveGraphicsContext(this);
-    if (!m_private->m_context)
-        return;
-
-    makeContextCurrent();
-    ::glDeleteTextures(1, &m_texture);
-    if (m_attrs.antialias) {
-        ::glDeleteRenderbuffersEXT(1, &m_multisampleColorBuffer);
-        if (m_attrs.stencil || m_attrs.depth)
-            ::glDeleteRenderbuffersEXT(1, &m_multisampleDepthStencilBuffer);
-        ::glDeleteFramebuffersEXT(1, &m_multisampleFBO);
-    } else {
-        if (m_attrs.stencil || m_attrs.depth)
-            ::glDeleteRenderbuffersEXT(1, &m_depthStencilBuffer);
-    }
-    ::glDeleteFramebuffersEXT(1, &m_fbo);
-}
-
-bool GraphicsContext3D::makeContextCurrent()
-{
-    if (!m_private)
-        return false;
-    return m_private->makeContextCurrent();
-}
-
-PlatformGraphicsContext3D GraphicsContext3D::platformGraphicsContext3D() const
-{
-    return m_private->m_context;
-}
-
-bool GraphicsContext3D::isGLES2Compliant() const
-{
-    return false;
-}
-
-} // namespace WebCore
-
-#endif // ENABLE(WEBGL)
diff --git a/Source/WebCore/platform/graphics/filters/FEComposite.cpp b/Source/WebCore/platform/graphics/filters/FEComposite.cpp
index c64d02c8a..fbc2c1671 100644
--- a/Source/WebCore/platform/graphics/filters/FEComposite.cpp
+++ b/Source/WebCore/platform/graphics/filters/FEComposite.cpp
@@ -239,9 +239,19 @@ void FEComposite::platformApplySoftware()
         filterContext->drawImageBuffer(in->asImageBuffer(), ColorSpaceDeviceRGB, drawingRegionOfInputImage(in->absolutePaintRect()));
         break;
     case FECOMPOSITE_OPERATOR_IN: {
-        GraphicsContextStateSaver stateSaver(*filterContext);
-        filterContext->clipToImageBuffer(in2->asImageBuffer(), drawingRegionOfInputImage(in2->absolutePaintRect()));
-        filterContext->drawImageBuffer(in->asImageBuffer(), ColorSpaceDeviceRGB, drawingRegionOfInputImage(in->absolutePaintRect()));
+        // Applies only to the intersected region.
+        IntRect destinationRect = in->absolutePaintRect();
+        destinationRect.intersect(in2->absolutePaintRect());
+        destinationRect.intersect(absolutePaintRect());
+        if (destinationRect.isEmpty())
+            break;
+        IntPoint destinationPoint(destinationRect.x() - absolutePaintRect().x(), destinationRect.y() - absolutePaintRect().y());
+        IntRect sourceRect(IntPoint(destinationRect.x() - in->absolutePaintRect().x(),
+                                    destinationRect.y() - in->absolutePaintRect().y()), destinationRect.size());
+        IntRect source2Rect(IntPoint(destinationRect.x() - in2->absolutePaintRect().x(),
+                                     destinationRect.y() - in2->absolutePaintRect().y()), destinationRect.size());
+        filterContext->drawImageBuffer(in2->asImageBuffer(), ColorSpaceDeviceRGB, destinationPoint, source2Rect);
+        filterContext->drawImageBuffer(in->asImageBuffer(), ColorSpaceDeviceRGB, destinationPoint, sourceRect, CompositeSourceIn);
         break;
     }
     case FECOMPOSITE_OPERATOR_OUT:
diff --git a/Source/WebCore/platform/graphics/filters/FilterOperation.h b/Source/WebCore/platform/graphics/filters/FilterOperation.h
index 4d15ec8ed..9ee955768 100644
--- a/Source/WebCore/platform/graphics/filters/FilterOperation.h
+++ b/Source/WebCore/platform/graphics/filters/FilterOperation.h
@@ -74,6 +74,13 @@ public:
 
     virtual OperationType getOperationType() const { return m_type; }
     virtual bool isSameType(const FilterOperation& o) const { return o.getOperationType() == m_type; }
+    
+    virtual bool isDefault() const { return false; }
+
+    // True if the alpha channel of any pixel can change under this operation.
+    virtual bool affectsOpacity() const { return false; }
+    // True if the the value of one pixel can affect the value of another pixel under this operation, such as blur.
+    virtual bool movesPixels() const { return false; }
 
 protected:
     FilterOperation(OperationType type)
@@ -84,6 +91,28 @@ protected:
     OperationType m_type;
 };
 
+class DefaultFilterOperation : public FilterOperation {
+public:
+    static PassRefPtr<DefaultFilterOperation> create(OperationType type)
+    {
+        return adoptRef(new DefaultFilterOperation(type));
+    }
+
+private:
+
+    virtual bool operator==(const FilterOperation& o) const
+    {
+        return isSameType(o);
+    }
+
+    virtual bool isDefault() const { return true; }
+
+    DefaultFilterOperation(OperationType type)
+        : FilterOperation(type)
+    {
+    }
+};
+
 class PassthroughFilterOperation : public FilterOperation {
 public:
     static PassRefPtr<PassthroughFilterOperation> create()
@@ -111,6 +140,9 @@ public:
         return adoptRef(new ReferenceFilterOperation(reference, type));
     }
 
+    virtual bool affectsOpacity() const { return true; }
+    virtual bool movesPixels() const { return true; }
+
     const AtomicString& reference() const { return m_reference; }
 
 private:
@@ -175,6 +207,8 @@ public:
 
     double amount() const { return m_amount; }
 
+    virtual bool affectsOpacity() const { return m_type == OPACITY; }
+
     virtual PassRefPtr<FilterOperation> blend(const FilterOperation* from, double progress, bool blendToPassthrough = false);
 
 private:
@@ -241,6 +275,9 @@ public:
 
     Length stdDeviation() const { return m_stdDeviation; }
 
+    virtual bool affectsOpacity() const { return true; }
+    virtual bool movesPixels() const { return true; }
+
     virtual PassRefPtr<FilterOperation> blend(const FilterOperation* from, double progress, bool blendToPassthrough = false);
 
 private:
@@ -273,6 +310,9 @@ public:
     int stdDeviation() const { return m_stdDeviation; }
     Color color() const { return m_color; }
 
+    virtual bool affectsOpacity() const { return true; }
+    virtual bool movesPixels() const { return true; }
+
     virtual PassRefPtr<FilterOperation> blend(const FilterOperation* from, double progress, bool blendToPassthrough = false);
 
 private:
diff --git a/Source/WebCore/platform/graphics/filters/FilterOperations.cpp b/Source/WebCore/platform/graphics/filters/FilterOperations.cpp
index dd92ac1aa..35282cb53 100644
--- a/Source/WebCore/platform/graphics/filters/FilterOperations.cpp
+++ b/Source/WebCore/platform/graphics/filters/FilterOperations.cpp
@@ -136,6 +136,22 @@ void FilterOperations::getOutsets(LayoutUnit& top, LayoutUnit& right, LayoutUnit
     }
 }
 
+bool FilterOperations::hasFilterThatAffectsOpacity() const
+{
+    for (size_t i = 0; i < m_operations.size(); ++i)
+        if (m_operations[i]->affectsOpacity())
+            return true;
+    return false;
+}
+
+bool FilterOperations::hasFilterThatMovesPixels() const
+{
+    for (size_t i = 0; i < m_operations.size(); ++i)
+        if (m_operations[i]->movesPixels())
+            return true;
+    return false;
+}
+
 } // namespace WebCore
 
 #endif // ENABLE(CSS_FILTERS)
diff --git a/Source/WebCore/platform/graphics/filters/FilterOperations.h b/Source/WebCore/platform/graphics/filters/FilterOperations.h
index 64cee8808..0b492eb9a 100644
--- a/Source/WebCore/platform/graphics/filters/FilterOperations.h
+++ b/Source/WebCore/platform/graphics/filters/FilterOperations.h
@@ -57,6 +57,7 @@ public:
     Vector<RefPtr<FilterOperation> >& operations() { return m_operations; }
     const Vector<RefPtr<FilterOperation> >& operations() const { return m_operations; }
 
+    bool isEmpty() const { return !m_operations.size(); }
     size_t size() const { return m_operations.size(); }
     const FilterOperation* at(size_t index) const { return index < m_operations.size() ? m_operations.at(index).get() : 0; }
 
@@ -65,6 +66,9 @@ public:
     bool hasOutsets() const;
     void getOutsets(LayoutUnit& top, LayoutUnit& right, LayoutUnit& bottom, LayoutUnit& left) const;
 
+    bool hasFilterThatAffectsOpacity() const;
+    bool hasFilterThatMovesPixels() const;
+
 private:
     Vector<RefPtr<FilterOperation> > m_operations;
 };
diff --git a/Source/WebCore/platform/graphics/filters/SourceAlpha.cpp b/Source/WebCore/platform/graphics/filters/SourceAlpha.cpp
index aeebde6f8..0bd5cbc5a 100644
--- a/Source/WebCore/platform/graphics/filters/SourceAlpha.cpp
+++ b/Source/WebCore/platform/graphics/filters/SourceAlpha.cpp
@@ -63,9 +63,8 @@ void SourceAlpha::platformApplySoftware()
 
     FloatRect imageRect(FloatPoint(), absolutePaintRect().size());
     GraphicsContext* filterContext = resultImage->context();
-    GraphicsContextStateSaver stateSaver(*filterContext);
-    filterContext->clipToImageBuffer(filter->sourceImage(), imageRect);
     filterContext->fillRect(imageRect, Color::black, ColorSpaceDeviceRGB);
+    filterContext->drawImageBuffer(filter->sourceImage(), ColorSpaceDeviceRGB, IntPoint(), CompositeDestinationIn);
 }
 
 void SourceAlpha::dump()
diff --git a/Source/WebCore/platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp b/Source/WebCore/platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp
index e28b67b37..fd90fa9a6 100644
--- a/Source/WebCore/platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp
+++ b/Source/WebCore/platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp
@@ -283,9 +283,17 @@ MediaPlayerPrivateGStreamer::~MediaPlayerPrivateGStreamer()
 
 void MediaPlayerPrivateGStreamer::load(const String& url)
 {
-    g_object_set(m_playBin, "uri", url.utf8().data(), NULL);
 
-    LOG_VERBOSE(Media, "Load %s", url.utf8().data());
+    KURL kurl(KURL(), url);
+    String cleanUrl(url);
+
+    // Clean out everything after file:// url path.
+    if (kurl.isLocalFile())
+        cleanUrl = cleanUrl.substring(0, kurl.pathEnd());
+
+    g_object_set(m_playBin, "uri", cleanUrl.utf8().data(), NULL);
+
+    LOG_VERBOSE(Media, "Load %s", cleanUrl.utf8().data());
 
     if (m_preload == MediaPlayer::None) {
         LOG_VERBOSE(Media, "Delaying load.");
@@ -1026,15 +1034,8 @@ void MediaPlayerPrivateGStreamer::sourceChanged()
     gst_object_replace(reinterpret_cast<GstObject**>(&m_source),
                        reinterpret_cast<GstObject*>(element.get()));
 
-    if (WEBKIT_IS_WEB_SRC(element.get())) {
-        Frame* frame = 0;
-        Document* document = m_player->mediaPlayerClient()->mediaPlayerOwningDocument();
-        if (document)
-            frame = document->frame();
-
-        if (frame)
-            webKitWebSrcSetFrame(WEBKIT_WEB_SRC(element.get()), frame);
-    }
+    if (WEBKIT_IS_WEB_SRC(element.get()))
+        webKitWebSrcSetMediaPlayer(WEBKIT_WEB_SRC(element.get()), m_player);
 }
 
 void MediaPlayerPrivateGStreamer::cancelLoad()
@@ -1494,8 +1495,10 @@ static HashSet<String> mimeTypeCache()
                 const gchar* name = gst_structure_get_name(structure);
                 bool cached = false;
 
-                // These formats are supported by GStreamer, but not
-                // correctly advertised.
+                // There isn't a one-to-one correspondance of caps to supported mime types in
+                // GStreamer, so we need to manually map between them. At some point in the future,
+                // GStreamer may reduce the differences between caps and mime types and we can
+                // remove mappings.
                 if (g_str_equal(name, "video/x-h264")) {
                     cache.add(String("video/mp4"));
                     cached = true;
@@ -1523,6 +1526,7 @@ static HashSet<String> mimeTypeCache()
                 if (g_str_equal(name, "audio/x-vorbis")) {
                     cache.add(String("audio/ogg"));
                     cache.add(String("audio/x-vorbis+ogg"));
+                    cache.add(String("audio/webm"));
                     cached = true;
                 }
 
diff --git a/Source/WebCore/platform/graphics/gstreamer/PlatformVideoWindowPrivate.h b/Source/WebCore/platform/graphics/gstreamer/PlatformVideoWindowPrivate.h
index eeb08c2e3..33600f696 100644
--- a/Source/WebCore/platform/graphics/gstreamer/PlatformVideoWindowPrivate.h
+++ b/Source/WebCore/platform/graphics/gstreamer/PlatformVideoWindowPrivate.h
@@ -20,18 +20,26 @@
 #ifndef PlatformVideoWindowPrivate_h
 #define PlatformVideoWindowPrivate_h
 
+#include <QEvent>
 #include <QTimer>
-#include <QWidget>
 
-QT_BEGIN_NAMESPACE
-class QKeyEvent;
-QT_END_NAMESPACE
+#if QT_VERSION >= QT_VERSION_CHECK(5, 0, 0)
+#include <QWindow>
+#else
+#include <QWidget>
+#endif
 
 namespace WebCore {
 
 class HTMLVideoElement;
 
-class FullScreenVideoWindow: public QWidget {
+#if QT_VERSION >= QT_VERSION_CHECK(5, 0, 0)
+typedef QWindow Base;
+#else
+typedef QWidget Base;
+#endif
+
+class FullScreenVideoWindow: public Base {
 Q_OBJECT
 public:
     FullScreenVideoWindow();
@@ -39,7 +47,6 @@ public:
 signals:
     void closed();
 protected:
-    void closeEvent(QCloseEvent*);
     void keyPressEvent(QKeyEvent*);
     bool event(QEvent*);
 
diff --git a/Source/WebCore/platform/graphics/gstreamer/PlatformVideoWindowQt.cpp b/Source/WebCore/platform/graphics/gstreamer/PlatformVideoWindowQt.cpp
index 0a6c45bf7..06a792505 100644
--- a/Source/WebCore/platform/graphics/gstreamer/PlatformVideoWindowQt.cpp
+++ b/Source/WebCore/platform/graphics/gstreamer/PlatformVideoWindowQt.cpp
@@ -23,10 +23,11 @@
 #include "HTMLVideoElement.h"
 #include "PlatformVideoWindowPrivate.h"
 
+#include <QCursor>
 #include <QGuiApplication>
-#include <QDesktopWidget>
 #include <QKeyEvent>
 #include <QPalette>
+
 using namespace WebCore;
 
 #ifndef QT_NO_CURSOR
@@ -34,13 +35,14 @@ static const int gHideMouseCursorDelay = 3000;
 #endif
 
 FullScreenVideoWindow::FullScreenVideoWindow()
-    : QWidget(0, Qt::Window)
-    , m_mediaElement(0)
+    : m_mediaElement(0)
 {
+#if QT_VERSION < QT_VERSION_CHECK(5, 0, 0)
     setAttribute(Qt::WA_NativeWindow);
-    setWindowModality(Qt::ApplicationModal);
     setAttribute(Qt::WA_NoSystemBackground, true);
     setAttribute(Qt::WA_PaintOnScreen, true);
+#endif
+    setWindowModality(Qt::ApplicationModal);
 
 #ifndef QT_NO_CURSOR
     m_cursorTimer.setSingleShot(true);
@@ -53,18 +55,6 @@ void FullScreenVideoWindow::setVideoElement(HTMLVideoElement* element)
     m_mediaElement = element;
 }
 
-void FullScreenVideoWindow::closeEvent(QCloseEvent*)
-{
-#ifndef QT_NO_CURSOR
-    m_cursorTimer.stop();
-#endif
-    setMouseTracking(false);
-    releaseMouse();
-#ifndef QT_NO_CURSOR
-    QGuiApplication::restoreOverrideCursor();
-#endif
-}
-
 void FullScreenVideoWindow::keyPressEvent(QKeyEvent* ev)
 {
     if (m_mediaElement && ev->key() == Qt::Key_Space) {
@@ -74,7 +64,7 @@ void FullScreenVideoWindow::keyPressEvent(QKeyEvent* ev)
             m_mediaElement->play();
     } else if (ev->key() == Qt::Key_Escape)
         emit closed();
-    QWidget::keyPressEvent(ev);
+    Base::keyPressEvent(ev);
 }
 
 bool FullScreenVideoWindow::event(QEvent* ev)
@@ -88,17 +78,34 @@ bool FullScreenVideoWindow::event(QEvent* ev)
         emit closed();
         ev->accept();
         return true;
+    case QEvent::Close:
+#ifndef QT_NO_CURSOR
+        m_cursorTimer.stop();
+#endif
+#if QT_VERSION < QT_VERSION_CHECK(5, 0, 0)
+        setMouseTracking(false);
+        releaseMouse();
+#endif
+#ifndef QT_NO_CURSOR
+        QGuiApplication::restoreOverrideCursor();
+#endif
+        break;
     default:
-        return QWidget::event(ev);
+        break;
     }
+    return Base::event(ev);
 }
 
 void FullScreenVideoWindow::showFullScreen()
 {
-    QWidget::showFullScreen();
+    Base::showFullScreen();
+#if QT_VERSION < QT_VERSION_CHECK(5, 0, 0)
     setMouseTracking(true);
+#endif
     raise();
+#if QT_VERSION < QT_VERSION_CHECK(5, 0, 0)
     setFocus();
+#endif
     hideCursor();
 }
 
@@ -120,14 +127,18 @@ void FullScreenVideoWindow::showCursor()
 
 PlatformVideoWindow::PlatformVideoWindow()
 {
-    m_window = new FullScreenVideoWindow();
-    m_window->setWindowFlags(m_window->windowFlags() | Qt::FramelessWindowHint);
+    Base* win = new FullScreenVideoWindow();
+    m_window = win;
+    win->setWindowFlags(win->windowFlags() | Qt::FramelessWindowHint);
+    // FIXME: Port to Qt 5.
+#if QT_VERSION < QT_VERSION_CHECK(5, 0, 0)
     QPalette p;
     p.setColor(QPalette::Base, Qt::black);
     p.setColor(QPalette::Window, Qt::black);
-    m_window->setPalette(p);
-    m_window->showFullScreen();
-    m_videoWindowId = m_window->winId();
+    win->setPalette(p);
+#endif
+    win->showFullScreen();
+    m_videoWindowId = win->winId();
 }
 
 PlatformVideoWindow::~PlatformVideoWindow()
diff --git a/Source/WebCore/platform/graphics/gstreamer/WebKitWebSourceGStreamer.cpp b/Source/WebCore/platform/graphics/gstreamer/WebKitWebSourceGStreamer.cpp
index ad4c24d82..2fc00581a 100644
--- a/Source/WebCore/platform/graphics/gstreamer/WebKitWebSourceGStreamer.cpp
+++ b/Source/WebCore/platform/graphics/gstreamer/WebKitWebSourceGStreamer.cpp
@@ -22,9 +22,11 @@
 #if ENABLE(VIDEO) && USE(GSTREAMER)
 
 #include "Document.h"
+#include "Frame.h"
 #include "GOwnPtr.h"
 #include "GRefPtr.h"
 #include "GRefPtrGStreamer.h"
+#include "MediaPlayer.h"
 #include "NetworkingContext.h"
 #include "Noncopyable.h"
 #include "NotImplemented.h"
@@ -63,6 +65,7 @@ struct _WebKitWebSrcPrivate {
     gchar* uri;
 
     RefPtr<WebCore::Frame> frame;
+    WebCore::MediaPlayer* player;
 
     StreamingClient* client;
     RefPtr<ResourceHandle> resourceHandle;
@@ -352,7 +355,9 @@ static void webKitWebSrcStop(WebKitWebSrc* src, bool seeking)
     priv->resourceHandle = 0;
 
     if (priv->frame && !seeking)
-        priv->frame.release();
+        priv->frame.clear();
+
+    priv->player = 0;
 
     GST_OBJECT_LOCK(src);
     if (priv->needDataID)
@@ -414,18 +419,15 @@ static bool webKitWebSrcStart(WebKitWebSrc* src)
     request.setAllowCookies(true);
 
     NetworkingContext* context = 0;
-    if (priv->frame) {
-        Document* document = priv->frame->document();
-        if (document)
-            request.setHTTPReferrer(document->documentURI());
-
-        FrameLoader* loader = priv->frame->loader();
-        if (loader) {
-            loader->addExtraFieldsToSubresourceRequest(request);
-            context = loader->networkingContext();
-        }
+    FrameLoader* loader = priv->frame ? priv->frame->loader() : 0;
+    if (loader) {
+        loader->addExtraFieldsToSubresourceRequest(request);
+        context = loader->networkingContext();
     }
 
+    if (priv->player)
+        request.setHTTPReferrer(priv->player->referrer());
+
     // Let Apple web servers know we want to access their nice movie trailers.
     if (!g_ascii_strcasecmp("movies.apple.com", url.host().utf8().data())
         || !g_ascii_strcasecmp("trailers.apple.com", url.host().utf8().data()))
@@ -739,11 +741,17 @@ static gboolean webKitWebSrcSeekDataCb(GstAppSrc* appsrc, guint64 offset, gpoint
     return TRUE;
 }
 
-void webKitWebSrcSetFrame(WebKitWebSrc* src, WebCore::Frame* frame)
+void webKitWebSrcSetMediaPlayer(WebKitWebSrc* src, WebCore::MediaPlayer* player)
 {
     WebKitWebSrcPrivate* priv = src->priv;
+    WebCore::Frame* frame = 0;
+
+    WebCore::Document* document = player->mediaPlayerClient()->mediaPlayerOwningDocument();
+    if (document)
+        frame = document->frame();
 
     priv->frame = frame;
+    priv->player = player;
 }
 
 StreamingClient::StreamingClient(WebKitWebSrc* src) : m_src(src)
diff --git a/Source/WebCore/platform/graphics/gstreamer/WebKitWebSourceGStreamer.h b/Source/WebCore/platform/graphics/gstreamer/WebKitWebSourceGStreamer.h
index 2712413b9..9ed95cfad 100644
--- a/Source/WebCore/platform/graphics/gstreamer/WebKitWebSourceGStreamer.h
+++ b/Source/WebCore/platform/graphics/gstreamer/WebKitWebSourceGStreamer.h
@@ -20,7 +20,7 @@
 #define WebKitWebSourceGStreamer_h
 #if ENABLE(VIDEO) && USE(GSTREAMER)
 
-#include "Frame.h"
+#include "MediaPlayer.h"
 #include <gst/gst.h>
 
 G_BEGIN_DECLS
@@ -46,7 +46,7 @@ struct _WebKitWebSrcClass {
 };
 
 GType webkit_web_src_get_type(void);
-void  webKitWebSrcSetFrame(WebKitWebSrc* src, WebCore::Frame* frame);
+void webKitWebSrcSetMediaPlayer(WebKitWebSrc*, WebCore::MediaPlayer*);
 
 G_END_DECLS
 
diff --git a/Source/WebCore/platform/graphics/gtk/GraphicsContext3DGtk.cpp b/Source/WebCore/platform/graphics/gtk/GraphicsContext3DGtk.cpp
deleted file mode 100644
index 418b8b461..000000000
--- a/Source/WebCore/platform/graphics/gtk/GraphicsContext3DGtk.cpp
+++ /dev/null
@@ -1,157 +0,0 @@
-/*
- * Copyright (C) 2009 Apple Inc. All rights reserved.
- * Copyright (C) 2011 Igalia S.L.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#include "config.h"
-#include "GraphicsContext3D.h"
-
-#if ENABLE(WEBGL)
-#include "Extensions3DOpenGL.h"
-#include "GraphicsContext3DPrivate.h"
-#include "OpenGLShims.h"
-#include "ShaderLang.h"
-#include <wtf/NotFound.h>
-
-namespace WebCore {
-
-PassRefPtr<GraphicsContext3D> GraphicsContext3D::create(GraphicsContext3D::Attributes attributes, HostWindow* hostWindow, GraphicsContext3D::RenderStyle renderStyle)
-{
-    // This implementation doesn't currently support rendering directly to the HostWindow.
-    if (renderStyle == RenderDirectlyToHostWindow)
-        return 0;
-
-    OwnPtr<GraphicsContext3DPrivate> priv = GraphicsContext3DPrivate::create();
-    if (!priv)
-        return 0;
-
-    RefPtr<GraphicsContext3D> context = adoptRef(new GraphicsContext3D(attributes, hostWindow, false));
-    context->m_private = priv.release();
-    return context.release();
-}
-
-GraphicsContext3D::GraphicsContext3D(GraphicsContext3D::Attributes attributes, HostWindow*, bool)
-    : m_currentWidth(0)
-    , m_currentHeight(0)
-    , m_attrs(attributes)
-    , m_texture(0)
-    , m_fbo(0)
-    , m_depthStencilBuffer(0)
-    , m_boundFBO(0)
-    , m_multisampleFBO(0)
-    , m_multisampleDepthStencilBuffer(0)
-    , m_multisampleColorBuffer(0)
-{
-    GraphicsContext3DPrivate::addActiveGraphicsContext(this);
-
-    validateAttributes();
-
-    // Create a texture to render into.
-    ::glGenTextures(1, &m_texture);
-    ::glBindTexture(GL_TEXTURE_2D, m_texture);
-    ::glTexParameterf(GL_TEXTURE_2D, GL_TEXTURE_MAG_FILTER, GL_LINEAR);
-    ::glTexParameterf(GL_TEXTURE_2D, GL_TEXTURE_MIN_FILTER, GL_LINEAR);
-    ::glTexParameteri(GL_TEXTURE_2D, GL_TEXTURE_WRAP_S, GL_CLAMP);
-    ::glTexParameteri(GL_TEXTURE_2D, GL_TEXTURE_WRAP_T, GL_CLAMP);
-    ::glBindTexture(GL_TEXTURE_2D, 0);
-
-    // Create an FBO.
-    ::glGenFramebuffersEXT(1, &m_fbo);
-    ::glBindFramebufferEXT(GL_FRAMEBUFFER_EXT, m_fbo);
-
-    m_boundFBO = m_fbo;
-    if (!m_attrs.antialias && (m_attrs.stencil || m_attrs.depth))
-        ::glGenRenderbuffersEXT(1, &m_depthStencilBuffer);
-    
-    // Create a multisample FBO.
-    if (m_attrs.antialias) {
-        ::glGenFramebuffersEXT(1, &m_multisampleFBO);
-        ::glBindFramebufferEXT(GL_FRAMEBUFFER_EXT, m_multisampleFBO);
-        m_boundFBO = m_multisampleFBO;
-        ::glGenRenderbuffersEXT(1, &m_multisampleColorBuffer);
-        if (m_attrs.stencil || m_attrs.depth)
-            ::glGenRenderbuffersEXT(1, &m_multisampleDepthStencilBuffer);
-    }
-
-    // ANGLE initialization.
-    ShBuiltInResources ANGLEResources;
-    ShInitBuiltInResources(&ANGLEResources);
-
-    getIntegerv(GraphicsContext3D::MAX_VERTEX_ATTRIBS, &ANGLEResources.MaxVertexAttribs);
-    getIntegerv(GraphicsContext3D::MAX_VERTEX_UNIFORM_VECTORS, &ANGLEResources.MaxVertexUniformVectors);
-    getIntegerv(GraphicsContext3D::MAX_VARYING_VECTORS, &ANGLEResources.MaxVaryingVectors);
-    getIntegerv(GraphicsContext3D::MAX_VERTEX_TEXTURE_IMAGE_UNITS, &ANGLEResources.MaxVertexTextureImageUnits);
-    getIntegerv(GraphicsContext3D::MAX_COMBINED_TEXTURE_IMAGE_UNITS, &ANGLEResources.MaxCombinedTextureImageUnits);
-    getIntegerv(GraphicsContext3D::MAX_TEXTURE_IMAGE_UNITS, &ANGLEResources.MaxTextureImageUnits);
-    getIntegerv(GraphicsContext3D::MAX_FRAGMENT_UNIFORM_VECTORS, &ANGLEResources.MaxFragmentUniformVectors);
-
-    // Always set to 1 for OpenGL ES.
-    ANGLEResources.MaxDrawBuffers = 1;
-    m_compiler.setResources(ANGLEResources);
-
-    ::glEnable(GL_VERTEX_PROGRAM_POINT_SIZE);
-    ::glEnable(GL_POINT_SPRITE);
-    ::glClearColor(0, 0, 0, 0);
-}
-
-GraphicsContext3D::~GraphicsContext3D()
-{
-    GraphicsContext3DPrivate::removeActiveGraphicsContext(this);
-    if (!m_private->m_context)
-        return;
-
-    makeContextCurrent();
-    ::glDeleteTextures(1, &m_texture);
-    if (m_attrs.antialias) {
-        ::glDeleteRenderbuffersEXT(1, &m_multisampleColorBuffer);
-        if (m_attrs.stencil || m_attrs.depth)
-            ::glDeleteRenderbuffersEXT(1, &m_multisampleDepthStencilBuffer);
-        ::glDeleteFramebuffersEXT(1, &m_multisampleFBO);
-    } else {
-        if (m_attrs.stencil || m_attrs.depth)
-            ::glDeleteRenderbuffersEXT(1, &m_depthStencilBuffer);
-    }
-    ::glDeleteFramebuffersEXT(1, &m_fbo);
-}
-
-bool GraphicsContext3D::makeContextCurrent()
-{
-    if (!m_private)
-        return false;
-    return m_private->makeContextCurrent();
-}
-
-PlatformGraphicsContext3D GraphicsContext3D::platformGraphicsContext3D()
-{
-    return m_private->m_context;
-}
-
-bool GraphicsContext3D::isGLES2Compliant() const
-{
-    return false;
-}
-
-}
-
-#endif // ENABLE(WEBGL)
diff --git a/Source/WebCore/platform/graphics/gtk/ImageGtk.cpp b/Source/WebCore/platform/graphics/gtk/ImageGtk.cpp
index 6e81e33a3..c5a5194d0 100644
--- a/Source/WebCore/platform/graphics/gtk/ImageGtk.cpp
+++ b/Source/WebCore/platform/graphics/gtk/ImageGtk.cpp
@@ -26,6 +26,7 @@
 #include "config.h"
 
 #include "BitmapImage.h"
+#include "FileSystem.h"
 #include "GdkCairoUtilities.h"
 #include "GOwnPtrGtk.h"
 #include "SharedBuffer.h"
@@ -33,63 +34,16 @@
 #include <cairo.h>
 #include <gtk/gtk.h>
 
-#if PLATFORM(WIN)
-#include <mbstring.h>
-#include <shlobj.h>
-
-static HMODULE hmodule;
-
-extern "C" {
-BOOL WINAPI DllMain(HINSTANCE hinstDLL, DWORD fdwReason, LPVOID lpvReserved)
-{
-    if (fdwReason == DLL_PROCESS_ATTACH)
-        hmodule = hinstDLL;
-    return TRUE;
-}
-}
-
-static char* getPathToImageResource(char* resource)
-{
-    static char* dataDirectory = 0;
-    if (!dataDirectory) {
-        dataDirectory = new char[PATH_MAX];
-        if (!GetModuleFileName(hmodule, static_cast<CHAR*>(dataDirectory), sizeof(dataDirectory) - 10))
-            dataDirectory = DATA_DIR;
-
-        // FIXME: This is pretty ugly. Ideally we should be using Windows API
-        // functions or GLib methods to calculate paths.
-        unsigned char *p;
-        p = _mbsrchr(static_cast<const unsigned char *>(dataDirectory), '\\');
-        *p = '\0';
-        p = _mbsrchr(static_cast<const unsigned char *>(dataDirectory), '\\');
-        if (p) {
-            if (!stricmp((const char *) (p+1), "bin"))
-                *p = '\0';
-        }
-        strcat(dataDirectory, "\\share\\webkitgtk-"WEBKITGTK_API_VERSION_STRING"\\images\\");
-    }
-
-    char* imageResourcePath = new char[PATH_MAX];
-    strcat(imageResourcePath, dataDirectory);
-    strcat(imageResourcePath, resource);
-
-    return imageResourcePath;
-}
-
-#else
+namespace WebCore {
 
 static char* getPathToImageResource(char* resource)
 {
     if (g_getenv("WEBKIT_TOP_LEVEL"))
         return g_build_filename(g_getenv("WEBKIT_TOP_LEVEL"), "Source", "WebCore", "Resources", resource, NULL);
 
-    return g_build_filename(DATA_DIR, "webkitgtk-"WEBKITGTK_API_VERSION_STRING, "images", resource, NULL);
+    return g_build_filename(sharedResourcesPath().data(), "images", resource, NULL);
 }
 
-#endif
-
-namespace WebCore {
-
 static CString getThemeIconFileName(const char* name, int size)
 {
     GtkIconInfo* iconInfo = gtk_icon_theme_lookup_icon(gtk_icon_theme_get_default(),
diff --git a/Source/WebCore/platform/graphics/harfbuzz/ComplexTextControllerHarfBuzz.cpp b/Source/WebCore/platform/graphics/harfbuzz/ComplexTextControllerHarfBuzz.cpp
index 9a36365b4..f244a94c2 100644
--- a/Source/WebCore/platform/graphics/harfbuzz/ComplexTextControllerHarfBuzz.cpp
+++ b/Source/WebCore/platform/graphics/harfbuzz/ComplexTextControllerHarfBuzz.cpp
@@ -52,35 +52,33 @@ static int truncateFixedPointToInteger(HB_Fixed value)
     return value >> 6;
 }
 
-ComplexTextController::ComplexTextController(const TextRun& run, int startingX, int startingY, unsigned wordSpacing, unsigned letterSpacing, unsigned padding, const Font* font)
-    : m_font(font)
-    , m_run(getNormalizedTextRun(run, m_normalizedRun, m_normalizedBuffer))
+ComplexTextController::ComplexTextController(const Font* font, const TextRun& run, int startingX, int startingY)
+    : HarfBuzzShaperBase(font, run)
 {
-    // Do not use |run| inside this constructor. Use |m_run| instead.
+    NormalizeMode mode = m_run.rtl() ? NormalizeMirrorChars : DoNotNormalizeMirrorChars;
+    setNormalizedBuffer(mode);
 
     memset(&m_item, 0, sizeof(m_item));
     // We cannot know, ahead of time, how many glyphs a given script run
     // will produce. We take a guess that script runs will not produce more
     // than twice as many glyphs as there are code points plus a bit of
     // padding and fallback if we find that we are wrong.
-    createGlyphArrays((m_run.length() + 2) * 2);
+    createGlyphArrays((m_normalizedBufferLength + 2) * 2);
 
-    m_item.log_clusters = new unsigned short[m_run.length()];
+    m_item.log_clusters = new unsigned short[m_normalizedBufferLength];
 
     m_item.face = 0;
     m_item.font = allocHarfbuzzFont();
 
     m_item.item.bidiLevel = m_run.rtl();
 
-    m_item.string = m_run.characters();
-    m_item.stringLength = m_run.length();
+    m_item.string = m_normalizedBuffer.get();
+    m_item.stringLength = m_normalizedBufferLength;
 
     reset(startingX);
     m_startingY = startingY;
 
-    setWordSpacingAdjustment(wordSpacing);
-    setLetterSpacingAdjustment(letterSpacing);
-    setPadding(padding);
+    setPadding(m_run.expansion());
 }
 
 ComplexTextController::~ComplexTextController()
@@ -90,59 +88,6 @@ ComplexTextController::~ComplexTextController()
     delete[] m_item.log_clusters;
 }
 
-bool ComplexTextController::isWordBreak(unsigned index)
-{
-    return index && isCodepointSpace(m_item.string[index]) && !isCodepointSpace(m_item.string[index - 1]);
-}
-
-int ComplexTextController::determineWordBreakSpacing(unsigned logClustersIndex)
-{
-    int wordBreakSpacing = 0;
-    // The first half of the conjunction works around the case where
-    // output glyphs aren't associated with any codepoints by the
-    // clusters log.
-    if (logClustersIndex < m_item.item.length
-        && isWordBreak(m_item.item.pos + logClustersIndex)) {
-        wordBreakSpacing = m_wordSpacingAdjustment;
-
-        if (m_padding > 0) {
-            int toPad = roundf(m_padPerWordBreak + m_padError);
-            m_padError += m_padPerWordBreak - toPad;
-
-            if (m_padding < toPad)
-                toPad = m_padding;
-            m_padding -= toPad;
-            wordBreakSpacing += toPad;
-        }
-    }
-    return wordBreakSpacing;
-}
-
-// setPadding sets a number of pixels to be distributed across the TextRun.
-// WebKit uses this to justify text.
-void ComplexTextController::setPadding(int padding)
-{
-    m_padding = padding;
-    m_padError = 0;
-    if (!m_padding)
-        return;
-
-    // If we have padding to distribute, then we try to give an equal
-    // amount to each space. The last space gets the smaller amount, if
-    // any.
-    unsigned numWordBreaks = 0;
-
-    for (unsigned i = 0; i < m_item.stringLength; i++) {
-        if (isWordBreak(i))
-            numWordBreaks++;
-    }
-
-    if (numWordBreaks)
-        m_padPerWordBreak = m_padding / numWordBreaks;
-    else
-        m_padPerWordBreak = 0;
-}
-
 void ComplexTextController::reset(int offset)
 {
     m_indexOfNextScriptRun = 0;
@@ -166,9 +111,9 @@ void ComplexTextController::setupForRTL()
 bool ComplexTextController::nextScriptRun()
 {
     // Ensure we're not pointing at the small caps buffer.
-    m_item.string = m_run.characters();
+    m_item.string = m_normalizedBuffer.get();
 
-    if (!hb_utf16_script_run_next(0, &m_item.item, m_run.characters(), m_run.length(), &m_indexOfNextScriptRun))
+    if (!hb_utf16_script_run_next(0, &m_item.item, m_normalizedBuffer.get(), m_normalizedBufferLength, &m_indexOfNextScriptRun))
         return false;
 
     // It is actually wrong to consider script runs at all in this code.
@@ -254,7 +199,7 @@ void ComplexTextController::setupFontForScriptRun()
     // case change while in small-caps mode always results in different
     // FontData, so we only need to check the first character's case.
     if (m_font->isSmallCaps() && u_islower(m_item.string[m_item.item.pos])) {
-        m_smallCapsString = String(m_run.data(m_item.item.pos), m_item.item.length);
+        m_smallCapsString = String(m_normalizedBuffer.get() + m_item.item.pos, m_item.item.length);
         m_smallCapsString.makeUpper();
         m_item.string = m_smallCapsString.characters();
         m_item.item.pos = 0;
@@ -346,16 +291,17 @@ void ComplexTextController::setGlyphPositions(bool isRTL)
 
     // logClustersIndex indexes logClusters for the first codepoint of the current glyph.
     // Each time we advance a glyph, we skip over all the codepoints that contributed to the current glyph.
-    int logClustersIndex = 0;
+    size_t logClustersIndex = 0;
 
     // Iterate through the glyphs in logical order, flipping for RTL where necessary.
     // Glyphs are positioned starting from m_offsetX; in RTL mode they go leftwards from there.
     for (size_t i = 0; i < m_item.num_glyphs; ++i) {
-        while (static_cast<unsigned>(logClustersIndex) < m_item.item.length && m_item.log_clusters[logClustersIndex] < i)
+        while (logClustersIndex < m_item.item.length && m_item.log_clusters[logClustersIndex] < i)
             logClustersIndex++;
 
         // If the current glyph is just after a space, add in the word spacing.
-        position += determineWordBreakSpacing(logClustersIndex);
+        if (logClustersIndex < m_item.item.length && isWordEnd(m_item.item.pos + logClustersIndex))
+            position += determineWordBreakSpacing();
 
         m_glyphs16[i] = m_item.glyphs[i];
         double offsetX = truncateFixedPointToInteger(m_item.offsets[i].x);
@@ -380,79 +326,6 @@ void ComplexTextController::setGlyphPositions(bool isRTL)
     m_offsetX += m_pixelWidth * rtlFlip;
 }
 
-void ComplexTextController::normalizeSpacesAndMirrorChars(const UChar* source, bool rtl, UChar* destination, int length)
-{
-    int position = 0;
-    bool error = false;
-    // Iterate characters in source and mirror character if needed.
-    while (position < length) {
-        UChar32 character;
-        int nextPosition = position;
-        U16_NEXT(source, nextPosition, length, character);
-        if (Font::treatAsSpace(character))
-            character = ' ';
-        else if (Font::treatAsZeroWidthSpace(character))
-            character = zeroWidthSpace;
-        else if (rtl)
-            character = u_charMirror(character);
-        U16_APPEND(destination, position, length, character, error);
-        ASSERT_UNUSED(error, !error);
-        position = nextPosition;
-    }
-}
-
-const TextRun& ComplexTextController::getNormalizedTextRun(const TextRun& originalRun, OwnPtr<TextRun>& normalizedRun, OwnArrayPtr<UChar>& normalizedBuffer)
-{
-    // Normalize the text run in three ways:
-    // 1) Convert the |originalRun| to NFC normalized form if combining diacritical marks
-    // (U+0300..) are used in the run. This conversion is necessary since most OpenType
-    // fonts (e.g., Arial) don't have substitution rules for the diacritical marks in
-    // their GSUB tables.
-    //
-    // Note that we don't use the icu::Normalizer::isNormalized(UNORM_NFC) API here since
-    // the API returns FALSE (= not normalized) for complex runs that don't require NFC
-    // normalization (e.g., Arabic text). Unless the run contains the diacritical marks,
-    // Harfbuzz will do the same thing for us using the GSUB table.
-    // 2) Convert spacing characters into plain spaces, as some fonts will provide glyphs
-    // for characters like '\n' otherwise.
-    // 3) Convert mirrored characters such as parenthesis for rtl text.
-
-    // Convert to NFC form if the text has diacritical marks.
-    icu::UnicodeString normalizedString;
-    UErrorCode error = U_ZERO_ERROR;
-
-    for (int i = 0; i < originalRun.length(); ++i) {
-        UChar ch = originalRun[i];
-        if (::ublock_getCode(ch) == UBLOCK_COMBINING_DIACRITICAL_MARKS) {
-            icu::Normalizer::normalize(icu::UnicodeString(originalRun.characters(),
-                                       originalRun.length()), UNORM_NFC, 0 /* no options */,
-                                       normalizedString, error);
-            if (U_FAILURE(error))
-                return originalRun;
-            break;
-        }
-    }
-
-    // Normalize space and mirror parenthesis for rtl text.
-    int normalizedBufferLength;
-    const UChar* sourceText;
-    if (normalizedString.isEmpty()) {
-        normalizedBufferLength = originalRun.length();
-        sourceText = originalRun.characters();
-    } else {
-        normalizedBufferLength = normalizedString.length();
-        sourceText = normalizedString.getBuffer();
-    }
-
-    normalizedBuffer = adoptArrayPtr(new UChar[normalizedBufferLength + 1]);
-
-    normalizeSpacesAndMirrorChars(sourceText, originalRun.rtl(), normalizedBuffer.get(), normalizedBufferLength);
-
-    normalizedRun = adoptPtr(new TextRun(originalRun));
-    normalizedRun->setText(normalizedBuffer.get(), normalizedBufferLength);
-    return *normalizedRun;
-}
-
 int ComplexTextController::glyphIndexForXPositionInScriptRun(int targetX) const
 {
     // Iterate through the glyphs in logical order, seeing whether targetX falls between the previous
diff --git a/Source/WebCore/platform/graphics/harfbuzz/ComplexTextControllerHarfBuzz.h b/Source/WebCore/platform/graphics/harfbuzz/ComplexTextControllerHarfBuzz.h
index fff36ebad..6288d408a 100644
--- a/Source/WebCore/platform/graphics/harfbuzz/ComplexTextControllerHarfBuzz.h
+++ b/Source/WebCore/platform/graphics/harfbuzz/ComplexTextControllerHarfBuzz.h
@@ -31,6 +31,7 @@
 #ifndef ComplexTextControllerHarfBuzz_h
 #define ComplexTextControllerHarfBuzz_h
 
+#include "HarfBuzzShaperBase.h"
 #include "HarfBuzzSkia.h"
 #include "SkPoint.h"
 #include "SkScalar.h"
@@ -63,32 +64,17 @@ class SimpleFontData;
 // Once you have setup the object, call |nextScriptRun| to get the first script
 // run. This will return false when the iteration is complete. At any time you
 // can call |reset| to start over again.
-class ComplexTextController {
+class ComplexTextController : public HarfBuzzShaperBase {
 public:
-    ComplexTextController(const TextRun&, int startingX, int startingY, unsigned wordSpacing, unsigned letterSpacing, unsigned padding, const Font*);
-    ~ComplexTextController();
-
-    bool isWordBreak(unsigned);
-    int determineWordBreakSpacing(unsigned);
-    // setPadding sets a number of pixels to be distributed across the TextRun.
-    // WebKit uses this to justify text.
-    void setPadding(int);
+    ComplexTextController(const Font*, const TextRun&, int startingX, int startingY);
+    virtual ~ComplexTextController();
+
     void reset(int offset);
     // Advance to the next script run, returning false when the end of the
     // TextRun has been reached.
     bool nextScriptRun();
     float widthOfFullRun();
 
-    // setWordSpacingAdjustment sets a delta (in pixels) which is applied at
-    // each word break in the TextRun.
-    void setWordSpacingAdjustment(int wordSpacingAdjustment) { m_wordSpacingAdjustment = wordSpacingAdjustment; }
-
-    // setLetterSpacingAdjustment sets an additional number of pixels that is
-    // added to the advance after each output cluster. This matches the behaviour
-    // of WidthIterator::advance.
-    void setLetterSpacingAdjustment(int letterSpacingAdjustment) { m_letterSpacing = letterSpacingAdjustment; }
-    int letterSpacing() const { return m_letterSpacing; }
-
     void setupForRTL();
     bool rtl() const { return m_run.rtl(); }
     const uint16_t* glyphs() const { return m_glyphs16; }
@@ -126,15 +112,8 @@ private:
     void shapeGlyphs();
     void setGlyphPositions(bool);
 
-    static void normalizeSpacesAndMirrorChars(const UChar* source, bool rtl, UChar* destination, int length);
-    static const TextRun& getNormalizedTextRun(const TextRun& originalRun, OwnPtr<TextRun>& normalizedRun, OwnArrayPtr<UChar>& normalizedBuffer);
-
-    // This matches the logic in RenderBlock::findNextLineBreak
-    static bool isCodepointSpace(HB_UChar16 c) { return c == ' ' || c == '\t'; }
-
     int glyphIndexForXPositionInScriptRun(int targetX) const;
 
-    const Font* const m_font;
     const SimpleFontData* m_currentFontData;
     HB_ShaperItem m_item;
     uint16_t* m_glyphs16; // A vector of 16-bit glyph ids.
@@ -145,17 +124,6 @@ private:
     unsigned m_pixelWidth; // Width (in px) of the current script run.
     unsigned m_glyphsArrayCapacity; // Current size of all the Harfbuzz arrays.
 
-    OwnPtr<TextRun> m_normalizedRun;
-    OwnArrayPtr<UChar> m_normalizedBuffer; // A buffer for normalized run.
-    const TextRun& m_run;
-    int m_wordSpacingAdjustment; // delta adjustment (pixels) for each word break.
-    float m_padding; // pixels to be distributed over the line at word breaks.
-    float m_padPerWordBreak; // pixels to be added to each word break.
-    float m_padError; // |m_padPerWordBreak| might have a fractional component.
-                      // Since we only add a whole number of padding pixels at
-                      // each word break we accumulate error. This is the
-                      // number of pixels that we are behind so far.
-    int m_letterSpacing; // pixels to be added after each glyph.
     String m_smallCapsString; // substring of m_run converted to small caps.
 };
 
diff --git a/Source/WebCore/platform/graphics/harfbuzz/FontHarfBuzz.cpp b/Source/WebCore/platform/graphics/harfbuzz/FontHarfBuzz.cpp
index ba8aa2e7d..03f6836c1 100644
--- a/Source/WebCore/platform/graphics/harfbuzz/FontHarfBuzz.cpp
+++ b/Source/WebCore/platform/graphics/harfbuzz/FontHarfBuzz.cpp
@@ -195,8 +195,7 @@ void Font::drawComplexText(GraphicsContext* gc, const TextRun& run,
         setupForTextPainting(&strokePaint, gc->strokeColor().rgb());
     }
 
-    ComplexTextController controller(run, point.x(), point.y(), wordSpacing(), letterSpacing(), run.expansion(), this);
-
+    ComplexTextController controller(this, run, point.x(), point.y());
     if (run.rtl())
         controller.setupForRTL();
 
@@ -228,7 +227,7 @@ void Font::drawEmphasisMarksForComplexText(GraphicsContext* /* context */, const
 
 float Font::floatWidthForComplexText(const TextRun& run, HashSet<const SimpleFontData*>* /* fallbackFonts */, GlyphOverflow* /* glyphOverflow */) const
 {
-    ComplexTextController controller(run, 0, 0, wordSpacing(), letterSpacing(), run.expansion(), this);
+    ComplexTextController controller(this, run, 0, 0);
     return controller.widthOfFullRun();
 }
 
@@ -242,7 +241,7 @@ int Font::offsetForPositionForComplexText(const TextRun& run, float xFloat,
 
     // (Mac code ignores includePartialGlyphs, and they don't know what it's
     // supposed to do, so we just ignore it as well.)
-    ComplexTextController controller(run, 0, 0, wordSpacing(), letterSpacing(), run.expansion(), this);
+    ComplexTextController controller(this, run, 0, 0);
     if (run.rtl())
         controller.setupForRTL();
     return controller.offsetForPosition(targetX);
@@ -253,7 +252,7 @@ FloatRect Font::selectionRectForComplexText(const TextRun& run,
                                             const FloatPoint& point, int height,
                                             int from, int to) const
 {
-    ComplexTextController controller(run, 0, 0, wordSpacing(), letterSpacing(), run.expansion(), this);
+    ComplexTextController controller(this, run, 0, 0);
     if (run.rtl())
         controller.setupForRTL();
     return controller.selectionRect(point, height, from, to);
diff --git a/Source/WebCore/platform/graphics/harfbuzz/HarfBuzzShaperBase.cpp b/Source/WebCore/platform/graphics/harfbuzz/HarfBuzzShaperBase.cpp
new file mode 100644
index 000000000..29c061238
--- /dev/null
+++ b/Source/WebCore/platform/graphics/harfbuzz/HarfBuzzShaperBase.cpp
@@ -0,0 +1,164 @@
+/*
+ * Copyright (c) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#include "HarfBuzzShaperBase.h"
+
+#include "Font.h"
+#include <unicode/normlzr.h>
+#include <unicode/uchar.h>
+#include <wtf/MathExtras.h>
+#include <wtf/unicode/Unicode.h>
+
+namespace WebCore {
+
+HarfBuzzShaperBase::HarfBuzzShaperBase(const Font* font, const TextRun& run)
+    : m_font(font)
+    , m_run(run)
+    , m_wordSpacingAdjustment(font->wordSpacing())
+    , m_letterSpacing(font->letterSpacing())
+{
+}
+
+static void normalizeSpacesAndMirrorChars(const UChar* source, UChar* destination, int length, HarfBuzzShaperBase::NormalizeMode normalizeMode)
+{
+    int position = 0;
+    bool error = false;
+    // Iterate characters in source and mirror character if needed.
+    while (position < length) {
+        UChar32 character;
+        int nextPosition = position;
+        U16_NEXT(source, nextPosition, length, character);
+        if (Font::treatAsSpace(character))
+            character = ' ';
+        else if (Font::treatAsZeroWidthSpace(character))
+            character = zeroWidthSpace;
+        else if (normalizeMode == HarfBuzzShaperBase::NormalizeMirrorChars)
+            character = u_charMirror(character);
+        U16_APPEND(destination, position, length, character, error);
+        ASSERT(!error);
+        position = nextPosition;
+    }
+}
+
+void HarfBuzzShaperBase::setNormalizedBuffer(NormalizeMode normalizeMode)
+{
+    // Normalize the text run in three ways:
+    // 1) Convert the |originalRun| to NFC normalized form if combining diacritical marks
+    // (U+0300..) are used in the run. This conversion is necessary since most OpenType
+    // fonts (e.g., Arial) don't have substitution rules for the diacritical marks in
+    // their GSUB tables.
+    //
+    // Note that we don't use the icu::Normalizer::isNormalized(UNORM_NFC) API here since
+    // the API returns FALSE (= not normalized) for complex runs that don't require NFC
+    // normalization (e.g., Arabic text). Unless the run contains the diacritical marks,
+    // HarfBuzz will do the same thing for us using the GSUB table.
+    // 2) Convert spacing characters into plain spaces, as some fonts will provide glyphs
+    // for characters like '\n' otherwise.
+    // 3) Convert mirrored characters such as parenthesis for rtl text.
+
+    // Convert to NFC form if the text has diacritical marks.
+    icu::UnicodeString normalizedString;
+    UErrorCode error = U_ZERO_ERROR;
+
+    for (int i = 0; i < m_run.length(); ++i) {
+        UChar ch = m_run[i];
+        if (::ublock_getCode(ch) == UBLOCK_COMBINING_DIACRITICAL_MARKS) {
+            icu::Normalizer::normalize(icu::UnicodeString(m_run.characters(),
+                                       m_run.length()), UNORM_NFC, 0 /* no options */,
+                                       normalizedString, error);
+            if (U_FAILURE(error))
+                normalizedString.remove();
+            break;
+        }
+    }
+
+    const UChar* sourceText;
+    if (normalizedString.isEmpty()) {
+        m_normalizedBufferLength = m_run.length();
+        sourceText = m_run.characters();
+    } else {
+        m_normalizedBufferLength = normalizedString.length();
+        sourceText = normalizedString.getBuffer();
+    }
+
+    m_normalizedBuffer = adoptArrayPtr(new UChar[m_normalizedBufferLength + 1]);
+    normalizeSpacesAndMirrorChars(sourceText, m_normalizedBuffer.get(), m_normalizedBufferLength, normalizeMode);
+}
+
+bool HarfBuzzShaperBase::isWordEnd(unsigned index)
+{
+    // This could refer a high-surrogate, but should work.
+    return index && isCodepointSpace(m_normalizedBuffer[index]) && !isCodepointSpace(m_normalizedBuffer[index - 1]);
+}
+
+int HarfBuzzShaperBase::determineWordBreakSpacing()
+{
+    int wordBreakSpacing = m_wordSpacingAdjustment;
+
+    if (m_padding > 0) {
+        int toPad = roundf(m_padPerWordBreak + m_padError);
+        m_padError += m_padPerWordBreak - toPad;
+
+        if (m_padding < toPad)
+            toPad = m_padding;
+        m_padding -= toPad;
+        wordBreakSpacing += toPad;
+    }
+    return wordBreakSpacing;
+}
+
+// setPadding sets a number of pixels to be distributed across the TextRun.
+// WebKit uses this to justify text.
+void HarfBuzzShaperBase::setPadding(int padding)
+{
+    m_padding = padding;
+    m_padError = 0;
+    if (!m_padding)
+        return;
+
+    // If we have padding to distribute, then we try to give an equal
+    // amount to each space. The last space gets the smaller amount, if
+    // any.
+    unsigned numWordEnds = 0;
+
+    for (unsigned i = 0; i < m_normalizedBufferLength; i++) {
+        if (isWordEnd(i))
+            numWordEnds++;
+    }
+
+    if (numWordEnds)
+        m_padPerWordBreak = m_padding / numWordEnds;
+    else
+        m_padPerWordBreak = 0;
+}
+
+} // namespace WebCore
diff --git a/Source/WebCore/platform/graphics/harfbuzz/HarfBuzzShaperBase.h b/Source/WebCore/platform/graphics/harfbuzz/HarfBuzzShaperBase.h
new file mode 100644
index 000000000..67bcadbff
--- /dev/null
+++ b/Source/WebCore/platform/graphics/harfbuzz/HarfBuzzShaperBase.h
@@ -0,0 +1,80 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef HarfBuzzShaperBase_h
+#define HarfBuzzShaperBase_h
+
+#include "TextRun.h"
+#include <wtf/OwnArrayPtr.h>
+
+namespace WebCore {
+
+class Font;
+
+class HarfBuzzShaperBase {
+public:
+    enum NormalizeMode {
+        DoNotNormalizeMirrorChars,
+        NormalizeMirrorChars
+    };
+
+    HarfBuzzShaperBase(const Font*, const TextRun&);
+    virtual ~HarfBuzzShaperBase() { }
+
+protected:
+    void setNormalizedBuffer(NormalizeMode = DoNotNormalizeMirrorChars);
+
+    bool isWordEnd(unsigned);
+    int determineWordBreakSpacing();
+    // setPadding sets a number of pixels to be distributed across the TextRun.
+    // WebKit uses this to justify text.
+    void setPadding(int);
+
+    // This matches the logic in RenderBlock::findNextLineBreak
+    static bool isCodepointSpace(UChar c) { return c == ' ' || c == '\t'; }
+
+    const Font* m_font;
+    OwnArrayPtr<UChar> m_normalizedBuffer;
+    unsigned m_normalizedBufferLength;
+    const TextRun& m_run;
+
+    int m_wordSpacingAdjustment; // delta adjustment (pixels) for each word break.
+    float m_padding; // pixels to be distributed over the line at word breaks.
+    float m_padPerWordBreak; // pixels to be added to each word break.
+    float m_padError; // |m_padPerWordBreak| might have a fractional component.
+                      // Since we only add a whole number of padding pixels at
+                      // each word break we accumulate error. This is the
+                      // number of pixels that we are behind so far.
+    int m_letterSpacing; // pixels to be added after each glyph.
+};
+
+} // namespace WebCore
+
+#endif // HarfBuzzShaperBase_h
diff --git a/Source/WebCore/platform/graphics/opengl/Extensions3DOpenGL.cpp b/Source/WebCore/platform/graphics/opengl/Extensions3DOpenGL.cpp
index 67d42ba86..b6410f61c 100644
--- a/Source/WebCore/platform/graphics/opengl/Extensions3DOpenGL.cpp
+++ b/Source/WebCore/platform/graphics/opengl/Extensions3DOpenGL.cpp
@@ -35,10 +35,8 @@
 #if PLATFORM(MAC)
 #include "ANGLE/ShaderLang.h"
 #include <OpenGL/gl.h>
-#elif PLATFORM(GTK) || PLATFORM(EFL)
+#elif PLATFORM(GTK) || PLATFORM(EFL) || PLATFORM(QT)
 #include "OpenGLShims.h"
-#elif PLATFORM(QT)
-#include <cairo/OpenGLShims.h>
 #endif
 
 namespace WebCore {
diff --git a/Source/WebCore/platform/graphics/opengl/GraphicsContext3DOpenGL.cpp b/Source/WebCore/platform/graphics/opengl/GraphicsContext3DOpenGL.cpp
index 8b4d9d49a..8c002facc 100644
--- a/Source/WebCore/platform/graphics/opengl/GraphicsContext3DOpenGL.cpp
+++ b/Source/WebCore/platform/graphics/opengl/GraphicsContext3DOpenGL.cpp
@@ -36,11 +36,8 @@
 
 #if PLATFORM(MAC)
 #include <OpenGL/gl.h>
-#elif PLATFORM(GTK) || PLATFORM(EFL)
+#elif PLATFORM(GTK) || PLATFORM(EFL) || PLATFORM(QT)
 #include "OpenGLShims.h"
-#elif PLATFORM(QT)
-#include <QtGlobal>
-#include <cairo/OpenGLShims.h>
 #endif
 
 namespace WebCore {
diff --git a/Source/WebCore/platform/graphics/opengl/GraphicsContext3DOpenGLCommon.cpp b/Source/WebCore/platform/graphics/opengl/GraphicsContext3DOpenGLCommon.cpp
index cf9d8f615..03d4a32cc 100644
--- a/Source/WebCore/platform/graphics/opengl/GraphicsContext3DOpenGLCommon.cpp
+++ b/Source/WebCore/platform/graphics/opengl/GraphicsContext3DOpenGLCommon.cpp
@@ -51,11 +51,8 @@
 
 #if PLATFORM(MAC)
 #include <OpenGL/gl.h>
-#elif PLATFORM(GTK) || PLATFORM(EFL)
+#elif PLATFORM(GTK) || PLATFORM(EFL) || PLATFORM(QT)
 #include "OpenGLShims.h"
-#elif PLATFORM(QT)
-#include <QtGlobal>
-#include <cairo/OpenGLShims.h>
 #endif
 
 namespace WebCore {
@@ -111,7 +108,6 @@ bool GraphicsContext3D::isResourceSafe()
     return false;
 }
 
-#if !PLATFORM(QT)
 void GraphicsContext3D::paintRenderingResultsToCanvas(CanvasRenderingContext* context, DrawingBuffer*)
 {
     HTMLCanvasElement* canvas = context->canvas();
@@ -138,7 +134,6 @@ void GraphicsContext3D::paintRenderingResultsToCanvas(CanvasRenderingContext* co
     paintToCanvas(pixels.get(), m_currentWidth, m_currentHeight,
                   canvas->width(), canvas->height(), imageBuffer->context()->platformContext());
 }
-#endif
 
 bool GraphicsContext3D::paintCompositedResultsToCanvas(CanvasRenderingContext*)
 {
diff --git a/Source/WebCore/platform/graphics/pango/FontPango.cpp b/Source/WebCore/platform/graphics/pango/FontPango.cpp
index 2684f53f4..0c60c767c 100644
--- a/Source/WebCore/platform/graphics/pango/FontPango.cpp
+++ b/Source/WebCore/platform/graphics/pango/FontPango.cpp
@@ -136,7 +136,7 @@ static gchar* utf16ToUtf8(const UChar* aText, gint aLength, gint &length)
 
     gchar* utf8Text;
     glong itemsWritten;
-    utf8Text = g_utf16_to_utf8(static_cast<const gunichar2*>(aText), aLength, 0, &itemsWritten, 0);
+    utf8Text = g_utf16_to_utf8(reinterpret_cast<const gunichar2*>(aText), aLength, 0, &itemsWritten, 0);
     length = itemsWritten;
 
     return utf8Text;
diff --git a/Source/WebCore/platform/graphics/qt/Extensions3DQt.cpp b/Source/WebCore/platform/graphics/qt/Extensions3DQt.cpp
index be786015a..27c8366ef 100644
--- a/Source/WebCore/platform/graphics/qt/Extensions3DQt.cpp
+++ b/Source/WebCore/platform/graphics/qt/Extensions3DQt.cpp
@@ -30,7 +30,7 @@
 #include "Extensions3DQt.h"
 
 #include "GraphicsContext3D.h"
-#include <QGLContext>
+#include "OpenGLShims.h"
 
 namespace WebCore {
 
diff --git a/Source/WebCore/platform/graphics/qt/GraphicsContext3DQt.cpp b/Source/WebCore/platform/graphics/qt/GraphicsContext3DQt.cpp
index 66bc76e81..80591e9c4 100644
--- a/Source/WebCore/platform/graphics/qt/GraphicsContext3DQt.cpp
+++ b/Source/WebCore/platform/graphics/qt/GraphicsContext3DQt.cpp
@@ -21,7 +21,6 @@
 #include "GraphicsContext3D.h"
 
 #include "WebGLObject.h"
-#include <cairo/OpenGLShims.h>
 #include "CanvasRenderingContext.h"
 #if defined(QT_OPENGL_ES_2)
 #include "Extensions3DQt.h"
@@ -34,17 +33,14 @@
 #include "ImageBuffer.h"
 #include "ImageData.h"
 #include "NotImplemented.h"
+#include "OpenGLShims.h"
 #include "QWebPageClient.h"
 #include "SharedBuffer.h"
-#include <QAbstractScrollArea>
-#include <QGraphicsObject>
-#include <QGLContext>
-#include <QStyleOptionGraphicsItem>
 #include <wtf/UnusedParam.h>
 #include <wtf/text/CString.h>
 
 #if USE(ACCELERATED_COMPOSITING) && USE(TEXTURE_MAPPER) && USE(TEXTURE_MAPPER_GL)
-#include <opengl/TextureMapperGL.h>
+#include <texmap/TextureMapperGL.h>
 #endif
 
 #if ENABLE(WEBGL)
@@ -60,24 +56,18 @@ typedef char GLchar;
 #endif
 
 class GraphicsContext3DPrivate
-#if USE(ACCELERATED_COMPOSITING)
-#if USE(TEXTURE_MAPPER)
+#if USE(ACCELERATED_COMPOSITING) && USE(TEXTURE_MAPPER)
         : public TextureMapperPlatformLayer
-#else
-        : public QGraphicsObject
-#endif
 #endif
 {
 public:
     GraphicsContext3DPrivate(GraphicsContext3D*, HostWindow*);
     ~GraphicsContext3DPrivate();
 
-    QGLWidget* getViewportGLWidget();
 #if USE(ACCELERATED_COMPOSITING) && USE(TEXTURE_MAPPER)
-    virtual void paintToTextureMapper(TextureMapper*, const FloatRect& target, const TransformationMatrix&, float opacity, BitmapTexture* mask) const;
+    virtual void paintToTextureMapper(TextureMapper*, const FloatRect& target, const TransformationMatrix&, float opacity, BitmapTexture* mask);
 #endif
 
-    void paint(QPainter*, const QStyleOptionGraphicsItem*, QWidget*);
     QRectF boundingRect() const;
     void blitMultisampleFramebuffer() const;
     void blitMultisampleFramebufferAndRestoreContext() const;
@@ -85,8 +75,8 @@ public:
 
     GraphicsContext3D* m_context;
     HostWindow* m_hostWindow;
-    QGLWidget* m_glWidget;
-    QGLWidget* m_viewportGLWidget;
+    PlatformGraphicsSurface3D m_surface;
+    PlatformGraphicsContext3D m_platformContext;
 };
 
 bool GraphicsContext3D::isGLES2Compliant() const
@@ -101,39 +91,24 @@ bool GraphicsContext3D::isGLES2Compliant() const
 GraphicsContext3DPrivate::GraphicsContext3DPrivate(GraphicsContext3D* context, HostWindow* hostWindow)
     : m_context(context)
     , m_hostWindow(hostWindow)
-    , m_glWidget(0)
-    , m_viewportGLWidget(0)
+    , m_surface(0)
+    , m_platformContext(0)
 {
-    m_viewportGLWidget = getViewportGLWidget();
-
-    if (m_viewportGLWidget)
-        m_glWidget = new QGLWidget(0, m_viewportGLWidget);
-    else
-        m_glWidget = new QGLWidget();
-
-    // Geometry can be set to zero because m_glWidget is used only for its QGLContext.
-    m_glWidget->setGeometry(0, 0, 0, 0);
-
+    QWebPageClient* webPageClient = m_hostWindow->platformPageClient();
+    if (!webPageClient)
+        return;
+    webPageClient->createPlatformGraphicsContext3D(&m_platformContext, &m_surface);
+    if (!m_surface)
+        return;
     makeCurrentIfNeeded();
 }
 
 GraphicsContext3DPrivate::~GraphicsContext3DPrivate()
 {
-    delete m_glWidget;
-    m_glWidget = 0;
-}
-
-QGLWidget* GraphicsContext3DPrivate::getViewportGLWidget()
-{
-    QWebPageClient* webPageClient = m_hostWindow->platformPageClient();
-    if (!webPageClient)
-        return 0;
-
-    QAbstractScrollArea* scrollArea = qobject_cast<QAbstractScrollArea*>(webPageClient->ownerWidget());
-    if (scrollArea)
-        return qobject_cast<QGLWidget*>(scrollArea->viewport());
-
-    return 0;
+    delete m_surface;
+    m_surface = 0;
+    // Platform context is assumed to be owned by surface.
+    m_platformContext = 0;
 }
 
 static inline quint32 swapBgrToRgb(quint32 pixel)
@@ -142,13 +117,14 @@ static inline quint32 swapBgrToRgb(quint32 pixel)
 }
 
 #if USE(ACCELERATED_COMPOSITING) && USE(TEXTURE_MAPPER)
-void GraphicsContext3DPrivate::paintToTextureMapper(TextureMapper* textureMapper, const FloatRect& targetRect, const TransformationMatrix& matrix, float opacity, BitmapTexture* mask) const
+void GraphicsContext3DPrivate::paintToTextureMapper(TextureMapper* textureMapper, const FloatRect& targetRect, const TransformationMatrix& matrix, float opacity, BitmapTexture* mask)
 {
     blitMultisampleFramebufferAndRestoreContext();
 
     if (textureMapper->accelerationMode() == TextureMapper::OpenGLMode) {
         TextureMapperGL* texmapGL = static_cast<TextureMapperGL*>(textureMapper);
-        texmapGL->drawTexture(m_context->m_texture, !m_context->m_attrs.alpha, FloatSize(1, 1), targetRect, matrix, opacity, mask, true /* flip */);
+        TextureMapperGL::Flags flags = TextureMapperGL::ShouldFlipTexture | (m_context->m_attrs.alpha ? TextureMapperGL::SupportsBlending : 0);
+        texmapGL->drawTexture(m_context->m_texture, flags, FloatSize(1, 1), targetRect, matrix, opacity, mask);
         return;
     }
 
@@ -202,58 +178,6 @@ QRectF GraphicsContext3DPrivate::boundingRect() const
     return QRectF(QPointF(0, 0), QSizeF(m_context->m_currentWidth, m_context->m_currentHeight));
 }
 
-void GraphicsContext3DPrivate::paint(QPainter* painter, const QStyleOptionGraphicsItem* option, QWidget* widget)
-{
-    Q_UNUSED(widget);
-
-    QRectF rect = option ? option->rect : boundingRect();
-
-    makeCurrentIfNeeded();
-    blitMultisampleFramebuffer();
-
-    // Use direct texture mapping if WebGL canvas has a shared OpenGL context
-    // with browsers OpenGL context.
-    QGLWidget* viewportGLWidget = getViewportGLWidget();
-    if (viewportGLWidget && viewportGLWidget == m_viewportGLWidget && viewportGLWidget == painter->device()) {
-        viewportGLWidget->drawTexture(rect, m_context->m_texture);
-        return;
-    }
-
-    // Alternatively read pixels to a memory buffer.
-    QImage offscreenImage(rect.width(), rect.height(), QImage::Format_ARGB32);
-    quint32* imagePixels = reinterpret_cast<quint32*>(offscreenImage.bits());
-
-    glBindFramebuffer(GraphicsContext3D::FRAMEBUFFER, m_context->m_fbo);
-    glReadPixels(/* x */ 0, /* y */ 0, rect.width(), rect.height(), GraphicsContext3D::RGBA, GraphicsContext3D::UNSIGNED_BYTE, imagePixels);
-    glBindFramebuffer(GraphicsContext3D::FRAMEBUFFER, m_context->m_boundFBO);
-
-    // OpenGL gives us ABGR on 32 bits, and with the origin at the bottom left
-    // We need RGB32 or ARGB32_PM, with the origin at the top left.
-    quint32* pixelsSrc = imagePixels;
-    const int height = static_cast<int>(rect.height());
-    const int width = static_cast<int>(rect.width());
-    const int halfHeight = height / 2;
-    for (int row = 0; row < halfHeight; ++row) {
-        const int targetIdx = (height - 1 - row) * width;
-        quint32* pixelsDst = imagePixels + targetIdx;
-        for (int column = 0; column < width; ++column) {
-            quint32 tempPixel = *pixelsSrc;
-            *pixelsSrc = swapBgrToRgb(*pixelsDst);
-            *pixelsDst = swapBgrToRgb(tempPixel);
-            ++pixelsSrc;
-            ++pixelsDst;
-        }
-    }
-    if (static_cast<int>(height) % 2) {
-        for (int column = 0; column < width; ++column) {
-            *pixelsSrc = swapBgrToRgb(*pixelsSrc);
-            ++pixelsSrc;
-        }
-    }
-
-    painter->drawImage(/* x */ 0, /* y */ 0, offscreenImage);
-}
-
 void GraphicsContext3DPrivate::blitMultisampleFramebuffer() const
 {
     if (!m_context->m_attrs.antialias)
@@ -269,26 +193,45 @@ void GraphicsContext3DPrivate::blitMultisampleFramebufferAndRestoreContext() con
     if (!m_context->m_attrs.antialias)
         return;
 
+#if QT_VERSION >= QT_VERSION_CHECK(5, 0, 0)
+    const QOpenGLContext* currentContext = QOpenGLContext::currentContext();
+    QSurface* currentSurface = 0;
+    if (currentContext != m_platformContext) {
+        currentSurface = currentContext->surface();
+        m_platformContext->makeCurrent(m_surface);
+    }
+    blitMultisampleFramebuffer();
+    if (currentSurface)
+        const_cast<QOpenGLContext*>(currentContext)->makeCurrent(currentSurface);
+#else
     const QGLContext* currentContext = QGLContext::currentContext();
-    const QGLContext* widgetContext = m_glWidget->context();
+    const QGLContext* widgetContext = m_surface->context();
     if (currentContext != widgetContext)
-        m_glWidget->makeCurrent();
+        m_surface->makeCurrent();
     blitMultisampleFramebuffer();
     if (currentContext) {
         if (currentContext != widgetContext)
             const_cast<QGLContext*>(currentContext)->makeCurrent();
     } else
-        m_glWidget->doneCurrent();
+        m_surface->doneCurrent();
+#endif
 }
 
 bool GraphicsContext3DPrivate::makeCurrentIfNeeded() const
 {
+#if QT_VERSION >= QT_VERSION_CHECK(5, 0, 0)
+    const QOpenGLContext* currentContext = QOpenGLContext::currentContext();
+    if (currentContext == m_platformContext)
+        return true;
+    return m_platformContext->makeCurrent(m_surface);
+#else
     const QGLContext* currentContext = QGLContext::currentContext();
-    const QGLContext* widgetContext = m_glWidget->context();
+    const QGLContext* widgetContext = m_surface->context();
     if (currentContext != widgetContext)
-        m_glWidget->makeCurrent();
+        m_surface->makeCurrent();
 
     return QGLContext::currentContext() == widgetContext;
+#endif
 }
 
 PassRefPtr<GraphicsContext3D> GraphicsContext3D::create(GraphicsContext3D::Attributes attrs, HostWindow* hostWindow, GraphicsContext3D::RenderStyle renderStyle)
@@ -327,7 +270,7 @@ GraphicsContext3D::GraphicsContext3D(GraphicsContext3D::Attributes attrs, HostWi
     validateAttributes();
 #endif
 
-    if (!m_private->m_glWidget->isValid()) {
+    if (!m_private->m_surface) {
         LOG_ERROR("GraphicsContext3D: QGLWidget initialization failed.");
         m_private = nullptr;
         return;
@@ -405,8 +348,6 @@ GraphicsContext3D::GraphicsContext3D(GraphicsContext3D::Attributes attrs, HostWi
 GraphicsContext3D::~GraphicsContext3D()
 {
     makeContextCurrent();
-    if (!m_private->m_glWidget->isValid())
-        return;
     glDeleteTextures(1, &m_texture);
     glDeleteFramebuffers(1, &m_fbo);
     if (m_attrs.antialias) {
@@ -428,7 +369,7 @@ GraphicsContext3D::~GraphicsContext3D()
 
 PlatformGraphicsContext3D GraphicsContext3D::platformGraphicsContext3D()
 {
-    return m_private->m_glWidget;
+    return m_private->m_platformContext;
 }
 
 Platform3DObject GraphicsContext3D::platformTexture() const
@@ -448,13 +389,16 @@ bool GraphicsContext3D::makeContextCurrent()
     return m_private->makeCurrentIfNeeded();
 }
 
-void GraphicsContext3D::paintRenderingResultsToCanvas(CanvasRenderingContext* context, DrawingBuffer*)
+void GraphicsContext3D::paintToCanvas(const unsigned char* imagePixels, int imageWidth, int imageHeight,
+                                      int canvasWidth, int canvasHeight, QPainter* context)
 {
-    makeContextCurrent();
-    HTMLCanvasElement* canvas = context->canvas();
-    ImageBuffer* imageBuffer = canvas->buffer();
-    QPainter* painter = imageBuffer->context()->platformContext();
-    m_private->paint(painter, 0, 0);
+    QImage image(imagePixels, imageWidth, imageHeight, QImage::Format_ARGB32_Premultiplied);
+    context->save();
+    context->translate(0, imageHeight);
+    context->scale(1, -1);
+    context->setCompositionMode(QPainter::CompositionMode_Source);
+    context->drawImage(QRect(0, 0, canvasWidth, -canvasHeight), image);
+    context->restore();
 }
 
 #if defined(QT_OPENGL_ES_2)
diff --git a/Source/WebCore/platform/graphics/qt/GraphicsContextQt.cpp b/Source/WebCore/platform/graphics/qt/GraphicsContextQt.cpp
index 90079ee30..d07d732b4 100644
--- a/Source/WebCore/platform/graphics/qt/GraphicsContextQt.cpp
+++ b/Source/WebCore/platform/graphics/qt/GraphicsContextQt.cpp
@@ -301,7 +301,7 @@ void GraphicsContext::restorePlatformState()
 {
     if (!m_data->layers.isEmpty() && !m_data->layers.top()->alphaMask.isNull())
         if (!--m_data->layers.top()->saveCounter)
-            endTransparencyLayer();
+            endPlatformTransparencyLayer();
 
     m_data->p()->restore();
 
diff --git a/Source/WebCore/platform/graphics/qt/IconQt.cpp b/Source/WebCore/platform/graphics/qt/IconQt.cpp
index eb09eda6b..7d2613fbd 100644
--- a/Source/WebCore/platform/graphics/qt/IconQt.cpp
+++ b/Source/WebCore/platform/graphics/qt/IconQt.cpp
@@ -22,13 +22,10 @@
 #include "Icon.h"
 
 #include "GraphicsContext.h"
-#include "PlatformString.h"
 #include "IntRect.h"
+#include "NotImplemented.h"
+#include "PlatformString.h"
 
-#include <qpainter.h>
-#include <qpixmap.h>
-#include <qrect.h>
-#include <qglobal.h>
 
 namespace WebCore {
 
@@ -41,27 +38,16 @@ Icon::~Icon()
 }
 
 // FIXME: Move the code to ChromeClient::iconForFiles().
-PassRefPtr<Icon> Icon::createIconForFiles(const Vector<String>& filenames)
+PassRefPtr<Icon> Icon::createIconForFiles(const Vector<String>&)
 {
-    if (filenames.isEmpty())
-        return 0;
-
-    if (filenames.size() == 1) {
-        RefPtr<Icon> i = adoptRef(new Icon);
-        i->m_icon = QIcon(filenames[0]);
-        return i.release();
-    }
-
-    //FIXME: Implement this
+    // FIXME: Should use QMimeType in Qt 5.
+    notImplemented();
     return 0;
 }
 
-void Icon::paint(GraphicsContext* ctx, const IntRect& rect)
+void Icon::paint(GraphicsContext*, const IntRect&)
 {
-    QPixmap px = m_icon.pixmap(rect.size());
-    QPainter *p = static_cast<QPainter*>(ctx->platformContext());
-    if (p && !px.isNull())
-        p->drawPixmap(rect.x(), rect.y(), px);
+    notImplemented();
 }
 
 }
diff --git a/Source/WebCore/platform/graphics/qt/ImageQt.cpp b/Source/WebCore/platform/graphics/qt/ImageQt.cpp
index fa78e01be..eb4be2d4a 100644
--- a/Source/WebCore/platform/graphics/qt/ImageQt.cpp
+++ b/Source/WebCore/platform/graphics/qt/ImageQt.cpp
@@ -41,13 +41,12 @@
 #include "ShadowBlur.h"
 #include "StillImageQt.h"
 
-#include <QApplication>
+#include <QCoreApplication>
 #include <QDebug>
 #include <QImage>
 #include <QImageReader>
 #include <QPainter>
 #include <QPixmap>
-#include <QStyle>
 #include <QTransform>
 
 #include <math.h>
@@ -81,10 +80,6 @@ static WebGraphicHash* graphics()
         hash->insert("deleteButton", QPixmap(QLatin1String(":webkit/resources/deleteButton.png")));
         // QWebSettings::InputSpeechButtonGraphic
         hash->insert("inputSpeech", QPixmap(QLatin1String(":webkit/resources/inputSpeech.png")));
-        // QWebSettings::SearchCancelButtonGraphic
-        hash->insert("searchCancelButton", QApplication::style()->standardPixmap(QStyle::SP_DialogCloseButton));
-        // QWebSettings::SearchCancelButtonPressedGraphic
-        hash->insert("searchCancelButtonPressed", QApplication::style()->standardPixmap(QStyle::SP_DialogCloseButton));
     }
 
     return hash;
diff --git a/Source/WebCore/platform/graphics/qt/SimpleFontDataQt.cpp b/Source/WebCore/platform/graphics/qt/SimpleFontDataQt.cpp
index e95b8c5ea..827e1346e 100644
--- a/Source/WebCore/platform/graphics/qt/SimpleFontDataQt.cpp
+++ b/Source/WebCore/platform/graphics/qt/SimpleFontDataQt.cpp
@@ -148,9 +148,11 @@ void SimpleFontData::platformInit()
     float spaceWidth = fm.width(QLatin1Char(' '));
 #endif
 
+#if QT_VERSION < QT_VERSION_CHECK(5, 0, 0)
     // Qt subtracts 1 from the descent to account for the baseline,
     // we add it back here to get correct metrics for WebKit.
     descent += 1;
+#endif
 
     // The line spacing should always be >= (ascent + descent), but this
     // may be false in some cases due to misbehaving platform libraries.
diff --git a/Source/WebCore/platform/graphics/skia/FontSkia.cpp b/Source/WebCore/platform/graphics/skia/FontSkia.cpp
index da3e49470..4980526b7 100644
--- a/Source/WebCore/platform/graphics/skia/FontSkia.cpp
+++ b/Source/WebCore/platform/graphics/skia/FontSkia.cpp
@@ -159,7 +159,6 @@ void Font::drawGlyphs(GraphicsContext* gc, const SimpleFontData* font,
         setupPaint(&paint, font, this, shouldAntialias, shouldSmoothFonts);
         adjustTextRenderMode(&paint, gc->platformContext());
         paint.setTextEncoding(SkPaint::kGlyphID_TextEncoding);
-        paint.setColor(gc->fillColor().rgb());
 
         canvas->drawPosText(glyphs, numGlyphs * sizeof(uint16_t), pos, paint);
     }
@@ -173,7 +172,6 @@ void Font::drawGlyphs(GraphicsContext* gc, const SimpleFontData* font,
         setupPaint(&paint, font, this, shouldAntialias, shouldSmoothFonts);
         adjustTextRenderMode(&paint, gc->platformContext());
         paint.setTextEncoding(SkPaint::kGlyphID_TextEncoding);
-        paint.setColor(gc->strokeColor().rgb());
 
         if (textMode & TextModeFill) {
             // If we also filled, we don't want to draw shadows twice.
diff --git a/Source/WebCore/platform/graphics/skia/OpaqueRegionSkia.cpp b/Source/WebCore/platform/graphics/skia/OpaqueRegionSkia.cpp
index 30b8a3805..21facaadb 100644
--- a/Source/WebCore/platform/graphics/skia/OpaqueRegionSkia.cpp
+++ b/Source/WebCore/platform/graphics/skia/OpaqueRegionSkia.cpp
@@ -235,7 +235,12 @@ void OpaqueRegionSkia::didDraw(const PlatformContextSkia* context, const AffineT
 {
     SkRect targetRect = rect;
 
-    // Apply the current clip.
+    // Apply the transform to device coordinate space.
+    SkMatrix canvasTransform = context->canvas()->getTotalMatrix();
+    if (!canvasTransform.mapRect(&targetRect))
+        fillsBounds = false;
+
+    // Apply the current clip in device coordinate space.
     if (context->canvas()->getClipType() != SkCanvas::kRect_ClipType)
         fillsBounds = false;
     else {
@@ -247,10 +252,7 @@ void OpaqueRegionSkia::didDraw(const PlatformContextSkia* context, const AffineT
     if (!context->clippedToImage().isOpaque())
         fillsBounds = false;
 
-    // Apply the transforms.
-    SkMatrix canvasTransform = context->canvas()->getTotalMatrix();
-    if (!canvasTransform.mapRect(&targetRect))
-        fillsBounds = false;
+    // Apply the transform to the tracking space.
     SkMatrix canvasToTargetTransform = transform;
     if (!canvasToTargetTransform.mapRect(&targetRect))
         fillsBounds = false;
diff --git a/Source/WebCore/platform/graphics/skia/PlatformContextSkia.cpp b/Source/WebCore/platform/graphics/skia/PlatformContextSkia.cpp
index c323a0d7e..3a677e2b0 100644
--- a/Source/WebCore/platform/graphics/skia/PlatformContextSkia.cpp
+++ b/Source/WebCore/platform/graphics/skia/PlatformContextSkia.cpp
@@ -52,6 +52,10 @@
 #include <wtf/MathExtras.h>
 #include <wtf/Vector.h>
 
+#if PLATFORM(CHROMIUM)
+#include "TraceEvent.h"
+#endif
+
 namespace WebCore {
 
 // State -----------------------------------------------------------------------
@@ -551,6 +555,9 @@ void PlatformContextSkia::paintSkPaint(const SkRect& rect,
 
 const SkBitmap* PlatformContextSkia::bitmap() const
 {
+#if PLATFORM(CHROMIUM)
+    TRACE_EVENT("PlatformContextSkia::bitmap", this, 0);
+#endif
     return &m_canvas->getDevice()->accessBitmap(false);
 }
 
diff --git a/Source/WebCore/platform/graphics/texmap/GraphicsLayerTextureMapper.cpp b/Source/WebCore/platform/graphics/texmap/GraphicsLayerTextureMapper.cpp
index b521d1a21..46169c672 100644
--- a/Source/WebCore/platform/graphics/texmap/GraphicsLayerTextureMapper.cpp
+++ b/Source/WebCore/platform/graphics/texmap/GraphicsLayerTextureMapper.cpp
@@ -20,19 +20,21 @@
 #include "config.h"
 #include "GraphicsLayerTextureMapper.h"
 
-#include "TextureMapperNode.h"
+#include "TextureMapperLayer.h"
 
 namespace WebCore {
 
 GraphicsLayerTextureMapper::GraphicsLayerTextureMapper(GraphicsLayerClient* client)
     : GraphicsLayer(client)
-    , m_node(adoptPtr(new TextureMapperNode()))
+    , m_layer(adoptPtr(new TextureMapperLayer()))
     , m_changeMask(0)
+    , m_needsDisplay(false)
+    , m_contentsLayer(0)
     , m_animationStartedTimer(this, &GraphicsLayerTextureMapper::animationStartedTimerFired)
 {
 }
 
-void GraphicsLayerTextureMapper::notifyChange(TextureMapperNode::ChangeMask changeMask)
+void GraphicsLayerTextureMapper::notifyChange(TextureMapperLayer::ChangeMask changeMask)
 {
     m_changeMask |= changeMask;
     if (!client())
@@ -44,8 +46,8 @@ void GraphicsLayerTextureMapper::didSynchronize()
 {
     m_syncQueued = false;
     m_changeMask = 0;
-    m_pendingContent.needsDisplay = false;
-    m_pendingContent.needsDisplayRect = IntRect();
+    m_needsDisplay = false;
+    m_needsDisplayRect = IntRect();
 }
 
 void GraphicsLayerTextureMapper::setName(const String& name)
@@ -61,34 +63,34 @@ GraphicsLayerTextureMapper::~GraphicsLayerTextureMapper()
 */
 void GraphicsLayerTextureMapper::setNeedsDisplay()
 {
-    m_pendingContent.needsDisplay = true;
-    notifyChange(TextureMapperNode::DisplayChange);
+    m_needsDisplay = true;
+    notifyChange(TextureMapperLayer::DisplayChange);
 }
 
 /* \reimp (GraphicsLayer.h)
 */
 void GraphicsLayerTextureMapper::setContentsNeedsDisplay()
 {
-    if (!node()->media())
-        m_pendingContent.needsDisplay = true;
-    notifyChange(TextureMapperNode::DisplayChange);
+    if (m_image)
+        setContentsToImage(m_image.get());
+    notifyChange(TextureMapperLayer::DisplayChange);
 }
 
 /* \reimp (GraphicsLayer.h)
 */
 void GraphicsLayerTextureMapper::setNeedsDisplayInRect(const FloatRect& rect)
 {
-    if (m_pendingContent.needsDisplay)
+    if (m_needsDisplay)
         return;
-    m_pendingContent.needsDisplayRect.unite(rect);
-    notifyChange(TextureMapperNode::DisplayChange);
+    m_needsDisplayRect.unite(rect);
+    notifyChange(TextureMapperLayer::DisplayChange);
 }
 
 /* \reimp (GraphicsLayer.h)
 */
 void GraphicsLayerTextureMapper::setParent(GraphicsLayer* layer)
 {
-    notifyChange(TextureMapperNode::ParentChange);
+    notifyChange(TextureMapperLayer::ParentChange);
     GraphicsLayer::setParent(layer);
 }
 
@@ -96,7 +98,7 @@ void GraphicsLayerTextureMapper::setParent(GraphicsLayer* layer)
 */
 bool GraphicsLayerTextureMapper::setChildren(const Vector<GraphicsLayer*>& children)
 {
-    notifyChange(TextureMapperNode::ChildrenChange);
+    notifyChange(TextureMapperLayer::ChildrenChange);
     return GraphicsLayer::setChildren(children);
 }
 
@@ -104,7 +106,7 @@ bool GraphicsLayerTextureMapper::setChildren(const Vector<GraphicsLayer*>& child
 */
 void GraphicsLayerTextureMapper::addChild(GraphicsLayer* layer)
 {
-    notifyChange(TextureMapperNode::ChildrenChange);
+    notifyChange(TextureMapperLayer::ChildrenChange);
     GraphicsLayer::addChild(layer);
 }
 
@@ -113,7 +115,7 @@ void GraphicsLayerTextureMapper::addChild(GraphicsLayer* layer)
 void GraphicsLayerTextureMapper::addChildAtIndex(GraphicsLayer* layer, int index)
 {
     GraphicsLayer::addChildAtIndex(layer, index);
-    notifyChange(TextureMapperNode::ChildrenChange);
+    notifyChange(TextureMapperLayer::ChildrenChange);
 }
 
 /* \reimp (GraphicsLayer.h)
@@ -121,16 +123,15 @@ void GraphicsLayerTextureMapper::addChildAtIndex(GraphicsLayer* layer, int index
 void GraphicsLayerTextureMapper::addChildAbove(GraphicsLayer* layer, GraphicsLayer* sibling)
 {
      GraphicsLayer::addChildAbove(layer, sibling);
-     notifyChange(TextureMapperNode::ChildrenChange);
+     notifyChange(TextureMapperLayer::ChildrenChange);
 }
 
 /* \reimp (GraphicsLayer.h)
 */
 void GraphicsLayerTextureMapper::addChildBelow(GraphicsLayer* layer, GraphicsLayer* sibling)
 {
-
     GraphicsLayer::addChildBelow(layer, sibling);
-    notifyChange(TextureMapperNode::ChildrenChange);
+    notifyChange(TextureMapperLayer::ChildrenChange);
 }
 
 /* \reimp (GraphicsLayer.h)
@@ -138,7 +139,7 @@ void GraphicsLayerTextureMapper::addChildBelow(GraphicsLayer* layer, GraphicsLay
 bool GraphicsLayerTextureMapper::replaceChild(GraphicsLayer* oldChild, GraphicsLayer* newChild)
 {
     if (GraphicsLayer::replaceChild(oldChild, newChild)) {
-        notifyChange(TextureMapperNode::ChildrenChange);
+        notifyChange(TextureMapperLayer::ChildrenChange);
         return true;
     }
     return false;
@@ -150,7 +151,7 @@ void GraphicsLayerTextureMapper::removeFromParent()
 {
     if (!parent())
         return;
-    notifyChange(TextureMapperNode::ParentChange);
+    notifyChange(TextureMapperLayer::ParentChange);
     GraphicsLayer::removeFromParent();
 }
 
@@ -161,7 +162,7 @@ void GraphicsLayerTextureMapper::setMaskLayer(GraphicsLayer* value)
     if (value == maskLayer())
         return;
     GraphicsLayer::setMaskLayer(value);
-    notifyChange(TextureMapperNode::MaskLayerChange);
+    notifyChange(TextureMapperLayer::MaskLayerChange);
 }
 
 
@@ -172,7 +173,7 @@ void GraphicsLayerTextureMapper::setReplicatedByLayer(GraphicsLayer* value)
     if (value == replicaLayer())
         return;
     GraphicsLayer::setReplicatedByLayer(value);
-    notifyChange(TextureMapperNode::ReplicaLayerChange);
+    notifyChange(TextureMapperLayer::ReplicaLayerChange);
 }
 
 /* \reimp (GraphicsLayer.h)
@@ -182,7 +183,7 @@ void GraphicsLayerTextureMapper::setPosition(const FloatPoint& value)
     if (value == position())
         return;
     GraphicsLayer::setPosition(value);
-    notifyChange(TextureMapperNode::PositionChange);
+    notifyChange(TextureMapperLayer::PositionChange);
 }
 
 /* \reimp (GraphicsLayer.h)
@@ -192,7 +193,7 @@ void GraphicsLayerTextureMapper::setAnchorPoint(const FloatPoint3D& value)
     if (value == anchorPoint())
         return;
     GraphicsLayer::setAnchorPoint(value);
-    notifyChange(TextureMapperNode::AnchorPointChange);
+    notifyChange(TextureMapperLayer::AnchorPointChange);
 }
 
 /* \reimp (GraphicsLayer.h)
@@ -203,7 +204,7 @@ void GraphicsLayerTextureMapper::setSize(const FloatSize& value)
         return;
 
     GraphicsLayer::setSize(value);
-    notifyChange(TextureMapperNode::SizeChange);
+    notifyChange(TextureMapperLayer::SizeChange);
 }
 
 /* \reimp (GraphicsLayer.h)
@@ -214,7 +215,7 @@ void GraphicsLayerTextureMapper::setTransform(const TransformationMatrix& value)
         return;
 
     GraphicsLayer::setTransform(value);
-    notifyChange(TextureMapperNode::TransformChange);
+    notifyChange(TextureMapperLayer::TransformChange);
 }
 
 /* \reimp (GraphicsLayer.h)
@@ -224,7 +225,7 @@ void GraphicsLayerTextureMapper::setChildrenTransform(const TransformationMatrix
     if (value == childrenTransform())
         return;
     GraphicsLayer::setChildrenTransform(value);
-    notifyChange(TextureMapperNode::ChildrenTransformChange);
+    notifyChange(TextureMapperLayer::ChildrenTransformChange);
 }
 
 /* \reimp (GraphicsLayer.h)
@@ -234,7 +235,7 @@ void GraphicsLayerTextureMapper::setPreserves3D(bool value)
     if (value == preserves3D())
         return;
     GraphicsLayer::setPreserves3D(value);
-    notifyChange(TextureMapperNode::Preserves3DChange);
+    notifyChange(TextureMapperLayer::Preserves3DChange);
 }
 
 /* \reimp (GraphicsLayer.h)
@@ -244,7 +245,7 @@ void GraphicsLayerTextureMapper::setMasksToBounds(bool value)
     if (value == masksToBounds())
         return;
     GraphicsLayer::setMasksToBounds(value);
-    notifyChange(TextureMapperNode::MasksToBoundsChange);
+    notifyChange(TextureMapperLayer::MasksToBoundsChange);
 }
 
 /* \reimp (GraphicsLayer.h)
@@ -253,39 +254,17 @@ void GraphicsLayerTextureMapper::setDrawsContent(bool value)
 {
     if (value == drawsContent())
         return;
-    notifyChange(TextureMapperNode::DrawsContentChange);
+    notifyChange(TextureMapperLayer::DrawsContentChange);
     GraphicsLayer::setDrawsContent(value);
 }
 
 /* \reimp (GraphicsLayer.h)
 */
-void GraphicsLayerTextureMapper::setBackgroundColor(const Color& value)
-{
-    if (value == m_pendingContent.backgroundColor)
-        return;
-    m_pendingContent.backgroundColor = value;
-    GraphicsLayer::setBackgroundColor(value);
-    notifyChange(TextureMapperNode::BackgroundColorChange);
-}
-
-/* \reimp (GraphicsLayer.h)
-*/
-void GraphicsLayerTextureMapper::clearBackgroundColor()
-{
-    if (!m_pendingContent.backgroundColor.isValid())
-        return;
-    m_pendingContent.backgroundColor = Color();
-    GraphicsLayer::clearBackgroundColor();
-    notifyChange(TextureMapperNode::BackgroundColorChange);
-}
-
-/* \reimp (GraphicsLayer.h)
-*/
 void GraphicsLayerTextureMapper::setContentsOpaque(bool value)
 {
     if (value == contentsOpaque())
         return;
-    notifyChange(TextureMapperNode::ContentsOpaqueChange);
+    notifyChange(TextureMapperLayer::ContentsOpaqueChange);
     GraphicsLayer::setContentsOpaque(value);
 }
 
@@ -296,7 +275,7 @@ void GraphicsLayerTextureMapper::setBackfaceVisibility(bool value)
     if (value == backfaceVisibility())
         return;
     GraphicsLayer::setBackfaceVisibility(value);
-    notifyChange(TextureMapperNode::BackfaceVisibilityChange);
+    notifyChange(TextureMapperLayer::BackfaceVisibilityChange);
 }
 
 /* \reimp (GraphicsLayer.h)
@@ -306,7 +285,7 @@ void GraphicsLayerTextureMapper::setOpacity(float value)
     if (value == opacity())
         return;
     GraphicsLayer::setOpacity(value);
-    notifyChange(TextureMapperNode::OpacityChange);
+    notifyChange(TextureMapperLayer::OpacityChange);
 }
 
 /* \reimp (GraphicsLayer.h)
@@ -316,46 +295,51 @@ void GraphicsLayerTextureMapper::setContentsRect(const IntRect& value)
     if (value == contentsRect())
         return;
     GraphicsLayer::setContentsRect(value);
-    notifyChange(TextureMapperNode::ContentsRectChange);
+    notifyChange(TextureMapperLayer::ContentsRectChange);
 }
 
 /* \reimp (GraphicsLayer.h)
 */
 void GraphicsLayerTextureMapper::setContentsToImage(Image* image)
 {
-    notifyChange(TextureMapperNode::ContentChange);
-    m_pendingContent.contentType = image ? TextureMapperNode::DirectImageContentType : TextureMapperNode::HTMLContentType;
-    m_pendingContent.image = image;
+    if (image == m_image)
+        return;
+
+    m_image = image;
+    if (m_image) {
+        RefPtr<TextureMapperTiledBackingStore> backingStore = TextureMapperTiledBackingStore::create();
+        backingStore->setContentsToImage(image);
+        m_compositedImage = backingStore;
+    } else
+        m_compositedImage = 0;
+
+    setContentsToMedia(m_compositedImage.get());
+    notifyChange(TextureMapperLayer::ContentChange);
     GraphicsLayer::setContentsToImage(image);
 }
 
 void GraphicsLayerTextureMapper::setContentsToMedia(TextureMapperPlatformLayer* media)
 {
+    if (media == m_contentsLayer)
+        return;
+
     GraphicsLayer::setContentsToMedia(media);
-    notifyChange(TextureMapperNode::ContentChange);
-    m_pendingContent.contentType = media ? TextureMapperNode::MediaContentType : TextureMapperNode::HTMLContentType;
-    m_pendingContent.media = media;
+    notifyChange(TextureMapperLayer::ContentChange);
+    m_contentsLayer = media;
 }
 
 /* \reimp (GraphicsLayer.h)
 */
 void GraphicsLayerTextureMapper::syncCompositingStateForThisLayerOnly()
 {
-    m_node->syncCompositingState(this);
+    m_layer->syncCompositingState(this);
 }
 
 /* \reimp (GraphicsLayer.h)
 */
 void GraphicsLayerTextureMapper::syncCompositingState(const FloatRect&)
 {
-    m_node->syncCompositingState(this, TextureMapperNode::TraverseDescendants);
-}
-
-/* \reimp (GraphicsLayer.h)
-*/
-PlatformLayer* GraphicsLayerTextureMapper::platformLayer() const
-{
-    return const_cast<TextureMapperPlatformLayer*>(node()->media());
+    m_layer->syncCompositingState(this, TextureMapperLayer::TraverseDescendants);
 }
 
 bool GraphicsLayerTextureMapper::addAnimation(const KeyframeValueList& valueList, const IntSize& boxSize, const Animation* anim, const String& keyframesName, double timeOffset)
@@ -372,7 +356,7 @@ bool GraphicsLayerTextureMapper::addAnimation(const KeyframeValueList& valueList
         listsMatch = validateTransformOperations(valueList, hasBigRotation) >= 0;
 
     m_animations.add(keyframesName, TextureMapperAnimation(valueList, boxSize, anim, timeOffset, listsMatch));
-    notifyChange(TextureMapperNode::AnimationChange);
+    notifyChange(TextureMapperLayer::AnimationChange);
     m_animationStartedTimer.startOneShot(0);
     return true;
 }
@@ -399,4 +383,12 @@ PassOwnPtr<GraphicsLayer> GraphicsLayer::create(GraphicsLayerClient* client)
     return adoptPtr(new GraphicsLayerTextureMapper(client));
 }
 
+#if ENABLE(CSS_FILTERS)
+bool GraphicsLayerTextureMapper::setFilters(const FilterOperations& filters)
+{
+    notifyChange(TextureMapperLayer::FilterChange);
+    return GraphicsLayer::setFilters(filters);
+}
+#endif
+
 }
diff --git a/Source/WebCore/platform/graphics/texmap/GraphicsLayerTextureMapper.h b/Source/WebCore/platform/graphics/texmap/GraphicsLayerTextureMapper.h
index 172fdda24..07f378629 100644
--- a/Source/WebCore/platform/graphics/texmap/GraphicsLayerTextureMapper.h
+++ b/Source/WebCore/platform/graphics/texmap/GraphicsLayerTextureMapper.h
@@ -24,7 +24,7 @@
 #include "GraphicsLayer.h"
 #include "GraphicsLayerClient.h"
 #include "Image.h"
-#include "TextureMapperNode.h"
+#include "TextureMapperLayer.h"
 
 #if ENABLE(WEBGL)
 #include "GraphicsContext3D.h"
@@ -32,12 +32,12 @@
 
 namespace WebCore {
 
-class TextureMapperNode;
+class TextureMapperLayer;
 class BitmapTexture;
 class TextureMapper;
 
 class GraphicsLayerTextureMapper : public GraphicsLayer {
-    friend class TextureMapperNode;
+    friend class TextureMapperLayer;
 
 public:
     GraphicsLayerTextureMapper(GraphicsLayerClient*);
@@ -64,8 +64,6 @@ public:
     virtual void setPreserves3D(bool b);
     virtual void setMasksToBounds(bool b);
     virtual void setDrawsContent(bool b);
-    virtual void setBackgroundColor(const Color&);
-    virtual void clearBackgroundColor();
     virtual void setContentsOpaque(bool b);
     virtual void setBackfaceVisibility(bool b);
     virtual void setOpacity(float opacity);
@@ -77,10 +75,9 @@ public:
     virtual void syncCompositingState(const FloatRect&);
     virtual void syncCompositingStateForThisLayerOnly();
     virtual void setName(const String& name);
-    virtual PlatformLayer* platformLayer() const;
+    virtual PlatformLayer* platformLayer() const { return 0; }
 
-    void notifyChange(TextureMapperNode::ChangeMask changeMask);
-    inline TextureMapperNode::ContentData& pendingContent() { return m_pendingContent; }
+    void notifyChange(TextureMapperLayer::ChangeMask);
     inline int changeMask() const { return m_changeMask; }
     void didSynchronize();
 
@@ -88,13 +85,24 @@ public:
     virtual void pauseAnimation(const String&, double);
     virtual void removeAnimation(const String&);
 
-    TextureMapperNode* node() const { return m_node.get(); }
+    TextureMapperLayer* layer() const { return m_layer.get(); }
+    TextureMapperPlatformLayer* contentsLayer() const { return m_contentsLayer; }
+    bool needsDisplay() const { return m_needsDisplay; }
+    IntRect needsDisplayRect() const { return enclosingIntRect(m_needsDisplayRect); }
+
+#if ENABLE(CSS_FILTERS)
+    virtual bool setFilters(const FilterOperations&);
+#endif
 
 private:
-    OwnPtr<TextureMapperNode> m_node;
+    OwnPtr<TextureMapperLayer> m_layer;
+    RefPtr<TextureMapperBackingStore> m_compositedImage;
+    RefPtr<Image> m_image;
     bool m_syncQueued;
     int m_changeMask;
-    TextureMapperNode::ContentData m_pendingContent;
+    bool m_needsDisplay;
+    TextureMapperPlatformLayer* m_contentsLayer;
+    FloatRect m_needsDisplayRect;
     TextureMapperAnimations m_animations;
     void animationStartedTimerFired(Timer<GraphicsLayerTextureMapper>*);
     Timer<GraphicsLayerTextureMapper> m_animationStartedTimer;
diff --git a/Source/WebCore/platform/graphics/texmap/TextureMapper.cpp b/Source/WebCore/platform/graphics/texmap/TextureMapper.cpp
index 5e528d46b..58e4f594c 100644
--- a/Source/WebCore/platform/graphics/texmap/TextureMapper.cpp
+++ b/Source/WebCore/platform/graphics/texmap/TextureMapper.cpp
@@ -73,7 +73,6 @@ PassRefPtr<BitmapTexture> TextureMapper::acquireTextureFromPool(const IntSize& s
     return selectedTexture;
 }
 
-
 PassOwnPtr<TextureMapper> TextureMapper::create(AccelerationMode mode)
 {
     if (mode == SoftwareMode)
diff --git a/Source/WebCore/platform/graphics/texmap/TextureMapper.h b/Source/WebCore/platform/graphics/texmap/TextureMapper.h
index f25ce0bc1..af2d59e7f 100644
--- a/Source/WebCore/platform/graphics/texmap/TextureMapper.h
+++ b/Source/WebCore/platform/graphics/texmap/TextureMapper.h
@@ -27,6 +27,7 @@
     #endif
 #endif
 
+#include "FilterOperations.h"
 #include "GraphicsContext.h"
 #include "IntRect.h"
 #include "IntSize.h"
@@ -47,8 +48,14 @@ class TextureMapper;
 class BitmapTexture  : public RefCounted<BitmapTexture> {
 public:
     enum PixelFormat { BGRAFormat, RGBAFormat, BGRFormat, RGBFormat };
+    enum Flag {
+        SupportsAlpha = 0x01
+    };
+
+    typedef unsigned Flags;
+
     BitmapTexture()
-        : m_isOpaque(true)
+        : m_flags(0)
     {
     }
 
@@ -59,21 +66,30 @@ public:
     virtual void updateContents(Image*, const IntRect&, const IntRect&, BitmapTexture::PixelFormat) = 0;
     virtual void updateContents(const void*, const IntRect&) = 0;
     virtual bool isValid() const = 0;
+    inline Flags flags() const { return m_flags; }
 
     virtual int bpp() const { return 32; }
-    virtual void reset(const IntSize& size, bool opaque = false)
+    virtual void didReset() { }
+    void reset(const IntSize& size, Flags flags)
     {
-        m_isOpaque = opaque;
+        m_flags = flags;
         m_contentSize = size;
+        didReset();
     }
 
     inline IntSize contentSize() const { return m_contentSize; }
     inline int numberOfBytes() const { return size().width() * size().height() * bpp() >> 3; }
-    inline bool isOpaque() const { return m_isOpaque; }
+    inline bool isOpaque() const { return !(m_flags & SupportsAlpha); }
+
+#if ENABLE(CSS_FILTERS)
+    virtual void applyFilters(const BitmapTexture& contentTexture, const FilterOperations&) { }
+#endif
 
 protected:
     IntSize m_contentSize;
-    bool m_isOpaque;
+
+private:
+    Flags m_flags;
 };
 
 // A "context" class used to encapsulate accelerated texture mapping functions: i.e. drawing a texture
@@ -106,6 +122,8 @@ public:
     virtual void beginPainting() { }
     virtual void endPainting() { }
 
+    virtual IntSize maxTextureSize() const { return IntSize(INT_MAX, INT_MAX); }
+
     // A surface is released implicitly when dereferenced.
     virtual PassRefPtr<BitmapTexture> acquireTextureFromPool(const IntSize&);
 
diff --git a/Source/WebCore/platform/graphics/texmap/TextureMapperAnimation.cpp b/Source/WebCore/platform/graphics/texmap/TextureMapperAnimation.cpp
index 6be518a8b..37374928d 100644
--- a/Source/WebCore/platform/graphics/texmap/TextureMapperAnimation.cpp
+++ b/Source/WebCore/platform/graphics/texmap/TextureMapperAnimation.cpp
@@ -123,7 +123,7 @@ static TransformationMatrix applyTransformAnimation(const TransformOperations* f
 
     // Animation to "-webkit-transform: none".
     if (!to->size()) {
-        TransformOperations blended(*to);
+        TransformOperations blended(*from);
         for (size_t i = 0; i < blended.operations().size(); ++i)
             blended.operations()[i]->blend(0, progress, true)->apply(matrix, boxSize);
         return matrix;
@@ -131,7 +131,7 @@ static TransformationMatrix applyTransformAnimation(const TransformOperations* f
 
     // Animation from "-webkit-transform: none".
     if (!from->size()) {
-        TransformOperations blended(*from);
+        TransformOperations blended(*to);
         for (size_t i = 0; i < blended.operations().size(); ++i)
             blended.operations()[i]->blend(0, 1. - progress, true)->apply(matrix, boxSize);
         return matrix;
diff --git a/Source/WebCore/platform/graphics/texmap/TextureMapperBackingStore.cpp b/Source/WebCore/platform/graphics/texmap/TextureMapperBackingStore.cpp
new file mode 100644
index 000000000..6c3e2d8df
--- /dev/null
+++ b/Source/WebCore/platform/graphics/texmap/TextureMapperBackingStore.cpp
@@ -0,0 +1,155 @@
+/*
+ Copyright (C) 2012 Nokia Corporation and/or its subsidiary(-ies)
+
+ This library is free software; you can redistribute it and/or
+ modify it under the terms of the GNU Library General Public
+ License as published by the Free Software Foundation; either
+ version 2 of the License, or (at your option) any later version.
+
+ This library is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ Library General Public License for more details.
+
+ You should have received a copy of the GNU Library General Public License
+ along with this library; see the file COPYING.LIB.  If not, write to
+ the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ Boston, MA 02110-1301, USA.
+ */
+
+#include "config.h"
+#include "TextureMapperBackingStore.h"
+
+#include "GraphicsLayer.h"
+#include "ImageBuffer.h"
+#include "TextureMapper.h"
+
+namespace WebCore {
+
+void TextureMapperTile::updateContents(TextureMapper* textureMapper, Image* image, const IntRect& dirtyRect, BitmapTexture::PixelFormat format)
+{
+    IntRect targetRect = enclosingIntRect(m_rect);
+    targetRect.intersect(dirtyRect);
+    if (targetRect.isEmpty())
+        return;
+    IntRect sourceRect = targetRect;
+
+    // Normalize sourceRect to the buffer's coordinates.
+    sourceRect.move(-dirtyRect.x(), -dirtyRect.y());
+
+    // Normalize targetRect to the texture's coordinates.
+    targetRect.move(-m_rect.x(), -m_rect.y());
+    if (!m_texture) {
+        m_texture = textureMapper->createTexture();
+        m_texture->reset(targetRect.size(), image->currentFrameHasAlpha() ? BitmapTexture::SupportsAlpha : 0);
+    }
+
+    m_texture->updateContents(image, targetRect, sourceRect, format);
+}
+
+void TextureMapperTile::paint(TextureMapper* textureMapper, const TransformationMatrix& transform, float opacity, BitmapTexture* mask)
+{
+    textureMapper->drawTexture(*texture().get(), rect(), transform, opacity, mask);
+}
+
+void TextureMapperTiledBackingStore::updateContentsFromImageIfNeeded(TextureMapper* textureMapper)
+{
+    if (!m_image)
+        return;
+
+    updateContents(textureMapper, m_image.get(), m_image->currentFrameHasAlpha() ? BitmapTexture::BGRAFormat : BitmapTexture::BGRFormat);
+    m_image.clear();
+}
+
+void TextureMapperTiledBackingStore::paintToTextureMapper(TextureMapper* textureMapper, const FloatRect& targetRect, const TransformationMatrix& transform, float opacity, BitmapTexture* mask)
+{
+    updateContentsFromImageIfNeeded(textureMapper);
+    TransformationMatrix adjustedTransform = transform;
+    adjustedTransform.multiply(TransformationMatrix::rectToRect(rect(), targetRect));
+    for (size_t i = 0; i < m_tiles.size(); ++i)
+        m_tiles[i].paint(textureMapper, adjustedTransform, opacity, mask);
+}
+
+void TextureMapperTiledBackingStore::createOrDestroyTilesIfNeeded(const FloatSize& size, const IntSize& tileSize, bool hasAlpha)
+{
+    if (size == m_size)
+        return;
+
+    m_size = size;
+
+    Vector<FloatRect> tileRectsToAdd;
+    Vector<int> tileIndicesToRemove;
+    static const size_t TileEraseThreshold = 6;
+
+    // This method recycles tiles. We check which tiles we need to add, which to remove, and use as many
+    // removable tiles as replacement for new tiles when possible.
+    for (float y = 0; y < m_size.height(); y += tileSize.height()) {
+        for (float x = 0; x < m_size.width(); x += tileSize.width()) {
+            FloatRect tileRect(x, y, tileSize.width(), tileSize.height());
+            tileRect.intersect(rect());
+            tileRectsToAdd.append(tileRect);
+        }
+    }
+
+    // Check which tiles need to be removed, and which already exist.
+    for (int i = m_tiles.size() - 1; i >= 0; --i) {
+        FloatRect oldTile = m_tiles[i].rect();
+        bool existsAlready = false;
+
+        for (int j = tileRectsToAdd.size() - 1; j >= 0; --j) {
+            FloatRect newTile = tileRectsToAdd[j];
+            if (oldTile != newTile)
+                continue;
+
+            // A tile that we want to add already exists, no need to add or remove it.
+            existsAlready = true;
+            tileRectsToAdd.remove(j);
+            break;
+        }
+
+        // This tile is not needed.
+        if (!existsAlready)
+            tileIndicesToRemove.append(i);
+    }
+
+    // Recycle removable tiles to be used for newly requested tiles.
+    for (size_t i = 0; i < tileRectsToAdd.size(); ++i) {
+        if (!tileIndicesToRemove.isEmpty()) {
+            // We recycle an existing tile for usage with a new tile rect.
+            TextureMapperTile& tile = m_tiles[tileIndicesToRemove.last()];
+            tileIndicesToRemove.removeLast();
+            tile.setRect(tileRectsToAdd[i]);
+
+            if (tile.texture())
+                tile.texture()->reset(enclosingIntRect(tile.rect()).size(), hasAlpha ? BitmapTexture::SupportsAlpha : 0);
+            continue;
+        }
+
+        m_tiles.append(TextureMapperTile(tileRectsToAdd[i]));
+    }
+
+    // Remove unnecessary tiles, if they weren't recycled.
+    // We use a threshold to make sure we don't create/destroy tiles too eagerly.
+    for (size_t i = 0; i < tileIndicesToRemove.size() && m_tiles.size() > TileEraseThreshold; ++i)
+        m_tiles.remove(tileIndicesToRemove[i]);
+}
+
+void TextureMapperTiledBackingStore::updateContents(TextureMapper* textureMapper, Image* image, const FloatSize& totalSize, const IntRect& dirtyRect, BitmapTexture::PixelFormat format)
+{
+    createOrDestroyTilesIfNeeded(totalSize, textureMapper->maxTextureSize(), image->currentFrameHasAlpha());
+    for (size_t i = 0; i < m_tiles.size(); ++i)
+        m_tiles[i].updateContents(textureMapper, image, dirtyRect, format);
+}
+
+PassRefPtr<BitmapTexture> TextureMapperTiledBackingStore::texture() const
+{
+    for (size_t i = 0; i < m_tiles.size(); ++i) {
+        RefPtr<BitmapTexture> texture = m_tiles[i].texture();
+        if (texture)
+            return texture;
+    }
+
+    return PassRefPtr<BitmapTexture>();
+}
+
+}
diff --git a/Source/WebCore/platform/graphics/texmap/TextureMapperBackingStore.h b/Source/WebCore/platform/graphics/texmap/TextureMapperBackingStore.h
new file mode 100644
index 000000000..9f056e012
--- /dev/null
+++ b/Source/WebCore/platform/graphics/texmap/TextureMapperBackingStore.h
@@ -0,0 +1,84 @@
+/*
+ Copyright (C) 2012 Nokia Corporation and/or its subsidiary(-ies)
+
+ This library is free software; you can redistribute it and/or
+ modify it under the terms of the GNU Library General Public
+ License as published by the Free Software Foundation; either
+ version 2 of the License, or (at your option) any later version.
+
+ This library is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ Library General Public License for more details.
+
+ You should have received a copy of the GNU Library General Public License
+ along with this library; see the file COPYING.LIB.  If not, write to
+ the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ Boston, MA 02110-1301, USA.
+ */
+
+#ifndef TextureMapperBackingStore_h
+#define TextureMapperBackingStore_h
+
+#include "FloatRect.h"
+#include "Image.h"
+#include "RefPtr.h"
+#include "TextureMapper.h"
+#include "TextureMapperPlatformLayer.h"
+
+namespace WebCore {
+
+class GraphicsLayer;
+
+class TextureMapperBackingStore : public TextureMapperPlatformLayer, public RefCounted<TextureMapperBackingStore> {
+public:
+    virtual PassRefPtr<BitmapTexture> texture() const = 0;
+    virtual void paintToTextureMapper(TextureMapper*, const FloatRect&, const TransformationMatrix&, float, BitmapTexture*) = 0;
+    virtual ~TextureMapperBackingStore() { }
+};
+
+class TextureMapperTile {
+public:
+    inline PassRefPtr<BitmapTexture> texture() const { return m_texture; }
+    inline FloatRect rect() const { return m_rect; }
+    inline void setTexture(BitmapTexture* texture) { m_texture = texture; }
+    inline void setRect(const FloatRect& rect) { m_rect = rect; }
+
+    void updateContents(TextureMapper*, Image*, const IntRect&, BitmapTexture::PixelFormat);
+    virtual void paint(TextureMapper*, const TransformationMatrix&, float, BitmapTexture*);
+    virtual ~TextureMapperTile() { }
+
+    TextureMapperTile(const FloatRect& rect)
+        : m_rect(rect)
+    {
+    }
+
+private:
+    RefPtr<BitmapTexture> m_texture;
+    FloatRect m_rect;
+};
+
+class TextureMapperTiledBackingStore : public TextureMapperBackingStore {
+public:
+    void updateContentsFromLayer(TextureMapper*, GraphicsLayer*, const IntRect&);
+    virtual ~TextureMapperTiledBackingStore() { }
+    virtual void paintToTextureMapper(TextureMapper*, const FloatRect&, const TransformationMatrix&, float, BitmapTexture*);
+    virtual PassRefPtr<BitmapTexture> texture() const;
+    void updateContents(TextureMapper*, Image*, const FloatSize&, const IntRect&, BitmapTexture::PixelFormat);
+    void updateContents(TextureMapper* textureMapper, Image* image, BitmapTexture::PixelFormat format) { updateContents(textureMapper, image, image->size(), image->rect(), format); }
+    inline FloatRect rect() const { return FloatRect(FloatPoint::zero(), m_size); }
+    static PassRefPtr<TextureMapperTiledBackingStore> create() { return adoptRef(new TextureMapperTiledBackingStore); }
+    void setContentsToImage(Image* image) { m_image = image; }
+    void updateContentsFromImageIfNeeded(TextureMapper*);
+
+private:
+    TextureMapperTiledBackingStore() { }
+    void createOrDestroyTilesIfNeeded(const FloatSize& backingStoreSize, const IntSize& tileSize, bool hasAlpha);
+
+    Vector<TextureMapperTile> m_tiles;
+    FloatSize m_size;
+    RefPtr<Image> m_image;
+};
+
+}
+#endif // TextureMapperBackingStore_h
diff --git a/Source/WebCore/platform/graphics/opengl/TextureMapperGL.cpp b/Source/WebCore/platform/graphics/texmap/TextureMapperGL.cpp
index 9e69ce698..746a1d89b 100644
--- a/Source/WebCore/platform/graphics/opengl/TextureMapperGL.cpp
+++ b/Source/WebCore/platform/graphics/texmap/TextureMapperGL.cpp
@@ -22,6 +22,7 @@
 
 #include "GraphicsContext.h"
 #include "Image.h"
+#include "TextureMapperShaderManager.h"
 #include "Timer.h"
 #include <wtf/HashMap.h>
 #include <wtf/OwnArrayPtr.h>
@@ -35,17 +36,6 @@
 #endif
 #endif
 
-#if PLATFORM(QT) || USE(CAIRO)
-#include <cairo/OpenGLShims.h>
-#elif defined(TEXMAP_OPENGL_ES_2)
-#include <GLES2/gl2.h>
-#include <GLES2/gl2ext.h>
-#elif OS(MAC_OS_X)
-#include <gl.h>
-#else
-#include <GL/gl.h>
-#endif
-
 #if defined(TEXMAP_OPENGL_ES_2)
 #include <EGL/egl.h>
 #elif OS(WINDOWS)
@@ -63,50 +53,6 @@
 #include <wtf/ByteArray.h>
 #endif
 
-#if !defined(TEXMAP_OPENGL_ES_2) && !PLATFORM(QT) && !PLATFORM(GTK)
-extern "C" {
-    void glUniform1f(GLint, GLfloat);
-    void glUniform1i(GLint, GLint);
-    void glVertexAttribPointer(GLuint, GLint, GLenum, GLboolean, GLsizei, const GLvoid*);
-    void glUniform4f(GLint, GLfloat, GLfloat, GLfloat, GLfloat);
-    void glShaderSource(GLuint, GLsizei, const char**, const GLint*);
-    GLuint glCreateShader(GLenum);
-    void glShaderSource(GLuint, GLsizei, const char**, const GLint*);
-    void glCompileShader(GLuint);
-    void glDeleteShader(GLuint);
-    void glUniformMatrix4fv(GLint, GLsizei, GLboolean, const GLfloat*);
-    GLuint glCreateProgram();
-    void glAttachShader(GLuint, GLuint);
-    void glLinkProgram(GLuint);
-    void glUseProgram(GLuint);
-    void glDisableVertexAttribArray(GLuint);
-    void glEnableVertexAttribArray(GLuint);
-    void glBindFramebuffer(GLenum target, GLuint framebuffer);
-    void glDeleteFramebuffers(GLsizei n, const GLuint* framebuffers);
-    void glGenFramebuffers(GLsizei n, GLuint* framebuffers);
-    void glFramebufferTexture2D(GLenum target, GLenum attachment, GLenum textarget, GLuint texture, GLint level);
-    void glGetFramebufferAttachmentParameteriv(GLenum target, GLenum attachment, GLenum pname, GLint* params);
-    void glBindBuffer(GLenum, GLuint);
-    void glDeleteBuffers(GLsizei, const GLuint*);
-    void glGenBuffers(GLsizei, GLuint*);
-    void glBufferData(GLenum, GLsizeiptr, const GLvoid*, GLenum);
-    void glBufferSubData(GLenum, GLsizeiptr, GLsizeiptr, const GLvoid*);
-    void glGetProgramInfoLog(GLuint, GLsizei, GLsizei*, GLchar*);
-    void glGetShaderInfoLog(GLuint, GLsizei, GLsizei*, GLchar*);
-    void glGenRenderbuffers(GLsizei n, GLuint* ids);
-    void glDeleteRenderbuffers(GLsizei n, const GLuint* ids);
-    void glBindRenderbuffer(GLenum target, GLuint id);
-    void glRenderbufferStorage(GLenum target, GLenum internalFormat, GLsizei width, GLsizei height);
-    void glFramebufferRenderbuffer(GLenum target, GLenum attachmentPoint, GLenum renderbufferTarget, GLuint renderbufferId);
-    GLenum glCheckFramebufferStatus(GLenum target);
-    GLint glGetAttribLocation(GLuint program, const GLchar* name);
-#if !OS(MAC_OS_X)
-    GLint glGetUniformLocation(GLuint, const GLchar*);
-    GLint glBindAttribLocation(GLuint, GLuint, const GLchar*);
-#endif
-}
-#endif
-
 namespace WebCore {
 
 inline static void debugGLCommand(const char* command, int line)
@@ -179,91 +125,65 @@ struct TextureMapperGLData {
             return adoptRef(new SharedGLData(getCurrentGLContext()));
         }
 
-        enum ShaderProgramIndex {
-            NoProgram = -1,
-            SimpleProgram,
-            OpacityAndMaskProgram,
-            ClipProgram,
-
-            ProgramCount
-        };
-
-        enum ShaderVariableIndex {
-            InMatrixVariable,
-            InSourceMatrixVariable,
-            InMaskMatrixVariable,
-            OpacityVariable,
-            SourceTextureVariable,
-            MaskTextureVariable,
-
-            VariableCount
+        struct ClipState {
+            IntRect scissorBox;
+            int stencilIndex;
+            ClipState(const IntRect& scissors, int stencil)
+                : scissorBox(scissors)
+                , stencilIndex(stencil)
+            { }
+
+            ClipState()
+                : stencilIndex(1)
+            { }
         };
 
-        struct ProgramInfo {
-            GLuint id;
-            GLuint vertexAttrib;
-            GLint vars[VariableCount];
-            GLuint vertexShader;
-            GLuint fragmentShader;
-            ProgramInfo() : id(0) { }
-        };
+        ClipState clipState;
+        Vector<ClipState> clipStack;
 
-        GLint getUniformLocation(ShaderProgramIndex prog, ShaderVariableIndex var, const char* name)
+        void pushClipState()
         {
-            return programs[prog].vars[var] = glGetUniformLocation(programs[prog].id, name);
+            clipStack.append(clipState);
         }
 
-        void createShaderProgram(const char* vertexShaderSource, const char* fragmentShaderSource, ShaderProgramIndex index)
+        void popClipState()
         {
-            GLuint vertexShader = glCreateShader(GL_VERTEX_SHADER);
-            GLuint fragmentShader = glCreateShader(GL_FRAGMENT_SHADER);
-            GL_CMD(glShaderSource(vertexShader, 1, &vertexShaderSource, 0))
-            GL_CMD(glShaderSource(fragmentShader, 1, &fragmentShaderSource, 0))
-            GLuint programID = glCreateProgram();
-            GL_CMD(glCompileShader(vertexShader))
-            GL_CMD(glCompileShader(fragmentShader))
-            GL_CMD(glAttachShader(programID, vertexShader))
-            GL_CMD(glAttachShader(programID, fragmentShader))
-            GL_CMD(glLinkProgram(programID))
-            programs[index].vertexAttrib = glGetAttribLocation(programID, "InVertex");
-            programs[index].id = programID;
-            programs[index].vertexShader = vertexShader;
-            programs[index].fragmentShader = fragmentShader;
+            if (clipStack.isEmpty())
+                return;
+            clipState = clipStack.last();
+            clipStack.removeLast();
         }
 
-        void deleteShaderProgram(ShaderProgramIndex index)
+        static void scissorClip(const IntRect& rect)
         {
-            ProgramInfo& programInfo = programs[index];
-            GLuint programID = programInfo.id;
-            if (!programID)
+            if (rect.isEmpty())
                 return;
 
-            GL_CMD(glDetachShader(programID, programInfo.vertexShader))
-            GL_CMD(glDeleteShader(programInfo.vertexShader))
-            GL_CMD(glDetachShader(programID, programInfo.fragmentShader))
-            GL_CMD(glDeleteShader(programInfo.fragmentShader))
-            GL_CMD(glDeleteProgram(programID))
+            GLint viewport[4];
+            GL_CMD(glGetIntegerv(GL_VIEWPORT, viewport))
+            GL_CMD(glScissor(rect.x(), viewport[3] - rect.maxY() + 1, rect.width() - 1, rect.height() - 1))
         }
 
-        void initializeShaders();
-
-        ProgramInfo programs[ProgramCount];
+        void applyCurrentClip()
+        {
+            scissorClip(clipState.scissorBox);
+            GL_CMD(glStencilOp(GL_KEEP, GL_KEEP, GL_KEEP))
+            glStencilFunc(GL_EQUAL, clipState.stencilIndex - 1, clipState.stencilIndex - 1);
+            if (clipState.stencilIndex == 1)
+                glDisable(GL_STENCIL_TEST);
+            else
+                glEnable(GL_STENCIL_TEST);
+        }
 
-        int stencilIndex;
-        Vector<IntRect> clipStack;
+        TextureMapperShaderManager textureMapperShaderManager;
 
         SharedGLData(GLContext glContext)
-            : stencilIndex(1)
         {
             glContextDataMap().add(glContext, this);
-            initializeShaders();
         }
 
         ~SharedGLData()
         {
-            for (int i = SimpleProgram; i < ProgramCount; ++i)
-                deleteShaderProgram(ShaderProgramIndex(i));
-
             GLContextDataMap::const_iterator end = glContextDataMap().end();
             GLContextDataMap::iterator it;
             for (it = glContextDataMap().begin(); it != end; ++it) {
@@ -282,19 +202,25 @@ struct TextureMapperGLData {
         return *(m_sharedGLData.get());
     }
 
+    void initializeStencil();
+
     TextureMapperGLData()
-        : currentProgram(SharedGLData::NoProgram)
-        , previousProgram(0)
+        : previousProgram(0)
+        , didModifyStencil(false)
         , previousScissorState(0)
+        , previousDepthState(0)
         , m_sharedGLData(TextureMapperGLData::SharedGLData::currentSharedGLData())
     { }
 
     TransformationMatrix projectionMatrix;
-    int currentProgram;
     GLint previousProgram;
+    bool didModifyStencil;
     GLint previousScissorState;
+    GLint previousDepthState;
     GLint viewport[4];
+    GLint previousScissor[4];
     RefPtr<SharedGLData> m_sharedGLData;
+    RefPtr<BitmapTexture> currentSurface;
 };
 
 class BitmapTextureGL : public BitmapTexture {
@@ -302,8 +228,9 @@ public:
     virtual void destroy();
     virtual IntSize size() const;
     virtual bool isValid() const;
-    virtual void reset(const IntSize&, bool opaque);
+    virtual void didReset();
     void bind();
+    void initializeStencil();
     ~BitmapTextureGL() { destroy(); }
     virtual uint32_t id() const { return m_id; }
     inline FloatSize relativeSize() const { return m_relativeSize; }
@@ -318,7 +245,6 @@ private:
     IntRect m_dirtyRect;
     GLuint m_fbo;
     GLuint m_rbo;
-    IntSize m_actualSize;
     bool m_surfaceNeedsReset;
     TextureMapperGL* m_textureMapper;
     BitmapTextureGL()
@@ -333,12 +259,20 @@ private:
     friend class TextureMapperGL;
 };
 
-#define TEXMAP_GET_SHADER_VAR_LOCATION(prog, var) \
-    if (getUniformLocation(prog##Program, var##Variable, #var) < 0) \
-            LOG_ERROR("Couldn't find variable "#var" in program "#prog"\n");
+void TextureMapperGLData::initializeStencil()
+{
+    if (currentSurface) {
+        static_cast<BitmapTextureGL*>(currentSurface.get())->initializeStencil();
+        return;
+    }
+
+    if (didModifyStencil)
+        return;
 
-#define TEXMAP_BUILD_SHADER(program) \
-    createShaderProgram(vertexShaderSource##program, fragmentShaderSource##program, program##Program);
+    glClearStencil(0);
+    glClear(GL_STENCIL_BUFFER_BIT);
+    didModifyStencil = true;
+}
 
 TextureMapperGL::TextureMapperGL()
     : m_data(new TextureMapperGLData)
@@ -346,114 +280,6 @@ TextureMapperGL::TextureMapperGL()
 {
 }
 
-void TextureMapperGLData::SharedGLData::initializeShaders()
-{
-#ifndef TEXMAP_OPENGL_ES_2
-#define OES2_PRECISION_DEFINITIONS \
-    "#define lowp\n#define highp\n"
-#define OES2_FRAGMENT_SHADER_DEFAULT_PRECISION
-#else
-#define OES2_PRECISION_DEFINITIONS
-#define OES2_FRAGMENT_SHADER_DEFAULT_PRECISION \
-    "precision mediump float; \n"
-#endif
-
-#define VERTEX_SHADER(src...) OES2_PRECISION_DEFINITIONS#src
-#define FRAGMENT_SHADER(src...) OES2_PRECISION_DEFINITIONS\
-                                OES2_FRAGMENT_SHADER_DEFAULT_PRECISION\
-                                #src
-
-    if (!initializeOpenGLShims())
-        return;
-
-    const char* fragmentShaderSourceOpacityAndMask =
-        FRAGMENT_SHADER(
-            uniform sampler2D SourceTexture, MaskTexture;
-            uniform lowp float Opacity;
-            varying highp vec2 OutTexCoordSource, OutTexCoordMask;
-            void main(void)
-            {
-                lowp vec4 color = texture2D(SourceTexture, OutTexCoordSource);
-                lowp vec4 maskColor = texture2D(MaskTexture, OutTexCoordMask);
-                lowp float fragmentAlpha = Opacity * maskColor.a;
-                gl_FragColor = vec4(color.rgb * fragmentAlpha, color.a * fragmentAlpha);
-            }
-        );
-
-    const char* vertexShaderSourceOpacityAndMask =
-        VERTEX_SHADER(
-            uniform mat4 InMatrix, InSourceMatrix, InMaskMatrix;
-            attribute vec4 InVertex;
-            varying highp vec2 OutTexCoordSource, OutTexCoordMask;
-            void main(void)
-            {
-                OutTexCoordSource = vec2(InSourceMatrix * InVertex);
-                OutTexCoordMask = vec2(InMaskMatrix * InVertex);
-                gl_Position = InMatrix * InVertex;
-            }
-        );
-
-    const char* fragmentShaderSourceSimple =
-        FRAGMENT_SHADER(
-            uniform sampler2D SourceTexture;
-            uniform lowp float Opacity;
-            varying highp vec2 OutTexCoordSource;
-            void main(void)
-            {
-                lowp vec4 color = texture2D(SourceTexture, OutTexCoordSource);
-                gl_FragColor = vec4(color.rgb * Opacity, color.a * Opacity);
-            }
-        );
-
-    const char* vertexShaderSourceSimple =
-        VERTEX_SHADER(
-            uniform mat4 InMatrix, InSourceMatrix;
-            attribute vec4 InVertex;
-            varying highp vec2 OutTexCoordSource;
-            void main(void)
-            {
-                OutTexCoordSource = vec2(InSourceMatrix * InVertex);
-                gl_Position = InMatrix * InVertex;
-            }
-        );
-    const char* fragmentShaderSourceClip =
-        FRAGMENT_SHADER(
-            void main(void)
-            {
-                gl_FragColor = vec4(0.0, 0.0, 0.0, 0.0);
-            }
-        );
-
-    const char* vertexShaderSourceClip =
-        VERTEX_SHADER(
-            uniform mat4 InMatrix;
-            attribute vec4 InVertex;
-            void main(void)
-            {
-                gl_Position = InMatrix * InVertex;
-            }
-        );
-
-
-    TEXMAP_BUILD_SHADER(Simple)
-    TEXMAP_BUILD_SHADER(OpacityAndMask)
-    TEXMAP_BUILD_SHADER(Clip)
-
-    TEXMAP_GET_SHADER_VAR_LOCATION(OpacityAndMask, InMatrix)
-    TEXMAP_GET_SHADER_VAR_LOCATION(OpacityAndMask, InSourceMatrix)
-    TEXMAP_GET_SHADER_VAR_LOCATION(OpacityAndMask, InMaskMatrix)
-    TEXMAP_GET_SHADER_VAR_LOCATION(OpacityAndMask, SourceTexture)
-    TEXMAP_GET_SHADER_VAR_LOCATION(OpacityAndMask, MaskTexture)
-    TEXMAP_GET_SHADER_VAR_LOCATION(OpacityAndMask, Opacity)
-
-    TEXMAP_GET_SHADER_VAR_LOCATION(Simple, InSourceMatrix)
-    TEXMAP_GET_SHADER_VAR_LOCATION(Simple, InMatrix)
-    TEXMAP_GET_SHADER_VAR_LOCATION(Simple, SourceTexture)
-    TEXMAP_GET_SHADER_VAR_LOCATION(Simple, Opacity)
-
-    TEXMAP_GET_SHADER_VAR_LOCATION(Clip, InMatrix)
-}
-
 void TextureMapperGL::beginPainting()
 {
     // Make sure that no GL error code stays from previous operations.
@@ -464,7 +290,8 @@ void TextureMapperGL::beginPainting()
 
     glGetIntegerv(GL_CURRENT_PROGRAM, &data().previousProgram);
     data().previousScissorState = glIsEnabled(GL_SCISSOR_TEST);
-
+    data().previousDepthState = glIsEnabled(GL_DEPTH_TEST);
+    glDisable(GL_DEPTH_TEST);
     glEnable(GL_SCISSOR_TEST);
 #if PLATFORM(QT)
     if (m_context) {
@@ -473,23 +300,36 @@ void TextureMapperGL::beginPainting()
         painter->beginNativePainting();
     }
 #endif
-    glClearStencil(0);
-    glClear(GL_STENCIL_BUFFER_BIT);
+    data().didModifyStencil = false;
+    glDepthMask(0);
     glGetIntegerv(GL_VIEWPORT, data().viewport);
+    glGetIntegerv(GL_SCISSOR_BOX, data().previousScissor);
+    data().sharedGLData().clipState.stencilIndex = 1;
+    data().sharedGLData().clipState.scissorBox = IntRect(0, 0, data().viewport[2], data().viewport[3]);
     bindSurface(0);
 }
 
 void TextureMapperGL::endPainting()
 {
-    glClearStencil(1);
-    glClear(GL_STENCIL_BUFFER_BIT);
+    if (data().didModifyStencil) {
+        glClearStencil(1);
+        glClear(GL_STENCIL_BUFFER_BIT);
+    }
+
     glUseProgram(data().previousProgram);
 
+    glScissor(data().previousScissor[0], data().previousScissor[1], data().previousScissor[2], data().previousScissor[3]);
     if (data().previousScissorState)
         glEnable(GL_SCISSOR_TEST);
     else
         glDisable(GL_SCISSOR_TEST);
 
+    if (data().previousDepthState)
+        glEnable(GL_DEPTH_TEST);
+    else
+        glDisable(GL_DEPTH_TEST);
+
+
 #if PLATFORM(QT)
     if (!m_context)
         return;
@@ -504,27 +344,33 @@ void TextureMapperGL::drawTexture(const BitmapTexture& texture, const FloatRect&
 {
     if (!texture.isValid())
         return;
+
+    if (data().sharedGLData().clipState.scissorBox.isEmpty())
+        return;
+
     const BitmapTextureGL& textureGL = static_cast<const BitmapTextureGL&>(texture);
-    drawTexture(textureGL.id(), textureGL.isOpaque(), textureGL.relativeSize(), targetRect, matrix, opacity, mask, false);
+    drawTexture(textureGL.id(), textureGL.isOpaque() ? 0 : SupportsBlending, textureGL.relativeSize(), targetRect, matrix, opacity, mask);
 }
 
-void TextureMapperGL::drawTexture(uint32_t texture, bool opaque, const FloatSize& relativeSize, const FloatRect& targetRect, const TransformationMatrix& modelViewMatrix, float opacity, const BitmapTexture* maskTexture, bool flip)
+void TextureMapperGL::drawTexture(uint32_t texture, Flags flags, const FloatSize& relativeSize, const FloatRect& targetRect, const TransformationMatrix& modelViewMatrix, float opacity, const BitmapTexture* maskTexture)
 {
-    TextureMapperGLData::SharedGLData::ShaderProgramIndex program;
     if (maskTexture)
-        program = TextureMapperGLData::SharedGLData::OpacityAndMaskProgram;
+        drawTextureWithMaskAndOpacity(texture, flags, relativeSize, targetRect, modelViewMatrix, opacity, maskTexture);
     else
-        program = TextureMapperGLData::SharedGLData::SimpleProgram;
+        drawTextureSimple(texture, flags, relativeSize, targetRect, modelViewMatrix, opacity, maskTexture);
+}
+
+void TextureMapperGL::drawTextureWithMaskAndOpacity(uint32_t texture, Flags flags, const FloatSize& relativeSize, const FloatRect& targetRect, const TransformationMatrix& modelViewMatrix, float opacity, const BitmapTexture* maskTexture)
+{
+    RefPtr<TextureMapperShaderProgramOpacityAndMask> shaderInfo = data().sharedGLData().textureMapperShaderManager.getShaderProgram<TextureMapperShaderProgramOpacityAndMask>();
 
-    const TextureMapperGLData::SharedGLData::ProgramInfo& programInfo = data().sharedGLData().programs[program];
-    GL_CMD(glUseProgram(programInfo.id))
-    data().currentProgram = program;
-    GL_CMD(glEnableVertexAttribArray(programInfo.vertexAttrib))
+    GL_CMD(glUseProgram(shaderInfo->id()))
+    GL_CMD(glEnableVertexAttribArray(shaderInfo->vertexAttrib()))
     GL_CMD(glActiveTexture(GL_TEXTURE0))
     GL_CMD(glBindTexture(GL_TEXTURE_2D, texture))
     GL_CMD(glBindBuffer(GL_ARRAY_BUFFER, 0))
     const GLfloat unitRect[] = {0, 0, 1, 0, 1, 1, 0, 1};
-    GL_CMD(glVertexAttribPointer(programInfo.vertexAttrib, 2, GL_FLOAT, GL_FALSE, 0, unitRect))
+    GL_CMD(glVertexAttribPointer(shaderInfo->vertexAttrib(), 2, GL_FLOAT, GL_FALSE, 0, unitRect))
 
     TransformationMatrix matrix = TransformationMatrix(data().projectionMatrix).multiply(modelViewMatrix).multiply(TransformationMatrix(
             targetRect.width(), 0, 0, 0,
@@ -539,16 +385,16 @@ void TextureMapperGL::drawTexture(uint32_t texture, bool opaque, const FloatSize
         matrix.m41(), matrix.m42(), matrix.m43(), matrix.m44()
     };
     const GLfloat m4src[] = {relativeSize.width(), 0, 0, 0,
-                                     0, relativeSize.height() * (flip ? -1 : 1), 0, 0,
+                                     0, relativeSize.height() * ((flags & ShouldFlipTexture) ? -1 : 1), 0, 0,
                                      0, 0, 1, 0,
-                                     0, flip ? relativeSize.height() : 0, 0, 1};
+                                     0, (flags & ShouldFlipTexture) ? relativeSize.height() : 0, 0, 1};
 
-    GL_CMD(glUniformMatrix4fv(programInfo.vars[TextureMapperGLData::SharedGLData::InMatrixVariable], 1, GL_FALSE, m4))
-    GL_CMD(glUniformMatrix4fv(programInfo.vars[TextureMapperGLData::SharedGLData::InSourceMatrixVariable], 1, GL_FALSE, m4src))
-    GL_CMD(glUniform1i(programInfo.vars[TextureMapperGLData::SharedGLData::SourceTextureVariable], 0))
-    GL_CMD(glUniform1f(programInfo.vars[TextureMapperGLData::SharedGLData::OpacityVariable], opacity))
+    GL_CMD(glUniformMatrix4fv(shaderInfo->matrixVariable(), 1, GL_FALSE, m4))
+    GL_CMD(glUniformMatrix4fv(shaderInfo->sourceMatrixVariable(), 1, GL_FALSE, m4src))
+    GL_CMD(glUniform1i(shaderInfo->sourceTextureVariable(), 0))
+    GL_CMD(glUniform1f(shaderInfo->opacityVariable(), opacity))
 
-    if (maskTexture && maskTexture->isValid()) {
+    if (maskTexture->isValid()) {
         const BitmapTextureGL* maskTextureGL = static_cast<const BitmapTextureGL*>(maskTexture);
         GL_CMD(glActiveTexture(GL_TEXTURE1))
         GL_CMD(glBindTexture(GL_TEXTURE_2D, maskTextureGL->id()))
@@ -556,22 +402,62 @@ void TextureMapperGL::drawTexture(uint32_t texture, bool opaque, const FloatSize
                                          0, maskTextureGL->relativeSize().height(), 0, 0,
                                          0, 0, 1, 0,
                                          0, 0, 0, 1};
-        GL_CMD(glUniformMatrix4fv(programInfo.vars[TextureMapperGLData::SharedGLData::InMaskMatrixVariable], 1, GL_FALSE, m4mask));
-        GL_CMD(glUniform1i(programInfo.vars[TextureMapperGLData::SharedGLData::MaskTextureVariable], 1))
+        GL_CMD(glUniformMatrix4fv(shaderInfo->maskMatrixVariable(), 1, GL_FALSE, m4mask));
+        GL_CMD(glUniform1i(shaderInfo->maskTextureVariable(), 1))
         GL_CMD(glActiveTexture(GL_TEXTURE0))
     }
 
-    if (opaque && opacity > 0.99 && !maskTexture)
-        GL_CMD(glDisable(GL_BLEND))
-    else {
+    GL_CMD(glBlendFunc(GL_ONE, GL_ONE_MINUS_SRC_ALPHA))
+    GL_CMD(glEnable(GL_BLEND))
+
+    GL_CMD(glDrawArrays(GL_TRIANGLE_FAN, 0, 4))
+    GL_CMD(glDisableVertexAttribArray(shaderInfo->vertexAttrib()))
+}
+
+void TextureMapperGL::drawTextureSimple(uint32_t texture, Flags flags, const FloatSize& relativeSize, const FloatRect& targetRect, const TransformationMatrix& modelViewMatrix, float opacity, const BitmapTexture*)
+{
+    RefPtr<TextureMapperShaderProgramSimple> shaderInfo = data().sharedGLData().textureMapperShaderManager.getShaderProgram<TextureMapperShaderProgramSimple>();
+
+    GL_CMD(glUseProgram(shaderInfo->id()))
+    GL_CMD(glEnableVertexAttribArray(shaderInfo->vertexAttrib()))
+    GL_CMD(glActiveTexture(GL_TEXTURE0))
+    GL_CMD(glBindTexture(GL_TEXTURE_2D, texture))
+    GL_CMD(glBindBuffer(GL_ARRAY_BUFFER, 0))
+    const GLfloat unitRect[] = {0, 0, 1, 0, 1, 1, 0, 1};
+    GL_CMD(glVertexAttribPointer(shaderInfo->vertexAttrib(), 2, GL_FLOAT, GL_FALSE, 0, unitRect))
+
+    TransformationMatrix matrix = TransformationMatrix(data().projectionMatrix).multiply(modelViewMatrix).multiply(TransformationMatrix(
+            targetRect.width(), 0, 0, 0,
+            0, targetRect.height(), 0, 0,
+            0, 0, 1, 0,
+            targetRect.x(), targetRect.y(), 0, 1));
+
+    const GLfloat m4[] = {
+        matrix.m11(), matrix.m12(), matrix.m13(), matrix.m14(),
+        matrix.m21(), matrix.m22(), matrix.m23(), matrix.m24(),
+        matrix.m31(), matrix.m32(), matrix.m33(), matrix.m34(),
+        matrix.m41(), matrix.m42(), matrix.m43(), matrix.m44()
+    };
+    const GLfloat m4src[] = {relativeSize.width(), 0, 0, 0,
+                                     0, relativeSize.height() * ((flags & ShouldFlipTexture) ? -1 : 1), 0, 0,
+                                     0, 0, 1, 0,
+                                     0, (flags & ShouldFlipTexture) ? relativeSize.height() : 0, 0, 1};
+
+    GL_CMD(glUniformMatrix4fv(shaderInfo->matrixVariable(), 1, GL_FALSE, m4))
+    GL_CMD(glUniformMatrix4fv(shaderInfo->sourceMatrixVariable(), 1, GL_FALSE, m4src))
+    GL_CMD(glUniform1i(shaderInfo->sourceTextureVariable(), 0))
+    GL_CMD(glUniform1f(shaderInfo->opacityVariable(), opacity))
+
+    bool needsBlending = (flags & SupportsBlending) || opacity < 0.99;
+
+    if (needsBlending) {
         GL_CMD(glBlendFunc(GL_ONE, GL_ONE_MINUS_SRC_ALPHA))
         GL_CMD(glEnable(GL_BLEND))
-    }
-
-    GL_CMD(glDisable(GL_DEPTH_TEST))
+    } else
+        GL_CMD(glDisable(GL_BLEND))
 
     GL_CMD(glDrawArrays(GL_TRIANGLE_FAN, 0, 4))
-    GL_CMD(glDisableVertexAttribArray(programInfo.vertexAttrib))
+    GL_CMD(glDisableVertexAttribArray(shaderInfo->vertexAttrib()))
 }
 
 const char* TextureMapperGL::type() const
@@ -579,23 +465,9 @@ const char* TextureMapperGL::type() const
     return "OpenGL";
 }
 
-// This function is similar with GraphicsContext3D::texImage2DResourceSafe.
-static void texImage2DResourceSafe(size_t width, size_t height)
+void BitmapTextureGL::didReset()
 {
-    const int pixelSize = 4; // RGBA
-    OwnArrayPtr<unsigned char> zero;
-    if (width && height) {
-        unsigned int size = width * height * pixelSize;
-        zero = adoptArrayPtr(new unsigned char[size]);
-        memset(zero.get(), 0, size);
-    }
-    GL_CMD(glTexImage2D(GL_TEXTURE_2D, 0, GL_RGBA, width, height, 0, GL_RGBA, GL_UNSIGNED_BYTE, zero.get()))
-}
-
-void BitmapTextureGL::reset(const IntSize& newSize, bool opaque)
-{
-    BitmapTexture::reset(newSize, opaque);
-    IntSize newTextureSize = nextPowerOfTwo(newSize);
+    IntSize newTextureSize = nextPowerOfTwo(contentSize());
     bool justCreated = false;
     if (!m_id) {
         GL_CMD(glGenTextures(1, &m_id))
@@ -609,14 +481,14 @@ void BitmapTextureGL::reset(const IntSize& newSize, bool opaque)
         GL_CMD(glTexParameteri(GL_TEXTURE_2D, GL_TEXTURE_MAG_FILTER, GL_LINEAR))
         GL_CMD(glTexParameteri(GL_TEXTURE_2D, GL_TEXTURE_WRAP_S, GL_CLAMP_TO_EDGE))
         GL_CMD(glTexParameteri(GL_TEXTURE_2D, GL_TEXTURE_WRAP_T, GL_CLAMP_TO_EDGE))
-        texImage2DResourceSafe(m_textureSize.width(), m_textureSize.height());
+        GL_CMD(glTexImage2D(GL_TEXTURE_2D, 0, GL_RGBA, m_textureSize.width(), m_textureSize.height(), 0, GL_RGBA, GL_UNSIGNED_BYTE, 0))
     }
-    m_actualSize = newSize;
-    m_relativeSize = FloatSize(float(newSize.width()) / m_textureSize.width(), float(newSize.height()) / m_textureSize.height());
+
+    // We decrease the size by one, since this is used as rectangle coordinates and not as size.
+    m_relativeSize = FloatSize(float(contentSize().width() - 1) / m_textureSize.width(), float(contentSize().height() - 1) / m_textureSize.height());
     m_surfaceNeedsReset = true;
 }
 
-#if PLATFORM(QT) || (USE(CAIRO) && defined(TEXMAP_OPENGL_ES_2))
 static void swizzleBGRAToRGBA(uint32_t* data, const IntSize& size)
 {
     int width = size.width();
@@ -627,12 +499,38 @@ static void swizzleBGRAToRGBA(uint32_t* data, const IntSize& size)
             p[x] = ((p[x] << 16) & 0xff0000) | ((p[x] >> 16) & 0xff) | (p[x] & 0xff00ff00);
     }
 }
+
+// FIXME: Move this to Extensions3D when we move TextureMapper to use GC3D.
+static bool hasExtension(const char* extension)
+{
+    static Vector<String> availableExtensions;
+    if (!availableExtensions.isEmpty())
+        return availableExtensions.contains(extension);
+    String extensionsString(reinterpret_cast<const char*>(glGetString(GL_EXTENSIONS)));
+    extensionsString.split(" ", availableExtensions);
+    return availableExtensions.contains(extension);
+}
+static bool hasBGRAExtension()
+{
+#if !defined(TEXMAP_OPENGL_ES_2)
+    return true;
 #endif
+    static bool hasBGRA = hasExtension("GL_EXT_texture_format_BGRA8888");
+    return hasBGRA;
+}
 
 void BitmapTextureGL::updateContents(const void* data, const IntRect& targetRect)
 {
+    GLuint glFormat = GL_RGBA;
     GL_CMD(glBindTexture(GL_TEXTURE_2D, m_id))
-    GL_CMD(glTexSubImage2D(GL_TEXTURE_2D, 0, targetRect.x(), targetRect.y(), targetRect.width(), targetRect.height(), GL_RGBA, GL_UNSIGNED_BYTE, data))
+    if (hasBGRAExtension())
+        glFormat = GL_BGRA;
+    else {
+        swizzleBGRAToRGBA(static_cast<uint32_t*>(const_cast<void*>(data)), targetRect.size());
+        glFormat = GL_RGBA;
+    }
+
+    GL_CMD(glTexSubImage2D(GL_TEXTURE_2D, 0, targetRect.x(), targetRect.y(), targetRect.width(), targetRect.height(), glFormat, GL_UNSIGNED_BYTE, data))
 }
 
 void BitmapTextureGL::updateContents(Image* image, const IntRect& targetRect, const IntRect& sourceRect, BitmapTexture::PixelFormat format)
@@ -658,8 +556,12 @@ void BitmapTextureGL::updateContents(Image* image, const IntRect& targetRect, co
 
     if (IntSize(qtImage.size()) != sourceRect.size())
         qtImage = qtImage.copy(sourceRect);
-    if (format == BGRAFormat || format == BGRFormat)
-        swizzleBGRAToRGBA(reinterpret_cast<uint32_t*>(qtImage.bits()), qtImage.size());
+    if (format == BGRAFormat || format == BGRFormat) {
+        if (hasBGRAExtension())
+            glFormat = isOpaque() ? GL_BGR : GL_BGRA;
+        else
+            swizzleBGRAToRGBA(reinterpret_cast<uint32_t*>(qtImage.bits()), qtImage.size());
+    }
     GL_CMD(glTexSubImage2D(GL_TEXTURE_2D, 0, targetRect.x(), targetRect.y(), targetRect.width(), targetRect.height(), glFormat, GL_UNSIGNED_BYTE, qtImage.constBits()))
 
 #elif USE(CAIRO)
@@ -698,39 +600,40 @@ static inline TransformationMatrix createProjectionMatrix(const IntSize& size, b
                                 -1, flip ? 1 : -1, -(far + near) / (far - near), 1);
 }
 
+void BitmapTextureGL::initializeStencil()
+{
+    if (m_rbo)
+        return;
+    GL_CMD(glGenRenderbuffers(1, &m_rbo));
+    GL_CMD(glBindRenderbuffer(GL_RENDERBUFFER, m_rbo))
+#ifdef TEXMAP_OPENGL_ES_2
+    GL_CMD(glRenderbufferStorage(GL_RENDERBUFFER, GL_STENCIL_INDEX8, m_textureSize.width(), m_textureSize.height()))
+#else
+    GL_CMD(glRenderbufferStorage(GL_RENDERBUFFER, GL_DEPTH_STENCIL, m_textureSize.width(), m_textureSize.height()))
+#endif
+    GL_CMD(glBindRenderbuffer(GL_RENDERBUFFER, 0))
+    GL_CMD(glFramebufferRenderbuffer(GL_FRAMEBUFFER, GL_STENCIL_ATTACHMENT, GL_RENDERBUFFER, m_rbo))
+    GL_CMD(glClearStencil(0))
+    GL_CMD(glClear(GL_STENCIL_BUFFER_BIT))
+}
+
 void BitmapTextureGL::bind()
 {
-    int& stencilIndex = m_textureMapper->data().sharedGLData().stencilIndex;
     if (m_surfaceNeedsReset || !m_fbo) {
         if (!m_fbo)
             GL_CMD(glGenFramebuffers(1, &m_fbo))
-        if (!m_rbo)
-            GL_CMD(glGenRenderbuffers(1, &m_rbo));
-        GL_CMD(glBindRenderbuffer(GL_RENDERBUFFER, m_rbo))
-#ifdef TEXMAP_OPENGL_ES_2
-        GL_CMD(glRenderbufferStorage(GL_RENDERBUFFER, GL_STENCIL_INDEX8, m_textureSize.width(), m_textureSize.height()))
-#else
-        GL_CMD(glRenderbufferStorage(GL_RENDERBUFFER, GL_DEPTH_STENCIL, m_textureSize.width(), m_textureSize.height()))
-#endif
         GL_CMD(glBindFramebuffer(GL_FRAMEBUFFER, m_fbo))
         GL_CMD(glBindTexture(GL_TEXTURE_2D, 0))
-        GL_CMD(glBindRenderbuffer(GL_RENDERBUFFER, 0))
         GL_CMD(glFramebufferTexture2D(GL_FRAMEBUFFER, GL_COLOR_ATTACHMENT0, GL_TEXTURE_2D, id(), 0))
-        GL_CMD(glFramebufferRenderbuffer(GL_FRAMEBUFFER, GL_STENCIL_ATTACHMENT, GL_RENDERBUFFER, m_rbo))
-#ifndef TEXMAP_OPENGL_ES_2
-        GL_CMD(glFramebufferRenderbuffer(GL_FRAMEBUFFER, GL_DEPTH_ATTACHMENT, GL_RENDERBUFFER, m_rbo));
-#endif
         GL_CMD(glClearColor(0, 0, 0, 0))
-        GL_CMD(glClearStencil(stencilIndex - 1))
-        GL_CMD(glClear(GL_STENCIL_BUFFER_BIT | GL_COLOR_BUFFER_BIT | GL_DEPTH_BUFFER_BIT))
+        GL_CMD(glClear(GL_COLOR_BUFFER_BIT))
         m_surfaceNeedsReset = false;
     } else
         GL_CMD(glBindFramebuffer(GL_FRAMEBUFFER, m_fbo))
 
-    glStencilOp(GL_KEEP, GL_KEEP, GL_KEEP);
-    glStencilFunc(stencilIndex > 1 ? GL_GEQUAL : GL_ALWAYS, stencilIndex - 1, stencilIndex - 1);
     GL_CMD(glViewport(0, 0, size().width(), size().height()))
     m_textureMapper->data().projectionMatrix = createProjectionMatrix(size(), false);
+    m_textureMapper->beginClip(TransformationMatrix(), FloatRect(IntPoint::zero(), contentSize()));
 }
 
 void BitmapTextureGL::destroy()
@@ -745,6 +648,7 @@ void BitmapTextureGL::destroy()
         GL_CMD(glDeleteRenderbuffers(1, &m_rbo))
 
     m_fbo = 0;
+    m_rbo = 0;
     m_id = 0;
     m_textureSize = IntSize();
     m_relativeSize = FloatSize(1, 1);
@@ -773,21 +677,16 @@ void TextureMapperGL::bindSurface(BitmapTexture *surfacePointer)
         IntSize viewportSize(data().viewport[2], data().viewport[3]);
         GL_CMD(glBindFramebuffer(GL_FRAMEBUFFER, 0))
         data().projectionMatrix = createProjectionMatrix(viewportSize, true);
-        GL_CMD(glStencilFunc(data().sharedGLData().stencilIndex > 1 ? GL_EQUAL : GL_ALWAYS, data().sharedGLData().stencilIndex - 1, data().sharedGLData().stencilIndex - 1))
-        GL_CMD(glStencilOp(GL_KEEP, GL_KEEP, GL_KEEP))
         GL_CMD(glViewport(0, 0, viewportSize.width(), viewportSize.height()))
-        data().sharedGLData().clipStack.append(IntRect(data().viewport[0], data().viewport[1], data().viewport[2], data().viewport[3]));
+        if (data().currentSurface)
+            endClip();
+        data().currentSurface.clear();
         return;
     }
 
-    surface->bind();
-}
 
-static void scissorClip(const IntRect& rect)
-{
-    GLint viewport[4];
-    glGetIntegerv(GL_VIEWPORT, viewport);
-    glScissor(rect.x(), viewport[3] - rect.maxY(), rect.width(), rect.height());
+    surface->bind();
+    data().currentSurface = surface;
 }
 
 bool TextureMapperGL::beginScissorClip(const TransformationMatrix& modelViewMatrix, const FloatRect& targetRect)
@@ -796,44 +695,28 @@ bool TextureMapperGL::beginScissorClip(const TransformationMatrix& modelViewMatr
     IntRect rect = quad.enclosingBoundingBox();
 
     // Only use scissors on rectilinear clips.
-    if (!quad.isRectilinear() || rect.isEmpty()) {
-        data().sharedGLData().clipStack.append(IntRect());
+    if (!quad.isRectilinear() || rect.isEmpty())
         return false;
-    }
-
-    // Intersect with previous clip.
-    if (!data().sharedGLData().clipStack.isEmpty())
-        rect.intersect(data().sharedGLData().clipStack.last());
-
-    scissorClip(rect);
-    data().sharedGLData().clipStack.append(rect);
 
-    return true;
-}
-
-bool TextureMapperGL::endScissorClip()
-{
-    data().sharedGLData().clipStack.removeLast();
-    ASSERT(!data().sharedGLData().clipStack.isEmpty());
-
-    IntRect rect = data().sharedGLData().clipStack.last();
-    if (rect.isEmpty())
-        return false;
-
-    scissorClip(rect);
+    data().sharedGLData().clipState.scissorBox.intersect(rect);
+    data().sharedGLData().applyCurrentClip();
     return true;
 }
 
 void TextureMapperGL::beginClip(const TransformationMatrix& modelViewMatrix, const FloatRect& targetRect)
 {
+    data().sharedGLData().pushClipState();
     if (beginScissorClip(modelViewMatrix, targetRect))
         return;
-    TextureMapperGLData::SharedGLData::ShaderProgramIndex program = TextureMapperGLData::SharedGLData::ClipProgram;
-    const TextureMapperGLData::SharedGLData::ProgramInfo& programInfo = data().sharedGLData().programs[program];
-    GL_CMD(glUseProgram(programInfo.id))
-    GL_CMD(glEnableVertexAttribArray(programInfo.vertexAttrib))
+
+    data().initializeStencil();
+
+    RefPtr<TextureMapperShaderProgramSimple> shaderInfo = data().sharedGLData().textureMapperShaderManager.getShaderProgram<TextureMapperShaderProgramSimple>();
+
+    GL_CMD(glUseProgram(shaderInfo->id()))
+    GL_CMD(glEnableVertexAttribArray(shaderInfo->vertexAttrib()))
     const GLfloat unitRect[] = {0, 0, 1, 0, 1, 1, 0, 1};
-    GL_CMD(glVertexAttribPointer(programInfo.vertexAttrib, 2, GL_FLOAT, GL_FALSE, 0, unitRect))
+    GL_CMD(glVertexAttribPointer(shaderInfo->vertexAttrib(), 2, GL_FLOAT, GL_FALSE, 0, unitRect))
 
     TransformationMatrix matrix = TransformationMatrix(data().projectionMatrix)
             .multiply(modelViewMatrix)
@@ -849,32 +732,46 @@ void TextureMapperGL::beginClip(const TransformationMatrix& modelViewMatrix, con
         matrix.m41(), matrix.m42(), matrix.m43(), matrix.m44()
     };
 
-    int& stencilIndex = data().sharedGLData().stencilIndex;
+    const GLfloat m4all[] = {
+        2, 0, 0, 0,
+        0, 2, 0, 0,
+        0, 0, 1, 0,
+        -1, -1, 0, 1
+    };
+
+    int& stencilIndex = data().sharedGLData().clipState.stencilIndex;
 
-    GL_CMD(glUniformMatrix4fv(programInfo.vars[TextureMapperGLData::SharedGLData::InMatrixVariable], 1, GL_FALSE, m4))
     GL_CMD(glEnable(GL_STENCIL_TEST))
+
+    // Make sure we don't do any actual drawing.
     GL_CMD(glStencilFunc(GL_NEVER, stencilIndex, stencilIndex))
-    GL_CMD(glStencilOp(GL_REPLACE, GL_REPLACE, GL_REPLACE))
+
+    // Operate only on the stencilIndex and above.
     GL_CMD(glStencilMask(0xff & ~(stencilIndex - 1)))
+
+    // First clear the entire buffer at the current index.
+    GL_CMD(glUniformMatrix4fv(shaderInfo->matrixVariable(), 1, GL_FALSE, m4all))
+    GL_CMD(glStencilOp(GL_ZERO, GL_ZERO, GL_ZERO))
     GL_CMD(glDrawArrays(GL_TRIANGLE_FAN, 0, 4))
-    GL_CMD(glStencilOp(GL_KEEP, GL_KEEP, GL_KEEP))
-    stencilIndex <<= 1;
-    glStencilFunc(stencilIndex > 1 ? GL_EQUAL : GL_ALWAYS, stencilIndex - 1, stencilIndex - 1);
-    GL_CMD(glDisableVertexAttribArray(programInfo.vertexAttrib))
-}
 
-void TextureMapperGL::endClip()
-{
-    if (endScissorClip())
-        return;
+    // Now apply the current index to the new quad.
+    GL_CMD(glStencilOp(GL_REPLACE, GL_REPLACE, GL_REPLACE))
+    GL_CMD(glUniformMatrix4fv(shaderInfo->matrixVariable(), 1, GL_FALSE, m4))
+    GL_CMD(glDrawArrays(GL_TRIANGLE_FAN, 0, 4))
 
-    data().sharedGLData().stencilIndex >>= 1;
-    glStencilFunc(data().sharedGLData().stencilIndex > 1 ? GL_EQUAL : GL_ALWAYS, data().sharedGLData().stencilIndex - 1, data().sharedGLData().stencilIndex - 1);    
+    // Clear the state.
+    GL_CMD(glDisableVertexAttribArray(shaderInfo->vertexAttrib()))
+    GL_CMD(glStencilMask(0))
 
-    // After we've cleared the last non-rectalinear clip, we disable the stencil test.
-    if (data().sharedGLData().stencilIndex == 1)
-        GL_CMD(glDisable(GL_STENCIL_TEST))
+    // Increase stencilIndex and apply stencil testing.
+    stencilIndex *= 2;
+    data().sharedGLData().applyCurrentClip();
+}
 
+void TextureMapperGL::endClip()
+{
+    data().sharedGLData().popClipState();
+    data().sharedGLData().applyCurrentClip();
 }
 
 PassRefPtr<BitmapTexture> TextureMapperGL::createTexture()
diff --git a/Source/WebCore/platform/graphics/opengl/TextureMapperGL.h b/Source/WebCore/platform/graphics/texmap/TextureMapperGL.h
index 08fa0adef..3e598904b 100644
--- a/Source/WebCore/platform/graphics/opengl/TextureMapperGL.h
+++ b/Source/WebCore/platform/graphics/texmap/TextureMapperGL.h
@@ -38,14 +38,24 @@ public:
     TextureMapperGL();
     virtual ~TextureMapperGL();
 
+    enum Flag {
+        SupportsBlending = 0x01,
+        ShouldFlipTexture = 0x02
+    };
+
+    typedef int Flags;
+
     // reimps from TextureMapper
     virtual void drawTexture(const BitmapTexture&, const FloatRect&, const TransformationMatrix&, float opacity, const BitmapTexture* maskTexture);
-    virtual void drawTexture(uint32_t texture, bool opaque, const FloatSize&, const FloatRect&, const TransformationMatrix&, float opacity, const BitmapTexture* maskTexture, bool flip);
+    virtual void drawTexture(uint32_t texture, Flags, const FloatSize&, const FloatRect&, const TransformationMatrix&, float opacity, const BitmapTexture* maskTexture);
+    virtual void drawTextureWithMaskAndOpacity(uint32_t texture, Flags, const FloatSize&, const FloatRect&, const TransformationMatrix&, float opacity, const BitmapTexture* maskTexture);
+    virtual void drawTextureSimple(uint32_t texture, Flags, const FloatSize&, const FloatRect&, const TransformationMatrix&, float opacity, const BitmapTexture* maskTexture);
     virtual void bindSurface(BitmapTexture* surface);
     virtual void beginClip(const TransformationMatrix&, const FloatRect&);
     virtual void beginPainting();
     virtual void endPainting();
     virtual void endClip();
+    virtual IntSize maxTextureSize() { return IntSize(2000, 2000); }
     virtual PassRefPtr<BitmapTexture> createTexture();
     virtual const char* type() const;
     static PassOwnPtr<TextureMapperGL> create() { return adoptPtr(new TextureMapperGL); }
@@ -57,7 +67,6 @@ public:
 
 private:
     bool beginScissorClip(const TransformationMatrix&, const FloatRect&);
-    bool endScissorClip();
     inline TextureMapperGLData& data() { return *m_data; }
     TextureMapperGLData* m_data;
     GraphicsContext* m_context;
diff --git a/Source/WebCore/platform/graphics/texmap/TextureMapperImageBuffer.cpp b/Source/WebCore/platform/graphics/texmap/TextureMapperImageBuffer.cpp
index 783b03bf7..e53b9f8d6 100644
--- a/Source/WebCore/platform/graphics/texmap/TextureMapperImageBuffer.cpp
+++ b/Source/WebCore/platform/graphics/texmap/TextureMapperImageBuffer.cpp
@@ -20,6 +20,8 @@
 #include "config.h"
 #include "TextureMapperImageBuffer.h"
 
+#include "FilterEffectRenderer.h"
+
 #if USE(TEXTURE_MAPPER)
 namespace WebCore {
 
@@ -35,6 +37,11 @@ void BitmapTextureImageBuffer::updateContents(const void* data, const IntRect& t
 #endif
 }
 
+void BitmapTextureImageBuffer::didReset()
+{
+    m_image = ImageBuffer::create(contentSize());
+}
+
 void BitmapTextureImageBuffer::updateContents(Image* image, const IntRect& targetRect, const IntRect& sourceRect, PixelFormat)
 {
     m_image->context()->drawImage(image, ColorSpaceDeviceRGB, targetRect, sourceRect, CompositeCopy);
@@ -101,5 +108,21 @@ void TextureMapperImageBuffer::drawTexture(const BitmapTexture& texture, const F
     context->restore();
 }
 
+#if ENABLE(CSS_FILTERS)
+void BitmapTextureImageBuffer::applyFilters(const BitmapTexture& contentTexture, const FilterOperations& filters)
+{
+    RefPtr<FilterEffectRenderer> renderer = FilterEffectRenderer::create(0);
+    renderer->setSourceImageRect(FloatRect(FloatPoint::zero(), contentTexture.size()));
+
+    // The document parameter is only needed for CSS shaders.
+    renderer->build(0 /*document */, filters);
+    renderer->prepare();
+    GraphicsContext* context = renderer->inputContext();
+    context->drawImageBuffer(static_cast<const BitmapTextureImageBuffer&>(contentTexture).m_image.get(), ColorSpaceDeviceRGB, IntPoint::zero());
+    renderer->apply();
+    m_image->context()->drawImageBuffer(renderer->output(), ColorSpaceDeviceRGB, renderer->outputRect());
+}
+#endif
+
 }
 #endif
diff --git a/Source/WebCore/platform/graphics/texmap/TextureMapperImageBuffer.h b/Source/WebCore/platform/graphics/texmap/TextureMapperImageBuffer.h
index 8411206cf..0b363a33a 100644
--- a/Source/WebCore/platform/graphics/texmap/TextureMapperImageBuffer.h
+++ b/Source/WebCore/platform/graphics/texmap/TextureMapperImageBuffer.h
@@ -33,16 +33,15 @@ public:
     ~BitmapTextureImageBuffer() { destroy(); }
     virtual void destroy() { m_image.clear(); }
     virtual IntSize size() const { return m_image->size(); }
-    virtual void reset(const IntSize& size, bool opaque)
-    {
-        BitmapTexture::reset(size, opaque);
-        m_image = ImageBuffer::create(size);
-    }
-
+    virtual void didReset();
     virtual bool isValid() const { return m_image; }
     inline GraphicsContext* graphicsContext() { return m_image ? m_image->context() : 0; }
     virtual void updateContents(Image*, const IntRect&, const IntRect&, PixelFormat);
     void updateContents(const void* data, const IntRect& targetRect);
+#if ENABLE(CSS_FILTERS)
+    void applyFilters(const BitmapTexture&, const FilterOperations&);
+#endif
+
 private:
     BitmapTextureImageBuffer() { }
     OwnPtr<ImageBuffer> m_image;
diff --git a/Source/WebCore/platform/graphics/texmap/TextureMapperLayer.cpp b/Source/WebCore/platform/graphics/texmap/TextureMapperLayer.cpp
new file mode 100644
index 000000000..da0b40e36
--- /dev/null
+++ b/Source/WebCore/platform/graphics/texmap/TextureMapperLayer.cpp
@@ -0,0 +1,514 @@
+/*
+ Copyright (C) 2010 Nokia Corporation and/or its subsidiary(-ies)
+
+ This library is free software; you can redistribute it and/or
+ modify it under the terms of the GNU Library General Public
+ License as published by the Free Software Foundation; either
+ version 2 of the License, or (at your option) any later version.
+
+ This library is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ Library General Public License for more details.
+
+ You should have received a copy of the GNU Library General Public License
+ along with this library; see the file COPYING.LIB.  If not, write to
+ the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ Boston, MA 02110-1301, USA.
+ */
+
+#include "config.h"
+#include "TextureMapperLayer.h"
+
+#include "stdio.h"
+
+#if USE(ACCELERATED_COMPOSITING)
+
+#include "GraphicsLayerTextureMapper.h"
+#include "ImageBuffer.h"
+#include "MathExtras.h"
+
+namespace WebCore {
+
+TextureMapperLayer* toTextureMapperLayer(GraphicsLayer* layer)
+{
+    return layer ? toGraphicsLayerTextureMapper(layer)->layer() : 0;
+}
+
+TextureMapperLayer* TextureMapperLayer::rootLayer()
+{
+    if (m_effectTarget)
+        return m_effectTarget->rootLayer();
+    if (m_parent)
+        return m_parent->rootLayer();
+    return this;
+}
+
+void TextureMapperLayer::setTransform(const TransformationMatrix& matrix)
+{
+    m_transform.setLocalTransform(matrix);
+}
+
+void TextureMapperLayer::clearBackingStoresRecursive()
+{
+    m_backingStore.clear();
+    m_contentsLayer = 0;
+    for (size_t i = 0; i < m_children.size(); ++i)
+        m_children[i]->clearBackingStoresRecursive();
+    if (m_state.maskLayer)
+        m_state.maskLayer->clearBackingStoresRecursive();
+}
+
+void TextureMapperLayer::computeTransformsRecursive()
+{
+    if (m_size.isEmpty() && m_state.masksToBounds)
+        return;
+
+    // Compute transforms recursively on the way down to leafs.
+    TransformationMatrix parentTransform;
+    if (m_parent)
+        parentTransform = m_parent->m_transform.combinedForChildren();
+    else if (m_effectTarget)
+        parentTransform = m_effectTarget->m_transform.combined();
+    m_transform.combineTransforms(parentTransform);
+
+    m_state.visible = m_state.backfaceVisibility || m_transform.combined().inverse().m33() >= 0;
+
+    if (m_parent && m_parent->m_state.preserves3D)
+        m_centerZ = m_transform.combined().mapPoint(FloatPoint3D(m_size.width() / 2, m_size.height() / 2, 0)).z();
+
+    if (m_state.maskLayer)
+        m_state.maskLayer->computeTransformsRecursive();
+    if (m_state.replicaLayer)
+        m_state.replicaLayer->computeTransformsRecursive();
+    for (size_t i = 0; i < m_children.size(); ++i)
+        m_children[i]->computeTransformsRecursive();
+
+    // Reorder children if needed on the way back up.
+    if (m_state.preserves3D)
+        sortByZOrder(m_children, 0, m_children.size());
+}
+
+void TextureMapperLayer::updateBackingStore(TextureMapper* textureMapper, GraphicsLayer* layer)
+{
+    if (!layer || !textureMapper)
+        return;
+
+    if (!m_shouldUpdateBackingStoreFromLayer)
+        return;
+
+    if (!m_state.drawsContent || m_size.isEmpty()) {
+        m_backingStore.clear();
+        return;
+    }
+
+    IntRect dirtyRect = enclosingIntRect(m_state.needsDisplay ? layerRect() : m_state.needsDisplayRect);
+    if (dirtyRect.isEmpty())
+        return;
+
+    if (!m_backingStore)
+        m_backingStore = TextureMapperTiledBackingStore::create();
+
+#if PLATFORM(QT)
+    ASSERT(dynamic_cast<TextureMapperTiledBackingStore*>(m_backingStore.get()));
+#endif
+
+    // Paint the entire dirty rect into an image buffer. This ensures we only paint once.
+    OwnPtr<ImageBuffer> imageBuffer = ImageBuffer::create(dirtyRect.size());
+    GraphicsContext* context = imageBuffer->context();
+    context->setImageInterpolationQuality(textureMapper->imageInterpolationQuality());
+    context->setTextDrawingMode(textureMapper->textDrawingMode());
+    context->translate(-dirtyRect.x(), -dirtyRect.y());
+    layer->paintGraphicsLayerContents(*context, dirtyRect);
+
+    RefPtr<Image> image;
+
+#if PLATFORM(QT)
+    image = imageBuffer->copyImage(DontCopyBackingStore);
+#else
+    // FIXME: support DontCopyBackingStore in non-Qt ports that use TextureMapper.
+    image = imageBuffer->copyImage(CopyBackingStore);
+#endif
+
+    static_cast<TextureMapperTiledBackingStore*>(m_backingStore.get())->updateContents(textureMapper, image.get(), m_size, dirtyRect, BitmapTexture::BGRAFormat);
+}
+
+void TextureMapperLayer::paint()
+{
+    computeTransformsRecursive();
+
+    TextureMapperPaintOptions options;
+    options.textureMapper = m_textureMapper;
+    options.textureMapper->bindSurface(0);
+    paintRecursive(options);
+}
+
+void TextureMapperLayer::paintSelf(const TextureMapperPaintOptions& options)
+{
+    // We apply the following transform to compensate for painting into a surface, and then apply the offset so that the painting fits in the target rect.
+    TransformationMatrix transform =
+            TransformationMatrix(options.transform)
+            .multiply(m_transform.combined())
+            .translate(options.offset.width(), options.offset.height());
+
+    float opacity = options.opacity;
+    RefPtr<BitmapTexture> mask = options.mask;
+
+    if (m_backingStore)
+        m_backingStore->paintToTextureMapper(options.textureMapper, layerRect(), transform, opacity, mask.get());
+
+    if (m_contentsLayer)
+        m_contentsLayer->paintToTextureMapper(options.textureMapper, m_state.contentsRect, transform, opacity, mask.get());
+}
+
+int TextureMapperLayer::compareGraphicsLayersZValue(const void* a, const void* b)
+{
+    TextureMapperLayer* const* layerA = static_cast<TextureMapperLayer* const*>(a);
+    TextureMapperLayer* const* layerB = static_cast<TextureMapperLayer* const*>(b);
+    return int(((*layerA)->m_centerZ - (*layerB)->m_centerZ) * 1000);
+}
+
+void TextureMapperLayer::sortByZOrder(Vector<TextureMapperLayer* >& array, int first, int last)
+{
+    qsort(array.data(), array.size(), sizeof(TextureMapperLayer*), compareGraphicsLayersZValue);
+}
+
+void TextureMapperLayer::paintSelfAndChildren(const TextureMapperPaintOptions& options)
+{
+    paintSelf(options);
+
+    if (m_children.isEmpty())
+        return;
+
+    bool shouldClip = m_state.masksToBounds && !m_state.preserves3D;
+    if (shouldClip)
+        options.textureMapper->beginClip(TransformationMatrix(options.transform).multiply(m_transform.combined()), layerRect());
+
+    for (int i = 0; i < m_children.size(); ++i)
+        m_children[i]->paintRecursive(options);
+
+    if (shouldClip)
+        options.textureMapper->endClip();
+}
+
+IntRect TextureMapperLayer::intermediateSurfaceRect()
+{
+    // FIXME: Add an inverse transform to LayerTransform.
+    return intermediateSurfaceRect(m_transform.combined().inverse());
+}
+
+IntRect TextureMapperLayer::intermediateSurfaceRect(const TransformationMatrix& matrix)
+{
+    IntRect rect;
+    TransformationMatrix localTransform = TransformationMatrix(matrix).multiply(m_transform.combined());
+    rect = enclosingIntRect(localTransform.mapRect(layerRect()));
+    if (!m_state.masksToBounds && !m_state.maskLayer) {
+        for (size_t i = 0; i < m_children.size(); ++i)
+            rect.unite(m_children[i]->intermediateSurfaceRect(matrix));
+    }
+
+    if (m_state.replicaLayer)
+        rect.unite(m_state.replicaLayer->intermediateSurfaceRect(matrix));
+
+    return rect;
+}
+
+bool TextureMapperLayer::shouldPaintToIntermediateSurface() const
+{
+#if ENABLE(CSS_FILTERS)
+    if (m_state.filters.size())
+        return true;
+#endif
+    bool hasOpacity = m_opacity < 0.99;
+    bool hasChildren = !m_children.isEmpty();
+    bool hasReplica = !!m_state.replicaLayer;
+    bool hasMask = !!m_state.maskLayer;
+
+    // We don't use two-pass blending for preserves-3d, that's in sync with Safari.
+    if (m_state.preserves3D)
+        return false;
+
+    // We should use an intermediate surface when blending several items with an ancestor opacity.
+    // Tested by compositing/reflections/reflection-opacity.html
+    if (hasOpacity && (hasChildren || hasReplica))
+        return true;
+
+    // We should use an intermediate surface with a masked ancestor.
+    // In the case of replicas the mask is applied before replicating.
+    // Tested by compositing/masks/masked-ancestor.html
+    if (hasMask && hasChildren && !hasReplica)
+        return true;
+
+    return false;
+}
+
+bool TextureMapperLayer::isVisible() const
+{
+    if (m_size.isEmpty() && (m_state.masksToBounds || m_state.maskLayer || m_children.isEmpty()))
+        return false;
+    if (!m_state.visible || m_opacity < 0.01)
+        return false;
+    return true;
+}
+
+void TextureMapperLayer::paintSelfAndChildrenWithReplica(const TextureMapperPaintOptions& options)
+{
+    if (m_state.replicaLayer) {
+        TextureMapperPaintOptions replicaOptions(options);
+        // We choose either the content's mask or the replica's mask.
+        // FIXME: blend the two if both exist.
+        if (m_state.replicaLayer->m_state.maskLayer)
+            replicaOptions.mask = m_state.replicaLayer->m_state.maskLayer->texture();
+
+        replicaOptions.transform
+                  .multiply(m_state.replicaLayer->m_transform.combined())
+                  .multiply(m_transform.combined().inverse());
+        paintSelfAndChildren(replicaOptions);
+    }
+
+    paintSelfAndChildren(options);
+}
+
+#if ENABLE(CSS_FILTERS)
+static PassRefPtr<BitmapTexture> applyFilters(const FilterOperations& filters, TextureMapper* textureMapper, BitmapTexture* source, IntRect& targetRect)
+{
+    if (!filters.size())
+        return source;
+
+    RefPtr<BitmapTexture> filterSurface(source);
+    int leftOutset, topOutset, bottomOutset, rightOutset;
+    if (filters.hasOutsets()) {
+        filters.getOutsets(topOutset, rightOutset, bottomOutset, leftOutset);
+        IntRect unfilteredTargetRect(targetRect);
+        targetRect.move(std::max(0, -leftOutset), std::max(0, -topOutset));
+        targetRect.expand(leftOutset + rightOutset, topOutset + bottomOutset);
+        targetRect.unite(unfilteredTargetRect);
+        filterSurface = textureMapper->acquireTextureFromPool(targetRect.size());
+    }
+
+    filterSurface->applyFilters(*source, filters);
+    return filterSurface;
+}
+#endif
+
+void TextureMapperLayer::paintRecursive(const TextureMapperPaintOptions& options)
+{
+    if (!isVisible())
+        return;
+
+    float opacity = options.opacity * m_opacity;
+    RefPtr<BitmapTexture> maskTexture = m_state.maskLayer ? m_state.maskLayer->texture() : 0;
+
+    TextureMapperPaintOptions paintOptions(options);
+    paintOptions.mask = maskTexture.get();
+    IntRect surfaceRect;
+
+    RefPtr<BitmapTexture> surface;
+
+    if (!shouldPaintToIntermediateSurface()) {
+        paintOptions.opacity = opacity;
+        paintSelfAndChildrenWithReplica(paintOptions);
+        return;
+    }
+
+    // Prepare a surface to paint into.
+    // We paint into the surface ignoring the opacity/transform of the current layer.
+    surfaceRect = intermediateSurfaceRect();
+    surface = options.textureMapper->acquireTextureFromPool(surfaceRect.size());
+    options.textureMapper->bindSurface(surface.get());
+    paintOptions.opacity = 1;
+
+    // We have to use combinedForChildren() and not combined(), otherwise preserve-3D doesn't work.
+    paintOptions.transform = m_transform.combinedForChildren().inverse();
+    paintOptions.offset = -IntSize(surfaceRect.x(), surfaceRect.y());
+
+    paintSelfAndChildrenWithReplica(paintOptions);
+
+    // If we painted the replica, the mask is already applied so we don't need to paint it again.
+    if (m_state.replicaLayer)
+        maskTexture = 0;
+
+#if ENABLE(CSS_FILTERS)
+    surface = applyFilters(m_state.filters, options.textureMapper, surface.get(), surfaceRect);
+#endif
+
+    options.textureMapper->bindSurface(options.surface.get());
+    TransformationMatrix targetTransform =
+            TransformationMatrix(options.transform)
+                .multiply(m_transform.combined())
+                .translate(options.offset.width(), options.offset.height());
+    options.textureMapper->drawTexture(*surface.get(), surfaceRect, targetTransform, opacity, maskTexture.get());
+}
+
+TextureMapperLayer::~TextureMapperLayer()
+{
+    for (int i = m_children.size() - 1; i >= 0; --i)
+        m_children[i]->m_parent = 0;
+
+    if (m_parent)
+        m_parent->m_children.remove(m_parent->m_children.find(this));
+}
+
+void TextureMapperLayer::syncCompositingState(GraphicsLayerTextureMapper* graphicsLayer, int options)
+{
+    syncCompositingState(graphicsLayer, rootLayer()->m_textureMapper, options);
+}
+
+void TextureMapperLayer::syncCompositingStateSelf(GraphicsLayerTextureMapper* graphicsLayer, TextureMapper* textureMapper)
+{
+    int changeMask = graphicsLayer->changeMask();
+
+    if (changeMask == NoChanges && graphicsLayer->m_animations.isEmpty())
+        return;
+
+    if (changeMask & ParentChange) {
+        TextureMapperLayer* newParent = toTextureMapperLayer(graphicsLayer->parent());
+        if (newParent != m_parent) {
+            // Remove layer from current from child list first.
+            if (m_parent) {
+                size_t index = m_parent->m_children.find(this);
+                m_parent->m_children.remove(index);
+                m_parent = 0;
+            }
+            // Set new layer parent and add layer to the parents child list.
+            if (newParent) {
+                m_parent = newParent;
+                m_parent->m_children.append(this);
+            }
+        }
+    }
+
+    if (changeMask & ChildrenChange) {
+        // Clear children parent pointer to avoid unsync and crash on layer delete.
+        for (size_t i = 0; i < m_children.size(); i++)
+            m_children[i]->m_parent = 0;
+
+        m_children.clear();
+        for (size_t i = 0; i < graphicsLayer->children().size(); ++i) {
+            TextureMapperLayer* child = toTextureMapperLayer(graphicsLayer->children()[i]);
+            if (!child)
+                continue;
+            m_children.append(child);
+            child->m_parent = this;
+        }
+    }
+
+    m_size = graphicsLayer->size();
+
+    if (changeMask & MaskLayerChange) {
+       if (TextureMapperLayer* layer = toTextureMapperLayer(graphicsLayer->maskLayer()))
+           layer->m_effectTarget = this;
+    }
+
+    if (changeMask & ReplicaLayerChange) {
+       if (TextureMapperLayer* layer = toTextureMapperLayer(graphicsLayer->replicaLayer()))
+           layer->m_effectTarget = this;
+    }
+
+    if (changeMask & AnimationChange)
+        m_animations = graphicsLayer->m_animations;
+
+    m_state.maskLayer = toTextureMapperLayer(graphicsLayer->maskLayer());
+    m_state.replicaLayer = toTextureMapperLayer(graphicsLayer->replicaLayer());
+    m_state.pos = graphicsLayer->position();
+    m_state.anchorPoint = graphicsLayer->anchorPoint();
+    m_state.size = graphicsLayer->size();
+    m_state.contentsRect = graphicsLayer->contentsRect();
+    m_state.transform = graphicsLayer->transform();
+    m_state.contentsRect = graphicsLayer->contentsRect();
+    m_state.preserves3D = graphicsLayer->preserves3D();
+    m_state.masksToBounds = graphicsLayer->masksToBounds();
+    m_state.drawsContent = graphicsLayer->drawsContent();
+    m_state.contentsOpaque = graphicsLayer->contentsOpaque();
+    m_state.backfaceVisibility = graphicsLayer->backfaceVisibility();
+    m_state.childrenTransform = graphicsLayer->childrenTransform();
+    m_state.opacity = graphicsLayer->opacity();
+#if ENABLE(CSS_FILTERS)
+    m_state.filters = graphicsLayer->filters();
+#endif
+
+    m_state.needsDisplay = m_state.needsDisplay || graphicsLayer->needsDisplay();
+    if (!m_state.needsDisplay)
+        m_state.needsDisplayRect.unite(graphicsLayer->needsDisplayRect());
+    m_contentsLayer = graphicsLayer->contentsLayer();
+
+    m_transform.setPosition(m_state.pos);
+    m_transform.setAnchorPoint(m_state.anchorPoint);
+    m_transform.setSize(m_state.size);
+    m_transform.setFlattening(!m_state.preserves3D);
+    m_transform.setChildrenTransform(m_state.childrenTransform);
+}
+
+bool TextureMapperLayer::descendantsOrSelfHaveRunningAnimations() const
+{
+    if (m_animations.hasRunningAnimations())
+        return true;
+
+    for (size_t i = 0; i < m_children.size(); ++i) {
+        if (m_children[i]->descendantsOrSelfHaveRunningAnimations())
+            return true;
+    }
+
+    return false;
+}
+
+void TextureMapperLayer::syncAnimations()
+{
+    m_animations.apply(this);
+    if (!m_animations.hasActiveAnimationsOfType(AnimatedPropertyWebkitTransform))
+        setTransform(m_state.transform);
+    if (!m_animations.hasActiveAnimationsOfType(AnimatedPropertyOpacity))
+        setOpacity(m_state.opacity);
+}
+
+void TextureMapperLayer::syncAnimationsRecursively()
+{
+    syncAnimations();
+
+    for (int i = m_children.size() - 1; i >= 0; --i)
+        m_children[i]->syncAnimationsRecursively();
+}
+
+void TextureMapperLayer::syncCompositingState(GraphicsLayerTextureMapper* graphicsLayer, TextureMapper* textureMapper, int options)
+{
+    if (!textureMapper)
+        return;
+
+    if (graphicsLayer && !(options & ComputationsOnly)) {
+        syncCompositingStateSelf(graphicsLayer, textureMapper);
+        graphicsLayer->didSynchronize();
+    }
+
+    if (graphicsLayer && m_state.maskLayer) {
+        m_state.maskLayer->syncCompositingState(toGraphicsLayerTextureMapper(graphicsLayer->maskLayer()), textureMapper);
+
+        // A mask layer has its parent's size by default, in case it's not set specifically.
+        if (m_state.maskLayer->m_size.isEmpty())
+            m_state.maskLayer->m_size = m_size;
+    }
+
+    if (m_state.replicaLayer)
+        m_state.replicaLayer->syncCompositingState(toGraphicsLayerTextureMapper(graphicsLayer->replicaLayer()), textureMapper);
+
+    syncAnimations();
+    updateBackingStore(textureMapper, graphicsLayer);
+
+    if (!(options & TraverseDescendants))
+        options = ComputationsOnly;
+
+    if (graphicsLayer) {
+        Vector<GraphicsLayer*> children = graphicsLayer->children();
+        for (int i = children.size() - 1; i >= 0; --i) {
+            TextureMapperLayer* layer = toTextureMapperLayer(children[i]);
+            if (!layer)
+                continue;
+            layer->syncCompositingState(toGraphicsLayerTextureMapper(children[i]), textureMapper, options);
+        }
+    } else {
+        for (int i = m_children.size() - 1; i >= 0; --i)
+            m_children[i]->syncCompositingState(0, textureMapper, options);
+    }
+}
+
+}
+#endif
diff --git a/Source/WebCore/platform/graphics/texmap/TextureMapperNode.h b/Source/WebCore/platform/graphics/texmap/TextureMapperLayer.h
index 230c9e0e0..e10d5a798 100644
--- a/Source/WebCore/platform/graphics/texmap/TextureMapperNode.h
+++ b/Source/WebCore/platform/graphics/texmap/TextureMapperLayer.h
@@ -17,9 +17,10 @@
  Boston, MA 02110-1301, USA.
  */
 
-#ifndef TextureMapperNode_h
-#define TextureMapperNode_h
+#ifndef TextureMapperLayer_h
+#define TextureMapperLayer_h
 
+#include "FilterOperations.h"
 #include "FloatRect.h"
 #include "GraphicsContext.h"
 #include "GraphicsLayer.h"
@@ -28,6 +29,7 @@
 #include "LayerTransform.h"
 #include "TextureMapper.h"
 #include "TextureMapperAnimation.h"
+#include "TextureMapperBackingStore.h"
 #include "Timer.h"
 #include "TransformOperations.h"
 #include <wtf/CurrentTime.h>
@@ -37,26 +39,24 @@
 namespace WebCore {
 
 class TextureMapperPlatformLayer;
-class TextureMapperNode;
+class TextureMapperLayer;
 class GraphicsLayerTextureMapper;
 
 class TextureMapperPaintOptions {
 public:
-    BitmapTexture* surface;
-    BitmapTexture* mask;
+    RefPtr<BitmapTexture> surface;
+    RefPtr<BitmapTexture> mask;
     float opacity;
     TransformationMatrix transform;
     IntSize offset;
     TextureMapper* textureMapper;
     TextureMapperPaintOptions()
-        : surface(0)
-        , mask(0)
-        , opacity(1)
+        : opacity(1)
         , textureMapper(0)
     { }
 };
 
-class TextureMapperNode : public TextureMapperAnimationClient {
+class TextureMapperLayer : public TextureMapperAnimationClient {
 
 public:
     // This set of flags help us defer which properties of the layer have been
@@ -89,7 +89,8 @@ public:
         BackgroundColorChange =     (1L << 19),
 
         ReplicaLayerChange =        (1L << 20),
-        AnimationChange =           (1L << 21)
+        AnimationChange =           (1L << 21),
+        FilterChange =              (1L << 22)
     };
 
     enum SyncOptions {
@@ -97,41 +98,17 @@ public:
         ComputationsOnly = 2
     };
 
-    enum TileOwnership {
-        OwnedTiles,
-        ExternallyManagedTiles
-    };
-
-    typedef HashMap<TextureMapperNode*, FloatRect> NodeRectMap;
-
-    // The compositor lets us special-case images and colors, so we try to do so.
-    enum ContentType { HTMLContentType, DirectImageContentType, ColorContentType, MediaContentType, Canvas3DContentType};
-    struct ContentData {
-        FloatRect needsDisplayRect;
-        bool needsDisplay;
-        Color backgroundColor;
-
-        ContentType contentType;
-        RefPtr<Image> image;
-        const TextureMapperPlatformLayer* media;
-        ContentData()
-            : needsDisplay(false)
-            , contentType(HTMLContentType)
-            , image(0)
-            , media(0)
-        {
-        }
-    };
-
-    TextureMapperNode()
+    TextureMapperLayer()
         : m_parent(0)
         , m_effectTarget(0)
+        , m_contentsLayer(0)
         , m_opacity(1)
         , m_centerZ(0)
+        , m_shouldUpdateBackingStoreFromLayer(true)
         , m_textureMapper(0)
     { }
 
-    virtual ~TextureMapperNode();
+    virtual ~TextureMapperLayer();
 
     void syncCompositingState(GraphicsLayerTextureMapper*, int syncOptions = 0);
     void syncCompositingState(GraphicsLayerTextureMapper*, TextureMapper*, int syncOptions = 0);
@@ -144,22 +121,13 @@ public:
 
     void paint();
 
-#if USE(TILED_BACKING_STORE)
-    void setTileOwnership(TileOwnership ownership) { m_state.tileOwnership = ownership; }
-    int createContentsTile(float scale);
-    void removeContentsTile(int id);
-    void setContentsTileBackBuffer(int id, const IntRect& sourceRect, const IntRect& targetRect, const void*);
-    void setTileBackBufferTextureForDirectlyCompositedImage(int id, const IntRect& sourceRect, const FloatRect& targetRect, BitmapTexture*);
-    void clearAllDirectlyCompositedImageTiles();
-    void purgeNodeTexturesRecursive();
-#endif
-    void setID(int id) { m_id = id; }
-    int id() const { return m_id; }
-
-    const TextureMapperPlatformLayer* media() const { return m_currentContent.media; }
+    void setShouldUpdateBackingStoreFromLayer(bool b) { m_shouldUpdateBackingStoreFromLayer = b; }
+    void setBackingStore(TextureMapperBackingStore* backingStore) { m_backingStore = backingStore; }
+    PassRefPtr<TextureMapperBackingStore> backingStore() { return m_backingStore; }
+    void clearBackingStoresRecursive();
 
 private:
-    TextureMapperNode* rootLayer();
+    TextureMapperLayer* rootLayer();
     void computeTransformsRecursive();
     void computeOverlapsIfNeeded();
     void computeTiles();
@@ -169,18 +137,18 @@ private:
     FloatRect targetRectForTileRect(const FloatRect& totalTargetRect, const FloatRect& tileRect) const;
     void invalidateViewport(const FloatRect&);
     void notifyChange(ChangeMask);
-    void syncCompositingStateSelf(GraphicsLayerTextureMapper* graphicsLayer, TextureMapper* textureMapper);
+    void syncCompositingStateSelf(GraphicsLayerTextureMapper*, TextureMapper*);
 
     static int compareGraphicsLayersZValue(const void* a, const void* b);
-    static void sortByZOrder(Vector<TextureMapperNode* >& array, int first, int last);
+    static void sortByZOrder(Vector<TextureMapperLayer* >& array, int first, int last);
 
-    BitmapTexture* texture() { return m_ownedTiles.isEmpty() ? 0 : m_ownedTiles[0].texture.get(); }
+    PassRefPtr<BitmapTexture> texture() { return m_backingStore ? m_backingStore->texture() : 0; }
 
     void paintRecursive(const TextureMapperPaintOptions&);
     void paintSelf(const TextureMapperPaintOptions&);
     void paintSelfAndChildren(const TextureMapperPaintOptions&);
     void paintSelfAndChildrenWithReplica(const TextureMapperPaintOptions&);
-    void renderContent(TextureMapper*, GraphicsLayer*);
+    void updateBackingStore(TextureMapper*, GraphicsLayer*);
 
     void syncAnimations();
     bool isVisible() const;
@@ -188,63 +156,21 @@ private:
 
     LayerTransform m_transform;
 
-    inline FloatRect targetRect() const
-    {
-        return m_currentContent.contentType == HTMLContentType ? entireRect() : m_state.contentsRect;
-    }
-
-    inline FloatRect entireRect() const
-    {
-        return FloatRect(0, 0, m_size.width(), m_size.height());
-    }
-
-    FloatSize contentSize() const
+    inline FloatRect layerRect() const
     {
-        return m_currentContent.contentType == DirectImageContentType && m_currentContent.image ? m_currentContent.image->size() : m_size;
+        return FloatRect(FloatPoint::zero(), m_size);
     }
-    struct OwnedTile {
-        FloatRect rect;
-        RefPtr<BitmapTexture> texture;
-        bool needsReset;
-    };
-
-    Vector<OwnedTile> m_ownedTiles;
-
-#if USE(TILED_BACKING_STORE)
-    struct ExternallyManagedTileBuffer {
-        FloatRect sourceRect;
-        FloatRect targetRect;
-        RefPtr<BitmapTexture> texture;
-    };
-
-    struct ExternallyManagedTile {
-        bool isBackBufferUpdated;
-        bool isDirectlyCompositedImage;
-        float scale;
-        ExternallyManagedTileBuffer frontBuffer;
-        ExternallyManagedTileBuffer backBuffer;
-
-        ExternallyManagedTile(float scale = 1.0)
-            : isBackBufferUpdated(false)
-            , isDirectlyCompositedImage(false)
-            , scale(scale)
-        {
-        }
-    };
 
-    HashMap<int, ExternallyManagedTile> m_externallyManagedTiles;
-#endif
-
-    ContentData m_currentContent;
-
-    Vector<TextureMapperNode*> m_children;
-    TextureMapperNode* m_parent;
-    TextureMapperNode* m_effectTarget;
+    Vector<TextureMapperLayer*> m_children;
+    TextureMapperLayer* m_parent;
+    TextureMapperLayer* m_effectTarget;
+    RefPtr<TextureMapperBackingStore> m_backingStore;
+    TextureMapperPlatformLayer* m_contentsLayer;
     FloatSize m_size;
     float m_opacity;
     float m_centerZ;
     String m_name;
-    int m_id;
+    bool m_shouldUpdateBackingStoreFromLayer;
 
     struct State {
         FloatPoint pos;
@@ -254,22 +180,23 @@ private:
         TransformationMatrix childrenTransform;
         float opacity;
         FloatRect contentsRect;
+        FloatRect needsDisplayRect;
         int descendantsWithContent;
-        TextureMapperNode* maskLayer;
-        TextureMapperNode* replicaLayer;
+        TextureMapperLayer* maskLayer;
+        TextureMapperLayer* replicaLayer;
+#if ENABLE(CSS_FILTERS)
+         FilterOperations filters;
+#endif
+
         bool preserves3D : 1;
         bool masksToBounds : 1;
         bool drawsContent : 1;
         bool contentsOpaque : 1;
         bool backfaceVisibility : 1;
         bool visible : 1;
-        bool needsReset: 1;
+        bool needsDisplay: 1;
         bool mightHaveOverlaps : 1;
         bool needsRepaint;
-        float contentScale;
-#if USE(TILED_BACKING_STORE)
-        TileOwnership tileOwnership;
-#endif
         State()
             : opacity(1.f)
             , maskLayer(0)
@@ -280,13 +207,9 @@ private:
             , contentsOpaque(false)
             , backfaceVisibility(false)
             , visible(true)
-            , needsReset(false)
+            , needsDisplay(true)
             , mightHaveOverlaps(false)
             , needsRepaint(false)
-            , contentScale(1.0f)
-#if USE(TILED_BACKING_STORE)
-            , tileOwnership(OwnedTiles)
-#endif
         {
         }
     };
@@ -297,7 +220,7 @@ private:
 };
 
 
-TextureMapperNode* toTextureMapperNode(GraphicsLayer*);
+TextureMapperLayer* toTextureMapperLayer(GraphicsLayer*);
 
 }
-#endif // TextureMapperNode_h
+#endif // TextureMapperLayer_h
diff --git a/Source/WebCore/platform/graphics/texmap/TextureMapperNode.cpp b/Source/WebCore/platform/graphics/texmap/TextureMapperNode.cpp
deleted file mode 100644
index 45b94bd91..000000000
--- a/Source/WebCore/platform/graphics/texmap/TextureMapperNode.cpp
+++ /dev/null
@@ -1,709 +0,0 @@
-/*
- Copyright (C) 2010 Nokia Corporation and/or its subsidiary(-ies)
-
- This library is free software; you can redistribute it and/or
- modify it under the terms of the GNU Library General Public
- License as published by the Free Software Foundation; either
- version 2 of the License, or (at your option) any later version.
-
- This library is distributed in the hope that it will be useful,
- but WITHOUT ANY WARRANTY; without even the implied warranty of
- MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- Library General Public License for more details.
-
- You should have received a copy of the GNU Library General Public License
- along with this library; see the file COPYING.LIB.  If not, write to
- the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
- Boston, MA 02110-1301, USA.
- */
-
-#include "config.h"
-#include "TextureMapperNode.h"
-
-#if USE(ACCELERATED_COMPOSITING)
-
-#include "GraphicsLayerTextureMapper.h"
-#include "ImageBuffer.h"
-#include "MathExtras.h"
-
-namespace {
-    static const float gTileDimension = 1024.0;
-}
-
-namespace WebCore {
-
-TextureMapperNode* toTextureMapperNode(GraphicsLayer* layer)
-{
-    return layer ? toGraphicsLayerTextureMapper(layer)->node() : 0;
-}
-
-TextureMapperNode* TextureMapperNode::rootLayer()
-{
-    if (m_effectTarget)
-        return m_effectTarget->rootLayer();
-    if (m_parent)
-        return m_parent->rootLayer();
-    return this;
-}
-
-void TextureMapperNode::setTransform(const TransformationMatrix& matrix)
-{
-    m_transform.setLocalTransform(matrix);
-}
-
-void TextureMapperNode::computeTransformsRecursive()
-{
-    if (m_size.isEmpty() && m_state.masksToBounds)
-        return;
-
-    // Compute transforms recursively on the way down to leafs.
-    TransformationMatrix parentTransform;
-    if (m_parent)
-        parentTransform = m_parent->m_transform.combinedForChildren();
-    else if (m_effectTarget)
-        parentTransform = m_effectTarget->m_transform.combined();
-    m_transform.combineTransforms(parentTransform);
-
-    m_state.visible = m_state.backfaceVisibility || m_transform.combined().inverse().m33() >= 0;
-
-    if (m_parent && m_parent->m_state.preserves3D)
-        m_centerZ = m_transform.combined().mapPoint(FloatPoint3D(m_size.width() / 2, m_size.height() / 2, 0)).z();
-
-    if (m_state.maskLayer)
-        m_state.maskLayer->computeTransformsRecursive();
-    if (m_state.replicaLayer)
-        m_state.replicaLayer->computeTransformsRecursive();
-    for (int i = 0; i < m_children.size(); ++i)
-        m_children[i]->computeTransformsRecursive();
-
-    // Reorder children if needed on the way back up.
-    if (m_state.preserves3D)
-        sortByZOrder(m_children, 0, m_children.size());
-}
-
-void TextureMapperNode::computeTiles()
-{
-#if USE(TILED_BACKING_STORE)
-    if (m_state.tileOwnership == ExternallyManagedTiles)
-        return;
-#endif
-    if (m_currentContent.contentType == HTMLContentType && !m_state.drawsContent) {
-        m_ownedTiles.clear();
-        return;
-    }
-    Vector<FloatRect> tilesToAdd;
-    Vector<int> tilesToRemove;
-    const int TileEraseThreshold = 6;
-    FloatSize size = contentSize();
-    FloatRect contentRect(0, 0, size.width(), size.height());
-
-    for (float y = 0; y < contentRect.height(); y += gTileDimension) {
-        for (float x = 0; x < contentRect.width(); x += gTileDimension) {
-            FloatRect tileRect(x, y, gTileDimension, gTileDimension);
-            tileRect.intersect(contentRect);
-            tilesToAdd.append(tileRect);
-        }
-    }
-
-    for (int i = m_ownedTiles.size() - 1; i >= 0; --i) {
-        const FloatRect oldTile = m_ownedTiles[i].rect;
-        bool found = false;
-
-        for (int j = tilesToAdd.size() - 1; j >= 0; --j) {
-            const FloatRect newTile = tilesToAdd[j];
-            if (oldTile != newTile)
-                continue;
-
-            found = true;
-            tilesToAdd.remove(j);
-            break;
-        }
-
-        if (!found)
-            tilesToRemove.append(i);
-    }
-
-    for (size_t i = 0; i < tilesToAdd.size(); ++i) {
-        if (!tilesToRemove.isEmpty()) {
-            OwnedTile& tile = m_ownedTiles[tilesToRemove[0]];
-            tilesToRemove.remove(0);
-            tile.rect = tilesToAdd[i];
-            tile.needsReset = true;
-            continue;
-        }
-
-        OwnedTile tile;
-        tile.rect = tilesToAdd[i];
-        tile.needsReset = true;
-        m_ownedTiles.append(tile);
-    }
-
-    for (size_t i = 0; i < tilesToRemove.size() && m_ownedTiles.size() > TileEraseThreshold; ++i)
-        m_ownedTiles.remove(tilesToRemove[i]);
-}
-
-void TextureMapperNode::renderContent(TextureMapper* textureMapper, GraphicsLayer* layer)
-{
-#if USE(TILED_BACKING_STORE)
-    if (m_state.tileOwnership == ExternallyManagedTiles)
-        return;
-#endif
-
-    if (m_size.isEmpty() || !layer || (!m_state.drawsContent && m_currentContent.contentType == HTMLContentType)) {
-        m_ownedTiles.clear();
-        return;
-    }
-
-    if (!textureMapper)
-        return;
-
-    IntRect dirtyRect = enclosingIntRect(m_currentContent.needsDisplay ? entireRect() : m_currentContent.needsDisplayRect);
-
-    for (size_t tileIndex = 0; tileIndex < m_ownedTiles.size(); ++tileIndex) {
-        OwnedTile& tile = m_ownedTiles[tileIndex];
-        if (!tile.texture)
-            tile.texture = textureMapper->createTexture();
-        RefPtr<BitmapTexture>& texture = tile.texture;
-        IntSize tileSize = enclosingIntRect(tile.rect).size();
-
-        if (tile.needsReset || texture->contentSize() != tileSize || !texture->isValid()) {
-            tile.needsReset = false;
-            texture->reset(tileSize, m_state.contentsOpaque);
-            dirtyRect.unite(enclosingIntRect(tile.rect));
-        }
-    }
-
-    if (dirtyRect.isEmpty())
-        return;
-
-    // Paint the entire dirty rect into an image buffer. This ensures we only paint once.
-    OwnPtr<ImageBuffer> imageBuffer = ImageBuffer::create(dirtyRect.size());
-    GraphicsContext* context = imageBuffer->context();
-    context->setImageInterpolationQuality(textureMapper->imageInterpolationQuality());
-    context->setTextDrawingMode(textureMapper->textDrawingMode());
-    context->translate(-dirtyRect.x(), -dirtyRect.y());
-    layer->paintGraphicsLayerContents(*context, dirtyRect);
-    if (m_currentContent.contentType == DirectImageContentType)
-        context->drawImage(m_currentContent.image.get(), ColorSpaceDeviceRGB, m_state.contentsRect);
-
-    RefPtr<Image> image;
-
-#if PLATFORM(QT)
-    image = imageBuffer->copyImage(DontCopyBackingStore);
-#else
-    // FIXME: support DontCopyBackingStore in non-Qt ports that use TextureMapper.
-    image = imageBuffer->copyImage(CopyBackingStore);
-#endif
-
-    // Divide the image to tiles.
-    for (size_t tileIndex = 0; tileIndex < m_ownedTiles.size(); ++tileIndex) {
-        OwnedTile& tile = m_ownedTiles[tileIndex];
-        IntRect targetRect = enclosingIntRect(tile.rect);
-        targetRect.intersect(dirtyRect);
-        if (targetRect.isEmpty())
-            continue;
-        IntRect sourceRect = targetRect;
-
-        // Normalize sourceRect to the buffer's coordinates.
-        sourceRect.move(-dirtyRect.x(), -dirtyRect.y());
-
-        // Normalize targetRect to the texture's coordinqates.
-        targetRect.move(-tile.rect.x(), -tile.rect.y());
-        tile.texture->updateContents(image.get(), targetRect, sourceRect, BitmapTexture::RGBAFormat);
-    }
-
-    m_currentContent.needsDisplay = false;
-    m_currentContent.needsDisplayRect = IntRect();
-}
-
-void TextureMapperNode::paint()
-{
-    if (m_size.isEmpty())
-        return;
-
-    computeTransformsRecursive();
-
-    TextureMapperPaintOptions opt;
-    opt.textureMapper = m_textureMapper;
-    opt.textureMapper->bindSurface(0);
-    paintRecursive(opt);
-}
-
-FloatRect TextureMapperNode::targetRectForTileRect(const FloatRect& targetRect, const FloatRect& tileRect) const
-{
-    return FloatRect(
-                targetRect.x() + (tileRect.x() - targetRect.x()),
-                targetRect.y() + (tileRect.y() - targetRect.y()),
-                tileRect.width(),
-                tileRect.height());
-}
-
-void TextureMapperNode::paintSelf(const TextureMapperPaintOptions& options)
-{
-    if (m_size.isEmpty() || (!m_state.drawsContent && m_currentContent.contentType == HTMLContentType))
-        return;
-
-    float opacity = options.opacity;
-    BitmapTexture* mask = options.mask;
-    FloatRect targetRect = this->targetRect();
-
-    // We apply the following transform to compensate for painting into a surface, and then apply the offset so that the painting fits in the target rect.
-    TransformationMatrix transform =
-            TransformationMatrix(options.transform)
-            .multiply(m_transform.combined())
-            .translate(options.offset.width(), options.offset.height());
-
-#if USE(TILED_BACKING_STORE)
-    Vector<ExternallyManagedTile> tilesToPaint;
-
-    if (m_state.tileOwnership == ExternallyManagedTiles) {
-        // Sort tiles, with current scale factor last.
-        Vector<ExternallyManagedTile*> tiles;
-        HashMap<int, ExternallyManagedTile>::iterator end = m_externallyManagedTiles.end();
-        for (HashMap<int, ExternallyManagedTile>::iterator it = m_externallyManagedTiles.begin(); it != end; ++it) {
-            if (!it->second.frontBuffer.texture)
-                continue;
-
-            if (it->second.scale == m_state.contentScale) {
-                tiles.append(&it->second);
-                continue;
-            }
-
-            // This creates a transitional effect looks good only when there's no transparency, so we only use it when the opacity for the layer is above a certain threshold.
-            if (opacity > 0.95)
-                tiles.prepend(&it->second);
-        }
-
-        for (int i = 0; i < tiles.size(); ++i) {
-            ExternallyManagedTile& tile = *tiles[i];
-            FloatRect rect = tile.frontBuffer.targetRect;
-            BitmapTexture& texture = *tile.frontBuffer.texture;
-            options.textureMapper->drawTexture(texture, rect, transform, opacity, mask);
-        }
-        return;
-    }
-#endif
-
-    // Now we paint owned tiles, if we're in OwnedTileMode.
-    for (size_t i = 0; i < m_ownedTiles.size(); ++i) {
-        BitmapTexture* texture = m_ownedTiles[i].texture.get();
-        const FloatRect rect = targetRectForTileRect(targetRect, m_ownedTiles[i].rect);
-        options.textureMapper->drawTexture(*texture, rect, transform, opacity, mask);
-    }
-
-    if (m_currentContent.contentType == MediaContentType && m_currentContent.media)
-        m_currentContent.media->paintToTextureMapper(options.textureMapper, targetRect, transform, opacity, mask);
-}
-
-int TextureMapperNode::compareGraphicsLayersZValue(const void* a, const void* b)
-{
-    TextureMapperNode* const* nodeA = static_cast<TextureMapperNode* const*>(a);
-    TextureMapperNode* const* nodeB = static_cast<TextureMapperNode* const*>(b);
-    return int(((*nodeA)->m_centerZ - (*nodeB)->m_centerZ) * 1000);
-}
-
-void TextureMapperNode::sortByZOrder(Vector<TextureMapperNode* >& array, int first, int last)
-{
-    qsort(array.data(), array.size(), sizeof(TextureMapperNode*), compareGraphicsLayersZValue);
-}
-
-void TextureMapperNode::paintSelfAndChildren(const TextureMapperPaintOptions& options)
-{
-    bool hasClip = m_state.masksToBounds && !m_children.isEmpty();
-    if (hasClip)
-        options.textureMapper->beginClip(TransformationMatrix(options.transform).multiply(m_transform.combined()), FloatRect(0, 0, m_size.width(), m_size.height()));
-
-    paintSelf(options);
-
-    for (int i = 0; i < m_children.size(); ++i)
-        m_children[i]->paintRecursive(options);
-
-    if (hasClip)
-        options.textureMapper->endClip();
-}
-
-IntRect TextureMapperNode::intermediateSurfaceRect()
-{
-    // FIXME: Add an inverse transform to LayerTransform.
-    return intermediateSurfaceRect(m_transform.combined().inverse());
-}
-
-IntRect TextureMapperNode::intermediateSurfaceRect(const TransformationMatrix& matrix)
-{
-    IntRect rect;
-    TransformationMatrix localTransform = TransformationMatrix(matrix).multiply(m_transform.combined());
-    rect = enclosingIntRect(localTransform.mapRect(entireRect()));
-    if (!m_state.masksToBounds && !m_state.maskLayer) {
-        for (int i = 0; i < m_children.size(); ++i)
-            rect.unite(m_children[i]->intermediateSurfaceRect(matrix));
-    }
-
-    if (m_state.replicaLayer)
-        rect.unite(m_state.replicaLayer->intermediateSurfaceRect(matrix));
-
-    return rect;
-}
-
-bool TextureMapperNode::shouldPaintToIntermediateSurface() const
-{
-    bool hasOpacity = m_opacity < 0.99;
-    bool hasChildren = !m_children.isEmpty();
-    bool hasReplica = !!m_state.replicaLayer;
-    bool hasMask = !!m_state.maskLayer;
-
-    // We don't use two-pass blending for preserves-3d, that's in sync with Safari.
-    if (m_state.preserves3D)
-        return false;
-
-    // We should use an intermediate surface when blending several items with an ancestor opacity.
-    // Tested by compositing/reflections/reflection-opacity.html
-    if (hasOpacity && (hasChildren || hasReplica))
-        return true;
-
-    // We should use an intermediate surface with a masked ancestor.
-    // In the case of replicas the mask is applied before replicating.
-    // Tested by compositing/masks/masked-ancestor.html
-    if (hasMask && hasChildren && !hasReplica)
-        return true;
-
-    return false;
-}
-
-bool TextureMapperNode::isVisible() const
-{
-    if (m_size.isEmpty() && (m_state.masksToBounds || m_state.maskLayer || m_children.isEmpty()))
-        return false;
-    if (!m_state.visible || m_opacity < 0.01)
-        return false;
-    return true;
-}
-
-void TextureMapperNode::paintSelfAndChildrenWithReplica(const TextureMapperPaintOptions& options)
-{
-    if (m_state.replicaLayer) {
-        TextureMapperPaintOptions replicaOptions(options);
-        // We choose either the content's mask or the replica's mask.
-        // FIXME: blend the two if both exist.
-        if (m_state.replicaLayer->m_state.maskLayer)
-            replicaOptions.mask = m_state.replicaLayer->m_state.maskLayer->texture();
-
-        replicaOptions.transform
-                  .multiply(m_state.replicaLayer->m_transform.combined())
-                  .multiply(m_transform.combined().inverse());
-        paintSelfAndChildren(replicaOptions);
-    }
-
-    paintSelfAndChildren(options);
-}
-
-void TextureMapperNode::paintRecursive(const TextureMapperPaintOptions& options)
-{
-    if (!isVisible())
-        return;
-
-    float opacity = options.opacity * m_opacity;
-    RefPtr<BitmapTexture> maskTexture = m_state.maskLayer ? m_state.maskLayer->texture() : 0;
-
-    TextureMapperPaintOptions paintOptions(options);
-    paintOptions.mask = maskTexture.get();
-    IntRect surfaceRect;
-
-    RefPtr<BitmapTexture> surface;
-
-    if (!shouldPaintToIntermediateSurface()) {
-        paintOptions.opacity = opacity;
-        paintSelfAndChildrenWithReplica(paintOptions);
-        return;
-    }
-
-    // Prepare a surface to paint into.
-    // We paint into the surface ignoring the opacity/transform of the current layer.
-    surfaceRect = intermediateSurfaceRect();
-    surface = options.textureMapper->acquireTextureFromPool(surfaceRect.size());
-    options.textureMapper->bindSurface(surface.get());
-    paintOptions.opacity = 1;
-
-    // We have to use combinedForChildren() and not combined(), otherwise preserve-3D doesn't work.
-    paintOptions.transform = m_transform.combinedForChildren().inverse();
-    paintOptions.offset = -IntSize(surfaceRect.x(), surfaceRect.y());
-
-    paintSelfAndChildrenWithReplica(paintOptions);
-
-    // If we painted the replica, the mask is already applied so we don't need to paint it again.
-    if (m_state.replicaLayer)
-        maskTexture = 0;
-
-    options.textureMapper->bindSurface(options.surface);
-    TransformationMatrix targetTransform =
-            TransformationMatrix(options.transform)
-                .multiply(m_transform.combined())
-                .translate(options.offset.width(), options.offset.height());
-    options.textureMapper->drawTexture(*surface.get(), surfaceRect, targetTransform, opacity, maskTexture.get());
-}
-
-TextureMapperNode::~TextureMapperNode()
-{
-    for (int i = m_children.size() - 1; i >= 0; --i)
-        m_children[i]->m_parent = 0;
-
-    if (m_parent)
-        m_parent->m_children.remove(m_parent->m_children.find(this));
-}
-
-#if USE(TILED_BACKING_STORE)
-int TextureMapperNode::createContentsTile(float scale)
-{
-    static int nextID = 0;
-    int id = ++nextID;
-    m_externallyManagedTiles.add(id, ExternallyManagedTile(scale));
-    m_state.contentScale = scale;
-    return id;
-}
-
-void TextureMapperNode::removeContentsTile(int id)
-{
-    m_externallyManagedTiles.remove(id);
-}
-
-void TextureMapperNode::purgeNodeTexturesRecursive()
-{
-    m_externallyManagedTiles.clear();
-
-    for (int i = m_children.size() - 1; i >= 0; --i)
-        m_children[i]->purgeNodeTexturesRecursive();
-}
-
-void TextureMapperNode::setTileBackBufferTextureForDirectlyCompositedImage(int id, const IntRect& sourceRect, const FloatRect& targetRect, BitmapTexture* texture)
-{
-    HashMap<int, ExternallyManagedTile>::iterator it = m_externallyManagedTiles.find(id);
-
-    if (it == m_externallyManagedTiles.end())
-        return;
-
-    ExternallyManagedTile& tile = it->second;
-
-    tile.backBuffer.sourceRect = sourceRect;
-    tile.backBuffer.targetRect = targetRect;
-    tile.backBuffer.texture = texture;
-    tile.isBackBufferUpdated = true;
-    tile.isDirectlyCompositedImage = true;
-}
-
-void TextureMapperNode::clearAllDirectlyCompositedImageTiles()
-{
-    for (HashMap<int, ExternallyManagedTile>::iterator it = m_externallyManagedTiles.begin(); it != m_externallyManagedTiles.end(); ++it) {
-        if (it->second.isDirectlyCompositedImage)
-            m_externallyManagedTiles.remove(it);
-    }
-}
-
-void TextureMapperNode::setContentsTileBackBuffer(int id, const IntRect& sourceRect, const IntRect& targetRect, const void* data)
-{
-    ASSERT(m_textureMapper);
-
-    HashMap<int, ExternallyManagedTile>::iterator it = m_externallyManagedTiles.find(id);
-    if (it == m_externallyManagedTiles.end())
-        return;
-
-    ExternallyManagedTile& tile = it->second;
-
-    tile.backBuffer.sourceRect = sourceRect;
-    tile.backBuffer.targetRect = FloatRect(targetRect);
-    tile.backBuffer.targetRect.scale(1.0 / tile.scale);
-
-    if (!tile.backBuffer.texture)
-        tile.backBuffer.texture = m_textureMapper->createTexture();
-    tile.backBuffer.texture->reset(sourceRect.size(), false);
-    tile.backBuffer.texture->updateContents(data, sourceRect);
-    tile.isBackBufferUpdated = true;
-}
-
-void TextureMapperNode::swapContentsBuffers()
-{
-    HashMap<int, ExternallyManagedTile>::iterator end = m_externallyManagedTiles.end();
-    for (HashMap<int, ExternallyManagedTile>::iterator it = m_externallyManagedTiles.begin(); it != end; ++it) {
-        ExternallyManagedTile& tile = it->second;
-        if (!tile.isBackBufferUpdated)
-            continue;
-        tile.isBackBufferUpdated = false;
-        ExternallyManagedTileBuffer swapBuffer = tile.frontBuffer;
-        tile.frontBuffer = tile.backBuffer;
-        tile.backBuffer = swapBuffer;
-    }
-}
-#endif
-
-void TextureMapperNode::syncCompositingState(GraphicsLayerTextureMapper* graphicsLayer, int options)
-{
-    syncCompositingState(graphicsLayer, rootLayer()->m_textureMapper, options);
-}
-
-void TextureMapperNode::syncCompositingStateSelf(GraphicsLayerTextureMapper* graphicsLayer, TextureMapper* textureMapper)
-{
-    int changeMask = graphicsLayer->changeMask();
-    const TextureMapperNode::ContentData& pendingContent = graphicsLayer->pendingContent();
-#if USE(TILED_BACKING_STORE)
-    swapContentsBuffers();
-#endif
-    if (changeMask == NoChanges && graphicsLayer->m_animations.isEmpty() && pendingContent.needsDisplayRect.isEmpty() && !pendingContent.needsDisplay)
-        return;
-
-    if (m_currentContent.contentType == HTMLContentType && (changeMask & ParentChange)) {
-        TextureMapperNode* newParent = toTextureMapperNode(graphicsLayer->parent());
-        if (newParent != m_parent) {
-            // Remove node from current from child list first.
-            if (m_parent) {
-                size_t index = m_parent->m_children.find(this);
-                m_parent->m_children.remove(index);
-                m_parent = 0;
-            }
-            // Set new node parent and add node to the parents child list.
-            if (newParent) {
-                m_parent = newParent;
-                m_parent->m_children.append(this);
-            }
-        }
-    }
-
-    if (changeMask & ChildrenChange) {
-        // Clear children parent pointer to avoid unsync and crash on node delete.
-        for (size_t i = 0; i < m_children.size(); i++)
-            m_children[i]->m_parent = 0;
-
-        m_children.clear();
-        for (size_t i = 0; i < graphicsLayer->children().size(); ++i) {
-            TextureMapperNode* child = toTextureMapperNode(graphicsLayer->children()[i]);
-            if (!child)
-                continue;
-            m_children.append(child);
-            child->m_parent = this;
-        }
-    }
-
-    if (changeMask & (SizeChange | ContentsRectChange)) {
-        FloatSize wantedSize(graphicsLayer->size().width(), graphicsLayer->size().height());
-        if (wantedSize.isEmpty() && pendingContent.contentType == HTMLContentType)
-            wantedSize = FloatSize(graphicsLayer->contentsRect().width(), graphicsLayer->contentsRect().height());
-
-        if (wantedSize != m_size)
-            m_ownedTiles.clear();
-
-        m_size = wantedSize;
-    }
-
-    if (changeMask & MaskLayerChange) {
-       if (TextureMapperNode* layer = toTextureMapperNode(graphicsLayer->maskLayer()))
-           layer->m_effectTarget = this;
-    }
-
-    if (changeMask & ReplicaLayerChange) {
-       if (TextureMapperNode* layer = toTextureMapperNode(graphicsLayer->replicaLayer()))
-           layer->m_effectTarget = this;
-    }
-
-    if (changeMask & AnimationChange)
-        m_animations = graphicsLayer->m_animations;
-
-    m_state.maskLayer = toTextureMapperNode(graphicsLayer->maskLayer());
-    m_state.replicaLayer = toTextureMapperNode(graphicsLayer->replicaLayer());
-    m_state.pos = graphicsLayer->position();
-    m_state.anchorPoint = graphicsLayer->anchorPoint();
-    m_state.size = graphicsLayer->size();
-    m_state.contentsRect = graphicsLayer->contentsRect();
-    m_state.transform = graphicsLayer->transform();
-    m_state.contentsRect = graphicsLayer->contentsRect();
-    m_state.preserves3D = graphicsLayer->preserves3D();
-    m_state.masksToBounds = graphicsLayer->masksToBounds();
-    m_state.drawsContent = graphicsLayer->drawsContent();
-    m_state.contentsOpaque = graphicsLayer->contentsOpaque();
-    m_state.backfaceVisibility = graphicsLayer->backfaceVisibility();
-    m_state.childrenTransform = graphicsLayer->childrenTransform();
-    m_state.opacity = graphicsLayer->opacity();
-
-    m_currentContent.contentType = pendingContent.contentType;
-    m_currentContent.image = pendingContent.image;
-    m_currentContent.media = pendingContent.media;
-    m_currentContent.needsDisplay = m_currentContent.needsDisplay || pendingContent.needsDisplay;
-    if (!m_currentContent.needsDisplay)
-        m_currentContent.needsDisplayRect.unite(pendingContent.needsDisplayRect);
-
-    m_transform.setPosition(m_state.pos);
-    m_transform.setAnchorPoint(m_state.anchorPoint);
-    m_transform.setSize(m_state.size);
-    m_transform.setFlattening(!m_state.preserves3D);
-    m_transform.setChildrenTransform(m_state.childrenTransform);
-}
-
-bool TextureMapperNode::descendantsOrSelfHaveRunningAnimations() const
-{
-    if (m_animations.hasRunningAnimations())
-        return true;
-
-    for (size_t i = 0; i < m_children.size(); ++i) {
-        if (m_children[i]->descendantsOrSelfHaveRunningAnimations())
-            return true;
-    }
-
-    return false;
-}
-
-void TextureMapperNode::syncAnimations()
-{
-    m_animations.apply(this);
-    if (!m_animations.hasActiveAnimationsOfType(AnimatedPropertyWebkitTransform))
-        setTransform(m_state.transform);
-    if (!m_animations.hasActiveAnimationsOfType(AnimatedPropertyOpacity))
-        setOpacity(m_state.opacity);
-}
-
-void TextureMapperNode::syncAnimationsRecursively()
-{
-    syncAnimations();
-
-    for (int i = m_children.size() - 1; i >= 0; --i)
-        m_children[i]->syncAnimationsRecursively();
-}
-
-void TextureMapperNode::syncCompositingState(GraphicsLayerTextureMapper* graphicsLayer, TextureMapper* textureMapper, int options)
-{
-    if (graphicsLayer && !(options & ComputationsOnly)) {
-        syncCompositingStateSelf(graphicsLayer, textureMapper);
-        graphicsLayer->didSynchronize();
-    }
-
-    if (graphicsLayer && m_state.maskLayer) {
-        m_state.maskLayer->syncCompositingState(toGraphicsLayerTextureMapper(graphicsLayer->maskLayer()), textureMapper);
-
-        // A mask layer has its parent's size by default, in case it's not set specifically.
-        if (m_state.maskLayer->m_size.isEmpty())
-            m_state.maskLayer->m_size = m_size;
-    }
-
-    if (m_state.replicaLayer)
-        m_state.replicaLayer->syncCompositingState(toGraphicsLayerTextureMapper(graphicsLayer->replicaLayer()), textureMapper);
-
-    syncAnimations();
-    computeTiles();
-
-    if (graphicsLayer)
-        renderContent(textureMapper, graphicsLayer);
-
-    if (!(options & TraverseDescendants))
-        options = ComputationsOnly;
-
-    if (graphicsLayer) {
-        Vector<GraphicsLayer*> children = graphicsLayer->children();
-        for (int i = children.size() - 1; i >= 0; --i) {
-            TextureMapperNode* node = toTextureMapperNode(children[i]);
-            if (!node)
-                continue;
-            node->syncCompositingState(toGraphicsLayerTextureMapper(children[i]), textureMapper, options);
-        }
-    } else {
-        for (int i = m_children.size() - 1; i >= 0; --i)
-            m_children[i]->syncCompositingState(0, textureMapper, options);
-    }
-}
-
-}
-#endif
diff --git a/Source/WebCore/platform/graphics/texmap/TextureMapperPlatformLayer.h b/Source/WebCore/platform/graphics/texmap/TextureMapperPlatformLayer.h
index 1b29290d6..c69c1fbca 100644
--- a/Source/WebCore/platform/graphics/texmap/TextureMapperPlatformLayer.h
+++ b/Source/WebCore/platform/graphics/texmap/TextureMapperPlatformLayer.h
@@ -20,7 +20,6 @@
 #ifndef TextureMapperPlatformLayer_h
 #define TextureMapperPlatformLayer_h
 
-#include "FloatRect.h"
 #include "TransformationMatrix.h"
 
 namespace WebCore {
@@ -30,7 +29,8 @@ class BitmapTexture;
 
 class TextureMapperPlatformLayer {
 public:
-    virtual void paintToTextureMapper(TextureMapper*, const FloatRect&, const TransformationMatrix& modelViewMatrix = TransformationMatrix(), float opacity = 1.0, BitmapTexture* mask = 0) const = 0;
+    virtual void paintToTextureMapper(TextureMapper*, const FloatRect&, const TransformationMatrix& modelViewMatrix = TransformationMatrix(), float opacity = 1.0, BitmapTexture* mask = 0) = 0;
+    virtual void swapBuffers() { }
 };
 
 };
diff --git a/Source/WebCore/platform/graphics/texmap/TextureMapperShaderManager.cpp b/Source/WebCore/platform/graphics/texmap/TextureMapperShaderManager.cpp
new file mode 100644
index 000000000..3eb34d16e
--- /dev/null
+++ b/Source/WebCore/platform/graphics/texmap/TextureMapperShaderManager.cpp
@@ -0,0 +1,195 @@
+/*
+ Copyright (C) 2012 Nokia Corporation and/or its subsidiary(-ies)
+
+ This library is free software; you can redistribute it and/or
+ modify it under the terms of the GNU Library General Public
+ License as published by the Free Software Foundation; either
+ version 2 of the License, or (at your option) any later version.
+
+ This library is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ Library General Public License for more details.
+
+ You should have received a copy of the GNU Library General Public License
+ along with this library; see the file COPYING.LIB.  If not, write to
+ the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ Boston, MA 02110-1301, USA.
+ */
+
+#include "config.h"
+#include "TextureMapperShaderManager.h"
+
+#if USE(ACCELERATED_COMPOSITING) && USE(TEXTURE_MAPPER)
+
+namespace WebCore {
+
+#ifndef TEXMAP_OPENGL_ES_2
+#define OES2_PRECISION_DEFINITIONS \
+    "#define lowp\n#define highp\n"
+#define OES2_FRAGMENT_SHADER_DEFAULT_PRECISION
+#else
+#define OES2_PRECISION_DEFINITIONS
+#define OES2_FRAGMENT_SHADER_DEFAULT_PRECISION \
+    "precision mediump float; \n"
+#endif
+
+#define VERTEX_SHADER(src...) OES2_PRECISION_DEFINITIONS#src
+#define FRAGMENT_SHADER(src...) OES2_PRECISION_DEFINITIONS\
+                                OES2_FRAGMENT_SHADER_DEFAULT_PRECISION\
+                                #src
+
+static const char* fragmentShaderSourceOpacityAndMask =
+    FRAGMENT_SHADER(
+        uniform sampler2D SourceTexture, MaskTexture;
+        uniform lowp float Opacity;
+        varying highp vec2 OutTexCoordSource, OutTexCoordMask;
+        void main(void)
+        {
+            lowp vec4 color = texture2D(SourceTexture, OutTexCoordSource);
+            lowp vec4 maskColor = texture2D(MaskTexture, OutTexCoordMask);
+            lowp float fragmentAlpha = Opacity * maskColor.a;
+            gl_FragColor = vec4(color.rgb * fragmentAlpha, color.a * fragmentAlpha);
+        }
+    );
+
+static const char* vertexShaderSourceOpacityAndMask =
+    VERTEX_SHADER(
+        uniform mat4 InMatrix, InSourceMatrix, InMaskMatrix;
+        attribute vec4 InVertex;
+        varying highp vec2 OutTexCoordSource, OutTexCoordMask;
+        void main(void)
+        {
+            OutTexCoordSource = vec2(InSourceMatrix * InVertex);
+            OutTexCoordMask = vec2(InMaskMatrix * InVertex);
+            gl_Position = InMatrix * InVertex;
+        }
+    );
+
+static const char* fragmentShaderSourceSimple =
+    FRAGMENT_SHADER(
+        uniform sampler2D SourceTexture;
+        uniform lowp float Opacity;
+        varying highp vec2 OutTexCoordSource;
+        void main(void)
+        {
+            lowp vec4 color = texture2D(SourceTexture, OutTexCoordSource);
+            gl_FragColor = vec4(color.rgb * Opacity, color.a * Opacity);
+        }
+    );
+
+static const char* vertexShaderSourceSimple =
+    VERTEX_SHADER(
+        uniform mat4 InMatrix, InSourceMatrix;
+        attribute vec4 InVertex;
+        varying highp vec2 OutTexCoordSource;
+        void main(void)
+        {
+            OutTexCoordSource = vec2(InSourceMatrix * InVertex);
+            gl_Position = InMatrix * InVertex;
+        }
+    );
+
+void TextureMapperShaderProgram::initializeProgram()
+{
+    const char* vertexShaderSourceProgram = vertexShaderSource();
+    const char* fragmentShaderSourceProgram = fragmentShaderSource();
+    GLuint vertexShader = glCreateShader(GL_VERTEX_SHADER);
+    GLuint fragmentShader = glCreateShader(GL_FRAGMENT_SHADER);
+    glShaderSource(vertexShader, 1, &vertexShaderSourceProgram, 0);
+    glShaderSource(fragmentShader, 1, &fragmentShaderSourceProgram, 0);
+    GLuint programID = glCreateProgram();
+    glCompileShader(vertexShader);
+    glCompileShader(fragmentShader);
+    glAttachShader(programID, vertexShader);
+    glAttachShader(programID, fragmentShader);
+    glLinkProgram(programID);
+
+    m_vertexAttrib = glGetAttribLocation(programID, "InVertex");
+    m_id = programID;
+    m_vertexShader = vertexShader;
+    m_fragmentShader = fragmentShader;
+}
+
+void TextureMapperShaderProgram::getUniformLocation(GLint &variable, const char* name)
+{
+    variable = glGetUniformLocation(m_id, name);
+    ASSERT(variable >= 0);
+}
+
+TextureMapperShaderProgram::~TextureMapperShaderProgram()
+{
+    GLuint programID = m_id;
+    if (!programID)
+        return;
+
+    glDetachShader(programID, m_vertexShader);
+    glDeleteShader(m_vertexShader);
+    glDetachShader(programID, m_fragmentShader);
+    glDeleteShader(m_fragmentShader);
+    glDeleteProgram(programID);
+}
+
+PassRefPtr<TextureMapperShaderProgramSimple> TextureMapperShaderProgramSimple::create()
+{
+    return adoptRef(new TextureMapperShaderProgramSimple());
+}
+
+TextureMapperShaderProgramSimple::TextureMapperShaderProgramSimple()
+{
+    initializeProgram();
+    getUniformLocation(m_sourceMatrixVariable, "InSourceMatrix");
+    getUniformLocation(m_matrixVariable, "InMatrix");
+    getUniformLocation(m_sourceTextureVariable, "SourceTexture");
+    getUniformLocation(m_opacityVariable, "Opacity");
+}
+
+const char* TextureMapperShaderProgramSimple::vertexShaderSource()
+{
+    return vertexShaderSourceSimple;
+}
+
+const char* TextureMapperShaderProgramSimple::fragmentShaderSource()
+{
+    return fragmentShaderSourceSimple;
+}
+
+PassRefPtr<TextureMapperShaderProgramOpacityAndMask> TextureMapperShaderProgramOpacityAndMask::create()
+{
+    return adoptRef(new TextureMapperShaderProgramOpacityAndMask());
+}
+
+TextureMapperShaderProgramOpacityAndMask::TextureMapperShaderProgramOpacityAndMask()
+{
+    initializeProgram();
+    getUniformLocation(m_matrixVariable, "InMatrix");
+    getUniformLocation(m_sourceMatrixVariable, "InSourceMatrix");
+    getUniformLocation(m_maskMatrixVariable, "InMaskMatrix");
+    getUniformLocation(m_sourceTextureVariable, "SourceTexture");
+    getUniformLocation(m_maskTextureVariable, "MaskTexture");
+    getUniformLocation(m_opacityVariable, "Opacity");
+}
+
+const char* TextureMapperShaderProgramOpacityAndMask::vertexShaderSource()
+{
+    return vertexShaderSourceOpacityAndMask;
+}
+
+const char* TextureMapperShaderProgramOpacityAndMask::fragmentShaderSource()
+{
+    return fragmentShaderSourceOpacityAndMask;
+}
+
+TextureMapperShaderManager::TextureMapperShaderManager()
+{
+    ASSERT(initializeOpenGLShims());
+}
+
+TextureMapperShaderManager::~TextureMapperShaderManager()
+{
+    m_textureMapperShaderProgramMap.clear();
+}
+
+};
+
+#endif
diff --git a/Source/WebCore/platform/graphics/texmap/TextureMapperShaderManager.h b/Source/WebCore/platform/graphics/texmap/TextureMapperShaderManager.h
new file mode 100644
index 000000000..53aeaaacc
--- /dev/null
+++ b/Source/WebCore/platform/graphics/texmap/TextureMapperShaderManager.h
@@ -0,0 +1,134 @@
+/*
+ Copyright (C) 2012 Nokia Corporation and/or its subsidiary(-ies)
+
+ This library is free software; you can redistribute it and/or
+ modify it under the terms of the GNU Library General Public
+ License as published by the Free Software Foundation; either
+ version 2 of the License, or (at your option) any later version.
+
+ This library is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ Library General Public License for more details.
+
+ You should have received a copy of the GNU Library General Public License
+ along with this library; see the file COPYING.LIB.  If not, write to
+ the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ Boston, MA 02110-1301, USA.
+ */
+
+#ifndef TextureMapperShaderManager_h
+#define TextureMapperShaderManager_h
+
+#if USE(ACCELERATED_COMPOSITING) && USE(TEXTURE_MAPPER)
+
+#include "FloatQuad.h"
+#include "IntSize.h"
+#include "OpenGLShims.h"
+#include "TextureMapper.h"
+#include "TransformationMatrix.h"
+#include <wtf/HashMap.h>
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefPtr.h>
+
+namespace WebCore {
+
+typedef void* ShaderType;
+
+class TextureMapperShaderManager;
+
+class TextureMapperShaderProgram : public RefCounted<TextureMapperShaderProgram> {
+public:
+    GLuint id() { return m_id; }
+    GLuint vertexAttrib() { return m_vertexAttrib; }
+
+    virtual ~TextureMapperShaderProgram();
+
+    template<class T>
+    static ShaderType shaderType()
+    {
+        static int type = 0;
+        return &type;
+    }
+
+protected:
+    void getUniformLocation(GLint& var, const char* name);
+    void initializeProgram();
+    virtual const char* vertexShaderSource() = 0;
+    virtual const char* fragmentShaderSource() = 0;
+
+    GLuint m_id;
+    GLuint m_vertexAttrib;
+    GLuint m_vertexShader;
+    GLuint m_fragmentShader;
+};
+
+class TextureMapperShaderProgramSimple : public TextureMapperShaderProgram {
+public:
+    static PassRefPtr<TextureMapperShaderProgramSimple> create();
+    GLint matrixVariable() { return m_matrixVariable; }
+    GLint sourceMatrixVariable() { return m_sourceMatrixVariable; }
+    GLint sourceTextureVariable() { return m_sourceTextureVariable; }
+    GLint opacityVariable() { return m_opacityVariable; }
+
+private:
+    virtual const char* vertexShaderSource();
+    virtual const char* fragmentShaderSource();
+    TextureMapperShaderProgramSimple();
+    GLint m_matrixVariable;
+    GLint m_sourceMatrixVariable;
+    GLint m_sourceTextureVariable;
+    GLint m_opacityVariable;
+};
+
+class TextureMapperShaderProgramOpacityAndMask : public TextureMapperShaderProgram {
+public:
+    static PassRefPtr<TextureMapperShaderProgramOpacityAndMask> create();
+    GLint sourceMatrixVariable() { return m_sourceMatrixVariable; }
+    GLint matrixVariable() { return m_matrixVariable; }
+    GLint maskMatrixVariable() { return m_maskMatrixVariable; }
+    GLint sourceTextureVariable() { return m_sourceTextureVariable; }
+    GLint maskTextureVariable() { return m_maskTextureVariable; }
+    GLint opacityVariable() { return m_opacityVariable; }
+
+private:
+    static int m_classID;
+    virtual const char* vertexShaderSource();
+    virtual const char* fragmentShaderSource();
+    TextureMapperShaderProgramOpacityAndMask();
+    GLint m_sourceMatrixVariable;
+    GLint m_matrixVariable;
+    GLint m_maskMatrixVariable;
+    GLint m_sourceTextureVariable;
+    GLint m_maskTextureVariable;
+    GLint m_opacityVariable;
+};
+
+class TextureMapperShaderManager {
+public:
+    TextureMapperShaderManager();
+    virtual ~TextureMapperShaderManager();
+
+    template<class T>
+    PassRefPtr<T> getShaderProgram()
+    {
+        ShaderType shaderType = TextureMapperShaderProgram::shaderType<T>();
+        TextureMapperShaderProgramMap::iterator it = m_textureMapperShaderProgramMap.find(shaderType);
+        if (it != m_textureMapperShaderProgramMap.end())
+            return static_cast<T*>(it->second.get());
+
+        RefPtr<T> t = T::create();
+        m_textureMapperShaderProgramMap.add(shaderType, t);
+        return t;
+    }
+
+private:
+    typedef HashMap<ShaderType, RefPtr<TextureMapperShaderProgram> > TextureMapperShaderProgramMap;
+    TextureMapperShaderProgramMap m_textureMapperShaderProgramMap;
+};
+
+}
+
+#endif
+
+#endif // TextureMapperShaderManager_h
diff --git a/Source/WebCore/platform/gtk/AsyncFileSystemGtk.cpp b/Source/WebCore/platform/gtk/AsyncFileSystemGtk.cpp
new file mode 100644
index 000000000..c1db006a8
--- /dev/null
+++ b/Source/WebCore/platform/gtk/AsyncFileSystemGtk.cpp
@@ -0,0 +1,136 @@
+/*
+ * Copyright (C) 2012 ChangSeok Oh <shivamidow@gmail.com>
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free
+ * Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301 USA
+ */
+
+#include "config.h"
+
+#if ENABLE(FILE_SYSTEM)
+
+#include "AsyncFileSystemGtk.h"
+
+#include "AsyncFileSystemCallbacks.h"
+#include "ExceptionCode.h"
+#include "NotImplemented.h"
+
+namespace WebCore {
+
+bool AsyncFileSystem::isAvailable()
+{
+    notImplemented();
+    return false;
+}
+
+bool AsyncFileSystem::isValidType(Type type)
+{
+    notImplemented();
+    return false;
+}
+
+PassOwnPtr<AsyncFileSystem> AsyncFileSystem::create(Type type)
+{
+    return adoptPtr(new AsyncFileSystemGtk(type));
+}
+
+void AsyncFileSystem::openFileSystem(const String& basePath, const String& storageIdentifier, Type type, bool, PassOwnPtr<AsyncFileSystemCallbacks> callbacks)
+{
+    notImplemented();
+    callbacks->didFail(NOT_SUPPORTED_ERR);
+}
+
+bool AsyncFileSystem::crackFileSystemURL(const KURL& url, AsyncFileSystem::Type& type, String& filePath)
+{
+    notImplemented();
+    return false;
+}
+
+AsyncFileSystemGtk::AsyncFileSystemGtk(AsyncFileSystem::Type type)
+    : AsyncFileSystem(type)
+{
+    notImplemented();
+}
+
+AsyncFileSystemGtk::~AsyncFileSystemGtk()
+{
+    notImplemented();
+}
+
+String AsyncFileSystemGtk::toURL(const String& originString, const String& fullPath)
+{
+    notImplemented();
+    return String();
+}
+
+void AsyncFileSystemGtk::move(const String& sourcePath, const String& destinationPath, PassOwnPtr<AsyncFileSystemCallbacks> callbacks)
+{
+    notImplemented();
+}
+
+void AsyncFileSystemGtk::copy(const String& sourcePath, const String& destinationPath, PassOwnPtr<AsyncFileSystemCallbacks> callbacks)
+{
+    notImplemented();
+}
+
+void AsyncFileSystemGtk::remove(const String& path, PassOwnPtr<AsyncFileSystemCallbacks> callbacks)
+{
+    notImplemented();
+}
+
+void AsyncFileSystemGtk::removeRecursively(const String& path, PassOwnPtr<AsyncFileSystemCallbacks> callbacks)
+{
+    notImplemented();
+}
+
+void AsyncFileSystemGtk::readMetadata(const String& path, PassOwnPtr<AsyncFileSystemCallbacks> callbacks)
+{
+    notImplemented();
+}
+
+void AsyncFileSystemGtk::createFile(const String& path, bool exclusive, PassOwnPtr<AsyncFileSystemCallbacks> callbacks)
+{
+    notImplemented();
+}
+
+void AsyncFileSystemGtk::createDirectory(const String& path, bool exclusive, PassOwnPtr<AsyncFileSystemCallbacks> callbacks)
+{
+    notImplemented();
+}
+
+void AsyncFileSystemGtk::fileExists(const String& path, PassOwnPtr<AsyncFileSystemCallbacks> callbacks)
+{
+    notImplemented();
+}
+
+void AsyncFileSystemGtk::directoryExists(const String& path, PassOwnPtr<AsyncFileSystemCallbacks> callbacks)
+{
+    notImplemented();
+}
+
+void AsyncFileSystemGtk::readDirectory(const String& path, PassOwnPtr<AsyncFileSystemCallbacks> callbacks)
+{
+    notImplemented();
+}
+
+
+void AsyncFileSystemGtk::createWriter(AsyncFileWriterClient* client, const String& path, PassOwnPtr<AsyncFileSystemCallbacks> callbacks)
+{
+    notImplemented();
+}
+
+} // namespace WebCore
+
+#endif
diff --git a/Source/WebCore/platform/gtk/AsyncFileSystemGtk.h b/Source/WebCore/platform/gtk/AsyncFileSystemGtk.h
new file mode 100644
index 000000000..cb45b6ea4
--- /dev/null
+++ b/Source/WebCore/platform/gtk/AsyncFileSystemGtk.h
@@ -0,0 +1,55 @@
+/*
+ * Copyright (C) 2012 ChangSeok Oh <shivamidow@gmail.com>
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free
+ * Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301 USA
+ */
+
+#ifndef  AsyncFileSystemGtk_h
+#define  AsyncFileSystemGtk_h
+
+#if ENABLE(FILE_SYSTEM)
+
+#include "AsyncFileSystem.h"
+#include <wtf/PassOwnPtr.h>
+
+namespace WebCore {
+
+class AsyncFileSystemCallbacks;
+
+class AsyncFileSystemGtk : public AsyncFileSystem {
+public:
+    AsyncFileSystemGtk(AsyncFileSystem::Type);
+    virtual ~AsyncFileSystemGtk();
+
+    virtual String toURL(const String& originString, const String& fullPath);
+    virtual void move(const String& sourcePath, const String& destinationPath, PassOwnPtr<AsyncFileSystemCallbacks>);
+    virtual void copy(const String& sourcePath, const String& destinationPath, PassOwnPtr<AsyncFileSystemCallbacks>);
+    virtual void remove(const String& path, PassOwnPtr<AsyncFileSystemCallbacks>);
+    virtual void removeRecursively(const String& path, PassOwnPtr<AsyncFileSystemCallbacks>);
+    virtual void readMetadata(const String& path, PassOwnPtr<AsyncFileSystemCallbacks>);
+    virtual void createFile(const String& path, bool exclusive, PassOwnPtr<AsyncFileSystemCallbacks>);
+    virtual void createDirectory(const String& path, bool exclusive, PassOwnPtr<AsyncFileSystemCallbacks>);
+    virtual void fileExists(const String& path, PassOwnPtr<AsyncFileSystemCallbacks>);
+    virtual void directoryExists(const String& path, PassOwnPtr<AsyncFileSystemCallbacks>);
+    virtual void readDirectory(const String& path, PassOwnPtr<AsyncFileSystemCallbacks>);
+    virtual void createWriter(AsyncFileWriterClient*, const String& path, PassOwnPtr<AsyncFileSystemCallbacks>);
+};
+
+} // namespace WebCore
+
+#endif
+
+#endif //  AsyncFileSystemGtk_h
diff --git a/Source/WebCore/platform/gtk/ClipboardGtk.cpp b/Source/WebCore/platform/gtk/ClipboardGtk.cpp
index b1d2b5269..b20216760 100644
--- a/Source/WebCore/platform/gtk/ClipboardGtk.cpp
+++ b/Source/WebCore/platform/gtk/ClipboardGtk.cpp
@@ -18,6 +18,7 @@
 #include "ClipboardGtk.h"
 
 #include "CachedImage.h"
+#include "DOMStringList.h"
 #include "DragData.h"
 #include "Editor.h"
 #include "Element.h"
@@ -189,33 +190,33 @@ bool ClipboardGtk::setData(const String& typeString, const String& data)
     return success;
 }
 
-HashSet<String> ClipboardGtk::types() const
+PassRefPtr<DOMStringList> ClipboardGtk::types() const
 {
     if (policy() != ClipboardReadable && policy() != ClipboardTypesReadable)
-        return HashSet<String>();
+        return DOMStringList::create();
 
     if (m_clipboard)
         PasteboardHelper::defaultPasteboardHelper()->getClipboardContents(m_clipboard);
 
-    HashSet<String> types;
+    RefPtr<DOMStringList> types = DOMStringList::create();
     if (m_dataObject->hasText()) {
-        types.add("text/plain");
-        types.add("Text");
-        types.add("text");
+        types->append("text/plain");
+        types->append("Text");
+        types->append("text");
     }
 
     if (m_dataObject->hasMarkup())
-        types.add("text/html");
+        types->append("text/html");
 
     if (m_dataObject->hasURIList()) {
-        types.add("text/uri-list");
-        types.add("URL");
+        types->append("text/uri-list");
+        types->append("URL");
     }
 
     if (m_dataObject->hasFilenames())
-        types.add("Files");
+        types->append("Files");
 
-    return types;
+    return types.release();
 }
 
 PassRefPtr<FileList> ClipboardGtk::files() const
diff --git a/Source/WebCore/platform/gtk/ClipboardGtk.h b/Source/WebCore/platform/gtk/ClipboardGtk.h
index d8b751825..b72e1c81b 100644
--- a/Source/WebCore/platform/gtk/ClipboardGtk.h
+++ b/Source/WebCore/platform/gtk/ClipboardGtk.h
@@ -57,7 +57,7 @@ namespace WebCore {
         String getData(const String&, bool&) const;
         bool setData(const String&, const String&);
 
-        virtual HashSet<String> types() const;
+        virtual PassRefPtr<DOMStringList> types() const;
         virtual PassRefPtr<FileList> files() const;
 
         void setDragImage(CachedImage*, const IntPoint&);
diff --git a/Source/WebCore/platform/gtk/ContextMenuGtk.cpp b/Source/WebCore/platform/gtk/ContextMenuGtk.cpp
index 6f168fedc..51072f7f5 100644
--- a/Source/WebCore/platform/gtk/ContextMenuGtk.cpp
+++ b/Source/WebCore/platform/gtk/ContextMenuGtk.cpp
@@ -75,6 +75,14 @@ PlatformMenuDescription ContextMenu::releasePlatformDescription()
     return description;
 }
 
+unsigned ContextMenu::itemCount() const
+{
+    ASSERT(m_platformDescription);
+
+    GOwnPtr<GList> children(gtk_container_get_children(GTK_CONTAINER(m_platformDescription)));
+    return g_list_length(children.get());
+}
+
 Vector<ContextMenuItem> contextMenuItemVector(const PlatformMenuDescription menu)
 {
     Vector<ContextMenuItem> menuItemVector;
diff --git a/Source/WebCore/platform/gtk/FileSystemGtk.cpp b/Source/WebCore/platform/gtk/FileSystemGtk.cpp
index fc9d4bfc5..950d61823 100644
--- a/Source/WebCore/platform/gtk/FileSystemGtk.cpp
+++ b/Source/WebCore/platform/gtk/FileSystemGtk.cpp
@@ -190,6 +190,26 @@ CString applicationDirectoryPath()
     return dirname.get();
 }
 
+CString sharedResourcesPath()
+{
+    static CString cachedPath;
+    if (!cachedPath.isNull())
+        return cachedPath;
+
+#if OS(WINDOWS)
+    HMODULE hmodule = 0;
+    GetModuleHandleExA(GET_MODULE_HANDLE_EX_FLAG_FROM_ADDRESS, reinterpret_cast<char*>(sharedResourcesPath), &hmodule);
+
+    GOwnPtr<gchar> runtimeDir(g_win32_get_package_installation_directory_of_module(hmodule));
+    GOwnPtr<gchar> dataPath(g_build_filename(runtimeDir.get(), "share", "webkitgtk-"WEBKITGTK_API_VERSION_STRING, NULL));
+#else
+    GOwnPtr<gchar> dataPath(g_build_filename(DATA_DIR, "webkitgtk-"WEBKITGTK_API_VERSION_STRING, NULL));
+#endif
+
+    cachedPath = dataPath.get();
+    return cachedPath;
+}
+
 uint64_t getVolumeFreeSizeForPath(const char* path)
 {
     GRefPtr<GFile> file = adoptGRef(g_file_new_for_path(path));
diff --git a/Source/WebCore/platform/gtk/GtkPluginWidget.cpp b/Source/WebCore/platform/gtk/GtkPluginWidget.cpp
index 82023592a..4cf1b680d 100644
--- a/Source/WebCore/platform/gtk/GtkPluginWidget.cpp
+++ b/Source/WebCore/platform/gtk/GtkPluginWidget.cpp
@@ -41,6 +41,11 @@ GtkPluginWidget::GtkPluginWidget(GtkWidget* widget)
     gtk_widget_hide(widget);
 }
 
+GtkPluginWidget::~GtkPluginWidget()
+{
+    gtk_container_remove(GTK_CONTAINER(gtk_widget_get_parent(platformWidget())), platformWidget());
+}
+
 void GtkPluginWidget::invalidateRect(const IntRect& coreRect)
 {
     /* no need to */
@@ -66,49 +71,4 @@ void GtkPluginWidget::frameRectsChanged()
     gtk_widget_show(platformWidget());
 }
 
-void GtkPluginWidget::paint(GraphicsContext* context, const IntRect& rect)
-{
-    if (!context->gdkExposeEvent())
-        return;
-
-    /* only paint widgets with no window this way */
-    if (gtk_widget_get_has_window(platformWidget()))
-        return;
-
-    GtkWidget* widget = platformWidget();
-    ASSERT(!gtk_widget_get_has_window(widget));
-
-    GdkEvent* event = gdk_event_new(GDK_EXPOSE);
-    event->expose = *context->gdkExposeEvent();
-    event->expose.area = static_cast<GdkRectangle>(rect);
-
-    IntPoint loc = parent()->contentsToWindow(rect.location());
-
-    event->expose.area.x = loc.x();
-    event->expose.area.y = loc.y();
-
-#ifdef GTK_API_VERSION_2
-    event->expose.region = gdk_region_rectangle(&event->expose.area);
-#else
-    event->expose.region = cairo_region_create_rectangle(&event->expose.area);
-#endif
-
-    /*
-     * This will be unref'ed by gdk_event_free.
-     */
-    g_object_ref(event->expose.window);
-
-    /*
-     * If we are going to paint do the translation and GtkAllocation manipulation.
-     */
-#ifdef GTK_API_VERSION_2
-    if (!gdk_region_empty(event->expose.region))
-#else
-    if (!cairo_region_is_empty(event->expose.region))
-#endif
-        gtk_widget_send_expose(widget, event);
-
-    gdk_event_free(event);
-}
-
 }
diff --git a/Source/WebCore/platform/gtk/GtkPluginWidget.h b/Source/WebCore/platform/gtk/GtkPluginWidget.h
index cad346284..7373ec590 100644
--- a/Source/WebCore/platform/gtk/GtkPluginWidget.h
+++ b/Source/WebCore/platform/gtk/GtkPluginWidget.h
@@ -33,9 +33,9 @@ namespace WebCore {
     class GtkPluginWidget : public Widget {
     public:
         GtkPluginWidget(GtkWidget*);
+        virtual ~GtkPluginWidget();
         void invalidateRect(const IntRect&);
         void frameRectsChanged();
-        void paint(GraphicsContext*, const IntRect&);
     };
 }
 
diff --git a/Source/WebCore/platform/gtk/GtkPopupMenu.cpp b/Source/WebCore/platform/gtk/GtkPopupMenu.cpp
index b9112e9bf..fd7c84c53 100644
--- a/Source/WebCore/platform/gtk/GtkPopupMenu.cpp
+++ b/Source/WebCore/platform/gtk/GtkPopupMenu.cpp
@@ -178,9 +178,9 @@ bool GtkPopupMenu::typeAheadFind(GdkEventKey* event)
     // menulists.
     bool repeatingCharacter = unicodeCharacter != m_previousKeyEventCharacter;
     if (event->time - m_previousKeyEventTimestamp > gSearchTimeoutMs)
-        m_currentSearchString = String(static_cast<UChar*>(utf16String.get()), charactersWritten);
+        m_currentSearchString = String(reinterpret_cast<UChar*>(utf16String.get()), charactersWritten);
     else if (repeatingCharacter)
-        m_currentSearchString.append(String(static_cast<UChar*>(utf16String.get()), charactersWritten));
+        m_currentSearchString.append(String(reinterpret_cast<UChar*>(utf16String.get()), charactersWritten));
 
     m_previousKeyEventTimestamp = event->time;
     m_previousKeyEventCharacter = unicodeCharacter;
diff --git a/Source/WebCore/platform/gtk/KURLGtk.cpp b/Source/WebCore/platform/gtk/KURLGtk.cpp
index 47bc48b87..12d2b1883 100644
--- a/Source/WebCore/platform/gtk/KURLGtk.cpp
+++ b/Source/WebCore/platform/gtk/KURLGtk.cpp
@@ -20,6 +20,9 @@
 #include "KURL.h"
 
 #include "FileSystem.h"
+#include <gio/gio.h>
+#include <wtf/gobject/GOwnPtr.h>
+#include <wtf/gobject/GRefPtr.h>
 #include <wtf/text/CString.h>
 
 #include <glib.h>
@@ -28,13 +31,9 @@ namespace WebCore {
 
 String KURL::fileSystemPath() const
 {
-    gchar* filename = g_filename_from_uri(m_string.utf8().data(), 0, 0);
-    if (!filename)
-        return String();
-
-    String path = filenameToString(filename);
-    g_free(filename);
-    return path;
+    GRefPtr<GFile> file = adoptGRef(g_file_new_for_uri(m_string.utf8().data()));
+    GOwnPtr<char> filename(g_file_get_path(file.get()));
+    return filenameToString(filename.get());
 }
 
 } // namespace WebCore
diff --git a/Source/WebCore/platform/gtk/RenderThemeGtk.cpp b/Source/WebCore/platform/gtk/RenderThemeGtk.cpp
index f1620a794..bb67eaf37 100644
--- a/Source/WebCore/platform/gtk/RenderThemeGtk.cpp
+++ b/Source/WebCore/platform/gtk/RenderThemeGtk.cpp
@@ -701,7 +701,7 @@ static bool stringByAdoptingFileSystemRepresentation(gchar* systemFilename, Stri
     return true;
 }
 
-String RenderThemeGtk::fileListNameForWidth(const Vector<String>& filenames, const Font& font, int width, bool multipleFilesAllowed)
+String RenderThemeGtk::fileListNameForWidth(const Vector<String>& filenames, const Font& font, int width, bool multipleFilesAllowed) const
 {
     if (width <= 0)
         return String();
diff --git a/Source/WebCore/platform/gtk/RenderThemeGtk.h b/Source/WebCore/platform/gtk/RenderThemeGtk.h
index ad7990ed2..c26f9c967 100644
--- a/Source/WebCore/platform/gtk/RenderThemeGtk.h
+++ b/Source/WebCore/platform/gtk/RenderThemeGtk.h
@@ -181,7 +181,7 @@ protected:
     virtual bool paintInnerSpinButton(RenderObject*, const PaintInfo&, const IntRect&);
 
 private:
-    virtual String fileListNameForWidth(const Vector<String>& filenames, const Font&, int width, bool multipleFilesAllowed);
+    virtual String fileListNameForWidth(const Vector<String>& filenames, const Font&, int width, bool multipleFilesAllowed) const;
 
     void platformInit();
     static void setTextInputBorders(RenderStyle*);
diff --git a/Source/WebCore/platform/gtk/WidgetGtk.cpp b/Source/WebCore/platform/gtk/WidgetGtk.cpp
index ba21226eb..203f3c9c7 100644
--- a/Source/WebCore/platform/gtk/WidgetGtk.cpp
+++ b/Source/WebCore/platform/gtk/WidgetGtk.cpp
@@ -58,18 +58,6 @@ Widget::~Widget()
 
 void Widget::setFocus(bool focused)
 {
-    if (!focused)
-        return;
-
-    GtkWidget* widget = platformWidget() ? platformWidget() : root()->hostWindow()->platformPageClient();
-    if (widget) {
-        gtk_widget_grab_focus(widget);
-        return;
-    }
-
-    // We are running WK2.
-    if (Frame* frame = Frame::frameForWidget(this))
-        frame->page()->chrome()->focus();
 }
 
 void Widget::setCursor(const Cursor& cursor)
diff --git a/Source/WebCore/platform/image-decoders/jpeg/JPEGImageDecoder.cpp b/Source/WebCore/platform/image-decoders/jpeg/JPEGImageDecoder.cpp
index 5b42490ab..f0fbe44ac 100644
--- a/Source/WebCore/platform/image-decoders/jpeg/JPEGImageDecoder.cpp
+++ b/Source/WebCore/platform/image-decoders/jpeg/JPEGImageDecoder.cpp
@@ -70,6 +70,7 @@ extern "C" {
 #endif
 
 #if defined(JCS_ALPHA_EXTENSIONS) && ASSUME_LITTLE_ENDIAN
+inline J_DCT_METHOD dctMethod() { return JDCT_IFAST; }
 #define TURBO_JPEG_RGB_SWIZZLE
 #if USE(SKIA) && (!SK_R32_SHIFT && SK_G32_SHIFT == 8 && SK_B32_SHIFT == 16)
 inline J_COLOR_SPACE rgbOutputColorSpace() { return JCS_EXT_RGBA; }
@@ -78,6 +79,7 @@ inline J_COLOR_SPACE rgbOutputColorSpace() { return JCS_EXT_BGRA; }
 #endif
 inline bool turboSwizzled(J_COLOR_SPACE colorSpace) { return colorSpace == rgbOutputColorSpace(); }
 #else
+inline J_DCT_METHOD dctMethod() { return JDCT_ISLOW; }
 inline J_COLOR_SPACE rgbOutputColorSpace() { return JCS_RGB; }
 #endif
 
@@ -291,7 +293,7 @@ public:
             // Set parameters for decompression.
             // FIXME -- Should reset dct_method and dither mode for final pass
             // of progressive JPEG.
-            m_info.dct_method =  JDCT_ISLOW;
+            m_info.dct_method = dctMethod();
             m_info.dither_mode = JDITHER_FS;
             m_info.do_fancy_upsampling = true;
             m_info.enable_2pass_quant = false;
diff --git a/Source/WebCore/platform/image-encoders/skia/JPEGImageEncoder.cpp b/Source/WebCore/platform/image-encoders/skia/JPEGImageEncoder.cpp
index 01b0dc5a4..eb3341cc5 100644
--- a/Source/WebCore/platform/image-encoders/skia/JPEGImageEncoder.cpp
+++ b/Source/WebCore/platform/image-encoders/skia/JPEGImageEncoder.cpp
@@ -136,7 +136,8 @@ static bool encodePixels(IntSize imageSize, unsigned char* inputPixels, bool pre
 
 #if defined(JCS_EXTENSIONS)
     if (premultiplied) {
-        cinfo.in_color_space = JCS_EXT_BGRX;
+        cinfo.in_color_space = SK_B32_SHIFT ? JCS_EXT_RGBX : JCS_EXT_BGRX;
+
         cinfo.input_components = 4;
 
         jpeg_set_defaults(&cinfo);
diff --git a/Source/WebCore/platform/mac/ClipboardMac.h b/Source/WebCore/platform/mac/ClipboardMac.h
index 24e9b8060..a84f289dc 100644
--- a/Source/WebCore/platform/mac/ClipboardMac.h
+++ b/Source/WebCore/platform/mac/ClipboardMac.h
@@ -41,9 +41,9 @@ class FileList;
 class ClipboardMac : public Clipboard, public CachedImageClient {
     WTF_MAKE_FAST_ALLOCATED;
 public:
-    static PassRefPtr<ClipboardMac> create(ClipboardType clipboardType, NSPasteboard *pasteboard, ClipboardAccessPolicy policy, Frame* frame)
+    static PassRefPtr<ClipboardMac> create(ClipboardType clipboardType, const String& pasteboardName, ClipboardAccessPolicy policy, Frame* frame)
     {
-        return adoptRef(new ClipboardMac(clipboardType, pasteboard, policy, frame));
+        return adoptRef(new ClipboardMac(clipboardType, pasteboardName, policy, frame));
     }
 
     virtual ~ClipboardMac();
@@ -56,7 +56,7 @@ public:
     virtual bool hasData();
     
     // extensions beyond IE's API
-    virtual HashSet<String> types() const;
+    virtual PassRefPtr<DOMStringList> types() const;
     virtual PassRefPtr<FileList> files() const;
 
     void setDragImage(CachedImage*, const IntPoint&);
@@ -72,14 +72,14 @@ public:
     
     // Methods for getting info in Cocoa's type system
     NSImage *dragNSImage(NSPoint&) const; // loc converted from dragLoc, based on whole image size
-    NSPasteboard *pasteboard() { return m_pasteboard.get(); }
+    const String& pasteboardName() { return m_pasteboardName; }
 
 private:
-    ClipboardMac(ClipboardType, NSPasteboard *, ClipboardAccessPolicy, Frame*);
+    ClipboardMac(ClipboardType, const String& pasteboardName, ClipboardAccessPolicy, Frame*);
 
     void setDragImage(CachedImage*, Node*, const IntPoint&);
 
-    RetainPtr<NSPasteboard> m_pasteboard;
+    String m_pasteboardName;
     int m_changeCount;
     Frame* m_frame; // used on the source side to generate dragging images
 };
diff --git a/Source/WebCore/platform/mac/ClipboardMac.mm b/Source/WebCore/platform/mac/ClipboardMac.mm
index d37c5f3f3..88eefcb53 100644
--- a/Source/WebCore/platform/mac/ClipboardMac.mm
+++ b/Source/WebCore/platform/mac/ClipboardMac.mm
@@ -27,6 +27,7 @@
 #import "ClipboardMac.h"
 
 #import "DOMElementInternal.h"
+#import "DOMStringList.h"
 #import "DragClient.h"
 #import "DragController.h"
 #import "DragData.h"
@@ -36,6 +37,8 @@
 #import "Image.h"
 #import "Page.h"
 #import "Pasteboard.h"
+#import "PasteboardStrategy.h"
+#import "PlatformStrategies.h"
 #import "RenderImage.h"
 #import "ScriptExecutionContext.h"
 #import "SecurityOrigin.h"
@@ -46,15 +49,15 @@ namespace WebCore {
 
 PassRefPtr<Clipboard> Clipboard::create(ClipboardAccessPolicy policy, DragData* dragData, Frame* frame)
 {
-    return ClipboardMac::create(DragAndDrop, dragData->pasteboard(), policy, frame);
+    return ClipboardMac::create(DragAndDrop, dragData->pasteboardName(), policy, frame);
 }
 
-ClipboardMac::ClipboardMac(ClipboardType clipboardType, NSPasteboard *pasteboard, ClipboardAccessPolicy policy, Frame *frame)
+ClipboardMac::ClipboardMac(ClipboardType clipboardType, const String& pasteboardName, ClipboardAccessPolicy policy, Frame *frame)
     : Clipboard(policy, clipboardType)
-    , m_pasteboard(pasteboard)
+    , m_pasteboardName(pasteboardName)
     , m_frame(frame)
 {
-    m_changeCount = [m_pasteboard.get() changeCount];
+    m_changeCount = platformStrategies()->pasteboardStrategy()->changeCount(m_pasteboardName);
 }
 
 ClipboardMac::~ClipboardMac()
@@ -63,10 +66,12 @@ ClipboardMac::~ClipboardMac()
 
 bool ClipboardMac::hasData()
 {
-    return m_pasteboard && [m_pasteboard.get() types] && [[m_pasteboard.get() types] count] > 0;
+    Vector<String> types;
+    platformStrategies()->pasteboardStrategy()->getTypes(types, m_pasteboardName);
+    return !types.isEmpty();
 }
     
-static RetainPtr<NSString> cocoaTypeFromHTMLClipboardType(const String& type)
+static String cocoaTypeFromHTMLClipboardType(const String& type)
 {
     // http://www.whatwg.org/specs/web-apps/current-work/multipage/dnd.html#dom-datatransfer-setdata
     String qType = type.lower();
@@ -78,27 +83,27 @@ static RetainPtr<NSString> cocoaTypeFromHTMLClipboardType(const String& type)
 
     // Ignore any trailing charset - JS strings are Unicode, which encapsulates the charset issue
     if (qType == "text/plain" || qType.startsWith("text/plain;"))
-        return NSStringPboardType;
+        return String(NSStringPboardType);
     if (qType == "text/uri-list")
         // special case because UTI doesn't work with Cocoa's URL type
-        return NSURLPboardType; // note special case in getData to read NSFilenamesType
+        return String(NSURLPboardType); // note special case in getData to read NSFilenamesType
 
     // Try UTI now
-    NSString *mimeType = qType;
-    RetainPtr<CFStringRef> utiType(AdoptCF, UTTypeCreatePreferredIdentifierForTag(kUTTagClassMIMEType, (CFStringRef)mimeType, NULL));
+    String mimeType = qType;
+    RetainPtr<CFStringRef> utiType(AdoptCF, UTTypeCreatePreferredIdentifierForTag(kUTTagClassMIMEType, mimeType.createCFString(), NULL));
     if (utiType) {
         CFStringRef pbType = UTTypeCopyPreferredTagWithClass(utiType.get(), kUTTagClassNSPboardType);
         if (pbType)
-            return (NSString *)pbType;
+            return pbType;
     }
 
     // No mapping, just pass the whole string though
-    return (NSString *)qType;
+    return qType;
 }
 
-static String utiTypeFromCocoaType(NSString *type)
+static String utiTypeFromCocoaType(const String& type)
 {
-    RetainPtr<CFStringRef> utiType(AdoptCF, UTTypeCreatePreferredIdentifierForTag(kUTTagClassNSPboardType, (CFStringRef)type, NULL));
+    RetainPtr<CFStringRef> utiType(AdoptCF, UTTypeCreatePreferredIdentifierForTag(kUTTagClassNSPboardType, type.createCFString(), NULL));
     if (utiType) {
         RetainPtr<CFStringRef> mimeType(AdoptCF, UTTypeCopyPreferredTagWithClass(utiType.get(), kUTTagClassMIMEType));
         if (mimeType)
@@ -107,37 +112,38 @@ static String utiTypeFromCocoaType(NSString *type)
     return String();
 }
 
-static void addHTMLClipboardTypesForCocoaType(HashSet<String>& resultTypes, NSString *cocoaType, NSPasteboard *pasteboard)
+static void addHTMLClipboardTypesForCocoaType(DOMStringList* resultTypes, const String& cocoaType, const String& pasteboardName)
 {
     // UTI may not do these right, so make sure we get the right, predictable result
-    if ([cocoaType isEqualToString:NSStringPboardType]) {
-        resultTypes.add("text/plain");
+    if (cocoaType == String(NSStringPboardType)) {
+        resultTypes->append("text/plain");
         return;
     }
-    if ([cocoaType isEqualToString:NSURLPboardType]) {
-        resultTypes.add("text/uri-list");
+    if (cocoaType == String(NSURLPboardType)) {
+        resultTypes->append("text/uri-list");
         return;
     }
-    if ([cocoaType isEqualToString:NSFilenamesPboardType]) {
+    if (cocoaType == String(NSFilenamesPboardType)) {
         // If file list is empty, add nothing.
         // Note that there is a chance that the file list count could have changed since we grabbed the types array.
         // However, this is not really an issue for us doing a sanity check here.
-        NSArray *fileList = [pasteboard propertyListForType:NSFilenamesPboardType];
-        if ([fileList count]) {
+        Vector<String> fileList;
+        platformStrategies()->pasteboardStrategy()->getPathnamesForType(fileList, String(NSFilenamesPboardType), pasteboardName);
+        if (!fileList.isEmpty()) {
             // It is unknown if NSFilenamesPboardType always implies NSURLPboardType in Cocoa,
             // but NSFilenamesPboardType should imply both 'text/uri-list' and 'Files'
-            resultTypes.add("text/uri-list");
-            resultTypes.add("Files");
+            resultTypes->append("text/uri-list");
+            resultTypes->append("Files");
         }
         return;
     }
     String utiType = utiTypeFromCocoaType(cocoaType);
     if (!utiType.isEmpty()) {
-        resultTypes.add(utiType);
+        resultTypes->append(utiType);
         return;
     }
     // No mapping, just pass the whole string though
-    resultTypes.add(cocoaType);
+    resultTypes->append(cocoaType);
 }
 
 void ClipboardMac::clearData(const String& type)
@@ -147,8 +153,9 @@ void ClipboardMac::clearData(const String& type)
 
     // note NSPasteboard enforces changeCount itself on writing - can't write if not the owner
 
-    if (RetainPtr<NSString> cocoaType = cocoaTypeFromHTMLClipboardType(type))
-        [m_pasteboard.get() setString:@"" forType:cocoaType.get()];
+    String cocoaType = cocoaTypeFromHTMLClipboardType(type);
+    if (!cocoaType.isEmpty())
+        platformStrategies()->pasteboardStrategy()->setStringForType("", cocoaType, m_pasteboardName);
 }
 
 void ClipboardMac::clearAllData()
@@ -158,53 +165,51 @@ void ClipboardMac::clearAllData()
 
     // note NSPasteboard enforces changeCount itself on writing - can't write if not the owner
 
-    [m_pasteboard.get() declareTypes:[NSArray array] owner:nil];
+    Pasteboard pasteboard(m_pasteboardName);
+    pasteboard.clear();
 }
 
-static NSArray *absoluteURLsFromPasteboardFilenames(NSPasteboard* pasteboard, bool onlyFirstURL = false)
+static Vector<String> absoluteURLsFromPasteboardFilenames(const String& pasteboardName, bool onlyFirstURL = false)
 {
-    NSArray *fileList = [pasteboard propertyListForType:NSFilenamesPboardType];
+    Vector<String> fileList;
+    platformStrategies()->pasteboardStrategy()->getPathnamesForType(fileList, String(NSFilenamesPboardType), pasteboardName);
 
-    // FIXME: Why does this code need to guard against bad values on the pasteboard?
-    ASSERT(!fileList || [fileList isKindOfClass:[NSArray class]]);
-    if (!fileList || ![fileList isKindOfClass:[NSArray class]] || ![fileList count])
-        return nil;
+    if (fileList.isEmpty())
+        return fileList;
 
-    NSUInteger count = onlyFirstURL ? 1 : [fileList count];
-    NSMutableArray *urls = [NSMutableArray array];
-    for (NSUInteger i = 0; i < count; i++) {
-        NSString *string = [fileList objectAtIndex:i];
-
-        ASSERT([string isKindOfClass:[NSString class]]);  // Added to understand why this if code is here
-        if (![string isKindOfClass:[NSString class]])
-            return nil; // Non-string object in the list, bail out!  FIXME: When can this happen?
-
-        NSURL *url = [NSURL fileURLWithPath:string];
-        [urls addObject:[url absoluteString]];
+    size_t count = onlyFirstURL ? 1 : fileList.size();
+    Vector<String> urls;
+    for (size_t i = 0; i < count; i++) {
+        NSURL *url = [NSURL fileURLWithPath:fileList[i]];
+        urls.append(String([url absoluteString]));
     }
     return urls;
 }
 
-static NSArray *absoluteURLsFromPasteboard(NSPasteboard* pasteboard, bool onlyFirstURL = false)
+static Vector<String> absoluteURLsFromPasteboard(const String& pasteboardName, bool onlyFirstURL = false)
 {
     // NOTE: We must always check [availableTypes containsObject:] before accessing pasteboard data
     // or CoreFoundation will printf when there is not data of the corresponding type.
-    NSArray *availableTypes = [pasteboard types];
+    Vector<String> availableTypes;
+    Vector<String> absoluteURLs;
+    platformStrategies()->pasteboardStrategy()->getTypes(availableTypes, pasteboardName);
 
     // Try NSFilenamesPboardType because it contains a list
-    if ([availableTypes containsObject:NSFilenamesPboardType]) {
-        if (NSArray* absoluteURLs = absoluteURLsFromPasteboardFilenames(pasteboard, onlyFirstURL))
+    if (availableTypes.contains(String(NSFilenamesPboardType))) {
+        absoluteURLs = absoluteURLsFromPasteboardFilenames(pasteboardName, onlyFirstURL);
+        if (!absoluteURLs.isEmpty())
             return absoluteURLs;
     }
 
     // Fallback to NSURLPboardType (which is a single URL)
-    if ([availableTypes containsObject:NSURLPboardType]) {
-        if (NSURL *url = [NSURL URLFromPasteboard:pasteboard])
-            return [NSArray arrayWithObject:[url absoluteString]];
+    if (availableTypes.contains(String(NSURLPboardType))) {
+        platformStrategies()->pasteboardStrategy()->getPathnamesForType(absoluteURLs, String(NSURLPboardType), pasteboardName);
+        if (!absoluteURLs.isEmpty())
+            return absoluteURLs;
     }
 
     // No file paths on the pasteboard, return nil
-    return nil;
+    return Vector<String>();
 }
 
 String ClipboardMac::getData(const String& type, bool& success) const
@@ -213,23 +218,24 @@ String ClipboardMac::getData(const String& type, bool& success) const
     if (policy() != ClipboardReadable)
         return String();
 
-    RetainPtr<NSString> cocoaType = cocoaTypeFromHTMLClipboardType(type);
-    NSString *cocoaValue = nil;
+    const String& cocoaType = cocoaTypeFromHTMLClipboardType(type);
+    String cocoaValue;
 
     // Grab the value off the pasteboard corresponding to the cocoaType
-    if ([cocoaType.get() isEqualToString:NSURLPboardType]) {
+    if (cocoaType == String(NSURLPboardType)) {
         // "url" and "text/url-list" both map to NSURLPboardType in cocoaTypeFromHTMLClipboardType(), "url" only wants the first URL
         bool onlyFirstURL = (equalIgnoringCase(type, "url"));
-        NSArray *absoluteURLs = absoluteURLsFromPasteboard(m_pasteboard.get(), onlyFirstURL);
-        cocoaValue = [absoluteURLs componentsJoinedByString:@"\n"];
-    } else if ([cocoaType.get() isEqualToString:NSStringPboardType]) {
-        cocoaValue = [[m_pasteboard.get() stringForType:cocoaType.get()] precomposedStringWithCanonicalMapping];
-    } else if (cocoaType)
-        cocoaValue = [m_pasteboard.get() stringForType:cocoaType.get()];
+        Vector<String> absoluteURLs = absoluteURLsFromPasteboard(m_pasteboardName, onlyFirstURL);
+        for (size_t i = 0; i < absoluteURLs.size(); i++)
+            cocoaValue = i ? "\n" + absoluteURLs[i]: absoluteURLs[i];
+    } else if (cocoaType == String(NSStringPboardType))
+        cocoaValue = [platformStrategies()->pasteboardStrategy()->stringForType(cocoaType, m_pasteboardName) precomposedStringWithCanonicalMapping];
+    else if (!cocoaType.isEmpty())
+        cocoaValue = platformStrategies()->pasteboardStrategy()->stringForType(cocoaType, m_pasteboardName);
 
     // Enforce changeCount ourselves for security.  We check after reading instead of before to be
     // sure it doesn't change between our testing the change count and accessing the data.
-    if (cocoaValue && m_changeCount == [m_pasteboard.get() changeCount]) {
+    if (!cocoaValue.isEmpty() && m_changeCount == platformStrategies()->pasteboardStrategy()->changeCount(m_pasteboardName)) {
         success = true;
         return cocoaValue;
     }
@@ -243,58 +249,65 @@ bool ClipboardMac::setData(const String &type, const String &data)
         return false;
     // note NSPasteboard enforces changeCount itself on writing - can't write if not the owner
 
-    RetainPtr<NSString> cocoaType = cocoaTypeFromHTMLClipboardType(type);
-    NSString *cocoaData = data;
+    const String& cocoaType = cocoaTypeFromHTMLClipboardType(type);
+    String cocoaData = data;
 
-    if ([cocoaType.get() isEqualToString:NSURLPboardType]) {
-        [m_pasteboard.get() addTypes:[NSArray arrayWithObject:NSURLPboardType] owner:nil];
+    if (cocoaType == String(NSURLPboardType)) {
+        Vector<String> types;
+        types.append(String(NSURLPboardType));
+
+        platformStrategies()->pasteboardStrategy()->setTypes(types, m_pasteboardName);
+        platformStrategies()->pasteboardStrategy()->setStringForType(cocoaData, String(NSURLPboardType), m_pasteboardName);
         NSURL *url = [[NSURL alloc] initWithString:cocoaData];
-        [url writeToPasteboard:m_pasteboard.get()];
 
         if ([url isFileURL] && m_frame->document()->securityOrigin()->canLoadLocalResources()) {
-            [m_pasteboard.get() addTypes:[NSArray arrayWithObject:NSFilenamesPboardType] owner:nil];
-            NSArray *fileList = [NSArray arrayWithObject:[url path]];
-            [m_pasteboard.get() setPropertyList:fileList forType:NSFilenamesPboardType];
+            types.append(String(NSFilenamesPboardType));
+            platformStrategies()->pasteboardStrategy()->setTypes(types, m_pasteboardName);
+            Vector<String> fileList;
+            fileList.append(String([url path]));
+            platformStrategies()->pasteboardStrategy()->setPathnamesForType(fileList, String(NSFilenamesPboardType), m_pasteboardName);
         }
 
         [url release];
         return true;
     }
 
-    if (cocoaType) {
+    if (!cocoaType.isEmpty()) {
         // everything else we know of goes on the pboard as a string
-        [m_pasteboard.get() addTypes:[NSArray arrayWithObject:cocoaType.get()] owner:nil];
-        return [m_pasteboard.get() setString:cocoaData forType:cocoaType.get()];
+        Vector<String> types;
+        types.append(cocoaType);
+        platformStrategies()->pasteboardStrategy()->setTypes(types, m_pasteboardName);
+        platformStrategies()->pasteboardStrategy()->setStringForType(cocoaData, cocoaType, m_pasteboardName);
+        return true;
     }
 
     return false;
 }
 
-HashSet<String> ClipboardMac::types() const
+PassRefPtr<DOMStringList> ClipboardMac::types() const
 {
     if (policy() != ClipboardReadable && policy() != ClipboardTypesReadable)
-        return HashSet<String>();
+        return DOMStringList::create();
 
-    NSArray *types = [m_pasteboard.get() types];
+    Vector<String> types;
+    platformStrategies()->pasteboardStrategy()->getTypes(types, m_pasteboardName);
 
     // Enforce changeCount ourselves for security.  We check after reading instead of before to be
     // sure it doesn't change between our testing the change count and accessing the data.
-    if (m_changeCount != [m_pasteboard.get() changeCount])
-        return HashSet<String>();
+    if (m_changeCount != platformStrategies()->pasteboardStrategy()->changeCount(m_pasteboardName))
+        return DOMStringList::create();
 
-    HashSet<String> result;
-    NSUInteger count = [types count];
+    RefPtr<DOMStringList> result = DOMStringList::create();
     // FIXME: This loop could be split into two stages. One which adds all the HTML5 specified types
     // and a second which adds all the extra types from the cocoa clipboard (which is Mac-only behavior).
-    for (NSUInteger i = 0; i < count; i++) {
-        NSString *pbType = [types objectAtIndex:i];
-        if ([pbType isEqualToString:@"NeXT plain ascii pasteboard type"])
+    for (size_t i = 0; i < types.size(); i++) {
+        if (types[i] == "NeXT plain ascii pasteboard type")
             continue;   // skip this ancient type that gets auto-supplied by some system conversion
 
-        addHTMLClipboardTypesForCocoaType(result, pbType, m_pasteboard.get());
+        addHTMLClipboardTypesForCocoaType(result.get(), types[i], m_pasteboardName);
     }
 
-    return result;
+    return result.release();
 }
 
 // FIXME: We could cache the computed fileList if necessary
@@ -305,12 +318,11 @@ PassRefPtr<FileList> ClipboardMac::files() const
     if (policy() != ClipboardReadable)
         return FileList::create();
 
-    NSArray *absoluteURLs = absoluteURLsFromPasteboardFilenames(m_pasteboard.get());
-    NSUInteger count = [absoluteURLs count];
+    Vector<String> absoluteURLs = absoluteURLsFromPasteboardFilenames(m_pasteboardName);
 
     RefPtr<FileList> fileList = FileList::create();
-    for (NSUInteger x = 0; x < count; x++) {
-        NSURL *absoluteURL = [NSURL URLWithString:[absoluteURLs objectAtIndex:x]];
+    for (size_t i = 0; i < absoluteURLs.size(); i++) {
+        NSURL *absoluteURL = [NSURL URLWithString:absoluteURLs[i]];
         ASSERT([absoluteURL isFileURL]);
         fileList->append(File::create([absoluteURL path]));
     }
@@ -341,7 +353,7 @@ void ClipboardMac::setDragImage(CachedImage* image, Node *node, const IntPoint &
         m_dragLoc = loc;
         m_dragImageElement = node;
         
-        if (dragStarted() && m_changeCount == [m_pasteboard.get() changeCount]) {
+        if (dragStarted() && m_changeCount == platformStrategies()->pasteboardStrategy()->changeCount(m_pasteboardName)) {
             NSPoint cocoaLoc;
             NSImage* cocoaImage = dragNSImage(cocoaLoc);
             if (cocoaImage) {
@@ -367,21 +379,21 @@ void ClipboardMac::writeRange(Range* range, Frame* frame)
 {
     ASSERT(range);
     ASSERT(frame);
-    Pasteboard pasteboard([m_pasteboard.get() name]);
+    Pasteboard pasteboard(m_pasteboardName);
     pasteboard.writeSelection(range, frame->editor()->smartInsertDeleteEnabled() && frame->selection()->granularity() == WordGranularity, frame);
 }
 
 void ClipboardMac::writePlainText(const String& text)
 {
-    Pasteboard pasteboard([m_pasteboard.get() name]);
+    Pasteboard pasteboard(m_pasteboardName);
     pasteboard.writePlainText(text);
 }
 
 void ClipboardMac::writeURL(const KURL& url, const String& title, Frame* frame)
 {   
     ASSERT(frame);
-    ASSERT(m_pasteboard);
-    Pasteboard pasteboard([m_pasteboard.get() name]);
+    ASSERT(m_pasteboardName);
+    Pasteboard pasteboard(m_pasteboardName);
     pasteboard.writeURL(url, title, frame);
 }
     
@@ -390,7 +402,7 @@ void ClipboardMac::declareAndWriteDragImage(Element* element, const KURL& url, c
 {
     ASSERT(frame);
     if (Page* page = frame->page())
-        page->dragController()->client()->declareAndWriteDragImage(m_pasteboard.get(), kit(element), url, title, frame);
+        page->dragController()->client()->declareAndWriteDragImage(m_pasteboardName, kit(element), url, title, frame);
 }
 #endif // ENABLE(DRAG_SUPPORT)
     
diff --git a/Source/WebCore/platform/mac/DragDataMac.mm b/Source/WebCore/platform/mac/DragDataMac.mm
index bec007bd4..61eac930e 100644
--- a/Source/WebCore/platform/mac/DragDataMac.mm
+++ b/Source/WebCore/platform/mac/DragDataMac.mm
@@ -36,6 +36,8 @@
 #import "Frame.h"
 #import "MIMETypeRegistry.h"
 #import "Pasteboard.h"
+#import "PasteboardStrategy.h"
+#import "PlatformStrategies.h"
 #import "Range.h"
 
 namespace WebCore {
@@ -47,7 +49,7 @@ DragData::DragData(DragDataRef data, const IntPoint& clientPosition, const IntPo
     , m_platformDragData(data)
     , m_draggingSourceOperationMask(sourceOperationMask)
     , m_applicationFlags(flags)
-    , m_pasteboard([m_platformDragData draggingPasteboard])
+    , m_pasteboardName([[m_platformDragData draggingPasteboard] name])
 {
 }
 
@@ -58,92 +60,78 @@ DragData::DragData(const String& dragStorageName, const IntPoint& clientPosition
     , m_platformDragData(0)
     , m_draggingSourceOperationMask(sourceOperationMask)
     , m_applicationFlags(flags)
-    , m_pasteboard([NSPasteboard pasteboardWithName:dragStorageName])
+    , m_pasteboardName(dragStorageName)
 {
 }
     
 bool DragData::canSmartReplace() const
 {
-    //Need to call this so that the various Pasteboard type strings are intialised
-    Pasteboard::generalPasteboard();
-    return [[m_pasteboard.get() types] containsObject:WebSmartPastePboardType];
+    return Pasteboard(m_pasteboardName).canSmartReplace();
 }
 
 bool DragData::containsColor() const
 {
-    return [[m_pasteboard.get() types] containsObject:NSColorPboardType];
+    Vector<String> types;
+    platformStrategies()->pasteboardStrategy()->getTypes(types, m_pasteboardName);
+    return types.contains(String(NSColorPboardType));
 }
 
 bool DragData::containsFiles() const
 {
-    return [[m_pasteboard.get() types] containsObject:NSFilenamesPboardType];
+    Vector<String> types;
+    platformStrategies()->pasteboardStrategy()->getTypes(types, m_pasteboardName);
+    return types.contains(String(NSFilenamesPboardType));
 }
 
 unsigned DragData::numberOfFiles() const
 {
-    if (![[m_pasteboard.get() types] containsObject:NSFilenamesPboardType])
-        return 0;
-    return [[m_pasteboard.get() propertyListForType:NSFilenamesPboardType] count];
+    Vector<String> files;
+    platformStrategies()->pasteboardStrategy()->getPathnamesForType(files, String(NSFilenamesPboardType), m_pasteboardName);
+    return files.size();
 }
 
 void DragData::asFilenames(Vector<String>& result) const
 {
-    NSArray *filenames = [m_pasteboard.get() propertyListForType:NSFilenamesPboardType];
-    NSEnumerator *fileEnumerator = [filenames objectEnumerator];
-    
-    while (NSString *filename = [fileEnumerator nextObject])
-        result.append(filename);
+    platformStrategies()->pasteboardStrategy()->getPathnamesForType(result, String(NSFilenamesPboardType), m_pasteboardName);
 }
 
 bool DragData::containsPlainText() const
 {
-    NSArray *types = [m_pasteboard.get() types];
-    
-    return [types containsObject:NSStringPboardType] 
-        || [types containsObject:NSRTFDPboardType]
-        || [types containsObject:NSRTFPboardType]
-        || [types containsObject:NSFilenamesPboardType]
-        || [NSURL URLFromPasteboard:m_pasteboard.get()];
+    Vector<String> types;
+    platformStrategies()->pasteboardStrategy()->getTypes(types, m_pasteboardName);
+
+    return types.contains(String(NSStringPboardType))
+        || types.contains(String(NSRTFDPboardType))
+        || types.contains(String(NSRTFPboardType))
+        || types.contains(String(NSFilenamesPboardType))
+        || platformStrategies()->pasteboardStrategy()->stringForType(String(NSURLPboardType), m_pasteboardName).length();
 }
 
 String DragData::asPlainText(Frame *frame) const
 {
-    Pasteboard pasteboard([m_pasteboard.get() name]);
-    return pasteboard.plainText(frame);
+    return Pasteboard(m_pasteboardName).plainText(frame);
 }
 
 Color DragData::asColor() const
 {
-    NSColor *color = [NSColor colorFromPasteboard:m_pasteboard.get()];
-    
-    // The color may not be in an RGB colorspace. This commonly occurs when a color is 
-    // dragged from the NSColorPanel grayscale picker.
-    if ([[color colorSpace] colorSpaceModel] != NSRGBColorSpaceModel)
-        color = [color colorUsingColorSpaceName:NSCalibratedRGBColorSpace];
-    
-    return makeRGBA((int)([color redComponent] * 255.0 + 0.5), (int)([color greenComponent] * 255.0 + 0.5), 
-                    (int)([color blueComponent] * 255.0 + 0.5), (int)([color alphaComponent] * 255.0 + 0.5));
+    return platformStrategies()->pasteboardStrategy()->color(m_pasteboardName);
 }
 
-static NSArray *insertablePasteboardTypes()
-{
-    static NSArray *types = nil;
-    if (!types) {
-        types = [[NSArray alloc] initWithObjects:WebArchivePboardType, NSHTMLPboardType, NSFilenamesPboardType, NSTIFFPboardType, NSPDFPboardType,
-#ifdef BUILDING_ON_LEOPARD
-                 NSPICTPboardType,
-#endif
-                 NSURLPboardType, NSRTFDPboardType, NSRTFPboardType, NSStringPboardType, NSColorPboardType, kUTTypePNG, nil];
-        CFRetain(types);
-    }
-    return types;
-}
-    
 bool DragData::containsCompatibleContent() const
 {
-    NSMutableSet *types = [NSMutableSet setWithArray:[m_pasteboard.get() types]];
-    [types intersectSet:[NSSet setWithArray:insertablePasteboardTypes()]];
-    return [types count] != 0;
+    Vector<String> types;
+    platformStrategies()->pasteboardStrategy()->getTypes(types, m_pasteboardName);
+    return types.contains(String(WebArchivePboardType))
+        || types.contains(String(NSHTMLPboardType))
+        || types.contains(String(NSFilenamesPboardType))
+        || types.contains(String(NSTIFFPboardType))
+        || types.contains(String(NSPDFPboardType))
+        || types.contains(String(NSURLPboardType))
+        || types.contains(String(NSRTFDPboardType))
+        || types.contains(String(NSRTFPboardType))
+        || types.contains(String(NSStringPboardType))
+        || types.contains(String(NSColorPboardType))
+        || types.contains(String(kUTTypePNG));
 }
     
 bool DragData::containsURL(Frame* frame, FilenameConversionPolicy filenamePolicy) const
@@ -157,39 +145,40 @@ String DragData::asURL(Frame* frame, FilenameConversionPolicy filenamePolicy, St
     (void)filenamePolicy;
 
     if (title) {
-        if (NSString *URLTitleString = [m_pasteboard.get() stringForType:WebURLNamePboardType])
+        String URLTitleString = platformStrategies()->pasteboardStrategy()->stringForType(String(WebURLNamePboardType), m_pasteboardName);
+        if (!URLTitleString.isEmpty())
             *title = URLTitleString;
     }
     
-    NSArray *types = [m_pasteboard.get() types];
+    Vector<String> types;
+    platformStrategies()->pasteboardStrategy()->getTypes(types, m_pasteboardName);
     
     // FIXME: using the editorClient to call into WebKit, for now, since 
     // calling webkit_canonicalize from WebCore involves migrating a sizable amount of 
     // helper code that should either be done in a separate patch or figured out in another way.
     
-    if ([types containsObject:NSURLPboardType]) {
-        NSURL *URLFromPasteboard = [NSURL URLFromPasteboard:m_pasteboard.get()];
+    if (types.contains(String(NSURLPboardType))) {
+        NSURL *URLFromPasteboard = [NSURL URLWithString:platformStrategies()->pasteboardStrategy()->stringForType(String(NSURLPboardType), m_pasteboardName)];
         NSString *scheme = [URLFromPasteboard scheme];
         if ([scheme isEqualToString:@"http"] || [scheme isEqualToString:@"https"]) {
             return [frame->editor()->client()->canonicalizeURL(URLFromPasteboard) absoluteString];
         }
     }
     
-    if ([types containsObject:NSStringPboardType]) {
-        NSString *URLString = [m_pasteboard.get() stringForType:NSStringPboardType];
-        NSURL *URL = frame->editor()->client()->canonicalizeURLString(URLString);
+    if (types.contains(String(NSStringPboardType))) {
+        NSURL *URL = frame->editor()->client()->canonicalizeURLString(platformStrategies()->pasteboardStrategy()->stringForType(String(NSStringPboardType), m_pasteboardName));
         if (URL)
             return [URL absoluteString];
     }
     
-    if ([types containsObject:NSFilenamesPboardType]) {
-        NSArray *files = [m_pasteboard.get() propertyListForType:NSFilenamesPboardType];
-        if ([files count] == 1) {
-            NSString *file = [files objectAtIndex:0];
+    if (types.contains(String(NSFilenamesPboardType))) {
+        Vector<String> files;
+        platformStrategies()->pasteboardStrategy()->getPathnamesForType(files, String(NSFilenamesPboardType), m_pasteboardName);
+        if (files.size() == 1) {
             BOOL isDirectory;
-            if ([[NSFileManager defaultManager] fileExistsAtPath:file isDirectory:&isDirectory] && isDirectory)
+            if ([[NSFileManager defaultManager] fileExistsAtPath:files[0] isDirectory:&isDirectory] && isDirectory)
                 return String();
-            return [frame->editor()->client()->canonicalizeURL([NSURL fileURLWithPath:file]) absoluteString];
+            return [frame->editor()->client()->canonicalizeURL([NSURL fileURLWithPath:files[0]]) absoluteString];
         }
     }
     
@@ -198,9 +187,7 @@ String DragData::asURL(Frame* frame, FilenameConversionPolicy filenamePolicy, St
 
 PassRefPtr<DocumentFragment> DragData::asFragment(Frame* frame, PassRefPtr<Range> range, bool allowPlainText, bool& chosePlainText) const
 {
-    Pasteboard pasteboard([m_pasteboard.get() name]);
-    
-    return pasteboard.documentFragment(frame, range, allowPlainText, chosePlainText);
+    return Pasteboard(m_pasteboardName).documentFragment(frame, range, allowPlainText, chosePlainText);
 }
     
 } // namespace WebCore
diff --git a/Source/WebCore/platform/mac/Language.mm b/Source/WebCore/platform/mac/Language.mm
index 78ff1dd31..c15ff5ad9 100644
--- a/Source/WebCore/platform/mac/Language.mm
+++ b/Source/WebCore/platform/mac/Language.mm
@@ -56,33 +56,27 @@ static BOOL useCachedPreferredLanguages;
 
 namespace WebCore {
 
-static NSString *createHTTPStyleLanguageCode(NSString *languageCode)
+static String httpStyleLanguageCode(NSString *languageCode)
 {
     ASSERT(isMainThread());
 
     // Look up the language code using CFBundle.
-    CFStringRef preferredLanguageCode = wkCopyCFLocalizationPreferredName((CFStringRef)languageCode);
+    RetainPtr<CFStringRef> preferredLanguageCode(AdoptCF, wkCopyCFLocalizationPreferredName((CFStringRef)languageCode));
 
     if (preferredLanguageCode)
-        languageCode = (NSString *)preferredLanguageCode;
-    
+        languageCode = (NSString *)preferredLanguageCode.get();
+
     // Make the string lowercase.
     NSString *lowercaseLanguageCode = [languageCode lowercaseString];
-    
-    NSString *httpStyleLanguageCode;
-    
+
     // Turn a '_' into a '-' if it appears after a 2-letter language code.
     if ([lowercaseLanguageCode length] >= 3 && [lowercaseLanguageCode characterAtIndex:2] == '_') {
-        NSMutableString *mutableLanguageCode = [lowercaseLanguageCode mutableCopy];
-        [mutableLanguageCode replaceCharactersInRange:NSMakeRange(2, 1) withString:@"-"];
-        httpStyleLanguageCode = mutableLanguageCode;
-    } else
-        httpStyleLanguageCode = [lowercaseLanguageCode retain];
-    
-    if (preferredLanguageCode)
-        CFRelease(preferredLanguageCode);
+        RetainPtr<NSMutableString> mutableLanguageCode(AdoptNS, [lowercaseLanguageCode mutableCopy]);
+        [mutableLanguageCode.get() replaceCharactersInRange:NSMakeRange(2, 1) withString:@"-"];
+        return mutableLanguageCode.get();
+    }
 
-    return httpStyleLanguageCode;
+    return lowercaseLanguageCode;
 }
 
 Vector<String> platformUserPreferredLanguages()
@@ -103,7 +97,7 @@ Vector<String> platformUserPreferredLanguages()
             userPreferredLanguages.append("en");
         else {
             for (CFIndex i = 0; i < languageCount; i++)
-                userPreferredLanguages.append(createHTTPStyleLanguageCode((NSString *)CFArrayGetValueAtIndex(languages.get(), i)));
+                userPreferredLanguages.append(httpStyleLanguageCode((NSString *)CFArrayGetValueAtIndex(languages.get(), i)));
         }
     }
 
diff --git a/Source/WebCore/platform/mac/PasteboardMac.mm b/Source/WebCore/platform/mac/PasteboardMac.mm
index 877e0a6f7..6e4bda87d 100644
--- a/Source/WebCore/platform/mac/PasteboardMac.mm
+++ b/Source/WebCore/platform/mac/PasteboardMac.mm
@@ -56,59 +56,64 @@
 #import <wtf/StdLibExtras.h>
 #import <wtf/RetainPtr.h>
 #import <wtf/UnusedParam.h>
+#import <wtf/text/StringBuilder.h>
 #import <wtf/unicode/CharacterNames.h>
 
-@interface NSAttributedString (AppKitSecretsIKnowAbout)
-- (id)_initWithDOMRange:(DOMRange *)domRange;
-@end
+#if USE(PLATFORM_STRATEGIES)
+#include "PasteboardStrategy.h"
+#include "PlatformStrategies.h"
+#endif
+
 namespace WebCore {
 
 // FIXME: It's not great to have these both here and in WebKit.
-NSString *WebArchivePboardType = @"Apple Web Archive pasteboard type";
-NSString *WebSmartPastePboardType = @"NeXT smart paste pasteboard type";
-NSString *WebURLNamePboardType = @"public.url-name";
-NSString *WebURLPboardType = @"public.url";
-NSString *WebURLsWithTitlesPboardType = @"WebURLsWithTitlesPboardType";
+const char* WebArchivePboardType = "Apple Web Archive pasteboard type";
+const char* WebSmartPastePboardType = "NeXT smart paste pasteboard type";
+const char* WebURLNamePboardType = "public.url-name";
+const char* WebURLPboardType = "public.url";
+const char* WebURLsWithTitlesPboardType = "WebURLsWithTitlesPboardType";
 
-static NSArray* selectionPasteboardTypes(bool canSmartCopyOrDelete, bool selectionContainsAttachments)
+static Vector<String> selectionPasteboardTypes(bool canSmartCopyOrDelete, bool selectionContainsAttachments)
 {
-    if (selectionContainsAttachments) {
-        if (canSmartCopyOrDelete)
-            return [NSArray arrayWithObjects:WebSmartPastePboardType, WebArchivePboardType, NSRTFDPboardType, NSRTFPboardType, NSStringPboardType, nil];
-        else
-            return [NSArray arrayWithObjects:WebArchivePboardType, NSRTFDPboardType, NSRTFPboardType, NSStringPboardType, nil];
-    } else { // Don't write RTFD to the pasteboard when the copied attributed string has no attachments.
-        if (canSmartCopyOrDelete)
-            return [NSArray arrayWithObjects:WebSmartPastePboardType, WebArchivePboardType, NSRTFPboardType, NSStringPboardType, nil];
-        else
-            return [NSArray arrayWithObjects:WebArchivePboardType, NSRTFPboardType, NSStringPboardType, nil];
-    }
+    Vector<String> types;
+    if (canSmartCopyOrDelete)
+        types.append(WebSmartPastePboardType);
+    types.append(WebArchivePboardType);
+    if (selectionContainsAttachments)
+        types.append(String(NSRTFDPboardType));
+    types.append(String(NSRTFPboardType));
+    types.append(String(NSStringPboardType));
+
+    return types;
 }
 
-static NSArray* writableTypesForURL()
+static const Vector<String> writableTypesForURL()
 {
-    DEFINE_STATIC_LOCAL(RetainPtr<NSArray>, types, ([[NSArray alloc] initWithObjects:
-            WebURLsWithTitlesPboardType,
-            NSURLPboardType,
-            WebURLPboardType,
-            WebURLNamePboardType,
-            NSStringPboardType,
-            nil]));
-    return types.get();
+    Vector<String> types;
+    
+    types.append(WebURLsWithTitlesPboardType);
+    types.append(String(NSURLPboardType));
+    types.append(WebURLPboardType);
+    types.append(WebURLNamePboardType);
+    types.append(String(NSStringPboardType));        
+    return types;
 }
 
-static inline NSArray* createWritableTypesForImage()
+static inline Vector<String> createWritableTypesForImage()
 {
-    NSMutableArray *types = [[NSMutableArray alloc] initWithObjects:NSTIFFPboardType, nil];
-    [types addObjectsFromArray:writableTypesForURL()];
-    [types addObject:NSRTFDPboardType];
+    Vector<String> types;
+    
+    types.append(String(NSTIFFPboardType));
+    types.append(writableTypesForURL());
+    types.append(String(NSRTFDPboardType));
     return types;
 }
 
-static NSArray* writableTypesForImage()
+static Vector<String> writableTypesForImage()
 {
-    DEFINE_STATIC_LOCAL(RetainPtr<NSArray>, types, (createWritableTypesForImage()));
-    return types.get();
+    Vector<String> types;
+    types.append(createWritableTypesForImage());
+    return types;
 }
 
 Pasteboard* Pasteboard::generalPasteboard() 
@@ -118,17 +123,17 @@ Pasteboard* Pasteboard::generalPasteboard()
 }
 
 Pasteboard::Pasteboard(const String& pasteboardName)
-    : m_pasteboard([NSPasteboard pasteboardWithName:pasteboardName])
+    : m_pasteboardName(pasteboardName)
 {
     ASSERT(pasteboardName);
 }
 
 void Pasteboard::clear()
 {
-    [m_pasteboard.get() declareTypes:[NSArray array] owner:nil];
+    platformStrategies()->pasteboardStrategy()->setTypes(Vector<String>(), m_pasteboardName);
 }
 
-void Pasteboard::writeSelectionForTypes(NSArray* pasteboardTypes, Range* selectedRange, bool canSmartCopyOrDelete, Frame* frame)
+void Pasteboard::writeSelectionForTypes(const Vector<String>& pasteboardTypes, Range* selectedRange, bool canSmartCopyOrDelete, Frame* frame)
 {
     if (!WebArchivePboardType)
         Pasteboard::generalPasteboard(); // Initializes pasteboard types.
@@ -145,44 +150,36 @@ void Pasteboard::writeSelectionForTypes(NSArray* pasteboardTypes, Range* selecte
     if (enclosingAnchor && comparePositions(firstPositionInOrBeforeNode(selectedRange->startPosition().anchorNode()), selectedRange->startPosition()) >= 0)
         selectedRange->setStart(enclosingAnchor, 0, ec);
 
-    // Using different API for WebKit and WebKit2.
     NSAttributedString *attributedString = nil;
-    if (frame->view()->platformWidget())
-        attributedString = [[[NSAttributedString alloc] _initWithDOMRange:kit(selectedRange)] autorelease];
-#ifndef BUILDING_ON_LEOPARD
-    else {
-        // In WebKit2 we are using a different way to create the NSAttributedString from the DOMrange that doesn't require access to the WebView.
-        RetainPtr<WebHTMLConverter> converter(AdoptNS, [[WebHTMLConverter alloc] initWithDOMRange:kit(selectedRange)]);
-        if (converter)
-            attributedString = [converter.get() attributedString];
-    }
-#endif
+    RetainPtr<WebHTMLConverter> converter(AdoptNS, [[WebHTMLConverter alloc] initWithDOMRange:kit(selectedRange)]);
+    if (converter)
+        attributedString = [converter.get() attributedString];
 
-    NSArray *types = pasteboardTypes ? pasteboardTypes : selectionPasteboardTypes(canSmartCopyOrDelete, [attributedString containsAttachments]);
-    [m_pasteboard.get() declareTypes:types owner:nil];
+    const Vector<String> types = !pasteboardTypes.isEmpty() ? pasteboardTypes : selectionPasteboardTypes(canSmartCopyOrDelete, [attributedString containsAttachments]);
+    platformStrategies()->pasteboardStrategy()->setTypes(types, m_pasteboardName);
     frame->editor()->client()->didSetSelectionTypesForPasteboard();
     
     // Put HTML on the pasteboard.
-    if ([types containsObject:WebArchivePboardType]) {
+    if (types.contains(WebArchivePboardType)) {
         RefPtr<LegacyWebArchive> archive = LegacyWebArchive::createFromSelection(frame);
         RetainPtr<CFDataRef> data = archive ? archive->rawDataRepresentation() : 0;
-        [m_pasteboard.get() setData:(NSData *)data.get() forType:WebArchivePboardType];
+        platformStrategies()->pasteboardStrategy()->setBufferForType(SharedBuffer::wrapNSData((NSData *)data.get()), WebArchivePboardType, m_pasteboardName);
     }
     
     // Put the attributed string on the pasteboard (RTF/RTFD format).
-    if ([types containsObject:NSRTFDPboardType]) {
+    if (types.contains(String(NSRTFDPboardType))) {
         NSData *RTFDData = [attributedString RTFDFromRange:NSMakeRange(0, [attributedString length]) documentAttributes:nil];
-        [m_pasteboard.get() setData:RTFDData forType:NSRTFDPboardType];
+        platformStrategies()->pasteboardStrategy()->setBufferForType(SharedBuffer::wrapNSData((NSData *)RTFDData).get(), NSRTFDPboardType, m_pasteboardName);
     }
-    if ([types containsObject:NSRTFPboardType]) {
+    if (types.contains(String(NSRTFPboardType))) {
         if ([attributedString containsAttachments])
             attributedString = attributedStringByStrippingAttachmentCharacters(attributedString);
         NSData *RTFData = [attributedString RTFFromRange:NSMakeRange(0, [attributedString length]) documentAttributes:nil];
-        [m_pasteboard.get() setData:RTFData forType:NSRTFPboardType];
+        platformStrategies()->pasteboardStrategy()->setBufferForType(SharedBuffer::wrapNSData((NSData *)RTFData).get(), NSRTFPboardType, m_pasteboardName);
     }
     
     // Put plain string on the pasteboard.
-    if ([types containsObject:NSStringPboardType]) {
+    if (types.contains(String(NSStringPboardType))) {
         // Map &nbsp; to a plain old space because this is better for source code, other browsers do it,
         // and because HTML forces you to do this any time you want two spaces in a row.
         String text = frame->editor()->selectedText();
@@ -190,29 +187,30 @@ void Pasteboard::writeSelectionForTypes(NSArray* pasteboardTypes, Range* selecte
         
         NSString *NonBreakingSpaceString = [NSString stringWithCharacters:&noBreakSpace length:1];
         [s replaceOccurrencesOfString:NonBreakingSpaceString withString:@" " options:0 range:NSMakeRange(0, [s length])];
-        [m_pasteboard.get() setString:s forType:NSStringPboardType];
+        platformStrategies()->pasteboardStrategy()->setStringForType(s, NSStringPboardType, m_pasteboardName);
         [s release];
     }
     
-    if ([types containsObject:WebSmartPastePboardType]) {
-        [m_pasteboard.get() setData:nil forType:WebSmartPastePboardType];
-    }
+    if (types.contains(WebSmartPastePboardType))
+        platformStrategies()->pasteboardStrategy()->setBufferForType(0, WebSmartPastePboardType, m_pasteboardName);
 }
 
 void Pasteboard::writePlainText(const String& text)
 {
-    [m_pasteboard.get() declareTypes:[NSArray arrayWithObject:NSStringPboardType] owner:nil];
-    [m_pasteboard.get() setString:text forType:NSStringPboardType];
+    Vector<String> types;
+    types.append(NSStringPboardType);
+    platformStrategies()->pasteboardStrategy()->setTypes(types, m_pasteboardName);
+    platformStrategies()->pasteboardStrategy()->setStringForType(text, NSStringPboardType, m_pasteboardName);
 }
     
 void Pasteboard::writeSelection(Range* selectedRange, bool canSmartCopyOrDelete, Frame* frame)
 {
-    writeSelectionForTypes(nil, selectedRange, canSmartCopyOrDelete, frame);
+    writeSelectionForTypes(Vector<String>(), selectedRange, canSmartCopyOrDelete, frame);
 }
 
-static void writeURLForTypes(NSArray* types, NSPasteboard* pasteboard, const KURL& url, const String& titleStr, Frame* frame)
+static void writeURLForTypes(const Vector<String>& types, const String& pasteboardName, const KURL& url, const String& titleStr, Frame* frame)
 {
-    [pasteboard declareTypes:types owner:nil];
+    platformStrategies()->pasteboardStrategy()->setTypes(types, pasteboardName);
     
     ASSERT(!url.isEmpty());
     
@@ -225,25 +223,25 @@ static void writeURLForTypes(NSArray* types, NSPasteboard* pasteboard, const KUR
         if ([title length] == 0)
             title = userVisibleString;
     }
-        
-    if ([types containsObject:WebURLsWithTitlesPboardType])
-        [pasteboard setPropertyList:[NSArray arrayWithObjects:[NSArray arrayWithObject:userVisibleString], 
-                                     [NSArray arrayWithObject:(NSString*)titleStr.stripWhiteSpace()], 
-                                     nil]
-                            forType:WebURLsWithTitlesPboardType];
-    if ([types containsObject:NSURLPboardType])
-        [cocoaURL writeToPasteboard:pasteboard];
-    if ([types containsObject:WebURLPboardType])
-        [pasteboard setString:userVisibleString forType:WebURLPboardType];
-    if ([types containsObject:WebURLNamePboardType])
-        [pasteboard setString:title forType:WebURLNamePboardType];
-    if ([types containsObject:NSStringPboardType])
-        [pasteboard setString:userVisibleString forType:NSStringPboardType];
+    if (types.contains(WebURLsWithTitlesPboardType)) {
+        Vector<String> paths;
+        paths.append(userVisibleString);
+        paths.append(titleStr.stripWhiteSpace());
+        platformStrategies()->pasteboardStrategy()->setPathnamesForType(paths, WebURLsWithTitlesPboardType, pasteboardName);
+    }
+    if (types.contains(String(NSURLPboardType)))
+        platformStrategies()->pasteboardStrategy()->setStringForType([cocoaURL absoluteString], NSURLPboardType, pasteboardName);
+    if (types.contains(WebURLPboardType))
+        platformStrategies()->pasteboardStrategy()->setStringForType(userVisibleString, WebURLPboardType, pasteboardName);
+    if (types.contains(WebURLNamePboardType))
+        platformStrategies()->pasteboardStrategy()->setStringForType(title, WebURLNamePboardType, pasteboardName);
+    if (types.contains(String(NSStringPboardType)))
+        platformStrategies()->pasteboardStrategy()->setStringForType(userVisibleString, NSStringPboardType, pasteboardName);
 }
     
 void Pasteboard::writeURL(const KURL& url, const String& titleStr, Frame* frame)
 {
-    writeURLForTypes(writableTypesForURL(), m_pasteboard.get(), url, titleStr, frame);
+    writeURLForTypes(writableTypesForURL(), m_pasteboardName, url, titleStr, frame);
 }
 
 static NSFileWrapper* fileWrapperForImage(CachedResource* resource, NSURL *url)
@@ -259,7 +257,7 @@ static NSFileWrapper* fileWrapperForImage(CachedResource* resource, NSURL *url)
     return wrapper;
 }
 
-static void writeFileWrapperAsRTFDAttachment(NSFileWrapper* wrapper, NSPasteboard* pasteboard)
+static void writeFileWrapperAsRTFDAttachment(NSFileWrapper* wrapper, const String& pasteboardName)
 {
     NSTextAttachment *attachment = [[NSTextAttachment alloc] initWithFileWrapper:wrapper];
     
@@ -267,7 +265,7 @@ static void writeFileWrapperAsRTFDAttachment(NSFileWrapper* wrapper, NSPasteboar
     [attachment release];
     
     NSData *RTFDData = [string RTFDFromRange:NSMakeRange(0, [string length]) documentAttributes:nil];
-    [pasteboard setData:RTFDData forType:NSRTFDPboardType];
+    platformStrategies()->pasteboardStrategy()->setBufferForType(SharedBuffer::wrapNSData((NSData *)RTFDData).get(), NSRTFDPboardType, pasteboardName);
 }
 
 void Pasteboard::writeImage(Node* node, const KURL& url, const String& title)
@@ -277,8 +275,6 @@ void Pasteboard::writeImage(Node* node, const KURL& url, const String& title)
     if (!(node->renderer() && node->renderer()->isImage()))
         return;
 
-    Frame* frame = node->document()->frame();
-
     NSURL *cocoaURL = url;
     ASSERT(cocoaURL);
 
@@ -287,68 +283,72 @@ void Pasteboard::writeImage(Node* node, const KURL& url, const String& title)
     if (!cachedImage || cachedImage->errorOccurred())
         return;
 
-    writeURLForTypes(writableTypesForImage(), m_pasteboard.get(), cocoaURL, nsStringNilIfEmpty(title), frame);
+    writeURLForTypes(writableTypesForImage(), m_pasteboardName, cocoaURL, nsStringNilIfEmpty(title), node->document()->frame());
     
     Image* image = cachedImage->imageForRenderer(renderer);
     ASSERT(image);
     
-    [m_pasteboard.get() setData:[image->getNSImage() TIFFRepresentation] forType:NSTIFFPboardType];
+    platformStrategies()->pasteboardStrategy()->setBufferForType(SharedBuffer::wrapNSData((NSData *)[image->getNSImage() TIFFRepresentation]), NSTIFFPboardType, m_pasteboardName);
 
     String MIMEType = cachedImage->response().mimeType();
     ASSERT(MIMETypeRegistry::isSupportedImageResourceMIMEType(MIMEType));
 
-    writeFileWrapperAsRTFDAttachment(fileWrapperForImage(cachedImage, cocoaURL), m_pasteboard.get());
+    writeFileWrapperAsRTFDAttachment(fileWrapperForImage(cachedImage, cocoaURL), m_pasteboardName);
 }
 
 void Pasteboard::writeClipboard(Clipboard* clipboard)
 {
-    NSPasteboard* pasteboard = static_cast<ClipboardMac*>(clipboard)->pasteboard();
-    NSArray* types = [pasteboard types];
-
-    [m_pasteboard.get() addTypes:types owner:nil];
-    for (NSUInteger i = 0; i < [types count]; i++) {
-        NSString* type = [types objectAtIndex:i];
-        [m_pasteboard.get() setData:[pasteboard dataForType:type] forType:type];
-    }
+    platformStrategies()->pasteboardStrategy()->copy(static_cast<ClipboardMac*>(clipboard)->pasteboardName(), m_pasteboardName);
 }
 
 bool Pasteboard::canSmartReplace()
 {
-    return [[m_pasteboard.get() types] containsObject:WebSmartPastePboardType];
+    Vector<String> types;
+    platformStrategies()->pasteboardStrategy()->getTypes(types, m_pasteboardName);
+    return types.contains(WebSmartPastePboardType);
 }
 
 String Pasteboard::plainText(Frame* frame)
 {
-    NSArray *types = [m_pasteboard.get() types];
+    Vector<String> types;
+    platformStrategies()->pasteboardStrategy()->getTypes(types, m_pasteboardName);
     
-    if ([types containsObject:NSStringPboardType])
-        return [[m_pasteboard.get() stringForType:NSStringPboardType] precomposedStringWithCanonicalMapping];
+    if (types.contains(String(NSStringPboardType)))
+        return [(NSString *)platformStrategies()->pasteboardStrategy()->stringForType(NSStringPboardType, m_pasteboardName) precomposedStringWithCanonicalMapping];
     
     NSAttributedString *attributedString = nil;
     NSString *string;
 
-    if ([types containsObject:NSRTFDPboardType])
-        attributedString = [[NSAttributedString alloc] initWithRTFD:[m_pasteboard.get() dataForType:NSRTFDPboardType] documentAttributes:NULL];
-    if (attributedString == nil && [types containsObject:NSRTFPboardType])
-        attributedString = [[NSAttributedString alloc] initWithRTF:[m_pasteboard.get() dataForType:NSRTFPboardType] documentAttributes:NULL];
+    if (types.contains(String(NSRTFDPboardType))) {
+        RefPtr<SharedBuffer> data = platformStrategies()->pasteboardStrategy()->bufferForType(NSRTFDPboardType, m_pasteboardName);
+        attributedString = [[NSAttributedString alloc] initWithRTFD:[data->createNSData() autorelease] documentAttributes:NULL];
+    }
+    if (attributedString == nil && types.contains(String(NSRTFPboardType))) {
+        RefPtr<SharedBuffer> data = platformStrategies()->pasteboardStrategy()->bufferForType(NSRTFPboardType, m_pasteboardName);
+        attributedString = [[NSAttributedString alloc] initWithRTF:[data->createNSData() autorelease] documentAttributes:NULL];
+    }
     if (attributedString != nil) {
         string = [[attributedString string] precomposedStringWithCanonicalMapping];
         [attributedString release];
         return string;
     }
     
-    if ([types containsObject:NSFilenamesPboardType]) {
-        string = [[[m_pasteboard.get() propertyListForType:NSFilenamesPboardType] componentsJoinedByString:@"\n"] precomposedStringWithCanonicalMapping];
-        if (string != nil)
-            return string;
+    if (types.contains(String(NSFilenamesPboardType))) {
+        Vector<String> pathnames;
+        platformStrategies()->pasteboardStrategy()->getPathnamesForType(pathnames, NSFilenamesPboardType, m_pasteboardName);
+        StringBuilder builder;
+        for (size_t i = 0; i < pathnames.size(); i++)
+            builder.append(i ? "\n" + pathnames[i] : pathnames[i]);
+        string = builder.toString();
+        return [string precomposedStringWithCanonicalMapping];
     }
     
-    
-    if (NSURL *url = [NSURL URLFromPasteboard:m_pasteboard.get()]) {
+    string = platformStrategies()->pasteboardStrategy()->stringForType(NSURLPboardType, m_pasteboardName);
+    if ([string length]) {
         // FIXME: using the editorClient to call into webkit, for now, since 
         // calling _web_userVisibleString from WebCore involves migrating a sizable web of 
         // helper code that should either be done in a separate patch or figured out in another way.
-        string = frame->editor()->client()->userVisibleString(url);
+        string = frame->editor()->client()->userVisibleString([NSURL URLWithString:string]);
         if ([string length] > 0)
             return [string precomposedStringWithCanonicalMapping];
     }
@@ -377,16 +377,20 @@ static PassRefPtr<DocumentFragment> documentFragmentWithImageResource(Frame* fra
     return 0;
 }
 
-static PassRefPtr<DocumentFragment> documentFragmentWithRTF(Frame* frame, NSString *pasteboardType, NSPasteboard *pasteboard)
+static PassRefPtr<DocumentFragment> documentFragmentWithRTF(Frame* frame, NSString *pasteboardType,const String& pastebordName)
 {
     if (!frame || !frame->document() || !frame->document()->isHTMLDocument())
         return 0;
 
     NSAttributedString *string = nil;
-    if (pasteboardType == NSRTFDPboardType)
-        string = [[NSAttributedString alloc] initWithRTFD:[pasteboard dataForType:NSRTFDPboardType] documentAttributes:NULL];
-    if (string == nil)
-        string = [[NSAttributedString alloc] initWithRTF:[pasteboard dataForType:NSRTFPboardType] documentAttributes:NULL];
+    if (pasteboardType == NSRTFDPboardType) {
+        RefPtr<SharedBuffer> data = platformStrategies()->pasteboardStrategy()->bufferForType(NSRTFDPboardType, pastebordName);
+        string = [[NSAttributedString alloc] initWithRTFD:[data->createNSData() autorelease] documentAttributes:NULL];
+    }
+    if (string == nil) {
+        RefPtr<SharedBuffer> data = platformStrategies()->pasteboardStrategy()->bufferForType(NSRTFPboardType, pastebordName);
+        string = [[NSAttributedString alloc] initWithRTF:[data->createNSData() autorelease] documentAttributes:NULL];
+    }
     if (string == nil)
         return nil;
 
@@ -426,12 +430,13 @@ static NSURL* uniqueURLWithRelativePart(NSString *relativePart)
 
 PassRefPtr<DocumentFragment> Pasteboard::documentFragment(Frame* frame, PassRefPtr<Range> context, bool allowPlainText, bool& chosePlainText)
 {
-    NSArray *types = [m_pasteboard.get() types];
+    Vector<String> types;
+    platformStrategies()->pasteboardStrategy()->getTypes(types, m_pasteboardName);
     RefPtr<DocumentFragment> fragment;
     chosePlainText = false;
 
-    if ([types containsObject:WebArchivePboardType]) {
-        RefPtr<LegacyWebArchive> coreArchive = LegacyWebArchive::create(KURL(), SharedBuffer::wrapNSData([m_pasteboard.get() dataForType:WebArchivePboardType]).get());
+    if (types.contains(WebArchivePboardType)) {
+        RefPtr<LegacyWebArchive> coreArchive = LegacyWebArchive::create(KURL(), platformStrategies()->pasteboardStrategy()->bufferForType(WebArchivePboardType, m_pasteboardName).get());
         if (coreArchive) {
             RefPtr<ArchiveResource> mainResource = coreArchive->mainResource();
             if (mainResource) {
@@ -454,17 +459,16 @@ PassRefPtr<DocumentFragment> Pasteboard::documentFragment(Frame* frame, PassRefP
             return fragment.release();
     } 
 
-    if ([types containsObject:NSFilenamesPboardType]) {
-        NSArray* paths = [m_pasteboard.get() propertyListForType:NSFilenamesPboardType];
-        NSEnumerator* enumerator = [paths objectEnumerator];
-        NSString* path;
+    if (types.contains(String(NSFilenamesPboardType))) {
+        Vector<String> paths;
+        platformStrategies()->pasteboardStrategy()->getPathnamesForType(paths, NSFilenamesPboardType, m_pasteboardName);
         Vector< RefPtr<Node> > refNodesVector;
         Vector<Node*> nodesVector;
 
-        while ((path = [enumerator nextObject]) != nil) {
+        for (size_t i = 0; i < paths.size(); i++) {
             // Non-image file types; _web_userVisibleString is appropriate here because this will
             // be pasted as visible text.
-            NSString *url = frame->editor()->client()->userVisibleString([NSURL fileURLWithPath:path]);
+            NSString *url = frame->editor()->client()->userVisibleString([NSURL fileURLWithPath:paths[i]]);
             RefPtr<Node> textNode = frame->document()->createTextNode(url);
             refNodesVector.append(textNode.get());
             nodesVector.append(textNode.get());
@@ -474,8 +478,8 @@ PassRefPtr<DocumentFragment> Pasteboard::documentFragment(Frame* frame, PassRefP
             return fragment.release();
     }
 
-    if ([types containsObject:NSHTMLPboardType]) {
-        NSString *HTMLString = [m_pasteboard.get() stringForType:NSHTMLPboardType];
+    if (types.contains(String(NSHTMLPboardType))) {
+        NSString *HTMLString = platformStrategies()->pasteboardStrategy()->stringForType(NSHTMLPboardType, m_pasteboardName);
         // This is a hack to make Microsoft's HTML pasteboard data work. See 3778785.
         if ([HTMLString hasPrefix:@"Version:"]) {
             NSRange range = [HTMLString rangeOfString:@"<html" options:NSCaseInsensitiveSearch];
@@ -488,36 +492,28 @@ PassRefPtr<DocumentFragment> Pasteboard::documentFragment(Frame* frame, PassRefP
             return fragment.release();
     }
 
-    if ([types containsObject:NSRTFDPboardType] &&
-        (fragment = documentFragmentWithRTF(frame, NSRTFDPboardType, m_pasteboard.get())))
+    if (types.contains(String(NSRTFDPboardType)) &&
+        (fragment = documentFragmentWithRTF(frame, NSRTFDPboardType, m_pasteboardName)))
        return fragment.release();
 
-    if ([types containsObject:NSRTFPboardType] &&
-        (fragment = documentFragmentWithRTF(frame, NSRTFPboardType, m_pasteboard.get())))
+    if (types.contains(String(NSRTFPboardType)) &&
+        (fragment = documentFragmentWithRTF(frame, NSRTFPboardType, m_pasteboardName)))
         return fragment.release();
 
-    if ([types containsObject:NSTIFFPboardType] &&
-        (fragment = documentFragmentWithImageResource(frame, ArchiveResource::create(SharedBuffer::wrapNSData([[[m_pasteboard.get() dataForType:NSTIFFPboardType] copy] autorelease]), uniqueURLWithRelativePart(@"image.tiff"), "image/tiff", "", ""))))
+    if (types.contains(String(NSTIFFPboardType)) &&
+        (fragment = documentFragmentWithImageResource(frame, ArchiveResource::create(platformStrategies()->pasteboardStrategy()->bufferForType(NSTIFFPboardType, m_pasteboardName), uniqueURLWithRelativePart(@"image.tiff"), "image/tiff", "", ""))))
         return fragment.release();
 
-    if ([types containsObject:NSPDFPboardType] &&
-        (fragment = documentFragmentWithImageResource(frame, ArchiveResource::create(SharedBuffer::wrapNSData([[[m_pasteboard.get() dataForType:NSPDFPboardType] copy] autorelease]), uniqueURLWithRelativePart(@"application.pdf"), "application/pdf", "", ""))))
+    if (types.contains(String(NSPDFPboardType)) &&
+        (fragment = documentFragmentWithImageResource(frame, ArchiveResource::create(platformStrategies()->pasteboardStrategy()->bufferForType(NSPDFPboardType, m_pasteboardName).get(), uniqueURLWithRelativePart(@"application.pdf"), "application/pdf", "", ""))))
         return fragment.release();
 
-#ifdef BUILDING_ON_LEOPARD
-    if ([types containsObject:NSPICTPboardType] &&
-        (fragment = documentFragmentWithImageResource(frame, ArchiveResource::create(SharedBuffer::wrapNSData([[[m_pasteboard.get() dataForType:NSPICTPboardType] copy] autorelease]), uniqueURLWithRelativePart(@"image.pict"), "image/pict", "", ""))))
-        return fragment.release();
-#endif
-
-    // Only 10.5 and higher support setting and retrieving pasteboard types with UTIs, but we don't believe
-    // that any applications on Tiger put types for which we only have a UTI, like PNG, on the pasteboard.
-    if ([types containsObject:(NSString*)kUTTypePNG] &&
-        (fragment = documentFragmentWithImageResource(frame, ArchiveResource::create(SharedBuffer::wrapNSData([[[m_pasteboard.get() dataForType:(NSString*)kUTTypePNG] copy] autorelease]), uniqueURLWithRelativePart(@"image.png"), "image/png", "", ""))))
+    if (types.contains(String(kUTTypePNG)) &&
+        (fragment = documentFragmentWithImageResource(frame, ArchiveResource::create(platformStrategies()->pasteboardStrategy()->bufferForType(String(kUTTypePNG), m_pasteboardName), uniqueURLWithRelativePart(@"image.png"), "image/png", "", ""))))
         return fragment.release();
 
-    if ([types containsObject:NSURLPboardType]) {
-        NSURL *URL = [NSURL URLFromPasteboard:m_pasteboard.get()];
+    if (types.contains(String(NSURLPboardType))) {
+        NSURL *URL = [NSURL URLWithString:platformStrategies()->pasteboardStrategy()->stringForType(NSURLPboardType, m_pasteboardName)];
         Document* document = frame->document();
         ASSERT(document);
         if (!document)
@@ -526,7 +522,7 @@ PassRefPtr<DocumentFragment> Pasteboard::documentFragment(Frame* frame, PassRefP
         NSString *URLString = [URL absoluteString]; // Original data is ASCII-only, so there is no need to precompose.
         if ([URLString length] == 0)
             return nil;
-        NSString *URLTitleString = [[m_pasteboard.get() stringForType:WebURLNamePboardType] precomposedStringWithCanonicalMapping];
+        NSString *URLTitleString = [platformStrategies()->pasteboardStrategy()->stringForType(WebURLNamePboardType, m_pasteboardName) precomposedStringWithCanonicalMapping];
         ExceptionCode ec;
         anchor->setAttribute(HTMLNames::hrefAttr, URLString);
         anchor->appendChild(document->createTextNode(URLTitleString), ec);
@@ -537,9 +533,9 @@ PassRefPtr<DocumentFragment> Pasteboard::documentFragment(Frame* frame, PassRefP
         }
     }
 
-    if (allowPlainText && [types containsObject:NSStringPboardType]) {
+    if (allowPlainText && types.contains(String(NSStringPboardType))) {
         chosePlainText = true;
-        fragment = createFragmentFromText(context.get(), [[m_pasteboard.get() stringForType:NSStringPboardType] precomposedStringWithCanonicalMapping]);
+        fragment = createFragmentFromText(context.get(), [platformStrategies()->pasteboardStrategy()->stringForType(NSStringPboardType, m_pasteboardName) precomposedStringWithCanonicalMapping]);
         return fragment.release();
     }
 
diff --git a/Source/WebCore/platform/mac/PlatformPasteboardMac.mm b/Source/WebCore/platform/mac/PlatformPasteboardMac.mm
new file mode 100644
index 000000000..d03df24b5
--- /dev/null
+++ b/Source/WebCore/platform/mac/PlatformPasteboardMac.mm
@@ -0,0 +1,134 @@
+/*
+ * Copyright (C) 2006 Apple Computer, Inc.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#import "config.h"
+#import "Color.h"
+#import "PlatformPasteboard.h"
+
+namespace WebCore {
+
+PlatformPasteboard::PlatformPasteboard(const String& pasteboardName)
+    : m_pasteboard([NSPasteboard pasteboardWithName:pasteboardName])
+{
+    ASSERT(pasteboardName);
+}
+
+void PlatformPasteboard::getTypes(Vector<String>& types)
+{
+    NSArray *pasteboardTypes = [m_pasteboard.get() types];
+    
+    for (NSUInteger i = 0; i < [pasteboardTypes count]; i++)
+        types.append([pasteboardTypes objectAtIndex:i]);
+}
+
+PassRefPtr<SharedBuffer> PlatformPasteboard::bufferForType(const String& pasteboardType)
+{
+    return SharedBuffer::wrapNSData([[[m_pasteboard.get() dataForType:pasteboardType] copy] autorelease]);
+}
+
+void PlatformPasteboard::getPathnamesForType(Vector<String>& pathnames, const String& pasteboardType)
+{
+    NSArray* paths = [m_pasteboard.get() propertyListForType:pasteboardType];
+    if ([paths isKindOfClass:[NSString class]]) {
+        pathnames.append((NSString *)paths);
+        return;        
+    }
+    for (NSUInteger i = 0; i < [paths count]; i++)
+        pathnames.append([paths objectAtIndex:i]);
+}
+
+String PlatformPasteboard::stringForType(const String& pasteboardType)
+{
+    return [m_pasteboard.get() stringForType:pasteboardType];
+}
+
+int PlatformPasteboard::changeCount() const
+{
+    return [m_pasteboard.get() changeCount];
+}
+
+String PlatformPasteboard::uniqueName()
+{
+    return [[NSPasteboard pasteboardWithUniqueName] name];
+}
+
+Color PlatformPasteboard::color()
+{
+    NSColor *color = [NSColor colorFromPasteboard:m_pasteboard.get()];
+    
+    // The color may not be in an RGB colorspace. This commonly occurs when a color is 
+    // dragged from the NSColorPanel grayscale picker.
+    if ([[color colorSpace] colorSpaceModel] != NSRGBColorSpaceModel)
+        color = [color colorUsingColorSpaceName:NSCalibratedRGBColorSpace];
+    
+    return makeRGBA((int)([color redComponent] * 255.0 + 0.5), (int)([color greenComponent] * 255.0 + 0.5), 
+                    (int)([color blueComponent] * 255.0 + 0.5), (int)([color alphaComponent] * 255.0 + 0.5));    
+}
+
+void PlatformPasteboard::copy(const String& fromPasteboard)
+{
+    NSPasteboard* pasteboard = [NSPasteboard pasteboardWithName:fromPasteboard];
+    NSArray* types = [pasteboard types];
+    
+    [m_pasteboard.get() addTypes:types owner:nil];
+    for (NSUInteger i = 0; i < [types count]; i++) {
+        NSString* type = [types objectAtIndex:i];
+        [m_pasteboard.get() setData:[pasteboard dataForType:type] forType:type];
+    }    
+}
+
+void PlatformPasteboard::setTypes(const Vector<String>& pasteboardTypes)
+{
+    if (pasteboardTypes.isEmpty()) {
+        [m_pasteboard.get() declareTypes:nil owner:nil];
+        return;
+    }
+
+    RetainPtr<NSMutableArray> types(AdoptNS, [[NSMutableArray alloc] init]);
+    for (size_t i = 0; i < pasteboardTypes.size(); ++i)
+        [types.get() addObject:pasteboardTypes[i]];
+
+    [m_pasteboard.get() declareTypes:types.get() owner:nil];
+}
+
+void PlatformPasteboard::setBufferForType(PassRefPtr<SharedBuffer> buffer, const String& pasteboardType)
+{
+    [m_pasteboard.get() setData:buffer ? [buffer->createNSData() autorelease] : nil forType:pasteboardType];
+}
+
+void PlatformPasteboard::setPathnamesForType(const Vector<String>& pathnames, const String& pasteboardType)
+{
+    RetainPtr<NSMutableArray> paths(AdoptNS, [[NSMutableArray alloc] init]);    
+    for (size_t i = 0; i < pathnames.size(); ++i)
+        [paths.get() addObject: [NSArray arrayWithObject:pathnames[i]]];
+    [m_pasteboard.get() setPropertyList:paths.get() forType:pasteboardType];
+}
+
+void PlatformPasteboard::setStringForType(const String& string, const String& pasteboardType)
+{
+    [m_pasteboard.get() setString:string forType:pasteboardType];
+}
+
+}
diff --git a/Source/WebCore/platform/mac/ScrollAnimatorMac.h b/Source/WebCore/platform/mac/ScrollAnimatorMac.h
index c8d9b232a..3720feb74 100644
--- a/Source/WebCore/platform/mac/ScrollAnimatorMac.h
+++ b/Source/WebCore/platform/mac/ScrollAnimatorMac.h
@@ -111,8 +111,8 @@ private:
 
     virtual bool shouldScrollbarParticipateInHitTesting(Scrollbar*);
 
-    float adjustScrollXPositionIfNecessary(float) const;
-    float adjustScrollYPositionIfNecessary(float) const;
+    virtual void notifyContentAreaScrolled() OVERRIDE;
+
     FloatPoint adjustScrollPositionIfNecessary(const FloatPoint&) const;
 
     void immediateScrollTo(const FloatPoint&);
diff --git a/Source/WebCore/platform/mac/ScrollAnimatorMac.mm b/Source/WebCore/platform/mac/ScrollAnimatorMac.mm
index 63c247770..5bcc77549 100644
--- a/Source/WebCore/platform/mac/ScrollAnimatorMac.mm
+++ b/Source/WebCore/platform/mac/ScrollAnimatorMac.mm
@@ -621,22 +621,6 @@ void ScrollAnimatorMac::scrollToOffsetWithoutAnimation(const FloatPoint& offset)
     immediateScrollTo(offset);
 }
 
-float ScrollAnimatorMac::adjustScrollXPositionIfNecessary(float position) const
-{
-    if (!m_scrollableArea->constrainsScrollingToContentEdge())
-        return position;
-
-    return max<float>(min<float>(position, m_scrollableArea->contentsSize().width() - m_scrollableArea->visibleWidth()), 0);
-}
-
-float ScrollAnimatorMac::adjustScrollYPositionIfNecessary(float position) const
-{
-    if (!m_scrollableArea->constrainsScrollingToContentEdge())
-        return position;
-
-    return max<float>(min<float>(position, m_scrollableArea->contentsSize().height() - m_scrollableArea->visibleHeight()), 0);
-}
-
 FloatPoint ScrollAnimatorMac::adjustScrollPositionIfNecessary(const FloatPoint& position) const
 {
     if (!m_scrollableArea->constrainsScrollingToContentEdge())
@@ -669,13 +653,7 @@ void ScrollAnimatorMac::immediateScrollToPointForScrollAnimation(const FloatPoin
 
 void ScrollAnimatorMac::notifyPositionChanged()
 {
-    if (isScrollbarOverlayAPIAvailable()) {
-        // This function is called when a page is going into the page cache, but the page 
-        // isn't really scrolling in that case. We should only pass the message on to the
-        // ScrollbarPainterController when we're really scrolling on an active page.
-        if (scrollableArea()->isOnActivePage())
-            [m_scrollbarPainterController.get() contentAreaScrolled];
-    }
+    notifyContentAreaScrolled();
     ScrollAnimator::notifyPositionChanged();
 }
 
@@ -803,68 +781,72 @@ void ScrollAnimatorMac::didEndScrollGesture() const
 
 void ScrollAnimatorMac::didAddVerticalScrollbar(Scrollbar* scrollbar)
 {
-    if (isScrollbarOverlayAPIAvailable()) {
-        ScrollbarPainter painter = scrollbarPainterForScrollbar(scrollbar);
-        if (!painter)
-            return;
+    if (!isScrollbarOverlayAPIAvailable())
+        return;
+
+    ScrollbarPainter painter = scrollbarPainterForScrollbar(scrollbar);
+    if (!painter)
+        return;
 
-        ASSERT(!m_verticalScrollbarPainterDelegate);
-        m_verticalScrollbarPainterDelegate.adoptNS([[WebScrollbarPainterDelegate alloc] initWithScrollbar:scrollbar]);
+    ASSERT(!m_verticalScrollbarPainterDelegate);
+    m_verticalScrollbarPainterDelegate.adoptNS([[WebScrollbarPainterDelegate alloc] initWithScrollbar:scrollbar]);
 
-        [painter setDelegate:m_verticalScrollbarPainterDelegate.get()];
-        [m_scrollbarPainterController.get() setVerticalScrollerImp:painter];
-        if (scrollableArea()->inLiveResize())
-            [painter setKnobAlpha:1];
-    }
+    [painter setDelegate:m_verticalScrollbarPainterDelegate.get()];
+    [m_scrollbarPainterController.get() setVerticalScrollerImp:painter];
+    if (scrollableArea()->inLiveResize())
+        [painter setKnobAlpha:1];
 }
 
 void ScrollAnimatorMac::willRemoveVerticalScrollbar(Scrollbar* scrollbar)
 {
-    if (isScrollbarOverlayAPIAvailable()) {
-        ScrollbarPainter painter = scrollbarPainterForScrollbar(scrollbar);
-        if (!painter)
-            return;
+    if (!isScrollbarOverlayAPIAvailable())
+        return;
 
-        ASSERT(m_verticalScrollbarPainterDelegate);
-        [m_verticalScrollbarPainterDelegate.get() invalidate];
-        m_verticalScrollbarPainterDelegate = nullptr;
+    ScrollbarPainter painter = scrollbarPainterForScrollbar(scrollbar);
+    if (!painter)
+        return;
 
-        [painter setDelegate:nil];
-        [m_scrollbarPainterController.get() setVerticalScrollerImp:nil];
-    }
+    ASSERT(m_verticalScrollbarPainterDelegate);
+    [m_verticalScrollbarPainterDelegate.get() invalidate];
+    m_verticalScrollbarPainterDelegate = nullptr;
+
+    [painter setDelegate:nil];
+    [m_scrollbarPainterController.get() setVerticalScrollerImp:nil];
 }
 
 void ScrollAnimatorMac::didAddHorizontalScrollbar(Scrollbar* scrollbar)
 {
-    if (isScrollbarOverlayAPIAvailable()) {
-        ScrollbarPainter painter = scrollbarPainterForScrollbar(scrollbar);
-        if (!painter)
-            return;
+    if (!isScrollbarOverlayAPIAvailable())
+        return;
 
-        ASSERT(!m_horizontalScrollbarPainterDelegate);
-        m_horizontalScrollbarPainterDelegate.adoptNS([[WebScrollbarPainterDelegate alloc] initWithScrollbar:scrollbar]);
+    ScrollbarPainter painter = scrollbarPainterForScrollbar(scrollbar);
+    if (!painter)
+        return;
 
-        [painter setDelegate:m_horizontalScrollbarPainterDelegate.get()];
-        [m_scrollbarPainterController.get() setHorizontalScrollerImp:painter];
-        if (scrollableArea()->inLiveResize())
-            [painter setKnobAlpha:1];
-    }
+    ASSERT(!m_horizontalScrollbarPainterDelegate);
+    m_horizontalScrollbarPainterDelegate.adoptNS([[WebScrollbarPainterDelegate alloc] initWithScrollbar:scrollbar]);
+
+    [painter setDelegate:m_horizontalScrollbarPainterDelegate.get()];
+    [m_scrollbarPainterController.get() setHorizontalScrollerImp:painter];
+    if (scrollableArea()->inLiveResize())
+        [painter setKnobAlpha:1];
 }
 
 void ScrollAnimatorMac::willRemoveHorizontalScrollbar(Scrollbar* scrollbar)
 {
-    if (isScrollbarOverlayAPIAvailable()) {
-        ScrollbarPainter painter = scrollbarPainterForScrollbar(scrollbar);
-        if (!painter)
-            return;
+    if (!isScrollbarOverlayAPIAvailable())
+        return;
 
-        ASSERT(m_horizontalScrollbarPainterDelegate);
-        [m_horizontalScrollbarPainterDelegate.get() invalidate];
-        m_horizontalScrollbarPainterDelegate = nullptr;
+    ScrollbarPainter painter = scrollbarPainterForScrollbar(scrollbar);
+    if (!painter)
+        return;
 
-        [painter setDelegate:nil];
-        [m_scrollbarPainterController.get() setHorizontalScrollerImp:nil];
-    }
+    ASSERT(m_horizontalScrollbarPainterDelegate);
+    [m_horizontalScrollbarPainterDelegate.get() invalidate];
+    m_horizontalScrollbarPainterDelegate = nullptr;
+
+    [painter setDelegate:nil];
+    [m_scrollbarPainterController.get() setHorizontalScrollerImp:nil];
 }
 
 bool ScrollAnimatorMac::shouldScrollbarParticipateInHitTesting(Scrollbar* scrollbar)
@@ -883,6 +865,18 @@ bool ScrollAnimatorMac::shouldScrollbarParticipateInHitTesting(Scrollbar* scroll
     return [painter knobAlpha] > 0;
 }
 
+void ScrollAnimatorMac::notifyContentAreaScrolled()
+{
+    if (!isScrollbarOverlayAPIAvailable())
+        return;
+
+    // This function is called when a page is going into the page cache, but the page 
+    // isn't really scrolling in that case. We should only pass the message on to the
+    // ScrollbarPainterController when we're really scrolling on an active page.
+    if (scrollableArea()->isOnActivePage())
+        [m_scrollbarPainterController.get() contentAreaScrolled];
+}
+
 void ScrollAnimatorMac::cancelAnimations()
 {
     m_haveScrolledSincePageLoad = false;
@@ -1034,14 +1028,12 @@ void ScrollAnimatorMac::immediateScrollByWithoutContentEdgeConstraints(const Flo
 
 void ScrollAnimatorMac::immediateScrollBy(const FloatSize& delta)
 {
-    float newPosX = adjustScrollXPositionIfNecessary(m_currentPosX + delta.width());
-    float newPosY = adjustScrollYPositionIfNecessary(m_currentPosY + delta.height());
-
-    if (newPosX == m_currentPosX && newPosY == m_currentPosY)
+    FloatPoint newPos = adjustScrollPositionIfNecessary(FloatPoint(m_currentPosX, m_currentPosY) + delta);
+    if (newPos.x() == m_currentPosX && newPos.y() == m_currentPosY)
         return;
 
-    m_currentPosX = newPosX;
-    m_currentPosY = newPosY;
+    m_currentPosX = newPos.x();
+    m_currentPosY = newPos.y();
     notifyPositionChanged();
 }
 
diff --git a/Source/WebCore/platform/mediastream/PeerConnectionHandler.h b/Source/WebCore/platform/mediastream/PeerConnectionHandler.h
index 778cd1b25..fa22cf4c7 100644
--- a/Source/WebCore/platform/mediastream/PeerConnectionHandler.h
+++ b/Source/WebCore/platform/mediastream/PeerConnectionHandler.h
@@ -41,7 +41,6 @@
 namespace WebCore {
 
 class PeerConnectionHandlerClient;
-class SecurityOrigin;
 
 #if PLATFORM(CHROMIUM)
 class PeerConnectionHandlerInternal;
@@ -51,7 +50,7 @@ class PeerConnectionHandler {
     WTF_MAKE_NONCOPYABLE(PeerConnectionHandler);
     WTF_MAKE_FAST_ALLOCATED;
 public:
-    static PassOwnPtr<PeerConnectionHandler> create(PeerConnectionHandlerClient*, const String& serverConfiguration, PassRefPtr<SecurityOrigin>);
+    static PassOwnPtr<PeerConnectionHandler> create(PeerConnectionHandlerClient*, const String& serverConfiguration, const String& username);
     ~PeerConnectionHandler();
 
     void produceInitialOffer(const MediaStreamDescriptorVector& pendingAddStreams);
@@ -63,7 +62,7 @@ public:
     void stop();
 
 private:
-    PeerConnectionHandler(PeerConnectionHandlerClient*, const String& serverConfiguration, PassRefPtr<SecurityOrigin>);
+    PeerConnectionHandler(PeerConnectionHandlerClient*, const String& serverConfiguration, const String& username);
 
 #if PLATFORM(CHROMIUM)
     OwnPtr<PeerConnectionHandlerInternal> m_private;
diff --git a/Source/WebCore/platform/mediastream/gstreamer/PeerConnectionHandler.cpp b/Source/WebCore/platform/mediastream/gstreamer/PeerConnectionHandler.cpp
index 4569b5fdb..371293412 100644
--- a/Source/WebCore/platform/mediastream/gstreamer/PeerConnectionHandler.cpp
+++ b/Source/WebCore/platform/mediastream/gstreamer/PeerConnectionHandler.cpp
@@ -35,18 +35,16 @@
 #include "PeerConnectionHandler.h"
 
 #include "PeerConnectionHandlerClient.h"
-#include "SecurityOrigin.h"
 
 namespace WebCore {
 
-PassOwnPtr<PeerConnectionHandler> PeerConnectionHandler::create(PeerConnectionHandlerClient* client, const String& serverConfiguration, PassRefPtr<SecurityOrigin> securityOrigin)
+PassOwnPtr<PeerConnectionHandler> PeerConnectionHandler::create(PeerConnectionHandlerClient* client, const String& serverConfiguration, const String& username)
 {
-    return adoptPtr(new PeerConnectionHandler(client, serverConfiguration, securityOrigin));
+    return adoptPtr(new PeerConnectionHandler(client, serverConfiguration, username));
 }
 
-// FIXME: remove when real implementations are available
 // Empty implementations for ports that build with MEDIA_STREAM enabled by default.
-PeerConnectionHandler::PeerConnectionHandler(PeerConnectionHandlerClient*, const String&, PassRefPtr<SecurityOrigin>)
+PeerConnectionHandler::PeerConnectionHandler(PeerConnectionHandlerClient*, const String&, const String&)
 {
 }
 
diff --git a/Source/WebCore/platform/network/NetworkingContext.h b/Source/WebCore/platform/network/NetworkingContext.h
index f2b10c445..046085c2f 100644
--- a/Source/WebCore/platform/network/NetworkingContext.h
+++ b/Source/WebCore/platform/network/NetworkingContext.h
@@ -35,6 +35,10 @@ class QUrl;
 QT_END_NAMESPACE
 #endif
 
+#if USE(SOUP)
+typedef struct _SoupSession SoupSession;
+#endif
+
 namespace WebCore {
 
 class ResourceError;
@@ -66,6 +70,10 @@ public:
     virtual ResourceError blockedError(const ResourceRequest&) const = 0;
 #endif
 
+#if USE(SOUP)
+    virtual SoupSession* soupSession() const = 0;
+#endif
+
 protected:
     NetworkingContext() { }
 };
diff --git a/Source/WebCore/platform/network/ResourceHandleInternal.h b/Source/WebCore/platform/network/ResourceHandleInternal.h
index 877997963..bc79ed12b 100644
--- a/Source/WebCore/platform/network/ResourceHandleInternal.h
+++ b/Source/WebCore/platform/network/ResourceHandleInternal.h
@@ -189,6 +189,7 @@ namespace WebCore {
         unsigned long m_bodySize;
         unsigned long m_bodyDataSent;
         RefPtr<NetworkingContext> m_context;
+        SoupSession* soupSession();
 #endif
 #if PLATFORM(QT)
         QNetworkReplyHandler* m_job;
diff --git a/Source/WebCore/platform/network/blackberry/NetworkJob.cpp b/Source/WebCore/platform/network/blackberry/NetworkJob.cpp
index 6be4cff08..29134757a 100644
--- a/Source/WebCore/platform/network/blackberry/NetworkJob.cpp
+++ b/Source/WebCore/platform/network/blackberry/NetworkJob.cpp
@@ -111,6 +111,7 @@ NetworkJob::NetworkJob()
     , m_redirectCount(0)
     , m_deferredData(*this)
     , m_deferLoadingCount(0)
+    , m_frame(0)
 {
 }
 
@@ -137,6 +138,14 @@ bool NetworkJob::initialize(int playerId,
 
     m_streamFactory = streamFactory;
     m_frame = &frame;
+
+    if (m_frame && m_frame->loader()->pageDismissalEventBeingDispatched() != FrameLoader::NoDismissal) {
+        // In the case the frame will be detached soon, we still need to ping the server, but it is
+        // no longer safe to reference the Frame object.
+        // See http://trac.webkit.org/changeset/65910 and https://bugs.webkit.org/show_bug.cgi?id=30457.
+        m_frame = 0;
+    }
+
     m_redirectCount = redirectCount;
     m_deferLoadingCount = deferLoadingCount;
 
diff --git a/Source/WebCore/platform/network/cf/LoaderRunLoopCF.cpp b/Source/WebCore/platform/network/cf/LoaderRunLoopCF.cpp
index aa99df345..3088eb4c8 100644
--- a/Source/WebCore/platform/network/cf/LoaderRunLoopCF.cpp
+++ b/Source/WebCore/platform/network/cf/LoaderRunLoopCF.cpp
@@ -42,7 +42,7 @@ static void emptyPerform(void*)
 {
 }
 
-static void* runLoaderThread(void*)
+static void runLoaderThread(void*)
 {
     loaderRunLoopObject = CFRunLoopGetCurrent();
 
@@ -56,8 +56,6 @@ static void* runLoaderThread(void*)
         AutodrainedPool pool;
         result = CFRunLoopRunInMode(kCFRunLoopDefaultMode, std::numeric_limits<double>::max(), true);
     } while (result != kCFRunLoopRunStopped && result != kCFRunLoopRunFinished);
-
-    return 0;
 }
 
 CFRunLoopRef loaderRunLoop()
diff --git a/Source/WebCore/platform/network/cf/ProxyServerCFNet.cpp b/Source/WebCore/platform/network/cf/ProxyServerCFNet.cpp
index 245e6ff3c..6b0c8b0c5 100644
--- a/Source/WebCore/platform/network/cf/ProxyServerCFNet.cpp
+++ b/Source/WebCore/platform/network/cf/ProxyServerCFNet.cpp
@@ -27,7 +27,9 @@
 #include "ProxyServer.h"
 
 #include "KURL.h"
+#include "Logging.h"
 #include <wtf/RetainPtr.h>
+#include <wtf/text/CString.h>
 
 #if PLATFORM(WIN)
 #include <CFNetwork/CFNetwork.h>
@@ -36,33 +38,69 @@
 namespace WebCore {
 
 #ifndef BUILDING_ON_LEOPARD
-static void addProxyServersForURL(Vector<ProxyServer>& proxyServers, const KURL& url)
+
+static void processProxyServers(Vector<ProxyServer>& proxyServers, CFArrayRef proxies, CFURLRef url);
+
+static void proxyAutoConfigurationResultCallback(void *context, CFArrayRef proxies, CFErrorRef error)
 {
-    RetainPtr<CFDictionaryRef> proxySettings(AdoptCF, CFNetworkCopySystemProxySettings());
-    if (!proxySettings)
-        return;
+    // We only expect a single result callback per invocation. Stop our runloop to unblock our caller.
+    CFRunLoopStop(CFRunLoopGetCurrent());
 
-    RetainPtr<CFURLRef> cfURL(AdoptCF, url.createCFURL());
-    RetainPtr<CFArrayRef> proxiesForURL(AdoptCF, CFNetworkCopyProxiesForURL(cfURL.get(), proxySettings.get()));
-    if (!proxiesForURL)
+    Vector<ProxyServer>* proxyServers = (Vector<ProxyServer>*)context;
+    if (!proxies) {
+        ASSERT(error);
+        RetainPtr<CFStringRef> errorDescriptionCF(AdoptCF, CFErrorCopyDescription(error));
+        String errorDescription(errorDescriptionCF.get());
+        LOG(Network, "Failed to process proxy auto-configuration file with error: %s", errorDescription.utf8().data());
         return;
+    }
+
+    processProxyServers(*proxyServers, proxies, 0);
+}
 
-    CFIndex numProxies = CFArrayGetCount(proxiesForURL.get());
+static void processProxyServers(Vector<ProxyServer>& proxyServers, CFArrayRef proxies, CFURLRef url)
+{
+    CFIndex numProxies = CFArrayGetCount(proxies);
     for (CFIndex i = 0; i < numProxies; ++i) {
-        CFDictionaryRef proxyDictionary = static_cast<CFDictionaryRef>(CFArrayGetValueAtIndex(proxiesForURL.get(), i));
+        CFDictionaryRef proxyDictionary = static_cast<CFDictionaryRef>(CFArrayGetValueAtIndex(proxies, i));
 
         ProxyServer::Type type = ProxyServer::Direct;
         CFStringRef typeString = static_cast<CFStringRef>(CFDictionaryGetValue(proxyDictionary, kCFProxyTypeKey));
+
+        if (!url) {
+            // If we have no URL then we're processing an auto-configuration response.
+            // It isn't sensible to receive another auto-configured proxy in such a response.
+            ASSERT(!CFEqual(typeString, kCFProxyTypeAutoConfigurationURL));
+        }
+
         if (CFEqual(typeString, kCFProxyTypeAutoConfigurationURL)) {
-            // FIXME: Handle PAC URLs.
+            if (!url)
+                continue;
+
+            // FIXME: We should restructure to allow this to happen asynchronously.
+            CFURLRef scriptURL = static_cast<CFURLRef>(CFDictionaryGetValue(proxyDictionary, kCFProxyAutoConfigurationURLKey));
+            if (!scriptURL || CFGetTypeID(scriptURL) != CFURLGetTypeID())
+                continue;
+
+            CFStreamClientContext context = { 0, (void*)&proxyServers, 0, 0, 0 };
+            RetainPtr<CFRunLoopSourceRef> runLoopSource(AdoptCF, CFNetworkExecuteProxyAutoConfigurationURL(scriptURL, url, proxyAutoConfigurationResultCallback, &context));
+
+            CFStringRef privateRunLoopMode = CFSTR("com.apple.WebKit.ProxyAutoConfiguration");
+            CFTimeInterval timeout = 5;
+            CFRunLoopAddSource(CFRunLoopGetCurrent(), runLoopSource.get(), privateRunLoopMode);
+            CFRunLoopRunInMode(privateRunLoopMode, timeout, 0);
+            CFRunLoopRemoveSource(CFRunLoopGetCurrent(), runLoopSource.get(), privateRunLoopMode);
+            CFRunLoopSourceInvalidate(runLoopSource.get());
+
+            // The proxyAutoConfigurationResultCallback has added any relevant ProxyServers to proxyServers.
             continue;
-        } 
-        
+        }
+
         if (CFEqual(typeString, kCFProxyTypeNone)) {
             proxyServers.append(ProxyServer(ProxyServer::Direct, String(), -1));
             continue;
         }
-        
+
         if (CFEqual(typeString, kCFProxyTypeHTTP))
             type = ProxyServer::HTTP;
         else if (CFEqual(typeString, kCFProxyTypeHTTPS))
@@ -83,6 +121,20 @@ static void addProxyServersForURL(Vector<ProxyServer>& proxyServers, const KURL&
     }
 }
 
+static void addProxyServersForURL(Vector<ProxyServer>& proxyServers, const KURL& url)
+{
+    RetainPtr<CFDictionaryRef> proxySettings(AdoptCF, CFNetworkCopySystemProxySettings());
+    if (!proxySettings)
+        return;
+
+    RetainPtr<CFURLRef> cfURL(AdoptCF, url.createCFURL());
+    RetainPtr<CFArrayRef> proxiesForURL(AdoptCF, CFNetworkCopyProxiesForURL(cfURL.get(), proxySettings.get()));
+    if (!proxiesForURL)
+        return;
+
+    processProxyServers(proxyServers, proxiesForURL.get(), cfURL.get());
+}
+
 Vector<ProxyServer> proxyServersForURL(const KURL& url, const NetworkingContext*)
 {
     Vector<ProxyServer> proxyServers;
diff --git a/Source/WebCore/platform/network/chromium/ResourceResponse.h b/Source/WebCore/platform/network/chromium/ResourceResponse.h
index a2a8c5d30..997cd71dd 100644
--- a/Source/WebCore/platform/network/chromium/ResourceResponse.h
+++ b/Source/WebCore/platform/network/chromium/ResourceResponse.h
@@ -36,6 +36,11 @@ namespace WebCore {
 
     class ResourceResponse : public ResourceResponseBase {
     public:
+        class ExtraData : public RefCounted<ExtraData> {
+        public:
+            virtual ~ExtraData() { }
+        };
+
         ResourceResponse()
             : m_appCacheID(0)
             , m_isMultipartPayload(false)
@@ -103,6 +108,10 @@ namespace WebCore {
         const File* downloadedFile() const { return m_downloadedFile.get(); }
         void setDownloadedFile(PassRefPtr<File> downloadedFile) { m_downloadedFile = downloadedFile; }
 
+        // Extra data associated with this response.
+        ExtraData* extraData() const { return m_extraData.get(); }
+        void setExtraData(PassRefPtr<ExtraData> extraData) { m_extraData = extraData; }
+
     private:
         friend class ResourceResponseBase;
 
@@ -155,6 +164,9 @@ namespace WebCore {
 
         // The downloaded file if the load streamed to a file.
         RefPtr<File> m_downloadedFile;
+
+        // ExtraData associated with the response.
+        RefPtr<ExtraData> m_extraData;
     };
 
     struct CrossThreadResourceResponseData : public CrossThreadResourceResponseDataBase {
diff --git a/Source/WebCore/platform/network/soup/CookieJarSoup.cpp b/Source/WebCore/platform/network/soup/CookieJarSoup.cpp
index f170d2d54..3b8a544cf 100644
--- a/Source/WebCore/platform/network/soup/CookieJarSoup.cpp
+++ b/Source/WebCore/platform/network/soup/CookieJarSoup.cpp
@@ -23,8 +23,12 @@
 
 #include "Cookie.h"
 #include "Document.h"
+#include "Frame.h"
+#include "FrameLoader.h"
 #include "GOwnPtrSoup.h"
 #include "KURL.h"
+#include "NetworkingContext.h"
+#include "ResourceHandle.h"
 #include <wtf/text/CString.h>
 
 namespace WebCore {
@@ -32,6 +36,22 @@ namespace WebCore {
 static bool cookiesInitialized;
 static SoupCookieJar* cookieJar;
 
+static SoupCookieJar* cookieJarForDocument(const Document* document)
+{
+    if (!document)
+        return 0;
+    const Frame* frame = document->frame();
+    if (!frame)
+        return 0;
+    const FrameLoader* loader = frame->loader();
+    if (!loader)
+        return 0;
+    const NetworkingContext* context = loader->networkingContext();
+    if (!context)
+        return 0;
+    return SOUP_COOKIE_JAR(soup_session_get_feature(context->soupSession(), SOUP_TYPE_COOKIE_JAR));
+}
+
 SoupCookieJar* defaultCookieJar()
 {
     if (!cookiesInitialized) {
@@ -59,7 +79,7 @@ void setDefaultCookieJar(SoupCookieJar* jar)
 
 void setCookies(Document* document, const KURL& url, const String& value)
 {
-    SoupCookieJar* jar = defaultCookieJar();
+    SoupCookieJar* jar = cookieJarForDocument(document);
     if (!jar)
         return;
 
@@ -73,9 +93,9 @@ void setCookies(Document* document, const KURL& url, const String& value)
                                                 value.utf8().data());
 }
 
-String cookies(const Document* /*document*/, const KURL& url)
+String cookies(const Document* document, const KURL& url)
 {
-    SoupCookieJar* jar = defaultCookieJar();
+    SoupCookieJar* jar = cookieJarForDocument(document);
     if (!jar)
         return String();
 
@@ -89,9 +109,9 @@ String cookies(const Document* /*document*/, const KURL& url)
     return result;
 }
 
-String cookieRequestHeaderFieldValue(const Document* /*document*/, const KURL& url)
+String cookieRequestHeaderFieldValue(const Document* document, const KURL& url)
 {
-    SoupCookieJar* jar = defaultCookieJar();
+    SoupCookieJar* jar = cookieJarForDocument(document);
     if (!jar)
         return String();
 
@@ -105,9 +125,9 @@ String cookieRequestHeaderFieldValue(const Document* /*document*/, const KURL& u
     return result;
 }
 
-bool cookiesEnabled(const Document* /*document*/)
+bool cookiesEnabled(const Document* document)
 {
-    return defaultCookieJar();
+    return !!cookieJarForDocument(document);
 }
 
 bool getRawCookies(const Document*, const KURL&, Vector<Cookie>& rawCookies)
diff --git a/Source/WebCore/platform/network/soup/ResourceHandleSoup.cpp b/Source/WebCore/platform/network/soup/ResourceHandleSoup.cpp
index 5cb53bdff..e671660ae 100644
--- a/Source/WebCore/platform/network/soup/ResourceHandleSoup.cpp
+++ b/Source/WebCore/platform/network/soup/ResourceHandleSoup.cpp
@@ -141,6 +141,11 @@ ResourceHandleInternal::~ResourceHandleInternal()
 {
 }
 
+SoupSession* ResourceHandleInternal::soupSession()
+{
+    return (m_context && m_context->isValid()) ? m_context->soupSession() : ResourceHandle::defaultSession();
+}
+
 ResourceHandle::~ResourceHandle()
 {
     cleanupSoupRequestOperation(this, true);
@@ -151,11 +156,13 @@ static void ensureSessionIsInitialized(SoupSession* session)
     if (g_object_get_data(G_OBJECT(session), "webkit-init"))
         return;
 
-    SoupCookieJar* jar = SOUP_COOKIE_JAR(soup_session_get_feature(session, SOUP_TYPE_COOKIE_JAR));
-    if (!jar)
-        soup_session_add_feature(session, SOUP_SESSION_FEATURE(defaultCookieJar()));
-    else
-        setDefaultCookieJar(jar);
+    if (session == ResourceHandle::defaultSession()) {
+        SoupCookieJar* jar = SOUP_COOKIE_JAR(soup_session_get_feature(session, SOUP_TYPE_COOKIE_JAR));
+        if (!jar)
+            soup_session_add_feature(session, SOUP_SESSION_FEATURE(defaultCookieJar()));
+        else
+            setDefaultCookieJar(jar);
+    }
 
     if (!soup_session_get_feature(session, SOUP_TYPE_LOGGER) && LogNetwork.state == WTFLogChannelOn) {
         SoupLogger* logger = soup_logger_new(static_cast<SoupLoggerLogLevel>(SOUP_LOGGER_LOG_BODY), -1);
@@ -319,7 +326,7 @@ static void sendRequestCallback(GObject* source, GAsyncResult* res, gpointer dat
         d->m_response.updateFromSoupMessage(soupMessage);
 
         if (d->m_defersLoading)
-            soup_session_pause_message(handle->defaultSession(), soupMessage);
+            soup_session_pause_message(d->soupSession(), soupMessage);
     } else {
         d->m_response.setURL(handle->firstRequest().url());
         const gchar* contentType = soup_request_get_content_type(d->m_soupRequest.get());
@@ -442,12 +449,12 @@ static bool startHTTPRequest(ResourceHandle* handle)
 {
     ASSERT(handle);
 
-    SoupSession* session = handle->defaultSession();
+    ResourceHandleInternal* d = handle->getInternal();
+
+    SoupSession* session = d->soupSession();
     ensureSessionIsInitialized(session);
     SoupRequester* requester = SOUP_REQUESTER(soup_session_get_feature(session, SOUP_TYPE_REQUESTER));
 
-    ResourceHandleInternal* d = handle->getInternal();
-
     ResourceRequest request(handle->firstRequest());
     KURL url(request.url());
     url.removeFragmentIdentifier();
@@ -552,7 +559,7 @@ void ResourceHandle::cancel()
 {
     d->m_cancelled = true;
     if (d->m_soupMessage)
-        soup_session_cancel_message(defaultSession(), d->m_soupMessage.get(), SOUP_STATUS_CANCELLED);
+        soup_session_cancel_message(d->soupSession(), d->m_soupMessage.get(), SOUP_STATUS_CANCELLED);
     else if (d->m_cancellable)
         g_cancellable_cancel(d->m_cancellable.get());
 }
@@ -687,10 +694,11 @@ static bool startNonHTTPRequest(ResourceHandle* handle, KURL url)
     if (handle->firstRequest().httpMethod() != "GET" && handle->firstRequest().httpMethod() != "POST")
         return false;
 
-    SoupSession* session = handle->defaultSession();
+    ResourceHandleInternal* d = handle->getInternal();
+
+    SoupSession* session = d->soupSession();
     ensureSessionIsInitialized(session);
     SoupRequester* requester = SOUP_REQUESTER(soup_session_get_feature(session, SOUP_TYPE_REQUESTER));
-    ResourceHandleInternal* d = handle->getInternal();
 
     CString urlStr = url.string().utf8();
 
@@ -727,7 +735,10 @@ SoupSession* ResourceHandle::defaultSession()
         session = soup_session_async_new();
         g_object_set(session,
                      SOUP_SESSION_MAX_CONNS, maxConnections,
-                     SOUP_SESSION_MAX_CONNS_PER_HOST, maxConnectionsPerHost, 
+                     SOUP_SESSION_MAX_CONNS_PER_HOST, maxConnectionsPerHost,
+                     SOUP_SESSION_ADD_FEATURE_BY_TYPE, SOUP_TYPE_CONTENT_DECODER,
+                     SOUP_SESSION_ADD_FEATURE_BY_TYPE, SOUP_TYPE_CONTENT_SNIFFER,
+                     SOUP_SESSION_ADD_FEATURE_BY_TYPE, SOUP_TYPE_PROXY_RESOLVER_DEFAULT,
                      NULL);
     }
 
diff --git a/Source/WebCore/platform/qt/ClipboardQt.cpp b/Source/WebCore/platform/qt/ClipboardQt.cpp
index 2734952d9..3d8bab1f6 100644
--- a/Source/WebCore/platform/qt/ClipboardQt.cpp
+++ b/Source/WebCore/platform/qt/ClipboardQt.cpp
@@ -30,6 +30,7 @@
 #include "ClipboardQt.h"
 
 #include "CachedImage.h"
+#include "DOMStringList.h"
 #include "DataTransferItemListQt.h"
 #include "Document.h"
 #include "DragData.h"
@@ -189,17 +190,17 @@ bool ClipboardQt::setData(const String& type, const String& data)
 }
 
 // extensions beyond IE's API
-HashSet<String> ClipboardQt::types() const
+PassRefPtr<DOMStringList> ClipboardQt::types() const
 {
     if (policy() != ClipboardReadable && policy() != ClipboardTypesReadable)
-        return HashSet<String>();
+        return DOMStringList::create();
 
     ASSERT(m_readableData);
-    HashSet<String> result;
+    RefPtr<DOMStringList> result = DOMStringList::create();
     QStringList formats = m_readableData->formats();
     for (int i = 0; i < formats.count(); ++i)
-        result.add(formats.at(i));
-    return result;
+        result->append(formats.at(i));
+    return result.release();
 }
 
 PassRefPtr<FileList> ClipboardQt::files() const
diff --git a/Source/WebCore/platform/qt/ClipboardQt.h b/Source/WebCore/platform/qt/ClipboardQt.h
index dc6ba4173..a840becf6 100644
--- a/Source/WebCore/platform/qt/ClipboardQt.h
+++ b/Source/WebCore/platform/qt/ClipboardQt.h
@@ -57,7 +57,7 @@ public:
     bool setData(const String& type, const String& data);
 
     // extensions beyond IE's API
-    virtual HashSet<String> types() const;
+    virtual PassRefPtr<DOMStringList> types() const;
     virtual PassRefPtr<FileList> files() const;
 
     void setDragImage(CachedImage*, const IntPoint&);
diff --git a/Source/WebCore/platform/qt/ContextMenuQt.cpp b/Source/WebCore/platform/qt/ContextMenuQt.cpp
index 61aab6dad..0fefeb986 100644
--- a/Source/WebCore/platform/qt/ContextMenuQt.cpp
+++ b/Source/WebCore/platform/qt/ContextMenuQt.cpp
@@ -30,7 +30,6 @@
 #include <Document.h>
 #include <Frame.h>
 #include <FrameView.h>
-#include <QAction>
 #include <wtf/Assertions.h>
 
 namespace WebCore {
diff --git a/Source/WebCore/platform/qt/LocalizedStringsQt.cpp b/Source/WebCore/platform/qt/LocalizedStringsQt.cpp
new file mode 100644
index 000000000..a48d6b846
--- /dev/null
+++ b/Source/WebCore/platform/qt/LocalizedStringsQt.cpp
@@ -0,0 +1,692 @@
+/*
+ * Copyright (C) 2007 Staikos Computing Services Inc. <info@staikos.net>
+ * Copyright (C) 2010 Nokia Corporation and/or its subsidiary(-ies)
+ * Copyright (C) 2008 Collabora Ltd. All rights reserved.
+ * Copyright (C) 2010, 2012 Apple Inc. All rights reserved.
+ * Copyright (C) 2010 INdT - Instituto Nokia de Tecnologia
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "LocalizedStrings.h"
+
+#include "IntSize.h"
+#include "NotImplemented.h"
+#include "PlatformString.h"
+#include <QCoreApplication>
+#include <wtf/MathExtras.h>
+
+namespace WebCore {
+
+String inputElementAltText()
+{
+    return QCoreApplication::translate("QWebPage", "Submit", "Submit (input element) alt text for <input> elements with no alt, title, or value");
+}
+
+String resetButtonDefaultLabel()
+{
+    return QCoreApplication::translate("QWebPage", "Reset", "default label for Reset buttons in forms on web pages");
+}
+
+String searchableIndexIntroduction()
+{
+    return QCoreApplication::translate("QWebPage", "This is a searchable index. Enter search keywords: ", "text that appears at the start of nearly-obsolete web pages in the form of a 'searchable index'");
+}
+
+String submitButtonDefaultLabel()
+{
+    return QCoreApplication::translate("QWebPage", "Submit", "default label for Submit buttons in forms on web pages");
+}
+
+String fileButtonChooseFileLabel()
+{
+    return QCoreApplication::translate("QWebPage", "Choose File", "title for a single file chooser button used in HTML forms");
+}
+
+String fileButtonChooseMultipleFilesLabel()
+{
+    return QCoreApplication::translate("QWebPage", "Choose Files", "title for a multiple file chooser button used in HTML forms. This title should be as short as possible.");
+}
+
+String fileButtonNoFileSelectedLabel()
+{
+    return QCoreApplication::translate("QWebPage", "No file selected", "text to display in file button used in HTML forms when no file is selected");
+}
+
+String fileButtonNoFilesSelectedLabel()
+{
+    return QCoreApplication::translate("QWebPage", "No files selected", "text to display in file button used in HTML forms when no files are selected and the button allows multiple files to be selected");
+}
+
+String defaultDetailsSummaryText()
+{
+    return QCoreApplication::translate("QWebPage", "Details", "text to display in <details> tag when it has no <summary> child");
+}
+
+String contextMenuItemTagOpenLinkInNewWindow()
+{
+    return QCoreApplication::translate("QWebPage", "Open in New Window", "Open in New Window context menu item");
+}
+
+String contextMenuItemTagDownloadLinkToDisk()
+{
+    return QCoreApplication::translate("QWebPage", "Save Link...", "Download Linked File context menu item");
+}
+
+String contextMenuItemTagCopyLinkToClipboard()
+{
+    return QCoreApplication::translate("QWebPage", "Copy Link", "Copy Link context menu item");
+}
+
+String contextMenuItemTagOpenImageInNewWindow()
+{
+    return QCoreApplication::translate("QWebPage", "Open Image", "Open Image in New Window context menu item");
+}
+
+String contextMenuItemTagDownloadImageToDisk()
+{
+    return QCoreApplication::translate("QWebPage", "Save Image", "Download Image context menu item");
+}
+
+String contextMenuItemTagCopyImageToClipboard()
+{
+    return QCoreApplication::translate("QWebPage", "Copy Image", "Copy Link context menu item");
+}
+
+String contextMenuItemTagCopyImageUrlToClipboard()
+{
+    return QCoreApplication::translate("QWebPage", "Copy Image Address", "Copy Image Address menu item");
+}
+
+String contextMenuItemTagOpenVideoInNewWindow()
+{
+    return QCoreApplication::translate("QWebPage", "Open Video", "Open Video in New Window");
+}
+
+String contextMenuItemTagOpenAudioInNewWindow()
+{
+    return QCoreApplication::translate("QWebPage", "Open Audio", "Open Audio in New Window");
+}
+
+String contextMenuItemTagCopyVideoLinkToClipboard()
+{
+    return QCoreApplication::translate("QWebPage", "Copy Video", "Copy Video Link Location");
+}
+
+String contextMenuItemTagCopyAudioLinkToClipboard()
+{
+    return QCoreApplication::translate("QWebPage", "Copy Audio", "Copy Audio Link Location");
+}
+
+String contextMenuItemTagToggleMediaControls()
+{
+    return QCoreApplication::translate("QWebPage", "Toggle Controls", "Toggle Media Controls");
+}
+
+String contextMenuItemTagToggleMediaLoop()
+{
+    return QCoreApplication::translate("QWebPage", "Toggle Loop", "Toggle Media Loop Playback");
+}
+
+String contextMenuItemTagEnterVideoFullscreen()
+{
+    return QCoreApplication::translate("QWebPage", "Enter Fullscreen", "Switch Video to Fullscreen");
+}
+
+String contextMenuItemTagMediaPlay()
+{
+    return QCoreApplication::translate("QWebPage", "Play", "Play");
+}
+
+String contextMenuItemTagMediaPause()
+{
+    return QCoreApplication::translate("QWebPage", "Pause", "Pause");
+}
+
+String contextMenuItemTagMediaMute()
+{
+    return QCoreApplication::translate("QWebPage", "Mute", "Mute");
+}
+
+String contextMenuItemTagOpenFrameInNewWindow()
+{
+    return QCoreApplication::translate("QWebPage", "Open Frame", "Open Frame in New Window context menu item");
+}
+
+String contextMenuItemTagCopy()
+{
+    return QCoreApplication::translate("QWebPage", "Copy", "Copy context menu item");
+}
+
+String contextMenuItemTagGoBack()
+{
+    return QCoreApplication::translate("QWebPage", "Go Back", "Back context menu item");
+}
+
+String contextMenuItemTagGoForward()
+{
+    return QCoreApplication::translate("QWebPage", "Go Forward", "Forward context menu item");
+}
+
+String contextMenuItemTagStop()
+{
+    return QCoreApplication::translate("QWebPage", "Stop", "Stop context menu item");
+}
+
+String contextMenuItemTagReload()
+{
+    return QCoreApplication::translate("QWebPage", "Reload", "Reload context menu item");
+}
+
+String contextMenuItemTagCut()
+{
+    return QCoreApplication::translate("QWebPage", "Cut", "Cut context menu item");
+}
+
+String contextMenuItemTagPaste()
+{
+    return QCoreApplication::translate("QWebPage", "Paste", "Paste context menu item");
+}
+
+String contextMenuItemTagSelectAll()
+{
+    return QCoreApplication::translate("QWebPage", "Select All", "Select All context menu item");
+}
+
+String contextMenuItemTagNoGuessesFound()
+{
+    return QCoreApplication::translate("QWebPage", "No Guesses Found", "No Guesses Found context menu item");
+}
+
+String contextMenuItemTagIgnoreSpelling()
+{
+    return QCoreApplication::translate("QWebPage", "Ignore", "Ignore Spelling context menu item");
+}
+
+String contextMenuItemTagLearnSpelling()
+{
+    return QCoreApplication::translate("QWebPage", "Add To Dictionary", "Learn Spelling context menu item");
+}
+
+String contextMenuItemTagSearchWeb()
+{
+    return QCoreApplication::translate("QWebPage", "Search The Web", "Search The Web context menu item");
+}
+
+String contextMenuItemTagLookUpInDictionary(const String&)
+{
+    return QCoreApplication::translate("QWebPage", "Look Up In Dictionary", "Look Up in Dictionary context menu item");
+}
+
+String contextMenuItemTagOpenLink()
+{
+    return QCoreApplication::translate("QWebPage", "Open Link", "Open Link context menu item");
+}
+
+String contextMenuItemTagIgnoreGrammar()
+{
+    return QCoreApplication::translate("QWebPage", "Ignore", "Ignore Grammar context menu item");
+}
+
+String contextMenuItemTagSpellingMenu()
+{
+    return QCoreApplication::translate("QWebPage", "Spelling", "Spelling and Grammar context sub-menu item");
+}
+
+String contextMenuItemTagShowSpellingPanel(bool show)
+{
+    return show ? QCoreApplication::translate("QWebPage", "Show Spelling and Grammar", "menu item title") :
+                  QCoreApplication::translate("QWebPage", "Hide Spelling and Grammar", "menu item title");
+}
+
+String contextMenuItemTagCheckSpelling()
+{
+    return QCoreApplication::translate("QWebPage", "Check Spelling", "Check spelling context menu item");
+}
+
+String contextMenuItemTagCheckSpellingWhileTyping()
+{
+    return QCoreApplication::translate("QWebPage", "Check Spelling While Typing", "Check spelling while typing context menu item");
+}
+
+String contextMenuItemTagCheckGrammarWithSpelling()
+{
+    return QCoreApplication::translate("QWebPage", "Check Grammar With Spelling", "Check grammar with spelling context menu item");
+}
+
+String contextMenuItemTagFontMenu()
+{
+    return QCoreApplication::translate("QWebPage", "Fonts", "Font context sub-menu item");
+}
+
+String contextMenuItemTagBold()
+{
+    return QCoreApplication::translate("QWebPage", "Bold", "Bold context menu item");
+}
+
+String contextMenuItemTagItalic()
+{
+    return QCoreApplication::translate("QWebPage", "Italic", "Italic context menu item");
+}
+
+String contextMenuItemTagUnderline()
+{
+    return QCoreApplication::translate("QWebPage", "Underline", "Underline context menu item");
+}
+
+String contextMenuItemTagOutline()
+{
+    return QCoreApplication::translate("QWebPage", "Outline", "Outline context menu item");
+}
+
+String contextMenuItemTagWritingDirectionMenu()
+{
+    return QCoreApplication::translate("QWebPage", "Direction", "Writing direction context sub-menu item");
+}
+
+String contextMenuItemTagTextDirectionMenu()
+{
+    return QCoreApplication::translate("QWebPage", "Text Direction", "Text direction context sub-menu item");
+}
+
+String contextMenuItemTagDefaultDirection()
+{
+    return QCoreApplication::translate("QWebPage", "Default", "Default writing direction context menu item");
+}
+
+String contextMenuItemTagLeftToRight()
+{
+    return QCoreApplication::translate("QWebPage", "Left to Right", "Left to Right context menu item");
+}
+
+String contextMenuItemTagRightToLeft()
+{
+    return QCoreApplication::translate("QWebPage", "Right to Left", "Right to Left context menu item");
+}
+
+String contextMenuItemTagInspectElement()
+{
+    return QCoreApplication::translate("QWebPage", "Inspect", "Inspect Element context menu item");
+}
+
+String searchMenuNoRecentSearchesText()
+{
+    return QCoreApplication::translate("QWebPage", "No recent searches", "Label for only item in menu that appears when clicking on the search field image, when no searches have been performed");
+}
+
+String searchMenuRecentSearchesText()
+{
+    return QCoreApplication::translate("QWebPage", "Recent searches", "label for first item in the menu that appears when clicking on the search field image, used as embedded menu title");
+}
+
+String searchMenuClearRecentSearchesText()
+{
+    return QCoreApplication::translate("QWebPage", "Clear recent searches", "menu item in Recent Searches menu that empties menu's contents");
+}
+
+String AXWebAreaText()
+{
+    notImplemented();
+    return String();
+}
+
+String AXLinkText()
+{
+    notImplemented();
+    return String();
+}
+
+String AXListMarkerText()
+{
+    notImplemented();
+    return String();
+}
+
+String AXImageMapText()
+{
+    notImplemented();
+    return String();
+}
+
+String AXHeadingText()
+{
+    notImplemented();
+    return String();
+}
+
+String AXDefinitionListTermText()
+{
+    notImplemented();
+    return String();
+}
+
+String AXDefinitionListDefinitionText()
+{
+    notImplemented();
+    return String();
+}
+
+String AXButtonActionVerb()
+{
+    notImplemented();
+    return String();
+}
+
+String AXRadioButtonActionVerb()
+{
+    notImplemented();
+    return String();
+}
+
+String AXTextFieldActionVerb()
+{
+    notImplemented();
+    return String();
+}
+
+String AXCheckedCheckBoxActionVerb()
+{
+    notImplemented();
+    return String();
+}
+
+String AXUncheckedCheckBoxActionVerb()
+{
+    notImplemented();
+    return String();
+}
+
+String AXMenuListActionVerb()
+{
+    notImplemented();
+    return String();
+}
+
+String AXMenuListPopupActionVerb()
+{
+    notImplemented();
+    return String();
+}
+
+String AXLinkActionVerb()
+{
+    notImplemented();
+    return String();
+}
+
+String missingPluginText()
+{
+    return QCoreApplication::translate("QWebPage", "Missing Plug-in", "Label text to be used when a plug-in is missing");
+}
+
+String crashedPluginText()
+{
+    notImplemented();
+    return String();
+}
+
+String multipleFileUploadText(unsigned)
+{
+    notImplemented();
+    return String();
+}
+
+String unknownFileSizeText()
+{
+    return QCoreApplication::translate("QWebPage", "Unknown", "Unknown filesize FTP directory listing item");
+}
+
+String imageTitle(const String& filename, const IntSize& size)
+{
+    return QCoreApplication::translate("QWebPage", "%1 (%2x%3 pixels)", "Title string for images").arg(filename).arg(size.width()).arg(size.height());
+}
+
+String mediaElementLoadingStateText()
+{
+    return QCoreApplication::translate("QWebPage", "Loading...", "Media controller status message when the media is loading");
+}
+
+String mediaElementLiveBroadcastStateText()
+{
+    return QCoreApplication::translate("QWebPage", "Live Broadcast", "Media controller status message when watching a live broadcast");
+}
+
+#if ENABLE(VIDEO)
+
+String localizedMediaControlElementString(const String& name)
+{
+    if (name == "AudioElement")
+        return QCoreApplication::translate("QWebPage", "Audio Element", "Media controller element");
+    if (name == "VideoElement")
+        return QCoreApplication::translate("QWebPage", "Video Element", "Media controller element");
+    if (name == "MuteButton")
+        return QCoreApplication::translate("QWebPage", "Mute Button", "Media controller element");
+    if (name == "UnMuteButton")
+        return QCoreApplication::translate("QWebPage", "Unmute Button", "Media controller element");
+    if (name == "PlayButton")
+        return QCoreApplication::translate("QWebPage", "Play Button", "Media controller element");
+    if (name == "PauseButton")
+        return QCoreApplication::translate("QWebPage", "Pause Button", "Media controller element");
+    if (name == "Slider")
+        return QCoreApplication::translate("QWebPage", "Slider", "Media controller element");
+    if (name == "SliderThumb")
+        return QCoreApplication::translate("QWebPage", "Slider Thumb", "Media controller element");
+    if (name == "RewindButton")
+        return QCoreApplication::translate("QWebPage", "Rewind Button", "Media controller element");
+    if (name == "ReturnToRealtimeButton")
+        return QCoreApplication::translate("QWebPage", "Return to Real-time Button", "Media controller element");
+    if (name == "CurrentTimeDisplay")
+        return QCoreApplication::translate("QWebPage", "Elapsed Time", "Media controller element");
+    if (name == "TimeRemainingDisplay")
+        return QCoreApplication::translate("QWebPage", "Remaining Time", "Media controller element");
+    if (name == "StatusDisplay")
+        return QCoreApplication::translate("QWebPage", "Status Display", "Media controller element");
+    if (name == "FullscreenButton")
+        return QCoreApplication::translate("QWebPage", "Fullscreen Button", "Media controller element");
+    if (name == "SeekForwardButton")
+        return QCoreApplication::translate("QWebPage", "Seek Forward Button", "Media controller element");
+    if (name == "SeekBackButton")
+        return QCoreApplication::translate("QWebPage", "Seek Back Button", "Media controller element");
+
+    return String();
+}
+
+String localizedMediaControlElementHelpText(const String& name)
+{
+    if (name == "AudioElement")
+        return QCoreApplication::translate("QWebPage", "Audio element playback controls and status display", "Media controller element");
+    if (name == "VideoElement")
+        return QCoreApplication::translate("QWebPage", "Video element playback controls and status display", "Media controller element");
+    if (name == "MuteButton")
+        return QCoreApplication::translate("QWebPage", "Mute audio tracks", "Media controller element");
+    if (name == "UnMuteButton")
+        return QCoreApplication::translate("QWebPage", "Unmute audio tracks", "Media controller element");
+    if (name == "PlayButton")
+        return QCoreApplication::translate("QWebPage", "Begin playback", "Media controller element");
+    if (name == "PauseButton")
+        return QCoreApplication::translate("QWebPage", "Pause playback", "Media controller element");
+    if (name == "Slider")
+        return QCoreApplication::translate("QWebPage", "Movie time scrubber", "Media controller element");
+    if (name == "SliderThumb")
+        return QCoreApplication::translate("QWebPage", "Movie time scrubber thumb", "Media controller element");
+    if (name == "RewindButton")
+        return QCoreApplication::translate("QWebPage", "Rewind movie", "Media controller element");
+    if (name == "ReturnToRealtimeButton")
+        return QCoreApplication::translate("QWebPage", "Return streaming movie to real-time", "Media controller element");
+    if (name == "CurrentTimeDisplay")
+        return QCoreApplication::translate("QWebPage", "Current movie time", "Media controller element");
+    if (name == "TimeRemainingDisplay")
+        return QCoreApplication::translate("QWebPage", "Remaining movie time", "Media controller element");
+    if (name == "StatusDisplay")
+        return QCoreApplication::translate("QWebPage", "Current movie status", "Media controller element");
+    if (name == "FullscreenButton")
+        return QCoreApplication::translate("QWebPage", "Play movie in full-screen mode", "Media controller element");
+    if (name == "SeekForwardButton")
+        return QCoreApplication::translate("QWebPage", "Seek quickly back", "Media controller element");
+    if (name == "SeekBackButton")
+        return QCoreApplication::translate("QWebPage", "Seek quickly forward", "Media controller element");
+
+    ASSERT_NOT_REACHED();
+    return String();
+}
+
+String localizedMediaTimeDescription(float time)
+{
+    if (!isfinite(time))
+        return QCoreApplication::translate("QWebPage", "Indefinite time", "Media time description");
+
+    int seconds = (int)fabsf(time);
+    int days = seconds / (60 * 60 * 24);
+    int hours = seconds / (60 * 60);
+    int minutes = (seconds / 60) % 60;
+    seconds %= 60;
+
+    if (days)
+        return QCoreApplication::translate("QWebPage", "%1 days %2 hours %3 minutes %4 seconds", "Media time description").arg(days).arg(hours).arg(minutes).arg(seconds);
+
+    if (hours)
+        return QCoreApplication::translate("QWebPage", "%1 hours %2 minutes %3 seconds", "Media time description").arg(hours).arg(minutes).arg(seconds);
+
+    if (minutes)
+        return QCoreApplication::translate("QWebPage", "%1 minutes %2 seconds", "Media time description").arg(minutes).arg(seconds);
+
+    return QCoreApplication::translate("QWebPage", "%1 seconds", "Media time description").arg(seconds);
+}
+
+#else // ENABLE(VIDEO)
+// FIXME: #if ENABLE(VIDEO) should be in the base class
+
+String localizedMediaControlElementString(const String& name)
+{
+    return String();
+}
+
+String localizedMediaControlElementHelpText(const String& name)
+{
+    return String();
+}
+
+String localizedMediaTimeDescription(float time)
+{
+    return String();
+}
+
+#endif // ENABLE(VIDEO)
+
+
+String validationMessageValueMissingText()
+{
+    notImplemented();
+    return String();
+}
+
+String validationMessageValueMissingForCheckboxText()
+{
+    notImplemented();
+    return String();
+}
+
+String validationMessageValueMissingForFileText()
+{
+    notImplemented();
+    return String();
+}
+
+String validationMessageValueMissingForMultipleFileText()
+{
+    notImplemented();
+    return String();
+}
+
+String validationMessageValueMissingForRadioText()
+{
+    notImplemented();
+    return String();
+}
+
+String validationMessageValueMissingForSelectText()
+{
+    notImplemented();
+    return String();
+}
+
+String validationMessageTypeMismatchText()
+{
+    notImplemented();
+    return String();
+}
+
+String validationMessageTypeMismatchForEmailText()
+{
+    notImplemented();
+    return String();
+}
+
+String validationMessageTypeMismatchForMultipleEmailText()
+{
+    notImplemented();
+    return String();
+}
+
+String validationMessageTypeMismatchForURLText()
+{
+    notImplemented();
+    return String();
+}
+
+String validationMessagePatternMismatchText()
+{
+    notImplemented();
+    return String();
+}
+
+String validationMessageTooLongText(int valueLength, int maxLength)
+{
+    notImplemented();
+    return String();
+}
+
+String validationMessageRangeUnderflowText(const String& minimum)
+{
+    notImplemented();
+    return String();
+}
+
+String validationMessageRangeOverflowText(const String& maximum)
+{
+    notImplemented();
+    return String();
+}
+
+String validationMessageStepMismatchText(const String& base, const String& step)
+{
+    notImplemented();
+    return String();
+}
+
+String localizedString(const char* key)
+{
+    return String::fromUTF8(key, strlen(key));
+}
+
+}
diff --git a/Source/WebCore/platform/qt/PlatformScreenQt.cpp b/Source/WebCore/platform/qt/PlatformScreenQt.cpp
index 3c1329ba3..62dcf501f 100644
--- a/Source/WebCore/platform/qt/PlatformScreenQt.cpp
+++ b/Source/WebCore/platform/qt/PlatformScreenQt.cpp
@@ -38,8 +38,13 @@
 #include "NotImplemented.h"
 #include "Widget.h"
 #include "QWebPageClient.h"
+#if QT_VERSION >= QT_VERSION_CHECK(5, 0, 0)
+#include <QGuiApplication>
+#include <QScreen>
+#else
 #include <QApplication>
 #include <QDesktopWidget>
+#endif
 
 namespace WebCore {
 
@@ -66,11 +71,20 @@ static int screenNumber(Widget* w)
 
 int screenDepth(Widget* w)
 {
+#if QT_VERSION >= QT_VERSION_CHECK(5, 0, 0)
+    return QGuiApplication::screens().value(screenNumber(w))->depth();
+#else
     return QApplication::desktop()->screen(screenNumber(w))->depth();
+#endif
 }
 
 int screenDepthPerComponent(Widget* w)
 {
+#if QT_VERSION >= QT_VERSION_CHECK(5, 0, 0)
+    int depth = QGuiApplication::primaryScreen()->depth();
+    // FIXME: Use widget's screen
+    Q_UNUSED(w);
+#else
     int depth = QApplication::desktop()->screen(0)->depth();
     if (w) {
         QWebPageClient* client = w->root()->hostWindow()->platformPageClient();
@@ -81,6 +95,7 @@ int screenDepthPerComponent(Widget* w)
                 depth = view->depth();
         }
     }
+#endif
     // An interface to establish the actual number of bits per color
     // doesn't exist in Qt, or probably at all, so use common-sense
     // values for each screen depth and assume RGB/RGBA where appropriate.
@@ -99,18 +114,32 @@ int screenDepthPerComponent(Widget* w)
 
 bool screenIsMonochrome(Widget* w)
 {
+#if QT_VERSION >= QT_VERSION_CHECK(5, 0, 0)
+    Q_UNUSED(w);
+    // FIXME: In Qt 5 colorCount() isn't even implemented beyond returning 256 :)
+    return false;
+#else
     return QApplication::desktop()->screen(screenNumber(w))->colorCount() == 2;
+#endif
 }
 
 FloatRect screenRect(Widget* widget)
 {
+#if QT_VERSION >= QT_VERSION_CHECK(5, 0, 0)
+    QRect r = QGuiApplication::screens().value(screenNumber(widget))->geometry();
+#else
     QRect r = QApplication::desktop()->screenGeometry(screenNumber(widget));
+#endif
     return FloatRect(r.x(), r.y(), r.width(), r.height());
 }
 
 FloatRect screenAvailableRect(Widget* widget)
 {
+#if QT_VERSION >= QT_VERSION_CHECK(5, 0, 0)
+    QRect r = QGuiApplication::screens().value(screenNumber(widget))->availableGeometry();
+#else
     QRect r = QApplication::desktop()->availableGeometry(screenNumber(widget));
+#endif
     return FloatRect(r.x(), r.y(), r.width(), r.height());
 }
 
diff --git a/Source/WebCore/platform/qt/PlatformTouchEventQt.cpp b/Source/WebCore/platform/qt/PlatformTouchEventQt.cpp
index e3cae8c5a..17a51e9ed 100644
--- a/Source/WebCore/platform/qt/PlatformTouchEventQt.cpp
+++ b/Source/WebCore/platform/qt/PlatformTouchEventQt.cpp
@@ -40,11 +40,39 @@ PlatformTouchEvent::PlatformTouchEvent(QTouchEvent* event)
     case QEvent::TouchEnd:
         m_type = PlatformEvent::TouchEnd;
         break;
+#if QT_VERSION >= QT_VERSION_CHECK(5, 0, 0)
+    case QEvent::TouchCancel:
+        m_type = PlatformEvent::TouchCancel;
+        break;
+#endif
     }
 
     const QList<QTouchEvent::TouchPoint>& points = event->touchPoints();
-    for (int i = 0; i < points.count(); ++i)
-        m_touchPoints.append(PlatformTouchPoint(points.at(i)));
+    for (int i = 0; i < points.count(); ++i) {
+        PlatformTouchPoint::State state = PlatformTouchPoint::TouchStateEnd;
+
+        switch (points.at(i).state()) {
+        case Qt::TouchPointReleased:
+            state = PlatformTouchPoint::TouchReleased;
+            break;
+        case Qt::TouchPointMoved:
+            state = PlatformTouchPoint::TouchMoved;
+            break;
+        case Qt::TouchPointPressed:
+            state = PlatformTouchPoint::TouchPressed;
+            break;
+        case Qt::TouchPointStationary:
+            state = PlatformTouchPoint::TouchStationary;
+            break;
+        }
+
+        // Qt does not have a Qt::TouchPointCancelled point state, so if we receive a touch cancel event,
+        // simply cancel all touch points here.
+        if (m_type == PlatformEvent::TouchCancel)
+            state = PlatformTouchPoint::TouchCancelled;
+
+        m_touchPoints.append(PlatformTouchPoint(points.at(i), state));
+    }
 
     m_modifiers = 0;
     if (event->modifiers()  & Qt::ShiftModifier)
diff --git a/Source/WebCore/platform/qt/PlatformTouchPointQt.cpp b/Source/WebCore/platform/qt/PlatformTouchPointQt.cpp
index ee5e56df7..0f9afa48e 100644
--- a/Source/WebCore/platform/qt/PlatformTouchPointQt.cpp
+++ b/Source/WebCore/platform/qt/PlatformTouchPointQt.cpp
@@ -27,18 +27,13 @@
 
 namespace WebCore {
 
-PlatformTouchPoint::PlatformTouchPoint(const QTouchEvent::TouchPoint& point)
+PlatformTouchPoint::PlatformTouchPoint(const QTouchEvent::TouchPoint& point, State state)
     // The QTouchEvent::TouchPoint API states that ids will be >= 0.
     : m_id(point.id())
+    , m_state(state)
     , m_screenPos(point.screenPos().toPoint())
     , m_pos(point.pos().toPoint())
 {
-    switch (point.state()) {
-    case Qt::TouchPointReleased: m_state = TouchReleased; break;
-    case Qt::TouchPointMoved: m_state = TouchMoved; break;
-    case Qt::TouchPointPressed: m_state = TouchPressed; break;
-    case Qt::TouchPointStationary: m_state = TouchStationary; break;
-    }
     // Qt reports touch point size as rectangles, but we will pretend it is an oval.
     QRect touchRect = point.rect().toAlignedRect();
     if (touchRect.isValid()) {
diff --git a/Source/WebCore/platform/qt/QWebPageClient.h b/Source/WebCore/platform/qt/QWebPageClient.h
index 8396caca5..30c3b48ea 100644
--- a/Source/WebCore/platform/qt/QWebPageClient.h
+++ b/Source/WebCore/platform/qt/QWebPageClient.h
@@ -34,6 +34,10 @@
 #include <GraphicsLayer.h>
 #endif
 
+#if ENABLE(WEBGL)
+#include <GraphicsContext3D.h>
+#endif
+
 #include <QPalette>
 #include <QRect>
 
@@ -41,6 +45,10 @@ QT_BEGIN_NAMESPACE
 class QStyle;
 QT_END_NAMESPACE
 
+namespace WebCore {
+class Widget;
+}
+
 class QWebPageClient {
 public:
     virtual ~QWebPageClient() { }
@@ -95,6 +103,13 @@ public:
 
     virtual QRectF windowRect() const = 0;
 
+    virtual void setWidgetVisible(WebCore::Widget*, bool visible) = 0;
+
+#if ENABLE(WEBGL)
+    virtual void createPlatformGraphicsContext3D(PlatformGraphicsContext3D*,
+                                                 PlatformGraphicsSurface3D*) = 0;
+#endif
+
 protected:
 #ifndef QT_NO_CURSOR
     virtual QCursor cursor() const = 0;
diff --git a/Source/WebCore/platform/qt/RenderThemeQt.cpp b/Source/WebCore/platform/qt/RenderThemeQt.cpp
index 18df290db..00b8b1c1b 100644
--- a/Source/WebCore/platform/qt/RenderThemeQt.cpp
+++ b/Source/WebCore/platform/qt/RenderThemeQt.cpp
@@ -845,7 +845,7 @@ double RenderThemeQt::caretBlinkInterval() const
     return static_cast<QGuiApplication*>(qApp)->styleHints()->cursorFlashTime() / 1000.0 / 2.0;
 }
 
-String RenderThemeQt::fileListNameForWidth(const Vector<String>& filenames, const Font& font, int width)
+String RenderThemeQt::fileListNameForWidth(const Vector<String>& filenames, const Font& font, int width) const
 {
     if (width <= 0)
         return String();
diff --git a/Source/WebCore/platform/qt/RenderThemeQt.h b/Source/WebCore/platform/qt/RenderThemeQt.h
index 1393536b3..cdaaa98eb 100644
--- a/Source/WebCore/platform/qt/RenderThemeQt.h
+++ b/Source/WebCore/platform/qt/RenderThemeQt.h
@@ -151,7 +151,7 @@ protected:
 #endif
     virtual void computeSizeBasedOnStyle(RenderStyle*) const = 0;
 
-    virtual String fileListNameForWidth(const Vector<String>& filenames, const Font&, int width);
+    virtual String fileListNameForWidth(const Vector<String>& filenames, const Font&, int width) const;
 
     virtual QRect inflateButtonRect(const QRect& originalRect) const;
 
diff --git a/Source/WebCore/platform/qt/ScrollbarQt.cpp b/Source/WebCore/platform/qt/ScrollbarQt.cpp
deleted file mode 100644
index 190f08da9..000000000
--- a/Source/WebCore/platform/qt/ScrollbarQt.cpp
+++ /dev/null
@@ -1,102 +0,0 @@
-/*
- * Copyright (C) 2007, 2008 Apple Inc. All rights reserved.
- * Copyright (C) 2007 Staikos Computing Services Inc. <info@staikos.net>
- * Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies)
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "config.h"
-#include "Scrollbar.h"
-
-#include "EventHandler.h"
-#include "Frame.h"
-#include "FrameView.h"
-#include "GraphicsContext.h"
-#include "IntRect.h"
-#include "PlatformMouseEvent.h"
-#include "ScrollableArea.h"
-#include "ScrollbarTheme.h"
-
-#include <QApplication>
-#include <QDebug>
-#include <QMenu>
-#include <QPainter>
-#include <QStyle>
-
-using namespace std;
-
-namespace WebCore {
-
-bool Scrollbar::contextMenu(const PlatformMouseEvent& event)
-{
-#ifndef QT_NO_CONTEXTMENU
-    if (!QApplication::style()->styleHint(QStyle::SH_ScrollBar_ContextMenu))
-        return true;
-
-    bool horizontal = (m_orientation == HorizontalScrollbar);
-
-    QMenu menu;
-    QAction* actScrollHere = menu.addAction(QCoreApplication::translate("QWebPage", "Scroll here"));
-    menu.addSeparator();
-
-    QAction* actScrollTop = menu.addAction(horizontal ? QCoreApplication::translate("QWebPage", "Left edge") : QCoreApplication::translate("QWebPage", "Top"));
-    QAction* actScrollBottom = menu.addAction(horizontal ? QCoreApplication::translate("QWebPage", "Right edge") : QCoreApplication::translate("QWebPage", "Bottom"));
-    menu.addSeparator();
-
-    QAction* actPageUp = menu.addAction(horizontal ? QCoreApplication::translate("QWebPage", "Page left") : QCoreApplication::translate("QWebPage", "Page up"));
-    QAction* actPageDown = menu.addAction(horizontal ? QCoreApplication::translate("QWebPage", "Page right") : QCoreApplication::translate("QWebPage", "Page down"));
-    menu.addSeparator();
-
-    QAction* actScrollUp = menu.addAction(horizontal ? QCoreApplication::translate("QWebPage", "Scroll left") : QCoreApplication::translate("QWebPage", "Scroll up"));
-    QAction* actScrollDown = menu.addAction(horizontal ? QCoreApplication::translate("QWebPage", "Scroll right") : QCoreApplication::translate("QWebPage", "Scroll down"));
-
-    const QPoint globalPos = QPoint(event.globalPosition().x(), event.globalPosition().y());
-    QAction* actionSelected = menu.exec(globalPos);
-
-    if (actionSelected == actScrollHere) {
-        // Set the pressed position to the middle of the thumb so that when we 
-        // do move, the delta will be from the current pixel position of the
-        // thumb to the new position
-        int position = theme()->trackPosition(this) + theme()->thumbPosition(this) + theme()->thumbLength(this) / 2;
-        setPressedPos(position); 
-        const QPoint pos = convertFromContainingWindow(event.position());
-        moveThumb(horizontal ? pos.x() : pos.y());
-    } else if (actionSelected == actScrollTop)
-        scrollableArea()->scroll(horizontal ? ScrollLeft : ScrollUp, ScrollByDocument);
-    else if (actionSelected == actScrollBottom)
-        scrollableArea()->scroll(horizontal ? ScrollRight : ScrollDown, ScrollByDocument);
-    else if (actionSelected == actPageUp)
-        scrollableArea()->scroll(horizontal ? ScrollLeft : ScrollUp, ScrollByPage);
-    else if (actionSelected == actPageDown)
-        scrollableArea()->scroll(horizontal ? ScrollRight : ScrollDown, ScrollByPage);
-    else if (actionSelected == actScrollUp)
-        scrollableArea()->scroll(horizontal ? ScrollLeft : ScrollUp, ScrollByLine);
-    else if (actionSelected == actScrollDown)
-        scrollableArea()->scroll(horizontal ? ScrollRight : ScrollDown, ScrollByLine);
-#endif // QT_NO_CONTEXTMENU
-    return true;
-}
-
-}
-
-// vim: ts=4 sw=4 et
diff --git a/Source/WebCore/platform/qt/SoundQt.cpp b/Source/WebCore/platform/qt/SoundQt.cpp
index bf9e1426a..7e3c99119 100644
--- a/Source/WebCore/platform/qt/SoundQt.cpp
+++ b/Source/WebCore/platform/qt/SoundQt.cpp
@@ -28,13 +28,16 @@
 #include "config.h"
 #include "Sound.h"
 
-#include <QApplication>
+#include <NotImplemented.h>
 
 namespace WebCore {
 
 void systemBeep()
 {
-    QApplication::beep();
+    // FIXME: Not implemented in Qt 5 right now. The implementation in QApplication:beep()
+    // is empty. If anyone is going to bother implementing this via QPlatformNativeInterface, then
+    // we could use that here.
+    notImplemented();
 }
 
 }
diff --git a/Source/WebCore/platform/qt/WidgetQt.cpp b/Source/WebCore/platform/qt/WidgetQt.cpp
index 5215e6661..86ee4307f 100644
--- a/Source/WebCore/platform/qt/WidgetQt.cpp
+++ b/Source/WebCore/platform/qt/WidgetQt.cpp
@@ -45,11 +45,10 @@
 #include <QDebug>
 #include <QPaintEngine>
 #include <QPainter>
-#include <QWidget>
 
 namespace WebCore {
 
-Widget::Widget(QWidget* widget)
+Widget::Widget(PlatformWidget widget)
 {
     init(widget);
 }
@@ -89,16 +88,24 @@ void Widget::show()
 {
     setSelfVisible(true);
 
-    if (isParentVisible() && platformWidget())
-        platformWidget()->show();
+    if (!isParentVisible() || !platformWidget())
+        return;
+
+    QWebPageClient* client = root()->hostWindow()->platformPageClient();
+    if (client)
+        client->setWidgetVisible(this, true);
 }
 
 void Widget::hide()
 {
     setSelfVisible(false);
 
-    if (isParentVisible() && platformWidget())
-        platformWidget()->hide();
+    if (!isParentVisible() || !platformWidget())
+        return;
+
+    QWebPageClient* client = root()->hostWindow()->platformPageClient();
+    if (client)
+        client->setWidgetVisible(this, false);
 }
 
 void Widget::paint(GraphicsContext*, const IntRect&)
diff --git a/Source/WebCore/platform/sql/SQLiteDatabase.cpp b/Source/WebCore/platform/sql/SQLiteDatabase.cpp
index 5b9e9c570..bfca58636 100644
--- a/Source/WebCore/platform/sql/SQLiteDatabase.cpp
+++ b/Source/WebCore/platform/sql/SQLiteDatabase.cpp
@@ -102,7 +102,7 @@ bool SQLiteDatabase::open(const String& filename, bool forWebSQLDatabase)
 void SQLiteDatabase::close()
 {
     if (m_db) {
-        // FIXME: This is being called on themain thread during JS GC. <rdar://problem/5739818>
+        // FIXME: This is being called on the main thread during JS GC. <rdar://problem/5739818>
         // ASSERT(currentThread() == m_openingThread);
         sqlite3* db = m_db;
         {
@@ -167,7 +167,7 @@ void SQLiteDatabase::setMaximumSize(int64_t size)
     
     int currentPageSize = pageSize();
 
-    ASSERT(currentPageSize);
+    ASSERT(currentPageSize || !m_db);
     int64_t newMaxPageCount = currentPageSize ? size / currentPageSize : 0;
     
     MutexLocker locker(m_authorizerLock);
diff --git a/Source/WebCore/platform/sql/SQLiteDatabase.h b/Source/WebCore/platform/sql/SQLiteDatabase.h
index 0bf03141a..26fea2471 100644
--- a/Source/WebCore/platform/sql/SQLiteDatabase.h
+++ b/Source/WebCore/platform/sql/SQLiteDatabase.h
@@ -104,7 +104,7 @@ public:
     const char* lastErrorMsg();
     
     sqlite3* sqlite3Handle() const {
-        ASSERT(m_sharable || currentThread() == m_openingThread);
+        ASSERT(m_sharable || currentThread() == m_openingThread || !m_db);
         return m_db;
     }
     
diff --git a/Source/WebCore/platform/text/TextCheckerClient.h b/Source/WebCore/platform/text/TextCheckerClient.h
index d16ade164..6b0fa8053 100644
--- a/Source/WebCore/platform/text/TextCheckerClient.h
+++ b/Source/WebCore/platform/text/TextCheckerClient.h
@@ -37,6 +37,7 @@
 namespace WebCore {
 
 class SpellChecker;
+class TextCheckingRequest;
 
 struct GrammarDetail {
     int location;
@@ -71,7 +72,7 @@ public:
     // provide more accurate correction suggestions. Caller can pass in more text in "context" to aid such spellcheckers on language
     // identification. Noramlly it's the text surrounding the "word" for which we are getting correction suggestions.
     virtual void getGuessesForWord(const String& word, const String& context, Vector<String>& guesses) = 0;
-    virtual void requestCheckingOfString(SpellChecker*, int, TextCheckingTypeMask, const String&) = 0;
+    virtual void requestCheckingOfString(SpellChecker*, const TextCheckingRequest&) = 0;
 };
 
 }
diff --git a/Source/WebCore/platform/text/TextChecking.h b/Source/WebCore/platform/text/TextChecking.h
index 967eac5b3..be9ed5f9e 100644
--- a/Source/WebCore/platform/text/TextChecking.h
+++ b/Source/WebCore/platform/text/TextChecking.h
@@ -31,6 +31,8 @@
 #ifndef TextChecking_h
 #define TextChecking_h
 
+#include <wtf/text/WTFString.h>
+
 namespace WebCore {
 
 #define WTF_USE_GRAMMAR_CHECKING 1
@@ -61,6 +63,34 @@ enum TextCheckingType {
 
 typedef unsigned TextCheckingTypeMask;
 
+enum TextCheckingProcessType {
+    TextCheckingProcessBatch,
+    TextCheckingProcessIncremental
+};
+
+class TextCheckingRequest {
+public:
+    TextCheckingRequest(int sequence, String text, TextCheckingTypeMask mask, TextCheckingProcessType processType)
+        : m_sequence(sequence)
+        , m_text(text)
+        , m_mask(mask)
+        , m_processType(processType)
+    {
+    }
+
+    void setSequence(int sequence) { m_sequence = sequence; }
+    int sequence() const { return m_sequence; }
+    String text() const { return m_text; }
+    TextCheckingTypeMask mask() const { return m_mask; }
+    TextCheckingProcessType processType() const { return m_processType; }
+
+private:
+    int m_sequence;
+    String m_text;
+    TextCheckingTypeMask m_mask;
+    TextCheckingProcessType m_processType;
+};
+
 }
 
 #endif // TextChecking_h
diff --git a/Source/WebCore/platform/text/blackberry/StringBlackBerry.cpp b/Source/WebCore/platform/text/blackberry/StringBlackBerry.cpp
index 52d130cb8..3eff66b2f 100644
--- a/Source/WebCore/platform/text/blackberry/StringBlackBerry.cpp
+++ b/Source/WebCore/platform/text/blackberry/StringBlackBerry.cpp
@@ -20,10 +20,8 @@
 #include "PlatformString.h"
 
 #include "WebString.h"
-#include "WebStringImpl.h"
 
 using BlackBerry::WebKit::WebString;
-using BlackBerry::WebKit::WebStringImpl;
 
 namespace WTF {
 
@@ -34,7 +32,7 @@ String::String(const WebString& webString)
 
 String::operator WebString() const
 {
-    WebString webString(static_cast<WebStringImpl*>(m_impl.get()));
+    WebString webString(m_impl.get());
     return webString;
 }
 
diff --git a/Source/WebCore/platform/win/ClipboardWin.cpp b/Source/WebCore/platform/win/ClipboardWin.cpp
index aa383881a..89cacb351 100644
--- a/Source/WebCore/platform/win/ClipboardWin.cpp
+++ b/Source/WebCore/platform/win/ClipboardWin.cpp
@@ -28,6 +28,7 @@
 
 #include "CachedImage.h"
 #include "ClipboardUtilitiesWin.h"
+#include "DOMStringList.h"
 #include "Document.h"
 #include "DragData.h"
 #include "Editor.h"
@@ -485,24 +486,24 @@ bool ClipboardWin::setData(const String& type, const String& data)
     return false;
 }
 
-static void addMimeTypesForFormat(HashSet<String>& results, const FORMATETC& format)
+static void addMimeTypesForFormat(DOMStringList* results, const FORMATETC& format)
 {
     // URL and Text are provided for compatibility with IE's model
     if (format.cfFormat == urlFormat()->cfFormat || format.cfFormat == urlWFormat()->cfFormat) {
-        results.add("URL");
-        results.add("text/uri-list");
+        results->append("URL");
+        results->append("text/uri-list");
     }
 
     if (format.cfFormat == plainTextWFormat()->cfFormat || format.cfFormat == plainTextFormat()->cfFormat) {
-        results.add("Text");
-        results.add("text/plain");
+        results->append("Text");
+        results->append("text/plain");
     }
 }
 
 // extensions beyond IE's API
-HashSet<String> ClipboardWin::types() const
+PassRefPtr<DOMStringList> ClipboardWin::types() const
 { 
-    HashSet<String> results; 
+    RefPtr<DOMStringList> results = DOMStringList::create();
     if (policy() != ClipboardReadable && policy() != ClipboardTypesReadable)
         return results;
 
@@ -522,16 +523,16 @@ HashSet<String> ClipboardWin::types() const
 
         // IEnumFORMATETC::Next returns S_FALSE if there are no more items.
         while (itr->Next(1, &data, 0) == S_OK)
-            addMimeTypesForFormat(results, data);
+            addMimeTypesForFormat(results.get(), data);
     } else {
         for (DragDataMap::const_iterator it = m_dragDataMap.begin(); it != m_dragDataMap.end(); ++it) {
             FORMATETC data;
             data.cfFormat = (*it).first;
-            addMimeTypesForFormat(results, data);
+            addMimeTypesForFormat(results.get(), data);
         }
     }
 
-    return results;
+    return results.release();
 }
 
 PassRefPtr<FileList> ClipboardWin::files() const
diff --git a/Source/WebCore/platform/win/ClipboardWin.h b/Source/WebCore/platform/win/ClipboardWin.h
index a35d8b48a..8c22c0a35 100644
--- a/Source/WebCore/platform/win/ClipboardWin.h
+++ b/Source/WebCore/platform/win/ClipboardWin.h
@@ -64,7 +64,7 @@ public:
     bool setData(const String& type, const String& data);
 
     // extensions beyond IE's API
-    virtual HashSet<String> types() const;
+    virtual PassRefPtr<DOMStringList> types() const;
     virtual PassRefPtr<FileList> files() const;
 
     void setDragImage(CachedImage*, const IntPoint&);
diff --git a/Source/WebCore/platform/win/FileSystemWin.cpp b/Source/WebCore/platform/win/FileSystemWin.cpp
index d9b0dbcf2..118754455 100644
--- a/Source/WebCore/platform/win/FileSystemWin.cpp
+++ b/Source/WebCore/platform/win/FileSystemWin.cpp
@@ -32,45 +32,64 @@
 
 #include "NotImplemented.h"
 #include "PathWalker.h"
+#include <wtf/CryptographicallyRandomNumber.h>
 #include <wtf/HashMap.h>
 #include <wtf/text/CString.h>
 #include <wtf/text/WTFString.h>
 
 #include <windows.h>
-#include <winbase.h>
 #include <shlobj.h>
 #include <shlwapi.h>
 
 namespace WebCore {
 
-static bool statFile(String path, struct _stat64& st)
+static const ULONGLONG kSecondsFromFileTimeToTimet = 11644473600;
+
+static bool getFindData(String path, WIN32_FIND_DATAW& findData)
 {
-    ASSERT_ARG(path, !path.isNull());
-    return !_wstat64(path.charactersWithNullTermination(), &st) && (st.st_mode & _S_IFMT) == _S_IFREG;
+    HANDLE handle = FindFirstFileW(path.charactersWithNullTermination(), &findData);
+    if (handle == INVALID_HANDLE_VALUE)
+        return false;
+    FindClose(handle);
+    return true;
 }
 
 bool getFileSize(const String& path, long long& result)
 {
-    struct _stat64 sb;
-    if (!statFile(path, sb))
+    WIN32_FIND_DATAW findData;
+    if (!getFindData(path, findData))
+        return false;
+
+    ULARGE_INTEGER fileSize;
+    fileSize.HighPart = findData.nFileSizeHigh;
+    fileSize.LowPart = findData.nFileSizeLow;
+
+    if (fileSize.QuadPart > static_cast<ULONGLONG>(std::numeric_limits<long long>::max()))
         return false;
-    result = sb.st_size;
+
+    result = fileSize.QuadPart;
     return true;
 }
 
 bool getFileModificationTime(const String& path, time_t& result)
 {
-    struct _stat64 st;
-    if (!statFile(path, st))
+    WIN32_FIND_DATAW findData;
+    if (!getFindData(path, findData))
         return false;
-    result = st.st_mtime;
+
+    ULARGE_INTEGER fileSize;
+    fileSize.HighPart = findData.ftLastWriteTime.dwHighDateTime;
+    fileSize.LowPart = findData.ftLastWriteTime.dwLowDateTime;
+
+    // Information about converting time_t to FileTime is available at http://msdn.microsoft.com/en-us/library/ms724228%28v=vs.85%29.aspx
+    result = fileSize.QuadPart / 10000000 - kSecondsFromFileTimeToTimet;
     return true;
 }
 
-bool fileExists(const String& path) 
+bool fileExists(const String& path)
 {
-    struct _stat64 st;
-    return statFile(path, st);
+    WIN32_FIND_DATAW findData;
+    return getFindData(path, findData);
 }
 
 bool deleteFile(const String& path)
@@ -145,9 +164,11 @@ String directoryName(const String& path)
 
 static String bundleName()
 {
-    static bool initialized;
     static String name = "WebKit";
 
+#if USE(CF)
+    static bool initialized;
+
     if (!initialized) {
         initialized = true;
 
@@ -156,6 +177,7 @@ static String bundleName()
                 if (CFGetTypeID(bundleExecutable) == CFStringGetTypeID())
                     name = reinterpret_cast<CFStringRef>(bundleExecutable);
     }
+#endif
 
     return name;
 }
@@ -194,21 +216,16 @@ String openTemporaryFile(const String&, PlatformFileHandle& handle)
 {
     handle = INVALID_HANDLE_VALUE;
 
-    char tempPath[MAX_PATH];
-    int tempPathLength = ::GetTempPathA(WTF_ARRAY_LENGTH(tempPath), tempPath);
+    wchar_t tempPath[MAX_PATH];
+    int tempPathLength = ::GetTempPathW(WTF_ARRAY_LENGTH(tempPath), tempPath);
     if (tempPathLength <= 0 || tempPathLength > WTF_ARRAY_LENGTH(tempPath))
         return String();
 
-    HCRYPTPROV hCryptProv = 0;
-    if (!CryptAcquireContext(&hCryptProv, 0, 0, PROV_RSA_FULL, CRYPT_VERIFYCONTEXT))
-        return String();
-
-    char proposedPath[MAX_PATH];
-    while (1) {
-        char tempFile[] = "XXXXXXXX.tmp"; // Use 8.3 style name (more characters aren't helpful due to 8.3 short file names)
+    String proposedPath;
+    do {
+        wchar_t tempFile[] = L"XXXXXXXX.tmp"; // Use 8.3 style name (more characters aren't helpful due to 8.3 short file names)
         const int randomPartLength = 8;
-        if (!CryptGenRandom(hCryptProv, randomPartLength, reinterpret_cast<BYTE*>(tempFile)))
-            break;
+        cryptographicallyRandomValues(tempFile, randomPartLength * sizeof(wchar_t));
 
         // Limit to valid filesystem characters, also excluding others that could be problematic, like punctuation.
         // don't include both upper and lowercase since Windows file systems are typically not case sensitive.
@@ -216,25 +233,20 @@ String openTemporaryFile(const String&, PlatformFileHandle& handle)
         for (int i = 0; i < randomPartLength; ++i)
             tempFile[i] = validChars[tempFile[i] % (sizeof(validChars) - 1)];
 
-        ASSERT(strlen(tempFile) == sizeof(tempFile) - 1);
+        ASSERT(wcslen(tempFile) == WTF_ARRAY_LENGTH(tempFile) - 1);
 
-        if (!PathCombineA(proposedPath, tempPath, tempFile))
+        proposedPath = pathByAppendingComponent(tempPath, tempFile);
+        if (proposedPath.isEmpty())
             break;
- 
-        // use CREATE_NEW to avoid overwriting an existing file with the same name
-        handle = CreateFileA(proposedPath, GENERIC_READ | GENERIC_WRITE, 0, 0, CREATE_NEW, FILE_ATTRIBUTE_NORMAL, 0);
-        if (!isHandleValid(handle) && GetLastError() == ERROR_ALREADY_EXISTS)
-            continue;
 
-        break;
-    }
-
-    CryptReleaseContext(hCryptProv, 0);
+        // use CREATE_NEW to avoid overwriting an existing file with the same name
+        handle = ::CreateFileW(proposedPath.charactersWithNullTermination(), GENERIC_READ | GENERIC_WRITE, 0, 0, CREATE_NEW, FILE_ATTRIBUTE_NORMAL, 0);
+    } while (!isHandleValid(handle) && GetLastError() == ERROR_ALREADY_EXISTS);
 
     if (!isHandleValid(handle))
         return String();
 
-    return String::fromUTF8(proposedPath);
+    return proposedPath;
 }
 
 PlatformFileHandle openFile(const String& path, FileOpenMode mode)
@@ -294,6 +306,8 @@ String roamingUserSpecificStorageDirectory()
     return cachedStorageDirectory(CSIDL_APPDATA);
 }
 
+#if USE(CF)
+
 bool safeCreateFile(const String& path, CFDataRef data)
 {
     // Create a temporary file.
@@ -324,6 +338,8 @@ bool safeCreateFile(const String& path, CFDataRef data)
     return true;
 }
 
+#endif // USE(CF)
+
 Vector<String> listDirectory(const String& directory, const String& filter)
 {
     Vector<String> entries;
diff --git a/Source/WebCore/platform/win/PasteboardWin.cpp b/Source/WebCore/platform/win/PasteboardWin.cpp
index 887fc912c..065e3a801 100644
--- a/Source/WebCore/platform/win/PasteboardWin.cpp
+++ b/Source/WebCore/platform/win/PasteboardWin.cpp
@@ -42,6 +42,7 @@
 #include "RenderImage.h"
 #include "TextEncoding.h"
 #include "WebCoreInstanceHandle.h"
+#include "WindowsExtras.h"
 #include "markup.h"
 #include <wtf/text/CString.h>
 
@@ -88,11 +89,6 @@ Pasteboard* Pasteboard::generalPasteboard()
 
 Pasteboard::Pasteboard()
 {
-    HWND hWndParent = 0;
-#if !OS(WINCE)
-    hWndParent = HWND_MESSAGE;
-#endif
-
     WNDCLASS wc;
     memset(&wc, 0, sizeof(WNDCLASS));
     wc.lpfnWndProc    = PasteboardOwnerWndProc;
@@ -101,7 +97,7 @@ Pasteboard::Pasteboard()
     RegisterClass(&wc);
 
     m_owner = ::CreateWindow(L"PasteboardOwnerWindowClass", L"PasteboardOwnerWindow", 0, 0, 0, 0, 0,
-        hWndParent, 0, 0, 0);
+        HWND_MESSAGE, 0, 0, 0);
 
     HTMLClipboardFormat = ::RegisterClipboardFormat(L"HTML Format");
     BookmarkClipboardFormat = ::RegisterClipboardFormat(L"UniformResourceLocatorW");
diff --git a/Source/WebCore/platform/win/PopupMenuWin.cpp b/Source/WebCore/platform/win/PopupMenuWin.cpp
index d0b3ec940..9ac2674c4 100644
--- a/Source/WebCore/platform/win/PopupMenuWin.cpp
+++ b/Source/WebCore/platform/win/PopupMenuWin.cpp
@@ -43,6 +43,7 @@
 #include "SimpleFontData.h"
 #include "TextRun.h"
 #include "WebCoreInstanceHandle.h"
+#include "WindowsExtras.h"
 
 #include <windows.h>
 #include <windowsx.h>
@@ -536,12 +537,12 @@ bool PopupMenuWin::scrollToRevealSelection()
     int index = focusedIndex();
 
     if (index < m_scrollOffset) {
-        ScrollableArea::scrollToYOffsetWithoutAnimation(index);
+        ScrollableArea::scrollToOffsetWithoutAnimation(VerticalScrollbar, index);
         return true;
     }
 
     if (index >= m_scrollOffset + visibleItems()) {
-        ScrollableArea::scrollToYOffsetWithoutAnimation(index - visibleItems() + 1);
+        ScrollableArea::scrollToOffsetWithoutAnimation(VerticalScrollbar, index - visibleItems() + 1);
         return true;
     }
 
@@ -763,24 +764,14 @@ void PopupMenuWin::registerClass()
 
 LRESULT CALLBACK PopupMenuWin::PopupMenuWndProc(HWND hWnd, UINT message, WPARAM wParam, LPARAM lParam)
 {
-#if OS(WINCE)
-    LONG longPtr = GetWindowLong(hWnd, 0);
-#else
-    LONG_PTR longPtr = GetWindowLongPtr(hWnd, 0);
-#endif
-    
-    if (PopupMenuWin* popup = reinterpret_cast<PopupMenuWin*>(longPtr))
+    if (PopupMenuWin* popup = static_cast<PopupMenuWin*>(getWindowPointer(hWnd, 0)))
         return popup->wndProc(hWnd, message, wParam, lParam);
-    
+
     if (message == WM_CREATE) {
         LPCREATESTRUCT createStruct = reinterpret_cast<LPCREATESTRUCT>(lParam);
 
         // Associate the PopupMenu with the window.
-#if OS(WINCE)
-        ::SetWindowLong(hWnd, 0, (LONG)createStruct->lpCreateParams);
-#else
-        ::SetWindowLongPtr(hWnd, 0, (LONG_PTR)createStruct->lpCreateParams);
-#endif
+        setWindowPointer(hWnd, 0, createStruct->lpCreateParams);
         return 0;
     }
 
diff --git a/Source/WebCore/platform/win/RunLoopWin.cpp b/Source/WebCore/platform/win/RunLoopWin.cpp
index 120c252a6..1663b6613 100644
--- a/Source/WebCore/platform/win/RunLoopWin.cpp
+++ b/Source/WebCore/platform/win/RunLoopWin.cpp
@@ -26,6 +26,7 @@
 #include "config.h"
 #include "RunLoop.h"
 
+#include "WindowsExtras.h"
 #include <wtf/CurrentTime.h>
 
 using namespace std;
@@ -37,16 +38,14 @@ static const LPWSTR kRunLoopMessageWindowClassName = L"RunLoopMessageWindow";
 
 LRESULT CALLBACK RunLoop::RunLoopWndProc(HWND hWnd, UINT message, WPARAM wParam, LPARAM lParam)
 {
-    LONG_PTR longPtr = ::GetWindowLongPtr(hWnd, 0);
-    
-    if (RunLoop* runLoop = reinterpret_cast<RunLoop*>(longPtr))
+    if (RunLoop* runLoop = static_cast<RunLoop*>(getWindowPointer(hWnd, 0)))
         return runLoop->wndProc(hWnd, message, wParam, lParam);
 
     if (message == WM_CREATE) {
         LPCREATESTRUCT createStruct = reinterpret_cast<LPCREATESTRUCT>(lParam);
 
         // Associate the RunLoop with the window.
-        ::SetWindowLongPtr(hWnd, 0, (LONG_PTR)createStruct->lpCreateParams);
+        setWindowPointer(hWnd, 0, createStruct->lpCreateParams);
         return 0;
     }
 
@@ -87,13 +86,12 @@ bool RunLoop::registerRunLoopMessageWindowClass()
 {
     // FIXME: This really only needs to be called once.
 
-    WNDCLASSEX windowClass = { 0 };
-    windowClass.cbSize          = sizeof(windowClass);
+    WNDCLASS windowClass = { 0 };
     windowClass.lpfnWndProc     = RunLoop::RunLoopWndProc;
     windowClass.cbWndExtra      = sizeof(RunLoop*);
     windowClass.lpszClassName   = kRunLoopMessageWindowClassName;
 
-    return !!::RegisterClassEx(&windowClass);
+    return !!::RegisterClass(&windowClass);
 }
 
 RunLoop::RunLoop()
diff --git a/Source/WebCore/platform/win/WindowsExtras.h b/Source/WebCore/platform/win/WindowsExtras.h
new file mode 100644
index 000000000..ab1e85376
--- /dev/null
+++ b/Source/WebCore/platform/win/WindowsExtras.h
@@ -0,0 +1,56 @@
+/*
+ * Copyright (C) 2012 Patrick Gansterer <paroga@paroga.com>
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WindowsExtras_h
+#define WindowsExtras_h
+
+#include <windows.h>
+
+namespace WebCore {
+
+#ifndef HWND_MESSAGE
+const HWND HWND_MESSAGE = 0;
+#endif
+
+inline void* getWindowPointer(HWND hWnd, int index)
+{
+#if OS(WINCE)
+    return reinterpret_cast<void*>(::GetWindowLong(hWnd, index));
+#else
+    return reinterpret_cast<void*>(::GetWindowLongPtr(hWnd, index));
+#endif
+}
+
+inline void* setWindowPointer(HWND hWnd, int index, void* value)
+{
+#if OS(WINCE)
+    return reinterpret_cast<void*>(::SetWindowLong(hWnd, index, reinterpret_cast<LONG>(value)));
+#else
+    return reinterpret_cast<void*>(::SetWindowLongPtr(hWnd, index, reinterpret_cast<LONG_PTR>(value)));
+#endif
+}
+
+} // namespace WebCore
+
+#endif // WindowsExtras_h
diff --git a/Source/WebCore/platform/wx/ClipboardWx.cpp b/Source/WebCore/platform/wx/ClipboardWx.cpp
index 32216a652..161bce8aa 100644
--- a/Source/WebCore/platform/wx/ClipboardWx.cpp
+++ b/Source/WebCore/platform/wx/ClipboardWx.cpp
@@ -26,6 +26,7 @@
 #include "config.h"
 #include "ClipboardWx.h"
 
+#include "DOMStringList.h"
 #include "FileList.h"
 #include "HashTable.h"
 #include "IntPoint.h"
@@ -70,11 +71,10 @@ bool ClipboardWx::setData(const String& type, const String& data)
 }
 
 // extensions beyond IE's API
-HashSet<String> ClipboardWx::types() const 
+PassRefPtr<DOMStringList> ClipboardWx::types() const 
 {
     notImplemented();
-    HashSet<String> result;
-    return result;
+    return DOMStringList::create();
 }
 
 PassRefPtr<FileList> ClipboardWx::files() const
diff --git a/Source/WebCore/platform/wx/ClipboardWx.h b/Source/WebCore/platform/wx/ClipboardWx.h
index 138635aae..f92726ae6 100644
--- a/Source/WebCore/platform/wx/ClipboardWx.h
+++ b/Source/WebCore/platform/wx/ClipboardWx.h
@@ -46,7 +46,7 @@ namespace WebCore {
         bool setData(const String& type, const String& data);
     
         // extensions beyond IE's API
-        virtual HashSet<String> types() const;
+        virtual PassRefPtr<DOMStringList> types() const;
         virtual PassRefPtr<FileList> files() const;
     
         IntPoint dragLocation() const;
diff --git a/Source/WebCore/platform/wx/ContextMenuWx.cpp b/Source/WebCore/platform/wx/ContextMenuWx.cpp
index 73329a994..f722769fa 100644
--- a/Source/WebCore/platform/wx/ContextMenuWx.cpp
+++ b/Source/WebCore/platform/wx/ContextMenuWx.cpp
@@ -110,3 +110,11 @@ PlatformMenuDescription ContextMenu::releasePlatformDescription()
 
     return description;
 }
+
+unsigned ContextMenu::itemCount() const
+{
+    if (m_platformDescription)
+        return m_platformDescription->GetMenuItemCount();
+    
+    return 0;
+}
diff --git a/Source/WebCore/platform/wx/LocalizedStringsWx.cpp b/Source/WebCore/platform/wx/LocalizedStringsWx.cpp
index 4d1e19729..fa959314d 100644
--- a/Source/WebCore/platform/wx/LocalizedStringsWx.cpp
+++ b/Source/WebCore/platform/wx/LocalizedStringsWx.cpp
@@ -32,473 +32,9 @@
 
 namespace WebCore {
 
-String submitButtonDefaultLabel() 
-{ 
-    return String("Submit"); 
-}
-
-String inputElementAltText() 
-{ 
-    return String(); 
-}
-
-String resetButtonDefaultLabel() 
-{ 
-    return String("Reset"); 
-}
-
-String defaultDetailsSummaryText()
-{
-    return String("Details");
-}
-
-String platformDefaultLanguage() 
-{ 
-    return String("en"); 
-}
-
-String searchableIndexIntroduction() 
-{ 
-    return String("Searchable Index"); 
-}
-
-String fileButtonChooseFileLabel() 
-{ 
-    return String("Choose File"); 
-}
-
-String fileButtonChooseMultipleFilesLabel() 
-{ 
-    return String("Choose Files"); 
-}
-
-String fileButtonNoFileSelectedLabel() 
-{ 
-    return String("No file selected"); 
-}
-
-String fileButtonNoFilesSelectedLabel() 
-{ 
-    return String("No files selected"); 
-}
-
-String contextMenuItemTagOpenLinkInNewWindow() 
-{ 
-    return String("Open Link in New Window"); 
-}
-
-String contextMenuItemTagDownloadLinkToDisk() 
-{ 
-    return String("Download Link to Disk"); 
-}
-
-String contextMenuItemTagCopyLinkToClipboard() 
-{ 
-    return String("Copy Link to Clipboard"); 
-}
-
-String contextMenuItemTagOpenImageInNewWindow() 
-{ 
-    return String("Open Image in New Window"); 
-}
-
-String contextMenuItemTagDownloadImageToDisk() 
-{ 
-    return String("Download Image to Disk"); 
-}
-
-String contextMenuItemTagCopyImageToClipboard() 
-{ 
-    return String("Copy Image to Clipboard"); 
-}
-
-String contextMenuItemTagOpenVideoInNewWindow()
-{
-    return String("Open Video in New Window");
-}
-
-String contextMenuItemTagOpenAudioInNewWindow()
-{
-    return String("Open Audio in New Window");
-}
-
-String contextMenuItemTagCopyVideoLinkToClipboard()
-{
-    return String("Copy Video Link Location");
-}
-
-String contextMenuItemTagCopyAudioLinkToClipboard()
-{
-    return String("Copy Audio Link Location");
-}
-
-String contextMenuItemTagToggleMediaControls()
-{
-    return String("Toggle Media Controls");
-}
-
-String contextMenuItemTagToggleMediaLoop()
-{
-    return String("Toggle Media Loop Playback");
-}
-
-String contextMenuItemTagEnterVideoFullscreen()
-{
-    return String("Switch Video to Fullscreen");
-}
-
-String contextMenuItemTagMediaPlay()
-{
-    return String("Play");
-}
-
-String contextMenuItemTagMediaPause()
-{
-    return String("Pause");
-}
-
-String contextMenuItemTagMediaMute()
-{
-    return String("Mute");
-}
-
-String contextMenuItemTagOpenFrameInNewWindow() 
-{ 
-    return String("Open Frame in New Window"); 
-}
-
-String contextMenuItemTagCopy() 
-{
-    return String("Copy");
-}
-
-String contextMenuItemTagGoBack() 
-{
-    return String("Go Back");
-}
-
-String contextMenuItemTagGoForward() 
-{
-    return String("Go Forward");
-}
-
-String contextMenuItemTagStop() 
-{
-    return String("Stop");
-}
-
-String contextMenuItemTagReload() 
-{
-    return String("Reload");
-}
-
-String contextMenuItemTagCut() 
-{
-    return String("Cut");
-}
-
-String contextMenuItemTagPaste() 
-{
-    return String("Paste");
-}
-
-String contextMenuItemTagNoGuessesFound() 
-{
-    return String("No Guesses Found");
-}
-
-String contextMenuItemTagIgnoreSpelling() 
-{
-    return String("Ignore Spelling");
-}
-
-String contextMenuItemTagLearnSpelling() 
-{
-    return String("Learn Spelling");
-}
-
-String contextMenuItemTagSearchWeb() 
-{
-    return String("Search Web");
-}
-
-String contextMenuItemTagLookUpInDictionary(const String&)
-{
-    return String("Look Up in Dictionary");
-}
-
-String contextMenuItemTagOpenLink() 
-{
-    return String("Open Link");
-}
-
-String contextMenuItemTagIgnoreGrammar() 
-{
-    return String("Ignore Grammar");
-}
-
-String contextMenuItemTagSpellingMenu() 
-{
-    return String("Spelling");
-}
-
-String contextMenuItemTagShowSpellingPanel(bool show) 
-{
-    return String("Show Spelling Panel");
-}
-
-String contextMenuItemTagCheckSpelling() 
-{
-    return String("Check Spelling");
-}
-
-String contextMenuItemTagCheckSpellingWhileTyping() 
-{
-    return String("Check Spelling While Typing");
-}
-
-String contextMenuItemTagCheckGrammarWithSpelling() 
-{
-    return String("Check Grammar with Spelling");
-}
-
-String contextMenuItemTagFontMenu() 
-{
-    return String("Font");
-}
-
-String contextMenuItemTagBold() 
+String localizedString(const char* key)
 {
-    return String("Bold");
+    return String::fromUTF8(key, strlen(key));
 }
 
-String contextMenuItemTagItalic() 
-{
-    return String("Italic");
-}
-
-String contextMenuItemTagUnderline() 
-{
-    return String("Underline");
-}
-
-String contextMenuItemTagOutline() 
-{
-    return String("Outline");
-}
-
-String contextMenuItemTagWritingDirectionMenu() 
-{
-    return String("Writing Direction");
-}
-
-String contextMenuItemTagTextDirectionMenu()
-{
-    return String("Text Direction");
-}
-
-String contextMenuItemTagDefaultDirection() 
-{
-    return String("Default Direction");
 }
-
-String contextMenuItemTagLeftToRight() 
-{
-    return String("Left to Right");
-}
-
-String contextMenuItemTagRightToLeft() 
-{
-    return String("Right to Left");
-}
-
-String searchMenuNoRecentSearchesText() 
-{
-    return String("No recent searches");
-}
-
-String searchMenuRecentSearchesText() 
-{
-    return String("Recent searches");
-}
-
-String searchMenuClearRecentSearchesText() 
-{
-    return String("Clear recent searches");
-}
-
-String contextMenuItemTagInspectElement() 
-{
-    return String("Inspect Element");
-}
-
-String multipleFileUploadText(unsigned numberOfFiles)
-{
-    // FIXME: If this file gets localized, this should really be localized as one string with a wildcard for the number.
-    return String::number(numberOfFiles) + String(" files");
-}
-
-String unknownFileSizeText() 
-{
-    return String("Unknown");
-}
-
-String imageTitle(const String& filename, const IntSize& size)
-{
-    return String();
-}
-
-// accessibility related strings
-String AXButtonActionVerb()
-{
-    return String();
-}
-
-String AXRadioButtonActionVerb()
-{
-    return String();
-}
-
-String AXTextFieldActionVerb()
-{
-    return String();
-}
-
-String AXCheckedCheckBoxActionVerb()
-{
-    return String();
-}
-
-String AXUncheckedCheckBoxActionVerb()
-{
-    return String();
-}
-
-String AXLinkActionVerb()
-{
-    return String();
-}
-
-String AXDefinitionListTermText()
-{
-    return String();
-}
-
-String AXDefinitionListDefinitionText()
-{
-    return String();
-}
-
-String AXMenuListPopupActionVerb()
-{
-    return String();
-}
-
-String AXMenuListActionVerb()
-{
-    return String();
-}
-
-String validationMessageValueMissingText()
-{
-    notImplemented();
-    return String();
-}
-
-String validationMessageValueMissingForCheckboxText()
-{
-    notImplemented();
-    return validationMessageValueMissingText();
-}
-
-String validationMessageValueMissingForFileText()
-{
-    notImplemented();
-    return validationMessageValueMissingText();
-}
-
-String validationMessageValueMissingForMultipleFileText()
-{
-    notImplemented();
-    return validationMessageValueMissingText();
-}
-
-String validationMessageValueMissingForRadioText()
-{
-    notImplemented();
-    return validationMessageValueMissingText();
-}
-
-String validationMessageValueMissingForSelectText()
-{
-    notImplemented();
-    return validationMessageValueMissingText();
-}
-
-String validationMessageTypeMismatchText()
-{
-    notImplemented();
-    return String();
-}
-
-String validationMessageTypeMismatchForEmailText()
-{
-    notImplemented();
-    return validationMessageTypeMismatchText();
-}
-
-String validationMessageTypeMismatchForMultipleEmailText()
-{
-    notImplemented();
-    return validationMessageTypeMismatchText();
-}
-
-String validationMessageTypeMismatchForURLText()
-{
-    notImplemented();
-    return validationMessageTypeMismatchText();
-}
-
-String validationMessagePatternMismatchText()
-{
-    notImplemented();
-    return String();
-}
-
-String validationMessageTooLongText(int, int)
-{
-    notImplemented();
-    return String();
-}
-
-String validationMessageRangeUnderflowText(const String&)
-{
-    notImplemented();
-    return String();
-}
-
-String validationMessageRangeOverflowText(const String&)
-{
-    notImplemented();
-    return String();
-}
-
-String validationMessageStepMismatchText(const String&, const String&)
-{
-    notImplemented();
-    return String();
-}
-
-String missingPluginText()
-{
-    notImplemented();
-    return String("Missing Plug-in");
-}
-
-String crashedPluginText()
-{
-    notImplemented();
-    return String("Plug-in Failure");
-}
-
-} // namespace WebCore
diff --git a/Source/WebCore/plugins/DOMMimeType.idl b/Source/WebCore/plugins/DOMMimeType.idl
index 1d97a6b61..942060f10 100644
--- a/Source/WebCore/plugins/DOMMimeType.idl
+++ b/Source/WebCore/plugins/DOMMimeType.idl
@@ -20,7 +20,9 @@
 
 module window {
 
-    interface DOMMimeType {
+    interface [
+        InterfaceName=MimeType
+    ] DOMMimeType {
         readonly attribute DOMString type;
         readonly attribute DOMString suffixes;
         readonly attribute DOMString description;
diff --git a/Source/WebCore/plugins/DOMMimeTypeArray.idl b/Source/WebCore/plugins/DOMMimeTypeArray.idl
index 3e2eff2de..3de7f8d6d 100644
--- a/Source/WebCore/plugins/DOMMimeTypeArray.idl
+++ b/Source/WebCore/plugins/DOMMimeTypeArray.idl
@@ -23,11 +23,12 @@ module window {
     interface [
         JSGenerateIsReachable=ImplFrame,
         NamedGetter,
-        IndexedGetter
+        IndexedGetter,
+        InterfaceName=MimeTypeArray
     ] DOMMimeTypeArray {
         readonly attribute unsigned long length;
-        DOMMimeType item(in [Optional=CallWithDefaultValue] unsigned long index);
-        DOMMimeType namedItem(in [Optional=CallWithDefaultValue] DOMString name);
+        DOMMimeType item(in [Optional=DefaultIsUndefined] unsigned long index);
+        DOMMimeType namedItem(in [Optional=DefaultIsUndefined] DOMString name);
     };
 
 }
diff --git a/Source/WebCore/plugins/DOMPlugin.idl b/Source/WebCore/plugins/DOMPlugin.idl
index bf3542d0c..f645a0b6e 100644
--- a/Source/WebCore/plugins/DOMPlugin.idl
+++ b/Source/WebCore/plugins/DOMPlugin.idl
@@ -22,14 +22,15 @@ module window {
 
     interface [
         NamedGetter,
-        IndexedGetter
+        IndexedGetter,
+        InterfaceName=Plugin
     ] DOMPlugin {
         readonly attribute DOMString name;
         readonly attribute DOMString filename;
         readonly attribute DOMString description;
         readonly attribute unsigned long length;
-        DOMMimeType item(in [Optional=CallWithDefaultValue] unsigned long index);
-        DOMMimeType namedItem(in [Optional=CallWithDefaultValue] DOMString name);
+        DOMMimeType item(in [Optional=DefaultIsUndefined] unsigned long index);
+        DOMMimeType namedItem(in [Optional=DefaultIsUndefined] DOMString name);
     };
 
 }
diff --git a/Source/WebCore/plugins/DOMPluginArray.idl b/Source/WebCore/plugins/DOMPluginArray.idl
index 32aa34263..f042f924c 100644
--- a/Source/WebCore/plugins/DOMPluginArray.idl
+++ b/Source/WebCore/plugins/DOMPluginArray.idl
@@ -23,12 +23,13 @@ module window {
     interface [
         JSGenerateIsReachable=ImplFrame,
         NamedGetter,
-        IndexedGetter
+        IndexedGetter,
+        InterfaceName=PluginArray
     ] DOMPluginArray {
         readonly attribute unsigned long length;
-        DOMPlugin item(in [Optional=CallWithDefaultValue] unsigned long index);
-        DOMPlugin namedItem(in [Optional=CallWithDefaultValue] DOMString name);
-        void refresh(in [Optional=CallWithDefaultValue] boolean reload);
+        DOMPlugin item(in [Optional=DefaultIsUndefined] unsigned long index);
+        DOMPlugin namedItem(in [Optional=DefaultIsUndefined] DOMString name);
+        void refresh(in [Optional=DefaultIsUndefined] boolean reload);
     };
 
 }
diff --git a/Source/WebCore/plugins/PluginView.h b/Source/WebCore/plugins/PluginView.h
index cb3ee42ca..1128522d0 100644
--- a/Source/WebCore/plugins/PluginView.h
+++ b/Source/WebCore/plugins/PluginView.h
@@ -61,7 +61,6 @@ typedef PlatformWidget PlatformPluginWidget;
 #include "TextureMapperPlatformLayer.h"
 #endif
 
-#include <QGraphicsItem>
 #include <QImage>
 QT_BEGIN_NAMESPACE
 class QPainter;
diff --git a/Source/WebCore/plugins/blackberry/PluginViewPrivateBlackBerry.h b/Source/WebCore/plugins/blackberry/PluginViewPrivateBlackBerry.h
index 0beedd566..3f2878fdf 100644
--- a/Source/WebCore/plugins/blackberry/PluginViewPrivateBlackBerry.h
+++ b/Source/WebCore/plugins/blackberry/PluginViewPrivateBlackBerry.h
@@ -20,6 +20,9 @@
 #define PluginViewPrivateBlackBerry_h
 
 #include "PluginView.h"
+
+#include <BlackBerryPlatformGraphics.h>
+#include <BlackBerryPlatformIntRectRegion.h>
 #include <pthread.h>
 
 #define PLUGIN_BUFFERS 2
diff --git a/Source/WebCore/plugins/efl/PluginPackageEfl.cpp b/Source/WebCore/plugins/efl/PluginPackageEfl.cpp
index a6016d9e7..7b950d30a 100644
--- a/Source/WebCore/plugins/efl/PluginPackageEfl.cpp
+++ b/Source/WebCore/plugins/efl/PluginPackageEfl.cpp
@@ -69,16 +69,16 @@ bool PluginPackage::fetchInfo()
     NPError err = getValue(0, NPPVpluginNameString, static_cast<void*>(&buffer));
     if (err != NPERR_NO_ERROR)
         return false;
-    m_name = buffer;
+    m_name = String::fromUTF8(buffer);
 
     buffer = 0;
     err = getValue(0, NPPVpluginDescriptionString, static_cast<void*>(&buffer));
     if (err != NPERR_NO_ERROR)
         return false;
-    m_description = buffer;
+    m_description = String::fromUTF8(buffer);
     determineModuleVersionFromDescription();
 
-    String description = getMIMEDescription();
+    String description = String::fromUTF8(getMIMEDescription());
 
     Vector<String> types;
     description.split(UChar(';'), false, types);
diff --git a/Source/WebCore/plugins/gtk/PluginPackageGtk.cpp b/Source/WebCore/plugins/gtk/PluginPackageGtk.cpp
index 21d3c9ede..93abd320a 100644
--- a/Source/WebCore/plugins/gtk/PluginPackageGtk.cpp
+++ b/Source/WebCore/plugins/gtk/PluginPackageGtk.cpp
@@ -58,12 +58,12 @@ bool PluginPackage::fetchInfo()
     char* buffer = 0;
     NPError err = NPP_GetValue(0, NPPVpluginNameString, &buffer);
     if (err == NPERR_NO_ERROR)
-        m_name = buffer;
+        m_name = String::fromUTF8(buffer);
 
     buffer = 0;
     err = NPP_GetValue(0, NPPVpluginDescriptionString, &buffer);
     if (err == NPERR_NO_ERROR) {
-        m_description = buffer;
+        m_description = String::fromUTF8(buffer);
         determineModuleVersionFromDescription();
     }
 
diff --git a/Source/WebCore/plugins/gtk/PluginViewGtk.cpp b/Source/WebCore/plugins/gtk/PluginViewGtk.cpp
index abf4f196c..3ef203f54 100644
--- a/Source/WebCore/plugins/gtk/PluginViewGtk.cpp
+++ b/Source/WebCore/plugins/gtk/PluginViewGtk.cpp
@@ -165,6 +165,8 @@ void PluginView::updatePluginWidget()
 void PluginView::setFocus(bool focused)
 {
     ASSERT(platformPluginWidget() == platformWidget());
+    if (focused && platformWidget())
+        gtk_widget_grab_focus(platformWidget());
     Widget::setFocus(focused);
 }
 
diff --git a/Source/WebCore/plugins/mac/PluginViewMac.mm b/Source/WebCore/plugins/mac/PluginViewMac.mm
index 94fc8e628..901a359b5 100644
--- a/Source/WebCore/plugins/mac/PluginViewMac.mm
+++ b/Source/WebCore/plugins/mac/PluginViewMac.mm
@@ -104,7 +104,7 @@ static inline WindowRef nativeWindowFor(PlatformWidget widget)
 #if PLATFORM(QT)
     if (widget)
 #if QT_MAC_USE_COCOA
-        return static_cast<WindowRef>([qt_mac_window_for(widget) windowRef]);
+        return static_cast<WindowRef>([qt_mac_window_for(static_cast<QWidget*>(widget)) windowRef]);
 #else
         return static_cast<WindowRef>(qt_mac_window_for(widget));
 #endif
@@ -119,7 +119,7 @@ static inline CGContextRef cgHandleFor(PlatformWidget widget)
 {
 #if PLATFORM(QT)
     if (widget)
-        return (CGContextRef)widget->macCGHandle();
+        return (CGContextRef)static_cast<QWidget*>(widget)->macCGHandle();
 #endif
 #if PLATFORM(WX)
     if (widget)
@@ -132,8 +132,8 @@ static inline IntPoint topLevelOffsetFor(PlatformWidget widget)
 {
 #if PLATFORM(QT)
     if (widget) {
-        PlatformWidget topLevel = widget->window();
-        return widget->mapTo(topLevel, QPoint(0, 0)) + topLevel->geometry().topLeft() - topLevel->pos();
+        QWidget* topLevel = static_cast<QWidget*>(widget)->window();
+        return static_cast<QWidget*>(widget)->mapTo(topLevel, QPoint(0, 0)) + topLevel->geometry().topLeft() - topLevel->pos();
     }
 #endif
 #if PLATFORM(WX)
@@ -348,7 +348,7 @@ void PluginView::setFocus(bool focused)
 
     if (platformPluginWidget())
 #if PLATFORM(QT)
-       platformPluginWidget()->setFocus(Qt::OtherFocusReason);
+       static_cast<QWidget*>(platformPluginWidget())->setFocus(Qt::OtherFocusReason);
 #else
         platformPluginWidget()->SetFocus();
 #endif
@@ -535,7 +535,7 @@ void PluginView::invalidateRect(const IntRect& rect)
 {
     if (platformPluginWidget())
 #if PLATFORM(QT)
-        platformPluginWidget()->update(convertToContainingWindow(rect));
+        static_cast<QWidget*>(platformPluginWidget())->update(convertToContainingWindow(rect));
 #else
         platformPluginWidget()->RefreshRect(convertToContainingWindow(rect));
 #endif
diff --git a/Source/WebCore/plugins/qt/PluginPackageQt.cpp b/Source/WebCore/plugins/qt/PluginPackageQt.cpp
index 72d83c4f7..4e9a717b8 100644
--- a/Source/WebCore/plugins/qt/PluginPackageQt.cpp
+++ b/Source/WebCore/plugins/qt/PluginPackageQt.cpp
@@ -51,16 +51,15 @@ bool PluginPackage::fetchInfo()
     if (err != NPERR_NO_ERROR)
         return false;
 
-    m_name = buf;
+    m_name = String::fromUTF8(buf);
     err = gv(0, NPPVpluginDescriptionString, (void*) &buf);
     if (err != NPERR_NO_ERROR)
         return false;
 
-    m_description = buf;
+    m_description = String::fromUTF8(buf);
     determineModuleVersionFromDescription();
 
-    String mimeDescription = gm();
-    setMIMEDescription(mimeDescription);
+    setMIMEDescription(String::fromUTF8(gm()));
     m_infoIsFromCache = false;
 
     return true;
diff --git a/Source/WebCore/plugins/qt/PluginViewQt.cpp b/Source/WebCore/plugins/qt/PluginViewQt.cpp
index e2c55cfef..ff912db56 100644
--- a/Source/WebCore/plugins/qt/PluginViewQt.cpp
+++ b/Source/WebCore/plugins/qt/PluginViewQt.cpp
@@ -189,7 +189,7 @@ void PluginView::setFocus(bool focused)
 {
     if (platformPluginWidget()) {
         if (focused)
-            platformPluginWidget()->setFocus(Qt::OtherFocusReason);
+            static_cast<QWidget*>(platformPluginWidget())->setFocus(Qt::OtherFocusReason);
     } else {
         Widget::setFocus(focused);
     }
@@ -572,7 +572,8 @@ void PluginView::setNPWindowIfNeeded()
     m_hasPendingGeometryChange = false;
 
     if (m_isWindowed) {
-        platformPluginWidget()->setGeometry(m_windowRect);
+        QWidget* widget = static_cast<QWidget*>(platformPluginWidget());
+        widget->setGeometry(m_windowRect);
 
         // Cut out areas of the plugin occluded by iframe shims
         Vector<IntRect> cutOutRects;
@@ -584,8 +585,8 @@ void PluginView::setNPWindowIfNeeded()
         }
         // if setMask is set with an empty QRegion, no clipping will
         // be performed, so in that case we hide the plugin view
-        platformPluginWidget()->setVisible(!clipRegion.isEmpty());
-        platformPluginWidget()->setMask(clipRegion);
+        widget->setVisible(!clipRegion.isEmpty());
+        widget->setMask(clipRegion);
 
         m_npWindow.x = m_windowRect.x();
         m_npWindow.y = m_windowRect.y();
@@ -639,7 +640,7 @@ void PluginView::setParentVisible(bool visible)
     Widget::setParentVisible(visible);
 
     if (isSelfVisible() && platformPluginWidget())
-        platformPluginWidget()->setVisible(visible);
+        static_cast<QWidget*>(platformPluginWidget())->setVisible(visible);
 }
 
 NPError PluginView::handlePostReadFile(Vector<char>& buffer, uint32_t len, const char* buf)
@@ -742,8 +743,9 @@ void PluginView::invalidateRect(const IntRect& rect)
         if (platformWidget()) {
             // update() will schedule a repaint of the widget so ensure
             // its knowledge of its position on the page is up to date.
-            platformWidget()->setGeometry(m_windowRect);
-            platformWidget()->update(rect);
+            QWidget* w = static_cast<QWidget*>(platformWidget());
+            w->setGeometry(m_windowRect);
+            w->update(rect);
         }
         return;
     }
@@ -892,7 +894,7 @@ bool PluginView::platformStart()
     wsi->type = 0;
 
     if (m_isWindowed) {
-        const QX11Info* x11Info = &platformPluginWidget()->x11Info();
+        const QX11Info* x11Info = &static_cast<QWidget*>(platformPluginWidget())->x11Info();
 
         wsi->display = x11Info->display();
         wsi->visual = (Visual*)x11Info->visual();
@@ -900,7 +902,7 @@ bool PluginView::platformStart()
         wsi->colormap = x11Info->colormap();
 
         m_npWindow.type = NPWindowTypeWindow;
-        m_npWindow.window = (void*)platformPluginWidget()->winId();
+        m_npWindow.window = (void*)static_cast<QWidget*>(platformPluginWidget())->winId();
         m_npWindow.width = -1;
         m_npWindow.height = -1;
     } else {
diff --git a/Source/WebCore/rendering/FilterEffectRenderer.cpp b/Source/WebCore/rendering/FilterEffectRenderer.cpp
index cb20bc4bd..7d9873151 100644
--- a/Source/WebCore/rendering/FilterEffectRenderer.cpp
+++ b/Source/WebCore/rendering/FilterEffectRenderer.cpp
@@ -326,7 +326,8 @@ void FilterEffectRenderer::prepare()
         m_graphicsBufferAttached = true;
     }
     m_sourceGraphic->clearResult();
-    lastEffect()->clearResult();
+    for (size_t i = 0; i < m_effects.size(); ++i)
+        m_effects[i]->clearResult();
 }
 
 void FilterEffectRenderer::apply()
diff --git a/Source/WebCore/rendering/InlineFlowBox.cpp b/Source/WebCore/rendering/InlineFlowBox.cpp
index fb93b62c2..f799a1ae1 100644
--- a/Source/WebCore/rendering/InlineFlowBox.cpp
+++ b/Source/WebCore/rendering/InlineFlowBox.cpp
@@ -657,8 +657,8 @@ void InlineFlowBox::placeBoxesInBlockDirection(LayoutUnit top, LayoutUnit maxHei
 
                 RenderRubyRun* rubyRun = toRenderRubyRun(curr->renderer());
                 if (RenderRubyBase* rubyBase = rubyRun->rubyBase()) {
-                    LayoutUnit bottomRubyBaseLeading = (curr->logicalHeight() - rubyBase->logicalBottom()) + rubyBase->logicalHeight() - (rubyBase->lastRootBox() ? rubyBase->lastRootBox()->lineBottom() : 0);
-                    LayoutUnit topRubyBaseLeading = rubyBase->logicalTop() + (rubyBase->firstRootBox() ? rubyBase->firstRootBox()->lineTop() : 0);
+                    LayoutUnit bottomRubyBaseLeading = (curr->logicalHeight() - rubyBase->logicalBottom()) + rubyBase->logicalHeight() - (rubyBase->lastRootBox() ? rubyBase->lastRootBox()->lineBottom() : zeroLayoutUnit);
+                    LayoutUnit topRubyBaseLeading = rubyBase->logicalTop() + (rubyBase->firstRootBox() ? rubyBase->firstRootBox()->lineTop() : zeroLayoutUnit);
                     newLogicalTop += !renderer()->style()->isFlippedLinesWritingMode() ? topRubyBaseLeading : bottomRubyBaseLeading;
                     boxHeight -= (topRubyBaseLeading + bottomRubyBaseLeading);
                 }
@@ -787,8 +787,8 @@ inline void InlineFlowBox::addBorderOutsetVisualOverflow(LayoutRect& logicalVisu
     LayoutUnit borderOutsetLogicalRight;
     style->getBorderImageInlineDirectionOutsets(borderOutsetLogicalLeft, borderOutsetLogicalRight);
 
-    LayoutUnit outsetLogicalLeft = includeLogicalLeftEdge() ? borderOutsetLogicalLeft : 0;
-    LayoutUnit outsetLogicalRight = includeLogicalRightEdge() ? borderOutsetLogicalRight : 0;
+    LayoutUnit outsetLogicalLeft = includeLogicalLeftEdge() ? borderOutsetLogicalLeft : zeroLayoutUnit;
+    LayoutUnit outsetLogicalRight = includeLogicalRightEdge() ? borderOutsetLogicalRight : zeroLayoutUnit;
 
     LayoutUnit logicalLeftVisualOverflow = min(pixelSnappedLogicalLeft() - outsetLogicalLeft, logicalVisualOverflow.x());
     LayoutUnit logicalRightVisualOverflow = max(pixelSnappedLogicalRight() + outsetLogicalRight, logicalVisualOverflow.maxX());
@@ -1008,7 +1008,7 @@ void InlineFlowBox::paint(PaintInfo& paintInfo, const LayoutPoint& paintOffset,
     flipForWritingMode(overflowRect);
     overflowRect.moveBy(paintOffset);
     
-    if (!paintInfo.rect.intersects(overflowRect))
+    if (!paintInfo.rect.intersects(pixelSnappedIntRect(overflowRect)))
         return;
 
     if (paintInfo.phase != PaintPhaseChildOutlines) {
@@ -1079,6 +1079,15 @@ void InlineFlowBox::paintFillLayers(const PaintInfo& paintInfo, const Color& c,
     paintFillLayer(paintInfo, c, fillLayer, rect, op);
 }
 
+bool InlineFlowBox::boxShadowCanBeAppliedToBackground(const FillLayer& lastBackgroundLayer) const
+{
+    // The checks here match how paintFillLayer() decides whether to clip (if it does, the shadow
+    // would be clipped out, so it has to be drawn separately).
+    StyleImage* image = lastBackgroundLayer.image();
+    bool hasFillImage = image && image->canRender(renderer(), renderer()->style()->effectiveZoom());
+    return (!hasFillImage && !renderer()->style()->hasBorderRadius()) || (!prevLineBox() && !nextLineBox()) || !parent();
+}
+
 void InlineFlowBox::paintFillLayer(const PaintInfo& paintInfo, const Color& c, const FillLayer* fillLayer, const LayoutRect& rect, CompositeOperator op)
 {
     StyleImage* img = fillLayer->image();
@@ -1107,8 +1116,8 @@ void InlineFlowBox::paintFillLayer(const PaintInfo& paintInfo, const Color& c, c
             for (InlineFlowBox* curr = this; curr; curr = curr->prevLineBox())
                 totalLogicalWidth += curr->logicalWidth();
         }
-        LayoutUnit stripX = rect.x() - (isHorizontal() ? logicalOffsetOnLine : 0);
-        LayoutUnit stripY = rect.y() - (isHorizontal() ? 0 : logicalOffsetOnLine);
+        LayoutUnit stripX = rect.x() - (isHorizontal() ? logicalOffsetOnLine : zeroLayoutUnit);
+        LayoutUnit stripY = rect.y() - (isHorizontal() ? zeroLayoutUnit : logicalOffsetOnLine);
         LayoutUnit stripWidth = isHorizontal() ? totalLogicalWidth : width();
         LayoutUnit stripHeight = isHorizontal() ? height() : totalLogicalWidth;
 
@@ -1203,7 +1212,8 @@ void InlineFlowBox::paintBoxDecorations(PaintInfo& paintInfo, const LayoutPoint&
     if ((!parent() && m_firstLine && styleToUse != renderer()->style()) || (parent() && renderer()->hasBoxDecorations())) {
         LayoutRect paintRect = LayoutRect(adjustedPaintoffset, frameRect.size());
         // Shadow comes first and is behind the background and border.
-        paintBoxShadow(paintInfo, styleToUse, Normal, paintRect);
+        if (!boxModelObject()->boxShadowShouldBeAppliedToBackground(BackgroundBleedNone, this))
+            paintBoxShadow(paintInfo, styleToUse, Normal, paintRect);
 
         Color c = styleToUse->visitedDependentColor(CSSPropertyBackgroundColor);
         paintFillLayers(paintInfo, c, styleToUse->backgroundLayers(), paintRect);
@@ -1237,8 +1247,8 @@ void InlineFlowBox::paintBoxDecorations(PaintInfo& paintInfo, const LayoutPoint&
                 LayoutUnit totalLogicalWidth = logicalOffsetOnLine;
                 for (InlineFlowBox* curr = this; curr; curr = curr->nextLineBox())
                     totalLogicalWidth += curr->logicalWidth();
-                LayoutUnit stripX = adjustedPaintoffset.x() - (isHorizontal() ? logicalOffsetOnLine : 0);
-                LayoutUnit stripY = adjustedPaintoffset.y() - (isHorizontal() ? 0 : logicalOffsetOnLine);
+                LayoutUnit stripX = adjustedPaintoffset.x() - (isHorizontal() ? logicalOffsetOnLine : zeroLayoutUnit);
+                LayoutUnit stripY = adjustedPaintoffset.y() - (isHorizontal() ? zeroLayoutUnit : logicalOffsetOnLine);
                 LayoutUnit stripWidth = isHorizontal() ? totalLogicalWidth : frameRect.width();
                 LayoutUnit stripHeight = isHorizontal() ? frameRect.height() : totalLogicalWidth;
 
@@ -1308,8 +1318,8 @@ void InlineFlowBox::paintMask(PaintInfo& paintInfo, const LayoutPoint& paintOffs
         LayoutUnit totalLogicalWidth = logicalOffsetOnLine;
         for (InlineFlowBox* curr = this; curr; curr = curr->nextLineBox())
             totalLogicalWidth += curr->logicalWidth();
-        LayoutUnit stripX = adjustedPaintOffset.x() - (isHorizontal() ? logicalOffsetOnLine : 0);
-        LayoutUnit stripY = adjustedPaintOffset.y() - (isHorizontal() ? 0 : logicalOffsetOnLine);
+        LayoutUnit stripX = adjustedPaintOffset.x() - (isHorizontal() ? logicalOffsetOnLine : zeroLayoutUnit);
+        LayoutUnit stripY = adjustedPaintOffset.y() - (isHorizontal() ? zeroLayoutUnit : logicalOffsetOnLine);
         LayoutUnit stripWidth = isHorizontal() ? totalLogicalWidth : frameRect.width();
         LayoutUnit stripHeight = isHorizontal() ? frameRect.height() : totalLogicalWidth;
 
@@ -1406,7 +1416,7 @@ LayoutUnit InlineFlowBox::computeOverAnnotationAdjustment(LayoutUnit allowedPosi
                 continue;
             
             if (!rubyRun->style()->isFlippedLinesWritingMode()) {
-                LayoutUnit topOfFirstRubyTextLine = rubyText->logicalTop() + (rubyText->firstRootBox() ? rubyText->firstRootBox()->lineTop() : 0);
+                LayoutUnit topOfFirstRubyTextLine = rubyText->logicalTop() + (rubyText->firstRootBox() ? rubyText->firstRootBox()->lineTop() : zeroLayoutUnit);
                 if (topOfFirstRubyTextLine >= 0)
                     continue;
                 topOfFirstRubyTextLine += curr->logicalTop();
diff --git a/Source/WebCore/rendering/InlineFlowBox.h b/Source/WebCore/rendering/InlineFlowBox.h
index 2ea5c47ba..500de7ed9 100644
--- a/Source/WebCore/rendering/InlineFlowBox.h
+++ b/Source/WebCore/rendering/InlineFlowBox.h
@@ -114,6 +114,8 @@ public:
     virtual void paint(PaintInfo&, const LayoutPoint&, LayoutUnit lineTop, LayoutUnit lineBottom);
     virtual bool nodeAtPoint(const HitTestRequest&, HitTestResult&, const LayoutPoint& pointInContainer, const LayoutPoint& accumulatedOffset, LayoutUnit lineTop, LayoutUnit lineBottom);
 
+    bool boxShadowCanBeAppliedToBackground(const FillLayer&) const;
+
     virtual RenderLineBoxList* rendererLineBoxes() const;
 
     // logicalLeft = left in a horizontal line and top in a vertical line.
diff --git a/Source/WebCore/rendering/LayoutState.cpp b/Source/WebCore/rendering/LayoutState.cpp
index c9018c599..e89dcc5db 100644
--- a/Source/WebCore/rendering/LayoutState.cpp
+++ b/Source/WebCore/rendering/LayoutState.cpp
@@ -79,7 +79,7 @@ LayoutState::LayoutState(LayoutState* prev, RenderBox* renderer, const LayoutSiz
             m_clipped = true;
         }
 
-        m_paintOffset -= layer->scrolledContentOffset();
+        m_paintOffset -= renderer->scrolledContentOffset();
     }
 
     // If we establish a new page height, then cache the offset to the top of the first page.
@@ -156,10 +156,11 @@ LayoutState::LayoutState(RenderObject* root)
     m_paintOffset = LayoutSize(absContentPoint.x(), absContentPoint.y());
 
     if (container->hasOverflowClip()) {
-        RenderLayer* layer = toRenderBoxModelObject(container)->layer();
+        RenderBox* containerBox = toRenderBox(container);
+        RenderLayer* layer = containerBox->layer();
         m_clipped = true;
         m_clipRect = LayoutRect(toPoint(m_paintOffset), layer->size());
-        m_paintOffset -= layer->scrolledContentOffset();
+        m_paintOffset -= containerBox->scrolledContentOffset();
     }
 }
 
diff --git a/Source/WebCore/rendering/LayoutTypes.h b/Source/WebCore/rendering/LayoutTypes.h
index fc765d11f..72cbf2fd9 100644
--- a/Source/WebCore/rendering/LayoutTypes.h
+++ b/Source/WebCore/rendering/LayoutTypes.h
@@ -46,16 +46,38 @@ typedef IntPoint LayoutPoint;
 typedef IntSize LayoutSize;
 typedef IntRect LayoutRect;
 
+const LayoutUnit zeroLayoutUnit = 0;
+
 inline LayoutRect enclosingLayoutRect(const FloatRect& rect)
 {
     return enclosingIntRect(rect);
 }
 
+inline IntRect pixelSnappedIntRect(const LayoutRect& rect)
+{
+    return rect;
+}
+
+inline IntRect pixelSnappedIntRectFromEdges(LayoutUnit left, LayoutUnit top, LayoutUnit right, LayoutUnit bottom)
+{
+    return IntRect(left, top, right - left, bottom - top);
+}
+
+inline IntSize roundedIntSize(const LayoutSize& s)
+{
+    return s;
+}
+
 inline LayoutSize roundedLayoutSize(const FloatSize& s)
 {
     return roundedIntSize(s);
 }
 
+inline IntPoint roundedIntPoint(const LayoutPoint& p)
+{
+    return p;
+}
+
 inline LayoutPoint roundedLayoutPoint(const FloatPoint& p)
 {
     return roundedIntPoint(p);
diff --git a/Source/WebCore/rendering/RenderBlock.cpp b/Source/WebCore/rendering/RenderBlock.cpp
index 9b2bca5a9..413c60ece 100755
--- a/Source/WebCore/rendering/RenderBlock.cpp
+++ b/Source/WebCore/rendering/RenderBlock.cpp
@@ -114,8 +114,8 @@ RenderBlock::MarginInfo::MarginInfo(RenderBlock* block, LayoutUnit beforeBorderP
     m_quirkContainer = block->isTableCell() || block->isBody() || blockStyle->marginBeforeCollapse() == MDISCARD
         || blockStyle->marginAfterCollapse() == MDISCARD;
 
-    m_positiveMargin = m_canCollapseMarginBeforeWithChildren ? block->maxPositiveMarginBefore() : 0;
-    m_negativeMargin = m_canCollapseMarginBeforeWithChildren ? block->maxNegativeMarginBefore() : 0;
+    m_positiveMargin = m_canCollapseMarginBeforeWithChildren ? block->maxPositiveMarginBefore() : zeroLayoutUnit;
+    m_negativeMargin = m_canCollapseMarginBeforeWithChildren ? block->maxNegativeMarginBefore() : zeroLayoutUnit;
 }
 
 // -------------------------------------------------------------------------------------------------------
@@ -429,14 +429,24 @@ void RenderBlock::addChildToAnonymousColumnBlocks(RenderObject* newChild, Render
 
 RenderBlock* RenderBlock::containingColumnsBlock(bool allowAnonymousColumnBlock)
 {
+    RenderBlock* firstChildIgnoringAnonymousWrappers = 0;
     for (RenderObject* curr = this; curr; curr = curr->parent()) {
         if (!curr->isRenderBlock() || curr->isFloatingOrPositioned() || curr->isTableCell() || curr->isRoot() || curr->isRenderView() || curr->hasOverflowClip()
             || curr->isInlineBlockOrInlineTable())
             return 0;
+
+        // FIXME: Table manages its own table parts, most of which are RenderBoxes.
+        // Multi-column code cannot handle splitting the flow in table. Disabling it
+        // to prevent crashes.
+        if (curr->isTable())
+            return 0;
         
         RenderBlock* currBlock = toRenderBlock(curr);
+        if (!currBlock->createsAnonymousWrapper())
+            firstChildIgnoringAnonymousWrappers = currBlock;
+
         if (currBlock->style()->specifiesColumns() && (allowAnonymousColumnBlock || !currBlock->isAnonymousColumnsBlock()))
-            return currBlock;
+            return firstChildIgnoringAnonymousWrappers;
             
         if (currBlock->isAnonymousColumnSpanBlock())
             return 0;
@@ -447,15 +457,20 @@ RenderBlock* RenderBlock::containingColumnsBlock(bool allowAnonymousColumnBlock)
 RenderBlock* RenderBlock::clone() const
 {
     RenderBlock* cloneBlock;
-    if (isAnonymousBlock())
+    if (isAnonymousBlock()) {
         cloneBlock = createAnonymousBlock();
+        cloneBlock->setChildrenInline(childrenInline());
+    }
     else {
-        cloneBlock = new (renderArena()) RenderBlock(node());
+        RenderObject* cloneRenderer = node()->createRenderer(renderArena(), style());
+        cloneBlock = toRenderBlock(cloneRenderer);
         cloneBlock->setStyle(style());
-        if (!childrenInline() && cloneBlock->firstChild() && cloneBlock->firstChild()->isInline())
-            cloneBlock->makeChildrenNonInline();
+
+        // This takes care of setting the right value of childrenInline in case
+        // generated content is added to cloneBlock and 'this' does not have
+        // generated content added yet.
+        cloneBlock->setChildrenInline(cloneBlock->firstChild() ? cloneBlock->firstChild()->isInline() : childrenInline());
     }
-    cloneBlock->setChildrenInline(childrenInline());
     return cloneBlock;
 }
 
@@ -468,10 +483,16 @@ void RenderBlock::splitBlocks(RenderBlock* fromBlock, RenderBlock* toBlock,
     if (!isAnonymousBlock())
         cloneBlock->setContinuation(oldCont);
 
-    // Now take all of the children from beforeChild to the end and remove
-    // them from |this| and place them in the clone.
     if (!beforeChild && isAfterContent(lastChild()))
         beforeChild = lastChild();
+
+    // If we are moving inline children from |this| to cloneBlock, then we need
+    // to clear our line box tree.
+    if (beforeChild && childrenInline())
+        deleteLineBoxTree();
+
+    // Now take all of the children from beforeChild to the end and remove
+    // them from |this| and place them in the clone.
     moveChildrenTo(cloneBlock, beforeChild, 0, true);
     
     // Hook |clone| up as the continuation of the middle block.
@@ -494,7 +515,7 @@ void RenderBlock::splitBlocks(RenderBlock* fromBlock, RenderBlock* toBlock,
         cloneBlock = blockCurr->clone();
 
         // Insert our child clone as the first child.
-        cloneBlock->children()->appendChildNode(cloneBlock, cloneChild);
+        cloneBlock->addChildIgnoringContinuation(cloneChild, 0);
 
         // Hook the clone up as a continuation of |curr|.  Note we do encounter
         // anonymous blocks possibly as we walk up the block chain.  When we split an
@@ -585,6 +606,9 @@ void RenderBlock::splitFlow(RenderObject* beforeChild, RenderBlock* newBlockBox,
 
 RenderObject* RenderBlock::splitAnonymousBlocksAroundChild(RenderObject* beforeChild)
 {
+    if (beforeChild->isTablePart())
+        beforeChild = splitTablePartsAroundChild(beforeChild);
+
     while (beforeChild->parent() != this) {
         RenderBlock* blockToSplit = toRenderBlock(beforeChild->parent());
         if (blockToSplit->firstChild() != beforeChild) {
@@ -603,6 +627,71 @@ RenderObject* RenderBlock::splitAnonymousBlocksAroundChild(RenderObject* beforeC
     return beforeChild;
 }
 
+static void markTableForSectionAndCellRecalculation(RenderObject* child)
+{
+    RenderObject* curr = child;
+    while (!curr->isTable()) {
+        if (curr->isTableSection())
+            toRenderTableSection(curr)->setNeedsCellRecalc();
+        curr = curr->parent();
+    }
+
+    RenderTable* table = toRenderTable(curr);
+    table->setNeedsSectionRecalc();
+    table->setNeedsLayoutAndPrefWidthsRecalc();
+}
+
+static void moveAllTableChildrenTo(RenderObject* fromTablePart, RenderTable* toTable, RenderObject* startChild)
+{
+    for (RenderObject* curr = startChild; curr;) {
+        // Need to store next sibling as we won't have access to it
+        // after we are removed from table.
+        RenderObject* next = curr->nextSibling();
+        fromTablePart->removeChild(curr);
+        toTable->addChild(curr);
+        if (curr->isTableSection())
+            toRenderTableSection(curr)->setNeedsCellRecalc();
+        curr->setNeedsLayoutAndPrefWidthsRecalc();
+        curr = next; 
+    }
+
+    // This marks fromTable for section and cell recalculation.
+    markTableForSectionAndCellRecalculation(fromTablePart);
+
+    // startChild is now part of toTable. This marks toTable for section and cell recalculation.
+    markTableForSectionAndCellRecalculation(startChild);
+}
+
+RenderObject* RenderBlock::splitTablePartsAroundChild(RenderObject* beforeChild)
+{
+    ASSERT(beforeChild->isTablePart());
+
+    while (beforeChild->parent() != this) {
+        RenderObject* tablePartToSplit = beforeChild->parent();
+        if (!tablePartToSplit->isTablePart() && !tablePartToSplit->isTable())
+            break;
+        if (tablePartToSplit->firstChild() != beforeChild) {
+            // Get our table container.
+            RenderObject* curr = tablePartToSplit;
+            while (!curr->isTable())
+                curr = curr->parent();
+            RenderTable* table = toRenderTable(curr);
+
+            // Create an anonymous table container next to our table container.
+            RenderBlock* parentBlock = toRenderBlock(table->parent());
+            RenderTable* postTable = parentBlock->createAnonymousTable();
+            parentBlock->children()->insertChildNode(parentBlock, postTable, table->nextSibling());
+            
+            // Move all the children from beforeChild to the newly created anonymous table container.
+            moveAllTableChildrenTo(tablePartToSplit, postTable, beforeChild);
+
+            beforeChild = postTable;
+        } else
+            beforeChild = tablePartToSplit;
+    }
+    return beforeChild;
+}
+
 void RenderBlock::makeChildrenAnonymousColumnBlocks(RenderObject* beforeChild, RenderBlock* newBlockBox, RenderObject* newChild)
 {
     RenderBlock* pre = 0;
@@ -669,22 +758,17 @@ RenderBlock* RenderBlock::columnsBlockForSpanningElement(RenderObject* newChild)
     RenderBlock* columnsBlockAncestor = 0;
     if (!newChild->isText() && newChild->style()->columnSpan() && !newChild->isBeforeOrAfterContent()
         && !newChild->isFloatingOrPositioned() && !newChild->isInline() && !isAnonymousColumnSpanBlock()) {
-        if (style()->specifiesColumns())
-            columnsBlockAncestor = this;
-        else if (!isInline() && parent() && parent()->isRenderBlock()) {
-            columnsBlockAncestor = toRenderBlock(parent())->containingColumnsBlock(false);
-            
-            if (columnsBlockAncestor) {
-                // Make sure that none of the parent ancestors have a continuation.
-                // If yes, we do not want split the block into continuations.
-                RenderObject* curr = this;
-                while (curr && curr != columnsBlockAncestor) {
-                    if (curr->isRenderBlock() && toRenderBlock(curr)->continuation()) {
-                        columnsBlockAncestor = 0;
-                        break;
-                    }
-                    curr = curr->parent();
+        columnsBlockAncestor = containingColumnsBlock(false);
+        if (columnsBlockAncestor) {
+            // Make sure that none of the parent ancestors have a continuation.
+            // If yes, we do not want split the block into continuations.
+            RenderObject* curr = this;
+            while (curr && curr != columnsBlockAncestor) {
+                if (curr->isRenderBlock() && toRenderBlock(curr)->continuation()) {
+                    columnsBlockAncestor = 0;
+                    break;
                 }
+                curr = curr->parent();
             }
         }
     }
@@ -697,35 +781,48 @@ void RenderBlock::addChildIgnoringAnonymousColumnBlocks(RenderObject* newChild,
     if (!beforeChild)
         beforeChild = afterPseudoElementRenderer();
 
-    // If the requested beforeChild is not one of our children, then this is because
-    // there is an anonymous container within this object that contains the beforeChild.
     if (beforeChild && beforeChild->parent() != this) {
-        RenderObject* beforeChildAnonymousContainer = anonymousContainer(beforeChild);
-        ASSERT(beforeChildAnonymousContainer);
-        ASSERT(beforeChildAnonymousContainer->isAnonymous());
-
-        if (beforeChildAnonymousContainer->isAnonymousBlock()) {
-            // Insert the child into the anonymous block box instead of here.
-            if (newChild->isInline() || beforeChild->parent()->firstChild() != beforeChild)
-                beforeChild->parent()->addChild(newChild, beforeChild);
-            else
-                addChild(newChild, beforeChild->parent());
-            return;
-        }
+        RenderObject* beforeChildContainer = beforeChild->parent();
+        while (beforeChildContainer->parent() != this)
+            beforeChildContainer = beforeChildContainer->parent();
+        ASSERT(beforeChildContainer);
+
+        if (beforeChildContainer->isAnonymous()) {
+            // If the requested beforeChild is not one of our children, then this is because
+            // there is an anonymous container within this object that contains the beforeChild.
+            RenderObject* beforeChildAnonymousContainer = beforeChildContainer;
+            if (beforeChildAnonymousContainer->isAnonymousBlock()) {
+                // Insert the child into the anonymous block box instead of here.
+                if (newChild->isInline() || beforeChild->parent()->firstChild() != beforeChild)
+                    beforeChild->parent()->addChild(newChild, beforeChild);
+                else
+                    addChild(newChild, beforeChild->parent());
+                return;
+            }
 
-        ASSERT(beforeChildAnonymousContainer->isTable());
-        if ((newChild->isTableCol() && newChild->style()->display() == TABLE_COLUMN_GROUP)
-                || (newChild->isTableCaption())
-                || newChild->isTableSection()
-                || newChild->isTableRow()
-                || newChild->isTableCell()) {
-            // Insert into the anonymous table.
-            beforeChildAnonymousContainer->addChild(newChild, beforeChild);
-            return;
-        }
+            ASSERT(beforeChildAnonymousContainer->isTable());
+            if (newChild->isTablePart()) {
+                // Insert into the anonymous table.
+                beforeChildAnonymousContainer->addChild(newChild, beforeChild);
+                return;
+            }
+
+            beforeChild = splitTablePartsAroundChild(beforeChild);
 
-        // Go on to insert before the anonymous table.
-        beforeChild = beforeChildAnonymousContainer;
+            ASSERT(beforeChild->parent() == this);
+            if (beforeChild->parent() != this) {
+                // We should never reach here. If we do, we need to use the
+                // safe fallback to use the topmost beforeChild container.
+                beforeChild = beforeChildContainer;
+            }
+        } else {
+            // We will reach here when beforeChild is a run-in element.
+            // If run-in element precedes a block-level element, it becomes the
+            // the first inline child of that block level element. The insertion
+            // point will be before that block-level element.
+            ASSERT(beforeChild->isRunIn());
+            beforeChild = beforeChildContainer;
+        }
     }
 
     // Check for a spanning element in columns.
@@ -885,23 +982,27 @@ RootInlineBox* RenderBlock::createAndAppendRootInlineBox()
     return rootBox;
 }
 
-void RenderBlock::moveChildTo(RenderBlock* to, RenderObject* child, RenderObject* beforeChild, bool fullRemoveInsert)
+void RenderBlock::moveChildTo(RenderBlock* toBlock, RenderObject* child, RenderObject* beforeChild, bool fullRemoveInsert)
 {
     ASSERT(this == child->parent());
-    ASSERT(!beforeChild || to == beforeChild->parent());
-    to->children()->insertChildNode(to, children()->removeChildNode(this, child, fullRemoveInsert), beforeChild, fullRemoveInsert);
+    ASSERT(!beforeChild || toBlock == beforeChild->parent());
+    if (fullRemoveInsert) {
+        // Takes care of adding the new child correctly if toBlock and fromBlock
+        // have different kind of children (block vs inline).
+        toBlock->addChildIgnoringContinuation(children()->removeChildNode(this, child), beforeChild);
+    } else
+        toBlock->children()->insertChildNode(toBlock, children()->removeChildNode(this, child, false), beforeChild, false);
 }
 
-void RenderBlock::moveChildrenTo(RenderBlock* to, RenderObject* startChild, RenderObject* endChild, RenderObject* beforeChild, bool fullRemoveInsert)
+void RenderBlock::moveChildrenTo(RenderBlock* toBlock, RenderObject* startChild, RenderObject* endChild, RenderObject* beforeChild, bool fullRemoveInsert)
 {
-    ASSERT(!beforeChild || to == beforeChild->parent());
-    RenderObject* nextChild = startChild;
-    while (nextChild && nextChild != endChild) {
-        RenderObject* child = nextChild;
-        nextChild = child->nextSibling();
-        to->children()->insertChildNode(to, children()->removeChildNode(this, child, fullRemoveInsert), beforeChild, fullRemoveInsert);
-        if (child == endChild)
-            return;
+    ASSERT(!beforeChild || toBlock == beforeChild->parent());
+
+    for (RenderObject* child = startChild; child && child != endChild; ) {
+        // Save our next sibling as moveChildTo will clear it.
+        RenderObject* nextSibling = child->nextSibling();
+        moveChildTo(toBlock, child, beforeChild, fullRemoveInsert);
+        child = nextSibling;
     }
 }
 
@@ -1025,11 +1126,15 @@ void RenderBlock::collapseAnonymousBoxChild(RenderBlock* parent, RenderObject* c
     parent->setNeedsLayoutAndPrefWidthsRecalc();
     parent->setChildrenInline(child->childrenInline());
     RenderObject* nextSibling = child->nextSibling();
+
+    RenderFlowThread* childFlowThread = child->enclosingRenderFlowThread();
     RenderBlock* anonBlock = toRenderBlock(parent->children()->removeChildNode(parent, child, child->hasLayer()));
     anonBlock->moveAllChildrenTo(parent, nextSibling, child->hasLayer());
     // Delete the now-empty block's lines and nuke it.
     if (!parent->documentBeingDestroyed())
         anonBlock->deleteLineBoxTree();
+    if (childFlowThread && !parent->documentBeingDestroyed())
+        childFlowThread->removeFlowChildInfo(anonBlock);
     anonBlock->destroy();
 }
 
@@ -1419,7 +1524,7 @@ void RenderBlock::layoutBlock(bool relayoutChildren, LayoutUnit pageLogicalHeigh
         
         if (hasOverflowClip()) {
             // Adjust repaint rect for scroll offset
-            repaintRect.move(-layer()->scrolledContentOffset());
+            repaintRect.move(-scrolledContentOffset());
 
             // Don't allow this rect to spill out of our overflow box.
             repaintRect.intersect(LayoutRect(LayoutPoint(), size()));
@@ -1427,7 +1532,6 @@ void RenderBlock::layoutBlock(bool relayoutChildren, LayoutUnit pageLogicalHeigh
 
         // Make sure the rect is still non-empty after intersecting for overflow above
         if (!repaintRect.isEmpty()) {
-            // FIXME: Might need rounding once we switch to float, see https://bugs.webkit.org/show_bug.cgi?id=64021
             repaintRectangle(repaintRect); // We need to do a partial repaint of our content.
             if (hasReflection())
                 repaintRectangle(reflectedRect(repaintRect));
@@ -1488,6 +1592,9 @@ void RenderBlock::computeOverflow(LayoutUnit oldClientAfterEdge, bool recomputeF
 
     // Add visual overflow from theme.
     addVisualOverflowFromTheme();
+
+    if (isRenderFlowThread())
+        enclosingRenderFlowThread()->computeOverflowStateForRegions(oldClientAfterEdge);
 }
 
 void RenderBlock::addOverflowFromBlockChildren()
@@ -1591,7 +1698,7 @@ void RenderBlock::adjustFloatingBlock(const MarginInfo& marginInfo)
     // for by simply calling canCollapseWithMarginBefore.  See
     // http://www.hixie.ch/tests/adhoc/css/box/block/margin-collapse/046.html for
     // an example of this scenario.
-    LayoutUnit marginOffset = marginInfo.canCollapseWithMarginBefore() ? 0 : marginInfo.margin();
+    LayoutUnit marginOffset = marginInfo.canCollapseWithMarginBefore() ? zeroLayoutUnit : marginInfo.margin();
     setLogicalHeight(logicalHeight() + marginOffset);
     positionNewFloats();
     setLogicalHeight(logicalHeight() - marginOffset);
@@ -1893,7 +2000,6 @@ LayoutUnit RenderBlock::computeStartPositionDeltaForChildAvoidingFloats(const Re
         if (childMarginStart < 0)
             startOff += childMarginStart;
         newPosition = max(newPosition, startOff); // Let the float sit in the child's margin if it can fit.
-        // FIXME: Needs to use epsilon once we switch to float, see https://bugs.webkit.org/show_bug.cgi?id=64021
     } else if (startOff != startPosition) {
         // The object is shifting to the "end" side of the block. The object might be centered, so we need to
         // recalculate our inline direction margins. Note that the containing block content
@@ -2440,7 +2546,7 @@ void RenderBlock::paint(PaintInfo& paintInfo, const LayoutPoint& paintOffset)
     // z-index.  We paint after we painted the background/border, so that the scrollbars will
     // sit above the background/border.
     if (hasOverflowClip() && style()->visibility() == VISIBLE && (phase == PaintPhaseBlockBackground || phase == PaintPhaseChildBlockBackground) && paintInfo.shouldPaintWithinRoot(this))
-        layer()->paintOverflowControls(paintInfo.context, adjustedPaintOffset, paintInfo.rect);
+        layer()->paintOverflowControls(paintInfo.context, roundedIntPoint(adjustedPaintOffset), paintInfo.rect);
 }
 
 void RenderBlock::paintColumnRules(PaintInfo& paintInfo, const LayoutPoint& paintOffset)
@@ -2463,9 +2569,9 @@ void RenderBlock::paintColumnRules(PaintInfo& paintInfo, const LayoutPoint& pain
     bool antialias = shouldAntialiasLines(paintInfo.context);
 
     if (colInfo->progressionAxis() == ColumnInfo::InlineAxis) {
-        LayoutUnit currLogicalLeftOffset = style()->isLeftToRightDirection() ? 0 : contentLogicalWidth();
+        LayoutUnit currLogicalLeftOffset = style()->isLeftToRightDirection() ? zeroLayoutUnit : contentLogicalWidth();
         LayoutUnit ruleAdd = logicalLeftOffsetForContent();
-        LayoutUnit ruleLogicalLeft = style()->isLeftToRightDirection() ? 0 : contentLogicalWidth();
+        LayoutUnit ruleLogicalLeft = style()->isLeftToRightDirection() ? zeroLayoutUnit : contentLogicalWidth();
         LayoutUnit inlineDirectionSize = colInfo->desiredColumnWidth();
         BoxSide boxSide = isHorizontalWritingMode()
             ? style()->isLeftToRightDirection() ? BSLeft : BSRight
@@ -2487,7 +2593,8 @@ void RenderBlock::paintColumnRules(PaintInfo& paintInfo, const LayoutPoint& pain
                 LayoutUnit ruleRight = isHorizontalWritingMode() ? ruleLeft + ruleThickness : ruleLeft + contentWidth();
                 LayoutUnit ruleTop = isHorizontalWritingMode() ? paintOffset.y() + borderTop() + paddingTop() : paintOffset.y() + ruleLogicalLeft - ruleThickness / 2 + ruleAdd;
                 LayoutUnit ruleBottom = isHorizontalWritingMode() ? ruleTop + contentHeight() : ruleTop + ruleThickness;
-                drawLineForBoxSide(paintInfo.context, ruleLeft, ruleTop, ruleRight, ruleBottom, boxSide, ruleColor, ruleStyle, 0, 0, antialias);
+                IntRect pixelSnappedRuleRect = pixelSnappedIntRectFromEdges(ruleLeft, ruleTop, ruleRight, ruleBottom);
+                drawLineForBoxSide(paintInfo.context, pixelSnappedRuleRect.x(), pixelSnappedRuleRect.y(), pixelSnappedRuleRect.maxX(), pixelSnappedRuleRect.maxY(), boxSide, ruleColor, ruleStyle, 0, 0, antialias);
             }
             
             ruleLogicalLeft = currLogicalLeftOffset;
@@ -2512,7 +2619,8 @@ void RenderBlock::paintColumnRules(PaintInfo& paintInfo, const LayoutPoint& pain
 
         for (unsigned i = 1; i < colCount; i++) {
             ruleRect.move(step);
-            drawLineForBoxSide(paintInfo.context, ruleRect.x(), ruleRect.y(), ruleRect.maxX(), ruleRect.maxY(), boxSide, ruleColor, ruleStyle, 0, 0, antialias);
+            IntRect pixelSnappedRuleRect = pixelSnappedIntRect(ruleRect);
+            drawLineForBoxSide(paintInfo.context, pixelSnappedRuleRect.x(), pixelSnappedRuleRect.y(), pixelSnappedRuleRect.maxX(), pixelSnappedRuleRect.maxY(), boxSide, ruleColor, ruleStyle, 0, 0, antialias);
         }
     }
 }
@@ -2540,7 +2648,7 @@ void RenderBlock::paintColumnContents(PaintInfo& paintInfo, const LayoutPoint& p
         }
         colRect.moveBy(paintOffset);
         PaintInfo info(paintInfo);
-        info.rect.intersect(colRect);
+        info.rect.intersect(pixelSnappedIntRect(colRect));
         
         if (!info.rect.isEmpty()) {
             GraphicsContextStateSaver stateSaver(*context);
@@ -2680,7 +2788,7 @@ void RenderBlock::paintObject(PaintInfo& paintInfo, const LayoutPoint& paintOffs
     // Adjust our painting position if we're inside a scrolled layer (e.g., an overflow:auto div).
     LayoutPoint scrolledOffset = paintOffset;
     if (hasOverflowClip())
-        scrolledOffset.move(-layer()->scrolledContentOffset());
+        scrolledOffset.move(-scrolledContentOffset());
 
     // 2. paint contents
     if (paintPhase != PaintPhaseSelfOutline) {
@@ -2928,7 +3036,7 @@ GapRects RenderBlock::selectionGapRectsForRepaint(RenderBoxModelObject* repaintC
     LayoutPoint offsetFromRepaintContainer = roundedLayoutPoint(transformState.mappedPoint());
 
     if (hasOverflowClip())
-        offsetFromRepaintContainer -= layer()->scrolledContentOffset();
+        offsetFromRepaintContainer -= scrolledContentOffset();
 
     LayoutUnit lastTop = 0;
     LayoutUnit lastLeft = logicalLeftSelectionOffset(this, lastTop);
@@ -2953,7 +3061,8 @@ void RenderBlock::paintSelection(PaintInfo& paintInfo, const LayoutPoint& paintO
                     LayoutRect localBounds(gapRectsBounds);
                     flipForWritingMode(localBounds);
                     gapRectsBounds = localToContainerQuad(FloatRect(localBounds), layer->renderer()).enclosingBoundingBox();
-                    gapRectsBounds.move(layer->scrolledContentOffset());
+                    if (layer->renderer()->hasOverflowClip())
+                        gapRectsBounds.move(layer->renderBox()->scrolledContentOffset());
                 }
                 layer->addBlockSelectionGapsBounds(gapRectsBounds);
             }
@@ -3019,7 +3128,7 @@ GapRects RenderBlock::selectionGaps(RenderBlock* rootBlock, const LayoutPoint& r
                                     r->m_renderer->width(), r->m_renderer->height());
                 rootBlock->flipForWritingMode(floatBox);
                 floatBox.move(rootBlockPhysicalPosition.x(), rootBlockPhysicalPosition.y());
-                paintInfo->context->clipOut(floatBox);
+                paintInfo->context->clipOut(pixelSnappedIntRect(floatBox));
             }
         }
     }
@@ -3769,7 +3878,7 @@ LayoutUnit RenderBlock::nextFloatLogicalBottomBelow(LayoutUnit logicalHeight) co
             bottom = min(floatBottom, bottom);
     }
 
-    return bottom == numeric_limits<LayoutUnit>::max() ? 0 : bottom;
+    return bottom == numeric_limits<LayoutUnit>::max() ? zeroLayoutUnit : bottom;
 }
 
 LayoutUnit RenderBlock::lowestFloatLogicalBottom(FloatingObject::Type floatType) const
@@ -4087,7 +4196,7 @@ bool RenderBlock::avoidsFloats() const
     return RenderBox::avoidsFloats() || !style()->hasAutoColumnCount() || !style()->hasAutoColumnWidth();
 }
 
-bool RenderBlock::containsFloat(RenderBox* renderer)
+bool RenderBlock::containsFloat(RenderBox* renderer) const
 {
     return m_floatingObjects && m_floatingObjects->set().contains<RenderBox*, FloatingObjectHashTranslator>(renderer);
 }
@@ -4166,13 +4275,11 @@ LayoutUnit RenderBlock::getClearDelta(RenderBox* child, LayoutUnit logicalTop)
     }
 
     // We also clear floats if we are too big to sit on the same line as a float (and wish to avoid floats by default).
-    LayoutUnit result = clearSet ? max<LayoutUnit>(0, logicalBottom - logicalTop) : 0;
+    LayoutUnit result = clearSet ? max<LayoutUnit>(0, logicalBottom - logicalTop) : zeroLayoutUnit;
     if (!result && child->avoidsFloats()) {
         LayoutUnit newLogicalTop = logicalTop;
         while (true) {
             LayoutUnit availableLogicalWidthAtNewLogicalTopOffset = availableLogicalWidthForLine(newLogicalTop, false);
-            // FIXME: Change to use roughlyEquals when we move to float.
-            // See https://bugs.webkit.org/show_bug.cgi?id=66148
             if (availableLogicalWidthAtNewLogicalTopOffset == availableLogicalWidthForContent(newLogicalTop))
                 return newLogicalTop - logicalTop;
 
@@ -4193,8 +4300,6 @@ LayoutUnit RenderBlock::getClearDelta(RenderBox* child, LayoutUnit logicalTop)
             child->setMarginLeft(childOldMarginLeft);
             child->setMarginRight(childOldMarginRight);
             
-            // FIXME: Change to use roughlyEquals when we move to float.
-            // See https://bugs.webkit.org/show_bug.cgi?id=66148
             if (childLogicalWidthAtNewLogicalTopOffset <= availableLogicalWidthAtNewLogicalTopOffset)
                 return newLogicalTop - logicalTop;
 
@@ -4245,9 +4350,8 @@ bool RenderBlock::nodeAtPoint(const HitTestRequest& request, HitTestResult& resu
     if (checkChildren) {
         // Hit test descendants first.
         LayoutSize scrolledOffset(localOffset);
-        if (hasOverflowClip()) {
-            scrolledOffset -= layer()->scrolledContentOffset();
-        }
+        if (hasOverflowClip())
+            scrolledOffset -= scrolledContentOffset();
 
         // Hit test contents if we don't have columns.
         if (!hasColumns()) {
@@ -4594,7 +4698,7 @@ VisiblePosition RenderBlock::positionForPoint(const LayoutPoint& point)
 void RenderBlock::offsetForContents(LayoutPoint& offset) const
 {
     if (hasOverflowClip())
-        offset += layer()->scrolledContentOffset();
+        offset += scrolledContentOffset();
 
     if (hasColumns())
         adjustPointToColumnContents(offset);
@@ -5005,6 +5109,8 @@ void RenderBlock::computePreferredLogicalWidths()
         }
 
         int scrollbarWidth = 0;
+        // FIXME: This should only be done for horizontal writing mode.
+        // For vertical writing mode, this should check overflowX and use the horizontalScrollbarHeight.
         if (hasOverflowClip() && styleToUse->overflowY() == OSCROLL) {
             layer()->setHasVerticalScrollbar(true);
             scrollbarWidth = verticalScrollbarWidth();
@@ -5150,7 +5256,7 @@ void RenderBlock::computeInlinePreferredLogicalWidths()
 
     RenderStyle* styleToUse = style();
     RenderBlock* containingBlock = this->containingBlock();
-    LayoutUnit cw = containingBlock ? containingBlock->contentLogicalWidth() : 0;
+    LayoutUnit cw = containingBlock ? containingBlock->contentLogicalWidth() : zeroLayoutUnit;
 
     // If we are at the start of a line, we want to ignore all white-space.
     // Also strip spaces if we previously had text that ended in a trailing space.
@@ -5704,6 +5810,36 @@ static inline bool shouldSkipForFirstLetter(UChar c)
     return isSpaceOrNewline(c) || c == noBreakSpace || isPunctuationForFirstLetter(c);
 }
 
+// We only honor first-letter if 
+// - the firstLetterBlock can have children in the DOM and
+// - the block doesn't have any special assumption on its text children.
+// This correctly prevents form controls from honoring first-letter.
+static inline bool isSafeToCreateFirstLetterRendererOn(RenderObject* renderer)
+{
+    return (renderer->canHaveChildren()
+            && !(renderer->isDeprecatedFlexibleBox()
+                 && static_cast<RenderDeprecatedFlexibleBox*>(renderer)->buttonText()));
+}
+
+static inline RenderObject* findFirstLetterBlock(RenderBlock* start)
+{
+    RenderObject* firstLetterBlock = start;
+    while (true) {
+        bool canHaveFirstLetterRenderer = firstLetterBlock->style()->hasPseudoStyle(FIRST_LETTER)
+            && isSafeToCreateFirstLetterRendererOn(firstLetterBlock);
+        if (canHaveFirstLetterRenderer)
+            return firstLetterBlock;
+
+        RenderObject* parentBlock = firstLetterBlock->parent();
+        if (firstLetterBlock->isReplaced() || !parentBlock || parentBlock->firstChild() != firstLetterBlock || 
+            !parentBlock->isBlockFlow())
+            return 0;
+        firstLetterBlock = parentBlock;
+    } 
+
+    return 0;
+}
+   
 void RenderBlock::updateFirstLetter()
 {
     if (!document()->usesFirstLetterRules())
@@ -5714,23 +5850,8 @@ void RenderBlock::updateFirstLetter()
 
     // FIXME: We need to destroy the first-letter object if it is no longer the first child.  Need to find
     // an efficient way to check for that situation though before implementing anything.
-    RenderObject* firstLetterBlock = this;
-    bool hasPseudoStyle = false;
-    while (true) {
-        // We only honor first-letter if the firstLetterBlock can have children in the DOM. This correctly 
-        // prevents form controls from honoring first-letter.
-        hasPseudoStyle = firstLetterBlock->style()->hasPseudoStyle(FIRST_LETTER) 
-            && firstLetterBlock->canHaveChildren();
-        if (hasPseudoStyle)
-            break;
-        RenderObject* parentBlock = firstLetterBlock->parent();
-        if (firstLetterBlock->isReplaced() || !parentBlock || parentBlock->firstChild() != firstLetterBlock || 
-            !parentBlock->isBlockFlow())
-            break;
-        firstLetterBlock = parentBlock;
-    } 
-
-    if (!hasPseudoStyle) 
+    RenderObject* firstLetterBlock = findFirstLetterBlock(this);
+    if (!firstLetterBlock)
         return;
 
     // Drill into inlines looking for our first text child.
@@ -5922,7 +6043,7 @@ static int getHeightForLineCount(RenderBlock* block, int l, bool includeBottom,
         if (block->childrenInline()) {
             for (RootInlineBox* box = block->firstRootBox(); box; box = box->nextRootBox()) {
                 if (++count == l)
-                    return box->lineBottom() + (includeBottom ? (block->borderBottom() + block->paddingBottom()) : 0);
+                    return box->lineBottom() + (includeBottom ? (block->borderBottom() + block->paddingBottom()) : zeroLayoutUnit);
             }
         }
         else {
@@ -5931,7 +6052,7 @@ static int getHeightForLineCount(RenderBlock* block, int l, bool includeBottom,
                 if (shouldCheckLines(obj)) {
                     int result = getHeightForLineCount(toRenderBlock(obj), l, false, count);
                     if (result != -1)
-                        return result + obj->y() + (includeBottom ? (block->borderBottom() + block->paddingBottom()) : 0);
+                        return result + obj->y() + (includeBottom ? (block->borderBottom() + block->paddingBottom()) : zeroLayoutUnit);
                 }
                 else if (!obj->isFloatingOrPositioned() && !obj->isRunIn())
                     normalFlowChildWithoutLines = obj;
@@ -6495,11 +6616,15 @@ LayoutUnit RenderBlock::pageRemainingLogicalHeightForOffset(LayoutUnit offset, P
 
 LayoutUnit RenderBlock::adjustForUnsplittableChild(RenderBox* child, LayoutUnit logicalOffset, bool includeMargins)
 {
-    bool isUnsplittable = child->isUnsplittableForPagination() || child->style()->columnBreakInside() == PBAVOID
-        || child->style()->regionBreakInside() == PBAVOID;
+    bool checkColumnBreaks = view()->layoutState()->isPaginatingColumns();
+    bool checkPageBreaks = !checkColumnBreaks && view()->layoutState()->m_pageLogicalHeight;
+    bool checkRegionBreaks = inRenderFlowThread();
+    bool isUnsplittable = child->isUnsplittableForPagination() || (checkColumnBreaks && child->style()->columnBreakInside() == PBAVOID)
+        || (checkPageBreaks && child->style()->pageBreakInside() == PBAVOID)
+        || (checkRegionBreaks && child->style()->regionBreakInside() == PBAVOID);
     if (!isUnsplittable)
         return logicalOffset;
-    LayoutUnit childLogicalHeight = logicalHeightForChild(child) + (includeMargins ? marginBeforeForChild(child) + marginAfterForChild(child) : 0);
+    LayoutUnit childLogicalHeight = logicalHeightForChild(child) + (includeMargins ? marginBeforeForChild(child) + marginAfterForChild(child) : zeroLayoutUnit);
     LayoutState* layoutState = view()->layoutState();
     if (layoutState->m_columnInfo)
         layoutState->m_columnInfo->updateMinimumColumnHeight(childLogicalHeight);
diff --git a/Source/WebCore/rendering/RenderBlock.h b/Source/WebCore/rendering/RenderBlock.h
index 2ccf0aa25..8996da5ef 100644
--- a/Source/WebCore/rendering/RenderBlock.h
+++ b/Source/WebCore/rendering/RenderBlock.h
@@ -122,8 +122,8 @@ public:
     void markPositionedObjectsForLayout();
     virtual void markForPaginationRelayoutIfNeeded();
     
-    bool containsFloats() { return m_floatingObjects && !m_floatingObjects->set().isEmpty(); }
-    bool containsFloat(RenderBox*);
+    bool containsFloats() const { return m_floatingObjects && !m_floatingObjects->set().isEmpty(); }
+    bool containsFloat(RenderBox*) const;
 
     // Versions that can compute line offsets with the region and page offset passed in. Used for speed to avoid having to
     // compute the region all over again when you already know it.
@@ -145,6 +145,11 @@ public:
         return style()->isLeftToRightDirection() ? logicalLeftOffsetForLine(position, firstLine, region, offsetFromLogicalTopOfFirstPage)
             : logicalWidth() - logicalRightOffsetForLine(position, firstLine, region, offsetFromLogicalTopOfFirstPage);
     }
+    LayoutUnit endOffsetForLine(LayoutUnit position, bool firstLine, RenderRegion* region, LayoutUnit offsetFromLogicalTopOfFirstPage) const
+    {
+        return !style()->isLeftToRightDirection() ? logicalLeftOffsetForLine(position, firstLine, region, offsetFromLogicalTopOfFirstPage)
+            : logicalWidth() - logicalRightOffsetForLine(position, firstLine, region, offsetFromLogicalTopOfFirstPage);
+    }
 
     LayoutUnit availableLogicalWidthForLine(LayoutUnit position, bool firstLine) const
     {
@@ -163,6 +168,11 @@ public:
         return style()->isLeftToRightDirection() ? logicalLeftOffsetForLine(position, firstLine)
             : logicalWidth() - logicalRightOffsetForLine(position, firstLine);
     }
+    LayoutUnit endOffsetForLine(LayoutUnit position, bool firstLine) const
+    {
+        return !style()->isLeftToRightDirection() ? logicalLeftOffsetForLine(position, firstLine)
+            : logicalWidth() - logicalRightOffsetForLine(position, firstLine);
+    }
 
     // FIXME: The implementation for these functions will change once we move to subpixel layout. See bug 60318.
     int pixelSnappedLogicalRightOffsetForLine(LayoutUnit position, bool firstLine) const
@@ -242,12 +252,12 @@ public:
     unsigned columnCount(ColumnInfo*) const;
     LayoutRect columnRectAt(ColumnInfo*, unsigned) const;
 
-    LayoutUnit paginationStrut() const { return m_rareData ? m_rareData->m_paginationStrut : 0; }
+    LayoutUnit paginationStrut() const { return m_rareData ? m_rareData->m_paginationStrut : zeroLayoutUnit; }
     void setPaginationStrut(LayoutUnit);
     
     // The page logical offset is the object's offset from the top of the page in the page progression
     // direction (so an x-offset in vertical text and a y-offset for horizontal text).
-    int pageLogicalOffset() const { return m_rareData ? m_rareData->m_pageLogicalOffset : 0; }
+    LayoutUnit pageLogicalOffset() const { return m_rareData ? m_rareData->m_pageLogicalOffset : zeroLayoutUnit; }
     void setPageLogicalOffset(int);
 
     RootInlineBox* lineGridBox() const { return m_rareData ? m_rareData->m_lineGridBox : 0; }
@@ -326,6 +336,11 @@ public:
         return style()->isLeftToRightDirection() ? logicalLeftOffsetForContent(region, offsetFromLogicalTopOfFirstPage)
             : logicalWidth() - logicalRightOffsetForContent(region, offsetFromLogicalTopOfFirstPage);
     }
+    LayoutUnit endOffsetForContent(RenderRegion* region, LayoutUnit offsetFromLogicalTopOfFirstPage) const
+    {
+        return !style()->isLeftToRightDirection() ? logicalLeftOffsetForContent(region, offsetFromLogicalTopOfFirstPage)
+            : logicalWidth() - logicalRightOffsetForContent(region, offsetFromLogicalTopOfFirstPage);
+    }
     LayoutUnit logicalLeftOffsetForContent(LayoutUnit blockOffset) const
     {
         return logicalLeftOffsetForContent(regionAtBlockOffset(blockOffset), offsetFromLogicalTopOfFirstPage());
@@ -342,9 +357,14 @@ public:
     {
         return startOffsetForContent(regionAtBlockOffset(blockOffset), offsetFromLogicalTopOfFirstPage());
     }
+    LayoutUnit endOffsetForContent(LayoutUnit blockOffset) const
+    {
+        return endOffsetForContent(regionAtBlockOffset(blockOffset), offsetFromLogicalTopOfFirstPage());
+    }
     LayoutUnit logicalLeftOffsetForContent() const { return isHorizontalWritingMode() ? borderLeft() + paddingLeft() : borderTop() + paddingTop(); }
     LayoutUnit logicalRightOffsetForContent() const { return logicalLeftOffsetForContent() + availableLogicalWidth(); }
     LayoutUnit startOffsetForContent() const { return style()->isLeftToRightDirection() ? logicalLeftOffsetForContent() : logicalWidth() - logicalRightOffsetForContent(); }
+    LayoutUnit endOffsetForContent() const { return !style()->isLeftToRightDirection() ? logicalLeftOffsetForContent() : logicalWidth() - logicalRightOffsetForContent(); }
     
     void setStaticInlinePositionForChild(RenderBox*, LayoutUnit blockOffset, LayoutUnit inlinePosition);
 
@@ -365,23 +385,23 @@ protected:
     {
         return moveChildTo(to, child, 0, fullRemoveInsert);
     }
-    void moveChildTo(RenderBlock* to, RenderObject* child, RenderObject* beforeChild, bool fullRemoveInsert = false);
-    void moveAllChildrenTo(RenderBlock* to, bool fullRemoveInsert = false)
+    void moveChildTo(RenderBlock* toBlock, RenderObject* child, RenderObject* beforeChild, bool fullRemoveInsert = false);
+    void moveAllChildrenTo(RenderBlock* toBlock, bool fullRemoveInsert = false)
     {
-        return moveAllChildrenTo(to, 0, fullRemoveInsert);
+        return moveAllChildrenTo(toBlock, 0, fullRemoveInsert);
     }
-    void moveAllChildrenTo(RenderBlock* to, RenderObject* beforeChild, bool fullRemoveInsert = false)
+    void moveAllChildrenTo(RenderBlock* toBlock, RenderObject* beforeChild, bool fullRemoveInsert = false)
     {
-        return moveChildrenTo(to, firstChild(), 0, beforeChild, fullRemoveInsert);
+        return moveChildrenTo(toBlock, firstChild(), 0, beforeChild, fullRemoveInsert);
     }
     // Move all of the kids from |startChild| up to but excluding |endChild|.  0 can be passed as the endChild to denote
     // that all the kids from |startChild| onwards should be added.
-    void moveChildrenTo(RenderBlock* to, RenderObject* startChild, RenderObject* endChild, bool fullRemoveInsert = false)
+    void moveChildrenTo(RenderBlock* toBlock, RenderObject* startChild, RenderObject* endChild, bool fullRemoveInsert = false)
     {
-        return moveChildrenTo(to, startChild, endChild, 0, fullRemoveInsert);
+        return moveChildrenTo(toBlock, startChild, endChild, 0, fullRemoveInsert);
     }
-    void moveChildrenTo(RenderBlock* to, RenderObject* startChild, RenderObject* endChild, RenderObject* beforeChild, bool fullRemoveInsert = false);
-    
+    void moveChildrenTo(RenderBlock* toBlock, RenderObject* startChild, RenderObject* endChild, RenderObject* beforeChild, bool fullRemoveInsert = false);
+
     LayoutUnit maxPositiveMarginBefore() const { return m_rareData ? m_rareData->m_margins.positiveMarginBefore() : RenderBlockRareData::positiveMarginBeforeDefault(this); }
     LayoutUnit maxNegativeMarginBefore() const { return m_rareData ? m_rareData->m_margins.negativeMarginBefore() : RenderBlockRareData::negativeMarginBeforeDefault(this); }
     LayoutUnit maxPositiveMarginAfter() const { return m_rareData ? m_rareData->m_margins.positiveMarginAfter() : RenderBlockRareData::positiveMarginAfterDefault(this); }
@@ -822,6 +842,7 @@ private:
     void updateScrollInfoAfterLayout();
 
     RenderObject* splitAnonymousBlocksAroundChild(RenderObject* beforeChild);
+    RenderObject* splitTablePartsAroundChild(RenderObject* beforeChild);
     void splitBlocks(RenderBlock* fromBlock, RenderBlock* toBlock, RenderBlock* middleBlock,
                      RenderObject* beforeChild, RenderBoxModelObject* oldCont);
     void splitFlow(RenderObject* beforeChild, RenderBlock* newBlockBox,
diff --git a/Source/WebCore/rendering/RenderBlockLineLayout.cpp b/Source/WebCore/rendering/RenderBlockLineLayout.cpp
index 406930fc1..47b632464 100755
--- a/Source/WebCore/rendering/RenderBlockLineLayout.cpp
+++ b/Source/WebCore/rendering/RenderBlockLineLayout.cpp
@@ -491,6 +491,9 @@ RootInlineBox* RenderBlock::constructLine(BidiRunList<BidiRun>& bidiRuns, const
         if (runCount == 2 && !r->m_object->isListMarker())
             isOnlyRun = (!style()->isLeftToRightDirection() ? bidiRuns.lastRun() : bidiRuns.firstRun())->m_object->isListMarker();
 
+        if (lineInfo.isEmpty())
+            continue;
+
         InlineBox* box = createInlineBoxForRenderer(r->m_object, false, isOnlyRun);
         r->m_box = box;
 
@@ -1093,8 +1096,8 @@ public:
     void updateRepaintRangeFromBox(RootInlineBox* box, LayoutUnit paginationDelta = 0)
     {
         m_usesRepaintBounds = true;
-        m_repaintLogicalTop = min(m_repaintLogicalTop, box->logicalTopVisualOverflow() + min(paginationDelta, 0));
-        m_repaintLogicalBottom = max(m_repaintLogicalBottom, box->logicalBottomVisualOverflow() + max(paginationDelta, 0));
+        m_repaintLogicalTop = min(m_repaintLogicalTop, box->logicalTopVisualOverflow() + min(paginationDelta, zeroLayoutUnit));
+        m_repaintLogicalBottom = max(m_repaintLogicalBottom, box->logicalBottomVisualOverflow() + max(paginationDelta, zeroLayoutUnit));
     }
     
     bool endLineMatched() const { return m_endLineMatched; }
@@ -1459,7 +1462,7 @@ void RenderBlock::layoutInlineChildren(bool relayoutChildren, LayoutUnit& repain
     LineLayoutState layoutState(isFullLayout, repaintLogicalTop, repaintLogicalBottom);
 
     if (isFullLayout)
-        lineBoxes()->deleteLineBoxes(renderArena());
+        deleteLineBoxTree();
 
     // Text truncation only kicks in if your overflow isn't visible and your text-overflow-mode isn't
     // clip.
@@ -1831,14 +1834,22 @@ static inline bool shouldCollapseWhiteSpace(const RenderStyle* style, const Line
         || (whitespacePosition == TrailingWhitespace && style->whiteSpace() == PRE_WRAP && (!lineInfo.isEmpty() || !lineInfo.previousLineBrokeCleanly()));
 }
 
-static bool inlineFlowRequiresLineBox(RenderInline* flow, const LineInfo& lineInfo)
+static bool requiresLineBoxForContent(RenderInline* flow, const LineInfo& lineInfo)
+{
+    RenderObject* parent = flow->parent();
+    if (flow->document()->inNoQuirksMode() 
+        && (flow->style(lineInfo.isFirstLine())->lineHeight() != parent->style(lineInfo.isFirstLine())->lineHeight()
+        || flow->style()->verticalAlign() != parent->style()->verticalAlign()
+        || !parent->style()->font().fontMetrics().hasIdenticalAscentDescentAndLineGap(flow->style()->font().fontMetrics())))
+        return true;
+    return false;
+}
+
+static bool alwaysRequiresLineBox(RenderInline* flow)
 {
     // FIXME: Right now, we only allow line boxes for inlines that are truly empty.
     // We need to fix this, though, because at the very least, inlines containing only
     // ignorable whitespace should should also have line boxes.
-    if (!flow->document()->inQuirksMode() && flow->style(lineInfo.isFirstLine())->lineHeight() != flow->parent()->style(lineInfo.isFirstLine())->lineHeight())
-        return true;
-
     return !flow->firstChild() && flow->hasInlineDirectionBordersPaddingOrMargin();
 }
 
@@ -1847,7 +1858,7 @@ static bool requiresLineBox(const InlineIterator& it, const LineInfo& lineInfo =
     if (it.m_obj->isFloatingOrPositioned())
         return false;
 
-    if (it.m_obj->isRenderInline() && !inlineFlowRequiresLineBox(toRenderInline(it.m_obj), lineInfo))
+    if (it.m_obj->isRenderInline() && !alwaysRequiresLineBox(toRenderInline(it.m_obj)) && !requiresLineBoxForContent(toRenderInline(it.m_obj), lineInfo))
         return false;
 
     if (!shouldCollapseWhiteSpace(it.m_obj->style(), lineInfo, whitespacePosition) || it.m_obj->isBR())
@@ -2235,8 +2246,12 @@ InlineIterator RenderBlock::LineBreaker::nextLineBreak(InlineBidiResolver& resol
             // to make sure that we stop to include this object and then start ignoring spaces again.
             // If this object is at the start of the line, we need to behave like list markers and
             // start ignoring spaces.
-            if (inlineFlowRequiresLineBox(flowBox, lineInfo)) {
-                lineInfo.setEmpty(false, m_block, &width);
+            bool requiresLineBox = alwaysRequiresLineBox(flowBox);
+            if (requiresLineBox || requiresLineBoxForContent(flowBox, lineInfo)) {
+                // An empty inline that only has line-height, vertical-align or font-metrics will only get a
+                // line box to affect the height of the line if the rest of the line is not empty.
+                if (requiresLineBox)
+                    lineInfo.setEmpty(false, m_block, &width);
                 if (ignoringSpaces) {
                     trailingObjects.clear();
                     addMidpoint(lineMidpointState, InlineIterator(0, current.m_obj, 0)); // Stop ignoring spaces.
@@ -2354,7 +2369,7 @@ InlineIterator RenderBlock::LineBreaker::nextLineBreak(InlineBidiResolver& resol
                     midWordBreak = width.committedWidth() + wrapW + charWidth > width.availableWidth();
                 }
 
-                if (lineBreakIteratorInfo.first != t) {
+                if ((lineBreakIteratorInfo.first != t) || (lineBreakIteratorInfo.second.string() != t->characters())) {
                     lineBreakIteratorInfo.first = t;
                     lineBreakIteratorInfo.second.reset(t->characters(), t->textLength(), style->locale());
                 }
@@ -2651,7 +2666,7 @@ InlineIterator RenderBlock::LineBreaker::nextLineBreak(InlineBidiResolver& resol
 
 void RenderBlock::addOverflowFromInlineChildren()
 {
-    LayoutUnit endPadding = hasOverflowClip() ? paddingEnd() : 0;
+    LayoutUnit endPadding = hasOverflowClip() ? paddingEnd() : zeroLayoutUnit;
     // FIXME: Need to find another way to do this, since scrollbars could show when we don't want them to.
     if (hasOverflowClip() && !endPadding && node() && node()->rendererIsEditable() && node() == node()->rootEditableElement() && style()->isLeftToRightDirection())
         endPadding = 1;
diff --git a/Source/WebCore/rendering/RenderBox.cpp b/Source/WebCore/rendering/RenderBox.cpp
index f3ca0b1d1..d21c2405d 100644
--- a/Source/WebCore/rendering/RenderBox.cpp
+++ b/Source/WebCore/rendering/RenderBox.cpp
@@ -746,6 +746,13 @@ bool RenderBox::needsPreferredWidthsRecalculation() const
     return style()->paddingStart().isPercent() || style()->paddingEnd().isPercent();
 }
 
+IntSize RenderBox::scrolledContentOffset() const
+{
+    ASSERT(hasOverflowClip());
+    ASSERT(hasLayer());
+    return layer()->scrolledContentOffset();
+}
+
 LayoutUnit RenderBox::minPreferredLogicalWidth() const
 {
     if (preferredLogicalWidthsDirty())
@@ -917,11 +924,12 @@ void RenderBox::paintBoxDecorations(PaintInfo& paintInfo, const LayoutPoint& pai
     // balloon layout is an example of this).
     borderFitAdjust(paintRect);
 
+    BackgroundBleedAvoidance bleedAvoidance = determineBackgroundBleedAvoidance(paintInfo.context);
+
     // FIXME: Should eventually give the theme control over whether the box shadow should paint, since controls could have
     // custom shadows of their own.
-    paintBoxShadow(paintInfo, paintRect, style(), Normal);
-
-    BackgroundBleedAvoidance bleedAvoidance = determineBackgroundBleedAvoidance(paintInfo.context);
+    if (!boxShadowShouldBeAppliedToBackground(bleedAvoidance))
+        paintBoxShadow(paintInfo, paintRect, style(), Normal);
 
     GraphicsContextStateSaver stateSaver(*paintInfo.context, false);
     if (bleedAvoidance == BackgroundBleedUseTransparencyLayer) {
@@ -941,12 +949,12 @@ void RenderBox::paintBoxDecorations(PaintInfo& paintInfo, const LayoutPoint& pai
         paintBackground(paintInfo, paintRect, bleedAvoidance);
 
         if (style()->hasAppearance())
-            theme()->paintDecorations(this, paintInfo, paintRect);
+            theme()->paintDecorations(this, paintInfo, pixelSnappedIntRect(paintRect));
     }
     paintBoxShadow(paintInfo, paintRect, style(), Inset);
 
     // The theme will tell us whether or not we should also paint the CSS border.
-    if ((!style()->hasAppearance() || (!themePainted && theme()->paintBorderOnly(this, paintInfo, paintRect))) && style()->hasBorder())
+    if ((!style()->hasAppearance() || (!themePainted && theme()->paintBorderOnly(this, paintInfo, pixelSnappedIntRect(paintRect)))) && style()->hasBorder())
         paintBorder(paintInfo, paintRect, style(), bleedAvoidance);
 
     if (bleedAvoidance == BackgroundBleedUseTransparencyLayer)
@@ -1186,7 +1194,7 @@ bool RenderBox::pushContentsClip(PaintInfo& paintInfo, const LayoutPoint& accumu
         paintObject(paintInfo, accumulatedOffset);
         paintInfo.phase = PaintPhaseChildBlockBackgrounds;
     }
-    IntRect clipRect(isControlClip ? controlClipRect(accumulatedOffset) : overflowClipRect(accumulatedOffset, paintInfo.renderRegion));
+    IntRect clipRect = pixelSnappedIntRect(isControlClip ? controlClipRect(accumulatedOffset) : overflowClipRect(accumulatedOffset, paintInfo.renderRegion));
     paintInfo.context->save();
     if (style()->hasBorderRadius())
         paintInfo.context->addRoundedRectClip(style()->getRoundedInnerBorderFor(LayoutRect(accumulatedOffset, size())));
@@ -1251,11 +1259,50 @@ LayoutRect RenderBox::clipRect(const LayoutPoint& location, RenderRegion* region
     return clipRect;
 }
 
+LayoutUnit RenderBox::shrinkLogicalWidthToAvoidFloats(LayoutUnit childMarginStart, LayoutUnit childMarginEnd, const RenderBlock* cb, RenderRegion* region, LayoutUnit offsetFromLogicalTopOfFirstPage)
+{    
+    RenderRegion* containingBlockRegion = 0;
+    LayoutUnit logicalTopPosition = logicalTop();
+    LayoutUnit adjustedPageOffsetForContainingBlock = offsetFromLogicalTopOfFirstPage - logicalTop();
+    if (region) {
+        LayoutUnit offsetFromLogicalTopOfRegion = region ? region->offsetFromLogicalTopOfFirstPage() - offsetFromLogicalTopOfFirstPage : 0;
+        logicalTopPosition = max(logicalTopPosition, logicalTopPosition + offsetFromLogicalTopOfRegion);
+        containingBlockRegion = cb->clampToStartAndEndRegions(region);
+    }
+
+    LayoutUnit result = cb->availableLogicalWidthForLine(logicalTopPosition, false, containingBlockRegion, adjustedPageOffsetForContainingBlock) - childMarginStart - childMarginEnd;
+
+    // We need to see if margins on either the start side or the end side can contain the floats in question. If they can,
+    // then just using the line width is inaccurate. In the case where a float completely fits, we don't need to use the line
+    // offset at all, but can instead push all the way to the content edge of the containing block. In the case where the float
+    // doesn't fit, we can use the line offset, but we need to grow it by the margin to reflect the fact that the margin was
+    // "consumed" by the float. Negative margins aren't consumed by the float, and so we ignore them.
+    if (childMarginStart > 0) {
+        LayoutUnit startContentSide = cb->startOffsetForContent(containingBlockRegion, adjustedPageOffsetForContainingBlock);
+        LayoutUnit startContentSideWithMargin = startContentSide + childMarginStart;
+        LayoutUnit startOffset = cb->startOffsetForLine(logicalTopPosition, false, containingBlockRegion, adjustedPageOffsetForContainingBlock);
+        if (startOffset > startContentSideWithMargin)
+            result += childMarginStart;
+        else
+            result += startOffset - startContentSide;
+    }
+    
+    if (childMarginEnd > 0) {
+        LayoutUnit endContentSide = cb->endOffsetForContent(containingBlockRegion, adjustedPageOffsetForContainingBlock);
+        LayoutUnit endContentSideWithMargin = endContentSide + childMarginEnd;
+        LayoutUnit endOffset = cb->endOffsetForLine(logicalTopPosition, false, containingBlockRegion, adjustedPageOffsetForContainingBlock);
+        if (endOffset > endContentSideWithMargin)
+            result += childMarginEnd;
+        else
+            result += endOffset - endContentSide;
+    }
+
+    return result;
+}
+
 LayoutUnit RenderBox::containingBlockLogicalWidthForContent() const
 {
     RenderBlock* cb = containingBlock();
-    if (shrinkToAvoidFloats() && !inRenderFlowThread())
-        return cb->availableLogicalWidthForLine(logicalTop(), false);
     return cb->availableLogicalWidth();
 }
 
@@ -1266,10 +1313,6 @@ LayoutUnit RenderBox::containingBlockLogicalWidthForContentInRegion(RenderRegion
 
     RenderBlock* cb = containingBlock();
     RenderRegion* containingBlockRegion = cb->clampToStartAndEndRegions(region);
-    if (shrinkToAvoidFloats()) {
-        LayoutUnit offsetFromLogicalTopOfRegion = region->offsetFromLogicalTopOfFirstPage() - offsetFromLogicalTopOfFirstPage;
-        return cb->availableLogicalWidthForLine(max(logicalTop(), logicalTop() + offsetFromLogicalTopOfRegion), false, containingBlockRegion, offsetFromLogicalTopOfFirstPage - logicalTop());
-    }
     LayoutUnit result = cb->availableLogicalWidth();
     RenderBoxRegionInfo* boxInfo = cb->renderBoxRegionInfo(containingBlockRegion, offsetFromLogicalTopOfFirstPage - logicalTop());
     if (!boxInfo)
@@ -1397,7 +1440,7 @@ LayoutSize RenderBox::offsetFromContainer(RenderObject* o, const LayoutPoint& po
     }
 
     if (o->hasOverflowClip())
-        offset -= toRenderBox(o)->layer()->scrolledContentOffset();
+        offset -= toRenderBox(o)->scrolledContentOffset();
 
     if (style()->position() == AbsolutePosition && o->isRelPositioned() && o->isRenderInline())
         offset += toRenderInline(o)->relativePositionedInlineOffset(this);
@@ -1596,7 +1639,7 @@ void RenderBox::computeRectForRepaint(RenderBoxModelObject* repaintContainer, La
         // o->height() is inaccurate if we're in the middle of a layout of |o|, so use the
         // layer's size instead.  Even if the layer's size is wrong, the layer itself will repaint
         // anyway if its size does change.
-        topLeft -= containerBox->layer()->scrolledContentOffset(); // For overflow:auto/scroll/hidden.
+        topLeft -= containerBox->scrolledContentOffset(); // For overflow:auto/scroll/hidden.
 
         LayoutRect repaintRect(topLeft, rect.size());
         LayoutRect boxRect(LayoutPoint(), containerBox->layer()->size());
@@ -1691,11 +1734,11 @@ void RenderBox::computeLogicalWidthInRegion(RenderRegion* region, LayoutUnit off
         setLogicalWidth(logicalWidthLength.value() + borderAndPaddingLogicalWidth());
     else {
         // Calculate LogicalWidth
-        setLogicalWidth(computeLogicalWidthUsing(LogicalWidth, containerWidthInInlineDirection));
+        setLogicalWidth(computeLogicalWidthInRegionUsing(LogicalWidth, containerWidthInInlineDirection, cb, region, offsetFromLogicalTopOfFirstPage));
 
         // Calculate MaxLogicalWidth
         if (!styleToUse->logicalMaxWidth().isUndefined()) {
-            LayoutUnit maxLogicalWidth = computeLogicalWidthUsing(MaxLogicalWidth, containerWidthInInlineDirection);
+            LayoutUnit maxLogicalWidth = computeLogicalWidthInRegionUsing(MaxLogicalWidth, containerWidthInInlineDirection, cb, region, offsetFromLogicalTopOfFirstPage);
             if (logicalWidth() > maxLogicalWidth) {
                 setLogicalWidth(maxLogicalWidth);
                 logicalWidthLength = styleToUse->logicalMaxWidth();
@@ -1703,7 +1746,7 @@ void RenderBox::computeLogicalWidthInRegion(RenderRegion* region, LayoutUnit off
         }
 
         // Calculate MinLogicalWidth
-        LayoutUnit minLogicalWidth = computeLogicalWidthUsing(MinLogicalWidth, containerWidthInInlineDirection);
+        LayoutUnit minLogicalWidth = computeLogicalWidthInRegionUsing(MinLogicalWidth, containerWidthInInlineDirection, cb, region, offsetFromLogicalTopOfFirstPage);
         if (logicalWidth() < minLogicalWidth) {
             setLogicalWidth(minLogicalWidth);
             logicalWidthLength = styleToUse->logicalMinWidth();
@@ -1728,7 +1771,8 @@ void RenderBox::computeLogicalWidthInRegion(RenderRegion* region, LayoutUnit off
         cb->setMarginEndForChild(this, containerLogicalWidth - logicalWidth() - cb->marginStartForChild(this));
 }
 
-LayoutUnit RenderBox::computeLogicalWidthUsing(LogicalWidthType widthType, LayoutUnit availableLogicalWidth)
+LayoutUnit RenderBox::computeLogicalWidthInRegionUsing(LogicalWidthType widthType, LayoutUnit availableLogicalWidth,
+    const RenderBlock* cb, RenderRegion* region, LayoutUnit offsetFromLogicalTopOfFirstPage)
 {
     LayoutUnit logicalWidthResult = logicalWidth();
     RenderStyle* styleToUse = style();
@@ -1745,6 +1789,9 @@ LayoutUnit RenderBox::computeLogicalWidthUsing(LogicalWidthType widthType, Layou
         LayoutUnit marginEnd = styleToUse->marginEnd().calcMinValue(availableLogicalWidth);
         logicalWidthResult = availableLogicalWidth - marginStart - marginEnd;
 
+        if (shrinkToAvoidFloats() && cb->containsFloats())
+            logicalWidthResult = shrinkLogicalWidthToAvoidFloats(marginStart, marginEnd, cb, region, offsetFromLogicalTopOfFirstPage);
+
         if (sizesToIntrinsicLogicalWidth(widthType)) {
             logicalWidthResult = max(logicalWidthResult, minPreferredLogicalWidth());
             logicalWidthResult = min(logicalWidthResult, maxPreferredLogicalWidth());
@@ -1997,7 +2044,6 @@ void RenderBox::computeLogicalHeight()
         LayoutUnit heightResult;
         if (checkMinMaxHeight) {
             heightResult = computeLogicalHeightUsing(styleToUse->logicalHeight());
-            // FIXME: Use < 0 or roughlyEquals when we move to float, see https://bugs.webkit.org/show_bug.cgi?id=66148
             if (heightResult == -1)
                 heightResult = logicalHeight();
             LayoutUnit minH = computeLogicalHeightUsing(styleToUse->logicalMinHeight()); // Leave as -1 if unset.
@@ -2056,7 +2102,6 @@ LayoutUnit RenderBox::computeLogicalHeightUsing(const Length& h)
             logicalHeight = h.value();
         else if (h.isPercent())
             logicalHeight = computePercentageLogicalHeight(h);
-        // FIXME: Use < 0 or roughlyEquals when we move to float, see https://bugs.webkit.org/show_bug.cgi?id=66148
         if (logicalHeight != -1) {
             logicalHeight = computeBorderBoxLogicalHeight(logicalHeight);
             return logicalHeight;
@@ -2123,7 +2168,6 @@ LayoutUnit RenderBox::computePercentageLogicalHeight(const Length& height)
     else if (cbstyle->logicalHeight().isPercent() && !isPositionedWithSpecifiedHeight) {
         // We need to recur and compute the percentage height for our containing block.
         result = cb->computePercentageLogicalHeight(cbstyle->logicalHeight());
-        // FIXME: Use < 0 or roughlyEquals when we move to float, see https://bugs.webkit.org/show_bug.cgi?id=66148
         if (result != -1)
             result = cb->computeContentBoxLogicalHeight(result);
     } else if (cb->isRenderView() || (cb->isBody() && document()->inQuirksMode()) || isPositionedWithSpecifiedHeight) {
@@ -2138,7 +2182,6 @@ LayoutUnit RenderBox::computePercentageLogicalHeight(const Length& height)
         // always.  Note we could only hit this case by recurring into computePercentageLogicalHeight on a positioned containing block.
         result = cb->computeContentBoxLogicalHeight(cb->availableLogicalHeight());
 
-    // FIXME: Use < 0 or roughlyEquals when we move to float, see https://bugs.webkit.org/show_bug.cgi?id=66148
     if (result != -1) {
         result = height.calcValue(result);
         if (includeBorderPadding) {
@@ -3444,9 +3487,9 @@ VisiblePosition RenderBox::positionForPoint(const LayoutPoint& point)
         
         RenderBox* renderer = toRenderBox(renderObject);
 
-        LayoutUnit top = renderer->borderTop() + renderer->paddingTop() + (isTableRow() ? 0 : renderer->y());
+        LayoutUnit top = renderer->borderTop() + renderer->paddingTop() + (isTableRow() ? zeroLayoutUnit : renderer->y());
         LayoutUnit bottom = top + renderer->contentHeight();
-        LayoutUnit left = renderer->borderLeft() + renderer->paddingLeft() + (isTableRow() ? 0 : renderer->x());
+        LayoutUnit left = renderer->borderLeft() + renderer->paddingLeft() + (isTableRow() ? zeroLayoutUnit : renderer->x());
         LayoutUnit right = left + renderer->contentWidth();
         
         if (point.x() <= right && point.x() >= left && point.y() <= top && point.y() >= bottom) {
diff --git a/Source/WebCore/rendering/RenderBox.h b/Source/WebCore/rendering/RenderBox.h
index f9b852c54..31ec39a20 100644
--- a/Source/WebCore/rendering/RenderBox.h
+++ b/Source/WebCore/rendering/RenderBox.h
@@ -151,6 +151,7 @@ public:
     // respectively are flipped when compared to their physical counterparts.  For example minX is on the left in vertical-lr,
     // but it is on the right in vertical-rl.
     LayoutRect layoutOverflowRect() const { return m_overflow ? m_overflow->layoutOverflowRect() : clientBoxRect(); }
+    IntRect pixelSnappedLayoutOverflowRect() const { return pixelSnappedIntRect(layoutOverflowRect()); }
     LayoutUnit minYLayoutOverflow() const { return m_overflow? m_overflow->minYLayoutOverflow() : borderTop(); }
     LayoutUnit maxYLayoutOverflow() const { return m_overflow ? m_overflow->maxYLayoutOverflow() : borderTop() + clientHeight(); }
     LayoutUnit minXLayoutOverflow() const { return m_overflow ? m_overflow->minXLayoutOverflow() : borderLeft(); }
@@ -160,9 +161,9 @@ public:
     LayoutUnit logicalRightLayoutOverflow() const { return style()->isHorizontalWritingMode() ? maxXLayoutOverflow() : maxYLayoutOverflow(); }
     
     virtual LayoutRect visualOverflowRect() const { return m_overflow ? m_overflow->visualOverflowRect() : borderBoxRect(); }
-    LayoutUnit minYVisualOverflow() const { return m_overflow? m_overflow->minYVisualOverflow() : 0; }
+    LayoutUnit minYVisualOverflow() const { return m_overflow? m_overflow->minYVisualOverflow() : zeroLayoutUnit; }
     LayoutUnit maxYVisualOverflow() const { return m_overflow ? m_overflow->maxYVisualOverflow() : height(); }
-    LayoutUnit minXVisualOverflow() const { return m_overflow ? m_overflow->minXVisualOverflow() : 0; }
+    LayoutUnit minXVisualOverflow() const { return m_overflow ? m_overflow->minXVisualOverflow() : zeroLayoutUnit; }
     LayoutUnit maxXVisualOverflow() const { return m_overflow ? m_overflow->maxXVisualOverflow() : width(); }
     LayoutUnit logicalLeftVisualOverflow() const { return style()->isHorizontalWritingMode() ? minXVisualOverflow() : minYVisualOverflow(); }
     LayoutUnit logicalRightVisualOverflow() const { return style()->isHorizontalWritingMode() ? maxXVisualOverflow() : maxYVisualOverflow(); }
@@ -313,7 +314,7 @@ public:
     virtual void computeLogicalHeight();
 
     RenderBoxRegionInfo* renderBoxRegionInfo(RenderRegion*, LayoutUnit offsetFromLogicalTopOfFirstPage, RenderBoxRegionInfoFlags = CacheRenderBoxRegionInfo) const;
-    void computeLogicalWidthInRegion(RenderRegion* = 0, LayoutUnit offsetFromLogicalTopOfFirstPage = 0);
+    void computeLogicalWidthInRegion(RenderRegion* = 0, LayoutUnit offsetFromLogicalTopOfFirstPage = zeroLayoutUnit);
 
     bool stretchesToViewport() const
     {
@@ -329,7 +330,9 @@ public:
     bool sizesToIntrinsicLogicalWidth(LogicalWidthType) const;
     virtual bool stretchesToMinIntrinsicLogicalWidth() const { return false; }
 
-    LayoutUnit computeLogicalWidthUsing(LogicalWidthType, LayoutUnit availableLogicalWidth);
+    LayoutUnit shrinkLogicalWidthToAvoidFloats(LayoutUnit childMarginStart, LayoutUnit childMarginEnd, const RenderBlock* cb, RenderRegion*, LayoutUnit offsetFromLogicalTopOfFirstPage);
+
+    LayoutUnit computeLogicalWidthInRegionUsing(LogicalWidthType, LayoutUnit availableLogicalWidth, const RenderBlock* containingBlock, RenderRegion*, LayoutUnit offsetFromLogicalTopOfFirstPage);
     LayoutUnit computeLogicalHeightUsing(const Length& height);
     LayoutUnit computeReplacedLogicalWidthUsing(Length width) const;
     LayoutUnit computeReplacedLogicalWidthRespectingMinMaxWidth(LayoutUnit logicalWidth, bool includeMaxWidth = true) const;
@@ -444,6 +447,8 @@ public:
     virtual bool needsPreferredWidthsRecalculation() const;
     virtual void computeIntrinsicRatioInformation(FloatSize& /* intrinsicSize */, double& /* intrinsicRatio */, bool& /* isPercentageIntrinsicSize */) const { }
 
+    IntSize scrolledContentOffset() const;
+
 protected:
     virtual void willBeDestroyed();
 
@@ -459,6 +464,8 @@ protected:
 
     void paintMaskImages(const PaintInfo&, const LayoutRect&);
 
+    BackgroundBleedAvoidance determineBackgroundBleedAvoidance(GraphicsContext*) const;
+
 #if PLATFORM(MAC)
     void paintCustomHighlight(const LayoutPoint&, const AtomicString& type, bool behindText);
 #endif
@@ -503,8 +510,6 @@ private:
     // These include tables, positioned objects, floats and flexible boxes.
     virtual void computePreferredLogicalWidths() { setPreferredLogicalWidthsDirty(false); }
 
-    BackgroundBleedAvoidance determineBackgroundBleedAvoidance(GraphicsContext*) const;
-
 private:
     // The width/height of the contents + borders + padding.  The x/y location is relative to our container (which is not always our parent).
     LayoutRect m_frameRect;
diff --git a/Source/WebCore/rendering/RenderBoxModelObject.cpp b/Source/WebCore/rendering/RenderBoxModelObject.cpp
index 3aadee902..e3ab32180 100644
--- a/Source/WebCore/rendering/RenderBoxModelObject.cpp
+++ b/Source/WebCore/rendering/RenderBoxModelObject.cpp
@@ -168,8 +168,6 @@ bool ImageQualityController::shouldPaintAtLowQuality(GraphicsContext* context, R
 
     const AffineTransform& currentTransform = context->getCTM();
     bool contextIsScaled = !currentTransform.isIdentityOrTranslationOrFlipped();
-    // FIXME: Change to use roughlyEquals when we move to float.
-    // See https://bugs.webkit.org/show_bug.cgi?id=66148
     if (!contextIsScaled && size == imageSize) {
         // There is no scale in effect. If we had a scale in effect before, we can just remove this object from the list.
         removeLayer(object, innerMap, layer);
@@ -192,8 +190,6 @@ bool ImageQualityController::shouldPaintAtLowQuality(GraphicsContext* context, R
     // If this is the first time resizing this image, or its size is the
     // same as the last resize, draw at high res, but record the paint
     // size and set the timer.
-    // FIXME: Change to use roughlyEquals when we move to float.
-    // See https://bugs.webkit.org/show_bug.cgi?id=66148
     if (isFirstResize || oldSize == size) {
         restartTimer();
         set(object, innerMap, layer, size);
@@ -362,7 +358,7 @@ void RenderBoxModelObject::styleDidChange(StyleDifference diff, const RenderStyl
     updateBoxModelInfoFromStyle();
     
     if (requiresLayer()) {
-        if (!layer()) {
+        if (!layer() && layerCreationAllowedForSubtree()) {
             if (s_wasFloating && isFloating())
                 setChildNeedsLayout(true);
             m_layer = new (renderArena()) RenderLayer(this);
@@ -401,8 +397,26 @@ void RenderBoxModelObject::updateBoxModelInfoFromStyle()
     setHorizontalWritingMode(styleToUse->isHorizontalWritingMode());
 }
 
+enum RelPosAxis { RelPosX, RelPosY };
+
+static LayoutUnit accumulateRelativePositionOffsets(const RenderObject* child, RelPosAxis axis)
+{
+    if (!child->isAnonymousBlock() || !child->isRelPositioned())
+        return 0;
+    LayoutUnit offset = 0;
+    RenderObject* p = toRenderBlock(child)->inlineElementContinuation();
+    while (p && p->isRenderInline()) {
+        if (p->isRelPositioned())
+            offset += (axis == RelPosX) ? toRenderInline(p)->relativePositionOffsetX() : toRenderInline(p)->relativePositionOffsetY();
+        p = p->parent();
+    }
+    return offset;
+}
+
 LayoutUnit RenderBoxModelObject::relativePositionOffsetX() const
 {
+    LayoutUnit offset = accumulateRelativePositionOffsets(this, RelPosX);
+
     // Objects that shrink to avoid floats normally use available line width when computing containing block width.  However
     // in the case of relative positioning using percentages, we can't do this.  The offset should always be resolved using the
     // available width of the containing block.  Therefore we don't use containingBlockLogicalWidthForContent() here, but instead explicitly
@@ -411,19 +425,20 @@ LayoutUnit RenderBoxModelObject::relativePositionOffsetX() const
         RenderBlock* cb = containingBlock();
         if (!style()->right().isAuto() && !cb->style()->isLeftToRightDirection())
             return -style()->right().calcValue(cb->availableWidth());
-        return style()->left().calcValue(cb->availableWidth());
+        return offset + style()->left().calcValue(cb->availableWidth());
     }
     if (!style()->right().isAuto()) {
         RenderBlock* cb = containingBlock();
-        return -style()->right().calcValue(cb->availableWidth());
+        return offset + -style()->right().calcValue(cb->availableWidth());
     }
-    return 0;
+    return offset;
 }
 
 LayoutUnit RenderBoxModelObject::relativePositionOffsetY() const
 {
+    LayoutUnit offset = accumulateRelativePositionOffsets(this, RelPosY);
+    
     RenderBlock* containingBlock = this->containingBlock();
-
     // If the containing block of a relatively positioned element does not
     // specify a height, a percentage top or bottom offset should be resolved as
     // auto. An exception to this is if the containing block has the WinIE quirk
@@ -434,15 +449,15 @@ LayoutUnit RenderBoxModelObject::relativePositionOffsetY() const
         && (!containingBlock->style()->height().isAuto()
             || !style()->top().isPercent()
             || containingBlock->stretchesToViewport()))
-        return style()->top().calcValue(containingBlock->availableHeight());
+        return offset + style()->top().calcValue(containingBlock->availableHeight());
 
     if (!style()->bottom().isAuto()
         && (!containingBlock->style()->height().isAuto()
             || !style()->bottom().isPercent()
             || containingBlock->stretchesToViewport()))
-        return -style()->bottom().calcValue(containingBlock->availableHeight());
+        return offset + -style()->bottom().calcValue(containingBlock->availableHeight());
 
-    return 0;
+    return offset;
 }
 
 LayoutUnit RenderBoxModelObject::offsetLeft() const
@@ -453,7 +468,7 @@ LayoutUnit RenderBoxModelObject::offsetLeft() const
         return 0;
     
     RenderBoxModelObject* offsetPar = offsetParent();
-    LayoutUnit xPos = (isBox() ? toRenderBox(this)->left() : 0);
+    LayoutUnit xPos = (isBox() ? toRenderBox(this)->left() : zeroLayoutUnit);
     
     // If the offsetParent of the element is null, or is the HTML body element,
     // return the distance between the canvas origin and the left border edge 
@@ -487,7 +502,7 @@ LayoutUnit RenderBoxModelObject::offsetTop() const
         return 0;
     
     RenderBoxModelObject* offsetPar = offsetParent();
-    LayoutUnit yPos = (isBox() ? toRenderBox(this)->top() : 0);
+    LayoutUnit yPos = (isBox() ? toRenderBox(this)->top() : zeroLayoutUnit);
     
     // If the offsetParent of the element is null, or is the HTML body element,
     // return the distance between the canvas origin and the top border edge 
@@ -619,6 +634,19 @@ static LayoutRect backgroundRectAdjustedForBleedAvoidance(GraphicsContext* conte
     return adjustedRect;
 }
 
+static void applyBoxShadowForBackground(GraphicsContext* context, RenderStyle* style)
+{
+    const ShadowData* boxShadow = style->boxShadow();
+    while (boxShadow->style() != Normal)
+        boxShadow = boxShadow->next();
+
+    FloatSize shadowOffset(boxShadow->x(), boxShadow->y());
+    if (!boxShadow->isWebkitBoxShadow())
+        context->setShadow(shadowOffset, boxShadow->blur(), boxShadow->color(), style->colorSpace());
+    else
+        context->setLegacyShadow(shadowOffset, boxShadow->blur(), boxShadow->color(), style->colorSpace());
+}
+
 void RenderBoxModelObject::paintFillLayerExtended(const PaintInfo& paintInfo, const Color& color, const FillLayer* bgLayer, const LayoutRect& rect,
     BackgroundBleedAvoidance bleedAvoidance, InlineFlowBox* box, const LayoutSize& boxSize, CompositeOperator op, RenderObject* backgroundObject)
 {
@@ -669,11 +697,16 @@ void RenderBoxModelObject::paintFillLayerExtended(const PaintInfo& paintInfo, co
         if (!colorVisible)
             return;
 
+        bool boxShadowShouldBeAppliedToBackground = this->boxShadowShouldBeAppliedToBackground(bleedAvoidance, box);
+        GraphicsContextStateSaver shadowStateSaver(*context, boxShadowShouldBeAppliedToBackground);
+        if (boxShadowShouldBeAppliedToBackground)
+            applyBoxShadowForBackground(context, style());
+
         if (hasRoundedBorder && bleedAvoidance != BackgroundBleedUseTransparencyLayer) {
             RoundedRect border = getBackgroundRoundedRect(backgroundRectAdjustedForBleedAvoidance(context, rect, bleedAvoidance), box, boxSize.width(), boxSize.height(), includeLeftEdge, includeRightEdge);
             context->fillRoundedRect(border, bgColor, style()->colorSpace());
         } else
-            context->fillRect(rect, bgColor, style()->colorSpace());
+            context->fillRect(pixelSnappedIntRect(rect), bgColor, style()->colorSpace());
         
         return;
     }
@@ -685,49 +718,53 @@ void RenderBoxModelObject::paintFillLayerExtended(const PaintInfo& paintInfo, co
         context->addRoundedRectClip(border);
     }
     
-    LayoutUnit bLeft = includeLeftEdge ? borderLeft() : 0;
-    LayoutUnit bRight = includeRightEdge ? borderRight() : 0;
-    LayoutUnit pLeft = includeLeftEdge ? paddingLeft() : 0;
-    LayoutUnit pRight = includeRightEdge ? paddingRight() : 0;
+    LayoutUnit bLeft = includeLeftEdge ? borderLeft() : zeroLayoutUnit;
+    LayoutUnit bRight = includeRightEdge ? borderRight() : zeroLayoutUnit;
+    LayoutUnit pLeft = includeLeftEdge ? paddingLeft() : zeroLayoutUnit;
+    LayoutUnit pRight = includeRightEdge ? paddingRight() : zeroLayoutUnit;
 
     GraphicsContextStateSaver clipWithScrollingStateSaver(*context, clippedWithLocalScrolling);
     LayoutRect scrolledPaintRect = rect;
     if (clippedWithLocalScrolling) {
         // Clip to the overflow area.
-        context->clip(toRenderBox(this)->overflowClipRect(rect.location(), paintInfo.renderRegion));
+        RenderBox* thisBox = toRenderBox(this);
+        context->clip(thisBox->overflowClipRect(rect.location(), paintInfo.renderRegion));
         
         // Adjust the paint rect to reflect a scrolled content box with borders at the ends.
-        LayoutSize offset = layer()->scrolledContentOffset();
+        IntSize offset = thisBox->scrolledContentOffset();
         scrolledPaintRect.move(-offset);
         scrolledPaintRect.setWidth(bLeft + layer()->scrollWidth() + bRight);
         scrolledPaintRect.setHeight(borderTop() + layer()->scrollHeight() + borderBottom());
     }
     
     GraphicsContextStateSaver backgroundClipStateSaver(*context, false);
+    OwnPtr<ImageBuffer> maskImage;
+    IntRect maskRect;
+
     if (bgLayer->clip() == PaddingFillBox || bgLayer->clip() == ContentFillBox) {
         // Clip to the padding or content boxes as necessary.
         bool includePadding = bgLayer->clip() == ContentFillBox;
-        LayoutRect clipRect = LayoutRect(scrolledPaintRect.x() + bLeft + (includePadding ? pLeft : 0),
-                                   scrolledPaintRect.y() + borderTop() + (includePadding ? paddingTop() : 0),
-                                   scrolledPaintRect.width() - bLeft - bRight - (includePadding ? pLeft + pRight : 0),
-                                   scrolledPaintRect.height() - borderTop() - borderBottom() - (includePadding ? paddingTop() + paddingBottom() : 0));
+        LayoutRect clipRect = LayoutRect(scrolledPaintRect.x() + bLeft + (includePadding ? pLeft : zeroLayoutUnit),
+                                   scrolledPaintRect.y() + borderTop() + (includePadding ? paddingTop() : zeroLayoutUnit),
+                                   scrolledPaintRect.width() - bLeft - bRight - (includePadding ? pLeft + pRight : zeroLayoutUnit),
+                                   scrolledPaintRect.height() - borderTop() - borderBottom() - (includePadding ? paddingTop() + paddingBottom() : zeroLayoutUnit));
         backgroundClipStateSaver.save();
         context->clip(clipRect);
     } else if (bgLayer->clip() == TextFillBox) {
         // We have to draw our text into a mask that can then be used to clip background drawing.
         // First figure out how big the mask has to be.  It should be no bigger than what we need
         // to actually render, so we should intersect the dirty rect with the border box of the background.
-        LayoutRect maskRect = rect;
+        maskRect = pixelSnappedIntRect(rect);
         maskRect.intersect(paintInfo.rect);
-        
+
         // Now create the mask.
-        OwnPtr<ImageBuffer> maskImage = context->createCompatibleBuffer(maskRect.size());
+        maskImage = context->createCompatibleBuffer(maskRect.size());
         if (!maskImage)
             return;
-        
+
         GraphicsContext* maskImageContext = maskImage->context();
         maskImageContext->translate(-maskRect.x(), -maskRect.y());
-        
+
         // Now add the text to the clip.  We do this by painting using a special paint phase that signals to
         // InlineTextBoxes that they should just add their contents to the clip.
         PaintInfo info(maskImageContext, maskRect, PaintPhaseTextClip, true, 0, paintInfo.renderRegion, 0);
@@ -738,12 +775,13 @@ void RenderBoxModelObject::paintFillLayerExtended(const PaintInfo& paintInfo, co
             LayoutSize localOffset = isBox() ? toRenderBox(this)->locationOffset() : LayoutSize();
             paint(info, scrolledPaintRect.location() - localOffset);
         }
-        
+
         // The mask has been created.  Now we just need to clip to it.
         backgroundClipStateSaver.save();
-        context->clipToImageBuffer(maskImage.get(), maskRect);
+        context->clip(maskRect);
+        context->beginTransparencyLayer(1);
     }
-    
+
     // Only fill with a base color (e.g., white) if we're the root document, since iframes/frames with
     // no background in the child document should show the parent's background.
     bool isOpaqueRoot = false;
@@ -777,8 +815,11 @@ void RenderBoxModelObject::paintFillLayerExtended(const PaintInfo& paintInfo, co
 
     // Paint the color first underneath all images.
     if (!bgLayer->next()) {
-        LayoutRect backgroundRect(scrolledPaintRect);
-        backgroundRect.intersect(paintInfo.rect);
+        IntRect backgroundRect(pixelSnappedIntRect(scrolledPaintRect));
+        bool boxShadowShouldBeAppliedToBackground = this->boxShadowShouldBeAppliedToBackground(bleedAvoidance, box);
+        if (!boxShadowShouldBeAppliedToBackground)
+            backgroundRect.intersect(paintInfo.rect);
+
         // If we have an alpha and we are painting the root element, go ahead and blend with the base background color.
         Color baseColor;
         bool shouldClearBackground = false;
@@ -788,6 +829,10 @@ void RenderBoxModelObject::paintFillLayerExtended(const PaintInfo& paintInfo, co
                 shouldClearBackground = true;
         }
 
+        GraphicsContextStateSaver shadowStateSaver(*context, boxShadowShouldBeAppliedToBackground);
+        if (boxShadowShouldBeAppliedToBackground)
+            applyBoxShadowForBackground(context, style());
+
         if (baseColor.alpha()) {
             if (bgColor.alpha())
                 baseColor = baseColor.blend(bgColor);
@@ -814,6 +859,11 @@ void RenderBoxModelObject::paintFillLayerExtended(const PaintInfo& paintInfo, co
                 compositeOp, useLowQualityScaling);
         }
     }
+
+    if (bgLayer->clip() == TextFillBox) {
+        context->drawImageBuffer(maskImage.get(), ColorSpaceDeviceRGB, maskRect, CompositeDestinationIn);
+        context->endTransparencyLayer();
+    }
 }
 
 static inline LayoutUnit resolveWidthForRatio(LayoutUnit height, const FloatSize& intrinsicRatio)
@@ -1064,7 +1114,7 @@ void RenderBoxModelObject::calculateBackgroundImageGeometry(const FillLayer* fil
         } else
             positioningAreaSize = LayoutSize(paintRect.width() - left - right, paintRect.height() - top - bottom);
     } else {
-        geometry.setDestRect(viewRect());
+        geometry.setDestRect(pixelSnappedIntRect(viewRect()));
         positioningAreaSize = geometry.destRect().size();
     }
 
@@ -1404,6 +1454,14 @@ static inline bool includesEdge(BorderEdgeFlags flags, BoxSide side)
     return flags & edgeFlagForSide(side);
 }
 
+static inline bool includesAdjacentEdges(BorderEdgeFlags flags)
+{
+    return (flags & (TopBorderEdge | RightBorderEdge)) == (TopBorderEdge | RightBorderEdge)
+        || (flags & (RightBorderEdge | BottomBorderEdge)) == (RightBorderEdge | BottomBorderEdge)
+        || (flags & (BottomBorderEdge | LeftBorderEdge)) == (BottomBorderEdge | LeftBorderEdge)
+        || (flags & (LeftBorderEdge | TopBorderEdge)) == (LeftBorderEdge | TopBorderEdge);
+}
+
 inline bool edgesShareColor(const BorderEdge& firstEdge, const BorderEdge& secondEdge)
 {
     return firstEdge.color == secondEdge.color;
@@ -1527,7 +1585,7 @@ static bool joinRequiresMitre(BoxSide side, BoxSide adjacentSide, const BorderEd
 }
 
 void RenderBoxModelObject::paintOneBorderSide(GraphicsContext* graphicsContext, const RenderStyle* style, const RoundedRect& outerBorder, const RoundedRect& innerBorder,
-    const LayoutRect& sideRect, BoxSide side, BoxSide adjacentSide1, BoxSide adjacentSide2, const BorderEdge edges[], const Path* path,
+    const IntRect& sideRect, BoxSide side, BoxSide adjacentSide1, BoxSide adjacentSide2, const BorderEdge edges[], const Path* path,
     BackgroundBleedAvoidance bleedAvoidance, bool includeLogicalLeftEdge, bool includeLogicalRightEdge, bool antialias, const Color* overrideColor)
 {
     const BorderEdge& edgeToRender = edges[side];
@@ -1572,9 +1630,9 @@ void RenderBoxModelObject::paintOneBorderSide(GraphicsContext* graphicsContext,
     }
 }
 
-static LayoutRect calculateSideRect(const RoundedRect& outerBorder, const BorderEdge edges[], int side)
+static IntRect calculateSideRect(const RoundedRect& outerBorder, const BorderEdge edges[], int side)
 {
-    LayoutRect sideRect = outerBorder.rect();
+    IntRect sideRect = outerBorder.rect();
     int width = edges[side].width;
 
     if (side == BSTop)
@@ -1600,7 +1658,7 @@ void RenderBoxModelObject::paintBorderSides(GraphicsContext* graphicsContext, co
         roundedPath.addRoundedRect(outerBorder);
     
     if (edges[BSTop].shouldRender() && includesEdge(edgeSet, BSTop)) {
-        LayoutRect sideRect = outerBorder.rect();
+        IntRect sideRect = outerBorder.rect();
         sideRect.setHeight(edges[BSTop].width);
 
         bool usePath = renderRadii && (borderStyleHasInnerDetail(edges[BSTop].style) || borderWillArcInnerEdge(innerBorder.radii().topLeft(), innerBorder.radii().topRight()));
@@ -1608,7 +1666,7 @@ void RenderBoxModelObject::paintBorderSides(GraphicsContext* graphicsContext, co
     }
 
     if (edges[BSBottom].shouldRender() && includesEdge(edgeSet, BSBottom)) {
-        LayoutRect sideRect = outerBorder.rect();
+        IntRect sideRect = outerBorder.rect();
         sideRect.shiftYEdgeTo(sideRect.maxY() - edges[BSBottom].width);
 
         bool usePath = renderRadii && (borderStyleHasInnerDetail(edges[BSBottom].style) || borderWillArcInnerEdge(innerBorder.radii().bottomLeft(), innerBorder.radii().bottomRight()));
@@ -1616,7 +1674,7 @@ void RenderBoxModelObject::paintBorderSides(GraphicsContext* graphicsContext, co
     }
 
     if (edges[BSLeft].shouldRender() && includesEdge(edgeSet, BSLeft)) {
-        LayoutRect sideRect = outerBorder.rect();
+        IntRect sideRect = outerBorder.rect();
         sideRect.setWidth(edges[BSLeft].width);
 
         bool usePath = renderRadii && (borderStyleHasInnerDetail(edges[BSLeft].style) || borderWillArcInnerEdge(innerBorder.radii().bottomLeft(), innerBorder.radii().topLeft()));
@@ -1624,7 +1682,7 @@ void RenderBoxModelObject::paintBorderSides(GraphicsContext* graphicsContext, co
     }
 
     if (edges[BSRight].shouldRender() && includesEdge(edgeSet, BSRight)) {
-        LayoutRect sideRect = outerBorder.rect();
+        IntRect sideRect = outerBorder.rect();
         sideRect.shiftXEdgeTo(sideRect.maxX() - edges[BSRight].width);
 
         bool usePath = renderRadii && (borderStyleHasInnerDetail(edges[BSRight].style) || borderWillArcInnerEdge(innerBorder.radii().bottomRight(), innerBorder.radii().topRight()));
@@ -1657,7 +1715,7 @@ void RenderBoxModelObject::paintTranslucentBorderSides(GraphicsContext* graphics
                 commonColorEdgeSet |= edgeFlagForSide(currSide);
         }
 
-        bool useTransparencyLayer = commonColor.hasAlpha();
+        bool useTransparencyLayer = includesAdjacentEdges(commonColorEdgeSet) && commonColor.hasAlpha();
         if (useTransparencyLayer) {
             graphicsContext->beginTransparencyLayer(static_cast<float>(commonColor.alpha()) / 255);
             commonColor = Color(commonColor.red(), commonColor.green(), commonColor.blue());
@@ -1753,7 +1811,7 @@ void RenderBoxModelObject::paintBorder(const PaintInfo& info, const LayoutRect&
             for (int i = BSTop; i <= BSLeft; ++i) {
                 const BorderEdge& currEdge = edges[i];
                 if (currEdge.shouldRender()) {
-                    LayoutRect sideRect = calculateSideRect(outerBorder, edges, i);
+                    IntRect sideRect = calculateSideRect(outerBorder, edges, i);
                     path.addRect(sideRect);
                 }
             }
@@ -1933,7 +1991,7 @@ void RenderBoxModelObject::drawBoxSideFromPath(GraphicsContext* graphicsContext,
 
     graphicsContext->setStrokeStyle(NoStroke);
     graphicsContext->setFillColor(color, style->colorSpace());
-    graphicsContext->drawRect(borderRect);
+    graphicsContext->drawRect(pixelSnappedIntRect(borderRect));
 }
 #else
 void RenderBoxModelObject::paintBorder(const PaintInfo& info, const IntRect& rect, const RenderStyle* style,
@@ -2375,9 +2433,9 @@ void RenderBoxModelObject::clipBorderSidePolygon(GraphicsContext* graphicsContex
     graphicsContext->clipConvexPolygon(4, secondQuad, !secondEdgeMatches);
 }
 
-static LayoutRect calculateSideRectIncludingInner(const RoundedRect& outerBorder, const BorderEdge edges[], BoxSide side)
+static IntRect calculateSideRectIncludingInner(const RoundedRect& outerBorder, const BorderEdge edges[], BoxSide side)
 {
-    LayoutRect sideRect = outerBorder.rect();
+    IntRect sideRect = outerBorder.rect();
     int width;
 
     switch (side) {
@@ -2556,6 +2614,53 @@ bool RenderBoxModelObject::borderObscuresBackground() const
     return true;
 }
 
+bool RenderBoxModelObject::boxShadowShouldBeAppliedToBackground(BackgroundBleedAvoidance bleedAvoidance, InlineFlowBox* inlineFlowBox) const
+{
+    if (bleedAvoidance != BackgroundBleedNone)
+        return false;
+
+    if (style()->hasAppearance())
+        return false;
+
+    bool hasOneNormalBoxShadow = false;
+    for (const ShadowData* currentShadow = style()->boxShadow(); currentShadow; currentShadow = currentShadow->next()) {
+        if (currentShadow->style() != Normal)
+            continue;
+
+        if (hasOneNormalBoxShadow)
+            return false;
+        hasOneNormalBoxShadow = true;
+
+        if (currentShadow->spread())
+            return false;
+    }
+
+    if (!hasOneNormalBoxShadow)
+        return false;
+
+    Color backgroundColor = style()->visitedDependentColor(CSSPropertyBackgroundColor);
+    if (!backgroundColor.isValid() || backgroundColor.alpha() < 255)
+        return false;
+
+    const FillLayer* lastBackgroundLayer = style()->backgroundLayers();
+    for (const FillLayer* next = lastBackgroundLayer->next(); next; next = lastBackgroundLayer->next())
+        lastBackgroundLayer = next;
+
+    if (lastBackgroundLayer->clip() != BorderFillBox)
+        return false;
+
+    if (lastBackgroundLayer->image() && style()->hasBorderRadius())
+        return false;
+
+    if (inlineFlowBox && !inlineFlowBox->boxShadowCanBeAppliedToBackground(*lastBackgroundLayer))
+        return false;
+
+    if (hasOverflowClip() && lastBackgroundLayer->attachment() == LocalBackgroundAttachment)
+        return false;
+
+    return true;
+}
+
 static inline LayoutRect areaCastingShadowInHole(const LayoutRect& holeRect, int shadowBlur, int shadowSpread, const LayoutSize& shadowOffset)
 {
     LayoutRect bounds(holeRect);
@@ -2634,7 +2739,7 @@ void RenderBoxModelObject::paintBoxShadow(const PaintInfo& info, const LayoutRec
                 if (!rectToClipOut.isEmpty())
                     context->clipOutRoundedRect(rectToClipOut);
 
-                RoundedRect influenceRect(shadowRect, border.radii());
+                RoundedRect influenceRect(pixelSnappedIntRect(shadowRect), border.radii());
                 influenceRect.expandRadii(2 * shadowBlur + shadowSpread);
                 if (allCornersClippedOut(influenceRect, info.rect))
                     context->fillRect(fillRect.rect(), Color::black, s->colorSpace());
@@ -2658,7 +2763,7 @@ void RenderBoxModelObject::paintBoxShadow(const PaintInfo& info, const LayoutRec
                 }
 
                 if (!rectToClipOut.isEmpty())
-                    context->clipOut(rectToClipOut);
+                    context->clipOut(pixelSnappedIntRect(rectToClipOut));
                 context->fillRect(fillRect.rect(), Color::black, s->colorSpace());
             }
         } else {
@@ -2693,7 +2798,7 @@ void RenderBoxModelObject::paintBoxShadow(const PaintInfo& info, const LayoutRec
             Color fillColor(shadowColor.red(), shadowColor.green(), shadowColor.blue(), 255);
 
             LayoutRect outerRect = areaCastingShadowInHole(border.rect(), shadowBlur, shadowSpread, shadowOffset);
-            RoundedRect roundedHole(holeRect, border.radii());
+            RoundedRect roundedHole(pixelSnappedIntRect(holeRect), border.radii());
 
             GraphicsContextStateSaver stateSaver(*context);
             if (hasBorderRadius) {
@@ -2713,7 +2818,7 @@ void RenderBoxModelObject::paintBoxShadow(const PaintInfo& info, const LayoutRec
             else
                 context->setShadow(shadowOffset, shadowBlur, shadowColor, s->colorSpace());
 
-            context->fillRectWithRoundedHole(outerRect, roundedHole, fillColor, s->colorSpace());
+            context->fillRectWithRoundedHole(pixelSnappedIntRect(outerRect), roundedHole, fillColor, s->colorSpace());
         }
     }
 }
diff --git a/Source/WebCore/rendering/RenderBoxModelObject.h b/Source/WebCore/rendering/RenderBoxModelObject.h
index 027b1fb89..11e97c3fd 100644
--- a/Source/WebCore/rendering/RenderBoxModelObject.h
+++ b/Source/WebCore/rendering/RenderBoxModelObject.h
@@ -127,6 +127,8 @@ public:
     void paintBoxShadow(const PaintInfo&, const LayoutRect&, const RenderStyle*, ShadowStyle, bool includeLogicalLeftEdge = true, bool includeLogicalRightEdge = true);
     void paintFillLayerExtended(const PaintInfo&, const Color&, const FillLayer*, const LayoutRect&, BackgroundBleedAvoidance, InlineFlowBox* = 0, const LayoutSize& = LayoutSize(), CompositeOperator = CompositeSourceOver, RenderObject* backgroundObject = 0);
     
+    virtual bool boxShadowShouldBeAppliedToBackground(BackgroundBleedAvoidance, InlineFlowBox* = 0) const;
+
     // Overridden by subclasses to determine line height and baseline position.
     virtual LayoutUnit lineHeight(bool firstLine, LineDirectionMode, LinePositionMode = PositionOnContainingLine) const = 0;
     virtual LayoutUnit baselinePosition(FontBaseline, bool firstLine, LineDirectionMode, LinePositionMode = PositionOnContainingLine) const = 0;
@@ -218,7 +220,7 @@ private:
                                BoxSide, bool firstEdgeMatches, bool secondEdgeMatches);
     void clipBorderSideForComplexInnerPath(GraphicsContext*, const RoundedRect&, const RoundedRect&, BoxSide, const class BorderEdge[]);
     void paintOneBorderSide(GraphicsContext*, const RenderStyle*, const RoundedRect& outerBorder, const RoundedRect& innerBorder,
-                                const LayoutRect& sideRect, BoxSide, BoxSide adjacentSide1, BoxSide adjacentSide2, const class BorderEdge[],
+                                const IntRect& sideRect, BoxSide, BoxSide adjacentSide1, BoxSide adjacentSide2, const class BorderEdge[],
                                 const Path*, BackgroundBleedAvoidance, bool includeLogicalLeftEdge, bool includeLogicalRightEdge, bool antialias, const Color* overrideColor = 0);
     void paintTranslucentBorderSides(GraphicsContext*, const RenderStyle*, const RoundedRect& outerBorder, const RoundedRect& innerBorder,
                           const class BorderEdge[], BackgroundBleedAvoidance, bool includeLogicalLeftEdge, bool includeLogicalRightEdge, bool antialias = false);
diff --git a/Source/WebCore/rendering/RenderButton.cpp b/Source/WebCore/rendering/RenderButton.cpp
index e6d1920fe..dd23130a6 100644
--- a/Source/WebCore/rendering/RenderButton.cpp
+++ b/Source/WebCore/rendering/RenderButton.cpp
@@ -118,14 +118,6 @@ void RenderButton::updateFromElement()
     }
 }
 
-bool RenderButton::canHaveChildren() const
-{
-    // Input elements can't have children, but button elements can.  We'll
-    // write the code assuming any other button types that might emerge in the future
-    // can also have children.
-    return !node()->hasTagName(inputTag);
-}
-
 void RenderButton::setText(const String& str)
 {
     if (str.isEmpty()) {
@@ -157,6 +149,11 @@ void RenderButton::updateBeforeAfterContent(PseudoId type)
         children()->updateBeforeAfterContent(this, type);
 }
 
+RenderText* RenderButton::buttonText() const
+{
+    return m_buttonText;
+}
+
 LayoutRect RenderButton::controlClipRect(const LayoutPoint& additionalOffset) const
 {
     // Clip to the padding box to at least give content the extra padding space.
diff --git a/Source/WebCore/rendering/RenderButton.h b/Source/WebCore/rendering/RenderButton.h
index 24cecd2f2..c851abc7d 100644
--- a/Source/WebCore/rendering/RenderButton.h
+++ b/Source/WebCore/rendering/RenderButton.h
@@ -50,14 +50,13 @@ public:
 
     virtual void updateBeforeAfterContent(PseudoId);
 
+    virtual RenderText* buttonText() const OVERRIDE;
     virtual bool hasControlClip() const { return true; }
     virtual LayoutRect controlClipRect(const LayoutPoint&) const;
 
     void setText(const String&);
     String text() const;
 
-    virtual bool canHaveChildren() const;
-
 private:
     virtual void styleWillChange(StyleDifference, const RenderStyle* newStyle);
     virtual void styleDidChange(StyleDifference, const RenderStyle* oldStyle);
diff --git a/Source/WebCore/rendering/RenderDeprecatedFlexibleBox.h b/Source/WebCore/rendering/RenderDeprecatedFlexibleBox.h
index 417ebac75..101bedbe3 100644
--- a/Source/WebCore/rendering/RenderDeprecatedFlexibleBox.h
+++ b/Source/WebCore/rendering/RenderDeprecatedFlexibleBox.h
@@ -49,6 +49,7 @@ public:
     virtual bool isDeprecatedFlexibleBox() const { return true; }
     virtual bool isFlexingChildren() const { return m_flexingChildren; }
     virtual bool isStretchingChildren() const { return m_stretchingChildren; }
+    virtual RenderText* buttonText() const { return 0; }
 
     void placeChild(RenderBox* child, const LayoutPoint& location);
 
diff --git a/Source/WebCore/rendering/RenderDetailsMarker.cpp b/Source/WebCore/rendering/RenderDetailsMarker.cpp
index 0b1de6973..c1468b543 100644
--- a/Source/WebCore/rendering/RenderDetailsMarker.cpp
+++ b/Source/WebCore/rendering/RenderDetailsMarker.cpp
@@ -132,7 +132,7 @@ void RenderDetailsMarker::paint(PaintInfo& paintInfo, const LayoutPoint& paintOf
     overflowRect.moveBy(boxOrigin);
     overflowRect.inflate(maximalOutlineSize(paintInfo.phase));
 
-    if (!paintInfo.rect.intersects(overflowRect))
+    if (!paintInfo.rect.intersects(pixelSnappedIntRect(overflowRect)))
         return;
 
     const Color color(style()->visitedDependentColor(CSSPropertyColor));
diff --git a/Source/WebCore/rendering/RenderEmbeddedObject.cpp b/Source/WebCore/rendering/RenderEmbeddedObject.cpp
index 0140c1ed6..bdafd62d5 100644
--- a/Source/WebCore/rendering/RenderEmbeddedObject.cpp
+++ b/Source/WebCore/rendering/RenderEmbeddedObject.cpp
@@ -190,7 +190,7 @@ void RenderEmbeddedObject::paintReplaced(PaintInfo& paintInfo, const LayoutPoint
 bool RenderEmbeddedObject::getReplacementTextGeometry(const LayoutPoint& accumulatedOffset, FloatRect& contentRect, Path& path, FloatRect& replacementTextRect, Font& font, TextRun& run, float& textWidth) const
 {
     contentRect = contentBoxRect();
-    contentRect.moveBy(accumulatedOffset);
+    contentRect.moveBy(roundedIntPoint(accumulatedOffset));
     
     FontDescription fontDescription;
     RenderTheme::defaultTheme()->systemFont(CSSValueWebkitSmallControl, fontDescription);
diff --git a/Source/WebCore/rendering/RenderFieldset.cpp b/Source/WebCore/rendering/RenderFieldset.cpp
index 3a70866e2..1d18bb9df 100644
--- a/Source/WebCore/rendering/RenderFieldset.cpp
+++ b/Source/WebCore/rendering/RenderFieldset.cpp
@@ -132,16 +132,17 @@ void RenderFieldset::paintBoxDecorations(PaintInfo& paintInfo, const LayoutPoint
     // cases the legend is embedded in the right and bottom borders respectively.
     // https://bugs.webkit.org/show_bug.cgi?id=47236
     if (style()->isHorizontalWritingMode()) {
-        LayoutUnit yOff = (legend->y() > 0) ? 0 : (legend->height() - borderTop()) / 2;
+        LayoutUnit yOff = (legend->y() > 0) ? zeroLayoutUnit : (legend->height() - borderTop()) / 2;
         paintRect.setHeight(paintRect.height() - yOff);
         paintRect.setY(paintRect.y() + yOff);
     } else {
-        LayoutUnit xOff = (legend->x() > 0) ? 0 : (legend->width() - borderLeft()) / 2;
+        LayoutUnit xOff = (legend->x() > 0) ? zeroLayoutUnit : (legend->width() - borderLeft()) / 2;
         paintRect.setWidth(paintRect.width() - xOff);
         paintRect.setX(paintRect.x() + xOff);
     }
-    
-    paintBoxShadow(paintInfo, paintRect, style(), Normal);
+
+    if (!boxShadowShouldBeAppliedToBackground(determineBackgroundBleedAvoidance(paintInfo.context)))
+        paintBoxShadow(paintInfo, paintRect, style(), Normal);
     paintFillLayers(paintInfo, style()->visitedDependentColor(CSSPropertyBackgroundColor), style()->backgroundLayers(), paintRect);
     paintBoxShadow(paintInfo, paintRect, style(), Inset);
 
diff --git a/Source/WebCore/rendering/RenderFileUploadControl.cpp b/Source/WebCore/rendering/RenderFileUploadControl.cpp
index a1ae15b5c..a927f3fae 100644
--- a/Source/WebCore/rendering/RenderFileUploadControl.cpp
+++ b/Source/WebCore/rendering/RenderFileUploadControl.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2006, 2007 Apple Inc. All rights reserved.
+ * Copyright (C) 2006, 2007, 2012 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -32,6 +32,7 @@
 #include "RenderText.h"
 #include "RenderTheme.h"
 #include "ShadowRoot.h"
+#include "ShadowRootList.h"
 #include "TextRun.h"
 #include "VisiblePosition.h"
 #include <math.h>
@@ -85,7 +86,7 @@ void RenderFileUploadControl::updateFromElement()
 
 static int nodeWidth(Node* node)
 {
-    return node ? node->renderBox()->width() : 0;
+    return node ? node->renderBox()->width() : zeroLayoutUnit;
 }
 
 int RenderFileUploadControl::maxFilenameWidth() const
@@ -177,10 +178,15 @@ void RenderFileUploadControl::computePreferredLogicalWidths()
     else {
         // Figure out how big the filename space needs to be for a given number of characters
         // (using "0" as the nominal character).
-        const UChar ch = '0';
-        const String str = String(&ch, 1);
-        float charWidth = font.width(constructTextRun(this, font, str, style, TextRun::AllowTrailingExpansion));
-        m_maxPreferredLogicalWidth = (int)ceilf(charWidth * defaultWidthNumChars);
+        const UChar character = '0';
+        const String characterAsString = String(&character, 1);
+        float minDefaultLabelWidth = defaultWidthNumChars * font.width(constructTextRun(this, font, characterAsString, style, TextRun::AllowTrailingExpansion));
+
+        const String label = theme()->fileListDefaultLabel(node()->toInputElement()->multiple());
+        float defaultLabelWidth = font.width(constructTextRun(this, font, label, style, TextRun::AllowTrailingExpansion));
+        if (HTMLInputElement* button = uploadButton())
+            defaultLabelWidth += button->renderer()->maxPreferredLogicalWidth() + afterButtonSpacing;
+        m_maxPreferredLogicalWidth = static_cast<int>(ceilf(max(minDefaultLabelWidth, defaultLabelWidth)));
     }
 
     if (style->minWidth().isFixed() && style->minWidth().value() > 0) {
@@ -212,9 +218,9 @@ HTMLInputElement* RenderFileUploadControl::uploadButton() const
 {
     HTMLInputElement* input = static_cast<HTMLInputElement*>(node());
 
-    ASSERT(input->shadowRoot());
+    ASSERT(input->hasShadowRoot());
 
-    Node* buttonNode = input->shadowRoot()->firstChild();
+    Node* buttonNode = input->shadowRootList()->oldestShadowRoot()->firstChild();
     return buttonNode && buttonNode->isHTMLElement() && buttonNode->hasTagName(inputTag) ? static_cast<HTMLInputElement*>(buttonNode) : 0;
 }
 
diff --git a/Source/WebCore/rendering/RenderFileUploadControl.h b/Source/WebCore/rendering/RenderFileUploadControl.h
index 30ee6231c..11d959dac 100644
--- a/Source/WebCore/rendering/RenderFileUploadControl.h
+++ b/Source/WebCore/rendering/RenderFileUploadControl.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2006, 2007, 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2006, 2007, 2009, 2012 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
diff --git a/Source/WebCore/rendering/RenderFlexibleBox.cpp b/Source/WebCore/rendering/RenderFlexibleBox.cpp
index b025cd317..f2f993d7b 100644
--- a/Source/WebCore/rendering/RenderFlexibleBox.cpp
+++ b/Source/WebCore/rendering/RenderFlexibleBox.cpp
@@ -40,55 +40,13 @@ namespace WebCore {
 // Normally, -1 and 0 are not valid in a HashSet, but these are relatively likely flex-order values. Instead,
 // we make the two smallest int values invalid flex-order values (in the css parser code we clamp them to
 // int min + 2).
-struct FlexOrderHashTraits : WTF::GenericHashTraits<int> {
+struct RenderFlexibleBox::FlexOrderHashTraits : WTF::GenericHashTraits<int> {
     static const bool emptyValueIsZero = false;
     static int emptyValue() { return std::numeric_limits<int>::min(); }
     static void constructDeletedValue(int& slot) { slot = std::numeric_limits<int>::min() + 1; }
     static bool isDeletedValue(int value) { return value == std::numeric_limits<int>::min() + 1; }
 };
 
-typedef HashSet<int, DefaultHash<int>::Hash, FlexOrderHashTraits> FlexOrderHashSet;
-
-class RenderFlexibleBox::TreeOrderIterator {
-public:
-    explicit TreeOrderIterator(RenderFlexibleBox* flexibleBox)
-        : m_flexibleBox(flexibleBox)
-        , m_currentChild(0)
-    {
-    }
-
-    RenderBox* first()
-    {
-        reset();
-        return next();
-    }
-
-    RenderBox* next()
-    {
-        m_currentChild = m_currentChild ? m_currentChild->nextSiblingBox() : m_flexibleBox->firstChildBox();
-
-        if (m_currentChild)
-            m_flexOrderValues.add(m_currentChild->style()->flexOrder());
-
-        return m_currentChild;
-    }
-
-    void reset()
-    {
-        m_currentChild = 0;
-    }
-
-    const FlexOrderHashSet& flexOrderValues()
-    {
-        return m_flexOrderValues;
-    }
-
-private:
-    RenderFlexibleBox* m_flexibleBox;
-    RenderBox* m_currentChild;
-    FlexOrderHashSet m_flexOrderValues;
-};
-
 class RenderFlexibleBox::FlexOrderIterator {
 public:
     FlexOrderIterator(RenderFlexibleBox* flexibleBox, const FlexOrderHashSet& flexOrderValues)
@@ -156,6 +114,84 @@ const char* RenderFlexibleBox::renderName() const
     return "RenderFlexibleBox";
 }
 
+static LayoutUnit marginLogicalWidthForChild(RenderBox* child, RenderStyle* parentStyle)
+{
+    // A margin has three types: fixed, percentage, and auto (variable).
+    // Auto and percentage margins become 0 when computing min/max width.
+    // Fixed margins can be added in as is.
+    Length marginLeft = child->style()->marginStartUsing(parentStyle);
+    Length marginRight = child->style()->marginEndUsing(parentStyle);
+    LayoutUnit margin = 0;
+    if (marginLeft.isFixed())
+        margin += marginLeft.value();
+    if (marginRight.isFixed())
+        margin += marginRight.value();
+    return margin;
+}
+
+void RenderFlexibleBox::computePreferredLogicalWidths()
+{
+    ASSERT(preferredLogicalWidthsDirty());
+
+    RenderStyle* styleToUse = style();
+    if (styleToUse->logicalWidth().isFixed() && styleToUse->logicalWidth().value() > 0)
+        m_minPreferredLogicalWidth = m_maxPreferredLogicalWidth = computeContentBoxLogicalWidth(styleToUse->logicalWidth().value());
+    else {
+        m_minPreferredLogicalWidth = m_maxPreferredLogicalWidth = 0;
+
+        for (RenderBox* child = firstChildBox(); child; child = child->nextSiblingBox()) {
+            if (child->isPositioned())
+                continue;
+
+            LayoutUnit margin = marginLogicalWidthForChild(child, style());
+            bool hasOrthogonalWritingMode = child->isHorizontalWritingMode() != isHorizontalWritingMode();
+            LayoutUnit minPreferredLogicalWidth = hasOrthogonalWritingMode ? child->logicalHeight() : child->minPreferredLogicalWidth();
+            LayoutUnit maxPreferredLogicalWidth = hasOrthogonalWritingMode ? child->logicalHeight() : child->maxPreferredLogicalWidth();
+            minPreferredLogicalWidth += margin;
+            maxPreferredLogicalWidth += margin;
+            if (!isColumnFlow()) {
+                m_minPreferredLogicalWidth += minPreferredLogicalWidth;
+                m_maxPreferredLogicalWidth += maxPreferredLogicalWidth;
+            } else {
+                m_minPreferredLogicalWidth = std::max(minPreferredLogicalWidth, m_minPreferredLogicalWidth);
+                m_maxPreferredLogicalWidth = std::max(maxPreferredLogicalWidth, m_maxPreferredLogicalWidth);
+            }
+        }
+
+        m_maxPreferredLogicalWidth = std::max(m_minPreferredLogicalWidth, m_maxPreferredLogicalWidth);
+    }
+
+    LayoutUnit scrollbarWidth = 0;
+    if (hasOverflowClip()) {
+        if (isHorizontalWritingMode() && styleToUse->overflowY() == OSCROLL) {
+            layer()->setHasVerticalScrollbar(true);
+            scrollbarWidth = verticalScrollbarWidth();
+        } else if (!isHorizontalWritingMode() && styleToUse->overflowX() == OSCROLL) {
+            layer()->setHasHorizontalScrollbar(true);
+            scrollbarWidth = horizontalScrollbarHeight();
+        }
+    }
+
+    m_maxPreferredLogicalWidth += scrollbarWidth;
+    m_minPreferredLogicalWidth += scrollbarWidth;
+
+    if (styleToUse->logicalMinWidth().isFixed() && styleToUse->logicalMinWidth().value() > 0) {
+        m_maxPreferredLogicalWidth = std::max(m_maxPreferredLogicalWidth, computeContentBoxLogicalWidth(styleToUse->logicalMinWidth().value()));
+        m_minPreferredLogicalWidth = std::max(m_minPreferredLogicalWidth, computeContentBoxLogicalWidth(styleToUse->logicalMinWidth().value()));
+    }
+
+    if (styleToUse->logicalMaxWidth().isFixed()) {
+        m_maxPreferredLogicalWidth = std::min(m_maxPreferredLogicalWidth, computeContentBoxLogicalWidth(styleToUse->logicalMaxWidth().value()));
+        m_minPreferredLogicalWidth = std::min(m_minPreferredLogicalWidth, computeContentBoxLogicalWidth(styleToUse->logicalMaxWidth().value()));
+    }
+
+    LayoutUnit borderAndPadding = borderAndPaddingLogicalWidth();
+    m_minPreferredLogicalWidth += borderAndPadding;
+    m_maxPreferredLogicalWidth += borderAndPadding;
+
+    setPreferredLogicalWidthsDirty(false);
+}
+
 void RenderFlexibleBox::layoutBlock(bool relayoutChildren, int, BlockLayoutPass)
 {
     ASSERT(needsLayout());
@@ -465,26 +501,25 @@ LayoutUnit RenderFlexibleBox::preferredMainAxisContentExtentForChild(RenderBox*
 
 void RenderFlexibleBox::layoutFlexItems(bool relayoutChildren)
 {
+    FlexOrderHashSet flexOrderValues;
+    computeMainAxisPreferredSizes(relayoutChildren, flexOrderValues);
+
+    OrderedFlexItemList orderedChildren;
+    LayoutUnit preferredMainAxisExtent;
     float totalPositiveFlexibility;
     float totalNegativeFlexibility;
-    TreeOrderIterator treeIterator(this);
+    FlexOrderIterator flexIterator(this, flexOrderValues);
+    computeFlexOrder(flexIterator, orderedChildren, preferredMainAxisExtent, totalPositiveFlexibility, totalNegativeFlexibility);
 
-    WTF::Vector<LayoutUnit> preferredSizes;
-    computeMainAxisPreferredSizes(relayoutChildren, treeIterator, preferredSizes, totalPositiveFlexibility, totalNegativeFlexibility);
-    LayoutUnit preferredMainAxisExtent = 0;
-    for (size_t i = 0; i < preferredSizes.size(); ++i)
-        preferredMainAxisExtent += preferredSizes[i];
     LayoutUnit availableFreeSpace = mainAxisContentExtent() - preferredMainAxisExtent;
-
-    FlexOrderIterator flexIterator(this, treeIterator.flexOrderValues());
     InflexibleFlexItemSize inflexibleItems;
     WTF::Vector<LayoutUnit> childSizes;
-    while (!runFreeSpaceAllocationAlgorithm(flexIterator, availableFreeSpace, totalPositiveFlexibility, totalNegativeFlexibility, inflexibleItems, childSizes)) {
+    while (!runFreeSpaceAllocationAlgorithm(orderedChildren, availableFreeSpace, totalPositiveFlexibility, totalNegativeFlexibility, inflexibleItems, childSizes)) {
         ASSERT(totalPositiveFlexibility >= 0 && totalNegativeFlexibility >= 0);
         ASSERT(inflexibleItems.size() > 0);
     }
 
-    layoutAndPlaceChildren(flexIterator, childSizes, availableFreeSpace, totalPositiveFlexibility);
+    layoutAndPlaceChildren(orderedChildren, childSizes, availableFreeSpace);
 }
 
 float RenderFlexibleBox::positiveFlexForChild(RenderBox* child) const
@@ -512,16 +547,14 @@ LayoutUnit RenderFlexibleBox::marginBoxAscent(RenderBox* child)
     return ascent + flowAwareMarginBeforeForChild(child);
 }
 
-void RenderFlexibleBox::computeMainAxisPreferredSizes(bool relayoutChildren, TreeOrderIterator& iterator, WTF::Vector<LayoutUnit>& preferredSizes, float& totalPositiveFlexibility, float& totalNegativeFlexibility)
+void RenderFlexibleBox::computeMainAxisPreferredSizes(bool relayoutChildren, FlexOrderHashSet& flexOrderValues)
 {
-    totalPositiveFlexibility = totalNegativeFlexibility = 0;
-
     LayoutUnit flexboxAvailableContentExtent = mainAxisContentExtent();
-    for (RenderBox* child = iterator.first(); child; child = iterator.next()) {
-        if (child->isPositioned()) {
-            preferredSizes.append(0);
+    for (RenderBox* child = firstChildBox(); child; child = child->nextSiblingBox()) {
+        flexOrderValues.add(child->style()->flexOrder());
+
+        if (child->isPositioned())
             continue;
-        }
 
         child->clearOverrideSize();
         if (mainAxisLengthForChild(child).isAuto()) {
@@ -530,35 +563,51 @@ void RenderFlexibleBox::computeMainAxisPreferredSizes(bool relayoutChildren, Tre
             child->layoutIfNeeded();
         }
 
-        LayoutUnit preferredSize = mainAxisBorderAndPaddingExtentForChild(child) + preferredMainAxisContentExtentForChild(child);
-
         // We set the margins because we want to make sure 'auto' has a margin
         // of 0 and because if we're not auto sizing, we don't do a layout that
         // computes the start/end margins.
         if (isHorizontalFlow()) {
             child->setMarginLeft(child->style()->marginLeft().calcMinValue(flexboxAvailableContentExtent));
             child->setMarginRight(child->style()->marginRight().calcMinValue(flexboxAvailableContentExtent));
-            preferredSize += child->marginLeft() + child->marginRight();
         } else {
             child->setMarginTop(child->style()->marginTop().calcMinValue(flexboxAvailableContentExtent));
             child->setMarginBottom(child->style()->marginBottom().calcMinValue(flexboxAvailableContentExtent));
-            preferredSize += child->marginTop() + child->marginBottom();
         }
+    }
+}
+
+void RenderFlexibleBox::computeFlexOrder(FlexOrderIterator& iterator, OrderedFlexItemList& orderedChildren, LayoutUnit& preferredMainAxisExtent, float& totalPositiveFlexibility, float& totalNegativeFlexibility)
+{
+    orderedChildren.clear();
+    preferredMainAxisExtent = 0;
+    totalPositiveFlexibility = totalNegativeFlexibility = 0;
+    for (RenderBox* child = iterator.first(); child; child = iterator.next()) {
+        orderedChildren.append(child);
+        if (child->isPositioned())
+            continue;
 
-        preferredSizes.append(preferredSize);
+        LayoutUnit childMainAxisExtent = mainAxisBorderAndPaddingExtentForChild(child) + preferredMainAxisContentExtentForChild(child);
+        if (isHorizontalFlow())
+            childMainAxisExtent += child->marginLeft() + child->marginRight();
+        else
+            childMainAxisExtent += child->marginTop() + child->marginBottom();
 
+        // FIXME: When implementing multiline, we would return here if adding
+        // the child's main axis extent would cause us to overflow.
+        preferredMainAxisExtent += childMainAxisExtent;
         totalPositiveFlexibility += positiveFlexForChild(child);
         totalNegativeFlexibility += negativeFlexForChild(child);
     }
 }
 
 // Returns true if we successfully ran the algorithm and sized the flex items.
-bool RenderFlexibleBox::runFreeSpaceAllocationAlgorithm(FlexOrderIterator& iterator, LayoutUnit& availableFreeSpace, float& totalPositiveFlexibility, float& totalNegativeFlexibility, InflexibleFlexItemSize& inflexibleItems, WTF::Vector<LayoutUnit>& childSizes)
+bool RenderFlexibleBox::runFreeSpaceAllocationAlgorithm(const OrderedFlexItemList& children, LayoutUnit& availableFreeSpace, float& totalPositiveFlexibility, float& totalNegativeFlexibility, InflexibleFlexItemSize& inflexibleItems, WTF::Vector<LayoutUnit>& childSizes)
 {
     childSizes.clear();
 
     LayoutUnit flexboxAvailableContentExtent = mainAxisContentExtent();
-    for (RenderBox* child = iterator.first(); child; child = iterator.next()) {
+    for (size_t i = 0; i < children.size(); ++i) {
+        RenderBox* child = children[i];
         if (child->isPositioned()) {
             childSizes.append(0);
             continue;
@@ -600,27 +649,25 @@ bool RenderFlexibleBox::runFreeSpaceAllocationAlgorithm(FlexOrderIterator& itera
     return true;
 }
 
-static bool hasPackingSpace(LayoutUnit availableFreeSpace, float totalPositiveFlexibility)
-{
-    return availableFreeSpace > 0 && !totalPositiveFlexibility;
-}
-
-static LayoutUnit initialPackingOffset(LayoutUnit availableFreeSpace, float totalPositiveFlexibility, EFlexPack flexPack, size_t numberOfChildren)
+static LayoutUnit initialPackingOffset(LayoutUnit availableFreeSpace, EFlexPack flexPack, size_t numberOfChildren)
 {
-    if (hasPackingSpace(availableFreeSpace, totalPositiveFlexibility)) {
+    if (availableFreeSpace > 0) {
         if (flexPack == PackEnd)
             return availableFreeSpace;
         if (flexPack == PackCenter)
             return availableFreeSpace / 2;
         if (flexPack == PackDistribute && numberOfChildren)
             return availableFreeSpace / (2 * numberOfChildren);
+    } else if (availableFreeSpace < 0) {
+        if (flexPack == PackCenter || flexPack == PackDistribute)
+            return availableFreeSpace / 2;
     }
     return 0;
 }
 
-static LayoutUnit packingSpaceBetweenChildren(LayoutUnit availableFreeSpace, float totalPositiveFlexibility, EFlexPack flexPack, size_t numberOfChildren)
+static LayoutUnit packingSpaceBetweenChildren(LayoutUnit availableFreeSpace, EFlexPack flexPack, size_t numberOfChildren)
 {
-    if (hasPackingSpace(availableFreeSpace, totalPositiveFlexibility) && numberOfChildren > 1) {
+    if (availableFreeSpace > 0 && numberOfChildren > 1) {
         if (flexPack == PackJustify)
             return availableFreeSpace / (numberOfChildren - 1);
         if (flexPack == PackDistribute)
@@ -664,10 +711,10 @@ static EFlexAlign flexAlignForChild(RenderBox* child)
     return align;
 }
 
-void RenderFlexibleBox::layoutAndPlaceChildren(FlexOrderIterator& iterator, const WTF::Vector<LayoutUnit>& childSizes, LayoutUnit availableFreeSpace, float totalPositiveFlexibility)
+void RenderFlexibleBox::layoutAndPlaceChildren(const OrderedFlexItemList& children, const WTF::Vector<LayoutUnit>& childSizes, LayoutUnit availableFreeSpace)
 {
     LayoutUnit mainAxisOffset = flowAwareBorderStart() + flowAwarePaddingStart();
-    mainAxisOffset += initialPackingOffset(availableFreeSpace, totalPositiveFlexibility, style()->flexPack(), childSizes.size());
+    mainAxisOffset += initialPackingOffset(availableFreeSpace, style()->flexPack(), childSizes.size());
     if (style()->flexDirection() == FlowRowReverse)
         mainAxisOffset += isHorizontalFlow() ? verticalScrollbarWidth() : horizontalScrollbarHeight();
 
@@ -675,11 +722,11 @@ void RenderFlexibleBox::layoutAndPlaceChildren(FlexOrderIterator& iterator, cons
     LayoutUnit totalMainExtent = mainAxisExtent();
     LayoutUnit maxAscent = 0, maxDescent = 0; // Used when flex-align: baseline.
     bool shouldFlipMainAxis = !isColumnFlow() && !isLeftToRightFlow();
-    size_t i = 0;
-    for (RenderBox* child = iterator.first(); child; child = iterator.next(), ++i) {
+    for (size_t i = 0; i < children.size(); ++i) {
+        RenderBox* child = children[i];
         if (child->isPositioned()) {
             prepareChildForPositionedLayout(child, mainAxisOffset, crossAxisOffset);
-            mainAxisOffset += packingSpaceBetweenChildren(availableFreeSpace, totalPositiveFlexibility, style()->flexPack(), childSizes.size());
+            mainAxisOffset += packingSpaceBetweenChildren(availableFreeSpace, style()->flexPack(), childSizes.size());
             continue;
         }
         LayoutUnit childPreferredSize = childSizes[i] + mainAxisBorderAndPaddingExtentForChild(child);
@@ -687,6 +734,7 @@ void RenderFlexibleBox::layoutAndPlaceChildren(FlexOrderIterator& iterator, cons
         child->setChildNeedsLayout(true);
         child->layoutIfNeeded();
 
+        LayoutUnit childCrossAxisExtent;
         if (flexAlignForChild(child) == AlignBaseline) {
             LayoutUnit ascent = marginBoxAscent(child);
             LayoutUnit descent = (crossAxisMarginExtentForChild(child) + crossAxisExtentForChild(child)) - ascent;
@@ -694,10 +742,11 @@ void RenderFlexibleBox::layoutAndPlaceChildren(FlexOrderIterator& iterator, cons
             maxAscent = std::max(maxAscent, ascent);
             maxDescent = std::max(maxDescent, descent);
 
-            if (crossAxisLength().isAuto())
-                setCrossAxisExtent(std::max(crossAxisExtent(), crossAxisBorderAndPaddingExtent() + crossAxisMarginExtentForChild(child) + maxAscent + maxDescent + crossAxisScrollbarExtent()));
-        } else if (crossAxisLength().isAuto())
-            setCrossAxisExtent(std::max(crossAxisExtent(), crossAxisBorderAndPaddingExtent() + crossAxisMarginExtentForChild(child) + crossAxisExtentForChild(child) + crossAxisScrollbarExtent()));
+            childCrossAxisExtent = maxAscent + maxDescent;
+        } else
+            childCrossAxisExtent =  crossAxisExtentForChild(child);
+        if (crossAxisLength().isAuto())
+            setCrossAxisExtent(std::max(crossAxisExtent(), crossAxisBorderAndPaddingExtent() + crossAxisMarginExtentForChild(child) + childCrossAxisExtent + crossAxisScrollbarExtent()));
 
         mainAxisOffset += flowAwareMarginStartForChild(child);
 
@@ -709,7 +758,7 @@ void RenderFlexibleBox::layoutAndPlaceChildren(FlexOrderIterator& iterator, cons
         setFlowAwareLocationForChild(child, childLocation);
         mainAxisOffset += childMainExtent + flowAwareMarginEndForChild(child);
 
-        mainAxisOffset += packingSpaceBetweenChildren(availableFreeSpace, totalPositiveFlexibility, style()->flexPack(), childSizes.size());
+        mainAxisOffset += packingSpaceBetweenChildren(availableFreeSpace, style()->flexPack(), childSizes.size());
 
         if (isColumnFlow())
             setLogicalHeight(mainAxisOffset + flowAwareBorderEnd() + flowAwarePaddingEnd() + scrollbarLogicalHeight());
@@ -719,27 +768,27 @@ void RenderFlexibleBox::layoutAndPlaceChildren(FlexOrderIterator& iterator, cons
         // We have to do an extra pass for column-reverse to reposition the flex items since the start depends
         // on the height of the flexbox, which we only know after we've positioned all the flex items.
         computeLogicalHeight();
-        layoutColumnReverse(iterator, childSizes, availableFreeSpace, totalPositiveFlexibility);
+        layoutColumnReverse(children, childSizes, availableFreeSpace);
     }
 
-    alignChildren(iterator, maxAscent);
+    alignChildren(children, maxAscent);
 }
 
-void RenderFlexibleBox::layoutColumnReverse(FlexOrderIterator& iterator, const WTF::Vector<LayoutUnit>& childSizes, LayoutUnit availableFreeSpace, float totalPositiveFlexibility)
+void RenderFlexibleBox::layoutColumnReverse(const OrderedFlexItemList& children, const WTF::Vector<LayoutUnit>& childSizes, LayoutUnit availableFreeSpace)
 {
     // This is similar to the logic in layoutAndPlaceChildren, except we place the children
     // starting from the end of the flexbox. We also don't need to layout anything since we're
     // just moving the children to a new position.
     LayoutUnit mainAxisOffset = logicalHeight() - flowAwareBorderEnd() - flowAwarePaddingEnd();
-    mainAxisOffset -= initialPackingOffset(availableFreeSpace, totalPositiveFlexibility, style()->flexPack(), childSizes.size());
+    mainAxisOffset -= initialPackingOffset(availableFreeSpace, style()->flexPack(), childSizes.size());
     mainAxisOffset -= isHorizontalFlow() ? verticalScrollbarWidth() : horizontalScrollbarHeight();
 
     LayoutUnit crossAxisOffset = flowAwareBorderBefore() + flowAwarePaddingBefore();
-    size_t i = 0;
-    for (RenderBox* child = iterator.first(); child; child = iterator.next(), ++i) {
+    for (size_t i = 0; i < children.size(); ++i) {
+        RenderBox* child = children[i];
         if (child->isPositioned()) {
             child->layer()->setStaticBlockPosition(mainAxisOffset);
-            mainAxisOffset -= packingSpaceBetweenChildren(availableFreeSpace, totalPositiveFlexibility, style()->flexPack(), childSizes.size());
+            mainAxisOffset -= packingSpaceBetweenChildren(availableFreeSpace, style()->flexPack(), childSizes.size());
             continue;
         }
         mainAxisOffset -= mainAxisExtentForChild(child) + flowAwareMarginEndForChild(child);
@@ -750,7 +799,7 @@ void RenderFlexibleBox::layoutColumnReverse(FlexOrderIterator& iterator, const W
             child->repaintDuringLayoutIfMoved(oldRect);
 
         mainAxisOffset -= flowAwareMarginStartForChild(child);
-        mainAxisOffset -= packingSpaceBetweenChildren(availableFreeSpace, totalPositiveFlexibility, style()->flexPack(), childSizes.size());
+        mainAxisOffset -= packingSpaceBetweenChildren(availableFreeSpace, style()->flexPack(), childSizes.size());
     }
 }
 
@@ -767,19 +816,12 @@ void RenderFlexibleBox::adjustAlignmentForChild(RenderBox* child, LayoutUnit del
         child->repaintDuringLayoutIfMoved(oldRect);
 }
 
-void RenderFlexibleBox::alignChildren(FlexOrderIterator& iterator, LayoutUnit maxAscent)
+void RenderFlexibleBox::alignChildren(const OrderedFlexItemList& children, LayoutUnit maxAscent)
 {
     LayoutUnit crossExtent = crossAxisExtent();
 
-    for (RenderBox* child = iterator.first(); child; child = iterator.next()) {
-        // direction:rtl + flex-direction:column means the cross-axis direction is flipped.
-        if (!style()->isLeftToRightDirection() && isColumnFlow()) {
-            LayoutPoint location = flowAwareLocationForChild(child);
-            location.setY(crossExtent - crossAxisExtentForChild(child) - location.y());
-            setFlowAwareLocationForChild(child, location);
-        }
-
-        // FIXME: Make sure this does the right thing with column flows.
+    for (size_t i = 0; i < children.size(); ++i) {
+        RenderBox* child = children[i];
         switch (flexAlignForChild(child)) {
         case AlignAuto:
             ASSERT_NOT_REACHED();
@@ -814,6 +856,14 @@ void RenderFlexibleBox::alignChildren(FlexOrderIterator& iterator, LayoutUnit ma
             break;
         }
         }
+
+        // direction:rtl + flex-direction:column means the cross-axis direction is flipped.
+        if (!style()->isLeftToRightDirection() && isColumnFlow()) {
+            LayoutPoint location = flowAwareLocationForChild(child);
+            location.setY(crossExtent - crossAxisExtentForChild(child) - location.y());
+            setFlowAwareLocationForChild(child, location);
+        }
+
     }
 }
 
diff --git a/Source/WebCore/rendering/RenderFlexibleBox.h b/Source/WebCore/rendering/RenderFlexibleBox.h
index 0833217b6..0ee715f7e 100644
--- a/Source/WebCore/rendering/RenderFlexibleBox.h
+++ b/Source/WebCore/rendering/RenderFlexibleBox.h
@@ -43,15 +43,18 @@ public:
     virtual const char* renderName() const;
 
     virtual bool isFlexibleBox() const { return true; }
-
+    virtual void computePreferredLogicalWidths();
     virtual void layoutBlock(bool relayoutChildren, int pageLogicalHeight = 0, BlockLayoutPass = NormalLayoutPass);
 
     bool isHorizontalFlow() const;
 
 private:
-    class TreeOrderIterator;
+    struct FlexOrderHashTraits;
+    typedef HashSet<int, DefaultHash<int>::Hash, FlexOrderHashTraits> FlexOrderHashSet;
+
     class FlexOrderIterator;
     typedef WTF::HashMap<const RenderBox*, LayoutUnit> InflexibleFlexItemSize;
+    typedef WTF::Vector<RenderBox*> OrderedFlexItemList;
 
     bool hasOrthogonalFlow(RenderBox* child) const;
     bool isColumnFlow() const;
@@ -95,13 +98,14 @@ private:
     LayoutUnit availableAlignmentSpaceForChild(RenderBox*);
     LayoutUnit marginBoxAscent(RenderBox*);
 
-    void computeMainAxisPreferredSizes(bool relayoutChildren, TreeOrderIterator&, WTF::Vector<LayoutUnit>&, float& totalPositiveFlexibility, float& totalNegativeFlexibility);
-    bool runFreeSpaceAllocationAlgorithm(FlexOrderIterator&, LayoutUnit& availableFreeSpace, float& totalPositiveFlexibility, float& totalNegativeFlexibility, InflexibleFlexItemSize&, WTF::Vector<LayoutUnit>& childSizes);
+    void computeMainAxisPreferredSizes(bool relayoutChildren, FlexOrderHashSet&);
+    void computeFlexOrder(FlexOrderIterator&, OrderedFlexItemList& orderedChildren, LayoutUnit& preferredMainAxisExtent, float& totalPositiveFlexibility, float& totalNegativeFlexibility);
+    bool runFreeSpaceAllocationAlgorithm(const OrderedFlexItemList&, LayoutUnit& availableFreeSpace, float& totalPositiveFlexibility, float& totalNegativeFlexibility, InflexibleFlexItemSize&, WTF::Vector<LayoutUnit>& childSizes);
     void setLogicalOverrideSize(RenderBox* child, LayoutUnit childPreferredSize);
     void prepareChildForPositionedLayout(RenderBox* child, LayoutUnit mainAxisOffset, LayoutUnit crossAxisOffset);
-    void layoutAndPlaceChildren(FlexOrderIterator&, const WTF::Vector<LayoutUnit>& childSizes, LayoutUnit availableFreeSpace, float totalPositiveFlexibility);
-    void layoutColumnReverse(FlexOrderIterator&, const WTF::Vector<LayoutUnit>& childSizes, LayoutUnit availableFreeSpace, float totalPositiveFlexibility);
-    void alignChildren(FlexOrderIterator&, LayoutUnit maxAscent);
+    void layoutAndPlaceChildren(const OrderedFlexItemList&, const WTF::Vector<LayoutUnit>& childSizes, LayoutUnit availableFreeSpace);
+    void layoutColumnReverse(const OrderedFlexItemList&, const WTF::Vector<LayoutUnit>& childSizes, LayoutUnit availableFreeSpace);
+    void alignChildren(const OrderedFlexItemList&, LayoutUnit maxAscent);
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/rendering/RenderFlowThread.cpp b/Source/WebCore/rendering/RenderFlowThread.cpp
index 9e39d9607..9e47d4dc9 100644
--- a/Source/WebCore/rendering/RenderFlowThread.cpp
+++ b/Source/WebCore/rendering/RenderFlowThread.cpp
@@ -51,7 +51,9 @@ RenderFlowThread::RenderFlowThread(Node* node, const AtomicString& flowThread)
     , m_regionsInvalidated(false)
     , m_regionsHaveUniformLogicalWidth(true)
     , m_regionsHaveUniformLogicalHeight(true)
+    , m_overflow(false)
 {
+    ASSERT(node->document()->cssRegionsEnabled());
     setIsAnonymous(false);
     setInRenderFlowThread();
 }
@@ -137,6 +139,15 @@ void RenderFlowThread::removeFlowChild(RenderObject* child)
     m_flowThreadChildList.remove(child);
 }
 
+void RenderFlowThread::removeFlowChildInfo(RenderObject* child)
+{
+    if (child->isBox()) {
+        removeRenderBoxRegionInfo(toRenderBox(child));
+        if (child->canHaveRegionStyle())
+            clearRenderBoxCustomStyle(toRenderBox(child));
+    }
+}
+
 // Compare two regions to determine in which one the content should flow first.
 // The function returns true if the first passed region is "less" than the second passed region.
 // If the first region appears before second region in DOM,
@@ -373,10 +384,10 @@ void RenderFlowThread::layout()
                     continue;
                 LayoutRect regionRect;
                 if (isHorizontalWritingMode()) {
-                    regionRect = LayoutRect(style()->direction() == LTR ? 0 : logicalWidth() - region->contentWidth(), logicalHeight, region->contentWidth(), region->contentHeight());
+                    regionRect = LayoutRect(style()->direction() == LTR ? zeroLayoutUnit : logicalWidth() - region->contentWidth(), logicalHeight, region->contentWidth(), region->contentHeight());
                     logicalHeight += regionRect.height();
                 } else {
-                    regionRect = LayoutRect(logicalHeight, style()->direction() == LTR ? 0 : logicalWidth() - region->contentHeight(), region->contentWidth(), region->contentHeight());
+                    regionRect = LayoutRect(logicalHeight, style()->direction() == LTR ? zeroLayoutUnit : logicalWidth() - region->contentHeight(), region->contentWidth(), region->contentHeight());
                     logicalHeight += regionRect.width();
                 }
                 region->setRegionRect(regionRect);
@@ -410,7 +421,7 @@ void RenderFlowThread::computeLogicalWidth()
         
         LayoutUnit regionLogicalWidth = isHorizontalWritingMode() ? region->contentWidth() : region->contentHeight();
         if (regionLogicalWidth != logicalWidth) {
-            LayoutUnit logicalLeft = style()->direction() == LTR ? 0 : logicalWidth - regionLogicalWidth;
+            LayoutUnit logicalLeft = style()->direction() == LTR ? zeroLayoutUnit : logicalWidth - regionLogicalWidth;
             region->setRenderBoxRegionInfo(this, logicalLeft, regionLogicalWidth, false);
         }
     }
@@ -445,7 +456,7 @@ void RenderFlowThread::paintIntoRegion(PaintInfo& paintInfo, RenderRegion* regio
     LayoutRect regionClippingRect(paintOffset + (regionOverflowRect.location() - regionRect.location()), regionOverflowRect.size());
 
     PaintInfo info(paintInfo);
-    info.rect.intersect(regionClippingRect);
+    info.rect.intersect(pixelSnappedIntRect(regionClippingRect));
 
     if (!info.rect.isEmpty()) {
         context->save();
@@ -464,7 +475,7 @@ void RenderFlowThread::paintIntoRegion(PaintInfo& paintInfo, RenderRegion* regio
             renderFlowThreadOffset = LayoutPoint(paintOffset - regionRect.location());
 
         context->translate(renderFlowThreadOffset.x(), renderFlowThreadOffset.y());
-        info.rect.moveBy(-renderFlowThreadOffset);
+        info.rect.moveBy(-roundedIntPoint(renderFlowThreadOffset));
         
         layer()->paint(context, info.rect, 0, 0, region, RenderLayer::PaintLayerTemporaryClipRects);
 
@@ -491,7 +502,7 @@ bool RenderFlowThread::hitTestRegion(RenderRegion* region, const HitTestRequest&
     LayoutPoint transformedPoint(pointInContainer.x() - renderFlowThreadOffset.x(), pointInContainer.y() - renderFlowThreadOffset.y());
     
     // Always ignore clipping, since the RenderFlowThread has nothing to do with the bounds of the FrameView.
-    HitTestRequest newRequest(request.type() & HitTestRequest::IgnoreClipping);
+    HitTestRequest newRequest(request.type() | HitTestRequest::IgnoreClipping);
 
     RenderRegion* oldRegion = result.region();
     result.setRegion(region);
@@ -531,14 +542,14 @@ void RenderFlowThread::repaintRectangleInRegions(const LayoutRect& repaintRect,
         flipForWritingMode(flippedRegionRect); // Put the region rects into physical coordinates.
         flipForWritingMode(flippedRegionOverflowRect);
 
-        LayoutRect clippedRect(flippedRegionOverflowRect);
-        clippedRect.intersect(repaintRect);
+        LayoutRect clippedRect(repaintRect);
+        clippedRect.intersect(flippedRegionOverflowRect);
         if (clippedRect.isEmpty())
             continue;
-        
+
         // Put the region rect into the region's physical coordinate space.
-        clippedRect.setLocation(region->contentBoxRect().location() + (repaintRect.location() - flippedRegionRect.location()));
-        
+        clippedRect.setLocation(region->contentBoxRect().location() + (clippedRect.location() - flippedRegionRect.location()));
+
         // Now switch to the region's writing mode coordinate space and let it repaint itself.
         region->flipForWritingMode(clippedRect);
         LayoutStateDisabler layoutStateDisabler(view()); // We can't use layout state to repaint, since the region is somewhere else.
@@ -806,6 +817,9 @@ void RenderFlowThread::clearRenderBoxCustomStyle(const RenderBox* box,
 
 void RenderFlowThread::setRegionRangeForBox(const RenderBox* box, LayoutUnit offsetFromLogicalTopOfFirstPage)
 {
+    if (!hasRegions())
+        return;
+
     // FIXME: Not right for differing writing-modes.
     RenderRegion* startRegion = renderRegionForLine(offsetFromLogicalTopOfFirstPage, true);
     RenderRegion* endRegion = renderRegionForLine(offsetFromLogicalTopOfFirstPage + box->logicalHeight(), true);
@@ -855,9 +869,40 @@ void RenderFlowThread::getRegionRangeForBox(const RenderBox* box, RenderRegion*&
 WebKitNamedFlow* RenderFlowThread::ensureNamedFlow()
 {
     if (!m_namedFlow)
-        m_namedFlow = WebKitNamedFlow::create();
+        m_namedFlow = WebKitNamedFlow::create(this);
 
     return m_namedFlow.get();
 }
 
+void RenderFlowThread::computeOverflowStateForRegions(LayoutUnit oldClientAfterEdge)
+{
+    LayoutUnit height = oldClientAfterEdge;
+    // FIXME: the visual overflow of middle region (if it is the last one to contain any content in a render flow thread)
+    // might not be taken into account because the render flow thread height is greater that that regions height + its visual overflow
+    // because of how computeLogicalHeight is implemented for RenderFlowThread (as a sum of all regions height).
+    // This means that the middle region will be marked as fit (even if it has visual overflow flowing into the next region)
+    if (hasRenderOverflow())
+        height = isHorizontalWritingMode() ? visualOverflowRect().maxY() : visualOverflowRect().maxX();
+
+    for (RenderRegionList::iterator iter = m_regionList.begin(); iter != m_regionList.end(); ++iter) {
+        RenderRegion* region = *iter;
+        if (!region->isValid()) {
+            region->setRegionState(RenderRegion::RegionUndefined);
+            continue;
+        }
+        LayoutUnit flowMin = height - (isHorizontalWritingMode() ? region->regionRect().y() : region->regionRect().x());
+        LayoutUnit flowMax = height - (isHorizontalWritingMode() ? region->regionRect().maxY() : region->regionRect().maxX());
+        RenderRegion::RegionState state = RenderRegion::RegionFit;
+        if (flowMin <= 0)
+            state = RenderRegion::RegionEmpty;
+        if (flowMax > 0)
+            state = RenderRegion::RegionOverflow;
+        region->setRegionState(state);
+    }
+
+    // With the regions overflow state computed we can also set the overflow for the named flow.
+    RenderRegion* lastReg = lastRegion();
+    m_overflow = lastReg && (lastReg->regionState() == RenderRegion::RegionOverflow);
+}
+
 } // namespace WebCore
diff --git a/Source/WebCore/rendering/RenderFlowThread.h b/Source/WebCore/rendering/RenderFlowThread.h
index 4b1b36663..d05938891 100644
--- a/Source/WebCore/rendering/RenderFlowThread.h
+++ b/Source/WebCore/rendering/RenderFlowThread.h
@@ -74,7 +74,12 @@ public:
     
     void addFlowChild(RenderObject* newChild, RenderObject* beforeChild = 0);
     void removeFlowChild(RenderObject*);
+    void removeFlowChildInfo(RenderObject*);
     bool hasChildren() const { return !m_flowThreadChildList.isEmpty(); }
+#ifndef NDEBUG
+    bool hasChild(RenderObject* child) const { return m_flowThreadChildList.contains(child); }
+    bool hasChildInfo(RenderObject* child) const { return child && child->isBox() && m_regionRangeMap.contains(toRenderBox(child)); }
+#endif
 
     void addRegionToThread(RenderRegion*);
     void removeRegionFromThread(RenderRegion*);
@@ -128,7 +133,9 @@ public:
                                       const RenderRegion* oldStartRegion = 0, const RenderRegion* oldEndRegion = 0,
                                       const RenderRegion* newStartRegion = 0, const RenderRegion* newEndRegion = 0);
     WebKitNamedFlow* ensureNamedFlow();
+    void computeOverflowStateForRegions(LayoutUnit oldClientAfterEdge);
 
+    bool overflow() const { return m_overflow; }
 private:
     virtual const char* renderName() const { return "RenderFlowThread"; }
 
@@ -189,6 +196,7 @@ private:
     bool m_regionsInvalidated;
     bool m_regionsHaveUniformLogicalWidth;
     bool m_regionsHaveUniformLogicalHeight;
+    bool m_overflow;
     RefPtr<WebKitNamedFlow> m_namedFlow;
 };
 
diff --git a/Source/WebCore/rendering/RenderFrameSet.cpp b/Source/WebCore/rendering/RenderFrameSet.cpp
index fc2c97f17..bcce93ef8 100644
--- a/Source/WebCore/rendering/RenderFrameSet.cpp
+++ b/Source/WebCore/rendering/RenderFrameSet.cpp
@@ -80,7 +80,7 @@ static Color borderFillColor()
     return Color(208, 208, 208);
 }
 
-void RenderFrameSet::paintColumnBorder(const PaintInfo& paintInfo, const LayoutRect& borderRect)
+void RenderFrameSet::paintColumnBorder(const PaintInfo& paintInfo, const IntRect& borderRect)
 {
     if (!paintInfo.rect.intersects(borderRect))
         return;
@@ -100,7 +100,7 @@ void RenderFrameSet::paintColumnBorder(const PaintInfo& paintInfo, const LayoutR
     }
 }
 
-void RenderFrameSet::paintRowBorder(const PaintInfo& paintInfo, const LayoutRect& borderRect)
+void RenderFrameSet::paintRowBorder(const PaintInfo& paintInfo, const IntRect& borderRect)
 {
     if (!paintInfo.rect.intersects(borderRect))
         return;
@@ -142,7 +142,7 @@ void RenderFrameSet::paint(PaintInfo& paintInfo, const LayoutPoint& paintOffset)
             child->paint(paintInfo, adjustedPaintOffset);
             xPos += m_cols.m_sizes[c];
             if (borderThickness && m_cols.m_allowBorder[c + 1]) {
-                paintColumnBorder(paintInfo, LayoutRect(adjustedPaintOffset.x() + xPos, adjustedPaintOffset.y() + yPos, borderThickness, height()));
+                paintColumnBorder(paintInfo, pixelSnappedIntRect(LayoutRect(adjustedPaintOffset.x() + xPos, adjustedPaintOffset.y() + yPos, borderThickness, height())));
                 xPos += borderThickness;
             }
             child = child->nextSibling();
@@ -151,7 +151,7 @@ void RenderFrameSet::paint(PaintInfo& paintInfo, const LayoutPoint& paintOffset)
         }
         yPos += m_rows.m_sizes[r];
         if (borderThickness && m_rows.m_allowBorder[r + 1]) {
-            paintRowBorder(paintInfo, LayoutRect(adjustedPaintOffset.x(), adjustedPaintOffset.y() + yPos, width(), borderThickness));
+            paintRowBorder(paintInfo, pixelSnappedIntRect(LayoutRect(adjustedPaintOffset.x(), adjustedPaintOffset.y() + yPos, width(), borderThickness)));
             yPos += borderThickness;
         }
     }
@@ -571,7 +571,7 @@ void RenderFrameSet::positionFramesWithFlattening()
         int height = m_rows.m_sizes[r];
 
         for (int c = 0; c < cols; c++) {
-            IntRect oldFrameRect = child->frameRect();
+            IntRect oldFrameRect = pixelSnappedIntRect(child->frameRect());
 
             int width = m_cols.m_sizes[c];
 
@@ -619,7 +619,7 @@ void RenderFrameSet::positionFramesWithFlattening()
         xPos = 0;
         for (int c = 0; c < cols; c++) {
             // ensure the rows and columns are filled
-            IntRect oldRect = child->frameRect();
+            IntRect oldRect = pixelSnappedIntRect(child->frameRect());
 
             child->setLocation(IntPoint(xPos, yPos));
             child->setHeight(m_rows.m_sizes[r]);
@@ -802,11 +802,12 @@ bool RenderFrameSet::isChildAllowed(RenderObject* child, RenderStyle*) const
 
 CursorDirective RenderFrameSet::getCursor(const LayoutPoint& point, Cursor& cursor) const
 {
-    if (canResizeRow(point)) {
+    IntPoint roundedPoint = roundedIntPoint(point);
+    if (canResizeRow(roundedPoint)) {
         cursor = rowResizeCursor();
         return SetCursor;
     }
-    if (canResizeColumn(point)) {
+    if (canResizeColumn(roundedPoint)) {
         cursor = columnResizeCursor();
         return SetCursor;
     }
diff --git a/Source/WebCore/rendering/RenderFrameSet.h b/Source/WebCore/rendering/RenderFrameSet.h
index 373d0d02c..97be97428 100644
--- a/Source/WebCore/rendering/RenderFrameSet.h
+++ b/Source/WebCore/rendering/RenderFrameSet.h
@@ -68,8 +68,8 @@ public:
     bool isResizingRow() const;
     bool isResizingColumn() const;
 
-    bool canResizeRow(const LayoutPoint&) const;
-    bool canResizeColumn(const LayoutPoint&) const;
+    bool canResizeRow(const IntPoint&) const;
+    bool canResizeColumn(const IntPoint&) const;
 
     void notifyFrameEdgeInfoChanged();
 
@@ -119,8 +119,8 @@ private:
     void startResizing(GridAxis&, int position);
     void continueResizing(GridAxis&, int position);
 
-    void paintRowBorder(const PaintInfo&, const LayoutRect&);
-    void paintColumnBorder(const PaintInfo&, const LayoutRect&);
+    void paintRowBorder(const PaintInfo&, const IntRect&);
+    void paintColumnBorder(const PaintInfo&, const IntRect&);
 
     RenderObjectChildList m_children;
 
diff --git a/Source/WebCore/rendering/RenderImage.cpp b/Source/WebCore/rendering/RenderImage.cpp
index 9a0e576ad..de3e7e190 100644
--- a/Source/WebCore/rendering/RenderImage.cpp
+++ b/Source/WebCore/rendering/RenderImage.cpp
@@ -273,7 +273,7 @@ void RenderImage::paintReplaced(PaintInfo& paintInfo, const LayoutPoint& paintOf
             context->setStrokeStyle(SolidStroke);
             context->setStrokeColor(Color::lightGray, style()->colorSpace());
             context->setFillColor(Color::transparent, style()->colorSpace());
-            context->drawRect(LayoutRect(paintOffset.x() + leftBorder + leftPad, paintOffset.y() + topBorder + topPad, cWidth, cHeight));
+            context->drawRect(pixelSnappedIntRect(LayoutRect(paintOffset.x() + leftBorder + leftPad, paintOffset.y() + topBorder + topPad, cWidth, cHeight)));
 
             bool errorPictureDrawn = false;
             LayoutSize imageOffset;
@@ -299,7 +299,7 @@ void RenderImage::paintReplaced(PaintInfo& paintInfo, const LayoutPoint& paintOf
                 if (centerY < 0)
                     centerY = 0;
                 imageOffset = LayoutSize(leftBorder + leftPad + centerX + 1, topBorder + topPad + centerY + 1);
-                context->drawImage(image.get(), style()->colorSpace(), IntRect(paintOffset + imageOffset, imageSize));
+                context->drawImage(image.get(), style()->colorSpace(), IntRect(roundedIntPoint(paintOffset + imageOffset), imageSize));
                 errorPictureDrawn = true;
             }
 
diff --git a/Source/WebCore/rendering/RenderInline.cpp b/Source/WebCore/rendering/RenderInline.cpp
index a4d95c003..3be57ae0a 100644
--- a/Source/WebCore/rendering/RenderInline.cpp
+++ b/Source/WebCore/rendering/RenderInline.cpp
@@ -126,6 +126,33 @@ void RenderInline::updateBoxModelInfoFromStyle()
     setHasReflection(false);    
 }
 
+static bool hasRelPositionedInlineAncestor(RenderObject* p)
+{
+    while (p && p->isRenderInline()) {
+        if (p->isRelPositioned())
+            return true;
+        p = p->parent();
+    }
+    return false;
+}
+
+static void updateStyleOfAnonymousBlockContinuations(RenderObject* block, const RenderStyle* newStyle, const RenderStyle* oldStyle)
+{
+    for (;block && block->isAnonymousBlock(); block = block->nextSibling()) {
+        if (!toRenderBlock(block)->isAnonymousBlockContinuation() || block->style()->position() == newStyle->position())
+            continue;
+        // If we are no longer relatively positioned but our descendant block(s) still have a relatively positioned ancestor then 
+        // their containing anonymous block should keep its relative positioning. 
+        RenderInline* cont = toRenderBlock(block)->inlineElementContinuation();
+        if (oldStyle->position() == RelativePosition && hasRelPositionedInlineAncestor(cont))
+            continue;
+        RefPtr<RenderStyle> blockStyle = RenderStyle::createAnonymousStyle(block->style());
+        blockStyle->setPosition(newStyle->position());
+        blockStyle->setDisplay(BLOCK);
+        block->setStyle(blockStyle);
+    }
+}
+
 void RenderInline::styleDidChange(StyleDifference diff, const RenderStyle* oldStyle)
 {
     RenderBoxModelObject::styleDidChange(diff, oldStyle);
@@ -137,13 +164,24 @@ void RenderInline::styleDidChange(StyleDifference diff, const RenderStyle* oldSt
     // and after the block share the same style, but the block doesn't
     // need to pass its style on to anyone else.
     RenderStyle* newStyle = style();
-    for (RenderInline* currCont = inlineElementContinuation(); currCont; currCont = currCont->inlineElementContinuation()) {
+    RenderInline* continuation = inlineElementContinuation();
+    for (RenderInline* currCont = continuation; currCont; currCont = currCont->inlineElementContinuation()) {
         RenderBoxModelObject* nextCont = currCont->continuation();
         currCont->setContinuation(0);
         currCont->setStyle(newStyle);
         currCont->setContinuation(nextCont);
     }
 
+    // If an inline's relative positioning has changed then any descendant blocks will need to change their relative positioning accordingly.
+    // Do this by updating the position of the descendant blocks' containing anonymous blocks - there may be more than one.
+    if (continuation && oldStyle && newStyle->position() != oldStyle->position() 
+        && (newStyle->position() == RelativePosition || (oldStyle->position() == RelativePosition))) {
+        // If any descendant blocks exist then they will be in the next anonymous block and its siblings.
+        RenderObject* block = containingBlock()->nextSibling();
+        ASSERT(block && block->isAnonymousBlock());
+        updateStyleOfAnonymousBlockContinuations(block, newStyle, oldStyle);
+    }
+
     if (!m_alwaysCreateLineBoxes) {
         bool alwaysCreateLineBoxes = hasSelfPaintingLayer() || hasBoxDecorations() || newStyle->hasPadding() || newStyle->hasMargin() || hasOutline();
         if (oldStyle && alwaysCreateLineBoxes) {
@@ -245,6 +283,11 @@ void RenderInline::addChildIgnoringContinuation(RenderObject* newChild, RenderOb
         // the children after |beforeChild| and put them in a clone of this object.
         RefPtr<RenderStyle> newStyle = RenderStyle::createAnonymousStyle(style());
         newStyle->setDisplay(BLOCK);
+        
+        // If inside an inline affected by relative positioning the block needs to be affected by it too.
+        // Giving the block a layer like this allows it to collect the x/y offsets from inline parents later.
+        if (hasRelPositionedInlineAncestor(this))
+            newStyle->setPosition(RelativePosition);
 
         RenderBlock* newBox = new (renderArena()) RenderBlock(document() /* anonymous box */);
         newBox->setStyle(newStyle.release());
@@ -988,7 +1031,7 @@ LayoutRect RenderInline::clippedOverflowRectForRepaint(RenderBoxModelObject* rep
         // layer's size instead.  Even if the layer's size is wrong, the layer itself will repaint
         // anyway if its size does change.
         LayoutRect repaintRect(r);
-        repaintRect.move(-cb->layer()->scrolledContentOffset()); // For overflow:auto/scroll/hidden.
+        repaintRect.move(-cb->scrolledContentOffset()); // For overflow:auto/scroll/hidden.
 
         LayoutRect boxRect(LayoutPoint(), cb->layer()->size());
         r = intersection(repaintRect, boxRect);
@@ -1089,7 +1132,7 @@ void RenderInline::computeRectForRepaint(RenderBoxModelObject* repaintContainer,
         // o->height() is inaccurate if we're in the middle of a layout of |o|, so use the
         // layer's size instead.  Even if the layer's size is wrong, the layer itself will repaint
         // anyway if its size does change.
-        topLeft -= containerBox->layer()->scrolledContentOffset(); // For overflow:auto/scroll/hidden.
+        topLeft -= containerBox->scrolledContentOffset(); // For overflow:auto/scroll/hidden.
 
         LayoutRect repaintRect(topLeft, rect.size());
         LayoutRect boxRect(LayoutPoint(), containerBox->layer()->size());
@@ -1120,7 +1163,7 @@ LayoutSize RenderInline::offsetFromContainer(RenderObject* container, const Layo
     container->adjustForColumns(offset, point);
 
     if (container->hasOverflowClip())
-        offset -= toRenderBox(container)->layer()->scrolledContentOffset();
+        offset -= toRenderBox(container)->scrolledContentOffset();
 
     return offset;
 }
@@ -1403,24 +1446,24 @@ void RenderInline::paintOutlineForLine(GraphicsContext* graphicsContext, const L
                                        const Color outlineColor)
 {
     RenderStyle* styleToUse = style();
-    LayoutUnit outlineWidth = styleToUse->outlineWidth();
+    int outlineWidth = styleToUse->outlineWidth();
     EBorderStyle outlineStyle = styleToUse->outlineStyle();
 
     bool antialias = shouldAntialiasLines(graphicsContext);
 
-    LayoutUnit offset = style()->outlineOffset();
+    int offset = style()->outlineOffset();
+
+    LayoutRect box(LayoutPoint(paintOffset.x() + thisline.x() - offset, paintOffset.y() + thisline.y() - offset),
+        LayoutSize(thisline.width() + offset, thisline.height() + offset));
 
-    LayoutUnit top = paintOffset.y() + thisline.y() - offset;
-    LayoutUnit left = paintOffset.x() + thisline.x() - offset;
-    LayoutUnit bottom = paintOffset.y() + thisline.maxY() + offset;
-    LayoutUnit right = paintOffset.x() + thisline.maxX() + offset;
+    IntRect pixelSnappedBox = pixelSnappedIntRect(box);
     
     // left edge
     drawLineForBoxSide(graphicsContext,
-        left - outlineWidth,
-        top - (lastline.isEmpty() || thisline.x() < lastline.x() || (lastline.maxX() - 1) <= thisline.x() ? outlineWidth : 0),
-        left,
-        bottom + (nextline.isEmpty() || thisline.x() <= nextline.x() || (nextline.maxX() - 1) <= thisline.x() ? outlineWidth : 0),
+        pixelSnappedBox.x() - outlineWidth,
+        pixelSnappedBox.y() - (lastline.isEmpty() || thisline.x() < lastline.x() || (lastline.maxX() - 1) <= thisline.x() ? outlineWidth : 0),
+        pixelSnappedBox.x(),
+        pixelSnappedBox.maxY() + (nextline.isEmpty() || thisline.x() <= nextline.x() || (nextline.maxX() - 1) <= thisline.x() ? outlineWidth : 0),
         BSLeft,
         outlineColor, outlineStyle,
         (lastline.isEmpty() || thisline.x() < lastline.x() || (lastline.maxX() - 1) <= thisline.x() ? outlineWidth : -outlineWidth),
@@ -1429,10 +1472,10 @@ void RenderInline::paintOutlineForLine(GraphicsContext* graphicsContext, const L
     
     // right edge
     drawLineForBoxSide(graphicsContext,
-        right,
-        top - (lastline.isEmpty() || lastline.maxX() < thisline.maxX() || (thisline.maxX() - 1) <= lastline.x() ? outlineWidth : 0),
-        right + outlineWidth,
-        bottom + (nextline.isEmpty() || nextline.maxX() <= thisline.maxX() || (thisline.maxX() - 1) <= nextline.x() ? outlineWidth : 0),
+        pixelSnappedBox.maxX(),
+        pixelSnappedBox.y() - (lastline.isEmpty() || lastline.maxX() < thisline.maxX() || (thisline.maxX() - 1) <= lastline.x() ? outlineWidth : 0),
+        pixelSnappedBox.maxX() + outlineWidth,
+        pixelSnappedBox.maxY() + (nextline.isEmpty() || nextline.maxX() <= thisline.maxX() || (thisline.maxX() - 1) <= nextline.x() ? outlineWidth : 0),
         BSRight,
         outlineColor, outlineStyle,
         (lastline.isEmpty() || lastline.maxX() < thisline.maxX() || (thisline.maxX() - 1) <= lastline.x() ? outlineWidth : -outlineWidth),
@@ -1441,31 +1484,31 @@ void RenderInline::paintOutlineForLine(GraphicsContext* graphicsContext, const L
     // upper edge
     if (thisline.x() < lastline.x())
         drawLineForBoxSide(graphicsContext,
-            left - outlineWidth,
-            top - outlineWidth,
-            min(right + outlineWidth, (lastline.isEmpty() ? 1000000 : paintOffset.x() + lastline.x())),
-            top,
+            pixelSnappedBox.x() - outlineWidth,
+            pixelSnappedBox.y() - outlineWidth,
+            min(pixelSnappedBox.maxX() + outlineWidth, (lastline.isEmpty() ? 1000000 : paintOffset.x() + lastline.x())),
+            pixelSnappedBox.y(),
             BSTop, outlineColor, outlineStyle,
             outlineWidth,
-            (!lastline.isEmpty() && paintOffset.x() + lastline.x() + 1 < right + outlineWidth) ? -outlineWidth : outlineWidth,
+            (!lastline.isEmpty() && paintOffset.x() + lastline.x() + 1 < pixelSnappedBox.maxX() + outlineWidth) ? -outlineWidth : outlineWidth,
             antialias);
     
     if (lastline.maxX() < thisline.maxX())
         drawLineForBoxSide(graphicsContext,
-            max(lastline.isEmpty() ? -1000000 : paintOffset.x() + lastline.maxX(), left - outlineWidth),
-            top - outlineWidth,
-            right + outlineWidth,
-            top,
+            max(lastline.isEmpty() ? -1000000 : paintOffset.x() + lastline.maxX(), pixelSnappedBox.x() - outlineWidth),
+            pixelSnappedBox.y() - outlineWidth,
+            pixelSnappedBox.maxX() + outlineWidth,
+            pixelSnappedBox.y(),
             BSTop, outlineColor, outlineStyle,
-            (!lastline.isEmpty() && left - outlineWidth < paintOffset.x() + lastline.maxX()) ? -outlineWidth : outlineWidth,
+            (!lastline.isEmpty() && pixelSnappedBox.x() - outlineWidth < paintOffset.x() + lastline.maxX()) ? -outlineWidth : outlineWidth,
             outlineWidth, antialias);
 
     if (thisline.x() == thisline.maxX())
           drawLineForBoxSide(graphicsContext,
-            left - outlineWidth,
-            top - outlineWidth,
-            right + outlineWidth,
-            top,
+            pixelSnappedBox.x() - outlineWidth,
+            pixelSnappedBox.y() - outlineWidth,
+            pixelSnappedBox.maxX() + outlineWidth,
+            pixelSnappedBox.y(),
             BSTop, outlineColor, outlineStyle,
             outlineWidth,
             outlineWidth,
@@ -1474,31 +1517,31 @@ void RenderInline::paintOutlineForLine(GraphicsContext* graphicsContext, const L
     // lower edge
     if (thisline.x() < nextline.x())
         drawLineForBoxSide(graphicsContext,
-            left - outlineWidth,
-            bottom,
-            min(right + outlineWidth, !nextline.isEmpty() ? paintOffset.x() + nextline.x() + 1 : 1000000),
-            bottom + outlineWidth,
+            pixelSnappedBox.x() - outlineWidth,
+            pixelSnappedBox.maxY(),
+            min(pixelSnappedBox.maxX() + outlineWidth, !nextline.isEmpty() ? paintOffset.x() + nextline.x() + 1 : 1000000),
+            pixelSnappedBox.maxY() + outlineWidth,
             BSBottom, outlineColor, outlineStyle,
             outlineWidth,
-            (!nextline.isEmpty() && paintOffset.x() + nextline.x() + 1 < right + outlineWidth) ? -outlineWidth : outlineWidth,
+            (!nextline.isEmpty() && paintOffset.x() + nextline.x() + 1 < pixelSnappedBox.maxX() + outlineWidth) ? -outlineWidth : outlineWidth,
             antialias);
     
     if (nextline.maxX() < thisline.maxX())
         drawLineForBoxSide(graphicsContext,
-            max(!nextline.isEmpty() ? paintOffset.x() + nextline.maxX() : -1000000, left - outlineWidth),
-            bottom,
-            right + outlineWidth,
-            bottom + outlineWidth,
+            max(!nextline.isEmpty() ? paintOffset.x() + nextline.maxX() : -1000000, pixelSnappedBox.x() - outlineWidth),
+            pixelSnappedBox.maxY(),
+            pixelSnappedBox.maxX() + outlineWidth,
+            pixelSnappedBox.maxY() + outlineWidth,
             BSBottom, outlineColor, outlineStyle,
-            (!nextline.isEmpty() && left - outlineWidth < paintOffset.x() + nextline.maxX()) ? -outlineWidth : outlineWidth,
+            (!nextline.isEmpty() && pixelSnappedBox.x() - outlineWidth < paintOffset.x() + nextline.maxX()) ? -outlineWidth : outlineWidth,
             outlineWidth, antialias);
 
     if (thisline.x() == thisline.maxX())
           drawLineForBoxSide(graphicsContext,
-            left - outlineWidth,
-            bottom,
-            right + outlineWidth,
-            bottom + outlineWidth,
+            pixelSnappedBox.x() - outlineWidth,
+            pixelSnappedBox.maxY(),
+            pixelSnappedBox.maxX() + outlineWidth,
+            pixelSnappedBox.maxY() + outlineWidth,
             BSBottom, outlineColor, outlineStyle,
             outlineWidth,
             outlineWidth,
diff --git a/Source/WebCore/rendering/RenderLayer.cpp b/Source/WebCore/rendering/RenderLayer.cpp
index ee6e8beea..a5b028b65 100644
--- a/Source/WebCore/rendering/RenderLayer.cpp
+++ b/Source/WebCore/rendering/RenderLayer.cpp
@@ -77,6 +77,7 @@
 #include "Page.h"
 #include "PlatformMouseEvent.h"
 #include "RenderArena.h"
+#include "RenderFlowThread.h"
 #include "RenderInline.h"
 #include "RenderMarquee.h"
 #include "RenderReplica.h"
@@ -357,7 +358,7 @@ void RenderLayer::updateLayerPositions(LayoutPoint* offsetFromRoot, UpdateLayerP
         // as canUseConvertToLayerCoords may be true for an ancestor layer.
         convertToLayerCoords(root(), offset);
     }
-    positionOverflowControls(toSize(offset));
+    positionOverflowControls(toSize(roundedIntPoint(offset)));
 
     updateVisibilityStatus();
 
@@ -375,8 +376,8 @@ void RenderLayer::updateLayerPositions(LayoutPoint* offsetFromRoot, UpdateLayerP
         ASSERT(!view->layoutStateEnabled());
 
         RenderBoxModelObject* repaintContainer = renderer()->containerForRepaint();
-        IntRect oldRepaintRect = m_repaintRect;
-        IntRect oldOutlineBox = m_outlineBox;
+        LayoutRect oldRepaintRect = m_repaintRect;
+        LayoutRect oldOutlineBox = m_outlineBox;
         computeRepaintRects(offsetFromRoot);
         // FIXME: Should ASSERT that value calculated for m_outlineBox using the cached offset is the same
         // as the value not using the cached offset, but we can't due to https://bugs.webkit.org/show_bug.cgi?id=37048
@@ -433,7 +434,7 @@ LayoutRect RenderLayer::repaintRectIncludingDescendants() const
     return repaintRect;
 }
 
-void RenderLayer::computeRepaintRects(IntPoint* offsetFromRoot)
+void RenderLayer::computeRepaintRects(LayoutPoint* offsetFromRoot)
 {
     ASSERT(!m_visibleContentStatusDirty);
 
@@ -453,8 +454,9 @@ void RenderLayer::clearRepaintRects()
 
 void RenderLayer::updateLayerPositionsAfterScroll(UpdateLayerPositionsAfterScrollFlags flags)
 {
-    ASSERT(!m_visibleDescendantStatusDirty);
-    ASSERT(!m_visibleContentStatusDirty);
+    // FIXME: This shouldn't be needed, but there are some corner cases where
+    // these flags are still dirty. Update so that the check below is valid.
+    updateVisibilityStatus();
 
     // If we have no visible content and no visible descendants, there is no point recomputing
     // our rectangles as they will be empty. If our visibility changes, we are expected to
@@ -1191,22 +1193,16 @@ void RenderLayer::removeOnlyThisLayer()
     // Dirty the clip rects.
     clearClipRectsIncludingDescendants();
 
-    // Remove us from the parent.
-    RenderLayer* parent = m_parent;
     RenderLayer* nextSib = nextSibling();
     bool hasLayerOffset;
     const LayoutPoint offsetFromRootBeforeMove = computeOffsetFromRoot(hasLayerOffset);
-    parent->removeChild(this);
-    
-    if (reflection())
-        removeChild(reflectionLayer());
 
     // Now walk our kids and reattach them to our parent.
     RenderLayer* current = m_first;
     while (current) {
         RenderLayer* next = current->nextSibling();
         removeChild(current);
-        parent->addChild(current, nextSib);
+        m_parent->addChild(current, nextSib);
         current->setRepaintStatus(NeedsFullRepaint);
         LayoutPoint offsetFromRoot = offsetFromRootBeforeMove;
         // updateLayerPositions depends on hasLayer() already being false for proper layout.
@@ -1215,6 +1211,11 @@ void RenderLayer::removeOnlyThisLayer()
         current = next;
     }
 
+    // Remove us from the parent.
+    if (reflection())
+        removeChild(reflectionLayer());
+    m_parent->removeChild(this);
+
     m_renderer->destroyLayer();
 }
 
@@ -1237,8 +1238,21 @@ void RenderLayer::insertOnlyThisLayer()
     clearClipRectsIncludingDescendants();
 }
 
-void 
-RenderLayer::convertToLayerCoords(const RenderLayer* ancestorLayer, LayoutPoint& location) const
+void RenderLayer::convertToPixelSnappedLayerCoords(const RenderLayer* ancestorLayer, IntPoint& roundedLocation) const
+{
+    LayoutPoint location = roundedLocation;
+    convertToLayerCoords(ancestorLayer, location);
+    roundedLocation = roundedIntPoint(location);
+}
+
+void RenderLayer::convertToPixelSnappedLayerCoords(const RenderLayer* ancestorLayer, IntRect& roundedRect) const
+{
+    LayoutRect rect = roundedRect;
+    convertToLayerCoords(ancestorLayer, rect);
+    roundedRect = pixelSnappedIntRect(rect);
+}
+
+void RenderLayer::convertToLayerCoords(const RenderLayer* ancestorLayer, LayoutPoint& location) const
 {
     if (ancestorLayer == this)
         return;
@@ -1325,8 +1339,7 @@ RenderLayer::convertToLayerCoords(const RenderLayer* ancestorLayer, LayoutPoint&
     location += toSize(m_topLeft);
 }
 
-void
-RenderLayer::convertToLayerCoords(const RenderLayer* ancestorLayer, LayoutRect& rect) const
+void RenderLayer::convertToLayerCoords(const RenderLayer* ancestorLayer, LayoutRect& rect) const
 {
     LayoutPoint delta;
     convertToLayerCoords(ancestorLayer, delta);
@@ -1578,7 +1591,7 @@ void RenderLayer::scrollRectToVisible(const LayoutRect& rect, const ScrollAlignm
                 LayoutRect viewRect = frameView->visibleContentRect();
                 LayoutRect r = getRectToExpose(viewRect, rect, alignX, alignY);
                 
-                frameView->setScrollPosition(r.location());
+                frameView->setScrollPosition(roundedIntPoint(r.location()));
 
                 // This is the outermost view of a web page, so after scrolling this view we
                 // scroll its container by calling Page::scrollRectIntoView.
@@ -1587,7 +1600,7 @@ void RenderLayer::scrollRectToVisible(const LayoutRect& rect, const ScrollAlignm
                 // The canAutoscroll function in EventHandler also knows about this.
                 if (Frame* frame = frameView->frame()) {
                     if (Page* page = frame->page())
-                        page->chrome()->scrollRectIntoView(rect);
+                        page->chrome()->scrollRectIntoView(pixelSnappedIntRect(rect));
                 }
             }
         }
@@ -1725,29 +1738,29 @@ void RenderLayer::resize(const PlatformMouseEvent& evt, const LayoutSize& oldOff
     LayoutSize difference = (currentSize + newOffset - adjustedOldOffset).expandedTo(minimumSize) - currentSize;
 
     ASSERT(element->isStyledElement());
-    StylePropertySet* styleDeclaration = static_cast<StyledElement*>(element)->ensureInlineStyleDecl();
+    StyledElement* styledElement = static_cast<StyledElement*>(element);
     bool isBoxSizingBorder = renderer->style()->boxSizing() == BORDER_BOX;
 
     if (resize != RESIZE_VERTICAL && difference.width()) {
         if (element->isFormControlElement()) {
             // Make implicit margins from the theme explicit (see <http://bugs.webkit.org/show_bug.cgi?id=9547>).
-            styleDeclaration->setProperty(CSSPropertyMarginLeft, String::number(renderer->marginLeft() / zoomFactor) + "px", false);
-            styleDeclaration->setProperty(CSSPropertyMarginRight, String::number(renderer->marginRight() / zoomFactor) + "px", false);
+            styledElement->setInlineStyleProperty(CSSPropertyMarginLeft, String::number(renderer->marginLeft() / zoomFactor) + "px", false);
+            styledElement->setInlineStyleProperty(CSSPropertyMarginRight, String::number(renderer->marginRight() / zoomFactor) + "px", false);
         }
-        LayoutUnit baseWidth = renderer->width() - (isBoxSizingBorder ? 0 : renderer->borderAndPaddingWidth());
+        LayoutUnit baseWidth = renderer->width() - (isBoxSizingBorder ? zeroLayoutUnit : renderer->borderAndPaddingWidth());
         baseWidth = baseWidth / zoomFactor;
-        styleDeclaration->setProperty(CSSPropertyWidth, String::number(baseWidth + difference.width()) + "px", false);
+        styledElement->setInlineStyleProperty(CSSPropertyWidth, String::number(baseWidth + difference.width()) + "px", false);
     }
 
     if (resize != RESIZE_HORIZONTAL && difference.height()) {
         if (element->isFormControlElement()) {
             // Make implicit margins from the theme explicit (see <http://bugs.webkit.org/show_bug.cgi?id=9547>).
-            styleDeclaration->setProperty(CSSPropertyMarginTop, String::number(renderer->marginTop() / zoomFactor) + "px", false);
-            styleDeclaration->setProperty(CSSPropertyMarginBottom, String::number(renderer->marginBottom() / zoomFactor) + "px", false);
+            styledElement->setInlineStyleProperty(CSSPropertyMarginTop, String::number(renderer->marginTop() / zoomFactor) + "px", false);
+            styledElement->setInlineStyleProperty(CSSPropertyMarginBottom, String::number(renderer->marginBottom() / zoomFactor) + "px", false);
         }
-        LayoutUnit baseHeight = renderer->height() - (isBoxSizingBorder ? 0 : renderer->borderAndPaddingHeight());
+        LayoutUnit baseHeight = renderer->height() - (isBoxSizingBorder ? zeroLayoutUnit : renderer->borderAndPaddingHeight());
         baseHeight = baseHeight / zoomFactor;
-        styleDeclaration->setProperty(CSSPropertyHeight, String::number(baseHeight + difference.height()) + "px", false);
+        styledElement->setInlineStyleProperty(CSSPropertyHeight, String::number(baseHeight + difference.height()) + "px", false);
     }
 
     document->updateLayout();
@@ -1788,7 +1801,7 @@ IntPoint RenderLayer::minimumScrollPosition() const
 IntPoint RenderLayer::maximumScrollPosition() const
 {
     // FIXME: m_scrollSize may not be up-to-date if m_scrollDimensionsDirty is true.
-    return scrollOrigin() + m_scrollSize - visibleContentRect(true).size();
+    return scrollOrigin() + roundedIntSize(m_scrollSize) - visibleContentRect(true).size();
 }
 
 IntRect RenderLayer::visibleContentRect(bool includeScrollbars) const
@@ -1850,7 +1863,7 @@ IntRect RenderLayer::scrollCornerRect() const
     bool hasVerticalBar = verticalScrollbar();
     bool hasResizer = renderer()->style()->resize() != RESIZE_NONE;
     if ((hasHorizontalBar && hasVerticalBar) || (hasResizer && (hasHorizontalBar || hasVerticalBar)))
-        return cornerRect(this, renderBox()->borderBoxRect());
+        return cornerRect(this, pixelSnappedIntRect(renderBox()->borderBoxRect()));
     return IntRect();
 }
 
@@ -1869,7 +1882,7 @@ IntRect RenderLayer::scrollCornerAndResizerRect() const
         return IntRect();
     IntRect scrollCornerAndResizer = scrollCornerRect();
     if (scrollCornerAndResizer.isEmpty())
-        scrollCornerAndResizer = resizerCornerRect(this, box->borderBoxRect());
+        scrollCornerAndResizer = resizerCornerRect(this, pixelSnappedIntRect(box->borderBoxRect()));
     return scrollCornerAndResizer;
 }
 
@@ -2131,12 +2144,12 @@ int RenderLayer::horizontalScrollbarHeight(OverlayScrollbarSizeRelevancy relevan
     return m_hBar->height();
 }
 
-LayoutSize RenderLayer::offsetFromResizeCorner(const LayoutPoint& absolutePoint) const
+IntSize RenderLayer::offsetFromResizeCorner(const IntPoint& absolutePoint) const
 {
     // Currently the resize corner is always the bottom right corner
     // FIXME: This assumes the location is 0, 0. Is this guaranteed to always be the case?
-    LayoutPoint bottomRight = toPoint(size());
-    LayoutPoint localPoint = absoluteToContents(absolutePoint);
+    IntPoint bottomRight = toPoint(size());
+    IntPoint localPoint = roundedIntPoint(absoluteToContents(absolutePoint));
     return localPoint - bottomRight;
 }
 
@@ -2145,7 +2158,7 @@ bool RenderLayer::hasOverflowControls() const
     return m_hBar || m_vBar || m_scrollCorner || renderer()->style()->resize() != RESIZE_NONE;
 }
 
-void RenderLayer::positionOverflowControls(const LayoutSize& offsetFromLayer)
+void RenderLayer::positionOverflowControls(const IntSize& offsetFromLayer)
 {
     if (!m_hBar && !m_vBar && (!renderer()->hasOverflowClip() || renderer()->style()->resize() == RESIZE_NONE))
         return;
@@ -2154,7 +2167,7 @@ void RenderLayer::positionOverflowControls(const LayoutSize& offsetFromLayer)
     if (!box)
         return;
 
-    const IntRect borderBox = box->borderBoxRect();
+    const IntRect borderBox = pixelSnappedIntRect(box->borderBoxRect());
     const IntRect& scrollCorner = scrollCornerRect();
     IntRect absBounds(borderBox.location() + offsetFromLayer, borderBox.size());
     if (m_vBar)
@@ -2397,7 +2410,7 @@ void RenderLayer::updateScrollInfoAfterLayout()
         updateOverflowStatus(horizontalOverflow, verticalOverflow);
 }
 
-void RenderLayer::paintOverflowControls(GraphicsContext* context, const LayoutPoint& paintOffset, const LayoutRect& damageRect, bool paintingOverlayControls)
+void RenderLayer::paintOverflowControls(GraphicsContext* context, const IntPoint& paintOffset, const IntRect& damageRect, bool paintingOverlayControls)
 {
     // Don't do anything if we have no overflow.
     if (!renderer()->hasOverflowClip())
@@ -2421,7 +2434,7 @@ void RenderLayer::paintOverflowControls(GraphicsContext* context, const LayoutPo
     if (paintingOverlayControls && !hasOverlayScrollbars())
         return;
 
-    LayoutPoint adjustedPaintOffset = paintOffset;
+    IntPoint adjustedPaintOffset = paintOffset;
     if (paintingOverlayControls)
         adjustedPaintOffset = m_cachedOverlayScrollbarOffset;
 
@@ -2457,12 +2470,12 @@ void RenderLayer::paintOverflowControls(GraphicsContext* context, const LayoutPo
     paintResizer(context, adjustedPaintOffset, damageRect);
 }
 
-void RenderLayer::paintScrollCorner(GraphicsContext* context, const LayoutPoint& paintOffset, const LayoutRect& damageRect)
+void RenderLayer::paintScrollCorner(GraphicsContext* context, const IntPoint& paintOffset, const IntRect& damageRect)
 {
     RenderBox* box = renderBox();
     ASSERT(box);
 
-    LayoutRect absRect = scrollCornerRect();
+    IntRect absRect = scrollCornerRect();
     absRect.moveBy(paintOffset);
     if (!absRect.intersects(damageRect))
         return;
@@ -2483,7 +2496,7 @@ void RenderLayer::paintScrollCorner(GraphicsContext* context, const LayoutPoint&
         context->fillRect(absRect, Color::white, box->style()->colorSpace());
 }
 
-void RenderLayer::drawPlatformResizerImage(GraphicsContext* context, LayoutRect resizerCornerRect)
+void RenderLayer::drawPlatformResizerImage(GraphicsContext* context, IntRect resizerCornerRect)
 {
     float deviceScaleFactor = WebCore::deviceScaleFactor(renderer()->frame());
 
@@ -2504,7 +2517,7 @@ void RenderLayer::drawPlatformResizerImage(GraphicsContext* context, LayoutRect
     context->drawImage(resizeCornerImage.get(), renderer()->style()->colorSpace(), imageRect);
 }
 
-void RenderLayer::paintResizer(GraphicsContext* context, const LayoutPoint& paintOffset, const LayoutRect& damageRect)
+void RenderLayer::paintResizer(GraphicsContext* context, const IntPoint& paintOffset, const IntRect& damageRect)
 {
     if (renderer()->style()->resize() == RESIZE_NONE)
         return;
@@ -2512,7 +2525,7 @@ void RenderLayer::paintResizer(GraphicsContext* context, const LayoutPoint& pain
     RenderBox* box = renderBox();
     ASSERT(box);
 
-    LayoutRect absRect = resizerCornerRect(this, box->borderBoxRect());
+    IntRect absRect = resizerCornerRect(this, pixelSnappedIntRect(box->borderBoxRect()));
     absRect.moveBy(paintOffset);
     if (!absRect.intersects(damageRect))
         return;
@@ -2534,8 +2547,8 @@ void RenderLayer::paintResizer(GraphicsContext* context, const LayoutPoint& pain
     if (!hasOverlayScrollbars() && (m_vBar || m_hBar)) {
         GraphicsContextStateSaver stateSaver(*context);
         context->clip(absRect);
-        LayoutRect largerCorner = absRect;
-        largerCorner.setSize(LayoutSize(largerCorner.width() + 1, largerCorner.height() + 1));
+        IntRect largerCorner = absRect;
+        largerCorner.setSize(IntSize(largerCorner.width() + 1, largerCorner.height() + 1));
         context->setStrokeColor(Color(makeRGB(217, 217, 217)), ColorSpaceDeviceRGB);
         context->setStrokeThickness(1.0f);
         context->setFillColor(Color::transparent, ColorSpaceDeviceRGB);
@@ -2543,7 +2556,7 @@ void RenderLayer::paintResizer(GraphicsContext* context, const LayoutPoint& pain
     }
 }
 
-bool RenderLayer::isPointInResizeControl(const LayoutPoint& absolutePoint) const
+bool RenderLayer::isPointInResizeControl(const IntPoint& absolutePoint) const
 {
     if (!renderer()->hasOverflowClip() || renderer()->style()->resize() == RESIZE_NONE)
         return false;
@@ -2551,13 +2564,13 @@ bool RenderLayer::isPointInResizeControl(const LayoutPoint& absolutePoint) const
     RenderBox* box = renderBox();
     ASSERT(box);
 
-    LayoutPoint localPoint = absoluteToContents(absolutePoint);
+    IntPoint localPoint = roundedIntPoint(absoluteToContents(absolutePoint));
 
-    LayoutRect localBounds(0, 0, box->width(), box->height());
+    IntRect localBounds(0, 0, box->pixelSnappedWidth(), box->pixelSnappedHeight());
     return resizerCornerRect(this, localBounds).contains(localPoint);
 }
     
-bool RenderLayer::hitTestOverflowControls(HitTestResult& result, const LayoutPoint& localPoint)
+bool RenderLayer::hitTestOverflowControls(HitTestResult& result, const IntPoint& localPoint)
 {
     if (!m_hBar && !m_vBar && (!renderer()->hasOverflowClip() || renderer()->style()->resize() == RESIZE_NONE))
         return false;
@@ -2567,7 +2580,7 @@ bool RenderLayer::hitTestOverflowControls(HitTestResult& result, const LayoutPoi
     
     IntRect resizeControlRect;
     if (renderer()->style()->resize() != RESIZE_NONE) {
-        resizeControlRect = resizerCornerRect(this, box->borderBoxRect());
+        resizeControlRect = resizerCornerRect(this, pixelSnappedIntRect(box->borderBoxRect()));
         if (resizeControlRect.contains(localPoint))
             return true;
     }
@@ -2645,7 +2658,7 @@ void RenderLayer::clipToRect(RenderLayer* rootLayer, GraphicsContext* context, c
     if (clipRect.rect() == paintDirtyRect)
         return;
     context->save();
-    context->clip(clipRect.rect());
+    context->clip(pixelSnappedIntRect(clipRect.rect()));
     
     if (!clipRect.hasRadius())
         return;
@@ -2946,7 +2959,7 @@ void RenderLayer::paintLayerContents(RenderLayer* rootLayer, GraphicsContext* co
 
     if (isPaintingOverlayScrollbars) {
         clipToRect(rootLayer, context, paintDirtyRect, damageRect);
-        paintOverflowControls(context, paintOffset, damageRect.rect(), true);
+        paintOverflowControls(context, roundedIntPoint(paintOffset), pixelSnappedIntRect(damageRect.rect()), true);
         restoreClip(context, paintDirtyRect, damageRect);
     }
 
@@ -3110,9 +3123,9 @@ bool RenderLayer::hitTest(const HitTestRequest& request, HitTestResult& result)
 {
     renderer()->document()->updateLayout();
     
-    LayoutRect hitTestArea = renderer()->view()->documentRect();
+    IntRect hitTestArea = renderer()->isRenderFlowThread() ? toRenderFlowThread(renderer())->borderBoxRect() : renderer()->view()->documentRect();
     if (!request.ignoreClipping())
-        hitTestArea.intersect(frameVisibleRect(renderer()));
+        hitTestArea.intersect(pixelSnappedIntRect(frameVisibleRect(renderer())));
 
     RenderLayer* insideLayer = hitTestLayer(this, 0, request, result, hitTestArea, result.point(), false);
     if (!insideLayer) {
@@ -3747,7 +3760,7 @@ void RenderLayer::calculateRects(const RenderLayer* rootLayer, RenderRegion* reg
             backgroundRect.intersect(layerBoundsWithVisualOverflow);
         } else {
             // Shift the bounds to be for our region only.
-            LayoutRect bounds = renderBox()->borderBoxRectInRegion(region);
+            LayoutRect bounds = pixelSnappedIntRect(renderBox()->borderBoxRectInRegion(region));
             bounds.moveBy(offset);
             backgroundRect.intersect(bounds);
         }
@@ -4269,7 +4282,7 @@ void RenderLayer::setBackingNeedsRepaintInRect(const LayoutRect& r)
         if (view)
             view->repaintViewRectangle(absRect);
     } else
-        backing()->setContentsNeedDisplayInRect(r);
+        backing()->setContentsNeedDisplayInRect(pixelSnappedIntRect(r));
 }
 
 // Since we're only painting non-composited layers, we know that they all share the same repaintContainer.
diff --git a/Source/WebCore/rendering/RenderLayer.h b/Source/WebCore/rendering/RenderLayer.h
index bb4797bb2..4c5be0cdc 100644
--- a/Source/WebCore/rendering/RenderLayer.h
+++ b/Source/WebCore/rendering/RenderLayer.h
@@ -295,8 +295,6 @@ public:
     // Scrolling methods for layers that can scroll their overflow.
     void scrollByRecursively(LayoutUnit xDelta, LayoutUnit yDelta, ScrollOffsetClamping = ScrollOffsetUnclamped);
 
-    LayoutSize scrolledContentOffset() const { return scrollOffset() + m_scrollOverflow; }
-
     int scrollXOffset() const { return m_scrollOffset.width() + scrollOrigin().x(); }
     int scrollYOffset() const { return m_scrollOffset.height() + scrollOrigin().y(); }
     IntSize scrollOffset() const { return IntSize(scrollXOffset(), scrollYOffset()); }
@@ -327,13 +325,13 @@ public:
     int horizontalScrollbarHeight(OverlayScrollbarSizeRelevancy = IgnoreOverlayScrollbarSize) const;
 
     bool hasOverflowControls() const;
-    bool isPointInResizeControl(const LayoutPoint& absolutePoint) const;
-    bool hitTestOverflowControls(HitTestResult&, const LayoutPoint& localPoint);
-    LayoutSize offsetFromResizeCorner(const LayoutPoint& absolutePoint) const;
+    bool isPointInResizeControl(const IntPoint& absolutePoint) const;
+    bool hitTestOverflowControls(HitTestResult&, const IntPoint& localPoint);
+    IntSize offsetFromResizeCorner(const IntPoint& absolutePoint) const;
 
-    void paintOverflowControls(GraphicsContext*, const LayoutPoint&, const LayoutRect& damageRect, bool paintingOverlayControls = false);
-    void paintScrollCorner(GraphicsContext*, const LayoutPoint&, const LayoutRect& damageRect);
-    void paintResizer(GraphicsContext*, const LayoutPoint&, const LayoutRect& damageRect);
+    void paintOverflowControls(GraphicsContext*, const IntPoint&, const IntRect& damageRect, bool paintingOverlayControls = false);
+    void paintScrollCorner(GraphicsContext*, const IntPoint&, const IntRect& damageRect);
+    void paintResizer(GraphicsContext*, const IntPoint&, const IntRect& damageRect);
 
     void updateScrollInfoAfterLayout();
 
@@ -425,6 +423,8 @@ public:
     RenderLayer* ancestorCompositingLayer() const { return enclosingCompositingLayer(false); }
 #endif
 
+    void convertToPixelSnappedLayerCoords(const RenderLayer* ancestorLayer, IntPoint& location) const;
+    void convertToPixelSnappedLayerCoords(const RenderLayer* ancestorLayer, IntRect&) const;
     void convertToLayerCoords(const RenderLayer* ancestorLayer, LayoutPoint& location) const;
     void convertToLayerCoords(const RenderLayer* ancestorLayer, LayoutRect&) const;
 
@@ -524,6 +524,9 @@ public:
 
 #if ENABLE(CSS_FILTERS)
     virtual void filterNeedsRepaint();
+    bool hasFilter() const { return renderer()->hasFilter(); }
+#else
+    bool hasFilter() const { return false; }
 #endif
 
     // Overloaded new operator. Derived classes must override operator new
@@ -565,7 +568,7 @@ public:
 private:
     void updateZOrderListsSlowCase();
 
-    void computeRepaintRects(IntPoint* offsetFromRoot = 0);
+    void computeRepaintRects(LayoutPoint* offsetFromRoot = 0);
     void clearRepaintRects();
 
     void clipToRect(RenderLayer* rootLayer, GraphicsContext*, const LayoutRect& paintDirtyRect, const ClipRect&,
@@ -574,6 +577,9 @@ private:
 
     bool shouldRepaintAfterLayout() const;
 
+    friend IntSize RenderBox::scrolledContentOffset() const;
+    IntSize scrolledContentOffset() const { return scrollOffset() + m_scrollOverflow; }
+
     // The normal operator new is disallowed on all render objects.
     void* operator new(size_t) throw();
 
@@ -710,11 +716,11 @@ private:
     // Convert a point in absolute coords into layer coords, taking transforms into account
     LayoutPoint absoluteToContents(const LayoutPoint&) const;
 
-    void positionOverflowControls(const LayoutSize&);
+    void positionOverflowControls(const IntSize&);
     void updateScrollCornerStyle();
     void updateResizerStyle();
 
-    void drawPlatformResizerImage(GraphicsContext*, LayoutRect resizerCornerRect);
+    void drawPlatformResizerImage(GraphicsContext*, IntRect resizerCornerRect);
 
     void updatePagination();
     bool isPaginated() const { return m_isPaginated; }
@@ -818,7 +824,7 @@ protected:
     LayoutSize m_scrollOverflow;
     
     // The width/height of our scrolled area.
-    IntSize m_scrollSize;
+    LayoutSize m_scrollSize;
 
     // For layers with overflow, we have a pair of scrollbars.
     RefPtr<Scrollbar> m_hBar;
@@ -840,7 +846,7 @@ protected:
     const RenderLayer* m_clipRectsRoot;   // Root layer used to compute clip rects.
 #endif
 
-    LayoutPoint m_cachedOverlayScrollbarOffset;
+    IntPoint m_cachedOverlayScrollbarOffset;
 
     RenderMarquee* m_marquee; // Used by layers with overflow:marquee
     
diff --git a/Source/WebCore/rendering/RenderLayerBacking.cpp b/Source/WebCore/rendering/RenderLayerBacking.cpp
index 9503a8275..f559970b4 100644
--- a/Source/WebCore/rendering/RenderLayerBacking.cpp
+++ b/Source/WebCore/rendering/RenderLayerBacking.cpp
@@ -70,7 +70,7 @@ using namespace HTMLNames;
 static bool hasBoxDecorations(const RenderStyle*);
 static bool hasBoxDecorationsOrBackground(const RenderObject*);
 static bool hasBoxDecorationsOrBackgroundImage(const RenderStyle*);
-static LayoutRect clipBox(RenderBox* renderer);
+static IntRect clipBox(RenderBox* renderer);
 
 static inline bool isAcceleratedCanvas(RenderObject* renderer)
 {
@@ -101,7 +101,7 @@ RenderLayerBacking::RenderLayerBacking(RenderLayer* layer)
         if (page && frame && page->mainFrame() == frame) {
             m_isMainFrameRenderViewLayer = true;
 
-#if ENABLE(THREADED_SCROLLING)
+#if PLATFORM(MAC)
             // FIXME: It's a little weird that we base this decision on whether there's a scrolling coordinator or not.
             if (page->scrollingCoordinator())
                 m_usingTiledCacheLayer = true;
@@ -229,7 +229,7 @@ static bool layerOrAncestorIsFullScreen(RenderLayer* layer)
 
 void RenderLayerBacking::updateCompositedBounds()
 {
-    LayoutRect layerBounds = compositor()->calculateCompositedBounds(m_owningLayer, m_owningLayer);
+    IntRect layerBounds = compositor()->calculateCompositedBounds(m_owningLayer, m_owningLayer);
 
     // Clip to the size of the document or enclosing overflow-scroll layer.
     // If this or an ancestor is transformed, we can't currently compute the correct rect to intersect with.
@@ -254,7 +254,7 @@ void RenderLayerBacking::updateCompositedBounds()
         m_owningLayer->convertToLayerCoords(rootLayer, delta);
         clippingBounds.move(-delta.x(), -delta.y());
 
-        layerBounds.intersect(clippingBounds);
+        layerBounds.intersect(pixelSnappedIntRect(clippingBounds));
     }
     
     // If the element has a transform-origin that has fixed lengths, and the renderer has zero size,
@@ -371,7 +371,7 @@ bool RenderLayerBacking::updateGraphicsLayerConfiguration()
     return layerConfigChanged;
 }
 
-static LayoutRect clipBox(RenderBox* renderer)
+static IntRect clipBox(RenderBox* renderer)
 {
     LayoutRect result = PaintInfo::infiniteRect();
     if (renderer->hasOverflowClip())
@@ -380,7 +380,7 @@ static LayoutRect clipBox(RenderBox* renderer)
     if (renderer->hasClip())
         result.intersect(renderer->clipRect(LayoutPoint(), 0)); // FIXME: Incorrect for CSS regions.
 
-    return result;
+    return pixelSnappedIntRect(result);
 }
 
 void RenderLayerBacking::updateGraphicsLayerGeometry()
@@ -416,24 +416,24 @@ void RenderLayerBacking::updateGraphicsLayerGeometry()
     RenderLayer* compAncestor = m_owningLayer->ancestorCompositingLayer();
     
     // We compute everything relative to the enclosing compositing layer.
-    LayoutRect ancestorCompositingBounds;
+    IntRect ancestorCompositingBounds;
     if (compAncestor) {
         ASSERT(compAncestor->backing());
-        ancestorCompositingBounds = compAncestor->backing()->compositedBounds();
+        ancestorCompositingBounds = pixelSnappedIntRect(compAncestor->backing()->compositedBounds());
     }
 
-    LayoutRect localCompositingBounds = compositedBounds();
+    IntRect localCompositingBounds = pixelSnappedIntRect(compositedBounds());
 
-    LayoutRect relativeCompositingBounds(localCompositingBounds);
-    LayoutPoint delta;
-    m_owningLayer->convertToLayerCoords(compAncestor, delta);
+    IntRect relativeCompositingBounds(localCompositingBounds);
+    IntPoint delta;
+    m_owningLayer->convertToPixelSnappedLayerCoords(compAncestor, delta);
     relativeCompositingBounds.moveBy(delta);
 
-    LayoutPoint graphicsLayerParentLocation;
+    IntPoint graphicsLayerParentLocation;
     if (compAncestor && compAncestor->backing()->hasClippingLayer()) {
         // If the compositing ancestor has a layer to clip children, we parent in that, and therefore
         // position relative to it.
-        LayoutRect clippingBox = clipBox(toRenderBox(compAncestor->renderer()));
+        IntRect clippingBox = clipBox(toRenderBox(compAncestor->renderer()));
         graphicsLayerParentLocation = clippingBox.location();
     } else if (compAncestor)
         graphicsLayerParentLocation = ancestorCompositingBounds.location();
@@ -444,7 +444,7 @@ void RenderLayerBacking::updateGraphicsLayerGeometry()
         // Call calculateRects to get the backgroundRect which is what is used to clip the contents of this
         // layer. Note that we call it with temporaryClipRects = true because normally when computing clip rects
         // for a compositing layer, rootLayer is the layer itself.
-        LayoutRect parentClipRect = m_owningLayer->backgroundClipRect(compAncestor, 0, true).rect(); // FIXME: Incorrect for CSS regions.
+        IntRect parentClipRect = pixelSnappedIntRect(m_owningLayer->backgroundClipRect(compAncestor, 0, true).rect()); // FIXME: Incorrect for CSS regions.
         ASSERT(parentClipRect != PaintInfo::infiniteRect());
         m_ancestorClippingLayer->setPosition(FloatPoint() + (parentClipRect.location() - graphicsLayerParentLocation));
         m_ancestorClippingLayer->setSize(parentClipRect.size());
@@ -457,7 +457,7 @@ void RenderLayerBacking::updateGraphicsLayerGeometry()
     }
 
     m_graphicsLayer->setPosition(FloatPoint() + (relativeCompositingBounds.location() - graphicsLayerParentLocation));
-    m_graphicsLayer->setOffsetFromRenderer(localCompositingBounds.location() - LayoutPoint());
+    m_graphicsLayer->setOffsetFromRenderer(localCompositingBounds.location() - IntPoint());
     
     FloatSize oldSize = m_graphicsLayer->size();
     FloatSize newSize = relativeCompositingBounds.size();
@@ -470,12 +470,12 @@ void RenderLayerBacking::updateGraphicsLayerGeometry()
     }
 
     // If we have a layer that clips children, position it.
-    LayoutRect clippingBox;
+    IntRect clippingBox;
     if (m_clippingLayer) {
         clippingBox = clipBox(toRenderBox(renderer()));
         m_clippingLayer->setPosition(FloatPoint() + (clippingBox.location() - localCompositingBounds.location()));
         m_clippingLayer->setSize(clippingBox.size());
-        m_clippingLayer->setOffsetFromRenderer(clippingBox.location() - LayoutPoint());
+        m_clippingLayer->setOffsetFromRenderer(clippingBox.location() - IntPoint());
     }
     
     if (m_maskLayer) {
@@ -488,10 +488,10 @@ void RenderLayerBacking::updateGraphicsLayerGeometry()
     }
     
     if (m_owningLayer->hasTransform()) {
-        const LayoutRect borderBox = toRenderBox(renderer())->borderBoxRect();
+        const IntRect borderBox = pixelSnappedIntRect(toRenderBox(renderer())->borderBoxRect());
 
         // Get layout bounds in the coords of compAncestor to match relativeCompositingBounds.
-        LayoutRect layerBounds = LayoutRect(delta, borderBox.size());
+        IntRect layerBounds = IntRect(delta, borderBox.size());
 
         // Update properties that depend on layer dimensions
         FloatPoint3D transformOrigin = computeTransformOrigin(borderBox);
@@ -524,12 +524,12 @@ void RenderLayerBacking::updateGraphicsLayerGeometry()
     if (m_foregroundLayer) {
         FloatPoint foregroundPosition;
         FloatSize foregroundSize = newSize;
-        LayoutSize foregroundOffset = m_graphicsLayer->offsetFromRenderer();
+        IntSize foregroundOffset = m_graphicsLayer->offsetFromRenderer();
         if (m_clippingLayer) {
             // If we have a clipping layer (which clips descendants), then the foreground layer is a child of it,
             // so that it gets correctly sorted with children. In that case, position relative to the clipping layer.
             foregroundSize = FloatSize(clippingBox.size());
-            foregroundOffset = clippingBox.location() - LayoutPoint();
+            foregroundOffset = clippingBox.location() - IntPoint();
         }
 
         m_foregroundLayer->setPosition(foregroundPosition);
@@ -1002,7 +1002,7 @@ void RenderLayerBacking::updateImageContents()
     image->startAnimation();
 }
 
-FloatPoint3D RenderLayerBacking::computeTransformOrigin(const LayoutRect& borderBox) const
+FloatPoint3D RenderLayerBacking::computeTransformOrigin(const IntRect& borderBox) const
 {
     RenderStyle* style = renderer()->style();
 
@@ -1014,7 +1014,7 @@ FloatPoint3D RenderLayerBacking::computeTransformOrigin(const LayoutRect& border
     return origin;
 }
 
-FloatPoint RenderLayerBacking::computePerspectiveOrigin(const LayoutRect& borderBox) const
+FloatPoint RenderLayerBacking::computePerspectiveOrigin(const IntRect& borderBox) const
 {
     RenderStyle* style = renderer()->style();
 
@@ -1029,26 +1029,26 @@ FloatPoint RenderLayerBacking::computePerspectiveOrigin(const LayoutRect& border
 }
 
 // Return the offset from the top-left of this compositing layer at which the renderer's contents are painted.
-LayoutSize RenderLayerBacking::contentOffsetInCompostingLayer() const
+IntSize RenderLayerBacking::contentOffsetInCompostingLayer() const
 {
-    return LayoutSize(-m_compositedBounds.x(), -m_compositedBounds.y());
+    return IntSize(-m_compositedBounds.x(), -m_compositedBounds.y());
 }
 
-LayoutRect RenderLayerBacking::contentsBox() const
+IntRect RenderLayerBacking::contentsBox() const
 {
     if (!renderer()->isBox())
-        return LayoutRect();
+        return IntRect();
 
-    LayoutRect contentsRect;
+    IntRect contentsRect;
 #if ENABLE(VIDEO)
     if (renderer()->isVideo()) {
         RenderVideo* videoRenderer = toRenderVideo(renderer());
         contentsRect = videoRenderer->videoBox();
     } else
 #endif
-        contentsRect = toRenderBox(renderer())->contentBoxRect();
+        contentsRect = pixelSnappedIntRect(toRenderBox(renderer())->contentBoxRect());
 
-    LayoutSize contentOffset = contentOffsetInCompostingLayer();
+    IntSize contentOffset = contentOffsetInCompostingLayer();
     contentsRect.move(contentOffset);
     return contentsRect;
 }
@@ -1077,29 +1077,29 @@ void RenderLayerBacking::setContentsNeedDisplay()
 }
 
 // r is in the coordinate space of the layer's render object
-void RenderLayerBacking::setContentsNeedDisplayInRect(const LayoutRect& r)
+void RenderLayerBacking::setContentsNeedDisplayInRect(const IntRect& r)
 {
     if (m_graphicsLayer && m_graphicsLayer->drawsContent()) {
-        LayoutRect layerDirtyRect = r;
+        IntRect layerDirtyRect = r;
         layerDirtyRect.move(-m_graphicsLayer->offsetFromRenderer());
         m_graphicsLayer->setNeedsDisplayInRect(layerDirtyRect);
     }
 
     if (m_foregroundLayer && m_foregroundLayer->drawsContent()) {
-        LayoutRect layerDirtyRect = r;
+        IntRect layerDirtyRect = r;
         layerDirtyRect.move(-m_foregroundLayer->offsetFromRenderer());
         m_foregroundLayer->setNeedsDisplayInRect(layerDirtyRect);
     }
 
     if (m_maskLayer && m_maskLayer->drawsContent()) {
-        LayoutRect layerDirtyRect = r;
+        IntRect layerDirtyRect = r;
         layerDirtyRect.move(-m_maskLayer->offsetFromRenderer());
         m_maskLayer->setNeedsDisplayInRect(layerDirtyRect);
     }
 }
 
 void RenderLayerBacking::paintIntoLayer(RenderLayer* rootLayer, GraphicsContext* context,
-                    const LayoutRect& paintDirtyRect, // In the coords of rootLayer.
+                    const IntRect& paintDirtyRect, // In the coords of rootLayer.
                     PaintBehavior paintBehavior, GraphicsLayerPaintingPhase paintingPhase,
                     RenderObject* paintingRoot)
 {
@@ -1124,28 +1124,28 @@ void RenderLayerBacking::paintIntoLayer(RenderLayer* rootLayer, GraphicsContext*
     ASSERT(!m_owningLayer->m_usedTransparency);
 }
 
-static void paintScrollbar(Scrollbar* scrollbar, GraphicsContext& context, const LayoutRect& clip)
+static void paintScrollbar(Scrollbar* scrollbar, GraphicsContext& context, const IntRect& clip)
 {
     if (!scrollbar)
         return;
 
     context.save();
-    const LayoutRect& scrollbarRect = scrollbar->frameRect();
+    const IntRect& scrollbarRect = scrollbar->frameRect();
     context.translate(-scrollbarRect.x(), -scrollbarRect.y());
-    LayoutRect transformedClip = clip;
+    IntRect transformedClip = clip;
     transformedClip.moveBy(scrollbarRect.location());
     scrollbar->paint(&context, transformedClip);
     context.restore();
 }
 
 // Up-call from compositing layer drawing callback.
-void RenderLayerBacking::paintContents(const GraphicsLayer* graphicsLayer, GraphicsContext& context, GraphicsLayerPaintingPhase paintingPhase, const LayoutRect& clip)
+void RenderLayerBacking::paintContents(const GraphicsLayer* graphicsLayer, GraphicsContext& context, GraphicsLayerPaintingPhase paintingPhase, const IntRect& clip)
 {
     if (graphicsLayer == m_graphicsLayer.get() || graphicsLayer == m_foregroundLayer.get() || graphicsLayer == m_maskLayer.get()) {
-        InspectorInstrumentationCookie cookie = InspectorInstrumentation::willPaint(m_owningLayer->renderer()->frame(), clip);
+        InspectorInstrumentationCookie cookie = InspectorInstrumentation::willPaint(m_owningLayer->renderer()->frame(), &context, clip);
 
         // The dirtyRect is in the coords of the painting root.
-        LayoutRect dirtyRect = compositedBounds();
+        IntRect dirtyRect = compositedBounds();
         dirtyRect.intersect(clip);
 
         // We have to use the same root as for hit testing, because both methods can compute and cache clipRects.
@@ -1157,13 +1157,13 @@ void RenderLayerBacking::paintContents(const GraphicsLayer* graphicsLayer, Graph
     } else if (graphicsLayer == layerForVerticalScrollbar()) {
         paintScrollbar(m_owningLayer->verticalScrollbar(), context, clip);
     } else if (graphicsLayer == layerForScrollCorner()) {
-        const LayoutRect& scrollCornerAndResizer = m_owningLayer->scrollCornerAndResizerRect();
+        const IntRect& scrollCornerAndResizer = m_owningLayer->scrollCornerAndResizerRect();
         context.save();
         context.translate(-scrollCornerAndResizer.x(), -scrollCornerAndResizer.y());
-        LayoutRect transformedClip = clip;
+        IntRect transformedClip = clip;
         transformedClip.moveBy(scrollCornerAndResizer.location());
-        m_owningLayer->paintScrollCorner(&context, LayoutPoint(), transformedClip);
-        m_owningLayer->paintResizer(&context, LayoutPoint(), transformedClip);
+        m_owningLayer->paintScrollCorner(&context, IntPoint(), transformedClip);
+        m_owningLayer->paintResizer(&context, IntPoint(), transformedClip);
         context.restore();
     }
 }
@@ -1197,12 +1197,20 @@ bool RenderLayerBacking::startAnimation(double timeOffset, const Animation* anim
 {
     bool hasOpacity = keyframes.containsProperty(CSSPropertyOpacity);
     bool hasTransform = renderer()->isBox() && keyframes.containsProperty(CSSPropertyWebkitTransform);
-    
-    if (!hasOpacity && !hasTransform)
+#if ENABLE(CSS_FILTERS)
+    bool hasFilter = keyframes.containsProperty(CSSPropertyWebkitFilter);
+#else
+    bool hasFilter = false;
+#endif
+
+    if (!hasOpacity && !hasTransform && !hasFilter)
         return false;
     
     KeyframeValueList transformVector(AnimatedPropertyWebkitTransform);
     KeyframeValueList opacityVector(AnimatedPropertyOpacity);
+#if ENABLE(CSS_FILTERS)
+    KeyframeValueList filterVector(AnimatedPropertyWebkitFilter);
+#endif
 
     size_t numKeyframes = keyframes.size();
     for (size_t i = 0; i < numKeyframes; ++i) {
@@ -1222,22 +1230,41 @@ bool RenderLayerBacking::startAnimation(double timeOffset, const Animation* anim
         
         if ((hasOpacity && isFirstOrLastKeyframe) || currentKeyframe.containsProperty(CSSPropertyOpacity))
             opacityVector.insert(new FloatAnimationValue(key, keyframeStyle->opacity(), tf));
+
+#if ENABLE(CSS_FILTERS)
+        if ((hasFilter && isFirstOrLastKeyframe) || currentKeyframe.containsProperty(CSSPropertyWebkitFilter))
+            filterVector.insert(new FilterAnimationValue(key, &(keyframeStyle->filter()), tf));
+#endif
     }
 
     bool didAnimateTransform = false;
     bool didAnimateOpacity = false;
+#if ENABLE(CSS_FILTERS)
+    bool didAnimateFilter = false;
+#endif
     
-    if (hasTransform && m_graphicsLayer->addAnimation(transformVector, toRenderBox(renderer())->borderBoxRect().size(), anim, keyframes.animationName(), timeOffset)) {
+    if (hasTransform && m_graphicsLayer->addAnimation(transformVector, pixelSnappedIntRect(toRenderBox(renderer())->borderBoxRect()).size(), anim, keyframes.animationName(), timeOffset)) {
         didAnimateTransform = true;
         compositor()->didStartAcceleratedAnimation(CSSPropertyWebkitTransform);
     }
 
-    if (hasOpacity && m_graphicsLayer->addAnimation(opacityVector, LayoutSize(), anim, keyframes.animationName(), timeOffset)) {
+    if (hasOpacity && m_graphicsLayer->addAnimation(opacityVector, IntSize(), anim, keyframes.animationName(), timeOffset)) {
         didAnimateOpacity = true;
         compositor()->didStartAcceleratedAnimation(CSSPropertyOpacity);
     }
 
+#if ENABLE(CSS_FILTERS)
+    if (hasFilter && m_graphicsLayer->addAnimation(filterVector, IntSize(), anim, keyframes.animationName(), timeOffset)) {
+        didAnimateFilter = true;
+        compositor()->didStartAcceleratedAnimation(CSSPropertyWebkitFilter);
+    }
+#endif
+
+#if ENABLE(CSS_FILTERS)
+    return didAnimateTransform || didAnimateOpacity || didAnimateFilter;
+#else
     return didAnimateTransform || didAnimateOpacity;
+#endif
 }
 
 void RenderLayerBacking::animationPaused(double timeOffset, const String& animationName)
@@ -1254,6 +1281,10 @@ bool RenderLayerBacking::startTransition(double timeOffset, int property, const
 {
     bool didAnimateOpacity = false;
     bool didAnimateTransform = false;
+#if ENABLE(CSS_FILTERS)
+    bool didAnimateFilter = false;
+#endif
+
     ASSERT(property != cAnimateAll);
 
     if (property == (int)CSSPropertyOpacity) {
@@ -1263,7 +1294,7 @@ bool RenderLayerBacking::startTransition(double timeOffset, int property, const
             opacityVector.insert(new FloatAnimationValue(0, compositingOpacity(fromStyle->opacity())));
             opacityVector.insert(new FloatAnimationValue(1, compositingOpacity(toStyle->opacity())));
             // The boxSize param is only used for transform animations (which can only run on RenderBoxes), so we pass an empty size here.
-            if (m_graphicsLayer->addAnimation(opacityVector, LayoutSize(), opacityAnim, GraphicsLayer::animationNameForTransition(AnimatedPropertyOpacity), timeOffset)) {
+            if (m_graphicsLayer->addAnimation(opacityVector, IntSize(), opacityAnim, GraphicsLayer::animationNameForTransition(AnimatedPropertyOpacity), timeOffset)) {
                 // To ensure that the correct opacity is visible when the animation ends, also set the final opacity.
                 updateLayerOpacity(toStyle);
                 didAnimateOpacity = true;
@@ -1277,21 +1308,46 @@ bool RenderLayerBacking::startTransition(double timeOffset, int property, const
             KeyframeValueList transformVector(AnimatedPropertyWebkitTransform);
             transformVector.insert(new TransformAnimationValue(0, &fromStyle->transform()));
             transformVector.insert(new TransformAnimationValue(1, &toStyle->transform()));
-            if (m_graphicsLayer->addAnimation(transformVector, toRenderBox(renderer())->borderBoxRect().size(), transformAnim, GraphicsLayer::animationNameForTransition(AnimatedPropertyWebkitTransform), timeOffset)) {
-                // To ensure that the correct transform is visible when the animation ends, also set the final opacity.
+            if (m_graphicsLayer->addAnimation(transformVector, pixelSnappedIntRect(toRenderBox(renderer())->borderBoxRect()).size(), transformAnim, GraphicsLayer::animationNameForTransition(AnimatedPropertyWebkitTransform), timeOffset)) {
+                // To ensure that the correct transform is visible when the animation ends, also set the final transform.
                 updateLayerTransform(toStyle);
                 didAnimateTransform = true;
             }
         }
     }
 
+#if ENABLE(CSS_FILTERS)
+    if (property == (int)CSSPropertyWebkitFilter && m_owningLayer->hasFilter()) {
+        const Animation* filterAnim = toStyle->transitionForProperty(CSSPropertyWebkitFilter);
+        if (filterAnim && !filterAnim->isEmptyOrZeroDuration()) {
+            KeyframeValueList filterVector(AnimatedPropertyWebkitFilter);
+            filterVector.insert(new FilterAnimationValue(0, &fromStyle->filter()));
+            filterVector.insert(new FilterAnimationValue(1, &toStyle->filter()));
+            if (m_graphicsLayer->addAnimation(filterVector, IntSize(), filterAnim, GraphicsLayer::animationNameForTransition(AnimatedPropertyWebkitFilter), timeOffset)) {
+                // To ensure that the correct filter is visible when the animation ends, also set the final filter.
+                updateLayerFilters(toStyle);
+                didAnimateFilter = true;
+            }
+        }
+    }
+#endif
+
     if (didAnimateOpacity)
         compositor()->didStartAcceleratedAnimation(CSSPropertyOpacity);
 
     if (didAnimateTransform)
         compositor()->didStartAcceleratedAnimation(CSSPropertyWebkitTransform);
     
+#if ENABLE(CSS_FILTERS)
+    if (didAnimateFilter)
+        compositor()->didStartAcceleratedAnimation(CSSPropertyWebkitFilter);
+#endif
+
+#if ENABLE(CSS_FILTERS)
+    return didAnimateOpacity || didAnimateTransform || didAnimateFilter;
+#else
     return didAnimateOpacity || didAnimateTransform;
+#endif
 }
 
 void RenderLayerBacking::transitionPaused(double timeOffset, int property)
@@ -1330,12 +1386,12 @@ void RenderLayerBacking::resumeAnimations()
     m_graphicsLayer->resumeAnimations();
 }
 
-LayoutRect RenderLayerBacking::compositedBounds() const
+IntRect RenderLayerBacking::compositedBounds() const
 {
     return m_compositedBounds;
 }
 
-void RenderLayerBacking::setCompositedBounds(const LayoutRect& bounds)
+void RenderLayerBacking::setCompositedBounds(const IntRect& bounds)
 {
     m_compositedBounds = bounds;
 
@@ -1353,6 +1409,13 @@ int RenderLayerBacking::graphicsLayerToCSSProperty(AnimatedPropertyID property)
         case AnimatedPropertyBackgroundColor:
             cssProperty = CSSPropertyBackgroundColor;
             break;
+        case AnimatedPropertyWebkitFilter:
+#if ENABLE(CSS_FILTERS)
+            cssProperty = CSSPropertyWebkitFilter;
+#else
+            ASSERT_NOT_REACHED();
+#endif
+            break;
         case AnimatedPropertyInvalid:
             ASSERT_NOT_REACHED();
     }
@@ -1368,6 +1431,10 @@ AnimatedPropertyID RenderLayerBacking::cssToGraphicsLayerProperty(int cssPropert
             return AnimatedPropertyOpacity;
         case CSSPropertyBackgroundColor:
             return AnimatedPropertyBackgroundColor;
+#if ENABLE(CSS_FILTERS)
+        case CSSPropertyWebkitFilter:
+            return AnimatedPropertyWebkitFilter;
+#endif
         // It's fine if we see other css properties here; they are just not accelerated.
     }
     return AnimatedPropertyInvalid;
diff --git a/Source/WebCore/rendering/RenderLayerBacking.h b/Source/WebCore/rendering/RenderLayerBacking.h
index b2d481c57..e1fafc0ac 100644
--- a/Source/WebCore/rendering/RenderLayerBacking.h
+++ b/Source/WebCore/rendering/RenderLayerBacking.h
@@ -99,7 +99,7 @@ public:
 
     void setContentsNeedDisplay();
     // r is in the coordinate space of the layer's render object
-    void setContentsNeedDisplayInRect(const LayoutRect&);
+    void setContentsNeedDisplayInRect(const IntRect&);
 
     // Notification from the renderer that its content changed.
     void contentChanged(RenderLayer::ContentChangeType);
@@ -116,8 +116,8 @@ public:
     void suspendAnimations(double time = 0);
     void resumeAnimations();
 
-    LayoutRect compositedBounds() const;
-    void setCompositedBounds(const LayoutRect&);
+    IntRect compositedBounds() const;
+    void setCompositedBounds(const IntRect&);
     void updateCompositedBounds();
     
     void updateAfterWidgetResize();
@@ -127,7 +127,7 @@ public:
     virtual void notifyAnimationStarted(const GraphicsLayer*, double startTime);
     virtual void notifySyncRequired(const GraphicsLayer*);
 
-    virtual void paintContents(const GraphicsLayer*, GraphicsContext&, GraphicsLayerPaintingPhase, const LayoutRect& clip);
+    virtual void paintContents(const GraphicsLayer*, GraphicsContext&, GraphicsLayerPaintingPhase, const IntRect& clip);
 
     virtual float deviceScaleFactor() const;
     virtual float pageScaleFactor() const;
@@ -136,7 +136,7 @@ public:
     virtual bool showDebugBorders(const GraphicsLayer*) const;
     virtual bool showRepaintCounter(const GraphicsLayer*) const;
 
-    LayoutRect contentsBox() const;
+    IntRect contentsBox() const;
     
     // For informative purposes only.
     CompositingLayerType compositingLayerType() const;
@@ -169,11 +169,11 @@ private:
 
     GraphicsLayerPaintingPhase paintingPhaseForPrimaryLayer() const;
     
-    LayoutSize contentOffsetInCompostingLayer() const;
+    IntSize contentOffsetInCompostingLayer() const;
     // Result is transform origin in pixels.
-    FloatPoint3D computeTransformOrigin(const LayoutRect& borderBox) const;
+    FloatPoint3D computeTransformOrigin(const IntRect& borderBox) const;
     // Result is perspective origin in pixels.
-    FloatPoint computePerspectiveOrigin(const LayoutRect& borderBox) const;
+    FloatPoint computePerspectiveOrigin(const IntRect& borderBox) const;
 
     void updateLayerOpacity(const RenderStyle*);
     void updateLayerTransform(const RenderStyle*);
@@ -200,7 +200,7 @@ private:
     bool containsNonEmptyRenderers() const;
     bool hasVisibleNonCompositingDescendantLayers() const;
     
-    void paintIntoLayer(RenderLayer* rootLayer, GraphicsContext*, const LayoutRect& paintDirtyRect, PaintBehavior, GraphicsLayerPaintingPhase, RenderObject* paintingRoot);
+    void paintIntoLayer(RenderLayer* rootLayer, GraphicsContext*, const IntRect& paintDirtyRect, PaintBehavior, GraphicsLayerPaintingPhase, RenderObject* paintingRoot);
 
     static int graphicsLayerToCSSProperty(AnimatedPropertyID);
     static AnimatedPropertyID cssToGraphicsLayerProperty(int);
@@ -221,7 +221,7 @@ private:
     OwnPtr<GraphicsLayer> m_layerForVerticalScrollbar;
     OwnPtr<GraphicsLayer> m_layerForScrollCorner;
 
-    LayoutRect m_compositedBounds;
+    IntRect m_compositedBounds;
 
     bool m_artificiallyInflatedBounds;      // bounds had to be made non-zero to make transform-origin work
     bool m_isMainFrameRenderViewLayer;
diff --git a/Source/WebCore/rendering/RenderLayerCompositor.cpp b/Source/WebCore/rendering/RenderLayerCompositor.cpp
index 5c0ab779f..75a280c95 100644
--- a/Source/WebCore/rendering/RenderLayerCompositor.cpp
+++ b/Source/WebCore/rendering/RenderLayerCompositor.cpp
@@ -51,16 +51,13 @@
 #include "RenderVideo.h"
 #include "RenderView.h"
 #include "ScrollbarTheme.h"
+#include "ScrollingCoordinator.h"
 #include "Settings.h"
 
 #if ENABLE(PLUGIN_PROXY_FOR_VIDEO)
 #include "HTMLMediaElement.h"
 #endif
 
-#if ENABLE(THREADED_SCROLLING)
-#include "ScrollingCoordinator.h"
-#endif
-
 #if PROFILE_LAYER_REBUILD
 #include <wtf/CurrentTime.h>
 #endif
@@ -456,10 +453,10 @@ void RenderLayerCompositor::repaintOnCompositingChange(RenderLayer* layer)
 
 // The bounds of the GraphicsLayer created for a compositing layer is the union of the bounds of all the descendant
 // RenderLayers that are rendered by the composited RenderLayer.
-LayoutRect RenderLayerCompositor::calculateCompositedBounds(const RenderLayer* layer, const RenderLayer* ancestorLayer)
+IntRect RenderLayerCompositor::calculateCompositedBounds(const RenderLayer* layer, const RenderLayer* ancestorLayer)
 {
     if (!canBeComposited(layer))
-        return LayoutRect();
+        return IntRect();
 
     LayoutRect boundingBoxRect = layer->localBoundingBox();
     if (layer->renderer()->isRoot()) {
@@ -467,8 +464,8 @@ LayoutRect RenderLayerCompositor::calculateCompositedBounds(const RenderLayer* l
         // then it has to be big enough to cover the viewport in order to display the background. This is akin
         // to the code in RenderBox::paintRootBoxFillLayers().
         if (m_renderView->frameView()) {
-            int rw = m_renderView->frameView()->contentsWidth();
-            int rh = m_renderView->frameView()->contentsHeight();
+            LayoutUnit rw = m_renderView->frameView()->contentsWidth();
+            LayoutUnit rh = m_renderView->frameView()->contentsHeight();
             
             boundingBoxRect.setWidth(max(boundingBoxRect.width(), rw - boundingBoxRect.x()));
             boundingBoxRect.setHeight(max(boundingBoxRect.height(), rh - boundingBoxRect.y()));
@@ -481,7 +478,7 @@ LayoutRect RenderLayerCompositor::calculateCompositedBounds(const RenderLayer* l
         LayoutPoint ancestorRelOffset;
         layer->convertToLayerCoords(ancestorLayer, ancestorRelOffset);
         boundingBoxRect.moveBy(ancestorRelOffset);
-        return boundingBoxRect;
+        return pixelSnappedIntRect(boundingBoxRect);
     }
 
     if (RenderLayer* reflection = layer->reflectionLayer()) {
@@ -536,7 +533,7 @@ LayoutRect RenderLayerCompositor::calculateCompositedBounds(const RenderLayer* l
     layer->convertToLayerCoords(ancestorLayer, ancestorRelOffset);
     unionBounds.moveBy(ancestorRelOffset);
 
-    return unionBounds;
+    return pixelSnappedIntRect(unionBounds);
 }
 
 void RenderLayerCompositor::layerWasAdded(RenderLayer* /*parent*/, RenderLayer* /*child*/)
@@ -582,7 +579,7 @@ RenderLayer* RenderLayerCompositor::enclosingNonStackingClippingLayer(const Rend
     return 0;
 }
 
-void RenderLayerCompositor::addToOverlapMap(OverlapMap& overlapMap, RenderLayer* layer, LayoutRect& layerBounds, bool& boundsComputed)
+void RenderLayerCompositor::addToOverlapMap(OverlapMap& overlapMap, RenderLayer* layer, IntRect& layerBounds, bool& boundsComputed)
 {
     if (layer->isRootLayer())
         return;
@@ -591,11 +588,11 @@ void RenderLayerCompositor::addToOverlapMap(OverlapMap& overlapMap, RenderLayer*
         layerBounds = layer->renderer()->localToAbsoluteQuad(FloatRect(layer->localBoundingBox())).enclosingBoundingBox();
         // Empty rects never intersect, but we need them to for the purposes of overlap testing.
         if (layerBounds.isEmpty())
-            layerBounds.setSize(LayoutSize(1, 1));
+            layerBounds.setSize(IntSize(1, 1));
         boundsComputed = true;
     }
 
-    LayoutRect clipRect = layer->backgroundClipRect(rootRenderLayer(), 0, true).rect(); // FIXME: Incorrect for CSS regions.
+    IntRect clipRect = pixelSnappedIntRect(layer->backgroundClipRect(rootRenderLayer(), 0, true).rect()); // FIXME: Incorrect for CSS regions.
     clipRect.scale(pageScaleFactor());
     clipRect.intersect(layerBounds);
     overlapMap.add(layer, clipRect);
@@ -606,7 +603,7 @@ void RenderLayerCompositor::addToOverlapMapRecursive(OverlapMap& overlapMap, Ren
     if (!canBeComposited(layer) || overlapMap.contains(layer))
         return;
 
-    LayoutRect bounds;
+    IntRect bounds;
     bool haveComputedBounds = false;
     addToOverlapMap(overlapMap, layer, bounds, haveComputedBounds);
 
@@ -640,11 +637,11 @@ void RenderLayerCompositor::addToOverlapMapRecursive(OverlapMap& overlapMap, Ren
     }
 }
 
-bool RenderLayerCompositor::overlapsCompositedLayers(OverlapMap& overlapMap, const LayoutRect& layerBounds)
+bool RenderLayerCompositor::overlapsCompositedLayers(OverlapMap& overlapMap, const IntRect& layerBounds)
 {
     RenderLayerCompositor::OverlapMap::const_iterator end = overlapMap.end();
     for (RenderLayerCompositor::OverlapMap::const_iterator it = overlapMap.begin(); it != end; ++it) {
-        const LayoutRect& bounds = it->second;
+        const IntRect& bounds = it->second;
         if (layerBounds.intersects(bounds))
             return true;
     }
@@ -673,13 +670,13 @@ void RenderLayerCompositor::computeCompositingRequirements(RenderLayer* layer, O
     bool mustOverlapCompositedLayers = compositingState.m_subtreeIsCompositing;
 
     bool haveComputedBounds = false;
-    LayoutRect absBounds;
+    IntRect absBounds;
     if (overlapMap && !overlapMap->isEmpty()) {
         // If we're testing for overlap, we only need to composite if we overlap something that is already composited.
         absBounds = layer->renderer()->localToAbsoluteQuad(FloatRect(layer->localBoundingBox())).enclosingBoundingBox();
         // Empty rects never intersect, but we need them to for the purposes of overlap testing.
         if (absBounds.isEmpty())
-            absBounds.setSize(LayoutSize(1, 1));
+            absBounds.setSize(IntSize(1, 1));
         haveComputedBounds = true;
         mustOverlapCompositedLayers = overlapsCompositedLayers(*overlapMap, absBounds);
     }
@@ -953,7 +950,7 @@ void RenderLayerCompositor::rebuildCompositingLayerTree(RenderLayer* layer, Vect
     }
 }
 
-void RenderLayerCompositor::frameViewDidChangeLocation(const LayoutPoint& contentsOffset)
+void RenderLayerCompositor::frameViewDidChangeLocation(const IntPoint& contentsOffset)
 {
     if (m_overflowControlsHostLayer)
         m_overflowControlsHostLayer->setPosition(contentsOffset);
@@ -978,13 +975,22 @@ void RenderLayerCompositor::frameViewDidChangeSize()
 void RenderLayerCompositor::frameViewDidScroll()
 {
     FrameView* frameView = m_renderView->frameView();
-    LayoutPoint scrollPosition = frameView->scrollPosition();
+    IntPoint scrollPosition = frameView->scrollPosition();
 
     if (RenderLayerBacking* backing = rootRenderLayer()->backing())
         backing->graphicsLayer()->visibleRectChanged();
 
-    if (m_scrollLayer)
-        m_scrollLayer->setPosition(FloatPoint(-scrollPosition.x(), -scrollPosition.y()));
+    if (!m_scrollLayer)
+        return;
+
+    // If there's a scrolling coordinator that manages scrolling for this frame view,
+    // it will also manage updating the scroll layer position.
+    if (ScrollingCoordinator* scrollingCoordinator = this->scrollingCoordinator()) {
+        if (scrollingCoordinator->coordinatesScrollingForFrameView(frameView))
+            return;
+    }
+
+    m_scrollLayer->setPosition(FloatPoint(-scrollPosition.x(), -scrollPosition.y()));
 }
 
 String RenderLayerCompositor::layerTreeAsText(bool showDebugInfo)
@@ -1126,12 +1132,12 @@ void RenderLayerCompositor::updateCompositingDescendantGeometry(RenderLayer* com
 }
 
 
-void RenderLayerCompositor::repaintCompositedLayersAbsoluteRect(const LayoutRect& absRect)
+void RenderLayerCompositor::repaintCompositedLayersAbsoluteRect(const IntRect& absRect)
 {
     recursiveRepaintLayerRect(rootRenderLayer(), absRect);
 }
 
-void RenderLayerCompositor::recursiveRepaintLayerRect(RenderLayer* layer, const LayoutRect& rect)
+void RenderLayerCompositor::recursiveRepaintLayerRect(RenderLayer* layer, const IntRect& rect)
 {
     // FIXME: This method does not work correctly with transforms.
     if (layer->isComposited())
@@ -1142,8 +1148,8 @@ void RenderLayerCompositor::recursiveRepaintLayerRect(RenderLayer* layer, const
             size_t listSize = negZOrderList->size();
             for (size_t i = 0; i < listSize; ++i) {
                 RenderLayer* curLayer = negZOrderList->at(i);
-                LayoutRect childRect(rect);
-                curLayer->convertToLayerCoords(layer, childRect);
+                IntRect childRect(rect);
+                curLayer->convertToPixelSnappedLayerCoords(layer, childRect);
                 recursiveRepaintLayerRect(curLayer, childRect);
             }
         }
@@ -1152,8 +1158,8 @@ void RenderLayerCompositor::recursiveRepaintLayerRect(RenderLayer* layer, const
             size_t listSize = posZOrderList->size();
             for (size_t i = 0; i < listSize; ++i) {
                 RenderLayer* curLayer = posZOrderList->at(i);
-                LayoutRect childRect(rect);
-                curLayer->convertToLayerCoords(layer, childRect);
+                IntRect childRect(rect);
+                curLayer->convertToPixelSnappedLayerCoords(layer, childRect);
                 recursiveRepaintLayerRect(curLayer, childRect);
             }
         }
@@ -1162,8 +1168,8 @@ void RenderLayerCompositor::recursiveRepaintLayerRect(RenderLayer* layer, const
         size_t listSize = normalFlowList->size();
         for (size_t i = 0; i < listSize; ++i) {
             RenderLayer* curLayer = normalFlowList->at(i);
-            LayoutRect childRect(rect);
-            curLayer->convertToLayerCoords(layer, childRect);
+            IntRect childRect(rect);
+            curLayer->convertToPixelSnappedLayerCoords(layer, childRect);
             recursiveRepaintLayerRect(curLayer, childRect);
         }
     }
@@ -1223,7 +1229,7 @@ void RenderLayerCompositor::clearBackingForAllLayers()
 void RenderLayerCompositor::updateRootLayerPosition()
 {
     if (m_rootContentLayer) {
-        const LayoutRect& documentRect = m_renderView->documentRect();
+        const IntRect& documentRect = m_renderView->documentRect();
         m_rootContentLayer->setSize(documentRect.size());
         m_rootContentLayer->setPosition(documentRect.location());
     }
@@ -1463,7 +1469,7 @@ bool RenderLayerCompositor::requiresCompositingForPlugin(RenderObject* renderer)
         return pluginRenderer->hasLayer() && pluginRenderer->layer()->isComposited();
 
     // Don't go into compositing mode if height or width are zero, or size is 1x1.
-    LayoutRect contentBox = pluginRenderer->contentBoxRect();
+    IntRect contentBox = pixelSnappedIntRect(pluginRenderer->contentBoxRect());
     return contentBox.height() * contentBox.width() > 1;
 }
 
@@ -1488,7 +1494,7 @@ bool RenderLayerCompositor::requiresCompositingForFrame(RenderObject* renderer)
         return frameRenderer->hasLayer() && frameRenderer->layer()->isComposited();
     
     // Don't go into compositing mode if height or width are zero.
-    LayoutRect contentBox = frameRenderer->contentBoxRect();
+    IntRect contentBox = pixelSnappedIntRect(frameRenderer->contentBoxRect());
     return contentBox.height() * contentBox.width() > 0;
 }
 
@@ -1556,6 +1562,11 @@ bool RenderLayerCompositor::requiresCompositingForPosition(RenderObject* rendere
     if (container != m_renderView)
         return false;
 
+    // Fixed position elements that are invisible in the current view don't get their own layer.
+    FrameView* frameView = m_renderView->frameView();
+    if (frameView && !layer->absoluteBoundingBox().intersects(LayoutRect(frameView->scrollXForFixedPosition(), frameView->scrollYForFixedPosition(), frameView->layoutWidth(), frameView->layoutHeight())))
+        return false;
+
     return true;
 }
 
@@ -1592,31 +1603,31 @@ bool RenderLayerCompositor::requiresScrollLayer(RootLayerAttachment attachment)
         || attachment == RootLayerAttachedViaEnclosingFrame; // a composited frame on Mac
 }
 
-static void paintScrollbar(Scrollbar* scrollbar, GraphicsContext& context, const LayoutRect& clip)
+static void paintScrollbar(Scrollbar* scrollbar, GraphicsContext& context, const IntRect& clip)
 {
     if (!scrollbar)
         return;
 
     context.save();
-    const LayoutRect& scrollbarRect = scrollbar->frameRect();
+    const IntRect& scrollbarRect = scrollbar->frameRect();
     context.translate(-scrollbarRect.x(), -scrollbarRect.y());
-    LayoutRect transformedClip = clip;
+    IntRect transformedClip = clip;
     transformedClip.moveBy(scrollbarRect.location());
     scrollbar->paint(&context, transformedClip);
     context.restore();
 }
 
-void RenderLayerCompositor::paintContents(const GraphicsLayer* graphicsLayer, GraphicsContext& context, GraphicsLayerPaintingPhase, const LayoutRect& clip)
+void RenderLayerCompositor::paintContents(const GraphicsLayer* graphicsLayer, GraphicsContext& context, GraphicsLayerPaintingPhase, const IntRect& clip)
 {
     if (graphicsLayer == layerForHorizontalScrollbar())
         paintScrollbar(m_renderView->frameView()->horizontalScrollbar(), context, clip);
     else if (graphicsLayer == layerForVerticalScrollbar())
         paintScrollbar(m_renderView->frameView()->verticalScrollbar(), context, clip);
     else if (graphicsLayer == layerForScrollCorner()) {
-        const LayoutRect& scrollCorner = m_renderView->frameView()->scrollCornerRect();
+        const IntRect& scrollCorner = m_renderView->frameView()->scrollCornerRect();
         context.save();
         context.translate(-scrollCorner.x(), -scrollCorner.y());
-        LayoutRect transformedClip = clip;
+        IntRect transformedClip = clip;
         transformedClip.moveBy(scrollCorner.location());
         m_renderView->frameView()->paintScrollCorner(&context, transformedClip);
         context.restore();
@@ -1628,6 +1639,23 @@ void RenderLayerCompositor::paintContents(const GraphicsLayer* graphicsLayer, Gr
     }
 }
 
+void RenderLayerCompositor::documentBackgroundColorDidChange()
+{
+    RenderLayerBacking* backing = rootRenderLayer()->backing();
+    if (!backing)
+        return;
+
+    GraphicsLayer* graphicsLayer = backing->graphicsLayer();
+    if (!graphicsLayer->client()->shouldUseTileCache(graphicsLayer))
+        return;
+
+    Color backgroundColor = m_renderView->frameView()->documentBackgroundColor();
+    if (!backgroundColor.isValid() || backgroundColor.hasAlpha())
+        backgroundColor = Color::white;
+
+    graphicsLayer->setBackgroundColor(backgroundColor);
+}
+
 bool RenderLayerCompositor::showDebugBorders(const GraphicsLayer* layer) const
 {
     if (layer == m_layerForHorizontalScrollbar || layer == m_layerForVerticalScrollbar || layer == m_layerForScrollCorner)
@@ -1682,12 +1710,11 @@ static bool shouldCompositeOverflowControls(FrameView* view)
     if (view->platformWidget())
         return false;
 
-#if ENABLE(THREADED_SCROLLING)
     if (Page* page = view->frame()->page()) {
         if (ScrollingCoordinator* scrollingCoordinator = page->scrollingCoordinator())
-            return scrollingCoordinator->coordinatesScrollingForFrameView(view);
+            if (scrollingCoordinator->coordinatesScrollingForFrameView(view))
+                return true;
     }
-#endif
 
 #if !PLATFORM(CHROMIUM)
     if (!view->hasOverlayScrollbars())
@@ -1722,10 +1749,8 @@ bool RenderLayerCompositor::requiresOverhangAreasLayer() const
         return false;
 
     // We do want a layer if we have a scrolling coordinator.
-#if ENABLE(THREADED_SCROLLING)
     if (scrollingCoordinator())
         return true;
-#endif
 
     // Chromium always wants a layer.
 #if PLATFORM(CHROMIUM)
@@ -1741,7 +1766,7 @@ bool RenderLayerCompositor::requiresContentShadowLayer() const
     if (m_renderView->document()->ownerElement())
         return false;
 
-#if PLATFORM(MAC) && ENABLE(THREADED_SCROLLING)
+#if PLATFORM(MAC)
     // On Mac, we want a content shadow layer if we have a scrolling coordinator.
     if (scrollingCoordinator())
         return true;
@@ -1800,19 +1825,15 @@ void RenderLayerCompositor::updateOverflowControlsLayers()
     #endif
             m_overflowControlsHostLayer->addChild(m_layerForHorizontalScrollbar.get());
 
-#if ENABLE(THREADED_SCROLLING)
             if (ScrollingCoordinator* scrollingCoordinator = this->scrollingCoordinator())
                 scrollingCoordinator->frameViewHorizontalScrollbarLayerDidChange(m_renderView->frameView(), m_layerForHorizontalScrollbar.get());
-#endif
         }
     } else if (m_layerForHorizontalScrollbar) {
         m_layerForHorizontalScrollbar->removeFromParent();
         m_layerForHorizontalScrollbar = nullptr;
 
-#if ENABLE(THREADED_SCROLLING)
         if (ScrollingCoordinator* scrollingCoordinator = this->scrollingCoordinator())
             scrollingCoordinator->frameViewHorizontalScrollbarLayerDidChange(m_renderView->frameView(), 0);
-#endif
     }
 
     if (requiresVerticalScrollbarLayer()) {
@@ -1823,19 +1844,15 @@ void RenderLayerCompositor::updateOverflowControlsLayers()
     #endif
             m_overflowControlsHostLayer->addChild(m_layerForVerticalScrollbar.get());
 
-#if ENABLE(THREADED_SCROLLING)
             if (ScrollingCoordinator* scrollingCoordinator = this->scrollingCoordinator())
                 scrollingCoordinator->frameViewVerticalScrollbarLayerDidChange(m_renderView->frameView(), m_layerForVerticalScrollbar.get());
-#endif
         }
     } else if (m_layerForVerticalScrollbar) {
         m_layerForVerticalScrollbar->removeFromParent();
         m_layerForVerticalScrollbar = nullptr;
 
-#if ENABLE(THREADED_SCROLLING)
         if (ScrollingCoordinator* scrollingCoordinator = this->scrollingCoordinator())
             scrollingCoordinator->frameViewVerticalScrollbarLayerDidChange(m_renderView->frameView(), 0);
-#endif
     }
 
     if (requiresScrollCornerLayer()) {
@@ -1865,7 +1882,8 @@ void RenderLayerCompositor::ensureRootLayer()
 #ifndef NDEBUG
         m_rootContentLayer->setName("content root");
 #endif
-        m_rootContentLayer->setSize(FloatSize(m_renderView->maxXLayoutOverflow(), m_renderView->maxYLayoutOverflow()));
+        IntRect overflowRect = m_renderView->pixelSnappedLayoutOverflowRect();
+        m_rootContentLayer->setSize(FloatSize(overflowRect.maxX(), overflowRect.maxY()));
         m_rootContentLayer->setPosition(FloatPoint());
 
         // Need to clip to prevent transformed content showing outside this frame
@@ -1902,11 +1920,6 @@ void RenderLayerCompositor::ensureRootLayer()
 
             frameViewDidChangeSize();
             frameViewDidScroll();
-
-#if ENABLE(THREADED_SCROLLING)
-            if (ScrollingCoordinator* scrollingCoordinator = this->scrollingCoordinator())
-                scrollingCoordinator->frameViewScrollLayerDidChange(m_renderView->frameView(), m_scrollLayer.get());
-#endif
         }
     } else {
         if (m_overflowControlsHostLayer) {
@@ -1941,14 +1954,14 @@ void RenderLayerCompositor::destroyRootLayer()
         m_layerForHorizontalScrollbar->removeFromParent();
         m_layerForHorizontalScrollbar = nullptr;
         if (Scrollbar* horizontalScrollbar = m_renderView->frameView()->verticalScrollbar())
-            m_renderView->frameView()->invalidateScrollbar(horizontalScrollbar, LayoutRect(LayoutPoint(0, 0), horizontalScrollbar->frameRect().size()));
+            m_renderView->frameView()->invalidateScrollbar(horizontalScrollbar, IntRect(IntPoint(0, 0), horizontalScrollbar->frameRect().size()));
     }
 
     if (m_layerForVerticalScrollbar) {
         m_layerForVerticalScrollbar->removeFromParent();
         m_layerForVerticalScrollbar = nullptr;
         if (Scrollbar* verticalScrollbar = m_renderView->frameView()->verticalScrollbar())
-            m_renderView->frameView()->invalidateScrollbar(verticalScrollbar, LayoutRect(LayoutPoint(0, 0), verticalScrollbar->frameRect().size()));
+            m_renderView->frameView()->invalidateScrollbar(verticalScrollbar, IntRect(IntPoint(0, 0), verticalScrollbar->frameRect().size()));
     }
 
     if (m_layerForScrollCorner) {
@@ -1990,7 +2003,10 @@ void RenderLayerCompositor::attachRootLayer(RootLayerAttachment attachment)
             break;
         }
     }
-    
+
+    if (ScrollingCoordinator* scrollingCoordinator = this->scrollingCoordinator())
+        scrollingCoordinator->frameViewRootLayerDidChange(m_renderView->frameView());
+
     m_rootLayerAttachment = attachment;
     rootLayerAttachmentChanged();
 }
@@ -2116,7 +2132,6 @@ void RenderLayerCompositor::deviceOrPageScaleFactorChanged()
         rootLayer->noteDeviceOrPageScaleFactorChangedIncludingDescendants();
 }
 
-#if ENABLE(THREADED_SCROLLING)
 ScrollingCoordinator* RenderLayerCompositor::scrollingCoordinator() const
 {
     if (Frame* frame = m_renderView->frameView()->frame()) {
@@ -2126,7 +2141,6 @@ ScrollingCoordinator* RenderLayerCompositor::scrollingCoordinator() const
 
     return 0;
 }
-#endif
 
 } // namespace WebCore
 
diff --git a/Source/WebCore/rendering/RenderLayerCompositor.h b/Source/WebCore/rendering/RenderLayerCompositor.h
index 00518f3df..86aea07a6 100644
--- a/Source/WebCore/rendering/RenderLayerCompositor.h
+++ b/Source/WebCore/rendering/RenderLayerCompositor.h
@@ -37,12 +37,10 @@ namespace WebCore {
 class GraphicsLayer;
 class RenderEmbeddedObject;
 class RenderPart;
+class ScrollingCoordinator;
 #if ENABLE(VIDEO)
 class RenderVideo;
 #endif
-#if ENABLE(THREADED_SCROLLING)
-class ScrollingCoordinator;
-#endif
 
 enum CompositingUpdateType {
     CompositingUpdateAfterLayoutOrStyleChange,
@@ -121,7 +119,7 @@ public:
     bool needsContentsCompositingLayer(const RenderLayer*) const;
     // Return the bounding box required for compositing layer and its childern, relative to ancestorLayer.
     // If layerBoundingBox is not 0, on return it contains the bounding box of this layer only.
-    LayoutRect calculateCompositedBounds(const RenderLayer*, const RenderLayer* ancestorLayer);
+    IntRect calculateCompositedBounds(const RenderLayer*, const RenderLayer* ancestorLayer);
 
     // Repaint the appropriate layers when the given RenderLayer starts or stops being composited.
     void repaintOnCompositingChange(RenderLayer*);
@@ -134,7 +132,7 @@ public:
     RenderLayer* enclosingNonStackingClippingLayer(const RenderLayer* layer) const;
 
     // Repaint parts of all composited layers that intersect the given absolute rectangle.
-    void repaintCompositedLayersAbsoluteRect(const LayoutRect&);
+    void repaintCompositedLayersAbsoluteRect(const IntRect&);
 
     RenderLayer* rootRenderLayer() const;
     GraphicsLayer* rootGraphicsLayer() const;
@@ -183,7 +181,7 @@ public:
     static bool parentFrameContentLayers(RenderPart*);
 
     // Update the geometry of the layers used for clipping and scrolling in frames.
-    void frameViewDidChangeLocation(const LayoutPoint& contentsOffset);
+    void frameViewDidChangeLocation(const IntPoint& contentsOffset);
     void frameViewDidChangeSize();
     void frameViewDidScroll();
 
@@ -209,11 +207,13 @@ public:
     GraphicsLayer* layerForOverhangAreas() const { return m_layerForOverhangAreas.get(); }
 #endif
 
+    void documentBackgroundColorDidChange();
+
 private:
     // GraphicsLayerClient Implementation
     virtual void notifyAnimationStarted(const GraphicsLayer*, double) { }
     virtual void notifySyncRequired(const GraphicsLayer*) { scheduleLayerFlush(); }
-    virtual void paintContents(const GraphicsLayer*, GraphicsContext&, GraphicsLayerPaintingPhase, const LayoutRect&);
+    virtual void paintContents(const GraphicsLayer*, GraphicsContext&, GraphicsLayerPaintingPhase, const IntRect&);
 
     virtual bool showDebugBorders(const GraphicsLayer*) const;
     virtual bool showRepaintCounter(const GraphicsLayer*) const;
@@ -231,12 +231,12 @@ private:
     void clearBackingForLayerIncludingDescendants(RenderLayer*);
 
     // Repaint the given rect (which is layer's coords), and regions of child layers that intersect that rect.
-    void recursiveRepaintLayerRect(RenderLayer*, const LayoutRect&);
+    void recursiveRepaintLayerRect(RenderLayer*, const IntRect&);
 
-    typedef HashMap<RenderLayer*, LayoutRect> OverlapMap;
-    void addToOverlapMap(OverlapMap&, RenderLayer*, LayoutRect& layerBounds, bool& boundsComputed);
+    typedef HashMap<RenderLayer*, IntRect> OverlapMap;
+    void addToOverlapMap(OverlapMap&, RenderLayer*, IntRect& layerBounds, bool& boundsComputed);
     void addToOverlapMapRecursive(OverlapMap&, RenderLayer*);
-    static bool overlapsCompositedLayers(OverlapMap&, const LayoutRect& layerBounds);
+    static bool overlapsCompositedLayers(OverlapMap&, const IntRect& layerBounds);
 
     void updateCompositingLayersTimerFired(Timer<RenderLayerCompositor>*);
 
@@ -272,6 +272,8 @@ private:
 
     bool isFlushingLayers() const { return m_flushingLayers; }
 
+    ScrollingCoordinator* scrollingCoordinator() const;
+
     // Whether a running transition or animation enforces the need for a compositing layer.
     bool requiresCompositingForAnimation(RenderObject*) const;
     bool requiresCompositingForTransform(RenderObject*) const;
@@ -294,10 +296,6 @@ private:
     bool requiresContentShadowLayer() const;
 #endif
 
-#if ENABLE(THREADED_SCROLLING)
-    ScrollingCoordinator* scrollingCoordinator() const;
-#endif
-
 private:
     RenderView* m_renderView;
     OwnPtr<GraphicsLayer> m_rootContentLayer;
diff --git a/Source/WebCore/rendering/RenderListBox.cpp b/Source/WebCore/rendering/RenderListBox.cpp
index d47a1801e..68ae283e3 100644
--- a/Source/WebCore/rendering/RenderListBox.cpp
+++ b/Source/WebCore/rendering/RenderListBox.cpp
@@ -255,7 +255,7 @@ void RenderListBox::computeLogicalHeight()
         m_vBar->setSteps(1, max(1, numVisibleItems() - 1), itemHeight);
         m_vBar->setProportion(numVisibleItems(), numItems());
         if (!enabled) {
-            scrollToYOffsetWithoutAnimation(0);
+            scrollToOffsetWithoutAnimation(VerticalScrollbar, 0);
             m_indexOffset = 0;
         }
     }
@@ -473,7 +473,7 @@ int RenderListBox::listIndexAtOffset(const LayoutSize& offset)
     if (offset.height() < borderTop() + paddingTop() || offset.height() > height() - paddingBottom() - borderBottom())
         return -1;
 
-    LayoutUnit scrollbarWidth = m_vBar ? m_vBar->width() : LayoutUnit(0);
+    int scrollbarWidth = m_vBar ? m_vBar->width() : 0;
     if (offset.width() < borderLeft() + paddingLeft() || offset.width() > width() - borderRight() - paddingRight() - scrollbarWidth)
         return -1;
 
@@ -579,7 +579,7 @@ bool RenderListBox::scrollToRevealElementAtListIndex(int index)
     else
         newOffset = index - numVisibleItems() + 1;
 
-    ScrollableArea::scrollToYOffsetWithoutAnimation(newOffset);
+    scrollToOffsetWithoutAnimation(VerticalScrollbar, newOffset);
 
     return true;
 }
@@ -638,7 +638,7 @@ LayoutUnit RenderListBox::itemHeight() const
 
 int RenderListBox::verticalScrollbarWidth() const
 {
-    return m_vBar && !m_vBar->isOverlayScrollbar() ? m_vBar->width() : LayoutUnit(0);
+    return m_vBar && !m_vBar->isOverlayScrollbar() ? m_vBar->width() : 0;
 }
 
 // FIXME: We ignore padding in the vertical direction as far as these values are concerned, since that's
@@ -675,7 +675,7 @@ void RenderListBox::setScrollTop(int newTop)
     if (index < 0 || index >= numItems() || index == m_indexOffset)
         return;
     
-    ScrollableArea::scrollToYOffsetWithoutAnimation(index);
+    scrollToOffsetWithoutAnimation(VerticalScrollbar, index);
 }
 
 bool RenderListBox::nodeAtPoint(const HitTestRequest& request, HitTestResult& result, const LayoutPoint& pointInContainer, const LayoutPoint& accumulatedOffset, HitTestAction hitTestAction)
diff --git a/Source/WebCore/rendering/RenderListBox.h b/Source/WebCore/rendering/RenderListBox.h
index e63e00386..407fa5247 100644
--- a/Source/WebCore/rendering/RenderListBox.h
+++ b/Source/WebCore/rendering/RenderListBox.h
@@ -62,8 +62,6 @@ private:
 
     virtual void updateFromElement();
 
-    virtual bool canHaveChildren() const { return false; }
-
     virtual bool hasControlClip() const { return true; }
     virtual void paintObject(PaintInfo&, const LayoutPoint&);
     virtual LayoutRect controlClipRect(const LayoutPoint&) const;
diff --git a/Source/WebCore/rendering/RenderListItem.cpp b/Source/WebCore/rendering/RenderListItem.cpp
index a5b5b94e8..883218d4f 100644
--- a/Source/WebCore/rendering/RenderListItem.cpp
+++ b/Source/WebCore/rendering/RenderListItem.cpp
@@ -247,6 +247,9 @@ void RenderListItem::updateMarkerLocation()
             LayoutStateDisabler layoutStateDisabler(view());
             updateFirstLetter();
             m_marker->remove();
+            // If markerPar is an anonymous block that will lose all its children, destroy it
+            if (markerPar && (markerPar != lineBoxParent) && markerPar->isAnonymousBlock() && !(toRenderBlock(markerPar)->firstChild()))
+                markerPar->destroy();
             if (!lineBoxParent)
                 lineBoxParent = this;
             lineBoxParent->addChild(m_marker, firstNonMarkerChild(lineBoxParent));
diff --git a/Source/WebCore/rendering/RenderListMarker.cpp b/Source/WebCore/rendering/RenderListMarker.cpp
index e7f85283a..fe193987c 100644
--- a/Source/WebCore/rendering/RenderListMarker.cpp
+++ b/Source/WebCore/rendering/RenderListMarker.cpp
@@ -1110,7 +1110,7 @@ void RenderListMarker::paint(PaintInfo& paintInfo, const LayoutPoint& paintOffse
     if (style()->visibility() != VISIBLE)
         return;
 
-    LayoutPoint boxOrigin(paintOffset + location());
+    IntPoint boxOrigin(paintOffset + location());
     LayoutRect overflowRect(visualOverflowRect());
     overflowRect.moveBy(boxOrigin);
     overflowRect.inflate(maximalOutlineSize(paintInfo.phase));
diff --git a/Source/WebCore/rendering/RenderMarquee.cpp b/Source/WebCore/rendering/RenderMarquee.cpp
index ad5892cc6..fe5dbaa22 100644
--- a/Source/WebCore/rendering/RenderMarquee.cpp
+++ b/Source/WebCore/rendering/RenderMarquee.cpp
@@ -125,13 +125,13 @@ int RenderMarquee::computePosition(EMarqueeDirection dir, bool stopAtContentEdge
         }
         if (dir == MRIGHT) {
             if (stopAtContentEdge)
-                return max(0, ltr ? (contentWidth - clientWidth) : (clientWidth - contentWidth));
+                return max(zeroLayoutUnit, ltr ? (contentWidth - clientWidth) : (clientWidth - contentWidth));
             else
                 return ltr ? contentWidth : clientWidth;
         }
         else {
             if (stopAtContentEdge)
-                return min(0, ltr ? (contentWidth - clientWidth) : (clientWidth - contentWidth));
+                return min(zeroLayoutUnit, ltr ? (contentWidth - clientWidth) : (clientWidth - contentWidth));
             else
                 return ltr ? -clientWidth : -contentWidth;
         }
diff --git a/Source/WebCore/rendering/RenderMedia.h b/Source/WebCore/rendering/RenderMedia.h
index 78e36c4ce..54e625af3 100644
--- a/Source/WebCore/rendering/RenderMedia.h
+++ b/Source/WebCore/rendering/RenderMedia.h
@@ -51,6 +51,7 @@ protected:
 private:
     virtual RenderObjectChildList* virtualChildren() { return children(); }
     virtual const RenderObjectChildList* virtualChildren() const { return children(); }
+    virtual bool canHaveChildren() const { return true; }
 
     virtual const char* renderName() const { return "RenderMedia"; }
     virtual bool isMedia() const { return true; }
diff --git a/Source/WebCore/rendering/RenderMenuList.h b/Source/WebCore/rendering/RenderMenuList.h
index b6f44364f..27872eba2 100644
--- a/Source/WebCore/rendering/RenderMenuList.h
+++ b/Source/WebCore/rendering/RenderMenuList.h
@@ -62,12 +62,12 @@ private:
     virtual void addChild(RenderObject* newChild, RenderObject* beforeChild = 0);
     virtual void removeChild(RenderObject*);
     virtual bool createsAnonymousWrapper() const { return true; }
-    virtual bool canHaveChildren() const { return false; }
 
     virtual void updateFromElement();
 
-    virtual bool hasControlClip() const { return true; }
     virtual LayoutRect controlClipRect(const LayoutPoint&) const;
+    virtual bool hasControlClip() const { return true; }
+    virtual RenderText* buttonText() const OVERRIDE { return m_buttonText; }
 
     virtual const char* renderName() const { return "RenderMenuList"; }
 
diff --git a/Source/WebCore/rendering/RenderMeter.h b/Source/WebCore/rendering/RenderMeter.h
index 6eb171761..c4deb12b2 100644
--- a/Source/WebCore/rendering/RenderMeter.h
+++ b/Source/WebCore/rendering/RenderMeter.h
@@ -42,7 +42,6 @@ private:
     virtual const char* renderName() const { return "RenderMeter"; }
     virtual bool isMeter() const { return true; }
     virtual bool requiresForcedStyleRecalcPropagation() const { return true; }
-    virtual bool canHaveChildren() const { return false; }
     virtual void updateFromElement();
 
     double valueRatio() const;
diff --git a/Source/WebCore/rendering/RenderObject.cpp b/Source/WebCore/rendering/RenderObject.cpp
index 73d874416..a91b7f89c 100755
--- a/Source/WebCore/rendering/RenderObject.cpp
+++ b/Source/WebCore/rendering/RenderObject.cpp
@@ -158,7 +158,7 @@ RenderObject* RenderObject::createObject(Node* node, RenderStyle* style)
     case RUN_IN:
     case COMPACT:
         // Only non-replaced block elements can become a region.
-        if (!style->regionThread().isEmpty() && doc->renderView())
+        if (doc->cssRegionsEnabled() && !style->regionThread().isEmpty() && doc->renderView())
             return new (arena) RenderRegion(node, doc->renderView()->ensureRenderFlowThreadWithName(style->regionThread()));
         return new (arena) RenderBlock(node);
     case LIST_ITEM:
@@ -266,6 +266,16 @@ static bool isBeforeAfterContentGeneratedByAncestor(RenderObject* renderer, Rend
     return false;
 }
 
+RenderTable* RenderObject::createAnonymousTable() const
+{
+    RefPtr<RenderStyle> newStyle = RenderStyle::createAnonymousStyle(style());
+    newStyle->setDisplay(TABLE);
+
+    RenderTable* table = new (renderArena()) RenderTable(document() /* is anonymous */);
+    table->setStyle(newStyle.release());
+    return table;
+}
+
 void RenderObject::addChild(RenderObject* newChild, RenderObject* beforeChild)
 {
     RenderObjectChildList* children = virtualChildren();
@@ -310,11 +320,7 @@ void RenderObject::addChild(RenderObject* newChild, RenderObject* beforeChild)
         if (afterChild && afterChild->isAnonymous() && afterChild->isTable() && !afterChild->isBeforeContent())
             table = toRenderTable(afterChild);
         else {
-            table = new (renderArena()) RenderTable(document() /* is anonymous */);
-            RefPtr<RenderStyle> newStyle = RenderStyle::create();
-            newStyle->inheritFrom(style());
-            newStyle->setDisplay(TABLE);
-            table->setStyle(newStyle.release());
+            table = createAnonymousTable();
             addChild(table, beforeChild);
         }
         table->addChild(newChild);
@@ -329,6 +335,17 @@ void RenderObject::addChild(RenderObject* newChild, RenderObject* beforeChild)
             toRenderText(newChild)->setText(textToTransform.release(), true);
     }
 
+    // SVG creates renderers for <g display="none">, as SVG requires children of hidden
+    // <g>s to have renderers - at least that's how our implementation works. Consider:
+    // <g display="none"><foreignObject><body style="position: relative">FOO...
+    // - requiresLayer() would return true for the <body>, creating a new RenderLayer
+    // - when the document is painted, both layers are painted. The <body> layer doesn't
+    //   know that it's inside a "hidden SVG subtree", and thus paints, even if it shouldn't.
+    // To avoid the problem alltogether, detect early if we're inside a hidden SVG subtree
+    // and stop creating layers at all for these cases - they're not used anyways.
+    if (newChild->hasLayer() && !layerCreationAllowedForSubtree())
+        toRenderBoxModelObject(newChild)->layer()->removeOnlyThisLayer();
+
     if (beforeChildHasBeforeAndAfterContent)
         children->updateBeforeAfterContent(this, BEFORE);
 }
@@ -790,7 +807,7 @@ bool RenderObject::mustRepaintBackgroundOrBorder() const
     return false;
 }
 
-void RenderObject::drawLineForBoxSide(GraphicsContext* graphicsContext, LayoutUnit x1, LayoutUnit y1, LayoutUnit x2, LayoutUnit y2,
+void RenderObject::drawLineForBoxSide(GraphicsContext* graphicsContext, int x1, int y1, int x2, int y2,
                                       BoxSide side, Color color, EBorderStyle style,
                                       int adjacentWidth1, int adjacentWidth2, bool antialias)
 {
@@ -1110,7 +1127,7 @@ void RenderObject::addPDFURLRect(GraphicsContext* context, const LayoutRect& rec
     const AtomicString& href = static_cast<Element*>(n)->getAttribute(hrefAttr);
     if (href.isNull())
         return;
-    context->setURLForRect(n->document()->completeURL(href), rect);
+    context->setURLForRect(n->document()->completeURL(href), pixelSnappedIntRect(rect));
 }
 
 void RenderObject::paintOutline(GraphicsContext* graphicsContext, const LayoutRect& paintRect)
@@ -1124,7 +1141,7 @@ void RenderObject::paintOutline(GraphicsContext* graphicsContext, const LayoutRe
 
     Color outlineColor = styleToUse->visitedDependentColor(CSSPropertyOutlineColor);
 
-    LayoutUnit outlineOffset = styleToUse->outlineOffset();
+    int outlineOffset = styleToUse->outlineOffset();
 
     if (styleToUse->outlineStyleIsAuto() || hasOutlineAnnotation()) {
         if (!theme()->supportsFocusRing(styleToUse)) {
@@ -1136,10 +1153,10 @@ void RenderObject::paintOutline(GraphicsContext* graphicsContext, const LayoutRe
     if (styleToUse->outlineStyleIsAuto() || styleToUse->outlineStyle() == BNONE)
         return;
 
-    LayoutRect inner = paintRect;
+    IntRect inner = pixelSnappedIntRect(paintRect);
     inner.inflate(outlineOffset);
 
-    LayoutRect outer = inner;
+    IntRect outer = pixelSnappedIntRect(inner);
     outer.inflate(outlineWidth);
 
     // FIXME: This prevents outlines from painting inside the object. See bug 12042
@@ -1161,14 +1178,14 @@ void RenderObject::paintOutline(GraphicsContext* graphicsContext, const LayoutRe
         outlineColor = Color(outlineColor.red(), outlineColor.green(), outlineColor.blue());
     }
 
-    LayoutUnit leftOuter = outer.x();
-    LayoutUnit leftInner = inner.x();
-    LayoutUnit rightOuter = outer.maxX();
-    LayoutUnit rightInner = inner.maxX();
-    LayoutUnit topOuter = outer.y();
-    LayoutUnit topInner = inner.y();
-    LayoutUnit bottomOuter = outer.maxY();
-    LayoutUnit bottomInner = inner.maxY();
+    int leftOuter = outer.x();
+    int leftInner = inner.x();
+    int rightOuter = outer.maxX();
+    int rightInner = inner.maxX();
+    int topOuter = outer.y();
+    int topInner = inner.y();
+    int bottomOuter = outer.maxY();
+    int bottomInner = inner.maxY();
     
     drawLineForBoxSide(graphicsContext, leftOuter, topOuter, leftInner, bottomOuter, BSLeft, outlineColor, outlineStyle, outlineWidth, outlineWidth);
     drawLineForBoxSide(graphicsContext, leftOuter, topOuter, rightOuter, topInner, BSTop, outlineColor, outlineStyle, outlineWidth, outlineWidth);
@@ -1417,8 +1434,8 @@ bool RenderObject::repaintAfterLayoutIfNeeded(RenderBoxModelObject* repaintConta
         LayoutUnit shadowRight;
         style()->getBoxShadowHorizontalExtent(shadowLeft, shadowRight);
 
-        LayoutUnit borderRight = isBox() ? toRenderBox(this)->borderRight() : LayoutUnit(0);
-        LayoutUnit boxWidth = isBox() ? toRenderBox(this)->width() : LayoutUnit(0);
+        LayoutUnit borderRight = isBox() ? toRenderBox(this)->borderRight() : zeroLayoutUnit;
+        LayoutUnit boxWidth = isBox() ? toRenderBox(this)->width() : zeroLayoutUnit;
         LayoutUnit borderWidth = max<LayoutUnit>(-outlineStyle->outlineOffset(), max(borderRight, max<LayoutUnit>(style()->borderTopRightRadius().width().calcValue(boxWidth), style()->borderBottomRightRadius().width().calcValue(boxWidth)))) + max(ow, shadowRight);
         LayoutRect rightRect(newOutlineBox.x() + min(newOutlineBox.width(), oldOutlineBox.width()) - borderWidth,
             newOutlineBox.y(),
@@ -1436,8 +1453,8 @@ bool RenderObject::repaintAfterLayoutIfNeeded(RenderBoxModelObject* repaintConta
         LayoutUnit shadowBottom;
         style()->getBoxShadowVerticalExtent(shadowTop, shadowBottom);
 
-        LayoutUnit borderBottom = isBox() ? toRenderBox(this)->borderBottom() : LayoutUnit(0);
-        LayoutUnit boxHeight = isBox() ? toRenderBox(this)->height() : LayoutUnit(0);
+        LayoutUnit borderBottom = isBox() ? toRenderBox(this)->borderBottom() : zeroLayoutUnit;
+        LayoutUnit boxHeight = isBox() ? toRenderBox(this)->height() : zeroLayoutUnit;
         LayoutUnit borderHeight = max<LayoutUnit>(-outlineStyle->outlineOffset(), max(borderBottom, max<LayoutUnit>(style()->borderBottomLeftRadius().height().calcValue(boxHeight), style()->borderBottomRightRadius().height().calcValue(boxHeight)))) + max(ow, shadowBottom);
         LayoutRect bottomRect(newOutlineBox.x(),
             min(newOutlineBox.maxY(), oldOutlineBox.maxY()) - borderHeight,
@@ -1500,7 +1517,7 @@ void RenderObject::computeRectForRepaint(RenderBoxModelObject* repaintContainer,
             RenderBox* boxParent = toRenderBox(o);
 
             LayoutRect repaintRect(rect);
-            repaintRect.move(-boxParent->layer()->scrolledContentOffset()); // For overflow:auto/scroll/hidden.
+            repaintRect.move(-boxParent->scrolledContentOffset()); // For overflow:auto/scroll/hidden.
 
             LayoutRect boxRect(LayoutPoint(), boxParent->layer()->size());
             rect = intersection(repaintRect, boxRect);
@@ -1931,6 +1948,12 @@ void RenderObject::propagateStyleToAnonymousChildren(bool blockChildrenOnly)
             if (child->style()->columnSpan())
                 newStyle->setColumnSpan(ColumnSpanAll);
         }
+
+        // Preserve the position style of anonymous block continuations as they can have relative position when
+        // they contain block descendants of relative positioned inlines.
+        if (child->isRelPositioned() && toRenderBlock(child)->isAnonymousBlockContinuation())
+            newStyle->setPosition(child->style()->position());
+
         newStyle->setDisplay(child->style()->display());
         child->setStyle(newStyle.release());
     }
@@ -2006,7 +2029,7 @@ void RenderObject::mapLocalToContainer(RenderBoxModelObject* repaintContainer, b
         transformState.move(columnOffset);
 
     if (o->hasOverflowClip())
-        transformState.move(-toRenderBox(o)->layer()->scrolledContentOffset());
+        transformState.move(-toRenderBox(o)->scrolledContentOffset());
 
     o->mapLocalToContainer(repaintContainer, fixed, useTransforms, transformState, wasFixed);
 }
@@ -2017,7 +2040,7 @@ void RenderObject::mapAbsoluteToLocalPoint(bool fixed, bool useTransforms, Trans
     if (o) {
         o->mapAbsoluteToLocalPoint(fixed, useTransforms, transformState);
         if (o->hasOverflowClip())
-            transformState.move(toRenderBox(o)->layer()->scrolledContentOffset());
+            transformState.move(toRenderBox(o)->scrolledContentOffset());
     }
 }
 
@@ -2079,7 +2102,7 @@ LayoutSize RenderObject::offsetFromContainer(RenderObject* o, const LayoutPoint&
     o->adjustForColumns(offset, point);
 
     if (o->hasOverflowClip())
-        offset -= toRenderBox(o)->layer()->scrolledContentOffset();
+        offset -= toRenderBox(o)->scrolledContentOffset();
 
     return offset;
 }
@@ -2231,6 +2254,18 @@ void RenderObject::willBeDestroyed()
 
     remove();
 
+#ifndef NDEBUG
+    if (!documentBeingDestroyed() && view() && view()->hasRenderFlowThreads()) {
+        // After remove, the object and the associated information should not be in any flow thread.
+        const RenderFlowThreadList* flowThreadList = view()->renderFlowThreadList();
+        for (RenderFlowThreadList::const_iterator iter = flowThreadList->begin(); iter != flowThreadList->end(); ++iter) {
+            const RenderFlowThread* renderFlowThread = *iter;
+            ASSERT(!renderFlowThread->hasChild(this));
+            ASSERT(!renderFlowThread->hasChildInfo(this));
+        }
+    }
+#endif
+
     // If this renderer had a parent, remove should have destroyed any counters
     // attached to this renderer and marked the affected other counters for
     // reevaluation. This apparently redundant check is here for the case when
@@ -2247,6 +2282,33 @@ void RenderObject::willBeDestroyed()
     }
 }
 
+void RenderObject::destroyAndCleanupAnonymousWrappers()
+{
+    RenderObject* parent = this->parent();
+
+    // If the tree is destroyed or our parent is not anonymous, there is no need for a clean-up phase.
+    if (documentBeingDestroyed() || !parent || !parent->isAnonymous()) {
+        destroy();
+        return;
+    }
+
+    bool parentIsLeftOverAnonymousWrapper = false;
+
+    // Currently we only remove anonymous cells' wrapper but we should remove all unneeded
+    // wrappers. See http://webkit.org/b/52123 as an example where this is needed.
+    if (parent->isTableCell())
+        parentIsLeftOverAnonymousWrapper = parent->firstChild() == this && parent->lastChild() == this;
+
+    destroy();
+
+    // WARNING: |this| is deleted here.
+
+    if (parentIsLeftOverAnonymousWrapper) {
+        ASSERT(!parent->firstChild());
+        parent->destroyAndCleanupAnonymousWrappers();
+    }
+}
+
 void RenderObject::destroy()
 {
     willBeDestroyed();
@@ -2487,7 +2549,7 @@ void RenderObject::getTextDecorationColors(int decorations, Color& underline, Co
                 linethrough = decorationColor(curr);
             }
         }
-        if (curr->isFloating() || curr->isPositioned())
+        if (curr->isFloating() || curr->isPositioned() || curr->isRubyText())
             return;
         curr = curr->parent();
         if (curr && curr->isAnonymousBlock() && toRenderBlock(curr)->continuation())
diff --git a/Source/WebCore/rendering/RenderObject.h b/Source/WebCore/rendering/RenderObject.h
index 1bcda46aa..ac1bfc76d 100644
--- a/Source/WebCore/rendering/RenderObject.h
+++ b/Source/WebCore/rendering/RenderObject.h
@@ -58,6 +58,7 @@ class RenderInline;
 class RenderBlock;
 class RenderFlowThread;
 class RenderLayer;
+class RenderTable;
 class RenderTheme;
 class TransformState;
 class VisiblePosition;
@@ -219,6 +220,8 @@ public:
     // normal flow object.
     void handleDynamicFloatPositionChange();
     
+    RenderTable* createAnonymousTable() const;
+    
     // RenderObject tree manipulation
     //////////////////////////////////////////
     virtual bool canHaveChildren() const { return virtualChildren(); }
@@ -352,6 +355,8 @@ public:
 
     bool isHTMLMarquee() const;
 
+    bool isTablePart() const { return isTableCell() || isTableCol() || isTableCaption() || isTableRow() || isTableSection(); }
+
     inline bool isBeforeContent() const;
     inline bool isAfterContent() const;
     inline bool isBeforeOrAfterContent() const;
@@ -359,16 +364,6 @@ public:
     static inline bool isAfterContent(const RenderObject* obj) { return obj && obj->isAfterContent(); }
     static inline bool isBeforeOrAfterContent(const RenderObject* obj) { return obj && obj->isBeforeOrAfterContent(); }
 
-    inline RenderObject* anonymousContainer(RenderObject* child)
-    {
-         RenderObject* container = child;
-         while (container->parent() != this)
-             container = container->parent();
-
-         ASSERT(container->isAnonymous());
-         return container;
-    }
-
     bool hasCounterNodeMap() const { return m_bitfields.hasCounterNodeMap(); }
     void setHasCounterNodeMap(bool hasCounterNodeMap) { m_bitfields.setHasCounterNodeMap(hasCounterNodeMap); }
     bool everHadLayout() const { return m_bitfields.everHadLayout(); }
@@ -392,7 +387,8 @@ public:
     // to add SVG renderer methods to RenderObject with an ASSERT_NOT_REACHED() default implementation.
     virtual bool isSVGRoot() const { return false; }
     virtual bool isSVGContainer() const { return false; }
-    virtual bool isSVGViewportContainer() const { return false; } 
+    virtual bool isSVGTransformableContainer() const { return false; }
+    virtual bool isSVGViewportContainer() const { return false; }
     virtual bool isSVGGradientStop() const { return false; }
     virtual bool isSVGHiddenContainer() const { return false; }
     virtual bool isSVGPath() const { return false; }
@@ -801,6 +797,7 @@ public:
     // as a hook to detect the case of document destruction and don't waste time doing unnecessary work.
     bool documentBeingDestroyed() const;
 
+    void destroyAndCleanupAnonymousWrappers();
     virtual void destroy();
 
     // Virtual function helpers for the deprecated Flexible Box Layout (display: -webkit-box).
@@ -856,13 +853,15 @@ public:
     RenderObject* rendererForRootBackground();
 
 protected:
+    inline bool layerCreationAllowedForSubtree() const;
+
     // Overrides should call the superclass at the end
     virtual void styleWillChange(StyleDifference, const RenderStyle* newStyle);
     // Overrides should call the superclass at the start
     virtual void styleDidChange(StyleDifference, const RenderStyle* oldStyle);
     void propagateStyleToAnonymousChildren(bool blockChildrenOnly = false);
 
-    void drawLineForBoxSide(GraphicsContext*, LayoutUnit x1, LayoutUnit y1, LayoutUnit x2, LayoutUnit y2, BoxSide,
+    void drawLineForBoxSide(GraphicsContext*, int x1, int y1, int x2, int y2, BoxSide,
                             Color, EBorderStyle, int adjbw1, int adjbw2, bool antialias = false);
 
     void paintFocusRing(GraphicsContext*, const LayoutPoint&, RenderStyle*);
@@ -1107,6 +1106,20 @@ inline bool RenderObject::preservesNewline() const
     return style()->preserveNewline();
 }
 
+inline bool RenderObject::layerCreationAllowedForSubtree() const
+{
+#if ENABLE(SVG)
+    RenderObject* parentRenderer = parent();
+    while (parentRenderer) {
+        if (parentRenderer->isSVGHiddenContainer())
+            return false;
+        parentRenderer = parentRenderer->parent();
+    }
+#endif
+
+    return true;
+}
+
 inline void makeMatrixRenderable(TransformationMatrix& matrix, bool has3DRendering)
 {
 #if !ENABLE(3D_RENDERING)
diff --git a/Source/WebCore/rendering/RenderObjectChildList.cpp b/Source/WebCore/rendering/RenderObjectChildList.cpp
index 24055bb16..efe6b8520 100644
--- a/Source/WebCore/rendering/RenderObjectChildList.cpp
+++ b/Source/WebCore/rendering/RenderObjectChildList.cpp
@@ -520,7 +520,15 @@ void RenderObjectChildList::updateBeforeAfterContent(RenderObject* owner, Pseudo
                     renderer->destroy();
                     return;
                 }
-                owner->addChild(generatedContentContainer, insertBefore);
+
+                // When we don't have a first child and are part of a continuation chain,
+                // insertBefore is incorrectly set to zero above, which causes the :before
+                // child to end up at the end of continuation chain.
+                // See https://bugs.webkit.org/show_bug.cgi?id=78380.
+                if (!insertBefore && type == BEFORE && owner->virtualContinuation())
+                    owner->addChildIgnoringContinuation(generatedContentContainer, 0);
+                else
+                    owner->addChild(generatedContentContainer, insertBefore);
             }
             if (generatedContentContainer->isChildAllowed(renderer, pseudoElementStyle))
                 generatedContentContainer->addChild(renderer);
diff --git a/Source/WebCore/rendering/RenderProgress.h b/Source/WebCore/rendering/RenderProgress.h
index 62436fdc0..fa92bb20b 100644
--- a/Source/WebCore/rendering/RenderProgress.h
+++ b/Source/WebCore/rendering/RenderProgress.h
@@ -45,7 +45,6 @@ private:
     virtual const char* renderName() const { return "RenderProgress"; }
     virtual bool isProgress() const { return true; }
     virtual bool requiresForcedStyleRecalcPropagation() const { return true; }
-    virtual bool canHaveChildren() const { return false; }
     virtual void updateFromElement();
 
     void animationTimerFired(Timer<RenderProgress>*);
diff --git a/Source/WebCore/rendering/RenderRegion.cpp b/Source/WebCore/rendering/RenderRegion.cpp
index 8df1ced4c..42f7d2955 100644
--- a/Source/WebCore/rendering/RenderRegion.cpp
+++ b/Source/WebCore/rendering/RenderRegion.cpp
@@ -47,7 +47,9 @@ RenderRegion::RenderRegion(Node* node, RenderFlowThread* flowThread)
     , m_parentFlowThread(0)
     , m_isValid(false)
     , m_hasCustomRegionStyle(false)
+    , m_regionState(RegionUndefined)
 {
+    ASSERT(node->document()->cssRegionsEnabled());
 }
 
 LayoutRect RenderRegion::regionOverflowRect() const
@@ -157,7 +159,8 @@ bool RenderRegion::nodeAtPoint(const HitTestRequest& request, HitTestResult& res
 
     // Check our bounds next. For this purpose always assume that we can only be hit in the
     // foreground phase (which is true for replaced elements like images).
-    LayoutRect boundsRect(adjustedLocation, size());
+    LayoutRect boundsRect = borderBoxRectInRegion(result.region());
+    boundsRect.moveBy(adjustedLocation);
     if (visibleToHitTesting() && action == HitTestForeground && boundsRect.intersects(result.rectForPoint(pointInContainer))) {
         // Check the contents of the RenderFlowThread.
         if (m_flowThread && m_flowThread->hitTestRegion(this, request, result, pointInContainer, LayoutPoint(adjustedLocation.x() + borderLeft() + paddingLeft(), adjustedLocation.y() + borderTop() + paddingTop())))
diff --git a/Source/WebCore/rendering/RenderRegion.h b/Source/WebCore/rendering/RenderRegion.h
index 6bdcdf672..d46d6da67 100644
--- a/Source/WebCore/rendering/RenderRegion.h
+++ b/Source/WebCore/rendering/RenderRegion.h
@@ -81,6 +81,16 @@ public:
     bool isLastRegion() const;
 
     void clearBoxStyleInRegion(const RenderBox*);
+
+    enum RegionState {
+        RegionUndefined,
+        RegionEmpty,
+        RegionFit,
+        RegionOverflow
+    };
+
+    RegionState regionState() const { return isValid() ? m_regionState : RegionUndefined; }
+    void setRegionState(RegionState regionState) { m_regionState = regionState; }
 private:
     virtual const char* renderName() const { return "RenderRegion"; }
 
@@ -109,6 +119,7 @@ private:
 
     bool m_isValid;
     bool m_hasCustomRegionStyle;
+    RegionState m_regionState;
 };
 
 inline RenderRegion* toRenderRegion(RenderObject* object)
diff --git a/Source/WebCore/rendering/RenderReplaced.cpp b/Source/WebCore/rendering/RenderReplaced.cpp
index 82c344866..6bdb1831c 100644
--- a/Source/WebCore/rendering/RenderReplaced.cpp
+++ b/Source/WebCore/rendering/RenderReplaced.cpp
@@ -438,7 +438,7 @@ void RenderReplaced::computePreferredLogicalWidths()
     m_maxPreferredLogicalWidth = computeReplacedLogicalWidth(false) + borderAndPadding;
 
     if (style()->maxWidth().isFixed())
-        m_maxPreferredLogicalWidth = min(m_maxPreferredLogicalWidth, style()->maxWidth().value() + (style()->boxSizing() == CONTENT_BOX ? borderAndPadding : 0));
+        m_maxPreferredLogicalWidth = min(m_maxPreferredLogicalWidth, style()->maxWidth().value() + (style()->boxSizing() == CONTENT_BOX ? borderAndPadding : zeroLayoutUnit));
 
     if (style()->width().isPercent() || style()->height().isPercent()
         || style()->maxWidth().isPercent() || style()->maxHeight().isPercent()
diff --git a/Source/WebCore/rendering/RenderTable.cpp b/Source/WebCore/rendering/RenderTable.cpp
index 5de2ddbda..1a42652db 100644
--- a/Source/WebCore/rendering/RenderTable.cpp
+++ b/Source/WebCore/rendering/RenderTable.cpp
@@ -232,14 +232,16 @@ void RenderTable::computeLogicalWidth()
         setLogicalWidth(convertStyleLogicalWidthToComputedWidth(styleLogicalWidth, containerWidthInInlineDirection));
     else {
         // Subtract out any fixed margins from our available width for auto width tables.
-        LayoutUnit marginTotal = 0;
-        if (!style()->marginStart().isAuto())
-            marginTotal += style()->marginStart().calcValue(availableLogicalWidth);
-        if (!style()->marginEnd().isAuto())
-            marginTotal += style()->marginEnd().calcValue(availableLogicalWidth);
-
+        LayoutUnit marginStart = style()->marginStart().calcMinValue(availableLogicalWidth);
+        LayoutUnit marginEnd = style()->marginEnd().calcMinValue(availableLogicalWidth);
+        LayoutUnit marginTotal = marginStart + marginEnd;
+        
         // Subtract out our margins to get the available content width.
         LayoutUnit availableContentLogicalWidth = max<LayoutUnit>(0, containerWidthInInlineDirection - marginTotal);
+        if (shrinkToAvoidFloats() && cb->containsFloats() && !hasPerpendicularContainingBlock) {
+            // FIXME: Work with regions someday.
+            availableContentLogicalWidth = shrinkLogicalWidthToAvoidFloats(marginStart, marginEnd, cb, 0, 0);
+        }
 
         // Ensure we aren't bigger than our available width.
         setLogicalWidth(min(availableContentLogicalWidth, maxPreferredLogicalWidth()));
@@ -272,7 +274,7 @@ LayoutUnit RenderTable::convertStyleLogicalWidthToComputedWidth(const Length& st
     bool isCSSTable = !node() || !node()->hasTagName(tableTag);
     if (isCSSTable && styleLogicalWidth.isFixed() && styleLogicalWidth.isPositive()) {
         recalcBordersInRowDirection();
-        borders = borderStart() + borderEnd() + (collapseBorders() ? 0 : paddingStart() + paddingEnd());
+        borders = borderStart() + borderEnd() + (collapseBorders() ? zeroLayoutUnit : paddingStart() + paddingEnd());
     }
     return styleLogicalWidth.calcMinValue(availableWidth) + borders;
 }
@@ -370,8 +372,8 @@ void RenderTable::layout()
         }
     }
 
-    LayoutUnit borderAndPaddingBefore = borderBefore() + (collapsing ? 0 : paddingBefore());
-    LayoutUnit borderAndPaddingAfter = borderAfter() + (collapsing ? 0 : paddingAfter());
+    LayoutUnit borderAndPaddingBefore = borderBefore() + (collapsing ? zeroLayoutUnit : paddingBefore());
+    LayoutUnit borderAndPaddingAfter = borderAfter() + (collapsing ? zeroLayoutUnit : paddingAfter());
 
     setLogicalHeight(logicalHeight() + borderAndPaddingBefore);
 
@@ -382,7 +384,7 @@ void RenderTable::layout()
     LayoutUnit computedLogicalHeight = 0;
     if (logicalHeightLength.isFixed()) {
         // HTML tables size as though CSS height includes border/padding, CSS tables do not.
-        LayoutUnit borders = node() && node()->hasTagName(tableTag) ? (borderAndPaddingBefore + borderAndPaddingAfter) : 0;
+        LayoutUnit borders = node() && node()->hasTagName(tableTag) ? (borderAndPaddingBefore + borderAndPaddingAfter) : zeroLayoutUnit;
         computedLogicalHeight = logicalHeightLength.value() - borders;
     } else if (logicalHeightLength.isPercent())
         computedLogicalHeight = computePercentageLogicalHeight(logicalHeightLength);
@@ -390,11 +392,11 @@ void RenderTable::layout()
 
     for (RenderObject* child = firstChild(); child; child = child->nextSibling()) {
         if (child->isTableSection())
-            // FIXME: Distribute extra height between all table body sections instead of giving it all to the first one.
-            toRenderTableSection(child)->layoutRows(child == m_firstBody ? max<LayoutUnit>(0, computedLogicalHeight - totalSectionLogicalHeight) : 0);
+            // FIXME: Distribute the extra logical height between all table sections instead of giving it all to the first one.
+            toRenderTableSection(child)->layoutRows(child == topSection() ? max<LayoutUnit>(0, computedLogicalHeight - totalSectionLogicalHeight) : 0);
     }
 
-    if (!m_firstBody && computedLogicalHeight > totalSectionLogicalHeight && !document()->inQuirksMode()) {
+    if (!topSection() && computedLogicalHeight > totalSectionLogicalHeight && !document()->inQuirksMode()) {
         // Completely empty tables (with no sections or anything) should at least honor specified height
         // in strict mode.
         setLogicalHeight(logicalHeight() + computedLogicalHeight);
@@ -617,7 +619,8 @@ void RenderTable::paintBoxDecorations(PaintInfo& paintInfo, const LayoutPoint& p
     LayoutRect rect(paintOffset, size());
     subtractCaptionRect(rect);
 
-    paintBoxShadow(paintInfo, rect, style(), Normal);
+    if (!boxShadowShouldBeAppliedToBackground(determineBackgroundBleedAvoidance(paintInfo.context)))
+        paintBoxShadow(paintInfo, rect, style(), Normal);
     paintBackground(paintInfo, rect);
     paintBoxShadow(paintInfo, rect, style(), Inset);
 
diff --git a/Source/WebCore/rendering/RenderTable.h b/Source/WebCore/rendering/RenderTable.h
index ba9fd3983..9a6557e03 100644
--- a/Source/WebCore/rendering/RenderTable.h
+++ b/Source/WebCore/rendering/RenderTable.h
@@ -172,7 +172,7 @@ public:
     LayoutUnit bordersPaddingAndSpacingInRowDirection() const
     {
         return borderStart() + borderEnd() +
-               (collapseBorders() ? 0 : (paddingStart() + paddingEnd() + (numEffCols() + 1) * hBorderSpacing()));
+               (collapseBorders() ? zeroLayoutUnit : (paddingStart() + paddingEnd() + (numEffCols() + 1) * hBorderSpacing()));
     }
 
     RenderTableCol* colElement(unsigned col, bool* startEdge = 0, bool* endEdge = 0) const;
diff --git a/Source/WebCore/rendering/RenderTableCell.cpp b/Source/WebCore/rendering/RenderTableCell.cpp
index 5b690f4c7..434ac0d69 100644
--- a/Source/WebCore/rendering/RenderTableCell.cpp
+++ b/Source/WebCore/rendering/RenderTableCell.cpp
@@ -91,6 +91,25 @@ void RenderTableCell::colSpanOrRowSpanChanged()
         section()->setNeedsCellRecalc();
 }
 
+LayoutUnit RenderTableCell::logicalHeightForRowSizing() const
+{
+    LayoutUnit adjustedLogicalHeight = logicalHeight() - (intrinsicPaddingBefore() + intrinsicPaddingAfter());
+
+    LayoutUnit styleLogicalHeight = style()->logicalHeight().calcValue(0);
+    if (document()->inQuirksMode() || style()->boxSizing() == BORDER_BOX) {
+        // Explicit heights use the border box in quirks mode.
+        // Don't adjust height.
+    } else {
+        // In strict mode, box-sizing: content-box do the right
+        // thing and actually add in the border and padding.
+        LayoutUnit adjustedPaddingBefore = paddingBefore() - intrinsicPaddingBefore();
+        LayoutUnit adjustedPaddingAfter = paddingAfter() - intrinsicPaddingAfter();
+        styleLogicalHeight += adjustedPaddingBefore + adjustedPaddingAfter + borderBefore() + borderAfter();
+    }
+
+    return max(styleLogicalHeight, adjustedLogicalHeight);
+}
+
 Length RenderTableCell::styleOrColLogicalWidth() const
 {
     Length w = style()->logicalWidth();
@@ -1068,6 +1087,11 @@ void RenderTableCell::paintMask(PaintInfo& paintInfo, const LayoutPoint& paintOf
     paintMaskImages(paintInfo, LayoutRect(paintOffset, size()));
 }
 
+bool RenderTableCell::boxShadowShouldBeAppliedToBackground(BackgroundBleedAvoidance, InlineFlowBox*) const
+{
+    return false;
+}
+
 void RenderTableCell::scrollbarsChanged(bool horizontalScrollbarChanged, bool verticalScrollbarChanged)
 {
     LayoutUnit scrollbarHeight = scrollbarLogicalHeight();
diff --git a/Source/WebCore/rendering/RenderTableCell.h b/Source/WebCore/rendering/RenderTableCell.h
index 2548b4713..e0b4a0558 100644
--- a/Source/WebCore/rendering/RenderTableCell.h
+++ b/Source/WebCore/rendering/RenderTableCell.h
@@ -85,6 +85,8 @@ public:
 
     Length styleOrColLogicalWidth() const;
 
+    LayoutUnit logicalHeightForRowSizing() const;
+
     virtual void computePreferredLogicalWidths();
 
     void updateLogicalWidth(LayoutUnit);
@@ -151,6 +153,8 @@ private:
     virtual void paintBoxDecorations(PaintInfo&, const LayoutPoint&);
     virtual void paintMask(PaintInfo&, const LayoutPoint&);
 
+    virtual bool boxShadowShouldBeAppliedToBackground(BackgroundBleedAvoidance, InlineFlowBox*) const OVERRIDE;
+
     virtual LayoutSize offsetFromContainer(RenderObject*, const LayoutPoint&) const;
     virtual LayoutRect clippedOverflowRectForRepaint(RenderBoxModelObject* repaintContainer) const;
     virtual void computeRectForRepaint(RenderBoxModelObject* repaintContainer, LayoutRect&, bool fixed = false) const;
diff --git a/Source/WebCore/rendering/RenderTableSection.cpp b/Source/WebCore/rendering/RenderTableSection.cpp
index fd55a6321..844209c8d 100644
--- a/Source/WebCore/rendering/RenderTableSection.cpp
+++ b/Source/WebCore/rendering/RenderTableSection.cpp
@@ -334,14 +334,10 @@ int RenderTableSection::calcRowLogicalHeight()
     m_rowPos[0] = spacing;
 
     for (unsigned r = 0; r < m_grid.size(); r++) {
-        m_rowPos[r + 1] = 0;
-        m_grid[r].baseline = 0;
-        LayoutUnit baseline = 0;
-        int bdesc = 0;
-        int ch = m_grid[r].logicalHeight.calcMinValue(0);
-        int pos = m_rowPos[r] + ch + (m_grid[r].rowRenderer ? spacing : 0);
+        LayoutUnit baselineDescent = 0;
 
-        m_rowPos[r + 1] = max(m_rowPos[r + 1], pos);
+        // Our base size is the biggest logical height from our cells' styles (excluding row spanning cells).
+        m_rowPos[r + 1] = max(m_rowPos[r] + m_grid[r].logicalHeight.calcMinValue(0), 0);
 
         Row& row = m_grid[r].row;
         unsigned totalCols = row.size();
@@ -353,10 +349,13 @@ int RenderTableSection::calcRowLogicalHeight()
             if (!cell || current.inColSpan)
                 continue;
 
-            if ((cell->row() + cell->rowSpan() - 1) > r)
+            // FIXME: We are always adding the height of a rowspan to the last rows which doesn't match
+            // other browsers. See webkit.org/b/52185 for example.
+            if ((cell->row() + cell->rowSpan() - 1) != r)
                 continue;
 
-            unsigned indx = max(r - cell->rowSpan() + 1, 0u);
+            // For row spanning cells, |r| is the last row in the span.
+            unsigned cellStartRow = cell->row();
 
             if (cell->hasOverrideHeight()) {
                 if (!statePusher.didPush()) {
@@ -370,43 +369,27 @@ int RenderTableSection::calcRowLogicalHeight()
                 cell->layoutIfNeeded();
             }
 
-            int adjustedLogicalHeight = cell->logicalHeight() - (cell->intrinsicPaddingBefore() + cell->intrinsicPaddingAfter());
-
-            ch = cell->style()->logicalHeight().calcValue(0);
-            if (document()->inQuirksMode() || cell->style()->boxSizing() == BORDER_BOX) {
-                // Explicit heights use the border box in quirks mode.
-                // Don't adjust height.
-            } else {
-                // In strict mode, box-sizing: content-box do the right
-                // thing and actually add in the border and padding.
-                int adjustedPaddingBefore = cell->paddingBefore() - cell->intrinsicPaddingBefore();
-                int adjustedPaddingAfter = cell->paddingAfter() - cell->intrinsicPaddingAfter();
-                ch += adjustedPaddingBefore + adjustedPaddingAfter + cell->borderBefore() + cell->borderAfter();
-            }
-            ch = max(ch, adjustedLogicalHeight);
-
-            pos = m_rowPos[indx] + ch + (m_grid[r].rowRenderer ? spacing : 0);
-
-            m_rowPos[r + 1] = max(m_rowPos[r + 1], pos);
+            int cellLogicalHeight = cell->logicalHeightForRowSizing();
+            m_rowPos[r + 1] = max(m_rowPos[r + 1], m_rowPos[cellStartRow] + cellLogicalHeight);
 
             // find out the baseline
             EVerticalAlign va = cell->style()->verticalAlign();
             if (va == BASELINE || va == TEXT_BOTTOM || va == TEXT_TOP || va == SUPER || va == SUB) {
-                int b = cell->cellBaselinePosition();
-                if (b > cell->borderBefore() + cell->paddingBefore()) {
-                    baseline = max<LayoutUnit>(baseline, b - cell->intrinsicPaddingBefore());
-                    bdesc = max(bdesc, m_rowPos[indx] + ch - (b - cell->intrinsicPaddingBefore()));
+                int baselinePosition = cell->cellBaselinePosition();
+                if (baselinePosition > cell->borderBefore() + cell->paddingBefore()) {
+                    m_grid[r].baseline = max(m_grid[r].baseline, baselinePosition - cell->intrinsicPaddingBefore());
+                    baselineDescent = max(baselineDescent, m_rowPos[cellStartRow] + cellLogicalHeight - (baselinePosition - cell->intrinsicPaddingBefore()));
                 }
             }
         }
 
         // do we have baseline aligned elements?
-        if (baseline) {
+        if (m_grid[r].baseline)
             // increase rowheight if baseline requires
-            m_rowPos[r + 1] = max(m_rowPos[r + 1], baseline + bdesc + (m_grid[r].rowRenderer ? spacing : 0));
-            m_grid[r].baseline = baseline;
-        }
+            m_rowPos[r + 1] = max(m_rowPos[r + 1], m_grid[r].baseline + baselineDescent);
 
+        // Add the border-spacing to our final position.
+        m_rowPos[r + 1] += m_grid[r].rowRenderer ? spacing : 0;
         m_rowPos[r + 1] = max(m_rowPos[r + 1], m_rowPos[r]);
     }
 
@@ -1306,6 +1289,9 @@ bool RenderTableSection::nodeAtPoint(const HitTestRequest& request, HitTestResul
     }
 
     LayoutUnit offsetInColumnDirection = style()->isHorizontalWritingMode() ? location.y() : location.x();
+    
+    recalcCellsIfNeeded();
+
     // Find the first row that starts after offsetInColumnDirection.
     unsigned nextRow = std::upper_bound(m_rowPos.begin(), m_rowPos.end(), offsetInColumnDirection) - m_rowPos.begin();
     if (nextRow == m_rowPos.size())
diff --git a/Source/WebCore/rendering/RenderText.cpp b/Source/WebCore/rendering/RenderText.cpp
index f6c0373eb..f2408dbcc 100644
--- a/Source/WebCore/rendering/RenderText.cpp
+++ b/Source/WebCore/rendering/RenderText.cpp
@@ -300,7 +300,7 @@ void RenderText::deleteTextBoxes()
 PassRefPtr<StringImpl> RenderText::originalText() const
 {
     Node* e = node();
-    return (e && e->isTextNode()) ? static_cast<Text*>(e)->dataImpl() : 0;
+    return (e && e->isTextNode()) ? toText(e)->dataImpl() : 0;
 }
 
 void RenderText::absoluteRects(Vector<LayoutRect>& rects, const LayoutPoint& accumulatedOffset) const
diff --git a/Source/WebCore/rendering/RenderTextControl.h b/Source/WebCore/rendering/RenderTextControl.h
index 744878af4..aa936e7a0 100644
--- a/Source/WebCore/rendering/RenderTextControl.h
+++ b/Source/WebCore/rendering/RenderTextControl.h
@@ -70,7 +70,6 @@ private:
     virtual bool isTextControl() const { return true; }
     virtual void computePreferredLogicalWidths();
     virtual void removeLeftoverAnonymousBlock(RenderBlock*) { }
-    virtual bool canHaveChildren() const { return false; }
     virtual bool avoidsFloats() const { return true; }
     
     virtual void addFocusRingRects(Vector<LayoutRect>&, const LayoutPoint&);
diff --git a/Source/WebCore/rendering/RenderTextControlSingleLine.cpp b/Source/WebCore/rendering/RenderTextControlSingleLine.cpp
index a86850ce4..a44e2886c 100644
--- a/Source/WebCore/rendering/RenderTextControlSingleLine.cpp
+++ b/Source/WebCore/rendering/RenderTextControlSingleLine.cpp
@@ -60,7 +60,7 @@ VisiblePosition RenderTextControlInnerBlock::positionForPoint(const LayoutPoint&
     if (m_multiLine) {
         RenderTextControl* renderer = toRenderTextControl(node()->shadowAncestorNode()->renderer());
         if (renderer->hasOverflowClip())
-            contentsPoint += renderer->layer()->scrolledContentOffset();
+            contentsPoint += renderer->scrolledContentOffset();
     }
 
     return RenderBlock::positionForPoint(contentsPoint);
@@ -175,7 +175,7 @@ void RenderTextControlSingleLine::showPopup()
         m_searchPopup->saveRecentSearches(name, m_recentSearches);
     }
 
-    m_searchPopup->popupMenu()->show(absoluteBoundingBoxRect(), document()->view(), -1);
+    m_searchPopup->popupMenu()->show(pixelSnappedIntRect(absoluteBoundingBoxRect()), document()->view(), -1);
 }
 
 void RenderTextControlSingleLine::hidePopup()
@@ -196,7 +196,7 @@ void RenderTextControlSingleLine::paint(PaintInfo& paintInfo, const LayoutPoint&
 
         // Convert the rect into the coords used for painting the content
         contentsRect.moveBy(paintOffset + location());
-        theme()->paintCapsLockIndicator(this, paintInfo, contentsRect);
+        theme()->paintCapsLockIndicator(this, paintInfo, pixelSnappedIntRect(contentsRect));
     }
 }
 
@@ -332,7 +332,7 @@ void RenderTextControlSingleLine::styleDidChange(StyleDifference diff, const Ren
         containerRenderer->style()->setWidth(Length());
     }
     if (HTMLElement* placeholder = inputElement()->placeholderElement())
-        placeholder->ensureInlineStyleDecl()->setProperty(CSSPropertyTextOverflow, textShouldBeTruncated() ? CSSValueEllipsis : CSSValueClip);
+        placeholder->setInlineStyleProperty(CSSPropertyTextOverflow, textShouldBeTruncated() ? CSSValueEllipsis : CSSValueClip);
     setHasOverflowClip(false);
 }
 
diff --git a/Source/WebCore/rendering/RenderTextFragment.cpp b/Source/WebCore/rendering/RenderTextFragment.cpp
index 17c9d7b77..ff4082422 100644
--- a/Source/WebCore/rendering/RenderTextFragment.cpp
+++ b/Source/WebCore/rendering/RenderTextFragment.cpp
@@ -52,7 +52,7 @@ RenderTextFragment::~RenderTextFragment()
 PassRefPtr<StringImpl> RenderTextFragment::originalText() const
 {
     Node* e = node();
-    RefPtr<StringImpl> result = ((e && e->isTextNode()) ? static_cast<Text*>(e)->dataImpl() : contentString());
+    RefPtr<StringImpl> result = ((e && e->isTextNode()) ? toText(e)->dataImpl() : contentString());
     if (!result)
         return 0;
     return result->substring(start(), end());
@@ -95,7 +95,7 @@ UChar RenderTextFragment::previousCharacter() const
 {
     if (start()) {
         Node* e = node();
-        StringImpl*  original = ((e && e->isTextNode()) ? static_cast<Text*>(e)->dataImpl() : contentString());
+        StringImpl* original = ((e && e->isTextNode()) ? toText(e)->dataImpl() : contentString());
         if (original && start() <= original->length())
             return (*original)[start() - 1];
     }
diff --git a/Source/WebCore/rendering/RenderTheme.cpp b/Source/WebCore/rendering/RenderTheme.cpp
index d93a27e25..6be2f5efb 100644
--- a/Source/WebCore/rendering/RenderTheme.cpp
+++ b/Source/WebCore/rendering/RenderTheme.cpp
@@ -1,7 +1,7 @@
 /**
  * This file is part of the theme implementation for form controls in WebCore.
  *
- * Copyright (C) 2005, 2006, 2007, 2008, 2009, 2010 Apple Computer, Inc.
+ * Copyright (C) 2005, 2006, 2007, 2008, 2009, 2010, 2012 Apple Computer, Inc.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -1125,18 +1125,21 @@ Color RenderTheme::focusRingColor()
     return customFocusRingColor().isValid() ? customFocusRingColor() : defaultTheme()->platformFocusRingColor();
 }
 
-String RenderTheme::fileListNameForWidth(const Vector<String>& filenames, const Font& font, int width, bool multipleFilesAllowed)
+String RenderTheme::fileListDefaultLabel(bool multipleFilesAllowed) const
+{
+    if (multipleFilesAllowed)
+        return fileButtonNoFilesSelectedLabel();
+    return fileButtonNoFileSelectedLabel();
+}
+
+String RenderTheme::fileListNameForWidth(const Vector<String>& filenames, const Font& font, int width, bool multipleFilesAllowed) const
 {
     if (width <= 0)
         return String();
 
     String string;
-    if (filenames.isEmpty()) {
-        if (multipleFilesAllowed)
-            string = fileButtonNoFilesSelectedLabel();
-        else
-            string = fileButtonNoFileSelectedLabel();
-    }
+    if (filenames.isEmpty())
+        string = fileListDefaultLabel(multipleFilesAllowed);
     else if (filenames.size() == 1)
         string = pathGetFileName(filenames[0]);
     else
diff --git a/Source/WebCore/rendering/RenderTheme.h b/Source/WebCore/rendering/RenderTheme.h
index c243b78a5..f65b8523f 100644
--- a/Source/WebCore/rendering/RenderTheme.h
+++ b/Source/WebCore/rendering/RenderTheme.h
@@ -1,7 +1,7 @@
 /*
  * This file is part of the theme implementation for form controls in WebCore.
  *
- * Copyright (C) 2005, 2006, 2007, 2008, 2009, 2010 Apple Computer, Inc.
+ * Copyright (C) 2005, 2006, 2007, 2008, 2009, 2010, 2012 Apple Computer, Inc.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -214,7 +214,8 @@ public:
     virtual bool popsMenuByArrowKeys() const { return false; }
     virtual bool popsMenuBySpaceOrReturn() const { return false; }
 
-    virtual String fileListNameForWidth(const Vector<String>& filenames, const Font&, int width, bool multipleFilesAllowed);
+    virtual String fileListDefaultLabel(bool multipleFilesAllowed) const;
+    virtual String fileListNameForWidth(const Vector<String>& filenames, const Font&, int width, bool multipleFilesAllowed) const;
 
 protected:
     // The platform selection color.
diff --git a/Source/WebCore/rendering/RenderThemeChromiumAndroid.cpp b/Source/WebCore/rendering/RenderThemeChromiumAndroid.cpp
index c45fc2086..88ac3a8d6 100644
--- a/Source/WebCore/rendering/RenderThemeChromiumAndroid.cpp
+++ b/Source/WebCore/rendering/RenderThemeChromiumAndroid.cpp
@@ -63,6 +63,12 @@ Color RenderThemeChromiumAndroid::systemColor(int cssValueId) const
     return RenderTheme::systemColor(cssValueId);
 }
 
+String RenderThemeChromiumAndroid::extraDefaultStyleSheet()
+{
+    return RenderThemeChromiumLinux::extraDefaultStyleSheet() +
+        String(themeChromiumAndroidUserAgentStyleSheet, sizeof(themeChromiumAndroidUserAgentStyleSheet));
+}
+
 void RenderThemeChromiumAndroid::adjustInnerSpinButtonStyle(CSSStyleSelector*, RenderStyle* style, Element*) const
 {
     if (PlatformSupport::layoutTestMode()) {
diff --git a/Source/WebCore/rendering/RenderThemeChromiumAndroid.h b/Source/WebCore/rendering/RenderThemeChromiumAndroid.h
index e7b9d9885..5fb12bc02 100644
--- a/Source/WebCore/rendering/RenderThemeChromiumAndroid.h
+++ b/Source/WebCore/rendering/RenderThemeChromiumAndroid.h
@@ -33,14 +33,25 @@ namespace WebCore {
 class RenderThemeChromiumAndroid : public RenderThemeChromiumLinux {
 public:
     static PassRefPtr<RenderTheme> create();
+    virtual String extraDefaultStyleSheet() OVERRIDE;
 
-    virtual Color systemColor(int cssValidId) const;
+    virtual Color systemColor(int cssValidId) const OVERRIDE;
 
-    virtual void adjustInnerSpinButtonStyle(CSSStyleSelector*, RenderStyle*, Element*) const;
+    virtual void adjustInnerSpinButtonStyle(CSSStyleSelector*, RenderStyle*, Element*) const OVERRIDE;
+
+    virtual bool delegatesMenuListRendering() const OVERRIDE { return true; }
+
+#if ENABLE(TOUCH_EVENTS)
+    virtual Color platformTapHighlightColor() const OVERRIDE
+    {
+        return RenderThemeChromiumAndroid::defaultTapHighlightColor;
+    }
+#endif
 
 private:
     virtual ~RenderThemeChromiumAndroid();
 
+    static const RGBA32 defaultTapHighlightColor = 0x6633b5e5;
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/rendering/RenderThemeMac.h b/Source/WebCore/rendering/RenderThemeMac.h
index dc1af04d0..25065c422 100644
--- a/Source/WebCore/rendering/RenderThemeMac.h
+++ b/Source/WebCore/rendering/RenderThemeMac.h
@@ -1,7 +1,7 @@
 /*
  * This file is part of the theme implementation for form controls in WebCore.
  *
- * Copyright (C) 2005, 2006, 2007, 2008, 2009, 2010, 2011 Apple Computer, Inc.
+ * Copyright (C) 2005, 2006, 2007, 2008, 2009, 2010, 2011, 2012 Apple Computer, Inc.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -175,7 +175,7 @@ protected:
     virtual bool shouldShowPlaceholderWhenFocused() const;
 
 private:
-    virtual String fileListNameForWidth(const Vector<String>& filenames, const Font&, int width, bool multipleFilesAllowed);
+    virtual String fileListNameForWidth(const Vector<String>& filenames, const Font&, int width, bool multipleFilesAllowed) const;
 
     LayoutRect inflateRect(const LayoutRect&, const IntSize&, const int* margins, float zoomLevel = 1.0f) const;
 
diff --git a/Source/WebCore/rendering/RenderThemeMac.mm b/Source/WebCore/rendering/RenderThemeMac.mm
index e405f6ceb..cd566e859 100644
--- a/Source/WebCore/rendering/RenderThemeMac.mm
+++ b/Source/WebCore/rendering/RenderThemeMac.mm
@@ -2115,18 +2115,14 @@ NSTextFieldCell* RenderThemeMac::textField() const
     return m_textField.get();
 }
 
-String RenderThemeMac::fileListNameForWidth(const Vector<String>& filenames, const Font& font, int width, bool multipleFilesAllowed)
+String RenderThemeMac::fileListNameForWidth(const Vector<String>& filenames, const Font& font, int width, bool multipleFilesAllowed) const
 {
     if (width <= 0)
         return String();
 
     String strToTruncate;
-    if (filenames.isEmpty()) {
-        if (multipleFilesAllowed)
-            strToTruncate = fileButtonNoFilesSelectedLabel();
-        else
-            strToTruncate = fileButtonNoFileSelectedLabel();
-    }
+    if (filenames.isEmpty())
+        strToTruncate = fileListDefaultLabel(multipleFilesAllowed);
     else if (filenames.size() == 1)
         strToTruncate = [[NSFileManager defaultManager] displayNameAtPath:(filenames[0])];
     else
diff --git a/Source/WebCore/rendering/RenderTreeAsText.cpp b/Source/WebCore/rendering/RenderTreeAsText.cpp
index 06e0fe98e..4cb4c0e67 100644
--- a/Source/WebCore/rendering/RenderTreeAsText.cpp
+++ b/Source/WebCore/rendering/RenderTreeAsText.cpp
@@ -69,7 +69,7 @@
 #endif
 
 #if PLATFORM(QT)
-#include <QWidget>
+#include <QVariant>
 #endif
 
 namespace WebCore {
@@ -475,14 +475,13 @@ void RenderTreeAsText::writeRenderObject(TextStream& ts, const RenderObject& o,
     if (o.isRenderPart()) {
         const RenderPart* part = toRenderPart(const_cast<RenderObject*>(&o));
         if (part->widget() && part->widget()->platformWidget()) {
-            QWidget* wid = part->widget()->platformWidget();
+            QObject* wid = part->widget()->platformWidget();
 
             ts << " [QT: ";
-            ts << "geometry: {" << wid->geometry() << "} ";
-            ts << "isHidden: " << wid->isHidden() << " ";
+            ts << "geometry: {" << wid->property("geometry").toRect() << "} ";
+            ts << "isHidden: " << !wid->property("isVisible").toBool() << " ";
             ts << "isSelfVisible: " << part->widget()->isSelfVisible() << " ";
-            ts << "isParentVisible: " << part->widget()->isParentVisible() << " ";
-            ts << "mask: {" << wid->mask().boundingRect() << "} ] ";
+            ts << "isParentVisible: " << part->widget()->isParentVisible() << " ] ";
         }
     }
 #endif
diff --git a/Source/WebCore/rendering/RenderWidget.cpp b/Source/WebCore/rendering/RenderWidget.cpp
index 2c9565134..ad5a03fd2 100644
--- a/Source/WebCore/rendering/RenderWidget.cpp
+++ b/Source/WebCore/rendering/RenderWidget.cpp
@@ -308,7 +308,7 @@ void RenderWidget::paint(PaintInfo& paintInfo, const LayoutPoint& paintOffset)
     // Paint a partially transparent wash over selected widgets.
     if (isSelected() && !document()->printing()) {
         // FIXME: selectionRect() is in absolute, not painting coordinates.
-        paintInfo.context->fillRect(selectionRect(), selectionBackgroundColor(), style()->colorSpace());
+        paintInfo.context->fillRect(pixelSnappedIntRect(selectionRect()), selectionBackgroundColor(), style()->colorSpace());
     }
 }
 
diff --git a/Source/WebCore/rendering/RootInlineBox.cpp b/Source/WebCore/rendering/RootInlineBox.cpp
index 2acfaf02c..8d84bfe61 100644
--- a/Source/WebCore/rendering/RootInlineBox.cpp
+++ b/Source/WebCore/rendering/RootInlineBox.cpp
@@ -286,7 +286,7 @@ LayoutUnit RootInlineBox::alignBoxesInBlockDirection(LayoutUnit heightOfBlock, G
         heightOfBlock += annotationsAdjustment;
     }
 
-    LayoutUnit gridSnapAdjustment = lineGridSnapAdjustment();
+    LayoutUnit gridSnapAdjustment = lineSnapAdjustment();
     if (gridSnapAdjustment) {
         adjustBlockDirectionPosition(gridSnapAdjustment);
         heightOfBlock += gridSnapAdjustment;
@@ -326,11 +326,11 @@ int RootInlineBox::beforeAnnotationsAdjustment() const
     return result;
 }
 
-LayoutUnit RootInlineBox::lineGridSnapAdjustment(LayoutUnit delta) const
+LayoutUnit RootInlineBox::lineSnapAdjustment(LayoutUnit delta) const
 {
     // If our block doesn't have snapping turned on, do nothing.
     // FIXME: Implement bounds snapping.
-    if (block()->style()->lineGridSnap() == LineGridSnapNone)
+    if (block()->style()->lineSnap() == LineSnapNone)
         return 0;
 
     // Get the current line grid and offset.
@@ -377,7 +377,7 @@ LayoutUnit RootInlineBox::lineGridSnapAdjustment(LayoutUnit delta) const
             firstTextTop = pageLogicalTop + lineGridBox->logicalTop() - lineGrid->borderBefore() - lineGrid->paddingBefore() + lineGridPaginationOrigin;
     }
 
-    if (block()->style()->lineGridSnap() == LineGridSnapContain) {
+    if (block()->style()->lineSnap() == LineSnapContain) {
         // Compute the desired offset from the text-top of a grid line.
         // Look at our height (logicalHeight()).
         // Look at the total available height. It's going to be (textBottom - textTop) + (n-1)*(multiple with leading)
@@ -414,7 +414,7 @@ LayoutUnit RootInlineBox::lineGridSnapAdjustment(LayoutUnit delta) const
         return result;
     
     // Put ourselves at the top of the next page to force a snap onto the new grid established by that page.
-    return lineGridSnapAdjustment(newPageLogicalTop - (blockOffset + lineTopWithLeading()));
+    return lineSnapAdjustment(newPageLogicalTop - (blockOffset + lineTopWithLeading()));
 }
 
 GapRects RootInlineBox::lineSelectionGap(RenderBlock* rootBlock, const LayoutPoint& rootBlockPhysicalPosition, const LayoutSize& offsetFromRootBlock, 
diff --git a/Source/WebCore/rendering/RootInlineBox.h b/Source/WebCore/rendering/RootInlineBox.h
index fef7ced22..901bcff24 100644
--- a/Source/WebCore/rendering/RootInlineBox.h
+++ b/Source/WebCore/rendering/RootInlineBox.h
@@ -183,7 +183,7 @@ public:
 private:
     void setHasEllipsisBox(bool hasEllipsisBox) { m_hasEllipsisBoxOrHyphen = hasEllipsisBox; }
     
-    LayoutUnit lineGridSnapAdjustment(LayoutUnit delta = 0) const;
+    LayoutUnit lineSnapAdjustment(LayoutUnit delta = 0) const;
 
     int beforeAnnotationsAdjustment() const;
 
diff --git a/Source/WebCore/rendering/mathml/RenderMathMLBlock.cpp b/Source/WebCore/rendering/mathml/RenderMathMLBlock.cpp
index 2bdccec2c..167eeb21a 100644
--- a/Source/WebCore/rendering/mathml/RenderMathMLBlock.cpp
+++ b/Source/WebCore/rendering/mathml/RenderMathMLBlock.cpp
@@ -49,7 +49,7 @@ bool RenderMathMLBlock::isChildAllowed(RenderObject* child, RenderStyle*) const
     return child->node() && child->node()->nodeType() == Node::ELEMENT_NODE;
 }
 
-PassRefPtr<RenderStyle> RenderMathMLBlock::makeBlockStyle()
+PassRefPtr<RenderStyle> RenderMathMLBlock::createBlockStyle()
 {
     RefPtr<RenderStyle> newStyle = RenderStyle::create();
     newStyle->inheritFrom(style());
@@ -57,14 +57,6 @@ PassRefPtr<RenderStyle> RenderMathMLBlock::makeBlockStyle()
     return newStyle;
 }
 
-int RenderMathMLBlock::nonOperatorHeight() const
-{
-    if (!isRenderMathMLOperator())
-        return offsetHeight();
-        
-    return 0;
-}
-
 void RenderMathMLBlock::stretchToHeight(int height) 
 {
     for (RenderObject* current = firstChild(); current; current = current->nextSibling())
@@ -82,7 +74,7 @@ void RenderMathMLBlock::paint(PaintInfo& info, const LayoutPoint& paintOffset)
     if (info.context->paintingDisabled() || info.phase != PaintPhaseForeground)
         return;
 
-    LayoutPoint adjustedPaintOffset = paintOffset + location();
+    IntPoint adjustedPaintOffset = roundedIntPoint(paintOffset + location());
 
     GraphicsContextStateSaver stateSaver(*info.context);
     
diff --git a/Source/WebCore/rendering/mathml/RenderMathMLBlock.h b/Source/WebCore/rendering/mathml/RenderMathMLBlock.h
index 4d8184bcf..5d4d780ed 100644
--- a/Source/WebCore/rendering/mathml/RenderMathMLBlock.h
+++ b/Source/WebCore/rendering/mathml/RenderMathMLBlock.h
@@ -34,6 +34,8 @@
 
 namespace WebCore {
     
+class RenderMathMLOperator;
+
 class RenderMathMLBlock : public RenderBlock {
 public:
     RenderMathMLBlock(Node* container);
@@ -43,8 +45,15 @@ public:
     virtual bool isRenderMathMLOperator() const { return false; }
     virtual bool isRenderMathMLRow() const { return false; }
     virtual bool isRenderMathMLMath() const { return false; }
-    virtual bool hasBase() const { return false; }
-    virtual int nonOperatorHeight() const;
+    
+    // MathML defines an "embellished operator" as roughly an <mo> that may have subscripts,
+    // superscripts, underscripts, overscripts, or a denominator (as in d/dx, where "d" is some
+    // differential operator). The padding, precedence, and stretchiness of the base <mo> should
+    // apply to the embellished operator as a whole. unembellishedOperator() checks for being an
+    // embellished operator, and omits any embellishments.
+    // FIXME: We don't yet handle all the cases in the MathML spec. See
+    // https://bugs.webkit.org/show_bug.cgi?id=78617.
+    virtual RenderMathMLOperator* unembellishedOperator() { return 0; }
     virtual void stretchToHeight(int height);
 
 #if ENABLE(DEBUG_MATH_LAYOUT)
@@ -70,7 +79,7 @@ protected:
         
         return 0;
     }
-    virtual PassRefPtr<RenderStyle> makeBlockStyle();
+    virtual PassRefPtr<RenderStyle> createBlockStyle();
 
 private:
     virtual const char* renderName() const { return isAnonymous() ? "RenderMathMLBlock (anonymous)" : "RenderMathMLBlock"; }
diff --git a/Source/WebCore/rendering/mathml/RenderMathMLFenced.cpp b/Source/WebCore/rendering/mathml/RenderMathMLFenced.cpp
index 55da1a5ec..c2f67ea93 100644
--- a/Source/WebCore/rendering/mathml/RenderMathMLFenced.cpp
+++ b/Source/WebCore/rendering/mathml/RenderMathMLFenced.cpp
@@ -44,8 +44,8 @@ enum Braces { OpeningBraceChar = 0x28, ClosingBraceChar = 0x29 };
     
 static const float gOperatorPadding = 0.1f;
 
-RenderMathMLFenced::RenderMathMLFenced(Node* fenced) 
-    : RenderMathMLRow(fenced)
+RenderMathMLFenced::RenderMathMLFenced(Element* element)
+    : RenderMathMLRow(element)
     , m_open(OpeningBraceChar)
     , m_close(ClosingBraceChar)
 {
@@ -63,7 +63,7 @@ void RenderMathMLFenced::updateFromElement()
     if (closeValue.length() > 0)
         m_close = closeValue[0];
     
-    AtomicString separators = static_cast<Element*>(fenced)->getAttribute(MathMLNames::separatorsAttr);
+    AtomicString separators = fenced->getAttribute(MathMLNames::separatorsAttr);
     if (!separators.isNull()) {
         StringBuilder characters;
         for (unsigned int i = 0; i < separators.length(); i++) {
@@ -80,22 +80,22 @@ void RenderMathMLFenced::updateFromElement()
         makeFences();
 }
 
-RefPtr<RenderStyle> RenderMathMLFenced::makeOperatorStyle() 
+PassRefPtr<RenderStyle> RenderMathMLFenced::createOperatorStyle()
 {
     RefPtr<RenderStyle> newStyle = RenderStyle::create();
     newStyle->inheritFrom(style());
     newStyle->setDisplay(INLINE_BLOCK);
     newStyle->setPaddingRight(Length(static_cast<int>(gOperatorPadding * style()->fontSize()), Fixed));
-    return newStyle;
+    return newStyle.release();
 }
 
 void RenderMathMLFenced::makeFences()
 {
     RenderObject* openFence = new (renderArena()) RenderMathMLOperator(node(), m_open);
-    openFence->setStyle(makeOperatorStyle().release());
+    openFence->setStyle(createOperatorStyle());
     RenderBlock::addChild(openFence, firstChild());
     RenderObject* closeFence = new (renderArena()) RenderMathMLOperator(node(), m_close);
-    closeFence->setStyle(makeOperatorStyle().release());
+    closeFence->setStyle(createOperatorStyle());
     RenderBlock::addChild(closeFence);
 }
 
@@ -122,7 +122,7 @@ void RenderMathMLFenced::addChild(RenderObject* child, RenderObject*)
                 separator = (*m_separators.get())[count - 2];
                 
             RenderObject* separatorObj = new (renderArena()) RenderMathMLOperator(node(), separator);
-            separatorObj->setStyle(makeOperatorStyle().release());
+            separatorObj->setStyle(createOperatorStyle());
             RenderBlock::addChild(separatorObj, lastChild());
         }
     }
diff --git a/Source/WebCore/rendering/mathml/RenderMathMLFenced.h b/Source/WebCore/rendering/mathml/RenderMathMLFenced.h
index 9707b3ae6..b2bca9971 100644
--- a/Source/WebCore/rendering/mathml/RenderMathMLFenced.h
+++ b/Source/WebCore/rendering/mathml/RenderMathMLFenced.h
@@ -34,15 +34,16 @@ namespace WebCore {
     
 class RenderMathMLFenced : public RenderMathMLRow {
 public:
-    RenderMathMLFenced(Node *fraction);
+    RenderMathMLFenced(Element*);
     virtual void addChild(RenderObject* child, RenderObject* beforeChild = 0);
     virtual void updateFromElement();
     
 private:
     virtual const char* renderName() const { return "RenderMathMLFenced"; }
 
+    PassRefPtr<RenderStyle> createOperatorStyle();
     void makeFences();
-    RefPtr<RenderStyle> makeOperatorStyle();
+    
     UChar m_open;
     UChar m_close;
     RefPtr<StringImpl> m_separators;
diff --git a/Source/WebCore/rendering/mathml/RenderMathMLFraction.cpp b/Source/WebCore/rendering/mathml/RenderMathMLFraction.cpp
index aeaab20f7..dd59bb998 100644
--- a/Source/WebCore/rendering/mathml/RenderMathMLFraction.cpp
+++ b/Source/WebCore/rendering/mathml/RenderMathMLFraction.cpp
@@ -46,8 +46,8 @@ static const float gLineThick = 3.f;
 static const float gFractionBarWidth = 0.05f;
 static const float gDenominatorPad = 0.1f;
 
-RenderMathMLFraction::RenderMathMLFraction(Element* fraction) 
-    : RenderMathMLBlock(fraction)
+RenderMathMLFraction::RenderMathMLFraction(Element* element)
+    : RenderMathMLBlock(element)
     , m_lineThickness(gLineMedium)
 {
     setChildrenInline(false);
@@ -101,7 +101,7 @@ void RenderMathMLFraction::updateFromElement()
 void RenderMathMLFraction::addChild(RenderObject* child, RenderObject* beforeChild)
 {
     RenderBlock* row = new (renderArena()) RenderMathMLBlock(node());
-    RefPtr<RenderStyle> rowStyle = makeBlockStyle();
+    RefPtr<RenderStyle> rowStyle = createBlockStyle();
     
     rowStyle->setTextAlign(CENTER);
     Length pad(static_cast<int>(rowStyle->fontSize() * gHorizontalPad), Fixed);
@@ -119,6 +119,17 @@ void RenderMathMLFraction::addChild(RenderObject* child, RenderObject* beforeChi
     updateFromElement();
 }
 
+RenderMathMLOperator* RenderMathMLFraction::unembellishedOperator()
+{
+    RenderObject* numeratorWrapper = firstChild();
+    if (!numeratorWrapper)
+        return 0;
+    RenderObject* numerator = numeratorWrapper->firstChild();
+    if (!numerator || !numerator->isRenderMathMLBlock())
+        return 0;
+    return toRenderMathMLBlock(numerator)->unembellishedOperator();
+}
+
 void RenderMathMLFraction::layout()
 {
     updateFromElement();
@@ -153,7 +164,7 @@ void RenderMathMLFraction::paint(PaintInfo& info, const LayoutPoint& paintOffset
             verticalOffset = numerator->offsetHeight();        
     }
     
-    LayoutPoint adjustedPaintOffset = paintOffset + location();
+    IntPoint adjustedPaintOffset = roundedIntPoint(paintOffset + location());
     adjustedPaintOffset.setY(adjustedPaintOffset.y() + verticalOffset);
     
     GraphicsContextStateSaver stateSaver(*info.context);
diff --git a/Source/WebCore/rendering/mathml/RenderMathMLFraction.h b/Source/WebCore/rendering/mathml/RenderMathMLFraction.h
index 3971a1e13..4756583b6 100644
--- a/Source/WebCore/rendering/mathml/RenderMathMLFraction.h
+++ b/Source/WebCore/rendering/mathml/RenderMathMLFraction.h
@@ -35,15 +35,20 @@ namespace WebCore {
 
 class RenderMathMLFraction : public RenderMathMLBlock {
 public:
-    RenderMathMLFraction(Element* fraction);
+    RenderMathMLFraction(Element*);
     virtual void addChild(RenderObject* child, RenderObject* beforeChild = 0);
     virtual void updateFromElement();
+    
+    virtual RenderMathMLOperator* unembellishedOperator();
+    
     virtual LayoutUnit baselinePosition(FontBaseline, bool firstLine, LineDirectionMode, LinePositionMode = PositionOnContainingLine) const; 
     virtual void paint(PaintInfo&, const LayoutPoint&);
 protected:
     virtual void layout();
+    
 private:
     virtual const char* renderName() const { return "RenderMathMLFraction"; }
+    
     float m_lineThickness;
 };
 
diff --git a/Source/WebCore/rendering/mathml/RenderMathMLMath.cpp b/Source/WebCore/rendering/mathml/RenderMathMLMath.cpp
index 006fea31c..15e2bbdbe 100644
--- a/Source/WebCore/rendering/mathml/RenderMathMLMath.cpp
+++ b/Source/WebCore/rendering/mathml/RenderMathMLMath.cpp
@@ -35,8 +35,8 @@ namespace WebCore {
 
 using namespace MathMLNames;
 
-RenderMathMLMath::RenderMathMLMath(Node* math)
-    : RenderMathMLRow(math)
+RenderMathMLMath::RenderMathMLMath(Element* element)
+    : RenderMathMLRow(element)
 {
 }
 
diff --git a/Source/WebCore/rendering/mathml/RenderMathMLMath.h b/Source/WebCore/rendering/mathml/RenderMathMLMath.h
index a81d5a890..aaa2f4f12 100644
--- a/Source/WebCore/rendering/mathml/RenderMathMLMath.h
+++ b/Source/WebCore/rendering/mathml/RenderMathMLMath.h
@@ -34,7 +34,7 @@ namespace WebCore {
     
 class RenderMathMLMath : public RenderMathMLRow {
 public:
-    RenderMathMLMath(Node* container);
+    RenderMathMLMath(Element*);
     virtual bool isRenderMathMLMath() const { return true; }
 
 private:
diff --git a/Source/WebCore/rendering/mathml/RenderMathMLOperator.cpp b/Source/WebCore/rendering/mathml/RenderMathMLOperator.cpp
index 2702c0656..ad11d8bac 100644
--- a/Source/WebCore/rendering/mathml/RenderMathMLOperator.cpp
+++ b/Source/WebCore/rendering/mathml/RenderMathMLOperator.cpp
@@ -38,15 +38,15 @@ namespace WebCore {
     
 using namespace MathMLNames;
 
-RenderMathMLOperator::RenderMathMLOperator(Node* container)
-    : RenderMathMLBlock(container)
+RenderMathMLOperator::RenderMathMLOperator(Element* element)
+    : RenderMathMLBlock(element)
     , m_stretchHeight(0)
     , m_operator(0)
 {
 }
 
-RenderMathMLOperator::RenderMathMLOperator(Node* container, UChar operatorChar)
-    : RenderMathMLBlock(container)
+RenderMathMLOperator::RenderMathMLOperator(Node* node, UChar operatorChar)
+    : RenderMathMLBlock(node)
     , m_stretchHeight(0)
     , m_operator(convertHyphenMinusToMinusSign(operatorChar))
 {
@@ -139,7 +139,7 @@ void RenderMathMLOperator::updateFromElement()
     // This boolean indicates whether stretching is disabled via the markup.
     bool stretchDisabled = false;
     
-    // We made need the element later if we can't stretch.
+    // We may need the element later if we can't stretch.
     if (node()->nodeType() == Node::ELEMENT_NODE) {
         if (Element* mo = static_cast<Element*>(node())) {
             AtomicString stretchyAttr = mo->getAttribute(MathMLNames::stretchyAttr);
@@ -282,7 +282,7 @@ void RenderMathMLOperator::updateFromElement()
     }
 }
 
-RefPtr<RenderStyle> RenderMathMLOperator::createStackableStyle(int size, int topRelative)
+PassRefPtr<RenderStyle> RenderMathMLOperator::createStackableStyle(int size, int topRelative)
 {
     RefPtr<RenderStyle> newStyle = RenderStyle::create();
     newStyle->inheritFrom(style());
@@ -307,13 +307,13 @@ RefPtr<RenderStyle> RenderMathMLOperator::createStackableStyle(int size, int top
         newStyle->setPosition(RelativePosition);
     }
 
-    return newStyle;
+    return newStyle.release();
 }
 
 RenderBlock* RenderMathMLOperator::createGlyph(UChar glyph, int size, int charRelative, int topRelative)
 {
     RenderBlock* container = new (renderArena()) RenderMathMLBlock(node());
-    container->setStyle(createStackableStyle(size, topRelative).release());
+    container->setStyle(createStackableStyle(size, topRelative));
     addChild(container);
     RenderBlock* parent = container;
     if (charRelative) {
diff --git a/Source/WebCore/rendering/mathml/RenderMathMLOperator.h b/Source/WebCore/rendering/mathml/RenderMathMLOperator.h
index 5ee0660f5..42708724a 100644
--- a/Source/WebCore/rendering/mathml/RenderMathMLOperator.h
+++ b/Source/WebCore/rendering/mathml/RenderMathMLOperator.h
@@ -35,9 +35,10 @@ namespace WebCore {
     
 class RenderMathMLOperator : public RenderMathMLBlock {
 public:
-    RenderMathMLOperator(Node* container);
-    RenderMathMLOperator(Node* container, UChar operatorChar);
+    RenderMathMLOperator(Element*);
+    RenderMathMLOperator(Node*, UChar operatorChar);
     virtual bool isRenderMathMLOperator() const { return true; }
+    virtual RenderMathMLOperator* unembellishedOperator() { return this; }
     virtual void stretchToHeight(int pixelHeight);
     virtual void updateFromElement(); 
     virtual bool isChildAllowed(RenderObject*, RenderStyle*) const;
@@ -45,7 +46,7 @@ public:
         
 protected:
     virtual void layout();
-    virtual RefPtr<RenderStyle> createStackableStyle(int size, int topRelative);
+    virtual PassRefPtr<RenderStyle> createStackableStyle(int size, int topRelative);
     virtual RenderBlock* createGlyph(UChar glyph, int size = 0, int charRelative = 0, int topRelative = 0);
     
 private:
diff --git a/Source/WebCore/rendering/mathml/RenderMathMLRoot.cpp b/Source/WebCore/rendering/mathml/RenderMathMLRoot.cpp
index 24e79ba7e..07e8ff911 100644
--- a/Source/WebCore/rendering/mathml/RenderMathMLRoot.cpp
+++ b/Source/WebCore/rendering/mathml/RenderMathMLRoot.cpp
@@ -64,8 +64,8 @@ const float gRadicalLineThickness = 0.02f;
 // Radical thick line thickness (%)
 const float gRadicalThickLineThickness = 0.1f;
     
-RenderMathMLRoot::RenderMathMLRoot(Node *expression) 
-: RenderMathMLBlock(expression) 
+RenderMathMLRoot::RenderMathMLRoot(Element* element)
+    : RenderMathMLBlock(element)
 {
 }
 
@@ -74,7 +74,7 @@ void RenderMathMLRoot::addChild(RenderObject* child, RenderObject* )
     if (isEmpty()) {
         // Add a block for the index
         RenderBlock* block = new (renderArena()) RenderBlock(node());
-        RefPtr<RenderStyle> indexStyle = makeBlockStyle();
+        RefPtr<RenderStyle> indexStyle = createBlockStyle();
         indexStyle->setDisplay(INLINE_BLOCK);
         block->setStyle(indexStyle.release());
         RenderBlock::addChild(block);
@@ -82,7 +82,7 @@ void RenderMathMLRoot::addChild(RenderObject* child, RenderObject* )
         // FIXME: the wrapping does not seem to be needed anymore.
         // this is the base, so wrap it so we can pad it
         block = new (renderArena()) RenderBlock(node());
-        RefPtr<RenderStyle> baseStyle = makeBlockStyle();
+        RefPtr<RenderStyle> baseStyle = createBlockStyle();
         baseStyle->setDisplay(INLINE_BLOCK);
         baseStyle->setPaddingLeft(Length(5 * gRadicalWidth , Percent));
         block->setStyle(baseStyle.release());
@@ -104,7 +104,7 @@ void RenderMathMLRoot::paint(PaintInfo& info, const LayoutPoint& paintOffset)
     if (!firstChild() || !lastChild())
         return;
 
-    LayoutPoint adjustedPaintOffset = paintOffset + location();
+    IntPoint adjustedPaintOffset = roundedIntPoint(paintOffset + location());
     
     RenderBoxModelObject* indexBox = toRenderBoxModelObject(lastChild());
     
@@ -232,7 +232,8 @@ void RenderMathMLRoot::layout()
     
     LayoutUnit indexShift = indexBox->offsetWidth() + topStartShift;
     LayoutUnit radicalHeight = static_cast<LayoutUnit>((1 - gRadicalTopLeftPointYPos) * maxHeight);
-    LayoutUnit rootMarginTop = radicalHeight + style()->paddingBottom().value() + indexBox->offsetHeight() - (maxHeight + static_cast<LayoutUnit>(gRootPadding * style()->fontSize()));
+    LayoutUnit rootMarginTop = radicalHeight + style()->paddingBottom().value() + indexBox->offsetHeight()
+        - (maxHeight + static_cast<LayoutUnit>(gRootPadding * style()->fontSize()));
     
     style()->setPaddingLeft(Length(indexShift, Fixed));
     if (rootMarginTop > 0)
diff --git a/Source/WebCore/rendering/mathml/RenderMathMLRoot.h b/Source/WebCore/rendering/mathml/RenderMathMLRoot.h
index ab3e4f057..19b2ec6ec 100644
--- a/Source/WebCore/rendering/mathml/RenderMathMLRoot.h
+++ b/Source/WebCore/rendering/mathml/RenderMathMLRoot.h
@@ -34,7 +34,7 @@ namespace WebCore {
     
 class RenderMathMLRoot : public RenderMathMLBlock {
 public:
-    RenderMathMLRoot(Node* fraction);
+    RenderMathMLRoot(Element*);
     virtual void addChild(RenderObject* child, RenderObject* beforeChild = 0);
     virtual void paint(PaintInfo&, const LayoutPoint&);
 protected:
diff --git a/Source/WebCore/rendering/mathml/RenderMathMLRow.cpp b/Source/WebCore/rendering/mathml/RenderMathMLRow.cpp
index 922fa9245..203d194de 100644
--- a/Source/WebCore/rendering/mathml/RenderMathMLRow.cpp
+++ b/Source/WebCore/rendering/mathml/RenderMathMLRow.cpp
@@ -36,57 +36,23 @@ namespace WebCore {
 
 using namespace MathMLNames;
 
-RenderMathMLRow::RenderMathMLRow(Node* row)
-    : RenderMathMLBlock(row)
+RenderMathMLRow::RenderMathMLRow(Element* element)
+    : RenderMathMLBlock(element)
 {
 }
 
-int RenderMathMLRow::nonOperatorHeight() const
-{
-    int maxHeight = 0;
-    for (RenderObject* current = firstChild(); current; current = current->nextSibling()) {
-        if (current->isRenderMathMLBlock()) {
-            RenderMathMLBlock* block = toRenderMathMLBlock(current);
-            int blockHeight = block->nonOperatorHeight();
-            // Check to see if this box has a larger height
-            if (blockHeight > maxHeight)
-                maxHeight = blockHeight;
-        } else if (current->isBoxModelObject()) {
-            RenderBoxModelObject* box = toRenderBoxModelObject(current);
-            // Check to see if this box has a larger height
-            if (box->offsetHeight() > maxHeight)
-                maxHeight = box->offsetHeight();
-        }
-        
-    }
-    return maxHeight;
-}
-
 void RenderMathMLRow::layout() 
 {
     RenderBlock::layout();
     
     LayoutUnit maxHeight = 0;
-    int childCount = 0;
-    int operatorCount = 0;
 
     // Calculate the non-operator max height of the row.
-    LayoutUnit operatorHeight = 0;
     for (RenderObject* current = firstChild(); current; current = current->nextSibling()) {
-        childCount++;
         if (current->isRenderMathMLBlock()) {
             RenderMathMLBlock* block = toRenderMathMLBlock(current);
-            // Check to see if the non-operator block has a greater height.
-            if (!block->hasBase() && !block->isRenderMathMLOperator() && block->offsetHeight() > maxHeight)
+            if (!block->unembellishedOperator() && block->offsetHeight() > maxHeight)
                 maxHeight = block->offsetHeight();
-            if (block->hasBase() && block->nonOperatorHeight() > maxHeight) 
-                maxHeight = block->nonOperatorHeight();
-            // If the block is an operator, capture the maximum height and increment the count.
-            if (block->isRenderMathMLOperator()) {
-                if (block->offsetHeight() > operatorHeight)
-                    operatorHeight = block->offsetHeight();
-                operatorCount++;
-            }
         } else if (current->isBoxModelObject()) {
             RenderBoxModelObject* box = toRenderBoxModelObject(current);
             // Check to see if this box has a larger height.
@@ -95,10 +61,8 @@ void RenderMathMLRow::layout()
         }
     }
     
-    if (childCount > 0 && childCount == operatorCount) {
-        // We have only operators and so set the max height to the operator height.
-        maxHeight = operatorHeight;
-    }
+    if (!maxHeight)
+        maxHeight = style()->fontSize();
     
     // Stretch everything to the same height (blocks can ignore the request).
     if (maxHeight > 0) {
@@ -118,17 +82,6 @@ void RenderMathMLRow::layout()
     }
     
 }    
-
-LayoutUnit RenderMathMLRow::baselinePosition(FontBaseline, bool firstLine, LineDirectionMode direction, LinePositionMode linePositionMode) const
-{
-    if (firstChild() && firstChild()->isRenderMathMLBlock()) {
-        RenderMathMLBlock* block = toRenderMathMLBlock(firstChild());
-        if (block->isRenderMathMLOperator())
-            return block->y() + block->baselinePosition(AlphabeticBaseline, firstLine, direction, linePositionMode);
-    }
-    
-    return RenderBlock::baselinePosition(AlphabeticBaseline, firstLine, direction, linePositionMode);
-}
     
 }
 
diff --git a/Source/WebCore/rendering/mathml/RenderMathMLRow.h b/Source/WebCore/rendering/mathml/RenderMathMLRow.h
index 73c5a26e5..2a520d07b 100644
--- a/Source/WebCore/rendering/mathml/RenderMathMLRow.h
+++ b/Source/WebCore/rendering/mathml/RenderMathMLRow.h
@@ -34,10 +34,8 @@ namespace WebCore {
     
 class RenderMathMLRow : public RenderMathMLBlock {
 public:
-    RenderMathMLRow(Node* container);
+    RenderMathMLRow(Element*);
     virtual bool isRenderMathMLRow() const { return true; }
-    virtual int nonOperatorHeight() const;
-    virtual LayoutUnit baselinePosition(FontBaseline, bool firstLine, LineDirectionMode, LinePositionMode = PositionOnContainingLine) const;    
     virtual void stretchToHeight(int) {}
 protected:
     virtual void layout();
diff --git a/Source/WebCore/rendering/mathml/RenderMathMLSquareRoot.cpp b/Source/WebCore/rendering/mathml/RenderMathMLSquareRoot.cpp
index 38ab1c1c0..206426a13 100644
--- a/Source/WebCore/rendering/mathml/RenderMathMLSquareRoot.cpp
+++ b/Source/WebCore/rendering/mathml/RenderMathMLSquareRoot.cpp
@@ -61,8 +61,8 @@ const float gRadicalLineThickness = 0.02f;
 // Radical thick line thickness (%)
 const float gRadicalThickLineThickness = 0.1f;
     
-RenderMathMLSquareRoot::RenderMathMLSquareRoot(Node *expression) 
-    : RenderMathMLBlock(expression) 
+RenderMathMLSquareRoot::RenderMathMLSquareRoot(Element* element)
+    : RenderMathMLBlock(element)
 {
 }
 
@@ -73,7 +73,7 @@ void RenderMathMLSquareRoot::paint(PaintInfo& info, const LayoutPoint& paintOffs
     if (info.context->paintingDisabled())
         return;
     
-    LayoutPoint adjustedPaintOffset = paintOffset + location();
+    IntPoint adjustedPaintOffset = roundedIntPoint(paintOffset + location());
 
     LayoutUnit maxHeight = 0;
     LayoutUnit width = 0;
diff --git a/Source/WebCore/rendering/mathml/RenderMathMLSquareRoot.h b/Source/WebCore/rendering/mathml/RenderMathMLSquareRoot.h
index c8e41cdfb..ad81fdc56 100644
--- a/Source/WebCore/rendering/mathml/RenderMathMLSquareRoot.h
+++ b/Source/WebCore/rendering/mathml/RenderMathMLSquareRoot.h
@@ -34,7 +34,7 @@ namespace WebCore {
     
 class RenderMathMLSquareRoot : public RenderMathMLBlock {
 public:
-    RenderMathMLSquareRoot(Node* fraction);
+    RenderMathMLSquareRoot(Element*);
     virtual void paint(PaintInfo&, const LayoutPoint&);
 protected:
     virtual void layout();
diff --git a/Source/WebCore/rendering/mathml/RenderMathMLSubSup.cpp b/Source/WebCore/rendering/mathml/RenderMathMLSubSup.cpp
index 9a06b0236..631266258 100644
--- a/Source/WebCore/rendering/mathml/RenderMathMLSubSup.cpp
+++ b/Source/WebCore/rendering/mathml/RenderMathMLSubSup.cpp
@@ -43,20 +43,30 @@ RenderMathMLSubSup::RenderMathMLSubSup(Element* element)
     : RenderMathMLBlock(element)
     , m_scripts(0)
 {
-    // Determine what kind of under/over expression we have by element name
+    // Determine what kind of sub/sup expression we have by element name
     if (element->hasLocalName(MathMLNames::msubTag))
         m_kind = Sub;
     else if (element->hasLocalName(MathMLNames::msupTag))
         m_kind = Sup;
-    else if (element->hasLocalName(MathMLNames::msubsupTag))
-        m_kind = SubSup;
-    else 
+    else {
+        ASSERT(element->hasLocalName(MathMLNames::msubsupTag));
         m_kind = SubSup;
+    }
+}
+
+RenderBoxModelObject* RenderMathMLSubSup::base() const
+{
+    RenderObject* baseWrapper = firstChild();
+    if (!baseWrapper)
+        return 0;
+    RenderObject* base = baseWrapper->firstChild();
+    if (!base || !base->isBoxModelObject())
+        return 0;
+    return toRenderBoxModelObject(base);
 }
 
 void RenderMathMLSubSup::addChild(RenderObject* child, RenderObject* beforeChild)
 {
-    
     // Note: The RenderMathMLBlock only allows element children to be added.
     Element* childElement = toElement(child->node());
 
@@ -105,72 +115,49 @@ void RenderMathMLSubSup::addChild(RenderObject* child, RenderObject* beforeChild
     }
 }
 
+RenderMathMLOperator* RenderMathMLSubSup::unembellishedOperator()
+{
+    RenderBoxModelObject* base = this->base();
+    if (!base || !base->isRenderMathMLBlock())
+        return 0;
+    return toRenderMathMLBlock(base)->unembellishedOperator();
+}
+
 void RenderMathMLSubSup::stretchToHeight(int height)
 {
-    RenderObject* base = firstChild();
-    if (!base || !base->firstChild())
-        return;
-    
-    if (base->firstChild() && base->firstChild()->isRenderMathMLBlock()) {
-        RenderMathMLBlock* block = toRenderMathMLBlock(base->firstChild());
-        block->stretchToHeight(static_cast<int>(gSubSupStretch * height));
+    RenderBoxModelObject* base = this->base();
+    if (base && base->isRenderMathMLBlock()) {
+        toRenderMathMLBlock(base)->stretchToHeight(static_cast<int>(gSubSupStretch * height));
         
         // Adjust the script placement after we stretch
         if (height > 0 && m_kind == SubSup && m_scripts) {
-            RenderObject* script = m_scripts->firstChild();
-            if (script) {
+            RenderObject* supWrapper = m_scripts->firstChild();
+            if (supWrapper) {
                 // Calculate the script height without the container margins.
-                RenderObject* top = script;
-                int topHeight = getBoxModelObjectHeight(top->firstChild());
-                int topAdjust = topHeight / gTopAdjustDivisor;
-                top->style()->setMarginTop(Length(-topAdjust, Fixed));
-                top->style()->setMarginBottom(Length(height - topHeight + topAdjust, Fixed));
-                if (top->isBoxModelObject()) {
-                    RenderBoxModelObject* topBox = toRenderBoxModelObject(top);
-                    topBox->updateBoxModelInfoFromStyle();
-                }
-                m_scripts->setNeedsLayout(true);
-                setNeedsLayout(true);
+                int supHeight = getBoxModelObjectHeight(supWrapper->firstChild());
+                int supTopAdjust = supHeight / gTopAdjustDivisor;
+                supWrapper->style()->setMarginTop(Length(-supTopAdjust, Fixed));
+                supWrapper->style()->setMarginBottom(Length(height - supHeight + supTopAdjust, Fixed));
+                supWrapper->setNeedsLayout(true);
             }
         }
-        
     }
 }
 
-int RenderMathMLSubSup::nonOperatorHeight() const 
-{
-    if (m_kind == SubSup) 
-       return static_cast<int>(style()->fontSize()*gSubSupStretch);
-    return static_cast<int>(style()->fontSize());
-}
-
-void RenderMathMLSubSup::layout() 
+void RenderMathMLSubSup::layout()
 {
-    if (firstChild())
-        firstChild()->setNeedsLayout(true);
-    if (m_scripts) 
-        m_scripts->setNeedsLayout(true);
-    
     RenderBlock::layout();
     
-    if (m_kind == SubSup) {
-        if (RenderObject* base = firstChild()) {
-            LayoutUnit maxHeight = 0;
-            RenderObject* current = base->firstChild();
-            while (current) {
-                LayoutUnit height = getBoxModelObjectHeight(current);
-                if (height > maxHeight)
-                    maxHeight = height;
-                current = current->nextSibling();
-            }
-            LayoutUnit heightDiff = m_scripts ? (m_scripts->offsetHeight() - maxHeight) / 2 : 0;
+    if (m_kind == SubSup && m_scripts) {
+        if (RenderBoxModelObject* base = this->base()) {
+            LayoutUnit heightDiff = (m_scripts->offsetHeight() - base->offsetHeight()) / 2;
             if (heightDiff < 0) 
                 heightDiff = 0;
-            base->style()->setPaddingTop(Length(heightDiff, Fixed));
-            base->setNeedsLayout(true);
+            RenderObject* baseWrapper = firstChild();
+            baseWrapper->style()->setPaddingTop(Length(heightDiff, Fixed));
+            baseWrapper->setNeedsLayout(true);
+            RenderBlock::layout();
         }
-        setNeedsLayout(true);
-        RenderBlock::layout();
     }    
 }
 
diff --git a/Source/WebCore/rendering/mathml/RenderMathMLSubSup.h b/Source/WebCore/rendering/mathml/RenderMathMLSubSup.h
index 2ba466cb4..9c7d02c89 100644
--- a/Source/WebCore/rendering/mathml/RenderMathMLSubSup.h
+++ b/Source/WebCore/rendering/mathml/RenderMathMLSubSup.h
@@ -34,10 +34,10 @@ namespace WebCore {
     
 class RenderMathMLSubSup : public RenderMathMLBlock {
 public:
-    RenderMathMLSubSup(Element* fraction);
+    RenderMathMLSubSup(Element*);
     virtual void addChild(RenderObject* child, RenderObject* beforeChild = 0);
-    virtual bool hasBase() const { return true; }
-    virtual int nonOperatorHeight() const;
+    
+    virtual RenderMathMLOperator* unembellishedOperator();
     virtual void stretchToHeight(int pixelHeight);
     virtual LayoutUnit baselinePosition(FontBaseline, bool firstLine, LineDirectionMode, LinePositionMode = PositionOnContainingLine) const;
 
@@ -47,6 +47,10 @@ protected:
 private:
     virtual const char* renderName() const { return "RenderMathMLSubSup"; }
 
+    // Omit our subscript and/or superscript. This may return 0 for a non-MathML base (which
+    // won't occur in valid MathML).
+    RenderBoxModelObject* base() const;
+    
     enum SubSupType { Sub, Sup, SubSup };
     SubSupType m_kind;
     RenderBlock* m_scripts;
@@ -57,4 +61,3 @@ private:
 #endif // ENABLE(MATHML)
 
 #endif // RenderMathMLSubSup_h
-
diff --git a/Source/WebCore/rendering/mathml/RenderMathMLUnderOver.cpp b/Source/WebCore/rendering/mathml/RenderMathMLUnderOver.cpp
index 75911036a..0621cd6dd 100644
--- a/Source/WebCore/rendering/mathml/RenderMathMLUnderOver.cpp
+++ b/Source/WebCore/rendering/mathml/RenderMathMLUnderOver.cpp
@@ -38,27 +38,37 @@ using namespace MathMLNames;
     
 static const double gOverSpacingAdjustment = 0.5;
     
-RenderMathMLUnderOver::RenderMathMLUnderOver(Node* expression) 
-    : RenderMathMLBlock(expression) 
+RenderMathMLUnderOver::RenderMathMLUnderOver(Element* element)
+    : RenderMathMLBlock(element)
 {
-    Element* element = static_cast<Element*>(expression);
     // Determine what kind of under/over expression we have by element name
-    
     if (element->hasLocalName(MathMLNames::munderTag))
         m_kind = Under;
     else if (element->hasLocalName(MathMLNames::moverTag))
         m_kind = Over;
-    else if (element->hasLocalName(MathMLNames::munderoverTag))
+    else {
+        ASSERT(element->hasLocalName(MathMLNames::munderoverTag));
         m_kind = UnderOver;
-    else 
-        m_kind = Under;
-    
+    }
+}
+
+RenderBoxModelObject* RenderMathMLUnderOver::base() const
+{
+    RenderObject* baseWrapper = firstChild();
+    if ((m_kind == Over || m_kind == UnderOver) && baseWrapper)
+        baseWrapper = baseWrapper->nextSibling();
+    if (!baseWrapper)
+        return 0;
+    RenderObject* base = baseWrapper->firstChild();
+    if (!base || !base->isBoxModelObject())
+        return 0;
+    return toRenderBoxModelObject(base);
 }
 
 void RenderMathMLUnderOver::addChild(RenderObject* child, RenderObject* beforeChild)
 {    
     RenderMathMLBlock* row = new (renderArena()) RenderMathMLBlock(node());
-    RefPtr<RenderStyle> rowStyle = makeBlockStyle();
+    RefPtr<RenderStyle> rowStyle = createBlockStyle();
     row->setStyle(rowStyle.release());
     row->setIsAnonymous(true);
     
@@ -109,6 +119,14 @@ void RenderMathMLUnderOver::addChild(RenderObject* child, RenderObject* beforeCh
     row->addChild(child);    
 }
 
+RenderMathMLOperator* RenderMathMLUnderOver::unembellishedOperator()
+{
+    RenderBoxModelObject* base = this->base();
+    if (!base || !base->isRenderMathMLBlock())
+        return 0;
+    return toRenderMathMLBlock(base)->unembellishedOperator();
+}
+
 inline int getOffsetHeight(RenderObject* obj) 
 {
     if (obj->isBoxModelObject()) {
@@ -121,21 +139,7 @@ inline int getOffsetHeight(RenderObject* obj)
 
 void RenderMathMLUnderOver::stretchToHeight(int height)
 {
-
-    RenderObject* base = firstChild();
-    if (!base)
-        return;
-        
-    // For over or underover, the base is the sibling of the first child
-    if (m_kind != Under) 
-        base = base->nextSibling();
-        
-    if (!base)
-        return;
-        
-    // use the child of the row which is the actual base
-    base = base->firstChild();
-    
+    RenderBoxModelObject* base = this->base();
     if (base && base->isRenderMathMLBlock()) {
         RenderMathMLBlock* block = toRenderMathMLBlock(base);
         block->stretchToHeight(height);
@@ -275,21 +279,6 @@ LayoutUnit RenderMathMLUnderOver::baselinePosition(FontBaseline, bool firstLine,
     return baseline;
 }
 
-
-int RenderMathMLUnderOver::nonOperatorHeight() const 
-{
-    int nonOperators = 0;
-    for (RenderObject* current = firstChild(); current; current = current->nextSibling()) {
-        if (current->firstChild() && current->firstChild()->isRenderMathMLBlock()) {
-            RenderMathMLBlock* block = toRenderMathMLBlock(current->firstChild());
-            if (!block->isRenderMathMLOperator()) 
-                nonOperators += getOffsetHeight(current);
-        } else
-            nonOperators += getOffsetHeight(current);
-    }
-    return nonOperators;
-}
-
 }
 
 #endif // ENABLE(MATHML)
diff --git a/Source/WebCore/rendering/mathml/RenderMathMLUnderOver.h b/Source/WebCore/rendering/mathml/RenderMathMLUnderOver.h
index 2fe619821..e25e94768 100644
--- a/Source/WebCore/rendering/mathml/RenderMathMLUnderOver.h
+++ b/Source/WebCore/rendering/mathml/RenderMathMLUnderOver.h
@@ -34,16 +34,21 @@ namespace WebCore {
     
 class RenderMathMLUnderOver : public RenderMathMLBlock {
 public:
-    RenderMathMLUnderOver(Node* expression);
+    RenderMathMLUnderOver(Element*);
     virtual void addChild(RenderObject* child, RenderObject* beforeChild = 0);
+    
+    virtual RenderMathMLOperator* unembellishedOperator();
     virtual void layout();
-    virtual bool hasBase() const { return true; }
-    virtual int nonOperatorHeight() const;
     virtual LayoutUnit baselinePosition(FontBaseline, bool firstLine, LineDirectionMode, LinePositionMode = PositionOnContainingLine) const;
     virtual void stretchToHeight(int pixelHeight);
+    
 private:
     virtual const char* renderName() const { return "RenderMathMLUnderOver"; }
 
+    // Omit our underscript and/or overscript. This may return 0 for a non-MathML base (which
+    // won't occur in valid MathML).
+    RenderBoxModelObject* base() const;
+    
     enum UnderOverType { Under, Over, UnderOver };
     UnderOverType m_kind;
 };
diff --git a/Source/WebCore/rendering/style/RenderStyle.cpp b/Source/WebCore/rendering/style/RenderStyle.cpp
index 08bfbf90f..c62b3b198 100644
--- a/Source/WebCore/rendering/style/RenderStyle.cpp
+++ b/Source/WebCore/rendering/style/RenderStyle.cpp
@@ -466,7 +466,8 @@ StyleDifference RenderStyle::diff(const RenderStyle* other, unsigned& changedCon
             || rareInheritedData->textEmphasisCustomMark != other->rareInheritedData->textEmphasisCustomMark
             || rareInheritedData->m_lineBoxContain != other->rareInheritedData->m_lineBoxContain
             || rareInheritedData->m_lineGrid != other->rareInheritedData->m_lineGrid
-            || rareInheritedData->m_lineGridSnap != other->rareInheritedData->m_lineGridSnap)
+            || rareInheritedData->m_lineSnap != other->rareInheritedData->m_lineSnap
+            || rareInheritedData->m_lineAlign != other->rareInheritedData->m_lineAlign)
             return StyleDifferenceLayout;
 
         if (!rareInheritedData->shadowDataEquivalent(*other->rareInheritedData.get()))
@@ -886,7 +887,7 @@ static float calcConstraintScaleFor(const IntRect& rect, const RoundedRect::Radi
 
 RoundedRect RenderStyle::getRoundedBorderFor(const LayoutRect& borderRect, bool includeLogicalLeftEdge, bool includeLogicalRightEdge) const
 {
-    RoundedRect roundedRect(borderRect);
+    RoundedRect roundedRect(pixelSnappedIntRect(borderRect));
     if (hasBorderRadius()) {
         RoundedRect::Radii radii = calcRadiiFor(surround->border, borderRect.size());
         radii.scale(calcConstraintScaleFor(borderRect, radii));
@@ -915,7 +916,7 @@ RoundedRect RenderStyle::getRoundedInnerBorderFor(const LayoutRect& borderRect,
                borderRect.width() - leftWidth - rightWidth, 
                borderRect.height() - topWidth - bottomWidth);
 
-    RoundedRect roundedRect(innerRect);
+    RoundedRect roundedRect(pixelSnappedIntRect(innerRect));
 
     if (hasBorderRadius()) {
         RoundedRect::Radii radii = getRoundedBorderFor(borderRect).radii();
diff --git a/Source/WebCore/rendering/style/RenderStyle.h b/Source/WebCore/rendering/style/RenderStyle.h
index 74fae1daf..647d3e9fc 100644
--- a/Source/WebCore/rendering/style/RenderStyle.h
+++ b/Source/WebCore/rendering/style/RenderStyle.h
@@ -791,9 +791,9 @@ public:
     float aspectRatioNumerator() const { return rareNonInheritedData->m_aspectRatioNumerator; }
     EBoxAlignment boxAlign() const { return static_cast<EBoxAlignment>(rareNonInheritedData->m_deprecatedFlexibleBox->align); }
     EBoxDirection boxDirection() const { return static_cast<EBoxDirection>(inherited_flags._box_direction); }
-    float boxFlex() { return rareNonInheritedData->m_deprecatedFlexibleBox->flex; }
+    float boxFlex() const { return rareNonInheritedData->m_deprecatedFlexibleBox->flex; }
     unsigned int boxFlexGroup() const { return rareNonInheritedData->m_deprecatedFlexibleBox->flex_group; }
-    EBoxLines boxLines() { return static_cast<EBoxLines>(rareNonInheritedData->m_deprecatedFlexibleBox->lines); }
+    EBoxLines boxLines() const { return static_cast<EBoxLines>(rareNonInheritedData->m_deprecatedFlexibleBox->lines); }
     unsigned int boxOrdinalGroup() const { return rareNonInheritedData->m_deprecatedFlexibleBox->ordinal_group; }
     EBoxOrient boxOrient() const { return static_cast<EBoxOrient>(rareNonInheritedData->m_deprecatedFlexibleBox->orient); }
     EBoxPack boxPack() const { return static_cast<EBoxPack>(rareNonInheritedData->m_deprecatedFlexibleBox->pack); }
@@ -903,7 +903,8 @@ public:
     RegionOverflow regionOverflow() const { return static_cast<RegionOverflow>(rareNonInheritedData->m_regionOverflow); }
 
     const AtomicString& lineGrid() const { return rareInheritedData->m_lineGrid; }
-    LineGridSnap lineGridSnap() const { return static_cast<LineGridSnap>(rareInheritedData->m_lineGridSnap); }
+    LineSnap lineSnap() const { return static_cast<LineSnap>(rareInheritedData->m_lineSnap); }
+    LineAlign lineAlign() const { return static_cast<LineAlign>(rareInheritedData->m_lineAlign); }
 
     WrapFlow wrapFlow() const { return static_cast<WrapFlow>(rareNonInheritedData->m_wrapFlow); }
     WrapThrough wrapThrough() const { return static_cast<WrapThrough>(rareNonInheritedData->m_wrapThrough); }
@@ -943,6 +944,9 @@ public:
 #if ENABLE(TOUCH_EVENTS)
     Color tapHighlightColor() const { return rareInheritedData->tapHighlightColor; }
 #endif
+#if ENABLE(OVERFLOW_SCROLLING)
+    bool useTouchOverflowScrolling() const { return rareInheritedData->useTouchOverflowScrolling; }
+#endif
     bool textSizeAdjust() const { return rareInheritedData->textSizeAdjust; }
     ETextSecurity textSecurity() const { return static_cast<ETextSecurity>(rareInheritedData->textSecurity); }
 
@@ -1302,7 +1306,8 @@ public:
     // End CSS3 Setters
 
     void setLineGrid(const AtomicString& lineGrid) { SET_VAR(rareInheritedData, m_lineGrid, lineGrid); }
-    void setLineGridSnap(LineGridSnap lineGridSnap) { SET_VAR(rareInheritedData, m_lineGridSnap, lineGridSnap); }
+    void setLineSnap(LineSnap lineSnap) { SET_VAR(rareInheritedData, m_lineSnap, lineSnap); }
+    void setLineAlign(LineAlign lineAlign) { SET_VAR(rareInheritedData, m_lineAlign, lineAlign); }
 
     void setFlowThread(const AtomicString& flowThread) { SET_VAR(rareNonInheritedData, m_flowThread, flowThread); }
     void setRegionThread(const AtomicString& regionThread) { SET_VAR(rareNonInheritedData, m_regionThread, regionThread); }
@@ -1347,6 +1352,9 @@ public:
 #if ENABLE(TOUCH_EVENTS)
     void setTapHighlightColor(const Color& c) { SET_VAR(rareInheritedData, tapHighlightColor, c); }
 #endif
+#if ENABLE(OVERFLOW_SCROLLING)
+    void setUseTouchOverflowScrolling(bool v) { SET_VAR(rareInheritedData, useTouchOverflowScrolling, v); }
+#endif
     bool setTextSizeAdjust(bool);
     void setTextSecurity(ETextSecurity aTextSecurity) { SET_VAR(rareInheritedData, textSecurity, aTextSecurity); }
 
@@ -1532,8 +1540,8 @@ public:
     static Length initialPadding() { return Length(Fixed); }
     static Length initialTextIndent() { return Length(Fixed); }
     static EVerticalAlign initialVerticalAlign() { return BASELINE; }
-    static int initialWidows() { return 2; }
-    static int initialOrphans() { return 2; }
+    static short initialWidows() { return 2; }
+    static short initialOrphans() { return 2; }
     static Length initialLineHeight() { return Length(-100.0, Percent); }
     static ETextAlign initialTextAlign() { return TAAUTO; }
     static ETextDecoration initialTextDecoration() { return TDNONE; }
@@ -1546,8 +1554,8 @@ public:
     static EBoxOrient initialBoxOrient() { return HORIZONTAL; }
     static EBoxPack initialBoxPack() { return Start; }
     static float initialBoxFlex() { return 0.0f; }
-    static int initialBoxFlexGroup() { return 1; }
-    static int initialBoxOrdinalGroup() { return 1; }
+    static unsigned int initialBoxFlexGroup() { return 1; }
+    static unsigned int initialBoxOrdinalGroup() { return 1; }
     static EBoxSizing initialBoxSizing() { return CONTENT_BOX; }
     static StyleReflection* initialBoxReflect() { return 0; }
     static float initialFlexboxWidthPositiveFlex() { return 0; }
@@ -1559,7 +1567,7 @@ public:
     static EFlexAlign initialFlexAlign() { return AlignStretch; }
     static EFlexAlign initialFlexItemAlign() { return AlignAuto; }
     static EFlexDirection initialFlexDirection() { return FlowRow; }
-    static EFlexWrap initialFlexWrap() { return FlexNoWrap; }
+    static EFlexWrap initialFlexWrap() { return FlexWrapNone; }
     static int initialMarqueeLoopCount() { return -1; }
     static int initialMarqueeSpeed() { return 85; }
     static Length initialMarqueeIncrement() { return Length(6, Fixed); }
@@ -1631,7 +1639,8 @@ public:
 #endif
 
     static const AtomicString& initialLineGrid() { return nullAtom; }
-    static LineGridSnap initialLineGridSnap() { return LineGridSnapNone; }
+    static LineSnap initialLineSnap() { return LineSnapNone; }
+    static LineAlign initialLineAlign() { return LineAlignNone; }
 
     static const AtomicString& initialFlowThread() { return nullAtom; }
     static const AtomicString& initialRegionThread() { return nullAtom; }
@@ -1647,6 +1656,9 @@ public:
 #if ENABLE(TOUCH_EVENTS)
     static Color initialTapHighlightColor();
 #endif
+#if ENABLE(OVERFLOW_SCROLLING)
+    static bool initialUseTouchOverflowScrolling() { return false; }
+#endif
 #if ENABLE(DASHBOARD_SUPPORT)
     static const Vector<StyleDashboardRegion>& initialDashboardRegions();
     static const Vector<StyleDashboardRegion>& noneDashboardRegions();
diff --git a/Source/WebCore/rendering/style/RenderStyleConstants.h b/Source/WebCore/rendering/style/RenderStyleConstants.h
index 0ce3d8886..aee10813a 100644
--- a/Source/WebCore/rendering/style/RenderStyleConstants.h
+++ b/Source/WebCore/rendering/style/RenderStyleConstants.h
@@ -171,7 +171,7 @@ enum EBoxDirection { BNORMAL, BREVERSE };
 enum EFlexPack { PackStart, PackEnd, PackCenter, PackJustify, PackDistribute };
 enum EFlexAlign { AlignAuto, AlignStart, AlignEnd, AlignCenter, AlignStretch, AlignBaseline };
 enum EFlexDirection { FlowRow, FlowRowReverse, FlowColumn, FlowColumnReverse };
-enum EFlexWrap { FlexNoWrap, FlexWrap, FlexWrapReverse };
+enum EFlexWrap { FlexWrapNone, FlexWrap, FlexWrapReverse };
 
 enum ETextSecurity {
     TSNONE, TSDISC, TSCIRCLE, TSSQUARE
@@ -454,7 +454,9 @@ enum RegionOverflow { AutoRegionOverflow, BreakRegionOverflow };
 
 enum ColumnAxis { HorizontalColumnAxis, VerticalColumnAxis, AutoColumnAxis };
 
-enum LineGridSnap { LineGridSnapNone, LineGridSnapBaseline, LineGridSnapContain };
+enum LineSnap { LineSnapNone, LineSnapBaseline, LineSnapContain };
+
+enum LineAlign { LineAlignNone, LineAlignEdges };
 
 enum WrapFlow { WrapFlowAuto, WrapFlowBoth, WrapFlowLeft, WrapFlowRight, WrapFlowMaximum, WrapFlowClear };
 
diff --git a/Source/WebCore/rendering/style/StyleCachedImage.cpp b/Source/WebCore/rendering/style/StyleCachedImage.cpp
index 1a7d9ef10..a7a1996fa 100644
--- a/Source/WebCore/rendering/style/StyleCachedImage.cpp
+++ b/Source/WebCore/rendering/style/StyleCachedImage.cpp
@@ -24,11 +24,22 @@
 #include "config.h"
 #include "StyleCachedImage.h"
 
-#include "CachedImage.h"
 #include "RenderObject.h"
 
 namespace WebCore {
 
+StyleCachedImage::StyleCachedImage(CachedImage* image)
+    : m_image(image)
+{
+    m_isCachedImage = true;
+    m_image->addClient(this);
+}
+
+StyleCachedImage::~StyleCachedImage()
+{
+    m_image->removeClient(this);
+}
+
 PassRefPtr<CSSValue> StyleCachedImage::cssValue() const
 {
     return CSSPrimitiveValue::create(m_image->url(), CSSPrimitiveValue::CSS_URI);
diff --git a/Source/WebCore/rendering/style/StyleCachedImage.h b/Source/WebCore/rendering/style/StyleCachedImage.h
index 06dfb25a6..c9913fd82 100644
--- a/Source/WebCore/rendering/style/StyleCachedImage.h
+++ b/Source/WebCore/rendering/style/StyleCachedImage.h
@@ -24,16 +24,18 @@
 #ifndef StyleCachedImage_h
 #define StyleCachedImage_h
 
+#include "CachedImage.h"
 #include "CachedResourceHandle.h"
 #include "StyleImage.h"
 
 namespace WebCore {
 
-class CachedImage;
-
-class StyleCachedImage : public StyleImage {
+class StyleCachedImage : public StyleImage, private CachedImageClient {
+    WTF_MAKE_FAST_ALLOCATED;
 public:
     static PassRefPtr<StyleCachedImage> create(CachedImage* image) { return adoptRef(new StyleCachedImage(image)); }
+    virtual ~StyleCachedImage();
+
     virtual WrappedImagePtr data() const { return m_image.get(); }
 
     virtual PassRefPtr<CSSValue> cssValue() const;
@@ -54,11 +56,7 @@ public:
     virtual PassRefPtr<Image> image(RenderObject*, const IntSize&) const;
     
 private:
-    StyleCachedImage(CachedImage* image)
-        : m_image(image)
-    {
-         m_isCachedImage = true;
-    }
+    explicit StyleCachedImage(CachedImage*);
     
     CachedResourceHandle<CachedImage> m_image;
 };
diff --git a/Source/WebCore/rendering/style/StyleRareInheritedData.cpp b/Source/WebCore/rendering/style/StyleRareInheritedData.cpp
index 9dda82d8b..5d73793ce 100644
--- a/Source/WebCore/rendering/style/StyleRareInheritedData.cpp
+++ b/Source/WebCore/rendering/style/StyleRareInheritedData.cpp
@@ -53,7 +53,11 @@ StyleRareInheritedData::StyleRareInheritedData()
     , textEmphasisPosition(TextEmphasisPositionOver)
     , m_lineBoxContain(RenderStyle::initialLineBoxContain())
     , m_imageRendering(RenderStyle::initialImageRendering())
-    , m_lineGridSnap(RenderStyle::initialLineGridSnap())
+    , m_lineSnap(RenderStyle::initialLineSnap())
+    , m_lineAlign(RenderStyle::initialLineAlign())
+#if ENABLE(OVERFLOW_SCROLLING)
+    , useTouchOverflowScrolling(RenderStyle::initialUseTouchOverflowScrolling())
+#endif
     , hyphenationLimitBefore(-1)
     , hyphenationLimitAfter(-1)
     , hyphenationLimitLines(-1)
@@ -97,7 +101,11 @@ StyleRareInheritedData::StyleRareInheritedData(const StyleRareInheritedData& o)
     , textEmphasisPosition(o.textEmphasisPosition)
     , m_lineBoxContain(o.m_lineBoxContain)
     , m_imageRendering(o.m_imageRendering)
-    , m_lineGridSnap(o.m_lineGridSnap)
+    , m_lineSnap(o.m_lineSnap)
+    , m_lineAlign(o.m_lineAlign)
+#if ENABLE(OVERFLOW_SCROLLING)
+    , useTouchOverflowScrolling(o.useTouchOverflowScrolling)
+#endif
     , hyphenationString(o.hyphenationString)
     , hyphenationLimitBefore(o.hyphenationLimitBefore)
     , hyphenationLimitAfter(o.hyphenationLimitAfter)
@@ -149,6 +157,9 @@ bool StyleRareInheritedData::operator==(const StyleRareInheritedData& o) const
         && wordWrap == o.wordWrap
         && nbspMode == o.nbspMode
         && khtmlLineBreak == o.khtmlLineBreak
+#if ENABLE(OVERFLOW_SCROLLING)
+        && useTouchOverflowScrolling == o.useTouchOverflowScrolling
+#endif
         && textSizeAdjust == o.textSizeAdjust
         && resize == o.resize
         && userSelect == o.userSelect
@@ -168,7 +179,8 @@ bool StyleRareInheritedData::operator==(const StyleRareInheritedData& o) const
         && QuotesData::equal(quotes.get(), o.quotes.get())
         && m_lineGrid == o.m_lineGrid
         && m_imageRendering == o.m_imageRendering
-        && m_lineGridSnap == o.m_lineGridSnap;
+        && m_lineSnap == o.m_lineSnap
+        && m_lineAlign == o.m_lineAlign;
 }
 
 bool StyleRareInheritedData::shadowDataEquivalent(const StyleRareInheritedData& o) const
diff --git a/Source/WebCore/rendering/style/StyleRareInheritedData.h b/Source/WebCore/rendering/style/StyleRareInheritedData.h
index fd5796936..570dbb573 100644
--- a/Source/WebCore/rendering/style/StyleRareInheritedData.h
+++ b/Source/WebCore/rendering/style/StyleRareInheritedData.h
@@ -91,7 +91,11 @@ public:
     unsigned m_lineBoxContain: 7; // LineBoxContain
     // CSS Image Values Level 3
     unsigned m_imageRendering : 2; // EImageRendering
-    unsigned m_lineGridSnap : 2; // LineGridSnap
+    unsigned m_lineSnap : 2; // LineSnap
+    unsigned m_lineAlign : 1; // LineAlign
+#if ENABLE(OVERFLOW_SCROLLING)
+    unsigned useTouchOverflowScrolling: 1;
+#endif
 
     AtomicString hyphenationString;
     short hyphenationLimitBefore;
diff --git a/Source/WebCore/rendering/svg/RenderSVGContainer.h b/Source/WebCore/rendering/svg/RenderSVGContainer.h
index c7d9f205f..b3324703c 100644
--- a/Source/WebCore/rendering/svg/RenderSVGContainer.h
+++ b/Source/WebCore/rendering/svg/RenderSVGContainer.h
@@ -41,6 +41,7 @@ public:
 
     virtual void paint(PaintInfo&, const LayoutPoint&);
     virtual void setNeedsBoundariesUpdate() { m_needsBoundariesUpdate = true; }
+    virtual bool didTransformToRootUpdate() { return false; }
 
 protected:
     virtual RenderObjectChildList* virtualChildren() { return children(); }
diff --git a/Source/WebCore/rendering/svg/RenderSVGInlineText.cpp b/Source/WebCore/rendering/svg/RenderSVGInlineText.cpp
index 74facc3cf..591316291 100644
--- a/Source/WebCore/rendering/svg/RenderSVGInlineText.cpp
+++ b/Source/WebCore/rendering/svg/RenderSVGInlineText.cpp
@@ -267,6 +267,8 @@ void RenderSVGInlineText::computeNewScaledFontForStyle(RenderObject* renderer, c
     }
 
     FontDescription fontDescription(style->fontDescription());
+
+    // FIXME: We need to better handle the case when we compute very small fonts below (below 1pt).
     fontDescription.setComputedSize(CSSStyleSelector::getComputedSizeFromSpecifiedSize(document, scalingFactor, fontDescription.isAbsoluteSize(), fontDescription.computedSize(), DoNotUseSmartMinimumForFontSize));
 
     scaledFont = Font(fontDescription, 0, 0);
diff --git a/Source/WebCore/rendering/svg/RenderSVGResourceContainer.cpp b/Source/WebCore/rendering/svg/RenderSVGResourceContainer.cpp
index 5adb29950..2e03e9f59 100644
--- a/Source/WebCore/rendering/svg/RenderSVGResourceContainer.cpp
+++ b/Source/WebCore/rendering/svg/RenderSVGResourceContainer.cpp
@@ -38,7 +38,7 @@ static inline SVGDocumentExtensions* svgExtensionsFromNode(Node* node)
 
 RenderSVGResourceContainer::RenderSVGResourceContainer(SVGStyledElement* node)
     : RenderSVGHiddenContainer(node)
-    , m_id(node->hasID() ? node->getIdAttribute() : nullAtom)
+    , m_id(node->getIdAttribute())
     , m_registered(false)
     , m_isInvalidating(false)
 {
diff --git a/Source/WebCore/rendering/svg/RenderSVGRoot.cpp b/Source/WebCore/rendering/svg/RenderSVGRoot.cpp
index ba821cca2..7baa4fc38 100644
--- a/Source/WebCore/rendering/svg/RenderSVGRoot.cpp
+++ b/Source/WebCore/rendering/svg/RenderSVGRoot.cpp
@@ -306,7 +306,7 @@ void RenderSVGRoot::buildLocalToBorderBoxTransform()
     float scale = style()->effectiveZoom();
     FloatPoint translate = svg->currentTranslate();
     LayoutSize borderAndPadding(borderLeft() + paddingLeft(), borderTop() + paddingTop());
-    m_localToBorderBoxTransform = svg->viewBoxToViewTransform(width() / scale, height() / scale);
+    m_localToBorderBoxTransform = svg->viewBoxToViewTransform(contentWidth() / scale, contentHeight() / scale);
     if (borderAndPadding.isEmpty() && scale == 1 && translate == FloatPoint::zero())
         return;
     m_localToBorderBoxTransform = AffineTransform(scale, 0, 0, scale, borderAndPadding.width() + translate.x(), borderAndPadding.height() + translate.y()) * m_localToBorderBoxTransform;
diff --git a/Source/WebCore/rendering/svg/RenderSVGRoot.h b/Source/WebCore/rendering/svg/RenderSVGRoot.h
index cb7a1b2e0..701137f44 100644
--- a/Source/WebCore/rendering/svg/RenderSVGRoot.h
+++ b/Source/WebCore/rendering/svg/RenderSVGRoot.h
@@ -56,7 +56,6 @@ public:
 private:
     virtual RenderObjectChildList* virtualChildren() { return children(); }
     virtual const RenderObjectChildList* virtualChildren() const { return children(); }
-    virtual bool canHaveChildren() const { return true; }
 
     virtual bool isSVGRoot() const { return true; }
     virtual const char* renderName() const { return "RenderSVGRoot"; }
@@ -87,6 +86,7 @@ private:
 
     virtual void mapLocalToContainer(RenderBoxModelObject* repaintContainer, bool useTransforms, bool fixed, TransformState&, bool* wasFixed = 0) const;
     virtual bool canBeSelectionLeaf() const { return false; }
+    virtual bool canHaveChildren() const { return true; }
 
     void updateCachedBoundaries();
     void buildLocalToBorderBoxTransform();
diff --git a/Source/WebCore/rendering/svg/RenderSVGText.cpp b/Source/WebCore/rendering/svg/RenderSVGText.cpp
index ebf92e569..d9cdeccdf 100644
--- a/Source/WebCore/rendering/svg/RenderSVGText.cpp
+++ b/Source/WebCore/rendering/svg/RenderSVGText.cpp
@@ -58,6 +58,7 @@ RenderSVGText::RenderSVGText(SVGTextElement* node)
     , m_needsReordering(false)
     , m_needsPositioningValuesUpdate(true)
     , m_needsTransformUpdate(true)
+    , m_needsTextMetricsUpdate(true)
 {
 }
 
@@ -208,11 +209,13 @@ void RenderSVGText::layout()
         updateCachedBoundariesInParents = true;
     }
 
-    // If the root layout size changed (eg. window size changes) or the positioning values change, recompute the on-screen font size.
-    if (SVGRenderSupport::findTreeRootObject(this)->isLayoutSizeChanged()) {
+    // If the root layout size changed (eg. window size changes) or the positioning values change
+    // or the transform to the root context has changed then recompute the on-screen font size.
+    if (m_needsTextMetricsUpdate || SVGRenderSupport::findTreeRootObject(this)->isLayoutSizeChanged()) {
         recursiveUpdateScaledFont(this);
         rebuildLayoutAttributes(true);
         updateCachedBoundariesInParents = true;
+        m_needsTextMetricsUpdate = false;
     }
 
     if (m_needsPositioningValuesUpdate) {
diff --git a/Source/WebCore/rendering/svg/RenderSVGText.h b/Source/WebCore/rendering/svg/RenderSVGText.h
index 864101695..7b0b5efa8 100644
--- a/Source/WebCore/rendering/svg/RenderSVGText.h
+++ b/Source/WebCore/rendering/svg/RenderSVGText.h
@@ -41,6 +41,7 @@ public:
 
     void setNeedsPositioningValuesUpdate() { m_needsPositioningValuesUpdate = true; }
     virtual void setNeedsTransformUpdate() { m_needsTransformUpdate = true; }
+    void setNeedsTextMetricsUpdate() { m_needsTextMetricsUpdate = true; }
     virtual FloatRect repaintRectInLocalCoordinates() const;
 
     static RenderSVGText* locateRenderSVGTextAncestor(RenderObject*);
@@ -90,6 +91,7 @@ private:
     bool m_needsReordering : 1;
     bool m_needsPositioningValuesUpdate : 1;
     bool m_needsTransformUpdate : 1;
+    bool m_needsTextMetricsUpdate : 1;
     AffineTransform m_localTransform;
     SVGTextLayoutAttributesBuilder m_layoutAttributesBuilder;
     Vector<SVGTextLayoutAttributes*> m_layoutAttributes;
diff --git a/Source/WebCore/rendering/svg/RenderSVGTransformableContainer.cpp b/Source/WebCore/rendering/svg/RenderSVGTransformableContainer.cpp
index 1db6365b2..0a62f6885 100644
--- a/Source/WebCore/rendering/svg/RenderSVGTransformableContainer.cpp
+++ b/Source/WebCore/rendering/svg/RenderSVGTransformableContainer.cpp
@@ -25,6 +25,7 @@
 #include "RenderSVGTransformableContainer.h"
 
 #include "SVGNames.h"
+#include "SVGRenderSupport.h"
 #include "SVGShadowTreeElements.h"
 #include "SVGStyledTransformableElement.h"
 
@@ -33,6 +34,7 @@ namespace WebCore {
 RenderSVGTransformableContainer::RenderSVGTransformableContainer(SVGStyledTransformableElement* node)
     : RenderSVGContainer(node)
     , m_needsTransformUpdate(true)
+    , m_didTransformToRootUpdate(false)
 {
 }
 
@@ -41,6 +43,7 @@ bool RenderSVGTransformableContainer::calculateLocalTransform()
     SVGStyledTransformableElement* element = static_cast<SVGStyledTransformableElement*>(node());
 
     bool needsUpdate = m_needsTransformUpdate;
+    m_didTransformToRootUpdate = m_needsTransformUpdate || SVGRenderSupport::transformToRootChanged(parent());
     if (needsUpdate) {
         m_localTransform = element->animatedLocalTransform();
         m_needsTransformUpdate = false;
diff --git a/Source/WebCore/rendering/svg/RenderSVGTransformableContainer.h b/Source/WebCore/rendering/svg/RenderSVGTransformableContainer.h
index 401bfa858..c9c607ba2 100644
--- a/Source/WebCore/rendering/svg/RenderSVGTransformableContainer.h
+++ b/Source/WebCore/rendering/svg/RenderSVGTransformableContainer.h
@@ -31,14 +31,17 @@ class RenderSVGTransformableContainer : public RenderSVGContainer {
 public:
     explicit RenderSVGTransformableContainer(SVGStyledTransformableElement*);
 
+    virtual bool isSVGTransformableContainer() const { return true; }
     virtual const AffineTransform& localToParentTransform() const { return m_localTransform; }
     virtual void setNeedsTransformUpdate() { m_needsTransformUpdate = true; }
+    virtual bool didTransformToRootUpdate() { return m_didTransformToRootUpdate; }
 
 private:
     virtual bool calculateLocalTransform();
     virtual AffineTransform localTransform() const { return m_localTransform; }
 
     bool m_needsTransformUpdate : 1;
+    bool m_didTransformToRootUpdate : 1;
     AffineTransform m_localTransform;
 };
 }
diff --git a/Source/WebCore/rendering/svg/RenderSVGViewportContainer.cpp b/Source/WebCore/rendering/svg/RenderSVGViewportContainer.cpp
index 1021aff00..3e0e3e4d9 100644
--- a/Source/WebCore/rendering/svg/RenderSVGViewportContainer.cpp
+++ b/Source/WebCore/rendering/svg/RenderSVGViewportContainer.cpp
@@ -34,7 +34,9 @@ namespace WebCore {
 
 RenderSVGViewportContainer::RenderSVGViewportContainer(SVGStyledElement* node)
     : RenderSVGContainer(node)
+    , m_didTransformToRootUpdate(false)
     , m_isLayoutSizeChanged(false)
+    , m_needsTransformUpdate(true)
 {
 }
 
@@ -63,8 +65,21 @@ void RenderSVGViewportContainer::calcViewport()
     SVGLengthContext lengthContext(element);
     m_viewport = FloatRect(svg->x().value(lengthContext), svg->y().value(lengthContext), svg->width().value(lengthContext), svg->height().value(lengthContext));
 
-    if (oldViewport != m_viewport)
+    if (oldViewport != m_viewport) {
+        m_didTransformToRootUpdate = true;
         setNeedsBoundariesUpdate();
+        setNeedsTransformUpdate();
+    }
+}
+
+bool RenderSVGViewportContainer::calculateLocalTransform() 
+{
+    if (!m_needsTransformUpdate)
+        return false;
+    
+    m_localToParentTransform = AffineTransform::translation(m_viewport.x(), m_viewport.y()) * viewportTransform();
+    m_needsTransformUpdate = false;
+    return true;
 }
 
 AffineTransform RenderSVGViewportContainer::viewportTransform() const
@@ -77,14 +92,6 @@ AffineTransform RenderSVGViewportContainer::viewportTransform() const
     return AffineTransform();
 }
 
-const AffineTransform& RenderSVGViewportContainer::localToParentTransform() const
-{
-    m_localToParentTransform = AffineTransform::translation(m_viewport.x(), m_viewport.y()) * viewportTransform();
-    return m_localToParentTransform;
-    // If this class were ever given a localTransform(), then the above would read:
-    // return viewportTranslation * localTransform() * viewportTransform()
-}
-
 bool RenderSVGViewportContainer::pointIsInsideViewportClip(const FloatPoint& pointInParent)
 {
     // Respect the viewport clip (which is in parent coords)
diff --git a/Source/WebCore/rendering/svg/RenderSVGViewportContainer.h b/Source/WebCore/rendering/svg/RenderSVGViewportContainer.h
index 808d6727b..b748fe6f0 100644
--- a/Source/WebCore/rendering/svg/RenderSVGViewportContainer.h
+++ b/Source/WebCore/rendering/svg/RenderSVGViewportContainer.h
@@ -36,8 +36,10 @@ public:
     FloatRect viewport() const { return m_viewport; }
 
     bool isLayoutSizeChanged() const { return m_isLayoutSizeChanged; }
+    virtual bool didTransformToRootUpdate() { return m_didTransformToRootUpdate; }
 
     virtual void determineIfLayoutSizeChanged();
+    virtual void setNeedsTransformUpdate() { m_needsTransformUpdate = true; }
 
 private:
     virtual bool isSVGContainer() const { return true; }
@@ -45,16 +47,19 @@ private:
     virtual const char* renderName() const { return "RenderSVGViewportContainer"; }
 
     AffineTransform viewportTransform() const;
-    virtual const AffineTransform& localToParentTransform() const;
+    virtual const AffineTransform& localToParentTransform() const { return m_localToParentTransform; }
 
     virtual void calcViewport();
+    virtual bool calculateLocalTransform();
 
     virtual void applyViewportClip(PaintInfo&);
     virtual bool pointIsInsideViewportClip(const FloatPoint& pointInParent);
 
     FloatRect m_viewport;
     mutable AffineTransform m_localToParentTransform;
+    bool m_didTransformToRootUpdate : 1;
     bool m_isLayoutSizeChanged : 1;
+    bool m_needsTransformUpdate : 1;
 };
   
 inline RenderSVGViewportContainer* toRenderSVGViewportContainer(RenderObject* object)
diff --git a/Source/WebCore/rendering/svg/SVGRenderSupport.cpp b/Source/WebCore/rendering/svg/SVGRenderSupport.cpp
index 6457ac006..7feb88fec 100644
--- a/Source/WebCore/rendering/svg/SVGRenderSupport.cpp
+++ b/Source/WebCore/rendering/svg/SVGRenderSupport.cpp
@@ -39,6 +39,7 @@
 #include "RenderSVGResourceMarker.h"
 #include "RenderSVGResourceMasker.h"
 #include "RenderSVGRoot.h"
+#include "RenderSVGText.h"
 #include "RenderSVGViewportContainer.h"
 #include "SVGResources.h"
 #include "SVGResourcesCache.h"
@@ -79,6 +80,13 @@ void SVGRenderSupport::mapLocalToContainer(const RenderObject* object, RenderBox
     object->parent()->mapLocalToContainer(repaintContainer, false, true, transformState, wasFixed);
 }
 
+static inline bool isRenderingMaskImage(RenderObject* object)
+{
+    if (object->frame() && object->frame()->view())
+        return object->frame()->view()->paintBehavior() & PaintBehaviorRenderingSVGMask;
+    return false;
+}
+
 bool SVGRenderSupport::prepareToRenderSVGContent(RenderObject* object, PaintInfo& paintInfo)
 {
     ASSERT(object);
@@ -89,11 +97,8 @@ bool SVGRenderSupport::prepareToRenderSVGContent(RenderObject* object, PaintInfo
     const SVGRenderStyle* svgStyle = style->svgStyle();
     ASSERT(svgStyle);
 
-    bool isRenderingMask = false;
-    if (object->frame() && object->frame()->view())
-        isRenderingMask = object->frame()->view()->paintBehavior() & PaintBehaviorRenderingSVGMask;
-
     // Setup transparency layers before setting up SVG resources!
+    bool isRenderingMask = isRenderingMaskImage(object);
     float opacity = isRenderingMask ? 1 : style->opacity();
     const ShadowData* shadow = svgStyle->shadow();
     if (opacity < 1 || shadow) {
@@ -168,7 +173,7 @@ void SVGRenderSupport::finishRenderSVGContent(RenderObject* object, PaintInfo& p
     }
 #endif
 
-    if (style->opacity() < 1)
+    if (style->opacity() < 1 && !isRenderingMaskImage(object))
         paintInfo.context->endTransparencyLayer();
 
     if (svgStyle->shadow())
@@ -245,14 +250,35 @@ static inline bool layoutSizeOfNearestViewportChanged(const RenderObject* start)
     return toRenderSVGRoot(start)->isLayoutSizeChanged();
 }
 
+bool SVGRenderSupport::transformToRootChanged(RenderObject* ancestor)
+{
+    while (ancestor && !ancestor->isSVGRoot()) {
+        if (ancestor->isSVGTransformableContainer())
+            return toRenderSVGContainer(ancestor)->didTransformToRootUpdate();
+        if (ancestor->isSVGViewportContainer())
+            return toRenderSVGViewportContainer(ancestor)->didTransformToRootUpdate();
+        ancestor = ancestor->parent();
+    }
+
+    return false;
+}
+
 void SVGRenderSupport::layoutChildren(RenderObject* start, bool selfNeedsLayout)
 {
     bool layoutSizeChanged = layoutSizeOfNearestViewportChanged(start);
+    bool transformChanged = transformToRootChanged(start);
     HashSet<RenderObject*> notlayoutedObjects;
 
     for (RenderObject* child = start->firstChild(); child; child = child->nextSibling()) {
         bool needsLayout = selfNeedsLayout;
 
+        if (transformChanged) {
+            // If the transform changed we need to update the text metrics (note: this also happens for layoutSizeChanged=true).
+            if (child->isSVGText())
+                toRenderSVGText(child)->setNeedsTextMetricsUpdate();
+            needsLayout = true;
+        }
+
         if (layoutSizeChanged) {
             // When selfNeedsLayout is false and the layout size changed, we have to check whether this child uses relative lengths
             if (SVGElement* element = child->node()->isSVGElement() ? static_cast<SVGElement*>(child->node()) : 0) {
@@ -260,6 +286,8 @@ void SVGRenderSupport::layoutChildren(RenderObject* start, bool selfNeedsLayout)
                     // When the layout size changed and when using relative values tell the RenderSVGShape to update its shape object
                     if (child->isSVGShape())
                         toRenderSVGShape(child)->setNeedsShapeUpdate();
+                    else if (child->isSVGText())
+                        toRenderSVGText(child)->setNeedsPositioningValuesUpdate();
 
                     needsLayout = true;
                 }
diff --git a/Source/WebCore/rendering/svg/SVGRenderSupport.h b/Source/WebCore/rendering/svg/SVGRenderSupport.h
index f5280ff24..c7b2fdcbf 100644
--- a/Source/WebCore/rendering/svg/SVGRenderSupport.h
+++ b/Source/WebCore/rendering/svg/SVGRenderSupport.h
@@ -72,6 +72,9 @@ public:
     // Shared between SVG renderers and resources.
     static void applyStrokeStyleToContext(GraphicsContext*, const RenderStyle*, const RenderObject*);
 
+    // Determines if any ancestor's transform has changed.
+    static bool transformToRootChanged(RenderObject*);
+
     // FIXME: These methods do not belong here.
     static const RenderSVGRoot* findTreeRootObject(const RenderObject*);
 
diff --git a/Source/WebCore/rendering/svg/SVGTextLayoutAttributesBuilder.cpp b/Source/WebCore/rendering/svg/SVGTextLayoutAttributesBuilder.cpp
index a27f68cd7..02a2123eb 100644
--- a/Source/WebCore/rendering/svg/SVGTextLayoutAttributesBuilder.cpp
+++ b/Source/WebCore/rendering/svg/SVGTextLayoutAttributesBuilder.cpp
@@ -79,12 +79,12 @@ void SVGTextLayoutAttributesBuilder::rebuildMetricsForWholeTree(RenderSVGText* t
 bool SVGTextLayoutAttributesBuilder::buildLayoutAttributesIfNeeded(RenderSVGText* textRoot)
 {
     ASSERT(textRoot);
-    if (!m_textPositions.isEmpty())
-        return m_textLength;
 
-    m_textLength = 0;
-    const UChar* lastCharacter = 0;
-    collectTextPositioningElements(textRoot, lastCharacter);
+    if (m_textPositions.isEmpty()) {
+        m_textLength = 0;
+        const UChar* lastCharacter = 0;
+        collectTextPositioningElements(textRoot, lastCharacter);
+    }
 
     m_characterDataMap.clear();
     if (!m_textLength)
diff --git a/Source/WebCore/storage/Database.cpp b/Source/WebCore/storage/Database.cpp
index dd29ea4b7..d9911c919 100644
--- a/Source/WebCore/storage/Database.cpp
+++ b/Source/WebCore/storage/Database.cpp
@@ -32,6 +32,7 @@
 #if ENABLE(SQL_DATABASE)
 
 #include "ChangeVersionWrapper.h"
+#include "CrossThreadTask.h"
 #include "DatabaseCallback.h"
 #include "DatabaseTask.h"
 #include "DatabaseThread.h"
@@ -41,6 +42,7 @@
 #include "Logging.h"
 #include "NotImplemented.h"
 #include "Page.h"
+#include "SQLError.h"
 #include "SQLTransactionCallback.h"
 #include "SQLTransactionClient.h"
 #include "SQLTransactionCoordinator.h"
@@ -216,6 +218,7 @@ void Database::close()
         MutexLocker locker(m_transactionInProgressMutex);
         m_isTransactionQueueEnabled = false;
         m_transactionInProgress = false;
+        m_transactionQueue.clear();
     }
 
     closeDatabase();
@@ -229,9 +232,12 @@ void Database::close()
 
 void Database::closeImmediately()
 {
+    ASSERT(m_scriptExecutionContext->isContextThread());
     DatabaseThread* databaseThread = scriptExecutionContext()->databaseThread();
-    if (databaseThread && !databaseThread->terminationRequested() && opened())
+    if (databaseThread && !databaseThread->terminationRequested() && opened()) {
+        logErrorMessage("forcibly closing database");
         databaseThread->scheduleImmediateTask(DatabaseCloseTask::create(this, 0));
+    }
 }
 
 unsigned long long Database::maximumSize() const
@@ -255,30 +261,36 @@ void Database::changeVersion(const String& oldVersion, const String& newVersion,
                              PassRefPtr<SQLTransactionCallback> callback, PassRefPtr<SQLTransactionErrorCallback> errorCallback,
                              PassRefPtr<VoidCallback> successCallback)
 {
-    RefPtr<SQLTransaction> transaction =
-        SQLTransaction::create(this, callback, errorCallback, successCallback, ChangeVersionWrapper::create(oldVersion, newVersion));
-    MutexLocker locker(m_transactionInProgressMutex);
-    m_transactionQueue.append(transaction.release());
-    if (!m_transactionInProgress)
-        scheduleTransaction();
+    runTransaction(callback, errorCallback, successCallback, ChangeVersionWrapper::create(oldVersion, newVersion), false);
 }
 
 void Database::transaction(PassRefPtr<SQLTransactionCallback> callback, PassRefPtr<SQLTransactionErrorCallback> errorCallback, PassRefPtr<VoidCallback> successCallback)
 {
-    runTransaction(callback, errorCallback, successCallback, false);
+    runTransaction(callback, errorCallback, successCallback, 0, false);
 }
 
 void Database::readTransaction(PassRefPtr<SQLTransactionCallback> callback, PassRefPtr<SQLTransactionErrorCallback> errorCallback, PassRefPtr<VoidCallback> successCallback)
 {
-    runTransaction(callback, errorCallback, successCallback, true);
+    runTransaction(callback, errorCallback, successCallback, 0, true);
+}
+
+static void callTransactionErrorCallback(ScriptExecutionContext*, PassRefPtr<SQLTransactionErrorCallback> callback, PassRefPtr<SQLError> error)
+{
+    callback->handleEvent(error.get());
 }
 
 void Database::runTransaction(PassRefPtr<SQLTransactionCallback> callback, PassRefPtr<SQLTransactionErrorCallback> errorCallback,
-                              PassRefPtr<VoidCallback> successCallback, bool readOnly)
+                              PassRefPtr<VoidCallback> successCallback, PassRefPtr<SQLTransactionWrapper> wrapper, bool readOnly)
 {
-    RefPtr<SQLTransaction> transaction =
-        SQLTransaction::create(this, callback, errorCallback, successCallback, 0, readOnly);
     MutexLocker locker(m_transactionInProgressMutex);
+    if (!m_isTransactionQueueEnabled) {
+        if (errorCallback) {
+            RefPtr<SQLError> error = SQLError::create(SQLError::UNKNOWN_ERR, "database has been closed");
+            scriptExecutionContext()->postTask(createCallbackTask(&callTransactionErrorCallback, errorCallback, error.release()));
+        }
+        return;
+    }
+    RefPtr<SQLTransaction> transaction = SQLTransaction::create(this, callback, errorCallback, successCallback, wrapper, readOnly);
     m_transactionQueue.append(transaction.release());
     if (!m_transactionInProgress)
         scheduleTransaction();
@@ -296,9 +308,8 @@ void Database::scheduleTransaction()
     ASSERT(!m_transactionInProgressMutex.tryLock()); // Locked by caller.
     RefPtr<SQLTransaction> transaction;
 
-    if (m_isTransactionQueueEnabled && !m_transactionQueue.isEmpty()) {
+    if (m_isTransactionQueueEnabled && !m_transactionQueue.isEmpty())
         transaction = m_transactionQueue.takeFirst();
-    }
 
     if (transaction && m_scriptExecutionContext->databaseThread()) {
         OwnPtr<DatabaseTransactionTask> task = DatabaseTransactionTask::create(transaction);
diff --git a/Source/WebCore/storage/Database.h b/Source/WebCore/storage/Database.h
index 4db9a9c85..12b430e33 100644
--- a/Source/WebCore/storage/Database.h
+++ b/Source/WebCore/storage/Database.h
@@ -47,6 +47,7 @@ class SQLTransactionCallback;
 class SQLTransactionClient;
 class SQLTransactionCoordinator;
 class SQLTransactionErrorCallback;
+class SQLTransactionWrapper;
 class VoidCallback;
 
 typedef int ExceptionCode;
@@ -93,7 +94,7 @@ private:
     Database(ScriptExecutionContext*, const String& name, const String& expectedVersion,
              const String& displayName, unsigned long estimatedSize);
     void runTransaction(PassRefPtr<SQLTransactionCallback>, PassRefPtr<SQLTransactionErrorCallback>,
-                        PassRefPtr<VoidCallback> successCallback, bool readOnly);
+                        PassRefPtr<VoidCallback> successCallback, PassRefPtr<SQLTransactionWrapper>, bool readOnly);
 
     bool openAndVerifyVersion(bool setVersionInNewDatabase, ExceptionCode&, String& errorMessage);
     virtual bool performOpenAndVerify(bool setVersionInNewDatabase, ExceptionCode&, String& errorMessage);
diff --git a/Source/WebCore/storage/DatabaseSync.cpp b/Source/WebCore/storage/DatabaseSync.cpp
index 1d8129dc2..8b744b8c6 100644
--- a/Source/WebCore/storage/DatabaseSync.cpp
+++ b/Source/WebCore/storage/DatabaseSync.cpp
@@ -205,16 +205,13 @@ private:
 
 void DatabaseSync::closeImmediately()
 {
-    if (!m_scriptExecutionContext->isContextThread()) {
-        m_scriptExecutionContext->postTask(CloseSyncDatabaseOnContextThreadTask::create(this));
-        return;
-    }
+    ASSERT(m_scriptExecutionContext->isContextThread());
 
     if (!opened())
         return;
 
+    logErrorMessage("forcibly closing database");
     DatabaseTracker::tracker().removeOpenDatabase(this);
-
     closeDatabase();
 }
 
diff --git a/Source/WebCore/storage/DatabaseThread.cpp b/Source/WebCore/storage/DatabaseThread.cpp
index cbde324e0..d771b1ca1 100644
--- a/Source/WebCore/storage/DatabaseThread.cpp
+++ b/Source/WebCore/storage/DatabaseThread.cpp
@@ -88,13 +88,13 @@ bool DatabaseThread::terminationRequested(DatabaseTaskSynchronizer* taskSynchron
     return m_queue.killed();
 }
 
-void* DatabaseThread::databaseThreadStart(void* vDatabaseThread)
+void DatabaseThread::databaseThreadStart(void* vDatabaseThread)
 {
     DatabaseThread* dbThread = static_cast<DatabaseThread*>(vDatabaseThread);
-    return dbThread->databaseThread();
+    dbThread->databaseThread();
 }
 
-void* DatabaseThread::databaseThread()
+void DatabaseThread::databaseThread()
 {
     {
         // Wait for DatabaseThread::start() to complete.
@@ -134,8 +134,6 @@ void* DatabaseThread::databaseThread()
 
     if (cleanupSync) // Someone wanted to know when we were done cleaning up.
         cleanupSync->taskCompleted();
-
-    return 0;
 }
 
 void DatabaseThread::recordDatabaseOpen(Database* database)
diff --git a/Source/WebCore/storage/DatabaseThread.h b/Source/WebCore/storage/DatabaseThread.h
index d410edbce..fa4fd088f 100644
--- a/Source/WebCore/storage/DatabaseThread.h
+++ b/Source/WebCore/storage/DatabaseThread.h
@@ -72,8 +72,8 @@ public:
 private:
     DatabaseThread();
 
-    static void* databaseThreadStart(void*);
-    void* databaseThread();
+    static void databaseThreadStart(void*);
+    void databaseThread();
 
     Mutex m_threadCreationMutex;
     ThreadIdentifier m_threadID;
diff --git a/Source/WebCore/storage/DatabaseTracker.h b/Source/WebCore/storage/DatabaseTracker.h
index 492c14863..d94a41578 100644
--- a/Source/WebCore/storage/DatabaseTracker.h
+++ b/Source/WebCore/storage/DatabaseTracker.h
@@ -173,12 +173,15 @@ private:
     static void notifyDatabasesChanged(void*);
 #else
 public:
-    void getOpenDatabases(const String& originIdentifier, const String& name, HashSet<RefPtr<AbstractDatabase> >* databases);
+    void closeDatabasesImmediately(const String& originIdentifier, const String& name);
 
 private:
     typedef HashSet<AbstractDatabase*> DatabaseSet;
     typedef HashMap<String, DatabaseSet*> DatabaseNameMap;
     typedef HashMap<String, DatabaseNameMap*> DatabaseOriginMap;
+    class CloseOneDatabaseImmediatelyTask;
+
+    void closeOneDatabaseImmediately(const String& originIdentifier, const String& name, AbstractDatabase* database);
 
     Mutex m_openDatabaseMapGuard;
     mutable OwnPtr<DatabaseOriginMap> m_openDatabaseMap;
diff --git a/Source/WebCore/storage/IDBAny.idl b/Source/WebCore/storage/IDBAny.idl
index 66a5c2042..dd51c4daa 100644
--- a/Source/WebCore/storage/IDBAny.idl
+++ b/Source/WebCore/storage/IDBAny.idl
@@ -27,7 +27,7 @@ module storage {
 
     interface [
         Conditional=INDEXED_DATABASE,
-        JSCustomToJS
+        CustomToJSObject
     ] IDBAny {
         // This space is intentionally left blank.
     };
diff --git a/Source/WebCore/storage/IDBCursor.cpp b/Source/WebCore/storage/IDBCursor.cpp
index 166c2dd6d..1dd1e9ebe 100644
--- a/Source/WebCore/storage/IDBCursor.cpp
+++ b/Source/WebCore/storage/IDBCursor.cpp
@@ -33,6 +33,7 @@
 #include "IDBCursorBackendInterface.h"
 #include "IDBKey.h"
 #include "IDBRequest.h"
+#include "IDBTracing.h"
 #include "IDBTransaction.h"
 #include "ScriptExecutionContext.h"
 #include "SerializedScriptValue.h"
@@ -62,21 +63,25 @@ IDBCursor::~IDBCursor()
 
 unsigned short IDBCursor::direction() const
 {
+    IDB_TRACE("IDBCursor::direction");
     return m_backend->direction();
 }
 
 PassRefPtr<IDBKey> IDBCursor::key() const
 {
+    IDB_TRACE("IDBCursor::key");
     return m_backend->key();
 }
 
 PassRefPtr<IDBKey> IDBCursor::primaryKey() const
 {
+    IDB_TRACE("IDBCursor::primaryKey");
     return m_backend->primaryKey();
 }
 
 PassRefPtr<IDBAny> IDBCursor::value() const
 {
+    IDB_TRACE("IDBCursor::value");
     return IDBAny::create(m_backend->value());
 }
 
@@ -87,6 +92,7 @@ IDBAny* IDBCursor::source() const
 
 PassRefPtr<IDBRequest> IDBCursor::update(ScriptExecutionContext* context, PassRefPtr<SerializedScriptValue> value, ExceptionCode& ec)
 {
+    IDB_TRACE("IDBCursor::update");
     RefPtr<IDBRequest> request = IDBRequest::create(context, IDBAny::create(this), m_transaction.get());
     m_backend->update(value, request, ec);
     if (ec) {
@@ -98,6 +104,7 @@ PassRefPtr<IDBRequest> IDBCursor::update(ScriptExecutionContext* context, PassRe
 
 void IDBCursor::continueFunction(PassRefPtr<IDBKey> key, ExceptionCode& ec)
 {
+    IDB_TRACE("IDBCursor::continue");
     if (key && (key->type() == IDBKey::InvalidType)) {
         ec = IDBDatabaseException::DATA_ERR;
         return;
@@ -114,6 +121,7 @@ void IDBCursor::continueFunction(PassRefPtr<IDBKey> key, ExceptionCode& ec)
 
 PassRefPtr<IDBRequest> IDBCursor::deleteFunction(ScriptExecutionContext* context, ExceptionCode& ec)
 {
+    IDB_TRACE("IDBCursor::delete");
     RefPtr<IDBRequest> request = IDBRequest::create(context, IDBAny::create(this), m_transaction.get());
     m_backend->deleteFunction(request, ec);
     if (ec) {
diff --git a/Source/WebCore/storage/IDBCursorBackendImpl.cpp b/Source/WebCore/storage/IDBCursorBackendImpl.cpp
index ff756cede..cdbe707fc 100644
--- a/Source/WebCore/storage/IDBCursorBackendImpl.cpp
+++ b/Source/WebCore/storage/IDBCursorBackendImpl.cpp
@@ -36,6 +36,7 @@
 #include "IDBKeyRange.h"
 #include "IDBObjectStoreBackendImpl.h"
 #include "IDBRequest.h"
+#include "IDBTracing.h"
 #include "IDBTransactionBackendInterface.h"
 #include "SerializedScriptValue.h"
 
@@ -64,21 +65,25 @@ IDBCursorBackendImpl::~IDBCursorBackendImpl()
 
 unsigned short IDBCursorBackendImpl::direction() const
 {
+    IDB_TRACE("IDBCursorBackendImpl::direction");
     return m_direction;
 }
 
 PassRefPtr<IDBKey> IDBCursorBackendImpl::key() const
 {
+    IDB_TRACE("IDBCursorBackendImpl::key");
     return m_cursor->key();
 }
 
 PassRefPtr<IDBKey> IDBCursorBackendImpl::primaryKey() const
 {
+    IDB_TRACE("IDBCursorBackendImpl::primaryKey");
     return m_cursor->primaryKey();
 }
 
 PassRefPtr<SerializedScriptValue> IDBCursorBackendImpl::value() const
 {
+    IDB_TRACE("IDBCursorBackendImpl::value");
     if (m_cursorType == IndexKeyCursor)
       return SerializedScriptValue::nullValue();
     return SerializedScriptValue::createFromWire(m_cursor->value());
@@ -86,6 +91,7 @@ PassRefPtr<SerializedScriptValue> IDBCursorBackendImpl::value() const
 
 void IDBCursorBackendImpl::update(PassRefPtr<SerializedScriptValue> value, PassRefPtr<IDBCallbacks> callbacks, ExceptionCode& ec)
 {
+    IDB_TRACE("IDBCursorBackendImpl::update");
     if (!m_cursor || m_cursorType == IndexKeyCursor) {
         ec = IDBDatabaseException::NOT_ALLOWED_ERR;
         return;
@@ -96,6 +102,7 @@ void IDBCursorBackendImpl::update(PassRefPtr<SerializedScriptValue> value, PassR
 
 void IDBCursorBackendImpl::continueFunction(PassRefPtr<IDBKey> prpKey, PassRefPtr<IDBCallbacks> prpCallbacks, ExceptionCode& ec)
 {
+    IDB_TRACE("IDBCursorBackendImpl::continue");
     RefPtr<IDBKey> key = prpKey;
 
     if (m_cursor && key) {
@@ -121,6 +128,7 @@ void IDBCursorBackendImpl::continueFunction(PassRefPtr<IDBKey> prpKey, PassRefPt
 //            IDBRequest::hasPendingActivity() will need to be modified to handle this!!!
 void IDBCursorBackendImpl::continueFunctionInternal(ScriptExecutionContext*, PassRefPtr<IDBCursorBackendImpl> prpCursor, PassRefPtr<IDBKey> prpKey, PassRefPtr<IDBCallbacks> callbacks)
 {
+    IDB_TRACE("IDBCursorBackendImpl::continueInternal");
     RefPtr<IDBCursorBackendImpl> cursor = prpCursor;
     RefPtr<IDBKey> key = prpKey;
 
@@ -135,6 +143,7 @@ void IDBCursorBackendImpl::continueFunctionInternal(ScriptExecutionContext*, Pas
 
 void IDBCursorBackendImpl::deleteFunction(PassRefPtr<IDBCallbacks> prpCallbacks, ExceptionCode& ec)
 {
+    IDB_TRACE("IDBCursorBackendImpl::delete");
     if (!m_cursor || m_cursorType == IndexKeyCursor) {
         ec = IDBDatabaseException::NOT_ALLOWED_ERR;
         return;
@@ -145,12 +154,14 @@ void IDBCursorBackendImpl::deleteFunction(PassRefPtr<IDBCallbacks> prpCallbacks,
 
 void IDBCursorBackendImpl::prefetchContinue(int numberToFetch, PassRefPtr<IDBCallbacks> prpCallbacks, ExceptionCode& ec)
 {
+    IDB_TRACE("IDBCursorBackendImpl::prefetchContinue");
     if (!m_transaction->scheduleTask(createCallbackTask(&IDBCursorBackendImpl::prefetchContinueInternal, this, numberToFetch, prpCallbacks)))
         ec = IDBDatabaseException::TRANSACTION_INACTIVE_ERR;
 }
 
 void IDBCursorBackendImpl::prefetchContinueInternal(ScriptExecutionContext*, PassRefPtr<IDBCursorBackendImpl> prpCursor, int numberToFetch, PassRefPtr<IDBCallbacks> callbacks)
 {
+    IDB_TRACE("IDBCursorBackendImpl::prefetchContinueInternal");
     RefPtr<IDBCursorBackendImpl> cursor = prpCursor;
 
     Vector<RefPtr<IDBKey> > foundKeys;
@@ -197,6 +208,7 @@ void IDBCursorBackendImpl::prefetchContinueInternal(ScriptExecutionContext*, Pas
 
 void IDBCursorBackendImpl::prefetchReset(int usedPrefetches, int unusedPrefetches)
 {
+    IDB_TRACE("IDBCursorBackendImpl::prefetchReset");
     m_transaction->addPendingEvents(-unusedPrefetches);
     m_cursor = m_savedCursor;
     m_savedCursor = 0;
@@ -213,6 +225,7 @@ void IDBCursorBackendImpl::prefetchReset(int usedPrefetches, int unusedPrefetche
 
 void IDBCursorBackendImpl::close()
 {
+    IDB_TRACE("IDBCursorBackendImpl::close");
     m_closed = true;
     if (m_cursor)
         m_cursor->close();
diff --git a/Source/WebCore/storage/IDBDatabase.cpp b/Source/WebCore/storage/IDBDatabase.cpp
index c4b73cec5..cc53a882a 100644
--- a/Source/WebCore/storage/IDBDatabase.cpp
+++ b/Source/WebCore/storage/IDBDatabase.cpp
@@ -26,6 +26,8 @@
 #include "config.h"
 #include "IDBDatabase.h"
 
+#if ENABLE(INDEXED_DATABASE)
+
 #include "EventQueue.h"
 #include "ExceptionCode.h"
 #include "EventQueue.h"
@@ -38,19 +40,20 @@
 #include "IDBIndex.h"
 #include "IDBKeyPath.h"
 #include "IDBObjectStore.h"
+#include "IDBTracing.h"
+#include "IDBTransaction.h"
 #include "IDBVersionChangeEvent.h"
 #include "IDBVersionChangeRequest.h"
-#include "IDBTransaction.h"
 #include "ScriptExecutionContext.h"
 #include <limits>
 
-#if ENABLE(INDEXED_DATABASE)
-
 namespace WebCore {
 
 PassRefPtr<IDBDatabase> IDBDatabase::create(ScriptExecutionContext* context, PassRefPtr<IDBDatabaseBackendInterface> database)
 {
-    return adoptRef(new IDBDatabase(context, database));
+    RefPtr<IDBDatabase> idbDatabase(adoptRef(new IDBDatabase(context, database)));
+    idbDatabase->suspendIfNeeded();
+    return idbDatabase.release();
 }
 
 IDBDatabase::IDBDatabase(ScriptExecutionContext* context, PassRefPtr<IDBDatabaseBackendInterface> backend)
@@ -219,6 +222,7 @@ void IDBDatabase::enqueueEvent(PassRefPtr<Event> event)
 
 bool IDBDatabase::dispatchEvent(PassRefPtr<Event> event)
 {
+    IDB_TRACE("IDBDatabase::dispatchEvent");
     ASSERT(event->type() == eventNames().versionchangeEvent);
     for (size_t i = 0; i < m_enqueuedEvents.size(); ++i) {
         if (m_enqueuedEvents[i].get() == event.get())
diff --git a/Source/WebCore/storage/IDBDatabase.idl b/Source/WebCore/storage/IDBDatabase.idl
index f0b1d0c28..9abb38d89 100644
--- a/Source/WebCore/storage/IDBDatabase.idl
+++ b/Source/WebCore/storage/IDBDatabase.idl
@@ -45,11 +45,11 @@ module storage {
             raises (IDBDatabaseException);
         [CallWith=ScriptExecutionContext] IDBVersionChangeRequest setVersion(in DOMString version)
             raises (IDBDatabaseException);
-        [CallWith=ScriptExecutionContext] IDBTransaction transaction(in DOMStringList storeNames, in [Optional=CallWithDefaultValue] unsigned short mode)
+        [CallWith=ScriptExecutionContext] IDBTransaction transaction(in DOMStringList storeNames, in [Optional=DefaultIsUndefined] unsigned short mode)
             raises (IDBDatabaseException);
-        [CallWith=ScriptExecutionContext] IDBTransaction transaction(in DOMString[] storeNames, in [Optional=CallWithDefaultValue] unsigned short mode)
+        [CallWith=ScriptExecutionContext] IDBTransaction transaction(in DOMString[] storeNames, in [Optional=DefaultIsUndefined] unsigned short mode)
             raises (IDBDatabaseException);
-        [CallWith=ScriptExecutionContext] IDBTransaction transaction(in DOMString storeName, in [Optional=CallWithDefaultValue] unsigned short mode)
+        [CallWith=ScriptExecutionContext] IDBTransaction transaction(in DOMString storeName, in [Optional=DefaultIsUndefined] unsigned short mode)
             raises (IDBDatabaseException);
         void close();
 
diff --git a/Source/WebCore/storage/IDBIndex.cpp b/Source/WebCore/storage/IDBIndex.cpp
index bf2d38af2..a7c8dd3bb 100644
--- a/Source/WebCore/storage/IDBIndex.cpp
+++ b/Source/WebCore/storage/IDBIndex.cpp
@@ -35,6 +35,7 @@
 #include "IDBKeyRange.h"
 #include "IDBObjectStore.h"
 #include "IDBRequest.h"
+#include "IDBTracing.h"
 #include "IDBTransaction.h"
 
 namespace WebCore {
@@ -57,6 +58,7 @@ IDBIndex::~IDBIndex()
 
 PassRefPtr<IDBRequest> IDBIndex::openCursor(ScriptExecutionContext* context, PassRefPtr<IDBKeyRange> keyRange, unsigned short direction, ExceptionCode& ec)
 {
+    IDB_TRACE("IDBIndex::openCursor");
     if (direction != IDBCursor::NEXT && direction != IDBCursor::NEXT_NO_DUPLICATE && direction != IDBCursor::PREV && direction != IDBCursor::PREV_NO_DUPLICATE) {
         // FIXME: May need to change when specced: http://www.w3.org/Bugs/Public/show_bug.cgi?id=11406
         ec = IDBDatabaseException::CONSTRAINT_ERR;
@@ -75,6 +77,7 @@ PassRefPtr<IDBRequest> IDBIndex::openCursor(ScriptExecutionContext* context, Pas
 
 PassRefPtr<IDBRequest> IDBIndex::count(ScriptExecutionContext* context, PassRefPtr<IDBKeyRange> keyRange, ExceptionCode& ec)
 {
+    IDB_TRACE("IDBIndex::count");
     RefPtr<IDBRequest> request = IDBRequest::create(context, IDBAny::create(this), m_transaction.get());
     m_backend->count(keyRange, request, m_transaction->backend(), ec);
     if (ec) {
@@ -86,6 +89,7 @@ PassRefPtr<IDBRequest> IDBIndex::count(ScriptExecutionContext* context, PassRefP
 
 PassRefPtr<IDBRequest> IDBIndex::openKeyCursor(ScriptExecutionContext* context, PassRefPtr<IDBKeyRange> keyRange, unsigned short direction, ExceptionCode& ec)
 {
+    IDB_TRACE("IDBIndex::openKeyCursor");
     if (direction != IDBCursor::NEXT && direction != IDBCursor::NEXT_NO_DUPLICATE && direction != IDBCursor::PREV && direction != IDBCursor::PREV_NO_DUPLICATE) {
         // FIXME: May need to change when specced: http://www.w3.org/Bugs/Public/show_bug.cgi?id=11406
         ec = IDBDatabaseException::CONSTRAINT_ERR;
@@ -104,6 +108,7 @@ PassRefPtr<IDBRequest> IDBIndex::openKeyCursor(ScriptExecutionContext* context,
 
 PassRefPtr<IDBRequest> IDBIndex::get(ScriptExecutionContext* context, PassRefPtr<IDBKey> key, ExceptionCode& ec)
 {
+    IDB_TRACE("IDBIndex::get");
     if (key && (key->type() == IDBKey::InvalidType)) {
         ec = IDBDatabaseException::DATA_ERR;
         return 0;
@@ -120,6 +125,7 @@ PassRefPtr<IDBRequest> IDBIndex::get(ScriptExecutionContext* context, PassRefPtr
 
 PassRefPtr<IDBRequest> IDBIndex::getKey(ScriptExecutionContext* context, PassRefPtr<IDBKey> key, ExceptionCode& ec)
 {
+    IDB_TRACE("IDBIndex::getKey");
     if (key && (key->type() == IDBKey::InvalidType)) {
         ec = IDBDatabaseException::DATA_ERR;
         return 0;
diff --git a/Source/WebCore/storage/IDBIndexBackendImpl.cpp b/Source/WebCore/storage/IDBIndexBackendImpl.cpp
index 85db158ae..cec43b98e 100644
--- a/Source/WebCore/storage/IDBIndexBackendImpl.cpp
+++ b/Source/WebCore/storage/IDBIndexBackendImpl.cpp
@@ -37,6 +37,7 @@
 #include "IDBKey.h"
 #include "IDBKeyRange.h"
 #include "IDBObjectStoreBackendImpl.h"
+#include "IDBTracing.h"
 
 namespace WebCore {
 
@@ -72,6 +73,7 @@ IDBIndexBackendImpl::~IDBIndexBackendImpl()
 
 void IDBIndexBackendImpl::openCursorInternal(ScriptExecutionContext*, PassRefPtr<IDBIndexBackendImpl> index, PassRefPtr<IDBKeyRange> range, unsigned short untypedDirection, IDBCursorBackendInterface::CursorType cursorType, PassRefPtr<IDBCallbacks> callbacks, PassRefPtr<IDBTransactionBackendInterface> transaction)
 {
+    IDB_TRACE("IDBIndexBackendImpl::openCursorInternal");
     IDBCursor::Direction direction = static_cast<IDBCursor::Direction>(untypedDirection);
 
     RefPtr<IDBBackingStore::Cursor> backingStoreCursor;
@@ -104,6 +106,7 @@ void IDBIndexBackendImpl::openCursorInternal(ScriptExecutionContext*, PassRefPtr
 
 void IDBIndexBackendImpl::openCursor(PassRefPtr<IDBKeyRange> prpKeyRange, unsigned short direction, PassRefPtr<IDBCallbacks> prpCallbacks, IDBTransactionBackendInterface* transactionPtr, ExceptionCode& ec)
 {
+    IDB_TRACE("IDBIndexBackendImpl::openCursor");
     RefPtr<IDBIndexBackendImpl> index = this;
     RefPtr<IDBKeyRange> keyRange = prpKeyRange;
     RefPtr<IDBCallbacks> callbacks = prpCallbacks;
@@ -114,6 +117,7 @@ void IDBIndexBackendImpl::openCursor(PassRefPtr<IDBKeyRange> prpKeyRange, unsign
 
 void IDBIndexBackendImpl::openKeyCursor(PassRefPtr<IDBKeyRange> prpKeyRange, unsigned short direction, PassRefPtr<IDBCallbacks> prpCallbacks, IDBTransactionBackendInterface* transactionPtr, ExceptionCode& ec)
 {
+    IDB_TRACE("IDBIndexBackendImpl::openKeyCursor");
     RefPtr<IDBIndexBackendImpl> index = this;
     RefPtr<IDBKeyRange> keyRange = prpKeyRange;
     RefPtr<IDBCallbacks> callbacks = prpCallbacks;
@@ -124,6 +128,7 @@ void IDBIndexBackendImpl::openKeyCursor(PassRefPtr<IDBKeyRange> prpKeyRange, uns
 
 void IDBIndexBackendImpl::countInternal(ScriptExecutionContext*, PassRefPtr<IDBIndexBackendImpl> index, PassRefPtr<IDBKeyRange> range, PassRefPtr<IDBCallbacks> callbacks, PassRefPtr<IDBTransactionBackendInterface> transaction)
 {
+    IDB_TRACE("IDBIndexBackendImpl::countInternal");
     uint32_t count = 0;
 
     RefPtr<IDBBackingStore::Cursor> backingStoreCursor = index->m_backingStore->openIndexKeyCursor(index->m_databaseId, index->m_objectStoreBackend->id(), index->id(), range.get(), IDBCursor::NEXT);
@@ -141,12 +146,14 @@ void IDBIndexBackendImpl::countInternal(ScriptExecutionContext*, PassRefPtr<IDBI
 
 void IDBIndexBackendImpl::count(PassRefPtr<IDBKeyRange> range, PassRefPtr<IDBCallbacks> callbacks, IDBTransactionBackendInterface* transaction, ExceptionCode& ec)
 {
+    IDB_TRACE("IDBIndexBackendImpl::count");
     if (!transaction->scheduleTask(createCallbackTask(&countInternal, this, range, callbacks, transaction)))
         ec = IDBDatabaseException::TRANSACTION_INACTIVE_ERR;
 }
 
 void IDBIndexBackendImpl::getInternal(ScriptExecutionContext*, PassRefPtr<IDBIndexBackendImpl> index, PassRefPtr<IDBKey> key, bool getObject, PassRefPtr<IDBCallbacks> callbacks)
 {
+    IDB_TRACE("IDBIndexBackendImpl::getInternal");
     // FIXME: Split getInternal into two functions, getting rid off |getObject|.
     if (getObject) {
         String value = index->m_backingStore->getObjectViaIndex(index->m_databaseId, index->m_objectStoreBackend->id(), index->id(), *key);
@@ -167,6 +174,7 @@ void IDBIndexBackendImpl::getInternal(ScriptExecutionContext*, PassRefPtr<IDBInd
 
 void IDBIndexBackendImpl::get(PassRefPtr<IDBKey> prpKey, PassRefPtr<IDBCallbacks> prpCallbacks, IDBTransactionBackendInterface* transaction, ExceptionCode& ec)
 {
+    IDB_TRACE("IDBIndexBackendImpl::get");
     RefPtr<IDBIndexBackendImpl> index = this;
     RefPtr<IDBKey> key = prpKey;
     RefPtr<IDBCallbacks> callbacks = prpCallbacks;
@@ -176,6 +184,7 @@ void IDBIndexBackendImpl::get(PassRefPtr<IDBKey> prpKey, PassRefPtr<IDBCallbacks
 
 void IDBIndexBackendImpl::getKey(PassRefPtr<IDBKey> prpKey, PassRefPtr<IDBCallbacks> prpCallbacks, IDBTransactionBackendInterface* transaction, ExceptionCode& ec)
 {
+    IDB_TRACE("IDBIndexBackendImpl::getKey");
     RefPtr<IDBIndexBackendImpl> index = this;
     RefPtr<IDBKey> key = prpKey;
     RefPtr<IDBCallbacks> callbacks = prpCallbacks;
diff --git a/Source/WebCore/storage/IDBKey.idl b/Source/WebCore/storage/IDBKey.idl
index a213d721a..1464d9f73 100644
--- a/Source/WebCore/storage/IDBKey.idl
+++ b/Source/WebCore/storage/IDBKey.idl
@@ -27,7 +27,7 @@ module storage {
 
     interface [
         Conditional=INDEXED_DATABASE,
-        JSCustomToJS
+        CustomToJSObject
     ] IDBKey {
         // This space is intentionally left blank.
     };
diff --git a/Source/WebCore/storage/IDBLevelDBBackingStore.cpp b/Source/WebCore/storage/IDBLevelDBBackingStore.cpp
index 528d1e912..f423bb007 100644
--- a/Source/WebCore/storage/IDBLevelDBBackingStore.cpp
+++ b/Source/WebCore/storage/IDBLevelDBBackingStore.cpp
@@ -968,7 +968,7 @@ public:
     virtual PassRefPtr<IDBKey> key() { return m_currentKey; }
     virtual PassRefPtr<IDBKey> primaryKey() { return m_currentKey; }
     virtual String value() = 0;
-    virtual PassRefPtr<IDBBackingStore::ObjectStoreRecordIdentifier> objectStoreRecordIdentifier() = 0; // FIXME: I don't think this is actually used, so drop it.
+    virtual PassRefPtr<IDBBackingStore::ObjectStoreRecordIdentifier> objectStoreRecordIdentifier() = 0;
     virtual int64_t indexDataId() = 0;
     virtual void close() { }
 
@@ -1117,7 +1117,10 @@ public:
 
     // CursorImplCommon
     virtual String value() { return m_currentValue; }
-    virtual PassRefPtr<IDBBackingStore::ObjectStoreRecordIdentifier> objectStoreRecordIdentifier() { ASSERT_NOT_REACHED(); return 0; }
+    virtual PassRefPtr<IDBBackingStore::ObjectStoreRecordIdentifier> objectStoreRecordIdentifier() OVERRIDE
+    {
+        return m_identifier;
+    }
     virtual int64_t indexDataId() { ASSERT_NOT_REACHED(); return 0; }
     virtual bool loadCurrentRow();
 
@@ -1134,6 +1137,7 @@ private:
     }
 
     String m_currentValue;
+    RefPtr<LevelDBRecordIdentifier> m_identifier;
 };
 
 bool ObjectStoreCursorImpl::loadCurrentRow()
@@ -1154,7 +1158,9 @@ bool ObjectStoreCursorImpl::loadCurrentRow()
     ASSERT(q);
     if (!q)
         return false;
-    (void) version;
+
+    // FIXME: This re-encodes what was just decoded; try and optimize.
+    m_identifier = LevelDBRecordIdentifier::create(encodeIDBKey(*m_currentKey), version);
 
     m_currentValue = decodeString(q, m_iterator->value().end());
 
diff --git a/Source/WebCore/storage/IDBObjectStore.cpp b/Source/WebCore/storage/IDBObjectStore.cpp
index e4c965b14..6d4ffab7d 100644
--- a/Source/WebCore/storage/IDBObjectStore.cpp
+++ b/Source/WebCore/storage/IDBObjectStore.cpp
@@ -35,6 +35,7 @@
 #include "IDBKey.h"
 #include "IDBKeyPath.h"
 #include "IDBKeyRange.h"
+#include "IDBTracing.h"
 #include "IDBTransaction.h"
 #include "SerializedScriptValue.h"
 #include <wtf/UnusedParam.h>
@@ -55,26 +56,31 @@ IDBObjectStore::IDBObjectStore(PassRefPtr<IDBObjectStoreBackendInterface> idbObj
 
 String IDBObjectStore::name() const
 {
+    IDB_TRACE("IDBObjectStore::name");
     return m_backend->name();
 }
 
 String IDBObjectStore::keyPath() const
 {
+    IDB_TRACE("IDBObjectStore::keyPath");
     return m_backend->keyPath();
 }
 
 PassRefPtr<DOMStringList> IDBObjectStore::indexNames() const
 {
+    IDB_TRACE("IDBObjectStore::indexNames");
     return m_backend->indexNames();
 }
 
 IDBTransaction* IDBObjectStore::transaction() const
 {
+    IDB_TRACE("IDBObjectStore::transaction");
     return m_transaction.get();
 }
 
 PassRefPtr<IDBRequest> IDBObjectStore::get(ScriptExecutionContext* context, PassRefPtr<IDBKey> key, ExceptionCode& ec)
 {
+    IDB_TRACE("IDBObjectStore::get");
     if (key && (key->type() == IDBKey::InvalidType)) {
         ec = IDBDatabaseException::DATA_ERR;
         return 0;
@@ -91,6 +97,7 @@ PassRefPtr<IDBRequest> IDBObjectStore::get(ScriptExecutionContext* context, Pass
 
 PassRefPtr<IDBRequest> IDBObjectStore::add(ScriptExecutionContext* context, PassRefPtr<SerializedScriptValue> value, PassRefPtr<IDBKey> key, ExceptionCode& ec)
 {
+    IDB_TRACE("IDBObjectStore::add");
     if (key && (key->type() == IDBKey::InvalidType)) {
         ec = IDBDatabaseException::DATA_ERR;
         return 0;
@@ -107,6 +114,7 @@ PassRefPtr<IDBRequest> IDBObjectStore::add(ScriptExecutionContext* context, Pass
 
 PassRefPtr<IDBRequest> IDBObjectStore::put(ScriptExecutionContext* context, PassRefPtr<SerializedScriptValue> value, PassRefPtr<IDBKey> key, ExceptionCode& ec)
 {
+    IDB_TRACE("IDBObjectStore::put");
     if (key && (key->type() == IDBKey::InvalidType)) {
         ec = IDBDatabaseException::DATA_ERR;
         return 0;
@@ -121,9 +129,26 @@ PassRefPtr<IDBRequest> IDBObjectStore::put(ScriptExecutionContext* context, Pass
     return request.release();
 }
 
+PassRefPtr<IDBRequest> IDBObjectStore::deleteFunction(ScriptExecutionContext* context, PassRefPtr<IDBKeyRange> keyRange, ExceptionCode& ec)
+{
+    if (!keyRange) {
+        ec = IDBDatabaseException::DATA_ERR;
+        return 0;
+    }
+
+    RefPtr<IDBRequest> request = IDBRequest::create(context, IDBAny::create(this), m_transaction.get());
+    m_backend->deleteFunction(keyRange, request, m_transaction->backend(), ec);
+    if (ec) {
+        request->markEarlyDeath();
+        return 0;
+    }
+    return request.release();
+}
+
 PassRefPtr<IDBRequest> IDBObjectStore::deleteFunction(ScriptExecutionContext* context, PassRefPtr<IDBKey> key, ExceptionCode& ec)
 {
-    if (key && (key->type() == IDBKey::InvalidType)) {
+    IDB_TRACE("IDBObjectStore::delete");
+    if (!key || !key->valid()) {
         ec = IDBDatabaseException::DATA_ERR;
         return 0;
     }
@@ -139,6 +164,7 @@ PassRefPtr<IDBRequest> IDBObjectStore::deleteFunction(ScriptExecutionContext* co
 
 PassRefPtr<IDBRequest> IDBObjectStore::clear(ScriptExecutionContext* context, ExceptionCode& ec)
 {
+    IDB_TRACE("IDBObjectStore::clear");
     RefPtr<IDBRequest> request = IDBRequest::create(context, IDBAny::create(this), m_transaction.get());
     m_backend->clear(request, m_transaction->backend(), ec);
     if (ec) {
@@ -150,6 +176,7 @@ PassRefPtr<IDBRequest> IDBObjectStore::clear(ScriptExecutionContext* context, Ex
 
 PassRefPtr<IDBIndex> IDBObjectStore::createIndex(const String& name, const String& keyPath, const OptionsObject& options, ExceptionCode& ec)
 {
+    IDB_TRACE("IDBObjectStore::createIndex");
     if (!IDBIsValidKeyPath(keyPath)) {
         ec = IDBDatabaseException::NON_TRANSIENT_ERR;
         return 0;
@@ -174,6 +201,7 @@ PassRefPtr<IDBIndex> IDBObjectStore::createIndex(const String& name, const Strin
 
 PassRefPtr<IDBIndex> IDBObjectStore::index(const String& name, ExceptionCode& ec)
 {
+    IDB_TRACE("IDBObjectStore::index");
     if (m_transaction->finished()) {
         ec = IDBDatabaseException::NOT_ALLOWED_ERR;
         return 0;
@@ -200,6 +228,7 @@ void IDBObjectStore::deleteIndex(const String& name, ExceptionCode& ec)
 
 PassRefPtr<IDBRequest> IDBObjectStore::openCursor(ScriptExecutionContext* context, PassRefPtr<IDBKeyRange> range, unsigned short direction, ExceptionCode& ec)
 {
+    IDB_TRACE("IDBObjectStore::openCursor");
     if (direction != IDBCursor::NEXT && direction != IDBCursor::NEXT_NO_DUPLICATE && direction != IDBCursor::PREV && direction != IDBCursor::PREV_NO_DUPLICATE) {
         // FIXME: May need to change when specced: http://www.w3.org/Bugs/Public/show_bug.cgi?id=11406
         ec = IDBDatabaseException::CONSTRAINT_ERR;
@@ -218,6 +247,7 @@ PassRefPtr<IDBRequest> IDBObjectStore::openCursor(ScriptExecutionContext* contex
 
 PassRefPtr<IDBRequest> IDBObjectStore::count(ScriptExecutionContext* context, PassRefPtr<IDBKeyRange> range, ExceptionCode& ec)
 {
+    IDB_TRACE("IDBObjectStore::count");
     RefPtr<IDBRequest> request = IDBRequest::create(context, IDBAny::create(this), m_transaction.get());
     m_backend->count(range, request, m_transaction->backend(), ec);
     if (ec) {
diff --git a/Source/WebCore/storage/IDBObjectStore.h b/Source/WebCore/storage/IDBObjectStore.h
index 2516663fa..60a9b1d3f 100644
--- a/Source/WebCore/storage/IDBObjectStore.h
+++ b/Source/WebCore/storage/IDBObjectStore.h
@@ -70,6 +70,7 @@ public:
     PassRefPtr<IDBRequest> get(ScriptExecutionContext*, PassRefPtr<IDBKey>, ExceptionCode&);
     PassRefPtr<IDBRequest> add(ScriptExecutionContext*, PassRefPtr<SerializedScriptValue>, PassRefPtr<IDBKey>, ExceptionCode&);
     PassRefPtr<IDBRequest> put(ScriptExecutionContext*, PassRefPtr<SerializedScriptValue>, PassRefPtr<IDBKey>, ExceptionCode&);
+    PassRefPtr<IDBRequest> deleteFunction(ScriptExecutionContext*, PassRefPtr<IDBKeyRange>, ExceptionCode&);
     PassRefPtr<IDBRequest> deleteFunction(ScriptExecutionContext*, PassRefPtr<IDBKey> key, ExceptionCode&);
     PassRefPtr<IDBRequest> clear(ScriptExecutionContext*, ExceptionCode&);
 
diff --git a/Source/WebCore/storage/IDBObjectStore.idl b/Source/WebCore/storage/IDBObjectStore.idl
index 0a91253b8..5bcaf8ec4 100644
--- a/Source/WebCore/storage/IDBObjectStore.idl
+++ b/Source/WebCore/storage/IDBObjectStore.idl
@@ -28,8 +28,8 @@ module storage {
     interface [
         Conditional=INDEXED_DATABASE
     ] IDBObjectStore {
-        readonly attribute [ConvertNullStringTo=Null] DOMString name;
-        readonly attribute [ConvertNullStringTo=Null] DOMString keyPath;
+        readonly attribute [TreatReturnedNullStringAs=Null] DOMString name;
+        readonly attribute [TreatReturnedNullStringAs=Null] DOMString keyPath;
         readonly attribute DOMStringList indexNames;
         readonly attribute IDBTransaction transaction;
 
@@ -37,6 +37,8 @@ module storage {
             raises (IDBDatabaseException);
         [CallWith=ScriptExecutionContext] IDBRequest add(in SerializedScriptValue value, in [Optional] IDBKey key)
             raises (IDBDatabaseException);
+        [CallWith=ScriptExecutionContext, ImplementedAs=deleteFunction] IDBRequest delete(in IDBKeyRange keyRange)
+            raises (IDBDatabaseException);
         [CallWith=ScriptExecutionContext, ImplementedAs=deleteFunction] IDBRequest delete(in IDBKey key)
             raises (IDBDatabaseException);
         [CallWith=ScriptExecutionContext] IDBRequest clear()
diff --git a/Source/WebCore/storage/IDBObjectStoreBackendImpl.cpp b/Source/WebCore/storage/IDBObjectStoreBackendImpl.cpp
index f07ea3eeb..b9ecce329 100644
--- a/Source/WebCore/storage/IDBObjectStoreBackendImpl.cpp
+++ b/Source/WebCore/storage/IDBObjectStoreBackendImpl.cpp
@@ -41,6 +41,7 @@
 #include "IDBKeyPath.h"
 #include "IDBKeyPathBackendImpl.h"
 #include "IDBKeyRange.h"
+#include "IDBTracing.h"
 #include "IDBTransactionBackendInterface.h"
 #include "ScriptExecutionContext.h"
 
@@ -83,6 +84,7 @@ PassRefPtr<DOMStringList> IDBObjectStoreBackendImpl::indexNames() const
 
 void IDBObjectStoreBackendImpl::get(PassRefPtr<IDBKey> prpKey, PassRefPtr<IDBCallbacks> prpCallbacks, IDBTransactionBackendInterface* transaction, ExceptionCode& ec)
 {
+    IDB_TRACE("IDBObjectStoreBackendImpl::get");
     RefPtr<IDBObjectStoreBackendImpl> objectStore = this;
     RefPtr<IDBKey> key = prpKey;
     RefPtr<IDBCallbacks> callbacks = prpCallbacks;
@@ -92,6 +94,7 @@ void IDBObjectStoreBackendImpl::get(PassRefPtr<IDBKey> prpKey, PassRefPtr<IDBCal
 
 void IDBObjectStoreBackendImpl::getInternal(ScriptExecutionContext*, PassRefPtr<IDBObjectStoreBackendImpl> objectStore, PassRefPtr<IDBKey> key, PassRefPtr<IDBCallbacks> callbacks)
 {
+    IDB_TRACE("IDBObjectStoreBackendImpl::getInternal");
     String wireData = objectStore->m_backingStore->getObjectStoreRecord(objectStore->m_databaseId, objectStore->id(), *key);
     if (wireData.isNull()) {
         callbacks->onSuccess(SerializedScriptValue::undefinedValue());
@@ -103,6 +106,7 @@ void IDBObjectStoreBackendImpl::getInternal(ScriptExecutionContext*, PassRefPtr<
 
 static PassRefPtr<IDBKey> fetchKeyFromKeyPath(SerializedScriptValue* value, const String& keyPath)
 {
+    IDB_TRACE("IDBObjectStoreBackendImpl::fetchKeyFromKeyPath");
     Vector<RefPtr<SerializedScriptValue> > values;
     values.append(value);
     Vector<RefPtr<IDBKey> > keys;
@@ -115,11 +119,13 @@ static PassRefPtr<IDBKey> fetchKeyFromKeyPath(SerializedScriptValue* value, cons
 
 static PassRefPtr<SerializedScriptValue> injectKeyIntoKeyPath(PassRefPtr<IDBKey> key, PassRefPtr<SerializedScriptValue> value, const String& keyPath)
 {
+    IDB_TRACE("IDBObjectStoreBackendImpl::injectKeyIntoKeyPath");
     return IDBKeyPathBackendImpl::injectIDBKeyIntoSerializedValue(key, value, keyPath);
 }
 
 void IDBObjectStoreBackendImpl::put(PassRefPtr<SerializedScriptValue> prpValue, PassRefPtr<IDBKey> prpKey, PutMode putMode, PassRefPtr<IDBCallbacks> prpCallbacks, IDBTransactionBackendInterface* transactionPtr, ExceptionCode& ec)
 {
+    IDB_TRACE("IDBObjectStoreBackendImpl::put");
     if (transactionPtr->mode() == IDBTransaction::READ_ONLY) {
         ec = IDBDatabaseException::READ_ONLY_ERR;
         return;
@@ -200,6 +206,7 @@ void IDBObjectStoreBackendImpl::revertAutoIncrementKeyCache(ScriptExecutionConte
 
 void IDBObjectStoreBackendImpl::putInternal(ScriptExecutionContext*, PassRefPtr<IDBObjectStoreBackendImpl> objectStore, PassRefPtr<SerializedScriptValue> prpValue, PassRefPtr<IDBKey> prpKey, PutMode putMode, PassRefPtr<IDBCallbacks> callbacks, PassRefPtr<IDBTransactionBackendInterface> transaction)
 {
+    IDB_TRACE("IDBObjectStoreBackendImpl::putInternal");
     RefPtr<SerializedScriptValue> value = prpValue;
     RefPtr<IDBKey> key = prpKey;
 
@@ -326,45 +333,68 @@ void IDBObjectStoreBackendImpl::putInternal(ScriptExecutionContext*, PassRefPtr<
 
 void IDBObjectStoreBackendImpl::deleteFunction(PassRefPtr<IDBKey> prpKey, PassRefPtr<IDBCallbacks> prpCallbacks, IDBTransactionBackendInterface* transaction, ExceptionCode& ec)
 {
+    IDB_TRACE("IDBObjectStoreBackendImpl::delete");
+    RefPtr<IDBKey> key = prpKey;
+    if (!key || !key->valid()) {
+        ec = IDBDatabaseException::DATA_ERR;
+        return;
+    }
+
+    RefPtr<IDBKeyRange> keyRange = IDBKeyRange::only(key, ec);
+    if (ec)
+        return;
+
+    deleteFunction(keyRange.release(), prpCallbacks, transaction, ec);
+}
+
+void IDBObjectStoreBackendImpl::deleteFunction(PassRefPtr<IDBKeyRange> prpKeyRange, PassRefPtr<IDBCallbacks> prpCallbacks, IDBTransactionBackendInterface* transaction, ExceptionCode& ec)
+{
+    IDB_TRACE("IDBObjectStoreBackendImpl::delete");
     if (transaction->mode() == IDBTransaction::READ_ONLY) {
         ec = IDBDatabaseException::READ_ONLY_ERR;
         return;
     }
 
     RefPtr<IDBObjectStoreBackendImpl> objectStore = this;
-    RefPtr<IDBKey> key = prpKey;
+    RefPtr<IDBKeyRange> keyRange = prpKeyRange;
     RefPtr<IDBCallbacks> callbacks = prpCallbacks;
-    if (!key || !key->valid()) {
-        ec = IDBDatabaseException::DATA_ERR;
-        return;
-    }
 
-    if (!transaction->scheduleTask(createCallbackTask(&IDBObjectStoreBackendImpl::deleteInternal, objectStore, key, callbacks)))
+    if (!transaction->scheduleTask(createCallbackTask(&IDBObjectStoreBackendImpl::deleteInternal, objectStore, keyRange, callbacks)))
         ec = IDBDatabaseException::TRANSACTION_INACTIVE_ERR;
 }
 
-void IDBObjectStoreBackendImpl::deleteInternal(ScriptExecutionContext*, PassRefPtr<IDBObjectStoreBackendImpl> objectStore, PassRefPtr<IDBKey> key, PassRefPtr<IDBCallbacks> callbacks)
+void IDBObjectStoreBackendImpl::deleteInternal(ScriptExecutionContext*, PassRefPtr<IDBObjectStoreBackendImpl> objectStore, PassRefPtr<IDBKeyRange> keyRange, PassRefPtr<IDBCallbacks> callbacks)
 {
-    RefPtr<IDBBackingStore::ObjectStoreRecordIdentifier> recordIdentifier = objectStore->m_backingStore->createInvalidRecordIdentifier();
-    if (!objectStore->m_backingStore->keyExistsInObjectStore(objectStore->m_databaseId, objectStore->id(), *key, recordIdentifier.get())) {
-        callbacks->onSuccess(SerializedScriptValue::booleanValue(false));
-        return;
-    }
+    IDB_TRACE("IDBObjectStoreBackendImpl::deleteInternal");
+    RefPtr<IDBBackingStore::ObjectStoreRecordIdentifier> recordIdentifier;
 
-    for (IndexMap::iterator it = objectStore->m_indexes.begin(); it != objectStore->m_indexes.end(); ++it) {
-        if (!it->second->hasValidId())
-            continue; // The index object has been created, but does not exist in the database yet.
+    RefPtr<IDBBackingStore::Cursor> backingStoreCursor = objectStore->m_backingStore->openObjectStoreCursor(objectStore->m_databaseId, objectStore->id(), keyRange.get(), IDBCursor::NEXT);
+    if (backingStoreCursor) {
 
-        if (!objectStore->m_backingStore->deleteIndexDataForRecord(objectStore->m_databaseId, objectStore->id(), it->second->id(), recordIdentifier.get()))
-            ASSERT_NOT_REACHED();
+        do {
+            recordIdentifier = backingStoreCursor->objectStoreRecordIdentifier();
+
+            for (IndexMap::iterator it = objectStore->m_indexes.begin(); it != objectStore->m_indexes.end(); ++it) {
+                if (!it->second->hasValidId())
+                    continue; // The index object has been created, but does not exist in the database yet.
+
+                bool success = objectStore->m_backingStore->deleteIndexDataForRecord(objectStore->m_databaseId, objectStore->id(), it->second->id(), recordIdentifier.get());
+                ASSERT_UNUSED(success, success);
+            }
+
+            objectStore->m_backingStore->deleteObjectStoreRecord(objectStore->m_databaseId, objectStore->id(), recordIdentifier.get());
+
+        } while (backingStoreCursor->continueFunction(0));
+
+        backingStoreCursor->close();
     }
 
-    objectStore->m_backingStore->deleteObjectStoreRecord(objectStore->m_databaseId, objectStore->id(), recordIdentifier.get());
-    callbacks->onSuccess(SerializedScriptValue::booleanValue(true));
+    callbacks->onSuccess(SerializedScriptValue::undefinedValue());
 }
 
 void IDBObjectStoreBackendImpl::clear(PassRefPtr<IDBCallbacks> prpCallbacks, IDBTransactionBackendInterface* transaction, ExceptionCode& ec)
 {
+    IDB_TRACE("IDBObjectStoreBackendImpl::clear");
     if (transaction->mode() == IDBTransaction::READ_ONLY) {
         ec = IDBDatabaseException::READ_ONLY_ERR;
         return;
@@ -531,6 +561,7 @@ void IDBObjectStoreBackendImpl::deleteIndexInternal(ScriptExecutionContext*, Pas
 
 void IDBObjectStoreBackendImpl::openCursor(PassRefPtr<IDBKeyRange> prpRange, unsigned short direction, PassRefPtr<IDBCallbacks> prpCallbacks, IDBTransactionBackendInterface* transaction, ExceptionCode& ec)
 {
+    IDB_TRACE("IDBObjectStoreBackendImpl::openCursor");
     RefPtr<IDBObjectStoreBackendImpl> objectStore = this;
     RefPtr<IDBKeyRange> range = prpRange;
     RefPtr<IDBCallbacks> callbacks = prpCallbacks;
@@ -544,6 +575,7 @@ void IDBObjectStoreBackendImpl::openCursor(PassRefPtr<IDBKeyRange> prpRange, uns
 
 void IDBObjectStoreBackendImpl::openCursorInternal(ScriptExecutionContext*, PassRefPtr<IDBObjectStoreBackendImpl> objectStore, PassRefPtr<IDBKeyRange> range, unsigned short tmpDirection, PassRefPtr<IDBCallbacks> callbacks, PassRefPtr<IDBTransactionBackendInterface> transaction)
 {
+    IDB_TRACE("IDBObjectStoreBackendImpl::openCursorInternal");
     IDBCursor::Direction direction = static_cast<IDBCursor::Direction>(tmpDirection);
 
     RefPtr<IDBBackingStore::Cursor> backingStoreCursor = objectStore->m_backingStore->openObjectStoreCursor(objectStore->m_databaseId, objectStore->id(), range.get(), direction);
@@ -558,12 +590,14 @@ void IDBObjectStoreBackendImpl::openCursorInternal(ScriptExecutionContext*, Pass
 
 void IDBObjectStoreBackendImpl::count(PassRefPtr<IDBKeyRange> range, PassRefPtr<IDBCallbacks> callbacks, IDBTransactionBackendInterface* transaction, ExceptionCode& ec)
 {
+    IDB_TRACE("IDBObjectStoreBackendImpl::count");
     if (!transaction->scheduleTask(createCallbackTask(&IDBObjectStoreBackendImpl::countInternal, this, range, callbacks, transaction)))
         ec = IDBDatabaseException::TRANSACTION_INACTIVE_ERR;
 }
 
 void IDBObjectStoreBackendImpl::countInternal(ScriptExecutionContext*, PassRefPtr<IDBObjectStoreBackendImpl> objectStore, PassRefPtr<IDBKeyRange> range, PassRefPtr<IDBCallbacks> callbacks, PassRefPtr<IDBTransactionBackendInterface> transaction)
 {
+    IDB_TRACE("IDBObjectStoreBackendImpl::countInternal");
     uint32_t count = 0;
     RefPtr<IDBBackingStore::Cursor> backingStoreCursor = objectStore->m_backingStore->openObjectStoreCursor(objectStore->m_databaseId, objectStore->id(), range.get(), IDBCursor::NEXT);
     if (!backingStoreCursor) {
diff --git a/Source/WebCore/storage/IDBObjectStoreBackendImpl.h b/Source/WebCore/storage/IDBObjectStoreBackendImpl.h
index bdbf1f16a..cdf360cdf 100644
--- a/Source/WebCore/storage/IDBObjectStoreBackendImpl.h
+++ b/Source/WebCore/storage/IDBObjectStoreBackendImpl.h
@@ -68,7 +68,8 @@ public:
 
     virtual void get(PassRefPtr<IDBKey> key, PassRefPtr<IDBCallbacks>, IDBTransactionBackendInterface*, ExceptionCode&);
     virtual void put(PassRefPtr<SerializedScriptValue>, PassRefPtr<IDBKey>, PutMode, PassRefPtr<IDBCallbacks>, IDBTransactionBackendInterface*, ExceptionCode&);
-    virtual void deleteFunction(PassRefPtr<IDBKey> key, PassRefPtr<IDBCallbacks>, IDBTransactionBackendInterface*, ExceptionCode&);
+    virtual void deleteFunction(PassRefPtr<IDBKey>, PassRefPtr<IDBCallbacks>, IDBTransactionBackendInterface*, ExceptionCode&);
+    virtual void deleteFunction(PassRefPtr<IDBKeyRange>, PassRefPtr<IDBCallbacks>, IDBTransactionBackendInterface*, ExceptionCode&);
     virtual void clear(PassRefPtr<IDBCallbacks>, IDBTransactionBackendInterface*, ExceptionCode&);
 
     virtual PassRefPtr<IDBIndexBackendInterface> createIndex(const String& name, const String& keyPath, bool unique, bool multiEntry, IDBTransactionBackendInterface*, ExceptionCode&);
@@ -90,7 +91,7 @@ private:
 
     static void getInternal(ScriptExecutionContext*, PassRefPtr<IDBObjectStoreBackendImpl>, PassRefPtr<IDBKey> key, PassRefPtr<IDBCallbacks>);
     static void putInternal(ScriptExecutionContext*, PassRefPtr<IDBObjectStoreBackendImpl>, PassRefPtr<SerializedScriptValue>, PassRefPtr<IDBKey>, PutMode, PassRefPtr<IDBCallbacks>, PassRefPtr<IDBTransactionBackendInterface>);
-    static void deleteInternal(ScriptExecutionContext*, PassRefPtr<IDBObjectStoreBackendImpl>, PassRefPtr<IDBKey> key, PassRefPtr<IDBCallbacks>);
+    static void deleteInternal(ScriptExecutionContext*, PassRefPtr<IDBObjectStoreBackendImpl>, PassRefPtr<IDBKeyRange>, PassRefPtr<IDBCallbacks>);
     static void clearInternal(ScriptExecutionContext*, PassRefPtr<IDBObjectStoreBackendImpl>, PassRefPtr<IDBCallbacks>);
     static void createIndexInternal(ScriptExecutionContext*, PassRefPtr<IDBObjectStoreBackendImpl>, PassRefPtr<IDBIndexBackendImpl>, PassRefPtr<IDBTransactionBackendInterface>);
     static void deleteIndexInternal(ScriptExecutionContext*, PassRefPtr<IDBObjectStoreBackendImpl>, PassRefPtr<IDBIndexBackendImpl>, PassRefPtr<IDBTransactionBackendInterface>);
diff --git a/Source/WebCore/storage/IDBObjectStoreBackendInterface.h b/Source/WebCore/storage/IDBObjectStoreBackendInterface.h
index 1d7125e64..5e6bf49c5 100644
--- a/Source/WebCore/storage/IDBObjectStoreBackendInterface.h
+++ b/Source/WebCore/storage/IDBObjectStoreBackendInterface.h
@@ -60,6 +60,7 @@ public:
     };
     virtual void put(PassRefPtr<SerializedScriptValue>, PassRefPtr<IDBKey>, PutMode, PassRefPtr<IDBCallbacks>, IDBTransactionBackendInterface*, ExceptionCode&) = 0;
     virtual void deleteFunction(PassRefPtr<IDBKey>, PassRefPtr<IDBCallbacks>, IDBTransactionBackendInterface*, ExceptionCode&) = 0;
+    virtual void deleteFunction(PassRefPtr<IDBKeyRange>, PassRefPtr<IDBCallbacks>, IDBTransactionBackendInterface*, ExceptionCode&) = 0;
 
     virtual void clear(PassRefPtr<IDBCallbacks>, IDBTransactionBackendInterface*, ExceptionCode&) = 0;
 
diff --git a/Source/WebCore/storage/IDBRequest.cpp b/Source/WebCore/storage/IDBRequest.cpp
index 968fb50ce..a04c0c668 100644
--- a/Source/WebCore/storage/IDBRequest.cpp
+++ b/Source/WebCore/storage/IDBRequest.cpp
@@ -39,13 +39,16 @@
 #include "IDBDatabase.h"
 #include "IDBEventDispatcher.h"
 #include "IDBPendingTransactionMonitor.h"
+#include "IDBTracing.h"
 #include "IDBTransaction.h"
 
 namespace WebCore {
 
 PassRefPtr<IDBRequest> IDBRequest::create(ScriptExecutionContext* context, PassRefPtr<IDBAny> source, IDBTransaction* transaction)
 {
-    return adoptRef(new IDBRequest(context, source, transaction));
+    RefPtr<IDBRequest> request(adoptRef(new IDBRequest(context, source, transaction)));
+    request->suspendIfNeeded();
+    return request.release();
 }
 
 IDBRequest::IDBRequest(ScriptExecutionContext* context, PassRefPtr<IDBAny> source, IDBTransaction* transaction)
@@ -195,6 +198,7 @@ static PassRefPtr<Event> createSuccessEvent()
 
 void IDBRequest::onSuccess(PassRefPtr<DOMStringList> domStringList)
 {
+    IDB_TRACE("IDBRequest::onSuccess(DOMStringList)");
     ASSERT(!m_errorCode && m_errorMessage.isNull() && !m_result);
     m_result = IDBAny::create(domStringList);
     enqueueEvent(createSuccessEvent());
@@ -202,6 +206,7 @@ void IDBRequest::onSuccess(PassRefPtr<DOMStringList> domStringList)
 
 void IDBRequest::onSuccess(PassRefPtr<IDBCursorBackendInterface> backend)
 {
+    IDB_TRACE("IDBRequest::onSuccess(IDBCursor)");
     ASSERT(!m_errorCode && m_errorMessage.isNull() && !m_result);
     ASSERT(m_cursorType != IDBCursorBackendInterface::InvalidCursorType);
     RefPtr<IDBCursor> cursor;
@@ -217,6 +222,7 @@ void IDBRequest::onSuccess(PassRefPtr<IDBCursorBackendInterface> backend)
 
 void IDBRequest::onSuccess(PassRefPtr<IDBDatabaseBackendInterface> backend)
 {
+    IDB_TRACE("IDBRequest::onSuccess(IDBDatabase)");
     ASSERT(!m_errorCode && m_errorMessage.isNull() && !m_result);
     if (m_contextStopped || !scriptExecutionContext())
         return;
@@ -230,6 +236,7 @@ void IDBRequest::onSuccess(PassRefPtr<IDBDatabaseBackendInterface> backend)
 
 void IDBRequest::onSuccess(PassRefPtr<IDBKey> idbKey)
 {
+    IDB_TRACE("IDBRequest::onSuccess(IDBKey)");
     ASSERT(!m_errorCode && m_errorMessage.isNull() && !m_result);
     if (idbKey && idbKey->valid())
         m_result = IDBAny::create(idbKey);
@@ -240,6 +247,7 @@ void IDBRequest::onSuccess(PassRefPtr<IDBKey> idbKey)
 
 void IDBRequest::onSuccess(PassRefPtr<IDBTransactionBackendInterface> prpBackend)
 {
+    IDB_TRACE("IDBRequest::onSuccess(IDBTransaction)");
     ASSERT(!m_errorCode && m_errorMessage.isNull() && !m_result);
     RefPtr<IDBTransactionBackendInterface> backend = prpBackend;
 
@@ -264,6 +272,7 @@ void IDBRequest::onSuccess(PassRefPtr<IDBTransactionBackendInterface> prpBackend
 
 void IDBRequest::onSuccess(PassRefPtr<SerializedScriptValue> serializedScriptValue)
 {
+    IDB_TRACE("IDBRequest::onSuccess(SerializedScriptValue)");
     ASSERT(!m_errorCode && m_errorMessage.isNull() && !m_result);
     m_result = IDBAny::create(serializedScriptValue);
     m_cursor.clear();
@@ -272,6 +281,7 @@ void IDBRequest::onSuccess(PassRefPtr<SerializedScriptValue> serializedScriptVal
 
 void IDBRequest::onSuccessWithContinuation()
 {
+    IDB_TRACE("IDBRequest::onSuccessWithContinuation");
     ASSERT(!m_errorCode && m_errorMessage.isNull() && !m_result);
     ASSERT(m_cursor);
     setResultCursor(m_cursor, m_cursorType);
@@ -315,6 +325,7 @@ ScriptExecutionContext* IDBRequest::scriptExecutionContext() const
 
 bool IDBRequest::dispatchEvent(PassRefPtr<Event> event)
 {
+    IDB_TRACE("IDBRequest::dispatchEvent");
     ASSERT(!m_requestFinished);
     ASSERT(!m_contextStopped);
     ASSERT(m_enqueuedEvents.size());
diff --git a/Source/WebCore/storage/IDBRequest.idl b/Source/WebCore/storage/IDBRequest.idl
index 29f94cd16..8c3e38529 100644
--- a/Source/WebCore/storage/IDBRequest.idl
+++ b/Source/WebCore/storage/IDBRequest.idl
@@ -38,7 +38,7 @@ module storage {
             getter raises (IDBDatabaseException);
         readonly attribute unsigned short errorCode
             getter raises (IDBDatabaseException);
-        readonly attribute [ConvertNullStringTo=Undefined] DOMString webkitErrorMessage
+        readonly attribute [TreatReturnedNullStringAs=Undefined] DOMString webkitErrorMessage
             getter raises (IDBDatabaseException);
         readonly attribute IDBAny source;
         readonly attribute IDBTransaction transaction;
diff --git a/Source/WebCore/storage/IDBTracing.h b/Source/WebCore/storage/IDBTracing.h
new file mode 100644
index 000000000..e1b3ef60f
--- /dev/null
+++ b/Source/WebCore/storage/IDBTracing.h
@@ -0,0 +1,47 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY GOOGLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef IDBTracing_h
+#define IDBTracing_h
+
+#if ENABLE(INDEXED_DATABASE)
+
+#if PLATFORM(CHROMIUM)
+
+#include "TraceEvent.h"
+#define IDB_TRACE(a) TRACE_EVENT0("IndexedDB", (a));
+
+#else
+
+#define IDB_TRACE(a) ((void)0)
+
+#endif //  PLATFORM(CHROMIUM)
+
+#endif // ENABLE(INDEXED_DATABASE)
+
+#endif // IDBTracing_h
diff --git a/Source/WebCore/storage/IDBTransaction.cpp b/Source/WebCore/storage/IDBTransaction.cpp
index 140df05aa..ccdfb2b9e 100644
--- a/Source/WebCore/storage/IDBTransaction.cpp
+++ b/Source/WebCore/storage/IDBTransaction.cpp
@@ -37,12 +37,15 @@
 #include "IDBObjectStore.h"
 #include "IDBObjectStoreBackendInterface.h"
 #include "IDBPendingTransactionMonitor.h"
+#include "IDBTracing.h"
 
 namespace WebCore {
 
 PassRefPtr<IDBTransaction> IDBTransaction::create(ScriptExecutionContext* context, PassRefPtr<IDBTransactionBackendInterface> backend, IDBDatabase* db)
 {
-    return adoptRef(new IDBTransaction(context, backend, db));
+    RefPtr<IDBTransaction> transaction(adoptRef(new IDBTransaction(context, backend, db)));
+    transaction->suspendIfNeeded();
+    return transaction.release();
 }
 
 IDBTransaction::IDBTransaction(ScriptExecutionContext* context, PassRefPtr<IDBTransactionBackendInterface> backend, IDBDatabase* db)
@@ -184,6 +187,7 @@ ScriptExecutionContext* IDBTransaction::scriptExecutionContext() const
 
 bool IDBTransaction::dispatchEvent(PassRefPtr<Event> event)
 {
+    IDB_TRACE("IDBTransaction::dispatchEvent");
     ASSERT(!m_transactionFinished);
     ASSERT(scriptExecutionContext());
     ASSERT(event->target() == this);
diff --git a/Source/WebCore/storage/IDBTransactionBackendImpl.cpp b/Source/WebCore/storage/IDBTransactionBackendImpl.cpp
index 24fa1c605..012e6b6dd 100644
--- a/Source/WebCore/storage/IDBTransactionBackendImpl.cpp
+++ b/Source/WebCore/storage/IDBTransactionBackendImpl.cpp
@@ -32,6 +32,7 @@
 #include "IDBCursorBackendImpl.h"
 #include "IDBDatabaseBackendImpl.h"
 #include "IDBDatabaseException.h"
+#include "IDBTracing.h"
 #include "IDBTransactionCoordinator.h"
 
 namespace WebCore {
@@ -104,6 +105,7 @@ bool IDBTransactionBackendImpl::scheduleTask(PassOwnPtr<ScriptExecutionContext::
 
 void IDBTransactionBackendImpl::abort()
 {
+    IDB_TRACE("IDBTransactionBackendImpl::abort");
     if (m_state == Finished)
         return;
 
@@ -185,6 +187,7 @@ void IDBTransactionBackendImpl::start()
 
 void IDBTransactionBackendImpl::commit()
 {
+    IDB_TRACE("IDBTransactionBackendImpl::commit");
     // The last reference to this object may be released while performing the
     // commit steps below. We therefore take a self reference to keep ourselves
     // alive while executing this method.
@@ -203,6 +206,7 @@ void IDBTransactionBackendImpl::commit()
 
 void IDBTransactionBackendImpl::taskTimerFired(Timer<IDBTransactionBackendImpl>*)
 {
+    IDB_TRACE("IDBTransactionBackendImpl::taskTimerFired");
     ASSERT(!m_taskQueue.isEmpty());
 
     if (m_state == StartPending) {
@@ -223,6 +227,7 @@ void IDBTransactionBackendImpl::taskTimerFired(Timer<IDBTransactionBackendImpl>*
 
 void IDBTransactionBackendImpl::taskEventTimerFired(Timer<IDBTransactionBackendImpl>*)
 {
+    IDB_TRACE("IDBTransactionBackendImpl::taskEventTimerFired");
     ASSERT(m_state == Running);
 
     if (!m_pendingEvents && m_taskQueue.isEmpty()) {
diff --git a/Source/WebCore/storage/IDBVersionChangeRequest.cpp b/Source/WebCore/storage/IDBVersionChangeRequest.cpp
index 081d24ce1..f13ca9d3c 100644
--- a/Source/WebCore/storage/IDBVersionChangeRequest.cpp
+++ b/Source/WebCore/storage/IDBVersionChangeRequest.cpp
@@ -35,7 +35,10 @@ namespace WebCore {
 
 PassRefPtr<IDBVersionChangeRequest> IDBVersionChangeRequest::create(ScriptExecutionContext* context, PassRefPtr<IDBAny> source, const String& version)
 {
-    return adoptRef(new IDBVersionChangeRequest(context, source, version));
+    RefPtr<IDBVersionChangeRequest> request(adoptRef(new IDBVersionChangeRequest(context, source, version)));
+    request->suspendIfNeeded();
+    return request.release();
+
 }
 
 IDBVersionChangeRequest::IDBVersionChangeRequest(ScriptExecutionContext* context, PassRefPtr<IDBAny> source, const String& version)
diff --git a/Source/WebCore/storage/IDBVersionChangeRequest.idl b/Source/WebCore/storage/IDBVersionChangeRequest.idl
index ffac73547..2aa238a8b 100644
--- a/Source/WebCore/storage/IDBVersionChangeRequest.idl
+++ b/Source/WebCore/storage/IDBVersionChangeRequest.idl
@@ -27,6 +27,7 @@ module storage {
 
     interface [
         Conditional=INDEXED_DATABASE,
+        ActiveDOMObject,
         EventTarget
     ] IDBVersionChangeRequest : IDBRequest {
         attribute EventListener onblocked;
diff --git a/Source/WebCore/storage/LocalStorageTask.h b/Source/WebCore/storage/LocalStorageTask.h
deleted file mode 100644
index 3e8b6b17d..000000000
--- a/Source/WebCore/storage/LocalStorageTask.h
+++ /dev/null
@@ -1,73 +0,0 @@
-/*
- * Copyright (C) 2008 Apple Inc. All Rights Reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#ifndef LocalStorageTask_h
-#define LocalStorageTask_h
-
-#include "PlatformString.h"
-#include <wtf/PassOwnPtr.h>
-#include <wtf/Threading.h>
-
-namespace WebCore {
-
-    class StorageAreaSync;
-    class LocalStorageThread;
-
-    // FIXME: Rename this class to StorageTask
-    class LocalStorageTask {
-        WTF_MAKE_NONCOPYABLE(LocalStorageTask); WTF_MAKE_FAST_ALLOCATED;
-    public:
-        enum Type { AreaImport, AreaSync, DeleteEmptyDatabase, SetOriginDetails, ImportOrigins, DeleteAllOrigins, DeleteOrigin, TerminateThread };
-
-        ~LocalStorageTask();
-
-        static PassOwnPtr<LocalStorageTask> createImport(StorageAreaSync* area) { return adoptPtr(new LocalStorageTask(AreaImport, area)); }
-        static PassOwnPtr<LocalStorageTask> createSync(StorageAreaSync* area) { return adoptPtr(new LocalStorageTask(AreaSync, area)); }
-        static PassOwnPtr<LocalStorageTask> createDeleteEmptyDatabase(StorageAreaSync* area) { return adoptPtr(new LocalStorageTask(DeleteEmptyDatabase, area)); }
-        static PassOwnPtr<LocalStorageTask> createOriginIdentifiersImport() { return adoptPtr(new LocalStorageTask(ImportOrigins)); }
-        static PassOwnPtr<LocalStorageTask> createSetOriginDetails(const String& originIdentifier, const String& databaseFilename) { return adoptPtr(new LocalStorageTask(SetOriginDetails, originIdentifier, databaseFilename)); }
-        static PassOwnPtr<LocalStorageTask> createDeleteOrigin(const String& originIdentifier) { return adoptPtr(new LocalStorageTask(DeleteOrigin, originIdentifier)); }
-        static PassOwnPtr<LocalStorageTask> createDeleteAllOrigins() { return adoptPtr(new LocalStorageTask(DeleteAllOrigins)); }
-        static PassOwnPtr<LocalStorageTask> createTerminate(LocalStorageThread* thread) { return adoptPtr(new LocalStorageTask(TerminateThread, thread)); }
-
-        void performTask();
-
-    private:
-        LocalStorageTask(Type, StorageAreaSync*);
-        LocalStorageTask(Type, LocalStorageThread*);
-        LocalStorageTask(Type, const String& originIdentifier);
-        LocalStorageTask(Type, const String& originIdentifier, const String& databaseFilename);
-        LocalStorageTask(Type);
-
-        Type m_type;
-        StorageAreaSync* m_area;
-        LocalStorageThread* m_thread;
-        String m_originIdentifier;
-        String m_databaseFilename;
-    };
-
-} // namespace WebCore
-
-#endif // LocalStorageTask_h
diff --git a/Source/WebCore/storage/SQLCallbackWrapper.h b/Source/WebCore/storage/SQLCallbackWrapper.h
index 34c708563..3cb0e2dbc 100644
--- a/Source/WebCore/storage/SQLCallbackWrapper.h
+++ b/Source/WebCore/storage/SQLCallbackWrapper.h
@@ -30,7 +30,6 @@
 
 #if ENABLE(SQL_DATABASE)
 
-#include "CrossThreadTask.h"
 #include "ScriptExecutionContext.h"
 #include <wtf/ThreadingPrimitives.h>
 
@@ -74,7 +73,7 @@ public:
             context = m_scriptExecutionContext.release().leakRef();
             callback = m_callback.release().leakRef();
         }
-        context->postTask(createCallbackTask(&safeRelease, AllowAccessLater(callback)));
+        context->postTask(SafeReleaseTask::create(callback));
     }
 
     PassRefPtr<T> unwrap()
@@ -89,12 +88,30 @@ public:
     bool hasCallback() const { return m_callback; }
 
 private:
-    static void safeRelease(ScriptExecutionContext* context, T* callback)
-    {
-        ASSERT(callback && context && context->isContextThread());
-        callback->deref();
-        context->deref();
-    }
+    class SafeReleaseTask : public ScriptExecutionContext::Task {
+    public:
+        static PassOwnPtr<SafeReleaseTask> create(T* callbackToRelease)
+        {
+            return adoptPtr(new SafeReleaseTask(callbackToRelease));
+        }
+
+        virtual void performTask(ScriptExecutionContext* context)
+        {
+            ASSERT(m_callbackToRelease && context && context->isContextThread());
+            m_callbackToRelease->deref();
+            context->deref();
+        }
+
+        virtual bool isCleanupTask() const { return true; }
+
+    private:
+        SafeReleaseTask(T* callbackToRelease)
+            : m_callbackToRelease(callbackToRelease)
+        {
+        }
+
+        T* m_callbackToRelease;
+    };
 
     Mutex m_mutex;
     RefPtr<T> m_callback;
diff --git a/Source/WebCore/storage/Storage.idl b/Source/WebCore/storage/Storage.idl
index e656d52fd..1d5b327cb 100644
--- a/Source/WebCore/storage/Storage.idl
+++ b/Source/WebCore/storage/Storage.idl
@@ -29,12 +29,12 @@ module storage {
         NamedGetter,
         JSGenerateIsReachable=ImplFrame,
         CustomDeleteProperty,
-        CustomGetPropertyNames,
+        CustomEnumerateProperty,
         CustomNamedSetter,
     ] Storage {
         readonly attribute [NotEnumerable] unsigned long length;
-        [NotEnumerable, ConvertNullStringTo=Null] DOMString key(in unsigned long index);
-        [NotEnumerable, ConvertNullStringTo=Null] DOMString getItem(in DOMString key);
+        [NotEnumerable, TreatReturnedNullStringAs=Null] DOMString key(in unsigned long index);
+        [NotEnumerable, TreatReturnedNullStringAs=Null] DOMString getItem(in DOMString key);
         [NotEnumerable] void setItem(in DOMString key, in DOMString data) 
             raises(DOMException);
         [NotEnumerable] void removeItem(in DOMString key);
diff --git a/Source/WebCore/storage/StorageEvent.idl b/Source/WebCore/storage/StorageEvent.idl
index 6414fcf11..6e4770a76 100644
--- a/Source/WebCore/storage/StorageEvent.idl
+++ b/Source/WebCore/storage/StorageEvent.idl
@@ -29,19 +29,19 @@ module storage {
         ConstructorTemplate=Event
     ] StorageEvent : Event {
         readonly attribute [InitializedByEventConstructor] DOMString key;
-        readonly attribute [InitializedByEventConstructor, ConvertNullStringTo=Null] DOMString oldValue;
-        readonly attribute [InitializedByEventConstructor, ConvertNullStringTo=Null] DOMString newValue;
+        readonly attribute [InitializedByEventConstructor, TreatReturnedNullStringAs=Null] DOMString oldValue;
+        readonly attribute [InitializedByEventConstructor, TreatReturnedNullStringAs=Null] DOMString newValue;
         readonly attribute [InitializedByEventConstructor] DOMString url;
         readonly attribute [InitializedByEventConstructor] Storage storageArea;
 
-        void initStorageEvent(in [Optional=CallWithDefaultValue] DOMString typeArg, 
-                              in [Optional=CallWithDefaultValue] boolean canBubbleArg, 
-                              in [Optional=CallWithDefaultValue] boolean cancelableArg, 
-                              in [Optional=CallWithDefaultValue] DOMString keyArg, 
-                              in [Optional=CallWithDefaultValue,TreatNullAs=NullString] DOMString oldValueArg, 
-                              in [Optional=CallWithDefaultValue,TreatNullAs=NullString] DOMString newValueArg, 
-                              in [Optional=CallWithDefaultValue] DOMString urlArg, 
-                              in [Optional=CallWithDefaultValue] Storage storageAreaArg);
+        void initStorageEvent(in [Optional=DefaultIsUndefined] DOMString typeArg, 
+                              in [Optional=DefaultIsUndefined] boolean canBubbleArg, 
+                              in [Optional=DefaultIsUndefined] boolean cancelableArg, 
+                              in [Optional=DefaultIsUndefined] DOMString keyArg, 
+                              in [Optional=DefaultIsUndefined,TreatNullAs=NullString] DOMString oldValueArg, 
+                              in [Optional=DefaultIsUndefined,TreatNullAs=NullString] DOMString newValueArg, 
+                              in [Optional=DefaultIsUndefined] DOMString urlArg, 
+                              in [Optional=DefaultIsUndefined] Storage storageAreaArg);
 
         // Needed once we support init<blank>EventNS
         // void initStorageEventNS(in DOMString namespaceURI, in DOMString typeArg, in boolean canBubbleArg, in boolean cancelableArg, in DOMString keyArg, in DOMString oldValueArg, in DOMString newValueArg, in DOMString urlArg, in Storage storageAreaArg);
diff --git a/Source/WebCore/storage/StorageSyncManager.cpp b/Source/WebCore/storage/StorageSyncManager.cpp
index c05de989f..c39fe0ddc 100644
--- a/Source/WebCore/storage/StorageSyncManager.cpp
+++ b/Source/WebCore/storage/StorageSyncManager.cpp
@@ -30,8 +30,8 @@
 #include "FileSystem.h"
 #include "Frame.h"
 #include "FrameTree.h"
-#include "LocalStorageTask.h"
-#include "LocalStorageThread.h"
+#include "StorageTask.h"
+#include "StorageThread.h"
 #include "Page.h"
 #include "PageGroup.h"
 #include "StorageAreaSync.h"
@@ -47,7 +47,7 @@ PassRefPtr<StorageSyncManager> StorageSyncManager::create(const String& path)
 }
 
 StorageSyncManager::StorageSyncManager(const String& path)
-    : m_thread(LocalStorageThread::create())
+    : m_thread(StorageThread::create())
     , m_path(path.isolatedCopy())
 {
     ASSERT(isMainThread());
@@ -87,7 +87,7 @@ bool StorageSyncManager::scheduleImport(PassRefPtr<StorageAreaSync> area)
     ASSERT(isMainThread());
     ASSERT(m_thread);
     if (m_thread)
-        m_thread->scheduleTask(LocalStorageTask::createImport(area.get()));
+        m_thread->scheduleTask(StorageTask::createImport(area.get()));
     return m_thread;
 }
 
@@ -96,7 +96,7 @@ void StorageSyncManager::scheduleSync(PassRefPtr<StorageAreaSync> area)
     ASSERT(isMainThread());
     ASSERT(m_thread);
     if (m_thread)
-        m_thread->scheduleTask(LocalStorageTask::createSync(area.get()));
+        m_thread->scheduleTask(StorageTask::createSync(area.get()));
 }
 
 void StorageSyncManager::scheduleDeleteEmptyDatabase(PassRefPtr<StorageAreaSync> area)
@@ -104,7 +104,7 @@ void StorageSyncManager::scheduleDeleteEmptyDatabase(PassRefPtr<StorageAreaSync>
     ASSERT(isMainThread());
     ASSERT(m_thread);
     if (m_thread)
-        m_thread->scheduleTask(LocalStorageTask::createDeleteEmptyDatabase(area.get()));
+        m_thread->scheduleTask(StorageTask::createDeleteEmptyDatabase(area.get()));
 }
 
 } // namespace WebCore
diff --git a/Source/WebCore/storage/StorageSyncManager.h b/Source/WebCore/storage/StorageSyncManager.h
index 5e0f16589..e27833787 100644
--- a/Source/WebCore/storage/StorageSyncManager.h
+++ b/Source/WebCore/storage/StorageSyncManager.h
@@ -34,7 +34,7 @@
 
 namespace WebCore {
 
-    class LocalStorageThread;
+    class StorageThread;
     class SecurityOrigin;
     class StorageAreaSync;
 
@@ -52,7 +52,7 @@ namespace WebCore {
     private:
         StorageSyncManager(const String& path);
 
-        OwnPtr<LocalStorageThread> m_thread;
+        OwnPtr<StorageThread> m_thread;
 
     // The following members are subject to thread synchronization issues
     public:
diff --git a/Source/WebCore/storage/LocalStorageTask.cpp b/Source/WebCore/storage/StorageTask.cpp
index 39b16b4d4..47aabe99e 100644
--- a/Source/WebCore/storage/LocalStorageTask.cpp
+++ b/Source/WebCore/storage/StorageTask.cpp
@@ -24,15 +24,15 @@
  */
 
 #include "config.h"
-#include "LocalStorageTask.h"
+#include "StorageTask.h"
 
-#include "LocalStorageThread.h"
+#include "StorageThread.h"
 #include "StorageAreaSync.h"
 #include "StorageTracker.h"
 
 namespace WebCore {
 
-LocalStorageTask::LocalStorageTask(Type type, StorageAreaSync* area)
+StorageTask::StorageTask(Type type, StorageAreaSync* area)
     : m_type(type)
     , m_area(area)
     , m_thread(0)
@@ -41,7 +41,7 @@ LocalStorageTask::LocalStorageTask(Type type, StorageAreaSync* area)
     ASSERT(m_type == AreaImport || m_type == AreaSync || m_type == DeleteEmptyDatabase);
 }
 
-LocalStorageTask::LocalStorageTask(Type type, LocalStorageThread* thread)
+StorageTask::StorageTask(Type type, StorageThread* thread)
     : m_type(type)
     , m_area(0)
     , m_thread(thread)
@@ -49,21 +49,21 @@ LocalStorageTask::LocalStorageTask(Type type, LocalStorageThread* thread)
     ASSERT(m_thread);
     ASSERT(m_type == TerminateThread);
 }
-    
-LocalStorageTask::LocalStorageTask(Type type)
+
+StorageTask::StorageTask(Type type)
     : m_type(type)
 {
     ASSERT(m_type == ImportOrigins || m_type == DeleteAllOrigins);
 }
-    
-LocalStorageTask::LocalStorageTask(Type type, const String& originIdentifier)
+
+StorageTask::StorageTask(Type type, const String& originIdentifier)
     : m_type(type)
     , m_originIdentifier(originIdentifier)
 {
     ASSERT(m_type == DeleteOrigin);
 }
 
-LocalStorageTask::LocalStorageTask(Type type, const String& originIdentifier, const String& databaseFilename)
+StorageTask::StorageTask(Type type, const String& originIdentifier, const String& databaseFilename)
     : m_type(type)
     , m_originIdentifier(originIdentifier)
     , m_databaseFilename(databaseFilename)
@@ -71,11 +71,11 @@ LocalStorageTask::LocalStorageTask(Type type, const String& originIdentifier, co
     ASSERT(m_type == SetOriginDetails);
 }
 
-LocalStorageTask::~LocalStorageTask()
+StorageTask::~StorageTask()
 {
 }
 
-void LocalStorageTask::performTask()
+void StorageTask::performTask()
 {
     switch (m_type) {
         case AreaImport:
diff --git a/Source/WebCore/storage/StorageTask.h b/Source/WebCore/storage/StorageTask.h
new file mode 100644
index 000000000..7d0523fd1
--- /dev/null
+++ b/Source/WebCore/storage/StorageTask.h
@@ -0,0 +1,72 @@
+/*
+ * Copyright (C) 2008 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef StorageTask_h
+#define StorageTask_h
+
+#include "PlatformString.h"
+#include <wtf/PassOwnPtr.h>
+#include <wtf/Threading.h>
+
+namespace WebCore {
+
+    class StorageAreaSync;
+    class StorageThread;
+
+    class StorageTask {
+        WTF_MAKE_NONCOPYABLE(StorageTask); WTF_MAKE_FAST_ALLOCATED;
+    public:
+        enum Type { AreaImport, AreaSync, DeleteEmptyDatabase, SetOriginDetails, ImportOrigins, DeleteAllOrigins, DeleteOrigin, TerminateThread };
+
+        ~StorageTask();
+
+        static PassOwnPtr<StorageTask> createImport(StorageAreaSync* area) { return adoptPtr(new StorageTask(AreaImport, area)); }
+        static PassOwnPtr<StorageTask> createSync(StorageAreaSync* area) { return adoptPtr(new StorageTask(AreaSync, area)); }
+        static PassOwnPtr<StorageTask> createDeleteEmptyDatabase(StorageAreaSync* area) { return adoptPtr(new StorageTask(DeleteEmptyDatabase, area)); }
+        static PassOwnPtr<StorageTask> createOriginIdentifiersImport() { return adoptPtr(new StorageTask(ImportOrigins)); }
+        static PassOwnPtr<StorageTask> createSetOriginDetails(const String& originIdentifier, const String& databaseFilename) { return adoptPtr(new StorageTask(SetOriginDetails, originIdentifier, databaseFilename)); }
+        static PassOwnPtr<StorageTask> createDeleteOrigin(const String& originIdentifier) { return adoptPtr(new StorageTask(DeleteOrigin, originIdentifier)); }
+        static PassOwnPtr<StorageTask> createDeleteAllOrigins() { return adoptPtr(new StorageTask(DeleteAllOrigins)); }
+        static PassOwnPtr<StorageTask> createTerminate(StorageThread* thread) { return adoptPtr(new StorageTask(TerminateThread, thread)); }
+
+        void performTask();
+
+    private:
+        StorageTask(Type, StorageAreaSync*);
+        StorageTask(Type, StorageThread*);
+        StorageTask(Type, const String& originIdentifier);
+        StorageTask(Type, const String& originIdentifier, const String& databaseFilename);
+        StorageTask(Type);
+
+        Type m_type;
+        StorageAreaSync* m_area;
+        StorageThread* m_thread;
+        String m_originIdentifier;
+        String m_databaseFilename;
+    };
+
+} // namespace WebCore
+
+#endif // StorageTask_h
diff --git a/Source/WebCore/storage/LocalStorageThread.cpp b/Source/WebCore/storage/StorageThread.cpp
index ba1b0fa26..623d7ea82 100644
--- a/Source/WebCore/storage/LocalStorageThread.cpp
+++ b/Source/WebCore/storage/StorageThread.cpp
@@ -24,60 +24,58 @@
  */
 
 #include "config.h"
-#include "LocalStorageThread.h"
+#include "StorageThread.h"
 
-#include "LocalStorageTask.h"
+#include "StorageTask.h"
 #include "StorageAreaSync.h"
 #include <wtf/MainThread.h>
 
 namespace WebCore {
 
-PassOwnPtr<LocalStorageThread> LocalStorageThread::create()
+PassOwnPtr<StorageThread> StorageThread::create()
 {
-    return adoptPtr(new LocalStorageThread);
+    return adoptPtr(new StorageThread);
 }
 
-LocalStorageThread::LocalStorageThread()
+StorageThread::StorageThread()
     : m_threadID(0)
 {
 }
 
-LocalStorageThread::~LocalStorageThread()
+StorageThread::~StorageThread()
 {
     ASSERT(isMainThread());
     ASSERT(!m_threadID);
 }
 
-bool LocalStorageThread::start()
+bool StorageThread::start()
 {
     ASSERT(isMainThread());
     if (!m_threadID)
-        m_threadID = createThread(LocalStorageThread::threadEntryPointCallback, this, "WebCore: LocalStorage");
+        m_threadID = createThread(StorageThread::threadEntryPointCallback, this, "WebCore: LocalStorage");
     return m_threadID;
 }
 
-void* LocalStorageThread::threadEntryPointCallback(void* thread)
+void StorageThread::threadEntryPointCallback(void* thread)
 {
-    return static_cast<LocalStorageThread*>(thread)->threadEntryPoint();
+    static_cast<StorageThread*>(thread)->threadEntryPoint();
 }
 
-void* LocalStorageThread::threadEntryPoint()
+void StorageThread::threadEntryPoint()
 {
     ASSERT(!isMainThread());
-    while (OwnPtr<LocalStorageTask> task = m_queue.waitForMessage())
+    while (OwnPtr<StorageTask> task = m_queue.waitForMessage())
         task->performTask();
-
-    return 0;
 }
 
-void LocalStorageThread::scheduleTask(PassOwnPtr<LocalStorageTask> task)
+void StorageThread::scheduleTask(PassOwnPtr<StorageTask> task)
 {
     ASSERT(isMainThread());
     ASSERT(!m_queue.killed() && m_threadID);
     m_queue.append(task);
 }
 
-void LocalStorageThread::terminate()
+void StorageThread::terminate()
 {
     ASSERT(isMainThread());
     ASSERT(!m_queue.killed() && m_threadID);
@@ -85,14 +83,13 @@ void LocalStorageThread::terminate()
     if (!m_threadID)
         return;
 
-    void* returnValue;
-    m_queue.append(LocalStorageTask::createTerminate(this));
-    waitForThreadCompletion(m_threadID, &returnValue);
+    m_queue.append(StorageTask::createTerminate(this));
+    waitForThreadCompletion(m_threadID);
     ASSERT(m_queue.killed());
     m_threadID = 0;
 }
 
-void LocalStorageThread::performTerminate()
+void StorageThread::performTerminate()
 {
     ASSERT(!isMainThread());
     m_queue.kill();
diff --git a/Source/WebCore/storage/LocalStorageThread.h b/Source/WebCore/storage/StorageThread.h
index 46467afa7..a484118c4 100644
--- a/Source/WebCore/storage/LocalStorageThread.h
+++ b/Source/WebCore/storage/StorageThread.h
@@ -23,8 +23,8 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#ifndef LocalStorageThread_h
-#define LocalStorageThread_h
+#ifndef StorageThread_h
+#define StorageThread_h
 
 #include <wtf/HashSet.h>
 #include <wtf/MessageQueue.h>
@@ -35,33 +35,32 @@
 namespace WebCore {
 
     class StorageAreaSync;
-    class LocalStorageTask;
+    class StorageTask;
 
-    // FIXME: Rename this class to StorageThread
-    class LocalStorageThread {
-        WTF_MAKE_NONCOPYABLE(LocalStorageThread); WTF_MAKE_FAST_ALLOCATED;
+    class StorageThread {
+        WTF_MAKE_NONCOPYABLE(StorageThread); WTF_MAKE_FAST_ALLOCATED;
     public:
-        static PassOwnPtr<LocalStorageThread> create();
-        ~LocalStorageThread();
+        static PassOwnPtr<StorageThread> create();
+        ~StorageThread();
 
         bool start();
         void terminate();
-        void scheduleTask(PassOwnPtr<LocalStorageTask>);
+        void scheduleTask(PassOwnPtr<StorageTask>);
 
         // Background thread part of the terminate procedure.
         void performTerminate();
 
     private:
-        LocalStorageThread();
+        StorageThread();
 
         // Called on background thread.
-        static void* threadEntryPointCallback(void*);
-        void* threadEntryPoint();
+        static void threadEntryPointCallback(void*);
+        void threadEntryPoint();
 
         ThreadIdentifier m_threadID;
-        MessageQueue<LocalStorageTask> m_queue;
+        MessageQueue<StorageTask> m_queue;
     };
 
 } // namespace WebCore
 
-#endif // LocalStorageThread_h
+#endif // StorageThread_h
diff --git a/Source/WebCore/storage/StorageTracker.cpp b/Source/WebCore/storage/StorageTracker.cpp
index f981e6bd0..9e18dd473 100644
--- a/Source/WebCore/storage/StorageTracker.cpp
+++ b/Source/WebCore/storage/StorageTracker.cpp
@@ -28,8 +28,8 @@
 
 #include "DatabaseThread.h"
 #include "FileSystem.h"
-#include "LocalStorageTask.h"
-#include "LocalStorageThread.h"
+#include "StorageTask.h"
+#include "StorageThread.h"
 #include "Logging.h"
 #include "PageGroup.h"
 #include "SQLiteFileSystem.h"
@@ -87,7 +87,7 @@ StorageTracker& StorageTracker::tracker()
 StorageTracker::StorageTracker(const String& storagePath)
     : m_storageDirectoryPath(storagePath.isolatedCopy())
     , m_client(0)
-    , m_thread(LocalStorageThread::create())
+    , m_thread(StorageThread::create())
     , m_isActive(false)
     , m_needsInitialization(false)
     , m_finishedImportingOriginIdentifiers(false)
@@ -163,7 +163,7 @@ void StorageTracker::importOriginIdentifiers()
     ASSERT(isMainThread());
     ASSERT(m_thread);
 
-    m_thread->scheduleTask(LocalStorageTask::createOriginIdentifiersImport());
+    m_thread->scheduleTask(StorageTask::createOriginIdentifiersImport());
 }
 
 void StorageTracker::notifyFinishedImportingOriginIdentifiersOnMainThread(void*)
@@ -297,7 +297,7 @@ void StorageTracker::setOriginDetails(const String& originIdentifier, const Stri
         m_originSet.add(originIdentifier);
     }
 
-    OwnPtr<LocalStorageTask> task = LocalStorageTask::createSetOriginDetails(originIdentifier.isolatedCopy(), databaseFile);
+    OwnPtr<StorageTask> task = StorageTask::createSetOriginDetails(originIdentifier.isolatedCopy(), databaseFile);
 
     if (isMainThread()) {
         ASSERT(m_thread);
@@ -311,7 +311,7 @@ void StorageTracker::scheduleTask(void* taskIn)
     ASSERT(isMainThread());
     ASSERT(StorageTracker::tracker().m_thread);
     
-    OwnPtr<LocalStorageTask> task = adoptPtr(reinterpret_cast<LocalStorageTask*>(taskIn));
+    OwnPtr<StorageTask> task = adoptPtr(reinterpret_cast<StorageTask*>(taskIn));
 
     StorageTracker::tracker().m_thread->scheduleTask(task.release());
 }
@@ -383,7 +383,7 @@ void StorageTracker::deleteAllOrigins()
 
     PageGroup::clearLocalStorageForAllOrigins();
     
-    m_thread->scheduleTask(LocalStorageTask::createDeleteAllOrigins());
+    m_thread->scheduleTask(StorageTask::createDeleteAllOrigins());
 }
     
 void StorageTracker::syncDeleteAllOrigins()
@@ -479,7 +479,7 @@ void StorageTracker::deleteOrigin(SecurityOrigin* origin)
         m_originSet.remove(originId);
     }
     
-    m_thread->scheduleTask(LocalStorageTask::createDeleteOrigin(originId));
+    m_thread->scheduleTask(StorageTask::createDeleteOrigin(originId));
 }
 
 void StorageTracker::syncDeleteOrigin(const String& originIdentifier)
diff --git a/Source/WebCore/storage/StorageTracker.h b/Source/WebCore/storage/StorageTracker.h
index d7cb82460..9e1945adb 100644
--- a/Source/WebCore/storage/StorageTracker.h
+++ b/Source/WebCore/storage/StorageTracker.h
@@ -35,8 +35,8 @@
 
 namespace WebCore {
 
-class LocalStorageTask;
-class LocalStorageThread;
+class StorageTask;
+class StorageThread;
 class SecurityOrigin;
 class StorageTrackerClient;    
 
@@ -113,7 +113,7 @@ private:
     OriginSet m_originSet;
     OriginSet m_originsBeingDeleted;
 
-    OwnPtr<LocalStorageThread> m_thread;
+    OwnPtr<StorageThread> m_thread;
     
     bool m_isActive;
     bool m_needsInitialization;
diff --git a/Source/WebCore/storage/chromium/DatabaseTrackerChromium.cpp b/Source/WebCore/storage/chromium/DatabaseTrackerChromium.cpp
index c53661dc2..117fdbeed 100644
--- a/Source/WebCore/storage/chromium/DatabaseTrackerChromium.cpp
+++ b/Source/WebCore/storage/chromium/DatabaseTrackerChromium.cpp
@@ -157,29 +157,6 @@ void DatabaseTracker::removeOpenDatabase(AbstractDatabase* database)
         DatabaseObserver::databaseClosed(database);
 }
 
-void DatabaseTracker::getOpenDatabases(SecurityOrigin* origin, const String& name, HashSet<RefPtr<AbstractDatabase> >* databases)
-{
-    getOpenDatabases(origin->databaseIdentifier(), name, databases);
-}
-
-void DatabaseTracker::getOpenDatabases(const String& originIdentifier, const String& name, HashSet<RefPtr<AbstractDatabase> >* databases)
-{
-    MutexLocker openDatabaseMapLock(m_openDatabaseMapGuard);
-    if (!m_openDatabaseMap)
-        return;
-
-    DatabaseNameMap* nameMap = m_openDatabaseMap->get(originIdentifier);
-    if (!nameMap)
-        return;
-
-    DatabaseSet* databaseSet = nameMap->get(name);
-    if (!databaseSet)
-        return;
-
-    for (DatabaseSet::iterator it = databaseSet->begin(); it != databaseSet->end(); ++it)
-        databases->add(*it);
-}
-
 unsigned long long DatabaseTracker::getMaxSizeForDatabase(const AbstractDatabase* database)
 {
     unsigned long long spaceAvailable = 0;
@@ -212,6 +189,76 @@ void DatabaseTracker::interruptAllDatabasesForContext(const ScriptExecutionConte
     }
 }
 
+class DatabaseTracker::CloseOneDatabaseImmediatelyTask : public ScriptExecutionContext::Task {
+public:
+    static PassOwnPtr<CloseOneDatabaseImmediatelyTask> create(const String& originIdentifier, const String& name, AbstractDatabase* database)
+    {
+        return adoptPtr(new CloseOneDatabaseImmediatelyTask(originIdentifier, name, database));
+    }
+
+    virtual void performTask(ScriptExecutionContext* context)
+    {
+        DatabaseTracker::tracker().closeOneDatabaseImmediately(m_originIdentifier, m_name, m_database);
+    }
+
+private:
+    CloseOneDatabaseImmediatelyTask(const String& originIdentifier, const String& name, AbstractDatabase* database)
+        : m_originIdentifier(originIdentifier.isolatedCopy())
+        , m_name(name.isolatedCopy())
+        , m_database(database)
+    {
+    }
+
+    String m_originIdentifier;
+    String m_name;
+    AbstractDatabase* m_database;  // Intentionally a raw pointer.
+};
+
+void DatabaseTracker::closeDatabasesImmediately(const String& originIdentifier, const String& name) {
+    MutexLocker openDatabaseMapLock(m_openDatabaseMapGuard);
+    if (!m_openDatabaseMap)
+        return;
+
+    DatabaseNameMap* nameMap = m_openDatabaseMap->get(originIdentifier);
+    if (!nameMap)
+        return;
+
+    DatabaseSet* databaseSet = nameMap->get(name);
+    if (!databaseSet)
+        return;
+
+    // We have to call closeImmediately() on the context thread and we cannot safely add a reference to
+    // the database in our collection when not on the context thread (which is always the case given
+    // current usage).
+    for (DatabaseSet::iterator it = databaseSet->begin(); it != databaseSet->end(); ++it)
+        (*it)->scriptExecutionContext()->postTask(CloseOneDatabaseImmediatelyTask::create(originIdentifier, name, *it));
+}
+
+void DatabaseTracker::closeOneDatabaseImmediately(const String& originIdentifier, const String& name, AbstractDatabase* database)
+{
+    // First we have to confirm the 'database' is still in our collection.
+    {
+        MutexLocker openDatabaseMapLock(m_openDatabaseMapGuard);
+        if (!m_openDatabaseMap)
+            return;
+
+        DatabaseNameMap* nameMap = m_openDatabaseMap->get(originIdentifier);
+        if (!nameMap)
+            return;
+
+        DatabaseSet* databaseSet = nameMap->get(name);
+        if (!databaseSet)
+            return;
+
+        DatabaseSet::iterator found = databaseSet->find(database);
+        if (found == databaseSet->end())
+            return;
+    }
+
+    // And we have to call closeImmediately() without our collection lock being held.
+    database->closeImmediately();
+}
+
 }
 
 #endif // ENABLE(SQL_DATABASE)
diff --git a/Source/WebCore/storage/wince/LocalStorageThreadWinCE.cpp b/Source/WebCore/storage/wince/StorageThreadWinCE.cpp
index 90c4e89a2..25e896f83 100644
--- a/Source/WebCore/storage/wince/LocalStorageThreadWinCE.cpp
+++ b/Source/WebCore/storage/wince/StorageThreadWinCE.cpp
@@ -22,31 +22,31 @@
  */
 
 #include "config.h"
-#include "LocalStorageThread.h"
+#include "StorageThread.h"
 
-#include "LocalStorageTask.h"
+#include "StorageTask.h"
 #include "StorageAreaSync.h"
 
 namespace WebCore {
 
-LocalStorageThread::LocalStorageThread()
-: m_timer(this, &LocalStorageThread::timerFired)
+StorageThread::StorageThread()
+: m_timer(this, &StorageThread::timerFired)
 {
 }
 
-LocalStorageThread::~LocalStorageThread()
+StorageThread::~StorageThread()
 {
 }
 
-bool LocalStorageThread::start()
+bool StorageThread::start()
 {
     return true;
 }
 
-void LocalStorageThread::timerFired(Timer<LocalStorageThread>*)
+void StorageThread::timerFired(Timer<StorageThread>*)
 {
     if (!m_queue.isEmpty()) {
-        RefPtr<LocalStorageTask> task = m_queue.first();
+        RefPtr<StorageTask> task = m_queue.first();
         task->performTask();
         m_queue.removeFirst();
         if (!m_queue.isEmpty())
@@ -54,27 +54,27 @@ void LocalStorageThread::timerFired(Timer<LocalStorageThread>*)
     }
 }
 
-void LocalStorageThread::scheduleImport(PassRefPtr<StorageAreaSync> area)
+void StorageThread::scheduleImport(PassRefPtr<StorageAreaSync> area)
 {
-    m_queue.append(LocalStorageTask::createImport(area));
+    m_queue.append(StorageTask::createImport(area));
     if (!m_timer.isActive())
         m_timer.startOneShot(0);
 }
 
-void LocalStorageThread::scheduleSync(PassRefPtr<StorageAreaSync> area)
+void StorageThread::scheduleSync(PassRefPtr<StorageAreaSync> area)
 {
-    m_queue.append(LocalStorageTask::createSync(area));
+    m_queue.append(StorageTask::createSync(area));
     if (!m_timer.isActive())
         m_timer.startOneShot(0);
 }
 
-void LocalStorageThread::terminate()
+void StorageThread::terminate()
 {
     m_queue.clear();
     m_timer.stop();
 }
 
-void LocalStorageThread::performTerminate()
+void StorageThread::performTerminate()
 {
     m_queue.clear();
     m_timer.stop();
diff --git a/Source/WebCore/storage/wince/LocalStorageThreadWinCE.h b/Source/WebCore/storage/wince/StorageThreadWinCE.h
index 06e7d4568..67573ae50 100644
--- a/Source/WebCore/storage/wince/LocalStorageThreadWinCE.h
+++ b/Source/WebCore/storage/wince/StorageThreadWinCE.h
@@ -22,8 +22,8 @@
  */
 
 
-#ifndef LocalStorageThreadWinCE_h
-#define LocalStorageThreadWinCE_h
+#ifndef StorageThreadWinCE_h
+#define StorageThreadWinCE_h
 
 #include <wtf/Deque.h>
 #include <wtf/PassRefPtr.h>
@@ -31,13 +31,13 @@
 namespace WebCore {
 
     class StorageAreaSync;
-    class LocalStorageTask;
+    class StorageTask;
 
-    class LocalStorageThread : public RefCounted<LocalStorageThread> {
+    class StorageThread : public RefCounted<StorageThread> {
     public:
-        static PassRefPtr<LocalStorageThread> create() { return adoptRef(new LocalStorageThread); }
+        static PassRefPtr<StorageThread> create() { return adoptRef(new StorageThread); }
 
-        ~LocalStorageThread();
+        ~StorageThread();
         bool start();
         void scheduleImport(PassRefPtr<StorageAreaSync>);
         void scheduleSync(PassRefPtr<StorageAreaSync>);
@@ -45,14 +45,14 @@ namespace WebCore {
         void performTerminate();
 
     private:
-        LocalStorageThread();
+        StorageThread();
 
-        void timerFired(Timer<LocalStorageThread>*);
+        void timerFired(Timer<StorageThread>*);
 
-        Deque<RefPtr<LocalStorageTask> > m_queue;
-        Timer<LocalStorageThread> m_timer;
+        Deque<RefPtr<StorageTask> > m_queue;
+        Timer<StorageThread> m_timer;
     };
 
 } // namespace WebCore
 
-#endif // LocalStorageThreadWinCE_h
+#endif // StorageThreadWinCE_h
diff --git a/Source/WebCore/svg/DOMWindowSVG.idl b/Source/WebCore/svg/DOMWindowSVG.idl
new file mode 100644
index 000000000..cc907136b
--- /dev/null
+++ b/Source/WebCore/svg/DOMWindowSVG.idl
@@ -0,0 +1,187 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ */
+
+module window {
+
+    // FIXME: Most of this could/should be generated from make_names.pl/SVGNames.in
+    // to reduce the chance that we forget a constructor when adding a new element.
+    interface [
+        Conditional=SVG,
+        Supplemental=DOMWindow
+    ] DOMWindowSVG {
+
+        attribute SVGZoomEventConstructor SVGZoomEvent;
+
+        // Expose all implemented SVG 1.1 interfaces, excluding the SVG MI interfaces:
+        // SVGAnimatedPathData, SVGAnimatedPoints, SVGExternalResourcesRequired,
+        // SVGFilterPrimitiveStandardAttributes, SVGFitToViewBox, SVGLangSpace, SVGLocatable
+        // SVGStylable, SVGTests, SVGTransformable, SVGURIReference, SVGZoomAndPan
+        attribute SVGAElementConstructor SVGAElement;
+        attribute SVGAngleConstructor SVGAngle;
+        attribute SVGAnimatedAngleConstructor SVGAnimatedAngle;
+        attribute SVGAnimatedBooleanConstructor SVGAnimatedBoolean;
+        attribute SVGAnimatedEnumerationConstructor SVGAnimatedEnumeration;
+        attribute SVGAnimatedIntegerConstructor SVGAnimatedInteger;
+        attribute SVGAnimatedLengthConstructor SVGAnimatedLength;
+        attribute SVGAnimatedLengthListConstructor SVGAnimatedLengthList;
+        attribute SVGAnimatedNumberConstructor SVGAnimatedNumber;
+        attribute SVGAnimatedNumberListConstructor SVGAnimatedNumberList;
+        attribute SVGAnimatedPreserveAspectRatioConstructor SVGAnimatedPreserveAspectRatio;
+        attribute SVGAnimatedRectConstructor SVGAnimatedRect;
+        attribute SVGAnimatedStringConstructor SVGAnimatedString;
+        attribute SVGAnimatedTransformListConstructor SVGAnimatedTransformList;
+        attribute SVGCircleElementConstructor SVGCircleElement;
+        attribute SVGClipPathElementConstructor SVGClipPathElement;
+        attribute SVGColorConstructor SVGColor;
+        attribute SVGCursorElementConstructor SVGCursorElement;
+//      attribute SVGCSSRuleConstructor SVGCSSRule;
+        attribute SVGDefsElementConstructor SVGDefsElement;
+        attribute SVGDescElementConstructor SVGDescElement;
+        attribute SVGDocumentConstructor SVGDocument;
+        attribute SVGElementConstructor SVGElement;
+        attribute SVGElementInstanceConstructor SVGElementInstance;
+        attribute SVGElementInstanceListConstructor SVGElementInstanceList;
+        attribute SVGEllipseElementConstructor SVGEllipseElement;
+        attribute SVGForeignObjectElementConstructor SVGForeignObjectElement;
+        attribute SVGExceptionConstructor SVGException;
+        attribute SVGGElementConstructor SVGGElement;
+        attribute SVGGradientElementConstructor SVGGradientElement;
+        attribute SVGImageElementConstructor SVGImageElement;
+        attribute SVGLengthConstructor SVGLength;
+        attribute SVGLengthListConstructor SVGLengthList;
+        attribute SVGLinearGradientElementConstructor SVGLinearGradientElement;
+        attribute SVGLineElementConstructor SVGLineElement;
+        attribute SVGMarkerElementConstructor SVGMarkerElement;
+        attribute SVGMaskElementConstructor SVGMaskElement;
+        attribute SVGMatrixConstructor SVGMatrix;
+        attribute SVGMetadataElementConstructor SVGMetadataElement;
+        attribute SVGNumberConstructor SVGNumber;
+        attribute SVGNumberListConstructor SVGNumberList;
+        attribute SVGPaintConstructor SVGPaint;
+        attribute SVGPathElementConstructor SVGPathElement;
+        attribute SVGPathSegConstructor SVGPathSeg;
+        attribute SVGPathSegArcAbsConstructor SVGPathSegArcAbs;
+        attribute SVGPathSegArcRelConstructor SVGPathSegArcRel;
+        attribute SVGPathSegClosePathConstructor SVGPathSegClosePath;
+        attribute SVGPathSegCurvetoCubicAbsConstructor SVGPathSegCurvetoCubicAbs;
+        attribute SVGPathSegCurvetoCubicRelConstructor SVGPathSegCurvetoCubicRel;
+        attribute SVGPathSegCurvetoCubicSmoothAbsConstructor SVGPathSegCurvetoCubicSmoothAbs;
+        attribute SVGPathSegCurvetoCubicSmoothRelConstructor SVGPathSegCurvetoCubicSmoothRel;
+        attribute SVGPathSegCurvetoQuadraticAbsConstructor SVGPathSegCurvetoQuadraticAbs;
+        attribute SVGPathSegCurvetoQuadraticRelConstructor SVGPathSegCurvetoQuadraticRel;
+        attribute SVGPathSegCurvetoQuadraticSmoothAbsConstructor SVGPathSegCurvetoQuadraticSmoothAbs;
+        attribute SVGPathSegCurvetoQuadraticSmoothRelConstructor SVGPathSegCurvetoQuadraticSmoothRel;
+        attribute SVGPathSegLinetoAbsConstructor SVGPathSegLinetoAbs;
+        attribute SVGPathSegLinetoHorizontalAbsConstructor SVGPathSegLinetoHorizontalAbs;
+        attribute SVGPathSegLinetoHorizontalRelConstructor SVGPathSegLinetoHorizontalRel;
+        attribute SVGPathSegLinetoRelConstructor SVGPathSegLinetoRel;
+        attribute SVGPathSegLinetoVerticalAbsConstructor SVGPathSegLinetoVerticalAbs;
+        attribute SVGPathSegLinetoVerticalRelConstructor SVGPathSegLinetoVerticalRel;
+        attribute SVGPathSegListConstructor SVGPathSegList;
+        attribute SVGPathSegMovetoAbsConstructor SVGPathSegMovetoAbs;
+        attribute SVGPathSegMovetoRelConstructor SVGPathSegMovetoRel;
+        attribute SVGPatternElementConstructor SVGPatternElement;
+        attribute SVGPointConstructor SVGPoint;
+        attribute SVGPointListConstructor SVGPointList;
+        attribute SVGPolygonElementConstructor SVGPolygonElement;
+        attribute SVGPolylineElementConstructor SVGPolylineElement;
+        attribute SVGPreserveAspectRatioConstructor SVGPreserveAspectRatio;
+        attribute SVGRadialGradientElementConstructor SVGRadialGradientElement;
+        attribute SVGRectConstructor SVGRect;
+        attribute SVGRectElementConstructor SVGRectElement;
+        attribute SVGRenderingIntentConstructor SVGRenderingIntent;
+        attribute SVGScriptElementConstructor SVGScriptElement;
+        attribute SVGStopElementConstructor SVGStopElement;
+        attribute SVGStringListConstructor SVGStringList;
+        attribute SVGStyleElementConstructor SVGStyleElement;
+        attribute SVGSVGElementConstructor SVGSVGElement;
+        attribute SVGSwitchElementConstructor SVGSwitchElement;
+        attribute SVGSymbolElementConstructor SVGSymbolElement;
+        attribute SVGTextContentElementConstructor SVGTextContentElement;
+        attribute SVGTextElementConstructor SVGTextElement;
+        attribute SVGTextPathElementConstructor SVGTextPathElement;
+        attribute SVGTextPositioningElementConstructor SVGTextPositioningElement;
+        attribute SVGTitleElementConstructor SVGTitleElement;
+        attribute SVGTransformConstructor SVGTransform;
+        attribute SVGTransformListConstructor SVGTransformList;
+        attribute SVGTRefElementConstructor SVGTRefElement;
+        attribute SVGTSpanElementConstructor SVGTSpanElement;
+        attribute SVGUnitTypesConstructor SVGUnitTypes;
+        attribute SVGUseElementConstructor SVGUseElement;
+        attribute SVGViewElementConstructor SVGViewElement;
+//      attribute SVGViewSpecConstructor SVGViewSpec;
+
+        attribute SVGAnimateColorElementConstructor SVGAnimateColorElement;
+        attribute SVGAnimateElementConstructor SVGAnimateElement;
+        attribute SVGAnimateMotionElementConstructor SVGAnimateMotionElement;
+        attribute SVGAnimateTransformElementConstructor SVGAnimateTransformElement;
+        attribute SVGMPathElementConstructor SVGMPathElement;
+        attribute SVGSetElementConstructor SVGSetElement;
+
+#if defined(ENABLE_SVG_FONTS) && ENABLE_SVG_FONTS
+        attribute SVGAltGlyphDefElementConstructor SVGAltGlyphDefElement;
+        attribute SVGAltGlyphElementConstructor SVGAltGlyphElement;
+        attribute SVGAltGlyphItemElementConstructor SVGAltGlyphItemElement;
+//      attribute SVGDefinitionSrcElementConstructor SVGDefinitionSrcElement;
+        attribute SVGFontElementConstructor SVGFontElement;
+        attribute SVGFontFaceElementConstructor SVGFontFaceElement;
+        attribute SVGFontFaceFormatElementConstructor SVGFontFaceFormatElement;
+        attribute SVGFontFaceNameElementConstructor SVGFontFaceNameElement;
+        attribute SVGFontFaceSrcElementConstructor SVGFontFaceSrcElement;
+        attribute SVGFontFaceUriElementConstructor SVGFontFaceUriElement;
+        attribute SVGGlyphElementConstructor SVGGlyphElement;
+        attribute SVGGlyphRefElementConstructor SVGGlyphRefElement;
+        attribute SVGHKernElementConstructor SVGHKernElement;
+        attribute SVGMissingGlyphElementConstructor SVGMissingGlyphElement;
+        attribute SVGVKernElementConstructor SVGVKernElement;
+#endif
+
+#if defined(ENABLE_FILTERS) && ENABLE_FILTERS
+        attribute SVGComponentTransferFunctionElementConstructor SVGComponentTransferFunctionElement;
+        attribute SVGFEBlendElementConstructor SVGFEBlendElement;
+        attribute SVGFEColorMatrixElementConstructor SVGFEColorMatrixElement;
+        attribute SVGFEComponentTransferElementConstructor SVGFEComponentTransferElement;
+        attribute SVGFECompositeElementConstructor SVGFECompositeElement;
+        attribute SVGFEConvolveMatrixElementConstructor SVGFEConvolveMatrixElement;
+        attribute SVGFEDiffuseLightingElementConstructor SVGFEDiffuseLightingElement;
+        attribute SVGFEDisplacementMapElementConstructor SVGFEDisplacementMapElement;
+        attribute SVGFEDistantLightElementConstructor SVGFEDistantLightElement;
+        attribute SVGFEDropShadowElementConstructor SVGFEDropShadowElement;
+        attribute SVGFEFloodElementConstructor SVGFEFloodElement;
+        attribute SVGFEFuncAElementConstructor SVGFEFuncAElement;
+        attribute SVGFEFuncBElementConstructor SVGFEFuncBElement;
+        attribute SVGFEFuncGElementConstructor SVGFEFuncGElement;
+        attribute SVGFEFuncRElementConstructor SVGFEFuncRElement;
+        attribute SVGFEGaussianBlurElementConstructor SVGFEGaussianBlurElement;
+        attribute SVGFEImageElementConstructor SVGFEImageElement;
+        attribute SVGFEMergeElementConstructor SVGFEMergeElement;
+        attribute SVGFEMergeNodeElementConstructor SVGFEMergeNodeElement;
+        attribute SVGFEMorphologyElementConstructor SVGFEMorphologyElement;
+        attribute SVGFEOffsetElementConstructor SVGFEOffsetElement;
+        attribute SVGFEPointLightElementConstructor SVGFEPointLightElement;
+        attribute SVGFESpecularLightingElementConstructor SVGFESpecularLightingElement;
+        attribute SVGFESpotLightElementConstructor SVGFESpotLightElement;
+        attribute SVGFETileElementConstructor SVGFETileElement;
+        attribute SVGFETurbulenceElementConstructor SVGFETurbulenceElement;
+        attribute SVGFilterElementConstructor SVGFilterElement;
+#endif
+
+    };
+
+}
diff --git a/Source/WebCore/svg/ElementTimeControl.idl b/Source/WebCore/svg/ElementTimeControl.idl
index 70164abaf..9c748c92e 100644
--- a/Source/WebCore/svg/ElementTimeControl.idl
+++ b/Source/WebCore/svg/ElementTimeControl.idl
@@ -32,9 +32,9 @@ module svg {
         OmitConstructor
     ] ElementTimeControl { 
         void beginElement();
-        void beginElementAt(in [Optional=CallWithDefaultValue] float offset);
+        void beginElementAt(in [Optional=DefaultIsUndefined] float offset);
         void endElement();
-        void endElementAt(in [Optional=CallWithDefaultValue] float offset);
+        void endElementAt(in [Optional=DefaultIsUndefined] float offset);
     };
 
 }
diff --git a/Source/WebCore/svg/SVGAElement.cpp b/Source/WebCore/svg/SVGAElement.cpp
index b3e0f8511..7ec617ae0 100644
--- a/Source/WebCore/svg/SVGAElement.cpp
+++ b/Source/WebCore/svg/SVGAElement.cpp
@@ -37,6 +37,7 @@
 #include "HTMLParserIdioms.h"
 #include "KeyboardEvent.h"
 #include "MouseEvent.h"
+#include "NodeRenderingContext.h"
 #include "PlatformMouseEvent.h"
 #include "RenderSVGInline.h"
 #include "RenderSVGTransformableContainer.h"
@@ -224,16 +225,16 @@ bool SVGAElement::isKeyboardFocusable(KeyboardEvent* event) const
     return document()->frame()->eventHandler()->tabsToLinks(event);
 }
 
-bool SVGAElement::childShouldCreateRenderer(Node* child) const
+bool SVGAElement::childShouldCreateRenderer(const NodeRenderingContext& childContext) const
 {
     // http://www.w3.org/2003/01/REC-SVG11-20030114-errata#linking-text-environment
     // The 'a' element may contain any element that its parent may contain, except itself.
-    if (child->hasTagName(SVGNames::aTag))
+    if (childContext.node()->hasTagName(SVGNames::aTag))
         return false;
     if (parentNode() && parentNode()->isSVGElement())
-        return parentNode()->childShouldCreateRenderer(child);
+        return parentNode()->childShouldCreateRenderer(childContext);
 
-    return SVGElement::childShouldCreateRenderer(child);
+    return SVGElement::childShouldCreateRenderer(childContext);
 }
 
 } // namespace WebCore
diff --git a/Source/WebCore/svg/SVGAElement.h b/Source/WebCore/svg/SVGAElement.h
index f2af9a828..e3b8f2802 100644
--- a/Source/WebCore/svg/SVGAElement.h
+++ b/Source/WebCore/svg/SVGAElement.h
@@ -61,7 +61,7 @@ private:
     virtual bool isKeyboardFocusable(KeyboardEvent*) const;
     virtual bool isFocusable() const;
 
-    virtual bool childShouldCreateRenderer(Node*) const;
+    virtual bool childShouldCreateRenderer(const NodeRenderingContext&) const;
 
     BEGIN_DECLARE_ANIMATED_PROPERTIES(SVGAElement)
         // This declaration used to define a non-virtual "String& target() const" method, that clashes with "virtual String Element::target() const".
diff --git a/Source/WebCore/svg/SVGAltGlyphElement.cpp b/Source/WebCore/svg/SVGAltGlyphElement.cpp
index 1baba8494..f03d1ff27 100644
--- a/Source/WebCore/svg/SVGAltGlyphElement.cpp
+++ b/Source/WebCore/svg/SVGAltGlyphElement.cpp
@@ -26,6 +26,7 @@
 #include "SVGAltGlyphElement.h"
 
 #include "ExceptionCode.h"
+#include "NodeRenderingContext.h"
 #include "RenderInline.h"
 #include "RenderSVGTSpan.h"
 #include "SVGAltGlyphDefElement.h"
@@ -75,9 +76,9 @@ const AtomicString& SVGAltGlyphElement::format() const
     return fastGetAttribute(SVGNames::formatAttr);
 }
 
-bool SVGAltGlyphElement::childShouldCreateRenderer(Node* child) const
+bool SVGAltGlyphElement::childShouldCreateRenderer(const NodeRenderingContext& childContext) const
 {
-    if (child->isTextNode())
+    if (childContext.node()->isTextNode())
         return true;
     return false;
 }
diff --git a/Source/WebCore/svg/SVGAltGlyphElement.h b/Source/WebCore/svg/SVGAltGlyphElement.h
index 0ba229c46..179ed7734 100644
--- a/Source/WebCore/svg/SVGAltGlyphElement.h
+++ b/Source/WebCore/svg/SVGAltGlyphElement.h
@@ -47,7 +47,7 @@ private:
     SVGAltGlyphElement(const QualifiedName&, Document*);
 
     virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
-    virtual bool childShouldCreateRenderer(Node*) const;
+    virtual bool childShouldCreateRenderer(const NodeRenderingContext&) const;
 
     BEGIN_DECLARE_ANIMATED_PROPERTIES(SVGAltGlyphElement)
         DECLARE_ANIMATED_STRING(Href, href)
diff --git a/Source/WebCore/svg/SVGAnimateElement.cpp b/Source/WebCore/svg/SVGAnimateElement.cpp
index c819e1e16..13f7cf96b 100644
--- a/Source/WebCore/svg/SVGAnimateElement.cpp
+++ b/Source/WebCore/svg/SVGAnimateElement.cpp
@@ -59,7 +59,7 @@ SVGAnimateElement::~SVGAnimateElement()
 static inline void getPropertyValue(SVGElement* svgParent, const QualifiedName& attributeName, String& value)
 {
     ASSERT(svgParent->isStyled());
-    value = computedStyle(svgParent)->getPropertyValue(cssPropertyID(attributeName.localName()));
+    value = CSSComputedStyleDeclaration::create(svgParent)->getPropertyValue(cssPropertyID(attributeName.localName()));
 }
 
 static bool inheritsFromProperty(SVGElement* targetElement, const QualifiedName& attributeName, const String& value)
@@ -109,7 +109,7 @@ bool SVGAnimateElement::hasValidAttributeType()
     if (!targetElement)
         return false;
     
-    return determineAnimatedPropertyType(targetElement) != AnimatedUnknown;
+    return m_animatedPropertyType != AnimatedUnknown;
 }
 
 AnimatedPropertyType SVGAnimateElement::determineAnimatedPropertyType(SVGElement* targetElement) const
@@ -159,12 +159,20 @@ void SVGAnimateElement::determinePropertyValueTypes(const String& from, const St
 void SVGAnimateElement::calculateAnimatedValue(float percentage, unsigned repeat, SVGSMILElement* resultElement)
 {
     ASSERT(resultElement);
+    SVGElement* targetElement = this->targetElement();
+    if (!targetElement)
+        return;
+
+    ASSERT(m_animatedPropertyType == determineAnimatedPropertyType(targetElement));
+
     ASSERT(percentage >= 0 && percentage <= 1);
     ASSERT(m_animatedPropertyType != AnimatedEnumeration);
     ASSERT(m_animatedPropertyType != AnimatedTransformList);
     ASSERT(m_animatedPropertyType != AnimatedUnknown);
     ASSERT(m_animator);
+    ASSERT(m_animator->type() == m_animatedPropertyType);
     ASSERT(m_fromType);
+    ASSERT(m_fromType->type() == m_animatedPropertyType);
     ASSERT(m_toType);
 
     SVGAnimateElement* resultAnimationElement = static_cast<SVGAnimateElement*>(resultElement);
@@ -177,10 +185,6 @@ void SVGAnimateElement::calculateAnimatedValue(float percentage, unsigned repeat
     if (hasTagName(SVGNames::setTag))
         percentage = 1;
 
-    SVGElement* targetElement = this->targetElement();
-    if (!targetElement)
-        return;
-
     // Target element might have changed.
     m_animator->setContextElement(targetElement);
     m_animator->calculateAnimatedValue(percentage, repeat, m_fromType, m_toType, resultAnimationElement->m_animatedType);
@@ -192,9 +196,8 @@ bool SVGAnimateElement::calculateFromAndToValues(const String& fromString, const
     if (!targetElement)
         return false;
 
-    m_animatedPropertyType = determineAnimatedPropertyType(targetElement);
-
     ensureAnimator()->calculateFromAndToValues(m_fromType, m_toType, fromString, toString);
+    ASSERT(m_animatedPropertyType == m_animator->type());
     return true;
 }
 
@@ -205,22 +208,19 @@ bool SVGAnimateElement::calculateFromAndByValues(const String& fromString, const
         return false;
 
     ASSERT(!hasTagName(SVGNames::setTag));
-    m_animatedPropertyType = determineAnimatedPropertyType(targetElement);
 
     ensureAnimator()->calculateFromAndByValues(m_fromType, m_toType, fromString, byString);
+    ASSERT(m_animatedPropertyType == m_animator->type());
     return true;
 }
 
 void SVGAnimateElement::resetToBaseValue(const String& baseString)
 {
-    SVGElement* targetElement = this->targetElement();
-    ASSERT(targetElement);
-    m_animatedPropertyType = determineAnimatedPropertyType(targetElement);
-
     if (!m_animatedType)
         m_animatedType = ensureAnimator()->constructFromString(baseString);
     else
         m_animatedType->setValueAsString(attributeName(), baseString);
+    ASSERT(m_animatedPropertyType == m_animator->type());
 }
     
 void SVGAnimateElement::applyResultsToTarget()
@@ -239,15 +239,24 @@ float SVGAnimateElement::calculateDistance(const String& fromString, const Strin
     SVGElement* targetElement = this->targetElement();
     if (!targetElement)
         return -1;
-    m_animatedPropertyType = determineAnimatedPropertyType(targetElement);
-    
+
     return ensureAnimator()->calculateDistance(fromString, toString);
 }
 
+void SVGAnimateElement::targetElementDidChange(SVGElement* targetElement)
+{
+    m_animatedType.clear();
+    m_fromType.clear();
+    m_toType.clear();
+    m_animator.clear();
+    m_animatedPropertyType = targetElement ? determineAnimatedPropertyType(targetElement) : AnimatedString;
+}
+
 SVGAnimatedTypeAnimator* SVGAnimateElement::ensureAnimator()
 {
     if (!m_animator)
         m_animator = SVGAnimatorFactory::create(this, targetElement(), m_animatedPropertyType);
+    ASSERT(m_animatedPropertyType == m_animator->type());
     return m_animator.get();
 }
 
diff --git a/Source/WebCore/svg/SVGAnimateElement.h b/Source/WebCore/svg/SVGAnimateElement.h
index d9ae3a28c..69cb9a6ed 100644
--- a/Source/WebCore/svg/SVGAnimateElement.h
+++ b/Source/WebCore/svg/SVGAnimateElement.h
@@ -45,7 +45,7 @@ public:
     static PassRefPtr<SVGAnimateElement> create(const QualifiedName&, Document*);
 
     virtual ~SVGAnimateElement();
-    
+
     static void adjustForCurrentColor(SVGElement* targetElement, Color&);
     void adjustForInheritance(SVGElement* targetElement, const QualifiedName&, String& value);
     
@@ -65,6 +65,8 @@ protected:
     virtual void applyResultsToTarget();
     virtual float calculateDistance(const String& fromString, const String& toString);
 
+    virtual void targetElementDidChange(SVGElement* targetElement) OVERRIDE;
+
 private:
     SVGAnimatedTypeAnimator* ensureAnimator();
     
diff --git a/Source/WebCore/svg/SVGAnimatedTypeAnimator.h b/Source/WebCore/svg/SVGAnimatedTypeAnimator.h
index 1524ed8e4..f3218647d 100644
--- a/Source/WebCore/svg/SVGAnimatedTypeAnimator.h
+++ b/Source/WebCore/svg/SVGAnimatedTypeAnimator.h
@@ -41,7 +41,9 @@ public:
     virtual float calculateDistance(const String& fromString, const String& toString) = 0;
 
     void setContextElement(SVGElement* contextElement) { m_contextElement = contextElement; }
-    
+
+    AnimatedPropertyType type() const { return m_type; }
+
 protected:
     SVGAnimatedTypeAnimator(AnimatedPropertyType type, SVGAnimationElement* animationElement, SVGElement* contextElement)
         : m_type(type)
diff --git a/Source/WebCore/svg/SVGAnimationElement.cpp b/Source/WebCore/svg/SVGAnimationElement.cpp
index bced2016d..2659dd9df 100644
--- a/Source/WebCore/svg/SVGAnimationElement.cpp
+++ b/Source/WebCore/svg/SVGAnimationElement.cpp
@@ -232,7 +232,7 @@ void SVGAnimationElement::beginElement()
 void SVGAnimationElement::beginElementAt(float offset)
 {
     SMILTime elapsed = this->elapsed();
-    addBeginTime(elapsed, elapsed + offset);
+    addBeginTime(elapsed, elapsed + offset, SMILTimeWithOrigin::ScriptOrigin);
 }
 
 void SVGAnimationElement::endElement()
@@ -243,7 +243,7 @@ void SVGAnimationElement::endElement()
 void SVGAnimationElement::endElementAt(float offset)
 {
     SMILTime elapsed = this->elapsed();
-    addEndTime(elapsed, elapsed + offset);
+    addEndTime(elapsed, elapsed + offset, SMILTimeWithOrigin::ScriptOrigin);
 }
 
 AnimationMode SVGAnimationElement::animationMode() const
@@ -624,9 +624,5 @@ void SVGAnimationElement::updateAnimation(float percent, unsigned repeat, SVGSMI
     calculateAnimatedValue(effectivePercent, repeat, resultElement);
 }
 
-void SVGAnimationElement::endedActiveInterval()
-{
-}
-
 }
 #endif // ENABLE(SVG)
diff --git a/Source/WebCore/svg/SVGAnimationElement.h b/Source/WebCore/svg/SVGAnimationElement.h
index 66c10d99e..495c1b244 100644
--- a/Source/WebCore/svg/SVGAnimationElement.h
+++ b/Source/WebCore/svg/SVGAnimationElement.h
@@ -104,7 +104,6 @@ protected:
     // from SVGSMILElement
     virtual void startedActiveInterval();
     virtual void updateAnimation(float percent, unsigned repeat, SVGSMILElement* resultElement);
-    virtual void endedActiveInterval();
 
 private:
     virtual void attributeChanged(Attribute*) OVERRIDE;
diff --git a/Source/WebCore/svg/SVGDocument.cpp b/Source/WebCore/svg/SVGDocument.cpp
index f5439489a..c29ede369 100644
--- a/Source/WebCore/svg/SVGDocument.cpp
+++ b/Source/WebCore/svg/SVGDocument.cpp
@@ -25,6 +25,7 @@
 #include "EventNames.h"
 #include "ExceptionCode.h"
 #include "FrameView.h"
+#include "NodeRenderingContext.h"
 #include "RenderView.h"
 #include "SVGElement.h"
 #include "SVGNames.h"
@@ -95,10 +96,10 @@ void SVGDocument::updatePan(const FloatPoint& pos) const
     }
 }
 
-bool SVGDocument::childShouldCreateRenderer(Node* node) const
+bool SVGDocument::childShouldCreateRenderer(const NodeRenderingContext& childContext) const
 {
-    if (node->hasTagName(SVGNames::svgTag))
-        return static_cast<SVGSVGElement*>(node)->isValid();
+    if (childContext.node()->hasTagName(SVGNames::svgTag))
+        return static_cast<SVGSVGElement*>(childContext.node())->isValid();
     return true;
 }
 
diff --git a/Source/WebCore/svg/SVGDocument.h b/Source/WebCore/svg/SVGDocument.h
index b93414526..a63787218 100644
--- a/Source/WebCore/svg/SVGDocument.h
+++ b/Source/WebCore/svg/SVGDocument.h
@@ -53,7 +53,7 @@ private:
 
     virtual bool isSVGDocument() const { return true; }
 
-    virtual bool childShouldCreateRenderer(Node*) const;
+    virtual bool childShouldCreateRenderer(const NodeRenderingContext&) const;
 
     FloatPoint m_translate;
 };
diff --git a/Source/WebCore/svg/SVGDocument.idl b/Source/WebCore/svg/SVGDocument.idl
index c5059f82e..2f9abfc2e 100644
--- a/Source/WebCore/svg/SVGDocument.idl
+++ b/Source/WebCore/svg/SVGDocument.idl
@@ -22,12 +22,13 @@
 module svg {
 
     interface [
-        Conditional=SVG
+        Conditional=SVG,
+        V8CustomToJSObject
     ] SVGDocument : Document {
         readonly attribute SVGSVGElement        rootElement;
 
         // Overwrite the one in events::DocumentEvent
-        Event createEvent(in [Optional=CallWithDefaultValue] DOMString eventType)
+        Event createEvent(in [Optional=DefaultIsUndefined] DOMString eventType)
             raises(DOMException);
     };
 
diff --git a/Source/WebCore/svg/SVGDocumentExtensions.cpp b/Source/WebCore/svg/SVGDocumentExtensions.cpp
index 6f19d800b..888bd5800 100644
--- a/Source/WebCore/svg/SVGDocumentExtensions.cpp
+++ b/Source/WebCore/svg/SVGDocumentExtensions.cpp
@@ -132,17 +132,6 @@ void SVGDocumentExtensions::dispatchSVGLoadEventToOutermostSVGElements()
     }
 }
 
-bool SVGDocumentExtensions::sampleAnimationAtTime(const String& elementId, SVGSMILElement* element, double time)
-{
-    ASSERT(element);
-    SMILTimeContainer* container = element->timeContainer();
-    if (!container || container->isPaused())
-        return false;
-
-    container->sampleAnimationAtTime(elementId, time);
-    return true;
-}
-
 void SVGDocumentExtensions::addAnimationElementToTarget(SVGSMILElement* animationElement, SVGElement* targetElement)
 {
     ASSERT(targetElement);
diff --git a/Source/WebCore/svg/SVGDocumentExtensions.h b/Source/WebCore/svg/SVGDocumentExtensions.h
index 36664c32c..48dae9737 100644
--- a/Source/WebCore/svg/SVGDocumentExtensions.h
+++ b/Source/WebCore/svg/SVGDocumentExtensions.h
@@ -56,7 +56,6 @@ public:
     void startAnimations();
     void pauseAnimations();
     void unpauseAnimations();
-    bool sampleAnimationAtTime(const String& elementId, SVGSMILElement*, double time);
     void dispatchSVGLoadEventToOutermostSVGElements();
     
     void addAnimationElementToTarget(SVGSMILElement*, SVGElement*);
diff --git a/Source/WebCore/svg/SVGElement.cpp b/Source/WebCore/svg/SVGElement.cpp
index f3d5874f3..24adcf794 100644
--- a/Source/WebCore/svg/SVGElement.cpp
+++ b/Source/WebCore/svg/SVGElement.cpp
@@ -36,6 +36,7 @@
 #include "EventNames.h"
 #include "FrameView.h"
 #include "HTMLNames.h"
+#include "NodeRenderingContext.h"
 #include "RegisteredEventListener.h"
 #include "RenderObject.h"
 #include "SVGCursorElement.h"
@@ -386,10 +387,10 @@ void SVGElement::finishParsingChildren()
     sendSVGLoadEventIfPossible();
 }
 
-bool SVGElement::childShouldCreateRenderer(Node* child) const
+bool SVGElement::childShouldCreateRenderer(const NodeRenderingContext& childContext) const
 {
-    if (child->isSVGElement())
-        return static_cast<SVGElement*>(child)->isValid();
+    if (childContext.node()->isSVGElement())
+        return static_cast<SVGElement*>(childContext.node())->isValid();
     return false;
 }
 
diff --git a/Source/WebCore/svg/SVGElement.h b/Source/WebCore/svg/SVGElement.h
index c5c5ac55f..4735690b3 100644
--- a/Source/WebCore/svg/SVGElement.h
+++ b/Source/WebCore/svg/SVGElement.h
@@ -114,7 +114,7 @@ protected:
 
     virtual void finishParsingChildren();
     virtual void attributeChanged(Attribute*) OVERRIDE;
-    virtual bool childShouldCreateRenderer(Node*) const;
+    virtual bool childShouldCreateRenderer(const NodeRenderingContext&) const;
     
     virtual void removedFromDocument();
 
diff --git a/Source/WebCore/svg/SVGElement.idl b/Source/WebCore/svg/SVGElement.idl
index 5e9b8312c..41ae9c24d 100644
--- a/Source/WebCore/svg/SVGElement.idl
+++ b/Source/WebCore/svg/SVGElement.idl
@@ -24,7 +24,8 @@ module svg {
 
     interface [
         JSGenerateToNativeObject,
-        Conditional=SVG
+        Conditional=SVG,
+        V8CustomToJSObject
     ] SVGElement : Element {
         attribute [Reflect] DOMString id;
         attribute [TreatNullAs=NullString] DOMString xmlbase setter raises(DOMException);
diff --git a/Source/WebCore/svg/SVGElementInstanceList.idl b/Source/WebCore/svg/SVGElementInstanceList.idl
index e710839ce..9429da719 100644
--- a/Source/WebCore/svg/SVGElementInstanceList.idl
+++ b/Source/WebCore/svg/SVGElementInstanceList.idl
@@ -29,6 +29,6 @@ module svg {
     ] SVGElementInstanceList {
         readonly attribute unsigned long length;
 
-        SVGElementInstance item(in [Optional=CallWithDefaultValue] unsigned long index);
+        SVGElementInstance item(in [Optional=DefaultIsUndefined] unsigned long index);
     };
 }
diff --git a/Source/WebCore/svg/SVGFEDropShadowElement.idl b/Source/WebCore/svg/SVGFEDropShadowElement.idl
index 91f654d99..3c7d7ce6b 100644
--- a/Source/WebCore/svg/SVGFEDropShadowElement.idl
+++ b/Source/WebCore/svg/SVGFEDropShadowElement.idl
@@ -29,8 +29,8 @@ module svg {
         readonly attribute SVGAnimatedNumber stdDeviationX;
         readonly attribute SVGAnimatedNumber stdDeviationY;
 
-        void setStdDeviation(in [Optional=CallWithDefaultValue] float stdDeviationX, 
-                             in [Optional=CallWithDefaultValue] float stdDeviationY);
+        void setStdDeviation(in [Optional=DefaultIsUndefined] float stdDeviationX, 
+                             in [Optional=DefaultIsUndefined] float stdDeviationY);
     };
 
 }
diff --git a/Source/WebCore/svg/SVGFEGaussianBlurElement.idl b/Source/WebCore/svg/SVGFEGaussianBlurElement.idl
index 5a01addd8..25858f80c 100644
--- a/Source/WebCore/svg/SVGFEGaussianBlurElement.idl
+++ b/Source/WebCore/svg/SVGFEGaussianBlurElement.idl
@@ -33,8 +33,8 @@ module svg {
         readonly attribute SVGAnimatedNumber stdDeviationX;
         readonly attribute SVGAnimatedNumber stdDeviationY;
 
-        void setStdDeviation(in [Optional=CallWithDefaultValue] float stdDeviationX, 
-                             in [Optional=CallWithDefaultValue] float stdDeviationY);
+        void setStdDeviation(in [Optional=DefaultIsUndefined] float stdDeviationX, 
+                             in [Optional=DefaultIsUndefined] float stdDeviationY);
     };
 
 }
diff --git a/Source/WebCore/svg/SVGFEMorphologyElement.idl b/Source/WebCore/svg/SVGFEMorphologyElement.idl
index b31d74fb6..24c0a47a9 100644
--- a/Source/WebCore/svg/SVGFEMorphologyElement.idl
+++ b/Source/WebCore/svg/SVGFEMorphologyElement.idl
@@ -40,8 +40,8 @@ module svg {
         readonly attribute SVGAnimatedNumber      radiusX;
         readonly attribute SVGAnimatedNumber      radiusY;
 
-        void setRadius(in [Optional=CallWithDefaultValue] float radiusX, 
-                       in [Optional=CallWithDefaultValue] float radiusY);
+        void setRadius(in [Optional=DefaultIsUndefined] float radiusX, 
+                       in [Optional=DefaultIsUndefined] float radiusY);
     };
 
 }
diff --git a/Source/WebCore/svg/SVGFilterElement.idl b/Source/WebCore/svg/SVGFilterElement.idl
index 4f984f469..ff2f49679 100644
--- a/Source/WebCore/svg/SVGFilterElement.idl
+++ b/Source/WebCore/svg/SVGFilterElement.idl
@@ -43,8 +43,8 @@ module svg {
         readonly attribute SVGAnimatedInteger     filterResX;
         readonly attribute SVGAnimatedInteger     filterResY;
 
-        void setFilterRes(in [Optional=CallWithDefaultValue] unsigned long filterResX, 
-                          in [Optional=CallWithDefaultValue] unsigned long filterResY);
+        void setFilterRes(in [Optional=DefaultIsUndefined] unsigned long filterResX, 
+                          in [Optional=DefaultIsUndefined] unsigned long filterResY);
     };
 
 }
diff --git a/Source/WebCore/svg/SVGFontFaceElement.cpp b/Source/WebCore/svg/SVGFontFaceElement.cpp
index 51fbc4447..98518de4d 100644
--- a/Source/WebCore/svg/SVGFontFaceElement.cpp
+++ b/Source/WebCore/svg/SVGFontFaceElement.cpp
@@ -51,7 +51,7 @@ inline SVGFontFaceElement::SVGFontFaceElement(const QualifiedName& tagName, Docu
     , m_fontFaceRule(CSSFontFaceRule::create())
 {
     ASSERT(hasTagName(font_faceTag));
-    RefPtr<StylePropertySet> styleDeclaration = StylePropertySet::create(m_fontFaceRule.get());
+    RefPtr<StylePropertySet> styleDeclaration = StylePropertySet::create();
     styleDeclaration->setStrictParsing(true);
     m_fontFaceRule->setDeclaration(styleDeclaration.release());
 }
@@ -328,6 +328,7 @@ void SVGFontFaceElement::removedFromDocument()
 {
     removeFromMappedElementSheet();
     SVGElement::removedFromDocument();
+    m_fontFaceRule->declaration()->parseDeclaration(emptyString(), 0);
 }
 
 void SVGFontFaceElement::childrenChanged(bool changedByParser, Node* beforeChange, Node* afterChange, int childCountDelta)
diff --git a/Source/WebCore/svg/SVGForeignObjectElement.cpp b/Source/WebCore/svg/SVGForeignObjectElement.cpp
index d792c47a1..1d7407931 100644
--- a/Source/WebCore/svg/SVGForeignObjectElement.cpp
+++ b/Source/WebCore/svg/SVGForeignObjectElement.cpp
@@ -25,6 +25,7 @@
 
 #include "Attribute.h"
 #include "CSSPropertyNames.h"
+#include "NodeRenderingContext.h"
 #include "RenderSVGForeignObject.h"
 #include "RenderSVGResource.h"
 #include "SVGElementInstance.h"
@@ -137,14 +138,14 @@ RenderObject* SVGForeignObjectElement::createRenderer(RenderArena* arena, Render
     return new (arena) RenderSVGForeignObject(this);
 }
 
-bool SVGForeignObjectElement::childShouldCreateRenderer(Node* child) const
+bool SVGForeignObjectElement::childShouldCreateRenderer(const NodeRenderingContext& childContext) const
 {
     // Disallow arbitary SVG content. Only allow proper <svg xmlns="svgNS"> subdocuments.
-    if (child->isSVGElement())
-        return child->hasTagName(SVGNames::svgTag);
+    if (childContext.node()->isSVGElement())
+        return childContext.node()->hasTagName(SVGNames::svgTag);
 
     // Skip over SVG rules which disallow non-SVG kids
-    return StyledElement::childShouldCreateRenderer(child);
+    return StyledElement::childShouldCreateRenderer(childContext);
 }
 
 bool SVGForeignObjectElement::selfHasRelativeLengths() const
diff --git a/Source/WebCore/svg/SVGForeignObjectElement.h b/Source/WebCore/svg/SVGForeignObjectElement.h
index 67266d5da..057ba0507 100644
--- a/Source/WebCore/svg/SVGForeignObjectElement.h
+++ b/Source/WebCore/svg/SVGForeignObjectElement.h
@@ -46,7 +46,7 @@ private:
     virtual void parseAttribute(Attribute*) OVERRIDE;
     virtual void svgAttributeChanged(const QualifiedName&);
 
-    virtual bool childShouldCreateRenderer(Node*) const;
+    virtual bool childShouldCreateRenderer(const NodeRenderingContext&) const;
     virtual RenderObject* createRenderer(RenderArena* arena, RenderStyle* style);
 
     virtual bool selfHasRelativeLengths() const;
diff --git a/Source/WebCore/svg/SVGImageElement.cpp b/Source/WebCore/svg/SVGImageElement.cpp
index bf10a1ea9..6f7fe9d1e 100644
--- a/Source/WebCore/svg/SVGImageElement.cpp
+++ b/Source/WebCore/svg/SVGImageElement.cpp
@@ -91,6 +91,23 @@ bool SVGImageElement::isSupportedAttribute(const QualifiedName& attrName)
     return supportedAttributes.contains<QualifiedName, SVGAttributeHashTranslator>(attrName);
 }
 
+bool SVGImageElement::isPresentationAttribute(Attribute* attr) const
+{
+    if (attr->name() == SVGNames::widthAttr || attr->name() == SVGNames::heightAttr)
+        return true;
+    return SVGStyledTransformableElement::isPresentationAttribute(attr);
+}
+
+void SVGImageElement::collectStyleForAttribute(Attribute* attr, StylePropertySet* style)
+{
+    if (!isSupportedAttribute(attr->name()))
+        SVGStyledTransformableElement::collectStyleForAttribute(attr, style);
+    else if (attr->name() == SVGNames::widthAttr)
+        addPropertyToAttributeStyle(style, CSSPropertyWidth, attr->value());
+    else if (attr->name() == SVGNames::heightAttr)
+        addPropertyToAttributeStyle(style, CSSPropertyHeight, attr->value());
+}
+
 void SVGImageElement::parseAttribute(Attribute* attr)
 {
     SVGParsingError parseError = NoError;
@@ -103,13 +120,11 @@ void SVGImageElement::parseAttribute(Attribute* attr)
         setYBaseValue(SVGLength::construct(LengthModeHeight, attr->value(), parseError));
     else if (attr->name() == SVGNames::preserveAspectRatioAttr)
         SVGPreserveAspectRatio::parsePreserveAspectRatio(this, attr->value());
-    else if (attr->name() == SVGNames::widthAttr) {
+    else if (attr->name() == SVGNames::widthAttr)
         setWidthBaseValue(SVGLength::construct(LengthModeWidth, attr->value(), parseError, ForbidNegativeLengths));
-        addCSSProperty(CSSPropertyWidth, attr->value());
-    } else if (attr->name() == SVGNames::heightAttr) {
+    else if (attr->name() == SVGNames::heightAttr)
         setHeightBaseValue(SVGLength::construct(LengthModeHeight, attr->value(), parseError, ForbidNegativeLengths));
-        addCSSProperty(CSSPropertyHeight, attr->value());
-    } else if (SVGTests::parseAttribute(attr)
+    else if (SVGTests::parseAttribute(attr)
              || SVGLangSpace::parseAttribute(attr)
              || SVGExternalResourcesRequired::parseAttribute(attr)
              || SVGURIReference::parseAttribute(attr)) {
diff --git a/Source/WebCore/svg/SVGImageElement.h b/Source/WebCore/svg/SVGImageElement.h
index 1fbbb0fd7..fb1229e23 100644
--- a/Source/WebCore/svg/SVGImageElement.h
+++ b/Source/WebCore/svg/SVGImageElement.h
@@ -50,6 +50,8 @@ private:
 
     bool isSupportedAttribute(const QualifiedName&);
     virtual void parseAttribute(Attribute*) OVERRIDE;
+    virtual bool isPresentationAttribute(Attribute*) const OVERRIDE;
+    virtual void collectStyleForAttribute(Attribute*, StylePropertySet*) OVERRIDE;
     virtual void svgAttributeChanged(const QualifiedName&);
 
     virtual void attach();
diff --git a/Source/WebCore/svg/SVGLengthContext.cpp b/Source/WebCore/svg/SVGLengthContext.cpp
index 36deeff46..d33de3456 100755..100644
--- a/Source/WebCore/svg/SVGLengthContext.cpp
+++ b/Source/WebCore/svg/SVGLengthContext.cpp
@@ -203,14 +203,31 @@ float SVGLengthContext::convertValueFromPercentageToUserUnits(float value, SVGLe
     return 0;
 }
 
+static inline RenderStyle* renderStyleForLengthResolving(const SVGElement* context)
+{
+    if (!context)
+        return 0;
+
+    const ContainerNode* currentContext = context;
+    while (currentContext) {
+        if (currentContext->renderer())
+            return currentContext->renderer()->style();
+        currentContext = currentContext->parentNode();
+    }
+
+    // There must be at least a RenderSVGRoot renderer, carrying a style.
+    ASSERT_NOT_REACHED();
+    return 0;
+}
+
 float SVGLengthContext::convertValueFromUserUnitsToEMS(float value, ExceptionCode& ec) const
 {
-    if (!m_context || !m_context->renderer() || !m_context->renderer()->style()) {
+    RenderStyle* style = renderStyleForLengthResolving(m_context);
+    if (!style) {
         ec = NOT_SUPPORTED_ERR;
         return 0;
     }
 
-    RenderStyle* style = m_context->renderer()->style();
     float fontSize = style->fontSize();
     if (!fontSize) {
         ec = NOT_SUPPORTED_ERR;
@@ -222,24 +239,23 @@ float SVGLengthContext::convertValueFromUserUnitsToEMS(float value, ExceptionCod
 
 float SVGLengthContext::convertValueFromEMSToUserUnits(float value, ExceptionCode& ec) const
 {
-    if (!m_context || !m_context->renderer() || !m_context->renderer()->style()) {
+    RenderStyle* style = renderStyleForLengthResolving(m_context);
+    if (!style) {
         ec = NOT_SUPPORTED_ERR;
         return 0;
     }
 
-    RenderStyle* style = m_context->renderer()->style();
     return value * style->fontSize();
 }
 
 float SVGLengthContext::convertValueFromUserUnitsToEXS(float value, ExceptionCode& ec) const
 {
-    if (!m_context || !m_context->renderer() || !m_context->renderer()->style()) {
+    RenderStyle* style = renderStyleForLengthResolving(m_context);
+    if (!style) {
         ec = NOT_SUPPORTED_ERR;
         return 0;
     }
 
-    RenderStyle* style = m_context->renderer()->style();
-
     // Use of ceil allows a pixel match to the W3Cs expected output of coords-units-03-b.svg
     // if this causes problems in real world cases maybe it would be best to remove this
     float xHeight = ceilf(style->fontMetrics().xHeight());
@@ -253,12 +269,12 @@ float SVGLengthContext::convertValueFromUserUnitsToEXS(float value, ExceptionCod
 
 float SVGLengthContext::convertValueFromEXSToUserUnits(float value, ExceptionCode& ec) const
 {
-    if (!m_context || !m_context->renderer() || !m_context->renderer()->style()) {
+    RenderStyle* style = renderStyleForLengthResolving(m_context);
+    if (!style) {
         ec = NOT_SUPPORTED_ERR;
         return 0;
     }
 
-    RenderStyle* style = m_context->renderer()->style();
     // Use of ceil allows a pixel match to the W3Cs expected output of coords-units-03-b.svg
     // if this causes problems in real world cases maybe it would be best to remove this
     return value * ceilf(style->fontMetrics().xHeight());
diff --git a/Source/WebCore/svg/SVGLocatable.idl b/Source/WebCore/svg/SVGLocatable.idl
index a83bca099..f626976dd 100644
--- a/Source/WebCore/svg/SVGLocatable.idl
+++ b/Source/WebCore/svg/SVGLocatable.idl
@@ -37,7 +37,7 @@ module svg {
         SVGRect   getBBox();
         SVGMatrix getCTM();
         SVGMatrix getScreenCTM();
-        SVGMatrix getTransformToElement(in [Optional=CallWithDefaultValue] SVGElement element)
+        SVGMatrix getTransformToElement(in [Optional=DefaultIsUndefined] SVGElement element)
             raises(SVGException);
     };
 
diff --git a/Source/WebCore/svg/SVGMarkerElement.idl b/Source/WebCore/svg/SVGMarkerElement.idl
index 1b136852e..dd351e320 100644
--- a/Source/WebCore/svg/SVGMarkerElement.idl
+++ b/Source/WebCore/svg/SVGMarkerElement.idl
@@ -51,7 +51,7 @@ module svg {
         readonly attribute SVGAnimatedAngle       orientAngle;
 
         void setOrientToAuto();
-        void setOrientToAngle(in [Optional=CallWithDefaultValue] SVGAngle angle);
+        void setOrientToAngle(in [Optional=DefaultIsUndefined] SVGAngle angle);
     };
 
 }
diff --git a/Source/WebCore/svg/SVGPathElement.idl b/Source/WebCore/svg/SVGPathElement.idl
index 89f637ed4..5f4f6cab6 100644
--- a/Source/WebCore/svg/SVGPathElement.idl
+++ b/Source/WebCore/svg/SVGPathElement.idl
@@ -37,77 +37,77 @@ module svg {
         readonly attribute SVGAnimatedNumber pathLength;
 
         float getTotalLength();
-        SVGPoint getPointAtLength(in [Optional=CallWithDefaultValue] float distance);
-        unsigned long getPathSegAtLength(in [Optional=CallWithDefaultValue] float distance);
+        SVGPoint getPointAtLength(in [Optional=DefaultIsUndefined] float distance);
+        unsigned long getPathSegAtLength(in [Optional=DefaultIsUndefined] float distance);
 
         SVGPathSegClosePath createSVGPathSegClosePath();
 
-        SVGPathSegMovetoAbs createSVGPathSegMovetoAbs(in [Optional=CallWithDefaultValue] float x, 
-                                                      in [Optional=CallWithDefaultValue] float y);
-        SVGPathSegMovetoRel createSVGPathSegMovetoRel(in [Optional=CallWithDefaultValue] float x, 
-                                                      in [Optional=CallWithDefaultValue] float y);
+        SVGPathSegMovetoAbs createSVGPathSegMovetoAbs(in [Optional=DefaultIsUndefined] float x, 
+                                                      in [Optional=DefaultIsUndefined] float y);
+        SVGPathSegMovetoRel createSVGPathSegMovetoRel(in [Optional=DefaultIsUndefined] float x, 
+                                                      in [Optional=DefaultIsUndefined] float y);
 
-        SVGPathSegLinetoAbs createSVGPathSegLinetoAbs(in [Optional=CallWithDefaultValue] float x, 
-                                                      in [Optional=CallWithDefaultValue] float y);
-        SVGPathSegLinetoRel createSVGPathSegLinetoRel(in [Optional=CallWithDefaultValue] float x, 
-                                                      in [Optional=CallWithDefaultValue] float y);
+        SVGPathSegLinetoAbs createSVGPathSegLinetoAbs(in [Optional=DefaultIsUndefined] float x, 
+                                                      in [Optional=DefaultIsUndefined] float y);
+        SVGPathSegLinetoRel createSVGPathSegLinetoRel(in [Optional=DefaultIsUndefined] float x, 
+                                                      in [Optional=DefaultIsUndefined] float y);
 
-        SVGPathSegCurvetoCubicAbs createSVGPathSegCurvetoCubicAbs(in [Optional=CallWithDefaultValue] float x, 
-                                                                  in [Optional=CallWithDefaultValue] float y, 
-                                                                  in [Optional=CallWithDefaultValue] float x1, 
-                                                                  in [Optional=CallWithDefaultValue] float y1, 
-                                                                  in [Optional=CallWithDefaultValue] float x2, 
-                                                                  in [Optional=CallWithDefaultValue] float y2);
-        SVGPathSegCurvetoCubicRel createSVGPathSegCurvetoCubicRel(in [Optional=CallWithDefaultValue] float x, 
-                                                                  in [Optional=CallWithDefaultValue] float y, 
-                                                                  in [Optional=CallWithDefaultValue] float x1, 
-                                                                  in [Optional=CallWithDefaultValue] float y1, 
-                                                                  in [Optional=CallWithDefaultValue] float x2, 
-                                                                  in [Optional=CallWithDefaultValue] float y2);
+        SVGPathSegCurvetoCubicAbs createSVGPathSegCurvetoCubicAbs(in [Optional=DefaultIsUndefined] float x, 
+                                                                  in [Optional=DefaultIsUndefined] float y, 
+                                                                  in [Optional=DefaultIsUndefined] float x1, 
+                                                                  in [Optional=DefaultIsUndefined] float y1, 
+                                                                  in [Optional=DefaultIsUndefined] float x2, 
+                                                                  in [Optional=DefaultIsUndefined] float y2);
+        SVGPathSegCurvetoCubicRel createSVGPathSegCurvetoCubicRel(in [Optional=DefaultIsUndefined] float x, 
+                                                                  in [Optional=DefaultIsUndefined] float y, 
+                                                                  in [Optional=DefaultIsUndefined] float x1, 
+                                                                  in [Optional=DefaultIsUndefined] float y1, 
+                                                                  in [Optional=DefaultIsUndefined] float x2, 
+                                                                  in [Optional=DefaultIsUndefined] float y2);
 
-        SVGPathSegCurvetoQuadraticAbs createSVGPathSegCurvetoQuadraticAbs(in [Optional=CallWithDefaultValue] float x, 
-                                                                          in [Optional=CallWithDefaultValue] float y, 
-                                                                          in [Optional=CallWithDefaultValue] float x1, 
-                                                                          in [Optional=CallWithDefaultValue] float y1);
-        SVGPathSegCurvetoQuadraticRel createSVGPathSegCurvetoQuadraticRel(in [Optional=CallWithDefaultValue] float x, 
-                                                                          in [Optional=CallWithDefaultValue] float y, 
-                                                                          in [Optional=CallWithDefaultValue] float x1, 
-                                                                          in [Optional=CallWithDefaultValue] float y1);
+        SVGPathSegCurvetoQuadraticAbs createSVGPathSegCurvetoQuadraticAbs(in [Optional=DefaultIsUndefined] float x, 
+                                                                          in [Optional=DefaultIsUndefined] float y, 
+                                                                          in [Optional=DefaultIsUndefined] float x1, 
+                                                                          in [Optional=DefaultIsUndefined] float y1);
+        SVGPathSegCurvetoQuadraticRel createSVGPathSegCurvetoQuadraticRel(in [Optional=DefaultIsUndefined] float x, 
+                                                                          in [Optional=DefaultIsUndefined] float y, 
+                                                                          in [Optional=DefaultIsUndefined] float x1, 
+                                                                          in [Optional=DefaultIsUndefined] float y1);
 
-        SVGPathSegArcAbs createSVGPathSegArcAbs(in [Optional=CallWithDefaultValue] float x, 
-                                                in [Optional=CallWithDefaultValue] float y, 
-                                                in [Optional=CallWithDefaultValue] float r1, 
-                                                in [Optional=CallWithDefaultValue] float r2, 
-                                                in [Optional=CallWithDefaultValue] float angle, 
-                                                in [Optional=CallWithDefaultValue] boolean largeArcFlag, 
-                                                in [Optional=CallWithDefaultValue] boolean sweepFlag);
-        SVGPathSegArcRel createSVGPathSegArcRel(in [Optional=CallWithDefaultValue] float x, 
-                                                in [Optional=CallWithDefaultValue] float y, 
-                                                in [Optional=CallWithDefaultValue] float r1, 
-                                                in [Optional=CallWithDefaultValue] float r2, 
-                                                in [Optional=CallWithDefaultValue] float angle, 
-                                                in [Optional=CallWithDefaultValue] boolean largeArcFlag, 
-                                                in [Optional=CallWithDefaultValue] boolean sweepFlag);
+        SVGPathSegArcAbs createSVGPathSegArcAbs(in [Optional=DefaultIsUndefined] float x, 
+                                                in [Optional=DefaultIsUndefined] float y, 
+                                                in [Optional=DefaultIsUndefined] float r1, 
+                                                in [Optional=DefaultIsUndefined] float r2, 
+                                                in [Optional=DefaultIsUndefined] float angle, 
+                                                in [Optional=DefaultIsUndefined] boolean largeArcFlag, 
+                                                in [Optional=DefaultIsUndefined] boolean sweepFlag);
+        SVGPathSegArcRel createSVGPathSegArcRel(in [Optional=DefaultIsUndefined] float x, 
+                                                in [Optional=DefaultIsUndefined] float y, 
+                                                in [Optional=DefaultIsUndefined] float r1, 
+                                                in [Optional=DefaultIsUndefined] float r2, 
+                                                in [Optional=DefaultIsUndefined] float angle, 
+                                                in [Optional=DefaultIsUndefined] boolean largeArcFlag, 
+                                                in [Optional=DefaultIsUndefined] boolean sweepFlag);
 
-        SVGPathSegLinetoHorizontalAbs createSVGPathSegLinetoHorizontalAbs(in [Optional=CallWithDefaultValue] float x);
-        SVGPathSegLinetoHorizontalRel createSVGPathSegLinetoHorizontalRel(in [Optional=CallWithDefaultValue] float x);
+        SVGPathSegLinetoHorizontalAbs createSVGPathSegLinetoHorizontalAbs(in [Optional=DefaultIsUndefined] float x);
+        SVGPathSegLinetoHorizontalRel createSVGPathSegLinetoHorizontalRel(in [Optional=DefaultIsUndefined] float x);
 
-        SVGPathSegLinetoVerticalAbs createSVGPathSegLinetoVerticalAbs(in [Optional=CallWithDefaultValue] float y);
-        SVGPathSegLinetoVerticalRel createSVGPathSegLinetoVerticalRel(in [Optional=CallWithDefaultValue] float y);
+        SVGPathSegLinetoVerticalAbs createSVGPathSegLinetoVerticalAbs(in [Optional=DefaultIsUndefined] float y);
+        SVGPathSegLinetoVerticalRel createSVGPathSegLinetoVerticalRel(in [Optional=DefaultIsUndefined] float y);
 
-        SVGPathSegCurvetoCubicSmoothAbs createSVGPathSegCurvetoCubicSmoothAbs(in [Optional=CallWithDefaultValue] float x, 
-                                                                              in [Optional=CallWithDefaultValue] float y, 
-                                                                              in [Optional=CallWithDefaultValue] float x2, 
-                                                                              in [Optional=CallWithDefaultValue] float y2);
-        SVGPathSegCurvetoCubicSmoothRel createSVGPathSegCurvetoCubicSmoothRel(in [Optional=CallWithDefaultValue] float x, 
-                                                                              in [Optional=CallWithDefaultValue] float y, 
-                                                                              in [Optional=CallWithDefaultValue] float x2, 
-                                                                              in [Optional=CallWithDefaultValue] float y2);
+        SVGPathSegCurvetoCubicSmoothAbs createSVGPathSegCurvetoCubicSmoothAbs(in [Optional=DefaultIsUndefined] float x, 
+                                                                              in [Optional=DefaultIsUndefined] float y, 
+                                                                              in [Optional=DefaultIsUndefined] float x2, 
+                                                                              in [Optional=DefaultIsUndefined] float y2);
+        SVGPathSegCurvetoCubicSmoothRel createSVGPathSegCurvetoCubicSmoothRel(in [Optional=DefaultIsUndefined] float x, 
+                                                                              in [Optional=DefaultIsUndefined] float y, 
+                                                                              in [Optional=DefaultIsUndefined] float x2, 
+                                                                              in [Optional=DefaultIsUndefined] float y2);
 
-        SVGPathSegCurvetoQuadraticSmoothAbs createSVGPathSegCurvetoQuadraticSmoothAbs(in [Optional=CallWithDefaultValue] float x, 
-                                                                                      in [Optional=CallWithDefaultValue] float y);
-        SVGPathSegCurvetoQuadraticSmoothRel createSVGPathSegCurvetoQuadraticSmoothRel(in [Optional=CallWithDefaultValue] float x, 
-                                                                                      in [Optional=CallWithDefaultValue] float y);
+        SVGPathSegCurvetoQuadraticSmoothAbs createSVGPathSegCurvetoQuadraticSmoothAbs(in [Optional=DefaultIsUndefined] float x, 
+                                                                                      in [Optional=DefaultIsUndefined] float y);
+        SVGPathSegCurvetoQuadraticSmoothRel createSVGPathSegCurvetoQuadraticSmoothRel(in [Optional=DefaultIsUndefined] float x, 
+                                                                                      in [Optional=DefaultIsUndefined] float y);
 
         readonly attribute SVGPathSegList pathSegList;
         readonly attribute SVGPathSegList normalizedPathSegList;
diff --git a/Source/WebCore/svg/SVGPathSeg.idl b/Source/WebCore/svg/SVGPathSeg.idl
index 5b967c2c9..e7ad75a8b 100644
--- a/Source/WebCore/svg/SVGPathSeg.idl
+++ b/Source/WebCore/svg/SVGPathSeg.idl
@@ -28,7 +28,7 @@ module svg {
 
     interface [
         Conditional=SVG,
-        JSCustomToJS,
+        CustomToJSObject,
         ObjCPolymorphic
     ] SVGPathSeg {
         // Path Segment Types
diff --git a/Source/WebCore/svg/SVGSVGElement.cpp b/Source/WebCore/svg/SVGSVGElement.cpp
index 8d6f1b03a..d381603ae 100644
--- a/Source/WebCore/svg/SVGSVGElement.cpp
+++ b/Source/WebCore/svg/SVGSVGElement.cpp
@@ -37,6 +37,7 @@
 #include "FrameTree.h"
 #include "FrameView.h"
 #include "HTMLNames.h"
+#include "RenderObject.h"
 #include "RenderPart.h"
 #include "RenderSVGResource.h"
 #include "RenderSVGModelObject.h"
@@ -286,25 +287,29 @@ void SVGSVGElement::parseAttribute(Attribute* attr)
 
 void SVGSVGElement::svgAttributeChanged(const QualifiedName& attrName)
 { 
-    bool updateRelativeLengths = false;
+    bool updateRelativeLengthsOrViewBox = false;
     if (attrName == SVGNames::widthAttr
         || attrName == SVGNames::heightAttr
         || attrName == SVGNames::xAttr
-        || attrName == SVGNames::yAttr
-        || SVGFitToViewBox::isKnownAttribute(attrName)) {
-        updateRelativeLengths = true;
+        || attrName == SVGNames::yAttr) {
+        updateRelativeLengthsOrViewBox = true;
         updateRelativeLengthsInformation();
     }
 
+    if (SVGFitToViewBox::isKnownAttribute(attrName)) {
+        updateRelativeLengthsOrViewBox = true; 
+        if (RenderObject* object = renderer())
+            object->setNeedsTransformUpdate();
+    }
+
     SVGElementInstance::InvalidationGuard invalidationGuard(this);
     if (SVGTests::handleAttributeChange(this, attrName))
         return;
 
-    if (updateRelativeLengths
+    if (updateRelativeLengthsOrViewBox
         || SVGLangSpace::isKnownAttribute(attrName)
         || SVGExternalResourcesRequired::isKnownAttribute(attrName)
-        || SVGZoomAndPan::isKnownAttribute(attrName)
-        || attrName == SVGNames::viewBoxAttr) {
+        || SVGZoomAndPan::isKnownAttribute(attrName)) {
         if (renderer())
             RenderSVGResource::markForLayoutAndParentResourceInvalidation(renderer());
         return;
@@ -550,12 +555,12 @@ FloatSize SVGSVGElement::currentViewportSize() const
         return FloatSize();
 
     if (renderer()->isSVGRoot()) {
-        LayoutRect frameRect = toRenderSVGRoot(renderer())->frameRect();
-        return FloatSize(frameRect.width() / renderer()->style()->effectiveZoom(), frameRect.height() / renderer()->style()->effectiveZoom());
+        LayoutRect contentBoxRect = toRenderSVGRoot(renderer())->contentBoxRect();
+        return FloatSize(contentBoxRect.width() / renderer()->style()->effectiveZoom(), contentBoxRect.height() / renderer()->style()->effectiveZoom());
     }
 
-    FloatRect frameRect = toRenderSVGViewportContainer(renderer())->viewport();
-    return FloatSize(frameRect.width() / renderer()->style()->effectiveZoom(), frameRect.height() / renderer()->style()->effectiveZoom());
+    FloatRect viewportRect = toRenderSVGViewportContainer(renderer())->viewport();
+    return FloatSize(viewportRect.width() / renderer()->style()->effectiveZoom(), viewportRect.height() / renderer()->style()->effectiveZoom());
 }
 
 bool SVGSVGElement::widthAttributeEstablishesViewport() const
@@ -726,7 +731,7 @@ Element* SVGSVGElement::getElementById(const AtomicString& id) const
             continue;
 
         Element* element = static_cast<Element*>(node);
-        if (element->hasID() && element->getIdAttribute() == id)
+        if (element->getIdAttribute() == id)
             return element;
     }
     return 0;
diff --git a/Source/WebCore/svg/SVGSVGElement.idl b/Source/WebCore/svg/SVGSVGElement.idl
index ff0309a0d..8fcd3d81e 100644
--- a/Source/WebCore/svg/SVGSVGElement.idl
+++ b/Source/WebCore/svg/SVGSVGElement.idl
@@ -55,23 +55,23 @@ module svg {
                      /*setter raises(DOMException)*/;
         readonly attribute SVGPoint currentTranslate;
 
-        unsigned long suspendRedraw(in [Optional=CallWithDefaultValue] unsigned long maxWaitMilliseconds);
-        void unsuspendRedraw(in [Optional=CallWithDefaultValue] unsigned long suspendHandleId);
+        unsigned long suspendRedraw(in [Optional=DefaultIsUndefined] unsigned long maxWaitMilliseconds);
+        void unsuspendRedraw(in [Optional=DefaultIsUndefined] unsigned long suspendHandleId);
         void unsuspendRedrawAll();
         void forceRedraw();
         void pauseAnimations();
         void unpauseAnimations();
         boolean animationsPaused();
         float getCurrentTime();
-        void setCurrentTime(in [Optional=CallWithDefaultValue] float seconds);
-        NodeList getIntersectionList(in [Optional=CallWithDefaultValue] SVGRect rect, 
-                                     in [Optional=CallWithDefaultValue] SVGElement referenceElement);
-        NodeList getEnclosureList(in [Optional=CallWithDefaultValue] SVGRect rect, 
-                                  in [Optional=CallWithDefaultValue] SVGElement referenceElement);
-        boolean checkIntersection(in [Optional=CallWithDefaultValue] SVGElement element, 
-                                  in [Optional=CallWithDefaultValue] SVGRect rect);
-        boolean checkEnclosure(in [Optional=CallWithDefaultValue] SVGElement element, 
-                               in [Optional=CallWithDefaultValue] SVGRect rect);
+        void setCurrentTime(in [Optional=DefaultIsUndefined] float seconds);
+        NodeList getIntersectionList(in [Optional=DefaultIsUndefined] SVGRect rect, 
+                                     in [Optional=DefaultIsUndefined] SVGElement referenceElement);
+        NodeList getEnclosureList(in [Optional=DefaultIsUndefined] SVGRect rect, 
+                                  in [Optional=DefaultIsUndefined] SVGElement referenceElement);
+        boolean checkIntersection(in [Optional=DefaultIsUndefined] SVGElement element, 
+                                  in [Optional=DefaultIsUndefined] SVGRect rect);
+        boolean checkEnclosure(in [Optional=DefaultIsUndefined] SVGElement element, 
+                               in [Optional=DefaultIsUndefined] SVGRect rect);
         void deselectAll();
 
         SVGNumber createSVGNumber();
@@ -81,8 +81,8 @@ module svg {
         SVGMatrix createSVGMatrix();
         SVGRect createSVGRect();
         SVGTransform createSVGTransform();
-        SVGTransform createSVGTransformFromMatrix(in [Optional=CallWithDefaultValue] SVGMatrix matrix);
-        Element getElementById(in [Optional=CallWithDefaultValue] DOMString elementId);
+        SVGTransform createSVGTransformFromMatrix(in [Optional=DefaultIsUndefined] SVGMatrix matrix);
+        Element getElementById(in [Optional=DefaultIsUndefined] DOMString elementId);
     };
 
 }
diff --git a/Source/WebCore/svg/SVGStylable.idl b/Source/WebCore/svg/SVGStylable.idl
index 481eec34f..3e06563f0 100644
--- a/Source/WebCore/svg/SVGStylable.idl
+++ b/Source/WebCore/svg/SVGStylable.idl
@@ -35,7 +35,7 @@ module svg {
         readonly attribute SVGAnimatedString className;
         readonly attribute CSSStyleDeclaration style;
 
-        CSSValue getPresentationAttribute(in [Optional=CallWithDefaultValue] DOMString name);
+        CSSValue getPresentationAttribute(in [Optional=DefaultIsUndefined] DOMString name);
     };
 
 }
diff --git a/Source/WebCore/svg/SVGStyledElement.cpp b/Source/WebCore/svg/SVGStyledElement.cpp
index 518b5b3ee..dd159a099 100644
--- a/Source/WebCore/svg/SVGStyledElement.cpp
+++ b/Source/WebCore/svg/SVGStyledElement.cpp
@@ -292,15 +292,22 @@ bool SVGStyledElement::isAnimatableCSSProperty(const QualifiedName& attrName)
     return cssPropertyToTypeMap().contains(attrName);
 }
 
+bool SVGStyledElement::isPresentationAttribute(Attribute* attr) const
+{
+    if (SVGStyledElement::cssPropertyIdForSVGAttributeName(attr->name()) > 0)
+        return true;
+    return SVGElement::isPresentationAttribute(attr);
+}
+
+void SVGStyledElement::collectStyleForAttribute(Attribute* attr, StylePropertySet* style)
+{
+    int propertyID = SVGStyledElement::cssPropertyIdForSVGAttributeName(attr->name());
+    if (propertyID > 0)
+        addPropertyToAttributeStyle(style, propertyID, attr->value());
+}
+
 void SVGStyledElement::parseAttribute(Attribute* attr)
 {
-    int propId = SVGStyledElement::cssPropertyIdForSVGAttributeName(attr->name());
-    if (propId > 0) {
-        addCSSProperty(propId, attr->value());
-        setNeedsStyleRecalc();
-        return;
-    }
-    
     // SVG animation has currently requires special storage of values so we set
     // the className here.  svgAttributeChanged actually causes the resulting
     // style updates (instead of StyledElement::parseAttribute). We don't
diff --git a/Source/WebCore/svg/SVGStyledElement.h b/Source/WebCore/svg/SVGStyledElement.h
index 3df4c93fc..7a400641c 100644
--- a/Source/WebCore/svg/SVGStyledElement.h
+++ b/Source/WebCore/svg/SVGStyledElement.h
@@ -66,6 +66,8 @@ protected:
     virtual bool rendererIsNeeded(const NodeRenderingContext&);
 
     virtual void parseAttribute(Attribute*) OVERRIDE;
+    virtual bool isPresentationAttribute(Attribute*) const OVERRIDE;
+    virtual void collectStyleForAttribute(Attribute*, StylePropertySet*) OVERRIDE;
     virtual void svgAttributeChanged(const QualifiedName&);
 
     virtual void attach();
diff --git a/Source/WebCore/svg/SVGSwitchElement.cpp b/Source/WebCore/svg/SVGSwitchElement.cpp
index 79a00ac92..7b976b2c0 100644
--- a/Source/WebCore/svg/SVGSwitchElement.cpp
+++ b/Source/WebCore/svg/SVGSwitchElement.cpp
@@ -23,6 +23,7 @@
 #if ENABLE(SVG)
 #include "SVGSwitchElement.h"
 
+#include "NodeRenderingContext.h"
 #include "RenderSVGTransformableContainer.h"
 #include "SVGNames.h"
 
@@ -49,7 +50,7 @@ PassRefPtr<SVGSwitchElement> SVGSwitchElement::create(const QualifiedName& tagNa
     return adoptRef(new SVGSwitchElement(tagName, document));
 }
 
-bool SVGSwitchElement::childShouldCreateRenderer(Node* child) const
+bool SVGSwitchElement::childShouldCreateRenderer(const NodeRenderingContext& childContext) const
 {
     // FIXME: This function does not do what the comment below implies it does.
     // It will create a renderer for any valid SVG element children, not just the first one.
@@ -61,7 +62,7 @@ bool SVGSwitchElement::childShouldCreateRenderer(Node* child) const
         if (!element || !element->isValid())
             continue;
 
-        return node == child; // Only allow this child if it's the first valid child
+        return node == childContext.node(); // Only allow this child if it's the first valid child
     }
 
     return false;
diff --git a/Source/WebCore/svg/SVGSwitchElement.h b/Source/WebCore/svg/SVGSwitchElement.h
index 073a03851..1bf7e6cd4 100644
--- a/Source/WebCore/svg/SVGSwitchElement.h
+++ b/Source/WebCore/svg/SVGSwitchElement.h
@@ -43,7 +43,7 @@ private:
     virtual bool isValid() const { return SVGTests::isValid(); }
     virtual bool supportsFocus() const { return true; }
 
-    virtual bool childShouldCreateRenderer(Node*) const;
+    virtual bool childShouldCreateRenderer(const NodeRenderingContext&) const;
 
     virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
 
diff --git a/Source/WebCore/svg/SVGTRefElement.cpp b/Source/WebCore/svg/SVGTRefElement.cpp
index 300b8c9fb..90b2d9985 100644
--- a/Source/WebCore/svg/SVGTRefElement.cpp
+++ b/Source/WebCore/svg/SVGTRefElement.cpp
@@ -27,10 +27,12 @@
 #include "EventListener.h"
 #include "EventNames.h"
 #include "MutationEvent.h"
+#include "NodeRenderingContext.h"
 #include "RenderSVGInline.h"
 #include "RenderSVGInlineText.h"
 #include "RenderSVGResource.h"
 #include "ShadowRoot.h"
+#include "ShadowRootList.h"
 #include "SVGDocument.h"
 #include "SVGElementInstance.h"
 #include "SVGNames.h"
@@ -56,19 +58,21 @@ inline SVGTRefElement::SVGTRefElement(const QualifiedName& tagName, Document* do
 
 PassRefPtr<SVGTRefElement> SVGTRefElement::create(const QualifiedName& tagName, Document* document)
 {
-    return adoptRef(new SVGTRefElement(tagName, document));
+    RefPtr<SVGTRefElement> element = adoptRef(new SVGTRefElement(tagName, document));
+    element->createShadowSubtree();
+    return element.release();
 }
 
-class SubtreeModificationEventListener : public EventListener {
+class TargetListener : public EventListener {
 public:
-    static PassRefPtr<SubtreeModificationEventListener> create(SVGTRefElement* trefElement, String targetId)
+    static PassRefPtr<TargetListener> create(SVGTRefElement* trefElement, String targetId)
     {
-        return adoptRef(new SubtreeModificationEventListener(trefElement, targetId));
+        return adoptRef(new TargetListener(trefElement, targetId));
     }
 
-    static const SubtreeModificationEventListener* cast(const EventListener* listener)
+    static const TargetListener* cast(const EventListener* listener)
     {
-        return listener->type() == CPPEventListenerType ? static_cast<const SubtreeModificationEventListener*>(listener) : 0;
+        return listener->type() == CPPEventListenerType ? static_cast<const TargetListener*>(listener) : 0;
     }
 
     virtual bool operator==(const EventListener&);
@@ -76,15 +80,17 @@ public:
     void clear()
     {
         Element* target = m_trefElement->treeScope()->getElementById(m_targetId);
-        if (target && target->parentNode())
-            target->parentNode()->removeEventListener(eventNames().DOMSubtreeModifiedEvent, this, false);
+        if (target) {
+            target->removeEventListener(eventNames().DOMSubtreeModifiedEvent, this, false);
+            target->removeEventListener(eventNames().DOMNodeRemovedFromDocumentEvent, this, false);
+        }
         
         m_trefElement = 0;
         m_targetId = String();
     }
 
 private:
-    SubtreeModificationEventListener(SVGTRefElement* trefElement, String targetId)
+    TargetListener(SVGTRefElement* trefElement, String targetId)
         : EventListener(CPPEventListenerType)
         , m_trefElement(trefElement)
         , m_targetId(targetId)
@@ -97,17 +103,20 @@ private:
     String m_targetId;
 };
 
-bool SubtreeModificationEventListener::operator==(const EventListener& listener)
+bool TargetListener::operator==(const EventListener& listener)
 {
-    if (const SubtreeModificationEventListener* subtreeModificationEventListener = SubtreeModificationEventListener::cast(&listener))
+    if (const TargetListener* subtreeModificationEventListener = TargetListener::cast(&listener))
         return m_trefElement == subtreeModificationEventListener->m_trefElement;
     return false;
 }
 
-void SubtreeModificationEventListener::handleEvent(ScriptExecutionContext*, Event* event)
+void TargetListener::handleEvent(ScriptExecutionContext*, Event* event)
 {
     if (m_trefElement && event->type() == eventNames().DOMSubtreeModifiedEvent && m_trefElement != event->target())
         m_trefElement->updateReferencedText();
+
+    if (m_trefElement && event->type() == eventNames().DOMNodeRemovedFromDocumentEvent)
+        m_trefElement->detachTarget();
 }
 
 class SVGShadowText : public Text {
@@ -144,18 +153,43 @@ SVGTRefElement::~SVGTRefElement()
     clearEventListener();
 }
 
+void SVGTRefElement::createShadowSubtree()
+{
+    ShadowRoot::create(this, ShadowRoot::CreatingUserAgentShadowRoot, ASSERT_NO_EXCEPTION);
+}
+
 void SVGTRefElement::updateReferencedText()
 {
-    Element* target = SVGURIReference::targetElementFromIRIString(href(), document());
-    ASSERT(target);
     String textContent;
-    if (target->parentNode())
+    if (Element* target = SVGURIReference::targetElementFromIRIString(href(), document()))
         textContent = target->textContent();
-    ExceptionCode ignore = 0;
-    if (!ensureShadowRoot()->firstChild())
-        shadowRoot()->appendChild(SVGShadowText::create(document(), textContent), ignore);
+
+    ASSERT(hasShadowRoot());
+    ShadowRoot* root = shadowRootList()->oldestShadowRoot();
+    if (!root->firstChild())
+        root->appendChild(SVGShadowText::create(document(), textContent), ASSERT_NO_EXCEPTION);
     else
-        shadowRoot()->firstChild()->setTextContent(textContent, ignore);
+        root->firstChild()->setTextContent(textContent, ASSERT_NO_EXCEPTION);
+}
+
+void SVGTRefElement::detachTarget()
+{
+    // Remove active listeners and clear the text content.
+    clearEventListener();
+
+    String emptyContent;
+    ExceptionCode ignore = 0;
+
+    ASSERT(hasShadowRoot());
+    Node* container = shadowRootList()->oldestShadowRoot()->firstChild();
+    if (container)
+        container->setTextContent(emptyContent, ignore);
+
+    // Mark the referenced ID as pending.
+    String id;
+    SVGURIReference::targetElementFromIRIString(href(), document(), &id);
+    if (!hasPendingResources() && !id.isEmpty())
+        document()->accessSVGExtensions()->addPendingResource(id, this);
 }
 
 bool SVGTRefElement::isSupportedAttribute(const QualifiedName& attrName)
@@ -204,9 +238,9 @@ RenderObject* SVGTRefElement::createRenderer(RenderArena* arena, RenderStyle*)
     return new (arena) RenderSVGInline(this);
 }
 
-bool SVGTRefElement::childShouldCreateRenderer(Node* child) const
+bool SVGTRefElement::childShouldCreateRenderer(const NodeRenderingContext& childContext) const
 {
-    return child->isInShadowTree();
+    return childContext.node()->isInShadowTree();
 }
 
 bool SVGTRefElement::rendererIsNeeded(const NodeRenderingContext& context)
@@ -247,9 +281,9 @@ void SVGTRefElement::buildPendingResource()
     if (!inDocument())
         return;
 
-    m_eventListener = SubtreeModificationEventListener::create(this, id);
-    ASSERT(target->parentNode());
-    target->parentNode()->addEventListener(eventNames().DOMSubtreeModifiedEvent, m_eventListener.get(), false);
+    m_eventListener = TargetListener::create(this, id);
+    target->addEventListener(eventNames().DOMSubtreeModifiedEvent, m_eventListener.get(), false);
+    target->addEventListener(eventNames().DOMNodeRemovedFromDocumentEvent, m_eventListener.get(), false);
 }
 
 void SVGTRefElement::insertedIntoDocument()
diff --git a/Source/WebCore/svg/SVGTRefElement.h b/Source/WebCore/svg/SVGTRefElement.h
index 17a8acd59..18cbded2f 100644
--- a/Source/WebCore/svg/SVGTRefElement.h
+++ b/Source/WebCore/svg/SVGTRefElement.h
@@ -27,7 +27,7 @@
 
 namespace WebCore {
 
-class SubtreeModificationEventListener;
+class TargetListener;
 
 class SVGTRefElement : public SVGTextPositioningElement,
                        public SVGURIReference {
@@ -35,17 +35,19 @@ public:
     static PassRefPtr<SVGTRefElement> create(const QualifiedName&, Document*);
 
 private:
-    friend class SubtreeModificationEventListener;
+    friend class TargetListener;
 
     SVGTRefElement(const QualifiedName&, Document*);
     virtual ~SVGTRefElement();
 
+    void createShadowSubtree();
+
     bool isSupportedAttribute(const QualifiedName&);
     virtual void parseAttribute(Attribute*) OVERRIDE;
     virtual void svgAttributeChanged(const QualifiedName&);
 
     virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
-    virtual bool childShouldCreateRenderer(Node*) const;
+    virtual bool childShouldCreateRenderer(const NodeRenderingContext&) const;
     virtual bool rendererIsNeeded(const NodeRenderingContext&);
 
     virtual void insertedIntoDocument();
@@ -55,13 +57,15 @@ private:
 
     void updateReferencedText();
 
+    void detachTarget();
+
     virtual void buildPendingResource();
 
     BEGIN_DECLARE_ANIMATED_PROPERTIES(SVGTRefElement)
         DECLARE_ANIMATED_STRING(Href, href)
     END_DECLARE_ANIMATED_PROPERTIES
 
-    RefPtr<SubtreeModificationEventListener> m_eventListener;
+    RefPtr<TargetListener> m_eventListener;
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/svg/SVGTSpanElement.cpp b/Source/WebCore/svg/SVGTSpanElement.cpp
index 3219e6533..d13120d90 100644
--- a/Source/WebCore/svg/SVGTSpanElement.cpp
+++ b/Source/WebCore/svg/SVGTSpanElement.cpp
@@ -23,6 +23,7 @@
 #if ENABLE(SVG)
 #include "SVGTSpanElement.h"
 
+#include "NodeRenderingContext.h"
 #include "RenderInline.h"
 #include "RenderSVGTSpan.h"
 #include "SVGNames.h"
@@ -45,15 +46,15 @@ RenderObject* SVGTSpanElement::createRenderer(RenderArena* arena, RenderStyle*)
     return new (arena) RenderSVGTSpan(this);
 }
 
-bool SVGTSpanElement::childShouldCreateRenderer(Node* child) const
+bool SVGTSpanElement::childShouldCreateRenderer(const NodeRenderingContext& childContext) const
 {
-    if (child->isTextNode()
-        || child->hasTagName(SVGNames::aTag)
+    if (childContext.node()->isTextNode()
+        || childContext.node()->hasTagName(SVGNames::aTag)
 #if ENABLE(SVG_FONTS)
-        || child->hasTagName(SVGNames::altGlyphTag)
+        || childContext.node()->hasTagName(SVGNames::altGlyphTag)
 #endif
-        || child->hasTagName(SVGNames::trefTag)
-        || child->hasTagName(SVGNames::tspanTag))
+        || childContext.node()->hasTagName(SVGNames::trefTag)
+        || childContext.node()->hasTagName(SVGNames::tspanTag))
         return true;
 
     return false;
diff --git a/Source/WebCore/svg/SVGTSpanElement.h b/Source/WebCore/svg/SVGTSpanElement.h
index 287cab41a..5ebab4475 100644
--- a/Source/WebCore/svg/SVGTSpanElement.h
+++ b/Source/WebCore/svg/SVGTSpanElement.h
@@ -34,7 +34,7 @@ private:
     SVGTSpanElement(const QualifiedName&, Document*);
             
     virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
-    virtual bool childShouldCreateRenderer(Node*) const;
+    virtual bool childShouldCreateRenderer(const NodeRenderingContext&) const;
     virtual bool rendererIsNeeded(const NodeRenderingContext&);
 };
 
diff --git a/Source/WebCore/svg/SVGTests.idl b/Source/WebCore/svg/SVGTests.idl
index c914a7bc8..11d9856a6 100644
--- a/Source/WebCore/svg/SVGTests.idl
+++ b/Source/WebCore/svg/SVGTests.idl
@@ -35,7 +35,7 @@ module svg {
         readonly attribute SVGStringList requiredExtensions;
         readonly attribute SVGStringList systemLanguage;
 
-        boolean hasExtension(in [Optional=CallWithDefaultValue] DOMString extension);
+        boolean hasExtension(in [Optional=DefaultIsUndefined] DOMString extension);
     };
 
 }
diff --git a/Source/WebCore/svg/SVGTextContentElement.cpp b/Source/WebCore/svg/SVGTextContentElement.cpp
index c8dfdc5f1..1efedac93 100644
--- a/Source/WebCore/svg/SVGTextContentElement.cpp
+++ b/Source/WebCore/svg/SVGTextContentElement.cpp
@@ -228,6 +228,27 @@ bool SVGTextContentElement::isSupportedAttribute(const QualifiedName& attrName)
     return supportedAttributes.contains<QualifiedName, SVGAttributeHashTranslator>(attrName);
 }
 
+bool SVGTextContentElement::isPresentationAttribute(Attribute* attr) const
+{
+    if (attr->name().matches(XMLNames::spaceAttr))
+        return true;
+    return SVGStyledElement::isPresentationAttribute(attr);
+}
+
+void SVGTextContentElement::collectStyleForAttribute(Attribute* attr, StylePropertySet* style)
+{
+    if (!isSupportedAttribute(attr->name()))
+        SVGStyledElement::collectStyleForAttribute(attr, style);
+    else if (attr->name().matches(XMLNames::spaceAttr)) {
+        DEFINE_STATIC_LOCAL(const AtomicString, preserveString, ("preserve"));
+
+        if (attr->value() == preserveString)
+            addPropertyToAttributeStyle(style, CSSPropertyWhiteSpace, CSSValuePre);
+        else
+            addPropertyToAttributeStyle(style, CSSPropertyWhiteSpace, CSSValueNowrap);
+    }
+}
+
 void SVGTextContentElement::parseAttribute(Attribute* attr)
 {
     SVGParsingError parseError = NoError;
@@ -243,14 +264,6 @@ void SVGTextContentElement::parseAttribute(Attribute* attr)
     } else if (SVGTests::parseAttribute(attr)
                || SVGExternalResourcesRequired::parseAttribute(attr)) {
     } else if (SVGLangSpace::parseAttribute(attr)) {
-        if (attr->name().matches(XMLNames::spaceAttr)) {
-            DEFINE_STATIC_LOCAL(const AtomicString, preserveString, ("preserve"));
-
-            if (attr->value() == preserveString)
-                addCSSProperty(CSSPropertyWhiteSpace, CSSValuePre);
-            else
-                addCSSProperty(CSSPropertyWhiteSpace, CSSValueNowrap);
-        }
     } else
         ASSERT_NOT_REACHED();
 
diff --git a/Source/WebCore/svg/SVGTextContentElement.h b/Source/WebCore/svg/SVGTextContentElement.h
index d45bea6a1..91ae378f8 100644
--- a/Source/WebCore/svg/SVGTextContentElement.h
+++ b/Source/WebCore/svg/SVGTextContentElement.h
@@ -104,6 +104,8 @@ protected:
 
     bool isSupportedAttribute(const QualifiedName&);
     virtual void parseAttribute(Attribute*) OVERRIDE;
+    virtual bool isPresentationAttribute(Attribute*) const OVERRIDE;
+    virtual void collectStyleForAttribute(Attribute*, StylePropertySet*) OVERRIDE;
     virtual void svgAttributeChanged(const QualifiedName&);
 
     virtual bool selfHasRelativeLengths() const;
diff --git a/Source/WebCore/svg/SVGTextContentElement.idl b/Source/WebCore/svg/SVGTextContentElement.idl
index cdd32e9fc..6ce8a5302 100644
--- a/Source/WebCore/svg/SVGTextContentElement.idl
+++ b/Source/WebCore/svg/SVGTextContentElement.idl
@@ -42,20 +42,20 @@ module svg {
 
         long getNumberOfChars();
         float getComputedTextLength();
-        float getSubStringLength(in [Optional=CallWithDefaultValue,IsIndex] unsigned long offset, 
-                                 in [Optional=CallWithDefaultValue,IsIndex] unsigned long length)
+        float getSubStringLength(in [Optional=DefaultIsUndefined,IsIndex] unsigned long offset, 
+                                 in [Optional=DefaultIsUndefined,IsIndex] unsigned long length)
             raises(DOMException);
-        SVGPoint getStartPositionOfChar(in [Optional=CallWithDefaultValue,IsIndex] unsigned long offset)
+        SVGPoint getStartPositionOfChar(in [Optional=DefaultIsUndefined,IsIndex] unsigned long offset)
             raises(DOMException);
-        SVGPoint getEndPositionOfChar(in [Optional=CallWithDefaultValue,IsIndex] unsigned long offset)
+        SVGPoint getEndPositionOfChar(in [Optional=DefaultIsUndefined,IsIndex] unsigned long offset)
             raises(DOMException);
-        SVGRect getExtentOfChar(in [Optional=CallWithDefaultValue,IsIndex] unsigned long offset)
+        SVGRect getExtentOfChar(in [Optional=DefaultIsUndefined,IsIndex] unsigned long offset)
             raises(DOMException);
-        float getRotationOfChar(in [Optional=CallWithDefaultValue,IsIndex] unsigned long offset)
+        float getRotationOfChar(in [Optional=DefaultIsUndefined,IsIndex] unsigned long offset)
             raises(DOMException);
-        long getCharNumAtPosition(in [Optional=CallWithDefaultValue] SVGPoint point);
-        void selectSubString(in [Optional=CallWithDefaultValue,IsIndex] unsigned long offset, 
-                             in [Optional=CallWithDefaultValue,IsIndex] unsigned long length)
+        long getCharNumAtPosition(in [Optional=DefaultIsUndefined] SVGPoint point);
+        void selectSubString(in [Optional=DefaultIsUndefined,IsIndex] unsigned long offset, 
+                             in [Optional=DefaultIsUndefined,IsIndex] unsigned long length)
             raises(DOMException);
     };
 
diff --git a/Source/WebCore/svg/SVGTextElement.cpp b/Source/WebCore/svg/SVGTextElement.cpp
index 5d46d82b2..54a64a57e 100644
--- a/Source/WebCore/svg/SVGTextElement.cpp
+++ b/Source/WebCore/svg/SVGTextElement.cpp
@@ -26,6 +26,7 @@
 #include "AffineTransform.h"
 #include "Attribute.h"
 #include "FloatRect.h"
+#include "NodeRenderingContext.h"
 #include "RenderSVGResource.h"
 #include "RenderSVGText.h"
 #include "SVGElementInstance.h"
@@ -141,16 +142,16 @@ RenderObject* SVGTextElement::createRenderer(RenderArena* arena, RenderStyle*)
     return new (arena) RenderSVGText(this);
 }
 
-bool SVGTextElement::childShouldCreateRenderer(Node* child) const
+bool SVGTextElement::childShouldCreateRenderer(const NodeRenderingContext& childContext) const
 {
-    if (child->isTextNode()
-        || child->hasTagName(SVGNames::aTag)
+    if (childContext.node()->isTextNode()
+        || childContext.node()->hasTagName(SVGNames::aTag)
 #if ENABLE(SVG_FONTS)
-        || child->hasTagName(SVGNames::altGlyphTag)
+        || childContext.node()->hasTagName(SVGNames::altGlyphTag)
 #endif
-        || child->hasTagName(SVGNames::textPathTag)
-        || child->hasTagName(SVGNames::trefTag)
-        || child->hasTagName(SVGNames::tspanTag))
+        || childContext.node()->hasTagName(SVGNames::textPathTag)
+        || childContext.node()->hasTagName(SVGNames::trefTag)
+        || childContext.node()->hasTagName(SVGNames::tspanTag))
         return true;
 
     return false;
diff --git a/Source/WebCore/svg/SVGTextElement.h b/Source/WebCore/svg/SVGTextElement.h
index e8a419358..32118f5bb 100644
--- a/Source/WebCore/svg/SVGTextElement.h
+++ b/Source/WebCore/svg/SVGTextElement.h
@@ -53,7 +53,7 @@ private:
     virtual AffineTransform localCoordinateSpaceTransform(SVGLocatable::CTMScope mode) const { return SVGTransformable::localCoordinateSpaceTransform(mode); }
 
     virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
-    virtual bool childShouldCreateRenderer(Node*) const;
+    virtual bool childShouldCreateRenderer(const NodeRenderingContext&) const;
             
     virtual void svgAttributeChanged(const QualifiedName&);
 
diff --git a/Source/WebCore/svg/SVGTextPathElement.cpp b/Source/WebCore/svg/SVGTextPathElement.cpp
index 84c9a724a..c8cfdd294 100644
--- a/Source/WebCore/svg/SVGTextPathElement.cpp
+++ b/Source/WebCore/svg/SVGTextPathElement.cpp
@@ -24,6 +24,7 @@
 #include "SVGTextPathElement.h"
 
 #include "Attribute.h"
+#include "NodeRenderingContext.h"
 #include "RenderSVGResource.h"
 #include "RenderSVGTextPath.h"
 #include "SVGElementInstance.h"
@@ -117,12 +118,12 @@ RenderObject* SVGTextPathElement::createRenderer(RenderArena* arena, RenderStyle
     return new (arena) RenderSVGTextPath(this);
 }
 
-bool SVGTextPathElement::childShouldCreateRenderer(Node* child) const
+bool SVGTextPathElement::childShouldCreateRenderer(const NodeRenderingContext& childContext) const
 {
-    if (child->isTextNode()
-        || child->hasTagName(SVGNames::aTag)
-        || child->hasTagName(SVGNames::trefTag)
-        || child->hasTagName(SVGNames::tspanTag))
+    if (childContext.node()->isTextNode()
+        || childContext.node()->hasTagName(SVGNames::aTag)
+        || childContext.node()->hasTagName(SVGNames::trefTag)
+        || childContext.node()->hasTagName(SVGNames::tspanTag))
         return true;
 
     return false;
diff --git a/Source/WebCore/svg/SVGTextPathElement.h b/Source/WebCore/svg/SVGTextPathElement.h
index 499c80d58..99bf6221c 100644
--- a/Source/WebCore/svg/SVGTextPathElement.h
+++ b/Source/WebCore/svg/SVGTextPathElement.h
@@ -122,7 +122,7 @@ private:
     virtual void svgAttributeChanged(const QualifiedName&);
 
     virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
-    virtual bool childShouldCreateRenderer(Node*) const;
+    virtual bool childShouldCreateRenderer(const NodeRenderingContext&) const;
     virtual bool rendererIsNeeded(const NodeRenderingContext&);
 
     virtual bool selfHasRelativeLengths() const;
diff --git a/Source/WebCore/svg/SVGUseElement.cpp b/Source/WebCore/svg/SVGUseElement.cpp
index fd7f2d217..e342ee4ad 100644
--- a/Source/WebCore/svg/SVGUseElement.cpp
+++ b/Source/WebCore/svg/SVGUseElement.cpp
@@ -345,14 +345,21 @@ bool SVGUseElement::willRecalcStyle(StyleChange change)
         if (SVGElement* shadowRoot = m_targetElementInstance->shadowTreeElement())
             shadowRoot->setNeedsStyleRecalc();
     }
+    // Do not do style calculation during shadow tree construction because it may cause nodes to
+    // be attached before they should be. Style recalc will happen when the tree is constructed
+    // and explicitly attached.
+    if (m_updatesBlocked)
+        return false;
     return true;
 }
 
 void SVGUseElement::didRecalcStyle(StyleChange change)
 {
     // Assure that the shadow tree has not been marked for recreation, while we're building it.
-    if (m_updatesBlocked)
-        ASSERT(!m_needsShadowTreeRecreation);
+    if (m_updatesBlocked && m_needsShadowTreeRecreation) {
+        // We are about to recreate the tree while in the middle of recreating the tree.
+        return;
+    }
 
     RenderSVGShadowTreeRootContainer* shadowRoot = static_cast<RenderSVGShadowTreeRootContainer*>(renderer());
     if (!shadowRoot)
diff --git a/Source/WebCore/svg/animation/SMILTime.h b/Source/WebCore/svg/animation/SMILTime.h
index f7276c3ce..18abdae59 100644
--- a/Source/WebCore/svg/animation/SMILTime.h
+++ b/Source/WebCore/svg/animation/SMILTime.h
@@ -55,6 +55,32 @@ private:
     double m_time;
 };
 
+class SMILTimeWithOrigin {
+public:
+    enum Origin {
+        ParserOrigin,
+        ScriptOrigin
+    };
+
+    SMILTimeWithOrigin()
+        : m_origin(ParserOrigin)
+    {
+    }
+
+    SMILTimeWithOrigin(const SMILTime& time, Origin origin)
+        : m_time(time)
+        , m_origin(origin)
+    {
+    }
+
+    const SMILTime& time() const { return m_time; }
+    bool originIsScript() const { return m_origin == ScriptOrigin; }
+
+private:
+    SMILTime m_time;
+    Origin m_origin;
+};
+
 inline bool operator==(const SMILTime& a, const SMILTime& b) { return a.isFinite() && a.value() == b.value(); }
 inline bool operator!(const SMILTime& a) { return !a.isFinite() || !a.value(); }
 inline bool operator!=(const SMILTime& a, const SMILTime& b) { return !operator==(a, b); }
@@ -62,6 +88,7 @@ inline bool operator>(const SMILTime& a, const SMILTime& b) { return a.value() >
 inline bool operator<(const SMILTime& a, const SMILTime& b) { return a.value() < b.value(); }
 inline bool operator>=(const SMILTime& a, const SMILTime& b) { return a.value() > b.value() || operator==(a, b); }
 inline bool operator<=(const SMILTime& a, const SMILTime& b) { return a.value() < b.value() || operator==(a, b); }
+inline bool operator<(const SMILTimeWithOrigin& a, const SMILTimeWithOrigin& b) { return a.time() < b.time(); }
 
 SMILTime operator+(const SMILTime&, const SMILTime&);
 SMILTime operator-(const SMILTime&, const SMILTime&);
diff --git a/Source/WebCore/svg/animation/SMILTimeContainer.cpp b/Source/WebCore/svg/animation/SMILTimeContainer.cpp
index 82369e9cd..692f28b5f 100644
--- a/Source/WebCore/svg/animation/SMILTimeContainer.cpp
+++ b/Source/WebCore/svg/animation/SMILTimeContainer.cpp
@@ -123,13 +123,13 @@ void SMILTimeContainer::resume()
 
 void SMILTimeContainer::setElapsed(SMILTime time)
 {
+    // If the documment didn't begin yet, record a new start time, we'll seek to once its possible.
     if (!m_beginTime) {
         m_presetStartTime = time.value();
         return;
     }
 
-    double now = currentTime();
-    m_beginTime = now - time.value();
+    m_beginTime = currentTime() - time.value();
     m_accumulatedPauseTime = 0;
 
     Vector<SVGSMILElement*> toReset;
@@ -137,8 +137,7 @@ void SMILTimeContainer::setElapsed(SMILTime time)
     for (unsigned n = 0; n < toReset.size(); ++n)
         toReset[n]->reset();
 
-    if (isPaused())
-        updateAnimations(now - m_beginTime - m_accumulatedPauseTime);
+    updateAnimations(time);
 }
 
 void SMILTimeContainer::startTimer(SMILTime fireTime, SMILTime minimumDelay)
@@ -157,8 +156,7 @@ void SMILTimeContainer::timerFired(Timer<SMILTimeContainer>*)
 {
     ASSERT(m_beginTime);
     ASSERT(!m_pauseTime);
-    SMILTime elapsed = this->elapsed();
-    updateAnimations(elapsed);
+    updateAnimations(elapsed());
 }
 
 void SMILTimeContainer::updateDocumentOrderIndexes()
@@ -221,49 +219,20 @@ String SMILTimeContainer::baseValueFor(ElementAttributePair key)
     ASSERT(attributeName != anyQName());
     String baseValue;
     if (SVGAnimationElement::isTargetAttributeCSSProperty(targetElement, attributeName))
-        baseValue = computedStyle(targetElement)->getPropertyValue(cssPropertyID(attributeName.localName()));
+        baseValue = CSSComputedStyleDeclaration::create(targetElement)->getPropertyValue(cssPropertyID(attributeName.localName()));
     else
         baseValue = targetElement->getAttribute(attributeName);
     m_savedBaseValues.add(key, baseValue);
     return baseValue;
 }
 
-void SMILTimeContainer::sampleAnimationAtTime(const String& elementId, double newTime)
-{
-    ASSERT(m_beginTime);
-    ASSERT(!isPaused());
-
-    // Fast-forward to the time DRT wants to sample
-    m_timer.stop();
-
-    updateAnimations(elapsed(), newTime, elementId);
-}
-
-void SMILTimeContainer::updateAnimations(SMILTime elapsed, double nextManualSampleTime, const String& nextSamplingTarget)
+void SMILTimeContainer::updateAnimations(SMILTime elapsed)
 {
     SMILTime earliersFireTime = SMILTime::unresolved();
 
     Vector<SVGSMILElement*> toAnimate;
     copyToVector(m_scheduledAnimations, toAnimate);
 
-    if (nextManualSampleTime) {
-        SMILTime samplingDiff;
-        for (unsigned n = 0; n < toAnimate.size(); ++n) {
-            SVGSMILElement* animation = toAnimate[n];
-            ASSERT(animation->timeContainer() == this);
-
-            SVGElement* targetElement = animation->targetElement();
-            // FIXME: This should probably be using getIdAttribute instead of idForStyleResolution.
-            if (!targetElement || !targetElement->hasID() || targetElement->idForStyleResolution() != nextSamplingTarget)
-                continue;
-
-            samplingDiff = animation->intervalBegin();
-            break;
-        }
-
-        elapsed = SMILTime(nextManualSampleTime) + samplingDiff;
-    }
-
     // Sort according to priority. Elements with later begin time have higher priority.
     // In case of a tie, document order decides. 
     // FIXME: This should also consider timing relationships between the elements. Dependents
diff --git a/Source/WebCore/svg/animation/SMILTimeContainer.h b/Source/WebCore/svg/animation/SMILTimeContainer.h
index a2d0b8fed..d4d06da48 100644
--- a/Source/WebCore/svg/animation/SMILTimeContainer.h
+++ b/Source/WebCore/svg/animation/SMILTimeContainer.h
@@ -63,15 +63,12 @@ public:
 
     void setDocumentOrderIndexesDirty() { m_documentOrderIndexesDirty = true; }
 
-    // Move to a specific time. Only used for DRT testing purposes.
-    void sampleAnimationAtTime(const String& elementId, double seconds);
-
 private:
     SMILTimeContainer(SVGSVGElement* owner);
     
     void timerFired(Timer<SMILTimeContainer>*);
     void startTimer(SMILTime fireTime, SMILTime minimumDelay = 0);
-    void updateAnimations(SMILTime elapsed, double nextManualSampleTime = 0, const String& nextSamplingTarget = String());
+    void updateAnimations(SMILTime elapsed);
     
     void updateDocumentOrderIndexes();
     void sortByPriority(Vector<SVGSMILElement*>& smilElements, SMILTime elapsed);
diff --git a/Source/WebCore/svg/animation/SVGSMILElement.cpp b/Source/WebCore/svg/animation/SVGSMILElement.cpp
index 790e27d81..dda170bf9 100644
--- a/Source/WebCore/svg/animation/SVGSMILElement.cpp
+++ b/Source/WebCore/svg/animation/SVGSMILElement.cpp
@@ -134,7 +134,7 @@ SVGSMILElement::SVGSMILElement(const QualifiedName& tagName, Document* doc)
     , m_cachedMin(invalidCachedTime)
     , m_cachedMax(invalidCachedTime)
 {
-    reset();
+    resolveFirstInterval();
 }
 
 SVGSMILElement::~SVGSMILElement()
@@ -168,6 +168,14 @@ static inline QualifiedName constructQualifiedName(const SVGElement* svgElement,
     return QualifiedName(nullAtom, localName, namespaceURI);
 }
 
+static inline void clearTimesWithDynamicOrigins(Vector<SMILTimeWithOrigin>& timeList)
+{
+    for (int i = timeList.size() - 1; i >= 0; --i) {
+        if (timeList[i].originIsScript())
+            timeList.remove(i);
+    }
+}
+
 void SVGSMILElement::reset()
 {
     m_activeState = Inactive;
@@ -178,7 +186,6 @@ void SVGSMILElement::reset()
     m_lastPercent = 0;
     m_lastRepeat = 0;
     m_nextProgressTime = 0;
-
     resolveFirstInterval();
 }
 
@@ -200,7 +207,7 @@ void SVGSMILElement::insertedIntoDocument()
 
     // "If no attribute is present, the default begin value (an offset-value of 0) must be evaluated."
     if (!fastHasAttribute(SVGNames::beginAttr))
-        m_beginTimes.append(0);
+        m_beginTimes.append(SMILTimeWithOrigin());
 
     if (m_isWaitingForFirstInterval) {
         resolveFirstInterval();
@@ -282,7 +289,7 @@ SMILTime SVGSMILElement::parseClockValue(const String& data)
     return result;
 }
     
-static void sortTimeList(Vector<SMILTime>& timeList)
+static void sortTimeList(Vector<SMILTimeWithOrigin>& timeList)
 {
     std::sort(timeList.begin(), timeList.end());
 }
@@ -364,12 +371,12 @@ bool SVGSMILElement::isSMILElement(Node* node)
     
 void SVGSMILElement::parseBeginOrEnd(const String& parseString, BeginOrEnd beginOrEnd)
 {
-    Vector<SMILTime>& timeList = beginOrEnd == Begin ? m_beginTimes : m_endTimes;
+    Vector<SMILTimeWithOrigin>& timeList = beginOrEnd == Begin ? m_beginTimes : m_endTimes;
     if (beginOrEnd == End)
         m_hasEndEventConditions = false;
     HashSet<double> existing;
     for (unsigned n = 0; n < timeList.size(); ++n)
-        existing.add(timeList[n].value());
+        existing.add(timeList[n].time().value());
     Vector<String> splitString;
     parseString.split(';', splitString);
     for (unsigned n = 0; n < splitString.size(); ++n) {
@@ -377,7 +384,7 @@ void SVGSMILElement::parseBeginOrEnd(const String& parseString, BeginOrEnd begin
         if (value.isUnresolved())
             parseCondition(splitString[n], beginOrEnd);
         else if (!existing.contains(value.value()))
-            timeList.append(value);
+            timeList.append(SMILTimeWithOrigin(value, SMILTimeWithOrigin::ParserOrigin));
     }
     sortTimeList(timeList);
 }
@@ -513,17 +520,32 @@ SVGElement* SVGSMILElement::targetElement()
     ContainerNode* target = href.isEmpty() ? parentNode() : SVGURIReference::targetElementFromIRIString(href, document());
     if (!target || !target->isSVGElement())
         return 0;
-    
+
     m_targetElement = static_cast<SVGElement*>(target);
     document()->accessSVGExtensions()->addAnimationElementToTarget(this, m_targetElement);
+
+    targetElementDidChange(m_targetElement);
+
     return m_targetElement;
 }
 
-SMILTime SVGSMILElement::elapsed() const 
+void SVGSMILElement::resetTargetElement()
+{
+    m_targetElement = 0;
+
+    // Force the animation to recompute values that are only calculated when an animation becomes active.
+    // Failing to do this means that a target reset and change during active animation may result in
+    // invalid state.
+    m_activeState = Inactive;
+
+    targetElementDidChange(0);
+}
+
+SMILTime SVGSMILElement::elapsed() const
 {
     return m_timeContainer ? m_timeContainer->elapsed() : 0;
-} 
-    
+}
+
 bool SVGSMILElement::isInactive() const
 {
      return m_activeState == Inactive;
@@ -616,67 +638,67 @@ SMILTime SVGSMILElement::simpleDuration() const
 {
     return min(dur(), SMILTime::indefinite());
 }
-    
-void SVGSMILElement::addBeginTime(SMILTime eventTime, SMILTime beginTime)
+
+void SVGSMILElement::addBeginTime(SMILTime eventTime, SMILTime beginTime, SMILTimeWithOrigin::Origin origin)
 {
-    m_beginTimes.append(beginTime);
+    m_beginTimes.append(SMILTimeWithOrigin(beginTime, origin));
     sortTimeList(m_beginTimes);
     beginListChanged(eventTime);
 }
-    
-void SVGSMILElement::addEndTime(SMILTime eventTime, SMILTime endTime)
+
+void SVGSMILElement::addEndTime(SMILTime eventTime, SMILTime endTime, SMILTimeWithOrigin::Origin origin)
 {
-    m_endTimes.append(endTime);
+    m_endTimes.append(SMILTimeWithOrigin(endTime, origin));
     sortTimeList(m_endTimes);
     endListChanged(eventTime);
 }
-    
-inline SMILTime extractTimeFromVector(const SMILTime* position)
+
+inline SMILTime extractTimeFromVector(const SMILTimeWithOrigin* position)
 {
-    return *position;
+    return position->time();
 }
 
 SMILTime SVGSMILElement::findInstanceTime(BeginOrEnd beginOrEnd, SMILTime minimumTime, bool equalsMinimumOK) const
 {
-    const Vector<SMILTime>& list = beginOrEnd == Begin ? m_beginTimes : m_endTimes;
+    const Vector<SMILTimeWithOrigin>& list = beginOrEnd == Begin ? m_beginTimes : m_endTimes;
     int sizeOfList = list.size();
 
     if (!sizeOfList)
         return beginOrEnd == Begin ? SMILTime::unresolved() : SMILTime::indefinite();
 
-    const SMILTime* result = binarySearch<const SMILTime, SMILTime, extractTimeFromVector>(list.begin(), sizeOfList, minimumTime, WTF::KeyMustNotBePresentInArray);
+    const SMILTimeWithOrigin* result = binarySearch<const SMILTimeWithOrigin, SMILTime, extractTimeFromVector>(list.begin(), sizeOfList, minimumTime, WTF::KeyMustNotBePresentInArray);
     int indexOfResult = result - list.begin();
-
-    if (sizeOfList - 1 > indexOfResult && list[indexOfResult] < minimumTime)
+    if (sizeOfList - 1 > indexOfResult && list[indexOfResult].time() < minimumTime)
         ++indexOfResult;
 
     ASSERT(indexOfResult < sizeOfList);
+    const SMILTime& currentTime = list[indexOfResult].time();
 
     // "The special value "indefinite" does not yield an instance time in the begin list."
-    if (list[indexOfResult].isIndefinite() && beginOrEnd == Begin)
+    if (currentTime.isIndefinite() && beginOrEnd == Begin)
         return SMILTime::unresolved();
 
-    if (list[indexOfResult] < minimumTime)
+    if (currentTime < minimumTime)
         return beginOrEnd == Begin ? SMILTime::unresolved() : SMILTime::indefinite();
 
     // If the equals is NOT accepted, we have to find a bigger one.
-    if (list[indexOfResult] == minimumTime && !equalsMinimumOK) {
+    if (currentTime == minimumTime && !equalsMinimumOK) {
         if (indexOfResult + 1 >= sizeOfList)
             return beginOrEnd == Begin ? SMILTime::unresolved() : SMILTime::indefinite();
     }
 
-    while (indexOfResult < sizeOfList - 1 && list[indexOfResult] == list[indexOfResult + 1])
+    while (indexOfResult < sizeOfList - 1 && currentTime == list[indexOfResult + 1].time())
         ++indexOfResult;
 
-    if (list[indexOfResult] > minimumTime)
-        return list[indexOfResult];
-    if (list[indexOfResult] == minimumTime) {
+    if (currentTime > minimumTime)
+        return currentTime;
+    if (currentTime == minimumTime) {
         if (indexOfResult + 1 < sizeOfList - 1)
-            return list[indexOfResult + 1];
+            return list[indexOfResult + 1].time();
         return beginOrEnd == Begin ? SMILTime::unresolved() : SMILTime::indefinite();
     }
 
-    return list[indexOfResult];
+    return currentTime;
 }
 
 SMILTime SVGSMILElement::repeatingDuration() const
@@ -1041,7 +1063,13 @@ void SVGSMILElement::beginByLinkActivation()
     SMILTime elapsed = this->elapsed();
     addBeginTime(elapsed, elapsed);
 }
-    
+
+void SVGSMILElement::endedActiveInterval()
+{
+    clearTimesWithDynamicOrigins(m_beginTimes);
+    clearTimesWithDynamicOrigins(m_endTimes);
+}
+
 }
 
 #endif
diff --git a/Source/WebCore/svg/animation/SVGSMILElement.h b/Source/WebCore/svg/animation/SVGSMILElement.h
index 334f97573..9e1dfd014 100644
--- a/Source/WebCore/svg/animation/SVGSMILElement.h
+++ b/Source/WebCore/svg/animation/SVGSMILElement.h
@@ -54,7 +54,7 @@ public:
     SMILTimeContainer* timeContainer() const { return m_timeContainer.get(); }
 
     SVGElement* targetElement();
-    void resetTargetElement() { m_targetElement = 0; }
+    void resetTargetElement();
     const QualifiedName& attributeName() const { return m_attributeName; }
 
     void beginByLinkActivation();
@@ -109,15 +109,18 @@ public:
     virtual void applyResultsToTarget() = 0;
 
 protected:
-    void addBeginTime(SMILTime eventTime, SMILTime endTime);
-    void addEndTime(SMILTime eventTime, SMILTime endTime);
+    void addBeginTime(SMILTime eventTime, SMILTime endTime, SMILTimeWithOrigin::Origin = SMILTimeWithOrigin::ParserOrigin);
+    void addEndTime(SMILTime eventTime, SMILTime endTime, SMILTimeWithOrigin::Origin = SMILTimeWithOrigin::ParserOrigin);
 
     void setInactive() { m_activeState = Inactive; }
 
+    // Sub-classes may need to take action when the target is changed.
+    virtual void targetElementDidChange(SVGElement*) { }
+
 private:
     virtual void startedActiveInterval() = 0;
     virtual void updateAnimation(float percent, unsigned repeat, SVGSMILElement* resultElement) = 0;
-    virtual void endedActiveInterval() = 0;
+    void endedActiveInterval();
 
     enum BeginOrEnd {
         Begin,
@@ -199,8 +202,8 @@ private:
     TimeDependentSet m_timeDependents;
 
     // Instance time lists
-    Vector<SMILTime> m_beginTimes;
-    Vector<SMILTime> m_endTimes;
+    Vector<SMILTimeWithOrigin> m_beginTimes;
+    Vector<SMILTimeWithOrigin> m_endTimes;
 
     // This is the upcoming or current interval
     SMILTime m_intervalBegin;
@@ -230,4 +233,3 @@ private:
 
 #endif // ENABLE(SVG)
 #endif // SVGSMILElement_h
-
diff --git a/Source/WebCore/svg/graphics/SVGImage.cpp b/Source/WebCore/svg/graphics/SVGImage.cpp
index bbcc91b52..7e1ce2854 100644
--- a/Source/WebCore/svg/graphics/SVGImage.cpp
+++ b/Source/WebCore/svg/graphics/SVGImage.cpp
@@ -337,12 +337,6 @@ bool SVGImage::dataChanged(bool allDataReceived)
 #endif
         static InspectorClient* dummyInspectorClient = new EmptyInspectorClient;
         pageClients.inspectorClient = dummyInspectorClient;
-#if ENABLE(DEVICE_ORIENTATION)
-        static DeviceMotionClient* dummyDeviceMotionClient = new EmptyDeviceMotionClient;
-        pageClients.deviceMotionClient = dummyDeviceMotionClient;
-        static DeviceOrientationClient* dummyDeviceOrientationClient = new EmptyDeviceOrientationClient;
-        pageClients.deviceOrientationClient = dummyDeviceOrientationClient;
-#endif
 
         // FIXME: If this SVG ends up loading itself, we might leak the world.
         // The Cache code does not know about CachedImages holding Frames and
diff --git a/Source/WebCore/svg/properties/SVGAnimatedPropertySynchronizer.h b/Source/WebCore/svg/properties/SVGAnimatedPropertySynchronizer.h
index e6bd013eb..6e4c4879d 100644
--- a/Source/WebCore/svg/properties/SVGAnimatedPropertySynchronizer.h
+++ b/Source/WebCore/svg/properties/SVGAnimatedPropertySynchronizer.h
@@ -37,15 +37,14 @@ struct SVGAnimatedPropertySynchronizer<true> {
         // Attribute directly to avoid a call to Element::attributeChanged
         // that could cause the SVGElement to erroneously reset its properties.
         // svg/dom/SVGStringList-basics.xhtml exercises this behavior.
-        NamedNodeMap* namedAttrMap = ownerElement->ensureUpdatedAttributes();
-        Attribute* old = namedAttrMap->getAttributeItem(attrName);
+        ElementAttributeData* attributeData = ownerElement->ensureUpdatedAttributeData();
+        Attribute* old = attributeData->getAttributeItem(attrName);
         if (old && value.isNull())
-            namedAttrMap->removeAttribute(old->name());
+            attributeData->removeAttribute(old->name(), ownerElement);
         else if (!old && !value.isNull())
-            namedAttrMap->addAttribute(ownerElement->createAttribute(attrName, value));
+            attributeData->addAttribute(Attribute::create(attrName, value), ownerElement);
         else if (old && !value.isNull())
             old->setValue(value);
-
     }
 };
 
diff --git a/Source/WebCore/svg/svgtags.in b/Source/WebCore/svg/svgtags.in
index e12a5542f..9c6422962 100644
--- a/Source/WebCore/svg/svgtags.in
+++ b/Source/WebCore/svg/svgtags.in
@@ -11,7 +11,7 @@ altGlyphItem
 #endif
 animate
 animateColor
-animateMotion JSInterfaceName=SVGElement
+animateMotion
 animateTransform
 set
 circle
@@ -64,7 +64,7 @@ g
 #if ENABLE_SVG_FONTS
 glyph
 glyphRef
-hkern interfaceName=SVGHKernElement, JSInterfaceName=SVGElement
+hkern interfaceName=SVGHKernElement
 #endif
 image
 line
@@ -75,7 +75,7 @@ metadata
 #if ENABLE_SVG_FONTS
 missing_glyph
 #endif
-mpath interfaceName=SVGMPathElement, JSInterfaceName=SVGElement
+mpath interfaceName=SVGMPathElement
 path
 pattern
 polygon
diff --git a/Source/WebCore/testing/InternalSettings.cpp b/Source/WebCore/testing/InternalSettings.cpp
index c2b045dca..2884e5661 100644
--- a/Source/WebCore/testing/InternalSettings.cpp
+++ b/Source/WebCore/testing/InternalSettings.cpp
@@ -36,14 +36,6 @@
 #include "Page.h"
 #include "Settings.h"
 
-#if ENABLE(GESTURE_EVENTS)
-#include "PlatformGestureEvent.h"
-#endif
-
-#if ENABLE(SMOOTH_SCROLLING)
-#include "ScrollAnimator.h"
-#endif
-
 #if ENABLE(INPUT_COLOR)
 #include "ColorChooser.h"
 #endif
@@ -172,43 +164,6 @@ void InternalSettings::setAcceleratedDrawingEnabled(bool enabled, ExceptionCode&
     settings()->setAcceleratedDrawingEnabled(enabled);
 }
 
-void InternalSettings::setEnableScrollAnimator(bool enabled, ExceptionCode& ec)
-{
-    InternalSettingsGuardForSettings();
-#if ENABLE(SMOOTH_SCROLLING)
-    settings()->setEnableScrollAnimator(enabled);
-#else
-    UNUSED_PARAM(enabled);
-#endif
-}
-
-void InternalSettings::setZoomAnimatorTransform(float scale, float tx, float ty, ExceptionCode& ec)
-{
-    InternalSettingsGuardForFrame();
-
-#if ENABLE(GESTURE_EVENTS)
-    PlatformGestureEvent pge(PlatformEvent::GestureDoubleTap, IntPoint(tx, ty), IntPoint(tx, ty), 0, scale, 0.f, 0, 0, 0, 0);
-    frame()->eventHandler()->handleGestureEvent(pge);
-#else
-    UNUSED_PARAM(scale);
-    UNUSED_PARAM(tx);
-    UNUSED_PARAM(ty);
-#endif
-}
-
-void InternalSettings::setZoomParameters(float scale, float x, float y, ExceptionCode& ec)
-{
-    InternalSettingsGuardForFrameView();
-
-#if ENABLE(SMOOTH_SCROLLING)
-    frame()->view()->scrollAnimator()->setZoomParametersForTest(scale, x, y);
-#else
-    UNUSED_PARAM(scale);
-    UNUSED_PARAM(x);
-    UNUSED_PARAM(y);
-#endif
-}
-
 void InternalSettings::setMockScrollbarsEnabled(bool enabled, ExceptionCode& ec)
 {
     InternalSettingsGuardForSettings();
@@ -253,12 +208,6 @@ bool InternalSettings::unifiedTextCheckingEnabled(ExceptionCode& ec)
     return settings()->unifiedTextCheckerEnabled();
 }
 
-float InternalSettings::pageScaleFactor(ExceptionCode& ec)
-{
-    InternalSettingsGuardForPageReturn(0);
-    return page()->pageScaleFactor();
-}
-
 void InternalSettings::setPageScaleFactor(float scaleFactor, int x, int y, ExceptionCode& ec)
 {
     InternalSettingsGuardForPage();
diff --git a/Source/WebCore/testing/InternalSettings.h b/Source/WebCore/testing/InternalSettings.h
index 64800926c..ef66c9959 100644
--- a/Source/WebCore/testing/InternalSettings.h
+++ b/Source/WebCore/testing/InternalSettings.h
@@ -52,16 +52,12 @@ public:
     void setEnableCompositingForScrollableFrames(bool enabled, ExceptionCode&);
     void setAcceleratedDrawingEnabled(bool enabled, ExceptionCode&);
     void setAcceleratedFiltersEnabled(bool enabled, ExceptionCode&);
-    void setEnableScrollAnimator(bool enabled, ExceptionCode&);
-    void setZoomAnimatorTransform(float scale, float tx, float ty, ExceptionCode&);
-    void setZoomParameters(float scale, float x, float y, ExceptionCode&);
     void setMockScrollbarsEnabled(bool enabled, ExceptionCode&);
     void setPasswordEchoEnabled(bool enabled, ExceptionCode&);
     void setPasswordEchoDurationInSeconds(double durationInSeconds, ExceptionCode&);
     void setFixedElementsLayoutRelativeToFrame(bool, ExceptionCode&);
     void setUnifiedTextCheckingEnabled(bool, ExceptionCode&);
     bool unifiedTextCheckingEnabled(ExceptionCode&);
-    float pageScaleFactor(ExceptionCode&);
     void setPageScaleFactor(float scaleFactor, int x, int y, ExceptionCode&);
     void setPerTileDrawingEnabled(bool enabled, ExceptionCode&);
     void setTouchEventEmulationEnabled(bool enabled, ExceptionCode&);
diff --git a/Source/WebCore/testing/InternalSettings.idl b/Source/WebCore/testing/InternalSettings.idl
index 036008384..dd9519ec2 100644
--- a/Source/WebCore/testing/InternalSettings.idl
+++ b/Source/WebCore/testing/InternalSettings.idl
@@ -33,16 +33,12 @@ module window {
         void setEnableCompositingForScrollableFrames(in boolean enabled) raises(DOMException);
         void setAcceleratedDrawingEnabled(in boolean enabled) raises(DOMException);
         void setAcceleratedFiltersEnabled(in boolean enabled) raises(DOMException);
-        void setEnableScrollAnimator(in boolean enabled) raises(DOMException);
-        void setZoomAnimatorTransform(in float scale, in float tx, in float ty) raises(DOMException);
-        void setZoomParameters(in float scale, in float x, in float y) raises(DOMException);
         void setMockScrollbarsEnabled(in boolean enabled) raises(DOMException);
         void setPasswordEchoEnabled(in boolean enabled) raises(DOMException);
         void setPasswordEchoDurationInSeconds(in double durationInSeconds) raises(DOMException);
         void setFixedElementsLayoutRelativeToFrame(in boolean enabled) raises(DOMException);
         void setUnifiedTextCheckingEnabled(in boolean enabled) raises (DOMException);
         boolean unifiedTextCheckingEnabled() raises (DOMException);
-        float pageScaleFactor() raises(DOMException);
         void setPageScaleFactor(in float scaleFactor, in long x, in long y) raises(DOMException);
         void setTouchEventEmulationEnabled(in boolean enabled) raises(DOMException);
     };
diff --git a/Source/WebCore/testing/Internals.cpp b/Source/WebCore/testing/Internals.cpp
index 06e34cd3c..84e9cf754 100644
--- a/Source/WebCore/testing/Internals.cpp
+++ b/Source/WebCore/testing/Internals.cpp
@@ -50,15 +50,14 @@
 #include "RenderTreeAsText.h"
 #include "Settings.h"
 #include "ShadowRoot.h"
+#include "ShadowRootList.h"
 #include "SpellChecker.h"
 #include "TextIterator.h"
 
-#if ENABLE(GESTURE_EVENTS)
-#include "PlatformGestureEvent.h"
-#endif
-
-#if ENABLE(SMOOTH_SCROLLING)
-#include "ScrollAnimator.h"
+#if ENABLE(SHADOW_DOM)
+#include "RuntimeEnabledFeatures.h"
+#else
+#include <wtf/UnusedParam.h>
 #endif
 
 #if ENABLE(INPUT_COLOR)
@@ -157,6 +156,16 @@ bool Internals::isValidContentSelect(Element* contentElement, ExceptionCode& ec)
     return toHTMLContentElement(contentElement)->isSelectValid();
 }
 
+bool Internals::attached(Node* node, ExceptionCode& ec)
+{
+    if (!node) {
+        ec = INVALID_ACCESS_ERR;
+        return false;
+    }
+
+    return node->attached();
+}
+
 String Internals::elementRenderTreeAsText(Element* element, ExceptionCode& ec)
 {
     if (!element) {
@@ -173,11 +182,11 @@ String Internals::elementRenderTreeAsText(Element* element, ExceptionCode& ec)
     return representation;
 }
 
-size_t Internals::numberOfScopedHTMLStyleChildren(const Element* element, ExceptionCode& ec) const
+size_t Internals::numberOfScopedHTMLStyleChildren(const Node* scope, ExceptionCode& ec) const
 {
-    if (element)
+    if (scope && (scope->isElementNode() || scope->isShadowRoot()))
 #if ENABLE(STYLE_SCOPED)
-        return element->numberOfScopedHTMLStyleChildren();
+        return scope->numberOfScopedHTMLStyleChildren();
 #else
         return 0;
 #endif
@@ -193,20 +202,43 @@ Internals::ShadowRootIfShadowDOMEnabledOrNode* Internals::ensureShadowRoot(Eleme
         return 0;
     }
 
-    if (ShadowRoot* root = host->shadowRoot())
-        return root;
+    if (host->hasShadowRoot())
+        return host->shadowRootList()->youngestShadowRoot();
 
     return ShadowRoot::create(host, ec).get();
 }
 
 Internals::ShadowRootIfShadowDOMEnabledOrNode* Internals::shadowRoot(Element* host, ExceptionCode& ec)
 {
+    // FIXME: Internals::shadowRoot() in tests should be converted to youngestShadowRoot() or oldestShadowRoot().
+    // https://bugs.webkit.org/show_bug.cgi?id=78465
+    return youngestShadowRoot(host, ec);
+}
+
+Internals::ShadowRootIfShadowDOMEnabledOrNode* Internals::youngestShadowRoot(Element* host, ExceptionCode& ec)
+{
+    if (!host) {
+        ec = INVALID_ACCESS_ERR;
+        return 0;
+    }
+
+    if (!host->hasShadowRoot())
+        return 0;
+
+    return host->shadowRootList()->youngestShadowRoot();
+}
+
+Internals::ShadowRootIfShadowDOMEnabledOrNode* Internals::oldestShadowRoot(Element* host, ExceptionCode& ec)
+{
     if (!host) {
         ec = INVALID_ACCESS_ERR;
         return 0;
     }
 
-    return host->shadowRoot();
+    if (!host->hasShadowRoot())
+        return 0;
+
+    return host->shadowRootList()->oldestShadowRoot();
 }
 
 void Internals::removeShadowRoot(Element* host, ExceptionCode& ec)
@@ -219,6 +251,15 @@ void Internals::removeShadowRoot(Element* host, ExceptionCode& ec)
     host->removeShadowRoot();
 }
 
+void Internals::setMultipleShadowSubtreesEnabled(bool enabled)
+{
+#if ENABLE(SHADOW_DOM)
+    RuntimeEnabledFeatures::setMultipleShadowSubtreesEnabled(enabled);
+#else
+    UNUSED_PARAM(enabled);
+#endif
+}
+
 Element* Internals::includerFor(Node* node, ExceptionCode& ec)
 {
     if (!node) {
@@ -226,7 +267,7 @@ Element* Internals::includerFor(Node* node, ExceptionCode& ec)
         return 0;
     }
 
-    return NodeRenderingContext(node).includer();
+    return NodeRenderingContext(node).insertionPoint();
 }
 
 String Internals::shadowPseudoId(Element* element, ExceptionCode& ec)
diff --git a/Source/WebCore/testing/Internals.h b/Source/WebCore/testing/Internals.h
index 439dc75c6..ea2f8b8af 100644
--- a/Source/WebCore/testing/Internals.h
+++ b/Source/WebCore/testing/Internals.h
@@ -57,7 +57,7 @@ public:
 
     bool isPreloaded(Document*, const String& url);
 
-    size_t numberOfScopedHTMLStyleChildren(const Element*, ExceptionCode&) const;
+    size_t numberOfScopedHTMLStyleChildren(const Node*, ExceptionCode&) const;
 
 #if ENABLE(SHADOW_DOM)
     typedef ShadowRoot ShadowRootIfShadowDOMEnabledOrNode;
@@ -66,13 +66,18 @@ public:
 #endif
     ShadowRootIfShadowDOMEnabledOrNode* ensureShadowRoot(Element* host, ExceptionCode&);
     ShadowRootIfShadowDOMEnabledOrNode* shadowRoot(Element* host, ExceptionCode&);
+    ShadowRootIfShadowDOMEnabledOrNode* youngestShadowRoot(Element* host, ExceptionCode&);
+    ShadowRootIfShadowDOMEnabledOrNode* oldestShadowRoot(Element* host, ExceptionCode&);
     void removeShadowRoot(Element* host, ExceptionCode&);
+    void setMultipleShadowSubtreesEnabled(bool);
     Element* includerFor(Node*, ExceptionCode&);
     String shadowPseudoId(Element*, ExceptionCode&);
     PassRefPtr<Element> createContentElement(Document*, ExceptionCode&);
     Element* getElementByIdInShadowRoot(Node* shadowRoot, const String& id, ExceptionCode&);
     bool isValidContentSelect(Element* contentElement, ExceptionCode&);
 
+    bool attached(Node*, ExceptionCode&);
+
 #if ENABLE(INPUT_COLOR)
     void selectColorInColorChooser(Element*, const String& colorValue);
 #endif
diff --git a/Source/WebCore/testing/Internals.idl b/Source/WebCore/testing/Internals.idl
index 9bf05751d..ba76d486d 100644
--- a/Source/WebCore/testing/Internals.idl
+++ b/Source/WebCore/testing/Internals.idl
@@ -30,15 +30,20 @@ module window {
         DOMString elementRenderTreeAsText(in Element element) raises(DOMException);
         boolean isPreloaded(in Document document, in DOMString url);
 
-        unsigned long numberOfScopedHTMLStyleChildren(in Element element) raises(DOMException);
+        unsigned long numberOfScopedHTMLStyleChildren(in Node scope) raises(DOMException);
 
 #if defined(ENABLE_SHADOW_DOM)
         ShadowRoot ensureShadowRoot(in Element host) raises (DOMException);
         ShadowRoot shadowRoot(in Element host) raises (DOMException);
+        ShadowRoot youngestShadowRoot(in Element host) raises (DOMException);
+        ShadowRoot oldestShadowRoot(in Element host) raises (DOMException);
 #else
         Node ensureShadowRoot(in Element host) raises (DOMException);
         Node shadowRoot(in Element host) raises (DOMException);
+        Node youngestShadowRoot(in Element host) raises (DOMException);
+        Node oldestShadowRoot(in Element host) raises (DOMException);
 #endif
+        void setMultipleShadowSubtreesEnabled(in boolean enabled);
         Element includerFor(in Node node) raises (DOMException);
         void removeShadowRoot(in Element host) raises (DOMException);
         DOMString shadowPseudoId(in Element element) raises (DOMException);
@@ -46,6 +51,8 @@ module window {
         Element getElementByIdInShadowRoot(in Node shadowRoot, in DOMString id) raises(DOMException);
         boolean isValidContentSelect(in Element contentElement) raises(DOMException);
 
+        boolean attached(in Node node) raises(DOMException);
+
 #if defined(ENABLE_INPUT_COLOR) && ENABLE_INPUT_COLOR
         void selectColorInColorChooser(in Element element, in DOMString colorValue);
 #endif
diff --git a/Source/WebCore/webaudio/AsyncAudioDecoder.cpp b/Source/WebCore/webaudio/AsyncAudioDecoder.cpp
index c26824398..f00bd1adc 100644
--- a/Source/WebCore/webaudio/AsyncAudioDecoder.cpp
+++ b/Source/WebCore/webaudio/AsyncAudioDecoder.cpp
@@ -49,8 +49,7 @@ AsyncAudioDecoder::~AsyncAudioDecoder()
     m_queue.kill();
     
     // Stop thread.
-    void* exitCode;
-    waitForThreadCompletion(m_threadID, &exitCode);
+    waitForThreadCompletion(m_threadID);
     m_threadID = 0;
 }
 
@@ -66,12 +65,11 @@ void AsyncAudioDecoder::decodeAsync(ArrayBuffer* audioData, float sampleRate, Pa
 }
 
 // Asynchronously decode in this thread.
-void* AsyncAudioDecoder::threadEntry(void* threadData)
+void AsyncAudioDecoder::threadEntry(void* threadData)
 {
     ASSERT(threadData);
     AsyncAudioDecoder* decoder = reinterpret_cast<AsyncAudioDecoder*>(threadData);
     decoder->runLoop();
-    return 0;
 }
 
 void AsyncAudioDecoder::runLoop()
diff --git a/Source/WebCore/webaudio/AsyncAudioDecoder.h b/Source/WebCore/webaudio/AsyncAudioDecoder.h
index e2fc4dcb0..ced8058c0 100644
--- a/Source/WebCore/webaudio/AsyncAudioDecoder.h
+++ b/Source/WebCore/webaudio/AsyncAudioDecoder.h
@@ -76,7 +76,7 @@ private:
         RefPtr<AudioBuffer> m_audioBuffer;
     };
     
-    static void* threadEntry(void* threadData);
+    static void threadEntry(void* threadData);
     void runLoop();
 
     WTF::ThreadIdentifier m_threadID;
diff --git a/Source/WebCore/webaudio/AudioBufferCallback.idl b/Source/WebCore/webaudio/AudioBufferCallback.idl
index f4b8303a7..9b35477c6 100644
--- a/Source/WebCore/webaudio/AudioBufferCallback.idl
+++ b/Source/WebCore/webaudio/AudioBufferCallback.idl
@@ -25,7 +25,7 @@
 module audio {
     interface [
         Conditional=WEB_AUDIO,
-        JSGenerateToJS,
+        JSGenerateToJSObject,
         Callback
     ] AudioBufferCallback {
         boolean handleEvent(in AudioBuffer audioBuffer);
diff --git a/Source/WebCore/webaudio/AudioBufferSourceNode.idl b/Source/WebCore/webaudio/AudioBufferSourceNode.idl
index 6f983afe3..eedb0cb70 100644
--- a/Source/WebCore/webaudio/AudioBufferSourceNode.idl
+++ b/Source/WebCore/webaudio/AudioBufferSourceNode.idl
@@ -26,7 +26,7 @@ module audio {
     // A cached (non-streamed), memory-resident audio source
     interface [
         Conditional=WEB_AUDIO,
-        JSGenerateToJS
+        JSGenerateToJSObject
     ] AudioBufferSourceNode : AudioSourceNode {
         attribute [CustomSetter] AudioBuffer buffer
             setter raises (DOMException);
diff --git a/Source/WebCore/webaudio/AudioContext.cpp b/Source/WebCore/webaudio/AudioContext.cpp
index 0c1664fb8..afc81130b 100644
--- a/Source/WebCore/webaudio/AudioContext.cpp
+++ b/Source/WebCore/webaudio/AudioContext.cpp
@@ -102,8 +102,10 @@ PassRefPtr<AudioContext> AudioContext::create(Document* document)
     ASSERT(isMainThread());
     if (s_hardwareContextCount >= MaxHardwareContexts)
         return 0;
-        
-    return adoptRef(new AudioContext(document));
+
+    RefPtr<AudioContext> audioContext(adoptRef(new AudioContext(document)));
+    audioContext->suspendIfNeeded();
+    return audioContext.release();
 }
 
 PassRefPtr<AudioContext> AudioContext::createOfflineContext(Document* document, unsigned numberOfChannels, size_t numberOfFrames, float sampleRate, ExceptionCode& ec)
@@ -118,7 +120,9 @@ PassRefPtr<AudioContext> AudioContext::createOfflineContext(Document* document,
         return 0;
     }
 
-    return adoptRef(new AudioContext(document, numberOfChannels, numberOfFrames, sampleRate));
+    RefPtr<AudioContext> audioContext(new AudioContext(document, numberOfChannels, numberOfFrames, sampleRate));
+    audioContext->suspendIfNeeded();
+    return audioContext.release();
 }
 
 // Constructor for rendering to the audio hardware.
diff --git a/Source/WebCore/webaudio/AudioDestinationNode.h b/Source/WebCore/webaudio/AudioDestinationNode.h
index 581edd801..d07833da9 100644
--- a/Source/WebCore/webaudio/AudioDestinationNode.h
+++ b/Source/WebCore/webaudio/AudioDestinationNode.h
@@ -49,8 +49,6 @@ public:
     size_t currentSampleFrame() { return m_currentSampleFrame; }
     double currentTime() { return currentSampleFrame() / static_cast<double>(sampleRate()); }
 
-    virtual float sampleRate() const = 0;
-
     virtual unsigned numberOfChannels() const { return 2; } // FIXME: update when multi-channel (more than stereo) is supported
 
     virtual void startRendering() = 0;
diff --git a/Source/WebCore/webaudio/AudioDestinationNode.idl b/Source/WebCore/webaudio/AudioDestinationNode.idl
index 1266952df..7ce4043b9 100644
--- a/Source/WebCore/webaudio/AudioDestinationNode.idl
+++ b/Source/WebCore/webaudio/AudioDestinationNode.idl
@@ -25,7 +25,7 @@
 module audio {
     interface [
         Conditional=WEB_AUDIO,
-        JSGenerateToJS
+        JSGenerateToJSObject
     ] AudioDestinationNode : AudioNode {
         readonly attribute long numberOfChannels;
     };
diff --git a/Source/WebCore/webaudio/AudioGain.idl b/Source/WebCore/webaudio/AudioGain.idl
index 6e70d160d..75974277d 100644
--- a/Source/WebCore/webaudio/AudioGain.idl
+++ b/Source/WebCore/webaudio/AudioGain.idl
@@ -29,7 +29,7 @@
 module audio {
     interface [
         Conditional=WEB_AUDIO,
-        JSGenerateToJS
+        JSGenerateToJSObject
     ] AudioGain : AudioParam {
     };
 }
diff --git a/Source/WebCore/webaudio/AudioGainNode.idl b/Source/WebCore/webaudio/AudioGainNode.idl
index 6b365fdbe..ba3163f94 100644
--- a/Source/WebCore/webaudio/AudioGainNode.idl
+++ b/Source/WebCore/webaudio/AudioGainNode.idl
@@ -25,7 +25,7 @@
 module audio {
     interface [
         Conditional=WEB_AUDIO,
-        JSGenerateToJS
+        JSGenerateToJSObject
     ] AudioGainNode : AudioNode {
         // FIXME: eventually it will be interesting to remove the readonly restriction, but need to properly deal with thread safety here.
         readonly attribute AudioGain gain;
diff --git a/Source/WebCore/webaudio/AudioNode.h b/Source/WebCore/webaudio/AudioNode.h
index 1aeb54b68..dffd7118e 100644
--- a/Source/WebCore/webaudio/AudioNode.h
+++ b/Source/WebCore/webaudio/AudioNode.h
@@ -118,7 +118,7 @@ public:
     void connect(AudioNode*, unsigned outputIndex, unsigned inputIndex, ExceptionCode&);
     void disconnect(unsigned outputIndex, ExceptionCode&);
 
-    float sampleRate() const { return m_sampleRate; }
+    virtual float sampleRate() const { return m_sampleRate; }
 
     // processIfNecessary() is called by our output(s) when the rendering graph needs this AudioNode to process.
     // This method ensures that the AudioNode will only process once per rendering time quantum even if it's called repeatedly.
diff --git a/Source/WebCore/webaudio/AudioNode.idl b/Source/WebCore/webaudio/AudioNode.idl
index 06f873e3a..cfaa73b2c 100644
--- a/Source/WebCore/webaudio/AudioNode.idl
+++ b/Source/WebCore/webaudio/AudioNode.idl
@@ -30,10 +30,10 @@ module audio {
         readonly attribute unsigned long numberOfInputs;
         readonly attribute unsigned long numberOfOutputs;
 
-        void connect(in AudioNode destination, in [Optional=CallWithDefaultValue] unsigned long output, in [Optional=CallWithDefaultValue] unsigned long input)
+        void connect(in AudioNode destination, in [Optional=DefaultIsUndefined] unsigned long output, in [Optional=DefaultIsUndefined] unsigned long input)
             raises(DOMException);
 
-        void disconnect(in [Optional=CallWithDefaultValue] unsigned long output)
+        void disconnect(in [Optional=DefaultIsUndefined] unsigned long output)
             raises(DOMException);
     };
 }
diff --git a/Source/WebCore/webaudio/AudioPannerNode.cpp b/Source/WebCore/webaudio/AudioPannerNode.cpp
index 7790b5ee5..110577326 100644
--- a/Source/WebCore/webaudio/AudioPannerNode.cpp
+++ b/Source/WebCore/webaudio/AudioPannerNode.cpp
@@ -222,7 +222,7 @@ void AudioPannerNode::getAzimuthElevation(double* outAzimuth, double* outElevati
 
     // Elevation
     double elevation = 90.0 - 180.0 * acos(sourceListener.dot(up)) / piDouble;
-    fixNANs(azimuth); // avoid illegal values
+    fixNANs(elevation); // avoid illegal values
 
     if (elevation > 90.0)
         elevation = 180.0 - elevation;
diff --git a/Source/WebCore/webaudio/AudioPannerNode.idl b/Source/WebCore/webaudio/AudioPannerNode.idl
index e15cb379e..5061e7825 100644
--- a/Source/WebCore/webaudio/AudioPannerNode.idl
+++ b/Source/WebCore/webaudio/AudioPannerNode.idl
@@ -25,7 +25,7 @@
 module audio {
     interface [
         Conditional=WEB_AUDIO,
-        JSGenerateToJS
+        JSGenerateToJSObject
     ] AudioPannerNode : AudioNode {
         // Panning model
         const unsigned short EQUALPOWER = 0;
diff --git a/Source/WebCore/webaudio/AudioParamTimeline.cpp b/Source/WebCore/webaudio/AudioParamTimeline.cpp
index eff1ea79b..cd8f53676 100644
--- a/Source/WebCore/webaudio/AudioParamTimeline.cpp
+++ b/Source/WebCore/webaudio/AudioParamTimeline.cpp
@@ -242,6 +242,13 @@ float AudioParamTimeline::valuesForTimeRangeImpl(float startTime,
                 // The value goes exponentially from value1 to value2 in a duration of deltaTime seconds (corresponding to numSampleFrames).
                 // Compute the per-sample multiplier.
                 float multiplier = powf(value2 / value1, 1 / numSampleFrames);
+
+                // Set the starting value of the exponential ramp. This is the same as multiplier ^
+                // AudioUtilities::timeToSampleFrame(currentTime - time1, sampleRate), but is more
+                // accurate, especially if multiplier is close to 1.
+                value = value1 * powf(value2 / value1,
+                                      AudioUtilities::timeToSampleFrame(currentTime - time1, sampleRate) / numSampleFrames);
+
                 for (; writeIndex < fillToFrame; ++writeIndex) {
                     values[writeIndex] = value;
                     value *= multiplier;
diff --git a/Source/WebCore/webaudio/AudioProcessingEvent.idl b/Source/WebCore/webaudio/AudioProcessingEvent.idl
index b963493bb..b6995f7d7 100644
--- a/Source/WebCore/webaudio/AudioProcessingEvent.idl
+++ b/Source/WebCore/webaudio/AudioProcessingEvent.idl
@@ -25,7 +25,7 @@
 module audio {
     interface [
         Conditional=WEB_AUDIO,
-        JSGenerateToJS
+        JSGenerateToJSObject
     ] AudioProcessingEvent : Event {
         readonly attribute AudioBuffer inputBuffer;
         readonly attribute AudioBuffer outputBuffer; 
diff --git a/Source/WebCore/webaudio/BiquadFilterNode.idl b/Source/WebCore/webaudio/BiquadFilterNode.idl
index c3f52a3b7..d143065df 100644
--- a/Source/WebCore/webaudio/BiquadFilterNode.idl
+++ b/Source/WebCore/webaudio/BiquadFilterNode.idl
@@ -25,7 +25,7 @@
 module audio {
     interface [
         Conditional=WEB_AUDIO,
-        JSGenerateToJS
+        JSGenerateToJSObject
     ] BiquadFilterNode : AudioNode {
         // Filter type.
         const unsigned short LOWPASS = 0;
diff --git a/Source/WebCore/webaudio/ConvolverNode.idl b/Source/WebCore/webaudio/ConvolverNode.idl
index a91e3eb3d..0f561f0ff 100644
--- a/Source/WebCore/webaudio/ConvolverNode.idl
+++ b/Source/WebCore/webaudio/ConvolverNode.idl
@@ -26,7 +26,7 @@ module audio {
     // A linear convolution effect
     interface [
         Conditional=WEB_AUDIO,
-        JSGenerateToJS
+        JSGenerateToJSObject
     ] ConvolverNode : AudioNode {
         attribute [JSCustomSetter] AudioBuffer buffer;
         attribute boolean normalize;
diff --git a/Source/WebCore/webaudio/DefaultAudioDestinationNode.cpp b/Source/WebCore/webaudio/DefaultAudioDestinationNode.cpp
index e26456375..fe47accfa 100644
--- a/Source/WebCore/webaudio/DefaultAudioDestinationNode.cpp
+++ b/Source/WebCore/webaudio/DefaultAudioDestinationNode.cpp
@@ -35,7 +35,6 @@ namespace WebCore {
 DefaultAudioDestinationNode::DefaultAudioDestinationNode(AudioContext* context)
     : AudioDestinationNode(context, AudioDestination::hardwareSampleRate())
 {
-    initialize();
 }
 
 DefaultAudioDestinationNode::~DefaultAudioDestinationNode()
diff --git a/Source/WebCore/webaudio/DefaultAudioDestinationNode.h b/Source/WebCore/webaudio/DefaultAudioDestinationNode.h
index 630bdc335..e7ac1cdba 100644
--- a/Source/WebCore/webaudio/DefaultAudioDestinationNode.h
+++ b/Source/WebCore/webaudio/DefaultAudioDestinationNode.h
@@ -45,9 +45,6 @@ public:
     // AudioNode   
     virtual void initialize();
     virtual void uninitialize();
-    
-    float sampleRate() const { return m_destination->sampleRate(); }
-
     virtual void startRendering();
     
 private:
diff --git a/Source/WebCore/webaudio/DelayNode.idl b/Source/WebCore/webaudio/DelayNode.idl
index 2ba529549..a21ac3095 100644
--- a/Source/WebCore/webaudio/DelayNode.idl
+++ b/Source/WebCore/webaudio/DelayNode.idl
@@ -25,7 +25,7 @@
 module audio {
     interface [
         Conditional=WEB_AUDIO,
-        JSGenerateToJS
+        JSGenerateToJSObject
     ] DelayNode : AudioNode {
         readonly attribute AudioParam delayTime;
     };
diff --git a/Source/WebCore/webaudio/DynamicsCompressorNode.cpp b/Source/WebCore/webaudio/DynamicsCompressorNode.cpp
index ea8b58922..263755595 100644
--- a/Source/WebCore/webaudio/DynamicsCompressorNode.cpp
+++ b/Source/WebCore/webaudio/DynamicsCompressorNode.cpp
@@ -33,13 +33,16 @@
 #include "AudioNodeOutput.h"
 #include "DynamicsCompressor.h"
 
+// Set output to stereo by default.
+static const unsigned defaultNumberOfOutputChannels = 2;
+
 namespace WebCore {
 
 DynamicsCompressorNode::DynamicsCompressorNode(AudioContext* context, float sampleRate)
     : AudioNode(context, sampleRate)
 {
     addInput(adoptPtr(new AudioNodeInput(this)));
-    addOutput(adoptPtr(new AudioNodeOutput(this, 2)));
+    addOutput(adoptPtr(new AudioNodeOutput(this, defaultNumberOfOutputChannels)));
     
     setNodeType(NodeTypeDynamicsCompressor);
     
@@ -70,7 +73,7 @@ void DynamicsCompressorNode::initialize()
         return;
 
     AudioNode::initialize();    
-    m_dynamicsCompressor = adoptPtr(new DynamicsCompressor(true, sampleRate()));
+    m_dynamicsCompressor = adoptPtr(new DynamicsCompressor(sampleRate(), defaultNumberOfOutputChannels));
 }
 
 void DynamicsCompressorNode::uninitialize()
diff --git a/Source/WebCore/webaudio/DynamicsCompressorNode.idl b/Source/WebCore/webaudio/DynamicsCompressorNode.idl
index dd25f10ab..faad13e3c 100644
--- a/Source/WebCore/webaudio/DynamicsCompressorNode.idl
+++ b/Source/WebCore/webaudio/DynamicsCompressorNode.idl
@@ -25,7 +25,7 @@
 module audio {
     interface [
         Conditional=WEB_AUDIO,
-        JSGenerateToJS
+        JSGenerateToJSObject
     ] DynamicsCompressorNode : AudioNode {
     };
 }
diff --git a/Source/WebCore/webaudio/HighPass2FilterNode.idl b/Source/WebCore/webaudio/HighPass2FilterNode.idl
index fdd31d241..25ccba883 100644
--- a/Source/WebCore/webaudio/HighPass2FilterNode.idl
+++ b/Source/WebCore/webaudio/HighPass2FilterNode.idl
@@ -27,7 +27,7 @@ module audio {
     // FIXME: design BiquadNode and use instead of this
     interface [
         Conditional=WEB_AUDIO,
-        JSGenerateToJS
+        JSGenerateToJSObject
     ] HighPass2FilterNode : AudioNode {
         readonly attribute AudioParam cutoff;
         readonly attribute AudioParam resonance;
diff --git a/Source/WebCore/webaudio/JavaScriptAudioNode.idl b/Source/WebCore/webaudio/JavaScriptAudioNode.idl
index 5f05a1189..83e3e6285 100644
--- a/Source/WebCore/webaudio/JavaScriptAudioNode.idl
+++ b/Source/WebCore/webaudio/JavaScriptAudioNode.idl
@@ -26,7 +26,7 @@ module audio {
     // For real-time audio stream synthesis/processing in JavaScript 
     interface [
         Conditional=WEB_AUDIO,
-        JSGenerateToJS,
+        JSGenerateToJSObject,
         JSCustomMarkFunction,
 #if defined(V8_BINDING) && V8_BINDING
         EventTarget
diff --git a/Source/WebCore/webaudio/LowPass2FilterNode.idl b/Source/WebCore/webaudio/LowPass2FilterNode.idl
index c8d6c8899..ae3f05a6c 100644
--- a/Source/WebCore/webaudio/LowPass2FilterNode.idl
+++ b/Source/WebCore/webaudio/LowPass2FilterNode.idl
@@ -27,7 +27,7 @@ module audio {
     // FIXME: design BiquadNode and use instead of this
     interface [
         Conditional=WEB_AUDIO,
-        JSGenerateToJS
+        JSGenerateToJSObject
     ] LowPass2FilterNode : AudioNode {
         readonly attribute AudioParam cutoff;
         readonly attribute AudioParam resonance;
diff --git a/Source/WebCore/webaudio/MediaElementAudioSourceNode.idl b/Source/WebCore/webaudio/MediaElementAudioSourceNode.idl
index 3f459e1f6..f09e98fea 100644
--- a/Source/WebCore/webaudio/MediaElementAudioSourceNode.idl
+++ b/Source/WebCore/webaudio/MediaElementAudioSourceNode.idl
@@ -25,7 +25,7 @@
 module audio {
     interface [
         Conditional=WEB_AUDIO&VIDEO,
-        JSGenerateToJS
+        JSGenerateToJSObject
     ] MediaElementAudioSourceNode : AudioSourceNode {
         readonly attribute HTMLMediaElement mediaElement;
     };
diff --git a/Source/WebCore/webaudio/OfflineAudioCompletionEvent.idl b/Source/WebCore/webaudio/OfflineAudioCompletionEvent.idl
index 54f454881..4ef693917 100644
--- a/Source/WebCore/webaudio/OfflineAudioCompletionEvent.idl
+++ b/Source/WebCore/webaudio/OfflineAudioCompletionEvent.idl
@@ -25,7 +25,7 @@
 module audio {
     interface [
         Conditional=WEB_AUDIO,
-        JSGenerateToJS
+        JSGenerateToJSObject
     ] OfflineAudioCompletionEvent : Event {
         readonly attribute AudioBuffer renderedBuffer;
     };
diff --git a/Source/WebCore/webaudio/OfflineAudioDestinationNode.cpp b/Source/WebCore/webaudio/OfflineAudioDestinationNode.cpp
index 198a5020b..a40e6057b 100644
--- a/Source/WebCore/webaudio/OfflineAudioDestinationNode.cpp
+++ b/Source/WebCore/webaudio/OfflineAudioDestinationNode.cpp
@@ -47,8 +47,6 @@ OfflineAudioDestinationNode::OfflineAudioDestinationNode(AudioContext* context,
     , m_startedRendering(false)
 {
     m_renderBus = adoptPtr(new AudioBus(renderTarget->numberOfChannels(), renderQuantumSize));
-    
-    initialize();
 }
 
 OfflineAudioDestinationNode::~OfflineAudioDestinationNode()
@@ -70,7 +68,7 @@ void OfflineAudioDestinationNode::uninitialize()
         return;
 
     if (m_renderThread) {
-        waitForThreadCompletion(m_renderThread, 0);
+        waitForThreadCompletion(m_renderThread);
         m_renderThread = 0;
     }
 
@@ -92,13 +90,11 @@ void OfflineAudioDestinationNode::startRendering()
 }
 
 // Do offline rendering in this thread.
-void* OfflineAudioDestinationNode::renderEntry(void* threadData)
+void OfflineAudioDestinationNode::renderEntry(void* threadData)
 {
     OfflineAudioDestinationNode* destinationNode = reinterpret_cast<OfflineAudioDestinationNode*>(threadData);
     ASSERT(destinationNode);
     destinationNode->render();
-    
-    return 0;
 }
 
 void OfflineAudioDestinationNode::render()
diff --git a/Source/WebCore/webaudio/OfflineAudioDestinationNode.h b/Source/WebCore/webaudio/OfflineAudioDestinationNode.h
index c4d567a5d..c2da6fffc 100644
--- a/Source/WebCore/webaudio/OfflineAudioDestinationNode.h
+++ b/Source/WebCore/webaudio/OfflineAudioDestinationNode.h
@@ -48,8 +48,7 @@ public:
     // AudioNode   
     virtual void initialize();
     virtual void uninitialize();
-    
-    float sampleRate() const { return m_renderTarget->sampleRate(); }
+    virtual float sampleRate() const { return m_renderTarget->sampleRate(); }
 
     void startRendering();
     
@@ -65,7 +64,7 @@ private:
     // Rendering thread.
     volatile ThreadIdentifier m_renderThread;
     bool m_startedRendering;
-    static void* renderEntry(void* threadData);
+    static void renderEntry(void* threadData);
     void render();
     
     // For completion callback on main thread.
diff --git a/Source/WebCore/webaudio/RealtimeAnalyser.cpp b/Source/WebCore/webaudio/RealtimeAnalyser.cpp
index a3f807d83..54a9d1cb0 100644
--- a/Source/WebCore/webaudio/RealtimeAnalyser.cpp
+++ b/Source/WebCore/webaudio/RealtimeAnalyser.cpp
@@ -45,8 +45,8 @@ using namespace std;
 namespace WebCore {
 
 const double RealtimeAnalyser::DefaultSmoothingTimeConstant  = 0.8;
-const double RealtimeAnalyser::DefaultMinDecibels = -100.0;
-const double RealtimeAnalyser::DefaultMaxDecibels = -30.0;
+const double RealtimeAnalyser::DefaultMinDecibels = -100;
+const double RealtimeAnalyser::DefaultMaxDecibels = -30;
 
 const unsigned RealtimeAnalyser::DefaultFFTSize = 2048;
 // All FFT implementations are expected to handle power-of-two sizes MinFFTSize <= size <= MaxFFTSize.
@@ -132,13 +132,13 @@ void applyWindow(float* p, size_t n)
     
     // Blackman window
     double alpha = 0.16;
-    double a0 = 0.5 * (1.0 - alpha);
+    double a0 = 0.5 * (1 - alpha);
     double a1 = 0.5;
     double a2 = 0.5 * alpha;
     
     for (unsigned i = 0; i < n; ++i) {
         double x = static_cast<double>(i) / static_cast<double>(n);
-        double window = a0 - a1 * cos(2.0 * piDouble * x) + a2 * cos(4.0 * piDouble * x);
+        double window = a0 - a1 * cos(2 * piDouble * x) + a2 * cos(4 * piDouble * x);
         p[i] *= float(window);
     }
 }
@@ -175,10 +175,10 @@ void RealtimeAnalyser::doFFTAnalysis()
     float* imagP = m_analysisFrame->imagData();
 
     // Blow away the packed nyquist component.
-    imagP[0] = 0.0f;
+    imagP[0] = 0;
     
     // Normalize so than an input sine wave at 0dBfs registers as 0dBfs (undo FFT scaling factor).
-    const double MagnitudeScale = 1.0 / DefaultFFTSize;
+    const double magnitudeScale = 1.0 / DefaultFFTSize;
 
     // A value of 0 does no averaging with the previous result.  Larger values produce slower, but smoother changes.
     double k = m_smoothingTimeConstant;
@@ -190,8 +190,8 @@ void RealtimeAnalyser::doFFTAnalysis()
     size_t n = magnitudeBuffer().size();
     for (size_t i = 0; i < n; ++i) {
         Complex c(realP[i], imagP[i]);
-        double scalarMagnitude = abs(c) * MagnitudeScale;        
-        destination[i] = float(k * destination[i] + (1.0 - k) * scalarMagnitude);
+        double scalarMagnitude = abs(c) * magnitudeScale;        
+        destination[i] = float(k * destination[i] + (1 - k) * scalarMagnitude);
     }
 }
 
@@ -205,7 +205,7 @@ void RealtimeAnalyser::getFloatFrequencyData(Float32Array* destinationArray)
     doFFTAnalysis();
     
     // Convert from linear magnitude to floating-point decibels.
-    const double MinDecibels = m_minDecibels;
+    const double minDecibels = m_minDecibels;
     unsigned sourceLength = magnitudeBuffer().size();
     size_t len = min(sourceLength, destinationArray->length());
     if (len > 0) {
@@ -214,7 +214,7 @@ void RealtimeAnalyser::getFloatFrequencyData(Float32Array* destinationArray)
         
         for (unsigned i = 0; i < len; ++i) {
             float linearValue = source[i];
-            double dbMag = !linearValue ? MinDecibels : AudioUtilities::linearToDecibels(linearValue);
+            double dbMag = !linearValue ? minDecibels : AudioUtilities::linearToDecibels(linearValue);
             destination[i] = float(dbMag);
         }
     }
@@ -233,21 +233,22 @@ void RealtimeAnalyser::getByteFrequencyData(Uint8Array* destinationArray)
     unsigned sourceLength = magnitudeBuffer().size();
     size_t len = min(sourceLength, destinationArray->length());
     if (len > 0) {
-        const double RangeScaleFactor = m_maxDecibels == m_minDecibels ? 1.0 : 1.0 / (m_maxDecibels - m_minDecibels);
+        const double rangeScaleFactor = m_maxDecibels == m_minDecibels ? 1 : 1 / (m_maxDecibels - m_minDecibels);
+        const double minDecibels = m_minDecibels;
 
         const float* source = magnitudeBuffer().data();
         unsigned char* destination = destinationArray->data();        
         
         for (unsigned i = 0; i < len; ++i) {
             float linearValue = source[i];
-            double dbMag = !linearValue ? m_minDecibels : AudioUtilities::linearToDecibels(linearValue);
+            double dbMag = !linearValue ? minDecibels : AudioUtilities::linearToDecibels(linearValue);
             
             // The range m_minDecibels to m_maxDecibels will be scaled to byte values from 0 to UCHAR_MAX.
-            double scaledValue = UCHAR_MAX * (dbMag - m_minDecibels) * RangeScaleFactor;
+            double scaledValue = UCHAR_MAX * (dbMag - minDecibels) * rangeScaleFactor;
 
             // Clip to valid range.
-            if (scaledValue < 0.0)
-                scaledValue = 0.0;
+            if (scaledValue < 0)
+                scaledValue = 0;
             if (scaledValue > UCHAR_MAX)
                 scaledValue = UCHAR_MAX;
             
@@ -280,12 +281,12 @@ void RealtimeAnalyser::getByteTimeDomainData(Uint8Array* destinationArray)
             // Buffer access is protected due to modulo operation.
             float value = inputBuffer[(i + writeIndex - fftSize + InputBufferSize) % InputBufferSize];
 
-            // Scale from nominal -1.0 -> +1.0 to unsigned byte.
-            double scaledValue = 128.0 * (value + 1.0);
+            // Scale from nominal -1 -> +1 to unsigned byte.
+            double scaledValue = 128 * (value + 1);
 
             // Clip to valid range.
-            if (scaledValue < 0.0)
-                scaledValue = 0.0;
+            if (scaledValue < 0)
+                scaledValue = 0;
             if (scaledValue > UCHAR_MAX)
                 scaledValue = UCHAR_MAX;
             
diff --git a/Source/WebCore/webaudio/RealtimeAnalyserNode.idl b/Source/WebCore/webaudio/RealtimeAnalyserNode.idl
index 73d55746b..50edbc174 100644
--- a/Source/WebCore/webaudio/RealtimeAnalyserNode.idl
+++ b/Source/WebCore/webaudio/RealtimeAnalyserNode.idl
@@ -25,7 +25,7 @@
 module audio {
     interface [
         Conditional=WEB_AUDIO,
-        JSGenerateToJS
+        JSGenerateToJSObject
     ] RealtimeAnalyserNode : AudioNode {
         attribute unsigned long fftSize;
         readonly attribute unsigned long frequencyBinCount;
diff --git a/Source/WebCore/webaudio/WaveShaperNode.idl b/Source/WebCore/webaudio/WaveShaperNode.idl
index a33bc012d..16a4acf7c 100644
--- a/Source/WebCore/webaudio/WaveShaperNode.idl
+++ b/Source/WebCore/webaudio/WaveShaperNode.idl
@@ -25,7 +25,7 @@
 module audio {
     interface [
         Conditional=WEB_AUDIO,
-        JSGenerateToJS
+        JSGenerateToJSObject
     ] WaveShaperNode : AudioNode {
         attribute [JSCustomSetter] Float32Array curve;
     };
diff --git a/Source/WebCore/websockets/CloseEvent.idl b/Source/WebCore/websockets/CloseEvent.idl
index e36c9494a..ea75111ac 100644
--- a/Source/WebCore/websockets/CloseEvent.idl
+++ b/Source/WebCore/websockets/CloseEvent.idl
@@ -36,7 +36,7 @@ module events {
     ] CloseEvent : Event {
         readonly attribute [InitializedByEventConstructor] boolean wasClean;
         readonly attribute [InitializedByEventConstructor] unsigned short code;
-        readonly attribute [InitializedByEventConstructor, ConvertingNullStringTo=Undefined] DOMString reason;
+        readonly attribute [InitializedByEventConstructor] DOMString reason;
     };
 
 }
diff --git a/Source/WebCore/websockets/ThreadableWebSocketChannel.cpp b/Source/WebCore/websockets/ThreadableWebSocketChannel.cpp
index 17f24fb4d..029e4ffd7 100644
--- a/Source/WebCore/websockets/ThreadableWebSocketChannel.cpp
+++ b/Source/WebCore/websockets/ThreadableWebSocketChannel.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2009 Google Inc.  All rights reserved.
+ * Copyright (C) 2009, 2012 Google Inc.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
@@ -34,6 +34,7 @@
 
 #include "ThreadableWebSocketChannel.h"
 
+#include "Document.h"
 #include "PlatformString.h"
 #include "ScriptExecutionContext.h"
 #include "ThreadableWebSocketChannelClientWrapper.h"
@@ -66,7 +67,7 @@ PassRefPtr<ThreadableWebSocketChannel> ThreadableWebSocketChannel::create(Script
 #endif // ENABLE(WORKERS)
 
     ASSERT(context->isDocument());
-    return WebSocketChannel::create(context, client);
+    return WebSocketChannel::create(static_cast<Document*>(context), client);
 }
 
 } // namespace WebCore
diff --git a/Source/WebCore/websockets/ThreadableWebSocketChannel.h b/Source/WebCore/websockets/ThreadableWebSocketChannel.h
index e93cf8684..a14582a8f 100644
--- a/Source/WebCore/websockets/ThreadableWebSocketChannel.h
+++ b/Source/WebCore/websockets/ThreadableWebSocketChannel.h
@@ -53,6 +53,7 @@ public:
     virtual bool useHixie76Protocol() = 0;
     virtual void connect(const KURL&, const String& protocol) = 0;
     virtual String subprotocol() = 0; // Will be available after didConnect() callback is invoked.
+    virtual String extensions() = 0; // Will be available after didConnect() callback is invoked.
     virtual bool send(const String& message) = 0;
     virtual bool send(const ArrayBuffer&) = 0;
     virtual bool send(const Blob&) = 0;
diff --git a/Source/WebCore/websockets/ThreadableWebSocketChannelClientWrapper.cpp b/Source/WebCore/websockets/ThreadableWebSocketChannelClientWrapper.cpp
index 3be04a98f..dcb1802a2 100644
--- a/Source/WebCore/websockets/ThreadableWebSocketChannelClientWrapper.cpp
+++ b/Source/WebCore/websockets/ThreadableWebSocketChannelClientWrapper.cpp
@@ -29,20 +29,22 @@
  */
 
 #include "config.h"
-#if ENABLE(WEB_SOCKETS)
+#if ENABLE(WEB_SOCKETS) && ENABLE(WORKERS)
 #include "ThreadableWebSocketChannelClientWrapper.h"
 
 #include "CrossThreadCopier.h"
 #include "CrossThreadTask.h"
+#include "ScriptExecutionContext.h"
 #include "WebSocketChannelClient.h"
 #include <wtf/PassRefPtr.h>
 #include <wtf/RefPtr.h>
 
 namespace WebCore {
 
-ThreadableWebSocketChannelClientWrapper::ThreadableWebSocketChannelClientWrapper(WebSocketChannelClient* client)
-    : m_client(client)
-    , m_syncMethodDone(false)
+ThreadableWebSocketChannelClientWrapper::ThreadableWebSocketChannelClientWrapper(ScriptExecutionContext* context, WebSocketChannelClient* client)
+    : m_context(context)
+    , m_client(client)
+    , m_syncMethodDone(true)
     , m_useHixie76Protocol(true)
     , m_sendRequestResult(false)
     , m_bufferedAmount(0)
@@ -50,9 +52,9 @@ ThreadableWebSocketChannelClientWrapper::ThreadableWebSocketChannelClientWrapper
 {
 }
 
-PassRefPtr<ThreadableWebSocketChannelClientWrapper> ThreadableWebSocketChannelClientWrapper::create(WebSocketChannelClient* client)
+PassRefPtr<ThreadableWebSocketChannelClientWrapper> ThreadableWebSocketChannelClientWrapper::create(ScriptExecutionContext* context, WebSocketChannelClient* client)
 {
-    return adoptRef(new ThreadableWebSocketChannelClientWrapper(client));
+    return adoptRef(new ThreadableWebSocketChannelClientWrapper(context, client));
 }
 
 void ThreadableWebSocketChannelClientWrapper::clearSyncMethodDone()
@@ -95,6 +97,21 @@ void ThreadableWebSocketChannelClientWrapper::setSubprotocol(const String& subpr
         memcpy(m_subprotocol.data(), subprotocol.characters(), sizeof(UChar) * length);
 }
 
+String ThreadableWebSocketChannelClientWrapper::extensions() const
+{
+    if (m_extensions.isEmpty())
+        return String("");
+    return String(m_extensions);
+}
+
+void ThreadableWebSocketChannelClientWrapper::setExtensions(const String& extensions)
+{
+    unsigned length = extensions.length();
+    m_extensions.resize(length);
+    if (length)
+        memcpy(m_extensions.data(), extensions.characters(), sizeof(UChar) * length);
+}
+
 bool ThreadableWebSocketChannelClientWrapper::sendRequestResult() const
 {
     return m_sendRequestResult;
@@ -175,9 +192,22 @@ void ThreadableWebSocketChannelClientWrapper::resume()
     processPendingTasks();
 }
 
+void ThreadableWebSocketChannelClientWrapper::processPendingTasksCallback(ScriptExecutionContext* context, PassRefPtr<ThreadableWebSocketChannelClientWrapper> wrapper)
+{
+    ASSERT_UNUSED(context, context->isWorkerContext());
+    wrapper->processPendingTasks();
+}
+
 void ThreadableWebSocketChannelClientWrapper::processPendingTasks()
 {
-    ASSERT(!m_suspended);
+    if (m_suspended)
+        return;
+    if (!m_syncMethodDone) {
+        // When a synchronous operation is in progress (i.e. the execution stack contains
+        // WorkerThreadableWebSocketChannel::waitForMethodCompletion()), we cannot invoke callbacks in this run loop.
+        m_context->postTask(createCallbackTask(&ThreadableWebSocketChannelClientWrapper::processPendingTasksCallback, this));
+        return;
+    }
     Vector<OwnPtr<ScriptExecutionContext::Task> > tasks;
     tasks.swap(m_pendingTasks);
     for (Vector<OwnPtr<ScriptExecutionContext::Task> >::const_iterator iter = tasks.begin(); iter != tasks.end(); ++iter)
diff --git a/Source/WebCore/websockets/ThreadableWebSocketChannelClientWrapper.h b/Source/WebCore/websockets/ThreadableWebSocketChannelClientWrapper.h
index ec9397cdb..4b9b7fde7 100644
--- a/Source/WebCore/websockets/ThreadableWebSocketChannelClientWrapper.h
+++ b/Source/WebCore/websockets/ThreadableWebSocketChannelClientWrapper.h
@@ -31,7 +31,7 @@
 #ifndef ThreadableWebSocketChannelClientWrapper_h
 #define ThreadableWebSocketChannelClientWrapper_h
 
-#if ENABLE(WEB_SOCKETS)
+#if ENABLE(WEB_SOCKETS) && ENABLE(WORKERS)
 
 #include "PlatformString.h"
 #include "ScriptExecutionContext.h"
@@ -44,11 +44,12 @@
 
 namespace WebCore {
 
+class ScriptExecutionContext;
 class WebSocketChannelClient;
 
 class ThreadableWebSocketChannelClientWrapper : public ThreadSafeRefCounted<ThreadableWebSocketChannelClientWrapper> {
 public:
-    static PassRefPtr<ThreadableWebSocketChannelClientWrapper> create(WebSocketChannelClient*);
+    static PassRefPtr<ThreadableWebSocketChannelClientWrapper> create(ScriptExecutionContext*, WebSocketChannelClient*);
 
     void clearSyncMethodDone();
     void setSyncMethodDone();
@@ -59,9 +60,11 @@ public:
     bool useHixie76Protocol() const;
     void setUseHixie76Protocol(bool);
 
-    // Subprotocol is cached too. Will be available when didConnect() callback is invoked.
+    // Subprotocol and extensions are cached too. Will be available when didConnect() callback is invoked.
     String subprotocol() const;
     void setSubprotocol(const String&);
+    String extensions() const;
+    void setExtensions(const String&);
 
     bool sendRequestResult() const;
     void setSendRequestResult(bool);
@@ -81,21 +84,26 @@ public:
     void suspend();
     void resume();
 
-protected:
-    ThreadableWebSocketChannelClientWrapper(WebSocketChannelClient*);
+private:
+    ThreadableWebSocketChannelClientWrapper(ScriptExecutionContext*, WebSocketChannelClient*);
 
     void processPendingTasks();
+
     static void didConnectCallback(ScriptExecutionContext*, PassRefPtr<ThreadableWebSocketChannelClientWrapper>);
     static void didReceiveMessageCallback(ScriptExecutionContext*, PassRefPtr<ThreadableWebSocketChannelClientWrapper>, const String& message);
     static void didReceiveBinaryDataCallback(ScriptExecutionContext*, PassRefPtr<ThreadableWebSocketChannelClientWrapper>, PassOwnPtr<Vector<char> >);
     static void didUpdateBufferedAmountCallback(ScriptExecutionContext*, PassRefPtr<ThreadableWebSocketChannelClientWrapper>, unsigned long bufferedAmount);
     static void didStartClosingHandshakeCallback(ScriptExecutionContext*, PassRefPtr<ThreadableWebSocketChannelClientWrapper>);
     static void didCloseCallback(ScriptExecutionContext*, PassRefPtr<ThreadableWebSocketChannelClientWrapper>, unsigned long unhandledBufferedAmount, WebSocketChannelClient::ClosingHandshakeCompletionStatus, unsigned short code, const String& reason);
+    static void processPendingTasksCallback(ScriptExecutionContext*, PassRefPtr<ThreadableWebSocketChannelClientWrapper>);
 
+    ScriptExecutionContext* m_context;
     WebSocketChannelClient* m_client;
     bool m_syncMethodDone;
     bool m_useHixie76Protocol;
-    Vector<UChar> m_subprotocol; // ThreadSafeRefCounted must not have a String member variable.
+    // ThreadSafeRefCounted must not have String member variables.
+    Vector<UChar> m_subprotocol;
+    Vector<UChar> m_extensions;
     bool m_sendRequestResult;
     unsigned long m_bufferedAmount;
     bool m_suspended;
diff --git a/Source/WebCore/websockets/WebSocket.cpp b/Source/WebCore/websockets/WebSocket.cpp
index 5e213b871..36dbb6f32 100644
--- a/Source/WebCore/websockets/WebSocket.cpp
+++ b/Source/WebCore/websockets/WebSocket.cpp
@@ -155,6 +155,7 @@ WebSocket::WebSocket(ScriptExecutionContext* context)
     , m_binaryType(BinaryTypeBlob)
     , m_useHixie76Protocol(true)
     , m_subprotocol("")
+    , m_extensions("")
 {
 }
 
@@ -164,6 +165,13 @@ WebSocket::~WebSocket()
         m_channel->disconnect();
 }
 
+PassRefPtr<WebSocket> WebSocket::create(ScriptExecutionContext* context)
+{
+    RefPtr<WebSocket> webSocket(adoptRef(new WebSocket(context)));
+    webSocket->suspendIfNeeded();
+    return webSocket.release();
+}
+
 void WebSocket::connect(const String& url, ExceptionCode& ec)
 {
     Vector<String> protocols;
@@ -380,8 +388,7 @@ String WebSocket::extensions() const
 {
     if (m_useHixie76Protocol)
         return String();
-    // WebSocket protocol extension is not supported yet.
-    return "";
+    return m_extensions;
 }
 
 String WebSocket::binaryType() const
diff --git a/Source/WebCore/websockets/WebSocket.h b/Source/WebCore/websockets/WebSocket.h
index b860b75c7..1e44245e8 100644
--- a/Source/WebCore/websockets/WebSocket.h
+++ b/Source/WebCore/websockets/WebSocket.h
@@ -53,7 +53,7 @@ class WebSocket : public RefCounted<WebSocket>, public EventTarget, public Activ
 public:
     static void setIsAvailable(bool);
     static bool isAvailable();
-    static PassRefPtr<WebSocket> create(ScriptExecutionContext* context) { return adoptRef(new WebSocket(context)); }
+    static PassRefPtr<WebSocket> create(ScriptExecutionContext*);
     virtual ~WebSocket();
 
     enum State {
@@ -136,6 +136,7 @@ private:
     BinaryType m_binaryType;
     bool m_useHixie76Protocol;
     String m_subprotocol;
+    String m_extensions;
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/websockets/WebSocket.idl b/Source/WebCore/websockets/WebSocket.idl
index b8dee1398..92835ae43 100644
--- a/Source/WebCore/websockets/WebSocket.idl
+++ b/Source/WebCore/websockets/WebSocket.idl
@@ -57,10 +57,10 @@ module websockets {
         attribute EventListener onerror;
         attribute EventListener onclose;
 
-        readonly attribute [ConvertNullStringTo=Undefined] DOMString protocol;
-        readonly attribute [ConvertNullStringTo=Undefined] DOMString extensions;
+        readonly attribute [TreatReturnedNullStringAs=Undefined] DOMString protocol;
+        readonly attribute [TreatReturnedNullStringAs=Undefined] DOMString extensions;
 
-        attribute [ConvertNullStringTo=Undefined] DOMString binaryType
+        attribute [TreatReturnedNullStringAs=Undefined] DOMString binaryType
             setter raises(DOMException);
 
         // FIXME: Use overloading provided by our IDL code generator.
diff --git a/Source/WebCore/websockets/WebSocketChannel.cpp b/Source/WebCore/websockets/WebSocketChannel.cpp
index 53436e39a..ec0706db4 100644
--- a/Source/WebCore/websockets/WebSocketChannel.cpp
+++ b/Source/WebCore/websockets/WebSocketChannel.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2011 Google Inc.  All rights reserved.
+ * Copyright (C) 2011, 2012 Google Inc.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
@@ -70,7 +70,7 @@ const double TCPMaximumSegmentLifetime = 2 * 60.0;
 
 // Constants for hybi-10 frame format.
 const unsigned char finalBit = 0x80;
-const unsigned char reserved1Bit = 0x40;
+const unsigned char compressBit = 0x40;
 const unsigned char reserved2Bit = 0x20;
 const unsigned char reserved3Bit = 0x10;
 const unsigned char opCodeMask = 0xF;
@@ -81,15 +81,8 @@ const size_t payloadLengthWithTwoByteExtendedLengthField = 126;
 const size_t payloadLengthWithEightByteExtendedLengthField = 127;
 const size_t maskingKeyWidthInBytes = 4;
 
-const WebSocketChannel::OpCode WebSocketChannel::OpCodeContinuation = 0x0;
-const WebSocketChannel::OpCode WebSocketChannel::OpCodeText = 0x1;
-const WebSocketChannel::OpCode WebSocketChannel::OpCodeBinary = 0x2;
-const WebSocketChannel::OpCode WebSocketChannel::OpCodeClose = 0x8;
-const WebSocketChannel::OpCode WebSocketChannel::OpCodePing = 0x9;
-const WebSocketChannel::OpCode WebSocketChannel::OpCodePong = 0xA;
-
-WebSocketChannel::WebSocketChannel(ScriptExecutionContext* context, WebSocketChannelClient* client)
-    : m_context(context)
+WebSocketChannel::WebSocketChannel(Document* document, WebSocketChannelClient* client)
+    : m_document(document)
     , m_client(client)
     , m_buffer(0)
     , m_bufferSize(0)
@@ -110,12 +103,10 @@ WebSocketChannel::WebSocketChannel(ScriptExecutionContext* context, WebSocketCha
     , m_blobLoaderStatus(BlobLoaderNotStarted)
 #endif
 {
-    ASSERT(m_context->isDocument());
-    Document* document = static_cast<Document*>(m_context);
-    if (Settings* settings = document->settings())
+    if (Settings* settings = m_document->settings())
         m_useHixie76Protocol = settings->useHixie76WebSocketProtocol();
 
-    if (Page* page = document->page())
+    if (Page* page = m_document->page())
         m_identifier = page->progress()->createUniqueIdentifier();
 }
 
@@ -134,10 +125,10 @@ void WebSocketChannel::connect(const KURL& url, const String& protocol)
     LOG(Network, "WebSocketChannel %p connect", this);
     ASSERT(!m_handle);
     ASSERT(!m_suspended);
-    m_handshake = adoptPtr(new WebSocketHandshake(url, protocol, m_context, m_useHixie76Protocol));
+    m_handshake = adoptPtr(new WebSocketHandshake(url, protocol, m_document, m_useHixie76Protocol));
     m_handshake->reset();
     if (m_identifier)
-        InspectorInstrumentation::didCreateWebSocket(m_context, m_identifier, url, m_context->url());
+        InspectorInstrumentation::didCreateWebSocket(m_document, m_identifier, url, m_document->url());
     ref();
     m_handle = SocketStreamHandle::create(m_handshake->url(), this);
 }
@@ -153,6 +144,17 @@ String WebSocketChannel::subprotocol()
     return serverProtocol;
 }
 
+String WebSocketChannel::extensions()
+{
+    LOG(Network, "WebSocketChannel %p extensions", this);
+    if (!m_handshake || m_handshake->mode() != WebSocketHandshake::Connected)
+        return "";
+    String extensions = m_handshake->acceptedExtensions();
+    if (extensions.isNull())
+        return "";
+    return extensions;
+}
+
 bool WebSocketChannel::send(const String& message)
 {
     LOG(Network, "WebSocketChannel %p send %s", this, message.utf8().data());
@@ -174,7 +176,7 @@ bool WebSocketChannel::send(const ArrayBuffer& binaryData)
 {
     LOG(Network, "WebSocketChannel %p send arraybuffer %p", this, &binaryData);
     ASSERT(!m_useHixie76Protocol);
-    enqueueRawFrame(OpCodeBinary, static_cast<const char*>(binaryData.data()), binaryData.byteLength());
+    enqueueRawFrame(WebSocketFrame::OpCodeBinary, static_cast<const char*>(binaryData.data()), binaryData.byteLength());
     return true;
 }
 
@@ -182,7 +184,7 @@ bool WebSocketChannel::send(const Blob& binaryData)
 {
     LOG(Network, "WebSocketChannel %p send blob %s", this, binaryData.url().string().utf8().data());
     ASSERT(!m_useHixie76Protocol);
-    enqueueBlobFrame(OpCodeBinary, binaryData);
+    enqueueBlobFrame(WebSocketFrame::OpCodeBinary, binaryData);
     return true;
 }
 
@@ -190,7 +192,7 @@ bool WebSocketChannel::send(const char* data, int length)
 {
     LOG(Network, "WebSocketChannel %p send binary %p (%dB)", this, data, length);
     ASSERT(!m_useHixie76Protocol);
-    enqueueRawFrame(OpCodeBinary, data, length);
+    enqueueRawFrame(WebSocketFrame::OpCodeBinary, data, length);
     return true;
 }
 
@@ -217,8 +219,8 @@ void WebSocketChannel::fail(const String& reason)
 {
     LOG(Network, "WebSocketChannel %p fail: %s", this, reason.utf8().data());
     ASSERT(!m_suspended);
-    if (m_context)
-        m_context->addConsoleMessage(JSMessageSource, LogMessageType, ErrorMessageLevel, reason, m_handshake->clientOrigin());
+    if (m_document)
+        m_document->addConsoleMessage(JSMessageSource, LogMessageType, ErrorMessageLevel, reason, m_handshake->clientOrigin());
     if (!m_useHixie76Protocol) {
         // Hybi-10 specification explicitly states we must not continue to handle incoming data
         // once the WebSocket connection is failed (section 7.1.7).
@@ -236,12 +238,12 @@ void WebSocketChannel::fail(const String& reason)
 void WebSocketChannel::disconnect()
 {
     LOG(Network, "WebSocketChannel %p disconnect", this);
-    if (m_identifier && m_context)
-        InspectorInstrumentation::didCloseWebSocket(m_context, m_identifier);
+    if (m_identifier && m_document)
+        InspectorInstrumentation::didCloseWebSocket(m_document, m_identifier);
     if (m_handshake)
         m_handshake->clearScriptExecutionContext();
     m_client = 0;
-    m_context = 0;
+    m_document = 0;
     if (m_handle)
         m_handle->disconnect();
 }
@@ -262,10 +264,10 @@ void WebSocketChannel::didOpenSocketStream(SocketStreamHandle* handle)
 {
     LOG(Network, "WebSocketChannel %p didOpenSocketStream", this);
     ASSERT(handle == m_handle);
-    if (!m_context)
+    if (!m_document)
         return;
     if (m_identifier)
-        InspectorInstrumentation::willSendWebSocketHandshakeRequest(m_context, m_identifier, m_handshake->clientHandshakeRequest());
+        InspectorInstrumentation::willSendWebSocketHandshakeRequest(m_document, m_identifier, m_handshake->clientHandshakeRequest());
     CString handshakeMessage = m_handshake->clientHandshakeMessage();
     if (!handle->send(handshakeMessage.data(), handshakeMessage.length()))
         fail("Failed to send WebSocket handshake.");
@@ -274,8 +276,8 @@ void WebSocketChannel::didOpenSocketStream(SocketStreamHandle* handle)
 void WebSocketChannel::didCloseSocketStream(SocketStreamHandle* handle)
 {
     LOG(Network, "WebSocketChannel %p didCloseSocketStream", this);
-    if (m_identifier && m_context)
-        InspectorInstrumentation::didCloseWebSocket(m_context, m_identifier);
+    if (m_identifier && m_document)
+        InspectorInstrumentation::didCloseWebSocket(m_document, m_identifier);
     ASSERT_UNUSED(handle, handle == m_handle || !m_handle);
     m_closed = true;
     if (m_closingTimer.isActive())
@@ -288,7 +290,7 @@ void WebSocketChannel::didCloseSocketStream(SocketStreamHandle* handle)
             return;
         WebSocketChannelClient* client = m_client;
         m_client = 0;
-        m_context = 0;
+        m_document = 0;
         m_handle = 0;
         if (client)
             client->didClose(m_unhandledBufferedAmount, m_receivedClosingHandshake ? WebSocketChannelClient::ClosingHandshakeComplete : WebSocketChannelClient::ClosingHandshakeIncomplete, m_closeEventCode, m_closeEventReason);
@@ -301,7 +303,7 @@ void WebSocketChannel::didReceiveSocketStreamData(SocketStreamHandle* handle, co
     LOG(Network, "WebSocketChannel %p didReceiveSocketStreamData %d", this, len);
     RefPtr<WebSocketChannel> protect(this); // The client can close the channel, potentially removing the last reference.
     ASSERT(handle == m_handle);
-    if (!m_context) {
+    if (!m_document) {
         return;
     }
     if (len <= 0) {
@@ -335,7 +337,7 @@ void WebSocketChannel::didFailSocketStream(SocketStreamHandle* handle, const Soc
 {
     LOG(Network, "WebSocketChannel %p didFailSocketStream", this);
     ASSERT(handle == m_handle || !m_handle);
-    if (m_context) {
+    if (m_document) {
         String message;
         if (error.isNull())
             message = "WebSocket network error";
@@ -347,7 +349,7 @@ void WebSocketChannel::didFailSocketStream(SocketStreamHandle* handle, const Soc
         ASSERT(failingURL.isNull() || m_handshake->url().string() == failingURL);
         if (failingURL.isNull())
             failingURL = m_handshake->url().string();
-        m_context->addConsoleMessage(NetworkMessageSource, LogMessageType, ErrorMessageLevel, message, failingURL);
+        m_document->addConsoleMessage(NetworkMessageSource, LogMessageType, ErrorMessageLevel, message, failingURL);
     }
     m_shouldDiscardReceivedData = true;
     handle->disconnect();
@@ -453,14 +455,11 @@ bool WebSocketChannel::processBuffer()
             return false;
         if (m_handshake->mode() == WebSocketHandshake::Connected) {
             if (m_identifier)
-                InspectorInstrumentation::didReceiveWebSocketHandshakeResponse(m_context, m_identifier, m_handshake->serverHandshakeResponse());
+                InspectorInstrumentation::didReceiveWebSocketHandshakeResponse(m_document, m_identifier, m_handshake->serverHandshakeResponse());
             if (!m_handshake->serverSetCookie().isEmpty()) {
-                if (m_context->isDocument()) {
-                    Document* document = static_cast<Document*>(m_context);
-                    if (cookiesEnabled(document)) {
-                        ExceptionCode ec; // Exception (for sandboxed documents) ignored.
-                        document->setCookie(m_handshake->serverSetCookie(), ec);
-                    }
+                if (cookiesEnabled(m_document)) {
+                    ExceptionCode ec; // Exception (for sandboxed documents) ignored.
+                    m_document->setCookie(m_handshake->serverSetCookie(), ec);
                 }
             }
             // FIXME: handle set-cookie2.
@@ -521,7 +520,7 @@ void WebSocketChannel::startClosingHandshake(int code, const String& reason)
             buf.append(static_cast<char>(lowByte));
             buf.append(reason.utf8().data(), reason.utf8().length());
         }
-        enqueueRawFrame(OpCodeClose, buf.data(), buf.size());
+        enqueueRawFrame(WebSocketFrame::OpCodeClose, buf.data(), buf.size());
     }
     m_closing = true;
     if (m_client)
@@ -536,7 +535,7 @@ void WebSocketChannel::closingTimerFired(Timer<WebSocketChannel>* timer)
         m_handle->disconnect();
 }
 
-WebSocketChannel::ParseFrameResult WebSocketChannel::parseFrame(FrameData& frame)
+WebSocketChannel::ParseFrameResult WebSocketChannel::parseFrame(WebSocketFrame& frame, const char*& frameEnd)
 {
     const char* p = m_buffer;
     const char* bufferEnd = m_buffer + m_bufferSize;
@@ -548,10 +547,10 @@ WebSocketChannel::ParseFrameResult WebSocketChannel::parseFrame(FrameData& frame
     unsigned char secondByte = *p++;
 
     bool final = firstByte & finalBit;
-    bool reserved1 = firstByte & reserved1Bit;
+    bool compress = firstByte & compressBit;
     bool reserved2 = firstByte & reserved2Bit;
     bool reserved3 = firstByte & reserved3Bit;
-    OpCode opCode = firstByte & opCodeMask;
+    unsigned char opCode = firstByte & opCodeMask;
 
     bool masked = secondByte & maskBit;
     uint64_t payloadLength64 = secondByte & payloadLengthMask;
@@ -595,15 +594,15 @@ WebSocketChannel::ParseFrameResult WebSocketChannel::parseFrame(FrameData& frame
             payload[i] ^= maskingKey[i % maskingKeyWidthInBytes]; // Unmask the payload.
     }
 
-    frame.opCode = opCode;
+    frame.opCode = static_cast<WebSocketFrame::OpCode>(opCode);
     frame.final = final;
-    frame.reserved1 = reserved1;
+    frame.compress = compress;
     frame.reserved2 = reserved2;
     frame.reserved3 = reserved3;
     frame.masked = masked;
     frame.payload = p + maskingKeyLength;
     frame.payloadLength = payloadLength;
-    frame.frameEnd = p + maskingKeyLength + payloadLength;
+    frameEnd = p + maskingKeyLength + payloadLength;
     return FrameOK;
 }
 
@@ -611,50 +610,54 @@ bool WebSocketChannel::processFrame()
 {
     ASSERT(m_buffer);
 
-    FrameData frame;
-    if (parseFrame(frame) != FrameOK)
+    WebSocketFrame frame;
+    const char* frameEnd;
+    if (parseFrame(frame, frameEnd) != FrameOK)
         return false;
 
+    ASSERT(m_buffer < frameEnd);
+    ASSERT(frameEnd <= m_buffer + m_bufferSize);
+
     // Validate the frame data.
-    if (isReservedOpCode(frame.opCode)) {
+    if (WebSocketFrame::isReservedOpCode(frame.opCode)) {
         fail("Unrecognized frame opcode: " + String::number(frame.opCode));
         return false;
     }
 
-    if (frame.reserved1 || frame.reserved2 || frame.reserved3) {
-        fail("One or more reserved bits are on: reserved1 = " + String::number(frame.reserved1) + ", reserved2 = " + String::number(frame.reserved2) + ", reserved3 = " + String::number(frame.reserved3));
+    if (frame.reserved2 || frame.reserved3) {
+        fail("One or more reserved bits are on: reserved2 = " + String::number(frame.reserved2) + ", reserved3 = " + String::number(frame.reserved3));
         return false;
     }
 
     // All control frames must not be fragmented.
-    if (isControlOpCode(frame.opCode) && !frame.final) {
+    if (WebSocketFrame::isControlOpCode(frame.opCode) && !frame.final) {
         fail("Received fragmented control frame: opcode = " + String::number(frame.opCode));
         return false;
     }
 
     // All control frames must have a payload of 125 bytes or less, which means the frame must not contain
     // the "extended payload length" field.
-    if (isControlOpCode(frame.opCode) && frame.payloadLength > maxPayloadLengthWithoutExtendedLengthField) {
+    if (WebSocketFrame::isControlOpCode(frame.opCode) && frame.payloadLength > maxPayloadLengthWithoutExtendedLengthField) {
         fail("Received control frame having too long payload: " + String::number(frame.payloadLength) + " bytes");
         return false;
     }
 
     // A new data frame is received before the previous continuous frame finishes.
     // Note that control frames are allowed to come in the middle of continuous frames.
-    if (m_hasContinuousFrame && frame.opCode != OpCodeContinuation && !isControlOpCode(frame.opCode)) {
+    if (m_hasContinuousFrame && frame.opCode != WebSocketFrame::OpCodeContinuation && !WebSocketFrame::isControlOpCode(frame.opCode)) {
         fail("Received new data frame but previous continuous frame is unfinished.");
         return false;
     }
 
     switch (frame.opCode) {
-    case OpCodeContinuation:
+    case WebSocketFrame::OpCodeContinuation:
         // An unexpected continuation frame is received without any leading frame.
         if (!m_hasContinuousFrame) {
             fail("Received unexpected continuation frame.");
             return false;
         }
         m_continuousFrameData.append(frame.payload, frame.payloadLength);
-        skipBuffer(frame.frameEnd - m_buffer);
+        skipBuffer(frameEnd - m_buffer);
         if (frame.final) {
             // onmessage handler may eventually call the other methods of this channel,
             // so we should pretend that we have finished to read this frame and
@@ -664,7 +667,7 @@ bool WebSocketChannel::processFrame()
             OwnPtr<Vector<char> > continuousFrameData = adoptPtr(new Vector<char>);
             m_continuousFrameData.swap(*continuousFrameData);
             m_hasContinuousFrame = false;
-            if (m_continuousFrameOpCode == OpCodeText) {
+            if (m_continuousFrameOpCode == WebSocketFrame::OpCodeText) {
                 String message;
                 if (continuousFrameData->size())
                     message = String::fromUTF8(continuousFrameData->data(), continuousFrameData->size());
@@ -674,48 +677,48 @@ bool WebSocketChannel::processFrame()
                     fail("Could not decode a text frame as UTF-8.");
                 else
                     m_client->didReceiveMessage(message);
-            } else if (m_continuousFrameOpCode == OpCodeBinary)
+            } else if (m_continuousFrameOpCode == WebSocketFrame::OpCodeBinary)
                 m_client->didReceiveBinaryData(continuousFrameData.release());
         }
         break;
 
-    case OpCodeText:
+    case WebSocketFrame::OpCodeText:
         if (frame.final) {
             String message;
             if (frame.payloadLength)
                 message = String::fromUTF8(frame.payload, frame.payloadLength);
             else
                 message = "";
-            skipBuffer(frame.frameEnd - m_buffer);
+            skipBuffer(frameEnd - m_buffer);
             if (message.isNull())
                 fail("Could not decode a text frame as UTF-8.");
             else
                 m_client->didReceiveMessage(message);
         } else {
             m_hasContinuousFrame = true;
-            m_continuousFrameOpCode = OpCodeText;
+            m_continuousFrameOpCode = WebSocketFrame::OpCodeText;
             ASSERT(m_continuousFrameData.isEmpty());
             m_continuousFrameData.append(frame.payload, frame.payloadLength);
-            skipBuffer(frame.frameEnd - m_buffer);
+            skipBuffer(frameEnd - m_buffer);
         }
         break;
 
-    case OpCodeBinary:
+    case WebSocketFrame::OpCodeBinary:
         if (frame.final) {
             OwnPtr<Vector<char> > binaryData = adoptPtr(new Vector<char>(frame.payloadLength));
             memcpy(binaryData->data(), frame.payload, frame.payloadLength);
-            skipBuffer(frame.frameEnd - m_buffer);
+            skipBuffer(frameEnd - m_buffer);
             m_client->didReceiveBinaryData(binaryData.release());
         } else {
             m_hasContinuousFrame = true;
-            m_continuousFrameOpCode = OpCodeBinary;
+            m_continuousFrameOpCode = WebSocketFrame::OpCodeBinary;
             ASSERT(m_continuousFrameData.isEmpty());
             m_continuousFrameData.append(frame.payload, frame.payloadLength);
-            skipBuffer(frame.frameEnd - m_buffer);
+            skipBuffer(frameEnd - m_buffer);
         }
         break;
 
-    case OpCodeClose:
+    case WebSocketFrame::OpCodeClose:
         if (frame.payloadLength >= 2) {
             unsigned char highByte = static_cast<unsigned char>(frame.payload[0]);
             unsigned char lowByte = static_cast<unsigned char>(frame.payload[1]);
@@ -726,7 +729,7 @@ bool WebSocketChannel::processFrame()
             m_closeEventReason = String::fromUTF8(&frame.payload[2], frame.payloadLength - 2);
         else
             m_closeEventReason = "";
-        skipBuffer(frame.frameEnd - m_buffer);
+        skipBuffer(frameEnd - m_buffer);
         m_receivedClosingHandshake = true;
         startClosingHandshake(m_closeEventCode, m_closeEventReason);
         if (m_closing) {
@@ -735,20 +738,20 @@ bool WebSocketChannel::processFrame()
         }
         break;
 
-    case OpCodePing:
-        enqueueRawFrame(OpCodePong, frame.payload, frame.payloadLength);
-        skipBuffer(frame.frameEnd - m_buffer);
+    case WebSocketFrame::OpCodePing:
+        enqueueRawFrame(WebSocketFrame::OpCodePong, frame.payload, frame.payloadLength);
+        skipBuffer(frameEnd - m_buffer);
         break;
 
-    case OpCodePong:
+    case WebSocketFrame::OpCodePong:
         // A server may send a pong in response to our ping, or an unsolicited pong which is not associated with
         // any specific ping. Either way, there's nothing to do on receipt of pong.
-        skipBuffer(frame.frameEnd - m_buffer);
+        skipBuffer(frameEnd - m_buffer);
         break;
 
     default:
         ASSERT_NOT_REACHED();
-        skipBuffer(frame.frameEnd - m_buffer);
+        skipBuffer(frameEnd - m_buffer);
         break;
     }
 
@@ -849,14 +852,14 @@ void WebSocketChannel::enqueueTextFrame(const String& string)
     ASSERT(!m_useHixie76Protocol);
     ASSERT(m_outgoingFrameQueueStatus == OutgoingFrameQueueOpen);
     OwnPtr<QueuedFrame> frame = adoptPtr(new QueuedFrame);
-    frame->opCode = OpCodeText;
+    frame->opCode = WebSocketFrame::OpCodeText;
     frame->frameType = QueuedFrameTypeString;
     frame->stringData = string;
     m_outgoingFrameQueue.append(frame.release());
     processOutgoingFrameQueue();
 }
 
-void WebSocketChannel::enqueueRawFrame(OpCode opCode, const char* data, size_t dataLength)
+void WebSocketChannel::enqueueRawFrame(WebSocketFrame::OpCode opCode, const char* data, size_t dataLength)
 {
     ASSERT(!m_useHixie76Protocol);
     ASSERT(m_outgoingFrameQueueStatus == OutgoingFrameQueueOpen);
@@ -870,7 +873,7 @@ void WebSocketChannel::enqueueRawFrame(OpCode opCode, const char* data, size_t d
     processOutgoingFrameQueue();
 }
 
-void WebSocketChannel::enqueueBlobFrame(OpCode opCode, const Blob& blob)
+void WebSocketChannel::enqueueBlobFrame(WebSocketFrame::OpCode opCode, const Blob& blob)
 {
     ASSERT(!m_useHixie76Protocol);
     ASSERT(m_outgoingFrameQueueStatus == OutgoingFrameQueueOpen);
@@ -911,7 +914,7 @@ void WebSocketChannel::processOutgoingFrameQueue()
                 ASSERT(!m_blobLoader);
                 m_blobLoader = adoptPtr(new FileReaderLoader(FileReaderLoader::ReadAsArrayBuffer, this));
                 m_blobLoaderStatus = BlobLoaderStarted;
-                m_blobLoader->start(m_context, frame->blobData.get());
+                m_blobLoader->start(m_document, frame->blobData.get());
                 m_outgoingFrameQueue.prepend(frame.release());
                 return;
 
@@ -961,44 +964,57 @@ void WebSocketChannel::abortOutgoingFrameQueue()
 #endif
 }
 
-bool WebSocketChannel::sendFrame(OpCode opCode, const char* data, size_t dataLength)
+static void appendMaskedFramePayload(const WebSocketFrame& frame, Vector<char>& frameData)
 {
-    ASSERT(m_handle);
-    ASSERT(!m_suspended);
+    size_t maskingKeyStart = frameData.size();
+    frameData.grow(frameData.size() + maskingKeyWidthInBytes); // Add placeholder for masking key. Will be overwritten.
+    size_t payloadStart = frameData.size();
+    frameData.append(frame.payload, frame.payloadLength);
+
+    cryptographicallyRandomValues(frameData.data() + maskingKeyStart, maskingKeyWidthInBytes);
+    for (size_t i = 0; i < frame.payloadLength; ++i)
+        frameData[payloadStart + i] ^= frameData[maskingKeyStart + i % maskingKeyWidthInBytes];
+}
 
-    Vector<char> frame;
-    ASSERT(!(opCode & ~opCodeMask)); // Checks whether "opCode" fits in the range of opCodes.
-    frame.append(finalBit | opCode);
-    if (dataLength <= maxPayloadLengthWithoutExtendedLengthField)
-        frame.append(maskBit | dataLength);
-    else if (dataLength <= 0xFFFF) {
-        frame.append(maskBit | payloadLengthWithTwoByteExtendedLengthField);
-        frame.append((dataLength & 0xFF00) >> 8);
-        frame.append(dataLength & 0xFF);
+static void makeFrameData(const WebSocketFrame& frame, Vector<char>& frameData)
+{
+    unsigned char firstByte = (frame.final ? finalBit : 0) | frame.opCode;
+    if (frame.compress)
+        firstByte |= compressBit;
+    frameData.append(firstByte);
+    if (frame.payloadLength <= maxPayloadLengthWithoutExtendedLengthField)
+        frameData.append(maskBit | frame.payloadLength);
+    else if (frame.payloadLength <= 0xFFFF) {
+        frameData.append(maskBit | payloadLengthWithTwoByteExtendedLengthField);
+        frameData.append((frame.payloadLength & 0xFF00) >> 8);
+        frameData.append(frame.payloadLength & 0xFF);
     } else {
-        frame.append(maskBit | payloadLengthWithEightByteExtendedLengthField);
+        frameData.append(maskBit | payloadLengthWithEightByteExtendedLengthField);
         char extendedPayloadLength[8];
-        size_t remaining = dataLength;
+        size_t remaining = frame.payloadLength;
         // Fill the length into extendedPayloadLength in the network byte order.
         for (int i = 0; i < 8; ++i) {
             extendedPayloadLength[7 - i] = remaining & 0xFF;
             remaining >>= 8;
         }
         ASSERT(!remaining);
-        frame.append(extendedPayloadLength, 8);
+        frameData.append(extendedPayloadLength, 8);
     }
 
-    // Mask the frame.
-    size_t maskingKeyStart = frame.size();
-    frame.grow(frame.size() + maskingKeyWidthInBytes); // Add placeholder for masking key. Will be overwritten.
-    size_t payloadStart = frame.size();
-    frame.append(data, dataLength);
+    appendMaskedFramePayload(frame, frameData);
+}
 
-    cryptographicallyRandomValues(frame.data() + maskingKeyStart, maskingKeyWidthInBytes);
-    for (size_t i = 0; i < dataLength; ++i)
-        frame[payloadStart + i] ^= frame[maskingKeyStart + i % maskingKeyWidthInBytes];
+bool WebSocketChannel::sendFrame(WebSocketFrame::OpCode opCode, const char* data, size_t dataLength)
+{
+    ASSERT(m_handle);
+    ASSERT(!m_suspended);
 
-    return m_handle->send(frame.data(), frame.size());
+    ASSERT(!(opCode & ~opCodeMask)); // Checks whether "opCode" fits in the range of opCodes.
+    WebSocketFrame frame(opCode, true, false, true, data, dataLength);
+    Vector<char> frameData;
+    makeFrameData(frame, frameData);
+
+    return m_handle->send(frameData.data(), frameData.size());
 }
 
 bool WebSocketChannel::sendFrameHixie76(const char* data, size_t dataLength)
diff --git a/Source/WebCore/websockets/WebSocketChannel.h b/Source/WebCore/websockets/WebSocketChannel.h
index 9f9bab8b1..4bb28c9f2 100644
--- a/Source/WebCore/websockets/WebSocketChannel.h
+++ b/Source/WebCore/websockets/WebSocketChannel.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2011 Google Inc.  All rights reserved.
+ * Copyright (C) 2011, 2012 Google Inc.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
@@ -37,6 +37,7 @@
 #include "SocketStreamHandleClient.h"
 #include "ThreadableWebSocketChannel.h"
 #include "Timer.h"
+#include "WebSocketFrame.h"
 #include "WebSocketHandshake.h"
 #include <wtf/Deque.h>
 #include <wtf/Forward.h>
@@ -46,8 +47,8 @@
 namespace WebCore {
 
 class Blob;
+class Document;
 class FileReaderLoader;
-class ScriptExecutionContext;
 class SocketStreamHandle;
 class SocketStreamError;
 class WebSocketChannelClient;
@@ -59,7 +60,7 @@ class WebSocketChannel : public RefCounted<WebSocketChannel>, public SocketStrea
 {
     WTF_MAKE_FAST_ALLOCATED;
 public:
-    static PassRefPtr<WebSocketChannel> create(ScriptExecutionContext* context, WebSocketChannelClient* client) { return adoptRef(new WebSocketChannel(context, client)); }
+    static PassRefPtr<WebSocketChannel> create(Document* document, WebSocketChannelClient* client) { return adoptRef(new WebSocketChannel(document, client)); }
     virtual ~WebSocketChannel();
 
     bool send(const char* data, int length);
@@ -68,6 +69,7 @@ public:
     virtual bool useHixie76Protocol() OVERRIDE;
     virtual void connect(const KURL&, const String& protocol) OVERRIDE;
     virtual String subprotocol() OVERRIDE;
+    virtual String extensions() OVERRIDE;
     virtual bool send(const String& message) OVERRIDE;
     virtual bool send(const ArrayBuffer&) OVERRIDE;
     virtual bool send(const Blob&) OVERRIDE;
@@ -118,7 +120,7 @@ protected:
     virtual void derefThreadableWebSocketChannel() { deref(); }
 
 private:
-    WebSocketChannel(ScriptExecutionContext*, WebSocketChannelClient*);
+    WebSocketChannel(Document*, WebSocketChannelClient*);
 
     bool appendToBuffer(const char* data, size_t len);
     void skipBuffer(size_t len);
@@ -127,38 +129,13 @@ private:
     void startClosingHandshake(int code, const String& reason);
     void closingTimerFired(Timer<WebSocketChannel>*);
 
-    // Hybi-10 opcodes.
-    typedef unsigned int OpCode;
-    static const OpCode OpCodeContinuation;
-    static const OpCode OpCodeText;
-    static const OpCode OpCodeBinary;
-    static const OpCode OpCodeClose;
-    static const OpCode OpCodePing;
-    static const OpCode OpCodePong;
-
-    static bool isNonControlOpCode(OpCode opCode) { return opCode == OpCodeContinuation || opCode == OpCodeText || opCode == OpCodeBinary; }
-    static bool isControlOpCode(OpCode opCode) { return opCode == OpCodeClose || opCode == OpCodePing || opCode == OpCodePong; }
-    static bool isReservedOpCode(OpCode opCode) { return !isNonControlOpCode(opCode) && !isControlOpCode(opCode); }
-
     enum ParseFrameResult {
         FrameOK,
         FrameIncomplete,
         FrameError
     };
 
-    struct FrameData {
-        OpCode opCode;
-        bool final;
-        bool reserved1;
-        bool reserved2;
-        bool reserved3;
-        bool masked;
-        const char* payload;
-        size_t payloadLength;
-        const char* frameEnd;
-    };
-
-    ParseFrameResult parseFrame(FrameData&); // May modify part of m_buffer to unmask the frame.
+    ParseFrameResult parseFrame(WebSocketFrame&, const char*& frameEnd); // May modify part of m_buffer to unmask the frame.
 
     bool processFrame();
     bool processFrameHixie76();
@@ -179,7 +156,7 @@ private:
         QueuedFrameTypeBlob
     };
     struct QueuedFrame {
-        OpCode opCode;
+        WebSocketFrame::OpCode opCode;
         QueuedFrameType frameType;
         // Only one of the following items is used, according to the value of frameType.
         String stringData;
@@ -187,8 +164,8 @@ private:
         RefPtr<Blob> blobData;
     };
     void enqueueTextFrame(const String&);
-    void enqueueRawFrame(OpCode, const char* data, size_t dataLength);
-    void enqueueBlobFrame(OpCode, const Blob&);
+    void enqueueRawFrame(WebSocketFrame::OpCode, const char* data, size_t dataLength);
+    void enqueueBlobFrame(WebSocketFrame::OpCode, const Blob&);
 
     void processOutgoingFrameQueue();
     void abortOutgoingFrameQueue();
@@ -207,7 +184,7 @@ private:
 
     // If you are going to send a hybi-10 frame, you need to use the outgoing frame queue
     // instead of call sendFrame() directly.
-    bool sendFrame(OpCode, const char* data, size_t dataLength);
+    bool sendFrame(WebSocketFrame::OpCode, const char* data, size_t dataLength);
     bool sendFrameHixie76(const char* data, size_t dataLength);
 
 #if ENABLE(BLOB)
@@ -219,7 +196,7 @@ private:
     };
 #endif
 
-    ScriptExecutionContext* m_context;
+    Document* m_document;
     WebSocketChannelClient* m_client;
     OwnPtr<WebSocketHandshake> m_handshake;
     RefPtr<SocketStreamHandle> m_handle;
@@ -241,7 +218,7 @@ private:
 
     // Private members only for hybi-10 protocol.
     bool m_hasContinuousFrame;
-    OpCode m_continuousFrameOpCode;
+    WebSocketFrame::OpCode m_continuousFrameOpCode;
     Vector<char> m_continuousFrameData;
     unsigned short m_closeEventCode;
     String m_closeEventReason;
diff --git a/Source/WebCore/websockets/WebSocketDeflater.cpp b/Source/WebCore/websockets/WebSocketDeflater.cpp
new file mode 100644
index 000000000..47ea94055
--- /dev/null
+++ b/Source/WebCore/websockets/WebSocketDeflater.cpp
@@ -0,0 +1,212 @@
+/*
+ * Copyright (C) 2012 Google Inc.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#if ENABLE(WEB_SOCKETS)
+
+#include "WebSocketDeflater.h"
+
+#include "Logging.h"
+#include <wtf/FastMalloc.h>
+#include <wtf/HashMap.h>
+#include <wtf/StdLibExtras.h>
+#include <wtf/StringExtras.h>
+#include <wtf/text/StringHash.h>
+#include <wtf/text/WTFString.h>
+#include <zlib.h>
+
+namespace WebCore {
+
+static const int defaultMemLevel = 1;
+static const size_t bufferIncrementUnit = 4096;
+
+PassOwnPtr<WebSocketDeflater> WebSocketDeflater::create(int windowBits, ContextTakeOverMode contextTakeOverMode)
+{
+    return adoptPtr(new WebSocketDeflater(windowBits, contextTakeOverMode));
+}
+
+WebSocketDeflater::WebSocketDeflater(int windowBits, ContextTakeOverMode contextTakeOverMode)
+    : m_windowBits(windowBits)
+    , m_contextTakeOverMode(contextTakeOverMode)
+{
+    ASSERT(m_windowBits >= 8);
+    ASSERT(m_windowBits <= 15);
+    m_stream = adoptPtr(new z_stream);
+    memset(m_stream.get(), 0, sizeof(z_stream));
+}
+
+bool WebSocketDeflater::initialize()
+{
+    return deflateInit2(m_stream.get(), Z_DEFAULT_COMPRESSION, Z_DEFLATED, -m_windowBits, defaultMemLevel, Z_DEFAULT_STRATEGY) == Z_OK;
+}
+
+WebSocketDeflater::~WebSocketDeflater()
+{
+    int result = deflateEnd(m_stream.get());
+    if (result != Z_OK)
+        LOG(Network, "deflateEnd() failed: %d", result);
+}
+
+static void setStreamParameter(z_stream* stream, const char* inputData, size_t inputLength, char* outputData, size_t outputLength)
+{
+    stream->next_in = reinterpret_cast<Bytef*>(const_cast<char*>(inputData));
+    stream->avail_in = inputLength;
+    stream->next_out = reinterpret_cast<Bytef*>(outputData);
+    stream->avail_out = outputLength;
+}
+
+bool WebSocketDeflater::addBytes(const char* data, size_t length)
+{
+    if (!length)
+        return false;
+
+    size_t maxLength = deflateBound(m_stream.get(), length);
+    size_t writePosition = m_buffer.size();
+    m_buffer.grow(writePosition + maxLength);
+    setStreamParameter(m_stream.get(), data, length, m_buffer.data() + writePosition, maxLength);
+    int result = deflate(m_stream.get(), Z_NO_FLUSH);
+    if (result != Z_OK || m_stream->avail_in > 0)
+        return false;
+
+    m_buffer.shrink(writePosition + maxLength - m_stream->avail_out);
+    return true;
+}
+
+bool WebSocketDeflater::finish()
+{
+    while (true) {
+        size_t writePosition = m_buffer.size();
+        m_buffer.grow(writePosition + bufferIncrementUnit);
+        size_t availableCapacity = m_buffer.size() - writePosition;
+        setStreamParameter(m_stream.get(), 0, 0, m_buffer.data() + writePosition, availableCapacity);
+        int result = deflate(m_stream.get(), Z_SYNC_FLUSH);
+        m_buffer.shrink(writePosition + availableCapacity - m_stream->avail_out);
+        if (result == Z_OK)
+            break;
+        if (result != Z_BUF_ERROR)
+            return false;
+    }
+    // Remove 4 octets from the tail as the specification requires.
+    if (m_buffer.size() <= 4)
+        return false;
+    m_buffer.resize(m_buffer.size() - 4);
+    return true;
+}
+
+void WebSocketDeflater::reset()
+{
+    m_buffer.clear();
+    if (m_contextTakeOverMode == DoNotTakeOverContext)
+        deflateReset(m_stream.get());
+}
+
+PassOwnPtr<WebSocketInflater> WebSocketInflater::create(int windowBits)
+{
+    return adoptPtr(new WebSocketInflater(windowBits));
+}
+
+WebSocketInflater::WebSocketInflater(int windowBits)
+    : m_windowBits(windowBits)
+{
+    m_stream = adoptPtr(new z_stream);
+    memset(m_stream.get(), 0, sizeof(z_stream));
+}
+
+bool WebSocketInflater::initialize()
+{
+    return inflateInit2(m_stream.get(), -m_windowBits) == Z_OK;
+}
+
+WebSocketInflater::~WebSocketInflater()
+{
+    int result = inflateEnd(m_stream.get());
+    if (result != Z_OK)
+        LOG(Network, "inflateEnd() failed: %d", result);
+}
+
+bool WebSocketInflater::addBytes(const char* data, size_t length)
+{
+    if (!length)
+        return false;
+
+    size_t consumedSoFar = 0;
+    while (consumedSoFar < length) {
+        size_t writePosition = m_buffer.size();
+        m_buffer.grow(writePosition + bufferIncrementUnit);
+        size_t availableCapacity = m_buffer.size() - writePosition;
+        size_t remainingLength = length - consumedSoFar;
+        setStreamParameter(m_stream.get(), data + consumedSoFar, remainingLength, m_buffer.data() + writePosition, availableCapacity);
+        int result = inflate(m_stream.get(), Z_NO_FLUSH);
+        consumedSoFar += remainingLength - m_stream->avail_in;
+        m_buffer.shrink(writePosition + availableCapacity - m_stream->avail_out);
+        if (result == Z_BUF_ERROR)
+            continue;
+        if (result != Z_OK)
+            return false;
+    }
+    ASSERT(consumedSoFar == length);
+    return true;
+}
+
+bool WebSocketInflater::finish()
+{
+    static const char* strippedFields = "\0\0\xff\xff";
+    static const size_t strippedLength = 4;
+
+    // Appends 4 octests of 0x00 0x00 0xff 0xff
+    size_t consumedSoFar = 0;
+    while (consumedSoFar < strippedLength) {
+        size_t writePosition = m_buffer.size();
+        m_buffer.grow(writePosition + bufferIncrementUnit);
+        size_t availableCapacity = m_buffer.size() - writePosition;
+        size_t remainingLength = strippedLength - consumedSoFar;
+        setStreamParameter(m_stream.get(), strippedFields + consumedSoFar, remainingLength, m_buffer.data() + writePosition, availableCapacity);
+        int result = inflate(m_stream.get(), Z_FINISH);
+        consumedSoFar += remainingLength - m_stream->avail_in;
+        m_buffer.shrink(writePosition + availableCapacity - m_stream->avail_out);
+        if (result == Z_BUF_ERROR)
+            continue;
+        if (result != Z_OK && result != Z_STREAM_END)
+            return false;
+    }
+    ASSERT(consumedSoFar == strippedLength);
+
+    return true;
+}
+
+void WebSocketInflater::reset()
+{
+    m_buffer.clear();
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(WEB_SOCKETS)
diff --git a/Source/WebCore/websockets/WebSocketDeflater.h b/Source/WebCore/websockets/WebSocketDeflater.h
new file mode 100644
index 000000000..9c630dcfb
--- /dev/null
+++ b/Source/WebCore/websockets/WebSocketDeflater.h
@@ -0,0 +1,97 @@
+/*
+ * Copyright (C) 2012 Google Inc.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebSocketDeflater_h
+#define WebSocketDeflater_h
+
+#if ENABLE(WEB_SOCKETS)
+
+#include <wtf/Noncopyable.h>
+#include <wtf/OwnPtr.h>
+#include <wtf/PassOwnPtr.h>
+#include <wtf/Vector.h>
+
+struct z_stream_s;
+typedef z_stream_s z_stream;
+
+namespace WebCore {
+
+class WebSocketDeflater {
+public:
+    enum ContextTakeOverMode {
+        DoNotTakeOverContext,
+        TakeOverContext
+    };
+    static PassOwnPtr<WebSocketDeflater> create(int windowBits, ContextTakeOverMode = TakeOverContext);
+
+    ~WebSocketDeflater();
+
+    bool initialize();
+    bool addBytes(const char*, size_t);
+    bool finish();
+    const char* data() { return m_buffer.data(); }
+    size_t size() const { return m_buffer.size(); }
+    void reset();
+
+private:
+    WebSocketDeflater(int windowBits, ContextTakeOverMode);
+
+    int m_windowBits;
+    ContextTakeOverMode m_contextTakeOverMode;
+    Vector<char> m_buffer;
+    OwnPtr<z_stream> m_stream;
+};
+
+class WebSocketInflater {
+public:
+    static PassOwnPtr<WebSocketInflater> create(int windowBits = 15);
+
+    ~WebSocketInflater();
+
+    bool initialize();
+    bool addBytes(const char*, size_t);
+    bool finish();
+    const char* data() { return m_buffer.data(); }
+    size_t size() const { return m_buffer.size(); }
+    void reset();
+
+private:
+    explicit WebSocketInflater(int windowBits);
+
+    int m_windowBits;
+    Vector<char> m_buffer;
+    OwnPtr<z_stream> m_stream;
+};
+
+}
+
+#endif // ENABLE(WEB_SOCKETS)
+
+#endif // WebSocketDeflater_h
diff --git a/Source/WebCore/websockets/WebSocketExtensionDispatcher.cpp b/Source/WebCore/websockets/WebSocketExtensionDispatcher.cpp
new file mode 100644
index 000000000..7c592ad1b
--- /dev/null
+++ b/Source/WebCore/websockets/WebSocketExtensionDispatcher.cpp
@@ -0,0 +1,278 @@
+/*
+ * Copyright (C) 2012 Google Inc.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#if ENABLE(WEB_SOCKETS)
+
+#include "WebSocketExtensionDispatcher.h"
+
+#include <wtf/ASCIICType.h>
+#include <wtf/HashMap.h>
+#include <wtf/text/CString.h>
+#include <wtf/text/StringHash.h>
+
+namespace WebCore {
+
+class ExtensionParser {
+public:
+    ExtensionParser(const char* start, const char* end)
+        : m_current(start)
+        , m_end(end)
+    {
+    }
+    bool finished();
+    bool parsedSuccessfully();
+    const String& currentToken() { return m_currentToken; }
+
+    // The following member functions basically follow the grammer defined
+    // in Section 2.2 of RFC 2616.
+    bool consumeToken();
+    bool consumeQuotedString();
+    bool consumeQuotedStringOrToken();
+    bool consumeCharacter(char);
+
+private:
+    void skipSpaces();
+
+    const char* m_current;
+    const char* m_end;
+    String m_currentToken;
+};
+
+bool ExtensionParser::finished()
+{
+    return m_current >= m_end;
+}
+
+bool ExtensionParser::parsedSuccessfully()
+{
+    return m_current == m_end;
+}
+
+static bool isSeparator(char character)
+{
+    static const char* separatorCharacters = "()<>@,;:\\\"/[]?={} \t";
+    const char* p = strchr(separatorCharacters, character);
+    return p && *p;
+}
+
+void ExtensionParser::skipSpaces()
+{
+    while (m_current < m_end && (*m_current == ' ' || *m_current == '\t'))
+        ++m_current;
+}
+
+bool ExtensionParser::consumeToken()
+{
+    skipSpaces();
+    const char* start = m_current;
+    while (m_current < m_end && isASCIIPrintable(*m_current) && !isSeparator(*m_current))
+        ++m_current;
+    if (start < m_current) {
+        m_currentToken = String(start, m_current - start);
+        return true;
+    }
+    return false;
+}
+
+bool ExtensionParser::consumeQuotedString()
+{
+    skipSpaces();
+    if (m_current >= m_end || *m_current != '"')
+        return false;
+
+    Vector<char> buffer;
+    ++m_current;
+    while (m_current < m_end && *m_current != '"') {
+        if (*m_current == '\\' && ++m_current >= m_end)
+            return false;
+        buffer.append(*m_current);
+        ++m_current;
+    }
+    if (m_current >= m_end || *m_current != '"')
+        return false;
+    m_currentToken = String::fromUTF8(buffer.data(), buffer.size());
+    ++m_current;
+    return true;
+}
+
+bool ExtensionParser::consumeQuotedStringOrToken()
+{
+    // This is ok because consumeQuotedString() doesn't update m_current or
+    // makes it same as m_end on failure.
+    return consumeQuotedString() || consumeToken();
+}
+
+bool ExtensionParser::consumeCharacter(char character)
+{
+    skipSpaces();
+    if (m_current < m_end && *m_current == character) {
+        ++m_current;
+        return true;
+    }
+    return false;
+}
+
+void WebSocketExtensionDispatcher::reset()
+{
+    m_processors.clear();
+}
+
+void WebSocketExtensionDispatcher::addProcessor(PassOwnPtr<WebSocketExtensionProcessor> processor)
+{
+    for (size_t i = 0; i < m_processors.size(); ++i) {
+        if (m_processors[i]->extensionToken() == processor->extensionToken())
+            return;
+    }
+    ASSERT(processor->handshakeString().length());
+    ASSERT(!processor->handshakeString().contains('\n'));
+    ASSERT(!processor->handshakeString().contains(static_cast<UChar>('\0')));
+    m_processors.append(processor);
+}
+
+const String WebSocketExtensionDispatcher::createHeaderValue() const
+{
+    size_t numProcessors = m_processors.size();
+    if (!numProcessors)
+        return String();
+
+    StringBuilder builder;
+    builder.append(m_processors[0]->handshakeString());
+    for (size_t i = 1; i < numProcessors; ++i) {
+        builder.append(", ");
+        builder.append(m_processors[i]->handshakeString());
+    }
+    return builder.toString();
+}
+
+void WebSocketExtensionDispatcher::appendAcceptedExtension(const String& extensionToken, HashMap<String, String>& extensionParameters)
+{
+    if (!m_acceptedExtensionsBuilder.isEmpty())
+        m_acceptedExtensionsBuilder.append(", ");
+    m_acceptedExtensionsBuilder.append(extensionToken);
+    // FIXME: Should use ListHashSet to keep the order of the parameters.
+    for (HashMap<String, String>::const_iterator iterator = extensionParameters.begin(); iterator != extensionParameters.end(); ++iterator) {
+        m_acceptedExtensionsBuilder.append("; ");
+        m_acceptedExtensionsBuilder.append(iterator->first);
+        if (!iterator->second.isNull()) {
+            m_acceptedExtensionsBuilder.append("=");
+            m_acceptedExtensionsBuilder.append(iterator->second);
+        }
+    }
+}
+
+void WebSocketExtensionDispatcher::fail(const String& reason)
+{
+    m_failureReason = reason;
+    m_acceptedExtensionsBuilder.clear();
+}
+
+bool WebSocketExtensionDispatcher::processHeaderValue(const String& headerValue)
+{
+    if (!headerValue.length())
+        return true;
+
+    // If we don't send Sec-WebSocket-Extensions header, the server should not return the header.
+    if (!m_processors.size()) {
+        fail("Received unexpected Sec-WebSocket-Extensions header");
+        return false;
+    }
+
+    const CString headerValueData = headerValue.utf8();
+    ExtensionParser parser(headerValueData.data(), headerValueData.data() + headerValueData.length());
+    while (!parser.finished()) {
+        // Parse extension-token.
+        if (!parser.consumeToken()) {
+            fail("Sec-WebSocket-Extensions header is invalid");
+            return false;
+        }
+        String extensionToken = parser.currentToken();
+
+        // Parse extension-parameters if exists.
+        HashMap<String, String> extensionParameters;
+        while (parser.consumeCharacter(';')) {
+            if (!parser.consumeToken()) {
+                fail("Sec-WebSocket-Extensions header is invalid");
+                return false;
+            }
+
+            String parameterToken = parser.currentToken();
+            if (parser.consumeCharacter('=')) {
+                if (parser.consumeQuotedStringOrToken())
+                    extensionParameters.add(parameterToken, parser.currentToken());
+                else {
+                    fail("Sec-WebSocket-Extensions header is invalid");
+                    return false;
+                }
+            } else
+                extensionParameters.add(parameterToken, String());
+        }
+        if (!parser.finished() && !parser.consumeCharacter(',')) {
+            fail("Sec-WebSocket-Extensions header is invalid");
+            return false;
+        }
+
+        size_t index;
+        for (index = 0; index < m_processors.size(); ++index) {
+            WebSocketExtensionProcessor* processor = m_processors[index].get();
+            if (extensionToken == processor->extensionToken()) {
+                if (processor->processResponse(extensionParameters)) {
+                    appendAcceptedExtension(extensionToken, extensionParameters);
+                    break;
+                }
+                fail(processor->failureReason());
+                return false;
+            }
+        }
+        // There is no extension which can process the response.
+        if (index == m_processors.size()) {
+            fail("Received unexpected extension: " + extensionToken);
+            return false;
+        }
+    }
+    return parser.parsedSuccessfully();
+}
+
+String WebSocketExtensionDispatcher::acceptedExtensions() const
+{
+    if (m_acceptedExtensionsBuilder.isEmpty())
+        return String();
+    return m_acceptedExtensionsBuilder.toStringPreserveCapacity();
+}
+
+String WebSocketExtensionDispatcher::failureReason() const
+{
+    return m_failureReason;
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(WEB_SOCKETS)
diff --git a/Source/WebCore/websockets/WebSocketExtensionDispatcher.h b/Source/WebCore/websockets/WebSocketExtensionDispatcher.h
new file mode 100644
index 000000000..35cd769ea
--- /dev/null
+++ b/Source/WebCore/websockets/WebSocketExtensionDispatcher.h
@@ -0,0 +1,70 @@
+/*
+ * Copyright (C) 2012 Google Inc.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebSocketExtensionDispatcher_h
+#define WebSocketExtensionDispatcher_h
+
+#if ENABLE(WEB_SOCKETS)
+
+#include "WebSocketExtensionProcessor.h"
+#include <wtf/OwnPtr.h>
+#include <wtf/PassOwnPtr.h>
+#include <wtf/Vector.h>
+#include <wtf/text/StringBuilder.h>
+#include <wtf/text/WTFString.h>
+
+namespace WebCore {
+
+class WebSocketExtensionDispatcher {
+public:
+    WebSocketExtensionDispatcher() { }
+
+    void reset();
+    void addProcessor(PassOwnPtr<WebSocketExtensionProcessor>);
+    const String createHeaderValue() const;
+
+    bool processHeaderValue(const String&);
+    String acceptedExtensions() const;
+    String failureReason() const;
+
+private:
+    void appendAcceptedExtension(const String& extensionToken, HashMap<String, String>& extensionParameters);
+    void fail(const String& reason);
+
+    Vector<OwnPtr<WebSocketExtensionProcessor> > m_processors;
+    StringBuilder m_acceptedExtensionsBuilder;
+    String m_failureReason;
+};
+
+}
+
+#endif // ENABLE(WEB_SOCKETS)
+
+#endif // WebSocketExtensionDispatcher_h
diff --git a/Source/WebCore/websockets/WebSocketExtensionProcessor.h b/Source/WebCore/websockets/WebSocketExtensionProcessor.h
new file mode 100644
index 000000000..ee3d53d41
--- /dev/null
+++ b/Source/WebCore/websockets/WebSocketExtensionProcessor.h
@@ -0,0 +1,74 @@
+/*
+ * Copyright (C) 2012 Google Inc.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebSocketExtensionProcessor_h
+#define WebSocketExtensionProcessor_h
+
+#if ENABLE(WEB_SOCKETS)
+
+#include <wtf/HashMap.h>
+#include <wtf/text/WTFString.h>
+
+namespace WebCore {
+
+class WebSocketExtensionProcessor {
+public:
+    virtual ~WebSocketExtensionProcessor() { }
+
+    String extensionToken() const { return m_extensionToken; }
+
+    // The return value of this method will be a part of the value of
+    // Sec-WebSocket-Extensions.
+    virtual String handshakeString() = 0;
+
+    // This should validate the server's response parameters which are passed
+    // as HashMap<key, value>. This may also do something for the extension.
+    // Note that this method may be called more than once when the server
+    // response contains duplicate extension token that matches extensionToken().
+    virtual bool processResponse(const HashMap<String, String>&) = 0;
+
+    // If procecssResponse() returns false, this should provide the reason.
+    virtual String failureReason() { return "Extension " + m_extensionToken + " failed"; }
+
+protected:
+    WebSocketExtensionProcessor(const String& extensionToken)
+        : m_extensionToken(extensionToken)
+    {
+    }
+
+private:
+    String m_extensionToken;
+};
+
+}
+
+#endif // ENABLE(WEB_SOCKETS)
+
+#endif // WebSocketExtensionProcessor_h
diff --git a/Source/WebCore/websockets/WebSocketFrame.h b/Source/WebCore/websockets/WebSocketFrame.h
new file mode 100644
index 000000000..7efea78db
--- /dev/null
+++ b/Source/WebCore/websockets/WebSocketFrame.h
@@ -0,0 +1,80 @@
+/*
+ * Copyright (C) 2012 Google Inc.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebSocketFrame_h
+#define WebSocketFrame_h
+
+#if ENABLE(WEB_SOCKETS)
+
+namespace WebCore {
+
+struct WebSocketFrame {
+    // RFC6455 opcodes.
+    enum OpCode {
+        OpCodeContinuation = 0x0,
+        OpCodeText = 0x1,
+        OpCodeBinary = 0x2,
+        OpCodeClose = 0x8,
+        OpCodePing = 0x9,
+        OpCodePong = 0xA,
+        OpCodeInvalid = 0x10
+    };
+
+    static bool isNonControlOpCode(OpCode opCode) { return opCode == OpCodeContinuation || opCode == OpCodeText || opCode == OpCodeBinary; }
+    static bool isControlOpCode(OpCode opCode) { return opCode == OpCodeClose || opCode == OpCodePing || opCode == OpCodePong; }
+    static bool isReservedOpCode(OpCode opCode) { return !isNonControlOpCode(opCode) && !isControlOpCode(opCode); }
+
+    WebSocketFrame(OpCode opCode = OpCodeInvalid, bool final = false, bool compress = false, bool masked = false, const char* payload = 0, size_t payloadLength = 0)
+        : opCode(opCode)
+        , final(final)
+        , compress(compress)
+        , reserved2(false)
+        , reserved3(false)
+        , masked(masked)
+        , payload(payload)
+        , payloadLength(payloadLength)
+    {
+    }
+
+    OpCode opCode;
+    bool final;
+    bool compress;
+    bool reserved2;
+    bool reserved3;
+    bool masked;
+    const char* payload;
+    size_t payloadLength;
+};
+
+} // namespace WebCore
+
+#endif // ENABLE(WEB_SOCKETS)
+
+#endif // WebSocketFrame_h
diff --git a/Source/WebCore/websockets/WebSocketHandshake.cpp b/Source/WebCore/websockets/WebSocketHandshake.cpp
index 8909efaf1..8cc509e59 100644
--- a/Source/WebCore/websockets/WebSocketHandshake.cpp
+++ b/Source/WebCore/websockets/WebSocketHandshake.cpp
@@ -287,6 +287,9 @@ CString WebSocketHandshake::clientHandshakeMessage() const
     } else {
         fields.append("Sec-WebSocket-Key: " + m_secWebSocketKey);
         fields.append("Sec-WebSocket-Version: 13");
+        const String extensionValue = m_extensionDispatcher.createHeaderValue();
+        if (extensionValue.length())
+            fields.append("Sec-WebSocket-Extensions: " + extensionValue);
     }
 
     // Fields in the handshake are sent by the client in a random order; the
@@ -344,6 +347,9 @@ WebSocketHandshakeRequest WebSocketHandshake::clientHandshakeRequest() const
     } else {
         request.addHeaderField("Sec-WebSocket-Key", m_secWebSocketKey);
         request.addHeaderField("Sec-WebSocket-Version", "13");
+        const String extensionValue = m_extensionDispatcher.createHeaderValue();
+        if (extensionValue.length())
+            request.addHeaderField("Sec-WebSocket-Extensions", extensionValue);
     }
 
     return request;
@@ -352,6 +358,7 @@ WebSocketHandshakeRequest WebSocketHandshake::clientHandshakeRequest() const
 void WebSocketHandshake::reset()
 {
     m_mode = Incomplete;
+    m_extensionDispatcher.reset();
 }
 
 void WebSocketHandshake::clearScriptExecutionContext()
@@ -469,9 +476,9 @@ String WebSocketHandshake::serverWebSocketAccept() const
     return m_response.headerFields().get("sec-websocket-accept");
 }
 
-String WebSocketHandshake::serverWebSocketExtensions() const
+String WebSocketHandshake::acceptedExtensions() const
 {
-    return m_response.headerFields().get("sec-websocket-extensions");
+    return m_extensionDispatcher.acceptedExtensions();
 }
 
 const WebSocketHandshakeResponse& WebSocketHandshake::serverHandshakeResponse() const
@@ -479,6 +486,11 @@ const WebSocketHandshakeResponse& WebSocketHandshake::serverHandshakeResponse()
     return m_response;
 }
 
+void WebSocketHandshake::addExtensionProcessor(PassOwnPtr<WebSocketExtensionProcessor> processor)
+{
+    m_extensionDispatcher.addProcessor(processor);
+}
+
 KURL WebSocketHandshake::httpURLForAuthenticationAndCookies() const
 {
     KURL url = m_url.copy();
@@ -625,7 +637,15 @@ const char* WebSocketHandshake::readHTTPHeaders(const char* start, const char* e
             return 0;
         }
         LOG(Network, "name=%s value=%s", nameStr.string().utf8().data(), valueStr.utf8().data());
-        m_response.addHeaderField(nameStr, valueStr);
+        // Sec-WebSocket-Extensions may be split. We parse and check the
+        // header value every time the header appears.
+        if (equalIgnoringCase("sec-websocket-extensions", nameStr)) {
+            if (!m_extensionDispatcher.processHeaderValue(valueStr)) {
+                m_failureReason = m_extensionDispatcher.failureReason();
+                return 0;
+            }
+        } else
+            m_response.addHeaderField(nameStr, valueStr);
     }
     ASSERT_NOT_REACHED();
     return 0;
@@ -639,7 +659,6 @@ bool WebSocketHandshake::checkResponseHeaders()
     const String& serverUpgrade = this->serverUpgrade();
     const String& serverConnection = this->serverConnection();
     const String& serverWebSocketAccept = this->serverWebSocketAccept();
-    const String& serverWebSocketExtensions = this->serverWebSocketExtensions();
 
     if (serverUpgrade.isNull()) {
         m_failureReason = "Error during WebSocket handshake: 'Upgrade' header is missing";
@@ -692,13 +711,6 @@ bool WebSocketHandshake::checkResponseHeaders()
             m_failureReason = "Error during WebSocket handshake: Sec-WebSocket-Accept mismatch";
             return false;
         }
-        if (!serverWebSocketExtensions.isNull()) {
-            // WebSocket protocol extensions are not supported yet.
-            // We do not send Sec-WebSocket-Extensions header in our request, thus
-            // servers should not return this header, either.
-            m_failureReason = "Error during WebSocket handshake: Sec-WebSocket-Extensions header is invalid";
-            return false;
-        }
     }
     return true;
 }
diff --git a/Source/WebCore/websockets/WebSocketHandshake.h b/Source/WebCore/websockets/WebSocketHandshake.h
index 12c184019..b025f0c27 100644
--- a/Source/WebCore/websockets/WebSocketHandshake.h
+++ b/Source/WebCore/websockets/WebSocketHandshake.h
@@ -35,8 +35,11 @@
 
 #include "KURL.h"
 #include "PlatformString.h"
+#include "WebSocketExtensionDispatcher.h"
+#include "WebSocketExtensionProcessor.h"
 #include "WebSocketHandshakeRequest.h"
 #include "WebSocketHandshakeResponse.h"
+#include <wtf/PassOwnPtr.h>
 
 namespace WebCore {
 
@@ -81,10 +84,12 @@ public:
     String serverUpgrade() const;
     String serverConnection() const;
     String serverWebSocketAccept() const; // Only for hybi-10 handshake.
-    String serverWebSocketExtensions() const; // Only for hybi-10 handshake.
+    String acceptedExtensions() const;
 
     const WebSocketHandshakeResponse& serverHandshakeResponse() const;
 
+    void addExtensionProcessor(PassOwnPtr<WebSocketExtensionProcessor>);
+
 private:
     KURL httpURLForAuthenticationAndCookies() const;
 
@@ -116,6 +121,8 @@ private:
     // For hybi-10 handshake.
     String m_secWebSocketKey;
     String m_expectedAccept;
+
+    WebSocketExtensionDispatcher m_extensionDispatcher;
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/websockets/WorkerThreadableWebSocketChannel.cpp b/Source/WebCore/websockets/WorkerThreadableWebSocketChannel.cpp
index f0e63e125..c7486557a 100644
--- a/Source/WebCore/websockets/WorkerThreadableWebSocketChannel.cpp
+++ b/Source/WebCore/websockets/WorkerThreadableWebSocketChannel.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2011 Google Inc.  All rights reserved.
+ * Copyright (C) 2011, 2012 Google Inc.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
@@ -36,6 +36,7 @@
 
 #include "Blob.h"
 #include "CrossThreadTask.h"
+#include "Document.h"
 #include "PlatformString.h"
 #include "ScriptExecutionContext.h"
 #include "ThreadableWebSocketChannelClientWrapper.h"
@@ -53,7 +54,7 @@ namespace WebCore {
 
 WorkerThreadableWebSocketChannel::WorkerThreadableWebSocketChannel(WorkerContext* context, WebSocketChannelClient* client, const String& taskMode)
     : m_workerContext(context)
-    , m_workerClientWrapper(ThreadableWebSocketChannelClientWrapper::create(client))
+    , m_workerClientWrapper(ThreadableWebSocketChannelClientWrapper::create(context, client))
     , m_bridge(Bridge::create(m_workerClientWrapper, m_workerContext, taskMode))
 {
 }
@@ -82,6 +83,12 @@ String WorkerThreadableWebSocketChannel::subprotocol()
     return m_workerClientWrapper->subprotocol();
 }
 
+String WorkerThreadableWebSocketChannel::extensions()
+{
+    ASSERT(m_workerClientWrapper);
+    return m_workerClientWrapper->extensions();
+}
+
 bool WorkerThreadableWebSocketChannel::send(const String& message)
 {
     if (!m_bridge)
@@ -145,7 +152,7 @@ void WorkerThreadableWebSocketChannel::resume()
 WorkerThreadableWebSocketChannel::Peer::Peer(PassRefPtr<ThreadableWebSocketChannelClientWrapper> clientWrapper, WorkerLoaderProxy& loaderProxy, ScriptExecutionContext* context, const String& taskMode)
     : m_workerClientWrapper(clientWrapper)
     , m_loaderProxy(loaderProxy)
-    , m_mainWebSocketChannel(WebSocketChannel::create(context, this))
+    , m_mainWebSocketChannel(WebSocketChannel::create(static_cast<Document*>(context), this))
     , m_taskMode(taskMode)
 {
     ASSERT(isMainThread());
@@ -262,17 +269,18 @@ void WorkerThreadableWebSocketChannel::Peer::resume()
     m_mainWebSocketChannel->resume();
 }
 
-static void workerContextDidConnect(ScriptExecutionContext* context, PassRefPtr<ThreadableWebSocketChannelClientWrapper> workerClientWrapper, const String& subprotocol)
+static void workerContextDidConnect(ScriptExecutionContext* context, PassRefPtr<ThreadableWebSocketChannelClientWrapper> workerClientWrapper, const String& subprotocol, const String& extensions)
 {
     ASSERT_UNUSED(context, context->isWorkerContext());
     workerClientWrapper->setSubprotocol(subprotocol);
+    workerClientWrapper->setExtensions(extensions);
     workerClientWrapper->didConnect();
 }
 
 void WorkerThreadableWebSocketChannel::Peer::didConnect()
 {
     ASSERT(isMainThread());
-    m_loaderProxy.postTaskForModeToWorkerContext(createCallbackTask(&workerContextDidConnect, m_workerClientWrapper, m_mainWebSocketChannel->subprotocol()), m_taskMode);
+    m_loaderProxy.postTaskForModeToWorkerContext(createCallbackTask(&workerContextDidConnect, m_workerClientWrapper, m_mainWebSocketChannel->subprotocol(), m_mainWebSocketChannel->extensions()), m_taskMode);
 }
 
 static void workerContextDidReceiveMessage(ScriptExecutionContext* context, PassRefPtr<ThreadableWebSocketChannelClientWrapper> workerClientWrapper, const String& message)
diff --git a/Source/WebCore/websockets/WorkerThreadableWebSocketChannel.h b/Source/WebCore/websockets/WorkerThreadableWebSocketChannel.h
index 2b1fa38df..317fce93c 100644
--- a/Source/WebCore/websockets/WorkerThreadableWebSocketChannel.h
+++ b/Source/WebCore/websockets/WorkerThreadableWebSocketChannel.h
@@ -64,6 +64,7 @@ public:
     virtual bool useHixie76Protocol() OVERRIDE;
     virtual void connect(const KURL&, const String& protocol) OVERRIDE;
     virtual String subprotocol() OVERRIDE;
+    virtual String extensions() OVERRIDE;
     virtual bool send(const String& message) OVERRIDE;
     virtual bool send(const ArrayBuffer&) OVERRIDE;
     virtual bool send(const Blob&) OVERRIDE;
diff --git a/Source/WebCore/workers/AbstractWorker.idl b/Source/WebCore/workers/AbstractWorker.idl
index e11e34c10..3c90d1ed7 100644
--- a/Source/WebCore/workers/AbstractWorker.idl
+++ b/Source/WebCore/workers/AbstractWorker.idl
@@ -34,7 +34,7 @@ module threads {
     interface [
         Conditional=WORKERS,
         ActiveDOMObject,
-        JSCustomToJS,
+        JSCustomToJSObject,
         EventTarget
     ] AbstractWorker {
 
diff --git a/Source/WebCore/workers/DOMWindowWorker.idl b/Source/WebCore/workers/DOMWindowWorker.idl
new file mode 100644
index 000000000..80bb93a39
--- /dev/null
+++ b/Source/WebCore/workers/DOMWindowWorker.idl
@@ -0,0 +1,29 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ */
+
+module window {
+
+    interface [
+        Supplemental=DOMWindow
+    ] DOMWindowWorker {
+        attribute [Conditional=WORKERS] WorkerConstructor Worker; // Usable with the new operator
+        attribute [Conditional=SHARED_WORKERS, JSCustomGetter, V8EnabledAtRuntime] SharedWorkerConstructor SharedWorker; // Usable with the new operator
+    };
+
+}
diff --git a/Source/WebCore/workers/SharedWorker.cpp b/Source/WebCore/workers/SharedWorker.cpp
index ff0792c54..9e94ee50f 100644
--- a/Source/WebCore/workers/SharedWorker.cpp
+++ b/Source/WebCore/workers/SharedWorker.cpp
@@ -58,6 +58,8 @@ PassRefPtr<SharedWorker> SharedWorker::create(ScriptExecutionContext* context, c
     OwnPtr<MessagePortChannel> remotePort = channel->port2()->disentangle(ec);
     ASSERT(remotePort);
 
+    worker->suspendIfNeeded();
+
     KURL scriptURL = worker->resolveURL(url, ec);
     if (scriptURL.isEmpty())
         return 0;
diff --git a/Source/WebCore/workers/SharedWorker.idl b/Source/WebCore/workers/SharedWorker.idl
index 5c7e47752..d2152720e 100644
--- a/Source/WebCore/workers/SharedWorker.idl
+++ b/Source/WebCore/workers/SharedWorker.idl
@@ -36,12 +36,12 @@ module threads {
         ActiveDOMObject,
         JSCustomConstructor,
         ConstructorParameters=2,
-        Constructor(in DOMString scriptURL, in [Optional=CallWithNullValue] DOMString name),
+        Constructor(in DOMString scriptURL, in [Optional=DefaultIsNullString] DOMString name),
         CallWith=ScriptExecutionContext,
         ConstructorRaisesException,
         JSCustomMarkFunction,
         JSGenerateToNativeObject,
-        JSGenerateToJS
+        JSGenerateToJSObject
     ] SharedWorker : AbstractWorker {
         readonly attribute MessagePort port;
     };
diff --git a/Source/WebCore/workers/Worker.cpp b/Source/WebCore/workers/Worker.cpp
index b3236a7cf..ec965a4e7 100644
--- a/Source/WebCore/workers/Worker.cpp
+++ b/Source/WebCore/workers/Worker.cpp
@@ -60,6 +60,8 @@ PassRefPtr<Worker> Worker::create(ScriptExecutionContext* context, const String&
 {
     RefPtr<Worker> worker = adoptRef(new Worker(context));
 
+    worker->suspendIfNeeded();
+
     KURL scriptURL = worker->resolveURL(url, ec);
     if (scriptURL.isEmpty())
         return 0;
@@ -148,7 +150,6 @@ void Worker::notifyFinished()
         if (InspectorInstrumentation::shouldPauseDedicatedWorkerOnStart(scriptExecutionContext()))
             startMode = PauseWorkerContextOnStart;
         m_contextProxy->startWorkerContext(m_scriptLoader->url(), scriptExecutionContext()->userAgent(m_scriptLoader->url()), m_scriptLoader->script(), startMode);
-        InspectorInstrumentation::didStartWorkerContext(scriptExecutionContext(), m_contextProxy, m_scriptLoader->url());
         InspectorInstrumentation::scriptImported(scriptExecutionContext(), m_scriptLoader->identifier(), m_scriptLoader->script());
     }
     m_scriptLoader = nullptr;
diff --git a/Source/WebCore/workers/Worker.idl b/Source/WebCore/workers/Worker.idl
index 623f84727..867d36710 100644
--- a/Source/WebCore/workers/Worker.idl
+++ b/Source/WebCore/workers/Worker.idl
@@ -36,7 +36,7 @@ module threads {
         CallWith=ScriptExecutionContext,
         ConstructorRaisesException,
         JSGenerateToNativeObject,
-        JSGenerateToJS
+        JSGenerateToJSObject
     ] Worker : AbstractWorker {
 
         attribute EventListener onmessage;
diff --git a/Source/WebCore/workers/WorkerContext.idl b/Source/WebCore/workers/WorkerContext.idl
index a2cd2392e..a5408d785 100644
--- a/Source/WebCore/workers/WorkerContext.idl
+++ b/Source/WebCore/workers/WorkerContext.idl
@@ -29,13 +29,14 @@ module threads {
     interface [
         Conditional=WORKERS,
         JSCustomMarkFunction,
-        JSCustomGetOwnPropertySlotDelegate,
+        JSCustomGetOwnPropertySlotAndDescriptor,
         EventTarget,
         ExtendsDOMGlobalObject,
         IsWorkerContext,
         JSLegacyParent=JSWorkerContextBase,
         JSNoStaticTables,
-        OmitConstructor
+        OmitConstructor,
+        V8CustomToJSObject
     ] WorkerContext {
 
         // WorkerGlobalScope
@@ -59,10 +60,10 @@ module threads {
         // Timers
         [Custom] long setTimeout(in TimeoutHandler handler, in long timeout);
         // [Custom] long setTimeout(in DOMString code, in long timeout);
-        void clearTimeout(in [Optional=CallWithDefaultValue] long handle);
+        void clearTimeout(in [Optional=DefaultIsUndefined] long handle);
         [Custom] long setInterval(in TimeoutHandler handler, in long timeout);
         // [Custom] long setInterval(in DOMString code, in long timeout);
-        void clearInterval(in [Optional=CallWithDefaultValue] long handle);
+        void clearInterval(in [Optional=DefaultIsUndefined] long handle);
 
 
         // EventTarget interface
diff --git a/Source/WebCore/workers/WorkerMessagingProxy.cpp b/Source/WebCore/workers/WorkerMessagingProxy.cpp
index 6cbdbe9e8..1fdccbd62 100644
--- a/Source/WebCore/workers/WorkerMessagingProxy.cpp
+++ b/Source/WebCore/workers/WorkerMessagingProxy.cpp
@@ -21,7 +21,7 @@
  * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
  * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  *
  */
 
@@ -276,6 +276,7 @@ void WorkerMessagingProxy::startWorkerContext(const KURL& scriptURL, const Strin
                                                                          m_scriptExecutionContext->contentSecurityPolicy()->headerType());
     workerThreadCreated(thread);
     thread->start();
+    InspectorInstrumentation::didStartWorkerContext(m_scriptExecutionContext.get(), this, scriptURL);
 }
 
 void WorkerMessagingProxy::postMessageToWorkerObject(PassRefPtr<SerializedScriptValue> message, PassOwnPtr<MessagePortChannelArray> channels)
@@ -315,7 +316,7 @@ void WorkerMessagingProxy::postExceptionToWorkerObject(const String& errorMessag
 {
     m_scriptExecutionContext->postTask(WorkerExceptionTask::create(errorMessage, lineNumber, sourceURL, this));
 }
-    
+
 static void postConsoleMessageTask(ScriptExecutionContext* context, WorkerMessagingProxy* messagingProxy, MessageSource source, MessageType type, MessageLevel level, const String& message, unsigned lineNumber, const String& sourceURL)
 {
     if (messagingProxy->askedToTerminate())
@@ -410,6 +411,7 @@ void WorkerMessagingProxy::sendMessageToInspector(const String& message)
         return;
 #if ENABLE(JAVASCRIPT_DEBUGGER)
     m_workerThread->runLoop().postTaskForMode(createCallbackTask(dispatchOnInspectorBackendTask, String(message)), WorkerDebuggerAgent::debuggerTaskMode);
+    WorkerDebuggerAgent::interruptAndDispatchInspectorCommands(m_workerThread.get());
 #endif
 }
 #endif
diff --git a/Source/WebCore/workers/WorkerRunLoop.cpp b/Source/WebCore/workers/WorkerRunLoop.cpp
index 992a09aeb..eb665d26b 100644
--- a/Source/WebCore/workers/WorkerRunLoop.cpp
+++ b/Source/WebCore/workers/WorkerRunLoop.cpp
@@ -132,26 +132,28 @@ void WorkerRunLoop::run(WorkerContext* context)
     ModePredicate modePredicate(defaultMode());
     MessageQueueWaitResult result;
     do {
-        result = runInMode(context, modePredicate);
+        result = runInMode(context, modePredicate, WaitForMessage);
     } while (result != MessageQueueTerminated);
     runCleanupTasks(context);
 }
 
-MessageQueueWaitResult WorkerRunLoop::runInMode(WorkerContext* context, const String& mode)
+MessageQueueWaitResult WorkerRunLoop::runInMode(WorkerContext* context, const String& mode, WaitMode waitMode)
 {
     RunLoopSetup setup(*this);
     ModePredicate modePredicate(mode);
-    MessageQueueWaitResult result = runInMode(context, modePredicate);
+    MessageQueueWaitResult result = runInMode(context, modePredicate, waitMode);
     return result;
 }
 
-MessageQueueWaitResult WorkerRunLoop::runInMode(WorkerContext* context, const ModePredicate& predicate)
+MessageQueueWaitResult WorkerRunLoop::runInMode(WorkerContext* context, const ModePredicate& predicate, WaitMode waitMode)
 {
     ASSERT(context);
     ASSERT(context->thread());
     ASSERT(context->thread()->threadID() == currentThread());
 
-    double absoluteTime = (predicate.isDefaultMode() && m_sharedTimer->isActive()) ? m_sharedTimer->fireTime() : MessageQueue<Task>::infiniteTime();
+    double absoluteTime = 0.0;
+    if (waitMode == WaitForMessage)
+        absoluteTime = (predicate.isDefaultMode() && m_sharedTimer->isActive()) ? m_sharedTimer->fireTime() : MessageQueue<Task>::infiniteTime();
     MessageQueueWaitResult result;
     OwnPtr<WorkerRunLoop::Task> task = m_messageQueue.waitForMessageFilteredWithTimeout(result, predicate, absoluteTime);
 
diff --git a/Source/WebCore/workers/WorkerRunLoop.h b/Source/WebCore/workers/WorkerRunLoop.h
index 842c62127..3916d6ac5 100644
--- a/Source/WebCore/workers/WorkerRunLoop.h
+++ b/Source/WebCore/workers/WorkerRunLoop.h
@@ -52,8 +52,10 @@ namespace WebCore {
         // Blocking call. Waits for tasks and timers, invokes the callbacks.
         void run(WorkerContext*);
 
+        enum WaitMode { WaitForMessage, DontWaitForMessage };
+
         // Waits for a single task and returns.
-        MessageQueueWaitResult runInMode(WorkerContext*, const String& mode);
+        MessageQueueWaitResult runInMode(WorkerContext*, const String& mode, WaitMode = WaitForMessage);
 
         void terminate();
         bool terminated() const { return m_messageQueue.killed(); }
@@ -82,7 +84,7 @@ namespace WebCore {
 
     private:
         friend class RunLoopSetup;
-        MessageQueueWaitResult runInMode(WorkerContext*, const ModePredicate&);
+        MessageQueueWaitResult runInMode(WorkerContext*, const ModePredicate&, WaitMode);
 
         // Runs any clean up tasks that are currently in the queue and returns.
         // This should only be called when the context is closed or loop has been terminated.
diff --git a/Source/WebCore/workers/WorkerThread.cpp b/Source/WebCore/workers/WorkerThread.cpp
index 93ba0bfb0..34cf909ff 100644
--- a/Source/WebCore/workers/WorkerThread.cpp
+++ b/Source/WebCore/workers/WorkerThread.cpp
@@ -123,12 +123,12 @@ bool WorkerThread::start()
     return m_threadID;
 }
 
-void* WorkerThread::workerThreadStart(void* thread)
+void WorkerThread::workerThreadStart(void* thread)
 {
-    return static_cast<WorkerThread*>(thread)->workerThread();
+    static_cast<WorkerThread*>(thread)->workerThread();
 }
 
-void* WorkerThread::workerThread()
+void WorkerThread::workerThread()
 {
     {
         MutexLocker lock(m_threadCreationMutex);
@@ -173,8 +173,6 @@ void* WorkerThread::workerThread()
 
     // The thread object may be already destroyed from notification now, don't try to access "this".
     detachThread(threadID);
-
-    return 0;
 }
 
 void WorkerThread::runEventLoop()
diff --git a/Source/WebCore/workers/WorkerThread.h b/Source/WebCore/workers/WorkerThread.h
index 6646b1148..e3a11df00 100644
--- a/Source/WebCore/workers/WorkerThread.h
+++ b/Source/WebCore/workers/WorkerThread.h
@@ -80,8 +80,8 @@ namespace WebCore {
 
     private:
         // Static function executed as the core routine on the new thread. Passed a pointer to a WorkerThread object.
-        static void* workerThreadStart(void*);
-        void* workerThread();
+        static void workerThreadStart(void*);
+        void workerThread();
 
         ThreadIdentifier m_threadID;
         WorkerRunLoop m_runLoop;
diff --git a/Source/WebCore/xml/DOMParser.idl b/Source/WebCore/xml/DOMParser.idl
index 716400814..5e51bc1e7 100644
--- a/Source/WebCore/xml/DOMParser.idl
+++ b/Source/WebCore/xml/DOMParser.idl
@@ -21,7 +21,7 @@ module xpath {
     interface [
         Constructor
     ] DOMParser {
-        Document parseFromString(in [Optional=CallWithDefaultValue] DOMString str, 
-                                 in [Optional=CallWithDefaultValue] DOMString contentType);
+        Document parseFromString(in [Optional=DefaultIsUndefined] DOMString str, 
+                                 in [Optional=DefaultIsUndefined] DOMString contentType);
     };
 }
diff --git a/Source/WebCore/xml/DOMWindowXML.idl b/Source/WebCore/xml/DOMWindowXML.idl
new file mode 100644
index 000000000..e527350ca
--- /dev/null
+++ b/Source/WebCore/xml/DOMWindowXML.idl
@@ -0,0 +1,37 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ */
+
+module window {
+
+    interface [
+        Supplemental=DOMWindow
+    ] DOMWindowXML {
+        // Mozilla has a separate XMLDocument object for XML documents. 
+        // We just use Document for this.
+        attribute DocumentConstructor XMLDocument;
+        attribute DOMParserConstructor DOMParser;
+        attribute XMLSerializerConstructor XMLSerializer;
+        attribute XMLHttpRequestConstructor XMLHttpRequest; // Usable with the new operator
+        attribute XMLHttpRequestUploadConstructor XMLHttpRequestUpload;
+        attribute XMLHttpRequestExceptionConstructor XMLHttpRequestException;
+        attribute XMLHttpRequestProgressEventConstructor XMLHttpRequestProgressEvent;
+        attribute [Conditional=XSLT] XSLTProcessorConstructor XSLTProcessor; // Usable with the new operator
+    };
+
+}
diff --git a/Source/WebCore/xml/XMLHttpRequest.cpp b/Source/WebCore/xml/XMLHttpRequest.cpp
index 41f0621ec..7ed8212ee 100644
--- a/Source/WebCore/xml/XMLHttpRequest.cpp
+++ b/Source/WebCore/xml/XMLHttpRequest.cpp
@@ -154,7 +154,10 @@ static void logConsoleError(ScriptExecutionContext* context, const String& messa
 
 PassRefPtr<XMLHttpRequest> XMLHttpRequest::create(ScriptExecutionContext* context, PassRefPtr<SecurityOrigin> securityOrigin)
 {
-    return adoptRef(new XMLHttpRequest(context, securityOrigin));
+    RefPtr<XMLHttpRequest> xmlHttpRequest(adoptRef(new XMLHttpRequest(context, securityOrigin)));
+    xmlHttpRequest->suspendIfNeeded();
+
+    return xmlHttpRequest.release();
 }
 
 XMLHttpRequest::XMLHttpRequest(ScriptExecutionContext* context, PassRefPtr<SecurityOrigin> securityOrigin)
diff --git a/Source/WebCore/xml/XMLHttpRequest.idl b/Source/WebCore/xml/XMLHttpRequest.idl
index b45baf2b1..0dcedfed1 100644
--- a/Source/WebCore/xml/XMLHttpRequest.idl
+++ b/Source/WebCore/xml/XMLHttpRequest.idl
@@ -89,11 +89,11 @@ module xml {
         readonly attribute XMLHttpRequestUpload upload;
 
         // response
-        [ConvertNullStringTo=Undefined] DOMString getAllResponseHeaders()
+        [TreatReturnedNullStringAs=Undefined] DOMString getAllResponseHeaders()
             raises(DOMException);
-        [ConvertNullStringTo=Null] DOMString getResponseHeader(in DOMString header)
+        [TreatReturnedNullStringAs=Null] DOMString getResponseHeader(in DOMString header)
             raises(DOMException);
-        readonly attribute [CustomGetter] DOMString responseText // The custom getter implements ConvertNullStringTo=Null
+        readonly attribute [CustomGetter] DOMString responseText // The custom getter implements TreatReturnedNullStringAs=Null
             getter raises(DOMException);
         readonly attribute Document responseXML
             getter raises(DOMException);
diff --git a/Source/WebCore/xml/XMLSerializer.idl b/Source/WebCore/xml/XMLSerializer.idl
index 5dabfdf15..58327cc2a 100644
--- a/Source/WebCore/xml/XMLSerializer.idl
+++ b/Source/WebCore/xml/XMLSerializer.idl
@@ -23,7 +23,7 @@ module xpath {
     interface [
         Constructor
     ] XMLSerializer {
-        DOMString serializeToString(in [Optional=CallWithDefaultValue] Node node)
+        DOMString serializeToString(in [Optional=DefaultIsUndefined] Node node)
             raises(DOMException);
     };
 
diff --git a/Source/WebCore/xml/XPathEvaluator.idl b/Source/WebCore/xml/XPathEvaluator.idl
index 4d47ecfee..cb9950c2a 100644
--- a/Source/WebCore/xml/XPathEvaluator.idl
+++ b/Source/WebCore/xml/XPathEvaluator.idl
@@ -21,17 +21,17 @@ module xpath {
     interface [
         Constructor
     ] XPathEvaluator {
-        XPathExpression createExpression(in [Optional=CallWithDefaultValue] DOMString expression,
-                                         in [Optional=CallWithDefaultValue] XPathNSResolver resolver)
+        XPathExpression createExpression(in [Optional=DefaultIsUndefined] DOMString expression,
+                                         in [Optional=DefaultIsUndefined] XPathNSResolver resolver)
             raises(DOMException);
 
-        XPathNSResolver createNSResolver(in [Optional=CallWithDefaultValue] Node nodeResolver);
+        XPathNSResolver createNSResolver(in [Optional=DefaultIsUndefined] Node nodeResolver);
 
-        XPathResult evaluate(in [Optional=CallWithDefaultValue] DOMString expression,
-                             in [Optional=CallWithDefaultValue] Node contextNode, 
-                             in [Optional=CallWithDefaultValue] XPathNSResolver resolver,
-                             in [Optional=CallWithDefaultValue] unsigned short type,
-                             in [Optional=CallWithDefaultValue] XPathResult inResult)
+        XPathResult evaluate(in [Optional=DefaultIsUndefined] DOMString expression,
+                             in [Optional=DefaultIsUndefined] Node contextNode, 
+                             in [Optional=DefaultIsUndefined] XPathNSResolver resolver,
+                             in [Optional=DefaultIsUndefined] unsigned short type,
+                             in [Optional=DefaultIsUndefined] XPathResult inResult)
             raises(DOMException);
     };
 }
diff --git a/Source/WebCore/xml/XPathExpression.idl b/Source/WebCore/xml/XPathExpression.idl
index add53cff4..5e60840d2 100644
--- a/Source/WebCore/xml/XPathExpression.idl
+++ b/Source/WebCore/xml/XPathExpression.idl
@@ -21,9 +21,9 @@
 module xpath {
 
     interface XPathExpression {
-        [ObjCLegacyUnnamedParameters] XPathResult evaluate(in [Optional=CallWithDefaultValue] Node contextNode, 
-                                            in [Optional=CallWithDefaultValue] unsigned short type, 
-                                            in [Optional=CallWithDefaultValue] XPathResult inResult)
+        [ObjCLegacyUnnamedParameters] XPathResult evaluate(in [Optional=DefaultIsUndefined] Node contextNode, 
+                                            in [Optional=DefaultIsUndefined] unsigned short type, 
+                                            in [Optional=DefaultIsUndefined] XPathResult inResult)
             raises(DOMException);
     };
 
diff --git a/Source/WebCore/xml/XPathNSResolver.idl b/Source/WebCore/xml/XPathNSResolver.idl
index e1d4e0e26..e9fa41be4 100644
--- a/Source/WebCore/xml/XPathNSResolver.idl
+++ b/Source/WebCore/xml/XPathNSResolver.idl
@@ -24,7 +24,7 @@ module xpath {
         ObjCProtocol,
         OmitConstructor
     ] XPathNSResolver {
-        [ConvertNullStringTo=Null] DOMString lookupNamespaceURI(in [Optional=CallWithDefaultValue] DOMString prefix);
+        [TreatReturnedNullStringAs=Null] DOMString lookupNamespaceURI(in [Optional=DefaultIsUndefined] DOMString prefix);
     };
 
 }
diff --git a/Source/WebCore/xml/XPathResult.idl b/Source/WebCore/xml/XPathResult.idl
index cb5c92263..77c5b8e7c 100644
--- a/Source/WebCore/xml/XPathResult.idl
+++ b/Source/WebCore/xml/XPathResult.idl
@@ -52,7 +52,7 @@ module xpath {
             
         Node iterateNext()
             raises (DOMException);
-        Node snapshotItem(in [Optional=CallWithDefaultValue] unsigned long index)
+        Node snapshotItem(in [Optional=DefaultIsUndefined] unsigned long index)
             raises (DOMException);
     };
 
diff --git a/Source/WebCore/xml/XPathUtil.cpp b/Source/WebCore/xml/XPathUtil.cpp
index 4c45fcbca..7a8ff33cf 100644
--- a/Source/WebCore/xml/XPathUtil.cpp
+++ b/Source/WebCore/xml/XPathUtil.cpp
@@ -85,7 +85,6 @@ bool isValidContextNode(Node* node)
         case Node::ENTITY_NODE:
         case Node::ENTITY_REFERENCE_NODE:
         case Node::NOTATION_NODE:
-        case Node::SHADOW_ROOT_NODE:
             return false;
         case Node::TEXT_NODE:
             return !(node->parentNode() && node->parentNode()->isAttributeNode());
diff --git a/Source/WebCore/xml/XSLTProcessor.idl b/Source/WebCore/xml/XSLTProcessor.idl
index 4fcae9af5..48ec6c20e 100644
--- a/Source/WebCore/xml/XSLTProcessor.idl
+++ b/Source/WebCore/xml/XSLTProcessor.idl
@@ -42,7 +42,7 @@ module xml {
         [Custom] Document transformToDocument(in Node source);
 
         [Custom] void setParameter(in DOMString namespaceURI, in DOMString localName, in DOMString value);
-        [Custom, ConvertNullStringTo=Undefined] DOMString getParameter(in DOMString namespaceURI, in DOMString localName);
+        [Custom, TreatReturnedNullStringAs=Undefined] DOMString getParameter(in DOMString namespaceURI, in DOMString localName);
         [Custom] void removeParameter(in DOMString namespaceURI, in DOMString localName);
         void clearParameters();
 
diff --git a/Source/WebCore/xml/parser/MarkupTokenBase.h b/Source/WebCore/xml/parser/MarkupTokenBase.h
index 7a30ed604..986538b8d 100644
--- a/Source/WebCore/xml/parser/MarkupTokenBase.h
+++ b/Source/WebCore/xml/parser/MarkupTokenBase.h
@@ -540,7 +540,7 @@ inline void AtomicMarkupTokenBase<Token>::initializeAttributes(const typename To
         ASSERT(attribute.m_valueRange.m_start);
         ASSERT(attribute.m_valueRange.m_end);
 
-        String value(attribute.m_value.data(), attribute.m_value.size());
+        AtomicString value(attribute.m_value.data(), attribute.m_value.size());
         m_attributes->insertAttribute(Attribute::create(nameForAttribute(attribute), value), false);
     }
 }
diff --git a/Source/WebCore/xml/parser/XMLDocumentParserQt.cpp b/Source/WebCore/xml/parser/XMLDocumentParserQt.cpp
index cd6ea1494..75b319ffe 100644
--- a/Source/WebCore/xml/parser/XMLDocumentParserQt.cpp
+++ b/Source/WebCore/xml/parser/XMLDocumentParserQt.cpp
@@ -138,7 +138,7 @@ XMLDocumentParser::XMLDocumentParser(DocumentFragment* fragment, Element* parent
 
     QXmlStreamNamespaceDeclarations namespaces;
     for (Element* element = elemStack.last(); !elemStack.isEmpty(); elemStack.removeLast()) {
-        if (NamedNodeMap* attrs = element->updatedAttributes()) {
+        if (ElementAttributeData* attrs = element->updatedAttributeData()) {
             for (unsigned i = 0; i < attrs->length(); i++) {
                 Attribute* attr = attrs->attributeItem(i);
                 if (attr->localName() == "xmlns")
diff --git a/Source/WebKit/CMakeLists.txt b/Source/WebKit/CMakeLists.txt
index 3f3c80fb1..8bf565edc 100644
--- a/Source/WebKit/CMakeLists.txt
+++ b/Source/WebKit/CMakeLists.txt
@@ -22,6 +22,7 @@ SET(WebKit_INCLUDE_DIRECTORIES
     "${WEBCORE_DIR}/platform"
     "${WEBCORE_DIR}/platform/animation"
     "${WEBCORE_DIR}/platform/graphics"
+    "${WEBCORE_DIR}/platform/graphics/filters"
     "${WEBCORE_DIR}/platform/graphics/transforms"
     "${WEBCORE_DIR}/platform/network"
     "${WEBCORE_DIR}/platform/sql"
@@ -44,6 +45,7 @@ SET(WebKit_INCLUDE_DIRECTORIES
     "${JAVASCRIPTCORE_DIR}/debugger"
     "${JAVASCRIPTCORE_DIR}/interpreter"
     "${JAVASCRIPTCORE_DIR}/jit"
+    "${JAVASCRIPTCORE_DIR}/llint"
     "${JAVASCRIPTCORE_DIR}/parser"
     "${JAVASCRIPTCORE_DIR}/profiler"
     "${JAVASCRIPTCORE_DIR}/runtime"
@@ -65,7 +67,7 @@ SET(WebKit_LIBRARIES
     ${WebCore_LIBRARY_NAME}
 )
 
-INCLUDE_IF_EXISTS(${WEBKIT_DIR}/${WEBKIT_PORT_DIR}/CMakeLists${PORT}.txt)
+WEBKIT_INCLUDE_CONFIG_FILES_IF_EXISTS()
 
 ADD_DEFINITIONS(-DBUILDING_WebKit)
 INCLUDE_DIRECTORIES(${WebKit_INCLUDE_DIRECTORIES})
diff --git a/Source/WebKit/ChangeLog b/Source/WebKit/ChangeLog
index 678b840f5..c95efcf3c 100644
--- a/Source/WebKit/ChangeLog
+++ b/Source/WebKit/ChangeLog
@@ -1,3 +1,465 @@
+2012-02-23  Patrick Gansterer  <paroga@webkit.org>
+
+        [CMake] Add WEBKIT_INCLUDE_CONFIG_FILES_IF_EXISTS macro
+        https://bugs.webkit.org/show_bug.cgi?id=79371
+
+        Reviewed by Daniel Bates.
+
+        * CMakeLists.txt:
+        * PlatformBlackBerry.cmake: Renamed from Source/WebKit/blackberry/CMakeListsBlackBerry.txt.
+        * PlatformEfl.cmake: Renamed from Source/WebKit/efl/CMakeListsEfl.txt.
+        * PlatformWinCE.cmake: Renamed from Source/WebKit/wince/CMakeListsWinCE.txt.
+
+2012-02-20  Filip Pizlo  <fpizlo@apple.com>
+
+        JSC should be a triple-tier VM
+        https://bugs.webkit.org/show_bug.cgi?id=75812
+        <rdar://problem/10079694>
+
+        Reviewed by Gavin Barraclough.
+
+        Changed EFL's build system to include a new directory in JavaScriptCore.
+        
+        * CMakeLists.txt:
+
+2012-02-21  Jon Lee  <jonlee@apple.com>
+
+        Bring notifications support to WK1 mac: showing, canceling, removing notifications
+        https://bugs.webkit.org/show_bug.cgi?id=78783
+        <rdar://problem/10610578>
+
+        Reviewed by Anders Carlsson.
+
+        * WebKit.xcodeproj/project.pbxproj: Added new files.
+
+2012-02-21  Adam Roben  <aroben@apple.com>
+
+        Roll out r108309, r108323, and r108326
+
+        They broke the 32-bit Lion build.
+
+        Original bugs is <http://webkit.org/b/75812> <rdar://problem/10079694>.
+
+        * CMakeLists.txt:
+
+2012-02-16  Leo Yang  <leo.yang@torchmobile.com.cn>
+
+        [BlackBerry] Adapt to the removal of WebStringIml.h
+        https://bugs.webkit.org/show_bug.cgi?id=78784
+
+        Reviewed by Antonio Gomes.
+
+        blackberry/WebCoreSupport/WebStringImpl.h which hasn't been upstreamed
+        has been removed internally. We should adapt to this removal for the
+        upstreamed part of the BlackBerry port. Actually WebStringImpl is not necessary
+        because it just inherits from WTF::StringImpl but adding nothing.
+
+        * blackberry/Api/WebString.cpp:
+        (BlackBerry::WebKit::WebString::WebString):
+        (BlackBerry::WebKit::WebString::equalIgnoringCase):
+        * blackberry/Api/WebString.h:
+        (WTF):
+
+2012-02-16  Nima Ghanavatian  <nghanavatian@rim.com>
+
+        [BlackBerry] Style clean-up in WebPageCompositor
+        https://bugs.webkit.org/show_bug.cgi?id=78738
+
+        Reviewed by Rob Buis.
+
+        No new functionality, no new tests.
+
+        * blackberry/WebKitSupport/WebPageCompositor.cpp:
+        (BlackBerry::WebKit::WebPageCompositor::drawLayers):
+        * blackberry/WebKitSupport/WebPageCompositor.h:
+        (WebKit):
+
+2012-02-16  Patrick Gansterer  <paroga@webkit.org>
+
+        [CMake] Add missing include directories.
+
+        * CMakeLists.txt:
+
+2012-02-15  Leo Yang  <leo.yang@torchmobile.com.cn>
+
+        [BlackBerry] Remove ResourceHolderImpl.cpp from build system
+        https://bugs.webkit.org/show_bug.cgi?id=78779
+
+        Reviewed by George Staikos.
+
+        blackberry/Api/ResourceHolderImpl.cpp which hasn't been upstreamed
+        has been removed internally. So remove it from the build system.
+
+        * blackberry/CMakeListsBlackBerry.txt:
+
+2012-02-15  Leo Yang  <leo.yang@torchmobile.com.cn>
+
+        [BlackBerry] Upstream WebPageGroupLoadDeferrer.{h, cpp}
+        https://bugs.webkit.org/show_bug.cgi?id=78770
+
+        Reviewed by Rob Buis.
+
+        Initial upstreaming, no new tests.
+
+        * blackberry/Api/WebPageGroupLoadDeferrer.cpp: Added.
+        * blackberry/Api/WebPageGroupLoadDeferrer.h: Added.
+
+2012-02-15  Konrad Piascik  <kpiascik@rim.com>
+
+        [BlackBerry] Upstream BlackBerry specific Web Inspector resources
+        https://bugs.webkit.org/show_bug.cgi?id=78727
+
+        Reviewed by Rob Buis.
+
+        * blackberry/WebCoreSupport/inspectorBB.html: Added.
+        * blackberry/WebCoreSupport/inspectorBB.js: Added.
+        ():
+        (InspectorFrontendHost.copyText):
+
+2012-02-15  Mike Fenton  <mifenton@rim.com>
+
+        Initial upstreaming of EditorClientBlackBerry
+        https://bugs.webkit.org/show_bug.cgi?id=78730
+
+        Reviewed by Rob Buis.
+
+        Initial upstreaming, no new tests.
+
+        * blackberry/WebCoreSupport/EditorClientBlackBerry.cpp: Added.
+        (WebCore):
+        (WebCore::EditorClientBlackBerry::EditorClientBlackBerry):
+        (WebCore::EditorClientBlackBerry::pageDestroyed):
+        (WebCore::EditorClientBlackBerry::shouldDeleteRange):
+        (WebCore::EditorClientBlackBerry::shouldShowDeleteInterface):
+        (WebCore::EditorClientBlackBerry::smartInsertDeleteEnabled):
+        (WebCore::EditorClientBlackBerry::isSelectTrailingWhitespaceEnabled):
+        (WebCore::EditorClientBlackBerry::enableSpellChecking):
+        (WebCore::EditorClientBlackBerry::shouldSpellCheckFocusedField):
+        (WebCore::EditorClientBlackBerry::isContinuousSpellCheckingEnabled):
+        (WebCore::EditorClientBlackBerry::toggleContinuousSpellChecking):
+        (WebCore::EditorClientBlackBerry::isGrammarCheckingEnabled):
+        (WebCore::EditorClientBlackBerry::toggleGrammarChecking):
+        (WebCore::EditorClientBlackBerry::spellCheckerDocumentTag):
+        (WebCore::EditorClientBlackBerry::shouldBeginEditing):
+        (WebCore::EditorClientBlackBerry::shouldEndEditing):
+        (WebCore::EditorClientBlackBerry::shouldInsertNode):
+        (WebCore::EditorClientBlackBerry::shouldInsertText):
+        (WebCore::EditorClientBlackBerry::shouldChangeSelectedRange):
+        (WebCore::EditorClientBlackBerry::shouldApplyStyle):
+        (WebCore::EditorClientBlackBerry::shouldMoveRangeAfterDelete):
+        (WebCore::EditorClientBlackBerry::didBeginEditing):
+        (WebCore::EditorClientBlackBerry::respondToChangedContents):
+        (WebCore::EditorClientBlackBerry::respondToChangedSelection):
+        (WebCore::EditorClientBlackBerry::didEndEditing):
+        (WebCore::EditorClientBlackBerry::respondToSelectionAppearanceChange):
+        (WebCore::EditorClientBlackBerry::didWriteSelectionToPasteboard):
+        (WebCore::EditorClientBlackBerry::didSetSelectionTypesForPasteboard):
+        (WebCore::EditorClientBlackBerry::registerCommandForUndo):
+        (WebCore::EditorClientBlackBerry::registerCommandForRedo):
+        (WebCore::EditorClientBlackBerry::clearUndoRedoOperations):
+        (WebCore::EditorClientBlackBerry::canUndo):
+        (WebCore::EditorClientBlackBerry::canRedo):
+        (WebCore::EditorClientBlackBerry::canCopyCut):
+        (WebCore::EditorClientBlackBerry::canPaste):
+        (WebCore::EditorClientBlackBerry::undo):
+        (WebCore::EditorClientBlackBerry::redo):
+        (KeyDownEntry):
+        (KeyPressEntry):
+        (WebCore::EditorClientBlackBerry::interpretKeyEvent):
+        (WebCore::EditorClientBlackBerry::handleKeyboardEvent):
+        (WebCore::EditorClientBlackBerry::handleInputMethodKeydown):
+        (WebCore::EditorClientBlackBerry::textFieldDidBeginEditing):
+        (WebCore::EditorClientBlackBerry::textFieldDidEndEditing):
+        (WebCore::EditorClientBlackBerry::textDidChangeInTextField):
+        (WebCore::EditorClientBlackBerry::doTextFieldCommandFromEvent):
+        (WebCore::EditorClientBlackBerry::textWillBeDeletedInTextField):
+        (WebCore::EditorClientBlackBerry::textDidChangeInTextArea):
+        (WebCore::EditorClientBlackBerry::ignoreWordInSpellDocument):
+        (WebCore::EditorClientBlackBerry::learnWord):
+        (WebCore::EditorClientBlackBerry::checkSpellingOfString):
+        (WebCore::EditorClientBlackBerry::getAutoCorrectSuggestionForMisspelledWord):
+        (WebCore::EditorClientBlackBerry::checkGrammarOfString):
+        (WebCore::EditorClientBlackBerry::requestCheckingOfString):
+        (WebCore::EditorClientBlackBerry::textChecker):
+        (WebCore::EditorClientBlackBerry::updateSpellingUIWithGrammarString):
+        (WebCore::EditorClientBlackBerry::updateSpellingUIWithMisspelledWord):
+        (WebCore::EditorClientBlackBerry::showSpellingUI):
+        (WebCore::EditorClientBlackBerry::spellingUIIsShowing):
+        (WebCore::EditorClientBlackBerry::getGuessesForWord):
+        (WebCore::EditorClientBlackBerry::willSetInputMethodState):
+        (WebCore::EditorClientBlackBerry::setInputMethodState):
+        * blackberry/WebCoreSupport/EditorClientBlackBerry.h: Added.
+        (WebKit):
+        (WebCore):
+        (EditorClientBlackBerry):
+
+2012-02-15  Leo Yang  <leo.yang@torchmobile.com.cn>
+
+        [BlackBerry] Upstream WebPageClient.h
+        https://bugs.webkit.org/show_bug.cgi?id=78660
+
+        Reviewed by Antonio Gomes.
+
+        Initial upstreaming, no new tests.
+
+        * blackberry/Api/BackingStore.cpp: Add #include <BlackBerryPlatformWindow.h> because this inclusion
+        is being removed from WebPageClient.h.
+        * blackberry/Api/WebPageClient.h: Added.
+        * blackberry/WebCoreSupport/ChromeClientBlackBerry.cpp: Add #include <BlackBerryPlatformWindow.h>
+        because this inclusion is being removed from WebPageClient.h.
+
+2012-02-15  Rob Buis  <rbuis@rim.com>
+
+        [BlackBerry] Upstream remaining classes in Api
+        https://bugs.webkit.org/show_bug.cgi?id=78644
+
+        Reviewed by Antonio Gomes.
+
+        No functionalities changed, no new tests.
+
+        * blackberry/Api/ActiveNodeContext.h: Renamed from Source/WebKit/blackberry/Api/BlackBerryContext.h.
+
+2012-02-14  Nima Ghanavatian  <nghanavatian@rim.com>
+
+        [BlackBerry] Upstreaming WebSettings code
+        https://bugs.webkit.org/show_bug.cgi?id=78633
+
+        Reviewed by Rob Buis.
+
+        Initial upstreaming, no new tests.
+
+        * blackberry/Api/WebSettings.cpp: Added.
+        * blackberry/Api/WebSettings.h: Added.
+        * blackberry/Api/WebSettings_p.h: Added.
+
+2012-02-14  Nima Ghanavatian  <nghanavatian@rim.com>
+
+        [BlackBerry] Upstreaming DOMSupport files
+        https://bugs.webkit.org/show_bug.cgi?id=78607
+
+        Reviewed by Rob Buis.
+
+        Initial upstreaming, no new tests.
+
+        * blackberry/WebKitSupport/DOMSupport.cpp: Added.
+        * blackberry/WebKitSupport/DOMSupport.h: Added.
+
+2012-02-14  Jeff Rogers  <jrogers@rim.com>
+
+        [BlackBerry] Remove OpenVG references
+        https://bugs.webkit.org/show_bug.cgi?id=78623
+
+        Reviewed by Rob Buis.
+
+        Removed references to USE(OPENVG) and the related code.
+
+        * blackberry/Api/BackingStore.cpp:
+        (BlackBerry::WebKit::BackingStorePrivate::BackingStorePrivate):
+        (BlackBerry::WebKit::BackingStorePrivate::repaint):
+        (BlackBerry::WebKit::BackingStorePrivate::renderContents):
+        (BlackBerry::WebKit::BackingStore::createSurface):
+        * blackberry/Api/BackingStore_p.h:
+
+2012-02-14  Andy Chen  <andchen@rim.com>
+
+        Initial upstreaming for find-in-page for BlackBerry port
+        https://bugs.webkit.org/show_bug.cgi?id=78615
+
+        Create a new class InPageSearchManager for find-in-page and
+        remove the functions in SelectionHandler
+
+        Reviewed by Rob Buis.
+
+        * blackberry/CMakeListsBlackBerry.txt:
+        * blackberry/WebKitSupport/InPageSearchManager.cpp: Added.
+        (BlackBerry::WebKit::InPageSearchManager::InPageSearchManager):
+        (BlackBerry::WebKit::InPageSearchManager::~InPageSearchManager):
+        (BlackBerry::WebKit::InPageSearchManager::findNextString):
+        (BlackBerry::WebKit::InPageSearchManager::clearTextMatches):
+        (BlackBerry::WebKit::InPageSearchManager::setMarkerActive):
+        * blackberry/WebKitSupport/InPageSearchManager.h: Added.
+        * blackberry/WebKitSupport/SelectionHandler.cpp:
+        * blackberry/WebKitSupport/SelectionHandler.h:
+
+2012-02-14  Jacky Jiang  <zhajiang@rim.com>
+
+        [BlackBerry] Upstream BlackBerry WebCoreSupport FrameLoaderClientBlackBerry class
+        https://bugs.webkit.org/show_bug.cgi?id=78275
+
+        Reviewed by Rob Buis.
+
+        Initial upstream, no new tests.
+
+        * blackberry/WebCoreSupport/FrameLoaderClientBlackBerry.cpp: Added.
+        * blackberry/WebCoreSupport/FrameLoaderClientBlackBerry.h: Added.
+
+2012-02-14  Lianghui Chen  <liachen@rim.com>
+
+        Separate mimetype and file extension mapping API from WebKit/blackberry/Api/WebKitTextCodec and complete it.
+        https://bugs.webkit.org/show_bug.cgi?id=78605
+
+        Reviewed by Rob Buis.
+
+        Now the MIME type and file extension mapping API are in WebKitMIMETypeConverter.
+
+        * blackberry/Api/WebKitMIMETypeConverter.cpp: Added.
+        (WebKit):
+        (BlackBerry::WebKit::getExtensionForMimeType):
+        (BlackBerry::WebKit::getMimeTypeForExtension):
+        * blackberry/Api/WebKitMIMETypeConverter.h: Added.
+        (WebKit):
+        * blackberry/Api/WebKitTextCodec.cpp:
+        * blackberry/Api/WebKitTextCodec.h:
+        * blackberry/CMakeListsBlackBerry.txt:
+
+2012-02-14  Ed Baker  <edbaker@rim.com>
+
+        [BlackBerry] Dragging a selection handle outside of the content bounding box does not update the selection range correctly
+        https://bugs.webkit.org/show_bug.cgi?id=78608
+
+        Ensure that when selection handles leave the content bounding box that
+        the handle not being dragged remains fixed. Do not applying padding to
+        a direction that would cause the selection to shrink when performing
+        the handle direction detection.
+
+        Reviewed by Rob Buis.
+
+        * blackberry/WebKitSupport/SelectionHandler.cpp:
+        (BlackBerry::WebKit::directionOfPointRelativeToRect):
+        (BlackBerry::WebKit::SelectionHandler::extendSelectionToFieldBoundary):
+        (BlackBerry::WebKit::SelectionHandler::clipPointToFocusNode):
+        (BlackBerry::WebKit::SelectionHandler::setSelection):
+        * blackberry/WebKitSupport/SelectionHandler.h:
+
+2012-02-14  Rob Buis  <rbuis@rim.com>
+
+        [BlackBerry] Upstream remaining classes in Api
+        https://bugs.webkit.org/show_bug.cgi?id=78644
+
+        Reviewed by Antonio Gomes.
+
+        Initial upstream, no new tests.
+
+        * blackberry/Api/BlackBerryContext.h: Added.
+        * blackberry/Api/BlackBerryGlobal.cpp: Added.
+        * blackberry/Api/BlackBerryGlobal.h: Added.
+        * blackberry/Api/Version.cpp: Added.
+        * blackberry/Api/Version.h: Added.
+
+2012-02-14  Rob Buis  <rbuis@rim.com>
+
+        [BlackBerry] Upstream backing store related classes
+        https://bugs.webkit.org/show_bug.cgi?id=78517
+
+        Reviewed by Antonio Gomes.
+
+        Initial upstream, no new tests.
+
+        * blackberry/WebKitSupport/BackingStoreClient.cpp: Added.
+        * blackberry/WebKitSupport/BackingStoreClient.h: Added.
+        * blackberry/WebKitSupport/BackingStoreCompositingSurface.cpp: Added.
+        * blackberry/WebKitSupport/BackingStoreCompositingSurface.h: Added.
+        * blackberry/WebKitSupport/BackingStoreTile.cpp: Added.
+        * blackberry/WebKitSupport/BackingStoreTile.h: Added.
+
+2012-02-13  Nima Ghanavatian  <nghanavatian@rim.com>
+
+        Initial upstreaming of selection handling code for BlackBerry port
+        https://bugs.webkit.org/show_bug.cgi?id=78136
+
+        Reviewed by Rob Buis.
+
+        Initial upstreaming, no new tests.
+
+        * blackberry/WebKitSupport/SelectionHandler.cpp: Added.
+        * blackberry/WebKitSupport/SelectionHandler.h: Added.
+
+2012-02-10  Mike Fenton  <mifenton@rim.com>
+
+        BlackBerry Port - Input focus is suppressed during XHR loads
+        https://bugs.webkit.org/show_bug.cgi?id=78368
+
+        Allow JS to trigger the VKB and input focus when XHR scripting
+        is active.
+
+        This switching the loaded state to checking the webpages loaded state
+        which is only updated after initial load.   When additional loading
+        events happen for XHR, it remains false and focus events function.
+
+        Also add detailed FocusLog's to shouldAcceptInputFocus.
+
+        Reviewed by Rob Buis.
+
+        * blackberry/WebKitSupport/InputHandler.cpp:
+        (BlackBerry::WebKit::InputHandler::shouldAcceptInputFocus):
+
+2012-02-10  Mike Fenton  <mifenton@rim.com>
+
+        BlackBerry Port - JS focus on blur can cause recursion
+        https://bugs.webkit.org/show_bug.cgi?id=78368
+
+        Prevent JS recursion of blur/focus by allowing focus
+        if we are already trying to prevent focus.
+
+        Reviewed by Rob Buis.
+
+        * blackberry/WebKitSupport/InputHandler.cpp:
+        (BlackBerry::WebKit::InputHandler::InputHandler):
+        (BlackBerry::WebKit::InputHandler::shouldAcceptInputFocus):
+        (BlackBerry::WebKit::InputHandler::setElementFocused):
+        * blackberry/WebKitSupport/InputHandler.h:
+        (InputHandler):
+
+2012-02-10  Rob Buis  <rbuis@rim.com>
+
+        [BlackBerry] Upstream graphics helper classes in WebKitSupport
+        https://bugs.webkit.org/show_bug.cgi?id=78278
+
+        Reviewed by Antonio Gomes.
+
+        Initial upstream, no new tests.
+
+        * blackberry/WebKitSupport/RenderQueue.cpp: Added.
+        * blackberry/WebKitSupport/RenderQueue.h: Added.
+
+2012-02-10  Rob Buis  <rbuis@rim.com>
+
+        [BlackBerry] Upstream graphics helper classes in WebKitSupport
+        https://bugs.webkit.org/show_bug.cgi?id=78278
+
+        Reviewed by Antonio Gomes.
+
+        Initial upstream, no new tests.
+
+        * blackberry/WebKitSupport/SurfacePool.cpp: Added.
+        * blackberry/WebKitSupport/SurfacePool.h: Added.
+        * blackberry/WebKitSupport/TileIndex.h: Added.
+        * blackberry/WebKitSupport/TileIndexHash.h: Added.
+
+2012-02-09  Leo Yang  <leo.yang@torchmobile.com.cn>
+
+        [BlackBerry] Upstream JavaScriptDebuggerBlackBerry.{h, cpp}
+        https://bugs.webkit.org/show_bug.cgi?id=78203
+
+        Reviewed by Rob Buis.
+
+        Initial upstream, no new tests.
+
+        * blackberry/WebCoreSupport/JavaScriptDebuggerBlackBerry.cpp: Added.
+        * blackberry/WebCoreSupport/JavaScriptDebuggerBlackBerry.h: Added.
+
+2012-02-09  Rob Buis  <rbuis@rim.com>
+
+        [BlackBerry] Upstream BlackBerry WebKitSupport WebPageCompositor class
+        https://bugs.webkit.org/show_bug.cgi?id=78276
+
+        Reviewed by Antonio Gomes.
+
+        Initial upstream, no new tests.
+
+        * blackberry/WebKitSupport/WebPageCompositor.cpp: Added.
+        * blackberry/WebKitSupport/WebPageCompositor.h: Added.
+
 2012-02-08  Jacky Jiang  <zhajiang@rim.com>
 
         [BlackBerry] Upstream BlackBerry WebCoreSupport FrameNetworkingContextBlackBerry and IconDatabaseClientBlackBerry classes
diff --git a/Source/WebKit/blackberry/CMakeListsBlackBerry.txt b/Source/WebKit/PlatformBlackBerry.cmake
index d0e27cfd6..5d5c8b352 100644
--- a/Source/WebKit/blackberry/CMakeListsBlackBerry.txt
+++ b/Source/WebKit/PlatformBlackBerry.cmake
@@ -41,7 +41,7 @@ LIST(APPEND WebKit_SOURCES
     blackberry/Api/BackingStore.cpp
     blackberry/Api/BlackBerryGlobal.cpp
     blackberry/Api/WebString.cpp
-    blackberry/Api/ResourceHolderImpl.cpp
+    blackberry/Api/WebKitMIMETypeConverter.cpp
     blackberry/Api/WebKitTextCodec.cpp
     blackberry/Api/WebPage.cpp
     blackberry/Api/WebPageGroupLoadDeferrer.cpp
@@ -67,6 +67,7 @@ LIST(APPEND WebKit_SOURCES
     blackberry/WebKitSupport/BackingStoreClient.cpp
     blackberry/WebKitSupport/DOMSupport.cpp
     blackberry/WebKitSupport/FrameLayers.cpp
+    blackberry/WebKitSupport/InPageSearchManager.cpp
     blackberry/WebKitSupport/InputHandler.cpp
     blackberry/WebKitSupport/OutOfMemoryHandler.cpp
     blackberry/WebKitSupport/RenderQueue.cpp
diff --git a/Source/WebKit/efl/CMakeListsEfl.txt b/Source/WebKit/PlatformEfl.cmake
index ec0c7d894..daf22876e 100644
--- a/Source/WebKit/efl/CMakeListsEfl.txt
+++ b/Source/WebKit/PlatformEfl.cmake
@@ -1,5 +1,3 @@
-INCLUDE(WebKitEfl)
-
 LIST(APPEND WebKit_LINK_FLAGS
     ${ECORE_X_LDFLAGS}
     ${EDJE_LDFLAGS}
@@ -10,6 +8,7 @@ LIST(APPEND WebKit_LINK_FLAGS
 LIST(APPEND WebKit_INCLUDE_DIRECTORIES
     "${WEBKIT_DIR}/efl/ewk"
     "${WEBKIT_DIR}/efl/WebCoreSupport"
+    "${JAVASCRIPTCORE_DIR}/wtf/gobject"
     "${WEBCORE_DIR}/platform/efl"
     "${WEBCORE_DIR}/platform/graphics/cairo"
     ${Cairo_INCLUDE_DIRS}
@@ -20,6 +19,8 @@ LIST(APPEND WebKit_INCLUDE_DIRECTORIES
     ${LIBXML2_INCLUDE_DIR}
     ${LIBXSLT_INCLUDE_DIR}
     ${SQLITE_INCLUDE_DIR}
+    ${Glib_INCLUDE_DIRS}
+    ${LIBSOUP24_INCLUDE_DIRS}
 )
 
 IF (ENABLE_SVG)
@@ -71,15 +72,20 @@ LIST(APPEND WebKit_SOURCES
     efl/WebCoreSupport/DumpRenderTreeSupportEfl.cpp
     efl/WebCoreSupport/EditorClientEfl.cpp
     efl/WebCoreSupport/FrameLoaderClientEfl.cpp
+    efl/WebCoreSupport/FrameNetworkingContextEfl.cpp
     efl/WebCoreSupport/FullscreenVideoControllerEfl.cpp
     efl/WebCoreSupport/IconDatabaseClientEfl.cpp
+    efl/WebCoreSupport/StorageTrackerClientEfl.cpp
     efl/WebCoreSupport/InspectorClientEfl.cpp
     efl/WebCoreSupport/NotificationPresenterClientEfl.cpp
 
+    efl/ewk/ewk_auth.cpp
+    efl/ewk/ewk_auth_soup.cpp
     efl/ewk/ewk_contextmenu.cpp
     efl/ewk/ewk_cookies.cpp
     efl/ewk/ewk_frame.cpp
     efl/ewk/ewk_history.cpp
+    efl/ewk/ewk_js.cpp
     efl/ewk/ewk_main.cpp
     efl/ewk/ewk_network.cpp
     efl/ewk/ewk_security_policy.cpp
@@ -92,7 +98,6 @@ LIST(APPEND WebKit_SOURCES
     efl/ewk/ewk_view_single.cpp
     efl/ewk/ewk_view_tiled.cpp
     efl/ewk/ewk_window_features.cpp
-    efl/ewk/ewk_js.cpp
 )
 
 LIST(APPEND WebKit_LIBRARIES
@@ -106,33 +111,19 @@ LIST(APPEND WebKit_LIBRARIES
     ${PNG_LIBRARY}
     ${JPEG_LIBRARY}
     ${CMAKE_DL_LIBS}
-)
-
-IF (ENABLE_GLIB_SUPPORT)
-  LIST(APPEND WebKit_INCLUDE_DIRECTORIES
-    ${Gdk_INCLUDE_DIRS}
-    ${Glib_INCLUDE_DIRS}
-    ${JAVASCRIPTCORE_DIR}/wtf/gobject
-  )
-  LIST(APPEND WebKit_LIBRARIES
     ${Glib_LIBRARIES}
-    ${Gdk_LIBRARIES}
-  )
-ENDIF ()
+    ${LIBSOUP24_LIBRARIES}
+)
 
-IF (WTF_USE_SOUP)
-  LIST(APPEND WebKit_INCLUDE_DIRECTORIES ${LIBSOUP24_INCLUDE_DIRS})
-  LIST(APPEND WebKit_LIBRARIES ${LIBSOUP24_LIBRARIES})
-  LIST(APPEND WebKit_SOURCES
-    efl/ewk/ewk_auth.cpp
-    efl/ewk/ewk_auth_soup.cpp
-  )
+IF (ENABLE_VIBRATION)
+    LIST(APPEND WebKit_INCLUDE_DIRECTORIES
+        ${WEBCORE_DIR}/Modules/vibration
+    )
+    LIST(APPEND WebKit_SOURCES
+        efl/WebCoreSupport/VibrationClientEfl.cpp
+    )
 ENDIF ()
 
-IF (WTF_USE_CURL)
-  LIST(APPEND WebKit_INCLUDE_DIRECTORIES ${CURL_INCLUDE_DIRS} ${ZLIB_INCLUDE_DIRS})
-  LIST(APPEND WebKit_LIBRARIES ${CURL_LIBRARIES} ${ZLIB_LIBRARIES})
-ENDIF ()
 
 SET(WebKit_THEME_DEFINITION "")
 IF (ENABLE_PROGRESS_TAG)
@@ -235,6 +226,7 @@ UNSET(LIBS_PRIVATE)
 SET(EWebKit_HEADERS
     ${CMAKE_CURRENT_SOURCE_DIR}/efl/ewk/EWebKit.h
     ${CMAKE_CURRENT_SOURCE_DIR}/efl/ewk/ewk_auth.h
+    ${CMAKE_CURRENT_SOURCE_DIR}/efl/ewk/ewk_auth_soup.h
     ${CMAKE_CURRENT_SOURCE_DIR}/efl/ewk/ewk_contextmenu.h
     ${CMAKE_CURRENT_SOURCE_DIR}/efl/ewk/ewk_cookies.h
     ${CMAKE_CURRENT_SOURCE_DIR}/efl/ewk/ewk_frame.h
@@ -249,10 +241,6 @@ SET(EWebKit_HEADERS
     ${CMAKE_CURRENT_SOURCE_DIR}/efl/ewk/ewk_window_features.h
 )
 
-IF (WTF_USE_SOUP)
-    LIST(APPEND EWebKit_HEADERS ${CMAKE_CURRENT_SOURCE_DIR}/efl/ewk/ewk_auth_soup.h)
-ENDIF ()
-
 INSTALL(FILES ${EWebKit_HEADERS}
         DESTINATION include/${WebKit_LIBRARY_NAME}-${PROJECT_VERSION_MAJOR})
 
diff --git a/Source/WebKit/wince/CMakeListsWinCE.txt b/Source/WebKit/PlatformWinCE.cmake
index de6de607e..de6de607e 100644
--- a/Source/WebKit/wince/CMakeListsWinCE.txt
+++ b/Source/WebKit/PlatformWinCE.cmake
diff --git a/Source/WebKit/WebKit.xcodeproj/project.pbxproj b/Source/WebKit/WebKit.xcodeproj/project.pbxproj
index 16cdf4c00..c8de755b6 100644
--- a/Source/WebKit/WebKit.xcodeproj/project.pbxproj
+++ b/Source/WebKit/WebKit.xcodeproj/project.pbxproj
@@ -74,6 +74,9 @@
 		226E9E6B09D0AA8200F3A2BC /* WebNetscapeDeprecatedFunctions.c in Sources */ = {isa = PBXBuildFile; fileRef = 226E9E6909D0AA8200F3A2BC /* WebNetscapeDeprecatedFunctions.c */; settings = {COMPILER_FLAGS = "-Wno-deprecated-declarations"; }; };
 		22F219CC08D236730030E078 /* WebBackForwardListPrivate.h in Headers */ = {isa = PBXBuildFile; fileRef = 22F219CB08D236730030E078 /* WebBackForwardListPrivate.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		29AEF960134C76FB00FE5096 /* OutlookQuirksUserScript.js in Resources */ = {isa = PBXBuildFile; fileRef = 29AEF95D134C755400FE5096 /* OutlookQuirksUserScript.js */; };
+		312E2FE514E48182007CCA18 /* WebNotification.h in Headers */ = {isa = PBXBuildFile; fileRef = 312E2FE314E48182007CCA18 /* WebNotification.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		312E2FE614E48182007CCA18 /* WebNotification.mm in Sources */ = {isa = PBXBuildFile; fileRef = 312E2FE414E48182007CCA18 /* WebNotification.mm */; };
+		312E2FE914E48215007CCA18 /* WebNotificationInternal.h in Headers */ = {isa = PBXBuildFile; fileRef = 312E2FE814E48215007CCA18 /* WebNotificationInternal.h */; };
 		31C11A6E1476552E0049A4CC /* WebNotificationClient.h in Headers */ = {isa = PBXBuildFile; fileRef = 31C11A6C1476552E0049A4CC /* WebNotificationClient.h */; };
 		31C11A6F1476552E0049A4CC /* WebNotificationClient.mm in Sources */ = {isa = PBXBuildFile; fileRef = 31C11A6D1476552E0049A4CC /* WebNotificationClient.mm */; };
 		37B6FB4E1063530C000FDB3B /* WebPDFDocumentExtras.h in Headers */ = {isa = PBXBuildFile; fileRef = 37B6FB4C1063530C000FDB3B /* WebPDFDocumentExtras.h */; };
@@ -456,6 +459,9 @@
 		2D36FD5E03F78F9E00A80166 /* WebFormDelegatePrivate.h */ = {isa = PBXFileReference; fileEncoding = 4; indentWidth = 4; lastKnownFileType = sourcecode.c.h; path = WebFormDelegatePrivate.h; sourceTree = "<group>"; tabWidth = 8; usesTabs = 0; };
 		2D81DAB203EB0B2D00A80166 /* WebFormDelegate.h */ = {isa = PBXFileReference; fileEncoding = 30; indentWidth = 4; lastKnownFileType = sourcecode.c.h; path = WebFormDelegate.h; sourceTree = "<group>"; tabWidth = 8; usesTabs = 0; };
 		2D81DAB303EB0B2D00A80166 /* WebFormDelegate.m */ = {isa = PBXFileReference; fileEncoding = 30; indentWidth = 4; lastKnownFileType = sourcecode.c.objc; path = WebFormDelegate.m; sourceTree = "<group>"; tabWidth = 8; usesTabs = 0; };
+		312E2FE314E48182007CCA18 /* WebNotification.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WebNotification.h; sourceTree = "<group>"; };
+		312E2FE414E48182007CCA18 /* WebNotification.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = WebNotification.mm; sourceTree = "<group>"; };
+		312E2FE814E48215007CCA18 /* WebNotificationInternal.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WebNotificationInternal.h; sourceTree = "<group>"; };
 		31C11A6C1476552E0049A4CC /* WebNotificationClient.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WebNotificationClient.h; sourceTree = "<group>"; };
 		31C11A6D1476552E0049A4CC /* WebNotificationClient.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = WebNotificationClient.mm; sourceTree = "<group>"; };
 		35081D9202B6D4D80ACA2ACA /* WebHTMLRepresentation.h */ = {isa = PBXFileReference; explicitFileType = sourcecode.c.h; fileEncoding = 4; indentWidth = 4; path = WebHTMLRepresentation.h; sourceTree = "<group>"; tabWidth = 8; usesTabs = 0; };
@@ -1239,6 +1245,9 @@
 				F834AAD60E64B1C700E2737C /* WebTextIterator.mm */,
 				515E27CC0458C86500CA2D3A /* WebUIDelegate.h */,
 				65A7D44A0568AB2600E70EF6 /* WebUIDelegatePrivate.h */,
+				312E2FE314E48182007CCA18 /* WebNotification.h */,
+				312E2FE414E48182007CCA18 /* WebNotification.mm */,
+				312E2FE814E48215007CCA18 /* WebNotificationInternal.h */,
 				51A8B579042834F700CA2D3A /* WebView.h */,
 				51A8B57A042834F700CA2D3A /* WebView.mm */,
 				BC2E464B0FD8A96800A9D9DE /* WebViewData.h */,
@@ -1632,6 +1641,8 @@
 				9398109B0824BF01008DF038 /* WebViewInternal.h in Headers */,
 				939810710824BF01008DF038 /* WebViewPrivate.h in Headers */,
 				41F4484F10338E8C0030E55E /* WebWorkersPrivate.h in Headers */,
+				312E2FE514E48182007CCA18 /* WebNotification.h in Headers */,
+				312E2FE914E48215007CCA18 /* WebNotificationInternal.h in Headers */,
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 		};
@@ -2018,6 +2029,7 @@
 				939811070824BF01008DF038 /* WebView.mm in Sources */,
 				BC2E464E0FD8A96800A9D9DE /* WebViewData.mm in Sources */,
 				41F4485010338E8C0030E55E /* WebWorkersPrivate.mm in Sources */,
+				312E2FE614E48182007CCA18 /* WebNotification.mm in Sources */,
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 		};
diff --git a/Source/WebKit/blackberry/Api/ActiveNodeContext.h b/Source/WebKit/blackberry/Api/ActiveNodeContext.h
new file mode 100644
index 000000000..1258d259f
--- /dev/null
+++ b/Source/WebKit/blackberry/Api/ActiveNodeContext.h
@@ -0,0 +1,76 @@
+/*
+ * Copyright (C) 2010, 2011, 2012 Research In Motion Limited. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+#ifndef ActiveNodeContext_h
+#define ActiveNodeContext_h
+
+#include "WebString.h"
+
+namespace BlackBerry {
+namespace WebKit {
+
+class ActiveNodeContext {
+public:
+    // We assume a default context should be selectable, but nothing else.
+    ActiveNodeContext()
+        : m_flags(IsSelectable)
+        {
+        }
+
+    enum ContextFlags { IsFocusable = 0x01,
+                        IsInput = 0x02,
+                        IsPassword = 0x04,
+                        IsSelectable = 0x08,
+                        IsSingleLine = 0x10, };
+
+    bool isFocusable() const { return m_flags & IsFocusable; }
+    bool isInput() const { return m_flags & IsInput; }
+    bool isPassword() const { return m_flags & IsPassword; }
+    bool isSelectable() const { return m_flags & IsSelectable; }
+    bool isSingleLine() const { return m_flags & IsSingleLine; }
+
+    void setFlag(ContextFlags flag) { m_flags |= flag; }
+    void resetFlag(ContextFlags flag) { m_flags &= ~flag; }
+
+    const WebString& imageAlt() const { return m_imageAlt; }
+    void setImageAlt(const WebString& string) { m_imageAlt = string; }
+
+    const WebString& imageSrc() const { return m_imageSrc; }
+    void setImageSrc(const WebString& string) { m_imageSrc = string; }
+
+    const WebString& pattern() const { return m_pattern; }
+    void setPattern(const WebString& string) { m_pattern = string; }
+
+    const WebString& text() const { return m_text; }
+    void setText(const WebString& string) { m_text = string; }
+
+    const WebString& url() const { return m_url; }
+    void setUrl(const WebString& string) { m_url = string; }
+
+private:
+    unsigned m_flags;
+    WebString m_imageAlt;
+    WebString m_imageSrc;
+    WebString m_pattern;
+    WebString m_text;
+    WebString m_url;
+};
+
+}
+}
+#endif // ActiveNodeContext_h
diff --git a/Source/WebKit/blackberry/Api/BackingStore.cpp b/Source/WebKit/blackberry/Api/BackingStore.cpp
index 036c9bbc0..2971d2698 100644
--- a/Source/WebKit/blackberry/Api/BackingStore.cpp
+++ b/Source/WebKit/blackberry/Api/BackingStore.cpp
@@ -39,6 +39,7 @@
 #include <BlackBerryPlatformIntRectRegion.h>
 #include <BlackBerryPlatformMessage.h>
 #include <BlackBerryPlatformMessageClient.h>
+#include <BlackBerryPlatformWindow.h>
 
 #include <wtf/CurrentTime.h>
 #include <wtf/MathExtras.h>
@@ -54,11 +55,6 @@
 #define DEBUG_TILEMATRIX 0
 #define DEBUG_COMPOSITING_DIRTY_REGION 0
 
-#if USE(OPENVG)
-#include "EGLDisplayOpenVG.h"
-#include "EGLUtils.h"
-#endif
-
 #include <BlackBerryPlatformScreen.h>
 
 using namespace WebCore;
@@ -202,9 +198,6 @@ BackingStorePrivate::BackingStorePrivate()
     , m_renderQueue(adoptPtr(new RenderQueue(this)))
     , m_defersBlit(true)
     , m_hasBlitJobs(false)
-#if USE(OPENVG)
-    , m_eglDisplay(EGL_NO_DISPLAY)
-#endif
     , m_currentWindowBackBuffer(0)
     , m_preferredTileMatrixDimension(Vertical)
     , m_blitGeneration(-1)
@@ -298,10 +291,6 @@ void BackingStorePrivate::resumeScreenAndBackingStoreUpdates(BackingStore::Resum
 void BackingStorePrivate::repaint(const Platform::IntRect& windowRect,
                                   bool contentChanged, bool immediate)
 {
-#if USE(OPENVG)
-    ASSERT(m_eglDisplay != EGL_NO_DISPLAY);
-#endif
-
     if (m_suspendBackingStoreUpdates)
         return;
 
@@ -2215,9 +2204,6 @@ void BackingStorePrivate::renderContents(BlackBerry::Platform::Graphics::Buffer*
     }
 
     // Grab the requested region from the drawing surface into the tile image.
-#if USE(OPENVG)
-    surface->makeCurrent();
-#endif
 
     delete bufferPlatformGraphicsContext;
 
@@ -2525,23 +2511,9 @@ void BackingStore::createSurface()
         initialized = true;
     }
 
-#if USE(OPENVG)
-    d->m_eglDisplay = BlackBerry::Platform::Graphics::eglDisplay();
-
-    // Make sure we are using OpenVG.
-    eglBindAPI(EGL_OPENVG_API);
-    ASSERT_EGL_NO_ERROR();
-
-    EGLDisplayOpenVG::setCurrentDisplay(d->m_eglDisplay);
-#endif
-
     // Triggers creation of surfaces in backingstore.
     d->createSurfaces();
 
-#if USE(OPENVG)
-    EGLDisplayOpenVG::current()->sharedPlatformSurface()->makeCurrent();
-#endif
-
     // Focusing the WebPage triggers a repaint, so while we want it to be
     // focused initially this has to happen after creation of the surface.
     d->m_webPage->setFocused(true);
diff --git a/Source/WebKit/blackberry/Api/BackingStore_p.h b/Source/WebKit/blackberry/Api/BackingStore_p.h
index 30abb592d..49c70a6a5 100644
--- a/Source/WebKit/blackberry/Api/BackingStore_p.h
+++ b/Source/WebKit/blackberry/Api/BackingStore_p.h
@@ -29,10 +29,6 @@
 #include <wtf/HashMap.h>
 #include <wtf/Vector.h>
 
-#if USE(OPENVG)
-#include <egl.h>
-#endif
-
 #include <pthread.h>
 
 namespace WebCore {
@@ -332,9 +328,6 @@ public:
     bool m_defersBlit;
     bool m_hasBlitJobs;
 
-#if USE(OPENVG)
-    EGLDisplay m_eglDisplay;
-#endif
     mutable unsigned m_frontState;
     mutable unsigned m_backState;
 
diff --git a/Source/WebKit/blackberry/Api/BlackBerryGlobal.cpp b/Source/WebKit/blackberry/Api/BlackBerryGlobal.cpp
new file mode 100644
index 000000000..6258a3cc3
--- /dev/null
+++ b/Source/WebKit/blackberry/Api/BlackBerryGlobal.cpp
@@ -0,0 +1,153 @@
+/*
+ * Copyright (C) 2009, 2010, 2011, 2012 Research In Motion Limited. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+#include "config.h"
+#include "BlackBerryGlobal.h"
+
+#include "ApplicationCacheStorage.h"
+#include "CacheClientBlackBerry.h"
+#include "CookieManager.h"
+#include "CrossOriginPreflightResultCache.h"
+#include "FontCache.h"
+#include "ImageSource.h"
+#include "InitializeThreading.h"
+#include "JSDOMWindow.h"
+#include "JSGlobalData.h"
+#include "Logging.h"
+#include "MainThread.h"
+#include "MemoryCache.h"
+#include "NetworkStateNotifier.h"
+#include "PageCache.h"
+#include "PageGroup.h"
+#include "TextureCacheCompositingThread.h"
+#include "WebString.h"
+#include "bindings/js/GCController.h"
+#include "runtime/JSLock.h"
+#include <BlackBerryPlatformExecutableMessage.h>
+#include <BlackBerryPlatformMessageClient.h>
+#include <BlackBerryPlatformSettings.h>
+
+using namespace WebCore;
+
+namespace BlackBerry {
+namespace WebKit {
+
+static bool gIsGlobalInitialized = false;
+
+// Global initialization of various WebKit singletons.
+void globalInitialize()
+{
+    if (gIsGlobalInitialized)
+        return;
+    gIsGlobalInitialized = true;
+
+#if ENABLE(BLACKBERRY_DEBUG_MEMORY)
+    blackberryDebugInitialize();
+#endif
+
+    // Turn on logging.
+    initializeLoggingChannelsIfNecessary();
+
+    // Initialize threading/
+    JSC::initializeThreading();
+
+    // Normally this is called from initializeThreading, but we're using ThreadingNone
+    // we're grabbing callOnMainThread without using the rest of the threading support.
+    WTF::initializeMainThread();
+
+    // Track visited links.
+    PageGroup::setShouldTrackVisitedLinks(true);
+
+    CacheClientBlackBerry::get()->initialize();
+
+    BlackBerry::Platform::Settings* settings = BlackBerry::Platform::Settings::get();
+
+    ImageSource::setMaxPixelsPerDecodedImage(settings->maxPixelsPerDecodedImage());
+}
+
+void collectJavascriptGarbageNow()
+{
+    if (gIsGlobalInitialized)
+        gcController().garbageCollectNow();
+}
+
+void clearCookieCache()
+{
+    cookieManager().removeAllCookies(RemoveFromBackingStore);
+}
+
+#if USE(ACCELERATED_COMPOSITING)
+static void clearMemoryCachesInCompositingThread()
+{
+    textureCacheCompositingThread()->prune(0);
+}
+#endif
+
+void clearMemoryCaches()
+{
+#if USE(ACCELERATED_COMPOSITING)
+    // Call textureCacheCompositingThread()->prune(0) in UI thread.
+    BlackBerry::Platform::userInterfaceThreadMessageClient()->dispatchMessage(BlackBerry::Platform::createFunctionCallMessage(clearMemoryCachesInCompositingThread));
+#endif
+
+    {
+        JSC::JSLock lock(JSC::SilenceAssertionsOnly);
+        // This function also performs a GC.
+        JSC::releaseExecutableMemory(*JSDOMWindow::commonJSGlobalData());
+    }
+
+    // Clean caches after JS garbage collection because JS GC can
+    // generate more dead resources.
+    int capacity = pageCache()->capacity();
+    pageCache()->setCapacity(0);
+    pageCache()->setCapacity(capacity);
+    pageCache()->releaseAutoreleasedPagesNow();
+
+    CrossOriginPreflightResultCache::shared().empty();
+
+    if (!memoryCache()->disabled()) {
+        // Evict all dead resources and prune live resources.
+        memoryCache()->setCapacities(0, 0, 0);
+
+        // Update cache capacity based on current memory status.
+        CacheClientBlackBerry::get()->updateCacheCapacity();
+    }
+
+    fontCache()->invalidate();
+}
+
+void clearAppCache(const WebString& pageGroupName)
+{
+    cacheStorage().empty();
+}
+
+void clearLocalStorage(const WebString& pageGroupName)
+{
+}
+
+void clearDatabase(const WebString& pageGroupName)
+{
+}
+
+void updateOnlineStatus(bool online)
+{
+    networkStateNotifier().networkStateChange(online);
+}
+
+}
+}
diff --git a/Source/WebKit/blackberry/Api/BlackBerryGlobal.h b/Source/WebKit/blackberry/Api/BlackBerryGlobal.h
new file mode 100644
index 000000000..e794fb951
--- /dev/null
+++ b/Source/WebKit/blackberry/Api/BlackBerryGlobal.h
@@ -0,0 +1,49 @@
+/*
+ * Copyright (C) 2009, 2010, 2011, 2012 Research In Motion Limited. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+#ifndef BlackBerryGlobal_h
+#define BlackBerryGlobal_h
+
+#if defined(__QNXNTO__) && defined(BUILD_WEBKIT)
+        #define BLACKBERRY_EXPORT __attribute__ ((visibility("default")))
+#else
+    #define BLACKBERRY_EXPORT
+#endif
+
+namespace BlackBerry {
+namespace WebKit {
+
+class WebString;
+
+void globalInitialize();
+void collectJavascriptGarbageNow();
+void clearCookieCache();
+BLACKBERRY_EXPORT void clearMemoryCaches();
+void clearAppCache(const WebString& pageGroupName);
+void reopenAllAppCaches();
+void closeAllAppCaches();
+void clearLocalStorage(const WebString& pageGroupName);
+void closeAllLocalStorages();
+void clearDatabase(const WebString& pageGroupName);
+void reopenAllTrackerDatabases();
+void closeAllTrackerDatabases();
+void updateOnlineStatus(bool online);
+}
+}
+
+#endif // BlackBerryGlobal_h
diff --git a/Source/WebKit/blackberry/Api/Version.cpp b/Source/WebKit/blackberry/Api/Version.cpp
new file mode 100644
index 000000000..23e7b7bd5
--- /dev/null
+++ b/Source/WebKit/blackberry/Api/Version.cpp
@@ -0,0 +1,43 @@
+/*
+ * Copyright (C) 2010, 2011, 2012 Research In Motion Limited. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+#include "config.h"
+#include "Version.h"
+
+#include "WebKitVersion.h" // Note: auto generated at build time.
+
+// Make sure we are not treated as big endian nor middle endian.
+#if PLATFORM(ARM) && (PLATFORM(BIG_ENDIAN) || PLATFORM(MIDDLE_ENDIAN))
+#error Our platform is little endian, but either PLATFORM(BIG_ENDIAN) or PLATFORM(MIDDLE_ENDIAN) is defined!
+#endif
+
+namespace BlackBerry {
+namespace WebKit {
+
+int webKitMajorVersion()
+{
+    return WEBKIT_MAJOR_VERSION;
+}
+
+int webKitMinorVersion()
+{
+    return WEBKIT_MINOR_VERSION;
+}
+
+}
+}
diff --git a/Source/WebKit/blackberry/Api/Version.h b/Source/WebKit/blackberry/Api/Version.h
new file mode 100644
index 000000000..eedd7da8d
--- /dev/null
+++ b/Source/WebKit/blackberry/Api/Version.h
@@ -0,0 +1,29 @@
+/*
+ * Copyright (C) 2010, 2011 Research In Motion Limited. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+#ifndef Version_h
+#define Version_h
+
+namespace BlackBerry {
+namespace WebKit {
+int webKitMajorVersion();
+int webKitMinorVersion();
+}
+}
+
+#endif // Version_h
diff --git a/Source/WebKit/blackberry/Api/WebKitMIMETypeConverter.cpp b/Source/WebKit/blackberry/Api/WebKitMIMETypeConverter.cpp
new file mode 100644
index 000000000..9c98af4e3
--- /dev/null
+++ b/Source/WebKit/blackberry/Api/WebKitMIMETypeConverter.cpp
@@ -0,0 +1,56 @@
+/*
+ * Copyright (C) 2012 Research In Motion Limited. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+#include "config.h"
+#include "WebKitMIMETypeConverter.h"
+
+#include "MIMETypeRegistry.h"
+#include <wtf/text/CString.h>
+#include <wtf/text/WTFString.h>
+
+namespace BlackBerry {
+namespace WebKit {
+
+bool getExtensionForMimeType(const std::string& mime, std::string& extension)
+{
+    String mimeType(mime.data(), mime.length());
+    String preferredExtension = WebCore::MIMETypeRegistry::getPreferredExtensionForMIMEType(mimeType);
+    if (preferredExtension.isEmpty())
+        return false;
+
+    CString utf8 = preferredExtension.utf8();
+    extension.clear();
+    extension.append(utf8.data(), utf8.length());
+    return true;
+}
+
+bool getMimeTypeForExtension(const std::string& extension, std::string& mimeType)
+{
+    String extStr(extension.data(), extension.length());
+    String mime = WebCore::MIMETypeRegistry::getMediaMIMETypeForExtension(extStr);
+    if (mime.isEmpty())
+        return false;
+
+    CString utf8 = mime.utf8();
+    mimeType.clear();
+    mimeType.append(utf8.data(), utf8.length());
+    return true;
+}
+
+} // namespace WebKit
+} // namespace BlackBerry
diff --git a/Source/WebKit/blackberry/Api/WebKitMIMETypeConverter.h b/Source/WebKit/blackberry/Api/WebKitMIMETypeConverter.h
new file mode 100644
index 000000000..3ff3d74f9
--- /dev/null
+++ b/Source/WebKit/blackberry/Api/WebKitMIMETypeConverter.h
@@ -0,0 +1,34 @@
+/*
+ * Copyright (C) 2012 Research In Motion Limited. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+#ifndef WebKitMIMETypeConverter_h
+#define WebKitMIMETypeConverter_h
+
+#include "BlackBerryGlobal.h"
+#include <string>
+
+namespace BlackBerry {
+namespace WebKit {
+
+BLACKBERRY_EXPORT bool getExtensionForMimeType(const std::string& mime, std::string& extension);
+BLACKBERRY_EXPORT bool getMimeTypeForExtension(const std::string& extension, std::string& mimeType);
+
+} // namespace WebKit
+} // namespace BlackBerry
+
+#endif // WebKitMIMETypeConverter_h
diff --git a/Source/WebKit/blackberry/Api/WebKitTextCodec.cpp b/Source/WebKit/blackberry/Api/WebKitTextCodec.cpp
index badb31fc7..3250601dd 100644
--- a/Source/WebKit/blackberry/Api/WebKitTextCodec.cpp
+++ b/Source/WebKit/blackberry/Api/WebKitTextCodec.cpp
@@ -21,7 +21,6 @@
 
 #include "Base64.h"
 #include "KURL.h"
-#include "MIMETypeRegistry.h"
 #include "TextCodecICU.h"
 #include <wtf/Vector.h>
 #include <wtf/text/CString.h>
@@ -134,18 +133,5 @@ void escapeURL(const std::string& url, std::string& escaped)
     escaped.append(utf8.data(), utf8.length());
 }
 
-bool getExtensionForMimeType(const std::string& mime, std::string& extension)
-{
-    String mimeType(mime.data(), mime.length());
-    String preferredExtension = WebCore::MIMETypeRegistry::getPreferredExtensionForMIMEType(mimeType);
-    if (preferredExtension.isEmpty())
-        return false;
-
-    CString utf8 = preferredExtension.utf8();
-    extension.clear();
-    extension.append(utf8.data(), utf8.length());
-    return true;
-}
-
 } // namespace WebKit
 } // namespace BlackBerry
diff --git a/Source/WebKit/blackberry/Api/WebKitTextCodec.h b/Source/WebKit/blackberry/Api/WebKitTextCodec.h
index 318411a87..2834be793 100644
--- a/Source/WebKit/blackberry/Api/WebKitTextCodec.h
+++ b/Source/WebKit/blackberry/Api/WebKitTextCodec.h
@@ -55,8 +55,6 @@ BLACKBERRY_EXPORT bool base64Encode(const std::vector<char>& binary, std::string
 BLACKBERRY_EXPORT void unescapeURL(const std::string& escaped, std::string& url);
 BLACKBERRY_EXPORT void escapeURL(const std::string& url, std::string& escaped);
 
-BLACKBERRY_EXPORT bool getExtensionForMimeType(const std::string& mime, std::string& extension);
-
 } // namespace WebKit
 } // namespace BlackBerry
 
diff --git a/Source/WebKit/blackberry/Api/WebPage.cpp b/Source/WebKit/blackberry/Api/WebPage.cpp
new file mode 100644
index 000000000..f3ce5f0ce
--- /dev/null
+++ b/Source/WebKit/blackberry/Api/WebPage.cpp
@@ -0,0 +1,5598 @@
+/*
+ * Copyright (C) 2009, 2010, 2011, 2012 Research In Motion Limited. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+#include "config.h"
+#include "WebPage.h"
+
+#include "ApplicationCacheStorage.h"
+#include "BackForwardController.h"
+#include "BackForwardListImpl.h"
+#include "BackingStoreClient.h"
+#include "BackingStoreCompositingSurface.h"
+#include "BackingStore_p.h"
+#include "CString.h"
+#include "CachedImage.h"
+#include "Chrome.h"
+#include "ChromeClientBlackBerry.h"
+#include "ContextMenuClientBlackBerry.h"
+#include "CookieManager.h"
+#include "DOMSupport.h"
+#include "Database.h"
+#include "DatabaseSync.h"
+#include "DatabaseTracker.h"
+#include "DeviceMotionClientBlackBerry.h"
+#include "DeviceOrientationClientBlackBerry.h"
+#include "DragClientBlackBerry.h"
+// FIXME: We should be using DumpRenderTreeClient, but I'm not sure where we should
+// create the DRT_BB object. See PR #120355.
+#if ENABLE_DRT
+#include "DumpRenderTreeBlackBerry.h"
+#endif
+#include "EditorClientBlackBerry.h"
+#include "FocusController.h"
+#include "FrameLoaderClientBlackBerry.h"
+#if ENABLE(CLIENT_BASED_GEOLOCATION)
+#if ENABLE_DRT
+#include "GeolocationClientMock.h"
+#endif
+#include "GeolocationControllerClientBlackBerry.h"
+#endif
+#include "GroupSettings.h"
+#include "HTMLAreaElement.h"
+#include "HTMLFrameOwnerElement.h"
+#include "HTMLImageElement.h"
+#include "HTMLInputElement.h"
+#include "HTMLNames.h"
+#include "HTMLParserIdioms.h"
+#include "HTTPParsers.h"
+#include "HistoryItem.h"
+#include "IconDatabaseClientBlackBerry.h"
+#include "InPageSearchManager.h"
+#include "InRegionScrollableArea.h"
+#include "InputHandler.h"
+#include "InspectorBackendDispatcher.h"
+#include "InspectorClientBlackBerry.h"
+#include "InspectorController.h"
+#include "JavaScriptDebuggerBlackBerry.h"
+#include "LayerWebKitThread.h"
+#include "NetworkManager.h"
+#include "NodeRenderStyle.h"
+#include "Page.h"
+#include "PageCache.h"
+#include "PageGroup.h"
+#include "PlatformTouchEvent.h"
+#include "PlatformWheelEvent.h"
+#include "PluginDatabase.h"
+#include "PluginView.h"
+#include "RenderText.h"
+#include "RenderThemeBlackBerry.h"
+#include "RenderTreeAsText.h"
+#include "RenderView.h"
+#include "RenderWidget.h"
+#include "ScriptSourceCode.h"
+#include "ScriptValue.h"
+#include "ScrollTypes.h"
+#include "SelectionHandler.h"
+#include "Settings.h"
+#include "Storage.h"
+#include "StorageNamespace.h"
+#include "SurfacePool.h"
+#include "Text.h"
+#include "ThreadCheck.h"
+#include "TouchEventHandler.h"
+#include "TransformationMatrix.h"
+#include "VisiblePosition.h"
+#if ENABLE(WEBDOM)
+#include "WebDOMDocument.h"
+#endif
+#include "WebPageClient.h"
+#include "WebSocket.h"
+#include "npapi.h"
+#include "runtime_root.h"
+
+#if ENABLE(VIDEO)
+#include "HTMLMediaElement.h"
+#include "MediaPlayer.h"
+#include "MediaPlayerPrivateBlackBerry.h"
+#endif
+
+#if USE(SKIA)
+#include "PlatformContextSkia.h"
+#endif
+
+#if USE(ACCELERATED_COMPOSITING)
+#include "FrameLayers.h"
+#include "WebPageCompositor.h"
+#endif
+
+#include <BlackBerryPlatformExecutableMessage.h>
+#include <BlackBerryPlatformITPolicy.h>
+#include <BlackBerryPlatformKeyboardEvent.h>
+#include <BlackBerryPlatformMessageClient.h>
+#include <BlackBerryPlatformMouseEvent.h>
+#include <BlackBerryPlatformScreen.h>
+#include <BlackBerryPlatformSettings.h>
+#include <JavaScriptCore/APICast.h>
+#include <JavaScriptCore/JSContextRef.h>
+#include <SharedPointer.h>
+#include <sys/keycodes.h>
+#include <unicode/ustring.h> // platform ICU
+
+#ifndef USER_PROCESSES
+#include <memalloc.h>
+#endif
+
+#if ENABLE(SKIA_GPU_CANVAS)
+#include "BlackBerryPlatformGraphics.h"
+#include "GrContext.h"
+#endif
+
+#define DEBUG_BLOCK_ZOOM 0
+#define DEBUG_TOUCH_EVENTS 0
+#define DEBUG_WEBPAGE_LOAD 0
+
+using namespace std;
+using namespace WebCore;
+
+typedef const unsigned short* CUShortPtr;
+
+namespace BlackBerry {
+namespace WebKit {
+
+static Vector<WebPage*>* visibleWebPages()
+{
+    static Vector<WebPage*>* s_visibleWebPages = 0; // Initially, no web page is visible.
+    if (!s_visibleWebPages)
+        s_visibleWebPages = new Vector<WebPage*>;
+    return s_visibleWebPages;
+}
+
+const unsigned blockZoomMargin = 3; // Add 3 pixel margin on each side.
+static int blockClickRadius = 0;
+static double maximumBlockZoomScale = 3; // This scale can be clamped by the maximumScale set for the page.
+
+const double manualScrollInterval = 0.1; // The time interval during which we associate user action with scrolling.
+
+const double delayedZoomInterval = 0;
+
+const IntSize minimumLayoutSize(10, 10); // Needs to be a small size, greater than 0, that we can grow the layout from.
+const IntSize maximumLayoutSize(10000, 10000); // Used with viewport meta tag, but we can still grow from this of course.
+
+const double minimumExpandingRatio = 0.15;
+
+// Helper function to parse a URL and fill in missing parts.
+static KURL parseUrl(const String& url)
+{
+    String urlString(url);
+    KURL kurl = KURL(KURL(), urlString);
+    if (kurl.protocol().isEmpty()) {
+        urlString.insert("http://", 0);
+        kurl = KURL(KURL(), urlString);
+    }
+
+    return kurl;
+}
+
+// Helper functions to convert to and from WebCore types.
+static inline MouseEventType toWebCoreMouseEventType(const Platform::MouseEvent::Type type)
+{
+    switch (type) {
+    case Platform::MouseEvent::MouseButtonDown:
+        return MouseEventPressed;
+    case Platform::MouseEvent::MouseButtonUp:
+        return MouseEventReleased;
+    case Platform::MouseEvent::MouseMove:
+    default:
+        return MouseEventMoved;
+    }
+}
+
+static inline ResourceRequestCachePolicy toWebCoreCachePolicy(Platform::NetworkRequest::CachePolicy policy)
+{
+    switch (policy) {
+    case Platform::NetworkRequest::UseProtocolCachePolicy:
+        return UseProtocolCachePolicy;
+    case Platform::NetworkRequest::ReloadIgnoringCacheData:
+        return ReloadIgnoringCacheData;
+    case Platform::NetworkRequest::ReturnCacheDataElseLoad:
+        return ReturnCacheDataElseLoad;
+    case Platform::NetworkRequest::ReturnCacheDataDontLoad:
+        return ReturnCacheDataDontLoad;
+    default:
+        ASSERT_NOT_REACHED();
+        return UseProtocolCachePolicy;
+    }
+}
+
+#if ENABLE(EVENT_MODE_METATAGS)
+static inline Platform::CursorEventMode toPlatformCursorEventMode(CursorEventMode mode)
+{
+    switch (mode) {
+    case ProcessedCursorEvents:
+        return Platform::ProcessedCursorEvents;
+    case NativeCursorEvents:
+        return Platform::NativeCursorEvents;
+    default:
+        ASSERT_NOT_REACHED();
+        return Platform::ProcessedCursorEvents;
+    }
+}
+
+static inline Platform::TouchEventMode toPlatformTouchEventMode(TouchEventMode mode)
+{
+    switch (mode) {
+    case ProcessedTouchEvents:
+        return Platform::ProcessedTouchEvents;
+    case NativeTouchEvents:
+        return Platform::NativeTouchEvents;
+    case PureTouchEventsWithMouseConversion:
+        return Platform::PureTouchEventsWithMouseConversion;
+    default:
+        ASSERT_NOT_REACHED();
+        return Platform::ProcessedTouchEvents;
+    }
+}
+#endif
+
+static inline HistoryItem* historyItemFromBackForwardId(WebPage::BackForwardId id)
+{
+    return reinterpret_cast<HistoryItem*>(id);
+}
+
+static inline WebPage::BackForwardId backForwardIdFromHistoryItem(HistoryItem* item)
+{
+    return reinterpret_cast<WebPage::BackForwardId>(item);
+}
+
+WebPagePrivate::WebPagePrivate(WebPage* webPage, WebPageClient* client, const IntRect& rect)
+    : m_webPage(webPage)
+    , m_client(client)
+    , m_page(0) // Initialized by init.
+    , m_mainFrame(0) // Initialized by init.
+    , m_currentContextNode(0)
+    , m_webSettings(0) // Initialized by init.
+    , m_visible(false)
+    , m_shouldResetTilesWhenShown(false)
+    , m_userScalable(true)
+    , m_userPerformedManualZoom(false)
+    , m_userPerformedManualScroll(false)
+    , m_contentsSizeChanged(false)
+    , m_overflowExceedsContentsSize(false)
+    , m_resetVirtualViewportOnCommitted(true)
+    , m_shouldUseFixedDesktopMode(false)
+    , m_needTouchEvents(false)
+    , m_preventIdleDimmingCount(0)
+#if ENABLE(TOUCH_EVENTS)
+    , m_preventDefaultOnTouchStart(false)
+#endif
+    , m_nestedLayoutFinishedCount(0)
+    , m_actualVisibleWidth(rect.width())
+    , m_actualVisibleHeight(rect.height())
+    , m_virtualViewportWidth(0)
+    , m_virtualViewportHeight(0)
+    , m_defaultLayoutSize(minimumLayoutSize)
+    , m_didRestoreFromPageCache(false)
+    , m_viewMode(WebPagePrivate::Desktop) // Default to Desktop mode for PB.
+    , m_loadState(WebPagePrivate::None)
+    , m_transformationMatrix(new TransformationMatrix())
+    , m_backingStore(0) // Initialized by init.
+    , m_backingStoreClient(0) // Initialized by init.
+    , m_inPageSearchManager(new InPageSearchManager(this))
+    , m_inputHandler(new InputHandler(this))
+    , m_selectionHandler(new SelectionHandler(this))
+    , m_touchEventHandler(new TouchEventHandler(this))
+#if ENABLE(EVENT_MODE_METATAGS)
+    , m_cursorEventMode(ProcessedCursorEvents)
+    , m_touchEventMode(ProcessedTouchEvents)
+#endif
+    , m_currentCursor(Platform::CursorNone)
+    , m_dumpRenderTree(0) // Lazy initialization.
+    , m_initialScale(-1.0)
+    , m_minimumScale(-1.0)
+    , m_maximumScale(-1.0)
+    , m_blockZoomFinalScale(1.0)
+    , m_anchorInNodeRectRatio(-1, -1)
+    , m_currentBlockZoomNode(0)
+    , m_currentBlockZoomAdjustedNode(0)
+    , m_shouldReflowBlock(false)
+    , m_delayedZoomTimer(adoptPtr(new Timer<WebPagePrivate>(this, &WebPagePrivate::zoomAboutPointTimerFired)))
+    , m_lastUserEventTimestamp(0.0)
+    , m_pluginMouseButtonPressed(false)
+    , m_pluginMayOpenNewTab(false)
+    , m_geolocationClient(0)
+    , m_inRegionScrollStartingNode(0)
+#if USE(ACCELERATED_COMPOSITING)
+    , m_isAcceleratedCompositingActive(false)
+    , m_rootLayerCommitTimer(adoptPtr(new Timer<WebPagePrivate>(this, &WebPagePrivate::rootLayerCommitTimerFired)))
+    , m_needsOneShotDrawingSynchronization(false)
+    , m_needsCommit(false)
+    , m_suspendRootLayerCommit(false)
+#endif
+    , m_pendingOrientation(-1)
+    , m_fullscreenVideoNode(0)
+    , m_hasInRegionScrollableAreas(false)
+    , m_updateDelegatedOverlaysDispatched(false)
+{
+}
+
+WebPagePrivate::~WebPagePrivate()
+{
+    // Hand the backingstore back to another owner if necessary.
+    m_webPage->setVisible(false);
+    if (BackingStorePrivate::currentBackingStoreOwner() == m_webPage)
+        BackingStorePrivate::setCurrentBackingStoreOwner(0);
+
+    delete m_webSettings;
+    m_webSettings = 0;
+
+    delete m_backingStoreClient;
+    m_backingStoreClient = 0;
+    m_backingStore = 0;
+
+    delete m_page;
+    m_page = 0;
+
+    delete m_transformationMatrix;
+    m_transformationMatrix = 0;
+
+    delete m_inPageSearchManager;
+    m_inPageSearchManager = 0;
+
+    delete m_selectionHandler;
+    m_selectionHandler = 0;
+
+    delete m_inputHandler;
+    m_inputHandler = 0;
+
+    delete m_touchEventHandler;
+    m_touchEventHandler = 0;
+
+#if ENABLE_DRT
+    delete m_dumpRenderTree;
+    m_dumpRenderTree = 0;
+#endif
+}
+
+void WebPagePrivate::init(const WebString& pageGroupName)
+{
+    ChromeClientBlackBerry* chromeClient = new ChromeClientBlackBerry(this);
+    ContextMenuClientBlackBerry* contextMenuClient = 0;
+#if ENABLE(CONTEXT_MENUS)
+    contextMenuClient = new ContextMenuClientBlackBerry();
+#endif
+    EditorClientBlackBerry* editorClient = new EditorClientBlackBerry(this);
+    DragClientBlackBerry* dragClient = 0;
+#if ENABLE(DRAG_SUPPORT)
+    dragClient = new DragClientBlackBerry();
+#endif
+    InspectorClientBlackBerry* inspectorClient = 0;
+#if ENABLE(INSPECTOR)
+    inspectorClient = new InspectorClientBlackBerry(this);
+#endif
+
+    FrameLoaderClientBlackBerry* frameLoaderClient = new FrameLoaderClientBlackBerry();
+
+    Page::PageClients pageClients;
+    pageClients.chromeClient = chromeClient;
+    pageClients.contextMenuClient = contextMenuClient;
+    pageClients.editorClient = editorClient;
+    pageClients.dragClient = dragClient;
+    pageClients.inspectorClient = inspectorClient;
+
+#if ENABLE(CLIENT_BASED_GEOLOCATION)
+    // Note the object will be destroyed when the page is destroyed.
+#if ENABLE_DRT
+    if (getenv("drtRun"))
+        pageClients.geolocationClient = new GeolocationClientMock();
+    else
+#endif
+        pageClients.geolocationClient = m_geolocationClient = new GeolocationControllerClientBlackBerry(this);
+#else
+    pageClients.geolocationClient = m_geolocationClient;
+#endif
+
+    pageClients.deviceMotionClient = new DeviceMotionClientBlackBerry(this);
+    pageClients.deviceOrientationClient = new DeviceOrientationClientBlackBerry(this);
+    m_page = new Page(pageClients);
+
+#if ENABLE(CLIENT_BASED_GEOLOCATION) && ENABLE_DRT
+    // In case running in DumpRenderTree mode set the controller to mock provider.
+    if (getenv("drtRun"))
+        static_cast<GeolocationClientMock*>(pageClients.geolocationClient)->setController(m_page->geolocationController());
+#endif
+
+    m_page->setCustomHTMLTokenizerChunkSize(256);
+    m_page->setCustomHTMLTokenizerTimeDelay(0.3);
+
+    m_webSettings = WebSettings::createFromStandardSettings();
+
+    // FIXME: We explicitly call setDelegate() instead of passing ourself in createFromStandardSettings()
+    // so that we only get one didChangeSettings() callback when we set the page group name. This causes us
+    // to make a copy of the WebSettings since some WebSettings method make use of the page group name.
+    // Instead, we shouldn't be storing the page group name in WebSettings.
+    m_webSettings->setDelegate(this);
+    m_webSettings->setPageGroupName(pageGroupName);
+
+    RefPtr<Frame> newFrame = Frame::create(m_page, /* HTMLFrameOwnerElement* */ 0, frameLoaderClient);
+
+    m_mainFrame = newFrame.get();
+    frameLoaderClient->setFrame(m_mainFrame, this);
+    m_mainFrame->init();
+
+#if ENABLE(WEBGL)
+    Platform::Settings* settings = Platform::Settings::get();
+    m_page->settings()->setWebGLEnabled(settings && settings->isWebGLSupported());
+#endif
+#if ENABLE(SKIA_GPU_CANVAS)
+    m_page->settings()->setCanvasUsesAcceleratedDrawing(true);
+    m_page->settings()->setAccelerated2dCanvasEnabled(true);
+#endif
+#if ENABLE(VIEWPORT_REFLOW)
+    m_page->settings()->setTextReflowEnabled(m_webSettings->textReflowMode() == WebSettings::TextReflowEnabled);
+#endif
+
+    m_page->settings()->setUseHixie76WebSocketProtocol(false);
+    m_page->settings()->setInteractiveFormValidationEnabled(true);
+    m_page->settings()->setAllowUniversalAccessFromFileURLs(false);
+
+    m_backingStoreClient = BackingStoreClient::create(m_mainFrame, /* parent frame */ 0, m_webPage);
+    // The direct access to BackingStore is left here for convenience since it
+    // is owned by BackingStoreClient and then deleted by its destructor.
+    m_backingStore = m_backingStoreClient->backingStore();
+
+    m_page->settings()->setSpatialNavigationEnabled(m_webSettings->isSpatialNavigationEnabled());
+    blockClickRadius = int(roundf(0.35 * Platform::Graphics::Screen::pixelsPerInch(0).width())); // The clicked rectangle area should be a fixed unit of measurement.
+
+    m_page->settings()->setDelegateSelectionPaint(true);
+}
+
+void WebPagePrivate::load(const char* url, const char* networkToken, const char* method, Platform::NetworkRequest::CachePolicy cachePolicy, const char* data, size_t dataLength, const char* const* headers, size_t headersLength, bool isInitial, bool mustHandleInternally, bool forceDownload, const char* overrideContentType)
+{
+    stopCurrentLoad();
+
+    String urlString(url);
+    if (urlString.startsWith("vs:", false)) {
+        urlString = urlString.substring(3);
+        m_mainFrame->setInViewSourceMode(true);
+    } else
+        m_mainFrame->setInViewSourceMode(false);
+
+    KURL kurl = parseUrl(urlString);
+    if (protocolIs(kurl, "javascript")) {
+        // Never run javascript while loading is deferred.
+        if (m_page->defersLoading()) {
+            FrameLoaderClientBlackBerry* frameLoaderClient = static_cast<FrameLoaderClientBlackBerry*>(m_mainFrame->loader()->client());
+            frameLoaderClient->setDeferredManualScript(kurl);
+        } else
+            m_mainFrame->script()->executeIfJavaScriptURL(kurl, DoNotReplaceDocumentIfJavaScriptURL);
+        return;
+    }
+
+    if (isInitial)
+        NetworkManager::instance()->setInitialURL(kurl);
+
+    ResourceRequest request(kurl, "" /* referrer */);
+    request.setToken(networkToken);
+    if (isInitial || mustHandleInternally)
+        request.setMustHandleInternally(true);
+    request.setHTTPMethod(method);
+    request.setCachePolicy(toWebCoreCachePolicy(cachePolicy));
+    if (overrideContentType)
+        request.setOverrideContentType(overrideContentType);
+
+    if (data)
+        request.setHTTPBody(FormData::create(data, dataLength));
+
+    for (unsigned i = 0; i + 1 < headersLength; i += 2)
+        request.addHTTPHeaderField(headers[i], headers[i + 1]);
+
+    if (forceDownload)
+        request.setForceDownload(true);
+
+    m_mainFrame->loader()->load(request, "" /* name */, false);
+}
+
+void WebPagePrivate::loadString(const char* string, const char* baseURL, const char* contentType, const char* failingURL)
+{
+    KURL kurl = parseUrl(baseURL);
+    ResourceRequest request(kurl);
+    WTF::RefPtr<SharedBuffer> buffer
+        = SharedBuffer::create(string, strlen(string));
+    SubstituteData substituteData(buffer,
+                                  extractMIMETypeFromMediaType(contentType),
+                                  extractCharsetFromMediaType(contentType),
+                                  failingURL ? parseUrl(failingURL) : KURL());
+    m_mainFrame->loader()->load(request, substituteData, false);
+}
+
+bool WebPagePrivate::executeJavaScript(const char* script, JavaScriptDataType& returnType, WebString& returnValue)
+{
+    ScriptValue result = m_mainFrame->script()->executeScript(String::fromUTF8(script), false);
+    JSC::JSValue value = result.jsValue();
+    if (!value) {
+        returnType = JSException;
+        return false;
+    }
+
+    JSC::ExecState* exec = m_mainFrame->script()->globalObject(mainThreadNormalWorld())->globalExec();
+    JSGlobalContextRef context = toGlobalRef(exec);
+
+    JSType type = JSValueGetType(context, toRef(exec, value));
+
+    switch (type) {
+    case kJSTypeNull:
+        returnType = JSNull;
+        break;
+    case kJSTypeBoolean:
+        returnType = JSBoolean;
+        break;
+    case kJSTypeNumber:
+        returnType = JSNumber;
+        break;
+    case kJSTypeString:
+        returnType = JSString;
+        break;
+    case kJSTypeObject:
+        returnType = JSObject;
+        break;
+    case kJSTypeUndefined:
+    default:
+        returnType = JSUndefined;
+        break;
+    }
+
+    if (returnType == JSBoolean || returnType == JSNumber || returnType == JSString || returnType == JSObject) {
+        String str = result.toString(exec);
+        returnValue = WebString(str.impl());
+    }
+
+    return true;
+}
+
+bool WebPagePrivate::executeJavaScriptInIsolatedWorld(const ScriptSourceCode& sourceCode, JavaScriptDataType& returnType, WebString& returnValue)
+{
+    if (!m_isolatedWorld)
+        m_isolatedWorld = m_mainFrame->script()->createWorld();
+
+    // Use evaluateInWorld to avoid canExecuteScripts check.
+    ScriptValue result = m_mainFrame->script()->evaluateInWorld(sourceCode, m_isolatedWorld.get());
+    JSC::JSValue value = result.jsValue();
+    if (!value) {
+        returnType = JSException;
+        return false;
+    }
+
+    JSC::ExecState* exec = m_mainFrame->script()->globalObject(m_isolatedWorld.get())->globalExec();
+    JSGlobalContextRef context = toGlobalRef(exec);
+
+    JSType type = JSValueGetType(context, toRef(exec, value));
+
+    switch (type) {
+    case kJSTypeNull:
+        returnType = JSNull;
+        break;
+    case kJSTypeBoolean:
+        returnType = JSBoolean;
+        break;
+    case kJSTypeNumber:
+        returnType = JSNumber;
+        break;
+    case kJSTypeString:
+        returnType = JSString;
+        break;
+    case kJSTypeObject:
+        returnType = JSObject;
+        break;
+    case kJSTypeUndefined:
+    default:
+        returnType = JSUndefined;
+        break;
+    }
+
+    if (returnType == JSBoolean || returnType == JSNumber || returnType == JSString || returnType == JSObject) {
+        String str = result.toString(exec);
+        returnValue = WebString(str.impl());
+    }
+
+    return true;
+}
+
+void WebPagePrivate::stopCurrentLoad()
+{
+    // This function should contain all common code triggered by WebPage::load
+    // (which stops any load in progress before starting the new load) and
+    // WebPage::stoploading (the entry point for the client to stop the load
+    // explicitly). If it should only be done while stopping the load
+    // explicitly, it goes in WebPage::stopLoading, not here.
+    m_mainFrame->loader()->stopAllLoaders();
+
+    // Cancel any deferred script that hasn't been processed yet.
+    FrameLoaderClientBlackBerry* frameLoaderClient = static_cast<FrameLoaderClientBlackBerry*>(m_mainFrame->loader()->client());
+    frameLoaderClient->setDeferredManualScript(KURL());
+}
+
+static void closeURLRecursively(Frame* frame)
+{
+    // Do not create more frame please.
+    FrameLoaderClientBlackBerry* frameLoaderClient = static_cast<FrameLoaderClientBlackBerry*>(frame->loader()->client());
+    frameLoaderClient->suppressChildFrameCreation();
+
+    frame->loader()->closeURL();
+
+    Vector<RefPtr<Frame>, 10> childFrames;
+
+    for (RefPtr<Frame> childFrame = frame->tree()->firstChild(); childFrame; childFrame = childFrame->tree()->nextSibling())
+        childFrames.append(childFrame);
+
+    unsigned size = childFrames.size();
+    for (unsigned i = 0; i < size; i++)
+        closeURLRecursively(childFrames[i].get());
+}
+
+void WebPagePrivate::prepareToDestroy()
+{
+    // Before the client starts tearing itself down, dispatch the unload event
+    // so it can take effect while all the client's state (e.g. scroll position)
+    // is still present.
+    closeURLRecursively(m_mainFrame);
+}
+
+void WebPagePrivate::setLoadState(LoadState state)
+{
+    if (m_loadState == state)
+        return;
+
+    bool isFirstLoad = m_loadState == None;
+
+    // See RIM Bug #1068.
+    if (state == Finished && m_mainFrame && m_mainFrame->document())
+        m_mainFrame->document()->updateStyleIfNeeded();
+
+    m_loadState = state;
+
+#if DEBUG_WEBPAGE_LOAD
+    Platform::log(Platform::LogLevelInfo, "WebPagePrivate::setLoadState %d", state);
+#endif
+
+    switch (m_loadState) {
+    case Provisional:
+        if (isFirstLoad) {
+            // Paints the visible backingstore as white to prevent initial checkerboard on
+            // the first blit.
+            if (m_backingStore->d->renderVisibleContents() && !m_backingStore->d->isSuspended() && !m_backingStore->d->shouldDirectRenderingToWindow())
+                m_backingStore->d->blitVisibleContents();
+        }
+        break;
+    case Committed:
+        {
+            unscheduleZoomAboutPoint();
+
+#if ENABLE(SKIA_GPU_CANVAS)
+            if (m_page->settings()->canvasUsesAcceleratedDrawing()) {
+                // Free GPU resources as we're on a new page.
+                // This will help us to free memory pressure.
+                Platform::Graphics::makeSharedResourceContextCurrent(Platform::Graphics::GLES2);
+                GrContext* grContext = Platform::Graphics::getGrContext();
+                grContext->freeGpuResources();
+            }
+#endif
+
+#if USE(ACCELERATED_COMPOSITING)
+            // FIXME: compositor may only be touched on the compositing thread.
+            // However, it's created/destroyed by a sync command so this is harmless.
+            if (m_compositor) {
+                m_compositor->setLayoutRectForCompositing(IntRect());
+                m_compositor->setContentsSizeForCompositing(IntSize());
+            }
+#endif
+            m_previousContentsSize = IntSize();
+            m_backingStore->d->resetRenderQueue();
+            m_backingStore->d->resetTiles(true /* resetBackground */);
+            m_backingStore->d->setScrollingOrZooming(false, false /* shouldBlit */);
+            m_userPerformedManualZoom = false;
+            m_userPerformedManualScroll = false;
+            m_shouldUseFixedDesktopMode = false;
+            if (m_resetVirtualViewportOnCommitted) { // For DRT.
+                m_virtualViewportWidth = 0;
+                m_virtualViewportHeight = 0;
+            }
+            if (m_webSettings->viewportWidth() > 0) {
+                m_virtualViewportWidth = m_webSettings->viewportWidth();
+                m_virtualViewportHeight = m_defaultLayoutSize.height();
+            }
+            // Check if we have already process the meta viewport tag, this only happens on history navigation
+            if (!m_didRestoreFromPageCache) {
+                m_viewportArguments = ViewportArguments();
+                m_userScalable = m_webSettings->isUserScalable();
+                resetScales();
+            } else {
+                IntSize virtualViewport = recomputeVirtualViewportFromViewportArguments();
+                m_webPage->setVirtualViewportSize(virtualViewport.width(), virtualViewport.height());
+            }
+
+#if ENABLE(EVENT_MODE_METATAGS)
+            didReceiveCursorEventMode(ProcessedCursorEvents);
+            didReceiveTouchEventMode(ProcessedTouchEvents);
+#endif
+
+            // If it's a outmost SVG document, we use FixedDesktop mode, otherwise
+            // we default to Mobile mode. For example, using FixedDesktop mode to
+            // render http://www.croczilla.com/bits_and_pieces/svg/samples/tiger/tiger.svg
+            // is user-experience friendly.
+            if (m_page->mainFrame()->document()->isSVGDocument()) {
+                setShouldUseFixedDesktopMode(true);
+                setViewMode(FixedDesktop);
+            } else
+                setViewMode(Mobile);
+
+            // Reset block zoom and reflow.
+            resetBlockZoom();
+#if ENABLE(VIEWPORT_REFLOW)
+            toggleTextReflowIfEnabledForBlockZoomOnly();
+#endif
+
+            // Set the scroll to origin here and notify the client since we'll be
+            // zooming below without any real contents yet thus the contents size
+            // we report to the client could make our current scroll position invalid.
+            setScrollPosition(IntPoint::zero());
+            notifyTransformedScrollChanged();
+
+            // Paints the visible backingstore as white. Note it is important we do
+            // this strictly after re-setting the scroll position to origin and resetting
+            // the scales otherwise the visible contents calculation is wrong and we
+            // can end up blitting artifacts instead. See: RIM Bug #401.
+            if (m_backingStore->d->renderVisibleContents() && !m_backingStore->d->isSuspended() && !m_backingStore->d->shouldDirectRenderingToWindow())
+                m_backingStore->d->blitVisibleContents();
+
+            zoomToInitialScaleOnLoad();
+
+            // Update cursor status.
+            updateCursor();
+
+#if USE(ACCELERATED_COMPOSITING)
+            // Don't render compositing contents from previous page.
+            resetCompositingSurface();
+#endif
+            break;
+        }
+    case Finished:
+    case Failed:
+        // Notify client of the initial zoom change.
+        m_client->zoomChanged(m_webPage->isMinZoomed(), m_webPage->isMaxZoomed(), !shouldZoomOnEscape(), currentScale());
+        m_backingStore->d->updateTiles(true /* updateVisible */, false /* immediate */);
+        break;
+    default:
+        break;
+    }
+}
+
+double WebPagePrivate::clampedScale(double scale) const
+{
+    if (scale < minimumScale())
+        return minimumScale();
+    if (scale > maximumScale())
+        return maximumScale();
+    return scale;
+}
+
+bool WebPagePrivate::shouldZoomAboutPoint(double scale, const FloatPoint&, bool enforceScaleClamping, double* clampedScale)
+{
+    if (!m_mainFrame->view())
+        return false;
+
+    if (enforceScaleClamping)
+        scale = this->clampedScale(scale);
+
+    ASSERT(clampedScale);
+    *clampedScale = scale;
+
+    if (currentScale() == scale) {
+        // Make sure backingstore updates resume from pinch zoom in the case where the final zoom level doesn't change.
+        m_backingStore->d->resumeScreenAndBackingStoreUpdates(BackingStore::None);
+        m_client->zoomChanged(m_webPage->isMinZoomed(), m_webPage->isMaxZoomed(), !shouldZoomOnEscape(), currentScale());
+        return false;
+    }
+
+    return true;
+}
+
+bool WebPagePrivate::zoomAboutPoint(double unclampedScale, const FloatPoint& anchor, bool enforceScaleClamping, bool forceRendering, bool isRestoringZoomLevel)
+{
+    if (!isRestoringZoomLevel) {
+        // Clear any existing block zoom.  (If we are restoring a saved zoom level on page load,
+        // there is guaranteed to be no existing block zoom and we don't want to clear m_shouldReflowBlock.)
+        resetBlockZoom();
+    }
+
+    // The reflow and block zoom stuff here needs to happen regardless of
+    // whether we shouldZoomAboutPoint.
+#if ENABLE(VIEWPORT_REFLOW)
+    toggleTextReflowIfEnabledForBlockZoomOnly(m_shouldReflowBlock);
+    if (m_page->settings()->isTextReflowEnabled() && m_mainFrame->view())
+        setNeedsLayout();
+#endif
+
+    double scale;
+    if (!shouldZoomAboutPoint(unclampedScale, anchor, enforceScaleClamping, &scale)) {
+        if (m_webPage->settings()->textReflowMode() == WebSettings::TextReflowEnabled) {
+            m_currentPinchZoomNode = 0;
+            m_anchorInNodeRectRatio = FloatPoint(-1, -1);
+        }
+        return false;
+    }
+    TransformationMatrix zoom;
+    zoom.scale(scale);
+
+#if DEBUG_WEBPAGE_LOAD
+    if (loadState() < Finished)
+        Platform::log(Platform::LogLevelInfo, "WebPagePrivate::zoomAboutPoint scale %f anchor (%f, %f)", scale, anchor.x(), anchor.y());
+#endif
+
+    // Our current scroll position in float.
+    FloatPoint scrollPosition = this->scrollPosition();
+
+    // Anchor offset from scroll position in float.
+    FloatPoint anchorOffset(anchor.x() - scrollPosition.x(), anchor.y() - scrollPosition.y());
+
+    // The horizontal scaling factor and vertical scaling factor should be equal
+    // to preserve aspect ratio of content.
+    ASSERT(m_transformationMatrix->m11() == m_transformationMatrix->m22());
+
+    // Need to invert the previous transform to anchor the viewport.
+    double inverseScale = scale / m_transformationMatrix->m11();
+
+    // Actual zoom.
+    *m_transformationMatrix = zoom;
+
+    // Suspend all screen updates to the backingstore.
+    m_backingStore->d->suspendScreenAndBackingStoreUpdates();
+
+    updateViewportSize();
+
+    IntPoint newScrollPosition(IntPoint(max(0, static_cast<int>(roundf(anchor.x() - anchorOffset.x() / inverseScale))),
+                                        max(0, static_cast<int>(roundf(anchor.y() - anchorOffset.y() / inverseScale)))));
+
+    if (m_webPage->settings()->textReflowMode() == WebSettings::TextReflowEnabled) {
+        // This is a hack for email which has reflow always turned on.
+        m_mainFrame->view()->setNeedsLayout();
+        requestLayoutIfNeeded();
+        if (m_currentPinchZoomNode)
+            newScrollPosition = calculateReflowedScrollPosition(anchorOffset, scale == minimumScale() ? 1 : inverseScale);
+         m_currentPinchZoomNode = 0;
+         m_anchorInNodeRectRatio = FloatPoint(-1, -1);
+    }
+
+    setScrollPosition(newScrollPosition);
+
+    notifyTransformChanged();
+
+    bool isLoading = this->isLoading();
+
+    // We need to invalidate all tiles both visible and non-visible if we're loading.
+    m_backingStore->d->updateTiles(isLoading /* updateVisible */, false /* immediate */);
+
+    m_client->resetBitmapZoomScale(m_transformationMatrix->m11());
+
+    bool shouldRender = !isLoading || m_userPerformedManualZoom || forceRendering;
+    bool shouldClearVisibleZoom = isLoading && shouldRender;
+
+    if (shouldClearVisibleZoom) {
+        // If we are loading and rendering then we need to clear the render queue's
+        // visible zoom jobs as they will be irrelevant with the render below.
+        m_backingStore->d->clearVisibleZoom();
+    }
+
+    // Clear window to make sure there are no artifacts.
+    if (shouldRender) {
+        m_backingStore->d->clearWindow();
+        // Resume all screen updates to the backingstore and render+blit visible contents to screen.
+        m_backingStore->d->resumeScreenAndBackingStoreUpdates(BackingStore::RenderAndBlit);
+    } else {
+        // Resume all screen updates to the backingstore but do not blit to the screen because we not rendering.
+        m_backingStore->d->resumeScreenAndBackingStoreUpdates(BackingStore::None);
+    }
+
+    m_client->zoomChanged(m_webPage->isMinZoomed(), m_webPage->isMaxZoomed(), !shouldZoomOnEscape(), currentScale());
+
+    return true;
+}
+
+IntPoint WebPagePrivate::calculateReflowedScrollPosition(const FloatPoint& anchorOffset, double inverseScale)
+{
+    // Should only be invoked when text reflow is enabled.
+    ASSERT(m_webPage->settings()->textReflowMode() == WebSettings::TextReflowEnabled);
+
+    int offsetY = 0;
+    int offsetX = 0;
+
+    IntRect nodeRect = rectForNode(m_currentPinchZoomNode.get());
+
+    if (m_currentPinchZoomNode->renderer() && m_anchorInNodeRectRatio.y() >= 0) {
+        offsetY = nodeRect.height() * m_anchorInNodeRectRatio.y();
+        if (m_currentPinchZoomNode->renderer()->isImage() && m_anchorInNodeRectRatio.x() > 0)
+            offsetX = nodeRect.width() * m_anchorInNodeRectRatio.x() - anchorOffset.x() / inverseScale;
+    }
+
+    IntRect reflowedRect = adjustRectOffsetForFrameOffset(nodeRect, m_currentPinchZoomNode.get());
+
+    return IntPoint(max(0, static_cast<int>(roundf(reflowedRect.x() + offsetX))),
+                    max(0, static_cast<int>(roundf(reflowedRect.y() + offsetY - anchorOffset.y() / inverseScale))));
+}
+
+bool WebPagePrivate::scheduleZoomAboutPoint(double unclampedScale, const FloatPoint& anchor, bool enforceScaleClamping, bool forceRendering)
+{
+    double scale;
+    if (!shouldZoomAboutPoint(unclampedScale, anchor, enforceScaleClamping, &scale)) {
+        // We could be back to the right zoom level before the timer has
+        // timed out, because of wiggling back and forth. Stop the timer.
+        unscheduleZoomAboutPoint();
+        return false;
+    }
+
+    // For some reason, the bitmap zoom wants an anchor in backingstore coordinates!
+    // this is different from zoomAboutPoint, which wants content coordinates.
+    // See RIM Bug #641.
+
+    FloatPoint transformedAnchor = mapToTransformedFloatPoint(anchor);
+    FloatPoint transformedScrollPosition = mapToTransformedFloatPoint(scrollPosition());
+
+    // Prohibit backingstore from updating the window overtop of the bitmap.
+    m_backingStore->d->suspendScreenAndBackingStoreUpdates();
+
+    // Need to invert the previous transform to anchor the viewport.
+    double zoomFraction = scale / transformationMatrix()->m11();
+
+    // Anchor offset from scroll position in float.
+    FloatPoint anchorOffset(transformedAnchor.x() - transformedScrollPosition.x(),
+                            transformedAnchor.y() - transformedScrollPosition.y());
+
+    IntPoint srcPoint(
+        static_cast<int>(roundf(transformedAnchor.x() - anchorOffset.x() / zoomFraction)),
+        static_cast<int>(roundf(transformedAnchor.y() - anchorOffset.y() / zoomFraction)));
+
+    const IntRect viewportRect = IntRect(IntPoint::zero(), transformedViewportSize());
+    const IntRect dstRect = viewportRect;
+
+    // This is the rect to pass as the actual source rect in the backingstore
+    // for the transform given by zoom.
+    IntRect srcRect(srcPoint.x(),
+                    srcPoint.y(),
+                    viewportRect.width() / zoomFraction,
+                    viewportRect.height() / zoomFraction);
+    m_backingStore->d->blitContents(dstRect, srcRect);
+
+    m_delayedZoomArguments.scale = scale;
+    m_delayedZoomArguments.anchor = anchor;
+    m_delayedZoomArguments.enforceScaleClamping = enforceScaleClamping;
+    m_delayedZoomArguments.forceRendering = forceRendering;
+    m_delayedZoomTimer->startOneShot(delayedZoomInterval);
+
+    return true;
+}
+
+void WebPagePrivate::unscheduleZoomAboutPoint()
+{
+    if (m_delayedZoomTimer->isActive())
+        m_backingStore->d->resumeScreenAndBackingStoreUpdates(BackingStore::None);
+
+    m_delayedZoomTimer->stop();
+}
+
+void WebPagePrivate::zoomAboutPointTimerFired(Timer<WebPagePrivate>*)
+{
+    zoomAboutPoint(m_delayedZoomArguments.scale, m_delayedZoomArguments.anchor, m_delayedZoomArguments.enforceScaleClamping, m_delayedZoomArguments.forceRendering);
+}
+
+void WebPagePrivate::setNeedsLayout()
+{
+    FrameView* view = m_mainFrame->view();
+    ASSERT(view);
+    view->setNeedsLayout();
+}
+
+void WebPagePrivate::requestLayoutIfNeeded() const
+{
+    FrameView* view = m_mainFrame->view();
+    ASSERT(view);
+    view->updateLayoutAndStyleIfNeededRecursive();
+    ASSERT(!view->needsLayout());
+}
+
+IntPoint WebPagePrivate::scrollPosition() const
+{
+    return m_backingStoreClient->scrollPosition();
+}
+
+IntPoint WebPagePrivate::maximumScrollPosition() const
+{
+    return m_backingStoreClient->maximumScrollPosition();
+}
+
+void WebPagePrivate::setScrollPosition(const IntPoint& pos)
+{
+    m_backingStoreClient->setScrollPosition(pos);
+}
+
+bool WebPagePrivate::shouldSendResizeEvent()
+{
+    if (!m_mainFrame->document())
+        return false;
+
+    // PR#96865 : Provide an option to always send resize events, regardless of the loading
+    //            status. The scenario for this are Sapphire applications which tend to
+    //            maintain an open GET request to the server. This open GET results in
+    //            webkit thinking that content is still arriving when at the application
+    //            level it is considered fully loaded.
+    //
+    //            NOTE: Care must be exercised in the use of this option, as it bypasses
+    //                  the sanity provided in 'isLoadingInAPISense()' below.
+    //
+    static const bool unrestrictedResizeEvents = Platform::Settings::get()->unrestrictedResizeEvents();
+    if (unrestrictedResizeEvents)
+        return true;
+
+    // Don't send the resize event if the document is loading. Some pages automatically reload
+    // when the window is resized; Safari on iPhone often resizes the window while setting up its
+    // viewport. This obviously can cause problems.
+    DocumentLoader* documentLoader = m_mainFrame->loader()->documentLoader();
+    if (documentLoader && documentLoader->isLoadingInAPISense())
+        return false;
+
+    return true;
+}
+
+void WebPagePrivate::willDeferLoading()
+{
+    m_client->willDeferLoading();
+}
+
+void WebPagePrivate::didResumeLoading()
+{
+    m_client->didResumeLoading();
+}
+
+bool WebPage::scrollBy(const Platform::IntSize& delta, bool scrollMainFrame)
+{
+    d->m_backingStoreClient->setIsClientGeneratedScroll(true);
+    bool b = d->scrollBy(delta.width(), delta.height(), scrollMainFrame);
+    d->m_backingStoreClient->setIsClientGeneratedScroll(false);
+    return b;
+}
+
+bool WebPagePrivate::scrollBy(int deltaX, int deltaY, bool scrollMainFrame)
+{
+    IntSize delta(deltaX, deltaY);
+    if (!scrollMainFrame) {
+        // We need to work around the fact that ::map{To,From}Transformed do not
+        // work well with negative values, like a negative width or height of an IntSize.
+        IntSize copiedDelta(IntSize(abs(delta.width()), abs(delta.height())));
+        IntSize untransformedCopiedDelta = mapFromTransformed(copiedDelta);
+        delta = IntSize(
+            delta.width() < 0 ? -untransformedCopiedDelta.width() : untransformedCopiedDelta.width(),
+            delta.height() < 0 ? -untransformedCopiedDelta.height(): untransformedCopiedDelta.height());
+
+        if (m_inRegionScrollStartingNode) {
+            if (scrollNodeRecursively(m_inRegionScrollStartingNode.get(), delta)) {
+                m_selectionHandler->selectionPositionChanged();
+                // FIXME: We have code in place to handle scrolling and clipping tap highlight
+                // on in-region scrolling. As soon as it is fast enough (i.e. we have it backed by
+                // a backing store), we can reliably make use of it in the real world.
+                // m_touchEventHandler->drawTapHighlight();
+                return true;
+            }
+        }
+
+        return false;
+    }
+
+    setScrollPosition(scrollPosition() + delta);
+    return true;
+}
+
+void WebPage::notifyInRegionScrollStatusChanged(bool status)
+{
+    d->notifyInRegionScrollStatusChanged(status);
+}
+
+void WebPagePrivate::notifyInRegionScrollStatusChanged(bool status)
+{
+    if (!status && m_inRegionScrollStartingNode) {
+        enqueueRenderingOfClippedContentOfScrollableNodeAfterInRegionScrolling(m_inRegionScrollStartingNode.get());
+        m_inRegionScrollStartingNode = 0;
+    }
+}
+
+void WebPagePrivate::enqueueRenderingOfClippedContentOfScrollableNodeAfterInRegionScrolling(Node* scrolledNode)
+{
+    ASSERT(scrolledNode);
+    if (scrolledNode->isDocumentNode()) {
+        Frame* frame = static_cast<const Document*>(scrolledNode)->frame();
+        ASSERT(frame);
+        if (!frame)
+            return;
+        ASSERT(frame != m_mainFrame);
+        FrameView* view = frame->view();
+        if (!view)
+            return;
+
+        // Steps:
+        // #1 - Get frame rect in contents coords.
+        // #2 - Get the clipped scrollview rect in contents coords.
+        // #3 - Take transform into account for 1 and 2.
+        // #4 - Subtract 2 from 1, so we know exactly which areas of the frame
+        //      are offscreen, and need async repainting.
+        FrameView* mainFrameView = m_mainFrame->view();
+        ASSERT(mainFrameView);
+        IntRect frameRect = view->frameRect();
+        frameRect = frame->tree()->parent()->view()->contentsToWindow(frameRect);
+        frameRect = mainFrameView->windowToContents(frameRect);
+
+        IntRect visibleWindowRect = getRecursiveVisibleWindowRect(view);
+        IntRect visibleContentsRect = mainFrameView->windowToContents(visibleWindowRect);
+
+        IntRect transformedFrameRect = mapToTransformed(frameRect);
+        IntRect transformedVisibleContentsRect = mapToTransformed(visibleContentsRect);
+
+        Platform::IntRectRegion offscreenRegionOfIframe
+            = Platform::IntRectRegion::subtractRegions(Platform::IntRect(transformedFrameRect), Platform::IntRect(transformedVisibleContentsRect));
+
+        if (!offscreenRegionOfIframe.isEmpty())
+            m_backingStore->d->m_renderQueue->addToQueue(RenderQueue::RegularRender, offscreenRegionOfIframe.rects());
+    }
+}
+
+void WebPagePrivate::setHasInRegionScrollableAreas(bool b)
+{
+    if (b != m_hasInRegionScrollableAreas)
+        m_hasInRegionScrollableAreas = b;
+}
+
+IntSize WebPagePrivate::viewportSize() const
+{
+    return mapFromTransformed(transformedViewportSize());
+}
+
+IntSize WebPagePrivate::actualVisibleSize() const
+{
+    return mapFromTransformed(transformedActualVisibleSize());
+}
+
+bool WebPagePrivate::hasVirtualViewport() const
+{
+    return m_virtualViewportWidth && m_virtualViewportHeight;
+}
+
+void WebPagePrivate::updateViewportSize(bool setFixedReportedSize, bool sendResizeEvent)
+{
+    ASSERT(m_mainFrame->view());
+    if (setFixedReportedSize)
+        m_mainFrame->view()->setFixedReportedSize(actualVisibleSize());
+
+    IntRect frameRect = IntRect(scrollPosition(), viewportSize());
+    if (frameRect != m_mainFrame->view()->frameRect()) {
+        m_mainFrame->view()->setFrameRect(frameRect);
+        m_mainFrame->view()->adjustViewSize();
+    }
+
+    // We're going to need to send a resize event to JavaScript because
+    // innerWidth and innerHeight depend on fixed reported size.
+    // This is how we support mobile pages where JavaScript resizes
+    // the page in order to get around the fixed layout size, e.g.
+    // google maps when it detects a mobile user agent.
+    if (sendResizeEvent && shouldSendResizeEvent())
+        m_mainFrame->eventHandler()->sendResizeEvent();
+
+    // When the actual visible size changes, we also
+    // need to reposition fixed elements.
+    m_mainFrame->view()->repaintFixedElementsAfterScrolling();
+}
+
+FloatPoint WebPagePrivate::centerOfVisibleContentsRect() const
+{
+    // The visible contents rect in float.
+    FloatRect visibleContentsRect = this->visibleContentsRect();
+
+    // The center of the visible contents rect in float.
+    return FloatPoint(visibleContentsRect.x() + visibleContentsRect.width() / 2.0,
+                      visibleContentsRect.y() + visibleContentsRect.height() / 2.0);
+}
+
+IntRect WebPagePrivate::visibleContentsRect() const
+{
+    return m_backingStoreClient->visibleContentsRect();
+}
+
+IntSize WebPagePrivate::contentsSize() const
+{
+    if (!m_mainFrame->view())
+        return IntSize();
+
+    return m_backingStoreClient->contentsSize();
+}
+
+IntSize WebPagePrivate::absoluteVisibleOverflowSize() const
+{
+    if (!m_mainFrame->contentRenderer())
+        return IntSize();
+
+    return IntSize(m_mainFrame->contentRenderer()->rightAbsoluteVisibleOverflow(), m_mainFrame->contentRenderer()->bottomAbsoluteVisibleOverflow());
+}
+
+void WebPagePrivate::contentsSizeChanged(const IntSize& contentsSize)
+{
+    if (m_previousContentsSize == contentsSize)
+        return;
+
+    // This should only occur in the middle of layout so we set a flag here and
+    // handle it at the end of the layout.
+    m_contentsSizeChanged = true;
+
+#if DEBUG_WEBPAGE_LOAD
+    Platform::log(Platform::LogLevelInfo, "WebPagePrivate::contentsSizeChanged %dx%d", contentsSize.width(), contentsSize.height());
+#endif
+}
+
+void WebPagePrivate::layoutFinished()
+{
+    if (!m_contentsSizeChanged && !m_overflowExceedsContentsSize)
+        return;
+
+    m_contentsSizeChanged = false; // Toggle to turn off notification again.
+    m_overflowExceedsContentsSize = false;
+
+    if (contentsSize().isEmpty())
+        return;
+
+    // The call to zoomToInitialScaleOnLoad can cause recursive layout when called from
+    // the middle of a layout, but the recursion is limited by detection code in
+    // setViewMode() and mitigation code in fixedLayoutSize().
+    if (didLayoutExceedMaximumIterations()) {
+        notifyTransformedContentsSizeChanged();
+        return;
+    }
+
+    // Temporarily save the m_previousContentsSize here before updating it (in
+    // notifyTransformedContentsSizeChanged()) so we can compare if our contents
+    // shrunk afterwards.
+    IntSize previousContentsSize = m_previousContentsSize;
+
+    m_nestedLayoutFinishedCount++;
+
+    if (loadState() == Committed)
+        zoomToInitialScaleOnLoad();
+    else if (loadState() != None)
+        notifyTransformedContentsSizeChanged();
+
+    m_nestedLayoutFinishedCount--;
+
+    if (!m_nestedLayoutFinishedCount) {
+        // When the contents shrinks, there is a risk that we
+        // will be left at a scroll position that lies outside of the
+        // contents rect. Since we allow overscrolling and neglect
+        // to clamp overscroll in order to retain input focus (RIM Bug #414)
+        // we need to clamp somewhere, and this is where we know the
+        // contents size has changed.
+
+        if (contentsSize() != previousContentsSize) {
+
+            IntPoint newScrollPosition = scrollPosition();
+
+            if (contentsSize().height() < previousContentsSize.height()) {
+                IntPoint scrollPositionWithHeightShrunk = IntPoint(newScrollPosition.x(), maximumScrollPosition().y());
+                newScrollPosition = newScrollPosition.shrunkTo(scrollPositionWithHeightShrunk);
+            }
+
+            if (contentsSize().width() < previousContentsSize.width()) {
+                IntPoint scrollPositionWithWidthShrunk = IntPoint(maximumScrollPosition().x(), newScrollPosition.y());
+                newScrollPosition = newScrollPosition.shrunkTo(scrollPositionWithWidthShrunk);
+            }
+
+            if (newScrollPosition != scrollPosition()) {
+                setScrollPosition(newScrollPosition);
+                notifyTransformedScrollChanged();
+            }
+        }
+    }
+}
+
+void WebPagePrivate::zoomToInitialScaleOnLoad()
+{
+#if DEBUG_WEBPAGE_LOAD
+    Platform::log(Platform::LogLevelInfo, "WebPagePrivate::zoomToInitialScaleOnLoad");
+#endif
+
+    bool needsLayout = false;
+
+    // If the contents width exceeds the viewport width set to desktop mode.
+    if (m_shouldUseFixedDesktopMode)
+        needsLayout = setViewMode(FixedDesktop);
+    else
+        needsLayout = setViewMode(Desktop);
+
+    if (needsLayout) {
+        // This can cause recursive layout...
+        setNeedsLayout();
+    }
+
+    if (contentsSize().isEmpty()) {
+#if DEBUG_WEBPAGE_LOAD
+        Platform::log(Platform::LogLevelInfo, "WebPagePrivate::zoomToInitialScaleOnLoad content is empty!");
+#endif
+        requestLayoutIfNeeded();
+        m_client->resetBitmapZoomScale(currentScale());
+        notifyTransformedContentsSizeChanged();
+        return;
+    }
+
+    bool performedZoom = false;
+    bool shouldZoom = !m_userPerformedManualZoom;
+
+    // If this load should restore view state, don't zoom to initial scale
+    // but instead let the HistoryItem's saved viewport reign supreme.
+    if (m_mainFrame && m_mainFrame->loader() && m_mainFrame->loader()->shouldRestoreScrollPositionAndViewState())
+        shouldZoom = false;
+
+    if (shouldZoom && loadState() == Committed) {
+        // Preserve at top and at left position, to avoid scrolling
+        // to a non top-left position for web page with viewport meta tag
+        // that specifies an initial-scale that is zoomed in.
+        FloatPoint anchor = centerOfVisibleContentsRect();
+        if (!scrollPosition().x())
+            anchor.setX(0);
+        if (!scrollPosition().y())
+            anchor.setY(0);
+        performedZoom = zoomAboutPoint(initialScale(), anchor);
+    }
+
+    // zoomAboutPoint above can also toggle setNeedsLayout and cause recursive layout...
+    requestLayoutIfNeeded();
+
+    if (!performedZoom) {
+        // We only notify if we didn't perform zoom, because zoom will notify on
+        // its own...
+        m_client->resetBitmapZoomScale(currentScale());
+        notifyTransformedContentsSizeChanged();
+    }
+}
+
+double WebPagePrivate::zoomToFitScale() const
+{
+    // We must clamp the contents for this calculation so that we do not allow an
+    // arbitrarily small zoomToFitScale much like we clamp the fixedLayoutSize()
+    // so that we do not have arbitrarily large layout size.
+    // If we have a specified viewport, we may need to be able to zoom out more.
+    int contentWidth = std::min(contentsSize().width(), std::max(m_virtualViewportWidth, static_cast<int>(defaultMaxLayoutSize().width())));
+
+    // defaultMaxLayoutSize().width() is a safeguard for excessively large page layouts that
+    // is too restrictive for image documents. In this case, the document width is sufficient.
+    Document* doc = m_page->mainFrame()->document();
+    if (doc && doc->isImageDocument())
+       contentWidth = contentsSize().width();
+
+    // If we have a virtual viewport and its aspect ratio caused content to layout
+    // wider than the default layout aspect ratio we need to zoom to fit the content height
+    // in order to avoid showing a grey area below the web page.
+    // Without virtual viewport we can never get into this situation.
+    if (hasVirtualViewport()) {
+        int contentHeight = std::min(contentsSize().height(), std::max(m_virtualViewportHeight, static_cast<int>(defaultMaxLayoutSize().height())));
+
+        // Aspect ratio check without division.
+        if (contentWidth * m_defaultLayoutSize.height() > contentHeight * m_defaultLayoutSize.width())
+            return contentHeight > 0 ? static_cast<double>(m_defaultLayoutSize.height()) / contentHeight : 1.0;
+    }
+
+    return contentWidth > 0.0 ? static_cast<double>(m_actualVisibleWidth) / contentWidth : 1.0;
+}
+
+double WebPagePrivate::initialScale() const
+{
+    if (m_initialScale > 0.0)
+        return m_initialScale;
+
+    if (m_webSettings->isZoomToFitOnLoad())
+        return zoomToFitScale();
+
+    return 1.0;
+}
+
+void WebPage::initializeIconDataBase()
+{
+    IconDatabaseClientBlackBerry::getInstance()->initIconDatabase(d->m_webSettings);
+}
+
+bool WebPage::isUserScalable() const
+{
+    return d->isUserScalable();
+}
+
+double WebPage::currentScale() const
+{
+    return d->currentScale();
+}
+
+double WebPage::initialScale() const
+{
+    return d->initialScale();
+}
+
+double WebPage::zoomToFitScale() const
+{
+    return d->zoomToFitScale();
+}
+
+void WebPage::setInitialScale(double initialScale)
+{
+    d->setInitialScale(initialScale);
+}
+
+double WebPage::minimumScale() const
+{
+    return d->minimumScale();
+}
+
+void WebPage::setMinimumScale(double minimumScale)
+{
+    d->setMinimumScale(minimumScale);
+}
+
+double WebPage::maximumScale() const
+{
+    return d->maximumScale();
+}
+
+void WebPage::setMaximumScale(double maximumScale)
+{
+    d->setMaximumScale(maximumScale);
+}
+
+double WebPagePrivate::maximumScale() const
+{
+    if (m_maximumScale >= zoomToFitScale() && m_maximumScale >= m_minimumScale)
+        return m_maximumScale;
+
+    return hasVirtualViewport() ? std::max<double>(zoomToFitScale(), 4.0) : 4.0;
+}
+
+void WebPagePrivate::resetScales()
+{
+    TransformationMatrix identity;
+    *m_transformationMatrix = identity;
+    m_initialScale = m_webSettings->initialScale() > 0 ? m_webSettings->initialScale() : -1.0;
+    m_minimumScale = -1.0;
+    m_maximumScale = -1.0;
+
+    // We have to let WebCore know about updated framerect now that we've
+    // reset our scales. See: RIM Bug #401.
+    updateViewportSize();
+}
+
+IntPoint WebPagePrivate::transformedScrollPosition() const
+{
+    return m_backingStoreClient->transformedScrollPosition();
+}
+
+IntPoint WebPagePrivate::transformedMaximumScrollPosition() const
+{
+    return m_backingStoreClient->transformedMaximumScrollPosition();
+}
+
+IntSize WebPagePrivate::transformedActualVisibleSize() const
+{
+    return IntSize(m_actualVisibleWidth, m_actualVisibleHeight);
+}
+
+IntSize WebPagePrivate::transformedViewportSize() const
+{
+    return Platform::Graphics::Screen::size();
+}
+
+IntRect WebPagePrivate::transformedVisibleContentsRect() const
+{
+    // Usually this would be mapToTransformed(visibleContentsRect()), but
+    // that results in rounding errors because we already set the WebCore
+    // viewport size from our original transformedViewportSize().
+    // Instead, we only transform the scroll position and take the
+    // viewport size as it is, which ensures that e.g. blitting operations
+    // always cover the whole widget/screen.
+    return IntRect(transformedScrollPosition(), transformedViewportSize());
+}
+
+IntSize WebPagePrivate::transformedContentsSize() const
+{
+    // mapToTransformed() functions use this method to crop their results,
+    // so we can't make use of them here. While we want rounding inside page
+    // boundaries to extend rectangles and round points, we need to crop the
+    // contents size to the floored values so that we don't try to display
+    // or report points that are not fully covered by the actual float-point
+    // contents rectangle.
+    const IntSize untransformedContentsSize = contentsSize();
+    const FloatPoint transformedBottomRight = m_transformationMatrix->mapPoint(
+        FloatPoint(untransformedContentsSize.width(), untransformedContentsSize.height()));
+    return IntSize(floorf(transformedBottomRight.x()), floorf(transformedBottomRight.y()));
+}
+
+IntPoint WebPagePrivate::mapFromContentsToViewport(const IntPoint& point) const
+{
+    return m_backingStoreClient->mapFromContentsToViewport(point);
+}
+
+IntPoint WebPagePrivate::mapFromViewportToContents(const IntPoint& point) const
+{
+    return m_backingStoreClient->mapFromViewportToContents(point);
+}
+
+IntRect WebPagePrivate::mapFromContentsToViewport(const IntRect& rect) const
+{
+    return m_backingStoreClient->mapFromContentsToViewport(rect);
+}
+
+IntRect WebPagePrivate::mapFromViewportToContents(const IntRect& rect) const
+{
+    return m_backingStoreClient->mapFromViewportToContents(rect);
+}
+
+IntPoint WebPagePrivate::mapFromTransformedContentsToTransformedViewport(const IntPoint& point) const
+{
+    return m_backingStoreClient->mapFromTransformedContentsToTransformedViewport(point);
+}
+
+IntPoint WebPagePrivate::mapFromTransformedViewportToTransformedContents(const IntPoint& point) const
+{
+    return m_backingStoreClient->mapFromTransformedViewportToTransformedContents(point);
+}
+
+IntRect WebPagePrivate::mapFromTransformedContentsToTransformedViewport(const IntRect& rect) const
+{
+    return m_backingStoreClient->mapFromTransformedContentsToTransformedViewport(rect);
+}
+
+IntRect WebPagePrivate::mapFromTransformedViewportToTransformedContents(const IntRect& rect) const
+{
+    return m_backingStoreClient->mapFromTransformedViewportToTransformedContents(rect);
+}
+
+// NOTE: PIXEL ROUNDING!
+// Accurate back-and-forth rounding is not possible with information loss
+// by integer points and sizes, so we always expand the resulting mapped
+// float rectangles to the nearest integer. For points, we always use
+// floor-rounding in mapToTransformed() so that we don't have to crop to
+// the (floor'd) transformed contents size.
+static inline IntPoint roundTransformedPoint(const FloatPoint &point)
+{
+    // Maps by rounding half towards zero.
+    return IntPoint(static_cast<int>(floorf(point.x())), static_cast<int>(floorf(point.y())));
+}
+
+static inline IntPoint roundUntransformedPoint(const FloatPoint &point)
+{
+    // Maps by rounding half away from zero.
+    return IntPoint(static_cast<int>(ceilf(point.x())), static_cast<int>(ceilf(point.y())));
+}
+
+IntPoint WebPagePrivate::mapToTransformed(const IntPoint& point) const
+{
+    return roundTransformedPoint(m_transformationMatrix->mapPoint(FloatPoint(point)));
+}
+
+FloatPoint WebPagePrivate::mapToTransformedFloatPoint(const FloatPoint& point) const
+{
+    return m_transformationMatrix->mapPoint(point);
+}
+
+IntPoint WebPagePrivate::mapFromTransformed(const IntPoint& point) const
+{
+    return roundUntransformedPoint(m_transformationMatrix->inverse().mapPoint(FloatPoint(point)));
+}
+
+FloatPoint WebPagePrivate::mapFromTransformedFloatPoint(const FloatPoint& point) const
+{
+    return m_transformationMatrix->inverse().mapPoint(point);
+}
+
+FloatRect WebPagePrivate::mapFromTransformedFloatRect(const FloatRect& rect) const
+{
+    return m_transformationMatrix->inverse().mapRect(rect);
+}
+
+IntSize WebPagePrivate::mapToTransformed(const IntSize& size) const
+{
+    return mapToTransformed(IntRect(IntPoint::zero(), size)).size();
+}
+
+IntSize WebPagePrivate::mapFromTransformed(const IntSize& size) const
+{
+    return mapFromTransformed(IntRect(IntPoint::zero(), size)).size();
+}
+
+IntRect WebPagePrivate::mapToTransformed(const IntRect& rect) const
+{
+    return enclosingIntRect(m_transformationMatrix->mapRect(FloatRect(rect)));
+}
+
+// Use this in conjunction with mapToTransformed(IntRect), in most cases.
+void WebPagePrivate::clipToTransformedContentsRect(IntRect& rect) const
+{
+    rect.intersect(IntRect(IntPoint::zero(), transformedContentsSize()));
+}
+
+IntRect WebPagePrivate::mapFromTransformed(const IntRect& rect) const
+{
+    return enclosingIntRect(m_transformationMatrix->inverse().mapRect(FloatRect(rect)));
+}
+
+bool WebPagePrivate::transformedPointEqualsUntransformedPoint(const IntPoint& transformedPoint, const IntPoint& untransformedPoint)
+{
+    // Scaling down is always more accurate than scaling up.
+    if (m_transformationMatrix->a() > 1.0)
+        return transformedPoint == mapToTransformed(untransformedPoint);
+
+    return mapFromTransformed(transformedPoint) == untransformedPoint;
+}
+
+void WebPagePrivate::notifyTransformChanged()
+{
+    notifyTransformedContentsSizeChanged();
+    notifyTransformedScrollChanged();
+
+    m_backingStore->d->transformChanged();
+}
+
+void WebPagePrivate::notifyTransformedContentsSizeChanged()
+{
+    // We mark here as the last reported content size we sent to the client.
+    m_previousContentsSize = contentsSize();
+
+    const IntSize size = transformedContentsSize();
+    m_backingStore->d->contentsSizeChanged(size);
+    m_client->contentsSizeChanged(size);
+    m_selectionHandler->selectionPositionChanged();
+}
+
+void WebPagePrivate::notifyTransformedScrollChanged()
+{
+    const IntPoint pos = transformedScrollPosition();
+    m_backingStore->d->scrollChanged(pos);
+    m_client->scrollChanged(pos);
+}
+
+bool WebPagePrivate::setViewMode(ViewMode mode)
+{
+    if (!m_mainFrame->view())
+        return false;
+
+    m_viewMode = mode;
+
+    // If we're in the middle of a nested layout with a recursion count above
+    // some maximum threshold, then our algorithm for finding the minimum content
+    // width of a given page has become dependent on the visible width.
+    //
+    // We need to find some method to ensure that we don't experience excessive
+    // and even infinite recursion. This can even happen with valid html. The
+    // former can happen when we run into inline text with few candidates for line
+    // break. The latter can happen for instance if the page has a negative margin
+    // set against the right border. Note: this is valid by spec and can lead to
+    // a situation where there is no value for which the content width will ensure
+    // no horizontal scrollbar.
+    // Example: LayoutTests/css1/box_properties/margin.html
+    //
+    // In order to address such situations when we detect a recursion above some
+    // maximum threshold we snap our fixed layout size to a defined quantum increment.
+    // Eventually, either the content width will be satisfied to ensure no horizontal
+    // scrollbar or this increment will run into the maximum layout size and the
+    // recursion will necessarily end.
+    bool snapToIncrement = didLayoutExceedMaximumIterations();
+
+    IntSize currentSize = m_mainFrame->view()->fixedLayoutSize();
+    IntSize newSize = fixedLayoutSize(snapToIncrement);
+    if (currentSize == newSize)
+        return false;
+
+    // FIXME: Temp solution. We'll get back to this.
+    if (m_nestedLayoutFinishedCount) {
+        double widthChange = fabs(double(newSize.width() - currentSize.width()) / currentSize.width());
+        double heightChange = fabs(double(newSize.height() - currentSize.height()) / currentSize.height());
+        if (widthChange < 0.05 && heightChange < 0.05)
+            return false;
+    }
+
+    m_mainFrame->view()->setUseFixedLayout(useFixedLayout());
+    m_mainFrame->view()->setFixedLayoutSize(newSize);
+    return true; // Needs re-layout!
+}
+
+void WebPagePrivate::setCursor(PlatformCursorHandle handle)
+{
+    if (m_currentCursor.type() != handle.type()) {
+        m_currentCursor = handle;
+        m_client->cursorChanged(handle.type(), handle.url().c_str(), handle.hotspot().x(), handle.hotspot().y());
+    }
+}
+
+Platform::NetworkStreamFactory* WebPagePrivate::networkStreamFactory()
+{
+    return m_client->networkStreamFactory();
+}
+
+Platform::Graphics::Window* WebPagePrivate::platformWindow() const
+{
+    return m_client->window();
+}
+
+void WebPagePrivate::setPreventsScreenDimming(bool keepAwake)
+{
+    if (keepAwake) {
+        if (!m_preventIdleDimmingCount)
+            m_client->setPreventsScreenIdleDimming(true);
+        m_preventIdleDimmingCount++;
+    } else if (m_preventIdleDimmingCount > 0) {
+        m_preventIdleDimmingCount--;
+        if (!m_preventIdleDimmingCount)
+            m_client->setPreventsScreenIdleDimming(false);
+    } else
+        ASSERT_NOT_REACHED(); // SetPreventsScreenIdleDimming(false) called too many times.
+}
+
+void WebPagePrivate::showVirtualKeyboard(bool showKeyboard)
+{
+    m_client->showVirtualKeyboard(showKeyboard);
+}
+
+void WebPagePrivate::ensureContentVisible(bool centerInView)
+{
+    m_inputHandler->ensureFocusElementVisible(centerInView);
+}
+
+void WebPagePrivate::zoomToContentRect(const IntRect& rect)
+{
+    // Don't scale if the user is not supposed to scale.
+    if (!isUserScalable())
+        return;
+
+    FloatPoint anchor = FloatPoint(rect.width() / 2.0 + rect.x(), rect.height() / 2.0 + rect.y());
+    IntSize viewSize = viewportSize();
+
+    // Calculate the scale required to scale that dimension to fit.
+    double scaleH = (double)viewSize.width() / (double)rect.width();
+    double scaleV = (double)viewSize.height() / (double)rect.height();
+
+    // Choose the smaller scale factor so that all of the content is visible.
+    zoomAboutPoint(min(scaleH, scaleV), anchor);
+}
+
+void WebPagePrivate::registerPlugin(PluginView* plugin, bool shouldRegister)
+{
+    if (shouldRegister)
+        m_pluginViews.add(plugin);
+    else
+        m_pluginViews.remove(plugin);
+}
+
+#define FOR_EACH_PLUGINVIEW(pluginViews) \
+    HashSet<PluginView*>::const_iterator it = pluginViews.begin(); \
+    HashSet<PluginView*>::const_iterator last = pluginViews.end(); \
+    for (; it != last; ++it)
+
+void WebPagePrivate::notifyPageOnLoad()
+{
+    FOR_EACH_PLUGINVIEW(m_pluginViews)
+        (*it)->handleOnLoadEvent();
+}
+
+bool WebPagePrivate::shouldPluginEnterFullScreen(PluginView* plugin, const char* windowUniquePrefix)
+{
+    return m_client->shouldPluginEnterFullScreen();
+}
+
+void WebPagePrivate::didPluginEnterFullScreen(PluginView* plugin, const char* windowUniquePrefix)
+{
+    m_fullScreenPluginView = plugin;
+    m_client->didPluginEnterFullScreen();
+    Platform::Graphics::Window::setTransparencyDiscardFilter(windowUniquePrefix);
+    m_client->window()->setSensitivityFullscreenOverride(true);
+}
+
+void WebPagePrivate::didPluginExitFullScreen(PluginView* plugin, const char* windowUniquePrefix)
+{
+    m_fullScreenPluginView = 0;
+    m_client->didPluginExitFullScreen();
+    Platform::Graphics::Window::setTransparencyDiscardFilter(0);
+    m_client->window()->setSensitivityFullscreenOverride(false);
+}
+
+void WebPagePrivate::onPluginStartBackgroundPlay(PluginView* plugin, const char* windowUniquePrefix)
+{
+    m_client->onPluginStartBackgroundPlay();
+}
+
+void WebPagePrivate::onPluginStopBackgroundPlay(PluginView* plugin, const char* windowUniquePrefix)
+{
+    m_client->onPluginStopBackgroundPlay();
+}
+
+bool WebPagePrivate::lockOrientation(bool landscape)
+{
+    return m_client->lockOrientation(landscape);
+}
+
+void WebPagePrivate::unlockOrientation()
+{
+    return m_client->unlockOrientation();
+}
+
+int WebPagePrivate::orientation() const
+{
+#if ENABLE(ORIENTATION_EVENTS)
+    return m_mainFrame->orientation();
+#else
+#error ORIENTATION_EVENTS must be defined.
+// Or a copy of the orientation value will have to be stored in these objects.
+#endif
+}
+
+double WebPagePrivate::currentZoomFactor() const
+{
+    return currentScale();
+}
+
+int WebPagePrivate::showAlertDialog(WebPageClient::AlertType atype)
+{
+    return m_client->showAlertDialog(atype);
+}
+
+bool WebPagePrivate::isActive() const
+{
+    return m_client->isActive();
+}
+
+bool WebPagePrivate::useFixedLayout() const
+{
+    return true;
+}
+
+ActiveNodeContext WebPagePrivate::activeNodeContext(TargetDetectionStrategy strategy)
+{
+    ActiveNodeContext context;
+
+    RefPtr<Node> node = contextNode(strategy);
+    m_currentContextNode = node;
+    if (!m_currentContextNode)
+        return context;
+
+    requestLayoutIfNeeded();
+
+    bool nodeAllowSelectionOverride = false;
+    if (Node* linkNode = node->enclosingLinkEventParentOrSelf()) {
+        KURL href;
+        if (linkNode->isLink() && linkNode->hasAttributes()) {
+            if (Attribute* attribute = linkNode->attributes()->getAttributeItem(HTMLNames::hrefAttr))
+                href = linkNode->document()->completeURL(stripLeadingAndTrailingHTMLSpaces(attribute->value()));
+        }
+
+        String pattern = findPatternStringForUrl(href);
+        if (!pattern.isEmpty())
+            context.setPattern(pattern);
+
+        if (!href.string().isEmpty()) {
+            context.setUrl(href.string());
+
+            // Links are non-selectable by default, but selection should be allowed
+            // providing the page is selectable, use the parent to determine it.
+            if (linkNode->parentNode() && linkNode->parentNode()->canStartSelection())
+                nodeAllowSelectionOverride = true;
+        }
+    }
+
+    if (!nodeAllowSelectionOverride && !node->canStartSelection())
+        context.resetFlag(ActiveNodeContext::IsSelectable);
+
+    if (node->isHTMLElement()) {
+        HTMLImageElement* imageElement = 0;
+        if (node->hasTagName(HTMLNames::imgTag))
+            imageElement = static_cast<HTMLImageElement*>(node.get());
+        else if (node->hasTagName(HTMLNames::areaTag))
+            imageElement = static_cast<HTMLAreaElement*>(node.get())->imageElement();
+        if (imageElement && imageElement->renderer()) {
+            // FIXME: At the mean time, we only show "Save Image" when the image data is available.
+            if (CachedResource* cachedResource = imageElement->cachedImage()) {
+                if (cachedResource->isLoaded() && cachedResource->data()) {
+                    String url = stripLeadingAndTrailingHTMLSpaces(imageElement->getAttribute(HTMLNames::srcAttr).string());
+                    context.setImageSrc(node->document()->completeURL(url).string());
+                }
+            }
+            String alt = imageElement->altText();
+            if (!alt.isNull())
+                context.setImageAlt(alt);
+        }
+    }
+
+    if (node->isTextNode()) {
+        Text* curText = static_cast<Text*>(node.get());
+        if (!curText->wholeText().isEmpty())
+            context.setText(curText->wholeText());
+    }
+
+    if (node->isElementNode()) {
+        Element* element = static_cast<Element*>(node->shadowAncestorNode());
+        if (DOMSupport::isTextBasedContentEditableElement(element)) {
+            context.setFlag(ActiveNodeContext::IsInput);
+            if (element->hasTagName(HTMLNames::inputTag))
+                context.setFlag(ActiveNodeContext::IsSingleLine);
+            if (DOMSupport::isPasswordElement(element))
+                context.setFlag(ActiveNodeContext::IsPassword);
+
+            String elementText(DOMSupport::inputElementText(element));
+            if (!elementText.stripWhiteSpace().isEmpty())
+                context.setText(elementText);
+        }
+    }
+
+    if (node->isFocusable())
+        context.setFlag(ActiveNodeContext::IsFocusable);
+
+    return context;
+}
+
+void WebPagePrivate::updateCursor()
+{
+    int buttonMask = 0;
+    if (m_lastMouseEvent.button() == LeftButton)
+        buttonMask = Platform::MouseEvent::ScreenLeftMouseButton;
+    else if (m_lastMouseEvent.button() == MiddleButton)
+        buttonMask = Platform::MouseEvent::ScreenMiddleMouseButton;
+    else if (m_lastMouseEvent.button() == RightButton)
+        buttonMask = Platform::MouseEvent::ScreenRightMouseButton;
+
+    Platform::MouseEvent event(buttonMask, buttonMask, mapToTransformed(m_lastMouseEvent.pos()), mapToTransformed(m_lastMouseEvent.globalPos()), 0, 0);
+    m_webPage->mouseEvent(event);
+}
+
+IntSize WebPagePrivate::fixedLayoutSize(bool snapToIncrement) const
+{
+    if (hasVirtualViewport())
+        return IntSize(m_virtualViewportWidth, m_virtualViewportHeight);
+
+    const int defaultLayoutWidth = m_defaultLayoutSize.width();
+    const int defaultLayoutHeight = m_defaultLayoutSize.height();
+
+    int minWidth = defaultLayoutWidth;
+    int maxWidth = defaultMaxLayoutSize().width();
+    int maxHeight = defaultMaxLayoutSize().height();
+
+    // If the load state is none then we haven't actually got anything yet, but we need to layout
+    // the entire page so that the user sees the entire page (unrendered) instead of just part of it.
+    if (m_loadState == None)
+        return IntSize(defaultLayoutWidth, defaultLayoutHeight);
+
+    if (m_viewMode == FixedDesktop) {
+        int width  = maxWidth;
+        // if the defaultLayoutHeight is at minimum, it probably was set as 0
+        // and clamped, meaning it's effectively not set.  (Even if it happened
+        // to be set exactly to the minimum, it's too small to be useful.)  So
+        // ignore it.
+        int height;
+        if (defaultLayoutHeight <= minimumLayoutSize.height())
+            height = maxHeight;
+        else
+            height = ceilf(static_cast<float>(width) / static_cast<float>(defaultLayoutWidth) * static_cast<float>(defaultLayoutHeight));
+        return IntSize(width, height);
+    }
+
+    if (m_viewMode == Desktop) {
+        // If we detect an overflow larger than the contents size then use that instead since
+        // it'll still be clamped by the maxWidth below...
+        int width = std::max(absoluteVisibleOverflowSize().width(), contentsSize().width());
+
+        if (snapToIncrement) {
+            // Snap to increments of defaultLayoutWidth / 2.0.
+            float factor = static_cast<float>(width) / (defaultLayoutWidth / 2.0);
+            factor = ceilf(factor);
+            width = (defaultLayoutWidth / 2.0) * factor;
+        }
+
+        if (width < minWidth)
+            width = minWidth;
+        if (width > maxWidth)
+            width = maxWidth;
+        int height = ceilf(static_cast<float>(width) / static_cast<float>(defaultLayoutWidth) * static_cast<float>(defaultLayoutHeight));
+        return IntSize(width, height);
+    }
+
+    if (m_webSettings->isZoomToFitOnLoad()) {
+        // We need to clamp the layout width to the minimum of the layout
+        // width or the content width. This is important under rotation for mobile
+        // websites. We want the page to remain layouted at the same width which
+        // it was loaded with, and instead change the zoom level to fit to screen.
+        // The height is welcome to adapt to the height used in the new orientation,
+        // otherwise we will get a grey bar below the web page.
+        if (m_mainFrame->view() && !contentsSize().isEmpty())
+            minWidth = contentsSize().width();
+        else {
+            // If there is no contents width, use the minimum of screen width
+            // and layout width to shape the first layout to a contents width
+            // that we could reasonably zoom to fit, in a manner that takes
+            // orientation into account and still respects a small default
+            // layout width.
+#if ENABLE(ORIENTATION_EVENTS)
+            minWidth = m_mainFrame->orientation() % 180
+                ? Platform::Graphics::Screen::height()
+                : Platform::Graphics::Screen::width();
+#else
+            minWidth = Platform::Graphics::Screen::width();
+#endif
+        }
+    }
+
+    return IntSize(std::min(minWidth, defaultLayoutWidth), defaultLayoutHeight);
+}
+
+BackingStoreClient* WebPagePrivate::backingStoreClientForFrame(const Frame* frame) const
+{
+    ASSERT(frame);
+    BackingStoreClient* backingStoreClient = 0;
+    if (m_backingStoreClientForFrameMap.contains(frame))
+        backingStoreClient = m_backingStoreClientForFrameMap.get(frame);
+    return backingStoreClient;
+}
+
+void WebPagePrivate::addBackingStoreClientForFrame(const Frame* frame, BackingStoreClient* client)
+{
+    ASSERT(frame);
+    ASSERT(client);
+    m_backingStoreClientForFrameMap.add(frame, client);
+}
+
+void WebPagePrivate::removeBackingStoreClientForFrame(const Frame* frame)
+{
+    ASSERT(frame);
+    if (m_backingStoreClientForFrameMap.contains(frame))
+        m_backingStoreClientForFrameMap.remove(frame);
+}
+
+
+void WebPagePrivate::clearDocumentData(const Document* documentGoingAway)
+{
+    ASSERT(documentGoingAway);
+    if (m_currentContextNode && m_currentContextNode->document() == documentGoingAway)
+        m_currentContextNode = 0;
+
+    if (m_currentPinchZoomNode && m_currentPinchZoomNode->document() == documentGoingAway)
+        m_currentPinchZoomNode = 0;
+
+    if (m_currentBlockZoomAdjustedNode && m_currentBlockZoomAdjustedNode->document() == documentGoingAway)
+        m_currentBlockZoomAdjustedNode = 0;
+
+    if (m_inRegionScrollStartingNode && m_inRegionScrollStartingNode->document() == documentGoingAway)
+        m_inRegionScrollStartingNode = 0;
+
+    Node* nodeUnderFatFinger = m_touchEventHandler->lastFatFingersResult().node();
+    if (nodeUnderFatFinger && nodeUnderFatFinger->document() == documentGoingAway)
+        m_touchEventHandler->resetLastFatFingersResult();
+
+    // NOTE: m_fullscreenVideoNode, m_fullScreenPluginView and m_pluginViews
+    // are cleared in other methods already.
+}
+
+typedef bool (*PredicateFunction)(RenderLayer*);
+static bool isPositionedContainer(RenderLayer* layer)
+{
+    RenderObject* o = layer->renderer();
+    return o->isRenderView() || o->isPositioned() || o->isRelPositioned() || layer->hasTransform();
+}
+
+static bool isNonRenderViewFixedPositionedContainer(RenderLayer* layer)
+{
+    RenderObject* o = layer->renderer();
+    if (o->isRenderView())
+        return false;
+
+    return o->isPositioned() && o->style()->position() == FixedPosition;
+}
+
+static bool isFixedPositionedContainer(RenderLayer* layer)
+{
+    RenderObject* o = layer->renderer();
+    return o->isRenderView() || (o->isPositioned() && o->style()->position() == FixedPosition);
+}
+
+static RenderLayer* findAncestorOrSelfNotMatching(PredicateFunction predicate, RenderLayer* layer)
+{
+    RenderLayer* curr = layer;
+    while (curr && !predicate(curr))
+        curr = curr->parent();
+
+    return curr;
+}
+
+RenderLayer* WebPagePrivate::enclosingFixedPositionedAncestorOrSelfIfFixedPositioned(RenderLayer* layer)
+{
+    return findAncestorOrSelfNotMatching(&isFixedPositionedContainer, layer);
+}
+
+RenderLayer* WebPagePrivate::enclosingPositionedAncestorOrSelfIfPositioned(RenderLayer* layer)
+{
+    return findAncestorOrSelfNotMatching(&isPositionedContainer, layer);
+}
+
+static inline Frame* frameForNode(Node* node)
+{
+    Node* origNode = node;
+    for (; node; node = node->parentNode()) {
+        if (RenderObject* renderer = node->renderer()) {
+            if (renderer->isRenderView()) {
+                if (FrameView* view = toRenderView(renderer)->frameView()) {
+                    if (Frame* frame = view->frame())
+                        return frame;
+                }
+            }
+            if (renderer->isWidget()) {
+                Widget* widget = toRenderWidget(renderer)->widget();
+                if (widget && widget->isFrameView()) {
+                    if (Frame* frame = static_cast<FrameView*>(widget)->frame())
+                        return frame;
+                }
+            }
+        }
+    }
+
+    for (node = origNode; node; node = node->parentNode()) {
+        if (Document* doc = node->document()) {
+            if (Frame* frame = doc->frame())
+                return frame;
+        }
+    }
+
+    return 0;
+}
+
+static IntRect getNodeWindowRect(Node* node)
+{
+    if (Frame* frame = frameForNode(node)) {
+        if (FrameView* view = frame->view())
+            return view->contentsToWindow(node->getRect());
+    }
+    ASSERT_NOT_REACHED();
+    return IntRect();
+}
+
+IntRect WebPagePrivate::getRecursiveVisibleWindowRect(ScrollView* view, bool noClipOfMainFrame)
+{
+    ASSERT(m_mainFrame);
+
+    // Don't call this function asking to not clip the main frame providing only
+    // the main frame. All that can be returned is the content rect which
+    // isn't what this function is for.
+    if (noClipOfMainFrame && view == m_mainFrame->view()) {
+        ASSERT_NOT_REACHED();
+        return IntRect(IntPoint::zero(), view->contentsSize());
+    }
+
+    IntRect visibleWindowRect(view->contentsToWindow(view->visibleContentRect(false)));
+    if (view->parent() && !(noClipOfMainFrame && view->parent() == m_mainFrame->view())) {
+        // Intersect with parent visible rect.
+        visibleWindowRect.intersect(getRecursiveVisibleWindowRect(view->parent(), noClipOfMainFrame));
+    }
+    return visibleWindowRect;
+}
+
+void WebPage::assignFocus(Platform::FocusDirection direction)
+{
+    d->assignFocus(direction);
+}
+
+void WebPagePrivate::assignFocus(Platform::FocusDirection direction)
+{
+    ASSERT((int) Platform::FocusDirectionNone == (int) FocusDirectionNone);
+    ASSERT((int) Platform::FocusDirectionForward == (int) FocusDirectionForward);
+    ASSERT((int) Platform::FocusDirectionBackward == (int) FocusDirectionBackward);
+
+    // First we clear the focus, since we want to focus either initial or the last
+    // focusable element in the webpage (according to the TABINDEX), or simply clear
+    // the focus.
+    clearFocusNode();
+
+    switch (direction) {
+    case FocusDirectionForward:
+    case FocusDirectionBackward:
+        m_page->focusController()->setInitialFocus((FocusDirection) direction, 0);
+        break;
+    case FocusDirectionNone:
+        break;
+    default:
+        ASSERT_NOT_REACHED();
+    }
+}
+
+Platform::IntRect WebPagePrivate::focusNodeRect()
+{
+    Frame* frame = focusedOrMainFrame();
+    if (!frame)
+        return Platform::IntRect();
+
+    Document* doc = frame->document();
+    FrameView* view = frame->view();
+    if (!doc || !view || view->needsLayout())
+        return Platform::IntRect();
+
+    IntRect focusRect = rectForNode(doc->focusedNode());
+    focusRect = adjustRectOffsetForFrameOffset(focusRect, doc->focusedNode());
+    focusRect = mapToTransformed(focusRect);
+    clipToTransformedContentsRect(focusRect);
+    return focusRect;
+}
+
+PassRefPtr<Node> WebPagePrivate::contextNode(TargetDetectionStrategy strategy)
+{
+    EventHandler* eventHandler = focusedOrMainFrame()->eventHandler();
+    const FatFingersResult lastFatFingersResult = m_touchEventHandler->lastFatFingersResult();
+    bool isTouching = lastFatFingersResult.isValid() && strategy == RectBased;
+
+    // Unpress the mouse button always.
+    if (eventHandler->mousePressed())
+        eventHandler->setMousePressed(false);
+
+    // Check if we're using LinkToLink and the user is not touching the screen.
+    if (m_webSettings->doesGetFocusNodeContext() && !isTouching) {
+        RefPtr<Node> node;
+        node = m_page->focusController()->focusedOrMainFrame()->document()->focusedNode();
+        if (node) {
+            IntRect visibleRect = IntRect(IntPoint(), actualVisibleSize());
+            if (!visibleRect.intersects(getNodeWindowRect(node.get())))
+                return 0;
+        }
+        return node.release();
+    }
+
+    // Check for text input.
+    if (isTouching && lastFatFingersResult.isTextInput())
+        return lastFatFingersResult.node(FatFingersResult::ShadowContentNotAllowed);
+
+    IntPoint contentPos;
+    if (isTouching)
+        contentPos = lastFatFingersResult.adjustedPosition();
+    else
+        contentPos = mapFromViewportToContents(m_lastMouseEvent.pos());
+
+    if (strategy == RectBased) {
+        FatFingersResult result = FatFingers(this, lastFatFingersResult.adjustedPosition(), FatFingers::Text).findBestPoint();
+        return result.node(FatFingersResult::ShadowContentNotAllowed);
+    }
+
+    HitTestResult result = eventHandler->hitTestResultAtPoint(contentPos, false /*allowShadowContent*/);
+    return result.innerNode();
+}
+
+static inline int distanceBetweenPoints(IntPoint p1, IntPoint p2)
+{
+    // Change int to double, because (dy * dy) can cause int overflow in reality, e.g, (-46709 * -46709).
+    double dx = static_cast<double>(p1.x() - p2.x());
+    double dy = static_cast<double>(p1.y() - p2.y());
+    return sqrt((dx * dx) + (dy * dy));
+}
+
+Node* WebPagePrivate::bestNodeForZoomUnderPoint(const IntPoint& point)
+{
+    IntPoint pt = mapFromTransformed(point);
+    IntRect clickRect(pt.x() - blockClickRadius, pt.y() - blockClickRadius, 2 * blockClickRadius, 2 * blockClickRadius);
+    Node* originalNode = nodeForZoomUnderPoint(point);
+    if (!originalNode)
+        return 0;
+    Node* node = bestChildNodeForClickRect(originalNode, clickRect);
+    return node ? adjustedBlockZoomNodeForZoomLimits(node) : adjustedBlockZoomNodeForZoomLimits(originalNode);
+}
+
+Node* WebPagePrivate::bestChildNodeForClickRect(Node* parentNode, const IntRect& clickRect)
+{
+    if (!parentNode)
+        return 0;
+
+    int bestDistance = std::numeric_limits<int>::max();
+
+    Node* node = parentNode->firstChild();
+    Node* bestNode = 0;
+    for (; node; node = node->nextSibling()) {
+        IntRect rect = rectForNode(node);
+        if (!clickRect.intersects(rect))
+            continue;
+
+        int distance = distanceBetweenPoints(rect.center(), clickRect.center());
+        Node* bestChildNode = bestChildNodeForClickRect(node, clickRect);
+        if (bestChildNode) {
+            IntRect bestChildRect = rectForNode(bestChildNode);
+            int bestChildDistance = distanceBetweenPoints(bestChildRect.center(), clickRect.center());
+            if (bestChildDistance < distance && bestChildDistance < bestDistance) {
+                bestNode = bestChildNode;
+                bestDistance = bestChildDistance;
+            } else {
+                if (distance < bestDistance) {
+                    bestNode = node;
+                    bestDistance = distance;
+                }
+            }
+        } else {
+            if (distance < bestDistance) {
+                bestNode = node;
+                bestDistance = distance;
+            }
+        }
+    }
+
+    return bestNode;
+}
+
+double WebPagePrivate::maxBlockZoomScale() const
+{
+    return std::min(maximumBlockZoomScale, maximumScale());
+}
+
+Node* WebPagePrivate::nodeForZoomUnderPoint(const IntPoint& point)
+{
+    if (!m_mainFrame)
+        return 0;
+
+    HitTestResult result = m_mainFrame->eventHandler()->hitTestResultAtPoint(mapFromTransformed(point), false);
+
+    Node* node = result.innerNonSharedNode();
+
+    if (!node)
+        return 0;
+
+    RenderObject* renderer = node->renderer();
+    while (!renderer) {
+        node = node->parentNode();
+        renderer = node->renderer();
+    }
+
+    return node;
+}
+
+Node* WebPagePrivate::adjustedBlockZoomNodeForZoomLimits(Node* node)
+{
+    Node* initialNode = node;
+    RenderObject* renderer = node->renderer();
+    bool acceptableNodeSize = newScaleForBlockZoomRect(rectForNode(node), 1.0, 0) < maxBlockZoomScale();
+
+    while (!renderer || !acceptableNodeSize) {
+        node = node->parentNode();
+
+        if (!node)
+            return initialNode;
+
+        renderer = node->renderer();
+        acceptableNodeSize = newScaleForBlockZoomRect(rectForNode(node), 1.0, 0) < maxBlockZoomScale();
+    }
+
+    return node;
+}
+
+bool WebPagePrivate::compareNodesForBlockZoom(Node* n1, Node* n2)
+{
+    if (!n1 || !n2)
+        return false;
+
+    return (n2 == n1) || n2->isDescendantOf(n1);
+}
+
+double WebPagePrivate::newScaleForBlockZoomRect(const IntRect& rect, double oldScale, double margin)
+{
+    if (rect.isEmpty())
+        return std::numeric_limits<double>::max();
+
+    ASSERT(rect.width() + margin);
+
+    double newScale = oldScale * static_cast<double>(transformedActualVisibleSize().width()) / (rect.width() + margin);
+
+    return newScale;
+}
+
+IntRect WebPagePrivate::rectForNode(Node* node)
+{
+    if (!node)
+        return IntRect();
+
+    RenderObject* renderer = node->renderer();
+
+    if (!renderer)
+        return IntRect();
+
+    // Return rect in un-transformed content coordinates.
+    IntRect blockRect;
+
+    // FIXME: Ensure this works with iframes.
+    if (m_webPage->settings()->textReflowMode() == WebSettings::TextReflowEnabled && renderer->isText()) {
+        RenderBlock* renderBlock = renderer->containingBlock();
+        int xOffset = 0;
+        int yOffset = 0;
+        while (!renderBlock->isRoot()) {
+            xOffset += renderBlock->x();
+            yOffset += renderBlock->y();
+            renderBlock = renderBlock->containingBlock();
+        }
+        const RenderText* renderText = toRenderText(renderer);
+        IntRect linesBox = renderText->linesBoundingBox();
+        blockRect = IntRect(xOffset + linesBox.x(), yOffset + linesBox.y(), linesBox.width(), linesBox.height());
+    } else
+        blockRect = renderer->absoluteClippedOverflowRect();
+
+    if (renderer->isText()) {
+        RenderBlock* rb = renderer->containingBlock();
+
+        // Inefficient? Way to find width when floats intersect a block.
+        int blockWidth = 0;
+        int lineCount = rb->lineCount();
+        for (int i = 0; i < lineCount; i++)
+            blockWidth = max(blockWidth, rb->availableLogicalWidthForLine(i, false));
+
+        blockRect.setWidth(blockWidth);
+        blockRect.setX(blockRect.x() + rb->logicalLeftOffsetForLine(1, false));
+    }
+
+    // Strip off padding.
+    if (renderer->style()->hasPadding()) {
+        blockRect.setX(blockRect.x() + renderer->style()->paddingLeft().value());
+        blockRect.setY(blockRect.y() + renderer->style()->paddingTop().value());
+        blockRect.setWidth(blockRect.width() - renderer->style()->paddingRight().value());
+        blockRect.setHeight(blockRect.height() - renderer->style()->paddingBottom().value());
+    }
+
+    return blockRect;
+}
+
+IntPoint WebPagePrivate::frameOffset(const Frame* frame) const
+{
+    ASSERT(frame);
+
+    // FIXME: This function can be called when page is being destroyed and JS triggers selection change.
+    // We could break the call chain at upper levels, but I think it is better to check the frame pointer
+    // here because the pointer is explicitly cleared in WebPage::destroy().
+    if (!mainFrame())
+        return IntPoint();
+
+    // Convert 0,0 in the frame's coordinate system to window coordinates to
+    // get the frame's global position, and return this position in the main
+    // frame's coordinates.  (So the main frame's coordinates will be 0,0.)
+    return mainFrame()->view()->windowToContents(frame->view()->contentsToWindow(IntPoint::zero()));
+}
+
+IntRect WebPagePrivate::adjustRectOffsetForFrameOffset(const IntRect& rect, const Node* node)
+{
+    if (!node)
+        return rect;
+
+    // Adjust the offset of the rect if it is in an iFrame/frame or set of iFrames/frames.
+    // FIXME: can we just use frameOffset instead of this big routine?
+    const Node* tnode = node;
+    IntRect adjustedRect = rect;
+    do {
+        Frame* frame = tnode->document()->frame();
+        if (!frame)
+            continue;
+
+        Node* ownerNode = static_cast<Node*>(frame->ownerElement());
+        tnode = ownerNode;
+        if (ownerNode && (ownerNode->hasTagName(HTMLNames::iframeTag) || ownerNode->hasTagName(HTMLNames::frameTag))) {
+            IntRect iFrameRect;
+            do {
+                iFrameRect = rectForNode(ownerNode);
+                adjustedRect.move(iFrameRect.x(), iFrameRect.y());
+                adjustedRect.intersect(iFrameRect);
+                ownerNode = ownerNode->parentNode();
+            } while (iFrameRect.isEmpty() && ownerNode);
+        } else
+            break;
+    } while (tnode = tnode->parentNode());
+
+    return adjustedRect;
+}
+
+IntRect WebPagePrivate::blockZoomRectForNode(Node* node)
+{
+    if (!node || contentsSize().isEmpty())
+        return IntRect();
+
+    Node* tnode = node;
+    m_currentBlockZoomAdjustedNode = tnode;
+
+    IntRect blockRect = rectForNode(tnode);
+    IntRect originalRect = blockRect;
+
+    int originalArea = originalRect.width() * originalRect.height();
+    int pageArea = contentsSize().width() * contentsSize().height();
+    double blockToPageRatio = static_cast<double>(1 - originalArea / pageArea);
+    double blockExpansionRatio = 5.0 * blockToPageRatio * blockToPageRatio;
+
+    if (!tnode->hasTagName(HTMLNames::imgTag) && !tnode->hasTagName(HTMLNames::inputTag) && !tnode->hasTagName(HTMLNames::textareaTag)) {
+        while (tnode = tnode->parentNode()) {
+            ASSERT(tnode);
+            IntRect tRect = rectForNode(tnode);
+            int tempBlockArea = tRect.width() * tRect.height();
+            // Don't expand the block if it will be too large relative to the content.
+            if (static_cast<double>(1 - tempBlockArea / pageArea) < minimumExpandingRatio)
+                break;
+            if (tRect.isEmpty())
+                continue; // No renderer.
+            if (tempBlockArea < 1.1 * originalArea)
+                continue; // The size of this parent is very close to the child, no need to go to this parent.
+            // Don't expand the block if the parent node size is already almost the size of actual visible size.
+            IntSize actualSize = actualVisibleSize();
+            if (static_cast<double>(1 - tRect.width() / actualSize.width()) < minimumExpandingRatio)
+                break;
+            if (tempBlockArea < blockExpansionRatio * originalArea) {
+                blockRect = tRect;
+                m_currentBlockZoomAdjustedNode = tnode;
+            } else
+                break;
+        }
+    }
+
+    blockRect = adjustRectOffsetForFrameOffset(blockRect, node);
+    blockRect = mapToTransformed(blockRect);
+    clipToTransformedContentsRect(blockRect);
+
+#if DEBUG_BLOCK_ZOOM
+    // Re-paint the backingstore to screen to erase other annotations.
+    m_backingStore->d->resumeScreenAndBackingStoreUpdates(BackingStore::Blit);
+
+    // Render a black square over the calculated block and a gray square over the original block for visual inspection.
+    originalRect = mapToTransformed(originalRect);
+    clipToTransformedContentsRect(originalRect);
+    IntRect renderRect = mapFromTransformedContentsToTransformedViewport(blockRect);
+    IntRect originalRenderRect = mapFromTransformedContentsToTransformedViewport(originalRect);
+    IntSize viewportSize = transformedViewportSize();
+    renderRect.intersect(IntRect(0, 0, viewportSize.width(), viewportSize.height()));
+    originalRenderRect.intersect(IntRect(0, 0, viewportSize.width(), viewportSize.height()));
+    m_backingStore->d->clearWindow(renderRect, 0, 0, 0);
+    m_backingStore->d->clearWindow(originalRenderRect, 120, 120, 120);
+    m_backingStore->d->invalidateWindow(renderRect);
+#endif
+
+    return blockRect;
+}
+
+void WebPage::blockZoomAnimationFinished()
+{
+    d->zoomBlock();
+}
+
+// This function should not be called directly.
+// It is called after the animation ends (see above).
+void WebPagePrivate::zoomBlock()
+{
+    if (!m_mainFrame)
+        return;
+
+    IntPoint anchor(roundUntransformedPoint(mapFromTransformedFloatPoint(m_finalBlockPoint)));
+    bool willUseTextReflow = false;
+
+#if ENABLE(VIEWPORT_REFLOW)
+    willUseTextReflow = m_webPage->settings()->textReflowMode() != WebSettings::TextReflowDisabled;
+    toggleTextReflowIfEnabledForBlockZoomOnly(m_shouldReflowBlock);
+    setNeedsLayout();
+#endif
+
+    TransformationMatrix zoom;
+    zoom.scale(m_blockZoomFinalScale);
+    *m_transformationMatrix = zoom;
+    m_client->resetBitmapZoomScale(m_blockZoomFinalScale);
+    m_backingStore->d->suspendScreenAndBackingStoreUpdates();
+    updateViewportSize();
+
+#if ENABLE(VIEWPORT_REFLOW)
+    requestLayoutIfNeeded();
+    if (willUseTextReflow && m_shouldReflowBlock) {
+        IntRect reflowedRect = rectForNode(m_currentBlockZoomAdjustedNode.get());
+        reflowedRect = adjustRectOffsetForFrameOffset(reflowedRect, m_currentBlockZoomAdjustedNode.get());
+        reflowedRect.move(roundTransformedPoint(m_finalBlockPointReflowOffset).x(), roundTransformedPoint(m_finalBlockPointReflowOffset).y());
+        RenderObject* renderer = m_currentBlockZoomAdjustedNode->renderer();
+        IntPoint topLeftPoint(reflowedRect.location());
+        if (renderer && renderer->isText()) {
+            ETextAlign textAlign = renderer->style()->textAlign();
+            IntPoint textAnchor;
+            switch (textAlign) {
+            case CENTER:
+            case WEBKIT_CENTER:
+                textAnchor = IntPoint(reflowedRect.x() + (reflowedRect.width() - actualVisibleSize().width()) / 2, topLeftPoint.y());
+                break;
+            case LEFT:
+            case WEBKIT_LEFT:
+                textAnchor = topLeftPoint;
+                break;
+            case RIGHT:
+            case WEBKIT_RIGHT:
+                textAnchor = IntPoint(reflowedRect.x() + reflowedRect.width() - actualVisibleSize().width(), topLeftPoint.y());
+                break;
+            case TAAUTO:
+            case JUSTIFY:
+            default:
+                if (renderer->style()->isLeftToRightDirection())
+                    textAnchor = topLeftPoint;
+                else
+                    textAnchor = IntPoint(reflowedRect.x() + reflowedRect.width() - actualVisibleSize().width(), topLeftPoint.y());
+                break;
+            }
+            setScrollPosition(textAnchor);
+        } else {
+            renderer->style()->isLeftToRightDirection()
+                ? setScrollPosition(topLeftPoint)
+                : setScrollPosition(IntPoint(reflowedRect.x() + reflowedRect.width() - actualVisibleSize().width(), topLeftPoint.y()));
+        }
+    } else if (willUseTextReflow) {
+        IntRect finalRect = rectForNode(m_currentBlockZoomAdjustedNode.get());
+        finalRect = adjustRectOffsetForFrameOffset(finalRect, m_currentBlockZoomAdjustedNode.get());
+        setScrollPosition(IntPoint(0, finalRect.y() + m_finalBlockPointReflowOffset.y()));
+        resetBlockZoom();
+    }
+#endif
+    if (!willUseTextReflow) {
+        setScrollPosition(anchor);
+        if (!m_shouldReflowBlock)
+            resetBlockZoom();
+    }
+
+    notifyTransformChanged();
+    m_backingStore->d->clearWindow();
+    m_backingStore->d->resumeScreenAndBackingStoreUpdates(BackingStore::RenderAndBlit);
+    m_client->zoomChanged(m_webPage->isMinZoomed(), m_webPage->isMaxZoomed(), !shouldZoomOnEscape(), currentScale());
+}
+
+
+void WebPagePrivate::resetBlockZoom()
+{
+    m_currentBlockZoomNode = 0;
+    m_currentBlockZoomAdjustedNode = 0;
+    m_shouldReflowBlock = false;
+}
+
+WebPage::WebPage(WebPageClient* client, const WebString& pageGroupName, const Platform::IntRect& rect)
+{
+    globalInitialize();
+    d = new WebPagePrivate(this, client, rect);
+    d->init(pageGroupName);
+}
+
+void WebPage::destroyWebPageCompositor()
+{
+#if USE(ACCELERATED_COMPOSITING)
+    // Destroy the layer renderer in a sync command before we destroy the backing store,
+    // to flush any pending compositing messages on the compositing thread.
+    // The backing store is indirectly deleted by the 'detachFromParent' call below.
+    d->syncDestroyCompositorOnCompositingThread();
+#endif
+}
+
+void WebPage::destroy()
+{
+    // TODO: need to verify if this call needs to be made before calling
+    // WebPage::destroyWebPageCompositor()
+    d->m_backingStore->d->suspendScreenAndBackingStoreUpdates();
+
+    // Close the backforward list and release the cached pages.
+    d->m_page->backForward()->close();
+    pageCache()->releaseAutoreleasedPagesNow();
+
+    FrameLoader* loader = d->m_mainFrame->loader();
+
+    // Remove main frame's backing store client from the map
+    // to prevent FrameLoaderClientBlackyBerry::detachFromParent2(),
+    // which is called by loader->detachFromParent(), deleting it.
+    // We will delete it in ~WebPagePrivate().
+    // Reason: loader->detachFromParent() may ping back to backing store
+    // indirectly through ChromeClientBlackBerry::invalidateContentsAndWindow().
+    // see RIM PR #93256.
+    d->removeBackingStoreClientForFrame(d->m_mainFrame);
+
+    // Set m_mainFrame to 0 to avoid calls back in to the backingstore during webpage deletion.
+    d->m_mainFrame = 0;
+    if (loader)
+        loader->detachFromParent();
+
+    delete this;
+}
+
+WebPage::~WebPage()
+{
+    delete d;
+    d = 0;
+}
+
+WebPageClient* WebPage::client() const
+{
+    return d->m_client;
+}
+
+void WebPage::load(const char* url, const char* networkToken, bool isInitial)
+{
+    d->load(url, networkToken, "GET", Platform::NetworkRequest::UseProtocolCachePolicy, 0, 0, 0, 0, isInitial, false);
+}
+
+void WebPage::loadExtended(const char* url, const char* networkToken, const char* method, Platform::NetworkRequest::CachePolicy cachePolicy, const char* data, size_t dataLength, const char* const* headers, size_t headersLength, bool mustHandleInternally)
+{
+    d->load(url, networkToken, method, cachePolicy, data, dataLength, headers, headersLength, false, mustHandleInternally, false, "");
+}
+
+void WebPage::loadFile(const char* path, const char* overrideContentType)
+{
+    std::string fileUrl(path);
+    if (!fileUrl.find("/"))
+        fileUrl.insert(0, "file://");
+    else if (fileUrl.find("file:///"))
+        return;
+
+    d->load(fileUrl.c_str(), 0, "GET", Platform::NetworkRequest::UseProtocolCachePolicy, 0, 0, 0, 0, false, false, false, overrideContentType);
+}
+
+void WebPage::loadString(const char* string, const char* baseURL, const char* mimeType, const char* failingURL)
+{
+    d->loadString(string, baseURL, mimeType, failingURL);
+}
+
+void WebPage::download(const Platform::NetworkRequest& request)
+{
+    d->load(request.getUrlRef().c_str(), 0, "GET", Platform::NetworkRequest::UseProtocolCachePolicy, 0, 0, 0, 0, false, false, true, "");
+}
+
+bool WebPage::executeJavaScript(const char* script, JavaScriptDataType& returnType, WebString& returnValue)
+{
+    return d->executeJavaScript(script, returnType, returnValue);
+}
+
+bool WebPage::executeJavaScriptInIsolatedWorld(const std::wstring& script, JavaScriptDataType& returnType, WebString& returnValue)
+{
+    // On our platform wchar_t is unsigned int and UChar is unsigned short
+    // so we have to convert using ICU conversion function
+    int lengthCopied = 0;
+    UErrorCode error = U_ZERO_ERROR;
+    const int length = script.length() + 1 /*null termination char*/;
+    UChar data[length];
+
+    // FIXME: PR 138162 is giving U_INVALID_CHAR_FOUND error.
+    u_strFromUTF32(data, length, &lengthCopied, reinterpret_cast<const UChar32*>(script.c_str()), script.length(), &error);
+    BLACKBERRY_ASSERT(error == U_ZERO_ERROR);
+    if (error != U_ZERO_ERROR) {
+        Platform::logAlways(Platform::LogLevelCritical, "WebPage::executeJavaScriptInIsolatedWorld failed to convert UTF16 to JavaScript!");
+        return false;
+    }
+    String str = String(data, lengthCopied);
+    ScriptSourceCode sourceCode(str, KURL());
+    return d->executeJavaScriptInIsolatedWorld(sourceCode, returnType, returnValue);
+}
+
+bool WebPage::executeJavaScriptInIsolatedWorld(const char* script, JavaScriptDataType& returnType, WebString& returnValue)
+{
+    ScriptSourceCode sourceCode(String::fromUTF8(script), KURL());
+    return d->executeJavaScriptInIsolatedWorld(sourceCode, returnType, returnValue);
+}
+
+void WebPage::stopLoading()
+{
+    d->stopCurrentLoad();
+}
+
+void WebPage::prepareToDestroy()
+{
+    d->prepareToDestroy();
+}
+
+int WebPage::backForwardListLength() const
+{
+    return d->m_page->getHistoryLength();
+}
+
+bool WebPage::canGoBackOrForward(int delta) const
+{
+    return d->m_page->canGoBackOrForward(delta);
+}
+
+bool WebPage::goBackOrForward(int delta)
+{
+    if (d->m_page->canGoBackOrForward(delta)) {
+        d->m_page->goBackOrForward(delta);
+        return true;
+    }
+    return false;
+}
+
+void WebPage::goToBackForwardEntry(BackForwardId id)
+{
+    HistoryItem* item = historyItemFromBackForwardId(id);
+    ASSERT(item);
+    d->m_page->goToItem(item, FrameLoadTypeIndexedBackForward);
+}
+
+void WebPage::reload()
+{
+    d->m_mainFrame->loader()->reload(/* bypassCache */ true);
+}
+
+void WebPage::reloadFromCache()
+{
+    d->m_mainFrame->loader()->reload(/* bypassCache */ false);
+}
+
+WebSettings* WebPage::settings() const
+{
+    return d->m_webSettings;
+}
+
+bool WebPage::isVisible() const
+{
+    return d->m_visible;
+}
+
+void WebPage::setVisible(bool visible)
+{
+    if (d->m_visible == visible)
+        return;
+
+    d->m_visible = visible;
+
+    if (!visible) {
+        d->suspendBackingStore();
+
+        // Remove this WebPage from the visible pages list.
+        size_t foundIndex = visibleWebPages()->find(this);
+        if (foundIndex != WTF::notFound)
+            visibleWebPages()->remove(foundIndex);
+
+        // Return the backing store to the last visible WebPage.
+        if (BackingStorePrivate::currentBackingStoreOwner() == this && !visibleWebPages()->isEmpty())
+            visibleWebPages()->last()->d->resumeBackingStore();
+
+#if USE(ACCELERATED_COMPOSITING)
+        // Root layer commit is not necessary for invisible tabs.
+        // And release layer resources can reduce memory consumption.
+        d->suspendRootLayerCommit();
+#endif
+        return;
+    }
+
+#if USE(ACCELERATED_COMPOSITING)
+    d->resumeRootLayerCommit();
+#endif
+
+    // Push this WebPage to the top of the visible pages list.
+    if (!visibleWebPages()->isEmpty() && visibleWebPages()->last() != this) {
+        size_t foundIndex = visibleWebPages()->find(this);
+        if (foundIndex != WTF::notFound)
+            visibleWebPages()->remove(foundIndex);
+    }
+    visibleWebPages()->append(this);
+
+    if (BackingStorePrivate::currentBackingStoreOwner()
+        && BackingStorePrivate::currentBackingStoreOwner() != this)
+        BackingStorePrivate::currentBackingStoreOwner()->d->suspendBackingStore();
+
+    // resumeBackingStore will set the current owner to this webpage.
+    // If we set the owner prematurely, then the tiles will not be reset.
+    d->resumeBackingStore();
+}
+
+void WebPagePrivate::selectionChanged(Frame* frame)
+{
+    m_inputHandler->selectionChanged();
+
+    // FIXME: This is a hack!
+    // To ensure the selection being changed has its frame 'focused', lets
+    // set it as focused ourselves (PR #104724).
+    m_page->focusController()->setFocusedFrame(frame);
+}
+
+void WebPagePrivate::updateDelegatedOverlays(bool dispatched)
+{
+    // Track a dispatched message, we don't want to flood the webkit thread.
+    // There can be as many as one more message enqued as needed but never less.
+    if (dispatched)
+        m_updateDelegatedOverlaysDispatched = false;
+    else if (m_updateDelegatedOverlaysDispatched) {
+        // Early return if there is message already pending on the webkit thread.
+        return;
+    }
+
+    if (Platform::webKitThreadMessageClient()->isCurrentThread()) {
+        // Must be called on the WebKit thread.
+        if (m_selectionHandler->isSelectionActive())
+            m_selectionHandler->selectionPositionChanged(true /* visualChangeOnly */);
+
+    } else if (m_selectionHandler->isSelectionActive()) {
+        // Don't bother dispatching to webkit thread if selection and tap highlight are not active.
+        m_updateDelegatedOverlaysDispatched = true;
+        Platform::webKitThreadMessageClient()->dispatchMessage(Platform::createMethodCallMessage(&WebPagePrivate::updateDelegatedOverlays, this, true /*dispatched*/));
+    }
+}
+
+void WebPage::setCaretHighlightStyle(Platform::CaretHighlightStyle style)
+{
+}
+
+bool WebPage::setBatchEditingActive(bool active)
+{
+    return d->m_inputHandler->setBatchEditingActive(active);
+}
+
+bool WebPage::setInputSelection(unsigned start, unsigned end)
+{
+    return d->m_inputHandler->setSelection(start, end);
+}
+
+int WebPage::inputCaretPosition() const
+{
+    return d->m_inputHandler->caretPosition();
+}
+
+void WebPage::popupListClosed(int size, bool* selecteds)
+{
+    d->m_inputHandler->setPopupListIndexes(size, selecteds);
+}
+
+void WebPage::popupListClosed(int index)
+{
+    d->m_inputHandler->setPopupListIndex(index);
+}
+
+void WebPage::setDateTimeInput(const WebString& value)
+{
+    d->m_inputHandler->setInputValue(String(value.impl()));
+}
+
+void WebPage::setColorInput(const WebString& value)
+{
+    d->m_inputHandler->setInputValue(String(value.impl()));
+}
+
+ActiveNodeContext WebPage::activeNodeContext(TargetDetectionStrategy strategy) const
+{
+    return d->activeNodeContext(strategy);
+}
+
+void WebPage::setVirtualViewportSize(int width, int height)
+{
+    d->m_virtualViewportWidth = width;
+    d->m_virtualViewportHeight = height;
+}
+
+void WebPage::resetVirtualViewportOnCommitted(bool reset)
+{
+    d->m_resetVirtualViewportOnCommitted = reset;
+}
+
+IntSize WebPagePrivate::recomputeVirtualViewportFromViewportArguments()
+{
+    static ViewportArguments defaultViewportArguments;
+    if (m_viewportArguments == defaultViewportArguments)
+        return IntSize();
+
+    int desktopWidth = defaultMaxLayoutSize().width();
+    int deviceWidth = Platform::Graphics::Screen::width();
+    int deviceHeight = Platform::Graphics::Screen::height();
+    FloatSize currentPPI = Platform::Graphics::Screen::pixelsPerInch(-1);
+    int deviceDPI = int(roundf((currentPPI.width() + currentPPI.height()) / 2));
+    if (m_viewportArguments.targetDensityDpi == ViewportArguments::ValueAuto) {
+        // Auto means 160dpi if we leave it alone. This looks terrible for pages wanting 1:1.
+        // FIXME: This is insufficient for devices with high dpi, as they will render content unreadably small.
+        m_viewportArguments.targetDensityDpi = deviceDPI;
+    }
+
+    ViewportAttributes result = computeViewportAttributes(m_viewportArguments, desktopWidth, deviceWidth, deviceHeight, deviceDPI, m_defaultLayoutSize);
+    return IntSize(result.layoutSize.width(), result.layoutSize.height());
+}
+
+#if ENABLE(EVENT_MODE_METATAGS)
+void WebPagePrivate::didReceiveCursorEventMode(CursorEventMode mode)
+{
+    if (mode != m_cursorEventMode)
+        m_client->cursorEventModeChanged(toPlatformCursorEventMode(mode));
+    m_cursorEventMode = mode;
+}
+
+void WebPagePrivate::didReceiveTouchEventMode(TouchEventMode mode)
+{
+    if (mode != m_touchEventMode)
+        m_client->touchEventModeChanged(toPlatformTouchEventMode(mode));
+    m_touchEventMode = mode;
+}
+#endif
+
+void WebPagePrivate::dispatchViewportPropertiesDidChange(const ViewportArguments& arguments)
+{
+    static ViewportArguments defaultViewportArguments;
+    if (arguments == defaultViewportArguments)
+        return;
+
+    m_viewportArguments = arguments;
+
+    // 0 width or height in viewport arguments makes no sense, and results in a very large initial scale.
+    // In real world, a 0 width or height is usually caused by a syntax error in "content" field of viewport
+    // meta tag, for example, using semicolon instead of comma as separator ("width=device-width; initial-scale=1.0").
+    // We don't have a plan to tolerate the semicolon separator, but we can avoid applying 0 width/height.
+    // I default it to ValueDeviceWidth rather than ValueAuto because in more cases the web site wants "device-width"
+    // when they specify the viewport width.
+    if (!m_viewportArguments.width)
+        m_viewportArguments.width = ViewportArguments::ValueDeviceWidth;
+    if (!m_viewportArguments.height)
+        m_viewportArguments.height = ViewportArguments::ValueDeviceHeight;
+
+    setUserScalable(arguments.userScalable == ViewportArguments::ValueAuto ? true : arguments.userScalable);
+    if (arguments.initialScale > 0)
+        setInitialScale(arguments.initialScale);
+    if (arguments.minimumScale > 0)
+        setMinimumScale(arguments.minimumScale);
+    if (arguments.maximumScale > 0)
+        setMaximumScale(arguments.maximumScale);
+
+    IntSize virtualViewport = recomputeVirtualViewportFromViewportArguments();
+    m_webPage->setVirtualViewportSize(virtualViewport.width(), virtualViewport.height());
+
+    if (loadState() == WebKit::WebPagePrivate::Committed)
+        zoomToInitialScaleOnLoad();
+}
+
+void WebPagePrivate::onInputLocaleChanged(bool isRTL)
+{
+    if (isRTL != m_webSettings->isWritingDirectionRTL()) {
+        m_webSettings->setWritingDirectionRTL(isRTL);
+        m_inputHandler->handleInputLocaleChanged(isRTL);
+    }
+}
+
+void WebPage::setScreenOrientation(int orientation)
+{
+    d->m_pendingOrientation = orientation;
+}
+
+void WebPage::applyPendingOrientationIfNeeded()
+{
+    if (d->m_pendingOrientation != -1)
+        d->setScreenOrientation(d->m_pendingOrientation);
+}
+
+void WebPagePrivate::suspendBackingStore()
+{
+#if USE(ACCELERATED_COMPOSITING)
+    resetCompositingSurface();
+#endif
+}
+
+void WebPagePrivate::resumeBackingStore()
+{
+    ASSERT(m_webPage->isVisible());
+
+#if USE(ACCELERATED_COMPOSITING)
+    setNeedsOneShotDrawingSynchronization();
+#endif
+
+    bool directRendering = m_backingStore->d->shouldDirectRenderingToWindow();
+    if (!m_backingStore->d->isActive()
+        || shouldResetTilesWhenShown()
+        || directRendering) {
+        // We need to reset all tiles so that we do not show any tiles whose content may
+        // have been replaced by another WebPage instance (i.e. another tab).
+        BackingStorePrivate::setCurrentBackingStoreOwner(m_webPage);
+        m_backingStore->d->orientationChanged(); // Updates tile geometry and creates visible tile buffer.
+        m_backingStore->d->resetTiles(true /* resetBackground */);
+        m_backingStore->d->updateTiles(false /* updateVisible */, false /* immediate */);
+        // This value may have changed, so we need to update it.
+        directRendering = m_backingStore->d->shouldDirectRenderingToWindow();
+        if (m_backingStore->d->renderVisibleContents() && !m_backingStore->d->isSuspended() && !directRendering)
+            m_backingStore->d->blitVisibleContents();
+    } else {
+        // Rendering was disabled while we were hidden, so we need to update all tiles.
+        m_backingStore->d->updateTiles(true /* updateVisible */, false /* immediate */);
+    }
+
+    setShouldResetTilesWhenShown(false);
+}
+
+void WebPagePrivate::setScreenOrientation(int orientation)
+{
+    FOR_EACH_PLUGINVIEW(m_pluginViews)
+        (*it)->handleOrientationEvent(orientation);
+
+    m_pendingOrientation = -1;
+
+#if ENABLE(ORIENTATION_EVENTS)
+    if (m_mainFrame->orientation() == orientation)
+        return;
+    for (RefPtr<Frame> frame = m_mainFrame; frame; frame = frame->tree()->traverseNext())
+        frame->sendOrientationChangeEvent(orientation);
+#endif
+}
+
+Platform::IntSize WebPage::viewportSize() const
+{
+    return d->transformedActualVisibleSize();
+}
+
+void WebPage::setViewportSize(const Platform::IntSize& viewportSize, bool ensureFocusElementVisible)
+{
+    d->setViewportSize(viewportSize, ensureFocusElementVisible);
+}
+
+void WebPagePrivate::screenRotated()
+{
+    // This call will cause the client to reallocate the window buffer to new size,
+    // which needs to be serialized with usage of the window buffer. Accomplish
+    // this by sending a sync message to the compositing thread. All other usage of
+    // the window buffer happens on the compositing thread.
+    if (!Platform::userInterfaceThreadMessageClient()->isCurrentThread()) {
+        Platform::userInterfaceThreadMessageClient()->dispatchSyncMessage(
+            Platform::createMethodCallMessage(&WebPagePrivate::screenRotated, this));
+        return;
+    }
+
+    SurfacePool::globalSurfacePool()->notifyScreenRotated();
+    m_client->notifyScreenRotated();
+}
+
+void WebPagePrivate::setViewportSize(const IntSize& transformedActualVisibleSize, bool ensureFocusElementVisible)
+{
+    if (m_pendingOrientation == -1 && transformedActualVisibleSize == this->transformedActualVisibleSize())
+        return;
+
+    // Suspend all screen updates to the backingstore to make sure no-one tries to blit
+    // while the window surface and the BackingStore are out of sync.
+    m_backingStore->d->suspendScreenAndBackingStoreUpdates();
+
+    // The screen rotation is a major state transition that in this case is not properly
+    // communicated to the backing store, since it does early return in most methods when
+    // not visible.
+    if (!m_visible || !m_backingStore->d->isActive())
+        setShouldResetTilesWhenShown(true);
+
+    bool hasPendingOrientation = m_pendingOrientation != -1;
+    if (hasPendingOrientation)
+        screenRotated();
+
+    // The window buffers might have been recreated, cleared, moved, etc., so:
+    m_backingStore->d->windowFrontBufferState()->clearBlittedRegion();
+    m_backingStore->d->windowBackBufferState()->clearBlittedRegion();
+
+    IntSize viewportSizeBefore = actualVisibleSize();
+    FloatPoint centerOfVisibleContentsRect = this->centerOfVisibleContentsRect();
+    bool newVisibleRectContainsOldVisibleRect = (m_actualVisibleHeight <= transformedActualVisibleSize.height())
+                                          && (m_actualVisibleWidth <= transformedActualVisibleSize.width());
+
+    bool atInitialScale = currentScale() == initialScale();
+    bool atTop = !scrollPosition().y();
+    bool atLeft = !scrollPosition().x();
+
+    // We need to reorient the visibleTileRect because the following code
+    // could cause BackingStore::transformChanged to be called, where it
+    // is used.
+    // It is only dependent on the transformedViewportSize which has been
+    // updated by now.
+    m_backingStore->d->createVisibleTileBuffer();
+
+    setDefaultLayoutSize(transformedActualVisibleSize);
+
+    // Recompute our virtual viewport.
+    bool needsLayout = false;
+    static ViewportArguments defaultViewportArguments;
+    if (!(m_viewportArguments == defaultViewportArguments)) {
+        // We may need to infer the width and height for the viewport with respect to the rotation.
+        IntSize newVirtualViewport = recomputeVirtualViewportFromViewportArguments();
+        ASSERT(!newVirtualViewport.isEmpty());
+        m_webPage->setVirtualViewportSize(newVirtualViewport.width(), newVirtualViewport.height());
+        m_mainFrame->view()->setUseFixedLayout(useFixedLayout());
+        m_mainFrame->view()->setFixedLayoutSize(fixedLayoutSize());
+        needsLayout = true;
+    }
+
+    // We switch this strictly after recomputing our virtual viewport as zoomToFitScale is dependent
+    // upon these values and so is the virtual viewport recalculation.
+    m_actualVisibleWidth = transformedActualVisibleSize.width();
+    m_actualVisibleHeight = transformedActualVisibleSize.height();
+
+    IntSize viewportSizeAfter = actualVisibleSize();
+
+    IntPoint offset(roundf((viewportSizeBefore.width() - viewportSizeAfter.width()) / 2.0),
+                    roundf((viewportSizeBefore.height() - viewportSizeAfter.height()) / 2.0));
+
+    // As a special case, if we were anchored to the top left position at
+    // the beginning of the rotation then preserve that anchor.
+    if (atTop)
+        offset.setY(0);
+    if (atLeft)
+        offset.setX(0);
+
+    // If we're about to overscroll, cap the offset to valid content.
+    IntPoint bottomRight(
+        scrollPosition().x() + viewportSizeAfter.width(),
+        scrollPosition().y() + viewportSizeAfter.height());
+
+    if (bottomRight.x() + offset.x() > contentsSize().width())
+        offset.setX(contentsSize().width() - bottomRight.x());
+    if (bottomRight.y() + offset.y() > contentsSize().height())
+        offset.setY(contentsSize().height() - bottomRight.y());
+    if (scrollPosition().x() + offset.x() < 0)
+        offset.setX(-scrollPosition().x());
+    if (scrollPosition().y() + offset.y() < 0)
+        offset.setY(-scrollPosition().y());
+
+    // ...before scrolling, because the backing store will align its
+    // tile matrix with the viewport as reported by the ScrollView.
+    scrollBy(offset.x(), offset.y());
+    notifyTransformedScrollChanged();
+
+    m_backingStore->d->orientationChanged();
+    m_backingStore->d->actualVisibleSizeChanged(transformedActualVisibleSize);
+
+    // Update view mode only after we have updated the actual
+    // visible size and reset the contents rect if necessary.
+    if (setViewMode(viewMode()))
+        needsLayout = true;
+
+    // We need to update the viewport size of the WebCore::ScrollView...
+    updateViewportSize(!hasPendingOrientation /* setFixedReportedSize */, false /* sendResizeEvent */);
+    notifyTransformedContentsSizeChanged();
+
+    // If automatic zooming is disabled, prevent zooming below.
+    if (!m_webSettings->isZoomToFitOnLoad()) {
+        atInitialScale = false;
+
+        // Normally, if the contents size is smaller than the layout width,
+        // we would zoom in. If zoom is disabled, we need to do something else,
+        // or there will be artifacts due to non-rendered areas outside of the
+        // contents size. If there is a virtual viewport, we are not allowed
+        // to modify the fixed layout size, however.
+        if (!hasVirtualViewport() && contentsSize().width() < m_defaultLayoutSize.width()) {
+            m_mainFrame->view()->setUseFixedLayout(useFixedLayout());
+            m_mainFrame->view()->setFixedLayoutSize(m_defaultLayoutSize);
+            needsLayout = true;
+        }
+    }
+
+    if (needsLayout)
+        setNeedsLayout();
+
+    // Need to resume so that the backingstore will start recording the invalidated
+    // rects from below.
+    m_backingStore->d->resumeScreenAndBackingStoreUpdates(BackingStore::None);
+
+    // We might need to layout here to get a correct contentsSize so that zoomToFit
+    // is calculated correctly.
+    requestLayoutIfNeeded();
+
+    // As a special case if we were zoomed to the initial scale at the beginning
+    // of the rotation then preserve that zoom level even when it is zoomToFit.
+    double scale = atInitialScale ? initialScale() : currentScale();
+
+    // Do our own clamping.
+    scale = clampedScale(scale);
+
+    if (hasPendingOrientation) {
+        // Set the fixed reported size here so that innerWidth|innerHeight works
+        // with this new scale.
+        TransformationMatrix rotationMatrix;
+        rotationMatrix.scale(scale);
+        IntRect viewportRect = IntRect(IntPoint::zero(), transformedActualVisibleSize);
+        IntRect actualVisibleRect = enclosingIntRect(rotationMatrix.inverse().mapRect(FloatRect(viewportRect)));
+        m_mainFrame->view()->setFixedReportedSize(actualVisibleRect.size());
+    }
+
+    // We're going to need to send a resize event to JavaScript because
+    // innerWidth and innerHeight depend on fixed reported size.
+    // This is how we support mobile pages where JavaScript resizes
+    // the page in order to get around the fixed layout size, e.g.
+    // google maps when it detects a mobile user agent.
+    if (shouldSendResizeEvent())
+        m_mainFrame->eventHandler()->sendResizeEvent();
+
+    // As a special case if we were anchored to the top left position at the beginning
+    // of the rotation then preserve that anchor.
+    FloatPoint anchor = centerOfVisibleContentsRect;
+    if (atTop)
+        anchor.setY(0);
+    if (atLeft)
+        anchor.setX(0);
+
+    // Try and zoom here with clamping on.
+    if (m_backingStore->d->shouldDirectRenderingToWindow()) {
+        bool success = zoomAboutPoint(scale, anchor, false /* enforceScaleClamping */, true /* forceRendering */);
+        if (!success && ensureFocusElementVisible)
+            ensureContentVisible(!newVisibleRectContainsOldVisibleRect);
+    } else if (!scheduleZoomAboutPoint(scale, anchor, false /* enforceScaleClamping */, true /* forceRendering */)) {
+        // Suspend all screen updates to the backingstore.
+        m_backingStore->d->suspendScreenAndBackingStoreUpdates();
+
+        // If the zoom failed, then we should still preserve the special case of scroll position.
+        IntPoint scrollPosition = this->scrollPosition();
+        if (atTop)
+            scrollPosition.setY(0);
+        if (atLeft)
+            scrollPosition.setX(0);
+        setScrollPosition(scrollPosition);
+
+        // These might have been altered even if we didn't zoom so notify the client.
+        notifyTransformedContentsSizeChanged();
+        notifyTransformedScrollChanged();
+
+        if (!needsLayout) {
+            // The visible tiles for scroll must be up-to-date before we blit since we are not performing a layout.
+            m_backingStore->d->updateTilesForScrollOrNotRenderedRegion();
+        }
+
+        if (ensureFocusElementVisible)
+            ensureContentVisible(!newVisibleRectContainsOldVisibleRect);
+
+        if (needsLayout) {
+            m_backingStore->d->resetTiles(true);
+            m_backingStore->d->updateTiles(false /* updateVisible */, false /* immediate */);
+        }
+
+        // If we need layout then render and blit, otherwise just blit as our viewport has changed.
+        m_backingStore->d->resumeScreenAndBackingStoreUpdates(needsLayout ? BackingStore::RenderAndBlit : BackingStore::Blit);
+    } else if (ensureFocusElementVisible)
+        ensureContentVisible(!newVisibleRectContainsOldVisibleRect);
+}
+
+void WebPage::setDefaultLayoutSize(int width, int height)
+{
+    IntSize size(width, height);
+    d->setDefaultLayoutSize(size);
+}
+
+void WebPagePrivate::setDefaultLayoutSize(const IntSize& size)
+{
+    if (size == m_defaultLayoutSize)
+        return;
+
+    IntSize screenSize = Platform::Graphics::Screen::size();
+    ASSERT(size.width() <= screenSize.width() && size.height() <= screenSize.height());
+    m_defaultLayoutSize = size.expandedTo(minimumLayoutSize).shrunkTo(screenSize);
+
+    bool needsLayout = setViewMode(viewMode());
+    if (needsLayout) {
+        setNeedsLayout();
+        if (!isLoading())
+            requestLayoutIfNeeded();
+    }
+}
+
+bool WebPage::mouseEvent(const Platform::MouseEvent& mouseEvent, bool* wheelDeltaAccepted)
+{
+    if (!d->m_mainFrame->view())
+        return false;
+
+    PluginView* pluginView = d->m_fullScreenPluginView.get();
+    if (pluginView)
+        return d->dispatchMouseEventToFullScreenPlugin(pluginView, mouseEvent);
+
+    if (mouseEvent.type() == Platform::MouseEvent::MouseAborted) {
+        d->m_mainFrame->eventHandler()->setMousePressed(false);
+        return false;
+    }
+
+    d->m_pluginMayOpenNewTab = true;
+
+    d->m_lastUserEventTimestamp = currentTime();
+    int clickCount = (d->m_selectionHandler->isSelectionActive() || mouseEvent.type() != Platform::MouseEvent::MouseMove) ? 1 : 0;
+
+    // Set the button type.
+    MouseButton buttonType = NoButton;
+    if (mouseEvent.isLeftButton())
+        buttonType = LeftButton;
+    else if (mouseEvent.isRightButton())
+        buttonType = RightButton;
+    else if (mouseEvent.isMiddleButton())
+        buttonType = MiddleButton;
+
+    // Create our event.
+    PlatformMouseEvent platformMouseEvent(d->mapFromTransformed(mouseEvent.position()),
+                                          d->mapFromTransformed(mouseEvent.screenPosition()),
+                                          toWebCoreMouseEventType(mouseEvent.type()), clickCount, buttonType, PointingDevice);
+    d->m_lastMouseEvent = platformMouseEvent;
+    bool success = d->handleMouseEvent(platformMouseEvent);
+
+    if (mouseEvent.wheelTicks()) {
+        PlatformWheelEvent wheelEvent(d->mapFromTransformed(mouseEvent.position()),
+                                      d->mapFromTransformed(mouseEvent.screenPosition()),
+                                      0, -mouseEvent.wheelDelta(),
+                                      0, -mouseEvent.wheelTicks(),
+                                      ScrollByPixelWheelEvent,
+                                      false /* shiftKey */, false /* ctrlKey */,
+                                      false /* altKey */, false /* metaKey */);
+        if (wheelDeltaAccepted)
+            *wheelDeltaAccepted = d->handleWheelEvent(wheelEvent);
+    } else if (wheelDeltaAccepted)
+        *wheelDeltaAccepted = false;
+
+    return success;
+}
+
+bool WebPagePrivate::dispatchMouseEventToFullScreenPlugin(PluginView* plugin, const Platform::MouseEvent& event)
+{
+    NPEvent npEvent;
+    NPMouseEvent mouseEvent;
+
+    mouseEvent.x = event.screenPosition().x();
+    mouseEvent.y = event.screenPosition().y();
+
+    switch (event.type()) {
+    case Platform::MouseEvent::MouseButtonDown:
+        mouseEvent.type = MOUSE_BUTTON_DOWN;
+        m_pluginMouseButtonPressed = true;
+        break;
+    case Platform::MouseEvent::MouseButtonUp:
+        mouseEvent.type = MOUSE_BUTTON_UP;
+        m_pluginMouseButtonPressed = false;
+        break;
+    case Platform::MouseEvent::MouseMove:
+        mouseEvent.type = MOUSE_MOTION;
+        break;
+    default:
+        return false;
+    }
+
+    mouseEvent.flags = 0;
+    mouseEvent.button = m_pluginMouseButtonPressed;
+
+    npEvent.type = NP_MouseEvent;
+    npEvent.data = &mouseEvent;
+
+    return plugin->dispatchFullScreenNPEvent(npEvent);
+}
+
+bool WebPagePrivate::handleMouseEvent(PlatformMouseEvent& mouseEvent)
+{
+    EventHandler* eventHandler = m_mainFrame->eventHandler();
+
+    if (mouseEvent.eventType() == MouseEventMoved)
+        return eventHandler->mouseMoved(mouseEvent);
+
+    if (mouseEvent.eventType() == MouseEventScroll)
+        return true;
+
+    Node* node = 0;
+    if (mouseEvent.inputMethod() == TouchScreen) {
+        const FatFingersResult lastFatFingersResult = m_touchEventHandler->lastFatFingersResult();
+
+        // Fat fingers can deal with shadow content.
+        node = lastFatFingersResult.node(FatFingersResult::ShadowContentNotAllowed);
+    }
+
+    if (!node) {
+        HitTestResult result = eventHandler->hitTestResultAtPoint(mapFromViewportToContents(mouseEvent.pos()), false /*allowShadowContent*/);
+        node = result.innerNode();
+    }
+
+    if (mouseEvent.eventType() == MouseEventPressed) {
+        if (m_inputHandler->willOpenPopupForNode(node)) {
+            // Do not allow any human generated mouse or keyboard events to select <option>s in the list box
+            // because we use a pop up dialog to handle the actual selections. This prevents options from
+            // being selected prior to displaying the pop up dialog. The contents of the listbox are for
+            // display only.
+            //
+            // FIXME: We explicitly do not forward this event to WebCore so as to preserve symmetry with
+            // the MouseEventReleased handling (below). This has the side-effect that mousedown events
+            // are not fired for human generated mouse press events. See RIM Bug #1579.
+
+            // We do focus <select>/<option> on mouse down so that a Focus event is fired and have the
+            // element painted in its focus state on repaint.
+            ASSERT(node->isElementNode());
+            if (node->isElementNode()) {
+                Element* element = static_cast<Element*>(node);
+                element->focus();
+            }
+        } else
+            eventHandler->handleMousePressEvent(mouseEvent);
+    } else if (mouseEvent.eventType() == MouseEventReleased) {
+        // FIXME: For <select> and <options> elements, we explicitly do not forward this event to WebCore so
+        // as to preserve symmetry with the MouseEventPressed handling (above). This has the side-effect that
+        // mouseup events are not fired on such elements for human generated mouse release events. See RIM Bug #1579.
+        if (!m_inputHandler->didNodeOpenPopup(node))
+            eventHandler->handleMouseReleaseEvent(mouseEvent);
+    }
+
+    return true;
+}
+
+bool WebPagePrivate::handleWheelEvent(PlatformWheelEvent& wheelEvent)
+{
+    return m_mainFrame->eventHandler()->handleWheelEvent(wheelEvent);
+}
+
+bool WebPage::touchEvent(const Platform::TouchEvent& event)
+{
+#if DEBUG_TOUCH_EVENTS
+    switch (event.m_type) {
+    case Platform::TouchEvent::TouchEnd:
+        Platform::log(Platform::LogLevelCritical, "WebPage::touchEvent Touch End");
+        break;
+    case Platform::TouchEvent::TouchStart:
+        Platform::log(Platform::LogLevelCritical, "WebPage::touchEvent Touch Start");
+        break;
+    case Platform::TouchEvent::TouchMove:
+        Platform::log(Platform::LogLevelCritical, "WebPage::touchEvent Touch Move");
+        break;
+    case Platform::TouchEvent::TouchCancel:
+        Platform::log(Platform::LogLevelCritical, "WebPage::touchCancel Touch Cancel");
+        break;
+    }
+
+    for (unsigned i = 0; i < event.m_points.size(); i++) {
+        switch (event.m_points[i].m_state) {
+        case Platform::TouchPoint::TouchPressed:
+            Platform::log(Platform::LogLevelCritical, "WebPage::touchEvent %d Touch Pressed (%d, %d)", event.m_points[i].m_id, event.m_points[i].m_pos.x(), event.m_points[i].m_pos.y());
+            break;
+        case Platform::TouchPoint::TouchReleased:
+            Platform::log(Platform::LogLevelCritical, "WebPage::touchEvent %d Touch Released (%d, %d)", event.m_points[i].m_id, event.m_points[i].m_pos.x(), event.m_points[i].m_pos.y());
+            break;
+        case Platform::TouchPoint::TouchMoved:
+            Platform::log(Platform::LogLevelCritical, "WebPage::touchEvent %d Touch Moved (%d, %d)", event.m_points[i].m_id, event.m_points[i].m_pos.x(), event.m_points[i].m_pos.y());
+            break;
+        case Platform::TouchPoint::TouchStationary:
+            Platform::log(Platform::LogLevelCritical, "WebPage::touchEvent %d Touch Stationary (%d, %d)", event.m_points[i].m_id, event.m_points[i].m_pos.x(), event.m_points[i].m_pos.y());
+            break;
+        }
+    }
+#endif
+
+#if ENABLE(TOUCH_EVENTS)
+    PluginView* pluginView = d->m_fullScreenPluginView.get();
+    if (pluginView)
+        return d->dispatchTouchEventToFullScreenPlugin(pluginView, event);
+
+    if (!d->m_mainFrame)
+        return false;
+
+    Platform::TouchEvent tEvent = event;
+    for (unsigned i = 0; i < event.m_points.size(); i++) {
+        tEvent.m_points[i].m_pos = d->mapFromTransformed(tEvent.m_points[i].m_pos);
+        tEvent.m_points[i].m_screenPos = d->mapFromTransformed(tEvent.m_points[i].m_screenPos);
+    }
+
+    Platform::Gesture tapGesture;
+    if (event.hasGesture(Platform::Gesture::SingleTap))
+        d->m_pluginMayOpenNewTab = true;
+    else if (tEvent.m_type == Platform::TouchEvent::TouchStart || tEvent.m_type == Platform::TouchEvent::TouchCancel)
+        d->m_pluginMayOpenNewTab = false;
+
+    bool handled = false;
+
+    if (d->m_needTouchEvents && !event.hasGesture(Platform::Gesture::Injected))
+        handled = d->m_mainFrame->eventHandler()->handleTouchEvent(PlatformTouchEvent(&tEvent));
+
+    // Unpress mouse if touch end is consumed by a JavaScript touch handler, otherwise the mouse state will remain pressed
+    // which could either mess up the internal mouse state or start text selection on the next mouse move/down.
+    if (tEvent.m_type == Platform::TouchEvent::TouchEnd && handled && d->m_mainFrame->eventHandler()->mousePressed())
+        d->m_touchEventHandler->touchEventCancel();
+
+    if (d->m_preventDefaultOnTouchStart) {
+        if (tEvent.m_type == Platform::TouchEvent::TouchEnd || tEvent.m_type == Platform::TouchEvent::TouchCancel)
+            d->m_preventDefaultOnTouchStart = false;
+        return true;
+    }
+
+    if (handled) {
+        if (tEvent.m_type == Platform::TouchEvent::TouchStart)
+            d->m_preventDefaultOnTouchStart = true;
+        return true;
+    }
+
+    if (event.hasGesture(Platform::Gesture::TouchHold))
+        d->m_touchEventHandler->touchHoldEvent();
+#endif
+
+    return false;
+}
+
+void WebPage::setScrollOriginPoint(const Platform::IntPoint& point)
+{
+    Platform::IntPoint untransformedPoint = d->mapFromTransformed(point);
+    d->setScrollOriginPoint(untransformedPoint);
+}
+
+void WebPagePrivate::setScrollOriginPoint(const Platform::IntPoint& point)
+{
+    m_inRegionScrollStartingNode = 0;
+
+    if (!m_hasInRegionScrollableAreas)
+        return;
+
+    m_client->notifyInRegionScrollingStartingPointChanged(inRegionScrollableAreasForPoint(point));
+}
+
+bool WebPagePrivate::dispatchTouchEventToFullScreenPlugin(PluginView* plugin, const Platform::TouchEvent& event)
+{
+    NPTouchEvent npTouchEvent;
+
+    if (event.hasGesture(Platform::Gesture::DoubleTap))
+        npTouchEvent.type = TOUCH_EVENT_DOUBLETAP;
+    else if (event.hasGesture(Platform::Gesture::TouchHold))
+        npTouchEvent.type = TOUCH_EVENT_TOUCHHOLD;
+    else {
+        switch (event.m_type) {
+        case Platform::TouchEvent::TouchStart:
+            npTouchEvent.type = TOUCH_EVENT_START;
+            break;
+        case Platform::TouchEvent::TouchEnd:
+            npTouchEvent.type = TOUCH_EVENT_END;
+            break;
+        case Platform::TouchEvent::TouchMove:
+            npTouchEvent.type = TOUCH_EVENT_MOVE;
+            break;
+        case Platform::TouchEvent::TouchCancel:
+            npTouchEvent.type = TOUCH_EVENT_CANCEL;
+            break;
+        default:
+            return false;
+        }
+    }
+
+    npTouchEvent.points = 0;
+    npTouchEvent.size = event.m_points.size();
+    if (npTouchEvent.size) {
+        npTouchEvent.points = new NPTouchPoint[npTouchEvent.size];
+        for (int i = 0; i < npTouchEvent.size; i++) {
+            npTouchEvent.points[i].touchId = event.m_points[i].m_id;
+            npTouchEvent.points[i].clientX = event.m_points[i].m_screenPos.x();
+            npTouchEvent.points[i].clientY = event.m_points[i].m_screenPos.y();
+            npTouchEvent.points[i].screenX = event.m_points[i].m_screenPos.x();
+            npTouchEvent.points[i].screenY = event.m_points[i].m_screenPos.y();
+            npTouchEvent.points[i].pageX = event.m_points[i].m_pos.x();
+            npTouchEvent.points[i].pageY = event.m_points[i].m_pos.y();
+        }
+    }
+
+    NPEvent npEvent;
+    npEvent.type = NP_TouchEvent;
+    npEvent.data = &npTouchEvent;
+
+    bool handled = plugin->dispatchFullScreenNPEvent(npEvent);
+
+    if (npTouchEvent.type == TOUCH_EVENT_DOUBLETAP && !handled) {
+        // Send Touch Up if double tap not consumed.
+        npTouchEvent.type = TOUCH_EVENT_END;
+        npEvent.data = &npTouchEvent;
+        handled = plugin->dispatchFullScreenNPEvent(npEvent);
+    }
+    delete[] npTouchEvent.points;
+    return handled;
+}
+
+bool WebPage::touchPointAsMouseEvent(const Platform::TouchPoint& point)
+{
+    PluginView* pluginView = d->m_fullScreenPluginView.get();
+    if (pluginView)
+        return d->dispatchTouchPointAsMouseEventToFullScreenPlugin(pluginView, point);
+
+    d->m_lastUserEventTimestamp = currentTime();
+
+    Platform::TouchPoint tPoint = point;
+    tPoint.m_pos = d->mapFromTransformed(tPoint.m_pos);
+    tPoint.m_screenPos = d->mapFromTransformed(tPoint.m_screenPos);
+
+    return d->m_touchEventHandler->handleTouchPoint(tPoint);
+}
+
+bool WebPagePrivate::dispatchTouchPointAsMouseEventToFullScreenPlugin(PluginView* pluginView, const Platform::TouchPoint& point)
+{
+    NPEvent npEvent;
+    NPMouseEvent mouse;
+
+    switch (point.m_state) {
+    case Platform::TouchPoint::TouchPressed:
+        mouse.type = MOUSE_BUTTON_DOWN;
+        break;
+    case Platform::TouchPoint::TouchReleased:
+        mouse.type = MOUSE_BUTTON_UP;
+        break;
+    case Platform::TouchPoint::TouchMoved:
+        mouse.type = MOUSE_MOTION;
+        break;
+    case Platform::TouchPoint::TouchStationary:
+        return false;
+    }
+
+    mouse.x = point.m_screenPos.x();
+    mouse.y = point.m_screenPos.y();
+    mouse.button = mouse.type != MOUSE_BUTTON_UP;
+    mouse.flags = 0;
+    npEvent.type = NP_MouseEvent;
+    npEvent.data = &mouse;
+
+    return pluginView->dispatchFullScreenNPEvent(npEvent);
+}
+
+void WebPage::touchEventCancel()
+{
+    d->m_pluginMayOpenNewTab = false;
+    d->m_touchEventHandler->touchEventCancel();
+}
+
+void WebPage::touchEventCancelAndClearFocusedNode()
+{
+    d->m_touchEventHandler->touchEventCancelAndClearFocusedNode();
+}
+
+Frame* WebPagePrivate::focusedOrMainFrame() const
+{
+    return m_page->focusController()->focusedOrMainFrame();
+}
+
+void WebPagePrivate::clearFocusNode()
+{
+    Frame* frame = focusedOrMainFrame();
+    if (!frame)
+        return;
+    ASSERT(frame->document());
+
+    if (frame->document()->focusedNode())
+        frame->page()->focusController()->setFocusedNode(0, frame);
+}
+
+bool WebPagePrivate::scrollNodeRecursively(Node* node, const IntSize& delta)
+{
+    if (delta.isZero())
+        return true;
+
+    if (!node)
+        return false;
+
+    RenderObject* renderer = node->renderer();
+    if (!renderer)
+        return false;
+
+    FrameView* view = renderer->view()->frameView();
+    if (!view)
+        return false;
+
+    // Try scrolling the renderer.
+    if (scrollRenderer(renderer, delta))
+        return true;
+
+    // We've hit the page, don't scroll it and return false.
+    if (view == m_mainFrame->view())
+        return false;
+
+    // Try scrolling the FrameView.
+    if (canScrollInnerFrame(view->frame())) {
+        IntSize viewDelta = delta;
+        IntPoint newViewOffset = view->scrollPosition();
+        IntPoint maxViewOffset = view->maximumScrollPosition();
+        adjustScrollDelta(maxViewOffset, newViewOffset, viewDelta);
+
+        if (!viewDelta.isZero()) {
+            view->setCanBlitOnScroll(false);
+
+            BackingStoreClient* backingStoreClient = backingStoreClientForFrame(view->frame());
+            if (backingStoreClient) {
+                backingStoreClient->setIsClientGeneratedScroll(true);
+                backingStoreClient->setIsScrollNotificationSuppressed(true);
+            }
+
+            m_inRegionScrollStartingNode = view->frame()->document();
+
+            view->scrollBy(viewDelta);
+
+            if (backingStoreClient) {
+                backingStoreClient->setIsClientGeneratedScroll(false);
+                backingStoreClient->setIsScrollNotificationSuppressed(false);
+            }
+
+            return true;
+        }
+    }
+
+    // Try scrolling the node of the enclosing frame.
+    Frame* frame = node->document()->frame();
+    if (frame) {
+        Node* ownerNode = frame->ownerElement();
+        if (scrollNodeRecursively(ownerNode, delta))
+            return true;
+    }
+
+    return false;
+}
+
+void WebPagePrivate::adjustScrollDelta(const IntPoint& maxOffset, const IntPoint& currentOffset, IntSize& delta) const
+{
+    if (currentOffset.x() + delta.width() > maxOffset.x())
+        delta.setWidth(min(maxOffset.x() - currentOffset.x(), delta.width()));
+
+    if (currentOffset.x() + delta.width() < 0)
+        delta.setWidth(max(-currentOffset.x(), delta.width()));
+
+    if (currentOffset.y() + delta.height() > maxOffset.y())
+        delta.setHeight(min(maxOffset.y() - currentOffset.y(), delta.height()));
+
+    if (currentOffset.y() + delta.height() < 0)
+        delta.setHeight(max(-currentOffset.y(), delta.height()));
+}
+
+static Node* enclosingLayerNode(RenderLayer*);
+
+bool WebPagePrivate::scrollRenderer(RenderObject* renderer, const IntSize& delta)
+{
+    RenderLayer* layer = renderer->enclosingLayer();
+    if (!layer)
+        return false;
+
+    // Try to scroll layer.
+    bool restrictedByLineClamp = false;
+    if (renderer->parent())
+        restrictedByLineClamp = !renderer->parent()->style()->lineClamp().isNone();
+
+    if (renderer->hasOverflowClip() && !restrictedByLineClamp) {
+        IntSize layerDelta = delta;
+        IntPoint maxOffset(layer->scrollWidth() - layer->renderBox()->clientWidth(), layer->scrollHeight() - layer->renderBox()->clientHeight());
+        IntPoint currentOffset(layer->scrollXOffset(), layer->scrollYOffset());
+        adjustScrollDelta(maxOffset, currentOffset, layerDelta);
+        if (!layerDelta.isZero()) {
+            m_inRegionScrollStartingNode = enclosingLayerNode(layer);
+            IntPoint newOffset = currentOffset + layerDelta;
+            layer->scrollToOffset(newOffset.x(), newOffset.y());
+            renderer->repaint(true);
+            return true;
+        }
+    }
+
+    while (layer = layer->parent()) {
+        if (canScrollRenderBox(layer->renderBox()))
+            return scrollRenderer(layer->renderBox(), delta);
+    }
+
+    return false;
+}
+
+static void handleScrolling(unsigned short character, WebPagePrivate* scroller)
+{
+    const int scrollFactor = 20;
+    int dx = 0, dy = 0;
+    switch (character) {
+    case KEYCODE_LEFT:
+        dx = -scrollFactor;
+        break;
+    case KEYCODE_RIGHT:
+        dx = scrollFactor;
+        break;
+    case KEYCODE_UP:
+        dy = -scrollFactor;
+        break;
+    case KEYCODE_DOWN:
+        dy = scrollFactor;
+        break;
+    case KEYCODE_PG_UP:
+        ASSERT(scroller);
+        dy = scrollFactor - scroller->actualVisibleSize().height();
+        break;
+    case KEYCODE_PG_DOWN:
+        ASSERT(scroller);
+        dy = scroller->actualVisibleSize().height() - scrollFactor;
+        break;
+    }
+
+    if (dx || dy) {
+        // Don't use the scrollBy function because it triggers the scroll as originating from BlackBerry
+        // but then it expects a separate invalidate which isn't sent in this case.
+        ASSERT(scroller && scroller->m_mainFrame && scroller->m_mainFrame->view());
+        IntPoint pos(scroller->scrollPosition() + IntSize(dx, dy));
+
+        // Prevent over scrolling for arrows and Page up/down.
+        if (pos.x() < 0)
+            pos.setX(0);
+        if (pos.y() < 0)
+            pos.setY(0);
+        if (pos.x() + scroller->actualVisibleSize().width() > scroller->contentsSize().width())
+            pos.setX(scroller->contentsSize().width() - scroller->actualVisibleSize().width());
+        if (pos.y() + scroller->actualVisibleSize().height() > scroller->contentsSize().height())
+            pos.setY(scroller->contentsSize().height() - scroller->actualVisibleSize().height());
+
+        scroller->m_mainFrame->view()->setScrollPosition(pos);
+        scroller->m_client->scrollChanged(pos);
+    }
+}
+
+bool WebPage::keyEvent(const Platform::KeyboardEvent& keyboardEvent)
+{
+    if (!d->m_mainFrame->view())
+        return false;
+
+    ASSERT(d->m_page->focusController());
+
+    bool handled = d->m_inputHandler->handleKeyboardInput(keyboardEvent);
+
+    if (!handled && keyboardEvent.type() == Platform::KeyboardEvent::KeyDown && !d->m_inputHandler->isInputMode()) {
+        IntPoint previousPos = d->scrollPosition();
+        handleScrolling(keyboardEvent.character(), d);
+        handled = previousPos != d->scrollPosition();
+    }
+
+    return handled;
+}
+
+bool WebPage::deleteTextRelativeToCursor(unsigned int leftOffset, unsigned int rightOffset)
+{
+    return d->m_inputHandler->deleteTextRelativeToCursor(leftOffset, rightOffset);
+}
+
+spannable_string_t* WebPage::selectedText(int32_t flags)
+{
+    return d->m_inputHandler->selectedText(flags);
+}
+
+spannable_string_t* WebPage::textBeforeCursor(int32_t length, int32_t flags)
+{
+    return d->m_inputHandler->textBeforeCursor(length, flags);
+}
+
+spannable_string_t* WebPage::textAfterCursor(int32_t length, int32_t flags)
+{
+    return d->m_inputHandler->textAfterCursor(length, flags);
+}
+
+extracted_text_t* WebPage::extractedTextRequest(extracted_text_request_t* request, int32_t flags)
+{
+    return d->m_inputHandler->extractedTextRequest(request, flags);
+}
+
+int32_t WebPage::setComposingRegion(int32_t start, int32_t end)
+{
+    return d->m_inputHandler->setComposingRegion(start, end);
+}
+
+int32_t WebPage::finishComposition()
+{
+    return d->m_inputHandler->finishComposition();
+}
+
+int32_t WebPage::setComposingText(spannable_string_t* spannableString, int32_t relativeCursorPosition)
+{
+    return d->m_inputHandler->setComposingText(spannableString, relativeCursorPosition);
+}
+
+int32_t WebPage::commitText(spannable_string_t* spannableString, int32_t relativeCursorPosition)
+{
+    return d->m_inputHandler->commitText(spannableString, relativeCursorPosition);
+}
+
+void WebPage::spellCheckingEnabled(bool enabled)
+{
+    static_cast<EditorClientBlackBerry*>(d->m_page->editorClient())->enableSpellChecking(enabled);
+}
+
+void WebPage::selectionCancelled()
+{
+    d->m_selectionHandler->cancelSelection();
+}
+
+bool WebPage::selectionContains(const Platform::IntPoint& point)
+{
+    return d->m_selectionHandler->selectionContains(d->mapFromTransformed(point));
+}
+
+WebString WebPage::title() const
+{
+    if (d->m_mainFrame->document())
+        return d->m_mainFrame->loader()->documentLoader()->title().string();
+    return WebString();
+}
+
+WebString WebPage::selectedText() const
+{
+    return d->m_selectionHandler->selectedText();
+}
+
+WebString WebPage::cutSelectedText()
+{
+    WebString selectedText = d->m_selectionHandler->selectedText();
+    if (!selectedText.isEmpty())
+        d->m_inputHandler->deleteSelection();
+    return selectedText;
+}
+
+void WebPage::insertText(const WebString& string)
+{
+    d->m_inputHandler->insertText(string);
+}
+
+void WebPage::clearCurrentInputField()
+{
+    d->m_inputHandler->clearField();
+}
+
+void WebPage::cut()
+{
+    d->m_inputHandler->cut();
+}
+
+void WebPage::copy()
+{
+    d->m_inputHandler->copy();
+}
+
+void WebPage::paste()
+{
+    d->m_inputHandler->paste();
+}
+
+void WebPage::setSelection(const Platform::IntPoint& startPoint, const Platform::IntPoint& endPoint)
+{
+    // Transform this events coordinates to webkit content coordinates.
+    // FIXME: Don't transform the sentinel, because it may be transformed to a floating number
+    // which could be rounded to 0 or other numbers. This workaround should be removed after
+    // the error of roundUntransformedPoint() is fixed.
+    bool invalidPoint = IntPoint(startPoint) == DOMSupport::InvalidPoint;
+    IntPoint start = invalidPoint ? DOMSupport::InvalidPoint : d->mapFromTransformed(startPoint);
+    invalidPoint = IntPoint(endPoint) == DOMSupport::InvalidPoint;
+    IntPoint end = invalidPoint ? DOMSupport::InvalidPoint : d->mapFromTransformed(endPoint);
+
+    d->m_selectionHandler->setSelection(start, end);
+}
+
+void WebPage::setCaretPosition(const Platform::IntPoint& position)
+{
+    // Handled by selection handler as it's point based.
+    // Transform this events coordinates to webkit content coordinates.
+    d->m_selectionHandler->setCaretPosition(d->mapFromTransformed(position));
+}
+
+void WebPage::selectAtPoint(const Platform::IntPoint& location)
+{
+    // Transform this events coordinates to webkit content coordinates if it
+    // is not the sentinel value.
+    IntPoint selectionLocation =
+            IntPoint(location) == DOMSupport::InvalidPoint ?
+            DOMSupport::InvalidPoint :
+            d->mapFromTransformed(location);
+
+    d->m_selectionHandler->selectAtPoint(selectionLocation);
+}
+
+// Returned scroll position is in transformed coordinates.
+Platform::IntPoint WebPage::scrollPosition() const
+{
+    return d->transformedScrollPosition();
+}
+
+// Setting the scroll position is in transformed coordinates.
+void WebPage::setScrollPosition(const Platform::IntPoint& point)
+{
+    if (d->transformedPointEqualsUntransformedPoint(point, d->scrollPosition()))
+        return;
+
+    // If the user recently performed an event, this new scroll position
+    // could possibly be a result of that. Or not, this is just a heuristic.
+    if (currentTime() - d->m_lastUserEventTimestamp < manualScrollInterval)
+        d->m_userPerformedManualScroll = true;
+
+    d->m_backingStoreClient->setIsClientGeneratedScroll(true);
+    d->m_mainFrame->view()->setCanOverscroll(true);
+    d->setScrollPosition(d->mapFromTransformed(point));
+    d->m_mainFrame->view()->setCanOverscroll(false);
+    d->m_backingStoreClient->setIsClientGeneratedScroll(false);
+}
+
+WebString WebPage::textEncoding()
+{
+    Frame* frame = d->focusedOrMainFrame();
+    if (!frame)
+        return "";
+
+    Document* document = frame->document();
+    if (!document)
+        return "";
+
+    return document->loader()->writer()->encoding();
+}
+
+WebString WebPage::forcedTextEncoding()
+{
+    Frame* frame = d->focusedOrMainFrame();
+    if (!frame)
+        return "";
+
+    Document* document = frame->document();
+    if (!document)
+        return "";
+
+    return document->loader()->overrideEncoding();
+}
+
+void WebPage::setForcedTextEncoding(const char* encoding)
+{
+    if (encoding && d->focusedOrMainFrame() && d->focusedOrMainFrame()->loader() && d->focusedOrMainFrame()->loader())
+        return d->focusedOrMainFrame()->loader()->reloadWithOverrideEncoding(encoding);
+}
+
+// FIXME: Move to DOMSupport.
+bool WebPagePrivate::canScrollInnerFrame(Frame* frame) const
+{
+    if (!frame || !frame->view())
+        return false;
+
+    // Not having an owner element means that we are on the mainframe.
+    if (!frame->ownerElement())
+        return false;
+
+    ASSERT(frame != m_mainFrame);
+
+    IntSize visibleSize = frame->view()->visibleContentRect().size();
+    IntSize contentsSize = frame->view()->contentsSize();
+
+    bool canBeScrolled = contentsSize.height() > visibleSize.height() || contentsSize.width() > visibleSize.width();
+
+    // Lets also consider the 'overflow-{x,y} property set directly to the {i}frame tag.
+    return canBeScrolled && (frame->ownerElement()->scrollingMode() != ScrollbarAlwaysOff);
+}
+
+// The RenderBox::canbeScrolledAndHasScrollableArea method returns true for the
+// following scenario, for example:
+// (1) a div that has a vertical overflow but no horizontal overflow
+//     with overflow-y: hidden and overflow-x: auto set.
+// The version below fixes it.
+// FIXME: Fix RenderBox::canBeScrolledAndHasScrollableArea method instead.
+bool WebPagePrivate::canScrollRenderBox(RenderBox* box)
+{
+    if (!box || !box->hasOverflowClip())
+        return false;
+
+    if (box->scrollsOverflowX() && (box->scrollWidth() != box->clientWidth())
+        || box->scrollsOverflowY() && (box->scrollHeight() != box->clientHeight()))
+        return true;
+
+    Node* node = box->node();
+    return node && (node->rendererIsEditable() || node->isDocumentNode());
+}
+
+static RenderLayer* parentLayer(RenderLayer* layer)
+{
+    ASSERT(layer);
+
+    if (layer->parent())
+        return layer->parent();
+
+    RenderObject* renderer = layer->renderer();
+    if (renderer->document() && renderer->document()->ownerElement() && renderer->document()->ownerElement()->renderer())
+        return renderer->document()->ownerElement()->renderer()->enclosingLayer();
+
+    return 0;
+}
+
+// FIXME: Make RenderLayer::enclosingElement public so this one can be removed.
+static Node* enclosingLayerNode(RenderLayer* layer)
+{
+    for (RenderObject* r = layer->renderer(); r; r = r->parent()) {
+        if (Node* e = r->node())
+            return e;
+    }
+    ASSERT_NOT_REACHED();
+    return 0;
+}
+
+static void pushBackInRegionScrollable(std::vector<Platform::ScrollViewBase>& vector, InRegionScrollableArea scroller, WebPagePrivate* webPage)
+{
+    ASSERT(webPage);
+    ASSERT(!scroller.isNull());
+
+    scroller.setCanPropagateScrollingToEnclosingScrollable(!isNonRenderViewFixedPositionedContainer(scroller.layer()));
+    vector.push_back(scroller);
+    if (vector.size() == 1) {
+        // FIXME: Use RenderLayer::renderBox()->node() instead?
+        webPage->m_inRegionScrollStartingNode = enclosingLayerNode(scroller.layer());
+    }
+}
+
+std::vector<Platform::ScrollViewBase> WebPagePrivate::inRegionScrollableAreasForPoint(const Platform::IntPoint& point)
+{
+    std::vector<Platform::ScrollViewBase> validReturn;
+    std::vector<Platform::ScrollViewBase> emptyReturn;
+
+    HitTestResult result = m_mainFrame->eventHandler()->hitTestResultAtPoint(mapFromViewportToContents(point), false /*allowShadowContent*/);
+    Node* node = result.innerNonSharedNode();
+    if (!node)
+        return emptyReturn;
+
+    RenderObject* renderer = node->renderer();
+    // FIXME: Validate with elements with visibility:hidden.
+    if (!renderer)
+        return emptyReturn;
+
+    RenderLayer* layer = renderer->enclosingLayer();
+
+    do {
+        RenderObject* renderer = layer->renderer();
+
+        if (renderer->isRenderView()) {
+            if (RenderView* renderView = toRenderView(renderer)) {
+                FrameView* view = renderView->frameView();
+                if (!view)
+                    return emptyReturn;
+
+                if (canScrollInnerFrame(view->frame())) {
+                    pushBackInRegionScrollable(validReturn, InRegionScrollableArea(this, layer), this);
+                    continue;
+                }
+            }
+        } else if (canScrollRenderBox(layer->renderBox())) {
+            pushBackInRegionScrollable(validReturn, InRegionScrollableArea(this, layer), this);
+            continue;
+        }
+
+        // If we run into a fix positioned layer, set the last scrollable in-region object
+        // as not able to propagate scroll to its parent scrollable.
+        if (isNonRenderViewFixedPositionedContainer(layer) && validReturn.size()) {
+            Platform::ScrollViewBase& end = validReturn.back();
+            end.setCanPropagateScrollingToEnclosingScrollable(false);
+        }
+
+    } while (layer = parentLayer(layer));
+
+    if (validReturn.empty())
+        return emptyReturn;
+
+    return validReturn;
+}
+
+BackingStore* WebPage::backingStore() const
+{
+    return d->m_backingStore;
+}
+
+bool WebPage::zoomToFit()
+{
+    if (d->contentsSize().isEmpty() || !d->isUserScalable())
+        return false;
+
+    d->m_userPerformedManualZoom = true;
+
+    // TODO: We may need to use (0,0) as the anchor point when textReflow is enabled.
+    // IF the minimum font size is ginormous, we may still want the scroll position to be 0,0.
+    return d->zoomAboutPoint(d->zoomToFitScale(), d->centerOfVisibleContentsRect());
+}
+
+void WebPagePrivate::setTextReflowAnchorPoint(const Platform::IntPoint& focalPoint)
+{
+    // Should only be invoked when text reflow is enabled.
+    ASSERT(m_webPage->settings()->textReflowMode() == WebSettings::TextReflowEnabled);
+
+    m_currentPinchZoomNode = bestNodeForZoomUnderPoint(focalPoint);
+    if (!m_currentPinchZoomNode)
+        return;
+
+    IntRect nodeRect = rectForNode(m_currentPinchZoomNode.get());
+    m_anchorInNodeRectRatio.set(static_cast<float>(mapFromTransformed(focalPoint).x() - nodeRect.x()) / nodeRect.width(),
+                                static_cast<float>(mapFromTransformed(focalPoint).y() - nodeRect.y()) / nodeRect.height());
+}
+
+bool WebPage::pinchZoomAboutPoint(double scale, int x, int y)
+{
+    IntPoint anchor(x, y);
+    d->m_userPerformedManualZoom = true;
+    d->m_userPerformedManualScroll = true;
+
+    if (d->m_webPage->settings()->textReflowMode() == WebSettings::TextReflowEnabled) {
+        d->setTextReflowAnchorPoint(anchor);
+        // Theoretically, d->nodeForZoomUnderPoint(anchor) can return null.
+        if (!d->m_currentPinchZoomNode)
+            return false;
+    }
+
+    return d->zoomAboutPoint(scale, d->mapFromTransformed(anchor));
+}
+
+#if ENABLE(VIEWPORT_REFLOW)
+void WebPagePrivate::toggleTextReflowIfEnabledForBlockZoomOnly(bool shouldEnableTextReflow)
+{
+    if (m_webPage->settings()->textReflowMode() == WebSettings::TextReflowEnabledOnlyForBlockZoom)
+        m_page->settings()->setTextReflowEnabled(shouldEnableTextReflow);
+}
+#endif
+
+bool WebPage::blockZoom(int x, int y)
+{
+    if (!d->m_mainFrame->view() || !d->isUserScalable())
+        return false;
+
+    Node* node = d->bestNodeForZoomUnderPoint(IntPoint(x, y));
+    if (!node)
+        return false;
+
+    IntRect nodeRect = d->rectForNode(node);
+    IntRect blockRect;
+    bool endOfBlockZoomMode = d->compareNodesForBlockZoom(d->m_currentBlockZoomAdjustedNode.get(), node);
+    const double oldScale = d->m_transformationMatrix->m11();
+    double newScale = 0;
+    const double margin = endOfBlockZoomMode ? 0 : blockZoomMargin * 2 * oldScale;
+    bool isFirstZoom = false;
+
+    if (endOfBlockZoomMode) {
+        // End of block zoom mode
+        IntRect rect = d->blockZoomRectForNode(node);
+        blockRect = IntRect(0, rect.y(), d->transformedContentsSize().width(), d->transformedContentsSize().height() - rect.y());
+        d->m_shouldReflowBlock = false;
+    } else {
+        // Start/continue block zoom mode
+        Node* tempBlockZoomAdjustedNode = d->m_currentBlockZoomAdjustedNode.get();
+        blockRect = d->blockZoomRectForNode(node);
+
+        // Don't use a block if it is too close to the size of the actual contents.
+        // We allow this for images only so that they can be zoomed tight to the screen.
+        if (!node->hasTagName(HTMLNames::imgTag)) {
+            IntRect tRect = d->mapFromTransformed(blockRect);
+            int blockArea = tRect.width() * tRect.height();
+            int pageArea = d->contentsSize().width() * d->contentsSize().height();
+            double blockToPageRatio = static_cast<double>(1 - blockArea / pageArea);
+            if (blockToPageRatio < minimumExpandingRatio) {
+                // Restore old adjust node because zoom was canceled.
+                d->m_currentBlockZoomAdjustedNode = tempBlockZoomAdjustedNode;
+                return false;
+            }
+        }
+
+        if (blockRect.isEmpty() || !blockRect.width() || !blockRect.height())
+            return false;
+
+        if (!d->m_currentBlockZoomNode.get())
+            isFirstZoom = true;
+
+        d->m_currentBlockZoomNode = node;
+        d->m_shouldReflowBlock = true;
+    }
+
+    newScale = std::min(d->newScaleForBlockZoomRect(blockRect, oldScale, margin), d->maxBlockZoomScale());
+    newScale = std::max(newScale, minimumScale());
+
+#if DEBUG_BLOCK_ZOOM
+    // Render the double tap point for visual reference.
+    IntRect renderRect(x, y, 1, 1);
+    renderRect = d->mapFromTransformedContentsToTransformedViewport(renderRect);
+    IntSize viewportSize = d->transformedViewportSize();
+    renderRect.intersect(IntRect(0, 0, viewportSize.width(), viewportSize.height()));
+    d->m_backingStore->d->clearWindow(renderRect, 0, 0, 0);
+    d->m_backingStore->d->invalidateWindow(renderRect);
+
+    // Uncomment this to return in order to see the blocks being selected.
+    // d->m_client->zoomChanged(isMinZoomed(), isMaxZoomed(), isAtInitialZoom(), currentZoomLevel());
+    // return true;
+#endif
+
+#if ENABLE(VIEWPORT_REFLOW)
+    // If reflowing, adjust the reflow-width of text node to make sure the font is a reasonable size.
+    if (d->m_currentBlockZoomNode && d->m_shouldReflowBlock && settings()->textReflowMode() != WebSettings::TextReflowDisabled) {
+        RenderObject* renderer = d->m_currentBlockZoomNode->renderer();
+        if (renderer && renderer->isText()) {
+            double newFontSize = renderer->style()->fontSize() * newScale;
+            if (newFontSize < d->m_webSettings->defaultFontSize()) {
+                newScale = std::min(static_cast<double>(d->m_webSettings->defaultFontSize()) / renderer->style()->fontSize(), d->maxBlockZoomScale());
+                newScale = std::max(newScale, minimumScale());
+            }
+            blockRect.setWidth(oldScale * static_cast<double>(d->transformedActualVisibleSize().width()) / newScale);
+            // Re-calculate the scale here to take in to account the margin.
+            newScale = std::min(d->newScaleForBlockZoomRect(blockRect, oldScale, margin), d->maxBlockZoomScale());
+            newScale = std::max(newScale, minimumScale()); // Still, it's not allowed to be smaller than minimum scale.
+        }
+    }
+#endif
+
+    // Align the zoomed block in the screen.
+    double newBlockHeight = d->mapFromTransformed(blockRect).height();
+    double newBlockWidth = d->mapFromTransformed(blockRect).width();
+    double scaledViewportWidth = static_cast<double>(d->actualVisibleSize().width()) * oldScale / newScale;
+    double scaledViewportHeight = static_cast<double>(d->actualVisibleSize().height()) * oldScale / newScale;
+    double dx = std::max(0.0, (scaledViewportWidth - newBlockWidth) / 2.0);
+    double dy = std::max(0.0, (scaledViewportHeight - newBlockHeight) / 2.0);
+
+    RenderObject* renderer = d->m_currentBlockZoomAdjustedNode->renderer();
+    FloatPoint anchor;
+    FloatPoint topLeftPoint(d->mapFromTransformed(blockRect).location());
+    if (renderer && renderer->isText()) {
+        ETextAlign textAlign = renderer->style()->textAlign();
+        switch (textAlign) {
+        case CENTER:
+        case WEBKIT_CENTER:
+            anchor = FloatPoint(nodeRect.x() + (nodeRect.width() - scaledViewportWidth) / 2, topLeftPoint.y());
+            break;
+        case LEFT:
+        case WEBKIT_LEFT:
+            anchor = topLeftPoint;
+            break;
+        case RIGHT:
+        case WEBKIT_RIGHT:
+            anchor = FloatPoint(nodeRect.x() + nodeRect.width() - scaledViewportWidth, topLeftPoint.y());
+            break;
+        case TAAUTO:
+        case JUSTIFY:
+        default:
+            if (renderer->style()->isLeftToRightDirection())
+                anchor = topLeftPoint;
+            else
+                anchor = FloatPoint(nodeRect.x() + nodeRect.width() - scaledViewportWidth, topLeftPoint.y());
+            break;
+        }
+    } else
+        anchor = renderer->style()->isLeftToRightDirection() ? topLeftPoint : FloatPoint(nodeRect.x() + nodeRect.width() - scaledViewportWidth, topLeftPoint.y());
+
+    if (newBlockHeight <= scaledViewportHeight) {
+        // The block fits in the viewport so center it.
+        d->m_finalBlockPoint = FloatPoint(anchor.x() - dx, anchor.y() - dy);
+    } else {
+        // The block is longer than the viewport so top align it and add 3 pixel margin.
+        d->m_finalBlockPoint = FloatPoint(anchor.x() - dx, anchor.y() - 3);
+    }
+
+#if ENABLE(VIEWPORT_REFLOW)
+    // We don't know how long the reflowed block will be so we position it at the top of the screen with a small margin.
+    if (settings()->textReflowMode() != WebSettings::TextReflowDisabled) {
+        d->m_finalBlockPoint = FloatPoint(anchor.x() - dx, anchor.y() - 3);
+        d->m_finalBlockPointReflowOffset = FloatPoint(-dx, -3);
+    }
+#endif
+
+    // Make sure that the original node rect is visible in the screen after the zoom. This is necessary because the identified block rect might
+    // not be the same as the original node rect, and it could force the original node rect off the screen.
+    FloatRect br(anchor, FloatSize(scaledViewportWidth, scaledViewportHeight));
+    IntPoint clickPoint = d->mapFromTransformed(IntPoint(x, y));
+    if (!br.contains(clickPoint)) {
+        d->m_finalBlockPointReflowOffset.move(0, (clickPoint.y() - scaledViewportHeight / 2) - d->m_finalBlockPoint.y());
+        d->m_finalBlockPoint = FloatPoint(d->m_finalBlockPoint.x(), clickPoint.y() - scaledViewportHeight / 2);
+    }
+
+    // Clamp the finalBlockPoint to not cause any overflow scrolling.
+    if (d->m_finalBlockPoint.x() < 0) {
+        d->m_finalBlockPoint.setX(0);
+        d->m_finalBlockPointReflowOffset.setX(0);
+    } else if (d->m_finalBlockPoint.x() + scaledViewportWidth > d->contentsSize().width()) {
+        d->m_finalBlockPoint.setX(d->contentsSize().width() - scaledViewportWidth);
+        d->m_finalBlockPointReflowOffset.setX(0);
+    }
+
+    if (d->m_finalBlockPoint.y() < 0) {
+        d->m_finalBlockPoint.setY(0);
+        d->m_finalBlockPointReflowOffset.setY(0);
+    } else if (d->m_finalBlockPoint.y() + scaledViewportHeight > d->contentsSize().height()) {
+        d->m_finalBlockPoint.setY(d->contentsSize().height() - scaledViewportHeight);
+        d->m_finalBlockPointReflowOffset.setY(0);
+    }
+
+    d->m_finalBlockPoint = d->mapToTransformedFloatPoint(d->m_finalBlockPoint);
+
+    // Don't block zoom if the user is zooming and the new scale is only marginally different from the
+    // oldScale with only a marginal change in scroll position. Ignore scroll difference in the special case
+    // that the zoom level is the minimumScale.
+    if (!endOfBlockZoomMode && abs(newScale - oldScale) / oldScale < minimumExpandingRatio) {
+        const double minimumDisplacement = minimumExpandingRatio * d->transformedActualVisibleSize().width();
+        if (oldScale == d->minimumScale() || (distanceBetweenPoints(roundTransformedPoint(d->mapToTransformed(d->scrollPosition())), roundTransformedPoint(d->m_finalBlockPoint)) < minimumDisplacement && abs(newScale - oldScale) / oldScale < 0.10)) {
+            if (isFirstZoom) {
+                d->resetBlockZoom();
+                return false;
+            }
+            // Zoom out of block zoom.
+            blockZoom(x, y);
+            return true;
+        }
+    }
+
+    d->m_blockZoomFinalScale = newScale;
+
+    // We set this here to make sure we don't try to re-render the page at a different zoom level during loading.
+    d->m_userPerformedManualZoom = true;
+    d->m_userPerformedManualScroll = true;
+    d->m_client->animateBlockZoom(d->m_finalBlockPoint, d->m_blockZoomFinalScale);
+
+    return true;
+}
+
+bool WebPage::isMaxZoomed() const
+{
+    return (d->currentScale() == d->maximumScale()) || !d->isUserScalable();
+}
+
+bool WebPage::isMinZoomed() const
+{
+    return (d->currentScale() == d->minimumScale()) || !d->isUserScalable();
+}
+
+bool WebPage::isAtInitialZoom() const
+{
+    return (d->currentScale() == d->initialScale()) || !d->isUserScalable();
+}
+
+bool WebPagePrivate::shouldZoomOnEscape() const
+{
+    if (!isUserScalable())
+        return false;
+
+    // If the initial scale is not reachable, don't try to zoom.
+    if (initialScale() < minimumScale() || initialScale() > maximumScale())
+        return false;
+
+    // Don't ever zoom in when we press escape.
+    if (initialScale() >= currentScale())
+        return false;
+
+    return currentScale() != initialScale();
+}
+
+void WebPage::zoomToInitialScale()
+{
+    if (!d->isUserScalable())
+        return;
+
+    d->zoomAboutPoint(d->initialScale(), d->centerOfVisibleContentsRect());
+}
+
+bool WebPage::zoomToOneOne()
+{
+    if (!d->isUserScalable())
+        return false;
+
+    double scale = 1;
+    return d->zoomAboutPoint(scale, d->centerOfVisibleContentsRect());
+}
+
+Platform::IntRect WebPage::focusNodeRect()
+{
+    return d->focusNodeRect();
+}
+
+void WebPage::setFocused(bool focused)
+{
+    FocusController* focusController = d->m_page->focusController();
+    focusController->setActive(focused);
+    if (focused) {
+        Frame* frame = focusController->focusedFrame();
+        if (!frame)
+            focusController->setFocusedFrame(d->m_mainFrame);
+    }
+    focusController->setFocused(focused);
+}
+
+bool WebPage::findNextString(const char* text, bool forward)
+{
+    return d->m_inPageSearchManager->findNextString(String::fromUTF8(text), forward);
+}
+
+void WebPage::runLayoutTests()
+{
+#if ENABLE_DRT
+    // FIXME: do we need API to toggle this?
+    d->m_page->settings()->setDeveloperExtrasEnabled(true);
+
+    if (!d->m_dumpRenderTree)
+        d->m_dumpRenderTree = new DumpRenderTree(this);
+    d->m_dumpRenderTree->runTests();
+#endif
+}
+
+bool WebPage::enableScriptDebugger()
+{
+#if ENABLE(JAVASCRIPT_DEBUGGER)
+    if (d->m_scriptDebugger)
+        return true;
+
+    d->m_scriptDebugger = adoptPtr(new JavaScriptDebuggerBlackBerry(this->d));
+
+    return !!d->m_scriptDebugger;
+#endif
+}
+
+bool WebPage::disableScriptDebugger()
+{
+#if ENABLE(JAVASCRIPT_DEBUGGER)
+    if (!d->m_scriptDebugger)
+        return true;
+
+    d->m_scriptDebugger.clear();
+    return true;
+#endif
+}
+
+void WebPage::addBreakpoint(const unsigned short* url, unsigned urlLength, int lineNumber, const unsigned short* condition, unsigned conditionLength)
+{
+#if ENABLE(JAVASCRIPT_DEBUGGER)
+    if (d->m_scriptDebugger)
+        d->m_scriptDebugger->addBreakpoint(url, urlLength, lineNumber, condition, conditionLength);
+#endif
+}
+
+void WebPage::updateBreakpoint(const unsigned short* url, unsigned urlLength, int lineNumber, const unsigned short* condition, unsigned conditionLength)
+{
+#if ENABLE(JAVASCRIPT_DEBUGGER)
+    if (d->m_scriptDebugger)
+        d->m_scriptDebugger->updateBreakpoint(url, urlLength, lineNumber, condition, conditionLength);
+#endif
+}
+
+void WebPage::removeBreakpoint(const unsigned short* url, unsigned urlLength, int lineNumber)
+{
+#if ENABLE(JAVASCRIPT_DEBUGGER)
+    if (d->m_scriptDebugger)
+        d->m_scriptDebugger->removeBreakpoint(url, urlLength, lineNumber);
+#endif
+}
+
+bool WebPage::pauseOnExceptions()
+{
+#if ENABLE(JAVASCRIPT_DEBUGGER)
+    return d->m_scriptDebugger ? d->m_scriptDebugger->pauseOnExceptions() : false;
+#endif
+}
+
+void WebPage::setPauseOnExceptions(bool pause)
+{
+#if ENABLE(JAVASCRIPT_DEBUGGER)
+    if (d->m_scriptDebugger)
+        d->m_scriptDebugger->setPauseOnExceptions(pause);
+#endif
+}
+
+void WebPage::pauseInDebugger()
+{
+#if ENABLE(JAVASCRIPT_DEBUGGER)
+    if (d->m_scriptDebugger)
+        d->m_scriptDebugger->pauseInDebugger();
+#endif
+}
+
+void WebPage::resumeDebugger()
+{
+#if ENABLE(JAVASCRIPT_DEBUGGER)
+    if (d->m_scriptDebugger)
+        d->m_scriptDebugger->resumeDebugger();
+#endif
+}
+
+void WebPage::stepOverStatementInDebugger()
+{
+#if ENABLE(JAVASCRIPT_DEBUGGER)
+    if (d->m_scriptDebugger)
+        d->m_scriptDebugger->stepOverStatementInDebugger();
+#endif
+}
+
+void WebPage::stepIntoStatementInDebugger()
+{
+#if ENABLE(JAVASCRIPT_DEBUGGER)
+    if (d->m_scriptDebugger)
+        d->m_scriptDebugger->stepIntoStatementInDebugger();
+#endif
+}
+
+void WebPage::stepOutOfFunctionInDebugger()
+{
+#if ENABLE(JAVASCRIPT_DEBUGGER)
+    if (d->m_scriptDebugger)
+        d->m_scriptDebugger->stepOutOfFunctionInDebugger();
+#endif
+}
+
+unsigned WebPage::timeoutForJavaScriptExecution() const
+{
+    return Settings::timeoutForJavaScriptExecution(d->m_page->groupName());
+}
+
+void WebPage::setTimeoutForJavaScriptExecution(unsigned ms)
+{
+    Settings::setTimeoutForJavaScriptExecution(d->m_page->groupName(), ms);
+
+    Document* doc = d->m_page->mainFrame()->document();
+    if (!doc)
+        return;
+
+    doc->globalData()->timeoutChecker.setTimeoutInterval(ms);
+}
+
+JSContextRef WebPage::scriptContext() const
+{
+    if (!d->m_mainFrame)
+        return 0;
+
+    JSC::Bindings::RootObject *root = d->m_mainFrame->script()->bindingRootObject();
+    if (!root)
+        return 0;
+
+    JSC::ExecState *exec = root->globalObject()->globalExec();
+    return toRef(exec);
+}
+
+JSValueRef WebPage::windowObject() const
+{
+    return toRef(d->m_mainFrame->script()->globalObject(mainThreadNormalWorld()));
+}
+
+// Serialize only the members of HistoryItem which are needed by the client,
+// and copy them into a SharedArray. Also include the HistoryItem pointer which
+// will be used by the client as an opaque reference to identify the item.
+void WebPage::getBackForwardList(SharedArray<BackForwardEntry>& result, unsigned int& resultSize) const
+{
+    HistoryItemVector entries = static_cast<BackForwardListImpl*>(d->m_page->backForward()->client())->entries();
+    resultSize = entries.size();
+    result.reset(new BackForwardEntry[resultSize]);
+
+    for (unsigned i = 0; i < resultSize; ++i) {
+        RefPtr<HistoryItem> entry = entries[i];
+        BackForwardEntry& resultEntry = result[i];
+        resultEntry.url = entry->urlString();
+        resultEntry.originalUrl = entry->originalURLString();
+        resultEntry.title = entry->title();
+        resultEntry.networkToken = entry->viewState().networkToken;
+        resultEntry.lastVisitWasHTTPNonGet = entry->lastVisitWasHTTPNonGet();
+        resultEntry.id = backForwardIdFromHistoryItem(entry.get());
+
+        // Make sure the HistoryItem is not disposed while the result list is still being used, to make sure the pointer is not reused
+        // will be balanced by deref in releaseBackForwardEntry.
+        entry->ref();
+    }
+}
+
+void WebPage::releaseBackForwardEntry(BackForwardId id) const
+{
+    HistoryItem* item = historyItemFromBackForwardId(id);
+    ASSERT(item);
+    item->deref();
+}
+
+void WebPage::clearBrowsingData()
+{
+    clearMemoryCaches();
+    clearAppCache(d->m_page->groupName());
+    clearLocalStorage();
+    clearCookieCache();
+    clearHistory();
+    clearPluginSiteData();
+}
+
+void WebPage::clearHistory()
+{
+    // Don't clear the back-forward list as we might like to keep it.
+}
+
+void WebPage::clearCookies()
+{
+    clearCookieCache();
+}
+
+void WebPage::clearLocalStorage()
+{
+    BlackBerry::WebKit::clearLocalStorage(d->m_page->groupName());
+    clearDatabase(d->m_page->groupName());
+}
+
+void WebPage::clearCache()
+{
+    clearMemoryCaches();
+    clearAppCache(d->m_page->groupName());
+}
+
+void WebPage::clearBackForwardList(bool keepCurrentPage) const
+{
+    BackForwardListImpl* backForwardList = static_cast<BackForwardListImpl*>(d->m_page->backForward()->client());
+    RefPtr<HistoryItem> currentItem = backForwardList->currentItem();
+    while (!backForwardList->entries().isEmpty())
+        backForwardList->removeItem(backForwardList->entries().last().get());
+    if (keepCurrentPage)
+        backForwardList->addItem(currentItem);
+}
+
+bool WebPage::isEnableLocalAccessToAllCookies() const
+{
+    return cookieManager().canLocalAccessAllCookies();
+}
+
+void WebPage::setEnableLocalAccessToAllCookies(bool enabled)
+{
+    cookieManager().setCanLocalAccessAllCookies(enabled);
+}
+
+void WebPage::addVisitedLink(const unsigned short* url, unsigned int length)
+{
+    ASSERT(d->m_page);
+    d->m_page->group().addVisitedLink(url, length);
+}
+
+#if ENABLE(WEBDOM)
+WebDOMDocument WebPage::document() const
+{
+    if (!d->m_mainFrame)
+        return WebDOMDocument();
+    return WebDOMDocument(d->m_mainFrame->document());
+}
+
+WebDOMNode WebPage::nodeAtPoint(int x, int y)
+{
+    HitTestResult result = d->m_mainFrame->eventHandler()->hitTestResultAtPoint(d->mapFromTransformed(IntPoint(x, y)), false);
+    Node* node = result.innerNonSharedNode();
+    return WebDOMNode(node);
+}
+
+bool WebPage::getNodeRect(const WebDOMNode& node, Platform::IntRect& result)
+{
+    Node* nodeImpl = node.impl();
+    if (nodeImpl && nodeImpl->renderer()) {
+        result = nodeImpl->getRect();
+        return true;
+    }
+
+    return false;
+}
+
+bool WebPage::setNodeFocus(const WebDOMNode& node, bool on)
+{
+    Node* nodeImpl = node.impl();
+
+    if (nodeImpl && nodeImpl->isFocusable()) {
+        Document* doc = nodeImpl->document();
+        if (Page* page = doc->page()) {
+            // Modify if focusing on node or turning off focused node.
+            if (on) {
+                page->focusController()->setFocusedNode(nodeImpl, doc->frame());
+                if (nodeImpl->isElementNode())
+                    static_cast<Element*>(nodeImpl)->updateFocusAppearance(true);
+                d->m_inputHandler->didNodeOpenPopup(nodeImpl);
+            } else if (doc->focusedNode() == nodeImpl) // && !on
+                page->focusController()->setFocusedNode(0, doc->frame());
+
+            return true;
+        }
+    }
+    return false;
+}
+
+bool WebPage::setNodeHovered(const WebDOMNode& node, bool on)
+{
+    if (Node* nodeImpl = node.impl()) {
+        nodeImpl->setHovered(on);
+        return true;
+    }
+    return false;
+}
+
+bool WebPage::nodeHasHover(const WebDOMNode& node)
+{
+    if (Node* nodeImpl = node.impl()) {
+        if (RenderStyle* style = nodeImpl->renderStyle())
+            return style->affectedByHoverRules();
+    }
+    return false;
+}
+#endif
+
+String WebPagePrivate::findPatternStringForUrl(const KURL& url) const
+{
+    if ((m_webSettings->shouldHandlePatternUrls() && protocolIs(url, "pattern"))
+            || protocolIs(url, "tel")
+            || protocolIs(url, "wtai")
+            || protocolIs(url, "cti")
+            || protocolIs(url, "mailto")
+            || protocolIs(url, "sms")
+            || protocolIs(url, "pin")) {
+        return url;
+    }
+    return String();
+}
+
+bool WebPage::defersLoading() const
+{
+    return d->m_page->defersLoading();
+}
+
+bool WebPage::willFireTimer()
+{
+    if (d->isLoading())
+        return true;
+
+    return d->m_backingStore->d->willFireTimer();
+}
+
+void WebPage::notifyPagePause()
+{
+    FOR_EACH_PLUGINVIEW(d->m_pluginViews)
+        (*it)->handlePauseEvent();
+}
+
+void WebPage::notifyPageResume()
+{
+    FOR_EACH_PLUGINVIEW(d->m_pluginViews)
+        (*it)->handleResumeEvent();
+}
+
+void WebPage::notifyPageBackground()
+{
+#if USE(ACCELERATED_COMPOSITING)
+    d->suspendRootLayerCommit();
+#endif
+
+    FOR_EACH_PLUGINVIEW(d->m_pluginViews)
+        (*it)->handleBackgroundEvent();
+}
+
+void WebPage::notifyPageForeground()
+{
+#if USE(ACCELERATED_COMPOSITING)
+    d->resumeRootLayerCommit();
+#endif
+
+    FOR_EACH_PLUGINVIEW(d->m_pluginViews)
+        (*it)->handleForegroundEvent();
+}
+
+void WebPage::notifyPageFullScreenAllowed()
+{
+    FOR_EACH_PLUGINVIEW(d->m_pluginViews)
+        (*it)->handleFullScreenAllowedEvent();
+}
+
+void WebPage::notifyPageFullScreenExit()
+{
+    FOR_EACH_PLUGINVIEW(d->m_pluginViews)
+        (*it)->handleFullScreenExitEvent();
+}
+
+void WebPage::notifyDeviceIdleStateChange(bool enterIdle)
+{
+    FOR_EACH_PLUGINVIEW(d->m_pluginViews)
+        (*it)->handleIdleEvent(enterIdle);
+}
+
+void WebPage::notifyAppActivationStateChange(ActivationStateType activationState)
+{
+#if ENABLE(VIDEO)
+    MediaPlayerPrivate::notifyAppActivatedEvent(activationState == ActivationActive);
+#endif
+
+    FOR_EACH_PLUGINVIEW(d->m_pluginViews) {
+        switch (activationState) {
+        case ActivationActive:
+            (*it)->handleAppActivatedEvent();
+            break;
+        case ActivationInactive:
+            (*it)->handleAppDeactivatedEvent();
+            break;
+        case ActivationStandby:
+            (*it)->handleAppStandbyEvent();
+            break;
+        default: // FIXME: Get rid of the default to force a compiler error instead of using a runtime error. See PR #121109.
+            ASSERT_NOT_REACHED();
+            break;
+        }
+    }
+}
+
+void WebPage::notifySwipeEvent()
+{
+    FOR_EACH_PLUGINVIEW(d->m_pluginViews)
+       (*it)->handleSwipeEvent();
+}
+
+void WebPage::notifyScreenPowerStateChanged(bool powered)
+{
+    FOR_EACH_PLUGINVIEW(d->m_pluginViews)
+       (*it)->handleScreenPowerEvent(powered);
+}
+
+void WebPage::notifyFullScreenVideoExited(bool done)
+{
+    UNUSED_PARAM(done);
+#if ENABLE(VIDEO)
+    if (HTMLMediaElement* mediaElement = static_cast<HTMLMediaElement*>(d->m_fullscreenVideoNode.get()))
+        mediaElement->exitFullscreen();
+#endif
+}
+
+void WebPage::clearPluginSiteData()
+{
+    PluginDatabase* database = PluginDatabase::installedPlugins(true);
+
+    if (!database)
+        return;
+
+    Vector<PluginPackage*> plugins = database->plugins();
+
+    Vector<PluginPackage*>::const_iterator end = plugins.end();
+    for (Vector<PluginPackage*>::const_iterator it = plugins.begin(); it != end; ++it)
+        (*it)->clearSiteData(String());
+}
+
+void WebPage::onInputLocaleChanged(bool isRTL)
+{
+    d->onInputLocaleChanged(isRTL);
+}
+
+void WebPage::onNetworkAvailabilityChanged(bool available)
+{
+    updateOnlineStatus(available);
+}
+
+void WebPage::onCertificateStoreLocationSet(const WebString& caPath)
+{
+#if ENABLE(VIDEO)
+    MediaPlayerPrivate::setCertificatePath(caPath);
+#endif
+}
+
+void WebPage::enableWebInspector()
+{
+    d->m_page->inspectorController()->connectFrontend();
+    d->m_page->settings()->setDeveloperExtrasEnabled(true);
+}
+
+void WebPage::disableWebInspector()
+{
+    d->m_page->inspectorController()->disconnectFrontend();
+    d->m_page->settings()->setDeveloperExtrasEnabled(false);
+}
+
+void WebPage::enablePasswordEcho()
+{
+    d->m_page->settings()->setPasswordEchoEnabled(true);
+}
+
+void WebPage::disablePasswordEcho()
+{
+    d->m_page->settings()->setPasswordEchoEnabled(false);
+}
+
+void WebPage::dispatchInspectorMessage(const char* message, int length)
+{
+    String stringMessage(message, length);
+    d->m_page->inspectorController()->dispatchMessageFromFrontend(stringMessage);
+}
+
+Frame* WebPage::mainFrame() const
+{
+    return d->m_mainFrame;
+}
+
+#if USE(ACCELERATED_COMPOSITING)
+void WebPagePrivate::drawLayersOnCommit()
+{
+    if (!Platform::userInterfaceThreadMessageClient()->isCurrentThread()) {
+        // This method will only be called when the layer appearance changed due to
+        // animations. And only if we don't need a one shot drawing sync.
+        ASSERT(!needsOneShotDrawingSynchronization());
+
+        if (!m_webPage->isVisible() || !m_backingStore->d->isActive())
+            return;
+
+        m_backingStore->d->willDrawLayersOnCommit();
+
+        Platform::userInterfaceThreadMessageClient()->dispatchMessage(
+            Platform::createMethodCallMessage(&WebPagePrivate::drawLayersOnCommit, this));
+        return;
+    }
+
+    if (m_client->window()->windowUsage() == Platform::Graphics::Window::GLES2Usage) {
+        m_backingStore->d->blitVisibleContents();
+        return; // blitVisibleContents() includes drawSubLayers() in this case.
+    }
+
+    if (!drawSubLayers())
+        return;
+
+    // If we use the compositing surface, we need to re-blit the
+    // backingstore and blend the compositing surface on top of that
+    // in order to get the newly drawn layers on screen.
+    if (!SurfacePool::globalSurfacePool()->compositingSurface())
+        return;
+
+    // If there are no visible layers, return early.
+    if (lastCompositingResults().isEmpty() && lastCompositingResults().wasEmpty)
+        return;
+
+    if (m_backingStore->d->shouldDirectRenderingToWindow())
+        return;
+
+    m_backingStore->d->blitVisibleContents();
+}
+
+bool WebPagePrivate::drawSubLayers(const IntRect& dstRect, const FloatRect& contents)
+{
+    ASSERT(Platform::userInterfaceThreadMessageClient()->isCurrentThread());
+    if (!Platform::userInterfaceThreadMessageClient()->isCurrentThread())
+        return false;
+
+    if (m_compositor) {
+        m_compositor->setCompositingOntoMainWindow(
+            m_client->window()->windowUsage() == Platform::Graphics::Window::GLES2Usage);
+        return m_compositor->drawLayers(dstRect, contents);
+    }
+
+    return false;
+}
+
+bool WebPagePrivate::drawSubLayers()
+{
+    ASSERT(Platform::userInterfaceThreadMessageClient()->isCurrentThread());
+    if (!Platform::userInterfaceThreadMessageClient()->isCurrentThread())
+        return false;
+
+    return m_backingStore->d->drawSubLayers();
+}
+
+void WebPagePrivate::scheduleRootLayerCommit()
+{
+    if (!m_frameLayers || !m_frameLayers->hasLayer())
+        return;
+
+    m_needsCommit = true;
+    if (!m_rootLayerCommitTimer->isActive())
+        m_rootLayerCommitTimer->startOneShot(0);
+}
+
+static bool needsLayoutRecursive(FrameView* view)
+{
+    if (view->needsLayout())
+        return true;
+
+    bool subframesNeedsLayout = false;
+    const HashSet<RefPtr<Widget> >* viewChildren = view->children();
+    HashSet<RefPtr<Widget> >::const_iterator end = viewChildren->end();
+    for (HashSet<RefPtr<Widget> >::const_iterator current = viewChildren->begin(); current != end && !subframesNeedsLayout; ++current) {
+        Widget* widget = (*current).get();
+        if (widget->isFrameView())
+            subframesNeedsLayout |= needsLayoutRecursive(static_cast<FrameView*>(widget));
+    }
+
+    return subframesNeedsLayout;
+}
+
+LayerRenderingResults WebPagePrivate::lastCompositingResults() const
+{
+    if (m_compositor)
+        return m_compositor->lastCompositingResults();
+    return LayerRenderingResults();
+}
+
+void WebPagePrivate::commitRootLayer(const IntRect& layoutRectForCompositing,
+                                     const IntSize& contentsSizeForCompositing)
+{
+    if (!m_frameLayers || !m_compositor)
+        return;
+
+    m_compositor->setLayoutRectForCompositing(layoutRectForCompositing);
+    m_compositor->setContentsSizeForCompositing(contentsSizeForCompositing);
+    m_compositor->commit(m_frameLayers->rootLayer());
+}
+
+bool WebPagePrivate::commitRootLayerIfNeeded()
+{
+    if (m_suspendRootLayerCommit)
+        return false;
+
+    if (!m_needsCommit)
+        return false;
+
+    if (!m_frameLayers || !m_frameLayers->hasLayer())
+        return false;
+
+    FrameView* view = m_mainFrame->view();
+    if (!view)
+        return false;
+
+    // If we sync compositing layers when a layout is pending, we may cause painting of compositing
+    // layer content to occur before layout has happened, which will cause paintContents() to bail.
+    if (needsLayoutRecursive(view)) {
+        // In case of one shot drawing synchronization, you
+        // should first layoutIfNeeded, render, then commit and draw the layers.
+        ASSERT(!needsOneShotDrawingSynchronization());
+        return false;
+    }
+
+    m_needsCommit = false;
+    // We get here either due to the commit timer, which would have called
+    // render if a one shot sync was needed. Or we get called from render
+    // before the timer times out, which means we are doing a one shot anyway.
+    m_needsOneShotDrawingSynchronization = false;
+
+    if (m_rootLayerCommitTimer->isActive())
+        m_rootLayerCommitTimer->stop();
+
+    m_frameLayers->commitOnWebKitThread(currentScale());
+    updateDelegatedOverlays();
+
+    // Stash the visible content rect according to webkit thread
+    // This is the rectangle used to layout fixed positioned elements,
+    // and that's what the layer renderer wants.
+    IntRect layoutRectForCompositing(scrollPosition(), actualVisibleSize());
+    IntSize contentsSizeForCompositing = contentsSize();
+
+    // Commit changes made to the layers synchronously with the compositing thread.
+    Platform::userInterfaceThreadMessageClient()->dispatchSyncMessage(
+        Platform::createMethodCallMessage(
+            &WebPagePrivate::commitRootLayer,
+            this,
+            layoutRectForCompositing,
+            contentsSizeForCompositing));
+
+    return true;
+}
+
+void WebPagePrivate::rootLayerCommitTimerFired(Timer<WebPagePrivate>*)
+{
+    if (m_suspendRootLayerCommit)
+        return;
+
+    // The commit timer may have fired just before the layout timer, or for some
+    // other reason we need layout. It's not allowed to commit when a layout is
+    // pending, becaues a commit can cause parts of the web page to be rendered
+    // to texture.
+    // The layout can also turn of compositing altogether, so we need to be prepared
+    // to handle a one shot drawing synchronization after the layout.
+    requestLayoutIfNeeded();
+
+    bool isSingleTargetWindow = SurfacePool::globalSurfacePool()->compositingSurface()
+        || m_client->window()->windowUsage() == Platform::Graphics::Window::GLES2Usage;
+
+    // If we are doing direct rendering and have a single rendering target,
+    // committing is equivalent to a one shot drawing synchronization.
+    // We need to re-render the web page, re-render the layers, and
+    // then blit them on top of the re-rendered web page.
+    if (isSingleTargetWindow && m_backingStore->d->shouldDirectRenderingToWindow())
+        setNeedsOneShotDrawingSynchronization();
+
+    if (needsOneShotDrawingSynchronization()) {
+        const IntRect windowRect = IntRect(IntPoint::zero(), viewportSize());
+        m_backingStore->d->repaint(windowRect, true /*contentChanged*/, true /*immediate*/);
+        return;
+    }
+
+    // If the web page needs layout, the commit will fail.
+    // No need to draw the layers if nothing changed.
+    if (commitRootLayerIfNeeded())
+        drawLayersOnCommit();
+}
+
+void WebPagePrivate::setIsAcceleratedCompositingActive(bool active)
+{
+    // Backing store can be null here because it happens during teardown.
+    if (m_isAcceleratedCompositingActive == active || !m_backingStore)
+        return;
+
+    m_isAcceleratedCompositingActive = active;
+
+    if (!active) {
+        m_compositor.clear();
+        resetCompositingSurface();
+        return;
+    }
+
+    if (!m_compositor) {
+        m_compositor = adoptPtr(new WebPageCompositor(this));
+        m_isAcceleratedCompositingActive = m_compositor->hardwareCompositing();
+        if (!m_isAcceleratedCompositingActive)
+            m_compositor.clear();
+    }
+}
+
+void WebPagePrivate::resetCompositingSurface()
+{
+    if (!Platform::userInterfaceThreadMessageClient()->isCurrentThread()) {
+        Platform::userInterfaceThreadMessageClient()->dispatchMessage(
+            Platform::createMethodCallMessage(
+                &WebPagePrivate::resetCompositingSurface, this));
+        return;
+    }
+
+    if (m_compositor)
+        m_compositor->setLastCompositingResults(LayerRenderingResults());
+}
+
+void WebPagePrivate::setRootLayerWebKitThread(Frame* frame, LayerWebKitThread* layer)
+{
+    // This method updates the FrameLayers based on input from WebCore.
+    // FrameLayers keeps track of the layer proxies attached to frames.
+    // We will have to compute a new root layer and update the compositor.
+    if (!layer && !m_frameLayers)
+        return;
+
+    if (!layer) {
+         ASSERT(m_frameLayers);
+         m_frameLayers->removeLayerByFrame(frame);
+         if (!m_frameLayers->hasLayer())
+             m_frameLayers.clear();
+    } else {
+        if (!m_frameLayers)
+            m_frameLayers = adoptPtr(new FrameLayers(this));
+
+        if (!m_frameLayers->containsLayerForFrame(frame))
+            m_frameLayers->addLayer(frame, layer);
+
+        ASSERT(m_frameLayers);
+    }
+
+    LayerCompositingThread* rootLayerCompositingThread = 0;
+    if (m_frameLayers && m_frameLayers->rootLayer())
+        rootLayerCompositingThread = m_frameLayers->rootLayer()->layerCompositingThread();
+
+    setRootLayerCompositingThread(rootLayerCompositingThread);
+}
+
+void WebPagePrivate::setRootLayerCompositingThread(LayerCompositingThread* layer)
+{
+    if (!Platform::userInterfaceThreadMessageClient()->isCurrentThread()) {
+        Platform::userInterfaceThreadMessageClient()->dispatchSyncMessage(
+            Platform::createMethodCallMessage(&WebPagePrivate::setRootLayerCompositingThread, this, layer));
+        return;
+    }
+
+    // Depending on whether we have a root layer or not,
+    // this method will turn on or off accelerated compositing.
+    if (!layer) {
+         // Don't ASSERT(m_compositor) here because we may be called in
+         // the process of destruction of WebPage where we have already
+         // called syncDestroyCompositorOnCompositingThread() to destroy
+         // the compositor.
+         setIsAcceleratedCompositingActive(false);
+         return;
+    }
+
+    if (!m_compositor)
+        setIsAcceleratedCompositingActive(true);
+
+    // Don't ASSERT(m_compositor) here because setIsAcceleratedCompositingActive(true)
+    // may not turn accelerated compositing on since m_backingStore is 0.
+    if (m_compositor)
+        m_compositor->setRootLayer(layer);
+}
+
+void WebPagePrivate::destroyCompositor()
+{
+     m_compositor.clear();
+}
+
+void WebPagePrivate::syncDestroyCompositorOnCompositingThread()
+{
+    if (!m_compositor)
+        return;
+
+    Platform::userInterfaceThreadMessageClient()->dispatchSyncMessage(
+        Platform::createMethodCallMessage(
+            &WebPagePrivate::destroyCompositor, this));
+}
+
+void WebPagePrivate::destroyLayerResources()
+{
+     m_compositor->releaseLayerResources();
+}
+
+void WebPagePrivate::suspendRootLayerCommit()
+{
+    if (m_suspendRootLayerCommit)
+        return;
+
+    m_suspendRootLayerCommit = true;
+
+    if (!m_frameLayers || !m_frameLayers->hasLayer() || !m_compositor)
+        return;
+
+    Platform::userInterfaceThreadMessageClient()->dispatchSyncMessage(
+        Platform::createMethodCallMessage(&WebPagePrivate::destroyLayerResources, this));
+}
+
+void WebPagePrivate::resumeRootLayerCommit()
+{
+    if (!m_suspendRootLayerCommit)
+        return;
+
+    m_suspendRootLayerCommit = false;
+    m_needsCommit = true;
+
+    // Recreate layer resources if needed.
+    commitRootLayerIfNeeded();
+}
+
+bool WebPagePrivate::needsOneShotDrawingSynchronization()
+{
+    return m_needsOneShotDrawingSynchronization;
+}
+
+void WebPagePrivate::setNeedsOneShotDrawingSynchronization()
+{
+    // This means we have to commit layers on next render, or render on the next commit,
+    // whichever happens first.
+    m_needsCommit = true;
+    m_needsOneShotDrawingSynchronization = true;
+}
+#endif // USE(ACCELERATED_COMPOSITING)
+
+void WebPagePrivate::enterFullscreenForNode(Node* node)
+{
+#if ENABLE(VIDEO)
+    if (!node || !node->hasTagName(HTMLNames::videoTag))
+        return;
+
+    MediaPlayer* player = static_cast<HTMLMediaElement*>(node)->player();
+    if (!player)
+        return;
+
+    MediaPlayerPrivate* mmrPlayer = static_cast<MediaPlayerPrivate*>(player->implementation());
+    if (!mmrPlayer)
+        return;
+
+    Platform::Graphics::Window* window = mmrPlayer->windowGet();
+    if (!window)
+        return;
+
+    unsigned x, y, width, height;
+    mmrPlayer->windowPositionGet(x, y, width, height);
+
+    const char* contextName = mmrPlayer->mmrContextNameGet();
+    if (!contextName)
+        return;
+
+    mmrPlayer->setFullscreenWebPageClient(m_client);
+    m_fullscreenVideoNode = node;
+    m_client->fullscreenStart(contextName, window, x, y, width, height);
+#endif
+}
+
+void WebPagePrivate::exitFullscreenForNode(Node* node)
+{
+#if ENABLE(VIDEO)
+    if (m_fullscreenVideoNode.get()) {
+        m_client->fullscreenStop();
+        m_fullscreenVideoNode = 0;
+    }
+
+    if (!node || !node->hasTagName(HTMLNames::videoTag))
+        return;
+
+    MediaPlayer* player = static_cast<HTMLMediaElement*>(node)->player();
+    if (!player)
+        return;
+
+    MediaPlayerPrivate* mmrPlayer = static_cast<MediaPlayerPrivate*>(player->implementation());
+    if (!mmrPlayer)
+        return;
+
+    // Fullscreen mode is being turned off, so MediaPlayerPrivate no longer needs the pointer.
+    mmrPlayer->setFullscreenWebPageClient(0);
+#endif
+}
+
+void WebPagePrivate::didChangeSettings(WebSettings* webSettings)
+{
+    Settings* coreSettings = m_page->settings();
+    m_page->setGroupName(webSettings->pageGroupName());
+    coreSettings->setXSSAuditorEnabled(webSettings->xssAuditorEnabled());
+    coreSettings->setLoadsImagesAutomatically(webSettings->loadsImagesAutomatically());
+    coreSettings->setShouldDrawBorderWhileLoadingImages(webSettings->shouldDrawBorderWhileLoadingImages());
+    coreSettings->setScriptEnabled(webSettings->isJavaScriptEnabled());
+    coreSettings->setPrivateBrowsingEnabled(webSettings->isPrivateBrowsingEnabled());
+    coreSettings->setDefaultFixedFontSize(webSettings->defaultFixedFontSize());
+    coreSettings->setDefaultFontSize(webSettings->defaultFontSize());
+    coreSettings->setMinimumFontSize(webSettings->minimumFontSize());
+    coreSettings->setSerifFontFamily(webSettings->serifFontFamily().impl());
+    coreSettings->setFixedFontFamily(webSettings->fixedFontFamily().impl());
+    coreSettings->setSansSerifFontFamily(webSettings->sansSerifFontFamily().impl());
+    coreSettings->setStandardFontFamily(webSettings->standardFontFamily().impl());
+    coreSettings->setJavaScriptCanOpenWindowsAutomatically(webSettings->canJavaScriptOpenWindowsAutomatically());
+    coreSettings->setAllowScriptsToCloseWindows(webSettings->canJavaScriptOpenWindowsAutomatically()); // Why are we using the same value as setJavaScriptCanOpenWindowsAutomatically()?
+    coreSettings->setPluginsEnabled(webSettings->arePluginsEnabled());
+    coreSettings->setDefaultTextEncodingName(webSettings->defaultTextEncodingName().impl());
+    coreSettings->setDownloadableBinaryFontsEnabled(webSettings->downloadableBinaryFontsEnabled());
+    coreSettings->setSpatialNavigationEnabled(m_webSettings->isSpatialNavigationEnabled());
+
+    // UserScalable should be reset by new settings.
+    setUserScalable(webSettings->isUserScalable());
+
+    WebString stylesheetURL = webSettings->userStyleSheetString();
+    if (stylesheetURL.isEmpty())
+        stylesheetURL = webSettings->userStyleSheetLocation();
+    if (!stylesheetURL.isEmpty())
+        coreSettings->setUserStyleSheetLocation(KURL(KURL(), stylesheetURL));
+
+    coreSettings->setFirstScheduledLayoutDelay(webSettings->firstScheduledLayoutDelay());
+    coreSettings->setUseCache(webSettings->useWebKitCache());
+
+#if ENABLE(SQL_DATABASE)
+    // DatabaseTracker can only be initialized for once, so it doesn't
+    // make sense to change database path after DatabaseTracker has
+    // already been initialized.
+    static bool dbinit = false;
+    if (!dbinit && !webSettings->databasePath().isEmpty()) {
+        dbinit = true;
+        DatabaseTracker::initializeTracker(webSettings->databasePath());
+    }
+
+    // The directory of cacheStorage for one page group can only be initialized once.
+    static bool acinit = false;
+    if (!acinit && !webSettings->appCachePath().isEmpty()) {
+        acinit = true;
+        cacheStorage().setCacheDirectory(webSettings->appCachePath());
+    }
+
+    coreSettings->setLocalStorageDatabasePath(webSettings->localStoragePath());
+    Database::setIsAvailable(webSettings->isDatabasesEnabled());
+    DatabaseSync::setIsAvailable(webSettings->isDatabasesEnabled());
+
+    coreSettings->setLocalStorageEnabled(webSettings->isLocalStorageEnabled());
+    coreSettings->setOfflineWebApplicationCacheEnabled(webSettings->isAppCacheEnabled());
+
+    m_page->group().groupSettings()->setLocalStorageQuotaBytes(webSettings->localStorageQuota());
+    coreSettings->setUsesPageCache(webSettings->maximumPagesInCache());
+    coreSettings->setFrameFlatteningEnabled(webSettings->isFrameFlatteningEnabled());
+#endif
+
+#if ENABLE(WEB_SOCKETS)
+    WebSocket::setIsAvailable(webSettings->areWebSocketsEnabled());
+#endif
+
+#if ENABLE(VIEWPORT_REFLOW)
+    coreSettings->setTextReflowEnabled(webSettings->textReflowMode() == WebSettings::TextReflowEnabled);
+#endif
+
+    // FIXME: We don't want HTMLTokenizer to yield for anything other than email case because
+    // call to currentTime() is too expensive on our platform. See RIM Bug #746.
+    coreSettings->setShouldUseFirstScheduledLayoutDelay(webSettings->isEmailMode());
+    coreSettings->setProcessHTTPEquiv(!webSettings->isEmailMode());
+
+    coreSettings->setShouldUseCrossOriginProtocolCheck(!webSettings->allowCrossSiteRequests());
+
+    cookieManager().setPrivateMode(webSettings->isPrivateBrowsingEnabled());
+
+    if (m_mainFrame && m_mainFrame->view()) {
+        Color backgroundColor(webSettings->backgroundColor());
+        m_mainFrame->view()->updateBackgroundRecursively(backgroundColor, backgroundColor.hasAlpha());
+    }
+}
+
+IntSize WebPagePrivate::defaultMaxLayoutSize()
+{
+    static IntSize size;
+    if (size.isEmpty())
+        size = IntSize(std::max(1024, Platform::Graphics::Screen::landscapeWidth()),
+                       std::max(768, Platform::Graphics::Screen::landscapeHeight()));
+
+    return size;
+}
+
+WebString WebPage::textHasAttribute(const WebString& query) const
+{
+    if (Document* doc = d->m_page->focusController()->focusedOrMainFrame()->document())
+        return doc->queryCommandValue(query);
+
+    return "";
+}
+
+void WebPage::setJavaScriptCanAccessClipboard(bool enabled)
+{
+    d->m_page->settings()->setJavaScriptCanAccessClipboard(enabled);
+}
+
+#if USE(ACCELERATED_COMPOSITING)
+void WebPagePrivate::blitVisibleContents()
+{
+    if (m_backingStore->d->shouldDirectRenderingToWindow())
+        return;
+
+    m_backingStore->d->blitVisibleContents();
+}
+#endif
+
+void WebPage::setWebGLEnabled(bool enabled)
+{
+    if (!Platform::ITPolicy::isWebGLEnabled()) {
+        d->m_page->settings()->setWebGLEnabled(false);
+        return;
+    }
+    d->m_page->settings()->setWebGLEnabled(enabled);
+}
+
+bool WebPage::isWebGLEnabled() const
+{
+    return d->m_page->settings()->webGLEnabled();
+}
+
+void WebPagePrivate::setNeedTouchEvents(bool value)
+{
+    m_needTouchEvents = value;
+}
+
+}
+}
diff --git a/Source/WebKit/blackberry/Api/WebPage.h b/Source/WebKit/blackberry/Api/WebPage.h
new file mode 100644
index 000000000..489f4536c
--- /dev/null
+++ b/Source/WebKit/blackberry/Api/WebPage.h
@@ -0,0 +1,354 @@
+/*
+ * Copyright (C) 2009, 2010, 2011, 2012 Research In Motion Limited. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+#ifndef WebPage_h
+#define WebPage_h
+
+#include "ActiveNodeContext.h"
+#include "BlackBerryGlobal.h"
+#include <BlackBerryPlatformGuardedPointer.h>
+#include <BlackBerryPlatformInputEvents.h>
+#include <imf/input_data.h>
+#include <network/NetworkRequest.h>
+
+struct OpaqueJSContext;
+typedef const struct OpaqueJSContext* JSContextRef;
+
+struct OpaqueJSValue;
+typedef const struct OpaqueJSValue* JSValueRef;
+
+namespace WebCore {
+class ChromeClientBlackBerry;
+class EditorClientBlackBerry;
+class Element;
+class Frame;
+class FrameLoaderClientBlackBerry;
+class GeolocationControllerClientBlackBerry;
+class IconDatabaseClientBlackBerry;
+class InspectorClientBlackBerry;
+class JavaScriptDebuggerBlackBerry;
+class Node;
+class RenderObject;
+class VisibleSelection;
+}
+
+class WebDOMDocument;
+class WebDOMNode;
+template<typename T> class SharedArray;
+
+namespace BlackBerry {
+namespace Platform {
+class IntPoint;
+class IntRect;
+class IntSize;
+class KeyboardEvent;
+class MouseEvent;
+class TouchEvent;
+class TouchPoint;
+}
+
+namespace WebKit {
+
+class BackingStore;
+class BackingStoreClient;
+class BackingStorePrivate;
+class DumpRenderTreeClient;
+class RenderQueue;
+class WebPageClient;
+class WebPageGroupLoadDeferrer;
+class WebPagePrivate;
+class WebSettings;
+
+enum JavaScriptDataType { JSUndefined = 0, JSNull, JSBoolean, JSNumber, JSString, JSObject, JSException, JSDataTypeMax };
+
+enum ActivationStateType { ActivationActive, ActivationInactive, ActivationStandby };
+
+enum TargetDetectionStrategy {PointBased, RectBased};
+
+class BLACKBERRY_EXPORT WebPage : public Platform::GuardedPointerBase {
+public:
+    WebPage(WebPageClient*, const WebString& pageGroupName, const Platform::IntRect&);
+    void destroy();
+
+    WebPageClient* client() const;
+
+    void load(const char* url, const char* networkToken, bool isInitial = false);
+
+    void loadExtended(const char* url, const char* networkToken, const char* method, Platform::NetworkRequest::CachePolicy = Platform::NetworkRequest::UseProtocolCachePolicy, const char* data = 0, size_t dataLength = 0, const char* const* headers = 0, size_t headersLength = 0, bool mustHandleInternally = false);
+
+    void loadFile(const char* path, const char* overrideContentType = "");
+
+    void loadString(const char* string, const char* baseURL, const char* contentType = "text/html", const char* failingURL = 0);
+
+    void download(const Platform::NetworkRequest&);
+
+    bool executeJavaScript(const char* script, JavaScriptDataType& returnType, WebString& returnValue);
+
+    // This will execute the script even if in-page JavaScript is disabled.
+    bool executeJavaScriptInIsolatedWorld(const char* script, JavaScriptDataType& returnType, WebString& returnValue);
+
+    // Takes a UTF16 encoded script that is used explicitly by the pattern matching code
+    bool executeJavaScriptInIsolatedWorld(const std::wstring& script, JavaScriptDataType& returnType, WebString& returnValue);
+
+    void initializeIconDataBase();
+
+    void stopLoading();
+
+    // This will force any unload handlers to run.
+    void prepareToDestroy();
+
+    void reload();
+    void reloadFromCache();
+
+    WebSettings* settings() const;
+
+    void setVisible(bool);
+    bool isVisible() const;
+
+    void setScreenOrientation(int);
+    void applyPendingOrientationIfNeeded();
+
+    Platform::IntSize viewportSize() const;
+    void setViewportSize(const Platform::IntSize& viewportSize, bool ensureFocusElementVisible = true);
+
+    void resetVirtualViewportOnCommitted(bool reset);
+    void setVirtualViewportSize(int width, int height);
+
+    // Used for default layout size unless overridden by web content or by other APIs.
+    void setDefaultLayoutSize(int width, int height);
+
+    bool mouseEvent(const Platform::MouseEvent&, bool* wheelDeltaAccepted = 0);
+
+    // Handles native javascript touch events.
+    bool touchEvent(const Platform::TouchEvent&);
+
+    // For conversion to mouse events.
+    void touchEventCancel();
+    void touchEventCancelAndClearFocusedNode();
+    bool touchPointAsMouseEvent(const Platform::TouchPoint&);
+
+    // Returns true if the key stroke was handled by WebKit.
+    bool keyEvent(const Platform::KeyboardEvent&);
+
+    WebString title() const;
+    WebString selectedText() const;
+    WebString cutSelectedText();
+    void insertText(const WebString&);
+    void clearCurrentInputField();
+
+    void cut();
+    void copy();
+    void paste();
+
+    // Text encoding.
+    WebString textEncoding();
+    WebString forcedTextEncoding();
+    void setForcedTextEncoding(const char*);
+
+    // Scroll position returned is in transformed coordinates.
+    Platform::IntPoint scrollPosition() const;
+    // Scroll position provided should be in transformed coordinates.
+    void setScrollPosition(const Platform::IntPoint&);
+    bool scrollBy(const Platform::IntSize&, bool scrollMainFrame = true);
+    void notifyInRegionScrollStatusChanged(bool status);
+    void setScrollOriginPoint(const Platform::IntPoint&);
+
+    BackingStore* backingStore() const;
+
+    bool zoomToFit();
+    bool zoomToOneOne();
+    void zoomToInitialScale();
+    bool blockZoom(int x, int y);
+    void blockZoomAnimationFinished();
+    bool isAtInitialZoom() const;
+    bool isMaxZoomed() const;
+    bool isMinZoomed() const;
+    bool pinchZoomAboutPoint(double scale, int x, int y);
+
+    bool isUserScalable() const;
+    double currentScale() const;
+    double initialScale() const;
+    double zoomToFitScale() const;
+    void setInitialScale(double);
+    double minimumScale() const;
+    void setMinimumScale(double);
+    double maximumScale() const;
+    void setMaximumScale(double);
+
+    void assignFocus(Platform::FocusDirection);
+
+    Platform::IntRect focusNodeRect();
+
+    void setFocused(bool);
+
+    void clearBrowsingData();
+    void clearHistory();
+    void clearCookies();
+    void clearCache();
+    void clearLocalStorage();
+
+    void runLayoutTests();
+
+     // Finds and selects the next utf8 string that is a case sensitive
+     // match in the web page. It will wrap the web page if it reaches
+     // the end. An empty string will result in no match and no selection.
+     // Returns true if the string matched and false if not.
+    bool findNextString(const char*, bool forward = true);
+
+    // JavaScriptDebugger interface.
+    bool enableScriptDebugger();
+    bool disableScriptDebugger();
+
+    JSContextRef scriptContext() const;
+    JSValueRef windowObject() const;
+
+    void addBreakpoint(const unsigned short* url, unsigned urlLength, int lineNumber, const unsigned short* condition, unsigned conditionLength);
+    void updateBreakpoint(const unsigned short* url, unsigned urlLength, int lineNumber, const unsigned short* condition, unsigned conditionLength);
+    void removeBreakpoint(const unsigned short* url, unsigned urlLength, int lineNumber);
+
+    bool pauseOnExceptions();
+    void setPauseOnExceptions(bool);
+
+    void pauseInDebugger();
+    void resumeDebugger();
+
+    void stepOverStatementInDebugger();
+    void stepIntoStatementInDebugger();
+    void stepOutOfFunctionInDebugger();
+
+    unsigned timeoutForJavaScriptExecution() const;
+    void setTimeoutForJavaScriptExecution(unsigned ms);
+
+    void setCaretHighlightStyle(Platform::CaretHighlightStyle);
+
+    // IMF functions.
+    bool setBatchEditingActive(bool);
+    bool setInputSelection(unsigned start, unsigned end);
+    int inputCaretPosition() const;
+    bool deleteTextRelativeToCursor(unsigned leftOffset, unsigned rightOffset);
+    spannable_string_t* selectedText(int32_t flags);
+    spannable_string_t* textBeforeCursor(int32_t length, int32_t flags);
+    spannable_string_t* textAfterCursor(int32_t length, int32_t flags);
+    extracted_text_t* extractedTextRequest(extracted_text_request_t*, int32_t flags);
+    int32_t setComposingRegion(int32_t start, int32_t end);
+    int32_t finishComposition();
+    int32_t setComposingText(spannable_string_t*, int32_t relativeCursorPosition);
+    int32_t commitText(spannable_string_t*, int32_t relativeCursorPosition);
+
+    void spellCheckingEnabled(bool);
+
+    void setSelection(const Platform::IntPoint& startPoint, const Platform::IntPoint& endPoint);
+    void setCaretPosition(const Platform::IntPoint&);
+    void selectAtPoint(const Platform::IntPoint&);
+    void selectionCancelled();
+    bool selectionContains(const Platform::IntPoint&);
+
+    void popupListClosed(int size, bool* selecteds);
+    void popupListClosed(int index);
+    void setDateTimeInput(const WebString& value);
+    void setColorInput(const WebString& value);
+
+    void onInputLocaleChanged(bool isRTL);
+    static void onNetworkAvailabilityChanged(bool available);
+    static void onCertificateStoreLocationSet(const WebString& caPath);
+
+    WebString textHasAttribute(const WebString& query) const;
+
+    ActiveNodeContext activeNodeContext(TargetDetectionStrategy) const;
+
+    typedef intptr_t BackForwardId;
+    struct BackForwardEntry {
+        WebString url;
+        WebString originalUrl;
+        WebString title;
+        WebString networkToken;
+        BackForwardId id;
+        bool lastVisitWasHTTPNonGet;
+    };
+
+    bool canGoBackOrForward(int delta) const;
+    // Returns false if there is no page for the given delta (eg.
+    // attempt to go back with -1 when on the first page).
+    bool goBackOrForward(int delta);
+    void goToBackForwardEntry(BackForwardId);
+
+    int backForwardListLength() const;
+    void getBackForwardList(SharedArray<BackForwardEntry>& result, unsigned& resultLength) const;
+    void releaseBackForwardEntry(BackForwardId) const;
+    void clearBackForwardList(bool keepCurrentPage) const;
+
+    void addVisitedLink(const unsigned short* url, unsigned length);
+
+#if defined(ENABLE_WEBDOM) && ENABLE_WEBDOM
+    WebDOMDocument document() const;
+    WebDOMNode nodeAtPoint(int x, int y);
+    bool getNodeRect(const WebDOMNode&, Platform::IntRect& result);
+    bool setNodeFocus(const WebDOMNode&, bool on);
+    bool setNodeHovered(const WebDOMNode&, bool on);
+    bool nodeHasHover(const WebDOMNode&);
+#endif
+
+    bool defersLoading() const;
+
+    bool willFireTimer();
+
+    bool isEnableLocalAccessToAllCookies() const;
+    void setEnableLocalAccessToAllCookies(bool);
+
+    void enableWebInspector();
+    void disableWebInspector();
+    void enablePasswordEcho();
+    void disablePasswordEcho();
+    void dispatchInspectorMessage(const char* message, int length);
+    WebCore::Frame* mainFrame() const;
+
+    // FIXME: Needs API review on this header. See PR #120402.
+    void notifyPagePause();
+    void notifyPageResume();
+    void notifyPageBackground();
+    void notifyPageForeground();
+    void notifyPageFullScreenAllowed();
+    void notifyPageFullScreenExit();
+    void notifyDeviceIdleStateChange(bool enterIdle);
+    void notifyAppActivationStateChange(ActivationStateType);
+    void notifySwipeEvent();
+    void notifyScreenPowerStateChanged(bool powered);
+    void notifyFullScreenVideoExited(bool done);
+    void clearPluginSiteData();
+    void setJavaScriptCanAccessClipboard(bool);
+    bool isWebGLEnabled() const;
+    void setWebGLEnabled(bool);
+
+    void destroyWebPageCompositor();
+
+private:
+    ~WebPage();
+
+    friend class WebKit::BackingStore;
+    friend class WebKit::BackingStoreClient;
+    friend class WebKit::BackingStorePrivate;
+    friend class WebKit::RenderQueue;
+    friend class WebKit::WebPageGroupLoadDeferrer;
+    friend class WebCore::ChromeClientBlackBerry;
+    friend class WebCore::FrameLoaderClientBlackBerry;
+    WebPagePrivate* d;
+};
+}
+}
+
+#endif // WebPage_h
diff --git a/Source/WebKit/blackberry/Api/WebPageClient.h b/Source/WebKit/blackberry/Api/WebPageClient.h
new file mode 100644
index 000000000..74b735c77
--- /dev/null
+++ b/Source/WebKit/blackberry/Api/WebPageClient.h
@@ -0,0 +1,288 @@
+/*
+ * Copyright (C) 2009, 2010, 2011, 2012 Research In Motion Limited. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+#ifndef WebPageClient_h
+#define WebPageClient_h
+
+#include "BlackBerryGlobal.h"
+#include "WebString.h"
+
+#include <BlackBerryPlatformCursor.h>
+#include <BlackBerryPlatformInputEvents.h>
+#include <BlackBerryPlatformNavigationType.h>
+#include <BlackBerryPlatformPrimitives.h>
+#include <interaction/ScrollViewBase.h>
+#include <vector>
+
+template<typename T> class ScopeArray;
+template<typename T> class SharedArray;
+
+typedef void* WebFrame;
+
+namespace BlackBerry {
+
+namespace Platform {
+class FilterStream;
+class GeoTrackerListener;
+class IntRectRegion;
+class NetworkRequest;
+class NetworkStreamFactory;
+
+namespace Graphics {
+class Window;
+}
+}
+
+namespace WebKit {
+class WebPage;
+
+class BLACKBERRY_EXPORT WebPageClient {
+public:
+    virtual ~WebPageClient() { }
+    enum WindowStyleFlag {
+        FlagWindowHasMenuBar = 0x00000001,
+        FlagWindowHasToolBar = 0x00000002,
+        FlagWindowHasLocationBar = 0x00000004,
+        FlagWindowHasStatusBar = 0x00000008,
+        FlagWindowHasScrollBar = 0x00000010,
+        FlagWindowIsResizable = 0x00000020,
+        FlagWindowIsFullScreen = 0x00000040,
+        FlagWindowIsDialog = 0x00000080,
+        FlagWindowDefault = 0xFFFFFFFF,
+    };
+
+    enum FocusType {
+        FocusUnknown = 0,
+        FocusNone,
+        FocusCanvas,
+        FocusImage,
+        FocusInputButton,
+        FocusInputCheckBox,
+        FocusInputColor,
+        FocusInputDate,
+        FocusInputDateTime,
+        FocusInputDateTimeLocal,
+        FocusInputEmail,
+        FocusInputFile,
+        FocusInputImage,
+        FocusInputMonth,
+        FocusInputNumber,
+        FocusInputPassword,
+        FocusInputRadio,
+        FocusInputRange,
+        FocusInputReset,
+        FocusInputSearch,
+        FocusInputSubmit,
+        FocusInputTelephone,
+        FocusInputText,
+        FocusInputTime,
+        FocusInputURL,
+        FocusInputWeek,
+        FocusInputUnknown,
+        FocusLink,
+        FocusObject,
+        FocusSelect,
+        FocusSVGElement,
+        FocusTextArea,
+        FocusVideo,
+    };
+
+    enum AlertType {
+        MediaOK = 0,
+        MediaDecodeError,
+        MediaMetaDataError,
+        MediaMetaDataTimeoutError,
+        MediaNoMetaDataError,
+        MediaVideoReceiveError,
+        MediaAudioReceiveError,
+        MediaInvalidError,
+    };
+
+    virtual int getInstanceId() const = 0;
+
+    virtual void notifyLoadStarted() = 0;
+    virtual void notifyLoadCommitted(const unsigned short* originalUrl, unsigned int originalUrlLength, const unsigned short* finalUrl, unsigned int finalUrlLength, const unsigned short* networkToken, unsigned int networkTokenLength) = 0;
+    virtual void notifyLoadFailedBeforeCommit(const unsigned short* originalUrl, unsigned int originalUrlLength, const unsigned short* finalUrl, unsigned int finalUrlLength, const unsigned short* networkToken, unsigned int networkTokenLength) = 0;
+    virtual void notifyLoadToAnchor(const unsigned short* url, unsigned int urlLength, const unsigned short* networkToken, unsigned int networkTokenLength) = 0;
+    virtual void notifyLoadProgress(int percentage) = 0;
+    virtual void notifyLoadReadyToRender(bool pageIsVisuallyNonEmpty) = 0;
+    virtual void notifyFirstVisuallyNonEmptyLayout() = 0;
+    virtual void notifyLoadFinished(int status) = 0;
+    virtual void notifyClientRedirect(const unsigned short* originalUrl, unsigned int originalUrlLength, const unsigned short* finalUrl, unsigned int finalUrlLength) = 0;
+
+    virtual void notifyFrameDetached(const WebFrame) = 0;
+
+    virtual void notifyRunLayoutTestsFinished() = 0;
+
+    virtual void notifyInRegionScrollingStartingPointChanged(std::vector<Platform::ScrollViewBase>) = 0;
+
+    virtual void notifyDocumentOnLoad() = 0;
+
+    virtual void notifyWindowObjectCleared() = 0;
+    virtual WebString invokeClientJavaScriptCallback(const char* const* args, unsigned numArgs) = 0;
+
+    virtual void addMessageToConsole(const unsigned short* message, unsigned messageLength, const unsigned short* source, unsigned sourceLength, unsigned lineNumber) = 0;
+    virtual int showAlertDialog(AlertType) = 0;
+
+    virtual void runJavaScriptAlert(const unsigned short* message, unsigned messageLength, const char* origin, unsigned originLength) = 0;
+    virtual bool runJavaScriptConfirm(const unsigned short* message, unsigned messageLength, const char* origin, unsigned originLength) = 0;
+    virtual bool runJavaScriptPrompt(const unsigned short* message, unsigned messageLength, const unsigned short* defaultValue, unsigned defaultValueLength, const char* origin, unsigned originLength, WebString& result) = 0;
+
+    virtual bool shouldInterruptJavaScript() = 0;
+
+    virtual void javascriptSourceParsed(const unsigned short* url, unsigned urlLength, const unsigned short* script, unsigned scriptLength) = 0;
+    virtual void javascriptParsingFailed(const unsigned short* url, unsigned urlLength, const unsigned short* error, unsigned errorLength, int lineNumber) = 0;
+    virtual void javascriptPaused(const unsigned short* stack, unsigned stackLength) = 0;
+    virtual void javascriptContinued() = 0;
+
+    // All of these methods use transformed coordinates.
+    virtual void contentsSizeChanged(const Platform::IntSize&) const = 0;
+    virtual void scrollChanged(const Platform::IntPoint&) const = 0;
+    virtual void zoomChanged(bool isMinZoomed, bool isMaxZoomed, bool isAtInitialZoom, double newZoom) const = 0;
+
+    virtual void setPageTitle(const unsigned short* title, unsigned titleLength) = 0;
+
+    virtual Platform::Graphics::Window* window() const = 0;
+
+    virtual void notifyContentRendered(const Platform::IntRect&) = 0;
+    virtual void notifyScreenRotated() = 0;
+
+    virtual void drawTapHighlight(const Platform::IntRectRegion&, int red, int green, int blue, int alpha, bool hideAfterScroll) = 0;
+    virtual void hideTapHighlight() = 0;
+
+    virtual void focusChanged(FocusType, int elementId) = 0;
+    virtual void inputFocusGained(Platform::BlackBerryInputType, int inputStyle, bool waitForExplicitKeyboardShowCall) = 0;
+    virtual void inputFocusLost() = 0;
+    virtual void inputTextChanged() = 0;
+    virtual void inputSelectionChanged(unsigned selectionStart, unsigned selectionEnd) = 0;
+    virtual void inputLearnText(wchar_t* text, int length) = 0;
+
+    virtual void showVirtualKeyboard(bool) = 0;
+
+    virtual void checkSpellingOfString(const unsigned short* text, int length, int& misspellingLocation, int& misspellingLength) = 0;
+    virtual void requestSpellingSuggestionsForString(unsigned start, unsigned end) = 0;
+
+    virtual void notifySelectionDetailsChanged(const Platform::IntRect& start, const Platform::IntRect& end, const Platform::IntRectRegion&) = 0;
+    virtual void cancelSelectionVisuals() = 0;
+    virtual void notifySelectionHandlesReversed() = 0;
+    virtual void notifyCaretChanged(const Platform::IntRect& caret, bool userTouchTriggered) = 0;
+
+    virtual void cursorChanged(Platform::CursorType, const char* url, int x, int y) = 0;
+
+    virtual void requestGeolocationPermission(Platform::GeoTrackerListener*, void* context, const char* origin, unsigned originLength) = 0;
+    virtual void cancelGeolocationPermission(Platform::GeoTrackerListener*, void* context) = 0;
+    virtual Platform::NetworkStreamFactory* networkStreamFactory() = 0;
+
+    virtual void handleStringPattern(const unsigned short* pattern, unsigned length) = 0;
+    virtual void handleExternalLink(const Platform::NetworkRequest&, const unsigned short* context, unsigned contextLength, bool isClientRedirect) = 0;
+
+    virtual void resetBackForwardList(unsigned listSize, unsigned currentIndex) = 0;
+
+    virtual void openPopupList(bool multiple, int size, const ScopeArray<WebString>& labels, bool* enableds, const int* itemType, bool* selecteds) = 0;
+    virtual void openDateTimePopup(int type, const WebString& value, const WebString& min, const WebString& max, double step) = 0;
+    virtual void openColorPopup(const WebString& value) = 0;
+
+    virtual bool chooseFilenames(bool allowMultiple, const WebString& acceptTypes, const SharedArray<WebString>& initialFiles, unsigned initialFileSize, SharedArray<WebString>& chosenFiles, unsigned& chosenFileSize) = 0;
+
+    virtual void loadPluginForMimetype(int, int width, int height, const SharedArray<WebString>& paramNames, const SharedArray<WebString>& paramValues, int size, const char* url) = 0;
+    virtual void notifyPluginRectChanged(int, Platform::IntRect rectChanged) = 0;
+    virtual void destroyPlugin(int) = 0;
+    virtual void playMedia(int) = 0;
+    virtual void pauseMedia(int) = 0;
+    virtual float getTime(int) = 0;
+    virtual void setTime(int, float) = 0;
+    virtual void setVolume(int, float) = 0;
+    virtual void setMuted(int, bool) = 0;
+
+    virtual WebPage* createWindow(int x, int y, int width, int height, unsigned flags, const WebString& url, const WebString& windowName) = 0;
+
+    virtual void scheduleCloseWindow() = 0;
+
+    // Database interface.
+    virtual unsigned long long databaseQuota(const unsigned short* origin, unsigned originLength, const unsigned short* databaseName, unsigned databaseNameLength, unsigned long long totalUsage, unsigned long long originUsage, unsigned long long estimatedSize) = 0;
+
+    virtual void setIconForUrl(const char* originalPageUrl, const char* finalPageUrl, const char* iconUrl) = 0;
+    virtual void setFavicon(int width, int height, unsigned char* iconData, const char* url) = 0;
+    virtual void setLargeIcon(const char* iconUrl) = 0;
+    virtual void setWebAppCapable() = 0;
+    virtual void setSearchProviderDetails(const char* title, const char* documentUrl) = 0;
+    virtual void setAlternateFeedDetails(const char* title, const char* feedUrl) = 0;
+
+    virtual WebString getErrorPage(int errorCode, const char* errorMessage, const char* url) = 0;
+
+    virtual void willDeferLoading() = 0;
+    virtual void didResumeLoading() = 0;
+
+    // Headers is a list of alternating key and value.
+    virtual void setMetaHeaders(const ScopeArray<WebString>& headers, unsigned int headersSize) = 0;
+
+    virtual void needMoreData() = 0;
+    virtual void handleWebInspectorMessageToFrontend(int id, const char* message, int length) = 0;
+
+    virtual bool hasPendingScrollOrZoomEvent() const = 0;
+    virtual Platform::IntRect userInterfaceBlittedDestinationRect() const = 0;
+    virtual Platform::IntRect userInterfaceBlittedVisibleContentsRect() const = 0;
+
+    virtual void resetBitmapZoomScale(double scale) = 0;
+    virtual void animateBlockZoom(const Platform::FloatPoint& finalPoint, double finalScale) = 0;
+
+    virtual void setPreventsScreenIdleDimming(bool noDimming) = 0;
+    virtual void authenticationChallenge(const unsigned short* realm, unsigned int realmLength, WebString& username, WebString& password) = 0;
+
+    virtual bool shouldPluginEnterFullScreen() = 0;
+    virtual void didPluginEnterFullScreen() = 0;
+    virtual void didPluginExitFullScreen() = 0;
+    virtual void onPluginStartBackgroundPlay() = 0;
+    virtual void onPluginStopBackgroundPlay() = 0;
+    virtual bool lockOrientation(bool landscape) = 0;
+    virtual void unlockOrientation() = 0;
+    virtual bool isActive() const = 0;
+    virtual void requestWebGLPermission(const WebString&) = 0;
+
+    virtual void setToolTip(WebString) = 0;
+    virtual void setStatus(WebString) = 0;
+    virtual bool acceptNavigationRequest(const Platform::NetworkRequest&, Platform::NavigationType) = 0;
+    virtual void cursorEventModeChanged(Platform::CursorEventMode) = 0;
+    virtual void touchEventModeChanged(Platform::TouchEventMode) = 0;
+
+    virtual bool downloadAllowed(const char* url) = 0;
+    virtual void downloadRequested(const Platform::NetworkRequest&) = 0;
+    virtual void downloadRequested(Platform::FilterStream*, const WebString& suggestedFilename) = 0;
+
+    virtual int fullscreenStart(const char* contextName, Platform::Graphics::Window*, unsigned x, unsigned y, unsigned width, unsigned height) = 0;
+
+    virtual int fullscreenStop() = 0;
+
+    virtual int fullscreenWindowSet(unsigned x, unsigned y, unsigned width, unsigned height) = 0;
+
+    virtual void drawVerticalScrollbar() = 0;
+    virtual void drawHorizontalScrollbar() = 0;
+    virtual void populateCustomHeaders(Platform::NetworkRequest&) = 0;
+
+    virtual void notifyWillUpdateApplicationCache() = 0;
+    virtual void notifyDidLoadFromApplicationCache() = 0;
+
+    virtual void clearCookies() = 0;
+    virtual void clearCache() = 0;
+
+    virtual bool hasKeyboardFocus() = 0;
+};
+} // namespace WebKit
+} // namespace BlackBerry
+
+#endif // WebPageClient_h
diff --git a/Source/WebKit/blackberry/Api/WebPageGroupLoadDeferrer.cpp b/Source/WebKit/blackberry/Api/WebPageGroupLoadDeferrer.cpp
new file mode 100644
index 000000000..084f2f42a
--- /dev/null
+++ b/Source/WebKit/blackberry/Api/WebPageGroupLoadDeferrer.cpp
@@ -0,0 +1,41 @@
+/*
+ * Copyright (C) 2010, 2011, 2012 Research In Motion Limited. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+#include "config.h"
+#include "WebPageGroupLoadDeferrer.h"
+
+#include "PageGroupLoadDeferrer.h"
+#include "WebPage.h"
+#include "WebPage_p.h"
+
+namespace BlackBerry {
+namespace WebKit {
+
+WebPageGroupLoadDeferrer::WebPageGroupLoadDeferrer(WebPage* webPage)
+{
+    WebCore::TimerBase::fireTimersInNestedEventLoop();
+    m_pageGroupLoadDeferrer = new WebCore::PageGroupLoadDeferrer(webPage->d->m_page, true /* defer the page itself */);
+}
+
+WebPageGroupLoadDeferrer::~WebPageGroupLoadDeferrer()
+{
+    delete m_pageGroupLoadDeferrer;
+}
+
+} // namespace WebKit
+} // namespace BlackBerry
diff --git a/Source/WebKit/blackberry/Api/WebPageGroupLoadDeferrer.h b/Source/WebKit/blackberry/Api/WebPageGroupLoadDeferrer.h
new file mode 100644
index 000000000..cb651ed9d
--- /dev/null
+++ b/Source/WebKit/blackberry/Api/WebPageGroupLoadDeferrer.h
@@ -0,0 +1,46 @@
+/*
+ * Copyright (C) 2010, 2011, 2012 Research In Motion Limited. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+#ifndef WebPageGroupLoadDeferrer_h
+#define WebPageGroupLoadDeferrer_h
+
+#include "BlackBerryGlobal.h"
+
+namespace WebCore {
+class PageGroupLoadDeferrer;
+}
+
+namespace BlackBerry {
+namespace WebKit {
+
+class WebPage;
+
+// WebPageGroupLoadDeferrer is supposed to be used in the same way as WebCore::PageGroupLoadDeferrer.
+// Declare a WebPageGroupLoadDeferrer object in the scope where the page group should defer loading and DOM timers.
+class BLACKBERRY_EXPORT WebPageGroupLoadDeferrer {
+public:
+    explicit WebPageGroupLoadDeferrer(WebPage*);
+    ~WebPageGroupLoadDeferrer();
+private:
+    WebCore::PageGroupLoadDeferrer* m_pageGroupLoadDeferrer;
+};
+
+} // namespace WebKit
+} // namespace BlackBerry
+
+#endif // WebPageGroupLoadDeferrer_h
diff --git a/Source/WebKit/blackberry/Api/WebPage_p.h b/Source/WebKit/blackberry/Api/WebPage_p.h
new file mode 100644
index 000000000..e0238b6d6
--- /dev/null
+++ b/Source/WebKit/blackberry/Api/WebPage_p.h
@@ -0,0 +1,517 @@
+/*
+ * Copyright (C) 2009, 2010, 2011, 2012 Research In Motion Limited. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+#ifndef WebPage_p_h
+#define WebPage_p_h
+
+#include "ChromeClient.h"
+#if USE(ACCELERATED_COMPOSITING)
+#include "LayerRenderer.h"
+#endif
+#include "PageClientBlackBerry.h"
+#include "PlatformMouseEvent.h"
+#include "ScriptSourceCode.h"
+#include "Timer.h"
+#include "ViewportArguments.h"
+#include "WebPage.h"
+#include "WebSettings.h"
+
+#include <BlackBerryPlatformMessage.h>
+
+namespace WebCore {
+class DOMWrapperWorld;
+class Document;
+class Frame;
+class FrameView;
+class GeolocationControllerClientBlackBerry;
+class JavaScriptDebuggerBlackBerry;
+class KURL;
+class Node;
+class Page;
+class PluginView;
+class RenderLayer;
+class RenderObject;
+class ScrollView;
+class TransformationMatrix;
+template<typename T> class Timer;
+}
+
+namespace BlackBerry {
+namespace WebKit {
+
+class BackingStore;
+class BackingStoreClient;
+class BackingStoreTile;
+class DumpRenderTreeClient;
+class InPageSearchManager;
+class InputHandler;
+class InRegionScrollableArea;
+class SelectionHandler;
+class TouchEventHandler;
+class WebPageClient;
+
+#if USE(ACCELERATED_COMPOSITING)
+class FrameLayers;
+class WebPageCompositor;
+#endif
+
+// In the client code, there is screen size and viewport.
+// In WebPagePrivate, the screen size is called the transformedViewportSize,
+// the viewport position is called the transformedScrollPosition,
+// and the viewport size is called the transformedActualVisibleSize.
+class WebPagePrivate : public PageClientBlackBerry, public WebSettingsDelegate, public Platform::GuardedPointerBase {
+public:
+    enum ViewMode { Mobile, Desktop, FixedDesktop };
+    enum LoadState { None /* on instantiation of page */, Provisional, Committed, Finished, Failed };
+
+    WebPagePrivate(WebPage*, WebPageClient*, const WebCore::IntRect&);
+    virtual ~WebPagePrivate();
+
+    void init(const WebString& pageGroupName);
+    bool handleMouseEvent(WebCore::PlatformMouseEvent&);
+    bool handleWheelEvent(WebCore::PlatformWheelEvent&);
+
+    void load(const char* url, const char* networkToken, const char* method, Platform::NetworkRequest::CachePolicy, const char* data, size_t dataLength, const char* const* headers, size_t headersLength, bool isInitial, bool mustHandleInternally = false, bool forceDownload = false, const char* overrideContentType = "");
+    void loadString(const char* string, const char* baseURL, const char* mimeType, const char* failingURL = 0);
+    bool executeJavaScript(const char* script, JavaScriptDataType& returnType, WebString& returnValue);
+    bool executeJavaScriptInIsolatedWorld(const WebCore::ScriptSourceCode&, JavaScriptDataType& returnType, WebString& returnValue);
+
+    void stopCurrentLoad();
+    void prepareToDestroy();
+
+    LoadState loadState() const { return m_loadState; }
+    bool isLoading() const { return m_loadState == WebPagePrivate::Provisional || m_loadState == WebPagePrivate::Committed; }
+
+    // Called from within WebKit via FrameLoaderClientBlackBerry.
+    void setLoadState(LoadState);
+
+    // Clamp the scale.
+    double clampedScale(double scale) const;
+
+    // Determine if we should zoom, clamping the scale parameter if required.
+    bool shouldZoomAboutPoint(double scale, const WebCore::FloatPoint& anchor, bool enforeScaleClamping, double* clampedScale);
+
+    // Scale the page to the given scale and anchor about the point which is specified in untransformed content coordinates.
+    bool zoomAboutPoint(double scale, const WebCore::FloatPoint& anchor, bool enforceScaleClamping = true, bool forceRendering = false, bool isRestoringZoomLevel = false);
+    bool scheduleZoomAboutPoint(double scale, const WebCore::FloatPoint& anchor, bool enforceScaleClamping = true, bool forceRendering = false);
+    void unscheduleZoomAboutPoint();
+    WebCore::IntPoint calculateReflowedScrollPosition(const WebCore::FloatPoint& anchorOffset, double inverseScale);
+    void setTextReflowAnchorPoint(const Platform::IntPoint& focalPoint);
+
+    void schedulePinchZoomAboutPoint(double scale, const WebCore::IntPoint& anchor);
+
+    // Perform actual zoom for block zoom.
+    void zoomBlock();
+
+    // Called by the backing store as well as the method below.
+    void requestLayoutIfNeeded() const;
+    void setNeedsLayout();
+
+    WebCore::IntPoint scrollPosition() const;
+    WebCore::IntPoint maximumScrollPosition() const;
+    void setScrollPosition(const WebCore::IntPoint&);
+    bool scrollBy(int deltaX, int deltaY, bool scrollMainFrame = true);
+
+    void enqueueRenderingOfClippedContentOfScrollableNodeAfterInRegionScrolling(WebCore::Node*);
+    std::vector<Platform::ScrollViewBase> inRegionScrollableAreasForPoint(const Platform::IntPoint&);
+    void notifyInRegionScrollStatusChanged(bool status);
+    void setScrollOriginPoint(const Platform::IntPoint&);
+    void setHasInRegionScrollableAreas(bool);
+
+    // The actual visible size as reported by the client, but in WebKit coordinates.
+    WebCore::IntSize actualVisibleSize() const;
+
+    // The viewport size is the same as the client's window size, but in webkit coordinates.
+    WebCore::IntSize viewportSize() const;
+
+    // Modifies the zoomToFit algorithm logic to construct a scale such that the viewportSize above is equal to this size.
+    bool hasVirtualViewport() const;
+    bool isUserScalable() const { return m_userScalable; }
+    void setUserScalable(bool userScalable) { m_userScalable = userScalable; }
+
+    // Sets default layout size without doing layout or marking as needing layout.
+    void setDefaultLayoutSize(const WebCore::IntSize&);
+
+    // Updates WebCore when the viewportSize() or actualVisibleSize() change.
+    void updateViewportSize(bool setFixedReportedSize = true, bool sendResizeEvent = true);
+
+    WebCore::FloatPoint centerOfVisibleContentsRect() const;
+    WebCore::IntRect visibleContentsRect() const;
+    WebCore::IntSize contentsSize() const;
+    WebCore::IntSize absoluteVisibleOverflowSize() const;
+
+    // Virtual functions inherited from PageClientBlackBerry.
+    virtual void setCursor(WebCore::PlatformCursorHandle);
+    virtual Platform::NetworkStreamFactory* networkStreamFactory();
+    virtual Platform::Graphics::Window* platformWindow() const;
+    virtual void setPreventsScreenDimming(bool preventDimming);
+    virtual void showVirtualKeyboard(bool showKeyboard);
+    virtual void ensureContentVisible(bool centerInView = true);
+    virtual void zoomToContentRect(const WebCore::IntRect&);
+    virtual void registerPlugin(WebCore::PluginView*, bool);
+    virtual void notifyPageOnLoad();
+    virtual bool shouldPluginEnterFullScreen(WebCore::PluginView*, const char*);
+    virtual void didPluginEnterFullScreen(WebCore::PluginView*, const char*);
+    virtual void didPluginExitFullScreen(WebCore::PluginView*, const char*);
+    virtual void onPluginStartBackgroundPlay(WebCore::PluginView*, const char*);
+    virtual void onPluginStopBackgroundPlay(WebCore::PluginView*, const char*);
+    virtual bool lockOrientation(bool landscape);
+    virtual void unlockOrientation();
+    virtual int orientation() const;
+    virtual double currentZoomFactor() const;
+    virtual int showAlertDialog(WebPageClient::AlertType atype);
+    virtual bool isActive() const;
+
+    // Called from within WebKit via ChromeClientBlackBerry.
+    void enterFullscreenForNode(WebCore::Node*);
+    void exitFullscreenForNode(WebCore::Node*);
+    void contentsSizeChanged(const WebCore::IntSize&);
+    void overflowExceedsContentsSize() { m_overflowExceedsContentsSize = true; }
+    void layoutFinished();
+    void setNeedTouchEvents(bool);
+
+    // Called according to our heuristic or from setLoadState depending on whether we have a virtual viewport.
+    void zoomToInitialScaleOnLoad();
+
+    // Various scale factors.
+    double currentScale() const { return m_transformationMatrix->m11(); }
+    double zoomToFitScale() const;
+    double initialScale() const;
+    void setInitialScale(double scale) { m_initialScale = scale; }
+    double minimumScale() const
+    {
+        return (m_minimumScale > zoomToFitScale() && m_minimumScale <= maximumScale()) ? m_minimumScale : zoomToFitScale();
+    }
+
+    void setMinimumScale(double scale) { m_minimumScale = scale; }
+    double maximumScale() const;
+    void setMaximumScale(double scale) { m_maximumScale = scale; }
+    void resetScales();
+
+    // Note: to make this reflow width transform invariant just use
+    // transformedActualVisibleSize() here instead!
+    int reflowWidth() const { return actualVisibleSize().width(); }
+
+    // These methods give the real geometry of the device given the currently set transform.
+    WebCore::IntPoint transformedScrollPosition() const;
+    WebCore::IntPoint transformedMaximumScrollPosition() const;
+    WebCore::IntSize transformedActualVisibleSize() const;
+    WebCore::IntSize transformedViewportSize() const;
+    WebCore::IntRect transformedVisibleContentsRect() const;
+    WebCore::IntSize transformedContentsSize() const;
+
+    // Generic conversions of points, rects, relative to and from contents and viewport.
+    WebCore::IntPoint mapFromContentsToViewport(const WebCore::IntPoint&) const;
+    WebCore::IntPoint mapFromViewportToContents(const WebCore::IntPoint&) const;
+    WebCore::IntRect mapFromContentsToViewport(const WebCore::IntRect&) const;
+    WebCore::IntRect mapFromViewportToContents(const WebCore::IntRect&) const;
+
+    // Generic conversions of points, rects, relative to and from transformed contents and transformed viewport.
+    WebCore::IntPoint mapFromTransformedContentsToTransformedViewport(const WebCore::IntPoint&) const;
+    WebCore::IntPoint mapFromTransformedViewportToTransformedContents(const WebCore::IntPoint&) const;
+    WebCore::IntRect mapFromTransformedContentsToTransformedViewport(const WebCore::IntRect&) const;
+    WebCore::IntRect mapFromTransformedViewportToTransformedContents(const WebCore::IntRect&) const;
+
+    // Generic conversions of points, rects, and sizes to and from transformed coordinates.
+    WebCore::IntPoint mapToTransformed(const WebCore::IntPoint&) const;
+    WebCore::FloatPoint mapToTransformedFloatPoint(const WebCore::FloatPoint&) const;
+    WebCore::IntPoint mapFromTransformed(const WebCore::IntPoint&) const;
+    WebCore::FloatPoint mapFromTransformedFloatPoint(const WebCore::FloatPoint&) const;
+    WebCore::FloatRect mapFromTransformedFloatRect(const WebCore::FloatRect&) const;
+    WebCore::IntSize mapToTransformed(const WebCore::IntSize&) const;
+    WebCore::IntSize mapFromTransformed(const WebCore::IntSize&) const;
+    WebCore::IntRect mapToTransformed(const WebCore::IntRect&) const;
+    void clipToTransformedContentsRect(WebCore::IntRect&) const;
+    WebCore::IntRect mapFromTransformed(const WebCore::IntRect&) const;
+    bool transformedPointEqualsUntransformedPoint(const WebCore::IntPoint& transformedPoint, const WebCore::IntPoint& untransformedPoint);
+
+    // Notification methods that deliver changes to the real geometry of the device as specified above.
+    void notifyTransformChanged();
+    void notifyTransformedContentsSizeChanged();
+    void notifyTransformedScrollChanged();
+
+    void assignFocus(Platform::FocusDirection);
+    Platform::IntRect focusNodeRect();
+    WebCore::IntRect getRecursiveVisibleWindowRect(WebCore::ScrollView*, bool noClipOfMainFrame = false);
+
+    WebCore::IntPoint frameOffset(const WebCore::Frame*) const;
+
+    WebCore::Node* bestNodeForZoomUnderPoint(const WebCore::IntPoint&);
+    WebCore::Node* bestChildNodeForClickRect(WebCore::Node* parentNode, const WebCore::IntRect& clickRect);
+    WebCore::Node* nodeForZoomUnderPoint(const WebCore::IntPoint&);
+    WebCore::Node* adjustedBlockZoomNodeForZoomLimits(WebCore::Node*);
+    WebCore::IntRect rectForNode(WebCore::Node*);
+    WebCore::IntRect blockZoomRectForNode(WebCore::Node*);
+    WebCore::IntRect adjustRectOffsetForFrameOffset(const WebCore::IntRect&, const WebCore::Node*);
+    bool compareNodesForBlockZoom(WebCore::Node* n1, WebCore::Node* n2);
+    double newScaleForBlockZoomRect(const WebCore::IntRect&, double oldScale, double margin);
+    double maxBlockZoomScale() const;
+
+    // Plugin Methods.
+    void notifyPluginRectChanged(int id, const WebCore::IntRect& rectChanged);
+
+    // Context Methods.
+    ActiveNodeContext activeNodeContext(TargetDetectionStrategy);
+    PassRefPtr<WebCore::Node> contextNode(TargetDetectionStrategy);
+
+#if ENABLE(VIEWPORT_REFLOW)
+    void toggleTextReflowIfEnabledForBlockZoomOnly(bool shouldEnableTextReflow = false);
+#endif
+
+    void selectionChanged(WebCore::Frame*);
+
+    void updateDelegatedOverlays(bool dispatched = false);
+
+    void updateCursor();
+
+    void onInputLocaleChanged(bool isRTL);
+
+    ViewMode viewMode() const { return m_viewMode; }
+    bool setViewMode(ViewMode); // Returns true if the change requires re-layout.
+
+    void setShouldUseFixedDesktopMode(bool b) { m_shouldUseFixedDesktopMode = b; }
+
+    bool useFixedLayout() const;
+    WebCore::IntSize fixedLayoutSize(bool snapToIncrement = false) const;
+
+    // ZoomToFitOnLoad can lead to a large recursion depth in FrameView::layout() as we attempt
+    // to determine the zoom scale factor so as to have the content of the page fit within the
+    // area of the frame. From observation, we can bail out after a recursion depth of 10 and
+    // still have reasonable results.
+    bool didLayoutExceedMaximumIterations() const { return m_nestedLayoutFinishedCount > 10; }
+
+    void clearFocusNode();
+    WebCore::Frame* focusedOrMainFrame() const;
+    WebCore::Frame* mainFrame() const { return m_mainFrame; }
+
+    bool scrollNodeRecursively(WebCore::Node* originalNode, const WebCore::IntSize& delta);
+    bool scrollRenderer(WebCore::RenderObject* renderer, const WebCore::IntSize& delta);
+    void adjustScrollDelta(const WebCore::IntPoint& maxOffset, const WebCore::IntPoint& currentOffset, WebCore::IntSize& delta) const;
+
+    bool canScrollRenderBox(WebCore::RenderBox*);
+    bool canScrollInnerFrame(WebCore::Frame*) const;
+
+#if ENABLE(EVENT_MODE_METATAGS)
+    void didReceiveCursorEventMode(WebCore::CursorEventMode);
+    void didReceiveTouchEventMode(WebCore::TouchEventMode);
+#endif
+
+    void dispatchViewportPropertiesDidChange(const WebCore::ViewportArguments&);
+    WebCore::IntSize recomputeVirtualViewportFromViewportArguments();
+
+    void resetBlockZoom();
+
+    void zoomAboutPointTimerFired(WebCore::Timer<WebPagePrivate>*);
+    bool shouldSendResizeEvent();
+    void scrollEventTimerFired(WebCore::Timer<WebPagePrivate>*);
+    void resizeEventTimerFired(WebCore::Timer<WebPagePrivate>*);
+
+    // If this url should be handled as a pattern, returns the pattern
+    // otherwise, returns an empty string.
+    String findPatternStringForUrl(const WebCore::KURL&) const;
+
+    void suspendBackingStore();
+    void resumeBackingStore();
+
+    void setShouldResetTilesWhenShown(bool flag) { m_shouldResetTilesWhenShown = flag; }
+    bool shouldResetTilesWhenShown() const { return m_shouldResetTilesWhenShown; }
+
+    void setScreenOrientation(int);
+
+    // Scroll and/or zoom so that the WebPage fits the new actual
+    // visible size.
+    void setViewportSize(const WebCore::IntSize& transformedActualVisibleSize, bool ensureFocusElementVisible);
+    void screenRotated(); // Helper method for setViewportSize().
+
+    void scheduleDeferrableTimer(WebCore::Timer<WebPagePrivate>*, double timeOut);
+    void unscheduleAllDeferrableTimers();
+    void willDeferLoading();
+    void didResumeLoading();
+
+    // Returns true if the escape key handler should zoom.
+    bool shouldZoomOnEscape() const;
+
+    WebCore::TransformationMatrix* transformationMatrix() const
+    {
+        return m_transformationMatrix;
+    }
+
+#if USE(ACCELERATED_COMPOSITING)
+    // WebKit thread.
+    bool needsOneShotDrawingSynchronization();
+    void rootLayerCommitTimerFired(WebCore::Timer<WebPagePrivate>*);
+    bool commitRootLayerIfNeeded();
+    WebCore::LayerRenderingResults lastCompositingResults() const;
+
+    // WebKit thread, plumbed through from ChromeClientBlackBerry.
+    void setRootLayerWebKitThread(WebCore::Frame*, WebCore::LayerWebKitThread*);
+    void setNeedsOneShotDrawingSynchronization();
+    void scheduleRootLayerCommit();
+
+    // Thread safe.
+    void resetCompositingSurface();
+    void drawLayersOnCommit(); // Including backing store blit.
+    bool drawSubLayers(const WebCore::IntRect& dstRect, const WebCore::FloatRect& contents);
+    bool drawSubLayers(); // Draw them at last known position.
+
+    // Compositing thread.
+    void setRootLayerCompositingThread(WebCore::LayerCompositingThread*);
+    void commitRootLayer(const WebCore::IntRect&, const WebCore::IntSize&);
+    void setIsAcceleratedCompositingActive(bool);
+    void destroyCompositor();
+    void syncDestroyCompositorOnCompositingThread();
+    void destroyLayerResources();
+    void suspendRootLayerCommit();
+    void resumeRootLayerCommit();
+    void blitVisibleContents();
+#endif
+
+    bool dispatchTouchEventToFullScreenPlugin(WebCore::PluginView*, const Platform::TouchEvent&);
+    bool dispatchTouchPointAsMouseEventToFullScreenPlugin(WebCore::PluginView*, const Platform::TouchPoint&);
+    bool dispatchMouseEventToFullScreenPlugin(WebCore::PluginView*, const Platform::MouseEvent&);
+
+    BackingStoreClient* backingStoreClientForFrame(const WebCore::Frame*) const;
+    void addBackingStoreClientForFrame(const WebCore::Frame*, BackingStoreClient*);
+    void removeBackingStoreClientForFrame(const WebCore::Frame*);
+
+    // Clean up any document related data we might be holding.
+    void clearDocumentData(const WebCore::Document*);
+
+    static WebCore::RenderLayer* enclosingPositionedAncestorOrSelfIfPositioned(WebCore::RenderLayer*);
+    static WebCore::RenderLayer* enclosingFixedPositionedAncestorOrSelfIfFixedPositioned(WebCore::RenderLayer*);
+
+    static WebCore::IntSize defaultMaxLayoutSize();
+
+    WebPage* m_webPage;
+    WebPageClient* m_client;
+    WebCore::Page* m_page;
+    WebCore::Frame* m_mainFrame;
+    RefPtr<WebCore::Node> m_currentContextNode;
+    WebSettings* m_webSettings;
+
+#if ENABLE(JAVASCRIPT_DEBUGGER)
+    OwnPtr<WebCore::JavaScriptDebuggerBlackBerry> m_scriptDebugger;
+#endif
+
+    bool m_visible;
+    bool m_shouldResetTilesWhenShown;
+    bool m_userScalable;
+    bool m_userPerformedManualZoom;
+    bool m_userPerformedManualScroll;
+    bool m_contentsSizeChanged;
+    bool m_overflowExceedsContentsSize;
+    bool m_resetVirtualViewportOnCommitted;
+    bool m_shouldUseFixedDesktopMode;
+    bool m_needTouchEvents;
+    int m_preventIdleDimmingCount;
+
+#if ENABLE(TOUCH_EVENTS)
+    bool m_preventDefaultOnTouchStart;
+#endif
+    unsigned m_nestedLayoutFinishedCount;
+    WebCore::IntSize m_previousContentsSize;
+    int m_actualVisibleWidth;
+    int m_actualVisibleHeight;
+    int m_virtualViewportWidth;
+    int m_virtualViewportHeight;
+    WebCore::IntSize m_defaultLayoutSize;
+    WebCore::ViewportArguments m_viewportArguments; // We keep this around since we may need to re-evaluate the arguments on rotation.
+    bool m_didRestoreFromPageCache;
+    ViewMode m_viewMode;
+    LoadState m_loadState;
+    WebCore::TransformationMatrix* m_transformationMatrix;
+    BackingStore* m_backingStore;
+    BackingStoreClient* m_backingStoreClient;
+    InPageSearchManager* m_inPageSearchManager;
+    InputHandler* m_inputHandler;
+    SelectionHandler* m_selectionHandler;
+    TouchEventHandler* m_touchEventHandler;
+
+#if ENABLE(EVENT_MODE_METATAGS)
+    WebCore::CursorEventMode m_cursorEventMode;
+    WebCore::TouchEventMode m_touchEventMode;
+#endif
+
+    Platform::BlackBerryCursor m_currentCursor;
+
+    DumpRenderTreeClient* m_dumpRenderTree;
+
+    double m_initialScale;
+    double m_minimumScale;
+    double m_maximumScale;
+
+    // Block zoom animation data.
+    WebCore::FloatPoint m_finalBlockPoint;
+    WebCore::FloatPoint m_finalBlockPointReflowOffset;
+    double m_blockZoomFinalScale;
+    RefPtr<WebCore::Node> m_currentPinchZoomNode;
+    WebCore::FloatPoint m_anchorInNodeRectRatio;
+    RefPtr<WebCore::Node> m_currentBlockZoomNode;
+    RefPtr<WebCore::Node> m_currentBlockZoomAdjustedNode;
+    bool m_shouldReflowBlock;
+
+    // Delayed zoomAboutPoint.
+    OwnPtr<WebCore::Timer<WebPagePrivate> > m_delayedZoomTimer;
+    struct {
+        double scale;
+        WebCore::FloatPoint anchor;
+        bool enforceScaleClamping;
+        bool forceRendering;
+    } m_delayedZoomArguments;
+
+    double m_lastUserEventTimestamp; // Used to detect user scrolling.
+
+    WebCore::PlatformMouseEvent m_lastMouseEvent;
+    bool m_pluginMouseButtonPressed; // Used to track mouse button for full screen plugins.
+    bool m_pluginMayOpenNewTab;
+
+    WebCore::GeolocationControllerClientBlackBerry* m_geolocationClient;
+
+    HashSet<WebCore::PluginView*> m_pluginViews;
+
+    RefPtr<WebCore::Node> m_inRegionScrollStartingNode;
+
+#if USE(ACCELERATED_COMPOSITING)
+    bool m_isAcceleratedCompositingActive;
+    OwnPtr<FrameLayers> m_frameLayers; // WebKit thread only.
+    OwnPtr<WebPageCompositor> m_compositor; // Compositing thread only.
+    OwnPtr<WebCore::Timer<WebPagePrivate> > m_rootLayerCommitTimer;
+    bool m_needsOneShotDrawingSynchronization;
+    bool m_needsCommit;
+    bool m_suspendRootLayerCommit;
+#endif
+
+    int m_pendingOrientation;
+
+    RefPtr<WebCore::Node> m_fullscreenVideoNode;
+    RefPtr<WebCore::PluginView> m_fullScreenPluginView;
+
+    typedef HashMap<const WebCore::Frame*, BackingStoreClient*> BackingStoreClientForFrameMap;
+    BackingStoreClientForFrameMap m_backingStoreClientForFrameMap;
+
+    // WebSettingsDelegate methods.
+    virtual void didChangeSettings(WebSettings*);
+
+    RefPtr<WebCore::DOMWrapperWorld> m_isolatedWorld;
+    bool m_hasInRegionScrollableAreas;
+    bool m_updateDelegatedOverlaysDispatched;
+};
+}
+}
+
+#endif // WebPage_p_h
diff --git a/Source/WebKit/blackberry/Api/WebSettings.cpp b/Source/WebKit/blackberry/Api/WebSettings.cpp
new file mode 100644
index 000000000..960964cd8
--- /dev/null
+++ b/Source/WebKit/blackberry/Api/WebSettings.cpp
@@ -0,0 +1,816 @@
+/*
+ * Copyright (C) 2009, 2010, 2011, 2012 Research In Motion Limited. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+#include "config.h"
+#include "WebSettings.h"
+
+#include "WebSettings_p.h"
+
+#include "WebString.h"
+#include <Base64.h>
+#include <Color.h>
+#include <PageCache.h>
+#include <wtf/HashSet.h>
+#include <wtf/Vector.h>
+
+namespace BlackBerry {
+namespace WebKit {
+
+DEFINE_STATIC_LOCAL(String, BlackBerryAllowCrossSiteRequests, ("BlackBerryAllowCrossSiteRequests"));
+DEFINE_STATIC_LOCAL(String, BlackBerryBackgroundColor, ("BlackBerryBackgroundColor"));
+DEFINE_STATIC_LOCAL(String, BlackBerryCookiesEnabled, ("BlackBerryCookiesEnabled"));
+DEFINE_STATIC_LOCAL(String, BlackBerryDirectRenderingToWindowEnabled, ("BlackBerryDirectRenderingToWindowEnabled"));
+DEFINE_STATIC_LOCAL(String, BlackBerryDrawBorderWhileLoadingImages, ("BlackBerryDrawBorderWhileLoadingImages"));
+DEFINE_STATIC_LOCAL(String, BlackBerryEmailModeEnabled, ("BlackBerryEmailModeEnabled"));
+DEFINE_STATIC_LOCAL(String, BlackBerryGetFocusNodeContextEnabled, ("BlackBerryGetFocusNodeContextEnabled"));
+DEFINE_STATIC_LOCAL(String, BlackBerryHandlePatternURLs, ("BlackBerryHandlePatternURLs"));
+DEFINE_STATIC_LOCAL(String, BlackBerryInitialScale, ("BlackBerryInitialScale"));
+DEFINE_STATIC_LOCAL(String, BlackBerryLinksHandledExternallyEnabled, ("BlackBerryLinksHandledExternallyEnabled"));
+DEFINE_STATIC_LOCAL(String, BlackBerryMaxPluginInstances, ("BlackBerryMaxPluginInstances"));
+DEFINE_STATIC_LOCAL(String, BlackBerryOverZoomColor, ("BlackBerryOverZoomColor"));
+DEFINE_STATIC_LOCAL(String, BlackBerryRenderAnimationsOnScrollOrZoomEnabled, ("BlackBerryRenderAnimationsOnScrollOrZoomEnabled"));
+DEFINE_STATIC_LOCAL(String, BlackBerryScrollbarsEnabled, ("BlackBerryScrollbarsEnabled"));
+DEFINE_STATIC_LOCAL(String, BlackBerryTextReflowMode, ("BlackBerryTextReflowMode"));
+DEFINE_STATIC_LOCAL(String, BlackBerryUseRTLWritingDirection, ("BlackBerryUseRTLWritingDirection"));
+DEFINE_STATIC_LOCAL(String, BlackBerryUseWebKitCache, ("BlackBerryUseWebKitCache"));
+DEFINE_STATIC_LOCAL(String, BlackBerryUserAgentString, ("BlackBerryUserAgentString"));
+DEFINE_STATIC_LOCAL(String, BlackBerryUserScalableEnabled, ("BlackBerryUserScalableEnabled"));
+DEFINE_STATIC_LOCAL(String, BlackBerryViewportWidth, ("BlackBerryViewportWidth"));
+DEFINE_STATIC_LOCAL(String, BlackBerryZoomToFitOnLoadEnabled, ("BlackBerryZoomToFitOnLoadEnabled"));
+DEFINE_STATIC_LOCAL(String, WebKitDatabasePath, ("WebKitDatabasePath"));
+DEFINE_STATIC_LOCAL(String, WebKitDatabasesEnabled, ("WebKitDatabasesEnabled"));
+DEFINE_STATIC_LOCAL(String, WebKitDefaultFixedFontSize, ("WebKitDefaultFixedFontSize"));
+DEFINE_STATIC_LOCAL(String, WebKitDefaultFontSize, ("WebKitDefaultFontSize"));
+DEFINE_STATIC_LOCAL(String, WebKitDefaultTextEncodingName, ("WebKitDefaultTextEncodingName"));
+DEFINE_STATIC_LOCAL(String, WebKitDownloadableBinaryFontsEnabled, ("WebKitDownloadableBinaryFontsEnabled"));
+DEFINE_STATIC_LOCAL(String, WebKitFirstScheduledLayoutDelay, ("WebKitFirstScheduledLayoutDelay"));
+DEFINE_STATIC_LOCAL(String, WebKitFixedFontFamily, ("WebKitFixedFontFamily"));
+DEFINE_STATIC_LOCAL(String, WebKitFrameFlatteningEnabled, ("WebKitFrameFlatteningEnabled"));
+DEFINE_STATIC_LOCAL(String, WebKitGeolocationEnabled, ("WebKitGeolocationEnabled"));
+DEFINE_STATIC_LOCAL(String, WebKitJavaScriptCanOpenWindowsAutomaticallyEnabled, ("WebKitJavaScriptCanOpenWindowsAutomaticallyEnabled"));
+DEFINE_STATIC_LOCAL(String, WebKitJavaScriptEnabled, ("WebKitJavaScriptEnabled"));
+DEFINE_STATIC_LOCAL(String, WebKitLoadsImagesAutomatically, ("WebKitLoadsImagesAutomatically"));
+DEFINE_STATIC_LOCAL(String, WebKitLocalStorageEnabled, ("WebKitLocalStorageEnabled"));
+DEFINE_STATIC_LOCAL(String, WebKitLocalStoragePath, ("WebKitLocalStoragePath"));
+DEFINE_STATIC_LOCAL(String, WebKitLocalStorageQuota, ("WebKitLocalStorageQuota"));
+DEFINE_STATIC_LOCAL(String, WebKitMaximumPagesInCache, ("WebKitMaximumPagesInCache"));
+DEFINE_STATIC_LOCAL(String, WebKitMinimumFontSize, ("WebKitMinimumFontSize"));
+DEFINE_STATIC_LOCAL(String, WebKitOfflineWebApplicationCacheEnabled, ("WebKitOfflineWebApplicationCacheEnabled"));
+DEFINE_STATIC_LOCAL(String, WebKitOfflineWebApplicationCachePath, ("WebKitOfflineWebApplicationCachePath"));
+DEFINE_STATIC_LOCAL(String, WebKitPageGroupName, ("WebKitPageGroupName"));
+DEFINE_STATIC_LOCAL(String, WebKitPluginsEnabled, ("WebKitPluginsEnabled"));
+DEFINE_STATIC_LOCAL(String, WebKitPrivateBrowsingEnabled, ("WebKitPrivateBrowsingEnabled"));
+DEFINE_STATIC_LOCAL(String, WebKitSansSeriffFontFamily, ("WebKitSansSeriffFontFamily"));
+DEFINE_STATIC_LOCAL(String, WebKitSeriffFontFamily, ("WebKitSeriffFontFamily"));
+DEFINE_STATIC_LOCAL(String, WebKitStandardFontFamily, ("WebKitStandardFontFamily"));
+DEFINE_STATIC_LOCAL(String, WebKitUserStyleSheet, ("WebKitUserStyleSheet"));
+DEFINE_STATIC_LOCAL(String, WebKitUserStyleSheetLocation, ("WebKitUserStyleSheetLocation"));
+DEFINE_STATIC_LOCAL(String, WebKitWebSocketsEnabled, ("WebKitWebSocketsEnabled"));
+DEFINE_STATIC_LOCAL(String, WebKitXSSAuditorEnabled, ("WebKitXSSAuditorEnabled"));
+DEFINE_STATIC_LOCAL(String, SpatialNavigationEnabled, ("SpatialNavigationEnabled"));
+
+// FIXME: We should consider moving all the mime type code into its own object.
+
+typedef HashMap<String, WebString> MIMETypeAssociationMap;
+
+static const MIMETypeAssociationMap& mimeTypeAssociationMap()
+{
+    static MIMETypeAssociationMap* mimeTypeMap = 0;
+    if (mimeTypeMap)
+        return *mimeTypeMap;
+
+    mimeTypeMap = new MIMETypeAssociationMap;
+    mimeTypeMap->add("image/x-ms-bmp", "image/bmp");
+    mimeTypeMap->add("image/x-windows-bmp", "image/bmp");
+    mimeTypeMap->add("image/x-bmp", "image/bmp");
+    mimeTypeMap->add("image/x-bitmap", "image/bmp");
+    mimeTypeMap->add("image/x-ms-bitmap", "image/bmp");
+    mimeTypeMap->add("image/jpg", "image/jpeg");
+    mimeTypeMap->add("image/pjpeg", "image/jpeg");
+    mimeTypeMap->add("image/x-png", "image/png");
+    mimeTypeMap->add("image/vnd.rim.png", "image/png");
+    mimeTypeMap->add("image/ico", "image/vnd.microsoft.icon");
+    mimeTypeMap->add("image/icon", "image/vnd.microsoft.icon");
+    mimeTypeMap->add("text/ico", "image/vnd.microsoft.icon");
+    mimeTypeMap->add("application/ico", "image/vnd.microsoft.icon");
+    mimeTypeMap->add("image/x-icon", "image/vnd.microsoft.icon");
+    mimeTypeMap->add("audio/vnd.qcelp", "audio/qcelp");
+    mimeTypeMap->add("audio/qcp", "audio/qcelp");
+    mimeTypeMap->add("audio/vnd.qcp", "audio/qcelp");
+    mimeTypeMap->add("audio/wav", "audio/x-wav");
+    mimeTypeMap->add("audio/mid", "audio/midi");
+    mimeTypeMap->add("audio/sp-midi", "audio/midi");
+    mimeTypeMap->add("audio/x-mid", "audio/midi");
+    mimeTypeMap->add("audio/x-midi", "audio/midi");
+    mimeTypeMap->add("audio/x-mpeg", "audio/mpeg");
+    mimeTypeMap->add("audio/mp3", "audio/mpeg");
+    mimeTypeMap->add("audio/x-mp3", "audio/mpeg");
+    mimeTypeMap->add("audio/mpeg3", "audio/mpeg");
+    mimeTypeMap->add("audio/x-mpeg3", "audio/mpeg");
+    mimeTypeMap->add("audio/mpg3", "audio/mpeg");
+    mimeTypeMap->add("audio/mpg", "audio/mpeg");
+    mimeTypeMap->add("audio/x-mpg", "audio/mpeg");
+    mimeTypeMap->add("audio/m4a", "audio/mp4");
+    mimeTypeMap->add("audio/x-m4a", "audio/mp4");
+    mimeTypeMap->add("audio/x-mp4", "audio/mp4");
+    mimeTypeMap->add("audio/x-aac", "audio/aac");
+    mimeTypeMap->add("audio/x-amr", "audio/amr");
+    mimeTypeMap->add("audio/mpegurl", "audio/x-mpegurl");
+    mimeTypeMap->add("video/3gp", "video/3gpp");
+    mimeTypeMap->add("video/avi", "video/x-msvideo");
+    mimeTypeMap->add("video/x-m4v", "video/mp4");
+    mimeTypeMap->add("video/x-quicktime", "video/quicktime");
+    mimeTypeMap->add("application/java", "application/java-archive");
+    mimeTypeMap->add("application/x-java-archive", "application/java-archive");
+    mimeTypeMap->add("application/x-zip-compressed", "application/zip");
+
+    return *mimeTypeMap;
+}
+
+static HashSet<String>* s_supportedObjectMIMETypes;
+
+WebSettingsPrivate::WebSettingsPrivate()
+    : impl(0)
+    , delegate(0)
+    , sender(0)
+    , copyOnWrite(true)
+{
+}
+
+WebSettings::WebSettings()
+{
+    m_private = new WebSettingsPrivate();
+}
+
+WebSettings::WebSettings(const WebSettings& otherSettings)
+{
+    m_private->impl = otherSettings.m_private->impl;
+}
+
+WebSettings::~WebSettings()
+{
+    if (!m_private->copyOnWrite) {
+        delete m_private->impl;
+        m_private->impl = 0;
+    }
+    delete m_private;
+    m_private = 0;
+}
+
+void WebSettings::setDelegate(WebSettingsDelegate* delegate)
+{
+    m_private->delegate = delegate;
+    m_private->sender = this;
+}
+
+WebSettingsDelegate* WebSettings::delegate()
+{
+    return m_private->delegate;
+}
+
+WebSettings* WebSettings::createFromStandardSettings(WebSettingsDelegate* delegate)
+{
+    WebSettings* settings = new WebSettings();
+    settings->m_private->impl = standardSettings()->m_private->impl;
+    settings->m_private->delegate = delegate;
+    settings->m_private->sender = settings;
+    if (delegate)
+        delegate->didChangeSettings(settings);
+
+    return settings;
+}
+
+WebSettings* WebSettings::standardSettings()
+{
+    static WebSettings *settings = 0;
+    if (settings)
+        return settings;
+
+    settings = new WebSettings;
+    settings->m_private->impl = new WebSettingsPrivate::WebSettingsPrivateImpl();
+    settings->m_private->copyOnWrite = false;
+    settings->m_private->setUnsigned(BlackBerryBackgroundColor, WebCore::Color::white);
+    settings->m_private->setBoolean(BlackBerryCookiesEnabled, true);
+    settings->m_private->setDouble(BlackBerryInitialScale, -1);
+    settings->m_private->setUnsigned(BlackBerryMaxPluginInstances, 1);
+    settings->m_private->setUnsigned(BlackBerryOverZoomColor, WebCore::Color::white);
+    settings->m_private->setBoolean(BlackBerryScrollbarsEnabled, true);
+
+    // FIXME: We should detect whether we are embedded in a browser or an email client and default to TextReflowEnabledOnlyForBlockZoom and TextReflowEnabled, respectively.
+    settings->m_private->setTextReflowMode(BlackBerryTextReflowMode, TextReflowDisabled);
+
+    settings->m_private->setBoolean(BlackBerryUserScalableEnabled, true);
+    settings->m_private->setBoolean(BlackBerryUseWebKitCache, true);
+    settings->m_private->setBoolean(BlackBerryZoomToFitOnLoadEnabled, true);
+    settings->m_private->setInteger(WebKitDefaultFontSize, 16);
+    settings->m_private->setInteger(WebKitDefaultFixedFontSize, 13);
+    settings->m_private->setInteger(WebKitMinimumFontSize, 8);
+    settings->m_private->setString(WebKitDefaultTextEncodingName, "iso-8859-1");
+    settings->m_private->setInteger(WebKitFirstScheduledLayoutDelay, 250); // Match Document::cLayoutScheduleThreshold.
+    settings->m_private->setBoolean(WebKitJavaScriptEnabled, true);
+    settings->m_private->setBoolean(WebKitLoadsImagesAutomatically, true);
+    settings->m_private->setBoolean(WebKitDownloadableBinaryFontsEnabled, true);
+    settings->m_private->setUnsignedLongLong(WebKitLocalStorageQuota, 5 * 1024 * 1024);
+    settings->m_private->setInteger(WebKitMaximumPagesInCache, 0);
+    settings->m_private->setBoolean(WebKitWebSocketsEnabled, true);
+    settings->m_private->setString(WebKitFixedFontFamily, "Courier New");
+    settings->m_private->setString(WebKitSansSeriffFontFamily, "Arial");
+    settings->m_private->setString(WebKitSeriffFontFamily, "Times New Roman");
+    settings->m_private->setString(WebKitStandardFontFamily, "Times New Roman");
+    settings->m_private->setBoolean(SpatialNavigationEnabled, false);
+
+    return settings;
+}
+
+void WebSettings::addSupportedObjectPluginMIMEType(const char* type)
+{
+    if (!s_supportedObjectMIMETypes)
+        s_supportedObjectMIMETypes = new HashSet<String>;
+
+    s_supportedObjectMIMETypes->add(type);
+}
+
+bool WebSettings::isSupportedObjectMIMEType(const WebString& mimeType)
+{
+    if (mimeType.isEmpty())
+        return false;
+
+    if (!s_supportedObjectMIMETypes)
+        return false;
+
+    return s_supportedObjectMIMETypes->contains(getNormalizedMIMEType(mimeType));
+}
+
+WebString WebSettings::getNormalizedMIMEType(const WebString& type)
+{
+    MIMETypeAssociationMap::const_iterator i = mimeTypeAssociationMap().find(type);
+
+    return i == mimeTypeAssociationMap().end() ? type : i->second;
+}
+
+bool WebSettings::xssAuditorEnabled() const
+{
+    return m_private->getBoolean(WebKitXSSAuditorEnabled);
+}
+
+void WebSettings::setXSSAuditorEnabled(bool enabled)
+{
+    return m_private->setBoolean(WebKitXSSAuditorEnabled, enabled);
+}
+
+bool WebSettings::loadsImagesAutomatically() const
+{
+    return m_private->getBoolean(WebKitLoadsImagesAutomatically);
+}
+
+void WebSettings::setLoadsImagesAutomatically(bool enabled)
+{
+    m_private->setBoolean(WebKitLoadsImagesAutomatically, enabled);
+}
+
+bool WebSettings::downloadableBinaryFontsEnabled() const
+{
+    return m_private->getBoolean(WebKitDownloadableBinaryFontsEnabled);
+}
+
+void WebSettings::setDownloadableBinaryFontsEnabled(bool enabled)
+{
+    return m_private->setBoolean(WebKitDownloadableBinaryFontsEnabled, enabled);
+}
+
+bool WebSettings::shouldDrawBorderWhileLoadingImages() const
+{
+    return m_private->getBoolean(BlackBerryDrawBorderWhileLoadingImages);
+}
+
+void WebSettings::setShouldDrawBorderWhileLoadingImages(bool enabled)
+{
+    m_private->setBoolean(BlackBerryDrawBorderWhileLoadingImages, enabled);
+}
+
+bool WebSettings::isJavaScriptEnabled() const
+{
+    return m_private->getBoolean(WebKitJavaScriptEnabled);
+}
+
+void WebSettings::setJavaScriptEnabled(bool enabled)
+{
+    m_private->setBoolean(WebKitJavaScriptEnabled, enabled);
+}
+
+bool WebSettings::isPrivateBrowsingEnabled() const
+{
+    return m_private->getBoolean(WebKitPrivateBrowsingEnabled);
+}
+
+void WebSettings::setPrivateBrowsingEnabled(bool enabled)
+{
+    m_private->setBoolean(WebKitPrivateBrowsingEnabled, enabled);
+}
+
+int WebSettings::defaultFixedFontSize() const
+{
+    return m_private->getInteger(WebKitDefaultFixedFontSize);
+}
+
+void WebSettings::setDefaultFixedFontSize(int defaultFixedFontSize)
+{
+    m_private->setInteger(WebKitDefaultFixedFontSize, defaultFixedFontSize);
+}
+
+int WebSettings::defaultFontSize() const
+{
+    return m_private->getInteger(WebKitDefaultFontSize);
+}
+
+void WebSettings::setDefaultFontSize(int defaultFontSize)
+{
+    m_private->setInteger(WebKitDefaultFontSize, defaultFontSize);
+}
+
+int WebSettings::minimumFontSize() const
+{
+    return m_private->getInteger(WebKitMinimumFontSize);
+}
+
+void WebSettings::setMinimumFontSize(int minimumFontSize)
+{
+    m_private->setInteger(WebKitMinimumFontSize, minimumFontSize);
+}
+
+WebString WebSettings::serifFontFamily() const
+{
+    return m_private->getString(WebKitSeriffFontFamily);
+}
+
+void WebSettings::setSerifFontFamily(const char* seriffFontFamily)
+{
+    m_private->setString(WebKitSeriffFontFamily, seriffFontFamily);
+}
+
+WebString WebSettings::fixedFontFamily() const
+{
+    return m_private->getString(WebKitFixedFontFamily);
+}
+
+void WebSettings::setFixedFontFamily(const char* fixedFontFamily)
+{
+    m_private->setString(WebKitFixedFontFamily, fixedFontFamily);
+}
+
+WebString WebSettings::sansSerifFontFamily() const
+{
+    return m_private->getString(WebKitSansSeriffFontFamily);
+}
+
+void WebSettings::setSansSerifFontFamily(const char* sansSeriffFontFamily)
+{
+    m_private->setString(WebKitSansSeriffFontFamily, sansSeriffFontFamily);
+}
+
+WebString WebSettings::standardFontFamily() const
+{
+    return m_private->getString(WebKitStandardFontFamily);
+}
+
+void WebSettings::setStandardFontFamily(const char* standardFontFamily)
+{
+    m_private->setString(WebKitStandardFontFamily, standardFontFamily);
+}
+
+WebString WebSettings::userAgentString() const
+{
+    // FIXME: Is this the best place for this assertion. Why can't we just return an empty string
+    // and let the caller decide how to handle it?
+
+    // The default user agent string is empty. We rely upon the client to set this for us.
+    // We check this by asserting if the client has not done so before the first time it is needed.
+    String userAgentString = m_private->getString(BlackBerryUserAgentString);
+    ASSERT(!userAgentString.isEmpty());
+    return userAgentString;
+}
+
+void WebSettings::setUserAgentString(const char* userAgentString)
+{
+    m_private->setString(BlackBerryUserAgentString, userAgentString);
+}
+
+WebString WebSettings::defaultTextEncodingName() const
+{
+    return m_private->getString(WebKitDefaultTextEncodingName);
+}
+
+void WebSettings::setDefaultTextEncodingName(const char* defaultTextEncodingName)
+{
+    m_private->setString(WebKitDefaultTextEncodingName, defaultTextEncodingName);
+}
+
+bool WebSettings::isZoomToFitOnLoad() const
+{
+    return m_private->getBoolean(BlackBerryZoomToFitOnLoadEnabled);
+}
+
+void WebSettings::setZoomToFitOnLoad(bool enabled)
+{
+    m_private->setBoolean(BlackBerryZoomToFitOnLoadEnabled, enabled);
+}
+
+WebSettings::TextReflowMode WebSettings::textReflowMode() const
+{
+    return m_private->getTextReflowMode(BlackBerryTextReflowMode);
+}
+
+void WebSettings::setTextReflowMode(TextReflowMode textReflowMode)
+{
+    m_private->setTextReflowMode(BlackBerryTextReflowMode, textReflowMode);
+}
+
+bool WebSettings::isScrollbarsEnabled() const
+{
+    return m_private->getBoolean(BlackBerryScrollbarsEnabled);
+}
+
+void WebSettings::setScrollbarsEnabled(bool enabled)
+{
+    m_private->setBoolean(BlackBerryScrollbarsEnabled, enabled);
+}
+
+bool WebSettings::canJavaScriptOpenWindowsAutomatically() const
+{
+    return m_private->getBoolean(WebKitJavaScriptCanOpenWindowsAutomaticallyEnabled);
+}
+
+void WebSettings::setJavaScriptOpenWindowsAutomatically(bool enabled)
+{
+    m_private->setBoolean(WebKitJavaScriptCanOpenWindowsAutomaticallyEnabled, enabled);
+}
+
+bool WebSettings::arePluginsEnabled() const
+{
+    return m_private->getBoolean(WebKitPluginsEnabled);
+}
+
+void WebSettings::setPluginsEnabled(bool enabled)
+{
+    m_private->setBoolean(WebKitPluginsEnabled, enabled);
+}
+
+bool WebSettings::isGeolocationEnabled() const
+{
+    return m_private->getBoolean(WebKitGeolocationEnabled);
+}
+
+void WebSettings::setGeolocationEnabled(bool enabled)
+{
+    m_private->setBoolean(WebKitGeolocationEnabled, enabled);
+}
+
+bool WebSettings::doesGetFocusNodeContext() const
+{
+    return m_private->getBoolean(BlackBerryGetFocusNodeContextEnabled);
+}
+
+void WebSettings::setGetFocusNodeContext(bool enabled)
+{
+    m_private->setBoolean(BlackBerryGetFocusNodeContextEnabled, enabled);
+}
+
+WebString WebSettings::userStyleSheetString() const
+{
+    return m_private->getString(WebKitUserStyleSheet);
+}
+
+void WebSettings::setUserStyleSheetString(const char* userStyleSheetString)
+{
+    // FIXME: This doesn't seem like the appropriate place to do this as WebSettings should ideally be a state store.
+    // Either the caller of this function should do this conversion or caller of the getter corresponding to this function
+    // should do this conversion.
+
+    size_t length = strlen(userStyleSheetString);
+    Vector<char> data;
+    data.append(userStyleSheetString, length);
+
+    Vector<char> encodedData;
+    WebCore::base64Encode(data, encodedData);
+
+    const char prefix[] = "data:text/css;charset=utf-8;base64,";
+    size_t prefixLength = sizeof(prefix) - 1;
+    Vector<char> dataURL;
+    dataURL.reserveCapacity(prefixLength + encodedData.size());
+    dataURL.append(prefix, prefixLength);
+    dataURL.append(encodedData);
+    m_private->setString(WebKitUserStyleSheet, String(dataURL.data(), dataURL.size()));
+}
+
+WebString WebSettings::userStyleSheetLocation()
+{
+    return m_private->getString(WebKitUserStyleSheetLocation);
+}
+
+void WebSettings::setUserStyleSheetLocation(const char* userStyleSheetLocation)
+{
+    m_private->setString(WebKitUserStyleSheetLocation, userStyleSheetLocation);
+}
+
+bool WebSettings::areLinksHandledExternally() const
+{
+    return m_private->getBoolean(BlackBerryLinksHandledExternallyEnabled);
+}
+
+void WebSettings::setAreLinksHandledExternally(bool enabled)
+{
+    m_private->setBoolean(BlackBerryLinksHandledExternallyEnabled, enabled);
+}
+
+void WebSettings::setAllowCrossSiteRequests(bool allow)
+{
+    m_private->setBoolean(BlackBerryAllowCrossSiteRequests, allow);
+}
+
+bool WebSettings::allowCrossSiteRequests() const
+{
+    return m_private->getBoolean(BlackBerryAllowCrossSiteRequests);
+}
+
+bool WebSettings::isUserScalable() const
+{
+    return m_private->getBoolean(BlackBerryUserScalableEnabled);
+}
+
+void WebSettings::setUserScalable(bool enabled)
+{
+    m_private->setBoolean(BlackBerryUserScalableEnabled, enabled);
+}
+
+int WebSettings::viewportWidth() const
+{
+    return m_private->getInteger(BlackBerryViewportWidth);
+}
+
+void WebSettings::setViewportWidth(int width)
+{
+    m_private->setInteger(BlackBerryViewportWidth, width);
+}
+
+double WebSettings::initialScale() const
+{
+    return m_private->getDouble(BlackBerryInitialScale);
+}
+
+void WebSettings::setInitialScale(double initialScale)
+{
+    m_private->setDouble(BlackBerryInitialScale, initialScale);
+}
+
+int WebSettings::firstScheduledLayoutDelay() const
+{
+    return m_private->getInteger(WebKitFirstScheduledLayoutDelay);
+}
+
+void WebSettings::setFirstScheduledLayoutDelay(int delay)
+{
+    m_private->setInteger(WebKitFirstScheduledLayoutDelay, delay);
+}
+
+// Whether to include pattern: in the list of string patterns.
+bool WebSettings::shouldHandlePatternUrls() const
+{
+    return m_private->getBoolean(BlackBerryHandlePatternURLs);
+}
+
+void WebSettings::setShouldHandlePatternUrls(bool handlePatternURLs)
+{
+    m_private->setBoolean(BlackBerryHandlePatternURLs, handlePatternURLs);
+}
+
+bool WebSettings::areCookiesEnabled() const
+{
+    return m_private->getBoolean(BlackBerryCookiesEnabled);
+}
+
+void WebSettings::setAreCookiesEnabled(bool enable)
+{
+    m_private->setBoolean(BlackBerryCookiesEnabled, enable);
+}
+
+bool WebSettings::isLocalStorageEnabled() const
+{
+    return m_private->getBoolean(WebKitLocalStorageEnabled);
+}
+
+void WebSettings::setIsLocalStorageEnabled(bool enable)
+{
+    m_private->setBoolean(WebKitLocalStorageEnabled, enable);
+}
+
+bool WebSettings::isDatabasesEnabled() const
+{
+    return m_private->getBoolean(WebKitDatabasesEnabled);
+}
+
+void WebSettings::setIsDatabasesEnabled(bool enable)
+{
+    m_private->setBoolean(WebKitDatabasesEnabled, enable);
+}
+
+bool WebSettings::isAppCacheEnabled() const
+{
+    return m_private->getBoolean(WebKitOfflineWebApplicationCacheEnabled);
+}
+
+void WebSettings::setIsAppCacheEnabled(bool enable)
+{
+    m_private->setBoolean(WebKitOfflineWebApplicationCacheEnabled, enable);
+}
+
+unsigned long long WebSettings::localStorageQuota() const
+{
+    return m_private->getUnsignedLongLong(WebKitLocalStorageQuota);
+}
+
+void WebSettings::setLocalStorageQuota(unsigned long long quota)
+{
+    m_private->setUnsignedLongLong(WebKitLocalStorageQuota, quota);
+}
+
+int WebSettings::maximumPagesInCache() const
+{
+    // FIXME: We shouldn't be calling into WebCore from here. This class should just be a state store.
+    return WebCore::pageCache()->capacity();
+}
+
+void WebSettings::setMaximumPagesInCache(int pages)
+{
+    // FIXME: We shouldn't be calling into WebCore from here. This class should just be a state store.
+    unsigned realPages = std::max(0, pages);
+    WebCore::pageCache()->setCapacity(realPages);
+    m_private->setUnsigned(WebKitMaximumPagesInCache, realPages);
+}
+
+WebString WebSettings::localStoragePath() const
+{
+    return m_private->getString(WebKitLocalStoragePath);
+}
+
+void WebSettings::setLocalStoragePath(const WebString& path)
+{
+    m_private->setString(WebKitLocalStoragePath, path);
+}
+
+WebString WebSettings::databasePath() const
+{
+    return m_private->getString(WebKitDatabasePath);
+}
+
+void WebSettings::setDatabasePath(const WebString& path)
+{
+    m_private->setString(WebKitDatabasePath, path);
+}
+
+WebString WebSettings::appCachePath() const
+{
+    return m_private->getString(WebKitOfflineWebApplicationCachePath);
+}
+
+void WebSettings::setAppCachePath(const WebString& path)
+{
+    m_private->setString(WebKitOfflineWebApplicationCachePath, path);
+}
+
+WebString WebSettings::pageGroupName() const
+{
+    return m_private->getString(WebKitPageGroupName);
+}
+
+void WebSettings::setPageGroupName(const WebString& pageGroupName)
+{
+    m_private->setString(WebKitPageGroupName, pageGroupName);
+}
+
+bool WebSettings::isEmailMode() const
+{
+    return m_private->getBoolean(BlackBerryEmailModeEnabled);
+}
+
+void WebSettings::setEmailMode(bool enable)
+{
+    m_private->setBoolean(BlackBerryEmailModeEnabled, enable);
+}
+
+bool WebSettings::shouldRenderAnimationsOnScrollOrZoom() const
+{
+    return m_private->getBoolean(BlackBerryRenderAnimationsOnScrollOrZoomEnabled);
+}
+
+void WebSettings::setShouldRenderAnimationsOnScrollOrZoom(bool enable)
+{
+    m_private->setBoolean(BlackBerryRenderAnimationsOnScrollOrZoomEnabled, enable);
+}
+
+unsigned WebSettings::overZoomColor() const
+{
+    return m_private->getUnsigned(BlackBerryOverZoomColor);
+}
+
+void WebSettings::setOverZoomColor(unsigned color)
+{
+    m_private->setUnsigned(BlackBerryOverZoomColor, color);
+}
+
+unsigned WebSettings::backgroundColor() const
+{
+    return m_private->getUnsigned(BlackBerryBackgroundColor);
+}
+
+void WebSettings::setBackgroundColor(unsigned color)
+{
+    m_private->setUnsigned(BlackBerryBackgroundColor, color);
+}
+
+bool WebSettings::isWritingDirectionRTL() const
+{
+    return m_private->getBoolean(BlackBerryUseRTLWritingDirection);
+}
+
+void WebSettings::setWritingDirectionRTL(bool useRTLWritingDirection)
+{
+    m_private->setBoolean(BlackBerryUseRTLWritingDirection, useRTLWritingDirection);
+}
+
+bool WebSettings::useWebKitCache() const
+{
+    return m_private->getBoolean(BlackBerryUseWebKitCache);
+}
+
+void WebSettings::setUseWebKitCache(bool useWebKitCache)
+{
+    m_private->setBoolean(BlackBerryUseWebKitCache, useWebKitCache);
+}
+
+bool WebSettings::isFrameFlatteningEnabled() const
+{
+    return m_private->getBoolean(WebKitFrameFlatteningEnabled);
+}
+
+void WebSettings::setFrameFlatteningEnabled(bool enable)
+{
+    m_private->setBoolean(WebKitFrameFlatteningEnabled, enable);
+}
+
+bool WebSettings::isDirectRenderingToWindowEnabled() const
+{
+    return m_private->getBoolean(BlackBerryDirectRenderingToWindowEnabled);
+}
+
+void WebSettings::setDirectRenderingToWindowEnabled(bool enable)
+{
+    m_private->setBoolean(BlackBerryDirectRenderingToWindowEnabled, enable);
+}
+
+unsigned WebSettings::maxPluginInstances() const
+{
+    return m_private->getUnsigned(BlackBerryMaxPluginInstances);
+}
+
+void WebSettings::setMaxPluginInstances(unsigned maxPluginInstances)
+{
+    m_private->setUnsigned(BlackBerryMaxPluginInstances, maxPluginInstances);
+}
+
+bool WebSettings::areWebSocketsEnabled() const
+{
+    return m_private->getBoolean(WebKitWebSocketsEnabled);
+}
+
+void WebSettings::setWebSocketsEnabled(bool enable)
+{
+    m_private->setBoolean(WebKitWebSocketsEnabled, enable);
+}
+
+bool WebSettings::isSpatialNavigationEnabled() const
+{
+    return m_private->getBoolean(SpatialNavigationEnabled);
+}
+
+void WebSettings::setSpatialNavigationEnabled(bool enable)
+{
+    m_private->setBoolean(SpatialNavigationEnabled, enable);
+}
+
+} // namespace WebKit
+} // namespace BlackBerry
diff --git a/Source/WebKit/blackberry/Api/WebSettings.h b/Source/WebKit/blackberry/Api/WebSettings.h
new file mode 100644
index 000000000..403e8f4a2
--- /dev/null
+++ b/Source/WebKit/blackberry/Api/WebSettings.h
@@ -0,0 +1,263 @@
+/*
+ * Copyright (C) 2009, 2010, 2011, 2012 Research In Motion Limited. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+#ifndef WebSettings_h
+#define WebSettings_h
+
+#include "BlackBerryGlobal.h"
+
+namespace BlackBerry {
+namespace WebKit {
+
+class WebSettings;
+class WebSettingsPrivate;
+
+/*!
+    @struct WebSettingsDelegate
+    Defines the methods that must be implemented by a delegate of WebSettings.
+*/
+struct BLACKBERRY_EXPORT WebSettingsDelegate {
+    virtual ~WebSettingsDelegate() { }
+
+    /*!
+        Sent when the value of a setting changed as well as on instantiation of a WebSettings object.
+        @param settings The WebSettings object that sent the message.
+    */
+    virtual void didChangeSettings(WebSettings*) = 0;
+};
+
+/*!
+    @class WebSettings
+*/
+class BLACKBERRY_EXPORT WebSettings {
+public:
+    static WebSettings* createFromStandardSettings(WebSettingsDelegate* = 0);
+    ~WebSettings();
+
+    static WebSettings* standardSettings();
+
+    void setDelegate(WebSettingsDelegate*);
+    WebSettingsDelegate* delegate();
+
+    static void addSupportedObjectPluginMIMEType(const char*);
+    static bool isSupportedObjectMIMEType(const WebString&);
+    static WebString getNormalizedMIMEType(const WebString&);
+
+    bool xssAuditorEnabled() const;
+    void setXSSAuditorEnabled(bool);
+
+    bool loadsImagesAutomatically() const;
+    void setLoadsImagesAutomatically(bool);
+
+    bool shouldDrawBorderWhileLoadingImages() const;
+    void setShouldDrawBorderWhileLoadingImages(bool);
+
+    bool isJavaScriptEnabled() const;
+    void setJavaScriptEnabled(bool);
+
+    bool isPrivateBrowsingEnabled() const;
+    void setPrivateBrowsingEnabled(bool);
+
+    int defaultFixedFontSize() const;
+    void setDefaultFixedFontSize(int);
+
+    int defaultFontSize() const;
+    void setDefaultFontSize(int);
+
+    int minimumFontSize() const;
+    void setMinimumFontSize(int);
+
+    WebString serifFontFamily() const;
+    void setSerifFontFamily(const char*);
+    WebString fixedFontFamily() const;
+    void setFixedFontFamily(const char*);
+    WebString sansSerifFontFamily() const;
+    void setSansSerifFontFamily(const char*);
+    WebString standardFontFamily() const;
+    void setStandardFontFamily(const char*);
+
+    void setDownloadableBinaryFontsEnabled(bool);
+    bool downloadableBinaryFontsEnabled() const;
+
+    WebString userAgentString() const;
+    void setUserAgentString(const char*);
+
+    WebString defaultTextEncodingName() const;
+    void setDefaultTextEncodingName(const char*);
+
+    bool isZoomToFitOnLoad() const;
+    void setZoomToFitOnLoad(bool);
+
+    enum TextReflowMode { TextReflowDisabled, TextReflowEnabled, TextReflowEnabledOnlyForBlockZoom };
+    TextReflowMode textReflowMode() const;
+    void setTextReflowMode(TextReflowMode);
+
+    bool isScrollbarsEnabled() const;
+    void setScrollbarsEnabled(bool);
+
+    // FIXME: Consider renaming this method upstream, where it is called javaScriptCanOpenWindowsAutomatically.
+    bool canJavaScriptOpenWindowsAutomatically() const;
+    void setJavaScriptOpenWindowsAutomatically(bool);
+
+    bool arePluginsEnabled() const;
+    void setPluginsEnabled(bool);
+
+    bool isGeolocationEnabled() const;
+    void setGeolocationEnabled(bool);
+
+    // Context info
+    bool doesGetFocusNodeContext() const;
+    void setGetFocusNodeContext(bool);
+
+    WebString userStyleSheetString() const;
+    void setUserStyleSheetString(const char*);
+
+    WebString userStyleSheetLocation();
+    void setUserStyleSheetLocation(const char*);
+
+    // External link handlers
+    bool areLinksHandledExternally() const;
+    void setAreLinksHandledExternally(bool);
+
+    // BrowserField2 settings
+    void setAllowCrossSiteRequests(bool);
+    bool allowCrossSiteRequests() const;
+    bool isUserScalable() const;
+    void setUserScalable(bool);
+    int viewportWidth() const;
+    void setViewportWidth(int);
+    double initialScale() const;
+    void setInitialScale(double);
+
+    int firstScheduledLayoutDelay() const;
+    void setFirstScheduledLayoutDelay(int);
+
+    // Whether to include pattern: in the list of string patterns.
+    bool shouldHandlePatternUrls() const;
+    void setShouldHandlePatternUrls(bool);
+
+    bool areCookiesEnabled() const;
+    void setAreCookiesEnabled(bool);
+
+    // Web storage settings
+    bool isLocalStorageEnabled() const;
+    void setIsLocalStorageEnabled(bool);
+
+    bool isDatabasesEnabled() const;
+    void setIsDatabasesEnabled(bool);
+
+    bool isAppCacheEnabled() const;
+    void setIsAppCacheEnabled(bool);
+
+    unsigned long long localStorageQuota() const;
+    void setLocalStorageQuota(unsigned long long);
+
+    // Page cache
+    void setMaximumPagesInCache(int);
+    int maximumPagesInCache() const;
+
+    WebString localStoragePath() const;
+    void setLocalStoragePath(const WebString&);
+
+    WebString databasePath() const;
+    void setDatabasePath(const WebString&);
+
+    WebString appCachePath() const;
+    void setAppCachePath(const WebString&);
+
+    WebString pageGroupName() const;
+    void setPageGroupName(const WebString&);
+
+    // FIXME: We shouldn't have an email mode. Instead, we should expose all email-related settings
+    // so that the email client can toggle them directly.
+    bool isEmailMode() const;
+    void setEmailMode(bool enable);
+
+    bool shouldRenderAnimationsOnScrollOrZoom() const;
+    void setShouldRenderAnimationsOnScrollOrZoom(bool enable);
+
+    unsigned overZoomColor() const;
+    void setOverZoomColor(unsigned);
+
+    unsigned backgroundColor() const;
+    void setBackgroundColor(unsigned);
+
+    bool isWritingDirectionRTL() const;
+    void setWritingDirectionRTL(bool);
+
+    bool useWebKitCache() const;
+    void setUseWebKitCache(bool);
+
+    bool isFrameFlatteningEnabled() const;
+    void setFrameFlatteningEnabled(bool);
+
+    bool isDirectRenderingToWindowEnabled() const;
+    void setDirectRenderingToWindowEnabled(bool);
+
+    unsigned maxPluginInstances() const;
+    void setMaxPluginInstances(unsigned num);
+
+    bool areWebSocketsEnabled() const;
+    void setWebSocketsEnabled(bool);
+
+    bool isSpatialNavigationEnabled() const;
+    void setSpatialNavigationEnabled(bool);
+
+private:
+    WebSettingsPrivate* m_private;
+    WebSettings();
+    WebSettings(const WebSettings&);
+};
+
+/*!
+    @class WebSettingsTransaction
+    Defines a scope guard that suppresses didChangeSettings messages within its scope.
+    On destruction the guarded WebSettings object will dispatch exactly one didChangeSettings message.
+*/
+class BLACKBERRY_EXPORT WebSettingsTransaction {
+public:
+    WebSettingsTransaction(WebSettings* settings)
+        : m_settings(settings)
+        , m_savedDelegate(0)
+    {
+        if (!settings)
+            return;
+        m_savedDelegate = settings->delegate();
+        settings->setDelegate(0);
+    }
+
+    ~WebSettingsTransaction()
+    {
+        if (!m_settings || !m_savedDelegate)
+            return;
+        m_settings->setDelegate(m_savedDelegate);
+        m_savedDelegate->didChangeSettings(m_settings);
+    }
+
+private:
+    WebSettingsTransaction(const WebSettingsTransaction&);
+    WebSettingsTransaction& operator=(const WebSettingsTransaction&);
+
+    WebSettings* m_settings;
+    WebSettingsDelegate* m_savedDelegate;
+};
+
+} // namespace WebKit
+} // namespace BlackBerry
+
+#endif // WebSettings_h
diff --git a/Source/WebKit/blackberry/Api/WebSettings_p.h b/Source/WebKit/blackberry/Api/WebSettings_p.h
new file mode 100644
index 000000000..7f9e2334d
--- /dev/null
+++ b/Source/WebKit/blackberry/Api/WebSettings_p.h
@@ -0,0 +1,114 @@
+/*
+ * Copyright (C) 2009, 2010, 2011, 2012 Research In Motion Limited. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+#ifndef WebSettings_p_h
+#define WebSettings_p_h
+
+#include "WebSettings.h"
+
+#include <wtf/HashMap.h>
+#include <wtf/text/StringHash.h>
+
+#define synthesizeAccessorsForPrimitiveValuePrefixAndType(prefix, type) \
+     void set##prefix(const String& key, type newValue) { \
+         ASSERT(impl); \
+         if (get##prefix(key) == newValue) \
+            return; \
+         if (copyOnWrite) { \
+            copyOnWrite = false; \
+            impl = new WebSettingsPrivateImpl(*impl); \
+         } \
+         PrimitiveValue primitiveValue; \
+         primitiveValue.prefix##Value = newValue; \
+         impl->primitiveValues.set(key, primitiveValue); \
+         if (delegate) \
+            delegate->didChangeSettings(sender); \
+     } \
+     type get##prefix(const String& key) const { \
+          ASSERT(impl); \
+          if (!impl->primitiveValues.contains(key)) \
+              return static_cast<type>(false); \
+          return impl->primitiveValues.get(key).prefix##Value; \
+      }
+
+namespace BlackBerry {
+namespace WebKit {
+
+struct WebSettingsPrivate {
+    union PrimitiveValue {
+        WebSettings::TextReflowMode TextReflowModeValue;
+        bool BooleanValue;
+        double DoubleValue;
+        int IntegerValue;
+        unsigned UnsignedValue;
+        unsigned long long UnsignedLongLongValue;
+    };
+
+    struct WebSettingsPrivateImpl {
+        HashMap<String, PrimitiveValue> primitiveValues;
+        HashMap<String, String> stringValues;
+    };
+
+    WebSettingsPrivateImpl* impl;
+    WebSettingsDelegate* delegate;
+    WebSettings* sender;
+    bool copyOnWrite;
+
+    WebSettingsPrivate();
+
+    synthesizeAccessorsForPrimitiveValuePrefixAndType(TextReflowMode, WebSettings::TextReflowMode);
+
+    synthesizeAccessorsForPrimitiveValuePrefixAndType(Boolean, bool);
+
+    synthesizeAccessorsForPrimitiveValuePrefixAndType(Double, double);
+
+    synthesizeAccessorsForPrimitiveValuePrefixAndType(Integer, int);
+
+    synthesizeAccessorsForPrimitiveValuePrefixAndType(Unsigned, unsigned);
+
+    synthesizeAccessorsForPrimitiveValuePrefixAndType(UnsignedLongLong, unsigned long long);
+
+    String getString(const String& key) const
+    {
+        ASSERT(impl);
+        if (!impl->stringValues.contains(key))
+            return String();
+        return impl->stringValues.get(key);
+    }
+
+    void setString(const String& key, const String& newValue)
+    {
+        ASSERT(impl);
+        if (getString(key) == newValue)
+            return;
+
+        if (copyOnWrite) {
+            copyOnWrite = false;
+            impl = new WebSettingsPrivateImpl(*impl);
+        }
+
+        impl->stringValues.set(key, newValue);
+        if (delegate)
+            delegate->didChangeSettings(sender);
+    }
+};
+
+} // namespace WebKit
+} // namespace BlackBerry
+
+#endif // WebSettings_p_h
diff --git a/Source/WebKit/blackberry/Api/WebString.cpp b/Source/WebKit/blackberry/Api/WebString.cpp
index 7429d86de..7fc9a1a77 100644
--- a/Source/WebKit/blackberry/Api/WebString.cpp
+++ b/Source/WebKit/blackberry/Api/WebString.cpp
@@ -19,7 +19,6 @@
 #include "config.h"
 #include "WebString.h"
 
-#include "WebStringImpl.h"
 #include <wtf/text/CString.h>
 #include <wtf/text/WTFString.h>
 
@@ -27,21 +26,21 @@ namespace BlackBerry {
 namespace WebKit {
 
 WebString::WebString(const char* latin1)
-    : m_impl(static_cast<WebStringImpl*>(WTF::StringImpl::create(latin1).releaseRef()))
+    : m_impl(StringImpl::create(latin1).leakRef())
 {
 }
 
 WebString::WebString(const char* latin1, unsigned length)
-    : m_impl(static_cast<WebStringImpl*>(WTF::StringImpl::create(latin1, length).releaseRef()))
+    : m_impl(StringImpl::create(latin1, length).leakRef())
 {
 }
 
 WebString::WebString(const unsigned short* utf16, unsigned length)
-    : m_impl(static_cast<WebStringImpl*>(WTF::StringImpl::create(utf16, length).releaseRef()))
+    : m_impl(StringImpl::create(utf16, length).leakRef())
 {
 }
 
-WebString::WebString(WebStringImpl* impl)
+WebString::WebString(StringImpl* impl)
     : m_impl(impl)
 {
     if (m_impl)
@@ -109,7 +108,7 @@ bool WebString::equal(const char* utf8) const
 
 bool WebString::equalIgnoringCase(const char* utf8) const
 {
-    return WTF::equalIgnoringCase(m_impl, utf8);
+    return WTF::equalIgnoringCase(utf8, WTF::String(m_impl));
 }
 
 } // namespace WebKit
diff --git a/Source/WebKit/blackberry/Api/WebString.h b/Source/WebKit/blackberry/Api/WebString.h
index fe28bdef6..fe43c247f 100644
--- a/Source/WebKit/blackberry/Api/WebString.h
+++ b/Source/WebKit/blackberry/Api/WebString.h
@@ -22,11 +22,14 @@
 #include "BlackBerryGlobal.h"
 #include <string>
 
+// Not for public API purpose.
+namespace WTF {
+class StringImpl;
+}
+
 namespace BlackBerry {
 namespace WebKit {
 
-class WebStringImpl;
-
 class BLACKBERRY_EXPORT WebString {
 public:
     WebString() : m_impl(0) { }
@@ -34,7 +37,6 @@ public:
     WebString(const char* latin1);
     WebString(const char* latin1, unsigned length);
     WebString(const unsigned short* utf16, unsigned length);
-    WebString(WebStringImpl*);
     WebString(const WebString&);
     WebString& operator=(const WebString&);
     std::string utf8() const;
@@ -44,9 +46,13 @@ public:
     bool isEmpty() const;
     bool equal(const char* utf8) const;
     bool equalIgnoringCase(const char* utf8) const;
-    WebStringImpl* impl() const { return m_impl; }
+
+    // Not for public API purpose.
+    WebString(WTF::StringImpl*);
+    WTF::StringImpl* impl() const { return m_impl; }
+
 private:
-    WebStringImpl* m_impl;
+    WTF::StringImpl* m_impl;
 };
 } // namespace WebKit
 } // namespace BlackBerry
diff --git a/Source/WebKit/blackberry/ChangeLog b/Source/WebKit/blackberry/ChangeLog
new file mode 100644
index 000000000..60d341ad0
--- /dev/null
+++ b/Source/WebKit/blackberry/ChangeLog
@@ -0,0 +1,390 @@
+2012-02-24  Shinya Kawanaka  <shinyak@chromium.org>
+
+        SpellCheckRequest needs to know the context where the spellcheck happened.
+        https://bugs.webkit.org/show_bug.cgi?id=79320
+
+        Reviewed by Hajime Morita.
+
+        * WebCoreSupport/EditorClientBlackBerry.cpp:
+        (WebCore::EditorClientBlackBerry::requestCheckingOfString):
+        * WebCoreSupport/EditorClientBlackBerry.h:
+        (EditorClientBlackBerry):
+
+2012-02-24  Charles Wei  <charles.wei@torchmobile.com.cn>
+
+        [BlackBerry] Anchor mailto: with target set won't launch Messaging application when clicked
+        https://bugs.webkit.org/show_bug.cgi?id=79318
+
+        Need to give the client a chance to decide how to handle the new window request.
+
+        Reviewed by Rob Buis.
+
+        * WebCoreSupport/FrameLoaderClientBlackBerry.cpp:
+        (WebCore::FrameLoaderClientBlackBerry::dispatchDecidePolicyForNewWindowAction):
+
+2012-02-23  Mike Fenton  <mifenton@rim.com>
+
+        [BlackBerry] Selection handler has compile failure with logs enabled.
+        https://bugs.webkit.org/show_bug.cgi?id=79392
+
+        Reviewed by Antonio Gomes.
+
+        Build Fix.  Update log to avoid usage of toString which was removed.
+
+        * WebKitSupport/SelectionHandler.cpp:
+        (BlackBerry::WebKit::SelectionHandler::selectionPositionChanged):
+
+2012-02-19  Antonio Gomes  <agomes@rim.com>
+
+        Fat fingers - Add a clearer way to distinguish the node we want (shadow or non-shadow)
+        https://bugs.webkit.org/show_bug.cgi?id=79256
+        PR #127814 / MKS_2587410
+
+        Reviewed by Rob Buis.
+
+        Patch adds a cleaner way for call sites of FatFingersResult to
+        query for the appropriated target node: shadow or non-shadow DOM nodes.
+
+        It also renames FatFingersResults::validNode to ::node, assuming
+        that "invalid" nodes are not applicable in any context.
+
+        * Api/WebPage.cpp:
+        (BlackBerry::WebKit::WebPagePrivate::clearDocumentData):
+        (BlackBerry::WebKit::WebPagePrivate::contextNode):
+        (BlackBerry::WebKit::WebPagePrivate::handleMouseEvent):
+        * WebKitSupport/FatFingers.h:
+        (FatFingersResult):
+        (BlackBerry::WebKit::FatFingersResult::node):
+        (BlackBerry::WebKit::FatFingersResult::nodeAsElementIfApplicable):
+        * WebKitSupport/SelectionHandler.cpp:
+        (BlackBerry::WebKit::SelectionHandler::selectAtPoint):
+        * WebKitSupport/TouchEventHandler.cpp:
+        (BlackBerry::WebKit::TouchEventHandler::touchHoldEvent):
+        (BlackBerry::WebKit::TouchEventHandler::handleTouchPoint):
+
+2012-02-23  Jacky Jiang  <zhajiang@rim.com>
+
+        [BlackBerry] Upstream BlackBerry API web page related files
+        https://bugs.webkit.org/show_bug.cgi?id=74380
+
+        Reviewed by Antonio Gomes.
+
+        Initial upstream, no new tests.
+
+        * Api/WebPage.cpp: Added.
+        * Api/WebPage.h: Added.
+        * Api/WebPage_p.h: Added.
+
+2012-02-23  Leo Yang  <leo.yang@torchmobile.com.cn>
+
+        [BlackBerry] Remove unused ChromeClientBlackBerry::platformCompositingWindow(), platformWindow() and WebPageClient::compositingWindow()
+        https://bugs.webkit.org/show_bug.cgi?id=78681
+
+        Reviewed by Antonio Gomes.
+
+        * Api/WebPageClient.h:
+        * WebCoreSupport/ChromeClientBlackBerry.cpp:
+        (WebCore):
+        * WebCoreSupport/ChromeClientBlackBerry.h:
+        (ChromeClientBlackBerry):
+
+2012-02-23  Leo Yang  <leo.yang@torchmobile.com.cn>
+
+        [BlackBerry] Upstream GLES2Context.{h, cpp}
+        https://bugs.webkit.org/show_bug.cgi?id=79196
+
+        Reviewed by Rob Buis.
+
+        Initial upstream, no new tests.
+
+        * WebKitSupport/GLES2Context.cpp: Added.
+        * WebKitSupport/GLES2Context.h: Added.
+
+2012-02-23  Mike Fenton  <mifenton@rim.com>
+
+        [BlackBerry] InputHandler requires cleanup of Navigation Mode handling.
+        https://bugs.webkit.org/show_bug.cgi?id=79366
+
+        Reviewed by Rob Buis.
+
+        Cleanup InputHandler navigation based code.
+
+        1) Remove the concept of NavigationMode and replace it
+           with simple showKeyboard calls.
+
+        2) Remove navigation move events and replace with standard
+           key events.
+
+        3) Standardize function/variable names and remove obsolete
+           functions.
+
+        * Api/WebPageClient.h:
+        * WebKitSupport/InputHandler.cpp:
+        (BlackBerry::WebKit::InputHandler::InputHandler):
+        (BlackBerry::WebKit::InputHandler::nodeFocused):
+        (BlackBerry::WebKit::InputHandler::setElementUnfocused):
+        (BlackBerry::WebKit::InputHandler::setElementFocused):
+        (BlackBerry::WebKit::InputHandler::ensureFocusTextElementVisible):
+        (BlackBerry::WebKit::InputHandler::setDelayKeyboardVisibilityChange):
+        (BlackBerry::WebKit::InputHandler::processPendingKeyboardVisibilityChange):
+        (BlackBerry::WebKit::InputHandler::notifyClientOfKeyboardVisibilityChange):
+        * WebKitSupport/InputHandler.h:
+        (InputHandler):
+        * WebKitSupport/SelectionHandler.cpp:
+        (BlackBerry::WebKit::SelectionHandler::setCaretPosition):
+        (BlackBerry::WebKit::SelectionHandler::updateOrHandleInputSelection):
+        * WebKitSupport/TouchEventHandler.cpp:
+        (BlackBerry::WebKit::TouchEventHandler::touchEventCancel):
+        (BlackBerry::WebKit::TouchEventHandler::handleTouchPoint):
+
+2012-02-21  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Remove the remaining uses of CSSStyleDeclaration in Editor
+        https://bugs.webkit.org/show_bug.cgi?id=78939
+
+        Reviewed by Enrica Casucci.
+
+        * WebCoreSupport/EditorClientBlackBerry.cpp:
+        (WebCore::EditorClientBlackBerry::shouldApplyStyle):
+        * WebCoreSupport/EditorClientBlackBerry.h:
+        (EditorClientBlackBerry):
+
+2012-02-22  Mike Fenton  <mifenton@rim.com>
+
+        [BlackBerry] InputHandler has signed vs unsigned comparison.
+        https://bugs.webkit.org/show_bug.cgi?id=79261
+
+        Fix warning by casting the unsigned int to an int.
+
+        Reviewed by Rob Buis.
+
+        * WebKitSupport/InputHandler.cpp:
+        (BlackBerry::WebKit::InputHandler::rectForCaret):
+
+2012-02-22  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Remove the remaining uses of CSSStyleDeclaration in Editor
+        https://bugs.webkit.org/show_bug.cgi?id=78939
+
+        Reviewed by Enrica Casucci.
+
+        * WebCoreSupport/EditorClientBlackBerry.cpp:
+        (WebCore::EditorClientBlackBerry::shouldApplyStyle):
+        * WebCoreSupport/EditorClientBlackBerry.h:
+        (EditorClientBlackBerry):
+
+2012-02-18  Antonio Gomes  <agomes@rim.com>
+
+        Fat fingers - cache the first rect-based hit test so we do not need to do it again
+        https://bugs.webkit.org/show_bug.cgi?id=79115
+
+        Reviewed by Adam Treat.
+
+        Our FatFingers implementation runs currently in two phases:
+        the first checks for the elements intrinsically clickable;
+        the second checks for elements made clickable by the page
+        (for example, a div with a onclick event listener attached to it).
+        For each phase, we perform a rect hittest, which is not needed since
+        the result of each is the same.
+
+        Patch introduces a caching mechanism so we avoid on rect hittest:
+        when the first phase runs, it caches each nodeset per document in
+        a hashmap. This second phase works with the cached results.
+
+        No behavioral change, but performance is better since we
+        avoid one (possibly expensive) rect hittest.
+
+        I measured the performance gain on https://www.kvd.se/, and we
+        save up to 0.04 seconds, by caching and re-using the results.
+
+        * WebKitSupport/FatFingers.cpp:
+        (BlackBerry::WebKit::dumpHitTestResult):
+        (BlackBerry::WebKit::FatFingers::findBestPoint):
+        (BlackBerry::WebKit::FatFingers::findIntersectingRegions):
+        (BlackBerry::WebKit::FatFingers::cachingStrategy):
+        (WebKit):
+        (BlackBerry::WebKit::FatFingers::getNodesFromRect):
+        * WebKitSupport/FatFingers.h:
+
+2012-02-20  Antonio Gomes  <agomes@rim.com>
+
+        All default video/audio control elements should be rect-hit testable (Part II)
+        PR #139518 / MKS_3005538
+
+        Reviewed by George Staikos.
+
+        Add HTMLInputElement::isMediaControlElement as a criteria
+        to consider a element as clickable.
+
+        Note that is should be only used while in the "ClickableByDefault"
+        phase of FatFingers.
+
+        * WebKitSupport/FatFingers.cpp:
+        (BlackBerry::WebKit::FatFingers::isElementClickable):
+
+2012-02-16  Antonio Gomes  <agomes@rim.com>
+
+        [BlackBerry] Implemented a way to defer client navigation change client notifications
+        https://bugs.webkit.org/show_bug.cgi?id=78848
+
+        Reviewed by Rob Buis.
+
+        Currently we postpone touch_down till touch_up if user touches
+        the screen and an input field has the WebKit focus. This is done
+        so we can scroll the page without hidding the vkb needlessly.
+
+        However, it breaks the conversion of touch to mouse events
+        if an input field has the focus in the following scenario:
+        an <input type=text> is focused and an user grab and-drag
+        a <input type=range> knob/slide. It does not work until the
+        user unfocuses the currently focused edit field.
+
+        Patch introduces a way to unfocus a currently focused input field,
+        without requesting the client to show or hide the virtual keyboard
+        right way. Instead it gets a delayed notification of the vkb mode requested
+        at either touch_released/mouse_up or touch_cancel time.
+
+        For now, due to content side issues with major web sites,
+        only delay navigation mode notification changes if we are not dealing with
+        input modes.
+
+        * WebKitSupport/InputHandler.cpp:
+        (BlackBerry::WebKit::InputHandler::InputHandler):
+        (BlackBerry::WebKit::InputHandler::nodeFocused):
+        (BlackBerry::WebKit::InputHandler::setElementFocused):
+        (BlackBerry::WebKit::InputHandler::setNavigationMode):
+        (WebKit):
+        (BlackBerry::WebKit::InputHandler::setDelayClientNotificationOfNavigationModeChange):
+        (BlackBerry::WebKit::InputHandler::processPendingClientNavigationModeChangeNotification):
+        (BlackBerry::WebKit::InputHandler::notifyClientOfNavigationModeChange):
+        (BlackBerry::WebKit::InputHandler::willOpenPopupForNode):
+        (BlackBerry::WebKit::InputHandler::setPopupListIndexes):
+        (BlackBerry::WebKit::InputHandler::spannableTextInRange):
+        (BlackBerry::WebKit::InputHandler::removeComposedText):
+        (BlackBerry::WebKit::InputHandler::firstSpanInString):
+        (BlackBerry::WebKit::InputHandler::setText):
+        (BlackBerry::WebKit::InputHandler::setRelativeCursorPosition):
+        * WebKitSupport/InputHandler.h:
+        (InputHandler):
+
+2012-02-16  Antonio Gomes  <agomes@rim.com>
+
+        Crash @WebPagePrivate::enqueueRenderingOfClippedContentOfScrollableNodeAfterInRegionScrolling MKS_2986818
+        https://bugs.webkit.org/show_bug.cgi?id=78845
+
+        Reviewed by Rob Buis.
+
+        We were trying to operate on a cached Node when its page/frame/document
+        were gone to PageCache already. To avoid such problems, lets clean up
+        any document data we have cached when the Frame goes into the cache.
+
+        * WebCoreSupport/FrameLoaderClientBlackBerry.cpp:
+        (WebCore::FrameLoaderClientBlackBerry::didSaveToPageCache):
+        (WebCore):
+        * WebCoreSupport/FrameLoaderClientBlackBerry.h:
+        (FrameLoaderClientBlackBerry):
+
+2012-02-16  Antonio Gomes  <agomes@rim.com>
+
+        [BlackBerry] Upstream touch handling related classes
+        https://bugs.webkit.org/show_bug.cgi?id=78509
+
+        Reviewed by Adam Treat and Rob Buis.
+
+        FatFingers is the class responsible to the whole touch
+        accuracy of the BlackBerry port. Initial upstream.
+
+        * WebKitSupport/FatFingers.cpp: Added.
+        (WebKit):
+        (BlackBerry::WebKit::FatFingers::fingerRectForPoint):
+        (BlackBerry::WebKit::hasMousePressListener):
+        (BlackBerry::WebKit::FatFingers::isElementClickable):
+        (BlackBerry::WebKit::isFieldWithText):
+        (BlackBerry::WebKit::distanceBetweenPoints):
+        (BlackBerry::WebKit::compareDistanceBetweenPoints):
+        (BlackBerry::WebKit::isValidFrameOwner):
+        (BlackBerry::WebKit::FatFingers::FatFingers):
+        (BlackBerry::WebKit::FatFingers::~FatFingers):
+        (BlackBerry::WebKit::FatFingers::findBestPoint):
+        (BlackBerry::WebKit::FatFingers::checkFingerIntersection):
+        (BlackBerry::WebKit::FatFingers::findIntersectingRegions):
+        (BlackBerry::WebKit::FatFingers::checkForClickableElement):
+        (BlackBerry::WebKit::FatFingers::checkForText):
+        (BlackBerry::WebKit::FatFingers::getPaddings):
+        (BlackBerry::WebKit::FatFingers::nodesFromRect):
+        (BlackBerry::WebKit::FatFingers::getRelevantInfoFromPoint):
+        (BlackBerry::WebKit::FatFingers::setSuccessfulFatFingersResult):
+        * WebKitSupport/FatFingers.h: Added.
+        (WebCore):
+        (WebKit):
+        (FatFingersResult):
+        (BlackBerry::WebKit::FatFingersResult::FatFingersResult):
+        (BlackBerry::WebKit::FatFingersResult::reset):
+        (BlackBerry::WebKit::FatFingersResult::originPosition):
+        (BlackBerry::WebKit::FatFingersResult::adjustedPosition):
+        (BlackBerry::WebKit::FatFingersResult::positionWasAdjusted):
+        (BlackBerry::WebKit::FatFingersResult::isTextInput):
+        (BlackBerry::WebKit::FatFingersResult::isValid):
+        (BlackBerry::WebKit::FatFingersResult::validNode):
+        (BlackBerry::WebKit::FatFingersResult::nodeAsElementIfApplicable):
+        (FatFingers):
+
+2012-02-16  Antonio Gomes  <agomes@rim.com>
+
+        [BlackBerry] Upstream touch handling related classes
+        https://bugs.webkit.org/show_bug.cgi?id=78509
+
+        Reviewed by Adam Treat.
+
+        Initial upstream of the Blackberry specific single touch event
+        handler class.
+
+        * blackberry/WebKitSupport/TouchEventHandler.cpp: Added.
+        (WebKit):
+        (BlackBerry::WebKit::hasMouseMoveListener):
+        (BlackBerry::WebKit::hasTouchListener):
+        (BlackBerry::WebKit::elementExpectsMouseEvents):
+        (BlackBerry::WebKit::shouldConvertTouchToMouse):
+        (BlackBerry::WebKit::TouchEventHandler::TouchEventHandler):
+        (BlackBerry::WebKit::TouchEventHandler::~TouchEventHandler):
+        (BlackBerry::WebKit::TouchEventHandler::shouldSuppressMouseDownOnTouchDown):
+        [BlackBerry] Upstream touch handling related classes
+        https://bugs.webkit.org/show_bug.cgi?id=78509
+
+        Reviewed by Rob Buis.
+
+        InRegionScrollableArea specializes the BlackBerry specific ScrollViewBase,
+        working as a read-only wrapper object for a scrollable areas in the page.
+        It is used in our client side to control in-region scrolling (scrollable boxes,
+        inner frames, etc).
+
+        Initial upstream.
+
+        * WebKitSupport/InRegionScrollableArea.cpp: Added.
+        (WebKit):
+        (BlackBerry::WebKit::InRegionScrollableArea::InRegionScrollableArea):
+        (BlackBerry::WebKit::InRegionScrollableArea::calculateMinimumScrollPosition):
+        (BlackBerry::WebKit::InRegionScrollableArea::calculateMaximumScrollPosition):
+        (BlackBerry::WebKit::InRegionScrollableArea::layer):
+        (BlackBerry):
+        * WebKitSupport/InRegionScrollableArea.h: Added.
+        (WebCore):
+        (WebKit):
+        (InRegionScrollableArea):
+
+2012-02-16  Antonio Gomes  <agomes@rim.com>
+
+        (BlackBerry::WebKit::TouchEventHandler::touchEventCancel):
+        (BlackBerry::WebKit::TouchEventHandler::touchHoldEvent):
+        (BlackBerry::WebKit::TouchEventHandler::handleTouchPoint):
+        (BlackBerry::WebKit::TouchEventHandler::spellCheck):
+        (BlackBerry::WebKit::TouchEventHandler::handleFatFingerPressed):
+        (BlackBerry::WebKit::elementForTapHighlight):
+        (BlackBerry::WebKit::TouchEventHandler::drawTapHighlight):
+        * blackberry/WebKitSupport/TouchEventHandler.h: Added.
+        (WebCore):
+        (WebKit):
+        (TouchEventHandler):
+        (BlackBerry::WebKit::TouchEventHandler::lastFatFingersResult):
+        (BlackBerry::WebKit::TouchEventHandler::resetLastFatFingersResult):
+
diff --git a/Source/WebKit/blackberry/WebCoreSupport/ChromeClientBlackBerry.cpp b/Source/WebKit/blackberry/WebCoreSupport/ChromeClientBlackBerry.cpp
index 0e9acffd8..b12f49b21 100644
--- a/Source/WebKit/blackberry/WebCoreSupport/ChromeClientBlackBerry.cpp
+++ b/Source/WebKit/blackberry/WebCoreSupport/ChromeClientBlackBerry.cpp
@@ -61,8 +61,10 @@
 #include "WebSettings.h"
 #include "WebString.h"
 #include "WindowFeatures.h"
+
 #include <BlackBerryPlatformLog.h>
 #include <BlackBerryPlatformSettings.h>
+#include <BlackBerryPlatformWindow.h>
 
 #define DEBUG_OVERFLOW_DETECTION 0
 
@@ -830,14 +832,4 @@ bool ChromeClientBlackBerry::allowsAcceleratedCompositing() const
 }
 #endif
 
-void* ChromeClientBlackBerry::platformWindow() const
-{
-    return m_webPagePrivate->m_client->window();
-}
-
-void* ChromeClientBlackBerry::platformCompositingWindow() const
-{
-    return m_webPagePrivate->m_client->compositingWindow();
-}
-
 } // namespace WebCore
diff --git a/Source/WebKit/blackberry/WebCoreSupport/ChromeClientBlackBerry.h b/Source/WebKit/blackberry/WebCoreSupport/ChromeClientBlackBerry.h
index 76a715abe..99c8b6062 100644
--- a/Source/WebKit/blackberry/WebCoreSupport/ChromeClientBlackBerry.h
+++ b/Source/WebKit/blackberry/WebCoreSupport/ChromeClientBlackBerry.h
@@ -148,9 +148,6 @@ public:
     virtual bool allowsAcceleratedCompositing() const;
 #endif
 
-    virtual void* platformWindow() const;
-    virtual void* platformCompositingWindow() const;
-
     BlackBerry::WebKit::WebPagePrivate* webPagePrivate() const { return m_webPagePrivate; }
 
 private:
diff --git a/Source/WebKit/blackberry/WebCoreSupport/EditorClientBlackBerry.cpp b/Source/WebKit/blackberry/WebCoreSupport/EditorClientBlackBerry.cpp
new file mode 100644
index 000000000..0e4441d82
--- /dev/null
+++ b/Source/WebKit/blackberry/WebCoreSupport/EditorClientBlackBerry.cpp
@@ -0,0 +1,628 @@
+/*
+ * Copyright (C) 2009 Torch Mobile Inc. http://www.torchmobile.com/
+ * Copyright (C) 2009, 2010, 2011, 2012 Research In Motion Limited. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+#include "config.h"
+#include "EditorClientBlackBerry.h"
+
+#include "DOMSupport.h"
+#include "DumpRenderTreeClient.h"
+#include "EditCommand.h"
+#include "Frame.h"
+#include "HTMLInputElement.h"
+#include "HTMLNames.h"
+#include "InputHandler.h"
+#include "KeyboardEvent.h"
+#include "NotImplemented.h"
+#include "Page.h"
+#include "PlatformKeyboardEvent.h"
+#include "SelectionHandler.h"
+#include "WebPage_p.h"
+#include "WindowsKeyboardCodes.h"
+
+using namespace BlackBerry::WebKit;
+
+namespace WebCore {
+
+// Arbitrary depth limit for the undo stack, to keep it from using
+// unbounded memory. This is the maximum number of distinct undoable
+// actions -- unbroken stretches of typed characters are coalesced
+// into a single action only when not interrupted by string replacements
+// triggered by replaceText calls.
+static const size_t maximumUndoStackDepth = 1000;
+
+EditorClientBlackBerry::EditorClientBlackBerry(WebPagePrivate* webPagePrivate)
+    : m_webPagePrivate(webPagePrivate)
+    , m_waitingForCursorFocus(false)
+    , m_spellCheckState(SpellCheckDefault)
+    , m_inRedo(false)
+{
+}
+
+void EditorClientBlackBerry::pageDestroyed()
+{
+    delete this;
+}
+
+bool EditorClientBlackBerry::shouldDeleteRange(Range* range)
+{
+    if (m_webPagePrivate->m_dumpRenderTree)
+        return m_webPagePrivate->m_dumpRenderTree->shouldDeleteDOMRange(range);
+    return true;
+}
+
+bool EditorClientBlackBerry::shouldShowDeleteInterface(HTMLElement*)
+{
+    notImplemented();
+    return false;
+}
+
+bool EditorClientBlackBerry::smartInsertDeleteEnabled()
+{
+    notImplemented();
+    return false;
+}
+
+bool EditorClientBlackBerry::isSelectTrailingWhitespaceEnabled()
+{
+    if (m_webPagePrivate->m_dumpRenderTree)
+        return m_webPagePrivate->m_dumpRenderTree->isSelectTrailingWhitespaceEnabled();
+    return false;
+}
+
+void EditorClientBlackBerry::enableSpellChecking(bool enable)
+{
+    m_spellCheckState = enable ? SpellCheckDefault : SpellCheckOff;
+}
+
+bool EditorClientBlackBerry::shouldSpellCheckFocusedField()
+{
+    const Frame* frame = m_webPagePrivate->focusedOrMainFrame();
+    if (!frame || !frame->document() || !frame->editor())
+        return false;
+
+    const Node* node = frame->document()->focusedNode();
+    // NOTE: This logic is taken from EditorClientImpl::shouldSpellcheckByDefault
+    // If |node| is null, we default to allowing spellchecking. This is done in
+    // order to mitigate the issue when the user clicks outside the textbox, as a
+    // result of which |node| becomes null, resulting in all the spell check
+    // markers being deleted. Also, the Frame will decide not to do spellchecking
+    // if the user can't edit - so returning true here will not cause any problems
+    // to the Frame's behavior.
+    if (!node)
+        return true;
+
+    // If the field does not support autocomplete, do not do spellchecking.
+    if (node->isElementNode()) {
+        const Element* element = static_cast<const Element*>(node);
+        if (element->hasTagName(HTMLNames::inputTag) && !DOMSupport::elementSupportsAutocomplete(element))
+            return false;
+    }
+
+    // Check if the node disables spell checking directly.
+    return frame->editor()->isSpellCheckingEnabledInFocusedNode();
+}
+
+bool EditorClientBlackBerry::isContinuousSpellCheckingEnabled()
+{
+    if (m_spellCheckState == SpellCheckOff)
+        return false;
+    if (m_spellCheckState == SpellCheckOn)
+        return true;
+    return shouldSpellCheckFocusedField();
+}
+
+void EditorClientBlackBerry::toggleContinuousSpellChecking()
+{
+    // Use the current state to determine how to toggle, if it hasn't
+    // been explicitly set, it will toggle based on the field type.
+    if (isContinuousSpellCheckingEnabled())
+        m_spellCheckState = SpellCheckOff;
+    else
+        m_spellCheckState = SpellCheckOn;
+}
+
+bool EditorClientBlackBerry::isGrammarCheckingEnabled()
+{
+    notImplemented();
+    return false;
+}
+
+void EditorClientBlackBerry::toggleGrammarChecking()
+{
+    notImplemented();
+}
+
+int EditorClientBlackBerry::spellCheckerDocumentTag()
+{
+    notImplemented();
+    return 0;
+}
+
+bool EditorClientBlackBerry::shouldBeginEditing(Range* range)
+{
+    if (m_webPagePrivate->m_dumpRenderTree)
+        return m_webPagePrivate->m_dumpRenderTree->shouldBeginEditingInDOMRange(range);
+
+    return m_webPagePrivate->m_inputHandler->shouldAcceptInputFocus();
+}
+
+bool EditorClientBlackBerry::shouldEndEditing(Range* range)
+{
+    if (m_webPagePrivate->m_dumpRenderTree)
+        return m_webPagePrivate->m_dumpRenderTree->shouldEndEditingInDOMRange(range);
+    return true;
+}
+
+bool EditorClientBlackBerry::shouldInsertNode(Node* node, Range* range, EditorInsertAction insertAction)
+{
+    if (m_webPagePrivate->m_dumpRenderTree)
+        return m_webPagePrivate->m_dumpRenderTree->shouldInsertNode(node, range, static_cast<int>(insertAction));
+    return true;
+}
+
+bool EditorClientBlackBerry::shouldInsertText(const WTF::String& text, Range* range, EditorInsertAction insertAction)
+{
+    if (m_webPagePrivate->m_dumpRenderTree)
+        return m_webPagePrivate->m_dumpRenderTree->shouldInsertText(text, range, static_cast<int>(insertAction));
+    return true;
+}
+
+bool EditorClientBlackBerry::shouldChangeSelectedRange(Range* fromRange, Range* toRange, EAffinity affinity, bool stillSelecting)
+{
+    if (m_webPagePrivate->m_dumpRenderTree)
+        return m_webPagePrivate->m_dumpRenderTree->shouldChangeSelectedDOMRangeToDOMRangeAffinityStillSelecting(fromRange, toRange, static_cast<int>(affinity), stillSelecting);
+
+    Frame* frame = m_webPagePrivate->focusedOrMainFrame();
+    if (frame && frame->document()) {
+        if (frame->document()->focusedNode() && frame->document()->focusedNode()->hasTagName(HTMLNames::selectTag))
+            return false;
+
+        // Update the focus state to re-show the keyboard if needed.
+        // FIXME, this should be removed and strictly be a show keyboard call if
+        // focus is active.
+        if (m_webPagePrivate->m_inputHandler->isInputMode())
+            m_webPagePrivate->m_inputHandler->nodeFocused(frame->document()->focusedNode());
+    }
+
+    return true;
+}
+
+bool EditorClientBlackBerry::shouldApplyStyle(StylePropertySet*, Range*)
+{
+    notImplemented();
+    return true;
+}
+
+bool EditorClientBlackBerry::shouldMoveRangeAfterDelete(Range*, Range*)
+{
+    notImplemented();
+    return true;
+}
+
+void EditorClientBlackBerry::didBeginEditing()
+{
+    if (m_webPagePrivate->m_dumpRenderTree)
+        m_webPagePrivate->m_dumpRenderTree->didBeginEditing();
+}
+
+void EditorClientBlackBerry::respondToChangedContents()
+{
+    if (m_webPagePrivate->m_dumpRenderTree)
+        m_webPagePrivate->m_dumpRenderTree->didChange();
+}
+
+void EditorClientBlackBerry::respondToChangedSelection(Frame* frame)
+{
+    if (m_waitingForCursorFocus)
+        m_waitingForCursorFocus = false;
+    else
+        m_webPagePrivate->selectionChanged(frame);
+
+    if (m_webPagePrivate->m_dumpRenderTree)
+        m_webPagePrivate->m_dumpRenderTree->didChangeSelection();
+}
+
+void EditorClientBlackBerry::didEndEditing()
+{
+    if (m_webPagePrivate->m_dumpRenderTree)
+        m_webPagePrivate->m_dumpRenderTree->didEndEditing();
+}
+
+void EditorClientBlackBerry::respondToSelectionAppearanceChange()
+{
+    m_webPagePrivate->m_selectionHandler->selectionPositionChanged();
+}
+
+void EditorClientBlackBerry::didWriteSelectionToPasteboard()
+{
+    notImplemented();
+}
+
+void EditorClientBlackBerry::didSetSelectionTypesForPasteboard()
+{
+    notImplemented();
+}
+
+void EditorClientBlackBerry::registerCommandForUndo(PassRefPtr<EditCommand> command)
+{
+    // Remove the oldest item if we've reached the maximum capacity for the stack.
+    if (m_undoStack.size() == maximumUndoStackDepth)
+        m_undoStack.removeFirst();
+
+    if (!m_inRedo)
+        m_redoStack.clear();
+
+    m_undoStack.append(command);
+}
+
+void EditorClientBlackBerry::registerCommandForRedo(PassRefPtr<EditCommand> command)
+{
+    m_redoStack.append(command);
+}
+
+void EditorClientBlackBerry::clearUndoRedoOperations()
+{
+    m_undoStack.clear();
+    m_redoStack.clear();
+}
+
+bool EditorClientBlackBerry::canUndo() const
+{
+    return !m_undoStack.isEmpty();
+}
+
+bool EditorClientBlackBerry::canRedo() const
+{
+    return !m_redoStack.isEmpty();
+}
+
+bool EditorClientBlackBerry::canCopyCut(Frame*, bool defaultValue) const
+{
+    return defaultValue;
+}
+
+bool EditorClientBlackBerry::canPaste(Frame*, bool defaultValue) const
+{
+    return defaultValue;
+}
+
+void EditorClientBlackBerry::undo()
+{
+    if (canUndo()) {
+        EditCommandStack::iterator back = --m_undoStack.end();
+        RefPtr<EditCommand> command(*back);
+        m_undoStack.remove(back);
+
+        // Unapply will call us back to push this command onto the redo stack.
+        command->unapply();
+    }
+}
+
+void EditorClientBlackBerry::redo()
+{
+    if (canRedo()) {
+        EditCommandStack::iterator back = --m_redoStack.end();
+        RefPtr<EditCommand> command(*back);
+        m_redoStack.remove(back);
+
+        ASSERT(!m_inRedo);
+        m_inRedo = true;
+
+        // Reapply will call us back to push this command onto the undo stack.
+        command->reapply();
+        m_inRedo = false;
+    }
+}
+
+static const unsigned CtrlKey = 1 << 0;
+static const unsigned AltKey = 1 << 1;
+static const unsigned ShiftKey = 1 << 2;
+
+struct KeyDownEntry {
+    unsigned virtualKey;
+    unsigned modifiers;
+    const char* name;
+};
+
+struct KeyPressEntry {
+    unsigned charCode;
+    unsigned modifiers;
+    const char* name;
+};
+
+static const KeyDownEntry keyDownEntries[] = {
+    { VK_LEFT,   0,                  "MoveLeft"                                    },
+    { VK_LEFT,   ShiftKey,           "MoveLeftAndModifySelection"                  },
+    { VK_LEFT,   CtrlKey,            "MoveWordLeft"                                },
+    { VK_LEFT,   CtrlKey | ShiftKey, "MoveWordLeftAndModifySelection"              },
+    { VK_RIGHT,  0,                  "MoveRight"                                   },
+    { VK_RIGHT,  ShiftKey,           "MoveRightAndModifySelection"                 },
+    { VK_RIGHT,  CtrlKey,            "MoveWordRight"                               },
+    { VK_RIGHT,  CtrlKey | ShiftKey, "MoveWordRightAndModifySelection"             },
+    { VK_UP,     0,                  "MoveUp"                                      },
+    { VK_UP,     ShiftKey,           "MoveUpAndModifySelection"                    },
+    { VK_DOWN,   0,                  "MoveDown"                                    },
+    { VK_DOWN,   ShiftKey,           "MoveDownAndModifySelection"                  },
+    { VK_PRIOR,  0,                  "MovePageUp"                                  },
+    { VK_PRIOR,  ShiftKey,           "MovePageUpAndModifySelection"                },
+    { VK_NEXT,   0,                  "MovePageDown"                                },
+    { VK_NEXT,   ShiftKey,           "MovePageDownAndModifySelection"              },
+    { VK_HOME,   0,                  "MoveToBeginningOfLine"                       },
+    { VK_HOME,   ShiftKey,           "MoveToBeginningOfLineAndModifySelection"     },
+    { VK_HOME,   CtrlKey,            "MoveToBeginningOfDocument"                   },
+    { VK_HOME,   CtrlKey | ShiftKey, "MoveToBeginningOfDocumentAndModifySelection" },
+    { VK_END,    0,                  "MoveToEndOfLine"                             },
+    { VK_END,    ShiftKey,           "MoveToEndOfLineAndModifySelection"           },
+    { VK_END,    CtrlKey,            "MoveToEndOfDocument"                         },
+    { VK_END,    CtrlKey | ShiftKey, "MoveToEndOfDocumentAndModifySelection"       },
+
+    { 'B',       CtrlKey,            "ToggleBold"                                  },
+    { 'I',       CtrlKey,            "ToggleItalic"                                },
+    { 'U',       CtrlKey,            "ToggleUnderline"                             },
+
+    { VK_BACK,   0,                  "DeleteBackward"                              },
+    { VK_BACK,   ShiftKey,           "DeleteBackward"                              },
+    { VK_DELETE, 0,                  "DeleteForward"                               },
+    { VK_BACK,   CtrlKey,            "DeleteWordBackward"                          },
+    { VK_DELETE, CtrlKey,            "DeleteWordForward"                           },
+
+    { 'C',       CtrlKey,            "Copy"                                        },
+    { 'V',       CtrlKey,            "Paste"                                       },
+    { 'V',       CtrlKey | ShiftKey, "PasteAndMatchStyle"                          },
+    { 'X',       CtrlKey,            "Cut"                                         },
+    { VK_INSERT, CtrlKey,            "Copy"                                        },
+    { VK_DELETE, ShiftKey,           "Cut"                                         },
+    { VK_INSERT, ShiftKey,           "Paste"                                       },
+
+    { 'A',       CtrlKey,            "SelectAll"                                   },
+    { 'Z',       CtrlKey,            "Undo"                                        },
+    { 'Z',       CtrlKey | ShiftKey, "Redo"                                        },
+    { 'Y',       CtrlKey,            "Redo"                                        },
+
+    { VK_TAB,    0,                  "InsertTab"                                   },
+    { VK_TAB,    ShiftKey,           "InsertBacktab"                               },
+    { VK_RETURN, 0,                  "InsertNewline"                               },
+    { VK_RETURN, CtrlKey,            "InsertNewline"                               },
+    { VK_RETURN, AltKey,             "InsertNewline"                               },
+    { VK_RETURN, ShiftKey,           "InsertLineBreak"                             },
+    { VK_RETURN, AltKey | ShiftKey,  "InsertNewline"                               },
+
+};
+
+static const KeyPressEntry keyPressEntries[] = {
+    { '\t',   0,                  "InsertTab"                                   },
+    { '\t',   ShiftKey,           "InsertBacktab"                               },
+    { '\r',   0,                  "InsertNewline"                               },
+    { '\r',   CtrlKey,            "InsertNewline"                               },
+    { '\r',   AltKey,             "InsertNewline"                               },
+    { '\r',   ShiftKey,           "InsertLineBreak"                             },
+    { '\r',   AltKey | ShiftKey,  "InsertNewline"                               },
+};
+
+
+const char* EditorClientBlackBerry::interpretKeyEvent(const KeyboardEvent* event)
+{
+    ASSERT(event->type() == eventNames().keydownEvent || event->type() == eventNames().keypressEvent);
+
+    static HashMap<int, const char*>* keyDownCommandsMap = 0;
+    static HashMap<int, const char*>* keyPressCommandsMap = 0;
+
+    if (!keyDownCommandsMap) {
+        keyDownCommandsMap = new HashMap<int, const char*>;
+        keyPressCommandsMap = new HashMap<int, const char*>;
+
+        for (size_t i = 0; i < WTF_ARRAY_LENGTH(keyDownEntries); ++i)
+            keyDownCommandsMap->set(keyDownEntries[i].modifiers << 16 | keyDownEntries[i].virtualKey, keyDownEntries[i].name);
+
+        for (size_t i = 0; i < WTF_ARRAY_LENGTH(keyPressEntries); ++i)
+            keyPressCommandsMap->set(keyPressEntries[i].modifiers << 16 | keyPressEntries[i].charCode, keyPressEntries[i].name);
+    }
+
+    unsigned modifiers = 0;
+    if (event->shiftKey())
+        modifiers |= ShiftKey;
+    if (event->altKey())
+        modifiers |= AltKey;
+    if (event->ctrlKey())
+        modifiers |= CtrlKey;
+
+    if (event->type() == eventNames().keydownEvent) {
+        int mapKey = modifiers << 16 | event->keyCode();
+        return mapKey ? keyDownCommandsMap->get(mapKey) : 0;
+    }
+
+    int mapKey = modifiers << 16 | event->charCode();
+    return mapKey ? keyPressCommandsMap->get(mapKey) : 0;
+}
+
+void EditorClientBlackBerry::handleKeyboardEvent(KeyboardEvent* event)
+{
+    ASSERT(event);
+
+    const PlatformKeyboardEvent* platformEvent = event->keyEvent();
+    if (!platformEvent)
+        return;
+
+    ASSERT(event->target()->toNode());
+    Frame* frame = event->target()->toNode()->document()->frame();
+    ASSERT(frame);
+
+    String commandName = interpretKeyEvent(event);
+
+    if (!commandName.isEmpty()) {
+        if (frame->editor()->command(commandName).execute())
+            event->setDefaultHandled();
+        return;
+    }
+
+    if (!frame->editor()->canEdit())
+        return;
+
+    // Text insertion commands should only be triggered from keypressEvent.
+    // There is an assert guaranteeing this in
+    // EventHandler::handleTextInputEvent. Note that windowsVirtualKeyCode
+    // is not set for keypressEvent: special keys should have been already
+    // handled in keydownEvent, which is called first.
+    if (event->type() != eventNames().keypressEvent)
+        return;
+
+    // Don't insert null or control characters as they can result in unexpected behaviour.
+    if (event->charCode() < ' ')
+        return;
+
+    // Don't insert anything if a modifier is pressed.
+    if (event->ctrlKey() || event->altKey())
+        return;
+
+    if (!platformEvent->text().isEmpty()) {
+        if (frame->editor()->insertText(platformEvent->text(), event))
+            event->setDefaultHandled();
+    }
+}
+
+void EditorClientBlackBerry::handleInputMethodKeydown(KeyboardEvent*)
+{
+    notImplemented();
+}
+
+void EditorClientBlackBerry::textFieldDidBeginEditing(Element*)
+{
+    notImplemented();
+}
+
+void EditorClientBlackBerry::textFieldDidEndEditing(Element*)
+{
+    notImplemented();
+}
+
+void EditorClientBlackBerry::textDidChangeInTextField(Element*)
+{
+    notImplemented();
+}
+
+bool EditorClientBlackBerry::doTextFieldCommandFromEvent(Element*, KeyboardEvent*)
+{
+    notImplemented();
+    return false;
+}
+
+void EditorClientBlackBerry::textWillBeDeletedInTextField(Element*)
+{
+    notImplemented();
+}
+
+void EditorClientBlackBerry::textDidChangeInTextArea(Element*)
+{
+    notImplemented();
+}
+
+void EditorClientBlackBerry::ignoreWordInSpellDocument(const WTF::String&)
+{
+    notImplemented();
+}
+
+void EditorClientBlackBerry::learnWord(const WTF::String&)
+{
+    notImplemented();
+}
+
+void EditorClientBlackBerry::checkSpellingOfString(const UChar* text, int textLength, int* misspellLocation, int* misspellLength)
+{
+    m_webPagePrivate->m_client->checkSpellingOfString(text, textLength, *misspellLocation, *misspellLength);
+}
+
+WTF::String EditorClientBlackBerry::getAutoCorrectSuggestionForMisspelledWord(const WTF::String& misspelledWord)
+{
+    notImplemented();
+    return WTF::String();
+}
+
+void EditorClientBlackBerry::checkGrammarOfString(const UChar*, int, WTF::Vector<GrammarDetail, 0u>&, int*, int*)
+{
+    notImplemented();
+}
+
+void EditorClientBlackBerry::requestCheckingOfString(SpellChecker*, const TextCheckingRequest&)
+{
+    notImplemented();
+}
+
+TextCheckerClient* EditorClientBlackBerry::textChecker()
+{
+    return this;
+}
+
+void EditorClientBlackBerry::updateSpellingUIWithGrammarString(const WTF::String&, const GrammarDetail&)
+{
+    notImplemented();
+}
+
+void EditorClientBlackBerry::updateSpellingUIWithMisspelledWord(const WTF::String&)
+{
+    notImplemented();
+}
+
+void EditorClientBlackBerry::showSpellingUI(bool)
+{
+    notImplemented();
+}
+
+bool EditorClientBlackBerry::spellingUIIsShowing()
+{
+    notImplemented();
+    return false;
+}
+
+void EditorClientBlackBerry::getGuessesForWord(const WTF::String&, WTF::Vector<WTF::String, 0u>&)
+{
+    notImplemented();
+}
+
+void EditorClientBlackBerry::getGuessesForWord(const String&, const String&, Vector<String>&)
+{
+    notImplemented();
+}
+
+void EditorClientBlackBerry::willSetInputMethodState()
+{
+    notImplemented();
+}
+
+void EditorClientBlackBerry::setInputMethodState(bool active)
+{
+    Frame* frame = m_webPagePrivate->focusedOrMainFrame();
+    // Determines whether or not to provide input assistance. Password fields
+    // do not have this flag active, so it needs to be overridden.
+    if (frame && frame->document()) {
+        if (Node* focusNode = frame->document()->focusedNode()) {
+            if (!active && focusNode->hasTagName(HTMLNames::inputTag)
+                && static_cast<HTMLInputElement*>(focusNode)->isPasswordField())
+                    active = true;
+
+            if (active) {
+                m_webPagePrivate->m_inputHandler->nodeFocused(focusNode);
+                return;
+            }
+        }
+    }
+    // No frame or document or a node that doesn't support IME.
+    m_webPagePrivate->m_inputHandler->nodeFocused(0);
+}
+
+} // namespace WebCore
diff --git a/Source/WebKit/blackberry/WebCoreSupport/EditorClientBlackBerry.h b/Source/WebKit/blackberry/WebCoreSupport/EditorClientBlackBerry.h
new file mode 100644
index 000000000..54a310090
--- /dev/null
+++ b/Source/WebKit/blackberry/WebCoreSupport/EditorClientBlackBerry.h
@@ -0,0 +1,118 @@
+/*
+ * Copyright (C) 2009 Torch Mobile Inc. http://www.torchmobile.com/
+ * Copyright (C) 2009, 2010, 2011, 2012 Research In Motion Limited. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+#ifndef EditorClientBlackBerry_h
+#define EditorClientBlackBerry_h
+
+#include "EditorClient.h"
+#include "TextCheckerClient.h"
+
+#include <wtf/Deque.h>
+
+namespace BlackBerry {
+namespace WebKit {
+class WebPagePrivate;
+}
+}
+
+namespace WebCore {
+
+class EditorClientBlackBerry : public EditorClient, public TextCheckerClient {
+public:
+    EditorClientBlackBerry(BlackBerry::WebKit::WebPagePrivate*);
+    virtual void pageDestroyed();
+    virtual bool shouldDeleteRange(Range*);
+    virtual bool shouldShowDeleteInterface(HTMLElement*);
+    virtual bool smartInsertDeleteEnabled();
+    virtual bool isSelectTrailingWhitespaceEnabled();
+    virtual bool isContinuousSpellCheckingEnabled();
+    virtual void toggleContinuousSpellChecking();
+    virtual bool isGrammarCheckingEnabled();
+    virtual void toggleGrammarChecking();
+    virtual int spellCheckerDocumentTag();
+    virtual bool shouldBeginEditing(Range*);
+    virtual bool shouldEndEditing(Range*);
+    virtual bool shouldInsertNode(Node*, Range*, EditorInsertAction);
+    virtual bool shouldInsertText(const String&, Range*, EditorInsertAction);
+    virtual bool shouldChangeSelectedRange(Range*, Range*, EAffinity, bool);
+    virtual bool shouldApplyStyle(StylePropertySet*, Range*);
+    virtual bool shouldMoveRangeAfterDelete(Range*, Range*);
+    virtual void didBeginEditing();
+    virtual void respondToChangedContents();
+    virtual void respondToChangedSelection(Frame*);
+    virtual void respondToSelectionAppearanceChange();
+    virtual void didEndEditing();
+    virtual void didWriteSelectionToPasteboard();
+    virtual void didSetSelectionTypesForPasteboard();
+    virtual void registerCommandForUndo(PassRefPtr<EditCommand>);
+    virtual void registerCommandForRedo(PassRefPtr<EditCommand>);
+    virtual void clearUndoRedoOperations();
+    virtual bool canCopyCut(Frame*, bool) const;
+    virtual bool canPaste(Frame*, bool) const;
+    virtual bool canUndo() const;
+    virtual bool canRedo() const;
+    virtual void undo();
+    virtual void redo();
+    virtual const char* interpretKeyEvent(const KeyboardEvent*);
+    virtual void handleKeyboardEvent(KeyboardEvent*);
+    virtual void handleInputMethodKeydown(KeyboardEvent*);
+    virtual void textFieldDidBeginEditing(Element*);
+    virtual void textFieldDidEndEditing(Element*);
+    virtual void textDidChangeInTextField(Element*);
+    virtual bool doTextFieldCommandFromEvent(Element*, KeyboardEvent*);
+    virtual void textWillBeDeletedInTextField(Element*);
+    virtual void textDidChangeInTextArea(Element*);
+    virtual void ignoreWordInSpellDocument(const String&);
+    virtual void learnWord(const String&);
+    virtual void checkSpellingOfString(const UChar*, int, int*, int*);
+    virtual String getAutoCorrectSuggestionForMisspelledWord(const String& misspelledWord);
+    virtual void checkGrammarOfString(const UChar*, int, Vector<GrammarDetail, 0u>&, int*, int*);
+    virtual void getGuessesForWord(const String&, const String&, Vector<String>&);
+    virtual void requestCheckingOfString(SpellChecker*, const TextCheckingRequest&);
+
+    virtual TextCheckerClient* textChecker();
+    virtual void updateSpellingUIWithGrammarString(const String&, const GrammarDetail&);
+    virtual void updateSpellingUIWithMisspelledWord(const String&);
+    virtual void showSpellingUI(bool);
+    virtual bool spellingUIIsShowing();
+    virtual void getGuessesForWord(const String&, Vector<String, 0u>&);
+    virtual void willSetInputMethodState();
+    virtual void setInputMethodState(bool);
+
+    void enableSpellChecking(bool);
+
+private:
+    bool shouldSpellCheckFocusedField();
+
+    BlackBerry::WebKit::WebPagePrivate* m_webPagePrivate;
+    bool m_waitingForCursorFocus;
+
+    enum SpellCheckState { SpellCheckDefault, SpellCheckOn, SpellCheckOff };
+    SpellCheckState m_spellCheckState;
+
+    bool m_inRedo;
+
+    typedef Deque<RefPtr<WebCore::EditCommand> > EditCommandStack;
+    EditCommandStack m_undoStack;
+    EditCommandStack m_redoStack;
+};
+
+} // WebCore
+
+#endif // EditorClientBlackBerry_h
diff --git a/Source/WebKit/blackberry/WebCoreSupport/FrameLoaderClientBlackBerry.cpp b/Source/WebKit/blackberry/WebCoreSupport/FrameLoaderClientBlackBerry.cpp
new file mode 100644
index 000000000..afddd51a3
--- /dev/null
+++ b/Source/WebKit/blackberry/WebCoreSupport/FrameLoaderClientBlackBerry.cpp
@@ -0,0 +1,1274 @@
+/*
+ * Copyright (C) 2009, 2010, 2011, 2012 Research In Motion Limited. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+#include "config.h"
+#include "FrameLoaderClientBlackBerry.h"
+
+#include "BackForwardController.h"
+#include "BackForwardListImpl.h"
+#include "BackingStoreClient.h"
+#include "BackingStore_p.h"
+#include "Base64.h"
+#include "CachedImage.h"
+#include "Chrome.h"
+#include "ChromeClientBlackBerry.h"
+#include "ClientExtension.h"
+#include "CookieManager.h"
+#include "DumpRenderTreeClient.h"
+#include "FrameNetworkingContextBlackBerry.h"
+#include "FrameView.h"
+#include "HTMLFormElement.h"
+#include "HTMLHeadElement.h"
+#include "HTMLImageElement.h"
+#include "HTMLLinkElement.h"
+#include "HTMLMediaElement.h"
+#include "HTMLMetaElement.h"
+#include "HTMLNames.h"
+#include "HTMLPlugInElement.h"
+#include "HTTPParsers.h"
+#include "HistoryItem.h"
+#include "IconDatabase.h"
+#include "Image.h"
+#include "InputHandler.h"
+#include "MIMETypeRegistry.h"
+#include "NativeImageSkia.h"
+#include "NetworkManager.h"
+#include "NodeList.h"
+#include "Page.h"
+#include "PluginView.h"
+#include "ProgressTracker.h"
+#include "ScopePointer.h"
+#include "SharedBuffer.h"
+#include "TextEncoding.h"
+#include "TouchEventHandler.h"
+#if ENABLE(WEBDOM)
+#include "WebDOMDocument.h"
+#endif
+#include "WebPageClient.h"
+
+#include <BlackBerryPlatformLog.h>
+#include <BlackBerryPlatformScreen.h>
+#include <JavaScriptCore/APICast.h>
+#include <network/FilterStream.h>
+#include <network/NetworkRequest.h>
+
+using WTF::String;
+using namespace WebCore;
+using namespace BlackBerry::WebKit;
+
+// This was copied from file "WebKit/Source/WebKit/mac/Misc/WebKitErrors.h".
+enum {
+    WebKitErrorCannotShowMIMEType =                             100,
+    WebKitErrorCannotShowURL =                                  101,
+    WebKitErrorFrameLoadInterruptedByPolicyChange =             102,
+    WebKitErrorCannotUseRestrictedPort =                        103,
+    WebKitErrorCannotFindPlugIn =                               200,
+    WebKitErrorCannotLoadPlugIn =                               201,
+    WebKitErrorJavaUnavailable =                                202,
+    WebKitErrorPluginWillHandleLoad =                           203
+};
+
+namespace WebCore {
+
+FrameLoaderClientBlackBerry::FrameLoaderClientBlackBerry()
+    : m_frame(0)
+    , m_webPagePrivate(0)
+    , m_sentReadyToRender(false)
+    , m_pendingFragmentScrollPolicyFunction(0)
+    , m_loadingErrorPage(false)
+    , m_clientRedirectIsPending(false)
+    , m_childFrameCreationSuppressed(false)
+    , m_pluginView(0)
+    , m_hasSentResponseToPlugin(false)
+    , m_cancelLoadOnNextData(false)
+{
+    m_deferredJobsTimer = new Timer<FrameLoaderClientBlackBerry>(this, &FrameLoaderClientBlackBerry::deferredJobsTimerFired);
+}
+
+FrameLoaderClientBlackBerry::~FrameLoaderClientBlackBerry()
+{
+    delete m_deferredJobsTimer;
+    m_deferredJobsTimer = 0;
+}
+
+int FrameLoaderClientBlackBerry::playerId() const
+{
+    if (m_webPagePrivate && m_webPagePrivate->m_client)
+        return m_webPagePrivate->m_client->getInstanceId();
+    return 0;
+}
+
+bool FrameLoaderClientBlackBerry::cookiesEnabled() const
+{
+    return m_webPagePrivate->m_webSettings->areCookiesEnabled();
+}
+
+void FrameLoaderClientBlackBerry::dispatchDidAddBackForwardItem(HistoryItem* item) const
+{
+    // Inform the client that the back/forward list has changed.
+    invalidateBackForwardList();
+}
+
+void FrameLoaderClientBlackBerry::dispatchDidRemoveBackForwardItem(HistoryItem* item) const
+{
+    invalidateBackForwardList();
+}
+
+void FrameLoaderClientBlackBerry::dispatchDidChangeBackForwardIndex() const
+{
+    invalidateBackForwardList();
+}
+
+void FrameLoaderClientBlackBerry::dispatchDidChangeLocationWithinPage()
+{
+    if (!isMainFrame())
+        return;
+
+    String url = m_frame->document()->url().string();
+    String token = m_frame->loader()->documentLoader()->request().token();
+
+    m_webPagePrivate->m_client->notifyLoadToAnchor(url.characters(), url.length(), token.characters(), token.length());
+}
+
+void FrameLoaderClientBlackBerry::dispatchDidPushStateWithinPage()
+{
+    // FIXME: As a workaround we abuse anchor navigation to achieve history push. See PR #119779 for more details.
+    dispatchDidChangeLocationWithinPage();
+}
+
+void FrameLoaderClientBlackBerry::dispatchDidReplaceStateWithinPage()
+{
+    // FIXME: As a workaround we abuse anchor navigation to achieve history replace. See PR #119779 for more details.
+    dispatchDidChangeLocationWithinPage();
+}
+
+void FrameLoaderClientBlackBerry::dispatchDidPopStateWithinPage()
+{
+    // Not needed.
+}
+
+void FrameLoaderClientBlackBerry::dispatchDidCancelClientRedirect()
+{
+    m_clientRedirectIsPending = false;
+}
+
+void FrameLoaderClientBlackBerry::dispatchWillPerformClientRedirect(const KURL&, double, double)
+{
+    if (m_webPagePrivate->m_dumpRenderTree)
+        m_webPagePrivate->m_dumpRenderTree->didDispatchWillPerformClientRedirect();
+
+    m_clientRedirectIsPending = true;
+}
+
+void FrameLoaderClientBlackBerry::dispatchDecidePolicyForResponse(FramePolicyFunction function, const ResourceResponse& response, const ResourceRequest& request)
+{
+    // FIXME: What should we do for HTTP status code 204 and 205 and "application/zip"?
+    PolicyAction policy = PolicyIgnore;
+
+    if (contentDispositionType(response.httpHeaderField("Content-Disposition")) == ContentDispositionAttachment
+        || request.forceDownload())
+        policy = PolicyDownload;
+    else if (canShowMIMEType(response.mimeType()))
+        policy = PolicyUse;
+    else if ((ResourceRequest::TargetIsMainFrame == request.targetType())
+             && m_webPagePrivate->m_client->downloadAllowed(request.url().string().utf8().data()))
+        policy = PolicyDownload;
+
+    (m_frame->loader()->policyChecker()->*function)(policy);
+}
+
+void FrameLoaderClientBlackBerry::dispatchDecidePolicyForNavigationAction(FramePolicyFunction function, const NavigationAction& action, const ResourceRequest& request, PassRefPtr<FormState>)
+{
+    PolicyAction decision = PolicyUse;
+
+    const KURL& url = request.url();
+
+    // Fragment scrolls on the same page should always be handled internally.
+    // (Only count as a fragment scroll if we are scrolling to a #fragment url, not back to the top, and reloading
+    // the same url is not a fragment scroll even if it has a #fragment.)
+    const KURL& currentUrl = m_frame->document()->url();
+    bool isFragmentScroll = url.hasFragmentIdentifier() && url != currentUrl && equalIgnoringFragmentIdentifier(currentUrl, url);
+    if (decision == PolicyUse)
+        decision = decidePolicyForExternalLoad(request, isFragmentScroll);
+
+    // Let the client have a chance to say whether this navigation should
+    // be ignored or not.
+    BlackBerry::Platform::NetworkRequest platformRequest;
+    request.initializePlatformRequest(platformRequest, false /*isInitial*/);
+    if (isMainFrame() && !m_webPagePrivate->m_client->acceptNavigationRequest(
+        platformRequest, BlackBerry::Platform::NavigationType(action.type()))) {
+        if (action.type() == NavigationTypeFormSubmitted
+            || action.type() == NavigationTypeFormResubmitted)
+            m_frame->loader()->resetMultipleFormSubmissionProtection();
+
+        if (action.type() == NavigationTypeLinkClicked && url.hasFragmentIdentifier()) {
+            ResourceRequest emptyRequest;
+            m_frame->loader()->activeDocumentLoader()->setLastCheckedRequest(emptyRequest);
+        }
+        decision = PolicyIgnore;
+    }
+
+    // If we abort here, dispatchDidCancelClientRedirect will not be called.
+    // So call it by hand.
+    if (decision == PolicyIgnore)
+        dispatchDidCancelClientRedirect();
+
+    (m_frame->loader()->policyChecker()->*function)(decision);
+
+    if (m_webPagePrivate->m_dumpRenderTree)
+        m_webPagePrivate->m_dumpRenderTree->didDecidePolicyForNavigationAction(action, request);
+}
+
+void FrameLoaderClientBlackBerry::delayPolicyCheckUntilFragmentExists(const String& fragment, FramePolicyFunction function)
+{
+    ASSERT(isMainFrame());
+
+    if (m_webPagePrivate->loadState() < WebPagePrivate::Finished && !m_frame->document()->findAnchor(fragment)) {
+        // Tell the client we need more data, in case the fragment exists but is being held back.
+        m_webPagePrivate->m_client->needMoreData();
+        m_pendingFragmentScrollPolicyFunction = function;
+        m_pendingFragmentScroll = fragment;
+        return;
+    }
+
+    (m_frame->loader()->policyChecker()->*function)(PolicyUse);
+}
+
+void FrameLoaderClientBlackBerry::cancelPolicyCheck()
+{
+    m_pendingFragmentScrollPolicyFunction = 0;
+    m_pendingFragmentScroll = String();
+}
+
+void FrameLoaderClientBlackBerry::doPendingFragmentScroll()
+{
+    if (m_pendingFragmentScroll.isNull())
+        return;
+
+    // Make sure to clear the pending members first to avoid recursion.
+    String fragment = m_pendingFragmentScroll;
+    m_pendingFragmentScroll = String();
+
+    FramePolicyFunction function = m_pendingFragmentScrollPolicyFunction;
+    m_pendingFragmentScrollPolicyFunction = 0;
+
+    delayPolicyCheckUntilFragmentExists(fragment, function);
+}
+
+void FrameLoaderClientBlackBerry::dispatchDecidePolicyForNewWindowAction(FramePolicyFunction function, const NavigationAction& action, const ResourceRequest& request, PassRefPtr<FormState>, const String& frameName)
+{
+    if (request.isRequestedByPlugin() && ScriptController::processingUserGesture() && !m_webPagePrivate->m_pluginMayOpenNewTab)
+        (m_frame->loader()->policyChecker()->*function)(PolicyIgnore);
+
+    // A new window can never be a fragment scroll.
+    PolicyAction decision = decidePolicyForExternalLoad(request, false);
+    // Let the client have a chance to say whether this navigation should
+    // be ignored or not.
+    BlackBerry::Platform::NetworkRequest platformRequest;
+    request.initializePlatformRequest(platformRequest, false /*isInitial*/);
+    if (isMainFrame() && !m_webPagePrivate->m_client->acceptNavigationRequest(
+        platformRequest, BlackBerry::Platform::NavigationType(action.type()))) {
+        if (action.type() == NavigationTypeFormSubmitted || action.type() == NavigationTypeFormResubmitted)
+            m_frame->loader()->resetMultipleFormSubmissionProtection();
+
+        if (action.type() == NavigationTypeLinkClicked && request.url().hasFragmentIdentifier()) {
+            ResourceRequest emptyRequest;
+            m_frame->loader()->activeDocumentLoader()->setLastCheckedRequest(emptyRequest);
+        }
+        decision = PolicyIgnore;
+    }
+
+    (m_frame->loader()->policyChecker()->*function)(decision);
+}
+
+void FrameLoaderClientBlackBerry::committedLoad(DocumentLoader* loader, const char* data, int length)
+{
+    // The structure of this code may seem...a bit odd. It's structured with two checks on the state
+    // of m_pluginView because it's actually receivedData that may cause the request to re-direct data
+    // to a PluginView. This is because receivedData may decide to create a PluginDocument containing
+    // a PluginView. The PluginView will request that the main resource for the frame be redirected
+    // to the PluginView. So after receivedData has been called, this code needs to check whether
+    // re-direction to a PluginView has been requested and pass the same data on to the PluginView.
+    // Thereafter, all data will be re-directed to the PluginView; i.e., no additional data will go
+    // to receivedData.
+
+    if (!m_pluginView) {
+        const String& textEncoding = loader->response().textEncodingName();
+        receivedData(data, length, textEncoding);
+    }
+
+    if (m_pluginView) {
+        if (!m_hasSentResponseToPlugin) {
+            m_pluginView->didReceiveResponse(loader->response());
+            m_hasSentResponseToPlugin = true;
+        }
+
+        if (!m_pluginView)
+            return;
+
+        m_pluginView->didReceiveData(data, length);
+    }
+}
+
+PassRefPtr<Widget> FrameLoaderClientBlackBerry::createPlugin(const IntSize& pluginSize,
+    HTMLPlugInElement* element, const KURL& url, const Vector<String>& paramNames,
+    const Vector<String>& paramValues, const String& mimeTypeIn, bool loadManually)
+{
+    String mimeType(mimeTypeIn);
+    if (mimeType.isEmpty()) {
+        mimeType = MIMETypeRegistry::getMIMETypeForPath(url.path());
+        mimeType = WebSettings::getNormalizedMIMEType(mimeType);
+        if (mimeType != "application/x-shockwave-flash")
+            mimeType = mimeTypeIn;
+    }
+
+    if (mimeType == "application/x-shockwave-flash" || mimeType == "application/jnext-scriptable-plugin")
+        return PluginView::create(m_frame, pluginSize, element, url, paramNames, paramValues, mimeType, loadManually);
+
+    // If it's not the plugin type we support, try load directly from browser.
+    if (m_frame->loader() && m_frame->loader()->subframeLoader() && !url.isNull())
+        m_frame->loader()->subframeLoader()->requestFrame(element, url, String());
+
+    return 0;
+}
+
+void FrameLoaderClientBlackBerry::redirectDataToPlugin(Widget* pluginWidget)
+{
+    ASSERT(!m_pluginView);
+    m_pluginView = static_cast<PluginView*>(pluginWidget);
+    m_hasSentResponseToPlugin = false;
+}
+
+void FrameLoaderClientBlackBerry::receivedData(const char* data, int length, const String& textEncoding)
+{
+    if (!m_frame)
+        return;
+
+    if (m_cancelLoadOnNextData) {
+        m_frame->loader()->activeDocumentLoader()->stopLoading();
+        m_frame->loader()->documentLoader()->writer()->end();
+        m_cancelLoadOnNextData = false;
+        return;
+    }
+
+    // Set the encoding. This only needs to be done once, but it's harmless to do it again later.
+    String encoding = m_frame->loader()->documentLoader()->overrideEncoding();
+    bool userChosen = !encoding.isNull();
+    if (encoding.isNull())
+        encoding = textEncoding;
+    m_frame->loader()->documentLoader()->writer()->setEncoding(encoding, userChosen);
+    m_frame->loader()->documentLoader()->writer()->addData(data, length);
+}
+
+void FrameLoaderClientBlackBerry::finishedLoading(DocumentLoader* loader)
+{
+    if (m_pluginView) {
+        m_pluginView->didFinishLoading();
+        m_pluginView = 0;
+        m_hasSentResponseToPlugin = false;
+    } else {
+        // Telling the frame we received some data and passing 0 as the data is our
+        // way to get work done that is normally done when the first bit of data is
+        // received, even for the case of a document with no data (like about:blank).
+        committedLoad(loader, 0, 0);
+    }
+}
+
+PassRefPtr<DocumentLoader> FrameLoaderClientBlackBerry::createDocumentLoader(const ResourceRequest& request, const SubstituteData& substituteData)
+{
+    // Make a copy of the request with the token from the original request for this frame
+    // (unless it already has a token, in which case the request came from the client).
+    ResourceRequest newRequest(request);
+    if (m_frame && m_frame->loader() && m_frame->loader()->documentLoader()) {
+        const ResourceRequest& originalRequest = m_frame->loader()->documentLoader()->originalRequest();
+        if (request.token().isNull() && !originalRequest.token().isNull())
+            newRequest.setToken(originalRequest.token());
+    }
+
+    // FIXME: This should probably be shared.
+    RefPtr<DocumentLoader> loader = DocumentLoader::create(newRequest, substituteData);
+    if (substituteData.isValid())
+        loader->setDeferMainResourceDataLoad(false);
+    return loader.release();
+}
+
+void FrameLoaderClientBlackBerry::frameLoaderDestroyed()
+{
+    delete this;
+}
+
+void FrameLoaderClientBlackBerry::transitionToCommittedForNewPage()
+{
+    m_cancelLoadOnNextData = false;
+
+    // In Frame::createView, Frame's FrameView object is set to 0 and recreated.
+    // This operation is not atomic, and an attempt to blit contents might happen
+    // in the backing store from another thread (see BackingStorePrivate::blitContents method),
+    // so we suspend and resume screen update to make sure we do not get a invalid FrameView
+    // state.
+    BackingStoreClient* backingStoreClientForFrame = m_webPagePrivate->backingStoreClientForFrame(m_frame);
+    if (backingStoreClientForFrame)
+        backingStoreClientForFrame->backingStore()->d->suspendScreenAndBackingStoreUpdates();
+
+    // We are navigating away from this document, so clean up any footprint we might have.
+    if (m_frame->document())
+        m_webPagePrivate->clearDocumentData(m_frame->document());
+
+    Color backgroundColor(m_webPagePrivate->m_webSettings->backgroundColor());
+
+    m_frame->createView(m_webPagePrivate->viewportSize(),      /* viewport */
+                        backgroundColor,                       /* background color */
+                        backgroundColor.hasAlpha(),            /* is transparent */
+                        m_webPagePrivate->actualVisibleSize(), /* fixed reported size */
+                        m_webPagePrivate->fixedLayoutSize(),   /* fixed layout size */
+                        m_webPagePrivate->useFixedLayout(),    /* use fixed layout */
+                        ScrollbarAlwaysOff,                    /* hor mode */
+                        true,                                  /* lock the mode */
+                        ScrollbarAlwaysOff,                    /* ver mode */
+                        true);                                 /* lock the mode */
+
+    if (backingStoreClientForFrame)
+        backingStoreClientForFrame->backingStore()->d->resumeScreenAndBackingStoreUpdates(BackingStore::None);
+    m_frame->view()->updateCanHaveScrollbars();
+
+    if (isMainFrame()) {
+        // Since the mainframe has a tiled backingstore request to receive all update
+        // rects instead of the default which just sends update rects for currently
+        // visible viewport.
+        m_frame->view()->setPaintsEntireContents(true);
+    }
+}
+
+String FrameLoaderClientBlackBerry::userAgent(const KURL&)
+{
+    return m_webPagePrivate->m_webSettings->userAgentString();
+}
+
+bool FrameLoaderClientBlackBerry::canHandleRequest(const ResourceRequest&) const
+{
+    // FIXME: Stub.
+    return true;
+}
+
+bool FrameLoaderClientBlackBerry::canShowMIMEType(const String& mimeTypeIn) const
+{
+    // Get normalized type.
+    String mimeType = WebSettings::getNormalizedMIMEType(mimeTypeIn);
+
+    // FIXME: Seems no other port checks empty MIME type in this function. Should we do that?
+    return MIMETypeRegistry::isSupportedImageMIMEType(mimeType) || MIMETypeRegistry::isSupportedNonImageMIMEType(mimeType)
+        || MIMETypeRegistry::isSupportedMediaMIMEType(mimeType) || WebSettings::isSupportedObjectMIMEType(mimeType)
+        || (mimeType == "application/x-shockwave-flash");
+}
+
+bool FrameLoaderClientBlackBerry::canShowMIMETypeAsHTML(const String&) const
+{
+    // FIXME: Stub.
+    return true;
+}
+
+bool FrameLoaderClientBlackBerry::isMainFrame() const
+{
+    return m_frame == m_webPagePrivate->m_mainFrame;
+}
+
+void FrameLoaderClientBlackBerry::dispatchDidStartProvisionalLoad()
+{
+    if (isMainFrame())
+        m_webPagePrivate->setLoadState(WebPagePrivate::Provisional);
+
+    if (m_webPagePrivate->m_dumpRenderTree)
+        m_webPagePrivate->m_dumpRenderTree->didStartProvisionalLoadForFrame(m_frame);
+}
+
+void FrameLoaderClientBlackBerry::dispatchDidReceiveResponse(DocumentLoader*, unsigned long identifier, const ResourceResponse& response)
+{
+    if (m_webPagePrivate->m_dumpRenderTree)
+        m_webPagePrivate->m_dumpRenderTree->didReceiveResponseForFrame(m_frame, response);
+}
+
+void FrameLoaderClientBlackBerry::dispatchDidReceiveTitle(const StringWithDirection& title)
+{
+    if (isMainFrame())
+        m_webPagePrivate->m_client->setPageTitle(title.string().characters(), title.string().length());
+
+    if (m_webPagePrivate->m_dumpRenderTree)
+        m_webPagePrivate->m_dumpRenderTree->didReceiveTitleForFrame(title.string(), m_frame);
+}
+
+void FrameLoaderClientBlackBerry::setTitle(const StringWithDirection& /*title*/, const KURL& /*url*/)
+{
+    // Used by Apple WebKit to update the title of an existing history item.
+    // QtWebKit doesn't accomodate this on history items. If it ever does,
+    // it should be privateBrowsing-aware. For now, we are just passing
+    // globalhistory layout tests.
+    // FIXME: Use direction of title.
+    notImplemented();
+}
+
+void FrameLoaderClientBlackBerry::dispatchDidCommitLoad()
+{
+    // FIXME: Do we need to find a replacement for m_frame->document()->setExtraLayoutDelay(250);?
+
+    if (isMainFrame()) {
+        m_webPagePrivate->setLoadState(WebPagePrivate::Committed);
+
+        String originalUrl = m_frame->loader()->documentLoader()->originalRequest().url().string();
+        String url = m_frame->loader()->documentLoader()->request().url().string();
+        String token = m_frame->loader()->documentLoader()->request().token();
+
+        // Notify the client that the load succeeded or failed (if it failed, this
+        // is actually committing the error page, which was set through
+        // SubstituteData in dispatchDidFailProvisionalLoad).
+        if (m_loadingErrorPage) {
+            m_loadingErrorPage = false;
+            m_webPagePrivate->m_client->notifyLoadFailedBeforeCommit(
+                originalUrl.characters(), originalUrl.length(),
+                    url.characters(), url.length(), token.characters(), token.length());
+        } else {
+            m_webPagePrivate->m_client->notifyLoadCommitted(
+                originalUrl.characters(), originalUrl.length(),
+                    url.characters(), url.length(), token.characters(), token.length());
+        }
+    }
+
+    if (m_webPagePrivate->m_dumpRenderTree)
+        m_webPagePrivate->m_dumpRenderTree->didCommitLoadForFrame(m_frame);
+}
+
+void FrameLoaderClientBlackBerry::dispatchDidHandleOnloadEvents()
+{
+    m_webPagePrivate->m_client->notifyDocumentOnLoad();
+    if (m_webPagePrivate->m_dumpRenderTree)
+        m_webPagePrivate->m_dumpRenderTree->didHandleOnloadEventsForFrame(m_frame);
+}
+
+void FrameLoaderClientBlackBerry::dispatchDidFinishLoad()
+{
+    didFinishOrFailLoading(ResourceError());
+
+    if (m_webPagePrivate->m_dumpRenderTree)
+        m_webPagePrivate->m_dumpRenderTree->didFinishLoadForFrame(m_frame);
+
+    if (!isMainFrame() || m_webPagePrivate->m_webSettings->isEmailMode()
+        || !m_frame->document() || !m_frame->document()->head())
+        return;
+
+    HTMLHeadElement* headElement = m_frame->document()->head();
+    // FIXME: Handle NOSCRIPT special case?
+
+    // Process document metadata.
+    RefPtr<NodeList> nodeList = headElement->getElementsByTagName(HTMLNames::metaTag.localName());
+    unsigned int size = nodeList->length();
+    ScopeArray<WebString> headers;
+
+    // This may allocate more space than needed since not all meta elements will be http-equiv.
+    headers.reset(new WebString[2 * size]);
+    unsigned headersLength = 0;
+
+    for (unsigned i = 0; i < size; ++i) {
+        HTMLMetaElement* metaElement = static_cast<HTMLMetaElement*>(nodeList->item(i));
+        if (WTF::equalIgnoringCase(metaElement->name(), "apple-mobile-web-app-capable")
+            && WTF::equalIgnoringCase(metaElement->content().stripWhiteSpace(), "yes"))
+            m_webPagePrivate->m_client->setWebAppCapable();
+        else {
+            String httpEquiv = metaElement->httpEquiv().stripWhiteSpace();
+            String content = metaElement->content().stripWhiteSpace();
+
+            if (!httpEquiv.isNull() && !content.isNull()) {
+                headers[headersLength++] = httpEquiv;
+                headers[headersLength++] = content;
+            }
+        }
+    }
+
+    if (headersLength > 0)
+        m_webPagePrivate->m_client->setMetaHeaders(headers, headersLength);
+
+    nodeList = headElement->getElementsByTagName(HTMLNames::linkTag.localName());
+    size = nodeList->length();
+
+    for (unsigned i = 0; i < size; ++i) {
+        HTMLLinkElement* linkElement = static_cast<HTMLLinkElement*>(nodeList->item(i));
+        String href = linkElement->href().string();
+        if (!href.isEmpty()) {
+            String title = linkElement->title();
+
+            if (WTF::equalIgnoringCase(linkElement->rel(), "apple-touch-icon"))
+                m_webPagePrivate->m_client->setLargeIcon(href.latin1().data());
+            else if (WTF::equalIgnoringCase(linkElement->rel(), "search")) {
+                if (WTF::equalIgnoringCase(linkElement->type(), "application/opensearchdescription+xml"))
+                    m_webPagePrivate->m_client->setSearchProviderDetails(title.utf8().data(), href.utf8().data());
+            } else if (WTF::equalIgnoringCase(linkElement->rel(), "alternate")
+                && (WTF::equalIgnoringCase(linkElement->type(), "application/rss+xml")
+                || WTF::equalIgnoringCase(linkElement->type(), "application/atom+xml")))
+                m_webPagePrivate->m_client->setAlternateFeedDetails(title.utf8().data(), href.utf8().data());
+        }
+    }
+}
+
+void FrameLoaderClientBlackBerry::dispatchDidFinishDocumentLoad()
+{
+    if (m_webPagePrivate->m_dumpRenderTree)
+        m_webPagePrivate->m_dumpRenderTree->didFinishDocumentLoadForFrame(m_frame);
+    notImplemented();
+}
+
+void FrameLoaderClientBlackBerry::dispatchDidFailLoad(const ResourceError& error)
+{
+    didFinishOrFailLoading(error);
+    if (m_webPagePrivate->m_dumpRenderTree)
+        m_webPagePrivate->m_dumpRenderTree->didFailLoadForFrame(m_frame);
+}
+
+void FrameLoaderClientBlackBerry::didFinishOrFailLoading(const ResourceError& error)
+{
+    // FIXME: Do we need to find a replacement for m_frame->document()->setExtraLayoutDelay(0);?
+
+    // If we have finished loading a page through history navigation, any
+    // attempt to go back to that page through an automatic redirect should be
+    // denied to avoid redirect loops. So save the history navigation urls to
+    // check later. (If this was not a history navigation,
+    // m_historyNavigationSourceURLs will be empty, and we should save that
+    // too.)
+    m_redirectURLsToSkipDueToHistoryNavigation.swap(m_historyNavigationSourceURLs);
+
+    // History navigation is finished so clear the history navigation url.
+    m_historyNavigationSourceURLs.clear();
+
+    if (isMainFrame()) {
+        m_loadError = error;
+        m_webPagePrivate->setLoadState(error.isNull() ? WebPagePrivate::Finished : WebPagePrivate::Failed);
+    }
+}
+
+void FrameLoaderClientBlackBerry::dispatchDidFailProvisionalLoad(const ResourceError& error)
+{
+    if (isMainFrame()) {
+        m_loadError = error;
+        m_webPagePrivate->setLoadState(WebPagePrivate::Failed);
+
+        if (error.domain() == ResourceError::platformErrorDomain
+                && (error.errorCode() == BlackBerry::Platform::FilterStream::StatusErrorAlreadyHandled)) {
+            // Error has already been displayed by client.
+            return;
+        }
+
+        if (error.domain().isEmpty() && !error.errorCode() && error.failingURL().isEmpty() && error.localizedDescription().isEmpty()) {
+            // Don't try to display empty errors returned from the unimplemented error functions in FrameLoaderClientBlackBerry - there's nothing to display anyway.
+            return;
+        }
+    }
+
+    if (m_webPagePrivate->m_dumpRenderTree)
+        m_webPagePrivate->m_dumpRenderTree->didFailProvisionalLoadForFrame(m_frame);
+
+    if (!isMainFrame())
+        return;
+
+    String errorPage = m_webPagePrivate->m_client->getErrorPage(error.errorCode()
+            , error.localizedDescription().isEmpty() ? "" : error.localizedDescription().utf8().data()
+            , error.failingURL().isEmpty() ? "" : error.failingURL().utf8().data());
+
+    // Make sure we're still in the provisionalLoad state - getErrorPage runs a
+    // nested event loop while it's waiting for client resources to load so
+    // there's a small window for the user to hit stop.
+    if (m_frame->loader()->provisionalDocumentLoader()) {
+        SubstituteData errorData(utf8Buffer(errorPage), "text/html", "utf-8", KURL(KURL(), error.failingURL()));
+
+        ResourceRequest originalRequest = m_frame->loader()->provisionalDocumentLoader()->originalRequest();
+
+        // Loading using SubstituteData will replace the original request with our
+        // error data. This must be done within dispatchDidFailProvisionalLoad,
+        // and do NOT call stopAllLoaders first, because the loader checks the
+        // provisionalDocumentLoader to decide the load type; if called any other
+        // way, the error page is added to the end of the history instead of
+        // replacing the failed load.
+        //
+        // If this comes from a back/forward navigation, we need to save the current viewstate
+        // to original historyitem, and prevent the restore of view state to the error page.
+        if (isBackForwardLoadType(m_frame->loader()->loadType())) {
+            m_frame->loader()->history()->saveScrollPositionAndViewStateToItem(m_frame->loader()->history()->currentItem());
+            ASSERT(m_frame->loader()->history()->provisionalItem());
+            m_frame->loader()->history()->provisionalItem()->viewState().shouldSaveViewState = false;
+        }
+        m_loadingErrorPage = true;
+        m_frame->loader()->load(originalRequest, errorData, false);
+    }
+}
+
+void FrameLoaderClientBlackBerry::dispatchWillSubmitForm(FramePolicyFunction function, PassRefPtr<FormState>)
+{
+    // FIXME: Stub.
+    (m_frame->loader()->policyChecker()->*function)(PolicyUse);
+}
+
+PassRefPtr<Frame> FrameLoaderClientBlackBerry::createFrame(const KURL& url, const String& name
+    , HTMLFrameOwnerElement* ownerElement, const String& referrer, bool allowsScrolling, int marginWidth, int marginHeight)
+{
+    if (!m_webPagePrivate)
+        return 0;
+
+    if (m_childFrameCreationSuppressed)
+        return 0;
+
+    FrameLoaderClientBlackBerry* frameLoaderClient = new FrameLoaderClientBlackBerry();
+    RefPtr<Frame> childFrame = Frame::create(m_frame->page(), ownerElement, frameLoaderClient);
+    frameLoaderClient->setFrame(childFrame.get(), m_webPagePrivate);
+
+    // Initialize FrameView.
+    RefPtr<FrameView> frameView = FrameView::create(childFrame.get());
+    childFrame->setView(frameView.get());
+    if (!allowsScrolling)
+        frameView->setScrollbarModes(ScrollbarAlwaysOff, ScrollbarAlwaysOff);
+    if (marginWidth != -1)
+        frameView->setMarginWidth(marginWidth);
+    if (marginHeight != -1)
+        frameView->setMarginHeight(marginHeight);
+
+    childFrame->tree()->setName(name);
+    m_frame->tree()->appendChild(childFrame);
+    childFrame->init();
+
+    if (!childFrame->tree()->parent())
+        return 0;
+
+    BackingStoreClient::create(childFrame.get(), m_frame, m_webPagePrivate->m_webPage);
+
+    m_frame->loader()->loadURLIntoChildFrame(url, referrer, childFrame.get());
+
+    if (!childFrame->tree()->parent())
+        return 0;
+
+    return childFrame.release();
+}
+
+void FrameLoaderClientBlackBerry::didTransferChildFrameToNewDocument(Page* /*oldPage*/)
+{
+    Page* newPage = m_frame->page();
+    m_webPagePrivate = static_cast<ChromeClientBlackBerry*>(newPage->chrome()->client())->webPagePrivate();
+}
+
+void FrameLoaderClientBlackBerry::transferLoadingResourceFromPage(ResourceLoader*, const ResourceRequest&, Page*)
+{
+    notImplemented();
+}
+
+ObjectContentType FrameLoaderClientBlackBerry::objectContentType(const KURL& url, const String& mimeTypeIn, bool shouldPreferPlugInsForImages)
+{
+    String mimeType = mimeTypeIn;
+    if (mimeType.isEmpty())
+        mimeType = MIMETypeRegistry::getMIMETypeForPath(url.path());
+
+    // Get mapped type.
+    mimeType = WebSettings::getNormalizedMIMEType(mimeType);
+
+    ObjectContentType defaultType = FrameLoader::defaultObjectContentType(url, mimeType, shouldPreferPlugInsForImages);
+    if (defaultType != ObjectContentNone)
+        return defaultType;
+
+    if (WebSettings::isSupportedObjectMIMEType(mimeType))
+        return ObjectContentOtherPlugin;
+
+    return ObjectContentNone;
+}
+
+void FrameLoaderClientBlackBerry::dispatchWillClose()
+{
+    m_webPagePrivate->m_inputHandler->frameUnloaded(m_frame);
+}
+
+void FrameLoaderClientBlackBerry::setMainDocumentError(DocumentLoader*, const ResourceError& error)
+{
+    if (!m_pluginView)
+        return;
+
+    m_pluginView->didFail(error);
+    m_pluginView = 0;
+    m_hasSentResponseToPlugin = false;
+}
+
+void FrameLoaderClientBlackBerry::postProgressStartedNotification()
+{
+    if (!isMainFrame())
+        return;
+
+    // New load started, so clear the error.
+    m_loadError = ResourceError();
+    m_sentReadyToRender = false;
+    m_webPagePrivate->m_client->notifyLoadStarted();
+}
+
+void FrameLoaderClientBlackBerry::postProgressEstimateChangedNotification()
+{
+    if (!isMainFrame() || !m_frame->page())
+        return;
+
+    m_webPagePrivate->m_client->notifyLoadProgress(m_frame->page()->progress()->estimatedProgress() * 100);
+}
+
+void FrameLoaderClientBlackBerry::dispatchDidFirstVisuallyNonEmptyLayout()
+{
+    if (!isMainFrame())
+        return;
+
+    BlackBerry::Platform::log(BlackBerry::Platform::LogLevelInfo, "dispatchDidFirstVisuallyNonEmptyLayout");
+
+    readyToRender(true);
+
+    // FIXME: We shouldn't be getting here if we are not in the Committed state but we are
+    // so we can not assert on that right now. But we only want to do this on load.
+    // RIM Bug #555
+    if (m_webPagePrivate->loadState() == WebPagePrivate::Committed) {
+        m_webPagePrivate->zoomToInitialScaleOnLoad(); // Set the proper zoom level first.
+        m_webPagePrivate->m_backingStore->d->clearVisibleZoom(); // Clear the visible zoom since we're explicitly rendering+blitting below.
+        m_webPagePrivate->m_backingStore->d->renderVisibleContents();
+    }
+
+    m_webPagePrivate->m_client->notifyFirstVisuallyNonEmptyLayout();
+}
+
+void FrameLoaderClientBlackBerry::postProgressFinishedNotification()
+{
+    if (!isMainFrame())
+        return;
+
+    // Empty pages will never have called
+    // dispatchDidFirstVisuallyNonEmptyLayout, since they're visually empty, so
+    // we may need to call readyToRender now.
+    readyToRender(false);
+
+    // FIXME: Send up a real status code.
+    m_webPagePrivate->m_client->notifyLoadFinished(m_loadError.isNull() ? 0 : -1);
+
+    // Notify plugins that are waiting for the page to fully load before starting that
+    // the load has completed.
+    m_webPagePrivate->notifyPageOnLoad();
+}
+
+void FrameLoaderClientBlackBerry::dispatchDidClearWindowObjectInWorld(DOMWrapperWorld* world)
+{
+    if (world != mainThreadNormalWorld())
+        return;
+
+    // Provide the extension object first in case the client or others want to use it.
+    // FIXME: Conditionally attach extension object based on some flag or whether or not we
+    // are browser or something else.
+    attachExtensionObjectToFrame(m_frame, m_webPagePrivate->m_client);
+
+    m_webPagePrivate->m_client->notifyWindowObjectCleared();
+
+    if (m_webPagePrivate->m_dumpRenderTree) {
+        JSGlobalContextRef context = toGlobalRef(m_frame->script()->globalObject(mainThreadNormalWorld())->globalExec());
+        JSObjectRef windowObject = toRef(m_frame->script()->globalObject(mainThreadNormalWorld()));
+        ASSERT(windowObject);
+        m_webPagePrivate->m_dumpRenderTree->didClearWindowObjectInWorld(world, context, windowObject);
+    }
+}
+
+bool FrameLoaderClientBlackBerry::shouldGoToHistoryItem(HistoryItem*) const
+{
+    return true;
+}
+
+bool FrameLoaderClientBlackBerry::shouldStopLoadingForHistoryItem(HistoryItem*) const
+{
+    return true;
+}
+
+void FrameLoaderClientBlackBerry::invalidateBackForwardList() const
+{
+    notifyBackForwardListChanged();
+}
+
+void FrameLoaderClientBlackBerry::notifyBackForwardListChanged() const
+{
+    BackForwardListImpl* backForwardList = static_cast<BackForwardListImpl*>(m_webPagePrivate->m_page->backForward()->client());
+    ASSERT(backForwardList);
+
+    unsigned listSize = backForwardList->entries().size();
+    unsigned currentIndex = backForwardList->backListCount();
+    m_webPagePrivate->m_client->resetBackForwardList(listSize, currentIndex);
+}
+
+Frame* FrameLoaderClientBlackBerry::dispatchCreatePage(const NavigationAction& navigation)
+{
+    WebPage* webPage = m_webPagePrivate->m_client->createWindow(0, 0, -1, -1, WebPageClient::FlagWindowDefault, navigation.url().string(), WebString());
+    if (!webPage)
+        return 0;
+
+    return webPage->d->m_page->mainFrame();
+}
+
+void FrameLoaderClientBlackBerry::detachedFromParent2()
+{
+    BackingStoreClient* backingStoreClientForFrame = m_webPagePrivate->backingStoreClientForFrame(m_frame);
+    if (backingStoreClientForFrame) {
+        delete backingStoreClientForFrame;
+        backingStoreClientForFrame = 0;
+    }
+
+    if (m_frame->document())
+        m_webPagePrivate->clearDocumentData(m_frame->document());
+
+    m_webPagePrivate->m_inputHandler->frameUnloaded(m_frame);
+    m_webPagePrivate->m_client->notifyFrameDetached(m_frame);
+}
+
+void FrameLoaderClientBlackBerry::dispatchWillSendRequest(DocumentLoader* docLoader, long unsigned int, ResourceRequest& request, const ResourceResponse&)
+{
+    // If the request is being loaded by the provisional document loader, then
+    // it is a new top level request which has not been commited.
+    bool isMainResourceLoad = docLoader && docLoader == docLoader->frameLoader()->provisionalDocumentLoader();
+
+    // Any processing which is done for all loads (both main and subresource) should go here.
+    BlackBerry::Platform::NetworkRequest platformRequest;
+    request.initializePlatformRequest(platformRequest, false /*isInitial*/);
+    m_webPagePrivate->m_client->populateCustomHeaders(platformRequest);
+    const BlackBerry::Platform::NetworkRequest::HeaderList& headerLists = platformRequest.getHeaderListRef();
+    for (BlackBerry::Platform::NetworkRequest::HeaderList::const_iterator it = headerLists.begin(); it != headerLists.end(); ++it) {
+        std::string headerString = it->first;
+        std::string headerValueString = it->second;
+        request.setHTTPHeaderField(String(headerString.c_str()), String(headerValueString.c_str()));
+    }
+    if (cookiesEnabled()) {
+        String cookiePairs = cookieManager().getCookie(request.url(), WithHttpOnlyCookies);
+        if (!cookiePairs.isEmpty()) {
+            // We only modify the WebCore request to make the cookies visible in inspector.
+            request.setHTTPHeaderField(String("Cookie"), cookiePairs);
+        }
+    }
+    if (!isMainResourceLoad) {
+        // Do nothing for now.
+        // Any processing which is done only for subresources should go here.
+        return;
+    }
+
+    // All processing beyond this point is done only for main resource loads.
+
+    if (m_clientRedirectIsPending && isMainFrame()) {
+        String originalUrl = m_frame->document()->url().string();
+        String finalUrl = request.url().string();
+
+        m_webPagePrivate->m_client->notifyClientRedirect(originalUrl.characters(), originalUrl.length(),
+            finalUrl.characters(), finalUrl.length());
+    }
+
+    // FIXME: Update the request type. See PR #119792.
+    if (docLoader->frameLoader()->isLoadingMainFrame())
+        request.setTargetType(ResourceRequest::TargetIsMainFrame);
+    else
+        request.setTargetType(ResourceRequest::TargetIsSubframe);
+
+    FrameLoader* loader = m_frame->loader();
+    ASSERT(loader);
+    if (isBackForwardLoadType(loader->loadType())) {
+        // Do not use the passed DocumentLoader because it is the loader that
+        // will be used for the new request (the DESTINATION of the history
+        // navigation - we want to use the current DocumentLoader to record the
+        // SOURCE).
+        DocumentLoader* docLoader = m_frame->loader()->documentLoader();
+        ASSERT(docLoader);
+        m_historyNavigationSourceURLs.add(docLoader->url());
+        m_historyNavigationSourceURLs.add(docLoader->originalURL());
+    }
+}
+
+void FrameLoaderClientBlackBerry::loadIconExternally(const String& originalPageUrl, const String& finalPageUrl, const String& iconUrl)
+{
+    m_webPagePrivate->m_client->setIconForUrl(originalPageUrl.utf8().data(), finalPageUrl.utf8().data(), iconUrl.utf8().data());
+}
+
+void FrameLoaderClientBlackBerry::saveViewStateToItem(HistoryItem* item)
+{
+    if (!isMainFrame())
+        return;
+
+    ASSERT(item);
+    HistoryItemViewState& viewState = item->viewState();
+    if (viewState.shouldSaveViewState) {
+        viewState.orientation = m_webPagePrivate->mainFrame()->orientation();
+        viewState.isZoomToFitScale = m_webPagePrivate->currentScale() == m_webPagePrivate->zoomToFitScale();
+        viewState.scale = m_webPagePrivate->currentScale();
+        viewState.shouldReflowBlock = m_webPagePrivate->m_shouldReflowBlock;
+    }
+}
+
+void FrameLoaderClientBlackBerry::restoreViewState()
+{
+    if (!isMainFrame())
+        return;
+
+    HistoryItem* currentItem = m_frame->loader()->history()->currentItem();
+    ASSERT(currentItem);
+
+    if (!currentItem)
+        return;
+
+    // WebPagePrivate is messing up FrameView::wasScrolledByUser() by sending
+    // scroll events that look like they were user generated all the time.
+    //
+    // Even if the user did not scroll, FrameView is gonna think they did.
+    // So we use our own bookkeeping code to keep track of whether we were
+    // actually scrolled by the user during load.
+    //
+    // If the user did scroll though, all are going to be in agreement about
+    // that, and the worst thing that could happen is that
+    // HistoryController::restoreScrollPositionAndViewState calls
+    // setScrollPosition with the the same point, which is a NOOP.
+    IntSize contentsSize = currentItem->contentsSize();
+    IntPoint scrollPosition = currentItem->scrollPoint();
+    if (m_webPagePrivate->m_userPerformedManualScroll)
+        scrollPosition = m_webPagePrivate->scrollPosition();
+
+    // We need to reset this variable after the view state has been restored.
+    m_webPagePrivate->m_didRestoreFromPageCache = false;
+    HistoryItemViewState& viewState = currentItem->viewState();
+
+    // Also, try to keep the users zoom if any.
+    double scale = viewState.scale;
+    bool shouldReflowBlock = viewState.shouldReflowBlock;
+    if (m_webPagePrivate->m_userPerformedManualZoom) {
+        scale = m_webPagePrivate->currentScale();
+        shouldReflowBlock = m_webPagePrivate->m_shouldReflowBlock;
+    }
+
+    bool scrollChanged = scrollPosition != m_webPagePrivate->scrollPosition();
+    bool scaleChanged = scale != m_webPagePrivate->currentScale();
+    bool reflowChanged = shouldReflowBlock != m_webPagePrivate->m_shouldReflowBlock;
+    bool orientationChanged = viewState.orientation % 180 != m_webPagePrivate->mainFrame()->orientation() % 180;
+
+    if (!scrollChanged && !scaleChanged && !reflowChanged && !orientationChanged)
+        return;
+
+    // When rotate happens, only zoom when previous page was zoomToFitScale, otherwise keep old scale.
+    if (orientationChanged && viewState.isZoomToFitScale)
+        scale = BlackBerry::Platform::Graphics::Screen::width() * scale / static_cast<double>(BlackBerry::Platform::Graphics::Screen::height());
+    m_webPagePrivate->m_backingStore->d->suspendScreenAndBackingStoreUpdates(); // don't flash checkerboard for the setScrollPosition call
+    m_frame->view()->setContentsSizeFromHistory(contentsSize);
+
+    // Here we need to set scroll position what we asked for.
+    // So we use ScrollView::setCanOverscroll(true).
+    bool oldCanOverscroll = m_frame->view()->canOverScroll();
+    m_frame->view()->setCanOverscroll(true);
+    m_webPagePrivate->setScrollPosition(scrollPosition);
+    m_frame->view()->setCanOverscroll(oldCanOverscroll);
+
+    m_webPagePrivate->m_shouldReflowBlock = viewState.shouldReflowBlock;
+
+    // Will restore updates to backingstore guaranteed!
+    if (!m_webPagePrivate->zoomAboutPoint(scale, m_frame->view()->scrollPosition(), true /* enforceScaleClamping */, true /*forceRendering*/, true /*isRestoringZoomLevel*/)) {
+        // If we're already at that scale, then we should still force rendering since
+        // our scroll position changed.
+        m_webPagePrivate->m_backingStore->d->renderVisibleContents();
+
+        // We need to notify the client of the scroll position and content size change(s) above even if we didn't scale.
+        m_webPagePrivate->notifyTransformedContentsSizeChanged();
+        m_webPagePrivate->notifyTransformedScrollChanged();
+    }
+}
+
+PolicyAction FrameLoaderClientBlackBerry::decidePolicyForExternalLoad(const ResourceRequest& request, bool isFragmentScroll)
+{
+    const KURL& url = request.url();
+    String pattern = m_webPagePrivate->findPatternStringForUrl(url);
+    if (!pattern.isEmpty()) {
+        m_webPagePrivate->m_client->handleStringPattern(pattern.characters(), pattern.length());
+        return PolicyIgnore;
+    }
+
+    if (m_webPagePrivate->m_webSettings->areLinksHandledExternally()
+            && isMainFrame()
+            && !request.mustHandleInternally()
+            && !isFragmentScroll) {
+        BlackBerry::Platform::NetworkRequest platformRequest;
+        request.initializePlatformRequest(platformRequest);
+        m_webPagePrivate->m_client->handleExternalLink(platformRequest, request.anchorText().characters(), request.anchorText().length(), m_clientRedirectIsPending);
+        return PolicyIgnore;
+    }
+
+    return PolicyUse;
+}
+
+void FrameLoaderClientBlackBerry::willDeferLoading()
+{
+    m_deferredJobsTimer->stop();
+
+    if (!isMainFrame())
+        return;
+
+    m_webPagePrivate->willDeferLoading();
+}
+
+void FrameLoaderClientBlackBerry::didResumeLoading()
+{
+    if (!m_deferredManualScript.isNull())
+        m_deferredJobsTimer->startOneShot(0);
+
+    if (!isMainFrame())
+        return;
+
+    m_webPagePrivate->didResumeLoading();
+}
+
+void FrameLoaderClientBlackBerry::setDeferredManualScript(const KURL& script)
+{
+    ASSERT(!m_deferredJobsTimer->isActive());
+    m_deferredManualScript = script;
+}
+
+void FrameLoaderClientBlackBerry::deferredJobsTimerFired(Timer<FrameLoaderClientBlackBerry>*)
+{
+    ASSERT(!m_frame->page()->defersLoading());
+
+    if (!m_deferredManualScript.isNull()) {
+        // Executing the script will set deferred loading, which could trigger this timer again if a script is set. So clear the script first.
+        KURL script = m_deferredManualScript;
+        m_deferredManualScript = KURL();
+
+        m_frame->script()->executeIfJavaScriptURL(script);
+    }
+
+    ASSERT(!m_frame->page()->defersLoading());
+}
+
+void FrameLoaderClientBlackBerry::readyToRender(bool pageIsVisuallyNonEmpty)
+{
+    // Only send the notification once.
+    if (!m_sentReadyToRender) {
+        m_webPagePrivate->m_client->notifyLoadReadyToRender(pageIsVisuallyNonEmpty);
+        m_sentReadyToRender = true;
+    }
+}
+
+PassRefPtr<FrameNetworkingContext> FrameLoaderClientBlackBerry::createNetworkingContext()
+{
+    return FrameNetworkingContextBlackBerry::create(m_frame);
+}
+
+void FrameLoaderClientBlackBerry::authenticationChallenge(const String& realm, String& username, String& password)
+{
+    WebString webPageUsername;
+    WebString webPagePassword;
+
+    m_webPagePrivate->m_client->authenticationChallenge(realm.characters(), realm.length(), webPageUsername, webPagePassword);
+
+    username = webPageUsername;
+    password = webPagePassword;
+}
+
+void FrameLoaderClientBlackBerry::startDownload(const ResourceRequest& request, const String& /*suggestedName*/)
+{
+    // FIXME: use the suggestedName?
+    m_webPagePrivate->load(request.url().string().utf8().data(), 0, "GET", BlackBerry::Platform::NetworkRequest::UseProtocolCachePolicy, 0, 0, 0, 0, false, false, true, "");
+}
+
+void FrameLoaderClientBlackBerry::download(ResourceHandle* handle, const ResourceRequest&, const ResourceRequest&, const ResourceResponse& r)
+{
+    BlackBerry::Platform::FilterStream* stream = NetworkManager::instance()->streamForHandle(handle);
+    ASSERT(stream);
+
+    m_webPagePrivate->m_client->downloadRequested(stream, r.suggestedFilename());
+}
+
+void FrameLoaderClientBlackBerry::dispatchDidReceiveIcon()
+{
+    String url = m_frame->document()->url().string();
+    Image* img = iconDatabase().synchronousIconForPageURL(url, IntSize(10, 10));
+    if (!img || !img->data())
+        return;
+
+    NativeImageSkia* bitmap = img->nativeImageForCurrentFrame();
+    if (!bitmap)
+        return;
+    bitmap->lockPixels();
+    String iconUrl = iconDatabase().synchronousIconURLForPageURL(url);
+    m_webPagePrivate->m_client->setFavicon(img->width(), img->height(), (unsigned char*)bitmap->getPixels(), iconUrl.utf8().data());
+    bitmap->unlockPixels();
+}
+
+bool FrameLoaderClientBlackBerry::canCachePage() const
+{
+    // We won't cache pages containing video or audio.
+    ASSERT(m_frame->document());
+    RefPtr<NodeList> nodeList = m_frame->document()->getElementsByTagName(HTMLNames::videoTag.localName());
+    if (nodeList.get()->length() > 0)
+        return false;
+    nodeList = m_frame->document()->getElementsByTagName(HTMLNames::audioTag.localName());
+    if (nodeList.get()->length() > 0)
+        return false;
+
+    // The multipart of "multipart/x-mixed-replace" only supports image, correct?
+    // FIXME: Do we have a better place to handle this case?
+    nodeList = m_frame->document()->getElementsByTagName(HTMLNames::imgTag.localName());
+    for (unsigned i = 0; i < nodeList.get()->length(); ++i) {
+        HTMLImageElement* node = static_cast<HTMLImageElement*>(nodeList.get()->item(i));
+        CachedImage* cachedimage = node ? node->cachedImage() : 0;
+        if (cachedimage && cachedimage->response().isMultipartPayload())
+            return false;
+    }
+    return true;
+}
+
+void FrameLoaderClientBlackBerry::didSaveToPageCache()
+{
+    // When page goes into PageCache, clean up any possible
+    // document data cache we might have.
+    m_webPagePrivate->clearDocumentData(m_frame->document());
+}
+
+void FrameLoaderClientBlackBerry::provisionalLoadStarted()
+{
+    // We would like to hide the virtual keyboard before it navigates to another page
+    // so that the scroll offset without keyboard shown will be saved in the history item.
+    // Then when the user navigates back, it will scroll to the right position.
+    if (isMainFrame())
+        m_webPagePrivate->showVirtualKeyboard(false);
+}
+
+// We don't need to provide the error message string, that will be handled in BrowserErrorPage according to the error code.
+ResourceError FrameLoaderClientBlackBerry::cannotShowURLError(const ResourceRequest& request)
+{
+    // FIXME: Why are we not passing the domain to the ResourceError? See PR #119789.
+    return ResourceError(String(), WebKitErrorCannotShowURL, request.url().string(), String());
+}
+
+void FrameLoaderClientBlackBerry::didRestoreFromPageCache()
+{
+    m_webPagePrivate->m_didRestoreFromPageCache = true;
+}
+
+void FrameLoaderClientBlackBerry::dispatchWillUpdateApplicationCache(const ResourceRequest&)
+{
+    ASSERT(isMainFrame());
+    if (!isMainFrame())
+        return;
+
+    m_webPagePrivate->m_client->notifyWillUpdateApplicationCache();
+}
+
+void FrameLoaderClientBlackBerry::dispatchDidLoadFromApplicationCache(const ResourceRequest&)
+{
+    ASSERT(isMainFrame());
+    if (!isMainFrame())
+        return;
+
+    m_webPagePrivate->m_client->notifyDidLoadFromApplicationCache();
+}
+
+} // WebCore
diff --git a/Source/WebKit/blackberry/WebCoreSupport/FrameLoaderClientBlackBerry.h b/Source/WebKit/blackberry/WebCoreSupport/FrameLoaderClientBlackBerry.h
new file mode 100644
index 000000000..2983d01ee
--- /dev/null
+++ b/Source/WebKit/blackberry/WebCoreSupport/FrameLoaderClientBlackBerry.h
@@ -0,0 +1,235 @@
+/*
+ * Copyright (C) 2009, 2010, 2011, 2012 Research In Motion Limited. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+#ifndef FrameLoaderClientBlackBerry_h
+#define FrameLoaderClientBlackBerry_h
+
+#include "DocumentLoader.h"
+#include "Frame.h"
+#include "FrameLoaderClient.h"
+#include "NotImplemented.h"
+#include "Widget.h"
+
+namespace BlackBerry {
+namespace WebKit {
+class WebPagePrivate;
+}
+}
+
+namespace WebCore {
+
+class FrameNetworkingContext;
+class Geolocation;
+
+class FrameLoaderClientBlackBerry : public FrameLoaderClient {
+public:
+    FrameLoaderClientBlackBerry();
+    ~FrameLoaderClientBlackBerry();
+
+    void setFrame(Frame* frame, BlackBerry::WebKit::WebPagePrivate* webPagePrivate) { m_frame = frame; m_webPagePrivate = webPagePrivate; }
+
+    int playerId() const;
+    bool cookiesEnabled() const;
+
+    virtual void frameLoaderDestroyed();
+    virtual bool hasWebView() const { return true; }
+    virtual void makeRepresentation(DocumentLoader*) { notImplemented(); }
+    virtual void forceLayout() { notImplemented(); }
+    virtual void forceLayoutForNonHTML() { notImplemented(); }
+    virtual void setCopiesOnScroll() { notImplemented(); }
+    virtual void detachedFromParent2();
+    virtual void detachedFromParent3() { notImplemented(); }
+    virtual void assignIdentifierToInitialRequest(long unsigned int, DocumentLoader*, const ResourceRequest&) { notImplemented(); }
+    virtual void dispatchWillSendRequest(DocumentLoader*, long unsigned int, ResourceRequest&, const ResourceResponse&);
+    virtual bool shouldUseCredentialStorage(DocumentLoader*, long unsigned int) { notImplemented(); return false; }
+    virtual void dispatchDidReceiveAuthenticationChallenge(DocumentLoader*, long unsigned int, const AuthenticationChallenge&) { notImplemented(); }
+    virtual void dispatchDidCancelAuthenticationChallenge(DocumentLoader*, long unsigned int, const AuthenticationChallenge&) { notImplemented(); }
+    virtual void dispatchDidReceiveResponse(DocumentLoader*, long unsigned int, const ResourceResponse&);
+    virtual void dispatchDidReceiveContentLength(DocumentLoader*, long unsigned int, int) { notImplemented(); }
+    virtual void dispatchDidFinishLoading(DocumentLoader*, long unsigned int) { notImplemented(); }
+    virtual void dispatchDidFailLoading(DocumentLoader*, long unsigned int, const ResourceError&) { notImplemented(); }
+    virtual bool dispatchDidLoadResourceFromMemoryCache(DocumentLoader*, const ResourceRequest&, const ResourceResponse&, int) { notImplemented(); return false; }
+    virtual void dispatchDidHandleOnloadEvents();
+    virtual void dispatchDidReceiveServerRedirectForProvisionalLoad() { notImplemented(); }
+    virtual void dispatchDidCancelClientRedirect();
+    virtual void dispatchWillPerformClientRedirect(const KURL&, double, double);
+    virtual void dispatchDidChangeLocationWithinPage();
+    virtual void dispatchDidPushStateWithinPage();
+    virtual void dispatchDidReplaceStateWithinPage();
+    virtual void dispatchDidPopStateWithinPage();
+    virtual void dispatchWillClose();
+    virtual void dispatchDidReceiveIcon();
+    virtual void dispatchDidStartProvisionalLoad();
+    virtual void dispatchDidReceiveTitle(const StringWithDirection&);
+    virtual void setTitle(const StringWithDirection& title, const KURL&);
+    virtual void dispatchDidCommitLoad();
+    virtual void dispatchDidFailProvisionalLoad(const ResourceError&);
+    virtual void dispatchDidFailLoad(const ResourceError&);
+    virtual void dispatchDidFinishDocumentLoad();
+    virtual void dispatchDidFinishLoad();
+    virtual void dispatchDidFirstLayout() { notImplemented(); }
+    virtual void dispatchDidFirstVisuallyNonEmptyLayout();
+    virtual Frame* dispatchCreatePage(const NavigationAction&);
+    virtual void dispatchShow() { notImplemented(); }
+
+    virtual void dispatchDecidePolicyForResponse(FramePolicyFunction, const ResourceResponse&, const ResourceRequest&);
+    virtual void dispatchDecidePolicyForNewWindowAction(FramePolicyFunction, const NavigationAction&, const ResourceRequest&, PassRefPtr<FormState>, const String& frameName);
+    virtual void dispatchDecidePolicyForNavigationAction(FramePolicyFunction, const NavigationAction&, const ResourceRequest&, PassRefPtr<FormState>);
+    virtual void cancelPolicyCheck();
+    virtual void dispatchUnableToImplementPolicy(const ResourceError&) { notImplemented(); }
+    virtual void dispatchWillSubmitForm(FramePolicyFunction, PassRefPtr<FormState>);
+    virtual void dispatchDidLoadMainResource(DocumentLoader*) { notImplemented(); }
+    virtual void revertToProvisionalState(DocumentLoader*) { notImplemented(); }
+    virtual void setMainDocumentError(DocumentLoader*, const ResourceError&);
+    virtual void postProgressStartedNotification();
+    virtual void postProgressEstimateChangedNotification();
+    virtual void postProgressFinishedNotification();
+    virtual void setMainFrameDocumentReady(bool) { notImplemented(); }
+    virtual void startDownload(const ResourceRequest&, const String& suggestedName = String());
+    virtual void willChangeTitle(DocumentLoader*) { notImplemented(); }
+    virtual void didChangeTitle(DocumentLoader*) { notImplemented(); }
+    virtual void committedLoad(DocumentLoader*, const char*, int);
+    virtual void finishedLoading(DocumentLoader*);
+    virtual void updateGlobalHistory() { notImplemented(); }
+    virtual void updateGlobalHistoryRedirectLinks() { notImplemented(); }
+    virtual bool shouldGoToHistoryItem(HistoryItem*) const;
+    virtual bool shouldStopLoadingForHistoryItem(HistoryItem*) const;
+    virtual void dispatchDidAddBackForwardItem(HistoryItem*) const;
+    virtual void dispatchDidRemoveBackForwardItem(HistoryItem*) const;
+    virtual void dispatchDidChangeBackForwardIndex() const;
+    virtual void dispatchWillUpdateApplicationCache(const ResourceRequest&);
+    virtual void dispatchDidLoadFromApplicationCache(const ResourceRequest&);
+    virtual void didDisplayInsecureContent() { notImplemented(); }
+    virtual void didRunInsecureContent(SecurityOrigin*, const KURL&) { notImplemented(); }
+    virtual ResourceError interruptedForPolicyChangeError(const ResourceRequest&) { notImplemented(); return ResourceError(emptyString(), 0, emptyString(), emptyString()); }
+    virtual ResourceError cancelledError(const ResourceRequest&) { notImplemented(); return ResourceError(emptyString(), 0, emptyString(), emptyString()); }
+    virtual ResourceError blockedError(const ResourceRequest&) { notImplemented(); return ResourceError(emptyString(), 0, emptyString(), emptyString()); }
+    virtual ResourceError cannotShowURLError(const ResourceRequest&);
+    virtual ResourceError interruptForPolicyChangeError(const ResourceRequest&) { notImplemented(); return ResourceError(emptyString(), 0, emptyString(), emptyString()); }
+    virtual ResourceError cannotShowMIMETypeError(const ResourceResponse&) { notImplemented(); return ResourceError(emptyString(), 0, emptyString(), emptyString()); }
+    virtual ResourceError fileDoesNotExistError(const ResourceResponse&) { notImplemented(); return ResourceError(emptyString(), 0, emptyString(), emptyString()); }
+    virtual ResourceError pluginWillHandleLoadError(const ResourceResponse&) { notImplemented(); return ResourceError(emptyString(), 0, emptyString(), emptyString()); }
+    virtual bool shouldFallBack(const ResourceError&) { notImplemented(); return false; }
+    virtual bool canHandleRequest(const ResourceRequest&) const;
+    virtual bool canShowMIMEType(const String&) const;
+    virtual bool canShowMIMETypeAsHTML(const String&) const;
+    virtual bool representationExistsForURLScheme(const String&) const { notImplemented(); return false; }
+    virtual String generatedMIMETypeForURLScheme(const String&) const { notImplemented(); return String(); }
+    virtual void frameLoadCompleted() { notImplemented(); }
+    virtual void saveViewStateToItem(HistoryItem*);
+    virtual void restoreViewState();
+    virtual void provisionalLoadStarted();
+    virtual void didFinishLoad() { notImplemented(); }
+    virtual void prepareForDataSourceReplacement() { notImplemented(); }
+    virtual PassRefPtr<DocumentLoader> createDocumentLoader(const ResourceRequest&, const SubstituteData&);
+    virtual void setTitle(const String&, const KURL&) { notImplemented(); }
+    virtual String userAgent(const KURL&);
+    virtual void savePlatformDataToCachedFrame(CachedFrame*) { notImplemented(); }
+    virtual void transitionToCommittedFromCachedFrame(CachedFrame*) { notImplemented(); }
+    virtual void transitionToCommittedForNewPage();
+    virtual bool canCachePage() const;
+    virtual void didSaveToPageCache();
+    virtual void didRestoreFromPageCache();
+    virtual void dispatchDidBecomeFrameset(bool) { }
+    virtual void download(ResourceHandle*, const ResourceRequest&, const ResourceRequest&, const ResourceResponse&);
+    virtual PassRefPtr<Frame> createFrame(const KURL&, const String&, HTMLFrameOwnerElement*, const String&, bool, int, int);
+    virtual void didTransferChildFrameToNewDocument(Page*);
+    virtual PassRefPtr<Widget> createPlugin(const IntSize&, HTMLPlugInElement*, const KURL&, const Vector<String>&, const Vector<String>&, const String&, bool);
+    virtual void redirectDataToPlugin(Widget*);
+    virtual PassRefPtr<Widget> createJavaAppletWidget(const IntSize&, HTMLAppletElement*, const KURL&, const Vector<String>&, const Vector<String>&) { notImplemented(); return 0; }
+
+    virtual ObjectContentType objectContentType(const KURL&, const String& mimeType, bool shouldPreferPlugInsForImages);
+    virtual String overrideMediaType() const { notImplemented(); return String(); }
+    virtual void dispatchDidClearWindowObjectInWorld(DOMWrapperWorld*);
+    virtual void documentElementAvailable() { notImplemented(); }
+    virtual void didPerformFirstNavigation() const { notImplemented(); }
+    virtual void registerForIconNotification(bool) { notImplemented(); }
+
+    virtual bool shouldLoadIconExternally() { return false; }
+    virtual void loadIconExternally(const String& originalPageUrl, const String& finalPageUrl, const String& iconUrl);
+
+    virtual void didDetectXSS(const KURL&, bool) { }
+    virtual void transferLoadingResourceFromPage(ResourceLoader*, const ResourceRequest&, Page*);
+    virtual void didTransferChildFrameToNewDocument() { notImplemented(); };
+    virtual void dispatchDidChangeIcons(IconType) { notImplemented(); };
+    virtual void dispatchWillSendSubmitEvent(HTMLFormElement*) { notImplemented(); };
+
+    virtual void willDeferLoading();
+    virtual void didResumeLoading();
+    virtual void authenticationChallenge(const String& realm, String& username, String& password);
+
+    virtual PassRefPtr<FrameNetworkingContext> createNetworkingContext();
+
+     // Schedule a script that was loaded manually by the user (eg. a
+     // bookmarklet) while page loading was deferred.
+    void setDeferredManualScript(const KURL&);
+
+    void readyToRender(bool pageIsVisuallyNonEmpty);
+
+    void doPendingFragmentScroll();
+
+    // Used to stop media files from loading because we don't need to have the entire file loaded by WebKit.
+    void setCancelLoadOnNextData() { m_cancelLoadOnNextData = true; }
+    bool shouldCancelLoadOnNextData() const { return m_cancelLoadOnNextData; }
+
+    void suppressChildFrameCreation() { m_childFrameCreationSuppressed = true; }
+
+private:
+    void receivedData(const char*, int, const String&);
+    void didFinishOrFailLoading(const ResourceError&);
+    bool isMainFrame() const;
+
+    void invalidateBackForwardList() const;
+    void notifyBackForwardListChanged() const;
+
+    PolicyAction decidePolicyForExternalLoad(const ResourceRequest &, bool isFragmentScroll);
+    void delayPolicyCheckUntilFragmentExists(const String& fragment, FramePolicyFunction);
+
+    void deferredJobsTimerFired(Timer<FrameLoaderClientBlackBerry>*);
+
+    Frame* m_frame;
+    ResourceError m_loadError;
+    BlackBerry::WebKit::WebPagePrivate* m_webPagePrivate;
+
+    Timer<FrameLoaderClientBlackBerry>* m_deferredJobsTimer;
+    KURL m_deferredManualScript;
+    Geolocation* m_geolocation;
+    bool m_sentReadyToRender;
+
+    FramePolicyFunction m_pendingFragmentScrollPolicyFunction;
+    String m_pendingFragmentScroll;
+
+    bool m_loadingErrorPage;
+    bool m_clientRedirectIsPending;
+    bool m_childFrameCreationSuppressed;
+
+    // This set includes the original and final urls for server redirects.
+    HashSet<KURL> m_historyNavigationSourceURLs;
+    HashSet<KURL> m_redirectURLsToSkipDueToHistoryNavigation;
+
+    // Plugin view to redirect data to.
+    PluginView* m_pluginView;
+    bool m_hasSentResponseToPlugin;
+
+    // Used to stop media files from loading because we don't need to have the entire file loaded by WebKit.
+    bool m_cancelLoadOnNextData;
+};
+
+} // WebCore
+
+#endif // FrameLoaderClientBlackBerry_h
diff --git a/Source/WebKit/blackberry/WebCoreSupport/JavaScriptDebuggerBlackBerry.cpp b/Source/WebKit/blackberry/WebCoreSupport/JavaScriptDebuggerBlackBerry.cpp
new file mode 100644
index 000000000..ffe7e9383
--- /dev/null
+++ b/Source/WebKit/blackberry/WebCoreSupport/JavaScriptDebuggerBlackBerry.cpp
@@ -0,0 +1,179 @@
+/*
+ * Copyright (C) 2009 Torch Mobile Inc. http://www.torchmobile.com/
+ * Copyright (C) 2010, 2011, 2012 Research In Motion Limited. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+#include "config.h"
+
+#if ENABLE(JAVASCRIPT_DEBUGGER)
+#include "JavaScriptDebuggerBlackBerry.h"
+
+#include "JavaScriptCallFrame.h"
+#include "PageScriptDebugServer.h"
+#include "PlatformString.h"
+#include "ScriptBreakpoint.h"
+#include "SourceCode.h"
+#include "WebPage_p.h"
+
+namespace WebCore {
+
+JavaScriptDebuggerBlackBerry::JavaScriptDebuggerBlackBerry(BlackBerry::WebKit::WebPagePrivate* webPagePrivate)
+    : m_webPagePrivate(webPagePrivate)
+    , m_debugServer(PageScriptDebugServer::shared())
+{
+    start();
+}
+
+JavaScriptDebuggerBlackBerry::~JavaScriptDebuggerBlackBerry()
+{
+    stop();
+}
+
+void JavaScriptDebuggerBlackBerry::start()
+{
+    m_debugServer.addListener(this, m_webPagePrivate->m_page);
+}
+
+void JavaScriptDebuggerBlackBerry::stop()
+{
+    m_debugServer.removeListener(this, m_webPagePrivate->m_page);
+}
+
+void JavaScriptDebuggerBlackBerry::addBreakpoint(const unsigned short* url, unsigned urlLength, int lineNumber, const unsigned short* condition, unsigned conditionLength)
+{
+    if (!url || !urlLength)
+        return;
+    if (!m_currentCallFrame)
+        return;
+
+    String sourceString(url, urlLength);
+    String conditionString(condition, conditionLength);
+    int actualLineNumber;
+    m_debugServer.setBreakpoint(sourceString, ScriptBreakpoint(lineNumber, 0, conditionString), &lineNumber, &actualLineNumber);
+}
+
+void JavaScriptDebuggerBlackBerry::updateBreakpoint(const unsigned short* url, unsigned urlLength, int lineNumber, const unsigned short* condition, unsigned conditionLength)
+{
+    if (!url || !urlLength)
+        return;
+    if (!m_currentCallFrame)
+        return;
+
+    String sourceString(url, urlLength);
+    String conditionString(condition, conditionLength);
+    int actualLineNumber;
+    m_debugServer.setBreakpoint(sourceString, ScriptBreakpoint(lineNumber, 0, conditionString), &lineNumber, &actualLineNumber);
+}
+
+
+void JavaScriptDebuggerBlackBerry::removeBreakpoint(const unsigned short* url, unsigned urlLength, int lineNumber)
+{
+    if (!url || !urlLength)
+        return;
+    if (!m_currentCallFrame)
+        return;
+
+    String sourceString(url, urlLength);
+    sourceString += ":" + lineNumber;
+    m_debugServer.removeBreakpoint(sourceString);
+}
+
+
+bool JavaScriptDebuggerBlackBerry::pauseOnExceptions()
+{
+    return m_debugServer.pauseOnExceptionsState() == ScriptDebugServer::PauseOnAllExceptions;
+}
+
+void JavaScriptDebuggerBlackBerry::setPauseOnExceptions(bool pause)
+{
+    m_debugServer.setPauseOnExceptionsState(pause ? ScriptDebugServer::PauseOnAllExceptions : ScriptDebugServer::DontPauseOnExceptions);
+}
+
+void JavaScriptDebuggerBlackBerry::pauseInDebugger()
+{
+    m_debugServer.setPauseOnNextStatement(true);
+}
+
+void JavaScriptDebuggerBlackBerry::resumeDebugger()
+{
+    m_debugServer.continueProgram();
+}
+
+void JavaScriptDebuggerBlackBerry::stepOverStatementInDebugger()
+{
+    m_debugServer.stepOverStatement();
+}
+
+void JavaScriptDebuggerBlackBerry::stepIntoStatementInDebugger()
+{
+    m_debugServer.stepIntoStatement();
+}
+
+void JavaScriptDebuggerBlackBerry::stepOutOfFunctionInDebugger()
+{
+    m_debugServer.stepOutOfFunction();
+}
+
+void JavaScriptDebuggerBlackBerry::didParseSource(const String& sourceID, const Script& script)
+{
+    m_webPagePrivate->m_client->javascriptSourceParsed(script.url.characters(), script.url.length(), script.source.characters(), script.source.length());
+}
+
+void JavaScriptDebuggerBlackBerry::failedToParseSource(const String& url, const String& data, int firstLine, int errorLine, const String& errorMessage)
+{
+    m_webPagePrivate->m_client->javascriptParsingFailed(url.impl()->characters(), url.length(), errorMessage.impl()->characters(), errorMessage.length(), errorLine);
+}
+
+void JavaScriptDebuggerBlackBerry::didPause(ScriptState*, const ScriptValue& callFrames, const ScriptValue& exception)
+{
+    String stacks;
+
+    m_currentCallFrame = m_debugServer.currentCallFrame();
+    JavaScriptCallFrame* frame = m_currentCallFrame;
+
+    while (frame && frame->isValid()) {
+        JSC::SourceProvider* provider = reinterpret_cast<JSC::SourceProvider*>(frame->sourceID());
+        String url(provider->url().characters(), provider->url().length());
+        if (url.length())
+            stacks += url;
+        stacks += ": ";
+
+        if (frame->type() == JSC::DebuggerCallFrame::FunctionType) {
+            String name = frame->functionName();
+            if (name.length())
+                stacks += name;
+        }
+        stacks += "(): ";
+
+        String line = String::number(frame->line());
+        stacks += line + "\n";
+
+        frame = frame->caller();
+    }
+
+    m_webPagePrivate->m_client->javascriptPaused(reinterpret_cast<const unsigned short*>(stacks.characters()), stacks.length());
+}
+
+void JavaScriptDebuggerBlackBerry::didContinue()
+{
+    m_currentCallFrame = 0;
+    m_webPagePrivate->m_client->javascriptContinued();
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(JAVASCRIPT_DEBUGGER)
diff --git a/Source/WebKit/blackberry/WebCoreSupport/JavaScriptDebuggerBlackBerry.h b/Source/WebKit/blackberry/WebCoreSupport/JavaScriptDebuggerBlackBerry.h
new file mode 100644
index 000000000..2f511b2a3
--- /dev/null
+++ b/Source/WebKit/blackberry/WebCoreSupport/JavaScriptDebuggerBlackBerry.h
@@ -0,0 +1,77 @@
+/*
+ * Copyright (C) 2009 Torch Mobile Inc. http://www.torchmobile.com/
+ * Copyright (C) 2011, 2012 Research In Motion Limited. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+#ifndef JavaScriptDebuggerBlackBerry_h
+#define JavaScriptDebuggerBlackBerry_h
+
+#if ENABLE(JAVASCRIPT_DEBUGGER)
+
+#include "ScriptDebugListener.h"
+
+namespace BlackBerry {
+namespace WebKit {
+class WebPagePrivate;
+}
+}
+
+namespace WebCore {
+
+class JavaScriptCallFrame;
+class PageScriptDebugServer;
+
+class JavaScriptDebuggerBlackBerry : public ScriptDebugListener {
+public:
+    JavaScriptDebuggerBlackBerry(BlackBerry::WebKit::WebPagePrivate*);
+    ~JavaScriptDebuggerBlackBerry();
+
+    void addBreakpoint(const unsigned short* url, unsigned urlLength, int lineNumber, const unsigned short* condition, unsigned conditionLength);
+    void updateBreakpoint(const unsigned short* url, unsigned urlLength, int lineNumber, const unsigned short* condition, unsigned conditionLength);
+    void removeBreakpoint(const unsigned short* url, unsigned urlLength, int lineNumber);
+
+    bool pauseOnExceptions();
+    void setPauseOnExceptions(bool);
+
+    void pauseInDebugger();
+    void resumeDebugger();
+
+    void stepOverStatementInDebugger();
+    void stepIntoStatementInDebugger();
+    void stepOutOfFunctionInDebugger();
+
+    // From ScriptDebugListener
+    virtual void didParseSource(const String&  sourceID, const Script&);
+    virtual void failedToParseSource(const String& url, const String& data, int firstLine, int errorLine, const String& errorMessage);
+    virtual void didPause(ScriptState*, const ScriptValue& callFrames, const ScriptValue& exception);
+    virtual void didContinue();
+
+protected:
+    void start();
+    void stop();
+
+private:
+    BlackBerry::WebKit::WebPagePrivate* m_webPagePrivate;
+    PageScriptDebugServer& m_debugServer;
+
+    JavaScriptCallFrame* m_currentCallFrame;
+};
+
+} // WebCore
+
+#endif // ENABLE(JAVASCRIPT_DEBUGGER)
+#endif // JavaScriptDebuggerBlackBerry_h
diff --git a/Source/WebKit/blackberry/WebCoreSupport/inspectorBB.html b/Source/WebKit/blackberry/WebCoreSupport/inspectorBB.html
new file mode 100644
index 000000000..5f692197f
--- /dev/null
+++ b/Source/WebKit/blackberry/WebCoreSupport/inspectorBB.html
@@ -0,0 +1,64 @@
+<!--
+Copyright (C) 2006, 2007, 2008 Apple Inc.  All rights reserved.
+Copyright (C) 2011, 2012 Research In Motion Ltd.  All rights reserved.
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions
+are met:
+
+1.  Redistributions of source code must retain the above copyright
+    notice, this list of conditions and the following disclaimer.
+2.  Redistributions in binary form must reproduce the above copyright
+    notice, this list of conditions and the following disclaimer in the
+    documentation and/or other materials provided with the distribution.
+3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+    its contributors may be used to endorse or promote products derived
+    from this software without specific prior written permission.
+
+THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+(INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+-->
+<!DOCTYPE html>
+<html>
+    <head>
+        <meta http-equiv="content-type" content="text/html; charset=utf-8">
+        <link rel="stylesheet" type="text/css" href="audits.css">
+        <link rel="stylesheet" type="text/css" href="dataGrid.css">
+        <link rel="stylesheet" type="text/css" href="goToLineDialog.css">
+        <link rel="stylesheet" type="text/css" href="heapProfiler.css">
+        <link rel="stylesheet" type="text/css" href="inspector.css">
+        <link rel="stylesheet" type="text/css" href="inspectorCommon.css">
+        <link rel="stylesheet" type="text/css" href="inspectorSyntaxHighlight.css">
+        <link rel="stylesheet" type="text/css" href="networkPanel.css">
+        <link rel="stylesheet" type="text/css" href="helpScreen.css">
+        <link rel="stylesheet" type="text/css" href="popover.css">
+        <link rel="stylesheet" type="text/css" href="textViewer.css">
+        <script type="text/javascript" src="javascript.js"></script>
+    </head>
+    <body class="detached">
+    <div id="toolbar">
+        <div class="toolbar-item close-left"><button id="close-button-left"></button></div>
+        <div id="toolbar-controls">
+            <div class="toolbar-item"><button id="toolbar-dropdown-arrow" class="toolbar-label">&raquo;</button></div>
+            <div class="toolbar-item hidden" id="search-results-matches"></div>
+            <div class="toolbar-item toolbar-search-item"><input id="search" type="search" incremental results="0"><div id="search-toolbar-label" class="toolbar-label"></div></div>
+            <div class="toolbar-item close-right"><button id="close-button-right"></button></div>
+        </div>
+    </div>
+    <div id="main">
+        <div id="main-panels" spellcheck="false"></div>
+        <div id="main-status-bar" class="status-bar"><div id="anchored-status-bar-items"><div id="counters"><div id="error-warning-count" class="hidden"></div></div></div></div>
+    </div>
+    <div id="drawer">
+        <div id="console-view"><div id="console-messages" class="monospace"><div id="console-prompt" spellcheck="false"><br></div></div></div>
+        <div id="drawer-status-bar" class="status-bar"><div id="other-drawer-status-bar-items"><button id="clear-console-status-bar-item" class="status-bar-item clear-status-bar-item"><div class="glyph"></div><div class="glyph shadow"></div></button><select id="console-context" class="status-bar-item"></select><div id="console-filter" class="scope-bar status-bar-item"></div></div></div>
+    </div>
+</body>
+</html>
diff --git a/Source/WebKit/blackberry/WebCoreSupport/inspectorBB.js b/Source/WebKit/blackberry/WebCoreSupport/inspectorBB.js
new file mode 100644
index 000000000..3017e0a58
--- /dev/null
+++ b/Source/WebKit/blackberry/WebCoreSupport/inspectorBB.js
@@ -0,0 +1,36 @@
+/*
+ * Copyright (C) 2012 Research In Motion Limited. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+var context = {};
+(function () {
+    Preferences.ignoreWhitespace = false;
+    Preferences.samplingCPUProfiler = true;
+    Preferences.debuggerAlwaysEnabled = true;
+    Preferences.profilerAlwaysEnabled = true;
+    Preferences.canEditScriptSource = false;
+    Preferences.onlineDetectionEnabled = false;
+    Preferences.nativeInstrumentationEnabled = true;
+    // FIXME: Turn this to whatever the value of --enable-file-system for chrome.
+    Preferences.fileSystemEnabled = false;
+    Preferences.canClearCacheAndCookies = true;
+    Preferences.showCookiesTab = true;
+})();
+InspectorFrontendHost.copyText = function(tmp) {
+    var encoded = encodeURI(tmp);
+    var text = 'data:text/plain;charset=utf-8,' + encoded;
+    window.open(text, "_blank");
+}
diff --git a/Source/WebKit/blackberry/WebKitSupport/BackingStoreClient.cpp b/Source/WebKit/blackberry/WebKitSupport/BackingStoreClient.cpp
new file mode 100644
index 000000000..c7de7716c
--- /dev/null
+++ b/Source/WebKit/blackberry/WebKitSupport/BackingStoreClient.cpp
@@ -0,0 +1,409 @@
+/*
+ * Copyright (C) 2009, 2010, 2011 Research In Motion Limited. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+#include "config.h"
+#include "BackingStoreClient.h"
+
+#include "BackingStore.h"
+#include "BackingStore_p.h"
+#include "FloatPoint.h"
+#include "FocusController.h"
+#include "Frame.h"
+#include "FrameView.h"
+#include "HTMLFrameOwnerElement.h"
+#include "Page.h"
+#include "RenderBox.h"
+#include "WebPage_p.h"
+
+// FIXME: Leaving the below lines commented out as a reference for us to soon be sure if we need these
+// methods and class variables be moved from WebPage to BackingStoreClient.
+// Notification methods that deliver changes to the real geometry of the device as specified above.
+// void notifyTransformChanged();
+// void notifyTransformedContentsSizeChanged();
+// void notifyTransformedScrollChanged();
+// m_overflowExceedsContentsSize = true;
+// haspendingscrollevent
+
+using namespace WebCore;
+
+namespace BlackBerry {
+namespace WebKit {
+
+static inline IntSize pointToSize(const IntPoint& point)
+{
+    return IntSize(point.x(), point.y());
+}
+
+BackingStoreClient* BackingStoreClient::create(Frame* frame, Frame* parentFrame, WebPage* parentPage)
+{
+    ASSERT(parentPage);
+    ASSERT(frame->view());
+
+    // FIXME: We do not support inner frames for now.
+    if (parentFrame)
+        return 0;
+
+    BackingStoreClient* parentBackingStoreClient
+        = parentFrame
+        ? parentPage->d->backingStoreClientForFrame(parentFrame)
+        : 0;
+
+    // If this frame has a parent with no backingstore then just stop since
+    // our frame heirarchy is done.
+    if (parentFrame && !parentBackingStoreClient)
+        return 0;
+
+    BackingStoreClient* it = new BackingStoreClient(frame, parentFrame, parentPage);
+    ASSERT(it);
+
+    // Frame -> BackingStoreClient mapping is controlled by the Page.
+    parentPage->d->addBackingStoreClientForFrame(frame, it);
+
+    // Add the backing store client to the child list of its parent.
+    if (parentBackingStoreClient)
+        parentBackingStoreClient->addChild(it);
+
+    return it;
+}
+
+BackingStoreClient::BackingStoreClient(Frame* frame, Frame* parentFrame, WebPage* parentPage)
+    : m_frame(frame)
+    , m_webPage(parentPage)
+    , m_backingStore(0)
+    , m_parent(0)
+    , m_isClientGeneratedScroll(false)
+    , m_isScrollNotificationSuppressed(false)
+{
+    UNUSED_PARAM(parentFrame);
+    m_backingStore = new BackingStore(m_webPage, this);
+}
+
+BackingStoreClient::~BackingStoreClient()
+{
+    m_webPage->d->removeBackingStoreClientForFrame(m_frame);
+
+    delete m_backingStore;
+    m_backingStore = 0;
+    m_frame = 0;
+}
+
+void BackingStoreClient::addChild(BackingStoreClient* child)
+{
+    ASSERT(child);
+    child->m_parent = this;
+}
+
+WTF::Vector <BackingStoreClient*> BackingStoreClient::children() const
+{
+    WTF::Vector<BackingStoreClient*> children;
+    for (Frame* child = m_frame->tree()->firstChild(); child; child = child->tree()->nextSibling()) {
+        BlackBerry::WebKit::BackingStoreClient* client =
+            m_webPage->d->backingStoreClientForFrame(child);
+
+        if (client)
+            children.append(client);
+    }
+
+    return children;
+}
+
+IntRect BackingStoreClient::absoluteRect() const
+{
+    IntRect rect = IntRect(IntPoint::zero(), viewportSize());
+
+    if (!isMainFrame()) {
+        // It is possible that the owner HTML element has been removed at this point,
+        // especially when the frame is loading a JavaScript URL.
+        if (Element* elt = m_frame->ownerElement()) {
+            if (RenderBox* obj = elt->renderBox())
+                rect.move(obj->borderLeft() + obj->paddingLeft(), obj->borderTop() + obj->paddingTop());
+        }
+    }
+
+    Frame* frame = m_frame;
+    while (frame) {
+        if (Element* element = static_cast<Element*>(frame->ownerElement())) {
+            do {
+                rect.move(element->offsetLeft(), element->offsetTop());
+            } while ((element = element->offsetParent()));
+        }
+
+        if ((frame = frame->tree()->parent()))
+            rect.move((-frame->view()->scrollOffset()));
+    }
+
+    return rect;
+}
+
+IntRect BackingStoreClient::transformedAbsoluteRect() const
+{
+    return m_webPage->d->mapToTransformed(absoluteRect());
+}
+
+IntPoint BackingStoreClient::absoluteLocation() const
+{
+    return absoluteRect().location();
+}
+
+IntPoint BackingStoreClient::transformedAbsoluteLocation() const
+{
+    return m_webPage->d->mapToTransformed(transformedAbsoluteRect()).location();
+}
+
+IntPoint BackingStoreClient::scrollPosition() const
+{
+    ASSERT(m_frame);
+    return m_frame->view()->scrollPosition() - pointToSize(m_frame->view()->minimumScrollPosition());
+}
+
+IntPoint BackingStoreClient::transformedScrollPosition() const
+{
+    return m_webPage->d->mapToTransformed(scrollPosition());
+}
+
+void BackingStoreClient::setScrollPosition(const IntPoint& pos)
+{
+    ASSERT(m_frame->view());
+    if (pos == scrollPosition())
+        return;
+
+    // We set a flag here to note that this scroll operation was originated
+    // within the BlackBerry-specific layer of WebKit and not by WebCore.
+    // This flag is checked in checkOriginOfCurrentScrollOperation() to decide
+    // whether to notify the client of the current scroll operation. This is
+    // why it is important that all scroll operations that originate within
+    // BlackBerry-specific code are encapsulated here and that callers of this
+    // method also directly or indirectly call notifyTransformedScrollChanged().
+    m_isScrollNotificationSuppressed = true;
+    m_frame->view()->setScrollPosition(pos + pointToSize(m_frame->view()->minimumScrollPosition()));
+    m_isScrollNotificationSuppressed = false;
+}
+
+IntPoint BackingStoreClient::maximumScrollPosition() const
+{
+    ASSERT(m_frame->view());
+    return m_frame->view()->maximumScrollPosition() - pointToSize(m_frame->view()->minimumScrollPosition());
+}
+
+IntPoint BackingStoreClient::transformedMaximumScrollPosition() const
+{
+    return m_webPage->d->mapToTransformed(maximumScrollPosition());
+}
+
+IntSize BackingStoreClient::actualVisibleSize() const
+{
+    return m_webPage->d->mapFromTransformed(transformedActualVisibleSize());
+}
+
+IntSize BackingStoreClient::transformedActualVisibleSize() const
+{
+    if (isMainFrame())
+        return m_webPage->d->transformedActualVisibleSize();
+
+    return transformedViewportSize();
+}
+
+IntSize BackingStoreClient::viewportSize() const
+{
+    ASSERT(m_frame->view());
+    if (isMainFrame())
+        return m_webPage->d->viewportSize();
+
+    return m_frame->view()->visibleContentRect().size();
+}
+
+IntSize BackingStoreClient::transformedViewportSize() const
+{
+    if (isMainFrame())
+        return m_webPage->d->transformedViewportSize();
+
+    ASSERT(m_frame->view());
+    const IntSize untransformedViewportSize = m_frame->view()->visibleContentRect().size();
+    const FloatPoint transformedBottomRight = m_webPage->d->m_transformationMatrix->mapPoint(
+        FloatPoint(untransformedViewportSize.width(), untransformedViewportSize.height()));
+    return IntSize(floorf(transformedBottomRight.x()), floorf(transformedBottomRight.y()));
+}
+
+IntRect BackingStoreClient::visibleContentsRect() const
+{
+    ASSERT(m_frame->view());
+    IntRect visibleContentRect = m_frame->view()->visibleContentRect();
+    if (isMainFrame())
+        return visibleContentRect;
+
+    IntPoint offset = absoluteLocation();
+    visibleContentRect.move(offset.x(), offset.y());
+    if (m_parent)
+        visibleContentRect.intersect(m_parent->visibleContentsRect());
+
+    return visibleContentRect;
+}
+
+IntRect BackingStoreClient::transformedVisibleContentsRect() const
+{
+    // Usually this would be mapToTransformed(visibleContentsRect()), but
+    // that results in rounding errors because we already set the WebCore
+    // viewport size from our original transformedViewportSize().
+    // Instead, we only transform the scroll position and take the
+    // viewport size as it is, which ensures that e.g. blitting operations
+    // always cover the whole widget/screen.
+    IntRect visibleContentsRect = IntRect(transformedScrollPosition(), transformedViewportSize());
+    if (isMainFrame())
+        return visibleContentsRect;
+
+    IntPoint offset = transformedAbsoluteLocation();
+    visibleContentsRect.move(offset.x(), offset.y());
+    return visibleContentsRect;
+}
+
+IntSize BackingStoreClient::contentsSize() const
+{
+    ASSERT(m_frame->view());
+    return m_frame->view()->contentsSize();
+}
+
+IntSize BackingStoreClient::transformedContentsSize() const
+{
+    // mapToTransformed() functions use this method to crop their results,
+    // so we can't make use of them here. While we want rounding inside page
+    // boundaries to extend rectangles and round points, we need to crop the
+    // contents size to the floored values so that we don't try to display
+    // or report points that are not fully covered by the actual float-point
+    // contents rectangle.
+    const IntSize untransformedContentsSize = contentsSize();
+    const FloatPoint transformedBottomRight = m_webPage->d->m_transformationMatrix->mapPoint(
+        FloatPoint(untransformedContentsSize.width(), untransformedContentsSize.height()));
+    return IntSize(floorf(transformedBottomRight.x()), floorf(transformedBottomRight.y()));
+}
+
+void BackingStoreClient::clipToTransformedContentsRect(IntRect& rect) const
+{
+    // FIXME: Needs to proper translate coordinates here?
+    rect.intersect(IntRect(IntPoint::zero(), transformedContentsSize()));
+}
+
+IntPoint BackingStoreClient::mapFromContentsToViewport(const IntPoint& point) const
+{
+    const IntPoint scrollPosition = this->scrollPosition();
+    return IntPoint(point.x() - scrollPosition.x(), point.y() - scrollPosition.y());
+}
+
+IntPoint BackingStoreClient::mapFromViewportToContents(const IntPoint& point) const
+{
+    const IntPoint scrollPosition = this->scrollPosition();
+    return IntPoint(point.x() + scrollPosition.x(), point.y() + scrollPosition.y());
+}
+
+IntRect BackingStoreClient::mapFromContentsToViewport(const IntRect& rect) const
+{
+    return IntRect(mapFromContentsToViewport(rect.location()), rect.size());
+}
+
+IntRect BackingStoreClient::mapFromViewportToContents(const IntRect& rect) const
+{
+    return IntRect(mapFromViewportToContents(rect.location()), rect.size());
+}
+
+IntPoint BackingStoreClient::mapFromTransformedContentsToTransformedViewport(const IntPoint& point) const
+{
+    const IntPoint scrollPosition = transformedScrollPosition();
+    return IntPoint(point.x() - scrollPosition.x(), point.y() - scrollPosition.y());
+}
+
+IntPoint BackingStoreClient::mapFromTransformedViewportToTransformedContents(const IntPoint& point) const
+{
+    const IntPoint scrollPosition = transformedScrollPosition();
+    return IntPoint(point.x() + scrollPosition.x(), point.y() + scrollPosition.y());
+}
+
+IntRect BackingStoreClient::mapFromTransformedContentsToTransformedViewport(const IntRect& rect) const
+{
+    return IntRect(mapFromTransformedContentsToTransformedViewport(rect.location()), rect.size());
+}
+
+IntRect BackingStoreClient::mapFromTransformedViewportToTransformedContents(const IntRect& rect) const
+{
+    return IntRect(mapFromTransformedViewportToTransformedContents(rect.location()), rect.size());
+}
+
+WebPagePrivate::LoadState BackingStoreClient::loadState() const
+{
+    // FIXME: Does it need to call WebPage's?
+    return m_webPage->d->loadState();
+}
+
+bool BackingStoreClient::isLoading() const
+{
+    // FIXME: Does it need to call WebPage's?
+    return m_webPage->d->isLoading();
+}
+
+bool BackingStoreClient::isFocused() const
+{
+    return m_frame && m_frame->page() && m_frame->page()->focusController()
+        && m_frame->page()->focusController()->focusedFrame() == m_frame;
+}
+
+bool BackingStoreClient::scrollsHorizontally() const
+{
+    return transformedActualVisibleSize().width() < transformedContentsSize().width();
+}
+
+bool BackingStoreClient::scrollsVertically() const
+{
+    return transformedActualVisibleSize().height() < transformedContentsSize().height();
+}
+
+bool BackingStoreClient::isClientGeneratedScroll() const
+{
+    return m_isClientGeneratedScroll;
+}
+
+void BackingStoreClient::setIsClientGeneratedScroll(bool flag)
+{
+    m_isClientGeneratedScroll = flag;
+}
+
+bool BackingStoreClient::isScrollNotificationSuppressed() const
+{
+    return m_isScrollNotificationSuppressed;
+}
+
+void BackingStoreClient::setIsScrollNotificationSuppressed(bool flag)
+{
+    m_isScrollNotificationSuppressed = flag;
+}
+
+void BackingStoreClient::checkOriginOfCurrentScrollOperation()
+{
+    // This is called via ChromeClientBlackBerry::scroll in order to check the origin
+    // of the current scroll operation to decide whether to notify the client.
+    // If the current scroll operation was initiated internally by WebCore itself
+    // either via JavaScript, back/forward or otherwise then we need to go ahead
+    // and notify the client of this change.
+    if (isScrollNotificationSuppressed())
+        return;
+
+    if (isMainFrame())
+        m_webPage->d->notifyTransformedScrollChanged();
+    else
+        m_backingStore->d->scrollChanged(transformedScrollPosition());
+}
+
+}
+}
diff --git a/Source/WebKit/blackberry/WebKitSupport/BackingStoreClient.h b/Source/WebKit/blackberry/WebKitSupport/BackingStoreClient.h
new file mode 100644
index 000000000..42b572104
--- /dev/null
+++ b/Source/WebKit/blackberry/WebKitSupport/BackingStoreClient.h
@@ -0,0 +1,123 @@
+/*
+ * Copyright (C) 2009, 2010, 2011 Research In Motion Limited. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+#ifndef BackingStoreClient_h
+#define BackingStoreClient_h
+
+#include "WebPage_p.h"
+#include <wtf/Vector.h>
+
+namespace WebCore {
+class FloatPoint;
+class Frame;
+class IntPoint;
+class IntSize;
+class IntRect;
+}
+
+namespace BlackBerry {
+namespace WebKit {
+
+class BackingStore;
+class WebPagePrivate;
+
+class BackingStoreClient {
+public:
+    static BackingStoreClient* create(WebCore::Frame*, WebCore::Frame* parentFrame, WebPage* parentPage);
+    ~BackingStoreClient();
+
+    BackingStore* backingStore() const { return m_backingStore; }
+    WebCore::Frame* frame() const { return m_frame; }
+    bool isMainFrame() const { return m_frame == m_webPage->d->m_mainFrame; }
+
+    void addChild(BackingStoreClient* child);
+    WTF::Vector <BackingStoreClient*> children() const;
+    BackingStoreClient* parent() const { return m_parent; }
+
+    WebCore::IntPoint absoluteLocation() const;
+    WebCore::IntPoint transformedAbsoluteLocation() const;
+    WebCore::IntRect absoluteRect() const;
+    WebCore::IntRect transformedAbsoluteRect() const;
+
+    // scroll position returned is in transformed coordinates
+    WebCore::IntPoint scrollPosition() const;
+    WebCore::IntPoint maximumScrollPosition() const;
+    // scroll position provided should be in transformed coordinates
+    void setScrollPosition(const WebCore::IntPoint&);
+
+    WebCore::IntPoint transformedScrollPosition() const;
+    WebCore::IntPoint transformedMaximumScrollPosition() const;
+
+    WebCore::IntSize actualVisibleSize() const;
+    WebCore::IntSize transformedActualVisibleSize() const;
+
+    WebCore::IntSize viewportSize() const;
+    WebCore::IntSize transformedViewportSize() const;
+
+    WebCore::IntRect visibleContentsRect() const;
+    WebCore::IntRect transformedVisibleContentsRect() const;
+
+    WebCore::IntSize contentsSize() const;
+    WebCore::IntSize transformedContentsSize() const;
+
+    /* Generic conversions of points, rects, relative to and from contents and viewport*/
+    WebCore::IntPoint mapFromContentsToViewport(const WebCore::IntPoint&) const;
+    WebCore::IntPoint mapFromViewportToContents(const WebCore::IntPoint&) const;
+    WebCore::IntRect mapFromContentsToViewport(const WebCore::IntRect&) const;
+    WebCore::IntRect mapFromViewportToContents(const WebCore::IntRect&) const;
+
+    /* Generic conversions of points, rects, relative to and from transformed contents and transformed viewport*/
+    WebCore::IntPoint mapFromTransformedContentsToTransformedViewport(const WebCore::IntPoint&) const;
+    WebCore::IntPoint mapFromTransformedViewportToTransformedContents(const WebCore::IntPoint&) const;
+    WebCore::IntRect mapFromTransformedContentsToTransformedViewport(const WebCore::IntRect&) const;
+    WebCore::IntRect mapFromTransformedViewportToTransformedContents(const WebCore::IntRect&) const;
+
+    void clipToTransformedContentsRect(WebCore::IntRect&) const;
+
+    bool isLoading() const;
+    WebPagePrivate::LoadState loadState() const;
+
+    bool isFocused() const;
+
+    bool scrollsHorizontally() const;
+    bool scrollsVertically() const;
+
+    bool isClientGeneratedScroll() const;
+    void setIsClientGeneratedScroll(bool);
+
+    bool isScrollNotificationSuppressed() const;
+    void setIsScrollNotificationSuppressed(bool);
+
+    /* Called from within WebKit via ChromeClientBlackBerry */
+    void checkOriginOfCurrentScrollOperation();
+
+private:
+    BackingStoreClient(WebCore::Frame*, WebCore::Frame* parentFrame, WebPage* parentPage);
+
+    WebCore::Frame* m_frame;
+    WebPage* m_webPage;
+    BackingStore* m_backingStore;
+    BackingStoreClient* m_parent;
+    bool m_isClientGeneratedScroll;
+    bool m_isScrollNotificationSuppressed;
+};
+
+}
+}
+
+#endif // BackingStoreClient_h
diff --git a/Source/WebKit/blackberry/WebKitSupport/BackingStoreCompositingSurface.cpp b/Source/WebKit/blackberry/WebKitSupport/BackingStoreCompositingSurface.cpp
new file mode 100644
index 000000000..43e075a39
--- /dev/null
+++ b/Source/WebKit/blackberry/WebKitSupport/BackingStoreCompositingSurface.cpp
@@ -0,0 +1,106 @@
+/*
+ * Copyright (C) 2009, 2010, 2011, 2012 Research In Motion Limited. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+#include "config.h"
+#include "BackingStoreCompositingSurface.h"
+
+#include "GraphicsContext.h"
+#include "SurfacePool.h"
+
+#if USE(ACCELERATED_COMPOSITING)
+
+#include <BlackBerryPlatformGraphics.h>
+
+namespace BlackBerry {
+namespace WebKit {
+
+CompositingSurfaceBuffer::CompositingSurfaceBuffer(const Platform::IntSize& size)
+    : m_size(size)
+    , m_buffer(0)
+{
+}
+
+CompositingSurfaceBuffer::~CompositingSurfaceBuffer()
+{
+    destroyBuffer(m_buffer);
+}
+
+Platform::IntSize CompositingSurfaceBuffer::surfaceSize() const
+{
+    return m_size;
+}
+
+Platform::Graphics::Buffer* CompositingSurfaceBuffer::nativeBuffer() const
+{
+    if (!m_buffer) {
+        m_buffer = createBuffer(m_size,
+                                Platform::Graphics::TileBuffer,
+                                Platform::Graphics::GLES2);
+    }
+    return m_buffer;
+}
+
+BackingStoreCompositingSurface::BackingStoreCompositingSurface(const Platform::IntSize& size, bool doubleBuffered)
+    : m_isDoubleBuffered(doubleBuffered)
+    , m_needsSync(true)
+{
+    m_frontBuffer = new CompositingSurfaceBuffer(size);
+    m_backBuffer = !doubleBuffered ? 0 : new CompositingSurfaceBuffer(size);
+}
+
+BackingStoreCompositingSurface::~BackingStoreCompositingSurface()
+{
+    delete m_frontBuffer;
+    m_frontBuffer = 0;
+
+    delete m_backBuffer;
+    m_backBuffer = 0;
+}
+
+CompositingSurfaceBuffer* BackingStoreCompositingSurface::frontBuffer() const
+{
+    ASSERT(m_frontBuffer);
+    return m_frontBuffer;
+}
+
+CompositingSurfaceBuffer* BackingStoreCompositingSurface::backBuffer() const
+{
+    if (!m_isDoubleBuffered)
+        return frontBuffer();
+
+    ASSERT(m_backBuffer);
+    return m_backBuffer;
+}
+
+void BackingStoreCompositingSurface::swapBuffers()
+{
+    if (!m_isDoubleBuffered)
+        return;
+
+    // Store temps.
+    unsigned front = reinterpret_cast<unsigned>(frontBuffer());
+    unsigned back = reinterpret_cast<unsigned>(backBuffer());
+
+    // Atomic change.
+    _smp_xchg(reinterpret_cast<unsigned*>(&m_frontBuffer), back);
+    _smp_xchg(reinterpret_cast<unsigned*>(&m_backBuffer), front);
+}
+
+} // namespace WebKit
+} // namespace BlackBerry
+#endif // USE(ACCELERATED_COMPOSITING)
diff --git a/Source/WebKit/blackberry/WebKitSupport/BackingStoreCompositingSurface.h b/Source/WebKit/blackberry/WebKitSupport/BackingStoreCompositingSurface.h
new file mode 100644
index 000000000..d4ec45c52
--- /dev/null
+++ b/Source/WebKit/blackberry/WebKitSupport/BackingStoreCompositingSurface.h
@@ -0,0 +1,82 @@
+/*
+ * Copyright (C) 2009, 2010, 2011, 2012 Research In Motion Limited. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+#ifndef BackingStoreCompositingSurface_h
+#define BackingStoreCompositingSurface_h
+
+#if USE(ACCELERATED_COMPOSITING)
+
+#include <BlackBerryPlatformIntRectRegion.h>
+#include <wtf/RefPtr.h>
+#include <wtf/ThreadSafeRefCounted.h>
+
+namespace BlackBerry {
+
+namespace Platform {
+namespace Graphics {
+struct Buffer;
+}
+}
+
+namespace WebKit {
+class CompositingSurfaceBuffer {
+public:
+    CompositingSurfaceBuffer(const Platform::IntSize&);
+    ~CompositingSurfaceBuffer();
+    Platform::IntSize surfaceSize() const;
+
+    Platform::Graphics::Buffer* nativeBuffer() const;
+
+private:
+    Platform::IntSize m_size;
+    mutable Platform::Graphics::Buffer* m_buffer;
+};
+
+
+class BackingStoreCompositingSurface : public ThreadSafeRefCounted<BackingStoreCompositingSurface> {
+public:
+    static PassRefPtr<BackingStoreCompositingSurface> create(const Platform::IntSize& size, bool doubleBuffered)
+    {
+        return adoptRef(new BackingStoreCompositingSurface(size, doubleBuffered));
+    }
+
+    ~BackingStoreCompositingSurface();
+
+    CompositingSurfaceBuffer* frontBuffer() const;
+    CompositingSurfaceBuffer* backBuffer() const;
+    bool isDoubleBuffered() const { return m_isDoubleBuffered; }
+    void swapBuffers();
+
+    bool needsSync() const { return m_needsSync; }
+    void setNeedsSync(bool needsSync) { m_needsSync = needsSync; }
+
+private:
+    BackingStoreCompositingSurface(const Platform::IntSize&, bool doubleBuffered);
+
+    mutable CompositingSurfaceBuffer* m_frontBuffer;
+    mutable CompositingSurfaceBuffer* m_backBuffer;
+    bool m_isDoubleBuffered;
+    bool m_needsSync;
+};
+
+} // namespace WebKit
+} // namespace BlackBerry
+
+#endif // USE(ACCELERATED_COMPOSITING)
+
+#endif // BackingStoreCompositingSurface_h
diff --git a/Source/WebKit/blackberry/WebKitSupport/BackingStoreTile.cpp b/Source/WebKit/blackberry/WebKitSupport/BackingStoreTile.cpp
new file mode 100644
index 000000000..a02f93a1c
--- /dev/null
+++ b/Source/WebKit/blackberry/WebKitSupport/BackingStoreTile.cpp
@@ -0,0 +1,166 @@
+/*
+ * Copyright (C) 2009, 2010, 2011, 2012 Research In Motion Limited. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+#include "config.h"
+#include "BackingStoreTile.h"
+
+#include "GraphicsContext.h"
+#include "SurfacePool.h"
+
+#include <BlackBerryPlatformGraphics.h>
+
+namespace BlackBerry {
+namespace WebKit {
+
+TileBuffer::TileBuffer(const Platform::IntSize& size)
+    : m_size(size)
+    , m_buffer(0)
+    , m_blitGeneration(0)
+{
+}
+
+TileBuffer::~TileBuffer()
+{
+    destroyBuffer(m_buffer);
+}
+
+Platform::IntSize TileBuffer::size() const
+{
+    return m_size;
+}
+
+Platform::IntRect TileBuffer::rect() const
+{
+    return Platform::IntRect(Platform::IntPoint::zero(), m_size);
+}
+
+bool TileBuffer::isRendered() const
+{
+    return isRendered(rect());
+}
+
+bool TileBuffer::isRendered(const Platform::IntRectRegion& contents) const
+{
+    return Platform::IntRectRegion::subtractRegions(contents, m_renderedRegion).isEmpty();
+}
+
+void TileBuffer::clearRenderedRegion(const Platform::IntRectRegion& region)
+{
+    m_renderedRegion = Platform::IntRectRegion::subtractRegions(m_renderedRegion, region);
+}
+
+void TileBuffer::clearRenderedRegion()
+{
+    m_renderedRegion = Platform::IntRectRegion();
+}
+
+void TileBuffer::addRenderedRegion(const Platform::IntRectRegion& region)
+{
+    m_renderedRegion = Platform::IntRectRegion::unionRegions(region, m_renderedRegion);
+}
+
+Platform::IntRectRegion TileBuffer::renderedRegion() const
+{
+    return m_renderedRegion;
+}
+
+Platform::IntRectRegion TileBuffer::notRenderedRegion() const
+{
+    return Platform::IntRectRegion::subtractRegions(rect(), renderedRegion());
+}
+
+Platform::Graphics::Buffer* TileBuffer::nativeBuffer() const
+{
+    if (!m_buffer)
+        m_buffer = createBuffer(m_size, Platform::Graphics::TileBuffer, SurfacePool::globalSurfacePool()->sharedPixmapGroup());
+
+    return m_buffer;
+}
+
+
+BackingStoreTile::BackingStoreTile(const Platform::IntSize& size, BufferingMode mode)
+    : m_bufferingMode(mode)
+    , m_committed(false)
+    , m_backgroundPainted(false)
+    , m_horizontalShift(0)
+    , m_verticalShift(0)
+{
+    m_frontBuffer = new TileBuffer(size);
+}
+
+BackingStoreTile::~BackingStoreTile()
+{
+    delete m_frontBuffer;
+    m_frontBuffer = 0;
+}
+
+Platform::IntSize BackingStoreTile::size() const
+{
+    return frontBuffer()->size();
+}
+
+Platform::IntRect BackingStoreTile::rect() const
+{
+    return frontBuffer()->rect();
+}
+
+TileBuffer* BackingStoreTile::frontBuffer() const
+{
+    ASSERT(m_frontBuffer);
+    return m_frontBuffer;
+}
+
+TileBuffer* BackingStoreTile::backBuffer() const
+{
+    if (m_bufferingMode == SingleBuffered)
+        return frontBuffer();
+
+    return SurfacePool::globalSurfacePool()->backBuffer();
+}
+
+void BackingStoreTile::swapBuffers()
+{
+    if (m_bufferingMode == SingleBuffered)
+        return;
+
+    // Store temps.
+    unsigned front = reinterpret_cast<unsigned>(frontBuffer());
+    unsigned back = reinterpret_cast<unsigned>(backBuffer());
+
+    // Atomic change.
+    _smp_xchg(reinterpret_cast<unsigned*>(&m_frontBuffer), back);
+    _smp_xchg(reinterpret_cast<unsigned*>(&SurfacePool::globalSurfacePool()->m_backBuffer), front);
+}
+
+void BackingStoreTile::reset()
+{
+    setCommitted(false);
+    frontBuffer()->clearRenderedRegion();
+    backBuffer()->clearRenderedRegion();
+    clearShift();
+}
+
+void BackingStoreTile::paintBackground()
+{
+    m_backgroundPainted = true;
+
+    clearBuffer(backBuffer()->nativeBuffer(), 0, 0, 0, 0);
+}
+
+}
+}
diff --git a/Source/WebKit/blackberry/WebKitSupport/BackingStoreTile.h b/Source/WebKit/blackberry/WebKitSupport/BackingStoreTile.h
new file mode 100644
index 000000000..7a0a42f5d
--- /dev/null
+++ b/Source/WebKit/blackberry/WebKitSupport/BackingStoreTile.h
@@ -0,0 +1,109 @@
+/*
+ * Copyright (C) 2009, 2010, 2011, 2012 Research In Motion Limited. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+#ifndef BackingStoreTile_h
+#define BackingStoreTile_h
+
+#include "BlackBerryPlatformIntRectRegion.h"
+#include "BlackBerryPlatformPrimitives.h"
+
+namespace BlackBerry {
+namespace Platform {
+namespace Graphics {
+struct Buffer;
+}
+}
+
+namespace WebKit {
+class TileBuffer {
+    public:
+        TileBuffer(const Platform::IntSize&);
+        ~TileBuffer();
+        Platform::IntSize size() const;
+        Platform::IntRect rect() const;
+
+        bool isRendered() const;
+        bool isRendered(const Platform::IntRectRegion& contents) const;
+        void clearRenderedRegion();
+        void clearRenderedRegion(const Platform::IntRectRegion&);
+        void addRenderedRegion(const Platform::IntRectRegion&);
+        Platform::IntRectRegion renderedRegion() const;
+        Platform::IntRectRegion notRenderedRegion() const;
+
+        Platform::Graphics::Buffer* nativeBuffer() const;
+
+        void setBlitGeneration(int g) const { m_blitGeneration = g; }
+        int blitGeneration() const { return m_blitGeneration; }
+
+    private:
+        Platform::IntSize m_size;
+        Platform::IntRectRegion m_renderedRegion;
+        mutable Platform::Graphics::Buffer* m_buffer;
+        mutable int m_blitGeneration;
+};
+
+
+class BackingStoreTile {
+public:
+    enum BufferingMode { SingleBuffered, DoubleBuffered };
+
+    static BackingStoreTile* create(const Platform::IntSize& size, BufferingMode mode)
+    {
+        return new BackingStoreTile(size, mode);
+    }
+
+    ~BackingStoreTile();
+
+    Platform::IntSize size() const;
+    Platform::IntRect rect() const;
+
+    TileBuffer* frontBuffer() const;
+    TileBuffer* backBuffer() const;
+    bool isDoubleBuffered() const { return m_bufferingMode == DoubleBuffered; }
+
+    void reset();
+    bool backgroundPainted() const { return m_backgroundPainted; }
+    void paintBackground();
+
+    bool isCommitted() const { return m_committed; }
+    void setCommitted(bool committed) { m_committed = committed; }
+
+    void clearShift() { m_horizontalShift = 0; m_verticalShift = 0; }
+    int horizontalShift() const { return m_horizontalShift; }
+    void setHorizontalShift(int shift) { m_horizontalShift = shift; }
+    int verticalShift() const { return m_verticalShift; }
+    void setVerticalShift(int shift) { m_verticalShift = shift; }
+
+    void swapBuffers();
+
+private:
+    BackingStoreTile(const Platform::IntSize&, BufferingMode);
+
+    mutable TileBuffer* m_frontBuffer;
+    BufferingMode m_bufferingMode;
+    bool m_checkered;
+    bool m_committed;
+    bool m_backgroundPainted;
+    int m_horizontalShift;
+    int m_verticalShift;
+};
+
+} // namespace WebKit
+} // namespace BlackBerry
+
+#endif // BackingStoreTile_h
diff --git a/Source/WebKit/blackberry/WebKitSupport/DOMSupport.cpp b/Source/WebKit/blackberry/WebKitSupport/DOMSupport.cpp
new file mode 100644
index 000000000..9dd5d2117
--- /dev/null
+++ b/Source/WebKit/blackberry/WebKitSupport/DOMSupport.cpp
@@ -0,0 +1,404 @@
+/*
+ * Copyright (C) 2011, 2012 Research In Motion Limited. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+#include "config.h"
+#include "DOMSupport.h"
+
+#include "FloatQuad.h"
+#include "Frame.h"
+#include "FrameView.h"
+#include "HTMLFormElement.h"
+#include "HTMLInputElement.h"
+#include "HTMLNames.h"
+#include "HTMLTextAreaElement.h"
+#include "Node.h"
+#include "Range.h"
+#include "RenderObject.h"
+#include "RenderText.h"
+#include "RenderTextControl.h"
+#include "TextIterator.h"
+#include "VisibleSelection.h"
+#include "WTFString.h"
+
+#include "htmlediting.h"
+#include "visible_units.h"
+
+#include <limits>
+
+using WTF::Vector;
+
+using namespace WebCore;
+
+namespace BlackBerry {
+namespace WebKit {
+namespace DOMSupport {
+
+void visibleTextQuads(const Range& range, Vector<FloatQuad>& quads, bool useSelectionHeight)
+{
+    // Range::textQuads includes hidden text, which we don't want.
+    // To work around this, this is a copy of it which skips hidden elements.
+    Node* startContainer = range.startContainer();
+    Node* endContainer = range.endContainer();
+
+    if (!startContainer || !endContainer)
+        return;
+
+    Node* stopNode = range.pastLastNode();
+    for (Node* node = range.firstNode(); node != stopNode; node = node->traverseNextNode()) {
+        RenderObject* r = node->renderer();
+        if (!r || !r->isText())
+            continue;
+
+        if (r->style()->visibility() != VISIBLE)
+            continue;
+
+        RenderText* renderText = toRenderText(r);
+        int startOffset = node == startContainer ? range.startOffset() : 0;
+        int endOffset = node == endContainer ? range.endOffset() : std::numeric_limits<int>::max();
+        renderText->absoluteQuadsForRange(quads, startOffset, endOffset, useSelectionHeight);
+    }
+}
+
+bool isTextInputElement(Element* element)
+{
+    return element->isTextFormControl()
+           || element->hasTagName(HTMLNames::textareaTag)
+           || element->isContentEditable();
+}
+
+bool isPasswordElement(const Element* element)
+{
+    return element && element->hasTagName(HTMLNames::inputTag)
+           && static_cast<const HTMLInputElement*>(element)->isPasswordField();
+}
+
+WTF::String inputElementText(Element* element)
+{
+    if (!element)
+        return WTF::String();
+
+    WTF::String elementText;
+    if (element->hasTagName(HTMLNames::inputTag)) {
+        const HTMLInputElement* inputElement = static_cast<const HTMLInputElement*>(element);
+        elementText = inputElement->value();
+    } else if (element->hasTagName(HTMLNames::textareaTag)) {
+        const HTMLTextAreaElement* inputElement = static_cast<const HTMLTextAreaElement*>(element);
+        elementText = inputElement->value();
+    } else if (element->isContentEditable()) {
+        RefPtr<Range> rangeForNode = rangeOfContents(element);
+        elementText = rangeForNode.get()->text();
+    }
+    return elementText;
+}
+
+bool isElementTypePlugin(const Element* element)
+{
+    if (!element)
+        return false;
+
+    if (element->hasTagName(HTMLNames::objectTag)
+        || element->hasTagName(HTMLNames::embedTag)
+        || element->hasTagName(HTMLNames::appletTag))
+        return true;
+
+    return false;
+}
+
+HTMLTextFormControlElement* toTextControlElement(Node* node)
+{
+    if (!(node && node->isElementNode()))
+        return 0;
+
+    Element* element = static_cast<Element*>(node);
+    if (!element->isFormControlElement())
+        return 0;
+
+    HTMLFormControlElement* formElement = static_cast<HTMLFormControlElement*>(element);
+    if (!formElement->isTextFormControl())
+        return 0;
+
+    return static_cast<HTMLTextFormControlElement*>(formElement);
+}
+
+bool isPopupInputField(const Element* element)
+{
+    return isDateTimeInputField(element) || isColorInputField(element);
+}
+
+bool isDateTimeInputField(const Element* element)
+{
+    if (!element->hasTagName(HTMLNames::inputTag))
+        return false;
+
+    const HTMLInputElement* inputElement = static_cast<const HTMLInputElement*>(element);
+
+    // The following types have popup's.
+    if (inputElement->isDateControl()
+        || inputElement->isDateTimeControl()
+        || inputElement->isDateTimeLocalControl()
+        || inputElement->isTimeControl()
+        || inputElement->isMonthControl())
+            return true;
+
+    return false;
+}
+
+bool isColorInputField(const Element* element)
+{
+    if (!element->hasTagName(HTMLNames::inputTag))
+        return false;
+
+    const HTMLInputElement* inputElement = static_cast<const HTMLInputElement*>(element);
+
+#if ENABLE(INPUT_COLOR)
+    if (inputElement->isColorControl())
+        return true;
+#endif
+
+    return false;
+}
+
+AttributeState elementSupportsAutocorrect(const Element* element)
+{
+    // First we check the input item itself. If the attribute is not defined,
+    // we check its parent form.
+    QualifiedName autocorrectAttr = QualifiedName(nullAtom, "autocorrect", nullAtom);
+    if (element->fastHasAttribute(autocorrectAttr)) {
+        AtomicString attributeString = element->fastGetAttribute(autocorrectAttr);
+        if (equalIgnoringCase(attributeString, "off"))
+            return Off;
+        if (equalIgnoringCase(attributeString, "on"))
+            return On;
+        // If we haven't returned, it wasn't set properly. Check the form for an explicit setting
+        // because the attribute was provided, but invalid.
+    }
+    if (element->isFormControlElement()) {
+        const HTMLFormControlElement* formElement = static_cast<const HTMLFormControlElement*>(element);
+        if (formElement->form() && formElement->form()->fastHasAttribute(autocorrectAttr)) {
+            AtomicString attributeString = formElement->form()->fastGetAttribute(autocorrectAttr);
+            if (equalIgnoringCase(attributeString, "off"))
+                return Off;
+            if (equalIgnoringCase(attributeString, "on"))
+                return On;
+        }
+    }
+
+    return Default;
+}
+
+// Check if this is an input field that will be focused & require input support.
+bool isTextBasedContentEditableElement(Element* element)
+{
+    if (!element)
+        return false;
+
+    if (element->isReadOnlyFormControl())
+        return false;
+
+    if (isPopupInputField(element))
+        return false;
+
+    return element->isTextFormControl() || element->isContentEditable();
+}
+
+IntRect transformedBoundingBoxForRange(const Range& range)
+{
+    // Based on Range::boundingBox, which does not handle transforms, and
+    // RenderObject::absoluteBoundingBoxRect, which does.
+    IntRect result;
+    Vector<FloatQuad> quads;
+    visibleTextQuads(range, quads);
+    const size_t n = quads.size();
+    for (size_t i = 0; i < n; ++i)
+        result.unite(quads[i].enclosingBoundingBox());
+
+    return result;
+}
+
+VisibleSelection visibleSelectionForInputElement(Element* element)
+{
+    return visibleSelectionForRangeInputElement(element, 0, inputElementText(element).length());
+}
+
+VisibleSelection visibleSelectionForRangeInputElement(Element* element, int start, int end)
+{
+    if (DOMSupport::toTextControlElement(element)) {
+        RenderTextControl* textRender = toRenderTextControl(element->renderer());
+        if (!textRender)
+            return VisibleSelection();
+
+        VisiblePosition startPosition = textRender->visiblePositionForIndex(start);
+        VisiblePosition endPosition;
+        if (start == end)
+            endPosition = startPosition;
+        else
+            endPosition = textRender->visiblePositionForIndex(end);
+
+        return VisibleSelection(startPosition, endPosition);
+    }
+
+    // Must be content editable, generate the range.
+    RefPtr<Range> selectionRange = TextIterator::rangeFromLocationAndLength(element, start, end - start);
+    if (start == end)
+        return VisibleSelection(selectionRange.get()->startPosition(), DOWNSTREAM);
+
+    VisiblePosition visibleStart(selectionRange->startPosition(), DOWNSTREAM);
+    VisiblePosition visibleEnd(selectionRange->endPosition(), SEL_DEFAULT_AFFINITY);
+
+    return VisibleSelection(visibleStart, visibleEnd);
+}
+
+Node* DOMContainerNodeForPosition(const Position& position)
+{
+    Node* nodeAtPos = position.containerNode();
+    if (nodeAtPos->isInShadowTree())
+        nodeAtPos = nodeAtPos->shadowAncestorNode();
+
+    return nodeAtPos;
+}
+
+bool isPositionInNode(Node* node, const Position& position)
+{
+    int offset = 0;
+    Node* domNodeAtPos = DOMContainerNodeForPosition(position);
+    if (domNodeAtPos == position.containerNode())
+        offset = position.computeOffsetInContainerNode();
+
+    RefPtr<Range> rangeForNode = rangeOfContents(node);
+    int ec;
+
+    return rangeForNode->isPointInRange(domNodeAtPos, offset, ec);
+}
+
+// This is a Tristate return to allow us to override name matching when
+// autocomplete is expressly requested for a field. Default indicates
+// that the setting is On which is the default but not expressly requested
+// for the element being checked. On indicates that it is directly added
+// to the element.
+AttributeState elementSupportsAutocomplete(const Element* element)
+{
+    if (!element->hasTagName(HTMLNames::inputTag))
+        return Default;
+
+    const HTMLInputElement* inputElement = static_cast<const HTMLInputElement*>(element);
+    if (inputElement->fastHasAttribute(HTMLNames::autocompleteAttr)) {
+        if (equalIgnoringCase(inputElement->fastGetAttribute(HTMLNames::autocompleteAttr), "on"))
+            return On;
+    }
+
+    return inputElement->shouldAutocomplete() ? Default : Off;
+}
+
+bool matchesReservedStringPreventingAutocomplete(AtomicString& string)
+{
+    if (string.contains("email", false /* caseSensitive */)
+        || string.contains("user", false /* caseSensitive */)
+        || string.contains("name", false /* caseSensitive */)
+        || string.contains("login", false /* caseSensitive */))
+        return true;
+
+    return false;
+}
+
+// This checks to see if an input element has a name or id attribute set to
+// username or email. These are rough checks to avoid major sites that use
+// login fields as input type=text and auto correction interfers with.
+bool elementIdOrNameIndicatesNoAutocomplete(const Element* element)
+{
+    if (!element->hasTagName(HTMLNames::inputTag))
+        return false;
+
+    AtomicString idAttribute = element->getIdAttribute();
+    if (matchesReservedStringPreventingAutocomplete(idAttribute))
+        return true;
+
+    if (element->fastHasAttribute(HTMLNames::nameAttr)) {
+        AtomicString nameAttribute = element->fastGetAttribute(HTMLNames::nameAttr);
+        if (matchesReservedStringPreventingAutocomplete(nameAttribute))
+            return true;
+    }
+
+    return false;
+}
+
+IntPoint convertPointToFrame(const Frame* sourceFrame, const Frame* targetFrame, const IntPoint& point)
+{
+    ASSERT(sourceFrame && targetFrame);
+    if (sourceFrame == targetFrame)
+        return point;
+
+    ASSERT(sourceFrame->view() && targetFrame->view());
+    ASSERT(targetFrame->tree());
+
+    Frame* targetFrameParent = targetFrame->tree()->parent();
+    IntRect targetFrameRect = targetFrame->view()->frameRect();
+
+    // Convert the target frame rect to source window content coordinates. This is only required
+    // if the parent frame is not the source. If the parent is the source, subframeRect
+    // is already in source content coordinates.
+    if (targetFrameParent != sourceFrame)
+        targetFrameRect = sourceFrame->view()->windowToContents(targetFrameParent->view()->contentsToWindow(targetFrameRect));
+
+    // Requested point is outside of target frame, return InvalidPoint.
+    if (!targetFrameRect.contains(point))
+        return InvalidPoint;
+
+    // Adjust the points to be relative to the target.
+    return targetFrame->view()->windowToContents(sourceFrame->view()->contentsToWindow(point));
+}
+
+VisibleSelection visibleSelectionForClosestActualWordStart(const VisibleSelection& selection)
+{
+    // VisibleSelection validation has a special case when the caret is at the end of a paragraph where
+    // it selects the paragraph marker. As well, if the position is at the end of a word, it will select
+    // only the space between words. We want to select an actual word so we move the selection to
+    // the start of the leftmost word if the character after the selection point is whitespace.
+    if (selection.selectionType() != VisibleSelection::RangeSelection && isWhitespace(selection.visibleStart().characterAfter())) {
+        VisibleSelection leftSelection(previousWordPosition(selection.start()));
+        bool leftSelectionIsOnWord = !isWhitespace(leftSelection.visibleStart().characterAfter());
+
+        VisibleSelection rangeSelection(endOfWord(leftSelection.start()), selection.visibleStart());
+        int leftDistance = TextIterator::rangeLength(rangeSelection.toNormalizedRange().get());
+
+        VisibleSelection rightSelection(nextWordPosition(selection.start()));
+        rightSelection = previousWordPosition(rightSelection.start());
+        bool rightSelectionIsOnWord = !isWhitespace(rightSelection.visibleStart().characterAfter());
+
+        rangeSelection = VisibleSelection(rightSelection.visibleStart(), selection.visibleStart());
+        int rightDistance = TextIterator::rangeLength(rangeSelection.toNormalizedRange().get());
+
+        // Make sure we found an actual word. If not, return the original selection.
+        if (!leftSelectionIsOnWord && !rightSelectionIsOnWord)
+            return selection;
+
+        if (!rightSelectionIsOnWord || (leftSelectionIsOnWord && leftDistance < rightDistance)) {
+            // Left is closer or right is invalid.
+            return leftSelection;
+        }
+
+        // Right is closer or equal, or left was invalid.
+        return rightSelection;
+    }
+
+    // No adjustment required.
+    return selection;
+}
+
+} // DOMSupport
+} // WebKit
+} // BlackBerry
diff --git a/Source/WebKit/blackberry/WebKitSupport/DOMSupport.h b/Source/WebKit/blackberry/WebKitSupport/DOMSupport.h
new file mode 100644
index 000000000..1e0945189
--- /dev/null
+++ b/Source/WebKit/blackberry/WebKitSupport/DOMSupport.h
@@ -0,0 +1,85 @@
+/*
+ * Copyright (C) 2011, 2012 Research In Motion Limited. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+#ifndef DOMSupport_h
+#define DOMSupport_h
+
+#include "IntPoint.h"
+#include "IntRect.h"
+
+#include <wtf/Vector.h>
+
+namespace WTF {
+class String;
+}
+
+namespace WebCore {
+class Element;
+class FloatQuad;
+class Frame;
+class HTMLTextFormControlElement;
+class Node;
+class Position;
+class Range;
+class VisibleSelection;
+}
+
+namespace BlackBerry {
+namespace WebKit {
+namespace DOMSupport {
+
+enum AttributeState { On, Off, Default };
+
+bool isElementTypePlugin(const WebCore::Element*);
+
+bool isTextInputElement(WebCore::Element*);
+bool isTextBasedContentEditableElement(WebCore::Element*);
+bool isPasswordElement(const WebCore::Element*);
+
+bool isPopupInputField(const WebCore::Element*);
+bool isDateTimeInputField(const WebCore::Element*);
+bool isColorInputField(const WebCore::Element*);
+AttributeState elementSupportsAutocorrect(const WebCore::Element*);
+
+WTF::String inputElementText(WebCore::Element*);
+
+WebCore::HTMLTextFormControlElement* toTextControlElement(WebCore::Node*);
+
+WebCore::IntRect transformedBoundingBoxForRange(const WebCore::Range&);
+void visibleTextQuads(const WebCore::Range&, WTF::Vector<WebCore::FloatQuad>& quads, bool useSelectionHeight = false);
+
+WebCore::VisibleSelection visibleSelectionForRangeInputElement(WebCore::Element*, int start, int end);
+WebCore::VisibleSelection visibleSelectionForInputElement(WebCore::Element*);
+
+WebCore::Node* DOMContainerNodeForPosition(const WebCore::Position&);
+bool isPositionInNode(WebCore::Node*, const WebCore::Position&);
+
+AttributeState elementSupportsAutocomplete(const WebCore::Element*);
+bool elementIdOrNameIndicatesNoAutocomplete(const WebCore::Element*);
+
+WebCore::IntPoint convertPointToFrame(const WebCore::Frame* sourceFrame, const WebCore::Frame* targetFrame, const WebCore::IntPoint& sourcePoint);
+
+static const WebCore::IntPoint InvalidPoint = WebCore::IntPoint(-1, -1);
+
+WebCore::VisibleSelection visibleSelectionForClosestActualWordStart(const WebCore::VisibleSelection&);
+
+} // DOMSupport
+} // WebKit
+} // BlackBerry
+
+#endif // DOMSupport_h
diff --git a/Source/WebKit/blackberry/WebKitSupport/FatFingers.cpp b/Source/WebKit/blackberry/WebKitSupport/FatFingers.cpp
new file mode 100644
index 000000000..016a42620
--- /dev/null
+++ b/Source/WebKit/blackberry/WebKitSupport/FatFingers.cpp
@@ -0,0 +1,537 @@
+/*
+ * Copyright (C) 2010, 2011, 2012 Research In Motion Limited. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+#include "config.h"
+#include "FatFingers.h"
+
+#include "BlackBerryPlatformLog.h"
+#include "BlackBerryPlatformScreen.h"
+#include "BlackBerryPlatformSettings.h"
+#include "CSSComputedStyleDeclaration.h"
+#include "CSSParser.h"
+#include "DOMSupport.h"
+#include "Document.h"
+#include "Element.h"
+#include "EventNames.h"
+#include "ExceptionCode.h"
+#include "FloatQuad.h"
+#include "Frame.h"
+#include "FrameView.h"
+#include "HTMLFrameOwnerElement.h"
+#include "HTMLInputElement.h"
+#include "HTMLNames.h"
+#include "HTMLTextAreaElement.h"
+#include "Range.h"
+#include "RenderObject.h"
+#include "RenderView.h"
+#include "Text.h"
+#include "TextBreakIterator.h"
+#include "WebPage_p.h"
+
+#if DEBUG_FAT_FINGERS
+#include "BackingStore.h"
+#endif
+
+using BlackBerry::Platform::LogLevelInfo;
+using BlackBerry::Platform::log;
+using BlackBerry::Platform::IntRectRegion;
+using WTF::RefPtr;
+
+using namespace WebCore;
+
+// Lets make the top padding bigger than other directions, since it gets us more
+// accurate clicking results.
+
+namespace BlackBerry {
+namespace WebKit {
+
+#if DEBUG_FAT_FINGERS
+IntRect FatFingers::m_debugFatFingerRect;
+IntPoint FatFingers::m_debugFatFingerClickPosition;
+IntPoint FatFingers::m_debugFatFingerAdjustedPosition;
+#endif
+
+IntRect FatFingers::fingerRectForPoint(const IntPoint& point) const
+{
+    unsigned topPadding, rightPadding, bottomPadding, leftPadding;
+    getPaddings(topPadding, rightPadding, bottomPadding, leftPadding);
+
+    return HitTestResult::rectForPoint(point, topPadding, rightPadding, bottomPadding, leftPadding);
+}
+
+static bool hasMousePressListener(Element* element)
+{
+    ASSERT(element);
+    return element->hasEventListeners(eventNames().clickEvent)
+        || element->hasEventListeners(eventNames().mousedownEvent)
+        || element->hasEventListeners(eventNames().mouseupEvent);
+}
+
+bool FatFingers::isElementClickable(Element* element) const
+{
+    ASSERT(element);
+    ASSERT(m_matchingApproach != Done);
+    ASSERT(m_targetType == ClickableElement);
+
+    switch (m_matchingApproach) {
+    case ClickableByDefault: {
+        ExceptionCode ec = 0;
+        return element->webkitMatchesSelector("a[href],*:link,*:visited,*[role=button],button,input,select,label[for],area[href],textarea,embed,object", ec)
+            || element->isMediaControlElement()
+            || element->isContentEditable();
+    }
+    case MadeClickableByTheWebpage:
+
+        // Elements within a shadow DOM can not be 'made clickable by the webpage', since
+        // they are not accessible.
+        if (element->isInShadowTree())
+            return false;
+
+        // FIXME: We fall back to checking for the presence of CSS style "cursor: pointer" to indicate whether the element A
+        // can be clicked when A neither registers mouse events handlers nor is a hyperlink or form control. This workaround
+        // ensures that we don't break various Google web apps, including <http://maps.google.com>. Ideally, we should walk
+        // up the DOM hierarchy to determine the first parent element that accepts mouse events.
+        // Consider the HTML snippet: <div id="A" onclick="..."><div id="B">Example</div></div>
+        // Notice, B is not a hyperlink, or form control, and does not register any mouse event handler. Then B cannot
+        // be clicked. Suppose B specified the CSS property "cursor: pointer". Then, B will be considered as clickable.
+        return hasMousePressListener(element)
+            || computedStyle(element)->getPropertyValue(cssPropertyID("cursor")) == "pointer";
+    default:
+        ASSERT_NOT_REACHED();
+    }
+
+    return false;
+}
+
+// FIXME: Handle content editable nodes here too.
+static inline bool isFieldWithText(Node* node)
+{
+    ASSERT(node);
+    if (!node || !node->isElementNode())
+        return false;
+
+    Element* element = toElement(node);
+    return !DOMSupport::inputElementText(element).isEmpty();
+}
+
+static inline int distanceBetweenPoints(const IntPoint& p1, const IntPoint& p2)
+{
+    int dx = p1.x() - p2.x();
+    int dy = p1.y() - p2.y();
+    return sqrt((double)((dx * dx) + (dy * dy)));
+}
+
+static bool compareDistanceBetweenPoints(const Platform::IntPoint& p, const Platform::IntRectRegion& r1, const Platform::IntRectRegion& r2)
+{
+    return distanceBetweenPoints(p, r1.extents().center()) > distanceBetweenPoints(p, r2.extents().center());
+}
+
+static bool isValidFrameOwner(WebCore::Element* element)
+{
+    ASSERT(element);
+    return element->isFrameOwnerElement() && static_cast<HTMLFrameOwnerElement*>(element)->contentFrame();
+}
+
+// NOTE: 'contentPos' is in main frame contents coordinates.
+FatFingers::FatFingers(WebPagePrivate* webPage, const WebCore::IntPoint& contentPos, TargetType targetType)
+    : m_webPage(webPage)
+    , m_contentPos(contentPos)
+    , m_targetType(targetType)
+    , m_matchingApproach(Done)
+{
+    ASSERT(webPage);
+
+#if DEBUG_FAT_FINGERS
+    m_debugFatFingerRect = IntRect(0, 0, 0, 0);
+    m_debugFatFingerClickPosition = m_webPage->mapToTransformed(m_webPage->mapFromContentsToViewport(contentPos));
+    m_debugFatFingerAdjustedPosition = m_webPage->mapToTransformed(m_webPage->mapFromContentsToViewport(contentPos));
+#endif
+}
+
+FatFingers::~FatFingers()
+{
+}
+
+const FatFingersResult FatFingers::findBestPoint()
+{
+    ASSERT(m_webPage);
+    ASSERT(m_webPage->m_mainFrame);
+
+    m_cachedRectHitTestResults.clear();
+
+    FatFingersResult result(m_contentPos);
+    m_matchingApproach = ClickableByDefault;
+
+    // Lets set nodeUnderFatFinger to the result of a point based hit test here. If something
+    // targable is actually found by ::findIntersectingRegions, then we might replace what we just set below later on.
+    Element* elementUnderPoint;
+    Element* clickableElementUnderPoint;
+    getRelevantInfoFromPoint(m_webPage->m_mainFrame->document(), m_contentPos, elementUnderPoint, clickableElementUnderPoint);
+
+    if (elementUnderPoint) {
+        result.m_nodeUnderFatFinger = elementUnderPoint;
+
+        // If we are looking for a Clickable Element and we found one, we can quit early.
+        if (m_targetType == ClickableElement) {
+            if (clickableElementUnderPoint) {
+                setSuccessfulFatFingersResult(result, clickableElementUnderPoint, m_contentPos /*adjustedPosition*/);
+                return result;
+            }
+
+            if (isElementClickable(elementUnderPoint)) {
+                setSuccessfulFatFingersResult(result, elementUnderPoint, m_contentPos /*adjustedPosition*/);
+                return result;
+            }
+        }
+    }
+
+#if DEBUG_FAT_FINGERS
+    // Force blit to make the fat fingers rects show up.
+    if (!m_debugFatFingerRect.isEmpty())
+        m_webPage->m_backingStore->repaint(0, 0, m_webPage->transformedViewportSize().width(), m_webPage->transformedViewportSize().height(), true, true);
+#endif
+
+    Vector<IntersectingRegion> intersectingRegions;
+    Platform::IntRectRegion remainingFingerRegion = Platform::IntRectRegion(fingerRectForPoint(m_contentPos));
+
+    bool foundOne = findIntersectingRegions(m_webPage->m_mainFrame->document(), intersectingRegions, remainingFingerRegion);
+    if (!foundOne) {
+        m_matchingApproach = MadeClickableByTheWebpage;
+        remainingFingerRegion = Platform::IntRectRegion(fingerRectForPoint(m_contentPos));
+        foundOne = findIntersectingRegions(m_webPage->m_mainFrame->document(), intersectingRegions, remainingFingerRegion);
+    }
+
+    m_matchingApproach = Done;
+    m_cachedRectHitTestResults.clear();
+
+    if (!foundOne)
+        return result;
+
+    Node* bestNode = 0;
+    Platform::IntRectRegion largestIntersectionRegion;
+    IntPoint bestPoint;
+    int largestIntersectionRegionArea = 0;
+
+    Vector<IntersectingRegion>::const_iterator endIt = intersectingRegions.end();
+    for (Vector<IntersectingRegion>::const_iterator it = intersectingRegions.begin(); it != endIt; ++it) {
+        Node* currentNode = it->first;
+        Platform::IntRectRegion currentIntersectionRegion = it->second;
+
+        int currentIntersectionRegionArea = currentIntersectionRegion.area();
+        if (currentIntersectionRegionArea > largestIntersectionRegionArea
+            || (currentIntersectionRegionArea == largestIntersectionRegionArea
+            && compareDistanceBetweenPoints(m_contentPos, currentIntersectionRegion, largestIntersectionRegion))) {
+            bestNode = currentNode;
+            largestIntersectionRegion = currentIntersectionRegion;
+            largestIntersectionRegionArea = currentIntersectionRegionArea;
+        }
+    }
+
+    if (!bestNode || largestIntersectionRegion.isEmpty())
+        return result;
+
+#if DEBUG_FAT_FINGERS
+    m_debugFatFingerAdjustedPosition = m_webPage->mapToTransformed(m_webPage->mapFromContentsToViewport(largestIntersectionRegion.rects()[0].center()));
+#endif
+
+    setSuccessfulFatFingersResult(result, bestNode, largestIntersectionRegion.rects()[0].center() /*adjustedPosition*/);
+
+    return result;
+}
+
+// 'region' is in contents coordinates relative to the frame containing 'node'
+// 'remainingFingerRegion' and 'intersectingRegions' will always be in main frame contents
+// coordinates.
+// Thus, before comparing, we need to map the former to main frame contents coordinates.
+bool FatFingers::checkFingerIntersection(const Platform::IntRectRegion& region,
+                                         const Platform::IntRectRegion& remainingFingerRegion,
+                                         Node* node, Vector<IntersectingRegion>& intersectingRegions)
+{
+    ASSERT(node);
+
+    Platform::IntRectRegion regionCopy(region);
+    WebCore::IntPoint framePos(m_webPage->frameOffset(node->document()->frame()));
+    regionCopy.move(framePos.x(), framePos.y());
+
+    Platform::IntRectRegion intersection = intersectRegions(regionCopy, remainingFingerRegion);
+    if (intersection.isEmpty())
+        return false;
+
+#if DEBUG_FAT_FINGERS
+    String nodeName;
+    if (node->isTextNode())
+        nodeName = "text node";
+    else if (node->isElementNode())
+        nodeName = String::format("%s node", toElement(node)->tagName().latin1().data());
+    else
+        nodeName = "unknown node";
+    log(LogLevelInfo, "%s has region %s, intersecting at %s (area %d)", nodeName.latin1().data(),
+        regionCopy.toString().c_str(), intersection.toString().c_str(), intersection.area());
+#endif
+
+    intersectingRegions.append(std::make_pair(node, intersection));
+    return true;
+}
+
+
+// intersectingRegions and remainingFingerRegion are all in main frame contents coordinates,
+// even on recursive calls of ::findIntersectingRegions.
+bool FatFingers::findIntersectingRegions(Document* document,
+                                         Vector<IntersectingRegion>& intersectingRegions, Platform::IntRectRegion& remainingFingerRegion)
+{
+    if (!document || !document->frame()->view())
+        return false;
+
+    // The layout needs to be up-to-date to determine if a node is focusable.
+    document->updateLayoutIgnorePendingStylesheets();
+
+    // Create fingerRect.
+    IntPoint frameContentPos(document->frame()->view()->windowToContents(m_webPage->m_mainFrame->view()->contentsToWindow(m_contentPos)));
+
+#if DEBUG_FAT_FINGERS
+    IntRect fingerRect(fingerRectForPoint(frameContentPos));
+    IntRect screenFingerRect = m_webPage->mapToTransformed(fingerRect);
+    log(LogLevelInfo, "fat finger rect now %s", screenFingerRect.toString().latin1().data());
+
+    // only record the first finger rect
+    if (document == m_webPage->m_mainFrame->document())
+        m_debugFatFingerRect = m_webPage->mapToTransformed(m_webPage->mapFromContentsToViewport(fingerRect));
+#endif
+
+    bool foundOne = false;
+
+    RenderLayer* lowestPositionedEnclosingLayerSoFar = 0;
+
+    // Iterate over the list of nodes (and subrects of nodes where possible), for each saving the
+    // intersection of the bounding box with the finger rect.
+    ListHashSet<RefPtr<Node> > intersectedNodes;
+    getNodesFromRect(document, frameContentPos, intersectedNodes);
+
+    ListHashSet<RefPtr<Node> >::const_iterator it = intersectedNodes.begin();
+    ListHashSet<RefPtr<Node> >::const_iterator end = intersectedNodes.end();
+    for ( ; it != end; ++it) {
+        Node* curNode = (*it).get();
+        if (!curNode || !curNode->renderer())
+            continue;
+
+        if (remainingFingerRegion.isEmpty())
+            break;
+
+        bool isElement = curNode->isElementNode();
+        if (isElement && isValidFrameOwner(toElement(curNode))) {
+
+            HTMLFrameOwnerElement* owner = static_cast<HTMLFrameOwnerElement*>(curNode);
+            Document* childDocument = owner && owner->contentFrame() ? owner->contentFrame()->document() : 0;
+            if (!childDocument)
+                continue;
+
+            ASSERT(childDocument->frame()->view());
+
+            foundOne |= findIntersectingRegions(childDocument, intersectingRegions, remainingFingerRegion);
+        } else if (isElement && m_targetType == ClickableElement) {
+            foundOne |= checkForClickableElement(toElement(curNode), intersectingRegions, remainingFingerRegion, lowestPositionedEnclosingLayerSoFar);
+        } else if (m_targetType == Text)
+            foundOne |= checkForText(curNode, intersectingRegions, remainingFingerRegion);
+    }
+
+    return foundOne;
+}
+
+bool FatFingers::checkForClickableElement(Element* curElement,
+                                          Vector<IntersectingRegion>& intersectingRegions,
+                                          Platform::IntRectRegion& remainingFingerRegion,
+                                          RenderLayer*& lowestPositionedEnclosingLayerSoFar)
+{
+    ASSERT(curElement);
+
+    bool intersects = false;
+    Platform::IntRectRegion elementRegion;
+
+    bool isClickableElement = isElementClickable(curElement);
+    if (isClickableElement) {
+        if (curElement->isLink()) {
+            // Links can wrap lines, and in such cases Node::getRect() can give us
+            // not accurate rects, since it unites all InlineBox's rects. In these
+            // cases, we can process each line of the link separately with our
+            // intersection rect, getting a more accurate clicking.
+            Vector<FloatQuad> quads;
+            curElement->renderer()->absoluteFocusRingQuads(quads);
+
+            size_t n = quads.size();
+            ASSERT(n);
+
+            for (size_t i = 0; i < n; ++i)
+                elementRegion = unionRegions(elementRegion, Platform::IntRect(quads[i].enclosingBoundingBox()));
+        } else
+            elementRegion = Platform::IntRectRegion(curElement->renderer()->absoluteBoundingBoxRect(true /*use transforms*/));
+
+    } else
+        elementRegion = Platform::IntRectRegion(curElement->renderer()->absoluteBoundingBoxRect(true /*use transforms*/));
+
+    if (lowestPositionedEnclosingLayerSoFar) {
+        RenderLayer* curElementRenderLayer = m_webPage->enclosingPositionedAncestorOrSelfIfPositioned(curElement->renderer()->enclosingLayer());
+        if (curElementRenderLayer != lowestPositionedEnclosingLayerSoFar) {
+
+            // elementRegion will always be in contents coordinates of its container frame. It needs to be
+            // mapped to main frame contents coordinates in order to subtract the fingerRegion, then.
+            WebCore::IntPoint framePos(m_webPage->frameOffset(curElement->document()->frame()));
+            Platform::IntRectRegion layerRegion(Platform::IntRect(lowestPositionedEnclosingLayerSoFar->renderer()->absoluteBoundingBoxRect(true/*use transforms*/)));
+            layerRegion.move(framePos.x(), framePos.y());
+
+            remainingFingerRegion = subtractRegions(remainingFingerRegion, layerRegion);
+
+            lowestPositionedEnclosingLayerSoFar = curElementRenderLayer;
+        }
+    } else
+        lowestPositionedEnclosingLayerSoFar = m_webPage->enclosingPositionedAncestorOrSelfIfPositioned(curElement->renderer()->enclosingLayer());
+
+    if (isClickableElement)
+        intersects = checkFingerIntersection(elementRegion, remainingFingerRegion, curElement, intersectingRegions);
+
+    return intersects;
+}
+
+bool FatFingers::checkForText(Node* curNode, Vector<IntersectingRegion>& intersectingRegions, Platform::IntRectRegion& fingerRegion)
+{
+    ASSERT(curNode);
+    if (isFieldWithText(curNode)) {
+        // FIXME: Find all text in the field and find the best word.
+        // For now, we will just select the whole field.
+        IntRect boundingRect = curNode->renderer()->absoluteBoundingBoxRect(true /*use transforms*/);
+        Platform::IntRectRegion nodeRegion(boundingRect);
+        return checkFingerIntersection(nodeRegion, fingerRegion, curNode, intersectingRegions);
+    }
+
+    if (curNode->isTextNode()) {
+        WebCore::Text* curText = static_cast<WebCore::Text*>(curNode);
+        String allText = curText->wholeText();
+
+        // Iterate through all words, breaking at whitespace, to find the bounding box of each word.
+        TextBreakIterator* wordIterator = wordBreakIterator(allText.characters(), allText.length());
+
+        int lastOffset = textBreakFirst(wordIterator);
+        if (lastOffset == -1)
+            return false;
+
+        bool foundOne = false;
+        int offset;
+        Document* document = curNode->document();
+
+        while ((offset = textBreakNext(wordIterator)) != -1) {
+            RefPtr<Range> range = Range::create(document, curText, lastOffset, curText, offset);
+            if (!range->text().stripWhiteSpace().isEmpty()) {
+#if DEBUG_FAT_FINGERS
+                log(LogLevelInfo, "Checking word '%s'", range->text().latin1().data());
+#endif
+                Platform::IntRectRegion rangeRegion(DOMSupport::transformedBoundingBoxForRange(*range));
+                foundOne |= checkFingerIntersection(rangeRegion, fingerRegion, curNode, intersectingRegions);
+            }
+            lastOffset = offset;
+        }
+        return foundOne;
+    }
+    return false;
+}
+
+void FatFingers::getPaddings(unsigned& top, unsigned& right, unsigned& bottom, unsigned& left) const
+{
+    static unsigned topPadding = Platform::Settings::get()->topFatFingerPadding();
+    static unsigned rightPadding = Platform::Settings::get()->rightFatFingerPadding();
+    static unsigned bottomPadding = Platform::Settings::get()->bottomFatFingerPadding();
+    static unsigned leftPadding = Platform::Settings::get()->leftFatFingerPadding();
+
+    double currentScale = m_webPage->currentScale();
+    top = topPadding / currentScale;
+    right = rightPadding / currentScale;
+    bottom = bottomPadding / currentScale;
+    left = leftPadding / currentScale;
+}
+
+FatFingers::CachedResultsStrategy FatFingers::cachingStrategy() const
+{
+    switch (m_matchingApproach) {
+    case ClickableElement:
+        return GetFromRenderTree;
+    case MadeClickableByTheWebpage:
+        return GetFromCache;
+    case Done:
+    default:
+        ASSERT_NOT_REACHED();
+        return GetFromRenderTree;
+    }
+}
+
+void FatFingers::getNodesFromRect(Document* document, const IntPoint& contentPos, ListHashSet<RefPtr<WebCore::Node> >& intersectedNodes)
+{
+    FatFingers::CachedResultsStrategy cacheResolvingStrategy = cachingStrategy();
+
+    if (cacheResolvingStrategy == GetFromCache) {
+        ASSERT(m_cachedRectHitTestResults.contains(document));
+        intersectedNodes = m_cachedRectHitTestResults.get(document);
+        return;
+    }
+
+    ASSERT(cacheResolvingStrategy == GetFromRenderTree);
+
+    unsigned topPadding, rightPadding, bottomPadding, leftPadding;
+    getPaddings(topPadding, rightPadding, bottomPadding, leftPadding);
+
+    HitTestRequest request(HitTestRequest::ReadOnly | HitTestRequest::Active | HitTestRequest::IgnoreClipping);
+    HitTestResult result(contentPos, topPadding, rightPadding, bottomPadding, leftPadding, HitTestShadowDOM);
+
+    document->renderView()->layer()->hitTest(request, result);
+    intersectedNodes = result.rectBasedTestResult();
+    m_cachedRectHitTestResults.add(document, intersectedNodes);
+}
+
+void FatFingers::getRelevantInfoFromPoint(Document* document, const IntPoint& contentPos, Element*& elementUnderPoint, Element*& clickableElementUnderPoint) const
+{
+    elementUnderPoint = 0;
+    clickableElementUnderPoint = 0;
+
+    if (!document || !document->renderer() || !document->frame())
+        return;
+
+    HitTestResult result  = document->frame()->eventHandler()->hitTestResultAtPoint(contentPos, true /*allowShadowContent*/);
+    Node* node = result.innerNode();
+    while (node && !node->isElementNode())
+        node = node->parentNode();
+
+    elementUnderPoint = static_cast<Element*>(node);
+    clickableElementUnderPoint = result.URLElement();
+}
+
+void FatFingers::setSuccessfulFatFingersResult(FatFingersResult& result, Node* bestNode, const WebCore::IntPoint& adjustedPoint)
+{
+    result.m_nodeUnderFatFinger = bestNode;
+    result.m_adjustedPosition = adjustedPoint;
+    result.m_positionWasAdjusted = true;
+    result.m_isValid = true;
+
+    bool isTextInputElement = false;
+    if (m_targetType == ClickableElement) {
+        ASSERT(bestNode->isElementNode());
+        Element* bestElement = static_cast<Element*>(bestNode);
+        isTextInputElement = DOMSupport::isTextInputElement(bestElement);
+    }
+    result.m_isTextInput = isTextInputElement;
+}
+
+}
+}
+
diff --git a/Source/WebKit/blackberry/WebKitSupport/FatFingers.h b/Source/WebKit/blackberry/WebKitSupport/FatFingers.h
new file mode 100644
index 000000000..cb31f977a
--- /dev/null
+++ b/Source/WebKit/blackberry/WebKitSupport/FatFingers.h
@@ -0,0 +1,191 @@
+/*
+ * Copyright (C) 2010, 2011, 2012 Research In Motion Limited. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+#ifndef FatFingers_h
+#define FatFingers_h
+
+#include "HitTestResult.h"
+#include "RenderLayer.h"
+
+#include <BlackBerryPlatformIntRectRegion.h>
+
+#include <utility>
+
+#include <wtf/HashSet.h>
+#include <wtf/ListHashSet.h>
+#include <wtf/Vector.h>
+
+namespace WebCore {
+class Document;
+class Element;
+class IntPoint;
+class IntRect;
+class IntSize;
+class Node;
+}
+
+#define DEBUG_FAT_FINGERS 0
+
+namespace BlackBerry {
+namespace WebKit {
+
+class WebPagePrivate;
+class FatFingers;
+class TouchEventHandler;
+
+class FatFingersResult {
+public:
+
+    FatFingersResult(const WebCore::IntPoint& p = WebCore::IntPoint::zero())
+        : m_originalPosition(p)
+        , m_adjustedPosition(p)
+        , m_positionWasAdjusted(false)
+        , m_isTextInput(false)
+        , m_isValid(false)
+        , m_nodeUnderFatFinger(0)
+    {
+    }
+
+    void reset()
+    {
+        m_originalPosition = m_adjustedPosition = WebCore::IntPoint::zero();
+        m_positionWasAdjusted = false;
+        m_isTextInput = false;
+        m_isValid = false;
+        m_nodeUnderFatFinger = 0;
+    }
+
+    WebCore::IntPoint originPosition() const { return m_originalPosition; }
+    WebCore::IntPoint adjustedPosition() const { return m_adjustedPosition; }
+    bool positionWasAdjusted() const { return m_isValid && m_positionWasAdjusted; }
+    bool isTextInput() const { return m_isValid && !!m_nodeUnderFatFinger && m_isTextInput; }
+    bool isValid() const { return m_isValid; }
+
+    enum ContentType { ShadowContentAllowed, ShadowContentNotAllowed };
+
+    WebCore::Node* node(ContentType type = ShadowContentAllowed) const
+    {
+        if (!m_nodeUnderFatFinger || !m_nodeUnderFatFinger->inDocument())
+            return 0;
+
+        WebCore::Node* result = m_nodeUnderFatFinger.get();
+
+        if (type == ShadowContentAllowed)
+            return result;
+
+        // Shadow trees can be nested.
+        while (result->isInShadowTree())
+            result = toElement(result->shadowAncestorNode());
+
+        return result;
+    }
+
+    WebCore::Element* nodeAsElementIfApplicable(ContentType type = ShadowContentAllowed) const
+    {
+        WebCore::Node* result = node(type);
+        if (!result || !result->isElementNode())
+            return 0;
+
+        return static_cast<WebCore::Element*>(result);
+    }
+
+private:
+    friend class WebKit::FatFingers;
+    friend class WebKit::TouchEventHandler;
+
+    WebCore::IntPoint m_originalPosition; // Main frame contents coordinates.
+    WebCore::IntPoint m_adjustedPosition; // Main frame contents coordinates.
+    bool m_positionWasAdjusted;
+    bool m_isTextInput; // Check if the element under the touch point will require a VKB be displayed so that
+                        // the touch down can be suppressed.
+    bool m_isValid;
+    RefPtr<WebCore::Node> m_nodeUnderFatFinger;
+};
+
+class FatFingers {
+public:
+    enum TargetType { ClickableElement, Text };
+
+    FatFingers(WebPagePrivate* webpage, const WebCore::IntPoint& contentPos, TargetType);
+    ~FatFingers();
+
+    const FatFingersResult findBestPoint();
+
+#if DEBUG_FAT_FINGERS
+    // These debug vars are all in content coordinates. They are public so
+    // they can be read from BackingStore, which will draw a visible rect
+    // around the fat fingers area.
+    static WebCore::IntRect m_debugFatFingerRect;
+    static WebCore::IntPoint m_debugFatFingerClickPosition;
+    static WebCore::IntPoint m_debugFatFingerAdjustedPosition;
+#endif
+
+private:
+    enum MatchingApproachForClickable { ClickableByDefault = 0, MadeClickableByTheWebpage, Done };
+
+    typedef std::pair<WebCore::Node*, Platform::IntRectRegion> IntersectingRegion;
+
+    enum CachedResultsStrategy { GetFromRenderTree = 0, GetFromCache };
+    CachedResultsStrategy cachingStrategy() const;
+    typedef HashMap<RefPtr<WebCore::Document>, ListHashSet<RefPtr<WebCore::Node> > > CachedRectHitTestResults;
+
+    bool checkFingerIntersection(const Platform::IntRectRegion&,
+                                 const Platform::IntRectRegion& remainingFingerRegion,
+                                 WebCore::Node*,
+                                 Vector<IntersectingRegion>& intersectingRegions);
+
+    bool findIntersectingRegions(WebCore::Document*,
+                                 Vector<IntersectingRegion>& intersectingRegions,
+                                 Platform::IntRectRegion& remainingFingerRegion);
+
+    bool checkForClickableElement(WebCore::Element*,
+                                  Vector<IntersectingRegion>& intersectingRegions,
+                                  Platform::IntRectRegion& remainingFingerRegion,
+                                  WebCore::RenderLayer*& lowestPositionedEnclosingLayerSoFar);
+
+    bool checkForText(WebCore::Node*,
+                      Vector<IntersectingRegion>& intersectingRegions,
+                      Platform::IntRectRegion& fingerRegion);
+
+    void setSuccessfulFatFingersResult(FatFingersResult&, WebCore::Node*, const WebCore::IntPoint&);
+
+    void getNodesFromRect(WebCore::Document*, const WebCore::IntPoint&, ListHashSet<RefPtr<WebCore::Node> >&);
+
+    // It mimics Document::elementFromPoint, but recursively hit-tests in case an inner frame is found.
+    void getRelevantInfoFromPoint(WebCore::Document*,
+                                  const WebCore::IntPoint&,
+                                  WebCore::Element*& elementUnderPoint,
+                                  WebCore::Element*& clickableElementUnderPoint) const;
+
+    bool isElementClickable(WebCore::Element*) const;
+
+    inline WebCore::IntRect fingerRectForPoint(const WebCore::IntPoint&) const;
+    void getPaddings(unsigned& top, unsigned& right, unsigned& bottom, unsigned& left) const;
+
+    WebPagePrivate* m_webPage;
+    WebCore::IntPoint m_contentPos;
+    TargetType m_targetType;
+    MatchingApproachForClickable m_matchingApproach;
+    CachedRectHitTestResults m_cachedRectHitTestResults;
+};
+
+}
+}
+
+#endif // FatFingers_h
+
diff --git a/Source/WebKit/blackberry/WebKitSupport/GLES2Context.cpp b/Source/WebKit/blackberry/WebKitSupport/GLES2Context.cpp
new file mode 100644
index 000000000..55b9e15dd
--- /dev/null
+++ b/Source/WebKit/blackberry/WebKitSupport/GLES2Context.cpp
@@ -0,0 +1,121 @@
+/*
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ * Copyright (C) 2010, 2011, 2012 Research In Motion Limited. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "GLES2Context.h"
+
+#include "Assertions.h"
+#include "BackingStoreCompositingSurface.h"
+#include "Chrome.h"
+#include "ChromeClient.h"
+#include "SurfacePool.h"
+#include "WebPageClient.h"
+#include "WebPage_p.h"
+
+#include <GLES2/gl2.h>
+
+namespace BlackBerry {
+namespace WebKit {
+
+BackingStoreCompositingSurface* GLES2Context::compositingSurface() const
+{
+    return SurfacePool::globalSurfacePool()->compositingSurface();
+}
+
+Platform::Graphics::Buffer* GLES2Context::buffer() const
+{
+    if (m_window)
+        return m_window->buffer();
+
+#if ENABLE_COMPOSITING_SURFACE
+    if (BackingStoreCompositingSurface* surface = compositingSurface())
+        return surface->backBuffer()->nativeBuffer();
+#endif
+
+    ASSERT_NOT_REACHED();
+    return 0;
+}
+
+PassOwnPtr<GLES2Context> GLES2Context::create(WebPagePrivate* page)
+{
+    return adoptPtr(new GLES2Context(page));
+}
+
+GLES2Context::GLES2Context(WebPagePrivate* page)
+    : m_window(0)
+{
+    if (page->m_client->window()->windowUsage() == Platform::Graphics::Window::GLES2Usage)
+        m_window = page->m_client->window();
+}
+
+GLES2Context::~GLES2Context()
+{
+}
+
+Platform::IntSize GLES2Context::surfaceSize() const
+{
+    if (m_window)
+        return m_window->surfaceSize();
+
+#if ENABLE_COMPOSITING_SURFACE
+    if (BackingStoreCompositingSurface* surface = compositingSurface())
+        return surface->backBuffer()->surfaceSize();
+#endif
+
+    ASSERT_NOT_REACHED();
+    return Platform::IntSize();
+}
+
+bool GLES2Context::makeCurrent()
+{
+    Platform::Graphics::makeBufferCurrent(buffer(), Platform::Graphics::GLES2);
+    return true;
+}
+
+bool GLES2Context::swapBuffers()
+{
+    ASSERT(glGetError() == GL_NO_ERROR);
+
+#if ENABLE_COMPOSITING_SURFACE
+    // Because we are rendering compositing contents into an off-screen pixmap and
+    // we need to blend the pixmap with the web page window surface we have to call
+    // glFinish() here.
+    glFinish();
+
+    if (BackingStoreCompositingSurface* surface = compositingSurface())
+        surface->swapBuffers();
+#endif
+
+    return true;
+}
+
+} // namespace WebKit
+} // namespace BlackBerry
diff --git a/Source/WebKit/blackberry/WebKitSupport/GLES2Context.h b/Source/WebKit/blackberry/WebKitSupport/GLES2Context.h
new file mode 100644
index 000000000..ce7e84694
--- /dev/null
+++ b/Source/WebKit/blackberry/WebKitSupport/GLES2Context.h
@@ -0,0 +1,66 @@
+/*
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ * Copyright (C) 2010, 2011, 2012 Research In Motion Limited. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef GLES2Context_h
+#define GLES2Context_h
+
+#include <BlackBerryPlatformGLES2Context.h>
+#include <BlackBerryPlatformWindow.h>
+#include <wtf/Noncopyable.h>
+#include <wtf/PassOwnPtr.h>
+
+namespace BlackBerry {
+namespace WebKit {
+
+class BackingStoreCompositingSurface;
+class WebPagePrivate;
+
+class GLES2Context : public Platform::Graphics::GLES2Context {
+    WTF_MAKE_NONCOPYABLE(GLES2Context);
+public:
+    static PassOwnPtr<GLES2Context> create(WebPagePrivate*);
+    ~GLES2Context();
+    Platform::IntSize surfaceSize() const;
+    bool makeCurrent();
+    bool swapBuffers();
+
+private:
+    GLES2Context(WebPagePrivate*);
+    BackingStoreCompositingSurface* compositingSurface() const;
+    Platform::Graphics::Buffer* buffer() const;
+
+    Platform::Graphics::Window* m_window;
+};
+
+} // namespace WebKit
+} // namespace BlackBerry
+
+#endif
diff --git a/Source/WebKit/blackberry/WebKitSupport/InPageSearchManager.cpp b/Source/WebKit/blackberry/WebKitSupport/InPageSearchManager.cpp
new file mode 100644
index 000000000..ae0402100
--- /dev/null
+++ b/Source/WebKit/blackberry/WebKitSupport/InPageSearchManager.cpp
@@ -0,0 +1,93 @@
+/*
+ * Copyright (C) 2012 Research In Motion Limited. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+#include "config.h"
+#include "InPageSearchManager.h"
+
+#include "Document.h"
+#include "DocumentMarkerController.h"
+#include "Editor.h"
+#include "Frame.h"
+#include "Page.h"
+#include "WebPage_p.h"
+
+static const int TextMatchMarkerLimit = 100;
+
+using namespace WebCore;
+
+namespace BlackBerry {
+namespace WebKit {
+
+InPageSearchManager::InPageSearchManager(WebPagePrivate* page)
+    : m_webPage(page)
+    , m_activeMatch(0)
+{
+}
+
+InPageSearchManager::~InPageSearchManager()
+{
+}
+
+bool InPageSearchManager::findNextString(const String& text, bool forward)
+{
+    if (!text.length()) {
+        clearTextMatches();
+        m_activeSearchString = String();
+        return false;
+    }
+
+    if (m_activeSearchString != text) {
+        clearTextMatches();
+        m_activeSearchString = text;
+        m_activeMatchCount = m_webPage->m_page->markAllMatchesForText(text, WebCore::CaseInsensitive, true, TextMatchMarkerLimit);
+    } else
+        setMarkerActive(m_activeMatch.get(), false);
+
+    if (!m_activeMatchCount)
+        return false;
+
+    const FindOptions findOptions = (forward ? 0 : WebCore::Backwards)
+        | WebCore::CaseInsensitive
+        | WebCore::WrapAround; // TODO should wrap around in page, not in frame
+
+    // TODO StartInSelection
+
+    m_activeMatch = m_webPage->mainFrame()->editor()->findStringAndScrollToVisible(text, m_activeMatch.get(), findOptions);
+    setMarkerActive(m_activeMatch.get(), true);
+
+    return true;
+}
+
+void InPageSearchManager::clearTextMatches()
+{
+    m_webPage->m_page->unmarkAllTextMatches();
+    m_activeMatch = 0;
+}
+
+void InPageSearchManager::setMarkerActive(WebCore::Range* range, bool active)
+{
+    if (!range)
+        return;
+    WebCore::Document* doc = m_webPage->mainFrame()->document();
+    if (!doc)
+        return;
+    doc->markers()->setMarkersActive(range, active);
+}
+
+}
+}
diff --git a/Source/WebKit/blackberry/WebKitSupport/InPageSearchManager.h b/Source/WebKit/blackberry/WebKitSupport/InPageSearchManager.h
new file mode 100644
index 000000000..1f6bbb535
--- /dev/null
+++ b/Source/WebKit/blackberry/WebKitSupport/InPageSearchManager.h
@@ -0,0 +1,56 @@
+/*
+ * Copyright (C) 2012 Research In Motion Limited. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+#ifndef InPageSearchManager_h
+#define InPageSearchManager_h
+
+#include "WTFString.h"
+
+#include <wtf/RefPtr.h>
+
+namespace WebCore {
+class Range;
+}
+
+namespace BlackBerry {
+
+namespace WebKit {
+
+class WebPagePrivate;
+
+class InPageSearchManager {
+public:
+    InPageSearchManager(WebPagePrivate*);
+    ~InPageSearchManager();
+
+    bool findNextString(const String& text, bool forward);
+
+private:
+    void clearTextMatches();
+    void setMarkerActive(WebCore::Range*, bool active);
+
+    WebPagePrivate* m_webPage;
+    RefPtr<WebCore::Range> m_activeMatch;
+    String m_activeSearchString;
+    int m_activeMatchCount;
+};
+
+}
+}
+
+#endif // InPageSearchManager_h
diff --git a/Source/WebKit/blackberry/WebKitSupport/InRegionScrollableArea.cpp b/Source/WebKit/blackberry/WebKitSupport/InRegionScrollableArea.cpp
new file mode 100644
index 000000000..5eac31a30
--- /dev/null
+++ b/Source/WebKit/blackberry/WebKitSupport/InRegionScrollableArea.cpp
@@ -0,0 +1,138 @@
+/*
+ * Copyright (C) 2011, 2012 Research In Motion Limited. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+#include "config.h"
+#include "InRegionScrollableArea.h"
+
+#include "Frame.h"
+#include "NotImplemented.h"
+#include "RenderBox.h"
+#include "RenderLayer.h"
+#include "RenderObject.h"
+#include "RenderView.h"
+#include "WebPage_p.h"
+
+using namespace WebCore;
+
+namespace BlackBerry {
+namespace WebKit {
+
+InRegionScrollableArea::InRegionScrollableArea()
+    : m_webPage(0)
+    , m_layer(0)
+{
+}
+
+InRegionScrollableArea::InRegionScrollableArea(WebPagePrivate* webPage, RenderLayer* layer)
+    : m_webPage(webPage)
+    , m_layer(layer)
+{
+    ASSERT(webPage);
+    ASSERT(layer);
+    m_isNull = false;
+
+    // FIXME: Add an ASSERT here as the 'layer' must be scrollable.
+
+    RenderObject* layerRenderer = layer->renderer();
+    ASSERT(layerRenderer);
+
+    if (layerRenderer->isRenderView()) { // #document case
+
+        FrameView* view = toRenderView(layerRenderer)->frameView();
+        ASSERT(view);
+
+        Frame* frame = view->frame();
+        ASSERT_UNUSED(frame, frame);
+
+        m_scrollPosition = m_webPage->mapToTransformed(view->scrollPosition());
+        m_contentsSize = m_webPage->mapToTransformed(view->contentsSize());
+        m_viewportRect = m_webPage->mapToTransformed(view->visibleContentRect(false /*includeScrollbars*/));
+
+        m_visibleWindowRect = m_webPage->mapToTransformed(m_webPage->getRecursiveVisibleWindowRect(view));
+        IntRect transformedWindowRect = IntRect(IntPoint::zero(), m_webPage->transformedViewportSize());
+        m_visibleWindowRect.intersect(transformedWindowRect);
+
+        m_scrollsHorizontally = view->contentsWidth() > view->visibleWidth();
+        m_scrollsVertically = view->contentsHeight() > view->visibleHeight();
+
+        m_minimumScrollPosition = m_webPage->mapToTransformed(calculateMinimumScrollPosition(
+            view->visibleContentRect().size(),
+            0.0 /*overscrollLimit*/));
+        m_maximumScrollPosition = m_webPage->mapToTransformed(calculateMaximumScrollPosition(
+            view->visibleContentRect().size(),
+            view->contentsSize(),
+            0.0 /*overscrollLimit*/));
+
+    } else { // RenderBox-based elements case (scrollable boxes (div's, p's, textarea's, etc)).
+
+        RenderBox* box = m_layer->renderBox();
+        ASSERT(box);
+        ASSERT(box->canBeScrolledAndHasScrollableArea());
+
+        ScrollableArea* scrollableArea = static_cast<ScrollableArea*>(m_layer);
+        m_scrollPosition = m_webPage->mapToTransformed(scrollableArea->scrollPosition());
+        m_contentsSize = m_webPage->mapToTransformed(scrollableArea->contentsSize());
+        m_viewportRect = m_webPage->mapToTransformed(scrollableArea->visibleContentRect(false /*includeScrollbars*/));
+
+        m_visibleWindowRect = m_layer->renderer()->absoluteClippedOverflowRect();
+        m_visibleWindowRect = m_layer->renderer()->frame()->view()->contentsToWindow(m_visibleWindowRect);
+        IntRect visibleFrameWindowRect = m_webPage->getRecursiveVisibleWindowRect(m_layer->renderer()->frame()->view());
+        m_visibleWindowRect.intersect(visibleFrameWindowRect);
+        m_visibleWindowRect = m_webPage->mapToTransformed(m_visibleWindowRect);
+        IntRect transformedWindowRect = IntRect(IntPoint::zero(), m_webPage->transformedViewportSize());
+        m_visibleWindowRect.intersect(transformedWindowRect);
+
+        m_scrollsHorizontally = box->scrollWidth() != box->clientWidth() && box->scrollsOverflowX();
+        m_scrollsVertically = box->scrollHeight() != box->clientHeight() && box->scrollsOverflowY();
+
+        m_minimumScrollPosition = m_webPage->mapToTransformed(calculateMinimumScrollPosition(
+            Platform::IntSize(box->clientWidth(), box->clientHeight()),
+            0.0 /*overscrollLimit*/));
+        m_maximumScrollPosition = m_webPage->mapToTransformed(calculateMaximumScrollPosition(
+            Platform::IntSize(box->clientWidth(), box->clientHeight()),
+            Platform::IntSize(box->scrollWidth(), box->scrollHeight()),
+            0.0 /*overscrollLimit*/));
+    }
+}
+
+Platform::IntPoint InRegionScrollableArea::calculateMinimumScrollPosition(const Platform::IntSize& viewportSize, float overscrollLimitFactor) const
+{
+    // FIXME: Eventually we should support overscroll like iOS5 does.
+    ASSERT(!allowsOverscroll());
+
+    return Platform::IntPoint(-(viewportSize.width() * overscrollLimitFactor),
+                              -(viewportSize.height() * overscrollLimitFactor));
+}
+
+Platform::IntPoint InRegionScrollableArea::calculateMaximumScrollPosition(const Platform::IntSize& viewportSize, const Platform::IntSize& contentsSize, float overscrollLimitFactor) const
+{
+    // FIXME: Eventually we should support overscroll like iOS5 does.
+    ASSERT(!allowsOverscroll());
+
+    return Platform::IntPoint(std::max(contentsSize.width() - viewportSize.width(), 0) + overscrollLimitFactor,
+                              std::max(contentsSize.height() - viewportSize.height(), 0) + overscrollLimitFactor);
+}
+
+RenderLayer* InRegionScrollableArea::layer() const
+{
+    ASSERT(!m_isNull);
+    return m_layer;
+}
+}
+
+}
diff --git a/Source/WebKit/blackberry/WebKitSupport/InRegionScrollableArea.h b/Source/WebKit/blackberry/WebKitSupport/InRegionScrollableArea.h
new file mode 100644
index 000000000..9467b9bc5
--- /dev/null
+++ b/Source/WebKit/blackberry/WebKitSupport/InRegionScrollableArea.h
@@ -0,0 +1,53 @@
+/*
+ * Copyright (C) 2011, 2012 Research In Motion Limited. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+#ifndef InRegionScrollableArea_h
+#define InRegionScrollableArea_h
+
+#include <BlackBerryPlatformPrimitives.h>
+#include <interaction/ScrollViewBase.h>
+
+namespace WebCore {
+class RenderLayer;
+}
+
+namespace BlackBerry {
+namespace WebKit {
+
+class WebPagePrivate;
+
+class InRegionScrollableArea : public Platform::ScrollViewBase {
+public:
+
+    InRegionScrollableArea();
+    InRegionScrollableArea(WebPagePrivate*, WebCore::RenderLayer*);
+
+    WebCore::RenderLayer* layer() const;
+
+private:
+    Platform::IntPoint calculateMinimumScrollPosition(const Platform::IntSize& viewportSize, float overscrollLimitFactor) const;
+    Platform::IntPoint calculateMaximumScrollPosition(const Platform::IntSize& viewportSize, const Platform::IntSize& contentsSize, float overscrollLimitFactor) const;
+
+    WebPagePrivate* m_webPage;
+    WebCore::RenderLayer* m_layer;
+};
+
+}
+}
+
+#endif
diff --git a/Source/WebKit/blackberry/WebKitSupport/InputHandler.cpp b/Source/WebKit/blackberry/WebKitSupport/InputHandler.cpp
index ad555dae7..27b941e6f 100644
--- a/Source/WebKit/blackberry/WebKitSupport/InputHandler.cpp
+++ b/Source/WebKit/blackberry/WebKitSupport/InputHandler.cpp
@@ -110,11 +110,13 @@ InputHandler::InputHandler(WebPagePrivate* page)
     : m_webPage(page)
     , m_currentFocusElement(0)
     , m_processingChange(false)
-    , m_navigationMode(false)
+    , m_changingFocus(false)
     , m_currentFocusElementType(TextEdit)
     , m_currentFocusElementTextEditMask(DEFAULT_STYLE)
     , m_composingTextStart(0)
     , m_composingTextEnd(0)
+    , m_pendingKeyboardVisibilityChange(NoChange)
+    , m_delayKeyboardVisibilityChange(false)
 {
 }
 
@@ -223,7 +225,7 @@ BlackBerryInputType InputHandler::elementType(Element* element) const
 void InputHandler::nodeFocused(Node* node)
 {
     if (isActiveTextEdit() && m_currentFocusElement == node) {
-        setNavigationMode(true);
+        notifyClientOfKeyboardVisibilityChange(true);
         return;
     }
 
@@ -391,10 +393,10 @@ void InputHandler::setElementUnfocused(bool refocusOccuring)
         // End any composition that is in progress.
         finishComposition();
 
-        // Send change notifications. Only cancel navigation mode if we are not
-        // refocusing to avoid flashing the keyboard when switching between two
-        // input fields.
-        setNavigationMode(false, !refocusOccuring);
+        // Only hide the keyboard if we aren't refocusing on a new input field.
+        if (!refocusOccuring)
+            notifyClientOfKeyboardVisibilityChange(false);
+
         m_webPage->m_client->inputFocusLost();
         m_webPage->m_selectionHandler->selectionPositionChanged();
     }
@@ -410,29 +412,37 @@ bool InputHandler::shouldAcceptInputFocus()
     if (m_webPage->m_dumpRenderTree)
         return true;
 
-    if (BlackBerry::Platform::Settings::get()->alwaysShowKeyboardOnFocus())
+    if (BlackBerry::Platform::Settings::get()->alwaysShowKeyboardOnFocus()) {
+        FocusLog(BlackBerry::Platform::LogLevelInfo, "InputHandler::shouldAcceptInputFocus alwaysShowKeyboardOnFocus is active.");
         return true;
+    }
 
-    Frame* mainFrame = m_webPage->m_page->mainFrame();
     Frame* focusedFrame = m_webPage->focusedOrMainFrame();
-    if (mainFrame && mainFrame->document() && focusedFrame && focusedFrame->document()) {
-        // Any user action should be respected. Mouse will be down when touch is
-        // used to focus.
-        if (focusedFrame->eventHandler()->mousePressed())
-            return true;
+    if (!focusedFrame) {
+        FocusLog(BlackBerry::Platform::LogLevelInfo, "InputHandler::shouldAcceptInputFocus Frame not valid.");
+        return false;
+    }
 
-        // Make sure the main frame is not still loading.
-        if (mainFrame->loader()->isLoading())
-            return false;
+    // Any user action should be respected. Mouse will be down when touch is
+    // used to focus.
+    if (focusedFrame->eventHandler()->mousePressed()) {
+        FocusLog(BlackBerry::Platform::LogLevelInfo, "InputHandler::shouldAcceptInputFocus Mouse is pressed focusing.");
+        return true;
+    }
 
-        // Make sure the focused frame is loaded.
-        if (!focusedFrame->loader()->frameHasLoaded())
-            return false;
+    if (!m_webPage->m_client->hasKeyboardFocus()) {
+        FocusLog(BlackBerry::Platform::LogLevelInfo, "InputHandler::shouldAcceptInputFocus Client does not have input focus.");
+        return false;
+    }
 
-        // Make sure the focused frame is not processing load events.
-        return !focusedFrame->document()->processingLoadEvent();
+    if (m_webPage->isLoading()) {
+        FocusLog(BlackBerry::Platform::LogLevelInfo, "InputHandler::shouldAcceptInputFocus Webpage is loading.");
+        return false;
     }
-    return false;
+
+    // Make sure the focused frame is not processing load events.
+    FocusLog(BlackBerry::Platform::LogLevelInfo, "InputHandler::shouldAcceptInputFocus returning state of processingLoadEvent (%s).", !focusedFrame->document()->processingLoadEvent() ? "true" : "false");
+    return !focusedFrame->document()->processingLoadEvent();
 }
 
 void InputHandler::setElementFocused(Element* element)
@@ -440,9 +450,15 @@ void InputHandler::setElementFocused(Element* element)
     ASSERT(DOMSupport::isTextBasedContentEditableElement(element));
     ASSERT(element->document() && element->document()->frame());
 
-    if (!shouldAcceptInputFocus()) {
-        // Remove the focus from this element.
+    if (!m_changingFocus && !shouldAcceptInputFocus()) {
+        // Remove the focus from this element, but guard against recursion by
+        // allowing a refocus during the blur to continue.
+        // THIS IS A HACK that needs to be fixed. Instead of blur the field,
+        // the frame or frame selection should be blurred. Google bypasses these
+        // though so it can't be done right now.
+        m_changingFocus = true;
         element->blur();
+        m_changingFocus = false;
         return;
     }
 
@@ -459,8 +475,9 @@ void InputHandler::setElementFocused(Element* element)
 
     FocusLog(BlackBerry::Platform::LogLevelInfo, "InputHandler::setElementFocused, Type=%d, Style=%d", type, m_currentFocusElementTextEditMask);
 
-    m_webPage->m_client->inputFocusGained(type, m_currentFocusElementTextEditMask);
-    m_navigationMode = true;
+    m_webPage->m_client->inputFocusGained(type,
+                                          m_currentFocusElementTextEditMask,
+                                          m_delayKeyboardVisibilityChange /* wait for explicit keyboard show call */);
 
     handleInputLocaleChanged(m_webPage->m_webSettings->isWritingDirectionRTL());
 }
@@ -528,7 +545,7 @@ void InputHandler::nodeTextChanged(const Node* node)
 
 void InputHandler::ensureFocusTextElementVisible(CaretScrollType scrollType)
 {
-    if (!m_currentFocusElement || !m_navigationMode || !m_currentFocusElement->document())
+    if (!m_currentFocusElement || !m_currentFocusElement->document())
         return;
 
     if (!BlackBerry::Platform::Settings::get()->allowCenterScrollAdjustmentForInputFields() && scrollType != EdgeIfNeeded)
@@ -706,34 +723,36 @@ void InputHandler::frameUnloaded(Frame* frame)
     setElementUnfocused(false /*refocusOccuring*/);
 }
 
-void InputHandler::setNavigationMode(bool active, bool sendMessage)
+void InputHandler::setDelayKeyboardVisibilityChange(bool value)
 {
-    if (active && !isActiveTextEdit()) {
-        if (!m_navigationMode)
-            return;
+    m_delayKeyboardVisibilityChange = value;
+    m_pendingKeyboardVisibilityChange = NoChange;
+}
 
-        // We can't be active if there is no element. Send out notification that we
-        // aren't in navigation mode.
-        active = false;
+void InputHandler::processPendingKeyboardVisibilityChange()
+{
+    if (!m_delayKeyboardVisibilityChange) {
+        ASSERT(m_pendingKeyboardVisibilityChange == NoChange);
+        return;
     }
 
-    // Don't send the change if it's setting the event setting navigationMode true
-    // if we are already in navigation mode and this is a navigation move event.
-    // We need to send the event when it's triggered by a touch event or mouse
-    // event to allow display of the VKB, but do not want to send it when it's
-    // triggered by a navigation event as it has no effect.
-    // Touch events are simulated as mouse events so mousePressed will be active
-    // when it is a re-entry event.
-    // See RIM Bugs #369 & #878.
-    if (active && active == m_navigationMode && !m_webPage->m_mainFrame->eventHandler()->mousePressed())
+    m_delayKeyboardVisibilityChange = false;
+
+    if (m_pendingKeyboardVisibilityChange == NoChange)
         return;
 
-    m_navigationMode = active;
+    notifyClientOfKeyboardVisibilityChange(m_pendingKeyboardVisibilityChange == Visible);
+    m_pendingKeyboardVisibilityChange = NoChange;
+}
 
-    InputLog(BlackBerry::Platform::LogLevelInfo, "InputHandler::setNavigationMode %s, %s", active ? "true" : "false", sendMessage ? "message sent" : "message not sent");
+void InputHandler::notifyClientOfKeyboardVisibilityChange(bool visible)
+{
+    if (!m_delayKeyboardVisibilityChange) {
+        m_webPage->showVirtualKeyboard(visible);
+        return;
+    }
 
-    if (sendMessage)
-        m_webPage->m_client->inputSetNavigationMode(active);
+    m_pendingKeyboardVisibilityChange = visible ? Visible : NotVisible;
 }
 
 bool InputHandler::selectionAtStartOfElement()
@@ -856,7 +875,7 @@ WebCore::IntRect InputHandler::rectForCaret(int index)
 
     ASSERT(m_currentFocusElement->document() && m_currentFocusElement->document()->frame());
 
-    if (index < 0 || index > elementText().length()) {
+    if (index < 0 || index > static_cast<int>(elementText().length())) {
         // Invalid request.
         return WebCore::IntRect();
     }
@@ -920,68 +939,6 @@ bool InputHandler::handleKeyboardInput(const BlackBerry::Platform::KeyboardEvent
     return keyboardEventHandled;
 }
 
-bool InputHandler::handleNavigationMove(unsigned short character, bool shiftDown, bool altDown, bool canExitField)
-{
-    InputLog(BlackBerry::Platform::LogLevelInfo, "InputHandler::handleNavigationMove received character=%lc", character);
-
-    bool eventHandled = false;
-    ASSERT(m_webPage->m_page->focusController());
-    if (Frame* focusedFrame = m_webPage->m_page->focusController()->focusedFrame()) {
-        // If alt is down, do not break out of the field.
-        if (canExitField && !altDown) {
-            if ((character == KEYCODE_LEFT || character == KEYCODE_UP) && selectionAtStartOfElement()
-                || (character == KEYCODE_RIGHT || character == KEYCODE_DOWN) && selectionAtEndOfElement()) {
-                setNavigationMode(false);
-                return true;
-            }
-        }
-
-        switch (character) {
-        case KEYCODE_LEFT:
-            if (altDown && shiftDown)
-                eventHandled = focusedFrame->editor()->command("MoveToBeginningOfLineAndModifySelection").execute();
-            else if (altDown)
-                eventHandled = focusedFrame->editor()->command("MoveToBeginningOfLine").execute();
-            else if (shiftDown)
-                eventHandled = focusedFrame->editor()->command("MoveLeftAndModifySelection").execute();
-            else
-                eventHandled = focusedFrame->editor()->command("MoveLeft").execute();
-            break;
-        case KEYCODE_RIGHT:
-            if (altDown && shiftDown)
-                eventHandled = focusedFrame->editor()->command("MoveToEndOfLineAndModifySelection").execute();
-            else if (altDown)
-                eventHandled = focusedFrame->editor()->command("MoveToEndOfLine").execute();
-            else if (shiftDown)
-                eventHandled = focusedFrame->editor()->command("MoveRightAndModifySelection").execute();
-            else
-                eventHandled = focusedFrame->editor()->command("MoveRight").execute();
-            break;
-        case KEYCODE_UP:
-            if (altDown && shiftDown)
-                eventHandled = focusedFrame->editor()->command("MoveToBeginningOfDocumentAndModifySelection").execute();
-            else if (altDown)
-                eventHandled = focusedFrame->editor()->command("MoveToBeginningOfDocument").execute();
-            else if (shiftDown)
-                eventHandled = focusedFrame->editor()->command("MoveUpAndModifySelection").execute();
-            else
-                eventHandled = focusedFrame->editor()->command("MoveUp").execute();
-            break;
-        case KEYCODE_DOWN:
-            if (altDown && shiftDown)
-                eventHandled = focusedFrame->editor()->command("MoveToEndOfDocumentAndModifySelection").execute();
-            else if (altDown)
-                eventHandled = focusedFrame->editor()->command("MoveToEndOfDocument").execute();
-            else if (shiftDown)
-                eventHandled = focusedFrame->editor()->command("MoveDownAndModifySelection").execute();
-            else
-                eventHandled = focusedFrame->editor()->command("MoveDown").execute();
-            break;
-        }
-    }
-    return eventHandled;
-}
-
 bool InputHandler::deleteSelection()
 {
     if (!isActiveTextEdit())
diff --git a/Source/WebKit/blackberry/WebKitSupport/InputHandler.h b/Source/WebKit/blackberry/WebKitSupport/InputHandler.h
index ba7eb3e7b..1b64a78b1 100644
--- a/Source/WebKit/blackberry/WebKitSupport/InputHandler.h
+++ b/Source/WebKit/blackberry/WebKitSupport/InputHandler.h
@@ -63,7 +63,6 @@ public:
     void frameUnloaded(WebCore::Frame*);
 
     bool handleKeyboardInput(const BlackBerry::Platform::KeyboardEvent&, bool changeIsPartOfComposition = false);
-    bool handleNavigationMove(const unsigned short character, bool shiftDown, bool altDown, bool canExitField = true);
 
     bool deleteSelection();
     void insertText(const WTF::String&);
@@ -77,11 +76,14 @@ public:
 
     void setInputValue(const WTF::String&);
 
+    void setDelayKeyboardVisibilityChange(bool value);
+    void processPendingKeyboardVisibilityChange();
+
+    void notifyClientOfKeyboardVisibilityChange(bool visible);
+
     bool isInputMode() const { return isActiveTextEdit(); }
     bool isMultilineInputMode() const { return isActiveTextEdit() && elementType(m_currentFocusElement.get()) == BlackBerry::Platform::InputTypeTextArea; }
 
-    void setNavigationMode(bool active, bool sendMessage = true);
-
     void ensureFocusElementVisible(bool centerFieldInDisplay = true);
     void handleInputLocaleChanged(bool isRTL);
 
@@ -117,6 +119,8 @@ public:
     bool shouldAcceptInputFocus();
 
 private:
+    enum PendingKeyboardStateChange { NoChange, Visible, NotVisible };
+
     void setElementFocused(WebCore::Element*);
     void setPluginFocused(WebCore::Element*);
     void setElementUnfocused(bool refocusOccuring = false);
@@ -175,12 +179,16 @@ private:
     RefPtr<WebCore::Element> m_currentFocusElement;
 
     bool m_processingChange;
-    bool m_navigationMode;
+    bool m_changingFocus;
+
     FocusElementType m_currentFocusElementType;
     int m_currentFocusElementTextEditMask;
 
     int m_composingTextStart;
     int m_composingTextEnd;
+
+    PendingKeyboardStateChange m_pendingKeyboardVisibilityChange;
+    bool m_delayKeyboardVisibilityChange;
 };
 
 }
diff --git a/Source/WebKit/blackberry/WebKitSupport/RenderQueue.cpp b/Source/WebKit/blackberry/WebKitSupport/RenderQueue.cpp
new file mode 100644
index 000000000..1f320b9a8
--- /dev/null
+++ b/Source/WebKit/blackberry/WebKitSupport/RenderQueue.cpp
@@ -0,0 +1,910 @@
+/*
+ * Copyright (C) 2009, 2010, 2011, 2012 Research In Motion Limited. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+#include "config.h"
+#include "RenderQueue.h"
+
+#include "BackingStore_p.h"
+#include "WebPageClient.h"
+#include "WebPage_p.h"
+
+#define DEBUG_RENDER_QUEUE 0
+#define DEBUG_RENDER_QUEUE_SORT 0
+
+#if DEBUG_RENDER_QUEUE
+#include <BlackBerryPlatformLog.h>
+#include <wtf/CurrentTime.h>
+#endif
+
+namespace BlackBerry {
+namespace WebKit {
+
+template<SortDirection sortDirection>
+static inline int compareRectOneDirection(const Platform::IntRect& r1, const Platform::IntRect& r2)
+{
+    switch (sortDirection) {
+    case LeftToRight:
+        return r1.x() - r2.x();
+    case RightToLeft:
+        return r2.x() - r1.x();
+    case TopToBottom:
+        return r1.y() - r2.y();
+    case BottomToTop:
+        return r2.y() - r1.y();
+    default:
+        break;
+    }
+    ASSERT_NOT_REACHED();
+    return 0;
+}
+
+template<SortDirection primarySortDirection, SortDirection secondarySortDirection>
+static bool rectIsLessThan(const Platform::IntRect& r1, const Platform::IntRect& r2)
+{
+    int primaryResult = compareRectOneDirection<primarySortDirection>(r1, r2);
+    if (primaryResult || secondarySortDirection == primarySortDirection)
+        return primaryResult < 0;
+    return compareRectOneDirection<secondarySortDirection>(r1, r2) < 0;
+}
+
+typedef bool (*FuncRectLessThan)(const Platform::IntRect& r1, const Platform::IntRect& r2);
+static FuncRectLessThan rectLessThanFunction(SortDirection primary, SortDirection secondary)
+{
+    static FuncRectLessThan s_rectLessThanFunctions[NumSortDirections][NumSortDirections] = { { 0 } };
+    static bool s_initialized = false;
+    if (!s_initialized) {
+#define ADD_COMPARE_FUNCTION(_primary, _secondary) \
+        s_rectLessThanFunctions[_primary][_secondary] = rectIsLessThan<_primary, _secondary>
+
+        ADD_COMPARE_FUNCTION(LeftToRight, LeftToRight);
+        ADD_COMPARE_FUNCTION(LeftToRight, RightToLeft);
+        ADD_COMPARE_FUNCTION(LeftToRight, TopToBottom);
+        ADD_COMPARE_FUNCTION(LeftToRight, BottomToTop);
+
+        ADD_COMPARE_FUNCTION(RightToLeft, LeftToRight);
+        ADD_COMPARE_FUNCTION(RightToLeft, RightToLeft);
+        ADD_COMPARE_FUNCTION(RightToLeft, TopToBottom);
+        ADD_COMPARE_FUNCTION(RightToLeft, BottomToTop);
+
+        ADD_COMPARE_FUNCTION(TopToBottom, LeftToRight);
+        ADD_COMPARE_FUNCTION(TopToBottom, RightToLeft);
+        ADD_COMPARE_FUNCTION(TopToBottom, TopToBottom);
+        ADD_COMPARE_FUNCTION(TopToBottom, BottomToTop);
+
+        ADD_COMPARE_FUNCTION(BottomToTop, LeftToRight);
+        ADD_COMPARE_FUNCTION(BottomToTop, RightToLeft);
+        ADD_COMPARE_FUNCTION(BottomToTop, TopToBottom);
+        ADD_COMPARE_FUNCTION(BottomToTop, BottomToTop);
+#undef ADD_COMPARE_FUNCTION
+
+        s_initialized = true;
+    }
+
+    return s_rectLessThanFunctions[primary][secondary];
+}
+
+class RectLessThan {
+public:
+    RectLessThan(SortDirection primarySortDirection, SortDirection secondarySortDirection)
+        : m_rectIsLessThan(rectLessThanFunction(primarySortDirection, secondarySortDirection))
+    {
+    }
+
+    bool operator()(const Platform::IntRect& r1, const Platform::IntRect& r2)
+    {
+        return m_rectIsLessThan(r1, r2);
+    }
+
+private:
+    FuncRectLessThan m_rectIsLessThan;
+};
+
+class RenderRectLessThan {
+public:
+    RenderRectLessThan(SortDirection primarySortDirection, SortDirection secondarySortDirection)
+        : m_rectIsLessThan(rectLessThanFunction(primarySortDirection, secondarySortDirection))
+    {
+    }
+
+    bool operator()(const RenderRect& r1, const RenderRect& r2)
+    {
+        return m_rectIsLessThan(r1.subRects()[0], r2.subRects()[0]);
+    }
+
+private:
+    FuncRectLessThan m_rectIsLessThan;
+};
+
+RenderRect::RenderRect(const Platform::IntPoint& location, const Platform::IntSize& size, int splittingFactor)
+    : Platform::IntRect(location, size)
+    , m_splittingFactor(0)
+    , m_primarySortDirection(TopToBottom)
+    , m_secondarySortDirection(LeftToRight)
+{
+    initialize(splittingFactor);
+}
+
+RenderRect::RenderRect(int x, int y, int width, int height, int splittingFactor)
+    : Platform::IntRect(x, y, width, height)
+    , m_splittingFactor(0)
+    , m_primarySortDirection(TopToBottom)
+    , m_secondarySortDirection(LeftToRight)
+{
+    initialize(splittingFactor);
+}
+
+void RenderRect::initialize(int splittingFactor)
+{
+    m_subRects.push_back(*this);
+    for (int i = 0; i < splittingFactor; ++i)
+        split();
+    quickSort();
+}
+
+static void splitRectInHalfAndAddToList(const Platform::IntRect& rect, bool vertical, IntRectList& renderRectList)
+{
+    if (vertical) {
+        int width1 = static_cast<int>(ceilf(rect.width() / 2.0));
+        int width2 = static_cast<int>(floorf(rect.width() / 2.0));
+        renderRectList.push_back(Platform::IntRect(rect.x(), rect.y(), width1, rect.height()));
+        renderRectList.push_back(Platform::IntRect(rect.x() + width1, rect.y(), width2, rect.height()));
+    } else {
+        int height1 = static_cast<int>(ceilf(rect.height() / 2.0));
+        int height2 = static_cast<int>(floorf(rect.height() / 2.0));
+        renderRectList.push_back(Platform::IntRect(rect.x(), rect.y(), rect.width(), height1));
+        renderRectList.push_back(Platform::IntRect(rect.x(), rect.y() + height1, rect.width(), height2));
+    }
+}
+
+void RenderRect::split()
+{
+    ++m_splittingFactor;
+
+    bool vertical = !(m_splittingFactor % 2);
+
+    IntRectList subRects;
+    for (size_t i = 0; i < m_subRects.size(); ++i)
+        splitRectInHalfAndAddToList(m_subRects.at(i), vertical, subRects);
+    m_subRects.swap(subRects);
+}
+
+Platform::IntRect RenderRect::rectForRendering()
+{
+    ASSERT(!m_subRects.empty());
+    Platform::IntRect rect = m_subRects[0];
+    m_subRects.erase(m_subRects.begin());
+    return rect;
+}
+
+void RenderRect::updateSortDirection(SortDirection primary, SortDirection secondary)
+{
+    if (primary == m_primarySortDirection && secondary == m_secondarySortDirection)
+        return;
+
+    m_primarySortDirection = primary;
+    m_secondarySortDirection = secondary;
+
+    quickSort();
+}
+
+void RenderRect::quickSort()
+{
+    std::sort(m_subRects.begin(), m_subRects.begin(), RectLessThan(m_primarySortDirection, m_secondarySortDirection));
+}
+
+RenderQueue::RenderQueue(BackingStorePrivate* parent)
+    : m_parent(parent)
+    , m_rectsAddedToRegularRenderJobsInCurrentCycle(false)
+    , m_currentRegularRenderJobsBatchUnderPressure(false)
+    , m_primarySortDirection(TopToBottom)
+    , m_secondarySortDirection(LeftToRight)
+{
+}
+
+void RenderQueue::reset()
+{
+    m_rectsAddedToRegularRenderJobsInCurrentCycle = false;
+    m_currentRegularRenderJobsBatchUnderPressure = false;
+    m_primarySortDirection = TopToBottom;
+    m_secondarySortDirection = LeftToRight;
+    m_visibleZoomJobs.clear();
+    m_visibleScrollJobs.clear();
+    m_visibleScrollJobsCompleted.clear();
+    m_nonVisibleScrollJobs.clear();
+    m_nonVisibleScrollJobsCompleted.clear();
+    m_regularRenderJobsRegion = Platform::IntRectRegion();
+    m_currentRegularRenderJobsBatch.clear();
+    m_currentRegularRenderJobsBatchRegion = Platform::IntRectRegion();
+    m_regularRenderJobsNotRenderedRegion = Platform::IntRectRegion();
+    m_parent->stopRenderTimer();
+    ASSERT(isEmpty());
+}
+
+int RenderQueue::splittingFactor(const Platform::IntRect& rect) const
+{
+    // This method is used to split up regular render rect jobs and we want it to
+    // to be zoom invariant with respect to WebCore. In other words, if WebCore sends
+    // us a rect of viewport size to invalidate at zoom 1.0 then we split that up
+    // in the exact same way we would at zoom 2.0. The amount of content that is
+    // rendered in any one pass should stay fixed with regard to the zoom level.
+    Platform::IntRect untransformedRect = m_parent->m_webPage->d->mapFromTransformed(rect);
+    double rectArea = untransformedRect.width() * untransformedRect.height();
+    Platform::IntSize defaultMaxLayoutSize = WebPagePrivate::defaultMaxLayoutSize();
+    double maxArea = defaultMaxLayoutSize.width() * defaultMaxLayoutSize.height();
+
+    const unsigned splitFactor = 1 << 0;
+    double renderRectArea = maxArea / splitFactor;
+    return ceil(log(rectArea / renderRectArea) / log(2.0));
+}
+
+RenderRect RenderQueue::convertToRenderRect(const Platform::IntRect& rect) const
+{
+    return RenderRect(rect.location(), rect.size(), splittingFactor(rect));
+}
+
+bool RenderQueue::isEmpty(bool shouldPerformRegularRenderJobs) const
+{
+    return m_visibleZoomJobs.empty() && m_visibleScrollJobs.empty()
+        && (!shouldPerformRegularRenderJobs || m_currentRegularRenderJobsBatch.empty())
+        && (!shouldPerformRegularRenderJobs || m_regularRenderJobsRegion.isEmpty())
+        && m_nonVisibleScrollJobs.empty();
+}
+
+bool RenderQueue::hasCurrentRegularRenderJob() const
+{
+    return !m_currentRegularRenderJobsBatch.empty() || !m_regularRenderJobsRegion.isEmpty();
+}
+
+bool RenderQueue::hasCurrentVisibleZoomJob() const
+{
+    return !m_visibleZoomJobs.empty();
+}
+
+bool RenderQueue::hasCurrentVisibleScrollJob() const
+{
+    return !m_visibleScrollJobs.empty();
+}
+
+bool RenderQueue::isCurrentVisibleScrollJob(const Platform::IntRect& rect) const
+{
+    return std::find(m_visibleScrollJobs.begin(), m_visibleScrollJobs.end(), rect) != m_visibleScrollJobs.end();
+}
+
+bool RenderQueue::isCurrentVisibleScrollJobCompleted(const Platform::IntRect& rect) const
+{
+    return std::find(m_visibleScrollJobsCompleted.begin(), m_visibleScrollJobsCompleted.end(), rect) != m_visibleScrollJobsCompleted.end();
+}
+
+bool RenderQueue::isCurrentRegularRenderJob(const Platform::IntRect& rect) const
+{
+    return m_regularRenderJobsRegion.isRectInRegion(rect) == Platform::IntRectRegion::ContainedInRegion
+        || m_currentRegularRenderJobsBatchRegion.isRectInRegion(rect) == Platform::IntRectRegion::ContainedInRegion;
+}
+
+bool RenderQueue::currentRegularRenderJobBatchUnderPressure() const
+{
+    return m_currentRegularRenderJobsBatchUnderPressure;
+}
+
+void RenderQueue::setCurrentRegularRenderJobBatchUnderPressure(bool currentRegularRenderJobsBatchUnderPressure)
+{
+    m_currentRegularRenderJobsBatchUnderPressure = currentRegularRenderJobsBatchUnderPressure;
+}
+
+void RenderQueue::eventQueueCycled()
+{
+    // Called by the backing store when the event queue has cycled to allow the
+    // render queue to determine if the regular render jobs are under pressure.
+    if (m_rectsAddedToRegularRenderJobsInCurrentCycle && m_currentRegularRenderJobsBatchRegion.isEmpty())
+        m_currentRegularRenderJobsBatchUnderPressure = true;
+    m_rectsAddedToRegularRenderJobsInCurrentCycle = false;
+}
+
+void RenderQueue::addToQueue(JobType type, const IntRectList& rectList)
+{
+    for (size_t i = 0; i < rectList.size(); ++i)
+        addToQueue(type, rectList.at(i));
+}
+
+void RenderQueue::addToQueue(JobType type, const Platform::IntRect& rect)
+{
+    if (type == NonVisibleScroll && std::find(m_visibleScrollJobs.begin(), m_visibleScrollJobs.end(), rect) != m_visibleScrollJobs.end())
+        return; // |rect| is in a higher priority queue.
+
+    switch (type) {
+    case VisibleZoom:
+        addToScrollZoomQueue(convertToRenderRect(rect), &m_visibleZoomJobs);
+        return;
+    case VisibleScroll:
+        addToScrollZoomQueue(convertToRenderRect(rect), &m_visibleScrollJobs);
+        return;
+    case RegularRender:
+        {
+            // Flag that we added rects in the current event queue cycle.
+            m_rectsAddedToRegularRenderJobsInCurrentCycle = true;
+
+            // We try and detect if this newly added rect intersects or is contained in the currently running
+            // batch of render jobs. If so, then we have to start the batch over since we decompose individual
+            // rects into subrects and might have already rendered one of them. If the web page's content has
+            // changed state then this can lead to artifacts. We mark this by noting the batch is now under pressure
+            // and the backingstore will attempt to clear it at the next available opportunity.
+            Platform::IntRectRegion::IntersectionState state = m_currentRegularRenderJobsBatchRegion.isRectInRegion(rect);
+            if (state == Platform::IntRectRegion::ContainedInRegion || state == Platform::IntRectRegion::PartiallyContainedInRegion) {
+                m_regularRenderJobsRegion = Platform::IntRectRegion::unionRegions(m_regularRenderJobsRegion, m_currentRegularRenderJobsBatchRegion);
+                m_currentRegularRenderJobsBatch.clear();
+                m_currentRegularRenderJobsBatchRegion = Platform::IntRectRegion();
+                m_currentRegularRenderJobsBatchUnderPressure = true;
+            }
+            addToRegularQueue(rect);
+        }
+        return;
+    case NonVisibleScroll:
+        addToScrollZoomQueue(convertToRenderRect(rect), &m_nonVisibleScrollJobs);
+        return;
+    }
+    ASSERT_NOT_REACHED();
+}
+
+void RenderQueue::addToRegularQueue(const Platform::IntRect& rect)
+{
+#if DEBUG_RENDER_QUEUE
+    if (m_regularRenderJobsRegion.isRectInRegion(rect) != Platform::IntRectRegion::ContainedInRegion) {
+        BlackBerry::Platform::log(BlackBerry::Platform::LogLevelCritical, "RenderQueue::addToRegularQueue %d,%d %dx%d",
+                               rect.x(), rect.y(), rect.width(), rect.height());
+    }
+#endif
+
+    // Do not let the regular render queue grow past a maximum of 3 disjoint rects.
+    if (m_regularRenderJobsRegion.numRects() > 2)
+        m_regularRenderJobsRegion = Platform::unionOfRects(m_regularRenderJobsRegion.extents(), rect);
+    else
+        m_regularRenderJobsRegion = Platform::IntRectRegion::unionRegions(m_regularRenderJobsRegion, rect);
+
+    if (!isEmpty())
+        m_parent->startRenderTimer(); // Start the render timer since we could have some stale content here...
+}
+
+void RenderQueue::addToScrollZoomQueue(const RenderRect& rect, RenderRectList* rectList)
+{
+    if (std::find(rectList->begin(), rectList->end(), rect) != rectList->end())
+        return;
+
+#if DEBUG_RENDER_QUEUE
+    BlackBerry::Platform::log(BlackBerry::Platform::LogLevelCritical, "RenderQueue::addToScrollZoomQueue %d,%d %dx%d",
+                           rect.x(), rect.y(), rect.width(), rect.height());
+#endif
+    rectList->push_back(rect);
+
+    if (!isEmpty())
+        m_parent->startRenderTimer(); // Start the render timer since we know we could have some checkerboard here...
+}
+
+void RenderQueue::quickSort(RenderRectList* queue)
+{
+    size_t length = queue->size();
+    if (!length)
+        return;
+
+    for (size_t i = 0; i < length; ++i)
+        queue->at(i).updateSortDirection(m_primarySortDirection, m_secondarySortDirection);
+    return std::sort(queue->begin(), queue->end(), RenderRectLessThan(m_primarySortDirection, m_secondarySortDirection));
+}
+
+void RenderQueue::updateSortDirection(int lastDeltaX, int lastDeltaY)
+{
+    bool primaryIsHorizontal = abs(lastDeltaX) >= abs(lastDeltaY);
+    if (primaryIsHorizontal) {
+        m_primarySortDirection = lastDeltaX <= 0 ? LeftToRight : RightToLeft;
+        m_secondarySortDirection = lastDeltaY <= 0 ? TopToBottom : BottomToTop;
+    } else {
+        m_primarySortDirection = lastDeltaY <= 0 ? TopToBottom : BottomToTop;
+        m_secondarySortDirection = lastDeltaX <= 0 ? LeftToRight : RightToLeft;
+    }
+}
+
+void RenderQueue::visibleContentChanged(const Platform::IntRect& visibleContent)
+{
+    if (m_visibleScrollJobs.empty() && m_nonVisibleScrollJobs.empty()) {
+        ASSERT(m_visibleScrollJobsCompleted.empty() && m_nonVisibleScrollJobsCompleted.empty());
+        return;
+    }
+
+    // Move visibleScrollJobs to nonVisibleScrollJobs if they do not intersect
+    // the visible content rect.
+    for (size_t i = 0; i < m_visibleScrollJobs.size(); ++i) {
+        RenderRect rect = m_visibleScrollJobs.at(i);
+        if (!rect.intersects(visibleContent)) {
+            m_visibleScrollJobs.erase(m_visibleScrollJobs.begin() + i);
+            addToScrollZoomQueue(rect, &m_nonVisibleScrollJobs);
+            --i;
+        }
+    }
+
+    // Do the same for the completed list.
+    for (size_t i = 0; i < m_visibleScrollJobsCompleted.size(); ++i) {
+        RenderRect rect = m_visibleScrollJobsCompleted.at(i);
+        if (!rect.intersects(visibleContent)) {
+            m_visibleScrollJobsCompleted.erase(m_visibleScrollJobsCompleted.begin() + i);
+            addToScrollZoomQueue(rect, &m_nonVisibleScrollJobsCompleted);
+            --i;
+        }
+    }
+
+    // Move nonVisibleScrollJobs to visibleScrollJobs if they do intersect
+    // the visible content rect.
+    for (size_t i = 0; i < m_nonVisibleScrollJobs.size(); ++i) {
+        RenderRect rect = m_nonVisibleScrollJobs.at(i);
+        if (rect.intersects(visibleContent)) {
+            m_nonVisibleScrollJobs.erase(m_nonVisibleScrollJobs.begin() + i);
+            addToScrollZoomQueue(rect, &m_visibleScrollJobs);
+            --i;
+        }
+    }
+
+    // Do the same for the completed list.
+    for (size_t i = 0; i < m_nonVisibleScrollJobsCompleted.size(); ++i) {
+        RenderRect rect = m_nonVisibleScrollJobsCompleted.at(i);
+        if (rect.intersects(visibleContent)) {
+            m_nonVisibleScrollJobsCompleted.erase(m_nonVisibleScrollJobsCompleted.begin() + i);
+            addToScrollZoomQueue(rect, &m_visibleScrollJobsCompleted);
+            --i;
+        }
+    }
+
+    if (m_visibleScrollJobs.empty() && !m_visibleScrollJobsCompleted.empty())
+        visibleScrollJobsCompleted(false /*shouldBlit*/);
+
+    if (m_nonVisibleScrollJobs.empty() && !m_nonVisibleScrollJobsCompleted.empty())
+        nonVisibleScrollJobsCompleted();
+
+    // We shouldn't be empty because the early return above and the fact that this
+    // method just shuffles rects from queue to queue hence the total number of
+    // rects in the various queues should be conserved.
+    ASSERT(!isEmpty());
+}
+
+void RenderQueue::clear(const Platform::IntRectRegion& region, bool clearRegularRenderJobs)
+{
+    IntRectList rects = region.rects();
+    for (size_t i = 0; i < rects.size(); ++i)
+        clear(rects.at(i), clearRegularRenderJobs);
+}
+
+void RenderQueue::clear(const Platform::IntRect& rect, bool clearRegularRenderJobs)
+{
+    if (m_visibleScrollJobs.empty() && m_nonVisibleScrollJobs.empty())
+        ASSERT(m_visibleScrollJobsCompleted.empty() && m_nonVisibleScrollJobsCompleted.empty());
+
+    // Remove all rects from all queues that are contained by this rect.
+    for (size_t i = 0; i < m_visibleScrollJobs.size(); ++i) {
+        if (rect.contains(m_visibleScrollJobs.at(i))) {
+            m_visibleScrollJobs.erase(m_visibleScrollJobs.begin() + i);
+            --i;
+        }
+    }
+
+    for (size_t i = 0; i < m_visibleScrollJobsCompleted.size(); ++i) {
+        if (rect.contains(m_visibleScrollJobsCompleted.at(i))) {
+            m_visibleScrollJobsCompleted.erase(m_visibleScrollJobsCompleted.begin() + i);
+            --i;
+        }
+    }
+
+    for (size_t i = 0; i < m_nonVisibleScrollJobs.size(); ++i) {
+        if (rect.contains(m_nonVisibleScrollJobs.at(i))) {
+            m_nonVisibleScrollJobs.erase(m_nonVisibleScrollJobs.begin() + i);
+            --i;
+        }
+    }
+
+    for (size_t i = 0; i < m_nonVisibleScrollJobsCompleted.size(); ++i) {
+        if (rect.contains(m_nonVisibleScrollJobsCompleted.at(i))) {
+            m_nonVisibleScrollJobsCompleted.erase(m_nonVisibleScrollJobsCompleted.begin() + i);
+            --i;
+        }
+    }
+
+    // Only clear the regular render jobs if the flag has been set.
+    if (clearRegularRenderJobs)
+        this->clearRegularRenderJobs(rect);
+
+    if (m_visibleScrollJobs.empty() && !m_visibleScrollJobsCompleted.empty())
+        visibleScrollJobsCompleted(false /*shouldBlit*/);
+
+    if (m_nonVisibleScrollJobs.empty() && !m_nonVisibleScrollJobsCompleted.empty())
+        nonVisibleScrollJobsCompleted();
+
+    if (isEmpty())
+         m_parent->stopRenderTimer();
+}
+
+void RenderQueue::clearRegularRenderJobs(const Platform::IntRect& rect)
+{
+    for (size_t i = 0; i < m_currentRegularRenderJobsBatch.size(); ++i) {
+        if (rect.contains(m_currentRegularRenderJobsBatch.at(i))) {
+            m_currentRegularRenderJobsBatch.erase(m_currentRegularRenderJobsBatch.begin() + i);
+            --i;
+        }
+    }
+    m_regularRenderJobsRegion = Platform::IntRectRegion::subtractRegions(m_regularRenderJobsRegion, rect);
+    m_currentRegularRenderJobsBatchRegion = Platform::IntRectRegion::subtractRegions(m_currentRegularRenderJobsBatchRegion, rect);
+    m_regularRenderJobsNotRenderedRegion = Platform::IntRectRegion::subtractRegions(m_regularRenderJobsNotRenderedRegion, rect);
+}
+
+void RenderQueue::clearVisibleZoom()
+{
+    m_visibleZoomJobs.clear();
+    if (isEmpty())
+         m_parent->stopRenderTimer();
+}
+
+bool RenderQueue::regularRenderJobsPreviouslyAttemptedButNotRendered(const Platform::IntRect& rect)
+{
+    return m_regularRenderJobsNotRenderedRegion.isRectInRegion(rect) != Platform::IntRectRegion::NotInRegion;
+}
+
+void RenderQueue::render(bool shouldPerformRegularRenderJobs)
+{
+    // We request a layout here to ensure that we're executing jobs in the correct
+    // order. If we didn't request a layout here then the jobs below could result
+    // in a layout and that layout can alter this queue. So request layout if needed
+    // to ensure that the queues below are in constant state before performing the
+    // next rendering job.
+
+#if DEBUG_RENDER_QUEUE
+    // Start the time measurement.
+    double time = WTF::currentTime();
+#endif
+
+    m_parent->requestLayoutIfNeeded();
+
+#if DEBUG_RENDER_QUEUE
+    double elapsed = WTF::currentTime() - time;
+    if (elapsed)
+        BlackBerry::Platform::log(BlackBerry::Platform::LogLevelCritical, "RenderQueue::render layout elapsed=%f", elapsed);
+#endif
+
+    // Empty the queues in a precise order of priority.
+    if (!m_visibleZoomJobs.empty())
+        renderVisibleZoomJob();
+    else if (!m_visibleScrollJobs.empty())
+        renderVisibleScrollJob();
+    else if (shouldPerformRegularRenderJobs && (!m_currentRegularRenderJobsBatch.empty() || !m_regularRenderJobsRegion.isEmpty())) {
+        if (currentRegularRenderJobBatchUnderPressure())
+            renderAllCurrentRegularRenderJobs();
+        else
+            renderRegularRenderJob();
+    } else if (!m_nonVisibleScrollJobs.empty())
+        renderNonVisibleScrollJob();
+
+    if (isEmpty())
+        m_parent->stopRenderTimer();
+}
+
+void RenderQueue::renderAllCurrentRegularRenderJobs()
+{
+#if DEBUG_RENDER_QUEUE
+    // Start the time measurement...
+    double time = WTF::currentTime();
+#endif
+
+    // Request layout first
+    m_parent->requestLayoutIfNeeded();
+
+#if DEBUG_RENDER_QUEUE
+    double elapsed = WTF::currentTime() - time;
+    if (elapsed)
+        BlackBerry::Platform::log(BlackBerry::Platform::LogLevelCritical, "RenderQueue::renderAllCurrentRegularRenderJobs layout elapsed=%f", elapsed);
+#endif
+
+    // The state of render queue may be modified from inside requestLayoutIfNeeded.
+    // In fact, it can even be emptied entirely! Layout can trigger a call to
+    // RenderQueue::clear. See PR#101811 for instance. So we should check again here.
+    if (!hasCurrentRegularRenderJob())
+        return;
+
+    // If there is no current batch of jobs, then create one.
+    if (m_currentRegularRenderJobsBatchRegion.isEmpty()) {
+
+        // Create a current region object from our regular render region.
+        m_currentRegularRenderJobsBatchRegion = m_regularRenderJobsRegion;
+
+        // Clear this since we're about to render everything.
+        m_regularRenderJobsRegion = Platform::IntRectRegion();
+    }
+
+    Platform::IntRectRegion regionNotRendered;
+    if (m_parent->shouldSuppressNonVisibleRegularRenderJobs()) {
+        // Record any part of the region that doesn't intersect the current visible contents rect.
+        regionNotRendered = Platform::IntRectRegion::subtractRegions(m_currentRegularRenderJobsBatchRegion, m_parent->visibleContentsRect());
+        m_regularRenderJobsNotRenderedRegion = Platform::IntRectRegion::unionRegions(m_regularRenderJobsNotRenderedRegion, regionNotRendered);
+
+#if DEBUG_RENDER_QUEUE
+        if (!regionNotRendered.isEmpty())
+            BlackBerry::Platform::log(BlackBerry::Platform::LogLevelCritical, "RenderQueue::renderAllCurrentRegularRenderJobs region not completely rendered!");
+#endif
+
+        // Clip to the visible contents so we'll be faster.
+        m_currentRegularRenderJobsBatchRegion = Platform::IntRectRegion::intersectRegions(m_currentRegularRenderJobsBatchRegion, m_parent->visibleContentsRect());
+    }
+
+    bool rendered = false;
+    if (!m_currentRegularRenderJobsBatchRegion.isEmpty()) {
+        std::vector<Platform::IntRect> rectList = m_currentRegularRenderJobsBatchRegion.rects();
+        for (size_t i = 0; i < rectList.size(); ++i)
+            rendered = m_parent->render(rectList.at(i)) ? true : rendered;
+    }
+
+#if DEBUG_RENDER_QUEUE
+    // Stop the time measurement.
+    elapsed = WTF::currentTime() - time;
+    Platform::IntRect extents = m_currentRegularRenderJobsBatchRegion.extents();
+    int numberOfRects = m_currentRegularRenderJobsBatchRegion.rects().size();
+    BlackBerry::Platform::log(BlackBerry::Platform::LogLevelCritical, "RenderQueue::renderAllCurrentRegularRenderJobs extents=(%d,%d %dx%d) numberOfRects=%d elapsed=%f",
+                           extents.x(), extents.y(), extents.width(), extents.height(), numberOfRects, elapsed);
+#endif
+
+    // Clear the region and blit since this batch is now complete.
+    Platform::IntRect renderedRect = m_currentRegularRenderJobsBatchRegion.extents();
+    m_currentRegularRenderJobsBatch.clear();
+    m_currentRegularRenderJobsBatchRegion = Platform::IntRectRegion();
+    m_currentRegularRenderJobsBatchUnderPressure = false;
+
+    // Update the screen only if we're not scrolling or zooming.
+    if (rendered && !m_parent->isScrollingOrZooming()) {
+        if (!m_parent->shouldDirectRenderingToWindow())
+            m_parent->blitVisibleContents();
+        else
+            m_parent->invalidateWindow();
+        m_parent->m_webPage->client()->notifyContentRendered(renderedRect);
+    }
+
+    if (m_parent->shouldSuppressNonVisibleRegularRenderJobs() && !regionNotRendered.isEmpty())
+        m_parent->updateTilesForScrollOrNotRenderedRegion(false /*checkLoading*/);
+}
+
+void RenderQueue::startRegularRenderJobBatchIfNeeded()
+{
+    if (!m_currentRegularRenderJobsBatch.empty())
+        return;
+
+    // Decompose the current regular render job region into render rect pieces.
+    IntRectList regularRenderJobs = m_regularRenderJobsRegion.rects();
+
+    // The current batch...
+    m_currentRegularRenderJobsBatch = regularRenderJobs;
+
+    // Create a region object that will be checked when adding new rects before
+    // this batch has been completed.
+    m_currentRegularRenderJobsBatchRegion = m_regularRenderJobsRegion;
+
+    // Clear the former region since it is now part of this batch.
+    m_regularRenderJobsRegion = Platform::IntRectRegion();
+
+#if DEBUG_RENDER_QUEUE
+    BlackBerry::Platform::log(BlackBerry::Platform::LogLevelCritical, "RenderQueue::startRegularRenderJobBatchIfNeeded batch size is %d!", m_currentRegularRenderJobsBatch.size());
+#endif
+}
+
+void RenderQueue::renderVisibleZoomJob()
+{
+    ASSERT(m_visibleZoomJobs.size() > 0);
+
+#if DEBUG_RENDER_QUEUE
+    // Start the time measurement.
+    double time = WTF::currentTime();
+#endif
+
+    RenderRect* rect = &m_visibleZoomJobs[0];
+    ASSERT(!rect->isCompleted());
+    Platform::IntRect subRect = rect->rectForRendering();
+    if (rect->isCompleted())
+        m_visibleZoomJobs.erase(m_visibleZoomJobs.begin());
+
+    m_parent->render(subRect);
+
+    // Record that it has now been rendered via a different type of job...
+    clearRegularRenderJobs(subRect);
+
+#if DEBUG_RENDER_QUEUE
+    // Stop the time measurement
+    double elapsed = WTF::currentTime() - time;
+    BlackBerry::Platform::log(BlackBerry::Platform::LogLevelCritical, "RenderQueue::renderVisibleZoomJob rect=(%d,%d %dx%d) elapsed=%f",
+                           subRect.x(), subRect.y(), subRect.width(), subRect.height(), elapsed);
+#endif
+}
+
+void RenderQueue::renderVisibleScrollJob()
+{
+    ASSERT(!m_visibleScrollJobs.empty());
+
+#if DEBUG_RENDER_QUEUE || DEBUG_RENDER_QUEUE_SORT
+    // Start the time measurement.
+    double time = WTF::currentTime();
+#endif
+
+    quickSort(&m_visibleScrollJobs);
+
+#if DEBUG_RENDER_QUEUE_SORT
+    // Stop the time measurement
+    double elapsed = WTF::currentTime() - time;
+    BlackBerry::Platform::log(BlackBerry::Platform::LogLevelCritical, "RenderQueue::renderVisibleScrollJob sort elapsed=%f", elapsed);
+#endif
+
+    RenderRect rect = m_visibleScrollJobs[0];
+    m_visibleScrollJobs.erase(m_visibleScrollJobs.begin());
+
+    ASSERT(!rect.isCompleted());
+    Platform::IntRect subRect = rect.rectForRendering();
+    if (rect.isCompleted())
+        m_visibleScrollJobsCompleted.push_back(rect);
+    else
+        m_visibleScrollJobs.insert(m_visibleScrollJobs.begin(), rect);
+
+    m_parent->render(subRect);
+
+    // Record that it has now been rendered via a different type of job...
+    clearRegularRenderJobs(subRect);
+
+#if DEBUG_RENDER_QUEUE
+    // Stop the time measurement
+    double elapsed = WTF::currentTime() - time;
+    BlackBerry::Platform::log(BlackBerry::Platform::LogLevelCritical, "RenderQueue::renderVisibleScrollJob rect=(%d,%d %dx%d) elapsed=%f",
+                           subRect.x(), subRect.y(), subRect.width(), subRect.height(), elapsed);
+#endif
+
+    if (m_visibleScrollJobs.empty())
+        visibleScrollJobsCompleted(true /*shouldBlit*/);
+}
+
+void RenderQueue::renderRegularRenderJob()
+{
+#if DEBUG_RENDER_QUEUE
+    // Start the time measurement.
+    double time = WTF::currentTime();
+#endif
+
+    ASSERT(!m_currentRegularRenderJobsBatch.empty() || !m_regularRenderJobsRegion.isEmpty());
+
+    startRegularRenderJobBatchIfNeeded();
+
+    // Take the first job from the regular render job queue.
+    Platform::IntRect rect = m_currentRegularRenderJobsBatch[0];
+    m_currentRegularRenderJobsBatchRegion = Platform::IntRectRegion::subtractRegions(m_currentRegularRenderJobsBatchRegion, Platform::IntRectRegion(rect));
+    m_currentRegularRenderJobsBatch.erase(m_currentRegularRenderJobsBatch.begin());
+
+    Platform::IntRectRegion regionNotRendered;
+    if (m_parent->shouldSuppressNonVisibleRegularRenderJobs()) {
+        // Record any part of the region that doesn't intersect the current visible tiles rect.
+        regionNotRendered = Platform::IntRectRegion::subtractRegions(rect, m_parent->visibleContentsRect());
+        m_regularRenderJobsNotRenderedRegion = Platform::IntRectRegion::unionRegions(m_regularRenderJobsNotRenderedRegion, regionNotRendered);
+
+#if DEBUG_RENDER_QUEUE
+        if (!regionNotRendered.isEmpty()) {
+            BlackBerry::Platform::log(BlackBerry::Platform::LogLevelCritical, "RenderQueue::renderRegularRenderJob rect (%d,%d %dx%d) not completely rendered!",
+                                  rect.x(), rect.y(), rect.width(), rect.height());
+        }
+#endif
+
+        // Clip to the visible tiles so we'll be faster.
+        rect.intersect(m_parent->visibleContentsRect());
+    }
+
+    if (!rect.isEmpty())
+        m_parent->render(rect);
+
+#if DEBUG_RENDER_QUEUE
+    // Stop the time measurement.
+    double elapsed = WTF::currentTime() - time;
+    BlackBerry::Platform::log(BlackBerry::Platform::LogLevelCritical, "RenderQueue::renderRegularRenderJob rect=(%d,%d %dx%d) elapsed=%f",
+                           rect.x(), rect.y(), rect.width(), rect.height(), elapsed);
+#endif
+
+    if (m_currentRegularRenderJobsBatch.empty()) {
+        Platform::IntRect renderedRect = m_currentRegularRenderJobsBatchRegion.extents();
+        // Clear the region and the and blit since this batch is now complete.
+        m_currentRegularRenderJobsBatchRegion = Platform::IntRectRegion();
+        m_currentRegularRenderJobsBatchUnderPressure = false;
+        // Update the screen only if we're not scrolling or zooming.
+        if (!m_parent->isScrollingOrZooming()) {
+            if (!m_parent->shouldDirectRenderingToWindow())
+                m_parent->blitVisibleContents();
+            else
+                m_parent->invalidateWindow();
+            m_parent->m_webPage->client()->notifyContentRendered(renderedRect);
+        }
+    }
+
+    // Make sure we didn't alter state of the queues that should have been empty
+    // before this method was called.
+    ASSERT(m_visibleScrollJobs.empty());
+
+    if (m_parent->shouldSuppressNonVisibleRegularRenderJobs() && !regionNotRendered.isEmpty())
+        m_parent->updateTilesForScrollOrNotRenderedRegion(false /*checkLoading*/);
+}
+
+void RenderQueue::renderNonVisibleScrollJob()
+{
+    ASSERT(!m_nonVisibleScrollJobs.empty());
+
+#if DEBUG_RENDER_QUEUE || DEBUG_RENDER_QUEUE_SORT
+    // Start the time measurement.
+    double time = WTF::currentTime();
+#endif
+
+    quickSort(&m_nonVisibleScrollJobs);
+
+#if DEBUG_RENDER_QUEUE_SORT
+    // Stop the time measurement.
+    double elapsed = WTF::currentTime() - time;
+    BlackBerry::Platform::log(BlackBerry::Platform::LogLevelCritical, "RenderQueue::renderNonVisibleScrollJob sort elapsed=%f", elapsed);
+#endif
+
+    RenderRect rect = m_nonVisibleScrollJobs[0];
+    m_nonVisibleScrollJobs.erase(m_nonVisibleScrollJobs.begin());
+
+    ASSERT(!rect.isCompleted());
+    Platform::IntRect subRect = rect.rectForRendering();
+    if (rect.isCompleted())
+        m_nonVisibleScrollJobsCompleted.push_back(rect);
+    else
+        m_nonVisibleScrollJobs.insert(m_nonVisibleScrollJobs.begin(), rect);
+
+    m_parent->render(subRect);
+
+    // Record that it has now been rendered via a different type of job...
+    clearRegularRenderJobs(subRect);
+
+    // Make sure we didn't alter state of the queues that should have been empty
+    // before this method was called.
+    ASSERT(m_visibleScrollJobs.empty());
+
+#if DEBUG_RENDER_QUEUE
+    // Stop the time measurement.
+    double elapsed = WTF::currentTime() - time;
+    BlackBerry::Platform::log(BlackBerry::Platform::LogLevelCritical, "RenderQueue::renderNonVisibleScrollJob rect=(%d,%d %dx%d) elapsed=%f",
+                           subRect.x(), subRect.y(), subRect.width(), subRect.height(), elapsed);
+#endif
+
+    if (m_nonVisibleScrollJobs.empty())
+        nonVisibleScrollJobsCompleted();
+}
+
+void RenderQueue::visibleScrollJobsCompleted(bool shouldBlit)
+{
+    // Now blit to the screen if we are done and get rid of the completed list!
+    ASSERT(m_visibleScrollJobs.empty());
+    m_visibleScrollJobsCompleted.clear();
+    if (shouldBlit && !m_parent->isScrollingOrZooming()) {
+        if (!m_parent->shouldDirectRenderingToWindow())
+            m_parent->blitVisibleContents();
+        else
+            m_parent->invalidateWindow();
+        m_parent->m_webPage->client()->notifyContentRendered(m_parent->visibleContentsRect());
+    }
+}
+
+void RenderQueue::nonVisibleScrollJobsCompleted()
+{
+    // Get rid of the completed list!
+    ASSERT(m_nonVisibleScrollJobs.empty());
+    m_nonVisibleScrollJobsCompleted.clear();
+}
+
+} // namespace WebKit
+} // namespace BlackBerry
diff --git a/Source/WebKit/blackberry/WebKitSupport/RenderQueue.h b/Source/WebKit/blackberry/WebKitSupport/RenderQueue.h
new file mode 100644
index 000000000..3c9639e67
--- /dev/null
+++ b/Source/WebKit/blackberry/WebKitSupport/RenderQueue.h
@@ -0,0 +1,154 @@
+/*
+ * Copyright (C) 2009, 2010, 2011, 2012 Research In Motion Limited. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+#ifndef RenderQueue_h
+#define RenderQueue_h
+
+#include <BlackBerryPlatformIntRectRegion.h>
+#include <BlackBerryPlatformPrimitives.h>
+#include <vector>
+
+namespace BlackBerry {
+namespace WebKit {
+
+class BackingStorePrivate;
+
+typedef std::vector<Platform::IntRect> IntRectList;
+
+enum SortDirection {
+    LeftToRight = 0,
+    RightToLeft,
+    TopToBottom,
+    BottomToTop,
+    NumSortDirections
+};
+
+class RenderRect : public Platform::IntRect {
+public:
+    RenderRect() { }
+    RenderRect(const Platform::IntPoint& location, const Platform::IntSize&, int splittingFactor);
+    RenderRect(int x, int y, int width, int height, int splittingFactor);
+    RenderRect(const Platform::IntRect&);
+
+    Platform::IntRect rectForRendering();
+
+    bool isCompleted() const { return !m_subRects.size(); }
+
+    const IntRectList& subRects() const { return m_subRects; }
+    void updateSortDirection(SortDirection primary, SortDirection secondary);
+
+private:
+    void initialize(int splittingFactor);
+    void split();
+    void quickSort();
+    int m_splittingFactor;
+    IntRectList m_subRects;
+    SortDirection m_primarySortDirection;
+    SortDirection m_secondarySortDirection;
+};
+
+typedef std::vector<RenderRect> RenderRectList;
+
+class RenderQueue {
+public:
+    enum JobType { VisibleZoom, VisibleScroll, RegularRender, NonVisibleScroll };
+    RenderQueue(BackingStorePrivate*);
+
+    void reset();
+    RenderRect convertToRenderRect(const Platform::IntRect&) const;
+
+    bool isEmpty(bool shouldPerformRegularRenderJobs = true) const;
+
+    bool hasCurrentRegularRenderJob() const;
+    bool hasCurrentVisibleZoomJob() const;
+    bool hasCurrentVisibleScrollJob() const;
+    bool isCurrentVisibleScrollJob(const Platform::IntRect&) const;
+    bool isCurrentVisibleScrollJobCompleted(const Platform::IntRect&) const;
+    bool isCurrentRegularRenderJob(const Platform::IntRect&) const;
+
+    bool currentRegularRenderJobBatchUnderPressure() const;
+    void setCurrentRegularRenderJobBatchUnderPressure(bool);
+
+    void eventQueueCycled();
+
+    void addToQueue(JobType, const Platform::IntRect&);
+    void addToQueue(JobType, const IntRectList&);
+
+    void updateSortDirection(int lastDeltaX, int lastDeltaY);
+    void visibleContentChanged(const Platform::IntRect&);
+    void clear(const Platform::IntRectRegion&, bool clearRegularRenderJobs);
+    void clear(const Platform::IntRect&, bool clearRegularRenderJobs);
+    void clearRegularRenderJobs(const Platform::IntRect&);
+    void clearVisibleZoom();
+    bool regularRenderJobsPreviouslyAttemptedButNotRendered(const Platform::IntRect&);
+    Platform::IntRectRegion regularRenderJobsNotRenderedRegion() const { return m_regularRenderJobsNotRenderedRegion; }
+
+    void render(bool shouldPerformRegularRenderJobs = true);
+    void renderAllCurrentRegularRenderJobs();
+
+private:
+    void startRegularRenderJobBatchIfNeeded();
+
+    // Render an item from the queue.
+    void renderVisibleZoomJob();
+    void renderVisibleScrollJob();
+    void renderRegularRenderJob();
+    void renderNonVisibleScrollJob();
+
+    // Methods to handle a completed set of scroll jobs.
+    void visibleScrollJobsCompleted(bool shouldBlit);
+    void nonVisibleScrollJobsCompleted();
+
+    // Internal method to add to the various queues.
+    void addToRegularQueue(const Platform::IntRect&);
+    void addToScrollZoomQueue(const RenderRect&, RenderRectList* queue);
+    void quickSort(RenderRectList*);
+
+    // The splitting factor for render rects.
+    int splittingFactor(const Platform::IntRect&) const;
+
+    BackingStorePrivate* m_parent;
+
+    // The highest priority queue.
+    RenderRectList m_visibleZoomJobs;
+    RenderRectList m_visibleScrollJobs;
+    RenderRectList m_visibleScrollJobsCompleted;
+    // The lowest priority queue.
+    RenderRectList m_nonVisibleScrollJobs;
+    RenderRectList m_nonVisibleScrollJobsCompleted;
+    // The regular render jobs are in the middle.
+    Platform::IntRectRegion m_regularRenderJobsRegion;
+    IntRectList m_currentRegularRenderJobsBatch;
+    Platform::IntRectRegion m_currentRegularRenderJobsBatchRegion;
+    bool m_rectsAddedToRegularRenderJobsInCurrentCycle;
+    bool m_currentRegularRenderJobsBatchUnderPressure;
+
+    // Holds the region of the page that we attempt to render, but the
+    // backingstore was not in the right place at the time. This will
+    // be checked before we try to restore a tile to it's last rendered
+    // place.
+    Platform::IntRectRegion m_regularRenderJobsNotRenderedRegion;
+
+    SortDirection m_primarySortDirection;
+    SortDirection m_secondarySortDirection;
+};
+
+} // namespace WebKit
+} // namespace BlackBerry
+
+#endif // RenderQueue_h
diff --git a/Source/WebKit/blackberry/WebKitSupport/SelectionHandler.cpp b/Source/WebKit/blackberry/WebKitSupport/SelectionHandler.cpp
new file mode 100644
index 000000000..0723c65c8
--- /dev/null
+++ b/Source/WebKit/blackberry/WebKitSupport/SelectionHandler.cpp
@@ -0,0 +1,943 @@
+/*
+ * Copyright (C) 2010, 2011, 2012 Research In Motion Limited. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+#include "config.h"
+#include "SelectionHandler.h"
+
+#include "DOMSupport.h"
+#include "Document.h"
+#include "Editor.h"
+#include "EditorClient.h"
+#include "FatFingers.h"
+#include "Frame.h"
+#include "FrameSelection.h"
+#include "FrameView.h"
+#include "HTMLAnchorElement.h"
+#include "HTMLAreaElement.h"
+#include "HitTestResult.h"
+#include "InputHandler.h"
+#include "IntRect.h"
+#include "Page.h"
+#include "RenderPart.h"
+#include "TextGranularity.h"
+#include "TouchEventHandler.h"
+#include "WebPage.h"
+#include "WebPageClient.h"
+#include "WebPage_p.h"
+
+#include "htmlediting.h"
+#include "visible_units.h"
+
+#include <BlackBerryPlatformKeyboardEvent.h>
+
+#include <sys/keycodes.h>
+
+#define SHOWDEBUG_SELECTIONHANDLER 0
+
+#if SHOWDEBUG_SELECTIONHANDLER
+#define DEBUG_SELECTION(severity, format, ...) BlackBerry::Platform::logAlways(severity, format, ## __VA_ARGS__)
+#else
+#define DEBUG_SELECTION(severity, format, ...)
+#endif // SHOWDEBUG_SELECTIONHANDLER
+
+using namespace WebCore;
+
+namespace BlackBerry {
+namespace WebKit {
+
+SelectionHandler::SelectionHandler(WebPagePrivate* page)
+    : m_webPage(page)
+    , m_selectionActive(false)
+    , m_caretActive(false)
+    , m_lastUpdatedEndPointIsValid(false)
+{
+}
+
+SelectionHandler::~SelectionHandler()
+{
+}
+
+void SelectionHandler::cancelSelection()
+{
+    m_selectionActive = false;
+    m_lastSelectionRegion = BlackBerry::Platform::IntRectRegion();
+
+    DEBUG_SELECTION(BlackBerry::Platform::LogLevelInfo, "SelectionHandler::cancelSelection");
+
+    if (m_webPage->m_inputHandler->isInputMode())
+        m_webPage->m_inputHandler->cancelSelection();
+    else
+        m_webPage->focusedOrMainFrame()->selection()->clear();
+}
+
+WebString SelectionHandler::selectedText() const
+{
+    return m_webPage->focusedOrMainFrame()->editor()->selectedText();
+}
+
+void SelectionHandler::getConsolidatedRegionOfTextQuadsForSelection(const VisibleSelection& selection, BlackBerry::Platform::IntRectRegion& region) const
+{
+    ASSERT(region.isEmpty());
+
+    if (!selection.isRange())
+        return;
+
+    ASSERT(selection.firstRange());
+
+    Vector<FloatQuad> quadList;
+    DOMSupport::visibleTextQuads(*(selection.firstRange()), quadList, true /* use selection height */);
+
+    if (!quadList.isEmpty()) {
+        FrameView* frameView = m_webPage->focusedOrMainFrame()->view();
+
+        // frameRect is in frame coordinates.
+        IntRect frameRect(IntPoint(0, 0), frameView->contentsSize());
+
+        // framePosition is in main frame coordinates.
+        IntPoint framePosition = m_webPage->frameOffset(m_webPage->focusedOrMainFrame());
+
+        // The ranges rect list is based on render elements and may include multiple adjacent rects.
+        // Use BlackBerry::Platform::IntRectRegion to consolidate these rects into bands as well as a container to pass
+        // to the client.
+        for (unsigned i = 0; i < quadList.size(); i++) {
+            IntRect enclosingRect = quadList[i].enclosingBoundingBox();
+            enclosingRect.intersect(frameRect);
+            enclosingRect.move(framePosition.x(), framePosition.y());
+            region = unionRegions(region, BlackBerry::Platform::IntRectRegion(enclosingRect));
+        }
+    }
+}
+
+static VisiblePosition visiblePositionForPointIgnoringClipping(const Frame& frame, const IntPoint& framePoint)
+{
+    // Frame::visiblePositionAtPoint hard-codes ignoreClipping=false in the
+    // call to hitTestResultAtPoint. This has a bug where some pages (such as
+    // metafilter) will return the wrong VisiblePosition for points that are
+    // outside the visible rect. To work around the bug, this is a copy of
+    // visiblePositionAtPoint which which passes ignoreClipping=true.
+    // See RIM Bug #4315.
+    HitTestResult result = frame.eventHandler()->hitTestResultAtPoint(framePoint, true /* allowShadowContent */, true /* ignoreClipping */);
+
+    Node* node = result.innerNode();
+    if (!node)
+        return VisiblePosition();
+
+    RenderObject* renderer = node->renderer();
+    if (!renderer)
+        return VisiblePosition();
+
+    VisiblePosition visiblePos = renderer->positionForPoint(result.localPoint());
+    if (visiblePos.isNull())
+        visiblePos = VisiblePosition(Position(createLegacyEditingPosition(node, 0)));
+
+    return visiblePos;
+}
+
+static unsigned short directionOfPointRelativeToRect(const IntPoint& point, const IntRect& rect, const bool useTopPadding = true, const bool useBottomPadding = true)
+{
+    ASSERT(!rect.contains(point));
+
+    // Padding to prevent accidental trigger of up/down when intending to do horizontal movement.
+    const int verticalPadding = 5;
+
+    // Do height movement check first but add padding. We may be off on both x & y axis and only
+    // want to move in one direction at a time.
+    if (point.y() + (useTopPadding ? verticalPadding : 0) < rect.y())
+        return KEYCODE_UP;
+    if (point.y() > rect.maxY() + (useBottomPadding ? verticalPadding : 0))
+        return KEYCODE_DOWN;
+    if (point.x() < rect.location().x())
+        return KEYCODE_LEFT;
+    if (point.x() > rect.maxX())
+        return KEYCODE_RIGHT;
+
+    return 0;
+}
+
+bool SelectionHandler::shouldUpdateSelectionOrCaretForPoint(const IntPoint& point, const IntRect& caretRect, bool startCaret) const
+{
+    ASSERT(m_webPage->m_inputHandler->isInputMode());
+
+    // If the point isn't valid don't block change as it is not actually changing.
+    if (point == DOMSupport::InvalidPoint)
+        return true;
+
+    VisibleSelection currentSelection = m_webPage->focusedOrMainFrame()->selection()->selection();
+
+    // If the input field is single line or we are on the first or last
+    // line of a multiline input field only horizontal movement is supported.
+    bool aboveCaret = point.y() < caretRect.y();
+    bool belowCaret = point.y() >= caretRect.maxY();
+
+    DEBUG_SELECTION(BlackBerry::Platform::LogLevelInfo, "SelectionHandler::shouldUpdateSelectionOrCaretForPoint multiline = %s above = %s below = %s first line = %s last line = %s start = %s \n"
+            , m_webPage->m_inputHandler->isMultilineInputMode() ? "true" : "false", aboveCaret ? "true" : "false", belowCaret ? "true" : "false"
+            , inSameLine(currentSelection.visibleStart(), startOfEditableContent(currentSelection.visibleStart())) ? "true" : "false"
+            , inSameLine(currentSelection.visibleEnd(), endOfEditableContent(currentSelection.visibleEnd())) ? "true" : "false"
+            , startCaret ? "true" : "false");
+
+    if (!m_webPage->m_inputHandler->isMultilineInputMode() && (aboveCaret || belowCaret))
+        return false;
+    if (startCaret && inSameLine(currentSelection.visibleStart(), startOfEditableContent(currentSelection.visibleStart())) && aboveCaret)
+        return false;
+    if (!startCaret && inSameLine(currentSelection.visibleEnd(), endOfEditableContent(currentSelection.visibleEnd())) && belowCaret)
+        return false;
+
+    return true;
+}
+
+void SelectionHandler::setCaretPosition(const IntPoint &position)
+{
+    if (!m_webPage->m_inputHandler->isInputMode())
+        return;
+
+    m_caretActive = true;
+
+    DEBUG_SELECTION(BlackBerry::Platform::LogLevelInfo, "SelectionHandler::setCaretPosition requested point %d, %d", position.x(), position.y());
+
+    Frame* focusedFrame = m_webPage->focusedOrMainFrame();
+    FrameSelection* controller = focusedFrame->selection();
+    IntPoint relativePoint = DOMSupport::convertPointToFrame(m_webPage->mainFrame(), focusedFrame, position);
+    IntRect currentCaretRect = controller->selection().visibleStart().absoluteCaretBounds();
+
+    if (relativePoint == DOMSupport::InvalidPoint || !shouldUpdateSelectionOrCaretForPoint(relativePoint, currentCaretRect)) {
+        selectionPositionChanged();
+        return;
+    }
+
+    VisiblePosition visibleCaretPosition(focusedFrame->visiblePositionForPoint(relativePoint));
+
+    if (!DOMSupport::isPositionInNode(m_webPage->focusedOrMainFrame()->document()->focusedNode(), visibleCaretPosition.deepEquivalent())) {
+        if (unsigned short character = directionOfPointRelativeToRect(relativePoint, currentCaretRect))
+            m_webPage->m_inputHandler->handleKeyboardInput(BlackBerry::Platform::KeyboardEvent(character));
+
+        selectionPositionChanged();
+        return;
+    }
+
+    VisibleSelection newSelection(visibleCaretPosition);
+    if (controller->selection() == newSelection) {
+        selectionPositionChanged();
+        return;
+    }
+
+    controller->setSelection(newSelection);
+
+    DEBUG_SELECTION(BlackBerry::Platform::LogLevelInfo, "SelectionHandler::setCaretPosition point valid, cursor updated");
+}
+
+// This function makes sure we are not reducing the selection to a caret selection.
+static bool shouldExtendSelectionInDirection(const VisibleSelection& selection, unsigned short character)
+{
+    FrameSelection tempSelection;
+    tempSelection.setSelection(selection);
+    switch (character) {
+    case KEYCODE_LEFT:
+        tempSelection.modify(FrameSelection::AlterationExtend, DirectionLeft, CharacterGranularity);
+        break;
+    case KEYCODE_RIGHT:
+        tempSelection.modify(FrameSelection::AlterationExtend, DirectionRight, CharacterGranularity);
+        break;
+    case KEYCODE_UP:
+        tempSelection.modify(FrameSelection::AlterationExtend, DirectionBackward, LineGranularity);
+        break;
+    case KEYCODE_DOWN:
+        tempSelection.modify(FrameSelection::AlterationExtend, DirectionForward, LineGranularity);
+        break;
+    default:
+        break;
+    }
+
+    if ((character == KEYCODE_LEFT || character == KEYCODE_RIGHT)
+        && (!inSameLine(selection.visibleStart(), tempSelection.selection().visibleStart())
+           || !inSameLine(selection.visibleEnd(), tempSelection.selection().visibleEnd())))
+        return false;
+
+    return tempSelection.selection().selectionType() == VisibleSelection::RangeSelection;
+}
+
+static VisiblePosition directionalVisiblePositionAtExtentOfBox(Frame* frame, const IntRect& boundingBox, unsigned short direction, const IntPoint& basePoint)
+{
+    ASSERT(frame);
+
+    if (!frame)
+        return VisiblePosition();
+
+    switch (direction) {
+    case KEYCODE_LEFT:
+        // Extend x to start without modifying y.
+        return frame->visiblePositionForPoint(IntPoint(boundingBox.x(), basePoint.y()));
+    case KEYCODE_RIGHT:
+        // Extend x to end without modifying y.
+        return frame->visiblePositionForPoint(IntPoint(boundingBox.maxX(), basePoint.y()));
+    case KEYCODE_UP:
+        // Extend y to top without modifying x.
+        return frame->visiblePositionForPoint(IntPoint(basePoint.x(), boundingBox.y()));
+    case KEYCODE_DOWN:
+        // Extend y to bottom without modifying x.
+        return frame->visiblePositionForPoint(IntPoint(basePoint.x(), boundingBox.maxY()));
+    default:
+        break;
+    }
+
+    return frame->visiblePositionForPoint(IntPoint(basePoint.x(), basePoint.y()));
+}
+
+static bool pointIsOutsideOfBoundingBoxInDirection(unsigned direction, const IntPoint& selectionPoint, const IntRect& boundingBox)
+{
+    if ((direction == KEYCODE_LEFT && selectionPoint.x() < boundingBox.x())
+        || (direction == KEYCODE_UP && selectionPoint.y() < boundingBox.y())
+        || (direction == KEYCODE_RIGHT && selectionPoint.x() > boundingBox.maxX())
+        || (direction == KEYCODE_DOWN && selectionPoint.y() > boundingBox.maxY()))
+        return true;
+
+    return false;
+}
+
+unsigned short SelectionHandler::extendSelectionToFieldBoundary(bool isStartHandle, const IntPoint& selectionPoint, VisibleSelection& newSelection)
+{
+    Frame* focusedFrame = m_webPage->focusedOrMainFrame();
+    if (!focusedFrame->document()->focusedNode() || !focusedFrame->document()->focusedNode()->renderer())
+        return 0;
+
+    FrameSelection* controller = focusedFrame->selection();
+
+    IntRect caretRect = isStartHandle ? controller->selection().visibleStart().absoluteCaretBounds()
+                                      : controller->selection().visibleEnd().absoluteCaretBounds();
+
+    IntRect nodeBoundingBox = focusedFrame->document()->focusedNode()->renderer()->absoluteBoundingBoxRect();
+    nodeBoundingBox.inflate(-1);
+
+    // Start handle is outside of the field. Treat it as the changed handle and move
+    // relative to the start caret rect.
+    unsigned short character = directionOfPointRelativeToRect(selectionPoint, caretRect, isStartHandle /*useTopPadding*/, !isStartHandle /*useBottomPadding*/);
+
+    // Prevent incorrect movement, handles can only extend the selection this way
+    // to prevent inversion of the handles.
+    if (isStartHandle && (character == KEYCODE_RIGHT || character == KEYCODE_DOWN)
+        || !isStartHandle && (character == KEYCODE_LEFT || character == KEYCODE_UP))
+        character = 0;
+
+    VisiblePosition newVisiblePosition = isStartHandle ? controller->selection().extent() : controller->selection().base();
+    // Extend the selection to the bounds of the box before doing incremental scroll if the point is outside the node.
+    // Don't extend selection and handle the character at the same time.
+    if (pointIsOutsideOfBoundingBoxInDirection(character, selectionPoint, nodeBoundingBox))
+        newVisiblePosition = directionalVisiblePositionAtExtentOfBox(focusedFrame, nodeBoundingBox, character, selectionPoint);
+
+    if (isStartHandle)
+        newSelection = VisibleSelection(newVisiblePosition, newSelection.extent(), true /*isDirectional*/);
+    else
+        newSelection = VisibleSelection(newSelection.base(), newVisiblePosition, true /*isDirectional*/);
+
+    // If no selection will be changed, return the character to extend using navigation.
+    if (controller->selection() == newSelection)
+        return character;
+
+    // Selection has been updated.
+    return 0;
+}
+
+// Returns true if handled.
+bool SelectionHandler::updateOrHandleInputSelection(VisibleSelection& newSelection, const IntPoint& relativeStart
+                                                    , const IntPoint& relativeEnd)
+{
+    ASSERT(m_webPage->m_inputHandler->isInputMode());
+
+    Frame* focusedFrame = m_webPage->focusedOrMainFrame();
+    Node* focusedNode = focusedFrame->document()->focusedNode();
+    if (!focusedNode || !focusedNode->renderer())
+        return false;
+
+    FrameSelection* controller = focusedFrame->selection();
+
+    IntRect currentStartCaretRect = controller->selection().visibleStart().absoluteCaretBounds();
+    IntRect currentEndCaretRect = controller->selection().visibleEnd().absoluteCaretBounds();
+
+    // Check if the handle movement is valid.
+    if (!shouldUpdateSelectionOrCaretForPoint(relativeStart, currentStartCaretRect, true /* startCaret */)
+        || !shouldUpdateSelectionOrCaretForPoint(relativeEnd, currentEndCaretRect, false /* startCaret */)) {
+        selectionPositionChanged();
+        return true;
+    }
+
+    IntRect nodeBoundingBox = focusedNode->renderer()->absoluteBoundingBoxRect();
+
+    // Only do special handling if one handle is outside of the node.
+    bool startIsOutsideOfField = relativeStart != DOMSupport::InvalidPoint && !nodeBoundingBox.contains(relativeStart);
+    bool endIsOutsideOfField = relativeEnd != DOMSupport::InvalidPoint && !nodeBoundingBox.contains(relativeEnd);
+    if (startIsOutsideOfField && endIsOutsideOfField)
+        return false;
+
+    unsigned short character = 0;
+    if (startIsOutsideOfField) {
+        character = extendSelectionToFieldBoundary(true /* isStartHandle */, relativeStart, newSelection);
+        if (character) {
+            // Invert the selection so that the cursor point is at the beginning.
+            controller->setSelection(VisibleSelection(controller->selection().end(), controller->selection().start()));
+        }
+    } else if (endIsOutsideOfField) {
+        character = extendSelectionToFieldBoundary(false /* isStartHandle */, relativeEnd, newSelection);
+        if (character) {
+            // Reset the selection so that the end is the edit point.
+            controller->setSelection(VisibleSelection(controller->selection().start(), controller->selection().end()));
+        }
+    }
+
+    if (!character)
+        return false;
+
+    DEBUG_SELECTION(BlackBerry::Platform::LogLevelInfo, "SelectionHandler::setSelection making selection change attempt using key event %d", character);
+
+    if (shouldExtendSelectionInDirection(controller->selection(), character))
+        m_webPage->m_inputHandler->handleKeyboardInput(BlackBerry::Platform::KeyboardEvent(character, BlackBerry::Platform::KeyboardEvent::KeyDown, KEYMOD_SHIFT));
+
+    // Must send the selectionPositionChanged every time, sometimes this will duplicate but an accepted
+    // handleNavigationMove may not make an actual selection change.
+    selectionPositionChanged();
+    return true;
+}
+
+IntPoint SelectionHandler::clipPointToFocusNode(const IntPoint& point)
+{
+    Frame* focusedFrame = m_webPage->focusedOrMainFrame();
+    FrameSelection* controller = focusedFrame->selection();
+
+    if (!focusedFrame->document()->focusedNode() || !focusedFrame->document()->focusedNode()->renderer())
+        return point;
+
+    IntRect focusedNodeBoundingBox = focusedFrame->document()->focusedNode()->renderer()->absoluteBoundingBoxRect();
+    focusedNodeBoundingBox.inflate(-1);
+
+    IntPoint clippedPoint = point;
+    if (!focusedNodeBoundingBox.contains(clippedPoint))
+        clippedPoint = IntPoint(
+            point.x() < focusedNodeBoundingBox.x() ? focusedNodeBoundingBox.x() : std::min(focusedNodeBoundingBox.maxX(), point.x()),
+            point.y() < focusedNodeBoundingBox.y() ? focusedNodeBoundingBox.y() : std::min(focusedNodeBoundingBox.maxY(), point.y()));
+
+    return clippedPoint;
+}
+
+void SelectionHandler::setSelection(const IntPoint& start, const IntPoint& end)
+{
+    m_selectionActive = true;
+
+    ASSERT(m_webPage);
+    ASSERT(m_webPage->focusedOrMainFrame());
+    ASSERT(m_webPage->focusedOrMainFrame()->selection());
+
+    Frame* focusedFrame = m_webPage->focusedOrMainFrame();
+    FrameSelection* controller = focusedFrame->selection();
+
+    DEBUG_SELECTION(BlackBerry::Platform::LogLevelInfo, "SelectionHandler::setSelection adjusted points %d, %d, %d, %d", start.x(), start.y(), end.x(), end.y());
+
+    // Note that IntPoint(-1, -1) is being our sentinel so far for
+    // clipped out selection starting or ending location.
+    bool startIsValid = start != DOMSupport::InvalidPoint;
+    m_lastUpdatedEndPointIsValid = end != DOMSupport::InvalidPoint;
+
+    // At least one of the locations must be valid.
+    ASSERT(startIsValid || m_lastUpdatedEndPointIsValid);
+
+    IntPoint relativeStart = start;
+    IntPoint relativeEnd = end;
+
+    VisibleSelection newSelection(controller->selection());
+
+    // We need the selection to be ordered base then extent.
+    if (!controller->selection().isBaseFirst())
+        controller->setSelection(VisibleSelection(controller->selection().start(), controller->selection().end()));
+
+    if (startIsValid) {
+        relativeStart = DOMSupport::convertPointToFrame(m_webPage->mainFrame(), focusedFrame, start);
+
+        // Set the selection with validation.
+        newSelection.setBase(visiblePositionForPointIgnoringClipping(*focusedFrame, clipPointToFocusNode(relativeStart)));
+
+        // Reset the selection using the existing extent without validation.
+        newSelection.setWithoutValidation(newSelection.base(), controller->selection().end());
+    }
+
+    if (m_lastUpdatedEndPointIsValid) {
+        relativeEnd = DOMSupport::convertPointToFrame(m_webPage->mainFrame(), focusedFrame, end);
+
+        // Set the selection with validation.
+        newSelection.setExtent(visiblePositionForPointIgnoringClipping(*focusedFrame, clipPointToFocusNode(relativeEnd)));
+
+        // Reset the selection using the existing base without validation.
+        newSelection.setWithoutValidation(controller->selection().start(), newSelection.extent());
+    }
+
+    if (m_webPage->m_inputHandler->isInputMode()) {
+        if (updateOrHandleInputSelection(newSelection, relativeStart, relativeEnd))
+            return;
+    }
+
+    if (controller->selection() == newSelection) {
+        selectionPositionChanged();
+        return;
+    }
+
+    // If the selection size is reduce to less than a character, selection type becomes
+    // Caret. As long as it is still a range, it's a valid selection. Selection cannot
+    // be cancelled through this function.
+    BlackBerry::Platform::IntRectRegion region;
+    getConsolidatedRegionOfTextQuadsForSelection(newSelection, region);
+    clipRegionToVisibleContainer(region);
+    if (!region.isEmpty()) {
+        // Check if the handles reversed position.
+        if (m_selectionActive && !newSelection.isBaseFirst())
+            m_webPage->m_client->notifySelectionHandlesReversed();
+
+        controller->setSelection(newSelection);
+
+        DEBUG_SELECTION(BlackBerry::Platform::LogLevelInfo, "SelectionHandler::setSelection selection points valid, selection updated");
+    } else {
+        // Requested selection results in an empty selection, skip this change.
+        selectionPositionChanged();
+
+        DEBUG_SELECTION(BlackBerry::Platform::LogLevelWarn, "SelectionHandler::setSelection selection points invalid, selection not updated");
+    }
+}
+
+// FIXME re-use this in context. Must be updated to include an option to return the href.
+// This function should be moved to a new unit file. Names suggetions include DOMQueries
+// and NodeTypes. Functions currently in InputHandler.cpp, SelectionHandler.cpp and WebPage.cpp
+// can all be moved in.
+static Node* enclosingLinkEventParentForNode(Node* node)
+{
+    if (!node)
+        return 0;
+
+    Node* linkNode = node->enclosingLinkEventParentOrSelf();
+    return linkNode && linkNode->isLink() ? linkNode : 0;
+}
+
+void SelectionHandler::selectAtPoint(const IntPoint& location)
+{
+    // If point is invalid trigger selection based expansion.
+    if (location == DOMSupport::InvalidPoint) {
+        selectObject(WordGranularity);
+        return;
+    }
+
+    Node* targetNode;
+    IntPoint targetPosition;
+    // FIXME: Factory this get right fat finger code into a helper.
+    const FatFingersResult lastFatFingersResult = m_webPage->m_touchEventHandler->lastFatFingersResult();
+    if (lastFatFingersResult.positionWasAdjusted() && lastFatFingersResult.nodeAsElementIfApplicable()) {
+        targetNode = lastFatFingersResult.node(FatFingersResult::ShadowContentNotAllowed);
+        targetPosition = lastFatFingersResult.adjustedPosition();
+    } else {
+        FatFingersResult newFatFingersResult = FatFingers(m_webPage, location, FatFingers::Text).findBestPoint();
+        if (!newFatFingersResult.positionWasAdjusted())
+            return;
+
+        targetPosition = newFatFingersResult.adjustedPosition();
+        targetNode = newFatFingersResult.node(FatFingersResult::ShadowContentNotAllowed);
+    }
+
+    ASSERT(targetNode);
+
+    // If the node at the point is a link, focus on the entire link, not a word.
+    if (Node* link = enclosingLinkEventParentForNode(targetNode)) {
+        selectObject(link);
+        return;
+    }
+
+    // selectAtPoint API currently only supports WordGranularity but may be extended in the future.
+    selectObject(targetPosition, WordGranularity);
+}
+
+static bool expandSelectionToGranularity(Frame* frame, VisibleSelection selection, TextGranularity granularity, bool isInputMode)
+{
+    ASSERT(frame);
+    ASSERT(frame->selection());
+
+    if (!(selection.start().anchorNode() && selection.start().anchorNode()->isTextNode()))
+        return false;
+
+    if (granularity == WordGranularity)
+        selection = DOMSupport::visibleSelectionForClosestActualWordStart(selection);
+
+    selection.expandUsingGranularity(granularity);
+    RefPtr<Range> newRange = selection.toNormalizedRange();
+    RefPtr<Range> oldRange = frame->selection()->selection().toNormalizedRange();
+    EAffinity affinity = frame->selection()->affinity();
+
+    if (isInputMode && !frame->editor()->client()->shouldChangeSelectedRange(oldRange.get(), newRange.get(), affinity, false))
+        return false;
+
+    return frame->selection()->setSelectedRange(newRange.get(), affinity, true);
+}
+
+void SelectionHandler::selectObject(const IntPoint& location, TextGranularity granularity)
+{
+    ASSERT(location.x() >= 0 && location.y() >= 0);
+    ASSERT(m_webPage && m_webPage->focusedOrMainFrame() && m_webPage->focusedOrMainFrame()->selection());
+    Frame* focusedFrame = m_webPage->focusedOrMainFrame();
+
+    DEBUG_SELECTION(BlackBerry::Platform::LogLevelInfo, "SelectionHandler::selectObject adjusted points %d, %d", location.x(), location.y());
+
+    IntPoint relativePoint = DOMSupport::convertPointToFrame(m_webPage->mainFrame(), focusedFrame, location);
+    VisiblePosition pointLocation(focusedFrame->visiblePositionForPoint(relativePoint));
+    VisibleSelection selection = VisibleSelection(pointLocation, pointLocation);
+
+    m_selectionActive = expandSelectionToGranularity(focusedFrame, selection, granularity, m_webPage->m_inputHandler->isInputMode());
+}
+
+void SelectionHandler::selectObject(TextGranularity granularity)
+{
+    ASSERT(m_webPage && m_webPage->m_inputHandler);
+    // Using caret location, must be inside an input field.
+    if (!m_webPage->m_inputHandler->isInputMode())
+        return;
+
+    ASSERT(m_webPage->focusedOrMainFrame() && m_webPage->focusedOrMainFrame()->selection());
+    Frame* focusedFrame = m_webPage->focusedOrMainFrame();
+
+    DEBUG_SELECTION(BlackBerry::Platform::LogLevelInfo, "SelectionHandler::selectObject using current selection");
+
+    // Use the current selection as the selection point.
+    ASSERT(focusedFrame->selection()->selectionType() != VisibleSelection::NoSelection);
+    m_selectionActive = expandSelectionToGranularity(focusedFrame, focusedFrame->selection()->selection(), granularity, true /* isInputMode */);
+}
+
+void SelectionHandler::selectObject(Node* node)
+{
+    if (!node)
+        return;
+
+    m_selectionActive = true;
+
+    ASSERT(m_webPage && m_webPage->focusedOrMainFrame() && m_webPage->focusedOrMainFrame()->selection());
+    Frame* focusedFrame = m_webPage->focusedOrMainFrame();
+
+    DEBUG_SELECTION(BlackBerry::Platform::LogLevelInfo, "SelectionHandler::selectNode");
+
+    VisibleSelection selection = VisibleSelection::selectionFromContentsOfNode(node);
+    focusedFrame->selection()->setSelection(selection);
+}
+
+static TextDirection directionOfEnclosingBlock(FrameSelection* selection)
+{
+    Node* enclosingBlockNode = enclosingBlock(selection->selection().extent().deprecatedNode());
+    if (!enclosingBlockNode)
+        return LTR;
+
+    if (RenderObject* renderer = enclosingBlockNode->renderer())
+        return renderer->style()->direction();
+
+    return LTR;
+}
+
+// Returns > 0 if p1 is "closer" to referencePoint, < 0 if p2 is "closer", 0 if they are equidistant.
+// Because text is usually arranged in horizontal rows, distance is measured along the y-axis, with x-axis used only to break ties.
+// If rightGravity is true, the right-most x-coordinate is chosen, otherwise teh left-most coordinate is chosen.
+static inline int comparePointsToReferencePoint(const IntPoint& p1, const IntPoint& p2, const IntPoint& referencePoint, bool rightGravity)
+{
+    int dy1 = abs(referencePoint.y() - p1.y());
+    int dy2 = abs(referencePoint.y() - p2.y());
+    if (dy1 != dy2)
+        return dy2 - dy1;
+
+    // Same y-coordinate, choose the farthest right (or left) point.
+    if (p1.x() == p2.x())
+        return 0;
+
+    if (p1.x() > p2.x())
+        return rightGravity ? 1 : -1;
+
+    return rightGravity ? -1 : 1;
+}
+
+// NOTE/FIXME: Due to r77286, we are getting off-by-one results in the IntRect class counterpart implementation of the
+//             methods below. As done in r89803, r77928 and a few others, lets use local method to fix it.
+//             We should keep our eyes very open on it, since it can affect BackingStore very badly.
+static IntPoint minXMinYCorner(const IntRect& rect) { return rect.location(); } // typically topLeft
+static IntPoint maxXMinYCorner(const IntRect& rect) { return IntPoint(rect.x() + rect.width() - 1, rect.y()); } // typically topRight
+static IntPoint minXMaxYCorner(const IntRect& rect) { return IntPoint(rect.x(), rect.y() + rect.height() - 1); } // typically bottomLeft
+static IntPoint maxXMaxYCorner(const IntRect& rect) { return IntPoint(rect.x() + rect.width() - 1, rect.y() + rect.height() - 1); } // typically bottomRight
+
+// The caret is a one-pixel wide line down either the right or left edge of a
+// rect, depending on the text direction.
+static inline bool caretIsOnLeft(bool isStartCaret, bool isRTL)
+{
+    if (isStartCaret)
+        return !isRTL;
+
+    return isRTL;
+}
+
+static inline IntPoint caretLocationForRect(const IntRect& rect, bool isStartCaret, bool isRTL)
+{
+    return caretIsOnLeft(isStartCaret, isRTL) ? minXMinYCorner(rect) : maxXMinYCorner(rect);
+}
+
+static inline IntPoint caretComparisonPointForRect(const IntRect& rect, bool isStartCaret, bool isRTL)
+{
+    if (isStartCaret)
+        return caretIsOnLeft(isStartCaret, isRTL) ? minXMinYCorner(rect) : maxXMinYCorner(rect);
+
+    return caretIsOnLeft(isStartCaret, isRTL) ? minXMaxYCorner(rect) : maxXMaxYCorner(rect);
+}
+
+static void adjustCaretRects(IntRect& startCaret, bool isStartCaretClippedOut,
+                             IntRect& endCaret, bool isEndCaretClippedOut,
+                             const std::vector<BlackBerry::Platform::IntRect> rectList,
+                             const IntPoint& startReferencePoint,
+                             const IntPoint& endReferencePoint,
+                             bool isRTL)
+{
+    // startReferencePoint is the best guess at the top left of the selection; endReferencePoint is the best guess at the bottom right.
+    if (isStartCaretClippedOut)
+        startCaret.setLocation(DOMSupport::InvalidPoint);
+    else {
+        startCaret = rectList[0];
+        startCaret.setLocation(caretLocationForRect(startCaret, true, isRTL));
+    }
+
+    if (isEndCaretClippedOut)
+        endCaret.setLocation(DOMSupport::InvalidPoint);
+    else {
+        endCaret = rectList[0];
+        endCaret.setLocation(caretLocationForRect(endCaret, false, isRTL));
+    }
+
+    if (isStartCaretClippedOut && isEndCaretClippedOut)
+        return;
+
+    // Reset width to 1 as we are strictly interested in caret location.
+    startCaret.setWidth(1);
+    endCaret.setWidth(1);
+
+    for (unsigned i = 1; i < rectList.size(); i++) {
+        IntRect currentRect(rectList[i]);
+
+        // Compare and update the start and end carets with their respective reference points.
+        if (!isStartCaretClippedOut && comparePointsToReferencePoint(
+                    caretComparisonPointForRect(currentRect, true, isRTL),
+                    caretComparisonPointForRect(startCaret, true, isRTL),
+                    startReferencePoint, isRTL) > 0) {
+            startCaret.setLocation(caretLocationForRect(currentRect, true, isRTL));
+            startCaret.setHeight(currentRect.height());
+        }
+
+        if (!isEndCaretClippedOut && comparePointsToReferencePoint(
+                    caretComparisonPointForRect(currentRect, false, isRTL),
+                    caretComparisonPointForRect(endCaret, false, isRTL),
+                    endReferencePoint, !isRTL) > 0) {
+            endCaret.setLocation(caretLocationForRect(currentRect, false, isRTL));
+            endCaret.setHeight(currentRect.height());
+        }
+    }
+}
+
+void SelectionHandler::clipRegionToVisibleContainer(BlackBerry::Platform::IntRectRegion& region)
+{
+    ASSERT(m_webPage->m_mainFrame && m_webPage->m_mainFrame->view());
+
+    Frame* frame = m_webPage->focusedOrMainFrame();
+
+    // Don't allow the region to extend outside of the all its ancestor frames' visible area.
+    if (frame != m_webPage->mainFrame()) {
+        IntRect containingContentRect;
+        containingContentRect = m_webPage->getRecursiveVisibleWindowRect(frame->view(), true /* no clip to main frame window */);
+        containingContentRect = m_webPage->m_mainFrame->view()->windowToContents(containingContentRect);
+        region = intersectRegions(BlackBerry::Platform::IntRectRegion(containingContentRect), region);
+    }
+
+    // Don't allow the region to extend outside of the input field.
+    if (m_webPage->m_inputHandler->isInputMode()
+        && frame->document()->focusedNode()
+        && frame->document()->focusedNode()->renderer()) {
+
+        // Adjust the bounding box to the frame offset.
+        IntRect boundingBox(frame->document()->focusedNode()->renderer()->absoluteBoundingBoxRect());
+        boundingBox = m_webPage->mainFrame()->view()->windowToContents(frame->view()->contentsToWindow(boundingBox));
+
+        region = intersectRegions(BlackBerry::Platform::IntRectRegion(boundingBox), region);
+    }
+}
+
+static IntPoint referencePoint(const VisiblePosition& position, const IntRect& boundingRect, const IntPoint& framePosition, bool isStartCaret, bool isRTL)
+{
+    // If one of the carets is invalid (this happens, for instance, if the
+    // selection ends in an empty div) fall back to using the corner of the
+    // entire region (which is already in frame coordinates so doesn't need
+    // adjusting).
+    IntRect startCaretBounds(position.absoluteCaretBounds());
+    if (startCaretBounds.isEmpty())
+        startCaretBounds = boundingRect;
+    else
+        startCaretBounds.move(framePosition.x(), framePosition.y());
+
+    return caretComparisonPointForRect(startCaretBounds, isStartCaret, isRTL);
+}
+
+// Note: This is the only function in SelectionHandler in which the coordinate
+// system is not entirely WebKit.
+void SelectionHandler::selectionPositionChanged(bool visualChangeOnly)
+{
+    DEBUG_SELECTION(BlackBerry::Platform::LogLevelInfo, "SelectionHandler::selectionPositionChanged visibleChangeOnly = %s", visualChangeOnly ? "true" : "false");
+
+    // This method can get called during WebPage shutdown process.
+    // If that is the case, just bail out since the client is not
+    // in a safe state of trust to request anything else from it.
+    if (!m_webPage->m_mainFrame)
+        return;
+
+    if (m_webPage->m_inputHandler->isInputMode() && m_webPage->m_inputHandler->processingChange()) {
+        m_webPage->m_client->cancelSelectionVisuals();
+        return;
+    }
+
+    if (m_caretActive || (m_webPage->m_inputHandler->isInputMode() && m_webPage->focusedOrMainFrame()->selection()->isCaret())) {
+        // This may update the caret to no longer be active.
+        caretPositionChanged();
+    }
+
+    // Enter selection mode if selection type is RangeSelection, and disable selection if
+    // selection is active and becomes caret selection.
+    Frame* frame = m_webPage->focusedOrMainFrame();
+    IntPoint framePos = m_webPage->frameOffset(frame);
+    if (m_selectionActive && (m_caretActive || frame->selection()->isNone()))
+        m_selectionActive = false;
+    else if (frame->selection()->isRange())
+        m_selectionActive = true;
+    else if (!m_selectionActive)
+        return;
+
+    IntRect startCaret;
+    IntRect endCaret;
+
+    // Get the text rects from the selections range.
+    BlackBerry::Platform::IntRectRegion region;
+    getConsolidatedRegionOfTextQuadsForSelection(frame->selection()->selection(), region);
+
+    // If there is no change in selected text and the visual rects
+    // have not changed then don't bother notifying anything.
+    if (visualChangeOnly && m_lastSelectionRegion.isEqual(region))
+        return;
+
+    m_lastSelectionRegion = region;
+
+    if (!region.isEmpty()) {
+        IntRect unclippedStartCaret;
+        IntRect unclippedEndCaret;
+
+        bool isRTL = directionOfEnclosingBlock(frame->selection()) == RTL;
+
+        std::vector<BlackBerry::Platform::IntRect> rectList = region.rects();
+
+        IntPoint startCaretReferencePoint = referencePoint(frame->selection()->selection().visibleStart(), region.extents(), framePos, true /* isStartCaret */, isRTL);
+        IntPoint endCaretReferencePoint = referencePoint(frame->selection()->selection().visibleEnd(), region.extents(), framePos, false /* isStartCaret */, isRTL);
+
+        adjustCaretRects(unclippedStartCaret, false /* unclipped */, unclippedEndCaret, false /* unclipped */, rectList, startCaretReferencePoint, endCaretReferencePoint, isRTL);
+
+        clipRegionToVisibleContainer(region);
+
+#if SHOWDEBUG_SELECTIONHANDLER // Don't rely just on DEBUG_SELECTION to avoid loop.
+        for (unsigned int i = 0; i < rectList.size(); i++)
+            DEBUG_SELECTION(BlackBerry::Platform::LogLevelCritical, "Rect list - Unmodified #%d, (%d, %d) (%d x %d)", i, rectList[i].x(), rectList[i].y(), rectList[i].width(), rectList[i].height());
+        for (unsigned int i = 0; i < region.numRects(); i++)
+            DEBUG_SELECTION(BlackBerry::Platform::LogLevelCritical, "Rect list  - Consolidated #%d, (%d, %d) (%d x %d)", i, region.rects()[i].x(), region.rects()[i].y(), region.rects()[i].width(), region.rects()[i].height());
+#endif
+
+        bool shouldCareAboutPossibleClippedOutSelection = frame != m_webPage->mainFrame() || m_webPage->m_inputHandler->isInputMode();
+
+        if (!region.isEmpty() || shouldCareAboutPossibleClippedOutSelection) {
+            // Adjust the handle markers to be at the end of the painted rect. When selecting links
+            // and other elements that may have a larger visible area than needs to be rendered a gap
+            // can exist between the handle and overlay region.
+
+            bool shouldClipStartCaret = !region.isRectInRegion(unclippedStartCaret);
+            bool shouldClipEndCaret = !region.isRectInRegion(unclippedEndCaret);
+
+            // Find the top corner and bottom corner.
+            std::vector<BlackBerry::Platform::IntRect> clippedRectList = region.rects();
+            adjustCaretRects(startCaret, shouldClipStartCaret, endCaret, shouldClipEndCaret, clippedRectList, startCaretReferencePoint, endCaretReferencePoint, isRTL);
+
+            // Translate the caret values as they must be in transformed coordinates.
+            if (!shouldClipStartCaret) {
+                startCaret = m_webPage->mapToTransformed(startCaret);
+                m_webPage->clipToTransformedContentsRect(startCaret);
+            }
+
+            if (!shouldClipEndCaret) {
+                endCaret = m_webPage->mapToTransformed(endCaret);
+                m_webPage->clipToTransformedContentsRect(endCaret);
+            }
+        }
+    }
+
+    DEBUG_SELECTION(BlackBerry::Platform::LogLevelInfo, "SelectionHandler::selectionPositionChanged Start Rect=(%d, %d) (%d x %d) End Rect=(%d, %d) (%d x %d)",
+                    startCaret.x(), startCaret.y(), startCaret.width(), startCaret.height(), endCaret.x(), endCaret.y(), endCaret.width(), endCaret.height());
+
+
+    m_webPage->m_client->notifySelectionDetailsChanged(startCaret, endCaret, region);
+}
+
+// NOTE: This function is not in WebKit coordinates.
+void SelectionHandler::caretPositionChanged()
+{
+    DEBUG_SELECTION(BlackBerry::Platform::LogLevelInfo, "SelectionHandler::caretPositionChanged");
+
+    IntRect caretLocation;
+    // If the input field is not active, we must be turning off the caret.
+    if (!m_webPage->m_inputHandler->isInputMode() && m_caretActive) {
+        m_caretActive = false;
+        // Send an empty caret change to turn off the caret.
+        m_webPage->m_client->notifyCaretChanged(caretLocation, m_webPage->m_touchEventHandler->lastFatFingersResult().isTextInput() /* userTouchTriggered */);
+        return;
+    }
+
+    ASSERT(m_webPage && m_webPage->focusedOrMainFrame() && m_webPage->focusedOrMainFrame()->selection());
+
+    // This function should only reach this point if input mode is active.
+    ASSERT(m_webPage->m_inputHandler->isInputMode());
+
+    if (m_webPage->focusedOrMainFrame()->selection()->selectionType() == VisibleSelection::CaretSelection) {
+        IntPoint frameOffset = m_webPage->frameOffset(m_webPage->focusedOrMainFrame());
+
+        caretLocation = m_webPage->focusedOrMainFrame()->selection()->selection().visibleStart().absoluteCaretBounds();
+        caretLocation.move(frameOffset.x(), frameOffset.y());
+
+        // Clip against the containing frame and node boundaries.
+        BlackBerry::Platform::IntRectRegion region(caretLocation);
+        clipRegionToVisibleContainer(region);
+        caretLocation = region.extents();
+    }
+
+    m_caretActive = !caretLocation.isEmpty();
+
+    DEBUG_SELECTION(BlackBerry::Platform::LogLevelInfo, "SelectionHandler::caretPositionChanged caret Rect %d, %d, %dx%d",
+                        caretLocation.x(), caretLocation.y(), caretLocation.width(), caretLocation.height());
+
+    caretLocation = m_webPage->mapToTransformed(caretLocation);
+    m_webPage->clipToTransformedContentsRect(caretLocation);
+
+    m_webPage->m_client->notifyCaretChanged(caretLocation, m_webPage->m_touchEventHandler->lastFatFingersResult().isTextInput() /* userTouchTriggered */);
+}
+
+bool SelectionHandler::selectionContains(const IntPoint& point)
+{
+    ASSERT(m_webPage && m_webPage->focusedOrMainFrame() && m_webPage->focusedOrMainFrame()->selection());
+    return m_webPage->focusedOrMainFrame()->selection()->contains(point);
+}
+
+}
+}
diff --git a/Source/WebKit/blackberry/WebKitSupport/SelectionHandler.h b/Source/WebKit/blackberry/WebKitSupport/SelectionHandler.h
new file mode 100644
index 000000000..8c5fe7637
--- /dev/null
+++ b/Source/WebKit/blackberry/WebKitSupport/SelectionHandler.h
@@ -0,0 +1,92 @@
+/*
+ * Copyright (C) 2010, 2011, 2012 Research In Motion Limited. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+#ifndef SelectionHandler_h
+#define SelectionHandler_h
+
+#include "BlackBerryPlatformIntRectRegion.h"
+#include "BlackBerryPlatformPrimitives.h"
+#include "TextGranularity.h"
+
+namespace WTF {
+class String;
+}
+
+namespace WebCore {
+class IntPoint;
+class IntRect;
+class Node;
+class VisiblePosition;
+class VisibleSelection;
+}
+
+namespace BlackBerry {
+
+namespace WebKit {
+
+class WebPagePrivate;
+class WebString;
+
+class SelectionHandler {
+public:
+    SelectionHandler(WebPagePrivate*);
+    ~SelectionHandler();
+
+    bool isSelectionActive() { return m_selectionActive; }
+    void setSelectionActive(bool active) { m_selectionActive = active; }
+
+    void cancelSelection();
+    WebString selectedText() const;
+
+    bool selectionContains(const WebCore::IntPoint&);
+
+    void setSelection(const WebCore::IntPoint& start, const WebCore::IntPoint& end);
+    void selectAtPoint(const WebCore::IntPoint&);
+    void selectObject(const WebCore::IntPoint&, WebCore::TextGranularity);
+    void selectObject(WebCore::TextGranularity);
+    void selectObject(WebCore::Node*);
+
+    void selectionPositionChanged(bool visualChangeOnly = false);
+
+    void setCaretPosition(const WebCore::IntPoint&);
+
+    bool lastUpdatedEndPointIsValid() const { return m_lastUpdatedEndPointIsValid; }
+
+private:
+    void caretPositionChanged();
+    void getConsolidatedRegionOfTextQuadsForSelection(const WebCore::VisibleSelection&, BlackBerry::Platform::IntRectRegion&) const;
+    void clipRegionToVisibleContainer(BlackBerry::Platform::IntRectRegion&);
+    bool updateOrHandleInputSelection(WebCore::VisibleSelection& newSelection, const WebCore::IntPoint& relativeStart
+                                      , const WebCore::IntPoint& relativeEnd);
+    WebCore::Node* DOMContainerNodeForVisiblePosition(const WebCore::VisiblePosition&) const;
+    bool shouldUpdateSelectionOrCaretForPoint(const WebCore::IntPoint&, const WebCore::IntRect&, bool startCaret = true) const;
+    unsigned short extendSelectionToFieldBoundary(bool isStartHandle, const WebCore::IntPoint& selectionPoint, WebCore::VisibleSelection& newSelection);
+    WebCore::IntPoint clipPointToFocusNode(const WebCore::IntPoint&);
+
+    WebPagePrivate* m_webPage;
+
+    bool m_selectionActive;
+    bool m_caretActive;
+    bool m_lastUpdatedEndPointIsValid;
+    BlackBerry::Platform::IntRectRegion m_lastSelectionRegion;
+};
+
+}
+}
+
+#endif // SelectionHandler_h
diff --git a/Source/WebKit/blackberry/WebKitSupport/SurfacePool.cpp b/Source/WebKit/blackberry/WebKitSupport/SurfacePool.cpp
new file mode 100644
index 000000000..2642f39e3
--- /dev/null
+++ b/Source/WebKit/blackberry/WebKitSupport/SurfacePool.cpp
@@ -0,0 +1,199 @@
+/*
+ * Copyright (C) 2010, 2011, 2012 Research In Motion Limited. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+#include "config.h"
+#include "SurfacePool.h"
+
+#include "PlatformContextSkia.h"
+
+#if USE(ACCELERATED_COMPOSITING)
+#include "BackingStoreCompositingSurface.h"
+#endif
+
+#include <BlackBerryPlatformLog.h>
+#include <BlackBerryPlatformMisc.h>
+#include <BlackBerryPlatformScreen.h>
+#include <BlackBerryPlatformSettings.h>
+
+#define SHARED_PIXMAP_GROUP "webkit_backingstore_group"
+
+namespace BlackBerry {
+namespace WebKit {
+
+#if USE(ACCELERATED_COMPOSITING) && ENABLE_COMPOSITING_SURFACE
+static PassRefPtr<BackingStoreCompositingSurface> createCompositingSurface()
+{
+    BlackBerry::Platform::IntSize screenSize = BlackBerry::Platform::Graphics::Screen::size();
+    return BackingStoreCompositingSurface::create(screenSize, false /*doubleBuffered*/);
+}
+#endif
+
+SurfacePool* SurfacePool::globalSurfacePool()
+{
+    static SurfacePool* s_instance = 0;
+    if (!s_instance)
+        s_instance = new SurfacePool;
+    return s_instance;
+}
+
+SurfacePool::SurfacePool()
+    : m_visibleTileBuffer(0)
+#if USE(ACCELERATED_COMPOSITING)
+    , m_compositingSurface(0)
+#endif
+    , m_tileRenderingSurface(0)
+    , m_backBuffer(0)
+    , m_initialized(false)
+    , m_buffersSuspended(false)
+{
+}
+
+void SurfacePool::initialize(const BlackBerry::Platform::IntSize& tileSize)
+{
+    if (m_initialized)
+        return;
+    m_initialized = true;
+
+    const unsigned numberOfTiles = BlackBerry::Platform::Settings::get()->numberOfBackingStoreTiles();
+    const unsigned maxNumberOfTiles = BlackBerry::Platform::Settings::get()->maximumNumberOfBackingStoreTilesAcrossProcesses();
+
+    if (numberOfTiles) { // Only allocate if we actually use a backingstore.
+        unsigned byteLimit = (maxNumberOfTiles /*pool*/ + 2 /*visible tile buffer, backbuffer*/) * tileSize.width() * tileSize.height() * 4;
+        bool success = BlackBerry::Platform::Graphics::createPixmapGroup(SHARED_PIXMAP_GROUP, byteLimit);
+        if (!success) {
+            BlackBerry::Platform::log(BlackBerry::Platform::LogLevelWarn,
+                "Shared buffer pool could not be set up, using regular memory allocation instead.");
+        }
+    }
+
+    m_tileRenderingSurface = BlackBerry::Platform::Graphics::drawingSurface();
+
+#if USE(ACCELERATED_COMPOSITING) && ENABLE_COMPOSITING_SURFACE
+    m_compositingSurface = createCompositingSurface();
+#endif
+
+    if (!numberOfTiles)
+        return; // we only use direct rendering when 0 tiles are specified.
+
+    // Create the shared backbuffer.
+    m_backBuffer = reinterpret_cast<unsigned>(new TileBuffer(tileSize));
+
+    for (size_t i = 0; i < numberOfTiles; ++i)
+        m_tilePool.append(BackingStoreTile::create(tileSize, BackingStoreTile::DoubleBuffered));
+}
+
+PlatformGraphicsContext* SurfacePool::createPlatformGraphicsContext(BlackBerry::Platform::Graphics::Drawable* drawable) const
+{
+    return new WebCore::PlatformContextSkia(drawable);
+}
+
+PlatformGraphicsContext* SurfacePool::lockTileRenderingSurface() const
+{
+    if (!m_tileRenderingSurface)
+        return 0;
+
+    return createPlatformGraphicsContext(BlackBerry::Platform::Graphics::lockBufferDrawable(m_tileRenderingSurface));
+}
+
+void SurfacePool::releaseTileRenderingSurface(PlatformGraphicsContext* context) const
+{
+    if (!m_tileRenderingSurface)
+        return;
+
+    delete context;
+    BlackBerry::Platform::Graphics::releaseBufferDrawable(m_tileRenderingSurface);
+}
+
+void SurfacePool::initializeVisibleTileBuffer(const BlackBerry::Platform::IntSize& visibleSize)
+{
+    if (!m_visibleTileBuffer || m_visibleTileBuffer->size() != visibleSize) {
+        delete m_visibleTileBuffer;
+        m_visibleTileBuffer = BackingStoreTile::create(visibleSize, BackingStoreTile::SingleBuffered);
+    }
+}
+
+TileBuffer* SurfacePool::backBuffer() const
+{
+    ASSERT(m_backBuffer);
+    return reinterpret_cast<TileBuffer*>(m_backBuffer);
+}
+
+#if USE(ACCELERATED_COMPOSITING)
+BackingStoreCompositingSurface* SurfacePool::compositingSurface() const
+{
+    return m_compositingSurface.get();
+}
+#endif
+
+void SurfacePool::notifyScreenRotated()
+{
+#if USE(ACCELERATED_COMPOSITING) && ENABLE_COMPOSITING_SURFACE
+    // Recreate compositing surface at new screen resolution.
+    m_compositingSurface = createCompositingSurface();
+#endif
+}
+
+std::string SurfacePool::sharedPixmapGroup() const
+{
+    return SHARED_PIXMAP_GROUP;
+}
+
+void SurfacePool::createBuffers()
+{
+    if (!m_initialized || m_tilePool.isEmpty())
+        return;
+
+    // Create the tile pool.
+    for (size_t i = 0; i < m_tilePool.size(); ++i)
+        BlackBerry::Platform::Graphics::createPixmapBuffer(m_tilePool[i]->frontBuffer()->nativeBuffer());
+
+    if (m_visibleTileBuffer)
+        BlackBerry::Platform::Graphics::createPixmapBuffer(m_visibleTileBuffer->frontBuffer()->nativeBuffer());
+
+    if (backBuffer())
+        BlackBerry::Platform::Graphics::createPixmapBuffer(backBuffer()->nativeBuffer());
+
+    m_buffersSuspended = false;
+}
+
+void SurfacePool::releaseBuffers()
+{
+    if (!m_initialized || m_tilePool.isEmpty())
+        return;
+
+    m_buffersSuspended = true;
+
+    // Release the tile pool.
+    for (size_t i = 0; i < m_tilePool.size(); ++i) {
+        m_tilePool[i]->frontBuffer()->clearRenderedRegion();
+        BlackBerry::Platform::Graphics::destroyPixmapBuffer(m_tilePool[i]->frontBuffer()->nativeBuffer());
+    }
+
+    if (m_visibleTileBuffer) {
+        m_visibleTileBuffer->frontBuffer()->clearRenderedRegion();
+        BlackBerry::Platform::Graphics::destroyPixmapBuffer(m_visibleTileBuffer->frontBuffer()->nativeBuffer());
+    }
+
+    if (backBuffer()) {
+        backBuffer()->clearRenderedRegion();
+        BlackBerry::Platform::Graphics::destroyPixmapBuffer(backBuffer()->nativeBuffer());
+    }
+}
+
+}
+}
diff --git a/Source/WebKit/blackberry/WebKitSupport/SurfacePool.h b/Source/WebKit/blackberry/WebKitSupport/SurfacePool.h
new file mode 100644
index 000000000..fa88a5d6a
--- /dev/null
+++ b/Source/WebKit/blackberry/WebKitSupport/SurfacePool.h
@@ -0,0 +1,93 @@
+/*
+ * Copyright (C) 2010, 2011, 2012 Research In Motion Limited. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+#ifndef SurfacePool_h
+#define SurfacePool_h
+
+#include "BackingStoreTile.h"
+
+#include "PlatformContextSkia.h"
+
+#include <BlackBerryPlatformGraphics.h>
+#include <BlackBerryPlatformPrimitives.h>
+#include <wtf/Vector.h>
+
+#define ENABLE_COMPOSITING_SURFACE 1
+
+namespace BlackBerry {
+namespace WebKit {
+
+class BackingStoreCompositingSurface;
+
+class SurfacePool {
+public:
+    static SurfacePool* globalSurfacePool();
+
+    void initialize(const BlackBerry::Platform::IntSize&);
+
+    int isActive() const { return !m_tilePool.isEmpty() && !m_buffersSuspended; }
+    int isEmpty() const { return m_tilePool.isEmpty(); }
+    int size() const { return m_tilePool.size(); }
+
+    typedef WTF::Vector<BackingStoreTile*> TileList;
+    const TileList tileList() const { return m_tilePool; }
+
+    PlatformGraphicsContext* createPlatformGraphicsContext(BlackBerry::Platform::Graphics::Drawable*) const;
+    PlatformGraphicsContext* lockTileRenderingSurface() const;
+    void releaseTileRenderingSurface(PlatformGraphicsContext*) const;
+    BackingStoreTile* visibleTileBuffer() const { return m_visibleTileBuffer; }
+
+    void initializeVisibleTileBuffer(const BlackBerry::Platform::IntSize&);
+
+    // This is a shared back buffer that is used by all the tiles since
+    // only one tile will be rendering it at a time and we invalidate
+    // the whole tile every time we render by copying from the front
+    // buffer those portions that we don't render. This allows us to
+    // have N+1 tilebuffers rather than N*2 for our double buffered
+    // backingstore.
+    TileBuffer* backBuffer() const;
+
+    BackingStoreCompositingSurface* compositingSurface() const;
+
+    void notifyScreenRotated();
+
+    std::string sharedPixmapGroup() const;
+
+    void releaseBuffers();
+    void createBuffers();
+
+private:
+    // This is necessary so BackingStoreTile can atomically swap buffers with m_backBuffer.
+    friend class BackingStoreTile;
+
+    SurfacePool();
+
+    TileList m_tilePool;
+    BackingStoreTile* m_visibleTileBuffer;
+#if USE(ACCELERATED_COMPOSITING)
+    RefPtr<BackingStoreCompositingSurface> m_compositingSurface;
+#endif
+    BlackBerry::Platform::Graphics::Buffer* m_tileRenderingSurface;
+    unsigned m_backBuffer;
+    bool m_initialized; // SurfacePool has been set up, with or without buffers.
+    bool m_buffersSuspended; // Buffer objects exist, but pixel memory has been freed.
+};
+}
+}
+
+#endif // SurfacePool_h
diff --git a/Source/WebKit/blackberry/WebKitSupport/TileIndex.h b/Source/WebKit/blackberry/WebKitSupport/TileIndex.h
new file mode 100644
index 000000000..3149847c9
--- /dev/null
+++ b/Source/WebKit/blackberry/WebKitSupport/TileIndex.h
@@ -0,0 +1,63 @@
+/*
+ * Copyright (C) 2009, 2010, 2011 Research In Motion Limited. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+#ifndef TileIndex_h
+#define TileIndex_h
+
+#include <limits>
+
+namespace BlackBerry {
+namespace WebKit {
+
+class TileIndex {
+public:
+    TileIndex()
+        : m_i(std::numeric_limits<unsigned int>::max())
+        , m_j(std::numeric_limits<unsigned int>::max()) { }
+    TileIndex(unsigned int i, unsigned int j)
+        : m_i(i)
+        , m_j(j) { }
+    ~TileIndex() { }
+
+    unsigned int i() const { return m_i; }
+    unsigned int j() const { return m_j; }
+    void setIndex(unsigned int i, unsigned int j)
+    {
+        m_i = i;
+        m_j = j;
+    }
+
+private:
+    bool m_isValid;
+    unsigned int m_i;
+    unsigned int m_j;
+};
+
+inline bool operator==(const BlackBerry::WebKit::TileIndex& a, const BlackBerry::WebKit::TileIndex& b)
+{
+    return a.i() == b.i() && a.j() == b.j();
+}
+
+inline bool operator!=(const BlackBerry::WebKit::TileIndex& a, const BlackBerry::WebKit::TileIndex& b)
+{
+    return a.i() != b.i() || a.j() != b.j();
+}
+}
+}
+
+#endif // TileIndex_h
diff --git a/Source/WebKit/blackberry/WebKitSupport/TileIndexHash.h b/Source/WebKit/blackberry/WebKitSupport/TileIndexHash.h
new file mode 100644
index 000000000..0d4633b75
--- /dev/null
+++ b/Source/WebKit/blackberry/WebKitSupport/TileIndexHash.h
@@ -0,0 +1,56 @@
+/*
+ * Copyright (C) 2009, 2010, 2011, 2012 Research In Motion Limited. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+#ifndef TileIndexHash_h
+#define TileIndexHash_h
+
+#include "TileIndex.h"
+#include <limits>
+#include <wtf/HashMap.h>
+
+using BlackBerry::WebKit::TileIndex;
+
+namespace WTF {
+
+template<> struct IntHash<TileIndex> {
+    static unsigned hash(const TileIndex& key) { return intHash((static_cast<uint64_t>(key.i()) << 32 | key.j())); }
+    static bool equal(const TileIndex& a, const TileIndex& b) { return a == b; }
+    static const bool safeToCompareToEmptyOrDeleted = true;
+};
+template<> struct DefaultHash<TileIndex> {
+    typedef IntHash<TileIndex> Hash;
+};
+
+template<> struct HashTraits<TileIndex> : GenericHashTraits<TileIndex> {
+    static const bool emptyValueIsZero = false;
+    static const bool needsDestruction = false;
+    static TileIndex emptyValue() { return TileIndex(); }
+    static void constructDeletedValue(TileIndex& slot)
+    {
+        new (&slot) TileIndex(std::numeric_limits<unsigned int>::max() - 1,
+                              std::numeric_limits<unsigned int>::max() - 1);
+    }
+    static bool isDeletedValue(const TileIndex& value)
+    {
+        return value.i() == (std::numeric_limits<unsigned int>::max() - 1)
+               && value.j() == (std::numeric_limits<unsigned int>::max() - 1);
+    }
+};
+} // namespace WTF
+
+#endif // TileIndexHash_h
diff --git a/Source/WebKit/blackberry/WebKitSupport/TouchEventHandler.cpp b/Source/WebKit/blackberry/WebKitSupport/TouchEventHandler.cpp
new file mode 100644
index 000000000..cfe559af0
--- /dev/null
+++ b/Source/WebKit/blackberry/WebKitSupport/TouchEventHandler.cpp
@@ -0,0 +1,405 @@
+/*
+ * Copyright (C) 2010, 2011, 2012 Research In Motion Limited. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+#include "config.h"
+#include "TouchEventHandler.h"
+
+#include "DOMSupport.h"
+#include "Document.h"
+#include "DocumentMarkerController.h"
+#include "FocusController.h"
+#include "Frame.h"
+#include "FrameView.h"
+#include "HTMLAnchorElement.h"
+#include "HTMLAreaElement.h"
+#include "HTMLImageElement.h"
+#include "HTMLInputElement.h"
+#include "HTMLNames.h"
+#include "HTMLPlugInElement.h"
+#include "InputHandler.h"
+#include "IntRect.h"
+#include "IntSize.h"
+#include "Node.h"
+#include "Page.h"
+#include "PlatformMouseEvent.h"
+#include "PlatformTouchEvent.h"
+#include "RenderLayer.h"
+#include "RenderTheme.h"
+#include "RenderView.h"
+#include "RenderedDocumentMarker.h"
+#include "SelectionHandler.h"
+#include "WebPage_p.h"
+
+#include <wtf/MathExtras.h>
+
+using namespace WebCore;
+using namespace WTF;
+
+namespace BlackBerry {
+namespace WebKit {
+
+static bool hasMouseMoveListener(Element* element)
+{
+    ASSERT(element);
+    return element->hasEventListeners(eventNames().mousemoveEvent) || element->document()->hasEventListeners(eventNames().mousemoveEvent);
+}
+
+static bool hasTouchListener(Element* element)
+{
+    ASSERT(element);
+    return element->hasEventListeners(eventNames().touchstartEvent)
+        || element->hasEventListeners(eventNames().touchmoveEvent)
+        || element->hasEventListeners(eventNames().touchcancelEvent)
+        || element->hasEventListeners(eventNames().touchendEvent);
+}
+
+static bool elementExpectsMouseEvents(Element* element)
+{
+    // Make sure we are not operating a shadow node here, since the webpages
+    // aren't able to attach event listeners to shadow content.
+    ASSERT(element);
+    while (element->isInShadowTree())
+        element = toElement(element->shadowAncestorNode());
+
+    return hasMouseMoveListener(element) && !hasTouchListener(element);
+}
+
+static bool shouldConvertTouchToMouse(Element* element)
+{
+    if (!element)
+        return false;
+
+    // Range element are a special case that require natural mouse events in order to allow
+    // dragging of the slider handle.
+    if (element->hasTagName(HTMLNames::inputTag)) {
+        HTMLInputElement* inputElement = static_cast<HTMLInputElement*>(element);
+        if (inputElement->isRangeControl())
+            return true;
+    }
+
+    if ((element->hasTagName(HTMLNames::objectTag) || element->hasTagName(HTMLNames::embedTag)) && static_cast<HTMLPlugInElement*>(element))
+        return true;
+
+    // Check if the element has a mouse listener and no touch listener. If so,
+    // the field will require touch events be converted to mouse events to function properly.
+    if (elementExpectsMouseEvents(element))
+        return true;
+
+    return false;
+}
+
+TouchEventHandler::TouchEventHandler(WebPagePrivate* webpage)
+    : m_webPage(webpage)
+    , m_didCancelTouch(false)
+    , m_convertTouchToMouse(false)
+    , m_existingTouchMode(ProcessedTouchEvents)
+{
+}
+
+TouchEventHandler::~TouchEventHandler()
+{
+}
+
+bool TouchEventHandler::shouldSuppressMouseDownOnTouchDown() const
+{
+    return m_lastFatFingersResult.isTextInput() || m_webPage->m_inputHandler->isInputMode() || m_webPage->m_selectionHandler->isSelectionActive();
+}
+
+void TouchEventHandler::touchEventCancel()
+{
+    m_webPage->m_inputHandler->processPendingKeyboardVisibilityChange();
+
+    if (!shouldSuppressMouseDownOnTouchDown()) {
+        // Input elements delay mouse down and do not need to be released on touch cancel.
+        m_webPage->m_page->focusController()->focusedOrMainFrame()->eventHandler()->setMousePressed(false);
+    }
+    m_convertTouchToMouse = false;
+    m_didCancelTouch = true;
+
+    // If we cancel a single touch event, we need to also clean up any hover
+    // state we get into by synthetically moving the mouse to the m_fingerPoint.
+    Element* elementUnderFatFinger = m_lastFatFingersResult.nodeAsElementIfApplicable();
+    if (elementUnderFatFinger && elementUnderFatFinger->renderer()) {
+
+        HitTestRequest request(HitTestRequest::FingerUp);
+        // The HitTestResult point is not actually needed.
+        HitTestResult result(IntPoint::zero());
+        result.setInnerNode(elementUnderFatFinger);
+
+        Document* document = elementUnderFatFinger->document();
+        ASSERT(document);
+        document->renderView()->layer()->updateHoverActiveState(request, result);
+        document->updateStyleIfNeeded();
+        // Updating the document style may destroy the renderer.
+        if (elementUnderFatFinger->renderer())
+            elementUnderFatFinger->renderer()->repaint();
+        ASSERT(!elementUnderFatFinger->hovered());
+    }
+
+    m_lastFatFingersResult.reset();
+}
+
+void TouchEventHandler::touchEventCancelAndClearFocusedNode()
+{
+    touchEventCancel();
+    m_webPage->clearFocusNode();
+}
+
+void TouchEventHandler::touchHoldEvent()
+{
+    // This is a hack for our hack that converts the touch pressed event that we've delayed because the user has focused a input field
+    // to the page as a mouse pressed event.
+    if (shouldSuppressMouseDownOnTouchDown())
+        handleFatFingerPressed();
+
+    // Clear the focus ring indication if tap-and-hold'ing on a link.
+    if (m_lastFatFingersResult.node() && m_lastFatFingersResult.node()->isLink())
+        m_webPage->clearFocusNode();
+}
+
+bool TouchEventHandler::handleTouchPoint(Platform::TouchPoint& point)
+{
+    switch (point.m_state) {
+    case Platform::TouchPoint::TouchPressed:
+        {
+            m_lastFatFingersResult.reset(); // Theoretically this shouldn't be required. Keep it just in case states get mangled.
+            m_didCancelTouch = false;
+            m_lastScreenPoint = point.m_screenPos;
+
+            IntPoint contentPos(m_webPage->mapFromViewportToContents(point.m_pos));
+
+            m_lastFatFingersResult = FatFingers(m_webPage, contentPos, FatFingers::ClickableElement).findBestPoint();
+
+            Element* elementUnderFatFinger = 0;
+            if (m_lastFatFingersResult.positionWasAdjusted() && m_lastFatFingersResult.node()) {
+                ASSERT(m_lastFatFingersResult.node()->isElementNode());
+                elementUnderFatFinger = m_lastFatFingersResult.nodeAsElementIfApplicable();
+            }
+
+            // Set or reset the touch mode.
+            Element* possibleTargetNodeForMouseMoveEvents = static_cast<Element*>(m_lastFatFingersResult.positionWasAdjusted() ? elementUnderFatFinger : m_lastFatFingersResult.node());
+            m_convertTouchToMouse = shouldConvertTouchToMouse(possibleTargetNodeForMouseMoveEvents);
+
+            if (elementUnderFatFinger)
+                drawTapHighlight();
+
+            // Lets be conservative here: since we have problems on major website having
+            // mousemove listener for no good reason (e.g. google.com, desktop edition),
+            // let only delay client notifications when there is not input text node involved.
+            if (m_convertTouchToMouse
+                && (m_webPage->m_inputHandler->isInputMode() && !m_lastFatFingersResult.isTextInput())) {
+                m_webPage->m_inputHandler->setDelayKeyboardVisibilityChange(true);
+                handleFatFingerPressed();
+            } else if (!shouldSuppressMouseDownOnTouchDown())
+                handleFatFingerPressed();
+
+            return true;
+        }
+    case Platform::TouchPoint::TouchReleased:
+        {
+            // Apply any suppressed changes. This does not eliminate the need
+            // for the show after the handling of fat finger pressed as it may
+            // have triggered a state change.
+            m_webPage->m_inputHandler->processPendingKeyboardVisibilityChange();
+
+            if (shouldSuppressMouseDownOnTouchDown())
+                handleFatFingerPressed();
+
+            // The rebase has eliminated a necessary event when the mouse does not
+            // trigger an actual selection change preventing re-showing of the
+            // keyboard. If input mode is active, call showVirtualKeyboard which
+            // will update the state and display keyboard if needed.
+            if (m_webPage->m_inputHandler->isInputMode())
+                m_webPage->m_inputHandler->notifyClientOfKeyboardVisibilityChange(true);
+
+            IntPoint adjustedPoint;
+            if (m_convertTouchToMouse) {
+                adjustedPoint = point.m_pos;
+                m_convertTouchToMouse = false;
+            } else // Fat finger point in viewport coordinates.
+                adjustedPoint = m_webPage->mapFromContentsToViewport(m_lastFatFingersResult.adjustedPosition());
+
+            PlatformMouseEvent mouseEvent(adjustedPoint, m_lastScreenPoint, MouseEventReleased, 1, LeftButton, TouchScreen);
+            m_webPage->handleMouseEvent(mouseEvent);
+            m_lastFatFingersResult.reset(); // Reset the fat finger result as its no longer valid when a user's finger is not on the screen.
+
+            unsigned spellLength = spellCheck(point);
+            if (spellLength) {
+                unsigned end = m_webPage->m_inputHandler->caretPosition();
+                unsigned start = end - spellLength;
+                m_webPage->m_client->requestSpellingSuggestionsForString(start, end);
+            }
+            return true;
+        }
+    case Platform::TouchPoint::TouchMoved:
+        if (m_convertTouchToMouse) {
+            PlatformMouseEvent mouseEvent(point.m_pos, m_lastScreenPoint, MouseEventMoved, 1, LeftButton, TouchScreen);
+            m_lastScreenPoint = point.m_screenPos;
+            if (!m_webPage->handleMouseEvent(mouseEvent)) {
+                m_convertTouchToMouse = false;
+                return false;
+            }
+            return true;
+        }
+        break;
+    default:
+        break;
+    }
+    return false;
+}
+
+unsigned TouchEventHandler::spellCheck(Platform::TouchPoint& touchPoint)
+{
+    Element* elementUnderFatFinger = m_lastFatFingersResult.nodeAsElementIfApplicable();
+    if (!m_lastFatFingersResult.isTextInput() || !elementUnderFatFinger)
+        return 0;
+
+    IntPoint contentPos(m_webPage->mapFromViewportToContents(touchPoint.m_pos));
+    contentPos = DOMSupport::convertPointToFrame(m_webPage->mainFrame(), m_webPage->focusedOrMainFrame(), contentPos);
+
+    Document* document = elementUnderFatFinger->document();
+    ASSERT(document);
+    RenderedDocumentMarker* marker = document->markers()->renderedMarkerContainingPoint(contentPos, DocumentMarker::Spelling);
+    if (!marker)
+        return 0;
+
+    IntRect rect = marker->renderedRect();
+    IntPoint newContentPos = IntPoint(rect.x() + rect.width(), rect.y() + rect.height() / 2);
+    Frame* frame = m_webPage->focusedOrMainFrame();
+    if (frame != m_webPage->mainFrame())
+        newContentPos = m_webPage->mainFrame()->view()->windowToContents(frame->view()->contentsToWindow(newContentPos));
+    m_lastFatFingersResult.m_adjustedPosition = newContentPos;
+    m_lastFatFingersResult.m_positionWasAdjusted = true;
+    return marker->endOffset() - marker->startOffset();
+}
+
+void TouchEventHandler::handleFatFingerPressed()
+{
+    if (!m_didCancelTouch) {
+
+        // First update the mouse position with a MouseMoved event.
+        PlatformMouseEvent mouseMoveEvent(m_webPage->mapFromContentsToViewport(m_lastFatFingersResult.adjustedPosition()), m_lastScreenPoint, MouseEventMoved, 0, LeftButton, TouchScreen);
+        m_webPage->handleMouseEvent(mouseMoveEvent);
+
+        // Then send the MousePressed event.
+        PlatformMouseEvent mousePressedEvent(m_webPage->mapFromContentsToViewport(m_lastFatFingersResult.adjustedPosition()), m_lastScreenPoint, MouseEventPressed, 1, LeftButton, TouchScreen);
+        m_webPage->handleMouseEvent(mousePressedEvent);
+    }
+}
+
+// This method filters what element will get tap-highlight'ed or not. To start with,
+// we are going to highlight links (anchors with a valid href element), and elements
+// whose tap highlight color value is different than the default value.
+static Element* elementForTapHighlight(Element* elementUnderFatFinger)
+{
+    // Do not bail out right way here if there element does not have a renderer.
+    // It is the casefor <map> (descendent of <area>) elements. The associated <image>
+    // element actually has the renderer.
+    if (elementUnderFatFinger->renderer()) {
+        Color tapHighlightColor = elementUnderFatFinger->renderStyle()->tapHighlightColor();
+        if (tapHighlightColor != RenderTheme::defaultTheme()->platformTapHighlightColor())
+            return elementUnderFatFinger;
+    }
+
+    bool isArea = elementUnderFatFinger->hasTagName(HTMLNames::areaTag);
+    Node* linkNode = elementUnderFatFinger->enclosingLinkEventParentOrSelf();
+    if (!linkNode || !linkNode->isHTMLElement() || (!linkNode->renderer() && !isArea))
+        return 0;
+
+    ASSERT(linkNode->isLink());
+
+    // FatFingers class selector ensure only anchor with valid href attr value get here.
+    // It includes empty hrefs.
+    Element* highlightCandidateElement = static_cast<Element*>(linkNode);
+
+    if (!isArea)
+        return highlightCandidateElement;
+
+    HTMLAreaElement* area = static_cast<HTMLAreaElement*>(highlightCandidateElement);
+    HTMLImageElement* image = area->imageElement();
+    if (image && image->renderer())
+        return image;
+
+    return 0;
+}
+
+void TouchEventHandler::drawTapHighlight()
+{
+    Element* elementUnderFatFinger = m_lastFatFingersResult.nodeAsElementIfApplicable();
+    if (!elementUnderFatFinger)
+        return;
+
+    Element* element = elementForTapHighlight(elementUnderFatFinger);
+    if (!element)
+        return;
+
+    // Get the element bounding rect in transformed coordinates so we can extract
+    // the focus ring relative position each rect.
+    RenderObject* renderer = element->renderer();
+    ASSERT(renderer);
+
+    Frame* elementFrame = element->document()->frame();
+    ASSERT(elementFrame);
+
+    FrameView* elementFrameView = elementFrame->view();
+    if (!elementFrameView)
+        return;
+
+    // Tell the client if the element is either in a scrollable container or in a fixed positioned container.
+    // On the client side, this info is being used to hide the tap highlight window on scroll.
+    RenderLayer* layer = m_webPage->enclosingFixedPositionedAncestorOrSelfIfFixedPositioned(renderer->enclosingLayer());
+    bool shouldHideTapHighlightRightAfterScrolling = !layer->renderer()->isRenderView();
+    shouldHideTapHighlightRightAfterScrolling |= !!m_webPage->m_inRegionScrollStartingNode.get();
+
+    IntPoint framePos(m_webPage->frameOffset(elementFrame));
+
+    // FIXME: We can get more precise on the <map> case by calculating the rect with HTMLAreaElement::computeRect().
+    IntRect absoluteRect = renderer->absoluteClippedOverflowRect();
+    absoluteRect.move(framePos.x(), framePos.y());
+
+    IntRect clippingRect;
+    if (elementFrame == m_webPage->mainFrame())
+        clippingRect = IntRect(IntPoint(0, 0), elementFrameView->contentsSize());
+    else
+        clippingRect = m_webPage->mainFrame()->view()->windowToContents(m_webPage->getRecursiveVisibleWindowRect(elementFrameView, true /*noClipToMainFrame*/));
+    clippingRect = intersection(absoluteRect, clippingRect);
+
+    Vector<FloatQuad> focusRingQuads;
+    renderer->absoluteFocusRingQuads(focusRingQuads);
+
+    Platform::IntRectRegion region;
+    for (size_t i = 0; i < focusRingQuads.size(); ++i) {
+        IntRect rect = focusRingQuads[i].enclosingBoundingBox();
+        rect.move(framePos.x(), framePos.y());
+        IntRect clippedRect = intersection(clippingRect, rect);
+        clippedRect.inflate(2);
+        region = unionRegions(region, Platform::IntRect(clippedRect));
+    }
+
+    Color highlightColor = element->renderStyle()->tapHighlightColor();
+
+    m_webPage->m_client->drawTapHighlight(region,
+                                          highlightColor.red(),
+                                          highlightColor.green(),
+                                          highlightColor.blue(),
+                                          highlightColor.alpha(),
+                                          shouldHideTapHighlightRightAfterScrolling);
+}
+
+}
+}
diff --git a/Source/WebKit/blackberry/WebKitSupport/TouchEventHandler.h b/Source/WebKit/blackberry/WebKitSupport/TouchEventHandler.h
new file mode 100644
index 000000000..473fc30a2
--- /dev/null
+++ b/Source/WebKit/blackberry/WebKitSupport/TouchEventHandler.h
@@ -0,0 +1,71 @@
+/*
+ * Copyright (C) 2010, 2011, 2012 Research In Motion Limited. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+#ifndef TouchEventHandler_h
+#define TouchEventHandler_h
+
+#include "ChromeClient.h"
+#include "FatFingers.h"
+#include "IntPoint.h"
+
+#include <BlackBerryPlatformTouchEvent.h>
+#include <BlackBerryPlatformWindow.h>
+
+namespace BlackBerry {
+namespace WebKit {
+
+class WebPagePrivate;
+
+class TouchEventHandler {
+public:
+    TouchEventHandler(WebPagePrivate* webpage);
+    ~TouchEventHandler();
+
+    bool handleTouchPoint(Platform::TouchPoint&);
+    void touchEventCancel();
+    void touchEventCancelAndClearFocusedNode();
+    void touchHoldEvent();
+
+    bool shouldSuppressMouseDownOnTouchDown() const;
+
+    const FatFingersResult& lastFatFingersResult() const { return m_lastFatFingersResult; }
+    void resetLastFatFingersResult() { m_lastFatFingersResult.reset(); }
+
+private:
+    unsigned spellCheck(Platform::TouchPoint&);
+    void handleFatFingerPressed();
+
+    void drawTapHighlight();
+
+private:
+    WebPagePrivate* m_webPage;
+
+    bool m_didCancelTouch;
+    bool m_convertTouchToMouse;
+
+    WebCore::TouchEventMode m_existingTouchMode;
+
+    WebCore::IntPoint m_lastScreenPoint; // Screen Position
+
+    FatFingersResult m_lastFatFingersResult;
+};
+
+}
+}
+
+#endif // TouchEventHandler_h
diff --git a/Source/WebKit/blackberry/WebKitSupport/WebPageCompositor.cpp b/Source/WebKit/blackberry/WebKitSupport/WebPageCompositor.cpp
new file mode 100644
index 000000000..fcbc1acff
--- /dev/null
+++ b/Source/WebKit/blackberry/WebKitSupport/WebPageCompositor.cpp
@@ -0,0 +1,116 @@
+/*
+ * Copyright (C) 2010, 2011, 2012 Research In Motion Limited. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+#include "config.h"
+
+#if USE(ACCELERATED_COMPOSITING)
+#include "WebPageCompositor.h"
+
+#include "LayerWebKitThread.h"
+#include "WebPage_p.h"
+
+#include <GenericTimerClient.h>
+#include <ThreadTimerClient.h>
+
+using namespace WebCore;
+
+namespace BlackBerry {
+namespace WebKit {
+
+WebPageCompositor::WebPageCompositor(WebPagePrivate* page)
+    : m_webPage(page)
+    , m_layerRenderer(LayerRenderer::create(page->m_page))
+    , m_generation(0)
+    , m_compositedGeneration(-1)
+    , m_compositingOntoMainWindow(false)
+    , m_blitTimer(this, &BlackBerry::WebKit::WebPageCompositor::blitTimerFired)
+    , m_timerClient(new BlackBerry::Platform::GenericTimerClient(BlackBerry::Platform::userInterfaceThreadTimerClient()))
+{
+    m_blitTimer.setClient(m_timerClient);
+}
+
+WebPageCompositor::~WebPageCompositor()
+{
+    m_blitTimer.stop();
+    delete m_timerClient;
+}
+
+bool WebPageCompositor::hardwareCompositing() const
+{
+    return m_layerRenderer->hardwareCompositing();
+}
+
+void WebPageCompositor::setRootLayer(LayerCompositingThread* rootLayer)
+{
+    m_rootLayer = rootLayer;
+    m_layerRenderer->setRootLayer(m_rootLayer.get());
+}
+
+void WebPageCompositor::setCompositingOntoMainWindow(bool compositingOntoMainWindow)
+{
+    m_compositingOntoMainWindow = compositingOntoMainWindow;
+    m_layerRenderer->setClearSurfaceOnDrawLayers(!compositingOntoMainWindow);
+}
+
+void WebPageCompositor::commit(LayerWebKitThread* rootLayer)
+{
+    if (!rootLayer)
+        return;
+
+    rootLayer->commitOnCompositingThread();
+    ++m_generation;
+}
+
+bool WebPageCompositor::drawLayers(const IntRect& dstRect, const FloatRect& contents)
+{
+    // Save a draw if we already drew this generation, for example due to a concurrent scroll operation.
+    if (m_compositedGeneration == m_generation && dstRect == m_compositedDstRect
+        && contents == m_compositedContentsRect && !m_compositingOntoMainWindow)
+        return false;
+
+    m_layerRenderer->drawLayers(contents, m_layoutRectForCompositing, m_contentsSizeForCompositing, dstRect);
+    m_lastCompositingResults = m_layerRenderer->lastRenderingResults();
+
+    m_compositedDstRect = dstRect;
+    m_compositedContentsRect = contents;
+    m_compositedGeneration = m_generation;
+
+    if (m_lastCompositingResults.needsAnimationFrame) {
+        ++m_generation; // The animation update moves us along one generation.
+        // Using a timeout of 0 actually won't start a timer, it will send a message.
+        m_blitTimer.start(1.0 / 60.0);
+        m_webPage->updateDelegatedOverlays();
+    }
+
+    return true;
+}
+
+void WebPageCompositor::releaseLayerResources()
+{
+    m_layerRenderer->releaseLayerResources();
+}
+
+void WebPageCompositor::blitTimerFired()
+{
+    m_webPage->blitVisibleContents();
+}
+
+} // namespace WebKit
+} // namespace BlackBerry
+
+#endif // USE(ACCELERATED_COMPOSITING)
diff --git a/Source/WebKit/blackberry/WebKitSupport/WebPageCompositor.h b/Source/WebKit/blackberry/WebKitSupport/WebPageCompositor.h
new file mode 100644
index 000000000..437ab95e0
--- /dev/null
+++ b/Source/WebKit/blackberry/WebKitSupport/WebPageCompositor.h
@@ -0,0 +1,90 @@
+/*
+ * Copyright (C) 2010, 2011, 2012 Research In Motion Limited. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+#ifndef WebPageCompositor_h
+#define WebPageCompositor_h
+
+#if USE(ACCELERATED_COMPOSITING)
+
+#include "LayerCompositingThread.h"
+#include "LayerRenderer.h"
+
+#include <BlackBerryPlatformTimer.h>
+#include <wtf/OwnPtr.h>
+#include <wtf/RefPtr.h>
+
+namespace WebCore {
+class LayerWebKitThread;
+};
+
+namespace BlackBerry {
+namespace WebKit {
+
+class WebPagePrivate;
+
+// This class may only be used on the compositing thread.
+class WebPageCompositor {
+public:
+    WebPageCompositor(WebPagePrivate*);
+    ~WebPageCompositor();
+
+    bool hardwareCompositing() const;
+
+    void setRootLayer(WebCore::LayerCompositingThread*);
+
+    void setCompositingOntoMainWindow(bool);
+
+    void commit(WebCore::LayerWebKitThread* rootLayerProxy);
+
+    bool drawLayers(const WebCore::IntRect& dstRect, const WebCore::FloatRect& contents);
+
+    WebCore::IntRect layoutRectForCompositing() const { return m_layoutRectForCompositing; }
+    void setLayoutRectForCompositing(const WebCore::IntRect& rect) { m_layoutRectForCompositing = rect; }
+
+    WebCore::IntSize contentsSizeForCompositing() const { return m_contentsSizeForCompositing; }
+    void setContentsSizeForCompositing(const WebCore::IntSize& size) { m_contentsSizeForCompositing = size; }
+
+    WebCore::LayerRenderingResults lastCompositingResults() const { return m_lastCompositingResults; }
+    void setLastCompositingResults(const WebCore::LayerRenderingResults& results) { m_lastCompositingResults = results; }
+
+    void releaseLayerResources();
+
+private:
+    void blitTimerFired();
+
+    WebPagePrivate* m_webPage;
+    OwnPtr<WebCore::LayerRenderer> m_layerRenderer;
+    RefPtr<WebCore::LayerCompositingThread> m_rootLayer;
+    WebCore::IntRect m_layoutRectForCompositing;
+    WebCore::IntSize m_contentsSizeForCompositing;
+    WebCore::LayerRenderingResults m_lastCompositingResults;
+    int m_generation;
+    int m_compositedGeneration;
+    WebCore::IntRect m_compositedDstRect;
+    WebCore::FloatRect m_compositedContentsRect;
+    bool m_compositingOntoMainWindow;
+    BlackBerry::Platform::Timer<WebPageCompositor> m_blitTimer;
+    BlackBerry::Platform::TimerClient* m_timerClient;
+};
+
+} // namespace WebKit
+} // namespace BlackBerry
+
+#endif // USE(ACCELERATED_COMPOSITING)
+
+#endif // WebPageCompositor_h
diff --git a/Source/WebKit/chromium/ChangeLog b/Source/WebKit/chromium/ChangeLog
index c3837d1cf..797b31c6c 100644
--- a/Source/WebKit/chromium/ChangeLog
+++ b/Source/WebKit/chromium/ChangeLog
@@ -1,3 +1,1562 @@
+2012-02-24  Shinya Kawanaka  <shinyak@chromium.org>
+
+        SpellCheckRequest needs to know the context where the spellcheck happened.
+        https://bugs.webkit.org/show_bug.cgi?id=79320
+
+        Reviewed by Hajime Morita.
+
+        * src/EditorClientImpl.cpp:
+        (WebKit::EditorClientImpl::requestCheckingOfString):
+        * src/EditorClientImpl.h:
+        (EditorClientImpl):
+        * src/WebFrameImpl.cpp:
+        (WebKit::WebFrameImpl::requestTextChecking):
+
+2012-02-23  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed.  Rolled DEPS.
+
+        * DEPS:
+
+2012-02-23  Ian Vollick  <vollick@chromium.org>
+
+        [chromium] Implement keyframed animations for the cc thread.
+        https://bugs.webkit.org/show_bug.cgi?id=77229
+
+        Reviewed by James Robinson.
+
+        * WebKit.gypi:
+        * tests/CCAnimationTestCommon.cpp:
+        (WebCore):
+        (WebCore::addOpacityTransition):
+        (WebKitTests::addOpacityTransitionToController):
+        (WebKitTests::addOpacityTransitionToLayer):
+        * tests/CCAnimationTestCommon.h:
+        (WebCore):
+        (WebKitTests):
+        * tests/CCKeyframedAnimationCurveTest.cpp: Added.
+        (WebCore):
+        (WebCore::expectTranslateX):
+        (WebCore::TEST):
+        * tests/CCLayerAnimationControllerTest.cpp:
+        (WebKitTests::expectTranslateX):
+        (WebKitTests):
+        (WebKitTests::TEST):
+        * tests/CCLayerTreeHostTest.cpp:
+        (WTF::CCLayerTreeHostTest::dispatchAddAnimation):
+        (WTF::CCLayerTreeHostTest::doBeginTest):
+
+2012-02-23  James Robinson  <jamesr@chromium.org>
+
+        [chromium] Clean up GraphicsContext3D initialization paths
+        https://bugs.webkit.org/show_bug.cgi?id=79321
+
+        Reviewed by Kenneth Russell.
+
+        This simplifies the GraphicsContext3D initialization paths down to two simple codepaths, one for offscreen
+        contexts initialized from WebCore and one for onscreen (compositor) contexts initialized by WebViewImpl or
+        WebLayerTreeViewImpl.
+
+        Offscreen initialization path:
+        1) WebCore code calls WebCore::GraphicsContext3D::create(), implemented in GraphicsContext3DChromium.cpp
+        2) GraphicsContext3D::create() instantiates a WebGraphicsContext3D via the static WebKitPlatformSupport interface
+        3) GraphicsContext3DPrivate::createGraphicsContextFromWebContext() wraps the WebGraphicsContext3D in a
+        GraphicsContext3D's m_private pointer.
+
+        Onscreen initialization path:
+        1) WebViewImpl or WebLayerTreeViewImpl request an onscreen WebGraphicsContext3D from either their WebViewClient
+        or WebLayerTreeViewClient, respectively
+        2) GraphicsContext3DPrivate::createGraphicsContextFromWebContext() wraps the WebGraphicsContext3D in a
+        GraphicsContext3D's m_private pointer.
+
+        There are no other initialization paths. Specifically, we do not support instantiating onscreen contexts from
+        within WebCore.
+
+        * src/GraphicsContext3DChromium.cpp:
+        (WebCore::GraphicsContext3DPrivate::GraphicsContext3DPrivate):
+        (WebCore::GraphicsContext3DPrivate::createGraphicsContextFromWebContext):
+        (WebCore):
+        (WebCore::GraphicsContext3DPrivate::platformTexture):
+        (WebCore::GraphicsContext3D::create):
+        * src/GraphicsContext3DPrivate.h:
+        (GraphicsContext3DPrivate):
+        * src/WebLayerTreeViewImpl.cpp:
+        (WebKit::WebLayerTreeViewImpl::createLayerTreeHostContext3D):
+        * src/WebViewImpl.cpp:
+        (std::getCompositorContextAttributes):
+        (WebKit::WebViewImpl::createCompositorGraphicsContext3D):
+        (WebKit):
+        (WebKit::WebViewImpl::createLayerTreeHostContext3D):
+        (WebKit::WebViewImpl::graphicsContext3D):
+        * src/WebViewImpl.h:
+        (WebViewImpl):
+        * tests/CCLayerTreeHostImplTest.cpp:
+        (WebKit::CCLayerTreeHostImplTest::createContext):
+        (CCLayerTreeHostImplTest):
+        (WebKit::TEST_F):
+        * tests/CCLayerTreeHostTest.cpp:
+        (WTF::MockLayerTreeHostClient::createLayerTreeHostContext3D):
+        * tests/Canvas2DLayerChromiumTest.cpp:
+        (WebCore::Canvas2DLayerChromiumTest::fullLifecycleTest):
+        * tests/CompositorFakeGraphicsContext3D.h:
+        (WebCore::createCompositorMockGraphicsContext3D):
+        * tests/FakeGraphicsContext3DTest.cpp:
+        (TEST):
+
+2012-02-23  Jonathan Backer  <backer@chromium.org>
+
+        [chromium] Plumb video damage to the damage tracker.
+        https://bugs.webkit.org/show_bug.cgi?id=79373
+
+        Reviewed by James Robinson.
+
+        * src/WebMediaPlayerClientImpl.cpp:
+        (WebKit::WebMediaPlayerClientImpl::repaint):
+
+2012-02-21  James Robinson  <jamesr@chromium.org>
+
+        [chromium] Notify compositor of wheel event registration via ScrollingCoordinator
+        https://bugs.webkit.org/show_bug.cgi?id=79133
+
+        Reviewed by Dimitri Glazkov.
+
+        Rips out old wheel event notification and adds unit tests for new LayerChromium property.
+
+        * src/NonCompositedContentHost.cpp:
+        (WebKit::NonCompositedContentHost::setViewport):
+        * src/WebCompositorInputHandlerImpl.cpp:
+        (WebKit::WebCompositorInputHandlerImpl::handleInputEvent):
+        * src/WebViewImpl.cpp:
+        (WebKit::WebViewImpl::numberOfWheelEventHandlersChanged):
+        (WebKit::WebViewImpl::setIsAcceleratedCompositingActive):
+        * src/WebViewImpl.h:
+        * tests/CCLayerTreeHostImplTest.cpp:
+        (WebKit::TEST_F):
+        (WebKit):
+        * tests/LayerChromiumTest.cpp:
+        * tests/WebCompositorInputHandlerImplTest.cpp:
+
+2012-02-23  Adrienne Walker  <enne@google.com>
+
+        Unreviewed, rolling out r108666.
+        http://trac.webkit.org/changeset/108666
+        https://bugs.webkit.org/show_bug.cgi?id=79321
+
+        Breaks webplugin tests: http://goo.gl/CoHIi
+
+        * src/GraphicsContext3DChromium.cpp:
+        (WebCore::GraphicsContext3DPrivate::GraphicsContext3DPrivate):
+        (WebCore):
+        (WebCore::GraphicsContext3DPrivate::create):
+        (WebCore::GraphicsContext3DPrivate::createGraphicsContextFromWebContext):
+        (WebCore::GraphicsContext3DPrivate::createGraphicsContextForAnotherThread):
+        (WebCore::GraphicsContext3DPrivate::platformTexture):
+        (WebCore::GraphicsContext3D::create):
+        * src/GraphicsContext3DPrivate.h:
+        (WebKit):
+        (GraphicsContext3DPrivate):
+        * src/WebLayerTreeViewImpl.cpp:
+        (WebKit::WebLayerTreeViewImpl::createLayerTreeHostContext3D):
+        * src/WebViewImpl.cpp:
+        (std::getCompositorContextAttributes):
+        (WebKit::WebViewImpl::createLayerTreeHostContext3D):
+        (WebKit::WebViewImpl::graphicsContext3D):
+        * tests/CCLayerTreeHostImplTest.cpp:
+        (CCLayerTreeHostImplTest):
+        (WebKit::TEST_F):
+        * tests/CCLayerTreeHostTest.cpp:
+        (WTF::MockLayerTreeHostClient::createLayerTreeHostContext3D):
+        * tests/Canvas2DLayerChromiumTest.cpp:
+        (WebCore::Canvas2DLayerChromiumTest::fullLifecycleTest):
+        * tests/CompositorFakeGraphicsContext3D.h:
+        (WebCore::createCompositorMockGraphicsContext3D):
+        * tests/FakeGraphicsContext3DTest.cpp:
+        (TEST):
+
+2012-02-23  Daniel Sievers  <sievers@chromium.org>
+
+        [Chromium] Add video stream texture support
+        https://bugs.webkit.org/show_bug.cgi?id=78398
+
+        This upstreams the abstraction used on Android for
+        hardware video decoding with the compositor.
+
+        Most of the interfaces are kept generic and the core
+        of this change is to allow texturing from an external
+        texture while receiving notifications (on the compositor
+        thread if we are running it) when there are new frames to
+        be displayed.
+
+        Reviewed by James Robinson.
+
+        * WebKit.gyp:
+        * public/WebMediaPlayer.h:
+        (WebKit):
+        (WebKit::WebMediaPlayer::setStreamTextureClient):
+        (WebMediaPlayer):
+        * public/WebStreamTextureClient.h: Copied from Source/WebKit/chromium/public/WebVideoFrame.h.
+        (WebKit):
+        (WebStreamTextureClient):
+        (WebKit::WebStreamTextureClient::~WebStreamTextureClient):
+        * public/WebVideoFrame.h:
+        * src/WebMediaPlayerClientImpl.cpp:
+        (WebKit::WebMediaPlayerClientImpl::~WebMediaPlayerClientImpl):
+        (WebKit::WebMediaPlayerClientImpl::setVideoFrameProviderClient):
+        (WebKit::WebMediaPlayerClientImpl::didReceiveFrame):
+        (WebKit):
+        (WebKit::WebMediaPlayerClientImpl::didUpdateMatrix):
+        * src/WebMediaPlayerClientImpl.h:
+        (WebMediaPlayerClientImpl):
+
+2012-02-22  James Robinson  <jamesr@chromium.org>
+
+        [chromium] Clean up GraphicsContext3D initialization paths
+        https://bugs.webkit.org/show_bug.cgi?id=79321
+
+        Reviewed by Kenneth Russell.
+
+        This simplifies the GraphicsContext3D initialization paths down to two simple codepaths, one for offscreen
+        contexts initialized from WebCore and one for onscreen (compositor) contexts initialized by WebViewImpl or
+        WebLayerTreeViewImpl.
+
+        Offscreen initialization path:
+        1) WebCore code calls WebCore::GraphicsContext3D::create(), implemented in GraphicsContext3DChromium.cpp
+        2) GraphicsContext3D::create() instantiates a WebGraphicsContext3D via the static WebKitPlatformSupport interface
+        3) GraphicsContext3DPrivate::createGraphicsContextFromWebContext() wraps the WebGraphicsContext3D in a
+        GraphicsContext3D's m_private pointer.
+
+        Onscreen initialization path:
+        1) WebViewImpl or WebLayerTreeViewImpl request an onscreen WebGraphicsContext3D from either their WebViewClient
+        or WebLayerTreeViewClient, respectively
+        2) GraphicsContext3DPrivate::createGraphicsContextFromWebContext() wraps the WebGraphicsContext3D in a
+        GraphicsContext3D's m_private pointer.
+
+        There are no other initialization paths. Specifically, we do not support instantiating onscreen contexts from
+        within WebCore.
+
+        * src/GraphicsContext3DChromium.cpp:
+        (WebCore::GraphicsContext3DPrivate::GraphicsContext3DPrivate):
+        (WebCore::GraphicsContext3DPrivate::createGraphicsContextFromWebContext):
+        (WebCore):
+        (WebCore::GraphicsContext3DPrivate::platformTexture):
+        (WebCore::GraphicsContext3D::create):
+        * src/GraphicsContext3DPrivate.h:
+        (GraphicsContext3DPrivate):
+        * src/WebLayerTreeViewImpl.cpp:
+        (WebKit::WebLayerTreeViewImpl::createLayerTreeHostContext3D):
+        * src/WebViewImpl.cpp:
+        (std::getCompositorContextAttributes):
+        (WebKit::WebViewImpl::createLayerTreeHostContext3D):
+        (WebKit::WebViewImpl::graphicsContext3D):
+        * tests/CCLayerTreeHostImplTest.cpp:
+        (WebKit::CCLayerTreeHostImplTest::createContext):
+        (CCLayerTreeHostImplTest):
+        (WebKit::TEST_F):
+        * tests/CCLayerTreeHostTest.cpp:
+        (WTF::MockLayerTreeHostClient::createLayerTreeHostContext3D):
+        * tests/Canvas2DLayerChromiumTest.cpp:
+        (WebCore::Canvas2DLayerChromiumTest::fullLifecycleTest):
+        * tests/CompositorFakeGraphicsContext3D.h:
+        (WebCore::createCompositorMockGraphicsContext3D):
+        * tests/FakeGraphicsContext3DTest.cpp:
+        (TEST):
+
+2012-02-23  Greg Billock  <gbillock@google.com>
+
+        Add UserGestureIndicator capability to Chromium API.
+        https://bugs.webkit.org/show_bug.cgi?id=77690
+
+        Reviewed by Darin Fisher.
+
+        * WebKit.gyp:
+        * public/WebScopedUserGesture.h: Added.
+        * src/WebScopedUserGesture.cpp: Added.
+
+2012-02-23  Peter Beverloo  <peter@chromium.org>
+
+        Unreviewed, rolling out r108627 and r108630.
+        https://bugs.webkit.org/show_bug.cgi?id=79367
+
+        ffmpeg is creating issues and was just reverted upstream as well.
+
+        * DEPS:
+
+2012-02-23  Peter Beverloo  <peter@chromium.org>
+
+        Unreviewed build fix. Remove the ffmpeg binary directory from the
+        Chromium-Windows DEPS file, following the commit done in the
+        Chromium repository:
+        http://src.chromium.org/viewvc/chrome?view=rev&revision=123123
+
+        * DEPS:
+
+2012-02-23  Peter Beverloo  <peter@chromium.org>
+
+        Unreviewed.  Rolled DEPS.
+
+        * DEPS:
+
+2012-02-22  Hajime Morrita  <morrita@chromium.org>
+
+        NOTIFICATIONS should be implemented as PageSupplement
+        https://bugs.webkit.org/show_bug.cgi?id=79052
+
+        Reviewed by Adam Barth.
+
+        * src/WebViewImpl.cpp:
+        (WebKit::WebViewImpl::WebViewImpl):
+
+2012-02-22  Dana Jansens  <danakj@chromium.org>
+
+        [chromium] Add unit test for surface occlusion
+        https://bugs.webkit.org/show_bug.cgi?id=79302
+
+        Reviewed by James Robinson.
+
+        * tests/CCOcclusionTrackerTest.cpp:
+        (WebCore::TEST):
+        (WebCore):
+
+2012-02-22  James Robinson  <jamesr@chromium.org>
+
+        Remove GraphicsContext3D::paintsIntoCanvasBuffer and unify WebGL and canvas 2d logic
+        https://bugs.webkit.org/show_bug.cgi?id=79317
+
+        Reviewed by Kenneth Russell.
+
+        Remove paintsIntoCanvasBuffer() implementations.
+
+        * src/GraphicsContext3DChromium.cpp:
+        (WebCore):
+        * src/GraphicsContext3DPrivate.h:
+
+2012-02-22  Yuta Kitamura  <yutak@chromium.org>
+
+        Unreviewed, rolling out r108590.
+        http://trac.webkit.org/changeset/108590
+
+        I mistakenly disabled tests even though the fix was already
+        in.
+
+        * tests/CCOcclusionTrackerTest.cpp:
+        (WebCore::TEST):
+
+2012-02-22  Yuta Kitamura  <yutak@chromium.org>
+
+        [Chromium] Unreviewed. Disable two tests from CCOcclusionTrackerTest
+        which cause assertion failures.
+
+        * tests/CCOcclusionTrackerTest.cpp:
+        (WebCore):
+        (WebCore::TEST):
+
+2012-02-22  Dana Jansens  <danakj@chromium.org>
+
+        [chromium] Fix CCOcclusionTracker unit test assertion
+        https://bugs.webkit.org/show_bug.cgi?id=79275
+
+        Reviewed by James Robinson.
+
+        * tests/CCOcclusionTrackerTest.cpp:
+        (WebCore::TEST):
+
+2012-02-22  Ian Vollick  <vollick@chromium.org>
+
+        [chromium] Plumb from GraphicsLayer to the cc thread animation code
+        https://bugs.webkit.org/show_bug.cgi?id=75874
+
+        Reviewed by James Robinson.
+
+        * WebKit.gypi:
+        * public/WebSettings.h:
+        * public/platform/WebLayerTreeView.h:
+        (WebKit::WebLayerTreeView::Settings::Settings):
+        (Settings):
+        * src/WebLayerTreeView.cpp:
+        (WebKit::WebLayerTreeView::Settings::operator CCSettings):
+        * src/WebSettingsImpl.cpp:
+        (WebKit::WebSettingsImpl::setThreadedAnimationEnabled):
+        (WebKit):
+        * src/WebSettingsImpl.h:
+        (WebSettingsImpl):
+        * src/WebViewImpl.cpp:
+        (WebKit::WebViewImpl::setIsAcceleratedCompositingActive):
+        * tests/CCActiveAnimationTest.cpp:
+        (WebCore::createActiveAnimation):
+        * tests/CCAnimationTestCommon.cpp: Added.
+        (WebKitTests):
+        (WebKitTests::FakeFloatAnimationCurve::FakeFloatAnimationCurve):
+        (WebKitTests::FakeFloatAnimationCurve::~FakeFloatAnimationCurve):
+        (WebKitTests::FakeFloatAnimationCurve::clone):
+        (WebKitTests::FakeTransformTransition::FakeTransformTransition):
+        (WebKitTests::FakeTransformTransition::~FakeTransformTransition):
+        (WebKitTests::FakeTransformTransition::getValue):
+        (WebKitTests::FakeTransformTransition::clone):
+        (WebKitTests::FakeFloatTransition::FakeFloatTransition):
+        (WebKitTests::FakeFloatTransition::~FakeFloatTransition):
+        (WebKitTests::FakeFloatTransition::getValue):
+        (WebKitTests::FakeLayerAnimationControllerImplClient::FakeLayerAnimationControllerImplClient):
+        (WebKitTests::FakeLayerAnimationControllerImplClient::~FakeLayerAnimationControllerImplClient):
+        (WebKitTests::FakeFloatTransition::clone):
+        (WebKitTests::addOpacityTransition):
+        * tests/CCAnimationTestCommon.h: Added.
+        (WebCore):
+        (WebKitTests):
+        (FakeFloatAnimationCurve):
+        (WebKitTests::FakeFloatAnimationCurve::duration):
+        (WebKitTests::FakeFloatAnimationCurve::getValue):
+        (FakeTransformTransition):
+        (WebKitTests::FakeTransformTransition::duration):
+        (FakeFloatTransition):
+        (WebKitTests::FakeFloatTransition::duration):
+        (FakeLayerAnimationControllerImplClient):
+        (WebKitTests::FakeLayerAnimationControllerImplClient::id):
+        (WebKitTests::FakeLayerAnimationControllerImplClient::opacity):
+        (WebKitTests::FakeLayerAnimationControllerImplClient::setOpacity):
+        (WebKitTests::FakeLayerAnimationControllerImplClient::transform):
+        (WebKitTests::FakeLayerAnimationControllerImplClient::setTransform):
+        (WebKitTests::FakeLayerAnimationControllerImplClient::bounds):
+        * tests/CCLayerAnimationControllerImplTest.cpp:
+        (WebKitTests::createActiveAnimation):
+        (WebKitTests::TEST):
+        * tests/CCLayerAnimationControllerTest.cpp: Added.
+        (WebKitTests):
+        (WebKitTests::createActiveAnimation):
+        (WebKitTests::TEST):
+        * tests/CCLayerTreeHostImplTest.cpp:
+        (WebKit::CCLayerTreeHostImplTest::postAnimationEventsToMainThreadOnImplThread):
+        * tests/CCLayerTreeHostTest.cpp:
+        (WTF::TestHooks::animateLayers):
+        (MockLayerTreeHostImpl):
+        (WTF::MockLayerTreeHostImpl::animateLayers):
+        (WTF::MockLayerTreeHost::create):
+        (WTF::MockLayerTreeHost::createLayerTreeHostImpl):
+        (WTF):
+        (MockLayerAnimationController):
+        (WTF::MockLayerAnimationController::create):
+        (WTF::MockLayerAnimationController::addAnimation):
+        (WTF::MockLayerTreeHostClient::scheduleComposite):
+        (WTF::CCLayerTreeHostTest::postAddAnimationToMainThread):
+        (CCLayerTreeHostTest):
+        (WTF::CCLayerTreeHostTest::dispatchAddAnimation):
+        (WTF::CCLayerTreeHostTest::doBeginTest):
+        (CCLayerTreeHostTestAddAnimation):
+        (WTF::CCLayerTreeHostTestAddAnimation::CCLayerTreeHostTestAddAnimation):
+        (WTF::CCLayerTreeHostTestAddAnimation::beginTest):
+        (WTF::CCLayerTreeHostTestAddAnimation::animateLayers):
+        (WTF::CCLayerTreeHostTestAddAnimation::afterTest):
+        (WTF::TEST_F):
+        * tests/TreeSynchronizerTest.cpp:
+        (FakeLayerAnimationController):
+        (WebKitTests::FakeLayerAnimationController::create):
+        (WebKitTests::FakeLayerAnimationController::synchronizedAnimations):
+        (WebKitTests::FakeLayerAnimationController::FakeLayerAnimationController):
+        (WebKitTests::FakeLayerAnimationController::synchronizeAnimations):
+        (WebKitTests):
+        (WebKitTests::TEST):
+
+2012-02-21  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Remove the remaining uses of CSSStyleDeclaration in Editor
+        https://bugs.webkit.org/show_bug.cgi?id=78939
+
+        Reviewed by Enrica Casucci.
+
+        * src/EditorClientImpl.cpp:
+        (WebKit::EditorClientImpl::shouldApplyStyle):
+        * src/EditorClientImpl.h:
+        (EditorClientImpl):
+
+2012-02-22  Daniel Cheng  <dcheng@chromium.org>
+
+        [chromium] Cleanup unused WebDragData methods after r107846
+        https://bugs.webkit.org/show_bug.cgi?id=78837
+
+        Reviewed by Tony Chang.
+
+        The deleted methods have been replaced by items() and setItems().
+
+        * public/platform/WebDragData.h:
+        (WebDragData):
+        * src/WebDragData.cpp:
+        (WebKit::WebDragData::addItem): Add ensureMutable() call to verify preconditions for
+                                        mutating the item store.
+
+2012-02-22  Tim Dresser  <tdresser@chromium.org>
+
+        CCLayerTreeHostImpl calls didDraw more frequently than willDraw
+        https://bugs.webkit.org/show_bug.cgi?id=79139
+
+        Reviewed by James Robinson.
+
+        * tests/CCLayerTreeHostImplTest.cpp:
+        (WebKit::DidDrawCheckLayer::willDraw):
+        (DidDrawCheckLayer):
+        (WebKit::DidDrawCheckLayer::willDrawCalled):
+        (WebKit::DidDrawCheckLayer::DidDrawCheckLayer):
+        (WebKit::TEST_F):
+        (WebKit):
+
+2012-02-22  Dana Jansens  <danakj@chromium.org>
+
+        [Chromium] New CCOcclusionTracker class with tests
+        https://bugs.webkit.org/show_bug.cgi?id=78549
+
+        Reviewed by James Robinson.
+
+        * WebKit.gypi:
+        * tests/CCLayerTreeHostCommonTest.cpp:
+        (WebCore):
+        * tests/CCOcclusionTrackerTest.cpp: Added.
+        (WebCore):
+        (WebCore::setLayerPropertiesForTesting):
+        (LayerChromiumWithForcedDrawsContent):
+        (WebCore::LayerChromiumWithForcedDrawsContent::LayerChromiumWithForcedDrawsContent):
+        (WebCore::LayerChromiumWithForcedDrawsContent::drawsContent):
+        (TestCCOcclusionTracker):
+        (WebCore::TestCCOcclusionTracker::occlusionInScreenSpace):
+        (WebCore::TestCCOcclusionTracker::occlusionInTargetSurface):
+        (WebCore::TestCCOcclusionTracker::setOcclusionInScreenSpace):
+        (WebCore::TestCCOcclusionTracker::setOcclusionInTargetSurface):
+        (WebCore::TEST):
+
+2012-02-22  Hao Zheng  <zhenghao@chromium.org>
+
+        [chromium] Build WebKit with MEDIA_STREAM disabled.
+        https://bugs.webkit.org/show_bug.cgi?id=79214
+
+        Reviewed by Kent Tamura.
+
+        * src/UserMediaClientImpl.h:
+
+2012-02-20  Roland Steiner  <rolandsteiner@chromium.org>
+
+        <style scoped>: Add runtime-flag
+        https://bugs.webkit.org/show_bug.cgi?id=79074
+
+        Added a runtime-flag.
+        Enable default STYLE_SCOPED compile-time flag for Chromium.
+
+        Reviewed by Dimitri Glazkov.
+
+        * features.gypi: enable STYLE_SCOPED
+        * public/WebRuntimeFeatures.h:
+        (WebRuntimeFeatures):
+        * src/WebRuntimeFeatures.cpp:
+        (WebKit::WebRuntimeFeatures::enableStyleScoped):
+        (WebKit):
+        (WebKit::WebRuntimeFeatures::isStyleScopedEnabled):
+
+2012-02-22  Yuta Kitamura  <yutak@chromium.org>
+
+        Unreviewed, rolling out r108453.
+        http://trac.webkit.org/changeset/108453
+        https://bugs.webkit.org/show_bug.cgi?id=78549
+
+        Broke Chromium's webkit_unit_tests.
+
+        * WebKit.gypi:
+        * tests/CCLayerTreeHostCommonTest.cpp:
+        (WebCore::TEST):
+        (WebCore):
+        * tests/CCOcclusionTrackerTest.cpp: Removed.
+
+2012-02-22  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Remove the remaining uses of CSSStyleDeclaration in Editor
+        https://bugs.webkit.org/show_bug.cgi?id=78939
+
+        Reviewed by Enrica Casucci.
+
+        * src/EditorClientImpl.cpp:
+        (WebKit::EditorClientImpl::shouldApplyStyle):
+        * src/EditorClientImpl.h:
+        (EditorClientImpl):
+
+2012-02-22  Dana Jansens  <danakj@chromium.org>
+
+        [chromium] Cull quads outside of the scissoring damage rect
+        https://bugs.webkit.org/show_bug.cgi?id=79181
+
+        Reviewed by James Robinson.
+
+        * tests/CCQuadCullerTest.cpp:
+        (WebCore::TEST):
+        (WebCore):
+
+2012-02-21  Dana Jansens  <danakj@chromium.org>
+
+        [Chromium] New CCOcclusionTracker class with tests
+        https://bugs.webkit.org/show_bug.cgi?id=78549
+
+        Reviewed by James Robinson.
+
+        * WebKit.gypi:
+        * tests/CCLayerTreeHostCommonTest.cpp:
+        (WebCore):
+        * tests/CCOcclusionTrackerTest.cpp: Added.
+        (WebCore):
+        (WebCore::setLayerPropertiesForTesting):
+        (LayerChromiumWithForcedDrawsContent):
+        (WebCore::LayerChromiumWithForcedDrawsContent::LayerChromiumWithForcedDrawsContent):
+        (WebCore::LayerChromiumWithForcedDrawsContent::drawsContent):
+        (TestCCOcclusionTracker):
+        (WebCore::TestCCOcclusionTracker::occlusionInScreenSpace):
+        (WebCore::TestCCOcclusionTracker::occlusionInTargetSurface):
+        (WebCore::TestCCOcclusionTracker::setOcclusionInScreenSpace):
+        (WebCore::TestCCOcclusionTracker::setOcclusionInTargetSurface):
+        (WebCore::TEST):
+
+2012-02-21  MORITA Hajime  <morrita@google.com>
+
+        INPUT_SPEECH should be implemented as a PageSupplement.
+        https://bugs.webkit.org/show_bug.cgi?id=79051
+
+        Reviewed by Adam Barth.
+
+        * src/WebViewImpl.cpp:
+        (WebKit::WebViewImpl::WebViewImpl):
+
+2012-02-20  MORITA Hajime  <morrita@google.com>
+
+        MEDIA_STREAM should be implemented as a PageSupplement.
+        https://bugs.webkit.org/show_bug.cgi?id=79050
+
+        Reviewed by Adam Barth.
+
+        * src/WebViewImpl.cpp:
+        (WebKit::WebViewImpl::WebViewImpl):
+
+2012-02-21  Dana Jansens  <danakj@chromium.org>
+
+        [chromium] Painting a layer clears opaque rect in untouched tiles
+        https://bugs.webkit.org/show_bug.cgi?id=79157
+
+        Reviewed by James Robinson.
+
+        * tests/TiledLayerChromiumTest.cpp:
+        (WTF::TEST):
+
+2012-02-21  James Robinson  <jamesr@chromium.org>
+
+        Enable ScrollingCoordinator in chromium whenever compositing is enabled
+        https://bugs.webkit.org/show_bug.cgi?id=79165
+
+        Reviewed by Adam Barth.
+
+        * src/NonCompositedContentHost.cpp:
+        (WebKit::NonCompositedContentHost::setViewport):
+            Whenever the ScrollingCoordinator is enabled the scroll layer's position is expected to be updated
+            externally to RenderLayerCompositor, so set it here.
+        * src/WebSettingsImpl.cpp:
+        (WebKit::WebSettingsImpl::setAcceleratedCompositingEnabled):
+
+2012-02-21  Daniel Cheng  <dcheng@chromium.org>
+
+        [chromium] Fix image drag out on Chromium
+        https://bugs.webkit.org/show_bug.cgi?id=79158
+
+        Reviewed by Tony Chang.
+
+        We constructed the WebDragData::Item for dragging out an image but never added it to the
+        item list. This is normally covered by the fast/events/drag-image-filename.html layout test,
+        but the bug wasn't caught in the original patch since the implementations in Chrome and DRT
+        had diverged.
+
+        * src/WebDragData.cpp:
+        (WebKit::WebDragData::items):
+
+2012-02-21  David Grogan  <dgrogan@chromium.org>
+
+        IndexedDB: webFrame isn't threadsafe, don't use it from a worker thread
+        https://bugs.webkit.org/show_bug.cgi?id=78659
+
+        After crrev.com/121669, indexed db doesn't use the web frame for
+        anything if called from a web worker.
+
+        No new tests - this check was defensive and possibly not ever
+        triggered.
+
+        Reviewed by Tony Chang.
+
+        * src/IDBFactoryBackendProxy.cpp:
+        (WebKit::IDBFactoryBackendProxy::openFromWorker):
+
+2012-02-21  Yury Semikhatsky  <yurys@chromium.org>
+
+        [V8] Web Inspector: set breakpoint/pause doesn't work when worker is in a tight loop
+        https://bugs.webkit.org/show_bug.cgi?id=79097
+
+        Worker script execution will be interrupted for dispatching inspector commands.
+
+        Reviewed by Pavel Feldman.
+
+        * src/WebSharedWorkerImpl.cpp:
+        (WebKit::WebSharedWorkerImpl::dispatchDevToolsMessage):
+
+2012-02-20  Peter Beverloo  <peter@chromium.org>
+
+        Unreviewed.  Rolled DEPS.
+
+        * DEPS:
+
+2012-02-20  Kenichi Ishibashi  <bashi@chromium.org>
+
+        [WebSocket] Add deflater/inflater classes
+        https://bugs.webkit.org/show_bug.cgi?id=78449
+
+        Add tests which ensure WebSocketDeflater/WebSocketInflater can
+        compress/decompress data correctly.
+
+        Reviewed by Kent Tamura.
+
+        * WebKit.gypi: Added zlib dependency.
+        * WebKitUnitTests.gyp: Ditto.
+        * tests/WebSocketDeflaterTest.cpp: Added.
+        (WebCore):
+        (WebCore::TEST):
+
+2012-02-17  Yury Semikhatsky  <yurys@chromium.org>
+
+        [Chromium] Web Inspector: terminated workers are not removed from dedicated worker list
+        https://bugs.webkit.org/show_bug.cgi?id=78899
+
+        Pass original WorkerContextProxy object to the inspector instrumentation instead
+        of Chromium-specific one for consistency with WorkerMessagingProxy implementation
+        in WebCore.
+
+        Reviewed by Pavel Feldman.
+
+        * src/WebWorkerClientImpl.cpp:
+        (WebKit::WebWorkerClientImpl::startWorkerContext):
+
+2012-02-18  raman Tenneti  <rtenneti@chromium.org>
+
+        Track the NPN protocol version negotiated with the server
+        https://bugs.webkit.org/show_bug.cgi?id=77349
+
+        Reviewed by Darin Fisher.
+
+        [chromium] Added ExtraData to WebURLResponse.
+
+        * WebKit.gypi:
+        * public/platform/WebURLResponse.h:
+        (ExtraData):
+        (WebKit::WebURLResponse::ExtraData::~ExtraData):
+        (WebURLResponse):
+        * src/WebURLResponse.cpp:
+        (WebKit::WebURLResponse::extraData):
+        (WebKit):
+        (WebKit::WebURLResponse::setExtraData):
+        * tests/WebURLResponseTest.cpp: Added.
+        (WebKit):
+        (TestExtraData):
+        (WebKit::TestExtraData::TestExtraData):
+        (WebKit::TestExtraData::~TestExtraData):
+        (WebKit::TEST):
+
+2012-02-17  Joshua Bell  <jsbell@chromium.org>
+
+        IndexedDB: Support overloaded methods that take IDBKey or IDBKeyRange
+        https://bugs.webkit.org/show_bug.cgi?id=78399
+
+        Implements the WebKit API for IDBObjectStore.delete(IDBKeyRange),
+        to exercise the overload capability.
+
+        Reviewed by Tony Chang.
+
+        * src/IDBObjectStoreBackendProxy.cpp:
+        (WebKit::IDBObjectStoreBackendProxy::deleteFunction):
+        (WebKit):
+        * src/IDBObjectStoreBackendProxy.h:
+        (IDBObjectStoreBackendProxy):
+        * src/WebIDBObjectStoreImpl.cpp:
+        (WebKit::WebIDBObjectStoreImpl::deleteFunction):
+        (WebKit):
+        * src/WebIDBObjectStoreImpl.h:
+        (WebIDBObjectStoreImpl):
+
+2012-02-17  Michal Mocny  <mmocny@google.com>
+
+        [chromium] GL_CHROMIUM_gpu_memory_manager extension
+        https://bugs.webkit.org/show_bug.cgi?id=77155
+
+        Reviewed by James Robinson.
+
+        * public/platform/WebGraphicsContext3D.h:
+        (WebGraphicsMemoryAllocationChangedCallbackCHROMIUM):
+        (WebKit::WebGraphicsContext3D::WebGraphicsMemoryAllocationChangedCallbackCHROMIUM::~WebGraphicsMemoryAllocationChangedCallbackCHROMIUM):
+        (WebGraphicsContext3D):
+        (WebKit::WebGraphicsContext3D::setMemoryAllocationChangedCallbackCHROMIUM):
+        * src/Extensions3DChromium.cpp:
+        (WebCore::Extensions3DChromium::setGpuMemoryAllocationChangedCallbackCHROMIUM):
+        (WebCore):
+        * src/GraphicsContext3DChromium.cpp:
+        (WebCore::GraphicsContext3D::~GraphicsContext3D):
+        (GraphicsContext3DMemoryAllocationChangedCallbackAdapter):
+        (WebCore::GraphicsContext3DMemoryAllocationChangedCallbackAdapter::GraphicsContext3DMemoryAllocationChangedCallbackAdapter):
+        (WebCore::GraphicsContext3DMemoryAllocationChangedCallbackAdapter::~GraphicsContext3DMemoryAllocationChangedCallbackAdapter):
+        (WebCore::GraphicsContext3DMemoryAllocationChangedCallbackAdapter::onMemoryAllocationChanged):
+        (WebCore):
+        (WebCore::GraphicsContext3DPrivate::setGpuMemoryAllocationChangedCallbackCHROMIUM):
+        * src/GraphicsContext3DPrivate.h:
+        (WebCore):
+        * tests/FakeWebGraphicsContext3D.h:
+        (WebKit::FakeWebGraphicsContext3D::setMemoryAllocationChangedCallbackCHROMIUM):
+        (FakeWebGraphicsContext3D):
+
+2012-02-17  Mihnea Ovidenie  <mihnea@adobe.com>
+
+        CSS regions enabled by default
+        https://bugs.webkit.org/show_bug.cgi?id=78525
+
+        Reviewed by David Hyatt.
+
+        Add a runtime preference to enable/disable regions functionality at runtime(WebKitCSSRegionsEnabled).
+        CSSRegions are still enabled by default.
+        In DRT, use layoutTestController.overridePreference("WebKitCSSRegionsEnabled", "0") to disable the css regions functionality.
+
+        * public/WebSettings.h:
+        * src/WebSettingsImpl.cpp:
+        (WebKit::WebSettingsImpl::setExperimentalCSSRegionsEnabled):
+        (WebKit):
+        * src/WebSettingsImpl.h:
+        (WebSettingsImpl):
+
+2012-02-17  Scott Graham  <scottmg@chromium.org>
+
+        [Chromium] pack Gamepad shared memory structure
+        https://bugs.webkit.org/show_bug.cgi?id=78022
+
+        Reviewed by Darin Fisher.
+
+        Add #pragma pack around definition of shared memory structures to
+        avoid differences across compilers and platforms. Add COMPILE_ASSERT
+        to verify expected size.
+
+        * public/platform/WebGamepad.h:
+        (WebKit):
+        * public/platform/WebGamepads.h:
+        (WebKit):
+
+2012-02-17  Tim Dresser  <tdresser@chromium.org>
+
+        [chromium] Refactor video drawing to be more data driven
+        https://bugs.webkit.org/show_bug.cgi?id=76720
+
+        Reviewed by James Robinson.
+
+        CCLayerTreeHostImplTest.didDrawCalledOnAllLayers ensures that
+        CCLayerImpl::didDraw() is called on all layers, including layers
+        on different render surfaces.
+
+        * tests/CCLayerTreeHostImplTest.cpp:
+        (DidDrawCheckLayer):
+        (WebKit::DidDrawCheckLayer::create):
+        (WebKit::DidDrawCheckLayer::didDraw):
+        (WebKit::DidDrawCheckLayer::didDrawCalled):
+        (WebKit::DidDrawCheckLayer::DidDrawCheckLayer):
+        (WebKit):
+        (WebKit::TEST_F):
+
+2012-02-17  Ilya Tikhonovsky  <loislo@chromium.org>
+
+        Unreviewed, rolling out r108071.
+        http://trac.webkit.org/changeset/108071
+        https://bugs.webkit.org/show_bug.cgi?id=77155
+
+        chromium-mac compilation failed
+
+        * public/platform/WebGraphicsContext3D.h:
+        (WebGraphicsContext3D):
+        * src/Extensions3DChromium.cpp:
+        * src/GraphicsContext3DChromium.cpp:
+        (WebCore::GraphicsContext3D::~GraphicsContext3D):
+        * src/GraphicsContext3DPrivate.h:
+        (WebCore):
+        * tests/FakeWebGraphicsContext3D.h:
+
+2012-02-17  Michal Mocny  <mmocny@google.com>
+
+        [chromium] GL_CHROMIUM_gpu_memory_manager extension
+        https://bugs.webkit.org/show_bug.cgi?id=77155
+
+        Reviewed by James Robinson.
+
+        * public/platform/WebGraphicsContext3D.h:
+        (WebGraphicsMemoryAllocationChangedCallbackCHROMIUM):
+        (WebKit::WebGraphicsContext3D::WebGraphicsMemoryAllocationChangedCallbackCHROMIUM::~WebGraphicsMemoryAllocationChangedCallbackCHROMIUM):
+        (WebGraphicsContext3D):
+        (WebKit::WebGraphicsContext3D::setMemoryAllocationChangedCallbackCHROMIUM):
+        * src/Extensions3DChromium.cpp:
+        (WebCore::Extensions3DChromium::setGpuMemoryAllocationChangedCallbackCHROMIUM):
+        (WebCore):
+        * src/GraphicsContext3DChromium.cpp:
+        (WebCore::GraphicsContext3D::~GraphicsContext3D):
+        (GraphicsContext3DMemoryAllocationChangedCallbackAdapter):
+        (WebCore::GraphicsContext3DMemoryAllocationChangedCallbackAdapter::GraphicsContext3DMemoryAllocationChangedCallbackAdapter):
+        (WebCore::GraphicsContext3DMemoryAllocationChangedCallbackAdapter::~GraphicsContext3DMemoryAllocationChangedCallbackAdapter):
+        (WebCore::GraphicsContext3DMemoryAllocationChangedCallbackAdapter::onMemoryAllocationChanged):
+        (WebCore):
+        (WebCore::GraphicsContext3DPrivate::setGpuMemoryAllocationChangedCallbackCHROMIUM):
+        * src/GraphicsContext3DPrivate.h:
+        (WebCore):
+        * tests/FakeWebGraphicsContext3D.h:
+        (WebKit::FakeWebGraphicsContext3D::setMemoryAllocationChangedCallbackCHROMIUM):
+        (FakeWebGraphicsContext3D):
+
+2012-02-17  Ilya Tikhonovsky  <loislo@chromium.org>
+
+        Unreviewed. Chromium DEPS roll
+
+        * DEPS: from 122122 to 122498
+
+2012-02-16  Alexandre Elias  <aelias@google.com>
+
+        [chromium] Bundle page scale factor and limits in CCLayerTreeHost
+        https://bugs.webkit.org/show_bug.cgi?id=78762
+
+        Setting page scale factor and its limits in separate methods
+        may cause clamping bugs if one of them makes it to the
+        impl thread before the other.  Change the API to bundle them together,
+        which matches the existing impl-side interface.
+
+        Reviewed by James Robinson.
+
+        * src/WebViewImpl.cpp:
+        (WebKit::WebViewImpl::computePageScaleFactorLimits):
+        (WebKit::WebViewImpl::setIsAcceleratedCompositingActive):
+        (WebKit::WebViewImpl::updateLayerTreeViewport):
+        * tests/CCLayerTreeHostTest.cpp:
+        (WTF::CCLayerTreeHostTestStartPageScaleAnimation::applyScrollAndScale):
+
+2012-02-16  Varun Jain  <varunjain@google.com>
+
+        [Chromium] Add method to WebViewImpl to extract zoom/scroll params for gesture events on touch devices
+        https://bugs.webkit.org/show_bug.cgi?id=72909
+
+        Reviewed by James Robinson.
+
+        * src/WebViewImpl.cpp:
+        (std):
+        (WebKit):
+        (WebKit::WebViewImpl::computeBlockBounds):
+        (WebKit::WebViewImpl::widenRectWithinPageBounds):
+        (WebKit::WebViewImpl::computeScaleAndScrollForHitRect):
+        * src/WebViewImpl.h:
+        (WebViewImpl):
+        * tests/WebFrameTest.cpp:
+        (WebKit):
+        (WebKit::TEST_F):
+        * tests/data/get_scale_for_auto_zoom_into_div_test.html: Added.
+
+2012-02-16  Sami Kyostila  <skyostil@chromium.org>
+
+        [chromium] LayerChromium::setNeedsDisplay does not apply contents scale correctly
+        https://bugs.webkit.org/show_bug.cgi?id=77464
+
+        Added a new unit test for TiledLayerChromium to verify its invalidation behavior when
+        the contents scale changes. Also enhance and existing unit test for LayerChromium to
+        verify the paint rectangle dimensions instead just checking that it is not empty.
+
+        Reviewed by James Robinson.
+
+        * tests/LayerChromiumTest.cpp:
+        * tests/TiledLayerChromiumTest.cpp:
+        (WTF::FakeTiledLayerChromium::setNeedsDisplayRect):
+        (FakeTiledLayerChromium):
+        (WTF::FakeTiledLayerChromium::lastNeedsDisplayRect):
+        (WTF::TEST):
+        (WTF):
+
+2012-02-16  MORITA Hajime  <morrita@google.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=78065
+        [Chromium] Should eliminate WebTextCheckingResult legacy APIs
+
+        Reviewed by Kent Tamura.
+
+        Removed unused legacy members.
+
+        * public/WebTextCheckingResult.h:
+        (WebKit::WebTextCheckingResult::WebTextCheckingResult):
+        (WebTextCheckingResult):
+        * src/AssertMatchingEnums.cpp:
+
+2012-02-16  Evan Martin  <evan@chromium.org>
+
+        [chromium] pull third_party/gold to fix linux build
+        https://bugs.webkit.org/show_bug.cgi?id=78842
+
+        Reviewed by Tony Chang.
+
+        The Chrome build now depends on third_party/gold also being checked out.
+
+        * DEPS:
+
+2012-02-15  Michael Nordman  <michaeln@google.com>
+
+        Fix bugs in the implementation of WebDatabase::closeDatabaseImmediately.
+        https://bugs.webkit.org/show_bug.cgi?id=78841
+
+        WebDatabase now delegates this function entirely to DatabaseTracker.
+        This is part of resolving http://crbug.com/98939
+
+        Reviewed by David Levin.
+
+        * src/WebDatabase.cpp:
+        (WebKit::WebDatabase::closeDatabaseImmediately):
+
+2012-02-16  Dana Jansens  <danakj@chromium.org>
+
+        [Chromium] Occlusion tracking with CSS filters
+        https://bugs.webkit.org/show_bug.cgi?id=77498
+
+        Reviewed by James Robinson.
+
+        * tests/CCLayerTreeHostTest.cpp:
+        (CCLayerTreeHostTestLayerOcclusionWithFilters):
+        (WTF::CCLayerTreeHostTestLayerOcclusionWithFilters::CCLayerTreeHostTestLayerOcclusionWithFilters):
+        (WTF::CCLayerTreeHostTestLayerOcclusionWithFilters::beginTest):
+        (WTF::CCLayerTreeHostTestLayerOcclusionWithFilters::afterTest):
+        (WTF):
+
+2012-02-16  Joshua Bell  <jsbell@chromium.org>
+
+        IndexedDB: Chromium WebKit API support for IDBObjectStore.delete(IDBKeyRange)
+        https://bugs.webkit.org/show_bug.cgi?id=78619
+
+        Add an overload to WebIDBObjectStore::deleteFunction(). First part of a two-sided patch.
+
+        Reviewed by Darin Fisher.
+
+        * public/WebIDBObjectStore.h:
+        (WebKit::WebIDBObjectStore::deleteFunction):
+
+2012-02-16  Dana Jansens  <danakj@chromium.org>
+
+        [chromium] Clipping/Transforms applied in wrong order in opaque paint tracking
+        https://bugs.webkit.org/show_bug.cgi?id=78775
+
+        Reviewed by Stephen White.
+
+        * tests/PlatformContextSkiaTest.cpp:
+        (WebCore::TEST):
+
+2012-02-16  Daniel Cheng  <dcheng@chromium.org>
+
+        [chromium] Add WEBKIT_EXPORT to new WebDragData methods.
+        https://bugs.webkit.org/show_bug.cgi?id=78843
+
+        Reviewed by Tony Chang.
+
+        * public/platform/WebDragData.h:
+        (WebDragData):
+
+2012-02-16  Viet-Trung Luu  <viettrungluu@chromium.org>
+
+        [chromium] Add method to WebPluginContainer to check if a rectangle is topmost
+        https://bugs.webkit.org/show_bug.cgi?id=78166
+
+        Reviewed by Darin Fisher.
+
+        * public/WebPluginContainer.h:
+        (WebPluginContainer):
+        * src/WebPluginContainerImpl.cpp:
+        * src/WebPluginContainerImpl.h:
+        (WebPluginContainerImpl):
+
+2012-02-16  Yosifumi Inoue  <yosin@chromium.org>
+
+        Build Fix: R107894 breaks Chromium Linux Build.
+        https://bugs.webkit.org/show_bug.cgi?id=78790
+
+        WebDragDataPrivate::types, inherited from ChromiumDataObject, returns PassRef<DOMStringList> since r107894. However, WebDragData expected to get old return value type HashSet<String>.
+
+        Reviewed by Kent Tamura.
+
+        * src/WebDragData.cpp:
+        (WebKit::WebDragData::items): Use RefPtr<DOMStringList> rather than HashSet<String> for value of m_private->types().
+
+2012-02-15  Sami Kyostila  <skyostil@google.com>
+
+        Enable -webkit-overflow-scrolling CSS property
+        https://bugs.webkit.org/show_bug.cgi?id=78664
+
+        Reviewed by Eric Seidel.
+
+        * features.gypi:
+
+2012-02-15  Tommy Widenflycht  <tommyw@google.com>
+
+        MediaStream API: Removing SecurityContext from the embedder API
+        https://bugs.webkit.org/show_bug.cgi?id=73816
+
+        Reviewed by Darin Fisher.
+
+        * bridge/PeerConnectionHandler.cpp:
+        (WebCore::PeerConnectionHandler::create):
+        (WebCore::PeerConnectionHandler::PeerConnectionHandler):
+        * bridge/PeerConnectionHandlerInternal.cpp:
+        (WebCore::PeerConnectionHandlerInternal::PeerConnectionHandlerInternal):
+        * bridge/PeerConnectionHandlerInternal.h:
+        (WebCore):
+        (PeerConnectionHandlerInternal):
+        * public/platform/WebPeerConnectionHandler.h:
+        (WebPeerConnectionHandler):
+        (WebKit::WebPeerConnectionHandler::initialize):
+
+2012-02-15  Peter Beverloo  <peter@chromium.org>
+
+        [Chromium] Roll DEPS to r122122
+        https://bugs.webkit.org/show_bug.cgi?id=78754
+
+        Unreviewed DEPS roll.
+
+        * DEPS:
+
+2012-02-01  Daniel Cheng  <dcheng@chromium.org>
+
+        [chromium] Add setter/getter to expose drag data as a list of items
+        https://bugs.webkit.org/show_bug.cgi?id=77125
+
+        This change supports the unification of the data store backing ChromiumDataObject and
+        DataTransferItemListChromium. ChromiumDataObject will represent dragging and clipboard data
+        as a list of data nodes to make it more straightforward to implement the HTML spec for
+        DataTransferItemList. Thus, we extend the abstraction to the webkit glue layer to
+        simplify the serialization/deserialization between platform-specific data and WebDragData.
+        The other setter/getter methods are deprecated and will be removed once the dependencies in
+        Chromium code are gone.
+
+        Reviewed by Darin Fisher.
+
+        * public/platform/WebDragData.h:
+        (WebKit):
+        (WebDragData):
+        * src/WebDragData.cpp:
+        (WebKit::WebDragData::items):
+        (WebKit):
+        (WebKit::WebDragData::setItems):
+        (WebKit::WebDragData::addItem):
+
+2012-02-15  Sadrul Habib Chowdhury  <sadrul@chromium.org>
+
+        Notify ChromeClient when touch-event handlers are installed/removed.
+        https://bugs.webkit.org/show_bug.cgi?id=77440
+
+        Reviewed by Darin Fisher and Ryosuke Niwa.
+
+        * public/WebViewClient.h:
+        (WebKit::WebViewClient::numberOfTouchEventHandlersChanged):
+        * src/ChromeClientImpl.cpp:
+        (WebKit::ChromeClientImpl::numTouchEventHandlersChanged):
+        (WebKit):
+        * src/ChromeClientImpl.h:
+        (ChromeClientImpl):
+        * src/WebViewImpl.cpp:
+        (WebKit::WebViewImpl::numberOfTouchEventHandlersChanged):
+        (WebKit):
+        * src/WebViewImpl.h:
+        (WebViewImpl):
+
+2012-02-15  Anders Carlsson  <andersca@apple.com>
+
+        Remove ScrollableArea::handleGestureEvent
+        https://bugs.webkit.org/show_bug.cgi?id=78661
+
+        Reviewed by Adam Roben.
+
+        Update for WebCore changes.
+
+        * src/WebPluginContainerImpl.cpp:
+        * src/WebPluginContainerImpl.h:
+        (WebPluginContainerImpl):
+        * src/WebViewImpl.cpp:
+        (WebKit::WebViewImpl::gestureEvent):
+
+2012-02-14  Takashi Toyoshima  <toyoshim@chromium.org>
+
+        Provide SocketStreamHandleInternal::toWebSocketStreamHandle(SocketStreamHandle*).
+        https://bugs.webkit.org/show_bug.cgi?id=78581
+
+        Reviewed by Kent Tamura.
+
+        Now, there is no way to convert SocketStreamHandle to
+        WebSocketStreamHandle. In subsequent changes, I'll use this function
+        in FrameLoaderClientImpl.
+
+        * src/SocketStreamHandle.cpp: Remove SocketStreamHandleInternal class declaration.
+        * src/SocketStreamHandleInternal.h: Move SocketStreamHandleInternal class declaration from SocketStreamHandle.cpp to expose, and add conversion function to WebSocketStreamHandle from SocketStreamHandle.
+        (WebKit):
+        (WebCore):
+        (SocketStreamHandleInternal):
+        (WebCore::SocketStreamHandleInternal::create):
+        (WebCore::SocketStreamHandleInternal::toWebSocketStreamHandle):
+        * WebKit.gyp: Add SocketStreamHandleInternal.h entry.
+
+2012-02-14  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r107766.
+        http://trac.webkit.org/changeset/107766
+        https://bugs.webkit.org/show_bug.cgi?id=78665
+
+        Breaks Chromium Win build (Requested by bashi1 on #webkit).
+
+        * WebKit.gypi:
+        * tests/WebSocketDeflaterTest.cpp: Removed.
+
+2012-02-14  Kenichi Ishibashi  <bashi@chromium.org>
+
+        [WebSocket] Add extension attribute support
+        https://bugs.webkit.org/show_bug.cgi?id=78557
+
+        Add WebSocketExtensionDispatcher::acceptedExtensions() checks.
+
+        Reviewed by Kent Tamura.
+
+        * tests/WebSocketExtensionDispatcherTest.cpp:
+        (WebCore::TEST_F):
+
+2012-02-14  Kenichi Ishibashi  <bashi@chromium.org>
+
+        [WebSocket] Add deflater/inflater classes.
+        https://bugs.webkit.org/show_bug.cgi?id=78449
+
+        Add tests which ensure WebSocketDeflater/WebSocketInflater can
+        compress/decompress data correctly.
+
+        Reviewed by Kent Tamura.
+
+        * WebKit.gypi:
+        * tests/WebSocketDeflaterTest.cpp: Added.
+        (WebCore):
+        (WebCore::TEST):
+
+2012-02-14  Dana Jansens  <danakj@chromium.org>
+
+        [chromium] Compare filters on impl thread when setting them, and test setting in unit tests
+        https://bugs.webkit.org/show_bug.cgi?id=78643
+
+        Reviewed by James Robinson.
+
+        * tests/CCLayerImplTest.cpp:
+        (WebCore::TEST):
+
+2012-02-14  Ramya Chandrasekaran  <cramya@google.com>
+
+        Last character display for passwords in Android.
+        https://bugs.webkit.org/show_bug.cgi?id=78532
+
+        Reviewed by Adam Barth.
+
+        * public/WebSettings.h:
+        * src/WebSettingsImpl.cpp:
+        (WebKit::WebSettingsImpl::setPasswordEchoEnabled):
+        (WebKit):
+        (WebKit::WebSettingsImpl::setPasswordEchoDurationInSeconds):
+        * src/WebSettingsImpl.h:
+        (WebSettingsImpl):
+
+2012-02-14  David Reveman  <reveman@chromium.org>
+
+        [Chromium] Expose perTilePainting setting through WebLayerTreeView::Settings interface.
+        https://bugs.webkit.org/show_bug.cgi?id=76937
+
+        Reviewed by James Robinson.
+
+        Add perTilePainting to WebLayerTreeView::Settings.
+
+        * public/platform/WebLayerTreeView.h:
+        (WebKit::WebLayerTreeView::Settings::Settings):
+        (Settings):
+        * src/WebLayerTreeView.cpp:
+        (WebKit::WebLayerTreeView::Settings::operator CCSettings):
+
+2012-02-14  Vsevolod Vlasov  <vsevik@chromium.org>
+
+        Web Inspector: Make ScriptsNavigator default file selector.
+        https://bugs.webkit.org/show_bug.cgi?id=78349
+
+        Reviewed by Pavel Feldman.
+
+        * src/js/Tests.js:
+        (.TestSuite.prototype.testNoScriptDuplicatesOnPanelSwitch.checkNoDuplicates):
+        (.TestSuite.prototype.uiSourceCodesToString_):
+        (.TestSuite.prototype.nonAnonymousUISourceCodes_):
+        (.TestSuite.prototype._scriptsAreParsed):
+        (.TestSuite.prototype._waitUntilScriptsAreParsed.waitForAllScripts):
+        (.TestSuite.prototype._waitUntilScriptsAreParsed):
+
+2012-02-14  Hayato Ito  <hayato@chromium.org>
+
+        Make ShadowRoot.nodeType return DOCUMENT_FRAGMENT_NODE.
+        https://bugs.webkit.org/show_bug.cgi?id=77514
+
+        Reviewed by Dimitri Glazkov.
+
+        NodeType.SHADOW_ROOT_NODE type is finally gone.
+
+        * src/WebPageSerializerImpl.cpp:
+        (WebKit::WebPageSerializerImpl::buildContentForNode):
+
+2012-02-14  David Reveman  <reveman@chromium.org>
+
+        [Chromium] Inconsistent initialization of CCSettings in WebLayerTreeView.
+        https://bugs.webkit.org/show_bug.cgi?id=76927
+
+        Reviewed by James Robinson.
+
+        Remove unnecessary initialization and include maxPartialTextureUpdates
+        in FIXME comment.
+
+        * src/WebLayerTreeView.cpp:
+        (WebKit::WebLayerTreeView::Settings::operator CCSettings):
+
+2012-02-14  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r107661.
+        http://trac.webkit.org/changeset/107661
+        https://bugs.webkit.org/show_bug.cgi?id=78591
+
+        crash on lion/qt bots (Requested by hayato on #webkit).
+
+        * src/WebPageSerializerImpl.cpp:
+        (WebKit::WebPageSerializerImpl::buildContentForNode):
+
+2012-02-14  Yuzhu Shen  <yzshen@chromium.com>
+
+        [chromium] Pepper plugins don't receive mouse movement information in
+        non-mouse-lock mode.
+        https://bugs.webkit.org/show_bug.cgi?id=78014
+
+        This change makes WebMouseEventBuilder pass along mouse movement
+        information properly.
+
+        There isn't test for this change because:
+        - the movement information added is only used by pepper, and there
+          isn't any test for pepper at the WebKit side. (WebKit doesn't know
+          about pepper.)
+        - this change is trivial. It just copies two newly-added data fields
+          from MouseEvent to WebMouseEventBuilder during conversion.
+
+        Reviewed by Tony Chang.
+
+        * src/WebInputEventConversion.cpp:
+        (WebKit::WebMouseEventBuilder::WebMouseEventBuilder):
+
+2012-02-11  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Convert svg/animations to use SMIL methods for driving the timeline
+        https://bugs.webkit.org/show_bug.cgi?id=78422
+
+        Reviewed by Dirk Schulze.
+
+        Remove SVG animation sampling functionality provided for DRT, which no longer uses it.
+        Instead we switched the svg/animations tests to use SVGSVGElement.setCurrentTime.
+
+        * public/WebFrame.h:
+        (WebFrame):
+        * src/WebFrameImpl.cpp:
+        * src/WebFrameImpl.h:
+        (WebFrameImpl):
+
+2012-02-13  Mihai Parparita  <mihaip@chromium.org>
+
+        [Chromium] Remove BoundObject
+        https://bugs.webkit.org/show_bug.cgi?id=78531
+
+        Reviewed by Pavel Feldman.
+
+        Remove the BoundObject class, references to it were removed in r56999.
+
+        * WebKit.gyp:
+        * src/BoundObject.cpp: Removed.
+        * src/BoundObject.h: Removed.
+        * src/WebDevToolsFrontendImpl.cpp:
+
+2012-02-13  W. James MacLean  <wjmaclean@chromium.org>
+
+        [chromium] Remove obsolete zoom animation pathway.
+        https://bugs.webkit.org/show_bug.cgi?id=78359
+
+        Reviewed by James Robinson.
+
+        This patch removes dead code from the previous incarnation of zoom animation for chromium.
+
+        * src/WebViewImpl.cpp:
+
+2012-02-13  Hayato Ito  <hayato@chromium.org>
+
+        Make ShadowRoot.nodeType return DOCUMENT_FRAGMENT_NODE.
+        https://bugs.webkit.org/show_bug.cgi?id=77514
+
+        Reviewed by Dimitri Glazkov.
+
+        NodeType.SHADOW_ROOT_NODE type is finally gone.
+
+        * src/WebPageSerializerImpl.cpp:
+        (WebKit::WebPageSerializerImpl::buildContentForNode):
+
+2012-02-13  Nico Weber  <thakis@chromium.org>
+
+        [chromium] Let WebKit::initialize call InitWebCoreSystemInterface on mac.
+        https://bugs.webkit.org/show_bug.cgi?id=78246
+
+        This allows removing a bunch of code in chromium land (https://chromiumcodereview.appspot.com/9374020/),
+        and helps with the component build on mac (InitWebCoreSystemInterface is not an
+        exported function, and it shouldn't be).
+
+        Source/WebKit/mac/WebCoreSupport/WebSystemInterface.mm early-returns when it's
+        called twice, so it's safe to land this change, and remove the calls in client
+        code in a later CL.
+
+        Reviewed by Darin Fisher.
+
+        * src/WebKit.cpp:
+        (WebKit::initializeWithoutV8):
+
+2012-02-13  Yosifumi Inoue  <yosin@chromium.org>
+
+        [Forms] Use enum instead of bool for HTMLInputElement::setValue
+        https://bugs.webkit.org/show_bug.cgi?id=75217
+
+        Reviewed by Kent Tamura.
+
+        * src/WebInputElement.cpp:
+        (WebKit::WebInputElement::setValue): Use enum for HTMLInputElement::setValue
+
+2012-02-12  Hajime Morrita  <morrita@chromium.org>
+
+        Page should have less intrusive way to associate API implementation objects.
+        https://bugs.webkit.org/show_bug.cgi?id=78085
+
+        Reviewed by Adam Barth.
+
+        * src/WebViewImpl.cpp:
+        (WebKit::WebViewImpl::WebViewImpl):
+
+2012-02-10  David Grogan  <dgrogan@chromium.org>
+
+        Disable IndexedDB permissions check from shared workers
+        https://bugs.webkit.org/show_bug.cgi?id=78316
+
+        We want to temporarily bypass this check because it causes a crash
+        when called from a shared worker.  We'll have to fix it before
+        including idb on shared workers in a release but don't want to stop
+        developers from testing out idb on shared workers.
+
+        No new tests because it affects shared workers only, which aren't
+        testable by DRT.
+
+        Reviewed by Tony Chang.
+
+        * src/IDBFactoryBackendProxy.cpp:
+        (WebKit::IDBFactoryBackendProxy::allowIDBFromWorkerThread):
+
+2012-02-10  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed.  Rolled DEPS.
+
+        * DEPS:
+
+2012-02-09  Kenichi Ishibashi  <bashi@chromium.org>
+
+        Add WebSocket extension support
+        https://bugs.webkit.org/show_bug.cgi?id=78079
+
+        Add some tests which check WebSocketExtensions::processHeaderValue()
+        parses the given response correctly.
+
+        Reviewed by Kent Tamura.
+
+        * WebKit.gypi:
+        * tests/WebSocketExtensionDispatcherTest.cpp: Added.
+        (WebCore):
+        (MockWebSocketExtensionProcessor):
+        (WebCore::MockWebSocketExtensionProcessor::MockWebSocketExtensionProcessor):
+        (WebSocketExtensionDispatcherTest):
+        (WebCore::WebSocketExtensionDispatcherTest::WebSocketExtensionDispatcherTest):
+        (WebCore::WebSocketExtensionDispatcherTest::SetUp):
+        (WebCore::WebSocketExtensionDispatcherTest::TearDown):
+        (WebCore::WebSocketExtensionDispatcherTest::addMockProcessor):
+        (WebCore::WebSocketExtensionDispatcherTest::appendResult):
+        (WebCore::MockWebSocketExtensionProcessor::processResponse):
+        (WebCore::TEST_F):
+
+2012-02-09  W. James MacLean  <wjmaclean@chromium.org>
+
+        [chromium] Add support for starting page/scale animations on CC impl thread from WebViewImpl
+        https://bugs.webkit.org/show_bug.cgi?id=77872
+
+        Reviewed by James Robinson.
+
+        Provides a pathway to invoke CCLayerTreeHostImpl::startPageScaleAnimation() from
+        WebViewImpl. This is intended to support scale and scroll animations, such as WebInputEvent::GestureDoubleTap.
+
+        * src/WebViewImpl.cpp:
+        (WebKit):
+        (WebKit::WebViewImpl::startPageScaleAnimation):
+        * src/WebViewImpl.h:
+        (WebViewImpl):
+        * tests/CCLayerTreeHostTest.cpp:
+        (WTF):
+        (CCLayerTreeHostTestStartPageScaleAnimation):
+        (WTF::CCLayerTreeHostTestStartPageScaleAnimation::CCLayerTreeHostTestStartPageScaleAnimation):
+        (WTF::CCLayerTreeHostTestStartPageScaleAnimation::beginTest):
+        (WTF::CCLayerTreeHostTestStartPageScaleAnimation::requestStartPageScaleAnimation):
+        (WTF::CCLayerTreeHostTestStartPageScaleAnimation::drawLayersOnCCThread):
+        (WTF::CCLayerTreeHostTestStartPageScaleAnimation::applyScrollAndScale):
+        (WTF::CCLayerTreeHostTestStartPageScaleAnimation::commitCompleteOnCCThread):
+        (WTF::CCLayerTreeHostTestStartPageScaleAnimation::afterTest):
+        (WTF::TEST_F):
+
+2012-02-09  John Bates  <jbates@google.com>
+
+        [Chromium] Add chromium-style tracing support
+        https://bugs.webkit.org/show_bug.cgi?id=76885
+
+        Reviewed by Darin Fisher.
+
+        This code enables WebKit trace events to pass through more data to the
+        chromium platform tracing API and generally to use the full tracing
+        API provided by chromium.
+
+        * public/platform/WebKitPlatformSupport.h:
+        (WebKit::WebKitPlatformSupport::getTraceCategoryEnabledFlag):
+        (WebKit::WebKitPlatformSupport::addTraceEvent):
+        * src/PlatformSupport.cpp:
+        (WebCore::PlatformSupport::getTraceCategoryEnabledFlag):
+        (WebCore::PlatformSupport::addTraceEvent):
+
+2012-02-09  Jonathan Backer  <backer@chromium.org>
+
+        [chromium] Plumb setNeedsRedraw.
+        https://bugs.webkit.org/show_bug.cgi?id=78248
+
+        Reviewed by James Robinson.
+
+        * public/platform/WebLayerTreeView.h:
+        (WebLayerTreeView):
+        * src/WebLayerTreeView.cpp:
+        (WebKit::WebLayerTreeView::setNeedsRedraw):
+        (WebKit):
+
+2012-02-09  Jonathan Backer  <backer@chromium.org>
+
+        [chromium] Add setNeedsRedraw to WebWidget
+        https://bugs.webkit.org/show_bug.cgi?id=77555
+
+        Reviewed by James Robinson.
+
+        * public/WebWidget.h:
+        (WebWidget):
+        (WebKit::WebWidget::setNeedsRedraw):
+        * src/WebViewImpl.cpp:
+        (WebKit::WebViewImpl::setNeedsRedraw):
+        (WebKit):
+        * src/WebViewImpl.h:
+        (WebViewImpl):
+
 2012-02-08  Raymond Liu  <raymond.liu@intel.com>
 
         Fix a typo for r107125
diff --git a/Source/WebKit/chromium/DEPS b/Source/WebKit/chromium/DEPS
index 2e0adf6f0..ba422445c 100644
--- a/Source/WebKit/chromium/DEPS
+++ b/Source/WebKit/chromium/DEPS
@@ -32,7 +32,7 @@
 
 vars = {
   'chromium_svn': 'http://src.chromium.org/svn/trunk/src',
-  'chromium_rev': '121041'
+  'chromium_rev': '123353'
 }
 
 deps = {
@@ -163,6 +163,8 @@ deps_os = {
     # Linux, actually.
     'tools/xdisplaycheck':
       Var('chromium_svn')+'/tools/xdisplaycheck@'+Var('chromium_rev'),
+    'third_party/gold':
+      From('chromium_deps', 'src/third_party/gold'),
     'third_party/openssl':
       From('chromium_deps', 'src/third_party/openssl'),
   },
diff --git a/Source/WebKit/chromium/WebKit.gyp b/Source/WebKit/chromium/WebKit.gyp
index 12ac1ab22..f8e58b383 100644
--- a/Source/WebKit/chromium/WebKit.gyp
+++ b/Source/WebKit/chromium/WebKit.gyp
@@ -232,6 +232,7 @@
                 'public/WebReferrerPolicy.h',
                 'public/WebRegularExpression.h',
                 'public/WebRuntimeFeatures.h',
+                'public/WebScopedUserGesture.h',
                 'public/WebScreenInfo.h',
                 'public/WebScriptController.h',
                 'public/WebScriptSource.h',
@@ -256,6 +257,7 @@
                 'public/WebStorageNamespace.h',
                 'public/WebStorageQuotaCallbacks.h',
                 'public/WebStorageQuotaType.h',
+                'public/WebStreamTextureClient.h',
                 'public/WebTextAffinity.h',
                 'public/WebTextCaseSensitivity.h',
                 'public/WebTextCheckingCompletion.h',
@@ -372,8 +374,6 @@
                 'src/BackForwardListChromium.h',
                 'src/BlobRegistryProxy.cpp',
                 'src/BlobRegistryProxy.h',
-                'src/BoundObject.cpp',
-                'src/BoundObject.h',
                 'src/CCThreadImpl.cpp',
                 'src/CCThreadImpl.h',
                 'src/ChromeClientImpl.cpp',
@@ -465,6 +465,7 @@
                 'src/ScrollbarGroup.h',
                 'src/SharedWorkerRepository.cpp',
                 'src/SocketStreamHandle.cpp',
+                'src/SocketStreamHandleInternal.h',
                 'src/SpeechInputClientImpl.cpp',
                 'src/SpeechInputClientImpl.h',
                 'src/StorageAreaProxy.cpp',
@@ -633,6 +634,7 @@
                 'src/WebRange.cpp',
                 'src/WebRegularExpression.cpp',
                 'src/WebRuntimeFeatures.cpp',
+                'src/WebScopedUserGesture.cpp',
                 'src/WebScriptController.cpp',
                 'src/WebScrollbarImpl.cpp',
                 'src/WebScrollbarImpl.h',
@@ -668,6 +670,7 @@
                 'src/WebURLResponse.cpp',
                 'src/WebURLResponsePrivate.h',
                 'src/WebURLError.cpp',
+                'src/WebScopedUserGesture.cpp',
                 'src/WebUserMediaRequest.cpp',
                 'src/WebViewImpl.cpp',
                 'src/WebViewImpl.h',
diff --git a/Source/WebKit/chromium/WebKit.gypi b/Source/WebKit/chromium/WebKit.gypi
index c8502f573..e91e336db 100644
--- a/Source/WebKit/chromium/WebKit.gypi
+++ b/Source/WebKit/chromium/WebKit.gypi
@@ -61,10 +61,14 @@
             'tests/AssociatedURLLoaderTest.cpp',
             'tests/Canvas2DLayerChromiumTest.cpp',
             'tests/CCActiveAnimationTest.cpp',
+            'tests/CCAnimationTestCommon.cpp',
+            'tests/CCAnimationTestCommon.h',
             'tests/CCDamageTrackerTest.cpp',
             'tests/CCDelayBasedTimeSourceTest.cpp',
             'tests/CCFrameRateControllerTest.cpp',
+            'tests/CCKeyframedAnimationCurveTest.cpp',
             'tests/CCLayerAnimationControllerImplTest.cpp',
+            'tests/CCLayerAnimationControllerTest.cpp',
             'tests/CCLayerImplTest.cpp',
             'tests/CCLayerIteratorTest.cpp',
             'tests/CCLayerQuadTest.cpp',
@@ -75,6 +79,7 @@
             'tests/CCLayerTreeHostImplTest.cpp',
             'tests/CCLayerTreeHostTest.cpp',
             'tests/CCLayerTreeTestCommon.h',
+            'tests/CCOcclusionTrackerTest.cpp',
             'tests/CCQuadCullerTest.cpp',
             'tests/CCRenderSurfaceTest.cpp',
             'tests/CCSchedulerStateMachineTest.cpp',
@@ -118,7 +123,10 @@
             'tests/WebLayerTest.cpp',
             'tests/WebPageNewSerializerTest.cpp',
             'tests/WebPageSerializerTest.cpp',
+            'tests/WebSocketDeflaterTest.cpp',
+            'tests/WebSocketExtensionDispatcherTest.cpp',
             'tests/WebURLRequestTest.cpp',
+            'tests/WebURLResponseTest.cpp',
             'tests/WebViewTest.cpp',
         ],
 
diff --git a/Source/WebKit/chromium/WebKitUnitTests.gyp b/Source/WebKit/chromium/WebKitUnitTests.gyp
index 5a98a8459..d50ad1523 100644
--- a/Source/WebKit/chromium/WebKitUnitTests.gyp
+++ b/Source/WebKit/chromium/WebKitUnitTests.gyp
@@ -61,6 +61,7 @@
                 '<(chromium_src_dir)/base/base.gyp:base',
                 '<(chromium_src_dir)/base/base.gyp:base_i18n',
                 '<(chromium_src_dir)/base/base.gyp:test_support_base',
+                '<(chromium_src_dir)/third_party/zlib/zlib.gyp:zlib',
                 '<(chromium_src_dir)/webkit/support/webkit_support.gyp:webkit_support',
                 '<(chromium_src_dir)/webkit/support/webkit_support.gyp:webkit_user_agent',
             ],
diff --git a/Source/WebKit/chromium/bridge/PeerConnectionHandler.cpp b/Source/WebKit/chromium/bridge/PeerConnectionHandler.cpp
index e9bd9e82d..c59b2d46c 100644
--- a/Source/WebKit/chromium/bridge/PeerConnectionHandler.cpp
+++ b/Source/WebKit/chromium/bridge/PeerConnectionHandler.cpp
@@ -36,17 +36,16 @@
 
 #include "PeerConnectionHandlerClient.h"
 #include "PeerConnectionHandlerInternal.h"
-#include "SecurityOrigin.h"
 
 namespace WebCore {
 
-PassOwnPtr<PeerConnectionHandler> PeerConnectionHandler::create(PeerConnectionHandlerClient* client, const String& serverConfiguration, PassRefPtr<SecurityOrigin> securityOrigin)
+PassOwnPtr<PeerConnectionHandler> PeerConnectionHandler::create(PeerConnectionHandlerClient* client, const String& serverConfiguration, const String& username)
 {
-    return adoptPtr(new PeerConnectionHandler(client, serverConfiguration, securityOrigin));
+    return adoptPtr(new PeerConnectionHandler(client, serverConfiguration, username));
 }
 
-PeerConnectionHandler::PeerConnectionHandler(PeerConnectionHandlerClient* client, const String& serverConfiguration, PassRefPtr<SecurityOrigin> securityOrigin)
-    : m_private(adoptPtr(new PeerConnectionHandlerInternal(client, serverConfiguration, securityOrigin)))
+PeerConnectionHandler::PeerConnectionHandler(PeerConnectionHandlerClient* client, const String& serverConfiguration, const String& username)
+    : m_private(adoptPtr(new PeerConnectionHandlerInternal(client, serverConfiguration, username)))
 {
 }
 
diff --git a/Source/WebKit/chromium/bridge/PeerConnectionHandlerInternal.cpp b/Source/WebKit/chromium/bridge/PeerConnectionHandlerInternal.cpp
index cfc33584a..d8f61f7f0 100644
--- a/Source/WebKit/chromium/bridge/PeerConnectionHandlerInternal.cpp
+++ b/Source/WebKit/chromium/bridge/PeerConnectionHandlerInternal.cpp
@@ -45,15 +45,21 @@
 
 namespace WebCore {
 
-PeerConnectionHandlerInternal::PeerConnectionHandlerInternal(PeerConnectionHandlerClient* client, const String& serverConfiguration, PassRefPtr<SecurityOrigin> securityOrigin)
+PeerConnectionHandlerInternal::PeerConnectionHandlerInternal(PeerConnectionHandlerClient* client, const String& serverConfiguration, const String& username)
     : m_client(client)
 {
     ASSERT(m_client);
     m_webHandler = adoptPtr(WebKit::webKitPlatformSupport()->createPeerConnectionHandler(this));
     // FIXME: When there is some error reporting avaliable in the PeerConnection object report
     // if we didn't get a WebPeerConnectionHandler instance.
-    if (m_webHandler)
-        m_webHandler->initialize(serverConfiguration, securityOrigin);
+
+    if (m_webHandler) {
+        // Dual calls due to API change
+        m_webHandler->initialize(serverConfiguration, username);
+
+        // DEPRECATED
+        m_webHandler->initialize(serverConfiguration, SecurityOrigin::createFromString(username));
+    }
 }
 
 PeerConnectionHandlerInternal::~PeerConnectionHandlerInternal()
diff --git a/Source/WebKit/chromium/bridge/PeerConnectionHandlerInternal.h b/Source/WebKit/chromium/bridge/PeerConnectionHandlerInternal.h
index a3e79e0ac..e17fd96b5 100644
--- a/Source/WebKit/chromium/bridge/PeerConnectionHandlerInternal.h
+++ b/Source/WebKit/chromium/bridge/PeerConnectionHandlerInternal.h
@@ -48,11 +48,10 @@ class WebMediaStreamDescriptor;
 namespace WebCore {
 
 class PeerConnectionHandlerClient;
-class SecurityOrigin;
 
 class PeerConnectionHandlerInternal : public WebKit::WebPeerConnectionHandlerClient {
 public:
-    PeerConnectionHandlerInternal(PeerConnectionHandlerClient*, const String& serverConfiguration, PassRefPtr<SecurityOrigin>);
+    PeerConnectionHandlerInternal(PeerConnectionHandlerClient*, const String& serverConfiguration, const String& username);
     ~PeerConnectionHandlerInternal();
 
     virtual void produceInitialOffer(const MediaStreamDescriptorVector& pendingAddStreams);
diff --git a/Source/WebKit/chromium/features.gypi b/Source/WebKit/chromium/features.gypi
index 4cca26795..4c46d4de4 100644
--- a/Source/WebKit/chromium/features.gypi
+++ b/Source/WebKit/chromium/features.gypi
@@ -73,6 +73,7 @@
       'ENABLE_MUTATION_OBSERVERS=<(enable_mutation_observers)',
       'ENABLE_NOTIFICATIONS=1',
       'ENABLE_ORIENTATION_EVENTS=0',
+      'ENABLE_OVERFLOW_SCROLLING=1',
       'ENABLE_PAGE_VISIBILITY_API=1',
       'ENABLE_POINTER_LOCK=1',
       'ENABLE_PROGRESS_TAG=1',
@@ -84,7 +85,7 @@
       'ENABLE_SHARED_WORKERS=1',
       'ENABLE_SMOOTH_SCROLLING=1',
       'ENABLE_SQL_DATABASE=1',
-      'ENABLE_STYLE_SCOPED=0',
+      'ENABLE_STYLE_SCOPED=1',
       'ENABLE_SVG=<(enable_svg)',
       'ENABLE_SVG_FONTS=<(enable_svg)',
       'ENABLE_TOUCH_EVENTS=<(enable_touch_events)',
diff --git a/Source/WebKit/chromium/public/WebFrame.h b/Source/WebKit/chromium/public/WebFrame.h
index 9574c490e..0d5406d52 100644
--- a/Source/WebKit/chromium/public/WebFrame.h
+++ b/Source/WebKit/chromium/public/WebFrame.h
@@ -624,12 +624,6 @@ public:
     // Returns true if selection.anchorNode has a marker on range from |from| with |length|.
     virtual bool selectionStartHasSpellingMarkerFor(int from, int length) const = 0;
 
-    // Pauses and samples an SVG animation.  Returns false if there's no svg
-    // animation to pause.  This is only for testing.
-    virtual bool pauseSVGAnimation(const WebString& animationId,
-                                   double time,
-                                   const WebString& elementId) = 0;
-
     // Dumps the layer tree, used by the accelerated compositor, in
     // text form. This is used only by layout tests.
     virtual WebString layerTreeAsText(bool showDebugInfo = false) const = 0;
diff --git a/Source/WebKit/chromium/public/WebIDBObjectStore.h b/Source/WebKit/chromium/public/WebIDBObjectStore.h
index 6bd51f419..981f5ec7e 100644
--- a/Source/WebKit/chromium/public/WebIDBObjectStore.h
+++ b/Source/WebKit/chromium/public/WebIDBObjectStore.h
@@ -69,6 +69,7 @@ public:
 
     virtual void put(const WebSerializedScriptValue&, const WebIDBKey&, PutMode, WebIDBCallbacks*, const WebIDBTransaction&, WebExceptionCode&) { WEBKIT_ASSERT_NOT_REACHED(); }
     virtual void deleteFunction(const WebIDBKey&, WebIDBCallbacks*, const WebIDBTransaction&, WebExceptionCode&) { WEBKIT_ASSERT_NOT_REACHED(); }
+    virtual void deleteFunction(const WebIDBKeyRange&, WebIDBCallbacks*, const WebIDBTransaction&, WebExceptionCode&) { WEBKIT_ASSERT_NOT_REACHED(); }
     virtual void clear(WebIDBCallbacks*, const WebIDBTransaction&, WebExceptionCode&) { WEBKIT_ASSERT_NOT_REACHED(); }
     virtual WebIDBIndex* createIndex(const WebString& name, const WebString& keyPath, bool unique, bool multiEntry, const WebIDBTransaction& transaction, WebExceptionCode& ec)
     {
diff --git a/Source/WebKit/chromium/public/WebMediaPlayer.h b/Source/WebKit/chromium/public/WebMediaPlayer.h
index 9aaf1a3d0..239134963 100644
--- a/Source/WebKit/chromium/public/WebMediaPlayer.h
+++ b/Source/WebKit/chromium/public/WebMediaPlayer.h
@@ -40,6 +40,7 @@ namespace WebKit {
 class WebAudioSourceProvider;
 class WebAudioSourceProviderClient;
 class WebMediaPlayerClient;
+class WebStreamTextureClient;
 class WebURL;
 struct WebRect;
 struct WebSize;
@@ -162,6 +163,8 @@ public:
     // method should no longer be referenced after the call is made.
     virtual void putCurrentFrame(WebVideoFrame*) { }
 
+    virtual void setStreamTextureClient(WebStreamTextureClient*) { }
+
     virtual WebAudioSourceProvider* audioSourceProvider() { return 0; }
 
     virtual bool sourceAppend(const unsigned char* data, unsigned length) { return false; }
diff --git a/Source/WebKit/chromium/public/WebPluginContainer.h b/Source/WebKit/chromium/public/WebPluginContainer.h
index 122c4c8df..845cb1a28 100644
--- a/Source/WebKit/chromium/public/WebPluginContainer.h
+++ b/Source/WebKit/chromium/public/WebPluginContainer.h
@@ -100,6 +100,10 @@ public:
     // Notifies that the zoom level has changed.
     virtual void zoomLevelChanged(double zoomLevel) = 0;
 
+    // Determines whether the given rectangle in this plugin is above all other
+    // content. The rectangle is in the plugin's coordinate system.
+    virtual bool isRectTopmost(const WebRect&) = 0;
+
     virtual WebPlugin* plugin() = 0;
     virtual void setPlugin(WebPlugin*) = 0;
 
diff --git a/Source/WebKit/chromium/public/WebRuntimeFeatures.h b/Source/WebKit/chromium/public/WebRuntimeFeatures.h
index 7e29ab0db..34e3947f6 100644
--- a/Source/WebKit/chromium/public/WebRuntimeFeatures.h
+++ b/Source/WebKit/chromium/public/WebRuntimeFeatures.h
@@ -124,6 +124,9 @@ public:
     WEBKIT_EXPORT static void enableShadowDOM(bool);
     WEBKIT_EXPORT static bool isShadowDOMEnabled();
 
+    WEBKIT_EXPORT static void enableStyleScoped(bool);
+    WEBKIT_EXPORT static bool isStyleScopedEnabled();
+
 private:
     WebRuntimeFeatures();
 };
diff --git a/Source/WebKit/chromium/src/BoundObject.h b/Source/WebKit/chromium/public/WebScopedUserGesture.h
index 394ff7c9e..14798f153 100644
--- a/Source/WebKit/chromium/src/BoundObject.h
+++ b/Source/WebKit/chromium/public/WebScopedUserGesture.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2010 Google Inc. All rights reserved.
+ * Copyright (C) 2011 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
@@ -28,34 +28,33 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#ifndef BoundObject_h
-#define BoundObject_h
+#ifndef WebScopedUserGesture_h
+#define WebScopedUserGesture_h
 
-#include <v8.h>
-#include <wtf/Noncopyable.h>
+#include "platform/WebPrivateOwnPtr.h"
+
+namespace WebCore {
+class UserGestureIndicator;
+}
 
 namespace WebKit {
 
-// BoundObject is a helper class that lets you map JavaScript method calls
-// directly to C++ method calls. It should be destroyed once JS object is
-// built.
-class BoundObject {
-    WTF_MAKE_NONCOPYABLE(BoundObject);
+// An instance of this class, while kept alive, will indicate that we are in
+// the context of a known user gesture. To use, create one, perform whatever
+// actions were done under color of a known user gesture, and then delete it.
+// Usually this will be done on the stack.
+class WebScopedUserGesture {
 public:
-    BoundObject(v8::Handle<v8::Context> context, void* v8This, const char* objectName);
-    virtual ~BoundObject();
-
-    void addProtoFunction(const char* name, v8::InvocationCallback callback);
-    void build();
+    WebScopedUserGesture() { initialize(); }
+    ~WebScopedUserGesture() { reset(); }
 
 private:
-    v8::HandleScope m_handleScope;
-    const char* m_objectName;
-    v8::Handle<v8::Context> m_context;
-    v8::Persistent<v8::FunctionTemplate> m_hostTemplate;
-    void* m_v8This;
+    WEBKIT_EXPORT void initialize();
+    WEBKIT_EXPORT void reset();
+
+    WebPrivateOwnPtr<WebCore::UserGestureIndicator> m_indicator;
 };
 
 } // namespace WebKit
 
-#endif
+#endif // WebScopedUserGesture_h
diff --git a/Source/WebKit/chromium/public/WebSettings.h b/Source/WebKit/chromium/public/WebSettings.h
index 25ac07523..7f1bbb0c4 100644
--- a/Source/WebKit/chromium/public/WebSettings.h
+++ b/Source/WebKit/chromium/public/WebSettings.h
@@ -96,6 +96,7 @@ public:
     virtual void setOfflineWebApplicationCacheEnabled(bool) = 0;
     virtual void setWebAudioEnabled(bool) = 0;
     virtual void setExperimentalWebGLEnabled(bool) = 0;
+    virtual void setExperimentalCSSRegionsEnabled(bool) = 0;
     virtual void setOpenGLMultisamplingEnabled(bool) = 0;
     virtual void setPrivilegedWebGLExtensionsEnabled(bool) = 0;
     virtual void setWebGLErrorsToConsoleEnabled(bool) = 0;
@@ -132,6 +133,8 @@ public:
     virtual void setFullScreenEnabled(bool) = 0;
     virtual void setAllowDisplayOfInsecureContent(bool) = 0;
     virtual void setAllowRunningOfInsecureContent(bool) = 0;
+    virtual void setPasswordEchoEnabled(bool) = 0;
+    virtual void setPasswordEchoDurationInSeconds(double) = 0;
     virtual void setShouldPrintBackgrounds(bool) = 0;
     virtual void setEnableScrollAnimator(bool) = 0;
     virtual void setHixie76WebSocketProtocolEnabled(bool) = 0;
@@ -139,6 +142,7 @@ public:
     virtual void setAcceleratedPaintingEnabled(bool) = 0;
     virtual void setPerTilePaintingEnabled(bool) = 0;
     virtual void setPartialSwapEnabled(bool) = 0;
+    virtual void setThreadedAnimationEnabled(bool) = 0;
 
 protected:
     ~WebSettings() { }
diff --git a/Source/WebKit/chromium/public/WebStreamTextureClient.h b/Source/WebKit/chromium/public/WebStreamTextureClient.h
new file mode 100644
index 000000000..81002fb26
--- /dev/null
+++ b/Source/WebKit/chromium/public/WebStreamTextureClient.h
@@ -0,0 +1,47 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebStreamTextureClient_h
+#define WebStreamTextureClient_h
+
+namespace WebKit {
+
+class WebStreamTextureClient {
+public:
+    virtual void didReceiveFrame() = 0;
+    virtual void didUpdateMatrix(const float*) = 0;
+
+protected:
+    virtual ~WebStreamTextureClient() { }
+};
+
+} // namespace WebKit
+
+#endif
diff --git a/Source/WebKit/chromium/public/WebTextCheckingResult.h b/Source/WebKit/chromium/public/WebTextCheckingResult.h
index 8d0a745cc..e46f48cdc 100644
--- a/Source/WebKit/chromium/public/WebTextCheckingResult.h
+++ b/Source/WebKit/chromium/public/WebTextCheckingResult.h
@@ -34,7 +34,6 @@
 #include "WebTextCheckingType.h"
 #include "platform/WebCommon.h"
 #include "platform/WebString.h"
-#include "platform/WebVector.h"
 
 namespace WebCore {
 struct TextCheckingResult;
@@ -44,50 +43,19 @@ namespace WebKit {
 
 // A checked entry of text checking.
 struct WebTextCheckingResult {
-    // FIXME: Should be removed after we confirm Chromium does not use it.
-    enum Error {
-        ErrorSpelling = 1 << 0,
-        ErrorGrammar = 1 << 1
-    };
-
     WebTextCheckingResult()
         : type(WebTextCheckingTypeSpelling)
-        , error(ErrorSpelling)
-        , position(0)
         , location(0)
         , length(0)
     {
     }
 
-    explicit WebTextCheckingResult(Error e, int p = 0, int l = 0)
-        : type(WebTextCheckingTypeSpelling)
-        , error(e)
-        , position(p)
-        , location(p)
-        , length(l)
-    {
-        if (e & ErrorSpelling)
-            type = WebTextCheckingTypeSpelling;
-        else if (e & ErrorGrammar)
-            type = WebTextCheckingTypeGrammar;
-        else
-            WEBKIT_ASSERT_NOT_REACHED();
-    }
-
     WebTextCheckingResult(WebTextCheckingType type, int location, int length, const WebString& replacement = WebString())
         : type(type)
-        , error(ErrorSpelling)
-        , position(location)
         , location(location)
         , length(length)
         , replacement(replacement)
     {
-        if (type & WebTextCheckingTypeSpelling)
-            error = ErrorSpelling;
-        else if (type & WebTextCheckingTypeGrammar)
-            error = ErrorGrammar;
-        else
-            WEBKIT_ASSERT_NOT_REACHED();
     }
 
 #if WEBKIT_IMPLEMENTATION
@@ -95,8 +63,6 @@ struct WebTextCheckingResult {
 #endif
 
     WebTextCheckingType type;
-    Error error; // FIXME: Should be removed after we confirm Chromium does not use it.
-    int position; // FIXME: Should be removed after we confirm Chromium does not use it.
     int location;
     int length;
     WebString replacement;
diff --git a/Source/WebKit/chromium/public/WebVideoFrame.h b/Source/WebKit/chromium/public/WebVideoFrame.h
index 8e3b2cdbd..78790627d 100644
--- a/Source/WebKit/chromium/public/WebVideoFrame.h
+++ b/Source/WebKit/chromium/public/WebVideoFrame.h
@@ -61,6 +61,7 @@ public:
     virtual int stride(unsigned plane) const { return 0; }
     virtual const void* data(unsigned plane) const { return 0; }
     virtual unsigned textureId() const { return 0; }
+    virtual unsigned textureTarget() const { return 0; }
 };
 
 } // namespace WebKit
diff --git a/Source/WebKit/chromium/public/WebViewClient.h b/Source/WebKit/chromium/public/WebViewClient.h
index 1b42a48a8..b656fd5ad 100644
--- a/Source/WebKit/chromium/public/WebViewClient.h
+++ b/Source/WebKit/chromium/public/WebViewClient.h
@@ -263,6 +263,7 @@ public:
     virtual void focusedNodeChanged(const WebNode&) { }
 
     virtual void numberOfWheelEventHandlersChanged(unsigned) { }
+    virtual void numberOfTouchEventHandlersChanged(unsigned) { }
 
     // Indicates two things:
     //   1) This view may have a new layout now.
diff --git a/Source/WebKit/chromium/public/WebWidget.h b/Source/WebKit/chromium/public/WebWidget.h
index ca160a26e..58f3fa169 100644
--- a/Source/WebKit/chromium/public/WebWidget.h
+++ b/Source/WebKit/chromium/public/WebWidget.h
@@ -107,6 +107,11 @@ public:
     // animate or layout in this case.
     virtual void composite(bool finish) = 0;
 
+    // Temporary method for the embedder to notify the WebWidget that the widget
+    // has taken damage, e.g. due to a window expose. This method will be
+    // removed when the WebWidget inversion patch lands --- http://crbug.com/112837
+    virtual void setNeedsRedraw() { }
+
     // Called to inform the WebWidget of a change in theme.
     // Implementors that cache rendered copies of widgets need to re-render
     // on receiving this message
diff --git a/Source/WebKit/chromium/public/platform/WebDragData.h b/Source/WebKit/chromium/public/platform/WebDragData.h
index 171231eca..a6c82aee1 100644
--- a/Source/WebKit/chromium/public/platform/WebDragData.h
+++ b/Source/WebKit/chromium/public/platform/WebDragData.h
@@ -32,7 +32,9 @@
 #define WebDragData_h
 
 #include "WebCommon.h"
+#include "WebData.h"
 #include "WebString.h"
+#include "WebURL.h"
 
 #if WEBKIT_IMPLEMENTATION
 namespace WebCore { class ChromiumDataObject; }
@@ -41,15 +43,45 @@ namespace WTF { template <typename T> class PassRefPtr; }
 
 namespace WebKit {
 
-class WebData;
 class WebDragDataPrivate;
-class WebURL;
 template <typename T> class WebVector;
 
 // Holds data that may be exchanged through a drag-n-drop operation.  It is
 // inexpensive to copy a WebDragData object.
 class WebDragData {
 public:
+    struct Item {
+        enum StorageType {
+            // String data with an associated MIME type. Depending on the MIME type, there may be
+            // optional metadata attributes as well.
+            StorageTypeString,
+            // Stores the name of one file being dragged into the renderer.
+            StorageTypeFilename,
+            // An image being dragged out of the renderer. Contains a buffer holding the image data
+            // as well as the suggested name for saving the image to.
+            StorageTypeBinaryData,
+        };
+
+        StorageType storageType;
+
+        // Only valid when storageType == StorageTypeString.
+        WebString stringType;
+        WebString stringData;
+
+        // Only valid when storageType == StorageTypeFilename.
+        WebString filenameData;
+
+        // Only valid when storageType == StorageTypeBinaryData.
+        WebData binaryData;
+
+        // Title associated with a link when stringType == "text/uri-list".
+        // Filename when storageType == StorageTypeBinaryData.
+        WebString title;
+
+        // Only valid when stringType == "text/html".
+        WebURL baseURL;
+    };
+
     ~WebDragData() { reset(); }
 
     WebDragData() : m_private(0) { }
@@ -66,44 +98,9 @@ public:
 
     bool isNull() const { return !m_private; }
 
-    WEBKIT_EXPORT WebString url() const;
-    WEBKIT_EXPORT void setURL(const WebURL&);
-
-    WEBKIT_EXPORT WebString urlTitle() const;
-    WEBKIT_EXPORT void setURLTitle(const WebString&);
-
-    WEBKIT_EXPORT WebString downloadMetadata() const;
-    WEBKIT_EXPORT void setDownloadMetadata(const WebString&);
-
-    WEBKIT_EXPORT WebString fileExtension() const;
-    WEBKIT_EXPORT void setFileExtension(const WebString&);
-
-    WEBKIT_EXPORT bool containsFilenames() const;
-    WEBKIT_EXPORT void filenames(WebVector<WebString>&) const;
-    WEBKIT_EXPORT void setFilenames(const WebVector<WebString>&);
-    WEBKIT_EXPORT void appendToFilenames(const WebString&);
-
-    WEBKIT_EXPORT WebString plainText() const;
-    WEBKIT_EXPORT void setPlainText(const WebString&);
-
-    WEBKIT_EXPORT WebString htmlText() const;
-    WEBKIT_EXPORT void setHTMLText(const WebString&);
-
-    WEBKIT_EXPORT WebURL htmlBaseURL() const;
-    WEBKIT_EXPORT void setHTMLBaseURL(const WebURL&);
-
-    WEBKIT_EXPORT WebString fileContentFilename() const;
-    WEBKIT_EXPORT void setFileContentFilename(const WebString&);
-
-    WEBKIT_EXPORT WebData fileContent() const;
-    WEBKIT_EXPORT void setFileContent(const WebData&);
-
-    struct CustomData {
-        WebString type;
-        WebString data;
-    };
-    WEBKIT_EXPORT WebVector<CustomData> customData() const;
-    WEBKIT_EXPORT void setCustomData(const WebVector<CustomData>&);
+    WEBKIT_EXPORT WebVector<Item> items() const;
+    WEBKIT_EXPORT void setItems(const WebVector<Item>&);
+    WEBKIT_EXPORT void addItem(const Item&);
 
 #if WEBKIT_IMPLEMENTATION
     WebDragData(const WTF::PassRefPtr<WebCore::ChromiumDataObject>&);
diff --git a/Source/WebKit/chromium/public/platform/WebGamepad.h b/Source/WebKit/chromium/public/platform/WebGamepad.h
index 71d37b3ba..788e78ba4 100644
--- a/Source/WebKit/chromium/public/platform/WebGamepad.h
+++ b/Source/WebKit/chromium/public/platform/WebGamepad.h
@@ -26,8 +26,14 @@
 
 #include "WebCommon.h"
 
+#if WEBKIT_IMPLEMENTATION
+#include <wtf/Assertions.h>
+#endif
+
 namespace WebKit {
 
+#pragma pack(push, 1)
+
 // This structure is intentionally POD and fixed size so that it can be shared
 // memory between hardware polling threads and the rest of the browser. See
 // also WebGamepads.h.
@@ -69,6 +75,12 @@ public:
     float buttons[buttonsLengthCap];
 };
 
+#if WEBKIT_IMPLEMENTATION
+COMPILE_ASSERT(sizeof(WebGamepad) == 465, WebGamepad_has_wrong_size);
+#endif
+
+#pragma pack(pop)
+
 }
 
 #endif // WebGamepad_h
diff --git a/Source/WebKit/chromium/public/platform/WebGamepads.h b/Source/WebKit/chromium/public/platform/WebGamepads.h
index b1cc18ef8..50e2ab208 100644
--- a/Source/WebKit/chromium/public/platform/WebGamepads.h
+++ b/Source/WebKit/chromium/public/platform/WebGamepads.h
@@ -26,8 +26,14 @@
 
 #include "WebGamepad.h"
 
+#if WEBKIT_IMPLEMENTATION
+#include <wtf/Assertions.h>
+#endif
+
 namespace WebKit {
 
+#pragma pack(push, 1)
+
 // This structure is intentionally POD and fixed size so that it can be stored
 // in shared memory between hardware polling threads and the rest of the
 // browser.
@@ -45,6 +51,12 @@ public:
     WebGamepad items[itemsLengthCap];
 };
 
+#if WEBKIT_IMPLEMENTATION
+COMPILE_ASSERT(sizeof(WebGamepads) == 1864, WebGamepads_has_wrong_size);
+#endif
+
+#pragma pack(pop)
+
 }
 
 #endif // WebGamepads_h
diff --git a/Source/WebKit/chromium/public/platform/WebGraphicsContext3D.h b/Source/WebKit/chromium/public/platform/WebGraphicsContext3D.h
index 57f9d7985..f13f7c44d 100644
--- a/Source/WebKit/chromium/public/platform/WebGraphicsContext3D.h
+++ b/Source/WebKit/chromium/public/platform/WebGraphicsContext3D.h
@@ -130,6 +130,14 @@ public:
         virtual ~WebGraphicsSwapBuffersCompleteCallbackCHROMIUM() { }
     };
 
+    class WebGraphicsMemoryAllocationChangedCallbackCHROMIUM {
+    public:
+        virtual void onMemoryAllocationChanged(size_t gpuResourceSizeInBytes) = 0;
+
+    protected:
+        virtual ~WebGraphicsMemoryAllocationChangedCallbackCHROMIUM() { }
+    };
+
     // This destructor needs to be public so that using classes can destroy instances if initialization fails.
     virtual ~WebGraphicsContext3D() {}
 
@@ -151,6 +159,9 @@ public:
     // GL_CHROMIUM_setVisibility - Changes the visibility of the backbuffer
     virtual void setVisibilityCHROMIUM(bool visible) = 0;
 
+    // GL_CHROMIUM_gpu_memory_manager - sets callback to observe changes to memory allocation limits.
+    virtual void setMemoryAllocationChangedCallbackCHROMIUM(WebGraphicsMemoryAllocationChangedCallbackCHROMIUM* callback) { }
+
     // Query whether it is built on top of compliant GLES2 implementation.
     virtual bool isGLES2Compliant() = 0;
 
diff --git a/Source/WebKit/chromium/public/platform/WebKitPlatformSupport.h b/Source/WebKit/chromium/public/platform/WebKitPlatformSupport.h
index 54795fa48..3bf4cb43a 100644
--- a/Source/WebKit/chromium/public/platform/WebKitPlatformSupport.h
+++ b/Source/WebKit/chromium/public/platform/WebKitPlatformSupport.h
@@ -240,11 +240,76 @@ public:
     virtual void decrementStatsCounter(const char* name) { }
     virtual void incrementStatsCounter(const char* name) { }
 
-    // An event is identified by the pair (name, id). The extra parameter
-    // specifies additional data to log with the event.
-    virtual bool isTraceEventEnabled() const { return true; }
-    virtual void traceEventBegin(const char* name, void* id, const char* extra) { }
-    virtual void traceEventEnd(const char* name, void* id, const char* extra) { }
+    // Tracing -------------------------------------------------------------
+
+    // Get a pointer to the enabled state of the given trace category. The
+    // embedder can dynamically change the enabled state as trace event
+    // recording is started and stopped by the application. Only long-lived
+    // literal strings should be given as the category name. The implementation
+    // expects the returned pointer to be held permanently in a local static. If
+    // the unsigned char is non-zero, tracing is enabled. If tracing is enabled,
+    // addTraceEvent is expected to be called by the trace event macros.
+    virtual const unsigned char* getTraceCategoryEnabledFlag(const char* categoryName) { return 0; }
+    // Add a trace event to the platform tracing system. Depending on the actual
+    // enabled state, this event may be recorded or dropped. Returns
+    // thresholdBeginId for use in a corresponding end addTraceEvent call.
+    // - phase specifies the type of event:
+    //   - BEGIN ('B'): Marks the beginning of a scoped event.
+    //   - END ('E'): Marks the end of a scoped event.
+    //   - INSTANT ('I'): Standalone, instantaneous event.
+    //   - START ('S'): Marks the beginning of an asynchronous event (the end
+    //     event can occur in a different scope or thread). The id parameter is
+    //     used to match START/FINISH pairs.
+    //   - FINISH ('F'): Marks the end of an asynchronous event.
+    //   - COUNTER ('C'): Used to trace integer quantities that change over
+    //     time. The argument values are expected to be of type int.
+    //   - METADATA ('M'): Reserved for internal use.
+    // - categoryEnabled is the pointer returned by getTraceCategoryEnabledFlag.
+    // - name is the name of the event. Also used to match BEGIN/END and
+    //   START/FINISH pairs.
+    // - id optionally allows events of the same name to be distinguished from
+    //   each other. For example, to trace the consutruction and destruction of
+    //   objects, specify the pointer as the id parameter.
+    // - numArgs specifies the number of elements in argNames, argTypes, and
+    //   argValues.
+    // - argNames is the array of argument names. Use long-lived literal strings
+    //   or specify the COPY flag.
+    // - argTypes is the array of argument types:
+    //   - BOOL (1): bool
+    //   - UINT (2): unsigned long long
+    //   - INT (3): long long
+    //   - DOUBLE (4): double
+    //   - POINTER (5): void*
+    //   - STRING (6): char* (long-lived null-terminated char* string)
+    //   - COPY_STRING (7): char* (temporary null-terminated char* string)
+    // - argValues is the array of argument values. Each value is the unsigned
+    //   long long member of a union of all supported types.
+    // - thresholdBeginId optionally specifies the value returned by a previous
+    //   call to addTraceEvent with a BEGIN phase.
+    // - threshold is used on an END phase event in conjunction with the
+    //   thresholdBeginId of a prior BEGIN event. The threshold is the minimum
+    //   number of microseconds that must have passed since the BEGIN event. If
+    //   less than threshold microseconds has passed, the BEGIN/END pair is
+    //   dropped.
+    // - flags can be 0 or one or more of the following, ORed together:
+    //   - COPY (0x1): treat all strings (name, argNames and argValues of type
+    //     string) as temporary so that they will be copied by addTraceEvent.
+    //   - HAS_ID (0x2): use the id argument to uniquely identify the event for
+    //     matching with other events of the same name.
+    //   - MANGLE_ID (0x4): specify this flag if the id parameter is the value
+    //     of a pointer.
+    virtual int addTraceEvent(
+        char phase,
+        const unsigned char* categoryEnabledFlag,
+        const char* name,
+        unsigned long long id,
+        int numArgs,
+        const char** argNames,
+        const unsigned char* argTypes,
+        const unsigned long long* argValues,
+        int thresholdBeginId,
+        long long threshold,
+        unsigned char flags) { return -1; }
 
     // Callbacks for reporting histogram data.
     // CustomCounts histogram has exponential bucket sizes, so that min=1, max=1000000, bucketCount=50 would do.
diff --git a/Source/WebKit/chromium/public/platform/WebLayerTreeView.h b/Source/WebKit/chromium/public/platform/WebLayerTreeView.h
index 0263b3926..17a876a98 100644
--- a/Source/WebKit/chromium/public/platform/WebLayerTreeView.h
+++ b/Source/WebKit/chromium/public/platform/WebLayerTreeView.h
@@ -49,14 +49,18 @@ public:
             , showFPSCounter(false)
             , showPlatformLayerTree(false)
             , refreshRate(0)
-            , partialSwapEnabled(false) { }
+            , perTilePainting(false)
+            , partialSwapEnabled(false)
+            , threadedAnimationEnabled(false) { }
 
         bool acceleratePainting;
         bool compositeOffscreen;
         bool showFPSCounter;
         bool showPlatformLayerTree;
         double refreshRate;
+        bool perTilePainting;
         bool partialSwapEnabled;
+        bool threadedAnimationEnabled;
 #if WEBKIT_IMPLEMENTATION
         operator WebCore::CCSettings() const;
 #endif
@@ -107,6 +111,8 @@ public:
     operator WTF::PassRefPtr<WebCore::CCLayerTreeHost>() const;
 #endif
 
+    WEBKIT_EXPORT void setNeedsRedraw();
+
 protected:
     WebPrivatePtr<WebCore::CCLayerTreeHost> m_private;
 };
diff --git a/Source/WebKit/chromium/public/platform/WebPeerConnectionHandler.h b/Source/WebKit/chromium/public/platform/WebPeerConnectionHandler.h
index 7586abc03..bd2093577 100644
--- a/Source/WebKit/chromium/public/platform/WebPeerConnectionHandler.h
+++ b/Source/WebKit/chromium/public/platform/WebPeerConnectionHandler.h
@@ -54,7 +54,10 @@ class WebPeerConnectionHandler {
 public:
     virtual ~WebPeerConnectionHandler() { }
 
-    virtual void initialize(const WebString& serverConfiguration, const WebSecurityOrigin&) = 0;
+    // DEPRECATED
+    virtual void initialize(const WebString& serverConfiguration, const WebSecurityOrigin&) { };
+
+    virtual void initialize(const WebString& serverConfiguration, const WebString& username) { };
 
     virtual void produceInitialOffer(const WebVector<WebMediaStreamDescriptor>& pendingAddStreams) = 0;
     virtual void handleInitialOffer(const WebString& sdp) = 0;
diff --git a/Source/WebKit/chromium/public/platform/WebURLResponse.h b/Source/WebKit/chromium/public/platform/WebURLResponse.h
index 8629b849c..8d53eac38 100644
--- a/Source/WebKit/chromium/public/platform/WebURLResponse.h
+++ b/Source/WebKit/chromium/public/platform/WebURLResponse.h
@@ -50,6 +50,11 @@ class WebURLResponsePrivate;
 
 class WebURLResponse {
 public:
+    class ExtraData {
+    public:
+        virtual ~ExtraData() { }
+    };
+
     ~WebURLResponse() { reset(); }
 
     WebURLResponse() : m_private(0) { }
@@ -174,6 +179,15 @@ public:
     WEBKIT_EXPORT unsigned short remotePort() const;
     WEBKIT_EXPORT void setRemotePort(unsigned short);
 
+    // Extra data associated with the underlying resource response. Resource
+    // responses can be copied. If non-null, each copy of a resource response
+    // holds a pointer to the extra data, and the extra data pointer will be
+    // deleted when the last resource response is destroyed. Setting the extra
+    // data pointer will cause the underlying resource response to be
+    // dissociated from any existing non-null extra data pointer.
+    WEBKIT_EXPORT ExtraData* extraData() const;
+    WEBKIT_EXPORT void setExtraData(ExtraData*);
+
 protected:
     void assign(WebURLResponsePrivate*);
 
diff --git a/Source/WebKit/chromium/src/AssertMatchingEnums.cpp b/Source/WebKit/chromium/src/AssertMatchingEnums.cpp
index a451b88a6..3f0875b53 100644
--- a/Source/WebKit/chromium/src/AssertMatchingEnums.cpp
+++ b/Source/WebKit/chromium/src/AssertMatchingEnums.cpp
@@ -454,9 +454,6 @@ COMPILE_ASSERT_MATCHING_ENUM(WebFileErrorPathExists, FileError::PATH_EXISTS_ERR)
 COMPILE_ASSERT_MATCHING_ENUM(WebGeolocationError::ErrorPermissionDenied, GeolocationError::PermissionDenied);
 COMPILE_ASSERT_MATCHING_ENUM(WebGeolocationError::ErrorPositionUnavailable, GeolocationError::PositionUnavailable);
 
-COMPILE_ASSERT_MATCHING_ENUM(WebTextCheckingResult::ErrorSpelling, DocumentMarker::Spelling);
-COMPILE_ASSERT_MATCHING_ENUM(WebTextCheckingResult::ErrorGrammar, DocumentMarker::Grammar);
-
 COMPILE_ASSERT_MATCHING_ENUM(WebTextCheckingTypeSpelling, TextCheckingTypeSpelling);
 COMPILE_ASSERT_MATCHING_ENUM(WebTextCheckingTypeGrammar, TextCheckingTypeGrammar);
 COMPILE_ASSERT_MATCHING_ENUM(WebTextCheckingTypeLink, TextCheckingTypeLink);
diff --git a/Source/WebKit/chromium/src/ChromeClientImpl.cpp b/Source/WebKit/chromium/src/ChromeClientImpl.cpp
index fb07b4c10..45a813859 100644
--- a/Source/WebKit/chromium/src/ChromeClientImpl.cpp
+++ b/Source/WebKit/chromium/src/ChromeClientImpl.cpp
@@ -1018,6 +1018,11 @@ void ChromeClientImpl::numWheelEventHandlersChanged(unsigned numberOfWheelHandle
     m_webView->numberOfWheelEventHandlersChanged(numberOfWheelHandlers);
 }
 
+void ChromeClientImpl::numTouchEventHandlersChanged(unsigned numberOfTouchHandlers)
+{
+    m_webView->numberOfTouchEventHandlersChanged(numberOfTouchHandlers);
+}
+
 #if ENABLE(POINTER_LOCK)
 bool ChromeClientImpl::requestPointerLock()
 {
diff --git a/Source/WebKit/chromium/src/ChromeClientImpl.h b/Source/WebKit/chromium/src/ChromeClientImpl.h
index 8fd2488d9..23e02ff3d 100644
--- a/Source/WebKit/chromium/src/ChromeClientImpl.h
+++ b/Source/WebKit/chromium/src/ChromeClientImpl.h
@@ -204,6 +204,7 @@ public:
 
     virtual bool shouldRubberBandInDirection(WebCore::ScrollDirection) const;
     virtual void numWheelEventHandlersChanged(unsigned);
+    virtual void numTouchEventHandlersChanged(unsigned);
 
 #if ENABLE(POINTER_LOCK)
     virtual bool requestPointerLock();
diff --git a/Source/WebKit/chromium/src/EditorClientImpl.cpp b/Source/WebKit/chromium/src/EditorClientImpl.cpp
index 04aa719ed..934281a29 100644
--- a/Source/WebKit/chromium/src/EditorClientImpl.cpp
+++ b/Source/WebKit/chromium/src/EditorClientImpl.cpp
@@ -238,13 +238,11 @@ bool EditorClientImpl::shouldChangeSelectedRange(Range* fromRange,
     return true;
 }
 
-bool EditorClientImpl::shouldApplyStyle(CSSStyleDeclaration* style,
-                                        Range* range)
+bool EditorClientImpl::shouldApplyStyle(StylePropertySet* style, Range* range)
 {
     if (m_webView->client()) {
         // FIXME: Pass a reference to the CSSStyleDeclaration somehow.
-        return m_webView->client()->shouldApplyStyle(WebString(),
-                                                     WebRange(range));
+        return m_webView->client()->shouldApplyStyle(WebString(), WebRange(range));
     }
     return true;
 }
@@ -731,10 +729,10 @@ void EditorClientImpl::checkSpellingOfString(const UChar* text, int length,
         *misspellingLength = spellLength;
 }
 
-void EditorClientImpl::requestCheckingOfString(SpellChecker* sender, int identifier, TextCheckingTypeMask, const String& text)
+void EditorClientImpl::requestCheckingOfString(SpellChecker* sender, const WebCore::TextCheckingRequest& request)
 {
     if (m_webView->spellCheckClient())
-        m_webView->spellCheckClient()->requestCheckingOfText(text, new WebTextCheckingCompletionImpl(identifier, sender));
+        m_webView->spellCheckClient()->requestCheckingOfText(request.text(), new WebTextCheckingCompletionImpl(request.sequence(), sender));
 }
 
 String EditorClientImpl::getAutoCorrectSuggestionForMisspelledWord(const String& misspelledWord)
diff --git a/Source/WebKit/chromium/src/EditorClientImpl.h b/Source/WebKit/chromium/src/EditorClientImpl.h
index 2b577107c..b167b6c2d 100644
--- a/Source/WebKit/chromium/src/EditorClientImpl.h
+++ b/Source/WebKit/chromium/src/EditorClientImpl.h
@@ -67,7 +67,7 @@ public:
     virtual bool shouldDeleteRange(WebCore::Range*);
     virtual bool shouldChangeSelectedRange(WebCore::Range* fromRange, WebCore::Range* toRange,
         WebCore::EAffinity, bool stillSelecting);
-    virtual bool shouldApplyStyle(WebCore::CSSStyleDeclaration*, WebCore::Range*);
+    virtual bool shouldApplyStyle(WebCore::StylePropertySet*, WebCore::Range*);
     virtual bool shouldMoveRangeAfterDelete(WebCore::Range*, WebCore::Range*);
     virtual void didBeginEditing();
     virtual void respondToChangedContents();
@@ -109,7 +109,7 @@ public:
     virtual void getGuessesForWord(const WTF::String& word, const WTF::String& context, WTF::Vector<WTF::String>& guesses);
     virtual void willSetInputMethodState();
     virtual void setInputMethodState(bool enabled);
-    virtual void requestCheckingOfString(WebCore::SpellChecker*, int, WebCore::TextCheckingTypeMask, const WTF::String&);
+    virtual void requestCheckingOfString(WebCore::SpellChecker*, const WebCore::TextCheckingRequest&);
 
     virtual WebCore::TextCheckerClient* textChecker() { return this; }
 
diff --git a/Source/WebKit/chromium/src/Extensions3DChromium.cpp b/Source/WebKit/chromium/src/Extensions3DChromium.cpp
index ece0405ae..73397bd2b 100644
--- a/Source/WebKit/chromium/src/Extensions3DChromium.cpp
+++ b/Source/WebKit/chromium/src/Extensions3DChromium.cpp
@@ -107,6 +107,11 @@ void Extensions3DChromium::setVisibilityCHROMIUM(bool visibility)
     m_private->setVisibilityCHROMIUM(visibility);
 }
 
+void Extensions3DChromium::setGpuMemoryAllocationChangedCallbackCHROMIUM(PassOwnPtr<GpuMemoryAllocationChangedCallbackCHROMIUM> callback)
+{
+    m_private->setGpuMemoryAllocationChangedCallbackCHROMIUM(callback);
+}
+
 Platform3DObject Extensions3DChromium::createVertexArrayOES()
 {
     return 0;
diff --git a/Source/WebKit/chromium/src/GraphicsContext3DChromium.cpp b/Source/WebKit/chromium/src/GraphicsContext3DChromium.cpp
index cbbf5c581..c7ac894b0 100644
--- a/Source/WebKit/chromium/src/GraphicsContext3DChromium.cpp
+++ b/Source/WebKit/chromium/src/GraphicsContext3DChromium.cpp
@@ -85,12 +85,11 @@ namespace WebCore {
 //----------------------------------------------------------------------
 // GraphicsContext3DPrivate
 
-GraphicsContext3DPrivate::GraphicsContext3DPrivate(WebKit::WebViewImpl* webViewImpl, PassOwnPtr<WebKit::WebGraphicsContext3D> webContext, GraphicsContext3D::Attributes attrs)
+GraphicsContext3DPrivate::GraphicsContext3DPrivate(PassOwnPtr<WebKit::WebGraphicsContext3D> webContext, bool preserveDrawingBuffer)
     : m_impl(webContext)
-    , m_webViewImpl(webViewImpl)
     , m_initializedAvailableExtensions(false)
     , m_layerComposited(false)
-    , m_preserveDrawingBuffer(attrs.preserveDrawingBuffer)
+    , m_preserveDrawingBuffer(preserveDrawingBuffer)
     , m_resourceSafety(ResourceSafetyUnknown)
 #if USE(SKIA)
     , m_grContext(0)
@@ -112,59 +111,19 @@ GraphicsContext3DPrivate::~GraphicsContext3DPrivate()
 #endif
 }
 
-
-PassOwnPtr<GraphicsContext3DPrivate> GraphicsContext3DPrivate::create(WebKit::WebViewImpl* webViewImpl, PassOwnPtr<WebKit::WebGraphicsContext3D> webContext, GraphicsContext3D::Attributes attrs)
-{
-    return adoptPtr(new GraphicsContext3DPrivate(webViewImpl, webContext, attrs));
-}
-
-PassRefPtr<GraphicsContext3D> GraphicsContext3DPrivate::createGraphicsContextFromWebContext(PassOwnPtr<WebKit::WebGraphicsContext3D> webContext, GraphicsContext3D::Attributes attrs, HostWindow* hostWindow, GraphicsContext3D::RenderStyle renderStyle, ThreadUsage threadUsage)
+PassRefPtr<GraphicsContext3D> GraphicsContext3DPrivate::createGraphicsContextFromWebContext(PassOwnPtr<WebKit::WebGraphicsContext3D> webContext, GraphicsContext3D::RenderStyle renderStyle, bool preserveDrawingBuffer)
 {
-    Chrome* chrome = static_cast<Chrome*>(hostWindow);
-    WebKit::WebViewImpl* webViewImpl = chrome ? static_cast<WebKit::WebViewImpl*>(chrome->client()->webView()) : 0;
+    bool renderDirectlyToHostWindow = renderStyle == GraphicsContext3D::RenderDirectlyToHostWindow;
 
-    OwnPtr<GraphicsContext3DPrivate> priv = GraphicsContext3DPrivate::create(webViewImpl, webContext, attrs);
-    if (!priv)
-        return 0;
+    RefPtr<GraphicsContext3D> context = adoptRef(new GraphicsContext3D(GraphicsContext3D::Attributes(), 0, renderDirectlyToHostWindow));
 
-    bool renderDirectlyToHostWindow = renderStyle == GraphicsContext3D::RenderDirectlyToHostWindow;
-    RefPtr<GraphicsContext3D> result = adoptRef(new GraphicsContext3D(attrs, hostWindow, renderDirectlyToHostWindow));
-    result->m_private = priv.release();
-    return result.release();
+    OwnPtr<GraphicsContext3DPrivate> priv = adoptPtr(new GraphicsContext3DPrivate(webContext, preserveDrawingBuffer));
+    context->m_private = priv.release();
+    return context.release();
 }
 
 namespace {
 
-PassRefPtr<GraphicsContext3D> createGraphicsContext(GraphicsContext3D::Attributes attrs, HostWindow* hostWindow, GraphicsContext3D::RenderStyle renderStyle, GraphicsContext3DPrivate::ThreadUsage threadUsage)
-{
-    bool renderDirectlyToHostWindow = renderStyle == GraphicsContext3D::RenderDirectlyToHostWindow;
-
-    WebKit::WebGraphicsContext3D::Attributes webAttributes;
-    webAttributes.alpha = attrs.alpha;
-    webAttributes.depth = attrs.depth;
-    webAttributes.stencil = attrs.stencil;
-    webAttributes.antialias = attrs.antialias;
-    webAttributes.premultipliedAlpha = attrs.premultipliedAlpha;
-    webAttributes.canRecoverFromContextLoss = attrs.canRecoverFromContextLoss;
-    webAttributes.noExtensions = attrs.noExtensions;
-    webAttributes.shareResources = attrs.shareResources;
-    webAttributes.forUseOnAnotherThread = threadUsage == GraphicsContext3DPrivate::ForUseOnAnotherThread;
-
-    Chrome* chrome = static_cast<Chrome*>(hostWindow);
-    WebKit::WebViewImpl* webViewImpl = chrome ? static_cast<WebKit::WebViewImpl*>(chrome->client()->webView()) : 0;
-    OwnPtr<WebKit::WebGraphicsContext3D> webContext;
-    if (!webViewImpl || !webViewImpl->client()) {
-        if (renderDirectlyToHostWindow)
-            return 0;
-        webContext = adoptPtr(WebKit::webKitPlatformSupport()->createOffscreenGraphicsContext3D(webAttributes));
-    } else
-        webContext = adoptPtr(webViewImpl->client()->createGraphicsContext3D(webAttributes, renderDirectlyToHostWindow));
-    if (!webContext)
-        return 0;
-
-    return GraphicsContext3DPrivate::createGraphicsContextFromWebContext(webContext.release(), attrs, hostWindow, renderStyle, threadUsage);
-}
-
 void getDrawingParameters(DrawingBuffer* drawingBuffer, WebKit::WebGraphicsContext3D* graphicsContext3D,
                           Platform3DObject* frameBufferId, int* width, int* height)
 {
@@ -181,11 +140,6 @@ void getDrawingParameters(DrawingBuffer* drawingBuffer, WebKit::WebGraphicsConte
 
 } // anonymous namespace
 
-PassRefPtr<GraphicsContext3D> GraphicsContext3DPrivate::createGraphicsContextForAnotherThread(GraphicsContext3D::Attributes attrs, HostWindow* hostWindow, GraphicsContext3D::RenderStyle renderStyle)
-{
-    return createGraphicsContext(attrs, hostWindow, renderStyle, ForUseOnAnotherThread);
-}
-
 WebKit::WebGraphicsContext3D* GraphicsContext3DPrivate::extractWebGraphicsContext3D(GraphicsContext3D* context)
 {
     if (!context)
@@ -200,8 +154,6 @@ PlatformGraphicsContext3D GraphicsContext3DPrivate::platformGraphicsContext3D()
 
 Platform3DObject GraphicsContext3DPrivate::platformTexture() const
 {
-    ASSERT(m_webViewImpl);
-    m_impl->setParentContext(m_webViewImpl->graphicsContext3D());
     return m_impl->getPlatformTextureId();
 }
 
@@ -345,13 +297,6 @@ PassRefPtr<ImageData> GraphicsContext3DPrivate::paintRenderingResultsToImageData
     return imageData.release();
 }
 
-bool GraphicsContext3DPrivate::paintsIntoCanvasBuffer() const
-{
-    // If the gpu compositor is on then skip the readback and software rendering path.
-    ASSERT(m_webViewImpl);
-    return !m_webViewImpl->isAcceleratedCompositingActive();
-}
-
 void GraphicsContext3DPrivate::reshape(int width, int height)
 {
     if (width == m_impl->width() && height == m_impl->height())
@@ -1035,11 +980,28 @@ GraphicsContext3D::~GraphicsContext3D()
     m_private->setContextLostCallback(nullptr);
     m_private->setErrorMessageCallback(nullptr);
     m_private->setSwapBuffersCompleteCallbackCHROMIUM(nullptr);
+    m_private->setGpuMemoryAllocationChangedCallbackCHROMIUM(nullptr);
 }
 
-PassRefPtr<GraphicsContext3D> GraphicsContext3D::create(GraphicsContext3D::Attributes attrs, HostWindow* hostWindow, GraphicsContext3D::RenderStyle renderStyle)
+PassRefPtr<GraphicsContext3D> GraphicsContext3D::create(GraphicsContext3D::Attributes attrs, HostWindow*, GraphicsContext3D::RenderStyle renderStyle)
 {
-    return createGraphicsContext(attrs, hostWindow, renderStyle, GraphicsContext3DPrivate::ForUseOnThisThread);
+    ASSERT(renderStyle != GraphicsContext3D::RenderDirectlyToHostWindow);
+
+    WebKit::WebGraphicsContext3D::Attributes webAttributes;
+    webAttributes.alpha = attrs.alpha;
+    webAttributes.depth = attrs.depth;
+    webAttributes.stencil = attrs.stencil;
+    webAttributes.antialias = attrs.antialias;
+    webAttributes.premultipliedAlpha = attrs.premultipliedAlpha;
+    webAttributes.canRecoverFromContextLoss = attrs.canRecoverFromContextLoss;
+    webAttributes.noExtensions = attrs.noExtensions;
+    webAttributes.shareResources = attrs.shareResources;
+
+    OwnPtr<WebKit::WebGraphicsContext3D> webContext = adoptPtr(WebKit::webKitPlatformSupport()->createOffscreenGraphicsContext3D(webAttributes));
+    if (!webContext)
+        return 0;
+
+    return GraphicsContext3DPrivate::createGraphicsContextFromWebContext(webContext.release(), renderStyle, attrs.preserveDrawingBuffer);
 }
 
 PlatformGraphicsContext3D GraphicsContext3D::platformGraphicsContext3D() const
@@ -1247,11 +1209,6 @@ PassRefPtr<ImageData> GraphicsContext3D::paintRenderingResultsToImageData(Drawin
 
 DELEGATE_TO_INTERNAL_1R(paintCompositedResultsToCanvas, CanvasRenderingContext*, bool)
 
-bool GraphicsContext3D::paintsIntoCanvasBuffer() const
-{
-    return m_private->paintsIntoCanvasBuffer();
-}
-
 DELEGATE_TO_INTERNAL_R(createBuffer, Platform3DObject)
 DELEGATE_TO_INTERNAL_R(createFramebuffer, Platform3DObject)
 DELEGATE_TO_INTERNAL_R(createProgram, Platform3DObject)
@@ -1359,6 +1316,31 @@ void GraphicsContext3DPrivate::setSwapBuffersCompleteCallbackCHROMIUM(PassOwnPtr
     m_impl->setSwapBuffersCompleteCallbackCHROMIUM(m_swapBuffersCompleteCallbackAdapter.get());
 }
 
+class GraphicsContext3DMemoryAllocationChangedCallbackAdapter : public WebKit::WebGraphicsContext3D::WebGraphicsMemoryAllocationChangedCallbackCHROMIUM {
+public:
+    GraphicsContext3DMemoryAllocationChangedCallbackAdapter(PassOwnPtr<Extensions3DChromium::GpuMemoryAllocationChangedCallbackCHROMIUM> cb)
+        : m_memoryAllocationChangedCallback(cb)
+    {
+    }
+
+    virtual ~GraphicsContext3DMemoryAllocationChangedCallbackAdapter() { }
+
+    virtual void onMemoryAllocationChanged(size_t gpuResourceSizeInBytes)
+    {
+        if (m_memoryAllocationChangedCallback)
+            m_memoryAllocationChangedCallback->onGpuMemoryAllocationChanged(gpuResourceSizeInBytes);
+    }
+
+private:
+    OwnPtr<Extensions3DChromium::GpuMemoryAllocationChangedCallbackCHROMIUM> m_memoryAllocationChangedCallback;
+};
+
+void GraphicsContext3DPrivate::setGpuMemoryAllocationChangedCallbackCHROMIUM(PassOwnPtr<Extensions3DChromium::GpuMemoryAllocationChangedCallbackCHROMIUM> cb)
+{
+    m_memoryAllocationChangedCallbackAdapter = adoptPtr(new GraphicsContext3DMemoryAllocationChangedCallbackAdapter(cb));
+    m_impl->setMemoryAllocationChangedCallbackCHROMIUM(m_memoryAllocationChangedCallbackAdapter.get());
+}
+
 } // namespace WebCore
 
 #endif // ENABLE(WEBGL)
diff --git a/Source/WebKit/chromium/src/GraphicsContext3DPrivate.h b/Source/WebKit/chromium/src/GraphicsContext3DPrivate.h
index f2d49a132..d296eeb9b 100644
--- a/Source/WebKit/chromium/src/GraphicsContext3DPrivate.h
+++ b/Source/WebKit/chromium/src/GraphicsContext3DPrivate.h
@@ -41,8 +41,7 @@ class GrContext;
 
 namespace WebKit {
 class WebGraphicsContext3D;
-class WebViewImpl;
-} // namespace WebKit
+}
 
 namespace WebCore {
 
@@ -51,25 +50,14 @@ class Extensions3DChromium;
 class GraphicsContextLostCallbackAdapter;
 class GraphicsContext3DSwapBuffersCompleteCallbackAdapter;
 class GraphicsErrorMessageCallbackAdapter;
+class GraphicsContext3DMemoryAllocationChangedCallbackAdapter;
 
 class GraphicsContext3DPrivate {
 public:
-    static PassOwnPtr<GraphicsContext3DPrivate> create(WebKit::WebViewImpl*, PassOwnPtr<WebKit::WebGraphicsContext3D>, GraphicsContext3D::Attributes);
-
-    enum ThreadUsage {
-        ForUseOnThisThread,
-        ForUseOnAnotherThread,
-    };
-
-    // createGraphicsContextForAnotherThread is equivalent to
-    // GraphicsContext3D::create, but will skip making the context
-    // current. Callers must make the context current before using it AND check
-    // that the context was created successfully via ContextLost. Once made
-    // current on a thread, the context cannot be used on any other thread.
-    static PassRefPtr<GraphicsContext3D> createGraphicsContextForAnotherThread(GraphicsContext3D::Attributes, HostWindow*, GraphicsContext3D::RenderStyle);
-
-    // Used in tests to create a GraphicsContext3D from a mocked WebGraphicsContext3D.
-    static PassRefPtr<GraphicsContext3D> createGraphicsContextFromWebContext(PassOwnPtr<WebKit::WebGraphicsContext3D>, GraphicsContext3D::Attributes, HostWindow*, GraphicsContext3D::RenderStyle, ThreadUsage);
+    // Callers must make the context current before using it AND check that the context was created successfully
+    // via ContextLost before using the context in any way. Once made current on a thread, the context cannot
+    // be used on any other thread.
+    static PassRefPtr<GraphicsContext3D> createGraphicsContextFromWebContext(PassOwnPtr<WebKit::WebGraphicsContext3D>, GraphicsContext3D::RenderStyle, bool preserveDrawingBuffer = false);
 
     ~GraphicsContext3DPrivate();
 
@@ -97,7 +85,6 @@ public:
     void paintRenderingResultsToCanvas(CanvasRenderingContext*, DrawingBuffer*);
     void paintFramebufferToCanvas(int framebuffer, int width, int height, bool premultiplyAlpha, ImageBuffer*);
     PassRefPtr<ImageData> paintRenderingResultsToImageData(DrawingBuffer*);
-    bool paintsIntoCanvasBuffer() const;
     bool paintCompositedResultsToCanvas(CanvasRenderingContext*);
 
     void prepareTexture();
@@ -295,6 +282,9 @@ public:
     // GL_CHROMIUM_set_visibility
     void setVisibilityCHROMIUM(bool);
 
+    // GL_CHROMIUM_gpu_memory_manager
+    void setGpuMemoryAllocationChangedCallbackCHROMIUM(PassOwnPtr<Extensions3DChromium::GpuMemoryAllocationChangedCallbackCHROMIUM>);
+
     // GL_CHROMIUM_framebuffer_multisample
     void blitFramebufferCHROMIUM(GC3Dint srcX0, GC3Dint srcY0, GC3Dint srcX1, GC3Dint srcY1, GC3Dint dstX0, GC3Dint dstY0, GC3Dint dstX1, GC3Dint dstY1, GC3Dbitfield mask, GC3Denum filter);
     void renderbufferStorageMultisampleCHROMIUM(GC3Denum target, GC3Dsizei samples, GC3Denum internalformat, GC3Dsizei width, GC3Dsizei height);
@@ -318,14 +308,14 @@ public:
     void texStorage2DEXT(GC3Denum target, GC3Dint levels, GC3Duint internalformat, GC3Dint width, GC3Dint height);
 
 private:
-    GraphicsContext3DPrivate(WebKit::WebViewImpl*, PassOwnPtr<WebKit::WebGraphicsContext3D>, GraphicsContext3D::Attributes);
+    GraphicsContext3DPrivate(PassOwnPtr<WebKit::WebGraphicsContext3D>, bool preserveDrawingBuffer);
 
     OwnPtr<WebKit::WebGraphicsContext3D> m_impl;
     OwnPtr<Extensions3DChromium> m_extensions;
     OwnPtr<GraphicsContextLostCallbackAdapter> m_contextLostCallbackAdapter;
     OwnPtr<GraphicsErrorMessageCallbackAdapter> m_errorMessageCallbackAdapter;
     OwnPtr<GraphicsContext3DSwapBuffersCompleteCallbackAdapter> m_swapBuffersCompleteCallbackAdapter;
-    WebKit::WebViewImpl* m_webViewImpl;
+    OwnPtr<GraphicsContext3DMemoryAllocationChangedCallbackAdapter> m_memoryAllocationChangedCallbackAdapter;
     bool m_initializedAvailableExtensions;
     HashSet<String> m_enabledExtensions;
     HashSet<String> m_requestableExtensions;
diff --git a/Source/WebKit/chromium/src/IDBFactoryBackendProxy.cpp b/Source/WebKit/chromium/src/IDBFactoryBackendProxy.cpp
index 99a0afae4..a1cce45b0 100755
--- a/Source/WebKit/chromium/src/IDBFactoryBackendProxy.cpp
+++ b/Source/WebKit/chromium/src/IDBFactoryBackendProxy.cpp
@@ -157,6 +157,12 @@ private:
 
 bool IDBFactoryBackendProxy::allowIDBFromWorkerThread(WorkerContext* workerContext, const String& name, const WebSecurityOrigin&)
 {
+    // FIXME: Bypass checking for permission so as not to block shared worker
+    // testing until a permissions check is implemented. This has to be fixed
+    // before m19 goes to beta. http://crbug.com/112855
+    if (workerContext->isSharedWorkerContext())
+        return true;
+
     WebWorkerClientImpl* webWorkerClientImpl = static_cast<WebWorkerClientImpl*>(&workerContext->thread()->workerLoaderProxy());
     WorkerRunLoop& runLoop = workerContext->thread()->runLoop();
 
@@ -181,15 +187,7 @@ void IDBFactoryBackendProxy::openFromWorker(const String& name, IDBCallbacks* ca
         callbacks->onError(WebIDBDatabaseError(0, "The user denied permission to access the database."));
         return;
     }
-    WorkerLoaderProxy* workerLoaderProxy = &context->thread()->workerLoaderProxy();
-    WebWorkerBase* webWorker = static_cast<WebWorkerBase*>(workerLoaderProxy);
-    WebView* webView = webWorker->view();
-    if (!webView) {
-        // Frame is closed, worker is terminaring.
-        return;
-    }
-    WebFrame* webFrame = webView->mainFrame();
-    m_webIDBFactory->open(name, new WebIDBCallbacksImpl(callbacks), origin, webFrame, dataDir);
+    m_webIDBFactory->open(name, new WebIDBCallbacksImpl(callbacks), origin, /*webFrame*/0, dataDir);
 #endif
 }
 
diff --git a/Source/WebKit/chromium/src/IDBObjectStoreBackendProxy.cpp b/Source/WebKit/chromium/src/IDBObjectStoreBackendProxy.cpp
index 71fb571d1..485487ac0 100755
--- a/Source/WebKit/chromium/src/IDBObjectStoreBackendProxy.cpp
+++ b/Source/WebKit/chromium/src/IDBObjectStoreBackendProxy.cpp
@@ -98,6 +98,14 @@ void IDBObjectStoreBackendProxy::deleteFunction(PassRefPtr<IDBKey> key, PassRefP
     m_webIDBObjectStore->deleteFunction(key, new WebIDBCallbacksImpl(callbacks), *transactionProxy->getWebIDBTransaction(), ec);
 }
 
+void IDBObjectStoreBackendProxy::deleteFunction(PassRefPtr<IDBKeyRange> keyRange, PassRefPtr<IDBCallbacks> callbacks, IDBTransactionBackendInterface* transaction, ExceptionCode& ec)
+{
+    // The transaction pointer is guaranteed to be a pointer to a proxy object as, in the renderer,
+    // all implementations of IDB interfaces are proxy objects.
+    IDBTransactionBackendProxy* transactionProxy = static_cast<IDBTransactionBackendProxy*>(transaction);
+    m_webIDBObjectStore->deleteFunction(keyRange, new WebIDBCallbacksImpl(callbacks), *transactionProxy->getWebIDBTransaction(), ec);
+}
+
 void IDBObjectStoreBackendProxy::clear(PassRefPtr<IDBCallbacks> callbacks, IDBTransactionBackendInterface* transaction, ExceptionCode& ec)
 {
     // The transaction pointer is guaranteed to be a pointer to a proxy object as, in the renderer,
diff --git a/Source/WebKit/chromium/src/IDBObjectStoreBackendProxy.h b/Source/WebKit/chromium/src/IDBObjectStoreBackendProxy.h
index 6d335635c..c19a0f0a4 100644
--- a/Source/WebKit/chromium/src/IDBObjectStoreBackendProxy.h
+++ b/Source/WebKit/chromium/src/IDBObjectStoreBackendProxy.h
@@ -49,6 +49,7 @@ public:
     virtual void get(PassRefPtr<WebCore::IDBKey>, PassRefPtr<WebCore::IDBCallbacks>, WebCore::IDBTransactionBackendInterface*, WebCore::ExceptionCode&);
     virtual void put(PassRefPtr<WebCore::SerializedScriptValue>, PassRefPtr<WebCore::IDBKey>, PutMode, PassRefPtr<WebCore::IDBCallbacks>, WebCore::IDBTransactionBackendInterface*, WebCore::ExceptionCode&);
     virtual void deleteFunction(PassRefPtr<WebCore::IDBKey>, PassRefPtr<WebCore::IDBCallbacks>, WebCore::IDBTransactionBackendInterface*, WebCore::ExceptionCode&);
+    virtual void deleteFunction(PassRefPtr<WebCore::IDBKeyRange>, PassRefPtr<WebCore::IDBCallbacks>, WebCore::IDBTransactionBackendInterface*, WebCore::ExceptionCode&);
     virtual void clear(PassRefPtr<WebCore::IDBCallbacks>, WebCore::IDBTransactionBackendInterface*, WebCore::ExceptionCode&);
 
     PassRefPtr<WebCore::IDBIndexBackendInterface> createIndex(const String& name, const String& keyPath, bool unique, bool multiEntry, WebCore::IDBTransactionBackendInterface*, WebCore::ExceptionCode&);
diff --git a/Source/WebKit/chromium/src/NonCompositedContentHost.cpp b/Source/WebKit/chromium/src/NonCompositedContentHost.cpp
index c9be08a84..b6b1a2294 100644
--- a/Source/WebKit/chromium/src/NonCompositedContentHost.cpp
+++ b/Source/WebKit/chromium/src/NonCompositedContentHost.cpp
@@ -27,6 +27,7 @@
 
 #include "NonCompositedContentHost.h"
 
+#include "FloatPoint.h"
 #include "FloatRect.h"
 #include "GraphicsLayer.h"
 #include "LayerChromium.h"
@@ -103,6 +104,7 @@ void NonCompositedContentHost::setViewport(const WebCore::IntSize& viewportSize,
 
     m_viewportSize = viewportSize;
     scrollLayer()->setScrollPosition(scrollPosition);
+    scrollLayer()->setPosition(-scrollPosition);
     // Due to the possibility of pinch zoom, the noncomposited layer is always
     // assumed to be scrollable.
     scrollLayer()->setScrollable(true);
diff --git a/Source/WebKit/chromium/src/PlatformSupport.cpp b/Source/WebKit/chromium/src/PlatformSupport.cpp
index b4d479ca6..63be0245c 100644
--- a/Source/WebKit/chromium/src/PlatformSupport.cpp
+++ b/Source/WebKit/chromium/src/PlatformSupport.cpp
@@ -947,19 +947,24 @@ void PlatformSupport::paintThemePart(
 
 // Trace Event ----------------------------------------------------------------
 
-bool PlatformSupport::isTraceEventEnabled()
-{
-    return webKitPlatformSupport()->isTraceEventEnabled();
-}
-
-void PlatformSupport::traceEventBegin(const char* name, void* id, const char* extra)
-{
-    webKitPlatformSupport()->traceEventBegin(name, id, extra);
-}
-
-void PlatformSupport::traceEventEnd(const char* name, void* id, const char* extra)
-{
-    webKitPlatformSupport()->traceEventEnd(name, id, extra);
+const unsigned char* PlatformSupport::getTraceCategoryEnabledFlag(const char* categoryName)
+{
+    return webKitPlatformSupport()->getTraceCategoryEnabledFlag(categoryName);
+}
+int PlatformSupport::addTraceEvent(char phase,
+                                   const unsigned char* categoryEnabledFlag,
+                                   const char* name,
+                                   unsigned long long id,
+                                   int numArgs,
+                                   const char** argNames,
+                                   const unsigned char* argTypes,
+                                   const unsigned long long* argValues,
+                                   int thresholdBeginId,
+                                   long long threshold,
+                                   unsigned char flags)
+{
+    return webKitPlatformSupport()->addTraceEvent(
+        phase, categoryEnabledFlag, name, id, numArgs, argNames, argTypes, argValues,  thresholdBeginId, threshold, flags);
 }
 
 // Visited Links --------------------------------------------------------------
diff --git a/Source/WebKit/chromium/src/SocketStreamHandle.cpp b/Source/WebKit/chromium/src/SocketStreamHandle.cpp
index cf8aa02cd..298e733a4 100644
--- a/Source/WebKit/chromium/src/SocketStreamHandle.cpp
+++ b/Source/WebKit/chromium/src/SocketStreamHandle.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2009 Google Inc. All rights reserved.
+ * Copyright (C) 2009, 2012 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
@@ -30,6 +30,7 @@
 
 #include "config.h"
 #include "SocketStreamHandle.h"
+#include "SocketStreamHandleInternal.h"
 
 #if ENABLE(WEB_SOCKETS)
 
@@ -40,41 +41,12 @@
 #include "WebKit.h"
 #include "platform/WebKitPlatformSupport.h"
 #include "platform/WebSocketStreamHandle.h"
-#include "platform/WebSocketStreamHandleClient.h"
-#include "platform/WebURL.h"
 #include <wtf/PassOwnPtr.h>
 
 using namespace WebKit;
 
 namespace WebCore {
 
-class SocketStreamHandleInternal : public WebSocketStreamHandleClient {
-public:
-    static PassOwnPtr<SocketStreamHandleInternal> create(SocketStreamHandle* handle)
-    {
-        return adoptPtr(new SocketStreamHandleInternal(handle));
-    }
-    virtual ~SocketStreamHandleInternal();
-
-    void connect(const KURL&);
-    int send(const char*, int);
-    void close();
-
-    virtual void didOpenStream(WebSocketStreamHandle*, int);
-    virtual void didSendData(WebSocketStreamHandle*, int);
-    virtual void didReceiveData(WebSocketStreamHandle*, const WebData&);
-    virtual void didClose(WebSocketStreamHandle*);
-    virtual void didFail(WebSocketStreamHandle*, const WebSocketStreamError&);
-
-private:
-    explicit SocketStreamHandleInternal(SocketStreamHandle*);
-
-    SocketStreamHandle* m_handle;
-    OwnPtr<WebSocketStreamHandle> m_socket;
-    int m_maxPendingSendAllowed;
-    int m_pendingAmountSent;
-};
-
 SocketStreamHandleInternal::SocketStreamHandleInternal(SocketStreamHandle* handle)
     : m_handle(handle)
     , m_maxPendingSendAllowed(0)
diff --git a/Source/WebKit/chromium/src/SocketStreamHandleInternal.h b/Source/WebKit/chromium/src/SocketStreamHandleInternal.h
new file mode 100644
index 000000000..857b279e7
--- /dev/null
+++ b/Source/WebKit/chromium/src/SocketStreamHandleInternal.h
@@ -0,0 +1,89 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef SocketStreamHandleInternal_h
+#define SocketStreamHandleInternal_h
+
+#if ENABLE(WEB_SOCKETS)
+
+#include "SocketStreamHandle.h"
+#include "platform/WebSocketStreamHandleClient.h"
+#include "platform/WebURL.h"
+#include <wtf/PassOwnPtr.h>
+
+namespace WebKit {
+
+class WebData;
+class WebSocketStreamError;
+class WebSocketStreamHandle;
+
+}
+
+namespace WebCore {
+
+class SocketStreamHandleInternal : public WebKit::WebSocketStreamHandleClient {
+public:
+    static PassOwnPtr<SocketStreamHandleInternal> create(SocketStreamHandle* handle)
+    {
+        return adoptPtr(new SocketStreamHandleInternal(handle));
+    }
+    virtual ~SocketStreamHandleInternal();
+
+    void connect(const KURL&);
+    int send(const char*, int);
+    void close();
+
+    virtual void didOpenStream(WebKit::WebSocketStreamHandle*, int);
+    virtual void didSendData(WebKit::WebSocketStreamHandle*, int);
+    virtual void didReceiveData(WebKit::WebSocketStreamHandle*, const WebKit::WebData&);
+    virtual void didClose(WebKit::WebSocketStreamHandle*);
+    virtual void didFail(WebKit::WebSocketStreamHandle*, const WebKit::WebSocketStreamError&);
+
+    static WebKit::WebSocketStreamHandle* toWebSocketStreamHandle(SocketStreamHandle* handle)
+    {
+        if (handle && handle->m_internal)
+            return handle->m_internal->m_socket.get();
+        return 0;
+    }
+
+private:
+    explicit SocketStreamHandleInternal(SocketStreamHandle*);
+
+    SocketStreamHandle* m_handle;
+    OwnPtr<WebKit::WebSocketStreamHandle> m_socket;
+    int m_maxPendingSendAllowed;
+    int m_pendingAmountSent;
+};
+
+} // namespace WebCore
+
+#endif // ENABLE(WEB_SOCKETS)
+
+#endif // SocketStreamHandleInternal_h
diff --git a/Source/WebKit/chromium/src/UserMediaClientImpl.h b/Source/WebKit/chromium/src/UserMediaClientImpl.h
index f6ab0416b..a1c6ac281 100644
--- a/Source/WebKit/chromium/src/UserMediaClientImpl.h
+++ b/Source/WebKit/chromium/src/UserMediaClientImpl.h
@@ -31,6 +31,8 @@
 #ifndef UserMediaClientImpl_h
 #define UserMediaClientImpl_h
 
+#if ENABLE(MEDIA_STREAM)
+
 #include "MediaStreamSource.h"
 #include "UserMediaClient.h"
 #include <wtf/PassRefPtr.h>
@@ -61,4 +63,6 @@ private:
 
 } // namespace WebKit
 
+#endif // ENABLE(MEDIA_STREAM)
+
 #endif // UserMediaClientImpl_h
diff --git a/Source/WebKit/chromium/src/VideoFrameChromiumImpl.cpp b/Source/WebKit/chromium/src/VideoFrameChromiumImpl.cpp
index ce389adc6..fcce939f7 100644
--- a/Source/WebKit/chromium/src/VideoFrameChromiumImpl.cpp
+++ b/Source/WebKit/chromium/src/VideoFrameChromiumImpl.cpp
@@ -128,4 +128,11 @@ unsigned VideoFrameChromiumImpl::textureId() const
     return 0;
 }
 
+unsigned VideoFrameChromiumImpl::textureTarget() const
+{
+    if (m_webVideoFrame)
+        return m_webVideoFrame->textureTarget();
+    return 0;
+}
+
 } // namespace WebKit
diff --git a/Source/WebKit/chromium/src/VideoFrameChromiumImpl.h b/Source/WebKit/chromium/src/VideoFrameChromiumImpl.h
index 446ab5f54..67920866f 100644
--- a/Source/WebKit/chromium/src/VideoFrameChromiumImpl.h
+++ b/Source/WebKit/chromium/src/VideoFrameChromiumImpl.h
@@ -58,6 +58,7 @@ public:
     virtual const WebCore::IntSize requiredTextureSize(unsigned plane) const;
     virtual bool hasPaddingBytes(unsigned plane) const;
     virtual unsigned textureId() const;
+    virtual unsigned textureTarget() const;
 
 private:
     WebVideoFrame* m_webVideoFrame;
diff --git a/Source/WebKit/chromium/src/WebCompositorInputHandlerImpl.cpp b/Source/WebKit/chromium/src/WebCompositorInputHandlerImpl.cpp
index 40c151dfd..397308b52 100644
--- a/Source/WebKit/chromium/src/WebCompositorInputHandlerImpl.cpp
+++ b/Source/WebKit/chromium/src/WebCompositorInputHandlerImpl.cpp
@@ -121,9 +121,9 @@ void WebCompositorInputHandlerImpl::handleInputEvent(const WebInputEvent& event)
     ASSERT(CCProxy::isImplThread());
     ASSERT(m_client);
 
-    if (event.type == WebInputEvent::MouseWheel && !m_inputHandlerClient->haveWheelEventHandlers()) {
+    if (event.type == WebInputEvent::MouseWheel) {
         const WebMouseWheelEvent& wheelEvent = *static_cast<const WebMouseWheelEvent*>(&event);
-        CCInputHandlerClient::ScrollStatus scrollStatus = m_inputHandlerClient->scrollBegin(IntPoint(wheelEvent.x, wheelEvent.y));
+        CCInputHandlerClient::ScrollStatus scrollStatus = m_inputHandlerClient->scrollBegin(IntPoint(wheelEvent.x, wheelEvent.y), CCInputHandlerClient::Wheel);
         switch (scrollStatus) {
         case CCInputHandlerClient::ScrollStarted:
             m_inputHandlerClient->scrollBy(IntSize(-wheelEvent.deltaX, -wheelEvent.deltaY));
@@ -143,7 +143,7 @@ void WebCompositorInputHandlerImpl::handleInputEvent(const WebInputEvent& event)
         m_expectScrollUpdateEnd = true;
 #endif
         const WebGestureEvent& gestureEvent = *static_cast<const WebGestureEvent*>(&event);
-        CCInputHandlerClient::ScrollStatus scrollStatus = m_inputHandlerClient->scrollBegin(IntPoint(gestureEvent.x, gestureEvent.y));
+        CCInputHandlerClient::ScrollStatus scrollStatus = m_inputHandlerClient->scrollBegin(IntPoint(gestureEvent.x, gestureEvent.y), CCInputHandlerClient::Gesture);
         switch (scrollStatus) {
         case CCInputHandlerClient::ScrollStarted:
             m_scrollStarted = true;
diff --git a/Source/WebKit/chromium/src/WebDatabase.cpp b/Source/WebKit/chromium/src/WebDatabase.cpp
index 9545a07e0..9ea6ee9b5 100644
--- a/Source/WebKit/chromium/src/WebDatabase.cpp
+++ b/Source/WebKit/chromium/src/WebDatabase.cpp
@@ -122,10 +122,7 @@ void WebDatabase::resetSpaceAvailable(const WebString& originIdentifier)
 void WebDatabase::closeDatabaseImmediately(const WebString& originIdentifier, const WebString& databaseName)
 {
 #if ENABLE(SQL_DATABASE)
-    HashSet<RefPtr<AbstractDatabase> > databaseHandles;
-    DatabaseTracker::tracker().getOpenDatabases(originIdentifier, databaseName, &databaseHandles);
-    for (HashSet<RefPtr<AbstractDatabase> >::iterator it = databaseHandles.begin(); it != databaseHandles.end(); ++it)
-        it->get()->closeImmediately();
+    DatabaseTracker::tracker().closeDatabasesImmediately(originIdentifier, databaseName);
 #endif
 }
 
diff --git a/Source/WebKit/chromium/src/WebDevToolsFrontendImpl.cpp b/Source/WebKit/chromium/src/WebDevToolsFrontendImpl.cpp
index dc126f0f5..054e5b245 100644
--- a/Source/WebKit/chromium/src/WebDevToolsFrontendImpl.cpp
+++ b/Source/WebKit/chromium/src/WebDevToolsFrontendImpl.cpp
@@ -31,7 +31,6 @@
 #include "config.h"
 #include "WebDevToolsFrontendImpl.h"
 
-#include "BoundObject.h"
 #include "ContextMenuController.h"
 #include "ContextMenuItem.h"
 #include "DOMWindow.h"
diff --git a/Source/WebKit/chromium/src/WebDragData.cpp b/Source/WebKit/chromium/src/WebDragData.cpp
index 5c3123918..9e634340e 100644
--- a/Source/WebKit/chromium/src/WebDragData.cpp
+++ b/Source/WebKit/chromium/src/WebDragData.cpp
@@ -66,166 +66,88 @@ void WebDragData::assign(const WebDragData& other)
     assign(p);
 }
 
-WebString WebDragData::url() const
-{
-    ASSERT(!isNull());
-    bool ignoredSuccess;
-    return m_private->getData(mimeTypeURL, ignoredSuccess);
-}
-
-void WebDragData::setURL(const WebURL& url)
-{
-    ensureMutable();
-    m_private->setData(mimeTypeURL, KURL(url).string());
-}
-
-WebString WebDragData::urlTitle() const
-{
-    ASSERT(!isNull());
-    return m_private->urlTitle();
-}
-
-void WebDragData::setURLTitle(const WebString& urlTitle)
-{
-    ensureMutable();
-    m_private->setUrlTitle(urlTitle);
-}
-
-WebString WebDragData::downloadMetadata() const
-{
-    ASSERT(!isNull());
-    bool ignoredSuccess;
-    return m_private->getData(mimeTypeDownloadURL, ignoredSuccess);
-}
-
-void WebDragData::setDownloadMetadata(const WebString& downloadMetadata)
-{
-    ensureMutable();
-    m_private->setData(mimeTypeDownloadURL, downloadMetadata);
-}
-
-WebString WebDragData::fileExtension() const
-{
-    ASSERT(!isNull());
-    return m_private->fileExtension();
-}
-
-void WebDragData::setFileExtension(const WebString& fileExtension)
-{
-    ensureMutable();
-    m_private->setFileExtension(fileExtension);
-}
-
-bool WebDragData::containsFilenames() const
-{
-    ASSERT(!isNull());
-    return m_private->containsFilenames();
-}
-
-void WebDragData::filenames(WebVector<WebString>& filenames) const
-{
-    ASSERT(!isNull());
-    filenames = m_private->filenames();
-}
-
-void WebDragData::setFilenames(const WebVector<WebString>& filenames)
-{
-    ensureMutable();
-    Vector<String> filenamesCopy;
-    filenamesCopy.append(filenames.data(), filenames.size());
-    m_private->setFilenames(filenamesCopy);
-}
-
-void WebDragData::appendToFilenames(const WebString& filename)
-{
-    ensureMutable();
-    Vector<String> filenames = m_private->filenames();
-    filenames.append(filename);
-    m_private->setFilenames(filenames);
-}
-
-WebString WebDragData::plainText() const
-{
-    ASSERT(!isNull());
-    bool ignoredSuccess;
-    return m_private->getData(mimeTypeTextPlain, ignoredSuccess);
-}
-
-void WebDragData::setPlainText(const WebString& plainText)
-{
-    ensureMutable();
-    m_private->setData(mimeTypeTextPlain, plainText);
-}
-
-WebString WebDragData::htmlText() const
-{
-    ASSERT(!isNull());
-    bool ignoredSuccess;
-    return m_private->getData(mimeTypeTextHTML, ignoredSuccess);
-}
-
-void WebDragData::setHTMLText(const WebString& htmlText)
-{
-    ensureMutable();
-    m_private->setData(mimeTypeTextHTML, htmlText);
-}
-
-WebURL WebDragData::htmlBaseURL() const
-{
-    ASSERT(!isNull());
-    return m_private->htmlBaseUrl();
-}
-
-void WebDragData::setHTMLBaseURL(const WebURL& htmlBaseURL)
-{
-    ensureMutable();
-    m_private->setHtmlBaseUrl(htmlBaseURL);
-}
-
-WebString WebDragData::fileContentFilename() const
-{
-    ASSERT(!isNull());
-    return m_private->fileContentFilename();
-}
-
-void WebDragData::setFileContentFilename(const WebString& filename)
-{
-    ensureMutable();
-    m_private->setFileContentFilename(filename);
+WebVector<WebDragData::Item> WebDragData::items() const
+{
+    Vector<Item> itemList;
+    RefPtr<DOMStringList> types = m_private->types();
+    if (types->contains(mimeTypeTextPlain)) {
+        Item item;
+        item.storageType = Item::StorageTypeString;
+        item.stringType = String(mimeTypeTextPlain);
+        bool ignored;
+        item.stringData = m_private->getData(mimeTypeTextPlain, ignored);
+        itemList.append(item);
+    }
+    if (types->contains(mimeTypeTextURIList)) {
+        Item item;
+        item.storageType = Item::StorageTypeString;
+        item.stringType = String(mimeTypeTextURIList);
+        bool ignored;
+        item.stringData = m_private->getData(mimeTypeURL, ignored);
+        item.title = m_private->urlTitle();
+        itemList.append(item);
+    }
+    if (types->contains(mimeTypeTextHTML)) {
+        Item item;
+        item.storageType = Item::StorageTypeString;
+        item.stringType = String(mimeTypeTextHTML);
+        bool ignored;
+        item.stringData = m_private->getData(mimeTypeTextHTML, ignored);
+        item.baseURL = m_private->htmlBaseUrl();
+        itemList.append(item);
+    }
+    if (types->contains(mimeTypeDownloadURL)) {
+        Item item;
+        item.storageType = Item::StorageTypeString;
+        item.stringType = String(mimeTypeDownloadURL);
+        bool ignored;
+        item.stringData = m_private->getData(mimeTypeDownloadURL, ignored);
+        itemList.append(item);
+    }
+    const HashMap<String, String>& customData = m_private->customData();
+    for (HashMap<String, String>::const_iterator it = customData.begin(); it != customData.end(); ++it) {
+        Item item;
+        item.storageType = Item::StorageTypeString;
+        item.stringType = it->first;
+        item.stringData = it->second;
+        itemList.append(item);
+    }
+    if (m_private->fileContent()) {
+        Item item;
+        item.storageType = Item::StorageTypeBinaryData;
+        item.binaryData = m_private->fileContent();
+        item.title = m_private->fileContentFilename();
+        itemList.append(item);
+    }
+    // We don't handle filenames here, since they are never used for dragging out.
+    return itemList;
 }
 
-WebData WebDragData::fileContent() const
+void WebDragData::setItems(const WebVector<Item>& itemList)
 {
-    ASSERT(!isNull());
-    return WebData(m_private->fileContent());
+    m_private->clearAll();
+    for (size_t i = 0; i < itemList.size(); ++i)
+        addItem(itemList[i]);
 }
 
-void WebDragData::setFileContent(const WebData& fileContent)
+void WebDragData::addItem(const Item& item)
 {
     ensureMutable();
-    m_private->setFileContent(fileContent);
-}
-
-WebVector<WebDragData::CustomData> WebDragData::customData() const
-{
-    ASSERT(!isNull());
-    WebVector<CustomData> customData(static_cast<size_t>(m_private->customData().size()));
-    HashMap<String, String>::const_iterator begin = m_private->customData().begin();
-    HashMap<String, String>::const_iterator end = m_private->customData().end();
-    size_t i = 0;
-    for (HashMap<String, String>::const_iterator it = begin; it != end; ++it) {
-        CustomData data = {it->first, it->second};
-        customData[i++] = data;
+    switch (item.storageType) {
+    case Item::StorageTypeString:
+        m_private->setData(item.stringType, item.stringData);
+        if (String(item.stringType) == mimeTypeTextURIList)
+            m_private->setUrlTitle(item.title);
+        else if (String(item.stringType) == mimeTypeTextHTML)
+            m_private->setHtmlBaseUrl(item.baseURL);
+        return;
+    case Item::StorageTypeFilename:
+        m_private->addFilename(item.filenameData);
+        return;
+    case Item::StorageTypeBinaryData:
+        // This should never happen when dragging in.
+        ASSERT_NOT_REACHED();
     }
-    return customData;
-}
-
-void WebDragData::setCustomData(const WebVector<WebDragData::CustomData>& customData)
-{
-    ensureMutable();
-    HashMap<String, String>& customDataMap = m_private->customData();
-    for (size_t i = 0; i < customData.size(); ++i)
-        customDataMap.set(customData[i].type, customData[i].data);
 }
 
 WebDragData::WebDragData(const WTF::PassRefPtr<WebCore::ChromiumDataObject>& data)
diff --git a/Source/WebKit/chromium/src/WebFrameImpl.cpp b/Source/WebKit/chromium/src/WebFrameImpl.cpp
index f8d2034fd..adf202371 100644
--- a/Source/WebKit/chromium/src/WebFrameImpl.cpp
+++ b/Source/WebKit/chromium/src/WebFrameImpl.cpp
@@ -123,8 +123,6 @@
 #include "ReplaceSelectionCommand.h"
 #include "ResourceHandle.h"
 #include "ResourceRequest.h"
-#include "SVGDocumentExtensions.h"
-#include "SVGSMILElement.h"
 #include "SchemeRegistry.h"
 #include "ScriptController.h"
 #include "ScriptSourceCode.h"
@@ -1303,7 +1301,7 @@ void WebFrameImpl::requestTextChecking(const WebElement& webElem)
 
     RefPtr<Range> rangeToCheck = rangeOfContents(const_cast<Element*>(webElem.constUnwrap<Element>()));
 
-    frame()->editor()->spellChecker()->requestCheckingFor(SpellCheckRequest::create(TextCheckingTypeSpelling | TextCheckingTypeGrammar, rangeToCheck, rangeToCheck));
+    frame()->editor()->spellChecker()->requestCheckingFor(SpellCheckRequest::create(TextCheckingTypeSpelling | TextCheckingTypeGrammar, TextCheckingProcessBatch, rangeToCheck, rangeToCheck));
 }
 
 bool WebFrameImpl::hasSelection() const
@@ -1946,26 +1944,6 @@ bool WebFrameImpl::selectionStartHasSpellingMarkerFor(int from, int length) cons
     return m_frame->editor()->selectionStartHasMarkerFor(DocumentMarker::Spelling, from, length);
 }
 
-bool WebFrameImpl::pauseSVGAnimation(const WebString& animationId, double time, const WebString& elementId)
-{
-#if !ENABLE(SVG)
-    return false;
-#else
-    if (!m_frame)
-        return false;
-
-    Document* document = m_frame->document();
-    if (!document || !document->svgExtensions())
-        return false;
-
-    Node* coreNode = document->getElementById(animationId);
-    if (!coreNode || !SVGSMILElement::isSMILElement(coreNode))
-        return false;
-
-    return document->accessSVGExtensions()->sampleAnimationAtTime(elementId, static_cast<SVGSMILElement*>(coreNode), time);
-#endif
-}
-
 WebString WebFrameImpl::layerTreeAsText(bool showDebugInfo) const
 {
     if (!m_frame)
diff --git a/Source/WebKit/chromium/src/WebFrameImpl.h b/Source/WebKit/chromium/src/WebFrameImpl.h
index de38d0dca..700f6ea40 100644
--- a/Source/WebKit/chromium/src/WebFrameImpl.h
+++ b/Source/WebKit/chromium/src/WebFrameImpl.h
@@ -214,9 +214,6 @@ public:
     virtual WebRect selectionBoundsRect() const;
 
     virtual bool selectionStartHasSpellingMarkerFor(int from, int length) const;
-    virtual bool pauseSVGAnimation(const WebString& animationId,
-                                   double time,
-                                   const WebString& elementId);
     virtual WebString layerTreeAsText(bool showDebugInfo = false) const;
 
     static PassRefPtr<WebFrameImpl> create(WebFrameClient* client);
diff --git a/Source/WebKit/chromium/src/WebIDBObjectStoreImpl.cpp b/Source/WebKit/chromium/src/WebIDBObjectStoreImpl.cpp
index 1ec8af5bc..55a6add57 100755
--- a/Source/WebKit/chromium/src/WebIDBObjectStoreImpl.cpp
+++ b/Source/WebKit/chromium/src/WebIDBObjectStoreImpl.cpp
@@ -82,6 +82,11 @@ void WebIDBObjectStoreImpl::deleteFunction(const WebIDBKey& key, WebIDBCallbacks
     m_objectStore->deleteFunction(key, IDBCallbacksProxy::create(adoptPtr(callbacks)), transaction.getIDBTransactionBackendInterface(), ec);
 }
 
+void WebIDBObjectStoreImpl::deleteFunction(const WebIDBKeyRange& keyRange, WebIDBCallbacks* callbacks, const WebIDBTransaction& transaction, WebExceptionCode& ec)
+{
+    m_objectStore->deleteFunction(keyRange, IDBCallbacksProxy::create(adoptPtr(callbacks)), transaction.getIDBTransactionBackendInterface(), ec);
+}
+
 void WebIDBObjectStoreImpl::clear(WebIDBCallbacks* callbacks, const WebIDBTransaction& transaction, WebExceptionCode& ec)
 {
     m_objectStore->clear(IDBCallbacksProxy::create(adoptPtr(callbacks)), transaction.getIDBTransactionBackendInterface(), ec);
diff --git a/Source/WebKit/chromium/src/WebIDBObjectStoreImpl.h b/Source/WebKit/chromium/src/WebIDBObjectStoreImpl.h
index 6f580f01a..d2202fc7f 100644
--- a/Source/WebKit/chromium/src/WebIDBObjectStoreImpl.h
+++ b/Source/WebKit/chromium/src/WebIDBObjectStoreImpl.h
@@ -51,7 +51,8 @@ public:
 
     void get(const WebIDBKey& key, WebIDBCallbacks*, const WebIDBTransaction&, WebExceptionCode&);
     void put(const WebSerializedScriptValue&, const WebIDBKey&, PutMode, WebIDBCallbacks*, const WebIDBTransaction&, WebExceptionCode&);
-    void deleteFunction(const WebIDBKey& key, WebIDBCallbacks*, const WebIDBTransaction&, WebExceptionCode&);
+    void deleteFunction(const WebIDBKey&, WebIDBCallbacks*, const WebIDBTransaction&, WebExceptionCode&);
+    void deleteFunction(const WebIDBKeyRange&, WebIDBCallbacks*, const WebIDBTransaction&, WebExceptionCode&);
     void clear(WebIDBCallbacks*, const WebIDBTransaction&, WebExceptionCode&);
 
     // FIXME: Remove once callers are updated.
diff --git a/Source/WebKit/chromium/src/WebInputElement.cpp b/Source/WebKit/chromium/src/WebInputElement.cpp
index 5dadb0cf8..736165bbf 100644
--- a/Source/WebKit/chromium/src/WebInputElement.cpp
+++ b/Source/WebKit/chromium/src/WebInputElement.cpp
@@ -90,7 +90,7 @@ int WebInputElement::size() const
 
 void WebInputElement::setValue(const WebString& value, bool sendChangeEvent)
 {
-    unwrap<HTMLInputElement>()->setValue(value, sendChangeEvent);
+    unwrap<HTMLInputElement>()->setValue(value, sendChangeEvent ? DispatchChangeEvent : DispatchNoEvent);
 }
 
 WebString WebInputElement::value() const
diff --git a/Source/WebKit/chromium/src/WebInputEventConversion.cpp b/Source/WebKit/chromium/src/WebInputEventConversion.cpp
index 64ba31170..5cf0ccaec 100644
--- a/Source/WebKit/chromium/src/WebInputEventConversion.cpp
+++ b/Source/WebKit/chromium/src/WebInputEventConversion.cpp
@@ -389,6 +389,10 @@ WebMouseEventBuilder::WebMouseEventBuilder(const Widget* widget, const MouseEven
     windowY = p.y();
     x = event.absoluteLocation().x() - widget->location().x();
     y = event.absoluteLocation().y() - widget->location().y();
+#if ENABLE(POINTER_LOCK)
+    movementX = event.webkitMovementX();
+    movementY = event.webkitMovementY();
+#endif
     clickCount = event.detail();
 }
 
diff --git a/Source/WebKit/chromium/src/WebKit.cpp b/Source/WebKit/chromium/src/WebKit.cpp
index 2b2b2597c..77858c4e7 100644
--- a/Source/WebKit/chromium/src/WebKit.cpp
+++ b/Source/WebKit/chromium/src/WebKit.cpp
@@ -45,6 +45,10 @@
 #include "WorkerContextExecutionProxy.h"
 #include "v8.h"
 
+#if OS(DARWIN)
+#include "WebSystemInterface.h"
+#endif
+
 #include <wtf/Assertions.h>
 #include <wtf/MainThread.h>
 #include <wtf/Threading.h>
@@ -107,6 +111,10 @@ void initializeWithoutV8(WebKitPlatformSupport* webKitPlatformSupport)
     ASSERT(!s_webKitInitialized);
     s_webKitInitialized = true;
 
+#if OS(DARWIN)
+    InitWebCoreSystemInterface();
+#endif
+
     ASSERT(webKitPlatformSupport);
     ASSERT(!s_webKitPlatformSupport);
     s_webKitPlatformSupport = webKitPlatformSupport;
diff --git a/Source/WebKit/chromium/src/WebLayerTreeView.cpp b/Source/WebKit/chromium/src/WebLayerTreeView.cpp
index b288b563b..d2c0f0c12 100644
--- a/Source/WebKit/chromium/src/WebLayerTreeView.cpp
+++ b/Source/WebKit/chromium/src/WebLayerTreeView.cpp
@@ -43,11 +43,11 @@ WebLayerTreeView::Settings::operator CCSettings() const
     settings.showFPSCounter = showFPSCounter;
     settings.showPlatformLayerTree = showPlatformLayerTree;
     settings.refreshRate = refreshRate;
+    settings.perTilePainting = perTilePainting;
     settings.partialSwapEnabled = partialSwapEnabled;
+    settings.threadedAnimationEnabled = threadedAnimationEnabled;
 
-    // FIXME: showFPSCounter / showPlatformLayerTree aren't supported currently.
-    settings.showFPSCounter = false;
-    settings.showPlatformLayerTree = false;
+    // FIXME: showFPSCounter / showPlatformLayerTree / maxPartialTextureUpdates aren't supported currently.
     return settings;
 }
 
@@ -118,4 +118,9 @@ WebLayerTreeView::operator PassRefPtr<CCLayerTreeHost>() const
     return m_private.get();
 }
 
+void WebLayerTreeView::setNeedsRedraw()
+{
+    m_private->setNeedsRedraw();
+}
+
 } // namespace WebKit
diff --git a/Source/WebKit/chromium/src/WebLayerTreeViewImpl.cpp b/Source/WebKit/chromium/src/WebLayerTreeViewImpl.cpp
index 981477118..29d033215 100644
--- a/Source/WebKit/chromium/src/WebLayerTreeViewImpl.cpp
+++ b/Source/WebKit/chromium/src/WebLayerTreeViewImpl.cpp
@@ -86,21 +86,7 @@ PassRefPtr<GraphicsContext3D> WebLayerTreeViewImpl::createLayerTreeHostContext3D
     if (!webContext)
         return 0;
 
-    WebGraphicsContext3D::Attributes webAttributes = webContext->getContextAttributes();
-    GraphicsContext3D::Attributes attributes;
-    attributes.alpha = webAttributes.alpha;
-    attributes.depth = webAttributes.depth;
-    attributes.stencil = webAttributes.stencil;
-    attributes.antialias = webAttributes.antialias;
-    attributes.premultipliedAlpha = webAttributes.premultipliedAlpha;
-    attributes.canRecoverFromContextLoss = webAttributes.canRecoverFromContextLoss;
-    attributes.noExtensions = webAttributes.noExtensions;
-    attributes.shareResources = webAttributes.shareResources;
-    attributes.preserveDrawingBuffer = false;
-
-    GraphicsContext3D::RenderStyle style = GraphicsContext3D::RenderDirectlyToHostWindow;
-    GraphicsContext3DPrivate::ThreadUsage usage = CCProxy::hasImplThread() ? GraphicsContext3DPrivate::ForUseOnAnotherThread : GraphicsContext3DPrivate::ForUseOnThisThread;
-    return GraphicsContext3DPrivate::createGraphicsContextFromWebContext(webContext.release(), attributes, 0, style, usage);
+    return GraphicsContext3DPrivate::createGraphicsContextFromWebContext(webContext.release(), GraphicsContext3D::RenderDirectlyToHostWindow, false /* preserveDrawingBuffer */ );
 }
 
 void WebLayerTreeViewImpl::didCommitAndDrawFrame()
diff --git a/Source/WebKit/chromium/src/WebMediaPlayerClientImpl.cpp b/Source/WebKit/chromium/src/WebMediaPlayerClientImpl.cpp
index 996e70710..ec74b6bea 100644
--- a/Source/WebKit/chromium/src/WebMediaPlayerClientImpl.cpp
+++ b/Source/WebKit/chromium/src/WebMediaPlayerClientImpl.cpp
@@ -28,6 +28,7 @@
 #include "WebMediaElement.h"
 #include "WebMediaPlayer.h"
 #include "WebViewImpl.h"
+#include "cc/CCProxy.h"
 #include "platform/WebCString.h"
 #include "platform/WebCanvas.h"
 #include "platform/WebKitPlatformSupport.h"
@@ -105,6 +106,8 @@ WebMediaPlayerClientImpl::~WebMediaPlayerClientImpl()
     MutexLocker locker(m_compositingMutex);
     if (m_videoFrameProviderClient)
         m_videoFrameProviderClient->stopUsingProvider();
+    if (m_webMediaPlayer)
+        m_webMediaPlayer->setStreamTextureClient(0);
 #endif
 }
 
@@ -149,7 +152,7 @@ void WebMediaPlayerClientImpl::repaint()
     ASSERT(m_mediaPlayer);
 #if USE(ACCELERATED_COMPOSITING)
     if (m_videoLayer && supportsAcceleratedRendering())
-        m_videoLayer->setNeedsDisplay();
+        m_videoLayer->contentChanged();
 #endif
     m_mediaPlayer->repaint();
 }
@@ -237,6 +240,7 @@ void WebMediaPlayerClientImpl::load(const String& url)
     m_url = url;
 
     if (m_preload == MediaPlayer::None) {
+        MutexLocker locker(m_compositingMutex);
 #if ENABLE(WEB_AUDIO)
         m_audioSourceProvider.wrap(0); // Clear weak reference to m_webMediaPlayer's WebAudioSourceProvider.
 #endif
@@ -248,6 +252,7 @@ void WebMediaPlayerClientImpl::load(const String& url)
 
 void WebMediaPlayerClientImpl::loadInternal()
 {
+    MutexLocker locker(m_compositingMutex);
 #if ENABLE(WEB_AUDIO)
     m_audioSourceProvider.wrap(0); // Clear weak reference to m_webMediaPlayer's WebAudioSourceProvider.
 #endif
@@ -597,6 +602,8 @@ void WebMediaPlayerClientImpl::setVideoFrameProviderClient(VideoFrameProvider::C
 {
     MutexLocker locker(m_compositingMutex);
     m_videoFrameProviderClient = client;
+    if (m_webMediaPlayer)
+        m_webMediaPlayer->setStreamTextureClient(client ? this : 0);
 }
 
 VideoFrameChromium* WebMediaPlayerClientImpl::getCurrentFrame()
@@ -679,6 +686,20 @@ void WebMediaPlayerClientImpl::startDelayedLoad()
     loadInternal();
 }
 
+void WebMediaPlayerClientImpl::didReceiveFrame()
+{
+    // No lock since this gets called on the client's thread.
+    ASSERT(CCProxy::isImplThread());
+    m_videoFrameProviderClient->didReceiveFrame();
+}
+
+void WebMediaPlayerClientImpl::didUpdateMatrix(const float* matrix)
+{
+    // No lock since this gets called on the client's thread.
+    ASSERT(CCProxy::isImplThread());
+    m_videoFrameProviderClient->didUpdateMatrix(matrix);
+}
+
 WebMediaPlayerClientImpl::WebMediaPlayerClientImpl()
     : m_mediaPlayer(0)
     , m_delayingLoad(false)
diff --git a/Source/WebKit/chromium/src/WebMediaPlayerClientImpl.h b/Source/WebKit/chromium/src/WebMediaPlayerClientImpl.h
index e75e73ae1..d85e0d1fc 100644
--- a/Source/WebKit/chromium/src/WebMediaPlayerClientImpl.h
+++ b/Source/WebKit/chromium/src/WebMediaPlayerClientImpl.h
@@ -40,7 +40,9 @@
 #include "VideoLayerChromium.h"
 #include "WebAudioSourceProviderClient.h"
 #include "WebMediaPlayerClient.h"
+#include "WebStreamTextureClient.h"
 #include <wtf/OwnPtr.h>
+#include <wtf/PassOwnPtr.h>
 
 namespace WebCore { class AudioSourceProviderClient; }
 
@@ -56,7 +58,8 @@ class WebMediaPlayerClientImpl : public WebCore::MediaPlayerPrivateInterface
 #if USE(ACCELERATED_COMPOSITING)
                                , public WebCore::VideoFrameProvider
 #endif
-                               , public WebMediaPlayerClient {
+                               , public WebMediaPlayerClient
+                               , public WebStreamTextureClient {
 
 public:
     static bool isEnabled();
@@ -150,6 +153,10 @@ public:
     virtual void sourceEndOfStream(WebCore::MediaPlayer::EndOfStreamStatus);
 #endif
 
+    // WebStreamTextureClient methods:
+    virtual void didReceiveFrame();
+    virtual void didUpdateMatrix(const float*);
+
 private:
     WebMediaPlayerClientImpl();
     void startDelayedLoad();
diff --git a/Source/WebKit/chromium/src/WebPageSerializerImpl.cpp b/Source/WebKit/chromium/src/WebPageSerializerImpl.cpp
index ca0583488..072a9909c 100644
--- a/Source/WebKit/chromium/src/WebPageSerializerImpl.cpp
+++ b/Source/WebKit/chromium/src/WebPageSerializerImpl.cpp
@@ -417,7 +417,6 @@ void WebPageSerializerImpl::buildContentForNode(Node* node,
     case Node::ATTRIBUTE_NODE:
     case Node::DOCUMENT_NODE:
     case Node::DOCUMENT_FRAGMENT_NODE:
-    case Node::SHADOW_ROOT_NODE:
         // Should not exist.
         ASSERT_NOT_REACHED();
         break;
diff --git a/Source/WebKit/chromium/src/WebPluginContainerImpl.cpp b/Source/WebKit/chromium/src/WebPluginContainerImpl.cpp
index 129088ef4..10c3e2e4b 100644
--- a/Source/WebKit/chromium/src/WebPluginContainerImpl.cpp
+++ b/Source/WebKit/chromium/src/WebPluginContainerImpl.cpp
@@ -60,6 +60,7 @@
 #include "FrameLoadRequest.h"
 #include "FrameView.h"
 #include "GraphicsContext.h"
+#include "HitTestResult.h"
 #include "HostWindow.h"
 #include "HTMLFormElement.h"
 #include "HTMLNames.h"
@@ -433,6 +434,26 @@ void WebPluginContainerImpl::zoomLevelChanged(double zoomLevel)
     WebViewImpl* view = WebViewImpl::fromPage(m_element->document()->frame()->page());
     view->fullFramePluginZoomLevelChanged(zoomLevel);
 }
+ 
+bool WebPluginContainerImpl::isRectTopmost(const WebRect& rect)
+{
+    Page* page = m_element->document()->page();
+    if (!page)
+        return false;
+
+    // hitTestResultAtPoint() takes a padding rectangle.
+    // FIXME: We'll be off by 1 when the width or height is even.
+    IntRect windowRect = convertToContainingWindow(static_cast<IntRect>(rect));
+    LayoutPoint center = windowRect.center();
+    // Make the rect we're checking (the point surrounded by padding rects) contained inside the requested rect. (Note that -1/2 is 0.)
+    LayoutSize padding((windowRect.width() - 1) / 2, (windowRect.height() - 1) / 2);
+    HitTestResult result =
+        page->mainFrame()->eventHandler()->hitTestResultAtPoint(center, false, false, DontHitTestScrollbars, HitTestRequest::ReadOnly | HitTestRequest::Active, padding);
+    const HitTestResult::NodeSet& nodes = result.rectBasedTestResult();
+    if (nodes.size() != 1)
+        return false;
+    return (nodes.first().get() == m_element);
+}
 
 void WebPluginContainerImpl::didReceiveResponse(const ResourceResponse& response)
 {
@@ -519,17 +540,6 @@ bool WebPluginContainerImpl::paintCustomOverhangArea(GraphicsContext* context, c
     return true;
 }
 
-#if ENABLE(GESTURE_EVENTS)
-bool WebPluginContainerImpl::handleGestureEvent(const WebCore::PlatformGestureEvent& gestureEvent)
-{
-    if (m_scrollbarGroup) {
-        m_scrollbarGroup->handleGestureEvent(gestureEvent);
-        return true;
-    }
-    return false;
-}
-#endif
-
 // Private methods -------------------------------------------------------------
 
 WebPluginContainerImpl::WebPluginContainerImpl(WebCore::HTMLPlugInElement* element, WebPlugin* webPlugin)
diff --git a/Source/WebKit/chromium/src/WebPluginContainerImpl.h b/Source/WebKit/chromium/src/WebPluginContainerImpl.h
index 8d6794d6f..898130084 100644
--- a/Source/WebKit/chromium/src/WebPluginContainerImpl.h
+++ b/Source/WebKit/chromium/src/WebPluginContainerImpl.h
@@ -104,6 +104,7 @@ public:
     virtual WebString executeScriptURL(const WebURL&, bool popupsAllowed);
     virtual void loadFrameRequest(const WebURLRequest&, const WebString& target, bool notifyNeeded, void* notifyData);
     virtual void zoomLevelChanged(double zoomLevel);    
+    virtual bool isRectTopmost(const WebRect&);
 
     // This cannot be null.
     WebPlugin* plugin() { return m_webPlugin; }
@@ -150,10 +151,6 @@ public:
 
     bool paintCustomOverhangArea(WebCore::GraphicsContext*, const WebCore::IntRect&, const WebCore::IntRect&, const WebCore::IntRect&);
 
-#if ENABLE(GESTURE_EVENTS)
-    bool handleGestureEvent(const WebCore::PlatformGestureEvent&);
-#endif
-
 private:
     WebPluginContainerImpl(WebCore::HTMLPlugInElement* element, WebPlugin* webPlugin);
     ~WebPluginContainerImpl();
diff --git a/Source/WebKit/chromium/src/WebRuntimeFeatures.cpp b/Source/WebKit/chromium/src/WebRuntimeFeatures.cpp
index 38963b521..f1960eb31 100644
--- a/Source/WebKit/chromium/src/WebRuntimeFeatures.cpp
+++ b/Source/WebKit/chromium/src/WebRuntimeFeatures.cpp
@@ -450,5 +450,23 @@ bool WebRuntimeFeatures::isShadowDOMEnabled()
 #endif
 }
 
+void WebRuntimeFeatures::enableStyleScoped(bool enable)
+{
+#if ENABLE(STYLE_SCOPED)
+    RuntimeEnabledFeatures::setStyleScopedEnabled(enable);
+#else
+    UNUSED_PARAM(enable);
+#endif
+}
+
+bool WebRuntimeFeatures::isStyleScopedEnabled()
+{
+#if ENABLE(STYLE_SCOPED)
+    return RuntimeEnabledFeatures::styleScopedEnabled();
+#else
+    return false;
+#endif
+}
+
 
 } // namespace WebKit
diff --git a/Source/WebKit/chromium/src/WebScopedUserGesture.cpp b/Source/WebKit/chromium/src/WebScopedUserGesture.cpp
new file mode 100644
index 000000000..68426fcae
--- /dev/null
+++ b/Source/WebKit/chromium/src/WebScopedUserGesture.cpp
@@ -0,0 +1,48 @@
+/*
+ * Copyright (C) 2011 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "WebScopedUserGesture.h"
+
+#include "UserGestureIndicator.h"
+
+namespace WebKit {
+
+void WebScopedUserGesture::initialize()
+{
+    m_indicator.reset(new WebCore::UserGestureIndicator(WebCore::DefinitelyProcessingUserGesture));
+}
+
+void WebScopedUserGesture::reset()
+{
+    m_indicator.reset(0);
+}
+
+} // namespace WebKit
diff --git a/Source/WebKit/chromium/src/WebSettingsImpl.cpp b/Source/WebKit/chromium/src/WebSettingsImpl.cpp
index 11e9c337b..485a5b051 100644
--- a/Source/WebKit/chromium/src/WebSettingsImpl.cpp
+++ b/Source/WebKit/chromium/src/WebSettingsImpl.cpp
@@ -288,6 +288,11 @@ void WebSettingsImpl::setExperimentalWebGLEnabled(bool enabled)
     m_settings->setWebGLEnabled(enabled);
 }
 
+void WebSettingsImpl::setExperimentalCSSRegionsEnabled(bool enabled)
+{
+    m_settings->setCSSRegionsEnabled(enabled);
+}
+
 void WebSettingsImpl::setOpenGLMultisamplingEnabled(bool enabled)
 {
     m_settings->setOpenGLMultisamplingEnabled(enabled);
@@ -326,6 +331,7 @@ void WebSettingsImpl::setEditingBehavior(EditingBehavior behavior)
 void WebSettingsImpl::setAcceleratedCompositingEnabled(bool enabled)
 {
     m_settings->setAcceleratedCompositingEnabled(enabled);
+    m_settings->setScrollingCoordinatorEnabled(enabled);
 }
 
 void WebSettingsImpl::setForceCompositingMode(bool enabled)
@@ -457,6 +463,16 @@ void WebSettingsImpl::setAllowRunningOfInsecureContent(bool enabled)
     m_settings->setAllowRunningOfInsecureContent(enabled);
 }
 
+void WebSettingsImpl::setPasswordEchoEnabled(bool flag)
+{
+    m_settings->setPasswordEchoEnabled(flag);
+}
+
+void WebSettingsImpl::setPasswordEchoDurationInSeconds(double durationInSeconds)
+{
+    m_settings->setPasswordEchoDurationInSeconds(durationInSeconds);
+}
+
 void WebSettingsImpl::setShouldPrintBackgrounds(bool enabled)
 {
     m_settings->setShouldPrintBackgrounds(enabled);
@@ -527,4 +543,9 @@ void WebSettingsImpl::setPartialSwapEnabled(bool enabled)
     m_settings->setPartialSwapEnabled(enabled);
 }
 
+void WebSettingsImpl::setThreadedAnimationEnabled(bool enabled)
+{
+    m_settings->setThreadedAnimationEnabled(enabled);
+}
+
 } // namespace WebKit
diff --git a/Source/WebKit/chromium/src/WebSettingsImpl.h b/Source/WebKit/chromium/src/WebSettingsImpl.h
index 45e62db6f..51d9323a4 100644
--- a/Source/WebKit/chromium/src/WebSettingsImpl.h
+++ b/Source/WebKit/chromium/src/WebSettingsImpl.h
@@ -88,6 +88,7 @@ public:
     virtual void setOfflineWebApplicationCacheEnabled(bool);
     virtual void setWebAudioEnabled(bool);
     virtual void setExperimentalWebGLEnabled(bool);
+    virtual void setExperimentalCSSRegionsEnabled(bool);
     virtual void setOpenGLMultisamplingEnabled(bool);
     virtual void setPrivilegedWebGLExtensionsEnabled(bool);
     virtual void setWebGLErrorsToConsoleEnabled(bool);
@@ -124,6 +125,8 @@ public:
     virtual void setFullScreenEnabled(bool);
     virtual void setAllowDisplayOfInsecureContent(bool);
     virtual void setAllowRunningOfInsecureContent(bool);
+    virtual void setPasswordEchoEnabled(bool);
+    virtual void setPasswordEchoDurationInSeconds(double);
     virtual void setShouldPrintBackgrounds(bool);
     virtual void setEnableScrollAnimator(bool);
     virtual void setHixie76WebSocketProtocolEnabled(bool);
@@ -134,6 +137,7 @@ public:
     virtual void setAcceleratedPaintingEnabled(bool);
     virtual void setPerTilePaintingEnabled(bool);
     virtual void setPartialSwapEnabled(bool);
+    virtual void setThreadedAnimationEnabled(bool);
 
 private:
     WebCore::Settings* m_settings;
diff --git a/Source/WebKit/chromium/src/WebSharedWorkerImpl.cpp b/Source/WebKit/chromium/src/WebSharedWorkerImpl.cpp
index 7a4bddb22..3fa19d25d 100644
--- a/Source/WebKit/chromium/src/WebSharedWorkerImpl.cpp
+++ b/Source/WebKit/chromium/src/WebSharedWorkerImpl.cpp
@@ -443,6 +443,7 @@ static void dispatchOnInspectorBackendTask(ScriptExecutionContext* context, cons
 void WebSharedWorkerImpl::dispatchDevToolsMessage(const WebString& message)
 {
     workerThread()->runLoop().postTaskForMode(createCallbackTask(dispatchOnInspectorBackendTask, String(message)), WorkerDebuggerAgent::debuggerTaskMode);
+    WorkerDebuggerAgent::interruptAndDispatchInspectorCommands(workerThread());
 }
 
 WebSharedWorker* WebSharedWorker::create(WebSharedWorkerClient* client)
diff --git a/Source/WebKit/chromium/src/WebURLResponse.cpp b/Source/WebKit/chromium/src/WebURLResponse.cpp
index 2eacda580..ec212e517 100644
--- a/Source/WebKit/chromium/src/WebURLResponse.cpp
+++ b/Source/WebKit/chromium/src/WebURLResponse.cpp
@@ -47,6 +47,27 @@ using namespace WebCore;
 
 namespace WebKit {
 
+namespace {
+
+class ExtraDataContainer : public ResourceResponse::ExtraData {
+public:
+    static PassRefPtr<ExtraDataContainer> create(WebURLResponse::ExtraData* extraData) { return adoptRef(new ExtraDataContainer(extraData)); }
+
+    virtual ~ExtraDataContainer() { }
+
+    WebURLResponse::ExtraData* extraData() const { return m_extraData.get(); }
+
+private:
+    explicit ExtraDataContainer(WebURLResponse::ExtraData* extraData)
+        : m_extraData(adoptPtr(extraData))
+    {
+    }
+
+    OwnPtr<WebURLResponse::ExtraData> m_extraData;
+};
+
+} // namespace
+
 // The standard implementation of WebURLResponsePrivate, which maintains
 // ownership of a ResourceResponse instance.
 class WebURLResponsePrivateImpl : public WebURLResponsePrivate {
@@ -399,6 +420,19 @@ void WebURLResponse::setRemotePort(unsigned short remotePort)
     m_private->m_resourceResponse->setRemotePort(remotePort);
 }
 
+WebURLResponse::ExtraData* WebURLResponse::extraData() const
+{
+    RefPtr<ResourceResponse::ExtraData> data = m_private->m_resourceResponse->extraData();
+    if (!data)
+        return 0;
+    return static_cast<ExtraDataContainer*>(data.get())->extraData();
+}
+
+void WebURLResponse::setExtraData(WebURLResponse::ExtraData* extraData)
+{
+    m_private->m_resourceResponse->setExtraData(ExtraDataContainer::create(extraData));
+}
+
 void WebURLResponse::assign(WebURLResponsePrivate* p)
 {
     // Subclasses may call this directly so a self-assignment check is needed
diff --git a/Source/WebKit/chromium/src/WebViewImpl.cpp b/Source/WebKit/chromium/src/WebViewImpl.cpp
index a05e98920..55a2052a4 100644
--- a/Source/WebKit/chromium/src/WebViewImpl.cpp
+++ b/Source/WebKit/chromium/src/WebViewImpl.cpp
@@ -99,7 +99,6 @@
 #include "RenderWidget.h"
 #include "ResourceHandle.h"
 #include "SchemeRegistry.h"
-#include "ScrollAnimator.h"
 #include "SecurityOrigin.h"
 #include "SecurityPolicy.h"
 #include "Settings.h"
@@ -171,7 +170,7 @@ using namespace std;
 
 namespace {
 
-GraphicsContext3D::Attributes getCompositorContextAttributes()
+WebKit::WebGraphicsContext3D::Attributes getCompositorContextAttributes(bool threaded)
 {
     // Explicitly disable antialiasing for the compositor. As of the time of
     // this writing, the only platform that supported antialiasing for the
@@ -183,12 +182,21 @@ GraphicsContext3D::Attributes getCompositorContextAttributes()
     // be optimized to resolve directly into the IOSurface shared between the
     // GPU and browser processes. For these reasons and to avoid platform
     // disparities we explicitly disable antialiasing.
-    GraphicsContext3D::Attributes attributes;
+    WebKit::WebGraphicsContext3D::Attributes attributes;
     attributes.antialias = false;
     attributes.shareResources = true;
+    attributes.forUseOnAnotherThread = threaded;
     return attributes;
 }
 
+// The following constants control parameters for automated scaling of webpages
+// (such as due to a double tap gesture or find in page etc.). These are
+// experimentally determined.
+static const int touchPointPadding = 32;
+static const float minScaleDifference = 0.01;
+static const float doubleTapZoomContentDefaultMargin = 5;
+static const float doubleTapZoomContentMinimumMargin = 2;
+
 } // anonymous namespace
 
 namespace WebKit {
@@ -390,21 +398,21 @@ WebViewImpl::WebViewImpl(WebViewClient* client)
     pageClients.editorClient = &m_editorClientImpl;
     pageClients.dragClient = &m_dragClientImpl;
     pageClients.inspectorClient = &m_inspectorClientImpl;
-#if ENABLE(INPUT_SPEECH)
-    pageClients.speechInputClient = m_speechInputClient.get();
-#endif
-    pageClients.deviceOrientationClient = m_deviceOrientationClientProxy.get();
     pageClients.geolocationClient = m_geolocationClientProxy.get();
-#if ENABLE(NOTIFICATIONS)
-    pageClients.notificationClient = notificationPresenterImpl();
-#endif
     pageClients.backForwardClient = BackForwardListChromium::create(this);
-#if ENABLE(MEDIA_STREAM)
-    pageClients.userMediaClient = &m_userMediaClientImpl;
-#endif
 
     m_page = adoptPtr(new Page(pageClients));
+#if ENABLE(MEDIA_STREAM)
+    provideUserMediaTo(m_page.get(), &m_userMediaClientImpl);
+#endif
+#if ENABLE(INPUT_SPEECH)
+    provideSpeechInputTo(m_page.get(), m_speechInputClient.get());
+#endif
+#if ENABLE(NOTIFICATIONS)
+    provideNotification(m_page.get(), notificationPresenterImpl());
+#endif
 
+    provideDeviceOrientationTo(m_page.get(), m_deviceOrientationClientProxy.get());
     m_geolocationClientProxy->setController(m_page->geolocationController());
 
     m_page->setGroupName(pageGroupName);
@@ -614,14 +622,13 @@ bool WebViewImpl::mouseWheel(const WebMouseWheelEvent& event)
 bool WebViewImpl::gestureEvent(const WebGestureEvent& event)
 {
     PlatformGestureEventBuilder platformEvent(mainFrameImpl()->frameView(), event);
-    bool handled = mainFrameImpl()->frame()->eventHandler()->handleGestureEvent(platformEvent);
-
-    Frame* frame = mainFrameImpl()->frame();
-    WebPluginContainerImpl* pluginContainer = WebFrameImpl::pluginContainerFromFrame(frame);
-    if (pluginContainer)
-        handled |= pluginContainer->handleGestureEvent(platformEvent);
+    return mainFrameImpl()->frame()->eventHandler()->handleGestureEvent(platformEvent);
+}
 
-    return handled;
+void WebViewImpl::startPageScaleAnimation(const IntPoint& scroll, bool useAnchor, float newScale, double durationSec)
+{
+    if (m_layerTreeHost)
+        m_layerTreeHost->startPageScaleAnimation(IntSize(scroll.x(), scroll.y()), useAnchor, newScale, durationSec);
 }
 #endif
 
@@ -797,15 +804,159 @@ bool WebViewImpl::touchEvent(const WebTouchEvent& event)
 }
 #endif
 
+#if ENABLE(GESTURE_EVENTS)
+WebRect WebViewImpl::computeBlockBounds(const WebRect& rect, AutoZoomType zoomType)
+{
+    if (!mainFrameImpl())
+        return WebRect();
+
+    // Use the rect-based hit test to find the node.
+    IntPoint point = mainFrameImpl()->frameView()->windowToContents(IntPoint(rect.x, rect.y));
+    HitTestResult result = mainFrameImpl()->frame()->eventHandler()->hitTestResultAtPoint(point,
+            false, zoomType == FindInPage, DontHitTestScrollbars, HitTestRequest::Active | HitTestRequest::ReadOnly,
+            IntSize(rect.width, rect.height));
+
+    Node* node = result.innerNonSharedNode();
+    if (!node)
+        return WebRect();
+
+    // Find the block type node based on the hit node.
+    while (node && (!node->renderer() || node->renderer()->isInline()))
+        node = node->parentNode();
+
+    // Return the bounding box in the window coordinate system.
+    if (node) {
+        IntRect rect = node->Node::getRect();
+        Frame* frame = node->document()->frame();
+        return frame->view()->contentsToWindow(rect);
+    }
+    return WebRect();
+}
+
+WebRect WebViewImpl::widenRectWithinPageBounds(const WebRect& source, int targetMargin, int minimumMargin)
+{
+    WebSize maxSize;
+    if (mainFrame())
+        maxSize = mainFrame()->contentsSize();
+    IntSize scrollOffset;
+    if (mainFrame())
+        scrollOffset = mainFrame()->scrollOffset();
+    int leftMargin = targetMargin;
+    int rightMargin = targetMargin;
+
+    const int absoluteSourceX = source.x + scrollOffset.width();
+    if (leftMargin > absoluteSourceX) {
+        leftMargin = absoluteSourceX;
+        rightMargin = max(leftMargin, minimumMargin);
+    }
+
+    const int maximumRightMargin = maxSize.width - (source.width + absoluteSourceX);
+    if (rightMargin > maximumRightMargin) {
+        rightMargin = maximumRightMargin;
+        leftMargin = min(leftMargin, max(rightMargin, minimumMargin));
+    }
+
+    const int newWidth = source.width + leftMargin + rightMargin;
+    const int newX = source.x - leftMargin;
+
+    ASSERT(newWidth >= 0);
+    ASSERT(scrollOffset.width() + newX + newWidth <= maxSize.width);
+
+    return WebRect(newX, source.y, newWidth, source.height);
+}
+
+void WebViewImpl::computeScaleAndScrollForHitRect(const WebRect& hitRect, AutoZoomType zoomType, float& scale, WebPoint& scroll)
+{
+    scale = pageScaleFactor();
+    scroll.x = scroll.y = 0;
+    WebRect targetRect = hitRect;
+    if (targetRect.isEmpty())
+        targetRect.width = targetRect.height = touchPointPadding;
+
+    WebRect rect = computeBlockBounds(targetRect, zoomType);
+
+    const float overviewScale = m_minimumPageScaleFactor;
+    bool scaleUnchanged = true;
+    if (!rect.isEmpty()) {
+        // Pages should be as legible as on desktop when at dpi scale, so no
+        // need to zoom in further when automatically determining zoom level
+        // (after double tap, find in page, etc), though the user should still
+        // be allowed to manually pinch zoom in further if they desire.
+        const float maxScale = deviceScaleFactor();
+
+        const float defaultMargin = doubleTapZoomContentDefaultMargin * deviceScaleFactor();
+        const float minimumMargin = doubleTapZoomContentMinimumMargin * deviceScaleFactor();
+        // We want the margins to have the same physical size, which means we
+        // need to express them in post-scale size. To do that we'd need to know
+        // the scale we're scaling to, but that depends on the margins. Instead
+        // we express them as a fraction of the target rectangle: this will be
+        // correct if we end up fully zooming to it, and won't matter if we
+        // don't.
+        rect = widenRectWithinPageBounds(rect,
+                static_cast<int>(defaultMargin * rect.width / m_size.width),
+                static_cast<int>(minimumMargin * rect.width / m_size.width));
+
+        // Fit block to screen, respecting limits.
+        scale *= static_cast<float>(m_size.width) / rect.width;
+        scale = min(scale, maxScale);
+        scale = clampPageScaleFactorToLimits(scale);
+
+        scaleUnchanged = fabs(pageScaleFactor() - scale) < minScaleDifference;
+    }
+
+    if (zoomType == DoubleTap) {
+        if (rect.isEmpty() || scaleUnchanged) {
+            // Zoom out to overview mode.
+            if (overviewScale)
+                scale = overviewScale;
+            return;
+        }
+    } else if (rect.isEmpty()) {
+        // Keep current scale (no need to scroll as x,y will normally already
+        // be visible). FIXME: Revisit this if it isn't always true.
+        return;
+    }
+
+    // FIXME: If this is being called for auto zoom during find in page,
+    // then if the user manually zooms in it'd be nice to preserve the relative
+    // increase in zoom they caused (if they zoom out then it's ok to zoom
+    // them back in again). This isn't compatible with our current double-tap
+    // zoom strategy (fitting the containing block to the screen) though.
+
+    float screenHeight = m_size.height / scale * pageScaleFactor();
+    float screenWidth = m_size.width / scale * pageScaleFactor();
+
+    // Scroll to vertically align the block.
+    if (rect.height < screenHeight) {
+        // Vertically center short blocks.
+        rect.y -= 0.5 * (screenHeight - rect.height);
+    } else {
+        // Ensure position we're zooming to (+ padding) isn't off the bottom of
+        // the screen.
+        rect.y = max<float>(rect.y, hitRect.y + touchPointPadding - screenHeight);
+    } // Otherwise top align the block.
+
+    // Do the same thing for horizontal alignment.
+    if (rect.width < screenWidth)
+        rect.x -= 0.5 * (screenWidth - rect.width);
+    else
+        rect.x = max<float>(rect.x, hitRect.x + touchPointPadding - screenWidth);
+
+    scroll.x = rect.x;
+    scroll.y = rect.y;
+}
+#endif
+
 void WebViewImpl::numberOfWheelEventHandlersChanged(unsigned numberOfWheelHandlers)
 {
-    m_haveWheelEventHandlers = numberOfWheelHandlers > 0;
     if (m_client)
         m_client->numberOfWheelEventHandlersChanged(numberOfWheelHandlers);
-#if USE(ACCELERATED_COMPOSITING)
-    if (m_layerTreeHost)
-        m_layerTreeHost->setHaveWheelEventHandlers(m_haveWheelEventHandlers);
-#endif
+}
+
+void WebViewImpl::numberOfTouchEventHandlersChanged(unsigned numberOfTouchHandlers)
+{
+    if (m_client)
+        m_client->numberOfTouchEventHandlersChanged(numberOfTouchHandlers);
 }
 
 #if !OS(DARWIN)
@@ -1257,6 +1408,14 @@ void WebViewImpl::composite(bool)
 #endif
 }
 
+void WebViewImpl::setNeedsRedraw()
+{
+#if USE(ACCELERATED_COMPOSITING)
+    if (m_layerTreeHost && isAcceleratedCompositingActive())
+        m_layerTreeHost->setNeedsRedraw();
+#endif
+}
+
 void WebViewImpl::loseCompositorContext(int numTimes)
 {
 #if USE(ACCELERATED_COMPOSITING)
@@ -2140,12 +2299,12 @@ bool WebViewImpl::computePageScaleFactorLimits()
         m_maximumPageScaleFactor = max(m_minimumPageScaleFactor, m_maximumPageScaleFactor);
     }
     ASSERT(m_minimumPageScaleFactor <= m_maximumPageScaleFactor);
+
+    float clampedScale = clampPageScaleFactorToLimits(pageScaleFactor());
 #if USE(ACCELERATED_COMPOSITING)
     if (m_layerTreeHost)
-        m_layerTreeHost->setPageScaleFactorLimits(m_minimumPageScaleFactor, m_maximumPageScaleFactor);
+        m_layerTreeHost->setPageScaleFactorAndLimits(clampedScale, m_minimumPageScaleFactor, m_maximumPageScaleFactor);
 #endif
-
-    float clampedScale = clampPageScaleFactorToLimits(pageScaleFactor());
     if (clampedScale != pageScaleFactor()) {
         setPageScaleFactorPreservingScrollOffset(clampedScale);
         return true;
@@ -3005,6 +3164,7 @@ void WebViewImpl::setIsAcceleratedCompositingActive(bool active)
 
         ccSettings.perTilePainting = page()->settings()->perTileDrawingEnabled();
         ccSettings.partialSwapEnabled = page()->settings()->partialSwapEnabled();
+        ccSettings.threadedAnimationEnabled = page()->settings()->threadedAnimationEnabled();
 
         m_nonCompositedContentHost = NonCompositedContentHost::create(WebViewImplContentPainter::create(this));
         m_nonCompositedContentHost->setShowDebugBorders(page()->settings()->showDebugBorders());
@@ -3014,8 +3174,7 @@ void WebViewImpl::setIsAcceleratedCompositingActive(bool active)
 
         m_layerTreeHost = CCLayerTreeHost::create(this, ccSettings);
         if (m_layerTreeHost) {
-            m_layerTreeHost->setHaveWheelEventHandlers(m_haveWheelEventHandlers);
-            m_layerTreeHost->setPageScaleFactorLimits(m_minimumPageScaleFactor, m_maximumPageScaleFactor);
+            m_layerTreeHost->setPageScaleFactorAndLimits(pageScaleFactor(), m_minimumPageScaleFactor, m_maximumPageScaleFactor);
             updateLayerTreeViewport();
             m_client->didActivateCompositor(m_layerTreeHost->compositorIdentifier());
             m_isAcceleratedCompositingActive = true;
@@ -3036,15 +3195,25 @@ void WebViewImpl::setIsAcceleratedCompositingActive(bool active)
 
 #endif
 
+PassRefPtr<GraphicsContext3D> WebViewImpl::createCompositorGraphicsContext3D()
+{
+    WebKit::WebGraphicsContext3D::Attributes attributes = getCompositorContextAttributes(CCProxy::hasImplThread());
+    OwnPtr<WebGraphicsContext3D> webContext = adoptPtr(client()->createGraphicsContext3D(attributes, true /* renderDirectlyToHostWindow */));
+    if (!webContext)
+        return 0;
+
+    return GraphicsContext3DPrivate::createGraphicsContextFromWebContext(webContext.release(), GraphicsContext3D::RenderDirectlyToHostWindow);
+}
+
 PassRefPtr<GraphicsContext3D> WebViewImpl::createLayerTreeHostContext3D()
 {
-    RefPtr<GraphicsContext3D> context = m_temporaryOnscreenGraphicsContext3D.release();
-    if (!context) {
-        if (CCProxy::hasImplThread())
-            context = GraphicsContext3DPrivate::createGraphicsContextForAnotherThread(getCompositorContextAttributes(), m_page->chrome(), GraphicsContext3D::RenderDirectlyToHostWindow);
-        else
-            context = GraphicsContext3D::create(getCompositorContextAttributes(), m_page->chrome(), GraphicsContext3D::RenderDirectlyToHostWindow);
-    }
+    RefPtr<GraphicsContext3D> context;
+
+    // If we've already created an onscreen context for this view, return that.
+    if (m_temporaryOnscreenGraphicsContext3D)
+        context = m_temporaryOnscreenGraphicsContext3D.release();
+    else // Otherwise make a new one.
+        context = createCompositorGraphicsContext3D();
     return context;
 }
 
@@ -3125,7 +3294,7 @@ void WebViewImpl::updateLayerTreeViewport()
     }
     m_nonCompositedContentHost->setViewport(visibleRect.size(), view->contentsSize(), scroll, pageScaleFactor(), layerAdjustX);
     m_layerTreeHost->setViewportSize(visibleRect.size());
-    m_layerTreeHost->setPageScale(pageScaleFactor());
+    m_layerTreeHost->setPageScaleFactorAndLimits(pageScaleFactor(), m_minimumPageScaleFactor, m_maximumPageScaleFactor);
 }
 
 WebGraphicsContext3D* WebViewImpl::graphicsContext3D()
@@ -3137,17 +3306,16 @@ WebGraphicsContext3D* WebViewImpl::graphicsContext3D()
             if (webContext && !webContext->isContextLost())
                 return webContext;
         }
-        if (m_temporaryOnscreenGraphicsContext3D) {
-            WebGraphicsContext3D* webContext = GraphicsContext3DPrivate::extractWebGraphicsContext3D(m_temporaryOnscreenGraphicsContext3D.get());
-            if (webContext && !webContext->isContextLost())
-                return webContext;
-        }
-        if (CCProxy::hasImplThread())
-            m_temporaryOnscreenGraphicsContext3D = GraphicsContext3DPrivate::createGraphicsContextForAnotherThread(getCompositorContextAttributes(), m_page->chrome(), GraphicsContext3D::RenderDirectlyToHostWindow);
-        else
-            m_temporaryOnscreenGraphicsContext3D = GraphicsContext3D::create(getCompositorContextAttributes(), m_page->chrome(), GraphicsContext3D::RenderDirectlyToHostWindow);
-
-        return GraphicsContext3DPrivate::extractWebGraphicsContext3D(m_temporaryOnscreenGraphicsContext3D.get());
+        // If we get here it means that some system needs access to the context the compositor will use but the compositor itself
+        // hasn't requested a context or it was unable to successfully instantiate a context.
+        // We need to return the context that the compositor will later use so we allocate a new context (if needed) and stash it
+        // until the compositor requests and takes ownership of the context via createLayerTreeHost3D().
+        if (!m_temporaryOnscreenGraphicsContext3D)
+            m_temporaryOnscreenGraphicsContext3D = createCompositorGraphicsContext3D();
+
+        WebGraphicsContext3D* webContext = GraphicsContext3DPrivate::extractWebGraphicsContext3D(m_temporaryOnscreenGraphicsContext3D.get());
+        if (webContext && !webContext->isContextLost())
+            return webContext;
     }
 #endif
     return 0;
diff --git a/Source/WebKit/chromium/src/WebViewImpl.h b/Source/WebKit/chromium/src/WebViewImpl.h
index 800d18254..bc7a53d04 100644
--- a/Source/WebKit/chromium/src/WebViewImpl.h
+++ b/Source/WebKit/chromium/src/WebViewImpl.h
@@ -45,6 +45,7 @@
 #include "GraphicsContext3D.h"
 #include "GraphicsLayer.h"
 #include "InspectorClientImpl.h"
+#include "IntPoint.h"
 #include "IntRect.h"
 #include "NotificationPresenterImpl.h"
 #include "PageOverlayList.h"
@@ -95,6 +96,11 @@ class WebTouchEvent;
 
 class WebViewImpl : public WebView, public WebCore::CCLayerTreeHostClient, public RefCounted<WebViewImpl> {
 public:
+    enum AutoZoomType {
+        DoubleTap,
+        FindInPage,
+    };
+
     // WebWidget methods:
     virtual void close();
     virtual WebSize size() { return m_size; }
@@ -110,6 +116,7 @@ public:
     virtual void paint(WebCanvas*, const WebRect&);
     virtual void themeChanged();
     virtual void composite(bool finish);
+    virtual void setNeedsRedraw();
     virtual bool handleInputEvent(const WebInputEvent&);
     virtual void mouseCaptureLost();
     virtual void setFocus(bool enable);
@@ -314,11 +321,13 @@ public:
     void mouseDoubleClick(const WebMouseEvent&);
     bool mouseWheel(const WebMouseWheelEvent&);
     bool gestureEvent(const WebGestureEvent&);
+    void startPageScaleAnimation(const WebCore::IntPoint& targetPosition, bool useAnchor, float newScale, double durationSec);
     bool keyEvent(const WebKeyboardEvent&);
     bool charEvent(const WebKeyboardEvent&);
     bool touchEvent(const WebTouchEvent&);
 
     void numberOfWheelEventHandlersChanged(unsigned);
+    void numberOfTouchEventHandlersChanged(unsigned);
 
     // Handles context menu events orignated via the the keyboard. These
     // include the VK_APPS virtual key and the Shift+F10 combine. Code is
@@ -437,9 +446,12 @@ public:
     // Returns the onscreen 3D context used by the compositor. This is
     // used by the renderer's code to set up resource sharing between
     // the compositor's context and subordinate contexts for APIs like
-    // WebGL. Returns 0 if compositing support is not compiled in.
+    // WebGL. Returns 0 if compositing support is not compiled in or
+    // we could not successfully instantiate a context.
     virtual WebGraphicsContext3D* graphicsContext3D();
 
+    PassRefPtr<WebCore::GraphicsContext3D> createCompositorGraphicsContext3D();
+
     virtual void setVisibilityState(WebPageVisibilityState, bool);
 
     WebCore::PopupContainer* selectPopup() const { return m_selectPopup.get(); }
@@ -455,6 +467,10 @@ public:
     // a plugin can update its own zoom, say because of its own UI.
     void fullFramePluginZoomLevelChanged(double zoomLevel);
 
+#if ENABLE(GESTURE_EVENTS)
+    void computeScaleAndScrollForHitRect(const WebRect& hitRect, AutoZoomType, float& scale, WebPoint& scroll);
+#endif
+
     void loseCompositorContext(int numTimes);
 
     void enterFullScreenForElement(WebCore::Element*);
@@ -525,6 +541,15 @@ private:
     void updateLayerTreeViewport();
 #endif
 
+#if ENABLE(GESTURE_EVENTS)
+    // Returns the bounding box of the block type node touched by the WebRect.
+    WebRect computeBlockBounds(const WebRect&, AutoZoomType);
+
+    // Helper function: Widens the width of |source| by the specified margins
+    // while keeping it smaller than page width.
+    WebRect widenRectWithinPageBounds(const WebRect& source, int targetMargin, int minimumMargin);
+#endif
+
 #if ENABLE(POINTER_LOCK)
     void pointerLockMouseEvent(const WebInputEvent&);
 #endif
@@ -670,7 +695,6 @@ private:
     // If true, the graphics context is being restored.
     bool m_recreatingGraphicsContext;
 #endif
-    bool m_haveWheelEventHandlers;
     static const WebInputEvent* m_currentInputEvent;
 
 #if ENABLE(INPUT_SPEECH)
diff --git a/Source/WebKit/chromium/src/WebWorkerClientImpl.cpp b/Source/WebKit/chromium/src/WebWorkerClientImpl.cpp
index 796ab166d..1db2d1dd9 100644
--- a/Source/WebKit/chromium/src/WebWorkerClientImpl.cpp
+++ b/Source/WebKit/chromium/src/WebWorkerClientImpl.cpp
@@ -39,6 +39,7 @@
 #include "ErrorEvent.h"
 #include "Frame.h"
 #include "FrameLoaderClient.h"
+#include "InspectorInstrumentation.h"
 #include "MessageEvent.h"
 #include "MessagePort.h"
 #include "MessagePortChannel.h"
@@ -90,6 +91,7 @@ void WebWorkerClientImpl::startWorkerContext(const KURL& scriptURL, const String
                                                                          m_scriptExecutionContext->contentSecurityPolicy()->headerType());
     m_proxy->workerThreadCreated(thread);
     thread->start();
+    InspectorInstrumentation::didStartWorkerContext(m_scriptExecutionContext.get(), m_proxy, scriptURL);
 }
 
 void WebWorkerClientImpl::terminateWorkerContext()
diff --git a/Source/WebKit/chromium/src/js/Tests.js b/Source/WebKit/chromium/src/js/Tests.js
index a41eefdd0..16a1ba257 100644
--- a/Source/WebKit/chromium/src/js/Tests.js
+++ b/Source/WebKit/chromium/src/js/Tests.js
@@ -308,7 +308,6 @@ TestSuite.prototype.testNoScriptDuplicatesOnPanelSwitch = function()
 
     this.showPanel("scripts");
 
-
     function switchToElementsTab() {
         test.showPanel("elements");
         setTimeout(switchToScriptsTab, 0);
@@ -320,19 +319,17 @@ TestSuite.prototype.testNoScriptDuplicatesOnPanelSwitch = function()
     }
 
     function checkScriptsPanel() {
-        test.assertTrue(!!WebInspector.panels.scripts.visibleView, "No visible script view.");
         test.assertTrue(test._scriptsAreParsed(["debugger_test_page.html"]), "Some scripts are missing.");
         checkNoDuplicates();
         test.releaseControl();
     }
 
     function checkNoDuplicates() {
-        var scriptSelect = document.getElementById("scripts-files");
-        var options = scriptSelect.options;
-        for (var i = 0; i < options.length; i++) {
-            var scriptName = options[i].text;
-            for (var j = i + 1; j < options.length; j++)
-                test.assertTrue(scriptName !== options[j].text, "Found script duplicates: " + test.optionsToString_(options));
+        var uiSourceCodes = test.nonAnonymousUISourceCodes_();
+        for (var i = 0; i < uiSourceCodes.length; i++) {
+            var scriptName = uiSourceCodes[i].fileName;
+            for (var j = i + 1; j < uiSourceCodes.length; j++)
+                test.assertTrue(scriptName !== uiSourceCodes[j].fileName, "Found script duplicates: " + test.uiSourceCodesToString_(uiSourceCodes));
         }
     }
 
@@ -584,70 +581,32 @@ TestSuite.prototype.waitForTestResultsInConsole = function()
 
 
 /**
- * Serializes options collection to string.
- * @param {HTMLOptionsCollection} options
+ * Serializes array of uiSourceCodes to string.
+ * @param {Array.<WebInspectorUISourceCode>} uiSourceCodes
  * @return {string}
  */
-TestSuite.prototype.optionsToString_ = function(options)
+TestSuite.prototype.uiSourceCodesToString_ = function(uiSourceCodes)
 {
     var names = [];
-    for (var i = 0; i < options.length; i++)
-        names.push('"' + options[i].text + '"');
+    for (var i = 0; i < uiSourceCodes.length; i++)
+        names.push('"' + uiSourceCodes[i].fileName + '"');
     return names.join(",");
 };
 
 
 /**
- * Ensures that main HTML resource is selected in Scripts panel and that its
- * source frame is setup. Invokes the callback when the condition is satisfied.
- * @param {HTMLOptionsCollection} options
- * @param {function(WebInspector.SourceView,string)} callback
+ * Returns all loaded non anonymous uiSourceCodes.
+ * @return {Array.<WebInspectorUISourceCode>}
  */
-TestSuite.prototype.showMainPageScriptSource_ = function(scriptName, callback)
+TestSuite.prototype.nonAnonymousUISourceCodes_ = function()
 {
-    var test = this;
-
-    var scriptSelect = document.getElementById("scripts-files");
-    var options = scriptSelect.options;
-
-    test.assertTrue(options.length, "Scripts list is empty");
-
-    // Select page's script if it's not current option.
-    var scriptResource;
-    if (options[scriptSelect.selectedIndex].text === scriptName)
-        scriptResource = options[scriptSelect.selectedIndex].representedObject;
-    else {
-        var pageScriptIndex = -1;
-        for (var i = 0; i < options.length; i++) {
-            if (options[i].text === scriptName) {
-                pageScriptIndex = i;
-                break;
-            }
-        }
-        test.assertTrue(-1 !== pageScriptIndex, "Script with url " + scriptName + " not found among " + test.optionsToString_(options));
-        scriptResource = options[pageScriptIndex].representedObject;
-
-        // Current panel is "Scripts".
-        WebInspector.inspectorView.currentPanel()._showScriptOrResource(scriptResource);
-        test.assertEquals(pageScriptIndex, scriptSelect.selectedIndex, "Unexpected selected option index.");
+    function filterOutAnonymous(uiSourceCode)
+    {
+        return !!uiSourceCode.url;
     }
 
-    test.assertTrue(scriptResource instanceof WebInspector.Resource,
-                    "Unexpected resource class.");
-    test.assertTrue(!!scriptResource.url, "Resource URL is null.");
-    test.assertTrue(scriptResource.url.search(scriptName + "$") !== -1, "Main HTML resource should be selected.");
-
-    var scriptsPanel = WebInspector.panels.scripts;
-
-    var view = scriptsPanel.visibleView;
-    test.assertTrue(view instanceof WebInspector.SourceView);
-
-    if (!view.sourceFrame._loaded) {
-        test.addSniffer(view, "_sourceFrameSetupFinished", function(event) {
-            callback(view, scriptResource.url);
-        });
-    } else
-        callback(view, scriptResource.url);
+    var uiSourceCodes = WebInspector.panels.scripts._presentationModel.uiSourceCodes();
+    return uiSourceCodes.filter(filterOutAnonymous);
 };
 
 
@@ -680,14 +639,12 @@ TestSuite.prototype.evaluateInConsole_ = function(code, callback)
  */
 TestSuite.prototype._scriptsAreParsed = function(expected)
 {
-    var scriptSelect = document.getElementById("scripts-files");
-    var options = scriptSelect.options;
-
+    var uiSourceCodes = this.nonAnonymousUISourceCodes_();
     // Check that at least all the expected scripts are present.
     var missing = expected.slice(0);
-    for (var i = 0 ; i < options.length; i++) {
-        for (var j = 0; j < missing.length; j++) {
-            if (options[i].text.search(missing[j]) !== -1) {
+    for (var i = 0; i < uiSourceCodes.length; ++i) {
+        for (var j = 0; j < missing.length; ++j) {
+            if (uiSourceCodes[i].fileName.search(missing[j]) !== -1) {
                 missing.splice(j, 1);
                 break;
             }
@@ -744,7 +701,7 @@ TestSuite.prototype._waitUntilScriptsAreParsed = function(expectedScripts, callb
         if (test._scriptsAreParsed(expectedScripts))
             callback();
         else
-            test.addSniffer(WebInspector.panels.scripts, "_uiSourceCodeAdded", waitForAllScripts);
+            test.addSniffer(WebInspector.panels.scripts, "_addUISourceCode", waitForAllScripts);
     }
 
     waitForAllScripts();
diff --git a/Source/WebKit/chromium/tests/CCActiveAnimationTest.cpp b/Source/WebKit/chromium/tests/CCActiveAnimationTest.cpp
index 3e93d95de..e14ef9bc0 100644
--- a/Source/WebKit/chromium/tests/CCActiveAnimationTest.cpp
+++ b/Source/WebKit/chromium/tests/CCActiveAnimationTest.cpp
@@ -25,24 +25,20 @@
 #include "config.h"
 
 #include "cc/CCActiveAnimation.h"
-
-#include "cc/CCAnimationCurve.h"
+#include "CCAnimationTestCommon.h"
 
 #include <gmock/gmock.h>
 #include <gtest/gtest.h>
 #include <wtf/Vector.h>
 
-namespace WebCore {
+using namespace WebKitTests;
+using namespace WebCore;
 
-class FakeFloatAnimation : public CCFloatAnimationCurve {
-public:
-    virtual double duration() const { return 1; }
-    virtual float getValue(double now) const { return 0; }
-};
+namespace {
 
 PassOwnPtr<CCActiveAnimation> createActiveAnimation(int iterations)
 {
-    OwnPtr<CCActiveAnimation> toReturn(CCActiveAnimation::create(adoptPtr(new FakeFloatAnimation), 1, CCActiveAnimation::Opacity));
+    OwnPtr<CCActiveAnimation> toReturn(CCActiveAnimation::create(adoptPtr(new FakeFloatAnimationCurve), 0, 1, CCActiveAnimation::Opacity));
     toReturn->setIterations(iterations);
     return toReturn.release();
 }
@@ -164,4 +160,4 @@ TEST(CCActiveAnimationTest, IsFinished)
     EXPECT_TRUE(anim->isFinished());
 }
 
-} // namespace WebCore
+} // namespace
diff --git a/Source/WebKit/chromium/tests/CCAnimationTestCommon.cpp b/Source/WebKit/chromium/tests/CCAnimationTestCommon.cpp
new file mode 100644
index 000000000..c9240e31f
--- /dev/null
+++ b/Source/WebKit/chromium/tests/CCAnimationTestCommon.cpp
@@ -0,0 +1,133 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#include "CCAnimationTestCommon.h"
+
+#include "GraphicsLayer.h"
+#include "LayerChromium.h"
+#include "cc/CCLayerAnimationController.h"
+
+using namespace WebCore;
+
+namespace {
+
+template <class Target>
+void addOpacityTransition(Target& target, double duration, float startOpacity, float endOpacity)
+{
+    WebCore::KeyframeValueList values(AnimatedPropertyOpacity);
+    if (duration > 0)
+        values.insert(new FloatAnimationValue(0, startOpacity));
+    values.insert(new FloatAnimationValue(duration, endOpacity));
+
+    RefPtr<Animation> animation = Animation::create();
+    animation->setDuration(duration);
+
+    IntSize boxSize;
+
+    target.addAnimation(values, boxSize, animation.get(), 0, 0, 0);
+}
+
+} // namespace
+
+namespace WebKitTests {
+
+FakeFloatAnimationCurve::FakeFloatAnimationCurve()
+{
+}
+
+FakeFloatAnimationCurve::~FakeFloatAnimationCurve()
+{
+}
+
+PassOwnPtr<WebCore::CCAnimationCurve> FakeFloatAnimationCurve::clone() const
+{
+    return adoptPtr(new FakeFloatAnimationCurve);
+}
+
+FakeTransformTransition::FakeTransformTransition(double duration)
+    : m_duration(duration)
+{
+}
+
+FakeTransformTransition::~FakeTransformTransition()
+{
+}
+
+WebCore::TransformationMatrix FakeTransformTransition::getValue(double time, const WebCore::IntSize& size) const
+{
+    return WebCore::TransformationMatrix();
+}
+
+PassOwnPtr<WebCore::CCAnimationCurve> FakeTransformTransition::clone() const
+{
+    return adoptPtr(new FakeTransformTransition(*this));
+}
+
+
+FakeFloatTransition::FakeFloatTransition(double duration, float from, float to)
+    : m_duration(duration)
+    , m_from(from)
+    , m_to(to)
+{
+}
+
+FakeFloatTransition::~FakeFloatTransition()
+{
+}
+
+float FakeFloatTransition::getValue(double time) const
+{
+    time /= m_duration;
+    if (time >= 1)
+        time = 1;
+    return (1 - time) * m_from + time * m_to;
+}
+
+FakeLayerAnimationControllerImplClient::FakeLayerAnimationControllerImplClient()
+    : m_opacity(0)
+{
+}
+
+FakeLayerAnimationControllerImplClient::~FakeLayerAnimationControllerImplClient()
+{
+}
+
+PassOwnPtr<WebCore::CCAnimationCurve> FakeFloatTransition::clone() const
+{
+    return adoptPtr(new FakeFloatTransition(*this));
+}
+
+void addOpacityTransitionToController(WebCore::CCLayerAnimationController& controller, double duration, float startOpacity, float endOpacity)
+{
+    addOpacityTransition(controller, duration, startOpacity, endOpacity);
+}
+
+void addOpacityTransitionToLayer(WebCore::LayerChromium& layer, double duration, float startOpacity, float endOpacity)
+{
+    addOpacityTransition(layer, duration, startOpacity, endOpacity);
+}
+
+} // namespace WebKitTests
diff --git a/Source/WebKit/chromium/tests/CCAnimationTestCommon.h b/Source/WebKit/chromium/tests/CCAnimationTestCommon.h
new file mode 100644
index 000000000..d13e74ca1
--- /dev/null
+++ b/Source/WebKit/chromium/tests/CCAnimationTestCommon.h
@@ -0,0 +1,104 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef CCAnimationTestCommon_h
+#define CCAnimationTestCommon_h
+
+#include "cc/CCAnimationCurve.h"
+#include "cc/CCLayerAnimationControllerImpl.h"
+
+#include <wtf/OwnPtr.h>
+
+namespace WebCore {
+class CCLayerAnimationController;
+class LayerChromium;
+}
+
+namespace WebKitTests {
+
+class FakeFloatAnimationCurve : public WebCore::CCFloatAnimationCurve {
+public:
+    FakeFloatAnimationCurve();
+    virtual ~FakeFloatAnimationCurve();
+
+    virtual double duration() const { return 1; }
+    virtual float getValue(double now) const { return 0; }
+    virtual PassOwnPtr<WebCore::CCAnimationCurve> clone() const;
+};
+
+class FakeTransformTransition : public WebCore::CCTransformAnimationCurve {
+public:
+    FakeTransformTransition(double duration);
+    virtual ~FakeTransformTransition();
+
+    virtual double duration() const { return m_duration; }
+    virtual WebCore::TransformationMatrix getValue(double time, const WebCore::IntSize&) const;
+
+    virtual PassOwnPtr<WebCore::CCAnimationCurve> clone() const;
+
+private:
+    double m_duration;
+};
+
+class FakeFloatTransition : public WebCore::CCFloatAnimationCurve {
+public:
+    FakeFloatTransition(double duration, float from, float to);
+    virtual ~FakeFloatTransition();
+
+    virtual double duration() const { return m_duration; }
+    virtual float getValue(double time) const;
+
+    virtual PassOwnPtr<WebCore::CCAnimationCurve> clone() const;
+
+private:
+    double m_duration;
+    float m_from;
+    float m_to;
+};
+
+class FakeLayerAnimationControllerImplClient : public WebCore::CCLayerAnimationControllerImplClient {
+public:
+    FakeLayerAnimationControllerImplClient();
+    virtual ~FakeLayerAnimationControllerImplClient();
+
+    virtual int id() const { return 0; }
+    virtual float opacity() const { return m_opacity; }
+    virtual void setOpacity(float opacity) { m_opacity = opacity; }
+    virtual const WebCore::TransformationMatrix& transform() const { return m_transform; }
+    virtual void setTransform(const WebCore::TransformationMatrix& transform) { m_transform = transform; }
+    virtual const WebCore::IntSize& bounds() const { return m_bounds; }
+
+private:
+    float m_opacity;
+    WebCore::TransformationMatrix m_transform;
+    WebCore::IntSize m_bounds;
+};
+
+void addOpacityTransitionToController(WebCore::CCLayerAnimationController&, double duration, float startOpacity, float endOpacity);
+
+void addOpacityTransitionToLayer(WebCore::LayerChromium&, double duration, float startOpacity, float endOpacity);
+
+} // namespace WebKitTests
+
+#endif // CCAnimationTesctCommon_h
diff --git a/Source/WebKit/chromium/tests/CCKeyframedAnimationCurveTest.cpp b/Source/WebKit/chromium/tests/CCKeyframedAnimationCurveTest.cpp
new file mode 100644
index 000000000..b7732aeab
--- /dev/null
+++ b/Source/WebKit/chromium/tests/CCKeyframedAnimationCurveTest.cpp
@@ -0,0 +1,241 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#include "cc/CCKeyframedAnimationCurve.h"
+
+#include "Length.h"
+#include "TranslateTransformOperation.h"
+
+#include <gmock/gmock.h>
+#include <gtest/gtest.h>
+#include <wtf/OwnPtr.h>
+#include <wtf/Vector.h>
+
+using namespace WebCore;
+
+namespace {
+
+void expectTranslateX(double translateX, const TransformationMatrix& matrix)
+{
+    TransformationMatrix::DecomposedType decomposedType;
+    matrix.decompose(decomposedType);
+    EXPECT_FLOAT_EQ(translateX, decomposedType.translateX);
+}
+
+// Tests that a float animation with one keyframe works as expected.
+TEST(CCKeyframedAnimationCurveTest, OneFloatKeyframe)
+{
+    Vector<CCFloatKeyframe> keyframes;
+    keyframes.append(CCFloatKeyframe(0, 2));
+    OwnPtr<CCKeyframedFloatAnimationCurve> curve(CCKeyframedFloatAnimationCurve::create(keyframes));
+    EXPECT_FLOAT_EQ(2, curve->getValue(-1));
+    EXPECT_FLOAT_EQ(2, curve->getValue(0));
+    EXPECT_FLOAT_EQ(2, curve->getValue(0.5));
+    EXPECT_FLOAT_EQ(2, curve->getValue(1));
+    EXPECT_FLOAT_EQ(2, curve->getValue(2));
+}
+
+// Tests that a float animation with two keyframes works as expected.
+TEST(CCKeyframedAnimationCurveTest, TwoFloatKeyframe)
+{
+    Vector<CCFloatKeyframe> keyframes;
+    keyframes.append(CCFloatKeyframe(0, 2));
+    keyframes.append(CCFloatKeyframe(1, 4));
+    OwnPtr<CCKeyframedFloatAnimationCurve> curve(CCKeyframedFloatAnimationCurve::create(keyframes));
+    EXPECT_FLOAT_EQ(2, curve->getValue(-1));
+    EXPECT_FLOAT_EQ(2, curve->getValue(0));
+    EXPECT_FLOAT_EQ(3, curve->getValue(0.5));
+    EXPECT_FLOAT_EQ(4, curve->getValue(1));
+    EXPECT_FLOAT_EQ(4, curve->getValue(2));
+}
+
+// Tests that a float animation with three keyframes works as expected.
+TEST(CCKeyframedAnimationCurveTest, ThreeFloatKeyframe)
+{
+    Vector<CCFloatKeyframe> keyframes;
+    keyframes.append(CCFloatKeyframe(0, 2));
+    keyframes.append(CCFloatKeyframe(1, 4));
+    keyframes.append(CCFloatKeyframe(2, 8));
+    OwnPtr<CCKeyframedFloatAnimationCurve> curve(CCKeyframedFloatAnimationCurve::create(keyframes));
+    EXPECT_FLOAT_EQ(2, curve->getValue(-1));
+    EXPECT_FLOAT_EQ(2, curve->getValue(0));
+    EXPECT_FLOAT_EQ(3, curve->getValue(0.5));
+    EXPECT_FLOAT_EQ(4, curve->getValue(1));
+    EXPECT_FLOAT_EQ(6, curve->getValue(1.5));
+    EXPECT_FLOAT_EQ(8, curve->getValue(2));
+    EXPECT_FLOAT_EQ(8, curve->getValue(3));
+}
+
+// Tests that a float animation with multiple keys at a given time works sanely.
+TEST(CCKeyframedAnimationCurveTest, RepeatedFloatKeyTimes)
+{
+    Vector<CCFloatKeyframe> keyframes;
+    // A step function.
+    keyframes.append(CCFloatKeyframe(0, 4));
+    keyframes.append(CCFloatKeyframe(1, 4));
+    keyframes.append(CCFloatKeyframe(1, 6));
+    keyframes.append(CCFloatKeyframe(2, 6));
+    OwnPtr<CCKeyframedFloatAnimationCurve> curve(CCKeyframedFloatAnimationCurve::create(keyframes));
+
+    EXPECT_FLOAT_EQ(4, curve->getValue(-1));
+    EXPECT_FLOAT_EQ(4, curve->getValue(0));
+    EXPECT_FLOAT_EQ(4, curve->getValue(0.5));
+
+    // There is a discontinuity at 1. Any value between 4 and 6 is valid.
+    float value = curve->getValue(1);
+    EXPECT_TRUE(value >= 4 && value <= 6);
+
+    EXPECT_FLOAT_EQ(6, curve->getValue(1.5));
+    EXPECT_FLOAT_EQ(6, curve->getValue(2));
+    EXPECT_FLOAT_EQ(6, curve->getValue(3));
+}
+
+
+// Tests that a transform animation with one keyframe works as expected.
+TEST(CCKeyframedAnimationCurveTest, OneTransformKeyframe)
+{
+    Vector<CCTransformKeyframe> keyframes;
+    TransformOperations operations;
+    operations.operations().append(TranslateTransformOperation::create(Length(2, Fixed), Length(0, Fixed), TransformOperation::TRANSLATE_X));
+    keyframes.append(CCTransformKeyframe(0, operations));
+    OwnPtr<CCKeyframedTransformAnimationCurve> curve(CCKeyframedTransformAnimationCurve::create(keyframes));
+    IntSize layerSize; // ignored
+    expectTranslateX(2, curve->getValue(-1, layerSize));
+    expectTranslateX(2, curve->getValue(0, layerSize));
+    expectTranslateX(2, curve->getValue(0.5, layerSize));
+    expectTranslateX(2, curve->getValue(1, layerSize));
+    expectTranslateX(2, curve->getValue(2, layerSize));
+}
+
+// Tests that a transform animation with two keyframes works as expected.
+TEST(CCKeyframedAnimationCurveTest, TwoTransformKeyframe)
+{
+    Vector<CCTransformKeyframe> keyframes;
+    TransformOperations operations1;
+    operations1.operations().append(TranslateTransformOperation::create(Length(2, Fixed), Length(0, Fixed), TransformOperation::TRANSLATE_X));
+    TransformOperations operations2;
+    operations2.operations().append(TranslateTransformOperation::create(Length(4, Fixed), Length(0, Fixed), TransformOperation::TRANSLATE_X));
+    keyframes.append(CCTransformKeyframe(0, operations1));
+    keyframes.append(CCTransformKeyframe(1, operations2));
+    OwnPtr<CCKeyframedTransformAnimationCurve> curve(CCKeyframedTransformAnimationCurve::create(keyframes));
+    IntSize layerSize; // ignored
+    expectTranslateX(2, curve->getValue(-1, layerSize));
+    expectTranslateX(2, curve->getValue(0, layerSize));
+    expectTranslateX(3, curve->getValue(0.5, layerSize));
+    expectTranslateX(4, curve->getValue(1, layerSize));
+    expectTranslateX(4, curve->getValue(2, layerSize));
+}
+
+// Tests that a transform animation with three keyframes works as expected.
+TEST(CCKeyframedAnimationCurveTest, ThreeTransformKeyframe)
+{
+    Vector<CCTransformKeyframe> keyframes;
+    TransformOperations operations1;
+    operations1.operations().append(TranslateTransformOperation::create(Length(2, Fixed), Length(0, Fixed), TransformOperation::TRANSLATE_X));
+    TransformOperations operations2;
+    operations2.operations().append(TranslateTransformOperation::create(Length(4, Fixed), Length(0, Fixed), TransformOperation::TRANSLATE_X));
+    TransformOperations operations3;
+    operations3.operations().append(TranslateTransformOperation::create(Length(8, Fixed), Length(0, Fixed), TransformOperation::TRANSLATE_X));
+    keyframes.append(CCTransformKeyframe(0, operations1));
+    keyframes.append(CCTransformKeyframe(1, operations2));
+    keyframes.append(CCTransformKeyframe(2, operations3));
+    OwnPtr<CCKeyframedTransformAnimationCurve> curve(CCKeyframedTransformAnimationCurve::create(keyframes));
+    IntSize layerSize; // ignored
+    expectTranslateX(2, curve->getValue(-1, layerSize));
+    expectTranslateX(2, curve->getValue(0, layerSize));
+    expectTranslateX(3, curve->getValue(0.5, layerSize));
+    expectTranslateX(4, curve->getValue(1, layerSize));
+    expectTranslateX(6, curve->getValue(1.5, layerSize));
+    expectTranslateX(8, curve->getValue(2, layerSize));
+    expectTranslateX(8, curve->getValue(3, layerSize));
+}
+
+// Tests that a transform animation with multiple keys at a given time works sanely.
+TEST(CCKeyframedAnimationCurveTest, RepeatedTransformKeyTimes)
+{
+    Vector<CCTransformKeyframe> keyframes;
+    // A step function.
+    TransformOperations operations1;
+    operations1.operations().append(TranslateTransformOperation::create(Length(4, Fixed), Length(0, Fixed), TransformOperation::TRANSLATE_X));
+    TransformOperations operations2;
+    operations2.operations().append(TranslateTransformOperation::create(Length(4, Fixed), Length(0, Fixed), TransformOperation::TRANSLATE_X));
+    TransformOperations operations3;
+    operations3.operations().append(TranslateTransformOperation::create(Length(6, Fixed), Length(0, Fixed), TransformOperation::TRANSLATE_X));
+    TransformOperations operations4;
+    operations4.operations().append(TranslateTransformOperation::create(Length(6, Fixed), Length(0, Fixed), TransformOperation::TRANSLATE_X));
+    keyframes.append(CCTransformKeyframe(0, operations1));
+    keyframes.append(CCTransformKeyframe(1, operations2));
+    keyframes.append(CCTransformKeyframe(1, operations3));
+    keyframes.append(CCTransformKeyframe(2, operations4));
+    OwnPtr<CCKeyframedTransformAnimationCurve> curve(CCKeyframedTransformAnimationCurve::create(keyframes));
+
+    IntSize layerSize; // ignored
+
+    expectTranslateX(4, curve->getValue(-1, layerSize));
+    expectTranslateX(4, curve->getValue(0, layerSize));
+    expectTranslateX(4, curve->getValue(0.5, layerSize));
+
+    // There is a discontinuity at 1. Any value between 4 and 6 is valid.
+    TransformationMatrix value = curve->getValue(1, layerSize);
+    TransformationMatrix::DecomposedType decomposedType;
+    value.decompose(decomposedType);
+    EXPECT_TRUE(decomposedType.translateX >= 4 && decomposedType.translateX <= 6);
+
+    expectTranslateX(6, curve->getValue(1.5, layerSize));
+    expectTranslateX(6, curve->getValue(2, layerSize));
+    expectTranslateX(6, curve->getValue(3, layerSize));
+}
+
+// Tests that invalid lists of keyframes result in nothing being returned from ::create.
+TEST(CCKeyframedAnimationCurveTest, InvalidKeyframes)
+{
+    // It is invalid to pass an empty vector of keyframes to create.
+    Vector<CCTransformKeyframe> transformKeyframes;
+    OwnPtr<CCKeyframedTransformAnimationCurve> transformCurve = CCKeyframedTransformAnimationCurve::create(transformKeyframes);
+    EXPECT_FALSE(transformCurve.get());
+
+    Vector<CCFloatKeyframe> floatKeyframes;
+    OwnPtr<CCKeyframedFloatAnimationCurve> floatCurve = CCKeyframedFloatAnimationCurve::create(floatKeyframes);
+    EXPECT_FALSE(floatCurve.get());
+
+    // It is invalid to pass a vector of unsorted keyframes to create;
+    TransformOperations operations1;
+    operations1.operations().append(TranslateTransformOperation::create(Length(2, Fixed), Length(0, Fixed), TransformOperation::TRANSLATE_X));
+    TransformOperations operations2;
+    operations2.operations().append(TranslateTransformOperation::create(Length(4, Fixed), Length(0, Fixed), TransformOperation::TRANSLATE_X));
+    transformKeyframes.append(CCTransformKeyframe(1, operations1));
+    transformKeyframes.append(CCTransformKeyframe(0, operations2));
+    transformCurve = CCKeyframedTransformAnimationCurve::create(transformKeyframes);
+    EXPECT_FALSE(transformCurve.get());
+
+    floatKeyframes.append(CCFloatKeyframe(1, 2));
+    floatKeyframes.append(CCFloatKeyframe(0, 4));
+    floatCurve = CCKeyframedFloatAnimationCurve::create(floatKeyframes);
+    EXPECT_FALSE(floatCurve.get());
+}
+
+
+} // namespace
diff --git a/Source/WebKit/chromium/tests/CCLayerAnimationControllerImplTest.cpp b/Source/WebKit/chromium/tests/CCLayerAnimationControllerImplTest.cpp
index 3d50d06e6..e1aeccc53 100644
--- a/Source/WebKit/chromium/tests/CCLayerAnimationControllerImplTest.cpp
+++ b/Source/WebKit/chromium/tests/CCLayerAnimationControllerImplTest.cpp
@@ -24,92 +24,39 @@
 
 #include "config.h"
 
+#include "CCAnimationTestCommon.h"
 #include "cc/CCLayerAnimationControllerImpl.h"
-
-#include "TransformOperations.h"
 #include "cc/CCAnimationCurve.h"
-
+#include "cc/CCAnimationEvents.h"
 #include <gmock/gmock.h>
 #include <gtest/gtest.h>
 #include <wtf/Vector.h>
 
 using namespace WebCore;
+using namespace WebKitTests;
 
 namespace {
 
-class FakeControllerClient : public CCLayerAnimationControllerImplClient {
-public:
-    FakeControllerClient() : m_opacity(0) { }
-    virtual ~FakeControllerClient() { }
-
-    virtual float opacity() const { return m_opacity; }
-    virtual void setOpacity(float opacity) { m_opacity = opacity; }
-    virtual const TransformationMatrix& transform() const { return m_transform; }
-    virtual void setTransform(const TransformationMatrix& transform) { m_transform = transform; }
-    virtual void animationControllerImplDidActivate(CCLayerAnimationControllerImpl* controller)
-    {
-        m_activeControllers.append(controller);
-    }
-
-    Vector<CCLayerAnimationControllerImpl*>& activeControllers() { return m_activeControllers; }
-
-private:
-    float m_opacity;
-    TransformationMatrix m_transform;
-    Vector<CCLayerAnimationControllerImpl*> m_activeControllers;
-};
-
-class FakeTransformTransition : public CCTransformAnimationCurve {
-public:
-    FakeTransformTransition(double duration) : m_duration(duration) { }
-    virtual double duration() const { return m_duration; }
-    virtual TransformOperations getValue(double time) const
-    {
-        return TransformOperations();
-    }
-
-private:
-    double m_duration;
-};
-
-class FakeFloatTransition : public CCFloatAnimationCurve {
-public:
-    FakeFloatTransition(double duration, float from, float to)
-        : m_duration(duration)
-        , m_from(from)
-        , m_to(to)
-    {
-    }
-
-    virtual double duration() const { return m_duration; }
-    virtual float getValue(double time) const
-    {
-        time /= m_duration;
-        if (time >= 1)
-            time = 1;
-        return (1 - time) * m_from + time * m_to;
-    }
-
-private:
-    double m_duration;
-    float m_from;
-    float m_to;
-};
+PassOwnPtr<CCActiveAnimation> createActiveAnimation(PassOwnPtr<CCAnimationCurve> curve, int id, CCActiveAnimation::TargetProperty property)
+{
+    return CCActiveAnimation::create(curve, 0, id, property);
+}
 
 // Tests that transitioning opacity from 0 to 1 works as expected.
 TEST(CCLayerAnimationControllerImplTest, TrivialTransition)
 {
-    FakeControllerClient dummy;
+    OwnPtr<CCAnimationEventsVector> events(adoptPtr(new CCAnimationEventsVector));
+    FakeLayerAnimationControllerImplClient dummy;
     OwnPtr<CCLayerAnimationControllerImpl> controller(
         CCLayerAnimationControllerImpl::create(&dummy));
 
-    OwnPtr<CCActiveAnimation> toAdd(CCActiveAnimation::create(adoptPtr(new FakeFloatTransition(1, 0, 1)), 1, CCActiveAnimation::Opacity));
+    OwnPtr<CCActiveAnimation> toAdd(createActiveAnimation(adoptPtr(new FakeFloatTransition(1, 0, 1)), 1, CCActiveAnimation::Opacity));
 
     controller->add(toAdd.release());
-    controller->animate(0);
+    controller->animate(0, *events);
     EXPECT_TRUE(controller->hasActiveAnimation());
     EXPECT_EQ(0, dummy.opacity());
-    controller->animate(1);
+    controller->animate(1, *events);
     EXPECT_EQ(1, dummy.opacity());
     EXPECT_FALSE(controller->hasActiveAnimation());
 }
@@ -117,20 +64,21 @@ TEST(CCLayerAnimationControllerImplTest, TrivialTransition)
 // Tests that two queued animations affecting the same property run in sequence.
 TEST(CCLayerAnimationControllerImplTest, TrivialQueuing)
 {
-    FakeControllerClient dummy;
+    OwnPtr<CCAnimationEventsVector> events(adoptPtr(new CCAnimationEventsVector));
+    FakeLayerAnimationControllerImplClient dummy;
     OwnPtr<CCLayerAnimationControllerImpl> controller(
         CCLayerAnimationControllerImpl::create(&dummy));
 
-    controller->add(CCActiveAnimation::create(adoptPtr(new FakeFloatTransition(1, 0, 1)), 1, CCActiveAnimation::Opacity));
-    controller->add(CCActiveAnimation::create(adoptPtr(new FakeFloatTransition(1, 1, 0.5f)), 2, CCActiveAnimation::Opacity));
+    controller->add(createActiveAnimation(adoptPtr(new FakeFloatTransition(1, 0, 1)), 1, CCActiveAnimation::Opacity));
+    controller->add(createActiveAnimation(adoptPtr(new FakeFloatTransition(1, 1, 0.5f)), 2, CCActiveAnimation::Opacity));
 
-    controller->animate(0);
+    controller->animate(0, *events);
     EXPECT_TRUE(controller->hasActiveAnimation());
     EXPECT_EQ(0, dummy.opacity());
-    controller->animate(1);
+    controller->animate(1, *events);
     EXPECT_TRUE(controller->hasActiveAnimation());
     EXPECT_EQ(1, dummy.opacity());
-    controller->animate(2);
+    controller->animate(2, *events);
     EXPECT_EQ(0.5f, dummy.opacity());
     EXPECT_FALSE(controller->hasActiveAnimation());
 }
@@ -138,22 +86,23 @@ TEST(CCLayerAnimationControllerImplTest, TrivialQueuing)
 // Tests interrupting a transition with another transition.
 TEST(CCLayerAnimationControllerImplTest, Interrupt)
 {
-    FakeControllerClient dummy;
+    OwnPtr<CCAnimationEventsVector> events(adoptPtr(new CCAnimationEventsVector));
+    FakeLayerAnimationControllerImplClient dummy;
     OwnPtr<CCLayerAnimationControllerImpl> controller(
         CCLayerAnimationControllerImpl::create(&dummy));
-    controller->add(CCActiveAnimation::create(adoptPtr(new FakeFloatTransition(1, 0, 1)), 1, CCActiveAnimation::Opacity));
-    controller->animate(0);
+    controller->add(createActiveAnimation(adoptPtr(new FakeFloatTransition(1, 0, 1)), 1, CCActiveAnimation::Opacity));
+    controller->animate(0, *events);
     EXPECT_TRUE(controller->hasActiveAnimation());
     EXPECT_EQ(0, dummy.opacity());
 
-    OwnPtr<CCActiveAnimation> toAdd(CCActiveAnimation::create(adoptPtr(new FakeFloatTransition(1, 1, 0.5f)), 2, CCActiveAnimation::Opacity));
+    OwnPtr<CCActiveAnimation> toAdd(createActiveAnimation(adoptPtr(new FakeFloatTransition(1, 1, 0.5f)), 2, CCActiveAnimation::Opacity));
     toAdd->setRunState(CCActiveAnimation::WaitingForNextTick, 0);
     controller->add(toAdd.release());
 
-    controller->animate(0.5); // second anim starts NOW.
+    controller->animate(0.5, *events); // second anim starts NOW.
     EXPECT_TRUE(controller->hasActiveAnimation());
     EXPECT_EQ(1, dummy.opacity());
-    controller->animate(1.5);
+    controller->animate(1.5, *events);
     EXPECT_EQ(0.5f, dummy.opacity());
     EXPECT_FALSE(controller->hasActiveAnimation());
 }
@@ -161,23 +110,24 @@ TEST(CCLayerAnimationControllerImplTest, Interrupt)
 // Tests scheduling two animations to run together when only one property is free.
 TEST(CCLayerAnimationControllerImplTest, ScheduleTogetherWhenAPropertyIsBlocked)
 {
-    FakeControllerClient dummy;
+    OwnPtr<CCAnimationEventsVector> events(adoptPtr(new CCAnimationEventsVector));
+    FakeLayerAnimationControllerImplClient dummy;
     OwnPtr<CCLayerAnimationControllerImpl> controller(
         CCLayerAnimationControllerImpl::create(&dummy));
 
-    controller->add(CCActiveAnimation::create(adoptPtr(new FakeTransformTransition(1)), 1, CCActiveAnimation::Transform));
-    controller->add(CCActiveAnimation::create(adoptPtr(new FakeTransformTransition(1)), 2, CCActiveAnimation::Transform));
-    controller->add(CCActiveAnimation::create(adoptPtr(new FakeFloatTransition(1, 0, 1)), 2, CCActiveAnimation::Opacity));
+    controller->add(createActiveAnimation(adoptPtr(new FakeTransformTransition(1)), 1, CCActiveAnimation::Transform));
+    controller->add(createActiveAnimation(adoptPtr(new FakeTransformTransition(1)), 2, CCActiveAnimation::Transform));
+    controller->add(createActiveAnimation(adoptPtr(new FakeFloatTransition(1, 0, 1)), 2, CCActiveAnimation::Opacity));
 
-    controller->animate(0);
+    controller->animate(0, *events);
     EXPECT_EQ(0, dummy.opacity());
     EXPECT_TRUE(controller->hasActiveAnimation());
-    controller->animate(1);
+    controller->animate(1, *events);
     // Should not have started the float transition yet.
     EXPECT_TRUE(controller->hasActiveAnimation());
     EXPECT_EQ(0, dummy.opacity());
     // The the float animation should have started at time 1 and should be done.
-    controller->animate(2);
+    controller->animate(2, *events);
     EXPECT_EQ(1, dummy.opacity());
     EXPECT_FALSE(controller->hasActiveAnimation());
 }
@@ -187,29 +137,30 @@ TEST(CCLayerAnimationControllerImplTest, ScheduleTogetherWhenAPropertyIsBlocked)
 // for both to finish).
 TEST(CCLayerAnimationControllerImplTest, ScheduleTogetherWithAnAnimWaiting)
 {
-    FakeControllerClient dummy;
+    OwnPtr<CCAnimationEventsVector> events(adoptPtr(new CCAnimationEventsVector));
+    FakeLayerAnimationControllerImplClient dummy;
     OwnPtr<CCLayerAnimationControllerImpl> controller(
         CCLayerAnimationControllerImpl::create(&dummy));
 
-    controller->add(CCActiveAnimation::create(adoptPtr(new FakeTransformTransition(2)), 1, CCActiveAnimation::Transform));
-    controller->add(CCActiveAnimation::create(adoptPtr(new FakeFloatTransition(1, 0, 1)), 1, CCActiveAnimation::Opacity));
-    controller->add(CCActiveAnimation::create(adoptPtr(new FakeFloatTransition(1, 1, 0.5f)), 2, CCActiveAnimation::Opacity));
+    controller->add(createActiveAnimation(adoptPtr(new FakeTransformTransition(2)), 1, CCActiveAnimation::Transform));
+    controller->add(createActiveAnimation(adoptPtr(new FakeFloatTransition(1, 0, 1)), 1, CCActiveAnimation::Opacity));
+    controller->add(createActiveAnimation(adoptPtr(new FakeFloatTransition(1, 1, 0.5f)), 2, CCActiveAnimation::Opacity));
 
     // Anims with id 1 should both start now.
-    controller->animate(0);
+    controller->animate(0, *events);
     EXPECT_TRUE(controller->hasActiveAnimation());
     EXPECT_EQ(0, dummy.opacity());
     // The opacity animation should have finished at time 1, but the group
     // of animations with id 1 don't finish until time 2 because of the length
     // of the transform animation.
-    controller->animate(2);
+    controller->animate(2, *events);
     // Should not have started the float transition yet.
     EXPECT_TRUE(controller->hasActiveAnimation());
     EXPECT_EQ(1, dummy.opacity());
 
     // The the second opacity animation should start at time 2 and should be
     // done by time 3
-    controller->animate(3);
+    controller->animate(3, *events);
     EXPECT_EQ(0.5f, dummy.opacity());
     EXPECT_FALSE(controller->hasActiveAnimation());
 }
@@ -217,22 +168,23 @@ TEST(CCLayerAnimationControllerImplTest, ScheduleTogetherWithAnAnimWaiting)
 // Tests scheduling an animation to start in the future.
 TEST(CCLayerAnimationControllerImplTest, ScheduleAnimation)
 {
-    FakeControllerClient dummy;
+    OwnPtr<CCAnimationEventsVector> events(adoptPtr(new CCAnimationEventsVector));
+    FakeLayerAnimationControllerImplClient dummy;
     OwnPtr<CCLayerAnimationControllerImpl> controller(
         CCLayerAnimationControllerImpl::create(&dummy));
 
-    OwnPtr<CCActiveAnimation> toAdd(CCActiveAnimation::create(adoptPtr(new FakeFloatTransition(1, 0, 1)), 1, CCActiveAnimation::Opacity));
+    OwnPtr<CCActiveAnimation> toAdd(createActiveAnimation(adoptPtr(new FakeFloatTransition(1, 0, 1)), 1, CCActiveAnimation::Opacity));
     toAdd->setRunState(CCActiveAnimation::WaitingForStartTime, 0);
     toAdd->setStartTime(1);
     controller->add(toAdd.release());
 
-    controller->animate(0);
+    controller->animate(0, *events);
     EXPECT_TRUE(controller->hasActiveAnimation());
     EXPECT_EQ(0, dummy.opacity());
-    controller->animate(1);
+    controller->animate(1, *events);
     EXPECT_TRUE(controller->hasActiveAnimation());
     EXPECT_EQ(0, dummy.opacity());
-    controller->animate(2);
+    controller->animate(2, *events);
     EXPECT_EQ(1, dummy.opacity());
     EXPECT_FALSE(controller->hasActiveAnimation());
 }
@@ -240,28 +192,29 @@ TEST(CCLayerAnimationControllerImplTest, ScheduleAnimation)
 // Tests scheduling an animation to start in the future that's interrupting a running animation.
 TEST(CCLayerAnimationControllerImplTest, ScheduledAnimationInterruptsRunningAnimation)
 {
-    FakeControllerClient dummy;
+    OwnPtr<CCAnimationEventsVector> events(adoptPtr(new CCAnimationEventsVector));
+    FakeLayerAnimationControllerImplClient dummy;
     OwnPtr<CCLayerAnimationControllerImpl> controller(
         CCLayerAnimationControllerImpl::create(&dummy));
 
-    controller->add(CCActiveAnimation::create(adoptPtr(new FakeFloatTransition(2, 0, 1)), 1, CCActiveAnimation::Opacity));
+    controller->add(createActiveAnimation(adoptPtr(new FakeFloatTransition(2, 0, 1)), 1, CCActiveAnimation::Opacity));
 
-    OwnPtr<CCActiveAnimation> toAdd(CCActiveAnimation::create(adoptPtr(new FakeFloatTransition(1, 0.5f, 0)), 2, CCActiveAnimation::Opacity));
+    OwnPtr<CCActiveAnimation> toAdd(createActiveAnimation(adoptPtr(new FakeFloatTransition(1, 0.5f, 0)), 2, CCActiveAnimation::Opacity));
     toAdd->setRunState(CCActiveAnimation::WaitingForStartTime, 0);
     toAdd->setStartTime(1);
     controller->add(toAdd.release());
 
     // First 2s opacity transition should start immediately.
-    controller->animate(0);
+    controller->animate(0, *events);
     EXPECT_TRUE(controller->hasActiveAnimation());
     EXPECT_EQ(0, dummy.opacity());
-    controller->animate(0.5);
+    controller->animate(0.5, *events);
     EXPECT_TRUE(controller->hasActiveAnimation());
     EXPECT_EQ(0.25f, dummy.opacity());
-    controller->animate(1);
+    controller->animate(1, *events);
     EXPECT_TRUE(controller->hasActiveAnimation());
     EXPECT_EQ(0.5f, dummy.opacity());
-    controller->animate(2);
+    controller->animate(2, *events);
     EXPECT_EQ(0, dummy.opacity());
     EXPECT_FALSE(controller->hasActiveAnimation());
 }
@@ -270,34 +223,35 @@ TEST(CCLayerAnimationControllerImplTest, ScheduledAnimationInterruptsRunningAnim
 // and there is yet another animation queued to start later.
 TEST(CCLayerAnimationControllerImplTest, ScheduledAnimationInterruptsRunningAnimationWithAnimInQueue)
 {
-    FakeControllerClient dummy;
+    OwnPtr<CCAnimationEventsVector> events(adoptPtr(new CCAnimationEventsVector));
+    FakeLayerAnimationControllerImplClient dummy;
     OwnPtr<CCLayerAnimationControllerImpl> controller(
         CCLayerAnimationControllerImpl::create(&dummy));
 
-    controller->add(CCActiveAnimation::create(adoptPtr(new FakeFloatTransition(2, 0, 1)), 1, CCActiveAnimation::Opacity));
+    controller->add(createActiveAnimation(adoptPtr(new FakeFloatTransition(2, 0, 1)), 1, CCActiveAnimation::Opacity));
 
-    OwnPtr<CCActiveAnimation> toAdd(CCActiveAnimation::create(adoptPtr(new FakeFloatTransition(2, 0.5f, 0)), 2, CCActiveAnimation::Opacity));
+    OwnPtr<CCActiveAnimation> toAdd(createActiveAnimation(adoptPtr(new FakeFloatTransition(2, 0.5f, 0)), 2, CCActiveAnimation::Opacity));
     toAdd->setRunState(CCActiveAnimation::WaitingForStartTime, 0);
     toAdd->setStartTime(1);
     controller->add(toAdd.release());
 
-    controller->add(CCActiveAnimation::create(adoptPtr(new FakeFloatTransition(1, 0, 0.75f)), 3, CCActiveAnimation::Opacity));
+    controller->add(createActiveAnimation(adoptPtr(new FakeFloatTransition(1, 0, 0.75f)), 3, CCActiveAnimation::Opacity));
 
     // First 2s opacity transition should start immediately.
-    controller->animate(0);
+    controller->animate(0, *events);
     EXPECT_TRUE(controller->hasActiveAnimation());
     EXPECT_EQ(0, dummy.opacity());
-    controller->animate(0.5);
+    controller->animate(0.5, *events);
     EXPECT_TRUE(controller->hasActiveAnimation());
     EXPECT_EQ(0.25f, dummy.opacity());
     EXPECT_TRUE(controller->hasActiveAnimation());
-    controller->animate(1);
+    controller->animate(1, *events);
     EXPECT_TRUE(controller->hasActiveAnimation());
     EXPECT_EQ(0.5f, dummy.opacity());
-    controller->animate(3);
+    controller->animate(3, *events);
     EXPECT_TRUE(controller->hasActiveAnimation());
     EXPECT_EQ(0, dummy.opacity());
-    controller->animate(4);
+    controller->animate(4, *events);
     EXPECT_EQ(0.75f, dummy.opacity());
     EXPECT_FALSE(controller->hasActiveAnimation());
 }
@@ -305,64 +259,66 @@ TEST(CCLayerAnimationControllerImplTest, ScheduledAnimationInterruptsRunningAnim
 // Test that a looping animation loops and for the correct number of iterations.
 TEST(CCLayerAnimationControllerImplTest, TrivialLooping)
 {
-    FakeControllerClient dummy;
+    OwnPtr<CCAnimationEventsVector> events(adoptPtr(new CCAnimationEventsVector));
+    FakeLayerAnimationControllerImplClient dummy;
     OwnPtr<CCLayerAnimationControllerImpl> controller(
         CCLayerAnimationControllerImpl::create(&dummy));
 
-    OwnPtr<CCActiveAnimation> toAdd(CCActiveAnimation::create(adoptPtr(new FakeFloatTransition(1, 0, 1)), 1, CCActiveAnimation::Opacity));
+    OwnPtr<CCActiveAnimation> toAdd(createActiveAnimation(adoptPtr(new FakeFloatTransition(1, 0, 1)), 1, CCActiveAnimation::Opacity));
     toAdd->setIterations(3);
     controller->add(toAdd.release());
 
-    controller->animate(0);
+    controller->animate(0, *events);
     EXPECT_TRUE(controller->hasActiveAnimation());
     EXPECT_EQ(0, dummy.opacity());
-    controller->animate(1.25);
+    controller->animate(1.25, *events);
     EXPECT_TRUE(controller->hasActiveAnimation());
     EXPECT_EQ(0.25f, dummy.opacity());
-    controller->animate(1.75);
+    controller->animate(1.75, *events);
     EXPECT_TRUE(controller->hasActiveAnimation());
     EXPECT_EQ(0.75f, dummy.opacity());
-    controller->animate(2.25);
+    controller->animate(2.25, *events);
     EXPECT_TRUE(controller->hasActiveAnimation());
     EXPECT_EQ(0.25f, dummy.opacity());
-    controller->animate(2.75);
+    controller->animate(2.75, *events);
     EXPECT_TRUE(controller->hasActiveAnimation());
     EXPECT_EQ(0.75f, dummy.opacity());
-    controller->animate(3);
+    controller->animate(3, *events);
     EXPECT_FALSE(controller->hasActiveAnimation());
     EXPECT_EQ(1, dummy.opacity());
 
     // Just be extra sure.
-    controller->animate(4);
+    controller->animate(4, *events);
     EXPECT_EQ(1, dummy.opacity());
 }
 
 // Test that an infinitely looping animation does indeed go until aborted.
 TEST(CCLayerAnimationControllerImplTest, InfiniteLooping)
 {
-    FakeControllerClient dummy;
+    OwnPtr<CCAnimationEventsVector> events(adoptPtr(new CCAnimationEventsVector));
+    FakeLayerAnimationControllerImplClient dummy;
     OwnPtr<CCLayerAnimationControllerImpl> controller(
         CCLayerAnimationControllerImpl::create(&dummy));
 
     const int id = 1;
-    OwnPtr<CCActiveAnimation> toAdd(CCActiveAnimation::create(adoptPtr(new FakeFloatTransition(1, 0, 1)), id, CCActiveAnimation::Opacity));
+    OwnPtr<CCActiveAnimation> toAdd(createActiveAnimation(adoptPtr(new FakeFloatTransition(1, 0, 1)), id, CCActiveAnimation::Opacity));
     toAdd->setIterations(-1);
     controller->add(toAdd.release());
 
-    controller->animate(0);
+    controller->animate(0, *events);
     EXPECT_TRUE(controller->hasActiveAnimation());
     EXPECT_EQ(0, dummy.opacity());
-    controller->animate(1.25);
+    controller->animate(1.25, *events);
     EXPECT_TRUE(controller->hasActiveAnimation());
     EXPECT_EQ(0.25f, dummy.opacity());
-    controller->animate(1.75);
+    controller->animate(1.75, *events);
     EXPECT_TRUE(controller->hasActiveAnimation());
     EXPECT_EQ(0.75f, dummy.opacity());
 
-    controller->animate(1073741824.25);
+    controller->animate(1073741824.25, *events);
     EXPECT_TRUE(controller->hasActiveAnimation());
     EXPECT_EQ(0.25f, dummy.opacity());
-    controller->animate(1073741824.75);
+    controller->animate(1073741824.75, *events);
     EXPECT_TRUE(controller->hasActiveAnimation());
     EXPECT_EQ(0.75f, dummy.opacity());
 
@@ -375,80 +331,66 @@ TEST(CCLayerAnimationControllerImplTest, InfiniteLooping)
 // Test that pausing and resuming work as expected.
 TEST(CCLayerAnimationControllerImplTest, PauseResume)
 {
-    FakeControllerClient dummy;
+    OwnPtr<CCAnimationEventsVector> events(adoptPtr(new CCAnimationEventsVector));
+    FakeLayerAnimationControllerImplClient dummy;
     OwnPtr<CCLayerAnimationControllerImpl> controller(
         CCLayerAnimationControllerImpl::create(&dummy));
 
     const int id = 1;
-    controller->add(CCActiveAnimation::create(adoptPtr(new FakeFloatTransition(1, 0, 1)), id, CCActiveAnimation::Opacity));
+    controller->add(createActiveAnimation(adoptPtr(new FakeFloatTransition(1, 0, 1)), id, CCActiveAnimation::Opacity));
 
-    controller->animate(0);
+    controller->animate(0, *events);
     EXPECT_TRUE(controller->hasActiveAnimation());
     EXPECT_EQ(0, dummy.opacity());
-    controller->animate(0.5);
+    controller->animate(0.5, *events);
     EXPECT_TRUE(controller->hasActiveAnimation());
     EXPECT_EQ(0.5f, dummy.opacity());
 
     EXPECT_TRUE(controller->getActiveAnimation(id, CCActiveAnimation::Opacity));
     controller->getActiveAnimation(id, CCActiveAnimation::Opacity)->setRunState(CCActiveAnimation::Paused, 0.5f);
 
-    controller->animate(1024);
+    controller->animate(1024, *events);
     EXPECT_TRUE(controller->hasActiveAnimation());
     EXPECT_EQ(0.5f, dummy.opacity());
 
     EXPECT_TRUE(controller->getActiveAnimation(id, CCActiveAnimation::Opacity));
     controller->getActiveAnimation(id, CCActiveAnimation::Opacity)->setRunState(CCActiveAnimation::Running, 1024);
 
-    controller->animate(1024.25);
+    controller->animate(1024.25, *events);
     EXPECT_TRUE(controller->hasActiveAnimation());
     EXPECT_EQ(0.75f, dummy.opacity());
-    controller->animate(1024.5);
+    controller->animate(1024.5, *events);
     EXPECT_FALSE(controller->hasActiveAnimation());
     EXPECT_EQ(1, dummy.opacity());
 }
 
 TEST(CCLayerAnimationControllerImplTest, AbortAGroupedAnimation)
 {
-    FakeControllerClient dummy;
+    OwnPtr<CCAnimationEventsVector> events(adoptPtr(new CCAnimationEventsVector));
+    FakeLayerAnimationControllerImplClient dummy;
     OwnPtr<CCLayerAnimationControllerImpl> controller(
         CCLayerAnimationControllerImpl::create(&dummy));
 
     const int id = 1;
-    controller->add(CCActiveAnimation::create(adoptPtr(new FakeTransformTransition(1)), id, CCActiveAnimation::Transform));
-    controller->add(CCActiveAnimation::create(adoptPtr(new FakeFloatTransition(2, 0, 1)), id, CCActiveAnimation::Opacity));
-    controller->add(CCActiveAnimation::create(adoptPtr(new FakeFloatTransition(1, 1, 0.75f)), 2, CCActiveAnimation::Opacity));
+    controller->add(createActiveAnimation(adoptPtr(new FakeTransformTransition(1)), id, CCActiveAnimation::Transform));
+    controller->add(createActiveAnimation(adoptPtr(new FakeFloatTransition(2, 0, 1)), id, CCActiveAnimation::Opacity));
+    controller->add(createActiveAnimation(adoptPtr(new FakeFloatTransition(1, 1, 0.75f)), 2, CCActiveAnimation::Opacity));
 
-    controller->animate(0);
+    controller->animate(0, *events);
     EXPECT_TRUE(controller->hasActiveAnimation());
     EXPECT_EQ(0, dummy.opacity());
-    controller->animate(1);
+    controller->animate(1, *events);
     EXPECT_TRUE(controller->hasActiveAnimation());
     EXPECT_EQ(0.5f, dummy.opacity());
 
     EXPECT_TRUE(controller->getActiveAnimation(id, CCActiveAnimation::Opacity));
     controller->getActiveAnimation(id, CCActiveAnimation::Opacity)->setRunState(CCActiveAnimation::Aborted, 1);
-    controller->animate(1);
+    controller->animate(1, *events);
     EXPECT_TRUE(controller->hasActiveAnimation());
     EXPECT_EQ(1, dummy.opacity());
-    controller->animate(2);
+    controller->animate(2, *events);
     EXPECT_TRUE(!controller->hasActiveAnimation());
     EXPECT_EQ(0.75f, dummy.opacity());
 }
 
-// Tests that adding an animation to the controller calls the appropriate callback on the controller client
-// (in this case, adding the controller to the list of active controller).
-TEST(CCLayerAnimationControllerImplTest, DidActivate)
-{
-    FakeControllerClient dummy;
-    OwnPtr<CCLayerAnimationControllerImpl> controller(
-        CCLayerAnimationControllerImpl::create(&dummy));
-
-    EXPECT_EQ(size_t(0), dummy.activeControllers().size());
-
-    controller->add(CCActiveAnimation::create(adoptPtr(new FakeFloatTransition(1, 0, 1)), 1, CCActiveAnimation::Opacity));
-
-    EXPECT_EQ(size_t(1), dummy.activeControllers().size());
-    EXPECT_EQ(controller.get(), dummy.activeControllers()[0]);
-}
-
 } // namespace
diff --git a/Source/WebKit/chromium/tests/CCLayerAnimationControllerTest.cpp b/Source/WebKit/chromium/tests/CCLayerAnimationControllerTest.cpp
new file mode 100644
index 000000000..c4f103a3c
--- /dev/null
+++ b/Source/WebKit/chromium/tests/CCLayerAnimationControllerTest.cpp
@@ -0,0 +1,215 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#include "cc/CCLayerAnimationController.h"
+
+#include "CCAnimationTestCommon.h"
+#include "GraphicsLayer.h"
+#include "Length.h"
+#include "TranslateTransformOperation.h"
+#include "cc/CCActiveAnimation.h"
+#include "cc/CCAnimationCurve.h"
+
+#include <gmock/gmock.h>
+#include <gtest/gtest.h>
+#include <wtf/Vector.h>
+
+using namespace WebCore;
+using namespace WebKitTests;
+
+namespace {
+
+void expectTranslateX(double translateX, const TransformationMatrix& matrix)
+{
+    TransformationMatrix::DecomposedType decomposedType;
+    matrix.decompose(decomposedType);
+    EXPECT_FLOAT_EQ(translateX, decomposedType.translateX);
+}
+
+PassOwnPtr<CCActiveAnimation> createActiveAnimation(PassOwnPtr<CCAnimationCurve> curve, int id, CCActiveAnimation::TargetProperty property)
+{
+    return CCActiveAnimation::create(curve, 0, id, property);
+}
+
+TEST(CCLayerAnimationControllerTest, createOpacityAnimation)
+{
+    OwnPtr<CCLayerAnimationController> controller(CCLayerAnimationController::create());
+    const double duration = 1;
+    WebCore::KeyframeValueList values(AnimatedPropertyOpacity);
+    values.insert(new FloatAnimationValue(0, 0));
+    values.insert(new FloatAnimationValue(duration, 1));
+
+    RefPtr<Animation> animation = Animation::create();
+    animation->setDuration(duration);
+
+    IntSize boxSize;
+    controller->addAnimation(values, boxSize, animation.get(), 0, 0, 0);
+
+    EXPECT_TRUE(controller->hasActiveAnimation());
+
+    CCActiveAnimation* activeAnimation = controller->getActiveAnimation(0, CCActiveAnimation::Opacity);
+    EXPECT_TRUE(activeAnimation);
+
+    EXPECT_EQ(1, activeAnimation->iterations());
+    EXPECT_EQ(CCActiveAnimation::Opacity, activeAnimation->targetProperty());
+
+    EXPECT_EQ(CCAnimationCurve::Float, activeAnimation->curve()->type());
+
+    const CCFloatAnimationCurve* curve = activeAnimation->curve()->toFloatAnimationCurve();
+    EXPECT_TRUE(curve);
+
+    EXPECT_EQ(0, curve->getValue(0));
+    EXPECT_EQ(1, curve->getValue(duration));
+}
+
+TEST(CCLayerAnimationControllerTest, createTransformAnimation)
+{
+    OwnPtr<CCLayerAnimationController> controller(CCLayerAnimationController::create());
+    const double duration = 1;
+    WebCore::KeyframeValueList values(AnimatedPropertyWebkitTransform);
+
+    TransformOperations operations1;
+    operations1.operations().append(TranslateTransformOperation::create(Length(2, Fixed), Length(0, Fixed), TransformOperation::TRANSLATE_X));
+    values.insert(new TransformAnimationValue(0, &operations1));
+
+    TransformOperations operations2;
+    operations2.operations().append(TranslateTransformOperation::create(Length(4, Fixed), Length(0, Fixed), TransformOperation::TRANSLATE_X));
+    values.insert(new TransformAnimationValue(duration, &operations2));
+
+    RefPtr<Animation> animation = Animation::create();
+    animation->setDuration(duration);
+
+    IntSize boxSize;
+    controller->addAnimation(values, boxSize, animation.get(), 0, 0, 0);
+
+    EXPECT_TRUE(controller->hasActiveAnimation());
+
+    CCActiveAnimation* activeAnimation = controller->getActiveAnimation(0, CCActiveAnimation::Transform);
+    EXPECT_TRUE(activeAnimation);
+
+    EXPECT_EQ(1, activeAnimation->iterations());
+    EXPECT_EQ(CCActiveAnimation::Transform, activeAnimation->targetProperty());
+
+    EXPECT_EQ(CCAnimationCurve::Transform, activeAnimation->curve()->type());
+
+    const CCTransformAnimationCurve* curve = activeAnimation->curve()->toTransformAnimationCurve();
+    EXPECT_TRUE(curve);
+
+    expectTranslateX(2, curve->getValue(0, boxSize));
+    expectTranslateX(4, curve->getValue(duration, boxSize));
+}
+
+TEST(CCLayerAnimationControllerTest, syncNewAnimation)
+{
+    FakeLayerAnimationControllerImplClient dummy;
+    OwnPtr<CCLayerAnimationControllerImpl> controllerImpl(CCLayerAnimationControllerImpl::create(&dummy));
+    OwnPtr<CCLayerAnimationController> controller(CCLayerAnimationController::create());
+
+    EXPECT_FALSE(controllerImpl->getActiveAnimation(0, CCActiveAnimation::Opacity));
+
+    addOpacityTransitionToController(*controller, 1, 0, 1);
+
+    controller->synchronizeAnimations(controllerImpl.get());
+
+    EXPECT_TRUE(controllerImpl->getActiveAnimation(0, CCActiveAnimation::Opacity));
+    EXPECT_EQ(CCActiveAnimation::WaitingForTargetAvailability, controllerImpl->getActiveAnimation(0, CCActiveAnimation::Opacity)->runState());
+}
+
+TEST(CCLayerAnimationControllerTest, syncAnimationProperties)
+{
+    FakeLayerAnimationControllerImplClient dummy;
+    OwnPtr<CCLayerAnimationControllerImpl> controllerImpl(CCLayerAnimationControllerImpl::create(&dummy));
+    OwnPtr<CCLayerAnimationController> controller(CCLayerAnimationController::create());
+
+    EXPECT_FALSE(controllerImpl->getActiveAnimation(0, CCActiveAnimation::Opacity));
+
+    addOpacityTransitionToController(*controller, 1, 0, 1);
+
+    controller->synchronizeAnimations(controllerImpl.get());
+
+    EXPECT_TRUE(controllerImpl->getActiveAnimation(0, CCActiveAnimation::Opacity));
+    EXPECT_EQ(CCActiveAnimation::WaitingForTargetAvailability, controllerImpl->getActiveAnimation(0, CCActiveAnimation::Opacity)->runState());
+
+    // Push an animation property change to the impl thread (should not cause an animation to be added).
+    controller->pauseAnimation(0, 0);
+    controller->synchronizeAnimations(controllerImpl.get());
+
+    EXPECT_TRUE(controllerImpl->getActiveAnimation(0, CCActiveAnimation::Opacity));
+    EXPECT_EQ(CCActiveAnimation::Paused, controllerImpl->getActiveAnimation(0, CCActiveAnimation::Opacity)->runState());
+}
+
+TEST(CCLayerAnimationControllerTest, syncAbortedAnimation)
+{
+    FakeLayerAnimationControllerImplClient dummy;
+    OwnPtr<CCLayerAnimationControllerImpl> controllerImpl(CCLayerAnimationControllerImpl::create(&dummy));
+    OwnPtr<CCLayerAnimationController> controller(CCLayerAnimationController::create());
+
+    EXPECT_FALSE(controllerImpl->getActiveAnimation(0, CCActiveAnimation::Opacity));
+
+    addOpacityTransitionToController(*controller, 1, 0, 1);
+
+    controller->synchronizeAnimations(controllerImpl.get());
+
+    EXPECT_TRUE(controllerImpl->getActiveAnimation(0, CCActiveAnimation::Opacity));
+    EXPECT_EQ(CCActiveAnimation::WaitingForTargetAvailability, controllerImpl->getActiveAnimation(0, CCActiveAnimation::Opacity)->runState());
+
+    controller->removeAnimation(0);
+
+    // Abort an animation from the main thread.
+    controller->synchronizeAnimations(controllerImpl.get());
+
+    EXPECT_FALSE(controllerImpl->getActiveAnimation(0, CCActiveAnimation::Opacity));
+}
+
+TEST(CCLayerAnimationControllerTest, syncCompletedAnimation)
+{
+    FakeLayerAnimationControllerImplClient dummy;
+    OwnPtr<CCLayerAnimationControllerImpl> controllerImpl(CCLayerAnimationControllerImpl::create(&dummy));
+    OwnPtr<CCLayerAnimationController> controller(CCLayerAnimationController::create());
+
+    EXPECT_FALSE(controllerImpl->getActiveAnimation(0, CCActiveAnimation::Opacity));
+
+    addOpacityTransitionToController(*controller, 1, 0, 1);
+
+    controller->synchronizeAnimations(controllerImpl.get());
+
+    EXPECT_TRUE(controllerImpl->getActiveAnimation(0, CCActiveAnimation::Opacity));
+    EXPECT_EQ(CCActiveAnimation::WaitingForTargetAvailability, controllerImpl->getActiveAnimation(0, CCActiveAnimation::Opacity)->runState());
+
+    // Step through the animation until it is finished. At the next sync, the main thread's animation should be cleared.
+    OwnPtr<CCAnimationEventsVector> events(adoptPtr(new CCAnimationEventsVector));
+    controllerImpl->animate(0, *events);
+    controllerImpl->animate(2, *events);
+
+    EXPECT_FALSE(controllerImpl->getActiveAnimation(0, CCActiveAnimation::Opacity));
+    EXPECT_TRUE(controller->hasActiveAnimation());
+
+    controller->synchronizeAnimations(controllerImpl.get());
+
+    EXPECT_FALSE(controller->hasActiveAnimation());
+}
+
+} // namespace
diff --git a/Source/WebKit/chromium/tests/CCLayerImplTest.cpp b/Source/WebKit/chromium/tests/CCLayerImplTest.cpp
index 27728cbef..16a25e12e 100644
--- a/Source/WebKit/chromium/tests/CCLayerImplTest.cpp
+++ b/Source/WebKit/chromium/tests/CCLayerImplTest.cpp
@@ -88,10 +88,13 @@ TEST(CCLayerImplTest, verifyLayerChangesAreTrackedProperly)
     Color arbitraryColor = Color(10, 20, 30);
     TransformationMatrix arbitraryTransform;
     arbitraryTransform.scale3d(0.1, 0.2, 0.3);
+    FilterOperations arbitraryFilters;
+    arbitraryFilters.operations().append(BasicComponentTransferFilterOperation::create(0.5, FilterOperation::OPACITY));
 
     // Changing these properties affects the entire subtree of layers.
     EXECUTE_AND_VERIFY_SUBTREE_CHANGED(root->setAnchorPoint(arbitraryFloatPoint));
     EXECUTE_AND_VERIFY_SUBTREE_CHANGED(root->setAnchorPointZ(arbitraryNumber));
+    EXECUTE_AND_VERIFY_SUBTREE_CHANGED(root->setFilters(arbitraryFilters));
     EXECUTE_AND_VERIFY_SUBTREE_CHANGED(root->setMaskLayer(dummyMask));
     EXECUTE_AND_VERIFY_SUBTREE_CHANGED(root->setMasksToBounds(true));
     EXECUTE_AND_VERIFY_SUBTREE_CHANGED(root->setOpaque(true));
diff --git a/Source/WebKit/chromium/tests/CCLayerTreeHostCommonTest.cpp b/Source/WebKit/chromium/tests/CCLayerTreeHostCommonTest.cpp
index b1fa72918..d2e1cfef9 100644
--- a/Source/WebKit/chromium/tests/CCLayerTreeHostCommonTest.cpp
+++ b/Source/WebKit/chromium/tests/CCLayerTreeHostCommonTest.cpp
@@ -28,7 +28,6 @@
 
 #include "CCLayerTreeTestCommon.h"
 #include "LayerChromium.h"
-#include "Region.h"
 #include "TransformationMatrix.h"
 
 #include <gmock/gmock.h>
@@ -36,12 +35,6 @@
 
 using namespace WebCore;
 
-#define EXPECT_EQ_RECT(a, b) \
-    EXPECT_EQ(a.x(), b.x()); \
-    EXPECT_EQ(a.y(), b.y()); \
-    EXPECT_EQ(a.width(), b.width()); \
-    EXPECT_EQ(a.height(), b.height());
-
 namespace {
 
 void setLayerPropertiesForTesting(LayerChromium* layer, const TransformationMatrix& transform, const TransformationMatrix& sublayerTransform, const FloatPoint& anchor, const FloatPoint& position, const IntSize& bounds, bool preserves3D)
@@ -602,174 +595,4 @@ TEST(CCLayerTreeHostCommonTest, verifyClipRectCullsRenderSurfaces)
 //  - test the other functions in CCLayerTreeHostCommon
 //
 
-TEST(CCLayerTreeHostCommonTest, layerAddsSelfToOccludedRegion)
-{
-    // This tests that the right transforms are being used.
-    Region occluded;
-    const TransformationMatrix identityMatrix;
-    RefPtr<LayerChromium> parent = LayerChromium::create();
-    RefPtr<LayerChromiumWithForcedDrawsContent> layer = adoptRef(new LayerChromiumWithForcedDrawsContent());
-    parent->createRenderSurface();
-    parent->addChild(layer);
-
-    setLayerPropertiesForTesting(parent.get(), identityMatrix, identityMatrix, FloatPoint(0, 0), FloatPoint(0, 0), IntSize(100, 100), false);
-    setLayerPropertiesForTesting(layer.get(), identityMatrix, identityMatrix, FloatPoint(0, 0), FloatPoint(30, 30), IntSize(500, 500), false);
-
-    layer->setOpaque(true);
-
-    Vector<RefPtr<LayerChromium> > renderSurfaceLayerList;
-    Vector<RefPtr<LayerChromium> > dummyLayerList;
-    int dummyMaxTextureSize = 512;
-
-    // FIXME: when we fix this "root-layer special case" behavior in CCLayerTreeHost, we will have to fix it here, too.
-    parent->renderSurface()->setContentRect(IntRect(IntPoint::zero(), parent->bounds()));
-    parent->setClipRect(IntRect(IntPoint::zero(), parent->bounds()));
-    renderSurfaceLayerList.append(parent);
-
-    CCLayerTreeHostCommon::calculateDrawTransformsAndVisibility(parent.get(), parent.get(), identityMatrix, identityMatrix, renderSurfaceLayerList, dummyLayerList, dummyMaxTextureSize);
-
-    occluded = Region();
-    layer->addSelfToOccludedScreenSpace(occluded);
-    EXPECT_EQ_RECT(IntRect(30, 30, 70, 70), occluded.bounds());
-    EXPECT_EQ(1u, occluded.rects().size());
-}
-
-TEST(CCLayerTreeHostCommonTest, layerAddsSelfToOccludedRegionWithRotation)
-{
-    // This tests that the right transforms are being used.
-    Region occluded;
-    const TransformationMatrix identityMatrix;
-    RefPtr<LayerChromium> parent = LayerChromium::create();
-    RefPtr<LayerChromiumWithForcedDrawsContent> layer = adoptRef(new LayerChromiumWithForcedDrawsContent());
-    parent->createRenderSurface();
-    parent->addChild(layer);
-
-    TransformationMatrix layerTransform;
-    layerTransform.translate(250, 250);
-    layerTransform.rotate(90);
-    layerTransform.translate(-250, -250);
-
-    setLayerPropertiesForTesting(parent.get(), identityMatrix, identityMatrix, FloatPoint(0, 0), FloatPoint(0, 0), IntSize(100, 100), false);
-    setLayerPropertiesForTesting(layer.get(), layerTransform, identityMatrix, FloatPoint(0, 0), FloatPoint(30, 30), IntSize(500, 500), false);
-
-    layer->setOpaque(true);
-
-    Vector<RefPtr<LayerChromium> > renderSurfaceLayerList;
-    Vector<RefPtr<LayerChromium> > dummyLayerList;
-    int dummyMaxTextureSize = 512;
-
-    // FIXME: when we fix this "root-layer special case" behavior in CCLayerTreeHost, we will have to fix it here, too.
-    parent->renderSurface()->setContentRect(IntRect(IntPoint::zero(), parent->bounds()));
-    parent->setClipRect(IntRect(IntPoint::zero(), parent->bounds()));
-    renderSurfaceLayerList.append(parent);
-
-    CCLayerTreeHostCommon::calculateDrawTransformsAndVisibility(parent.get(), parent.get(), identityMatrix, identityMatrix, renderSurfaceLayerList, dummyLayerList, dummyMaxTextureSize);
-
-    occluded = Region();
-    layer->addSelfToOccludedScreenSpace(occluded);
-    EXPECT_EQ_RECT(IntRect(30, 30, 70, 70), occluded.bounds());
-    EXPECT_EQ(1u, occluded.rects().size());
-}
-
-TEST(CCLayerTreeHostCommonTest, layerAddsSelfToOccludedRegionWithTranslation)
-{
-    // This tests that the right transforms are being used.
-    Region occluded;
-    const TransformationMatrix identityMatrix;
-    RefPtr<LayerChromium> parent = LayerChromium::create();
-    RefPtr<LayerChromiumWithForcedDrawsContent> layer = adoptRef(new LayerChromiumWithForcedDrawsContent());
-    parent->createRenderSurface();
-    parent->addChild(layer);
-
-    TransformationMatrix layerTransform;
-    layerTransform.translate(20, 20);
-
-    setLayerPropertiesForTesting(parent.get(), identityMatrix, identityMatrix, FloatPoint(0, 0), FloatPoint(0, 0), IntSize(100, 100), false);
-    setLayerPropertiesForTesting(layer.get(), layerTransform, identityMatrix, FloatPoint(0, 0), FloatPoint(30, 30), IntSize(500, 500), false);
-
-    layer->setOpaque(true);
-
-    Vector<RefPtr<LayerChromium> > renderSurfaceLayerList;
-    Vector<RefPtr<LayerChromium> > dummyLayerList;
-    int dummyMaxTextureSize = 512;
-
-    // FIXME: when we fix this "root-layer special case" behavior in CCLayerTreeHost, we will have to fix it here, too.
-    parent->renderSurface()->setContentRect(IntRect(IntPoint::zero(), parent->bounds()));
-    parent->setClipRect(IntRect(IntPoint::zero(), parent->bounds()));
-    renderSurfaceLayerList.append(parent);
-
-    CCLayerTreeHostCommon::calculateDrawTransformsAndVisibility(parent.get(), parent.get(), identityMatrix, identityMatrix, renderSurfaceLayerList, dummyLayerList, dummyMaxTextureSize);
-
-    occluded = Region();
-    layer->addSelfToOccludedScreenSpace(occluded);
-    EXPECT_EQ_RECT(IntRect(50, 50, 50, 50), occluded.bounds());
-    EXPECT_EQ(1u, occluded.rects().size());
-}
-
-TEST(CCLayerTreeHostCommonTest, layerAddsSelfToOccludedRegionWithRotatedSurface)
-{
-    // This tests that the right transforms are being used.
-    Region occluded;
-    const TransformationMatrix identityMatrix;
-    RefPtr<LayerChromium> parent = LayerChromium::create();
-    RefPtr<LayerChromium> child = LayerChromium::create();
-    RefPtr<LayerChromiumWithForcedDrawsContent> layer = adoptRef(new LayerChromiumWithForcedDrawsContent());
-    parent->createRenderSurface();
-    parent->addChild(child);
-    child->addChild(layer);
-
-    TransformationMatrix childTransform;
-    childTransform.translate(250, 250);
-    childTransform.rotate(90);
-    childTransform.translate(-250, -250);
-
-    setLayerPropertiesForTesting(parent.get(), identityMatrix, identityMatrix, FloatPoint(0, 0), FloatPoint(0, 0), IntSize(100, 100), false);
-    setLayerPropertiesForTesting(child.get(), childTransform, identityMatrix, FloatPoint(0, 0), FloatPoint(30, 30), IntSize(500, 500), false);
-    setLayerPropertiesForTesting(layer.get(), identityMatrix, identityMatrix, FloatPoint(0, 0), FloatPoint(10, 10), IntSize(500, 500), false);
-
-    child->setMasksToBounds(true);
-    layer->setOpaque(true);
-
-    Vector<RefPtr<LayerChromium> > renderSurfaceLayerList;
-    Vector<RefPtr<LayerChromium> > dummyLayerList;
-    int dummyMaxTextureSize = 512;
-
-    // FIXME: when we fix this "root-layer special case" behavior in CCLayerTreeHost, we will have to fix it here, too.
-    parent->renderSurface()->setContentRect(IntRect(IntPoint::zero(), parent->bounds()));
-    parent->setClipRect(IntRect(IntPoint::zero(), parent->bounds()));
-    renderSurfaceLayerList.append(parent);
-
-    CCLayerTreeHostCommon::calculateDrawTransformsAndVisibility(parent.get(), parent.get(), identityMatrix, identityMatrix, renderSurfaceLayerList, dummyLayerList, dummyMaxTextureSize);
-
-    occluded = Region();
-    layer->addSelfToOccludedScreenSpace(occluded);
-    EXPECT_EQ_RECT(IntRect(30, 40, 70, 60), occluded.bounds());
-    EXPECT_EQ(1u, occluded.rects().size());
-
-    /* Justification for the above opaque rect from |layer|:
-               100
-      +---------------------+                                      +---------------------+
-      |                     |                                      |                     |30  Visible region of |layer|: /////
-      |    30               |           rotate(90)                 |                     |
-      | 30 + ---------------------------------+                    |     +---------------------------------+
-  100 |    |  10            |                 |            ==>     |     |               |10               |
-      |    |10+---------------------------------+                  |  +---------------------------------+  |
-      |    |  |             |                 | |                  |  |  |///////////////|     420      |  |
-      |    |  |             |                 | |                  |  |  |///////////////|60            |  |
-      |    |  |             |                 | |                  |  |  |///////////////|              |  |
-      +----|--|-------------+                 | |                  +--|--|---------------+              |  |
-           |  |                               | |                   20|10|     70                       |  |
-           |  |                               | |                     |  |                              |  |
-           |  |                               | |500                  |  |                              |  |
-           |  |                               | |                     |  |                              |  |
-           |  |                               | |                     |  |                              |  |
-           |  |                               | |                     |  |                              |  |
-           |  |                               | |                     |  |                              |10|
-           +--|-------------------------------+ |                     |  +------------------------------|--+
-              |                                 |                     |                 490             |
-              +---------------------------------+                     +---------------------------------+
-                             500                                                     500
-     */
-}
-
 } // namespace
diff --git a/Source/WebKit/chromium/tests/CCLayerTreeHostImplTest.cpp b/Source/WebKit/chromium/tests/CCLayerTreeHostImplTest.cpp
index f59893de9..9ba1cf4ad 100644
--- a/Source/WebKit/chromium/tests/CCLayerTreeHostImplTest.cpp
+++ b/Source/WebKit/chromium/tests/CCLayerTreeHostImplTest.cpp
@@ -52,6 +52,7 @@ public:
     virtual void onSwapBuffersCompleteOnImplThread() { }
     virtual void setNeedsRedrawOnImplThread() { m_didRequestRedraw = true; }
     virtual void setNeedsCommitOnImplThread() { m_didRequestCommit = true; }
+    virtual void postAnimationEventsToMainThreadOnImplThread(PassOwnPtr<CCAnimationEventsVector>) { }
 
     static void expectClearedScrollDeltasRecursive(CCLayerImpl* layer)
     {
@@ -67,7 +68,8 @@ public:
         for (size_t i = 0; i < scrollInfo.scrolls.size(); ++i) {
             if (scrollInfo.scrolls[i].layerId != id)
                 continue;
-            ASSERT_EQ(scrollInfo.scrolls[i].scrollDelta, scrollDelta);
+            EXPECT_EQ(scrollDelta.width(), scrollInfo.scrolls[i].scrollDelta.width());
+            EXPECT_EQ(scrollDelta.height(), scrollInfo.scrolls[i].scrollDelta.height());
             timesEncountered++;
         }
 
@@ -89,6 +91,11 @@ public:
     }
 
 protected:
+    PassRefPtr<GraphicsContext3D> createContext()
+    {
+        return GraphicsContext3DPrivate::createGraphicsContextFromWebContext(adoptPtr(new FakeWebGraphicsContext3D()), GraphicsContext3D::RenderDirectlyToHostWindow);
+    }
+
     DebugScopedSetImplThread m_alwaysImplThread;
     OwnPtr<CCLayerTreeHostImpl> m_hostImpl;
     bool m_didRequestCommit;
@@ -142,14 +149,14 @@ TEST_F(CCLayerTreeHostImplTest, scrollDeltaRepeatedScrolls)
     scrollInfo = m_hostImpl->processScrollDeltas();
     ASSERT_EQ(scrollInfo->scrolls.size(), 1u);
     EXPECT_EQ(root->sentScrollDelta(), scrollDelta);
-    expectContains(*scrollInfo.get(), root->id(), scrollDelta);
+    expectContains(*scrollInfo, root->id(), scrollDelta);
 
     IntSize scrollDelta2(-5, 27);
     root->scrollBy(scrollDelta2);
     scrollInfo = m_hostImpl->processScrollDeltas();
     ASSERT_EQ(scrollInfo->scrolls.size(), 1u);
     EXPECT_EQ(root->sentScrollDelta(), scrollDelta + scrollDelta2);
-    expectContains(*scrollInfo.get(), root->id(), scrollDelta + scrollDelta2);
+    expectContains(*scrollInfo, root->id(), scrollDelta + scrollDelta2);
 
     root->scrollBy(IntSize());
     scrollInfo = m_hostImpl->processScrollDeltas();
@@ -163,13 +170,28 @@ TEST_F(CCLayerTreeHostImplTest, scrollRootCallsCommitAndRedraw)
     root->setScrollPosition(IntPoint(0, 0));
     root->setMaxScrollPosition(IntSize(100, 100));
     m_hostImpl->setRootLayer(root);
-    EXPECT_EQ(m_hostImpl->scrollBegin(IntPoint(0, 0)), CCInputHandlerClient::ScrollStarted);
+    EXPECT_EQ(m_hostImpl->scrollBegin(IntPoint(0, 0), CCInputHandlerClient::Wheel), CCInputHandlerClient::ScrollStarted);
     m_hostImpl->scrollBy(IntSize(0, 10));
     m_hostImpl->scrollEnd();
     EXPECT_TRUE(m_didRequestRedraw);
     EXPECT_TRUE(m_didRequestCommit);
 }
 
+TEST_F(CCLayerTreeHostImplTest, wheelEventHandlers)
+{
+    RefPtr<CCLayerImpl> root = CCLayerImpl::create(0);
+    root->setScrollable(true);
+    root->setScrollPosition(IntPoint(0, 0));
+    root->setMaxScrollPosition(IntSize(100, 100));
+    m_hostImpl->setRootLayer(root);
+    root->setHaveWheelEventHandlers(true);
+    // With registered event handlers, wheel scrolls have to go to the main thread.
+    EXPECT_EQ(m_hostImpl->scrollBegin(IntPoint(0, 0), CCInputHandlerClient::Wheel), CCInputHandlerClient::ScrollFailed);
+
+    // But gesture scrolls can still be handled.
+    EXPECT_EQ(m_hostImpl->scrollBegin(IntPoint(0, 0), CCInputHandlerClient::Gesture), CCInputHandlerClient::ScrollStarted);
+}
+
 TEST_F(CCLayerTreeHostImplTest, pinchGesture)
 {
     setupScrollAndContentsLayers(IntSize(100, 100));
@@ -184,6 +206,7 @@ TEST_F(CCLayerTreeHostImplTest, pinchGesture)
     {
         m_hostImpl->setPageScaleFactorAndLimits(1, minPageScale, maxPageScale);
         scrollLayer->setPageScaleDelta(1);
+        scrollLayer->setScrollDelta(IntSize());
 
         float pageScaleDelta = 2;
         m_hostImpl->pinchGestureBegin();
@@ -200,6 +223,7 @@ TEST_F(CCLayerTreeHostImplTest, pinchGesture)
     {
         m_hostImpl->setPageScaleFactorAndLimits(1, minPageScale, maxPageScale);
         scrollLayer->setPageScaleDelta(1);
+        scrollLayer->setScrollDelta(IntSize());
         float pageScaleDelta = 10;
 
         m_hostImpl->pinchGestureBegin();
@@ -214,6 +238,7 @@ TEST_F(CCLayerTreeHostImplTest, pinchGesture)
     {
         m_hostImpl->setPageScaleFactorAndLimits(1, minPageScale, maxPageScale);
         scrollLayer->setPageScaleDelta(1);
+        scrollLayer->setScrollDelta(IntSize());
         scrollLayer->setScrollPosition(IntPoint(50, 50));
 
         float pageScaleDelta = 0.1;
@@ -225,7 +250,25 @@ TEST_F(CCLayerTreeHostImplTest, pinchGesture)
         EXPECT_EQ(scrollInfo->pageScaleDelta, minPageScale);
 
         // Pushed to (0,0) via clamping against contents layer size.
-        expectContains(*scrollInfo.get(), scrollLayer->id(), IntSize(-50, -50));
+        expectContains(*scrollInfo, scrollLayer->id(), IntSize(-50, -50));
+    }
+
+    // Two-finger panning
+    {
+        m_hostImpl->setPageScaleFactorAndLimits(1, minPageScale, maxPageScale);
+        scrollLayer->setPageScaleDelta(1);
+        scrollLayer->setScrollDelta(IntSize());
+        scrollLayer->setScrollPosition(IntPoint(20, 20));
+
+        float pageScaleDelta = 1;
+        m_hostImpl->pinchGestureBegin();
+        m_hostImpl->pinchGestureUpdate(pageScaleDelta, IntPoint(10, 10));
+        m_hostImpl->pinchGestureUpdate(pageScaleDelta, IntPoint(20, 20));
+        m_hostImpl->pinchGestureEnd();
+
+        OwnPtr<CCScrollAndScaleSet> scrollInfo = m_hostImpl->processScrollDeltas();
+        EXPECT_EQ(scrollInfo->pageScaleDelta, pageScaleDelta);
+        expectContains(*scrollInfo, scrollLayer->id(), IntSize(-10, -10));
     }
 }
 
@@ -255,7 +298,7 @@ TEST_F(CCLayerTreeHostImplTest, pageScaleAnimation)
 
         OwnPtr<CCScrollAndScaleSet> scrollInfo = m_hostImpl->processScrollDeltas();
         EXPECT_EQ(scrollInfo->pageScaleDelta, 2);
-        expectContains(*scrollInfo.get(), scrollLayer->id(), IntSize(-50, -50));
+        expectContains(*scrollInfo, scrollLayer->id(), IntSize(-50, -50));
     }
 
     // Anchor zoom-out
@@ -272,8 +315,107 @@ TEST_F(CCLayerTreeHostImplTest, pageScaleAnimation)
         OwnPtr<CCScrollAndScaleSet> scrollInfo = m_hostImpl->processScrollDeltas();
         EXPECT_EQ(scrollInfo->pageScaleDelta, minPageScale);
         // Pushed to (0,0) via clamping against contents layer size.
-        expectContains(*scrollInfo.get(), scrollLayer->id(), IntSize(-50, -50));
+        expectContains(*scrollInfo, scrollLayer->id(), IntSize(-50, -50));
+    }
+}
+
+class DidDrawCheckLayer : public CCLayerImpl {
+public:
+    static PassRefPtr<DidDrawCheckLayer> create(int id) { return adoptRef(new DidDrawCheckLayer(id)); }
+
+    virtual void didDraw()
+    {
+        m_didDrawCalled = true;
+    }
+
+    virtual void willDraw(LayerRendererChromium*)
+    {
+        m_willDrawCalled = true;
+    }
+
+    bool didDrawCalled() const { return m_didDrawCalled; }
+    bool willDrawCalled() const { return m_willDrawCalled; }
+
+private:
+    explicit DidDrawCheckLayer(int id)
+        : CCLayerImpl(id)
+        , m_didDrawCalled(false)
+        , m_willDrawCalled(false)
+    {
+        setAnchorPoint(FloatPoint(0, 0));
+        setBounds(IntSize(10, 10));
+        setDrawsContent(true);
     }
+
+    bool m_didDrawCalled;
+    bool m_willDrawCalled;
+};
+
+TEST_F(CCLayerTreeHostImplTest, didDrawNotCalledOnHiddenLayer)
+{
+    RefPtr<GraphicsContext3D> context = createContext();
+    m_hostImpl->initializeLayerRenderer(context);
+
+    // Ensure visibleLayerRect for root layer is empty
+    m_hostImpl->setViewportSize(IntSize(0, 0));
+
+    RefPtr<DidDrawCheckLayer> root = DidDrawCheckLayer::create(0);
+    m_hostImpl->setRootLayer(root);
+
+    EXPECT_FALSE(root->willDrawCalled());
+    EXPECT_FALSE(root->didDrawCalled());
+
+    m_hostImpl->drawLayers();
+
+    EXPECT_FALSE(root->willDrawCalled());
+    EXPECT_FALSE(root->didDrawCalled());
+
+    EXPECT_TRUE(root->visibleLayerRect().isEmpty());
+
+    // Ensure visibleLayerRect for root layer is not empty
+    m_hostImpl->setViewportSize(IntSize(10, 10));
+
+    EXPECT_FALSE(root->willDrawCalled());
+    EXPECT_FALSE(root->didDrawCalled());
+
+    m_hostImpl->drawLayers();
+
+    EXPECT_TRUE(root->willDrawCalled());
+    EXPECT_TRUE(root->didDrawCalled());
+
+    EXPECT_FALSE(root->visibleLayerRect().isEmpty());
+}
+
+TEST_F(CCLayerTreeHostImplTest, didDrawCalledOnAllLayers)
+{
+    RefPtr<GraphicsContext3D> context = createContext();
+    m_hostImpl->initializeLayerRenderer(context);
+    m_hostImpl->setViewportSize(IntSize(10, 10));
+
+    RefPtr<DidDrawCheckLayer> root = DidDrawCheckLayer::create(0);
+    m_hostImpl->setRootLayer(root);
+
+    RefPtr<DidDrawCheckLayer> layer1 = DidDrawCheckLayer::create(1);
+    root->addChild(layer1);
+
+    RefPtr<DidDrawCheckLayer> layer2 = DidDrawCheckLayer::create(2);
+    layer1->addChild(layer2);
+
+    layer1->setOpacity(0.3);
+    layer1->setPreserves3D(false);
+
+    EXPECT_FALSE(root->didDrawCalled());
+    EXPECT_FALSE(layer1->didDrawCalled());
+    EXPECT_FALSE(layer2->didDrawCalled());
+
+    m_hostImpl->drawLayers();
+
+    EXPECT_TRUE(root->didDrawCalled());
+    EXPECT_TRUE(layer1->didDrawCalled());
+    EXPECT_TRUE(layer2->didDrawCalled());
+
+    EXPECT_NE(root->renderSurface(), layer1->renderSurface());
+    EXPECT_TRUE(!!layer1->renderSurface());
 }
 
 class BlendStateTrackerContext: public FakeWebGraphicsContext3D {
@@ -347,8 +489,7 @@ private:
 // https://bugs.webkit.org/show_bug.cgi?id=75783
 TEST_F(CCLayerTreeHostImplTest, blendingOffWhenDrawingOpaqueLayers)
 {
-    GraphicsContext3D::Attributes attrs;
-    RefPtr<GraphicsContext3D> context = GraphicsContext3DPrivate::createGraphicsContextFromWebContext(adoptPtr(new BlendStateTrackerContext()), attrs, 0, GraphicsContext3D::RenderDirectlyToHostWindow, GraphicsContext3DPrivate::ForUseOnThisThread);
+    RefPtr<GraphicsContext3D> context = createContext();
     m_hostImpl->initializeLayerRenderer(context);
     m_hostImpl->setViewportSize(IntSize(10, 10));
 
@@ -507,7 +648,6 @@ private:
 class FakeDrawableCCLayerImpl: public CCLayerImpl {
 public:
     explicit FakeDrawableCCLayerImpl(int id) : CCLayerImpl(id) { }
-    virtual void draw(LayerRendererChromium* renderer) { }
 };
 
 // Only reshape when we know we are going to draw. Otherwise, the reshape
@@ -515,9 +655,8 @@ public:
 // viewport size is never set.
 TEST_F(CCLayerTreeHostImplTest, reshapeNotCalledUntilDraw)
 {
-    GraphicsContext3D::Attributes attrs;
     ReshapeTrackerContext* reshapeTracker = new ReshapeTrackerContext();
-    RefPtr<GraphicsContext3D> context = GraphicsContext3DPrivate::createGraphicsContextFromWebContext(adoptPtr(reshapeTracker), attrs, 0, GraphicsContext3D::RenderDirectlyToHostWindow, GraphicsContext3DPrivate::ForUseOnThisThread);
+    RefPtr<GraphicsContext3D> context = GraphicsContext3DPrivate::createGraphicsContextFromWebContext(adoptPtr(reshapeTracker), GraphicsContext3D::RenderDirectlyToHostWindow);
     m_hostImpl->initializeLayerRenderer(context);
     m_hostImpl->setViewportSize(IntSize(10, 10));
 
@@ -559,9 +698,8 @@ private:
 // where it should request to swap only the subBuffer that is damaged.
 TEST_F(CCLayerTreeHostImplTest, partialSwapReceivesDamageRect)
 {
-    GraphicsContext3D::Attributes attrs;
     PartialSwapTrackerContext* partialSwapTracker = new PartialSwapTrackerContext();
-    RefPtr<GraphicsContext3D> context = GraphicsContext3DPrivate::createGraphicsContextFromWebContext(adoptPtr(partialSwapTracker), attrs, 0, GraphicsContext3D::RenderDirectlyToHostWindow, GraphicsContext3DPrivate::ForUseOnThisThread);
+    RefPtr<GraphicsContext3D> context = GraphicsContext3DPrivate::createGraphicsContextFromWebContext(adoptPtr(partialSwapTracker), GraphicsContext3D::RenderDirectlyToHostWindow);
 
     // This test creates its own CCLayerTreeHostImpl, so
     // that we can force partial swap enabled.
diff --git a/Source/WebKit/chromium/tests/CCLayerTreeHostTest.cpp b/Source/WebKit/chromium/tests/CCLayerTreeHostTest.cpp
index fc414f739..10cfa6931 100644
--- a/Source/WebKit/chromium/tests/CCLayerTreeHostTest.cpp
+++ b/Source/WebKit/chromium/tests/CCLayerTreeHostTest.cpp
@@ -26,14 +26,18 @@
 
 #include "cc/CCLayerTreeHost.h"
 
+#include "CCAnimationTestCommon.h"
 #include "CompositorFakeWebGraphicsContext3D.h"
 #include "ContentLayerChromium.h"
+#include "FilterOperations.h"
 #include "GraphicsContext3DPrivate.h"
 #include "LayerChromium.h"
 #include "Region.h"
 #include "TextureManager.h"
 #include "WebCompositor.h"
 #include "WebKit.h"
+#include "cc/CCActiveAnimation.h"
+#include "cc/CCLayerAnimationController.h"
 #include "cc/CCLayerImpl.h"
 #include "cc/CCLayerTreeHostImpl.h"
 #include "cc/CCScopedThreadProxy.h"
@@ -49,6 +53,7 @@
 
 using namespace WebCore;
 using namespace WebKit;
+using namespace WebKitTests;
 using namespace WTF;
 
 namespace {
@@ -59,6 +64,7 @@ public:
     virtual void beginCommitOnCCThread(CCLayerTreeHostImpl*) { }
     virtual void commitCompleteOnCCThread(CCLayerTreeHostImpl*) { }
     virtual void drawLayersOnCCThread(CCLayerTreeHostImpl*) { }
+    virtual void animateLayers(CCLayerTreeHostImpl*) { }
     virtual void applyScrollAndScale(const IntSize&, float) { }
     virtual void updateAnimations(double frameBeginTime) { }
     virtual void layout() { }
@@ -90,6 +96,13 @@ public:
         m_testHooks->drawLayersOnCCThread(this);
     }
 
+protected:
+    virtual void animateLayers(double frameBeginTimeMs)
+    {
+        CCLayerTreeHostImpl::animateLayers(frameBeginTimeMs);
+        m_testHooks->animateLayers(this);
+    }
+
 private:
     MockLayerTreeHostImpl(TestHooks* testHooks, const CCSettings& settings, CCLayerTreeHostImplClient* client)
         : CCLayerTreeHostImpl(settings, client)
@@ -105,7 +118,11 @@ class MockLayerTreeHost : public CCLayerTreeHost {
 public:
     static PassRefPtr<MockLayerTreeHost> create(TestHooks* testHooks, CCLayerTreeHostClient* client, PassRefPtr<LayerChromium> rootLayer, const CCSettings& settings)
     {
-        RefPtr<MockLayerTreeHost> layerTreeHost = adoptRef(new MockLayerTreeHost(testHooks, client, settings));
+        // For these tests, we will enable threaded animations.
+        CCSettings settingsCopy = settings;
+        settingsCopy.threadedAnimationEnabled = true;
+
+        RefPtr<MockLayerTreeHost> layerTreeHost = adoptRef(new MockLayerTreeHost(testHooks, client, settingsCopy));
         bool success = layerTreeHost->initialize();
         EXPECT_TRUE(success);
         layerTreeHost->setRootLayer(rootLayer);
@@ -118,7 +135,10 @@ public:
 
     virtual PassOwnPtr<CCLayerTreeHostImpl> createLayerTreeHostImpl(CCLayerTreeHostImplClient* client)
     {
-        return MockLayerTreeHostImpl::create(m_testHooks, settings(), client);
+        // For these tests, we will enable threaded animations.
+        CCSettings settings;
+        settings.threadedAnimationEnabled = true;
+        return MockLayerTreeHostImpl::create(m_testHooks, settings, client);
     }
 
 private:
@@ -207,10 +227,7 @@ public:
         webAttrs.alpha = attrs.alpha;
 
         OwnPtr<WebGraphicsContext3D> webContext = CompositorFakeWebGraphicsContext3DWithTextureTracking::create(webAttrs);
-        return GraphicsContext3DPrivate::createGraphicsContextFromWebContext(
-            webContext.release(), attrs, 0,
-            GraphicsContext3D::RenderDirectlyToHostWindow,
-            GraphicsContext3DPrivate::ForUseOnAnotherThread);
+        return GraphicsContext3DPrivate::createGraphicsContextFromWebContext(webContext.release(), GraphicsContext3D::RenderDirectlyToHostWindow);
     }
 
     virtual void didCommitAndDrawFrame()
@@ -225,7 +242,9 @@ public:
     {
     }
 
-    virtual void scheduleComposite() { }
+    virtual void scheduleComposite()
+    {
+    }
 
 private:
     explicit MockLayerTreeHostClient(TestHooks* testHooks) : m_testHooks(testHooks) { }
@@ -255,6 +274,11 @@ public:
         callOnMainThread(CCLayerTreeHostTest::dispatchSetNeedsAnimate, this);
     }
 
+    void postAddAnimationToMainThread()
+    {
+        callOnMainThread(CCLayerTreeHostTest::dispatchAddAnimation, this);
+    }
+
     void postSetNeedsCommitToMainThread()
     {
         callOnMainThread(CCLayerTreeHostTest::dispatchSetNeedsCommit, this);
@@ -270,7 +294,6 @@ public:
         callOnMainThread(CCLayerTreeHostTest::dispatchSetNeedsAnimateAndCommit, this);
     }
 
-
     void postSetVisibleToMainThread(bool visible)
     {
         callOnMainThread(visible ? CCLayerTreeHostTest::dispatchSetVisible : CCLayerTreeHostTest::dispatchSetInvisible, this);
@@ -313,6 +336,15 @@ protected:
           test->m_layerTreeHost->setNeedsAnimate();
     }
 
+    static void dispatchAddAnimation(void* self)
+    {
+      ASSERT(isMainThread());
+      CCLayerTreeHostTest* test = static_cast<CCLayerTreeHostTest*>(self);
+      ASSERT(test);
+      if (test->m_layerTreeHost && test->m_layerTreeHost->rootLayer())
+          addOpacityTransitionToLayer(*test->m_layerTreeHost->rootLayer(), 0, 0, 1);
+    }
+
     static void dispatchSetNeedsAnimateAndCommit(void* self)
     {
       ASSERT(isMainThread());
@@ -789,6 +821,47 @@ TEST_F(CCLayerTreeHostTestSetNeedsAnimateInsideAnimationCallback, runMultiThread
     runTestThreaded();
 }
 
+// Add a layer animation and confirm that CCLayerTreeHostImpl::animateLayers does get
+// called and continues to get called.
+class CCLayerTreeHostTestAddAnimation : public CCLayerTreeHostTestThreadOnly {
+public:
+    CCLayerTreeHostTestAddAnimation()
+        : m_numAnimates(0)
+        , m_layerTreeHostImpl(0)
+    {
+    }
+
+    virtual void beginTest()
+    {
+        postAddAnimationToMainThread();
+    }
+
+    virtual void animateLayers(CCLayerTreeHostImpl* layerTreeHostImpl)
+    {
+        if (!m_numAnimates) {
+            // The animation had zero duration so layerTreeHostImpl should no
+            // longer need to animate its layers.
+            EXPECT_FALSE(layerTreeHostImpl->needsAnimateLayers());
+            m_numAnimates++;
+            return;
+        }
+        endTest();
+    }
+
+    virtual void afterTest()
+    {
+    }
+
+private:
+    int m_numAnimates;
+    CCLayerTreeHostImpl* m_layerTreeHostImpl;
+};
+
+TEST_F(CCLayerTreeHostTestAddAnimation, runMultiThread)
+{
+    runTestThreaded();
+}
+
 class CCLayerTreeHostTestScrollSimple : public CCLayerTreeHostTestThreadOnly {
 public:
     CCLayerTreeHostTestScrollSimple()
@@ -938,6 +1011,75 @@ TEST_F(CCLayerTreeHostTestScrollMultipleRedraw, DISABLED_runMultiThread)
     runTestThreaded();
 }
 
+// Verifies that startPageScaleAnimation events propagate correctly from CCLayerTreeHost to
+// CCLayerTreeHostImpl in the MT compositor.
+class CCLayerTreeHostTestStartPageScaleAnimation : public CCLayerTreeHostTest {
+public:
+
+    CCLayerTreeHostTestStartPageScaleAnimation()
+        : m_animationRequested(false)
+    {
+    }
+
+    virtual void beginTest()
+    {
+        m_layerTreeHost->rootLayer()->setScrollable(true);
+        m_layerTreeHost->rootLayer()->setScrollPosition(IntPoint());
+        postSetNeedsRedrawToMainThread();
+    }
+
+    static void requestStartPageScaleAnimation(void* self)
+    {
+        CCLayerTreeHostTestStartPageScaleAnimation* test = static_cast<CCLayerTreeHostTestStartPageScaleAnimation*>(self);
+        if (test->layerTreeHost())
+            test->layerTreeHost()->startPageScaleAnimation(IntSize(), false, 1.25, 0);
+    }
+
+    virtual void drawLayersOnCCThread(CCLayerTreeHostImpl* impl)
+    {
+        impl->rootLayer()->setScrollable(true);
+        impl->rootLayer()->setScrollPosition(IntPoint());
+        impl->setPageScaleFactorAndLimits(impl->pageScale(), 0.5, 2);
+
+        // We request animation only once.
+        if (!m_animationRequested) {
+            callOnMainThread(CCLayerTreeHostTestStartPageScaleAnimation::requestStartPageScaleAnimation, this);
+            m_animationRequested = true;
+        }
+    }
+
+    virtual void applyScrollAndScale(const IntSize& scrollDelta, float scale)
+    {
+        IntPoint position = m_layerTreeHost->rootLayer()->scrollPosition();
+        m_layerTreeHost->rootLayer()->setScrollPosition(position + scrollDelta);
+        m_layerTreeHost->setPageScaleFactorAndLimits(scale, 0.5, 2);
+    }
+
+    virtual void commitCompleteOnCCThread(CCLayerTreeHostImpl* impl)
+    {
+        impl->processScrollDeltas();
+        // We get one commit before the first draw, and the animation doesn't happen until the second draw,
+        // so results available on the third commit.
+        if (impl->frameNumber() == 2) {
+            EXPECT_EQ(1.25, impl->pageScale());
+            endTest();
+        } else
+            postSetNeedsRedrawToMainThread();
+    }
+
+    virtual void afterTest()
+    {
+    }
+
+private:
+    bool m_animationRequested;
+};
+
+TEST_F(CCLayerTreeHostTestStartPageScaleAnimation, runTest)
+{
+    runTest(true);
+}
+
 class CCLayerTreeHostTestSetVisible : public CCLayerTreeHostTest {
 public:
 
@@ -1596,6 +1738,94 @@ public:
 
 SINGLE_AND_MULTI_THREAD_TEST_F(CCLayerTreeHostTestLayerOcclusion)
 
+class CCLayerTreeHostTestLayerOcclusionWithFilters : public CCLayerTreeHostTest {
+public:
+    CCLayerTreeHostTestLayerOcclusionWithFilters() { }
+
+    virtual void beginTest()
+    {
+        RefPtr<TestLayerChromium> rootLayer = TestLayerChromium::create();
+        RefPtr<TestLayerChromium> child = TestLayerChromium::create();
+        RefPtr<TestLayerChromium> child2 = TestLayerChromium::create();
+        RefPtr<TestLayerChromium> grandChild = TestLayerChromium::create();
+        RefPtr<TestLayerChromium> mask = TestLayerChromium::create();
+
+        TransformationMatrix identityMatrix;
+        TransformationMatrix childTransform;
+        childTransform.translate(250, 250);
+        childTransform.rotate(90);
+        childTransform.translate(-250, -250);
+
+        child->setMasksToBounds(true);
+
+        // If the child layer has a filter that changes alpha values, and is below child2, then child2 should contribute to occlusion on everything,
+        // and child shouldn't contribute to the rootLayer
+        setLayerPropertiesForTesting(rootLayer.get(), 0, identityMatrix, FloatPoint(0, 0), FloatPoint(0, 0), IntSize(100, 100), true);
+        setLayerPropertiesForTesting(child.get(), rootLayer.get(), childTransform, FloatPoint(0, 0), FloatPoint(30, 30), IntSize(500, 500), true);
+        setLayerPropertiesForTesting(grandChild.get(), child.get(), identityMatrix, FloatPoint(0, 0), FloatPoint(10, 10), IntSize(500, 500), true);
+        setLayerPropertiesForTesting(child2.get(), rootLayer.get(), identityMatrix, FloatPoint(0, 0), FloatPoint(10, 70), IntSize(500, 500), true);
+
+        {
+            FilterOperations filters;
+            filters.operations().append(BasicComponentTransferFilterOperation::create(0.5, FilterOperation::OPACITY));
+            child->setFilters(filters);
+        }
+
+        m_layerTreeHost->setRootLayer(rootLayer);
+        m_layerTreeHost->setViewportSize(rootLayer->bounds());
+        m_layerTreeHost->updateLayers();
+        m_layerTreeHost->commitComplete();
+
+        EXPECT_EQ_RECT(IntRect(), child2->occludedScreenSpace().bounds());
+        EXPECT_EQ(0u, child2->occludedScreenSpace().rects().size());
+        EXPECT_EQ_RECT(IntRect(10, 70, 90, 30), grandChild->occludedScreenSpace().bounds());
+        EXPECT_EQ(1u, grandChild->occludedScreenSpace().rects().size());
+        EXPECT_EQ_RECT(IntRect(10, 40, 90, 60), child->occludedScreenSpace().bounds());
+        EXPECT_EQ(2u, child->occludedScreenSpace().rects().size());
+        EXPECT_EQ_RECT(IntRect(10, 70, 90, 30), rootLayer->occludedScreenSpace().bounds());
+        EXPECT_EQ(1u, rootLayer->occludedScreenSpace().rects().size());
+
+        // If the child layer has a filter that moves pixels/changes alpha, and is below child2, then child should not inherit occlusion from outside its subtree,
+        // and should not contribute to the rootLayer
+        setLayerPropertiesForTesting(rootLayer.get(), 0, identityMatrix, FloatPoint(0, 0), FloatPoint(0, 0), IntSize(100, 100), true);
+        setLayerPropertiesForTesting(child.get(), rootLayer.get(), childTransform, FloatPoint(0, 0), FloatPoint(30, 30), IntSize(500, 500), true);
+        setLayerPropertiesForTesting(grandChild.get(), child.get(), identityMatrix, FloatPoint(0, 0), FloatPoint(10, 10), IntSize(500, 500), true);
+        setLayerPropertiesForTesting(child2.get(), rootLayer.get(), identityMatrix, FloatPoint(0, 0), FloatPoint(10, 70), IntSize(500, 500), true);
+
+        {
+            FilterOperations filters;
+            filters.operations().append(BlurFilterOperation::create(Length(10, WebCore::Percent), FilterOperation::BLUR));
+            child->setFilters(filters);
+        }
+
+        m_layerTreeHost->setRootLayer(rootLayer);
+        m_layerTreeHost->setViewportSize(rootLayer->bounds());
+        m_layerTreeHost->updateLayers();
+        m_layerTreeHost->commitComplete();
+
+        EXPECT_EQ_RECT(IntRect(), child2->occludedScreenSpace().bounds());
+        EXPECT_EQ(0u, child2->occludedScreenSpace().rects().size());
+        EXPECT_EQ_RECT(IntRect(), grandChild->occludedScreenSpace().bounds());
+        EXPECT_EQ(0u, grandChild->occludedScreenSpace().rects().size());
+        EXPECT_EQ_RECT(IntRect(30, 40, 70, 60), child->occludedScreenSpace().bounds());
+        EXPECT_EQ(1u, child->occludedScreenSpace().rects().size());
+        EXPECT_EQ_RECT(IntRect(10, 70, 90, 30), rootLayer->occludedScreenSpace().bounds());
+        EXPECT_EQ(1u, rootLayer->occludedScreenSpace().rects().size());
+
+        // Kill the layerTreeHost immediately.
+        m_layerTreeHost->setRootLayer(0);
+        m_layerTreeHost.clear();
+
+        endTest();
+    }
+
+    virtual void afterTest()
+    {
+    }
+};
+
+SINGLE_AND_MULTI_THREAD_TEST_F(CCLayerTreeHostTestLayerOcclusionWithFilters)
+
 class CCLayerTreeHostTestManySurfaces : public CCLayerTreeHostTest {
 public:
     CCLayerTreeHostTestManySurfaces() { }
diff --git a/Source/WebKit/chromium/tests/CCOcclusionTrackerTest.cpp b/Source/WebKit/chromium/tests/CCOcclusionTrackerTest.cpp
new file mode 100644
index 000000000..678ec9645
--- /dev/null
+++ b/Source/WebKit/chromium/tests/CCOcclusionTrackerTest.cpp
@@ -0,0 +1,1173 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#include "cc/CCOcclusionTracker.h"
+
+#include "FilterOperations.h"
+#include "LayerChromium.h"
+#include "Region.h"
+#include "TransformationMatrix.h"
+#include "cc/CCLayerTreeHostCommon.h"
+
+#include <gmock/gmock.h>
+#include <gtest/gtest.h>
+
+using namespace WebCore;
+
+#define EXPECT_EQ_RECT(a, b) \
+    EXPECT_EQ(a.x(), b.x()); \
+    EXPECT_EQ(a.y(), b.y()); \
+    EXPECT_EQ(a.width(), b.width()); \
+    EXPECT_EQ(a.height(), b.height());
+
+namespace {
+
+void setLayerPropertiesForTesting(LayerChromium* layer, const TransformationMatrix& transform, const TransformationMatrix& sublayerTransform, const FloatPoint& anchor, const FloatPoint& position, const IntSize& bounds, bool opaque)
+{
+    layer->setTransform(transform);
+    layer->setSublayerTransform(sublayerTransform);
+    layer->setAnchorPoint(anchor);
+    layer->setPosition(position);
+    layer->setBounds(bounds);
+    layer->setOpaque(opaque);
+}
+
+class LayerChromiumWithForcedDrawsContent : public LayerChromium {
+public:
+    LayerChromiumWithForcedDrawsContent()
+        : LayerChromium()
+    {
+    }
+
+    virtual bool drawsContent() const { return true; }
+};
+
+// A subclass to expose the total current occlusion.
+class TestCCOcclusionTracker : public CCOcclusionTracker {
+public:
+    Region occlusionInScreenSpace() const { return CCOcclusionTracker::m_stack.last().occlusionInScreen; }
+    Region occlusionInTargetSurface() const { return CCOcclusionTracker::m_stack.last().occlusionInTarget; }
+
+    void setOcclusionInScreenSpace(const Region& region) { CCOcclusionTracker::m_stack.last().occlusionInScreen = region; }
+    void setOcclusionInTargetSurface(const Region& region) { CCOcclusionTracker::m_stack.last().occlusionInTarget = region; }
+};
+
+TEST(CCOcclusionTrackerTest, layerAddedToOccludedRegion)
+{
+    // This tests that the right transforms are being used.
+    TestCCOcclusionTracker occlusion;
+    const TransformationMatrix identityMatrix;
+    RefPtr<LayerChromium> parent = LayerChromium::create();
+    RefPtr<LayerChromiumWithForcedDrawsContent> layer = adoptRef(new LayerChromiumWithForcedDrawsContent());
+    parent->createRenderSurface();
+    parent->addChild(layer);
+
+    setLayerPropertiesForTesting(parent.get(), identityMatrix, identityMatrix, FloatPoint(0, 0), FloatPoint(0, 0), IntSize(100, 100), false);
+    setLayerPropertiesForTesting(layer.get(), identityMatrix, identityMatrix, FloatPoint(0, 0), FloatPoint(30, 30), IntSize(500, 500), true);
+
+    Vector<RefPtr<LayerChromium> > renderSurfaceLayerList;
+    Vector<RefPtr<LayerChromium> > dummyLayerList;
+    int dummyMaxTextureSize = 512;
+
+    parent->renderSurface()->setContentRect(IntRect(IntPoint::zero(), parent->bounds()));
+    parent->setClipRect(IntRect(IntPoint::zero(), parent->bounds()));
+    renderSurfaceLayerList.append(parent);
+
+    CCLayerTreeHostCommon::calculateDrawTransformsAndVisibility(parent.get(), parent.get(), identityMatrix, identityMatrix, renderSurfaceLayerList, dummyLayerList, dummyMaxTextureSize);
+
+    occlusion.enterTargetRenderSurface(parent->renderSurface());
+    occlusion.markOccludedBehindLayer(layer.get());
+    EXPECT_EQ_RECT(IntRect(30, 30, 70, 70), occlusion.occlusionInScreenSpace().bounds());
+    EXPECT_EQ(1u, occlusion.occlusionInScreenSpace().rects().size());
+    EXPECT_EQ_RECT(IntRect(30, 30, 70, 70), occlusion.occlusionInTargetSurface().bounds());
+    EXPECT_EQ(1u, occlusion.occlusionInTargetSurface().rects().size());
+
+    EXPECT_TRUE(occlusion.occluded(parent.get(), IntRect(30, 30, 70, 70)));
+    EXPECT_FALSE(occlusion.occluded(parent.get(), IntRect(29, 30, 70, 70)));
+    EXPECT_FALSE(occlusion.occluded(parent.get(), IntRect(30, 29, 70, 70)));
+    EXPECT_FALSE(occlusion.occluded(parent.get(), IntRect(31, 30, 70, 70)));
+    EXPECT_FALSE(occlusion.occluded(parent.get(), IntRect(30, 31, 70, 70)));
+
+    EXPECT_TRUE(occlusion.unoccludedContentRect(parent.get(), IntRect(30, 30, 70, 70)).isEmpty());
+    EXPECT_EQ_RECT(IntRect(29, 30, 1, 70), occlusion.unoccludedContentRect(parent.get(), IntRect(29, 30, 70, 70)));
+    EXPECT_EQ_RECT(IntRect(29, 29, 70, 70), occlusion.unoccludedContentRect(parent.get(), IntRect(29, 29, 70, 70)));
+    EXPECT_EQ_RECT(IntRect(30, 29, 70, 1), occlusion.unoccludedContentRect(parent.get(), IntRect(30, 29, 70, 70)));
+    EXPECT_EQ_RECT(IntRect(31, 29, 70, 70), occlusion.unoccludedContentRect(parent.get(), IntRect(31, 29, 70, 70)));
+    EXPECT_EQ_RECT(IntRect(100, 30, 1, 70), occlusion.unoccludedContentRect(parent.get(), IntRect(31, 30, 70, 70)));
+    EXPECT_EQ_RECT(IntRect(31, 31, 70, 70), occlusion.unoccludedContentRect(parent.get(), IntRect(31, 31, 70, 70)));
+    EXPECT_EQ_RECT(IntRect(30, 100, 70, 1), occlusion.unoccludedContentRect(parent.get(), IntRect(30, 31, 70, 70)));
+    EXPECT_EQ_RECT(IntRect(29, 31, 70, 70), occlusion.unoccludedContentRect(parent.get(), IntRect(29, 31, 70, 70)));
+}
+
+TEST(CCOcclusionTrackerTest, layerAddedToOccludedRegionWithRotation)
+{
+    // This tests that the right transforms are being used.
+    TestCCOcclusionTracker occlusion;
+    const TransformationMatrix identityMatrix;
+    RefPtr<LayerChromium> parent = LayerChromium::create();
+    RefPtr<LayerChromiumWithForcedDrawsContent> layer = adoptRef(new LayerChromiumWithForcedDrawsContent());
+    parent->createRenderSurface();
+    parent->addChild(layer);
+
+    TransformationMatrix layerTransform;
+    layerTransform.translate(250, 250);
+    layerTransform.rotate(90);
+    layerTransform.translate(-250, -250);
+
+    setLayerPropertiesForTesting(parent.get(), identityMatrix, identityMatrix, FloatPoint(0, 0), FloatPoint(0, 0), IntSize(100, 100), false);
+    setLayerPropertiesForTesting(layer.get(), layerTransform, identityMatrix, FloatPoint(0, 0), FloatPoint(30, 30), IntSize(500, 500), true);
+
+    Vector<RefPtr<LayerChromium> > renderSurfaceLayerList;
+    Vector<RefPtr<LayerChromium> > dummyLayerList;
+    int dummyMaxTextureSize = 512;
+
+    parent->renderSurface()->setContentRect(IntRect(IntPoint::zero(), parent->bounds()));
+    parent->setClipRect(IntRect(IntPoint::zero(), parent->bounds()));
+    renderSurfaceLayerList.append(parent);
+
+    CCLayerTreeHostCommon::calculateDrawTransformsAndVisibility(parent.get(), parent.get(), identityMatrix, identityMatrix, renderSurfaceLayerList, dummyLayerList, dummyMaxTextureSize);
+
+    occlusion.enterTargetRenderSurface(parent->renderSurface());
+    occlusion.markOccludedBehindLayer(layer.get());
+    EXPECT_EQ_RECT(IntRect(30, 30, 70, 70), occlusion.occlusionInScreenSpace().bounds());
+    EXPECT_EQ(1u, occlusion.occlusionInScreenSpace().rects().size());
+    EXPECT_EQ_RECT(IntRect(30, 30, 70, 70), occlusion.occlusionInTargetSurface().bounds());
+    EXPECT_EQ(1u, occlusion.occlusionInTargetSurface().rects().size());
+
+    EXPECT_TRUE(occlusion.occluded(parent.get(), IntRect(30, 30, 70, 70)));
+    EXPECT_FALSE(occlusion.occluded(parent.get(), IntRect(29, 30, 70, 70)));
+    EXPECT_FALSE(occlusion.occluded(parent.get(), IntRect(30, 29, 70, 70)));
+    EXPECT_FALSE(occlusion.occluded(parent.get(), IntRect(31, 30, 70, 70)));
+    EXPECT_FALSE(occlusion.occluded(parent.get(), IntRect(30, 31, 70, 70)));
+
+    EXPECT_TRUE(occlusion.unoccludedContentRect(parent.get(), IntRect(30, 30, 70, 70)).isEmpty());
+    EXPECT_EQ_RECT(IntRect(29, 30, 1, 70), occlusion.unoccludedContentRect(parent.get(), IntRect(29, 30, 70, 70)));
+    EXPECT_EQ_RECT(IntRect(29, 29, 70, 70), occlusion.unoccludedContentRect(parent.get(), IntRect(29, 29, 70, 70)));
+    EXPECT_EQ_RECT(IntRect(30, 29, 70, 1), occlusion.unoccludedContentRect(parent.get(), IntRect(30, 29, 70, 70)));
+    EXPECT_EQ_RECT(IntRect(31, 29, 70, 70), occlusion.unoccludedContentRect(parent.get(), IntRect(31, 29, 70, 70)));
+    EXPECT_EQ_RECT(IntRect(100, 30, 1, 70), occlusion.unoccludedContentRect(parent.get(), IntRect(31, 30, 70, 70)));
+    EXPECT_EQ_RECT(IntRect(31, 31, 70, 70), occlusion.unoccludedContentRect(parent.get(), IntRect(31, 31, 70, 70)));
+    EXPECT_EQ_RECT(IntRect(30, 100, 70, 1), occlusion.unoccludedContentRect(parent.get(), IntRect(30, 31, 70, 70)));
+    EXPECT_EQ_RECT(IntRect(29, 31, 70, 70), occlusion.unoccludedContentRect(parent.get(), IntRect(29, 31, 70, 70)));
+}
+
+TEST(CCOcclusionTrackerTest, layerAddedToOccludedRegionWithTranslation)
+{
+    // This tests that the right transforms are being used.
+    TestCCOcclusionTracker occlusion;
+    const TransformationMatrix identityMatrix;
+    RefPtr<LayerChromium> parent = LayerChromium::create();
+    RefPtr<LayerChromiumWithForcedDrawsContent> layer = adoptRef(new LayerChromiumWithForcedDrawsContent());
+    parent->createRenderSurface();
+    parent->addChild(layer);
+
+    TransformationMatrix layerTransform;
+    layerTransform.translate(20, 20);
+
+    setLayerPropertiesForTesting(parent.get(), identityMatrix, identityMatrix, FloatPoint(0, 0), FloatPoint(0, 0), IntSize(100, 100), false);
+    setLayerPropertiesForTesting(layer.get(), layerTransform, identityMatrix, FloatPoint(0, 0), FloatPoint(30, 30), IntSize(500, 500), true);
+
+    Vector<RefPtr<LayerChromium> > renderSurfaceLayerList;
+    Vector<RefPtr<LayerChromium> > dummyLayerList;
+    int dummyMaxTextureSize = 512;
+
+    parent->renderSurface()->setContentRect(IntRect(IntPoint::zero(), parent->bounds()));
+    parent->setClipRect(IntRect(IntPoint::zero(), parent->bounds()));
+    renderSurfaceLayerList.append(parent);
+
+    CCLayerTreeHostCommon::calculateDrawTransformsAndVisibility(parent.get(), parent.get(), identityMatrix, identityMatrix, renderSurfaceLayerList, dummyLayerList, dummyMaxTextureSize);
+
+    occlusion.enterTargetRenderSurface(parent->renderSurface());
+    occlusion.markOccludedBehindLayer(layer.get());
+    EXPECT_EQ_RECT(IntRect(50, 50, 50, 50), occlusion.occlusionInScreenSpace().bounds());
+    EXPECT_EQ(1u, occlusion.occlusionInScreenSpace().rects().size());
+    EXPECT_EQ_RECT(IntRect(50, 50, 50, 50), occlusion.occlusionInTargetSurface().bounds());
+    EXPECT_EQ(1u, occlusion.occlusionInTargetSurface().rects().size());
+
+    EXPECT_TRUE(occlusion.occluded(parent.get(), IntRect(50, 50, 50, 50)));
+    EXPECT_FALSE(occlusion.occluded(parent.get(), IntRect(49, 50, 50, 50)));
+    EXPECT_FALSE(occlusion.occluded(parent.get(), IntRect(50, 49, 50, 50)));
+    EXPECT_FALSE(occlusion.occluded(parent.get(), IntRect(51, 50, 50, 50)));
+    EXPECT_FALSE(occlusion.occluded(parent.get(), IntRect(50, 51, 50, 50)));
+
+    EXPECT_TRUE(occlusion.unoccludedContentRect(parent.get(), IntRect(50, 50, 50, 50)).isEmpty());
+    EXPECT_EQ_RECT(IntRect(49, 50, 1, 50), occlusion.unoccludedContentRect(parent.get(), IntRect(49, 50, 50, 50)));
+    EXPECT_EQ_RECT(IntRect(49, 49, 50, 50), occlusion.unoccludedContentRect(parent.get(), IntRect(49, 49, 50, 50)));
+    EXPECT_EQ_RECT(IntRect(50, 49, 50, 1), occlusion.unoccludedContentRect(parent.get(), IntRect(50, 49, 50, 50)));
+    EXPECT_EQ_RECT(IntRect(51, 49, 50, 50), occlusion.unoccludedContentRect(parent.get(), IntRect(51, 49, 50, 50)));
+    EXPECT_EQ_RECT(IntRect(100, 50, 1, 50), occlusion.unoccludedContentRect(parent.get(), IntRect(51, 50, 50, 50)));
+    EXPECT_EQ_RECT(IntRect(51, 51, 50, 50), occlusion.unoccludedContentRect(parent.get(), IntRect(51, 51, 50, 50)));
+    EXPECT_EQ_RECT(IntRect(50, 100, 50, 1), occlusion.unoccludedContentRect(parent.get(), IntRect(50, 51, 50, 50)));
+    EXPECT_EQ_RECT(IntRect(49, 51, 50, 50), occlusion.unoccludedContentRect(parent.get(), IntRect(49, 51, 50, 50)));
+}
+
+TEST(CCOcclusionTrackerTest, layerAddedToOccludedRegionWithRotatedSurface)
+{
+    // This tests that the right transforms are being used.
+    TestCCOcclusionTracker occlusion;
+    const TransformationMatrix identityMatrix;
+    RefPtr<LayerChromium> parent = LayerChromium::create();
+    RefPtr<LayerChromium> child = LayerChromium::create();
+    RefPtr<LayerChromiumWithForcedDrawsContent> layer = adoptRef(new LayerChromiumWithForcedDrawsContent());
+    parent->createRenderSurface();
+    parent->addChild(child);
+    child->addChild(layer);
+
+    TransformationMatrix childTransform;
+    childTransform.translate(250, 250);
+    childTransform.rotate(90);
+    childTransform.translate(-250, -250);
+
+    setLayerPropertiesForTesting(parent.get(), identityMatrix, identityMatrix, FloatPoint(0, 0), FloatPoint(0, 0), IntSize(100, 100), false);
+    setLayerPropertiesForTesting(child.get(), childTransform, identityMatrix, FloatPoint(0, 0), FloatPoint(30, 30), IntSize(500, 500), false);
+    setLayerPropertiesForTesting(layer.get(), identityMatrix, identityMatrix, FloatPoint(0, 0), FloatPoint(10, 10), IntSize(500, 500), true);
+
+    child->setMasksToBounds(true);
+
+    Vector<RefPtr<LayerChromium> > renderSurfaceLayerList;
+    Vector<RefPtr<LayerChromium> > dummyLayerList;
+    int dummyMaxTextureSize = 512;
+
+    parent->renderSurface()->setContentRect(IntRect(IntPoint::zero(), parent->bounds()));
+    parent->setClipRect(IntRect(IntPoint::zero(), parent->bounds()));
+    renderSurfaceLayerList.append(parent);
+
+    CCLayerTreeHostCommon::calculateDrawTransformsAndVisibility(parent.get(), parent.get(), identityMatrix, identityMatrix, renderSurfaceLayerList, dummyLayerList, dummyMaxTextureSize);
+
+    occlusion.enterTargetRenderSurface(child->renderSurface());
+    occlusion.markOccludedBehindLayer(layer.get());
+
+    EXPECT_EQ_RECT(IntRect(30, 40, 70, 60), occlusion.occlusionInScreenSpace().bounds());
+    EXPECT_EQ(1u, occlusion.occlusionInScreenSpace().rects().size());
+    EXPECT_EQ_RECT(IntRect(10, 430, 60, 70), occlusion.occlusionInTargetSurface().bounds());
+    EXPECT_EQ(1u, occlusion.occlusionInTargetSurface().rects().size());
+
+    EXPECT_TRUE(occlusion.occluded(child.get(), IntRect(10, 430, 60, 70)));
+    EXPECT_FALSE(occlusion.occluded(child.get(), IntRect(9, 430, 60, 70)));
+    EXPECT_FALSE(occlusion.occluded(child.get(), IntRect(10, 429, 60, 70)));
+    EXPECT_FALSE(occlusion.occluded(child.get(), IntRect(10, 430, 61, 70)));
+    EXPECT_FALSE(occlusion.occluded(child.get(), IntRect(10, 430, 60, 71)));
+
+    occlusion.markOccludedBehindLayer(child.get());
+    occlusion.finishedTargetRenderSurface(child.get(), child->renderSurface());
+    occlusion.leaveToTargetRenderSurface(parent->renderSurface());
+
+    EXPECT_EQ_RECT(IntRect(30, 40, 70, 60), occlusion.occlusionInScreenSpace().bounds());
+    EXPECT_EQ(1u, occlusion.occlusionInScreenSpace().rects().size());
+    EXPECT_EQ_RECT(IntRect(30, 40, 70, 60), occlusion.occlusionInTargetSurface().bounds());
+    EXPECT_EQ(1u, occlusion.occlusionInTargetSurface().rects().size());
+
+    EXPECT_TRUE(occlusion.occluded(parent.get(), IntRect(30, 40, 70, 60)));
+    EXPECT_FALSE(occlusion.occluded(parent.get(), IntRect(29, 40, 70, 60)));
+    EXPECT_FALSE(occlusion.occluded(parent.get(), IntRect(30, 39, 70, 60)));
+
+
+    /* Justification for the above occlusion from |layer|:
+               100
+      +---------------------+                                      +---------------------+
+      |                     |                                      |                     |30  Visible region of |layer|: /////
+      |    30               |           rotate(90)                 |                     |
+      | 30 + ---------------------------------+                    |     +---------------------------------+
+  100 |    |  10            |                 |            ==>     |     |               |10               |
+      |    |10+---------------------------------+                  |  +---------------------------------+  |
+      |    |  |             |                 | |                  |  |  |///////////////|     420      |  |
+      |    |  |             |                 | |                  |  |  |///////////////|60            |  |
+      |    |  |             |                 | |                  |  |  |///////////////|              |  |
+      +----|--|-------------+                 | |                  +--|--|---------------+              |  |
+           |  |                               | |                   20|10|     70                       |  |
+           |  |                               | |                     |  |                              |  |
+           |  |                               | |500                  |  |                              |  |
+           |  |                               | |                     |  |                              |  |
+           |  |                               | |                     |  |                              |  |
+           |  |                               | |                     |  |                              |  |
+           |  |                               | |                     |  |                              |10|
+           +--|-------------------------------+ |                     |  +------------------------------|--+
+              |                                 |                     |                 490             |
+              +---------------------------------+                     +---------------------------------+
+                             500                                                     500
+     */
+}
+
+TEST(CCOcclusionTrackerTest, layerAddedToOccludedRegionWithSurfaceAlreadyOnStack)
+{
+    // This tests that the right transforms are being used.
+    TestCCOcclusionTracker occlusion;
+    const TransformationMatrix identityMatrix;
+    RefPtr<LayerChromium> parent = LayerChromium::create();
+    RefPtr<LayerChromium> child = LayerChromium::create();
+    RefPtr<LayerChromiumWithForcedDrawsContent> child2 = adoptRef(new LayerChromiumWithForcedDrawsContent());
+    RefPtr<LayerChromiumWithForcedDrawsContent> layer = adoptRef(new LayerChromiumWithForcedDrawsContent());
+    parent->createRenderSurface();
+    parent->addChild(child);
+    child->addChild(layer);
+    parent->addChild(child2);
+
+    TransformationMatrix childTransform;
+    childTransform.translate(250, 250);
+    childTransform.rotate(90);
+    childTransform.translate(-250, -250);
+
+    setLayerPropertiesForTesting(parent.get(), identityMatrix, identityMatrix, FloatPoint(0, 0), FloatPoint(0, 0), IntSize(100, 100), false);
+    setLayerPropertiesForTesting(child.get(), childTransform, identityMatrix, FloatPoint(0, 0), FloatPoint(30, 30), IntSize(500, 500), false);
+    setLayerPropertiesForTesting(layer.get(), identityMatrix, identityMatrix, FloatPoint(0, 0), FloatPoint(10, 10), IntSize(500, 500), true);
+
+    // |child2| makes |parent|'s surface get considered by CCOcclusionTracker first, instead of |child|'s. This exercises different code in
+    // leaveToTargetRenderSurface, as the target surface has already been seen.
+    setLayerPropertiesForTesting(child2.get(), identityMatrix, identityMatrix, FloatPoint(0, 0), FloatPoint(30, 30), IntSize(60, 20), true);
+
+    child->setMasksToBounds(true);
+
+    Vector<RefPtr<LayerChromium> > renderSurfaceLayerList;
+    Vector<RefPtr<LayerChromium> > dummyLayerList;
+    int dummyMaxTextureSize = 512;
+
+    parent->renderSurface()->setContentRect(IntRect(IntPoint::zero(), parent->bounds()));
+    parent->setClipRect(IntRect(IntPoint::zero(), parent->bounds()));
+    renderSurfaceLayerList.append(parent);
+
+    CCLayerTreeHostCommon::calculateDrawTransformsAndVisibility(parent.get(), parent.get(), identityMatrix, identityMatrix, renderSurfaceLayerList, dummyLayerList, dummyMaxTextureSize);
+
+    occlusion.enterTargetRenderSurface(parent->renderSurface());
+    occlusion.markOccludedBehindLayer(child2.get());
+
+    EXPECT_EQ_RECT(IntRect(30, 30, 60, 20), occlusion.occlusionInScreenSpace().bounds());
+    EXPECT_EQ(1u, occlusion.occlusionInScreenSpace().rects().size());
+    EXPECT_EQ_RECT(IntRect(30, 30, 60, 20), occlusion.occlusionInTargetSurface().bounds());
+    EXPECT_EQ(1u, occlusion.occlusionInTargetSurface().rects().size());
+
+    occlusion.enterTargetRenderSurface(child->renderSurface());
+    occlusion.markOccludedBehindLayer(layer.get());
+
+    EXPECT_EQ_RECT(IntRect(30, 30, 70, 70), occlusion.occlusionInScreenSpace().bounds());
+    EXPECT_EQ(2u, occlusion.occlusionInScreenSpace().rects().size());
+    EXPECT_EQ_RECT(IntRect(10, 430, 60, 70), occlusion.occlusionInTargetSurface().bounds());
+    EXPECT_EQ(1u, occlusion.occlusionInTargetSurface().rects().size());
+
+    EXPECT_TRUE(occlusion.occluded(child.get(), IntRect(10, 430, 60, 70)));
+    EXPECT_FALSE(occlusion.occluded(child.get(), IntRect(9, 430, 60, 70)));
+    EXPECT_FALSE(occlusion.occluded(child.get(), IntRect(10, 429, 60, 70)));
+    EXPECT_FALSE(occlusion.occluded(child.get(), IntRect(11, 430, 60, 70)));
+    EXPECT_FALSE(occlusion.occluded(child.get(), IntRect(10, 431, 60, 70)));
+
+    EXPECT_TRUE(occlusion.unoccludedContentRect(child.get(), IntRect(10, 430, 60, 70)).isEmpty());
+    // This is the little piece not occluded by child2
+    EXPECT_EQ_RECT(IntRect(9, 430, 1, 10), occlusion.unoccludedContentRect(child.get(), IntRect(9, 430, 60, 70)));
+    // This extends past both sides of child2, so it will be the original rect.
+    EXPECT_EQ_RECT(IntRect(9, 430, 60, 80), occlusion.unoccludedContentRect(child.get(), IntRect(9, 430, 60, 80)));
+    // This extends past two adjacent sides of child2, and should included the unoccluded parts of each side.
+    // This also demonstrates that the rect can be arbitrary and does not get clipped to the layer's visibleLayerRect().
+    EXPECT_EQ_RECT(IntRect(-10, 430, 20, 70), occlusion.unoccludedContentRect(child.get(), IntRect(-10, 430, 60, 70)));
+    // This extends past three adjacent sides of child2, so it should contain the unoccluded parts of each side. The left
+    // and bottom edges are completely unoccluded for some row/column so we get back the original query rect.
+    EXPECT_EQ_RECT(IntRect(-10, 430, 60, 80), occlusion.unoccludedContentRect(child.get(), IntRect(-10, 430, 60, 80)));
+    EXPECT_EQ_RECT(IntRect(10, 429, 60, 1), occlusion.unoccludedContentRect(child.get(), IntRect(10, 429, 60, 70)));
+    EXPECT_EQ_RECT(IntRect(70, 430, 1, 70), occlusion.unoccludedContentRect(child.get(), IntRect(11, 430, 60, 70)));
+    EXPECT_EQ_RECT(IntRect(10, 500, 60, 1), occlusion.unoccludedContentRect(child.get(), IntRect(10, 431, 60, 70)));
+
+    // Surface is not occluded by things that draw into itself.
+    EXPECT_EQ_RECT(IntRect(10, 430, 60, 70), occlusion.surfaceUnoccludedContentRect(child.get(), IntRect(10, 430, 60, 70)));
+
+    occlusion.markOccludedBehindLayer(child.get());
+    // |child2| should get merged with the surface we are leaving now
+    occlusion.finishedTargetRenderSurface(child.get(), child->renderSurface());
+    occlusion.leaveToTargetRenderSurface(parent->renderSurface());
+
+    EXPECT_EQ_RECT(IntRect(30, 30, 70, 70), occlusion.occlusionInScreenSpace().bounds());
+    EXPECT_EQ(2u, occlusion.occlusionInScreenSpace().rects().size());
+    EXPECT_EQ_RECT(IntRect(30, 30, 70, 70), occlusion.occlusionInTargetSurface().bounds());
+    EXPECT_EQ(2u, occlusion.occlusionInTargetSurface().rects().size());
+
+    Vector<IntRect> screen = occlusion.occlusionInScreenSpace().rects();
+    Vector<IntRect> target = occlusion.occlusionInTargetSurface().rects();
+
+    EXPECT_FALSE(occlusion.occluded(parent.get(), IntRect(30, 30, 70, 70)));
+    EXPECT_EQ_RECT(IntRect(90, 30, 10, 10), occlusion.unoccludedContentRect(parent.get(), IntRect(30, 30, 70, 70)));
+
+    EXPECT_TRUE(occlusion.occluded(parent.get(), IntRect(30, 30, 60, 10)));
+    EXPECT_FALSE(occlusion.occluded(parent.get(), IntRect(29, 30, 60, 10)));
+    EXPECT_FALSE(occlusion.occluded(parent.get(), IntRect(30, 29, 60, 10)));
+    EXPECT_FALSE(occlusion.occluded(parent.get(), IntRect(31, 30, 60, 10)));
+    EXPECT_TRUE(occlusion.occluded(parent.get(), IntRect(30, 31, 60, 10)));
+
+    EXPECT_TRUE(occlusion.occluded(parent.get(), IntRect(30, 40, 70, 60)));
+    EXPECT_FALSE(occlusion.occluded(parent.get(), IntRect(29, 40, 70, 60)));
+    EXPECT_FALSE(occlusion.occluded(parent.get(), IntRect(30, 39, 70, 60)));
+
+    EXPECT_TRUE(occlusion.unoccludedContentRect(parent.get(), IntRect(30, 30, 60, 10)).isEmpty());
+    EXPECT_EQ_RECT(IntRect(29, 30, 1, 10), occlusion.unoccludedContentRect(parent.get(), IntRect(29, 30, 60, 10)));
+    EXPECT_EQ_RECT(IntRect(30, 29, 60, 1), occlusion.unoccludedContentRect(parent.get(), IntRect(30, 29, 60, 10)));
+    EXPECT_EQ_RECT(IntRect(90, 30, 1, 10), occlusion.unoccludedContentRect(parent.get(), IntRect(31, 30, 60, 10)));
+    EXPECT_TRUE(occlusion.unoccludedContentRect(parent.get(), IntRect(30, 31, 60, 10)).isEmpty());
+
+    EXPECT_TRUE(occlusion.unoccludedContentRect(parent.get(), IntRect(30, 40, 70, 60)).isEmpty());
+    EXPECT_EQ_RECT(IntRect(29, 40, 1, 60), occlusion.unoccludedContentRect(parent.get(), IntRect(29, 40, 70, 60)));
+    // This rect is mostly occluded by |child2|.
+    EXPECT_EQ_RECT(IntRect(90, 39, 10, 1), occlusion.unoccludedContentRect(parent.get(), IntRect(30, 39, 70, 60)));
+    // This rect extends past top/right ends of |child2|.
+    EXPECT_EQ_RECT(IntRect(30, 29, 70, 11), occlusion.unoccludedContentRect(parent.get(), IntRect(30, 29, 70, 70)));
+    // This rect extends past left/right ends of |child2|.
+    EXPECT_EQ_RECT(IntRect(20, 39, 80, 60), occlusion.unoccludedContentRect(parent.get(), IntRect(20, 39, 80, 60)));
+    EXPECT_EQ_RECT(IntRect(100, 40, 1, 60), occlusion.unoccludedContentRect(parent.get(), IntRect(31, 40, 70, 60)));
+    EXPECT_EQ_RECT(IntRect(30, 100, 70, 1), occlusion.unoccludedContentRect(parent.get(), IntRect(30, 41, 70, 60)));
+
+    // Surface is not occluded by things that draw into itself.
+    EXPECT_EQ_RECT(IntRect(30, 40, 70, 60), occlusion.surfaceUnoccludedContentRect(parent.get(), IntRect(30, 40, 70, 60)));
+
+
+    /* Justification for the above occlusion from |layer|:
+               100
+      +---------------------+                                      +---------------------+
+      |                     |                                      |                     |30  Visible region of |layer|: /////
+      |    30               |           rotate(90)                 |     30   60         |    |child2|: \\\\\
+      | 30 + ------------+--------------------+                    |  30 +------------+--------------------+
+  100 |    |  10         |  |                 |            ==>     |     |\\\\\\\\\\\\|  |10               |
+      |    |10+----------|----------------------+                  |  +--|\\\\\\\\\\\\|-----------------+  |
+      |    + ------------+  |                 | |                  |  |  +------------+//|     420      |  |
+      |    |  |             |                 | |                  |  |  |///////////////|60            |  |
+      |    |  |             |                 | |                  |  |  |///////////////|              |  |
+      +----|--|-------------+                 | |                  +--|--|---------------+              |  |
+           |  |                               | |                   20|10|     70                       |  |
+           |  |                               | |                     |  |                              |  |
+           |  |                               | |500                  |  |                              |  |
+           |  |                               | |                     |  |                              |  |
+           |  |                               | |                     |  |                              |  |
+           |  |                               | |                     |  |                              |  |
+           |  |                               | |                     |  |                              |10|
+           +--|-------------------------------+ |                     |  +------------------------------|--+
+              |                                 |                     |                 490             |
+              +---------------------------------+                     +---------------------------------+
+                             500                                                     500
+     */
+}
+
+TEST(CCOcclusionTrackerTest, layerAddedToOccludedRegionWithRotatedOffAxisSurface)
+{
+    TestCCOcclusionTracker occlusion;
+    const TransformationMatrix identityMatrix;
+    RefPtr<LayerChromium> parent = LayerChromium::create();
+    RefPtr<LayerChromium> child = LayerChromium::create();
+    RefPtr<LayerChromiumWithForcedDrawsContent> layer = adoptRef(new LayerChromiumWithForcedDrawsContent());
+    parent->createRenderSurface();
+    parent->addChild(child);
+    child->addChild(layer);
+
+    // Now rotate the child a little more so it is not axis-aligned. The parent will no longer be occluded by |layer|, but
+    // the child's occlusion should be unchanged.
+
+    TransformationMatrix childTransform;
+    childTransform.translate(250, 250);
+    childTransform.rotate(95);
+    childTransform.translate(-250, -250);
+
+    TransformationMatrix layerTransform;
+    layerTransform.translate(10, 10);
+
+    setLayerPropertiesForTesting(parent.get(), identityMatrix, identityMatrix, FloatPoint(0, 0), FloatPoint(0, 0), IntSize(100, 100), false);
+    setLayerPropertiesForTesting(child.get(), childTransform, identityMatrix, FloatPoint(0, 0), FloatPoint(30, 30), IntSize(500, 500), false);
+    setLayerPropertiesForTesting(layer.get(), layerTransform, identityMatrix, FloatPoint(0, 0), FloatPoint(0, 0), IntSize(500, 500), true);
+
+    child->setMasksToBounds(true);
+
+    Vector<RefPtr<LayerChromium> > renderSurfaceLayerList;
+    Vector<RefPtr<LayerChromium> > dummyLayerList;
+    int dummyMaxTextureSize = 512;
+
+    parent->renderSurface()->setContentRect(IntRect(IntPoint::zero(), parent->bounds()));
+    parent->setClipRect(IntRect(IntPoint::zero(), parent->bounds()));
+    renderSurfaceLayerList.append(parent);
+
+    CCLayerTreeHostCommon::calculateDrawTransformsAndVisibility(parent.get(), parent.get(), identityMatrix, identityMatrix, renderSurfaceLayerList, dummyLayerList, dummyMaxTextureSize);
+
+    IntRect clippedLayerInChild = layerTransform.mapRect(layer->visibleLayerRect());
+
+    occlusion.enterTargetRenderSurface(child->renderSurface());
+    occlusion.markOccludedBehindLayer(layer.get());
+
+    EXPECT_EQ_RECT(IntRect(), occlusion.occlusionInScreenSpace().bounds());
+    EXPECT_EQ(0u, occlusion.occlusionInScreenSpace().rects().size());
+    EXPECT_EQ_RECT(clippedLayerInChild, occlusion.occlusionInTargetSurface().bounds());
+    EXPECT_EQ(1u, occlusion.occlusionInTargetSurface().rects().size());
+
+    EXPECT_TRUE(occlusion.occluded(child.get(), clippedLayerInChild));
+    EXPECT_TRUE(occlusion.unoccludedContentRect(parent.get(), clippedLayerInChild).isEmpty());
+    clippedLayerInChild.move(-1, 0);
+    EXPECT_FALSE(occlusion.occluded(child.get(), clippedLayerInChild));
+    EXPECT_FALSE(occlusion.unoccludedContentRect(parent.get(), clippedLayerInChild).isEmpty());
+    clippedLayerInChild.move(1, 0);
+    clippedLayerInChild.move(1, 0);
+    EXPECT_FALSE(occlusion.occluded(child.get(), clippedLayerInChild));
+    EXPECT_FALSE(occlusion.unoccludedContentRect(parent.get(), clippedLayerInChild).isEmpty());
+    clippedLayerInChild.move(-1, 0);
+    clippedLayerInChild.move(0, -1);
+    EXPECT_FALSE(occlusion.occluded(child.get(), clippedLayerInChild));
+    EXPECT_FALSE(occlusion.unoccludedContentRect(parent.get(), clippedLayerInChild).isEmpty());
+    clippedLayerInChild.move(0, 1);
+    clippedLayerInChild.move(0, 1);
+    EXPECT_FALSE(occlusion.occluded(child.get(), clippedLayerInChild));
+    EXPECT_FALSE(occlusion.unoccludedContentRect(parent.get(), clippedLayerInChild).isEmpty());
+    clippedLayerInChild.move(0, -1);
+
+    // Surface is not occluded by things that draw into itself.
+    EXPECT_EQ_RECT(IntRect(0, 0, 500, 500), occlusion.surfaceUnoccludedContentRect(child.get(), IntRect(0, 0, 500, 500)));
+
+    occlusion.markOccludedBehindLayer(child.get());
+    occlusion.finishedTargetRenderSurface(child.get(), child->renderSurface());
+    occlusion.leaveToTargetRenderSurface(parent->renderSurface());
+
+    EXPECT_EQ_RECT(IntRect(), occlusion.occlusionInScreenSpace().bounds());
+    EXPECT_EQ(0u, occlusion.occlusionInScreenSpace().rects().size());
+    EXPECT_EQ_RECT(IntRect(), occlusion.occlusionInTargetSurface().bounds());
+    EXPECT_EQ(0u, occlusion.occlusionInTargetSurface().rects().size());
+
+    EXPECT_FALSE(occlusion.occluded(parent.get(), IntRect(75, 55, 1, 1)));
+    EXPECT_EQ_RECT(IntRect(75, 55, 1, 1), occlusion.unoccludedContentRect(parent.get(), IntRect(75, 55, 1, 1)));
+
+    // Surface is not occluded by things that draw into itself.
+    EXPECT_EQ_RECT(IntRect(0, 0, 100, 100), occlusion.surfaceUnoccludedContentRect(parent.get(), IntRect(0, 0, 100, 100)));
+}
+
+TEST(CCOcclusionTrackerTest, layerAddedToOccludedRegionWithMultipleOpaqueLayers)
+{
+    // This is similar to the previous test but now we make a few opaque layers inside of |child| so that the occluded parts of child are not a simple rect.
+    TestCCOcclusionTracker occlusion;
+    const TransformationMatrix identityMatrix;
+    RefPtr<LayerChromium> parent = LayerChromium::create();
+    RefPtr<LayerChromium> child = LayerChromium::create();
+    RefPtr<LayerChromiumWithForcedDrawsContent> layer1 = adoptRef(new LayerChromiumWithForcedDrawsContent());
+    RefPtr<LayerChromiumWithForcedDrawsContent> layer2 = adoptRef(new LayerChromiumWithForcedDrawsContent());
+    parent->createRenderSurface();
+    parent->addChild(child);
+    child->addChild(layer1);
+    child->addChild(layer2);
+
+    TransformationMatrix childTransform;
+    childTransform.translate(250, 250);
+    childTransform.rotate(90);
+    childTransform.translate(-250, -250);
+
+    setLayerPropertiesForTesting(parent.get(), identityMatrix, identityMatrix, FloatPoint(0, 0), FloatPoint(0, 0), IntSize(100, 100), false);
+    setLayerPropertiesForTesting(child.get(), childTransform, identityMatrix, FloatPoint(0, 0), FloatPoint(30, 30), IntSize(500, 500), false);
+    setLayerPropertiesForTesting(layer1.get(), identityMatrix, identityMatrix, FloatPoint(0, 0), FloatPoint(10, 10), IntSize(500, 440), true);
+    setLayerPropertiesForTesting(layer2.get(), identityMatrix, identityMatrix, FloatPoint(0, 0), FloatPoint(10, 450), IntSize(500, 60), true);
+
+    child->setMasksToBounds(true);
+
+    Vector<RefPtr<LayerChromium> > renderSurfaceLayerList;
+    Vector<RefPtr<LayerChromium> > dummyLayerList;
+    int dummyMaxTextureSize = 512;
+
+    parent->renderSurface()->setContentRect(IntRect(IntPoint::zero(), parent->bounds()));
+    parent->setClipRect(IntRect(IntPoint::zero(), parent->bounds()));
+    renderSurfaceLayerList.append(parent);
+
+    CCLayerTreeHostCommon::calculateDrawTransformsAndVisibility(parent.get(), parent.get(), identityMatrix, identityMatrix, renderSurfaceLayerList, dummyLayerList, dummyMaxTextureSize);
+
+    occlusion.enterTargetRenderSurface(child->renderSurface());
+    occlusion.markOccludedBehindLayer(layer2.get());
+    occlusion.markOccludedBehindLayer(layer1.get());
+
+    EXPECT_EQ_RECT(IntRect(30, 40, 70, 60), occlusion.occlusionInScreenSpace().bounds());
+    EXPECT_EQ(1u, occlusion.occlusionInScreenSpace().rects().size());
+    EXPECT_EQ_RECT(IntRect(10, 430, 60, 70), occlusion.occlusionInTargetSurface().bounds());
+    EXPECT_EQ(1u, occlusion.occlusionInTargetSurface().rects().size());
+
+    EXPECT_TRUE(occlusion.occluded(child.get(), IntRect(10, 430, 60, 70)));
+    EXPECT_FALSE(occlusion.occluded(child.get(), IntRect(9, 430, 60, 70)));
+    EXPECT_FALSE(occlusion.occluded(child.get(), IntRect(10, 429, 60, 70)));
+    EXPECT_FALSE(occlusion.occluded(child.get(), IntRect(11, 430, 60, 70)));
+    EXPECT_FALSE(occlusion.occluded(child.get(), IntRect(10, 431, 60, 70)));
+
+    EXPECT_TRUE(occlusion.unoccludedContentRect(child.get(), IntRect(10, 430, 60, 70)).isEmpty());
+    EXPECT_EQ_RECT(IntRect(9, 430, 1, 70), occlusion.unoccludedContentRect(child.get(), IntRect(9, 430, 60, 70)));
+    EXPECT_EQ_RECT(IntRect(10, 429, 60, 1), occlusion.unoccludedContentRect(child.get(), IntRect(10, 429, 60, 70)));
+    EXPECT_EQ_RECT(IntRect(70, 430, 1, 70), occlusion.unoccludedContentRect(child.get(), IntRect(11, 430, 60, 70)));
+    EXPECT_EQ_RECT(IntRect(10, 500, 60, 1), occlusion.unoccludedContentRect(child.get(), IntRect(10, 431, 60, 70)));
+
+    // Surface is not occluded by things that draw into itself.
+    EXPECT_EQ_RECT(IntRect(10, 430, 60, 70), occlusion.surfaceUnoccludedContentRect(child.get(), IntRect(10, 430, 60, 70)));
+
+    occlusion.markOccludedBehindLayer(child.get());
+    occlusion.finishedTargetRenderSurface(child.get(), child->renderSurface());
+    occlusion.leaveToTargetRenderSurface(parent->renderSurface());
+
+    EXPECT_EQ_RECT(IntRect(30, 40, 70, 60), occlusion.occlusionInScreenSpace().bounds());
+    EXPECT_EQ(1u, occlusion.occlusionInScreenSpace().rects().size());
+    EXPECT_EQ_RECT(IntRect(30, 40, 70, 60), occlusion.occlusionInTargetSurface().bounds());
+    EXPECT_EQ(1u, occlusion.occlusionInTargetSurface().rects().size());
+
+    EXPECT_TRUE(occlusion.occluded(parent.get(), IntRect(30, 40, 70, 60)));
+    EXPECT_FALSE(occlusion.occluded(parent.get(), IntRect(29, 40, 70, 60)));
+    EXPECT_FALSE(occlusion.occluded(parent.get(), IntRect(30, 39, 70, 60)));
+
+    EXPECT_TRUE(occlusion.unoccludedContentRect(parent.get(), IntRect(30, 40, 70, 60)).isEmpty());
+    EXPECT_EQ_RECT(IntRect(29, 40, 1, 60), occlusion.unoccludedContentRect(parent.get(), IntRect(29, 40, 70, 60)));
+    EXPECT_EQ_RECT(IntRect(30, 39, 70, 1), occlusion.unoccludedContentRect(parent.get(), IntRect(30, 39, 70, 60)));
+    EXPECT_EQ_RECT(IntRect(100, 40, 1, 60), occlusion.unoccludedContentRect(parent.get(), IntRect(31, 40, 70, 60)));
+    EXPECT_EQ_RECT(IntRect(30, 100, 70, 1), occlusion.unoccludedContentRect(parent.get(), IntRect(30, 41, 70, 60)));
+
+    // Surface is not occluded by things that draw into itself.
+    EXPECT_EQ_RECT(IntRect(30, 40, 70, 60), occlusion.surfaceUnoccludedContentRect(parent.get(), IntRect(30, 40, 70, 60)));
+
+
+    /* Justification for the above occlusion from |layer1| and |layer2|:
+
+       +---------------------+
+       |                     |30  Visible region of |layer1|: /////
+       |                     |    Visible region of |layer2|: \\\\\
+       |     +---------------------------------+
+       |     |               |10               |
+       |  +---------------+-----------------+  |
+       |  |  |\\\\\\\\\\\\|//|     420      |  |
+       |  |  |\\\\\\\\\\\\|//|60            |  |
+       |  |  |\\\\\\\\\\\\|//|              |  |
+       +--|--|------------|--+              |  |
+        20|10|     70     |                 |  |
+          |  |            |                 |  |
+          |  |            |                 |  |
+          |  |            |                 |  |
+          |  |            |                 |  |
+          |  |            |                 |  |
+          |  |            |                 |10|
+          |  +------------|-----------------|--+
+          |               | 490             |
+          +---------------+-----------------+
+                60               440
+     */
+}
+
+TEST(CCOcclusionTrackerTest, surfaceOcclusionWithOverlappingSiblingSurfaces)
+{
+    // This tests that the right transforms are being used.
+    TestCCOcclusionTracker occlusion;
+    const TransformationMatrix identityMatrix;
+    RefPtr<LayerChromium> parent = LayerChromium::create();
+    RefPtr<LayerChromium> child1 = LayerChromium::create();
+    RefPtr<LayerChromium> child2 = LayerChromium::create();
+    RefPtr<LayerChromiumWithForcedDrawsContent> layer1 = adoptRef(new LayerChromiumWithForcedDrawsContent());
+    RefPtr<LayerChromiumWithForcedDrawsContent> layer2 = adoptRef(new LayerChromiumWithForcedDrawsContent());
+    parent->createRenderSurface();
+    parent->addChild(child1);
+    parent->addChild(child2);
+    child1->addChild(layer1);
+    child2->addChild(layer2);
+
+    TransformationMatrix childTransform;
+    childTransform.translate(250, 250);
+    childTransform.rotate(90);
+    childTransform.translate(-250, -250);
+
+    setLayerPropertiesForTesting(parent.get(), identityMatrix, identityMatrix, FloatPoint(0, 0), FloatPoint(0, 0), IntSize(100, 100), false);
+    setLayerPropertiesForTesting(child1.get(), childTransform, identityMatrix, FloatPoint(0, 0), FloatPoint(30, 30), IntSize(500, 500), false);
+    setLayerPropertiesForTesting(layer1.get(), identityMatrix, identityMatrix, FloatPoint(0, 0), FloatPoint(0, 0), IntSize(500, 500), true);
+    setLayerPropertiesForTesting(child2.get(), childTransform, identityMatrix, FloatPoint(0, 0), FloatPoint(20, 40), IntSize(500, 500), false);
+    setLayerPropertiesForTesting(layer2.get(), identityMatrix, identityMatrix, FloatPoint(0, 0), FloatPoint(0, 0), IntSize(500, 500), true);
+
+    child1->setMasksToBounds(true);
+    child2->setMasksToBounds(true);
+
+    Vector<RefPtr<LayerChromium> > renderSurfaceLayerList;
+    Vector<RefPtr<LayerChromium> > dummyLayerList;
+    int dummyMaxTextureSize = 512;
+
+    parent->renderSurface()->setContentRect(IntRect(IntPoint::zero(), parent->bounds()));
+    parent->setClipRect(IntRect(IntPoint::zero(), parent->bounds()));
+    renderSurfaceLayerList.append(parent);
+
+    CCLayerTreeHostCommon::calculateDrawTransformsAndVisibility(parent.get(), parent.get(), identityMatrix, identityMatrix, renderSurfaceLayerList, dummyLayerList, dummyMaxTextureSize);
+
+    occlusion.enterTargetRenderSurface(child2->renderSurface());
+    occlusion.markOccludedBehindLayer(layer2.get());
+
+    EXPECT_EQ_RECT(IntRect(20, 40, 80, 60), occlusion.occlusionInScreenSpace().bounds());
+    EXPECT_EQ(1u, occlusion.occlusionInScreenSpace().rects().size());
+    EXPECT_EQ_RECT(IntRect(0, 420, 60, 80), occlusion.occlusionInTargetSurface().bounds());
+    EXPECT_EQ(1u, occlusion.occlusionInTargetSurface().rects().size());
+
+    EXPECT_TRUE(occlusion.occluded(child2.get(), IntRect(0, 420, 60, 80)));
+    EXPECT_FALSE(occlusion.occluded(child2.get(), IntRect(-1, 420, 60, 80)));
+    EXPECT_FALSE(occlusion.occluded(child2.get(), IntRect(0, 419, 60, 80)));
+    EXPECT_FALSE(occlusion.occluded(child2.get(), IntRect(0, 420, 61, 80)));
+    EXPECT_FALSE(occlusion.occluded(child2.get(), IntRect(0, 420, 60, 81)));
+
+    // Surface is not occluded by things that draw into itself.
+    EXPECT_EQ_RECT(IntRect(0, 420, 60, 80), occlusion.surfaceUnoccludedContentRect(child2.get(), IntRect(0, 420, 60, 80)));
+
+    occlusion.markOccludedBehindLayer(child2.get());
+    occlusion.finishedTargetRenderSurface(child2.get(), child2->renderSurface());
+    occlusion.leaveToTargetRenderSurface(parent->renderSurface());
+    occlusion.enterTargetRenderSurface(child1->renderSurface());
+    occlusion.markOccludedBehindLayer(layer1.get());
+
+    EXPECT_EQ_RECT(IntRect(20, 30, 80, 70), occlusion.occlusionInScreenSpace().bounds());
+    EXPECT_EQ(2u, occlusion.occlusionInScreenSpace().rects().size());
+    EXPECT_EQ_RECT(IntRect(0, 430, 70, 70), occlusion.occlusionInTargetSurface().bounds());
+    EXPECT_EQ(1u, occlusion.occlusionInTargetSurface().rects().size());
+
+    EXPECT_TRUE(occlusion.occluded(child1.get(), IntRect(0, 430, 70, 70)));
+    EXPECT_FALSE(occlusion.occluded(child1.get(), IntRect(-1, 430, 70, 70)));
+    EXPECT_FALSE(occlusion.occluded(child1.get(), IntRect(0, 429, 70, 70)));
+    EXPECT_FALSE(occlusion.occluded(child1.get(), IntRect(0, 430, 71, 70)));
+    EXPECT_FALSE(occlusion.occluded(child1.get(), IntRect(0, 430, 70, 71)));
+
+    // Surface is not occluded by things that draw into itself, but the |child1| surface should be occluded by the |child2| surface.
+    EXPECT_EQ_RECT(IntRect(0, 430, 10, 70), occlusion.surfaceUnoccludedContentRect(child1.get(), IntRect(0, 430, 70, 70)));
+
+    occlusion.markOccludedBehindLayer(child1.get());
+    occlusion.finishedTargetRenderSurface(child1.get(), child1->renderSurface());
+    occlusion.leaveToTargetRenderSurface(parent->renderSurface());
+
+    EXPECT_EQ_RECT(IntRect(20, 30, 80, 70), occlusion.occlusionInScreenSpace().bounds());
+    EXPECT_EQ(2u, occlusion.occlusionInScreenSpace().rects().size());
+    EXPECT_EQ_RECT(IntRect(20, 30, 80, 70), occlusion.occlusionInTargetSurface().bounds());
+    EXPECT_EQ(2u, occlusion.occlusionInTargetSurface().rects().size());
+
+    EXPECT_FALSE(occlusion.occluded(parent.get(), IntRect(20, 30, 80, 70)));
+
+    EXPECT_TRUE(occlusion.occluded(parent.get(), IntRect(30, 30, 70, 70)));
+    EXPECT_FALSE(occlusion.occluded(parent.get(), IntRect(29, 30, 70, 70)));
+    EXPECT_FALSE(occlusion.occluded(parent.get(), IntRect(30, 29, 70, 70)));
+
+    EXPECT_TRUE(occlusion.occluded(parent.get(), IntRect(20, 40, 80, 60)));
+    EXPECT_FALSE(occlusion.occluded(parent.get(), IntRect(19, 40, 80, 60)));
+    EXPECT_FALSE(occlusion.occluded(parent.get(), IntRect(20, 39, 80, 60)));
+
+    // |child1| and |child2| both draw into parent so they should not occlude it.
+    EXPECT_EQ_RECT(IntRect(20, 30, 80, 70), occlusion.surfaceUnoccludedContentRect(parent.get(), IntRect(20, 30, 80, 70)));
+
+
+    /* Justification for the above occlusion:
+               100
+      +---------------------+
+      |                     |
+      |    30               |       child1
+      |  30+ ---------------------------------+
+  100 |  40|                |     child2      |
+      |20+----------------------------------+ |
+      |  | |                |               | |
+      |  | |                |               | |
+      |  | |                |               | |
+      +--|-|----------------+               | |
+         | |                                | | 500
+         | |                                | |
+         | |                                | |
+         | |                                | |
+         | |                                | |
+         | |                                | |
+         | |                                | |
+         | +--------------------------------|-+
+         |                                  |
+         +----------------------------------+
+                         500
+     */
+}
+
+TEST(CCOcclusionTrackerTest, surfaceOcclusionInScreenSpace)
+{
+    // This tests that the right transforms are being used.
+    TestCCOcclusionTracker occlusion;
+    const TransformationMatrix identityMatrix;
+    RefPtr<LayerChromium> parent = LayerChromium::create();
+    RefPtr<LayerChromium> child1 = LayerChromium::create();
+    RefPtr<LayerChromium> child2 = LayerChromium::create();
+    RefPtr<LayerChromiumWithForcedDrawsContent> layer1 = adoptRef(new LayerChromiumWithForcedDrawsContent());
+    RefPtr<LayerChromiumWithForcedDrawsContent> layer2 = adoptRef(new LayerChromiumWithForcedDrawsContent());
+    parent->createRenderSurface();
+    parent->addChild(child1);
+    parent->addChild(child2);
+    child1->addChild(layer1);
+    child2->addChild(layer2);
+
+    TransformationMatrix childTransform;
+    childTransform.translate(250, 250);
+    childTransform.rotate(90);
+    childTransform.translate(-250, -250);
+
+    // The owning layers have very different bounds from the surfaces that they own.
+    setLayerPropertiesForTesting(parent.get(), identityMatrix, identityMatrix, FloatPoint(0, 0), FloatPoint(0, 0), IntSize(100, 100), false);
+    setLayerPropertiesForTesting(child1.get(), childTransform, identityMatrix, FloatPoint(0, 0), FloatPoint(30, 30), IntSize(10, 10), false);
+    setLayerPropertiesForTesting(layer1.get(), identityMatrix, identityMatrix, FloatPoint(0, 0), FloatPoint(-10, -10), IntSize(510, 510), true);
+    setLayerPropertiesForTesting(child2.get(), childTransform, identityMatrix, FloatPoint(0, 0), FloatPoint(20, 40), IntSize(10, 10), false);
+    setLayerPropertiesForTesting(layer2.get(), identityMatrix, identityMatrix, FloatPoint(0, 0), FloatPoint(-10, -10), IntSize(510, 510), true);
+
+    // Make them both render surfaces
+    FilterOperations filters;
+    filters.operations().append(BasicComponentTransferFilterOperation::create(0.5, FilterOperation::GRAYSCALE));
+    child1->setFilters(filters);
+    child2->setFilters(filters);
+
+    child1->setMasksToBounds(false);
+    child2->setMasksToBounds(false);
+
+    Vector<RefPtr<LayerChromium> > renderSurfaceLayerList;
+    Vector<RefPtr<LayerChromium> > dummyLayerList;
+    int dummyMaxTextureSize = 512;
+
+    parent->renderSurface()->setContentRect(IntRect(IntPoint::zero(), parent->bounds()));
+    parent->setClipRect(IntRect(IntPoint::zero(), parent->bounds()));
+    renderSurfaceLayerList.append(parent);
+
+    CCLayerTreeHostCommon::calculateDrawTransformsAndVisibility(parent.get(), parent.get(), identityMatrix, identityMatrix, renderSurfaceLayerList, dummyLayerList, dummyMaxTextureSize);
+
+    occlusion.enterTargetRenderSurface(child2->renderSurface());
+    occlusion.markOccludedBehindLayer(layer2.get());
+
+    EXPECT_EQ_RECT(IntRect(20, 30, 80, 70), occlusion.occlusionInScreenSpace().bounds());
+    EXPECT_EQ(1u, occlusion.occlusionInScreenSpace().rects().size());
+    EXPECT_EQ_RECT(IntRect(-10, 420, 70, 80), occlusion.occlusionInTargetSurface().bounds());
+    EXPECT_EQ(1u, occlusion.occlusionInTargetSurface().rects().size());
+
+    EXPECT_TRUE(occlusion.occluded(child2.get(), IntRect(-10, 420, 70, 80)));
+    EXPECT_FALSE(occlusion.occluded(child2.get(), IntRect(-11, 420, 70, 80)));
+    EXPECT_FALSE(occlusion.occluded(child2.get(), IntRect(-10, 419, 70, 80)));
+    EXPECT_FALSE(occlusion.occluded(child2.get(), IntRect(-10, 420, 71, 80)));
+    EXPECT_FALSE(occlusion.occluded(child2.get(), IntRect(-10, 420, 70, 81)));
+
+    // Surface is not occluded by things that draw into itself.
+    EXPECT_EQ_RECT(IntRect(-10, 420, 70, 80), occlusion.surfaceUnoccludedContentRect(child2.get(), IntRect(-10, 420, 70, 80)));
+    EXPECT_FALSE(occlusion.surfaceOccluded(child2.get(), IntRect(30, 250, 1, 1)));
+
+    occlusion.markOccludedBehindLayer(child2.get());
+    occlusion.finishedTargetRenderSurface(child2.get(), child2->renderSurface());
+    occlusion.leaveToTargetRenderSurface(parent->renderSurface());
+    occlusion.enterTargetRenderSurface(child1->renderSurface());
+    occlusion.markOccludedBehindLayer(layer1.get());
+
+    EXPECT_EQ_RECT(IntRect(20, 20, 80, 80), occlusion.occlusionInScreenSpace().bounds());
+    EXPECT_EQ(2u, occlusion.occlusionInScreenSpace().rects().size());
+    EXPECT_EQ_RECT(IntRect(-10, 430, 80, 70), occlusion.occlusionInTargetSurface().bounds());
+    EXPECT_EQ(1u, occlusion.occlusionInTargetSurface().rects().size());
+
+    EXPECT_TRUE(occlusion.occluded(child1.get(), IntRect(-10, 430, 80, 70)));
+    EXPECT_FALSE(occlusion.occluded(child1.get(), IntRect(-11, 430, 80, 70)));
+    EXPECT_FALSE(occlusion.occluded(child1.get(), IntRect(-10, 429, 80, 70)));
+    EXPECT_FALSE(occlusion.occluded(child1.get(), IntRect(-10, 430, 81, 70)));
+    EXPECT_FALSE(occlusion.occluded(child1.get(), IntRect(-10, 430, 80, 71)));
+
+    // Surface is not occluded by things that draw into itself, but the |child1| surface should be occluded by the |child2| surface.
+    EXPECT_EQ_RECT(IntRect(-10, 430, 10, 80), occlusion.surfaceUnoccludedContentRect(child1.get(), IntRect(-10, 430, 70, 80)));
+    EXPECT_TRUE(occlusion.surfaceOccluded(child1.get(), IntRect(0, 430, 70, 80)));
+    EXPECT_FALSE(occlusion.surfaceOccluded(child1.get(), IntRect(-1, 430, 70, 80)));
+    EXPECT_FALSE(occlusion.surfaceOccluded(child1.get(), IntRect(0, 429, 70, 80)));
+    EXPECT_FALSE(occlusion.surfaceOccluded(child1.get(), IntRect(1, 430, 70, 80)));
+    EXPECT_FALSE(occlusion.surfaceOccluded(child1.get(), IntRect(0, 431, 70, 80)));
+
+    occlusion.markOccludedBehindLayer(child1.get());
+    occlusion.finishedTargetRenderSurface(child1.get(), child1->renderSurface());
+    occlusion.leaveToTargetRenderSurface(parent->renderSurface());
+
+    EXPECT_EQ_RECT(IntRect(20, 20, 80, 80), occlusion.occlusionInScreenSpace().bounds());
+    EXPECT_EQ(2u, occlusion.occlusionInScreenSpace().rects().size());
+    EXPECT_EQ_RECT(IntRect(20, 20, 80, 80), occlusion.occlusionInTargetSurface().bounds());
+    EXPECT_EQ(2u, occlusion.occlusionInTargetSurface().rects().size());
+
+    EXPECT_FALSE(occlusion.occluded(parent.get(), IntRect(20, 20, 80, 80)));
+
+    EXPECT_TRUE(occlusion.occluded(parent.get(), IntRect(30, 20, 70, 80)));
+    EXPECT_FALSE(occlusion.occluded(parent.get(), IntRect(29, 20, 70, 80)));
+    EXPECT_FALSE(occlusion.occluded(parent.get(), IntRect(30, 19, 70, 80)));
+
+    EXPECT_TRUE(occlusion.occluded(parent.get(), IntRect(20, 30, 80, 70)));
+    EXPECT_FALSE(occlusion.occluded(parent.get(), IntRect(19, 30, 80, 70)));
+    EXPECT_FALSE(occlusion.occluded(parent.get(), IntRect(20, 29, 80, 70)));
+
+    // |child1| and |child2| both draw into parent so they should not occlude it.
+    EXPECT_EQ_RECT(IntRect(20, 20, 80, 80), occlusion.surfaceUnoccludedContentRect(parent.get(), IntRect(20, 20, 80, 80)));
+    EXPECT_FALSE(occlusion.surfaceOccluded(parent.get(), IntRect(50, 50, 1, 1)));
+
+
+    /* Justification for the above occlusion:
+               100
+      +---------------------+
+      |    20               |       layer1
+      |  30+ ---------------------------------+
+  100 |  30|                |     layer2      |
+      |20+----------------------------------+ |
+      |  | |                |               | |
+      |  | |                |               | |
+      |  | |                |               | |
+      +--|-|----------------+               | |
+         | |                                | | 510
+         | |                                | |
+         | |                                | |
+         | |                                | |
+         | |                                | |
+         | |                                | |
+         | |                                | |
+         | +--------------------------------|-+
+         |                                  |
+         +----------------------------------+
+                         510
+     */
+}
+
+TEST(CCOcclusionTrackerTest, surfaceOcclusionInScreenSpaceDifferentTransforms)
+{
+    // This tests that the right transforms are being used.
+    TestCCOcclusionTracker occlusion;
+    const TransformationMatrix identityMatrix;
+    RefPtr<LayerChromium> parent = LayerChromium::create();
+    RefPtr<LayerChromium> child1 = LayerChromium::create();
+    RefPtr<LayerChromium> child2 = LayerChromium::create();
+    RefPtr<LayerChromiumWithForcedDrawsContent> layer1 = adoptRef(new LayerChromiumWithForcedDrawsContent());
+    RefPtr<LayerChromiumWithForcedDrawsContent> layer2 = adoptRef(new LayerChromiumWithForcedDrawsContent());
+    parent->createRenderSurface();
+    parent->addChild(child1);
+    parent->addChild(child2);
+    child1->addChild(layer1);
+    child2->addChild(layer2);
+
+    TransformationMatrix child1Transform;
+    child1Transform.translate(250, 250);
+    child1Transform.rotate(-90);
+    child1Transform.translate(-250, -250);
+
+    TransformationMatrix child2Transform;
+    child2Transform.translate(250, 250);
+    child2Transform.rotate(90);
+    child2Transform.translate(-250, -250);
+
+    // The owning layers have very different bounds from the surfaces that they own.
+    setLayerPropertiesForTesting(parent.get(), identityMatrix, identityMatrix, FloatPoint(0, 0), FloatPoint(0, 0), IntSize(100, 100), false);
+    setLayerPropertiesForTesting(child1.get(), child1Transform, identityMatrix, FloatPoint(0, 0), FloatPoint(30, 20), IntSize(10, 10), false);
+    setLayerPropertiesForTesting(layer1.get(), identityMatrix, identityMatrix, FloatPoint(0, 0), FloatPoint(-10, -20), IntSize(510, 520), true);
+    setLayerPropertiesForTesting(child2.get(), child2Transform, identityMatrix, FloatPoint(0, 0), FloatPoint(20, 40), IntSize(10, 10), false);
+    setLayerPropertiesForTesting(layer2.get(), identityMatrix, identityMatrix, FloatPoint(0, 0), FloatPoint(-10, -10), IntSize(510, 510), true);
+
+    // Make them both render surfaces
+    FilterOperations filters;
+    filters.operations().append(BasicComponentTransferFilterOperation::create(0.5, FilterOperation::GRAYSCALE));
+    child1->setFilters(filters);
+    child2->setFilters(filters);
+
+    child1->setMasksToBounds(false);
+    child2->setMasksToBounds(false);
+
+    Vector<RefPtr<LayerChromium> > renderSurfaceLayerList;
+    Vector<RefPtr<LayerChromium> > dummyLayerList;
+    int dummyMaxTextureSize = 512;
+
+    parent->renderSurface()->setContentRect(IntRect(IntPoint::zero(), parent->bounds()));
+    parent->setClipRect(IntRect(IntPoint::zero(), parent->bounds()));
+    renderSurfaceLayerList.append(parent);
+
+    CCLayerTreeHostCommon::calculateDrawTransformsAndVisibility(parent.get(), parent.get(), identityMatrix, identityMatrix, renderSurfaceLayerList, dummyLayerList, dummyMaxTextureSize);
+
+    occlusion.enterTargetRenderSurface(child2->renderSurface());
+    occlusion.markOccludedBehindLayer(layer2.get());
+
+    EXPECT_EQ_RECT(IntRect(20, 30, 80, 70), occlusion.occlusionInScreenSpace().bounds());
+    EXPECT_EQ(1u, occlusion.occlusionInScreenSpace().rects().size());
+    EXPECT_EQ_RECT(IntRect(-10, 420, 70, 80), occlusion.occlusionInTargetSurface().bounds());
+    EXPECT_EQ(1u, occlusion.occlusionInTargetSurface().rects().size());
+
+    EXPECT_TRUE(occlusion.occluded(child2.get(), IntRect(-10, 420, 70, 80)));
+    EXPECT_FALSE(occlusion.occluded(child2.get(), IntRect(-11, 420, 70, 80)));
+    EXPECT_FALSE(occlusion.occluded(child2.get(), IntRect(-10, 419, 70, 80)));
+    EXPECT_FALSE(occlusion.occluded(child2.get(), IntRect(-10, 420, 71, 80)));
+    EXPECT_FALSE(occlusion.occluded(child2.get(), IntRect(-10, 420, 70, 81)));
+
+    // Surface is not occluded by things that draw into itself.
+    EXPECT_EQ_RECT(IntRect(-10, 420, 70, 80), occlusion.surfaceUnoccludedContentRect(child2.get(), IntRect(-10, 420, 70, 80)));
+    EXPECT_FALSE(occlusion.surfaceOccluded(child2.get(), IntRect(30, 250, 1, 1)));
+
+    occlusion.markOccludedBehindLayer(child2.get());
+    occlusion.finishedTargetRenderSurface(child2.get(), child2->renderSurface());
+    occlusion.leaveToTargetRenderSurface(parent->renderSurface());
+    occlusion.enterTargetRenderSurface(child1->renderSurface());
+    occlusion.markOccludedBehindLayer(layer1.get());
+
+    EXPECT_EQ_RECT(IntRect(10, 20, 90, 80), occlusion.occlusionInScreenSpace().bounds());
+    EXPECT_EQ(1u, occlusion.occlusionInScreenSpace().rects().size());
+    EXPECT_EQ_RECT(IntRect(420, -20, 80, 90), occlusion.occlusionInTargetSurface().bounds());
+    EXPECT_EQ(1u, occlusion.occlusionInTargetSurface().rects().size());
+
+    EXPECT_TRUE(occlusion.occluded(child1.get(), IntRect(420, -20, 80, 90)));
+    EXPECT_FALSE(occlusion.occluded(child1.get(), IntRect(419, -20, 80, 90)));
+    EXPECT_FALSE(occlusion.occluded(child1.get(), IntRect(420, -21, 80, 90)));
+    EXPECT_FALSE(occlusion.occluded(child1.get(), IntRect(420, -19, 80, 90)));
+    EXPECT_FALSE(occlusion.occluded(child1.get(), IntRect(421, -20, 80, 90)));
+
+    // Surface is not occluded by things that draw into itself, but the |child1| surface should be occluded by the |child2| surface.
+    EXPECT_EQ_RECT(IntRect(420, -20, 80, 90), occlusion.surfaceUnoccludedContentRect(child1.get(), IntRect(420, -20, 80, 90)));
+    EXPECT_EQ_RECT(IntRect(490, -10, 10, 80), occlusion.surfaceUnoccludedContentRect(child1.get(), IntRect(420, -10, 80, 80)));
+    EXPECT_EQ_RECT(IntRect(420, -20, 70, 10), occlusion.surfaceUnoccludedContentRect(child1.get(), IntRect(420, -20, 70, 90)));
+    EXPECT_TRUE(occlusion.surfaceOccluded(child1.get(), IntRect(420, -10, 70, 80)));
+    EXPECT_FALSE(occlusion.surfaceOccluded(child1.get(), IntRect(419, -10, 70, 80)));
+    EXPECT_FALSE(occlusion.surfaceOccluded(child1.get(), IntRect(420, -11, 70, 80)));
+    EXPECT_FALSE(occlusion.surfaceOccluded(child1.get(), IntRect(421, -10, 70, 80)));
+    EXPECT_FALSE(occlusion.surfaceOccluded(child1.get(), IntRect(420, -9, 70, 80)));
+
+    occlusion.markOccludedBehindLayer(child1.get());
+    occlusion.finishedTargetRenderSurface(child1.get(), child1->renderSurface());
+    occlusion.leaveToTargetRenderSurface(parent->renderSurface());
+
+    EXPECT_EQ_RECT(IntRect(10, 20, 90, 80), occlusion.occlusionInScreenSpace().bounds());
+    EXPECT_EQ(1u, occlusion.occlusionInScreenSpace().rects().size());
+    EXPECT_EQ_RECT(IntRect(10, 20, 90, 80), occlusion.occlusionInTargetSurface().bounds());
+    EXPECT_EQ(1u, occlusion.occlusionInTargetSurface().rects().size());
+
+    EXPECT_TRUE(occlusion.occluded(parent.get(), IntRect(10, 20, 90, 80)));
+    EXPECT_FALSE(occlusion.occluded(parent.get(), IntRect(9, 20, 90, 80)));
+    EXPECT_FALSE(occlusion.occluded(parent.get(), IntRect(10, 19, 90, 80)));
+    EXPECT_FALSE(occlusion.occluded(parent.get(), IntRect(11, 20, 90, 80)));
+    EXPECT_FALSE(occlusion.occluded(parent.get(), IntRect(10, 21, 90, 80)));
+
+    // |child1| and |child2| both draw into parent so they should not occlude it.
+    EXPECT_EQ_RECT(IntRect(10, 20, 90, 80), occlusion.surfaceUnoccludedContentRect(parent.get(), IntRect(10, 20, 90, 80)));
+    EXPECT_FALSE(occlusion.surfaceOccluded(parent.get(), IntRect(10, 20, 1, 1)));
+    EXPECT_FALSE(occlusion.surfaceOccluded(parent.get(), IntRect(99, 20, 1, 1)));
+    EXPECT_FALSE(occlusion.surfaceOccluded(parent.get(), IntRect(10, 9, 1, 1)));
+    EXPECT_FALSE(occlusion.surfaceOccluded(parent.get(), IntRect(99, 99, 1, 1)));
+
+
+    /* Justification for the above occlusion:
+               100
+      +---------------------+
+      |20                   |       layer1
+     10+----------------------------------+
+  100 || 30                 |     layer2  |
+      |20+----------------------------------+
+      || |                  |             | |
+      || |                  |             | |
+      || |                  |             | |
+      +|-|------------------+             | |
+       | |                                | | 510
+       | |                            510 | |
+       | |                                | |
+       | |                                | |
+       | |                                | |
+       | |                                | |
+       | |                520             | |
+       +----------------------------------+ |
+         |                                  |
+         +----------------------------------+
+                         510
+     */
+}
+
+TEST(CCOcclusionTrackerTest, occlusionInteractionWithFilters)
+{
+    // This tests that the right transforms are being used.
+    TestCCOcclusionTracker occlusion;
+    const TransformationMatrix identityMatrix;
+    RefPtr<LayerChromium> parent = LayerChromium::create();
+    RefPtr<LayerChromiumWithForcedDrawsContent> blurLayer = adoptRef(new LayerChromiumWithForcedDrawsContent());
+    RefPtr<LayerChromiumWithForcedDrawsContent> opacityLayer = adoptRef(new LayerChromiumWithForcedDrawsContent());
+    RefPtr<LayerChromiumWithForcedDrawsContent> opaqueLayer = adoptRef(new LayerChromiumWithForcedDrawsContent());
+    parent->createRenderSurface();
+    parent->addChild(blurLayer);
+    parent->addChild(opacityLayer);
+    parent->addChild(opaqueLayer);
+
+    TransformationMatrix layerTransform;
+    layerTransform.translate(250, 250);
+    layerTransform.rotate(90);
+    layerTransform.translate(-250, -250);
+
+    setLayerPropertiesForTesting(parent.get(), identityMatrix, identityMatrix, FloatPoint(0, 0), FloatPoint(0, 0), IntSize(100, 100), false);
+    setLayerPropertiesForTesting(blurLayer.get(), layerTransform, identityMatrix, FloatPoint(0, 0), FloatPoint(30, 30), IntSize(500, 500), true);
+    setLayerPropertiesForTesting(opaqueLayer.get(), layerTransform, identityMatrix, FloatPoint(0, 0), FloatPoint(30, 30), IntSize(500, 500), true);
+    setLayerPropertiesForTesting(opacityLayer.get(), layerTransform, identityMatrix, FloatPoint(0, 0), FloatPoint(30, 30), IntSize(500, 500), true);
+
+    {
+        FilterOperations filters;
+        filters.operations().append(BlurFilterOperation::create(Length(10, WebCore::Percent), FilterOperation::BLUR));
+        blurLayer->setFilters(filters);
+    }
+
+    {
+        FilterOperations filters;
+        filters.operations().append(BasicComponentTransferFilterOperation::create(0.5, FilterOperation::GRAYSCALE));
+        opaqueLayer->setFilters(filters);
+    }
+
+    {
+        FilterOperations filters;
+        filters.operations().append(BasicComponentTransferFilterOperation::create(0.5, FilterOperation::OPACITY));
+        opacityLayer->setFilters(filters);
+    }
+
+
+    Vector<RefPtr<LayerChromium> > renderSurfaceLayerList;
+    Vector<RefPtr<LayerChromium> > dummyLayerList;
+    int dummyMaxTextureSize = 512;
+
+    parent->renderSurface()->setContentRect(IntRect(IntPoint::zero(), parent->bounds()));
+    parent->setClipRect(IntRect(IntPoint::zero(), parent->bounds()));
+    renderSurfaceLayerList.append(parent);
+
+    CCLayerTreeHostCommon::calculateDrawTransformsAndVisibility(parent.get(), parent.get(), identityMatrix, identityMatrix, renderSurfaceLayerList, dummyLayerList, dummyMaxTextureSize);
+
+    // Opacity layer won't contribute to occlusion.
+    occlusion.enterTargetRenderSurface(opacityLayer->renderSurface());
+    occlusion.markOccludedBehindLayer(opacityLayer.get());
+    occlusion.finishedTargetRenderSurface(opacityLayer.get(), opacityLayer->renderSurface());
+
+    EXPECT_TRUE(occlusion.occlusionInScreenSpace().isEmpty());
+    EXPECT_TRUE(occlusion.occlusionInTargetSurface().isEmpty());
+
+    // And has nothing to contribute to its parent surface.
+    occlusion.leaveToTargetRenderSurface(parent->renderSurface());
+    EXPECT_TRUE(occlusion.occlusionInScreenSpace().isEmpty());
+    EXPECT_TRUE(occlusion.occlusionInTargetSurface().isEmpty());
+
+    // Opaque layer will contribute to occlusion.
+    occlusion.enterTargetRenderSurface(opaqueLayer->renderSurface());
+    occlusion.markOccludedBehindLayer(opaqueLayer.get());
+    occlusion.finishedTargetRenderSurface(opaqueLayer.get(), opaqueLayer->renderSurface());
+
+    EXPECT_EQ_RECT(IntRect(30, 30, 70, 70), occlusion.occlusionInScreenSpace().bounds());
+    EXPECT_EQ(1u, occlusion.occlusionInScreenSpace().rects().size());
+    EXPECT_EQ_RECT(IntRect(0, 430, 70, 70), occlusion.occlusionInTargetSurface().bounds());
+    EXPECT_EQ(1u, occlusion.occlusionInTargetSurface().rects().size());
+
+    // And it gets translated to the parent surface.
+    occlusion.leaveToTargetRenderSurface(parent->renderSurface());
+    EXPECT_EQ_RECT(IntRect(30, 30, 70, 70), occlusion.occlusionInScreenSpace().bounds());
+    EXPECT_EQ(1u, occlusion.occlusionInScreenSpace().rects().size());
+    EXPECT_EQ_RECT(IntRect(30, 30, 70, 70), occlusion.occlusionInTargetSurface().bounds());
+    EXPECT_EQ(1u, occlusion.occlusionInTargetSurface().rects().size());
+
+    // The blur layer needs to throw away any occlusion from outside its subtree.
+    occlusion.enterTargetRenderSurface(blurLayer->renderSurface());
+    EXPECT_TRUE(occlusion.occlusionInScreenSpace().isEmpty());
+    EXPECT_TRUE(occlusion.occlusionInTargetSurface().isEmpty());
+
+    // And it won't contribute to occlusion.
+    occlusion.markOccludedBehindLayer(blurLayer.get());
+    occlusion.finishedTargetRenderSurface(blurLayer.get(), blurLayer->renderSurface());
+    EXPECT_TRUE(occlusion.occlusionInScreenSpace().isEmpty());
+    EXPECT_TRUE(occlusion.occlusionInTargetSurface().isEmpty());
+
+    // But the opaque layer's occlusion is preserved on the parent.
+    occlusion.leaveToTargetRenderSurface(parent->renderSurface());
+    EXPECT_EQ_RECT(IntRect(30, 30, 70, 70), occlusion.occlusionInScreenSpace().bounds());
+    EXPECT_EQ(1u, occlusion.occlusionInScreenSpace().rects().size());
+    EXPECT_EQ_RECT(IntRect(30, 30, 70, 70), occlusion.occlusionInTargetSurface().bounds());
+    EXPECT_EQ(1u, occlusion.occlusionInTargetSurface().rects().size());
+}
+
+} // namespace
diff --git a/Source/WebKit/chromium/tests/CCQuadCullerTest.cpp b/Source/WebKit/chromium/tests/CCQuadCullerTest.cpp
index 299e5c7e5..d49703e14 100644
--- a/Source/WebKit/chromium/tests/CCQuadCullerTest.cpp
+++ b/Source/WebKit/chromium/tests/CCQuadCullerTest.cpp
@@ -79,7 +79,7 @@ TEST(CCQuadCullerTest, verifyCullChildLinesUpTopLeft)
 
     setQuads(rootState.get(), childState.get(), quadList);
     EXPECT_EQ(quadList.size(), 13u);
-    CCQuadCuller::cullOccludedQuads(quadList);
+    CCQuadCuller::cullOccludedQuads(quadList, false, IntRect());
     EXPECT_EQ(quadList.size(), 9u);
 }
 
@@ -92,7 +92,7 @@ TEST(CCQuadCullerTest, verifyCullWhenChildOpacityNotOne)
 
     setQuads(rootState.get(), childState.get(), quadList);
     EXPECT_EQ(quadList.size(), 13u);
-    CCQuadCuller::cullOccludedQuads(quadList);
+    CCQuadCuller::cullOccludedQuads(quadList, false, IntRect());
     EXPECT_EQ(quadList.size(), 13u);
 }
 
@@ -105,7 +105,7 @@ TEST(CCQuadCullerTest, verifyCullWhenChildOpaqueFlagFalse)
 
     setQuads(rootState.get(), childState.get(), quadList);
     EXPECT_EQ(quadList.size(), 13u);
-    CCQuadCuller::cullOccludedQuads(quadList);
+    CCQuadCuller::cullOccludedQuads(quadList, false, IntRect());
     EXPECT_EQ(quadList.size(), 13u);
 }
 
@@ -120,7 +120,7 @@ TEST(CCQuadCullerTest, verifyCullCenterTileOnly)
 
     setQuads(rootState.get(), childState.get(), quadList);
     EXPECT_EQ(quadList.size(), 13u);
-    CCQuadCuller::cullOccludedQuads(quadList);
+    CCQuadCuller::cullOccludedQuads(quadList, false, IntRect());
     EXPECT_EQ(quadList.size(), 12u);
 
     IntRect quadVisibleRect1 = quadList[1].get()->quadVisibleRect();
@@ -158,7 +158,7 @@ TEST(CCQuadCullerTest, verifyCullCenterTileNonIntegralSize1)
     quadList.append(MakeTileQuad(childState.get(), IntRect(IntPoint(), IntSize(100, 100))));
 
     EXPECT_EQ(quadList.size(), 2u);
-    CCQuadCuller::cullOccludedQuads(quadList);
+    CCQuadCuller::cullOccludedQuads(quadList, false, IntRect());
     EXPECT_EQ(quadList.size(), 2u);
 }
 
@@ -181,7 +181,7 @@ TEST(CCQuadCullerTest, verifyCullCenterTileNonIntegralSize2)
     quadList.append(MakeTileQuad(childState.get(), IntRect(IntPoint(), IntSize(100, 100))));
 
     EXPECT_EQ(quadList.size(), 2u);
-    CCQuadCuller::cullOccludedQuads(quadList);
+    CCQuadCuller::cullOccludedQuads(quadList, false, IntRect());
     EXPECT_EQ(quadList.size(), 2u);
 }
 
@@ -196,7 +196,7 @@ TEST(CCQuadCullerTest, verifyCullChildLinesUpBottomRight)
 
     setQuads(rootState.get(), childState.get(), quadList);
     EXPECT_EQ(quadList.size(), 13u);
-    CCQuadCuller::cullOccludedQuads(quadList);
+    CCQuadCuller::cullOccludedQuads(quadList, false, IntRect());
     EXPECT_EQ(quadList.size(), 9u);
 }
 
@@ -212,7 +212,7 @@ TEST(CCQuadCullerTest, verifyCullSubRegion)
 
     setQuads(rootState.get(), childState.get(), quadList, childOpaqueRect);
     EXPECT_EQ(quadList.size(), 13u);
-    CCQuadCuller::cullOccludedQuads(quadList);
+    CCQuadCuller::cullOccludedQuads(quadList, false, IntRect());
     EXPECT_EQ(quadList.size(), 12u);
 }
 
@@ -228,7 +228,7 @@ TEST(CCQuadCullerTest, verifyCullSubRegion2)
 
     setQuads(rootState.get(), childState.get(), quadList, childOpaqueRect);
     EXPECT_EQ(quadList.size(), 13u);
-    CCQuadCuller::cullOccludedQuads(quadList);
+    CCQuadCuller::cullOccludedQuads(quadList, false, IntRect());
     EXPECT_EQ(quadList.size(), 12u);
 }
 
@@ -244,7 +244,7 @@ TEST(CCQuadCullerTest, verifyCullSubRegionCheckOvercull)
 
     setQuads(rootState.get(), childState.get(), quadList, childOpaqueRect);
     EXPECT_EQ(quadList.size(), 13u);
-    CCQuadCuller::cullOccludedQuads(quadList);
+    CCQuadCuller::cullOccludedQuads(quadList, false, IntRect());
     EXPECT_EQ(quadList.size(), 13u);
 }
 
@@ -260,7 +260,7 @@ TEST(CCQuadCullerTest, verifyNonAxisAlignedQuadsDontOcclude)
 
     setQuads(rootState.get(), childState.get(), quadList);
     EXPECT_EQ(quadList.size(), 13u);
-    CCQuadCuller::cullOccludedQuads(quadList);
+    CCQuadCuller::cullOccludedQuads(quadList, false, IntRect());
     EXPECT_EQ(quadList.size(), 13u);
 }
 
@@ -282,8 +282,61 @@ TEST(CCQuadCullerTest, verifyNonAxisAlignedQuadsSafelyCulled)
 
     setQuads(rootState.get(), childState.get(), quadList);
     EXPECT_EQ(quadList.size(), 13u);
-    CCQuadCuller::cullOccludedQuads(quadList);
+    CCQuadCuller::cullOccludedQuads(quadList, false, IntRect());
     EXPECT_EQ(quadList.size(), 12u);
 }
 
+TEST(CCQuadCullerTest, veriftyCullOutsideScissorOverTile)
+{
+    DECLARE_AND_INITIALIZE_TEST_QUADS
+
+    OwnPtr<CCSharedQuadState> rootState = CCSharedQuadState::create(TransformationMatrix(), TransformationMatrix(), rootRect, IntRect(), 1.0, true);
+    OwnPtr<CCSharedQuadState> childState = CCSharedQuadState::create(childTransform, TransformationMatrix(), childRect, IntRect(), 1.0, true);
+
+    setQuads(rootState.get(), childState.get(), quadList);
+    EXPECT_EQ(quadList.size(), 13u);
+    CCQuadCuller::cullOccludedQuads(quadList, true, IntRect(200, 100, 100, 100));
+    EXPECT_EQ(quadList.size(), 1u);
+}
+
+TEST(CCQuadCullerTest, veriftyCullOutsideScissorOverCulledTile)
+{
+    DECLARE_AND_INITIALIZE_TEST_QUADS
+
+    OwnPtr<CCSharedQuadState> rootState = CCSharedQuadState::create(TransformationMatrix(), TransformationMatrix(), rootRect, IntRect(), 1.0, true);
+    OwnPtr<CCSharedQuadState> childState = CCSharedQuadState::create(childTransform, TransformationMatrix(), childRect, IntRect(), 1.0, true);
+
+    setQuads(rootState.get(), childState.get(), quadList);
+    EXPECT_EQ(quadList.size(), 13u);
+    CCQuadCuller::cullOccludedQuads(quadList, true, IntRect(100, 100, 100, 100));
+    EXPECT_EQ(quadList.size(), 1u);
+}
+
+TEST(CCQuadCullerTest, veriftyCullOutsideScissorOverPartialTiles)
+{
+    DECLARE_AND_INITIALIZE_TEST_QUADS
+
+    OwnPtr<CCSharedQuadState> rootState = CCSharedQuadState::create(TransformationMatrix(), TransformationMatrix(), rootRect, IntRect(), 1.0, true);
+    OwnPtr<CCSharedQuadState> childState = CCSharedQuadState::create(childTransform, TransformationMatrix(), childRect, IntRect(), 1.0, true);
+
+    setQuads(rootState.get(), childState.get(), quadList);
+    EXPECT_EQ(quadList.size(), 13u);
+    CCQuadCuller::cullOccludedQuads(quadList, true, IntRect(50, 50, 200, 200));
+    EXPECT_EQ(quadList.size(), 9u);
+}
+
+TEST(CCQuadCullerTest, veriftyCullOutsideScissorOverNoTiles)
+{
+    DECLARE_AND_INITIALIZE_TEST_QUADS
+
+    OwnPtr<CCSharedQuadState> rootState = CCSharedQuadState::create(TransformationMatrix(), TransformationMatrix(), rootRect, IntRect(), 1.0, true);
+    OwnPtr<CCSharedQuadState> childState = CCSharedQuadState::create(childTransform, TransformationMatrix(), childRect, IntRect(), 1.0, true);
+
+    setQuads(rootState.get(), childState.get(), quadList);
+    EXPECT_EQ(quadList.size(), 13u);
+    CCQuadCuller::cullOccludedQuads(quadList, true, IntRect(500, 500, 100, 100));
+    EXPECT_EQ(quadList.size(), 0u);
+}
+
+
 } // namespace
diff --git a/Source/WebKit/chromium/tests/Canvas2DLayerChromiumTest.cpp b/Source/WebKit/chromium/tests/Canvas2DLayerChromiumTest.cpp
index 4b3dd27d3..ec0ce0c6a 100644
--- a/Source/WebKit/chromium/tests/Canvas2DLayerChromiumTest.cpp
+++ b/Source/WebKit/chromium/tests/Canvas2DLayerChromiumTest.cpp
@@ -79,8 +79,8 @@ protected:
     {
         GraphicsContext3D::Attributes attrs;
 
-        RefPtr<GraphicsContext3D> mainContext = GraphicsContext3DPrivate::createGraphicsContextFromWebContext(adoptPtr(new MockCanvasContext()), attrs, 0, GraphicsContext3D::RenderDirectlyToHostWindow, GraphicsContext3DPrivate::ForUseOnThisThread);
-        RefPtr<GraphicsContext3D> implContext = GraphicsContext3DPrivate::createGraphicsContextFromWebContext(adoptPtr(new MockCanvasContext()), attrs, 0, GraphicsContext3D::RenderDirectlyToHostWindow, GraphicsContext3DPrivate::ForUseOnThisThread);
+        RefPtr<GraphicsContext3D> mainContext = GraphicsContext3DPrivate::createGraphicsContextFromWebContext(adoptPtr(new MockCanvasContext()), GraphicsContext3D::RenderDirectlyToHostWindow);
+        RefPtr<GraphicsContext3D> implContext = GraphicsContext3DPrivate::createGraphicsContextFromWebContext(adoptPtr(new MockCanvasContext()), GraphicsContext3D::RenderDirectlyToHostWindow);
 
         MockCanvasContext& mainMock = *static_cast<MockCanvasContext*>(GraphicsContext3DPrivate::extractWebGraphicsContext3D(mainContext.get()));
         MockCanvasContext& implMock = *static_cast<MockCanvasContext*>(GraphicsContext3DPrivate::extractWebGraphicsContext3D(implContext.get()));
diff --git a/Source/WebKit/chromium/tests/CompositorFakeGraphicsContext3D.h b/Source/WebKit/chromium/tests/CompositorFakeGraphicsContext3D.h
index 1f0897341..937b62d4c 100644
--- a/Source/WebKit/chromium/tests/CompositorFakeGraphicsContext3D.h
+++ b/Source/WebKit/chromium/tests/CompositorFakeGraphicsContext3D.h
@@ -37,10 +37,7 @@ static PassRefPtr<GraphicsContext3D> createCompositorMockGraphicsContext3D(Graph
     webAttrs.alpha = attrs.alpha;
 
     OwnPtr<WebKit::WebGraphicsContext3D> webContext = WebKit::CompositorFakeWebGraphicsContext3D::create(webAttrs);
-    return GraphicsContext3DPrivate::createGraphicsContextFromWebContext(
-        webContext.release(), attrs, 0,
-        GraphicsContext3D::RenderDirectlyToHostWindow,
-        GraphicsContext3DPrivate::ForUseOnAnotherThread);
+    return GraphicsContext3DPrivate::createGraphicsContextFromWebContext(webContext.release(), GraphicsContext3D::RenderDirectlyToHostWindow);
 }
 
 }
diff --git a/Source/WebKit/chromium/tests/FakeGraphicsContext3DTest.cpp b/Source/WebKit/chromium/tests/FakeGraphicsContext3DTest.cpp
index 2b76b80ad..71cb8bab1 100644
--- a/Source/WebKit/chromium/tests/FakeGraphicsContext3DTest.cpp
+++ b/Source/WebKit/chromium/tests/FakeGraphicsContext3DTest.cpp
@@ -52,7 +52,7 @@ private:
 TEST(FakeGraphicsContext3DTest, CanOverrideManually)
 {
     GraphicsContext3D::Attributes attrs;
-    RefPtr<GraphicsContext3D> context = GraphicsContext3DPrivate::createGraphicsContextFromWebContext(adoptPtr(new FrameCountingContext()), attrs, 0, GraphicsContext3D::RenderDirectlyToHostWindow, GraphicsContext3DPrivate::ForUseOnThisThread);
+    RefPtr<GraphicsContext3D> context = GraphicsContext3DPrivate::createGraphicsContextFromWebContext(adoptPtr(new FrameCountingContext()), GraphicsContext3D::RenderDirectlyToHostWindow);
     FrameCountingContext& mockContext = *static_cast<FrameCountingContext*>(GraphicsContext3DPrivate::extractWebGraphicsContext3D(context.get()));
 
     for (int i = 0; i < 10; i++) {
@@ -73,7 +73,7 @@ public:
 TEST(FakeGraphicsContext3DTest, CanUseGMock)
 {
     GraphicsContext3D::Attributes attrs;
-    RefPtr<GraphicsContext3D> context = GraphicsContext3DPrivate::createGraphicsContextFromWebContext(adoptPtr(new GMockContext()), attrs, 0, GraphicsContext3D::RenderDirectlyToHostWindow, GraphicsContext3DPrivate::ForUseOnThisThread);
+    RefPtr<GraphicsContext3D> context = GraphicsContext3DPrivate::createGraphicsContextFromWebContext(adoptPtr(new GMockContext()), GraphicsContext3D::RenderDirectlyToHostWindow);
     GMockContext& mockContext = *static_cast<GMockContext*>(GraphicsContext3DPrivate::extractWebGraphicsContext3D(context.get()));
 
     EXPECT_CALL(mockContext, getError())
@@ -104,7 +104,7 @@ private:
 TEST(FakeGraphicsContext3DTest, ContextForThisThreadShouldNotMakeCurrent)
 {
     GraphicsContext3D::Attributes attrs;
-    RefPtr<GraphicsContext3D> context = GraphicsContext3DPrivate::createGraphicsContextFromWebContext(adoptPtr(new ContextThatCountsMakeCurrents()), attrs, 0, GraphicsContext3D::RenderDirectlyToHostWindow, GraphicsContext3DPrivate::ForUseOnThisThread);
+    RefPtr<GraphicsContext3D> context = GraphicsContext3DPrivate::createGraphicsContextFromWebContext(adoptPtr(new ContextThatCountsMakeCurrents()), GraphicsContext3D::RenderDirectlyToHostWindow);
     EXPECT_TRUE(context);
     ContextThatCountsMakeCurrents& mockContext = *static_cast<ContextThatCountsMakeCurrents*>(GraphicsContext3DPrivate::extractWebGraphicsContext3D(context.get()));
     EXPECT_EQ(0, mockContext.makeCurrentCount());
@@ -113,7 +113,7 @@ TEST(FakeGraphicsContext3DTest, ContextForThisThreadShouldNotMakeCurrent)
 TEST(FakeGraphicsContext3DTest, ContextForAnotherThreadShouldNotMakeCurrent)
 {
     GraphicsContext3D::Attributes attrs;
-    RefPtr<GraphicsContext3D> context = GraphicsContext3DPrivate::createGraphicsContextFromWebContext(adoptPtr(new ContextThatCountsMakeCurrents()), attrs, 0, GraphicsContext3D::RenderDirectlyToHostWindow, GraphicsContext3DPrivate::ForUseOnAnotherThread);
+    RefPtr<GraphicsContext3D> context = GraphicsContext3DPrivate::createGraphicsContextFromWebContext(adoptPtr(new ContextThatCountsMakeCurrents()), GraphicsContext3D::RenderDirectlyToHostWindow);
     EXPECT_TRUE(context);
     ContextThatCountsMakeCurrents& mockContext = *static_cast<ContextThatCountsMakeCurrents*>(GraphicsContext3DPrivate::extractWebGraphicsContext3D(context.get()));
     EXPECT_EQ(0, mockContext.makeCurrentCount());
diff --git a/Source/WebKit/chromium/tests/FakeWebGraphicsContext3D.h b/Source/WebKit/chromium/tests/FakeWebGraphicsContext3D.h
index cf0651b77..ae27da730 100644
--- a/Source/WebKit/chromium/tests/FakeWebGraphicsContext3D.h
+++ b/Source/WebKit/chromium/tests/FakeWebGraphicsContext3D.h
@@ -65,6 +65,8 @@ public:
 
     virtual void setVisibilityCHROMIUM(bool visible) { }
 
+    virtual void setMemoryAllocationChangedCallbackCHROMIUM(WebGraphicsMemoryAllocationChangedCallbackCHROMIUM* callback) { }
+
     virtual WebString getRequestableExtensionsCHROMIUM() { return WebString(); }
     virtual void requestExtensionCHROMIUM(const char*) { }
 
diff --git a/Source/WebKit/chromium/tests/LayerChromiumTest.cpp b/Source/WebKit/chromium/tests/LayerChromiumTest.cpp
index 43083a1d7..2e9ca9661 100644
--- a/Source/WebKit/chromium/tests/LayerChromiumTest.cpp
+++ b/Source/WebKit/chromium/tests/LayerChromiumTest.cpp
@@ -515,6 +515,7 @@ TEST_F(LayerChromiumTest, checkPropertyChangeCausesCorrectBehavior)
     EXECUTE_AND_VERIFY_SET_NEEDS_COMMIT_BEHAVIOR(1, testLayer->setReplicaLayer(dummyLayer.get()));
     EXECUTE_AND_VERIFY_SET_NEEDS_COMMIT_BEHAVIOR(1, testLayer->setSublayerTransform(TransformationMatrix(0, 0, 0, 0, 0, 0)));
     EXECUTE_AND_VERIFY_SET_NEEDS_COMMIT_BEHAVIOR(1, testLayer->setScrollable(true));
+    EXECUTE_AND_VERIFY_SET_NEEDS_COMMIT_BEHAVIOR(1, testLayer->setHaveWheelEventHandlers(true));
     EXECUTE_AND_VERIFY_SET_NEEDS_COMMIT_BEHAVIOR(1, testLayer->setScrollPosition(IntPoint(10, 10)));
     EXECUTE_AND_VERIFY_SET_NEEDS_COMMIT_BEHAVIOR(1, testLayer->setTransform(TransformationMatrix(0, 0, 0, 0, 0, 0)));
     EXECUTE_AND_VERIFY_SET_NEEDS_COMMIT_BEHAVIOR(1, testLayer->setDoubleSided(false));
@@ -539,10 +540,21 @@ public:
         return true;
     }
 
+    virtual void setNeedsDisplayRect(const FloatRect& dirtyRect)
+    {
+        m_lastNeedsDisplayRect = dirtyRect;
+        LayerChromium::setNeedsDisplayRect(dirtyRect);
+    }
+
     void resetNeedsDisplay()
     {
         m_needsDisplay = false;
     }
+
+    const FloatRect& lastNeedsDisplayRect() const { return m_lastNeedsDisplayRect; }
+
+private:
+    FloatRect m_lastNeedsDisplayRect;
 };
 
 TEST_F(LayerChromiumTest, checkContentsScaleChangeTriggersNeedsDisplay)
@@ -558,6 +570,7 @@ TEST_F(LayerChromiumTest, checkContentsScaleChangeTriggersNeedsDisplay)
 
     EXECUTE_AND_VERIFY_SET_NEEDS_COMMIT_BEHAVIOR(1, testLayer->setContentsScale(testLayer->contentsScale() + 1.f));
     EXPECT_TRUE(testLayer->needsDisplay());
+    EXPECT_FLOAT_RECT_EQ(FloatRect(0, 0, 320, 240), testLayer->lastNeedsDisplayRect());
 }
 
 class FakeCCLayerTreeHost : public CCLayerTreeHost {
diff --git a/Source/WebKit/chromium/tests/PlatformContextSkiaTest.cpp b/Source/WebKit/chromium/tests/PlatformContextSkiaTest.cpp
index 924b42d28..d097c499a 100644
--- a/Source/WebKit/chromium/tests/PlatformContextSkiaTest.cpp
+++ b/Source/WebKit/chromium/tests/PlatformContextSkiaTest.cpp
@@ -163,6 +163,30 @@ TEST(PlatformContextSkiaTest, trackOpaqueClipTest)
     context.clearRect(FloatRect(10, 10, 90, 90));
     EXPECT_EQ_RECT(IntRect(), platformContext.opaqueRegion().asRect());
 
+    // The transform and the clip need to interact correctly (transform first)
+    context.save();
+    context.translate(10, 10);
+    context.clip(FloatRect(20, 20, 10, 10));
+    context.fillRect(FloatRect(10, 10, 90, 90), opaque, ColorSpaceDeviceRGB, CompositeSourceOver);
+    EXPECT_EQ_RECT(IntRect(30, 30, 10, 10), platformContext.opaqueRegion().asRect());
+    EXPECT_PIXELS_MATCH(bitmap, platformContext.opaqueRegion().asRect());
+    context.restore();
+
+    context.clearRect(FloatRect(10, 10, 90, 90));
+    EXPECT_EQ_RECT(IntRect(), platformContext.opaqueRegion().asRect());
+
+    // The transform and the clip need to interact correctly (clip first)
+    context.save();
+    context.clip(FloatRect(20, 20, 10, 10));
+    context.translate(10, 10);
+    context.fillRect(FloatRect(10, 10, 90, 90), opaque, ColorSpaceDeviceRGB, CompositeSourceOver);
+    EXPECT_EQ_RECT(IntRect(20, 20, 10, 10), platformContext.opaqueRegion().asRect());
+    EXPECT_PIXELS_MATCH(bitmap, platformContext.opaqueRegion().asRect());
+    context.restore();
+
+    context.clearRect(FloatRect(10, 10, 90, 90));
+    EXPECT_EQ_RECT(IntRect(), platformContext.opaqueRegion().asRect());
+
     Path path;
     path.moveTo(FloatPoint(0, 0));
     path.addLineTo(FloatPoint(100, 0));
diff --git a/Source/WebKit/chromium/tests/TiledLayerChromiumTest.cpp b/Source/WebKit/chromium/tests/TiledLayerChromiumTest.cpp
index fcd3878a6..e03559046 100644
--- a/Source/WebKit/chromium/tests/TiledLayerChromiumTest.cpp
+++ b/Source/WebKit/chromium/tests/TiledLayerChromiumTest.cpp
@@ -162,6 +162,14 @@ public:
         return TiledLayerChromium::skipsDraw();
     }
 
+    virtual void setNeedsDisplayRect(const FloatRect& rect)
+    {
+        m_lastNeedsDisplayRect = rect;
+        TiledLayerChromium::setNeedsDisplayRect(rect);
+    }
+
+    const FloatRect& lastNeedsDisplayRect() const { return m_lastNeedsDisplayRect; }
+
     FakeLayerTextureUpdater* fakeLayerTextureUpdater() { return m_fakeTextureUpdater.get(); }
 
     virtual TextureManager* textureManager() const { return m_textureManager; }
@@ -181,6 +189,7 @@ private:
 
     RefPtr<FakeLayerTextureUpdater> m_fakeTextureUpdater;
     TextureManager* m_textureManager;
+    FloatRect m_lastNeedsDisplayRect;
 };
 
 class FakeTiledLayerWithScaledBounds : public FakeTiledLayerChromium {
@@ -434,6 +443,57 @@ TEST(TiledLayerChromiumTest, verifyUpdateRectWhenContentBoundsAreScaled)
     EXPECT_FLOAT_RECT_EQ(FloatRect(45, 80, 15, 8), layer->updateRect());
 }
 
+TEST(TiledLayerChromiumTest, verifyInvalidationWhenContentsScaleChanges)
+{
+    OwnPtr<TextureManager> textureManager = TextureManager::create(4*1024*1024, 2*1024*1024, 1024);
+    RefPtr<FakeTiledLayerChromium> layer = adoptRef(new FakeTiledLayerChromium(textureManager.get()));
+    DebugScopedSetImplThread implThread;
+    RefPtr<FakeCCTiledLayerImpl> layerImpl = adoptRef(new FakeCCTiledLayerImpl(0));
+
+    FakeTextureAllocator textureAllocator;
+    CCTextureUpdater updater(&textureAllocator);
+
+    // Create a layer with one tile.
+    layer->setBounds(IntSize(100, 100));
+
+    // Invalidate the entire layer.
+    layer->setNeedsDisplay();
+    EXPECT_FLOAT_RECT_EQ(FloatRect(0, 0, 100, 100), layer->lastNeedsDisplayRect());
+
+    // Push the tiles to the impl side and check that there is exactly one.
+    layer->prepareToUpdate(IntRect(0, 0, 100, 100));
+    layer->updateCompositorResources(0, updater);
+    layer->pushPropertiesTo(layerImpl.get());
+    EXPECT_TRUE(layerImpl->hasTileAt(0, 0));
+    EXPECT_FALSE(layerImpl->hasTileAt(0, 1));
+    EXPECT_FALSE(layerImpl->hasTileAt(1, 0));
+    EXPECT_FALSE(layerImpl->hasTileAt(1, 1));
+
+    // Change the contents scale and verify that the content rectangle requiring painting
+    // is not scaled.
+    layer->setContentsScale(2);
+    EXPECT_FLOAT_RECT_EQ(FloatRect(0, 0, 100, 100), layer->lastNeedsDisplayRect());
+
+    // The impl side should get 2x2 tiles now.
+    layer->prepareToUpdate(IntRect(0, 0, 200, 200));
+    layer->updateCompositorResources(0, updater);
+    layer->pushPropertiesTo(layerImpl.get());
+    EXPECT_TRUE(layerImpl->hasTileAt(0, 0));
+    EXPECT_TRUE(layerImpl->hasTileAt(0, 1));
+    EXPECT_TRUE(layerImpl->hasTileAt(1, 0));
+    EXPECT_TRUE(layerImpl->hasTileAt(1, 1));
+
+    // Invalidate the entire layer again, but do not paint. All tiles should be gone now from the
+    // impl side.
+    layer->setNeedsDisplay();
+    layer->updateCompositorResources(0, updater);
+    layer->pushPropertiesTo(layerImpl.get());
+    EXPECT_FALSE(layerImpl->hasTileAt(0, 0));
+    EXPECT_FALSE(layerImpl->hasTileAt(0, 1));
+    EXPECT_FALSE(layerImpl->hasTileAt(1, 0));
+    EXPECT_FALSE(layerImpl->hasTileAt(1, 1));
+}
+
 TEST(TiledLayerChromiumTest, skipsDrawGetsReset)
 {
     // Initialize without threading support.
@@ -524,7 +584,7 @@ TEST(TiledLayerChromiumTest, layerAddsSelfToOccludedRegion)
     occluded = Region();
     layer->addSelfToOccludedScreenSpace(occluded);
     EXPECT_EQ_RECT(IntRect(), occluded.bounds());
-    EXPECT_EQ(1u, occluded.rects().size());
+    EXPECT_EQ(0u, occluded.rects().size());
 
     // If the layer paints opaque content, then the occluded region should match the visible opaque content.
     IntRect opaquePaintRect = IntRect(10, 10, 90, 190);
@@ -546,6 +606,28 @@ TEST(TiledLayerChromiumTest, layerAddsSelfToOccludedRegion)
     EXPECT_EQ_RECT(intersection(opaquePaintRect, visibleBounds), occluded.bounds());
     EXPECT_EQ(1u, occluded.rects().size());
 
+    // If we repaint a non-opaque part of the tile, then it shouldn't lose its opaque-ness. And other tiles should
+    // not be affected.
+    layer->fakeLayerTextureUpdater()->setOpaquePaintRect(IntRect());
+    layer->invalidateRect(IntRect(0, 0, 1, 1));
+    layer->prepareToUpdate(contentBounds);
+
+    occluded = Region();
+    layer->addSelfToOccludedScreenSpace(occluded);
+    EXPECT_EQ_RECT(intersection(opaquePaintRect, visibleBounds), occluded.bounds());
+    EXPECT_EQ(1u, occluded.rects().size());
+
+    // If we repaint an opaque part of the tile, then it should lose its opaque-ness. But other tiles should still
+    // not be affected.
+    layer->fakeLayerTextureUpdater()->setOpaquePaintRect(IntRect());
+    layer->invalidateRect(IntRect(10, 10, 1, 1));
+    layer->prepareToUpdate(contentBounds);
+
+    occluded = Region();
+    layer->addSelfToOccludedScreenSpace(occluded);
+    EXPECT_EQ_RECT(intersection(IntRect(10, 100, 90, 100), visibleBounds), occluded.bounds());
+    EXPECT_EQ(1u, occluded.rects().size());
+
     // If the layer is transformed then the resulting occluded area needs to be transformed to its target space.
     TransformationMatrix transform;
     transform.translate(contentBounds.width() / 2.0, contentBounds.height() / 2.0);
@@ -556,6 +638,8 @@ TEST(TiledLayerChromiumTest, layerAddsSelfToOccludedRegion)
     screenSpaceTransform *= transform;
     screenSpaceTransform.translate(-contentBounds.width() / 2.0, -contentBounds.height() / 2.0);
     layer->setScreenSpaceTransform(screenSpaceTransform);
+    layer->fakeLayerTextureUpdater()->setOpaquePaintRect(opaquePaintRect);
+    layer->invalidateRect(opaquePaintRect);
     layer->prepareToUpdate(contentBounds);
 
     occluded = Region();
diff --git a/Source/WebKit/chromium/tests/TreeSynchronizerTest.cpp b/Source/WebKit/chromium/tests/TreeSynchronizerTest.cpp
index 1557a7d93..4724b4a43 100644
--- a/Source/WebKit/chromium/tests/TreeSynchronizerTest.cpp
+++ b/Source/WebKit/chromium/tests/TreeSynchronizerTest.cpp
@@ -26,13 +26,16 @@
 
 #include "TreeSynchronizer.h"
 
+#include "CCAnimationTestCommon.h"
 #include "LayerChromium.h"
+#include "cc/CCLayerAnimationController.h"
 #include "cc/CCLayerImpl.h"
 #include "cc/CCProxy.h"
 #include "cc/CCSingleThreadProxy.h"
 #include <gtest/gtest.h>
 
 using namespace WebCore;
+using namespace WebKitTests;
 
 namespace {
 
@@ -91,6 +94,30 @@ private:
     Vector<int>* m_ccLayerDestructionList;
 };
 
+class FakeLayerAnimationController : public CCLayerAnimationController {
+public:
+    static PassOwnPtr<FakeLayerAnimationController> create()
+    {
+        return adoptPtr(new FakeLayerAnimationController);
+    }
+
+    bool synchronizedAnimations() const { return m_synchronizedAnimations; }
+
+private:
+    FakeLayerAnimationController()
+        : m_synchronizedAnimations(false)
+    {
+    }
+
+    virtual void synchronizeAnimations(CCLayerAnimationControllerImpl* controllerImpl)
+    {
+        CCLayerAnimationController::synchronizeAnimations(controllerImpl);
+        m_synchronizedAnimations = true;
+    }
+
+    bool m_synchronizedAnimations;
+};
+
 void expectTreesAreIdentical(LayerChromium* layer, CCLayerImpl* ccLayer)
 {
     ASSERT_TRUE(layer);
@@ -307,5 +334,19 @@ TEST(TreeSynchronizerTest, syncMaskReplicaAndReplicaMaskLayers)
     expectTreesAreIdentical(layerTreeRoot.get(), ccLayerTreeRoot.get());
 }
 
+TEST(TreeSynchronizerTest, synchronizeAnimations)
+{
+    DebugScopedSetImplThread impl;
+    RefPtr<LayerChromium> layerTreeRoot = LayerChromium::create();
+
+    layerTreeRoot->setLayerAnimationController(FakeLayerAnimationController::create());
+
+    EXPECT_FALSE(static_cast<FakeLayerAnimationController*>(layerTreeRoot->layerAnimationController())->synchronizedAnimations());
+
+    RefPtr<CCLayerImpl> ccLayerTreeRoot = TreeSynchronizer::synchronizeTrees(layerTreeRoot.get(), 0);
+    ccLayerTreeRoot = TreeSynchronizer::synchronizeTrees(layerTreeRoot.get(), ccLayerTreeRoot.get());
+
+    EXPECT_TRUE(static_cast<FakeLayerAnimationController*>(layerTreeRoot->layerAnimationController())->synchronizedAnimations());
+}
 
 } // namespace
diff --git a/Source/WebKit/chromium/tests/WebCompositorInputHandlerImplTest.cpp b/Source/WebKit/chromium/tests/WebCompositorInputHandlerImplTest.cpp
index ad5810524..459255e02 100644
--- a/Source/WebKit/chromium/tests/WebCompositorInputHandlerImplTest.cpp
+++ b/Source/WebKit/chromium/tests/WebCompositorInputHandlerImplTest.cpp
@@ -67,14 +67,13 @@ public:
 
 private:
     virtual void setNeedsRedraw() OVERRIDE { }
-    virtual ScrollStatus scrollBegin(const WebCore::IntPoint&) OVERRIDE
+    virtual ScrollStatus scrollBegin(const WebCore::IntPoint&, WebCore::CCInputHandlerClient::ScrollInputType) OVERRIDE
     {
         return m_scrollStatus;
     }
     virtual void scrollBy(const WebCore::IntSize&) OVERRIDE { }
     virtual void scrollEnd() OVERRIDE { }
 
-    virtual bool haveWheelEventHandlers() OVERRIDE { return false; }
     virtual void pinchGestureBegin() OVERRIDE
     {
         m_pinchStarted = true;
diff --git a/Source/WebKit/chromium/tests/WebFrameTest.cpp b/Source/WebKit/chromium/tests/WebFrameTest.cpp
index b59001860..f61e98648 100644
--- a/Source/WebKit/chromium/tests/WebFrameTest.cpp
+++ b/Source/WebKit/chromium/tests/WebFrameTest.cpp
@@ -151,6 +151,78 @@ TEST_F(WebFrameTest, ChromePageNoJavascript)
     EXPECT_EQ(std::string::npos, content.find("Clobbered"));
 }
 
+#if ENABLE(GESTURE_EVENTS)
+TEST_F(WebFrameTest, DivAutoZoomParamsTest)
+{
+    registerMockedHttpURLLoad("get_scale_for_auto_zoom_into_div_test.html");
+
+    WebViewImpl* webViewImpl = static_cast<WebViewImpl*>(FrameTestHelpers::createWebViewAndLoad(m_baseURL + "get_scale_for_auto_zoom_into_div_test.html", true));
+    int pageWidth = 640;
+    int pageHeight = 480;
+    int divPosX = 200;
+    int divPosY = 200;
+    int divWidth = 200;
+    int divHeight = 150;
+    WebRect doubleTapPoint(250, 250, 0, 0);
+    webViewImpl->resize(WebSize(pageWidth, pageHeight));
+    float scale;
+    WebPoint scroll;
+
+    // Test for Doubletap scaling
+
+    // Tests for zooming in and out without clamping.
+    // Set device scale and scale limits so we dont get clamped.
+    webViewImpl->setDeviceScaleFactor(4);
+    webViewImpl->setPageScaleFactorLimits(0, 4 / webViewImpl->deviceScaleFactor());
+
+    // Test zooming into div.
+    webViewImpl->computeScaleAndScrollForHitRect(doubleTapPoint, WebViewImpl::DoubleTap, scale, scroll);
+    float scaledDivWidth = divWidth * scale;
+    float scaledDivHeight = divHeight * scale;
+    int hScroll = ((divPosX * scale) - ((pageWidth - scaledDivWidth) / 2)) / scale;
+    int vScroll = ((divPosY * scale) - ((pageHeight - scaledDivHeight) / 2)) / scale;
+    EXPECT_NEAR(pageWidth / divWidth, scale, 0.1);
+    EXPECT_EQ(hScroll, scroll.x);
+    EXPECT_EQ(vScroll, scroll.y);
+
+    // Test zoom out to overview scale.
+    webViewImpl->applyScrollAndScale(WebCore::IntSize(scroll.x, scroll.y), scale / webViewImpl->pageScaleFactor());
+    webViewImpl->computeScaleAndScrollForHitRect(doubleTapPoint, WebViewImpl::DoubleTap, scale, scroll);
+    EXPECT_FLOAT_EQ(1, scale);
+    EXPECT_EQ(WebPoint(0, 0), scroll);
+
+    // Tests for clamped scaling.
+    // Test clamp to device scale:
+    webViewImpl->applyScrollAndScale(WebCore::IntSize(scroll.x, scroll.y), scale / webViewImpl->pageScaleFactor());
+    webViewImpl->setDeviceScaleFactor(2.5);
+    webViewImpl->computeScaleAndScrollForHitRect(doubleTapPoint, WebViewImpl::DoubleTap, scale, scroll);
+    EXPECT_FLOAT_EQ(2.5, scale);
+
+    // Test clamp to minimum scale:
+    webViewImpl->applyScrollAndScale(WebCore::IntSize(scroll.x, scroll.y), scale / webViewImpl->pageScaleFactor());
+    webViewImpl->setPageScaleFactorLimits(1.5 / webViewImpl->deviceScaleFactor(), 4 / webViewImpl->deviceScaleFactor());
+    webViewImpl->computeScaleAndScrollForHitRect(doubleTapPoint, WebViewImpl::DoubleTap, scale, scroll);
+    EXPECT_FLOAT_EQ(1.5, scale);
+    EXPECT_EQ(WebPoint(0, 0), scroll);
+
+    // Test clamp to maximum scale:
+    webViewImpl->applyScrollAndScale(WebCore::IntSize(scroll.x, scroll.y), scale / webViewImpl->pageScaleFactor());
+    webViewImpl->setDeviceScaleFactor(4);
+    webViewImpl->setPageScaleFactorLimits(0, 3 / webViewImpl->deviceScaleFactor());
+    webViewImpl->computeScaleAndScrollForHitRect(doubleTapPoint, WebViewImpl::DoubleTap, scale, scroll);
+    EXPECT_FLOAT_EQ(3, scale);
+
+
+    // Test for Non-doubletap scaling
+    webViewImpl->setPageScaleFactor(1, WebPoint(0, 0));
+    webViewImpl->setDeviceScaleFactor(4);
+    webViewImpl->setPageScaleFactorLimits(0, 4 / webViewImpl->deviceScaleFactor());
+    // Test zooming into div.
+    webViewImpl->computeScaleAndScrollForHitRect(WebRect(250, 250, 10, 10), WebViewImpl::FindInPage, scale, scroll);
+    EXPECT_NEAR(pageWidth / divWidth, scale, 0.1);
+}
+#endif
+
 class TestReloadDoesntRedirectWebFrameClient : public WebFrameClient {
 public:
     virtual WebNavigationPolicy decidePolicyForNavigation(
diff --git a/Source/WebKit/chromium/tests/WebSocketDeflaterTest.cpp b/Source/WebKit/chromium/tests/WebSocketDeflaterTest.cpp
new file mode 100644
index 000000000..423a5969f
--- /dev/null
+++ b/Source/WebKit/chromium/tests/WebSocketDeflaterTest.cpp
@@ -0,0 +1,157 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#include "WebSocketDeflater.h"
+
+#include <gtest/gtest.h>
+#include <wtf/Vector.h>
+
+using namespace WebCore;
+
+namespace {
+
+TEST(WebSocketDeflaterTest, TestCompressHello)
+{
+    // Test the first example on section 4.3 of the specification.
+    OwnPtr<WebSocketDeflater> deflater = WebSocketDeflater::create(15);
+    ASSERT_TRUE(deflater->initialize());
+    OwnPtr<WebSocketInflater> inflater = WebSocketInflater::create();
+    ASSERT_TRUE(inflater->initialize());
+    const char* inputData = "Hello";
+    const size_t inputLength = strlen(inputData);
+
+    ASSERT_TRUE(deflater->addBytes(inputData, inputLength));
+    ASSERT_TRUE(deflater->finish());
+    const char expectedFirst[] = {0xf2, 0x48, 0xcd, 0xc9, 0xc9, 0x07, 0x00};
+    EXPECT_EQ(sizeof(expectedFirst), deflater->size());
+    EXPECT_EQ(0, memcmp(expectedFirst, deflater->data(), deflater->size()));
+    ASSERT_TRUE(inflater->addBytes(deflater->data(), deflater->size()));
+    ASSERT_TRUE(inflater->finish());
+    EXPECT_EQ(inputLength, inflater->size());
+    EXPECT_EQ(0, memcmp(inputData, inflater->data(), inflater->size()));
+
+    deflater->reset();
+    inflater->reset();
+
+    ASSERT_TRUE(deflater->addBytes(inputData, inputLength));
+    ASSERT_TRUE(deflater->finish());
+    const char expectedSecond[] = {0xf2, 0x00, 0x11, 0x00, 0x00};
+    EXPECT_EQ(sizeof(expectedSecond), deflater->size());
+    EXPECT_EQ(0, memcmp(expectedSecond, deflater->data(), deflater->size()));
+    ASSERT_TRUE(inflater->addBytes(deflater->data(), deflater->size()));
+    ASSERT_TRUE(inflater->finish());
+    EXPECT_EQ(inputLength, inflater->size());
+    EXPECT_EQ(0, memcmp(inputData, inflater->data(), inflater->size()));
+}
+
+TEST(WebSocketDeflaterTest, TestMultipleAddBytesCalls)
+{
+    OwnPtr<WebSocketDeflater> deflater = WebSocketDeflater::create(15);
+    ASSERT_TRUE(deflater->initialize());
+    OwnPtr<WebSocketInflater> inflater = WebSocketInflater::create();
+    ASSERT_TRUE(inflater->initialize());
+    Vector<char> inputData(32);
+    inputData.fill('a');
+
+    for (size_t i = 0; i < inputData.size(); ++i)
+        ASSERT_TRUE(deflater->addBytes(inputData.data() + i, 1));
+    ASSERT_TRUE(deflater->finish());
+    for (size_t i = 0; i < deflater->size(); ++i)
+        ASSERT_TRUE(inflater->addBytes(deflater->data() + i, 1));
+    ASSERT_TRUE(inflater->finish());
+    EXPECT_EQ(inputData.size(), inflater->size());
+    EXPECT_EQ(0, memcmp(inputData.data(), inflater->data(), inflater->size()));
+}
+
+TEST(WebSocketDeflaterTest, TestNoContextTakeOver)
+{
+    OwnPtr<WebSocketDeflater> deflater = WebSocketDeflater::create(15, WebSocketDeflater::DoNotTakeOverContext);
+    ASSERT_TRUE(deflater->initialize());
+    OwnPtr<WebSocketInflater> inflater = WebSocketInflater::create();
+    ASSERT_TRUE(inflater->initialize());
+    const char expected[] = {0xf2, 0x48, 0xcd, 0xc9, 0xc9, 0x07, 0x00};
+    const char* inputData = "Hello";
+    const size_t inputLength = strlen(inputData);
+
+    // If we don't take over context, the second result should be the identical
+    // with the first one.
+    for (size_t i = 0; i < 2; ++i) {
+        ASSERT_TRUE(deflater->addBytes(inputData, inputLength));
+        ASSERT_TRUE(deflater->finish());
+        EXPECT_EQ(sizeof(expected), deflater->size());
+        EXPECT_EQ(0, memcmp(expected, deflater->data(), deflater->size()));
+        ASSERT_TRUE(inflater->addBytes(deflater->data(), deflater->size()));
+        ASSERT_TRUE(inflater->finish());
+        EXPECT_EQ(inputLength, inflater->size());
+        EXPECT_EQ(0, memcmp(inputData, inflater->data(), inflater->size()));
+        deflater->reset();
+        inflater->reset();
+    }
+}
+
+TEST(WebSocketDeflaterTest, TestWindowBits)
+{
+    Vector<char> inputData(1024 + 64 * 2);
+    inputData.fill('a');
+    // Modify the head and tail of the inputData so that back-reference
+    // can be used if the window size is sufficiently-large.
+    for (size_t j = 0; j < 64; ++j) {
+        inputData[j] = 'b';
+        inputData[inputData.size() - j - 1] = 'b';
+    }
+
+    OwnPtr<WebSocketDeflater> deflater = WebSocketDeflater::create(8);
+    ASSERT_TRUE(deflater->initialize());
+    ASSERT_TRUE(deflater->addBytes(inputData.data(), inputData.size()));
+    ASSERT_TRUE(deflater->finish());
+
+    OwnPtr<WebSocketInflater> inflater = WebSocketInflater::create(8);
+    ASSERT_TRUE(inflater->initialize());
+    ASSERT_TRUE(inflater->addBytes(deflater->data(), deflater->size()));
+    ASSERT_TRUE(inflater->finish());
+    EXPECT_EQ(inputData.size(), inflater->size());
+    EXPECT_EQ(0, memcmp(inputData.data(), inflater->data(), inflater->size()));
+}
+
+TEST(WebSocketDeflaterTest, TestLargeData)
+{
+    OwnPtr<WebSocketDeflater> deflater = WebSocketDeflater::create(15);
+    ASSERT_TRUE(deflater->initialize());
+    OwnPtr<WebSocketInflater> inflater = WebSocketInflater::create();
+    ASSERT_TRUE(inflater->initialize());
+    Vector<char> inputData(16 * 1024 * 1024);
+    inputData.fill('a');
+
+    ASSERT_TRUE(deflater->addBytes(inputData.data(), inputData.size()));
+    ASSERT_TRUE(deflater->finish());
+    ASSERT_TRUE(inflater->addBytes(deflater->data(), deflater->size()));
+    ASSERT_TRUE(inflater->finish());
+    EXPECT_EQ(inputData.size(), inflater->size());
+    EXPECT_EQ(0, memcmp(inputData.data(), inflater->data(), inflater->size()));
+}
+
+}
diff --git a/Source/WebKit/chromium/tests/WebSocketExtensionDispatcherTest.cpp b/Source/WebKit/chromium/tests/WebSocketExtensionDispatcherTest.cpp
new file mode 100644
index 000000000..358983b83
--- /dev/null
+++ b/Source/WebKit/chromium/tests/WebSocketExtensionDispatcherTest.cpp
@@ -0,0 +1,179 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#include "WebSocketExtensionDispatcher.h"
+
+#include "WebSocketExtensionProcessor.h"
+
+#include <gtest/gtest.h>
+#include <wtf/text/StringHash.h>
+
+using namespace WebCore;
+
+namespace {
+
+class WebSocketExtensionDispatcherTest;
+
+class MockWebSocketExtensionProcessor : public WebSocketExtensionProcessor {
+public:
+    MockWebSocketExtensionProcessor(const String& name, WebSocketExtensionDispatcherTest* test)
+        : WebSocketExtensionProcessor(name)
+        , m_test(test)
+    {
+    }
+    virtual String handshakeString() OVERRIDE { return extensionToken(); }
+    virtual bool processResponse(const HashMap<String, String>&) OVERRIDE;
+
+private:
+    WebSocketExtensionDispatcherTest* m_test;
+};
+
+class WebSocketExtensionDispatcherTest : public testing::Test {
+public:
+    WebSocketExtensionDispatcherTest() { }
+
+    void SetUp() { }
+
+    void TearDown() { }
+
+    void addMockProcessor(const String& extensionToken)
+    {
+        m_extensions.addProcessor(adoptPtr(new MockWebSocketExtensionProcessor(extensionToken, this)));
+
+    }
+
+    void appendResult(const String& extensionToken, const HashMap<String, String>& parameters)
+    {
+        m_parsedExtensionTokens.append(extensionToken);
+        m_parsedParameters.append(parameters);
+    }
+
+protected:
+    WebSocketExtensionDispatcher m_extensions;
+    Vector<String> m_parsedExtensionTokens;
+    Vector<HashMap<String, String> > m_parsedParameters;
+};
+
+bool MockWebSocketExtensionProcessor::processResponse(const HashMap<String, String>& parameters)
+{
+    m_test->appendResult(extensionToken(), parameters);
+    return true;
+}
+
+TEST_F(WebSocketExtensionDispatcherTest, TestSingle)
+{
+    addMockProcessor("deflate-frame");
+    EXPECT_TRUE(m_extensions.processHeaderValue("deflate-frame"));
+    EXPECT_EQ(1UL, m_parsedExtensionTokens.size());
+    EXPECT_EQ("deflate-frame", m_parsedExtensionTokens[0]);
+    EXPECT_EQ("deflate-frame", m_extensions.acceptedExtensions());
+    EXPECT_EQ(0, m_parsedParameters[0].size());
+}
+
+TEST_F(WebSocketExtensionDispatcherTest, TestParameters)
+{
+    addMockProcessor("mux");
+    EXPECT_TRUE(m_extensions.processHeaderValue("mux; max-channels=4; flow-control  "));
+    EXPECT_EQ(1UL, m_parsedExtensionTokens.size());
+    EXPECT_EQ("mux", m_parsedExtensionTokens[0]);
+    EXPECT_EQ(2, m_parsedParameters[0].size());
+    HashMap<String, String>::iterator parameter = m_parsedParameters[0].find("max-channels");
+    EXPECT_TRUE(parameter != m_parsedParameters[0].end());
+    EXPECT_EQ("4", parameter->second);
+    parameter = m_parsedParameters[0].find("flow-control");
+    EXPECT_TRUE(parameter != m_parsedParameters[0].end());
+    EXPECT_TRUE(parameter->second.isNull());
+}
+
+TEST_F(WebSocketExtensionDispatcherTest, TestMultiple)
+{
+    struct {
+        String token;
+        HashMap<String, String> parameters;
+    } expected[2];
+    expected[0].token = "mux";
+    expected[0].parameters.add("max-channels", "4");
+    expected[0].parameters.add("flow-control", String());
+    expected[1].token = "deflate-frame";
+
+    addMockProcessor("mux");
+    addMockProcessor("deflate-frame");
+    EXPECT_TRUE(m_extensions.processHeaderValue("mux ;  max-channels =4;flow-control, deflate-frame  "));
+    EXPECT_TRUE(m_extensions.acceptedExtensions().find("mux") != notFound);
+    EXPECT_TRUE(m_extensions.acceptedExtensions().find("deflate-frame") != notFound);
+    for (size_t i = 0; i < sizeof(expected) / sizeof(expected[0]); ++i) {
+        EXPECT_EQ(expected[i].token, m_parsedExtensionTokens[i]);
+        const HashMap<String, String>& expectedParameters = expected[i].parameters;
+        const HashMap<String, String>& parsedParameters = m_parsedParameters[i];
+        EXPECT_EQ(expected[i].parameters.size(), m_parsedParameters[i].size());
+        for (HashMap<String, String>::const_iterator iterator = expectedParameters.begin(); iterator != expectedParameters.end(); ++iterator) {
+            HashMap<String, String>::const_iterator parsed = parsedParameters.find(iterator->first);
+            EXPECT_TRUE(parsed != parsedParameters.end());
+            if (iterator->second.isNull())
+                EXPECT_TRUE(parsed->second.isNull());
+            else
+                EXPECT_EQ(iterator->second, parsed->second);
+        }
+    }
+}
+
+TEST_F(WebSocketExtensionDispatcherTest, TestQuotedString)
+{
+    addMockProcessor("x-foo");
+    EXPECT_TRUE(m_extensions.processHeaderValue("x-foo; param1=\"quoted string\"; param2=\"\\\"quoted\\\" string\\\\\""));
+    EXPECT_EQ(2, m_parsedParameters[0].size());
+    EXPECT_EQ("quoted string", m_parsedParameters[0].get("param1"));
+    EXPECT_EQ("\"quoted\" string\\", m_parsedParameters[0].get("param2"));
+}
+
+TEST_F(WebSocketExtensionDispatcherTest, TestInvalid)
+{
+    const char* inputs[] = {
+        "\"x-foo\"",
+        "x-baz",
+        "x-foo\\",
+        "x-(foo)",
+        "x-foo; ",
+        "x-foo; bar=",
+        "x-foo; bar=x y",
+        "x-foo; bar=\"mismatch quote",
+        "x-foo; bar=\"\\\"",
+        "x-foo; \"bar\"=baz",
+        "x-foo x-bar",
+        "x-foo, x-baz"
+        "x-foo, ",
+    };
+    for (size_t i = 0; i < sizeof(inputs) / sizeof(inputs[0]); ++i) {
+        m_extensions.reset();
+        addMockProcessor("x-foo");
+        addMockProcessor("x-bar");
+        EXPECT_FALSE(m_extensions.processHeaderValue(inputs[i]));
+        EXPECT_TRUE(m_extensions.acceptedExtensions().isNull());
+    }
+}
+
+}
diff --git a/Source/WebKit/chromium/tests/WebURLResponseTest.cpp b/Source/WebKit/chromium/tests/WebURLResponseTest.cpp
new file mode 100644
index 000000000..112ed8601
--- /dev/null
+++ b/Source/WebKit/chromium/tests/WebURLResponseTest.cpp
@@ -0,0 +1,78 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#include "platform/WebURLResponse.h"
+
+#include <gtest/gtest.h>
+
+using namespace WebKit;
+
+namespace {
+
+class TestExtraData : public WebURLResponse::ExtraData {
+public:
+    explicit TestExtraData(bool* alive)
+        : m_alive(alive)
+    {
+        *alive = true;
+    }
+
+    virtual ~TestExtraData() { *m_alive = false; }
+
+private:
+    bool* m_alive;
+};
+
+TEST(WebURLResponseTest, ExtraData)
+{
+    bool alive = false;
+    {
+        WebURLResponse urlResponse;
+        TestExtraData* extraData = new TestExtraData(&alive);
+        EXPECT_TRUE(alive);
+
+        urlResponse.initialize();
+        urlResponse.setExtraData(extraData);
+        EXPECT_EQ(extraData, urlResponse.extraData());
+        {
+            WebURLResponse otherUrlResponse = urlResponse;
+            EXPECT_TRUE(alive);
+            EXPECT_EQ(extraData, otherUrlResponse.extraData());
+            EXPECT_EQ(extraData, urlResponse.extraData());
+        }
+        EXPECT_TRUE(alive);
+        EXPECT_EQ(extraData, urlResponse.extraData());
+    }
+    EXPECT_FALSE(alive);
+}
+
+} // namespace
diff --git a/Source/WebKit/chromium/tests/data/get_scale_for_auto_zoom_into_div_test.html b/Source/WebKit/chromium/tests/data/get_scale_for_auto_zoom_into_div_test.html
new file mode 100644
index 000000000..1817dc47d
--- /dev/null
+++ b/Source/WebKit/chromium/tests/data/get_scale_for_auto_zoom_into_div_test.html
@@ -0,0 +1,13 @@
+<html>
+  <body>
+    <div style="background-color: green; position: absolute; left: 0px; top: 0px; width: 640px; height: 480px">
+      <p>Top Div</p>
+      <div style="background-color: white; position: absolute; left: 200px; top: 200px; width: 200px; height: 150px">
+        <p id="innerDiv">Div to zoom to</p>
+        <div style="background-color: red; position: fixed; left: 220px; top: 350px; width: 160px; height: 40px">
+          <p id="innerInnerDiv">Div NOT to zoom to</p>
+        </div>
+      </div>
+    </div>
+  </body>
+</html>
diff --git a/Source/WebKit/efl/ChangeLog b/Source/WebKit/efl/ChangeLog
index 6a52fa252..db22d44eb 100644
--- a/Source/WebKit/efl/ChangeLog
+++ b/Source/WebKit/efl/ChangeLog
@@ -1,3 +1,245 @@
+2012-02-24  Shinya Kawanaka  <shinyak@chromium.org>
+
+        SpellCheckRequest needs to know the context where the spellcheck happened.
+        https://bugs.webkit.org/show_bug.cgi?id=79320
+
+        Reviewed by Hajime Morita.
+
+        * WebCoreSupport/EditorClientEfl.h:
+        (WebCore::EditorClientEfl::requestCheckingOfString):
+
+2012-02-21  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Remove the remaining uses of CSSStyleDeclaration in Editor
+        https://bugs.webkit.org/show_bug.cgi?id=78939
+
+        Reviewed by Enrica Casucci.
+
+        * WebCoreSupport/EditorClientEfl.cpp:
+        (WebCore::EditorClientEfl::shouldApplyStyle):
+        * WebCoreSupport/EditorClientEfl.h:
+        (EditorClientEfl):
+
+2012-02-22  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Remove the remaining uses of CSSStyleDeclaration in Editor
+        https://bugs.webkit.org/show_bug.cgi?id=78939
+
+        Reviewed by Enrica Casucci.
+
+        * WebCoreSupport/EditorClientEfl.cpp:
+        (WebCore::EditorClientEfl::shouldApplyStyle):
+        * WebCoreSupport/EditorClientEfl.h:
+        (EditorClientEfl):
+
+2012-02-20  Kihong Kwon  <kihong.kwon@samsung.com>
+
+        Add a new API for the Vibration API(W3C).
+        https://bugs.webkit.org/show_bug.cgi?id=72010
+
+        Reviewed by Hajime Morita.
+
+        Implementation for the Vibration API feature to the EFL-port layer.
+        http://dev.w3.org/2009/dap/vibration/
+        There are two methods for vibration API.
+        - vibrate : Vibrate device for receiving as a parameter.
+        - cancelVibrate : Cancel current vibration.
+
+        * CMakeListsEfl.txt:
+        * WebCoreSupport/VibrationClientEfl.cpp: Added.
+        (WebCore):
+        (WebCore::VibrationClientEfl::VibrationClientEfl):
+        (WebCore::VibrationClientEfl::vibrate):
+        (WebCore::VibrationClientEfl::cancelVibration):
+        (WebCore::VibrationClientEfl::vibrationDestroyed):
+        * WebCoreSupport/VibrationClientEfl.h: Added.
+        (WebCore):
+        (VibrationClientEfl):
+        (WebCore::VibrationClientEfl::~VibrationClientEfl):
+        * ewk/ewk_view.cpp:
+        (_Ewk_View_Private_Data):
+        (_ewk_view_priv_new):
+
+2012-02-17  Raphael Kubo da Costa  <kubo@profusion.mobi>
+
+        [EFL] Unreviewed, adapt to the changes introduced in r107973.
+
+        SVN r107973 moved some libsoup feature initialization code to
+        WebCore, but only changed the GTK+ bits in WebKit.
+
+        * ewk/ewk_main.cpp:
+        (_ewk_init_body): Do not initialize the content sniffer and the
+        decoder here, the initialization is now done in WebCore.
+
+2012-02-17  Raphael Kubo da Costa  <kubo@profusion.mobi>
+
+        Unreviewed, fix the build with ENABLE(DEVICE_ORIENTATION) after
+        r107518. The EFL EWS bot doesn't enable that flag, so the breakage
+        was not spotted earlier.
+
+        * ewk/ewk_view.cpp:
+        (_Ewk_View_Private_Data):
+        (_ewk_view_priv_new):
+
+2012-01-31  Raphael Kubo da Costa  <kubo@profusion.mobi>
+
+        [soup] Add support for multiple SoupSessions.
+        https://bugs.webkit.org/show_bug.cgi?id=77341
+
+        Add the necessary infrastructure to support multiple SoupSessions. Each
+        WebView now has a "session" property, which defaults to
+        ResourceHandle::defaultSession() and can be changed to another
+        SoupSession by the user.
+
+        Some API in ewk_network and ewk_view which required SoupSession to be a
+        valid type in the headers has now been moved inside #if USE(SOUP)
+        ifdefs so we can actually the required Soup header and avoid build
+        problems with duplicate typedefs.
+
+        * CMakeListsEfl.txt:
+        * WebCoreSupport/FrameLoaderClientEfl.cpp:
+        (WebCore::FrameLoaderClientEfl::createNetworkingContext):
+        * WebCoreSupport/FrameNetworkingContextEfl.cpp: Copied from Source/WebKit/efl/WebCoreSupport/FrameNetworkingContextEfl.h.
+        (WebCore):
+        (WebCore::FrameNetworkingContextEfl::create):
+        (WebCore::FrameNetworkingContextEfl::FrameNetworkingContextEfl):
+        (WebCore::FrameNetworkingContextEfl::soupSession):
+        * WebCoreSupport/FrameNetworkingContextEfl.h:
+        (FrameNetworkingContextEfl):
+        * ewk/ewk_cookies.h: Mention this API is only valid with the
+        default SoupSession.
+        * ewk/ewk_network.cpp:
+        (ewk_network_default_soup_session_get): Define only if USE(SOUP) is set.
+        * ewk/ewk_network.h: Ditto, and mention this API is only valid with the
+        default SoupSession.
+        * ewk/ewk_view.cpp:
+        (_Ewk_View_Private_Data):
+        (_ewk_view_priv_new):
+        (ewk_view_soup_session_get):
+        (ewk_view_soup_session_set):
+        * ewk/ewk_view.h:
+        ():
+
+2012-02-15  Sadrul Habib Chowdhury  <sadrul@chromium.org>
+
+        Notify ChromeClient when touch-event handlers are installed/removed.
+        https://bugs.webkit.org/show_bug.cgi?id=77440
+
+        Reviewed by Darin Fisher and Ryosuke Niwa.
+
+        * WebCoreSupport/ChromeClientEfl.h:
+        (WebCore::ChromeClientEfl::numTouchEventHandlersChanged):
+
+2012-02-15  Gustavo Lima Chaves  <glima@profusion.mobi>
+
+        [EFL] Add missing libsoup to (pkgconfig) dependency requirements
+        https://bugs.webkit.org/show_bug.cgi?id=78702
+
+        Unreviewed build fix.
+
+        * ewebkit.pc.in: Now that bug 77874 had its patch landed, we
+        always require libsoup as a dependency for the EFL port. The
+        'Require' session of this file has to contemplate that, otherwise
+        code linking with ewebkit will fail to lookup to libsoup's header
+        files.
+
+2012-02-13  Raphael Kubo da Costa  <kubo@profusion.mobi>
+
+        [CMake] Merge WebKitEfl.cmake into FindEFL.cmake.
+        https://bugs.webkit.org/show_bug.cgi?id=78566
+
+        Reviewed by Daniel Bates.
+
+        * CMakeListsEfl.txt: Do not include WebKitEfl.cmake.
+
+2012-02-11  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Convert svg/animations to use SMIL methods for driving the timeline
+        https://bugs.webkit.org/show_bug.cgi?id=78422
+
+        Reviewed by Dirk Schulze.
+
+        Remove SVG animation sampling functionality provided for DRT, which no longer uses it.
+        Instead we switched the svg/animations tests to use SVGSVGElement.setCurrentTime.
+
+        * WebCoreSupport/DumpRenderTreeSupportEfl.cpp:
+        * WebCoreSupport/DumpRenderTreeSupportEfl.h:
+
+2012-02-06  Raphael Kubo da Costa  <kubo@profusion.mobi>
+
+        [EFL] Drop support for the Curl network backend.
+        https://bugs.webkit.org/show_bug.cgi?id=77874
+
+        Reviewed by Eric Seidel.
+
+        Nobody seems to be maintaining the Curl backend in WebCore, the
+        EFL port developers all seem to be using the Soup backend and the
+        port itself has many features which are only implemented for the
+        latter.
+
+        * CMakeListsEfl.txt: Unconditionally build soup-dependent files
+        and always add the glib/soup include directories and libraries.
+        * WebCoreSupport/FrameLoaderClientEfl.cpp:
+        (WebCore::FrameLoaderClientEfl::dispatchDidReceiveResponse):
+        Remove USE(SOUP) checks.
+        * ewk/ewk_auth.cpp:
+        (ewk_auth_show_dialog_callback_set): Ditto.
+        (ewk_auth_credentials_set): Ditto.
+        * ewk/ewk_cookies.cpp:
+        (ewk_cookies_file_set): Ditto.
+        (ewk_cookies_clear): Ditto.
+        (ewk_cookies_get_all): Ditto.
+        (ewk_cookies_cookie_del): Ditto.
+        (ewk_cookies_cookie_free): Ditto.
+        (ewk_cookies_policy_set): Ditto.
+        (ewk_cookies_policy_get): Ditto.
+        * ewk/ewk_frame.cpp:
+        (ewk_frame_certificate_status_get): Ditto.
+        * ewk/ewk_main.cpp:
+        (_ewk_init_body): Ditto.
+        * ewk/ewk_network.cpp:
+        (ewk_network_proxy_uri_set): Ditto.
+        (ewk_network_proxy_uri_get): Ditto.
+        (ewk_network_tls_certificate_check_get): Ditto.
+        (ewk_network_tls_certificate_check_set): Ditto.
+        (ewk_network_tls_ca_certificates_path_get): Ditto.
+        (ewk_network_tls_ca_certificates_path_set): Ditto.
+        (ewk_network_default_soup_session_get): Ditto.
+        * ewk/ewk_network.h: Update apidox for
+        ewk_network_default_soup_session_get() now that libsoup is the
+        only available backend.
+
+2012-02-09  Gustavo Lima Chaves  <glima@profusion.mobi>
+
+        [EFL] Introducing functions to set local storage db path and clear
+        those dbs.
+        https://bugs.webkit.org/show_bug.cgi?id=77107
+
+        This patch exposes the web local storage tracker database path
+        setting cabability, introduced on bug 77006, to the EFL port of
+        WebKit. Particularly, we have our own storage tracker client
+        object, to initialize the storage tracker backend on ewk_init().
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        * CMakeListsEfl.txt:
+        * WebCoreSupport/StorageTrackerClientEfl.cpp: Added.
+        (WebCore):
+        (WebCore::StorageTrackerClientEfl::dispatchDidModifyOrigin):
+        (WebCore::StorageTrackerClientEfl::didFinishLoadingOrigins):
+        * WebCoreSupport/StorageTrackerClientEfl.h: Added.
+        (WebCore):
+        (StorageTrackerClientEfl):
+        * ewk/ewk_main.cpp:
+        (trackerClient):
+        (_ewk_init_body):
+        * ewk/ewk_settings.cpp:
+        (ewk_settings_local_storage_path_set):
+        (ewk_settings_local_storage_path_get):
+        (ewk_settings_local_storage_database_clear):
+        (ewk_settings_local_storage_database_origin_clear):
+        * ewk/ewk_settings.h:
+
 2012-02-07  Krzysztof Czech  <k.czech@samsung.com>
 
         [EFL] Add missing initialization of editable variable.
diff --git a/Source/WebKit/efl/WebCoreSupport/ChromeClientEfl.h b/Source/WebKit/efl/WebCoreSupport/ChromeClientEfl.h
index 4b47c731c..82512251f 100644
--- a/Source/WebKit/efl/WebCoreSupport/ChromeClientEfl.h
+++ b/Source/WebKit/efl/WebCoreSupport/ChromeClientEfl.h
@@ -173,6 +173,7 @@ public:
 
     virtual bool shouldRubberBandInDirection(WebCore::ScrollDirection) const { return true; }
     virtual void numWheelEventHandlersChanged(unsigned) { }
+    virtual void numTouchEventHandlersChanged(unsigned) { }
 
     Evas_Object* m_view;
     KURL m_hoveredLinkURL;
diff --git a/Source/WebKit/efl/WebCoreSupport/DumpRenderTreeSupportEfl.cpp b/Source/WebKit/efl/WebCoreSupport/DumpRenderTreeSupportEfl.cpp
index 1eb58d5b5..2a4a9fcc9 100644
--- a/Source/WebKit/efl/WebCoreSupport/DumpRenderTreeSupportEfl.cpp
+++ b/Source/WebKit/efl/WebCoreSupport/DumpRenderTreeSupportEfl.cpp
@@ -40,11 +40,6 @@
 #include <workers/WorkerThread.h>
 #include <wtf/text/AtomicString.h>
 
-#if ENABLE(SVG)
-#include <SVGDocumentExtensions.h>
-#include <SVGSMILElement.h>
-#endif
-
 unsigned DumpRenderTreeSupportEfl::activeAnimationsCount(const Evas_Object* ewkFrame)
 {
     WebCore::Frame* frame = EWKPrivate::coreFrame(ewkFrame);
@@ -174,30 +169,6 @@ bool DumpRenderTreeSupportEfl::pauseAnimation(Evas_Object* ewkFrame, const char*
     return frame->animation()->pauseAnimationAtTime(element->renderer(), name, time);
 }
 
-bool DumpRenderTreeSupportEfl::pauseSVGAnimation(Evas_Object* ewkFrame, const char* animationId, const char* elementId, double time)
-{
-#if ENABLE(SVG)
-    WebCore::Frame* frame = EWKPrivate::coreFrame(ewkFrame);
-
-    if (!frame)
-        return false;
-
-    WebCore::Document* document = frame->document();
-
-    if (!document || !document->svgExtensions())
-        return false;
-
-    WebCore::Element* element = document->getElementById(animationId);
-
-    if (!element || !WebCore::SVGSMILElement::isSMILElement(element))
-        return false;
-
-    return document->accessSVGExtensions()->sampleAnimationAtTime(elementId, static_cast<WebCore::SVGSMILElement*>(element), time);
-#else
-    return false;
-#endif
-}
-
 bool DumpRenderTreeSupportEfl::pauseTransition(Evas_Object* ewkFrame, const char* name, const char* elementId, double time)
 {
     WebCore::Frame* frame = EWKPrivate::coreFrame(ewkFrame);
diff --git a/Source/WebKit/efl/WebCoreSupport/DumpRenderTreeSupportEfl.h b/Source/WebKit/efl/WebCoreSupport/DumpRenderTreeSupportEfl.h
index 0ba342a6d..42af811d3 100644
--- a/Source/WebKit/efl/WebCoreSupport/DumpRenderTreeSupportEfl.h
+++ b/Source/WebKit/efl/WebCoreSupport/DumpRenderTreeSupportEfl.h
@@ -52,7 +52,6 @@ public:
     static int numberOfPages(const Evas_Object* ewkFrame, float pageWidth, float pageHeight);
     static int numberOfPagesForElementId(const Evas_Object* ewkFrame, const char* elementId, float pageWidth, float pageHeight);
     static bool pauseAnimation(Evas_Object* ewkFrame, const char* name, const char* elementId, double time);
-    static bool pauseSVGAnimation(Evas_Object* ewkFrame, const char* animationId, const char* elementId, double time);
     static bool pauseTransition(Evas_Object* ewkFrame, const char* name, const char* elementId, double time);
     static unsigned pendingUnloadEventCount(const Evas_Object* ewkFrame);
     static String renderTreeDump(Evas_Object* ewkFrame);
diff --git a/Source/WebKit/efl/WebCoreSupport/EditorClientEfl.cpp b/Source/WebKit/efl/WebCoreSupport/EditorClientEfl.cpp
index 78563ec7d..8224155a8 100644
--- a/Source/WebKit/efl/WebCoreSupport/EditorClientEfl.cpp
+++ b/Source/WebKit/efl/WebCoreSupport/EditorClientEfl.cpp
@@ -103,7 +103,7 @@ bool EditorClientEfl::shouldChangeSelectedRange(Range*, Range*, EAffinity, bool)
     return true;
 }
 
-bool EditorClientEfl::shouldApplyStyle(CSSStyleDeclaration*, Range*)
+bool EditorClientEfl::shouldApplyStyle(StylePropertySet*, Range*)
 {
     notImplemented();
     return true;
diff --git a/Source/WebKit/efl/WebCoreSupport/EditorClientEfl.h b/Source/WebKit/efl/WebCoreSupport/EditorClientEfl.h
index 7ff181316..2b52e9dda 100644
--- a/Source/WebKit/efl/WebCoreSupport/EditorClientEfl.h
+++ b/Source/WebKit/efl/WebCoreSupport/EditorClientEfl.h
@@ -73,7 +73,7 @@ public:
     virtual bool shouldInsertText(const String&, Range*, EditorInsertAction);
     virtual bool shouldChangeSelectedRange(Range* fromRange, Range* toRange, EAffinity, bool stillSelecting);
 
-    virtual bool shouldApplyStyle(CSSStyleDeclaration*, Range*);
+    virtual bool shouldApplyStyle(StylePropertySet*, Range*);
 
     virtual bool shouldMoveRangeAfterDelete(Range*, Range*);
 
@@ -120,7 +120,7 @@ public:
     virtual void getGuessesForWord(const String& word, const String& context, WTF::Vector<String>& guesses);
     virtual void willSetInputMethodState();
     virtual void setInputMethodState(bool enabled);
-    virtual void requestCheckingOfString(WebCore::SpellChecker*, int, WebCore::TextCheckingTypeMask, const WTF::String&) { }
+    virtual void requestCheckingOfString(WebCore::SpellChecker*, const WebCore::TextCheckingRequest&) { }
     virtual TextCheckerClient* textChecker() { return this; }
 
 private:
diff --git a/Source/WebKit/efl/WebCoreSupport/FrameLoaderClientEfl.cpp b/Source/WebKit/efl/WebCoreSupport/FrameLoaderClientEfl.cpp
index 1d4d64a9f..0096b8874 100644
--- a/Source/WebKit/efl/WebCoreSupport/FrameLoaderClientEfl.cpp
+++ b/Source/WebKit/efl/WebCoreSupport/FrameLoaderClientEfl.cpp
@@ -241,13 +241,9 @@ void FrameLoaderClientEfl::frameLoaderDestroyed()
 
 void FrameLoaderClientEfl::dispatchDidReceiveResponse(DocumentLoader* loader, unsigned long, const ResourceResponse& response)
 {
-#if USE(SOUP)
     // Update our knowledge of request soup flags - some are only set
     // after the request is done.
     loader->request().setSoupMessageFlags(response.soupMessageFlags());
-#else
-    UNUSED_PARAM(loader);
-#endif
 
     m_response = response;
 }
@@ -951,7 +947,7 @@ void FrameLoaderClientEfl::dispatchDidBecomeFrameset(bool)
 
 PassRefPtr<FrameNetworkingContext> FrameLoaderClientEfl::createNetworkingContext()
 {
-    return FrameNetworkingContextEfl::create(EWKPrivate::coreFrame(m_frame));
+    return FrameNetworkingContextEfl::create(EWKPrivate::coreFrame(m_frame), m_frame);
 }
 
 }
diff --git a/Source/WebKit/efl/WebCoreSupport/FrameNetworkingContextEfl.cpp b/Source/WebKit/efl/WebCoreSupport/FrameNetworkingContextEfl.cpp
new file mode 100644
index 000000000..8c20b213a
--- /dev/null
+++ b/Source/WebKit/efl/WebCoreSupport/FrameNetworkingContextEfl.cpp
@@ -0,0 +1,57 @@
+/*
+ * Copyright (C) 2010 Nokia Corporation and/or its subsidiary(-ies)
+ * Copyright (C) 2010 Samsung Electronics
+ * Copyright (C) 2012 ProFUSION embedded systems
+ *
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "FrameNetworkingContextEfl.h"
+
+#include "ResourceHandle.h"
+#include "ewk_frame.h"
+#include "ewk_view.h"
+
+#include <Evas.h>
+
+namespace WebCore {
+
+PassRefPtr<FrameNetworkingContextEfl> FrameNetworkingContextEfl::create(Frame* frame, Evas_Object* ewkFrame)
+{
+    return adoptRef(new FrameNetworkingContextEfl(frame, ewkFrame));
+}
+
+FrameNetworkingContextEfl::FrameNetworkingContextEfl(Frame* frame, Evas_Object* ewkFrame)
+    : FrameNetworkingContext(frame)
+    , m_ewkFrame(ewkFrame)
+{
+}
+
+SoupSession* FrameNetworkingContextEfl::soupSession() const
+{
+    return ewk_view_soup_session_get(ewk_frame_view_get(m_ewkFrame));
+}
+
+}
diff --git a/Source/WebKit/efl/WebCoreSupport/FrameNetworkingContextEfl.h b/Source/WebKit/efl/WebCoreSupport/FrameNetworkingContextEfl.h
index 4e67512d0..93ffd48bb 100644
--- a/Source/WebKit/efl/WebCoreSupport/FrameNetworkingContextEfl.h
+++ b/Source/WebKit/efl/WebCoreSupport/FrameNetworkingContextEfl.h
@@ -31,22 +31,21 @@
 
 #include "FrameNetworkingContext.h"
 
+typedef struct _Evas_Object Evas_Object;
+
 namespace WebCore {
 
 class FrameNetworkingContextEfl : public WebCore::FrameNetworkingContext {
 public:
-    static PassRefPtr<FrameNetworkingContextEfl> create(WebCore::Frame* frame)
-    {
-        return adoptRef(new FrameNetworkingContextEfl(frame));
-    }
+    static PassRefPtr<FrameNetworkingContextEfl> create(Frame*, Evas_Object*);
 
     WebCore::Frame* coreFrame() const { return frame(); }
+    virtual SoupSession* soupSession() const;
 
 private:
-    FrameNetworkingContextEfl(WebCore::Frame* frame)
-        : WebCore::FrameNetworkingContext(frame)
-    {
-    }
+    FrameNetworkingContextEfl(Frame*, Evas_Object*);
+
+    Evas_Object* m_ewkFrame;
 };
 
 }
diff --git a/Source/WebKit/efl/WebCoreSupport/StorageTrackerClientEfl.cpp b/Source/WebKit/efl/WebCoreSupport/StorageTrackerClientEfl.cpp
new file mode 100644
index 000000000..9d9d26918
--- /dev/null
+++ b/Source/WebKit/efl/WebCoreSupport/StorageTrackerClientEfl.cpp
@@ -0,0 +1,37 @@
+/*
+ *  Copyright (C) 2012 ProFUSION Embedded Systems
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Library General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Library General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Library General Public License
+ *  along with this library; see the file COPYING.LIB.  If not, write to
+ *  the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ *  Boston, MA 02110-1301, USA.
+ */
+
+#include "config.h"
+#include "StorageTrackerClientEfl.h"
+
+#include "NotImplemented.h"
+
+namespace WebCore {
+
+void StorageTrackerClientEfl::dispatchDidModifyOrigin(const String&)
+{
+    notImplemented();
+}
+
+void StorageTrackerClientEfl::didFinishLoadingOrigins()
+{
+    notImplemented();
+}
+
+}
diff --git a/Source/WebKit/efl/WebCoreSupport/StorageTrackerClientEfl.h b/Source/WebKit/efl/WebCoreSupport/StorageTrackerClientEfl.h
new file mode 100644
index 000000000..62eae20ee
--- /dev/null
+++ b/Source/WebKit/efl/WebCoreSupport/StorageTrackerClientEfl.h
@@ -0,0 +1,35 @@
+/*
+ *  Copyright (C) 2012 ProFUSION Embedded Systems
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Library General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Library General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Library General Public License
+ *  along with this library; see the file COPYING.LIB.  If not, write to
+ *  the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ *  Boston, MA 02110-1301, USA.
+ */
+
+#ifndef StorageTrackerClientEfl_h
+#define StorageTrackerClientEfl_h
+
+#include "StorageTrackerClient.h"
+
+namespace WebCore {
+
+class StorageTrackerClientEfl : public StorageTrackerClient {
+public:
+    virtual void dispatchDidModifyOrigin(const String&);
+    virtual void didFinishLoadingOrigins();
+};
+
+}
+
+#endif // StorageTrackerClientEfl_h
diff --git a/Source/WebKit/efl/WebCoreSupport/VibrationClientEfl.cpp b/Source/WebKit/efl/WebCoreSupport/VibrationClientEfl.cpp
new file mode 100644
index 000000000..2365b72a3
--- /dev/null
+++ b/Source/WebKit/efl/WebCoreSupport/VibrationClientEfl.cpp
@@ -0,0 +1,50 @@
+/*
+ *  Copyright (C) 2012 Samsung Electronics
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Library General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Library General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Library General Public License
+ *  along with this library; see the file COPYING.LIB.  If not, write to
+ *  the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ *  Boston, MA 02110-1301, USA.
+ */
+
+#include "config.h"
+#include "VibrationClientEfl.h"
+
+#if ENABLE(VIBRATION)
+
+namespace WebCore {
+
+VibrationClientEfl::VibrationClientEfl(Evas_Object* view)
+    : m_view(view)
+{
+}
+
+void VibrationClientEfl::vibrate(const unsigned long& time)
+{
+    evas_object_smart_callback_call(m_view, "vibration,vibrate", (void*)&time);
+}
+
+void VibrationClientEfl::cancelVibration()
+{
+    evas_object_smart_callback_call(m_view, "vibration,cancel", 0);
+}
+
+void VibrationClientEfl::vibrationDestroyed()
+{
+    delete this;
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(VIBRATION)
+
diff --git a/Source/WebKit/efl/WebCoreSupport/VibrationClientEfl.h b/Source/WebKit/efl/WebCoreSupport/VibrationClientEfl.h
new file mode 100644
index 000000000..e7b0d925a
--- /dev/null
+++ b/Source/WebKit/efl/WebCoreSupport/VibrationClientEfl.h
@@ -0,0 +1,45 @@
+/*
+ *  Copyright (C) 2012 Samsung Electronics
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Library General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Library General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Library General Public License
+ *  along with this library; see the file COPYING.LIB.  If not, write to
+ *  the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ *  Boston, MA 02110-1301, USA.
+ */
+
+#ifndef VibrationClientEfl_h
+#define VibrationClientEfl_h
+
+#include "VibrationClient.h"
+#include <Evas.h>
+
+namespace WebCore {
+
+class VibrationClientEfl : public VibrationClient {
+public:
+    VibrationClientEfl(Evas_Object* view);
+    virtual ~VibrationClientEfl() { }
+
+    virtual void vibrate(const unsigned long& time);
+    virtual void cancelVibration();
+
+    virtual void vibrationDestroyed();
+
+private:
+    Evas_Object* m_view;
+};
+
+} // namespace WebCore
+
+#endif // VibrationClientEfl_h
+
diff --git a/Source/WebKit/efl/ewebkit.pc.in b/Source/WebKit/efl/ewebkit.pc.in
index 3a1c8f54f..dd6178347 100644
--- a/Source/WebKit/efl/ewebkit.pc.in
+++ b/Source/WebKit/efl/ewebkit.pc.in
@@ -7,7 +7,7 @@ datadir=${prefix}/share/@WebKit_LIBRARY_NAME@-@PROJECT_VERSION_MAJOR@
 Name: WebKit-EFL
 Description: Web content engine for EFL applications
 Version: @PROJECT_VERSION@
-Requires: cairo evas ecore
+Requires: cairo evas ecore libsoup-2.4
 Libs: -L${libdir} -lewebkit @EXTRA_EWEBKIT_LINK@
 Libs.private: @LIBS_PRIVATE@
 Cflags: -I${includedir}/@WebKit_LIBRARY_NAME@-@PROJECT_VERSION_MAJOR@
diff --git a/Source/WebKit/efl/ewk/ewk_auth.cpp b/Source/WebKit/efl/ewk/ewk_auth.cpp
index a4cb9e6b7..af2172ae1 100644
--- a/Source/WebKit/efl/ewk/ewk_auth.cpp
+++ b/Source/WebKit/efl/ewk/ewk_auth.cpp
@@ -20,20 +20,14 @@
 #include "config.h"
 #include "ewk_auth.h"
 
-#ifdef WTF_USE_SOUP
 #include "ewk_auth_soup.h"
-#endif
 
 void ewk_auth_show_dialog_callback_set(Ewk_Auth_Show_Dialog_Callback callback)
 {
-#if USE(SOUP)
     ewk_auth_soup_show_dialog_callback_set(callback);
-#endif
 }
 
 void ewk_auth_credentials_set(char* username, char* password, void* data)
 {
-#if USE(SOUP)
     ewk_auth_soup_credentials_set(username, password, data);
-#endif
 }
diff --git a/Source/WebKit/efl/ewk/ewk_cookies.cpp b/Source/WebKit/efl/ewk/ewk_cookies.cpp
index 35e64ac40..7980c0120 100644
--- a/Source/WebKit/efl/ewk/ewk_cookies.cpp
+++ b/Source/WebKit/efl/ewk/ewk_cookies.cpp
@@ -21,20 +21,16 @@
 #include "config.h"
 #include "ewk_cookies.h"
 
+#include "CookieJarSoup.h"
 #include "ResourceHandle.h"
 #include <Eina.h>
 #include <eina_safety_checks.h>
-#include <wtf/text/CString.h>
-
-#if USE(SOUP)
-#include "CookieJarSoup.h"
 #include <glib.h>
 #include <libsoup/soup.h>
-#endif
+#include <wtf/text/CString.h>
 
 Eina_Bool ewk_cookies_file_set(const char* filename)
 {
-#if USE(SOUP)
     SoupCookieJar* cookieJar = 0;
     if (filename)
         cookieJar = soup_cookie_jar_text_new(filename, FALSE);
@@ -55,14 +51,10 @@ Eina_Bool ewk_cookies_file_set(const char* filename)
     soup_session_add_feature(session, SOUP_SESSION_FEATURE(cookieJar));
 
     return true;
-#else
-    return false;
-#endif
 }
 
 void ewk_cookies_clear(void)
 {
-#if USE(SOUP)
     GSList* list;
     GSList* p;
     SoupCookieJar* cookieJar = WebCore::defaultCookieJar();
@@ -72,13 +64,11 @@ void ewk_cookies_clear(void)
         soup_cookie_jar_delete_cookie(cookieJar, (SoupCookie*)p->data);
 
     soup_cookies_free(list);
-#endif
 }
 
 Eina_List* ewk_cookies_get_all(void)
 {
     Eina_List* result = 0;
-#if USE(SOUP)
     GSList* list;
     GSList* p;
     SoupCookieJar* cookieJar = WebCore::defaultCookieJar();
@@ -98,13 +88,12 @@ Eina_List* ewk_cookies_get_all(void)
     }
 
     soup_cookies_free(list);
-#endif
+
     return result;
 }
 
 void ewk_cookies_cookie_del(Ewk_Cookie* cookie)
 {
-#if USE(SOUP)
     EINA_SAFETY_ON_NULL_RETURN(cookie);
     GSList* list;
     GSList* p;
@@ -123,24 +112,20 @@ void ewk_cookies_cookie_del(Ewk_Cookie* cookie)
 
     soup_cookie_free(cookie1);
     soup_cookies_free(list);
-#endif
 }
 
 void ewk_cookies_cookie_free(Ewk_Cookie* cookie)
 {
-#if USE(SOUP)
     EINA_SAFETY_ON_NULL_RETURN(cookie);
     free(cookie->name);
     free(cookie->value);
     free(cookie->domain);
     free(cookie->path);
     free(cookie);
-#endif
 }
 
 void ewk_cookies_policy_set(Ewk_Cookie_Policy cookiePolicy)
 {
-#if USE(SOUP)
     SoupCookieJar* cookieJar = WebCore::defaultCookieJar();
     SoupCookieJarAcceptPolicy policy;
 
@@ -158,13 +143,11 @@ void ewk_cookies_policy_set(Ewk_Cookie_Policy cookiePolicy)
     }
 
     soup_cookie_jar_set_accept_policy(cookieJar, policy);
-#endif
 }
 
 Ewk_Cookie_Policy ewk_cookies_policy_get(void)
 {
     Ewk_Cookie_Policy ewkPolicy = EWK_COOKIE_JAR_ACCEPT_ALWAYS;
-#if USE(SOUP)
     SoupCookieJar* cookieJar = WebCore::defaultCookieJar();
     SoupCookieJarAcceptPolicy policy;
 
@@ -180,7 +163,6 @@ Ewk_Cookie_Policy ewk_cookies_policy_get(void)
         ewkPolicy = EWK_COOKIE_JAR_ACCEPT_NO_THIRD_PARTY;
         break;
     }
-#endif
 
     return ewkPolicy;
 }
diff --git a/Source/WebKit/efl/ewk/ewk_cookies.h b/Source/WebKit/efl/ewk/ewk_cookies.h
index 40e69d56c..29ac12182 100644
--- a/Source/WebKit/efl/ewk/ewk_cookies.h
+++ b/Source/WebKit/efl/ewk/ewk_cookies.h
@@ -21,6 +21,12 @@
 /**
  * @file    ewk_cookies.h
  * @brief   The Ewk cookies API.
+ *
+ * @note If the libsoup network backend is being used the functions here will
+ * only work with the @b default SoupSession, which can be retrieved with
+ * ewk_network_defaul_soup_session_get(). If a different SoupSession is used
+ * and associated with a view with ewk_view_soup_session_set(), all cookie
+ * management will have to be done manually.
  */
 
 #ifndef ewk_cookies_h
diff --git a/Source/WebKit/efl/ewk/ewk_frame.cpp b/Source/WebKit/efl/ewk/ewk_frame.cpp
index 8dc140150..29fe4f059 100644
--- a/Source/WebKit/efl/ewk/ewk_frame.cpp
+++ b/Source/WebKit/efl/ewk/ewk_frame.cpp
@@ -1606,7 +1606,6 @@ Eina_Bool ewk_frame_mixed_content_run_get(const Evas_Object* ewkFrame)
 
 Ewk_Certificate_Status ewk_frame_certificate_status_get(Evas_Object* ewkFrame)
 {
-#if USE(SOUP)
     EWK_FRAME_SD_GET_OR_RETURN(ewkFrame, smartData, EWK_CERTIFICATE_STATUS_NO_CERTIFICATE);
     EINA_SAFETY_ON_NULL_RETURN_VAL(smartData->frame, EWK_CERTIFICATE_STATUS_NO_CERTIFICATE);
 
@@ -1626,9 +1625,6 @@ Ewk_Certificate_Status ewk_frame_certificate_status_get(Evas_Object* ewkFrame)
         return EWK_CERTIFICATE_STATUS_TRUSTED;
 
     return EWK_CERTIFICATE_STATUS_UNTRUSTED;
-#endif
-
-    return EWK_CERTIFICATE_STATUS_NO_CERTIFICATE;
 }
 
 /**
diff --git a/Source/WebKit/efl/ewk/ewk_main.cpp b/Source/WebKit/efl/ewk/ewk_main.cpp
index cead2de72..7621d37d5 100644
--- a/Source/WebKit/efl/ewk/ewk_main.cpp
+++ b/Source/WebKit/efl/ewk/ewk_main.cpp
@@ -25,8 +25,12 @@
 #include "Logging.h"
 #include "PageCache.h"
 #include "PageGroup.h"
+#include "ResourceHandle.h"
 #include "ScriptController.h"
 #include "Settings.h"
+#include "StorageTracker.h"
+#include "StorageTrackerClientEfl.h"
+#include "ewk_auth_soup.h"
 #include "ewk_logging.h"
 #include "ewk_network.h"
 #include "ewk_private.h"
@@ -37,21 +41,12 @@
 #include <Edje.h>
 #include <Eina.h>
 #include <Evas.h>
-#include <stdlib.h>
-#include <sys/stat.h>
-#include <wtf/Threading.h>
-
-#if ENABLE(GLIB_SUPPORT)
 #include <glib-object.h>
 #include <glib.h>
-#endif
-
-#if USE(SOUP)
-// REMOVE-ME: see todo below
-#include "ResourceHandle.h"
-#include "ewk_auth_soup.h"
 #include <libsoup/soup.h>
-#endif
+#include <stdlib.h>
+#include <sys/stat.h>
+#include <wtf/Threading.h>
 
 static int _ewkInitCount = 0;
 
@@ -135,16 +130,20 @@ int ewk_shutdown(void)
     return 0;
 }
 
+static WebCore::StorageTrackerClientEfl* trackerClient()
+{
+    DEFINE_STATIC_LOCAL(WebCore::StorageTrackerClientEfl, trackerClient, ());
+    return &trackerClient;
+}
+
 Eina_Bool _ewk_init_body(void)
 {
 
-#if ENABLE(GLIB_SUPPORT)
     g_type_init();
 
     if (!ecore_main_loop_glib_integrate())
         WRN("Ecore was not compiled with GLib support, some plugins will not "
             "work (ie: Adobe Flash)");
-#endif
 
     WebCore::ScriptController::initializeThreading();
     WebCore::initializeLoggingChannelsIfNecessary();
@@ -174,17 +173,11 @@ Eina_Bool _ewk_init_body(void)
 
     ewk_network_tls_certificate_check_set(false);
 
-    // TODO: this should move to WebCore, already reported to webkit-gtk folks:
-#if USE(SOUP)
-    if (1) {
-        SoupSession* session = WebCore::ResourceHandle::defaultSession();
-        soup_session_add_feature_by_type(session, SOUP_TYPE_CONTENT_SNIFFER);
-        soup_session_add_feature_by_type(session, SOUP_TYPE_CONTENT_DECODER);
+    WebCore::StorageTracker::initializeTracker(webkitDirectory.utf8().data(), trackerClient());
 
-        SoupSessionFeature* auth_dialog = static_cast<SoupSessionFeature*>(g_object_new(EWK_TYPE_SOUP_AUTH_DIALOG, 0));
-        soup_session_add_feature(session, auth_dialog);
-    }
-#endif
+    SoupSession* session = WebCore::ResourceHandle::defaultSession();
+    SoupSessionFeature* auth_dialog = static_cast<SoupSessionFeature*>(g_object_new(EWK_TYPE_SOUP_AUTH_DIALOG, 0));
+    soup_session_add_feature(session, auth_dialog);
 
     return true;
 }
diff --git a/Source/WebKit/efl/ewk/ewk_network.cpp b/Source/WebKit/efl/ewk/ewk_network.cpp
index 0ca5bd1bb..541ccddab 100644
--- a/Source/WebKit/efl/ewk/ewk_network.cpp
+++ b/Source/WebKit/efl/ewk/ewk_network.cpp
@@ -21,18 +21,14 @@
 #include "ewk_network.h"
 
 #include "NetworkStateNotifier.h"
+#include "ResourceHandle.h"
 #include "ewk_logging.h"
 #include <Eina.h>
-#include <wtf/text/CString.h>
-
-#if USE(SOUP)
-#include "ResourceHandle.h"
 #include <libsoup/soup.h>
-#endif
+#include <wtf/text/CString.h>
 
 void ewk_network_proxy_uri_set(const char* proxy)
 {
-#if USE(SOUP)
     SoupSession* session = WebCore::ResourceHandle::defaultSession();
 
     if (!proxy) {
@@ -46,14 +42,10 @@ void ewk_network_proxy_uri_set(const char* proxy)
 
     g_object_set(session, SOUP_SESSION_PROXY_URI, uri, NULL);
     soup_uri_free(uri);
-#elif USE(CURL)
-    EINA_SAFETY_ON_TRUE_RETURN(1);
-#endif
 }
 
 const char* ewk_network_proxy_uri_get(void)
 {
-#if USE(SOUP)
     SoupURI* uri;
     SoupSession* session = WebCore::ResourceHandle::defaultSession();
     g_object_get(session, SOUP_SESSION_PROXY_URI, &uri, NULL);
@@ -65,9 +57,6 @@ const char* ewk_network_proxy_uri_get(void)
 
     WTF::String proxy = soup_uri_to_string(uri, false);
     return eina_stringshare_add(proxy.utf8().data());
-#elif USE(CURL)
-    EINA_SAFETY_ON_TRUE_RETURN_VAL(1, 0);
-#endif
 }
 
 void ewk_network_state_notifier_online_set(Eina_Bool online)
@@ -79,47 +68,35 @@ Eina_Bool ewk_network_tls_certificate_check_get()
 {
     bool checkCertificates = false;
 
-#if USE(SOUP)
     SoupSession* defaultSession = WebCore::ResourceHandle::defaultSession();
     g_object_get(defaultSession, "ssl-strict", &checkCertificates, NULL);
-#endif
 
     return checkCertificates;
 }
 
 void ewk_network_tls_certificate_check_set(Eina_Bool checkCertificates)
 {
-#if USE(SOUP)
     SoupSession* defaultSession = WebCore::ResourceHandle::defaultSession();
     g_object_set(defaultSession, "ssl-strict", checkCertificates, NULL);
-#endif
 }
 
 const char* ewk_network_tls_ca_certificates_path_get()
 {
     const char* bundlePath = 0;
 
-#if USE(SOUP)
     SoupSession* defaultSession = WebCore::ResourceHandle::defaultSession();
     g_object_get(defaultSession, "ssl-ca-file", &bundlePath, NULL);
-#endif
 
     return bundlePath;
 }
 
 void ewk_network_tls_ca_certificates_path_set(const char* bundlePath)
 {
-#if USE(SOUP)
     SoupSession* defaultSession = WebCore::ResourceHandle::defaultSession();
     g_object_set(defaultSession, "ssl-ca-file", bundlePath, NULL);
-#endif
 }
 
 SoupSession* ewk_network_default_soup_session_get()
 {
-#if USE(SOUP)
     return WebCore::ResourceHandle::defaultSession();
-#else
-    return 0;
-#endif
 }
diff --git a/Source/WebKit/efl/ewk/ewk_network.h b/Source/WebKit/efl/ewk/ewk_network.h
index 3977e9978..dbec81584 100644
--- a/Source/WebKit/efl/ewk/ewk_network.h
+++ b/Source/WebKit/efl/ewk/ewk_network.h
@@ -26,17 +26,21 @@
 #define ewk_network_h
 
 #include <Eina.h>
+#include <libsoup/soup-session.h>
 
 #ifdef __cplusplus
 extern "C" {
 #endif
 
-typedef struct _SoupSession SoupSession;
-
 /**
  * Sets the given proxy URI to network backend.
  *
  * @param proxy URI to set
+ *
+ * @note If the libsoup backend is being used, this function has effect on
+ * the @b default SoupSession, returned by ewk_network_default_soup_session_get().
+ * If a different SoupSession is used and passed to ewk_view_soup_session_set(),
+ * this function will not have any effect on it.
  */
 EAPI void             ewk_network_proxy_uri_set(const char *proxy);
 
@@ -46,6 +50,11 @@ EAPI void             ewk_network_proxy_uri_set(const char *proxy);
  * The returned string should be freed by eina_stringshare_del() after use.
  *
  * @return current proxy URI or @c 0 if it's not set
+ *
+ * @note If the libsoup backend is being used, this function has effect on
+ * the @b default SoupSession, returned by ewk_network_default_soup_session_get().
+ * If a different SoupSession is used and passed to ewk_view_soup_session_set(),
+ * this function will not have any effect on it.
  */
 EAPI const char      *ewk_network_proxy_uri_get(void);
 
@@ -62,6 +71,11 @@ EAPI void             ewk_network_state_notifier_online_set(Eina_Bool online);
  * By default, HTTPS connections are performed regardless of the validity of the certificate provided.
  *
  * @sa ewk_network_tls_ca_certificates_path_set
+ *
+ * @note If the libsoup backend is being used, this function has effect on
+ * the @b default SoupSession, returned by ewk_network_default_soup_session_get().
+ * If a different SoupSession is used and passed to ewk_view_soup_session_set(),
+ * this function will not have any effect on it.
  */
 EAPI Eina_Bool        ewk_network_tls_certificate_check_get(void);
 
@@ -73,6 +87,11 @@ EAPI Eina_Bool        ewk_network_tls_certificate_check_get(void);
  * @param enable Whether to check the provided certificates or not.
  *
  * @sa ewk_network_tls_ca_certificates_path_set
+ *
+ * @note If the libsoup backend is being used, this function has effect on
+ * the @b default SoupSession, returned by ewk_network_default_soup_session_get().
+ * If a different SoupSession is used and passed to ewk_view_soup_session_set(),
+ * this function will not have any effect on it.
  */
 EAPI void             ewk_network_tls_certificate_check_set(Eina_Bool enable);
 
@@ -89,6 +108,11 @@ EAPI void             ewk_network_tls_certificate_check_set(Eina_Bool enable);
  * By default, the path is not set, so all certificates are considered as not signed by a trusted root CA.
  *
  * @sa ewk_network_tls_certificate_check_set
+ *
+ * @note If the libsoup backend is being used, this function has effect on
+ * the @b default SoupSession, returned by ewk_network_default_soup_session_get().
+ * If a different SoupSession is used and passed to ewk_view_soup_session_set(),
+ * this function will not have any effect on it.
  */
 EAPI const char      *ewk_network_tls_ca_certificates_path_get(void);
 
@@ -107,17 +131,18 @@ EAPI const char      *ewk_network_tls_ca_certificates_path_get(void);
  * @param path The path to the certificate bundle.
  *
  * @sa ewk_network_tls_certificate_check_set
+ *
+ * @note If the libsoup backend is being used, this function has effect on
+ * the @b default SoupSession, returned by ewk_network_default_soup_session_get().
+ * If a different SoupSession is used and passed to ewk_view_soup_session_set(),
+ * this function will not have any effect on it.
  */
 EAPI void             ewk_network_tls_ca_certificates_path_set(const char *path);
 
 /**
  * Returns the default @c SoupSession used by all views.
  *
- * This function is meaningful only if WebKit has been compiled with the
- * @c Soup network backend.
- *
- * @return The default @c SoupSession in use, or @c NULL if another network
- *         backend was used.
+ * @return The default @c SoupSession in use.
  */
 EAPI SoupSession     *ewk_network_default_soup_session_get(void);
 
diff --git a/Source/WebKit/efl/ewk/ewk_settings.cpp b/Source/WebKit/efl/ewk/ewk_settings.cpp
index af561c3b6..d13b39e7e 100644
--- a/Source/WebKit/efl/ewk/ewk_settings.cpp
+++ b/Source/WebKit/efl/ewk/ewk_settings.cpp
@@ -24,6 +24,7 @@
 #include "ApplicationCacheStorage.h"
 #include "CrossOriginPreflightResultCache.h"
 #include "DatabaseTracker.h"
+#include "StorageTracker.h"
 #include "FontCache.h"
 #include "FrameView.h"
 #include "IconDatabase.h"
@@ -57,6 +58,7 @@ static const char* s_offlineAppCachePath = 0;
 static const char* _ewk_icon_database_path = 0;
 
 static const char* s_webDatabasePath = 0;
+static const char* s_localStoragePath = 0;
 static uint64_t s_webDatabaseQuota = 1 * 1024 * 1024; // 1MB.
 
 static WTF::String _ewk_settings_webkit_platform_get()
@@ -111,6 +113,30 @@ void ewk_settings_web_database_clear()
 #endif
 }
 
+void ewk_settings_local_storage_path_set(const char* path)
+{
+    WebCore::StorageTracker::tracker().setDatabaseDirectoryPath(WTF::String::fromUTF8(path));
+    eina_stringshare_replace(&s_localStoragePath, path);
+}
+
+const char* ewk_settings_local_storage_path_get(void)
+{
+    return s_localStoragePath;
+}
+
+void ewk_settings_local_storage_database_clear()
+{
+    WebCore::StorageTracker::tracker().deleteAllOrigins();
+}
+
+void ewk_settings_local_storage_database_origin_clear(const char* url)
+{
+    EINA_SAFETY_ON_NULL_RETURN(url);
+
+    const WebCore::KURL kurl(WebCore::KURL(), WTF::String::fromUTF8(url));
+    WebCore::StorageTracker::tracker().deleteOrigin(WebCore::SecurityOrigin::create(kurl).get());
+}
+
 void ewk_settings_web_database_path_set(const char* path)
 {
 #if ENABLE(SQL_DATABASE)
diff --git a/Source/WebKit/efl/ewk/ewk_settings.h b/Source/WebKit/efl/ewk/ewk_settings.h
index 1e61b4402..cce9a5aa7 100644
--- a/Source/WebKit/efl/ewk/ewk_settings.h
+++ b/Source/WebKit/efl/ewk/ewk_settings.h
@@ -68,6 +68,53 @@ EAPI void             ewk_settings_web_database_clear(void);
 EAPI void             ewk_settings_web_database_path_set(const char *path);
 
 /**
+ * Sets the current path to the directory where WebKit will write the
+ * HTML5 local storage indexing database (the one keeping track of
+ * individual views' local storage databases).
+ *
+ * By default, the value is @c ~/.webkit
+ *
+ * @param path the new local storage database directory path
+ *
+ * @note You may want to call
+ * ewk_view_setting_local_storage_database_path_set() on the same @p
+ * path, here, for your views.
+ */
+EAPI void ewk_settings_local_storage_path_set(const char* path);
+
+/**
+ * Returns directory's path where the HTML5 local storage indexing
+ * database is stored.
+ *
+ * This is guaranteed to be eina-stringshared, so whenever possible
+ * save yourself some cpu cycles and use eina_stringshare_ref()
+ * instead of eina_stringshare_add() or strdup().
+ *
+ * @return database path or @c NULL, on errors.
+ *
+ * @see ewk_settings_local_storage_path_set()
+ */
+EAPI const char* ewk_settings_local_storage_path_get(void);
+
+/**
+ * Removes @b all HTML 5 local storage databases.
+ */
+EAPI void ewk_settings_local_storage_database_clear();
+
+/**
+ * Clears the HTML 5 local storage database for the given URL
+ * (origin).
+ *
+ * @param url which URL to clear local storage to.
+ *
+ * After this call, the file holding the local storage database for
+ * that origin will be deleted, along with its entry on the local
+ * storage files database (a file stored under the path returned by
+ * ewk_settings_local_storage_path_get()).
+ */
+EAPI void ewk_settings_local_storage_database_origin_clear(const char *url);
+
+/**
  * Returns directory path where web database is stored.
  *
  * By default, the value is @c ~/.webkit
diff --git a/Source/WebKit/efl/ewk/ewk_view.cpp b/Source/WebKit/efl/ewk/ewk_view.cpp
index 9789c1c30..8a9674022 100644
--- a/Source/WebKit/efl/ewk/ewk_view.cpp
+++ b/Source/WebKit/efl/ewk/ewk_view.cpp
@@ -1,6 +1,6 @@
 /*
     Copyright (C) 2009-2010 ProFUSION embedded systems
-    Copyright (C) 2009-2011 Samsung Electronics
+    Copyright (C) 2009-2012 Samsung Electronics
 
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
@@ -50,6 +50,7 @@
 #include "ProgressTracker.h"
 #include "RefPtrCairo.h"
 #include "RenderTheme.h"
+#include "ResourceHandle.h"
 #include "Settings.h"
 #include "c_instance.h"
 #include "ewk_logging.h"
@@ -59,6 +60,7 @@
 #include <Evas.h>
 #include <eina_safety_checks.h>
 #include <inttypes.h>
+#include <libsoup/soup-session.h>
 #include <limits>
 #include <math.h>
 #include <sys/time.h>
@@ -68,6 +70,10 @@
 #include "DeviceOrientationClientEfl.h"
 #endif
 
+#if ENABLE(VIBRATION)
+#include "VibrationClientEfl.h"
+#endif
+
 static const float zoomMinimum = 0.05;
 static const float zoomMaximum = 4.0;
 
@@ -211,6 +217,7 @@ struct _Ewk_View_Private_Data {
         } center;
         Ecore_Animator* animator;
     } animatedZoom;
+    SoupSession* soupSession;
 };
 
 #ifndef EWK_TYPE_CHECK
@@ -604,15 +611,19 @@ static Ewk_View_Private_Data* _ewk_view_priv_new(Ewk_View_Smart_Data* smartData)
     pageClients.editorClient = new WebCore::EditorClientEfl(smartData->self);
     pageClients.dragClient = new WebCore::DragClientEfl;
     pageClients.inspectorClient = new WebCore::InspectorClientEfl;
-#if ENABLE(DEVICE_ORIENTATION)
-    pageClients.deviceMotionClient = new WebCore::DeviceMotionClientEfl;
-    pageClients.deviceOrientationClient = new WebCore::DeviceOrientationClientEfl;
-#endif
     priv->page = new WebCore::Page(pageClients);
     if (!priv->page) {
         CRITICAL("Could not create WebKit Page");
         goto error_page;
     }
+#if ENABLE(DEVICE_ORIENTATION)
+    WebCore::provideDeviceMotionTo(priv->page, new WebCore::DeviceMotionClientEfl);
+    WebCore::provideDeviceOrientationTo(priv->page, new WebCore::DeviceOrientationClientEfl);
+#endif
+
+#if ENABLE(VIBRATION)
+    WebCore::provideVibrationTo(priv->page, new WebCore::VibrationClientEfl(smartData->self));
+#endif
 
     priv->pageSettings = priv->page->settings();
     if (!priv->pageSettings) {
@@ -714,6 +725,8 @@ static Ewk_View_Private_Data* _ewk_view_priv_new(Ewk_View_Smart_Data* smartData)
         goto error_history;
     }
 
+    priv->soupSession = WebCore::ResourceHandle::defaultSession();
+
     return priv;
 
 error_history:
@@ -3913,6 +3926,25 @@ Ewk_Page_Visibility_State ewk_view_visibility_state_get(const Evas_Object* ewkVi
 #endif
 }
 
+SoupSession* ewk_view_soup_session_get(const Evas_Object* ewkView)
+{
+    EWK_VIEW_SD_GET_OR_RETURN(ewkView, smartData, 0);
+    EWK_VIEW_PRIV_GET_OR_RETURN(smartData, priv, 0);
+    return priv->soupSession;
+}
+
+void ewk_view_soup_session_set(Evas_Object* ewkView, SoupSession* session)
+{
+    EWK_VIEW_SD_GET_OR_RETURN(ewkView, smartData);
+    EWK_VIEW_PRIV_GET_OR_RETURN(smartData, priv);
+    if (!SOUP_IS_SESSION_ASYNC(session)) {
+        ERR("WebKit requires an SoupSessionAsync to work properly, but "
+            "a SoupSessionSync was provided.");
+        return;
+    }
+    priv->soupSession = session;
+}
+
 namespace EWKPrivate {
 
 WebCore::Page *corePage(const Evas_Object *ewkView)
diff --git a/Source/WebKit/efl/ewk/ewk_view.h b/Source/WebKit/efl/ewk/ewk_view.h
index d3474a64b..7de0e462f 100644
--- a/Source/WebKit/efl/ewk/ewk_view.h
+++ b/Source/WebKit/efl/ewk/ewk_view.h
@@ -95,6 +95,7 @@
 
 #include <Evas.h>
 #include <cairo.h>
+#include <libsoup/soup-session.h>
 
 #ifdef __cplusplus
 extern "C" {
@@ -2335,6 +2336,34 @@ EAPI Eina_Bool ewk_view_mixed_content_displayed_get(const Evas_Object *o);
  */
 EAPI Eina_Bool ewk_view_mixed_content_run_get(const Evas_Object *o);
 
+/**
+ * Returns the SoupSession associated with this view.
+ *
+ * By default, all views share the same, default soup session also available
+ * by calling ewk_network_default_soup_session_get.
+ *
+ * @param o The view to query.
+ *
+ * @sa ewk_view_soup_session_set, ewk_network_default_soup_session_get
+ */
+EAPI SoupSession* ewk_view_soup_session_get(const Evas_Object *o);
+
+/**
+ * Associates a new SoupSession with this view.
+ *
+ * Only sessions of type SoupSessionAsync are supported.
+ *
+ * @note Changing the SoupSession should not be needed in most cases. If
+ *       a different SoupSession is used, the cookie management and some
+ *       network functions in ewk will not have any effect on it.
+ *
+ * @param o The view to change.
+ * @param session The new SoupSession.
+ *
+ * @sa ewk_view_soup_session_get, ewk_network_default_soup_session_get
+ */
+EAPI void ewk_view_soup_session_set(Evas_Object *o, SoupSession *session);
+
 #ifdef __cplusplus
 }
 #endif
diff --git a/Source/WebKit/gtk/ChangeLog b/Source/WebKit/gtk/ChangeLog
index 8c59bb93f..59bb90acb 100644
--- a/Source/WebKit/gtk/ChangeLog
+++ b/Source/WebKit/gtk/ChangeLog
@@ -1,3 +1,454 @@
+2012-02-24  Shinya Kawanaka  <shinyak@chromium.org>
+
+        SpellCheckRequest needs to know the context where the spellcheck happened.
+        https://bugs.webkit.org/show_bug.cgi?id=79320
+
+        Reviewed by Hajime Morita.
+
+        * WebCoreSupport/TextCheckerClientGtk.h:
+        (WebKit::TextCheckerClientGtk::requestCheckingOfString):
+
+2012-02-23  ChangSeok Oh  <shivamidow@gmail.com>
+
+        [GTK] DRT doesn't support scheduleAsynchronousKeyDown.
+        https://bugs.webkit.org/show_bug.cgi?id=78481
+
+        Reviewed by Gustavo Noronha Silva.
+
+        Added a new API to deliver all mutations explicitly.
+
+        * WebCoreSupport/DumpRenderTreeSupportGtk.cpp:
+        (DumpRenderTreeSupportGtk::deliverAllMutationsIfNecessary):
+        * WebCoreSupport/DumpRenderTreeSupportGtk.h:
+        (DumpRenderTreeSupportGtk):
+
+2012-02-23  Philippe Normand  <pnormand@igalia.com>
+
+        [GTK] FullScreen signals
+        https://bugs.webkit.org/show_bug.cgi?id=76181
+
+        Reviewed by Martin Robinson.
+
+        Added entering-fullscreen and leaving-fullscreen signals, meant to
+        be used by the user agent to be notified when an element requests
+        full screen display and when the full screen display is to be
+        disabled.
+
+        * WebCoreSupport/ChromeClientGtk.cpp:
+        (WebKit::ChromeClient::supportsFullScreenForElement):
+        (WebKit::onFullscreenGtkKeyPressEvent):
+        (WebKit::ChromeClient::cancelFullScreen):
+        (WebKit::ChromeClient::enterFullScreenForElement):
+        (WebKit::ChromeClient::exitFullScreenForElement):
+        * WebCoreSupport/ChromeClientGtk.h:
+        * tests/testwebview.c:
+        * webkit/webkitwebview.cpp:
+        (webkit_web_view_real_entering_fullscreen):
+        (webkit_web_view_real_leaving_fullscreen):
+        (webkit_web_view_class_init):
+        * webkit/webkitwebview.h:
+
+2012-02-21  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Remove the remaining uses of CSSStyleDeclaration in Editor
+        https://bugs.webkit.org/show_bug.cgi?id=78939
+
+        Reviewed by Enrica Casucci.
+
+        * WebCoreSupport/EditorClientGtk.cpp:
+        (WebKit::EditorClient::shouldApplyStyle):
+        * WebCoreSupport/EditorClientGtk.h:
+        (EditorClient):
+
+2012-02-22  Philippe Normand  <pnormand@igalia.com>
+
+        Unreviewed, rolling out r108522.
+        http://trac.webkit.org/changeset/108522
+        https://bugs.webkit.org/show_bug.cgi?id=76181
+
+        Broke 4 fullscreen tests on GTK.
+
+        * WebCoreSupport/ChromeClientGtk.cpp:
+        (WebKit::ChromeClient::supportsFullScreenForElement):
+        (WebKit::ChromeClient::enterFullScreenForElement):
+        (WebKit::ChromeClient::exitFullScreenForElement):
+        * WebCoreSupport/ChromeClientGtk.h:
+        (ChromeClient):
+        * tests/testwebview.c:
+        * webkit/webkitwebview.cpp:
+        (webkit_web_view_class_init):
+        * webkit/webkitwebview.h:
+        (_WebKitWebViewClass):
+
+2012-02-20  Philippe Normand  <pnormand@igalia.com>
+
+        [GTK] FullScreen signals
+        https://bugs.webkit.org/show_bug.cgi?id=76181
+
+        Reviewed by Martin Robinson.
+
+        Added entering-fullscreen and leaving-fullscreen signals, meant to
+        be used by the user agent to be notified when an element requests
+        full screen display and when the full screen display is to be
+        disabled.
+
+        * WebCoreSupport/ChromeClientGtk.cpp:
+        (WebKit::ChromeClient::supportsFullScreenForElement):
+        (WebKit::onFullscreenGtkKeyPressEvent):
+        (WebKit::ChromeClient::cancelFullScreen):
+        (WebKit::ChromeClient::enterFullScreenForElement):
+        (WebKit::ChromeClient::exitFullScreenForElement):
+        * WebCoreSupport/ChromeClientGtk.h:
+        * tests/testwebview.c:
+        * webkit/webkitwebview.cpp:
+        (webkit_web_view_real_entering_fullscreen):
+        (webkit_web_view_real_leaving_fullscreen):
+        (webkit_web_view_class_init):
+        * webkit/webkitwebview.h:
+
+2012-02-22  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Remove the remaining uses of CSSStyleDeclaration in Editor
+        https://bugs.webkit.org/show_bug.cgi?id=78939
+
+        Reviewed by Enrica Casucci.
+
+        * WebCoreSupport/EditorClientGtk.cpp:
+        (WebKit::EditorClient::shouldApplyStyle):
+        * WebCoreSupport/EditorClientGtk.h:
+        (EditorClient):
+
+2012-02-22  Carlos Garcia Campos  <cgarcia@igalia.com>
+
+        Unreviewed, rolling out r107351.
+        http://trac.webkit.org/changeset/107351
+        https://bugs.webkit.org/show_bug.cgi?id=53600
+
+        Several issues introduced in WebKitGTK+ API
+
+        * WebCoreSupport/ChromeClientGtk.cpp:
+        (WebKit::ChromeClient::ChromeClient):
+        (WebKit::ChromeClient::chromeDestroyed):
+        (WebKit::ChromeClient::canRunModal):
+        (WebKit::ChromeClient::runModal):
+        * WebCoreSupport/ChromeClientGtk.h:
+        (ChromeClient):
+        * webkit/webkitwebview.cpp:
+        (webkit_web_view_class_init):
+
+2012-02-21  Philippe Normand  <pnormand@igalia.com>
+
+        Fix one more GTK+ unit test after r108278.
+
+        Reviewed by Alejandro G. Castro.
+
+        * tests/testkeyevents.c:
+        (map_event_cb): No longer grab focus here.
+        (setup_keyevent_test): Grabbing focus here seems to be late enough in the process.
+
+2012-02-20  Martin Robinson  <mrobinson@igalia.com>
+
+        Fix GTK+ unit tests after r108281.
+
+        Reviewed by Alejandro G. Castro.
+
+        * tests/testwebplugindatabase.c:
+        (test_webkit_web_plugin_database_get_plugins): Update the description used
+        in the test.
+
+2012-02-20  Martin Robinson  <mrobinson@igalia.com>
+
+        Fix GTK+ unit tests after r108278.
+
+        Reviewed by Alejandro G. Castro.
+
+        Now that WebCore is no longer stealing focus, we need to
+        adjust where we grab focus to ensure that it actually succeeds.
+
+        * tests/testcopyandpaste.c:
+        (map_event_cb): No longer grab focus here.
+        (runPasteTestCallback): Grabbing focus here seems to be late enough in the process.
+
+2012-02-20  Martin Robinson  <mrobinson@igalia.com>
+
+        [GTK] Web content oftens steals focus from other widgets
+        https://bugs.webkit.org/show_bug.cgi?id=77791
+
+        Reviewed by Gustavo Noronha Silva.
+
+        * tests/testwebview.c: Added a WebKit1 test to verify this behavior.
+
+2012-02-20  Gustavo Noronha Silva  <gns@gnome.org>
+
+        [GTK] Needs to claim being a more up-to-date Chrome
+        https://bugs.webkit.org/show_bug.cgi?id=79044
+
+        Reviewed by Martin Robinson.
+
+        * webkit/webkitwebsettings.cpp:
+        (chromeUserAgent): update the version of Chrome we claim to be
+        to avoid warnings from sites such as Wordpress saying that our
+        browser is outdated.
+
+2012-02-19  Paweł Forysiuk  <tuxator@o2.pl>
+        [GTK] Can't find webinspector and error page redirection on Windows
+        https://bugs.webkit.org/show_bug.cgi?id=51616
+
+        Use an abstraction for finding shared resources on Windows.
+
+        Reviewed by Martin Robinson.
+
+        * WebCoreSupport/FrameLoaderClientGtk.cpp:
+        (WebKit::FrameLoaderClient::dispatchDidFailLoad):
+        * WebCoreSupport/InspectorClientGtk.cpp:
+        (WebKit::InspectorClient::inspectorFilesPath):
+
+2012-02-19  Gustavo Noronha Silva  <gns@gnome.org>
+
+        Unreviewed. Remove gsettings schema from EXTRA_DIST.
+
+        * GNUmakefile.am:
+
+2012-02-19  Gustavo Noronha Silva  <gns@gnome.org>
+
+        [GTK] Remove unused GSettings stuff
+        https://bugs.webkit.org/show_bug.cgi?id=78995
+
+        Reviewed by Martin Robinson.
+
+        * GNUmakefile.am: remove GSettings-related stuff.
+        * WebCoreSupport/InspectorClientGtk.cpp:
+        (WebKit): Remove unused code.
+        * org.webkitgtk.gschema.xml.in: Removed.
+        * webkit/webkitwebinspector.cpp:
+        (webkit_web_inspector_execute_script): remove gsettings-related helper.
+        * webkit/webkitwebinspectorprivate.h: Ditto.
+
+2012-02-17  Gyuyoung Kim  <gyuyoung.kim@samsung.com>
+
+        [GTK] change the way of registering DeviceOrientation clients.
+        https://bugs.webkit.org/show_bug.cgi?id=78680
+
+        Reviewed by Gustavo Noronha Silva.
+
+        Bug 78085 removed deviceOrientationClient and deviceMotionClient from PageClients. Instead,
+        DeviceOrientationClient and DeviceMotionClient should be registered by PageSupplement class.
+        Chromium, mac and qt ports are already changed by Bug 78085.
+
+        * webkit/webkitwebview.cpp:
+        (webkit_web_view_init):
+
+2012-02-16  Martin Robinson  <mrobinson@igalia.com>
+
+        [GTK] [AC] Events can starve accelerated compositing updates
+        https://bugs.webkit.org/show_bug.cgi?id=78826
+
+        Reviewed by Gustavo Noronha Silva.
+
+        Instead of using a WebCore timer, which can be starved by GdkEvents,
+        use a raw GLib timer with GDK_PRIORITY_EVENTS to drive AC updates.
+        This prevents dragging from blocking rendering.
+
+        * WebCoreSupport/AcceleratedCompositingContext.h:
+        (AcceleratedCompositingContext): Store a GLib source tag instead of a WebCore timer.
+        * WebCoreSupport/AcceleratedCompositingContextClutter.cpp:
+        (WebKit::AcceleratedCompositingContext::AcceleratedCompositingContext):
+        (WebKit::AcceleratedCompositingContext::AcceleratedCompositingContext):
+        Remove the timer upon destruction.
+        (WebKit::syncLayersTimeoutCallback): Added this callback for the GLib timer.
+        (WebKit::AcceleratedCompositingContext::markForSync): Use a GLib timer.
+        (WebKit::AcceleratedCompositingContext::syncLayersTimeout): Ditto.
+        * WebCoreSupport/AcceleratedCompositingContextGL.cpp:
+        (WebKit::AcceleratedCompositingContext::AcceleratedCompositingContext):
+        (WebKit::AcceleratedCompositingContext::~AcceleratedCompositingContext):
+        Remove the timer upon destruction.
+        (WebKit::syncLayersTimeoutCallback): Added this callback for the GLib timer.
+        (WebKit::AcceleratedCompositingContext::markForSync): Use a GLib timer.
+        (WebKit::AcceleratedCompositingContext::syncLayersTimeout): Ditto.
+
+2012-02-16  Adam Barth  <abarth@webkit.org>
+
+        Attempt to fix the GTK build.
+
+        * WebCoreSupport/GeolocationClientGtk.cpp:
+        (WebKit::GeolocationClient::requestPermission):
+        (WebKit::GeolocationClient::cancelPermissionRequest):
+
+2012-02-16  Sergio Villar Senin  <svillar@igalia.com>
+
+        [soup] Move important SoupSession feature initialization to WebCore
+        https://bugs.webkit.org/show_bug.cgi?id=68602
+
+        Reviewed by Martin Robinson.
+
+        Moved content sniffer and decoder initialization from WebKit to
+        WebCore because network stuff will not work as expected without
+        them.
+
+        No new tests required as we're just moving stuff from WebKit to
+        WebCore.
+
+        * webkit/webkitglobals.cpp:
+        (webkitInit):
+
+2012-02-16  Philippe Normand  <pnormand@igalia.com>
+
+        Unreviewed, rolling out r107941.
+        http://trac.webkit.org/changeset/107941
+        https://bugs.webkit.org/show_bug.cgi?id=68602
+
+        Broke 23 http tests on GTK
+
+        * webkit/webkitglobals.cpp:
+        (webkitInit):
+
+2012-02-16  Sergio Villar Senin  <svillar@igalia.com>
+
+        [soup] Move important SoupSession feature initialization to WebCore
+        https://bugs.webkit.org/show_bug.cgi?id=68602
+
+        Reviewed by Martin Robinson.
+
+        Moved content sniffer and decoder initialization from WebKit to
+        WebCore because network stuff will not work as expected without
+        them.
+
+        No new tests required as we're just moving stuff from WebKit to
+        WebCore.
+
+        * webkit/webkitglobals.cpp:
+        (webkitInit):
+
+2012-01-31  Raphael Kubo da Costa  <kubo@profusion.mobi>
+
+        [soup] Add support for multiple SoupSessions.
+        https://bugs.webkit.org/show_bug.cgi?id=77341
+
+        Reviewed by Gustavo Noronha Silva.
+
+        Adapt to the changes to FrameNetworkingContext in WebCore.
+
+        * GNUmakefile.am:
+        * WebCoreSupport/FrameNetworkingContextGtk.cpp: Copied from Source/WebKit/gtk/WebCoreSupport/FrameNetworkingContextGtk.h.
+        (WebKit):
+        (WebKit::FrameNetworkingContextGtk::soupSession): Always return ResourceHandle::defaultSession().
+        * WebCoreSupport/FrameNetworkingContextGtk.h:
+        (FrameNetworkingContextGtk):
+
+2012-02-15  Sadrul Habib Chowdhury  <sadrul@chromium.org>
+
+        Notify ChromeClient when touch-event handlers are installed/removed.
+        https://bugs.webkit.org/show_bug.cgi?id=77440
+
+        Reviewed by Darin Fisher and Ryosuke Niwa.
+
+        * WebCoreSupport/ChromeClientGtk.h:
+        (WebKit::ChromeClient::numTouchEventHandlersChanged):
+
+2012-02-15  No'am Rosenthal  <noam.rosenthal@nokia.com>
+
+        [Texmap] Divide TextureMapperNode.cpp to 3 files.
+        https://bugs.webkit.org/show_bug.cgi?id=76660
+
+        Rename TextureMapperNode to TextureMapperLayer.        
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        * WebCoreSupport/AcceleratedCompositingContext.h:
+        (AcceleratedCompositingContext):
+        * WebCoreSupport/AcceleratedCompositingContextGL.cpp:
+        (WebKit::AcceleratedCompositingContext::AcceleratedCompositingContext):
+        (WebKit::AcceleratedCompositingContext::enabled):
+        (WebKit::AcceleratedCompositingContext::renderLayersToWindow):
+        (WebKit::AcceleratedCompositingContext::attachRootGraphicsLayer):
+        (WebKit::AcceleratedCompositingContext::syncLayersTimeout):
+
+2012-02-11  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Convert svg/animations to use SMIL methods for driving the timeline
+        https://bugs.webkit.org/show_bug.cgi?id=78422
+
+        Reviewed by Dirk Schulze.
+
+        Remove SVG animation sampling functionality provided for DRT, which no longer uses it.
+        Instead we switched the svg/animations tests to use SVGSVGElement.setCurrentTime.
+
+        * WebCoreSupport/DumpRenderTreeSupportGtk.cpp:
+        * WebCoreSupport/DumpRenderTreeSupportGtk.h:
+        (DumpRenderTreeSupportGtk):
+
+2012-02-13  Mario Sanchez Prada  <msanchez@igalia.com>
+
+        [GTK] Add GSList to the list of GObject types in GOwnPtr
+        https://bugs.webkit.org/show_bug.cgi?id=78487
+
+        Reviewed by Philippe Normand.
+
+        * WebCoreSupport/ChromeClientGtk.cpp:
+        (WebKit::ChromeClient::runOpenPanel): Use GOwnPtr<GSList> for the
+        list of filenames returned by gtk_file_chooser_get_filenames().
+
+2012-02-09  Zan Dobersek  <zandobersek@gmail.com>
+
+        [GTK] Add DRT support for modal dialogs
+        https://bugs.webkit.org/show_bug.cgi?id=53600
+
+        Reviewed by Martin Robinson.
+
+        Add support for running modal dialogs.
+
+        A new signal is added to the WebKitWebView. When emitted, the web view
+        is requesting to be displayed as a modal dialog. If accepted, the
+        ChromeClient then establishes a loop that is run until the chrome is destroyed.
+        If denied, nothing is done.
+
+        * WebCoreSupport/ChromeClientGtk.cpp:
+        (WebKit::ChromeClient::ChromeClient):
+        (WebKit::ChromeClient::chromeDestroyed):
+        (WebKit::ChromeClient::canRunModal):
+        (WebKit::ChromeClient::runModal):
+        * WebCoreSupport/ChromeClientGtk.h:
+        (ChromeClient):
+        * webkit/webkitwebview.cpp:
+        (webkit_web_view_class_init):
+
+2012-02-09  Zan Dobersek  <zandobersek@gmail.com>
+
+        [Gtk] security/set-form-autocomplete-attribute.html fails
+        https://bugs.webkit.org/show_bug.cgi?id=78261
+
+        Reviewed by Martin Robinson.
+
+        Add a helper function to DumpRenderTreeSupportGtk, returning
+        whether or not an element does perform autocompletion.
+
+        * WebCoreSupport/DumpRenderTreeSupportGtk.cpp:
+        (DumpRenderTreeSupportGtk::elementDoesAutoCompleteForElementWithId):
+        * WebCoreSupport/DumpRenderTreeSupportGtk.h:
+        (DumpRenderTreeSupportGtk):
+
+2012-02-09  Martin Robinson  <mrobinson@igalia.com>
+
+        Build fix for GTK+ 2.x after my previous commit.
+
+        * webkit/webkitwebview.cpp:
+        (webkit_web_view_expose_event): The name of the event is expose_event and not expose.
+
+2012-02-08  Dan Vrátil  <dvratil@redhat.com>, Milan Crha <mcrha@redhat.com>
+
+        [GTK] Embedded GtkWidgets are not drawn
+        https://bugs.webkit.org/show_bug.cgi?id=63451
+
+        Insert plugin widgets to WebKitWebView container as it's children.
+        Chain up to parent in webkit_web_view_draw() to ensure the child widgets are drawn.
+
+        Reviewed by Martin Robinson.
+
+        * WebCoreSupport/FrameLoaderClientGtk.cpp:
+        (WebKit::FrameLoaderClient::createPlugin):
+        * webkit/webkitwebview.cpp:
+        (webkit_web_view_draw):
+
 2012-02-08  Mario Sanchez Prada  <msanchez@igalia.com>
 
         [Gtk] atk_text_get_text_at_offset() fails to provide the correct line for list items whose text wraps
diff --git a/Source/WebKit/gtk/GNUmakefile.am b/Source/WebKit/gtk/GNUmakefile.am
index 38d2bb02a..069b5b0a5 100644
--- a/Source/WebKit/gtk/GNUmakefile.am
+++ b/Source/WebKit/gtk/GNUmakefile.am
@@ -204,6 +204,7 @@ webkitgtk_sources += \
 	Source/WebKit/gtk/WebCoreSupport/EditorClientGtk.h \
 	Source/WebKit/gtk/WebCoreSupport/FrameLoaderClientGtk.cpp \
 	Source/WebKit/gtk/WebCoreSupport/FrameLoaderClientGtk.h \
+	Source/WebKit/gtk/WebCoreSupport/FrameNetworkingContextGtk.cpp \
 	Source/WebKit/gtk/WebCoreSupport/FrameNetworkingContextGtk.h \
 	Source/WebKit/gtk/WebCoreSupport/FullscreenVideoController.cpp \
 	Source/WebKit/gtk/WebCoreSupport/FullscreenVideoController.h \
@@ -384,10 +385,6 @@ $(GENSOURCES_WEBKIT)/webkitenumtypes.cpp: $(webkitgtk_h_api) $(WebKit)/GNUmakefi
 	&& cp xgen-gtc $@ \
 	&& rm -f xgen-gtc
 
-# GSettings
-gsettings_SCHEMAS = $(top_builddir)/Source/WebKit/gtk/org.webkitgtk-@WEBKITGTK_API_VERSION@.gschema.xml
-@GSETTINGS_RULES@
-
 EXTRA_DIST += \
 	$(WebKit)/ChangeLog \
 	$(WebKit)/NEWS \
@@ -400,8 +397,7 @@ EXTRA_DIST += \
 	$(WebKit)/po/* \
 	$(WebKit)/resources/* \
 	$(WebKit)/tests/resources/* \
-	$(WebKit)/tests/test_utils.h \
-	$(WebKit)/org.webkitgtk.gschema.xml.in
+	$(WebKit)/tests/test_utils.h
 
 # extra resource files
 resourcesdir = ${datadir}/webkitgtk-@WEBKITGTK_API_VERSION@/resources
diff --git a/Source/WebKit/gtk/WebCoreSupport/AcceleratedCompositingContext.h b/Source/WebKit/gtk/WebCoreSupport/AcceleratedCompositingContext.h
index 42a5f24b6..cad47495d 100644
--- a/Source/WebKit/gtk/WebCoreSupport/AcceleratedCompositingContext.h
+++ b/Source/WebKit/gtk/WebCoreSupport/AcceleratedCompositingContext.h
@@ -28,7 +28,7 @@
 #include <wtf/PassOwnPtr.h>
 
 #if USE(TEXTURE_MAPPER_GL)
-#include "TextureMapperNode.h"
+#include "TextureMapperLayer.h"
 #include "WindowGLContext.h"
 #endif
 
@@ -48,7 +48,7 @@ public:
     void attachRootGraphicsLayer(WebCore::GraphicsLayer*);
     void scheduleRootLayerRepaint(const WebCore::IntRect&);
     void markForSync();
-    void syncLayersTimeout(WebCore::Timer<AcceleratedCompositingContext>*);
+    void syncLayersTimeout();
     void syncLayersNow();
     void resizeRootLayer(const WebCore::IntSize&);
     bool renderLayersToWindow(const WebCore::IntRect& clipRect);
@@ -64,7 +64,7 @@ public:
 private:
     WebKitWebView* m_webView;
     OwnPtr<WebCore::GraphicsLayer> m_rootGraphicsLayer;
-    WebCore::Timer<AcceleratedCompositingContext> m_syncTimer;
+    unsigned int m_syncTimerCallbackId;
 
 #if USE(CLUTTER)
     GtkWidget* m_rootLayerEmbedder;
@@ -72,7 +72,7 @@ private:
     void initializeIfNecessary();
 
     bool m_initialized;
-    WebCore::TextureMapperNode* m_rootTextureMapperNode;
+    WebCore::TextureMapperLayer* m_rootTextureMapperLayer;
     OwnPtr<WebCore::WindowGLContext> m_context;
     OwnPtr<WebCore::TextureMapper> m_textureMapper;
 #endif
diff --git a/Source/WebKit/gtk/WebCoreSupport/AcceleratedCompositingContextClutter.cpp b/Source/WebKit/gtk/WebCoreSupport/AcceleratedCompositingContextClutter.cpp
index b52b409e5..2e95fc56e 100644
--- a/Source/WebKit/gtk/WebCoreSupport/AcceleratedCompositingContextClutter.cpp
+++ b/Source/WebKit/gtk/WebCoreSupport/AcceleratedCompositingContextClutter.cpp
@@ -36,13 +36,15 @@ namespace WebKit {
 AcceleratedCompositingContext::AcceleratedCompositingContext(WebKitWebView* webView)
     : m_webView(webView)
     , m_rootGraphicsLayer(0)
-    , m_syncTimer(this, &AcceleratedCompositingContext::syncLayersTimeout)
+    , m_syncTimerCallbackId(0)
     , m_rootLayerEmbedder(0)
 {
 }
 
 AcceleratedCompositingContext::~AcceleratedCompositingContext()
 {
+    if (m_syncTimerCallbackId)
+        g_source_remove(m_syncTimerCallbackId);
 }
 
 bool AcceleratedCompositingContext::enabled()
@@ -109,14 +111,23 @@ void AcceleratedCompositingContext::resizeRootLayer(const IntSize& size)
     gtk_widget_size_allocate(GTK_WIDGET(m_webView->priv->rootLayerEmbedder), &allocation);
 }
 
+static gboolean syncLayersTimeoutCallback(AcceleratedCompositingContext* context)
+{
+    context->syncLayersTimeout();
+    return FALSE;
+}
+
 void AcceleratedCompositingContext::markForSync()
 {
-    if (m_syncTimer.isActive())
+    if (m_syncTimerCallbackId)
         return;
-    m_syncTimer.startOneShot(0);
+
+    // We use a GLib timer because otherwise GTK+ event handling during
+    // dragging can starve WebCore timers, which have a lower priority.
+    m_syncTimerCallbackId = g_timeout_add_full(GDK_PRIORITY_EVENTS, 0, reinterpret_cast<GSourceFunc>(syncLayersTimeoutCallback), this, 0);
 }
 
-void AcceleratedCompositingContext::syncLayersTimeout(Timer<AcceleratedCompositingContext>*)
+void AcceleratedCompositingContext::syncLayersTimeout()
 {
     core(m_webView)->mainFrame()->view()->syncCompositingStateIncludingSubframes();
 }
diff --git a/Source/WebKit/gtk/WebCoreSupport/AcceleratedCompositingContextGL.cpp b/Source/WebKit/gtk/WebCoreSupport/AcceleratedCompositingContextGL.cpp
index 9bfa3d0fe..8c4300f27 100644
--- a/Source/WebKit/gtk/WebCoreSupport/AcceleratedCompositingContextGL.cpp
+++ b/Source/WebKit/gtk/WebCoreSupport/AcceleratedCompositingContextGL.cpp
@@ -28,7 +28,7 @@
 #include "FrameView.h"
 #include "PlatformContextCairo.h"
 #include "TextureMapperGL.h"
-#include "TextureMapperNode.h"
+#include "TextureMapperLayer.h"
 #include "webkitwebviewprivate.h"
 #include <GL/gl.h>
 #include <cairo.h>
@@ -41,15 +41,16 @@ namespace WebKit {
 
 AcceleratedCompositingContext::AcceleratedCompositingContext(WebKitWebView* webView)
     : m_webView(webView)
-    , m_syncTimer(this, &AcceleratedCompositingContext::syncLayersTimeout)
+    , m_syncTimerCallbackId(0)
     , m_initialized(false)
-    , m_rootTextureMapperNode(0)
+    , m_rootTextureMapperLayer(0)
 {
 }
 
 AcceleratedCompositingContext::~AcceleratedCompositingContext()
 {
-
+    if (m_syncTimerCallbackId)
+        g_source_remove(m_syncTimerCallbackId);
 }
 
 void AcceleratedCompositingContext::initializeIfNecessary()
@@ -69,7 +70,7 @@ void AcceleratedCompositingContext::initializeIfNecessary()
 
 bool AcceleratedCompositingContext::enabled()
 {
-    return m_rootTextureMapperNode && m_textureMapper;
+    return m_rootTextureMapperLayer && m_textureMapper;
 }
 
 
@@ -90,7 +91,7 @@ bool AcceleratedCompositingContext::renderLayersToWindow(const IntRect& clipRect
     glViewport(0, 0, allocation.width, allocation.height);
 
     m_textureMapper->beginPainting();
-    m_rootTextureMapperNode->paint();
+    m_rootTextureMapperLayer->paint();
     m_textureMapper->endPainting();
 
     m_context->finishDrawing();
@@ -101,12 +102,12 @@ void AcceleratedCompositingContext::attachRootGraphicsLayer(GraphicsLayer* graph
 {
     if (!graphicsLayer) {
         m_rootGraphicsLayer.clear();
-        m_rootTextureMapperNode = 0;
+        m_rootTextureMapperLayer = 0;
         return;
     }
 
     m_rootGraphicsLayer = GraphicsLayer::create(this);
-    m_rootTextureMapperNode = toTextureMapperNode(m_rootGraphicsLayer.get());
+    m_rootTextureMapperLayer = toTextureMapperLayer(m_rootGraphicsLayer.get());
     m_rootGraphicsLayer->addChild(graphicsLayer);
     m_rootGraphicsLayer->setDrawsContent(true);
     m_rootGraphicsLayer->setMasksToBounds(false);
@@ -127,7 +128,7 @@ void AcceleratedCompositingContext::attachRootGraphicsLayer(GraphicsLayer* graph
     glViewport(0, 0, allocation.width, allocation.height);
 
     m_textureMapper = TextureMapperGL::create();
-    m_rootTextureMapperNode->setTextureMapper(m_textureMapper.get());
+    m_rootTextureMapperLayer->setTextureMapper(m_textureMapper.get());
     m_rootGraphicsLayer->syncCompositingStateForThisLayerOnly();
 }
 
@@ -150,11 +151,20 @@ void AcceleratedCompositingContext::resizeRootLayer(const IntSize& size)
     m_rootGraphicsLayer->setNeedsDisplay();
 }
 
+static gboolean syncLayersTimeoutCallback(AcceleratedCompositingContext* context)
+{
+    context->syncLayersTimeout();
+    return FALSE;
+}
+
 void AcceleratedCompositingContext::markForSync()
 {
-    if (m_syncTimer.isActive())
+    if (m_syncTimerCallbackId)
         return;
-    m_syncTimer.startOneShot(0);
+
+    // We use a GLib timer because otherwise GTK+ event handling during
+    // dragging can starve WebCore timers, which have a lower priority.
+    m_syncTimerCallbackId = g_timeout_add_full(GDK_PRIORITY_EVENTS, 0, reinterpret_cast<GSourceFunc>(syncLayersTimeoutCallback), this, 0);
 }
 
 void AcceleratedCompositingContext::syncLayersNow()
@@ -165,16 +175,17 @@ void AcceleratedCompositingContext::syncLayersNow()
     core(m_webView)->mainFrame()->view()->syncCompositingStateIncludingSubframes();
 }
 
-void AcceleratedCompositingContext::syncLayersTimeout(Timer<AcceleratedCompositingContext>*)
+void AcceleratedCompositingContext::syncLayersTimeout()
 {
+    m_syncTimerCallbackId = 0;
     syncLayersNow();
     if (!m_rootGraphicsLayer)
         return;
 
     renderLayersToWindow(IntRect());
 
-    if (toTextureMapperNode(m_rootGraphicsLayer.get())->descendantsOrSelfHaveRunningAnimations())
-        m_syncTimer.startOneShot(1.0 / 60.0);
+    if (toTextureMapperLayer(m_rootGraphicsLayer.get())->descendantsOrSelfHaveRunningAnimations())
+        m_syncTimerCallbackId = g_timeout_add_full(GDK_PRIORITY_EVENTS, 1000.0 / 60.0, reinterpret_cast<GSourceFunc>(syncLayersTimeoutCallback), this, 0);
 }
 
 void AcceleratedCompositingContext::notifyAnimationStarted(const WebCore::GraphicsLayer*, double time)
diff --git a/Source/WebKit/gtk/WebCoreSupport/ChromeClientGtk.cpp b/Source/WebKit/gtk/WebCoreSupport/ChromeClientGtk.cpp
index 955c166a9..d282f290a 100644
--- a/Source/WebKit/gtk/WebCoreSupport/ChromeClientGtk.cpp
+++ b/Source/WebKit/gtk/WebCoreSupport/ChromeClientGtk.cpp
@@ -51,6 +51,8 @@
 #include "RefPtrCairo.h"
 #include "SearchPopupMenuGtk.h"
 #include "SecurityOrigin.h"
+#include "WebKitDOMBinding.h"
+#include "WebKitDOMHTMLElementPrivate.h"
 #include "WindowFeatures.h"
 #include "webkitgeolocationpolicydecision.h"
 #include "webkitgeolocationpolicydecisionprivate.h"
@@ -61,6 +63,8 @@
 #include "webkitwebview.h"
 #include "webkitwebviewprivate.h"
 #include "webkitwebwindowfeaturesprivate.h"
+#include <gdk/gdk.h>
+#include <gdk/gdkkeysyms.h>
 #include <glib.h>
 #include <glib/gi18n-lib.h>
 #include <gtk/gtk.h>
@@ -807,15 +811,14 @@ void ChromeClient::runOpenPanel(Frame*, PassRefPtr<FileChooser> prpFileChooser)
 
     if (gtk_dialog_run(GTK_DIALOG(dialog)) == GTK_RESPONSE_ACCEPT) {
         if (gtk_file_chooser_get_select_multiple(GTK_FILE_CHOOSER(dialog))) {
-            GSList* filenames = gtk_file_chooser_get_filenames(GTK_FILE_CHOOSER(dialog));
+            GOwnPtr<GSList> filenames(gtk_file_chooser_get_filenames(GTK_FILE_CHOOSER(dialog)));
             Vector<String> names;
-            for (GSList* item = filenames ; item ; item = item->next) {
+            for (GSList* item = filenames.get() ; item ; item = item->next) {
                 if (!item->data)
                     continue;
                 names.append(filenameToString(static_cast<char*>(item->data)));
                 g_free(item->data);
             }
-            g_slist_free(filenames);
             chooser->chooseFiles(names);
         } else {
             gchar* filename = gtk_file_chooser_get_filename(GTK_FILE_CHOOSER(dialog));
@@ -922,29 +925,69 @@ void ChromeClient::exitFullscreenForNode(Node* node)
 #if ENABLE(FULLSCREEN_API)
 bool ChromeClient::supportsFullScreenForElement(const WebCore::Element* element, bool withKeyboard)
 {
-    return true;
+    return !withKeyboard;
+}
+
+static gboolean onFullscreenGtkKeyPressEvent(GtkWidget* widget, GdkEventKey* event, ChromeClient* chromeClient)
+{
+    switch (event->keyval) {
+    case GDK_KEY_Escape:
+    case GDK_KEY_f:
+    case GDK_KEY_F:
+        chromeClient->cancelFullScreen();
+        return TRUE;
+    default:
+        break;
+    }
+
+    return FALSE;
+}
+
+void ChromeClient::cancelFullScreen()
+{
+    ASSERT(m_fullScreenElement);
+    m_fullScreenElement->document()->webkitCancelFullScreen();
 }
 
 void ChromeClient::enterFullScreenForElement(WebCore::Element* element)
 {
+    gboolean returnValue;
+    GRefPtr<WebKitDOMHTMLElement> kitElement(adoptGRef(kit(reinterpret_cast<HTMLElement*>(element))));
+    g_signal_emit_by_name(m_webView, "entering-fullscreen", kitElement.get(), &returnValue);
+    if (returnValue)
+        return;
+
+    GtkWidget* window = gtk_widget_get_toplevel(GTK_WIDGET(m_webView));
+    if (!widgetIsOnscreenToplevelWindow(window))
+        return;
+
+    g_signal_connect(window, "key-press-event", G_CALLBACK(onFullscreenGtkKeyPressEvent), this);
+
+    m_fullScreenElement = element;
+
     element->document()->webkitWillEnterFullScreenForElement(element);
     m_adjustmentWatcher.disableAllScrollbars();
-#if ENABLE(VIDEO)
-    if (element->tagName() == "VIDEO")
-        enterFullscreenForNode(static_cast<Node*>(element));
-#endif
+    gtk_window_fullscreen(GTK_WINDOW(window));
     element->document()->webkitDidEnterFullScreenForElement(element);
 }
 
 void ChromeClient::exitFullScreenForElement(WebCore::Element* element)
 {
+    gboolean returnValue;
+    GRefPtr<WebKitDOMHTMLElement> kitElement(adoptGRef(kit(reinterpret_cast<HTMLElement*>(element))));
+    g_signal_emit_by_name(m_webView, "leaving-fullscreen", kitElement.get(), &returnValue);
+    if (returnValue)
+        return;
+
+    GtkWidget* window = gtk_widget_get_toplevel(GTK_WIDGET(m_webView));
+    ASSERT(widgetIsOnscreenToplevelWindow(window));
+    g_signal_handlers_disconnect_by_func(window, reinterpret_cast<void*>(onFullscreenGtkKeyPressEvent), this);
+
     element->document()->webkitWillExitFullScreenForElement(element);
+    gtk_window_unfullscreen(GTK_WINDOW(window));
     m_adjustmentWatcher.enableAllScrollbars();
-#if ENABLE(VIDEO)
-    if (element->tagName() == "VIDEO")
-        webViewExitFullscreen(m_webView);
-#endif
     element->document()->webkitDidExitFullScreenForElement(element);
+    m_fullScreenElement.clear();
 }
 #endif
 
diff --git a/Source/WebKit/gtk/WebCoreSupport/ChromeClientGtk.h b/Source/WebKit/gtk/WebCoreSupport/ChromeClientGtk.h
index 8c7c89233..5905f5679 100644
--- a/Source/WebKit/gtk/WebCoreSupport/ChromeClientGtk.h
+++ b/Source/WebKit/gtk/WebCoreSupport/ChromeClientGtk.h
@@ -155,10 +155,12 @@ namespace WebKit {
         virtual bool supportsFullScreenForElement(const Element*, bool withKeyboard);
         virtual void enterFullScreenForElement(Element*);
         virtual void exitFullScreenForElement(Element*);
+        void cancelFullScreen();
 #endif
 
         virtual bool shouldRubberBandInDirection(ScrollDirection) const { return true; }
         virtual void numWheelEventHandlersChanged(unsigned) { }
+        virtual void numTouchEventHandlersChanged(unsigned) { }
 
 #if USE(ACCELERATED_COMPOSITING) 
         virtual void attachRootGraphicsLayer(Frame*, GraphicsLayer*);
@@ -185,6 +187,9 @@ namespace WebKit {
         unsigned int m_repaintSoonSourceId;
 
         void invalidateWidgetRect(const IntRect&);
+#if ENABLE(FULLSCREEN_API)
+        RefPtr<Element> m_fullScreenElement;
+#endif
     };
 }
 
diff --git a/Source/WebKit/gtk/WebCoreSupport/DumpRenderTreeSupportGtk.cpp b/Source/WebKit/gtk/WebCoreSupport/DumpRenderTreeSupportGtk.cpp
index c59e1f792..8e6e26b14 100644
--- a/Source/WebKit/gtk/WebCoreSupport/DumpRenderTreeSupportGtk.cpp
+++ b/Source/WebKit/gtk/WebCoreSupport/DumpRenderTreeSupportGtk.cpp
@@ -61,6 +61,7 @@
 #include "TextIterator.h"
 #include "WebKitAccessibleWrapperAtk.h"
 #include "WebKitDOMRangePrivate.h"
+#include "WebKitMutationObserver.h"
 #include "WorkerThread.h"
 #include "webkitglobalsprivate.h"
 #include "webkitwebframe.h"
@@ -69,11 +70,6 @@
 #include "webkitwebviewprivate.h"
 #include <JavaScriptCore/APICast.h>
 
-#if ENABLE(SVG)
-#include "SVGDocumentExtensions.h"
-#include "SVGSMILElement.h"
-#endif
-
 using namespace JSC;
 using namespace WebCore;
 using namespace WebKit;
@@ -395,22 +391,6 @@ bool DumpRenderTreeSupportGtk::pauseTransition(WebKitWebFrame* frame, const char
     return core(frame)->animation()->pauseTransitionAtTime(coreElement->renderer(), AtomicString(name), time);
 }
 
-bool DumpRenderTreeSupportGtk::pauseSVGAnimation(WebKitWebFrame* frame, const char* animationId, double time, const char* elementId)
-{
-    ASSERT(core(frame));
-#if ENABLE(SVG)
-    Document* document = core(frame)->document();
-    if (!document || !document->svgExtensions())
-        return false;
-    Element* coreElement = document->getElementById(AtomicString(animationId));
-    if (!coreElement || !SVGSMILElement::isSMILElement(coreElement))
-        return false;
-    return document->accessSVGExtensions()->sampleAnimationAtTime(elementId, static_cast<SVGSMILElement*>(coreElement), time);
-#else
-    return false;
-#endif
-}
-
 CString DumpRenderTreeSupportGtk::markerTextForListItem(WebKitWebFrame* frame, JSContextRef context, JSValueRef nodeObject)
 {
     JSC::ExecState* exec = toJS(context);
@@ -913,3 +893,33 @@ void DumpRenderTreeSupportGtk::setHixie76WebSocketProtocolEnabled(WebKitWebView*
     UNUSED_PARAM(enabled);
 #endif
 }
+
+bool DumpRenderTreeSupportGtk::elementDoesAutoCompleteForElementWithId(WebKitWebFrame* frame, JSStringRef id)
+{
+    Frame* coreFrame = core(frame);
+    if (!coreFrame)
+        return false;
+
+    Document* document = coreFrame->document();
+    ASSERT(document);
+
+    size_t bufferSize = JSStringGetMaximumUTF8CStringSize(id);
+    GOwnPtr<gchar> idBuffer(static_cast<gchar*>(g_malloc(bufferSize)));
+    JSStringGetUTF8CString(id, idBuffer.get(), bufferSize);
+    Node* coreNode = document->getElementById(String::fromUTF8(idBuffer.get()));
+    if (!coreNode || !coreNode->renderer())
+        return false;
+
+    HTMLInputElement* inputElement = static_cast<HTMLInputElement*>(coreNode);
+    if (!inputElement)
+        return false;
+
+    return inputElement->isTextField() && !inputElement->isPasswordField() && inputElement->shouldAutocomplete();
+}
+
+void DumpRenderTreeSupportGtk::deliverAllMutationsIfNecessary()
+{
+#if ENABLE(MUTATION_OBSERVERS)
+    WebKitMutationObserver::deliverAllMutations();
+#endif
+}
diff --git a/Source/WebKit/gtk/WebCoreSupport/DumpRenderTreeSupportGtk.h b/Source/WebKit/gtk/WebCoreSupport/DumpRenderTreeSupportGtk.h
index 06d30070a..02b80c476 100644
--- a/Source/WebKit/gtk/WebCoreSupport/DumpRenderTreeSupportGtk.h
+++ b/Source/WebKit/gtk/WebCoreSupport/DumpRenderTreeSupportGtk.h
@@ -75,7 +75,6 @@ public:
     static guint getPendingUnloadEventCount(WebKitWebFrame*);
     static bool pauseAnimation(WebKitWebFrame*, const char* name, double time, const char* element);
     static bool pauseTransition(WebKitWebFrame*, const char* name, double time, const char* element);
-    static bool pauseSVGAnimation(WebKitWebFrame*, const char* animationId, double time, const char* elementId);
     static WTF::CString markerTextForListItem(WebKitWebFrame*, JSContextRef, JSValueRef nodeObject);
     static unsigned int numberOfActiveAnimations(WebKitWebFrame*);
     static void suspendAnimations(WebKitWebFrame*);
@@ -87,6 +86,7 @@ public:
     static void setAutofilled(JSContextRef, JSValueRef, bool);
     static void setValueForUser(JSContextRef, JSValueRef, JSStringRef);
     static bool shouldClose(WebKitWebFrame*);
+    static bool elementDoesAutoCompleteForElementWithId(WebKitWebFrame*, JSStringRef);
 
     // WebKitWebView
     static void executeCoreCommandByName(WebKitWebView*, const gchar* name, const gchar* value);
@@ -129,6 +129,8 @@ public:
 
     static void setHixie76WebSocketProtocolEnabled(WebKitWebView*, bool enabled);
 
+    static void deliverAllMutationsIfNecessary();
+
 private:
     static bool s_drtRun;
     static bool s_linksIncludedInTabChain;
diff --git a/Source/WebKit/gtk/WebCoreSupport/EditorClientGtk.cpp b/Source/WebKit/gtk/WebCoreSupport/EditorClientGtk.cpp
index 913b0df8e..b8e160e28 100644
--- a/Source/WebKit/gtk/WebCoreSupport/EditorClientGtk.cpp
+++ b/Source/WebKit/gtk/WebCoreSupport/EditorClientGtk.cpp
@@ -235,10 +235,10 @@ bool EditorClient::shouldChangeSelectedRange(Range* fromRange, Range* toRange, E
     return accept;
 }
 
-bool EditorClient::shouldApplyStyle(WebCore::CSSStyleDeclaration* declaration, WebCore::Range* range)
+bool EditorClient::shouldApplyStyle(WebCore::StylePropertySet* set, WebCore::Range* range)
 {
     gboolean accept = TRUE;
-    GRefPtr<WebKitDOMCSSStyleDeclaration> kitDeclaration(kit(declaration));
+    GRefPtr<WebKitDOMCSSStyleDeclaration> kitDeclaration(kit(set->ensureCSSStyleDeclaration()));
     GRefPtr<WebKitDOMRange> kitRange(adoptGRef(kit(range)));
     g_signal_emit_by_name(m_webView, "should-apply-style", kitDeclaration.get(), kitRange.get(), &accept);
     return accept;
diff --git a/Source/WebKit/gtk/WebCoreSupport/EditorClientGtk.h b/Source/WebKit/gtk/WebCoreSupport/EditorClientGtk.h
index 2533c1644..ef159c646 100644
--- a/Source/WebKit/gtk/WebCoreSupport/EditorClientGtk.h
+++ b/Source/WebKit/gtk/WebCoreSupport/EditorClientGtk.h
@@ -94,7 +94,7 @@ class EditorClient : public WebCore::EditorClient {
         virtual bool shouldInsertText(const WTF::String&, WebCore::Range*, WebCore::EditorInsertAction);
         virtual bool shouldChangeSelectedRange(WebCore::Range* fromRange, WebCore::Range* toRange, WebCore::EAffinity, bool stillSelecting);
 
-        virtual bool shouldApplyStyle(WebCore::CSSStyleDeclaration*, WebCore::Range*);
+        virtual bool shouldApplyStyle(WebCore::StylePropertySet*, WebCore::Range*);
 
         virtual bool shouldMoveRangeAfterDelete(WebCore::Range*, WebCore::Range*);
 
diff --git a/Source/WebKit/gtk/WebCoreSupport/FrameLoaderClientGtk.cpp b/Source/WebKit/gtk/WebCoreSupport/FrameLoaderClientGtk.cpp
index 60b00e893..42a494583 100644
--- a/Source/WebKit/gtk/WebCoreSupport/FrameLoaderClientGtk.cpp
+++ b/Source/WebKit/gtk/WebCoreSupport/FrameLoaderClientGtk.cpp
@@ -33,6 +33,7 @@
 #include "DocumentLoader.h"
 #include "DocumentLoaderGtk.h"
 #include "ErrorsGtk.h"
+#include "FileSystem.h"
 #include "FormState.h"
 #include "FrameLoader.h"
 #include "FrameNetworkingContextGtk.h"
@@ -482,8 +483,10 @@ PassRefPtr<Widget> FrameLoaderClient::createPlugin(const IntSize& pluginSize, HT
     GtkWidget* gtkWidget = 0;
     g_signal_emit_by_name(getViewFromFrame(m_frame), "create-plugin-widget",
                           mimeTypeString.data(), urlString.data(), hash.get(), &gtkWidget);
-    if (gtkWidget)
+    if (gtkWidget) {
+        gtk_container_add(GTK_CONTAINER(getViewFromFrame(m_frame)), gtkWidget);
         return adoptRef(new GtkPluginWidget(gtkWidget));
+    }
 
     RefPtr<PluginView> pluginView = PluginView::create(core(m_frame), pluginSize, element, url, paramNames, paramValues, mimeType, loadManually);
 
@@ -1103,7 +1106,9 @@ void FrameLoaderClient::dispatchDidFailLoad(const ResourceError& error)
 
     String content;
     gchar* fileContent = 0;
-    gchar* errorURI = g_filename_to_uri(DATA_DIR"/webkit-1.0/resources/error.html", NULL, NULL);
+    GOwnPtr<gchar> errorPath(g_build_filename(sharedResourcesPath().data(), "resources", "error.html", NULL));
+    gchar* errorURI = g_filename_to_uri(errorPath.get(), 0, 0);
+
     GFile* errorFile = g_file_new_for_uri(errorURI);
     g_free(errorURI);
 
diff --git a/Source/WebKit/gtk/WebCoreSupport/FrameNetworkingContextGtk.cpp b/Source/WebKit/gtk/WebCoreSupport/FrameNetworkingContextGtk.cpp
new file mode 100644
index 000000000..4b9d12491
--- /dev/null
+++ b/Source/WebKit/gtk/WebCoreSupport/FrameNetworkingContextGtk.cpp
@@ -0,0 +1,35 @@
+/*
+    Copyright (C) 2010 Nokia Corporation and/or its subsidiary(-ies)
+    Copyright (C) 2012 ProFUSION embedded systems
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#include "config.h"
+#include "FrameNetworkingContextGtk.h"
+
+#include "ResourceHandle.h"
+
+using namespace WebCore;
+
+namespace WebKit {
+
+SoupSession* FrameNetworkingContextGtk::soupSession() const
+{
+    return ResourceHandle::defaultSession();
+}
+
+}
diff --git a/Source/WebKit/gtk/WebCoreSupport/FrameNetworkingContextGtk.h b/Source/WebKit/gtk/WebCoreSupport/FrameNetworkingContextGtk.h
index 8e4c2148d..a59a94099 100644
--- a/Source/WebKit/gtk/WebCoreSupport/FrameNetworkingContextGtk.h
+++ b/Source/WebKit/gtk/WebCoreSupport/FrameNetworkingContextGtk.h
@@ -32,6 +32,7 @@ public:
     }
 
     WebCore::Frame* coreFrame() const { return frame(); }
+    virtual SoupSession* soupSession() const;
 
 private:
     FrameNetworkingContextGtk(WebCore::Frame* frame)
diff --git a/Source/WebKit/gtk/WebCoreSupport/GeolocationClientGtk.cpp b/Source/WebKit/gtk/WebCoreSupport/GeolocationClientGtk.cpp
index fac1d73af..06e9fbd3f 100644
--- a/Source/WebKit/gtk/WebCoreSupport/GeolocationClientGtk.cpp
+++ b/Source/WebKit/gtk/WebCoreSupport/GeolocationClientGtk.cpp
@@ -24,6 +24,7 @@
 #if ENABLE(CLIENT_BASED_GEOLOCATION)
 
 #include "Chrome.h"
+#include "ChromeClient.h"
 #include "Geolocation.h"
 #include "GeolocationController.h"
 #include "GeolocationError.h"
@@ -137,12 +138,12 @@ WebCore::GeolocationPosition* GeolocationClient::lastPosition()
 
 void GeolocationClient::requestPermission(WebCore::Geolocation* geolocation)
 {
-    core(m_webView)->chrome()->requestGeolocationPermissionForFrame(geolocation->frame(), geolocation);
+    core(m_webView)->chrome()->client()->requestGeolocationPermissionForFrame(geolocation->frame(), geolocation);
 }
 
 void GeolocationClient::cancelPermissionRequest(WebCore::Geolocation* geolocation)
 {
-    core(m_webView)->chrome()->cancelGeolocationPermissionRequestForFrame(geolocation->frame(), geolocation);
+    core(m_webView)->chrome()->client()->cancelGeolocationPermissionRequestForFrame(geolocation->frame(), geolocation);
 }
 
 void GeolocationClient::positionChanged(GeocluePosition*, GeocluePositionFields fields, int timestamp, double latitude, double longitude, double altitude, GeoclueAccuracy* accuracy)
diff --git a/Source/WebKit/gtk/WebCoreSupport/InspectorClientGtk.cpp b/Source/WebKit/gtk/WebCoreSupport/InspectorClientGtk.cpp
index d4d321d93..c1dd9b911 100644
--- a/Source/WebKit/gtk/WebCoreSupport/InspectorClientGtk.cpp
+++ b/Source/WebKit/gtk/WebCoreSupport/InspectorClientGtk.cpp
@@ -20,6 +20,7 @@
 #include "config.h"
 #include "InspectorClientGtk.h"
 
+#include "FileSystem.h"
 #include "Frame.h"
 #include "InspectorController.h"
 #include "NotImplemented.h"
@@ -48,55 +49,16 @@ public:
     virtual ~InspectorFrontendSettingsGtk() { }
 
 private:
-#ifdef HAVE_GSETTINGS
-    static bool shouldIgnoreSetting(const String& key)
-    {
-        // GSettings considers trying to fetch or set a setting that is
-        // not backed by a schema as programmer error, and aborts the
-        // program's execution. We check here to avoid having an unhandled
-        // setting as a fatal error.
-        LOG_VERBOSE(NotYetImplemented, "Unknown key ignored: %s", key.ascii().data());
-        return true;
-    }
-
     virtual String getProperty(const String& name)
     {
-        if (shouldIgnoreSetting(name))
-            return String();
-
-        GSettings* settings = inspectorGSettings();
-        if (!settings)
-            return String();
-
-        GRefPtr<GVariant> variant = adoptGRef(g_settings_get_value(settings, name.utf8().data()));
-        return String(g_variant_get_string(variant.get(), 0));
-    }
-
-    virtual void setProperty(const String& name, const String& value)
-    {
-        // Avoid setting unknown keys to avoid aborting the execution.
-        if (shouldIgnoreSetting(name))
-            return;
-
-        GSettings* settings = inspectorGSettings();
-        if (!settings)
-            return;
-
-        GRefPtr<GVariant> variant = adoptGRef(g_variant_new_string(value.utf8().data()));
-        g_settings_set_value(settings, name.utf8().data(), variant.get());
-    }
-#else
-    virtual String getProperty(const String&)
-    {
         notImplemented();
         return String();
     }
 
-    virtual void setProperty(const String&, const String&)
+    virtual void setProperty(const String& name, const String& value)
     {
         notImplemented();
     }
-#endif // HAVE_GSETTINGS
 };
 
 } // namespace
@@ -202,7 +164,7 @@ const char* InspectorClient::inspectorFilesPath()
     if (environmentPath && g_file_test(environmentPath, G_FILE_TEST_IS_DIR))
         m_inspectorFilesPath.set(g_strdup(environmentPath));
     else
-        m_inspectorFilesPath.set(g_build_filename(DATA_DIR, "webkitgtk-"WEBKITGTK_API_VERSION_STRING, "webinspector", NULL));
+        m_inspectorFilesPath.set(g_build_filename(sharedResourcesPath().data(), "webinspector", NULL));
 
     return m_inspectorFilesPath.get();
 }
diff --git a/Source/WebKit/gtk/WebCoreSupport/TextCheckerClientGtk.h b/Source/WebKit/gtk/WebCoreSupport/TextCheckerClientGtk.h
index e5390bcc9..b3fa04994 100644
--- a/Source/WebKit/gtk/WebCoreSupport/TextCheckerClientGtk.h
+++ b/Source/WebKit/gtk/WebCoreSupport/TextCheckerClientGtk.h
@@ -48,7 +48,7 @@ class TextCheckerClientGtk : public WebCore::TextCheckerClient {
         virtual WTF::String getAutoCorrectSuggestionForMisspelledWord(const WTF::String&);
         virtual void checkGrammarOfString(const UChar*, int length, WTF::Vector<WebCore::GrammarDetail>&, int* badGrammarLocation, int* badGrammarLength);
         virtual void getGuessesForWord(const WTF::String& word, const WTF::String& context, WTF::Vector<WTF::String>& guesses);
-        virtual void requestCheckingOfString(WebCore::SpellChecker*, int, WebCore::TextCheckingTypeMask, const WTF::String&) {}
+        virtual void requestCheckingOfString(WebCore::SpellChecker*, const WebCore::TextCheckingRequest&) { }
 
         void updateSpellCheckingLanguage(const char*);
     private:
diff --git a/Source/WebKit/gtk/org.webkitgtk.gschema.xml.in b/Source/WebKit/gtk/org.webkitgtk.gschema.xml.in
deleted file mode 100644
index 17063f4b8..000000000
--- a/Source/WebKit/gtk/org.webkitgtk.gschema.xml.in
+++ /dev/null
@@ -1,32 +0,0 @@
-<schemalist>
-  <schema id="org.webkitgtk-@WEBKITGTK_API_VERSION@" path="/system/webkitgtk/">
-    <child schema="org.webkitgtk-@WEBKITGTK_API_VERSION@.inspector" name="inspector"/>
-  </schema>
-  <schema id="org.webkitgtk-@WEBKITGTK_API_VERSION@.inspector" path="/system/webkitgtk/inspector/">
-    <key name="resource-tracking-enabled" type="b">
-      <default>false</default>
-      <summary>Resource Tracking Enabled</summary>
-      <description>Whether the Resource Tracking panel is always enabled.</description>
-    </key>
-    <key name="xhr-monitor-enabled" type="b">
-      <default>false</default>
-      <summary>XHR Monitor Enabled</summary>
-      <description>Whether the XHR monitor is always enabled.</description>
-    </key>
-    <key name="debugger-enabled" type="b">
-      <default>false</default>
-      <summary>Debugger Enabled</summary>
-      <description>Whether the debugger is always enabled.</description>
-    </key>
-    <key name="profiler-enabled" type="b">
-      <default>false</default>
-      <summary>Profiler Enabled</summary>
-      <description>Whether the profiler is always enabled.</description>
-    </key>
-    <key name="frontend-settings" type="s">
-      <default>''</default>
-      <summary>Misc Inspector Frontend Settings</summary>
-      <description>Miscelaneous Settings managed by the Inspector Frontend</description>
-    </key>
-  </schema>
-</schemalist>
diff --git a/Source/WebKit/gtk/tests/testcopyandpaste.c b/Source/WebKit/gtk/tests/testcopyandpaste.c
index 6d1b48080..7d8dd8f0d 100644
--- a/Source/WebKit/gtk/tests/testcopyandpaste.c
+++ b/Source/WebKit/gtk/tests/testcopyandpaste.c
@@ -111,7 +111,6 @@ static void load_status_cb(WebKitWebView* webView, GParamSpec* spec, gpointer da
 
 gboolean map_event_cb(GtkWidget *widget, GdkEvent* event, gpointer data)
 {
-    gtk_widget_grab_focus(widget);
     CopyAndPasteFixture* fixture = (CopyAndPasteFixture*)data;
     webkit_web_view_load_string(fixture->webView, fixture->info->page,
                                 "text/html", "utf-8", "file://");
@@ -137,6 +136,8 @@ static void test_copy_and_paste(CopyAndPasteFixture* fixture, gconstpointer data
 static CopyAndPasteFixture* currentFixture;
 static JSValueRef runPasteTestCallback(JSContextRef context, JSObjectRef function, JSObjectRef thisObject, size_t argumentCount, const JSValueRef arguments[], JSValueRef* exception)
 {
+    gtk_widget_grab_focus(GTK_WIDGET(currentFixture->webView));
+
     // Simulate a paste keyboard sequence.
     GdkEvent* event = gdk_event_new(GDK_KEY_PRESS);
     event->key.keyval = gdk_unicode_to_keyval('v');
diff --git a/Source/WebKit/gtk/tests/testkeyevents.c b/Source/WebKit/gtk/tests/testkeyevents.c
index cf33d4abe..b55b4bcaf 100644
--- a/Source/WebKit/gtk/tests/testkeyevents.c
+++ b/Source/WebKit/gtk/tests/testkeyevents.c
@@ -118,7 +118,6 @@ static void test_keypress_events_load_status_cb(WebKitWebView* webView, GParamSp
 
 gboolean map_event_cb(GtkWidget *widget, GdkEvent* event, gpointer data)
 {
-    gtk_widget_grab_focus(widget);
     KeyEventFixture* fixture = (KeyEventFixture*)data;
     webkit_web_view_load_string(fixture->webView, fixture->info->page,
                                 "text/html", "utf-8", "file://");
@@ -131,6 +130,7 @@ static void setup_keyevent_test(KeyEventFixture* fixture, gconstpointer data, GC
     g_signal_connect(fixture->window, "map-event",
                      G_CALLBACK(map_event_cb), fixture);
 
+    gtk_widget_grab_focus(GTK_WIDGET(fixture->webView));
     gtk_widget_show(fixture->window);
     gtk_widget_show(GTK_WIDGET(fixture->webView));
     gtk_window_present(GTK_WINDOW(fixture->window));
diff --git a/Source/WebKit/gtk/tests/testwebplugindatabase.c b/Source/WebKit/gtk/tests/testwebplugindatabase.c
index db2529f3a..f5e23d08a 100644
--- a/Source/WebKit/gtk/tests/testwebplugindatabase.c
+++ b/Source/WebKit/gtk/tests/testwebplugindatabase.c
@@ -44,7 +44,7 @@ static void test_webkit_web_plugin_database_get_plugins()
     for (p = pluginList; p; p = p->next) {
         WebKitWebPlugin* plugin = (WebKitWebPlugin*)p->data;
         if (!g_strcmp0(webkit_web_plugin_get_name(plugin), "WebKit Test PlugIn") &&
-            !g_strcmp0(webkit_web_plugin_get_description(plugin), "Simple Netscape plug-in that handles test content for WebKit")) {
+            !g_strcmp0(webkit_web_plugin_get_description(plugin), "Simple Netscape® plug-in that handles test content for WebKit")) {
             found = TRUE;
             enabled = webkit_web_plugin_get_enabled(plugin);
             webkit_web_plugin_set_enabled(plugin, FALSE);
@@ -60,7 +60,7 @@ static void test_webkit_web_plugin_database_get_plugins()
     for (p = pluginList; p; p = p->next) {
         WebKitWebPlugin* plugin = (WebKitWebPlugin*)p->data;
         if (!g_strcmp0(webkit_web_plugin_get_name(plugin), "WebKit Test PlugIn") &&
-            !g_strcmp0(webkit_web_plugin_get_description(plugin), "Simple Netscape plug-in that handles test content for WebKit"))
+            !g_strcmp0(webkit_web_plugin_get_description(plugin), "Simple Netscape® plug-in that handles test content for WebKit"))
             enabled = webkit_web_plugin_get_enabled(plugin);
     }
     webkit_web_plugin_database_plugins_list_free(pluginList);
diff --git a/Source/WebKit/gtk/tests/testwebview.c b/Source/WebKit/gtk/tests/testwebview.c
index 41cf308f6..ab3bd5576 100644
--- a/Source/WebKit/gtk/tests/testwebview.c
+++ b/Source/WebKit/gtk/tests/testwebview.c
@@ -382,6 +382,121 @@ static void test_webkit_web_view_in_offscreen_window_does_not_crash()
     g_main_loop_unref(loop);
 }
 
+static void test_webkit_web_view_does_not_steal_focus()
+{
+    loop = g_main_loop_new(NULL, TRUE);
+
+    GtkWidget *window = gtk_offscreen_window_new();
+    GtkWidget *webView = webkit_web_view_new();
+    GtkWidget *entry = gtk_entry_new();
+    GtkWidget *box = gtk_box_new(GTK_ORIENTATION_HORIZONTAL, 0);
+
+    gtk_container_add(GTK_CONTAINER(box), webView);
+    gtk_container_add(GTK_CONTAINER(box), entry);
+    gtk_container_add(GTK_CONTAINER(window), box);
+    gtk_widget_show_all(window);
+
+    gtk_widget_grab_focus(entry);
+    g_assert(gtk_widget_is_focus(entry));
+
+    g_signal_connect(webView, "notify::load-status", G_CALLBACK(idle_quit_loop_cb), NULL);
+    webkit_web_view_load_html_string(WEBKIT_WEB_VIEW(webView),
+        "<html><body>"
+        "    <input id=\"entry\" type=\"text\"/>"
+        "    <script>"
+        "        document.getElementById(\"entry\").focus();"
+        "    </script>"
+        "</body></html>", "file://");
+
+    g_main_loop_run(loop);
+
+    g_assert(gtk_widget_is_focus(entry));
+
+    gtk_widget_destroy(window);
+    g_main_loop_unref(loop);
+}
+
+static gboolean emitKeyStroke(WebKitWebView* webView)
+{
+    GdkEvent* pressEvent = gdk_event_new(GDK_KEY_PRESS);
+    pressEvent->key.keyval = GDK_KEY_f;
+    GdkWindow* window = gtk_widget_get_window(GTK_WIDGET(webView));
+    pressEvent->key.window = window;
+    g_object_ref(pressEvent->key.window);
+
+    GdkDeviceManager* manager = gdk_display_get_device_manager(gdk_window_get_display(window));
+    gdk_event_set_device(pressEvent, gdk_device_manager_get_client_pointer(manager));
+
+    // When synthesizing an event, an invalid hardware_keycode value
+    // can cause it to be badly processed by Gtk+.
+    GdkKeymapKey* keys;
+    gint n_keys;
+    if (gdk_keymap_get_entries_for_keyval(gdk_keymap_get_default(), GDK_KEY_f, &keys, &n_keys)) {
+        pressEvent->key.hardware_keycode = keys[0].keycode;
+        g_free(keys);
+    }
+
+    GdkEvent* releaseEvent = gdk_event_copy(pressEvent);
+    gtk_main_do_event(pressEvent);
+    gdk_event_free(pressEvent);
+    releaseEvent->key.type = GDK_KEY_RELEASE;
+    gtk_main_do_event(releaseEvent);
+    gdk_event_free(releaseEvent);
+
+    return FALSE;
+}
+
+static gboolean entering_fullscreen_cb(WebKitWebView* webView, GObject* element, gboolean blocked)
+{
+    if (blocked)
+        g_main_loop_quit(loop);
+    else
+        g_timeout_add(200, (GSourceFunc) emitKeyStroke, webView);
+    return blocked;
+}
+
+static gboolean leaving_fullscreen_cb(WebKitWebView* webView, GObject* element, gpointer data)
+{
+    g_main_loop_quit(loop);
+    return FALSE;
+}
+
+static void test_webkit_web_view_fullscreen(gconstpointer blocked)
+{
+    GtkWidget* window;
+    GtkWidget* web_view;
+    WebKitWebSettings *settings;
+
+    window = gtk_window_new(GTK_WINDOW_TOPLEVEL);
+    web_view = webkit_web_view_new();
+
+    settings = webkit_web_view_get_settings(WEBKIT_WEB_VIEW(web_view));
+    g_object_set(settings, "enable-fullscreen", TRUE, NULL);
+    webkit_web_view_set_settings(WEBKIT_WEB_VIEW(web_view), settings);
+
+    gtk_container_add(GTK_CONTAINER(window), web_view);
+
+    gtk_widget_show_all(window);
+
+    loop = g_main_loop_new(NULL, TRUE);
+
+    g_signal_connect(web_view, "entering-fullscreen", G_CALLBACK(entering_fullscreen_cb), (gpointer) blocked);
+    g_signal_connect(web_view, "leaving-fullscreen", G_CALLBACK(leaving_fullscreen_cb), NULL);
+
+    webkit_web_view_load_string(WEBKIT_WEB_VIEW(web_view), "<html><body>"
+                   "<script>"
+                   "var eventName = 'keypress';"
+                   "document.addEventListener(eventName, function () {"
+                   "    document.documentElement.webkitRequestFullScreen();"
+                   "}, false);"
+                   "</script></body></html>", NULL, NULL, NULL);
+
+    g_timeout_add(100, (GSourceFunc) emitKeyStroke, WEBKIT_WEB_VIEW(web_view));
+    g_main_loop_run(loop);
+
+    gtk_widget_destroy(window);
+}
+
 int main(int argc, char** argv)
 {
     SoupServer* server;
@@ -410,6 +525,9 @@ int main(int argc, char** argv)
     g_test_add_func("/webkit/webview/grab_focus", test_webkit_web_view_grab_focus);
     g_test_add_func("/webkit/webview/window-features", test_webkit_web_view_window_features);
     g_test_add_func("/webkit/webview/webview-in-offscreen-window-does-not-crash", test_webkit_web_view_in_offscreen_window_does_not_crash);
+    g_test_add_func("/webkit/webview/webview-does-not-steal-focus", test_webkit_web_view_does_not_steal_focus);
+    g_test_add_data_func("/webkit/webview/fullscreen", GINT_TO_POINTER(FALSE), test_webkit_web_view_fullscreen);
+    g_test_add_data_func("/webkit/webview/fullscreen-blocked", GINT_TO_POINTER(TRUE), test_webkit_web_view_fullscreen);
 
     return g_test_run ();
 }
diff --git a/Source/WebKit/gtk/webkit/webkitglobals.cpp b/Source/WebKit/gtk/webkit/webkitglobals.cpp
index 3967c6376..bc5d72604 100644
--- a/Source/WebKit/gtk/webkit/webkitglobals.cpp
+++ b/Source/WebKit/gtk/webkit/webkitglobals.cpp
@@ -336,12 +336,6 @@ void webkitInit()
     soup_session_add_feature(session, authDialog);
     g_object_unref(authDialog);
 
-    SoupSessionFeature* sniffer = static_cast<SoupSessionFeature*>(g_object_new(SOUP_TYPE_CONTENT_SNIFFER, NULL));
-    soup_session_add_feature(session, sniffer);
-    g_object_unref(sniffer);
-
-    soup_session_add_feature_by_type(session, SOUP_TYPE_CONTENT_DECODER);
-
 #if USE(CLUTTER)
     gtk_clutter_init(0, 0);
 #endif
diff --git a/Source/WebKit/gtk/webkit/webkitwebinspector.cpp b/Source/WebKit/gtk/webkit/webkitwebinspector.cpp
index c93c2bdb2..692079f68 100644
--- a/Source/WebKit/gtk/webkit/webkitwebinspector.cpp
+++ b/Source/WebKit/gtk/webkit/webkitwebinspector.cpp
@@ -577,42 +577,3 @@ void webkit_web_inspector_execute_script(WebKitWebInspector* webInspector, long
     WebKitWebInspectorPrivate* priv = webInspector->priv;
     priv->page->inspectorController()->evaluateForTestInFrontend(callId, script);
 }
-
-#ifdef HAVE_GSETTINGS
-static bool isSchemaAvailable(const char* schemaID)
-{
-    const char* const* availableSchemas = g_settings_list_schemas();
-    char* const* iter = const_cast<char* const*>(availableSchemas);
-
-    while (*iter) {
-        if (g_str_equal(schemaID, *iter))
-            return true;
-        iter++;
-    }
-
-    return false;
-}
-
-GSettings* inspectorGSettings()
-{
-    static GSettings* settings = 0;
-    if (settings)
-        return settings;
-
-    // Unfortunately GSettings will abort the process execution if the schema is not
-    // installed, which is the case for when running tests, or even the introspection dump
-    // at build time, so check if we have the schema before trying to initialize it.
-    const gchar* schemaID = "org.webkitgtk-"WEBKITGTK_API_VERSION_STRING".inspector";
-    if (!isSchemaAvailable(schemaID)) {
-
-        // This warning is very common on the build bots, which hides valid warnings.
-        // Skip printing it if we are running inside DumpRenderTree.
-        if (!DumpRenderTreeSupportGtk::dumpRenderTreeModeEnabled())
-            g_warning("GSettings schema not found - settings will not be used or saved.");
-        return 0;
-    }
-
-    settings = g_settings_new(schemaID);
-    return settings;
-}
-#endif
diff --git a/Source/WebKit/gtk/webkit/webkitwebinspectorprivate.h b/Source/WebKit/gtk/webkit/webkitwebinspectorprivate.h
index 46d57b0b8..64ba09a5d 100644
--- a/Source/WebKit/gtk/webkit/webkitwebinspectorprivate.h
+++ b/Source/WebKit/gtk/webkit/webkitwebinspectorprivate.h
@@ -25,10 +25,6 @@
 
 extern "C" {
 
-#ifdef HAVE_GSETTINGS
-GSettings* inspectorGSettings();
-#endif
-
 void webkit_web_inspector_set_inspector_client(WebKitWebInspector*, WebCore::Page*);
 
 void webkit_web_inspector_set_web_view(WebKitWebInspector*, WebKitWebView*);
diff --git a/Source/WebKit/gtk/webkit/webkitwebsettings.cpp b/Source/WebKit/gtk/webkit/webkitwebsettings.cpp
index d91c3bbf3..bf6ff600d 100644
--- a/Source/WebKit/gtk/webkit/webkitwebsettings.cpp
+++ b/Source/WebKit/gtk/webkit/webkitwebsettings.cpp
@@ -183,7 +183,7 @@ static String chromeUserAgent()
 
     DEFINE_STATIC_LOCAL(const String, uaVersion, (makeString(String::number(WEBKIT_USER_AGENT_MAJOR_VERSION), '.', String::number(WEBKIT_USER_AGENT_MINOR_VERSION), '+')));
     DEFINE_STATIC_LOCAL(const String, staticUA, (makeString("Mozilla/5.0 (", webkitPlatform(), webkitOSVersion(), ") AppleWebKit/", uaVersion) +
-                                                 makeString(" (KHTML, like Gecko) Chromium/15.0.874.120 Chrome/15.0.874.120 Safari/", uaVersion)));
+                                                 makeString(" (KHTML, like Gecko) Chromium/17.0.963.56 Chrome/17.0.963.56 Safari/", uaVersion)));
 
     return staticUA;
 }
diff --git a/Source/WebKit/gtk/webkit/webkitwebview.cpp b/Source/WebKit/gtk/webkit/webkitwebview.cpp
index c22461c74..89b9c228f 100644
--- a/Source/WebKit/gtk/webkit/webkitwebview.cpp
+++ b/Source/WebKit/gtk/webkit/webkitwebview.cpp
@@ -212,6 +212,8 @@ enum {
     RESOURCE_LOAD_FINISHED,
     RESOURCE_CONTENT_LENGTH_RECEIVED,
     RESOURCE_LOAD_FAILED,
+    ENTERING_FULLSCREEN,
+    LEAVING_FULLSCREEN,
 
     LAST_SIGNAL
 };
@@ -639,6 +641,9 @@ static gboolean webkit_web_view_expose_event(GtkWidget* widget, GdkEventExpose*
         copyRectFromCairoSurfaceToContext(WEBKIT_WEB_VIEW(widget)->priv->backingStore->cairoSurface(),
                                           cr.get(), IntSize(), IntRect(rects.get()[i]));
     }
+
+    // Chaining up to the parent forces child widgets to be drawn.
+    GTK_WIDGET_CLASS(webkit_web_view_parent_class)->expose_event(widget, event);
     return FALSE;
 }
 #else
@@ -667,6 +672,8 @@ static gboolean webkit_web_view_draw(GtkWidget* widget, cairo_t* cr)
     }
     cairo_rectangle_list_destroy(rectList);
 
+    // Chaining up to the parent forces child widgets to be drawn.
+    GTK_WIDGET_CLASS(webkit_web_view_parent_class)->draw(widget, cr);
     return FALSE;
 }
 #endif // GTK_API_VERSION_2
@@ -1295,6 +1302,16 @@ static gboolean webkit_web_view_real_should_allow_editing_action(WebKitWebView*)
     return TRUE;
 }
 
+static gboolean webkit_web_view_real_entering_fullscreen(WebKitWebView* webView)
+{
+    return FALSE;
+}
+
+static gboolean webkit_web_view_real_leaving_fullscreen(WebKitWebView* webView)
+{
+    return FALSE;
+}
+
 static void webkit_web_view_dispose(GObject* object)
 {
     WebKitWebView* webView = WEBKIT_WEB_VIEW(object);
@@ -2650,6 +2667,59 @@ static void webkit_web_view_class_init(WebKitWebViewClass* webViewClass)
             G_TYPE_NONE, 1,
             WEBKIT_TYPE_VIEWPORT_ATTRIBUTES);
 
+    /**
+     * WebKitWebView::entering-fullscreen:
+     * @web_view: the #WebKitWebView on which the signal is emitted.
+     * @element: the #WebKitDOMHTMLElement which has requested full screen display.
+     *
+     * Emitted when JavaScript code calls
+     * <function>element.webkitRequestFullScreen</function>. If the
+     * signal is not handled the WebView will proceed to full screen
+     * its top level window. This signal can be used by client code to
+     * request permission to the user prior doing the full screen
+     * transition and eventually prepare the top-level window
+     * (e.g. hide some widgets that would otherwise be part of the
+     * full screen window).
+     *
+     * Returns: %TRUE to stop other handlers from being invoked for the event.
+     *    %FALSE to continue emission of the event.
+     *
+     * Since: 1.9.0
+     */
+    webkit_web_view_signals[ENTERING_FULLSCREEN] =
+            g_signal_new("entering-fullscreen",
+                         G_TYPE_FROM_CLASS(webViewClass),
+                         G_SIGNAL_RUN_LAST,
+                         G_STRUCT_OFFSET(WebKitWebViewClass, entering_fullscreen),
+                         g_signal_accumulator_true_handled, 0,
+                         webkit_marshal_BOOLEAN__OBJECT,
+                         G_TYPE_BOOLEAN, 1, WEBKIT_TYPE_DOM_HTML_ELEMENT);
+
+
+    /**
+     * WebKitWebView::leaving-fullscreen:
+     * @web_view: the #WebKitWebView on which the signal is emitted.
+     * @element: the #WebKitDOMHTMLElement which is currently displayed full screen.
+     *
+     * Emitted when the WebView is about to restore its top level
+     * window out of its full screen state. This signal can be used by
+     * client code to restore widgets hidden during the
+     * entering-fullscreen stage for instance.
+     *
+     * Returns: %TRUE to stop other handlers from being invoked for the event.
+     *    %FALSE to continue emission of the event.
+     *
+     * Since: 1.9.0
+     */
+    webkit_web_view_signals[LEAVING_FULLSCREEN] =
+            g_signal_new("leaving-fullscreen",
+                         G_TYPE_FROM_CLASS(webViewClass),
+                         G_SIGNAL_RUN_LAST,
+                         G_STRUCT_OFFSET(WebKitWebViewClass, leaving_fullscreen),
+                         g_signal_accumulator_true_handled, 0,
+                         webkit_marshal_BOOLEAN__OBJECT,
+                         G_TYPE_BOOLEAN, 1, WEBKIT_TYPE_DOM_HTML_ELEMENT);
+
     /*
      * WebKitWebView::resource-response-received
      * @webView: the object which received the signal
@@ -2758,6 +2828,8 @@ static void webkit_web_view_class_init(WebKitWebViewClass* webViewClass)
     webViewClass->redo = webkit_web_view_real_redo;
     webViewClass->move_cursor = webkit_web_view_real_move_cursor;
     webViewClass->should_allow_editing_action = webkit_web_view_real_should_allow_editing_action;
+    webViewClass->entering_fullscreen = webkit_web_view_real_entering_fullscreen;
+    webViewClass->leaving_fullscreen = webkit_web_view_real_leaving_fullscreen;
 
     GObjectClass* objectClass = G_OBJECT_CLASS(webViewClass);
     objectClass->dispose = webkit_web_view_dispose;
@@ -3417,11 +3489,6 @@ static void webkit_web_view_init(WebKitWebView* webView)
     pageClients.dragClient = new WebKit::DragClient(webView);
     pageClients.inspectorClient = new WebKit::InspectorClient(webView);
 
-#if ENABLE(DEVICE_ORIENTATION)
-    pageClients.deviceMotionClient = static_cast<WebCore::DeviceMotionClient*>(new DeviceMotionClientGtk);
-    pageClients.deviceOrientationClient = static_cast<WebCore::DeviceOrientationClient*>(new DeviceOrientationClientGtk);
-#endif
-
 #if ENABLE(CLIENT_BASED_GEOLOCATION)
     if (DumpRenderTreeSupportGtk::dumpRenderTreeModeEnabled())
         pageClients.geolocationClient = new GeolocationClientMock;
@@ -3431,6 +3498,11 @@ static void webkit_web_view_init(WebKitWebView* webView)
 
     priv->corePage = new Page(pageClients);
 
+#if ENABLE(DEVICE_ORIENTATION)
+    WebCore::provideDeviceMotionTo(priv->corePage, new DeviceMotionClientGtk);
+    WebCore::provideDeviceOrientationTo(priv->corePage, new DeviceOrientationClientGtk);
+#endif
+
 #if ENABLE(CLIENT_BASED_GEOLOCATION)
     if (DumpRenderTreeSupportGtk::dumpRenderTreeModeEnabled())
         static_cast<GeolocationClientMock*>(pageClients.geolocationClient)->setController(priv->corePage->geolocationController());
diff --git a/Source/WebKit/gtk/webkit/webkitwebview.h b/Source/WebKit/gtk/webkit/webkitwebview.h
index 678e32966..2a15b53c6 100644
--- a/Source/WebKit/gtk/webkit/webkitwebview.h
+++ b/Source/WebKit/gtk/webkit/webkitwebview.h
@@ -176,11 +176,11 @@ struct _WebKitWebViewClass {
     void                       (* undo)                   (WebKitWebView        *web_view);
     void                       (* redo)                   (WebKitWebView        *web_view);
     gboolean                   (* should_allow_editing_action) (WebKitWebView   *web_view);
+    gboolean                   (* entering_fullscreen) (WebKitWebView   *web_view);
+    gboolean                   (* leaving_fullscreen) (WebKitWebView   *web_view);
 
     /* Padding for future expansion */
     void (*_webkit_reserved0) (void);
-    void (*_webkit_reserved1) (void);
-    void (*_webkit_reserved2) (void);
 };
 
 WEBKIT_API GType
diff --git a/Source/WebKit/mac/ChangeLog b/Source/WebKit/mac/ChangeLog
index bf1173720..898482ec1 100644
--- a/Source/WebKit/mac/ChangeLog
+++ b/Source/WebKit/mac/ChangeLog
@@ -1,3 +1,458 @@
+2012-02-24  Shinya Kawanaka  <shinyak@chromium.org>
+
+        SpellCheckRequest needs to know the context where the spellcheck happened.
+        https://bugs.webkit.org/show_bug.cgi?id=79320
+
+        Reviewed by Hajime Morita.
+
+        * WebCoreSupport/WebEditorClient.h:
+        * WebCoreSupport/WebEditorClient.mm:
+        (WebEditorClient::requestCheckingOfString):
+
+2012-02-23  Andy Estes  <aestes@apple.com>
+
+        Rename [setS|s]uppressIncrementalRendering to [setS|s]uppressesIncrementalRendering and make it WebPreferences API.
+        https://bugs.webkit.org/show_bug.cgi?id=79433
+
+        Reviewed by Dan Bernstein.
+
+        * WebCoreSupport/WebInspectorClient.mm:
+        (-[WebInspectorWindowController init]):
+        * WebView/WebPreferenceKeysPrivate.h:
+        * WebView/WebPreferences.h:
+        * WebView/WebPreferences.mm:
+        (+[WebPreferences initialize]):
+        (-[WebPreferences setSuppressesIncrementalRendering:]):
+        (-[WebPreferences suppressesIncrementalRendering]):
+        (-[WebPreferences setSuppressIncrementalRendering:]):
+        (-[WebPreferences suppressIncrementalRendering]):
+        * WebView/WebView.mm:
+        (-[WebView _preferencesChanged:]):
+
+2012-02-22  Hajime Morrita  <morrita@chromium.org>
+
+        NOTIFICATIONS should be implemented as PageSupplement
+        https://bugs.webkit.org/show_bug.cgi?id=79052
+
+        Reviewed by Adam Barth.
+
+        * WebView/WebView.mm:
+        (-[WebView _commonInitializationWithFrameName:groupName:]):
+
+2012-02-21  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Remove the remaining uses of CSSStyleDeclaration in Editor
+        https://bugs.webkit.org/show_bug.cgi?id=78939
+
+        Reviewed by Enrica Casucci.
+
+        * WebCoreSupport/WebEditorClient.h:
+        (WebEditorClient):
+        * WebCoreSupport/WebEditorClient.mm:
+        (WebEditorClient::shouldApplyStyle):
+        * WebView/WebFrame.mm:
+        (-[WebFrame _setTypingStyle:withUndoAction:]):
+        * WebView/WebHTMLView.mm:
+        (-[WebHTMLView _applyStyleToSelection:withUndoAction:]):
+        (-[WebHTMLView _changeCSSColorUsingSelector:inRange:]):
+        * WebView/WebView.mm:
+        (-[WebView applyStyle:]):
+
+2012-02-22  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Remove the remaining uses of CSSStyleDeclaration in Editor
+        https://bugs.webkit.org/show_bug.cgi?id=78939
+
+        Reviewed by Enrica Casucci.
+
+        * WebCoreSupport/WebEditorClient.h:
+        (WebEditorClient):
+        * WebCoreSupport/WebEditorClient.mm:
+        (WebEditorClient::shouldApplyStyle):
+        * WebView/WebFrame.mm:
+        (-[WebFrame _setTypingStyle:withUndoAction:]):
+        * WebView/WebHTMLView.mm:
+        (-[WebHTMLView _applyStyleToSelection:withUndoAction:]):
+        (-[WebHTMLView _changeCSSColorUsingSelector:inRange:]):
+        * WebView/WebView.mm:
+        (-[WebView applyStyle:]):
+
+2012-02-22  Jon Lee  <jonlee@apple.com>
+
+        Part of r108409 was incorrect, and incorporated an older version of a sub-patch.
+        This is the actual sub-patch that should have been submitted.
+
+        * WebCoreSupport/WebNotificationClient.h:
+        * WebCoreSupport/WebNotificationClient.mm:
+        (WebNotificationClient::show):
+        (WebNotificationClient::cancel):
+        (WebNotificationClient::clearNotifications):
+        (WebNotificationClient::notificationObjectDestroyed):
+        (WebNotificationClient::notificationControllerDestroyed):
+
+2012-02-21  Jon Lee  <jonlee@apple.com>
+
+        Build fix. Push ENABLE_NOTIFICATIONS into .mm file.
+
+        * WebCoreSupport/WebNotificationClient.h:
+        * WebView/WebNotification.h:
+        * WebView/WebNotification.mm:
+        (-[WebNotification title]):
+        (-[WebNotification body]):
+        (-[WebNotification origin]):
+        (-[WebNotification notificationID]):
+        (-[WebNotification dispatchShowEvent]):
+        (-[WebNotification dispatchCloseEvent]):
+        (-[WebNotification dispatchClickEvent]):
+        (-[WebNotification dispatchErrorEvent]):
+
+2012-02-21  John Sullivan  <sullivan@apple.com>
+
+        Build fix.
+
+        * WebView/WebUIDelegatePrivate.h:
+        Added @class declarations for DOMNode and DOMElement.
+
+2012-02-21  Jon Lee  <jonlee@apple.com>
+
+        Build fix for r108409.
+
+        * WebCoreSupport/WebNotificationClient.h:
+        (WebCore):
+        * WebCoreSupport/WebNotificationClient.mm:
+        * WebView/WebNotification.h:
+        (WebSecurityOrigin):
+        * WebView/WebNotification.mm:
+        (core):
+        (-[WebNotification initWithCoreNotification:notificationID:]):
+
+2012-02-21  Jon Lee  <jonlee@apple.com>
+
+        Bring notifications support to WK1 mac: permission requests
+        https://bugs.webkit.org/show_bug.cgi?id=78783
+        <rdar://problem/10610578>
+
+        Reviewed by Anders Carlsson.
+
+        * WebCoreSupport/WebNotificationClient.h:
+        * WebCoreSupport/WebNotificationClient.mm: Create policy listener, which conforms to the
+        WebAllowDenyPolicyListener protocol, similar to geolocation.
+        (WebNotificationClient::requestPermission):
+        (WebNotificationClient::checkPermission):
+        (-[WebNotificationPolicyListener initWithCallback:]):
+        (-[WebNotificationPolicyListener allow]): Call the callback.
+        (-[WebNotificationPolicyListener deny]): Call the callback.
+        * WebView/WebUIDelegatePrivate.h: Define new UI delegate method to ask the user to decide a
+        policy for navigations.
+
+        ====
+        Bring notifications support to WK1 mac: showing, canceling, removing notifications
+
+        Create a WebKit wrapper object for WebCore::Notification, which also keeps track of an assigned
+        ID.
+        * WebView/WebNotification.h: Added.
+        (WebSecurityOrigin):
+        * WebView/WebNotification.mm: Added.
+        (core):
+        (-[WebNotification initWithCoreNotification:notificationID:]):
+        (-[WebNotification init]):
+        (-[WebNotification dealloc]):
+        (-[WebNotification title]):
+        (-[WebNotification body]):
+        (-[WebNotification origin]):
+        (-[WebNotification notificationID]):
+        (-[WebNotification dispatchShowEvent]):
+        (-[WebNotification dispatchCloseEvent]):
+        (-[WebNotification dispatchClickEvent]):
+        (-[WebNotification dispatchErrorEvent]):
+        * WebView/WebNotificationInternal.h: Added.
+        (WebCore): Internal category to allow creating instances with WebCore objects.
+
+        Extend WebView to include a WebNotificationProvider, which clients implement.
+        * WebView/WebViewData.h: Add a private member for the provider.
+        * WebView/WebViewPrivate.h:
+            * Define an enum WebNotificationPermission that mirrors WebCore::NotificationPresenter::Permission
+            that client which implement the provider can use to return policy decisions.
+            * Define WebNotificationProvider.
+            * Category WebViewNotification extends WebView with methods that set and manager the
+            notification provider, and handle events from the platform notifications.
+        * WebView/WebView.mm:
+        (-[WebView _setNotificationProvider:]): Sets the provider when initializing the WebView.
+        (-[WebView _notificationControllerDestroyed]):
+        (-[WebView _notificationProvider]):
+        (-[WebView _notificationDidShow:]):
+        (-[WebView _notificationDidClick:]):
+        (-[WebView _notificationsDidClose:]):
+
+        * WebCoreSupport/WebNotificationClient.h: Add variables that map between WebCore::Notification
+        instances, their assigned IDs, their contexts, and corresponding WebKit wrapper objects.
+        * WebCoreSupport/WebNotificationClient.mm:
+        (generateNotificationID): Created unique IDs for each shown notification.
+        (WebNotificationClient::show): Create wrapper object for notification, assign ID, cache the
+        mappings between the objects, and forward it to the provider.
+        (WebNotificationClient::cancel):
+        (WebNotificationClient::clearNotifications): Clear all notifications associated with the
+        provided context.
+        (WebNotificationClient::notificationObjectDestroyed): Remove the notification from the maps.
+        (WebNotificationClient::notificationControllerDestroyed): If the controller is destroyed, tell
+        the provider to clear of the notifications related to this web view.
+
+        ====
+        (Prep work for) Bring notifications support to WK1 mac
+
+        Rename WebGeolocationPolicyListener. The interface is generic enough to be reused for
+        notification requests. To avoid having to create a new listener type, instead rename it
+        to WebAllowDenyPolicyListener.
+        * WebView/WebUIDelegatePrivate.h: Rename the protocol.
+        * WebCoreSupport/WebGeolocationClient.mm: Refactor geolocation request listener to use
+        new name.
+
+        Add preference to keep track of whether notifications are enabled in general.
+        * WebView/WebPreferenceKeysPrivate.h: Add WebNotificationsEnabledKey for storing the
+        preference.
+        * WebView/WebPreferences.mm:
+        (+[WebPreferences initialize]): By default have them enabled.
+        (-[WebPreferences setNotificationsEnabled:]):
+        (-[WebPreferences notificationsEnabled]):
+        * WebView/WebPreferencesPrivate.h:
+
+        Add a stringValue method that exposes WebCore::SecurityOrigin::toString() for storing the
+        notification policy for a given origin.
+        * WebCoreSupport/WebSecurityOrigin.mm:
+        (-[WebSecurityOrigin stringValue]):
+        * WebCoreSupport/WebSecurityOriginPrivate.h:
+
+2012-02-21  Sam Weinig  <sam@webkit.org>
+
+        Attempt to fix the Snow Leopard build.
+
+        * Configurations/Base.xcconfig:
+
+2012-02-21  Sam Weinig  <sam@webkit.org>
+
+        Use libc++ when building with Clang on Mac
+        https://bugs.webkit.org/show_bug.cgi?id=78981
+
+        Reviewed by Dan Bernstein.
+
+        * Configurations/Base.xcconfig:
+
+2012-02-17  Mihnea Ovidenie  <mihnea@adobe.com>
+
+        CSS regions enabled by default
+        https://bugs.webkit.org/show_bug.cgi?id=78525
+
+        Reviewed by David Hyatt.
+
+        Add a runtime preference to enable/disable regions functionality at runtime(WebKitCSSRegionsEnabled).
+        CSSRegions are still enabled by default.
+        In DRT, use layoutTestController.overridePreference("WebKitCSSRegionsEnabled", "0") to disable the css regions functionality.
+
+        * WebView/WebPreferenceKeysPrivate.h:
+        * WebView/WebPreferences.mm:
+        (+[WebPreferences initialize]):
+        (-[WebPreferences cssRegionsEnabled]):
+        (-[WebPreferences setCSSRegionsEnabled:]):
+        * WebView/WebPreferencesPrivate.h:
+        * WebView/WebView.mm:
+        (-[WebView _preferencesChanged:]):
+
+2012-02-17  Enrica Casucci  <enrica@apple.com>
+
+        Refactor DragData class to use PlatformStrategies in the Mac implementation.
+        https://bugs.webkit.org/show_bug.cgi?id=78768
+
+        Reviewed by Darin Adler.
+
+        * WebCoreSupport/WebPlatformStrategies.h: Added color() method.
+        * WebCoreSupport/WebPlatformStrategies.mm:
+        (WebPlatformStrategies::color):
+
+2012-02-16  Brady Eidson  <beidson@apple.com>
+
+        <rdar://problem/10616280> and https://bugs.webkit.org/show_bug.cgi?id=78767
+        REGRESSION (r90471) - iAd Producer 2.0.1 produces blank pages
+
+        Reviewed by Sam Weinig.
+
+        * WebView/WebView.mm:
+        (-[WebView _needsIsLoadingInAPISenseQuirk]):
+        (-[WebView _preferencesChanged:]):
+
+2012-02-15  Enrica Casucci  <enrica@apple.com>
+
+        Refactor ClipboardMac class to use PlatformStrategies.
+        https://bugs.webkit.org/show_bug.cgi?id=78554
+
+        Reviewed by Anders Carlsson.
+
+        * WebCoreSupport/WebDragClient.h: Changed methods signature to use name based pasteboard.
+        * WebCoreSupport/WebDragClient.mm: Ditto.
+        (WebDragClient::willPerformDragSourceAction):
+        (WebDragClient::startDrag):
+        (WebDragClient::declareAndWriteDragImage):
+        * WebCoreSupport/WebPlatformStrategies.h: Added new methods.
+        * WebCoreSupport/WebPlatformStrategies.mm:
+        (WebPlatformStrategies::changeCount):
+        (WebPlatformStrategies::uniqueName):
+
+2012-02-15  Sadrul Habib Chowdhury  <sadrul@chromium.org>
+
+        Notify ChromeClient when touch-event handlers are installed/removed.
+        https://bugs.webkit.org/show_bug.cgi?id=77440
+
+        Reviewed by Darin Fisher and Ryosuke Niwa.
+
+        * WebCoreSupport/WebChromeClient.h:
+
+2012-02-14  Matt Lilek  <mrl@apple.com>
+
+        Don't ENABLE_DASHBOARD_SUPPORT unconditionally on all Mac platforms
+        https://bugs.webkit.org/show_bug.cgi?id=78629
+
+        Reviewed by David Kilzer.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2012-02-14  Alexey Proskuryakov  <ap@apple.com>
+
+        [Mac][Win][WK2] Switch to RFC 6455 protocol for WebSockets
+        https://bugs.webkit.org/show_bug.cgi?id=78541
+        <rdar://problem/10036695>
+
+        Reviewed by Kent Tamura.
+
+        * WebView/WebPreferences.mm: (+[WebPreferences initialize]): Changed default value of the
+        preference.
+
+2012-02-11  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Convert svg/animations to use SMIL methods for driving the timeline
+        https://bugs.webkit.org/show_bug.cgi?id=78422
+
+        Reviewed by Dirk Schulze.
+
+        Remove SVG animation sampling functionality provided for DRT, which no longer uses it.
+        Instead we switched the svg/animations tests to use SVGSVGElement.setCurrentTime.
+
+        * WebKit.order:
+        * WebView/WebFrame.mm:
+        * WebView/WebFramePrivate.h:
+
+2012-02-13  Enrica Casucci  <enrica@apple.com>
+
+         Refactor Mac platform implementation of the Pasteboard class to use Platform Strategies.
+         https://bugs.webkit.org/show_bug.cgi?id=78282
+ 
+         This patch removes any accesss to the NSPasteboard object from the Pasteboard class which
+         now makes use of a new pasteboardStrategy object that is implemented both in WebKit and
+         WebKit2. The actual access to NSPasteboard is now performed inside the PlatformPasteboard
+         class. Currently both WebKit and WebKit2 use the same implementation of the PasteboardStrategy
+         interface but this one more step in the direction of removing access to NSPasteboard from
+         the WebProcess.
+         As part of the refactoring the I've reduced to a minimum the use of OBJ-C classes.
+         
+         Reviewed by Anders Carlsson.
+ 
+         * WebCoreSupport/WebPlatformStrategies.h: Added PasteboardStrategy.
+         * WebCoreSupport/WebPlatformStrategies.mm: Added implementation of PasteboardStrategy interface.
+         (WebPlatformStrategies::createPasteboardStrategy):
+         (WebPlatformStrategies::getTypes):
+         (WebPlatformStrategies::bufferForType):
+         (WebPlatformStrategies::getPathnamesForType):
+         (WebPlatformStrategies::stringForType):
+         (WebPlatformStrategies::copy):
+         (WebPlatformStrategies::setTypes):
+         (WebPlatformStrategies::setBufferForType):
+         (WebPlatformStrategies::setPathnamesForType):
+         (WebPlatformStrategies::setStringForType):
+
+2012-02-12  Hajime Morrita  <morrita@chromium.org>
+
+        Page should have less intrusive way to associate API implementation objects.
+        https://bugs.webkit.org/show_bug.cgi?id=78085
+
+        Reviewed by Adam Barth.
+
+        * WebView/WebView.mm:
+        (-[WebView _commonInitializationWithFrameName:groupName:]):
+
+2012-02-11  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r107435.
+        http://trac.webkit.org/changeset/107435
+        https://bugs.webkit.org/show_bug.cgi?id=78410
+
+        It broke the Qt build (Requested by Ossy on #webkit).
+
+        * WebCoreSupport/WebPlatformStrategies.h:
+        (WebPlatformStrategies):
+        * WebCoreSupport/WebPlatformStrategies.mm:
+        (WebPlatformStrategies::addVisitedLink):
+
+2012-02-10  Adam Klein  <adamk@chromium.org>
+
+        Enable MUTATION_OBSERVERS by default on all platforms
+        https://bugs.webkit.org/show_bug.cgi?id=78196
+
+        Reviewed by Ojan Vafai.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2012-02-10  Enrica Casucci  <enrica@apple.com>
+
+        Refactor Mac platform implementation of the Pasteboard class to use Platform Strategies.
+        https://bugs.webkit.org/show_bug.cgi?id=78282
+
+        This patch removes any accesss to the NSPasteboard object from the Pasteboard class which
+        now makes use of a new pasteboardStrategy object that is implemented both in WebKit and
+        WebKit2. The actual access to NSPasteboard is now performed inside the PlatformPasteboard
+        class. Currently both WebKit and WebKit2 use the same implementation of the PasteboardStrategy
+        interface but this one more step in the direction of removing access to NSPasteboard from
+        the WebProcess.
+        As part of the refactoring the I've reduced to a minimum the use of OBJ-C classes.
+        
+        Reviewed by Anders Carlsson.
+
+        * WebCoreSupport/WebPlatformStrategies.h: Added PasteboardStrategy.
+        * WebCoreSupport/WebPlatformStrategies.mm: Added implementation of PasteboardStrategy interface.
+        (WebPlatformStrategies::createPasteboardStrategy):
+        (WebPlatformStrategies::getTypes):
+        (WebPlatformStrategies::bufferForType):
+        (WebPlatformStrategies::getPathnamesForType):
+        (WebPlatformStrategies::stringForType):
+        (WebPlatformStrategies::copy):
+        (WebPlatformStrategies::setTypes):
+        (WebPlatformStrategies::setBufferForType):
+        (WebPlatformStrategies::setPathnamesForType):
+        (WebPlatformStrategies::setStringForType):
+
+2012-02-10  Benjamin Poulain  <bpoulain@apple.com>
+
+        [Mac] DYLIB_INSTALL_NAME_BASE should not be prefixed by the SDKROOT
+        https://bugs.webkit.org/show_bug.cgi?id=78320
+
+        Reviewed by Joseph Pecoraro.
+
+        <rdar://problem/10839750>
+
+        * Configurations/WebKit.xcconfig:
+
+2012-02-09  Alexey Proskuryakov  <ap@apple.com>
+
+        REGRESSION (r104885): Articles not displayed in Vienna RSS reader
+        https://bugs.webkit.org/show_bug.cgi?id=78280
+        <rdar://problem/10762545>
+
+        Reviewed by Oliver Hunt.
+
+        * Misc/WebNSURLExtras.h:
+        * Misc/WebNSURLExtras.mm: (-[NSURL _webkit_URLFromURLOrPath]):
+        Added a method to create a URL from a path, similarly to what KURL used to do.
+
+        * WebView/WebFrame.mm: (-[WebFrame loadData:MIMEType:textEncodingName:baseURL:]):
+        Use it in an API where a known regression occurred.
+
 2012-02-07  Antti Koivisto  <antti@apple.com>
 
         REGRESSION (r106681): Null check missing in [WebFrame(WebInternal) _typingStyle]
diff --git a/Source/WebKit/mac/Configurations/Base.xcconfig b/Source/WebKit/mac/Configurations/Base.xcconfig
index 648332252..b62984744 100644
--- a/Source/WebKit/mac/Configurations/Base.xcconfig
+++ b/Source/WebKit/mac/Configurations/Base.xcconfig
@@ -65,6 +65,11 @@ WARNING_CFLAGS_iphoneos = $(WARNING_CFLAGS_BASE);
 WARNING_CFLAGS_iphonesimulator = $(WARNING_CFLAGS_BASE);
 WARNING_CFLAGS_macosx = $(WARNING_CFLAGS_BASE);
 
+CLANG_CXX_LIBRARY = $(CLANG_CXX_LIBRARY_$(TARGET_MAC_OS_X_VERSION_MAJOR));
+CLANG_CXX_LIBRARY_1060 = libstdc++;
+CLANG_CXX_LIBRARY_1070 = libc++;
+CLANG_CXX_LIBRARY_1080 = libc++;
+CLANG_CXX_LIBRARY_1090 = libc++;
 
 REAL_PLATFORM_NAME = $(REAL_PLATFORM_NAME_$(PLATFORM_NAME));
 REAL_PLATFORM_NAME_ = $(REAL_PLATFORM_NAME_macosx);
diff --git a/Source/WebKit/mac/Configurations/FeatureDefines.xcconfig b/Source/WebKit/mac/Configurations/FeatureDefines.xcconfig
index f5bc9cf39..3e2090355 100644
--- a/Source/WebKit/mac/Configurations/FeatureDefines.xcconfig
+++ b/Source/WebKit/mac/Configurations/FeatureDefines.xcconfig
@@ -37,7 +37,8 @@ ENABLE_BLOB_macosx = ENABLE_BLOB;
 ENABLE_CLIENT_BASED_GEOLOCATION = $(ENABLE_CLIENT_BASED_GEOLOCATION_$(REAL_PLATFORM_NAME));
 ENABLE_CLIENT_BASED_GEOLOCATION_macosx = ENABLE_CLIENT_BASED_GEOLOCATION;
 
-ENABLE_DASHBOARD_SUPPORT = ENABLE_DASHBOARD_SUPPORT;
+ENABLE_DASHBOARD_SUPPORT = $(ENABLE_DASHBOARD_SUPPORT_$(REAL_PLATFORM_NAME));
+ENABLE_DASHBOARD_SUPPORT_macosx = ENABLE_DASHBOARD_SUPPORT;
 
 ENABLE_DATALIST = $(ENABLE_DATALIST_$(REAL_PLATFORM_NAME));
 ENABLE_DATALIST_macosx = ENABLE_DATALIST;
@@ -95,7 +96,7 @@ ENABLE_MEDIA_SOURCE = ;
 ENABLE_MEDIA_STATISTICS = ;
 ENABLE_METER_TAG = ENABLE_METER_TAG;
 ENABLE_MHTML = ;
-ENABLE_MUTATION_OBSERVERS = ;
+ENABLE_MUTATION_OBSERVERS = ENABLE_MUTATION_OBSERVERS;
 
 ENABLE_NOTIFICATIONS = $(ENABLE_NOTIFICATIONS_$(REAL_PLATFORM_NAME));
 ENABLE_NOTIFICATIONS_macosx = $(ENABLE_NOTIFICATIONS_macosx_$(TARGET_MAC_OS_X_VERSION_MAJOR));
diff --git a/Source/WebKit/mac/Configurations/Version.xcconfig b/Source/WebKit/mac/Configurations/Version.xcconfig
index 20bc364c1..5344a720d 100644
--- a/Source/WebKit/mac/Configurations/Version.xcconfig
+++ b/Source/WebKit/mac/Configurations/Version.xcconfig
@@ -22,7 +22,7 @@
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
 
 MAJOR_VERSION = 535;
-MINOR_VERSION = 20;
+MINOR_VERSION = 23;
 TINY_VERSION = 0;
 FULL_VERSION = $(MAJOR_VERSION).$(MINOR_VERSION);
 
diff --git a/Source/WebKit/mac/Configurations/WebKit.xcconfig b/Source/WebKit/mac/Configurations/WebKit.xcconfig
index 7e0ac2979..0a0cf9f41 100644
--- a/Source/WebKit/mac/Configurations/WebKit.xcconfig
+++ b/Source/WebKit/mac/Configurations/WebKit.xcconfig
@@ -83,8 +83,8 @@ WEBKIT_FRAMEWORKS_DIR_macosx_USE_STAGING_INSTALL_PATH_NO = $(NORMAL_WEBKIT_FRAME
 WEBKIT_FRAMEWORKS_DIR_macosx_USE_STAGING_INSTALL_PATH_YES = $(SYSTEM_LIBRARY_DIR)/StagedFrameworks/Safari;
 
 NORMAL_PRODUCTION_FRAMEWORKS_DIR = $(NORMAL_PRODUCTION_FRAMEWORKS_DIR_$(REAL_PLATFORM_NAME));
-NORMAL_PRODUCTION_FRAMEWORKS_DIR_iphoneos = $(SDKROOT)$(SYSTEM_LIBRARY_DIR)/PrivateFrameworks;
-NORMAL_PRODUCTION_FRAMEWORKS_DIR_iphonesimulator = $(PRODUCTION_FRAMEWORKS_DIR_iphoneos);
+NORMAL_PRODUCTION_FRAMEWORKS_DIR_iphoneos = $(SYSTEM_LIBRARY_DIR)/PrivateFrameworks;
+NORMAL_PRODUCTION_FRAMEWORKS_DIR_iphonesimulator = $(NORMAL_PRODUCTION_FRAMEWORKS_DIR_iphoneos);
 NORMAL_PRODUCTION_FRAMEWORKS_DIR_macosx = $(NEXT_ROOT)$(SYSTEM_LIBRARY_DIR)/Frameworks;
 
 PRODUCTION_FRAMEWORKS_DIR = $(PRODUCTION_FRAMEWORKS_DIR_$(REAL_PLATFORM_NAME));
diff --git a/Source/WebKit/mac/Misc/WebNSURLExtras.h b/Source/WebKit/mac/Misc/WebNSURLExtras.h
index c7b266e93..6b170a7bb 100644
--- a/Source/WebKit/mac/Misc/WebNSURLExtras.h
+++ b/Source/WebKit/mac/Misc/WebNSURLExtras.h
@@ -69,6 +69,8 @@
 
 - (NSString *)_webkit_suggestedFilenameWithMIMEType:(NSString *)MIMEType;
 
+- (NSURL *)_webkit_URLFromURLOrPath;
+
 @end
 
 @interface NSString (WebNSURLExtras)
diff --git a/Source/WebKit/mac/Misc/WebNSURLExtras.mm b/Source/WebKit/mac/Misc/WebNSURLExtras.mm
index b408bd4a3..c2351dd3d 100644
--- a/Source/WebKit/mac/Misc/WebNSURLExtras.mm
+++ b/Source/WebKit/mac/Misc/WebNSURLExtras.mm
@@ -883,6 +883,14 @@ static CFStringRef createStringWithEscapedUnsafeCharacters(CFStringRef string)
     return suggestedFilenameWithMIMEType(self, MIMEType);
 }
 
+- (NSURL *)_webkit_URLFromURLOrPath
+{
+    if ([self scheme])
+        return self;
+
+    return [NSURL fileURLWithPath:[self absoluteString]];
+}
+
 @end
 
 @implementation NSString (WebNSURLExtras)
diff --git a/Source/WebKit/mac/WebCoreSupport/WebChromeClient.h b/Source/WebKit/mac/WebCoreSupport/WebChromeClient.h
index 48ff09bba..66fa060b5 100644
--- a/Source/WebKit/mac/WebCoreSupport/WebChromeClient.h
+++ b/Source/WebKit/mac/WebCoreSupport/WebChromeClient.h
@@ -189,6 +189,7 @@ public:
 #endif
     
     virtual void numWheelEventHandlersChanged(unsigned) OVERRIDE { }
+    virtual void numTouchEventHandlersChanged(unsigned) OVERRIDE { }
     virtual bool shouldRubberBandInDirection(WebCore::ScrollDirection) const OVERRIDE { return false; }
 private:
     WebView *m_webView;
diff --git a/Source/WebKit/mac/WebCoreSupport/WebDragClient.h b/Source/WebKit/mac/WebCoreSupport/WebDragClient.h
index e472fb7ce..9d96b82c5 100644
--- a/Source/WebKit/mac/WebCoreSupport/WebDragClient.h
+++ b/Source/WebKit/mac/WebCoreSupport/WebDragClient.h
@@ -36,7 +36,7 @@ public:
     virtual void dragControllerDestroyed() OVERRIDE;
     virtual WebCore::DragSourceAction dragSourceActionMaskForPoint(const WebCore::IntPoint& windowPoint) OVERRIDE;
     virtual void startDrag(WebCore::DragImageRef, const WebCore::IntPoint& dragPos, const WebCore::IntPoint& eventPos, WebCore::Clipboard*, WebCore::Frame*, bool linkDrag) OVERRIDE;
-    virtual void declareAndWriteDragImage(NSPasteboard*, DOMElement*, NSURL*, NSString*, WebCore::Frame*) OVERRIDE;
+    virtual void declareAndWriteDragImage(const String& pasteboardName, DOMElement*, NSURL*, NSString*, WebCore::Frame*) OVERRIDE;
 private:
     WebView* m_webView;
 };
diff --git a/Source/WebKit/mac/WebCoreSupport/WebDragClient.mm b/Source/WebKit/mac/WebCoreSupport/WebDragClient.mm
index 9ba4b05dc..aff7ec2cf 100644
--- a/Source/WebKit/mac/WebCoreSupport/WebDragClient.mm
+++ b/Source/WebKit/mac/WebCoreSupport/WebDragClient.mm
@@ -83,7 +83,7 @@ WebCore::DragSourceAction WebDragClient::dragSourceActionMaskForPoint(const IntP
 void WebDragClient::willPerformDragSourceAction(WebCore::DragSourceAction action, const WebCore::IntPoint& mouseDownPoint, WebCore::Clipboard* clipboard)
 {
     ASSERT(clipboard);
-    [[m_webView _UIDelegateForwarder] webView:m_webView willPerformDragSourceAction:(WebDragSourceAction)action fromPoint:mouseDownPoint withPasteboard:static_cast<WebCore::ClipboardMac*>(clipboard)->pasteboard()];
+    [[m_webView _UIDelegateForwarder] webView:m_webView willPerformDragSourceAction:(WebDragSourceAction)action fromPoint:mouseDownPoint withPasteboard:[NSPasteboard pasteboardWithName:static_cast<WebCore::ClipboardMac*>(clipboard)->pasteboardName()]];
 }
 
 void WebDragClient::startDrag(DragImageRef dragImage, const IntPoint& at, const IntPoint& eventPos, Clipboard* clipboard, Frame* frame, bool linkDrag)
@@ -100,7 +100,7 @@ void WebDragClient::startDrag(DragImageRef dragImage, const IntPoint& at, const
     RetainPtr<WebHTMLView> topViewProtector = topHTMLView;
     
     [topHTMLView _stopAutoscrollTimer];
-    NSPasteboard *pasteboard = static_cast<ClipboardMac*>(clipboard)->pasteboard();
+    NSPasteboard *pasteboard = [NSPasteboard pasteboardWithName:static_cast<ClipboardMac*>(clipboard)->pasteboardName()];
 
     NSImage *dragNSImage = dragImage.get();
     WebHTMLView *sourceHTMLView = htmlView.get();
@@ -120,14 +120,14 @@ void WebDragClient::startDrag(DragImageRef dragImage, const IntPoint& at, const
         [topHTMLView dragImage:dragNSImage at:at offset:NSZeroSize event:event pasteboard:pasteboard source:sourceHTMLView slideBack:YES];
 }
 
-void WebDragClient::declareAndWriteDragImage(NSPasteboard* pasteboard, DOMElement* element, NSURL* URL, NSString* title, WebCore::Frame* frame) 
+void WebDragClient::declareAndWriteDragImage(const String& pasteboardName, DOMElement* element, NSURL* URL, NSString* title, WebCore::Frame* frame) 
 {
-    ASSERT(pasteboard);
+    ASSERT(pasteboardName);
     ASSERT(element);
     WebHTMLView *source = getTopHTMLView(frame);      
     WebArchive *archive = [element webArchive];
     
-    [pasteboard _web_declareAndWriteDragImageForElement:element URL:URL title:title archive:archive source:source];
+    [[NSPasteboard pasteboardWithName:pasteboardName] _web_declareAndWriteDragImageForElement:element URL:URL title:title archive:archive source:source];
 }
 
 void WebDragClient::dragControllerDestroyed() 
diff --git a/Source/WebKit/mac/WebCoreSupport/WebEditorClient.h b/Source/WebKit/mac/WebCoreSupport/WebEditorClient.h
index c70d6089d..c75fee09f 100644
--- a/Source/WebKit/mac/WebCoreSupport/WebEditorClient.h
+++ b/Source/WebKit/mac/WebCoreSupport/WebEditorClient.h
@@ -61,7 +61,7 @@ public:
     virtual bool shouldInsertText(const WTF::String&, WebCore::Range*, WebCore::EditorInsertAction) OVERRIDE;
     virtual bool shouldChangeSelectedRange(WebCore::Range* fromRange, WebCore::Range* toRange, WebCore::EAffinity, bool stillSelecting) OVERRIDE;
 
-    virtual bool shouldApplyStyle(WebCore::CSSStyleDeclaration*, WebCore::Range*) OVERRIDE;
+    virtual bool shouldApplyStyle(WebCore::StylePropertySet*, WebCore::Range*) OVERRIDE;
     
     virtual bool shouldMoveRangeAfterDelete(WebCore::Range*, WebCore::Range* rangeToBeReplaced) OVERRIDE;
 
@@ -135,7 +135,7 @@ public:
     virtual void getGuessesForWord(const WTF::String& word, const WTF::String& context, WTF::Vector<WTF::String>& guesses) OVERRIDE;
     virtual void willSetInputMethodState() OVERRIDE;
     virtual void setInputMethodState(bool enabled) OVERRIDE;
-    virtual void requestCheckingOfString(WebCore::SpellChecker*, int, WebCore::TextCheckingTypeMask, const WTF::String&) OVERRIDE;
+    virtual void requestCheckingOfString(WebCore::SpellChecker*, const WebCore::TextCheckingRequest&) OVERRIDE;
 #if !defined(BUILDING_ON_LEOPARD) && !defined(BUILDING_ON_SNOW_LEOPARD)
     virtual void showCorrectionPanel(WebCore::CorrectionPanelInfo::PanelType, const WebCore::FloatRect& boundingBoxOfReplacedString, const String& replacedString, const String& replacementString, const Vector<String>& alternativeReplacementStrings) OVERRIDE;
     virtual void dismissCorrectionPanel(WebCore::ReasonForDismissingCorrectionPanel) OVERRIDE;
diff --git a/Source/WebKit/mac/WebCoreSupport/WebEditorClient.mm b/Source/WebKit/mac/WebCoreSupport/WebEditorClient.mm
index fabdf6c6f..478553034 100644
--- a/Source/WebKit/mac/WebCoreSupport/WebEditorClient.mm
+++ b/Source/WebKit/mac/WebCoreSupport/WebEditorClient.mm
@@ -241,10 +241,10 @@ bool WebEditorClient::isSelectTrailingWhitespaceEnabled()
     return [m_webView isSelectTrailingWhitespaceEnabled];
 }
 
-bool WebEditorClient::shouldApplyStyle(CSSStyleDeclaration* style, Range* range)
+bool WebEditorClient::shouldApplyStyle(StylePropertySet* style, Range* range)
 {
     return [[m_webView _editingDelegateForwarder] webView:m_webView
-        shouldApplyStyle:kit(style) toElementsInDOMRange:kit(range)];
+        shouldApplyStyle:kit(style->ensureCSSStyleDeclaration()) toElementsInDOMRange:kit(range)];
 }
 
 bool WebEditorClient::shouldMoveRangeAfterDelete(Range* range, Range* rangeToBeReplaced)
@@ -972,15 +972,15 @@ void WebEditorClient::setInputMethodState(bool)
 @end
 #endif
 
-void WebEditorClient::requestCheckingOfString(WebCore::SpellChecker* sender, int sequence, WebCore::TextCheckingTypeMask checkingTypes, const String& text)
+void WebEditorClient::requestCheckingOfString(WebCore::SpellChecker* sender, const WebCore::TextCheckingRequest& request)
 {
 #ifndef BUILDING_ON_LEOPARD
-    NSRange range = NSMakeRange(0, text.length());
+    NSRange range = NSMakeRange(0, request.text().length());
     NSRunLoop* currentLoop = [NSRunLoop currentRunLoop];
-    [[NSSpellChecker sharedSpellChecker] requestCheckingOfString:text range:range types:NSTextCheckingAllSystemTypes options:0 inSpellDocumentWithTag:0 
+    [[NSSpellChecker sharedSpellChecker] requestCheckingOfString:request.text() range:range types:NSTextCheckingAllSystemTypes options:0 inSpellDocumentWithTag:0
                                          completionHandler:^(NSInteger, NSArray* results, NSOrthography*, NSInteger) {
             [currentLoop performSelector:@selector(perform) 
-                                  target:[[[WebEditorSpellCheckResponder alloc] initWithSender:sender sequence:sequence types:checkingTypes results:results] autorelease]
+                                  target:[[[WebEditorSpellCheckResponder alloc] initWithSender:sender sequence:request.sequence() types:request.mask() results:results] autorelease]
                                 argument:nil order:0 modes:[NSArray arrayWithObject:NSDefaultRunLoopMode]];
         }];
 #endif
diff --git a/Source/WebKit/mac/WebCoreSupport/WebGeolocationClient.mm b/Source/WebKit/mac/WebCoreSupport/WebGeolocationClient.mm
index b52b7bc64..541f40ccd 100644
--- a/Source/WebKit/mac/WebCoreSupport/WebGeolocationClient.mm
+++ b/Source/WebKit/mac/WebCoreSupport/WebGeolocationClient.mm
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2009, 2012 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -37,7 +37,7 @@
 
 using namespace WebCore;
 
-@interface WebGeolocationPolicyListener : NSObject <WebGeolocationPolicyListener>
+@interface WebGeolocationPolicyListener : NSObject <WebAllowDenyPolicyListener>
 {
     RefPtr<Geolocation> _geolocation;
 }
diff --git a/Source/WebKit/mac/WebCoreSupport/WebInspectorClient.mm b/Source/WebKit/mac/WebCoreSupport/WebInspectorClient.mm
index 14ebd1d65..2ae865951 100644
--- a/Source/WebKit/mac/WebCoreSupport/WebInspectorClient.mm
+++ b/Source/WebKit/mac/WebCoreSupport/WebInspectorClient.mm
@@ -240,7 +240,7 @@ void WebInspectorFrontendClient::updateWindowTitle() const
     [preferences setMinimumFontSize:0];
     [preferences setMinimumLogicalFontSize:9];
     [preferences setPlugInsEnabled:NO];
-    [preferences setSuppressIncrementalRendering:YES];
+    [preferences setSuppressesIncrementalRendering:YES];
     [preferences setTabsToLinks:NO];
     [preferences setUserStyleSheetEnabled:NO];
 
diff --git a/Source/WebKit/mac/WebCoreSupport/WebNotificationClient.h b/Source/WebKit/mac/WebCoreSupport/WebNotificationClient.h
index 82903ca59..a40ce81e5 100644
--- a/Source/WebKit/mac/WebCoreSupport/WebNotificationClient.h
+++ b/Source/WebKit/mac/WebCoreSupport/WebNotificationClient.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2011 Apple Inc. All rights reserved.
+ * Copyright (C) 2011, 2012 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -25,11 +25,20 @@
 
 #import <WebCore/NotificationPresenter.h>
 
+#if ENABLE(NOTIFICATIONS)
+#import <WebCore/Notification.h>
+#import <wtf/HashMap.h>
+#import <wtf/RefPtr.h>
+#import <wtf/RetainPtr.h>
+#endif
+
 namespace WebCore {
+class Notification;
 class ScriptExecutionContext;
 class VoidCallback;
 }
 
+@class WebNotification;
 @class WebView;
 
 class WebNotificationClient : public WebCore::NotificationPresenter {
@@ -40,11 +49,18 @@ public:
 private:
     virtual bool show(WebCore::Notification*) OVERRIDE;
     virtual void cancel(WebCore::Notification*) OVERRIDE;
+    virtual void clearNotifications(WebCore::ScriptExecutionContext*) OVERRIDE;
     virtual void notificationObjectDestroyed(WebCore::Notification*) OVERRIDE;
     virtual void notificationControllerDestroyed() OVERRIDE;
     virtual void requestPermission(WebCore::ScriptExecutionContext*, PassRefPtr<WebCore::VoidCallback>) OVERRIDE;
-    virtual void cancelRequestsForPermission(WebCore::ScriptExecutionContext*) OVERRIDE;
+    virtual void cancelRequestsForPermission(WebCore::ScriptExecutionContext*) OVERRIDE { }
     virtual WebCore::NotificationPresenter::Permission checkPermission(WebCore::ScriptExecutionContext*) OVERRIDE;
 
     WebView *m_webView;
+#if ENABLE(NOTIFICATIONS)
+    HashMap<RefPtr<WebCore::Notification>, RetainPtr<WebNotification> > m_notificationMap;
+    
+    typedef HashMap<RefPtr<WebCore::ScriptExecutionContext>, Vector<RetainPtr<WebNotification> > > NotificationContextMap;
+    NotificationContextMap m_notificationContextMap;
+#endif
 };
diff --git a/Source/WebKit/mac/WebCoreSupport/WebNotificationClient.mm b/Source/WebKit/mac/WebCoreSupport/WebNotificationClient.mm
index 80138e313..2f7cd5411 100644
--- a/Source/WebKit/mac/WebCoreSupport/WebNotificationClient.mm
+++ b/Source/WebKit/mac/WebCoreSupport/WebNotificationClient.mm
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2011 Apple Inc. All rights reserved.
+ * Copyright (C) 2011, 2012 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -25,49 +25,199 @@
 
 #import "WebNotificationClient.h"
 
-#import <WebCore/NotImplemented.h>
-#import <WebCore/Notification.h>
+#if ENABLE(NOTIFICATIONS)
+#import "WebDelegateImplementationCaching.h"
+#import "WebNotificationInternal.h"
+#import "WebPreferencesPrivate.h"
+#import "WebSecurityOriginInternal.h"
+#import "WebUIDelegatePrivate.h"
+#import "WebViewInternal.h"
+#import <WebCore/BlockExceptions.h>
+#import <WebCore/Page.h>
+#import <WebCore/ScriptExecutionContext.h>
+#endif
 
 using namespace WebCore;
 
+#if ENABLE(NOTIFICATIONS)
+@interface WebNotificationPolicyListener : NSObject <WebAllowDenyPolicyListener>
+{
+    RefPtr<VoidCallback> _callback;
+}
+- (id)initWithCallback:(PassRefPtr<VoidCallback>)callback;
+@end
+#endif
+
+#if ENABLE(NOTIFICATIONS)
+static uint64_t generateNotificationID()
+{
+    static uint64_t uniqueNotificationID = 1;
+    return uniqueNotificationID++;
+}
+#endif
+
 WebNotificationClient::WebNotificationClient(WebView *webView)
     : m_webView(webView)
 {
 }
 
-bool WebNotificationClient::show(Notification*)
+bool WebNotificationClient::show(Notification* notification)
 {
-    notImplemented();
+#if ENABLE(NOTIFICATIONS)
+    if (![m_webView _notificationProvider])
+        return false;
+
+    uint64_t notificationID = generateNotificationID();
+    RetainPtr<WebNotification> webNotification = adoptNS([[WebNotification alloc] initWithCoreNotification:notification notificationID:notificationID]);
+    m_notificationMap.set(notification, webNotification);
+
+    NotificationContextMap::iterator it = m_notificationContextMap.add(notification->scriptExecutionContext(), Vector<RetainPtr<WebNotification> >()).first;
+    it->second.append(webNotification);
+
+    [[m_webView _notificationProvider] showNotification:webNotification.get() fromWebView:m_webView];
+    return true;
+#else
+    UNUSED_PARAM(notification);
     return false;
+#endif
+}
+
+void WebNotificationClient::cancel(Notification* notification)
+{
+#if ENABLE(NOTIFICATIONS)
+    WebNotification *webNotification = m_notificationMap.get(notification).get();
+    if (!webNotification)
+        return;
+
+    [[m_webView _notificationProvider] cancelNotification:webNotification];
+#else
+    UNUSED_PARAM(notification);
+#endif
 }
 
-void WebNotificationClient::cancel(Notification*)
+void WebNotificationClient::clearNotifications(ScriptExecutionContext* context)
 {
-    notImplemented();
+#if ENABLE(NOTIFICATIONS)
+    NotificationContextMap::iterator it = m_notificationContextMap.find(context);
+    if (it == m_notificationContextMap.end())
+        return;
+    
+    Vector<RetainPtr<WebNotification> >& webNotifications = it->second;
+    NSMutableArray *nsIDs = [NSMutableArray array];
+    size_t count = webNotifications.size();
+    for (size_t i = 0; i < count; ++i) {
+        WebNotification *webNotification = webNotifications[i].get();
+        [nsIDs addObject:[NSNumber numberWithUnsignedLongLong:[webNotification notificationID]]];
+        m_notificationMap.remove(core(webNotification));
+    }
+
+    [[m_webView _notificationProvider] clearNotifications:nsIDs];
+    m_notificationContextMap.remove(it);
+#else
+    UNUSED_PARAM(context);
+#endif
 }
 
-void WebNotificationClient::notificationObjectDestroyed(WebCore::Notification*)
+void WebNotificationClient::notificationObjectDestroyed(Notification* notification)
 {
-    notImplemented();
+#if ENABLE(NOTIFICATIONS)
+    RetainPtr<WebNotification> webNotification = m_notificationMap.take(notification);
+    if (!webNotification)
+        return;
+
+    NotificationContextMap::iterator it = m_notificationContextMap.find(notification->scriptExecutionContext());
+    ASSERT(it != m_notificationContextMap.end());
+    size_t index = it->second.find(webNotification);
+    ASSERT(index != notFound);
+    it->second.remove(index);
+    if (it->second.isEmpty())
+        m_notificationContextMap.remove(it);
+
+    [[m_webView _notificationProvider] notificationDestroyed:webNotification.get()];
+#else
+    UNUSED_PARAM(notification);
+#endif
 }
 
 void WebNotificationClient::notificationControllerDestroyed()
 {
+#if ENABLE(NOTIFICATIONS)
+    [m_webView _notificationControllerDestroyed];
+#endif
     delete this;
 }
 
-void WebNotificationClient::requestPermission(WebCore::ScriptExecutionContext*, PassRefPtr<WebCore::VoidCallback>)
+void WebNotificationClient::requestPermission(ScriptExecutionContext* context, PassRefPtr<VoidCallback> callback)
 {
-    notImplemented();
+#if ENABLE(NOTIFICATIONS)
+    BEGIN_BLOCK_OBJC_EXCEPTIONS;
+    
+    SEL selector = @selector(webView:decidePolicyForNotificationRequestFromOrigin:listener:);
+    if (![[m_webView UIDelegate] respondsToSelector:selector])
+        return;
+    
+    WebSecurityOrigin *webOrigin = [[WebSecurityOrigin alloc] _initWithWebCoreSecurityOrigin:context->securityOrigin()];
+    WebNotificationPolicyListener* listener = [[WebNotificationPolicyListener alloc] initWithCallback:callback];
+    
+    CallUIDelegate(m_webView, selector, webOrigin, listener);
+    
+    [webOrigin release];
+    [listener release];
+    
+    END_BLOCK_OBJC_EXCEPTIONS;
+#else
+    UNUSED_PARAM(context);
+    UNUSED_PARAM(callback);
+#endif
 }
 
-void WebNotificationClient::cancelRequestsForPermission(WebCore::ScriptExecutionContext*)
+NotificationPresenter::Permission WebNotificationClient::checkPermission(ScriptExecutionContext* context)
 {
-    notImplemented();
+#if ENABLE(NOTIFICATIONS)
+    if (!context || !context->isDocument())
+        return NotificationPresenter::PermissionDenied;
+    if (![[m_webView preferences] notificationsEnabled])
+        return NotificationPresenter::PermissionDenied;
+    WebSecurityOrigin *webOrigin = [[WebSecurityOrigin alloc] _initWithWebCoreSecurityOrigin:context->securityOrigin()];
+    WebNotificationPermission permission = [[m_webView _notificationProvider] policyForOrigin:webOrigin];
+    [webOrigin release];
+    switch (permission) {
+        case WebNotificationPermissionAllowed:
+            return NotificationPresenter::PermissionAllowed;
+        case WebNotificationPermissionDenied:
+            return NotificationPresenter::PermissionDenied;
+        case WebNotificationPermissionNotAllowed:
+            return NotificationPresenter::PermissionNotAllowed;
+        default:
+            return NotificationPresenter::PermissionNotAllowed;
+    }
+#else
+    UNUSED_PARAM(context);
+    return NotificationPresenter::PermissionDenied;
+#endif
 }
 
-NotificationPresenter::Permission WebNotificationClient::checkPermission(WebCore::ScriptExecutionContext*)
+#if ENABLE(NOTIFICATIONS)
+@implementation WebNotificationPolicyListener
+- (id)initWithCallback:(PassRefPtr<VoidCallback>)callback
 {
-    notImplemented();
-    return NotificationPresenter::PermissionDenied;
+    if (!(self = [super init]))
+        return nil;
+
+    ASSERT(callback);
+    _callback = callback;
+    return self;
 }
+
+- (void)allow
+{
+    _callback->handleEvent();
+}
+
+- (void)deny
+{
+    _callback->handleEvent();
+}
+
+@end
+#endif
diff --git a/Source/WebKit/mac/WebCoreSupport/WebPlatformStrategies.h b/Source/WebKit/mac/WebCoreSupport/WebPlatformStrategies.h
index f1bd1a32c..4fde2b3b0 100644
--- a/Source/WebKit/mac/WebCoreSupport/WebPlatformStrategies.h
+++ b/Source/WebKit/mac/WebCoreSupport/WebPlatformStrategies.h
@@ -27,11 +27,12 @@
 #define WebPlatformStrategies_h
 
 #include <WebCore/CookiesStrategy.h>
+#include <WebCore/PasteboardStrategy.h>
 #include <WebCore/PlatformStrategies.h>
 #include <WebCore/PluginStrategy.h>
 #include <WebCore/VisitedLinkStrategy.h>
 
-class WebPlatformStrategies : public WebCore::PlatformStrategies, private WebCore::CookiesStrategy, private WebCore::PluginStrategy, private WebCore::VisitedLinkStrategy {
+class WebPlatformStrategies : public WebCore::PlatformStrategies, private WebCore::CookiesStrategy, private WebCore::PluginStrategy, private WebCore::VisitedLinkStrategy, private WebCore::PasteboardStrategy {
 public:
     static void initialize();
     
@@ -42,6 +43,7 @@ private:
     virtual WebCore::CookiesStrategy* createCookiesStrategy() OVERRIDE;
     virtual WebCore::PluginStrategy* createPluginStrategy() OVERRIDE;
     virtual WebCore::VisitedLinkStrategy* createVisitedLinkStrategy() OVERRIDE;
+    virtual WebCore::PasteboardStrategy* createPasteboardStrategy() OVERRIDE;
 
     // WebCore::CookiesStrategy
     virtual void notifyCookiesChanged() OVERRIDE;
@@ -53,6 +55,22 @@ private:
     // WebCore::VisitedLinkStrategy
     virtual bool isLinkVisited(WebCore::Page*, WebCore::LinkHash, const WebCore::KURL& baseURL, const WTF::AtomicString& attributeURL) OVERRIDE;
     virtual void addVisitedLink(WebCore::Page*, WebCore::LinkHash) OVERRIDE;
+    
+    // WebCore::PasteboardStrategy
+    virtual void getTypes(Vector<String>& types, const String& pasteboardName) OVERRIDE;
+    virtual PassRefPtr<WebCore::SharedBuffer> bufferForType(const String& pasteboardType, const String& pasteboardName) OVERRIDE;
+    virtual void getPathnamesForType(Vector<String>& pathnames, const String& pasteboardType, const String& pasteboardName) OVERRIDE;
+    virtual String stringForType(const String& pasteboardType, const String& pasteboardName) OVERRIDE;
+    virtual int changeCount(const String& pasteboardName) OVERRIDE;
+    virtual String uniqueName() OVERRIDE;
+    virtual WebCore::Color color(const String& pasteboardName) OVERRIDE;
+    
+    virtual void copy(const String& fromPasteboard, const String& toPasteboard) OVERRIDE;
+    virtual void setTypes(const Vector<String>& pasteboardTypes, const String& pasteboardName) OVERRIDE;
+    virtual void setBufferForType(PassRefPtr<WebCore::SharedBuffer>, const String& pasteboardType, const String& pasteboardName) OVERRIDE;
+    virtual void setPathnamesForType(const Vector<String>&, const String& pasteboardType, const String& pasteboardName) OVERRIDE;
+    virtual void setStringForType(const String&, const String& pasteboardType, const String& pasteboardName) OVERRIDE;
+    
 };
 
 #endif // WebPlatformStrategies_h
diff --git a/Source/WebKit/mac/WebCoreSupport/WebPlatformStrategies.mm b/Source/WebKit/mac/WebCoreSupport/WebPlatformStrategies.mm
index d1a4d9560..fc3035048 100644
--- a/Source/WebKit/mac/WebCoreSupport/WebPlatformStrategies.mm
+++ b/Source/WebKit/mac/WebCoreSupport/WebPlatformStrategies.mm
@@ -28,8 +28,10 @@
 #import "WebPluginDatabase.h"
 #import "WebPluginPackage.h"
 #import <WebCore/BlockExceptions.h>
+#import <WebCore/Color.h>
 #import <WebCore/Page.h>
 #import <WebCore/PageGroup.h>
+#import <WebCore/PlatformPasteboard.h>
 
 using namespace WebCore;
 
@@ -58,6 +60,11 @@ VisitedLinkStrategy* WebPlatformStrategies::createVisitedLinkStrategy()
     return this;
 }
 
+PasteboardStrategy* WebPlatformStrategies::createPasteboardStrategy()
+{
+    return this;
+}
+
 void WebPlatformStrategies::notifyCookiesChanged()
 {
 }
@@ -90,3 +97,63 @@ void WebPlatformStrategies::addVisitedLink(Page* page, LinkHash hash)
 {
     return page->group().addVisitedLinkHash(hash);
 }
+
+void WebPlatformStrategies::getTypes(Vector<String>& types, const String& pasteboardName)
+{
+    PlatformPasteboard(pasteboardName).getTypes(types);
+}
+
+PassRefPtr<WebCore::SharedBuffer> WebPlatformStrategies::bufferForType(const String& pasteboardType, const String& pasteboardName)
+{
+    return PlatformPasteboard(pasteboardName).bufferForType(pasteboardType);
+}
+
+void WebPlatformStrategies::getPathnamesForType(Vector<String>& pathnames, const String& pasteboardType, const String& pasteboardName)
+{
+    PlatformPasteboard(pasteboardName).getPathnamesForType(pathnames, pasteboardType);
+}
+
+String WebPlatformStrategies::stringForType(const String& pasteboardType, const String& pasteboardName)
+{
+    return PlatformPasteboard(pasteboardName).stringForType(pasteboardType);
+}
+
+void WebPlatformStrategies::copy(const String& fromPasteboard, const String& toPasteboard)
+{
+    PlatformPasteboard(toPasteboard).copy(fromPasteboard);
+}
+
+int WebPlatformStrategies::changeCount(const String &pasteboardName)
+{
+    return PlatformPasteboard(pasteboardName).changeCount();
+}
+
+String WebPlatformStrategies::uniqueName()
+{
+    return PlatformPasteboard::uniqueName();
+}
+
+Color WebPlatformStrategies::color(const String& pasteboardName)
+{
+    return PlatformPasteboard(pasteboardName).color();    
+}
+
+void WebPlatformStrategies::setTypes(const Vector<String>& pasteboardTypes, const String& pasteboardName)
+{
+    PlatformPasteboard(pasteboardName).setTypes(pasteboardTypes);
+}
+
+void WebPlatformStrategies::setBufferForType(PassRefPtr<SharedBuffer> buffer, const String& pasteboardType, const String& pasteboardName)
+{
+    PlatformPasteboard(pasteboardName).setBufferForType(buffer, pasteboardType);
+}
+
+void WebPlatformStrategies::setPathnamesForType(const Vector<String>& pathnames, const String& pasteboardType, const String& pasteboardName)
+{
+    PlatformPasteboard(pasteboardName).setPathnamesForType(pathnames, pasteboardType);
+}
+
+void WebPlatformStrategies::setStringForType(const String& string, const String& pasteboardType, const String& pasteboardName)
+{
+    PlatformPasteboard(pasteboardName).setStringForType(string, pasteboardType);    
+}
diff --git a/Source/WebKit/mac/WebCoreSupport/WebSecurityOrigin.mm b/Source/WebKit/mac/WebCoreSupport/WebSecurityOrigin.mm
index 2373f8464..8f38fed43 100644
--- a/Source/WebKit/mac/WebCoreSupport/WebSecurityOrigin.mm
+++ b/Source/WebKit/mac/WebCoreSupport/WebSecurityOrigin.mm
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2007, 2010 Apple Inc. All rights reserved.
+ * Copyright (C) 2007, 2010, 2012 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -66,6 +66,11 @@ using namespace WebCore;
     return reinterpret_cast<SecurityOrigin*>(_private)->databaseIdentifier();
 }
 
+- (NSString *)stringValue
+{
+    return reinterpret_cast<SecurityOrigin*>(_private)->toString();
+}
+
 // Deprecated. Use host instead. This needs to stay here until we ship a new Safari.
 - (NSString *)domain
 {
diff --git a/Source/WebKit/mac/WebCoreSupport/WebSecurityOriginPrivate.h b/Source/WebKit/mac/WebCoreSupport/WebSecurityOriginPrivate.h
index a784aba67..fae4c3382 100644
--- a/Source/WebKit/mac/WebCoreSupport/WebSecurityOriginPrivate.h
+++ b/Source/WebKit/mac/WebCoreSupport/WebSecurityOriginPrivate.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2007, 2010 Apple Inc.  All rights reserved.
+ * Copyright (C) 2007, 2010, 2012 Apple Inc.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -41,6 +41,7 @@
 - (NSString *)host;
 
 - (NSString *)databaseIdentifier;
+- (NSString *)stringValue;
 
 // Returns zero if the port is the default port for the protocol, non-zero otherwise.
 - (unsigned short)port;
diff --git a/Source/WebKit/mac/WebKit.order b/Source/WebKit/mac/WebKit.order
index 51b31e4a9..acd1a3755 100644
--- a/Source/WebKit/mac/WebKit.order
+++ b/Source/WebKit/mac/WebKit.order
@@ -2308,7 +2308,6 @@ __ZN3WTF6VectorINS_6RefPtrIN7WebCore14SecurityOriginEEELm0EED1Ev
 -[WebStorageManager syncLocalStorage]
 -[WebStorageManager deleteOrigin:]
 -[WebStorageManager diskUsageForOrigin:]
--[WebFrame(WebPrivate) _pauseSVGAnimation:onSMILNode:atTime:]
 __ZN3WTF6RefPtrIN7WebCore7ArchiveEED1Ev
 __ZN3WTF10RefCountedIN7WebCore7ArchiveEE5derefEv
 -[WebDataSource webArchive]
diff --git a/Source/WebKit/mac/WebView/WebFrame.mm b/Source/WebKit/mac/WebView/WebFrame.mm
index 9c15fafef..24bb8f39c 100644
--- a/Source/WebKit/mac/WebView/WebFrame.mm
+++ b/Source/WebKit/mac/WebView/WebFrame.mm
@@ -87,8 +87,6 @@
 #import <WebCore/ScriptValue.h>
 #import <WebCore/SecurityOrigin.h>
 #import <WebCore/SmartReplace.h>
-#import <WebCore/SVGDocumentExtensions.h>
-#import <WebCore/SVGSMILElement.h>
 #import <WebCore/TextIterator.h>
 #import <WebCore/ThreadCheck.h>
 #import <WebCore/TypingCommand.h>
@@ -801,7 +799,8 @@ static inline WebDataSource *dataSource(DocumentLoader* loader)
 {
     if (!_private->coreFrame)
         return;
-    _private->coreFrame->editor()->computeAndSetTypingStyle(core(style), undoAction);
+    // FIXME: We shouldn't have to create a copy here.
+    _private->coreFrame->editor()->computeAndSetTypingStyle(core(style)->copy().get(), undoAction);
 }
 
 - (void)_dragSourceEndedAt:(NSPoint)windowLoc operation:(NSDragOperation)operation
@@ -992,29 +991,6 @@ static inline WebDataSource *dataSource(DocumentLoader* loader)
     return controller->pauseTransitionAtTime(coreNode->renderer(), name, time);
 }
 
-// Pause a given SVG animation on the target node at a specific time.
-// This method is only intended to be used for testing the SVG animation system.
-- (BOOL)_pauseSVGAnimation:(NSString*)elementId onSMILNode:(DOMNode *)node atTime:(NSTimeInterval)time
-{
-#if ENABLE(SVG)
-    Frame* frame = core(self);
-    if (!frame)
-        return false;
- 
-    Document* document = frame->document();
-    if (!document || !document->svgExtensions())
-        return false;
-
-    Node* coreNode = core(node);
-    if (!coreNode || !SVGSMILElement::isSMILElement(coreNode))
-        return false;
-
-    return document->accessSVGExtensions()->sampleAnimationAtTime(elementId, static_cast<SVGSMILElement*>(coreNode), time);
-#else
-    return false;
-#endif
-}
-
 - (unsigned) _numberOfActiveAnimations
 {
     Frame* frame = core(self);
@@ -1484,7 +1460,7 @@ static NSURL *createUniqueWebDataURL()
     
     if (!MIMEType)
         MIMEType = @"text/html";
-    [self _loadData:data MIMEType:MIMEType textEncodingName:encodingName baseURL:baseURL unreachableURL:nil];
+    [self _loadData:data MIMEType:MIMEType textEncodingName:encodingName baseURL:[baseURL _webkit_URLFromURLOrPath] unreachableURL:nil];
 }
 
 - (void)_loadHTMLString:(NSString *)string baseURL:(NSURL *)baseURL unreachableURL:(NSURL *)unreachableURL
diff --git a/Source/WebKit/mac/WebView/WebFramePrivate.h b/Source/WebKit/mac/WebView/WebFramePrivate.h
index 98dbb706e..899ceeddf 100644
--- a/Source/WebKit/mac/WebView/WebFramePrivate.h
+++ b/Source/WebKit/mac/WebView/WebFramePrivate.h
@@ -104,10 +104,6 @@ typedef enum {
 - (BOOL)_pauseAnimation:(NSString*)name onNode:(DOMNode *)node atTime:(NSTimeInterval)time;
 - (BOOL)_pauseTransitionOfProperty:(NSString*)name onNode:(DOMNode*)node atTime:(NSTimeInterval)time;
 
-// Pause a given SVG animation on the target node at a specific time.
-// This method is only intended to be used for testing the SVG animation system.
-- (BOOL)_pauseSVGAnimation:(NSString*)elementId onSMILNode:(DOMNode *)node atTime:(NSTimeInterval)time;
-
 // Returns the total number of currently running animations (includes both CSS transitions and CSS animations).
 - (unsigned)_numberOfActiveAnimations;
 
diff --git a/Source/WebKit/mac/WebView/WebHTMLView.mm b/Source/WebKit/mac/WebView/WebHTMLView.mm
index 66f7b3aaf..7052fca0b 100644
--- a/Source/WebKit/mac/WebView/WebHTMLView.mm
+++ b/Source/WebKit/mac/WebView/WebHTMLView.mm
@@ -4352,14 +4352,10 @@ static PassRefPtr<KeyboardEvent> currentKeyboardEvent(Frame* coreFrame)
 
 - (void)_applyStyleToSelection:(DOMCSSStyleDeclaration *)style withUndoAction:(EditAction)undoAction
 {
-    if (Frame* coreFrame = core([self _frame]))
-        coreFrame->editor()->applyStyleToSelection(core(style), undoAction);
-}
-
-- (void)_applyParagraphStyleToSelection:(DOMCSSStyleDeclaration *)style withUndoAction:(EditAction)undoAction
-{
-    if (Frame* coreFrame = core([self _frame]))
-        coreFrame->editor()->applyParagraphStyleToSelection(core(style), undoAction);
+    if (Frame* coreFrame = core([self _frame])) {
+        // FIXME: We shouldn't have to make a copy here. We want callers of this function to work directly with StylePropertySet eventually.
+        coreFrame->editor()->applyStyleToSelection(core(style)->copy().get(), undoAction);
+    }
 }
 
 - (BOOL)_handleStyleKeyEquivalent:(NSEvent *)event
@@ -4657,9 +4653,13 @@ static PassRefPtr<KeyboardEvent> currentKeyboardEvent(Frame* coreFrame)
 {
     DOMCSSStyleDeclaration *style = [self _styleFromColorPanelWithSelector:selector];
     WebView *webView = [self _webView];
-    if ([[webView _editingDelegateForwarder] webView:webView shouldApplyStyle:style toElementsInDOMRange:range])
-        if (Frame* coreFrame = core([self _frame]))
-            coreFrame->editor()->applyStyle(core(style), [self _undoActionFromColorPanelWithSelector:selector]);
+    if ([[webView _editingDelegateForwarder] webView:webView shouldApplyStyle:style toElementsInDOMRange:range]) {
+        if (Frame* coreFrame = core([self _frame])) {
+            // FIXME: We shouldn't have to make a copy here.
+            coreFrame->editor()->applyStyle(core(style)->copy().get(), [self _undoActionFromColorPanelWithSelector:selector]);
+        }
+    }
+
 }
 
 - (void)changeDocumentBackgroundColor:(id)sender
diff --git a/Source/JavaScriptCore/bytecode/ValueProfile.cpp b/Source/WebKit/mac/WebView/WebNotification.h
index 2d7770aed..c04b2ad07 100644
--- a/Source/JavaScriptCore/bytecode/ValueProfile.cpp
+++ b/Source/WebKit/mac/WebView/WebNotification.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2011 Apple Inc. All rights reserved.
+ * Copyright (C) 2012 Apple Computer, Inc.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -26,27 +26,22 @@
  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#include "config.h"
-#include "ValueProfile.h"
+@class WebNotificationPrivate;
+@class WebSecurityOrigin;
 
-namespace JSC {
-
-#if ENABLE(VALUE_PROFILER)
-PredictedType ValueProfile::computeUpdatedPrediction()
+@interface WebNotification : NSObject
 {
-    for (unsigned i = 0; i < totalNumberOfBuckets; ++i) {
-        JSValue value = JSValue::decode(m_buckets[i]);
-        if (!value)
-            continue;
-        
-        m_numberOfSamplesInPrediction++;
-        mergePrediction(m_prediction, predictionFromValue(value));
-        
-        m_buckets[i] = JSValue::encode(JSValue());
-    }
-    
-    return m_prediction;
+    WebNotificationPrivate *_private;
 }
-#endif // ENABLE(VALUE_PROFILER)
 
-} // namespace JSC
+- (NSString *)title;
+- (NSString *)body;
+- (WebSecurityOrigin *)origin;
+- (uint64_t)notificationID;
+
+- (void)dispatchShowEvent;
+- (void)dispatchCloseEvent;
+- (void)dispatchClickEvent;
+- (void)dispatchErrorEvent;
+
+@end
diff --git a/Source/WebKit/mac/WebView/WebNotification.mm b/Source/WebKit/mac/WebView/WebNotification.mm
new file mode 100644
index 000000000..bbd0248f6
--- /dev/null
+++ b/Source/WebKit/mac/WebView/WebNotification.mm
@@ -0,0 +1,157 @@
+/*
+ * Copyright (C) 2012 Apple Computer, Inc.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#import "WebNotification.h"
+
+#import "WebNotificationInternal.h"
+
+#if ENABLE(NOTIFICATIONS)
+#import "WebSecurityOriginInternal.h"
+#import <WebCore/Notification.h>
+#import <WebCore/ScriptExecutionContext.h>
+#import <wtf/RefPtr.h>
+
+using namespace WebCore;
+#endif
+
+OBJC_CLASS WebNotificationInternal;
+
+@interface WebNotificationPrivate : NSObject
+{
+@public
+#if ENABLE(NOTIFICATIONS)
+    RefPtr<Notification> _internal;
+    uint64_t _notificationID;
+#endif
+}
+@end
+
+@implementation WebNotificationPrivate
+@end
+
+#if ENABLE(NOTIFICATIONS)
+@implementation WebNotification (WebNotificationInternal)
+Notification* core(WebNotification *notification)
+{
+    if (!notification->_private)
+        return 0;
+    return notification->_private->_internal.get();
+}
+
+- (id)initWithCoreNotification:(Notification*)coreNotification notificationID:(uint64_t)notificationID
+{
+    if (!(self = [super init]))
+        return nil;
+    _private = [[WebNotificationPrivate alloc] init];
+    _private->_internal = coreNotification;
+    _private->_notificationID = notificationID;
+    return self;
+}
+@end
+#endif
+
+@implementation WebNotification
+- (id)init
+{
+    return nil;
+}
+
+- (NSString *)title
+{
+#if ENABLE(NOTIFICATIONS)
+    ASSERT(core(self));
+    return core(self)->contents().title;
+#else
+    return nil;
+#endif
+}
+
+- (NSString *)body
+{
+#if ENABLE(NOTIFICATIONS)
+    ASSERT(core(self));
+    return core(self)->contents().body;
+#else
+    return nil;
+#endif
+}
+
+- (WebSecurityOrigin *)origin
+{
+#if ENABLE(NOTIFICATIONS)
+    ASSERT(core(self));
+    return [[[WebSecurityOrigin alloc] _initWithWebCoreSecurityOrigin:core(self)->scriptExecutionContext()->securityOrigin()] autorelease];
+#else
+    return nil;
+#endif
+}
+
+- (uint64_t)notificationID
+{
+#if ENABLE(NOTIFICATIONS)
+    ASSERT(core(self));
+    return _private->_notificationID;
+#else
+    return 0;
+#endif
+}
+
+- (void)dispatchShowEvent
+{
+#if ENABLE(NOTIFICATIONS)
+    ASSERT(core(self));
+    core(self)->dispatchShowEvent();
+#endif
+}
+
+- (void)dispatchCloseEvent
+{
+#if ENABLE(NOTIFICATIONS)
+    ASSERT(core(self));
+    core(self)->dispatchCloseEvent();
+#endif
+}
+
+- (void)dispatchClickEvent
+{
+#if ENABLE(NOTIFICATIONS)
+    ASSERT(core(self));
+    core(self)->dispatchClickEvent();
+#endif
+}
+
+- (void)dispatchErrorEvent
+{
+#if ENABLE(NOTIFICATIONS)
+    ASSERT(core(self));
+    core(self)->dispatchErrorEvent();
+#endif
+}
+
+@end
+
diff --git a/Source/WebKit/mac/WebView/WebNotificationInternal.h b/Source/WebKit/mac/WebView/WebNotificationInternal.h
new file mode 100644
index 000000000..b624069d9
--- /dev/null
+++ b/Source/WebKit/mac/WebView/WebNotificationInternal.h
@@ -0,0 +1,43 @@
+/*
+ * Copyright (C) 2012 Apple Computer, Inc.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#import "WebNotification.h"
+
+#if ENABLE(NOTIFICATIONS)
+
+namespace WebCore {
+class Notification;
+}
+
+WebCore::Notification* core(WebNotification *);
+
+@interface WebNotification (WebNotificationInternal)
+- (id)initWithCoreNotification:(WebCore::Notification*)coreNotification notificationID:(uint64_t)notificationID;
+@end
+
+#endif
diff --git a/Source/WebKit/mac/WebView/WebPreferenceKeysPrivate.h b/Source/WebKit/mac/WebView/WebPreferenceKeysPrivate.h
index 20e42ab3d..261a30e56 100644
--- a/Source/WebKit/mac/WebView/WebPreferenceKeysPrivate.h
+++ b/Source/WebKit/mac/WebView/WebPreferenceKeysPrivate.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2005 Apple Computer, Inc.  All rights reserved.
+ * Copyright (C) 2005, 2012 Apple Computer, Inc.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -95,6 +95,7 @@
 #define WebKitCanvasUsesAcceleratedDrawingPreferenceKey @"WebKitCanvasUsesAcceleratedDrawing"
 #define WebKitAcceleratedCompositingEnabledPreferenceKey @"WebKitAcceleratedCompositingEnabled"
 #define WebKitCSSCustomFilterEnabledPreferenceKey @"WebKitCSSCustomFilterEnabled"
+#define WebKitCSSRegionsEnabledPreferenceKey @"WebKitCSSRegionsEnabled"
 #define WebKitShowDebugBordersPreferenceKey @"WebKitShowDebugBorders"
 #define WebKitShowRepaintCounterPreferenceKey @"WebKitShowRepaintCounter"
 #define WebKitWebAudioEnabledPreferenceKey @"WebKitWebAudioEnabled"
@@ -116,6 +117,8 @@
 #define WebKitShouldDisplaySubtitlesPreferenceKey @"WebKitShouldDisplaySubtitles"
 #define WebKitShouldDisplayCaptionsPreferenceKey @"WebKitShouldDisplayCaptions"
 #define WebKitShouldDisplayTextDescriptionsPreferenceKey @"WebKitShouldDisplayTextDescriptions"
+#define WebKitNotificationsEnabledKey @"WebKitNotificationsEnabled"
+#define WebKitSuppressesIncrementalRenderingKey @"WebKitSuppressesIncrementalRendering"
 
 // These are private both because callers should be using the cover methods and because the
 // cover methods themselves are private.
@@ -130,7 +133,6 @@
 #define WebKitTextDirectionSubmenuInclusionBehaviorPreferenceKey @"WebKitTextDirectionSubmenuInclusionBehaviorPreferenceKey"
 #define WebKitEditingBehaviorPreferenceKey @"WebKitEditingBehavior"
 #define WebKitUsePreHTML5ParserQuirksKey @"WebKitUsePreHTML5ParserQuirks"
-#define WebKitSuppressIncrementalRenderingKey @"WebKitSuppressIncrementalRendering"
 #define WebKitBackspaceKeyNavigationEnabledKey @"WebKitBackspaceKeyNavigationEnabled"
 
 // CoreGraphics deferred updates are disabled if WebKitEnableCoalescedUpdatesPreferenceKey is set
diff --git a/Source/WebKit/mac/WebView/WebPreferences.h b/Source/WebKit/mac/WebView/WebPreferences.h
index 80cc9355a..6e01709f0 100644
--- a/Source/WebKit/mac/WebView/WebPreferences.h
+++ b/Source/WebKit/mac/WebView/WebPreferences.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2003, 2004, 2005 Apple Computer, Inc.  All rights reserved.
+ * Copyright (C) 2003, 2004, 2005, 2012 Apple Computer, Inc.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -431,4 +431,17 @@ caching behavior.
 */
 - (WebCacheModel)cacheModel;
 
+/*!
+    @method setSuppressesIncrementalRendering:
+    @param suppressesIncrementalRendering YES to suppress incremental rendering;
+    NO otherwise.
+*/
+- (void)setSuppressesIncrementalRendering:(BOOL)suppressesIncrementalRendering;
+
+/*!
+    @method suppressesIncrementalRendering
+    @result YES if the WebView suppresses incremental rendering; NO otherwise.
+*/
+- (BOOL)suppressesIncrementalRendering;
+
 @end
diff --git a/Source/WebKit/mac/WebView/WebPreferences.mm b/Source/WebKit/mac/WebView/WebPreferences.mm
index f49df5473..ed23910a9 100644
--- a/Source/WebKit/mac/WebView/WebPreferences.mm
+++ b/Source/WebKit/mac/WebView/WebPreferences.mm
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2005, 2006, 2007, 2011 Apple Inc. All rights reserved.
+ * Copyright (C) 2005, 2006, 2007, 2011, 2012 Apple Inc. All rights reserved.
  *           (C) 2006 Graham Dennis (graham.dennis@gmail.com)
  *
  * Redistribution and use in source and binary forms, with or without
@@ -369,6 +369,7 @@ static WebCacheModel cacheModelForMainBundle(void)
         [NSNumber numberWithBool:YES],  WebKitAcceleratedCompositingEnabledPreferenceKey,
         // CSS Shaders also need WebGL enabled (which is disabled by default), so we can keep it enabled for now.
         [NSNumber numberWithBool:YES], WebKitCSSCustomFilterEnabledPreferenceKey,
+        [NSNumber numberWithBool:YES], WebKitCSSRegionsEnabledPreferenceKey,
         [NSNumber numberWithBool:NO],  WebKitAcceleratedDrawingEnabledPreferenceKey,
         [NSNumber numberWithBool:NO],  WebKitCanvasUsesAcceleratedDrawingPreferenceKey,
         [NSNumber numberWithBool:NO],   WebKitShowDebugBordersPreferenceKey,
@@ -384,15 +385,16 @@ static WebCacheModel cacheModelForMainBundle(void)
         [NSNumber numberWithBool:YES],  WebKitHyperlinkAuditingEnabledPreferenceKey,
         [NSNumber numberWithBool:NO],   WebKitUsePreHTML5ParserQuirksKey,
         [NSNumber numberWithBool:YES],  WebKitAVFoundationEnabledKey,
-        [NSNumber numberWithBool:YES],  WebKitHixie76WebSocketProtocolEnabledKey,
+        [NSNumber numberWithBool:NO],  WebKitHixie76WebSocketProtocolEnabledKey,
         [NSNumber numberWithBool:NO],   WebKitMediaPlaybackRequiresUserGesturePreferenceKey,
         [NSNumber numberWithBool:YES],  WebKitMediaPlaybackAllowsInlinePreferenceKey,
         [NSNumber numberWithBool:NO],   WebKitWebAudioEnabledPreferenceKey,
-        [NSNumber numberWithBool:NO],   WebKitSuppressIncrementalRenderingKey,
+        [NSNumber numberWithBool:NO],   WebKitSuppressesIncrementalRenderingKey,
         [NSNumber numberWithBool:YES],  WebKitBackspaceKeyNavigationEnabledKey,
         [NSNumber numberWithBool:NO],   WebKitShouldDisplaySubtitlesPreferenceKey,
         [NSNumber numberWithBool:NO],   WebKitShouldDisplayCaptionsPreferenceKey,
         [NSNumber numberWithBool:NO],   WebKitShouldDisplayTextDescriptionsPreferenceKey,
+        [NSNumber numberWithBool:YES],  WebKitNotificationsEnabledKey,
 
         [NSNumber numberWithLongLong:ApplicationCacheStorage::noQuota()], WebKitApplicationCacheTotalQuota,
         [NSNumber numberWithLongLong:ApplicationCacheStorage::noQuota()], WebKitApplicationCacheDefaultOriginQuota,
@@ -806,6 +808,17 @@ static WebCacheModel cacheModelForMainBundle(void)
     return [self _integerValueForKey:WebKitCacheModelPreferenceKey];
 }
 
+
+- (void)setSuppressesIncrementalRendering:(BOOL)suppressesIncrementalRendering
+{
+    [self _setBoolValue:suppressesIncrementalRendering forKey:WebKitSuppressesIncrementalRenderingKey];
+}
+
+- (BOOL)suppressesIncrementalRendering
+{
+    return [self _boolValueForKey:WebKitSuppressesIncrementalRenderingKey];
+}
+
 @end
 
 @implementation WebPreferences (WebPrivate)
@@ -1335,6 +1348,16 @@ static NSString *classIBCreatorID = nil;
     [self _setBoolValue:enabled forKey:WebKitCSSCustomFilterEnabledPreferenceKey];
 }
 
+- (BOOL)cssRegionsEnabled
+{
+    return [self _boolValueForKey:WebKitCSSRegionsEnabledPreferenceKey];
+}
+
+- (void)setCSSRegionsEnabled:(BOOL)enabled
+{
+    [self _setBoolValue:enabled forKey:WebKitCSSRegionsEnabledPreferenceKey];
+}
+
 - (BOOL)showDebugBorders
 {
     return [self _boolValueForKey:WebKitShowDebugBordersPreferenceKey];
@@ -1583,12 +1606,12 @@ static NSString *classIBCreatorID = nil;
 
 - (void)setSuppressIncrementalRendering:(BOOL)flag
 {
-    [self _setBoolValue:flag forKey:WebKitSuppressIncrementalRenderingKey];
+    [self _setBoolValue:flag forKey:WebKitSuppressesIncrementalRenderingKey];
 }
 
 - (BOOL)suppressIncrementalRendering
 {
-    return [self _boolValueForKey:WebKitSuppressIncrementalRenderingKey];
+    return [self _boolValueForKey:WebKitSuppressesIncrementalRenderingKey];
 }
 
 - (void)setBackspaceKeyNavigationEnabled:(BOOL)flag
@@ -1631,6 +1654,16 @@ static NSString *classIBCreatorID = nil;
     return [self _boolValueForKey:WebKitShouldDisplayTextDescriptionsPreferenceKey];
 }
 
+- (void)setNotificationsEnabled:(BOOL)flag
+{
+    [self _setBoolValue:flag forKey:WebKitNotificationsEnabledKey];
+}
+
+- (BOOL)notificationsEnabled
+{
+    return [self _boolValueForKey:WebKitNotificationsEnabledKey];
+}
+
 @end
 
 @implementation WebPreferences (WebInternal)
diff --git a/Source/WebKit/mac/WebView/WebPreferencesPrivate.h b/Source/WebKit/mac/WebView/WebPreferencesPrivate.h
index 305434ffb..29a8be125 100644
--- a/Source/WebKit/mac/WebView/WebPreferencesPrivate.h
+++ b/Source/WebKit/mac/WebView/WebPreferencesPrivate.h
@@ -189,6 +189,9 @@ extern NSString *WebPreferencesChangedInternalNotification;
 - (BOOL)cssCustomFilterEnabled;
 - (void)setCSSCustomFilterEnabled:(BOOL)enabled;
 
+- (BOOL)cssRegionsEnabled;
+- (void)setCSSRegionsEnabled:(BOOL)enabled;
+
 - (BOOL)showDebugBorders;
 - (void)setShowDebugBorders:(BOOL)show;
 
@@ -271,6 +274,7 @@ extern NSString *WebPreferencesChangedInternalNotification;
 - (void)setHixie76WebSocketProtocolEnabled:(BOOL)flag;
 - (BOOL)isHixie76WebSocketProtocolEnabled;
 
+// Deprecated. You should use [setS|s]uppressesIncrementalRendering in WebPreferences.h instead.
 - (void)setSuppressIncrementalRendering:(BOOL)flag;
 - (BOOL)suppressIncrementalRendering;
 
@@ -286,4 +290,7 @@ extern NSString *WebPreferencesChangedInternalNotification;
 - (void)setShouldDisplayTextDescriptions:(BOOL)flag;
 - (BOOL)shouldDisplayTextDescriptions;
 
+- (void)setNotificationsEnabled:(BOOL)flag;
+- (BOOL)notificationsEnabled;
+
 @end
diff --git a/Source/WebKit/mac/WebView/WebUIDelegatePrivate.h b/Source/WebKit/mac/WebView/WebUIDelegatePrivate.h
index 9c98fdfcc..9f1801961 100644
--- a/Source/WebKit/mac/WebView/WebUIDelegatePrivate.h
+++ b/Source/WebKit/mac/WebView/WebUIDelegatePrivate.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2005, 2006, 2007, 2008, 2009, 2010 Apple Inc. All rights reserved.
+ * Copyright (C) 2005, 2006, 2007, 2008, 2009, 2010, 2012 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -117,9 +117,11 @@ extern NSString *WebConsoleMessageWarningMessageLevel;
 extern NSString *WebConsoleMessageErrorMessageLevel;
 extern NSString *WebConsoleMessageDebugMessageLevel;
 
+@class DOMElement;
+@class DOMNode;
 @class WebSecurityOrigin;
 
-@protocol WebGeolocationPolicyListener <NSObject>
+@protocol WebAllowDenyPolicyListener <NSObject>
 - (void)allow;
 - (void)deny;
 @end
@@ -223,7 +225,8 @@ extern NSString *WebConsoleMessageDebugMessageLevel;
 */
 - (void)webView:(WebView *)webView decidePolicyForGeolocationRequestFromOrigin:(WebSecurityOrigin *)origin
                                                                          frame:(WebFrame *)frame
-                                                                      listener:(id<WebGeolocationPolicyListener>)listener;
+                                                                      listener:(id<WebAllowDenyPolicyListener>)listener;
+- (void)webView:(WebView *)webView decidePolicyForNotificationRequestFromOrigin:(WebSecurityOrigin *)origin listener:(id<WebAllowDenyPolicyListener>)listener;
 
 - (void)webView:(WebView *)sender elementDidFocusNode:(DOMNode *)node;
 - (void)webView:(WebView *)sender elementDidBlurNode:(DOMNode *)node;
diff --git a/Source/WebKit/mac/WebView/WebView.mm b/Source/WebKit/mac/WebView/WebView.mm
index 4525cba9f..9b722026e 100644
--- a/Source/WebKit/mac/WebView/WebView.mm
+++ b/Source/WebKit/mac/WebView/WebView.mm
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2005, 2006, 2007, 2008, 2009, 2010, 2011 Apple Inc. All rights reserved.
+ * Copyright (C) 2005-2012 Apple Inc. All rights reserved.
  * Copyright (C) 2006 David Smith (catfish.man@gmail.com)
  * Copyright (C) 2010 Igalia S.L
  *
@@ -742,13 +742,13 @@ static NSString *leakOutlookQuirksUserScriptContents()
 #if ENABLE(CLIENT_BASED_GEOLOCATION)
     pageClients.geolocationClient = new WebGeolocationClient(self);
 #endif
+    _private->page = new Page(pageClients);
 #if ENABLE(NOTIFICATIONS)
-    pageClients.notificationClient = new WebNotificationClient(self);
+    WebCore::provideNotification(_private->page, new WebNotificationClient(self));
 #endif
 #if ENABLE(DEVICE_ORIENTATION)
-    pageClients.deviceOrientationClient = new WebDeviceOrientationClient(self);
+    WebCore::provideDeviceOrientationTo(_private->page, new WebDeviceOrientationClient(self));
 #endif
-    _private->page = new Page(pageClients);
 
     _private->page->setCanStartMedia([self window]);
     _private->page->settings()->setLocalStorageDatabasePath([[self preferences] _localStorageDatabasePath]);
@@ -1322,6 +1322,13 @@ static bool fastDocumentTeardownEnabled()
     return needsQuirk;
 }
 
+- (BOOL)_needsIsLoadingInAPISenseQuirk
+{
+    static BOOL needsQuirk = WKAppVersionCheckLessThan(@"com.apple.iAdProducer", -1, 2.1);
+    
+    return needsQuirk;
+}
+
 - (BOOL)_needsKeyboardEventDisambiguationQuirks
 {
     static BOOL needsQuirks = !WebKitLinkedOnOrAfter(WEBKIT_FIRST_VERSION_WITH_IE_COMPATIBLE_KEYBOARD_EVENT_DISPATCH) && !applicationIsSafari();
@@ -1474,6 +1481,7 @@ static bool needsSelfRetainWhileLoadingQuirk()
 #if ENABLE(CSS_SHADERS)
     settings->setCSSCustomFilterEnabled([preferences cssCustomFilterEnabled]);
 #endif
+    settings->setCSSRegionsEnabled([preferences cssRegionsEnabled]);
 #if ENABLE(FULLSCREEN_API)
     settings->setFullScreenEnabled([preferences fullScreenEnabled]);
 #endif
@@ -1499,7 +1507,7 @@ static bool needsSelfRetainWhileLoadingQuirk()
 #endif
     settings->setMediaPlaybackRequiresUserGesture([preferences mediaPlaybackRequiresUserGesture]);
     settings->setMediaPlaybackAllowsInline([preferences mediaPlaybackAllowsInline]);
-    settings->setSuppressIncrementalRendering([preferences suppressIncrementalRendering]);
+    settings->setSuppressesIncrementalRendering([preferences suppressesIncrementalRendering]);
     settings->setBackspaceKeyNavigationEnabled([preferences backspaceKeyNavigationEnabled]);
     settings->setMockScrollbarsEnabled([preferences mockScrollbarsEnabled]);
 
@@ -1509,6 +1517,8 @@ static bool needsSelfRetainWhileLoadingQuirk()
     settings->setShouldDisplayTextDescriptions([preferences shouldDisplayTextDescriptions]);
 #endif
 
+    settings->setNeedsIsLoadingInAPISenseQuirk([self _needsIsLoadingInAPISenseQuirk]);
+
     // Application Cache Preferences are stored on the global cache storage manager, not in Settings.
     [WebApplicationCache setDefaultOriginQuota:[preferences applicationCacheDefaultOriginQuota]];
 
@@ -5516,8 +5526,9 @@ static NSAppleEventDescriptor* aeDescFromJSValue(ExecState* exec, JSValue jsValu
     // change the API to allow this.
     WebFrame *webFrame = [self _selectedOrMainFrame];
     Frame* coreFrame = core(webFrame);
+    // FIXME: We shouldn't have to make a copy here.
     if (coreFrame)
-        coreFrame->editor()->applyStyle(core(style));
+        coreFrame->editor()->applyStyle(core(style)->copy().get());
 }
 
 @end
@@ -6401,6 +6412,43 @@ static void glibContextIterationCallback(CFRunLoopObserverRef, CFRunLoopActivity
 
 @end
 
+@implementation WebView (WebViewNotification)
+- (void)_setNotificationProvider:(id<WebNotificationProvider>)notificationProvider
+{
+    if (_private) {
+        _private->_notificationProvider = notificationProvider;
+        [_private->_notificationProvider registerWebView:self];
+    }
+}
+
+- (void)_notificationControllerDestroyed
+{
+    [[self _notificationProvider] unregisterWebView:self];
+}
+
+- (id<WebNotificationProvider>)_notificationProvider
+{
+    if (_private)
+        return _private->_notificationProvider;
+    return nil;
+}
+
+- (void)_notificationDidShow:(uint64_t)notificationID
+{
+    [[self _notificationProvider] webView:self didShowNotification:notificationID];
+}
+
+- (void)_notificationDidClick:(uint64_t)notificationID
+{
+    [[self _notificationProvider] webView:self didClickNotification:notificationID];
+}
+
+- (void)_notificationsDidClose:(NSArray *)notificationIDs
+{
+    [[self _notificationProvider] webView:self didCloseNotifications:notificationIDs];
+}
+@end
+
 @implementation WebView (WebViewPrivateStyleInfo)
 
 - (JSValueRef)_computedStyleIncludingVisitedInfo:(JSContextRef)context forElement:(JSValueRef)value
@@ -6414,7 +6462,7 @@ static void glibContextIterationCallback(CFRunLoopObserverRef, CFRunLoopActivity
         return JSValueMakeUndefined(context);
     JSElement* jsElement = static_cast<JSElement*>(asObject(jsValue));
     Element* element = jsElement->impl();
-    RefPtr<CSSComputedStyleDeclaration> style = computedStyle(element, true);
+    RefPtr<CSSComputedStyleDeclaration> style = CSSComputedStyleDeclaration::create(element, true);
     return toRef(exec, toJS(exec, jsElement->globalObject(), style.get()));
 }
 
diff --git a/Source/WebKit/mac/WebView/WebViewData.h b/Source/WebKit/mac/WebView/WebViewData.h
index 665cb9175..ea2bfcf60 100644
--- a/Source/WebKit/mac/WebView/WebViewData.h
+++ b/Source/WebKit/mac/WebView/WebViewData.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2005, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2005, 2006, 2007, 2008, 2009, 2012 Apple Inc. All rights reserved.
  * Copyright (C) 2010 Igalia S.L
  *
  * Redistribution and use in source and binary forms, with or without
@@ -50,6 +50,7 @@ namespace WebCore {
 @protocol WebFormDelegate;
 @protocol WebDeviceOrientationProvider;
 @protocol WebGeolocationProvider;
+@protocol WebNotificationProvider;
 #if ENABLE(VIDEO)
 @class WebVideoFullscreenController;
 #endif
@@ -191,6 +192,7 @@ private:
 #endif
     id<WebGeolocationProvider> _geolocationProvider;
     id<WebDeviceOrientationProvider> m_deviceOrientationProvider;
+    id<WebNotificationProvider> _notificationProvider;
 
     RefPtr<WebCore::HistoryItem> _globalHistoryItem;
 
diff --git a/Source/WebKit/mac/WebView/WebViewPrivate.h b/Source/WebKit/mac/WebView/WebViewPrivate.h
index cd92f31e5..e0fee81d1 100644
--- a/Source/WebKit/mac/WebView/WebViewPrivate.h
+++ b/Source/WebKit/mac/WebView/WebViewPrivate.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2005, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2005-2012 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -39,8 +39,10 @@
 @class WebDeviceOrientation;
 @class WebGeolocationPosition;
 @class WebInspector;
+@class WebNotification;
 @class WebPreferences;
 @class WebScriptWorld;
+@class WebSecurityOrigin;
 @class WebTextIterator;
 
 @protocol WebDeviceOrientationProvider;
@@ -104,6 +106,13 @@ typedef enum {
     WebPaginationModeVertical,
 } WebPaginationMode;
 
+// This needs to be in sync with WebCore::NotificationPresenter::Permission
+typedef enum {
+    WebNotificationPermissionAllowed,
+    WebNotificationPermissionNotAllowed,
+    WebNotificationPermissionDenied
+} WebNotificationPermission;
+
 @interface WebController : NSTreeController {
     IBOutlet WebView *webView;
 }
@@ -701,6 +710,21 @@ Could be worth adding to the API.
 - (WebGeolocationPosition *)lastPosition;
 @end
 
+@protocol WebNotificationProvider
+- (void)registerWebView:(WebView *)webView;
+- (void)unregisterWebView:(WebView *)webView;
+
+- (void)showNotification:(WebNotification *)notification fromWebView:(WebView *)webView;
+- (void)cancelNotification:(WebNotification *)notification;
+- (void)notificationDestroyed:(WebNotification *)notification;
+- (void)clearNotifications:(NSArray *)notificationIDs;
+- (WebNotificationPermission)policyForOrigin:(WebSecurityOrigin *)origin;
+
+- (void)webView:(WebView *)webView didShowNotification:(uint64_t)notificationID;
+- (void)webView:(WebView *)webView didClickNotification:(uint64_t)notificationID;
+- (void)webView:(WebView *)webView didCloseNotifications:(NSArray *)notificationIDs;
+@end
+
 @interface WebView (WebViewGeolocation)
 - (void)_setGeolocationProvider:(id<WebGeolocationProvider>)locationProvider;
 - (id<WebGeolocationProvider>)_geolocationProvider;
@@ -709,6 +733,16 @@ Could be worth adding to the API.
 - (void)_geolocationDidFailWithError:(NSError *)error;
 @end
 
+@interface WebView (WebViewNotification)
+- (void)_setNotificationProvider:(id<WebNotificationProvider>)notificationProvider;
+- (id<WebNotificationProvider>)_notificationProvider;
+- (void)_notificationControllerDestroyed;
+
+- (void)_notificationDidShow:(uint64_t)notificationID;
+- (void)_notificationDidClick:(uint64_t)notificationID;
+- (void)_notificationsDidClose:(NSArray *)notificationIDs;
+@end
+
 @interface WebView (WebViewPrivateStyleInfo)
 - (JSValueRef)_computedStyleIncludingVisitedInfo:(JSContextRef)context forElement:(JSValueRef)value;
 @end
diff --git a/Source/WebKit/qt/Api/qgraphicswebview.cpp b/Source/WebKit/qt/Api/qgraphicswebview.cpp
index c1eb5293a..3f6fe1471 100644
--- a/Source/WebKit/qt/Api/qgraphicswebview.cpp
+++ b/Source/WebKit/qt/Api/qgraphicswebview.cpp
@@ -288,13 +288,13 @@ void QGraphicsWebView::paint(QPainter* painter, const QStyleOptionGraphicsItem*
 #if USE(TILED_BACKING_STORE)
     if (WebCore::TiledBackingStore* backingStore = QWebFramePrivate::core(page()->mainFrame())->tiledBackingStore()) {
         // FIXME: We should set the backing store viewport earlier than in paint
-        backingStore->adjustVisibleRect();
+        backingStore->coverWithTilesIfNeeded();
         // QWebFrame::render is a public API, bypass it for tiled rendering so behavior does not need to change.
-        WebCore::GraphicsContext context(painter); 
+        WebCore::GraphicsContext context(painter);
         page()->mainFrame()->d->renderFromTiledBackingStore(&context, option->exposedRect.toAlignedRect());
         painter->setRenderHints(oldHints);
         return;
-    } 
+    }
 #endif
 #if USE(ACCELERATED_COMPOSITING) && !USE(TEXTURE_MAPPER)
     page()->mainFrame()->render(painter, d->overlay() ? QWebFrame::ContentsLayer : QWebFrame::AllLayers, option->exposedRect.toAlignedRect());
@@ -312,7 +312,11 @@ bool QGraphicsWebView::sceneEvent(QEvent* event)
 
     if (d->page && (event->type() == QEvent::TouchBegin
                 || event->type() == QEvent::TouchEnd
-                || event->type() == QEvent::TouchUpdate)) {
+                || event->type() == QEvent::TouchUpdate
+#if QT_VERSION >= QT_VERSION_CHECK(5, 0, 0)
+                || event->type() == QEvent::TouchCancel
+#endif
+       )) {
         d->page->event(event);
 
         // Always return true so that we'll receive also TouchUpdate and TouchEnd events
diff --git a/Source/WebKit/qt/Api/qwebelement.cpp b/Source/WebKit/qt/Api/qwebelement.cpp
index 178c70e5b..40c69f4bf 100644
--- a/Source/WebKit/qt/Api/qwebelement.cpp
+++ b/Source/WebKit/qt/Api/qwebelement.cpp
@@ -882,7 +882,7 @@ QString QWebElement::styleProperty(const QString &name, StyleResolveStrategy str
 
         int propID = cssPropertyID(name);
 
-        RefPtr<CSSComputedStyleDeclaration> style = computedStyle(m_element, true);
+        RefPtr<CSSComputedStyleDeclaration> style = CSSComputedStyleDeclaration::create(m_element, true);
         if (!propID || !style)
             return QString();
 
diff --git a/Source/WebKit/qt/Api/qwebframe.cpp b/Source/WebKit/qt/Api/qwebframe.cpp
index 39b9d20d4..211f0ef20 100644
--- a/Source/WebKit/qt/Api/qwebframe.cpp
+++ b/Source/WebKit/qt/Api/qwebframe.cpp
@@ -104,7 +104,7 @@
 #endif
 #if USE(TEXTURE_MAPPER)
 #include "texmap/TextureMapper.h"
-#include "texmap/TextureMapperNode.h"
+#include "texmap/TextureMapperLayer.h"
 #endif
 #include "wtf/HashMap.h"
 #include <QMultiMap>
@@ -331,7 +331,7 @@ void QWebFramePrivate::renderFromTiledBackingStore(GraphicsContext* context, con
 #if USE(ACCELERATED_COMPOSITING) && USE(TEXTURE_MAPPER)
 void QWebFramePrivate::renderCompositedLayers(GraphicsContext* context, const IntRect& clip)
 {
-    if (!rootTextureMapperNode || !textureMapper)
+    if (!rootTextureMapperLayer || !textureMapper)
         return;
 
     textureMapper->setGraphicsContext(context);
@@ -345,11 +345,11 @@ void QWebFramePrivate::renderCompositedLayers(GraphicsContext* context, const In
                 0, 0, 1, 0,
                 transform.m31(), transform.m32(), 0, transform.m33()
                 );
-    rootTextureMapperNode->setTransform(matrix);
-    rootTextureMapperNode->setOpacity(painter->opacity());
+    rootTextureMapperLayer->setTransform(matrix);
+    rootTextureMapperLayer->setOpacity(painter->opacity());
     textureMapper->beginPainting();
     textureMapper->beginClip(matrix, clip);
-    rootTextureMapperNode->paint();
+    rootTextureMapperLayer->paint();
     textureMapper->endClip();
     textureMapper->endPainting();
 }
diff --git a/Source/WebKit/qt/Api/qwebframe.h b/Source/WebKit/qt/Api/qwebframe.h
index 35fce4beb..ff157771f 100644
--- a/Source/WebKit/qt/Api/qwebframe.h
+++ b/Source/WebKit/qt/Api/qwebframe.h
@@ -60,7 +60,7 @@ namespace WebCore {
     class WidgetPrivate;
     class FrameLoaderClientQt;
     class ChromeClientQt;
-    class TextureMapperNodeClientQt;
+    class TextureMapperLayerClientQt;
 }
 class QWebFrameData;
 class QWebHitTestResultPrivate;
@@ -234,7 +234,7 @@ private:
     friend class WebCore::WidgetPrivate;
     friend class WebCore::FrameLoaderClientQt;
     friend class WebCore::ChromeClientQt;
-    friend class WebCore::TextureMapperNodeClientQt;
+    friend class WebCore::TextureMapperLayerClientQt;
     QWebFramePrivate *d;
     Q_PRIVATE_SLOT(d, void _q_orientationChanged())
 };
diff --git a/Source/WebKit/qt/Api/qwebframe_p.h b/Source/WebKit/qt/Api/qwebframe_p.h
index 1dba6a59e..4ab7b9700 100644
--- a/Source/WebKit/qt/Api/qwebframe_p.h
+++ b/Source/WebKit/qt/Api/qwebframe_p.h
@@ -49,7 +49,7 @@ namespace WebCore {
     class FrameView;
     class HTMLFrameOwnerElement;
     class Scrollbar;
-    class TextureMapperNode;
+    class TextureMapperLayer;
 }
 class QWebPage;
 
@@ -85,7 +85,7 @@ public:
         , marginWidth(-1)
         , marginHeight(-1)
 #if USE(ACCELERATED_COMPOSITING) && USE(TEXTURE_MAPPER)
-        , rootTextureMapperNode(0)
+        , rootTextureMapperLayer(0)
 #endif
         {}
     void init(QWebFrame* qframe, QWebFrameData* frameData);
@@ -125,7 +125,7 @@ public:
     int marginWidth;
     int marginHeight;
 #if USE(ACCELERATED_COMPOSITING) && USE(TEXTURE_MAPPER)
-    WebCore::TextureMapperNode* rootTextureMapperNode;
+    WebCore::TextureMapperLayer* rootTextureMapperLayer;
     OwnPtr<WebCore::TextureMapper> textureMapper;
 #endif
 
diff --git a/Source/WebKit/qt/Api/qwebpage.cpp b/Source/WebKit/qt/Api/qwebpage.cpp
index f94d44589..898899bf5 100644
--- a/Source/WebKit/qt/Api/qwebpage.cpp
+++ b/Source/WebKit/qt/Api/qwebpage.cpp
@@ -105,6 +105,7 @@
 #include "RenderThemeQt.h"
 #include "SchemeRegistry.h"
 #include "Scrollbar.h"
+#include "ScrollbarTheme.h"
 #include "SecurityOrigin.h"
 #include "Settings.h"
 #if defined Q_OS_WIN32
@@ -112,9 +113,11 @@
 #endif // Q_OS_WIN32
 #include "TextIterator.h"
 #include "UtilsQt.h"
+#include "WebEventConversion.h"
 #include "WindowFeatures.h"
 #include "WorkerThread.h"
 
+#include <QAction>
 #include <QApplication>
 #include <QBasicTimer>
 #include <QBitArray>
@@ -126,6 +129,7 @@
 #include <QDropEvent>
 #include <QFileDialog>
 #include <QInputDialog>
+#include <QMenu>
 #include <QMessageBox>
 #include <QNetworkProxy>
 #include <QUndoStack>
@@ -322,24 +326,23 @@ QWebPagePrivate::QWebPagePrivate(QWebPage *qq)
     pageClients.editorClient = new EditorClientQt(q);
     pageClients.dragClient = new DragClientQt(q);
     pageClients.inspectorClient = new InspectorClientQt(q);
-#if ENABLE(DEVICE_ORIENTATION)
-    if (useMock)
-        pageClients.deviceOrientationClient = new DeviceOrientationClientMock;
-    else
-        pageClients.deviceOrientationClient = new DeviceOrientationClientQt;
-
-    pageClients.deviceMotionClient = new DeviceMotionClientQt;
-#endif
 #if ENABLE(CLIENT_BASED_GEOLOCATION)
     if (useMock)
         pageClients.geolocationClient = new GeolocationClientMock;
     else
         pageClients.geolocationClient = new GeolocationClientQt(q);
 #endif
+    page = new Page(pageClients);
+#if ENABLE(DEVICE_ORIENTATION)
+    if (useMock)
+        WebCore::provideDeviceOrientationTo(page, new DeviceOrientationClientMock);
+    else
+        WebCore::provideDeviceOrientationTo(page, new DeviceOrientationClientQt);
+    WebCore::provideDeviceMotionTo(page, new DeviceMotionClientQt);
+#endif
 #if ENABLE(NOTIFICATIONS)
-    pageClients.notificationClient = NotificationPresenterClientQt::notificationPresenter();
+    WebCore::provideNotification(page, NotificationPresenterClientQt::notificationPresenter());
 #endif
-    page = new Page(pageClients);
 
     // By default each page is put into their own unique page group, which affects popup windows
     // and visited links. Page groups (per process only) is a feature making it possible to use
@@ -677,7 +680,7 @@ void QWebPagePrivate::mouseMoveEvent(T* ev)
     if (!frame->view())
         return;
 
-    bool accepted = frame->eventHandler()->mouseMoved(PlatformMouseEvent(ev, 0));
+    bool accepted = frame->eventHandler()->mouseMoved(convertMouseEvent(ev, 0));
     ev->setAccepted(accepted);
 }
 
@@ -702,7 +705,7 @@ void QWebPagePrivate::mousePressEvent(T* ev)
 
     bool accepted = false;
     adjustPointForClicking(ev);
-    PlatformMouseEvent mev(ev, 1);
+    PlatformMouseEvent mev = convertMouseEvent(ev, 1);
     // ignore the event if we can't map Qt's mouse buttons to WebCore::MouseButton
     if (mev.button() != NoButton)
         accepted = frame->eventHandler()->handleMousePressEvent(mev);
@@ -725,7 +728,7 @@ void QWebPagePrivate::mouseDoubleClickEvent(T *ev)
         return;
 
     bool accepted = false;
-    PlatformMouseEvent mev(ev, 2);
+    PlatformMouseEvent mev = convertMouseEvent(ev, 2);
     // ignore the event if we can't map Qt's mouse buttons to WebCore::MouseButton
     if (mev.button() != NoButton)
         accepted = frame->eventHandler()->handleMousePressEvent(mev);
@@ -743,7 +746,7 @@ void QWebPagePrivate::mouseTripleClickEvent(T *ev)
         return;
 
     bool accepted = false;
-    PlatformMouseEvent mev(ev, 3);
+    PlatformMouseEvent mev = convertMouseEvent(ev, 3);
     // ignore the event if we can't map Qt's mouse buttons to WebCore::MouseButton
     if (mev.button() != NoButton)
         accepted = frame->eventHandler()->handleMousePressEvent(mev);
@@ -782,7 +785,7 @@ void QWebPagePrivate::mouseReleaseEvent(T *ev)
 
     bool accepted = false;
     adjustPointForClicking(ev);
-    PlatformMouseEvent mev(ev, 0);
+    PlatformMouseEvent mev = convertMouseEvent(ev, 0);
     // ignore the event if we can't map Qt's mouse buttons to WebCore::MouseButton
     if (mev.button() != NoButton)
         accepted = frame->eventHandler()->handleMouseReleaseEvent(mev);
@@ -852,7 +855,7 @@ void QWebPagePrivate::wheelEvent(T *ev)
     if (!frame->view())
         return;
 
-    WebCore::PlatformWheelEvent pev(ev);
+    PlatformWheelEvent pev = convertWheelEvent(ev);
     bool accepted = frame->eventHandler()->handleWheelEvent(pev);
     ev->setAccepted(accepted);
 }
@@ -1199,43 +1202,6 @@ void QWebPagePrivate::dynamicPropertyChangeEvent(QDynamicPropertyChangeEvent* ev
             }
         }
     }
-#if USE(TILED_BACKING_STORE)
-    else if (event->propertyName() == "_q_TiledBackingStoreTileSize") {
-        WebCore::Frame* frame = QWebFramePrivate::core(q->mainFrame());
-        if (!frame->tiledBackingStore())
-            return;
-        QSize tileSize = q->property("_q_TiledBackingStoreTileSize").toSize();
-        frame->tiledBackingStore()->setTileSize(tileSize);
-    } else if (event->propertyName() == "_q_TiledBackingStoreTileCreationDelay") {
-        WebCore::Frame* frame = QWebFramePrivate::core(q->mainFrame());
-        if (!frame->tiledBackingStore())
-            return;
-        int tileCreationDelay = q->property("_q_TiledBackingStoreTileCreationDelay").toInt();
-        frame->tiledBackingStore()->setTileCreationDelay(static_cast<double>(tileCreationDelay) / 1000.);
-    } else if (event->propertyName() == "_q_TiledBackingStoreKeepAreaMultiplier") {
-        WebCore::Frame* frame = QWebFramePrivate::core(q->mainFrame());
-        if (!frame->tiledBackingStore())
-            return;
-        float keepMultiplier;
-        float coverMultiplier;
-        frame->tiledBackingStore()->getKeepAndCoverAreaMultipliers(keepMultiplier, coverMultiplier);
-        QSizeF qSize = q->property("_q_TiledBackingStoreKeepAreaMultiplier").toSizeF();
-        // setKeepAndCoverAreaMultipliers do not use FloatSize anymore, keep only the height part.
-        keepMultiplier = qSize.height();
-        frame->tiledBackingStore()->setKeepAndCoverAreaMultipliers(keepMultiplier, coverMultiplier);
-    } else if (event->propertyName() == "_q_TiledBackingStoreCoverAreaMultiplier") {
-        WebCore::Frame* frame = QWebFramePrivate::core(q->mainFrame());
-        if (!frame->tiledBackingStore())
-            return;
-        float keepMultiplier;
-        float coverMultiplier;
-        frame->tiledBackingStore()->getKeepAndCoverAreaMultipliers(keepMultiplier, coverMultiplier);
-        QSizeF qSize = q->property("_q_TiledBackingStoreCoverAreaMultiplier").toSizeF();
-        // setKeepAndCoverAreaMultipliers do not use FloatSize anymore, keep only the height part.
-        coverMultiplier = qSize.height();
-        frame->tiledBackingStore()->setKeepAndCoverAreaMultipliers(keepMultiplier, coverMultiplier);
-    }
-#endif
     else if (event->propertyName() == "_q_webInspectorServerPort") {
         InspectorServerQt* inspectorServer = InspectorServerQt::server();
         inspectorServer->listen(inspectorServerPort());
@@ -1566,7 +1532,7 @@ static bool isClickableElement(Element* element, RefPtr<NodeList> list)
     ExceptionCode ec = 0;
     return isClickable
         || element->webkitMatchesSelector("a,*:link,*:visited,*[role=button],button,input,select,label", ec)
-        || computedStyle(element)->getPropertyValue(cssPropertyID("cursor")) == "pointer";
+        || CSSComputedStyleDeclaration::create(element)->getPropertyValue(cssPropertyID("cursor")) == "pointer";
 }
 
 static bool isValidFrameOwner(Element* element)
@@ -3150,6 +3116,9 @@ bool QWebPage::event(QEvent *ev)
     case QEvent::TouchBegin:
     case QEvent::TouchUpdate:
     case QEvent::TouchEnd:
+#if QT_VERSION >= QT_VERSION_CHECK(5, 0, 0)
+    case QEvent::TouchCancel:
+#endif
         // Return whether the default action was cancelled in the JS event handler
         return d->touchEvent(static_cast<QTouchEvent*>(ev));
 #ifndef QT_NO_PROPERTIES
@@ -3259,6 +3228,55 @@ QWebPage::LinkDelegationPolicy QWebPage::linkDelegationPolicy() const
 }
 
 #ifndef QT_NO_CONTEXTMENU
+
+static bool handleScrollbarContextMenuEvent(Scrollbar* scrollBar, QContextMenuEvent* event)
+{
+    if (!QApplication::style()->styleHint(QStyle::SH_ScrollBar_ContextMenu))
+        return true;
+
+    bool horizontal = (scrollBar->orientation() == HorizontalScrollbar);
+
+    QMenu menu;
+    QAction* actScrollHere = menu.addAction(QCoreApplication::translate("QWebPage", "Scroll here"));
+    menu.addSeparator();
+
+    QAction* actScrollTop = menu.addAction(horizontal ? QCoreApplication::translate("QWebPage", "Left edge") : QCoreApplication::translate("QWebPage", "Top"));
+    QAction* actScrollBottom = menu.addAction(horizontal ? QCoreApplication::translate("QWebPage", "Right edge") : QCoreApplication::translate("QWebPage", "Bottom"));
+    menu.addSeparator();
+
+    QAction* actPageUp = menu.addAction(horizontal ? QCoreApplication::translate("QWebPage", "Page left") : QCoreApplication::translate("QWebPage", "Page up"));
+    QAction* actPageDown = menu.addAction(horizontal ? QCoreApplication::translate("QWebPage", "Page right") : QCoreApplication::translate("QWebPage", "Page down"));
+    menu.addSeparator();
+
+    QAction* actScrollUp = menu.addAction(horizontal ? QCoreApplication::translate("QWebPage", "Scroll left") : QCoreApplication::translate("QWebPage", "Scroll up"));
+    QAction* actScrollDown = menu.addAction(horizontal ? QCoreApplication::translate("QWebPage", "Scroll right") : QCoreApplication::translate("QWebPage", "Scroll down"));
+
+    QAction* actionSelected = menu.exec(event->globalPos());
+
+    if (actionSelected == actScrollHere) {
+        ScrollbarTheme* theme = scrollBar->theme();
+        // Set the pressed position to the middle of the thumb so that when we
+        // do move, the delta will be from the current pixel position of the
+        // thumb to the new position
+        int position = theme->trackPosition(scrollBar) + theme->thumbPosition(scrollBar) + theme->thumbLength(scrollBar) / 2;
+        scrollBar->setPressedPos(position);
+        const QPoint pos = scrollBar->convertFromContainingWindow(event->pos());
+        scrollBar->moveThumb(horizontal ? pos.x() : pos.y());
+    } else if (actionSelected == actScrollTop)
+        scrollBar->scrollableArea()->scroll(horizontal ? ScrollLeft : ScrollUp, ScrollByDocument);
+    else if (actionSelected == actScrollBottom)
+        scrollBar->scrollableArea()->scroll(horizontal ? ScrollRight : ScrollDown, ScrollByDocument);
+    else if (actionSelected == actPageUp)
+        scrollBar->scrollableArea()->scroll(horizontal ? ScrollLeft : ScrollUp, ScrollByPage);
+    else if (actionSelected == actPageDown)
+        scrollBar->scrollableArea()->scroll(horizontal ? ScrollRight : ScrollDown, ScrollByPage);
+    else if (actionSelected == actScrollUp)
+        scrollBar->scrollableArea()->scroll(horizontal ? ScrollLeft : ScrollUp, ScrollByLine);
+    else if (actionSelected == actScrollDown)
+        scrollBar->scrollableArea()->scroll(horizontal ? ScrollRight : ScrollDown, ScrollByLine);
+    return true;
+}
+
 /*!
     Filters the context menu event, \a event, through handlers for scrollbars and
     custom event handlers in the web page. Returns true if the event was handled;
@@ -3276,14 +3294,14 @@ bool QWebPage::swallowContextMenuEvent(QContextMenuEvent *event)
     if (!RenderThemeQt::useMobileTheme()) {
         if (QWebFrame* webFrame = frameAt(event->pos())) {
             Frame* frame = QWebFramePrivate::core(webFrame);
-            if (Scrollbar* scrollbar = frame->view()->scrollbarAtPoint(PlatformMouseEvent(event, 1).position()))
-                return scrollbar->contextMenu(PlatformMouseEvent(event, 1));
+            if (Scrollbar* scrollbar = frame->view()->scrollbarAtPoint(convertMouseEvent(event, 1).position()))
+                return handleScrollbarContextMenuEvent(scrollbar, event);
         }
     }
 #endif
 
     WebCore::Frame* focusedFrame = d->page->focusController()->focusedOrMainFrame();
-    focusedFrame->eventHandler()->sendContextMenuEvent(PlatformMouseEvent(event, 1));
+    focusedFrame->eventHandler()->sendContextMenuEvent(convertMouseEvent(event, 1));
     ContextMenu *menu = d->page->contextMenuController()->contextMenu();
     // If the website defines its own handler then sendContextMenuEvent takes care of
     // calling/showing it and the context menu pointer will be zero. This is the case
diff --git a/Source/WebKit/qt/Api/qwebsettings.cpp b/Source/WebKit/qt/Api/qwebsettings.cpp
index 89e982140..2885f01ee 100644
--- a/Source/WebKit/qt/Api/qwebsettings.cpp
+++ b/Source/WebKit/qt/Api/qwebsettings.cpp
@@ -171,6 +171,10 @@ void QWebSettingsPrivate::apply()
 #endif
 #endif
 
+        value = attributes.value(QWebSettings::CSSRegionsEnabled,
+                                 global->attributes.value(QWebSettings::CSSRegionsEnabled));
+        settings->setCSSRegionsEnabled(value);
+
         value = attributes.value(QWebSettings::HyperlinkAuditingEnabled,
                                  global->attributes.value(QWebSettings::HyperlinkAuditingEnabled));
 
@@ -515,6 +519,7 @@ QWebSettings::QWebSettings()
     d->attributes.insert(QWebSettings::LocalContentCanAccessFileUrls, true);
     d->attributes.insert(QWebSettings::AcceleratedCompositingEnabled, true);
     d->attributes.insert(QWebSettings::WebGLEnabled, false);
+    d->attributes.insert(QWebSettings::CSSRegionsEnabled, false);
     d->attributes.insert(QWebSettings::HyperlinkAuditingEnabled, false);
     d->attributes.insert(QWebSettings::TiledBackingStoreEnabled, false);
     d->attributes.insert(QWebSettings::FrameFlatteningEnabled, false);
diff --git a/Source/WebKit/qt/Api/qwebsettings.h b/Source/WebKit/qt/Api/qwebsettings.h
index 40f7f73f9..136ee8dc4 100644
--- a/Source/WebKit/qt/Api/qwebsettings.h
+++ b/Source/WebKit/qt/Api/qwebsettings.h
@@ -81,6 +81,7 @@ public:
         SiteSpecificQuirksEnabled,
         JavascriptCanCloseWindows,
         WebGLEnabled,
+        CSSRegionsEnabled,
         HyperlinkAuditingEnabled
     };
     enum WebGraphic {
diff --git a/Source/WebKit/qt/Api/qwebview.cpp b/Source/WebKit/qt/Api/qwebview.cpp
index 4a2d186a9..937d3bdca 100644
--- a/Source/WebKit/qt/Api/qwebview.cpp
+++ b/Source/WebKit/qt/Api/qwebview.cpp
@@ -703,7 +703,11 @@ bool QWebView::event(QEvent *e)
 #endif
         } else if (e->type() == QEvent::TouchBegin 
                    || e->type() == QEvent::TouchEnd 
-                   || e->type() == QEvent::TouchUpdate) {
+                   || e->type() == QEvent::TouchUpdate
+#if QT_VERSION >= QT_VERSION_CHECK(5, 0, 0)
+                   || e->type() == QEvent::TouchCancel
+#endif
+                  ) {
             d->page->event(e);
 
             // Always return true so that we'll receive also TouchUpdate and TouchEnd events
diff --git a/Source/WebKit/qt/ChangeLog b/Source/WebKit/qt/ChangeLog
index 148a27369..175b43df2 100644
--- a/Source/WebKit/qt/ChangeLog
+++ b/Source/WebKit/qt/ChangeLog
@@ -1,3 +1,376 @@
+2012-02-24  Holger Hans Peter Freyther  <holger@moiji-mobile.com>
+
+        [Qt] Build fix. macro "QSKIP" now only takes 1 argument on Qt5
+        https://bugs.webkit.org/show_bug.cgi?id=79328
+
+        Reviewed by Csaba Osztrogonác.
+
+        Introduce an alternative QSKIP that can work with both Qt4
+        and Qt5 without adding #ifdef to each usage site.
+
+        * tests/benchmarks/loading/tst_loading.cpp:
+        (tst_Loading::load):
+        * tests/benchmarks/painting/tst_painting.cpp:
+        (tst_Painting::paint):
+        * tests/qdeclarativewebview/tst_qdeclarativewebview.cpp:
+        (tst_QDeclarativeWebView::elementAreaAt):
+        * tests/qwebframe/tst_qwebframe.cpp:
+        (tst_QWebFrame::setHtmlWithBaseURL):
+        * tests/qwebpage/tst_qwebpage.cpp:
+        (tst_QWebPage::geolocationRequestJS):
+        (tst_QWebPage::loadHtml5Video):
+        (tst_QWebPage::screenshot):
+        * tests/qwebview/tst_qwebview.cpp:
+        (tst_QWebView::reusePage):
+
+2012-02-24  Shinya Kawanaka  <shinyak@chromium.org>
+
+        SpellCheckRequest needs to know the context where the spellcheck happened.
+        https://bugs.webkit.org/show_bug.cgi?id=79320
+
+        Reviewed by Hajime Morita.
+
+        * WebCoreSupport/TextCheckerClientQt.h:
+        (WebCore::TextCheckerClientQt::requestCheckingOfString):
+
+2012-02-23  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        [Qt] Add support for touch cancellation
+        https://bugs.webkit.org/show_bug.cgi?id=79348
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Forward incoming touch cancellation events to the WebCore
+        event handler.
+
+        * Api/qgraphicswebview.cpp:
+        (QGraphicsWebView::sceneEvent):
+        * Api/qwebpage.cpp:
+        (QWebPage::event):
+        * Api/qwebview.cpp:
+        (QWebView::event):
+
+2012-02-22  Hajime Morrita  <morrita@chromium.org>
+
+        NOTIFICATIONS should be implemented as PageSupplement
+        https://bugs.webkit.org/show_bug.cgi?id=79052
+
+        Reviewed by Adam Barth.
+
+        * Api/qwebpage.cpp:
+        (QWebPagePrivate::QWebPagePrivate):
+
+2012-02-21  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Remove the remaining uses of CSSStyleDeclaration in Editor
+        https://bugs.webkit.org/show_bug.cgi?id=78939
+
+        Reviewed by Enrica Casucci.
+
+        * WebCoreSupport/EditorClientQt.cpp:
+        (WebCore::EditorClientQt::shouldApplyStyle):
+        * WebCoreSupport/EditorClientQt.h:
+        (EditorClientQt):
+
+2012-02-22  Mihnea Ovidenie  <mihnea@adobe.com>
+
+        [Qt] REGRESSION(r108108): It made 3 fast/repaint tests fail
+        https://bugs.webkit.org/show_bug.cgi?id=78960
+
+        Reviewed by Csaba Osztrogonác.
+
+        * Api/qwebsettings.cpp:
+        (QWebSettingsPrivate::apply):
+        (QWebSettings::QWebSettings):
+        * Api/qwebsettings.h:
+
+2012-02-22  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        [Qt] Move QMenu dependant scrollbar context menu handling out of WebCore
+        https://bugs.webkit.org/show_bug.cgi?id=79233
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Move scrollbar context menu handling here, it's the only place where it is
+        used.
+
+        * Api/qwebpage.cpp:
+        (handleScrollbarContextMenuEvent):
+        (QWebPage::swallowContextMenuEvent):
+
+2012-02-22  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Merge setVisibleRectTrajectoryVector and adjustVisibleRect to
+        the more descriptive coverWithTilesIfNeeded
+        https://bugs.webkit.org/show_bug.cgi?id=79230
+
+        Reviewed by Simon Hausmann.
+
+        * Api/qgraphicswebview.cpp:
+        (QGraphicsWebView::paint):
+
+            Use coverWithTilesIfNeeded().
+
+2012-02-22  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Remove the remaining uses of CSSStyleDeclaration in Editor
+        https://bugs.webkit.org/show_bug.cgi?id=78939
+
+        Reviewed by Enrica Casucci.
+
+        * WebCoreSupport/EditorClientQt.cpp:
+        (WebCore::EditorClientQt::shouldApplyStyle):
+        * WebCoreSupport/EditorClientQt.h:
+        (EditorClientQt):
+
+2012-02-21  Csaba Osztrogonác  <ossy@webkit.org>
+
+        [Qt] tst_QWebPage::infiniteLoopJS() timeouts with DFG JIT
+        https://bugs.webkit.org/show_bug.cgi?id=79040
+
+        Reviewed by Simon Hausmann.
+
+        * tests/qwebpage/tst_qwebpage.cpp:
+        (tst_QWebPage): Disable tst_QWebPage::infiniteLoopJS() until proper fix.
+
+2012-02-21  Andras Becsi  <andras.becsi@nokia.com>
+
+        [Qt] Print warning when importing experimental WK2 APIs in QML
+        https://bugs.webkit.org/show_bug.cgi?id=78817
+
+        Reviewed by Simon Hausmann.
+
+        * declarative/experimental/plugin.cpp:
+
+2012-02-20  Benjamin Poulain  <benjamin@webkit.org>
+
+        Get rid of the LocalizationStrategy
+        https://bugs.webkit.org/show_bug.cgi?id=78324
+
+        Reviewed by Sam Weinig.
+
+        Move the localization code from PlatformStrategiesQt.cpp
+        to LocalizedStringsQt.cpp.
+
+        Get rid of LocalizationStrategy from PlatformStrategiesQt
+
+        * WebCoreSupport/PlatformStrategiesQt.cpp:
+        * WebCoreSupport/PlatformStrategiesQt.h:
+        (PlatformStrategiesQt):
+
+2012-02-16  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Unreviewed brown-paper bag build fix.
+
+        * WebCoreSupport/WebEventConversion.cpp:
+        (WebCore::WebKitPlatformWheelEvent::WebKitPlatformWheelEvent):
+
+2012-02-16  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        [Qt] Move event conversion functions from WebCore to WebKit
+        https://bugs.webkit.org/show_bug.cgi?id=78788
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Move QtWidgets dependent mouse event constructors out of WebCore
+        into WebKit, similar to the web event conversions of WebKit2.
+
+        * Api/qwebpage.cpp:
+        (QWebPagePrivate::mouseMoveEvent):
+        (QWebPagePrivate::mousePressEvent):
+        (QWebPagePrivate::mouseDoubleClickEvent):
+        (QWebPagePrivate::mouseTripleClickEvent):
+        (QWebPagePrivate::mouseReleaseEvent):
+        (QWebPagePrivate::wheelEvent):
+        (QWebPage::swallowContextMenuEvent):
+        * WebCoreSupport/FrameLoaderClientQt.cpp:
+        (WebCore::FrameLoaderClientQt::postProgressFinishedNotification):
+        * WebCoreSupport/WebEventConversion.cpp: Added.
+        (WebCore):
+        (WebCore::mouseEventModifiersFromQtKeyboardModifiers):
+        (WebCore::mouseEventTypeAndMouseButtonFromQEvent):
+        (WebKitPlatformMouseEvent):
+        (WebCore::WebKitPlatformMouseEvent::WebKitPlatformMouseEvent):
+        (WebCore::convertMouseEvent):
+        (WebKitPlatformWheelEvent):
+        (WebCore::WebKitPlatformWheelEvent::applyDelta):
+        (WebCore::WebKitPlatformWheelEvent::WebKitPlatformWheelEvent):
+        (WebCore::convertWheelEvent):
+        * WebCoreSupport/WebEventConversion.h: Added.
+        (WebCore):
+
+2012-02-16  Adenilson Cavalcanti  <cavalcantii@gmail.com>
+
+        [Qt][WK2] Split QWebPermissionRequest into QWebSecurityOrigin
+        https://bugs.webkit.org/show_bug.cgi?id=73215
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Adding a class to access security information data
+        (e.g. port/scheme/etc),
+        while allowing it to be handled in QML side.
+
+        * declarative/plugin.cpp:
+        (WebKitQmlPlugin::registerTypes):
+
+2012-02-15  Sadrul Habib Chowdhury  <sadrul@chromium.org>
+
+        Notify ChromeClient when touch-event handlers are installed/removed.
+        https://bugs.webkit.org/show_bug.cgi?id=77440
+
+        Reviewed by Darin Fisher and Ryosuke Niwa.
+
+        * WebCoreSupport/ChromeClientQt.h:
+        (WebCore::ChromeClientQt::numTouchEventHandlersChanged):
+
+2012-02-15  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Unreviewed Qt 4.x build fix.
+
+        * WebCoreSupport/PageClientQt.cpp: Fix the QT_VERSION_CHECK pre-processor foo.
+
+2012-02-15  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        [Qt] Replace use of QGLWidget/QGLContext with QOpenGLContext and QSurface for Qt 5
+        https://bugs.webkit.org/show_bug.cgi?id=78694
+
+        Reviewed by Noam Rosenthal.
+
+        * WebCoreSupport/PageClientQt.cpp:
+        (createPlatformGraphicsContext3DFromWidget): Return the QOpenGLContext and QSurface
+        from the QGLWidget when compiling with Qt 5, as that's what WebCore expects.
+
+2012-02-15  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        [Qt] Move Qt platform specific GL Context/Surface creation out of WebCore into WebKit
+        https://bugs.webkit.org/show_bug.cgi?id=78692
+
+        Reviewed by Noam Rosenthal.
+
+        Implement GLWidget and GLContext creation from the page client interface.
+
+        * WebCoreSupport/PageClientQt.cpp:
+        (createPlatformGraphicsContext3DFromWidget):
+        (WebCore):
+        (WebCore::PageClientQWidget::createPlatformGraphicsContext3D):
+        (WebCore::PageClientQGraphicsWidget::createPlatformGraphicsContext3D):
+        * WebCoreSupport/PageClientQt.h:
+        (PageClientQWidget):
+        (PageClientQGraphicsWidget):
+
+2012-02-14  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        [Qt] Eliminate first set of QtWidgets dependencies from WebCore
+        https://bugs.webkit.org/show_bug.cgi?id=78611
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        * Api/qwebpage.cpp: Add missing includes.
+        * WebCoreSupport/DumpRenderTreeSupportQt.cpp: Ditto.
+        * WebCoreSupport/FrameLoaderClientQt.cpp: Make it compile by casting
+        the QObject based PlatformWidget back to QWidget before doing QWidget
+        specific function calls.
+        * WebCoreSupport/InitWebCoreQt.cpp:
+        (WebCore::initializeWebCoreQt): Moved QStyle specific web-graphic initialization
+        here from WebCore.
+        * WebCoreSupport/PageClientQt.cpp:
+        (WebCore::PageClientQWidget::setWidgetVisible): Implement show/hiding of widgets
+        through delegation to QWidget.
+        (WebCore):
+        (WebCore::PageClientQGraphicsWidget::setWidgetVisible): Provide empty widget
+        show/hide implementation, as it doesn't seem to make sense for graphicsviews.
+        * WebCoreSupport/PageClientQt.h:
+        (PageClientQWidget):
+        (PageClientQGraphicsWidget):
+
+2012-02-15  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        [Qt] Be smarted with tile usages during tiling
+        https://bugs.webkit.org/show_bug.cgi?id=78243
+
+        Reviewed by Simon Hausmann.
+
+        Remove internal API used by Symbian.
+
+        * Api/qwebpage.cpp:
+        (QWebPagePrivate::dynamicPropertyChangeEvent):
+
+2012-02-15  No'am Rosenthal  <noam.rosenthal@nokia.com>
+
+        [Texmap] Divide TextureMapperNode.cpp to 3 files.
+        https://bugs.webkit.org/show_bug.cgi?id=76660
+
+        Rename TextureMapperNode to TextureMapperLayer.
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        * Api/qwebframe.cpp:
+        (QWebFramePrivate::renderCompositedLayers):
+        * Api/qwebframe.h:
+        (WebCore):
+        * Api/qwebframe_p.h:
+        (WebCore):
+        (QWebFramePrivate::QWebFramePrivate):
+        (QWebFramePrivate):
+        * WebCoreSupport/PageClientQt.cpp:
+        (WebCore::TextureMapperLayerClientQt::TextureMapperLayerClientQt):
+        (WebCore::TextureMapperLayerClientQt::setTextureMapper):
+        (WebCore::TextureMapperLayerClientQt::~TextureMapperLayerClientQt):
+        (WebCore::TextureMapperLayerClientQt::syncRootLayer):
+        (WebCore::TextureMapperLayerClientQt::rootLayer):
+        (WebCore::PageClientQWidget::setRootGraphicsLayer):
+        (WebCore::PageClientQWidget::syncLayers):
+        (WebCore::PageClientQGraphicsWidget::syncLayers):
+        (WebCore::PageClientQGraphicsWidget::setRootGraphicsLayer):
+        * WebCoreSupport/PageClientQt.h:
+        (TextureMapperLayerClientQt):
+        (PageClientQWidget):
+        (PageClientQGraphicsWidget):
+
+2012-02-11  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Convert svg/animations to use SMIL methods for driving the timeline
+        https://bugs.webkit.org/show_bug.cgi?id=78422
+
+        Reviewed by Dirk Schulze.
+
+        Remove SVG animation sampling functionality provided for DRT, which no longer uses it.
+        Instead we switched the svg/animations tests to use SVGSVGElement.setCurrentTime.
+
+        * WebCoreSupport/DumpRenderTreeSupportQt.cpp:
+        * WebCoreSupport/DumpRenderTreeSupportQt.h:
+
+2012-02-13  Enrica Casucci  <enrica@apple.com>
+
+        Build fix. Unreviewed.
+
+        * WebCoreSupport/PlatformStrategiesQt.cpp:
+        (PlatformStrategiesQt::createPasteboardStrategy):
+
+2012-02-13  Enrica Casucci  <enrica@apple.com>
+
+        Refactor Mac platform implementation of the Pasteboard class to use Platform Strategies.
+        https://bugs.webkit.org/show_bug.cgi?id=78282
+
+        Build fix. Unreviewed.
+
+        * WebCoreSupport/PlatformStrategiesQt.cpp:
+        (WebPlatformStrategies::createPasteboardStrategy):
+        * WebCoreSupport/PlatformStrategiesQt.h:
+        (PlatformStrategiesQt):
+
+2012-02-12  Hajime Morrita  <morrita@chromium.org>
+
+        Page should have less intrusive way to associate API implementation objects.
+        https://bugs.webkit.org/show_bug.cgi?id=78085
+
+        Reviewed by Adam Barth.
+
+        * Api/qwebpage.cpp:
+        (QWebPagePrivate::QWebPagePrivate):
+        * WebCoreSupport/DumpRenderTreeSupportQt.cpp:
+        (DumpRenderTreeSupportQt::setMockDeviceOrientation):
+
 2012-02-09  Simon Hausmann  <simon.hausmann@nokia.com>
 
         [Qt] Fix compilation with newer Qt5
diff --git a/Source/WebKit/qt/WebCoreSupport/ChromeClientQt.h b/Source/WebKit/qt/WebCoreSupport/ChromeClientQt.h
index 6a576d96d..3d45b7b51 100644
--- a/Source/WebKit/qt/WebCoreSupport/ChromeClientQt.h
+++ b/Source/WebKit/qt/WebCoreSupport/ChromeClientQt.h
@@ -192,6 +192,7 @@ public:
 
     virtual bool shouldRubberBandInDirection(WebCore::ScrollDirection) const { return true; }
     virtual void numWheelEventHandlersChanged(unsigned) { }
+    virtual void numTouchEventHandlersChanged(unsigned) { }
 
     QWebPage* m_webPage;
     KURL lastHoverURL;
diff --git a/Source/WebKit/qt/WebCoreSupport/DumpRenderTreeSupportQt.cpp b/Source/WebKit/qt/WebCoreSupport/DumpRenderTreeSupportQt.cpp
index 90254aeca..92c98cd37 100644
--- a/Source/WebKit/qt/WebCoreSupport/DumpRenderTreeSupportQt.cpp
+++ b/Source/WebKit/qt/WebCoreSupport/DumpRenderTreeSupportQt.cpp
@@ -78,10 +78,6 @@
 #include "SecurityOrigin.h"
 #include "SecurityPolicy.h"
 #include "Settings.h"
-#if ENABLE(SVG)
-#include "SVGDocumentExtensions.h"
-#include "SVGSMILElement.h"
-#endif
 #include "TextIterator.h"
 #include "ThirdPartyCookiesQt.h"
 #include "WebCoreTestSupport.h"
@@ -102,6 +98,9 @@
 #include "MediaPlayerPrivateQt.h"
 #endif
 
+#include <QAction>
+#include <QMenu>
+
 using namespace WebCore;
 
 QMap<int, QWebScriptWorld*> m_worldMap;
@@ -370,31 +369,6 @@ bool DumpRenderTreeSupportQt::pauseTransitionOfProperty(QWebFrame *frame, const
     return controller->pauseTransitionAtTime(coreNode->renderer(), propertyName, time);
 }
 
-// Pause a given SVG animation on the target node at a specific time.
-// This method is only intended to be used for testing the SVG animation system.
-bool DumpRenderTreeSupportQt::pauseSVGAnimation(QWebFrame *frame, const QString &animationId, double time, const QString &elementId)
-{
-#if !ENABLE(SVG)
-    return false;
-#else
-    Frame* coreFrame = QWebFramePrivate::core(frame);
-    if (!coreFrame)
-        return false;
-
-    Document* doc = coreFrame->document();
-    Q_ASSERT(doc);
-
-    if (!doc->svgExtensions())
-        return false;
-
-    Node* coreNode = doc->getElementById(animationId);
-    if (!coreNode || !SVGSMILElement::isSMILElement(coreNode))
-        return false;
-
-    return doc->accessSVGExtensions()->sampleAnimationAtTime(elementId, static_cast<SVGSMILElement*>(coreNode), time);
-#endif
-}
-
 // Returns the total number of currently running animations (includes both CSS transitions and CSS animations).
 int DumpRenderTreeSupportQt::numberOfActiveAnimations(QWebFrame *frame)
 {
@@ -635,7 +609,7 @@ QVariantMap DumpRenderTreeSupportQt::computedStyleIncludingVisitedInfo(const QWe
     if (!webElement)
         return res;
 
-    RefPtr<WebCore::CSSComputedStyleDeclaration> computedStyleDeclaration = computedStyle(webElement, true);
+    RefPtr<WebCore::CSSComputedStyleDeclaration> computedStyleDeclaration = CSSComputedStyleDeclaration::create(webElement, true);
     CSSStyleDeclaration* style = static_cast<WebCore::CSSStyleDeclaration*>(computedStyleDeclaration.get());
     for (unsigned i = 0; i < style->length(); i++) {
         QString name = style->item(i);
@@ -857,7 +831,7 @@ void DumpRenderTreeSupportQt::setMockDeviceOrientation(QWebPage* page, bool canP
 {
 #if ENABLE(DEVICE_ORIENTATION)
     Page* corePage = QWebPagePrivate::core(page);
-    DeviceOrientationClientMock* mockClient = toDeviceOrientationClientMock(corePage->deviceOrientationController()->client());
+    DeviceOrientationClientMock* mockClient = toDeviceOrientationClientMock(DeviceOrientationController::from(corePage)->client());
     mockClient->setOrientation(DeviceOrientation::create(canProvideAlpha, alpha, canProvideBeta, beta, canProvideGamma, gamma));
 #endif
 }
diff --git a/Source/WebKit/qt/WebCoreSupport/DumpRenderTreeSupportQt.h b/Source/WebKit/qt/WebCoreSupport/DumpRenderTreeSupportQt.h
index 7aa9f1dce..4b0314350 100644
--- a/Source/WebKit/qt/WebCoreSupport/DumpRenderTreeSupportQt.h
+++ b/Source/WebKit/qt/WebCoreSupport/DumpRenderTreeSupportQt.h
@@ -112,7 +112,6 @@ public:
 
     static bool pauseAnimation(QWebFrame*, const QString& name, double time, const QString& elementId);
     static bool pauseTransitionOfProperty(QWebFrame*, const QString& name, double time, const QString& elementId);
-    static bool pauseSVGAnimation(QWebFrame*, const QString& animationId, double time, const QString& elementId);
     static void suspendActiveDOMObjects(QWebFrame* frame);
     static void resumeActiveDOMObjects(QWebFrame* frame);
 
diff --git a/Source/WebKit/qt/WebCoreSupport/EditorClientQt.cpp b/Source/WebKit/qt/WebCoreSupport/EditorClientQt.cpp
index 1d808031f..166e0063f 100644
--- a/Source/WebKit/qt/WebCoreSupport/EditorClientQt.cpp
+++ b/Source/WebKit/qt/WebCoreSupport/EditorClientQt.cpp
@@ -31,7 +31,6 @@
 #include "config.h"
 #include "EditorClientQt.h"
 
-#include "CSSStyleDeclaration.h"
 #include "Document.h"
 #include "UndoStepQt.h"
 #include "Editor.h"
@@ -48,6 +47,7 @@
 #include "Range.h"
 #include "Settings.h"
 #include "SpatialNavigation.h"
+#include "StylePropertySet.h"
 #include "WindowsKeyboardCodes.h"
 #include "qwebpage.h"
 #include "qwebpage_p.h"
@@ -170,12 +170,12 @@ bool EditorClientQt::shouldChangeSelectedRange(Range* currentRange, Range* propo
     return acceptsEditing;
 }
 
-bool EditorClientQt::shouldApplyStyle(WebCore::CSSStyleDeclaration* style,
+bool EditorClientQt::shouldApplyStyle(WebCore::StylePropertySet* style,
                                       WebCore::Range* range)
 {
     if (dumpEditingCallbacks)
         printf("EDITING DELEGATE: shouldApplyStyle:%s toElementsInDOMRange:%s\n",
-               QString(style->cssText()).toUtf8().constData(), dumpRange(range).toUtf8().constData());
+               QString(style->asText()).toUtf8().constData(), dumpRange(range).toUtf8().constData());
     return acceptsEditing;
 }
 
diff --git a/Source/WebKit/qt/WebCoreSupport/EditorClientQt.h b/Source/WebKit/qt/WebCoreSupport/EditorClientQt.h
index c20f97576..2830989e4 100644
--- a/Source/WebKit/qt/WebCoreSupport/EditorClientQt.h
+++ b/Source/WebKit/qt/WebCoreSupport/EditorClientQt.h
@@ -63,7 +63,7 @@ public:
     virtual bool shouldInsertText(const String&, Range*, EditorInsertAction);
     virtual bool shouldChangeSelectedRange(Range* fromRange, Range* toRange, EAffinity, bool stillSelecting);
 
-    virtual bool shouldApplyStyle(CSSStyleDeclaration*, Range*);
+    virtual bool shouldApplyStyle(StylePropertySet*, Range*);
 
     virtual bool shouldMoveRangeAfterDelete(Range*, Range*);
 
diff --git a/Source/WebKit/qt/WebCoreSupport/FrameLoaderClientQt.cpp b/Source/WebKit/qt/WebCoreSupport/FrameLoaderClientQt.cpp
index b3588361e..8364219d6 100644
--- a/Source/WebKit/qt/WebCoreSupport/FrameLoaderClientQt.cpp
+++ b/Source/WebKit/qt/WebCoreSupport/FrameLoaderClientQt.cpp
@@ -73,6 +73,7 @@
 #include "V8DOMWindow.h"
 #endif
 #include "ViewportArguments.h"
+#include "WebEventConversion.h"
 
 #include "qwebframe.h"
 #include "qwebframe_p.h"
@@ -606,7 +607,7 @@ void FrameLoaderClientQt::postProgressFinishedNotification()
             QPoint localPos = view->mapFromGlobal(QCursor::pos());
             if (view->rect().contains(localPos)) {
                 QMouseEvent event(QEvent::MouseMove, localPos, Qt::NoButton, Qt::NoButton, Qt::NoModifier);
-                m_frame->eventHandler()->mouseMoved(PlatformMouseEvent(&event, 0));
+                m_frame->eventHandler()->mouseMoved(convertMouseEvent(&event, 0));
             }
         }
     }
@@ -1451,15 +1452,16 @@ public:
     virtual void invalidateRect(const IntRect& r)
     { 
         if (platformWidget())
-            platformWidget()->update(r);
+            static_cast<QWidget*>(platformWidget())->update(r);
     }
     virtual void frameRectsChanged()
     {
-        if (!platformWidget())
+        QWidget* widget = static_cast<QWidget*>(platformWidget());
+        if (!widget)
             return;
 
         IntRect windowRect = convertToContainingWindow(IntRect(0, 0, frameRect().width(), frameRect().height()));
-        platformWidget()->setGeometry(windowRect);
+        widget->setGeometry(windowRect);
 
         ScrollView* parentScrollView = parent();
         if (!parentScrollView)
@@ -1468,14 +1470,14 @@ public:
         ASSERT(parentScrollView->isFrameView());
         IntRect clipRect(static_cast<FrameView*>(parentScrollView)->windowClipRect());
         clipRect.move(-windowRect.x(), -windowRect.y());
-        clipRect.intersect(platformWidget()->rect());
+        clipRect.intersect(widget->rect());
 
         QRegion clipRegion = QRegion(clipRect);
-        platformWidget()->setMask(clipRegion);
+        widget->setMask(clipRegion);
 
         handleVisibility();
 
-        platformWidget()->update();
+        widget->update();
     }
 
     virtual void show()
@@ -1490,10 +1492,11 @@ private:
         if (!isVisible())
             return;
 
+        QWidget* widget = static_cast<QWidget*>(platformWidget());
         // If setMask is set with an empty QRegion, no clipping will
         // be performed, so in that case we hide the platformWidget.
-        QRegion mask = platformWidget()->mask();
-        platformWidget()->setVisible(!mask.isEmpty());
+        QRegion mask = widget->mask();
+        widget->setVisible(!mask.isEmpty());
     }
 };
 
@@ -1590,7 +1593,7 @@ PassRefPtr<Widget> FrameLoaderClientQt::createPlugin(const IntSize& pluginSize,
 
                 styleSheet += QString::fromLatin1(getPropertyName(property));
                 styleSheet += QLatin1Char(':');
-                styleSheet += computedStyle(element)->getPropertyValue(property);
+                styleSheet += CSSComputedStyleDeclaration::create(element)->getPropertyValue(property);
                 styleSheet += QLatin1Char(';');
             }
 
diff --git a/Source/WebKit/qt/WebCoreSupport/InitWebCoreQt.cpp b/Source/WebKit/qt/WebCoreSupport/InitWebCoreQt.cpp
index 40f6fe7c9..5cbd82c58 100644
--- a/Source/WebKit/qt/WebCoreSupport/InitWebCoreQt.cpp
+++ b/Source/WebKit/qt/WebCoreSupport/InitWebCoreQt.cpp
@@ -30,6 +30,7 @@
 #include "config.h"
 #include "InitWebCoreQt.h"
 
+#include "Image.h"
 #include "NotImplemented.h"
 #include "PlatformStrategiesQt.h"
 #include "ScriptController.h"
@@ -39,6 +40,8 @@
 #endif
 
 #include "qwebelement_p.h"
+#include <QApplication>
+#include <QStyle>
 
 #include <runtime/InitializeThreading.h>
 #include <wtf/MainThread.h>
@@ -63,6 +66,11 @@ void initializeWebCoreQt()
     InitWebCoreSystemInterface();
 #endif
 
+    // QWebSettings::SearchCancelButtonGraphic
+    Image::setPlatformResource("searchCancelButton", QApplication::style()->standardPixmap(QStyle::SP_DialogCloseButton));
+    // QWebSettings::SearchCancelButtonPressedGraphic
+    Image::setPlatformResource("searchCancelButtonPressed", QApplication::style()->standardPixmap(QStyle::SP_DialogCloseButton));
+
     initialized = true;
 }
 
diff --git a/Source/WebKit/qt/WebCoreSupport/PageClientQt.cpp b/Source/WebKit/qt/WebCoreSupport/PageClientQt.cpp
index 45dcfbbe1..6f96ce1ba 100644
--- a/Source/WebKit/qt/WebCoreSupport/PageClientQt.cpp
+++ b/Source/WebKit/qt/WebCoreSupport/PageClientQt.cpp
@@ -27,56 +27,93 @@
 #include <QX11Info>
 #endif
 
+#if ENABLE(WEBGL)
+#include <QGLWidget>
+
+#if QT_VERSION >= QT_VERSION_CHECK(5, 0, 0)
+#include <QWindow>
+#endif
+
+static void createPlatformGraphicsContext3DFromWidget(QWidget* widget, PlatformGraphicsContext3D* context,
+                                                      PlatformGraphicsSurface3D* surface)
+{
+    *context = 0;
+    *surface = 0;
+    QAbstractScrollArea* scrollArea = qobject_cast<QAbstractScrollArea*>(widget);
+    if (!scrollArea)
+        return;
+
+    QGLWidget* glViewport = qobject_cast<QGLWidget*>(scrollArea->viewport());
+    if (!glViewport)
+        return;
+    QGLWidget* glWidget = new QGLWidget(0, glViewport);
+    if (glWidget->isValid()) {
+        // Geometry can be set to zero because m_glWidget is used only for its QGLContext.
+        glWidget->setGeometry(0, 0, 0, 0);
+#if QT_VERSION >= QT_VERSION_CHECK(5, 0, 0)
+        *surface = glWidget->windowHandle();
+        *context = glWidget->context()->contextHandle();
+#else
+        *surface = glWidget;
+        *context = const_cast<QGLContext*>(glWidget->context());
+#endif
+    } else {
+        delete glWidget;
+        glWidget = 0;
+    }
+}
+#endif
+
 #if USE(ACCELERATED_COMPOSITING) && USE(TEXTURE_MAPPER)
 #include "TextureMapper.h"
-#include "texmap/TextureMapperNode.h"
+#include "texmap/TextureMapperLayer.h"
 #endif
 
 namespace WebCore {
 
 #if USE(ACCELERATED_COMPOSITING) && USE(TEXTURE_MAPPER)
-TextureMapperNodeClientQt::TextureMapperNodeClientQt(QWebFrame* frame, GraphicsLayer* layer)
+TextureMapperLayerClientQt::TextureMapperLayerClientQt(QWebFrame* frame, GraphicsLayer* layer)
     : m_frame(frame)
     , m_rootGraphicsLayer(GraphicsLayer::create(0))
 {
-    m_frame->d->rootTextureMapperNode = rootNode();
+    m_frame->d->rootTextureMapperLayer = rootLayer();
     m_rootGraphicsLayer->addChild(layer);
     m_rootGraphicsLayer->setDrawsContent(false);
     m_rootGraphicsLayer->setMasksToBounds(false);
     m_rootGraphicsLayer->setSize(IntSize(1, 1));
 }
 
-void TextureMapperNodeClientQt::setTextureMapper(const PassOwnPtr<TextureMapper>& textureMapper)
+void TextureMapperLayerClientQt::setTextureMapper(const PassOwnPtr<TextureMapper>& textureMapper)
 {
     m_frame->d->textureMapper = textureMapper;
-    m_frame->d->rootTextureMapperNode->setTextureMapper(m_frame->d->textureMapper.get());
+    m_frame->d->rootTextureMapperLayer->setTextureMapper(m_frame->d->textureMapper.get());
 }
 
-TextureMapperNodeClientQt::~TextureMapperNodeClientQt()
+TextureMapperLayerClientQt::~TextureMapperLayerClientQt()
 {
-    m_frame->d->rootTextureMapperNode = 0;
+    m_frame->d->rootTextureMapperLayer = 0;
 }
 
-void TextureMapperNodeClientQt::syncRootLayer()
+void TextureMapperLayerClientQt::syncRootLayer()
 {
     m_rootGraphicsLayer->syncCompositingStateForThisLayerOnly();
 }
 
-TextureMapperNode* TextureMapperNodeClientQt::rootNode()
+TextureMapperLayer* TextureMapperLayerClientQt::rootLayer()
 {
-    return toTextureMapperNode(m_rootGraphicsLayer.get());
+    return toTextureMapperLayer(m_rootGraphicsLayer.get());
 }
 
 
 void PageClientQWidget::setRootGraphicsLayer(GraphicsLayer* layer)
 {
     if (layer) {
-        textureMapperNodeClient = adoptPtr(new TextureMapperNodeClientQt(page->mainFrame(), layer));
-        textureMapperNodeClient->setTextureMapper(TextureMapper::create());
-        textureMapperNodeClient->syncRootLayer();
+        TextureMapperLayerClient = adoptPtr(new TextureMapperLayerClientQt(page->mainFrame(), layer));
+        TextureMapperLayerClient->setTextureMapper(TextureMapper::create());
+        TextureMapperLayerClient->syncRootLayer();
         return;
     }
-    textureMapperNodeClient.clear();
+    TextureMapperLayerClient.clear();
 }
 
 void PageClientQWidget::markForSync(bool scheduleSync)
@@ -88,12 +125,12 @@ void PageClientQWidget::markForSync(bool scheduleSync)
 
 void PageClientQWidget::syncLayers(Timer<PageClientQWidget>*)
 {
-    if (textureMapperNodeClient)
-        textureMapperNodeClient->syncRootLayer();
+    if (TextureMapperLayerClient)
+        TextureMapperLayerClient->syncRootLayer();
     QWebFramePrivate::core(page->mainFrame())->view()->syncCompositingStateIncludingSubframes();
-    if (!textureMapperNodeClient)
+    if (!TextureMapperLayerClient)
         return;
-    if (textureMapperNodeClient->rootNode()->descendantsOrSelfHaveRunningAnimations() && !syncTimer.isActive())
+    if (TextureMapperLayerClient->rootLayer()->descendantsOrSelfHaveRunningAnimations() && !syncTimer.isActive())
         syncTimer.startOneShot(1.0 / 60.0);
     update(view->rect());
 }
@@ -178,6 +215,22 @@ QRectF PageClientQWidget::windowRect() const
     return QRectF(view->window()->geometry());
 }
 
+void PageClientQWidget::setWidgetVisible(Widget* widget, bool visible)
+{
+    QWidget* qtWidget = qobject_cast<QWidget*>(widget->platformWidget());
+    if (!qtWidget)
+        return;
+    qtWidget->setVisible(visible);
+}
+
+#if ENABLE(WEBGL)
+void PageClientQWidget::createPlatformGraphicsContext3D(PlatformGraphicsContext3D* context,
+                                                        PlatformGraphicsSurface3D* surface)
+{
+    createPlatformGraphicsContext3DFromWidget(view, context, surface);
+}
+#endif
+
 #if !defined(QT_NO_GRAPHICSVIEW)
 PageClientQGraphicsWidget::~PageClientQGraphicsWidget()
 {
@@ -239,17 +292,17 @@ void PageClientQGraphicsWidget::createOrDeleteOverlay()
 void PageClientQGraphicsWidget::syncLayers()
 {
 #if USE(TEXTURE_MAPPER)
-    if (textureMapperNodeClient)
-        textureMapperNodeClient->syncRootLayer();
+    if (TextureMapperLayerClient)
+        TextureMapperLayerClient->syncRootLayer();
 #endif
 
     QWebFramePrivate::core(page->mainFrame())->view()->syncCompositingStateIncludingSubframes();
 
 #if USE(TEXTURE_MAPPER)
-    if (!textureMapperNodeClient)
+    if (!TextureMapperLayerClient)
         return;
 
-    if (textureMapperNodeClient->rootNode()->descendantsOrSelfHaveRunningAnimations() && !syncTimer.isActive())
+    if (TextureMapperLayerClient->rootLayer()->descendantsOrSelfHaveRunningAnimations() && !syncTimer.isActive())
         syncTimer.startOneShot(1.0 / 60.0);
     update(view->boundingRect().toAlignedRect());
 #endif
@@ -259,18 +312,18 @@ void PageClientQGraphicsWidget::syncLayers()
 void PageClientQGraphicsWidget::setRootGraphicsLayer(GraphicsLayer* layer)
 {
     if (layer) {
-        textureMapperNodeClient = adoptPtr(new TextureMapperNodeClientQt(page->mainFrame(), layer));
+        TextureMapperLayerClient = adoptPtr(new TextureMapperLayerClientQt(page->mainFrame(), layer));
 #if USE(TEXTURE_MAPPER_GL)
         QGraphicsView* graphicsView = view->scene()->views()[0];
         if (graphicsView && graphicsView->viewport() && graphicsView->viewport()->inherits("QGLWidget")) {
-            textureMapperNodeClient->setTextureMapper(TextureMapper::create(TextureMapper::OpenGLMode));
+            TextureMapperLayerClient->setTextureMapper(TextureMapper::create(TextureMapper::OpenGLMode));
             return;
         }
 #endif
-        textureMapperNodeClient->setTextureMapper(TextureMapper::create());
+        TextureMapperLayerClient->setTextureMapper(TextureMapper::create());
         return;
     }
-    textureMapperNodeClient.clear();
+    TextureMapperLayerClient.clear();
 }
 #else
 void PageClientQGraphicsWidget::setRootGraphicsLayer(GraphicsLayer* layer)
@@ -405,6 +458,11 @@ QStyle* PageClientQGraphicsWidget::style() const
     return view->style();
 }
 
+void PageClientQGraphicsWidget::setWidgetVisible(Widget*, bool)
+{
+    // Doesn't make sense, does it?
+}
+
 QRectF PageClientQGraphicsWidget::windowRect() const
 {
     if (!view->scene())
@@ -415,4 +473,12 @@ QRectF PageClientQGraphicsWidget::windowRect() const
 }
 #endif // QT_NO_GRAPHICSVIEW
 
+#if ENABLE(WEBGL)
+void PageClientQGraphicsWidget::createPlatformGraphicsContext3D(PlatformGraphicsContext3D* context,
+                                                                PlatformGraphicsSurface3D* surface)
+{
+    createPlatformGraphicsContext3DFromWidget(ownerWidget(), context, surface);
+}
+#endif
+
 } // namespace WebCore
diff --git a/Source/WebKit/qt/WebCoreSupport/PageClientQt.h b/Source/WebKit/qt/WebCoreSupport/PageClientQt.h
index 3480449d2..9a2636572 100644
--- a/Source/WebKit/qt/WebCoreSupport/PageClientQt.h
+++ b/Source/WebKit/qt/WebCoreSupport/PageClientQt.h
@@ -44,13 +44,13 @@
 namespace WebCore {
 
 #if USE(ACCELERATED_COMPOSITING) && USE(TEXTURE_MAPPER)
-class TextureMapperNodeClientQt {
+class TextureMapperLayerClientQt {
 public:
-    TextureMapperNodeClientQt(QWebFrame*, GraphicsLayer*);
-    virtual ~TextureMapperNodeClientQt();
+    TextureMapperLayerClientQt(QWebFrame*, GraphicsLayer*);
+    virtual ~TextureMapperLayerClientQt();
     void setTextureMapper(const PassOwnPtr<TextureMapper>&);
     void syncRootLayer();
-    TextureMapperNode* rootNode();
+    TextureMapperLayer* rootLayer();
 
 private:
     QWebFrame* m_frame;
@@ -97,6 +97,13 @@ public:
 
     virtual QRectF windowRect() const;
 
+    virtual void setWidgetVisible(Widget*, bool visible);
+
+#if ENABLE(WEBGL)
+    virtual void createPlatformGraphicsContext3D(PlatformGraphicsContext3D*,
+                                                 PlatformGraphicsSurface3D*);
+#endif
+
     QWidget* view;
     QWebPage* page;
 
@@ -114,7 +121,7 @@ public:
 
 #if USE(ACCELERATED_COMPOSITING) && USE(TEXTURE_MAPPER)
     Timer<PageClientQWidget> syncTimer;
-    OwnPtr<TextureMapperNodeClientQt> textureMapperNodeClient;
+    OwnPtr<TextureMapperLayerClientQt> TextureMapperLayerClient;
 #endif
 };
 
@@ -198,6 +205,13 @@ public:
 
     virtual bool viewResizesToContentsEnabled() const { return viewResizesToContents; }
 
+    virtual void setWidgetVisible(Widget*, bool);
+
+#if ENABLE(WEBGL)
+    virtual void createPlatformGraphicsContext3D(PlatformGraphicsContext3D*,
+                                                 PlatformGraphicsSurface3D*);
+#endif
+
     void createOrDeleteOverlay();
 
 #if USE(TILED_BACKING_STORE)
@@ -223,7 +237,7 @@ public:
 
 #if USE(ACCELERATED_COMPOSITING)
 #if USE(TEXTURE_MAPPER)
-    OwnPtr<TextureMapperNodeClientQt> textureMapperNodeClient;
+    OwnPtr<TextureMapperLayerClientQt> TextureMapperLayerClient;
 #else
     QWeakPointer<QGraphicsObject> rootGraphicsLayer;
 #endif
diff --git a/Source/WebKit/qt/WebCoreSupport/PlatformStrategiesQt.cpp b/Source/WebKit/qt/WebCoreSupport/PlatformStrategiesQt.cpp
index 64d424d95..cd4ab0d72 100644
--- a/Source/WebKit/qt/WebCoreSupport/PlatformStrategiesQt.cpp
+++ b/Source/WebKit/qt/WebCoreSupport/PlatformStrategiesQt.cpp
@@ -68,14 +68,14 @@ PluginStrategy* PlatformStrategiesQt::createPluginStrategy()
     return this;
 }
 
-LocalizationStrategy* PlatformStrategiesQt::createLocalizationStrategy()
+VisitedLinkStrategy* PlatformStrategiesQt::createVisitedLinkStrategy()
 {
     return this;
 }
 
-VisitedLinkStrategy* PlatformStrategiesQt::createVisitedLinkStrategy()
+PasteboardStrategy* PlatformStrategiesQt::createPasteboardStrategy()
 {
-    return this;
+    return 0;
 }
 
 void PlatformStrategiesQt::notifyCookiesChanged()
@@ -145,608 +145,6 @@ void PlatformStrategiesQt::getPluginInfo(const WebCore::Page* page, Vector<WebCo
 
 }
 
-
-// LocalizationStrategy
-
-String PlatformStrategiesQt::inputElementAltText()
-{
-    return QCoreApplication::translate("QWebPage", "Submit", "Submit (input element) alt text for <input> elements with no alt, title, or value");
-}
-
-String PlatformStrategiesQt::resetButtonDefaultLabel()
-{
-    return QCoreApplication::translate("QWebPage", "Reset", "default label for Reset buttons in forms on web pages");
-}
-
-String PlatformStrategiesQt::searchableIndexIntroduction()
-{
-    return QCoreApplication::translate("QWebPage", "This is a searchable index. Enter search keywords: ", "text that appears at the start of nearly-obsolete web pages in the form of a 'searchable index'");
-}
-
-String PlatformStrategiesQt::submitButtonDefaultLabel()
-{
-    return QCoreApplication::translate("QWebPage", "Submit", "default label for Submit buttons in forms on web pages");
-}
-
-String PlatformStrategiesQt::fileButtonChooseFileLabel()
-{
-    return QCoreApplication::translate("QWebPage", "Choose File", "title for a single file chooser button used in HTML forms");
-}
-
-String PlatformStrategiesQt::fileButtonChooseMultipleFilesLabel()
-{
-    return QCoreApplication::translate("QWebPage", "Choose Files", "title for a multiple file chooser button used in HTML forms. This title should be as short as possible.");
-}
-
-String PlatformStrategiesQt::fileButtonNoFileSelectedLabel()
-{
-    return QCoreApplication::translate("QWebPage", "No file selected", "text to display in file button used in HTML forms when no file is selected");
-}
-
-String PlatformStrategiesQt::fileButtonNoFilesSelectedLabel()
-{
-    return QCoreApplication::translate("QWebPage", "No files selected", "text to display in file button used in HTML forms when no files are selected and the button allows multiple files to be selected");
-}
-
-String PlatformStrategiesQt::defaultDetailsSummaryText()
-{
-    return QCoreApplication::translate("QWebPage", "Details", "text to display in <details> tag when it has no <summary> child");
-}
-
-String PlatformStrategiesQt::contextMenuItemTagOpenLinkInNewWindow()
-{
-    return QCoreApplication::translate("QWebPage", "Open in New Window", "Open in New Window context menu item");
-}
-
-String PlatformStrategiesQt::contextMenuItemTagDownloadLinkToDisk()
-{
-    return QCoreApplication::translate("QWebPage", "Save Link...", "Download Linked File context menu item");
-}
-
-String PlatformStrategiesQt::contextMenuItemTagCopyLinkToClipboard()
-{
-    return QCoreApplication::translate("QWebPage", "Copy Link", "Copy Link context menu item");
-}
-
-String PlatformStrategiesQt::contextMenuItemTagOpenImageInNewWindow()
-{
-    return QCoreApplication::translate("QWebPage", "Open Image", "Open Image in New Window context menu item");
-}
-
-String PlatformStrategiesQt::contextMenuItemTagDownloadImageToDisk()
-{
-    return QCoreApplication::translate("QWebPage", "Save Image", "Download Image context menu item");
-}
-
-String PlatformStrategiesQt::contextMenuItemTagCopyImageToClipboard()
-{
-    return QCoreApplication::translate("QWebPage", "Copy Image", "Copy Link context menu item");
-}
-
-String PlatformStrategiesQt::contextMenuItemTagCopyImageUrlToClipboard()
-{
-    return QCoreApplication::translate("QWebPage", "Copy Image Address", "Copy Image Address menu item");
-}
-
-String PlatformStrategiesQt::contextMenuItemTagOpenVideoInNewWindow()
-{
-    return QCoreApplication::translate("QWebPage", "Open Video", "Open Video in New Window");
-}
-
-String PlatformStrategiesQt::contextMenuItemTagOpenAudioInNewWindow()
-{
-    return QCoreApplication::translate("QWebPage", "Open Audio", "Open Audio in New Window");
-}
-
-String PlatformStrategiesQt::contextMenuItemTagCopyVideoLinkToClipboard()
-{
-    return QCoreApplication::translate("QWebPage", "Copy Video", "Copy Video Link Location");
-}
-
-String PlatformStrategiesQt::contextMenuItemTagCopyAudioLinkToClipboard()
-{
-    return QCoreApplication::translate("QWebPage", "Copy Audio", "Copy Audio Link Location");
-}
-
-String PlatformStrategiesQt::contextMenuItemTagToggleMediaControls()
-{
-    return QCoreApplication::translate("QWebPage", "Toggle Controls", "Toggle Media Controls");
-}
-
-String PlatformStrategiesQt::contextMenuItemTagToggleMediaLoop()
-{
-    return QCoreApplication::translate("QWebPage", "Toggle Loop", "Toggle Media Loop Playback");
-}
-
-String PlatformStrategiesQt::contextMenuItemTagEnterVideoFullscreen()
-{
-    return QCoreApplication::translate("QWebPage", "Enter Fullscreen", "Switch Video to Fullscreen");
-}
-
-String PlatformStrategiesQt::contextMenuItemTagMediaPlay()
-{
-    return QCoreApplication::translate("QWebPage", "Play", "Play");
-}
-
-String PlatformStrategiesQt::contextMenuItemTagMediaPause()
-{
-    return QCoreApplication::translate("QWebPage", "Pause", "Pause");
-}
-
-String PlatformStrategiesQt::contextMenuItemTagMediaMute()
-{
-    return QCoreApplication::translate("QWebPage", "Mute", "Mute");
-}
-
-String PlatformStrategiesQt::contextMenuItemTagOpenFrameInNewWindow()
-{
-    return QCoreApplication::translate("QWebPage", "Open Frame", "Open Frame in New Window context menu item");
-}
-
-String PlatformStrategiesQt::contextMenuItemTagCopy()
-{
-    return QCoreApplication::translate("QWebPage", "Copy", "Copy context menu item");
-}
-
-String PlatformStrategiesQt::contextMenuItemTagGoBack()
-{
-    return QCoreApplication::translate("QWebPage", "Go Back", "Back context menu item");
-}
-
-String PlatformStrategiesQt::contextMenuItemTagGoForward()
-{
-    return QCoreApplication::translate("QWebPage", "Go Forward", "Forward context menu item");
-}
-
-String PlatformStrategiesQt::contextMenuItemTagStop()
-{
-    return QCoreApplication::translate("QWebPage", "Stop", "Stop context menu item");
-}
-
-String PlatformStrategiesQt::contextMenuItemTagReload()
-{
-    return QCoreApplication::translate("QWebPage", "Reload", "Reload context menu item");
-}
-
-String PlatformStrategiesQt::contextMenuItemTagCut()
-{
-    return QCoreApplication::translate("QWebPage", "Cut", "Cut context menu item");
-}
-
-String PlatformStrategiesQt::contextMenuItemTagPaste()
-{
-    return QCoreApplication::translate("QWebPage", "Paste", "Paste context menu item");
-}
-
-String PlatformStrategiesQt::contextMenuItemTagSelectAll()
-{
-    return QCoreApplication::translate("QWebPage", "Select All", "Select All context menu item");
-}
-
-String PlatformStrategiesQt::contextMenuItemTagNoGuessesFound()
-{
-    return QCoreApplication::translate("QWebPage", "No Guesses Found", "No Guesses Found context menu item");
-}
-
-String PlatformStrategiesQt::contextMenuItemTagIgnoreSpelling()
-{
-    return QCoreApplication::translate("QWebPage", "Ignore", "Ignore Spelling context menu item");
-}
-
-String PlatformStrategiesQt::contextMenuItemTagLearnSpelling()
-{
-    return QCoreApplication::translate("QWebPage", "Add To Dictionary", "Learn Spelling context menu item");
-}
-
-String PlatformStrategiesQt::contextMenuItemTagSearchWeb()
-{
-    return QCoreApplication::translate("QWebPage", "Search The Web", "Search The Web context menu item");
-}
-
-String PlatformStrategiesQt::contextMenuItemTagLookUpInDictionary(const String&)
-{
-    return QCoreApplication::translate("QWebPage", "Look Up In Dictionary", "Look Up in Dictionary context menu item");
-}
-
-String PlatformStrategiesQt::contextMenuItemTagOpenLink()
-{
-    return QCoreApplication::translate("QWebPage", "Open Link", "Open Link context menu item");
-}
-
-String PlatformStrategiesQt::contextMenuItemTagIgnoreGrammar()
-{
-    return QCoreApplication::translate("QWebPage", "Ignore", "Ignore Grammar context menu item");
-}
-
-String PlatformStrategiesQt::contextMenuItemTagSpellingMenu()
-{
-    return QCoreApplication::translate("QWebPage", "Spelling", "Spelling and Grammar context sub-menu item");
-}
-
-String PlatformStrategiesQt::contextMenuItemTagShowSpellingPanel(bool show)
-{
-    return show ? QCoreApplication::translate("QWebPage", "Show Spelling and Grammar", "menu item title") :
-                  QCoreApplication::translate("QWebPage", "Hide Spelling and Grammar", "menu item title");
-}
-
-String PlatformStrategiesQt::contextMenuItemTagCheckSpelling()
-{
-    return QCoreApplication::translate("QWebPage", "Check Spelling", "Check spelling context menu item");
-}
-
-String PlatformStrategiesQt::contextMenuItemTagCheckSpellingWhileTyping()
-{
-    return QCoreApplication::translate("QWebPage", "Check Spelling While Typing", "Check spelling while typing context menu item");
-}
-
-String PlatformStrategiesQt::contextMenuItemTagCheckGrammarWithSpelling()
-{
-    return QCoreApplication::translate("QWebPage", "Check Grammar With Spelling", "Check grammar with spelling context menu item");
-}
-
-String PlatformStrategiesQt::contextMenuItemTagFontMenu()
-{
-    return QCoreApplication::translate("QWebPage", "Fonts", "Font context sub-menu item");
-}
-
-String PlatformStrategiesQt::contextMenuItemTagBold()
-{
-    return QCoreApplication::translate("QWebPage", "Bold", "Bold context menu item");
-}
-
-String PlatformStrategiesQt::contextMenuItemTagItalic()
-{
-    return QCoreApplication::translate("QWebPage", "Italic", "Italic context menu item");
-}
-
-String PlatformStrategiesQt::contextMenuItemTagUnderline()
-{
-    return QCoreApplication::translate("QWebPage", "Underline", "Underline context menu item");
-}
-
-String PlatformStrategiesQt::contextMenuItemTagOutline()
-{
-    return QCoreApplication::translate("QWebPage", "Outline", "Outline context menu item");
-}
-
-String PlatformStrategiesQt::contextMenuItemTagWritingDirectionMenu()
-{
-    return QCoreApplication::translate("QWebPage", "Direction", "Writing direction context sub-menu item");
-}
-
-String PlatformStrategiesQt::contextMenuItemTagTextDirectionMenu()
-{
-    return QCoreApplication::translate("QWebPage", "Text Direction", "Text direction context sub-menu item");
-}
-
-String PlatformStrategiesQt::contextMenuItemTagDefaultDirection()
-{
-    return QCoreApplication::translate("QWebPage", "Default", "Default writing direction context menu item");
-}
-
-String PlatformStrategiesQt::contextMenuItemTagLeftToRight()
-{
-    return QCoreApplication::translate("QWebPage", "Left to Right", "Left to Right context menu item");
-}
-
-String PlatformStrategiesQt::contextMenuItemTagRightToLeft()
-{
-    return QCoreApplication::translate("QWebPage", "Right to Left", "Right to Left context menu item");
-}
-
-String PlatformStrategiesQt::contextMenuItemTagInspectElement()
-{
-    return QCoreApplication::translate("QWebPage", "Inspect", "Inspect Element context menu item");
-}
-
-String PlatformStrategiesQt::searchMenuNoRecentSearchesText()
-{
-    return QCoreApplication::translate("QWebPage", "No recent searches", "Label for only item in menu that appears when clicking on the search field image, when no searches have been performed");
-}
-
-String PlatformStrategiesQt::searchMenuRecentSearchesText()
-{
-    return QCoreApplication::translate("QWebPage", "Recent searches", "label for first item in the menu that appears when clicking on the search field image, used as embedded menu title");
-}
-
-String PlatformStrategiesQt::searchMenuClearRecentSearchesText()
-{
-    return QCoreApplication::translate("QWebPage", "Clear recent searches", "menu item in Recent Searches menu that empties menu's contents");
-}
-
-String PlatformStrategiesQt::AXWebAreaText()
-{
-    notImplemented();
-    return String();
-}
-
-String PlatformStrategiesQt::AXLinkText()
-{
-    notImplemented();
-    return String();
-}
-
-String PlatformStrategiesQt::AXListMarkerText()
-{
-    notImplemented();
-    return String();
-}
-
-String PlatformStrategiesQt::AXImageMapText()
-{
-    notImplemented();
-    return String();
-}
-
-String PlatformStrategiesQt::AXHeadingText()
-{
-    notImplemented();
-    return String();
-}
-
-String PlatformStrategiesQt::AXDefinitionListTermText()
-{
-    notImplemented();
-    return String();
-}
-
-String PlatformStrategiesQt::AXDefinitionListDefinitionText()
-{
-    notImplemented();
-    return String();
-}
-
-String PlatformStrategiesQt::AXButtonActionVerb()
-{
-    notImplemented();
-    return String();
-}
-
-String PlatformStrategiesQt::AXRadioButtonActionVerb()
-{
-    notImplemented();
-    return String();
-}
-
-String PlatformStrategiesQt::AXTextFieldActionVerb()
-{
-    notImplemented();
-    return String();
-}
-
-String PlatformStrategiesQt::AXCheckedCheckBoxActionVerb()
-{
-    notImplemented();
-    return String();
-}
-
-String PlatformStrategiesQt::AXUncheckedCheckBoxActionVerb()
-{
-    notImplemented();
-    return String();
-}
-
-String PlatformStrategiesQt::AXMenuListActionVerb()
-{
-    notImplemented();
-    return String();
-}
-
-String PlatformStrategiesQt::AXMenuListPopupActionVerb()
-{
-    notImplemented();
-    return String();
-}
-
-String PlatformStrategiesQt::AXLinkActionVerb()
-{
-    notImplemented();
-    return String();
-}
-
-String PlatformStrategiesQt::missingPluginText()
-{
-    return QCoreApplication::translate("QWebPage", "Missing Plug-in", "Label text to be used when a plug-in is missing");
-}
-
-String PlatformStrategiesQt::crashedPluginText()
-{
-    notImplemented();
-    return String();
-}
-
-String PlatformStrategiesQt::multipleFileUploadText(unsigned)
-{
-    notImplemented();
-    return String();
-}
-
-String PlatformStrategiesQt::unknownFileSizeText()
-{
-    return QCoreApplication::translate("QWebPage", "Unknown", "Unknown filesize FTP directory listing item");
-}
-
-String PlatformStrategiesQt::imageTitle(const String& filename, const IntSize& size)
-{
-    return QCoreApplication::translate("QWebPage", "%1 (%2x%3 pixels)", "Title string for images").arg(filename).arg(size.width()).arg(size.height());
-}
-
-String PlatformStrategiesQt::mediaElementLoadingStateText()
-{
-    return QCoreApplication::translate("QWebPage", "Loading...", "Media controller status message when the media is loading");
-}
-
-String PlatformStrategiesQt::mediaElementLiveBroadcastStateText()
-{
-    return QCoreApplication::translate("QWebPage", "Live Broadcast", "Media controller status message when watching a live broadcast");
-}
-
-#if ENABLE(VIDEO)
-
-String PlatformStrategiesQt::localizedMediaControlElementString(const String& name)
-{
-    if (name == "AudioElement")
-        return QCoreApplication::translate("QWebPage", "Audio Element", "Media controller element");
-    if (name == "VideoElement")
-        return QCoreApplication::translate("QWebPage", "Video Element", "Media controller element");
-    if (name == "MuteButton")
-        return QCoreApplication::translate("QWebPage", "Mute Button", "Media controller element");
-    if (name == "UnMuteButton")
-        return QCoreApplication::translate("QWebPage", "Unmute Button", "Media controller element");
-    if (name == "PlayButton")
-        return QCoreApplication::translate("QWebPage", "Play Button", "Media controller element");
-    if (name == "PauseButton")
-        return QCoreApplication::translate("QWebPage", "Pause Button", "Media controller element");
-    if (name == "Slider")
-        return QCoreApplication::translate("QWebPage", "Slider", "Media controller element");
-    if (name == "SliderThumb")
-        return QCoreApplication::translate("QWebPage", "Slider Thumb", "Media controller element");
-    if (name == "RewindButton")
-        return QCoreApplication::translate("QWebPage", "Rewind Button", "Media controller element");
-    if (name == "ReturnToRealtimeButton")
-        return QCoreApplication::translate("QWebPage", "Return to Real-time Button", "Media controller element");
-    if (name == "CurrentTimeDisplay")
-        return QCoreApplication::translate("QWebPage", "Elapsed Time", "Media controller element");
-    if (name == "TimeRemainingDisplay")
-        return QCoreApplication::translate("QWebPage", "Remaining Time", "Media controller element");
-    if (name == "StatusDisplay")
-        return QCoreApplication::translate("QWebPage", "Status Display", "Media controller element");
-    if (name == "FullscreenButton")
-        return QCoreApplication::translate("QWebPage", "Fullscreen Button", "Media controller element");
-    if (name == "SeekForwardButton")
-        return QCoreApplication::translate("QWebPage", "Seek Forward Button", "Media controller element");
-    if (name == "SeekBackButton")
-        return QCoreApplication::translate("QWebPage", "Seek Back Button", "Media controller element");
-
-    return String();
-}
-
-String PlatformStrategiesQt::localizedMediaControlElementHelpText(const String& name)
-{
-    if (name == "AudioElement")
-        return QCoreApplication::translate("QWebPage", "Audio element playback controls and status display", "Media controller element");
-    if (name == "VideoElement")
-        return QCoreApplication::translate("QWebPage", "Video element playback controls and status display", "Media controller element");
-    if (name == "MuteButton")
-        return QCoreApplication::translate("QWebPage", "Mute audio tracks", "Media controller element");
-    if (name == "UnMuteButton")
-        return QCoreApplication::translate("QWebPage", "Unmute audio tracks", "Media controller element");
-    if (name == "PlayButton")
-        return QCoreApplication::translate("QWebPage", "Begin playback", "Media controller element");
-    if (name == "PauseButton")
-        return QCoreApplication::translate("QWebPage", "Pause playback", "Media controller element");
-    if (name == "Slider")
-        return QCoreApplication::translate("QWebPage", "Movie time scrubber", "Media controller element");
-    if (name == "SliderThumb")
-        return QCoreApplication::translate("QWebPage", "Movie time scrubber thumb", "Media controller element");
-    if (name == "RewindButton")
-        return QCoreApplication::translate("QWebPage", "Rewind movie", "Media controller element");
-    if (name == "ReturnToRealtimeButton")
-        return QCoreApplication::translate("QWebPage", "Return streaming movie to real-time", "Media controller element");
-    if (name == "CurrentTimeDisplay")
-        return QCoreApplication::translate("QWebPage", "Current movie time", "Media controller element");
-    if (name == "TimeRemainingDisplay")
-        return QCoreApplication::translate("QWebPage", "Remaining movie time", "Media controller element");
-    if (name == "StatusDisplay")
-        return QCoreApplication::translate("QWebPage", "Current movie status", "Media controller element");
-    if (name == "FullscreenButton")
-        return QCoreApplication::translate("QWebPage", "Play movie in full-screen mode", "Media controller element");
-    if (name == "SeekForwardButton")
-        return QCoreApplication::translate("QWebPage", "Seek quickly back", "Media controller element");
-    if (name == "SeekBackButton")
-        return QCoreApplication::translate("QWebPage", "Seek quickly forward", "Media controller element");
-
-    ASSERT_NOT_REACHED();
-    return String();
-}
-
-String PlatformStrategiesQt::localizedMediaTimeDescription(float time)
-{
-    if (!isfinite(time))
-        return QCoreApplication::translate("QWebPage", "Indefinite time", "Media time description");
-
-    int seconds = (int)fabsf(time);
-    int days = seconds / (60 * 60 * 24);
-    int hours = seconds / (60 * 60);
-    int minutes = (seconds / 60) % 60;
-    seconds %= 60;
-
-    if (days)
-        return QCoreApplication::translate("QWebPage", "%1 days %2 hours %3 minutes %4 seconds", "Media time description").arg(days).arg(hours).arg(minutes).arg(seconds);
-
-    if (hours)
-        return QCoreApplication::translate("QWebPage", "%1 hours %2 minutes %3 seconds", "Media time description").arg(hours).arg(minutes).arg(seconds);
-
-    if (minutes)
-        return QCoreApplication::translate("QWebPage", "%1 minutes %2 seconds", "Media time description").arg(minutes).arg(seconds);
-
-    return QCoreApplication::translate("QWebPage", "%1 seconds", "Media time description").arg(seconds);
-}
-
-#else // ENABLE(VIDEO)
-// FIXME: #if ENABLE(VIDEO) should be in the base class
-
-String PlatformStrategiesQt::localizedMediaControlElementString(const String& name)
-{
-    return String();
-}
-
-String PlatformStrategiesQt::localizedMediaControlElementHelpText(const String& name)
-{
-    return String();
-}
-
-String PlatformStrategiesQt::localizedMediaTimeDescription(float time)
-{
-    return String();
-}
-
-#endif // ENABLE(VIDEO)
-
-
-String PlatformStrategiesQt::validationMessageValueMissingText()
-{
-    notImplemented();
-    return String();
-}
-
-String PlatformStrategiesQt::validationMessageTypeMismatchText()
-{
-    notImplemented();
-    return String();
-}
-
-String PlatformStrategiesQt::validationMessagePatternMismatchText()
-{
-    notImplemented();
-    return String();
-}
-
-String PlatformStrategiesQt::validationMessageTooLongText()
-{
-    notImplemented();
-    return String();
-}
-
-String PlatformStrategiesQt::validationMessageRangeUnderflowText()
-{
-    notImplemented();
-    return String();
-}
-
-String PlatformStrategiesQt::validationMessageRangeOverflowText()
-{
-    notImplemented();
-    return String();
-}
-
-String PlatformStrategiesQt::validationMessageStepMismatchText()
-{
-    notImplemented();
-    return String();
-}
-
-
 // VisitedLinkStrategy
 
 bool PlatformStrategiesQt::isLinkVisited(Page* page, LinkHash hash, const KURL& baseURL, const AtomicString& attributeURL)
diff --git a/Source/WebKit/qt/WebCoreSupport/PlatformStrategiesQt.h b/Source/WebKit/qt/WebCoreSupport/PlatformStrategiesQt.h
index 504919e38..9dd7e79cf 100644
--- a/Source/WebKit/qt/WebCoreSupport/PlatformStrategiesQt.h
+++ b/Source/WebKit/qt/WebCoreSupport/PlatformStrategiesQt.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2010 Apple Inc. All rights reserved.
+ * Copyright (C) 2010, 2012 Apple Inc. All rights reserved.
  * Copyright (C) 2010 INdT - Instituto Nokia de Tecnologia
  * Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies)
  *
@@ -29,16 +29,16 @@
 #define PlatformStrategiesQt_h
 
 #include <CookiesStrategy.h>
-#include <LocalizationStrategy.h>
 #include <PlatformStrategies.h>
 #include <PluginStrategy.h>
 #include <VisitedLinkStrategy.h>
 
 namespace WebCore {
 class Page;
+class PasteboardStrategy;
 }
 
-class PlatformStrategiesQt : public WebCore::PlatformStrategies, private WebCore::CookiesStrategy, private WebCore::PluginStrategy, private WebCore::LocalizationStrategy, private WebCore::VisitedLinkStrategy {
+class PlatformStrategiesQt : public WebCore::PlatformStrategies, private WebCore::CookiesStrategy, private WebCore::PluginStrategy, private WebCore::VisitedLinkStrategy {
 public:
     static void initialize();
 
@@ -48,8 +48,8 @@ private:
     // WebCore::PlatformStrategies
     virtual WebCore::CookiesStrategy* createCookiesStrategy();
     virtual WebCore::PluginStrategy* createPluginStrategy();
-    virtual WebCore::LocalizationStrategy* createLocalizationStrategy();
     virtual WebCore::VisitedLinkStrategy* createVisitedLinkStrategy();
+    virtual WebCore::PasteboardStrategy* createPasteboardStrategy();
     
     // WebCore::CookiesStrategy
     virtual void notifyCookiesChanged();
@@ -58,101 +58,6 @@ private:
     virtual void refreshPlugins();
     virtual void getPluginInfo(const WebCore::Page*, Vector<WebCore::PluginInfo>&);
 
-    // WebCore::LocalizationStrategy
-    virtual WTF::String inputElementAltText();
-    virtual WTF::String resetButtonDefaultLabel();
-    virtual WTF::String searchableIndexIntroduction();
-    virtual WTF::String submitButtonDefaultLabel();
-    virtual WTF::String fileButtonChooseFileLabel();
-    virtual WTF::String fileButtonChooseMultipleFilesLabel();
-    virtual WTF::String fileButtonNoFileSelectedLabel();
-    virtual WTF::String fileButtonNoFilesSelectedLabel();
-    virtual WTF::String defaultDetailsSummaryText();
-    virtual WTF::String contextMenuItemTagOpenLinkInNewWindow();
-    virtual WTF::String contextMenuItemTagDownloadLinkToDisk();
-    virtual WTF::String contextMenuItemTagCopyLinkToClipboard();
-    virtual WTF::String contextMenuItemTagOpenImageInNewWindow();
-    virtual WTF::String contextMenuItemTagDownloadImageToDisk();
-    virtual WTF::String contextMenuItemTagCopyImageToClipboard();
-    virtual WTF::String contextMenuItemTagCopyImageUrlToClipboard();
-    virtual WTF::String contextMenuItemTagOpenFrameInNewWindow();
-    virtual WTF::String contextMenuItemTagCopy();
-    virtual WTF::String contextMenuItemTagGoBack();
-    virtual WTF::String contextMenuItemTagGoForward();
-    virtual WTF::String contextMenuItemTagStop();
-    virtual WTF::String contextMenuItemTagReload();
-    virtual WTF::String contextMenuItemTagCut();
-    virtual WTF::String contextMenuItemTagPaste();
-    virtual WTF::String contextMenuItemTagSelectAll();
-    virtual WTF::String contextMenuItemTagNoGuessesFound();
-    virtual WTF::String contextMenuItemTagIgnoreSpelling();
-    virtual WTF::String contextMenuItemTagLearnSpelling();
-    virtual WTF::String contextMenuItemTagSearchWeb();
-    virtual WTF::String contextMenuItemTagLookUpInDictionary(const String&);
-    virtual WTF::String contextMenuItemTagOpenLink();
-    virtual WTF::String contextMenuItemTagIgnoreGrammar();
-    virtual WTF::String contextMenuItemTagSpellingMenu();
-    virtual WTF::String contextMenuItemTagShowSpellingPanel(bool show);
-    virtual WTF::String contextMenuItemTagCheckSpelling();
-    virtual WTF::String contextMenuItemTagCheckSpellingWhileTyping();
-    virtual WTF::String contextMenuItemTagCheckGrammarWithSpelling();
-    virtual WTF::String contextMenuItemTagFontMenu();
-    virtual WTF::String contextMenuItemTagBold();
-    virtual WTF::String contextMenuItemTagItalic();
-    virtual WTF::String contextMenuItemTagUnderline();
-    virtual WTF::String contextMenuItemTagOutline();
-    virtual WTF::String contextMenuItemTagWritingDirectionMenu();
-    virtual WTF::String contextMenuItemTagTextDirectionMenu();
-    virtual WTF::String contextMenuItemTagDefaultDirection();
-    virtual WTF::String contextMenuItemTagLeftToRight();
-    virtual WTF::String contextMenuItemTagRightToLeft();
-    virtual WTF::String contextMenuItemTagInspectElement();
-    virtual WTF::String contextMenuItemTagOpenVideoInNewWindow();
-    virtual WTF::String contextMenuItemTagOpenAudioInNewWindow();
-    virtual WTF::String contextMenuItemTagCopyVideoLinkToClipboard();
-    virtual WTF::String contextMenuItemTagCopyAudioLinkToClipboard();
-    virtual WTF::String contextMenuItemTagToggleMediaControls();
-    virtual WTF::String contextMenuItemTagToggleMediaLoop();
-    virtual WTF::String contextMenuItemTagEnterVideoFullscreen();
-    virtual WTF::String contextMenuItemTagMediaPlay();
-    virtual WTF::String contextMenuItemTagMediaPause();
-    virtual WTF::String contextMenuItemTagMediaMute();
-    virtual WTF::String searchMenuNoRecentSearchesText();
-    virtual WTF::String searchMenuRecentSearchesText();
-    virtual WTF::String searchMenuClearRecentSearchesText();
-    virtual WTF::String AXWebAreaText();
-    virtual WTF::String AXLinkText();
-    virtual WTF::String AXListMarkerText();
-    virtual WTF::String AXImageMapText();
-    virtual WTF::String AXHeadingText();
-    virtual WTF::String AXDefinitionListTermText();
-    virtual WTF::String AXDefinitionListDefinitionText();
-    virtual WTF::String AXButtonActionVerb();
-    virtual WTF::String AXRadioButtonActionVerb();
-    virtual WTF::String AXTextFieldActionVerb();
-    virtual WTF::String AXCheckedCheckBoxActionVerb();
-    virtual WTF::String AXUncheckedCheckBoxActionVerb();
-    virtual WTF::String AXMenuListActionVerb();
-    virtual WTF::String AXMenuListPopupActionVerb();
-    virtual WTF::String AXLinkActionVerb();
-    virtual WTF::String missingPluginText();
-    virtual WTF::String crashedPluginText();
-    virtual WTF::String multipleFileUploadText(unsigned numberOfFiles);
-    virtual WTF::String unknownFileSizeText();
-    virtual WTF::String imageTitle(const WTF::String& filename, const WebCore::IntSize&);
-    virtual WTF::String mediaElementLoadingStateText();
-    virtual WTF::String mediaElementLiveBroadcastStateText();
-    virtual WTF::String localizedMediaControlElementString(const WTF::String&);
-    virtual WTF::String localizedMediaControlElementHelpText(const WTF::String&);
-    virtual WTF::String localizedMediaTimeDescription(float);
-    virtual WTF::String validationMessageValueMissingText();
-    virtual WTF::String validationMessageTypeMismatchText();
-    virtual WTF::String validationMessagePatternMismatchText();
-    virtual WTF::String validationMessageTooLongText();
-    virtual WTF::String validationMessageRangeUnderflowText();
-    virtual WTF::String validationMessageRangeOverflowText();
-    virtual WTF::String validationMessageStepMismatchText();
-
     // WebCore::VisitedLinkStrategy
     virtual bool isLinkVisited(WebCore::Page*, WebCore::LinkHash, const WebCore::KURL& baseURL, const WTF::AtomicString& attributeURL);
     virtual void addVisitedLink(WebCore::Page*, WebCore::LinkHash);
diff --git a/Source/WebKit/qt/WebCoreSupport/TextCheckerClientQt.h b/Source/WebKit/qt/WebCoreSupport/TextCheckerClientQt.h
index e78ce1d10..ae419b250 100644
--- a/Source/WebKit/qt/WebCoreSupport/TextCheckerClientQt.h
+++ b/Source/WebKit/qt/WebCoreSupport/TextCheckerClientQt.h
@@ -47,7 +47,7 @@ public:
     virtual String getAutoCorrectSuggestionForMisspelledWord(const String& misspelledWord);
     virtual void checkGrammarOfString(const UChar*, int length, Vector<GrammarDetail>&, int* badGrammarLocation, int* badGrammarLength);
     virtual void getGuessesForWord(const String& word, const String& context, Vector<String>& guesses);
-    virtual void requestCheckingOfString(SpellChecker*, int, TextCheckingTypeMask, const String&) { }
+    virtual void requestCheckingOfString(SpellChecker*, const TextCheckingRequest&) { }
 
     virtual bool isContinousSpellCheckingEnabled();
     virtual void toggleContinousSpellChecking();
diff --git a/Source/WebKit/qt/WebCoreSupport/WebEventConversion.cpp b/Source/WebKit/qt/WebCoreSupport/WebEventConversion.cpp
new file mode 100644
index 000000000..be5f5298e
--- /dev/null
+++ b/Source/WebKit/qt/WebCoreSupport/WebEventConversion.cpp
@@ -0,0 +1,237 @@
+/*
+    Copyright (C) 2012 Nokia Corporation and/or its subsidiary(-ies)
+    Copyright (C) 2006 Zack Rusin <zack@kde.org>
+    Copyright (C) 2011 Research In Motion Limited.
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#include "config.h"
+#include "WebEventConversion.h"
+
+#include "PlatformMouseEvent.h"
+#include "PlatformWheelEvent.h"
+#include <QApplication>
+#include <QGraphicsSceneMouseEvent>
+#include <QWheelEvent>
+#include <wtf/CurrentTime.h>
+
+namespace WebCore {
+
+static void mouseEventModifiersFromQtKeyboardModifiers(Qt::KeyboardModifiers keyboardModifiers, unsigned& modifiers)
+{
+    modifiers = 0;
+    if (keyboardModifiers & Qt::ShiftModifier)
+        modifiers |= PlatformEvent::ShiftKey;
+    if (keyboardModifiers & Qt::ControlModifier)
+        modifiers |= PlatformEvent::CtrlKey;
+    if (keyboardModifiers & Qt::AltModifier)
+        modifiers |= PlatformEvent::AltKey;
+    if (keyboardModifiers & Qt::MetaModifier)
+        modifiers |= PlatformEvent::MetaKey;
+}
+
+static void mouseEventTypeAndMouseButtonFromQEvent(const QEvent* event, PlatformEvent::Type& mouseEventType, MouseButton& mouseButton)
+{
+    enum { MouseEvent, GraphicsSceneMouseEvent } frameworkMouseEventType;
+    switch (event->type()) {
+    case QEvent::MouseButtonDblClick:
+    case QEvent::MouseButtonPress:
+        frameworkMouseEventType = MouseEvent;
+        mouseEventType = PlatformEvent::MousePressed;
+        break;
+    case QEvent::MouseButtonRelease:
+        frameworkMouseEventType = MouseEvent;
+        mouseEventType = PlatformEvent::MouseReleased;
+        break;
+    case QEvent::MouseMove:
+        frameworkMouseEventType = MouseEvent;
+        mouseEventType = PlatformEvent::MouseMoved;
+        break;
+    case QEvent::GraphicsSceneMouseDoubleClick:
+    case QEvent::GraphicsSceneMousePress:
+        frameworkMouseEventType = GraphicsSceneMouseEvent;
+        mouseEventType = PlatformEvent::MousePressed;
+        break;
+    case QEvent::GraphicsSceneMouseRelease:
+        frameworkMouseEventType = GraphicsSceneMouseEvent;
+        mouseEventType = PlatformEvent::MouseReleased;
+        break;
+    case QEvent::GraphicsSceneMouseMove:
+        frameworkMouseEventType = GraphicsSceneMouseEvent;
+        mouseEventType = PlatformEvent::MouseMoved;
+        break;
+    default:
+        ASSERT_NOT_REACHED();
+        frameworkMouseEventType = MouseEvent;
+        mouseEventType = PlatformEvent::MouseMoved;
+        break;
+    }
+
+    Qt::MouseButtons mouseButtons;
+    switch (frameworkMouseEventType) {
+    case MouseEvent: {
+        const QMouseEvent* mouseEvent = static_cast<const QMouseEvent*>(event);
+        mouseButtons = mouseEventType == PlatformEvent::MouseMoved ? mouseEvent->buttons() : mouseEvent->button();
+        break;
+    }
+    case GraphicsSceneMouseEvent: {
+        const QGraphicsSceneMouseEvent* mouseEvent = static_cast<const QGraphicsSceneMouseEvent*>(event);
+        mouseButtons = mouseEventType == PlatformEvent::MouseMoved ? mouseEvent->buttons() : mouseEvent->button();
+        break;
+    }
+    }
+
+    if (mouseButtons & Qt::LeftButton)
+        mouseButton = LeftButton;
+    else if (mouseButtons & Qt::RightButton)
+        mouseButton = RightButton;
+    else if (mouseButtons & Qt::MidButton)
+        mouseButton = MiddleButton;
+    else
+        mouseButton = NoButton;
+}
+
+class WebKitPlatformMouseEvent : public PlatformMouseEvent {
+public:
+    WebKitPlatformMouseEvent(QGraphicsSceneMouseEvent*, int clickCount);
+    WebKitPlatformMouseEvent(QInputEvent*, int clickCount);
+};
+
+WebKitPlatformMouseEvent::WebKitPlatformMouseEvent(QGraphicsSceneMouseEvent* event, int clickCount)
+{
+    m_timestamp = WTF::currentTime();
+
+    // FIXME: Why don't we handle a context menu event here as we do in PlatformMouseEvent(QInputEvent*, int)?
+    // See <https://bugs.webkit.org/show_bug.cgi?id=60728>.
+    PlatformEvent::Type type;
+    mouseEventTypeAndMouseButtonFromQEvent(event, type, m_button);
+
+    m_type = type;
+    m_position = IntPoint(event->pos().toPoint());
+    m_globalPosition = IntPoint(event->screenPos());
+
+    m_clickCount = clickCount;
+    mouseEventModifiersFromQtKeyboardModifiers(event->modifiers(), m_modifiers);
+}
+
+WebKitPlatformMouseEvent::WebKitPlatformMouseEvent(QInputEvent* event, int clickCount)
+{
+    m_timestamp = WTF::currentTime();
+
+    bool isContextMenuEvent = false;
+#ifndef QT_NO_CONTEXTMENU
+    if (event->type() == QEvent::ContextMenu) {
+        isContextMenuEvent = true;
+        m_type = PlatformEvent::MousePressed;
+        QContextMenuEvent* ce = static_cast<QContextMenuEvent*>(event);
+        m_position = IntPoint(ce->pos());
+        m_globalPosition = IntPoint(ce->globalPos());
+        m_button = RightButton;
+    }
+#endif
+    if (!isContextMenuEvent) {
+        PlatformEvent::Type type;
+        mouseEventTypeAndMouseButtonFromQEvent(event, type, m_button);
+        QMouseEvent* mouseEvent = static_cast<QMouseEvent*>(event);
+
+        m_type = type;
+        m_position = IntPoint(mouseEvent->pos());
+        m_globalPosition = IntPoint(mouseEvent->globalPos());
+    }
+
+    m_clickCount = clickCount;
+    mouseEventModifiersFromQtKeyboardModifiers(event->modifiers(), m_modifiers);
+}
+
+PlatformMouseEvent convertMouseEvent(QInputEvent* event, int clickCount)
+{
+    return WebKitPlatformMouseEvent(event, clickCount);
+}
+
+PlatformMouseEvent convertMouseEvent(QGraphicsSceneMouseEvent* event, int clickCount)
+{
+    return WebKitPlatformMouseEvent(event, clickCount);
+}
+
+class WebKitPlatformWheelEvent : public PlatformWheelEvent {
+public:
+    WebKitPlatformWheelEvent(QGraphicsSceneWheelEvent*);
+    WebKitPlatformWheelEvent(QWheelEvent*);
+
+private:
+    void applyDelta(int delta, Qt::Orientation);
+};
+
+void WebKitPlatformWheelEvent::applyDelta(int delta, Qt::Orientation orientation)
+{
+    // A delta that is not mod 120 indicates a device that is sending
+    // fine-resolution scroll events, so use the delta as number of wheel ticks
+    // and number of pixels to scroll.See also webkit.org/b/29601
+    bool fullTick = !(delta % 120);
+
+    if (orientation == Qt::Horizontal) {
+        m_deltaX = (fullTick) ? delta / 120.0f : delta;
+        m_deltaY = 0;
+    } else {
+        m_deltaX = 0;
+        m_deltaY = (fullTick) ? delta / 120.0f : delta;
+    }
+
+    m_wheelTicksX = m_deltaX;
+    m_wheelTicksY = m_deltaY;
+
+    // Use the same single scroll step as QTextEdit
+    // (in QTextEditPrivate::init [h,v]bar->setSingleStep)
+    static const float cDefaultQtScrollStep = 20.f;
+    m_deltaX *= (fullTick) ? QApplication::wheelScrollLines() * cDefaultQtScrollStep : 1;
+    m_deltaY *= (fullTick) ? QApplication::wheelScrollLines() * cDefaultQtScrollStep : 1;
+}
+
+WebKitPlatformWheelEvent::WebKitPlatformWheelEvent(QGraphicsSceneWheelEvent* e)
+{
+    m_timestamp = WTF::currentTime();
+    mouseEventModifiersFromQtKeyboardModifiers(e->modifiers(), m_modifiers);
+    m_position = e->pos().toPoint();
+    m_globalPosition = e->screenPos();
+    m_granularity = ScrollByPixelWheelEvent;
+    m_directionInvertedFromDevice = false;
+    applyDelta(e->delta(), e->orientation());
+}
+
+WebKitPlatformWheelEvent::WebKitPlatformWheelEvent(QWheelEvent* e)
+{
+    m_timestamp = WTF::currentTime();
+    mouseEventModifiersFromQtKeyboardModifiers(e->modifiers(), m_modifiers);
+    m_position = e->pos();
+    m_globalPosition = e->globalPos();
+    m_granularity = ScrollByPixelWheelEvent;
+    m_directionInvertedFromDevice = false;
+    applyDelta(e->delta(), e->orientation());
+}
+
+
+PlatformWheelEvent convertWheelEvent(QWheelEvent* event)
+{
+    return WebKitPlatformWheelEvent(event);
+}
+
+PlatformWheelEvent convertWheelEvent(QGraphicsSceneWheelEvent* event)
+{
+    return WebKitPlatformWheelEvent(event);
+}
+
+}
diff --git a/Source/WebKit/qt/WebCoreSupport/WebEventConversion.h b/Source/WebKit/qt/WebCoreSupport/WebEventConversion.h
new file mode 100644
index 000000000..25d02df22
--- /dev/null
+++ b/Source/WebKit/qt/WebCoreSupport/WebEventConversion.h
@@ -0,0 +1,41 @@
+/*
+    Copyright (C) 2012 Nokia Corporation and/or its subsidiary(-ies)
+    Copyright (C) 2006 Zack Rusin <zack@kde.org>
+    Copyright (C) 2011 Research In Motion Limited.
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#include <qglobal.h>
+
+QT_BEGIN_NAMESPACE
+class QInputEvent;
+class QGraphicsSceneMouseEvent;
+class QWheelEvent;
+class QGraphicsSceneWheelEvent;
+QT_END_NAMESPACE
+
+namespace WebCore {
+
+class PlatformMouseEvent;
+class PlatformWheelEvent;
+
+PlatformMouseEvent convertMouseEvent(QInputEvent*, int clickCount);
+PlatformMouseEvent convertMouseEvent(QGraphicsSceneMouseEvent*, int clickCount);
+PlatformWheelEvent convertWheelEvent(QWheelEvent*);
+PlatformWheelEvent convertWheelEvent(QGraphicsSceneWheelEvent*);
+
+}
diff --git a/Source/WebKit/qt/declarative/experimental/plugin.cpp b/Source/WebKit/qt/declarative/experimental/plugin.cpp
index 7a41657ac..da228521f 100644
--- a/Source/WebKit/qt/declarative/experimental/plugin.cpp
+++ b/Source/WebKit/qt/declarative/experimental/plugin.cpp
@@ -46,6 +46,9 @@ class WebKitQmlExperimentalExtensionPlugin: public QDeclarativeExtensionPlugin {
 public:
     virtual void registerTypes(const char* uri)
     {
+        qWarning("\nWARNING: This project is using the experimental QML API extensions for QtWebKit and is therefore tied to a specific QtWebKit release.\n"
+                 "WARNING: The experimental API will change from version to version, or even be removed. You have been warned!\n");
+
         Q_ASSERT(QLatin1String(uri) == QLatin1String("QtWebKit.experimental"));
 
         qmlRegisterUncreatableType<QWebDownloadItem>(uri, 1, 0, "DownloadItem", QObject::tr("Cannot create separate instance of DownloadItem"));
diff --git a/Source/WebKit/qt/declarative/plugin.cpp b/Source/WebKit/qt/declarative/plugin.cpp
index 64638e469..e2f0fb3ec 100644
--- a/Source/WebKit/qt/declarative/plugin.cpp
+++ b/Source/WebKit/qt/declarative/plugin.cpp
@@ -25,6 +25,7 @@
 #if defined(HAVE_WEBKIT2)
 #include "qquickwebpage_p.h"
 #include "qquickwebview_p.h"
+#include "qtwebsecurityorigin_p.h"
 #include "qwebiconimageprovider_p.h"
 #include "qwebnavigationrequest_p.h"
 #include "qwebpermissionrequest_p.h"
@@ -65,6 +66,8 @@ public:
         qmlRegisterUncreatableType<QNetworkReply>(uri, 3, 0, "NetworkReply", QObject::tr("Cannot create separate instance of NetworkReply"));
         qmlRegisterUncreatableType<QWebPermissionRequest>(uri, 3, 0, "PermissionRequest", QObject::tr("Cannot create separate instance of PermissionRequest"));
         qmlRegisterUncreatableType<QWebNavigationRequest>(uri, 3, 0, "NavigationRequest", QObject::tr("Cannot create separate instance of NavigationRequest"));
+        qmlRegisterUncreatableType<QtWebSecurityOrigin>(uri, 3, 0, "SecurityOrigin", QObject::tr("Cannot create separate instance of SecurityOrigin"));
+
 #endif
     }
 };
diff --git a/Source/WebKit/qt/tests/benchmarks/loading/tst_loading.cpp b/Source/WebKit/qt/tests/benchmarks/loading/tst_loading.cpp
index 661a7e3cb..1c3985b83 100644
--- a/Source/WebKit/qt/tests/benchmarks/loading/tst_loading.cpp
+++ b/Source/WebKit/qt/tests/benchmarks/loading/tst_loading.cpp
@@ -25,28 +25,7 @@
 #include <qwebview.h>
 #include <qpainter.h>
 
-/**
- * Starts an event loop that runs until the given signal is received.
- Optionally the event loop
- * can return earlier on a timeout.
- *
- * \return \p true if the requested signal was received
- *         \p false on timeout
- */
-static bool waitForSignal(QObject* obj, const char* signal, int timeout = 0)
-{
-    QEventLoop loop;
-    QObject::connect(obj, signal, &loop, SLOT(quit()));
-    QTimer timer;
-    QSignalSpy timeoutSpy(&timer, SIGNAL(timeout()));
-    if (timeout > 0) {
-        QObject::connect(&timer, SIGNAL(timeout()), &loop, SLOT(quit()));
-        timer.setSingleShot(true);
-        timer.start(timeout);
-    }
-    loop.exec();
-    return timeoutSpy.isEmpty();
-}
+#include "util.h"
 
 class tst_Loading : public QObject
 {
@@ -96,13 +75,13 @@ void tst_Loading::load()
     QFETCH(QUrl, url);
 
     if (!m_manager.isOnline())
-        QSKIP("This test requires an active network connection", SkipSingle);
+        W_QSKIP("This test requires an active network connection", SkipSingle);
 
     QBENCHMARK {
         m_view->load(url);
 
         // really wait for loading, painting is in another test
-        ::waitForSignal(m_view, SIGNAL(loadFinished(bool)));
+        ::waitForSignal(m_view, SIGNAL(loadFinished(bool)), 0);
     }
 }
 
diff --git a/Source/WebKit/qt/tests/benchmarks/painting/tst_painting.cpp b/Source/WebKit/qt/tests/benchmarks/painting/tst_painting.cpp
index 47d34dcbd..3f97b5aea 100644
--- a/Source/WebKit/qt/tests/benchmarks/painting/tst_painting.cpp
+++ b/Source/WebKit/qt/tests/benchmarks/painting/tst_painting.cpp
@@ -26,28 +26,7 @@
 #include <qwebview.h>
 #include <qpainter.h>
 
-/**
- * Starts an event loop that runs until the given signal is received.
- Optionally the event loop
- * can return earlier on a timeout.
- *
- * \return \p true if the requested signal was received
- *         \p false on timeout
- */
-static bool waitForSignal(QObject* obj, const char* signal, int timeout = 0)
-{
-    QEventLoop loop;
-    QObject::connect(obj, signal, &loop, SLOT(quit()));
-    QTimer timer;
-    QSignalSpy timeoutSpy(&timer, SIGNAL(timeout()));
-    if (timeout > 0) {
-        QObject::connect(&timer, SIGNAL(timeout()), &loop, SLOT(quit()));
-        timer.setSingleShot(true);
-        timer.start(timeout);
-    }
-    loop.exec();
-    return timeoutSpy.isEmpty();
-}
+#include "util.h"
 
 class tst_Painting : public QObject
 {
@@ -96,10 +75,10 @@ void tst_Painting::paint()
     QFETCH(QUrl, url);
 
     if (!m_manager.isOnline())
-        QSKIP("This test requires an active network connection", SkipSingle);
+        W_QSKIP("This test requires an active network connection", SkipSingle);
 
     m_view->load(url);
-    ::waitForSignal(m_view, SIGNAL(loadFinished(bool)));
+    ::waitForSignal(m_view, SIGNAL(loadFinished(bool)), 0);
 
     /* force a layout */
     QWebFrame* mainFrame = m_page->mainFrame();
@@ -116,7 +95,7 @@ void tst_Painting::paint()
 void tst_Painting::textAreas()
 {
     m_view->load(QUrl("data:text/html;<html><body></body></html>"));
-    ::waitForSignal(m_view, SIGNAL(loadFinished(bool)));
+    ::waitForSignal(m_view, SIGNAL(loadFinished(bool)), 0);
 
     QWebElement bodyElement = m_page->mainFrame()->findFirstElement("body");
 
diff --git a/Source/WebKit/qt/tests/qdeclarativewebview/tst_qdeclarativewebview.cpp b/Source/WebKit/qt/tests/qdeclarativewebview/tst_qdeclarativewebview.cpp
index 1f9a2ff84..f9421e3cf 100644
--- a/Source/WebKit/qt/tests/qdeclarativewebview/tst_qdeclarativewebview.cpp
+++ b/Source/WebKit/qt/tests/qdeclarativewebview/tst_qdeclarativewebview.cpp
@@ -139,7 +139,7 @@ void tst_QDeclarativeWebView::basicProperties()
 
 void tst_QDeclarativeWebView::elementAreaAt()
 {
-    QSKIP("This test should be changed to test 'heuristicZoom' instead.", SkipAll);
+    W_QSKIP("This test should be changed to test 'heuristicZoom' instead.", SkipAll);
     QDeclarativeEngine engine;
     QDeclarativeComponent component(&engine, QUrl("qrc:///resources/elements.qml"));
     checkNoErrors(component);
diff --git a/Source/WebKit/qt/tests/qwebframe/tst_qwebframe.cpp b/Source/WebKit/qt/tests/qwebframe/tst_qwebframe.cpp
index 3eb08c450..2c28aef1f 100644
--- a/Source/WebKit/qt/tests/qwebframe/tst_qwebframe.cpp
+++ b/Source/WebKit/qt/tests/qwebframe/tst_qwebframe.cpp
@@ -2555,7 +2555,7 @@ void tst_QWebFrame::setHtmlWithBaseURL()
     // As we are using a local file as baseUrl, its security origin should be able to load local resources.
 
     if (!QDir(TESTS_SOURCE_DIR).exists())
-        QSKIP(QString("This test requires access to resources found in '%1'").arg(TESTS_SOURCE_DIR).toLatin1().constData(), SkipAll);
+        W_QSKIP(QString("This test requires access to resources found in '%1'").arg(TESTS_SOURCE_DIR).toLatin1().constData(), SkipAll);
 
     QDir::setCurrent(TESTS_SOURCE_DIR);
 
diff --git a/Source/WebKit/qt/tests/qwebpage/tst_qwebpage.cpp b/Source/WebKit/qt/tests/qwebpage/tst_qwebpage.cpp
index b3ff3b9c1..b6f0aeee3 100644
--- a/Source/WebKit/qt/tests/qwebpage/tst_qwebpage.cpp
+++ b/Source/WebKit/qt/tests/qwebpage/tst_qwebpage.cpp
@@ -160,7 +160,9 @@ private slots:
     void testStopScheduledPageRefresh();
     void findText();
     void supportedContentType();
-    void infiniteLoopJS();
+    // [Qt] tst_QWebPage::infiniteLoopJS() timeouts with DFG JIT
+    // https://bugs.webkit.org/show_bug.cgi?id=79040
+    // void infiniteLoopJS();
     void navigatorCookieEnabled();
     void deleteQWebViewTwice();
     void renderOnRepaintRequestedShouldNotRecurse();
@@ -284,6 +286,9 @@ private:
     bool m_allowGeolocation;
 };
 
+// [Qt] tst_QWebPage::infiniteLoopJS() timeouts with DFG JIT
+// https://bugs.webkit.org/show_bug.cgi?id=79040
+/*
 void tst_QWebPage::infiniteLoopJS()
 {
     JSTestPage* newPage = new JSTestPage(m_view);
@@ -292,6 +297,7 @@ void tst_QWebPage::infiniteLoopJS()
     m_view->page()->mainFrame()->evaluateJavaScript("var run = true;var a = 1;while(run){a++;}");
     delete newPage;
 }
+*/
 
 void tst_QWebPage::geolocationRequestJS()
 {
@@ -299,7 +305,7 @@ void tst_QWebPage::geolocationRequestJS()
 
     if (newPage->mainFrame()->evaluateJavaScript(QLatin1String("!navigator.geolocation")).toBool()) {
         delete newPage;
-        QSKIP("Geolocation is not supported.", SkipSingle);
+        W_QSKIP("Geolocation is not supported.", SkipSingle);
     }
 
     connect(newPage, SIGNAL(featurePermissionRequested(QWebFrame*, QWebPage::Feature)),
@@ -529,7 +535,7 @@ void tst_QWebPage::loadHtml5Video()
     QEXPECT_FAIL("", "https://bugs.webkit.org/show_bug.cgi?id=65452", Continue);
     QCOMPARE(mUrl.toEncoded(), url);
 #else
-    QSKIP("This test requires Qt Multimedia", SkipAll);
+    W_QSKIP("This test requires Qt Multimedia", SkipAll);
 #endif
 }
 
@@ -2738,7 +2744,7 @@ void tst_QWebPage::screenshot_data()
 void tst_QWebPage::screenshot()
 {
     if (!QDir(TESTS_SOURCE_DIR).exists())
-        QSKIP(QString("This test requires access to resources found in '%1'").arg(TESTS_SOURCE_DIR).toLatin1().constData(), SkipAll);
+        W_QSKIP(QString("This test requires access to resources found in '%1'").arg(TESTS_SOURCE_DIR).toLatin1().constData(), SkipAll);
 
     QDir::setCurrent(TESTS_SOURCE_DIR);
 
diff --git a/Source/WebKit/qt/tests/qwebview/tst_qwebview.cpp b/Source/WebKit/qt/tests/qwebview/tst_qwebview.cpp
index be2c4c985..f7dc9c5f4 100644
--- a/Source/WebKit/qt/tests/qwebview/tst_qwebview.cpp
+++ b/Source/WebKit/qt/tests/qwebview/tst_qwebview.cpp
@@ -133,7 +133,7 @@ void tst_QWebView::reusePage_data()
 void tst_QWebView::reusePage()
 {
     if (!QDir(TESTS_SOURCE_DIR).exists())
-        QSKIP(QString("This test requires access to resources found in '%1'").arg(TESTS_SOURCE_DIR).toLatin1().constData(), SkipAll);
+        W_QSKIP(QString("This test requires access to resources found in '%1'").arg(TESTS_SOURCE_DIR).toLatin1().constData(), SkipAll);
 
     QDir::setCurrent(TESTS_SOURCE_DIR);
 
diff --git a/Source/WebKit/qt/tests/util.h b/Source/WebKit/qt/tests/util.h
index 94628ca9c..22192bad2 100644
--- a/Source/WebKit/qt/tests/util.h
+++ b/Source/WebKit/qt/tests/util.h
@@ -77,4 +77,9 @@ static bool waitForSignal(QObject* obj, const char* signal, int timeout = 10000)
         } \
         QCOMPARE(__expr, __expected); \
     } while(0)
+
+// Compatibility for Qt5
+#define W_QSKIP(a, b) QSKIP(a, b)
+#else
+#define W_QSKIP(a, b) QSKIP(a)
 #endif
diff --git a/Source/WebKit/win/ChangeLog b/Source/WebKit/win/ChangeLog
index 32db318fa..1c7f320a2 100644
--- a/Source/WebKit/win/ChangeLog
+++ b/Source/WebKit/win/ChangeLog
@@ -1,3 +1,138 @@
+2012-02-24  Shinya Kawanaka  <shinyak@chromium.org>
+
+        SpellCheckRequest needs to know the context where the spellcheck happened.
+        https://bugs.webkit.org/show_bug.cgi?id=79320
+
+        Reviewed by Hajime Morita.
+
+        * WebCoreSupport/WebEditorClient.h:
+        (WebEditorClient::requestCheckingOfString):
+        (WebEditorClient):
+
+2012-02-21  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Remove the remaining uses of CSSStyleDeclaration in Editor
+        https://bugs.webkit.org/show_bug.cgi?id=78939
+
+        Reviewed by Enrica Casucci.
+
+        * WebCoreSupport/WebEditorClient.cpp:
+        (WebEditorClient::shouldApplyStyle):
+        * WebCoreSupport/WebEditorClient.h:
+        (WebEditorClient):
+
+2012-02-22  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Remove the remaining uses of CSSStyleDeclaration in Editor
+        https://bugs.webkit.org/show_bug.cgi?id=78939
+
+        Reviewed by Enrica Casucci.
+
+        * WebCoreSupport/WebEditorClient.cpp:
+        (WebEditorClient::shouldApplyStyle):
+        * WebCoreSupport/WebEditorClient.h:
+        (WebEditorClient):
+
+2012-02-17  Kalev Lember  <kalevlember@gmail.com>
+
+        Remove unused parameters from WTF threading API
+        https://bugs.webkit.org/show_bug.cgi?id=78389
+
+        Reviewed by Adam Roben.
+
+        waitForThreadCompletion() had an out param 'void **result' to get the
+        'void *' returned by ThreadFunction. However, the implementation in
+        ThreadingWin.cpp ignored the out param, not filling it in. This had
+        led to a situation where none of the client code made use of the param
+        and just ignored it.
+
+        To clean this up, the patch changes the signature of ThreadFunction to
+        return void instead of void* and drops the the unused 'void **result'
+        parameter from waitForThreadCompletion. Also, all client code is
+        updated for the API change.
+
+        As mentioned in https://bugs.webkit.org/show_bug.cgi?id=78389 , even
+        though the change only affects internal API, Safari is using it
+        directly and we'll need to keep the old versions around for ABI
+        compatibility. For this, the patch adds compatibility wrappers with
+        the old ABI.
+
+        * WebKit.vcproj/WebKit_Cairo.def: Add the new functions.
+        * WebKit.vcproj/WebKit_Cairo_debug.def: Ditto.
+
+2012-02-15  Sadrul Habib Chowdhury  <sadrul@chromium.org>
+
+        Notify ChromeClient when touch-event handlers are installed/removed.
+        https://bugs.webkit.org/show_bug.cgi?id=77440
+
+        Reviewed by Darin Fisher and Ryosuke Niwa.
+
+        * WebCoreSupport/WebChromeClient.h:
+        (WebChromeClient::numTouchEventHandlersChanged):
+
+2012-02-14  Alexey Proskuryakov  <ap@apple.com>
+
+        [Mac][Win][WK2] Switch to RFC 6455 protocol for WebSockets
+        https://bugs.webkit.org/show_bug.cgi?id=78541
+        <rdar://problem/10036695>
+
+        Reviewed by Kent Tamura.
+
+        * WebPreferences.cpp: (WebPreferences::initializeDefaultSettings): Changed default value of
+        the preference
+
+2012-02-11  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Convert svg/animations to use SMIL methods for driving the timeline
+        https://bugs.webkit.org/show_bug.cgi?id=78422
+
+        Reviewed by Dirk Schulze.
+
+        Remove SVG animation sampling functionality provided for DRT, which no longer uses it.
+        Instead we switched the svg/animations tests to use SVGSVGElement.setCurrentTime.
+
+        * Interfaces/IWebFramePrivate.idl:
+        * WebFrame.cpp:
+        * WebFrame.h:
+
+2012-02-13  Andy Estes  <aestes@apple.com>
+
+        Fix the Windows build.
+
+        * WebCoreSupport/WebPlatformStrategies.cpp:
+        (WebPlatformStrategies::createPasteboardStrategy):
+        * WebCoreSupport/WebPlatformStrategies.h:
+        (WebPlatformStrategies):
+
+2012-02-12  Andy Estes  <aestes@apple.com>
+
+        [Windows] Add API to enable inverted color drawing on a WebView
+        https://bugs.webkit.org/show_bug.cgi?id=77382
+
+        Reviewed by Adam Roben.
+
+        Add a new private WebPreference key called "WebKitShouldInvertColors"
+        and add private cover methods to get and set the preference. When this
+        preference changes on a WebPreference object, all WebViews listening to
+        that object will repaint to reflect the new value.
+
+        * Interfaces/IWebPreferencesPrivate.idl: Add [setS|s]houldInvertColors()
+        cover methods for WebKitShouldInvertColorsPreferenceKey.
+        * WebPreferenceKeysPrivate.h: Add WebKitShouldInvertColorsPreferenceKey.
+        * WebPreferences.cpp:
+        (WebPreferences::shouldInvertColors):
+        (WebPreferences::setShouldInvertColors):
+        * WebPreferences.h:
+        (WebPreferences):
+        * WebView.cpp:
+        (WebView::setShouldInvertColors): If m_shouldInvertColors changes,
+        update the value on the WebView and in m_layerTreeHost, then repaint
+        the view.
+        (WebView::notifyPreferencesChanged):
+        (WebView::setAcceleratedCompositing): When creating a new layer tree
+        host, tell it whether it should be inverting colors.
+        * WebView.h:
+
 2012-02-07  MORITA Hajime  <morrita@google.com>
 
         Replacement text should be available from the marker.
diff --git a/Source/WebKit/win/Interfaces/IWebFramePrivate.idl b/Source/WebKit/win/Interfaces/IWebFramePrivate.idl
index 31287ba58..90ba4bdb9 100644
--- a/Source/WebKit/win/Interfaces/IWebFramePrivate.idl
+++ b/Source/WebKit/win/Interfaces/IWebFramePrivate.idl
@@ -98,8 +98,6 @@ interface IWebFramePrivate : IUnknown
 
     HRESULT counterValueForElementById([in] BSTR id, [out, retval] BSTR* result);
 
-    HRESULT pauseSVGAnimation([in] BSTR elementId, [in] IDOMNode* node, [in] double secondsFromNow, [out, retval] BOOL* animationWasRunning);
-
     HRESULT visibleContentRect([out, retval] RECT*);
 
     HRESULT pageNumberForElementById([in] BSTR id, [in] float pageWidthInPixels, [in] float pageHeightInPixels, [out, retval] int* pageNumber);
diff --git a/Source/WebKit/win/Interfaces/IWebPreferencesPrivate.idl b/Source/WebKit/win/Interfaces/IWebPreferencesPrivate.idl
index 01ace36d7..ad67a56b0 100644
--- a/Source/WebKit/win/Interfaces/IWebPreferencesPrivate.idl
+++ b/Source/WebKit/win/Interfaces/IWebPreferencesPrivate.idl
@@ -140,4 +140,6 @@ interface IWebPreferencesPrivate : IUnknown
     HRESULT setShowsToolTipOverTruncatedText([in] BOOL);
     HRESULT showsToolTipOverTruncatedText([out, retval] BOOL*);
 
+    HRESULT setShouldInvertColors([in] BOOL);
+    HRESULT shouldInvertColors([out, retval] BOOL*);
 }
diff --git a/Source/WebKit/win/WebCoreSupport/WebChromeClient.h b/Source/WebKit/win/WebCoreSupport/WebChromeClient.h
index b6aeb1cf7..2a9a8fe7f 100644
--- a/Source/WebKit/win/WebCoreSupport/WebChromeClient.h
+++ b/Source/WebKit/win/WebCoreSupport/WebChromeClient.h
@@ -177,6 +177,7 @@ public:
 
     virtual bool shouldRubberBandInDirection(WebCore::ScrollDirection) const { return true; }
     virtual void numWheelEventHandlersChanged(unsigned) { }
+    virtual void numTouchEventHandlersChanged(unsigned) { }
 
 private:
     COMPtr<IWebUIDelegate> uiDelegate();
diff --git a/Source/WebKit/win/WebCoreSupport/WebEditorClient.cpp b/Source/WebKit/win/WebCoreSupport/WebEditorClient.cpp
index 0b2653095..6a4ee8476 100644
--- a/Source/WebKit/win/WebCoreSupport/WebEditorClient.cpp
+++ b/Source/WebKit/win/WebCoreSupport/WebEditorClient.cpp
@@ -276,13 +276,13 @@ bool WebEditorClient::shouldInsertText(const String& /*str*/, Range* /* replacin
 //bool WebEditorClient::shouldChangeSelectedRange(Range *currentRange, Range *toProposedRange, SelectionAffinity selectionAffinity, bool stillSelecting)
 //{ notImplemented(); return false; }
 
-bool WebEditorClient::shouldApplyStyle(CSSStyleDeclaration* /*style*/, Range* /*toElementsInDOMRange*/)
+bool WebEditorClient::shouldApplyStyle(StylePropertySet* /*style*/, Range* /*toElementsInDOMRange*/)
 { notImplemented(); return true; }
 
 bool WebEditorClient::shouldMoveRangeAfterDelete(Range* /*range*/, Range* /*rangeToBeReplaced*/)
 { notImplemented(); return true; }
 
-bool WebEditorClient::shouldChangeTypingStyle(CSSStyleDeclaration* /*currentStyle*/, CSSStyleDeclaration* /*toProposedStyle*/)
+bool WebEditorClient::shouldChangeTypingStyle(StylePropertySet* /*currentStyle*/, StylePropertySet* /*toProposedStyle*/)
 { notImplemented(); return false; }
 
 void WebEditorClient::webViewDidChangeTypingStyle(WebNotification* /*notification*/)
diff --git a/Source/WebKit/win/WebCoreSupport/WebEditorClient.h b/Source/WebKit/win/WebCoreSupport/WebEditorClient.h
index a40586c98..0f29e9e0f 100644
--- a/Source/WebKit/win/WebCoreSupport/WebEditorClient.h
+++ b/Source/WebKit/win/WebCoreSupport/WebEditorClient.h
@@ -64,9 +64,9 @@ public:
     bool shouldDeleteRange(WebCore::Range*);
 
     bool shouldInsertNode(WebCore::Node*, WebCore::Range* replacingRange, WebCore::EditorInsertAction);
-    bool shouldApplyStyle(WebCore::CSSStyleDeclaration*, WebCore::Range*);
+    bool shouldApplyStyle(WebCore::StylePropertySet*, WebCore::Range*);
     bool shouldMoveRangeAfterDelete(WebCore::Range*, WebCore::Range*);
-    bool shouldChangeTypingStyle(WebCore::CSSStyleDeclaration* currentStyle, WebCore::CSSStyleDeclaration* toProposedStyle);
+    bool shouldChangeTypingStyle(WebCore::StylePropertySet* currentStyle, WebCore::StylePropertySet* toProposedStyle);
 
     void webViewDidChangeTypingStyle(WebNotification*);
     void webViewDidChangeSelection(WebNotification*);
@@ -110,7 +110,8 @@ public:
 
     virtual void willSetInputMethodState();
     virtual void setInputMethodState(bool);
-    virtual void requestCheckingOfString(WebCore::SpellChecker*, int, WebCore::TextCheckingTypeMask, const WTF::String&) {}
+    virtual void requestCheckingOfString(WebCore::SpellChecker*, const WebCore::TextCheckingRequest&) { }
+
     virtual WebCore::TextCheckerClient* textChecker() { return this; }
 
 private:
diff --git a/Source/WebKit/win/WebCoreSupport/WebPlatformStrategies.cpp b/Source/WebKit/win/WebCoreSupport/WebPlatformStrategies.cpp
index 7a3febb92..230f3323f 100644
--- a/Source/WebKit/win/WebCoreSupport/WebPlatformStrategies.cpp
+++ b/Source/WebKit/win/WebCoreSupport/WebPlatformStrategies.cpp
@@ -57,6 +57,11 @@ VisitedLinkStrategy* WebPlatformStrategies::createVisitedLinkStrategy()
     return this;
 }
 
+PasteboardStrategy* WebPlatformStrategies::createPasteboardStrategy()
+{
+    return 0;
+}
+
 void WebPlatformStrategies::notifyCookiesChanged()
 {
 }
diff --git a/Source/WebKit/win/WebCoreSupport/WebPlatformStrategies.h b/Source/WebKit/win/WebCoreSupport/WebPlatformStrategies.h
index 509de098b..274124213 100644
--- a/Source/WebKit/win/WebCoreSupport/WebPlatformStrategies.h
+++ b/Source/WebKit/win/WebCoreSupport/WebPlatformStrategies.h
@@ -42,6 +42,7 @@ private:
     virtual WebCore::CookiesStrategy* createCookiesStrategy();
     virtual WebCore::PluginStrategy* createPluginStrategy();
     virtual WebCore::VisitedLinkStrategy* createVisitedLinkStrategy();
+    virtual WebCore::PasteboardStrategy* createPasteboardStrategy();
 
     // WebCore::CookiesStrategy
     virtual void notifyCookiesChanged();
diff --git a/Source/WebKit/win/WebFrame.cpp b/Source/WebKit/win/WebFrame.cpp
index f15d3efd5..3564bd986 100644
--- a/Source/WebKit/win/WebFrame.cpp
+++ b/Source/WebKit/win/WebFrame.cpp
@@ -93,8 +93,6 @@
 #include <WebCore/RenderView.h>
 #include <WebCore/RenderTreeAsText.h>
 #include <WebCore/Settings.h>
-#include <WebCore/SVGDocumentExtensions.h>
-#include <WebCore/SVGSMILElement.h>
 #include <WebCore/TextIterator.h>
 #include <WebCore/JSDOMBinding.h>
 #include <WebCore/ScriptController.h>
@@ -1276,34 +1274,6 @@ HRESULT WebFrame::pauseTransition(BSTR propertyName, IDOMNode* node, double seco
     return S_OK;
 }
 
-HRESULT WebFrame::pauseSVGAnimation(BSTR elementId, IDOMNode* node, double secondsFromNow, BOOL* animationWasRunning)
-{
-    if (!node || !animationWasRunning)
-        return E_POINTER;
-
-    *animationWasRunning = FALSE;
-
-    Frame* frame = core(this);
-    if (!frame)
-        return E_FAIL;
-
-    Document* document = frame->document();
-    if (!document || !document->svgExtensions())
-        return E_FAIL;
-
-    COMPtr<DOMNode> domNode(Query, node);
-    if (!domNode || !SVGSMILElement::isSMILElement(domNode->node()))
-        return E_FAIL;
-
-#if ENABLE(SVG)
-    *animationWasRunning = document->accessSVGExtensions()->sampleAnimationAtTime(String(elementId, SysStringLen(elementId)), static_cast<SVGSMILElement*>(domNode->node()), secondsFromNow);
-#else
-    *animationWasRunning = FALSE;
-#endif
-
-    return S_OK;
-}
-
 HRESULT WebFrame::visibleContentRect(RECT* rect)
 {
     if (!rect)
diff --git a/Source/WebKit/win/WebFrame.h b/Source/WebKit/win/WebFrame.h
index f777a3205..c6286b0d0 100644
--- a/Source/WebKit/win/WebFrame.h
+++ b/Source/WebKit/win/WebFrame.h
@@ -259,7 +259,6 @@ public:
 
     virtual HRESULT STDMETHODCALLTYPE pauseAnimation(BSTR animationName, IDOMNode*, double secondsFromNow, BOOL* animationWasRunning);
     virtual HRESULT STDMETHODCALLTYPE pauseTransition(BSTR propertyName, IDOMNode*, double secondsFromNow, BOOL* transitionWasRunning);
-    virtual HRESULT STDMETHODCALLTYPE pauseSVGAnimation(BSTR elementId, IDOMNode*, double secondsFromNow, BOOL* animationWasRunning);
     virtual HRESULT STDMETHODCALLTYPE numberOfActiveAnimations(UINT*);
     virtual HRESULT STDMETHODCALLTYPE suspendAnimations();
     virtual HRESULT STDMETHODCALLTYPE resumeAnimations();
diff --git a/Source/WebKit/win/WebKit.vcproj/WebKit_Cairo.def b/Source/WebKit/win/WebKit.vcproj/WebKit_Cairo.def
index 89b0a2a61..e4cd266ed 100644
--- a/Source/WebKit/win/WebKit.vcproj/WebKit_Cairo.def
+++ b/Source/WebKit/win/WebKit.vcproj/WebKit_Cairo.def
@@ -122,6 +122,7 @@ EXPORTS
         ?broadcast@ThreadCondition@WTF@@QAEXXZ
         ?callOnMainThread@WTF@@YAXP6AXPAX@Z0@Z
         ?createThread@WTF@@YAIP6APAXPAX@Z0PBD@Z
+        ?createThread@WTF@@YAIP6AXPAX@Z0PBD@Z
         ?currentThread@WTF@@YAIXZ
         ?detachThread@WTF@@YAXI@Z
         ?initializeMainThread@WTF@@YAXXZ
@@ -139,5 +140,6 @@ EXPORTS
         ?unlockAtomicallyInitializedStaticMutex@WTF@@YAXXZ
         ?updateLayoutIgnorePendingStylesheets@Document@WebCore@@QAEXXZ
         ?wait@ThreadCondition@WTF@@QAEXAAVMutex@2@@Z
+        ?waitForThreadCompletion@WTF@@YAHI@Z
         ?waitForThreadCompletion@WTF@@YAHIPAPAX@Z
         ?createThread@WTF@@YAIP6APAXPAX@Z0@Z
diff --git a/Source/WebKit/win/WebKit.vcproj/WebKit_Cairo_debug.def b/Source/WebKit/win/WebKit.vcproj/WebKit_Cairo_debug.def
index 1b1b72df4..e4ac119c2 100644
--- a/Source/WebKit/win/WebKit.vcproj/WebKit_Cairo_debug.def
+++ b/Source/WebKit/win/WebKit.vcproj/WebKit_Cairo_debug.def
@@ -122,6 +122,7 @@ EXPORTS
         ?broadcast@ThreadCondition@WTF@@QAEXXZ
         ?callOnMainThread@WTF@@YAXP6AXPAX@Z0@Z
         ?createThread@WTF@@YAIP6APAXPAX@Z0PBD@Z
+        ?createThread@WTF@@YAIP6AXPAX@Z0PBD@Z
         ?currentThread@WTF@@YAIXZ
         ?detachThread@WTF@@YAXI@Z
         ?initializeMainThread@WTF@@YAXXZ
@@ -139,5 +140,6 @@ EXPORTS
         ?unlockAtomicallyInitializedStaticMutex@WTF@@YAXXZ
         ?updateLayoutIgnorePendingStylesheets@Document@WebCore@@QAEXXZ
         ?wait@ThreadCondition@WTF@@QAEXAAVMutex@2@@Z
+        ?waitForThreadCompletion@WTF@@YAHI@Z
         ?waitForThreadCompletion@WTF@@YAHIPAPAX@Z
         ?createThread@WTF@@YAIP6APAXPAX@Z0@Z
diff --git a/Source/WebKit/win/WebPreferenceKeysPrivate.h b/Source/WebKit/win/WebPreferenceKeysPrivate.h
index 76eacffeb..468944657 100644
--- a/Source/WebKit/win/WebPreferenceKeysPrivate.h
+++ b/Source/WebKit/win/WebPreferenceKeysPrivate.h
@@ -83,6 +83,7 @@
 #define WebKitPDFScaleFactorPreferenceKey "WebKitPDFScaleFactor"
 #define WebKitEditableLinkBehaviorPreferenceKey "WebKitEditableLinkBehavior"
 #define WebKitEditingBehaviorPreferenceKey "WebKitEditingBehavior"
+#define WebKitShouldInvertColorsPreferenceKey "WebKitShouldInvertColors"
 
 // Window display is throttled to 60 frames per second if WebKitThrottleWindowDisplayPreferenceKey
 // is set to YES.  The window display throttle is OFF by default for compatibility with Mac OS X
diff --git a/Source/WebKit/win/WebPreferences.cpp b/Source/WebKit/win/WebPreferences.cpp
index 39e4644c0..6f5ed8e7e 100644
--- a/Source/WebKit/win/WebPreferences.cpp
+++ b/Source/WebKit/win/WebPreferences.cpp
@@ -268,7 +268,7 @@ void WebPreferences::initializeDefaultSettings()
 
     CFDictionaryAddValue(defaults, CFSTR(WebKitMemoryInfoEnabledPreferenceKey), kCFBooleanFalse);
     CFDictionaryAddValue(defaults, CFSTR(WebKitHyperlinkAuditingEnabledPreferenceKey), kCFBooleanTrue);
-    CFDictionaryAddValue(defaults, CFSTR(WebKitHixie76WebSocketProtocolEnabledPreferenceKey), kCFBooleanTrue);
+    CFDictionaryAddValue(defaults, CFSTR(WebKitHixie76WebSocketProtocolEnabledPreferenceKey), kCFBooleanFalse);
 
     CFDictionaryAddValue(defaults, CFSTR(WebKitMediaPlaybackRequiresUserGesturePreferenceKey), kCFBooleanFalse);
     CFDictionaryAddValue(defaults, CFSTR(WebKitMediaPlaybackAllowsInlinePreferenceKey), kCFBooleanTrue);
@@ -1639,6 +1639,21 @@ HRESULT WebPreferences::setShowsToolTipOverTruncatedText(BOOL showsToolTip)
     return S_OK;
 }
 
+HRESULT WebPreferences::shouldInvertColors(BOOL* shouldInvertColors)
+{
+    if (!shouldInvertColors)
+        return E_POINTER;
+
+    *shouldInvertColors = boolValueForKey(CFSTR(WebKitShouldInvertColorsPreferenceKey));
+    return S_OK;
+}
+
+HRESULT WebPreferences::setShouldInvertColors(BOOL shouldInvertColors)
+{
+    setBoolValue(CFSTR(WebKitShouldInvertColorsPreferenceKey), shouldInvertColors);
+    return S_OK;
+}
+
 void WebPreferences::willAddToWebView()
 {
     ++m_numWebViews;
diff --git a/Source/WebKit/win/WebPreferences.h b/Source/WebKit/win/WebPreferences.h
index 3878050bb..baf56ecd0 100644
--- a/Source/WebKit/win/WebPreferences.h
+++ b/Source/WebKit/win/WebPreferences.h
@@ -468,6 +468,9 @@ public:
     virtual HRESULT STDMETHODCALLTYPE showsToolTipOverTruncatedText(BOOL*);
     virtual HRESULT STDMETHODCALLTYPE setShowsToolTipOverTruncatedText(BOOL);
 
+    virtual HRESULT STDMETHODCALLTYPE shouldInvertColors(BOOL*);
+    virtual HRESULT STDMETHODCALLTYPE setShouldInvertColors(BOOL);
+
     // WebPreferences
 
     // This method accesses a different preference key than developerExtrasEnabled.
diff --git a/Source/WebKit/win/WebView.cpp b/Source/WebKit/win/WebView.cpp
index 57acc1318..5927c9664 100644
--- a/Source/WebKit/win/WebView.cpp
+++ b/Source/WebKit/win/WebView.cpp
@@ -2072,6 +2072,23 @@ void WebView::setIsBeingDestroyed()
     ::SetWindowLongPtrW(m_viewWindow, 0, 0);
 }
 
+void WebView::setShouldInvertColors(bool shouldInvertColors)
+{
+    if (m_shouldInvertColors == shouldInvertColors)
+        return;
+
+    m_shouldInvertColors = shouldInvertColors;
+
+#if USE(ACCELERATED_COMPOSITING)
+    if (m_layerTreeHost)
+        m_layerTreeHost->setShouldInvertColors(shouldInvertColors);
+#endif
+
+    RECT windowRect = {0};
+    frameRect(&windowRect);
+    repaint(windowRect, true, true);
+}
+
 bool WebView::registerWebViewWindowClass()
 {
     static bool haveRegisteredWindowClass = false;
@@ -4922,6 +4939,11 @@ HRESULT WebView::notifyPreferencesChanged(IWebNotification* notification)
         return hr;
     settings->setMediaPlaybackAllowsInline(enabled);
 
+    hr = prefsPrivate->shouldInvertColors(&enabled);
+    if (FAILED(hr))
+        return hr;
+    setShouldInvertColors(enabled);
+
     return S_OK;
 }
 
@@ -6463,6 +6485,8 @@ void WebView::setAcceleratedCompositing(bool accelerated)
         if (m_layerTreeHost) {
             m_isAcceleratedCompositing = true;
 
+            m_layerTreeHost->setShouldInvertColors(m_shouldInvertColors);
+
             m_layerTreeHost->setClient(this);
             ASSERT(m_viewWindow);
             m_layerTreeHost->setWindow(m_viewWindow);
diff --git a/Source/WebKit/win/WebView.h b/Source/WebKit/win/WebView.h
index 7d2a6e2f9..30843d366 100644
--- a/Source/WebKit/win/WebView.h
+++ b/Source/WebKit/win/WebView.h
@@ -1002,6 +1002,7 @@ private:
 #endif
 
     bool m_shouldInvertColors;
+    void setShouldInvertColors(bool);
 
 protected:
     static bool registerWebViewWindowClass();
diff --git a/Source/WebKit/wince/ChangeLog b/Source/WebKit/wince/ChangeLog
index 6d2a7e647..998f5d165 100644
--- a/Source/WebKit/wince/ChangeLog
+++ b/Source/WebKit/wince/ChangeLog
@@ -1,3 +1,70 @@
+2012-02-24  Shinya Kawanaka  <shinyak@chromium.org>
+
+        SpellCheckRequest needs to know the context where the spellcheck happened.
+        https://bugs.webkit.org/show_bug.cgi?id=79320
+
+        Reviewed by Hajime Morita.
+
+        * WebCoreSupport/EditorClientWinCE.h:
+        (WebKit::EditorClientWinCE::requestCheckingOfString):
+
+2012-02-23  Patrick Gansterer  <paroga@webkit.org>
+
+        Unreviewed WinCE build fix after r108462.
+
+        * WebCoreSupport/EditorClientWinCE.h:
+        (EditorClientWinCE):
+
+2012-02-21  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Remove the remaining uses of CSSStyleDeclaration in Editor
+        https://bugs.webkit.org/show_bug.cgi?id=78939
+
+        Reviewed by Enrica Casucci.
+
+        * WebCoreSupport/EditorClientWinCE.cpp:
+        (WebKit::EditorClientWinCE::shouldApplyStyle):
+
+2012-02-22  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Remove the remaining uses of CSSStyleDeclaration in Editor
+        https://bugs.webkit.org/show_bug.cgi?id=78939
+
+        Reviewed by Enrica Casucci.
+
+        * WebCoreSupport/EditorClientWinCE.cpp:
+        (WebKit::EditorClientWinCE::shouldApplyStyle):
+
+2012-02-20  Benjamin Poulain  <benjamin@webkit.org>
+
+        Get rid of the LocalizationStrategy
+        https://bugs.webkit.org/show_bug.cgi?id=78324
+
+        Reviewed by Sam Weinig.
+
+        Remove a useless #include of LocalizationStrategy.h.
+
+        * WebCoreSupport/PlatformStrategiesWinCE.h:
+
+2012-02-15  Patrick Gansterer  <paroga@webkit.org>
+
+        Unreviewed WinCE build fix after r107606.
+
+        * WebCoreSupport/PlatformStrategiesWinCE.cpp:
+        (PlatformStrategiesWinCE::createPasteboardStrategy):
+        * WebCoreSupport/PlatformStrategiesWinCE.h:
+        (PlatformStrategiesWinCE):
+
+2012-02-15  Sadrul Habib Chowdhury  <sadrul@chromium.org>
+
+        Notify ChromeClient when touch-event handlers are installed/removed.
+        https://bugs.webkit.org/show_bug.cgi?id=77440
+
+        Reviewed by Darin Fisher and Ryosuke Niwa.
+
+        * WebCoreSupport/ChromeClientWinCE.h:
+        (WebKit::ChromeClientWinCE::numTouchEventHandlersChanged):
+
 2011-12-19  Sam Weinig  <sam@webkit.org>
 
         More PlatformEvent cleanup
diff --git a/Source/WebKit/wince/WebCoreSupport/ChromeClientWinCE.h b/Source/WebKit/wince/WebCoreSupport/ChromeClientWinCE.h
index 006e010f8..613783a03 100644
--- a/Source/WebKit/wince/WebCoreSupport/ChromeClientWinCE.h
+++ b/Source/WebKit/wince/WebCoreSupport/ChromeClientWinCE.h
@@ -177,6 +177,7 @@ public:
 
     virtual bool shouldRubberBandInDirection(WebCore::ScrollDirection) const { return true; }
     virtual void numWheelEventHandlersChanged(unsigned) { }
+    virtual void numTouchEventHandlersChanged(unsigned) { }
 
 private:
     WebView* m_webView;
diff --git a/Source/WebKit/wince/WebCoreSupport/EditorClientWinCE.cpp b/Source/WebKit/wince/WebCoreSupport/EditorClientWinCE.cpp
index 4cd3aac18..10c23731c 100644
--- a/Source/WebKit/wince/WebCoreSupport/EditorClientWinCE.cpp
+++ b/Source/WebKit/wince/WebCoreSupport/EditorClientWinCE.cpp
@@ -102,7 +102,7 @@ bool EditorClientWinCE::shouldChangeSelectedRange(Range*, Range*, EAffinity, boo
     return true;
 }
 
-bool EditorClientWinCE::shouldApplyStyle(WebCore::CSSStyleDeclaration*, WebCore::Range*)
+bool EditorClientWinCE::shouldApplyStyle(WebCore::StylePropertySet*, WebCore::Range*)
 {
     notImplemented();
     return true;
diff --git a/Source/WebKit/wince/WebCoreSupport/EditorClientWinCE.h b/Source/WebKit/wince/WebCoreSupport/EditorClientWinCE.h
index c29524e1a..fc9ce023f 100644
--- a/Source/WebKit/wince/WebCoreSupport/EditorClientWinCE.h
+++ b/Source/WebKit/wince/WebCoreSupport/EditorClientWinCE.h
@@ -55,7 +55,7 @@ public:
     virtual bool shouldInsertText(const WTF::String&, WebCore::Range*, WebCore::EditorInsertAction);
     virtual bool shouldChangeSelectedRange(WebCore::Range*, WebCore::Range*, WebCore::EAffinity, bool);
 
-    virtual bool shouldApplyStyle(WebCore::CSSStyleDeclaration*, WebCore::Range*);
+    virtual bool shouldApplyStyle(WebCore::StylePropertySet*, WebCore::Range*);
     virtual bool shouldMoveRangeAfterDelete(WebCore::Range*, WebCore::Range*);
 
     virtual void didBeginEditing();
@@ -101,7 +101,7 @@ public:
     virtual void getGuessesForWord(const WTF::String& word, const WTF::String& context, WTF::Vector<WTF::String>& guesses);
     virtual void willSetInputMethodState();
     virtual void setInputMethodState(bool);
-    virtual void requestCheckingOfString(WebCore::SpellChecker*, int, WebCore::TextCheckingTypeMask, const WTF::String&) {}
+    virtual void requestCheckingOfString(WebCore::SpellChecker*, const WebCore::TextCheckingRequest&) { }
     virtual WebCore::TextCheckerClient* textChecker() { return this; }
 
 private:
diff --git a/Source/WebKit/wince/WebCoreSupport/PlatformStrategiesWinCE.cpp b/Source/WebKit/wince/WebCoreSupport/PlatformStrategiesWinCE.cpp
index 3836cbd6a..3f8c907c7 100644
--- a/Source/WebKit/wince/WebCoreSupport/PlatformStrategiesWinCE.cpp
+++ b/Source/WebKit/wince/WebCoreSupport/PlatformStrategiesWinCE.cpp
@@ -58,6 +58,11 @@ VisitedLinkStrategy* PlatformStrategiesWinCE::createVisitedLinkStrategy()
     return this;
 }
 
+PasteboardStrategy* PlatformStrategiesWinCE::createPasteboardStrategy()
+{
+    return 0;
+}
+
 void PlatformStrategiesWinCE::notifyCookiesChanged()
 {
 }
diff --git a/Source/WebKit/wince/WebCoreSupport/PlatformStrategiesWinCE.h b/Source/WebKit/wince/WebCoreSupport/PlatformStrategiesWinCE.h
index 92d37dc65..344635690 100644
--- a/Source/WebKit/wince/WebCoreSupport/PlatformStrategiesWinCE.h
+++ b/Source/WebKit/wince/WebCoreSupport/PlatformStrategiesWinCE.h
@@ -26,7 +26,6 @@
 #define PlatformStrategiesWinCE_h
 
 #include "CookiesStrategy.h"
-#include "LocalizationStrategy.h"
 #include "PlatformStrategies.h"
 #include "PluginStrategy.h"
 #include "VisitedLinkStrategy.h"
@@ -42,6 +41,7 @@ private:
     virtual WebCore::CookiesStrategy* createCookiesStrategy();
     virtual WebCore::PluginStrategy* createPluginStrategy();
     virtual WebCore::VisitedLinkStrategy* createVisitedLinkStrategy();
+    virtual WebCore::PasteboardStrategy* createPasteboardStrategy();
 
     // WebCore::CookiesStrategy
     virtual void notifyCookiesChanged();
diff --git a/Source/WebKit/wx/ChangeLog b/Source/WebKit/wx/ChangeLog
index b45b35005..0c6021eab 100644
--- a/Source/WebKit/wx/ChangeLog
+++ b/Source/WebKit/wx/ChangeLog
@@ -1,3 +1,47 @@
+2012-02-24  Shinya Kawanaka  <shinyak@chromium.org>
+
+        SpellCheckRequest needs to know the context where the spellcheck happened.
+        https://bugs.webkit.org/show_bug.cgi?id=79320
+
+        Reviewed by Hajime Morita.
+
+        * WebKitSupport/EditorClientWx.h:
+        (WebCore::EditorClientWx::requestCheckingOfString):
+
+2012-02-21  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Remove the remaining uses of CSSStyleDeclaration in Editor
+        https://bugs.webkit.org/show_bug.cgi?id=78939
+
+        Reviewed by Enrica Casucci.
+
+        * WebKitSupport/EditorClientWx.cpp:
+        (WebCore::EditorClientWx::shouldApplyStyle):
+        * WebKitSupport/EditorClientWx.h:
+        (EditorClientWx):
+
+2012-02-22  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Remove the remaining uses of CSSStyleDeclaration in Editor
+        https://bugs.webkit.org/show_bug.cgi?id=78939
+
+        Reviewed by Enrica Casucci.
+
+        * WebKitSupport/EditorClientWx.cpp:
+        (WebCore::EditorClientWx::shouldApplyStyle):
+        * WebKitSupport/EditorClientWx.h:
+        (EditorClientWx):
+
+2012-02-15  Sadrul Habib Chowdhury  <sadrul@chromium.org>
+
+        Notify ChromeClient when touch-event handlers are installed/removed.
+        https://bugs.webkit.org/show_bug.cgi?id=77440
+
+        Reviewed by Darin Fisher and Ryosuke Niwa.
+
+        * WebKitSupport/ChromeClientWx.h:
+        (WebCore::ChromeClientWx::numTouchEventHandlersChanged):
+
 2012-01-30  Kevin Ollivier  <kevino@theolliviers.com>
 
         [wx] Unreviewed. Build fix, add JavaScriptCore/runtime
diff --git a/Source/WebKit/wx/WebKitSupport/ChromeClientWx.h b/Source/WebKit/wx/WebKitSupport/ChromeClientWx.h
index dcd164f34..2b6cdef61 100644
--- a/Source/WebKit/wx/WebKitSupport/ChromeClientWx.h
+++ b/Source/WebKit/wx/WebKitSupport/ChromeClientWx.h
@@ -151,6 +151,7 @@ public:
 
     virtual bool shouldRubberBandInDirection(WebCore::ScrollDirection) const { return true; }
     virtual void numWheelEventHandlersChanged(unsigned) { }
+    virtual void numTouchEventHandlersChanged(unsigned) { }
     
     virtual bool hasOpenedPopup() const;
 
diff --git a/Source/WebKit/wx/WebKitSupport/EditorClientWx.cpp b/Source/WebKit/wx/WebKitSupport/EditorClientWx.cpp
index 81d54f813..f2f9ca775 100644
--- a/Source/WebKit/wx/WebKitSupport/EditorClientWx.cpp
+++ b/Source/WebKit/wx/WebKitSupport/EditorClientWx.cpp
@@ -223,7 +223,7 @@ bool EditorClientWx::shouldInsertText(const String&, Range*,
     return true;
 }
 
-bool EditorClientWx::shouldApplyStyle(CSSStyleDeclaration*,
+bool EditorClientWx::shouldApplyStyle(StylePropertySet*,
                                        Range*)
 {
     notImplemented();
diff --git a/Source/WebKit/wx/WebKitSupport/EditorClientWx.h b/Source/WebKit/wx/WebKitSupport/EditorClientWx.h
index d1403d17f..ece15fa87 100644
--- a/Source/WebKit/wx/WebKitSupport/EditorClientWx.h
+++ b/Source/WebKit/wx/WebKitSupport/EditorClientWx.h
@@ -64,7 +64,7 @@ public:
                                   EditorInsertAction);
     virtual bool shouldInsertText(const String&, Range*,
                                   EditorInsertAction);
-    virtual bool shouldApplyStyle(CSSStyleDeclaration*,
+    virtual bool shouldApplyStyle(StylePropertySet*,
                                   Range*);
     virtual bool shouldMoveRangeAfterDelete(Range*, Range*);
     virtual bool shouldChangeSelectedRange(Range* fromRange, Range* toRange, 
@@ -114,7 +114,7 @@ public:
 
     virtual void willSetInputMethodState();
     virtual void setInputMethodState(bool enabled);
-    virtual void requestCheckingOfString(WebCore::SpellChecker*, int, WebCore::TextCheckingTypeMask, const WTF::String&) {}
+    virtual void requestCheckingOfString(WebCore::SpellChecker*, const WebCore::TextCheckingRequest&) { }
     virtual TextCheckerClient* textChecker() { return this; }
 
 private:
diff --git a/Source/WebKit2/CMakeLists.txt b/Source/WebKit2/CMakeLists.txt
index 0414d1333..0dc836c00 100644
--- a/Source/WebKit2/CMakeLists.txt
+++ b/Source/WebKit2/CMakeLists.txt
@@ -17,6 +17,7 @@ SET(WebKit2_INCLUDE_DIRECTORIES
     "${WEBKIT2_DIR}/UIProcess/Authentication"
     "${WEBKIT2_DIR}/UIProcess/Downloads"
     "${WEBKIT2_DIR}/UIProcess/Launcher"
+    "${WEBKIT2_DIR}/UIProcess/Notifications"
     "${WEBKIT2_DIR}/UIProcess/Plugins"
     "${WEBKIT2_DIR}/WebProcess"
     "${WEBKIT2_DIR}/WebProcess/ApplicationCache"
@@ -33,6 +34,7 @@ SET(WebKit2_INCLUDE_DIRECTORIES
     "${WEBKIT2_DIR}/WebProcess/KeyValueStorage"
     "${WEBKIT2_DIR}/WebProcess/Launching"
     "${WEBKIT2_DIR}/WebProcess/MediaCache"
+    "${WEBKIT2_DIR}/WebProcess/Notifications"
     "${WEBKIT2_DIR}/WebProcess/ResourceCache"
     "${WEBKIT2_DIR}/WebProcess/Plugins"
     "${WEBKIT2_DIR}/WebProcess/Plugins/Netscape"
@@ -49,6 +51,7 @@ SET(WebKit2_INCLUDE_DIRECTORIES
     "${WEBCORE_DIR}/editing"
     "${WEBCORE_DIR}/history"
     "${WEBCORE_DIR}/html"
+    "${WEBCORE_DIR}/inspector"
     "${WEBCORE_DIR}/loader"
     "${WEBCORE_DIR}/loader/icon"
     "${WEBCORE_DIR}/loader/cache"
@@ -57,6 +60,7 @@ SET(WebKit2_INCLUDE_DIRECTORIES
     "${WEBCORE_DIR}/platform"
     "${WEBCORE_DIR}/platform/animation"
     "${WEBCORE_DIR}/platform/graphics"
+    "${WEBCORE_DIR}/platform/graphics/filters"
     "${WEBCORE_DIR}/platform/graphics/transforms"
     "${WEBCORE_DIR}/platform/network"
     "${WEBCORE_DIR}/platform/sql"
@@ -91,6 +95,10 @@ SET(WebKit2_INCLUDE_DIRECTORIES
 )
 
 SET(WebKit2_SOURCES
+    Platform/Logging.cpp
+    Platform/Module.cpp
+    Platform/WorkQueue.cpp
+
     Platform/CoreIPC/ArgumentCoders.cpp
     Platform/CoreIPC/ArgumentDecoder.cpp
     Platform/CoreIPC/ArgumentEncoder.cpp
@@ -99,38 +107,17 @@ SET(WebKit2_SOURCES
     Platform/CoreIPC/Connection.cpp
     Platform/CoreIPC/DataReference.cpp
 
-    Platform/Logging.cpp
-    Platform/Module.cpp
-    Platform/RunLoop.cpp
-    Platform/WorkQueue.cpp
-
     PluginProcess/PluginControllerProxy.cpp
+    PluginProcess/PluginCreationParameters.cpp
     PluginProcess/PluginProcess.cpp
     PluginProcess/WebProcessConnection.cpp
 
-    Shared/API/c/WKArray.cpp
-    Shared/API/c/WKCertificateInfo.cpp
-    Shared/API/c/WKContextMenuItem.cpp
-    Shared/API/c/WKData.cpp
-    Shared/API/c/WKDictionary.cpp
-    Shared/API/c/WKError.cpp
-    Shared/API/c/WKGraphicsContext.cpp
-    Shared/API/c/WKImage.cpp
-    Shared/API/c/WKMutableArray.cpp
-    Shared/API/c/WKMutableDictionary.cpp
-    Shared/API/c/WKNumber.cpp
-    Shared/API/c/WKSecurityOrigin.cpp
-    Shared/API/c/WKSerializedScriptValue.cpp
-    Shared/API/c/WKString.cpp
-    Shared/API/c/WKType.cpp
-    Shared/API/c/WKURL.cpp
-    Shared/API/c/WKURLRequest.cpp
-    Shared/API/c/WKURLResponse.cpp
-    Shared/API/c/WKUserContentURLPattern.cpp
-
     Shared/APIClientTraits.cpp
     Shared/APIObject.cpp
     Shared/ChildProcess.cpp
+    Shared/DictionaryPopupInfo.cpp
+    Shared/EditorState.cpp
+    Shared/FontInfo.cpp
     Shared/ImmutableArray.cpp
     Shared/ImmutableDictionary.cpp
     Shared/MutableArray.cpp
@@ -145,6 +132,8 @@ SET(WebKit2_SOURCES
     Shared/UpdateInfo.cpp
     Shared/VisitedLinkTable.cpp
     Shared/WebBackForwardListItem.cpp
+    Shared/WebConnection.cpp
+    Shared/WebConnectionClient.cpp
     Shared/WebContextMenuItem.cpp
     Shared/WebContextMenuItemData.cpp
     Shared/WebCoreArgumentCoders.cpp
@@ -152,10 +141,12 @@ SET(WebKit2_SOURCES
     Shared/WebEvent.cpp
     Shared/WebEventConversion.cpp
     Shared/WebGeolocationPosition.cpp
+    Shared/WebGestureEvent.cpp
     Shared/WebGraphicsContext.cpp
     Shared/WebHitTestResult.cpp
     Shared/WebImage.cpp
     Shared/WebKeyboardEvent.cpp
+    Shared/WebMemorySampler.cpp
     Shared/WebMouseEvent.cpp
     Shared/WebOpenPanelParameters.cpp
     Shared/WebPageCreationParameters.cpp
@@ -169,49 +160,39 @@ SET(WebKit2_SOURCES
     Shared/WebURLResponse.cpp
     Shared/WebWheelEvent.cpp
 
+    Shared/API/c/WKArray.cpp
+    Shared/API/c/WKCertificateInfo.cpp
+    Shared/API/c/WKConnectionRef.cpp
+    Shared/API/c/WKContextMenuItem.cpp
+    Shared/API/c/WKData.cpp
+    Shared/API/c/WKDictionary.cpp
+    Shared/API/c/WKError.cpp
+    Shared/API/c/WKGeometry.cpp
+    Shared/API/c/WKGraphicsContext.cpp
+    Shared/API/c/WKImage.cpp
+    Shared/API/c/WKMutableArray.cpp
+    Shared/API/c/WKMutableDictionary.cpp
+    Shared/API/c/WKNumber.cpp
+    Shared/API/c/WKSecurityOrigin.cpp
+    Shared/API/c/WKSerializedScriptValue.cpp
+    Shared/API/c/WKString.cpp
+    Shared/API/c/WKType.cpp
+    Shared/API/c/WKURL.cpp
+    Shared/API/c/WKURLRequest.cpp
+    Shared/API/c/WKURLResponse.cpp
+    Shared/API/c/WKUserContentURLPattern.cpp
+
     Shared/Plugins/NPIdentifierData.cpp
     Shared/Plugins/NPObjectMessageReceiver.cpp
     Shared/Plugins/NPObjectProxy.cpp
     Shared/Plugins/NPRemoteObjectMap.cpp
     Shared/Plugins/NPVariantData.cpp
+    Shared/Plugins/PluginModuleInfo.cpp
     Shared/Plugins/PluginProcessCreationParameters.cpp
 
     Shared/Plugins/Netscape/NetscapePluginModule.cpp
     Shared/Plugins/Netscape/NetscapePluginModuleNone.cpp
 
-    UIProcess/API/C/WKApplicationCacheManager.cpp
-    UIProcess/API/C/WKAuthenticationChallenge.cpp
-    UIProcess/API/C/WKAuthenticationDecisionListener.cpp
-    UIProcess/API/C/WKBackForwardList.cpp
-    UIProcess/API/C/WKBackForwardListItem.cpp
-    UIProcess/API/C/WKContext.cpp
-    UIProcess/API/C/WKCookieManager.cpp
-    UIProcess/API/C/WKCredential.cpp
-    UIProcess/API/C/WKDatabaseManager.cpp
-    UIProcess/API/C/WKDownload.cpp
-    UIProcess/API/C/WKFormSubmissionListener.cpp
-    UIProcess/API/C/WKFrame.cpp
-    UIProcess/API/C/WKFramePolicyListener.cpp
-    UIProcess/API/C/WKGeolocationManager.cpp
-    UIProcess/API/C/WKGeolocationPermissionRequest.cpp
-    UIProcess/API/C/WKGeolocationPosition.cpp
-    UIProcess/API/C/WKGrammarDetail.cpp
-    UIProcess/API/C/WKHitTestResult.cpp
-    UIProcess/API/C/WKIconDatabase.cpp
-    UIProcess/API/C/WKInspector.cpp
-    UIProcess/API/C/WKKeyValueStorageManager.cpp
-    UIProcess/API/C/WKMediaCacheManager.cpp
-    UIProcess/API/C/WKNavigationData.cpp
-    UIProcess/API/C/WKOpenPanelParameters.cpp
-    UIProcess/API/C/WKOpenPanelResultListener.cpp
-    UIProcess/API/C/WKPage.cpp
-    UIProcess/API/C/WKPageGroup.cpp
-    UIProcess/API/C/WKPluginSiteDataManager.cpp
-    UIProcess/API/C/WKPreferences.cpp
-    UIProcess/API/C/WKProtectionSpace.cpp
-    UIProcess/API/C/WKResourceCacheManager.cpp
-    UIProcess/API/C/WKTextChecker.cpp
-
     UIProcess/BackingStore.cpp
     UIProcess/DrawingAreaProxy.cpp
     UIProcess/DrawingAreaProxyImpl.cpp
@@ -222,7 +203,9 @@ SET(WebKit2_SOURCES
     UIProcess/VisitedLinkProvider.cpp
     UIProcess/WebApplicationCacheManagerProxy.cpp
     UIProcess/WebBackForwardList.cpp
+    UIProcess/WebConnectionToWebProcess.cpp
     UIProcess/WebContext.cpp
+    UIProcess/WebContextConnectionClient.cpp
     UIProcess/WebContextInjectedBundleClient.cpp
     UIProcess/WebContextMenuProxy.cpp
     UIProcess/WebCookieManagerProxy.cpp
@@ -262,6 +245,42 @@ SET(WebKit2_SOURCES
     UIProcess/WebTextCheckerClient.cpp
     UIProcess/WebUIClient.cpp
 
+    UIProcess/API/C/WKApplicationCacheManager.cpp
+    UIProcess/API/C/WKAuthenticationChallenge.cpp
+    UIProcess/API/C/WKAuthenticationDecisionListener.cpp
+    UIProcess/API/C/WKBackForwardList.cpp
+    UIProcess/API/C/WKBackForwardListItem.cpp
+    UIProcess/API/C/WKContext.cpp
+    UIProcess/API/C/WKCookieManager.cpp
+    UIProcess/API/C/WKCredential.cpp
+    UIProcess/API/C/WKDatabaseManager.cpp
+    UIProcess/API/C/WKDownload.cpp
+    UIProcess/API/C/WKFormSubmissionListener.cpp
+    UIProcess/API/C/WKFrame.cpp
+    UIProcess/API/C/WKFramePolicyListener.cpp
+    UIProcess/API/C/WKGeolocationManager.cpp
+    UIProcess/API/C/WKGeolocationPermissionRequest.cpp
+    UIProcess/API/C/WKGeolocationPosition.cpp
+    UIProcess/API/C/WKGrammarDetail.cpp
+    UIProcess/API/C/WKHitTestResult.cpp
+    UIProcess/API/C/WKIconDatabase.cpp
+    UIProcess/API/C/WKInspector.cpp
+    UIProcess/API/C/WKKeyValueStorageManager.cpp
+    UIProcess/API/C/WKMediaCacheManager.cpp
+    UIProcess/API/C/WKNavigationData.cpp
+    UIProcess/API/C/WKNotification.cpp
+    UIProcess/API/C/WKNotificationManager.cpp
+    UIProcess/API/C/WKNotificationPermissionRequest.cpp
+    UIProcess/API/C/WKOpenPanelParameters.cpp
+    UIProcess/API/C/WKOpenPanelResultListener.cpp
+    UIProcess/API/C/WKPage.cpp
+    UIProcess/API/C/WKPageGroup.cpp
+    UIProcess/API/C/WKPluginSiteDataManager.cpp
+    UIProcess/API/C/WKPreferences.cpp
+    UIProcess/API/C/WKProtectionSpace.cpp
+    UIProcess/API/C/WKResourceCacheManager.cpp
+    UIProcess/API/C/WKTextChecker.cpp
+
     UIProcess/Authentication/AuthenticationChallengeProxy.cpp
     UIProcess/Authentication/AuthenticationDecisionListener.cpp
     UIProcess/Authentication/WebCredential.cpp
@@ -272,11 +291,18 @@ SET(WebKit2_SOURCES
     UIProcess/Launcher/ProcessLauncher.cpp
     UIProcess/Launcher/ThreadLauncher.cpp
 
+    UIProcess/Notifications/NotificationPermissionRequest.cpp
+    UIProcess/Notifications/NotificationPermissionRequestManagerProxy.cpp
+    UIProcess/Notifications/WebNotification.cpp
+    UIProcess/Notifications/WebNotificationManagerProxy.cpp
+    UIProcess/Notifications/WebNotificationProvider.cpp
+
     UIProcess/Plugins/PluginInfoStore.cpp
     UIProcess/Plugins/PluginProcessManager.cpp
     UIProcess/Plugins/PluginProcessProxy.cpp
     UIProcess/Plugins/WebPluginSiteDataManager.cpp
 
+    WebProcess/WebConnectionToUIProcess.cpp
     WebProcess/WebKitMain.cpp
     WebProcess/WebProcess.cpp
 
@@ -334,6 +360,9 @@ SET(WebKit2_SOURCES
 
     WebProcess/MediaCache/WebMediaCacheManager.cpp
 
+    WebProcess/Notifications/NotificationPermissionRequestManager.cpp
+    WebProcess/Notifications/WebNotificationManager.cpp
+
     WebProcess/Plugins/Plugin.cpp
     WebProcess/Plugins/PluginProcessConnection.cpp
     WebProcess/Plugins/PluginProcessConnectionManager.cpp
@@ -361,6 +390,7 @@ SET(WebKit2_SOURCES
     WebProcess/WebCoreSupport/WebGeolocationClient.cpp
     WebProcess/WebCoreSupport/WebInspectorClient.cpp
     WebProcess/WebCoreSupport/WebInspectorFrontendClient.cpp
+    WebProcess/WebCoreSupport/WebNotificationClient.cpp
     WebProcess/WebCoreSupport/WebPlatformStrategies.cpp
     WebProcess/WebCoreSupport/WebPopupMenu.cpp
     WebProcess/WebCoreSupport/WebSearchPopupMenu.cpp
@@ -369,55 +399,82 @@ SET(WebKit2_SOURCES
     WebProcess/WebPage/DrawingArea.cpp
     WebProcess/WebPage/DrawingAreaImpl.cpp
     WebProcess/WebPage/EncoderAdapter.cpp
+    WebProcess/WebPage/EventDispatcher.cpp
     WebProcess/WebPage/FindController.cpp
     WebProcess/WebPage/LayerTreeHost.cpp
     WebProcess/WebPage/PageOverlay.cpp
+    WebProcess/WebPage/TapHighlightController.cpp
     WebProcess/WebPage/WebBackForwardListProxy.cpp
     WebProcess/WebPage/WebContextMenu.cpp
-    WebProcess/WebPage/WebUndoStep.cpp
     WebProcess/WebPage/WebFrame.cpp
     WebProcess/WebPage/WebInspector.cpp
     WebProcess/WebPage/WebOpenPanelResultListener.cpp
     WebProcess/WebPage/WebPage.cpp
     WebProcess/WebPage/WebPageGroupProxy.cpp
+    WebProcess/WebPage/WebUndoStep.cpp
 )
 
 SET(WebKit2_MESSAGES_IN_FILES
-    UIProcess/WebMediaCacheManagerProxy.messages.in
+    PluginProcess/PluginControllerProxy.messages.in
+    PluginProcess/PluginProcess.messages.in
+    PluginProcess/WebProcessConnection.messages.in
+
+    Shared/Plugins/NPObjectMessageReceiver.messages.in
+
+    UIProcess/DrawingAreaProxy.messages.in
+    UIProcess/LayerTreeHostProxy.messages.in
+    UIProcess/WebApplicationCacheManagerProxy.messages.in
+    UIProcess/WebContext.messages.in
     UIProcess/WebCookieManagerProxy.messages.in
-    UIProcess/Plugins/PluginProcessProxy.messages.in
-    UIProcess/WebInspectorProxy.messages.in
-    UIProcess/WebFullScreenManagerProxy.messages.in
     UIProcess/WebDatabaseManagerProxy.messages.in
-    UIProcess/WebPageProxy.messages.in
-    UIProcess/WebIconDatabase.messages.in
-    UIProcess/Downloads/DownloadProxy.messages.in
-    UIProcess/WebContext.messages.in
+    UIProcess/WebFullScreenManagerProxy.messages.in
     UIProcess/WebGeolocationManagerProxy.messages.in
-    UIProcess/DrawingAreaProxy.messages.in
+    UIProcess/WebIconDatabase.messages.in
+    UIProcess/WebInspectorProxy.messages.in
     UIProcess/WebKeyValueStorageManagerProxy.messages.in
-    UIProcess/WebResourceCacheManagerProxy.messages.in
+    UIProcess/WebMediaCacheManagerProxy.messages.in
+    UIProcess/WebPageProxy.messages.in
     UIProcess/WebProcessProxy.messages.in
-    UIProcess/WebApplicationCacheManagerProxy.messages.in
-    PluginProcess/WebProcessConnection.messages.in
-    PluginProcess/PluginControllerProxy.messages.in
-    PluginProcess/PluginProcess.messages.in
-    Shared/Plugins/NPObjectMessageReceiver.messages.in
-    WebProcess/ApplicationCache/WebApplicationCacheManager.messages.in
-    WebProcess/MediaCache/WebMediaCacheManager.messages.in
-    WebProcess/Plugins/PluginProxy.messages.in
+    UIProcess/WebResourceCacheManagerProxy.messages.in
+
+    UIProcess/Downloads/DownloadProxy.messages.in
+
+    UIProcess/Notifications/WebNotificationManagerProxy.messages.in
+
+    UIProcess/Plugins/PluginProcessProxy.messages.in
+
     WebProcess/WebProcess.messages.in
-    WebProcess/Geolocation/WebGeolocationManager.messages.in
-    WebProcess/WebCoreSupport/WebDatabaseManager.messages.in
-    WebProcess/IconDatabase/WebIconDatabaseProxy.messages.in
+
+    WebProcess/ApplicationCache/WebApplicationCacheManager.messages.in
+
     WebProcess/Authentication/AuthenticationManager.messages.in
-    WebProcess/ResourceCache/WebResourceCacheManager.messages.in
-    WebProcess/FullScreen/WebFullScreenManager.messages.in
+
     WebProcess/Cookies/WebCookieManager.messages.in
+
+    WebProcess/FullScreen/WebFullScreenManager.messages.in
+
+    WebProcess/Geolocation/WebGeolocationManager.messages.in
+
+    WebProcess/IconDatabase/WebIconDatabaseProxy.messages.in
+
     WebProcess/KeyValueStorage/WebKeyValueStorageManager.messages.in
-    WebProcess/WebPage/WebPage.messages.in
-    WebProcess/WebPage/WebInspector.messages.in
+
+    WebProcess/MediaCache/WebMediaCacheManager.messages.in
+
+    WebProcess/Notifications/WebNotificationManager.messages.in
+
+    WebProcess/Plugins/PluginProcessConnection.messages.in
+    WebProcess/Plugins/PluginProxy.messages.in
+
+    WebProcess/ResourceCache/WebResourceCacheManager.messages.in
+
+    WebProcess/WebCoreSupport/WebDatabaseManager.messages.in
+
     WebProcess/WebPage/DrawingArea.messages.in
+    WebProcess/WebPage/EventDispatcher.messages.in
+    WebProcess/WebPage/LayerTreeHost.messages.in
+    WebProcess/WebPage/WebInspector.messages.in
+    WebProcess/WebPage/WebPage.messages.in
 )
 
 # Create JavaScript C++ code given an IDL input
@@ -449,10 +506,9 @@ SET(WebProcess_LIBRARIES
 
 SET(ForwardingHeaders_NAME )
 SET(ForwardingNetworkHeaders_NAME )
-INCLUDE_IF_EXISTS(${WEBKIT2_DIR}/Platform${PORT}.cmake)
+WEBKIT_INCLUDE_CONFIG_FILES_IF_EXISTS()
 
 ADD_DEFINITIONS(-DBUILDING_WEBKIT)
-ADD_DEFINITIONS(-DWTF_USE_JSC=1)
 INCLUDE_DIRECTORIES(${WebKit2_INCLUDE_DIRECTORIES})
 ADD_LIBRARY(${WebKit2_LIBRARY_NAME} ${WebKit2_LIBRARY_TYPE} ${WebKit2_SOURCES})
 
diff --git a/Source/WebKit2/ChangeLog b/Source/WebKit2/ChangeLog
index 35d30bb45..85a7f4bde 100644
--- a/Source/WebKit2/ChangeLog
+++ b/Source/WebKit2/ChangeLog
@@ -1,3 +1,2201 @@
+2012-02-24  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        [Qt] Use private QSGRenderNode in QQuickWebView for improved Qt Scene Graph integration
+        https://bugs.webkit.org/show_bug.cgi?id=79022
+
+        Reviewed by Csaba Osztrogonác.
+
+        * Target.pri:
+        * UIProcess/API/qt/qquickwebpage.cpp:
+        (PageProxyNode::PageProxyNode):
+        (PageProxyNode::changedStates):
+        (PageProxyNode::render):
+        (PageProxyNode):
+
+2012-02-24  Carlos Garcia Campos  <cgarcia@igalia.com>
+
+        [GTK] Encode/decode Null ResourceResponse objects in WebKit2
+        https://bugs.webkit.org/show_bug.cgi?id=79471
+
+        Reviewed by Philippe Normand.
+
+        * Shared/gtk/WebCoreArgumentCodersGtk.cpp:
+        (CoreIPC::::encode): Check whether ResourceResponse is Null before
+        encoding it.
+        (CoreIPC::::decode): Check whether response is Null and create a
+        Null ResourceResponse object in such case.
+
+2012-02-24  Shinya Kawanaka  <shinyak@chromium.org>
+
+        SpellCheckRequest needs to know the context where the spellcheck happened.
+        https://bugs.webkit.org/show_bug.cgi?id=79320
+
+        Reviewed by Hajime Morita.
+
+        * WebProcess/WebCoreSupport/WebEditorClient.cpp:
+        (WebKit::WebEditorClient::requestCheckingOfString):
+        * WebProcess/WebCoreSupport/WebEditorClient.h:
+
+2012-02-23  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        [Qt] Tiling: Improve the method names dealing with moving and scaling.
+
+        Rubberstamped by Simon Hausmann.
+
+        * UIProcess/API/qt/qquickwebview.cpp:
+        (QQuickWebViewLegacyPrivate::updateViewportSize):
+        (QQuickWebViewFlickablePrivate::onComponentComplete):
+        (QQuickWebViewFlickablePrivate::updateViewportSize):
+        (QQuickWebViewFlickablePrivate::_q_commitScaleChange):
+        (QQuickWebViewPrivate::_q_commitPositionChange):
+        (QQuickWebViewFlickablePrivate::_q_resume):
+        * UIProcess/API/qt/qquickwebview_p.h:
+        * UIProcess/API/qt/qquickwebview_p_p.h:
+        (QQuickWebViewPrivate):
+        (QQuickWebViewPrivate::_q_commitScaleChange):
+        (QQuickWebViewFlickablePrivate):
+        * UIProcess/DrawingAreaProxy.h:
+        (WebKit::DrawingAreaProxy::setVisibleContentsRectForScaling):
+        (WebKit::DrawingAreaProxy::setVisibleContentsRectForPanning):
+        * UIProcess/DrawingAreaProxyImpl.cpp:
+        (WebKit::DrawingAreaProxyImpl::setVisibleContentsRectForScaling):
+        (WebKit::DrawingAreaProxyImpl::setVisibleContentsRectForPanning):
+        * UIProcess/DrawingAreaProxyImpl.h:
+        (DrawingAreaProxyImpl):
+        * UIProcess/LayerTreeHostProxy.h:
+        (LayerTreeHostProxy):
+        * UIProcess/qt/LayerTreeHostProxyQt.cpp:
+        (WebKit::LayerTreeHostProxy::setVisibleContentsRectForPanning):
+        (WebKit::LayerTreeHostProxy::setVisibleContentsRectForScaling):
+        * UIProcess/qt/QtViewportInteractionEngine.cpp:
+        (WebKit::ViewportUpdateDeferrer::~ViewportUpdateDeferrer):
+        (WebKit::QtViewportInteractionEngine::flickableMovingPositionUpdate):
+        (WebKit::QtViewportInteractionEngine::wheelEvent):
+        (WebKit::QtViewportInteractionEngine::pinchGestureStarted):
+        * UIProcess/qt/QtViewportInteractionEngine.h:
+        (QtViewportInteractionEngine):
+        * WebProcess/WebPage/LayerTreeHost.h:
+        (WebKit::LayerTreeHost::setVisibleContentsRectForScaling):
+        (WebKit::LayerTreeHost::setVisibleContentsRectForPanning):
+        (WebKit::LayerTreeHost::setVisibleContentsRectForLayer):
+        * WebProcess/WebPage/LayerTreeHost.messages.in:
+        * WebProcess/WebPage/qt/LayerTreeHostQt.cpp:
+        (WebKit::LayerTreeHostQt::setVisibleContentsRectForScaling):
+        (WebKit::LayerTreeHostQt::setVisibleContentsRectForPanning):
+        * WebProcess/WebPage/qt/LayerTreeHostQt.h:
+        (LayerTreeHostQt):
+
+2012-02-24  Sergio Villar Senin  <svillar@igalia.com>
+
+        [WK2] [GTK] Destructor not invoked in EditorClientFrameDestructionObserver
+        https://bugs.webkit.org/show_bug.cgi?id=79466
+
+        Reviewed by Philippe Normand.
+
+        Explicitly cast the observer before deleting it instead of just
+        deleting a generic pointer. We must to that in order to get the
+        destructor of the object properly called.
+
+        * WebProcess/WebCoreSupport/gtk/WebEditorClientGtk.cpp:
+        (WebKit::EditorClientFrameDestructionObserver::destroyOnClosureFinalization):
+
+2012-02-23  Andy Estes  <aestes@apple.com>
+
+        Rename [setS|s]uppressIncrementalRendering to [setS|s]uppressesIncrementalRendering and make it WebPreferences API.
+        https://bugs.webkit.org/show_bug.cgi?id=79433
+
+        Reviewed by Dan Bernstein.
+
+        * Shared/WebPreferencesStore.h:
+        (WebKit):
+        * UIProcess/API/C/WKPreferences.cpp:
+        (WKPreferencesSetSuppressesIncrementalRendering):
+        (WKPreferencesGetSuppressesIncrementalRendering):
+        * UIProcess/API/C/WKPreferences.h:
+        * UIProcess/WebInspectorProxy.cpp:
+        (WebKit::createInspectorPageGroup):
+        * WebProcess/WebCoreSupport/WebFrameLoaderClient.cpp:
+        (WebKit::WebFrameLoaderClient::dispatchDidFirstLayout):
+        * WebProcess/WebPage/WebPage.cpp:
+        (WebKit::WebPage::updatePreferences):
+
+2012-02-23  Mario Sanchez Prada  <msanchez@igalia.com>
+
+        [GTK] Wrong signal name on emission in WebKitWindowProperties.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=79352
+
+        Reviewed by Philippe Normand.
+
+        Emit the signal 'resizable' instead of 'resizable-visible'.
+
+        * UIProcess/API/gtk/WebKitWindowProperties.cpp:
+        (webkitWindowPropertiesSetResizable): Use right signal name.
+
+2012-02-23  Anders Carlsson  <andersca@apple.com>
+
+        Flush layer changes after layout when resizing web page
+        https://bugs.webkit.org/show_bug.cgi?id=79399
+        <rdar://problem/10920157>
+
+        Reviewed by Andreas Kling.
+
+        Flush layer changes after layout, otherwise the scrollbars won't be updated
+        until sometime later which looks bad.
+
+        * WebProcess/WebPage/mac/TiledCoreAnimationDrawingArea.mm:
+        (WebKit::TiledCoreAnimationDrawingArea::updateGeometry):
+
+2012-02-23  Daniel Bates  <dbates@webkit.org>
+
+        Add missing "Reviewed by" line to change log entry for changeset r108631
+        (https://bugs.webkit.org/show_bug.cgi?id=79252)
+
+        The patch landed in changeset r108631 was reviewed by Martin Robinson.
+
+        * ChangeLog:
+
+2012-02-23  Patrick Gansterer  <paroga@webkit.org>
+
+        [CMake] Add WEBKIT_INCLUDE_CONFIG_FILES_IF_EXISTS macro
+        https://bugs.webkit.org/show_bug.cgi?id=79371
+
+        Reviewed by Daniel Bates.
+
+        * CMakeLists.txt:
+
+2012-02-23  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        [Qt] Add support for touch cancellation
+        https://bugs.webkit.org/show_bug.cgi?id=79348
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Convert and forward incoming touch cancellation events
+        to the web process.
+
+        * Shared/qt/WebEventFactoryQt.cpp:
+        (WebKit::webEventTypeForEvent):
+        (WebKit::WebEventFactory::createWebTouchEvent):
+        * UIProcess/API/qt/qquickwebview.cpp:
+        (QQuickWebView::event):
+        * UIProcess/qt/QtWebPageEventHandler.cpp:
+        (QtWebPageEventHandler::handleEvent):
+
+2012-02-23  Brent Fulgham  <bfulgham@webkit.org>
+
+        [WinCairo] Build fix after r108428.
+
+        * win/WebKit2CFLite.def: Add missing export declaration.
+
+2012-02-23  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Unreviewed test fix after r108614: Adjust public API after changes.
+
+        * UIProcess/API/qt/tests/publicapi/tst_publicapi.cpp:
+
+2012-02-23  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        [Qt] Build fix. Qt WebKit2 can not be compiled due to QtWebPageEventHandler.
+        https://bugs.webkit.org/show_bug.cgi?id=79335
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        In the upcoming Qt 5 builds the convenient setInputMethodHints method on QQuickItem
+        will be removed. There's no need for us to use it, we can implement passing the hints
+        to the input method right away in our re-implementation of inputMethodQuery, which works
+        with old and newer Qt 5 builds.
+
+        * UIProcess/API/qt/qquickwebview.cpp:
+        (QQuickWebView::inputMethodQuery):
+        * UIProcess/qt/QtWebPageEventHandler.cpp:
+        (QtWebPageEventHandler::updateTextInputState):
+
+2012-02-23  Sergio Villar Senin  <svillar@igalia.com>
+
+        [WK2][GTK] WebProcess SIGSEVs due to incorrect clipboard handling
+        https://bugs.webkit.org/show_bug.cgi?id=79252
+
+        Reviewed by Martin Robinson.
+
+        Do not execute clipboard callbacks after the Frame associated with
+        it is destroyed.
+
+        This change is already covered by the TestWebViewEditor unit tests
+        (among others), they hang (because WebProcess dies) without this
+        patch in Debug builds.
+
+        * WebProcess/WebCoreSupport/gtk/WebEditorClientGtk.cpp:
+        (EditorClientFrameDestructionObserver):
+        (WebKit::EditorClientFrameDestructionObserver::EditorClientFrameDestructionObserver):
+        (WebKit::EditorClientFrameDestructionObserver::frameDestroyed):
+        (WebKit::EditorClientFrameDestructionObserver::destroyOnClosureFinalization):
+        (WebKit):
+        (WebKit::WebEditorClient::setSelectionPrimaryClipboardIfNeeded):
+
+2012-02-23  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        [Qt] Page doesn't get repainted while panning is in progress
+        https://bugs.webkit.org/show_bug.cgi?id=78602
+
+        Reviewed by Simon Hausmann.
+
+        The tiling code needed the current visibleContentsRect in order to be
+        able to create tiles, so we now make sure it gets it. We also needed
+        to make sure to set the trajectory vector while panning and while the
+        flicking engine was animating kinetic scrolling.
+
+        * UIProcess/API/qt/qquickwebview.cpp:
+        (QQuickWebViewFlickablePrivate::_q_updateVisibleContentRectAndScale):
+        (QQuickWebViewPrivate::_q_viewportTrajectoryVectorChanged):
+        * UIProcess/DrawingAreaProxy.h:
+        (WebKit::DrawingAreaProxy::setVisibleContentRectTrajectoryVector):
+        * UIProcess/DrawingAreaProxyImpl.cpp:
+        (WebKit::DrawingAreaProxyImpl::setVisibleContentRectTrajectoryVector):
+        * UIProcess/DrawingAreaProxyImpl.h:
+        (DrawingAreaProxyImpl):
+        * UIProcess/LayerTreeHostProxy.h:
+        (LayerTreeHostProxy):
+        * UIProcess/qt/LayerTreeHostProxyQt.cpp:
+        (WebKit::LayerTreeHostProxy::setVisibleContentRectTrajectoryVector):
+        * UIProcess/qt/QtViewportInteractionEngine.cpp:
+        (WebKit::QtViewportInteractionEngine::QtViewportInteractionEngine):
+        (WebKit::QtViewportInteractionEngine::flickableMovingStateChanged):
+        (WebKit):
+        (WebKit::QtViewportInteractionEngine::panMoveStarted):
+        (WebKit::QtViewportInteractionEngine::panMoveEnded):
+        (WebKit::QtViewportInteractionEngine::flickableMovingPositionUpdate):
+        (WebKit::QtViewportInteractionEngine::panGestureRequestUpdate):
+        * UIProcess/qt/QtViewportInteractionEngine.h:
+        (QtViewportInteractionEngine):
+        * WebProcess/WebPage/LayerTreeHost.h:
+        (WebKit::LayerTreeHost::setVisibleContentRectTrajectoryVector):
+        * WebProcess/WebPage/LayerTreeHost.messages.in:
+        * WebProcess/WebPage/qt/LayerTreeHostQt.cpp:
+        (WebKit::LayerTreeHostQt::setVisibleContentRectAndScale):
+        (WebKit::LayerTreeHostQt::setVisibleContentRectTrajectoryVector):
+        * WebProcess/WebPage/qt/LayerTreeHostQt.h:
+        (LayerTreeHostQt):
+
+2012-02-23  Patrick Gansterer  <paroga@webkit.org>
+
+        [CMAKE][WK2] Cleanup WebKit2/CMakeLists.txt.
+        https://bugs.webkit.org/show_bug.cgi?id=76122
+
+        Reviewed by Eric Seidel.
+
+        * CMakeLists.txt: Removed hardcoded WTF_USE_JSC preprocessor definition.
+
+2012-02-23  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        [WK2] Trivial build fix after r108615.
+
+        * WebProcess/WebPage/WebPage.cpp:
+        (WebKit::WebPage::WebPage):
+
+2012-02-22  Michael Tyutyunik  <michael.tyutyunik@nokia.com>
+
+        [Qt][WK2] navigationType is missing in new API
+        https://bugs.webkit.org/show_bug.cgi?id=78867
+
+        Reviewed by Simon Hausmann.
+
+        In QtWebPagePolicyClient::decidePolicyForNavigationAction()
+        navigationType argument is dropped by mistake. Adding it back
+        and make it available through NavigationRequest.
+
+        * UIProcess/API/qt/qquickwebview_p.h:
+        * UIProcess/API/qt/qwebnavigationrequest.cpp:
+        (QWebNavigationRequestPrivate::QWebNavigationRequestPrivate):
+        (QWebNavigationRequestPrivate):
+        (QWebNavigationRequest::QWebNavigationRequest):
+        (QWebNavigationRequest::navigationType):
+        * UIProcess/API/qt/qwebnavigationrequest_p.h:
+        * UIProcess/qt/QtWebPagePolicyClient.cpp:
+        (QtWebPagePolicyClient::decidePolicyForNavigationAction):
+        (toQuickWebViewNavigationType):
+        * UIProcess/qt/QtWebPagePolicyClient.h:
+        (QtWebPagePolicyClient):
+
+2012-02-22  Anders Carlsson  <andersca@apple.com>
+
+        Implement TiledCoreAnimationDrawingAreaProxy::deviceScaleFactorDidChange
+        https://bugs.webkit.org/show_bug.cgi?id=79297
+        <rdar://problem/10748510>
+
+        Reviewed by Beth Dakin.
+
+        * UIProcess/mac/TiledCoreAnimationDrawingAreaProxy.mm:
+        (WebKit::TiledCoreAnimationDrawingAreaProxy::deviceScaleFactorDidChange):
+        Send a message to the web process.
+
+        * WebProcess/WebPage/DrawingArea.h:
+        (WebKit::DrawingArea::setDeviceScaleFactor):
+        Add empty stub.
+
+        * WebProcess/WebPage/DrawingArea.messages.in:
+        Add SetDeviceScaleFactor message.
+
+        * WebProcess/WebPage/mac/TiledCoreAnimationDrawingArea.mm:
+        (WebKit::TiledCoreAnimationDrawingArea::setDeviceScaleFactor):
+        Call WebPage::setDeviceScaleFactor.
+
+2012-02-22  Brady Eidson  <beidson@apple.com>
+
+        <rdar://problem/10406044> and https://bugs.webkit.org/show_bug.cgi?id=79279
+        Synchronous ShouldGoToBackForwardListItem causes lots of WebProcess hangs
+
+        Reviewed by Anders Carlsson.
+
+        Anytime the WebProcess sends a sync message up to the UI Process a hang can ensue.
+        
+        In the case of shouldGoToBackForwardListItem it seems many clients want a back/forward
+        notification but don't actually want to make a policy decision.
+
+        Making it an asynchronous notification instead of a synchronous policy call will remove the
+        possibility of a hang here.
+
+        If clients later decide it is important to have a policy here we should implement a form of
+        shouldGoToBackForwardListItem in the bundle loader client.
+
+        Add a notification "willGoToBackForwardListItem" to the WKPageLoaderClient:
+        * UIProcess/API/C/WKPage.h:
+
+        * UIProcess/WebPageProxy.cpp:
+        (WebKit::WebPageProxy::initializeLoaderClient): Tell the WebProcess whether it should be
+          sending the shouldGoToBackForwardListItem or willGoToBackForwardListItem form of this message.
+        (WebKit::WebPageProxy::shouldGoToBackForwardListItem): 
+        (WebKit::WebPageProxy::willGoToBackForwardListItem):
+        * UIProcess/WebPageProxy.h:
+        * UIProcess/WebPageProxy.messages.in: Add an asynchronous WillGoToBackForwardListItem message
+
+        Store a flag in the WebProcess - Sent from the UIProcess - to tell the FrameLoaderClient which form 
+        of the callback should be used:
+        * WebProcess/WebPage/WebPage.cpp:
+        (WebKit::WebPage::WebPage):
+        * WebProcess/WebPage/WebPage.h:
+        (WebKit::WebPage::willGoToBackForwardItemCallbackEnabled):
+        (WebKit::WebPage::setWillGoToBackForwardItemCallbackEnabled):
+        * WebProcess/WebPage/WebPage.messages.in:
+
+        * UIProcess/WebLoaderClient.cpp:
+        (WebKit::WebLoaderClient::shouldGoToBackForwardListItem): Only consider calling this for
+          version 0 clients.
+        (WebKit::WebLoaderClient::willGoToBackForwardListItem): Later clients get this callback.
+        * UIProcess/WebLoaderClient.h:
+        (WebLoaderClient):
+        
+        * WebProcess/WebCoreSupport/WebFrameLoaderClient.cpp:
+        (WebKit::WebFrameLoaderClient::shouldGoToHistoryItem): Send either the synchronous "should" message
+          or the asynchronous "will" message depending on which the WebProcess was last told that the
+          UIProcess expects. There is an edge case where the wrong one might be sent because the WebProcess
+          hasn't received the message about a change in the WKPageLoaderClient yet but that's probably okay;
+          It seems unlikely that a UIProcess client would ever rapidly change between v0 and other versions
+          of the loader client and the UIProcess of WebKit2 is equipped to handle that case if it comes up.
+
+2012-02-16  Jon Lee  <jonlee@apple.com>
+
+        [WK2] Clearing notifications does not clean up internal state
+        https://bugs.webkit.org/show_bug.cgi?id=78861
+        <rdar://problem/10881167>
+
+        Reviewed by Anders Carlsson.
+
+        * WebProcess/Notifications/WebNotificationManager.cpp:
+        (WebKit::WebNotificationManager::clearNotifications): This function was missing removing the notification
+        entries from the other maps.
+        (WebKit::WebNotificationManager::didDestroyNotification): When the notification is destroyed, it should
+        also be removed from the context map.
+        (WebKit::WebNotificationManager::didCloseNotifications): Refactor to pull out the code that removes
+        a provided notification from the context map.
+        (WebKit::WebNotificationManager::removeNotificationFromContextMap): Find the notification in the map, and
+        remove it. If the map is empty, get rid of the entry.
+        * WebProcess/Notifications/WebNotificationManager.h:
+        (WebNotificationManager):
+
+2012-02-22  Jon Lee  <jonlee@apple.com>
+
+        Code cleanup in WebNotificationManager (79285)
+        https://bugs.webkit.org/show_bug.cgi?id=79285
+        <rdar://problem/10914522>
+
+        Reviewed by Anders Carlsson.
+
+        * WebProcess/Notifications/WebNotificationManager.cpp:
+        (WebKit::WebNotificationManager::show): Simplify adding a blank vector to the map using .add(),
+        similar to what is found in WebNotificationClient.mm in WebKit 1.
+
+2012-02-21  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Remove the remaining uses of CSSStyleDeclaration in Editor
+        https://bugs.webkit.org/show_bug.cgi?id=78939
+
+        Reviewed by Enrica Casucci.
+
+        * WebProcess/WebCoreSupport/WebEditorClient.cpp:
+        (WebKit::WebEditorClient::shouldApplyStyle):
+        * WebProcess/WebCoreSupport/WebEditorClient.h:
+        (WebEditorClient):
+
+2012-02-22  Martin Robinson  <mrobinson@igalia.com>
+
+        [GTK] Clean build is broken when using make -j
+        https://bugs.webkit.org/show_bug.cgi?id=76388
+
+        * GNUmakefile.am: Add some WebKit2 sources to global sources lists
+        so that we can refer to them in separate GNUmakefiles.
+
+2012-02-22  Antaryami Pandia  <antaryami.pandia@motorola.com>
+
+        [GTK][WK2] Add WebGL WebSetting.
+        https://bugs.webkit.org/show_bug.cgi?id=79217
+
+        Reviewed by Martin Robinson.
+
+        Add a WebSetting to enable/disable Webgl.
+
+        * UIProcess/API/gtk/WebKitSettings.cpp:
+        (webKitSettingsSetProperty):
+        (webKitSettingsGetProperty):
+        (webkit_settings_class_init):
+        (webkit_settings_set_enable_webaudio):
+        (webkit_settings_get_enable_webgl):
+        (webkit_settings_set_enable_webgl):
+        * UIProcess/API/gtk/WebKitSettings.h:
+        * UIProcess/API/gtk/docs/webkit2gtk-sections.txt:
+        * UIProcess/API/gtk/tests/TestWebKitSettings.cpp:
+        (testWebKitSettings):
+
+2012-02-22  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        [Qt] Disregard previous backing store as soon as possible
+        https://bugs.webkit.org/show_bug.cgi?id=79232
+
+        Reviewed by Simon Hausmann and No'am Rosenthal.
+
+        Between creating the new backing store and painting the content,
+        we do not want to drop the previous one as that might result in
+        briefly seeing flickering as the old tiles may be dropped before
+        something replaces them.
+
+        But we do need to drop it at some point and we need to make sure
+        to not spike the memory usage before of this.
+
+        What we now do, is to store the previous backing store as before,
+        but drop all tiles which are not visible and then drop it as soon
+        as the visible rect (which might change due if followed by a quick
+        panning) has been fully covered by tiles.
+
+        * WebProcess/WebCoreSupport/WebGraphicsLayer.cpp:
+        (WebCore::WebGraphicsLayer::setContentsScale):
+        (WebCore::WebGraphicsLayer::updateContentBuffers):
+
+2012-02-22  Michael Brüning  <michael.bruning@nokia.com>
+
+        [Qt][WK2] Implement proxy authentication handling.
+        https://bugs.webkit.org/show_bug.cgi?id=78792
+
+        Reviewed by Simon Hausmann.
+
+        This patch corrects two bugs with the previous implementation:
+        1. The signal proxyAuthenticationRequired was not connected to a
+           slot.
+        2. The slot onProxyAuthenticationRequired had the wrong parameters. 
+
+        * WebProcess/qt/QtNetworkAccessManager.cpp:
+        (WebKit::QtNetworkAccessManager::QtNetworkAccessManager):
+        (WebKit::QtNetworkAccessManager::onProxyAuthenticationRequired):
+        * WebProcess/qt/QtNetworkAccessManager.h: Added include.
+        (QtNetworkAccessManager):
+
+2012-02-22  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Merge setVisibleRectTrajectoryVector and adjustVisibleRect to
+        the more descriptive coverWithTilesIfNeeded
+        https://bugs.webkit.org/show_bug.cgi?id=79230
+
+        Reviewed by Simon Hausmann.
+
+        Replace use by coverWithTilesIfNeeded().
+
+        * WebProcess/WebCoreSupport/WebGraphicsLayer.cpp:
+        (WebCore::WebGraphicsLayer::setVisibleContentRectTrajectoryVector):
+        (WebCore::WebGraphicsLayer::adjustVisibleRect):
+        (WebCore::WebGraphicsLayer::computeTransformedVisibleRect):
+
+2012-02-22  Zalan Bujtas  <zbujtas@gmail.com>
+
+        [Qt][WK2] Add frame flattening setting to QWebPreferences.
+        https://bugs.webkit.org/show_bug.cgi?id=79099
+
+        Reviewed by Simon Hausmann.
+
+        Frame flattening is enabled by default for Qt WebKit2.
+
+        * UIProcess/API/qt/qquickwebview.cpp:
+        (QQuickWebViewPrivate::initialize):
+        * UIProcess/API/qt/qwebpreferences.cpp:
+        (QWebPreferencesPrivate::testAttribute):
+        (QWebPreferencesPrivate::setAttribute):
+        (QWebPreferences::setNavigatorQtObjectEnabled):
+        (QWebPreferences::frameFlatteningEnabled):
+        (QWebPreferences::setFrameFlatteningEnabled):
+        * UIProcess/API/qt/qwebpreferences_p.h:
+
+2012-02-22  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Remove the remaining uses of CSSStyleDeclaration in Editor
+        https://bugs.webkit.org/show_bug.cgi?id=78939
+
+        Reviewed by Enrica Casucci.
+
+        * WebProcess/WebCoreSupport/WebEditorClient.cpp:
+        (WebKit::WebEditorClient::shouldApplyStyle):
+        * WebProcess/WebCoreSupport/WebEditorClient.h:
+        (WebEditorClient):
+
+2012-02-21  Carlos Garcia Campos  <cgarcia@igalia.com>
+
+        [GTK] Null ResourceErrors are encoded/decoded as empty ResourceErrors
+        https://bugs.webkit.org/show_bug.cgi?id=79120
+
+        Reviewed by Martin Robinson.
+
+        * Shared/gtk/WebCoreArgumentCodersGtk.cpp:
+        (CoreIPC::::encode): Encode a boolean to indicate whether it's a
+        Null error.
+        (CoreIPC::::decode): Check whether the error is Null and do not
+        continue decoding in such case.
+
+2012-02-21  No'am Rosenthal  <noam.rosenthal@nokia.com>
+
+        [Qt][WK2] Draw tiles of previous contents-scale for opaque layers if they don't intersect with previous tiles
+        https://bugs.webkit.org/show_bug.cgi?id=78962
+
+        Only avoid painting old-scale tiles in semi-transparent situtations if the old
+        tiles intersect with existing tiles.
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        * UIProcess/qt/LayerBackingStore.cpp:
+        (WebKit::LayerBackingStore::paintToTextureMapper):
+
+2012-02-21  No'am Rosenthal  <noam.rosenthal@nokia.com>
+
+        [Qt] Previous web page appears outside content rect
+        https://bugs.webkit.org/show_bug.cgi?id=78816
+
+        Apply a clip on painted tiles if some of the tiles fall outside of the target rect.
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        * UIProcess/qt/LayerBackingStore.cpp:
+        (WebKit::LayerBackingStore::paintToTextureMapper):
+
+2012-02-21  No'am Rosenthal  <noam.rosenthal@nokia.com>
+
+        [Qt][WK2] Accelerated animations don't work on Mac
+        https://bugs.webkit.org/show_bug.cgi?id=78963
+
+        Problem came from using a non-RunLoop timer.
+        Remove the unused viewportUpdateTimer, and use the existing animationTimer instead.
+        Use a continuous timer that we only stop when animations stop.
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        * UIProcess/LayerTreeHostProxy.h:
+        (LayerTreeHostProxy):
+        * UIProcess/qt/LayerTreeHostProxyQt.cpp:
+        (WebKit::LayerTreeHostProxy::LayerTreeHostProxy):
+        (WebKit::LayerTreeHostProxy::paintToCurrentGLContext):
+        (WebKit):
+        (WebKit::LayerTreeHostProxy::syncAnimations):
+
+2012-02-21  Sam Weinig  <sam@webkit.org>
+
+        Attempt to fix the Snow Leopard build.
+
+        * Configurations/Base.xcconfig:
+
+2012-02-21  Sam Weinig  <sam@webkit.org>
+
+        Use libc++ when building with Clang on Mac
+        https://bugs.webkit.org/show_bug.cgi?id=78981
+
+        Reviewed by Dan Bernstein.
+
+        * Configurations/Base.xcconfig:
+
+2012-02-21  Andras Becsi  <andras.becsi@nokia.com>
+
+        [Qt][WK2] Get rid of the dependency to QtWidgets
+        https://bugs.webkit.org/show_bug.cgi?id=76276
+
+        Reviewed by Simon Hausmann.
+
+        * Target.pri:
+        * UIProcess/API/qt/tests/qmltests/tst_qmltests.cpp:
+        (main):
+        * UIProcess/API/qt/tests/qquickwebview/tst_qquickwebview.cpp:
+        * UIProcess/API/qt/tests/tests.pri:
+        * UIProcess/API/qt/tests/util.h:
+
+2012-02-20  Martin Robinson  <mrobinson@igalia.com>
+
+        [UNIX] Plugin information fields are not interpreted as UTF-8
+        https://bugs.webkit.org/show_bug.cgi?id=78635
+
+        Reviewed by Gustavo Noronha Silva.
+
+        Interpret plugin metadata as UTF8 aways. This matches the behavior
+        of Chromium and the Totem plugin.
+
+        * Shared/Plugins/Netscape/x11/NetscapePluginModuleX11.cpp:
+        (WebKit::NetscapePluginModule::getPluginInfoForLoadedPlugin): Use String::fromUTF8.
+
+2012-02-20  Carlos Garcia Campos  <cgarcia@igalia.com>
+
+        [GTK] Adding SOUP_TYPE_PROXY_RESOLVER_DEFAULT feature to soup session makes WebProcess to hang
+        https://bugs.webkit.org/show_bug.cgi?id=79036
+
+        Reviewed by Martin Robinson.
+
+        This looks like a bug in gobject. Initializing the WebProcess
+        before creating the soup session seems to fix the problem. It's
+        actually a workaround, but initializing the WebProcess as sson as
+        possible it's a good idea in any case.
+
+        * WebProcess/gtk/WebProcessMainGtk.cpp:
+        (WebKit::WebProcessMainGtk):
+
+2012-02-20  Michael Brüning  <michael.bruning@nokia.com>
+
+        [Qt][WK2] Implement proxy authentication handling.
+        https://bugs.webkit.org/show_bug.cgi?id=78792
+
+        Reviewed by Simon Hausmann.
+
+        This patch implements the proxy authentication handling
+        for the Qt port in a similar matter to the http authentication
+        implementation.
+
+        Since there is a need to pass the proxy port, which is of type uint16_t,
+        from the WebProcess to the UIProcess, an encoder and a decoder for
+        this type was added because it did not exist.
+        
+        The message that was added to the WebPageProxy is called synchronously
+        as this is needed by the implementation of the network access manager
+        and has also been implemented this way already for the http 
+        authentication.
+
+        * Platform/CoreIPC/ArgumentDecoder.cpp:
+        (CoreIPC::ArgumentDecoder::decodeUInt16):
+        (CoreIPC):
+        * Platform/CoreIPC/ArgumentDecoder.h:
+        (ArgumentDecoder):
+        (CoreIPC::ArgumentDecoder::decode):
+        (CoreIPC):
+        * Platform/CoreIPC/ArgumentEncoder.cpp:
+        (CoreIPC::ArgumentEncoder::encodeUInt16):
+        (CoreIPC):
+        * Platform/CoreIPC/ArgumentEncoder.h:
+        (ArgumentEncoder):
+        (CoreIPC::ArgumentEncoder::encode):
+        (CoreIPC):
+        * UIProcess/API/qt/qquickwebview.cpp:
+        (QQuickWebViewPrivate::QQuickWebViewPrivate):
+        (QQuickWebViewPrivate::handleProxyAuthenticationRequiredRequest):
+        (QQuickWebViewExperimental::proxyAuthenticationDialog):
+        (QQuickWebViewExperimental::setProxyAuthenticationDialog):
+        * UIProcess/API/qt/qquickwebview_p.h:
+        * UIProcess/API/qt/qquickwebview_p_p.h:
+        (QQuickWebViewPrivate):
+        * UIProcess/PageClient.h:
+        (PageClient):
+        * UIProcess/WebPageProxy.cpp:
+        (WebKit::WebPageProxy::proxyAuthenticationRequiredRequest):
+        (WebKit):
+        * UIProcess/WebPageProxy.h:
+        (WebPageProxy):
+        * UIProcess/WebPageProxy.messages.in:
+        * UIProcess/qt/QtDialogRunner.cpp:
+        (ProxyAuthenticationDialogContextObject):
+        (ProxyAuthenticationDialogContextObject::ProxyAuthenticationDialogContextObject):
+        (ProxyAuthenticationDialogContextObject::hostname):
+        (ProxyAuthenticationDialogContextObject::port):
+        (ProxyAuthenticationDialogContextObject::prefilledUsername):
+        (ProxyAuthenticationDialogContextObject::accept):
+        (ProxyAuthenticationDialogContextObject::reject):
+        (QtDialogRunner::initForProxyAuthentication):
+        * UIProcess/qt/QtDialogRunner.h:
+        (QtDialogRunner):
+        * UIProcess/qt/QtPageClient.cpp:
+        (QtPageClient::handleProxyAuthenticationRequiredRequest):
+        * UIProcess/qt/QtPageClient.h:
+        (QtPageClient):
+        * WebProcess/WebPage/DecoderAdapter.cpp:
+        (WebKit::DecoderAdapter::decodeUInt16):
+        (WebKit):
+        * WebProcess/WebPage/DecoderAdapter.h:
+        (DecoderAdapter):
+        * WebProcess/WebPage/EncoderAdapter.cpp:
+        (WebKit::EncoderAdapter::encodeUInt16):
+        (WebKit):
+        * WebProcess/WebPage/EncoderAdapter.h:
+        (EncoderAdapter):
+        * WebProcess/qt/QtNetworkAccessManager.cpp:
+        (WebKit::QtNetworkAccessManager::onProxyAuthenticationRequired):
+        (WebKit):
+        * WebProcess/qt/QtNetworkAccessManager.h:
+        (QtNetworkAccessManager):
+
+2012-02-20  Patrick Gansterer  <paroga@webkit.org>
+
+        [CMake] Update and sort list of source files.
+
+        * CMakeLists.txt:
+
+2012-02-20  Martin Robinson  <mrobinson@igalia.com>
+
+        Fix WebKit2GTK+ for 'make distcheck'.
+
+        Instead of conditionally including WebKit2 GNUmakefiles, always
+        include them and conditionally activate the final targets.
+
+        * GNUmakefile.am:
+        * UIProcess/API/gtk/tests/GNUmakefile.am:
+
+2012-02-20  Martin Robinson  <mrobinson@igalia.com>
+
+        [GTK][WK2] WebKit2 does not build if gtk-unix-printing-3.0 is not available
+        https://bugs.webkit.org/show_bug.cgi?id=79011
+
+        Fix the build when gtk-unix-printing-3.0 is not present.
+
+        * UIProcess/API/gtk/WebKitPrintOperation.cpp:
+        (webkitPrintOperationRunDialog):
+        (webkitPrintOperationRunDialogForFrame):
+        * WebProcess/WebPage/gtk/WebPrintOperationGtk.cpp:
+        (WebKit::WebPrintOperationGtk::create):
+
+2012-02-18  Dan Bernstein  <mitz@apple.com>
+
+        <rdar://problem/10891801> BackingStore::scroll() unnecessarily copies pixels around
+        https://bugs.webkit.org/show_bug.cgi?id=78976
+
+        Reviewed by Anders Carlsson.
+
+        Rather than move pixels in the backing store in response to scrolling, we can maintain a
+        mapping, for the most recently scrolled rect, from backing store coordinates to view
+        client coordinates.
+
+        * UIProcess/BackingStore.h:
+        * UIProcess/mac/BackingStoreMac.mm:
+        (WebKit::BackingStore::performWithScrolledRectTransform): Added. Given a block to be
+        performed on a rect, divides the rect into parts such that for each part the mapping from
+        backing store coordinates to client coordinates is a (uniform) translation, and performs
+        the block on that part, passing it the translation that applies to the part.
+        (WebKit::BackingStore::resetScrolledRect): Added. Copies everything in the scrolled rect
+        back to where it should be under the identity map, and resets the scrolled rect and offset.
+        (WebKit::BackingStore::paint): Changed to call through performWithScrolledRectTransform().
+        (WebKit::BackingStore::incorporateUpdate): Ditto.
+        (WebKit::BackingStore::scroll): Now instead of copying pixels, just updates the scrolled
+        rect and offset.
+
+2012-02-17  No'am Rosenthal  <noam.rosenthal@nokia.com>
+
+        [Qt][WK2] Allow opaque tiles
+        https://bugs.webkit.org/show_bug.cgi?id=78809
+
+        Apply the SupportsAlpha flag only when the buffers actually have alpha.
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        * Shared/ShareableBitmap.h:
+        (ShareableBitmap):
+        * Shared/qt/ShareableBitmapQt.cpp:
+        * UIProcess/qt/LayerBackingStore.cpp:
+        (WebKit::LayerBackingStoreTile::swapBuffers):
+
+2012-02-17  Adam Roben  <aroben@apple.com>
+
+        Clang build fix after r108119
+
+        * WebProcess/WebProcess.cpp:
+        (WebKit::randomCrashThread): Annotate this function with NO_RETURN_DUE_TO_CRASH.
+
+2012-02-17  Kalev Lember  <kalevlember@gmail.com>
+
+        Remove unused parameters from WTF threading API
+        https://bugs.webkit.org/show_bug.cgi?id=78389
+
+        Reviewed by Adam Roben.
+
+        waitForThreadCompletion() had an out param 'void **result' to get the
+        'void *' returned by ThreadFunction. However, the implementation in
+        ThreadingWin.cpp ignored the out param, not filling it in. This had
+        led to a situation where none of the client code made use of the param
+        and just ignored it.
+
+        To clean this up, the patch changes the signature of ThreadFunction to
+        return void instead of void* and drops the the unused 'void **result'
+        parameter from waitForThreadCompletion. Also, all client code is
+        updated for the API change.
+
+        As mentioned in https://bugs.webkit.org/show_bug.cgi?id=78389 , even
+        though the change only affects internal API, Safari is using it
+        directly and we'll need to keep the old versions around for ABI
+        compatibility. For this, the patch adds compatibility wrappers with
+        the old ABI.
+
+        * Platform/WorkQueue.h:
+        (WorkQueue):
+        * Platform/gtk/WorkQueueGtk.cpp:
+        (WorkQueue::startWorkQueueThread):
+        * UIProcess/Launcher/mac/ThreadLauncherMac.mm:
+        (WebKit::webThreadBody):
+        * UIProcess/Launcher/qt/ThreadLauncherQt.cpp:
+        (WebKit::webThreadBody):
+        * UIProcess/Launcher/win/ThreadLauncherWin.cpp:
+        (WebKit::webThreadBody):
+        * WebProcess/WebProcess.cpp:
+        (WebKit::randomCrashThread):
+        * win/WebKit2.def:
+        * win/WebKit2CFLite.def:
+
+2012-02-17  Mihnea Ovidenie  <mihnea@adobe.com>
+
+        CSS regions enabled by default
+        https://bugs.webkit.org/show_bug.cgi?id=78525
+
+        Reviewed by David Hyatt.
+
+        Add a runtime preference to enable/disable regions functionality at runtime(WebKitCSSRegionsEnabled).
+        CSSRegions are still enabled by default.
+        In DRT, use layoutTestController.overridePreference("WebKitCSSRegionsEnabled", "0") to disable the css regions functionality.
+
+        * Shared/WebPreferencesStore.h:
+        (WebKit):
+        * UIProcess/API/C/WKPreferences.cpp:
+        (WKPreferencesSetCSSRegionsEnabled):
+        (WKPreferencesGetCSSRegionsEnabled):
+        * UIProcess/API/C/WKPreferencesPrivate.h:
+        * WebProcess/InjectedBundle/InjectedBundle.cpp:
+        (WebKit::InjectedBundle::overrideBoolPreferenceForTestRunner):
+        * WebProcess/WebPage/WebPage.cpp:
+        (WebKit::WebPage::updatePreferences):
+
+2012-02-17  Enrica Casucci  <enrica@apple.com>
+
+        Refactor DragData class to use PlatformStrategies in the Mac implementation.
+        https://bugs.webkit.org/show_bug.cgi?id=78768
+
+        Reviewed by Darin Adler.
+
+        * WebProcess/WebCoreSupport/WebPlatformStrategies.cpp: Added color() method.
+        (WebKit::WebPlatformStrategies::color):
+        * WebProcess/WebCoreSupport/WebPlatformStrategies.h:
+
+2012-02-17  Martin Robinson  <mrobinson@igalia.com>
+
+        Fix some warnings encountered during the GTK+ build
+        https://bugs.webkit.org/show_bug.cgi?id=78911
+
+        Reviewed by Xan Lopez.
+
+        * UIProcess/API/gtk/WebKitLoaderClient.cpp:
+        (attachLoaderClientToView): Initialize a new member of the loader client struct.
+
+2012-02-17  Carlos Garcia Campos  <cgarcia@igalia.com>
+
+        [GTK] Allow printing scaled pages in WebKit2 for printers that don't support it
+        https://bugs.webkit.org/show_bug.cgi?id=78823
+
+        Reviewed by Gustavo Noronha Silva.
+
+        * UIProcess/API/gtk/WebKitPrintOperation.cpp:
+        (webkitPrintOperationRunDialogUnix): Enable scale option in print
+        dialog.
+        * WebProcess/WebPage/gtk/WebPrintOperationGtk.cpp:
+        (WebKit::WebPrintOperationGtk::WebPrintOperationGtk): Initialize
+        manual scale to 1.
+        (WebKit::WebPrintOperationGtk::rotatePageIfNeeded): Renamed and
+        moved the needs rotate check here as an early return.
+        (WebKit::WebPrintOperationGtk::prepareContextToDraw): Scale the
+        page according to the manual scale factor.
+        (WebKit::WebPrintOperationGtk::renderPage): Move rotatePage to
+        prepareContextToDraw.
+        * WebProcess/WebPage/gtk/WebPrintOperationGtk.h:
+
+2012-02-17  Carlos Garcia Campos  <cgarcia@igalia.com>
+
+        [GTK] Allow printing multiple copies in WebKit2 for printers that don't support it
+        https://bugs.webkit.org/show_bug.cgi?id=78805
+
+        Reviewed by Gustavo Noronha Silva.
+
+        * UIProcess/API/gtk/WebKitPrintOperation.cpp:
+        (webkitPrintOperationRunDialogUnix): Enable multiple copies and
+        collate options in print dialog.
+        * WebProcess/WebPage/gtk/WebPrintOperationGtk.cpp:
+        (WebKit::PrintPagesData::PrintPagesData): Initialize number of
+        collated and uncolated copies done and total.
+        (WebKit::PrintPagesData::collatedCopiesLeft): Helper function that
+        returns the number of collated copies left to do.
+        (WebKit::PrintPagesData::uncollatedCopiesLeft): Helper function
+        that returns the number of uncollated copies left to do.
+        (WebKit::PrintPagesData::copiesLeft): Helper function
+        that returns the number of collated or uncollated copies left to
+        do.
+        (WebKit::PrintPagesData::incrementPageSequence): Do not finish the
+        print if there are uncollated copies left, and do not increment
+        sheet number if there are collated copies left.
+        (WebKit::WebPrintOperationGtk::WebPrintOperationGtk): Initialize
+        m_manualCopies to 1 and m_manualCollateCopies to false.
+        * WebProcess/WebPage/gtk/WebPrintOperationGtk.h:
+
+2012-02-17  Carlos Garcia Campos  <cgarcia@igalia.com>
+
+        [GTK] Allow printing pages in reverse order in WebKit2 for printers that don't support it
+        https://bugs.webkit.org/show_bug.cgi?id=78799
+
+        Reviewed by Gustavo Noronha Silva.
+
+        * UIProcess/API/gtk/WebKitPrintOperation.cpp:
+        (webkitPrintOperationRunDialogUnix): Enable printing in reverse
+        order option in print dialog.
+        * WebProcess/WebPage/gtk/WebPrintOperationGtk.cpp:
+        (WebKit::PrintPagesData::PrintPagesData): Initialize sheetNumber
+        and lastPagePosition depending on whether printing is in reverse
+        order or not.
+        (WebKit::PrintPagesData::incrementPageSequence): Use a negative
+        increment step when printing in reverse order. Fix page
+        incrementing when printing only odd/even pages broken in previous
+        commit due to merge conflicts.
+        (WebKit::WebPrintOperationGtk::WebPrintOperationGtk): Initialize
+        reverse printing to false.
+        * WebProcess/WebPage/gtk/WebPrintOperationGtk.h:
+
+2012-02-17  Carlos Garcia Campos  <cgarcia@igalia.com>
+
+        [GTK] Allow printing only odd/even pages in WebKit2 for printers that don't support it
+        https://bugs.webkit.org/show_bug.cgi?id=78793
+
+        Reviewed by Gustavo Noronha Silva.
+
+        * UIProcess/API/gtk/WebKitPrintOperation.cpp:
+        (webkitPrintOperationRunDialogUnix): Enable print odd/even pages
+        option in print dialog.
+        * WebProcess/WebPage/gtk/WebPrintOperationGtk.h:
+        * WebProcess/WebPage/gtk/WebPrintOperationGtk.cpp:
+        (WebKit::PrintPagesData::PrintPagesData): Add lastPagePosition and
+        initialize it depending on the page set.
+        (WebKit::PrintPagesData::incrementPageSequence): Use 2 step
+        increment when printing only odd/even pages.
+        (WebKit::WebPrintOperationGtk::WebPrintOperationGtk): Initialize
+        m_manualPageSet to GTK_PAGE_SET_ALL.
+
+2012-02-17  Carlos Garcia Campos  <cgarcia@igalia.com>
+
+        [GTK] Allow printing multiple pages per sheet in WebKit2 for printers that don't support it
+        https://bugs.webkit.org/show_bug.cgi?id=78715
+
+        Reviewed by Gustavo Noronha Silva.
+
+        * UIProcess/API/gtk/WebKitPrintOperation.cpp:
+        (webkitPrintOperationRunDialogUnix): Enable multiple pages per
+        sheet options in print dialog.
+        * WebProcess/WebPage/gtk/WebPrintOperationGtk.cpp:
+        (WebKit::PrintPagesData::PrintPagesData): Initialize sheetNumber
+        and numberOfSheets. Move pagePosition to WebPrintOperationGtk.
+        (WebKit::PrintPagesData::incrementPageSequence): Increment current
+        sheet and page position.
+        (WebKit::WebPrintOperationGtk::WebPrintOperationGtk):
+        (WebKit::WebPrintOperationGtk::currentPageIsFirstPageOfSheet):
+        Helper function to check whether current pages is the first one of
+        the current sheet.
+        (WebKit::WebPrintOperationGtk::currentPageIsLastPageOfSheet):
+        Helper function to check whether current pages is the last one of
+        the current sheet.
+        (WebKit::WebPrintOperationGtk::getRowsAndColumnsOfPagesPerSheet):
+        Returns the number of rows and columns of pages per sheet.
+        (WebKit::WebPrintOperationGtk::getPositionOfPageInSheet): Returns
+        the row and column number of the current page in the current sheet.
+        (WebKit::WebPrintOperationGtk::prepareContextToDraw): Translate,
+        scale and rotate accordingly to render every page in the right
+        place of the sheet.
+        (WebKit::WebPrintOperationGtk::renderPage): Call
+        prepareContextToDraw() before drawing the page.
+        * WebProcess/WebPage/gtk/WebPrintOperationGtk.h:
+        (WebKit::WebPrintOperationGtk::setNumberOfPagesToPrint):
+        (WebKit::WebPrintOperationGtk::pagePosition):
+        (WebKit::WebPrintOperationGtk::setPagePosition):
+        (WebKit::WebPrintOperationGtk::numberUp):
+        (WebKit::WebPrintOperationGtk::numberUpLayout):
+
+2012-02-17  Carlos Garcia Campos  <cgarcia@igalia.com>
+
+        [GTK] Rename WebKitPrintOperation::done signal to ::finished in WebKit2
+        https://bugs.webkit.org/show_bug.cgi?id=78893
+
+        Reviewed by Gustavo Noronha Silva.
+
+        And it's not emitted anynmore when the print dialog has been
+        cancelled. Since it's not possible to know whether the print
+        dialog was cancelled or not, the enum WebKitPrintOperationResponse
+        has been added, with Print and Cancel values, and it's used as
+        return value of webkit_print_operation_run_dialog().
+
+        * UIProcess/API/gtk/WebKitPrintOperation.cpp:
+        (webkit_print_operation_class_init): Rename done as finished.
+        (webkitPrintOperationRunDialogUnix): Return a
+        WebKitPrintOperationResponse instead of bool.
+        (webkitPrintOperationRunDialogWin32): Ditto.
+        (drawPagesForPrintingCompleted): Emit finished instead of done.
+        (webkitPrintOperationRunDialogForFrame): Do not emit finished if
+        the dialog was cancelled and return a WebKitPrintOperationResponse.
+        (webkit_print_operation_run_dialog): Return
+        WebKitPrintOperationResponse.
+        * UIProcess/API/gtk/WebKitPrintOperation.h: Add
+        WebKitPrintOperationResponse enum.
+        * UIProcess/API/gtk/WebKitPrintOperationPrivate.h:
+        * UIProcess/API/gtk/WebKitWebView.cpp:
+        (webkitWebViewPrintFrame): Check whether the dialog has been
+        cancelled or not and connect to finish when the print operation is
+        in progress to release the print operation object when printing
+        finishes.
+        * UIProcess/API/gtk/docs/webkit2gtk-sections.txt: Add
+        WebKitPrintOperationResponse symbol.
+        * UIProcess/API/gtk/tests/TestPrinting.cpp:
+        (testPrintOperationPrintFinished): Use finished instead of done.
+        (testPrintOperationPrint): Ditto.
+
+2012-02-17  Carlos Garcia Campos  <cgarcia@igalia.com>
+
+        [GTK] Add webkit_print_operation_print() to WebKit2 GTK+ API
+        https://bugs.webkit.org/show_bug.cgi?id=76536
+
+        Reviewed by Gustavo Noronha Silva.
+
+        * UIProcess/API/gtk/WebKitPrintOperation.cpp:
+        (webkitPrintOperationPrintPagesForFrame): Helper function to call
+        WebPageProxy::drawPagesForPrinting using the given
+        GtkPrintSettings and GtkPageSetup.
+        (webkitPrintOperationRunDialogForFrame): Use
+        webkitPrintOperationPrintPagesForFrame().
+        (webkit_print_operation_print): Print directly using current
+        GtkPrintSettings and GtkPageSetup without showing the print
+        dialog.
+        * UIProcess/API/gtk/WebKitPrintOperation.h:
+        * UIProcess/API/gtk/docs/webkit2gtk-sections.txt: Add new symbols.
+        * UIProcess/API/gtk/tests/GNUmakefile.am:
+        * UIProcess/API/gtk/tests/TestPrinting.cpp:
+        (testPrintOperationPrintLoadChanged):
+        (testPrintOperationPrintDone):
+        (testPrintOperationPrintPrinter):
+        (testPrintOperationPrint):
+        (beforeAll):
+        (afterAll):
+
+2012-02-17  No'am Rosenthal  <noam.rosenthal@nokia.com>
+
+        [Qt][WK2] Allow partial updates
+        https://bugs.webkit.org/show_bug.cgi?id=78824
+
+        Instead of using UpdateInfo to fill the entire tile's texture, we use it as a patch that
+        contains only the dirty rectangle of the current paint. This requires a lot less memory
+        for small updates, for example when typing a text in an input field.
+        This shows a significant reduction in overhead when testing on Mac with Instruments.
+
+        Reviewed by Simon Hausmann.
+
+        * UIProcess/qt/LayerBackingStore.cpp:
+        (WebKit::LayerBackingStoreTile::swapBuffers):
+        (WebKit::LayerBackingStoreTile::setBackBuffer):
+        (WebKit):
+        (WebKit::LayerBackingStore::updateTile):
+        * UIProcess/qt/LayerBackingStore.h:
+        (LayerBackingStoreTile):
+        * UIProcess/qt/LayerTreeHostProxyQt.cpp:
+        (WebKit::LayerTreeHostProxy::updateTileForLayer):
+        * WebProcess/WebPage/TiledBackingStoreRemoteTile.cpp:
+        (WebKit::TiledBackingStoreRemoteTile::updateBackBuffer):
+
+2012-02-16  Carlos Garcia Campos  <cgarcia@igalia.com>
+
+        [GTK] Make sure print operation object is alive until printing finishes in WebKit2
+        https://bugs.webkit.org/show_bug.cgi?id=78829
+
+        Reviewed by Martin Robinson.
+
+        * UIProcess/API/gtk/WebKitPrintOperation.cpp:
+        (drawPagesForPrintingCompleted): Adopt the WebKitPrintOperation
+        reference so that it's released when the callback finishes.
+        (webkitPrintOperationRunDialogForFrame): Pass a reference of
+        WebKitPrintOperation to the printing callback.
+
+2012-02-15  Geoffrey Garen  <ggaren@apple.com>
+
+        Made Weak<T> single-owner, adding PassWeak<T>
+        https://bugs.webkit.org/show_bug.cgi?id=78740
+
+        Reviewed by Sam Weinig.
+
+        * WebProcess/Plugins/Netscape/NPRuntimeObjectMap.cpp:
+        (WebKit::NPRuntimeObjectMap::getOrCreateJSObject): Use raw pointer and
+        PassWeak<T>, as required by our new hash map API.
+
+2012-02-16  Sergio Villar Senin  <svillar@igalia.com>
+
+        [soup] Move important SoupSession feature initialization to WebCore
+        https://bugs.webkit.org/show_bug.cgi?id=68602
+
+        Reviewed by Martin Robinson.
+
+        Moved content sniffer and decoder initialization from the
+        WebProcess to WebCore because network stuff will not work as
+        expected without them.
+
+        No new tests required as we're just moving stuff from the
+        WebProcess to WebCore.
+
+        * WebProcess/gtk/WebProcessMainGtk.cpp:
+        (WebKit::WebProcessMainGtk):
+
+2012-02-16  Philippe Normand  <pnormand@igalia.com>
+
+        Unreviewed, rolling out r107941.
+        http://trac.webkit.org/changeset/107941
+        https://bugs.webkit.org/show_bug.cgi?id=68602
+
+        Broke 23 http tests on GTK
+
+        * WebProcess/gtk/WebProcessMainGtk.cpp:
+        (WebKit::WebProcessMainGtk):
+
+2012-02-16  No'am Rosenthal  <noam.rosenthal@nokia.com>
+
+        [Texmap] Improve the way we deal with BGRA extension
+        https://bugs.webkit.org/show_bug.cgi?id=78822
+
+        Get rid of swizzling in the web process. Instead, we moved swizzling back to
+        TextureMapperGL, as we're moving towards a setup where textures are uploaded
+        in the web process.
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        * UIProcess/qt/LayerBackingStore.cpp:
+        (WebKit::LayerBackingStoreTile::swapBuffers):
+        * UIProcess/qt/LayerTreeHostProxyQt.cpp:
+        (WebKit::LayerTreeHostProxy::createImage):
+        * WebProcess/WebPage/TiledBackingStoreRemoteTile.cpp:
+        (WebKit::TiledBackingStoreRemoteTile::updateBackBuffer):
+        * WebProcess/WebPage/qt/LayerTreeHostQt.cpp:
+        (WebKit::LayerTreeHostQt::adoptImageBackingStore):
+
+2012-02-16  Carlos Garcia Campos  <cgarcia@igalia.com>
+
+        Unreviewed. Fix WebKit2 GTK+ build after r107947.
+
+        * UIProcess/API/gtk/WebKitPrintOperation.cpp:
+        (webkitPrintOperationRunDialogForFrame):
+
+2012-02-16  Alexander Færøy  <ahf@0x90.dk>
+
+        [Qt] Fix linking in debug builds on Mac OS X
+        https://bugs.webkit.org/show_bug.cgi?id=78811
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        * UIProcess/API/qt/tests/bytearraytestdata.h:
+
+2012-02-16  Carlos Garcia Campos  <cgarcia@igalia.com>
+
+        [GTK] Page content is incorrectly translated whenh rendering pages for printing in WebKit2
+        https://bugs.webkit.org/show_bug.cgi?id=78712
+
+        Reviewed by Martin Robinson.
+
+        * WebProcess/WebPage/gtk/WebPrintOperationGtk.cpp:
+        (WebKit::WebPrintOperationGtk::enumeratePrintersFunction):
+        Simplify the code to select the printer.
+        (WebKit::WebPrintOperationGtk::renderPage): Call cairo_save()
+        before rendering the page and cairo_restore() when page has been
+        rendered.
+
+2012-02-16  Carlos Garcia Campos  <cgarcia@igalia.com>
+
+        [GTK] Add WebKitPrintOperation to WebKit2 GTK+ API
+        https://bugs.webkit.org/show_bug.cgi?id=76448
+
+        Reviewed by Martin Robinson.
+
+        * GNUmakefile.am: Add new files to compilation.
+        * UIProcess/API/gtk/WebKitDefines.h:
+        * UIProcess/API/gtk/WebKitPrintOperation.cpp: Added.
+        (webViewDestroyed): Delete the print operation when the view
+        widget associated is destroyed.
+        (webkitPrintOperationConstructed): Connect to destroy signal of
+        associated web view.
+        (webkitPrintOperationGetProperty):
+        (webkitPrintOperationSetProperty):
+        (webkit_print_operation_init):
+        (webkit_print_operation_class_init):
+        (webkitPrintOperationRunDialogUnix): Use GtkPrintUnixDialog to
+        show the printing dialog in UNIX platforms.
+        (webkitPrintOperationRunDialogWin32): Empty, not implemented yet.
+        (drawPagesForPrintingCompleted): Callback called when printing
+        operation has finished in the web process.
+        (webkitPrintOperationRunDialogForFrame): Run the printing dialog
+        and start printing the given frame.
+        (webkit_print_operation_new): Create a new print operation for the
+        given web view.
+        (webkit_print_operation_get_print_settings):
+        (webkit_print_operation_set_print_settings):
+        (webkit_print_operation_get_page_setup):
+        (webkit_print_operation_set_page_setup):
+        (webkit_print_operation_run_dialog): Run the print dialog to print
+        the web view main frame.
+        * UIProcess/API/gtk/WebKitPrintOperation.h: Added.
+        * UIProcess/API/gtk/WebKitPrintOperationPrivate.h: Added.
+        * UIProcess/API/gtk/WebKitUIClient.cpp:
+        (printFrame): Call webkitWebViewPrintFrame.
+        (attachUIClientToView): Add implementation for
+        printFrame callback.
+        * UIProcess/API/gtk/WebKitWebView.cpp:
+        (webkit_web_view_class_init): Add WebKitWebView::print-requested
+        signal.
+        (webkitWebViewPrintFrame): Emit print-requested and show the print
+        dialog to print the frame when not signal is not handled by user.
+        * UIProcess/API/gtk/WebKitWebView.h:
+        * UIProcess/API/gtk/WebKitWebViewPrivate.h:
+        * UIProcess/API/gtk/docs/webkit2gtk-docs.sgml: Add new section for
+        WebKitPrintOperation.
+        * UIProcess/API/gtk/docs/webkit2gtk-sections.txt: Add new symbols.
+        * UIProcess/API/gtk/tests/GNUmakefile.am:
+        * UIProcess/API/gtk/tests/TestPrinting.cpp: Added.
+        (testPrintOperationPrintSettings):
+        (webViewPrintRequestedCallback):
+        (testWebViewPrintRequested):
+        (beforeAll):
+        (afterAll):
+        * UIProcess/API/gtk/webkit2.h: Include WebKitPrintOperation.h.
+
+2012-02-16  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        [Gtk][Efl][Qt] Move OpenGLShims out of cairo/ subdirectory
+        https://bugs.webkit.org/show_bug.cgi?id=78800
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        * UIProcess/qt/LayerTreeHostProxyQt.cpp: Adjust to changed OpenGLShims.h
+        location - no more cairo prefix needed.
+
+2012-02-16  No'am Rosenthal  <noam.rosenthal@nokia.com>
+
+        [Qt][WK2] Allow opaque tiles
+        https://bugs.webkit.org/show_bug.cgi?id=78809
+
+        Set the supportsAlpha flag for TiledBackingStore when the layer has contentsOpaque enabled.
+        Use the flag for ShareableBitmaps created by TiledBackingStore.
+
+        For now this will not have impact on performance/memory, because we allocate the same type
+        of buffers for opaque and transparent tiles.
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        * WebProcess/WebCoreSupport/WebGraphicsLayer.cpp:
+        (WebCore::WebGraphicsLayer::setContentsOpaque):
+        (WebCore::WebGraphicsLayer::setContentsScale):
+        (WebCore::WebGraphicsLayer::createBackingStore):
+        (WebCore):
+        (WebCore::WebGraphicsLayer::updateContentBuffers):
+        * WebProcess/WebCoreSupport/WebGraphicsLayer.h:
+        (WebGraphicsLayer):
+        * WebProcess/WebPage/TiledBackingStoreRemoteTile.cpp:
+        (WebKit::TiledBackingStoreRemoteTile::updateBackBuffer):
+
+2012-02-16  Sergio Villar Senin  <svillar@igalia.com>
+
+        [soup] Move important SoupSession feature initialization to WebCore
+        https://bugs.webkit.org/show_bug.cgi?id=68602
+
+        Reviewed by Martin Robinson.
+
+        Moved content sniffer and decoder initialization from the
+        WebProcess to WebCore because network stuff will not work as
+        expected without them.
+
+        No new tests required as we're just moving stuff from the
+        WebProcess to WebCore.
+
+        * WebProcess/gtk/WebProcessMainGtk.cpp:
+        (WebKit::WebProcessMainGtk):
+
+2012-02-16  Adenilson Cavalcanti  <cavalcantii@gmail.com>
+
+        [Qt][WK2] Split QWebPermissionRequest into QWebSecurityOrigin
+        https://bugs.webkit.org/show_bug.cgi?id=73215
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Introducing a new class to expose security origin information
+        (port/scheme/etc), useful for inspecting the origin of permission
+        requests.
+
+        * Target.pri:
+        * UIProcess/API/qt/qtwebsecurityorigin.cpp: Added.
+        (QtWebSecurityOrigin::QtWebSecurityOrigin):
+        (QtWebSecurityOrigin::~QtWebSecurityOrigin):
+        (QtWebSecurityOrigin::host):
+        (QtWebSecurityOrigin::scheme):
+        (QtWebSecurityOrigin::path):
+        (QtWebSecurityOrigin::port):
+        (QtWebSecurityOrigin::setHost):
+        (QtWebSecurityOrigin::setScheme):
+        (QtWebSecurityOrigin::setPath):
+        (QtWebSecurityOrigin::setPort):
+        * UIProcess/API/qt/qtwebsecurityorigin_p.h: Added.
+        * UIProcess/API/qt/tests/qmltests/WebView/tst_origin.qml: Added.
+        * UIProcess/API/qt/qwebpermissionrequest.cpp:
+        (QWebPermissionRequestPrivate::QWebPermissionRequestPrivate):
+        (QWebPermissionRequest::securityOrigin):
+        * UIProcess/API/qt/qwebpermissionrequest_p.h:
+        * UIProcess/API/qt/tests/qmltests/qmltests.pro:
+
+2012-02-16  Patrick Gansterer  <paroga@webkit.org>
+
+        [CMake] Add missing include directories.
+
+        * CMakeLists.txt:
+
+2012-02-16  Carlos Garcia Campos  <cgarcia@igalia.com>
+
+        [GTK] Document that local paths in html loaded with loadHTML might cause the web process to terminate
+        https://bugs.webkit.org/show_bug.cgi?id=78719
+
+        Reviewed by Martin Robinson.
+
+        * UIProcess/API/gtk/WebKitWebView.cpp:
+
+2012-02-15  Anders Carlsson  <andersca@apple.com>
+
+        Add TiledCoreAnimationDrawingArea::forceRepaint
+        https://bugs.webkit.org/show_bug.cgi?id=78749
+        <rdar://problem/10866221>
+
+        Reviewed by Sam Weinig.
+
+        * WebProcess/WebPage/mac/TiledCoreAnimationDrawingArea.h:
+        * WebProcess/WebPage/mac/TiledCoreAnimationDrawingArea.mm:
+        (WebKit::TiledCoreAnimationDrawingArea::forceRepaint):
+        Force a repaint and synchronize the layer tree to the UI process.
+
+2012-02-15  Enrica Casucci  <enrica@apple.com>
+
+        Refactor ClipboardMac class to use PlatformStrategies.
+        https://bugs.webkit.org/show_bug.cgi?id=78554
+
+        Reviewed by Anders Carlsson.
+
+        * WebProcess/WebCoreSupport/WebDragClient.h: Changed method signature to reference
+        the pasteboard by name.
+        * WebProcess/WebCoreSupport/WebPlatformStrategies.cpp: Added new methods.
+        (WebKit::WebPlatformStrategies::changeCount):
+        (WebKit::WebPlatformStrategies::uniqueName):
+        * WebProcess/WebCoreSupport/WebPlatformStrategies.h: Ditto.
+        * WebProcess/WebCoreSupport/mac/WebDragClientMac.mm:
+        (WebKit::WebDragClient::declareAndWriteDragImage): Changed method signature to reference
+        the pasteboard by name.
+
+2012-02-15  Sadrul Habib Chowdhury  <sadrul@chromium.org>
+
+        Notify ChromeClient when touch-event handlers are installed/removed.
+        https://bugs.webkit.org/show_bug.cgi?id=77440
+
+        Reviewed by Darin Fisher and Ryosuke Niwa.
+
+        * UIProcess/WebPageProxy.h:
+        (WebKit::WebPageProxy::numTouchEventHandlersChanged):
+        * WebProcess/WebCoreSupport/WebChromeClient.h:
+
+2012-02-15  Patrick Gansterer  <paroga@webkit.org>
+
+        [CMake] Move RunLoop to WebCore/platform
+        https://bugs.webkit.org/show_bug.cgi?id=78504
+
+        Reviewed by Adam Roben.
+
+        * CMakeLists.txt: Remove RunLoop.cpp from list of souces.
+
+2012-02-14  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        [Qt] Eliminate first set of QtWidgets dependencies from WebCore
+        https://bugs.webkit.org/show_bug.cgi?id=78611
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        * UIProcess/qt/QtWebPageEventHandler.cpp: Add missing QCursor include
+        to fix compilation.
+
+2012-02-15  Roland Steiner  <rolandsteiner@chromium.org>
+
+        <style scoped>: Allow <style scoped> as a direct child of a ShadowRoot
+        https://bugs.webkit.org/show_bug.cgi?id=77853
+
+        numberOfScopedHTMLStyleChildren got moved from Element into Node.
+
+        Reviewed by Dimitri Glazkov.
+
+        * win/WebKit2.def:
+        * win/WebKit2CFLite.def:
+
+2012-02-15  No'am Rosenthal  <noam.rosenthal@nokia.com>
+
+        [Texmap] Divide TextureMapperNode.cpp to 3 files.
+        https://bugs.webkit.org/show_bug.cgi?id=76660
+
+        Rename TextureMapperNode to TextureMapperLayer.
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        * UIProcess/qt/LayerTreeHostProxyQt.cpp:
+        (WebKit::LayerTreeHostProxy::createLayer):
+        (WebKit::LayerTreeHostProxy::paintToCurrentGLContext):
+        (WebKit::LayerTreeHostProxy::paintToGraphicsContext):
+        (WebKit::LayerTreeHostProxy::getBackingStore):
+        (WebKit::LayerTreeHostProxy::ensureRootLayer):
+        (WebKit::LayerTreeHostProxy::purgeGLResources):
+
+2012-02-14  Anders Carlsson  <andersca@apple.com>
+
+        Swipe gestures don't work if main frame has a horizontal scrollbar
+        https://bugs.webkit.org/show_bug.cgi?id=78650
+        <rdar://problem/10864993>
+
+        Reviewed by Sam Weinig.
+
+        * WebProcess/WebPage/EventDispatcher.cpp:
+        (WebKit::EventDispatcher::wheelEvent):
+        ScrollingTree::tryToHandleWheelEvent now returns a tri-state enum so handle the extra case.
+
+        (WebKit::EventDispatcher::sendDidReceiveEvent):
+        Rename this now that it takes a parameter indicating whether the event was handled or not.
+
+2012-02-14  Brian Weinstein  <bweinstein@apple.com>
+
+        Web Inspector: Add the ability to show the resources panel on launch
+        https://bugs.webkit.org/show_bug.cgi?id=78641
+        
+        Add WebKit2 API for the ability to show the resources panel. This calls down
+        from the WK API all the way to InspectorFrontendClientLocal::showResources.
+
+        Reviewed by Timothy Hatcher.
+
+        * UIProcess/API/C/WKInspector.cpp:
+        (WKInspectorShowResources): Call WebInspectorProxy::showResources.
+        * UIProcess/API/C/WKInspector.h:
+        * UIProcess/WebInspectorProxy.cpp:
+        (WebKit::WebInspectorProxy::showResources): Send a message to the web process.
+        * UIProcess/WebInspectorProxy.h:
+        * WebProcess/WebPage/WebInspector.cpp:
+        (WebKit::WebInspector::showResources): Call InspectorFrontendClientLocal::showResources.
+        * WebProcess/WebPage/WebInspector.h:
+        * WebProcess/WebPage/WebInspector.messages.in: Add a ShowResources message.
+
+2012-02-14  Matt Lilek  <mrl@apple.com>
+
+        Don't ENABLE_DASHBOARD_SUPPORT unconditionally on all Mac platforms
+        https://bugs.webkit.org/show_bug.cgi?id=78629
+
+        Reviewed by David Kilzer.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2012-02-13  Raphael Kubo da Costa  <kubo@profusion.mobi>
+
+        [CMake] Merge WebKitEfl.cmake into FindEFL.cmake.
+        https://bugs.webkit.org/show_bug.cgi?id=78566
+
+        Reviewed by Daniel Bates.
+
+        * PlatformEfl.cmake: Do not include WebKitEfl.cmake.
+
+2012-02-14  No'am Rosenthal  <noam.rosenthal@nokia.com>
+
+        [Qt][Texmap] Refactor backing-store code in TextureMapper
+        https://bugs.webkit.org/show_bug.cgi?id=78305
+
+        Move the backing-store code to LayerTreeBackingStore, implementing the virtual functions
+        in TextureMapperBackingStore.
+        We save the double-buffered tile in the backing-store, and then convert them to regular
+        tiles in updateContents, based on the order of painting.
+        Use TextureMapperCompositedImage for images instead of saving our own composited image
+        registry.
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        * Target.pri:
+        * UIProcess/LayerTreeHostProxy.h:
+        (WebKit):
+        (LayerTreeHostProxy):
+        * UIProcess/qt/LayerBackingStore.cpp: Added.
+        * UIProcess/qt/LayerBackingStore.h: Added.
+        * UIProcess/qt/LayerTreeHostProxyQt.cpp:
+        (WebKit::LayerTreeHostProxy::createLayer):
+        (WebKit::LayerTreeHostProxy::syncLayerParameters):
+        (WebKit::LayerTreeHostProxy::getBackingStore):
+        (WebKit::LayerTreeHostProxy::createTile):
+        (WebKit::LayerTreeHostProxy::removeTile):
+        (WebKit::LayerTreeHostProxy::updateTile):
+        (WebKit::LayerTreeHostProxy::createImage):
+        (WebKit::LayerTreeHostProxy::assignImageToLayer):
+        (WebKit::LayerTreeHostProxy::purgeGLResources):
+        * WebProcess.pro:
+
+
+2012-02-14  Shinya Kawanaka  <shinyak@google.com>
+
+        Use youngestShadowRoot and oldestShadowRoot instead of Element::shadowRoot().
+        https://bugs.webkit.org/show_bug.cgi?id=78455
+
+        Reviewed by Hajime Morita.
+
+        Exports necesarry symbols.
+
+        * win/WebKit2.def:
+        * win/WebKit2CFLite.def:
+
+2012-02-14  Alexey Proskuryakov  <ap@apple.com>
+
+        [Mac][Win][WK2] Switch to RFC 6455 protocol for WebSockets
+        https://bugs.webkit.org/show_bug.cgi?id=78541
+        <rdar://problem/10036695>
+
+        Reviewed by Kent Tamura.
+
+        * Shared/WebPreferencesStore.h: (WebKit): Changed default value of the preference.
+
+2012-02-13  W. James MacLean  <wjmaclean@chromium.org>
+
+        [chromium] Remove obsolete zoom animation pathway.
+        https://bugs.webkit.org/show_bug.cgi?id=78359
+
+        Reviewed by James Robinson.
+
+        This patch removes dead code from the previous incarnation of zoom animation for chromium.
+
+        WebProcess/Plugins/PDF/BuiltInPDFView.h:
+        (BuiltInPDFView):
+
+2012-02-13  Enrica Casucci  <enrica@apple.com>
+
+        Refactor Mac platform implementation of the Pasteboard class to use Platform Strategies.
+        https://bugs.webkit.org/show_bug.cgi?id=78282
+
+        This patch removes any accesss to the NSPasteboard object from the Pasteboard class which
+        now makes use of a new pasteboardStrategy object that is implemented both in WebKit and
+        WebKit2. The actual access to NSPasteboard is now performed inside the PlatformPasteboard
+        class. Currently both WebKit and WebKit2 use the same implementation of the PasteboardStrategy
+        interface but this one more step in the direction of removing access to NSPasteboard from
+        the WebProcess.
+        As part of the refactoring the I've reduced to a minimum the use of OBJ-C classes.
+
+        Reviewed by Anders Carlsson.
+
+        * WebProcess/WebCoreSupport/WebPlatformStrategies.cpp: Added implementation of PasteboardStrategy
+        interface.
+        (WebKit::WebPlatformStrategies::createPasteboardStrategy):
+        (WebKit::WebPlatformStrategies::getTypes):
+        (WebKit::WebPlatformStrategies::bufferForType):
+        (WebKit::WebPlatformStrategies::getPathnamesForType):
+        (WebKit::WebPlatformStrategies::stringForType):
+        (WebKit::WebPlatformStrategies::copy):
+        (WebKit::WebPlatformStrategies::setTypes):
+        (WebKit::WebPlatformStrategies::setBufferForType):
+        (WebKit::WebPlatformStrategies::setPathnamesForType):
+        (WebKit::WebPlatformStrategies::setStringForType):
+        * WebProcess/WebCoreSupport/WebPlatformStrategies.h: Added PasteboardStrategy.
+
+2012-02-13  Anders Carlsson  <andersca@apple.com>
+
+        The scrolling tree needs to know about the back forward state of the page
+        https://bugs.webkit.org/show_bug.cgi?id=78523
+        <rdar://problem/10756548>
+
+        Reviewed by Sam Weinig.
+
+        Pass the back/forward state in the WheelEvent message. This is pretty hacky but works well.
+
+        * Platform/CoreIPC/HandleMessage.h:
+        (CoreIPC):
+        (CoreIPC::callMemberFunction):
+        * UIProcess/WebPageProxy.cpp:
+        (WebKit::WebPageProxy::handleWheelEvent):
+        (WebKit::WebPageProxy::didReceiveEvent):
+        * WebProcess/WebPage/EventDispatcher.cpp:
+        (WebKit::EventDispatcher::wheelEvent):
+        * WebProcess/WebPage/EventDispatcher.h:
+        (EventDispatcher):
+        * WebProcess/WebPage/EventDispatcher.messages.in:
+
+2012-02-13  Dan Bernstein  <mitz@apple.com>
+
+        WebKit2 build emits a warning about not stripping code-signed PluginProcess.app when copying it into the framework
+        https://bugs.webkit.org/show_bug.cgi?id=78451
+
+        Reviewed by Sam Weinig.
+
+        * Configurations/Base.xcconfig: Set COPY_PHASE_STRIP to NO.
+
+2012-02-13  Sam Weinig  <sam@webkit.org>
+
+        Windows build fix.
+
+        * UIProcess/win/WebPopupMenuProxyWin.cpp:
+        (WebKit::WebPopupMenuProxyWin::scrollToRevealSelection):
+
+2012-02-13  Zalan Bujtas  <zbujtas@gmail.com>
+
+        Manage ShareableBitmap object lifecycle properly, when QImage is created
+        using the shared data.
+        https://bugs.webkit.org/show_bug.cgi?id=77546
+
+        Reviewed by Simon Hausmann.
+
+        * Shared/ShareableBitmap.h:
+        (ShareableBitmap):
+        * Shared/qt/ShareableBitmapQt.cpp:
+        (WebKit::ShareableBitmap::createQImage):
+        (WebKit):
+        (WebKit::ShareableBitmap::releaseSharedMemoryData):
+
+2012-02-06  Raphael Kubo da Costa  <kubo@profusion.mobi>
+
+        [EFL] Drop support for the Curl network backend.
+        https://bugs.webkit.org/show_bug.cgi?id=77874
+
+        Reviewed by Eric Seidel.
+
+        Nobody seems to be maintaining the Curl backend in WebCore, the
+        EFL port developers all seem to be using the Soup backend and the
+        port itself has many features which are only implemented for the
+        latter.
+
+        * PlatformEfl.cmake: Unconditionally build the glib/soup source
+        files and unconditionally add the required include directories and
+        libraries.
+        * WebProcess/efl/WebProcessMainEfl.cpp:
+        (WebKit::WebProcessMainEfl): Remove USE(SOUP) check.
+
+2012-02-11  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r107435.
+        http://trac.webkit.org/changeset/107435
+        https://bugs.webkit.org/show_bug.cgi?id=78410
+
+        It broke the Qt build (Requested by Ossy on #webkit).
+
+        * WebProcess/WebCoreSupport/WebPlatformStrategies.cpp:
+        * WebProcess/WebCoreSupport/WebPlatformStrategies.h:
+        (WebPlatformStrategies):
+
+2012-02-10  Brian Weinstein  <bweinstein@apple.com>
+
+        Web Inspector: Add the ability to jump to the source for a given frame
+        https://bugs.webkit.org/show_bug.cgi?id=78396
+        
+        Add WebKit2 API for the ability to show the source of a frame in the web inspector. This calls down
+        from the WK API all the way to InspectorFrontendClientLocal::showMainResourceForFrame.
+
+        Reviewed by Tim Hatcher.
+
+        * UIProcess/API/C/WKInspector.cpp:
+        (WKInspectorShowMainResourceForFrame): Call WebInspectorProxy::showMainResourceForFrame.
+        * UIProcess/API/C/WKInspector.h:
+
+        * UIProcess/WebInspectorProxy.cpp:
+        (WebKit::WebInspectorProxy::showMainResourceForFrame): Send a message to the web process, passing
+            the frame ID of the frame we want to show the main resource of.
+        * UIProcess/WebInspectorProxy.h:
+
+        * WebProcess/WebPage/WebInspector.cpp:
+        (WebKit::WebInspector::showMainResourceForFrame): Get the WebFrame for the frame we want to show the
+            main resource of from its ID. If we found a frame, call InspectorFrontendClientLocal::showMainResourceForFrame.
+        * WebProcess/WebPage/WebInspector.h:
+        
+        * WebProcess/WebPage/WebInspector.messages.in: Add a new message.
+
+2012-02-10  Adam Klein  <adamk@chromium.org>
+
+        Enable MUTATION_OBSERVERS by default on all platforms
+        https://bugs.webkit.org/show_bug.cgi?id=78196
+
+        Reviewed by Ojan Vafai.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2012-02-10  Enrica Casucci  <enrica@apple.com>
+
+        Refactor Mac platform implementation of the Pasteboard class to use Platform Strategies.
+        https://bugs.webkit.org/show_bug.cgi?id=78282
+
+        This patch removes any accesss to the NSPasteboard object from the Pasteboard class which
+        now makes use of a new pasteboardStrategy object that is implemented both in WebKit and
+        WebKit2. The actual access to NSPasteboard is now performed inside the PlatformPasteboard
+        class. Currently both WebKit and WebKit2 use the same implementation of the PasteboardStrategy
+        interface but this one more step in the direction of removing access to NSPasteboard from
+        the WebProcess.
+        As part of the refactoring the I've reduced to a minimum the use of OBJ-C classes.
+        
+        Reviewed by Anders Carlsson.
+
+        * WebProcess/WebCoreSupport/WebPlatformStrategies.cpp: Added implementation of PasteboardStrategy
+        interface.
+        (WebKit::WebPlatformStrategies::createPasteboardStrategy):
+        (WebKit::WebPlatformStrategies::getTypes):
+        (WebKit::WebPlatformStrategies::bufferForType):
+        (WebKit::WebPlatformStrategies::getPathnamesForType):
+        (WebKit::WebPlatformStrategies::stringForType):
+        (WebKit::WebPlatformStrategies::copy):
+        (WebKit::WebPlatformStrategies::setTypes):
+        (WebKit::WebPlatformStrategies::setBufferForType):
+        (WebKit::WebPlatformStrategies::setPathnamesForType):
+        (WebKit::WebPlatformStrategies::setStringForType):
+        * WebProcess/WebCoreSupport/WebPlatformStrategies.h: Added PasteboardStrategy.
+
+2012-02-09  Timothy Hatcher  <timothy@apple.com>
+
+        Prevent attaching when inspecting the Web Inspector.
+
+        Also adds some comments about keeping in sync with InspectorFrontendClientLocal::canAttachWindow
+        and why there are two implementations of the same function.
+
+        https://webkit.org/b/78304
+
+        Reviewed by Brian Weinstein.
+
+        * UIProcess/WebInspectorProxy.cpp:
+        (WebKit::WebInspectorProxy::canAttach): Prevent attaching when the page is an inspector page.
+        Added comments about InspectorFrontendClientLocal::canAttachWindow.
+        * UIProcess/WebInspectorProxy.h:
+        (WebInspectorProxy): Added comment about keeping in sync with InspectorFrontendClientLocal.
+
+2012-02-09  Alexey Proskuryakov  <ap@apple.com>
+
+        Managed network proxy settings are not used in WebProcess
+        https://bugs.webkit.org/show_bug.cgi?id=78288
+        <rdar://problem/9962116>
+
+        Reviewed by Anders Carlsson.
+
+        * WebProcess/com.apple.WebProcess.sb: Allow reading managed preferences.
+
+2012-02-09  Alexey Proskuryakov  <ap@apple.com>
+
+        ASSERTION FAILED: checkURLReceivedFromWebProcess(originalURL) loading a local file, if the WebProcess crashed
+        https://bugs.webkit.org/show_bug.cgi?id=70845
+        <rdar://problem/10269985>
+
+        Reviewed by Anders Carlsson.
+
+        This also fixes some case where WebProcess did not get a sandbox extension after a crash.
+
+        * UIProcess/WebPageProxy.cpp:
+        (WebKit::WebPageProxy::reattachToWebProcessWithItem): We no longer need to pass a sandbox
+        extension here, we're now passing it at b/f navigation bottleneck.
+        (WebKit::WebPageProxy::reload): Pass a sandbox extension - reload may mean reloading an error
+        page after a crash, so WebProcess may no longer have the extension.
+        (WebKit::WebPageProxy::goForward): We no longer need to pass a sandbox extension here,
+        we're now passing it at b/f navigation bottleneck. Also, fixed a bug where we first null checked
+        a WebBackForwardListItem pointer, and then used it anyway.
+        (WebKit::WebPageProxy::goBack): Ditto.
+        (WebKit::WebPageProxy::goToBackForwardItem): Ditto.
+        (WebKit::WebPageProxy::backForwardGoToItem): This is the bottleneck. We get here both for UI
+        actions like pressing the Back button, and for window.history.go() navigations. JS navigations
+        previously didn't open up the sandbox. URLs in UI process b/f list are trusted, so it's
+        always OK to grant a sandbox extension if one of them is a file: one.
+
+        * UIProcess/WebPageProxy.h: backForwardGoToItem() now returns a sandbox extension handle.
+
+        * UIProcess/WebPageProxy.messages.in: Ditto.
+
+        * UIProcess/WebProcessProxy.cpp:
+        (WebKit::WebProcessProxy::checkURLReceivedFromWebProcess): If a URL is in UI process b/f
+        list, then it has been already vetted as something the Web process knows about. No need to
+        crash if it actually attempts going there.
+        (WebKit::WebProcessProxy::didReceiveInvalidMessage): Removed a useless comment (we have tons
+        of fprintfs besides this one). Fixed log message syntax.
+
+        * UIProcess/cf/WebPageProxyCF.cpp: (WebKit::WebPageProxy::restoreFromSessionStateData):
+        We no longer need to pass a sandbox extension here, we're now passing it at b/f navigation
+        bottleneck. 
+
+        * WebProcess/WebPage/WebBackForwardListProxy.cpp: (WebKit::WebBackForwardListProxy::goToItem):
+        We now get an extension here, when telling UI process that we're navigating to a b/f list item.
+
+        * WebProcess/WebPage/WebPage.cpp:
+        (WebKit::WebPage::reload): Use the extension we're getting.
+        (WebKit::WebPage::goForward): Don't use one we're not getting.
+        (WebKit::WebPage::goBack): Ditto.
+        (WebKit::WebPage::goToBackForwardItem): Ditto.
+        (WebKit::WebPage::restoreSessionAndNavigateToCurrentItem): Ditto.
+
+        * WebProcess/WebPage/WebPage.h: Adjusted signatures accordingly.
+
+        * WebProcess/WebPage/WebPage.messages.in: Ditto.
+
+2012-02-09  Matthew Delaney  <mdelaney@apple.com>
+
+        HiDPI: WebKit2's drag images are blurry
+        https://bugs.webkit.org/show_bug.cgi?id=67779
+
+        Use the proper deviceScaleFactor() instead of accessing _intrinsicDeviceScaleFactor
+
+        Reviewed by Beth Dakin.
+
+        * UIProcess/API/mac/WKView.mm:
+        (-[WKView _setDragImage:at:linkDrag:]):
+
+2012-02-09  Alexey Proskuryakov  <ap@apple.com>
+
+        [WK2] Allow reading some debug-only preference files
+        https://bugs.webkit.org/show_bug.cgi?id=78255
+        <rdar://problem/9382382>
+        <rdar://problem/10830558>
+
+        Reviewed by Dan Bernstein.
+
+        * WebProcess/com.apple.WebProcess.sb:
+
+2012-02-09  Matthew Delaney  <mdelaney@apple.com>
+
+        HiDPI: WebKit2's link-dragging images are blurry
+        https://bugs.webkit.org/show_bug.cgi?id=67779
+
+        Reviewed by Beth Dakin.
+
+        Teach startDrag about the deviceScaleFactor so that it creates
+        an appropriately scaled bitmap image to ship over.
+        * WebProcess/WebCoreSupport/mac/WebDragClientMac.mm:
+        (WebKit::WebDragClient::startDrag):
+        (WebKit::convertImageToBitmap):
+
+        Have setDragImage assume that it's receiving a bitmap image scaled
+        up by the deviceScaleFactor that it sees.
+        * UIProcess/API/mac/WKView.mm:
+        (-[WKView _setDragImage:at:linkDrag:]):
+
+2012-02-09  Carlos Garcia Campos  <cgarcia@igalia.com>
+
+        [GTK] Add WebKitWebView::mouse-target-changed signal to WebKit2 GTK+ API
+        https://bugs.webkit.org/show_bug.cgi?id=78097
+
+        Reviewed by Martin Robinson.
+
+        * GNUmakefile.am: Add new files to compilation.
+        * UIProcess/API/gtk/WebKitHitTestResult.cpp: Added.
+        (webkitHitTestResultFinalize):
+        (webkitHitTestResultGetProperty):
+        (webkitHitTestResultSetProperty):
+        (webkit_hit_test_result_init):
+        (webkit_hit_test_result_class_init):
+        (webkitHitTestResultCreate): Create a new WebKitHitTestResult for
+        the given WKHitTestResult.
+        (stringIsEqualToCString): Helper function to compare String and
+        CString considering String::isEmpty() == CString.isNull().
+        (webkitHitTestResultCompare): Helper function to check whether a
+        WebKitHitTestResult contains the same information than the given
+        WKHitTestResult.
+        (webkit_hit_test_result_get_context):
+        (webkit_hit_test_result_context_is_link):
+        (webkit_hit_test_result_context_is_image):
+        (webkit_hit_test_result_context_is_media):
+        (webkit_hit_test_result_get_link_uri):
+        (webkit_hit_test_result_get_link_title):
+        (webkit_hit_test_result_get_link_label):
+        (webkit_hit_test_result_get_image_uri):
+        (webkit_hit_test_result_get_media_uri):
+        * UIProcess/API/gtk/WebKitHitTestResult.h: Added.
+        * UIProcess/API/gtk/WebKitHitTestResultPrivate.h:
+        * UIProcess/API/gtk/WebKitNavigationPolicyDecision.cpp:
+        (webkitNavigationPolicyDecisionCreate): Use
+        wkEventModifiersToGdkModifiers.
+        * UIProcess/API/gtk/WebKitPrivate.cpp:
+        (wkEventModifiersToGdkModifiers): Moved from
+        WebKitNavigationPolicyDecision and renamed to wkEventModifiersToGdkModifiers.
+        * UIProcess/API/gtk/WebKitPrivate.h:
+        * UIProcess/API/gtk/WebKitUIClient.cpp:
+        (mouseDidMoveOverElement): UI client callback that calls
+        webkitWebViewMouseTargetChanged().
+        (attachUIClientToView): Add implementation for callback
+        mouseDidMoveOverElement.
+        * UIProcess/API/gtk/WebKitWebView.cpp:
+        (webkit_web_view_class_init): Add
+        WebKitWebView::mouse-target-changed signal.
+        (webkitWebViewMouseTargetChanged): Emit
+        WebKitWebView::mouse-target-changed signal.
+        * UIProcess/API/gtk/WebKitWebView.h:
+        * UIProcess/API/gtk/WebKitWebViewPrivate.h:
+        * UIProcess/API/gtk/docs/webkit2gtk-docs.sgml: Add new section for
+        WebKitHitTestResult.
+        * UIProcess/API/gtk/docs/webkit2gtk-sections.txt: Add new symbols.
+        * UIProcess/API/gtk/tests/TestWebKitWebView.cpp:
+        (testWebViewMouseTarget):
+        (beforeAll):
+        * UIProcess/API/gtk/tests/WebViewTest.cpp:
+        (WebViewTest::WebViewTest):
+        (WebViewTest::~WebViewTest):
+        (parentWindowMapped):
+        (WebViewTest::showInWindowAndWaitUntilMapped): Method to add the
+        view into a popup window and show it running the main loop until
+        the window is mapped.
+        (WebViewTest::mouseMoveTo): Method to synthesize a
+        GDK_MOTION_EVENT on the given coordinates and using the given
+        modifiers.
+        * UIProcess/API/gtk/tests/WebViewTest.h:
+        * UIProcess/API/gtk/webkit2.h: Include WebKitHitTestResult.h.
+        * UIProcess/API/gtk/webkit2marshal.list:
+
+2012-02-07  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+
+        [Qt] Fetch the visible rect from LayerTreeHost instead of keeping a copy in each layer.
+        https://bugs.webkit.org/show_bug.cgi?id=78009
+
+        Reviewed by Noam Rosenthal.
+
+        Since WebGraphicsLayers are now accessed directly from LayerTreeHost, they don't
+        need to keep the visible rect to pass it down their child layers anymore.
+
+        * WebProcess/WebCoreSupport/WebGraphicsLayer.cpp:
+        (WebCore::WebGraphicsLayer::setContentsScale):
+        (WebCore::WebGraphicsLayer::tiledBackingStoreVisibleRect):
+        (WebCore::WebGraphicsLayer::adjustVisibleRect):
+        (WebCore):
+        * WebProcess/WebCoreSupport/WebGraphicsLayer.h:
+        (WebGraphicsLayerClient):
+        (WebGraphicsLayer):
+        * WebProcess/WebPage/qt/LayerTreeHostQt.cpp:
+        (WebKit::LayerTreeHostQt::registerLayer):
+        (WebKit::LayerTreeHostQt::visibleContentsRect):
+        (WebKit):
+        (WebKit::LayerTreeHostQt::setVisibleContentRectAndScale):
+        * WebProcess/WebPage/qt/LayerTreeHostQt.h:
+        (LayerTreeHostQt):
+
+2012-02-09  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+
+        [Qt] Control the lifetime of TiledBackingStores in WebGraphicsLayer.
+        https://bugs.webkit.org/show_bug.cgi?id=78005
+
+        Reviewed by Noam Rosenthal.
+
+        This makes sure that no empty tiles are generated for layers without contents and that
+        no interaction is made with the TiledBackingStore until we got a WebGraphicsLayerClient.
+
+        - Create the main TiledBackingStore only when the layer has drawsContent and has no
+          directly composited image
+        - Removed recreateBackingStoreIfNeeded and do the (re)creation of the backing stores
+          in updateContentBuffers
+        - Call purgeBackingStores on registered layers instead of passing it down the layer tree
+
+        * WebProcess/WebCoreSupport/WebGraphicsLayer.cpp:
+        (WebCore::WebGraphicsLayer::WebGraphicsLayer):
+        (WebCore::WebGraphicsLayer::~WebGraphicsLayer):
+        (WebCore::WebGraphicsLayer::setDrawsContent):
+        (WebCore::WebGraphicsLayer::setNeedsDisplayInRect):
+        (WebCore::WebGraphicsLayer::syncCompositingStateForThisLayerOnly):
+        (WebCore::WebGraphicsLayer::setVisibleContentRectTrajectoryVector):
+        (WebCore::WebGraphicsLayer::tiledBackingStoreContentsRect):
+        (WebCore::WebGraphicsLayer::updateContentBuffers):
+        (WebCore::WebGraphicsLayer::purgeBackingStores):
+        (WebCore::WebGraphicsLayer::setWebGraphicsLayerClient):
+        (WebCore::WebGraphicsLayer::computeTransformedVisibleRect):
+        * WebProcess/WebCoreSupport/WebGraphicsLayer.h:
+        (WebGraphicsLayer):
+        * WebProcess/WebPage/qt/LayerTreeHostQt.cpp:
+        (WebKit::LayerTreeHostQt::LayerTreeHostQt):
+        (WebKit::LayerTreeHostQt::flushPendingLayerChanges):
+        (WebKit):
+        (WebKit::LayerTreeHostQt::purgeBackingStores):
+        * WebProcess/WebPage/qt/LayerTreeHostQt.h:
+        (LayerTreeHostQt):
+
+2012-02-08  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+
+        [Qt] Remove WebGraphicsLayer::updateTileBuffersRecursively
+        https://bugs.webkit.org/show_bug.cgi?id=78105
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        The method is unused.
+
+        * WebProcess/WebCoreSupport/WebGraphicsLayer.cpp:
+        * WebProcess/WebCoreSupport/WebGraphicsLayer.h:
+        (WebGraphicsLayer):
+
+2012-02-08  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+
+        [Qt] Register individual WebGraphicsLayers to LayerTreeHost instead of handling the tree as a whole.
+        https://bugs.webkit.org/show_bug.cgi?id=77976
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        The LayerTreeHost association had to be maintained between re-parented layers and it would be
+        impossible to know if the layer would be disconnected from the LayerTreeHost only for reparenting
+        or disconnected for good (in other words, that the LayerTreeHost could be deleted meanwhile).
+
+        Instead, this patch assumes that graphics layers will only be in contact with one instance of
+        LayerTreeHost, and that this association can be kept until either the graphics layer or the layer
+        tree host gets deleted.
+
+        The registered layers are kept in a set and the visible rect and scales are passed directly
+        to layers instead of down the tree, through the root layer.
+
+        This also fixes the !m_layerInfo.imageBackingStoreID ASSERT that was popping in unit tests.
+
+        * WebProcess/WebCoreSupport/WebGraphicsLayer.cpp:
+        (WebCore::WebGraphicsLayer::WebGraphicsLayer):
+        (WebCore::WebGraphicsLayer::~WebGraphicsLayer):
+        (WebCore::WebGraphicsLayer::setChildren):
+        (WebCore::WebGraphicsLayer::addChild):
+        (WebCore::WebGraphicsLayer::addChildAtIndex):
+        (WebCore::WebGraphicsLayer::addChildAbove):
+        (WebCore::WebGraphicsLayer::addChildBelow):
+        (WebCore::WebGraphicsLayer::replaceChild):
+        (WebCore::WebGraphicsLayer::removeFromParent):
+        (WebCore::WebGraphicsLayer::setContentsToImage):
+        (WebCore::WebGraphicsLayer::setMaskLayer):
+        (WebCore::WebGraphicsLayer::setReplicatedByLayer):
+        (WebCore::WebGraphicsLayer::syncCompositingStateForThisLayerOnly):
+        (WebCore::WebGraphicsLayer::setVisibleContentRectAndScale):
+        (WebCore::WebGraphicsLayer::tiledBackingStoreUpdatesAllowed):
+        (WebCore::WebGraphicsLayer::createTile):
+        (WebCore::WebGraphicsLayer::updateTile):
+        (WebCore::WebGraphicsLayer::removeTile):
+        (WebCore::WebGraphicsLayer::updateContentBuffers):
+        (WebCore::WebGraphicsLayer::purgeBackingStores):
+        (WebCore::WebGraphicsLayer::setWebGraphicsLayerClient):
+        * WebProcess/WebCoreSupport/WebGraphicsLayer.h:
+        (WebCore):
+        (WebGraphicsLayerClient):
+        (WebGraphicsLayer):
+        * WebProcess/WebPage/qt/LayerTreeHostQt.cpp:
+        (WebKit::LayerTreeHostQt::~LayerTreeHostQt):
+        (WebKit::LayerTreeHostQt::LayerTreeHostQt):
+        (WebKit::LayerTreeHostQt::attachLayer):
+        (WebKit):
+        (WebKit::LayerTreeHostQt::detachLayer):
+        (WebKit::LayerTreeHostQt::setVisibleContentRectAndScale):
+        * WebProcess/WebPage/qt/LayerTreeHostQt.h:
+        (LayerTreeHostQt):
+
+2012-02-07  Andras Becsi  <andras.becsi@nokia.com>
+
+        [Qt][WK2] WebView should use Flickable instead of QScroller to handle positioning
+        https://bugs.webkit.org/show_bug.cgi?id=76275
+
+        Reviewed by Simon Hausmann and Kenneth Rohde Christiansen.
+
+        The current WebView implementation uses QScroller to manage positioning but other
+        similar items in QML (ie. ListView, GridView) use Flickable as their base class.
+        Since QScroller will be dropped from Qt5 this patch removes the QScroller code
+        and redirects pan gestures to a dynamically created encapsulated Flickable instance
+        (QtFlickProvider) which handles the positioning.
+
+        This implementation only uses public QML API and does not depend on declarative-private.
+        It propagates a small subset of the Flickable API as the public API of the WebView.
+        This minimalistic API is accessible via the experimental extension and makes it possible
+        in QML to place additional items (such as toolbars, scroll indicators and floating menus)
+        aroud the page.
+        These items can use anchoring and binding for positioning on the flickable contentItem.
+
+        The patch depends however on the automatic touch->mouse event synthetization of Qt5.
+        The touch events sent to the flickProvider are translated to mouse events automatically
+        as long as the Flickable does not handle touch events directly.
+
+        After this change QtWebKit2 does no longer depend on QtWidgets and this dependency can be
+        removed in a follow-up patch.
+
+        * Target.pri: Added QtFlickProvider source.
+        * UIProcess/API/qt/qquickwebpage.cpp:
+        (QQuickWebPagePrivate::paintToCurrentGLContext):
+        (QQuickWebPage::transformToItem):
+        (QQuickWebPagePrivate::updateSize):
+        * UIProcess/API/qt/qquickwebview.cpp:
+        (QQuickWebViewPrivate::QQuickWebViewPrivate):
+        (QQuickWebViewPrivate::pageItemPos):
+        (QQuickWebViewFlickablePrivate::pageItemPos):
+        (QQuickWebViewFlickablePrivate::updateContentsSize):
+        (QQuickWebViewFlickablePrivate::onComponentComplete):
+        (QQuickWebViewFlickablePrivate::updateViewportSize):
+        (QQuickWebViewExperimental::flickableData):
+        (QQuickWebViewExperimental::contentItem):
+        (QQuickWebViewExperimental::contentWidth):
+        (QQuickWebViewExperimental::setContentWidth):
+        (QQuickWebViewExperimental::contentHeight):
+        (QQuickWebViewExperimental::setContentHeight):
+        (QQuickWebViewExperimental::contentX):
+        (QQuickWebViewExperimental::setContentX):
+        (QQuickWebViewExperimental::contentY):
+        (QQuickWebViewExperimental::setContentY):
+        (QQuickWebView::pageItemPos):
+        (QQuickWebView::updateContentsSize):
+        * UIProcess/API/qt/qquickwebview_p.h:
+        * UIProcess/API/qt/qquickwebview_p_p.h:
+        (QQuickWebViewPrivate):
+        (QQuickWebViewPrivate::updateContentsSize):
+        (QQuickWebViewFlickablePrivate):
+        * UIProcess/API/qt/tests/qquickwebview/tst_qquickwebview.cpp:
+        (tst_QQuickWebView::scrollRequest):
+        * UIProcess/qt/QtFlickProvider.cpp: Added.
+        (QtFlickProvider::QtFlickProvider):
+        (QtFlickProvider::handleTouchFlickEvent):
+        (QtFlickProvider::contentItem):
+        (QtFlickProvider::flickableData):
+        (QtFlickProvider::contentPos):
+        (QtFlickProvider::setContentPos):
+        (QtFlickProvider::viewportSize):
+        (QtFlickProvider::setViewportSize):
+        (QtFlickProvider::returnToBounds):
+        (QtFlickProvider::cancelFlick):
+        (QtFlickProvider::isMoving):
+        (QtFlickProvider::isDragging):
+        (QtFlickProvider::isFlicking):
+        (QtFlickProvider::contentWidth):
+        (QtFlickProvider::setContentWidth):
+        (QtFlickProvider::contentHeight):
+        (QtFlickProvider::setContentHeight):
+        (QtFlickProvider::contentX):
+        (QtFlickProvider::setContentX):
+        (QtFlickProvider::contentY):
+        (QtFlickProvider::setContentY):
+        * UIProcess/qt/QtFlickProvider.h: Added.
+        (QtFlickProvider):
+        * UIProcess/qt/QtPanGestureRecognizer.cpp:
+        (WebKit::QtPanGestureRecognizer::recognize):
+        * UIProcess/qt/QtPanGestureRecognizer.h:
+        (QtPanGestureRecognizer):
+        * UIProcess/qt/QtViewportInteractionEngine.cpp:
+        (WebKit::QtViewportInteractionEngine::QtViewportInteractionEngine):
+        (WebKit::QtViewportInteractionEngine::setItemRectVisible):
+        (WebKit::QtViewportInteractionEngine::scrollStateChanged):
+        (WebKit):
+        (WebKit::QtViewportInteractionEngine::wheelEvent):
+        (WebKit::QtViewportInteractionEngine::reset):
+        (WebKit::QtViewportInteractionEngine::applyConstraints):
+        (WebKit::QtViewportInteractionEngine::scrollAnimationActive):
+        (WebKit::QtViewportInteractionEngine::panGestureActive):
+        (WebKit::QtViewportInteractionEngine::panGestureStarted):
+        (WebKit::QtViewportInteractionEngine::panGestureRequestUpdate):
+        (WebKit::QtViewportInteractionEngine::panGestureCancelled):
+        (WebKit::QtViewportInteractionEngine::panGestureEnded):
+        (WebKit::QtViewportInteractionEngine::pinchGestureRequestUpdate):
+        (WebKit::QtViewportInteractionEngine::scaleContent):
+        * UIProcess/qt/QtViewportInteractionEngine.h:
+        (QtViewportInteractionEngine):
+        * UIProcess/qt/QtWebPageEventHandler.cpp:
+        (QtWebPageEventHandler::doneWithTouchEvent):
+
 2012-02-08  Keunsoon Lee  <keunsoon.lee@samsung.com>
 
         [WK2][EFL] creating dummy class derived from ResourceHandleClient for Efl download module.
diff --git a/Source/WebKit2/Configurations/Base.xcconfig b/Source/WebKit2/Configurations/Base.xcconfig
index 98d08fdc4..e736e5daa 100644
--- a/Source/WebKit2/Configurations/Base.xcconfig
+++ b/Source/WebKit2/Configurations/Base.xcconfig
@@ -60,6 +60,11 @@ WARNING_CFLAGS = -Wall -Wextra -Wchar-subscripts -Wextra-tokens -Wformat-securit
 // Prevent C++ standard library operator new, delete and their related exception types from being exported as weak symbols.
 OTHER_LDFLAGS = -Wl,-unexported_symbol -Wl,__ZTISt9bad_alloc -Wl,-unexported_symbol -Wl,__ZTISt9exception -Wl,-unexported_symbol -Wl,__ZTSSt9bad_alloc -Wl,-unexported_symbol -Wl,__ZTSSt9exception -Wl,-unexported_symbol -Wl,__ZdlPvS_ -Wl,-unexported_symbol -Wl,__ZnwmPv;
 
+CLANG_CXX_LIBRARY = $(CLANG_CXX_LIBRARY_$(TARGET_MAC_OS_X_VERSION_MAJOR));
+CLANG_CXX_LIBRARY_1060 = libstdc++;
+CLANG_CXX_LIBRARY_1070 = libc++;
+CLANG_CXX_LIBRARY_1080 = libc++;
+CLANG_CXX_LIBRARY_1090 = libc++;
 
 REAL_PLATFORM_NAME = $(REAL_PLATFORM_NAME_$(PLATFORM_NAME));
 REAL_PLATFORM_NAME_ = $(REAL_PLATFORM_NAME_macosx);
@@ -84,6 +89,7 @@ STRIP_INSTALLED_PRODUCT = $(STRIP_INSTALLED_PRODUCT_$(CURRENT_VARIANT));
 STRIP_INSTALLED_PRODUCT_normal = YES;
 STRIP_INSTALLED_PRODUCT_debug = NO;
 
+COPY_PHASE_STRIP = NO;
 // Dead code stripping needs to be on in the debug variant to avoid link errors.  This is due to unconditionally
 // building the MiG bindings for WebKitPluginClient even when the functions that the bindings wrap are not built.
 DEAD_CODE_STRIPPING = YES;
diff --git a/Source/WebKit2/Configurations/FeatureDefines.xcconfig b/Source/WebKit2/Configurations/FeatureDefines.xcconfig
index f5bc9cf39..3e2090355 100644
--- a/Source/WebKit2/Configurations/FeatureDefines.xcconfig
+++ b/Source/WebKit2/Configurations/FeatureDefines.xcconfig
@@ -37,7 +37,8 @@ ENABLE_BLOB_macosx = ENABLE_BLOB;
 ENABLE_CLIENT_BASED_GEOLOCATION = $(ENABLE_CLIENT_BASED_GEOLOCATION_$(REAL_PLATFORM_NAME));
 ENABLE_CLIENT_BASED_GEOLOCATION_macosx = ENABLE_CLIENT_BASED_GEOLOCATION;
 
-ENABLE_DASHBOARD_SUPPORT = ENABLE_DASHBOARD_SUPPORT;
+ENABLE_DASHBOARD_SUPPORT = $(ENABLE_DASHBOARD_SUPPORT_$(REAL_PLATFORM_NAME));
+ENABLE_DASHBOARD_SUPPORT_macosx = ENABLE_DASHBOARD_SUPPORT;
 
 ENABLE_DATALIST = $(ENABLE_DATALIST_$(REAL_PLATFORM_NAME));
 ENABLE_DATALIST_macosx = ENABLE_DATALIST;
@@ -95,7 +96,7 @@ ENABLE_MEDIA_SOURCE = ;
 ENABLE_MEDIA_STATISTICS = ;
 ENABLE_METER_TAG = ENABLE_METER_TAG;
 ENABLE_MHTML = ;
-ENABLE_MUTATION_OBSERVERS = ;
+ENABLE_MUTATION_OBSERVERS = ENABLE_MUTATION_OBSERVERS;
 
 ENABLE_NOTIFICATIONS = $(ENABLE_NOTIFICATIONS_$(REAL_PLATFORM_NAME));
 ENABLE_NOTIFICATIONS_macosx = $(ENABLE_NOTIFICATIONS_macosx_$(TARGET_MAC_OS_X_VERSION_MAJOR));
diff --git a/Source/WebKit2/Configurations/Version.xcconfig b/Source/WebKit2/Configurations/Version.xcconfig
index c7089df71..8df936db5 100644
--- a/Source/WebKit2/Configurations/Version.xcconfig
+++ b/Source/WebKit2/Configurations/Version.xcconfig
@@ -22,7 +22,7 @@
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
 
 MAJOR_VERSION = 535;
-MINOR_VERSION = 20;
+MINOR_VERSION = 23;
 TINY_VERSION = 0;
 FULL_VERSION = $(MAJOR_VERSION).$(MINOR_VERSION);
 
diff --git a/Source/WebKit2/GNUmakefile.am b/Source/WebKit2/GNUmakefile.am
index 2b36ed3db..0e13715a3 100644
--- a/Source/WebKit2/GNUmakefile.am
+++ b/Source/WebKit2/GNUmakefile.am
@@ -88,8 +88,10 @@ libwebkit2gtkinclude_HEADERS = \
 	$(WebKit2)/UIProcess/API/gtk/WebKitDownload.h \
 	$(WebKit2)/UIProcess/API/gtk/WebKitEditingCommands.h \
 	$(WebKit2)/UIProcess/API/gtk/WebKitError.h \
+	$(WebKit2)/UIProcess/API/gtk/WebKitHitTestResult.h \
 	$(WebKit2)/UIProcess/API/gtk/WebKitNavigationPolicyDecision.h \
 	$(WebKit2)/UIProcess/API/gtk/WebKitPolicyDecision.h \
+	$(WebKit2)/UIProcess/API/gtk/WebKitPrintOperation.h \
 	$(WebKit2)/UIProcess/API/gtk/WebKitResponsePolicyDecision.h \
 	$(WebKit2)/UIProcess/API/gtk/WebKitSettings.h \
 	$(WebKit2)/UIProcess/API/gtk/WebKitURIRequest.h \
@@ -193,7 +195,7 @@ BUILT_SOURCES += $(webkit2_built_sources)
 nodist_libwebkit2gtk_@WEBKITGTK_API_MAJOR_VERSION@_@WEBKITGTK_API_MINOR_VERSION@_la_SOURCES = \
 	$(webkit2_built_sources)
 
-libwebkit2gtk_@WEBKITGTK_API_MAJOR_VERSION@_@WEBKITGTK_API_MINOR_VERSION@_la_SOURCES = \
+webkit2_sources += \
 	Source/WebKit2/config.h \
 	Source/WebKit2/Platform/CoreIPC/ArgumentCoder.h \
 	Source/WebKit2/Platform/CoreIPC/ArgumentCoders.cpp \
@@ -539,6 +541,9 @@ libwebkit2gtk_@WEBKITGTK_API_MAJOR_VERSION@_@WEBKITGTK_API_MINOR_VERSION@_la_SOU
 	Source/WebKit2/UIProcess/API/gtk/WebKitEditingCommands.h \
 	Source/WebKit2/UIProcess/API/gtk/WebKitError.h \
 	Source/WebKit2/UIProcess/API/gtk/WebKitError.cpp \
+	Source/WebKit2/UIProcess/API/gtk/WebKitHitTestResult.cpp \
+	Source/WebKit2/UIProcess/API/gtk/WebKitHitTestResult.h \
+	Source/WebKit2/UIProcess/API/gtk/WebKitHitTestResultPrivate.h \
 	Source/WebKit2/UIProcess/API/gtk/WebKitLoaderClient.h \
 	Source/WebKit2/UIProcess/API/gtk/WebKitLoaderClient.cpp \
 	Source/WebKit2/UIProcess/API/gtk/WebKitNavigationPolicyDecision.cpp \
@@ -549,7 +554,11 @@ libwebkit2gtk_@WEBKITGTK_API_MAJOR_VERSION@_@WEBKITGTK_API_MINOR_VERSION@_la_SOU
 	Source/WebKit2/UIProcess/API/gtk/WebKitPolicyDecisionPrivate.h \
 	Source/WebKit2/UIProcess/API/gtk/WebKitPolicyClient.cpp \
 	Source/WebKit2/UIProcess/API/gtk/WebKitPolicyClient.h \
+	Source/WebKit2/UIProcess/API/gtk/WebKitPrintOperation.cpp \
+	Source/WebKit2/UIProcess/API/gtk/WebKitPrintOperation.h \
+	Source/WebKit2/UIProcess/API/gtk/WebKitPrintOperationPrivate.h \
 	Source/WebKit2/UIProcess/API/gtk/WebKitPrivate.h \
+	Source/WebKit2/UIProcess/API/gtk/WebKitPrivate.cpp \
 	Source/WebKit2/UIProcess/API/gtk/WebKitResponsePolicyDecision.cpp \
 	Source/WebKit2/UIProcess/API/gtk/WebKitResponsePolicyDecision.h \
 	Source/WebKit2/UIProcess/API/gtk/WebKitResponsePolicyDecisionPrivate.h \
@@ -950,6 +959,9 @@ libwebkit2gtk_@WEBKITGTK_API_MAJOR_VERSION@_@WEBKITGTK_API_MINOR_VERSION@_la_SOU
 	Source/WebKit2/WebProcess/WebProcess.cpp \
 	Source/WebKit2/WebProcess/WebProcess.h
 
+libwebkit2gtk_@WEBKITGTK_API_MAJOR_VERSION@_@WEBKITGTK_API_MINOR_VERSION@_la_SOURCES = \
+	$(webkit2_sources)
+
 libwebkit2gtk_@WEBKITGTK_API_MAJOR_VERSION@_@WEBKITGTK_API_MINOR_VERSION@_la_CPPFLAGS = \
 	-fno-strict-aliasing \
 	$(global_cppflags) \
@@ -1038,9 +1050,11 @@ libwebkit2gtk_@WEBKITGTK_API_MAJOR_VERSION@_@WEBKITGTK_API_MINOR_VERSION@_la_CXX
 libwebkit2gtk_@WEBKITGTK_API_MAJOR_VERSION@_@WEBKITGTK_API_MINOR_VERSION@_la_CFLAGS = \
 	$(global_cflags)
 
+if ENABLE_WEBKIT2
 # Shared libraries
 lib_LTLIBRARIES += \
 	libwebkit2gtk-@WEBKITGTK_API_MAJOR_VERSION@.@WEBKITGTK_API_MINOR_VERSION@.la
+endif
 
 # Artificial dependency to make sure libwebkit2gtk and libwebkitgtk are not linked at the same time
 # The variable creation is to avoid having automake override the entire rule instead of adding the
@@ -1094,7 +1108,9 @@ libwebkit2gtk_@WEBKITGTK_API_MAJOR_VERSION@_@WEBKITGTK_API_MINOR_VERSION@_la_LIB
 	$(XRENDER_LIBS) \
 	$(XT_LIBS)
 
+if ENABLE_WEBKIT2
 pkgconfig_DATA += Source/WebKit2/webkit2gtk-@WEBKITGTK_API_VERSION@.pc
+endif
 
 # WebKit2 specific variables
 forwarding_headers := $(GENSOURCES_WEBKIT2)/include
@@ -1228,9 +1244,10 @@ CLEANFILES += \
 DISTCLEANFILES += \
 	$(top_builddir)/WebKit2/webkit2gtk-@WEBKITGTK_API_VERSION@.pc
 
-# WebKitWebProcess
+if ENABLE_WEBKIT2
 libexec_PROGRAMS += \
 	Programs/WebKitWebProcess
+endif
 
 Programs_WebKitWebProcess_CPPFLAGS = \
 	-I$(srcdir)/Source/WebKit2 \
@@ -1370,7 +1387,7 @@ webkit2_plugin_process_built_sources += \
 nodist_Programs_WebKitPluginProcess_SOURCES = $(webkit2_plugin_process_built_sources)
 BUILT_SOURCES += $(nodist_Programs_WebKitPluginProcess_SOURCES)
 
-Programs_WebKitPluginProcess_SOURCES = \
+webkit2_plugin_process_sources += \
 	Source/WebKit2/Platform/CoreIPC/ArgumentCoder.h \
 	Source/WebKit2/Platform/CoreIPC/ArgumentCoders.h \
 	Source/WebKit2/Platform/CoreIPC/ArgumentCoders.cpp \
@@ -1458,6 +1475,8 @@ Programs_WebKitPluginProcess_SOURCES = \
 	Source/WebKit2/WebProcess/Plugins/Netscape/NetscapePluginStream.h \
 	Source/WebKit2/WebProcess/Plugins/Netscape/x11/NetscapePluginX11.cpp \
 	Source/WebKit2/gtk/PluginMainGtk.cpp
+Programs_WebKitPluginProcess_SOURCES = \
+	$(webkit2_plugin_process_sources)
 
 Programs_WebKitPluginProcess_LDADD = \
 	-lpthread \
@@ -1495,7 +1514,7 @@ Programs_WebKitPluginProcess_CXXFLAGS = \
 	$(SYMBOL_VISIBILITY_INLINES) \
 	$(global_cxxflags)
 
-endif
+endif # ENABLE_PLUGIN_PROCESS
 
 EXTRA_DIST += \
 	$(WebKit2)/UIProcess/API/gtk/docs/webkit2gtk-docs.sgml \
diff --git a/Source/WebKit2/Platform/CoreIPC/ArgumentDecoder.cpp b/Source/WebKit2/Platform/CoreIPC/ArgumentDecoder.cpp
index 48da744de..f49076a6d 100644
--- a/Source/WebKit2/Platform/CoreIPC/ArgumentDecoder.cpp
+++ b/Source/WebKit2/Platform/CoreIPC/ArgumentDecoder.cpp
@@ -141,6 +141,16 @@ bool ArgumentDecoder::decodeBool(bool& result)
     return true;
 }
 
+bool ArgumentDecoder::decodeUInt16(uint16_t& result)
+{
+    if (!alignBufferPosition(sizeof(result), sizeof(result)))
+        return false;
+
+    result = *reinterpret_cast<uint16_t*>(m_bufferPos);
+    m_bufferPos += sizeof(result);
+    return true;
+}
+
 bool ArgumentDecoder::decodeUInt32(uint32_t& result)
 {
     if (!alignBufferPosition(sizeof(result), sizeof(result)))
diff --git a/Source/WebKit2/Platform/CoreIPC/ArgumentDecoder.h b/Source/WebKit2/Platform/CoreIPC/ArgumentDecoder.h
index 786e3d693..53f9f8c6c 100644
--- a/Source/WebKit2/Platform/CoreIPC/ArgumentDecoder.h
+++ b/Source/WebKit2/Platform/CoreIPC/ArgumentDecoder.h
@@ -53,6 +53,7 @@ public:
     bool decodeVariableLengthByteArray(DataReference&);
 
     bool decodeBool(bool&);
+    bool decodeUInt16(uint16_t&);
     bool decodeUInt32(uint32_t&);
     bool decodeUInt64(uint64_t&);
     bool decodeInt32(int32_t&);
@@ -126,6 +127,11 @@ template<> inline bool ArgumentDecoder::decode(bool& n)
     return decodeBool(n);
 }
 
+template<> inline bool ArgumentDecoder::decode(uint16_t& n)
+{
+    return decodeUInt16(n);
+}
+
 template<> inline bool ArgumentDecoder::decode(uint32_t& n)
 {
     return decodeUInt32(n);
diff --git a/Source/WebKit2/Platform/CoreIPC/ArgumentEncoder.cpp b/Source/WebKit2/Platform/CoreIPC/ArgumentEncoder.cpp
index a6c44ea41..64c2048cf 100644
--- a/Source/WebKit2/Platform/CoreIPC/ArgumentEncoder.cpp
+++ b/Source/WebKit2/Platform/CoreIPC/ArgumentEncoder.cpp
@@ -115,6 +115,13 @@ void ArgumentEncoder::encodeBool(bool n)
     *reinterpret_cast<bool*>(buffer) = n;
 }
 
+void ArgumentEncoder::encodeUInt16(uint16_t n)
+{
+    uint8_t* buffer = grow(sizeof(n), sizeof(n));
+
+    *reinterpret_cast<uint16_t*>(buffer) = n;
+}
+
 void ArgumentEncoder::encodeUInt32(uint32_t n)
 {
     uint8_t* buffer = grow(sizeof(n), sizeof(n));
diff --git a/Source/WebKit2/Platform/CoreIPC/ArgumentEncoder.h b/Source/WebKit2/Platform/CoreIPC/ArgumentEncoder.h
index beb5703db..b734d7531 100644
--- a/Source/WebKit2/Platform/CoreIPC/ArgumentEncoder.h
+++ b/Source/WebKit2/Platform/CoreIPC/ArgumentEncoder.h
@@ -46,6 +46,7 @@ public:
     void encodeVariableLengthByteArray(const DataReference&);
 
     void encodeBool(bool);
+    void encodeUInt16(uint16_t);
     void encodeUInt32(uint32_t);
     void encodeUInt64(uint64_t);
     void encodeInt32(int32_t);
@@ -94,6 +95,11 @@ template<> inline void ArgumentEncoder::encode(const bool& n)
     encodeBool(n);
 }
 
+template<> inline void ArgumentEncoder::encode(const uint16_t& n)
+{
+    encodeUInt16(n);
+}
+
 template<> inline void ArgumentEncoder::encode(const uint32_t& n)
 {
     encodeUInt32(n);
diff --git a/Source/WebKit2/Platform/CoreIPC/HandleMessage.h b/Source/WebKit2/Platform/CoreIPC/HandleMessage.h
index 5634a6b1e..9a08be46e 100644
--- a/Source/WebKit2/Platform/CoreIPC/HandleMessage.h
+++ b/Source/WebKit2/Platform/CoreIPC/HandleMessage.h
@@ -209,6 +209,12 @@ void callMemberFunction(Connection* connection, const Arguments2<P1, P2>& args,
     (object->*function)(connection, args.argument1, args.argument2);
 }
 
+template<typename C, typename MF, typename P1, typename P2, typename P3, typename P4>
+void callMemberFunction(Connection* connection, const Arguments4<P1, P2, P3, P4>& args, C* object, MF function)
+{
+    (object->*function)(connection, args.argument1, args.argument2, args.argument3, args.argument4);
+}
+
 // Variadic dispatch functions.
 
 template<typename C, typename MF>
diff --git a/Source/WebKit2/Platform/WorkQueue.h b/Source/WebKit2/Platform/WorkQueue.h
index 587ef892d..7b4aff71c 100644
--- a/Source/WebKit2/Platform/WorkQueue.h
+++ b/Source/WebKit2/Platform/WorkQueue.h
@@ -166,7 +166,7 @@ private:
     QThread* m_workThread;
     friend class WorkItemQt;
 #elif PLATFORM(GTK)
-    static void* startWorkQueueThread(WorkQueue*);
+    static void startWorkQueueThread(WorkQueue*);
     void workQueueThreadBody();
     void dispatchOnSource(GSource*, const Function<void()>&, GSourceFunc);
 
diff --git a/Source/WebKit2/Platform/gtk/WorkQueueGtk.cpp b/Source/WebKit2/Platform/gtk/WorkQueueGtk.cpp
index 112ba28b5..f0c11f977 100644
--- a/Source/WebKit2/Platform/gtk/WorkQueueGtk.cpp
+++ b/Source/WebKit2/Platform/gtk/WorkQueueGtk.cpp
@@ -142,10 +142,9 @@ void WorkQueue::platformInvalidate()
     }
 }
 
-void* WorkQueue::startWorkQueueThread(WorkQueue* workQueue)
+void WorkQueue::startWorkQueueThread(WorkQueue* workQueue)
 {
     workQueue->workQueueThreadBody();
-    return 0;
 }
 
 void WorkQueue::workQueueThreadBody()
diff --git a/Source/WebKit2/PlatformEfl.cmake b/Source/WebKit2/PlatformEfl.cmake
index ef5f3953d..d8a797a6c 100644
--- a/Source/WebKit2/PlatformEfl.cmake
+++ b/Source/WebKit2/PlatformEfl.cmake
@@ -1,5 +1,3 @@
-INCLUDE(WebKitEfl)
-
 LIST(APPEND WebKit2_LINK_FLAGS
     ${ECORE_X_LDFLAGS}
     ${EDJE_LDFLAGS}
@@ -44,6 +42,8 @@ LIST(APPEND WebKit2_SOURCES
     UIProcess/Plugins/efl/PluginInfoStoreEfl.cpp
     UIProcess/Plugins/efl/PluginProcessProxyEfl.cpp
 
+    WebProcess/Cookies/soup/WebCookieManagerSoup.cpp
+
     WebProcess/Downloads/efl/DownloadEfl.cpp
     WebProcess/Downloads/efl/FileDownloaderEfl.cpp
 
@@ -62,8 +62,10 @@ LIST(APPEND WebKit2_SOURCES
 )
 
 LIST(APPEND WebKit2_INCLUDE_DIRECTORIES
+    "${JAVASCRIPTCORE_DIR}/wtf/gobject"
     "${WEBCORE_DIR}/platform/efl"
     "${WEBCORE_DIR}/platform/graphics/cairo"
+    "${WEBCORE_DIR}/platform/network/soup"
     "${WEBKIT2_DIR}/Shared/efl"
     "${WEBKIT2_DIR}/UIProcess/API/efl/"
     "${WEBKIT2_DIR}/WebProcess/Downloads/efl"
@@ -77,6 +79,8 @@ LIST(APPEND WebKit2_INCLUDE_DIRECTORIES
     ${LIBXML2_INCLUDE_DIR}
     ${LIBXSLT_INCLUDE_DIRS}
     ${SQLITE_INCLUDE_DIRS}
+    ${Glib_INCLUDE_DIRS}
+    ${LIBSOUP24_INCLUDE_DIRS}
 )
 
 LIST(APPEND WebKit2_LIBRARIES
@@ -90,6 +94,8 @@ LIST(APPEND WebKit2_LIBRARIES
     ${PNG_LIBRARY}
     ${JPEG_LIBRARY}
     ${CMAKE_DL_LIBS}
+    ${Glib_LIBRARIES}
+    ${LIBSOUP24_LIBRARIES}
 )
 
 LIST (APPEND WebProcess_SOURCES
@@ -112,39 +118,7 @@ ADD_CUSTOM_TARGET(forwarding-headerEfl
 )
 SET(ForwardingHeaders_NAME forwarding-headerEfl)
 
-IF (WTF_USE_SOUP)
-    LIST(APPEND WebKit2_INCLUDE_DIRECTORIES
-        "${WEBCORE_DIR}/platform/network/soup"
-        ${LIBSOUP24_INCLUDE_DIRS}
-    )
-    LIST(APPEND WebKit2_LIBRARIES ${LIBSOUP24_LIBRARIES})
-    LIST(APPEND WebKit2_SOURCES
-        WebProcess/Cookies/soup/WebCookieManagerSoup.cpp
-    )
-
-    ADD_CUSTOM_TARGET(forwarding-headerSoup
-        COMMAND ${PERL_EXECUTABLE} ${WEBKIT2_DIR}/Scripts/generate-forwarding-headers.pl ${WEBKIT2_DIR} ${DERIVED_SOURCES_WEBKIT2_DIR}/include soup
-    )
-    SET(ForwardingNetworkHeaders_NAME forwarding-headerSoup)
-ENDIF ()
-
-IF (WTF_USE_CURL)
-    LIST(APPEND WebKit2_INCLUDE_DIRECTORIES
-        "${WEBCORE_DIR}/platform/network/curl"
-        ${CURL_INCLUDE_DIRS}
-    )
-    LIST(APPEND WebKit2_LIBRARIES ${CURL_LIBRARIES})
-    LIST(APPEND WebKit2_SOURCES
-        WebProcess/Cookies/curl/WebCookieManagerCurl.cpp
-    )
-ENDIF ()
-
-IF (ENABLE_GLIB_SUPPORT)
-    LIST(APPEND WebKit2_INCLUDE_DIRECTORIES
-        ${Glib_INCLUDE_DIRS}
-        ${JAVASCRIPTCORE_DIR}/wtf/gobject
-    )
-    LIST(APPEND WebKit2_LIBRARIES
-        ${Glib_LIBRARIES}
-    )
-ENDIF ()
+ADD_CUSTOM_TARGET(forwarding-headerSoup
+    COMMAND ${PERL_EXECUTABLE} ${WEBKIT2_DIR}/Scripts/generate-forwarding-headers.pl ${WEBKIT2_DIR} ${DERIVED_SOURCES_WEBKIT2_DIR}/include soup
+)
+SET(ForwardingNetworkHeaders_NAME forwarding-headerSoup)
diff --git a/Source/WebKit2/Shared/Plugins/Netscape/x11/NetscapePluginModuleX11.cpp b/Source/WebKit2/Shared/Plugins/Netscape/x11/NetscapePluginModuleX11.cpp
index be04bff26..866833c64 100644
--- a/Source/WebKit2/Shared/Plugins/Netscape/x11/NetscapePluginModuleX11.cpp
+++ b/Source/WebKit2/Shared/Plugins/Netscape/x11/NetscapePluginModuleX11.cpp
@@ -137,14 +137,14 @@ bool NetscapePluginModule::getPluginInfoForLoadedPlugin(PluginModuleInfo& plugin
     char* buffer;
     NPError error = NPP_GetValue(0, NPPVpluginNameString, &buffer);
     if (error == NPERR_NO_ERROR)
-        plugin.info.name = buffer;
+        plugin.info.name = String::fromUTF8(buffer);
 
     error = NPP_GetValue(0, NPPVpluginDescriptionString, &buffer);
     if (error == NPERR_NO_ERROR)
-        plugin.info.desc = buffer;
+        plugin.info.desc = String::fromUTF8(buffer);
 
-    const char* mimeDescription = NP_GetMIMEDescription();
-    if (!mimeDescription)
+    String mimeDescription = String::fromUTF8(NP_GetMIMEDescription());
+    if (mimeDescription.isNull())
         return false;
 
     setMIMEDescription(mimeDescription, plugin);
diff --git a/Source/WebKit2/Shared/ShareableBitmap.h b/Source/WebKit2/Shared/ShareableBitmap.h
index c78a14e09..e5d1a6dc9 100644
--- a/Source/WebKit2/Shared/ShareableBitmap.h
+++ b/Source/WebKit2/Shared/ShareableBitmap.h
@@ -135,7 +135,7 @@ public:
     // This creates a QImage that directly references the shared bitmap data.
     // This is only safe to use when we know that the contents of the shareable bitmap won't change.
     QImage createQImage();
-    void swizzleRGB();
+    static void releaseSharedMemoryData(void* typelessBitmap);
 #endif
 
 private:
diff --git a/Source/WebKit2/Shared/WebPreferencesStore.h b/Source/WebKit2/Shared/WebPreferencesStore.h
index 0cdc97594..cb7030940 100644
--- a/Source/WebKit2/Shared/WebPreferencesStore.h
+++ b/Source/WebKit2/Shared/WebPreferencesStore.h
@@ -73,6 +73,7 @@ namespace WebKit {
     macro(CompositingRepaintCountersVisible, compositingRepaintCountersVisible, Bool, bool, false) \
     macro(CSSCustomFilterEnabled, cssCustomFilterEnabled, Bool, bool, true) \
     macro(WebGLEnabled, webGLEnabled, Bool, bool, false) \
+    macro(CSSRegionsEnabled, cssRegionsEnabled, Bool, bool, true) \
     macro(ForceFTPDirectoryListings, forceFTPDirectoryListings, Bool, bool, false) \
     macro(TabsToLinks, tabsToLinks, Bool, bool, DEFAULT_WEBKIT_TABSTOLINKS_ENABLED) \
     macro(DNSPrefetchingEnabled, dnsPrefetchingEnabled, Bool, bool, false) \
@@ -90,7 +91,7 @@ namespace WebKit {
     macro(AllowUniversalAccessFromFileURLs, allowUniversalAccessFromFileURLs, Bool, bool, false) \
     macro(AllowFileAccessFromFileURLs, allowFileAccessFromFileURLs, Bool, bool, false) \
     macro(AVFoundationEnabled, isAVFoundationEnabled, Bool, bool, DEFAULT_WEBKIT_AVFOUNDATION_ENABLED) \
-    macro(Hixie76WebSocketProtocolEnabled, hixie76WebSocketProtocolEnabled, Bool, bool, true) \
+    macro(Hixie76WebSocketProtocolEnabled, hixie76WebSocketProtocolEnabled, Bool, bool, false) \
     macro(MediaPlaybackRequiresUserGesture, mediaPlaybackRequiresUserGesture, Bool, bool, false) \
     macro(MediaPlaybackAllowsInline, mediaPlaybackAllowsInline, Bool, bool, true) \
     macro(InspectorStartsAttached, inspectorStartsAttached, Bool, bool, true) \
@@ -98,7 +99,7 @@ namespace WebKit {
     macro(MockScrollbarsEnabled, mockScrollbarsEnabled, Bool, bool, false) \
     macro(WebAudioEnabled, webAudioEnabled, Bool, bool, false) \
     macro(ApplicationChromeModeEnabled, applicationChromeMode, Bool, bool, false) \
-    macro(SuppressIncrementalRendering, suppressIncrementalRendering, Bool, bool, false) \
+    macro(SuppressesIncrementalRendering, suppressesIncrementalRendering, Bool, bool, false) \
     macro(BackspaceKeyNavigationEnabled, backspaceKeyNavigationEnabled, Bool, bool, true) \
     macro(CaretBrowsingEnabled, caretBrowsingEnabled, Bool, bool, false) \
     macro(ShouldDisplaySubtitles, shouldDisplaySubtitles, Bool, bool, false) \
diff --git a/Source/WebKit2/Shared/gtk/WebCoreArgumentCodersGtk.cpp b/Source/WebKit2/Shared/gtk/WebCoreArgumentCodersGtk.cpp
index aae59e340..9d6e25c66 100644
--- a/Source/WebKit2/Shared/gtk/WebCoreArgumentCodersGtk.cpp
+++ b/Source/WebKit2/Shared/gtk/WebCoreArgumentCodersGtk.cpp
@@ -99,6 +99,11 @@ bool ArgumentCoder<ResourceRequest>::decode(ArgumentDecoder* decoder, ResourceRe
 
 void ArgumentCoder<ResourceResponse>::encode(ArgumentEncoder* encoder, const ResourceResponse& resourceResponse)
 {
+    bool responseIsNull = resourceResponse.isNull();
+    encoder->encode(responseIsNull);
+    if (responseIsNull)
+        return;
+
     encoder->encode(resourceResponse.url().string());
     encoder->encode(static_cast<int32_t>(resourceResponse.httpStatusCode()));
 
@@ -115,6 +120,14 @@ void ArgumentCoder<ResourceResponse>::encode(ArgumentEncoder* encoder, const Res
 
 bool ArgumentCoder<ResourceResponse>::decode(ArgumentDecoder* decoder, ResourceResponse& resourceResponse)
 {
+    bool responseIsNull;
+    if (!decoder->decode(responseIsNull))
+        return false;
+    if (responseIsNull) {
+        resourceResponse = ResourceResponse();
+        return true;
+    }
+
     ResourceResponse response;
 
     String url;
@@ -170,6 +183,11 @@ bool ArgumentCoder<ResourceResponse>::decode(ArgumentDecoder* decoder, ResourceR
 
 void ArgumentCoder<ResourceError>::encode(ArgumentEncoder* encoder, const ResourceError& resourceError)
 {
+    bool errorIsNull = resourceError.isNull();
+    encoder->encode(errorIsNull);
+    if (errorIsNull)
+        return;
+
     encoder->encode(resourceError.domain());
     encoder->encode(resourceError.errorCode());
     encoder->encode(resourceError.failingURL()); 
@@ -178,6 +196,14 @@ void ArgumentCoder<ResourceError>::encode(ArgumentEncoder* encoder, const Resour
 
 bool ArgumentCoder<ResourceError>::decode(ArgumentDecoder* decoder, ResourceError& resourceError)
 {
+    bool errorIsNull;
+    if (!decoder->decode(errorIsNull))
+        return false;
+    if (errorIsNull) {
+        resourceError = ResourceError();
+        return true;
+    }
+
     String domain;
     if (!decoder->decode(domain))
         return false;
diff --git a/Source/WebKit2/Shared/qt/ShareableBitmapQt.cpp b/Source/WebKit2/Shared/qt/ShareableBitmapQt.cpp
index d5e371def..0c8be072a 100644
--- a/Source/WebKit2/Shared/qt/ShareableBitmapQt.cpp
+++ b/Source/WebKit2/Shared/qt/ShareableBitmapQt.cpp
@@ -38,8 +38,15 @@ namespace WebKit {
 
 QImage ShareableBitmap::createQImage()
 {
+    ref(); // Balanced by deref in releaseSharedMemoryData
     return QImage(reinterpret_cast<uchar*>(data()), m_size.width(), m_size.height(), m_size.width() * 4,
-                  m_flags & SupportsAlpha ? QImage::Format_ARGB32_Premultiplied : QImage::Format_RGB32);
+                  m_flags & SupportsAlpha ? QImage::Format_ARGB32_Premultiplied : QImage::Format_RGB32,
+                  releaseSharedMemoryData, this);
+}
+
+void ShareableBitmap::releaseSharedMemoryData(void* typelessBitmap)
+{
+    static_cast<ShareableBitmap*>(typelessBitmap)->deref(); // Balanced by ref in createQImage.
 }
 
 PassRefPtr<Image> ShareableBitmap::createImage()
@@ -70,17 +77,5 @@ void ShareableBitmap::paint(GraphicsContext& /*context*/, float /*scaleFactor*/,
     notImplemented();
 }
 
-void ShareableBitmap::swizzleRGB()
-{
-    uint32_t* data = reinterpret_cast<uint32_t*>(this->data());
-    int width = size().width();
-    int height = size().height();
-    for (int y = 0; y < height; ++y) {
-        uint32_t* p = data + y * width;
-        for (int x = 0; x < width; ++x)
-            p[x] = ((p[x] << 16) & 0xff0000) | ((p[x] >> 16) & 0xff) | (p[x] & 0xff00ff00);
-    }
-}
-
 }
 // namespace WebKit
diff --git a/Source/WebKit2/Shared/qt/WebEventFactoryQt.cpp b/Source/WebKit2/Shared/qt/WebEventFactoryQt.cpp
index b6ac2f5e1..4eaff2c7e 100644
--- a/Source/WebKit2/Shared/qt/WebEventFactoryQt.cpp
+++ b/Source/WebKit2/Shared/qt/WebEventFactoryQt.cpp
@@ -86,6 +86,8 @@ static WebEvent::Type webEventTypeForEvent(const QEvent* event)
         return WebEvent::TouchMove;
     case QEvent::TouchEnd:
         return WebEvent::TouchEnd;
+    case QEvent::TouchCancel:
+        return WebEvent::TouchCancel;
 #endif
     default:
         // assert
@@ -207,6 +209,11 @@ WebTouchEvent WebEventFactory::createWebTouchEvent(const QTouchEvent* event, con
             break;
         }
 
+        // Qt does not have a Qt::TouchPointCancelled point state, so if we receive a touch cancel event,
+        // simply cancel all touch points here.
+        if (type == WebEvent::TouchCancel)
+            state = WebPlatformTouchPoint::TouchCancelled;
+
         m_touchPoints.append(WebPlatformTouchPoint(id, state, touchPoint.screenPos().toPoint(), fromItemTransform.map(touchPoint.pos()).toPoint()));
     }
 
diff --git a/Source/WebKit2/Target.pri b/Source/WebKit2/Target.pri
index 4326a4a99..2efe7f34c 100644
--- a/Source/WebKit2/Target.pri
+++ b/Source/WebKit2/Target.pri
@@ -12,7 +12,7 @@ load(features)
 include(WebKit2.pri)
 
 WEBKIT += wtf javascriptcore webcore
-QT += declarative quick widgets
+QT += declarative quick quick-private
 
 CONFIG += staticlib
 
@@ -173,6 +173,7 @@ HEADERS += \
     UIProcess/API/qt/qwebdownloaditem_p.h \
     UIProcess/API/qt/qwebdownloaditem_p_p.h \
     UIProcess/API/qt/qwebpermissionrequest_p.h \
+    UIProcess/API/qt/qtwebsecurityorigin_p.h \
     UIProcess/API/qt/qwebnavigationrequest_p.h \
     UIProcess/API/qt/qquickwebpage_p.h \
     UIProcess/API/qt/qquickwebpage_p_p.h \
@@ -253,6 +254,7 @@ HEADERS += \
     UIProcess/WebResourceCacheManagerProxy.h \
     UIProcess/WebResourceLoadClient.h \
     UIProcess/WebUIClient.h \
+    UIProcess/qt/LayerBackingStore.h \
     UIProcess/qt/QtWebContext.h \
     UIProcess/qt/QtWebPageEventHandler.h \
     UIProcess/qt/QtGestureRecognizer.h \
@@ -266,6 +268,7 @@ HEADERS += \
     UIProcess/qt/QtWebPageLoadClient.h \
     UIProcess/qt/QtWebPagePolicyClient.h \
     UIProcess/qt/QtWebPageUIClient.h \
+    UIProcess/qt/QtFlickProvider.h \
     UIProcess/qt/QtViewportInteractionEngine.h \
     UIProcess/qt/QtWebUndoController.h \
     UIProcess/qt/QtWebIconDatabaseClient.h \
@@ -499,6 +502,7 @@ SOURCES += \
     UIProcess/API/cpp/qt/WKURLQt.cpp \
     UIProcess/API/qt/qwebdownloaditem.cpp \
     UIProcess/API/qt/qwebpermissionrequest.cpp \
+    UIProcess/API/qt/qtwebsecurityorigin.cpp \
     UIProcess/API/qt/qwebnavigationrequest.cpp \
     UIProcess/API/qt/qquickwebpage.cpp \
     UIProcess/API/qt/qwebnavigationhistory.cpp \
@@ -580,6 +584,7 @@ SOURCES += \
     UIProcess/WebResourceLoadClient.cpp \
     UIProcess/WebUIClient.cpp \
     UIProcess/qt/QtWebContext.cpp \
+    UIProcess/qt/LayerBackingStore.cpp \
     UIProcess/qt/LayerTreeHostProxyQt.cpp \
     UIProcess/qt/QtWebPageEventHandler.cpp \
     UIProcess/qt/QtGestureRecognizer.cpp \
@@ -594,6 +599,7 @@ SOURCES += \
     UIProcess/qt/QtWebPagePolicyClient.cpp \
     UIProcess/qt/QtWebPageUIClient.cpp \
     UIProcess/qt/TextCheckerQt.cpp \
+    UIProcess/qt/QtFlickProvider.cpp \
     UIProcess/qt/QtViewportInteractionEngine.cpp \
     UIProcess/qt/WebContextMenuProxyQt.cpp \
     UIProcess/qt/WebContextQt.cpp \
diff --git a/Source/WebKit2/UIProcess/API/C/WKInspector.cpp b/Source/WebKit2/UIProcess/API/C/WKInspector.cpp
index 325db5ae9..1a4ecc7c9 100644
--- a/Source/WebKit2/UIProcess/API/C/WKInspector.cpp
+++ b/Source/WebKit2/UIProcess/API/C/WKInspector.cpp
@@ -63,6 +63,16 @@ void WKInspectorShowConsole(WKInspectorRef inspectorRef)
     toImpl(inspectorRef)->showConsole();
 }
 
+void WKInspectorShowResources(WKInspectorRef inspectorRef)
+{
+    toImpl(inspectorRef)->showResources();
+}
+
+void WKInspectorShowMainResourceForFrame(WKInspectorRef inspectorRef, WKFrameRef frameRef)
+{
+    toImpl(inspectorRef)->showMainResourceForFrame(toImpl(frameRef));
+}
+
 bool WKInspectorIsAttached(WKInspectorRef inspectorRef)
 {
     return toImpl(inspectorRef)->isAttached();
diff --git a/Source/WebKit2/UIProcess/API/C/WKInspector.h b/Source/WebKit2/UIProcess/API/C/WKInspector.h
index c147015f0..2e85688d0 100644
--- a/Source/WebKit2/UIProcess/API/C/WKInspector.h
+++ b/Source/WebKit2/UIProcess/API/C/WKInspector.h
@@ -47,6 +47,8 @@ WK_EXPORT void WKInspectorShow(WKInspectorRef inspector);
 WK_EXPORT void WKInspectorClose(WKInspectorRef inspector);
 
 WK_EXPORT void WKInspectorShowConsole(WKInspectorRef inspector);
+WK_EXPORT void WKInspectorShowResources(WKInspectorRef inspector);
+WK_EXPORT void WKInspectorShowMainResourceForFrame(WKInspectorRef inspector, WKFrameRef frame);
 
 WK_EXPORT bool WKInspectorIsAttached(WKInspectorRef inspector);
 WK_EXPORT void WKInspectorAttach(WKInspectorRef inspector);
diff --git a/Source/WebKit2/UIProcess/API/C/WKPage.h b/Source/WebKit2/UIProcess/API/C/WKPage.h
index ea8049dd5..96d097c60 100644
--- a/Source/WebKit2/UIProcess/API/C/WKPage.h
+++ b/Source/WebKit2/UIProcess/API/C/WKPage.h
@@ -71,6 +71,7 @@ typedef void (*WKPageDidChangeBackForwardListCallback)(WKPageRef page, WKBackFor
 typedef bool (*WKPageShouldGoToBackForwardListItemCallback)(WKPageRef page, WKBackForwardListItemRef item, const void *clientInfo);
 typedef void (*WKPageDidFailToInitializePluginCallback)(WKPageRef page, WKStringRef mimeType, const void* clientInfo);
 typedef void (*WKPageDidNewFirstVisuallyNonEmptyLayoutCallback)(WKPageRef page, WKTypeRef userData, const void *clientInfo);
+typedef void (*WKPageWillGoToBackForwardListItemCallback)(WKPageRef page, WKBackForwardListItemRef item, const void *clientInfo);
 
 struct WKPageLoaderClient {
     int                                                                 version;
@@ -110,6 +111,8 @@ struct WKPageLoaderClient {
 
     // FIXME: didFirstVisuallyNonEmptyLayoutForFrame and didNewFirstVisuallyNonEmptyLayout should be merged.
     WKPageDidNewFirstVisuallyNonEmptyLayoutCallback                     didNewFirstVisuallyNonEmptyLayout;
+
+    WKPageWillGoToBackForwardListItemCallback                           willGoToBackForwardListItem;
 };
 typedef struct WKPageLoaderClient WKPageLoaderClient;
 
diff --git a/Source/WebKit2/UIProcess/API/C/WKPreferences.cpp b/Source/WebKit2/UIProcess/API/C/WKPreferences.cpp
index 521e6d4a0..87d32ed2f 100644
--- a/Source/WebKit2/UIProcess/API/C/WKPreferences.cpp
+++ b/Source/WebKit2/UIProcess/API/C/WKPreferences.cpp
@@ -408,6 +408,16 @@ bool WKPreferencesGetWebGLEnabled(WKPreferencesRef preferencesRef)
     return toImpl(preferencesRef)->webGLEnabled();
 }
 
+void WKPreferencesSetCSSRegionsEnabled(WKPreferencesRef preferencesRef, bool flag)
+{
+    toImpl(preferencesRef)->setCSSRegionsEnabled(flag);
+}
+
+bool WKPreferencesGetCSSRegionsEnabled(WKPreferencesRef preferencesRef)
+{
+    return toImpl(preferencesRef)->cssRegionsEnabled();
+}
+
 void WKPreferencesSetNeedsSiteSpecificQuirks(WKPreferencesRef preferencesRef, bool flag)
 {
     toImpl(preferencesRef)->setNeedsSiteSpecificQuirks(flag);
@@ -668,14 +678,14 @@ bool WKPreferencesGetApplicationChromeModeEnabled(WKPreferencesRef preferencesRe
     return toImpl(preferencesRef)->applicationChromeMode();
 }
 
-void WKPreferencesSetSuppressIncrementalRendering(WKPreferencesRef preferencesRef, bool enabled)
+void WKPreferencesSetSuppressesIncrementalRendering(WKPreferencesRef preferencesRef, bool enabled)
 {
-    toImpl(preferencesRef)->setSuppressIncrementalRendering(enabled);
+    toImpl(preferencesRef)->setSuppressesIncrementalRendering(enabled);
 }
 
-bool WKPreferencesGetSuppressIncrementalRendering(WKPreferencesRef preferencesRef)
+bool WKPreferencesGetSuppressesIncrementalRendering(WKPreferencesRef preferencesRef)
 {
-    return toImpl(preferencesRef)->suppressIncrementalRendering();
+    return toImpl(preferencesRef)->suppressesIncrementalRendering();
 }
 
 void WKPreferencesSetBackspaceKeyNavigationEnabled(WKPreferencesRef preferencesRef, bool enabled)
diff --git a/Source/WebKit2/UIProcess/API/C/WKPreferences.h b/Source/WebKit2/UIProcess/API/C/WKPreferences.h
index f13559acb..8054e00f3 100644
--- a/Source/WebKit2/UIProcess/API/C/WKPreferences.h
+++ b/Source/WebKit2/UIProcess/API/C/WKPreferences.h
@@ -170,8 +170,8 @@ WK_EXPORT void WKPreferencesSetWebAudioEnabled(WKPreferencesRef preferencesRef,
 WK_EXPORT bool WKPreferencesGetWebAudioEnabled(WKPreferencesRef preferencesRef);
     
 // Defaults to false
-WK_EXPORT void WKPreferencesSetSuppressIncrementalRendering(WKPreferencesRef preferencesRef, bool enabled);
-WK_EXPORT bool WKPreferencesGetSuppressIncrementalRendering(WKPreferencesRef preferencesRef);
+WK_EXPORT void WKPreferencesSetSuppressesIncrementalRendering(WKPreferencesRef preferencesRef, bool enabled);
+WK_EXPORT bool WKPreferencesGetSuppressesIncrementalRendering(WKPreferencesRef preferencesRef);
 
 // Defaults to true
 WK_EXPORT void WKPreferencesSetBackspaceKeyNavigationEnabled(WKPreferencesRef preferencesRef, bool enabled);
diff --git a/Source/WebKit2/UIProcess/API/C/WKPreferencesPrivate.h b/Source/WebKit2/UIProcess/API/C/WKPreferencesPrivate.h
index 9153ccab8..36950e891 100644
--- a/Source/WebKit2/UIProcess/API/C/WKPreferencesPrivate.h
+++ b/Source/WebKit2/UIProcess/API/C/WKPreferencesPrivate.h
@@ -91,6 +91,10 @@ WK_EXPORT bool WKPreferencesGetCSSCustomFilterEnabled(WKPreferencesRef);
 WK_EXPORT void WKPreferencesSetWebGLEnabled(WKPreferencesRef, bool);
 WK_EXPORT bool WKPreferencesGetWebGLEnabled(WKPreferencesRef);
 
+// Defaults to true
+WK_EXPORT void WKPreferencesSetCSSRegionsEnabled(WKPreferencesRef, bool flag);
+WK_EXPORT bool WKPreferencesGetCSSRegionsEnabled(WKPreferencesRef);
+
 // Defaults to false.
 WK_EXPORT void WKPreferencesSetNeedsSiteSpecificQuirks(WKPreferencesRef, bool);
 WK_EXPORT bool WKPreferencesGetNeedsSiteSpecificQuirks(WKPreferencesRef);
diff --git a/Source/WebKit2/UIProcess/API/gtk/WebKitDefines.h b/Source/WebKit2/UIProcess/API/gtk/WebKitDefines.h
index 79b338360..8c3eec2a4 100644
--- a/Source/WebKit2/UIProcess/API/gtk/WebKitDefines.h
+++ b/Source/WebKit2/UIProcess/API/gtk/WebKitDefines.h
@@ -32,6 +32,8 @@
 
 #include <glib.h>
 
+typedef struct _WebKitPrintOperation WebKitPrintOperation;
+
 #ifdef G_OS_WIN32
 #    ifdef BUILDING_WEBKIT
 #        define WEBKIT_API __declspec(dllexport)
diff --git a/Source/WebKit2/UIProcess/API/gtk/WebKitHitTestResult.cpp b/Source/WebKit2/UIProcess/API/gtk/WebKitHitTestResult.cpp
new file mode 100644
index 000000000..928b4dc42
--- /dev/null
+++ b/Source/WebKit2/UIProcess/API/gtk/WebKitHitTestResult.cpp
@@ -0,0 +1,430 @@
+/*
+ * Copyright (C) 2012 Igalia S.L.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ */
+
+#include "config.h"
+#include "WebKitHitTestResult.h"
+
+#include "WebHitTestResult.h"
+#include "WebKitHitTestResultPrivate.h"
+#include <glib/gi18n-lib.h>
+#include <wtf/text/CString.h>
+
+/**
+ * SECTION: WebKitHitTestResult
+ * @Short_description: Result of a Hit Test
+ * @Title: WebKitHitTestResult
+ * @See_also: #WebKitWebView
+ *
+ * A Hit Test is an operation to get context information about a given
+ * point in a #WebKitWebView. #WebKitHitTestResult represents the
+ * result of a Hit Test. It provides context information about what is
+ * at the coordinates of the Hit Test, such as if there's a link,
+ * an image or a media.
+ *
+ * You can get the context of the HitTestResult with
+ * webkit_hit_test_result_get_context() that returns a bitmask of
+ * #WebKitHitTestResultContext flags. You can also use
+ * webkit_hit_test_result_context_is_link(), webkit_hit_test_result_context_is_image() and
+ * webkit_hit_test_result_context_is_media() to determine whether there's
+ * a link, image or a media element at the coordinates of the Hit Test.
+ * Note that it's possible that several #WebKitHitTestResultContext flags
+ * are active at the same time, for example if there's a link containing an image.
+ *
+ * When the mouse is moved over a #WebKitWebView a Hit Test is performed
+ * for the mouse coordinates and #WebKitWebView::mouse-target-changed
+ * signal is emitted with a #WebKitHitTestResult.
+ *
+ */
+
+using namespace WebKit;
+
+enum {
+    PROP_0,
+
+    PROP_CONTEXT,
+    PROP_LINK_URI,
+    PROP_LINK_TITLE,
+    PROP_LINK_LABEL,
+    PROP_IMAGE_URI,
+    PROP_MEDIA_URI
+};
+
+struct _WebKitHitTestResultPrivate {
+    unsigned int context;
+    CString linkURI;
+    CString linkTitle;
+    CString linkLabel;
+    CString imageURI;
+    CString mediaURI;
+};
+
+G_DEFINE_TYPE(WebKitHitTestResult, webkit_hit_test_result, G_TYPE_OBJECT)
+
+static void webkitHitTestResultFinalize(GObject* object)
+{
+    WEBKIT_HIT_TEST_RESULT(object)->priv->~WebKitHitTestResultPrivate();
+    G_OBJECT_CLASS(webkit_hit_test_result_parent_class)->finalize(object);
+}
+
+static void webkitHitTestResultGetProperty(GObject* object, guint propId, GValue* value, GParamSpec* paramSpec)
+{
+    WebKitHitTestResult* hitTestResult = WEBKIT_HIT_TEST_RESULT(object);
+
+    switch (propId) {
+    case PROP_CONTEXT:
+        g_value_set_uint(value, webkit_hit_test_result_get_context(hitTestResult));
+        break;
+    case PROP_LINK_URI:
+        g_value_set_string(value, webkit_hit_test_result_get_link_uri(hitTestResult));
+        break;
+    case PROP_LINK_TITLE:
+        g_value_set_string(value, webkit_hit_test_result_get_link_title(hitTestResult));
+        break;
+    case PROP_LINK_LABEL:
+        g_value_set_string(value, webkit_hit_test_result_get_link_label(hitTestResult));
+        break;
+    case PROP_IMAGE_URI:
+        g_value_set_string(value, webkit_hit_test_result_get_image_uri(hitTestResult));
+        break;
+    case PROP_MEDIA_URI:
+        g_value_set_string(value, webkit_hit_test_result_get_media_uri(hitTestResult));
+        break;
+    default:
+        G_OBJECT_WARN_INVALID_PROPERTY_ID(object, propId, paramSpec);
+    }
+}
+
+static void webkitHitTestResultSetProperty(GObject* object, guint propId, const GValue* value, GParamSpec* paramSpec)
+{
+    WebKitHitTestResult* hitTestResult = WEBKIT_HIT_TEST_RESULT(object);
+
+    switch (propId) {
+    case PROP_CONTEXT:
+        hitTestResult->priv->context = g_value_get_uint(value);
+        break;
+    case PROP_LINK_URI:
+        hitTestResult->priv->linkURI = g_value_get_string(value);
+        break;
+    case PROP_LINK_TITLE:
+        hitTestResult->priv->linkTitle = g_value_get_string(value);
+        break;
+    case PROP_LINK_LABEL:
+        hitTestResult->priv->linkLabel = g_value_get_string(value);
+        break;
+    case PROP_IMAGE_URI:
+        hitTestResult->priv->imageURI = g_value_get_string(value);
+        break;
+    case PROP_MEDIA_URI:
+        hitTestResult->priv->mediaURI = g_value_get_string(value);
+        break;
+    default:
+        G_OBJECT_WARN_INVALID_PROPERTY_ID(object, propId, paramSpec);
+    }
+}
+
+static void webkit_hit_test_result_init(WebKitHitTestResult* hitTestResult)
+{
+    WebKitHitTestResultPrivate* priv = G_TYPE_INSTANCE_GET_PRIVATE(hitTestResult, WEBKIT_TYPE_HIT_TEST_RESULT, WebKitHitTestResultPrivate);
+    hitTestResult->priv = priv;
+    new (priv) WebKitHitTestResultPrivate();
+}
+
+static void webkit_hit_test_result_class_init(WebKitHitTestResultClass* hitTestResultClass)
+{
+    GObjectClass* objectClass = G_OBJECT_CLASS(hitTestResultClass);
+    objectClass->get_property = webkitHitTestResultGetProperty;
+    objectClass->set_property = webkitHitTestResultSetProperty;
+    objectClass->finalize = webkitHitTestResultFinalize;
+
+    GParamFlags paramFlags = static_cast<GParamFlags>(WEBKIT_PARAM_READWRITE | G_PARAM_CONSTRUCT_ONLY);
+
+    /**
+     * WebKitHitTestResult:context:
+     *
+     * Bitmask of #WebKitHitTestResultContext flags representing
+     * the context of the #WebKitHitTestResult.
+     */
+    g_object_class_install_property(objectClass,
+                                    PROP_CONTEXT,
+                                    g_param_spec_uint("context",
+                                                      _("Context"),
+                                                      _("Flags with the context of the WebKitHitTestResult"),
+                                                      0, G_MAXUINT, 0,
+                                                      paramFlags));
+
+    /**
+     * WebKitHitTestResult:link-uri:
+     *
+     * The URI of the link if flag %WEBKIT_HIT_TEST_RESULT_CONTEXT_LINK
+     * is present in #WebKitHitTestResult:context
+     */
+    g_object_class_install_property(objectClass,
+                                    PROP_LINK_URI,
+                                    g_param_spec_string("link-uri",
+                                                        _("Link URI"),
+                                                        _("The link URI"),
+                                                        0,
+                                                        paramFlags));
+    /**
+     * WebKitHitTestResult:link-title:
+     *
+     * The title of the link if flag %WEBKIT_HIT_TEST_RESULT_CONTEXT_LINK
+     * is present in #WebKitHitTestResult:context
+     */
+    g_object_class_install_property(objectClass,
+                                    PROP_LINK_TITLE,
+                                    g_param_spec_string("link-title",
+                                                        _("Link Title"),
+                                                        _("The link title"),
+                                                        0,
+                                                        paramFlags));
+    /**
+     * WebKitHitTestResult:link-label:
+     *
+     * The label of the link if flag %WEBKIT_HIT_TEST_RESULT_CONTEXT_LINK
+     * is present in #WebKitHitTestResult:context
+     */
+    g_object_class_install_property(objectClass,
+                                    PROP_LINK_LABEL,
+                                    g_param_spec_string("link-label",
+                                                        _("Link Label"),
+                                                        _("The link label"),
+                                                        0,
+                                                        paramFlags));
+    /**
+     * WebKitHitTestResult:image-uri:
+     *
+     * The URI of the image if flag %WEBKIT_HIT_TEST_RESULT_CONTEXT_IMAGE
+     * is present in #WebKitHitTestResult:context
+     */
+    g_object_class_install_property(objectClass,
+                                    PROP_IMAGE_URI,
+                                    g_param_spec_string("image-uri",
+                                                        _("Image URI"),
+                                                        _("The image URI"),
+                                                        0,
+                                                        paramFlags));
+    /**
+     * WebKitHitTestResult:media-uri:
+     *
+     * The URI of the media if flag %WEBKIT_HIT_TEST_RESULT_CONTEXT_MEDIA
+     * is present in #WebKitHitTestResult:context
+     */
+    g_object_class_install_property(objectClass,
+                                    PROP_MEDIA_URI,
+                                    g_param_spec_string("media-uri",
+                                                        _("Media URI"),
+                                                        _("The media URI"),
+                                                        0,
+                                                        paramFlags));
+
+    g_type_class_add_private(hitTestResultClass, sizeof(WebKitHitTestResultPrivate));
+}
+
+WebKitHitTestResult* webkitHitTestResultCreate(WKHitTestResultRef wkHitTestResult)
+{
+    unsigned context = WEBKIT_HIT_TEST_RESULT_CONTEXT_DOCUMENT;
+
+    const String& linkURL = toImpl(wkHitTestResult)->absoluteLinkURL();
+    if (!linkURL.isEmpty())
+        context |= WEBKIT_HIT_TEST_RESULT_CONTEXT_LINK;
+
+    const String& imageURL = toImpl(wkHitTestResult)->absoluteImageURL();
+    if (!imageURL.isEmpty())
+        context |= WEBKIT_HIT_TEST_RESULT_CONTEXT_IMAGE;
+
+    const String& mediaURL = toImpl(wkHitTestResult)->absoluteMediaURL();
+    if (!mediaURL.isEmpty())
+        context |= WEBKIT_HIT_TEST_RESULT_CONTEXT_MEDIA;
+
+    const String& linkTitle = toImpl(wkHitTestResult)->linkTitle();
+    const String& linkLabel = toImpl(wkHitTestResult)->linkLabel();
+
+    return WEBKIT_HIT_TEST_RESULT(g_object_new(WEBKIT_TYPE_HIT_TEST_RESULT,
+                                               "context", context,
+                                               "link-uri", !linkURL.isEmpty() ? linkURL.utf8().data() : 0,
+                                               "image-uri", !imageURL.isEmpty() ? imageURL.utf8().data() : 0,
+                                               "media-uri", !mediaURL.isEmpty() ? mediaURL.utf8().data() : 0,
+                                               "link-title", !linkTitle.isEmpty() ? linkTitle.utf8().data() : 0,
+                                               "link-label", !linkLabel.isEmpty() ? linkLabel.utf8().data() : 0,
+                                               NULL));
+}
+
+static bool stringIsEqualToCString(const String& string, const CString& cString)
+{
+    return ((string.isEmpty() && cString.isNull()) || (string.utf8() == cString));
+}
+
+bool webkitHitTestResultCompare(WebKitHitTestResult* hitTestResult, WKHitTestResultRef wkHitTestResult)
+{
+    WebKitHitTestResultPrivate* priv = hitTestResult->priv;
+    return stringIsEqualToCString(toImpl(wkHitTestResult)->absoluteLinkURL(), priv->linkURI)
+        && stringIsEqualToCString(toImpl(wkHitTestResult)->linkTitle(), priv->linkTitle)
+        && stringIsEqualToCString(toImpl(wkHitTestResult)->linkLabel(), priv->linkLabel)
+        && stringIsEqualToCString(toImpl(wkHitTestResult)->absoluteImageURL(), priv->imageURI)
+        && stringIsEqualToCString(toImpl(wkHitTestResult)->absoluteMediaURL(), priv->mediaURI);
+}
+
+/**
+ * webkit_hit_test_result_get_context:
+ * @hit_test_result: a #WebKitHitTestResult
+ *
+ * Gets the value of the #WebKitHitTestResult:context property.
+ *
+ * Returns: a bitmask of #WebKitHitTestResultContext flags
+ */
+guint webkit_hit_test_result_get_context(WebKitHitTestResult* hitTestResult)
+{
+    g_return_val_if_fail(WEBKIT_IS_HIT_TEST_RESULT(hitTestResult), 0);
+
+    return hitTestResult->priv->context;
+}
+
+/**
+ * webkit_hit_test_result_context_is_link:
+ * @hit_test_result: a #WebKitHitTestResult
+ *
+ * Gets whether %WEBKIT_HIT_TEST_RESULT_CONTEXT_LINK flag is present in
+ * #WebKitHitTestResult:context.
+ *
+ * Returns: %TRUE if there's a link element in the coordinates of the Hit Test,
+ *    or %FALSE otherwise
+ */
+gboolean webkit_hit_test_result_context_is_link(WebKitHitTestResult* hitTestResult)
+{
+    g_return_val_if_fail(WEBKIT_IS_HIT_TEST_RESULT(hitTestResult), FALSE);
+
+    return hitTestResult->priv->context & WEBKIT_HIT_TEST_RESULT_CONTEXT_LINK;
+}
+
+/**
+ * webkit_hit_test_result_context_is_image:
+ * @hit_test_result: a #WebKitHitTestResult
+ *
+ * Gets whether %WEBKIT_HIT_TEST_RESULT_CONTEXT_IMAGE flag is present in
+ * #WebKitHitTestResult:context.
+ *
+ * Returns: %TRUE if there's an image element in the coordinates of the Hit Test,
+ *    or %FALSE otherwise
+ */
+gboolean webkit_hit_test_result_context_is_image(WebKitHitTestResult* hitTestResult)
+{
+    g_return_val_if_fail(WEBKIT_IS_HIT_TEST_RESULT(hitTestResult), FALSE);
+
+    return hitTestResult->priv->context & WEBKIT_HIT_TEST_RESULT_CONTEXT_IMAGE;
+}
+
+/**
+ * webkit_hit_test_result_context_is_media:
+ * @hit_test_result: a #WebKitHitTestResult
+ *
+ * Gets whether %WEBKIT_HIT_TEST_RESULT_CONTEXT_MEDIA flag is present in
+ * #WebKitHitTestResult:context.
+ *
+ * Returns: %TRUE if there's a media element in the coordinates of the Hit Test,
+ *    or %FALSE otherwise
+ */
+gboolean webkit_hit_test_result_context_is_media(WebKitHitTestResult* hitTestResult)
+{
+    g_return_val_if_fail(WEBKIT_IS_HIT_TEST_RESULT(hitTestResult), FALSE);
+
+    return hitTestResult->priv->context & WEBKIT_HIT_TEST_RESULT_CONTEXT_MEDIA;
+}
+
+/**
+ * webkit_hit_test_result_get_link_uri:
+ * @hit_test_result: a #WebKitHitTestResult
+ *
+ * Gets the value of the #WebKitHitTestResult:link-uri property.
+ *
+ * Returns: the URI of the link element in the coordinates of the Hit Test,
+ *    or %NULL if there ins't a link element in @hit_test_result context
+ */
+const gchar* webkit_hit_test_result_get_link_uri(WebKitHitTestResult* hitTestResult)
+{
+    g_return_val_if_fail(WEBKIT_IS_HIT_TEST_RESULT(hitTestResult), 0);
+
+    return hitTestResult->priv->linkURI.data();
+}
+
+/**
+ * webkit_hit_test_result_get_link_title:
+ * @hit_test_result: a #WebKitHitTestResult
+ *
+ * Gets the value of the #WebKitHitTestResult:link-title property.
+ *
+ * Returns: the title of the link element in the coordinates of the Hit Test,
+ *    or %NULL if there ins't a link element in @hit_test_result context or the
+ *    link element doesn't have a title
+ */
+const gchar* webkit_hit_test_result_get_link_title(WebKitHitTestResult* hitTestResult)
+{
+    g_return_val_if_fail(WEBKIT_IS_HIT_TEST_RESULT(hitTestResult), 0);
+
+    return hitTestResult->priv->linkTitle.data();
+}
+
+/**
+ * webkit_hit_test_result_get_link_label:
+ * @hit_test_result: a #WebKitHitTestResult
+ *
+ * Gets the value of the #WebKitHitTestResult:link-label property.
+ *
+ * Returns: the label of the link element in the coordinates of the Hit Test,
+ *    or %NULL if there ins't a link element in @hit_test_result context or the
+ *    link element doesn't have a label
+ */
+const gchar* webkit_hit_test_result_get_link_label(WebKitHitTestResult* hitTestResult)
+{
+    g_return_val_if_fail(WEBKIT_IS_HIT_TEST_RESULT(hitTestResult), 0);
+
+    return hitTestResult->priv->linkLabel.data();
+}
+
+/**
+ * webkit_hit_test_result_get_image_uri:
+ * @hit_test_result: a #WebKitHitTestResult
+ *
+ * Gets the value of the #WebKitHitTestResult:image-uri property.
+ *
+ * Returns: the URI of the image element in the coordinates of the Hit Test,
+ *    or %NULL if there ins't an image element in @hit_test_result context
+ */
+const gchar* webkit_hit_test_result_get_image_uri(WebKitHitTestResult* hitTestResult)
+{
+    g_return_val_if_fail(WEBKIT_IS_HIT_TEST_RESULT(hitTestResult), 0);
+
+    return hitTestResult->priv->imageURI.data();
+}
+
+/**
+ * webkit_hit_test_result_get_media_uri:
+ * @hit_test_result: a #WebKitHitTestResult
+ *
+ * Gets the value of the #WebKitHitTestResult:media-uri property.
+ *
+ * Returns: the URI of the media element in the coordinates of the Hit Test,
+ *    or %NULL if there ins't a media element in @hit_test_result context
+ */
+const gchar* webkit_hit_test_result_get_media_uri(WebKitHitTestResult* hitTestResult)
+{
+    g_return_val_if_fail(WEBKIT_IS_HIT_TEST_RESULT(hitTestResult), 0);
+
+    return hitTestResult->priv->mediaURI.data();
+}
diff --git a/Source/WebKit2/UIProcess/API/gtk/WebKitHitTestResult.h b/Source/WebKit2/UIProcess/API/gtk/WebKitHitTestResult.h
new file mode 100644
index 000000000..d8916e5f3
--- /dev/null
+++ b/Source/WebKit2/UIProcess/API/gtk/WebKitHitTestResult.h
@@ -0,0 +1,102 @@
+/*
+ * Copyright (C) 2012 Igalia S.L.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ */
+
+#if !defined(__WEBKIT2_H_INSIDE__) && !defined(WEBKIT2_COMPILATION)
+#error "Only <webkit2/webkit2.h> can be included directly."
+#endif
+
+#ifndef WebKitHitTestResult_h
+#define WebKitHitTestResult_h
+
+#include <glib-object.h>
+#include <webkit2/WebKitDefines.h>
+
+G_BEGIN_DECLS
+
+#define WEBKIT_TYPE_HIT_TEST_RESULT            (webkit_hit_test_result_get_type())
+#define WEBKIT_HIT_TEST_RESULT(obj)            (G_TYPE_CHECK_INSTANCE_CAST((obj), WEBKIT_TYPE_HIT_TEST_RESULT, WebKitHitTestResult))
+#define WEBKIT_IS_HIT_TEST_RESULT(obj)         (G_TYPE_CHECK_INSTANCE_TYPE((obj), WEBKIT_TYPE_HIT_TEST_RESULT))
+#define WEBKIT_HIT_TEST_RESULT_CLASS(klass)    (G_TYPE_CHECK_CLASS_CAST((klass),  WEBKIT_TYPE_HIT_TEST_RESULT, WebKitHitTestResultClass))
+#define WEBKIT_IS_HIT_TEST_RESULT_CLASS(klass) (G_TYPE_CHECK_CLASS_TYPE((klass),  WEBKIT_TYPE_HIT_TEST_RESULT))
+#define WEBKIT_HIT_TEST_RESULT_GET_CLASS(obj)  (G_TYPE_INSTANCE_GET_CLASS((obj),  WEBKIT_TYPE_HIT_TEST_RESULT, WebKitHitTestResultClass))
+
+typedef struct _WebKitHitTestResult        WebKitHitTestResult;
+typedef struct _WebKitHitTestResultClass   WebKitHitTestResultClass;
+typedef struct _WebKitHitTestResultPrivate WebKitHitTestResultPrivate;
+
+/**
+ * WebKitHitTestResultContext:
+ * @WEBKIT_HIT_TEST_RESULT_CONTEXT_DOCUMENT: anywhere in the document.
+ * @WEBKIT_HIT_TEST_RESULT_CONTEXT_LINK: a hyperlink element.
+ * @WEBKIT_HIT_TEST_RESULT_CONTEXT_IMAGE: an image element.
+ * @WEBKIT_HIT_TEST_RESULT_CONTEXT_MEDIA: a video or audio element.
+ *
+ * Enum values with flags representing the context of a #WebKitHitTestResult.
+ */
+typedef enum
+{
+    WEBKIT_HIT_TEST_RESULT_CONTEXT_DOCUMENT = 1 << 1,
+    WEBKIT_HIT_TEST_RESULT_CONTEXT_LINK     = 1 << 2,
+    WEBKIT_HIT_TEST_RESULT_CONTEXT_IMAGE    = 1 << 3,
+    WEBKIT_HIT_TEST_RESULT_CONTEXT_MEDIA    = 1 << 4
+} WebKitHitTestResultContext;
+
+struct _WebKitHitTestResult {
+    GObject parent;
+
+    WebKitHitTestResultPrivate *priv;
+};
+
+struct _WebKitHitTestResultClass {
+    GObjectClass parent_class;
+};
+
+WEBKIT_API GType
+webkit_hit_test_result_get_type             (void);
+
+WEBKIT_API guint
+webkit_hit_test_result_get_context          (WebKitHitTestResult *hit_test_result);
+
+WEBKIT_API gboolean
+webkit_hit_test_result_context_is_link      (WebKitHitTestResult *hit_test_result);
+
+WEBKIT_API gboolean
+webkit_hit_test_result_context_is_image     (WebKitHitTestResult *hit_test_result);
+
+WEBKIT_API gboolean
+webkit_hit_test_result_context_is_media     (WebKitHitTestResult *hit_test_result);
+
+WEBKIT_API const gchar *
+webkit_hit_test_result_get_link_uri         (WebKitHitTestResult *hit_test_result);
+
+WEBKIT_API const gchar *
+webkit_hit_test_result_get_link_title       (WebKitHitTestResult *hit_test_result);
+
+WEBKIT_API const gchar *
+webkit_hit_test_result_get_link_label       (WebKitHitTestResult *hit_test_result);
+
+WEBKIT_API const gchar *
+webkit_hit_test_result_get_image_uri        (WebKitHitTestResult *hit_test_result);
+
+WEBKIT_API const gchar *
+webkit_hit_test_result_get_media_uri        (WebKitHitTestResult *hit_test_result);
+
+G_END_DECLS
+
+#endif
diff --git a/Source/WebKit2/UIProcess/API/gtk/WebKitHitTestResultPrivate.h b/Source/WebKit2/UIProcess/API/gtk/WebKitHitTestResultPrivate.h
new file mode 100644
index 000000000..6088006e7
--- /dev/null
+++ b/Source/WebKit2/UIProcess/API/gtk/WebKitHitTestResultPrivate.h
@@ -0,0 +1,29 @@
+/*
+ * Copyright (C) 2012 Igalia S.L.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ */
+
+#ifndef WebKitHitTestResultPrivate_h
+#define WebKitHitTestResultPrivate_h
+
+#include "WebKitHitTestResult.h"
+#include "WebKitPrivate.h"
+
+WebKitHitTestResult* webkitHitTestResultCreate(WKHitTestResultRef);
+bool webkitHitTestResultCompare(WebKitHitTestResult*, WKHitTestResultRef);
+
+#endif // WebKitHitTestResultPrivate_h
diff --git a/Source/WebKit2/UIProcess/API/gtk/WebKitLoaderClient.cpp b/Source/WebKit2/UIProcess/API/gtk/WebKitLoaderClient.cpp
index 6d1133941..c26d8ebe9 100644
--- a/Source/WebKit2/UIProcess/API/gtk/WebKitLoaderClient.cpp
+++ b/Source/WebKit2/UIProcess/API/gtk/WebKitLoaderClient.cpp
@@ -144,7 +144,8 @@ void attachLoaderClientToView(WebKitWebView* webView)
         didChangeBackForwardList,
         0, // shouldGoToBackForwardListItem
         0, // didFailToInitializePlugin
-        0 // didDetectXSSForFrame
+        0, // didDetectXSSForFrame
+        0 // didFirstVisuallyNonEmptyLayoutForFrame 
     };
     WKPageRef wkPage = toAPI(webkitWebViewBaseGetPage(WEBKIT_WEB_VIEW_BASE(webView)));
     WKPageSetPageLoaderClient(wkPage, &wkLoaderClient);
diff --git a/Source/WebKit2/UIProcess/API/gtk/WebKitNavigationPolicyDecision.cpp b/Source/WebKit2/UIProcess/API/gtk/WebKitNavigationPolicyDecision.cpp
index fcd57b4a6..94d13eab2 100644
--- a/Source/WebKit2/UIProcess/API/gtk/WebKitNavigationPolicyDecision.cpp
+++ b/Source/WebKit2/UIProcess/API/gtk/WebKitNavigationPolicyDecision.cpp
@@ -25,7 +25,6 @@
 #include "WebKitPrivate.h"
 #include "WebKitURIRequestPrivate.h"
 #include "WebURLRequest.h"
-#include <gdk/gdk.h>
 #include <glib/gi18n-lib.h>
 #include <wtf/gobject/GRefPtr.h>
 #include <wtf/text/CString.h>
@@ -280,26 +279,12 @@ static unsigned wkEventMouseButtonToWebKitMouseButton(WKEventMouseButton wkButto
     return 0;
 }
 
-unsigned wkEventModifiersToUnsigned(WKEventModifiers wkModifiers)
-{
-    unsigned modifiers = 0;
-    if (wkModifiers & kWKEventModifiersShiftKey)
-        modifiers |= GDK_SHIFT_MASK;
-    if (wkModifiers & kWKEventModifiersControlKey)
-        modifiers |= GDK_CONTROL_MASK;
-    if (wkModifiers & kWKEventModifiersAltKey)
-        modifiers |= GDK_MOD1_MASK;
-    if (wkModifiers & kWKEventModifiersMetaKey)
-        modifiers |= GDK_META_MASK;
-    return modifiers;
-}
-
 WebKitNavigationPolicyDecision* webkitNavigationPolicyDecisionCreate(WKFrameNavigationType navigationType, WKEventMouseButton mouseButton, WKEventModifiers modifiers, WKURLRequestRef request, const char* frameName, WKFramePolicyListenerRef listener)
 {
     WebKitNavigationPolicyDecision* decision = WEBKIT_NAVIGATION_POLICY_DECISION(g_object_new(WEBKIT_TYPE_NAVIGATION_POLICY_DECISION, NULL));
     decision->priv->navigationType = static_cast<WebKitNavigationType>(navigationType);
     decision->priv->mouseButton = wkEventMouseButtonToWebKitMouseButton(mouseButton);
-    decision->priv->modifiers = wkEventModifiersToUnsigned(modifiers);
+    decision->priv->modifiers = wkEventModifiersToGdkModifiers(modifiers);
     decision->priv->request = adoptGRef(webkitURIRequestCreateForResourceRequest(toImpl(request)->resourceRequest()));
     decision->priv->frameName = frameName;
     webkitPolicyDecisionSetListener(WEBKIT_POLICY_DECISION(decision), listener);
diff --git a/Source/WebKit2/UIProcess/API/gtk/WebKitPrintOperation.cpp b/Source/WebKit2/UIProcess/API/gtk/WebKitPrintOperation.cpp
new file mode 100644
index 000000000..a20ccb2a6
--- /dev/null
+++ b/Source/WebKit2/UIProcess/API/gtk/WebKitPrintOperation.cpp
@@ -0,0 +1,410 @@
+/*
+ * Copyright (C) 2012 Igalia S.L.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ */
+
+#include "config.h"
+#include "WebKitPrintOperation.h"
+
+#include "PrintInfo.h"
+#include "WebKitPrintOperationPrivate.h"
+#include "WebKitPrivate.h"
+#include "WebKitWebViewBasePrivate.h"
+#include "WebPageProxy.h"
+#include <WebCore/GtkUtilities.h>
+#include <WebCore/NotImplemented.h>
+#include <glib/gi18n-lib.h>
+#include <wtf/gobject/GRefPtr.h>
+
+#ifdef HAVE_GTK_UNIX_PRINTING
+#include <gtk/gtkunixprint.h>
+#endif
+
+using namespace WebKit;
+
+enum {
+    PROP_0,
+
+    PROP_WEB_VIEW,
+    PROP_PRINT_SETTINGS,
+    PROP_PAGE_SETUP
+};
+
+enum {
+    FINISHED,
+
+    LAST_SIGNAL
+};
+
+struct _WebKitPrintOperationPrivate {
+    WebKitWebView* webView;
+    gulong webViewDestroyedId;
+
+    GRefPtr<GtkPrintSettings> printSettings;
+    GRefPtr<GtkPageSetup> pageSetup;
+};
+
+static guint signals[LAST_SIGNAL] = { 0, };
+
+G_DEFINE_TYPE(WebKitPrintOperation, webkit_print_operation, G_TYPE_OBJECT)
+
+static void webkitPrintOperationFinalize(GObject* object)
+{
+    WebKitPrintOperationPrivate* priv = WEBKIT_PRINT_OPERATION(object)->priv;
+    g_signal_handler_disconnect(priv->webView, priv->webViewDestroyedId);
+
+    priv->~WebKitPrintOperationPrivate();
+    G_OBJECT_CLASS(webkit_print_operation_parent_class)->finalize(object);
+}
+
+static void webViewDestroyed(GtkWidget* webView, GObject* printOperation)
+{
+    g_object_unref(printOperation);
+}
+
+static void webkitPrintOperationConstructed(GObject* object)
+{
+    WebKitPrintOperation* printOperation = WEBKIT_PRINT_OPERATION(object);
+    WebKitPrintOperationPrivate* priv = printOperation->priv;
+
+    if (G_OBJECT_CLASS(webkit_print_operation_parent_class)->constructed)
+        G_OBJECT_CLASS(webkit_print_operation_parent_class)->constructed(object);
+
+    priv->webViewDestroyedId = g_signal_connect(priv->webView, "destroy", G_CALLBACK(webViewDestroyed), printOperation);
+}
+
+static void webkitPrintOperationGetProperty(GObject* object, guint propId, GValue* value, GParamSpec* paramSpec)
+{
+    WebKitPrintOperation* printOperation = WEBKIT_PRINT_OPERATION(object);
+
+    switch (propId) {
+    case PROP_WEB_VIEW:
+        g_value_take_object(value, printOperation->priv->webView);
+        break;
+    case PROP_PRINT_SETTINGS:
+        g_value_set_object(value, printOperation->priv->printSettings.get());
+        break;
+    case PROP_PAGE_SETUP:
+        g_value_set_object(value, printOperation->priv->pageSetup.get());
+        break;
+    default:
+        G_OBJECT_WARN_INVALID_PROPERTY_ID(object, propId, paramSpec);
+    }
+}
+
+static void webkitPrintOperationSetProperty(GObject* object, guint propId, const GValue* value, GParamSpec* paramSpec)
+{
+    WebKitPrintOperation* printOperation = WEBKIT_PRINT_OPERATION(object);
+
+    switch (propId) {
+    case PROP_WEB_VIEW:
+        printOperation->priv->webView = WEBKIT_WEB_VIEW(g_value_get_object(value));
+        break;
+    case PROP_PRINT_SETTINGS:
+        webkit_print_operation_set_print_settings(printOperation, GTK_PRINT_SETTINGS(g_value_get_object(value)));
+        break;
+    case PROP_PAGE_SETUP:
+        webkit_print_operation_set_page_setup(printOperation, GTK_PAGE_SETUP(g_value_get_object(value)));
+        break;
+    default:
+        G_OBJECT_WARN_INVALID_PROPERTY_ID(object, propId, paramSpec);
+    }
+}
+
+static void webkit_print_operation_init(WebKitPrintOperation* printOperation)
+{
+    WebKitPrintOperationPrivate* priv = G_TYPE_INSTANCE_GET_PRIVATE(printOperation, WEBKIT_TYPE_PRINT_OPERATION, WebKitPrintOperationPrivate);
+    printOperation->priv = priv;
+    new (priv) WebKitPrintOperationPrivate();
+}
+
+static void webkit_print_operation_class_init(WebKitPrintOperationClass* printOperationClass)
+{
+    GObjectClass* gObjectClass = G_OBJECT_CLASS(printOperationClass);
+    gObjectClass->finalize = webkitPrintOperationFinalize;
+    gObjectClass->constructed = webkitPrintOperationConstructed;
+    gObjectClass->get_property = webkitPrintOperationGetProperty;
+    gObjectClass->set_property = webkitPrintOperationSetProperty;
+
+    /**
+     * WebKitPrintOperation:web-view:
+     *
+     * The #WebKitWebView that will be printed.
+     */
+    g_object_class_install_property(gObjectClass,
+                                    PROP_WEB_VIEW,
+                                    g_param_spec_object("web-view",
+                                                        _("Web View"),
+                                                        _("The web view that will be printed"),
+                                                        WEBKIT_TYPE_WEB_VIEW,
+                                                        static_cast<GParamFlags>(WEBKIT_PARAM_READWRITE | G_PARAM_CONSTRUCT_ONLY)));
+
+    /**
+     * WebKitPrintOperation:print-settings:
+     *
+     * The initial #GtkPrintSettings for the print operation.
+     */
+    g_object_class_install_property(gObjectClass,
+                                    PROP_PRINT_SETTINGS,
+                                    g_param_spec_object("print-settings",
+                                                        _("Print Settings"),
+                                                        _("The initial print settings for the print operation"),
+                                                        GTK_TYPE_PRINT_SETTINGS,
+                                                        WEBKIT_PARAM_READWRITE));
+    /**
+     * WebKitPrintOperation:page-setup:
+     *
+     * The initial #GtkPageSetup for the print operation.
+     */
+    g_object_class_install_property(gObjectClass,
+                                     PROP_PAGE_SETUP,
+                                     g_param_spec_object("page-setup",
+                                                         _("Page Setup"),
+                                                         _("The initial page setup for the print operation"),
+                                                         GTK_TYPE_PAGE_SETUP,
+                                                         WEBKIT_PARAM_READWRITE));
+
+    /**
+     * WebKitPrintOperation::finished:
+     * @print_operation: the #WebKitPrintOperation on which the signal was emitted
+     *
+     * Emitted when the print operation has finished doing everything
+     * required for printing.
+     */
+    signals[FINISHED] =
+        g_signal_new("finished",
+                     G_TYPE_FROM_CLASS(gObjectClass),
+                     G_SIGNAL_RUN_LAST,
+                     0, 0, 0,
+                     g_cclosure_marshal_VOID__VOID,
+                     G_TYPE_NONE, 0);
+
+    g_type_class_add_private(printOperationClass, sizeof(WebKitPrintOperationPrivate));
+}
+
+#ifdef HAVE_GTK_UNIX_PRINTING
+static WebKitPrintOperationResponse webkitPrintOperationRunDialog(WebKitPrintOperation* printOperation, GtkWindow* parent)
+{
+    GtkPrintUnixDialog* printDialog = GTK_PRINT_UNIX_DIALOG(gtk_print_unix_dialog_new(0, parent));
+    gtk_print_unix_dialog_set_manual_capabilities(printDialog, static_cast<GtkPrintCapabilities>(GTK_PRINT_CAPABILITY_NUMBER_UP
+                                                                                                 | GTK_PRINT_CAPABILITY_NUMBER_UP_LAYOUT
+                                                                                                 | GTK_PRINT_CAPABILITY_PAGE_SET
+                                                                                                 | GTK_PRINT_CAPABILITY_REVERSE
+                                                                                                 | GTK_PRINT_CAPABILITY_COPIES
+                                                                                                 | GTK_PRINT_CAPABILITY_COLLATE
+                                                                                                 | GTK_PRINT_CAPABILITY_SCALE));
+
+    WebKitPrintOperationPrivate* priv = printOperation->priv;
+    if (priv->printSettings)
+        gtk_print_unix_dialog_set_settings(printDialog, priv->printSettings.get());
+
+    if (priv->pageSetup)
+        gtk_print_unix_dialog_set_page_setup(printDialog, priv->pageSetup.get());
+
+    gtk_print_unix_dialog_set_embed_page_setup(printDialog, TRUE);
+
+    WebKitPrintOperationResponse returnValue = WEBKIT_PRINT_OPERATION_RESPONSE_CANCEL;
+    if (gtk_dialog_run(GTK_DIALOG(printDialog)) == GTK_RESPONSE_OK) {
+        priv->printSettings = adoptGRef(gtk_print_unix_dialog_get_settings(printDialog));
+        priv->pageSetup = gtk_print_unix_dialog_get_page_setup(printDialog);
+        returnValue = WEBKIT_PRINT_OPERATION_RESPONSE_PRINT;
+    }
+
+    gtk_widget_destroy(GTK_WIDGET(printDialog));
+
+    return returnValue;
+}
+#else
+// TODO: We need to add an implementation for Windows.
+static WebKitPrintOperationResponse webkitPrintOperationRunDialog(WebKitPrintOperation*, GtkWindow*)
+{
+    notImplemented();
+    return WEBKIT_PRINT_OPERATION_RESPONSE_CANCEL;
+}
+#endif
+
+static void drawPagesForPrintingCompleted(WKErrorRef, void* context)
+{
+    GRefPtr<WebKitPrintOperation> printOperation = adoptGRef(WEBKIT_PRINT_OPERATION(context));
+    WebPageProxy* page = webkitWebViewBaseGetPage(WEBKIT_WEB_VIEW_BASE(printOperation->priv->webView));
+    page->endPrinting();
+    g_signal_emit(printOperation.get(), signals[FINISHED], 0, NULL);
+}
+
+static void webkitPrintOperationPrintPagesForFrame(WebKitPrintOperation* printOperation, WebFrameProxy* webFrame, GtkPrintSettings* printSettings, GtkPageSetup* pageSetup)
+{
+    PrintInfo printInfo(printSettings, pageSetup);
+    WebPageProxy* page = webkitWebViewBaseGetPage(WEBKIT_WEB_VIEW_BASE(printOperation->priv->webView));
+    page->drawPagesForPrinting(webFrame, printInfo, VoidCallback::create(g_object_ref(printOperation), &drawPagesForPrintingCompleted));
+}
+
+WebKitPrintOperationResponse webkitPrintOperationRunDialogForFrame(WebKitPrintOperation* printOperation, GtkWindow* parent, WebFrameProxy* webFrame)
+{
+    WebKitPrintOperationPrivate* priv = printOperation->priv;
+    if (!parent) {
+        GtkWidget* toplevel = gtk_widget_get_toplevel(GTK_WIDGET(priv->webView));
+        if (WebCore::widgetIsOnscreenToplevelWindow(toplevel))
+            parent = GTK_WINDOW(toplevel);
+    }
+
+    WebKitPrintOperationResponse response = webkitPrintOperationRunDialog(printOperation, parent);
+    if (response == WEBKIT_PRINT_OPERATION_RESPONSE_CANCEL)
+        return response;
+
+    webkitPrintOperationPrintPagesForFrame(printOperation, webFrame, priv->printSettings.get(), priv->pageSetup.get());
+    return response;
+}
+
+/**
+ * webkit_print_operation_new:
+ * @web_view: a #WebKitWebView
+ *
+ * Create a new #WebKitPrintOperation to print @web_view contents.
+ *
+ * Returns: (transfer full): a new #WebKitPrintOperation.
+ */
+WebKitPrintOperation* webkit_print_operation_new(WebKitWebView* webView)
+{
+    g_return_val_if_fail(WEBKIT_IS_WEB_VIEW(webView), 0);
+
+    return WEBKIT_PRINT_OPERATION(g_object_new(WEBKIT_TYPE_PRINT_OPERATION, "web-view", webView, NULL));
+}
+
+/**
+ * webkit_print_operation_get_print_settings:
+ * @print_operation: a #WebKitPrintOperation
+ *
+ * Return the current print settings of @print_operation. It returns %NULL until
+ * either webkit_print_operation_set_print_settings() or webkit_print_operation_run_dialog()
+ * have been called.
+ *
+ * Returns: (transfer none): the current #GtkPrintSettings of @print_operation.
+ */
+GtkPrintSettings* webkit_print_operation_get_print_settings(WebKitPrintOperation* printOperation)
+{
+    g_return_val_if_fail(WEBKIT_IS_PRINT_OPERATION(printOperation), 0);
+
+    return printOperation->priv->printSettings.get();
+}
+
+/**
+ * webkit_print_operation_set_print_settings:
+ * @print_operation: a #WebKitPrintOperation
+ * @print_settings: a #GtkPrintSettings to set
+ *
+ * Set the current print settings of @print_operation. Current print settings are used for
+ * the initial values of the print dialog when webkit_print_operation_run_dialog() is called.
+ */
+void webkit_print_operation_set_print_settings(WebKitPrintOperation* printOperation, GtkPrintSettings* printSettings)
+{
+    g_return_if_fail(WEBKIT_IS_PRINT_OPERATION(printOperation));
+    g_return_if_fail(GTK_IS_PRINT_SETTINGS(printSettings));
+
+    if (printOperation->priv->printSettings.get() == printSettings)
+        return;
+
+    printOperation->priv->printSettings = printSettings;
+    g_object_notify(G_OBJECT(printOperation), "print-settings");
+}
+
+/**
+ * webkit_print_operation_get_page_setup:
+ * @print_operation: a #WebKitPrintOperation
+ *
+ * Return the current page setup of @print_operation. It returns %NULL until
+ * either webkit_print_operation_set_print_settings() or webkit_print_operation_run_dialog()
+ * have been called.
+ *
+ * Returns: (transfer none): the current #GtkPageSetup of @print_operation.
+ */
+GtkPageSetup* webkit_print_operation_get_page_setup(WebKitPrintOperation* printOperation)
+{
+    g_return_val_if_fail(WEBKIT_IS_PRINT_OPERATION(printOperation), 0);
+
+    return printOperation->priv->pageSetup.get();
+}
+
+/**
+ * webkit_print_operation_set_page_setup:
+ * @print_operation: a #WebKitPrintOperation
+ * @page_setup: a #GtkPageSetup to set
+ *
+ * Set the current page setup of @print_operation. Current page setup is used for the
+ * initial values of the print dialog when webkit_print_operation_run_dialog() is called.
+ */
+void webkit_print_operation_set_page_setup(WebKitPrintOperation* printOperation, GtkPageSetup* pageSetup)
+{
+    g_return_if_fail(WEBKIT_IS_PRINT_OPERATION(printOperation));
+    g_return_if_fail(GTK_IS_PAGE_SETUP(pageSetup));
+
+    if (printOperation->priv->pageSetup.get() == pageSetup)
+        return;
+
+    printOperation->priv->pageSetup = pageSetup;
+    g_object_notify(G_OBJECT(printOperation), "page-setup");
+}
+
+/**
+ * webkit_print_operation_run_dialog:
+ * @print_operation: a #WebKitPrintOperation
+ * @parent: (allow-none): transient parent of the print dialog
+ *
+ * Run the print dialog and start printing using the options selected by
+ * the user. This method returns when the print dialog is closed.
+ * If the print dialog is cancelled %WEBKIT_PRINT_OPERATION_RESPONSE_CANCEL
+ * is returned. If the user clicks on the print button, %WEBKIT_PRINT_OPERATION_RESPONSE_PRINT
+ * is returned and the print operation starts. In this case, the WebKitPrintOperation::finished
+ * signal is emitted when the operation finishes.
+ * If the print dialog is not cancelled current print settings and page setup of @print_operation
+ * are updated with options selected by the user when Print button is pressed in print dialog.
+ * You can get the updated print settings and page setup by calling
+ * webkit_print_operation_get_print_settings() and webkit_print_operation_get_page_setup()
+ * after this method.
+ *
+ * Returns: the #WebKitPrintOperationResponse of the print dialog
+ */
+WebKitPrintOperationResponse webkit_print_operation_run_dialog(WebKitPrintOperation* printOperation, GtkWindow* parent)
+{
+    g_return_val_if_fail(WEBKIT_IS_PRINT_OPERATION(printOperation), WEBKIT_PRINT_OPERATION_RESPONSE_CANCEL);
+
+    WebPageProxy* page = webkitWebViewBaseGetPage(WEBKIT_WEB_VIEW_BASE(printOperation->priv->webView));
+    return webkitPrintOperationRunDialogForFrame(printOperation, parent, page->mainFrame());
+}
+
+/**
+ * webkit_print_operation_print:
+ * @print_operation: a #WebKitPrintOperation
+ *
+ * Start a print operation using current print settings and page setup
+ * without showing the print dialog. If either print settings or page setup
+ * are not set with webkit_print_operation_set_print_settings() and
+ * webkit_print_operation_set_page_setup(), the default options will be used
+ * and the print job will be sent to the default printer.
+ * The WebKitPrintOperation::finished signal is emitted when the printing
+ * operation finishes.
+ */
+void webkit_print_operation_print(WebKitPrintOperation* printOperation)
+{
+    g_return_if_fail(WEBKIT_IS_PRINT_OPERATION(printOperation));
+
+    WebKitPrintOperationPrivate* priv = printOperation->priv;
+    GRefPtr<GtkPrintSettings> printSettings = priv->printSettings ? priv->printSettings : adoptGRef(gtk_print_settings_new());
+    GRefPtr<GtkPageSetup> pageSetup = priv->pageSetup ? priv->pageSetup : adoptGRef(gtk_page_setup_new());
+
+    WebPageProxy* page = webkitWebViewBaseGetPage(WEBKIT_WEB_VIEW_BASE(printOperation->priv->webView));
+    webkitPrintOperationPrintPagesForFrame(printOperation, page->mainFrame(), printSettings.get(), pageSetup.get());
+}
diff --git a/Source/WebKit2/UIProcess/API/gtk/WebKitPrintOperation.h b/Source/WebKit2/UIProcess/API/gtk/WebKitPrintOperation.h
new file mode 100644
index 000000000..a02f4e809
--- /dev/null
+++ b/Source/WebKit2/UIProcess/API/gtk/WebKitPrintOperation.h
@@ -0,0 +1,95 @@
+/*
+ * Copyright (C) 2012 Igalia S.L.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ */
+
+#if !defined(__WEBKIT2_H_INSIDE__) && !defined(WEBKIT2_COMPILATION)
+#error "Only <webkit2/webkit2.h> can be included directly."
+#endif
+
+#ifndef WebKitPrintOperation_h
+#define WebKitPrintOperation_h
+
+#include <glib-object.h>
+#include <webkit2/WebKitDefines.h>
+#include <webkit2/WebKitWebView.h>
+
+G_BEGIN_DECLS
+
+#define WEBKIT_TYPE_PRINT_OPERATION            (webkit_print_operation_get_type())
+#define WEBKIT_PRINT_OPERATION(obj)            (G_TYPE_CHECK_INSTANCE_CAST((obj), WEBKIT_TYPE_PRINT_OPERATION, WebKitPrintOperation))
+#define WEBKIT_IS_PRINT_OPERATION(obj)         (G_TYPE_CHECK_INSTANCE_TYPE((obj), WEBKIT_TYPE_PRINT_OPERATION))
+#define WEBKIT_PRINT_OPERATION_CLASS(klass)    (G_TYPE_CHECK_CLASS_CAST((klass),  WEBKIT_TYPE_PRINT_OPERATION, WebKitPrintOperationClass))
+#define WEBKIT_IS_PRINT_OPERATION_CLASS(klass) (G_TYPE_CHECK_CLASS_TYPE((klass),  WEBKIT_TYPE_PRINT_OPERATION))
+#define WEBKIT_PRINT_OPERATION_GET_CLASS(obj)  (G_TYPE_INSTANCE_GET_CLASS((obj),  WEBKIT_TYPE_PRINT_OPERATION, WebKitPrintOperationClass))
+
+typedef struct _WebKitPrintOperationClass   WebKitPrintOperationClass;
+typedef struct _WebKitPrintOperationPrivate WebKitPrintOperationPrivate;
+
+/**
+ * WebKitPrintOperationResponse:
+ * @WEBKIT_PRINT_OPERATION_RESPONSE_PRINT: Print button was cliked in print dialog
+ * @WEBKIT_PRINT_OPERATION_RESPONSE_CANCEL: Print dialog was cancelled
+ *
+ * Enum values representing the response of the print dialog shown with
+ * webkit_print_operation_run_dialog().
+ */
+typedef enum {
+    WEBKIT_PRINT_OPERATION_RESPONSE_PRINT,
+    WEBKIT_PRINT_OPERATION_RESPONSE_CANCEL
+} WebKitPrintOperationResponse;
+
+struct _WebKitPrintOperation {
+    GObject parent;
+
+    WebKitPrintOperationPrivate *priv;
+};
+
+struct _WebKitPrintOperationClass {
+    GObjectClass parent_class;
+};
+
+WEBKIT_API GType
+webkit_print_operation_get_type           (void);
+
+WEBKIT_API WebKitPrintOperation *
+webkit_print_operation_new                (WebKitWebView        *web_view);
+
+WEBKIT_API GtkPrintSettings *
+webkit_print_operation_get_print_settings (WebKitPrintOperation *print_operation);
+
+WEBKIT_API void
+webkit_print_operation_set_print_settings (WebKitPrintOperation *print_operation,
+                                           GtkPrintSettings     *print_settings);
+
+WEBKIT_API GtkPageSetup *
+webkit_print_operation_get_page_setup     (WebKitPrintOperation *print_operation);
+
+WEBKIT_API void
+webkit_print_operation_set_page_setup     (WebKitPrintOperation *print_operation,
+                                           GtkPageSetup         *page_setup);
+
+WEBKIT_API WebKitPrintOperationResponse
+webkit_print_operation_run_dialog         (WebKitPrintOperation *print_operation,
+                                           GtkWindow            *parent);
+
+WEBKIT_API void
+webkit_print_operation_print              (WebKitPrintOperation *print_operation);
+
+G_END_DECLS
+
+#endif
diff --git a/Source/WebKit2/UIProcess/API/gtk/WebKitPrintOperationPrivate.h b/Source/WebKit2/UIProcess/API/gtk/WebKitPrintOperationPrivate.h
new file mode 100644
index 000000000..7a4fb4e43
--- /dev/null
+++ b/Source/WebKit2/UIProcess/API/gtk/WebKitPrintOperationPrivate.h
@@ -0,0 +1,28 @@
+/*
+ * Copyright (C) 2012 Igalia S.L.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ */
+
+#ifndef WebKitPrintOperationPrivate_h
+#define WebKitPrintOperationPrivate_h
+
+#include "WebFrameProxy.h"
+#include "WebKitPrintOperation.h"
+
+WebKitPrintOperationResponse webkitPrintOperationRunDialogForFrame(WebKitPrintOperation*, GtkWindow* parent, WebKit::WebFrameProxy*);
+
+#endif // WebKitPrintOperationPrivate_h
diff --git a/Source/WebKit2/UIProcess/API/gtk/WebKitPrivate.cpp b/Source/WebKit2/UIProcess/API/gtk/WebKitPrivate.cpp
new file mode 100644
index 000000000..998c3abfa
--- /dev/null
+++ b/Source/WebKit2/UIProcess/API/gtk/WebKitPrivate.cpp
@@ -0,0 +1,37 @@
+/*
+ * Copyright (C) 2012 Igalia S.L.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ */
+
+#include "config.h"
+#include "WebKitPrivate.h"
+
+#include <gdk/gdk.h>
+
+unsigned wkEventModifiersToGdkModifiers(WKEventModifiers wkModifiers)
+{
+    unsigned modifiers = 0;
+    if (wkModifiers & kWKEventModifiersShiftKey)
+        modifiers |= GDK_SHIFT_MASK;
+    if (wkModifiers & kWKEventModifiersControlKey)
+        modifiers |= GDK_CONTROL_MASK;
+    if (wkModifiers & kWKEventModifiersAltKey)
+        modifiers |= GDK_MOD1_MASK;
+    if (wkModifiers & kWKEventModifiersMetaKey)
+        modifiers |= GDK_META_MASK;
+    return modifiers;
+}
diff --git a/Source/WebKit2/UIProcess/API/gtk/WebKitPrivate.h b/Source/WebKit2/UIProcess/API/gtk/WebKitPrivate.h
index c44d877e0..43d26cc85 100644
--- a/Source/WebKit2/UIProcess/API/gtk/WebKitPrivate.h
+++ b/Source/WebKit2/UIProcess/API/gtk/WebKitPrivate.h
@@ -40,4 +40,6 @@
 #define COMPILE_ASSERT_MATCHING_ENUM(webkitName, webcoreName) \
         COMPILE_ASSERT(int(webkitName) == int(webcoreName), mismatchingEnums)
 
+unsigned wkEventModifiersToGdkModifiers(WKEventModifiers);
+
 #endif // WebKitPrivate_h
diff --git a/Source/WebKit2/UIProcess/API/gtk/WebKitSettings.cpp b/Source/WebKit2/UIProcess/API/gtk/WebKitSettings.cpp
index 774f17190..c1c4a970b 100644
--- a/Source/WebKit2/UIProcess/API/gtk/WebKitSettings.cpp
+++ b/Source/WebKit2/UIProcess/API/gtk/WebKitSettings.cpp
@@ -102,7 +102,8 @@ enum {
     PROP_ENABLE_CARET_BROWSING,
     PROP_ENABLE_FULLSCREEN,
     PROP_PRINT_BACKGROUNDS,
-    PROP_ENABLE_WEBAUDIO
+    PROP_ENABLE_WEBAUDIO,
+    PROP_ENABLE_WEBGL
 };
 
 static void webKitSettingsSetProperty(GObject* object, guint propId, const GValue* value, GParamSpec* paramSpec)
@@ -206,6 +207,9 @@ static void webKitSettingsSetProperty(GObject* object, guint propId, const GValu
     case PROP_ENABLE_WEBAUDIO:
         webkit_settings_set_enable_webaudio(settings, g_value_get_boolean(value));
         break;
+    case PROP_ENABLE_WEBGL:
+        webkit_settings_set_enable_webgl(settings, g_value_get_boolean(value));
+        break;
     default:
         G_OBJECT_WARN_INVALID_PROPERTY_ID(object, propId, paramSpec);
         break;
@@ -313,6 +317,9 @@ static void webKitSettingsGetProperty(GObject* object, guint propId, GValue* val
     case PROP_ENABLE_WEBAUDIO:
         g_value_set_boolean(value, webkit_settings_get_enable_webaudio(settings));
         break;
+    case PROP_ENABLE_WEBGL:
+        g_value_set_boolean(value, webkit_settings_get_enable_webgl(settings));
+        break;
     default:
         G_OBJECT_WARN_INVALID_PROPERTY_ID(object, propId, paramSpec);
         break;
@@ -794,6 +801,21 @@ static void webkit_settings_class_init(WebKitSettingsClass* klass)
                                                          FALSE,
                                                          readWriteConstructParamFlags));
 
+    /**
+    * WebKitSettings:enable-webgl:
+    *
+    * Enable or disable support for WebGL on pages. WebGL is an experimental
+    * proposal for allowing web pages to use OpenGL ES-like calls directly. The
+    * standard is currently a work-in-progress by the Khronos Group.
+    */
+    g_object_class_install_property(gObjectClass,
+                                    PROP_ENABLE_WEBGL,
+                                    g_param_spec_boolean("enable-webgl",
+                                                         _("Enable WebGL"),
+                                                         _("Whether WebGL content should be rendered"),
+                                                         FALSE,
+                                                         readWriteConstructParamFlags));
+
     g_type_class_add_private(klass, sizeof(WebKitSettingsPrivate));
 }
 
@@ -2016,3 +2038,38 @@ void webkit_settings_set_enable_webaudio(WebKitSettings* settings, gboolean enab
     WKPreferencesSetWebAudioEnabled(priv->preferences.get(), enabled);
     g_object_notify(G_OBJECT(settings), "enable-webaudio");
 }
+
+/**
+ * webkit_settings_get_enable_webgl:
+ * @settings: a #WebKitSettings
+ *
+ * Get the #WebKitSettings:enable-webgl property.
+ *
+ * Returns: %TRUE If webgl support is enabled or %FALSE otherwise.
+ */
+gboolean webkit_settings_get_enable_webgl(WebKitSettings* settings)
+{
+    g_return_val_if_fail(WEBKIT_IS_SETTINGS(settings), FALSE);
+
+    return WKPreferencesGetWebGLEnabled(settings->priv->preferences.get());
+}
+
+/**
+ * webkit_settings_set_enable_webgl:
+ * @settings: a #WebKitSettings
+ * @enabled: Value to be set
+ *
+ * Set the #WebKitSettings:enable-webgl property.
+ */
+void webkit_settings_set_enable_webgl(WebKitSettings* settings, gboolean enabled)
+{
+    g_return_if_fail(WEBKIT_IS_SETTINGS(settings));
+
+    WebKitSettingsPrivate* priv = settings->priv;
+    bool currentValue = WKPreferencesGetWebGLEnabled(priv->preferences.get());
+    if (currentValue == enabled)
+        return;
+
+    WKPreferencesSetWebGLEnabled(priv->preferences.get(), enabled);
+    g_object_notify(G_OBJECT(settings), "enable-webgl");
+}
diff --git a/Source/WebKit2/UIProcess/API/gtk/WebKitSettings.h b/Source/WebKit2/UIProcess/API/gtk/WebKitSettings.h
index 27cb7c75a..b22ba00ff 100644
--- a/Source/WebKit2/UIProcess/API/gtk/WebKitSettings.h
+++ b/Source/WebKit2/UIProcess/API/gtk/WebKitSettings.h
@@ -300,6 +300,13 @@ WEBKIT_API void
 webkit_settings_set_enable_webaudio                            (WebKitSettings *settings,
                                                                 gboolean        enabled);
 
+WEBKIT_API gboolean
+webkit_settings_get_enable_webgl                               (WebKitSettings *settings);
+
+WEBKIT_API void
+webkit_settings_set_enable_webgl                               (WebKitSettings *settings,
+                                                                gboolean        enabled);
+
 G_END_DECLS
 
 #endif /* WebKitSettings_h */
diff --git a/Source/WebKit2/UIProcess/API/gtk/WebKitUIClient.cpp b/Source/WebKit2/UIProcess/API/gtk/WebKitUIClient.cpp
index a659ad314..6f0e11c82 100644
--- a/Source/WebKit2/UIProcess/API/gtk/WebKitUIClient.cpp
+++ b/Source/WebKit2/UIProcess/API/gtk/WebKitUIClient.cpp
@@ -126,6 +126,16 @@ static void setWindowFrame(WKPageRef page, WKRect frame, const void* clientInfo)
     webkitWindowPropertiesSetGeometry(windowProperties, &geometry);
 }
 
+static void mouseDidMoveOverElement(WKPageRef page, WKHitTestResultRef hitTestResult, WKEventModifiers modifiers, WKTypeRef userData, const void* clientInfo)
+{
+    webkitWebViewMouseTargetChanged(WEBKIT_WEB_VIEW(clientInfo), hitTestResult, wkEventModifiersToGdkModifiers(modifiers));
+}
+
+static void printFrame(WKPageRef page, WKFrameRef frame, const void*)
+{
+    webkitWebViewPrintFrame(WEBKIT_WEB_VIEW(toImpl(page)->viewWidget()), frame);
+}
+
 void attachUIClientToView(WebKitWebView* webView)
 {
     WKPageUIClient wkUIClient = {
@@ -165,13 +175,13 @@ void attachUIClientToView(WebKitWebView* webView)
         0, // footerHeight
         0, // drawHeader
         0, // drawFooter
-        0, // printFrame
+        printFrame,
         0, // runModal
         0, // didCompleteRubberBandForMainFrame
         0, // saveDataToFileInDownloadsFolder
         0, // shouldInterruptJavaScript
         createNewPage,
-        0, // mouseDidMoveOverElement
+        mouseDidMoveOverElement,
         0, // decidePolicyForNotificationPermissionRequest
     };
     WKPageRef wkPage = toAPI(webkitWebViewBaseGetPage(WEBKIT_WEB_VIEW_BASE(webView)));
diff --git a/Source/WebKit2/UIProcess/API/gtk/WebKitWebView.cpp b/Source/WebKit2/UIProcess/API/gtk/WebKitWebView.cpp
index c3accccbb..be590ff33 100644
--- a/Source/WebKit2/UIProcess/API/gtk/WebKitWebView.cpp
+++ b/Source/WebKit2/UIProcess/API/gtk/WebKitWebView.cpp
@@ -24,9 +24,11 @@
 #include "WebKitBackForwardListPrivate.h"
 #include "WebKitEnumTypes.h"
 #include "WebKitError.h"
+#include "WebKitHitTestResultPrivate.h"
 #include "WebKitLoaderClient.h"
 #include "WebKitMarshal.h"
 #include "WebKitPolicyClient.h"
+#include "WebKitPrintOperationPrivate.h"
 #include "WebKitPrivate.h"
 #include "WebKitSettingsPrivate.h"
 #include "WebKitUIClient.h"
@@ -59,6 +61,10 @@ enum {
 
     DECIDE_POLICY,
 
+    MOUSE_TARGET_CHANGED,
+
+    PRINT_REQUESTED,
+
     LAST_SIGNAL
 };
 
@@ -83,6 +89,9 @@ struct _WebKitWebViewPrivate {
     GRefPtr<WebKitBackForwardList> backForwardList;
     GRefPtr<WebKitSettings> settings;
     GRefPtr<WebKitWindowProperties> windowProperties;
+
+    GRefPtr<WebKitHitTestResult> mouseTargetHitTestResult;
+    unsigned mouseTargetModifiers;
 };
 
 static guint signals[LAST_SIGNAL] = { 0, };
@@ -615,6 +624,59 @@ static void webkit_web_view_class_init(WebKitWebViewClass* webViewClass)
                      G_TYPE_BOOLEAN, 2, /* number of parameters */
                      WEBKIT_TYPE_POLICY_DECISION,
                      WEBKIT_TYPE_POLICY_DECISION_TYPE);
+
+    /**
+     * WebKitWebView::mouse-target-changed:
+     * @web_view: the #WebKitWebView on which the signal is emitted
+     * @hit_test_result: a #WebKitHitTestResult
+     * @modifiers: a bitmask of #GdkModifierType
+     *
+     * This signal is emitted when the mouse cursor moves over an
+     * element such as a link, image or a media element. To determine
+     * what type of element the mouse cursor is over, a Hit Test is performed
+     * on the current mouse coordinates and the result is passed in the
+     * @hit_test_result argument. The @modifiers argument is a bitmask of
+     * #GdkModifierType flags indicating the state of modifier keys.
+     * The signal is emitted again when the mouse is moved out of the
+     * current element with a new @hit_test_result.
+     */
+     signals[MOUSE_TARGET_CHANGED] =
+         g_signal_new("mouse-target-changed",
+                      G_TYPE_FROM_CLASS(webViewClass),
+                      G_SIGNAL_RUN_LAST,
+                      G_STRUCT_OFFSET(WebKitWebViewClass, mouse_target_changed),
+                      0, 0,
+                      webkit_marshal_VOID__OBJECT_UINT,
+                      G_TYPE_NONE, 2,
+                      WEBKIT_TYPE_HIT_TEST_RESULT,
+                      G_TYPE_UINT);
+    /**
+     * WebKitWebView::print-requested:
+     * @web_view: the #WebKitWebView on which the signal is emitted
+     * @print_operation: the #WebKitPrintOperation that will handle the print request
+     *
+     * Emitted when printing is requested on @web_view, usually by a javascript call,
+     * before the print dialog is shown. This signal can be used to set the initial
+     * print settings and page setup of @print_operation to be used as default values in
+     * the print dialog. You can call webkit_print_operation_set_print_settings() and
+     * webkit_print_operation_set_page_setup() and then return %FALSE to propagate the
+     * event so that the print dialog is shown.
+     *
+     * You can connect to this signal and return %TRUE to cancel the print operation
+     * or implement your own print dialog.
+     *
+     * Returns: %TRUE to stop other handlers from being invoked for the event.
+     *    %FALSE to propagate the event further.
+     */
+    signals[PRINT_REQUESTED] =
+        g_signal_new("print-requested",
+                     G_TYPE_FROM_CLASS(webViewClass),
+                     G_SIGNAL_RUN_LAST,
+                     G_STRUCT_OFFSET(WebKitWebViewClass, print_requested),
+                     g_signal_accumulator_true_handled, 0,
+                     webkit_marshal_BOOLEAN__OBJECT,
+                     G_TYPE_BOOLEAN, 1,
+                     WEBKIT_TYPE_PRINT_OPERATION);
 }
 
 void webkitWebViewLoadChanged(WebKitWebView* webView, WebKitLoadEvent loadEvent)
@@ -726,6 +788,33 @@ void webkitWebViewMakePolicyDecision(WebKitWebView* webView, WebKitPolicyDecisio
     g_signal_emit(webView, signals[DECIDE_POLICY], 0, decision, type, &returnValue);
 }
 
+void webkitWebViewMouseTargetChanged(WebKitWebView* webView, WKHitTestResultRef wkHitTestResult, unsigned modifiers)
+{
+    WebKitWebViewPrivate* priv = webView->priv;
+    if (priv->mouseTargetHitTestResult
+        && priv->mouseTargetModifiers == modifiers
+        && webkitHitTestResultCompare(priv->mouseTargetHitTestResult.get(), wkHitTestResult))
+        return;
+
+    priv->mouseTargetModifiers = modifiers;
+    priv->mouseTargetHitTestResult = adoptGRef(webkitHitTestResultCreate(wkHitTestResult));
+    g_signal_emit(webView, signals[MOUSE_TARGET_CHANGED], 0, priv->mouseTargetHitTestResult.get(), modifiers);
+}
+
+void webkitWebViewPrintFrame(WebKitWebView* webView, WKFrameRef wkFrame)
+{
+    GRefPtr<WebKitPrintOperation> printOperation = adoptGRef(webkit_print_operation_new(webView));
+    gboolean returnValue;
+    g_signal_emit(webView, signals[PRINT_REQUESTED], 0, printOperation.get(), &returnValue);
+    if (returnValue)
+        return;
+
+    WebKitPrintOperationResponse response = webkitPrintOperationRunDialogForFrame(printOperation.get(), 0, toImpl(wkFrame));
+    if (response == WEBKIT_PRINT_OPERATION_RESPONSE_CANCEL)
+        return;
+    g_signal_connect(printOperation.leakRef(), "finished", G_CALLBACK(g_object_unref), 0);
+}
+
 /**
  * webkit_web_view_new:
  *
@@ -796,10 +885,14 @@ void webkit_web_view_load_uri(WebKitWebView* webView, const gchar* uri)
  * @base_uri: (allow-none): The base URI for relative locations or %NULL
  *
  * Load the given @content string with the specified @base_uri.
- * Relative URLs in the @content will be resolved against @base_uri.
- * When @base_uri is %NULL, it defaults to "about:blank". The mime type
- * of the document will be "text/html". You can monitor the load operation
- * by connecting to #WebKitWebView::load-changed signal.
+ * If @base_uri is not %NULL, relative URLs in the @content will be
+ * resolved against @base_uri and absolute local paths must be children of the @base_uri.
+ * For security reasons absolute local paths that are not children of @base_uri
+ * will cause the web process to terminate.
+ * If you need to include URLs in @content that are local paths in a different
+ * directory than @base_uri you can build a data URI for them. When @base_uri is %NULL,
+ * it defaults to "about:blank". The mime type of the document will be "text/html".
+ * You can monitor the load operation by connecting to #WebKitWebView::load-changed signal.
  */
 void webkit_web_view_load_html(WebKitWebView* webView, const gchar* content, const gchar* baseURI)
 {
diff --git a/Source/WebKit2/UIProcess/API/gtk/WebKitWebView.h b/Source/WebKit2/UIProcess/API/gtk/WebKitWebView.h
index d4768e3b6..a1b21420b 100644
--- a/Source/WebKit2/UIProcess/API/gtk/WebKitWebView.h
+++ b/Source/WebKit2/UIProcess/API/gtk/WebKitWebView.h
@@ -30,9 +30,10 @@
 
 #include <webkit2/WebKitBackForwardList.h>
 #include <webkit2/WebKitDefines.h>
-#include <webkit2/WebKitWebContext.h>
+#include <webkit2/WebKitHitTestResult.h>
 #include <webkit2/WebKitSettings.h>
 #include <webkit2/WebKitURIRequest.h>
+#include <webkit2/WebKitWebContext.h>
 #include <webkit2/WebKitWebViewBase.h>
 #include <webkit2/WebKitWindowProperties.h>
 #include <webkit2/WebKitPolicyDecision.h>
@@ -116,29 +117,34 @@ struct _WebKitWebView {
 struct _WebKitWebViewClass {
     WebKitWebViewBaseClass parent;
 
-    void       (* load_changed)   (WebKitWebView             *web_view,
-                                   WebKitLoadEvent            load_event);
-    gboolean   (* load_failed)    (WebKitWebView             *web_view,
-                                   WebKitLoadEvent            load_event,
-                                   const gchar               *failing_uri,
-                                   GError                    *error);
-
-    GtkWidget *(* create)         (WebKitWebView             *web_view);
-    void       (* ready_to_show)  (WebKitWebView             *web_view);
-    void       (* close)          (WebKitWebView             *web_view);
-
-    gboolean   (* script_alert)   (WebKitWebView             *web_view,
-                                   const gchar               *message);
-    gboolean   (* script_confirm) (WebKitWebView             *web_view,
-                                   const gchar               *message,
-                                   gboolean                  *confirmed);
-    gboolean   (* script_prompt)  (WebKitWebView             *web_view,
-                                   const gchar               *message,
-                                   const gchar               *default_text,
-                                   gchar                    **text);
-    gboolean   (* decide_policy)  (WebKitWebView             *web_view,
-                                   WebKitPolicyDecision      *decision,
-                                   WebKitPolicyDecisionType  type);
+    void       (* load_changed)         (WebKitWebView             *web_view,
+                                         WebKitLoadEvent            load_event);
+    gboolean   (* load_failed)          (WebKitWebView             *web_view,
+                                         WebKitLoadEvent            load_event,
+                                         const gchar               *failing_uri,
+                                         GError                    *error);
+
+    GtkWidget *(* create)               (WebKitWebView             *web_view);
+    void       (* ready_to_show)        (WebKitWebView             *web_view);
+    void       (* close)                (WebKitWebView             *web_view);
+
+    gboolean   (* script_alert)         (WebKitWebView             *web_view,
+                                         const gchar               *message);
+    gboolean   (* script_confirm)       (WebKitWebView             *web_view,
+                                         const gchar               *message,
+                                         gboolean                  *confirmed);
+    gboolean   (* script_prompt)        (WebKitWebView             *web_view,
+                                         const gchar               *message,
+                                         const gchar               *default_text,
+                                         gchar                    **text);
+    gboolean   (* decide_policy)        (WebKitWebView             *web_view,
+                                         WebKitPolicyDecision      *decision,
+                                         WebKitPolicyDecisionType   type);
+    void       (* mouse_target_changed) (WebKitWebView             *web_view,
+                                         WebKitHitTestResult       *hit_test_result,
+                                         guint                      modifiers);
+    gboolean   (* print_requested)      (WebKitWebView             *web_view,
+                                         WebKitPrintOperation      *print_operation);
 
     /* Padding for future expansion */
     void (*_webkit_reserved0) (void);
diff --git a/Source/WebKit2/UIProcess/API/gtk/WebKitWebViewPrivate.h b/Source/WebKit2/UIProcess/API/gtk/WebKitWebViewPrivate.h
index 66386d028..ad8ab2038 100644
--- a/Source/WebKit2/UIProcess/API/gtk/WebKitWebViewPrivate.h
+++ b/Source/WebKit2/UIProcess/API/gtk/WebKitWebViewPrivate.h
@@ -43,5 +43,7 @@ void webkitWebViewRunJavaScriptAlert(WebKitWebView*, const CString& message);
 bool webkitWebViewRunJavaScriptConfirm(WebKitWebView*, const CString& message);
 WKStringRef webkitWebViewRunJavaScriptPrompt(WebKitWebView*, const CString& message, const CString& defaultText);
 void webkitWebViewMakePolicyDecision(WebKitWebView*, WebKitPolicyDecisionType, WebKitPolicyDecision*);
+void webkitWebViewMouseTargetChanged(WebKitWebView*, WKHitTestResultRef, unsigned modifiers);
+void webkitWebViewPrintFrame(WebKitWebView*, WKFrameRef);
 
 #endif // WebKitWebViewPrivate_h
diff --git a/Source/WebKit2/UIProcess/API/gtk/WebKitWindowProperties.cpp b/Source/WebKit2/UIProcess/API/gtk/WebKitWindowProperties.cpp
index 413890203..242b753e8 100644
--- a/Source/WebKit2/UIProcess/API/gtk/WebKitWindowProperties.cpp
+++ b/Source/WebKit2/UIProcess/API/gtk/WebKitWindowProperties.cpp
@@ -377,7 +377,7 @@ void webkitWindowPropertiesSetResizable(WebKitWindowProperties* windowProperties
     if (windowProperties->priv->resizable == resizable)
         return;
     windowProperties->priv->resizable = resizable;
-    g_object_notify(G_OBJECT(windowProperties), "resizable-visible");
+    g_object_notify(G_OBJECT(windowProperties), "resizable");
 }
 
 void webkitWindowPropertiesSetFullscreen(WebKitWindowProperties* windowProperties, bool fullscreen)
diff --git a/Source/WebKit2/UIProcess/API/gtk/docs/webkit2gtk-docs.sgml b/Source/WebKit2/UIProcess/API/gtk/docs/webkit2gtk-docs.sgml
index af0cdae7c..5cd859dad 100644
--- a/Source/WebKit2/UIProcess/API/gtk/docs/webkit2gtk-docs.sgml
+++ b/Source/WebKit2/UIProcess/API/gtk/docs/webkit2gtk-docs.sgml
@@ -24,6 +24,8 @@
     <xi:include href="xml/WebKitPolicyDecision.xml"/>
     <xi:include href="xml/WebKitNavigationPolicyDecision.xml"/>
     <xi:include href="xml/WebKitResponsePolicyDecision.xml"/>
+    <xi:include href="xml/WebKitHitTestResult.xml"/>
+    <xi:include href="xml/WebKitPrintOperation.xml"/>
     <xi:include href="xml/WebKitError.xml"/>
   </chapter>
 
diff --git a/Source/WebKit2/UIProcess/API/gtk/docs/webkit2gtk-sections.txt b/Source/WebKit2/UIProcess/API/gtk/docs/webkit2gtk-sections.txt
index 52cd89ee7..5bfc129b2 100644
--- a/Source/WebKit2/UIProcess/API/gtk/docs/webkit2gtk-sections.txt
+++ b/Source/WebKit2/UIProcess/API/gtk/docs/webkit2gtk-sections.txt
@@ -218,6 +218,8 @@ webkit_settings_get_print_backgrounds
 webkit_settings_set_print_backgrounds
 webkit_settings_get_enable_webaudio
 webkit_settings_set_enable_webaudio
+webkit_settings_get_enable_webgl
+webkit_settings_set_enable_webgl
 
 <SUBSECTION Standard>
 WebKitSettingsClass
@@ -390,6 +392,60 @@ webkit_response_policy_decision_get_type
 </SECTION>
 
 <SECTION>
+<FILE>WebKitHitTestResult</FILE>
+WebKitHitTestResult
+WebKitHitTestResultContext
+webkit_hit_test_result_get_context
+webkit_hit_test_result_context_is_link
+webkit_hit_test_result_context_is_image
+webkit_hit_test_result_context_is_media
+webkit_hit_test_result_get_link_uri
+webkit_hit_test_result_get_link_title
+webkit_hit_test_result_get_link_label
+webkit_hit_test_result_get_image_uri
+webkit_hit_test_result_get_media_uri
+
+<SUBSECTION Standard>
+WebKitHitTestResultClass
+WEBKIT_TYPE_HIT_TEST_RESULT
+WEBKIT_HIT_TEST_RESULT
+WEBKIT_IS_HIT_TEST_RESULT
+WEBKIT_HIT_TEST_RESULT_CLASS
+WEBKIT_IS_HIT_TEST_RESULT_CLASS
+WEBKIT_HIT_TEST_RESULT_GET_CLASS
+
+<SUBSECTION Private>
+WebKitHitTestResultPrivate
+webkit_hit_test_result_get_type
+</SECTION>
+
+<SECTION>
+<FILE>WebKitPrintOperation</FILE>
+WebKitPrintOperation
+WebKitPrintOperationResponse
+webkit_print_operation_new
+webkit_print_operation_get_print_settings
+webkit_print_operation_set_print_settings
+webkit_print_operation_get_page_setup
+webkit_print_operation_set_page_setup
+webkit_print_operation_run_dialog
+webkit_print_operation_print
+
+<SUBSECTION Standard>
+WebKitPrintOperationClass
+WEBKIT_TYPE_PRINT_OPERATION
+WEBKIT_PRINT_OPERATION
+WEBKIT_IS_PRINT_OPERATION
+WEBKIT_PRINT_OPERATION_CLASS
+WEBKIT_IS_PRINT_OPERATION_CLASS
+WEBKIT_PRINT_OPERATION_GET_CLASS
+
+<SUBSECTION Private>
+WebKitPrintOperationPrivate
+webkit_print_operation_get_type
+</SECTION>
+
+<SECTION>
 <FILE>WebKitError</FILE>
 WEBKIT_NETWORK_ERROR
 WEBKIT_PLUGIN_ERROR
diff --git a/Source/WebKit2/UIProcess/API/gtk/tests/GNUmakefile.am b/Source/WebKit2/UIProcess/API/gtk/tests/GNUmakefile.am
index 7241b9980..35ece6845 100644
--- a/Source/WebKit2/UIProcess/API/gtk/tests/GNUmakefile.am
+++ b/Source/WebKit2/UIProcess/API/gtk/tests/GNUmakefile.am
@@ -1,3 +1,5 @@
+if ENABLE_WEBKIT2
+
 TEST_PROGS += \
 	Programs/WebKit2APITests/TestWebKitWebContext \
 	Programs/WebKit2APITests/TestWebKitWebView \
@@ -6,7 +8,8 @@ TEST_PROGS += \
 	Programs/WebKit2APITests/TestBackForwardList \
 	Programs/WebKit2APITests/TestDownloads \
 	Programs/WebKit2APITests/TestWebKitPolicyClient \
-	Programs/WebKit2APITests/TestWebViewEditor
+	Programs/WebKit2APITests/TestWebViewEditor \
+	Programs/WebKit2APITests/TestPrinting
 
 noinst_PROGRAMS += $(TEST_PROGS)
 
@@ -118,3 +121,11 @@ Programs_WebKit2APITests_TestWebViewEditor_SOURCES = \
 Programs_WebKit2APITests_TestWebViewEditor_CPPFLAGS = $(webkit2_tests_cppflags)
 Programs_WebKit2APITests_TestWebViewEditor_LDADD = $(webkit2_tests_ldadd)
 Programs_WebKit2APITests_TestWebViewEditor_LDFLAGS = $(webkit2_tests_ldflags)
+
+Programs_WebKit2APITests_TestPrinting_SOURCES = \
+        Source/WebKit2/UIProcess/API/gtk/tests/TestPrinting.cpp
+Programs_WebKit2APITests_TestPrinting_CPPFLAGS = $(webkit2_tests_cppflags) $(GTK_UNIX_PRINTING_CFLAGS)
+Programs_WebKit2APITests_TestPrinting_LDADD = $(webkit2_tests_ldadd) $(GTK_UNIX_PRINTING_LIBS)
+Programs_WebKit2APITests_TestPrinting_LDFLAGS = $(webkit2_tests_ldflags)
+
+endif # ENABLE_WEBKIT2
diff --git a/Source/WebKit2/UIProcess/API/gtk/tests/TestPrinting.cpp b/Source/WebKit2/UIProcess/API/gtk/tests/TestPrinting.cpp
new file mode 100644
index 000000000..1ddde0858
--- /dev/null
+++ b/Source/WebKit2/UIProcess/API/gtk/tests/TestPrinting.cpp
@@ -0,0 +1,152 @@
+/*
+ * Copyright (C) 2012 Igalia S.L.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2,1 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ */
+
+#include "config.h"
+#include "WebViewTest.h"
+#include <glib/gstdio.h>
+#include <wtf/gobject/GRefPtr.h>
+
+#ifdef HAVE_GTK_UNIX_PRINTING
+#include <gtk/gtkunixprint.h>
+#endif
+
+static char* kTempDirectory;
+
+static void testPrintOperationPrintSettings(WebViewTest* test, gconstpointer)
+{
+    GRefPtr<WebKitPrintOperation> printOperation = adoptGRef(webkit_print_operation_new(test->m_webView));
+    test->assertObjectIsDeletedWhenTestFinishes(G_OBJECT(printOperation.get()));
+
+    g_assert(!webkit_print_operation_get_print_settings(printOperation.get()));
+    g_assert(!webkit_print_operation_get_page_setup(printOperation.get()));
+
+    GRefPtr<GtkPrintSettings> printSettings = adoptGRef(gtk_print_settings_new());
+    test->assertObjectIsDeletedWhenTestFinishes(G_OBJECT(printSettings.get()));
+
+    GRefPtr<GtkPageSetup> pageSetup = adoptGRef(gtk_page_setup_new());
+    test->assertObjectIsDeletedWhenTestFinishes(G_OBJECT(pageSetup.get()));
+
+    webkit_print_operation_set_print_settings(printOperation.get(), printSettings.get());
+    webkit_print_operation_set_page_setup(printOperation.get(), pageSetup.get());
+
+    g_assert(webkit_print_operation_get_print_settings(printOperation.get()) == printSettings.get());
+    g_assert(webkit_print_operation_get_page_setup(printOperation.get()) == pageSetup.get());
+}
+
+static gboolean webViewPrintRequestedCallback(WebKitWebView* webView, WebKitPrintOperation* printOperation, WebViewTest* test)
+{
+    g_assert(webView == test->m_webView);
+
+    g_assert(WEBKIT_IS_PRINT_OPERATION(printOperation));
+    test->assertObjectIsDeletedWhenTestFinishes(G_OBJECT(printOperation));
+
+    g_assert(!webkit_print_operation_get_print_settings(printOperation));
+    g_assert(!webkit_print_operation_get_page_setup(printOperation));
+
+    g_main_loop_quit(test->m_mainLoop);
+
+    return TRUE;
+}
+
+static void testWebViewPrintRequested(WebViewTest* test, gconstpointer)
+{
+    g_signal_connect(test->m_webView, "print-requested", G_CALLBACK(webViewPrintRequestedCallback), test);
+    test->loadHtml("<html><body onLoad=\"print();\">WebKitGTK+ printing test</body></html>", 0);
+    g_main_loop_run(test->m_mainLoop);
+}
+
+#ifdef HAVE_GTK_UNIX_PRINTING
+static void testPrintOperationPrintLoadChanged(WebKitWebView*, WebKitLoadEvent loadEvent, WebViewTest* test)
+{
+    if (loadEvent != WEBKIT_LOAD_FINISHED)
+        return;
+    g_main_loop_quit(test->m_mainLoop);
+}
+
+static void testPrintOperationPrintFinished(WebKitPrintOperation* printOperation, WebViewTest* test)
+{
+    g_object_unref(printOperation);
+    g_main_loop_quit(test->m_mainLoop);
+}
+
+static gboolean testPrintOperationPrintPrinter(GtkPrinter* printer, gpointer userData)
+{
+    if (strcmp(gtk_printer_get_name(printer), "Print to File"))
+        return FALSE;
+
+    GtkPrinter** foundPrinter = static_cast<GtkPrinter**>(userData);
+    *foundPrinter = static_cast<GtkPrinter*>(g_object_ref(printer));
+    return TRUE;
+}
+
+static void testPrintOperationPrint(WebViewTest* test, gconstpointer)
+{
+    g_signal_connect(test->m_webView, "load-changed", G_CALLBACK(testPrintOperationPrintLoadChanged), test);
+    test->loadHtml("<html><body>WebKitGTK+ printing test</body></html>", 0);
+    g_main_loop_run(test->m_mainLoop);
+
+    GtkPrinter* printer = 0;
+    gtk_enumerate_printers(testPrintOperationPrintPrinter, &printer, 0, TRUE);
+    if (!printer) {
+        g_message("%s", "Cannot test WebKitPrintOperation/print: no suitable printer found");
+        return;
+    }
+
+    GOwnPtr<char> outputFilename(g_build_filename(kTempDirectory, "webkit-print.pdf", NULL));
+    GRefPtr<GFile> outputFile = adoptGRef(g_file_new_for_path(outputFilename.get()));
+    GOwnPtr<char> outputURI(g_file_get_uri(outputFile.get()));
+
+    GRefPtr<GtkPrintSettings> printSettings = adoptGRef(gtk_print_settings_new());
+    gtk_print_settings_set_printer(printSettings.get(), gtk_printer_get_name(printer));
+    gtk_print_settings_set(printSettings.get(), GTK_PRINT_SETTINGS_OUTPUT_URI, outputURI.get());
+    g_object_unref(printer);
+
+    GRefPtr<WebKitPrintOperation> printOperation = webkit_print_operation_new(test->m_webView);
+    test->assertObjectIsDeletedWhenTestFinishes(G_OBJECT(printOperation.get()));
+    g_signal_connect(printOperation.get(), "finished", G_CALLBACK(testPrintOperationPrintFinished), test);
+    webkit_print_operation_set_print_settings(printOperation.get(), printSettings.get());
+    webkit_print_operation_print(printOperation.get());
+    g_main_loop_run(test->m_mainLoop);
+
+    GRefPtr<GFileInfo> fileInfo = adoptGRef(g_file_query_info(outputFile.get(), G_FILE_ATTRIBUTE_STANDARD_SIZE","G_FILE_ATTRIBUTE_STANDARD_CONTENT_TYPE,
+                                                              static_cast<GFileQueryInfoFlags>(0), 0, 0));
+    g_assert(fileInfo.get());
+    g_assert_cmpint(g_file_info_get_size(fileInfo.get()), >, 0);
+    g_assert_cmpstr(g_file_info_get_content_type(fileInfo.get()), ==, "application/pdf");
+
+    g_file_delete(outputFile.get(), 0, 0);
+}
+#endif // HAVE_GTK_UNIX_PRINTING
+
+void beforeAll()
+{
+    kTempDirectory = g_dir_make_tmp("WebKit2Tests-XXXXXX", 0);
+    g_assert(kTempDirectory);
+
+    WebViewTest::add("WebKitPrintOperation", "printing-settings", testPrintOperationPrintSettings);
+    WebViewTest::add("WebKitWebView", "print-requested", testWebViewPrintRequested);
+#ifdef HAVE_GTK_UNIX_PRINTING
+    WebViewTest::add("WebKitPrintOperation", "print", testPrintOperationPrint);
+#endif
+}
+
+void afterAll()
+{
+    g_rmdir(kTempDirectory);
+}
diff --git a/Source/WebKit2/UIProcess/API/gtk/tests/TestWebKitSettings.cpp b/Source/WebKit2/UIProcess/API/gtk/tests/TestWebKitSettings.cpp
index 0ecea5604..a3ce7dece 100644
--- a/Source/WebKit2/UIProcess/API/gtk/tests/TestWebKitSettings.cpp
+++ b/Source/WebKit2/UIProcess/API/gtk/tests/TestWebKitSettings.cpp
@@ -194,6 +194,11 @@ static void testWebKitSettings(Test*, gconstpointer)
     webkit_settings_set_enable_webaudio(settings, TRUE);
     g_assert(webkit_settings_get_enable_webaudio(settings));
 
+    // WebGL is disabled by default.
+    g_assert(!webkit_settings_get_enable_webgl(settings));
+    webkit_settings_set_enable_webgl(settings, TRUE);
+    g_assert(webkit_settings_get_enable_webgl(settings));
+
     g_object_unref(G_OBJECT(settings));
 }
 
diff --git a/Source/WebKit2/UIProcess/API/gtk/tests/TestWebKitWebView.cpp b/Source/WebKit2/UIProcess/API/gtk/tests/TestWebKitWebView.cpp
index 3d59ee917..47da98eb3 100644
--- a/Source/WebKit2/UIProcess/API/gtk/tests/TestWebKitWebView.cpp
+++ b/Source/WebKit2/UIProcess/API/gtk/tests/TestWebKitWebView.cpp
@@ -267,15 +267,27 @@ public:
         return TRUE;
     }
 
+    static void mouseTargetChanged(WebKitWebView*, WebKitHitTestResult* hitTestResult, guint modifiers, UIClientTest* test)
+    {
+        g_assert(WEBKIT_IS_HIT_TEST_RESULT(hitTestResult));
+        test->assertObjectIsDeletedWhenTestFinishes(G_OBJECT(hitTestResult));
+
+        test->m_mouseTargetHitTestResult = hitTestResult;
+        test->m_mouseTargetModifiers = modifiers;
+        g_main_loop_quit(test->m_mainLoop);
+    }
+
     UIClientTest()
         : m_scriptType(Alert)
         , m_scriptDialogConfirmed(true)
+        , m_mouseTargetModifiers(0)
     {
         webkit_settings_set_javascript_can_open_windows_automatically(webkit_web_view_get_settings(m_webView), TRUE);
         g_signal_connect(m_webView, "create", G_CALLBACK(viewCreate), this);
         g_signal_connect(m_webView, "script-alert", G_CALLBACK(scriptAlert), this);
         g_signal_connect(m_webView, "script-confirm", G_CALLBACK(scriptConfirm), this);
         g_signal_connect(m_webView, "script-prompt", G_CALLBACK(scriptPrompt), this);
+        g_signal_connect(m_webView, "mouse-target-changed", G_CALLBACK(mouseTargetChanged), this);
     }
 
     ~UIClientTest()
@@ -293,11 +305,20 @@ public:
         m_windowProperties = windowProperties;
     }
 
+    WebKitHitTestResult* moveMouseAndWaitUntilMouseTargetChanged(int x, int y, unsigned int mouseModifiers = 0)
+    {
+        mouseMoveTo(x, y, mouseModifiers);
+        g_main_loop_run(m_mainLoop);
+        return m_mouseTargetHitTestResult.get();
+    }
+
     Vector<WebViewEvents> m_webViewEvents;
     ScriptType m_scriptType;
     bool m_scriptDialogConfirmed;
     WindowProperties m_windowProperties;
     HashSet<WTF::String> m_windowPropertiesChanged;
+    GRefPtr<WebKitHitTestResult> m_mouseTargetHitTestResult;
+    unsigned int m_mouseTargetModifiers;
 };
 
 static void testWebViewCreateReadyClose(UIClientTest* test, gconstpointer)
@@ -361,6 +382,66 @@ static void testWebViewWindowProperties(UIClientTest* test, gconstpointer)
     g_assert_cmpint(events[2], ==, UIClientTest::Close);
 }
 
+static void testWebViewMouseTarget(UIClientTest* test, gconstpointer)
+{
+    test->showInWindowAndWaitUntilMapped();
+
+    const char* linksHoveredHTML =
+        "<html><body>"
+        " <a style='position:absolute; left:1; top:1' href='http://www.webkitgtk.org' title='WebKitGTK+ Title'>WebKitGTK+ Website</a>"
+        " <img style='position:absolute; left:1; top:10' src='0xdeadbeef' width=5 height=5></img>"
+        " <a style='position:absolute; left:1; top:20' href='http://www.webkitgtk.org/logo' title='WebKitGTK+ Logo'><img src='0xdeadbeef' width=5 height=5></img></a>"
+        " <video style='position:absolute; left:1; top:30' width=10 height=10 controls='controls'><source src='movie.ogg' type='video/ogg' /></video>"
+        "</body></html>";
+
+    test->loadHtml(linksHoveredHTML, "file:///");
+    test->waitUntilLoadFinished();
+
+    // Move over link.
+    WebKitHitTestResult* hitTestResult = test->moveMouseAndWaitUntilMouseTargetChanged(1, 1);
+    g_assert(webkit_hit_test_result_context_is_link(hitTestResult));
+    g_assert(!webkit_hit_test_result_context_is_image(hitTestResult));
+    g_assert(!webkit_hit_test_result_context_is_media(hitTestResult));
+    g_assert_cmpstr(webkit_hit_test_result_get_link_uri(hitTestResult), ==, "http://www.webkitgtk.org/");
+    g_assert_cmpstr(webkit_hit_test_result_get_link_title(hitTestResult), ==, "WebKitGTK+ Title");
+    g_assert_cmpstr(webkit_hit_test_result_get_link_label(hitTestResult), ==, "WebKitGTK+ Website");
+    g_assert(!test->m_mouseTargetModifiers);
+
+    // Move out of the link.
+    hitTestResult = test->moveMouseAndWaitUntilMouseTargetChanged(0, 0);
+    g_assert(!webkit_hit_test_result_context_is_link(hitTestResult));
+    g_assert(!webkit_hit_test_result_context_is_image(hitTestResult));
+    g_assert(!webkit_hit_test_result_context_is_media(hitTestResult));
+    g_assert(!test->m_mouseTargetModifiers);
+
+    // Move over image with GDK_CONTROL_MASK.
+    hitTestResult = test->moveMouseAndWaitUntilMouseTargetChanged(1, 10, GDK_CONTROL_MASK);
+    g_assert(!webkit_hit_test_result_context_is_link(hitTestResult));
+    g_assert(webkit_hit_test_result_context_is_image(hitTestResult));
+    g_assert(!webkit_hit_test_result_context_is_media(hitTestResult));
+    g_assert_cmpstr(webkit_hit_test_result_get_image_uri(hitTestResult), ==, "file:///0xdeadbeef");
+    g_assert(test->m_mouseTargetModifiers & GDK_CONTROL_MASK);
+
+    // Move over image link.
+    hitTestResult = test->moveMouseAndWaitUntilMouseTargetChanged(1, 20);
+    g_assert(webkit_hit_test_result_context_is_link(hitTestResult));
+    g_assert(webkit_hit_test_result_context_is_image(hitTestResult));
+    g_assert(!webkit_hit_test_result_context_is_media(hitTestResult));
+    g_assert_cmpstr(webkit_hit_test_result_get_link_uri(hitTestResult), ==, "http://www.webkitgtk.org/logo");
+    g_assert_cmpstr(webkit_hit_test_result_get_image_uri(hitTestResult), ==, "file:///0xdeadbeef");
+    g_assert_cmpstr(webkit_hit_test_result_get_link_title(hitTestResult), ==, "WebKitGTK+ Logo");
+    g_assert(!webkit_hit_test_result_get_link_label(hitTestResult));
+    g_assert(!test->m_mouseTargetModifiers);
+
+    // Move over media.
+    hitTestResult = test->moveMouseAndWaitUntilMouseTargetChanged(1, 30);
+    g_assert(!webkit_hit_test_result_context_is_link(hitTestResult));
+    g_assert(!webkit_hit_test_result_context_is_image(hitTestResult));
+    g_assert(webkit_hit_test_result_context_is_media(hitTestResult));
+    g_assert_cmpstr(webkit_hit_test_result_get_media_uri(hitTestResult), ==, "file:///movie.ogg");
+    g_assert(!test->m_mouseTargetModifiers);
+}
+
 static void testWebViewZoomLevel(WebViewTest* test, gconstpointer)
 {
     g_assert_cmpfloat(webkit_web_view_get_zoom_level(test->m_webView), ==, 1);
@@ -377,6 +458,7 @@ void beforeAll()
     UIClientTest::add("WebKitWebView", "create-ready-close", testWebViewCreateReadyClose);
     UIClientTest::add("WebKitWebView", "javascript-dialogs", testWebViewJavaScriptDialogs);
     UIClientTest::add("WebKitWebView", "window-properties", testWebViewWindowProperties);
+    UIClientTest::add("WebKitWebView", "mouse-target", testWebViewMouseTarget);
     WebViewTest::add("WebKitWebView", "zoom-level", testWebViewZoomLevel);
 }
 
diff --git a/Source/WebKit2/UIProcess/API/gtk/tests/WebViewTest.cpp b/Source/WebKit2/UIProcess/API/gtk/tests/WebViewTest.cpp
index 20895eccb..00d3b3e20 100644
--- a/Source/WebKit2/UIProcess/API/gtk/tests/WebViewTest.cpp
+++ b/Source/WebKit2/UIProcess/API/gtk/tests/WebViewTest.cpp
@@ -21,15 +21,20 @@
 #include "config.h"
 #include "WebViewTest.h"
 
+#include <WebCore/GOwnPtrGtk.h>
+
 WebViewTest::WebViewTest()
     : m_webView(WEBKIT_WEB_VIEW(g_object_ref_sink(webkit_web_view_new())))
     , m_mainLoop(g_main_loop_new(0, TRUE))
+    , m_parentWindow(0)
 {
     assertObjectIsDeletedWhenTestFinishes(G_OBJECT(m_webView));
 }
 
 WebViewTest::~WebViewTest()
 {
+    if (m_parentWindow)
+        gtk_widget_destroy(m_parentWindow);
     g_object_unref(m_webView);
     g_main_loop_unref(m_mainLoop);
 }
@@ -130,3 +135,48 @@ void WebViewTest::waitUntilLoadFinished()
     g_signal_connect(m_webView, "load-changed", G_CALLBACK(loadChanged), this);
     g_main_loop_run(m_mainLoop);
 }
+
+static gboolean parentWindowMapped(GtkWidget* widget, GdkEvent*, WebViewTest* test)
+{
+    g_signal_handlers_disconnect_by_func(widget, reinterpret_cast<void*>(parentWindowMapped), test);
+    g_main_loop_quit(test->m_mainLoop);
+
+    return FALSE;
+}
+
+void WebViewTest::showInWindowAndWaitUntilMapped()
+{
+    g_assert(!m_parentWindow);
+    m_parentWindow = gtk_window_new(GTK_WINDOW_POPUP);
+    gtk_container_add(GTK_CONTAINER(m_parentWindow), GTK_WIDGET(m_webView));
+    gtk_widget_show(GTK_WIDGET(m_webView));
+
+    g_signal_connect(m_parentWindow, "map-event", G_CALLBACK(parentWindowMapped), this);
+    gtk_widget_show(m_parentWindow);
+    g_main_loop_run(m_mainLoop);
+}
+
+void WebViewTest::mouseMoveTo(int x, int y, unsigned int mouseModifiers)
+{
+    g_assert(m_parentWindow);
+    GtkWidget* viewWidget = GTK_WIDGET(m_webView);
+    g_assert(gtk_widget_get_realized(viewWidget));
+
+    GOwnPtr<GdkEvent> event(gdk_event_new(GDK_MOTION_NOTIFY));
+    event->motion.x = x;
+    event->motion.y = y;
+
+    event->motion.time = GDK_CURRENT_TIME;
+    event->motion.window = gtk_widget_get_window(viewWidget);
+    g_object_ref(event->motion.window);
+    event->button.device = gdk_device_manager_get_client_pointer(gdk_display_get_device_manager(gtk_widget_get_display(viewWidget)));
+    event->motion.state = mouseModifiers;
+    event->motion.axes = 0;
+
+    int xRoot, yRoot;
+    gdk_window_get_root_coords(gtk_widget_get_window(viewWidget), x, y, &xRoot, &yRoot);
+    event->motion.x_root = xRoot;
+    event->motion.y_root = yRoot;
+    gtk_main_do_event(event.get());
+}
+
diff --git a/Source/WebKit2/UIProcess/API/gtk/tests/WebViewTest.h b/Source/WebKit2/UIProcess/API/gtk/tests/WebViewTest.h
index 4ad6fa648..95a569cd6 100644
--- a/Source/WebKit2/UIProcess/API/gtk/tests/WebViewTest.h
+++ b/Source/WebKit2/UIProcess/API/gtk/tests/WebViewTest.h
@@ -42,10 +42,14 @@ public:
 
     void wait(double seconds);
     void waitUntilLoadFinished();
+    void showInWindowAndWaitUntilMapped();
+
+    void mouseMoveTo(int x, int y, unsigned int mouseModifiers = 0);
 
     WebKitWebView* m_webView;
     GMainLoop* m_mainLoop;
     CString m_activeURI;
+    GtkWidget* m_parentWindow;
 };
 
 #endif // WebViewTest_h
diff --git a/Source/WebKit2/UIProcess/API/gtk/webkit2.h b/Source/WebKit2/UIProcess/API/gtk/webkit2.h
index 78e53d508..f78b873a3 100644
--- a/Source/WebKit2/UIProcess/API/gtk/webkit2.h
+++ b/Source/WebKit2/UIProcess/API/gtk/webkit2.h
@@ -30,6 +30,8 @@
 #include <webkit2/WebKitEditingCommands.h>
 #include <webkit2/WebKitEnumTypes.h>
 #include <webkit2/WebKitError.h>
+#include <webkit2/WebKitHitTestResult.h>
+#include <webkit2/WebKitPrintOperation.h>
 #include <webkit2/WebKitSettings.h>
 #include <webkit2/WebKitURIRequest.h>
 #include <webkit2/WebKitURIResponse.h>
diff --git a/Source/WebKit2/UIProcess/API/gtk/webkit2marshal.list b/Source/WebKit2/UIProcess/API/gtk/webkit2marshal.list
index 5918d095a..77d269a75 100644
--- a/Source/WebKit2/UIProcess/API/gtk/webkit2marshal.list
+++ b/Source/WebKit2/UIProcess/API/gtk/webkit2marshal.list
@@ -10,5 +10,6 @@ BOOLEAN:UINT64
 BOOLEAN:VOID
 OBJECT:VOID
 VOID:ENUM
+VOID:OBJECT,UINT
 VOID:OBJECT,POINTER
 
diff --git a/Source/WebKit2/UIProcess/API/mac/WKView.mm b/Source/WebKit2/UIProcess/API/mac/WKView.mm
index 728f0e56f..d50a7269a 100644
--- a/Source/WebKit2/UIProcess/API/mac/WKView.mm
+++ b/Source/WebKit2/UIProcess/API/mac/WKView.mm
@@ -2561,6 +2561,9 @@ static void drawPageBackground(CGContextRef context, WebPageProxy* page, const I
         return;
     
     _data->_dragHasStarted = YES;
+    IntSize size([image size]);
+    size.scale(1.0 / _data->_page->deviceScaleFactor());
+    [image setSize:size];
     
     // The call to super could release this WKView.
     RetainPtr<WKView> protector(self);
diff --git a/Source/WebKit2/UIProcess/API/qt/qquickwebpage.cpp b/Source/WebKit2/UIProcess/API/qt/qquickwebpage.cpp
index 22c6703c4..d164a6b85 100644
--- a/Source/WebKit2/UIProcess/API/qt/qquickwebpage.cpp
+++ b/Source/WebKit2/UIProcess/API/qt/qquickwebpage.cpp
@@ -29,6 +29,7 @@
 #include <QtQuick/QQuickCanvas>
 #include <QtQuick/QSGGeometryNode>
 #include <QtQuick/QSGMaterial>
+#include <private/qsgrendernode_p.h>
 
 QQuickWebPage::QQuickWebPage(QQuickWebView* viewportItem)
     : QQuickItem(viewportItem)
@@ -97,7 +98,7 @@ void QQuickWebPagePrivate::paintToCurrentGLContext()
     transform.scale(contentsScale, contentsScale);
 
     float opacity = computeEffectiveOpacity(q);
-    QRectF clipRect = q->parentItem()->mapRectToScene(q->parentItem()->boundingRect());
+    QRectF clipRect = viewportItem->mapRectToScene(viewportItem->boundingRect());
 
     if (!clipRect.isValid())
         return;
@@ -109,57 +110,22 @@ void QQuickWebPagePrivate::paintToCurrentGLContext()
     drawingArea->paintToCurrentGLContext(transform, opacity, clipRect);
 }
 
-struct PageProxyMaterial;
-struct PageProxyNode;
-
-// FIXME: temporary until Qt Scenegraph will support custom painting.
-struct PageProxyMaterialShader : public QSGMaterialShader {
-    virtual void updateState(const RenderState& state, QSGMaterial* newMaterial, QSGMaterial* oldMaterial);
-    virtual char const* const* attributeNames() const
-    {
-        static char const* const attr[] = { "vertex", 0 };
-        return attr;
-    }
-
-    // vertexShader and fragmentShader are no-op shaders.
-    // All real painting is gone by TextureMapper through LayerTreeHostProxy.
-    virtual const char* vertexShader() const
-    {
-        return "attribute highp vec4 vertex; \n"
-               "void main() { gl_Position = vertex; }";
-    }
-
-    virtual const char* fragmentShader() const
-    {
-        return "void main() { gl_FragColor = vec4(0.0, 0.0, 0.0, 0.0); }";
-    }
-};
-
-struct PageProxyMaterial : public QSGMaterial {
-    PageProxyMaterial(PageProxyNode* node) : m_node(node) { }
-
-    QSGMaterialType* type() const
+struct PageProxyNode : public QSGRenderNode {
+    PageProxyNode(QQuickWebPagePrivate* page)
+        : m_pagePrivate(page)
     {
-        static QSGMaterialType type;
-        return &type;
     }
 
-    QSGMaterialShader* createShader() const
+    virtual StateFlags changedStates()
     {
-        return new PageProxyMaterialShader;
+        return StateFlags(DepthState) | StencilState | ScissorState | ColorState | BlendState
+               | CullState | ViewportState;
     }
 
-    PageProxyNode* m_node;
-};
-
-struct PageProxyNode : public QSGGeometryNode {
-    PageProxyNode(QQuickWebPagePrivate* page) :
-        m_pagePrivate(page)
-      , m_material(this)
-      , m_geometry(QSGGeometry::defaultAttributes_Point2D(), 4)
+    virtual void render(const RenderState &)
     {
-        setGeometry(&m_geometry);
-        setMaterial(&m_material);
+        if (m_pagePrivate)
+            m_pagePrivate->paintToCurrentGLContext();
     }
 
     ~PageProxyNode()
@@ -169,22 +135,8 @@ struct PageProxyNode : public QSGGeometryNode {
     }
 
     QQuickWebPagePrivate* m_pagePrivate;
-    PageProxyMaterial m_material;
-    QSGGeometry m_geometry;
 };
 
-void PageProxyMaterialShader::updateState(const RenderState& state, QSGMaterial* newMaterial, QSGMaterial* oldMaterial)
-{
-    if (!newMaterial)
-        return;
-
-    PageProxyNode* node = static_cast<PageProxyMaterial*>(newMaterial)->m_node;
-    // FIXME: Normally we wouldn't paint inside QSGMaterialShader::updateState,
-    // but this is a temporary hack until custom paint nodes are available.
-    if (node->m_pagePrivate)
-        node->m_pagePrivate->paintToCurrentGLContext();
-}
-
 QSGNode* QQuickWebPage::updatePaintNode(QSGNode* oldNode, UpdatePaintNodeData*)
 {
     if (!(flags() & ItemHasContents)) {
@@ -242,13 +194,15 @@ QTransform QQuickWebPage::transformFromItem() const
 
 QTransform QQuickWebPage::transformToItem() const
 {
-    return QTransform(d->contentsScale, 0, 0, 0, d->contentsScale, 0, x(), y(), 1);
+    QPointF pos = d->viewportItem->pageItemPos();
+    return QTransform(d->contentsScale, 0, 0, 0, d->contentsScale, 0, pos.x(), pos.y(), 1);
 }
 
 void QQuickWebPagePrivate::updateSize()
 {
     QSizeF scaledSize = contentsSize * contentsScale;
     q->setSize(scaledSize);
+    viewportItem->updateContentsSize(scaledSize);
 }
 
 void QQuickWebPagePrivate::resetPaintNode()
diff --git a/Source/WebKit2/UIProcess/API/qt/qquickwebview.cpp b/Source/WebKit2/UIProcess/API/qt/qquickwebview.cpp
index 7ea6d347c..f40e28924 100644
--- a/Source/WebKit2/UIProcess/API/qt/qquickwebview.cpp
+++ b/Source/WebKit2/UIProcess/API/qt/qquickwebview.cpp
@@ -51,6 +51,7 @@
 #include <WebCore/IntPoint.h>
 #include <WebCore/IntRect.h>
 #include <WKOpenPanelResultListener.h>
+#include <wtf/Assertions.h>
 #include <wtf/text/WTFString.h>
 
 using namespace WebCore;
@@ -66,12 +67,16 @@ static QQuickWebViewPrivate* createPrivateObject(QQuickWebView* publicObject)
 
 QQuickWebViewPrivate::QQuickWebViewPrivate(QQuickWebView* viewport)
     : q_ptr(viewport)
+    , flickProvider(0)
     , alertDialog(0)
     , confirmDialog(0)
     , promptDialog(0)
     , authenticationDialog(0)
     , certificateVerificationDialog(0)
     , itemSelector(0)
+    , proxyAuthenticationDialog(0)
+    , userDidOverrideContentWidth(false)
+    , userDidOverrideContentHeight(false)
     , m_navigatorQtObjectEnabled(false)
     , m_renderToOffscreenBuffer(false)
 {
@@ -112,6 +117,7 @@ void QQuickWebViewPrivate::initialize(WKContextRef contextRef, WKPageGroupRef pa
     // Any page setting should preferrable be set before creating the page.
     webPageProxy->pageGroup()->preferences()->setAcceleratedCompositingEnabled(true);
     webPageProxy->pageGroup()->preferences()->setForceCompositingMode(true);
+    webPageProxy->pageGroup()->preferences()->setFrameFlatteningEnabled(true);
 
     pageClient.initialize(q_ptr, pageViewPrivate->eventHandler.data(), &undoController);
     webPageProxy->initializeWebPage();
@@ -131,6 +137,12 @@ void QQuickWebViewPrivate::disableMouseEvents()
     q->setAcceptHoverEvents(false);
 }
 
+QPointF QQuickWebViewPrivate::pageItemPos()
+{
+    ASSERT(pageView);
+    return pageView->pos();
+}
+
 void QQuickWebViewPrivate::loadDidSucceed()
 {
     Q_Q(QQuickWebView);
@@ -200,14 +212,6 @@ void QQuickWebViewPrivate::handleDownloadRequest(DownloadProxy* download)
     context->downloadManager()->addDownload(download, downloadItem);
 }
 
-void QQuickWebViewPrivate::_q_viewportTrajectoryVectorChanged(const QPointF& trajectoryVector)
-{
-    DrawingAreaProxy* drawingArea = webPageProxy->drawingArea();
-    if (!drawingArea)
-        return;
-    drawingArea->setVisibleContentRectTrajectoryVector(trajectoryVector);
-}
-
 void QQuickWebViewPrivate::_q_onVisibleChanged()
 {
     webPageProxy->viewStateDidChange(WebPageProxy::ViewIsVisible);
@@ -301,6 +305,25 @@ void QQuickWebViewPrivate::handleAuthenticationRequiredRequest(const QString& ho
     password = dialogRunner.password();
 }
 
+void QQuickWebViewPrivate::handleProxyAuthenticationRequiredRequest(const QString& hostname, uint16_t port, const QString& prefilledUsername, QString& username, QString& password)
+{
+    if (!proxyAuthenticationDialog)
+        return;
+
+    Q_Q(QQuickWebView);
+    QtDialogRunner dialogRunner;
+    if (!dialogRunner.initForProxyAuthentication(proxyAuthenticationDialog, q, hostname, port, prefilledUsername))
+        return;
+
+    setViewInAttachedProperties(dialogRunner.dialog());
+    disableMouseEvents();
+    dialogRunner.exec();
+    enableMouseEvents();
+
+    username = dialogRunner.username();
+    password = dialogRunner.password();
+}
+
 bool QQuickWebViewPrivate::handleCertificateVerificationRequest(const QString& hostname)
 {
     if (!certificateVerificationDialog)
@@ -445,7 +468,7 @@ void QQuickWebViewLegacyPrivate::updateViewportSize()
     // The fixed layout is handled by the FrameView and the drawing area doesn't behave differently
     // whether its fixed or not. We still need to tell the drawing area which part of it
     // has to be rendered on tiles, and in desktop mode it's all of it.
-    webPageProxy->drawingArea()->setVisibleContentsRectAndScale(IntRect(IntPoint(), viewportSize), 1);
+    webPageProxy->drawingArea()->setVisibleContentsRectForScaling(IntRect(IntPoint(), viewportSize), 1);
 }
 
 QQuickWebViewFlickablePrivate::QQuickWebViewFlickablePrivate(QQuickWebView* viewport)
@@ -468,16 +491,52 @@ void QQuickWebViewFlickablePrivate::initialize(WKContextRef contextRef, WKPageGr
     webPageProxy->setUseFixedLayout(true);
 }
 
+QPointF QQuickWebViewFlickablePrivate::pageItemPos()
+{
+    // Flickable moves its contentItem so we need to take that position into account,
+    // as well as the potential displacement of the page on the contentItem because
+    // of additional QML items.
+    qreal xPos = flickProvider->contentItem()->x() + pageView->x();
+    qreal yPos = flickProvider->contentItem()->y() + pageView->y();
+    return QPointF(xPos, yPos);
+}
+
+void QQuickWebViewFlickablePrivate::updateContentsSize(const QSizeF& size)
+{
+    ASSERT(flickProvider);
+
+    // Make sure that the contentItem is sized to the page
+    // if the user did not add other flickable items in QML.
+    // If the user adds items in QML he has to make sure to
+    // also bind the contentWidth and contentHeight accordingly.
+    // This is in accordance with normal QML Flickable behaviour.
+    if (!userDidOverrideContentWidth)
+        flickProvider->setContentWidth(size.width());
+    if (!userDidOverrideContentHeight)
+        flickProvider->setContentHeight(size.height());
+}
+
 void QQuickWebViewFlickablePrivate::onComponentComplete()
 {
     Q_Q(QQuickWebView);
-    interactionEngine.reset(new QtViewportInteractionEngine(q, pageView.data()));
+
+    ASSERT(!flickProvider);
+    flickProvider = new QtFlickProvider(q, pageView.data());
+
+    // Propagate flickable signals.
+    const QQuickWebViewExperimental* experimental = q->experimental();
+    QObject::connect(flickProvider, SIGNAL(contentWidthChanged()), experimental, SIGNAL(contentWidthChanged()));
+    QObject::connect(flickProvider, SIGNAL(contentHeightChanged()), experimental, SIGNAL(contentHeightChanged()));
+    QObject::connect(flickProvider, SIGNAL(contentXChanged()), experimental, SIGNAL(contentXChanged()));
+    QObject::connect(flickProvider, SIGNAL(contentYChanged()), experimental, SIGNAL(contentYChanged()));
+
+    interactionEngine.reset(new QtViewportInteractionEngine(q, pageView.data(), flickProvider));
     pageView->eventHandler()->setViewportInteractionEngine(interactionEngine.data());
 
     QObject::connect(interactionEngine.data(), SIGNAL(contentSuspendRequested()), q, SLOT(_q_suspend()));
     QObject::connect(interactionEngine.data(), SIGNAL(contentResumeRequested()), q, SLOT(_q_resume()));
-    QObject::connect(interactionEngine.data(), SIGNAL(viewportTrajectoryVectorChanged(const QPointF&)), q, SLOT(_q_viewportTrajectoryVectorChanged(const QPointF&)));
-    QObject::connect(interactionEngine.data(), SIGNAL(visibleContentRectAndScaleChanged()), q, SLOT(_q_updateVisibleContentRectAndScale()));
+    QObject::connect(interactionEngine.data(), SIGNAL(contentWasMoved(const QPointF&)), q, SLOT(_q_commitPositionChange(const QPointF&)));
+    QObject::connect(interactionEngine.data(), SIGNAL(contentWasScaled()), q, SLOT(_q_commitScaleChange()));
 
     _q_resume();
 
@@ -533,15 +592,17 @@ void QQuickWebViewFlickablePrivate::updateViewportSize()
     if (viewportSize.isEmpty() || !interactionEngine)
         return;
 
+    flickProvider->setViewportSize(viewportSize);
+
     // Let the WebProcess know about the new viewport size, so that
     // it can resize the content accordingly.
     webPageProxy->setViewportSize(viewportSize);
 
     interactionEngine->applyConstraints(computeViewportConstraints());
-    _q_updateVisibleContentRectAndScale();
+    _q_commitScaleChange();
 }
 
-void QQuickWebViewFlickablePrivate::_q_updateVisibleContentRectAndScale()
+void QQuickWebViewFlickablePrivate::_q_commitScaleChange()
 {
     DrawingAreaProxy* drawingArea = webPageProxy->drawingArea();
     if (!drawingArea)
@@ -551,12 +612,31 @@ void QQuickWebViewFlickablePrivate::_q_updateVisibleContentRectAndScale()
     const QRectF visibleRectInCSSCoordinates = q->mapRectToWebContent(q->boundingRect()).intersected(pageView->boundingRect());
     float scale = pageView->contentsScale();
 
+    // This is only for our QML ViewportInfo debugging API.
+    q->experimental()->viewportInfo()->didUpdateCurrentScale();
+
     QRect alignedVisibleContentRect = visibleRectInCSSCoordinates.toAlignedRect();
-    drawingArea->setVisibleContentsRectAndScale(alignedVisibleContentRect, scale);
+    drawingArea->setVisibleContentsRectForScaling(alignedVisibleContentRect, scale);
+
+    webPageProxy->setFixedVisibleContentRect(alignedVisibleContentRect);
+}
+
+void QQuickWebViewPrivate::_q_commitPositionChange(const QPointF& trajectoryVector)
+{
+    DrawingAreaProxy* drawingArea = webPageProxy->drawingArea();
+    if (!drawingArea)
+        return;
+
+    Q_Q(QQuickWebView);
+    const QRectF visibleRectInCSSCoordinates = q->mapRectToWebContent(q->boundingRect()).intersected(pageView->boundingRect());
+
+    QRect alignedVisibleContentRect = visibleRectInCSSCoordinates.toAlignedRect();
+    drawingArea->setVisibleContentsRectForPanning(alignedVisibleContentRect, trajectoryVector);
+
+    if (!trajectoryVector.isNull())
+        return;
 
-    // FIXME: Once we support suspend and resume, this should be delayed until the page is active if the page is suspended.
     webPageProxy->setFixedVisibleContentRect(alignedVisibleContentRect);
-    q->experimental()->viewportInfo()->didUpdateCurrentScale();
 }
 
 void QQuickWebViewFlickablePrivate::_q_suspend()
@@ -576,7 +656,8 @@ void QQuickWebViewFlickablePrivate::_q_resume()
         postTransitionState->apply();
     }
 
-    _q_updateVisibleContentRectAndScale();
+    // FIXME: Revise this.
+    _q_commitScaleChange();
 }
 
 void QQuickWebViewFlickablePrivate::pageDidRequestScroll(const QPoint& pos)
@@ -794,6 +875,20 @@ void QQuickWebViewExperimental::setAuthenticationDialog(QDeclarativeComponent* a
     emit authenticationDialogChanged();
 }
 
+QDeclarativeComponent* QQuickWebViewExperimental::proxyAuthenticationDialog() const
+{
+    Q_D(const QQuickWebView);
+    return d->proxyAuthenticationDialog;
+}
+
+void QQuickWebViewExperimental::setProxyAuthenticationDialog(QDeclarativeComponent* proxyAuthenticationDialog)
+{
+    Q_D(QQuickWebView);
+    if (d->proxyAuthenticationDialog == proxyAuthenticationDialog)
+        return;
+    d->proxyAuthenticationDialog = proxyAuthenticationDialog;
+    emit proxyAuthenticationDialogChanged();
+}
 QDeclarativeComponent* QQuickWebViewExperimental::certificateVerificationDialog() const
 {
     Q_D(const QQuickWebView);
@@ -910,6 +1005,78 @@ QQuickWebPage* QQuickWebViewExperimental::page()
     return q_ptr->page();
 }
 
+QDeclarativeListProperty<QObject> QQuickWebViewExperimental::flickableData()
+{
+    Q_D(const QQuickWebView);
+    ASSERT(d->flickProvider);
+    return d->flickProvider->flickableData();
+}
+
+QQuickItem* QQuickWebViewExperimental::contentItem()
+{
+    Q_D(QQuickWebView);
+    ASSERT(d->flickProvider);
+    return d->flickProvider->contentItem();
+}
+
+qreal QQuickWebViewExperimental::contentWidth() const
+{
+    Q_D(const QQuickWebView);
+    ASSERT(d->flickProvider);
+    return d->flickProvider->contentWidth();
+}
+
+void QQuickWebViewExperimental::setContentWidth(qreal width)
+{
+    Q_D(QQuickWebView);
+    ASSERT(d->flickProvider);
+    d->userDidOverrideContentWidth = true;
+    d->flickProvider->setContentWidth(width);
+}
+
+qreal QQuickWebViewExperimental::contentHeight() const
+{
+    Q_D(const QQuickWebView);
+    ASSERT(d->flickProvider);
+    return d->flickProvider->contentHeight();
+}
+
+void QQuickWebViewExperimental::setContentHeight(qreal height)
+{
+    Q_D(QQuickWebView);
+    ASSERT(d->flickProvider);
+    d->userDidOverrideContentHeight = true;
+    d->flickProvider->setContentHeight(height);
+}
+
+qreal QQuickWebViewExperimental::contentX() const
+{
+    Q_D(const QQuickWebView);
+    ASSERT(d->flickProvider);
+    return d->flickProvider->contentX();
+}
+
+void QQuickWebViewExperimental::setContentX(qreal x)
+{
+    Q_D(QQuickWebView);
+    ASSERT(d->flickProvider);
+    d->flickProvider->setContentX(x);
+}
+
+qreal QQuickWebViewExperimental::contentY() const
+{
+    Q_D(const QQuickWebView);
+    ASSERT(d->flickProvider);
+    return d->flickProvider->contentY();
+}
+
+void QQuickWebViewExperimental::setContentY(qreal y)
+{
+    Q_D(QQuickWebView);
+    ASSERT(d->flickProvider);
+    d->flickProvider->setContentY(y);
+}
+
 QQuickWebView::QQuickWebView(QQuickItem* parent)
     : QQuickItem(parent)
     , d_ptr(createPrivateObject(this))
@@ -1071,6 +1238,8 @@ QVariant QQuickWebView::inputMethodQuery(Qt::InputMethodQuery property) const
         return QString(state.selectedText);
     case Qt::ImMaximumTextLength:
         return QVariant(); // No limit.
+    case Qt::ImHints:
+        return int(Qt::InputMethodHints(state.inputMethodHints));
     default:
         // Rely on the base implementation for ImEnabled, ImHints and ImPreferredLanguage.
         return QQuickItem::inputMethodQuery(property);
@@ -1225,6 +1394,7 @@ bool QQuickWebView::event(QEvent* ev)
     case QEvent::FocusOut:
     case QEvent::TouchBegin:
     case QEvent::TouchEnd:
+    case QEvent::TouchCancel:
     case QEvent::TouchUpdate:
         if (d->pageView->eventHandler()->handleEvent(ev))
             return true;
@@ -1256,4 +1426,16 @@ void QQuickWebView::loadHtml(const QString& html, const QUrl& baseUrl)
     d->webPageProxy->loadHTMLString(html, baseUrl.toString());
 }
 
+QPointF QQuickWebView::pageItemPos()
+{
+    Q_D(QQuickWebView);
+    return d->pageItemPos();
+}
+
+void QQuickWebView::updateContentsSize(const QSizeF& size)
+{
+    Q_D(QQuickWebView);
+    d->updateContentsSize(size);
+}
+
 #include "moc_qquickwebview_p.cpp"
diff --git a/Source/WebKit2/UIProcess/API/qt/qquickwebview_p.h b/Source/WebKit2/UIProcess/API/qt/qquickwebview_p.h
index 69f1cd81b..674c18fe7 100644
--- a/Source/WebKit2/UIProcess/API/qt/qquickwebview_p.h
+++ b/Source/WebKit2/UIProcess/API/qt/qquickwebview_p.h
@@ -76,6 +76,7 @@ class QWEBKIT_EXPORT QQuickWebView : public QQuickItem {
     Q_PROPERTY(bool canReload READ canReload NOTIFY navigationStateChanged FINAL)
     Q_ENUMS(NavigationRequestAction)
     Q_ENUMS(ErrorDomain)
+    Q_ENUMS(NavigationType)
 
 public:
     enum NavigationRequestAction {
@@ -89,6 +90,16 @@ public:
         HttpErrorDomain,
         DownloadErrorDomain
     };
+
+    enum NavigationType {
+        LinkClickedNavigation,
+        FormSubmittedNavigation,
+        BackForwardNavigation,
+        ReloadNavigation,
+        FormResubmittedNavigation,
+        OtherNavigation
+    };
+
     QQuickWebView(QQuickItem* parent = 0);
     virtual ~QQuickWebView();
 
@@ -116,6 +127,10 @@ public:
 
     static void platformInitialize(); // Only needed by WTR.
 
+    // Internal API used by WebPage.
+    void updateContentsSize(const QSizeF&);
+    QPointF pageItemPos();
+
 public Q_SLOTS:
     void load(const QUrl&);
     void loadHtml(const QString& html, const QUrl& baseUrl = QUrl());
@@ -168,8 +183,9 @@ private:
 
     Q_PRIVATE_SLOT(d_func(), void _q_suspend());
     Q_PRIVATE_SLOT(d_func(), void _q_resume());
-    Q_PRIVATE_SLOT(d_func(), void _q_viewportTrajectoryVectorChanged(const QPointF&));
-    Q_PRIVATE_SLOT(d_func(), void _q_updateVisibleContentRectAndScale());
+    Q_PRIVATE_SLOT(d_func(), void _q_commitPositionChange(const QPointF&));
+    Q_PRIVATE_SLOT(d_func(), void _q_commitScaleChange());
+
     Q_PRIVATE_SLOT(d_func(), void _q_onOpenPanelFilesSelected());
     Q_PRIVATE_SLOT(d_func(), void _q_onOpenPanelFinished(int result));
     Q_PRIVATE_SLOT(d_func(), void _q_onVisibleChanged());
@@ -209,11 +225,21 @@ QML_DECLARE_TYPEINFO(QQuickWebView, QML_HAS_ATTACHED_PROPERTIES)
 class QWEBKIT_EXPORT QQuickWebViewExperimental : public QObject {
     Q_OBJECT
     Q_PROPERTY(QQuickWebPage* page READ page CONSTANT FINAL)
+
+    // QML Flickable API.
+    Q_PROPERTY(qreal contentWidth READ contentWidth WRITE setContentWidth NOTIFY contentWidthChanged)
+    Q_PROPERTY(qreal contentHeight READ contentHeight WRITE setContentHeight NOTIFY contentHeightChanged)
+    Q_PROPERTY(qreal contentX READ contentX WRITE setContentX NOTIFY contentXChanged)
+    Q_PROPERTY(qreal contentY READ contentY WRITE setContentY NOTIFY contentYChanged)
+    Q_PROPERTY(QQuickItem* contentItem READ contentItem CONSTANT)
+    Q_PROPERTY(QDeclarativeListProperty<QObject> flickableData READ flickableData)
+
     Q_PROPERTY(QWebNavigationHistory* navigationHistory READ navigationHistory CONSTANT FINAL)
     Q_PROPERTY(QDeclarativeComponent* alertDialog READ alertDialog WRITE setAlertDialog NOTIFY alertDialogChanged)
     Q_PROPERTY(QDeclarativeComponent* confirmDialog READ confirmDialog WRITE setConfirmDialog NOTIFY confirmDialogChanged)
     Q_PROPERTY(QDeclarativeComponent* promptDialog READ promptDialog WRITE setPromptDialog NOTIFY promptDialogChanged)
     Q_PROPERTY(QDeclarativeComponent* authenticationDialog READ authenticationDialog WRITE setAuthenticationDialog NOTIFY authenticationDialogChanged)
+    Q_PROPERTY(QDeclarativeComponent* proxyAuthenticationDialog READ proxyAuthenticationDialog WRITE setProxyAuthenticationDialog NOTIFY proxyAuthenticationDialogChanged)
     Q_PROPERTY(QDeclarativeComponent* certificateVerificationDialog READ certificateVerificationDialog WRITE setCertificateVerificationDialog NOTIFY certificateVerificationDialogChanged)
     Q_PROPERTY(QDeclarativeComponent* itemSelector READ itemSelector WRITE setItemSelector NOTIFY itemSelectorChanged)
     Q_PROPERTY(QWebPreferences* preferences READ preferences CONSTANT FINAL)
@@ -241,6 +267,8 @@ public:
     void setCertificateVerificationDialog(QDeclarativeComponent*);
     QDeclarativeComponent* itemSelector() const;
     void setItemSelector(QDeclarativeComponent*);
+    QDeclarativeComponent* proxyAuthenticationDialog() const;
+    void setProxyAuthenticationDialog(QDeclarativeComponent*);
 
     QWebViewportInfo* viewportInfo();
 
@@ -253,9 +281,20 @@ public:
     static int schemeDelegates_Count(QDeclarativeListProperty<QQuickUrlSchemeDelegate>*);
     static void schemeDelegates_Clear(QDeclarativeListProperty<QQuickUrlSchemeDelegate>*);
     QDeclarativeListProperty<QQuickUrlSchemeDelegate> schemeDelegates();
+    QDeclarativeListProperty<QObject> flickableData();
     void invokeApplicationSchemeHandler(WTF::PassRefPtr<WebKit::QtRefCountedNetworkRequestData>);
     void sendApplicationSchemeReply(QQuickNetworkReply*);
 
+    QQuickItem* contentItem();
+    qreal contentWidth() const;
+    void setContentWidth(qreal);
+    qreal contentHeight() const;
+    void setContentHeight(qreal);
+    qreal contentX() const;
+    void setContentX(qreal);
+    qreal contentY() const;
+    void setContentY(qreal);
+
     // C++ only
     bool renderToOffscreenBuffer() const;
     void setRenderToOffscreenBuffer(bool enable);
@@ -268,6 +307,10 @@ public Q_SLOTS:
     void postMessage(const QString&);
 
 Q_SIGNALS:
+    void contentWidthChanged();
+    void contentHeightChanged();
+    void contentXChanged();
+    void contentYChanged();
     void alertDialogChanged();
     void confirmDialogChanged();
     void promptDialogChanged();
@@ -277,6 +320,7 @@ Q_SIGNALS:
     void downloadRequested(QWebDownloadItem* downloadItem);
     void permissionRequested(QWebPermissionRequest* permission);
     void messageReceived(const QVariantMap& message);
+    void proxyAuthenticationDialogChanged();
 
 private:
     QQuickWebView* q_ptr;
diff --git a/Source/WebKit2/UIProcess/API/qt/qquickwebview_p_p.h b/Source/WebKit2/UIProcess/API/qt/qquickwebview_p_p.h
index 9e27ce322..300b4759d 100644
--- a/Source/WebKit2/UIProcess/API/qt/qquickwebview_p_p.h
+++ b/Source/WebKit2/UIProcess/API/qt/qquickwebview_p_p.h
@@ -22,6 +22,7 @@
 #define qquickwebview_p_p_h
 
 #include "DrawingAreaProxy.h"
+#include "QtFlickProvider.h"
 #include "QtPageClient.h"
 #include "QtViewportInteractionEngine.h"
 #include "QtWebPageLoadClient.h"
@@ -68,6 +69,9 @@ public:
     void enableMouseEvents();
     void disableMouseEvents();
 
+    virtual QPointF pageItemPos();
+    virtual void updateContentsSize(const QSizeF&) { }
+
     virtual void loadDidSucceed();
     virtual void onComponentComplete() { }
     virtual void loadDidCommit() { }
@@ -80,11 +84,13 @@ public:
     virtual QtViewportInteractionEngine* viewportInteractionEngine() { return 0; }
     virtual void updateViewportSize() { }
     void updateTouchViewportSize();
-    virtual void _q_updateVisibleContentRectAndScale() { }
 
     virtual void _q_suspend() { }
     virtual void _q_resume() { }
-    void _q_viewportTrajectoryVectorChanged(const QPointF&);
+
+    virtual void _q_commitScaleChange() { }
+    void _q_commitPositionChange(const QPointF&);
+
     void _q_onOpenPanelFilesSelected();
     void _q_onOpenPanelFinished(int result);
     void _q_onVisibleChanged();
@@ -98,6 +104,7 @@ public:
 
     void handleAuthenticationRequiredRequest(const QString& hostname, const QString& realm, const QString& prefilledUsername, QString& username, QString& password);
     bool handleCertificateVerificationRequest(const QString& hostname);
+    void handleProxyAuthenticationRequiredRequest(const QString& hostname, uint16_t port, const QString& prefilledUsername, QString& username, QString& password);
 
     void setRenderToOffscreenBuffer(bool enable) { m_renderToOffscreenBuffer = enable; }
     void setViewInAttachedProperties(QObject*);
@@ -133,6 +140,7 @@ protected:
 
     QScopedPointer<QQuickWebPage> pageView;
     QQuickWebView* q_ptr;
+    QtFlickProvider* flickProvider;
 
     QDeclarativeComponent* alertDialog;
     QDeclarativeComponent* confirmDialog;
@@ -140,11 +148,14 @@ protected:
     QDeclarativeComponent* authenticationDialog;
     QDeclarativeComponent* certificateVerificationDialog;
     QDeclarativeComponent* itemSelector;
+    QDeclarativeComponent* proxyAuthenticationDialog;
 
     WebCore::ViewportArguments viewportArguments;
     QFileDialog* fileDialog;
     WKOpenPanelResultListenerRef openPanelResultListener;
 
+    bool userDidOverrideContentWidth;
+    bool userDidOverrideContentHeight;
     bool m_navigatorQtObjectEnabled;
     bool m_renderToOffscreenBuffer;
     QUrl m_iconURL;
@@ -166,6 +177,9 @@ public:
     virtual ~QQuickWebViewFlickablePrivate();
     virtual void initialize(WKContextRef contextRef = 0, WKPageGroupRef pageGroupRef = 0);
 
+    virtual QPointF pageItemPos();
+    virtual void updateContentsSize(const QSizeF&);
+
     virtual void loadDidSucceed();
     virtual void onComponentComplete();
     virtual void loadDidCommit();
@@ -173,9 +187,10 @@ public:
     virtual void didChangeViewportProperties(const WebCore::ViewportArguments& args);
     virtual QtViewportInteractionEngine* viewportInteractionEngine() { return interactionEngine.data(); }
     virtual void updateViewportSize();
-    virtual void _q_updateVisibleContentRectAndScale();
+
     virtual void _q_suspend();
     virtual void _q_resume();
+    virtual void _q_commitScaleChange();
 
     virtual void pageDidRequestScroll(const QPoint& pos);
     virtual void didChangeContentsSize(const QSize& newSize);
diff --git a/Source/WebKit2/UIProcess/API/qt/qtwebsecurityorigin.cpp b/Source/WebKit2/UIProcess/API/qt/qtwebsecurityorigin.cpp
new file mode 100644
index 000000000..4491dc40a
--- /dev/null
+++ b/Source/WebKit2/UIProcess/API/qt/qtwebsecurityorigin.cpp
@@ -0,0 +1,60 @@
+/*
+    Copyright (C) 2012 Nokia Corporation and/or its subsidiary(-ies)
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#include "config.h"
+#include "qtwebsecurityorigin_p.h"
+
+#include <QtCore/QFileInfo>
+#include <QtCore/QStringList>
+#include <SchemeRegistry.h>
+#include <SecurityOrigin.h>
+#include <WebKit2/WKBase.h>
+#include <WebKit2/WKRetainPtr.h>
+#include <WebKit2/WKSecurityOrigin.h>
+
+using namespace WebCore;
+
+QtWebSecurityOrigin::QtWebSecurityOrigin(QObject* parent)
+    : QObject(parent)
+{
+}
+
+QtWebSecurityOrigin::~QtWebSecurityOrigin()
+{
+}
+
+QString QtWebSecurityOrigin::host() const
+{
+    return m_url.host();
+}
+
+QString QtWebSecurityOrigin::scheme() const
+{
+    return m_url.scheme();
+}
+
+QString QtWebSecurityOrigin::path() const
+{
+    return m_url.path();
+}
+
+int QtWebSecurityOrigin::port() const
+{
+    return m_url.port();
+}
diff --git a/Source/WebKit2/UIProcess/API/qt/qtwebsecurityorigin_p.h b/Source/WebKit2/UIProcess/API/qt/qtwebsecurityorigin_p.h
new file mode 100644
index 000000000..df09fb8ea
--- /dev/null
+++ b/Source/WebKit2/UIProcess/API/qt/qtwebsecurityorigin_p.h
@@ -0,0 +1,57 @@
+/*
+    Copyright (C) 2012 Nokia Corporation and/or its subsidiary(-ies)
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+#ifndef qtwebsecurityorigin_p_h
+#define qtwebsecurityorigin_p_h
+
+#include "qwebkitglobal.h"
+
+#include <QtCore/QDataStream>
+#include <QtCore/QObject>
+#include <QtCore/QString>
+#include <QtCore/QUrl>
+#include <QtCore/qshareddata.h>
+
+class QWEBKIT_EXPORT QtWebSecurityOrigin : public QObject {
+    Q_OBJECT
+    Q_PROPERTY(QString scheme READ scheme CONSTANT)
+    Q_PROPERTY(QString host READ host CONSTANT)
+    Q_PROPERTY(int port READ port CONSTANT)
+    Q_PROPERTY(QString path READ path CONSTANT)
+
+public:
+    QtWebSecurityOrigin(QObject* parent = 0);
+    virtual ~QtWebSecurityOrigin();
+
+    QString scheme() const;
+    QString host() const;
+    int port() const;
+    QString path() const;
+
+    // Used to set security information in a permission request event (e.g.
+    // geolocation permission)
+    void setScheme(const QString& scheme) { m_url.setScheme(scheme); }
+    void setHost(const QString& host) { m_url.setHost(host); }
+    void setPath(const QString& path) { m_url.setPath(path); }
+    void setPort(int port) { m_url.setPort(port); }
+
+private:
+    QUrl m_url;
+};
+
+#endif // qtwebsecurityorigin_p_h
diff --git a/Source/WebKit2/UIProcess/API/qt/qwebnavigationrequest.cpp b/Source/WebKit2/UIProcess/API/qt/qwebnavigationrequest.cpp
index 5208a061c..3a63f80e3 100644
--- a/Source/WebKit2/UIProcess/API/qt/qwebnavigationrequest.cpp
+++ b/Source/WebKit2/UIProcess/API/qt/qwebnavigationrequest.cpp
@@ -25,12 +25,14 @@
 
 class QWebNavigationRequestPrivate {
 public:
-    QWebNavigationRequestPrivate(const QUrl& url, const QUrl& originatingUrl, Qt::MouseButton button, Qt::KeyboardModifiers modifiers)
+    QWebNavigationRequestPrivate(const QUrl& url, const QUrl& originatingUrl, Qt::MouseButton button,
+                                 Qt::KeyboardModifiers modifiers, QQuickWebView::NavigationType navigationType)
         : url(url)
         , originatingUrl(originatingUrl)
         , button(button)
         , modifiers(modifiers)
         , action(QQuickWebView::AcceptRequest)
+        , navigationType(navigationType)
     {
     }
 
@@ -43,11 +45,13 @@ public:
     Qt::MouseButton button;
     Qt::KeyboardModifiers modifiers;
     int action;
+    QQuickWebView::NavigationType navigationType;
 };
 
-QWebNavigationRequest::QWebNavigationRequest(const QUrl& url, const QUrl& originatingUrl, Qt::MouseButton button, Qt::KeyboardModifiers modifiers, QObject* parent)
+QWebNavigationRequest::QWebNavigationRequest(const QUrl& url, const QUrl& originatingUrl, Qt::MouseButton button,
+                                             Qt::KeyboardModifiers modifiers, QQuickWebView::NavigationType navigationType, QObject* parent)
     : QObject(parent)
-    , d(new QWebNavigationRequestPrivate(url, originatingUrl, button, modifiers))
+    , d(new QWebNavigationRequestPrivate(url, originatingUrl, button, modifiers, navigationType))
 {
 }
 
@@ -90,3 +94,7 @@ int QWebNavigationRequest::action() const
     return int(d->action);
 }
 
+QQuickWebView::NavigationType QWebNavigationRequest::navigationType() const
+{
+    return d->navigationType;
+}
diff --git a/Source/WebKit2/UIProcess/API/qt/qwebnavigationrequest_p.h b/Source/WebKit2/UIProcess/API/qt/qwebnavigationrequest_p.h
index 986b1c12d..46333f0e8 100644
--- a/Source/WebKit2/UIProcess/API/qt/qwebnavigationrequest_p.h
+++ b/Source/WebKit2/UIProcess/API/qt/qwebnavigationrequest_p.h
@@ -20,6 +20,7 @@
 #ifndef qwebnavigationrequest_p_h
 #define qwebnavigationrequest_p_h
 
+#include "qquickwebview_p.h"
 #include "qwebkitglobal.h"
 
 #include <QtCore/QObject>
@@ -34,9 +35,11 @@ class QWEBKIT_EXPORT QWebNavigationRequest : public QObject {
     Q_PROPERTY(int button READ button CONSTANT FINAL)
     Q_PROPERTY(int modifiers READ modifiers CONSTANT FINAL)
     Q_PROPERTY(int action READ action WRITE setAction NOTIFY actionChanged FINAL)
+    Q_PROPERTY(QQuickWebView::NavigationType navigationType READ navigationType CONSTANT FINAL)
 
 public:
-    QWebNavigationRequest(const QUrl& url, const QUrl& originatingUrl, Qt::MouseButton button, Qt::KeyboardModifiers modifiers, QObject* parent = 0);
+    QWebNavigationRequest(const QUrl& url, const QUrl& originatingUrl, Qt::MouseButton button, Qt::KeyboardModifiers modifiers,
+                          QQuickWebView::NavigationType navigationType, QObject* parent = 0);
     ~QWebNavigationRequest();
 
     QUrl url() const;
@@ -46,6 +49,7 @@ public:
     int action() const;
 
     void setAction(int action);
+    QQuickWebView::NavigationType navigationType() const;
 
 Q_SIGNALS:
     void actionChanged();
diff --git a/Source/WebKit2/UIProcess/API/qt/qwebpermissionrequest.cpp b/Source/WebKit2/UIProcess/API/qt/qwebpermissionrequest.cpp
index 16a438560..c4c1af825 100644
--- a/Source/WebKit2/UIProcess/API/qt/qwebpermissionrequest.cpp
+++ b/Source/WebKit2/UIProcess/API/qt/qwebpermissionrequest.cpp
@@ -34,7 +34,15 @@ public:
         , request(permissionRequest)
         , allow(false)
     {
+        WKRetainPtr<WKStringRef> url = adoptWK(WKSecurityOriginCopyProtocol(origin.get()));
+        securityInfo.setScheme(WKStringCopyQString(url.get()));
+
+        WKRetainPtr<WKStringRef> host = adoptWK(WKSecurityOriginCopyHost(origin.get()));
+        securityInfo.setHost(WKStringCopyQString(host.get()));
+
+        securityInfo.setPort(static_cast<int>(WKSecurityOriginGetPort(origin.get())));
     }
+
     ~QWebPermissionRequestPrivate()
     {
     }
@@ -42,6 +50,7 @@ public:
     WKRetainPtr<WKSecurityOriginRef> origin;
     QWebPermissionRequest::RequestType type;
     WKRetainPtr<WKGeolocationPermissionRequestRef> request;
+    QtWebSecurityOrigin securityInfo;
     bool allow;
 };
 
@@ -88,19 +97,8 @@ bool QWebPermissionRequest::allow() const
     return d->allow;
 }
 
-QString QWebPermissionRequest::scheme() const
-{
-    WKRetainPtr<WKStringRef> url = adoptWK(WKSecurityOriginCopyProtocol(d->origin.get()));
-    return WKStringCopyQString(url.get());
-}
-
-QString QWebPermissionRequest::host() const
+QtWebSecurityOrigin* QWebPermissionRequest::securityOrigin()
 {
-    WKRetainPtr<WKStringRef> origin = adoptWK(WKSecurityOriginCopyHost(d->origin.get()));
-    return WKStringCopyQString(origin.get());
+    return &(d->securityInfo);
 }
 
-int QWebPermissionRequest::port() const
-{
-    return static_cast<int>(WKSecurityOriginGetPort(d->origin.get()));
-}
diff --git a/Source/WebKit2/UIProcess/API/qt/qwebpermissionrequest_p.h b/Source/WebKit2/UIProcess/API/qt/qwebpermissionrequest_p.h
index 5824c4ccd..4708b71a6 100644
--- a/Source/WebKit2/UIProcess/API/qt/qwebpermissionrequest_p.h
+++ b/Source/WebKit2/UIProcess/API/qt/qwebpermissionrequest_p.h
@@ -20,6 +20,7 @@
 #ifndef qwebpermissionrequest_p_h
 #define qwebpermissionrequest_p_h
 
+#include "qtwebsecurityorigin_p.h"
 #include "qwebkitglobal.h"
 
 #include <QtCore/QObject>
@@ -32,10 +33,8 @@ class QWebPermissionRequestPrivate;
 class QWEBKIT_EXPORT QWebPermissionRequest : public QObject {
     Q_OBJECT
     Q_PROPERTY(bool allow READ allow WRITE setAllow)
-    Q_PROPERTY(RequestType type READ type)
-    Q_PROPERTY(QString scheme READ scheme)
-    Q_PROPERTY(QString host READ host)
-    Q_PROPERTY(int port READ port)
+    Q_PROPERTY(RequestType type READ type CONSTANT)
+    Q_PROPERTY(QtWebSecurityOrigin* origin READ securityOrigin)
     Q_ENUMS(RequestType)
 
 public:
@@ -48,12 +47,10 @@ public:
 
     RequestType type() const;
     bool allow() const;
-    QString scheme() const;
-    QString host() const;
-    int port() const;
 
 public Q_SLOTS:
     void setAllow(bool);
+    QtWebSecurityOrigin* securityOrigin();
 
 private:
     friend class QWebPermissionRequestPrivate;
diff --git a/Source/WebKit2/UIProcess/API/qt/qwebpreferences.cpp b/Source/WebKit2/UIProcess/API/qt/qwebpreferences.cpp
index 71c11afe5..835c698db 100644
--- a/Source/WebKit2/UIProcess/API/qt/qwebpreferences.cpp
+++ b/Source/WebKit2/UIProcess/API/qt/qwebpreferences.cpp
@@ -54,6 +54,8 @@ bool QWebPreferencesPrivate::testAttribute(QWebPreferencesPrivate::WebAttribute
         return WKPreferencesGetPrivateBrowsingEnabled(preferencesRef());
     case DnsPrefetchEnabled:
         return WKPreferencesGetDNSPrefetchingEnabled(preferencesRef());
+    case FrameFlatteningEnabled:
+        return WKPreferencesGetFrameFlatteningEnabled(preferencesRef());
     default:
         ASSERT_NOT_REACHED();
         return false;
@@ -87,6 +89,9 @@ void QWebPreferencesPrivate::setAttribute(QWebPreferencesPrivate::WebAttribute a
     case DnsPrefetchEnabled:
         WKPreferencesSetDNSPrefetchingEnabled(preferencesRef(), enable);
         break;
+    case FrameFlatteningEnabled:
+        WKPreferencesSetFrameFlatteningEnabled(preferencesRef(), enable);
+        break;
     default:
         ASSERT_NOT_REACHED();
     }
@@ -293,6 +298,17 @@ void QWebPreferences::setNavigatorQtObjectEnabled(bool enable)
     emit navigatorQtObjectEnabledChanged();
 }
 
+bool QWebPreferences::frameFlatteningEnabled() const
+{
+    return d->testAttribute(QWebPreferencesPrivate::FrameFlatteningEnabled);
+}
+
+void QWebPreferences::setFrameFlatteningEnabled(bool enable)
+{
+    d->setAttribute(QWebPreferencesPrivate::FrameFlatteningEnabled, enable);
+    emit frameFlatteningEnabledChanged();
+}
+
 QString QWebPreferences::standardFontFamily() const
 {
     return d->fontFamily(QWebPreferencesPrivate::StandardFont);
diff --git a/Source/WebKit2/UIProcess/API/qt/qwebpreferences_p.h b/Source/WebKit2/UIProcess/API/qt/qwebpreferences_p.h
index 29df04cea..82b738fbf 100644
--- a/Source/WebKit2/UIProcess/API/qt/qwebpreferences_p.h
+++ b/Source/WebKit2/UIProcess/API/qt/qwebpreferences_p.h
@@ -40,6 +40,7 @@ public:
     Q_PROPERTY(bool privateBrowsingEnabled READ privateBrowsingEnabled WRITE setPrivateBrowsingEnabled NOTIFY privateBrowsingEnabledChanged FINAL)
     Q_PROPERTY(bool dnsPrefetchEnabled READ dnsPrefetchEnabled WRITE setDnsPrefetchEnabled NOTIFY dnsPrefetchEnabledChanged FINAL)
     Q_PROPERTY(bool navigatorQtObjectEnabled READ navigatorQtObjectEnabled WRITE setNavigatorQtObjectEnabled NOTIFY navigatorQtObjectEnabledChanged FINAL)
+    Q_PROPERTY(bool frameFlatteningEnabled READ frameFlatteningEnabled WRITE setFrameFlatteningEnabled NOTIFY frameFlatteningEnabledChanged FINAL)
 
     Q_PROPERTY(QString standardFontFamily READ standardFontFamily WRITE setStandardFontFamily NOTIFY standardFontFamilyChanged FINAL)
     Q_PROPERTY(QString fixedFontFamily READ fixedFontFamily WRITE setFixedFontFamily NOTIFY fixedFontFamilyChanged FINAL)
@@ -79,6 +80,9 @@ public:
     bool navigatorQtObjectEnabled() const;
     void setNavigatorQtObjectEnabled(bool);
 
+    bool frameFlatteningEnabled() const;
+    void setFrameFlatteningEnabled(bool enable);
+
     QString standardFontFamily() const;
     void setStandardFontFamily(const QString& family);
 
@@ -116,6 +120,7 @@ Q_SIGNALS:
     void privateBrowsingEnabledChanged();
     void dnsPrefetchEnabledChanged();
     void navigatorQtObjectEnabledChanged();
+    void frameFlatteningEnabledChanged();
 
     void standardFontFamilyChanged();
     void fixedFontFamilyChanged();
diff --git a/Source/WebKit2/UIProcess/API/qt/tests/bytearraytestdata.h b/Source/WebKit2/UIProcess/API/qt/tests/bytearraytestdata.h
index 7170f6594..f7838f072 100644
--- a/Source/WebKit2/UIProcess/API/qt/tests/bytearraytestdata.h
+++ b/Source/WebKit2/UIProcess/API/qt/tests/bytearraytestdata.h
@@ -33,6 +33,7 @@ class QWEBKIT_EXPORT ByteArrayTestData : public QObject {
 
 public:
     ByteArrayTestData(QObject* parent = 0);
+    virtual ~ByteArrayTestData() { }
     QVariant latin1Data() const;
     QVariant utf8Data() const;
 
diff --git a/Source/WebKit2/UIProcess/API/qt/tests/publicapi/tst_publicapi.cpp b/Source/WebKit2/UIProcess/API/qt/tests/publicapi/tst_publicapi.cpp
index f1a81bc18..3ad4729a9 100644
--- a/Source/WebKit2/UIProcess/API/qt/tests/publicapi/tst_publicapi.cpp
+++ b/Source/WebKit2/UIProcess/API/qt/tests/publicapi/tst_publicapi.cpp
@@ -43,6 +43,12 @@ static QStringList expectedAPI = QStringList()
     << "QQuickWebView.NetworkErrorDomain --> ErrorDomain"
     << "QQuickWebView.HttpErrorDomain --> ErrorDomain"
     << "QQuickWebView.DownloadErrorDomain --> ErrorDomain"
+    << "QQuickWebView.LinkClickedNavigation --> NavigationType"
+    << "QQuickWebView.FormSubmittedNavigation --> NavigationType"
+    << "QQuickWebView.BackForwardNavigation --> NavigationType"
+    << "QQuickWebView.ReloadNavigation --> NavigationType"
+    << "QQuickWebView.FormResubmittedNavigation --> NavigationType"
+    << "QQuickWebView.OtherNavigation --> NavigationType"
     << "QQuickWebView.title --> QString"
     << "QQuickWebView.url --> QUrl"
     << "QQuickWebView.icon --> QUrl"
@@ -73,6 +79,7 @@ static QStringList expectedAPI = QStringList()
     << "QWebNavigationRequest.button --> int"
     << "QWebNavigationRequest.modifiers --> int"
     << "QWebNavigationRequest.action --> int"
+    << "QWebNavigationRequest.navigationType --> QQuickWebView::NavigationType"
     << "QWebNavigationRequest.actionChanged() --> void"
     ;
 
diff --git a/Source/WebKit2/UIProcess/API/qt/tests/qmltests/WebView.pro b/Source/WebKit2/UIProcess/API/qt/tests/qmltests/WebView.pro
index 8cd15ff4d..7f4e3d12f 100644
--- a/Source/WebKit2/UIProcess/API/qt/tests/qmltests/WebView.pro
+++ b/Source/WebKit2/UIProcess/API/qt/tests/qmltests/WebView.pro
@@ -27,4 +27,5 @@ OTHER_FILES += \
     WebView/tst_preferences.qml \
     WebView/tst_properties.qml \
     WebView/tst_titleChanged.qml \
-    WebView/tst_applicationScheme.qml
+    WebView/tst_applicationScheme.qml \
+    WebView/tst_origin.qml
diff --git a/Source/WebKit2/UIProcess/API/qt/tests/qmltests/WebView/tst_origin.qml b/Source/WebKit2/UIProcess/API/qt/tests/qmltests/WebView/tst_origin.qml
new file mode 100644
index 000000000..70745d8d6
--- /dev/null
+++ b/Source/WebKit2/UIProcess/API/qt/tests/qmltests/WebView/tst_origin.qml
@@ -0,0 +1,57 @@
+import QtQuick 2.0
+import QtTest 1.0
+import QtWebKit 3.0
+import QtWebKit.experimental 1.0
+
+WebView {
+    id: webView
+    width: 200
+    height: 200
+
+    property bool success: true
+    property int port: 0
+    property string scheme: "file"
+
+    SignalSpy {
+        id: spy
+        target: experimental
+        signalName: "permissionRequested"
+    }
+
+    experimental.onPermissionRequested: {
+        if (permission.origin.port != webView.port) {
+            console.log("Expected port value should be zero.")
+            webView.success = false
+        }
+
+        if (permission.origin.scheme != webView.scheme) {
+            console.log("Expected scheme should be \"file\".")
+            webView.success = false
+        }
+    }
+
+    TestCase {
+        name: "WebViewSecurityOrigin"
+
+        // Delayed windowShown to workaround problems with Qt5 in debug mode.
+        when: false
+        Timer {
+            running: parent.windowShown
+            repeat: false
+            interval: 1
+            onTriggered: parent.when = true
+        }
+
+        function init() {
+            spy.clear()
+        }
+
+        function test_permissionRequest() {
+            compare(spy.count, 0)
+            webView.load(Qt.resolvedUrl("../common/geolocation.html"))
+            spy.wait()
+            compare(spy.count, 1)
+            compare(webView.success, true)
+        }
+    }
+}
diff --git a/Source/WebKit2/UIProcess/API/qt/tests/qmltests/tst_qmltests.cpp b/Source/WebKit2/UIProcess/API/qt/tests/qmltests/tst_qmltests.cpp
index a80c5c389..bcc246db4 100644
--- a/Source/WebKit2/UIProcess/API/qt/tests/qmltests/tst_qmltests.cpp
+++ b/Source/WebKit2/UIProcess/API/qt/tests/qmltests/tst_qmltests.cpp
@@ -21,9 +21,9 @@
 #include "../util.h"
 
 #include "qquickwebview_p.h"
+#include <QGuiApplication>
 #include <QVarLengthArray>
 #include <QtQuickTest/quicktest.h>
-#include <QtWidgets/QApplication>
 
 int main(int argc, char** argv)
 {
@@ -42,7 +42,7 @@ int main(int argc, char** argv)
 
     // Instantiate QApplication to prevent quick_test_main to instantiate a QGuiApplication.
     // This can be removed as soon as we do not use QtWidgets any more.
-    QApplication app(argc, argv);
+    QGuiApplication app(argc, argv);
     qmlRegisterType<ByteArrayTestData>("Test", 1, 0, "ByteArrayTestData");
 
 #ifdef DISABLE_FLICKABLE_VIEWPORT
diff --git a/Source/WebKit2/UIProcess/API/qt/tests/qquickwebview/tst_qquickwebview.cpp b/Source/WebKit2/UIProcess/API/qt/tests/qquickwebview/tst_qquickwebview.cpp
index db3f9c977..12886b314 100644
--- a/Source/WebKit2/UIProcess/API/qt/tests/qquickwebview/tst_qquickwebview.cpp
+++ b/Source/WebKit2/UIProcess/API/qt/tests/qquickwebview/tst_qquickwebview.cpp
@@ -352,11 +352,11 @@ void tst_QQuickWebView::scrollRequest()
     // COMPARE with the position requested in the html
     // Use qRound as that is also used when calculating the position
     // in WebKit.
-    int y = -qRound(50 * webView()->page()->contentsScale());
-    QVERIFY(webView()->page()->pos().y() == y);
+    int y = qRound(50 * webView()->page()->contentsScale());
+    QVERIFY(webView()->experimental()->contentY() == y);
 }
 
-QTWEBKIT_API_TEST_MAIN(tst_QQuickWebView)
+QTEST_MAIN(tst_QQuickWebView)
 
 #include "tst_qquickwebview.moc"
 
diff --git a/Source/WebKit2/UIProcess/API/qt/tests/tests.pri b/Source/WebKit2/UIProcess/API/qt/tests/tests.pri
index ed91d3942..faf445397 100644
--- a/Source/WebKit2/UIProcess/API/qt/tests/tests.pri
+++ b/Source/WebKit2/UIProcess/API/qt/tests/tests.pri
@@ -9,7 +9,7 @@ SOURCES += ../util.cpp \
            ../bytearraytestdata.cpp
 INCLUDEPATH += $$PWD
 
-QT += testlib declarative widgets quick
+QT += testlib declarative quick
 
 CONFIG += qtwebkit
 
diff --git a/Source/WebKit2/UIProcess/API/qt/tests/util.h b/Source/WebKit2/UIProcess/API/qt/tests/util.h
index 007964fe5..1c052bc9a 100644
--- a/Source/WebKit2/UIProcess/API/qt/tests/util.h
+++ b/Source/WebKit2/UIProcess/API/qt/tests/util.h
@@ -29,13 +29,3 @@
 void addQtWebProcessToPath();
 bool waitForSignal(QObject*, const char* signal, int timeout = 10000);
 void suppressDebugOutput();
-
-#define QTWEBKIT_API_TEST_MAIN(TestObject) \
-int main(int argc, char** argv) \
-{ \
-    suppressDebugOutput(); \
-    QApplication app(argc, argv); \
-    QTEST_DISABLE_KEYPAD_NAVIGATION \
-    TestObject tc; \
-    return QTest::qExec(&tc, argc, argv); \
-}
diff --git a/Source/WebKit2/UIProcess/BackingStore.h b/Source/WebKit2/UIProcess/BackingStore.h
index e83ae88d2..bd301bbe4 100644
--- a/Source/WebKit2/UIProcess/BackingStore.h
+++ b/Source/WebKit2/UIProcess/BackingStore.h
@@ -26,7 +26,7 @@
 #ifndef BackingStore_h
 #define BackingStore_h
 
-#include <WebCore/IntSize.h>
+#include <WebCore/IntRect.h>
 #include <wtf/Noncopyable.h>
 #include <wtf/PassOwnPtr.h>
 
@@ -46,10 +46,6 @@
 #include <WebCore/WidgetBackingStore.h>
 #endif
 
-namespace WebCore {
-    class IntRect;
-}
-
 namespace WebKit {
 
 class ShareableBitmap;
@@ -92,8 +88,18 @@ private:
 #if PLATFORM(MAC)
     CGContextRef backingStoreContext();
 
+    void performWithScrolledRectTransform(const WebCore::IntRect&, void (^)(const WebCore::IntRect&, const WebCore::IntSize&));
+    void resetScrolledRect();
+
     RetainPtr<CGLayerRef> m_cgLayer;
     RetainPtr<CGContextRef> m_bitmapContext;
+
+    // The rectange that was scrolled most recently.
+    WebCore::IntRect m_scrolledRect;
+
+    // Contents of m_scrolledRect are offset by this amount (and wrapped around) with respect to
+    // their original location.
+    WebCore::IntSize m_scrolledRectOffset;
 #elif PLATFORM(WIN) || PLATFORM(WIN_CAIRO)
     OwnPtr<HBITMAP> m_bitmap;
 #elif PLATFORM(QT)
diff --git a/Source/WebKit2/UIProcess/DrawingAreaProxy.h b/Source/WebKit2/UIProcess/DrawingAreaProxy.h
index c5b713c39..e78c3cdf0 100644
--- a/Source/WebKit2/UIProcess/DrawingAreaProxy.h
+++ b/Source/WebKit2/UIProcess/DrawingAreaProxy.h
@@ -93,8 +93,8 @@ public:
     LayerTreeHostProxy* layerTreeHostProxy() const { return m_layerTreeHostProxy.get(); }
 
 #if USE(TILED_BACKING_STORE)
-    virtual void setVisibleContentsRectAndScale(const WebCore::IntRect& visibleContentsRect, float scale) { }
-    virtual void setVisibleContentRectTrajectoryVector(const WebCore::FloatPoint&) { }
+    virtual void setVisibleContentsRectForScaling(const WebCore::IntRect& visibleContentsRect, float scale) { }
+    virtual void setVisibleContentsRectForPanning(const WebCore::IntRect& visibleContentsRect, const WebCore::FloatPoint& trajectoryVector) { }
     virtual void createTileForLayer(int layerID, int tileID, const WebKit::UpdateInfo&) { }
     virtual void updateTileForLayer(int layerID, int tileID, const WebKit::UpdateInfo&) { }
     virtual void removeTileForLayer(int layerID, int tileID) { }
diff --git a/Source/WebKit2/UIProcess/DrawingAreaProxyImpl.cpp b/Source/WebKit2/UIProcess/DrawingAreaProxyImpl.cpp
index 24a5aed18..220f9ece2 100644
--- a/Source/WebKit2/UIProcess/DrawingAreaProxyImpl.cpp
+++ b/Source/WebKit2/UIProcess/DrawingAreaProxyImpl.cpp
@@ -348,16 +348,16 @@ void DrawingAreaProxyImpl::didReceiveLayerTreeHostProxyMessage(CoreIPC::Connecti
         m_layerTreeHostProxy->didReceiveLayerTreeHostProxyMessage(connection, messageID, arguments);
 }
 
-void DrawingAreaProxyImpl::setVisibleContentsRectAndScale(const WebCore::IntRect& visibleContentsRect, float scale)
+void DrawingAreaProxyImpl::setVisibleContentsRectForScaling(const WebCore::IntRect& visibleContentsRect, float scale)
 {
     if (m_layerTreeHostProxy)
-        m_layerTreeHostProxy->setVisibleContentsRectAndScale(visibleContentsRect, scale);
+        m_layerTreeHostProxy->setVisibleContentsRectForScaling(visibleContentsRect, scale);
 }
 
-void DrawingAreaProxyImpl::setVisibleContentRectTrajectoryVector(const WebCore::FloatPoint& trajectoryVector)
+void DrawingAreaProxyImpl::setVisibleContentsRectForPanning(const WebCore::IntRect& visibleContentsRect, const WebCore::FloatPoint& trajectoryVector)
 {
     if (m_layerTreeHostProxy)
-        m_layerTreeHostProxy->setVisibleContentRectTrajectoryVector(trajectoryVector);
+        m_layerTreeHostProxy->setVisibleContentsRectForPanning(visibleContentsRect, trajectoryVector);
 }
 
 void DrawingAreaProxyImpl::paintLayerTree(BackingStore::PlatformGraphicsContext context)
diff --git a/Source/WebKit2/UIProcess/DrawingAreaProxyImpl.h b/Source/WebKit2/UIProcess/DrawingAreaProxyImpl.h
index 5fcf24c50..25c279b0b 100644
--- a/Source/WebKit2/UIProcess/DrawingAreaProxyImpl.h
+++ b/Source/WebKit2/UIProcess/DrawingAreaProxyImpl.h
@@ -78,8 +78,8 @@ private:
     bool isInAcceleratedCompositingMode() const { return !m_layerTreeContext.isEmpty(); }
 
 #if USE(TILED_BACKING_STORE)
-    virtual void setVisibleContentsRectAndScale(const WebCore::IntRect& visibleContentsRect, float scale);
-    virtual void setVisibleContentRectTrajectoryVector(const WebCore::FloatPoint&);
+    virtual void setVisibleContentsRectForScaling(const WebCore::IntRect& visibleContentsRect, float scale);
+    virtual void setVisibleContentsRectForPanning(const WebCore::IntRect& visibleContentsRect, const WebCore::FloatPoint&);
     virtual void paintToCurrentGLContext(const WebCore::TransformationMatrix&, float opacity, const WebCore::FloatRect&);
     virtual void paintLayerTree(BackingStore::PlatformGraphicsContext);
     void didReceiveLayerTreeHostProxyMessage(CoreIPC::Connection*, CoreIPC::MessageID, CoreIPC::ArgumentDecoder*);
diff --git a/Source/WebKit2/UIProcess/Launcher/mac/ThreadLauncherMac.mm b/Source/WebKit2/UIProcess/Launcher/mac/ThreadLauncherMac.mm
index dd53b3ef1..7c011531f 100644
--- a/Source/WebKit2/UIProcess/Launcher/mac/ThreadLauncherMac.mm
+++ b/Source/WebKit2/UIProcess/Launcher/mac/ThreadLauncherMac.mm
@@ -37,7 +37,7 @@ using namespace WebCore;
 
 namespace WebKit {
 
-static void* webThreadBody(void* context)
+static void webThreadBody(void* context)
 {
     mach_port_t serverPort = static_cast<mach_port_t>(reinterpret_cast<uintptr_t>(context));
 
@@ -52,8 +52,6 @@ static void* webThreadBody(void* context)
     [pool drain];
 
     RunLoop::current()->run();
-
-    return 0;
 }
 
 CoreIPC::Connection::Identifier ThreadLauncher::createWebThread()
diff --git a/Source/WebKit2/UIProcess/Launcher/qt/ThreadLauncherQt.cpp b/Source/WebKit2/UIProcess/Launcher/qt/ThreadLauncherQt.cpp
index 1d0caf3ae..37d045f93 100644
--- a/Source/WebKit2/UIProcess/Launcher/qt/ThreadLauncherQt.cpp
+++ b/Source/WebKit2/UIProcess/Launcher/qt/ThreadLauncherQt.cpp
@@ -47,7 +47,7 @@ using namespace WebCore;
 
 namespace WebKit {
 
-static void* webThreadBody(void* /* context */)
+static void webThreadBody(void* /* context */)
 {
     // Initialization
     JSC::initializeThreading();
@@ -57,8 +57,6 @@ static void* webThreadBody(void* /* context */)
 
     WebProcess::shared().initialize(-1, RunLoop::current());
     RunLoop::run();
-
-    return 0;
 }
 
 CoreIPC::Connection::Identifier ThreadLauncher::createWebThread()
diff --git a/Source/WebKit2/UIProcess/Launcher/win/ThreadLauncherWin.cpp b/Source/WebKit2/UIProcess/Launcher/win/ThreadLauncherWin.cpp
index f9d1c0481..5abec7aaa 100644
--- a/Source/WebKit2/UIProcess/Launcher/win/ThreadLauncherWin.cpp
+++ b/Source/WebKit2/UIProcess/Launcher/win/ThreadLauncherWin.cpp
@@ -36,7 +36,7 @@ using namespace WebCore;
 
 namespace WebKit {
 
-static void* webThreadBody(void* context)
+static void webThreadBody(void* context)
 {
     HANDLE clientIdentifier = reinterpret_cast<HANDLE>(context);
 
@@ -46,8 +46,6 @@ static void* webThreadBody(void* context)
 
     WebProcess::shared().initialize(clientIdentifier, RunLoop::current());
     RunLoop::run();
-
-    return 0;
 }
 
 CoreIPC::Connection::Identifier ThreadLauncher::createWebThread()
diff --git a/Source/WebKit2/UIProcess/LayerTreeHostProxy.h b/Source/WebKit2/UIProcess/LayerTreeHostProxy.h
index 4c971875c..504c4e19e 100644
--- a/Source/WebKit2/UIProcess/LayerTreeHostProxy.h
+++ b/Source/WebKit2/UIProcess/LayerTreeHostProxy.h
@@ -30,15 +30,17 @@
 #include <WebCore/IntRect.h>
 #include <WebCore/IntSize.h>
 #include <WebCore/RunLoop.h>
+#include <WebCore/Timer.h>
 #include <wtf/HashSet.h>
 
 #if USE(TEXTURE_MAPPER)
 #include "TextureMapper.h"
-#include "TextureMapperNode.h"
+#include "TextureMapperBackingStore.h"
 #endif
 
 namespace WebKit {
 
+class LayerBackingStore;
 class WebLayerInfo;
 class WebLayerUpdateInfo;
 
@@ -55,8 +57,8 @@ public:
     void paintToCurrentGLContext(const WebCore::TransformationMatrix&, float, const WebCore::FloatRect&);
     void paintToGraphicsContext(BackingStore::PlatformGraphicsContext);
     void purgeGLResources();
-    void setVisibleContentsRectAndScale(const WebCore::IntRect&, float);
-    void setVisibleContentRectTrajectoryVector(const WebCore::FloatPoint&);
+    void setVisibleContentsRectForScaling(const WebCore::IntRect&, float);
+    void setVisibleContentsRectForPanning(const WebCore::IntRect&, const WebCore::FloatPoint&);
 #if USE(TILED_BACKING_STORE)
     void syncRemoteContent();
     void swapContentBuffers();
@@ -83,7 +85,6 @@ protected:
     virtual bool showRepaintCounter(const WebCore::GraphicsLayer*) const { return false; }
     void paintContents(const WebCore::GraphicsLayer*, WebCore::GraphicsContext&, WebCore::GraphicsLayerPaintingPhase, const WebCore::IntRect&) { }
 
-    WebCore::RunLoop::Timer<LayerTreeHostProxy> m_animationTimer;
     DrawingAreaProxy* m_drawingAreaProxy;
 
     typedef HashMap<WebLayerID, WebCore::GraphicsLayer*> LayerMap;
@@ -98,12 +99,6 @@ protected:
 #endif
 
 #if PLATFORM(QT)
-    typedef HashMap<WebCore::IntPoint, RefPtr<WebCore::BitmapTexture> > TiledImage;
-    WebCore::TextureMapperNode::NodeRectMap m_nodeVisualContentsRectMap;
-    HashMap<int, int> m_tileToNodeTile;
-    int remoteTileIDToNodeTileID(int tileID) const;
-    HashMap<int64_t, TiledImage> m_directlyCompositedImages;
-
     void scheduleWebViewUpdate();
     void synchronizeViewport();
     void deleteLayer(WebLayerID);
@@ -118,16 +113,15 @@ protected:
     void flushLayerChanges();
     void ensureRootLayer();
     void ensureLayer(WebLayerID);
-
+    PassRefPtr<LayerBackingStore> getBackingStore(WebLayerID);
+    void swapBuffers();
+    void syncAnimations();
 #endif
 
     OwnPtr<WebCore::GraphicsLayer> m_rootLayer;
     Vector<WebLayerID> m_layersToDelete;
-
-#if PLATFORM(QT)
-    void didFireViewportUpdateTimer(WebCore::Timer<LayerTreeHostProxy>*);
-    WebCore::Timer<LayerTreeHostProxy> m_viewportUpdateTimer;
-#endif
+    HashMap<int64_t, RefPtr<WebCore::TextureMapperBackingStore> > m_directlyCompositedImages;
+    HashSet<RefPtr<LayerBackingStore> > m_backingStoresWithPendingBuffers;
 
     LayerMap m_layers;
     WebLayerID m_rootLayerID;
diff --git a/Source/WebKit2/UIProcess/PageClient.h b/Source/WebKit2/UIProcess/PageClient.h
index bd6096c93..70ddf07fa 100644
--- a/Source/WebKit2/UIProcess/PageClient.h
+++ b/Source/WebKit2/UIProcess/PageClient.h
@@ -111,6 +111,7 @@ public:
     virtual void updateTextInputState() = 0;
     virtual void handleAuthenticationRequiredRequest(const String& hostname, const String& realm, const String& prefilledUsername, String& username, String& password) = 0;
     virtual void handleCertificateVerificationRequest(const String& hostname, bool& ignoreErrors) = 0;
+    virtual void handleProxyAuthenticationRequiredRequest(const String& hostname, uint16_t port, const String& prefilledUsername, String& username, String& password) = 0;
 #endif // PLATFORM(QT).
 
 #if PLATFORM(QT) || PLATFORM(GTK)
diff --git a/Source/WebKit2/UIProcess/WebInspectorProxy.cpp b/Source/WebKit2/UIProcess/WebInspectorProxy.cpp
index cb5df7906..6da04a9cb 100644
--- a/Source/WebKit2/UIProcess/WebInspectorProxy.cpp
+++ b/Source/WebKit2/UIProcess/WebInspectorProxy.cpp
@@ -29,6 +29,7 @@
 
 #if ENABLE(INSPECTOR)
 
+#include "WebFrameProxy.h"
 #include "WebInspectorMessages.h"
 #include "WebPageCreationParameters.h"
 #include "WebPageGroup.h"
@@ -54,7 +55,7 @@ static PassRefPtr<WebPageGroup> createInspectorPageGroup()
 #endif
 
     pageGroup->preferences()->setApplicationChromeModeEnabled(true);
-    pageGroup->preferences()->setSuppressIncrementalRendering(true);
+    pageGroup->preferences()->setSuppressesIncrementalRendering(true);
 
     return pageGroup.release();
 }
@@ -123,6 +124,22 @@ void WebInspectorProxy::showConsole()
     m_page->process()->send(Messages::WebInspector::ShowConsole(), m_page->pageID());
 }
 
+void WebInspectorProxy::showResources()
+{
+    if (!m_page)
+        return;
+
+    m_page->process()->send(Messages::WebInspector::ShowResources(), m_page->pageID());
+}
+
+void WebInspectorProxy::showMainResourceForFrame(WebFrameProxy* frame)
+{
+    if (!m_page)
+        return;
+    
+    m_page->process()->send(Messages::WebInspector::ShowMainResourceForFrame(frame->frameID()), m_page->pageID());
+}
+
 void WebInspectorProxy::attach()
 {
     if (!canAttach())
@@ -260,8 +277,17 @@ void WebInspectorProxy::inspectedURLChanged(const String& urlString)
 
 bool WebInspectorProxy::canAttach()
 {
-    unsigned inspectedWindowHeight = platformInspectedWindowHeight();
-    return inspectedWindowHeight && minimumAttachedHeight <= (inspectedWindowHeight * 3 / 4);
+    // Keep this in sync with InspectorFrontendClientLocal::canAttachWindow. There are two implementations
+    // to make life easier in the multi-process world we have. WebInspectorProxy uses canAttach to decide if
+    // we can attach on open (on the UI process side). And InspectorFrontendClientLocal::canAttachWindow is
+    // used to decide if we can attach when the attach button is pressed (on the WebProcess side).
+
+    // Don't allow the attach if the window would be too small to accommodate the minimum inspector height.
+    // Also don't allow attaching to another inspector -- two inspectors in one window is too much!
+    bool isInspectorPage = m_page->pageGroup() == inspectorPageGroup();
+    unsigned inspectedPageHeight = platformInspectedWindowHeight();
+    unsigned maximumAttachedHeight = inspectedPageHeight * 3 / 4;
+    return minimumAttachedHeight <= maximumAttachedHeight && !isInspectorPage;
 }
 
 bool WebInspectorProxy::shouldOpenAttached()
diff --git a/Source/WebKit2/UIProcess/WebInspectorProxy.h b/Source/WebKit2/UIProcess/WebInspectorProxy.h
index 56df78cd2..aebb6f9b9 100644
--- a/Source/WebKit2/UIProcess/WebInspectorProxy.h
+++ b/Source/WebKit2/UIProcess/WebInspectorProxy.h
@@ -50,6 +50,7 @@ OBJC_CLASS WKWebInspectorWKView;
 
 namespace WebKit {
 
+class WebFrameProxy;
 class WebPageGroup;
 class WebPageProxy;
 struct WebPageCreationParameters;
@@ -91,6 +92,8 @@ public:
 #endif
 
     void showConsole();
+    void showResources();
+    void showMainResourceForFrame(WebFrameProxy*);
 
     bool isAttached() const { return m_isAttached; }
     void attach();
@@ -164,6 +167,8 @@ private:
 
     static const unsigned initialWindowWidth = 750;
     static const unsigned initialWindowHeight = 650;
+
+    // Keep this in sync with the value in InspectorFrontendClientLocal.
     static const unsigned minimumAttachedHeight = 250;
 
     WebPageProxy* m_page;
diff --git a/Source/WebKit2/UIProcess/WebLoaderClient.cpp b/Source/WebKit2/UIProcess/WebLoaderClient.cpp
index 87feea062..2aae01617 100644
--- a/Source/WebKit2/UIProcess/WebLoaderClient.cpp
+++ b/Source/WebKit2/UIProcess/WebLoaderClient.cpp
@@ -241,12 +241,21 @@ void WebLoaderClient::didChangeBackForwardList(WebPageProxy* page, WebBackForwar
 
 bool WebLoaderClient::shouldGoToBackForwardListItem(WebPageProxy* page, WebBackForwardListItem* item)
 {
-    if (!m_client.shouldGoToBackForwardListItem)
+    // We should only even considering sending the shouldGoToBackForwardListItem() client callback
+    // for version 0 clients. Later versioned clients should get willGoToBackForwardListItem() instead,
+    // but do to XPC race conditions this one might have been called instead.
+    if (m_client.version > 0 || !m_client.shouldGoToBackForwardListItem)
         return true;
-    
+
     return m_client.shouldGoToBackForwardListItem(toAPI(page), toAPI(item), m_client.clientInfo);
 }
 
+void WebLoaderClient::willGoToBackForwardListItem(WebPageProxy* page, WebBackForwardListItem* item)
+{
+    if (m_client.willGoToBackForwardListItem)
+        m_client.willGoToBackForwardListItem(toAPI(page), toAPI(item), m_client.clientInfo);
+}
+
 void WebLoaderClient::didFailToInitializePlugin(WebPageProxy* page, const String& mimeType)
 {
     if (!m_client.didFailToInitializePlugin)
diff --git a/Source/WebKit2/UIProcess/WebLoaderClient.h b/Source/WebKit2/UIProcess/WebLoaderClient.h
index 970591937..55cc6aace 100644
--- a/Source/WebKit2/UIProcess/WebLoaderClient.h
+++ b/Source/WebKit2/UIProcess/WebLoaderClient.h
@@ -83,6 +83,7 @@ public:
 
     void didChangeBackForwardList(WebPageProxy*, WebBackForwardListItem* addedItem, Vector<RefPtr<APIObject> >* removedItems);
     bool shouldGoToBackForwardListItem(WebPageProxy*, WebBackForwardListItem*);
+    void willGoToBackForwardListItem(WebPageProxy*, WebBackForwardListItem*);
 
     void didFailToInitializePlugin(WebPageProxy*, const String& mimeType);
 };
diff --git a/Source/WebKit2/UIProcess/WebPageProxy.cpp b/Source/WebKit2/UIProcess/WebPageProxy.cpp
index 85b7d54ca..8ea3fe4a1 100644
--- a/Source/WebKit2/UIProcess/WebPageProxy.cpp
+++ b/Source/WebKit2/UIProcess/WebPageProxy.cpp
@@ -254,6 +254,11 @@ bool WebPageProxy::isValid()
 void WebPageProxy::initializeLoaderClient(const WKPageLoaderClient* loadClient)
 {
     m_loaderClient.initialize(loadClient);
+    
+    if (!loadClient)
+        return;
+
+    process()->send(Messages::WebPage::SetWillGoToBackForwardItemCallbackEnabled(loadClient->version > 0), m_pageID);
 }
 
 void WebPageProxy::initializePolicyClient(const WKPagePolicyClient* policyClient)
@@ -317,11 +322,7 @@ void WebPageProxy::reattachToWebProcessWithItem(WebBackForwardListItem* item)
     if (!item)
         return;
 
-    SandboxExtension::Handle sandboxExtensionHandle;
-    bool createdExtension = maybeInitializeSandboxExtensionHandle(KURL(KURL(), item->url()), sandboxExtensionHandle);
-    if (createdExtension)
-        process()->willAcquireUniversalFileReadSandboxExtension();
-    process()->send(Messages::WebPage::GoToBackForwardItem(item->itemID(), sandboxExtensionHandle), m_pageID);
+    process()->send(Messages::WebPage::GoToBackForwardItem(item->itemID()), m_pageID);
     process()->responsivenessTimer()->start();
 }
 
@@ -509,15 +510,24 @@ void WebPageProxy::stopLoading()
 
 void WebPageProxy::reload(bool reloadFromOrigin)
 {
-    if (m_backForwardList->currentItem())
-        setPendingAPIRequestURL(m_backForwardList->currentItem()->url());
+    SandboxExtension::Handle sandboxExtensionHandle;
+
+    if (m_backForwardList->currentItem()) {
+        String url = m_backForwardList->currentItem()->url();
+        setPendingAPIRequestURL(url);
+
+        // We may not have an extension yet if back/forward list was reinstated after a WebProcess crash or a browser relaunch
+        bool createdExtension = maybeInitializeSandboxExtensionHandle(KURL(KURL(), url), sandboxExtensionHandle);
+        if (createdExtension)
+            process()->willAcquireUniversalFileReadSandboxExtension();
+    }
 
     if (!isValid()) {
         reattachToWebProcessWithItem(m_backForwardList->currentItem());
         return;
     }
 
-    process()->send(Messages::WebPage::Reload(reloadFromOrigin), m_pageID);
+    process()->send(Messages::WebPage::Reload(reloadFromOrigin, sandboxExtensionHandle), m_pageID);
     process()->responsivenessTimer()->start();
 }
 
@@ -527,19 +537,17 @@ void WebPageProxy::goForward()
         return;
 
     WebBackForwardListItem* forwardItem = m_backForwardList->forwardItem();
-    if (forwardItem)
-        setPendingAPIRequestURL(forwardItem->url());
+    if (!forwardItem)
+        return;
+
+    setPendingAPIRequestURL(forwardItem->url());
 
     if (!isValid()) {
         reattachToWebProcessWithItem(forwardItem);
         return;
     }
 
-    SandboxExtension::Handle sandboxExtensionHandle;
-    bool createdExtension = maybeInitializeSandboxExtensionHandle(KURL(KURL(), forwardItem->url()), sandboxExtensionHandle);
-    if (createdExtension)
-        process()->willAcquireUniversalFileReadSandboxExtension();
-    process()->send(Messages::WebPage::GoForward(forwardItem->itemID(), sandboxExtensionHandle), m_pageID);
+    process()->send(Messages::WebPage::GoForward(forwardItem->itemID()), m_pageID);
     process()->responsivenessTimer()->start();
 }
 
@@ -554,19 +562,17 @@ void WebPageProxy::goBack()
         return;
 
     WebBackForwardListItem* backItem = m_backForwardList->backItem();
-    if (backItem)
-        setPendingAPIRequestURL(backItem->url());
+    if (!backItem)
+        return;
+
+    setPendingAPIRequestURL(backItem->url());
 
     if (!isValid()) {
         reattachToWebProcessWithItem(backItem);
         return;
     }
 
-    SandboxExtension::Handle sandboxExtensionHandle;
-    bool createdExtension = maybeInitializeSandboxExtensionHandle(KURL(KURL(), backItem->url()), sandboxExtensionHandle);
-    if (createdExtension)
-        process()->willAcquireUniversalFileReadSandboxExtension();
-    process()->send(Messages::WebPage::GoBack(backItem->itemID(), sandboxExtensionHandle), m_pageID);
+    process()->send(Messages::WebPage::GoBack(backItem->itemID()), m_pageID);
     process()->responsivenessTimer()->start();
 }
 
@@ -584,11 +590,7 @@ void WebPageProxy::goToBackForwardItem(WebBackForwardListItem* item)
     
     setPendingAPIRequestURL(item->url());
 
-    SandboxExtension::Handle sandboxExtensionHandle;
-    bool createdExtension = maybeInitializeSandboxExtensionHandle(KURL(KURL(), item->url()), sandboxExtensionHandle);
-    if (createdExtension)
-        process()->willAcquireUniversalFileReadSandboxExtension();
-    process()->send(Messages::WebPage::GoToBackForwardItem(item->itemID(), sandboxExtensionHandle), m_pageID);
+    process()->send(Messages::WebPage::GoToBackForwardItem(item->itemID()), m_pageID);
     process()->responsivenessTimer()->start();
 }
 
@@ -611,6 +613,12 @@ void WebPageProxy::shouldGoToBackForwardListItem(uint64_t itemID, bool& shouldGo
     shouldGoToBackForwardItem = item && m_loaderClient.shouldGoToBackForwardListItem(this, item);
 }
 
+void WebPageProxy::willGoToBackForwardListItem(uint64_t itemID)
+{
+    if (WebBackForwardListItem* item = process()->webBackForwardItem(itemID))
+        m_loaderClient.willGoToBackForwardListItem(this, item);
+}
+
 String WebPageProxy::activeURL() const
 {
     if (!m_mainFrame)
@@ -944,7 +952,7 @@ void WebPageProxy::handleWheelEvent(const NativeWebWheelEvent& event)
         process()->sendSync(Messages::WebPage::WheelEventSyncForTesting(event), Messages::WebPage::WheelEventSyncForTesting::Reply(handled), m_pageID);
         didReceiveEvent(event.type(), handled);
     } else
-        process()->send(Messages::EventDispatcher::WheelEvent(m_pageID, event), 0);
+        process()->send(Messages::EventDispatcher::WheelEvent(m_pageID, event, canGoBack(), canGoForward()), 0);
 }
 
 void WebPageProxy::handleKeyboardEvent(const NativeWebKeyboardEvent& event)
@@ -2399,6 +2407,11 @@ void WebPageProxy::authenticationRequiredRequest(const String& hostname, const S
     m_pageClient->handleAuthenticationRequiredRequest(hostname, realm, prefilledUsername, username, password);
 }
 
+void WebPageProxy::proxyAuthenticationRequiredRequest(const String& hostname, uint16_t port, const String& prefilledUsername, String& username, String& password)
+{
+    m_pageClient->handleProxyAuthenticationRequiredRequest(hostname, port, prefilledUsername, username, password);
+}
+
 void WebPageProxy::certificateVerificationRequest(const String& hostname, bool& ignoreErrors)
 {
     m_pageClient->handleCertificateVerificationRequest(hostname, ignoreErrors);
@@ -2448,9 +2461,16 @@ void WebPageProxy::backForwardAddItem(uint64_t itemID)
     m_backForwardList->addItem(process()->webBackForwardItem(itemID));
 }
 
-void WebPageProxy::backForwardGoToItem(uint64_t itemID)
+void WebPageProxy::backForwardGoToItem(uint64_t itemID, SandboxExtension::Handle& sandboxExtensionHandle)
 {
-    m_backForwardList->goToItem(process()->webBackForwardItem(itemID));
+    WebBackForwardListItem* item = process()->webBackForwardItem(itemID);
+    if (!item)
+        return;
+
+    bool createdExtension = maybeInitializeSandboxExtensionHandle(KURL(KURL(), item->url()), sandboxExtensionHandle);
+    if (createdExtension)
+        process()->willAcquireUniversalFileReadSandboxExtension();
+    m_backForwardList->goToItem(item);
 }
 
 void WebPageProxy::backForwardItemAtIndex(int32_t index, uint64_t& itemID)
@@ -2992,7 +3012,7 @@ void WebPageProxy::didReceiveEvent(uint32_t opaqueType, bool handled)
             WebWheelEvent newWheelEvent = coalescedWheelEvent(m_wheelEventQueue, m_currentlyProcessedWheelEvents);
 
             process()->responsivenessTimer()->start();
-            process()->send(Messages::EventDispatcher::WheelEvent(m_pageID, newWheelEvent), 0);
+            process()->send(Messages::EventDispatcher::WheelEvent(m_pageID, newWheelEvent, canGoBack(), canGoForward()), 0);
         }
 
         break;
@@ -3302,7 +3322,6 @@ WebPageCreationParameters WebPageProxy::creationParameters() const
 #if PLATFORM(WIN)
     parameters.nativeWindow = m_pageClient->nativeWindow();
 #endif
-
     return parameters;
 }
 
diff --git a/Source/WebKit2/UIProcess/WebPageProxy.h b/Source/WebKit2/UIProcess/WebPageProxy.h
index 2e64d16ec..af8da1bef 100644
--- a/Source/WebKit2/UIProcess/WebPageProxy.h
+++ b/Source/WebKit2/UIProcess/WebPageProxy.h
@@ -266,6 +266,7 @@ public:
     void tryRestoreScrollPosition();
     void didChangeBackForwardList(WebBackForwardListItem* addedItem, Vector<RefPtr<APIObject> >* removedItems);
     void shouldGoToBackForwardListItem(uint64_t itemID, bool& shouldGoToBackForwardListItem);
+    void willGoToBackForwardListItem(uint64_t itemID);
 
     String activeURL() const;
     String provisionalURL() const;
@@ -322,6 +323,7 @@ public:
     void sendApplicationSchemeReply(const QQuickNetworkReply*);
     void authenticationRequiredRequest(const String& hostname, const String& realm, const String& prefilledUsername, String& username, String& password);
     void certificateVerificationRequest(const String& hostname, bool& ignoreErrors);
+    void proxyAuthenticationRequiredRequest(const String& hostname, uint16_t port, const String& prefilledUsername, String& username, String& password);
 #endif // PLATFORM(QT).
 
 #if PLATFORM(QT)
@@ -743,7 +745,7 @@ private:
 
     // Back/Forward list management
     void backForwardAddItem(uint64_t itemID);
-    void backForwardGoToItem(uint64_t itemID);
+    void backForwardGoToItem(uint64_t itemID, SandboxExtension::Handle&);
     void backForwardItemAtIndex(int32_t index, uint64_t& itemID);
     void backForwardBackListCount(int32_t& count);
     void backForwardForwardListCount(int32_t& count);
diff --git a/Source/WebKit2/UIProcess/WebPageProxy.messages.in b/Source/WebKit2/UIProcess/WebPageProxy.messages.in
index 9ba1d5254..cb0c629e6 100644
--- a/Source/WebKit2/UIProcess/WebPageProxy.messages.in
+++ b/Source/WebKit2/UIProcess/WebPageProxy.messages.in
@@ -76,6 +76,7 @@ messages -> WebPageProxy {
     DidFindZoomableArea(WebCore::IntPoint target, WebCore::IntRect area)
     AuthenticationRequiredRequest(WTF::String hostname, WTF::String realm, WTF::String prefilledUsername) -> (WTF::String username, WTF::String password)
     CertificateVerificationRequest(WTF::String hostname) -> (bool ignoreErrors)
+    ProxyAuthenticationRequiredRequest(WTF::String hostname, uint16_t port, WTF::String prefilledUsername) -> (WTF::String username, WTF::String password)
 #endif
 #if ENABLE(TOUCH_EVENTS)
     NeedTouchEvents(bool needTouchEvents)
@@ -156,12 +157,13 @@ messages -> WebPageProxy {
 
     # BackForward messages
     BackForwardAddItem(uint64_t itemID)
-    BackForwardGoToItem(uint64_t itemID)
+    BackForwardGoToItem(uint64_t itemID) -> (WebKit::SandboxExtension::Handle sandboxExtensionHandle)
     BackForwardItemAtIndex(int32_t itemIndex) -> (uint64_t itemID)
     BackForwardBackListCount() -> (int32_t count)
     BackForwardForwardListCount() -> (int32_t count)
     BackForwardClear()
     ShouldGoToBackForwardListItem(uint64_t itemID) -> (bool shouldGoToBackForwardListItem)
+    WillGoToBackForwardListItem(uint64_t itemID)
 
     # Undo/Redo messages
     RegisterEditCommandForUndo(uint64_t commandID, uint32_t editAction)
diff --git a/Source/WebKit2/UIProcess/WebProcessProxy.cpp b/Source/WebKit2/UIProcess/WebProcessProxy.cpp
index 2109d9e7a..9ce54407e 100644
--- a/Source/WebKit2/UIProcess/WebProcessProxy.cpp
+++ b/Source/WebKit2/UIProcess/WebProcessProxy.cpp
@@ -245,7 +245,17 @@ bool WebProcessProxy::checkURLReceivedFromWebProcess(const KURL& url)
             return true;
     }
 
+    // Items in back/forward list have been already checked.
+    // One case where we don't have sandbox extensions for file URLs in b/f list is if the list has been reinstated after a crash or a browser restart.
+    for (WebBackForwardListItemMap::iterator iter = m_backForwardListItemMap.begin(), end = m_backForwardListItemMap.end(); iter != end; ++iter) {
+        if (KURL(KURL(), iter->second->url()).fileSystemPath() == path)
+            return true;
+        if (KURL(KURL(), iter->second->originalURL()).fileSystemPath() == path)
+            return true;
+    }
+
     // A Web process that was never asked to load a file URL should not ever ask us to do anything with a file URL.
+    fprintf(stderr, "Received an unexpected URL from the web process: '%s'\n", url.string().utf8().data());
     return false;
 }
 
@@ -368,9 +378,7 @@ void WebProcessProxy::didClose(CoreIPC::Connection*)
 
 void WebProcessProxy::didReceiveInvalidMessage(CoreIPC::Connection*, CoreIPC::MessageID messageID)
 {
-    // This fprintf is intentionally left because this function should 
-    // only be hit in the case of a misbehaving web process.
-    fprintf(stderr, "Receive an invalid message from the web process with message ID %x\n", messageID.toInt());
+    fprintf(stderr, "Received an invalid message from the web process with message ID %x\n", messageID.toInt());
 
     // Terminate the WebProcesses.
     terminate();
diff --git a/Source/WebKit2/UIProcess/cf/WebPageProxyCF.cpp b/Source/WebKit2/UIProcess/cf/WebPageProxyCF.cpp
index 0524bc517..79dd8ced0 100644
--- a/Source/WebKit2/UIProcess/cf/WebPageProxyCF.cpp
+++ b/Source/WebKit2/UIProcess/cf/WebPageProxyCF.cpp
@@ -164,15 +164,10 @@ void WebPageProxy::restoreFromSessionStateData(WebData* webData)
                 if (provisionalURL)
                     process()->send(Messages::WebPage::RestoreSession(state), m_pageID);
                 else {
-                    SandboxExtension::Handle sandboxExtensionHandle;
-                    if (WebBackForwardListItem* item = m_backForwardList->currentItem()) {
-                        bool createdExtension = maybeInitializeSandboxExtensionHandle(KURL(KURL(), item->url()), sandboxExtensionHandle);
-                        if (createdExtension)
-                            process()->willAcquireUniversalFileReadSandboxExtension();
+                    if (WebBackForwardListItem* item = m_backForwardList->currentItem())
                         setPendingAPIRequestURL(item->url());
-                    }
 
-                    process()->send(Messages::WebPage::RestoreSessionAndNavigateToCurrentItem(state, sandboxExtensionHandle), m_pageID);
+                    process()->send(Messages::WebPage::RestoreSessionAndNavigateToCurrentItem(state), m_pageID);
                 }
             }
         }
diff --git a/Source/WebKit2/UIProcess/mac/BackingStoreMac.mm b/Source/WebKit2/UIProcess/mac/BackingStoreMac.mm
index 646962f7e..2d159137e 100644
--- a/Source/WebKit2/UIProcess/mac/BackingStoreMac.mm
+++ b/Source/WebKit2/UIProcess/mac/BackingStoreMac.mm
@@ -31,26 +31,109 @@
 #import "UpdateInfo.h"
 #import "WebPageProxy.h"
 #import <WebCore/GraphicsContext.h>
+#import <WebCore/Region.h>
 
 using namespace WebCore;
 
 namespace WebKit {
 
-void BackingStore::paint(PlatformGraphicsContext context, const IntRect& rect)
+void BackingStore::performWithScrolledRectTransform(const IntRect& rect, void (^block)(const IntRect&, const IntSize&))
 {
-    if (m_cgLayer) {
-        CGContextSaveGState(context);
-        CGContextClipToRect(context, rect);
+    if (m_scrolledRect.isEmpty() || m_scrolledRectOffset.isZero() || !m_scrolledRect.intersects(rect)) {
+        block(rect, IntSize());
+        return;
+    }
 
-        CGContextScaleCTM(context, 1, -1);
-        CGContextDrawLayerAtPoint(context, CGPointMake(0, -m_size.height()), m_cgLayer.get());
+    // The part of rect that's outside the scrolled rect is not translated.
+    Region untranslatedRegion = rect;
+    untranslatedRegion.subtract(m_scrolledRect);
+    Vector<IntRect> untranslatedRects = untranslatedRegion.rects();
+    for (size_t i = 0; i < untranslatedRects.size(); ++i)
+        block(untranslatedRects[i], IntSize());
+
+    // The part of rect that intersects the scrolled rect comprises up to four parts, each subject
+    // to a different translation (all translations are equivalent modulo the dimensions of the
+    // scrolled rect to the scroll offset).
+    IntRect intersection = rect;
+    intersection.intersect(m_scrolledRect);
+
+    IntRect scrolledRect = m_scrolledRect;
+    IntSize offset = m_scrolledRectOffset;
+    scrolledRect.move(-offset);
+
+    IntRect part = intersection;
+    part.intersect(scrolledRect);
+    if (!part.isEmpty())
+        block(part, offset);
+
+    part = intersection;
+    offset += IntSize(0, -m_scrolledRect.height());
+    scrolledRect.move(IntSize(0, m_scrolledRect.height()));
+    part.intersect(scrolledRect);
+    if (!part.isEmpty())
+        block(part, offset);
+
+    part = intersection;
+    offset += IntSize(-m_scrolledRect.width(), 0);
+    scrolledRect.move(IntSize(m_scrolledRect.width(), 0));
+    part.intersect(scrolledRect);
+    if (!part.isEmpty())
+        block(part, offset);
+
+    part = intersection;
+    offset += IntSize(0, m_scrolledRect.height());
+    scrolledRect.move(IntSize(0, -m_scrolledRect.height()));
+    part.intersect(scrolledRect);
+    if (!part.isEmpty())
+        block(part, offset);
+}
+
+void BackingStore::resetScrolledRect()
+{
+    ASSERT(!m_scrolledRect.isEmpty());
 
-        CGContextRestoreGState(context);
+    if (m_scrolledRectOffset.isZero()) {
+        m_scrolledRect = IntRect();
         return;
     }
 
-    ASSERT(m_bitmapContext);
-    paintBitmapContext(context, m_bitmapContext.get(), rect.location(), rect);
+    RetainPtr<CGColorSpaceRef> colorSpace(AdoptCF, CGColorSpaceCreateDeviceRGB());
+    RetainPtr<CGContextRef> context(AdoptCF, CGBitmapContextCreate(0, m_scrolledRect.size().width(), m_scrolledRect.size().height(), 8, m_scrolledRect.size().width() * 4, colorSpace.get(), kCGImageAlphaPremultipliedFirst | kCGBitmapByteOrder32Host));
+
+    CGContextTranslateCTM(context.get(), -m_scrolledRect.location().x(), -m_scrolledRect.location().y());
+    CGContextTranslateCTM(context.get(), 0, m_scrolledRect.size().height());
+    CGContextScaleCTM(context.get(), 1, -1);
+    paint(context.get(), m_scrolledRect);
+
+    IntRect sourceRect(IntPoint(), m_scrolledRect.size());
+    paintBitmapContext(backingStoreContext(), context.get(), m_scrolledRect.location(), sourceRect);
+
+    m_scrolledRect = IntRect();
+    m_scrolledRectOffset = IntSize();
+}
+
+void BackingStore::paint(PlatformGraphicsContext context, const IntRect& rect)
+{
+    // FIXME: This is defined outside the block to work around bugs in llvm-gcc 4.2.
+    __block CGRect source;
+    performWithScrolledRectTransform(rect, ^(const IntRect& part, const IntSize& offset) {
+        if (m_cgLayer) {
+            CGContextSaveGState(context);
+            CGContextClipToRect(context, part);
+
+            CGContextScaleCTM(context, 1, -1);
+            CGContextDrawLayerAtPoint(context, CGPointMake(-offset.width(), offset.height() - m_size.height()), m_cgLayer.get());
+
+            CGContextRestoreGState(context);
+            return;
+        }
+
+        ASSERT(m_bitmapContext);
+        source = part;
+        source.origin.x += offset.width();
+        source.origin.y += offset.height();
+        paintBitmapContext(context, m_bitmapContext.get(), part.location(), source);
+    });
 }
 
 CGContextRef BackingStore::backingStoreContext()
@@ -101,15 +184,20 @@ void BackingStore::incorporateUpdate(ShareableBitmap* bitmap, const UpdateInfo&
 
     IntPoint updateRectLocation = updateInfo.updateRectBounds.location();
 
-    GraphicsContext graphicsContext(context);
+    GraphicsContext ctx(context);
+    __block GraphicsContext* graphicsContext = &ctx;
 
     // Paint all update rects.
     for (size_t i = 0; i < updateInfo.updateRects.size(); ++i) {
         IntRect updateRect = updateInfo.updateRects[i];
         IntRect srcRect = updateRect;
-        srcRect.move(-updateRectLocation.x(), -updateRectLocation.y());
-
-        bitmap->paint(graphicsContext, updateInfo.deviceScaleFactor, updateRect.location(), srcRect);
+        // FIXME: This is defined outside the block to work around bugs in llvm-gcc 4.2.
+        __block IntRect srcPart;
+        performWithScrolledRectTransform(srcRect, ^(const IntRect& part, const IntSize& offset) {
+            srcPart = part;
+            srcPart.move(-updateRectLocation.x(), -updateRectLocation.y());
+            bitmap->paint(*graphicsContext, updateInfo.deviceScaleFactor, part.location() + offset, srcPart);
+        });
     }
 }
 
@@ -118,26 +206,20 @@ void BackingStore::scroll(const IntRect& scrollRect, const IntSize& scrollOffset
     if (scrollOffset.isZero())
         return;
 
-    if (m_cgLayer) {
-        CGContextRef layerContext = CGLayerGetContext(m_cgLayer.get());
-
-        // Scroll the layer by painting it into itself with the given offset.
-        CGContextSaveGState(layerContext);
-        CGContextClipToRect(layerContext, scrollRect);
-        CGContextScaleCTM(layerContext, 1, -1);
-        CGContextDrawLayerAtPoint(layerContext, CGPointMake(scrollOffset.width(), -m_size.height() - scrollOffset.height()), m_cgLayer.get());
-        CGContextRestoreGState(layerContext);
+    if (!m_scrolledRect.isEmpty() && m_scrolledRect != scrollRect)
+        resetScrolledRect();
 
-        return;
-    }
+    m_scrolledRect = scrollRect;
 
-    ASSERT(m_bitmapContext);
+    int width = (m_scrolledRectOffset.width() - scrollOffset.width()) % m_scrolledRect.width();
+    if (width < 0)
+        width += m_scrolledRect.width();
+    m_scrolledRectOffset.setWidth(width);
 
-    CGContextSaveGState(m_bitmapContext.get());
-    CGContextClipToRect(m_bitmapContext.get(), scrollRect);
-    CGPoint destination = CGPointMake(scrollRect.x() + scrollOffset.width(), scrollRect.y() + scrollOffset.height());
-    paintBitmapContext(m_bitmapContext.get(), m_bitmapContext.get(), destination, scrollRect);
-    CGContextRestoreGState(m_bitmapContext.get());
+    int height = (m_scrolledRectOffset.height() - scrollOffset.height()) % m_scrolledRect.height();
+    if (height < 0)
+        height += m_scrolledRect.height();
+    m_scrolledRectOffset.setHeight(height);
 }
 
 } // namespace WebKit
diff --git a/Source/WebKit2/UIProcess/mac/TiledCoreAnimationDrawingAreaProxy.mm b/Source/WebKit2/UIProcess/mac/TiledCoreAnimationDrawingAreaProxy.mm
index 25d4e44a1..319bcb401 100644
--- a/Source/WebKit2/UIProcess/mac/TiledCoreAnimationDrawingAreaProxy.mm
+++ b/Source/WebKit2/UIProcess/mac/TiledCoreAnimationDrawingAreaProxy.mm
@@ -53,7 +53,7 @@ TiledCoreAnimationDrawingAreaProxy::~TiledCoreAnimationDrawingAreaProxy()
 
 void TiledCoreAnimationDrawingAreaProxy::deviceScaleFactorDidChange()
 {
-    // FIXME: Implement.
+    m_webPageProxy->process()->send(Messages::DrawingArea::SetDeviceScaleFactor(m_webPageProxy->deviceScaleFactor()), m_webPageProxy->pageID());
 }
 
 void TiledCoreAnimationDrawingAreaProxy::sizeDidChange()
diff --git a/Source/WebKit2/UIProcess/qt/LayerBackingStore.cpp b/Source/WebKit2/UIProcess/qt/LayerBackingStore.cpp
new file mode 100644
index 000000000..c6df57efb
--- /dev/null
+++ b/Source/WebKit2/UIProcess/qt/LayerBackingStore.cpp
@@ -0,0 +1,143 @@
+/*
+ Copyright (C) 2012 Nokia Corporation and/or its subsidiary(-ies)
+
+ This library is free software; you can redistribute it and/or
+ modify it under the terms of the GNU Library General Public
+ License as published by the Free Software Foundation; either
+ version 2 of the License, or (at your option) any later version.
+
+ This library is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ Library General Public License for more details.
+
+ You should have received a copy of the GNU Library General Public License
+ along with this library; see the file COPYING.LIB.  If not, write to
+ the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ Boston, MA 02110-1301, USA.
+ */
+
+#include "config.h"
+#include "LayerBackingStore.h"
+
+#include "GraphicsLayer.h"
+#include "TextureMapper.h"
+
+#include "stdio.h"
+
+using namespace WebCore;
+
+namespace WebKit {
+
+void LayerBackingStoreTile::swapBuffers(WebCore::TextureMapper* textureMapper)
+{
+    if (!m_backBuffer)
+        return;
+
+    FloatRect targetRect(m_targetRect);
+    targetRect.scale(1. / m_scale);
+    bool shouldReset = false;
+    if (targetRect != rect()) {
+        setRect(targetRect);
+        shouldReset = true;
+    }
+    RefPtr<BitmapTexture> texture = this->texture();
+    if (!texture) {
+        texture = textureMapper->createTexture();
+        setTexture(texture.get());
+        shouldReset = true;
+    }
+
+    QImage qImage = m_backBuffer->createQImage();
+
+    if (shouldReset)
+        texture->reset(m_sourceRect.size(), qImage.hasAlphaChannel() ? BitmapTexture::SupportsAlpha : 0);
+
+    texture->updateContents(qImage.constBits(), m_sourceRect);
+    m_backBuffer.clear();
+}
+
+void LayerBackingStoreTile::setBackBuffer(const WebCore::IntRect& targetRect, const WebCore::IntRect& sourceRect, ShareableBitmap* buffer)
+{
+    m_sourceRect = sourceRect;
+    m_targetRect = targetRect;
+    m_backBuffer = buffer;
+}
+
+void LayerBackingStore::createTile(int id, float scale)
+{
+    m_tiles.add(id, LayerBackingStoreTile(scale));
+    m_scale = scale;
+}
+
+void LayerBackingStore::removeTile(int id)
+{
+    m_tiles.remove(id);
+}
+
+void LayerBackingStore::updateTile(int id, const IntRect& sourceRect, const IntRect& targetRect, ShareableBitmap* backBuffer)
+{
+    HashMap<int, LayerBackingStoreTile>::iterator it = m_tiles.find(id);
+    ASSERT(it != m_tiles.end());
+    it->second.setBackBuffer(targetRect, sourceRect, backBuffer);
+}
+
+PassRefPtr<BitmapTexture> LayerBackingStore::texture() const
+{
+    HashMap<int, LayerBackingStoreTile>::const_iterator end = m_tiles.end();
+    for (HashMap<int, LayerBackingStoreTile>::const_iterator it = m_tiles.begin(); it != end; ++it) {
+        RefPtr<BitmapTexture> texture = it->second.texture();
+        if (texture)
+            return texture;
+    }
+
+    return PassRefPtr<BitmapTexture>();
+}
+
+void LayerBackingStore::paintToTextureMapper(TextureMapper* textureMapper, const FloatRect& targetRect, const TransformationMatrix& transform, float opacity, BitmapTexture* mask)
+{
+    Vector<TextureMapperTile*> tilesToPaint;
+
+    // We have to do this every time we paint, in case the opacity has changed.
+    HashMap<int, LayerBackingStoreTile>::iterator end = m_tiles.end();
+    FloatRect coveredRect;
+    for (HashMap<int, LayerBackingStoreTile>::iterator it = m_tiles.begin(); it != end; ++it) {
+        LayerBackingStoreTile& tile = it->second;
+        if (!tile.texture())
+            continue;
+
+        if (tile.scale() == m_scale) {
+            tilesToPaint.append(&tile);
+            coveredRect.unite(tile.rect());
+            continue;
+        }
+
+        // Only show the previous tile if the opacity is high, otherwise effect looks like a bug.
+        // We show the previous-scale tile anyway if it doesn't intersect with any current-scale tile.
+        if (opacity < 0.95 && coveredRect.intersects(tile.rect()))
+            continue;
+
+        tilesToPaint.prepend(&tile);
+        coveredRect.unite(tile.rect());
+    }
+
+    bool shouldClip = !targetRect.contains(coveredRect);
+
+    if (shouldClip)
+        textureMapper->beginClip(transform, targetRect);
+
+    for (size_t i = 0; i < tilesToPaint.size(); ++i)
+        tilesToPaint[i]->paint(textureMapper, transform, opacity, mask);
+
+    if (shouldClip)
+        textureMapper->endClip();
+}
+
+void LayerBackingStore::swapBuffers(TextureMapper* textureMapper)
+{
+    HashMap<int, LayerBackingStoreTile>::iterator end = m_tiles.end();
+    for (HashMap<int, LayerBackingStoreTile>::iterator it = m_tiles.begin(); it != end; ++it)
+        it->second.swapBuffers(textureMapper);
+}
+
+}
diff --git a/Source/WebKit2/UIProcess/qt/LayerBackingStore.h b/Source/WebKit2/UIProcess/qt/LayerBackingStore.h
new file mode 100644
index 000000000..e62fcc840
--- /dev/null
+++ b/Source/WebKit2/UIProcess/qt/LayerBackingStore.h
@@ -0,0 +1,68 @@
+/*
+ Copyright (C) 2012 Nokia Corporation and/or its subsidiary(-ies)
+
+ This library is free software; you can redistribute it and/or
+ modify it under the terms of the GNU Library General Public
+ License as published by the Free Software Foundation; either
+ version 2 of the License, or (at your option) any later version.
+
+ This library is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ Library General Public License for more details.
+
+ You should have received a copy of the GNU Library General Public License
+ along with this library; see the file COPYING.LIB.  If not, write to
+ the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ Boston, MA 02110-1301, USA.
+ */
+
+#ifndef LayerBackingStore_h
+#define LayerBackingStore_h
+
+#include "HashMap.h"
+#include "ShareableBitmap.h"
+#include "TextureMapper.h"
+#include "TextureMapperBackingStore.h"
+
+namespace WebKit {
+
+class LayerBackingStoreTile : public WebCore::TextureMapperTile {
+public:
+    LayerBackingStoreTile(float scale = 1)
+        : TextureMapperTile(WebCore::FloatRect())
+        , m_scale(scale)
+    {
+    }
+
+    inline float scale() const { return m_scale; }
+    void swapBuffers(WebCore::TextureMapper*);
+    void setBackBuffer(const WebCore::IntRect&, const WebCore::IntRect&, ShareableBitmap* buffer);
+
+private:
+    RefPtr<ShareableBitmap> m_backBuffer;
+    WebCore::IntRect m_sourceRect;
+    WebCore::IntRect m_targetRect;
+    float m_scale;
+};
+
+class LayerBackingStore : public WebCore::TextureMapperBackingStore {
+public:
+    void createTile(int, float);
+    void removeTile(int);
+    void updateTile(int, const WebCore::IntRect&, const WebCore::IntRect&, ShareableBitmap*);
+    static PassRefPtr<LayerBackingStore> create() { return adoptRef(new LayerBackingStore); }
+    void swapBuffers(WebCore::TextureMapper*);
+    PassRefPtr<WebCore::BitmapTexture> texture() const;
+    virtual void paintToTextureMapper(WebCore::TextureMapper*, const WebCore::FloatRect&, const WebCore::TransformationMatrix&, float, WebCore::BitmapTexture*);
+
+private:
+    LayerBackingStore()
+        : m_scale(1.)
+    { }
+    HashMap<int, LayerBackingStoreTile> m_tiles;
+    float m_scale;
+};
+
+}
+#endif // LayerBackingStore_h
diff --git a/Source/WebKit2/UIProcess/qt/LayerTreeHostProxyQt.cpp b/Source/WebKit2/UIProcess/qt/LayerTreeHostProxyQt.cpp
index c7ca7f116..ee05eaf41 100644
--- a/Source/WebKit2/UIProcess/qt/LayerTreeHostProxyQt.cpp
+++ b/Source/WebKit2/UIProcess/qt/LayerTreeHostProxyQt.cpp
@@ -22,21 +22,22 @@
 #if USE(ACCELERATED_COMPOSITING)
 #include "LayerTreeHostProxy.h"
 
+#include "GraphicsLayerTextureMapper.h"
+#include "LayerBackingStore.h"
 #include "LayerTreeHostMessages.h"
 #include "MainThread.h"
 #include "MessageID.h"
 #include "ShareableBitmap.h"
 #include "TextureMapper.h"
+#include "TextureMapperBackingStore.h"
+#include "TextureMapperLayer.h"
 #include "UpdateInfo.h"
 #include "WebCoreArgumentCoders.h"
 #include "WebLayerTreeInfo.h"
 #include "WebPageProxy.h"
 #include "WebProcessProxy.h"
-#include "texmap/GraphicsLayerTextureMapper.h"
-#include "texmap/TextureMapper.h"
-#include "texmap/TextureMapperNode.h"
+#include <OpenGLShims.h>
 #include <QDateTime>
-#include <cairo/OpenGLShims.h>
 
 namespace WebKit {
 
@@ -148,16 +149,13 @@ class SetRootLayerMessage
 PassOwnPtr<GraphicsLayer> LayerTreeHostProxy::createLayer(WebLayerID layerID)
 {
     GraphicsLayer* newLayer = new GraphicsLayerTextureMapper(this);
-    TextureMapperNode* node = toTextureMapperNode(newLayer);
-    node->setID(layerID);
-    node->setTileOwnership(TextureMapperNode::ExternallyManagedTiles);
+    TextureMapperLayer* layer = toTextureMapperLayer(newLayer);
+    layer->setShouldUpdateBackingStoreFromLayer(false);
     return adoptPtr(newLayer);
 }
 
 LayerTreeHostProxy::LayerTreeHostProxy(DrawingAreaProxy* drawingAreaProxy)
-    : m_animationTimer(RunLoop::main(), this, &LayerTreeHostProxy::updateViewport)
-    , m_drawingAreaProxy(drawingAreaProxy)
-    , m_viewportUpdateTimer(this, &LayerTreeHostProxy::didFireViewportUpdateTimer)
+    : m_drawingAreaProxy(drawingAreaProxy)
     , m_rootLayerID(0)
 {
 }
@@ -178,12 +176,12 @@ void LayerTreeHostProxy::paintToCurrentGLContext(const TransformationMatrix& mat
     if (!currentRootLayer)
         return;
 
-    TextureMapperNode* node = toTextureMapperNode(currentRootLayer);
+    TextureMapperLayer* layer = toTextureMapperLayer(currentRootLayer);
 
-    if (!node)
+    if (!layer)
         return;
 
-    node->setTextureMapper(m_textureMapper.get());
+    layer->setTextureMapper(m_textureMapper.get());
     m_textureMapper->beginPainting();
     m_textureMapper->bindSurface(0);
     m_textureMapper->beginClip(TransformationMatrix(), clipRect);
@@ -194,14 +192,21 @@ void LayerTreeHostProxy::paintToCurrentGLContext(const TransformationMatrix& mat
         currentRootLayer->syncCompositingStateForThisLayerOnly();
     }
 
-    node->paint();
+    layer->paint();
     m_textureMapper->endClip();
     m_textureMapper->endPainting();
 
-    if (node->descendantsOrSelfHaveRunningAnimations()) {
-        node->syncAnimationsRecursively();
-        m_viewportUpdateTimer.startOneShot(0);
-    }
+    syncAnimations();
+}
+
+void LayerTreeHostProxy::syncAnimations()
+{
+    TextureMapperLayer* layer = toTextureMapperLayer(rootLayer());
+    ASSERT(layer);
+
+    layer->syncAnimationsRecursively();
+    if (layer->descendantsOrSelfHaveRunningAnimations())
+        updateViewport();
 }
 
 void LayerTreeHostProxy::paintToGraphicsContext(QPainter* painter)
@@ -210,46 +215,32 @@ void LayerTreeHostProxy::paintToGraphicsContext(QPainter* painter)
         m_textureMapper = TextureMapper::create();
     ASSERT(m_textureMapper->accelerationMode() == TextureMapper::SoftwareMode);
     syncRemoteContent();
-    TextureMapperNode* node = toTextureMapperNode(rootLayer());
+    TextureMapperLayer* layer = toTextureMapperLayer(rootLayer());
 
-    if (!node)
+    if (!layer)
         return;
 
     GraphicsContext graphicsContext(painter);
     m_textureMapper->setGraphicsContext(&graphicsContext);
     m_textureMapper->beginPainting();
     m_textureMapper->bindSurface(0);
-    node->paint();
+    layer->paint();
     m_textureMapper->endPainting();
     m_textureMapper->setGraphicsContext(0);
 }
 
-
-void LayerTreeHostProxy::didFireViewportUpdateTimer(Timer<LayerTreeHostProxy>*)
-{
-    updateViewport();
-}
-
 void LayerTreeHostProxy::updateViewport()
 {
     m_drawingAreaProxy->updateViewport();
 }
 
-int LayerTreeHostProxy::remoteTileIDToNodeTileID(int tileID) const
-{
-    HashMap<int, int>::const_iterator it = m_tileToNodeTile.find(tileID);
-    if (it == m_tileToNodeTile.end())
-        return 0;
-    return it->second;
-}
-
 void LayerTreeHostProxy::syncLayerParameters(const WebLayerInfo& layerInfo)
 {
     WebLayerID id = layerInfo.id;
     ensureLayer(id);
     LayerMap::iterator it = m_layers.find(id);
     GraphicsLayer* layer = it->second;
-    bool needsToUpdateImageTiles = layerInfo.imageIsUpdated || layerInfo.contentsRect != layer->contentsRect();
+    bool needsToUpdateImageTiles = layerInfo.imageIsUpdated || (layerInfo.contentsRect != layer->contentsRect() && layerInfo.imageBackingStoreID);
 
     layer->setName(layerInfo.name);
 
@@ -348,69 +339,41 @@ void LayerTreeHostProxy::setRootLayerID(WebLayerID layerID)
     m_rootLayer->addChild(layer);
 }
 
-void LayerTreeHostProxy::createTile(WebLayerID layerID, int tileID, float scale)
+PassRefPtr<LayerBackingStore> LayerTreeHostProxy::getBackingStore(WebLayerID id)
 {
-    ensureLayer(layerID);
-    TextureMapperNode* node = toTextureMapperNode(layerByID(layerID));
+    ensureLayer(id);
+    TextureMapperLayer* layer = toTextureMapperLayer(layerByID(id));
+    RefPtr<LayerBackingStore> backingStore = static_cast<LayerBackingStore*>(layer->backingStore().get());
+    if (!backingStore) {
+        backingStore = LayerBackingStore::create();
+        layer->setBackingStore(backingStore.get());
+    }
+    ASSERT(backingStore);
+    return backingStore;
+}
 
-    int nodeTileID = node->createContentsTile(scale);
-    m_tileToNodeTile.add(tileID, nodeTileID);
+void LayerTreeHostProxy::createTile(WebLayerID layerID, int tileID, float scale)
+{
+    getBackingStore(layerID)->createTile(tileID, scale);
 }
 
 void LayerTreeHostProxy::removeTile(WebLayerID layerID, int tileID)
 {
-    TextureMapperNode* node = toTextureMapperNode(layerByID(layerID));
-    if (!node)
-        return;
-
-    int nodeTileID = remoteTileIDToNodeTileID(tileID);
-    if (!nodeTileID)
-        return;
-
-    node->removeContentsTile(nodeTileID);
-    m_tileToNodeTile.remove(tileID);
+    getBackingStore(layerID)->removeTile(tileID);
 }
 
 void LayerTreeHostProxy::updateTile(WebLayerID layerID, int tileID, const IntRect& sourceRect, const IntRect& targetRect, ShareableBitmap* bitmap)
 {
-    ensureLayer(layerID);
-    TextureMapperNode* node = toTextureMapperNode(layerByID(layerID));
-    if (!node)
-        return;
-
-    int nodeTileID = remoteTileIDToNodeTileID(tileID);
-    if (!nodeTileID)
-        return;
-
-    node->setTextureMapper(m_textureMapper.get());
-    QImage image = bitmap->createQImage();
-    node->setContentsTileBackBuffer(nodeTileID, sourceRect, targetRect, image.constBits());
+    RefPtr<LayerBackingStore> backingStore = getBackingStore(layerID);
+    backingStore->updateTile(tileID, sourceRect, targetRect, bitmap);
+    m_backingStoresWithPendingBuffers.add(backingStore);
 }
 
 void LayerTreeHostProxy::createImage(int64_t imageID, ShareableBitmap* bitmap)
 {
-    TiledImage tiledImage;
-    static const int TileDimension = 1024;
-    QImage image = bitmap->createQImage();
-    bool imageHasAlpha = image.hasAlphaChannel();
-    IntRect imageRect(0, 0, image.width(), image.height());
-    for (int y = 0; y < image.height(); y += TileDimension) {
-        for (int x = 0; x < image.width(); x += TileDimension) {
-            QImage subImage;
-            IntRect rect(x, y, TileDimension, TileDimension);
-            rect.intersect(imageRect);
-            if (QSize(rect.size()) == image.size())
-                subImage = image;
-            else
-                subImage = image.copy(rect);
-            RefPtr<BitmapTexture> texture = m_textureMapper->createTexture();
-            texture->reset(rect.size(), !imageHasAlpha);
-            texture->updateContents(subImage.constBits(), IntRect(IntPoint::zero(), rect.size()));
-            tiledImage.add(rect.location(), texture);
-        }
-    }
-
-    m_directlyCompositedImages.set(imageID, tiledImage);
+    RefPtr<TextureMapperTiledBackingStore> backingStore = TextureMapperTiledBackingStore::create();
+    backingStore->updateContents(m_textureMapper.get(), bitmap->createImage().get(), BitmapTexture::BGRAFormat);
+    m_directlyCompositedImages.set(imageID, backingStore);
 }
 
 void LayerTreeHostProxy::destroyImage(int64_t imageID)
@@ -420,38 +383,25 @@ void LayerTreeHostProxy::destroyImage(int64_t imageID)
 
 void LayerTreeHostProxy::assignImageToLayer(GraphicsLayer* layer, int64_t imageID)
 {
-    TextureMapperNode* node = toTextureMapperNode(layer);
-    if (!node)
-        return;
-
-    if (!imageID) {
-        node->clearAllDirectlyCompositedImageTiles();
-        return;
-    }
+    HashMap<int64_t, RefPtr<TextureMapperBackingStore> >::iterator it = m_directlyCompositedImages.find(imageID);
+    ASSERT(it != m_directlyCompositedImages.end());
+    layer->setContentsToMedia(it->second.get());
+}
 
-    FloatSize size(layer->size());
-    FloatRect contentsRect(layer->contentsRect());
-    float horizontalFactor = contentsRect.width() / size.width();
-    float verticalFactor = contentsRect.height() / size.height();
-    HashMap<int64_t, TiledImage>::iterator it = m_directlyCompositedImages.find(imageID);
-    if (it == m_directlyCompositedImages.end())
-        return;
+void LayerTreeHostProxy::swapBuffers()
+{
+    HashSet<RefPtr<LayerBackingStore> >::iterator end = m_backingStoresWithPendingBuffers.end();
+    for (HashSet<RefPtr<LayerBackingStore> >::iterator it = m_backingStoresWithPendingBuffers.begin(); it != end; ++it)
+        (*it)->swapBuffers(m_textureMapper.get());
 
-    TiledImage::iterator endTileIterator = it->second.end();
-    for (TiledImage::iterator tileIt = it->second.begin(); tileIt != endTileIterator; ++tileIt) {
-        FloatRect sourceRect(FloatPoint(tileIt->first), FloatSize(tileIt->second->size()));
-        FloatRect targetRect(sourceRect.x() * horizontalFactor + contentsRect.x(),
-                             sourceRect.y() * verticalFactor + contentsRect.y(),
-                             sourceRect.width() * horizontalFactor,
-                             sourceRect.height() * verticalFactor);
-        int newTileID = node->createContentsTile(1.0);
-        node->setTileBackBufferTextureForDirectlyCompositedImage(newTileID, IntRect(sourceRect), targetRect, tileIt->second.get());
-    }
+    m_backingStoresWithPendingBuffers.clear();
 }
 
 void LayerTreeHostProxy::flushLayerChanges()
 {
     m_rootLayer->syncCompositingState(FloatRect());
+    swapBuffers();
+
     // The pending tiles state is on its way for the screen, tell the web process to render the next one.
     m_drawingAreaProxy->page()->process()->send(Messages::LayerTreeHost::RenderNextFrame(), m_drawingAreaProxy->page()->pageID());
 }
@@ -469,7 +419,7 @@ void LayerTreeHostProxy::ensureRootLayer()
     m_rootLayer->setSize(FloatSize(1.0, 1.0));
     if (!m_textureMapper)
         m_textureMapper = TextureMapper::create(TextureMapper::OpenGLMode);
-    toTextureMapperNode(m_rootLayer.get())->setTextureMapper(m_textureMapper.get());
+    toTextureMapperLayer(m_rootLayer.get())->setTextureMapper(m_textureMapper.get());
 }
 
 void LayerTreeHostProxy::syncRemoteContent()
@@ -556,7 +506,8 @@ void LayerTreeHostProxy::updateTileForLayer(int layerID, int tileID, const WebKi
     data.layerID = layerID;
     data.remoteTileID = tileID;
     data.bitmap = ShareableBitmap::create(updateInfo.bitmapHandle);
-    data.sourceRect = IntRect(IntPoint::zero(), updateInfo.updateRectBounds.size());
+    ASSERT(updateInfo.updateRects.size() == 1);
+    data.sourceRect = updateInfo.updateRects.first();
     data.targetRect = updateInfo.updateRectBounds;
     pushUpdateToQueue(UpdateTileMessage::create(data));
 }
@@ -612,29 +563,28 @@ void LayerTreeHostProxy::destroyDirectlyCompositedImage(int64_t key)
     pushUpdateToQueue(DestroyImageMessage::create(data));
 }
 
-void LayerTreeHostProxy::setVisibleContentRectTrajectoryVector(const FloatPoint& trajectoryVector)
+void LayerTreeHostProxy::setVisibleContentsRectForPanning(const IntRect& rect, const FloatPoint& trajectoryVector)
 {
-    m_drawingAreaProxy->page()->process()->send(Messages::LayerTreeHost::SetVisibleContentRectTrajectoryVector(trajectoryVector), m_drawingAreaProxy->page()->pageID());
+    m_drawingAreaProxy->page()->process()->send(Messages::LayerTreeHost::SetVisibleContentsRectForPanning(rect, trajectoryVector), m_drawingAreaProxy->page()->pageID());
 }
 
-void LayerTreeHostProxy::setVisibleContentsRectAndScale(const IntRect& rect, float scale)
+void LayerTreeHostProxy::setVisibleContentsRectForScaling(const IntRect& rect, float scale)
 {
     m_visibleContentsRect = rect;
     m_contentsScale = scale;
-    m_drawingAreaProxy->page()->process()->send(Messages::LayerTreeHost::SetVisibleContentRectAndScale(rect, scale), m_drawingAreaProxy->page()->pageID());
+    m_drawingAreaProxy->page()->process()->send(Messages::LayerTreeHost::SetVisibleContentsRectForScaling(rect, scale), m_drawingAreaProxy->page()->pageID());
 }
 
 void LayerTreeHostProxy::purgeGLResources()
 {
-    TextureMapperNode* node = toTextureMapperNode(rootLayer());
+    TextureMapperLayer* layer = toTextureMapperLayer(rootLayer());
 
-    if (node)
-        node->purgeNodeTexturesRecursive();
+    if (layer)
+        layer->clearBackingStoresRecursive();
 
     m_directlyCompositedImages.clear();
-
     m_textureMapper.clear();
-
+    m_backingStoresWithPendingBuffers.clear();
     m_drawingAreaProxy->page()->process()->send(Messages::LayerTreeHost::PurgeBackingStores(), m_drawingAreaProxy->page()->pageID());
 }
 
diff --git a/Source/WebKit2/UIProcess/qt/QtDialogRunner.cpp b/Source/WebKit2/UIProcess/qt/QtDialogRunner.cpp
index f7e2b8514..16c642934 100644
--- a/Source/WebKit2/UIProcess/qt/QtDialogRunner.cpp
+++ b/Source/WebKit2/UIProcess/qt/QtDialogRunner.cpp
@@ -102,6 +102,39 @@ private:
     QString m_prefilledUsername;
 };
 
+class ProxyAuthenticationDialogContextObject : public QObject {
+    Q_OBJECT
+    Q_PROPERTY(QString hostname READ hostname CONSTANT)
+    Q_PROPERTY(quint16 port READ port CONSTANT)
+    Q_PROPERTY(QString prefilledUsername READ prefilledUsername CONSTANT)
+
+public:
+    ProxyAuthenticationDialogContextObject(const QString& hostname, quint16 port, const QString& prefilledUsername)
+        : QObject()
+        , m_hostname(hostname)
+        , m_port(port)
+        , m_prefilledUsername(prefilledUsername)
+    {
+    }
+
+    QString hostname() const { return m_hostname; }
+    quint16 port() const { return m_port; }
+    QString prefilledUsername() const { return m_prefilledUsername; }
+
+public slots:
+    void accept(const QString& username, const QString& password) { emit accepted(username, password); }
+    void reject() { emit rejected(); }
+
+signals:
+    void accepted(const QString& username, const QString& password);
+    void rejected();
+
+private:
+    QString m_hostname;
+    quint16 m_port;
+    QString m_prefilledUsername;
+};
+
 class CertificateVerificationDialogContextObject : public QObject {
     Q_OBJECT
     Q_PROPERTY(QString hostname READ hostname CONSTANT)
@@ -174,6 +207,19 @@ bool QtDialogRunner::initForAuthentication(QDeclarativeComponent* component, QQu
     return true;
 }
 
+bool QtDialogRunner::initForProxyAuthentication(QDeclarativeComponent* component, QQuickItem* dialogParent, const QString& hostname, uint16_t port, const QString& prefilledUsername)
+{
+    ProxyAuthenticationDialogContextObject* contextObject = new ProxyAuthenticationDialogContextObject(hostname, port, prefilledUsername);
+    if (!createDialog(component, dialogParent, contextObject))
+        return false;
+
+    connect(contextObject, SIGNAL(accepted(QString, QString)), SLOT(onAuthenticationAccepted(QString, QString)));
+    connect(contextObject, SIGNAL(accepted(QString, QString)), SLOT(quit()));
+    connect(contextObject, SIGNAL(rejected()), SLOT(quit()));
+
+    return true;
+}
+
 bool QtDialogRunner::initForCertificateVerification(QDeclarativeComponent* component, QQuickItem* dialogParent, const QString& hostname)
 {
     CertificateVerificationDialogContextObject* contextObject = new CertificateVerificationDialogContextObject(hostname);
diff --git a/Source/WebKit2/UIProcess/qt/QtDialogRunner.h b/Source/WebKit2/UIProcess/qt/QtDialogRunner.h
index 96dcea27f..7fbace1ce 100644
--- a/Source/WebKit2/UIProcess/qt/QtDialogRunner.h
+++ b/Source/WebKit2/UIProcess/qt/QtDialogRunner.h
@@ -40,6 +40,7 @@ public:
     bool initForPrompt(QDeclarativeComponent*, QQuickItem* dialogParent, const QString& message, const QString& defaultValue);
     bool initForAuthentication(QDeclarativeComponent*, QQuickItem* dialogParent, const QString& hostname, const QString& realm, const QString& prefilledUsername);
     bool initForCertificateVerification(QDeclarativeComponent*, QQuickItem*, const QString& hostname);
+    bool initForProxyAuthentication(QDeclarativeComponent*, QQuickItem*, const QString& hostname, uint16_t port, const QString& prefilledUsername);
 
     QQuickItem* dialog() const { return m_dialog.get(); }
 
diff --git a/Source/WebKit2/UIProcess/qt/QtFlickProvider.cpp b/Source/WebKit2/UIProcess/qt/QtFlickProvider.cpp
new file mode 100644
index 000000000..3760c0cfb
--- /dev/null
+++ b/Source/WebKit2/UIProcess/qt/QtFlickProvider.cpp
@@ -0,0 +1,224 @@
+/*
+ * Copyright (C) 2011 Nokia Corporation and/or its subsidiary(-ies)
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this program; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ *
+ */
+
+#include "config.h"
+#include "QtFlickProvider.h"
+
+#include "qquickwebpage_p.h"
+#include "qquickwebview_p.h"
+
+#include <QCoreApplication>
+#include <QDeclarativeEngine>
+#include <QPointF>
+#include <QQuickItem>
+#include <QTouchEvent>
+#include <wtf/Assertions.h>
+
+namespace {
+
+inline QMetaMethod resolveMetaMethod(QObject* flickable, const char* name)
+{
+    ASSERT(flickable);
+
+    const QMetaObject* metaObject = flickable->metaObject();
+    ASSERT(metaObject);
+
+    int methodIndex = metaObject->indexOfMethod(name);
+    ASSERT(methodIndex != -1);
+
+    return metaObject->method(methodIndex);
+}
+
+inline QMetaProperty resolveMetaProperty(QObject* flickable, const char* name)
+{
+    ASSERT(flickable);
+
+    const QMetaObject* metaObject = flickable->metaObject();
+    ASSERT(metaObject);
+
+    int propertyIndex = metaObject->indexOfProperty(name);
+    ASSERT(propertyIndex != -1);
+
+    return metaObject->property(propertyIndex);
+}
+
+} // namespace
+
+QtFlickProvider::QtFlickProvider(QQuickWebView* viewItem, QQuickWebPage* pageItem)
+    : QObject(viewItem)
+{
+    ASSERT(viewItem);
+    ASSERT(pageItem);
+
+    QDeclarativeEngine* engine = qmlEngine(viewItem);
+    QDeclarativeContext* context = qmlContext(viewItem);
+
+    ASSERT(engine);
+    ASSERT(context);
+
+    QDeclarativeComponent component(engine, viewItem);
+
+    // Create the internal Flickable instance dynamically.
+    // We only use public QML API so that we do not depend
+    // on private API of the QtDeclarative module.
+    component.setData(QByteArrayLiteral("import QtQuick 2.0\nFlickable {}"), QUrl());
+
+    m_flickable = qobject_cast<QQuickItem*>(component.create(context));
+
+    QMetaProperty content = resolveMetaProperty(m_flickable, "contentItem");
+    m_contentItem = content.read(m_flickable).value<QQuickItem*>();
+    ASSERT(m_contentItem);
+
+    // Resolve meta methods and properties of the Flickable instance.
+    m_returnToBoundsMethod = resolveMetaMethod(m_flickable, "returnToBounds()");
+    m_cancelFlickMethod = resolveMetaMethod(m_flickable, "cancelFlick()");
+
+    m_contentWidth = resolveMetaProperty(m_flickable, "contentWidth");
+    m_contentHeight = resolveMetaProperty(m_flickable, "contentHeight");
+    m_contentX = resolveMetaProperty(m_flickable, "contentX");
+    m_contentY = resolveMetaProperty(m_flickable, "contentY");
+    m_moving = resolveMetaProperty(m_flickable, "moving");
+    m_dragging = resolveMetaProperty(m_flickable, "dragging");
+    m_flicking = resolveMetaProperty(m_flickable, "flicking");
+
+    m_flickableData = resolveMetaProperty(m_flickable, "flickableData");
+
+    // Set the viewItem as the parent of the flickable instance
+    // and reparent the page so it is placed on the flickable contentItem.
+    m_flickable->setParentItem(viewItem);
+    pageItem->setParentItem(m_contentItem);
+
+    // Propagate flickable signals.
+    connect(m_flickable, SIGNAL(movingChanged()), SIGNAL(movingChanged()), Qt::DirectConnection);
+    connect(m_flickable, SIGNAL(flickingChanged()), SIGNAL(flickingChanged()), Qt::DirectConnection);
+    connect(m_flickable, SIGNAL(draggingChanged()), SIGNAL(draggingChanged()), Qt::DirectConnection);
+    connect(m_flickable, SIGNAL(contentWidthChanged()), SIGNAL(contentWidthChanged()), Qt::DirectConnection);
+    connect(m_flickable, SIGNAL(contentHeightChanged()), SIGNAL(contentHeightChanged()), Qt::DirectConnection);
+    connect(m_flickable, SIGNAL(contentXChanged()), SIGNAL(contentXChanged()), Qt::DirectConnection);
+    connect(m_flickable, SIGNAL(contentYChanged()), SIGNAL(contentYChanged()), Qt::DirectConnection);
+}
+
+void QtFlickProvider::handleTouchFlickEvent(QTouchEvent* event)
+{
+    QCoreApplication::sendEvent(m_flickable, event);
+}
+
+QQuickItem* QtFlickProvider::contentItem()
+{
+    ASSERT(m_contentItem);
+    return m_contentItem;
+}
+
+QDeclarativeListProperty<QObject> QtFlickProvider::flickableData()
+{
+    return m_flickableData.read(m_flickable).value<QDeclarativeListProperty<QObject> >();
+}
+
+QPointF QtFlickProvider::contentPos() const
+{
+    qreal x = m_contentX.read(m_flickable).value<qreal>();
+    qreal y = m_contentY.read(m_flickable).value<qreal>();
+    return QPointF(x, y);
+}
+void QtFlickProvider::setContentPos(const QPointF& pos)
+{
+    m_contentX.write(m_flickable, pos.x());
+    m_contentY.write(m_flickable, pos.y());
+}
+
+QSizeF QtFlickProvider::viewportSize() const
+{
+    qreal width = m_flickable->width();
+    qreal height = m_flickable->height();
+
+    return QSizeF(width, height);
+}
+
+void QtFlickProvider::setViewportSize(const QSizeF& size)
+{
+    ASSERT(size.isValid());
+    m_flickable->setWidth(size.width());
+    m_flickable->setHeight(size.height());
+}
+
+void QtFlickProvider::returnToBounds()
+{
+    m_returnToBoundsMethod.invoke(m_flickable, Qt::DirectConnection);
+}
+
+void QtFlickProvider::cancelFlick()
+{
+    m_cancelFlickMethod.invoke(m_flickable, Qt::DirectConnection);
+}
+
+bool QtFlickProvider::isMoving() const
+{
+    return m_moving.read(m_flickable).value<bool>();
+}
+
+bool QtFlickProvider::isDragging() const
+{
+    return m_dragging.read(m_flickable).value<bool>();
+}
+
+bool QtFlickProvider::isFlicking() const
+{
+    return m_flicking.read(m_flickable).value<bool>();
+}
+
+qreal QtFlickProvider::contentWidth() const
+{
+    return m_contentWidth.read(m_flickable).value<qreal>();
+}
+
+void QtFlickProvider::setContentWidth(qreal width)
+{
+    m_contentWidth.write(m_flickable, width);
+}
+
+qreal QtFlickProvider::contentHeight() const
+{
+    return m_contentHeight.read(m_flickable).value<qreal>();
+}
+
+void QtFlickProvider::setContentHeight(qreal height)
+{
+    m_contentHeight.write(m_flickable, height);
+}
+
+qreal QtFlickProvider::contentX() const
+{
+    return m_contentX.read(m_flickable).value<qreal>();
+}
+
+void QtFlickProvider::setContentX(qreal x)
+{
+    m_contentX.write(m_flickable, x);
+}
+
+qreal QtFlickProvider::contentY() const
+{
+    return m_contentY.read(m_flickable).value<qreal>();
+}
+
+void QtFlickProvider::setContentY(qreal y)
+{
+    m_contentY.write(m_flickable, y);
+}
diff --git a/Source/WebKit2/UIProcess/qt/QtFlickProvider.h b/Source/WebKit2/UIProcess/qt/QtFlickProvider.h
new file mode 100644
index 000000000..f388a0b4b
--- /dev/null
+++ b/Source/WebKit2/UIProcess/qt/QtFlickProvider.h
@@ -0,0 +1,98 @@
+/*
+ * Copyright (C) 2011 Nokia Corporation and/or its subsidiary(-ies)
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this program; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ *
+ */
+
+#ifndef QtFlickProvider_h
+#define QtFlickProvider_h
+
+#include <QDeclarativeListProperty>
+#include <QMetaMethod>
+#include <QMetaProperty>
+#include <QObject>
+
+QT_BEGIN_NAMESPACE
+class QPointF;
+class QSizeF;
+class QQuickItem;
+class QQuickWebPage;
+class QQuickWebView;
+class QTouchEvent;
+QT_END_NAMESPACE
+
+class QtFlickProvider : public QObject {
+    Q_OBJECT
+public:
+    QtFlickProvider(QQuickWebView* viewItem, QQuickWebPage* pageItem);
+
+    void handleTouchFlickEvent(QTouchEvent*);
+
+    QQuickItem* contentItem();
+    QDeclarativeListProperty<QObject> flickableData();
+
+    QPointF contentPos() const;
+    void setContentPos(const QPointF&);
+
+    QSizeF viewportSize() const;
+    void setViewportSize(const QSizeF&);
+
+    void returnToBounds();
+    void cancelFlick();
+
+    bool isMoving() const;
+    bool isDragging() const;
+    bool isFlicking() const;
+
+    qreal contentWidth() const;
+    void setContentWidth(qreal);
+    qreal contentHeight() const;
+    void setContentHeight(qreal);
+    qreal contentX() const;
+    void setContentX(qreal);
+    qreal contentY() const;
+    void setContentY(qreal);
+
+Q_SIGNALS:
+    void contentWidthChanged();
+    void contentHeightChanged();
+    void contentXChanged();
+    void contentYChanged();
+    void movingChanged();
+    void flickingChanged();
+    void draggingChanged();
+
+private:
+    QMetaMethod m_returnToBoundsMethod;
+    QMetaMethod m_cancelFlickMethod;
+
+    QMetaProperty m_contentWidth;
+    QMetaProperty m_contentHeight;
+    QMetaProperty m_contentX;
+    QMetaProperty m_contentY;
+
+    QMetaProperty m_moving;
+    QMetaProperty m_dragging;
+    QMetaProperty m_flicking;
+
+    QMetaProperty m_flickableData;
+
+    QQuickItem* m_contentItem;
+    QQuickItem* m_flickable;
+};
+
+#endif // QtFlickProvider_h
diff --git a/Source/WebKit2/UIProcess/qt/QtPageClient.cpp b/Source/WebKit2/UIProcess/qt/QtPageClient.cpp
index cdc863b61..8d6ebbb03 100644
--- a/Source/WebKit2/UIProcess/qt/QtPageClient.cpp
+++ b/Source/WebKit2/UIProcess/qt/QtPageClient.cpp
@@ -123,6 +123,17 @@ void QtPageClient::handleCertificateVerificationRequest(const String& hostname,
     ignoreErrors = QQuickWebViewPrivate::get(m_webView)->handleCertificateVerificationRequest(hostname);
 }
 
+void QtPageClient::handleProxyAuthenticationRequiredRequest(const String& hostname, uint16_t port, const String& prefilledUsername, String& username, String& password)
+{
+    QString qUsername;
+    QString qPassword;
+
+    QQuickWebViewPrivate::get(m_webView)->handleProxyAuthenticationRequiredRequest(hostname, port, prefilledUsername, qUsername, qPassword);
+
+    username = qUsername;
+    password = qPassword;
+}
+
 void QtPageClient::setCursor(const WebCore::Cursor& cursor)
 {
     // FIXME: This is a temporary fix until we get cursor support in QML items.
diff --git a/Source/WebKit2/UIProcess/qt/QtPageClient.h b/Source/WebKit2/UIProcess/qt/QtPageClient.h
index 43050f502..f4ffa18ad 100644
--- a/Source/WebKit2/UIProcess/qt/QtPageClient.h
+++ b/Source/WebKit2/UIProcess/qt/QtPageClient.h
@@ -56,6 +56,7 @@ public:
     virtual void handleApplicationSchemeRequest(PassRefPtr<QtRefCountedNetworkRequestData>);
     virtual void handleAuthenticationRequiredRequest(const String& hostname, const String& realm, const String& prefilledUsername, String& username, String& password);
     virtual void handleCertificateVerificationRequest(const String& hostname, bool& ignoreErrors);
+    virtual void handleProxyAuthenticationRequiredRequest(const String& hostname, uint16_t port, const String& prefilledUsername, String& username, String& password);
 
     virtual void displayView();
     virtual void scrollView(const WebCore::IntRect& scrollRect, const WebCore::IntSize& scrollOffset);
diff --git a/Source/WebKit2/UIProcess/qt/QtPanGestureRecognizer.cpp b/Source/WebKit2/UIProcess/qt/QtPanGestureRecognizer.cpp
index 6f93c9391..1787391b7 100644
--- a/Source/WebKit2/UIProcess/qt/QtPanGestureRecognizer.cpp
+++ b/Source/WebKit2/UIProcess/qt/QtPanGestureRecognizer.cpp
@@ -37,7 +37,7 @@ QtPanGestureRecognizer::QtPanGestureRecognizer(QtWebPageEventHandler* eventHandl
     reset();
 }
 
-bool QtPanGestureRecognizer::recognize(const QTouchEvent* event, qint64 eventTimestampMillis)
+bool QtPanGestureRecognizer::recognize(const QTouchEvent* event)
 {
     if (!interactionEngine())
         return false;
@@ -62,6 +62,7 @@ bool QtPanGestureRecognizer::recognize(const QTouchEvent* event, qint64 eventTim
         ASSERT(m_state == NoGesture);
         m_state = GestureRecognitionStarted;
         m_firstPosition = touchPoint.screenPos();
+        m_touchBegin.reset(new QTouchEvent(*event));
         return false;
     case QEvent::TouchUpdate: {
         ASSERT(m_state != NoGesture);
@@ -73,16 +74,17 @@ bool QtPanGestureRecognizer::recognize(const QTouchEvent* event, qint64 eventTim
                 return false;
 
             m_state = GestureRecognized;
-            interactionEngine()->panGestureStarted(touchPoint.pos(), eventTimestampMillis);
+            ASSERT(m_touchBegin);
+            interactionEngine()->panGestureStarted(m_touchBegin.data());
         }
 
         ASSERT(m_state == GestureRecognized);
-        interactionEngine()->panGestureRequestUpdate(touchPoint.pos(), eventTimestampMillis);
+        interactionEngine()->panGestureRequestUpdate(event);
         return true;
     }
     case QEvent::TouchEnd:
         if (m_state == GestureRecognized) {
-            interactionEngine()->panGestureEnded(touchPoint.pos(), eventTimestampMillis);
+            interactionEngine()->panGestureEnded(event);
             reset();
             return true;
         }
diff --git a/Source/WebKit2/UIProcess/qt/QtPanGestureRecognizer.h b/Source/WebKit2/UIProcess/qt/QtPanGestureRecognizer.h
index 532507e09..e1e9ff3fd 100644
--- a/Source/WebKit2/UIProcess/qt/QtPanGestureRecognizer.h
+++ b/Source/WebKit2/UIProcess/qt/QtPanGestureRecognizer.h
@@ -29,6 +29,7 @@
 #include "QtGestureRecognizer.h"
 
 #include <QPointF>
+#include <QScopedPointer>
 #include <QtCore/QtGlobal>
 
 QT_BEGIN_NAMESPACE
@@ -42,11 +43,12 @@ const qreal panningInitialTriggerDistanceThreshold = 5.;
 class QtPanGestureRecognizer : public QtGestureRecognizer {
 public:
     QtPanGestureRecognizer(QtWebPageEventHandler*);
-    bool recognize(const QTouchEvent*, qint64 eventTimestampMillis);
+    bool recognize(const QTouchEvent*);
     void reset();
 
 private:
     QPointF m_firstPosition;
+    QScopedPointer<QTouchEvent> m_touchBegin;
 };
 
 } // namespace WebKit
diff --git a/Source/WebKit2/UIProcess/qt/QtViewportInteractionEngine.cpp b/Source/WebKit2/UIProcess/qt/QtViewportInteractionEngine.cpp
index 62400fa42..bfec37138 100644
--- a/Source/WebKit2/UIProcess/qt/QtViewportInteractionEngine.cpp
+++ b/Source/WebKit2/UIProcess/qt/QtViewportInteractionEngine.cpp
@@ -23,12 +23,10 @@
 #include "QtViewportInteractionEngine.h"
 
 #include "PassOwnPtr.h"
+#include "QtFlickProvider.h"
 #include "qquickwebpage_p.h"
 #include "qquickwebview_p.h"
 #include <QPointF>
-#include <QScrollEvent>
-#include <QScrollPrepareEvent>
-#include <QScrollerProperties>
 #include <QTransform>
 #include <QWheelEvent>
 #include <QtQuick/qquickitem.h>
@@ -80,7 +78,7 @@ public:
         emit engine->contentResumeRequested();
 
         // Make sure that tiles all around the viewport will be requested.
-        emit engine->viewportTrajectoryVectorChanged(QPointF());
+        emit engine->contentWasMoved(QPointF());
     }
 
 private:
@@ -114,41 +112,25 @@ inline QRectF QtViewportInteractionEngine::itemRectFromCSS(const QRectF& cssRect
     return itemRect;
 }
 
-QtViewportInteractionEngine::QtViewportInteractionEngine(const QQuickWebView* viewport, QQuickWebPage* content)
+QtViewportInteractionEngine::QtViewportInteractionEngine(QQuickWebView* viewport, QQuickWebPage* content, QtFlickProvider* flickProvider)
     : m_viewport(viewport)
     , m_content(content)
+    , m_flickProvider(flickProvider)
     , m_suspendCount(0)
+    , m_hadUserInteraction(false)
     , m_scaleAnimation(new ScaleAnimation(this))
     , m_pinchStartScale(-1)
 {
     reset();
 
-    QScrollerProperties properties = scroller()->scrollerProperties();
-
-    // The QtPanGestureRecognizer is responsible for recognizing the gesture
-    // thus we need to disable the drag start distance.
-    properties.setScrollMetric(QScrollerProperties::DragStartDistance, 0.0);
-
-    // Set some default QScroller constrains to mimic the physics engine of the N9 browser.
-    properties.setScrollMetric(QScrollerProperties::AxisLockThreshold, 0.66);
-    properties.setScrollMetric(QScrollerProperties::ScrollingCurve, QEasingCurve(QEasingCurve::OutExpo));
-    properties.setScrollMetric(QScrollerProperties::DecelerationFactor, 0.05);
-    properties.setScrollMetric(QScrollerProperties::MaximumVelocity, 0.635);
-    properties.setScrollMetric(QScrollerProperties::OvershootDragResistanceFactor, 0.33);
-    properties.setScrollMetric(QScrollerProperties::OvershootScrollDistanceFactor, 0.33);
-
-    scroller()->setScrollerProperties(properties);
-
-    connect(m_content, SIGNAL(widthChanged()), this, SLOT(itemSizeChanged()), Qt::DirectConnection);
-    connect(m_content, SIGNAL(heightChanged()), this, SLOT(itemSizeChanged()), Qt::DirectConnection);
+    connect(m_content, SIGNAL(widthChanged()), SLOT(itemSizeChanged()), Qt::DirectConnection);
+    connect(m_content, SIGNAL(heightChanged()), SLOT(itemSizeChanged()), Qt::DirectConnection);
+    connect(m_flickProvider, SIGNAL(movingChanged()), SLOT(flickableMovingStateChanged()), Qt::DirectConnection);
 
     connect(m_scaleAnimation, SIGNAL(valueChanged(QVariant)),
             SLOT(scaleAnimationValueChanged(QVariant)), Qt::DirectConnection);
     connect(m_scaleAnimation, SIGNAL(stateChanged(QAbstractAnimation::State, QAbstractAnimation::State)),
             SLOT(scaleAnimationStateChanged(QAbstractAnimation::State, QAbstractAnimation::State)), Qt::DirectConnection);
-
-    connect(scroller(), SIGNAL(stateChanged(QScroller::State)),
-            SLOT(scrollStateChanged(QScroller::State)), Qt::DirectConnection);
 }
 
 QtViewportInteractionEngine::~QtViewportInteractionEngine()
@@ -182,9 +164,11 @@ void QtViewportInteractionEngine::setItemRectVisible(const QRectF& itemRect)
 
     m_content->setContentsScale(itemScale);
 
-    // We need to animate the content but the position represents the viewport hence we need to invert the position here.
-    // To animate the position together with the scale we multiply the position with the current scale;
-    m_content->setPos(- itemRect.topLeft() * itemScale);
+    // To animate the position together with the scale we multiply the position with the current scale
+    // and add it to the page position (displacement on the flickable contentItem because of additional items).
+    QPointF newPosition(m_content->pos() + (itemRect.topLeft() * itemScale));
+
+    m_flickProvider->setContentPos(newPosition);
 }
 
 bool QtViewportInteractionEngine::animateItemRectVisible(const QRectF& itemRect)
@@ -203,6 +187,44 @@ bool QtViewportInteractionEngine::animateItemRectVisible(const QRectF& itemRect)
     return true;
 }
 
+void QtViewportInteractionEngine::flickableMovingStateChanged()
+{
+    if (m_flickProvider->isMoving()) {
+        if (m_scrollUpdateDeferrer)
+            return; // We get the isMoving() signal multiple times.
+        panMoveStarted();
+    } else
+        panMoveEnded();
+}
+
+void QtViewportInteractionEngine::panMoveStarted()
+{
+    m_scrollUpdateDeferrer = adoptPtr(new ViewportUpdateDeferrer(this));
+
+    m_lastScrollPosition = m_flickProvider->contentPos();
+    connect(m_flickProvider, SIGNAL(contentXChanged()), SLOT(flickableMovingPositionUpdate()));
+    connect(m_flickProvider, SIGNAL(contentYChanged()), SLOT(flickableMovingPositionUpdate()));
+}
+
+void QtViewportInteractionEngine::panMoveEnded()
+{
+    // This method is called on the end of the pan or pan kinetic animation.
+    m_scrollUpdateDeferrer.clear();
+
+    m_lastScrollPosition = QPointF();
+    disconnect(m_flickProvider, SIGNAL(contentXChanged()), this, SLOT(flickableMovingPositionUpdate()));
+    disconnect(m_flickProvider, SIGNAL(contentYChanged()), this, SLOT(flickableMovingPositionUpdate()));
+}
+
+void QtViewportInteractionEngine::flickableMovingPositionUpdate()
+{
+    QPointF newPosition = m_flickProvider->contentPos();
+
+    emit contentWasMoved(m_lastScrollPosition - newPosition);
+
+    m_lastScrollPosition = newPosition;
+}
+
 void QtViewportInteractionEngine::scaleAnimationStateChanged(QAbstractAnimation::State newState, QAbstractAnimation::State /*oldState*/)
 {
     switch (newState) {
@@ -218,60 +240,6 @@ void QtViewportInteractionEngine::scaleAnimationStateChanged(QAbstractAnimation:
     }
 }
 
-void QtViewportInteractionEngine::scrollStateChanged(QScroller::State newState)
-{
-    switch (newState) {
-    case QScroller::Inactive:
-        // FIXME: QScroller gets when even when tapping while it is scrolling.
-        m_scrollUpdateDeferrer.clear();
-        break;
-    case QScroller::Pressed:
-    case QScroller::Dragging:
-    case QScroller::Scrolling:
-        if (m_scrollUpdateDeferrer)
-            break;
-        m_scrollUpdateDeferrer = adoptPtr(new ViewportUpdateDeferrer(this));
-        break;
-    default:
-        break;
-    }
-}
-
-bool QtViewportInteractionEngine::event(QEvent* event)
-{
-    switch (event->type()) {
-    case QEvent::ScrollPrepare: {
-        QScrollPrepareEvent* prepareEvent = static_cast<QScrollPrepareEvent*>(event);
-        const QRectF viewportRect = m_viewport->boundingRect();
-        const QRectF contentRect = m_viewport->mapRectFromItem(m_content, m_content->boundingRect());
-        const QRectF posRange = computePosRangeForItemAtScale(m_content->contentsScale());
-        prepareEvent->setContentPosRange(posRange);
-        prepareEvent->setViewportSize(viewportRect.size());
-
-        // As we want to push the contents and not actually scroll it, we need to invert the positions here.
-        prepareEvent->setContentPos(-contentRect.topLeft());
-        prepareEvent->accept();
-        return true;
-    }
-    case QEvent::Scroll: {
-        QScrollEvent* scrollEvent = static_cast<QScrollEvent*>(event);
-        QPointF newPos = -scrollEvent->contentPos() - scrollEvent->overshootDistance();
-        if (m_content->pos() != newPos) {
-            QPointF currentPosInCSSCoordinates = m_viewport->mapToWebContent(m_content->pos());
-            QPointF newPosInCSSCoordinates = m_viewport->mapToWebContent(newPos);
-
-            // This must be emitted before viewportUpdateRequested so that the web process knows where to look for tiles.
-            emit viewportTrajectoryVectorChanged(currentPosInCSSCoordinates - newPosInCSSCoordinates);
-            m_content->setPos(newPos);
-        }
-        return true;
-    }
-    default:
-        break;
-    }
-    return QObject::event(event);
-}
-
 static inline QPointF boundPosition(const QPointF minPosition, const QPointF& position, const QPointF& maxPosition)
 {
     return QPointF(qBound(minPosition.x(), position.x(), maxPosition.x()),
@@ -304,9 +272,12 @@ void QtViewportInteractionEngine::wheelEvent(QWheelEvent* ev)
         newPos.ry() += delta;
 
     QRectF endPosRange = computePosRangeForItemAtScale(m_content->contentsScale());
-    m_content->setPos(-boundPosition(endPosRange.topLeft(), newPos, endPosRange.bottomRight()));
 
-    emit visibleContentRectAndScaleChanged();
+    QPointF currentPosition = m_flickProvider->contentPos();
+    QPointF newPosition = -boundPosition(endPosRange.topLeft(), newPos, endPosRange.bottomRight());
+    m_flickProvider->setContentPos(newPosition);
+
+    emit contentWasMoved(currentPosition - newPosition);
 }
 
 void QtViewportInteractionEngine::pagePositionRequest(const QPoint& pagePosition)
@@ -434,8 +405,10 @@ void QtViewportInteractionEngine::reset()
 
     m_hadUserInteraction = false;
 
-    scroller()->stop();
+    m_flickProvider->cancelFlick();
     m_scaleAnimation->stop();
+    m_scaleUpdateDeferrer.clear();
+    m_scrollUpdateDeferrer.clear();
 }
 
 void QtViewportInteractionEngine::applyConstraints(const Constraints& constraints)
@@ -452,7 +425,7 @@ void QtViewportInteractionEngine::applyConstraints(const Constraints& constraint
         m_content->setContentsScale(itemScaleFromCSS(initialScale));
     }
 
-    // If the web app changes successively changes the viewport on purpose
+    // If the web app successively changes the viewport on purpose
     // it wants to be in control and we should disable animations.
     ensureContentWithinViewportBoundary(/* immediate */ true);
 }
@@ -464,44 +437,49 @@ qreal QtViewportInteractionEngine::currentCSSScale()
 
 bool QtViewportInteractionEngine::scrollAnimationActive() const
 {
-    QScroller* scroller = const_cast<QtViewportInteractionEngine*>(this)->scroller();
-    return scroller->state() == QScroller::Scrolling;
-}
-
-void QtViewportInteractionEngine::interruptScrollAnimation()
-{
-    // Stopping the scroller immediately stops kinetic scrolling and if the view is out of bounds it
-    // is moved inside valid bounds immediately as well. This is the behavior that we want.
-    scroller()->stop();
+    return m_flickProvider->isFlicking();
 }
 
 bool QtViewportInteractionEngine::panGestureActive() const
 {
-    QScroller* scroller = const_cast<QtViewportInteractionEngine*>(this)->scroller();
-    return scroller->state() == QScroller::Pressed || scroller->state() == QScroller::Dragging;
+    return m_flickProvider->isDragging();
 }
 
-void QtViewportInteractionEngine::panGestureStarted(const QPointF&  viewportTouchPoint, qint64 eventTimestampMillis)
+void QtViewportInteractionEngine::panGestureStarted(const QTouchEvent* event)
 {
     m_hadUserInteraction = true;
-    scroller()->handleInput(QScroller::InputPress,  viewportTouchPoint, eventTimestampMillis);
+
+    ASSERT(event->type() == QEvent::TouchBegin);
+
+    m_flickProvider->handleTouchFlickEvent(const_cast<QTouchEvent*>(event));
+    m_lastPinchCenterInViewportCoordinates = event->touchPoints().first().pos();
 }
 
-void QtViewportInteractionEngine::panGestureRequestUpdate(const QPointF&  viewportTouchPoint, qint64 eventTimestampMillis)
+void QtViewportInteractionEngine::panGestureRequestUpdate(const QTouchEvent* event)
 {
-    scroller()->handleInput(QScroller::InputMove,  viewportTouchPoint, eventTimestampMillis);
+    ASSERT(event->type() == QEvent::TouchUpdate);
+
+    m_flickProvider->handleTouchFlickEvent(const_cast<QTouchEvent*>(event));
+    m_lastPinchCenterInViewportCoordinates = event->touchPoints().first().pos();
 }
 
 void QtViewportInteractionEngine::panGestureCancelled()
 {
-    // Stopping the scroller immediately stops kinetic scrolling and if the view is out of bounds it
-    // is moved inside valid bounds immediately as well. This is the behavior that we want.
-    scroller()->stop();
+    // Reset the velocity samples of the flickable.
+    // This should only be called by the recognizer if we have a recognized
+    // pan gesture and receive a touch event with multiple touch points
+    // (ie. transition to a pinch gesture) as it does not move the content
+    // back inside valid bounds.
+    // When the pinch gesture ends, the content is positioned and scaled
+    // back to valid boundaries.
+    m_flickProvider->cancelFlick();
 }
 
-void QtViewportInteractionEngine::panGestureEnded(const QPointF&  viewportTouchPoint, qint64 eventTimestampMillis)
+void QtViewportInteractionEngine::panGestureEnded(const QTouchEvent* event)
 {
-    scroller()->handleInput(QScroller::InputRelease,  viewportTouchPoint, eventTimestampMillis);
+    ASSERT(event->type() == QEvent::TouchEnd);
+    m_flickProvider->handleTouchFlickEvent(const_cast<QTouchEvent*>(event));
+    m_lastPinchCenterInViewportCoordinates = event->touchPoints().first().pos();
 }
 
 bool QtViewportInteractionEngine::scaleAnimationActive() const
@@ -535,7 +513,7 @@ void QtViewportInteractionEngine::pinchGestureStarted(const QPointF& pinchCenter
     m_pinchStartScale = m_content->contentsScale();
 
     // Reset the tiling look-ahead vector so that tiles all around the viewport will be requested on pinch-end.
-    emit viewportTrajectoryVectorChanged(QPointF());
+    emit contentWasMoved(QPointF());
 }
 
 void QtViewportInteractionEngine::pinchGestureRequestUpdate(const QPointF& pinchCenterInViewportCoordinates, qreal totalScaleFactor)
@@ -557,7 +535,7 @@ void QtViewportInteractionEngine::pinchGestureRequestUpdate(const QPointF& pinch
     const QPointF positionDiff = pinchCenterInViewportCoordinates - m_lastPinchCenterInViewportCoordinates;
     m_lastPinchCenterInViewportCoordinates = pinchCenterInViewportCoordinates;
 
-    m_content->setPos(m_content->pos() + positionDiff);
+    m_flickProvider->setContentPos(m_flickProvider->contentPos() - positionDiff);
 }
 
 void QtViewportInteractionEngine::pinchGestureEnded()
@@ -588,7 +566,8 @@ void QtViewportInteractionEngine::scaleContent(const QPointF& centerInCSSCoordin
     QPointF oldPinchCenterOnViewport = m_viewport->mapFromWebContent(centerInCSSCoordinates);
     m_content->setContentsScale(itemScaleFromCSS(cssScale));
     QPointF newPinchCenterOnViewport = m_viewport->mapFromWebContent(centerInCSSCoordinates);
-    m_content->setPos(m_content->pos() - (newPinchCenterOnViewport - oldPinchCenterOnViewport));
+
+    m_flickProvider->setContentPos(m_flickProvider->contentPos() + (newPinchCenterOnViewport - oldPinchCenterOnViewport));
 }
 
 #include "moc_QtViewportInteractionEngine.cpp"
diff --git a/Source/WebKit2/UIProcess/qt/QtViewportInteractionEngine.h b/Source/WebKit2/UIProcess/qt/QtViewportInteractionEngine.h
index a4b699030..9419be0f6 100644
--- a/Source/WebKit2/UIProcess/qt/QtViewportInteractionEngine.h
+++ b/Source/WebKit2/UIProcess/qt/QtViewportInteractionEngine.h
@@ -23,8 +23,8 @@
 #define QtViewportInteractionEngine_h
 
 #include "OwnPtr.h"
-#include <QScroller>
 #include "qwebkitglobal.h"
+#include <QTouchEvent>
 #include <QtCore/QObject>
 #include <QtCore/QRectF>
 #include <QtCore/QVariant>
@@ -33,6 +33,7 @@
 QT_BEGIN_NAMESPACE
 class QPointF;
 class QQuickItem;
+class QtFlickProvider;
 class QQuickWebPage;
 class QQuickWebView;
 class QWheelEvent;
@@ -46,7 +47,7 @@ class QtViewportInteractionEngine : public QObject {
     Q_OBJECT
 
 public:
-    QtViewportInteractionEngine(const QQuickWebView*, QQuickWebPage*);
+    QtViewportInteractionEngine(QQuickWebView*, QQuickWebPage*, QtFlickProvider*);
     ~QtViewportInteractionEngine();
 
     struct Constraints {
@@ -67,8 +68,6 @@ public:
         QSize layoutSize;
     };
 
-    bool event(QEvent*);
-
     void reset();
     void applyConstraints(const Constraints&);
 
@@ -79,13 +78,12 @@ public:
     void pagePositionRequest(const QPoint& pos);
 
     bool scrollAnimationActive() const;
-    void interruptScrollAnimation();
 
     bool panGestureActive() const;
-    void panGestureStarted(const QPointF&  viewportTouchPoint, qint64 eventTimestampMillis);
-    void panGestureRequestUpdate(const QPointF&  viewportTouchPoint, qint64 eventTimestampMillis);
+    void panGestureStarted(const QTouchEvent*);
+    void panGestureRequestUpdate(const QTouchEvent*);
     void panGestureCancelled();
-    void panGestureEnded(const QPointF&  viewportTouchPoint, qint64 eventTimestampMillis);
+    void panGestureEnded(const QTouchEvent*);
 
     bool scaleAnimationActive() const;
     void interruptScaleAnimation();
@@ -105,6 +103,9 @@ Q_SIGNALS:
     void contentSuspendRequested();
     void contentResumeRequested();
 
+    void contentWasMoved(const QPointF& trajectoryVector);
+    void contentWasScaled();
+
     void viewportTrajectoryVectorChanged(const QPointF&);
     void visibleContentRectAndScaleChanged();
 
@@ -112,7 +113,9 @@ private Q_SLOTS:
     // Respond to changes of content that are not driven by us, like the page resizing itself.
     void itemSizeChanged();
 
-    void scrollStateChanged(QScroller::State);
+    void flickableMovingStateChanged();
+    void flickableMovingPositionUpdate();
+
     void scaleAnimationStateChanged(QAbstractAnimation::State, QAbstractAnimation::State);
     void scaleAnimationValueChanged(QVariant value) { setItemRectVisible(value.toRectF()); }
 
@@ -127,18 +130,19 @@ private:
     qreal innerBoundedCSSScale(qreal);
     qreal outerBoundedCSSScale(qreal);
 
+    void panMoveStarted(); // Called when panning starts.
+    void panMoveEnded(); //   Called when panning (+ kinetic animation) ends.
+
     QRectF computePosRangeForItemAtScale(qreal itemScale) const;
     bool ensureContentWithinViewportBoundary(bool immediate = false);
 
     void scaleContent(const QPointF& centerInCSSCoordinates, qreal cssScale);
 
-    // As long as the object exists this function will always return the same QScroller instance.
-    QScroller* scroller() { return QScroller::scroller(this); }
-
-
-    const QQuickWebView* const m_viewport;
+    QQuickWebView* const m_viewport;
     QQuickWebPage* const m_content;
 
+    QtFlickProvider* const m_flickProvider;
+
     Constraints m_constraints;
 
     int m_suspendCount;
@@ -158,6 +162,7 @@ private:
 
     ScaleAnimation* m_scaleAnimation;
     QPointF m_lastPinchCenterInViewportCoordinates;
+    QPointF m_lastScrollPosition;
     qreal m_pinchStartScale;
 };
 
diff --git a/Source/WebKit2/UIProcess/qt/QtWebPageEventHandler.cpp b/Source/WebKit2/UIProcess/qt/QtWebPageEventHandler.cpp
index a07967801..7d089929a 100644
--- a/Source/WebKit2/UIProcess/qt/QtWebPageEventHandler.cpp
+++ b/Source/WebKit2/UIProcess/qt/QtWebPageEventHandler.cpp
@@ -27,6 +27,7 @@
 #include "QtViewportInteractionEngine.h"
 #include "qquickwebpage_p.h"
 #include "qquickwebview_p.h"
+#include <QCursor>
 #include <QDrag>
 #include <QGraphicsSceneMouseEvent>
 #include <QGuiApplication>
@@ -142,6 +143,7 @@ bool QtWebPageEventHandler::handleEvent(QEvent* ev)
         return handleFocusOutEvent(static_cast<QFocusEvent*>(ev));
     case QEvent::TouchBegin:
     case QEvent::TouchEnd:
+    case QEvent::TouchCancel:
     case QEvent::TouchUpdate:
         touchEvent(static_cast<QTouchEvent*>(ev));
         return true;
@@ -461,8 +463,6 @@ void QtWebPageEventHandler::updateTextInputState()
 
     const EditorState& editor = m_webPageProxy->editorState();
 
-    m_webView->setInputMethodHints(Qt::InputMethodHints(editor.inputMethodHints));
-
     if (!m_webView->hasFocus())
         return;
 
@@ -507,8 +507,7 @@ void QtWebPageEventHandler::doneWithTouchEvent(const NativeWebTouchEvent& event,
         // The interaction engine might still be animating kinetic scrolling or a scale animation
         // such as double-tap to zoom or the bounce back effect. A touch stops the kinetic scrolling
         // where as it does not stop the scale animation.
-        if (m_interactionEngine->scrollAnimationActive())
-            m_interactionEngine->interruptScrollAnimation();
+        // Sending the event to the flickProvider will stop the kinetic scrolling animation.
         break;
     case QEvent::TouchUpdate:
         // The scale animation can only be interrupted by a pinch gesture, which will then take over.
@@ -524,15 +523,14 @@ void QtWebPageEventHandler::doneWithTouchEvent(const NativeWebTouchEvent& event,
     if (m_interactionEngine->scaleAnimationActive())
         return;
 
-    // Convert the event timestamp from second to millisecond.
-    qint64 eventTimestampMillis = static_cast<qint64>(event.timestamp() * 1000);
-    m_panGestureRecognizer.recognize(ev, eventTimestampMillis);
+    m_panGestureRecognizer.recognize(ev);
     m_pinchGestureRecognizer.recognize(ev);
 
     if (m_panGestureRecognizer.isRecognized() || m_pinchGestureRecognizer.isRecognized())
         m_tapGestureRecognizer.reset();
     else {
-        const QTouchEvent* ev = event.nativeEvent();
+        // Convert the event timestamp from second to millisecond.
+        qint64 eventTimestampMillis = static_cast<qint64>(event.timestamp() * 1000);
         m_tapGestureRecognizer.recognize(ev, eventTimestampMillis);
     }
 }
diff --git a/Source/WebKit2/UIProcess/qt/QtWebPagePolicyClient.cpp b/Source/WebKit2/UIProcess/qt/QtWebPagePolicyClient.cpp
index e77fb1463..ad8ced73f 100644
--- a/Source/WebKit2/UIProcess/qt/QtWebPagePolicyClient.cpp
+++ b/Source/WebKit2/UIProcess/qt/QtWebPagePolicyClient.cpp
@@ -23,7 +23,6 @@
 
 #include "WKFrame.h"
 #include "WKURLQt.h"
-#include "qquickwebview_p.h"
 #include "qquickwebview_p_p.h"
 #include "qwebnavigationrequest_p.h"
 #include <QtCore/QObject>
@@ -42,11 +41,12 @@ QtWebPagePolicyClient::QtWebPagePolicyClient(WKPageRef pageRef, QQuickWebView* w
     WKPageSetPagePolicyClient(pageRef, &policyClient);
 }
 
-void QtWebPagePolicyClient::decidePolicyForNavigationAction(const QUrl& url, const QUrl& originatingUrl, Qt::MouseButton mouseButton, Qt::KeyboardModifiers keyboardModifiers, WKFramePolicyListenerRef listener)
+void QtWebPagePolicyClient::decidePolicyForNavigationAction(const QUrl& url, const QUrl& originatingUrl, Qt::MouseButton mouseButton,
+                                                            Qt::KeyboardModifiers keyboardModifiers, QQuickWebView::NavigationType navigationType, WKFramePolicyListenerRef listener)
 {
     // NOTE: even though the C API (and the WebKit2 IPC) supports an asynchronous answer, this is not currently working.
     // We are expected to call the listener immediately. See the patch for https://bugs.webkit.org/show_bug.cgi?id=53785.
-    QWebNavigationRequest navigationRequest(url, originatingUrl, mouseButton, keyboardModifiers);
+    QWebNavigationRequest navigationRequest(url, originatingUrl, mouseButton, keyboardModifiers, navigationType);
     emit m_webView->navigationRequested(&navigationRequest);
 
     switch (navigationRequest.action()) {
@@ -99,13 +99,33 @@ static Qt::KeyboardModifiers toQtKeyboardModifiers(WKEventModifiers modifiers)
     return qtModifiers;
 }
 
-void QtWebPagePolicyClient::decidePolicyForNavigationAction(WKPageRef, WKFrameRef frame, WKFrameNavigationType, WKEventModifiers modifiers, WKEventMouseButton mouseButton, WKURLRequestRef request, WKFramePolicyListenerRef listener, WKTypeRef, const void* clientInfo)
+static QQuickWebView::NavigationType toQuickWebViewNavigationType(WKFrameNavigationType navigationType)
+{
+    switch (navigationType) {
+    case kWKFrameNavigationTypeLinkClicked:
+        return QQuickWebView::LinkClickedNavigation;
+    case kWKFrameNavigationTypeFormSubmitted:
+        return QQuickWebView::FormSubmittedNavigation;
+    case kWKFrameNavigationTypeBackForward:
+        return QQuickWebView::BackForwardNavigation;
+    case kWKFrameNavigationTypeReload:
+        return QQuickWebView::ReloadNavigation;
+    case kWKFrameNavigationTypeFormResubmitted:
+        return QQuickWebView::FormResubmittedNavigation;
+    case kWKFrameNavigationTypeOther:
+        return QQuickWebView::OtherNavigation;
+    }
+    ASSERT_NOT_REACHED();
+    return QQuickWebView::OtherNavigation;
+}
+
+void QtWebPagePolicyClient::decidePolicyForNavigationAction(WKPageRef, WKFrameRef frame, WKFrameNavigationType navigationType, WKEventModifiers modifiers, WKEventMouseButton mouseButton, WKURLRequestRef request, WKFramePolicyListenerRef listener, WKTypeRef, const void* clientInfo)
 {
     WKRetainPtr<WKURLRef> frameURL(AdoptWK, WKFrameCopyURL(frame));
     WKRetainPtr<WKURLRef> requestURL(AdoptWK, WKURLRequestCopyURL(request));
     QUrl qUrlFrame = WKURLCopyQUrl(frameURL.get());
     QUrl qUrl = WKURLCopyQUrl(requestURL.get());
-    toQtWebPagePolicyClient(clientInfo)->decidePolicyForNavigationAction(qUrl, qUrlFrame, toQtMouseButton(mouseButton), toQtKeyboardModifiers(modifiers), listener);
+    toQtWebPagePolicyClient(clientInfo)->decidePolicyForNavigationAction(qUrl, qUrlFrame, toQtMouseButton(mouseButton), toQtKeyboardModifiers(modifiers), toQuickWebViewNavigationType(navigationType), listener);
 }
 
 void QtWebPagePolicyClient::decidePolicyForResponse(WKPageRef page, WKFrameRef frame, WKURLResponseRef response, WKURLRequestRef, WKFramePolicyListenerRef listener, WKTypeRef, const void*)
diff --git a/Source/WebKit2/UIProcess/qt/QtWebPagePolicyClient.h b/Source/WebKit2/UIProcess/qt/QtWebPagePolicyClient.h
index 8c6021398..e393d54f3 100644
--- a/Source/WebKit2/UIProcess/qt/QtWebPagePolicyClient.h
+++ b/Source/WebKit2/UIProcess/qt/QtWebPagePolicyClient.h
@@ -21,17 +21,17 @@
 #ifndef QtWebPagePolicyClient_h
 #define QtWebPagePolicyClient_h
 
+#include "qquickwebview_p.h"
 #include <QtCore/QUrl>
 #include <WKPage.h>
 
 class QQuickWebView;
-
 class QtWebPagePolicyClient {
 public:
     QtWebPagePolicyClient(WKPageRef, QQuickWebView*);
 
 private:
-    void decidePolicyForNavigationAction(const QUrl&, const QUrl&, Qt::MouseButton, Qt::KeyboardModifiers, WKFramePolicyListenerRef);
+    void decidePolicyForNavigationAction(const QUrl&, const QUrl&, Qt::MouseButton, Qt::KeyboardModifiers, QQuickWebView::NavigationType, WKFramePolicyListenerRef);
 
     // WKPagePolicyClient callbacks.
     static void decidePolicyForNavigationAction(WKPageRef, WKFrameRef, WKFrameNavigationType, WKEventModifiers, WKEventMouseButton, WKURLRequestRef, WKFramePolicyListenerRef, WKTypeRef userData, const void* clientInfo);
diff --git a/Source/WebKit2/UIProcess/win/WebPopupMenuProxyWin.cpp b/Source/WebKit2/UIProcess/win/WebPopupMenuProxyWin.cpp
index a040ad4aa..0c18c4e83 100644
--- a/Source/WebKit2/UIProcess/win/WebPopupMenuProxyWin.cpp
+++ b/Source/WebKit2/UIProcess/win/WebPopupMenuProxyWin.cpp
@@ -946,12 +946,12 @@ bool WebPopupMenuProxyWin::scrollToRevealSelection()
     int index = focusedIndex();
 
     if (index < m_scrollOffset) {
-        ScrollableArea::scrollToYOffsetWithoutAnimation(index);
+        ScrollableArea::scrollToOffsetWithoutAnimation(VerticalScrollbar, index);
         return true;
     }
 
     if (index >= m_scrollOffset + visibleItems()) {
-        ScrollableArea::scrollToYOffsetWithoutAnimation(index - visibleItems() + 1);
+        ScrollableArea::scrollToOffsetWithoutAnimation(VerticalScrollbar, index - visibleItems() + 1);
         return true;
     }
 
diff --git a/Source/WebKit2/WebProcess/InjectedBundle/InjectedBundle.cpp b/Source/WebKit2/WebProcess/InjectedBundle/InjectedBundle.cpp
index f40a24a2e..2267d66a9 100644
--- a/Source/WebKit2/WebProcess/InjectedBundle/InjectedBundle.cpp
+++ b/Source/WebKit2/WebProcess/InjectedBundle/InjectedBundle.cpp
@@ -128,6 +128,7 @@ void InjectedBundle::overrideBoolPreferenceForTestRunner(WebPageGroupProxy* page
 #define FOR_EACH_OVERRIDE_BOOL_PREFERENCE(macro) \
     macro(WebKitAcceleratedCompositingEnabled, AcceleratedCompositingEnabled, acceleratedCompositingEnabled) \
     macro(WebKitCSSCustomFilterEnabled, CSSCustomFilterEnabled, cssCustomFilterEnabled) \
+    macro(WebKitCSSRegionsEnabled, CSSRegionsEnabled, cssRegionsEnabled) \
     macro(WebKitJavaEnabled, JavaEnabled, javaEnabled) \
     macro(WebKitJavaScriptEnabled, ScriptEnabled, javaScriptEnabled) \
     macro(WebKitLoadSiteIconsKey, LoadsSiteIconsIgnoringImageLoadingSetting, loadsSiteIconsIgnoringImageLoadingPreference) \
diff --git a/Source/WebKit2/WebProcess/Notifications/WebNotificationManager.cpp b/Source/WebKit2/WebProcess/Notifications/WebNotificationManager.cpp
index 84b52c2ac..90a7f4021 100644
--- a/Source/WebKit2/WebProcess/Notifications/WebNotificationManager.cpp
+++ b/Source/WebKit2/WebProcess/Notifications/WebNotificationManager.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2011 Apple Inc. All rights reserved.
+ * Copyright (C) 2011, 2012 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -114,11 +114,7 @@ bool WebNotificationManager::show(Notification* notification, WebPage* page)
     m_notificationMap.set(notification, notificationID);
     m_notificationIDMap.set(notificationID, notification);
     
-    NotificationContextMap::iterator it = m_notificationContextMap.find(notification->scriptExecutionContext());
-    if (it == m_notificationContextMap.end()) {
-        pair<NotificationContextMap::iterator, bool> addedPair = m_notificationContextMap.add(notification->scriptExecutionContext(), Vector<uint64_t>());
-        it = addedPair.first;
-    }
+    NotificationContextMap::iterator it = m_notificationContextMap.add(notification->scriptExecutionContext(), Vector<uint64_t>()).first;
     it->second.append(notificationID);
     
     m_process->connection()->send(Messages::WebPageProxy::ShowNotification(notification->contents().title, notification->contents().body, notification->iconURL().string(), notification->scriptExecutionContext()->securityOrigin()->toString(), notificationID), page->pageID());
@@ -149,7 +145,16 @@ void WebNotificationManager::clearNotifications(WebCore::ScriptExecutionContext*
     if (it == m_notificationContextMap.end())
         return;
     
-    m_process->connection()->send(Messages::WebNotificationManagerProxy::ClearNotifications(it->second), page->pageID());
+    Vector<uint64_t>& notificationIDs = it->second;
+    m_process->connection()->send(Messages::WebNotificationManagerProxy::ClearNotifications(notificationIDs), page->pageID());
+    size_t count = notificationIDs.size();
+    for (size_t i = 0; i < count; ++i) {
+        RefPtr<Notification> notification = m_notificationIDMap.take(notificationIDs[i]);
+        if (!notification)
+            continue;
+        m_notificationMap.remove(notification);
+    }
+    
     m_notificationContextMap.remove(it);
 #endif
 }
@@ -161,7 +166,8 @@ void WebNotificationManager::didDestroyNotification(Notification* notification,
     if (!notificationID)
         return;
 
-    m_notificationIDMap.take(notificationID);
+    m_notificationIDMap.remove(notificationID);
+    removeNotificationFromContextMap(notificationID, notification);
     m_process->connection()->send(Messages::WebNotificationManagerProxy::DidDestroyNotification(notificationID), page->pageID());
 #endif
 }
@@ -203,19 +209,30 @@ void WebNotificationManager::didCloseNotifications(const Vector<uint64_t>& notif
         if (!isNotificationIDValid(notificationID))
             continue;
 
-        RefPtr<Notification> notification = m_notificationIDMap.get(notificationID);
+        RefPtr<Notification> notification = m_notificationIDMap.take(notificationID);
         if (!notification)
             continue;
 
-        NotificationContextMap::iterator it = m_notificationContextMap.find(notification->scriptExecutionContext());
-        ASSERT(it != m_notificationContextMap.end());
-        size_t index = it->second.find(notificationID);
-        ASSERT(index != notFound);
-        it->second.remove(index);
+        m_notificationMap.remove(notification);
+        removeNotificationFromContextMap(notificationID, notification.get());
 
         notification->dispatchCloseEvent();
     }
 #endif
 }
 
+#if ENABLE(NOTIFICATIONS)
+void WebNotificationManager::removeNotificationFromContextMap(uint64_t notificationID, Notification* notification)
+{
+    // This is a helper function for managing the hash maps.
+    NotificationContextMap::iterator it = m_notificationContextMap.find(notification->scriptExecutionContext());
+    ASSERT(it != m_notificationContextMap.end());
+    size_t index = it->second.find(notificationID);
+    ASSERT(index != notFound);
+    it->second.remove(index);
+    if (it->second.isEmpty())
+        m_notificationContextMap.remove(it);
+}
+#endif
+
 } // namespace WebKit
diff --git a/Source/WebKit2/WebProcess/Notifications/WebNotificationManager.h b/Source/WebKit2/WebProcess/Notifications/WebNotificationManager.h
index dc550e231..3b788be20 100644
--- a/Source/WebKit2/WebProcess/Notifications/WebNotificationManager.h
+++ b/Source/WebKit2/WebProcess/Notifications/WebNotificationManager.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2011 Apple Inc. All rights reserved.
+ * Copyright (C) 2011, 2012 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -77,6 +77,10 @@ private:
     void didCloseNotifications(const Vector<uint64_t>& notificationIDs);
     void didUpdateNotificationDecision(const String& originString, bool allowed);
     void didRemoveNotificationDecisions(const Vector<String>& originStrings);
+    
+#if ENABLE(NOTIFICATIONS)
+    void removeNotificationFromContextMap(uint64_t notificationID, WebCore::Notification*);
+#endif
 
     WebProcess* m_process;
 
diff --git a/Source/WebKit2/WebProcess/Plugins/Netscape/NPRuntimeObjectMap.cpp b/Source/WebKit2/WebProcess/Plugins/Netscape/NPRuntimeObjectMap.cpp
index b4657f95f..01e73f95f 100644
--- a/Source/WebKit2/WebProcess/Plugins/Netscape/NPRuntimeObjectMap.cpp
+++ b/Source/WebKit2/WebProcess/Plugins/Netscape/NPRuntimeObjectMap.cpp
@@ -98,11 +98,11 @@ JSObject* NPRuntimeObjectMap::getOrCreateJSObject(JSGlobalObject* globalObject,
     if (NPJSObject::isNPJSObject(npObject))
         return NPJSObject::toNPJSObject(npObject)->jsObject();
     
-    if (JSC::Weak<JSNPObject> jsNPObject = m_jsNPObjects.get(npObject))
-        return jsNPObject.get();
+    if (JSNPObject* jsNPObject = m_jsNPObjects.get(npObject))
+        return jsNPObject;
 
     JSNPObject* jsNPObject = JSNPObject::create(globalObject, this, npObject);
-    m_jsNPObjects.set(npObject, JSC::Weak<JSNPObject>(globalObject->globalData(), jsNPObject, this, npObject));
+    m_jsNPObjects.set(npObject, JSC::PassWeak<JSNPObject>(globalObject->globalData(), jsNPObject, this, npObject));
 
     return jsNPObject;
 }
diff --git a/Source/WebKit2/WebProcess/Plugins/PDF/BuiltInPDFView.h b/Source/WebKit2/WebProcess/Plugins/PDF/BuiltInPDFView.h
index c185c1871..d6c364f00 100644
--- a/Source/WebKit2/WebProcess/Plugins/PDF/BuiltInPDFView.h
+++ b/Source/WebKit2/WebProcess/Plugins/PDF/BuiltInPDFView.h
@@ -140,7 +140,6 @@ private:
     virtual bool isOnActivePage() const;
     virtual bool shouldSuspendScrollAnimations() const { return false; } // If we return true, ScrollAnimatorMac will keep cycling a timer forever, waiting for a good time to animate.
     virtual void scrollbarStyleChanged(int newStyle, bool forceUpdate);
-    virtual void zoomAnimatorTransformChanged(float, float, float, ZoomAnimationState) { }
 
     // FIXME: Implement the other conversion functions; this one is enough to get scrollbar hit testing working.
     virtual WebCore::IntPoint convertFromContainingViewToScrollbar(const WebCore::Scrollbar*, const WebCore::IntPoint& parentPoint) const;
diff --git a/Source/WebKit2/WebProcess/WebCoreSupport/WebChromeClient.h b/Source/WebKit2/WebProcess/WebCoreSupport/WebChromeClient.h
index dd68e1f9b..9761c154a 100644
--- a/Source/WebKit2/WebProcess/WebCoreSupport/WebChromeClient.h
+++ b/Source/WebKit2/WebProcess/WebCoreSupport/WebChromeClient.h
@@ -220,6 +220,7 @@ private:
     virtual bool shouldRubberBandInDirection(WebCore::ScrollDirection) const OVERRIDE;
     
     virtual void numWheelEventHandlersChanged(unsigned) OVERRIDE;
+    virtual void numTouchEventHandlersChanged(unsigned) OVERRIDE { }
 
     String m_cachedToolTip;
     mutable RefPtr<WebFrame> m_cachedFrameSetLargestFrame;
diff --git a/Source/WebKit2/WebProcess/WebCoreSupport/WebDragClient.h b/Source/WebKit2/WebProcess/WebCoreSupport/WebDragClient.h
index 913eb6e56..a9411ac40 100644
--- a/Source/WebKit2/WebProcess/WebCoreSupport/WebDragClient.h
+++ b/Source/WebKit2/WebProcess/WebCoreSupport/WebDragClient.h
@@ -53,7 +53,7 @@ private:
     virtual void startDrag(WebCore::DragImageRef, const WebCore::IntPoint& dragImageOrigin, const WebCore::IntPoint& eventPos, WebCore::Clipboard*, WebCore::Frame*, bool linkDrag = false) OVERRIDE;
 
 #if PLATFORM(MAC)
-    virtual void declareAndWriteDragImage(NSPasteboard*, DOMElement*, NSURL*, NSString*, WebCore::Frame*) OVERRIDE;
+    virtual void declareAndWriteDragImage(const String& pasteboardName, DOMElement*, NSURL*, NSString*, WebCore::Frame*) OVERRIDE;
 #endif
 
     virtual void dragEnded() OVERRIDE;
diff --git a/Source/WebKit2/WebProcess/WebCoreSupport/WebEditorClient.cpp b/Source/WebKit2/WebProcess/WebCoreSupport/WebEditorClient.cpp
index f22b26074..c74216786 100644
--- a/Source/WebKit2/WebProcess/WebCoreSupport/WebEditorClient.cpp
+++ b/Source/WebKit2/WebProcess/WebCoreSupport/WebEditorClient.cpp
@@ -148,9 +148,9 @@ bool WebEditorClient::shouldChangeSelectedRange(Range* fromRange, Range* toRange
     return result;
 }
     
-bool WebEditorClient::shouldApplyStyle(CSSStyleDeclaration* style, Range* range)
+bool WebEditorClient::shouldApplyStyle(StylePropertySet* style, Range* range)
 {
-    bool result = m_page->injectedBundleEditorClient().shouldApplyStyle(m_page, style, range);
+    bool result = m_page->injectedBundleEditorClient().shouldApplyStyle(m_page, style->ensureCSSStyleDeclaration(), range);
     notImplemented();
     return result;
 }
@@ -447,7 +447,7 @@ void WebEditorClient::setInputMethodState(bool)
     notImplemented();
 }
 
-void WebEditorClient::requestCheckingOfString(WebCore::SpellChecker*, int, WebCore::TextCheckingTypeMask, const WTF::String&)
+void WebEditorClient::requestCheckingOfString(WebCore::SpellChecker*, const WebCore::TextCheckingRequest&)
 {
     notImplemented();
 }
diff --git a/Source/WebKit2/WebProcess/WebCoreSupport/WebEditorClient.h b/Source/WebKit2/WebProcess/WebCoreSupport/WebEditorClient.h
index 8f262205b..2fb3150bd 100644
--- a/Source/WebKit2/WebProcess/WebCoreSupport/WebEditorClient.h
+++ b/Source/WebKit2/WebProcess/WebCoreSupport/WebEditorClient.h
@@ -59,7 +59,7 @@ private:
     virtual bool shouldInsertText(const String&, WebCore::Range*, WebCore::EditorInsertAction) OVERRIDE;
     virtual bool shouldChangeSelectedRange(WebCore::Range* fromRange, WebCore::Range* toRange, WebCore::EAffinity, bool stillSelecting) OVERRIDE;
     
-    virtual bool shouldApplyStyle(WebCore::CSSStyleDeclaration*, WebCore::Range*) OVERRIDE;
+    virtual bool shouldApplyStyle(WebCore::StylePropertySet*, WebCore::Range*) OVERRIDE;
     virtual bool shouldMoveRangeAfterDelete(WebCore::Range*, WebCore::Range*) OVERRIDE;
 
     virtual void didBeginEditing() OVERRIDE;
@@ -141,7 +141,7 @@ private:
     virtual void getGuessesForWord(const String& word, const String& context, Vector<String>& guesses) OVERRIDE;
     virtual void willSetInputMethodState() OVERRIDE;
     virtual void setInputMethodState(bool enabled) OVERRIDE;
-    virtual void requestCheckingOfString(WebCore::SpellChecker*, int, WebCore::TextCheckingTypeMask, const WTF::String&) OVERRIDE;
+    virtual void requestCheckingOfString(WebCore::SpellChecker*, const WebCore::TextCheckingRequest&) OVERRIDE;
 #if PLATFORM(MAC) && !defined(BUILDING_ON_SNOW_LEOPARD)
     virtual void showCorrectionPanel(WebCore::CorrectionPanelInfo::PanelType, const WebCore::FloatRect& boundingBoxOfReplacedString, const String& replacedString, const String& replacementString, const Vector<String>& alternativeReplacementStrings) OVERRIDE;
     virtual void dismissCorrectionPanel(WebCore::ReasonForDismissingCorrectionPanel) OVERRIDE;
diff --git a/Source/WebKit2/WebProcess/WebCoreSupport/WebFrameLoaderClient.cpp b/Source/WebKit2/WebProcess/WebCoreSupport/WebFrameLoaderClient.cpp
index be24684db..49d3b84c4 100644
--- a/Source/WebKit2/WebProcess/WebCoreSupport/WebFrameLoaderClient.cpp
+++ b/Source/WebKit2/WebProcess/WebCoreSupport/WebFrameLoaderClient.cpp
@@ -537,7 +537,7 @@ void WebFrameLoaderClient::dispatchDidFirstLayout()
     // Notify the UIProcess.
     webPage->send(Messages::WebPageProxy::DidFirstLayoutForFrame(m_frame->frameID(), InjectedBundleUserMessageEncoder(userData.get())));
 
-    if (m_frame == m_frame->page()->mainWebFrame() && !webPage->corePage()->settings()->suppressIncrementalRendering())
+    if (m_frame == m_frame->page()->mainWebFrame() && !webPage->corePage()->settings()->suppressesIncrementalRendering())
         webPage->drawingArea()->setLayerTreeStateIsFrozen(false);
 }
 
@@ -932,6 +932,11 @@ bool WebFrameLoaderClient::shouldGoToHistoryItem(HistoryItem* item) const
         return false;
     }
     
+    if (webPage->willGoToBackForwardItemCallbackEnabled()) {
+        webPage->send(Messages::WebPageProxy::WillGoToBackForwardListItem(itemID));
+        return true;
+    }
+    
     bool shouldGoToBackForwardListItem;
     if (!webPage->sendSync(Messages::WebPageProxy::ShouldGoToBackForwardListItem(itemID), Messages::WebPageProxy::ShouldGoToBackForwardListItem::Reply(shouldGoToBackForwardListItem)))
         return false;
diff --git a/Source/WebKit2/WebProcess/WebCoreSupport/WebGraphicsLayer.cpp b/Source/WebKit2/WebProcess/WebCoreSupport/WebGraphicsLayer.cpp
index 14b86aea4..8fd108ad2 100644
--- a/Source/WebKit2/WebProcess/WebCoreSupport/WebGraphicsLayer.cpp
+++ b/Source/WebKit2/WebProcess/WebCoreSupport/WebGraphicsLayer.cpp
@@ -87,12 +87,10 @@ WebGraphicsLayer::WebGraphicsLayer(GraphicsLayerClient* client)
     , m_hasPendingAnimations(false)
     , m_inUpdateMode(false)
 #if USE(TILED_BACKING_STORE)
-    , m_layerTreeTileClient(0)
-    , m_mainBackingStore(adoptPtr(new TiledBackingStore(this, TiledBackingStoreRemoteTileBackend::create(this))))
+    , m_webGraphicsLayerClient(0)
     , m_contentsScale(1.f)
 #endif
 {
-    m_mainBackingStore->setContentsScale(1.0);
     static WebLayerID nextLayerID = 1;
     m_layerInfo.id = nextLayerID++;
     layerByIDMap().add(id(), this);
@@ -102,11 +100,10 @@ WebGraphicsLayer::~WebGraphicsLayer()
 {
     layerByIDMap().remove(id());
 
-    // This would tell the UI process to release the backing store.
-    setContentsToImage(0);
-
-    if (m_layerTreeTileClient)
-        m_layerTreeTileClient->didDeleteLayer(id());
+    if (m_webGraphicsLayerClient) {
+        purgeBackingStores();
+        m_webGraphicsLayerClient->detachLayer(this);
+    }
 }
 
 bool WebGraphicsLayer::setChildren(const Vector<GraphicsLayer*>& children)
@@ -116,7 +113,7 @@ bool WebGraphicsLayer::setChildren(const Vector<GraphicsLayer*>& children)
         return false;
     for (int i = 0; i < children.size(); ++i) {
         WebGraphicsLayer* child = toWebGraphicsLayer(children[i]);
-        child->setVisibleContentRectAndScale(m_pageVisibleRect, m_contentsScale);
+        child->setWebGraphicsLayerClient(m_webGraphicsLayerClient);
         child->notifyChange();
     }
     notifyChange();
@@ -126,7 +123,7 @@ bool WebGraphicsLayer::setChildren(const Vector<GraphicsLayer*>& children)
 void WebGraphicsLayer::addChild(GraphicsLayer* layer)
 {
     GraphicsLayer::addChild(layer);
-    toWebGraphicsLayer(layer)->setVisibleContentRectAndScale(m_pageVisibleRect, m_contentsScale);
+    toWebGraphicsLayer(layer)->setWebGraphicsLayerClient(m_webGraphicsLayerClient);
     toWebGraphicsLayer(layer)->notifyChange();
     notifyChange();
 }
@@ -134,7 +131,7 @@ void WebGraphicsLayer::addChild(GraphicsLayer* layer)
 void WebGraphicsLayer::addChildAtIndex(GraphicsLayer* layer, int index)
 {
     GraphicsLayer::addChildAtIndex(layer, index);
-    toWebGraphicsLayer(layer)->setVisibleContentRectAndScale(m_pageVisibleRect, m_contentsScale);
+    toWebGraphicsLayer(layer)->setWebGraphicsLayerClient(m_webGraphicsLayerClient);
     toWebGraphicsLayer(layer)->notifyChange();
     notifyChange();
 }
@@ -142,7 +139,7 @@ void WebGraphicsLayer::addChildAtIndex(GraphicsLayer* layer, int index)
 void WebGraphicsLayer::addChildAbove(GraphicsLayer* layer, GraphicsLayer* sibling)
 {
     GraphicsLayer::addChildAbove(layer, sibling);
-    toWebGraphicsLayer(layer)->setVisibleContentRectAndScale(m_pageVisibleRect, m_contentsScale);
+    toWebGraphicsLayer(layer)->setWebGraphicsLayerClient(m_webGraphicsLayerClient);
     toWebGraphicsLayer(layer)->notifyChange();
     notifyChange();
 }
@@ -150,7 +147,7 @@ void WebGraphicsLayer::addChildAbove(GraphicsLayer* layer, GraphicsLayer* siblin
 void WebGraphicsLayer::addChildBelow(GraphicsLayer* layer, GraphicsLayer* sibling)
 {
     GraphicsLayer::addChildBelow(layer, sibling);
-    toWebGraphicsLayer(layer)->setVisibleContentRectAndScale(m_pageVisibleRect, m_contentsScale);
+    toWebGraphicsLayer(layer)->setWebGraphicsLayerClient(m_webGraphicsLayerClient);
     toWebGraphicsLayer(layer)->notifyChange();
     notifyChange();
 }
@@ -162,8 +159,7 @@ bool WebGraphicsLayer::replaceChild(GraphicsLayer* oldChild, GraphicsLayer* newC
         return false;
     notifyChange();
     toWebGraphicsLayer(oldChild)->notifyChange();
-    toWebGraphicsLayer(oldChild)->setLayerTreeTileClient(0);
-    toWebGraphicsLayer(newChild)->setVisibleContentRectAndScale(m_pageVisibleRect, m_contentsScale);
+    toWebGraphicsLayer(newChild)->setWebGraphicsLayerClient(m_webGraphicsLayerClient);
     toWebGraphicsLayer(newChild)->notifyChange();
     return true;
 }
@@ -175,7 +171,6 @@ void WebGraphicsLayer::removeFromParent()
     GraphicsLayer::removeFromParent();
 
     notifyChange();
-    setLayerTreeTileClient(0);
 }
 
 void WebGraphicsLayer::setPosition(const FloatPoint& p)
@@ -249,8 +244,6 @@ void WebGraphicsLayer::setDrawsContent(bool b)
         return;
     GraphicsLayer::setDrawsContent(b);
 
-    if (b)
-        setNeedsDisplay();
     notifyChange();
 }
 
@@ -258,6 +251,8 @@ void WebGraphicsLayer::setContentsOpaque(bool b)
 {
     if (contentsOpaque() == b)
         return;
+    if (m_mainBackingStore)
+        m_mainBackingStore->setSupportsAlpha(!b);
     GraphicsLayer::setContentsOpaque(b);
     notifyChange();
 }
@@ -347,17 +342,16 @@ void WebGraphicsLayer::setContentsToImage(Image* image)
 {
     if (image == m_image)
         return;
-    WebLayerTreeTileClient* client = layerTreeTileClient();
     int64_t newID = 0;
-    if (client) {
+    if (m_webGraphicsLayerClient) {
         // We adopt first, in case this is the same frame - that way we avoid destroying and recreating the image.
-        newID = client->adoptImageBackingStore(image);
-        client->releaseImageBackingStore(m_layerInfo.imageBackingStoreID);
+        newID = m_webGraphicsLayerClient->adoptImageBackingStore(image);
+        m_webGraphicsLayerClient->releaseImageBackingStore(m_layerInfo.imageBackingStoreID);
         notifyChange();
         if (m_layerInfo.imageBackingStoreID && newID == m_layerInfo.imageBackingStoreID)
             return;
     } else {
-        // If client not set yet there should be no backing store ID.
+        // If m_webGraphicsLayerClient is not set yet there should be no backing store ID.
         ASSERT(!m_layerInfo.imageBackingStoreID);
         notifyChange();
     }
@@ -380,9 +374,8 @@ void WebGraphicsLayer::setMaskLayer(GraphicsLayer* layer)
 
     layer->setSize(size());
     WebGraphicsLayer* webGraphicsLayer = toWebGraphicsLayer(layer);
-    webGraphicsLayer->setLayerTreeTileClient(layerTreeTileClient());
+    webGraphicsLayer->setWebGraphicsLayerClient(m_webGraphicsLayerClient);
     webGraphicsLayer->setMaskTarget(this);
-    webGraphicsLayer->setVisibleContentRectAndScale(m_pageVisibleRect, m_contentsScale);
     webGraphicsLayer->notifyChange();
     notifyChange();
 
@@ -394,7 +387,7 @@ void WebGraphicsLayer::setReplicatedByLayer(GraphicsLayer* layer)
         return;
 
     if (layer)
-        toWebGraphicsLayer(layer)->setLayerTreeTileClient(layerTreeTileClient());
+        toWebGraphicsLayer(layer)->setWebGraphicsLayerClient(m_webGraphicsLayerClient);
 
     GraphicsLayer::setReplicatedByLayer(layer);
     notifyChange();
@@ -407,8 +400,8 @@ void WebGraphicsLayer::setNeedsDisplay()
 
 void WebGraphicsLayer::setNeedsDisplayInRect(const FloatRect& rect)
 {
-    recreateBackingStoreIfNeeded();
-    m_mainBackingStore->invalidate(IntRect(rect));
+    if (m_mainBackingStore)
+        m_mainBackingStore->invalidate(IntRect(rect));
     notifyChange();
 }
 
@@ -438,9 +431,6 @@ WebGraphicsLayer* toWebGraphicsLayer(GraphicsLayer* layer)
 
 void WebGraphicsLayer::syncCompositingStateForThisLayerOnly()
 {
-    if (!m_layerTreeTileClient)
-        m_layerTreeTileClient = layerTreeTileClient();
-
     updateContentBuffers();
 
     if (!m_modified)
@@ -469,11 +459,7 @@ void WebGraphicsLayer::syncCompositingStateForThisLayerOnly()
     for (size_t i = 0; i < children().size(); ++i)
         m_layerInfo.children.append(toWebLayerID(children()[i]));
 
-    ASSERT(m_layerTreeTileClient);
-    if (m_layerInfo.imageIsUpdated && m_image && !m_layerInfo.imageBackingStoreID)
-        m_layerInfo.imageBackingStoreID = m_layerTreeTileClient->adoptImageBackingStore(m_image.get());
-
-    m_layerTreeTileClient->didSyncCompositingStateForLayer(m_layerInfo);
+    m_webGraphicsLayerClient->didSyncCompositingStateForLayer(m_layerInfo);
     m_modified = false;
     m_layerInfo.imageIsUpdated = false;
     if (m_hasPendingAnimations)
@@ -495,28 +481,34 @@ void WebGraphicsLayer::setRootLayer(bool isRoot)
 
 void WebGraphicsLayer::setVisibleContentRectTrajectoryVector(const FloatPoint& trajectoryVector)
 {
-    m_mainBackingStore->setVisibleRectTrajectoryVector(trajectoryVector);
+    if (m_mainBackingStore)
+        m_mainBackingStore->coverWithTilesIfNeeded(trajectoryVector);
 }
 
-void WebGraphicsLayer::setVisibleContentRectAndScale(const IntRect& pageVisibleRect, float scale)
+void WebGraphicsLayer::setContentsScale(float scale)
 {
-    if (m_pageVisibleRect == pageVisibleRect && m_contentsScale == scale)
+    m_contentsScale = scale;
+
+    if (!m_mainBackingStore || m_mainBackingStore->contentsScale() == scale)
         return;
 
-    m_pageVisibleRect = pageVisibleRect;
-    m_contentsScale = scale;
+    // Between creating the new backing store and painting the content,
+    // we do not want to drop the previous one as that might result in
+    // briefly seeing flickering as the old tiles may be dropped before
+    // something replaces them.
+    m_previousBackingStore = m_mainBackingStore.release();
 
-    if (!m_mainBackingStore || m_mainBackingStore->contentsScale() != scale) {
-        m_previousBackingStore = m_mainBackingStore.release();
-        m_mainBackingStore = adoptPtr(new TiledBackingStore(this, TiledBackingStoreRemoteTileBackend::create(this)));
-        m_mainBackingStore->setContentsScale(scale);
-    } else
-        m_mainBackingStore->adjustVisibleRect();
+    // No reason to save the previous backing store for non-visible areas.
+    m_previousBackingStore->removeAllNonVisibleTiles();
 
-    if (maskLayer())
-        toWebGraphicsLayer(maskLayer())->setVisibleContentRectAndScale(pageVisibleRect, scale);
-    for (size_t i = 0; i < children().size(); ++i)
-        toWebGraphicsLayer(children()[i])->setVisibleContentRectAndScale(pageVisibleRect, scale);
+    createBackingStore();
+}
+
+void WebGraphicsLayer::createBackingStore()
+{
+    m_mainBackingStore = adoptPtr(new TiledBackingStore(this, TiledBackingStoreRemoteTileBackend::create(this)));
+    m_mainBackingStore->setSupportsAlpha(!contentsOpaque());
+    m_mainBackingStore->setContentsScale(m_contentsScale);
 }
 
 void WebGraphicsLayer::tiledBackingStorePaint(GraphicsContext* context, const IntRect& rect)
@@ -535,15 +527,11 @@ bool WebGraphicsLayer::tiledBackingStoreUpdatesAllowed() const
 {
     if (!m_inUpdateMode)
         return false;
-    if (WebLayerTreeTileClient* client = layerTreeTileClient())
-        return client->layerTreeTileUpdatesAllowed();
-    return false;
+    return m_webGraphicsLayerClient->layerTreeTileUpdatesAllowed();
 }
 
 IntRect WebGraphicsLayer::tiledBackingStoreContentsRect()
 {
-    if (!drawsContent())
-        return IntRect();
     return IntRect(0, 0, size().width(), size().height());
 }
 
@@ -561,7 +549,7 @@ IntRect WebGraphicsLayer::tiledBackingStoreVisibleRect()
     // Return a projection of the visible rect (surface coordinates) onto the layer's plane (layer coordinates).
     // The resulting quad might be squewed and the visible rect is the bounding box of this quad,
     // so it might spread further than the real visible area (and then even more amplified by the cover rect multiplier).
-    return m_layerTransform.combined().inverse().clampedBoundsOfProjectedQuad(FloatQuad(FloatRect(m_pageVisibleRect)));
+    return m_layerTransform.combined().inverse().clampedBoundsOfProjectedQuad(FloatQuad(FloatRect(m_webGraphicsLayerClient->visibleContentsRect())));
 }
 
 Color WebGraphicsLayer::tiledBackingStoreBackgroundColor() const
@@ -572,125 +560,91 @@ Color WebGraphicsLayer::tiledBackingStoreBackgroundColor() const
 void WebGraphicsLayer::createTile(int tileID, const UpdateInfo& updateInfo)
 {
     m_modified = true;
-    if (WebLayerTreeTileClient* client = layerTreeTileClient())
-        client->createTile(id(), tileID, updateInfo);
+    m_webGraphicsLayerClient->createTile(id(), tileID, updateInfo);
 }
 
 void WebGraphicsLayer::updateTile(int tileID, const UpdateInfo& updateInfo)
 {
     m_modified = true;
-    if (WebLayerTreeTileClient* client = layerTreeTileClient())
-        client->updateTile(id(), tileID, updateInfo);
+    m_webGraphicsLayerClient->updateTile(id(), tileID, updateInfo);
 }
 
 void WebGraphicsLayer::removeTile(int tileID)
 {
     m_modified = true;
-    if (WebLayerTreeTileClient* client = layerTreeTileClient())
-        client->removeTile(id(), tileID);
+    m_webGraphicsLayerClient->removeTile(id(), tileID);
 }
 
-void WebGraphicsLayer::updateTileBuffersRecursively()
+void WebGraphicsLayer::updateContentBuffers()
 {
-    m_mainBackingStore->updateTileBuffers();
-    for (size_t i = 0; i < children().size(); ++i) {
-        WebGraphicsLayer* layer = toWebGraphicsLayer(this->children()[i]);
-        layer->updateTileBuffersRecursively();
+    // The remote image might have been released by purgeBackingStores.
+    if (m_image) {
+        if (!m_layerInfo.imageBackingStoreID) {
+            m_layerInfo.imageBackingStoreID = m_webGraphicsLayerClient->adoptImageBackingStore(m_image.get());
+            m_layerInfo.imageIsUpdated = true;
+        }
     }
 
-    if (WebGraphicsLayer* mask = toWebGraphicsLayer(maskLayer()))
-        mask->updateTileBuffersRecursively();
-}
-
-WebLayerTreeTileClient* WebGraphicsLayer::layerTreeTileClient() const
-{
-    if (m_layerTreeTileClient)
-        return m_layerTreeTileClient;
-    WebGraphicsLayer* parent;
-    if (this->replicatedLayer())
-        parent = toWebGraphicsLayer(this->replicatedLayer());
-    else if (this->maskTarget())
-        parent = toWebGraphicsLayer(this->maskTarget());
-    else
-        parent = toWebGraphicsLayer(this->parent());
-
-    if (!parent)
-        return 0;
-    return parent->layerTreeTileClient();
-}
-
-void WebGraphicsLayer::updateContentBuffers()
-{
-    // Backing-stores for directly composited images is handled in LayerTreeHost.
-    if (m_image)
+    if (!drawsContent()) {
+        m_mainBackingStore.clear();
+        m_previousBackingStore.clear();
         return;
+    }
 
-    if (!drawsContent())
-        return;
-    WebLayerTreeTileClient* client = layerTreeTileClient();
-    if (!client)
-        return;
     m_inUpdateMode = true;
+    // This is the only place we (re)create the main tiled backing store, once we
+    // have a remote client and we are ready to send our data to the UI process.
+    if (!m_mainBackingStore)
+        createBackingStore();
     m_mainBackingStore->updateTileBuffers();
     m_inUpdateMode = false;
-}
-
-void WebGraphicsLayer::purgeBackingStores()
-{
-    for (size_t i = 0; i < children().size(); ++i) {
-        WebGraphicsLayer* layer = toWebGraphicsLayer(this->children()[i]);
-        layer->purgeBackingStores();
-    }
 
-    if (WebGraphicsLayer* mask = toWebGraphicsLayer(maskLayer()))
-        mask->purgeBackingStores();
-
-    if (m_mainBackingStore)
-        m_mainBackingStore.clear();
-
-    if (!m_layerInfo.imageBackingStoreID)
-        return;
-
-    layerTreeTileClient()->releaseImageBackingStore(m_layerInfo.imageBackingStoreID);
-    m_layerInfo.imageBackingStoreID = 0;
+    // The previous backing store is kept around to avoid flickering between
+    // removing the existing tiles and painting the new ones. The first time
+    // the visibleRect is full painted we remove the previous backing store.
+    if (m_mainBackingStore->visibleAreaIsCovered())
+        m_previousBackingStore.clear();
 }
 
-void WebGraphicsLayer::recreateBackingStoreIfNeeded()
+void WebGraphicsLayer::purgeBackingStores()
 {
-    for (size_t i = 0; i < children().size(); ++i) {
-        WebGraphicsLayer* layer = toWebGraphicsLayer(this->children()[i]);
-        layer->recreateBackingStoreIfNeeded();
-    }
-    if (WebGraphicsLayer* mask = toWebGraphicsLayer(maskLayer()))
-        mask->recreateBackingStoreIfNeeded();
+    m_mainBackingStore.clear();
+    m_previousBackingStore.clear();
 
-    if (!m_mainBackingStore) {
-        m_mainBackingStore = adoptPtr(new TiledBackingStore(this, TiledBackingStoreRemoteTileBackend::create(this)));
-        m_mainBackingStore->setContentsScale(m_contentsScale);
+    if (m_layerInfo.imageBackingStoreID) {
+        m_webGraphicsLayerClient->releaseImageBackingStore(m_layerInfo.imageBackingStoreID);
+        m_layerInfo.imageBackingStoreID = 0;
     }
-
-    if (m_image)
-        setContentsNeedsDisplay();
 }
 
-void WebGraphicsLayer::setLayerTreeTileClient(WebKit::WebLayerTreeTileClient* client)
+void WebGraphicsLayer::setWebGraphicsLayerClient(WebKit::WebGraphicsLayerClient* client)
 {
-    if (m_layerTreeTileClient == client)
+    if (m_webGraphicsLayerClient == client)
         return;
 
     if (WebGraphicsLayer* replica = toWebGraphicsLayer(replicaLayer()))
-        replica->setLayerTreeTileClient(client);
+        replica->setWebGraphicsLayerClient(client);
     if (WebGraphicsLayer* mask = toWebGraphicsLayer(maskLayer()))
-        mask->setLayerTreeTileClient(client);
+        mask->setWebGraphicsLayerClient(client);
     for (size_t i = 0; i < children().size(); ++i) {
         WebGraphicsLayer* layer = toWebGraphicsLayer(this->children()[i]);
-        layer->setLayerTreeTileClient(client);
+        layer->setWebGraphicsLayerClient(client);
     }
 
-    // Have to force detach from remote layer here if layer tile client changes.
-    if (m_layerTreeTileClient)
-        m_layerTreeTileClient->didDeleteLayer(id());
-    m_layerTreeTileClient = client;
+    // We have to release resources on the UI process here if the remote client has changed or is removed.
+    if (m_webGraphicsLayerClient) {
+        purgeBackingStores();
+        m_webGraphicsLayerClient->detachLayer(this);
+    }
+    m_webGraphicsLayerClient = client;
+    if (client)
+        client->attachLayer(this);
+}
+
+void WebGraphicsLayer::adjustVisibleRect()
+{
+    if (m_mainBackingStore)
+        m_mainBackingStore->coverWithTilesIfNeeded();
 }
 
 void WebGraphicsLayer::computeTransformedVisibleRect()
@@ -703,8 +657,9 @@ void WebGraphicsLayer::computeTransformedVisibleRect()
     m_layerTransform.setFlattening(!preserves3D());
     m_layerTransform.setChildrenTransform(childrenTransform());
     m_layerTransform.combineTransforms(parent() ? toWebGraphicsLayer(parent())->m_layerTransform.combinedForChildren() : TransformationMatrix());
+
     // The combined transform will be used in tiledBackingStoreVisibleRect.
-    m_mainBackingStore->adjustVisibleRect();
+    adjustVisibleRect();
 }
 #endif
 
diff --git a/Source/WebKit2/WebProcess/WebCoreSupport/WebGraphicsLayer.h b/Source/WebKit2/WebProcess/WebCoreSupport/WebGraphicsLayer.h
index 0b50763b7..4096d3764 100644
--- a/Source/WebKit2/WebProcess/WebCoreSupport/WebGraphicsLayer.h
+++ b/Source/WebKit2/WebProcess/WebCoreSupport/WebGraphicsLayer.h
@@ -39,19 +39,26 @@
 
 #if USE(ACCELERATED_COMPOSITING)
 
+namespace WebCore {
+class WebGraphicsLayer;
+}
+
 namespace WebKit {
 
-class WebLayerTreeTileClient {
+class WebGraphicsLayerClient {
 public:
     // TiledBackingStoreRemoteTileClient
     virtual void createTile(WebLayerID, int tileID, const UpdateInfo&) = 0;
     virtual void updateTile(WebLayerID, int tileID, const UpdateInfo&) = 0;
     virtual void removeTile(WebLayerID, int tileID) = 0;
+
+    virtual WebCore::IntRect visibleContentsRect() const = 0;
     virtual bool layerTreeTileUpdatesAllowed() const = 0;
     virtual int64_t adoptImageBackingStore(WebCore::Image*) = 0;
     virtual void releaseImageBackingStore(int64_t) = 0;
     virtual void didSyncCompositingStateForLayer(const WebLayerInfo&) = 0;
-    virtual void didDeleteLayer(WebLayerID) = 0;
+    virtual void attachLayer(WebCore::WebGraphicsLayer*) = 0;
+    virtual void detachLayer(WebCore::WebGraphicsLayer*) = 0;
 };
 }
 
@@ -96,7 +103,7 @@ public:
     void setNeedsDisplay();
     void setNeedsDisplayInRect(const FloatRect&);
     void setContentsNeedsDisplay();
-    void setVisibleContentRectAndScale(const IntRect&, float scale);
+    void setContentsScale(float);
     void setVisibleContentRectTrajectoryVector(const FloatPoint&);
     virtual void syncCompositingState(const FloatRect&);
     virtual void syncCompositingStateForThisLayerOnly();
@@ -129,14 +136,12 @@ public:
     virtual void updateTile(int tileID, const WebKit::UpdateInfo&);
     virtual void removeTile(int tileID);
 
-    void setLayerTreeTileClient(WebKit::WebLayerTreeTileClient*);
-    WebKit::WebLayerTreeTileClient* layerTreeTileClient() const;
+    void setWebGraphicsLayerClient(WebKit::WebGraphicsLayerClient*);
 
+    void adjustVisibleRect();
     bool isReadyForTileBufferSwap() const;
-    void updateTileBuffersRecursively();
     void updateContentBuffers();
     void purgeBackingStores();
-    void recreateBackingStoreIfNeeded();
 #endif
 
 private:
@@ -144,7 +149,6 @@ private:
     RefPtr<Image> m_image;
     GraphicsLayer* m_maskTarget;
     FloatRect m_needsDisplayRect;
-    IntRect m_pageVisibleRect;
     LayerTransform m_layerTransform;
     bool m_needsDisplay : 1;
     bool m_modified : 1;
@@ -154,6 +158,7 @@ private:
 
     void notifyChange();
     void notifyChangeRecursively();
+    void createBackingStore();
     HashSet<String> m_transformAnimations;
 
     bool selfOrAncestorHasActiveTransformAnimations() const;
@@ -161,7 +166,7 @@ private:
 #if USE(TILED_BACKING_STORE)
     void computeTransformedVisibleRect();
 
-    WebKit::WebLayerTreeTileClient* m_layerTreeTileClient;
+    WebKit::WebGraphicsLayerClient* m_webGraphicsLayerClient;
     OwnPtr<WebCore::TiledBackingStore> m_mainBackingStore;
     OwnPtr<WebCore::TiledBackingStore> m_previousBackingStore;
     float m_contentsScale;
diff --git a/Source/WebKit2/WebProcess/WebCoreSupport/WebPlatformStrategies.cpp b/Source/WebKit2/WebProcess/WebCoreSupport/WebPlatformStrategies.cpp
index 65240ee84..138b3eb63 100644
--- a/Source/WebKit2/WebProcess/WebCoreSupport/WebPlatformStrategies.cpp
+++ b/Source/WebKit2/WebProcess/WebCoreSupport/WebPlatformStrategies.cpp
@@ -33,7 +33,9 @@
 #include "WebCookieManager.h"
 #include "WebCoreArgumentCoders.h"
 #include "WebProcess.h"
+#include <WebCore/Color.h>
 #include <WebCore/Page.h>
+#include <WebCore/PlatformPasteboard.h>
 
 #if USE(CF)
 #include <wtf/RetainPtr.h>
@@ -70,6 +72,11 @@ VisitedLinkStrategy* WebPlatformStrategies::createVisitedLinkStrategy()
     return this;
 }
 
+PasteboardStrategy* WebPlatformStrategies::createPasteboardStrategy()
+{
+    return this;
+}
+
 // CookiesStrategy
 
 void WebPlatformStrategies::notifyCookiesChanged()
@@ -125,6 +132,70 @@ void WebPlatformStrategies::addVisitedLink(Page*, LinkHash linkHash)
     WebProcess::shared().addVisitedLink(linkHash);
 }
 
+#if PLATFORM(MAC)
+// PasteboardStrategy
+
+void WebPlatformStrategies::getTypes(Vector<String>& types, const String& pasteboardName)
+{
+    PlatformPasteboard(pasteboardName).getTypes(types);
+}
+
+PassRefPtr<WebCore::SharedBuffer> WebPlatformStrategies::bufferForType(const String& pasteboardType, const String& pasteboardName)
+{
+    return PlatformPasteboard(pasteboardName).bufferForType(pasteboardType);
+}
+
+void WebPlatformStrategies::getPathnamesForType(Vector<String>& pathnames, const String& pasteboardType, const String& pasteboardName)
+{
+    PlatformPasteboard(pasteboardName).getPathnamesForType(pathnames, pasteboardType);
+}
+
+String WebPlatformStrategies::stringForType(const String& pasteboardType, const String& pasteboardName)
+{
+    return PlatformPasteboard(pasteboardName).stringForType(pasteboardType);
+}
+
+void WebPlatformStrategies::copy(const String& fromPasteboard, const String& toPasteboard)
+{
+    PlatformPasteboard(toPasteboard).copy(fromPasteboard);
+}
+
+int WebPlatformStrategies::changeCount(const WTF::String &pasteboardName)
+{
+    return PlatformPasteboard(pasteboardName).changeCount();
+}
+
+String WebPlatformStrategies::uniqueName()
+{
+    return PlatformPasteboard::uniqueName();
+}
+
+Color WebPlatformStrategies::color(const String& pasteboardName)
+{
+    return PlatformPasteboard(pasteboardName).color();    
+}
+
+void WebPlatformStrategies::setTypes(const Vector<String>& pasteboardTypes, const String& pasteboardName)
+{
+    PlatformPasteboard(pasteboardName).setTypes(pasteboardTypes);
+}
+
+void WebPlatformStrategies::setBufferForType(PassRefPtr<SharedBuffer> buffer, const String& pasteboardType, const String& pasteboardName)
+{
+    PlatformPasteboard(pasteboardName).setBufferForType(buffer, pasteboardType);
+}
+
+void WebPlatformStrategies::setPathnamesForType(const Vector<String>& pathnames, const String& pasteboardType, const String& pasteboardName)
+{
+    PlatformPasteboard(pasteboardName).setPathnamesForType(pathnames, pasteboardType);
+}
+
+void WebPlatformStrategies::setStringForType(const String& string, const String& pasteboardType, const String& pasteboardName)
+{
+    PlatformPasteboard(pasteboardName).setStringForType(string, pasteboardType);    
+}
+#endif
+
 } // namespace WebKit
 
 #endif // USE(PLATFORM_STRATEGIES)
diff --git a/Source/WebKit2/WebProcess/WebCoreSupport/WebPlatformStrategies.h b/Source/WebKit2/WebProcess/WebCoreSupport/WebPlatformStrategies.h
index 970f7ce6d..e8e9bf790 100644
--- a/Source/WebKit2/WebProcess/WebCoreSupport/WebPlatformStrategies.h
+++ b/Source/WebKit2/WebProcess/WebCoreSupport/WebPlatformStrategies.h
@@ -29,13 +29,14 @@
 #if USE(PLATFORM_STRATEGIES)
 
 #include <WebCore/CookiesStrategy.h>
+#include <WebCore/PasteboardStrategy.h>
 #include <WebCore/PlatformStrategies.h>
 #include <WebCore/PluginStrategy.h>
 #include <WebCore/VisitedLinkStrategy.h>
 
 namespace WebKit {
 
-class WebPlatformStrategies : public WebCore::PlatformStrategies, private WebCore::CookiesStrategy, private WebCore::PluginStrategy, private WebCore::VisitedLinkStrategy {
+class WebPlatformStrategies : public WebCore::PlatformStrategies, private WebCore::CookiesStrategy, private WebCore::PluginStrategy, private WebCore::VisitedLinkStrategy, private WebCore::PasteboardStrategy {
 public:
     static void initialize();
     
@@ -46,6 +47,7 @@ private:
     virtual WebCore::CookiesStrategy* createCookiesStrategy() OVERRIDE;
     virtual WebCore::PluginStrategy* createPluginStrategy() OVERRIDE;
     virtual WebCore::VisitedLinkStrategy* createVisitedLinkStrategy() OVERRIDE;
+    virtual WebCore::PasteboardStrategy* createPasteboardStrategy() OVERRIDE;
 
     // WebCore::CookiesStrategy
     virtual void notifyCookiesChanged() OVERRIDE;
@@ -59,6 +61,23 @@ private:
     virtual bool isLinkVisited(WebCore::Page*, WebCore::LinkHash, const WebCore::KURL& baseURL, const WTF::AtomicString& attributeURL) OVERRIDE;
     virtual void addVisitedLink(WebCore::Page*, WebCore::LinkHash) OVERRIDE;
 
+#if PLATFORM(MAC)
+    // WebCore::PasteboardStrategy
+    virtual void getTypes(Vector<String>& types, const String& pasteboardName) OVERRIDE;
+    virtual PassRefPtr<WebCore::SharedBuffer> bufferForType(const String& pasteboardType, const String& pasteboardName) OVERRIDE;
+    virtual void getPathnamesForType(Vector<String>& pathnames, const String& pasteboardType, const String& pasteboardName) OVERRIDE;
+    virtual String stringForType(const String& pasteboardType, const String& pasteboardName) OVERRIDE;
+    virtual int changeCount(const String& pasteboardName) OVERRIDE;
+    virtual String uniqueName() OVERRIDE;
+    virtual WebCore::Color color(const String& pasteboardName) OVERRIDE;
+    
+    virtual void copy(const String& fromPasteboard, const String& toPasteboard) OVERRIDE;
+    virtual void setTypes(const Vector<String>& pasteboardTypes, const String& pasteboardName) OVERRIDE;
+    virtual void setBufferForType(PassRefPtr<WebCore::SharedBuffer>, const String& pasteboardType, const String& pasteboardName) OVERRIDE;
+    virtual void setPathnamesForType(const Vector<String>&, const String& pasteboardType, const String& pasteboardName) OVERRIDE;
+    virtual void setStringForType(const String&, const String& pasteboardType, const String& pasteboardName) OVERRIDE;
+#endif
+
     bool m_pluginCacheIsPopulated;
     bool m_shouldRefreshPlugins;
     Vector<WebCore::PluginInfo> m_cachedPlugins;
diff --git a/Source/WebKit2/WebProcess/WebCoreSupport/gtk/WebEditorClientGtk.cpp b/Source/WebKit2/WebProcess/WebCoreSupport/gtk/WebEditorClientGtk.cpp
index f59e69700..9f3453067 100644
--- a/Source/WebKit2/WebProcess/WebCoreSupport/gtk/WebEditorClientGtk.cpp
+++ b/Source/WebKit2/WebProcess/WebCoreSupport/gtk/WebEditorClientGtk.cpp
@@ -21,6 +21,7 @@
 #include "WebEditorClient.h"
 
 #include "Frame.h"
+#include "FrameDestructionObserver.h"
 #include "PlatformKeyboardEvent.h"
 #include "WebPage.h"
 #include "WebPageProxyMessages.h"
@@ -130,7 +131,34 @@ void WebEditorClient::handleInputMethodKeydown(KeyboardEvent*)
 }
 
 #if PLATFORM(X11)
+class EditorClientFrameDestructionObserver : FrameDestructionObserver {
+public:
+    EditorClientFrameDestructionObserver(Frame* frame, GClosure* closure)
+        : FrameDestructionObserver(frame)
+        , m_closure(closure)
+    {
+        g_closure_add_finalize_notifier(m_closure, this, destroyOnClosureFinalization);
+    }
+
+    void frameDestroyed()
+    {
+        g_closure_invalidate(m_closure);
+        FrameDestructionObserver::frameDestroyed();
+    }
+private:
+    GClosure* m_closure;
+
+    static void destroyOnClosureFinalization(gpointer data, GClosure* closure)
+    {
+        // Calling delete void* will free the memory but won't invoke
+        // the destructor, something that is a must for us.
+        EditorClientFrameDestructionObserver* observer = static_cast<EditorClientFrameDestructionObserver*>(data);
+        delete observer;
+    }
+};
+
 static Frame* frameSettingClipboard;
+
 static void collapseSelection(GtkClipboard* clipboard, Frame* frame)
 {
     if (frameSettingClipboard && frameSettingClipboard == frame)
@@ -156,6 +184,10 @@ void WebEditorClient::setSelectionPrimaryClipboardIfNeeded(Frame* frame)
 
     frameSettingClipboard = frame;
     GClosure* callback = g_cclosure_new(G_CALLBACK(collapseSelection), frame, 0);
+    // This observer will be self-destroyed on closure finalization,
+    // that will happen either after closure execution or after
+    // closure invalidation.
+    new EditorClientFrameDestructionObserver(frame, callback);
     g_closure_set_marshal(callback, g_cclosure_marshal_VOID__VOID);
     PasteboardHelper::defaultPasteboardHelper()->writeClipboardContents(clipboard, PasteboardHelper::DoNotIncludeSmartPaste, callback);
     frameSettingClipboard = 0;
diff --git a/Source/WebKit2/WebProcess/WebCoreSupport/mac/WebDragClientMac.mm b/Source/WebKit2/WebProcess/WebCoreSupport/mac/WebDragClientMac.mm
index 1cfa3c000..da608ddfb 100644
--- a/Source/WebKit2/WebProcess/WebCoreSupport/mac/WebDragClientMac.mm
+++ b/Source/WebKit2/WebProcess/WebCoreSupport/mac/WebDragClientMac.mm
@@ -39,6 +39,7 @@
 #import <WebCore/FrameView.h>
 #import <WebCore/GraphicsContext.h>
 #import <WebCore/LegacyWebArchive.h>
+#import <WebCore/Page.h>
 #import <WebCore/RenderImage.h>
 #import <WebCore/ResourceHandle.h>
 #import <WebCore/StringTruncator.h>
@@ -77,9 +78,9 @@ using namespace WebKit;
 
 namespace WebKit {
 
-static PassRefPtr<ShareableBitmap> convertImageToBitmap(NSImage *image)
+static PassRefPtr<ShareableBitmap> convertImageToBitmap(NSImage *image, const IntSize& size)
 {
-    RefPtr<ShareableBitmap> bitmap = ShareableBitmap::createShareable(IntSize([image size]), ShareableBitmap::SupportsAlpha);
+    RefPtr<ShareableBitmap> bitmap = ShareableBitmap::createShareable(size, ShareableBitmap::SupportsAlpha);
     OwnPtr<GraphicsContext> graphicsContext = bitmap->createGraphicsContext();
 
     RetainPtr<NSGraphicsContext> savedContext = [NSGraphicsContext currentContext];
@@ -94,7 +95,9 @@ static PassRefPtr<ShareableBitmap> convertImageToBitmap(NSImage *image)
 
 void WebDragClient::startDrag(RetainPtr<NSImage> image, const IntPoint& point, const IntPoint&, Clipboard*, Frame* frame, bool linkDrag)
 {
-    RefPtr<ShareableBitmap> bitmap = convertImageToBitmap(image.get());
+    IntSize bitmapSize([image.get() size]);
+    bitmapSize.scale(frame->page()->deviceScaleFactor());
+    RefPtr<ShareableBitmap> bitmap = convertImageToBitmap(image.get(), bitmapSize);
     ShareableBitmap::Handle handle;
     if (!bitmap->createHandle(handle))
         return;
@@ -122,10 +125,10 @@ static NSArray *arrayForURLsWithTitles(NSURL *URL, NSString *title)
         [NSArray arrayWithObject:[title _webkit_stringByTrimmingWhitespace]], nil];
 }
 
-void WebDragClient::declareAndWriteDragImage(NSPasteboard *pasteboard, DOMElement *element, NSURL *URL, NSString *title, WebCore::Frame*)
+void WebDragClient::declareAndWriteDragImage(const String& pasteboardName, DOMElement *element, NSURL *URL, NSString *title, WebCore::Frame*)
 {
     ASSERT(element);
-    ASSERT(pasteboard && pasteboard == [NSPasteboard pasteboardWithName:NSDragPboard]);
+    ASSERT(pasteboardName == String(NSDragPboard));
 
     Element* coreElement = core(element);
 
@@ -152,6 +155,7 @@ void WebDragClient::declareAndWriteDragImage(NSPasteboard *pasteboard, DOMElemen
     m_pasteboardOwner.adoptNS([[WKPasteboardOwner alloc] initWithImage:image]);
     m_filePromiseOwner.adoptNS([(WKPasteboardFilePromiseOwner *)[WKPasteboardFilePromiseOwner alloc] initWithSource:m_pasteboardOwner.get()]);
 
+    NSPasteboard* pasteboard = [NSPasteboard pasteboardWithName:pasteboardName];
     [pasteboard declareTypes:types.get() owner:m_pasteboardOwner.leakRef()];    
 
     [pasteboard setPropertyList:[NSArray arrayWithObject:extension] forType:NSFilesPromisePboardType];
diff --git a/Source/WebKit2/WebProcess/WebPage/DecoderAdapter.cpp b/Source/WebKit2/WebProcess/WebPage/DecoderAdapter.cpp
index 19083d6ad..763305cbe 100644
--- a/Source/WebKit2/WebProcess/WebPage/DecoderAdapter.cpp
+++ b/Source/WebKit2/WebProcess/WebPage/DecoderAdapter.cpp
@@ -52,6 +52,11 @@ bool DecoderAdapter::decodeBool(bool& value)
     return m_decoder.decodeBool(value);
 }
 
+bool DecoderAdapter::decodeUInt16(uint16_t& value)
+{
+    return m_decoder.decodeUInt16(value);
+}
+
 bool DecoderAdapter::decodeUInt32(uint32_t& value)
 {
     return m_decoder.decodeUInt32(value);
diff --git a/Source/WebKit2/WebProcess/WebPage/DecoderAdapter.h b/Source/WebKit2/WebProcess/WebPage/DecoderAdapter.h
index bd34ea8d3..d6b4eb766 100644
--- a/Source/WebKit2/WebProcess/WebPage/DecoderAdapter.h
+++ b/Source/WebKit2/WebProcess/WebPage/DecoderAdapter.h
@@ -39,6 +39,7 @@ public:
 private:
     virtual bool decodeBytes(Vector<uint8_t>&);
     virtual bool decodeBool(bool&);
+    virtual bool decodeUInt16(uint16_t&);
     virtual bool decodeUInt32(uint32_t&);
     virtual bool decodeUInt64(uint64_t&);
     virtual bool decodeInt32(int32_t&);
diff --git a/Source/WebKit2/WebProcess/WebPage/DrawingArea.h b/Source/WebKit2/WebProcess/WebPage/DrawingArea.h
index 377c9001a..e9fa49c5d 100644
--- a/Source/WebKit2/WebProcess/WebPage/DrawingArea.h
+++ b/Source/WebKit2/WebProcess/WebPage/DrawingArea.h
@@ -105,6 +105,7 @@ private:
 #if PLATFORM(MAC)
     // Used by TiledCoreAnimationDrawingArea.
     virtual void updateGeometry(const WebCore::IntSize& viewSize) { }
+    virtual void setDeviceScaleFactor(float deviceScaleFactor) { }
 #endif
 };
 
diff --git a/Source/WebKit2/WebProcess/WebPage/DrawingArea.messages.in b/Source/WebKit2/WebProcess/WebPage/DrawingArea.messages.in
index 41a1aa362..857f87293 100644
--- a/Source/WebKit2/WebProcess/WebPage/DrawingArea.messages.in
+++ b/Source/WebKit2/WebProcess/WebPage/DrawingArea.messages.in
@@ -30,5 +30,6 @@ messages -> DrawingArea {
 #if PLATFORM(MAC)
     // Used by TiledCoreAnimationDrawingArea.
     UpdateGeometry(WebCore::IntSize viewSize)
+    SetDeviceScaleFactor(float deviceScaleFactor)
 #endif
 }
diff --git a/Source/WebKit2/WebProcess/WebPage/EncoderAdapter.cpp b/Source/WebKit2/WebProcess/WebPage/EncoderAdapter.cpp
index 1f0e13c71..bda7d9b72 100644
--- a/Source/WebKit2/WebProcess/WebPage/EncoderAdapter.cpp
+++ b/Source/WebKit2/WebProcess/WebPage/EncoderAdapter.cpp
@@ -52,6 +52,11 @@ void EncoderAdapter::encodeBool(bool value)
     m_encoder->encodeBool(value);
 }
 
+void EncoderAdapter::encodeUInt16(uint16_t value)
+{
+    m_encoder->encodeUInt16(value);
+}
+
 void EncoderAdapter::encodeUInt32(uint32_t value)
 {
     m_encoder->encodeUInt32(value);
diff --git a/Source/WebKit2/WebProcess/WebPage/EncoderAdapter.h b/Source/WebKit2/WebProcess/WebPage/EncoderAdapter.h
index 47de7afd5..6321cf513 100644
--- a/Source/WebKit2/WebProcess/WebPage/EncoderAdapter.h
+++ b/Source/WebKit2/WebProcess/WebPage/EncoderAdapter.h
@@ -46,6 +46,7 @@ public:
 private:
     virtual void encodeBytes(const uint8_t*, size_t);
     virtual void encodeBool(bool);
+    virtual void encodeUInt16(uint16_t value);
     virtual void encodeUInt32(uint32_t);
     virtual void encodeUInt64(uint64_t);
     virtual void encodeInt32(int32_t);
diff --git a/Source/WebKit2/WebProcess/WebPage/EventDispatcher.cpp b/Source/WebKit2/WebProcess/WebPage/EventDispatcher.cpp
index 7f3c08198..a53220610 100644
--- a/Source/WebKit2/WebProcess/WebPage/EventDispatcher.cpp
+++ b/Source/WebKit2/WebProcess/WebPage/EventDispatcher.cpp
@@ -37,6 +37,7 @@
 
 #if ENABLE(THREADED_SCROLLING)
 #include <WebCore/ScrollingCoordinator.h>
+#include <WebCore/ScrollingThread.h>
 #include <WebCore/ScrollingTree.h>
 #endif
 
@@ -79,18 +80,29 @@ void EventDispatcher::didReceiveMessageOnConnectionWorkQueue(CoreIPC::Connection
     }
 }
 
-void EventDispatcher::wheelEvent(CoreIPC::Connection*, uint64_t pageID, const WebWheelEvent& wheelEvent)
+void EventDispatcher::wheelEvent(CoreIPC::Connection*, uint64_t pageID, const WebWheelEvent& wheelEvent, bool canGoBack, bool canGoForward)
 {
 #if ENABLE(THREADED_SCROLLING)
     MutexLocker locker(m_scrollingTreesMutex);
     if (ScrollingTree* scrollingTree = m_scrollingTrees.get(pageID).get()) {
         PlatformWheelEvent platformWheelEvent = platform(wheelEvent);
 
-        if (scrollingTree->tryToHandleWheelEvent(platformWheelEvent)) {
-            sendDidHandleEvent(pageID, wheelEvent);
+        // FIXME: It's pretty horrible that we're updating the back/forward state here.
+        // WebCore should always know the current state and know when it changes so the
+        // scrolling tree can be notified.
+        // We only need to do this at the beginning of the gesture.
+        if (platformWheelEvent.phase() == PlatformWheelEventPhaseBegan)
+            ScrollingThread::dispatch(bind(&ScrollingTree::updateBackForwardState, scrollingTree, canGoBack, canGoForward));
+
+        ScrollingTree::EventResult result = scrollingTree->tryToHandleWheelEvent(platformWheelEvent);
+        if (result == ScrollingTree::DidHandleEvent || result == ScrollingTree::DidNotHandleEvent) {
+            sendDidReceiveEvent(pageID, wheelEvent, result == ScrollingTree::DidHandleEvent);
             return;
         }
     }
+#else
+    UNUSED_PARAM(canGoBack);
+    UNUSED_PARAM(canGoForward);
 #endif
 
     RunLoop::main()->dispatch(bind(&EventDispatcher::dispatchWheelEvent, this, pageID, wheelEvent));
@@ -128,9 +140,9 @@ void EventDispatcher::dispatchGestureEvent(uint64_t pageID, const WebGestureEven
 #endif
 
 #if ENABLE(THREADED_SCROLLING)
-void EventDispatcher::sendDidHandleEvent(uint64_t pageID, const WebEvent& event)
+void EventDispatcher::sendDidReceiveEvent(uint64_t pageID, const WebEvent& event, bool didHandleEvent)
 {
-    WebProcess::shared().connection()->send(Messages::WebPageProxy::DidReceiveEvent(static_cast<uint32_t>(event.type()), true), pageID);
+    WebProcess::shared().connection()->send(Messages::WebPageProxy::DidReceiveEvent(static_cast<uint32_t>(event.type()), didHandleEvent), pageID);
 }
 #endif
 
diff --git a/Source/WebKit2/WebProcess/WebPage/EventDispatcher.h b/Source/WebKit2/WebProcess/WebPage/EventDispatcher.h
index 15b25380d..aa70a93e5 100644
--- a/Source/WebKit2/WebProcess/WebPage/EventDispatcher.h
+++ b/Source/WebKit2/WebProcess/WebPage/EventDispatcher.h
@@ -66,7 +66,7 @@ private:
     void didReceiveEventDispatcherMessageOnConnectionWorkQueue(CoreIPC::Connection*, CoreIPC::MessageID, CoreIPC::ArgumentDecoder* arguments, bool& didHandleMessage);
 
     // Message handlers
-    void wheelEvent(CoreIPC::Connection*, uint64_t pageID, const WebWheelEvent&);
+    void wheelEvent(CoreIPC::Connection*, uint64_t pageID, const WebWheelEvent&, bool canGoBack, bool canGoForward);
 #if ENABLE(GESTURE_EVENTS)
     void gestureEvent(CoreIPC::Connection*, uint64_t pageID, const WebGestureEvent&);
 #endif
@@ -78,7 +78,7 @@ private:
 #endif
 
 #if ENABLE(THREADED_SCROLLING)
-    void sendDidHandleEvent(uint64_t pageID, const WebEvent&);
+    void sendDidReceiveEvent(uint64_t pageID, const WebEvent&, bool didHandleEvent);
 
     Mutex m_scrollingTreesMutex;
     HashMap<uint64_t, RefPtr<WebCore::ScrollingTree> > m_scrollingTrees;
diff --git a/Source/WebKit2/WebProcess/WebPage/EventDispatcher.messages.in b/Source/WebKit2/WebProcess/WebPage/EventDispatcher.messages.in
index a15571be5..94cd5e501 100644
--- a/Source/WebKit2/WebProcess/WebPage/EventDispatcher.messages.in
+++ b/Source/WebKit2/WebProcess/WebPage/EventDispatcher.messages.in
@@ -21,7 +21,7 @@
 # OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
 messages -> EventDispatcher {
-    WheelEvent(uint64_t pageID, WebKit::WebWheelEvent event) DispatchOnConnectionQueue
+    WheelEvent(uint64_t pageID, WebKit::WebWheelEvent event, bool canGoBack, bool canGoForward) DispatchOnConnectionQueue
 
 #if ENABLE(GESTURE_EVENTS)
     GestureEvent(uint64_t pageID, WebKit::WebGestureEvent event) DispatchOnConnectionQueue
diff --git a/Source/WebKit2/WebProcess/WebPage/LayerTreeHost.h b/Source/WebKit2/WebProcess/WebPage/LayerTreeHost.h
index 61fbe2fc3..6f336a5cd 100644
--- a/Source/WebKit2/WebProcess/WebPage/LayerTreeHost.h
+++ b/Source/WebKit2/WebProcess/WebPage/LayerTreeHost.h
@@ -80,9 +80,9 @@ public:
     virtual void resumeRendering() { }
 
 #if USE(TILED_BACKING_STORE)
-    virtual void setVisibleContentRectAndScale(const WebCore::IntRect&, float scale) { }
-    virtual void setVisibleContentRectTrajectoryVector(const WebCore::FloatPoint&) { }
-    virtual void setVisibleContentRectForLayer(int layerID, const WebCore::IntRect&) { }
+    virtual void setVisibleContentsRectForScaling(const WebCore::IntRect&, float scale) { }
+    virtual void setVisibleContentsRectForPanning(const WebCore::IntRect&, const WebCore::FloatPoint&) { }
+    virtual void setVisibleContentsRectForLayer(int layerID, const WebCore::IntRect&) { }
     virtual void renderNextFrame() { }
     virtual void purgeBackingStores() { }
     virtual void didReceiveLayerTreeHostMessage(CoreIPC::Connection*, CoreIPC::MessageID, CoreIPC::ArgumentDecoder*);
diff --git a/Source/WebKit2/WebProcess/WebPage/LayerTreeHost.messages.in b/Source/WebKit2/WebProcess/WebPage/LayerTreeHost.messages.in
index 4ee1cc3b4..70fa85841 100644
--- a/Source/WebKit2/WebProcess/WebPage/LayerTreeHost.messages.in
+++ b/Source/WebKit2/WebProcess/WebPage/LayerTreeHost.messages.in
@@ -20,8 +20,8 @@
 
 #if USE(TILED_BACKING_STORE)
 messages -> LayerTreeHost {
-    SetVisibleContentRectTrajectoryVector(WebCore::FloatPoint trajectoryVectory)
-    SetVisibleContentRectAndScale(WebCore::IntRect contentRect, float scale)
+    SetVisibleContentsRectForPanning(WebCore::IntRect visibleContentsRect, WebCore::FloatPoint trajectoryVectory)
+    SetVisibleContentsRectForScaling(WebCore::IntRect visibleContentsRect, float scale)
     RenderNextFrame()
     PurgeBackingStores()
 }
diff --git a/Source/WebKit2/WebProcess/WebPage/TiledBackingStoreRemoteTile.cpp b/Source/WebKit2/WebProcess/WebPage/TiledBackingStoreRemoteTile.cpp
index 7cea0b426..ee116c2e9 100644
--- a/Source/WebKit2/WebProcess/WebPage/TiledBackingStoreRemoteTile.cpp
+++ b/Source/WebKit2/WebProcess/WebPage/TiledBackingStoreRemoteTile.cpp
@@ -72,29 +72,17 @@ Vector<IntRect> TiledBackingStoreRemoteTile::updateBackBuffer()
     if (!isDirty())
         return Vector<IntRect>();
 
-    // FIXME: Only use a local buffer when we know the tile is animated (after the first invalidate)
-    // and destroy it after a few seconds of inactivity. We can render directly to shared
-    // memory in other cases.
-    if (!m_localBuffer || m_localBuffer->size() != m_rect.size()) {
-        m_localBuffer = ImageBuffer::create(m_rect.size());
-        m_localBuffer->context()->translate(-m_rect.x(), -m_rect.y());
-        m_localBuffer->context()->scale(FloatSize(m_tiledBackingStore->contentsScale(), m_tiledBackingStore->contentsScale()));
-    }
-    // This assumes that the GraphicsContext on the ImageBuffer acts synchronously
-    // for us to be able to draw this buffer on the ShareableBitmap right after.
-    m_tiledBackingStore->client()->tiledBackingStorePaint(m_localBuffer->context(), m_tiledBackingStore->mapToContents(m_dirtyRect));
-
-    RefPtr<ShareableBitmap> bitmap = ShareableBitmap::createShareable(m_rect.size(), ShareableBitmap::SupportsAlpha);
+    RefPtr<ShareableBitmap> bitmap = ShareableBitmap::createShareable(m_dirtyRect.size(), m_tiledBackingStore->supportsAlpha() ? ShareableBitmap::SupportsAlpha : 0);
     OwnPtr<GraphicsContext> graphicsContext(bitmap->createGraphicsContext());
-    graphicsContext->drawImageBuffer(m_localBuffer.get(), ColorSpaceDeviceRGB, IntPoint(0, 0));
-
-#if PLATFORM(QT)
-    // Qt uses BGRA interally, we swizzle to RGBA for OpenGL.
-    bitmap->swizzleRGB();
-#endif
+    graphicsContext->translate(-m_dirtyRect.x(), -m_dirtyRect.y());
+    graphicsContext->scale(FloatSize(m_tiledBackingStore->contentsScale(), m_tiledBackingStore->contentsScale()));
+    m_tiledBackingStore->client()->tiledBackingStorePaint(graphicsContext.get(), m_tiledBackingStore->mapToContents(m_dirtyRect));
 
     UpdateInfo updateInfo;
     updateInfo.updateRectBounds = m_rect;
+    IntRect updateRect = m_dirtyRect;
+    updateRect.move(-m_rect.x(), -m_rect.y());
+    updateInfo.updateRects.append(updateRect);
     updateInfo.updateScaleFactor = m_tiledBackingStore->contentsScale();
     bitmap->createHandle(updateInfo.bitmapHandle);
 
diff --git a/Source/WebKit2/WebProcess/WebPage/WebBackForwardListProxy.cpp b/Source/WebKit2/WebProcess/WebPage/WebBackForwardListProxy.cpp
index 7a6045eb6..cbdc066da 100644
--- a/Source/WebKit2/WebProcess/WebPage/WebBackForwardListProxy.cpp
+++ b/Source/WebKit2/WebProcess/WebPage/WebBackForwardListProxy.cpp
@@ -163,7 +163,9 @@ void WebBackForwardListProxy::goToItem(HistoryItem* item)
     if (!m_page)
         return;
 
-    m_page->send(Messages::WebPageProxy::BackForwardGoToItem(historyItemToIDMap().get(item)));
+    SandboxExtension::Handle sandboxExtensionHandle;
+    m_page->sendSync(Messages::WebPageProxy::BackForwardGoToItem(historyItemToIDMap().get(item)), Messages::WebPageProxy::BackForwardGoToItem::Reply(sandboxExtensionHandle));
+    m_page->sandboxExtensionTracker().beginLoad(m_page->mainWebFrame(), sandboxExtensionHandle);
 }
 
 HistoryItem* WebBackForwardListProxy::itemAtIndex(int itemIndex)
diff --git a/Source/WebKit2/WebProcess/WebPage/WebFrame.cpp b/Source/WebKit2/WebProcess/WebPage/WebFrame.cpp
index a829fe45b..ac869fbea 100644
--- a/Source/WebKit2/WebProcess/WebPage/WebFrame.cpp
+++ b/Source/WebKit2/WebProcess/WebPage/WebFrame.cpp
@@ -650,7 +650,7 @@ JSValueRef WebFrame::computedStyleIncludingVisitedInfo(JSObjectRef element)
     if (!toJS(element)->inherits(&JSElement::s_info))
         return JSValueMakeUndefined(toRef(exec));
 
-    RefPtr<CSSComputedStyleDeclaration> style = computedStyle(static_cast<JSElement*>(toJS(element))->impl(), true);
+    RefPtr<CSSComputedStyleDeclaration> style = CSSComputedStyleDeclaration::create(static_cast<JSElement*>(toJS(element))->impl(), true);
 
     JSLock lock(SilenceAssertionsOnly);
     return toRef(exec, toJS(exec, globalObject, style.get()));
diff --git a/Source/WebKit2/WebProcess/WebPage/WebInspector.cpp b/Source/WebKit2/WebProcess/WebPage/WebInspector.cpp
index e1383c832..5a42d116e 100644
--- a/Source/WebKit2/WebProcess/WebPage/WebInspector.cpp
+++ b/Source/WebKit2/WebProcess/WebPage/WebInspector.cpp
@@ -28,6 +28,7 @@
 
 #if ENABLE(INSPECTOR)
 
+#include "WebFrame.h"
 #include "WebInspectorFrontendClient.h"
 #include "WebInspectorProxyMessages.h"
 #include "WebPage.h"
@@ -139,6 +140,24 @@ void WebInspector::showConsole()
         m_frontendClient->showConsole();
 }
 
+void WebInspector::showResources()
+{
+    m_page->corePage()->inspectorController()->show();
+    if (m_frontendClient)
+        m_frontendClient->showResources();
+}
+
+void WebInspector::showMainResourceForFrame(uint64_t frameID)
+{
+    WebFrame* frame = WebProcess::shared().webFrame(frameID);
+    if (!frame)
+        return;
+
+    m_page->corePage()->inspectorController()->show();
+    if (m_frontendClient)
+        m_frontendClient->showMainResourceForFrame(frame->coreFrame());
+}
+
 void WebInspector::startJavaScriptDebugging()
 {
 #if ENABLE(JAVASCRIPT_DEBUGGER)
diff --git a/Source/WebKit2/WebProcess/WebPage/WebInspector.h b/Source/WebKit2/WebProcess/WebPage/WebInspector.h
index 79ff8074a..221b97671 100644
--- a/Source/WebKit2/WebProcess/WebPage/WebInspector.h
+++ b/Source/WebKit2/WebProcess/WebPage/WebInspector.h
@@ -92,6 +92,10 @@ private:
 
     void showConsole();
 
+    void showResources();
+
+    void showMainResourceForFrame(uint64_t frameID);
+
     void startJavaScriptDebugging();
     void stopJavaScriptDebugging();
 
diff --git a/Source/WebKit2/WebProcess/WebPage/WebInspector.messages.in b/Source/WebKit2/WebProcess/WebPage/WebInspector.messages.in
index dc184b68a..a1a80f07f 100644
--- a/Source/WebKit2/WebProcess/WebPage/WebInspector.messages.in
+++ b/Source/WebKit2/WebProcess/WebPage/WebInspector.messages.in
@@ -26,6 +26,8 @@ messages -> WebInspector {
     Show()
     Close()
     ShowConsole()
+    ShowResources()
+    ShowMainResourceForFrame(uint64_t frameID)
     StartJavaScriptDebugging()
     StopJavaScriptDebugging()
     StartJavaScriptProfiling()
diff --git a/Source/WebKit2/WebProcess/WebPage/WebPage.cpp b/Source/WebKit2/WebProcess/WebPage/WebPage.cpp
index 4aa1e45e8..dad810491 100644
--- a/Source/WebKit2/WebProcess/WebPage/WebPage.cpp
+++ b/Source/WebKit2/WebProcess/WebPage/WebPage.cpp
@@ -210,6 +210,7 @@ WebPage::WebPage(uint64_t pageID, const WebPageCreationParameters& parameters)
     , m_numWheelEventHandlers(0)
     , m_cachedPageCount(0)
     , m_isShowingContextMenu(false)
+    , m_willGoToBackForwardItemCallbackEnabled(true)
 #if PLATFORM(WIN)
     , m_gestureReachedScrollingLimit(false)
 #endif
@@ -231,12 +232,13 @@ WebPage::WebPage(uint64_t pageID, const WebPageCreationParameters& parameters)
 #if ENABLE(INSPECTOR)
     pageClients.inspectorClient = new WebInspectorClient(this);
 #endif
-#if ENABLE(NOTIFICATIONS)
-    pageClients.notificationClient = new WebNotificationClient(this);
-#endif
     
     m_page = adoptPtr(new Page(pageClients));
 
+#if ENABLE(NOTIFICATIONS)
+    WebCore::provideNotification(m_page.get(), new WebNotificationClient(this));
+#endif
+
     // Qt does not yet call setIsInWindow. Until it does, just leave
     // this line out so plug-ins and video will work. Eventually all platforms
     // should call setIsInWindow and this comment and #if should be removed,
@@ -713,14 +715,15 @@ void WebPage::setDefersLoading(bool defersLoading)
     m_page->setDefersLoading(defersLoading);
 }
 
-void WebPage::reload(bool reloadFromOrigin)
+void WebPage::reload(bool reloadFromOrigin, const SandboxExtension::Handle& sandboxExtensionHandle)
 {
     SendStopResponsivenessTimer stopper(this);
 
+    m_sandboxExtensionTracker.beginLoad(m_mainFrame.get(), sandboxExtensionHandle);
     m_mainFrame->coreFrame()->loader()->reload(reloadFromOrigin);
 }
 
-void WebPage::goForward(uint64_t backForwardItemID, const SandboxExtension::Handle& sandboxExtensionHandle)
+void WebPage::goForward(uint64_t backForwardItemID)
 {
     SendStopResponsivenessTimer stopper(this);
 
@@ -729,11 +732,10 @@ void WebPage::goForward(uint64_t backForwardItemID, const SandboxExtension::Hand
     if (!item)
         return;
 
-    m_sandboxExtensionTracker.beginLoad(m_mainFrame.get(), sandboxExtensionHandle);
     m_page->goToItem(item, FrameLoadTypeForward);
 }
 
-void WebPage::goBack(uint64_t backForwardItemID, const SandboxExtension::Handle& sandboxExtensionHandle)
+void WebPage::goBack(uint64_t backForwardItemID)
 {
     SendStopResponsivenessTimer stopper(this);
 
@@ -742,11 +744,10 @@ void WebPage::goBack(uint64_t backForwardItemID, const SandboxExtension::Handle&
     if (!item)
         return;
 
-    m_sandboxExtensionTracker.beginLoad(m_mainFrame.get(), sandboxExtensionHandle);
     m_page->goToItem(item, FrameLoadTypeBack);
 }
 
-void WebPage::goToBackForwardItem(uint64_t backForwardItemID, const SandboxExtension::Handle& sandboxExtensionHandle)
+void WebPage::goToBackForwardItem(uint64_t backForwardItemID)
 {
     SendStopResponsivenessTimer stopper(this);
 
@@ -755,7 +756,6 @@ void WebPage::goToBackForwardItem(uint64_t backForwardItemID, const SandboxExten
     if (!item)
         return;
 
-    m_sandboxExtensionTracker.beginLoad(m_mainFrame.get(), sandboxExtensionHandle);
     m_page->goToItem(item, FrameLoadTypeIndexedBackForward);
 }
 
@@ -1439,10 +1439,10 @@ uint64_t WebPage::restoreSession(const SessionState& sessionState)
     return currentItemID;
 }
 
-void WebPage::restoreSessionAndNavigateToCurrentItem(const SessionState& sessionState, const SandboxExtension::Handle& sandboxExtensionHandle)
+void WebPage::restoreSessionAndNavigateToCurrentItem(const SessionState& sessionState)
 {
     if (uint64_t currentItemID = restoreSession(sessionState))
-        goToBackForwardItem(currentItemID, sandboxExtensionHandle);
+        goToBackForwardItem(currentItemID);
 }
 
 #if ENABLE(TOUCH_EVENTS)
@@ -1888,6 +1888,7 @@ void WebPage::updatePreferences(const WebPreferencesStore& store)
     settings->setShowDebugBorders(store.getBoolValueForKey(WebPreferencesKey::compositingBordersVisibleKey()));
     settings->setShowRepaintCounter(store.getBoolValueForKey(WebPreferencesKey::compositingRepaintCountersVisibleKey()));
     settings->setCSSCustomFilterEnabled(store.getBoolValueForKey(WebPreferencesKey::cssCustomFilterEnabledKey()));
+    settings->setCSSRegionsEnabled(store.getBoolValueForKey(WebPreferencesKey::cssRegionsEnabledKey()));
     settings->setWebGLEnabled(store.getBoolValueForKey(WebPreferencesKey::webGLEnabledKey()));
     settings->setMediaPlaybackRequiresUserGesture(store.getBoolValueForKey(WebPreferencesKey::mediaPlaybackRequiresUserGestureKey()));
     settings->setMediaPlaybackAllowsInline(store.getBoolValueForKey(WebPreferencesKey::mediaPlaybackAllowsInlineKey()));
@@ -1925,7 +1926,7 @@ void WebPage::updatePreferences(const WebPreferencesStore& store)
 #endif
 
     settings->setApplicationChromeMode(store.getBoolValueForKey(WebPreferencesKey::applicationChromeModeKey()));    
-    settings->setSuppressIncrementalRendering(store.getBoolValueForKey(WebPreferencesKey::suppressIncrementalRenderingKey()));
+    settings->setSuppressesIncrementalRendering(store.getBoolValueForKey(WebPreferencesKey::suppressesIncrementalRenderingKey()));
     settings->setBackspaceKeyNavigationEnabled(store.getBoolValueForKey(WebPreferencesKey::backspaceKeyNavigationEnabledKey()));
     settings->setCaretBrowsingEnabled(store.getBoolValueForKey(WebPreferencesKey::caretBrowsingEnabledKey()));
 
diff --git a/Source/WebKit2/WebProcess/WebPage/WebPage.h b/Source/WebKit2/WebProcess/WebPage/WebPage.h
index aa1e57f08..745bf4d4a 100644
--- a/Source/WebKit2/WebProcess/WebPage/WebPage.h
+++ b/Source/WebKit2/WebProcess/WebPage/WebPage.h
@@ -503,6 +503,8 @@ public:
     void numWheelEventHandlersChanged(unsigned);
     void recomputeShortCircuitHorizontalWheelEventsState();
 
+    bool willGoToBackForwardItemCallbackEnabled() const { return m_willGoToBackForwardItemCallbackEnabled; }
+    
 private:
     WebPage(uint64_t pageID, const WebPageCreationParameters&);
 
@@ -536,10 +538,10 @@ private:
     void loadAlternateHTMLString(const String& htmlString, const String& baseURL, const String& unreachableURL);
     void loadPlainTextString(const String&);
     void linkClicked(const String& url, const WebMouseEvent&);
-    void reload(bool reloadFromOrigin);
-    void goForward(uint64_t, const SandboxExtension::Handle&);
-    void goBack(uint64_t, const SandboxExtension::Handle&);
-    void goToBackForwardItem(uint64_t, const SandboxExtension::Handle&);
+    void reload(bool reloadFromOrigin, const SandboxExtension::Handle&);
+    void goForward(uint64_t);
+    void goBack(uint64_t);
+    void goToBackForwardItem(uint64_t);
     void tryRestoreScrollPosition();
     void setActive(bool);
     void setFocused(bool);
@@ -567,10 +569,12 @@ private:
     static void logicalScroll(WebCore::Page*, WebCore::ScrollLogicalDirection, WebCore::ScrollGranularity);
 
     uint64_t restoreSession(const SessionState&);
-    void restoreSessionAndNavigateToCurrentItem(const SessionState&, const SandboxExtension::Handle&);
+    void restoreSessionAndNavigateToCurrentItem(const SessionState&);
 
     void didRemoveBackForwardItem(uint64_t);
 
+    void setWillGoToBackForwardItemCallbackEnabled(bool enabled) { m_willGoToBackForwardItemCallbackEnabled = enabled; }
+    
     void setDrawsBackground(bool);
     void setDrawsTransparentBackground(bool);
 
@@ -765,6 +769,8 @@ private:
     unsigned m_cachedPageCount;
 
     bool m_isShowingContextMenu;
+    
+    bool m_willGoToBackForwardItemCallbackEnabled;
 
 #if PLATFORM(WIN)
     bool m_gestureReachedScrollingLimit;
diff --git a/Source/WebKit2/WebProcess/WebPage/WebPage.messages.in b/Source/WebKit2/WebProcess/WebPage/WebPage.messages.in
index 415460137..7813adf3c 100644
--- a/Source/WebKit2/WebProcess/WebPage/WebPage.messages.in
+++ b/Source/WebKit2/WebProcess/WebPage/WebPage.messages.in
@@ -50,9 +50,9 @@ messages -> WebPage {
     ScrollBy(uint32_t scrollDirection, uint32_t scrollGranularity)
     CenterSelectionInVisibleArea()
 
-    GoBack(uint64_t backForwardItemID, WebKit::SandboxExtension::Handle sandboxExtensionHandle)
-    GoForward(uint64_t backForwardItemID, WebKit::SandboxExtension::Handle sandboxExtensionHandle)
-    GoToBackForwardItem(uint64_t backForwardItemID, WebKit::SandboxExtension::Handle sandboxExtensionHandle)
+    GoBack(uint64_t backForwardItemID)
+    GoForward(uint64_t backForwardItemID)
+    GoToBackForwardItem(uint64_t backForwardItemID)
     TryRestoreScrollPosition()
     LoadHTMLString(WTF::String htmlString, WTF::String baseURL)
     LoadAlternateHTMLString(WTF::String htmlString, WTF::String baseURL, WTF::String unreachableURL); 
@@ -60,7 +60,7 @@ messages -> WebPage {
     LoadURL(WTF::String url, WebKit::SandboxExtension::Handle sandboxExtensionHandle)
     LoadURLRequest(WebCore::ResourceRequest request, WebKit::SandboxExtension::Handle sandboxExtensionHandle)
     LinkClicked(WTF::String url, WebKit::WebMouseEvent event)
-    Reload(bool reloadFromOrigin)
+    Reload(bool reloadFromOrigin, WebKit::SandboxExtension::Handle sandboxExtensionHandle)
     StopLoading()
 
 #if PLATFORM(QT)
@@ -71,9 +71,10 @@ messages -> WebPage {
     StopLoadingFrame(uint64_t frameID)
     
     RestoreSession(WebKit::SessionState state)
-    RestoreSessionAndNavigateToCurrentItem(WebKit::SessionState state, WebKit::SandboxExtension::Handle sandboxExtensionHandle)
+    RestoreSessionAndNavigateToCurrentItem(WebKit::SessionState state)
 
     DidRemoveBackForwardItem(uint64_t backForwardItemID)
+    SetWillGoToBackForwardItemCallbackEnabled(bool willGoToBackForwardItemEnabled)
 
     DidReceivePolicyDecision(uint64_t frameID, uint64_t listenerID, uint32_t policyAction, uint64_t downloadID)
 
diff --git a/Source/WebKit2/WebProcess/WebPage/gtk/WebPrintOperationGtk.cpp b/Source/WebKit2/WebProcess/WebPage/gtk/WebPrintOperationGtk.cpp
index 704adf3ea..b0440cf33 100644
--- a/Source/WebKit2/WebProcess/WebPage/gtk/WebPrintOperationGtk.cpp
+++ b/Source/WebKit2/WebProcess/WebPage/gtk/WebPrintOperationGtk.cpp
@@ -55,21 +55,15 @@ public:
 
     static gboolean enumeratePrintersFunction(GtkPrinter* printer, WebPrintOperationGtkUnix* printOperation)
     {
-        GtkPrinter* selectedPrinter = 0;
         const char* printerName = gtk_print_settings_get_printer(printOperation->printSettings());
-        if (printerName) {
-            if (!strcmp(printerName, gtk_printer_get_name(printer)))
-                selectedPrinter = printer;
-        } else if (gtk_printer_is_default(printer))
-            selectedPrinter = printer;
-
-        if (!selectedPrinter)
+        if ((printerName && strcmp(printerName, gtk_printer_get_name(printer)))
+            || (!printerName && !gtk_printer_is_default(printer)))
             return FALSE;
 
         static int jobNumber = 0;
         const char* applicationName = g_get_application_name();
         GOwnPtr<char>jobName(g_strdup_printf("%s job #%d", applicationName ? applicationName : "WebKit", ++jobNumber));
-        printOperation->m_printJob = adoptGRef(gtk_print_job_new(jobName.get(), selectedPrinter,
+        printOperation->m_printJob = adoptGRef(gtk_print_job_new(jobName.get(), printer,
                                                                  printOperation->printSettings(),
                                                                  printOperation->pageSetup()));
         return TRUE;
@@ -94,6 +88,15 @@ public:
         printOperation->m_pagesToPrint = gtk_print_job_get_pages(printOperation->m_printJob.get());
         printOperation->m_needsRotation = gtk_print_job_get_rotate(printOperation->m_printJob.get());
 
+        // Manual capabilities.
+        printOperation->m_numberUp = gtk_print_job_get_n_up(printOperation->m_printJob.get());
+        printOperation->m_numberUpLayout = gtk_print_job_get_n_up_layout(printOperation->m_printJob.get());
+        printOperation->m_pageSet = gtk_print_job_get_page_set(printOperation->m_printJob.get());
+        printOperation->m_reverse = gtk_print_job_get_reverse(printOperation->m_printJob.get());
+        printOperation->m_copies = gtk_print_job_get_num_copies(printOperation->m_printJob.get());
+        printOperation->m_collateCopies = gtk_print_job_get_collate(printOperation->m_printJob.get());
+        printOperation->m_scale = gtk_print_job_get_scale(printOperation->m_printJob.get());
+
         printOperation->print(surface, 72, 72);
     }
 
@@ -107,6 +110,9 @@ public:
 
     void startPage(cairo_t* cr)
     {
+        if (!currentPageIsFirstPageOfSheet())
+          return;
+
         GtkPaperSize* paperSize = gtk_page_setup_get_paper_size(m_pageSetup.get());
         double width = gtk_paper_size_get_width(paperSize, GTK_UNIT_POINTS);
         double height = gtk_paper_size_get_height(paperSize, GTK_UNIT_POINTS);
@@ -133,7 +139,8 @@ public:
 
     void endPage(cairo_t* cr)
     {
-        cairo_show_page(cr);
+        if (currentPageIsLastPageOfSheet())
+            cairo_show_page(cr);
     }
 
     static void printJobComplete(GtkPrintJob* printJob, WebPrintOperationGtkUnix* printOperation, const GError*)
@@ -196,9 +203,22 @@ struct PrintPagesData {
         : printOperation(printOperation)
         , totalPrinted(-1)
         , pageNumber(0)
-        , pagePosition(0)
+        , sheetNumber(0)
+        , firstSheetNumber(0)
+        , numberOfSheets(0)
+        , firstPagePosition(0)
+        , collated(0)
+        , uncollated(0)
         , isDone(false)
     {
+        if (printOperation->collateCopies()) {
+            collatedCopies = printOperation->copies();
+            uncollatedCopies = 1;
+        } else {
+            collatedCopies = 1;
+            uncollatedCopies = printOperation->copies();
+        }
+
         if (printOperation->pagesToPrint() == GTK_PRINT_PAGES_RANGES) {
             Vector<GtkPageRange> pageRanges;
             GtkPageRange* ranges = printOperation->pageRanges();
@@ -227,8 +247,63 @@ struct PrintPagesData {
             for (int i = 0; i < printOperation->pageCount(); ++i)
                 pages.append(i);
         }
+        printOperation->setNumberOfPagesToPrint(pages.size());
+
+        size_t numberUp = printOperation->numberUp();
+        if (numberUp > 1)
+            numberOfSheets = (pages.size() % numberUp) ? pages.size() / numberUp + 1 : pages.size() / numberUp;
+        else
+            numberOfSheets = pages.size();
+
+        bool reverse = printOperation->reverse();
+        switch (printOperation->pageSet()) {
+        case GTK_PAGE_SET_ODD:
+            if (reverse) {
+                lastPagePosition = std::min(numberUp - 1, pages.size() - 1);
+                sheetNumber = (numberOfSheets - 1) - (numberOfSheets - 1) % 2;
+            } else
+                lastPagePosition = std::min(((numberOfSheets - 1) - ((numberOfSheets - 1) % 2)) * numberUp - 1, pages.size() - 1);
+            break;
+        case GTK_PAGE_SET_EVEN:
+            if (reverse) {
+                lastPagePosition = std::min(2 * numberUp - 1, pages.size() - 1);
+                sheetNumber = (numberOfSheets - 1) - (1 - (numberOfSheets - 1) % 2);
+            } else {
+                lastPagePosition = std::min(((numberOfSheets - 1) - (1 - (numberOfSheets - 1) % 2)) * numberUp - 1, pages.size() - 1);
+                sheetNumber = numberOfSheets > 1 ? 1 : -1;
+            }
+            break;
+        case GTK_PAGE_SET_ALL:
+            if (reverse) {
+                lastPagePosition = std::min(numberUp - 1, pages.size() - 1);
+                sheetNumber = pages.size() - 1;
+            } else
+                lastPagePosition = pages.size() - 1;
+            break;
+        }
 
-        pageNumber = pages[pagePosition];
+        // FIXME: check pagePostion is between [0..pages.size() - 1]
+        // and cancel the operation otherwise when error reporting
+        // is implemented.
+        printOperation->setPagePosition(sheetNumber * numberUp);
+        pageNumber = pages[printOperation->pagePosition()];
+        firstPagePosition = printOperation->pagePosition();
+        firstSheetNumber = sheetNumber;
+    }
+
+    size_t collatedCopiesLeft()
+    {
+        return collatedCopies > 1 ? collatedCopies - collated - 1 : 0;
+    }
+
+    size_t uncollatedCopiesLeft()
+    {
+        return uncollatedCopies > 1 ? uncollatedCopies - uncollated - 1 : 0;
+    }
+
+    size_t copiesLeft()
+    {
+        return collatedCopiesLeft() + uncollatedCopiesLeft();
     }
 
     void incrementPageSequence()
@@ -238,8 +313,30 @@ struct PrintPagesData {
             return;
         }
 
-        pagePosition++;
-        if (pagePosition >= pages.size()) {
+        size_t pagePosition = printOperation->pagePosition();
+        if (pagePosition == lastPagePosition && !copiesLeft()) {
+            isDone = true;
+            return;
+        }
+
+        if (pagePosition == lastPagePosition && uncollatedCopiesLeft()) {
+            pagePosition = firstPagePosition;
+            sheetNumber = firstSheetNumber;
+            uncollated++;
+        } else if (printOperation->currentPageIsLastPageOfSheet()) {
+            if (!collatedCopiesLeft()) {
+                int step = printOperation->pageSet() == GTK_PAGE_SET_ALL ? 1 : 2;
+                step *= printOperation->reverse() ? -1 : 1;
+                sheetNumber += step;
+                collated = 0;
+            } else
+                collated++;
+            pagePosition = sheetNumber * printOperation->numberUp();
+        } else
+            pagePosition++;
+        printOperation->setPagePosition(pagePosition);
+
+        if (pagePosition >= pages.size() || sheetNumber >= numberOfSheets) {
             isDone = true;
             return;
         }
@@ -252,8 +349,16 @@ struct PrintPagesData {
     int totalPrinted;
     size_t totalToPrint;
     int pageNumber;
-    size_t pagePosition;
     Vector<size_t> pages;
+    size_t sheetNumber;
+    size_t firstSheetNumber;
+    size_t numberOfSheets;
+    size_t firstPagePosition;
+    size_t lastPagePosition;
+    size_t collated;
+    size_t uncollated;
+    size_t collatedCopies;
+    size_t uncollatedCopies;
 
     bool isDone : 1;
 };
@@ -262,9 +367,10 @@ PassRefPtr<WebPrintOperationGtk> WebPrintOperationGtk::create(WebPage* page, con
 {
 #ifdef HAVE_GTK_UNIX_PRINTING
     return adoptRef(new WebPrintOperationGtkUnix(page, printInfo));
-#endif
-#ifdef G_OS_WIN32
+#elif defined(G_OS_WIN32)
     return adoptRef(new WebPrintOperationGtkWin32(page, printInfo));
+#else
+    return 0;
 #endif
 }
 
@@ -277,10 +383,19 @@ WebPrintOperationGtk::WebPrintOperationGtk(WebPage* page, const PrintInfo& print
     , m_xDPI(1)
     , m_yDPI(1)
     , m_printPagesIdleId(0)
+    , m_numberOfPagesToPrint(0)
     , m_pagesToPrint(GTK_PRINT_PAGES_ALL)
+    , m_pagePosition(0)
     , m_pageRanges(0)
     , m_pageRangesCount(0)
     , m_needsRotation(false)
+    , m_numberUp(1)
+    , m_numberUpLayout(0)
+    , m_pageSet(GTK_PAGE_SET_ALL)
+    , m_reverse(false)
+    , m_copies(1)
+    , m_collateCopies(false)
+    , m_scale(1)
 {
 }
 
@@ -295,8 +410,21 @@ int WebPrintOperationGtk::pageCount() const
     return m_printContext ? m_printContext->pageCount() : 0;
 }
 
-void WebPrintOperationGtk::rotatePage()
+bool WebPrintOperationGtk::currentPageIsFirstPageOfSheet() const
+{
+    return (m_numberUp < 2 || !((m_pagePosition) % m_numberUp));
+}
+
+bool WebPrintOperationGtk::currentPageIsLastPageOfSheet() const
 {
+    return (m_numberUp < 2 || !((m_pagePosition + 1) % m_numberUp) || m_pagePosition == m_numberOfPagesToPrint - 1);
+}
+
+void WebPrintOperationGtk::rotatePageIfNeeded()
+{
+    if (!m_needsRotation)
+        return;
+
     GtkPaperSize* paperSize = gtk_page_setup_get_paper_size(m_pageSetup.get());
     double width = gtk_paper_size_get_width(paperSize, GTK_UNIT_INCH) * m_xDPI;
     double height = gtk_paper_size_get_height(paperSize, GTK_UNIT_INCH) * m_yDPI;
@@ -324,22 +452,191 @@ void WebPrintOperationGtk::rotatePage()
     }
 }
 
+void WebPrintOperationGtk::getRowsAndColumnsOfPagesPerSheet(size_t& rows, size_t& columns)
+{
+    switch (m_numberUp) {
+    default:
+        columns = 1;
+        rows = 1;
+        break;
+    case 2:
+        columns = 2;
+        rows = 1;
+        break;
+    case 4:
+        columns = 2;
+        rows = 2;
+        break;
+    case 6:
+        columns = 3;
+        rows = 2;
+        break;
+    case 9:
+        columns = 3;
+        rows = 3;
+        break;
+    case 16:
+        columns = 4;
+        rows = 4;
+        break;
+    }
+}
+
+void WebPrintOperationGtk::getPositionOfPageInSheet(size_t rows, size_t columns, int& x, int&y)
+{
+    switch (m_numberUpLayout) {
+    case GTK_NUMBER_UP_LAYOUT_LEFT_TO_RIGHT_TOP_TO_BOTTOM:
+        x = m_pagePosition % columns;
+        y = (m_pagePosition / columns) % rows;
+        break;
+    case GTK_NUMBER_UP_LAYOUT_LEFT_TO_RIGHT_BOTTOM_TO_TOP:
+        x = m_pagePosition % columns;
+        y = rows - 1 - (m_pagePosition / columns) % rows;
+        break;
+    case GTK_NUMBER_UP_LAYOUT_RIGHT_TO_LEFT_TOP_TO_BOTTOM:
+        x = columns - 1 - m_pagePosition % columns;
+        y = (m_pagePosition / columns) % rows;
+        break;
+    case GTK_NUMBER_UP_LAYOUT_RIGHT_TO_LEFT_BOTTOM_TO_TOP:
+        x = columns - 1 - m_pagePosition % columns;
+        y = rows - 1 - (m_pagePosition / columns) % rows;
+        break;
+    case GTK_NUMBER_UP_LAYOUT_TOP_TO_BOTTOM_LEFT_TO_RIGHT:
+        x = (m_pagePosition / rows) % columns;
+        y = m_pagePosition % rows;
+        break;
+    case GTK_NUMBER_UP_LAYOUT_TOP_TO_BOTTOM_RIGHT_TO_LEFT:
+        x = columns - 1 - (m_pagePosition / rows) % columns;
+        y = m_pagePosition % rows;
+        break;
+    case GTK_NUMBER_UP_LAYOUT_BOTTOM_TO_TOP_LEFT_TO_RIGHT:
+        x = (m_pagePosition / rows) % columns;
+        y = rows - 1 - m_pagePosition % rows;
+        break;
+    case GTK_NUMBER_UP_LAYOUT_BOTTOM_TO_TOP_RIGHT_TO_LEFT:
+        x = columns - 1 - (m_pagePosition / rows) % columns;
+        y = rows - 1 - m_pagePosition % rows;
+        break;
+    }
+}
+
+void WebPrintOperationGtk::prepareContextToDraw()
+{
+    if (m_numberUp < 2) {
+        double left = gtk_page_setup_get_left_margin(m_pageSetup.get(), GTK_UNIT_INCH);
+        double top = gtk_page_setup_get_top_margin(m_pageSetup.get(), GTK_UNIT_INCH);
+        if (m_scale != 1.0)
+            cairo_scale(m_cairoContext.get(), m_scale, m_scale);
+        rotatePageIfNeeded();
+        cairo_translate(m_cairoContext.get(), left * m_xDPI, top * m_yDPI);
+
+        return;
+    }
+
+    rotatePageIfNeeded();
+
+    // Multiple pages per sheet.
+    double marginLeft = gtk_page_setup_get_left_margin(m_pageSetup.get(), GTK_UNIT_POINTS);
+    double marginRight = gtk_page_setup_get_right_margin(m_pageSetup.get(), GTK_UNIT_POINTS);
+    double marginTop = gtk_page_setup_get_top_margin(m_pageSetup.get(), GTK_UNIT_POINTS);
+    double marginBottom = gtk_page_setup_get_bottom_margin(m_pageSetup.get(), GTK_UNIT_POINTS);
+
+    double paperWidth = gtk_page_setup_get_paper_width(m_pageSetup.get(), GTK_UNIT_POINTS);
+    double paperHeight = gtk_page_setup_get_paper_height(m_pageSetup.get(), GTK_UNIT_POINTS);
+
+    size_t rows, columns;
+    getRowsAndColumnsOfPagesPerSheet(rows, columns);
+
+    GtkPageOrientation orientation = gtk_page_setup_get_orientation(m_pageSetup.get());
+    double pageWidth = 0, pageHeight = 0;
+    switch (orientation) {
+    case GTK_PAGE_ORIENTATION_PORTRAIT:
+    case GTK_PAGE_ORIENTATION_REVERSE_PORTRAIT:
+        pageWidth = paperWidth - (marginLeft + marginRight);
+        pageHeight = paperHeight - (marginTop + marginBottom);
+        cairo_translate(m_cairoContext.get(), marginLeft, marginTop);
+        break;
+    case GTK_PAGE_ORIENTATION_LANDSCAPE:
+    case GTK_PAGE_ORIENTATION_REVERSE_LANDSCAPE:
+        pageWidth = paperWidth - (marginTop + marginBottom);
+        pageHeight = paperHeight - (marginLeft + marginRight);
+        cairo_translate(m_cairoContext.get(), marginTop, marginLeft);
+
+        size_t tmp = columns;
+        columns = rows;
+        rows = tmp;
+        break;
+    }
+
+    int x, y;
+    getPositionOfPageInSheet(rows, columns, x, y);
+
+    switch (m_numberUp) {
+    case 4:
+    case 9:
+    case 16: {
+        double scaleX = pageWidth / (columns * paperWidth);
+        double scaleY = pageHeight / (rows * paperHeight);
+        double scale = std::min(scaleX, scaleY);
+
+        double stepX = paperWidth * (scaleX / scale);
+        double stepY = paperHeight * (scaleY / scale);
+
+        double width = gtk_page_setup_get_page_width(m_pageSetup.get(), GTK_UNIT_INCH) * m_xDPI;
+        double height = gtk_page_setup_get_page_height(m_pageSetup.get(), GTK_UNIT_INCH) * m_yDPI;
+
+        double offsetX, offsetY;
+        if (marginLeft + marginRight > 0) {
+            offsetX = marginLeft * (stepX - width) / (marginLeft + marginRight);
+            offsetY = marginTop * (stepY - height) / (marginTop + marginBottom);
+        } else {
+            offsetX = (stepX - width) / 2.0;
+            offsetY = (stepY - height) / 2.0;
+        }
+
+        cairo_scale(m_cairoContext.get(), scale, scale);
+        cairo_translate(m_cairoContext.get(), x * stepX + offsetX, y * stepY + offsetY);
+        if (m_scale != 1.0)
+            cairo_scale(m_cairoContext.get(), m_scale, m_scale);
+        break;
+    }
+    case 2:
+    case 6: {
+        double scaleX = pageHeight / (columns * paperWidth);
+        double scaleY = pageWidth / (rows * paperHeight);
+        double scale = std::min(scaleX, scaleY);
+
+        double stepX = paperWidth * (scaleX / scale);
+        double stepY = paperHeight * (scaleY / scale);
+
+        double offsetX = ((stepX - paperWidth) / 2.0 * columns) - marginRight;
+        double offsetY = ((stepY - paperHeight) / 2.0 * rows) + marginTop;
+
+        cairo_scale(m_cairoContext.get(), scale, scale);
+        cairo_translate(m_cairoContext.get(), y * paperHeight + offsetY, (columns - x) * paperWidth + offsetX);
+        if (m_scale != 1.0)
+            cairo_scale(m_cairoContext.get(), m_scale, m_scale);
+        cairo_rotate(m_cairoContext.get(), -G_PI / 2);
+        break;
+    }
+    default:
+        break;
+    }
+}
+
 void WebPrintOperationGtk::renderPage(int pageNumber)
 {
     startPage(m_cairoContext.get());
+    cairo_save(m_cairoContext.get());
 
-    if (m_needsRotation)
-        rotatePage();
-
-    double left = gtk_page_setup_get_left_margin(m_pageSetup.get(), GTK_UNIT_INCH);
-    double top = gtk_page_setup_get_top_margin(m_pageSetup.get(), GTK_UNIT_INCH);
-    cairo_translate(m_cairoContext.get(), left * m_xDPI, top * m_yDPI);
+    prepareContextToDraw();
 
     double pageWidth = gtk_page_setup_get_page_width(m_pageSetup.get(), GTK_UNIT_INCH) * m_xDPI;
     WebCore::PlatformContextCairo platformContext(m_cairoContext.get());
     WebCore::GraphicsContext graphicsContext(&platformContext);
-    m_printContext->spoolPage(graphicsContext, pageNumber, pageWidth);
+    m_printContext->spoolPage(graphicsContext, pageNumber, pageWidth / m_scale);
 
+    cairo_restore(m_cairoContext.get());
     endPage(m_cairoContext.get());
 }
 
diff --git a/Source/WebKit2/WebProcess/WebPage/gtk/WebPrintOperationGtk.h b/Source/WebKit2/WebProcess/WebPage/gtk/WebPrintOperationGtk.h
index b142c4f63..5821a2ed3 100644
--- a/Source/WebKit2/WebProcess/WebPage/gtk/WebPrintOperationGtk.h
+++ b/Source/WebKit2/WebProcess/WebPage/gtk/WebPrintOperationGtk.h
@@ -51,11 +51,24 @@ public:
 
     GtkPrintSettings* printSettings() const { return m_printSettings.get(); }
     GtkPageSetup* pageSetup() const { return m_pageSetup.get(); }
+    void setNumberOfPagesToPrint(size_t numberOfPages) { m_numberOfPagesToPrint = numberOfPages; }
     unsigned int pagesToPrint() const { return m_pagesToPrint; }
     int pageCount() const;
+    bool currentPageIsFirstPageOfSheet() const;
+    bool currentPageIsLastPageOfSheet() const;
+    size_t pagePosition() const { return m_pagePosition; }
+    void setPagePosition(size_t position) { m_pagePosition = position; }
     GtkPageRange* pageRanges() const { return m_pageRanges; }
     size_t pageRangesCount() const { return m_pageRangesCount; }
 
+    unsigned int numberUp() const { return m_numberUp; }
+    unsigned int numberUpLayout() const { return m_numberUpLayout; }
+    unsigned int pageSet() const { return m_pageSet; }
+    bool reverse() const { return m_reverse; }
+    unsigned int copies() const { return m_copies; }
+    bool collateCopies() const { return m_collateCopies; }
+    double scale() const { return m_scale; }
+
     virtual void startPrint(WebCore::PrintContext*, uint64_t callbackID) = 0;
 
 protected:
@@ -70,7 +83,10 @@ protected:
 
     void print(cairo_surface_t*, double xDPI, double yDPI);
     void renderPage(int pageNumber);
-    void rotatePage();
+    void rotatePageIfNeeded();
+    void getRowsAndColumnsOfPagesPerSheet(size_t& rows, size_t& columns);
+    void getPositionOfPageInSheet(size_t rows, size_t columns, int& x, int&y);
+    void prepareContextToDraw();
     void printDone();
 
     WebPage* m_webPage;
@@ -83,10 +99,21 @@ protected:
     double m_yDPI;
 
     unsigned int m_printPagesIdleId;
+    size_t m_numberOfPagesToPrint;
     unsigned int m_pagesToPrint;
+    size_t m_pagePosition;
     GtkPageRange* m_pageRanges;
     size_t m_pageRangesCount;
     bool m_needsRotation;
+
+    // Manual capabilities.
+    unsigned int m_numberUp;
+    unsigned int m_numberUpLayout;
+    unsigned int m_pageSet;
+    bool m_reverse;
+    unsigned int m_copies;
+    bool m_collateCopies;
+    double m_scale;
 };
 
 }
diff --git a/Source/WebKit2/WebProcess/WebPage/mac/TiledCoreAnimationDrawingArea.h b/Source/WebKit2/WebProcess/WebPage/mac/TiledCoreAnimationDrawingArea.h
index 2dd065493..806ead9cc 100644
--- a/Source/WebKit2/WebProcess/WebPage/mac/TiledCoreAnimationDrawingArea.h
+++ b/Source/WebKit2/WebProcess/WebPage/mac/TiledCoreAnimationDrawingArea.h
@@ -50,6 +50,7 @@ private:
     virtual void setNeedsDisplay(const WebCore::IntRect&) OVERRIDE;
     virtual void scroll(const WebCore::IntRect& scrollRect, const WebCore::IntSize& scrollOffset) OVERRIDE;
 
+    virtual void forceRepaint() OVERRIDE;
     virtual void setLayerTreeStateIsFrozen(bool) OVERRIDE;
     virtual bool layerTreeStateIsFrozen() const OVERRIDE;
     virtual void setRootCompositingLayer(WebCore::GraphicsLayer*) OVERRIDE;
@@ -60,6 +61,7 @@ private:
 
     // Message handlers.
     virtual void updateGeometry(const WebCore::IntSize& viewSize) OVERRIDE;
+    virtual void setDeviceScaleFactor(float) OVERRIDE;
 
     void setRootCompositingLayer(CALayer *);
 
diff --git a/Source/WebKit2/WebProcess/WebPage/mac/TiledCoreAnimationDrawingArea.mm b/Source/WebKit2/WebProcess/WebPage/mac/TiledCoreAnimationDrawingArea.mm
index 9e2849328..26fca92bf 100644
--- a/Source/WebKit2/WebProcess/WebPage/mac/TiledCoreAnimationDrawingArea.mm
+++ b/Source/WebKit2/WebProcess/WebPage/mac/TiledCoreAnimationDrawingArea.mm
@@ -114,6 +114,16 @@ void TiledCoreAnimationDrawingArea::setRootCompositingLayer(GraphicsLayer* graph
     setRootCompositingLayer(rootCompositingLayer);
 }
 
+void TiledCoreAnimationDrawingArea::forceRepaint()
+{
+    if (m_layerTreeStateIsFrozen)
+        return;
+
+    flushLayers();
+    [CATransaction flush];
+    [CATransaction synchronize];
+}
+
 void TiledCoreAnimationDrawingArea::setLayerTreeStateIsFrozen(bool layerTreeStateIsFrozen)
 {
     if (m_layerTreeStateIsFrozen == layerTreeStateIsFrozen)
@@ -161,6 +171,9 @@ void TiledCoreAnimationDrawingArea::updateGeometry(const IntSize& viewSize)
     m_webPage->setSize(viewSize);
     m_webPage->layoutIfNeeded();
 
+    if (!m_layerTreeStateIsFrozen)
+        flushLayers();
+
     [CATransaction begin];
     [CATransaction setDisableActions:YES];
 
@@ -174,6 +187,11 @@ void TiledCoreAnimationDrawingArea::updateGeometry(const IntSize& viewSize)
     m_webPage->send(Messages::DrawingAreaProxy::DidUpdateGeometry());
 }
 
+void TiledCoreAnimationDrawingArea::setDeviceScaleFactor(float deviceScaleFactor)
+{
+    m_webPage->setDeviceScaleFactor(deviceScaleFactor);
+}
+
 void TiledCoreAnimationDrawingArea::setRootCompositingLayer(CALayer *layer)
 {
     ASSERT(!m_layerTreeStateIsFrozen);
diff --git a/Source/WebKit2/WebProcess/WebPage/qt/LayerTreeHostQt.cpp b/Source/WebKit2/WebProcess/WebPage/qt/LayerTreeHostQt.cpp
index fc1e85b21..0005ce8ee 100644
--- a/Source/WebKit2/WebProcess/WebPage/qt/LayerTreeHostQt.cpp
+++ b/Source/WebKit2/WebProcess/WebPage/qt/LayerTreeHostQt.cpp
@@ -52,8 +52,13 @@ PassRefPtr<LayerTreeHostQt> LayerTreeHostQt::create(WebPage* webPage)
 
 LayerTreeHostQt::~LayerTreeHostQt()
 {
-    if (m_rootLayer)
-        toWebGraphicsLayer(m_rootLayer.get())->setLayerTreeTileClient(0);
+    // Prevent setWebGraphicsLayerClient(0) -> detachLayer() from modifying the set while we iterate it.
+    HashSet<WebCore::WebGraphicsLayer*> registeredLayers;
+    registeredLayers.swap(m_registeredLayers);
+
+    HashSet<WebCore::WebGraphicsLayer*>::iterator end = registeredLayers.end();
+    for (HashSet<WebCore::WebGraphicsLayer*>::iterator it = registeredLayers.begin(); it != end; ++it)
+        (*it)->setWebGraphicsLayerClient(0);
 }
 
 LayerTreeHostQt::LayerTreeHostQt(WebPage* webPage)
@@ -63,12 +68,12 @@ LayerTreeHostQt::LayerTreeHostQt(WebPage* webPage)
 #if USE(TILED_BACKING_STORE)
     , m_waitingForUIProcess(false)
     , m_isSuspended(false)
+    , m_contentsScale(1)
 #endif
     , m_shouldSyncFrame(false)
     , m_shouldSyncRootLayer(true)
     , m_layerFlushTimer(this, &LayerTreeHostQt::layerFlushTimerFired)
     , m_layerFlushSchedulingEnabled(true)
-    , m_shouldRecreateBackingStore(false)
 {
     // Create a root layer.
     m_rootLayer = GraphicsLayer::create(this);
@@ -83,7 +88,7 @@ LayerTreeHostQt::LayerTreeHostQt(WebPage* webPage)
 
     m_nonCompositedContentLayer = GraphicsLayer::create(this);
 #if USE(TILED_BACKING_STORE)
-    toWebGraphicsLayer(m_rootLayer.get())->setLayerTreeTileClient(this);
+    toWebGraphicsLayer(m_rootLayer.get())->setWebGraphicsLayerClient(this);
 #endif
 #ifndef NDEBUG
     m_nonCompositedContentLayer->setName("LayerTreeHostQt non-composited content");
@@ -215,8 +220,6 @@ void LayerTreeHostQt::setPageOverlayNeedsDisplay(const WebCore::IntRect& rect)
 
 bool LayerTreeHostQt::flushPendingLayerChanges()
 {
-    recreateBackingStoreIfNeeded();
-
     bool didSync = m_webPage->corePage()->mainFrame()->view()->syncCompositingStateIncludingSubframes();
     m_nonCompositedContentLayer->syncCompositingStateForThisLayerOnly();
     if (m_pageOverlayLayer)
@@ -232,10 +235,20 @@ void LayerTreeHostQt::didSyncCompositingStateForLayer(const WebLayerInfo& info)
     m_webPage->send(Messages::LayerTreeHostProxy::SyncCompositingLayerState(info));
 }
 
-void LayerTreeHostQt::didDeleteLayer(WebLayerID id)
+void LayerTreeHostQt::attachLayer(WebGraphicsLayer* layer)
+{
+    ASSERT(!m_registeredLayers.contains(layer));
+    m_registeredLayers.add(layer);
+
+    layer->setContentsScale(m_contentsScale);
+    layer->adjustVisibleRect();
+}
+
+void LayerTreeHostQt::detachLayer(WebGraphicsLayer* layer)
 {
+    m_registeredLayers.remove(layer);
     m_shouldSyncFrame = true;
-    m_webPage->send(Messages::LayerTreeHostProxy::DeleteCompositingLayer(id));
+    m_webPage->send(Messages::LayerTreeHostProxy::DeleteCompositingLayer(layer->id()));
 }
 
 void LayerTreeHostQt::performScheduledLayerFlush()
@@ -321,8 +334,6 @@ int64_t LayerTreeHostQt::adoptImageBackingStore(Image* image)
         graphicsContext->drawImage(image, ColorSpaceDeviceRGB, IntPoint::zero());
     }
 
-    // Qt uses BGRA internally, we swizzle to RGBA for OpenGL.
-    bitmap->swizzleRGB();
     ShareableBitmap::Handle handle;
     bitmap->createHandle(handle);
     m_webPage->send(Messages::LayerTreeHostProxy::CreateDirectlyCompositedImage(key, handle));
@@ -396,22 +407,37 @@ void LayerTreeHostQt::updateTile(WebLayerID layerID, int tileID, const UpdateInf
 {
     m_webPage->send(Messages::LayerTreeHostProxy::UpdateTileForLayer(layerID, tileID, updateInfo));
 }
+
 void LayerTreeHostQt::removeTile(WebLayerID layerID, int tileID)
 {
     m_webPage->send(Messages::LayerTreeHostProxy::RemoveTileForLayer(layerID, tileID));
 }
 
-void LayerTreeHostQt::setVisibleContentRectAndScale(const IntRect& rect, float scale)
+WebCore::IntRect LayerTreeHostQt::visibleContentsRect() const
 {
-    if (m_rootLayer) {
-        toWebGraphicsLayer(m_rootLayer.get())->setVisibleContentRectAndScale(rect, scale);
-        scheduleLayerFlush();
+    return m_visibleContentsRect;
+}
+
+void LayerTreeHostQt::setVisibleContentsRectForScaling(const IntRect& rect, float scale)
+{
+    m_visibleContentsRect = rect;
+    m_contentsScale = scale;
+
+    HashSet<WebCore::WebGraphicsLayer*>::iterator end = m_registeredLayers.end();
+    for (HashSet<WebCore::WebGraphicsLayer*>::iterator it = m_registeredLayers.begin(); it != end; ++it) {
+        (*it)->setContentsScale(scale);
+        (*it)->adjustVisibleRect();
     }
+    scheduleLayerFlush();
 }
 
-void LayerTreeHostQt::setVisibleContentRectTrajectoryVector(const FloatPoint& trajectoryVector)
+void LayerTreeHostQt::setVisibleContentsRectForPanning(const IntRect& rect, const FloatPoint& trajectoryVector)
 {
+    m_visibleContentsRect = rect;
+
     toWebGraphicsLayer(m_nonCompositedContentLayer.get())->setVisibleContentRectTrajectoryVector(trajectoryVector);
+
+    scheduleLayerFlush();
 }
 
 void LayerTreeHostQt::renderNextFrame()
@@ -427,22 +453,12 @@ bool LayerTreeHostQt::layerTreeTileUpdatesAllowed() const
 
 void LayerTreeHostQt::purgeBackingStores()
 {
-    m_shouldRecreateBackingStore = true;
-    WebGraphicsLayer* webRootLayer = toWebGraphicsLayer(m_rootLayer.get());
-    webRootLayer->purgeBackingStores();
+    HashSet<WebCore::WebGraphicsLayer*>::iterator end = m_registeredLayers.end();
+    for (HashSet<WebCore::WebGraphicsLayer*>::iterator it = m_registeredLayers.begin(); it != end; ++it)
+        (*it)->purgeBackingStores();
 
     ASSERT(!m_directlyCompositedImageRefCounts.size());
 }
-
-void LayerTreeHostQt::recreateBackingStoreIfNeeded()
-{
-    if (!m_shouldRecreateBackingStore)
-        return;
-
-    m_shouldRecreateBackingStore = false;
-    WebGraphicsLayer* webRootLayer = toWebGraphicsLayer(m_rootLayer.get());
-    webRootLayer->recreateBackingStoreIfNeeded();
-}
 #endif
 
 } // namespace WebKit
diff --git a/Source/WebKit2/WebProcess/WebPage/qt/LayerTreeHostQt.h b/Source/WebKit2/WebProcess/WebPage/qt/LayerTreeHostQt.h
index 07f04e88a..f5c433f9a 100644
--- a/Source/WebKit2/WebProcess/WebPage/qt/LayerTreeHostQt.h
+++ b/Source/WebKit2/WebProcess/WebPage/qt/LayerTreeHostQt.h
@@ -34,7 +34,7 @@ class WebPage;
 
 class LayerTreeHostQt : public LayerTreeHost, WebCore::GraphicsLayerClient
 #if USE(TILED_BACKING_STORE)
-                      , public WebLayerTreeTileClient
+                      , public WebGraphicsLayerClient
 #endif
 {
 public:
@@ -69,13 +69,15 @@ public:
     virtual void createTile(WebLayerID, int tileID, const UpdateInfo&);
     virtual void updateTile(WebLayerID, int tileID, const UpdateInfo&);
     virtual void removeTile(WebLayerID, int tileID);
+    virtual WebCore::IntRect visibleContentsRect() const;
     virtual void renderNextFrame();
     virtual void purgeBackingStores();
     virtual bool layerTreeTileUpdatesAllowed() const;
-    virtual void setVisibleContentRectAndScale(const WebCore::IntRect&, float scale);
-    virtual void setVisibleContentRectTrajectoryVector(const WebCore::FloatPoint&);
+    virtual void setVisibleContentsRectForScaling(const WebCore::IntRect&, float scale);
+    virtual void setVisibleContentsRectForPanning(const WebCore::IntRect&, const WebCore::FloatPoint&);
     virtual void didSyncCompositingStateForLayer(const WebLayerInfo&);
-    virtual void didDeleteLayer(WebLayerID);
+    virtual void attachLayer(WebCore::WebGraphicsLayer*);
+    virtual void detachLayer(WebCore::WebGraphicsLayer*);
 #endif
 
 protected:
@@ -96,7 +98,6 @@ private:
     void cancelPendingLayerFlush();
     void performScheduledLayerFlush();
     void sendLayersToUI();
-    void recreateBackingStoreIfNeeded();
 
     OwnPtr<WebCore::GraphicsLayer> m_rootLayer;
 
@@ -106,6 +107,7 @@ private:
     // The page overlay layer. Will be null if there's no page overlay.
     OwnPtr<WebCore::GraphicsLayer> m_pageOverlayLayer;
 
+    HashSet<WebCore::WebGraphicsLayer*> m_registeredLayers;
     HashMap<int64_t, int> m_directlyCompositedImageRefCounts;
 
     bool m_notifyAfterScheduledLayerFlush;
@@ -113,6 +115,8 @@ private:
 #if USE(TILED_BACKING_STORE)
     bool m_waitingForUIProcess;
     bool m_isSuspended;
+    WebCore::IntRect m_visibleContentsRect;
+    float m_contentsScale;
 #endif
     LayerTreeContext m_layerTreeContext;
     bool m_shouldSyncFrame;
@@ -120,7 +124,6 @@ private:
     void layerFlushTimerFired(WebCore::Timer<LayerTreeHostQt>*);
     WebCore::Timer<LayerTreeHostQt> m_layerFlushTimer;
     bool m_layerFlushSchedulingEnabled;
-    bool m_shouldRecreateBackingStore;
 };
 
 }
diff --git a/Source/WebKit2/WebProcess/WebProcess.cpp b/Source/WebKit2/WebProcess/WebProcess.cpp
index d0981071f..9a8b905fe 100644
--- a/Source/WebKit2/WebProcess/WebProcess.cpp
+++ b/Source/WebKit2/WebProcess/WebProcess.cpp
@@ -100,7 +100,8 @@ static void sleep(unsigned seconds)
 }
 #endif
 
-static void* randomCrashThread(void*)
+static void randomCrashThread(void*) NO_RETURN_DUE_TO_CRASH;
+void randomCrashThread(void*)
 {
     // This delay was chosen semi-arbitrarily. We want the crash to happen somewhat quickly to
     // enable useful stress testing, but not so quickly that the web process will always crash soon
@@ -109,7 +110,6 @@ static void* randomCrashThread(void*)
 
     sleep(randomNumber() * maximumRandomCrashDelay);
     CRASH();
-    return 0;
 }
 
 static void startRandomCrashThreadIfRequested()
diff --git a/Source/WebKit2/WebProcess/com.apple.WebProcess.sb b/Source/WebKit2/WebProcess/com.apple.WebProcess.sb
index c706dc8d0..68b073bd8 100644
--- a/Source/WebKit2/WebProcess/com.apple.WebProcess.sb
+++ b/Source/WebKit2/WebProcess/com.apple.WebProcess.sb
@@ -24,6 +24,7 @@
        (subpath "/Library/Dictionaries")
        (subpath "/Library/Fonts")
        (subpath "/Library/Frameworks")
+       (subpath "/Library/Managed Preferences")
        (subpath "/private/var/db/mds")
        (subpath "/private/var/db/DetachedSignatures")
        (regex #"^/private/etc/(hosts|group|passwd)$")
@@ -34,6 +35,7 @@
        ;; System and user preferences
        (literal "/Library/Preferences/.GlobalPreferences.plist")
        (literal "/Library/Preferences/com.apple.crypto.plist")
+       (literal "/Library/Preferences/com.apple.networkd.plist")
        (literal "/Library/Preferences/com.apple.security.plist")
        (literal "/Library/Preferences/com.apple.security.common.plist")
        (literal "/Library/Preferences/com.apple.security.revocation.plist")
@@ -45,6 +47,7 @@
        (home-literal "/Library/Preferences/com.apple.DownloadAssessment.plist")
        (home-literal "/Library/Preferences/com.apple.HIToolbox.plist")
        (home-literal "/Library/Preferences/com.apple.LaunchServices.plist")
+       (home-literal "/Library/Preferences/com.apple.QTKit.plist")
        (home-literal "/Library/Preferences/com.apple.WebFoundation.plist")
        (home-literal "/Library/Preferences/com.apple.security.plist")
        (home-literal "/Library/Preferences/com.apple.security.revocation.plist")
diff --git a/Source/WebKit2/WebProcess/efl/WebProcessMainEfl.cpp b/Source/WebKit2/WebProcess/efl/WebProcessMainEfl.cpp
index 83c5c3be2..08f3bb547 100644
--- a/Source/WebKit2/WebProcess/efl/WebProcessMainEfl.cpp
+++ b/Source/WebKit2/WebProcess/efl/WebProcessMainEfl.cpp
@@ -66,7 +66,6 @@ WK_EXPORT int WebProcessMainEfl(int argc, char* argv[])
 
     RunLoop::initializeMainRunLoop();
 
-#if USE(SOUP)
     SoupSession* session = WebCore::ResourceHandle::defaultSession();
     const char* httpProxy = g_getenv("http_proxy");
     if (httpProxy) {
@@ -77,7 +76,6 @@ WK_EXPORT int WebProcessMainEfl(int argc, char* argv[])
 
     soup_session_add_feature_by_type(session, SOUP_TYPE_CONTENT_SNIFFER);
     soup_session_add_feature_by_type(session, SOUP_TYPE_CONTENT_DECODER);
-#endif
 
     int socket = atoi(argv[1]);
     WebProcess::shared().initialize(socket, RunLoop::main());
diff --git a/Source/WebKit2/WebProcess/gtk/WebProcessMainGtk.cpp b/Source/WebKit2/WebProcess/gtk/WebProcessMainGtk.cpp
index 18c506bcc..aacc27b6b 100644
--- a/Source/WebKit2/WebProcess/gtk/WebProcessMainGtk.cpp
+++ b/Source/WebKit2/WebProcess/gtk/WebProcessMainGtk.cpp
@@ -58,14 +58,12 @@ WK_EXPORT int WebProcessMainGtk(int argc, char* argv[])
     WTF::initializeMainThread();
 
     RunLoop::initializeMainRunLoop();
-    SoupSession* session = WebCore::ResourceHandle::defaultSession();
+    int socket = atoi(argv[1]);
+    WebProcess::shared().initialize(socket, RunLoop::main());
 
-    soup_session_add_feature_by_type(session, SOUP_TYPE_CONTENT_SNIFFER);
-    soup_session_add_feature_by_type(session, SOUP_TYPE_CONTENT_DECODER);
+    SoupSession* session = WebCore::ResourceHandle::defaultSession();
     soup_session_add_feature_by_type(session, WEB_TYPE_AUTH_DIALOG);
 
-    int socket = atoi(argv[1]);
-    WebProcess::shared().initialize(socket, RunLoop::main());
     RunLoop::run();
 
     return 0;
diff --git a/Source/WebKit2/WebProcess/qt/QtNetworkAccessManager.cpp b/Source/WebKit2/WebProcess/qt/QtNetworkAccessManager.cpp
index 28efc0c82..ce46be854 100644
--- a/Source/WebKit2/WebProcess/qt/QtNetworkAccessManager.cpp
+++ b/Source/WebKit2/WebProcess/qt/QtNetworkAccessManager.cpp
@@ -33,6 +33,7 @@
 #include "WebPageProxyMessages.h"
 #include "WebProcess.h"
 #include <QAuthenticator>
+#include <QNetworkProxy>
 #include <QNetworkReply>
 #include <QNetworkRequest>
 
@@ -43,6 +44,7 @@ QtNetworkAccessManager::QtNetworkAccessManager(WebProcess* webProcess)
     , m_webProcess(webProcess)
 {
     connect(this, SIGNAL(authenticationRequired(QNetworkReply*, QAuthenticator*)), SLOT(onAuthenticationRequired(QNetworkReply*, QAuthenticator*)));
+    connect(this, SIGNAL(proxyAuthenticationRequired(const QNetworkProxy&, QAuthenticator*)), SLOT(onProxyAuthenticationRequired(const QNetworkProxy&, QAuthenticator*)));
     connect(this, SIGNAL(sslErrors(QNetworkReply*, QList<QSslError>)), SLOT(onSslErrors(QNetworkReply*, QList<QSslError>)));
 }
 
@@ -73,6 +75,31 @@ void QtNetworkAccessManager::registerApplicationScheme(const WebPage* page, cons
     m_applicationSchemes.insert(page, scheme.toLower());
 }
 
+void QtNetworkAccessManager::onProxyAuthenticationRequired(const QNetworkProxy& proxy, QAuthenticator* authenticator)
+{
+    // FIXME: Check if there is a better way to get a reference to the page.
+    WebPage* webPage = m_webProcess->focusedWebPage();
+
+    if (!webPage)
+        return;
+
+    String hostname = proxy.hostName();
+    uint16_t port = static_cast<uint16_t>(proxy.port());
+    String prefilledUsername = authenticator->user();
+    String username;
+    String password;
+
+    if (webPage->sendSync(
+         Messages::WebPageProxy::ProxyAuthenticationRequiredRequest(hostname, port, prefilledUsername),
+         Messages::WebPageProxy::ProxyAuthenticationRequiredRequest::Reply(username, password))) {
+         if (!username.isEmpty())
+             authenticator->setUser(username);
+         if (!password.isEmpty())
+             authenticator->setPassword(password);
+     }
+
+}
+
 void QtNetworkAccessManager::onAuthenticationRequired(QNetworkReply* reply, QAuthenticator* authenticator)
 {
     WebPage* webPage = obtainOriginatingWebPage(reply->request());
diff --git a/Source/WebKit2/WebProcess/qt/QtNetworkAccessManager.h b/Source/WebKit2/WebProcess/qt/QtNetworkAccessManager.h
index 846221eb7..fe37bda1f 100644
--- a/Source/WebKit2/WebProcess/qt/QtNetworkAccessManager.h
+++ b/Source/WebKit2/WebProcess/qt/QtNetworkAccessManager.h
@@ -29,6 +29,7 @@
 
 #include <QMultiHash>
 #include <QNetworkAccessManager>
+#include <QNetworkProxy>
 #include <QString>
 
 namespace WebKit {
@@ -47,6 +48,7 @@ protected:
 
 private Q_SLOTS:
     void onAuthenticationRequired(QNetworkReply *, QAuthenticator *);
+    void onProxyAuthenticationRequired(const QNetworkProxy&, QAuthenticator *);
     void onSslErrors(QNetworkReply*, const QList<QSslError>&);
 
 private:
diff --git a/Source/WebKit2/win/WebKit2.def b/Source/WebKit2/win/WebKit2.def
index 76830e01c..718dfa18b 100644
--- a/Source/WebKit2/win/WebKit2.def
+++ b/Source/WebKit2/win/WebKit2.def
@@ -116,6 +116,7 @@ EXPORTS
         ?broadcast@ThreadCondition@WTF@@QAEXXZ
         ?callOnMainThread@WTF@@YAXP6AXPAX@Z0@Z
         ?createThread@WTF@@YAIP6APAXPAX@Z0PBD@Z
+        ?createThread@WTF@@YAIP6AXPAX@Z0PBD@Z
         ?currentThread@WTF@@YAIXZ
         ?detachThread@WTF@@YAXI@Z
         ?initializeMainThread@WTF@@YAXXZ
@@ -131,6 +132,7 @@ EXPORTS
         ?unlock@Mutex@WTF@@QAEXXZ
         ?unlockAtomicallyInitializedStaticMutex@WTF@@YAXXZ
         ?wait@ThreadCondition@WTF@@QAEXAAVMutex@2@@Z
+        ?waitForThreadCompletion@WTF@@YAHI@Z
         ?waitForThreadCompletion@WTF@@YAHIPAPAX@Z
         ?createThread@WTF@@YAIP6APAXPAX@Z0@Z
         ; Re-exports from WebCore for test harnesses
@@ -163,13 +165,14 @@ EXPORTS
         ?getData16SlowCase@StringImpl@WTF@@ABEPB_WXZ
         ?getElementById@TreeScope@WebCore@@QBEPAVElement@2@ABVAtomicString@WTF@@@Z
         ?getLocationAndLengthFromRange@TextIterator@WebCore@@SA_NPAVElement@2@PBVRange@2@AAI2@Z
+        ?hasShadowRoot@Element@WebCore@@QBE_NXZ
         ?isPreloaded@CachedResourceLoader@WebCore@@QBE_NABVString@WTF@@@Z
         ?jsStringSlowCase@WebCore@@YA?AVJSValue@JSC@@PAVExecState@3@AAV?$HashMap@PAVStringImpl@WTF@@V?$Weak@VJSString@JSC@@@JSC@@UStringHash@2@U?$HashTraits@PAVStringImpl@WTF@@@2@U?$HashTraits@V?$Weak@VJSString@JSC@@@JSC@@@2@@WTF@@PAVStringImpl@6@@Z
         ?lastChangeWasUserEdit@HTMLTextFormControlElement@WebCore@@QBE_NXZ
         ?markersFor@DocumentMarkerController@WebCore@@QAE?AV?$Vector@PAVDocumentMarker@WebCore@@$0A@@WTF@@PAVNode@2@VMarkerTypes@DocumentMarker@2@@Z
         ?observeFrame@FrameDestructionObserver@WebCore@@IAEXPAVFrame@2@@Z
         ?overrideUserPreferredLanguages@WebCore@@YAXABV?$Vector@VString@WTF@@$0A@@WTF@@@Z
-        ; ?numberOfScopedHTMLStyleChildren@Element@WebCore@@QBEIXZ
+        ?numberOfScopedHTMLStyleChildren@Node@WebCore@@QBEIXZ
         ?page@Document@WebCore@@QBEPAVPage@2@XZ
         ?paintControlTints@FrameView@WebCore@@AAEXXZ
         ?rangeFromLocationAndLength@TextIterator@WebCore@@SA?AV?$PassRefPtr@VRange@WebCore@@@WTF@@PAVElement@2@HH_N@Z
@@ -187,7 +190,7 @@ EXPORTS
         ?settings@Document@WebCore@@QBEPAVSettings@2@XZ
         ?settings@Frame@WebCore@@QBEPAVSettings@2@XZ
         ?setFixedElementsLayoutRelativeToFrame@Settings@WebCore@@QAEX_N@Z
-        ?shadowRoot@Element@WebCore@@QBEPAVShadowRoot@2@XZ
+        ?shadowRootList@Element@WebCore@@QBEPAVShadowRootList@2@XZ
         ?suggestedValue@HTMLInputElement@WebCore@@QBEABVString@WTF@@XZ
         ?toDocument@WebCore@@YAPAVDocument@1@VJSValue@JSC@@@Z
         ?toElement@WebCore@@YAPAVElement@1@VJSValue@JSC@@@Z
@@ -198,3 +201,4 @@ EXPORTS
         ?updateLayoutIgnorePendingStylesheets@Document@WebCore@@QAEXXZ
         ?userPreferredLanguages@WebCore@@YA?AV?$Vector@VString@WTF@@$0A@@WTF@@XZ
         ?view@Document@WebCore@@QBEPAVFrameView@2@XZ
+        ?willDetachPage@FrameDestructionObserver@WebCore@@UAEXXZ
diff --git a/Source/WebKit2/win/WebKit2CFLite.def b/Source/WebKit2/win/WebKit2CFLite.def
index 3a927c27c..c359ea6e3 100644
--- a/Source/WebKit2/win/WebKit2CFLite.def
+++ b/Source/WebKit2/win/WebKit2CFLite.def
@@ -109,6 +109,7 @@ EXPORTS
         ?broadcast@ThreadCondition@WTF@@QAEXXZ
         ?callOnMainThread@WTF@@YAXP6AXPAX@Z0@Z
         ?createThread@WTF@@YAIP6APAXPAX@Z0PBD@Z
+        ?createThread@WTF@@YAIP6AXPAX@Z0PBD@Z
         ?currentThread@WTF@@YAIXZ
         ?detachThread@WTF@@YAXI@Z
         ?initializeMainThread@WTF@@YAXXZ
@@ -124,9 +125,9 @@ EXPORTS
         ?unlock@Mutex@WTF@@QAEXXZ
         ?unlockAtomicallyInitializedStaticMutex@WTF@@YAXXZ
         ?wait@ThreadCondition@WTF@@QAEXAAVMutex@2@@Z
+        ?waitForThreadCompletion@WTF@@YAHI@Z
         ?waitForThreadCompletion@WTF@@YAHIPAPAX@Z
         ?createThread@WTF@@YAIP6APAXPAX@Z0@Z
-
         ; Re-exports from WebCore for test harnesses
         ??0NodeRenderingContext@WebCore@@QAE@PAVNode@1@@Z
         ??1NodeRenderingContext@WebCore@@QAE@XZ
@@ -157,13 +158,14 @@ EXPORTS
         ?getData16SlowCase@StringImpl@WTF@@ABEPB_WXZ
         ?getElementById@TreeScope@WebCore@@QBEPAVElement@2@ABVAtomicString@WTF@@@Z
         ?getLocationAndLengthFromRange@TextIterator@WebCore@@SA_NPAVElement@2@PBVRange@2@AAI2@Z
+        ?hasShadowRoot@Element@WebCore@@QBE_NXZ
         ?isPreloaded@CachedResourceLoader@WebCore@@QBE_NABVString@WTF@@@Z
         ?jsStringSlowCase@WebCore@@YA?AVJSValue@JSC@@PAVExecState@3@AAV?$HashMap@PAVStringImpl@WTF@@V?$Weak@VJSString@JSC@@@JSC@@UStringHash@2@U?$HashTraits@PAVStringImpl@WTF@@@2@U?$HashTraits@V?$Weak@VJSString@JSC@@@JSC@@@2@@WTF@@PAVStringImpl@6@@Z
         ?lastChangeWasUserEdit@HTMLTextFormControlElement@WebCore@@QBE_NXZ
         ?markersFor@DocumentMarkerController@WebCore@@QAE?AV?$Vector@PAVDocumentMarker@WebCore@@$0A@@WTF@@PAVNode@2@VMarkerTypes@DocumentMarker@2@@Z
         ?observeFrame@FrameDestructionObserver@WebCore@@IAEXPAVFrame@2@@Z
         ?overrideUserPreferredLanguages@WebCore@@YAXABV?$Vector@VString@WTF@@$0A@@WTF@@@Z
-        ; ?numberOfScopedHTMLStyleChildren@Element@WebCore@@QBEIXZ
+        ?numberOfScopedHTMLStyleChildren@Node@WebCore@@QBEIXZ
         ?page@Document@WebCore@@QBEPAVPage@2@XZ
         ?paintControlTints@FrameView@WebCore@@AAEXXZ
         ?rangeFromLocationAndLength@TextIterator@WebCore@@SA?AV?$PassRefPtr@VRange@WebCore@@@WTF@@PAVElement@2@HH_N@Z
@@ -181,7 +183,7 @@ EXPORTS
         ?settings@Document@WebCore@@QBEPAVSettings@2@XZ
         ?settings@Frame@WebCore@@QBEPAVSettings@2@XZ
         ?setFixedElementsLayoutRelativeToFrame@Settings@WebCore@@QAEX_N@Z
-        ?shadowRoot@Element@WebCore@@QBEPAVShadowRoot@2@XZ
+        ?shadowRootList@Element@WebCore@@QBEPAVShadowRootList@2@XZ
         ?suggestedValue@HTMLInputElement@WebCore@@QBEABVString@WTF@@XZ
         ?toDocument@WebCore@@YAPAVDocument@1@VJSValue@JSC@@@Z
         ?toElement@WebCore@@YAPAVElement@1@VJSValue@JSC@@@Z
@@ -192,3 +194,4 @@ EXPORTS
         ?updateLayoutIgnorePendingStylesheets@Document@WebCore@@QAEXXZ
         ?userPreferredLanguages@WebCore@@YA?AV?$Vector@VString@WTF@@$0A@@WTF@@XZ
         ?view@Document@WebCore@@QBEPAVFrameView@2@XZ
+        ?willDetachPage@FrameDestructionObserver@WebCore@@UAEXXZ
diff --git a/Source/api.pri b/Source/api.pri
index d22d43cea..9ca386f2f 100644
--- a/Source/api.pri
+++ b/Source/api.pri
@@ -61,7 +61,8 @@ SOURCES += \
     $$PWD/WebKit/qt/WebCoreSupport/QtPlatformPlugin.cpp \
     $$PWD/WebKit/qt/WebCoreSupport/SearchPopupMenuQt.cpp \
     $$PWD/WebKit/qt/WebCoreSupport/TextCheckerClientQt.cpp \
-    $$PWD/WebKit/qt/WebCoreSupport/PlatformStrategiesQt.cpp
+    $$PWD/WebKit/qt/WebCoreSupport/PlatformStrategiesQt.cpp \
+    $$PWD/WebKit/qt/WebCoreSupport/WebEventConversion.cpp
 
 HEADERS += \
     $$PWD/WebKit/qt/WebCoreSupport/InitWebCoreQt.h \
@@ -77,7 +78,8 @@ HEADERS += \
     $$PWD/WebKit/qt/WebCoreSupport/PopupMenuQt.h \
     $$PWD/WebKit/qt/WebCoreSupport/SearchPopupMenuQt.h \
     $$PWD/WebKit/qt/WebCoreSupport/TextCheckerClientQt.h \
-    $$PWD/WebKit/qt/WebCoreSupport/PlatformStrategiesQt.h
+    $$PWD/WebKit/qt/WebCoreSupport/PlatformStrategiesQt.h \
+    $$PWD/WebKit/qt/WebCoreSupport/WebEventConversion.h
 
 INCLUDEPATH += \
     $$PWD/WebKit/qt/Api \
diff --git a/Source/autotools/symbols.filter b/Source/autotools/symbols.filter
index f0cdc1a0c..ef70d81a4 100644
--- a/Source/autotools/symbols.filter
+++ b/Source/autotools/symbols.filter
@@ -9,6 +9,7 @@ _ZN3WTF16fastZeroedMallocEm;
 _ZN3WTF20fastMallocStatisticsEv;
 _ZN3WTF8fastFreeEPv;
 _ZN3WTF13freeOwnedGPtrI7_GErrorEEvPT_;
+_ZN3WTF13freeOwnedGPtrI9_GdkEventEEvPT_;
 _ZN3WTF8Internal21fastMallocMatchFailedEPv;
 _ZN3WTF3MD58addBytes*;
 _ZN3WTF3MD58checksum*;
@@ -70,6 +71,7 @@ _ZN7WebCore7toRangeEN3JSC7JSValueE;
 _ZN7WebCore9JSElement10putVirtualEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE;
 _ZN7WebCore9JSElement6s_infoE;
 _ZN7WebCore9toElementEN3JSC7JSValueE;
+_ZNK7WebCore4Node31numberOfScopedHTMLStyleChildrenEv;
 _ZNK7WebCore12RenderObject23absoluteBoundingBoxRectEb;
 _ZNK7WebCore16HTMLInputElement14suggestedValueEv;
 _ZNK7WebCore17JSDOMGlobalObject22scriptExecutionContextEv;
@@ -77,8 +79,8 @@ _ZNK7WebCore20CachedResourceLoader11isPreloadedERKN3WTF6StringE;
 _ZNK7WebCore26HTMLTextFormControlElement21lastChangeWasUserEditEv;
 _ZNK7WebCore5Frame8settingsEv;
 _ZNK7WebCore6JSNode21pushEventHandlerScopeEPN3JSC9ExecStateEPNS1_14ScopeChainNodeE;
-_ZNK7WebCore7Element10shadowRootEv;
-_ZNK7WebCore7Element31numberOfScopedHTMLStyleChildrenEv;
+_ZNK7WebCore7Element13hasShadowRootEv;
+_ZNK7WebCore7Element14shadowRootListEv;
 _ZNK7WebCore8Document4pageEv;
 _ZNK7WebCore8Document8settingsEv;
 _ZNK7WebCore8Document4viewEv;
@@ -94,6 +96,8 @@ _ZN7WebCore24FrameDestructionObserverD2Ev;
 _ZN7WebCore24FrameDestructionObserverC2EPNS_5FrameE;
 _ZN7WebCore24FrameDestructionObserver12observeFrameEPNS_5FrameE;
 _ZN7WebCore24FrameDestructionObserver14frameDestroyedEv;
+_ZN7WebCore24FrameDestructionObserver14willDetachPageEv;
+_ZN7WebCore22RuntimeEnabledFeatures31isMultipleShadowSubtreesEnabledE;
 local:
 _Z*;
 cti*;
diff --git a/Source/cmake/FindCFLite.cmake b/Source/cmake/FindCFLite.cmake
index ea2c2f3b1..4d60ec4c4 100644
--- a/Source/cmake/FindCFLite.cmake
+++ b/Source/cmake/FindCFLite.cmake
@@ -5,10 +5,6 @@
 #  CFLITE_INCLUDE_DIR - The CFLite include directory
 #  CFLITE_LIBRARIES - The libraries needed to use CFLite
 
-# use pkg-config to get the directories and then use these values
-# in the FIND_PATH() and FIND_LIBRARY() calls
-FIND_PACKAGE(PkgConfig)
-
 FIND_PATH(CFLITE_INCLUDE_DIR NAMES CoreFoundation/CoreFoundation.h)
 
 FIND_LIBRARY(CFLITE_LIBRARIES NAMES CFLite.lib)
diff --git a/Source/cmake/FindDirectX.cmake b/Source/cmake/FindDirectX.cmake
new file mode 100644
index 000000000..41787c968
--- /dev/null
+++ b/Source/cmake/FindDirectX.cmake
@@ -0,0 +1,29 @@
+# - Find DirectX SDK installation

+# Find the DirectX includes and library

+# This module defines

+#  DirectX_INCLUDE_DIRS, where to find d3d9.h, etc.

+#  DirectX_LIBRARIES, libraries to link against to use DirectX.

+#  DirectX_FOUND, If false, do not try to use DirectX.

+#  DirectX_ROOT_DIR, directory where DirectX was installed.

+

+FIND_PATH(DirectX_INCLUDE_DIRS d3d9.h PATHS

+    "$ENV{DXSDK_DIR}/Include"

+    "$ENV{PROGRAMFILES}/Microsoft DirectX SDK*/Include"

+)

+

+GET_FILENAME_COMPONENT(DirectX_ROOT_DIR "${DirectX_INCLUDE_DIRS}/.." ABSOLUTE)

+

+IF (CMAKE_CL_64)

+    SET(DirectX_LIBRARY_PATHS "${DirectX_ROOT_DIR}/Lib/x64")

+ELSE ()

+    SET(DirectX_LIBRARY_PATHS "${DirectX_ROOT_DIR}/Lib/x86" "${DirectX_ROOT_DIR}/Lib")

+ENDIF ()

+

+FIND_LIBRARY(DirectX_D3D9_LIBRARY d3d9 ${DirectX_LIBRARY_PATHS} NO_DEFAULT_PATH)

+FIND_LIBRARY(DirectX_D3DX9_LIBRARY d3dx9 ${DirectX_LIBRARY_PATHS} NO_DEFAULT_PATH)

+SET(DirectX_LIBRARIES ${DirectX_D3D9_LIBRARY} ${DirectX_D3DX9_LIBRARY})

+

+# handle the QUIETLY and REQUIRED arguments and set DirectX_FOUND to TRUE if all listed variables are TRUE

+INCLUDE(FindPackageHandleStandardArgs)

+FIND_PACKAGE_HANDLE_STANDARD_ARGS(DirectX DEFAULT_MSG DirectX_ROOT_DIR DirectX_LIBRARIES DirectX_INCLUDE_DIRS)

+MARK_AS_ADVANCED(DirectX_INCLUDE_DIRS DirectX_D3D9_LIBRARY DirectX_D3DX9_LIBRARY)

diff --git a/Source/cmake/FindEFL.cmake b/Source/cmake/FindEFL.cmake
index 8b12065d5..cdd64a67e 100644
--- a/Source/cmake/FindEFL.cmake
+++ b/Source/cmake/FindEFL.cmake
@@ -14,3 +14,7 @@ PKG_CHECK_MODULES (EINA REQUIRED eina>=1.0.0)
 PKG_CHECK_MODULES (ECORE_X ecore-x>=1.0.0)
 PKG_CHECK_MODULES (EVAS REQUIRED evas>=1.0.0)
 
+FIND_PROGRAM (EDJE_CC_EXECUTABLE edje_cc)
+IF (NOT EDJE_CC_EXECUTABLE)
+    MESSAGE (FATAL_ERROR "edje_cc could not be found")
+ENDIF ()
diff --git a/Source/cmake/FindGDK-PixBuf.cmake b/Source/cmake/FindGDK-PixBuf.cmake
deleted file mode 100644
index d21d87a9f..000000000
--- a/Source/cmake/FindGDK-PixBuf.cmake
+++ /dev/null
@@ -1,32 +0,0 @@
-# - Try to find gdk-pixbuf 2.0
-# Once done, this will define
-#
-#  GDK-PixBuf_FOUND - system has GDK-PixBuf
-#  GDK-PixBuf_INCLUDE_DIRS - the GDK-PixBuf include directories
-#  GDK-PixBuf_LIBRARIES - link these to use GDK-PixBuf
-
-include(LibFindMacros)
-
-# Use pkg-config to get hints about paths
-libfind_pkg_check_modules(GDK-PixBuf_PKGCONF gdk-pixbuf-2.0)
-
-# Main include dir
-find_path(GDK-PixBuf_INCLUDE_DIR
-  NAMES gdk-pixbuf/gdk-pixbuf.h
-  PATHS ${GDK-PixBuf_PKGCONF_INCLUDE_DIRS}
-  PATH_SUFFIXES gtk-2.0
-)
-
-# Finally the library itself
-find_library(GDK-PixBuf_LIBRARY
-  NAMES gdk_pixbuf-2.0
-  PATHS ${GDK-PixBuf_PKGCONF_LIBRARY_DIRS}
-)
-
-# Set the include dir variables and the libraries and let libfind_process do the rest.
-# NOTE: Singular variables for this library, plural for libraries this this lib depends on.
-set(GDK-PixBuf_PROCESS_INCLUDES GDK-PixBuf_INCLUDE_DIR)
-set(GDK-PixBuf_PROCESS_LIBS GDK-PixBuf_LIBRARY)
-libfind_process(GDK-PixBuf)
-
-
diff --git a/Source/cmake/FindGDK.cmake b/Source/cmake/FindGDK.cmake
deleted file mode 100644
index f7c469e79..000000000
--- a/Source/cmake/FindGDK.cmake
+++ /dev/null
@@ -1,43 +0,0 @@
-# - Try to find GDK 2.0
-# Once done, this will define
-#
-#  GDK_FOUND - system has GDK
-#  GDK_INCLUDE_DIRS - the GDK include directories
-#  GDK_LIBRARIES - link these to use GDK
-
-include(LibFindMacros)
-
-# Dependencies
-libfind_package(GDK GDK-PixBuf)
-libfind_package(GDK Pango)
-libfind_package(GDK GIO)
-
-# Use pkg-config to get hints about paths
-libfind_pkg_check_modules(GDK_PKGCONF gdk-2.0)
-
-# Main include dir
-find_path(GDK_INCLUDE_DIR
-  NAMES gdk/gdk.h
-  PATHS ${GDK_PKGCONF_INCLUDE_DIRS}
-  PATH_SUFFIXES gtk-2.0
-)
-
-# Glib-related libraries also use a separate config header, which is in lib dir
-find_path(GDKConfig_INCLUDE_DIR
-  NAMES gdkconfig.h
-  PATHS ${GDK_PKGCONF_INCLUDE_DIRS} /usr
-  PATH_SUFFIXES lib/gtk-2.0/include
-)
-
-# Finally the library itself
-find_library(GDK_LIBRARY
-  NAMES gdk-x11-2.0 gdk-win32-2.0
-  PATHS ${GDK_PKGCONF_LIBRARY_DIRS}
-)
-
-# Set the include dir variables and the libraries and let libfind_process do the rest.
-# NOTE: Singular variables for this library, plural for libraries this this lib depends on.
-set(GDK_PROCESS_INCLUDES GDK_INCLUDE_DIR GDKConfig_INCLUDE_DIR GDK-PixBuf_INCLUDE_DIRS Pango_INCLUDE_DIRS GIO_INCLUDE_DIRS)
-set(GDK_PROCESS_LIBS GDK_LIBRARY GDK-PixBuf_LIBRARIES Pango_LIBRARIES GIO_LIBRARIES)
-libfind_process(GDK)
-
diff --git a/Source/cmake/FindGStreamer-App.cmake b/Source/cmake/FindGStreamer-App.cmake
index 0b7ce9bad..f865f443a 100644
--- a/Source/cmake/FindGStreamer-App.cmake
+++ b/Source/cmake/FindGStreamer-App.cmake
@@ -12,7 +12,7 @@ libfind_package(GStreamer-App GStreamer)
 libfind_package(GStreamer-App GStreamer-Base)
 
 # Use pkg-config to get hints about paths
-libfind_pkg_check_modules(GStreamer-App_PKGCONF gstreamer-app-0.10)
+libfind_pkg_check_modules(GStreamer-App_PKGCONF gstreamer-app-0.10>=0.10.30)
 
 # Include dir
 find_path(GStreamer-App_INCLUDE_DIR
diff --git a/Source/cmake/FindGStreamer-Base.cmake b/Source/cmake/FindGStreamer-Base.cmake
index d4681a9a1..4e04b0cae 100644
--- a/Source/cmake/FindGStreamer-Base.cmake
+++ b/Source/cmake/FindGStreamer-Base.cmake
@@ -11,7 +11,7 @@ include(LibFindMacros)
 libfind_package(GStreamer-Base GStreamer)
 
 # Use pkg-config to get hints about paths
-libfind_pkg_check_modules(GStreamer-Base_PKGCONF gstreamer-base-0.10)
+libfind_pkg_check_modules(GStreamer-Base_PKGCONF gstreamer-base-0.10>=0.10.30)
 
 # Include dir
 find_path(GStreamer-Base_INCLUDE_DIR
diff --git a/Source/cmake/FindGStreamer-Interfaces.cmake b/Source/cmake/FindGStreamer-Interfaces.cmake
index 1c7e3e73f..7959c6678 100644
--- a/Source/cmake/FindGStreamer-Interfaces.cmake
+++ b/Source/cmake/FindGStreamer-Interfaces.cmake
@@ -11,7 +11,7 @@ include(LibFindMacros)
 libfind_package(GStreamer-Interfaces GStreamer)
 
 # Use pkg-config to get hints about paths
-libfind_pkg_check_modules(GStreamer-Interfaces_PKGCONF gstreamer-interfaces-0.10)
+libfind_pkg_check_modules(GStreamer-Interfaces_PKGCONF gstreamer-interfaces-0.10>=0.10.30)
 
 # Include dir
 find_path(GStreamer-Interfaces_INCLUDE_DIR
diff --git a/Source/cmake/FindGStreamer-Pbutils.cmake b/Source/cmake/FindGStreamer-Pbutils.cmake
index 12080774d..a1246c8d3 100644
--- a/Source/cmake/FindGStreamer-Pbutils.cmake
+++ b/Source/cmake/FindGStreamer-Pbutils.cmake
@@ -11,7 +11,7 @@ include(LibFindMacros)
 libfind_package(GStreamer-Pbutils GStreamer)
 
 # Use pkg-config to get hints about paths
-libfind_pkg_check_modules(GStreamer-Pbutils_PKGCONF gstreamer-pbutils-0.10)
+libfind_pkg_check_modules(GStreamer-Pbutils_PKGCONF gstreamer-pbutils-0.10>=0.10.30)
 
 # Include dir
 find_path(GStreamer-Pbutils_INCLUDE_DIR
diff --git a/Source/cmake/FindGStreamer-Plugins-Base.cmake b/Source/cmake/FindGStreamer-Plugins-Base.cmake
index e4c77be94..ee41bb935 100644
--- a/Source/cmake/FindGStreamer-Plugins-Base.cmake
+++ b/Source/cmake/FindGStreamer-Plugins-Base.cmake
@@ -11,7 +11,7 @@ include(LibFindMacros)
 libfind_package(GStreamer-Plugins-Base GStreamer)
 
 # Use pkg-config to get hints about paths
-libfind_pkg_check_modules(GStreamer-Plugins-Base_PKGCONF gstreamer-plugins-base-0.10)
+libfind_pkg_check_modules(GStreamer-Plugins-Base_PKGCONF gstreamer-plugins-base-0.10>=0.10.30)
 
 # Include dir
 find_path(GStreamer-Plugins-Base_INCLUDE_DIR
diff --git a/Source/cmake/FindGStreamer-Video.cmake b/Source/cmake/FindGStreamer-Video.cmake
index b1228f62d..64748d26e 100644
--- a/Source/cmake/FindGStreamer-Video.cmake
+++ b/Source/cmake/FindGStreamer-Video.cmake
@@ -12,7 +12,7 @@ libfind_package(GStreamer-Video GStreamer)
 libfind_package(GStreamer-Video GStreamer-Base)
 
 # Use pkg-config to get hints about paths
-libfind_pkg_check_modules(GStreamer-Video_PKGCONF gstreamer-video-0.10)
+libfind_pkg_check_modules(GStreamer-Video_PKGCONF gstreamer-video-0.10>=0.10.30)
 
 # Include dir
 find_path(GStreamer-Video_INCLUDE_DIR
diff --git a/Source/cmake/FindGStreamer.cmake b/Source/cmake/FindGStreamer.cmake
index 7fe836497..dbfe45b27 100644
--- a/Source/cmake/FindGStreamer.cmake
+++ b/Source/cmake/FindGStreamer.cmake
@@ -8,7 +8,7 @@
 include(LibFindMacros)
 
 # Use pkg-config to get hints about paths
-libfind_pkg_check_modules(GStreamer_PKGCONF gstreamer-0.10)
+libfind_pkg_check_modules(GStreamer_PKGCONF gstreamer-0.10>=0.10.30)
 
 # Include dir
 find_path(GStreamer_INCLUDE_DIR
diff --git a/Source/cmake/FindQuickTimeSDK.cmake b/Source/cmake/FindQuickTimeSDK.cmake
new file mode 100644
index 000000000..1c701f500
--- /dev/null
+++ b/Source/cmake/FindQuickTimeSDK.cmake
@@ -0,0 +1,20 @@
+# - Find QuickTime SDK installation
+# Find the QuickTime includes and library
+# This module defines
+#  QuickTime_INCLUDE_DIRS, where to find QuickTime.h, etc.
+#  QuickTime_LIBRARIES, libraries to link against to use QuickTime.
+#  QuickTime_FOUND, If false, do not try to use QuickTime.
+
+FIND_PATH(QuickTimeSDK_INCLUDE_DIRS QuickTime.h PATHS
+    "$ENV{PROGRAMFILES}/QuickTime SDK/CIncludes"
+)
+
+SET(QuickTimeSDK_LIBRARY_PATH "${QuickTimeSDK_INCLUDE_DIRS}/../Libraries")
+FIND_LIBRARY(QuickTimeSDK_CVClient_LIBRARY CVClient ${QuickTimeSDK_LIBRARY_PATH} NO_DEFAULT_PATH)
+FIND_LIBRARY(QuickTimeSDK_QTMLClient_LIBRARY QTMLClient ${QuickTimeSDK_LIBRARY_PATH} NO_DEFAULT_PATH)
+SET(QuickTimeSDK_LIBRARIES ${QuickTimeSDK_CVClient_LIBRARY} ${QuickTimeSDK_QTMLClient_LIBRARY})
+
+# handle the QUIETLY and REQUIRED arguments and set QuickTimeSDK_FOUND to TRUE if all listed variables are TRUE
+INCLUDE(FindPackageHandleStandardArgs)
+FIND_PACKAGE_HANDLE_STANDARD_ARGS(QuickTimeSDK DEFAULT_MSG QuickTimeSDK_LIBRARIES QuickTimeSDK_INCLUDE_DIRS)
+MARK_AS_ADVANCED(QuickTimeSDK_INCLUDE_DIRS QuickTimeSDK_CVClient_LIBRARY QuickTimeSDK_QTMLClient_LIBRARY)
diff --git a/Source/cmake/OptionsEfl.cmake b/Source/cmake/OptionsEfl.cmake
index f7195df31..42d28b847 100644
--- a/Source/cmake/OptionsEfl.cmake
+++ b/Source/cmake/OptionsEfl.cmake
@@ -15,12 +15,6 @@ ADD_DEFINITIONS(-DWTF_PLATFORM_EFL=1)
 SET(WTF_PLATFORM_EFL 1)
 
 # -----------------------------------------------------------------------------
-# Determine which network backend will be used
-# -----------------------------------------------------------------------------
-SET(ALL_NETWORK_BACKENDS soup curl)
-SET(NETWORK_BACKEND "soup" CACHE STRING "choose which network backend to use (one of ${ALL_NETWORK_BACKENDS})")
-
-# -----------------------------------------------------------------------------
 # Determine which font backend will be used
 # -----------------------------------------------------------------------------
 SET(ALL_FONT_BACKENDS freetype pango)
@@ -37,6 +31,14 @@ FIND_PACKAGE(Threads REQUIRED)
 FIND_PACKAGE(JPEG REQUIRED)
 FIND_PACKAGE(PNG REQUIRED)
 
+FIND_PACKAGE(Glib REQUIRED)
+FIND_PACKAGE(Gthread REQUIRED)
+FIND_PACKAGE(LibSoup2 2.37.2.1 REQUIRED)
+SET(ENABLE_GLIB_SUPPORT ON)
+
+SET(WTF_USE_SOUP 1)
+ADD_DEFINITIONS(-DWTF_USE_SOUP=1)
+
 ADD_DEFINITIONS(-DENABLE_CONTEXT_MENUS=0)
 
 SET(WTF_USE_PTHREADS 1)
@@ -73,7 +75,6 @@ WEBKIT_FEATURE(ENABLE_FILTERS "Enable SVG filters" DEFAULT ON)
 WEBKIT_FEATURE(ENABLE_FTPDIR "Enable FTP directory support" DEFAULT ON)
 WEBKIT_FEATURE(ENABLE_FULLSCREEN_API "Enable Fullscreen API support" DEFAULT OFF)
 WEBKIT_FEATURE(ENABLE_GEOLOCATION "Enable geolocation" DEFAULT OFF)
-WEBKIT_FEATURE(ENABLE_GLIB_SUPPORT "Enable Glib support" DEFAULT ON)
 WEBKIT_FEATURE(ENABLE_ICONDATABASE "Enable icon database" DEFAULT ON)
 WEBKIT_FEATURE(ENABLE_INSPECTOR "Enable inspector" DEFAULT ON)
 WEBKIT_FEATURE(ENABLE_JAVASCRIPT_DEBUGGER "Enable JavaScript debugger" DEFAULT ON)
@@ -94,6 +95,7 @@ WEBKIT_FEATURE(ENABLE_SVG "Enable SVG" DEFAULT ON)
 WEBKIT_FEATURE(ENABLE_SVG_FONTS "Enable SVG fonts" DEFAULT ON)
 WEBKIT_FEATURE(ENABLE_TOUCH_EVENTS "Enable Touch Events" DEFAULT OFF)
 WEBKIT_FEATURE(ENABLE_TOUCH_ICON_LOADING "Enable Touch Icon Loading" DEFAULT OFF)
+WEBKIT_FEATURE(ENABLE_VIBRATION "Enable vibration" DEFAULT ON)
 WEBKIT_FEATURE(ENABLE_VIDEO "Enable video" DEFAULT ON)
 WEBKIT_FEATURE(ENABLE_WEB_SOCKETS "Enable web sockets" DEFAULT ON)
 WEBKIT_FEATURE(ENABLE_WEBGL "Enable WebGL" DEFAULT OFF)
@@ -110,21 +112,6 @@ IF (ENABLE_ECORE_X)
     ENDIF ()
 ENDIF ()
 
-IF (NETWORK_BACKEND STREQUAL "soup")
-  IF (NOT ENABLE_GLIB_SUPPORT)
-    SET(ENABLE_GLIB_SUPPORT 1)
-    MESSAGE("Forcing Glib support")
-  ENDIF ()
-  FIND_PACKAGE(LibSoup2 2.33.4 REQUIRED)
-  SET(WTF_USE_SOUP 1)
-  ADD_DEFINITIONS(-DWTF_USE_SOUP=1)
-ELSE ()
-  FIND_PACKAGE(CURL REQUIRED)
-  FIND_PACKAGE(ZLIB REQUIRED)
-  SET(WTF_USE_CURL 1)
-  ADD_DEFINITIONS(-DWTF_USE_CURL=1)
-ENDIF ()
-
 IF (FONT_BACKEND STREQUAL "freetype")
   FIND_PACKAGE(Freetype REQUIRED)
   FIND_PACKAGE(ZLIB REQUIRED)
@@ -134,11 +121,6 @@ ELSE ()
   FIND_PACKAGE(Pango REQUIRED)
   SET(WTF_USE_PANGO 1)
   ADD_DEFINITIONS(-DWTF_USE_PANGO=1)
-
-  IF (NOT ENABLE_GLIB_SUPPORT)
-    SET(ENABLE_GLIB_SUPPORT 1)
-    MESSAGE("Forcing Glib support")
-  ENDIF ()
 ENDIF ()
 
 IF (NOT ENABLE_SVG)
@@ -146,9 +128,6 @@ IF (NOT ENABLE_SVG)
 ENDIF ()
 
 IF (ENABLE_VIDEO)
-  SET(ENABLE_GLIB_SUPPORT 1)
-  MESSAGE("Forcing Glib support")
-
   FIND_PACKAGE(GStreamer REQUIRED)
   FIND_PACKAGE(GStreamer-App REQUIRED)
   FIND_PACKAGE(GStreamer-Base REQUIRED)
@@ -160,11 +139,6 @@ IF (ENABLE_VIDEO)
   ADD_DEFINITIONS(-DWTF_USE_GSTREAMER=1)
 ENDIF()
 
-IF (ENABLE_GLIB_SUPPORT)
-  FIND_PACKAGE(Glib REQUIRED)
-  FIND_PACKAGE(Gthread REQUIRED)
-ENDIF ()
-
 IF (ENABLE_WEBGL)
   FIND_PACKAGE(OpenGL REQUIRED)
 ENDIF ()
diff --git a/Source/cmake/OptionsWindows.cmake b/Source/cmake/OptionsWindows.cmake
index a8f02b3d4..8a710192d 100644
--- a/Source/cmake/OptionsWindows.cmake
+++ b/Source/cmake/OptionsWindows.cmake
@@ -1,5 +1,5 @@
-ADD_DEFINITIONS(-DWTF_PLATFORM_WINDOWS=1)
-SET(WTF_PLATFORM_WINDOWS 1)
+ADD_DEFINITIONS(-DWTF_PLATFORM_WIN=1)
+SET(WTF_PLATFORM_WIN 1)
 
 ADD_DEFINITIONS(-DUNICODE)
 
diff --git a/Source/cmake/WebKitEfl.cmake b/Source/cmake/WebKitEfl.cmake
deleted file mode 100644
index 06bd0605c..000000000
--- a/Source/cmake/WebKitEfl.cmake
+++ /dev/null
@@ -1,6 +0,0 @@
-# EFL port specific macros and definitions
-
-FIND_PROGRAM(EDJE_CC_EXECUTABLE edje_cc)
-IF (NOT EDJE_CC_EXECUTABLE)
-  MESSAGE(FATAL_ERROR "Missing edje_cc")
-ENDIF ()
diff --git a/Source/cmake/WebKitMacros.cmake b/Source/cmake/WebKitMacros.cmake
index e43a4a464..3abe342b7 100644
--- a/Source/cmake/WebKitMacros.cmake
+++ b/Source/cmake/WebKitMacros.cmake
@@ -141,6 +141,10 @@ MACRO(MAKE_HASH_TOOLS _source)
     UNSET(_hash_tools_h)
 ENDMACRO()
 
+MACRO (WEBKIT_INCLUDE_CONFIG_FILES_IF_EXISTS)
+    INCLUDE_IF_EXISTS(${CMAKE_CURRENT_SOURCE_DIR}/Platform${PORT}.cmake)
+ENDMACRO ()
+
 MACRO (WEBKIT_WRAP_SOURCELIST)
     FOREACH (_file ${ARGN})
         GET_FILENAME_COMPONENT(_basename ${_file} NAME_WE)
diff --git a/Source/cmakeconfig.h.cmake b/Source/cmakeconfig.h.cmake
index 6d3f83794..b632fcc30 100644
--- a/Source/cmakeconfig.h.cmake
+++ b/Source/cmakeconfig.h.cmake
@@ -39,6 +39,7 @@
 #cmakedefine01 ENABLE_SVG_FONTS
 #cmakedefine01 ENABLE_TOUCH_EVENTS
 #cmakedefine01 ENABLE_TOUCH_ICON_LOADING
+#cmakedefine01 ENABLE_VIBRATION
 #cmakedefine01 ENABLE_VIDEO
 #cmakedefine01 ENABLE_WEBGL
 #cmakedefine01 ENABLE_WEB_SOCKETS
diff --git a/Tools/BuildSlaveSupport/build.webkit.org-config/config.json b/Tools/BuildSlaveSupport/build.webkit.org-config/config.json
index 85fbfec95..6b63a061e 100644
--- a/Tools/BuildSlaveSupport/build.webkit.org-config/config.json
+++ b/Tools/BuildSlaveSupport/build.webkit.org-config/config.json
@@ -187,6 +187,11 @@
                       "slavenames": ["szeged-linux-2"]
                     },
                     {
+                      "name": "Qt Linux 64-bit Release (Perf)", "type": "BuildAndPerfTest", "builddir": "qt-linux-64-release-perf-tests",
+                      "platform": "qt", "configuration": "release", "architectures": ["x86_64"],
+                      "slavenames": ["szeged-linux-3"]
+                    },
+                    {
                       "name": "Qt Linux ARMv7 Release", "type": "Build", "builddir": "qt-linux-armv7-release",
                       "platform": "qt", "configuration": "release", "architectures": ["armv7"],
                       "slavenames": ["szeged-linux-4"]
@@ -280,7 +285,7 @@
 
     "schedulers": [ { "type": "AnyBranchScheduler", "name": "trunk", "change_filter": "trunk_filter", "treeStableTimer": 45.0,
                       "builderNames": ["GTK Linux 32-bit Release", "GTK Linux 64-bit Release", "GTK Linux 64-bit Debug",
-                                       "Qt Linux Release", "Qt Linux Release minimal", "Qt Linux ARMv7 Release",
+                                       "Qt Linux Release", "Qt Linux Release minimal", "Qt Linux 64-bit Release (Perf)", "Qt Linux ARMv7 Release",
                                        "Qt Windows 32-bit Release", "Qt Windows 32-bit Debug", "Qt SnowLeopard Release",
                                        "Qt Linux MIPS Release", "Qt Linux SH4 Release",
                                        "Chromium Win Release", "Chromium Win Release (Tests)", "Chromium Mac Release", "Chromium Mac Release (Tests)",
diff --git a/Tools/BuildSlaveSupport/build.webkit.org-config/master.cfg b/Tools/BuildSlaveSupport/build.webkit.org-config/master.cfg
index a1a01b285..05e1540c6 100644
--- a/Tools/BuildSlaveSupport/build.webkit.org-config/master.cfg
+++ b/Tools/BuildSlaveSupport/build.webkit.org-config/master.cfg
@@ -576,6 +576,10 @@ class RunQtAPITests(shell.Test):
                 ]
 
     def evaluateCommand(self, cmd):
+        if re.findall("Timeout, process", cmd.logs['stdio'].getText()):
+            self.statusLine = ["Failure: timeout occured during testing"]
+            return FAILURE
+
         if self.incorrectTests:
             return WARNINGS
 
diff --git a/Tools/BuildSlaveSupport/build.webkit.org-config/mastercfg_unittest.py b/Tools/BuildSlaveSupport/build.webkit.org-config/mastercfg_unittest.py
index 889046b50..c28ab2a13 100755
--- a/Tools/BuildSlaveSupport/build.webkit.org-config/mastercfg_unittest.py
+++ b/Tools/BuildSlaveSupport/build.webkit.org-config/mastercfg_unittest.py
@@ -28,7 +28,7 @@ class BuildBotConfigLoader(object):
 
     def _add_dependant_modules_to_sys_modules(self):
         from webkitpy.thirdparty.autoinstalled import buildbot
-        from webkitpy.thirdparty import simplejson
+        import json as simplejson
 
         sys.modules['buildbot'] = buildbot
         sys.modules['simplejson'] = simplejson
@@ -78,6 +78,108 @@ class StubRemoteCommand(object):
         self.logs = {'stdio': StubStdio(stdio)}
 
 
+class RunQtAPITestsTest(unittest.TestCase):
+    def assertResults(self, expected_result, expected_text, stdio):
+        rc = 0
+        cmd = StubRemoteCommand(rc, stdio)
+        step = RunQtAPITests()
+        step.commandComplete(cmd)
+        actual_results = step.evaluateCommand(cmd)
+        actual_text = str(step.getText2(cmd, actual_results)[0])
+
+        self.assertEqual(expected_result, actual_results)
+        self.assertEqual(actual_text, expected_text)
+
+    def test_timeout(self):
+        self.assertResults(FAILURE, "API tests", """INFO:Exec:Running... WebKitBuild/Release/Source/WebKit2/UIProcess/API/qt/tests/qquickwebview/tst_qquickwebview
+INFO:Exec:Running... WebKitBuild/Release/Source/WebKit2/UIProcess/API/qt/tests/qmltests/tst_qmltests
+Qml debugging is enabled. Only use this in a safe environment!
+INFO:Exec:Finished WebKitBuild/Release/Source/WebKit2/UIProcess/API/qt/tests/qquickwebview/tst_qquickwebview
+ERROR:Exec:Timeout, process 'WebKitBuild/Release/Source/WebKit2/UIProcess/API/qt/tests/qmltests/tst_qmltests' (2336) was terminated
+INFO:Exec:Finished WebKitBuild/Release/Source/WebKit2/UIProcess/API/qt/tests/qmltests/tst_qmltests
+********* Start testing of tst_QQuickWebView *********
+Config: Using QTest library 5.0.0, Qt 5.0.0
+PASS   : tst_QQuickWebView::initTestCase()
+QWARN  : tst_QQuickWebView::accessPage() QQuickCanvas: platform does not support threaded rendering!
+.
+.
+.
+
+**********************************************************************
+**              TOTALS: 16 passed, 0 failed, 0 skipped              **
+**********************************************************************""")
+
+    def test_success(self):
+        self.assertResults(SUCCESS, "API tests", """INFO:Exec:Running... WebKitBuild/Release/Source/WebKit2/UIProcess/API/qt/tests/qquickwebview/tst_qquickwebview
+INFO:Exec:Running... WebKitBuild/Release/Source/WebKit2/UIProcess/API/qt/tests/qmltests/tst_qmltests
+Qml debugging is enabled. Only use this in a safe environment!
+INFO:Exec:Finished WebKitBuild/Release/Source/WebKit2/UIProcess/API/qt/tests/qquickwebview/tst_qquickwebview
+********* Start testing of tst_QQuickWebView *********
+Config: Using QTest library 5.0.0, Qt 5.0.0
+PASS   : tst_QQuickWebView::initTestCase()
+QWARN  : tst_QQuickWebView::accessPage() QQuickCanvas: platform does not support threaded rendering!
+.
+.
+.
+
+**********************************************************************
+**              TOTALS: 16 passed, 0 failed, 0 skipped              **
+**********************************************************************""")
+
+    def test_failure(self):
+        self.assertResults(WARNINGS, "16 passed, 1 failed, 0 skipped", """********* Start testing of tst_QDeclarativeWebView *********
+PASS   : tst_QDeclarativeWebView::pressGrabTime()
+PASS   : tst_QDeclarativeWebView::renderingEnabled()
+PASS   : tst_QDeclarativeWebView::setHtml()
+PASS   : tst_QDeclarativeWebView::settings()
+FAIL!  : tst_QDeclarativeWebView::backgroundColor() Compared values are not the same
+   Loc: [/ramdisk/qt-linux-release/build/Source/WebKit/qt/tests/qdeclarativewebview/tst_qdeclarativewebview.cpp(532)]
+PASS   : tst_QDeclarativeWebView::cleanupTestCase()
+.
+.
+.
+
+**********************************************************************
+**              TOTALS: 16 passed, 1 failed, 0 skipped              **
+**********************************************************************""")
+
+    def test_timeout_and_failure(self):
+        self.assertResults(FAILURE, "Failure: timeout occured during testing", """INFO:Exec:Finished WebKitBuild/Release/Source/WebKit/qt/tests/benchmarks/painting/tst_painting
+ERROR:Exec:Timeout, process 'WebKitBuild/Release/Source/WebKit/qt/tests/qwebpage/tst_qwebpage' (13000) was terminated
+INFO:Exec:Finished WebKitBuild/Release/Source/WebKit/qt/tests/qwebpage/tst_qwebpage
+********* Start testing of tst_Loading *********
+Config: Using QTest library 4.8.0, Qt 4.8.0
+PASS   : tst_Loading::initTestCase()
+QDEBUG : tst_Loading::load(amazon) loaded the Generic plugin
+RESULT : tst_Loading::load():"amazon":
+     1,843 msecs per iteration (total: 1,843, iterations: 1)
+RESULT : tst_Loading::load():"kde":
+     139 msecs per iteration (total: 139, iterations: 1)
+RESULT : tst_Loading::load():"apple":
+     740 msecs per iteration (total: 740, iterations: 1)
+PASS   : tst_Loading::load()
+PASS   : tst_Loading::cleanupTestCase()
+Totals: 3 passed, 0 failed, 0 skipped
+********* Finished testing of tst_Loading *********
+.
+.
+.
+PASS   : tst_QDeclarativeWebView::renderingEnabled()
+PASS   : tst_QDeclarativeWebView::setHtml()
+PASS   : tst_QDeclarativeWebView::settings()
+FAIL!  : tst_QDeclarativeWebView::backgroundColor() Compared values are not the same
+   Loc: [/ramdisk/qt-linux-release/build/Source/WebKit/qt/tests/qdeclarativewebview/tst_qdeclarativewebview.cpp(532)]
+PASS   : tst_QDeclarativeWebView::cleanupTestCase()
+Totals: 16 passed, 3 failed, 1 skipped
+.
+.
+.
+**********************************************************************
+**              TOTALS: 73 passed, 3 failed, 1 skipped              **
+**********************************************************************""")
+
+
+
 class RunUnitTestsTest(unittest.TestCase):
     def assertFailures(self, expected_failure_count, stdio):
         if expected_failure_count:
diff --git a/Tools/BuildSlaveSupport/build.webkit.org-config/public_html/TestFailures/scripts/config.js b/Tools/BuildSlaveSupport/build.webkit.org-config/public_html/TestFailures/scripts/config.js
index bcb33801d..4903562f7 100644
--- a/Tools/BuildSlaveSupport/build.webkit.org-config/public_html/TestFailures/scripts/config.js
+++ b/Tools/BuildSlaveSupport/build.webkit.org-config/public_html/TestFailures/scripts/config.js
@@ -35,8 +35,7 @@ config.kBuilders = {
     'Webkit Win (dbg)(2)': {version: 'xp', debug: true},
     'Webkit Linux': {version: 'lucid', is64bit: true},
     'Webkit Linux 32': {version: 'lucid'},
-    'Webkit Linux (dbg)(1)': {version: 'lucid', is64bit: true, debug: true},
-    'Webkit Linux (dbg)(2)': {version: 'lucid', is64bit: true, debug: true},
+    'Webkit Linux (dbg)': {version: 'lucid', is64bit: true, debug: true},
     'Webkit Mac10.5': {version: 'leopard'},
     'Webkit Mac10.5 (dbg)(1)': {version: 'leopard', debug: true},
     'Webkit Mac10.5 (dbg)(2)': {version: 'leopard', debug: true},
@@ -51,7 +50,6 @@ config.kBuildersThatOnlyCompile = [
     'Webkit Mac Builder',
     'Webkit Mac Builder (dbg)',
     'Win Builder',
-    'Mac Clang Builder (dbg)',
 ];
 
 config.kTracURL = 'http://trac.webkit.org';
diff --git a/Tools/BuildSlaveSupport/build.webkit.org-config/public_html/TestFailures/scripts/ui.js b/Tools/BuildSlaveSupport/build.webkit.org-config/public_html/TestFailures/scripts/ui.js
index e6e4fe5ca..5793e4264 100644
--- a/Tools/BuildSlaveSupport/build.webkit.org-config/public_html/TestFailures/scripts/ui.js
+++ b/Tools/BuildSlaveSupport/build.webkit.org-config/public_html/TestFailures/scripts/ui.js
@@ -64,6 +64,7 @@ ui.onebar = base.extends('div', {
         this.innerHTML =
             '<ul>' +
                 '<li><a href="#unexpected">Unexpected Failures</a></li>' +
+                '<li><a href="#failures">All Failures</a></li>' +
                 '<li><a href="#results">Results</a></li>' +
             '</ul>' +
             '<div id="unexpected"></div>' +
@@ -71,15 +72,12 @@ ui.onebar = base.extends('div', {
             '<div id="results"></div>';
         this._tabNames = [
             'unexpected',
+            'failures',
             'results',
         ]
         this._tabs = $(this).tabs({
-            disabled: [1],
+            disabled: [2],
         });
-        if (config.kExperimentalFeatures) {
-            this._tabs.tabs('add', '#failures', 'All Failures (experimental)');
-            this._tabNames.push('failures');
-        }
     },
     attach: function()
     {
diff --git a/Tools/ChangeLog b/Tools/ChangeLog
index a4fb2d060..7ced9e75a 100644
--- a/Tools/ChangeLog
+++ b/Tools/ChangeLog
@@ -1,3 +1,2492 @@
+2012-02-24  Balazs Kelemen  <kbalazs@webkit.org>
+
+        [Qt] Add Qt5 way to force 96 DPI for tests
+        https://bugs.webkit.org/show_bug.cgi?id=79364
+
+        Reviewed by Simon Hausmann.
+
+        * DumpRenderTree/qt/main.cpp:
+        (main):
+        * WebKitTestRunner/InjectedBundle/qt/ActivateFontsQt.cpp:
+        (WTR::activateFonts):
+
+2012-02-24  Carlos Garcia Campos  <cgarcia@igalia.com>
+
+        [GTK] MiniBrowser should reload the view then the reload button is clicked
+        https://bugs.webkit.org/show_bug.cgi?id=79472
+
+        Reviewed by Philippe Normand.
+
+        * MiniBrowser/gtk/BrowserWindow.c:
+        (reloadCallback): Call webkit_web_view_reload().
+        (browser_window_init): Connect reload item clicked even to
+        reloadCallback instead of activateUriEntryCallback.
+
+2012-02-24  Kentaro Hara  <haraken@chromium.org>
+
+        Add performance tests for DOM attribute getters and setters
+        https://bugs.webkit.org/show_bug.cgi?id=79208
+
+        Reviewed by Ryosuke Niwa.
+
+        We want to allow perf tests to output info messages
+        that do not affect the test results. To accomplish this,
+        this patch modifies perftestsrunner.py so that it ignores
+        a line that starts from "Info:".
+
+        * Scripts/webkitpy/performance_tests/perftestsrunner.py:
+        (PerfTestsRunner):
+
+2012-02-24  Andrew Lo  <anlo@rim.com>
+
+        [BlackBerry] Enable requestAnimationFrame
+        https://bugs.webkit.org/show_bug.cgi?id=79408
+
+        Enable requestAnimationFrame for BlackBerry.
+
+        Reviewed by Rob Buis.
+
+        * Scripts/build-webkit:
+
+2012-02-24  Adam Barth  <abarth@webkit.org>
+
+        style-queue tries to apply the patch twice
+        https://bugs.webkit.org/show_bug.cgi?id=79459
+
+        Reviewed by Eric Seidel.
+
+        Previously, we applied the patch using both apply-patch and
+        check-style.  This patch introduces a check-style-local to mirror the
+        apply-watchlist-local, which operates on the current working diff.
+
+        This patch also cleans up some other bugs I found by running the queue
+        locally for a while.  The queue still prints out a slightly
+        less-than-ideal message on the bugs when it find an error, but it's ok
+        for now.  We'll need to iterate a bit.
+
+        * Scripts/webkitpy/tool/bot/stylequeuetask.py:
+        (StyleQueueTask.validate):
+        (StyleQueueTask._check_style):
+        * Scripts/webkitpy/tool/commands/download.py:
+        (CheckStyleLocal):
+        * Scripts/webkitpy/tool/commands/earlywarningsystem_unittest.py:
+        (EarlyWarningSytemTest._default_expected_stderr):
+        (EarlyWarningSytemTest._test_testing_ews):
+        * Scripts/webkitpy/tool/commands/queues.py:
+        (AbstractReviewQueue.handle_script_error):
+        (StyleQueue.review_patch):
+        * Scripts/webkitpy/tool/commands/queues_unittest.py:
+        * Scripts/webkitpy/tool/commands/queuestest.py:
+        (QueuesTest.assert_queue_outputs):
+
+2012-02-23  Adam Barth  <abarth@webkit.org>
+
+        should_proceed_with_work_item is unused and can be removed
+        https://bugs.webkit.org/show_bug.cgi?id=79416
+
+        Reviewed by Eric Seidel.
+
+        We used to use this function to check whether the tree is red.  Now, we
+        don't use external measures of whether to proceed with work items.
+        Instead, we analyze them with the idea in mind that the tree might be
+        red.
+
+        * Scripts/webkitpy/tool/bot/queueengine.py:
+        (QueueEngineDelegate.next_work_item):
+        (QueueEngine.run):
+        * Scripts/webkitpy/tool/bot/queueengine_unittest.py:
+        (LoggingDelegate):
+        (LoggingDelegate.next_work_item):
+        (RaisingDelegate.process_work_item):
+        (QueueEngineTest.test_terminating_error):
+        * Scripts/webkitpy/tool/commands/earlywarningsystem.py:
+        (AbstractEarlyWarningSystem.__init__):
+        * Scripts/webkitpy/tool/commands/queues.py:
+        (AbstractQueue.next_work_item):
+        (FeederQueue.next_work_item):
+        (CommitQueue.next_work_item):
+        (AbstractReviewQueue.next_work_item):
+        (StyleQueue.__init__):
+        * Scripts/webkitpy/tool/commands/queues_unittest.py:
+        (FeederQueueTest.test_feeder_queue):
+        (CommitQueueTest.test_commit_queue):
+        (test_commit_queue_failure):
+        (test_commit_queue_failure_with_failing_tests):
+        (test_rollout):
+        (test_rollout_lands):
+        (StyleQueueTest.test_style_queue_with_style_exception):
+        (test_style_queue_with_watch_list_exception):
+        * Scripts/webkitpy/tool/commands/queuestest.py:
+        (QueuesTest.assert_queue_outputs):
+        * Scripts/webkitpy/tool/commands/sheriffbot.py:
+        (SheriffBot.next_work_item):
+
+2012-02-23  Adrienne Walker  <enne@google.com>
+
+        Unreviewed, add Stephen Chenney to committers.py as a contributor.
+
+        * Scripts/webkitpy/common/config/committers.py:
+
+2012-02-23  Adam Barth  <abarth@webkit.org>
+
+        style-queue logs bogus messages to the QueueStatusServer
+        https://bugs.webkit.org/show_bug.cgi?id=79424
+
+        Reviewed by Eric Seidel.
+
+        Copy/paste error.
+
+        * Scripts/webkitpy/tool/bot/stylequeuetask.py:
+        (StyleQueueTask._check_style):
+        (StyleQueueTask._apply_watch_list):
+        * Scripts/webkitpy/tool/commands/queues_unittest.py:
+
+2012-02-23  Eric Seidel  <eric@webkit.org>
+
+        Use self._filesystem in more places in the SCM classes
+        https://bugs.webkit.org/show_bug.cgi?id=79415
+
+        Reviewed by Adam Barth.
+
+        * Scripts/webkitpy/common/checkout/scm/detection_unittest.py:
+        (SCMDetectorTest.test_detect_scm_system):
+        * Scripts/webkitpy/common/checkout/scm/git.py:
+        (Git.find_checkout_root):
+        (Git.to_object_name):
+        * Scripts/webkitpy/common/checkout/scm/scm.py:
+        (SCM.__init__):
+        (SCM.in_working_directory):
+        * Scripts/webkitpy/common/checkout/scm/svn.py:
+        (SVN.find_uuid):
+        (SVN.find_checkout_root):
+
+2012-02-23  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r108685.
+        http://trac.webkit.org/changeset/108685
+        https://bugs.webkit.org/show_bug.cgi?id=79414
+
+        Broke Chromium builds (Requested by enne on #webkit).
+
+        * qmake/mkspecs/features/features.prf:
+
+2012-02-23  Adam Barth  <abarth@webkit.org>
+
+        style-queue shouldn't spam bugs if it fails to update its working copy
+        https://bugs.webkit.org/show_bug.cgi?id=79412
+
+        Reviewed by Eric Seidel.
+
+        This patch moves style-queue over to the new PatchAnalysisTask
+        infrastructure, which is smarter about retrying patches when update
+        fails.
+
+        * Scripts/webkitpy/common/system/executive_mock.py:
+        (MockExecutive.run_and_throw_if_fail):
+        * Scripts/webkitpy/tool/bot/earlywarningsystemtask.py:
+        * Scripts/webkitpy/tool/bot/patchanalysistask.py:
+        (UnableToApplyPatch):
+        (UnableToApplyPatch.__init__):
+        (PatchAnalysisTask.__init__):
+        * Scripts/webkitpy/tool/bot/stylequeuetask.py: Added.
+        (StyleQueueTaskDelegate):
+        (StyleQueueTaskDelegate.parent_command):
+        (StyleQueueTask):
+        (StyleQueueTask.validate):
+        (StyleQueueTask._check_style):
+        (StyleQueueTask._apply_watch_list):
+        (StyleQueueTask.run):
+        * Scripts/webkitpy/tool/commands/earlywarningsystem.py:
+        * Scripts/webkitpy/tool/commands/queues.py:
+        (StyleQueue):
+        (StyleQueue.should_proceed_with_work_item):
+        (StyleQueue.review_patch):
+        (StyleQueue.run_command):
+        (StyleQueue.command_passed):
+        (StyleQueue.command_failed):
+        (StyleQueue.expected_failures):
+        (StyleQueue.refetch_patch):
+        * Scripts/webkitpy/tool/commands/queues_unittest.py:
+        (StyleQueueTest.test_style_queue_with_style_exception):
+        (test_style_queue_with_watch_list_exception):
+
+2012-02-23  Zoltan Horvath  <zoltan@webkit.org>
+
+        [Qt] Allow to use WebCore imagedecoders
+        https://bugs.webkit.org/show_bug.cgi?id=32410
+
+        Add ENABLE_QT_IMAGE_DECODER macro, it's enabled by default.
+
+        Reviewed by Simon Hausmann.
+
+        * qmake/mkspecs/features/features.prf:
+
+2012-02-23  Eric Seidel  <eric@webkit.org>
+
+        Remove old broken find_checkout_root tests now that find_checkout_root is gone
+        https://bugs.webkit.org/show_bug.cgi?id=79405
+
+        Reviewed by Adam Barth.
+
+        * Scripts/webkitpy/common/checkout/scm/detection_unittest.py: Added.
+        (SCMDetectorTest):
+        (SCMDetectorTest.test_find_checkout_root):
+        * Scripts/webkitpy/common/checkout/scm/scm_unittest.py:
+        (SVNTestRepository.tear_down):
+
+2012-02-23  Michael Brüning  <michael.bruning@nokia.com>
+
+        [Qt][WK2] Implement proxy authentication dialog.
+        https://bugs.webkit.org/show_bug.cgi?id=79350
+
+        Reviewed by Simon Hausmann.
+
+        * MiniBrowser/qt/MiniBrowser.qrc:
+        * MiniBrowser/qt/qml/BrowserWindow.qml:
+        * MiniBrowser/qt/qml/ProxyAuthenticationDialog.qml: Added.
+
+2012-02-23  Kevin Ollivier  <kevino@theolliviers.com>
+
+        [wx] Build fix, add recently added source dirs.
+
+        * waf/build/settings.py:
+
+2012-02-23  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        [Qt] Add support for touch cancellation
+        https://bugs.webkit.org/show_bug.cgi?id=79348
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Added straight-forward touch cancellation event sending to Qt WK1 DRT
+        and WK2 WTR.
+
+        * DumpRenderTree/qt/EventSenderQt.cpp:
+        (EventSender::touchCancel):
+        (EventSender::cancelTouchPoint):
+        * DumpRenderTree/qt/EventSenderQt.h:
+        (EventSender):
+        * WebKitTestRunner/EventSenderProxy.h:
+        (EventSenderProxy):
+        * WebKitTestRunner/InjectedBundle/Bindings/EventSendingController.idl:
+        * WebKitTestRunner/InjectedBundle/EventSendingController.cpp:
+        (WTR::EventSendingController::touchCancel):
+        (WTR):
+        (WTR::EventSendingController::cancelTouchPoint):
+        * WebKitTestRunner/InjectedBundle/EventSendingController.h:
+        (EventSendingController):
+        * WebKitTestRunner/TestController.cpp:
+        (WTR::TestController::didReceiveSynchronousMessageFromInjectedBundle):
+        * WebKitTestRunner/qt/EventSenderProxyQt.cpp:
+        (WTR::EventSenderProxy::touchCancel):
+        (WTR):
+        (WTR::EventSenderProxy::cancelTouchPoint):
+
+2012-02-23  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r108626.
+        http://trac.webkit.org/changeset/108626
+        https://bugs.webkit.org/show_bug.cgi?id=79370
+
+        broke qt-wk2 bot, somehow the workaround does not work on the
+        bot (Requested by Ossy on #webkit).
+
+        * WebKitTestRunner/qt/PlatformWebViewQt.cpp:
+        (WTR::WrapperWindow::handleStatusChanged):
+        (WTR::PlatformWebView::resizeTo):
+
+2012-02-23  ChangSeok Oh  <shivamidow@gmail.com>
+
+        [GTK] DRT doesn't support scheduleAsynchronousKeyDown.
+        https://bugs.webkit.org/show_bug.cgi?id=78481
+
+        Reviewed by Gustavo Noronha Silva.
+
+        Extracted shareable code from keyDownCallback and then added createKeyPressEvent
+        to create gdk press key event.
+        Added sendKeyDown and sendAsynchronousKeyDown to evaluate keyDown event directly
+        and asynchronously. Eventually, sendAsynchronousKeyDown calls sendKeyDown.
+
+        * DumpRenderTree/gtk/EventSender.cpp:
+        (scheduleAsynchronousClickCallback):
+        (createKeyPressEvent):
+        (sendKeyDown):
+        (keyDownCallback):
+        (sendAsynchronousKeyDown):
+        (scheduleAsynchronousKeyDownCallback):
+
+2012-02-23  Balazs Kelemen  <kbalazs@webkit.org>
+
+        [Qt][WK2] WebKitTestRunner should use 480x360 sized view for W3C SVG tests
+        https://bugs.webkit.org/show_bug.cgi?id=76546
+
+        Reviewed by Simon Hausmann.
+
+        Co-authored with Simon Hausmann.
+
+        Revert the workaround introduced in r107868 and reintroduce
+        the qml binding so we can test the code path that we are more
+        interested in. The reason that it did not work before is that
+        we don't have an active platform window which we now workaround
+        by propagating the resize through QWindowSystemInterface.
+
+        * WebKitTestRunner/qt/PlatformWebViewQt.cpp:
+        (WTR::WrapperWindow::handleStatusChanged):
+        (WTR::PlatformWebView::resizeTo):
+
+2012-02-23  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r108577.
+        http://trac.webkit.org/changeset/108577
+        https://bugs.webkit.org/show_bug.cgi?id=79359
+
+        It doesn't work as expected (Requested by Ossy on #webkit).
+
+        * DumpRenderTree/qt/EventSenderQt.cpp:
+        (EventSender::postEvent):
+        * DumpRenderTree/qt/EventSenderQt.h:
+        (EventSender):
+
+2012-02-23  Philippe Normand  <pnormand@igalia.com>
+
+        [GTK] FullScreen signals
+        https://bugs.webkit.org/show_bug.cgi?id=76181
+
+        Reviewed by Martin Robinson.
+
+        Use the two new entering/leaving fullscreen signals to hide/show
+        the tool bar, the status bar and ask the user's permission before
+        entering fullscreen.
+
+        * GtkLauncher/main.c:
+        (webViewFullscreenMessageWindowClose):
+        (webViewWindowStateEvent):
+        (hide_widget):
+        (show_widget):
+        (webViewEnteringFullScreen):
+        (webViewLeavingFullScreen):
+        (createBrowser):
+        (createWindow):
+
+2012-02-22  Dongwoo Im  <dw.im@samsung.com>
+
+        [EFL] Fix to launch the EWebLauncher using the script, run-launcher.
+        https://bugs.webkit.org/show_bug.cgi?id=79076
+
+        Reviewed by Andreas Kling.
+
+        * Scripts/webkitdirs.pm: Fix the path of libewebkit.so.
+        (builtDylibPathForName):
+
+2012-02-22  Allan Sandfeld Jensen  <allan.jensen@nokia.com>
+
+        [Qt] Add eventSender.gestureTap
+        https://bugs.webkit.org/show_bug.cgi?id=66173
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        * DumpRenderTree/qt/EventSenderQt.cpp:
+        (EventSender::gestureTap):
+        * DumpRenderTree/qt/EventSenderQt.h:
+
+2012-02-22  Brady Eidson  <beidson@apple.com>
+
+        <rdar://problem/10406044> and https://bugs.webkit.org/show_bug.cgi?id=79279
+        Synchronous ShouldGoToBackForwardListItem causes lots of WebProcess hangs
+
+        Reviewed by Anders Carlsson.
+
+        Update our tools to the new form of the PageLoadClient.
+
+        * MiniBrowser/mac/BrowserWindowController.m:
+        (-[BrowserWindowController awakeFromNib]): 
+
+        * WebKitTestRunner/TestController.cpp:
+        (WTR::TestController::initialize):
+
+2012-02-22  Daniel Bates  <dbates@webkit.org>
+
+        new-run-webkit-tests shouldn't restore Safari state on Lion when showing results
+        https://bugs.webkit.org/show_bug.cgi?id=79277
+
+        Reviewed by Adam Barth.
+
+        Pass command line argument no-saved-state to run-safari to disable Safari
+        state restoration for the session on OS 10.7.
+
+        * Scripts/webkitpy/layout_tests/port/mac.py:
+        (MacPort.show_results_html_file):
+        * Scripts/webkitpy/layout_tests/port/mac_unittest.py:
+        (test_show_results_html_file):
+
+2012-02-22  Kalev Lember  <kalevlember@gmail.com>
+
+        Explicitly include unistd.h in TestNetscapePlugIn for GCC 4.7
+        https://bugs.webkit.org/show_bug.cgi?id=77759
+
+        Reviewed by Tony Chang.
+
+        Fixes build with gcc 4.7.
+
+        r100432 added the include only for ANDROID; this changes the ifdef to
+        also cover other unix platforms. On Fedora 17 the gcc 4.7 compiler no
+        longer implicitly includes unistd.h from standard headers and other
+        unix platforms are likely to get gcc 4.7 as well in the future.
+
+        * DumpRenderTree/TestNetscapePlugIn/PluginTest.cpp:
+
+2012-02-22  Philippe Normand  <pnormand@igalia.com>
+
+        Unreviewed, rolling out r108522.
+        http://trac.webkit.org/changeset/108522
+        https://bugs.webkit.org/show_bug.cgi?id=76181
+
+        Broke 4 fullscreen tests on GTK.
+
+        * GtkLauncher/main.c:
+        (createBrowser):
+        (createWindow):
+
+2012-02-20  Philippe Normand  <pnormand@igalia.com>
+
+        [GTK] FullScreen signals
+        https://bugs.webkit.org/show_bug.cgi?id=76181
+
+        Reviewed by Martin Robinson.
+
+        Use the two new entering/leaving fullscreen signals to hide/show
+        the tool bar, the status bar and ask the user's permission before
+        entering fullscreen.
+
+        * GtkLauncher/main.c:
+        (webViewFullscreenMessageWindowClose):
+        (webViewWindowStateEvent):
+        (hide_widget):
+        (show_widget):
+        (webViewEnteringFullScreen):
+        (webViewLeavingFullScreen):
+        (createBrowser):
+        (createWindow):
+
+2012-02-22  Rob Flack  <flackr@chromium.org>
+
+        Update Linux ChromiumOS builders in flakiness dashboard.
+        https://bugs.webkit.org/show_bug.cgi?id=79238
+
+        Reviewed by Ojan Vafai.
+
+        * TestResultServer/static-dashboards/builders.js:
+
+2012-02-22  Dirk Pranke  <dpranke@chromium.org>
+
+        webkitpy: test_function_length_check_definition_huge_lines is slow
+        https://bugs.webkit.org/show_bug.cgi?id=79185
+
+        Reviewed by Adam Barth.
+
+        This test takes ~3 seconds to run, apparently because we're
+        running a test on a 10,000 line function :). Dropping the
+        function length to 640 still exercises the code path and
+        provides a 10x speedup.
+
+        * Scripts/webkitpy/style/checkers/cpp_unittest.py:
+        (CppStyleTest):
+        (CheckForFunctionLengthsTest.test_function_length_check_definition_huge_lines):
+
+2012-02-22  Dirk Pranke  <dpranke@chromium.org>
+
+        webkitpy: speed up FileLockTest.test_lock_lifecycle
+        https://bugs.webkit.org/show_bug.cgi?id=79189
+
+        Reviewed by Adam Barth.
+
+        The unit test had a second lock trying to acquire a
+        lock already held, and a hard-coded timeout of one second.
+        I have changed the timeouts to a tenth of a second (which
+        is probably still fine) and changed the hard-spin on
+        the lock to a slow-spin every hundredth of a second.
+
+        * Scripts/webkitpy/common/system/file_lock.py:
+        (FileLock.acquire_lock):
+        * Scripts/webkitpy/common/system/file_lock_integrationtest.py:
+        (FileLockTest.setUp):
+        (FileLockTest.test_stuck_lock):
+
+2012-02-22  Gabor Rapcsanyi  <rgabor@webkit.org>
+
+        build-webkit should use environment variable at number of CPU
+        detection on all platform
+        https://bugs.webkit.org/show_bug.cgi?id=79227
+
+        Reviewed by Martin Robinson.
+
+        * Scripts/webkitdirs.pm:
+        (determineNumberOfCPUs):
+
+2012-02-22  Mihnea Ovidenie  <mihnea@adobe.com>
+
+        [Qt] REGRESSION(r108108): It made 3 fast/repaint tests fail
+        https://bugs.webkit.org/show_bug.cgi?id=78960
+
+        Reviewed by Csaba Osztrogonác.
+
+        * DumpRenderTree/qt/LayoutTestControllerQt.cpp:
+        (LayoutTestController::overridePreference):
+
+2012-02-22  Hao Zheng  <zhenghao@chromium.org>
+
+        [chromium] Build WebKit with MEDIA_STREAM disabled.
+        https://bugs.webkit.org/show_bug.cgi?id=79214
+
+        Reviewed by Kent Tamura.
+
+        * DumpRenderTree/chromium/WebUserMediaClientMock.cpp:
+        * DumpRenderTree/chromium/WebUserMediaClientMock.h:
+        * DumpRenderTree/chromium/WebViewHost.cpp:
+        (WebViewHost::createMediaPlayer):
+        * DumpRenderTree/chromium/WebViewHost.h:
+        (WebViewHost):
+
+2012-02-22  Zeno Albisser  <zeno@webkit.org>
+
+        [Qt][WK2][Mac] WebKitTestRunner does not build with clang.
+        https://bugs.webkit.org/show_bug.cgi?id=79124
+
+        WebKitTestRunnerPrefix.h should also be included
+        when building with clang.
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        * WebKitTestRunner/Target.pri:
+
+2012-02-20  Roland Steiner  <rolandsteiner@chromium.org>
+
+        <style scoped>: Add runtime-flag
+        https://bugs.webkit.org/show_bug.cgi?id=79074
+
+        Enable the runtime-flag for DRT. 
+
+        Reviewed by Dimitri Glazkov.
+
+        * DumpRenderTree/chromium/TestShell.cpp:
+        (TestShell::TestShell):
+
+2012-02-22  Carlos Garcia Campos  <cgarcia@igalia.com>
+
+        Unreviewed, rolling out r107351.
+        http://trac.webkit.org/changeset/107351
+        https://bugs.webkit.org/show_bug.cgi?id=53600
+
+        Several issues introduced in WebKitGTK+ API
+
+        * DumpRenderTree/gtk/DumpRenderTree.cpp:
+        (createWebView):
+        * GtkLauncher/main.c:
+        (createWebViewCb):
+        (createBrowser):
+        (createWindow):
+        (main):
+
+2012-02-21  Filip Pizlo  <fpizlo@apple.com>
+
+        JSC should be a triple-tier VM
+        https://bugs.webkit.org/show_bug.cgi?id=75812
+        <rdar://problem/10079694>
+
+        Reviewed by Gavin Barraclough.
+
+        Changed EFL's build system to include a new directory in JavaScriptCore.
+
+        * DumpRenderTree/efl/CMakeLists.txt:
+
+2012-02-21  Daniel Cheng  <dcheng@chromium.org>
+
+        [chromium] Fix image drag out on Chromium
+        https://bugs.webkit.org/show_bug.cgi?id=79158
+
+        Reviewed by Tony Chang.
+
+        * DumpRenderTree/chromium/EventSender.cpp:
+        (EventSender::dumpFilenameBeingDragged):
+        (EventSender::beginDragWithFiles):
+        * DumpRenderTree/chromium/WebViewHost.cpp:
+        (addDRTFakeFileToDataObject):
+
+2012-02-21  Dirk Pranke  <dpranke@chromium.org>
+
+        webkitpy: speed up hot filesystem_mock functions
+        https://bugs.webkit.org/show_bug.cgi?id=79159
+
+        Reviewed by Adam Barth.
+
+        Profiling run_webkit_tests_integrationtest.py revealed that
+        isdir(), normpath(), and join() are called a lot and were very
+        slow.This patch speeds them up substantially, shaving 20 seconds
+        off of the execution time.
+
+        * Scripts/webkitpy/common/system/filesystem_mock.py:
+        (MockFileSystem.isdir):
+        (MockFileSystem._slow_but_correct_join):
+        (MockFileSystem.join):
+        (MockFileSystem.listdir):
+        (MockFileSystem._slow_but_correct_normpath):
+        (MockFileSystem.normpath):
+        (MockFileSystem.write_binary_file):
+        * Scripts/webkitpy/common/system/filesystem_mock_unittest.py:
+        (MockFileSystemTest.quick_check):
+        (MockFileSystemTest):
+        (MockFileSystemTest.test_join):
+        (MockFileSystemTest.test_normpath):
+        * Scripts/webkitpy/tool/servers/rebaselineserver_unittest.py:
+        (get_test_config): Call write_binary_file() instead of updating
+          filesystem.files directly, so that we create directories as
+          needed.
+
+2012-02-21  Dirk Pranke  <dpranke@chromium.org>
+
+        nrwt: make the delay between starting workers configurable per-port
+        https://bugs.webkit.org/show_bug.cgi?id=79148
+
+        Reviewed by Eric Seidel.
+
+        Because of bug 79147, we have to sleep a bit in between starting
+        DRTs; however, doing so across the board slows down the Test
+        port. Making this configurable shaves 10 seconds off of
+        run_webkit_tests_integrationtest.py
+        
+        * Scripts/webkitpy/layout_tests/controllers/manager.py:
+        (Manager._run_tests):
+        * Scripts/webkitpy/layout_tests/port/base.py:
+        (Port.worker_startup_delay_secs):
+        * Scripts/webkitpy/layout_tests/port/test.py:
+        (TestPort.worker_startup_delay_secs):
+
+2012-02-21  Jon Lee  <jonlee@apple.com>
+
+        Bring notifications support to WK1 mac
+        https://bugs.webkit.org/show_bug.cgi?id=78783
+        <rdar://problem/10610578>
+
+        Reviewed by Anders Carlsson.
+
+        * DumpRenderTree/mac/UIDelegate.mm: Refactor WebGeolocationPolicyListener to WebAllowDenyPolicyListener.
+        (-[UIDelegate webView:decidePolicyForGeolocationRequestFromOrigin:frame:listener:]):
+        (-[UIDelegate timerFired]):
+
+2012-02-21  Kentaro Hara  <haraken@chromium.org>
+
+        Enable the IDL attribute checker in run-bindings-tests
+        https://bugs.webkit.org/show_bug.cgi?id=79091
+
+        Reviewed by Adam Barth.
+
+        We have enabled the IDL attribute checker in Chromium in r108322.
+        This patch enables the IDL attribute checker in run-bindings-tests.
+
+        No tests. I manually checked that [Custommm], [CallWith=],
+        [CallWith=ScriptExecutionContext|Foo] in TestObj.idl cause
+        run-bindings-tests failures.
+
+        * Scripts/webkitpy/bindings/main.py:
+        (BindingsTests.generate_supplemental_dependency):
+
+2012-02-21  Rafael Weinstein  <rafaelw@chromium.org>
+
+        Add rafaelw as a committer.
+
+        Unreviewed.
+
+        * Scripts/webkitpy/common/config/committers.py:
+
+2012-02-21  Dirk Pranke  <dpranke@chromium.org>
+
+        webkitpy: update names after deleting message_broker
+        https://bugs.webkit.org/show_bug.cgi?id=79000
+
+        Reviewed by Eric Seidel.
+
+        Part 3 of 3 in deleting message_broker.py; this change just
+        adjusts the names for the newly merged symbols so that they are
+        private as appropriate.
+
+        * Scripts/webkitpy/layout_tests/controllers/manager_worker_broker.py:
+        (get):
+        (_Broker):
+        (_BrokerConnection):
+        (_BrokerConnection.__init__):
+        (AbstractWorker.__init__):
+        (_ManagerConnection):
+        (_ManagerConnection.__init__):
+        (_WorkerConnection):
+        (_WorkerConnection.__init__):
+
+2012-02-21  Dirk Pranke  <dpranke@chromium.org>
+
+        webkitpy: merge message_broker.py into manager_worker_broker.py
+        https://bugs.webkit.org/show_bug.cgi?id=78999
+
+        Reviewed by Tony Chang.
+
+        This is pretty much a straight cut-and-paste of one file into
+        another (broken up so that docstrings and imports are in the
+        right place).
+
+        * Scripts/webkitpy/layout_tests/controllers/manager_worker_broker.py:
+        (BrokerClient):
+        (BrokerClient.is_done):
+        (BrokerClient.name):
+        (Broker):
+        (Broker.__init__):
+        (Broker.add_topic):
+        (Broker._get_queue_for_topic):
+        (Broker.post_message):
+        (Broker.run_message_loop):
+        (Broker.run_all_pending):
+        (Broker._run_loop):
+        (Broker._dispatch_message):
+        (_Message):
+        (_Message.loads):
+        (_Message.__init__):
+        (_Message.dumps):
+        (_Message.__repr__):
+        (BrokerConnection):
+        (BrokerConnection.__init__):
+        (BrokerConnection.run_message_loop):
+        (BrokerConnection.post_message):
+        (BrokerConnection.raise_exception):
+        * Scripts/webkitpy/layout_tests/controllers/message_broker.py: Removed.
+
+2012-02-21  Dirk Pranke  <dpranke@chromium.org>
+
+        webkitpy: prepare to delete message_broker.py
+        https://bugs.webkit.org/show_bug.cgi?id=78997
+
+        Reviewed by Eric Seidel.
+
+        This is part 1 of 3 changes to fix bug 78187. This change
+        prepares the code for merging message_broker.py into
+        manager_worker_broker.py; the tests in message_broker_unittest
+        are merged into manager_worker_broker_unittest, the symbols
+        needed by the tests are exported from manager_worker_broker.py,
+        and manager_worker_broker itself is updated to refer to the
+        symbols directly (without the module prefix).
+
+        * Scripts/webkitpy/layout_tests/controllers/manager_worker_broker.py:
+        (get):
+        (AbstractWorker):
+        (AbstractWorker.__init__):
+        (_ManagerConnection):
+        (_ManagerConnection.__init__):
+        (_WorkerConnection):
+        (_WorkerConnection.__init__):
+        * Scripts/webkitpy/layout_tests/controllers/manager_worker_broker_unittest.py:
+        (InterfaceTest.test_brokerclient_is_abstract):
+        (InterfaceTest.test_brokerclient_is_abstract.methods):
+        (MessageTest):
+        (MessageTest.test__no_body):
+        (MessageTest.test__body):
+        * Scripts/webkitpy/layout_tests/controllers/message_broker_unittest.py: Removed.
+
+2012-02-21  Sam Weinig  <sam@webkit.org>
+
+        Attempt to fix the Snow Leopard build.
+
+        * DumpRenderTree/mac/Configurations/Base.xcconfig:
+        * MiniBrowser/Configurations/Base.xcconfig:
+        * TestWebKitAPI/Configurations/Base.xcconfig:
+        * WebKitTestRunner/Configurations/Base.xcconfig:
+
+2012-02-21  Sam Weinig  <sam@webkit.org>
+
+        Use libc++ when building with Clang on Mac
+        https://bugs.webkit.org/show_bug.cgi?id=78981
+
+        Reviewed by Dan Bernstein.
+
+        * DumpRenderTree/mac/Configurations/Base.xcconfig:
+        * MiniBrowser/Configurations/Base.xcconfig:
+        * TestWebKitAPI/Configurations/Base.xcconfig:
+        * WebKitTestRunner/Configurations/Base.xcconfig:
+
+2012-02-21  Adam Roben  <aroben@apple.com>
+
+        Roll out r108309, r108323, and r108326
+
+        They broke the 32-bit Lion build.
+
+        Original bugs is <http://webkit.org/b/75812> <rdar://problem/10079694>.
+
+        * DumpRenderTree/efl/CMakeLists.txt:
+
+2012-02-21  Andras Becsi  <andras.becsi@nokia.com>
+
+        [Qt][WK2] Get rid of the dependency to QtWidgets
+        https://bugs.webkit.org/show_bug.cgi?id=76276
+
+        Reviewed by Simon Hausmann.
+
+        * MiniBrowser/qt/MiniBrowser.pro:
+        * MiniBrowser/qt/MiniBrowserApplication.cpp:
+        (MiniBrowserApplication::MiniBrowserApplication):
+        (MiniBrowserApplication::notify):
+        (MiniBrowserApplication::sendTouchEvent):
+        * MiniBrowser/qt/MiniBrowserApplication.h:
+        (MiniBrowserApplication):
+        * QtTestBrowser/locationedit.h:
+        * WebKitTestRunner/InjectedBundle/qt/ActivateFontsQt.cpp:
+        (WTR::activateFonts):
+        * WebKitTestRunner/qt/PlatformWebViewQt.cpp:
+
+2012-02-20  Adam Barth  <abarth@webkit.org>
+
+        mastercfg_unittest.py fails without simplejson
+        https://bugs.webkit.org/show_bug.cgi?id=79070
+
+        Reviewed by Csaba Osztrogonác.
+
+        Now that we require Python 2.6 (and higher) we can import json rather
+        than simplejson.  We still need to use the simplejson name because
+        that's what the master.cfg script expects.
+
+        * BuildSlaveSupport/build.webkit.org-config/mastercfg_unittest.py:
+        (BuildBotConfigLoader._add_dependant_modules_to_sys_modules):
+
+2012-02-20  Filip Pizlo  <fpizlo@apple.com>
+
+        JSC should be a triple-tier VM
+        https://bugs.webkit.org/show_bug.cgi?id=75812
+        <rdar://problem/10079694>
+
+        Reviewed by Gavin Barraclough.
+
+        Changed EFL's build system to include a new directory in JavaScriptCore.
+
+        * DumpRenderTree/efl/CMakeLists.txt:
+
+2012-02-20  Kenichi Ishibashi  <bashi@chromium.org>
+
+        Update pywebsocket to 0.7.2
+        https://bugs.webkit.org/show_bug.cgi?id=79066
+
+        This version includes vendor-prefixed deflate-frame extension support.
+
+        Reviewed by Kent Tamura.
+
+        * Scripts/webkitpy/thirdparty/__init__.py:
+        (AutoinstallImportHook._install_pywebsocket):
+
+2012-02-20  Martin Robinson  <mrobinson@igalia.com>
+
+        [UNIX] Plugin information fields are not interpreted as UTF-8
+        https://bugs.webkit.org/show_bug.cgi?id=78635
+
+        Reviewed by Gustavo Noronha Silva.
+
+        Interpret plugin metadata as UTF8 aways. This matches the behavior
+        of Chromium and the Totem plugin.
+
+        * DumpRenderTree/TestNetscapePlugIn/main.cpp:
+        (NPP_GetValue): Include a UTF-8 character in the description string for testing purposes.
+
+2012-02-20  Martin Robinson  <mrobinson@igalia.com>
+
+        [GTK] [Qt] Move the unix forwarding headers for TestNetscapePlugin to the TestNetscapePlugin directory
+        https://bugs.webkit.org/show_bug.cgi?id=78935
+
+        Reviewed by Gustavo Noronha Silva.
+
+        Move the TestNetscapePlugin headers to a more appropriate directory and update
+        the build files to match.
+
+        * DumpRenderTree/TestNetscapePlugIn/unix/ForwardingHeaders/WebKit/npapi.h: Renamed from Tools/DumpRenderTree/unix/TestNetscapePlugin/ForwardingHeaders/WebKit/npapi.h.
+        * DumpRenderTree/TestNetscapePlugIn/unix/ForwardingHeaders/WebKit/npfunctions.h: Renamed from Tools/DumpRenderTree/unix/TestNetscapePlugin/ForwardingHeaders/WebKit/npfunctions.h.
+        * DumpRenderTree/TestNetscapePlugIn/unix/ForwardingHeaders/WebKit/npruntime.h: Renamed from Tools/DumpRenderTree/unix/TestNetscapePlugin/ForwardingHeaders/WebKit/npruntime.h.
+        * DumpRenderTree/qt/TestNetscapePlugin/TestNetscapePlugin.pro: Update build.
+        * GNUmakefile.am: Ditto.
+
+2012-02-20  Kihong Kwon  <kihong.kwon@samsung.com>
+
+        Add a new API for the Vibration API(W3C).
+        https://bugs.webkit.org/show_bug.cgi?id=72010
+
+        Reviewed by Hajime Morita.
+
+        * Scripts/build-webkit: Enable ENABLE_VIBRATION feature.
+
+2012-02-20  János Badics  <dicska@gmail.com>
+
+        [Qt] run-qtwebkit-tests doesn't consider timeouts as failures
+        https://bugs.webkit.org/show_bug.cgi?id=71816
+
+        RunQtAPITests will notify if a timeout occurs during testing.
+        Added unittest to the master.cfg
+
+        Reviewed by Csaba Osztrogonác.
+
+        * BuildSlaveSupport/build.webkit.org-config/master.cfg:
+        (RunQtAPITests.evaluateCommand):
+        * BuildSlaveSupport/build.webkit.org-config/mastercfg_unittest.py:
+        (RunQtAPITestsTest):
+        (RunQtAPITestsTest.assertResults):
+        (RunQtAPITestsTest.test_timeout):
+        (test_success):
+        (test_failure):
+        (test_timeout_and_failure):
+
+2012-02-20  Andy Wingo  <wingo@igalia.com>
+
+        Add wingo as a committer.
+
+        Unreviewed.
+
+        * Scripts/webkitpy/common/config/committers.py: Add myself to the
+        committers list.
+
+2012-02-20  Jochen Eisinger  <jochen@chromium.org>
+
+        [chromium] check that we're not running multiple modal dialogs at the same time
+        https://bugs.webkit.org/show_bug.cgi?id=78486
+
+        Reviewed by Kent Tamura.
+
+        * DumpRenderTree/chromium/TestShell.cpp:
+        (TestShell::TestShell):
+        * DumpRenderTree/chromium/TestShell.h:
+        (TestShell::setIsDisplayingModalDialog):
+        (TestShell::isDisplayingModalDialog):
+        (TestShell):
+        * DumpRenderTree/chromium/WebViewHost.cpp:
+        (WebViewHost::runModal):
+
+2012-02-20  Martin Robinson  <mrobinson@igalia.com>
+
+        Fix WebKit2GTK+ for 'make distcheck'.
+
+        Instead of conditionally including WebKit2 GNUmakefiles, always
+        include them and conditionally activate the final targets.
+
+        * MiniBrowser/gtk/GNUmakefile.am:
+        * WebKitTestRunner/GNUmakefile.am:
+
+2012-02-20  Gyuyoung Kim  <gyuyoung.kim@samsung.com>
+
+        Enable video option for EFL port in build-webkit.
+        https://bugs.webkit.org/show_bug.cgi?id=79006
+
+        Reviewed by Daniel Bates.
+
+        * Scripts/build-webkit:
+
+2012-02-19  JungJik Lee  <jungjik.lee@samsung.com>
+
+        [EFL] Use modifier keys to execute pre-rendering.
+        https://bugs.webkit.org/show_bug.cgi?id=77933
+
+        Reviewed by Chang Shu.
+
+        Use modifier key to execute pre-rendering instead of using reserved function keys.
+
+        * EWebLauncher/main.c:
+        (on_key_down):
+
+2012-02-18  Dirk Pranke  <dpranke@chromium.org>
+
+        Fix one more dangling reference to worker_connection.name, delete unused code.
+
+        Unreviewed, build fix.
+
+        * Scripts/webkitpy/layout_tests/controllers/manager.py:
+        (Manager.update):
+        (_WorkerState.__init__):
+
+2012-02-18  Dirk Pranke  <dpranke@chromium.org>
+
+        Add a change that should've been in r108005.
+
+        Unreviewed, build fix.
+
+        In the refactoring/cleanup in r108005 I should've changed the
+        implementation of WorkerConnection to make it match BrokerClient
+        (and everything else) so that objects had a name() method
+        instead of a name property.
+
+        * Scripts/webkitpy/layout_tests/controllers/manager.py:
+        (Manager._run_tests):
+        * Scripts/webkitpy/layout_tests/controllers/manager_worker_broker.py:
+        (_WorkerConnection.__init__):
+        (_WorkerConnection.name):
+        * Scripts/webkitpy/layout_tests/controllers/manager_worker_broker_unittest.py:
+        (_TestWorker.__init__):
+        (_TestsMixin.name):
+        (_TestsMixin.test_name):
+        (_TestsMixin.test_cancel):
+        (_TestsMixin.test_unknown_message):
+
+2012-02-18  Dirk Pranke  <dpranke@chromium.org>
+
+        webkitpy: remove webkitpy.common.array_stream
+        https://bugs.webkit.org/show_bug.cgi?id=78952
+
+        Reviewed by Eric Seidel.
+
+        Turns out array_stream didn't really do anything that StringIO
+        didn't do (at least as of Python 2.6). This change removes it
+        and updates all of the callers. Where possible, I changed the
+        test assertions in order to capture the intent more clearly,
+        e.g., instead of calling self.assertTrue('foo' in stream.get()),
+        we have self.assertContainsLine(stream, 'foo'), and instead of
+        self.assertTrue(stream.empty()), we have self.assertEmpty(stream) -
+        the latter isn't that much more readable, but StringIO doesn't
+        export an empty() method.
+
+        * Scripts/webkitpy/common/array_stream.py: Removed.
+        * Scripts/webkitpy/common/array_stream_unittest.py: Removed.
+        * Scripts/webkitpy/layout_tests/run_webkit_tests_integrationtest.py:
+        (passing_run):
+        (run_and_capture):
+        (StreamTestingMixin):
+        (StreamTestingMixin.assertContains):
+        (StreamTestingMixin.assertContainsLine):
+        (StreamTestingMixin.assertEmpty):
+        (StreamTestingMixin.assertNotEmpty):
+        (LintTest):
+        (LintTest.test_lint_test_files):
+        (LintTest.test_lint_test_files__errors):
+        (MainTest):
+        (MainTest.test_child_process_1):
+        (MainTest.test_child_processes_2):
+        (MainTest.test_child_processes_min):
+        (MainTest.test_help_printing):
+        (MainTest.test_hung_thread):
+        (MainTest.test_no_tests_found):
+        (MainTest.test_no_tests_found_2):
+        (MainTest.test_repeat_each_iterations_num_tests):
+        (MainTest.test_test_list):
+        (MainTest.test_unexpected_failures):
+        (MainTest.test_worker_model__inline_with_child_processes):
+        (MainTest.test_additional_platform_directory):
+        (RebaselineTest):
+        (RebaselineTest.assertBaselines):
+        (RebaselineTest.test_reset_results):
+        (RebaselineTest.test_missing_results):
+        (RebaselineTest.test_new_baseline):
+        * Scripts/webkitpy/layout_tests/views/metered_stream.py:
+        (MeteredStream.update):
+        * Scripts/webkitpy/layout_tests/views/metered_stream_unittest.py:
+        (TestMeteredStream.test_regular):
+        * Scripts/webkitpy/layout_tests/views/printing_unittest.py:
+        (TestUtilityFunctions.assertEmpty):
+        (TestUtilityFunctions):
+        (TestUtilityFunctions.assertNotEmpty):
+        (TestUtilityFunctions.assertWritten):
+        (TestUtilityFunctions.test_configure_logging):
+        (Testprinter.assertEmpty):
+        (Testprinter):
+        (Testprinter.assertNotEmpty):
+        (Testprinter.assertWritten):
+        (Testprinter.reset):
+        (Testprinter.get_printer):
+        (Testprinter.test_help_printer):
+        (Testprinter.do_switch_tests.do_helper):
+        (Testprinter.test_print_one_line_summary):
+        (Testprinter.test_print_test_result):
+        (Testprinter.test_print_progress):
+        (Testprinter.test_write_nothing):
+        (Testprinter.test_write_misc):
+        (Testprinter.test_write_everything):
+        (Testprinter.test_write_verbose):
+        (Testprinter.test_print_unexpected_results):
+        * Scripts/webkitpy/performance_tests/perftestsrunner_unittest.py:
+        (MainTest.assertWritten):
+        (create_runner):
+        (test_run_test_set):
+        (test_run_test_set_kills_drt_per_run):
+        (test_run_test_set_for_parser_tests):
+        (test_run_test_set_with_json_output):
+        (test_run_test_set_with_json_source):
+        (test_run_test_set_with_multiple_repositories):
+        (test_upload_json):
+
+2012-02-18  Kevin Ollivier  <kevino@theolliviers.com>
+
+        [wx] Add the WebCore/page/scrolling directory to the build dirs.
+
+        * waf/build/settings.py:
+
+2012-02-18  Kevin Ollivier  <kevino@theolliviers.com>
+
+        [wx] Unreviewed build fix. Don't error out or hang if we have
+        downloaded dependencies but server update check fails.
+
+        * waf/build/build_utils.py:
+        (download_if_newer):
+
+2012-02-17  Dirk Pranke  <dpranke@chromium.org>
+
+        The new run-webkit-tests needs to dump out pixel hash failures even if the pixel test passes.
+        https://bugs.webkit.org/show_bug.cgi?id=69444
+
+        Reviewed by Tony Chang.
+
+        Currently if a test's image checksum doesn't match the checksum
+        in the baseline, but the images themselves match according to
+        ImageDiff, new-run-webkit-tests ignores the problem. This is
+        probably bad, but it's not yet clear what the right thing to do
+        is. This patch will log a warning to stderr, at least (but the
+        test will still pass).
+
+        * Scripts/webkitpy/layout_tests/controllers/single_test_runner.py:
+        (SingleTestRunner._compare_image):
+        (SingleTestRunner._run_reftest):
+        * Scripts/webkitpy/layout_tests/port/test.py:
+        (unit_test_list):
+        * Scripts/webkitpy/layout_tests/port/mock_drt_unittest.py:
+
+2012-02-17  Dirk Pranke  <dpranke@chromium.org>
+
+        NRWT does not report failure for a skipped test
+        https://bugs.webkit.org/show_bug.cgi?id=78750
+
+        Reviewed by Eric Seidel.
+
+        If a test is listed in a Skipped file and you run it anyway
+        with --force, and the test fails, currently NRWT will print
+        "test ran as expected"; this is confusing, because you probably
+        expect the test to fail and yet this might lead you to think the
+        test passed. This patch changes the expected behavior to "PASS",
+        so tests that fail will be reported.
+
+        * Scripts/webkitpy/layout_tests/models/test_expectations.py:
+        (result_was_expected):
+        (TestExpectationParser):
+        (TestExpectationParser.expectation_for_skipped_test):
+        (TestExpectations):
+        * Scripts/webkitpy/layout_tests/models/test_expectations_unittest.py:
+        (test_add_skipped_tests):
+        * Scripts/webkitpy/layout_tests/port/test.py:
+        (unit_test_list): Add some tests that are expected to be in a Skipped file.
+        (TestPort.skipped_tests): This adds actual integration test coverage of Skipped files.
+
+2012-02-17  Dirk Pranke  <dpranke@chromium.org>
+
+        webkitpy: fix test code after bug 78181
+        https://bugs.webkit.org/show_bug.cgi?id=78870
+
+        Reviewed by Adam Barth.
+
+        I forgot to update the test code as per Tony's suggestion in
+        bug 78181 (r108005). This change does that, and in doing so
+        it revealed a subtle bug in _InlineWorkerConnection.run() that
+        I am fixing as part of this (_alive would not be cleared if an
+        exception was thrown).
+
+        * Scripts/webkitpy/layout_tests/controllers/manager_worker_broker.py:
+        (_InlineWorkerConnection.run):
+        * Scripts/webkitpy/layout_tests/controllers/manager_worker_broker_unittest.py:
+        (_TestWorker.__init__):
+        (_TestWorker.handle_stop):
+        (_TestWorker.handle_test):
+        (_TestWorker.run):
+        (_TestsMixin.handle_exception):
+        (_TestsMixin.test_unknown_message):
+
+2012-02-17  Adam Roben  <aroben@apple.com>
+
+        Mac build fix after r108119
+
+        * DumpRenderTree/mac/DumpRenderTree.mm:
+        (runThread):
+        (runPthread):
+        (testThreadIdentifierMap):
+        Updated to match current WTF threading APIs.
+
+2012-02-17  Dirk Pranke  <dpranke@chromium.org>
+
+        revert r107147 - breaks webkit-patch on Mac SL
+        https://bugs.webkit.org/show_bug.cgi?id=78866
+
+        Reviewed by Adam Barth.
+
+        It appears that zipfile.ExtractAll is broken on Python 2.6.1,
+        which is the version that ships on Mac SL. Reverting this
+        change until we no longer have to worry about that version.
+
+        * Scripts/webkitpy/common/system/autoinstall.py:
+        (AutoInstaller):
+        (AutoInstaller._extract_all): Added a comment about SL.
+        (AutoInstaller._unzip):
+
+2012-02-17  Mihnea Ovidenie  <mihnea@adobe.com>
+
+        CSS regions enabled by default
+        https://bugs.webkit.org/show_bug.cgi?id=78525
+
+        Reviewed by David Hyatt.
+
+        Add a runtime preference to enable/disable regions functionality at runtime(WebKitCSSRegionsEnabled).
+        CSSRegions are still enabled by default.
+        In DRT, use layoutTestController.overridePreference("WebKitCSSRegionsEnabled", "0") to disable the css regions functionality.
+
+        * DumpRenderTree/chromium/LayoutTestController.cpp:
+        (LayoutTestController::overridePreference):
+        * DumpRenderTree/chromium/WebPreferences.cpp:
+        (WebPreferences::reset):
+        (WebPreferences::applyTo):
+        * DumpRenderTree/chromium/WebPreferences.h:
+        (WebPreferences):
+        * DumpRenderTree/mac/DumpRenderTree.mm:
+        (resetDefaultsToConsistentValues):
+
+2012-02-17  Maciej Stachowiak  <mjs@apple.com>
+
+        Some API tests erroneously use = instead of == (causing build failures)
+        https://bugs.webkit.org/show_bug.cgi?id=78915
+
+        Reviewed by Sam Weinig.
+
+        * TestWebKitAPI/Tests/WebKit2/PageLoadBasic.cpp:
+        (TestWebKitAPI::decidePolicyForNavigationAction): Replace an = with an ==
+        (TestWebKitAPI::decidePolicyForNewWindowAction): ditto
+
+2012-02-17  Peter Beverloo  <peter@chromium.org>
+
+        [Chromium] Include TestShellLinux.cpp in the build for Android
+        https://bugs.webkit.org/show_bug.cgi?id=78865
+
+        Reviewed by Eric Seidel.
+
+        Android will be re-using the TestShellLinux.cpp file. I already
+        added this r104033, but it seems to have gotten lost in the
+        recent refactorings.
+
+        * DumpRenderTree/DumpRenderTree.gyp/DumpRenderTree.gyp:
+
+2012-02-17  Gyuyoung Kim  <gyuyoung.kim@samsung.com>
+
+        Unreviewed, disable video build on EFL until it can be
+        supported by EFL build bot.
+
+        * Scripts/build-webkit:
+
+2012-02-17  Carlos Garcia Campos  <cgarcia@igalia.com>
+
+        [GTK] Implement zoom in/out in MiniBrowser
+        https://bugs.webkit.org/show_bug.cgi?id=75253
+
+        Reviewed by Gustavo Noronha Silva.
+
+        * MiniBrowser/gtk/BrowserWindow.c:
+        (browserWindowCanZoomIn):
+        (browserWindowCanZoomOut):
+        (browserWindowUpdateZoomActions):
+        (webViewZoomLevelChanged):
+        (zoomInCallback):
+        (zoomOutCallback):
+        (browser_window_init):
+        (browserWindowConstructed):
+
+2012-02-17  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        layoutTestController.display() is flaky for SVG tests
+        https://bugs.webkit.org/show_bug.cgi?id=78021
+
+        Reviewed by Adam Roben.
+
+        Apply the same fix to DRT/Win, as previously applied to DRT/Mac.
+        Size the web view before running the test, not when dumping.
+        All platforms handle this correctly now.
+
+        * DumpRenderTree/win/DumpRenderTree.cpp:
+        (dump):
+        (sizeWebViewForCurrentTest):
+        (runTest):
+
+2012-02-16  Carlos Garcia Campos  <cgarcia@igalia.com>
+
+        [GTK] Make install is broken when building without --enable-gtk-doc
+        https://bugs.webkit.org/show_bug.cgi?id=78828
+
+        Reviewed by Martin Robinson.
+
+        * gtk/generate-gtkdoc:
+        (rebase_installed_docs): Check documentation has been generated
+        before trying to rebase it.
+
+2012-02-16  Dirk Pranke  <dpranke@chromium.org>
+
+        nrwt: simplify worker interface
+        https://bugs.webkit.org/show_bug.cgi?id=78181
+
+        Reviewed by Tony Chang.
+
+        This change moves code in name(), is_done(), run(), and cancel()
+        from Worker to AbstractWorker, since the logic is pretty much
+        boilerplate code that any implementation would want to use.
+
+        * Scripts/webkitpy/layout_tests/controllers/manager_worker_broker.py:
+        (get.should):
+        (AbstractWorker.__init__):
+        (AbstractWorker):
+        (AbstractWorker.name):
+        (AbstractWorker.stop_handling_messages):
+        (AbstractWorker.run):
+        (AbstractWorker.is_done):
+        (AbstractWorker.cancel):
+        * Scripts/webkitpy/layout_tests/controllers/worker.py:
+        (Worker.__init__):
+        (Worker.run):
+        (Worker.handle_stop):
+
+2012-02-16  Michael Saboff  <msaboff@apple.com>
+
+        ENH: Add ability to run subset of JavaScript layout tests with JSC
+        https://bugs.webkit.org/show_bug.cgi?id=78764
+
+        Reviewed by Gavin Barraclough.
+
+        New simple test drive shell script that runs a defined
+        list of javascript tests using jsc and the standalone-{pre,post}.js
+        wrappers.
+
+        * Scripts/run-fast-jsc: Added.
+
+2012-02-16  Csaba Osztrogonác  <ossy@webkit.org>
+
+        Add new Qt performance tester bot to build.webkit.org
+        https://bugs.webkit.org/show_bug.cgi?id=78795
+
+        Reviewed by Adam Roben.
+
+        * BuildSlaveSupport/build.webkit.org-config/config.json:
+
+2012-02-16  Patrick Gansterer  <paroga@webkit.org>
+
+        Disable inspector on WinCE.
+
+        Avoid compiling InspectorBackendDispatcher.cpp, which causes an internal compiler error.
+
+        * Scripts/build-webkit:
+
+2012-02-16  Patrick Gansterer  <paroga@webkit.org>
+
+        WinCE build fix after r107656.
+
+        Disable FTPDIR on WinCE, since it does not compile there.
+
+        * Scripts/build-webkit:
+
+2012-02-15  Leo Yang  <leo.yang@torchmobile.com.cn>
+
+        Build fix after r107863.
+
+        * DumpRenderTree/blackberry/PixelDumpSupportBlackBerry.cpp:
+
+2012-02-15  Tony Chang  <tony@chromium.org>
+
+        [chromium] add linux dbg back to garden-o-matic
+        https://bugs.webkit.org/show_bug.cgi?id=78752
+
+        Reviewed by Adam Barth.
+
+        This reflects the current linux debug bot name (there's only one bot).
+        I'm also remove the mac clang builder since it doesn't exist (mac
+        always uses clang now).
+
+        * BuildSlaveSupport/build.webkit.org-config/public_html/TestFailures/scripts/config.js:
+        * Scripts/webkitpy/layout_tests/port/builders.py:
+
+2012-02-15  Sam Weinig  <sam@webkit.org>
+
+        Add style check for ctype functions that are generally frowned upon in WebKit
+        https://bugs.webkit.org/show_bug.cgi?id=78748
+
+        Reviewed by Anders Carlsson.
+
+        Not every platform has DisallowCType.h to check for uses of the ctype.h
+        functions, so add a style check for them as well.
+
+        * Scripts/webkitpy/style/checkers/cpp.py:
+        (check_ctype_functions):
+        (check_style):
+        (CppChecker):
+        Add check.
+
+        * Scripts/webkitpy/style/checkers/cpp_unittest.py:
+        (WebKitStyleTest.test_ctype_fucntion):
+        Add checker.
+
+2012-02-15  Szilard Ledan  <Ledan-Muntean.Szilard@stud.u-szeged.hu>
+
+        [Qt][WK2] WebKitTestRunner should use 480x360 sized view for W3C SVG tests
+        https://bugs.webkit.org/show_bug.cgi?id=76546
+
+        Reviewed by Simon Hausmann.
+
+        Resize the web view programatically because the declarative property binding
+        does not work. Seems like our qml environment is not initialized fully but it
+        needs more investigation.
+
+        * WebKitTestRunner/qt/PlatformWebViewQt.cpp:
+        (WTR::WrapperWindow::handleStatusChanged):
+        (WTR::PlatformWebView::resizeTo):
+
+2012-02-15  Dirk Pranke  <dpranke@chromium.org>
+
+        webkitpy: add a worker_args concept to start_worker()
+        https://bugs.webkit.org/show_bug.cgi?id=78572
+
+        Reviewed by Tony Chang.
+
+        This change replaces the three NRWT-specific arguments passed
+        through the broker to the worker with a generic WorkerArguments
+        wrapper class and a separate set_inline_arguments() call that can
+        be used to pass additional data to the worker when it is running
+        in the same process as the manager (this is needed for testing).
+        With the addition of set_inline_arguments() we also no longer
+        need to pass an optional argument to the worker.run() call.
+
+        Note that this method is *only* implemented on inline workers,
+        so calling this on a regular (child process) worker will result
+        in a runtime error.
+
+        * Scripts/webkitpy/layout_tests/controllers/manager.py:
+        (Manager._run_tests):
+        * Scripts/webkitpy/layout_tests/controllers/manager_worker_broker.py:
+        (AbstractWorker.__init__):
+        (AbstractWorker.run):
+        (_ManagerConnection.start_worker):
+        (_InlineManager.start_worker):
+        (_InlineManager.set_inline_arguments):
+        (_InlineManager.run_message_loop):
+        (_MultiProcessManager.start_worker): Reworked signature.
+        (_WorkerConnection.__init__):
+        (_InlineWorkerConnection.__init__):
+        (_InlineWorkerConnection.set_inline_arguments): New method.
+        (_InlineWorkerConnection):
+        (_InlineWorkerConnection.run):
+        (_Process.run):
+        (_MultiProcessWorkerConnection.__init__):
+        * Scripts/webkitpy/layout_tests/controllers/manager_worker_broker_unittest.py:
+        (_TestWorker.__init__):
+        (_TestWorker.set_inline_arguments):
+        (_TestWorker.handle_test):
+        (_TestWorker.run):
+        (_TestsMixin.test_cancel):
+        (_TestsMixin.test_done):
+        (_TestsMixin.test_unknown_message):
+        (InlineBrokerTests): New class for more testing.
+        (InlineBrokerTests.setUp):
+        (InlineBrokerTests.test_inline_arguments): New test.
+        (InterfaceTest.test_managerconnection_is_abstract):
+        (InterfaceTest.test_workerconnection_is_abstract):
+        * Scripts/webkitpy/layout_tests/controllers/worker.py:
+        (WorkerArguments):
+        (WorkerArguments.__init__):
+        (Worker.__init__):
+        (Worker.set_inline_arguments):
+        (Worker):
+        (Worker.run):
+        * Scripts/webkitpy/layout_tests/controllers/worker_unittest.py:
+        (WorkerTest.test_default_platform_in_worker):
+
+2012-02-15  Adam Klein  <adamk@chromium.org>
+
+        Unreviewed, rolling out r107704.
+        http://trac.webkit.org/changeset/107704
+        https://bugs.webkit.org/show_bug.cgi?id=78486
+
+        Caused layout test crashes in debug builds.
+
+        Specific crashing tests:
+
+        fast/events/show-modal-dialog-onblur-onfocus.html
+        fast/harness/show-modal-dialog.html
+        inspector/console/console-long-eval-crash.html
+
+        * DumpRenderTree/chromium/TestShell.cpp:
+        (TestShell::TestShell):
+        * DumpRenderTree/chromium/TestShell.h:
+        (TestShell):
+        * DumpRenderTree/chromium/WebViewHost.cpp:
+        (WebViewHost::runModal):
+
+2012-02-15  Michael Brüning  <michael.bruning@nokia.com>
+
+        [Qt] Add UI for HTTP authentication in the Qt MiniBrowser
+        https://bugs.webkit.org/show_bug.cgi?id=76347
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        * MiniBrowser/qt/MiniBrowser.qrc:
+        * MiniBrowser/qt/qml/AuthenticationDialog.qml: Added. 
+        * MiniBrowser/qt/qml/BrowserWindow.qml:
+        * MiniBrowser/qt/qml/DialogLineInput.qml:
+
+2012-02-15  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        [Qt] Fix WebGL in QtTestBrowser
+
+        Reviewed by Tor Arne Vestbø.
+
+        * QtTestBrowser/QtTestBrowser.pro: Set the OpenGL define so that when passing
+        the options for enabling GL we also pass them on properly.
+
+2012-02-14  Sam Weinig  <sam@webkit.org>
+
+        Add #include of unistd.h on the mac for getcwd. 
+
+        Reviewed by Anders Carlsson.
+
+        This is necessary when building with libc++.
+
+        * WebKitTestRunner/TestInvocation.cpp:
+
+2012-02-14  Sam Weinig  <sam@webkit.org>
+
+        In DRT, don't #define min or max on non-Windows platforms, it just isn't needed
+        https://bugs.webkit.org/show_bug.cgi?id=78663
+
+        Reviewed by Anders Carlsson.
+
+        * DumpRenderTree/DumpRenderTreePrefix.h:
+        * DumpRenderTree/cg/ImageDiffCG.cpp:
+
+2012-02-14  Adam Barth  <abarth@webkit.org>
+
+        Implement an adb-based driver for the ChromiumAndroidPort
+        https://bugs.webkit.org/show_bug.cgi?id=78627
+
+        Reviewed by Eric Seidel.
+
+        This driver mostly just wires up the ChromiumDriver through adb.  In
+        some cases, it translates protocol elements, such as URIs, so that the
+        rest of webkitpy is insulated from the "remoteness" of the target device.
+
+        * Scripts/webkitpy/layout_tests/port/chromium_android.py:
+        (ChromiumAndroidPort.start_helper):
+        (ChromiumAndroidPort._driver_class):
+        (ChromiumAndroidPort._update_version):
+        (ChromiumAndroidPort._get_stderr):
+        (ChromiumAndroidPort):
+        (ChromiumAndroidPort._get_last_stacktrace):
+        (ChromiumAndroidPort._teardown_performance):
+        (ChromiumAndroidDriver):
+        (ChromiumAndroidDriver.__init__):
+        (ChromiumAndroidDriver._start):
+        (ChromiumAndroidDriver.run_test):
+        (ChromiumAndroidDriver.stop):
+        (ChromiumAndroidDriver._test_shell_command):
+        (ChromiumAndroidDriver._write_command_and_read_line):
+        (ChromiumAndroidDriver._output_image):
+        (ChromiumAndroidDriver._has_crash_hint):
+
+2012-02-14  Dirk Pranke  <dpranke@chromium.org>
+
+        webkitpy: the real_name() method in the Port class is no longer needed
+        https://bugs.webkit.org/show_bug.cgi?id=78651
+
+        Reviewed by Eric Seidel.
+
+        The change in bug 78565 / r107718 made it no longer necessary
+        (we can use options.platform instead).
+
+        * Scripts/webkitpy/layout_tests/port/base.py:
+        (Port.name):
+        * Scripts/webkitpy/layout_tests/port/mock_drt.py:
+        (MockDRTPort.__init__):
+
+2012-02-14  Dirk Pranke  <dpranke@chromium.org>
+
+        webkitpy: clean up options, port handling in manager_worker_broker
+        https://bugs.webkit.org/show_bug.cgi?id=78568
+
+        Reviewed by Tony Chang.
+
+        manager_worker_broker no longer needs options or port objects
+        directly, so we make them only be passed in start_worker().
+
+        * Scripts/webkitpy/layout_tests/controllers/manager.py:
+        (Manager._run_tests):
+        * Scripts/webkitpy/layout_tests/controllers/manager_worker_broker.py:
+        (get):
+        (_ManagerConnection.__init__):
+        (_ManagerConnection.start_worker):
+        (_InlineManager.__init__):
+        (_InlineManager.start_worker):
+        (_InlineManager.run_message_loop):
+        (_MultiProcessManager.__init__):
+        (_MultiProcessManager):
+        (_MultiProcessManager.start_worker):
+        (_InlineWorkerConnection.__init__):
+        (_InlineWorkerConnection.run):
+        (_Process.__init__):
+        (_MultiProcessWorkerConnection.__init__):
+        * Scripts/webkitpy/layout_tests/controllers/manager_worker_broker_unittest.py:
+        (make_broker):
+        (_TestWorker.run):
+        (_TestsMixin.test_cancel):
+        (_TestsMixin.test_done):
+        (_TestsMixin.test_unknown_message):
+        (MultiProcessBrokerTests.setUp):
+        (InterfaceTest.test_managerconnection_is_abstract):
+        * Scripts/webkitpy/layout_tests/controllers/message_broker.py:
+        (Broker.__init__):
+
+2012-02-14  Dirk Pranke  <dpranke@chromium.org>
+
+        nrwt: add a unit test for regression introduced in bug 78565
+        https://bugs.webkit.org/show_bug.cgi?id=78646
+
+        Reviewed by Tony Chang.
+
+        * Scripts/webkitpy/layout_tests/controllers/worker_unittest.py: Added.
+        (FakeConnection):
+        (FakeConnection.run_message_loop):
+        (FakeConnection.post_message):
+        (WorkerTest):
+        (WorkerTest.test_default_platform_in_worker):
+
+2012-02-14  Dirk Pranke  <dpranke@chromium.org>
+
+        NRWT is broken for the default port
+        https://bugs.webkit.org/show_bug.cgi?id=78640
+    
+        Reviewed by Tony Chang.
+
+        The change in r107718 (bug 78565) broke NRWT if you didn't
+        specify any sort of --platform flag or equivalent. I didn't
+        catch this because it's a full integration test (which we don't
+        have an automated test for) and I missed this command line
+        variant when testing interactively.
+
+        * Scripts/webkitpy/layout_tests/controllers/worker.py:
+        (Worker.run):
+
+2012-02-14  Ramya Chandrasekaran  <cramya@google.com>
+
+        Last character display for passwords in Android.
+        https://bugs.webkit.org/show_bug.cgi?id=78532
+
+        Reviewed by Adam Barth.
+
+        * DumpRenderTree/chromium/WebPreferences.cpp:
+        (WebPreferences::applyTo):
+
+2012-02-14  Adam Barth  <abarth@webkit.org>
+
+        Finish implementing start_helper for ChromiumAndroidPort
+        https://bugs.webkit.org/show_bug.cgi?id=78582
+
+        Reviewed by Eric Seidel.
+
+        This patch contains the remaining odds and ends for the start_helper function.
+
+        * Scripts/webkitpy/layout_tests/port/chromium_android.py:
+        (ChromiumAndroidPort.start_helper):
+        (ChromiumAndroidPort._synchronize_datetime):
+        (ChromiumAndroidPort):
+        (ChromiumAndroidPort._check_version):
+        (ChromiumAndroidPort._run_adb_command):
+        (ChromiumAndroidPort._copy_device_file):
+
+2012-02-14  Dirk Pranke  <dpranke@chromium.org>
+
+        webkitpy: create ports in Workers, not in manager_worker_broker
+        https://bugs.webkit.org/show_bug.cgi?id=78565
+
+        Reviewed by Tony Chang.
+
+        We will now create the Port object (if necessary) in the Worker
+        directly, so that the manager_worker_broker module doesn't need
+        all of this layout_test-specific logic. Part of the fixes for
+        bug 78171.
+
+        These changes are all well-tested by the existing tests in
+        run_webkit_tests_integrationtest.py.
+
+        * Scripts/webkitpy/layout_tests/controllers/manager_worker_broker.py:
+        (_Process.run):
+        * Scripts/webkitpy/layout_tests/controllers/worker.py:
+        (Worker.__init__):
+        (Worker.safe_init):
+        (Worker.run):
+        (Worker.cleanup):
+        * Scripts/webkitpy/layout_tests/run_webkit_tests.py:
+        (parse_args):
+        (main): Fix a minor bug where running the 'mock-test' port didn't work right.
+
+2012-02-14  Jochen Eisinger  <jochen@chromium.org>
+
+        [chromium] check that we're not running multiple modal dialogs at the same time
+        https://bugs.webkit.org/show_bug.cgi?id=78486
+
+        Reviewed by Kent Tamura.
+
+        * DumpRenderTree/chromium/TestShell.cpp:
+        (TestShell::TestShell):
+        * DumpRenderTree/chromium/TestShell.h:
+        (TestShell::setIsDisplayingModalDialog):
+        (TestShell::isDisplayingModalDialog):
+        (TestShell):
+        * DumpRenderTree/chromium/WebViewHost.cpp:
+        (WebViewHost::runModal):
+
+2012-02-14  Adam Barth  <abarth@webkit.org>
+
+        Enable the GPU codepath in the chromium-android port
+        https://bugs.webkit.org/show_bug.cgi?id=78580
+
+        Reviewed by James Robinson.
+
+        Suprise!  There is no ChromiumGpuAndroidPort!  Instead, Chromium
+        Android always uses the GPU codepath, so we set the GPU flags on the
+        main chromium-android port instead.
+
+        * Scripts/webkitpy/layout_tests/port/chromium_android.py:
+        (ChromiumAndroidPort.__init__):
+
+2012-02-14  Adam Barth  <abarth@webkit.org>
+
+        NRWT should expose --adb-args flag for Android
+        https://bugs.webkit.org/show_bug.cgi?id=78579
+
+        Reviewed by Eric Seidel.
+
+        This flag is already wired up to the ChromiumAndroidPort.
+
+        * Scripts/webkitpy/layout_tests/run_webkit_tests.py:
+        (parse_args):
+
+2012-02-14  Alexey Proskuryakov  <ap@apple.com>
+
+        [Mac][Win][WK2] Switch to RFC 6455 protocol for WebSockets
+        https://bugs.webkit.org/show_bug.cgi?id=78541
+        <rdar://problem/10036695>
+
+        Reviewed by Kent Tamura.
+
+        * DumpRenderTree/mac/DumpRenderTree.mm: (resetDefaultsToConsistentValues):
+        * DumpRenderTree/win/DumpRenderTree.cpp: (resetDefaultsToConsistentValues):
+        After each test, reset to using new protocol.
+
+2012-02-11  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Convert svg/animations to use SMIL methods for driving the timeline
+        https://bugs.webkit.org/show_bug.cgi?id=78422
+
+        Reviewed by Dirk Schulze.
+
+        Remove no longer needed SVG specific animation sampling functionality from DRT.
+        Instead we switched the svg/animations tests to use SVGSVGElement.setCurrentTime.
+
+        * DumpRenderTree/LayoutTestController.cpp:
+        (LayoutTestController::staticFunctions):
+        * DumpRenderTree/LayoutTestController.h:
+        (LayoutTestController):
+        * DumpRenderTree/blackberry/LayoutTestControllerBlackBerry.cpp:
+        * DumpRenderTree/chromium/LayoutTestController.cpp:
+        (LayoutTestController::LayoutTestController):
+        * DumpRenderTree/chromium/LayoutTestController.h:
+        (LayoutTestController):
+        * DumpRenderTree/efl/LayoutTestControllerEfl.cpp:
+        * DumpRenderTree/gtk/LayoutTestControllerGtk.cpp:
+        * DumpRenderTree/mac/LayoutTestControllerMac.mm:
+        * DumpRenderTree/qt/LayoutTestControllerQt.cpp:
+        * DumpRenderTree/qt/LayoutTestControllerQt.h:
+        (LayoutTestController):
+        * DumpRenderTree/win/LayoutTestControllerWin.cpp:
+        * DumpRenderTree/wx/LayoutTestControllerWx.cpp:
+
+2012-02-13  Rob Flack  <flackr@chromium.org>
+
+        Add Linux ChromiumOS test results to flakiness dashboard.
+        https://bugs.webkit.org/show_bug.cgi?id=78495
+
+        Reviewed by Ojan Vafai.
+
+        * TestResultServer/static-dashboards/builders.js:
+        * TestResultServer/static-dashboards/dashboard_base.js:
+
+2012-02-13  ChangSeok Oh  <shivamidow@gmail.com>
+
+        [GTK] Mutation Observers build is broken
+        https://bugs.webkit.org/show_bug.cgi?id=78433
+
+        Reviewed by Martin Robinson.
+
+        Enabled mutation observers as a default feature for GTK port, too.
+
+        * Scripts/build-webkit:
+
+2012-02-13  Loïc Yhuel  <loic.yhuel_ext@softathome.com>
+
+        Allow to configure ENABLE_FTPDIR in build-webkit
+        https://bugs.webkit.org/show_bug.cgi?id=65098
+
+        Reviewed by Eric Seidel.
+
+        Allow to disable ENABLE_FTPDIR by command line.
+        Remove ENABLE_FTPDIR from --minimal build
+
+        * Scripts/build-webkit: Add entries for ENABLE_FTPDIR (enabled by default)
+        * qmake/mkspecs/features/features.prf: ENABLE_FTPDIR must be set to match Platform.h,
+        as, for Qt platform, build-webkit does not add on command line what it thinks to be default values
+
+2012-02-13  Shinya Kawanaka  <shinyak@chromium.org>
+
+        Add shinyak as committer.
+
+        Unreviewed.
+
+        * Scripts/webkitpy/common/config/committers.py:
+
+2012-02-13  Adam Barth  <abarth@webkit.org>
+
+        Implement start/stop_helper for ChromiumAndroidPort
+        https://bugs.webkit.org/show_bug.cgi?id=78558
+
+        Reviewed by Dirk Pranke.
+
+        These functions (and their dependencies) set up the Android device for
+        testing.
+
+        This patch also includes a few tweaks on the previous patch recommended
+        by dpranke.
+
+        * Scripts/webkitpy/layout_tests/port/chromium_android.py:
+        (ChromiumAndroidPort.__init__):
+        (ChromiumAndroidPort.start_helper):
+        (ChromiumAndroidPort.stop_helper):
+        (ChromiumAndroidPort._shut_down_http_server):
+        (ChromiumAndroidPort):
+        (ChromiumAndroidPort._push_executable):
+        (ChromiumAndroidPort._push_fonts):
+        (ChromiumAndroidPort._restore_system_font):
+        (ChromiumAndroidPort._push_test_resources):
+        (ChromiumAndroidPort._push_to_device):
+        (ChromiumAndroidPort._pull_from_device):
+        (ChromiumAndroidPort._kill_device_process):
+        (ChromiumAndroidPort._setup_performance):
+        (ChromiumAndroidPort._teardown_performance):
+        * Scripts/webkitpy/layout_tests/port/chromium_android_unittest.py:
+        (ChromiumAndroidPortTest):
+        * Scripts/webkitpy/layout_tests/port/port_testcase.py:
+        (PortTestCase):
+        (PortTestCase.make_port):
+        (PortTestCase.test_default_worker_model):
+
+2012-02-13  Adam Barth  <abarth@webkit.org>
+
+        Implement enough of ChromiumAndroidPort to make ChromiumAndroidPortTest pass
+        https://bugs.webkit.org/show_bug.cgi?id=78550
+
+        Reviewed by Eric Seidel.
+
+        Much of this code just forwards to the "host" port, which seems like a
+        reasonable thing to do.
+
+        * Scripts/webkitpy/layout_tests/port/chromium_android.py:
+        (ChromiumAndroidPort.__init__):
+        (ChromiumAndroidPort.stop_helper):
+        (ChromiumAndroidPort):
+        (ChromiumAndroidPort._build_path):
+        (ChromiumAndroidPort._path_to_apache):
+        (ChromiumAndroidPort._path_to_apache_config_file):
+        (ChromiumAndroidPort._path_to_driver):
+        (ChromiumAndroidPort._path_to_helper):
+        (ChromiumAndroidPort._path_to_image_diff):
+        (ChromiumAndroidPort._path_to_lighttpd):
+        (ChromiumAndroidPort._path_to_lighttpd_modules):
+        (ChromiumAndroidPort._path_to_lighttpd_php):
+        (ChromiumAndroidPort._path_to_wdiff):
+        (ChromiumAndroidPort._shut_down_http_server):
+        * Scripts/webkitpy/layout_tests/port/chromium_android_unittest.py:
+        (ChromiumAndroidPortTest):
+        * Scripts/webkitpy/layout_tests/port/port_testcase.py:
+        (PortTestCase):
+        (PortTestCase.make_port):
+        (PortTestCase.test_default_worker_model):
+
+2012-02-13  Adam Barth  <abarth@webkit.org>
+
+        chromium_android.py should implement "virtual" methods from ChromiumPort
+        https://bugs.webkit.org/show_bug.cgi?id=78545
+
+        Reviewed by Dirk Pranke.
+
+        This patch adds basic implementations that specialize a bunch of
+        functions from ChromiumPort.
+
+        * Scripts/webkitpy/layout_tests/port/chromium_android.py:
+        (ChromiumAndroidPort):
+        (ChromiumAndroidPort.__init__):
+        (ChromiumAndroidPort.default_child_processes):
+        (ChromiumAndroidPort.baseline_search_path):
+        (ChromiumAndroidPort.check_build):
+        (ChromiumAndroidPort.check_sys_deps):
+        (ChromiumAndroidPort.default_worker_model):
+        (ChromiumAndroidPort.test_expectations):
+        (ChromiumAndroidPort.start_http_server):
+        (ChromiumAndroidPort.stop_http_server):
+        (ChromiumAndroidPort.start_helper):
+        (ChromiumAndroidPort.stop_helper):
+
+2012-02-13  Adam Barth  <abarth@webkit.org>
+
+        Add a skeleton ChromiumAndroid port to webkitpy
+        https://bugs.webkit.org/show_bug.cgi?id=78543
+
+        Reviewed by Eric Seidel.
+
+        This patch just adds an empty ChromiumAndroid port object to webkitpy
+        and wires it up to the factory objects.  An actual implementation will
+        follow.
+
+        * Scripts/webkitpy/layout_tests/port/chromium.py:
+        (ChromiumPort):
+        * Scripts/webkitpy/layout_tests/port/chromium_android.py: Added.
+        (ChromiumAndroidPort):
+        (ChromiumAndroidPort.__init__):
+        * Scripts/webkitpy/layout_tests/port/chromium_unittest.py:
+        (ChromiumPortTest.test_all_test_configurations):
+        * Scripts/webkitpy/layout_tests/port/factory.py:
+        (PortFactory):
+
+2012-02-13  Adam Barth  <abarth@webkit.org>
+
+        NRWT's HTTP servers should support additional directories for resources
+        https://bugs.webkit.org/show_bug.cgi?id=78528
+
+        Reviewed by Eric Seidel.
+
+        This functionality will be used by the Chromium-Android port.
+
+        * Scripts/webkitpy/layout_tests/port/base.py:
+        (Port.to.start_http_server):
+        * Scripts/webkitpy/layout_tests/servers/apache_http_server.py:
+        (LayoutTestApacheHttpd.__init__):
+        * Scripts/webkitpy/layout_tests/servers/http_server.py:
+        (Lighttpd.__init__):
+        (Lighttpd._prepare_config):
+
+2012-02-13  Ami Fischman  <fischman@chromium.org>
+
+        Add fischman as committer.
+
+        Unreviewed
+
+        * Scripts/webkitpy/common/config/committers.py:
+
+2012-02-06  Raphael Kubo da Costa  <kubo@profusion.mobi>
+
+        [EFL] Drop support for the Curl network backend.
+        https://bugs.webkit.org/show_bug.cgi?id=77874
+
+        Reviewed by Eric Seidel.
+
+        Nobody seems to be maintaining the Curl backend in WebCore, the
+        EFL port developers all seem to be using the Soup backend and the
+        port itself has many features which are only implemented for the
+        latter.
+
+        * DumpRenderTree/efl/CMakeLists.txt: Always link to glib/libsoup
+        and always add the required include directories.
+        * EWebLauncher/CMakeLists.txt: Add the required glib/libsoup
+        include directories and link to them.
+
+2012-02-13  Kenichi Ishibashi  <bashi@chromium.org>
+
+        [WebSocket] Update pywebsocket to 0.7.1
+        https://bugs.webkit.org/show_bug.cgi?id=78484
+
+        pywebsocket-0.7.1 follow the current draft of WebSocket deflate-frame extension.
+
+        Reviewed by Kent Tamura.
+
+        * Scripts/webkitpy/thirdparty/__init__.py:
+        (AutoinstallImportHook._install_pywebsocket):
+
+2012-02-12  Kangil Han  <kangil.han@samsung.com>
+
+        [EFL][DRT] Implement zoomPage{In,Out} and textZoom{In,Out} events.
+        https://bugs.webkit.org/show_bug.cgi?id=78091
+
+        Reviewed by Hajime Morita.
+
+        Implemented zoomPageIn, zoomPageOut, textZoomIn and textZoomOut events on EFL DRT.
+        This patch will activate around 1,900 test cases from skipped list in EFL port.
+
+        * DumpRenderTree/efl/EventSender.cpp:
+        (textZoom):
+        (pageZoom):
+        (textZoomInCallback):
+        (textZoomOutCallback):
+        (zoomPageInCallback):
+        (zoomPageOutCallback):
+
+2012-02-12  Ashod Nakashian  <ashodnakashian@yahoo.com>
+
+        KeywordLookupGenerator.py script fails in some cases
+        https://bugs.webkit.org/show_bug.cgi?id=77886
+
+        Reviewed by Benjamin Poulain.
+
+        * Scripts/webkitpy/style/checker.py: New rule for Keywords.table to not have CR.
+        * Scripts/webkitpy/style/checker_unittest.py: New UT for Keywords.table rule.
+        (GlobalVariablesTest.test_path_rules_specifier):
+
+2012-02-12  Joe Thomas  <joethomas@motorola.com>
+
+        Add toText and isTextNode helpers in Text class.
+        https://bugs.webkit.org/show_bug.cgi?id=78140
+
+        Unit test case for the new style checker introduced.
+
+        Reviewed by Adam Barth.
+
+        * Scripts/webkitpy/style/checkers/cpp_unittest.py:
+        (CppStyleTest):
+        (CppStyleTest.test_static_cast_readability): Added a unit test case.
+
+2012-02-12  Gyuyoung Kim  <gyuyoung.kim@samsung.com>
+
+        Enable features supported by EFL port in build-webkit.
+        https://bugs.webkit.org/show_bug.cgi?id=78348
+
+        Reviewed by Ryosuke Niwa.
+
+        Sync build-webkit with OptionEfl.cmake, as some features enabled in
+        OptionEfl.cmake are not enabled in build-webkit.
+
+        * Scripts/build-webkit:
+
+2012-02-12  Joe Thomas  <joethomas@motorola.com>
+
+        Add toText and isTextNode helpers in Text class.
+        https://bugs.webkit.org/show_bug.cgi?id=78140
+
+        Added a style checker to use toText rather than static_cast<Text*>.
+
+        Reviewed by Adam Barth.
+
+        * Scripts/webkitpy/style/checkers/cpp.py:
+        (check_language): Style checker for static_cast<Text*>.
+
+2012-02-12  Philippe Normand  <pnormand@igalia.com>
+
+        Unreviewed, disable Mutation observers build on GTK until it can
+        actually build.
+
+        * Scripts/build-webkit:
+
+2012-02-11  Benjamin Poulain  <benjamin@webkit.org>
+
+        Add back WTFURL to WebKit
+        https://bugs.webkit.org/show_bug.cgi?id=77291
+
+        Reviewed by Adam Barth.
+
+        Add a flag to build-webkit to easily build WebKit with WTFURL.
+
+        * Scripts/build-webkit:
+
+2012-02-10  Adam Klein  <adamk@chromium.org>
+
+        Enable MUTATION_OBSERVERS by default on all platforms
+        https://bugs.webkit.org/show_bug.cgi?id=78196
+
+        Reviewed by Ojan Vafai.
+
+        * Scripts/build-webkit:
+
+2012-02-10  Adam Barth  <abarth@webkit.org>
+
+        Move garden-o-matic's All Failures out of experimental
+        https://bugs.webkit.org/show_bug.cgi?id=78395
+
+        Reviewed by Dimitri Glazkov.
+
+        Several folks have tried this feature and found it useful.
+
+        * BuildSlaveSupport/build.webkit.org-config/public_html/TestFailures/scripts/ui.js:
+
+2012-02-10  Tim Horton  <timothy_horton@apple.com>
+
+        NRWT should categorize options in --help
+        https://bugs.webkit.org/show_bug.cgi?id=76221
+
+        Reviewed by Eric Seidel.
+        
+        Use optparse's OptionGroup mechanism to logically group NRWT's options,
+        providing a better experience when scanning all the options.
+
+        * Scripts/webkitpy/layout_tests/run_webkit_tests.py:
+        (parse_args):
+
+2012-02-10  Jesus Sanchez-Palencia  <jesus.palencia@openbossa.org>
+
+        [Qt][WK2] Refactor on Qt5 Layout tests' structure
+        https://bugs.webkit.org/show_bug.cgi?id=77450
+
+        Reviewed by Csaba Osztrogonác.
+
+        Fix the scripts and related unittest due to the rename of qt-wk2 and qt-wk1
+        to qt-5.0-wk2 and qt-5.0-wk1.
+
+        * Scripts/old-run-webkit-tests:
+        (buildPlatformResultHierarchy):
+        (readSkippedFiles):
+        * Scripts/webkitpy/layout_tests/port/qt.py:
+        (QtPort._wk2_port_name):
+        (QtPort._skipped_file_search_paths):
+        * Scripts/webkitpy/layout_tests/port/qt_unittest.py:
+        (QtPortTest.test_baseline_search_path):
+        * Scripts/webkitpy/layout_tests/port/webkit.py:
+        (WebKitPort._wk2_port_name):
+
+2012-02-09  Philippe Normand  <pnormand@igalia.com>
+
+        [GTK] EWS command-line option to run the tests
+        https://bugs.webkit.org/show_bug.cgi?id=78211
+
+        Reviewed by Adam Barth.
+
+        New --run-tests option (defaults to False) for the EWS commands.
+
+        * Scripts/webkitpy/tool/commands/earlywarningsystem.py:
+        (AbstractEarlyWarningSystem):
+        (AbstractEarlyWarningSystem.__init__):
+        (AbstractEarlyWarningSystem.review_patch):
+        (ChromiumLinuxEWS):
+        * Scripts/webkitpy/tool/commands/earlywarningsystem_unittest.py:
+        (EarlyWarningSytemTest._test_builder_ews):
+
+2012-02-09  Eric Seidel  <eric@webkit.org>
+
+        Rename compare_text and compare_audio to make it clear that they're !=
+        https://bugs.webkit.org/show_bug.cgi?id=78301
+
+        Reviewed by Adam Barth.
+
+        I also removed the maybe_create_directory function which was redundant.
+
+        * Scripts/webkitpy/layout_tests/controllers/manager.py:
+        (Manager.set_up_run):
+        * Scripts/webkitpy/layout_tests/controllers/test_result_writer.py:
+        (TestResultWriter._make_output_directory):
+        * Scripts/webkitpy/layout_tests/port/base.py:
+        (Port.do_text_results_differ):
+        (Port.do_audio_results_differ):
+        (Port.diff_text):
+        (Port.driver_name):
+        (Port.skips_perf_test):
+        * Scripts/webkitpy/layout_tests/port/win.py:
+        (WinPort.do_text_results_differ):
+        * Scripts/webkitpy/layout_tests/port/win_unittest.py:
+        (WinPortTest.test_do_text_results_differ):
+        * Scripts/webkitpy/layout_tests/servers/apache_http_server.py:
+        (LayoutTestApacheHttpd.__init__):
+        * Scripts/webkitpy/layout_tests/servers/http_server_base.py:
+        (HttpServerBase.__init__):
+        * Scripts/webkitpy/to_be_moved/rebaseline_chromium_webkit_tests.py:
+        (Rebaseliner._diff_baselines):
+
+2012-02-09  Zan Dobersek  <zandobersek@gmail.com>
+
+        [GTK] Add DRT support for modal dialogs
+        https://bugs.webkit.org/show_bug.cgi?id=53600
+
+        Reviewed by Martin Robinson.
+
+        Implement the modal dialogs handling in DumpRenderTree and GtkLauncher.
+        Most significantly, when creating a new web view in GtkLauncher, the window
+        of the web view opener is passed around. In DumpRenderTree, the window of
+        the main web view is always considered as the opener. This is required so
+        the modal dialog's toplevel can be made transient for the opener's toplevel.
+
+        * DumpRenderTree/gtk/DumpRenderTree.cpp:
+        (webViewRunModalDialog):
+        (createWebView):
+        * GtkLauncher/main.c:
+        (createWebViewCb):
+        (runModalDialogCb):
+        (createBrowser):
+        (createWindow):
+        (main):
+
+2012-02-09  Zan Dobersek  <zandobersek@gmail.com>
+
+        [Gtk] security/set-form-autocomplete-attribute.html fails
+        https://bugs.webkit.org/show_bug.cgi?id=78261
+
+        Reviewed by Martin Robinson.
+
+        Use the new helper in DumpRenderTreeSupportGtk to properly
+        test whether an element performs autocompletion.
+
+        * DumpRenderTree/gtk/LayoutTestControllerGtk.cpp:
+        (LayoutTestController::elementDoesAutoCompleteForElementWithId):
+
+2012-02-09  James Robinson  <jamesr@chromium.org>
+
+        [chromium] Enable mock scrollbars for compositing layout tests
+        https://bugs.webkit.org/show_bug.cgi?id=78299
+
+        Reviewed by Dirk Pranke.
+
+        This enables mock scrollbars by default for compositing tests. These pixel tests are intended to test the
+        compositor behavior, not native theming, and having real scrollbars causes us to have to maintain significantly
+        more pngs than we should and expose weird alpha bugs in our theming that doesn't impact real users.
+
+        * DumpRenderTree/chromium/TestShell.cpp:
+        (TestShell::runFileTest):
+        * DumpRenderTree/chromium/WebPreferences.cpp:
+        (WebPreferences::reset):
+        (WebPreferences::applyTo):
+        * DumpRenderTree/chromium/WebPreferences.h:
+        (WebPreferences):
+
+2012-02-09  Eric Seidel  <eric@webkit.org>
+
+        Remove more uses of "os" from our webkitpy code
+        https://bugs.webkit.org/show_bug.cgi?id=78292
+
+        Reviewed by Adam Barth.
+
+        * Scripts/webkitpy/common/checkout/checkout_mock.py:
+        (MockCheckout.__init__):
+        (MockCheckout.is_path_to_changelog):
+        * Scripts/webkitpy/common/net/bugzilla/bugzilla.py:
+        * Scripts/webkitpy/common/system/filesystem_mock.py:
+        (MockFileSystem._split):
+        * Scripts/webkitpy/common/system/zipfileset_unittest.py:
+        * Scripts/webkitpy/layout_tests/controllers/test_result_writer.py:
+        * Scripts/webkitpy/layout_tests/layout_package/json_results_generator.py:
+        * Scripts/webkitpy/layout_tests/port/webkit.py:
+        * Scripts/webkitpy/tool/bot/queueengine.py:
+        * Scripts/webkitpy/tool/bot/sheriff_unittest.py:
+        * Scripts/webkitpy/tool/commands/download.py:
+        * Scripts/webkitpy/tool/commands/earlywarningsystem_unittest.py:
+        * Scripts/webkitpy/tool/commands/rebaselineserver.py:
+        * Scripts/webkitpy/tool/commands/sheriffbot.py:
+        * Scripts/webkitpy/tool/commands/sheriffbot_unittest.py:
+        * Scripts/webkitpy/tool/commands/upload.py:
+        (CreateBug.prompt_for_bug_title_and_comment):
+        * Scripts/webkitpy/tool/servers/reflectionhandler.py:
+        * Scripts/webkitpy/tool/steps/attachtobug.py:
+        (AttachToBug.run):
+        * Scripts/webkitpy/tool/steps/checkstyle.py:
+        * Scripts/webkitpy/tool/steps/cleanworkingdirectory.py:
+        * Scripts/webkitpy/tool/steps/commit_unittest.py:
+        * Scripts/webkitpy/tool/steps/editchangelog.py:
+        * Scripts/webkitpy/tool/steps/preparechangelog.py:
+        * Scripts/webkitpy/tool/steps/preparechangelog_unittest.py:
+        (PrepareChangeLogTest.test_ensure_bug_url):
+        * Scripts/webkitpy/tool/steps/preparechangelogfordepsroll.py:
+        * Scripts/webkitpy/tool/steps/preparechangelogforrevert.py:
+        * Scripts/webkitpy/tool/steps/updatechangelogswithreviewer.py:
+        * Scripts/webkitpy/tool/steps/validatereviewer.py:
+
+2012-02-09  Eric Seidel  <eric@webkit.org>
+
+        Remove the cr-mac-ews (it's long been dead)
+        https://bugs.webkit.org/show_bug.cgi?id=78267
+
+        Reviewed by Adam Barth.
+
+        * QueueStatusServer/model/queues.py:
+        (Queue):
+        * Scripts/webkitpy/tool/commands/earlywarningsystem.py:
+        (ChromiumWindowsEWS):
+        * Scripts/webkitpy/tool/commands/earlywarningsystem_unittest.py:
+        (EarlyWarningSytemTest._test_builder_ews):
+        (EarlyWarningSytemTest._test_testing_ews):
+
+2012-02-09  Dirk Pranke  <dpranke@chromium.org>
+
+        some tests in webkitpy are being run three times
+        https://bugs.webkit.org/show_bug.cgi?id=78283
+
+        Reviewed by Ryosuke Niwa.
+
+        It turns out that if you import a class derived from
+        unittest.TestCase as a base name (e.g., from ... import ChangeLogTest),
+        the unittest framework treats it as if the class was defined in
+        the file (as well in the original file). This led us to running
+        the tests in ChangeLogTest three times.
+
+        * Scripts/webkitpy/tool/steps/preparechangelog_unittest.py:
+        (PrepareChangeLogTest):
+        * Scripts/webkitpy/tool/steps/preparechangelogforrevert_unittest.py:
+        (_assert_message_for_revert_output):
+
+2012-02-09  Adam Barth  <abarth@webkit.org>
+
+        Remove extraneous line in previous patch.  I forgot to remove this
+        before landing.
+
+        * Scripts/webkitpy/layout_tests/port/driver.py:
+        (DriverProxy.start):
+
+2012-02-09  Adam Barth  <abarth@webkit.org>
+
+        run-perf-tests should have an option to pause before running tests so we can attach Instruments
+        https://bugs.webkit.org/show_bug.cgi?id=78271
+
+        Reviewed by Ryosuke Niwa.
+
+        This lets me attach instruments to profile the performance of the test.
+
+        * Scripts/webkitpy/layout_tests/port/chromium.py:
+        (ChromiumDriver.start):
+        * Scripts/webkitpy/layout_tests/port/driver.py:
+        (Driver.start):
+        (DriverProxy.start):
+        * Scripts/webkitpy/layout_tests/port/server_process.py:
+        (ServerProcess.start):
+        * Scripts/webkitpy/layout_tests/port/test.py:
+        (TestDriver.start):
+        * Scripts/webkitpy/layout_tests/port/webkit.py:
+        (WebKitDriver.start):
+        * Scripts/webkitpy/layout_tests/run_webkit_tests_integrationtest.py:
+        (get_tests_run.RecordingTestDriver.start):
+        * Scripts/webkitpy/performance_tests/perftestsrunner.py:
+        (PerfTestsRunner._parse_args):
+        (PerfTestsRunner._run_tests_set):
+        * Scripts/webkitpy/performance_tests/perftestsrunner_unittest.py:
+        (start):
+        (test_run_test_set_kills_drt_per_run.TestDriverWithStopCount):
+        (test_run_test_set_kills_drt_per_run):
+        (test_run_test_set_kills_drt_per_run.TestDriverWithStartCount):
+        (test_run_test_set_kills_drt_per_run.TestDriverWithStartCount.start):
+
+2012-02-09  Adam Barth  <abarth@webkit.org>
+
+        run-perf-tests --chromium should run the chromium port
+        https://bugs.webkit.org/show_bug.cgi?id=78266
+
+        Reviewed by Ryosuke Niwa.
+
+        This patch makes run-perf-tests work more like run-webkit-tests.
+
+        * Scripts/webkitpy/performance_tests/perftestsrunner.py:
+        (PerfTestsRunner._parse_args):
+
+2012-02-09  Jesus Sanchez-Palencia  <jesus.palencia@openbossa.org>
+
+        [Qt][WK2] run-webkit-tests --qt  crashes if WEBKIT_TESTFONTS is not set
+        https://bugs.webkit.org/show_bug.cgi?id=77466
+
+        Reviewed by Dirk Pranke.
+
+        Replicate the behavior of old-run-webkit-tests and check if WEBKIT_TESTFONTS
+        is set or if we should raise an error. A unit test was added.
+
+        * Scripts/webkitpy/layout_tests/port/qt.py:
+        (QtPort.operating_system):
+        (QtPort):
+        (QtPort.check_sys_deps):
+        * Scripts/webkitpy/layout_tests/port/qt_unittest.py:
+        (QtPortTest.test_operating_system):
+        (QtPortTest):
+        (QtPortTest.test_check_sys_deps):
+
+2012-02-09  Eric Seidel  <eric@webkit.org>
+
+        Rename ports.WebKitPort to DeprecatedPort and make it stop being all class methods
+        https://bugs.webkit.org/show_bug.cgi?id=78263
+
+        Reviewed by Adam Barth.
+
+        * Scripts/webkitpy/common/config/ports.py:
+        (DeprecatedPort):
+        (DeprecatedPort.name):
+        (DeprecatedPort.flag):
+        (DeprecatedPort.script_path):
+        (DeprecatedPort.script_shell_command):
+        (DeprecatedPort.port):
+        (DeprecatedPort.makeArgs):
+        (DeprecatedPort.update_webkit_command):
+        (DeprecatedPort.check_webkit_style_command):
+        (DeprecatedPort.prepare_changelog_command):
+        (DeprecatedPort.build_webkit_command):
+        (DeprecatedPort.run_javascriptcore_tests_command):
+        (DeprecatedPort.run_webkit_unit_tests_command):
+        (DeprecatedPort.run_webkit_tests_command):
+        (DeprecatedPort.run_python_unittests_command):
+        (DeprecatedPort.run_perl_unittests_command):
+        (DeprecatedPort.layout_tests_results_path):
+        (MacPort):
+        (WinPort):
+        (GtkPort):
+        (GtkPort.build_webkit_command):
+        (GtkPort.run_webkit_tests_command):
+        (QtPort):
+        (QtPort.build_webkit_command):
+        (EflPort):
+        (EflPort.build_webkit_command):
+        (ChromiumPort):
+        (ChromiumPort.update_webkit_command):
+        (ChromiumPort.build_webkit_command):
+        (ChromiumPort.run_webkit_tests_command):
+        (ChromiumPort.run_javascriptcore_tests_command):
+        (ChromiumXVFBPort):
+        (ChromiumXVFBPort.run_webkit_tests_command):
+        * Scripts/webkitpy/common/config/ports_unittest.py:
+        (DeprecatedPortTest):
+        (DeprecatedPortTest.test_mac_port):
+        (DeprecatedPortTest.test_gtk_port):
+        (DeprecatedPortTest.test_qt_port):
+        (DeprecatedPortTest.test_chromium_port):
+        (DeprecatedPortTest.test_chromium_xvfb_port):
+        * Scripts/webkitpy/tool/commands/earlywarningsystem.py:
+        (AbstractEarlyWarningSystem.__init__):
+        * Scripts/webkitpy/tool/commands/sheriffbot.py:
+        * Scripts/webkitpy/tool/main.py:
+        (WebKitPatch):
+        (WebKitPatch.handle_global_options):
+        * Scripts/webkitpy/tool/steps/abstractstep.py:
+        * Scripts/webkitpy/tool/steps/steps_unittest.py:
+        (StepsTest.test_runtests_args):
+
+2012-02-09  Jochen Eisinger  <jochen@chromium.org>
+
+        [chromium] always initialize makeArgs in buildChromiumNinja
+        https://bugs.webkit.org/show_bug.cgi?id=78231
+
+        Reviewed by Tony Gentilcore.
+
+        * Scripts/webkitdirs.pm:
+        (buildChromiumNinja):
+
+2012-02-09  Carlos Garcia Campos  <cgarcia@igalia.com>
+
+        [GTK] Show url of current hovered link in MiniBrowser
+        https://bugs.webkit.org/show_bug.cgi?id=78098
+
+        Reviewed by Martin Robinson.
+
+        * MiniBrowser/gtk/BrowserWindow.c:
+        (webViewMouseTargetChanged): Check whether hit test result is a
+        link and use the url to update the status bar text.
+        (browserWindowConstructed): Connect to
+        WebKitWebView::mouse-target-changed signal.
+
+2012-02-09  Rob Buis  <rbuis@rim.com>
+
+        [BlackBerry] Upstream DumpRenderTreeBlackBerry
+        https://bugs.webkit.org/show_bug.cgi?id=78042
+
+        Reviewed by Antonio Gomes.
+
+        Upstream final part of our DRT implementation.
+
+        * DumpRenderTree/blackberry/LayoutTestControllerBlackBerry.cpp: Added.
+        * DumpRenderTree/blackberry/PNGImageEncoder.cpp: Added.
+        * DumpRenderTree/blackberry/PNGImageEncoder.h: Added.
+        * DumpRenderTree/blackberry/PixelDumpSupportBlackBerry.cpp: Added.
+        * DumpRenderTree/blackberry/PixelDumpSupportBlackBerry.h: Added.
+
 2012-02-09  Ryosuke Niwa  <rniwa@webkit.org>
 
         kill-old-processes should kill gcc and clang
@@ -2290,7 +4779,7 @@
         run-perf-test should include relative file paths in test names
         https://bugs.webkit.org/show_bug.cgi?id=77144
 
-        Reviewed by Adam Birth.
+        Reviewed by Adam Barth.
 
         Include all directory names in the test name separated by "/".
         e.g. Bindings/event-target-wrapper.html translates to Bindings/event-target-wrapper
diff --git a/Tools/DumpRenderTree/DumpRenderTree.gyp/DumpRenderTree.gyp b/Tools/DumpRenderTree/DumpRenderTree.gyp/DumpRenderTree.gyp
index 02378cb6c..774ca9008 100644
--- a/Tools/DumpRenderTree/DumpRenderTree.gyp/DumpRenderTree.gyp
+++ b/Tools/DumpRenderTree/DumpRenderTree.gyp/DumpRenderTree.gyp
@@ -231,6 +231,9 @@
                     'dependencies': [
                         'ImageDiff#host',
                     ],
+                    'sources/': [
+                        ['include', 'chromium/TestShellLinux\\.cpp$'],
+                    ],
                 },{ # OS!="android"
                     'sources/': [
                         ['exclude', '(Android)\\.cpp$']
diff --git a/Tools/DumpRenderTree/DumpRenderTreePrefix.h b/Tools/DumpRenderTree/DumpRenderTreePrefix.h
index 1344754a6..010ca019d 100644
--- a/Tools/DumpRenderTree/DumpRenderTreePrefix.h
+++ b/Tools/DumpRenderTree/DumpRenderTreePrefix.h
@@ -32,7 +32,11 @@
 
 #endif
 
+#if defined(WIN32) || defined(_WIN32)
+
 // If we don't define these, they get defined in windef.h. 
 // We want to use std::min and std::max
 #define max max
 #define min min
+
+#endif
diff --git a/Tools/DumpRenderTree/LayoutTestController.cpp b/Tools/DumpRenderTree/LayoutTestController.cpp
index ae1164e5a..077b08238 100644
--- a/Tools/DumpRenderTree/LayoutTestController.cpp
+++ b/Tools/DumpRenderTree/LayoutTestController.cpp
@@ -1886,22 +1886,6 @@ static JSValueRef pauseTransitionAtTimeOnElementWithIdCallback(JSContextRef cont
     return JSValueMakeBoolean(context, controller->pauseTransitionAtTimeOnElementWithId(propertyName.get(), time, elementId.get()));
 }
 
-static JSValueRef sampleSVGAnimationForElementAtTimeCallback(JSContextRef context, JSObjectRef function, JSObjectRef thisObject, size_t argumentCount, const JSValueRef arguments[], JSValueRef* exception)
-{
-    if (argumentCount != 3)
-        return JSValueMakeUndefined(context);
-
-    JSRetainPtr<JSStringRef> animationId(Adopt, JSValueToStringCopy(context, arguments[0], exception));
-    ASSERT(!*exception);
-    double time = JSValueToNumber(context, arguments[1], exception);
-    ASSERT(!*exception);
-    JSRetainPtr<JSStringRef> elementId(Adopt, JSValueToStringCopy(context, arguments[2], exception));
-    ASSERT(!*exception);
-
-    LayoutTestController* controller = static_cast<LayoutTestController*>(JSObjectGetPrivate(thisObject));
-    return JSValueMakeBoolean(context, controller->sampleSVGAnimationForElementAtTime(animationId.get(), time, elementId.get()));
-}
-
 static JSValueRef numberOfActiveAnimationsCallback(JSContextRef context, JSObjectRef function, JSObjectRef thisObject, size_t argumentCount, const JSValueRef arguments[], JSValueRef* exception)
 {
     if (argumentCount != 0)
@@ -2421,7 +2405,6 @@ JSStaticFunction* LayoutTestController::staticFunctions()
         { "pathToLocalResource", pathToLocalResourceCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
         { "pauseAnimationAtTimeOnElementWithId", pauseAnimationAtTimeOnElementWithIdCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
         { "pauseTransitionAtTimeOnElementWithId", pauseTransitionAtTimeOnElementWithIdCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
-        { "sampleSVGAnimationForElementAtTime", sampleSVGAnimationForElementAtTimeCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
         { "printToPDF", dumpAsPDFCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
         { "queueBackNavigation", queueBackNavigationCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
         { "queueForwardNavigation", queueForwardNavigationCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
diff --git a/Tools/DumpRenderTree/LayoutTestController.h b/Tools/DumpRenderTree/LayoutTestController.h
index 6617cfe27..45265db6d 100644
--- a/Tools/DumpRenderTree/LayoutTestController.h
+++ b/Tools/DumpRenderTree/LayoutTestController.h
@@ -292,7 +292,6 @@ public:
     
     bool pauseAnimationAtTimeOnElementWithId(JSStringRef animationName, double time, JSStringRef elementId);
     bool pauseTransitionAtTimeOnElementWithId(JSStringRef propertyName, double time, JSStringRef elementId);
-    bool sampleSVGAnimationForElementAtTime(JSStringRef animationId, double time, JSStringRef elementId);
     unsigned numberOfActiveAnimations() const;
     void suspendAnimations() const;
     void resumeAnimations() const;
diff --git a/Tools/DumpRenderTree/TestNetscapePlugIn/PluginTest.cpp b/Tools/DumpRenderTree/TestNetscapePlugIn/PluginTest.cpp
index 989e16d8f..65dcaecd3 100644
--- a/Tools/DumpRenderTree/TestNetscapePlugIn/PluginTest.cpp
+++ b/Tools/DumpRenderTree/TestNetscapePlugIn/PluginTest.cpp
@@ -29,7 +29,7 @@
 #include <assert.h>
 #include <string.h>
 
-#if defined(ANDROID)
+#if defined(XP_UNIX) || defined(ANDROID)
 #include <unistd.h>
 #endif
 
diff --git a/Tools/DumpRenderTree/TestNetscapePlugIn/main.cpp b/Tools/DumpRenderTree/TestNetscapePlugIn/main.cpp
index c07bb2739..81fd33cb8 100644
--- a/Tools/DumpRenderTree/TestNetscapePlugIn/main.cpp
+++ b/Tools/DumpRenderTree/TestNetscapePlugIn/main.cpp
@@ -773,7 +773,7 @@ NPError NPP_GetValue(NPP instance, NPPVariable variable, void *value)
         return NPERR_NO_ERROR;
     }
     if (variable == NPPVpluginDescriptionString) {
-        *((char **)value) = const_cast<char*>("Simple Netscape plug-in that handles test content for WebKit");
+        *((char **)value) = const_cast<char*>("Simple Netscape® plug-in that handles test content for WebKit");
         return NPERR_NO_ERROR;
     }
     if (variable == NPPVpluginNeedsXEmbed) {
diff --git a/Tools/DumpRenderTree/unix/TestNetscapePlugin/ForwardingHeaders/WebKit/npapi.h b/Tools/DumpRenderTree/TestNetscapePlugIn/unix/ForwardingHeaders/WebKit/npapi.h
index 627bc97a9..627bc97a9 100644
--- a/Tools/DumpRenderTree/unix/TestNetscapePlugin/ForwardingHeaders/WebKit/npapi.h
+++ b/Tools/DumpRenderTree/TestNetscapePlugIn/unix/ForwardingHeaders/WebKit/npapi.h
diff --git a/Tools/DumpRenderTree/unix/TestNetscapePlugin/ForwardingHeaders/WebKit/npfunctions.h b/Tools/DumpRenderTree/TestNetscapePlugIn/unix/ForwardingHeaders/WebKit/npfunctions.h
index 54a603dbb..54a603dbb 100644
--- a/Tools/DumpRenderTree/unix/TestNetscapePlugin/ForwardingHeaders/WebKit/npfunctions.h
+++ b/Tools/DumpRenderTree/TestNetscapePlugIn/unix/ForwardingHeaders/WebKit/npfunctions.h
diff --git a/Tools/DumpRenderTree/unix/TestNetscapePlugin/ForwardingHeaders/WebKit/npruntime.h b/Tools/DumpRenderTree/TestNetscapePlugIn/unix/ForwardingHeaders/WebKit/npruntime.h
index e435ae2ab..e435ae2ab 100644
--- a/Tools/DumpRenderTree/unix/TestNetscapePlugin/ForwardingHeaders/WebKit/npruntime.h
+++ b/Tools/DumpRenderTree/TestNetscapePlugIn/unix/ForwardingHeaders/WebKit/npruntime.h
diff --git a/Tools/DumpRenderTree/blackberry/LayoutTestControllerBlackBerry.cpp b/Tools/DumpRenderTree/blackberry/LayoutTestControllerBlackBerry.cpp
new file mode 100644
index 000000000..14901aed6
--- /dev/null
+++ b/Tools/DumpRenderTree/blackberry/LayoutTestControllerBlackBerry.cpp
@@ -0,0 +1,899 @@
+/*
+ * Copyright (C) 2009, 2010, 2012 Research In Motion Limited. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+#include "config.h"
+#include "LayoutTestController.h"
+
+#include "CString.h"
+#include "DatabaseTracker.h"
+#include "Document.h"
+#include "DocumentLoader.h"
+#include "DocumentMarker.h"
+#include "DumpRenderTree.h"
+#include "DumpRenderTreeBlackBerry.h"
+#include "DumpRenderTreeSupport.h"
+#include "EditingBehaviorTypes.h"
+#include "EditorClientBlackBerry.h"
+#include "Element.h"
+#include "Frame.h"
+#include "HTMLInputElement.h"
+#include "JSElement.h"
+#include "KURL.h"
+#include "NotImplemented.h"
+#include "OwnArrayPtr.h"
+#include "Page.h"
+#include "RenderTreeAsText.h"
+#include "SchemeRegistry.h"
+#include "SecurityOrigin.h"
+#include "SecurityPolicy.h"
+#include "Settings.h"
+#include "UnusedParam.h"
+#include "WorkQueue.h"
+#include "WorkQueueItem.h"
+#include "WorkerThread.h"
+
+#include <JavaScriptCore/APICast.h>
+#include <SharedPointer.h>
+#include <WebPage.h>
+#include <WebSettings.h>
+
+using WebCore::toElement;
+using WebCore::toJS;
+
+LayoutTestController::~LayoutTestController()
+{
+}
+
+void LayoutTestController::addDisallowedURL(JSStringRef url)
+{
+    UNUSED_PARAM(url);
+    notImplemented();
+}
+
+void LayoutTestController::clearAllDatabases()
+{
+#if ENABLE(DATABASE)
+    WebCore::DatabaseTracker::tracker().deleteAllDatabases();
+#endif
+}
+
+void LayoutTestController::clearBackForwardList()
+{
+    BlackBerry::WebKit::DumpRenderTree::currentInstance()->page()->clearBackForwardList(true);
+}
+
+void LayoutTestController::clearPersistentUserStyleSheet()
+{
+    notImplemented();
+}
+
+JSStringRef LayoutTestController::copyDecodedHostName(JSStringRef name)
+{
+    UNUSED_PARAM(name);
+    notImplemented();
+    return 0;
+}
+
+JSStringRef LayoutTestController::copyEncodedHostName(JSStringRef name)
+{
+    UNUSED_PARAM(name);
+    notImplemented();
+    return 0;
+}
+
+void LayoutTestController::dispatchPendingLoadRequests()
+{
+    notImplemented();
+}
+
+void LayoutTestController::display()
+{
+    notImplemented();
+}
+
+static WTF::String jsStringRefToWebCoreString(JSStringRef str)
+{
+    size_t strArrSize = JSStringGetMaximumUTF8CStringSize(str);
+    OwnArrayPtr<char> strArr = adoptArrayPtr(new char[strArrSize]);
+    JSStringGetUTF8CString(str, strArr.get(), strArrSize);
+    return WTF::String::fromUTF8(strArr.get());
+}
+
+void LayoutTestController::execCommand(JSStringRef name, JSStringRef value)
+{
+    if (!mainFrame)
+        return;
+
+    WTF::String nameStr = jsStringRefToWebCoreString(name);
+    WTF::String valueStr = jsStringRefToWebCoreString(value);
+
+    mainFrame->editor()->command(nameStr).execute(valueStr);
+}
+
+bool LayoutTestController::isCommandEnabled(JSStringRef name)
+{
+    if (!mainFrame)
+        return false;
+
+    WTF::String nameStr = jsStringRefToWebCoreString(name);
+
+    return mainFrame->editor()->command(nameStr).isEnabled();
+}
+
+void LayoutTestController::keepWebHistory()
+{
+    notImplemented();
+}
+
+void LayoutTestController::notifyDone()
+{
+    if (m_waitToDump && (!topLoadingFrame || BlackBerry::WebKit::DumpRenderTree::currentInstance()->loadFinished()) && !WorkQueue::shared()->count())
+        dump();
+
+    m_waitToDump = false;
+    waitForPolicy = false;
+}
+
+JSStringRef LayoutTestController::pathToLocalResource(JSContextRef, JSStringRef url)
+{
+    return JSStringRetain(url);
+}
+
+void LayoutTestController::queueLoad(JSStringRef url, JSStringRef target)
+{
+    size_t urlArrSize = JSStringGetMaximumUTF8CStringSize(url);
+    OwnArrayPtr<char> urlArr = adoptArrayPtr(new char[urlArrSize]);
+    JSStringGetUTF8CString(url, urlArr.get(), urlArrSize);
+
+    WebCore::KURL base = mainFrame->loader()->documentLoader()->response().url();
+    WebCore::KURL absolute(base, urlArr.get());
+
+    JSRetainPtr<JSStringRef> absoluteURL(Adopt, JSStringCreateWithUTF8CString(absolute.string().utf8().data()));
+    WorkQueue::shared()->queue(new LoadItem(absoluteURL.get(), target));
+}
+
+void LayoutTestController::setAcceptsEditing(bool acceptsEditing)
+{
+    BlackBerry::WebKit::DumpRenderTree::currentInstance()->setAcceptsEditing(acceptsEditing);
+}
+
+void LayoutTestController::setAppCacheMaximumSize(unsigned long long quota)
+{
+    UNUSED_PARAM(quota);
+    notImplemented();
+}
+
+void LayoutTestController::setAuthorAndUserStylesEnabled(bool enable)
+{
+    mainFrame->page()->settings()->setAuthorAndUserStylesEnabled(enable);
+}
+
+void LayoutTestController::setCacheModel(int)
+{
+    notImplemented();
+}
+
+void LayoutTestController::setCustomPolicyDelegate(bool setDelegate, bool permissive)
+{
+    UNUSED_PARAM(setDelegate);
+    UNUSED_PARAM(permissive);
+    notImplemented();
+}
+
+void LayoutTestController::clearApplicationCacheForOrigin(OpaqueJSString*)
+{
+    // FIXME: Implement to support deleting all application caches for an origin.
+    notImplemented();
+}
+
+long long LayoutTestController::localStorageDiskUsageForOrigin(JSStringRef)
+{
+    // FIXME: Implement to support getting disk usage in bytes for an origin.
+    notImplemented();
+    return 0;
+}
+
+JSValueRef LayoutTestController::originsWithApplicationCache(JSContextRef context)
+{
+    // FIXME: Implement to get origins that contain application caches.
+    notImplemented();
+    return JSValueMakeUndefined(context);
+}
+
+void LayoutTestController::setDatabaseQuota(unsigned long long quota)
+{
+    if (!mainFrame)
+        return;
+
+    WebCore::DatabaseTracker::tracker().setQuota(mainFrame->document()->securityOrigin(), quota);
+}
+
+void LayoutTestController::setDomainRelaxationForbiddenForURLScheme(bool forbidden, JSStringRef scheme)
+{
+    WebCore::SchemeRegistry::setDomainRelaxationForbiddenForURLScheme(forbidden, jsStringRefToWebCoreString(scheme));
+}
+
+void LayoutTestController::setIconDatabaseEnabled(bool iconDatabaseEnabled)
+{
+    UNUSED_PARAM(iconDatabaseEnabled);
+    notImplemented();
+}
+
+void LayoutTestController::setJavaScriptProfilingEnabled(bool profilingEnabled)
+{
+    UNUSED_PARAM(profilingEnabled);
+    notImplemented();
+}
+
+void LayoutTestController::setMainFrameIsFirstResponder(bool flag)
+{
+    UNUSED_PARAM(flag);
+    notImplemented();
+}
+
+void LayoutTestController::setPersistentUserStyleSheetLocation(JSStringRef path)
+{
+    UNUSED_PARAM(path);
+    notImplemented();
+}
+
+void LayoutTestController::setPopupBlockingEnabled(bool flag)
+{
+    BlackBerry::WebKit::DumpRenderTree::currentInstance()->page()->settings()->setJavaScriptOpenWindowsAutomatically(!flag);
+}
+
+void LayoutTestController::setPrivateBrowsingEnabled(bool flag)
+{
+    UNUSED_PARAM(flag);
+    notImplemented();
+}
+
+void LayoutTestController::setXSSAuditorEnabled(bool flag)
+{
+    BlackBerry::WebKit::DumpRenderTree::currentInstance()->page()->settings()->setXSSAuditorEnabled(flag);
+}
+
+void LayoutTestController::setSelectTrailingWhitespaceEnabled(bool flag)
+{
+    BlackBerry::WebKit::DumpRenderTree::currentInstance()->setSelectTrailingWhitespaceEnabled(flag);
+}
+
+void LayoutTestController::setSmartInsertDeleteEnabled(bool flag)
+{
+    UNUSED_PARAM(flag);
+    notImplemented();
+}
+
+void LayoutTestController::setTabKeyCyclesThroughElements(bool cycles)
+{
+    if (!mainFrame)
+        return;
+
+    mainFrame->page()->setTabKeyCyclesThroughElements(cycles);
+}
+
+void LayoutTestController::setUseDashboardCompatibilityMode(bool flag)
+{
+    UNUSED_PARAM(flag);
+    notImplemented();
+}
+
+void LayoutTestController::setUserStyleSheetEnabled(bool flag)
+{
+    UNUSED_PARAM(flag);
+    notImplemented();
+}
+
+void LayoutTestController::setUserStyleSheetLocation(JSStringRef path)
+{
+    WTF::String pathStr = jsStringRefToWebCoreString(path);
+    BlackBerry::WebKit::DumpRenderTree::currentInstance()->page()->settings()->setUserStyleSheetLocation(pathStr.utf8().data());
+}
+
+void LayoutTestController::waitForPolicyDelegate()
+{
+    setWaitToDump(true);
+    waitForPolicy = true;
+}
+
+size_t LayoutTestController::webHistoryItemCount()
+{
+    SharedArray<BlackBerry::WebKit::WebPage::BackForwardEntry> backForwardList;
+    unsigned size;
+    BlackBerry::WebKit::DumpRenderTree::currentInstance()->page()->getBackForwardList(backForwardList, size);
+    return size;
+}
+
+int LayoutTestController::windowCount()
+{
+    notImplemented();
+    return 0;
+}
+
+bool LayoutTestController::elementDoesAutoCompleteForElementWithId(JSStringRef id)
+{
+    UNUSED_PARAM(id);
+    notImplemented();
+    return false;
+}
+
+JSRetainPtr<JSStringRef> LayoutTestController::pageProperty(const char* propertyName, int pageNumber) const
+{
+    UNUSED_PARAM(propertyName);
+    UNUSED_PARAM(pageNumber);
+    notImplemented();
+    return 0;
+}
+
+void LayoutTestController::setWaitToDump(bool waitToDump)
+{
+    // Change from 30s to 35s because some test cases in multipart need 30 seconds,
+    // refer to http/tests/multipart/resources/multipart-wait-before-boundary.php please.
+    static const double kWaitToDumpWatchdogInterval = 35.0;
+    m_waitToDump = waitToDump;
+    if (m_waitToDump)
+        BlackBerry::WebKit::DumpRenderTree::currentInstance()->setWaitToDumpWatchdog(kWaitToDumpWatchdogInterval);
+}
+
+void LayoutTestController::setWindowIsKey(bool windowIsKey)
+{
+    m_windowIsKey = windowIsKey;
+    notImplemented();
+}
+
+bool LayoutTestController::pauseAnimationAtTimeOnElementWithId(JSStringRef animationName, double time, JSStringRef elementId)
+{
+    if (!mainFrame)
+        return false;
+
+    int nameLen = JSStringGetMaximumUTF8CStringSize(animationName);
+    int idLen = JSStringGetMaximumUTF8CStringSize(elementId);
+    OwnArrayPtr<char> name = adoptArrayPtr(new char[nameLen]);
+    OwnArrayPtr<char> eId = adoptArrayPtr(new char[idLen]);
+
+    JSStringGetUTF8CString(animationName, name.get(), nameLen);
+    JSStringGetUTF8CString(elementId, eId.get(), idLen);
+
+    WebCore::AnimationController* animationController = mainFrame->animation();
+    if (!animationController)
+        return false;
+
+    WebCore::Node* node = mainFrame->document()->getElementById(eId.get());
+    if (!node || !node->renderer())
+        return false;
+
+    return animationController->pauseAnimationAtTime(node->renderer(), name.get(), time);
+}
+
+bool LayoutTestController::pauseTransitionAtTimeOnElementWithId(JSStringRef propertyName, double time, JSStringRef elementId)
+{
+    if (!mainFrame)
+        return false;
+
+    int nameLen = JSStringGetMaximumUTF8CStringSize(propertyName);
+    int idLen = JSStringGetMaximumUTF8CStringSize(elementId);
+    OwnArrayPtr<char> name = adoptArrayPtr(new char[nameLen]);
+    OwnArrayPtr<char> eId = adoptArrayPtr(new char[idLen]);
+
+    JSStringGetUTF8CString(propertyName, name.get(), nameLen);
+    JSStringGetUTF8CString(elementId, eId.get(), idLen);
+
+    WebCore::AnimationController* animationController = mainFrame->animation();
+    if (!animationController)
+        return false;
+
+    WebCore::Node* node = mainFrame->document()->getElementById(eId.get());
+    if (!node || !node->renderer())
+        return false;
+
+    return animationController->pauseTransitionAtTime(node->renderer(), name.get(), time);
+}
+
+unsigned LayoutTestController::numberOfActiveAnimations() const
+{
+    if (!mainFrame)
+        return false;
+
+    WebCore::AnimationController* animationController = mainFrame->animation();
+    if (!animationController)
+        return false;
+
+    return animationController->numberOfActiveAnimations(mainFrame->document());
+}
+
+unsigned int LayoutTestController::workerThreadCount() const
+{
+#if ENABLE_WORKERS
+    return WebCore::WorkerThread::workerThreadCount();
+#else
+    return 0;
+#endif
+}
+
+void LayoutTestController::removeAllVisitedLinks()
+{
+    notImplemented();
+}
+
+void LayoutTestController::disableImageLoading()
+{
+    BlackBerry::WebKit::DumpRenderTree::currentInstance()->page()->settings()->setLoadsImagesAutomatically(false);
+}
+
+JSRetainPtr<JSStringRef> LayoutTestController::counterValueForElementById(JSStringRef id)
+{
+    WTF::String idStr = jsStringRefToWebCoreString(id);
+    WebCore::Element* coreElement = mainFrame->document()->getElementById(AtomicString(idStr));
+    if (!coreElement)
+        return 0;
+
+    CString counterValueStr = counterValueForElement(coreElement).utf8();
+    if (counterValueStr.isNull())
+        return 0;
+
+    JSRetainPtr<JSStringRef> counterValue(Adopt, JSStringCreateWithUTF8CString(counterValueStr.data()));
+    return counterValue;
+}
+
+void LayoutTestController::overridePreference(JSStringRef key, JSStringRef value)
+{
+    if (!mainFrame)
+        return;
+
+    WTF::String keyStr = jsStringRefToWebCoreString(key);
+    WTF::String valueStr = jsStringRefToWebCoreString(value);
+
+    if (keyStr == "WebKitUsesPageCachePreferenceKey")
+        BlackBerry::WebKit::DumpRenderTree::currentInstance()->page()->settings()->setMaximumPagesInCache(1);
+    else if (keyStr == "WebKitUsePreHTML5ParserQuirks")
+        mainFrame->page()->settings()->setUsePreHTML5ParserQuirks(true);
+    else if (keyStr == "WebKitTabToLinksPreferenceKey")
+        DumpRenderTreeSupport::setLinksIncludedInFocusChain(valueStr == "true" || valueStr == "1");
+    else if (keyStr == "WebKitHyperlinkAuditingEnabled")
+        mainFrame->page()->settings()->setHyperlinkAuditingEnabled(valueStr == "true" || valueStr == "1");
+}
+
+void LayoutTestController::setAlwaysAcceptCookies(bool alwaysAcceptCookies)
+{
+    UNUSED_PARAM(alwaysAcceptCookies);
+    notImplemented();
+}
+
+void LayoutTestController::setMockGeolocationPosition(double latitude, double longitude, double accuracy)
+{
+    DumpRenderTreeSupport::setMockGeolocationPosition(BlackBerry::WebKit::DumpRenderTree::currentInstance()->page(), latitude, longitude, accuracy);
+}
+
+void LayoutTestController::setMockGeolocationError(int code, JSStringRef message)
+{
+    WTF::String messageStr = jsStringRefToWebCoreString(message);
+    DumpRenderTreeSupport::setMockGeolocationError(BlackBerry::WebKit::DumpRenderTree::currentInstance()->page(), code, messageStr);
+}
+
+void LayoutTestController::showWebInspector()
+{
+    notImplemented();
+}
+
+void LayoutTestController::closeWebInspector()
+{
+    notImplemented();
+}
+
+void LayoutTestController::evaluateInWebInspector(long callId, JSStringRef script)
+{
+    UNUSED_PARAM(callId);
+    UNUSED_PARAM(script);
+    notImplemented();
+}
+
+void LayoutTestController::evaluateScriptInIsolatedWorld(unsigned worldID, JSObjectRef globalObject, JSStringRef script)
+{
+    UNUSED_PARAM(worldID);
+    UNUSED_PARAM(globalObject);
+    UNUSED_PARAM(script);
+    notImplemented();
+}
+
+void LayoutTestController::addUserScript(JSStringRef source, bool runAtStart, bool allFrames)
+{
+    UNUSED_PARAM(source);
+    UNUSED_PARAM(runAtStart);
+    UNUSED_PARAM(allFrames);
+    notImplemented();
+}
+
+void LayoutTestController::addUserStyleSheet(JSStringRef, bool)
+{
+    notImplemented();
+}
+
+JSRetainPtr<JSStringRef> LayoutTestController::pageSizeAndMarginsInPixels(int, int, int, int, int, int, int) const
+{
+    notImplemented();
+    return 0;
+}
+
+int LayoutTestController::pageNumberForElementById(JSStringRef, float, float)
+{
+    notImplemented();
+    return -1;
+}
+
+int LayoutTestController::numberOfPages(float, float)
+{
+    notImplemented();
+    return -1;
+}
+
+bool LayoutTestController::isPageBoxVisible(int) const
+{
+    notImplemented();
+    return false;
+}
+
+void LayoutTestController::setScrollbarPolicy(JSStringRef, JSStringRef)
+{
+    notImplemented();
+}
+
+void LayoutTestController::setWebViewEditable(bool)
+{
+    notImplemented();
+}
+
+void LayoutTestController::authenticateSession(JSStringRef url, JSStringRef username, JSStringRef password)
+{
+    notImplemented();
+}
+
+bool LayoutTestController::callShouldCloseOnWebView()
+{
+    notImplemented();
+    return false;
+}
+
+void LayoutTestController::setFrameFlatteningEnabled(bool enable)
+{
+    BlackBerry::WebKit::DumpRenderTree::currentInstance()->page()->settings()->setFrameFlatteningEnabled(enable);
+}
+
+void LayoutTestController::setSpatialNavigationEnabled(bool enable)
+{
+    notImplemented();
+}
+
+void LayoutTestController::addOriginAccessWhitelistEntry(JSStringRef sourceOrigin, JSStringRef destinationProtocol, JSStringRef destinationHost, bool allowDestinationSubdomains)
+{
+    WebCore::SecurityPolicy::addOriginAccessWhitelistEntry(*WebCore::SecurityOrigin::createFromString(jsStringRefToWebCoreString(sourceOrigin)),
+                                                  jsStringRefToWebCoreString(destinationProtocol),
+                                                  jsStringRefToWebCoreString(destinationHost),
+                                                  allowDestinationSubdomains);
+}
+
+void LayoutTestController::removeOriginAccessWhitelistEntry(JSStringRef sourceOrigin, JSStringRef destinationProtocol, JSStringRef destinationHost, bool allowDestinationSubdomains)
+{
+    WebCore::SecurityPolicy::removeOriginAccessWhitelistEntry(*WebCore::SecurityOrigin::createFromString(jsStringRefToWebCoreString(sourceOrigin)),
+                                                     jsStringRefToWebCoreString(destinationProtocol),
+                                                     jsStringRefToWebCoreString(destinationHost),
+                                                     allowDestinationSubdomains);
+}
+
+void LayoutTestController::setAllowFileAccessFromFileURLs(bool enabled)
+{
+    if (!mainFrame)
+        return;
+
+    mainFrame->page()->settings()->setAllowFileAccessFromFileURLs(enabled);
+}
+
+void LayoutTestController::setAllowUniversalAccessFromFileURLs(bool enabled)
+{
+    if (!mainFrame)
+        return;
+
+    mainFrame->page()->settings()->setAllowUniversalAccessFromFileURLs(enabled);
+}
+
+void LayoutTestController::apiTestNewWindowDataLoadBaseURL(JSStringRef utf8Data, JSStringRef baseURL)
+{
+    notImplemented();
+}
+
+void LayoutTestController::apiTestGoToCurrentBackForwardItem()
+{
+    notImplemented();
+}
+
+void LayoutTestController::setJavaScriptCanAccessClipboard(bool flag)
+{
+    BlackBerry::WebKit::DumpRenderTree::currentInstance()->page()->setJavaScriptCanAccessClipboard(flag);
+}
+
+JSValueRef LayoutTestController::computedStyleIncludingVisitedInfo(JSContextRef context, JSValueRef value)
+{
+    return DumpRenderTreeSupport::computedStyleIncludingVisitedInfo(context, value);
+}
+
+JSRetainPtr<JSStringRef> LayoutTestController::layerTreeAsText() const
+{
+    notImplemented();
+    return 0;
+}
+
+JSRetainPtr<JSStringRef> LayoutTestController::markerTextForListItem(JSContextRef context, JSValueRef nodeObject) const
+{
+    WebCore::Element* element = toElement(toJS(toJS(context), nodeObject));
+    if (!element)
+        return 0;
+
+    JSRetainPtr<JSStringRef> markerText(Adopt, JSStringCreateWithUTF8CString(WebCore::markerTextForListItem(element).utf8().data()));
+    return markerText;
+}
+
+void LayoutTestController::setPluginsEnabled(bool flag)
+{
+    notImplemented();
+}
+
+void LayoutTestController::setEditingBehavior(const char* editingBehavior)
+{
+    if (!mainFrame)
+        return;
+    WebCore::EditingBehaviorType type = WebCore::EditingUnixBehavior;
+    if (!strcmp(editingBehavior, "win"))
+        type = WebCore::EditingWindowsBehavior;
+    else if (!strcmp(editingBehavior, "mac"))
+        type = WebCore::EditingMacBehavior;
+    else if (!strcmp(editingBehavior, "unix"))
+        type = WebCore::EditingUnixBehavior;
+    else
+        CRASH();
+    mainFrame->page()->settings()->setEditingBehaviorType(type);
+}
+
+void LayoutTestController::abortModal()
+{
+    notImplemented();
+}
+
+void LayoutTestController::clearAllApplicationCaches()
+{
+    notImplemented();
+}
+
+void LayoutTestController::setApplicationCacheOriginQuota(unsigned long long quota)
+{
+    notImplemented();
+}
+
+void LayoutTestController::setMockDeviceOrientation(bool canProvideAlpha, double alpha, bool canProvideBeta, double beta, bool canProvideGamma, double gamma)
+{
+    notImplemented();
+}
+
+void LayoutTestController::addMockSpeechInputResult(JSStringRef result, double confidence, JSStringRef language)
+{
+    notImplemented();
+}
+
+void LayoutTestController::setGeolocationPermission(bool allow)
+{
+    setGeolocationPermissionCommon(allow);
+    DumpRenderTreeSupport::setMockGeolocationPermission(BlackBerry::WebKit::DumpRenderTree::currentInstance()->page(), allow);
+}
+
+void LayoutTestController::setViewModeMediaFeature(const JSStringRef mode)
+{
+    notImplemented();
+}
+
+void LayoutTestController::suspendAnimations() const
+{
+    if (mainFrame && mainFrame->animation())
+        mainFrame->animation()->suspendAnimations();
+}
+
+void LayoutTestController::resumeAnimations() const
+{
+    if (mainFrame && mainFrame->animation())
+        mainFrame->animation()->resumeAnimations();
+}
+
+bool LayoutTestController::hasSpellingMarker(int from, int length)
+{
+    if (!mainFrame)
+        return false;
+
+    return mainFrame->editor()->selectionStartHasMarkerFor(WebCore::DocumentMarker::Spelling, from, length);
+}
+
+JSValueRef LayoutTestController::nodesFromRect(JSContextRef context, JSValueRef value, int x, int y, unsigned top, unsigned right, unsigned bottom, unsigned left, bool ignoreClipping)
+{
+    notImplemented();
+    return JSValueMakeUndefined(context);
+}
+
+void LayoutTestController::setSerializeHTTPLoads(bool)
+{
+    // FIXME: Implement if needed for https://bugs.webkit.org/show_bug.cgi?id=50758.
+    notImplemented();
+}
+
+void LayoutTestController::setMinimumTimerInterval(double)
+{
+    notImplemented();
+}
+
+void LayoutTestController::setTextDirection(JSStringRef)
+{
+    notImplemented();
+}
+
+void LayoutTestController::allowRoundingHacks()
+{
+    notImplemented();
+}
+
+void LayoutTestController::goBack()
+{
+    // FIXME: implement to enable loader/navigation-while-deferring-loads.html
+    notImplemented();
+}
+
+void LayoutTestController::setDefersLoading(bool)
+{
+    // FIXME: implement to enable loader/navigation-while-deferring-loads.html
+    notImplemented();
+}
+
+JSValueRef LayoutTestController::originsWithLocalStorage(JSContextRef context)
+{
+    notImplemented();
+    return JSValueMakeUndefined(context);
+}
+
+void LayoutTestController::observeStorageTrackerNotifications(unsigned)
+{
+    notImplemented();
+}
+
+void LayoutTestController::syncLocalStorage()
+{
+    notImplemented();
+}
+
+void LayoutTestController::deleteAllLocalStorage()
+{
+    notImplemented();
+}
+
+void LayoutTestController::setAsynchronousSpellCheckingEnabled(bool)
+{
+    notImplemented();
+}
+
+void LayoutTestController::setAutofilled(JSContextRef context, JSValueRef nodeObject, bool autofilled)
+{
+    JSC::ExecState* exec = toJS(context);
+    WebCore::Element* element = toElement(toJS(exec, nodeObject));
+    if (!element)
+        return;
+    WebCore::HTMLInputElement* inputElement = element->toInputElement();
+    if (!inputElement)
+        return;
+
+    inputElement->setAutofilled(autofilled);
+}
+
+int LayoutTestController::numberOfPendingGeolocationPermissionRequests()
+{
+    return DumpRenderTreeSupport::numberOfPendingGeolocationPermissionRequests(BlackBerry::WebKit::DumpRenderTree::currentInstance()->page());
+}
+
+bool LayoutTestController::hasGrammarMarker(int from, int length)
+{
+    if (!mainFrame)
+        return false;
+
+    return mainFrame->editor()->selectionStartHasMarkerFor(WebCore::DocumentMarker::Grammar, from, length);
+}
+
+void LayoutTestController::dumpConfigurationForViewport(int deviceDPI, int deviceWidth, int deviceHeight, int availableWidth, int availableHeight)
+{
+    if (!mainFrame)
+        return;
+
+    DumpRenderTreeSupport::dumpConfigurationForViewport(mainFrame, deviceDPI, deviceWidth, deviceHeight, availableWidth, availableHeight);
+}
+
+bool LayoutTestController::findString(JSContextRef context, JSStringRef target, JSObjectRef optionsArray)
+{
+    WebCore::FindOptions options = 0;
+
+    JSRetainPtr<JSStringRef> lengthPropertyName(Adopt, JSStringCreateWithUTF8CString("length"));
+    JSValueRef lengthValue = JSObjectGetProperty(context, optionsArray, lengthPropertyName.get(), 0);
+    if (!JSValueIsNumber(context, lengthValue))
+        return false;
+
+    WTF::String nameStr = jsStringRefToWebCoreString(target);
+
+    size_t length = static_cast<size_t>(JSValueToNumber(context, lengthValue, 0));
+    for (size_t i = 0; i < length; ++i) {
+        JSValueRef value = JSObjectGetPropertyAtIndex(context, optionsArray, i, 0);
+        if (!JSValueIsString(context, value))
+            continue;
+
+        JSRetainPtr<JSStringRef> optionName(Adopt, JSValueToStringCopy(context, value, 0));
+
+        if (JSStringIsEqualToUTF8CString(optionName.get(), "CaseInsensitive"))
+            options |= WebCore::CaseInsensitive;
+        else if (JSStringIsEqualToUTF8CString(optionName.get(), "AtWordStarts"))
+            options |= WebCore::AtWordStarts;
+        else if (JSStringIsEqualToUTF8CString(optionName.get(), "TreatMedialCapitalAsWordStart"))
+            options |= WebCore::TreatMedialCapitalAsWordStart;
+        else if (JSStringIsEqualToUTF8CString(optionName.get(), "Backwards"))
+            options |= WebCore::Backwards;
+        else if (JSStringIsEqualToUTF8CString(optionName.get(), "WrapAround"))
+            options |= WebCore::WrapAround;
+        else if (JSStringIsEqualToUTF8CString(optionName.get(), "StartInSelection"))
+            options |= WebCore::StartInSelection;
+    }
+    return BlackBerry::WebKit::DumpRenderTree::currentInstance()->findString(nameStr, options);
+}
+
+void LayoutTestController::deleteLocalStorageForOrigin(JSStringRef URL)
+{
+    // FIXME: Implement.
+}
+
+void LayoutTestController::setValueForUser(JSContextRef context, JSValueRef nodeObject, JSStringRef value)
+{
+    JSC::ExecState* exec = toJS(context);
+    WebCore::Element* element = toElement(toJS(exec, nodeObject));
+    if (!element)
+        return;
+    WebCore::HTMLInputElement* inputElement = element->toInputElement();
+    if (!inputElement)
+        return;
+
+    inputElement->setValueForUser(jsStringRefToWebCoreString(value));
+}
+
+long long LayoutTestController::applicationCacheDiskUsageForOrigin(JSStringRef origin)
+{
+    // FIXME: Implement to support getting disk usage by all application caches for an origin.
+    return 0;
+}
+
+void LayoutTestController::addChromeInputField()
+{
+}
+
+void LayoutTestController::removeChromeInputField()
+{
+}
+
+void LayoutTestController::focusWebView()
+{
+}
+
+void LayoutTestController::setBackingScaleFactor(double)
+{
+}
+
diff --git a/Tools/DumpRenderTree/blackberry/PNGImageEncoder.cpp b/Tools/DumpRenderTree/blackberry/PNGImageEncoder.cpp
new file mode 100644
index 000000000..fdb4a2930
--- /dev/null
+++ b/Tools/DumpRenderTree/blackberry/PNGImageEncoder.cpp
@@ -0,0 +1,156 @@
+/*
+ * Copyright (C) 2011 Research In Motion Limited. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ *
+ * Portions of this file are Copyright 2005 Google Inc.
+ */
+
+#include "config.h"
+#include "PNGImageEncoder.h"
+
+#include "SkBitmap.h"
+#include "SkUnPreMultiply.h"
+
+extern "C" {
+#include "png.h"
+}
+
+#include <OwnArrayPtr.h>
+
+// This code is almost a mirror of the code in WebCore/platform/image-encoders/skia/PNGImageEncoder.cpp
+// since we can't include this private WebCore file in a WebKit-client application.
+
+// Converts BGRA->RGBA and RGBA->BGRA and undoes alpha premultiplication.
+static void preMultipliedBGRAtoRGBA(const unsigned char* input, int numberOfPixels, unsigned char* output)
+{
+    SkBitmap inputBitmap;
+    inputBitmap.setConfig(SkBitmap::kARGB_8888_Config, numberOfPixels, 1);
+    inputBitmap.setPixels(const_cast<unsigned char*>(input));
+    for (int x = 0; x < numberOfPixels; x++) {
+        uint32_t srcPixel = *inputBitmap.getAddr32(x, 0);
+        SkColor unmultiplied = SkUnPreMultiply::PMColorToColor(srcPixel);
+        unsigned char* pixelOut = &output[x * 4];
+        pixelOut[0] = SkColorGetR(unmultiplied);
+        pixelOut[1] = SkColorGetG(unmultiplied);
+        pixelOut[2] = SkColorGetB(unmultiplied);
+        pixelOut[3] = SkColorGetA(unmultiplied);
+    }
+}
+
+// Passed around as the io_ptr in the png structs so our callbacks know where
+// to write data.
+struct PNGEncoderState {
+    PNGEncoderState(Vector<unsigned char>* o) : m_out(o) { }
+    Vector<unsigned char>* m_out;
+};
+
+// Called by libpng to flush its internal buffer to ours.
+void encoderWriteCallback(png_structp png, png_bytep data, png_size_t size)
+{
+    PNGEncoderState* state = static_cast<PNGEncoderState*>(png_get_io_ptr(png));
+    ASSERT(state->m_out);
+
+    size_t oldSize = state->m_out->size();
+    state->m_out->resize(oldSize + size);
+    memcpy(&(*state->m_out)[oldSize], data, size);
+}
+
+// Automatically destroys the given write structs on destruction to make
+// cleanup and error handling code cleaner.
+class PNGWriteStructDestroyer {
+public:
+    PNGWriteStructDestroyer(png_struct** ps, png_info** pi)
+        : m_pngStruct(ps)
+        , m_pngInfo(pi)
+    {
+    }
+
+    ~PNGWriteStructDestroyer()
+    {
+        png_destroy_write_struct(m_pngStruct, m_pngInfo);
+    }
+
+private:
+    png_struct** m_pngStruct;
+    png_info** m_pngInfo;
+};
+
+typedef void (*PixelConversionFunc)(const unsigned char*, int, unsigned char*);
+static bool encodeImpl(const unsigned char* input, int imageWidth, int imageHeight, int bytesPerRow, Vector<unsigned char>* output, PixelConversionFunc conversionFunc)
+{
+    int inputColorComponents = 4;
+    int outputColorComponents = 4;
+    int pngOutputColorType = PNG_COLOR_TYPE_RGB_ALPHA;
+
+    if (imageWidth < 0)
+        imageWidth = 0;
+
+    if (imageHeight < 0)
+        imageHeight = 0;
+
+    // Row stride should be at least as long as the length of the data.
+    if (inputColorComponents * imageWidth > bytesPerRow) {
+        ASSERT(false);
+        return false;
+    }
+
+    png_struct* pngPtr = png_create_write_struct(PNG_LIBPNG_VER_STRING, 0, 0, 0);
+    if (!pngPtr)
+        return false;
+
+    png_info* infoPtr = png_create_info_struct(pngPtr);
+    if (!infoPtr) {
+        png_destroy_write_struct(&pngPtr, 0);
+        return false;
+    }
+    PNGWriteStructDestroyer destroyer(&pngPtr, &infoPtr);
+
+    if (setjmp(png_jmpbuf(pngPtr))) {
+        // The destroyer will ensure that the structures are cleaned up in this
+        // case, even though we may get here as a jump from random parts of the
+        // PNG library called below.
+        return false;
+    }
+
+    // Set our callback for libpng to give us the data.
+    PNGEncoderState state(output);
+    png_set_write_fn(pngPtr, &state, encoderWriteCallback, 0);
+
+    png_set_IHDR(pngPtr, infoPtr, imageWidth, imageHeight, 8, pngOutputColorType,
+                 PNG_INTERLACE_NONE, PNG_COMPRESSION_TYPE_DEFAULT,
+                 PNG_FILTER_TYPE_DEFAULT);
+    png_write_info(pngPtr, infoPtr);
+
+    OwnArrayPtr<unsigned char> rowPixels = adoptArrayPtr(new unsigned char[imageWidth * outputColorComponents]);
+    for (int y = 0; y < imageHeight; y ++) {
+        conversionFunc(&input[y * bytesPerRow], imageWidth, rowPixels.get());
+        png_write_row(pngPtr, rowPixels.get());
+    }
+
+    png_write_end(pngPtr, infoPtr);
+    return true;
+}
+
+bool encodeSkBitmapToPNG(const SkBitmap& image, Vector<unsigned char>* output)
+{
+    if (image.config() != SkBitmap::kARGB_8888_Config)
+        return false; // Only support ARGB at 8 bpp now.
+
+    image.lockPixels();
+    bool result = encodeImpl(static_cast<unsigned char*>(image.getPixels()), image.width(), image.height(), image.rowBytes(), output, preMultipliedBGRAtoRGBA);
+    image.unlockPixels();
+    return result;
+}
diff --git a/Tools/DumpRenderTree/blackberry/PNGImageEncoder.h b/Tools/DumpRenderTree/blackberry/PNGImageEncoder.h
new file mode 100644
index 000000000..3407bdce8
--- /dev/null
+++ b/Tools/DumpRenderTree/blackberry/PNGImageEncoder.h
@@ -0,0 +1,28 @@
+/*
+ * Copyright (C) 2011 Research In Motion Limited. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+#ifndef PNGImageEncoder_h
+#define PNGImageEncoder_h
+
+#include <Vector.h>
+
+class SkBitmap;
+
+bool encodeSkBitmapToPNG(const SkBitmap&, WTF::Vector<unsigned char>* output);
+
+#endif // PNGImageEncoder_h
diff --git a/Tools/DumpRenderTree/blackberry/PixelDumpSupportBlackBerry.cpp b/Tools/DumpRenderTree/blackberry/PixelDumpSupportBlackBerry.cpp
new file mode 100644
index 000000000..4bea0c146
--- /dev/null
+++ b/Tools/DumpRenderTree/blackberry/PixelDumpSupportBlackBerry.cpp
@@ -0,0 +1,95 @@
+/*
+ * Copyright (C) 2011 Research In Motion Limited. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+#include "config.h"
+#include "PixelDumpSupportBlackBerry.h"
+
+#include "DumpRenderTreeBlackBerry.h"
+#include "PNGImageEncoder.h"
+#include "PixelDumpSupport.h"
+#include "WebPage.h"
+#include "WebPageClient.h"
+
+#include <BlackBerryPlatformWindow.h>
+#include <MD5.h>
+#include <Vector.h>
+#include <skia/SkDevice.h>
+
+using namespace BlackBerry::WebKit;
+using namespace BlackBerry;
+using namespace WTF;
+
+PassRefPtr<BitmapContext> createBitmapContextFromWebView(bool /*onscreen*/, bool /*incrementalRepaint*/, bool /*sweepHorizontally*/, bool /*drawSelectionRect*/)
+{
+    Platform::Graphics::Window* window = DumpRenderTree::currentInstance()->page()->client()->window();
+    ASSERT(window);
+
+    const Platform::IntRect& windowRect = window->viewportRect();
+
+    SkBitmap* bitmap = new SkBitmap;
+    bitmap->setConfig(SkBitmap::kARGB_8888_Config, windowRect.width(), windowRect.height()); // We use 32-bit RGBA since that is the pixel format that ImageDiff expects.
+    bitmap->allocPixels();
+
+    SkCanvas* canvas = new SkCanvas;
+    canvas->setBitmapDevice(*bitmap);
+
+    // We need to force a synchronous update to the window or we may get an empty bitmap.
+    // For example, running DRT with one test case that finishes before the screen is updated.
+    window->post(windowRect);
+
+    const SkBitmap* windowBitmap = static_cast<const SkBitmap*>(lockBufferBackingImage(window->buffer(), Platform::Graphics::ReadAccess));
+    canvas->drawBitmap(*windowBitmap, 0, 0); // Draw the bitmap at (0, 0).
+    Platform::Graphics::releaseBufferBackingImage(window->buffer());
+    return BitmapContext::createByAdoptingBitmapAndContext(bitmap, canvas);
+}
+
+void computeMD5HashStringForBitmapContext(BitmapContext* context, char hashString[33])
+{
+    const SkBitmap& bitmap = context->canvas()->getDevice()->accessBitmap(false);
+    ASSERT(bitmap.bytesPerPixel() == 4); // 32-bit RGBA
+
+    int pixelsWide = bitmap.width();
+    int pixelsHigh = bitmap.height();
+    int bytesPerRow = bitmap.rowBytes();
+    unsigned char* pixelData = (unsigned char*)bitmap.getPixels();
+
+    MD5 md5;
+    for (int i = 0; i < pixelsHigh; ++i) {
+        md5.addBytes(pixelData, 4 * pixelsWide);
+        pixelData += bytesPerRow;
+    }
+
+    Vector<uint8_t, 16> hash;
+    md5.checksum(hash);
+
+    hashString[0] = '\0';
+    for (int i = 0; i < 16; ++i)
+        snprintf(hashString, 33, "%s%02x", hashString, hash[i]);
+}
+
+static void printPNG(SkCanvas* canvas, const char* checksum)
+{
+    Vector<unsigned char> pngData;
+    encodeSkBitmapToPNG(canvas->getDevice()->accessBitmap(false), &pngData);
+    printPNG(pngData.data(), pngData.size(), checksum);
+}
+
+void dumpBitmap(BitmapContext* context, const char* checksum)
+{
+    printPNG(context->canvas(), checksum);
+}
diff --git a/Tools/DumpRenderTree/blackberry/PixelDumpSupportBlackBerry.h b/Tools/DumpRenderTree/blackberry/PixelDumpSupportBlackBerry.h
new file mode 100644
index 000000000..b52d3da18
--- /dev/null
+++ b/Tools/DumpRenderTree/blackberry/PixelDumpSupportBlackBerry.h
@@ -0,0 +1,56 @@
+/*
+ * Copyright (C) 2011 Research In Motion Limited. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+#ifndef PixelDumpSupportBlackBerry_h
+#define PixelDumpSupportBlackBerry_h
+
+#include <PassRefPtr.h>
+#include <RefCounted.h>
+#include <skia/SkBitmap.h>
+#include <skia/SkCanvas.h>
+
+class BitmapContext : public RefCounted<BitmapContext> {
+public:
+
+    static PassRefPtr<BitmapContext> createByAdoptingBitmapAndContext(SkBitmap* bitmap, SkCanvas* canvas)
+    {
+        return adoptRef(new BitmapContext(bitmap, canvas));
+    }
+
+    ~BitmapContext()
+    {
+        delete m_bitmap;
+        delete m_canvas;
+    }
+
+    SkCanvas* canvas() { return m_canvas; }
+
+private:
+
+    BitmapContext(SkBitmap* bitmap, SkCanvas* canvas)
+        : m_bitmap(bitmap)
+        , m_canvas(canvas)
+    {
+    }
+
+    SkBitmap* m_bitmap;
+    SkCanvas* m_canvas;
+
+};
+
+#endif // PixelDumpSupportBlackBerry_h
diff --git a/Tools/DumpRenderTree/cg/ImageDiffCG.cpp b/Tools/DumpRenderTree/cg/ImageDiffCG.cpp
index 07e51130c..e194a0080 100644
--- a/Tools/DumpRenderTree/cg/ImageDiffCG.cpp
+++ b/Tools/DumpRenderTree/cg/ImageDiffCG.cpp
@@ -24,7 +24,9 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
+#if defined(WIN32) || defined(_WIN32)
 #define min min
+#endif
 
 // FIXME: We need to be able to include these defines from a config.h somewhere.
 #define JS_EXPORT_PRIVATE
diff --git a/Tools/DumpRenderTree/chromium/EventSender.cpp b/Tools/DumpRenderTree/chromium/EventSender.cpp
index 9acc42dfb..cc73b2dbd 100644
--- a/Tools/DumpRenderTree/chromium/EventSender.cpp
+++ b/Tools/DumpRenderTree/chromium/EventSender.cpp
@@ -354,7 +354,15 @@ void EventSender::doDragDrop(const WebDragData& dragData, WebDragOperationsMask
 
 void EventSender::dumpFilenameBeingDragged(const CppArgumentList&, CppVariant*)
 {
-    printf("Filename being dragged: %s\n", currentDragData.fileContentFilename().utf8().data());
+    WebString filename;
+    WebVector<WebDragData::Item> items = currentDragData.items();
+    for (size_t i = 0; i < items.size(); ++i) {
+        if (items[i].storageType == WebDragData::Item::StorageTypeBinaryData) {
+            filename = items[i].title;
+            break;
+        }
+    }
+    printf("Filename being dragged: %s\n", filename.utf8().data());
 }
 
 WebMouseEvent::Button EventSender::getButtonTypeFromButtonNumber(int buttonCode)
@@ -869,8 +877,12 @@ void EventSender::beginDragWithFiles(const CppArgumentList& arguments, CppVarian
 {
     currentDragData.initialize();
     Vector<string> files = arguments[0].toStringVector();
-    for (size_t i = 0; i < files.size(); ++i)
-        currentDragData.appendToFilenames(webkit_support::GetAbsoluteWebStringFromUTF8Path(files[i]));
+    for (size_t i = 0; i < files.size(); ++i) {
+        WebDragData::Item item;
+        item.storageType = WebDragData::Item::StorageTypeFilename;
+        item.filenameData = webkit_support::GetAbsoluteWebStringFromUTF8Path(files[i]);
+        currentDragData.addItem(item);
+    }
     currentDragEffectsAllowed = WebKit::WebDragOperationCopy;
 
     // Provide a drag source.
diff --git a/Tools/DumpRenderTree/chromium/LayoutTestController.cpp b/Tools/DumpRenderTree/chromium/LayoutTestController.cpp
index b0347c853..3c3b83ba2 100644
--- a/Tools/DumpRenderTree/chromium/LayoutTestController.cpp
+++ b/Tools/DumpRenderTree/chromium/LayoutTestController.cpp
@@ -159,7 +159,6 @@ LayoutTestController::LayoutTestController(TestShell* shell)
     bindMethod("repaintSweepHorizontally", &LayoutTestController::repaintSweepHorizontally);
     bindMethod("resetPageVisibility", &LayoutTestController::resetPageVisibility);
     bindMethod("resumeAnimations", &LayoutTestController::resumeAnimations);
-    bindMethod("sampleSVGAnimationForElementAtTime", &LayoutTestController::sampleSVGAnimationForElementAtTime);
     bindMethod("setAcceptsEditing", &LayoutTestController::setAcceptsEditing);
     bindMethod("setAllowDisplayOfInsecureContent", &LayoutTestController::setAllowDisplayOfInsecureContent);
     bindMethod("setAllowFileAccessFromFileURLs", &LayoutTestController::setAllowFileAccessFromFileURLs);
@@ -1146,19 +1145,6 @@ void LayoutTestController::resumeAnimations(const CppArgumentList&, CppVariant*
     result->setNull();
 }
 
-void LayoutTestController::sampleSVGAnimationForElementAtTime(const CppArgumentList& arguments, CppVariant* result)
-{
-    if (arguments.size() != 3) {
-        result->setNull();
-        return;
-    }
-    WebString animationId = cppVariantToWebString(arguments[0]);
-    double time = arguments[1].toDouble();
-    WebString elementId = cppVariantToWebString(arguments[2]);
-    bool success = m_shell->webView()->mainFrame()->pauseSVGAnimation(animationId, time, elementId);
-    result->set(success);
-}
-
 void LayoutTestController::disableImageLoading(const CppArgumentList&, CppVariant* result)
 {
     m_shell->preferences()->loadsImagesAutomatically = false;
@@ -1535,6 +1521,8 @@ void LayoutTestController::overridePreference(const CppArgumentList& arguments,
         prefs->tabsToLinks = cppVariantToBool(value);
     else if (key == "WebKitWebGLEnabled")
         prefs->experimentalWebGLEnabled = cppVariantToBool(value);
+    else if (key == "WebKitCSSRegionsEnabled")
+        prefs->experimentalCSSRegionsEnabled = cppVariantToBool(value);
     else if (key == "WebKitHyperlinkAuditingEnabled")
         prefs->hyperlinkAuditingEnabled = cppVariantToBool(value);
     else if (key == "WebKitEnableCaretBrowsing")
diff --git a/Tools/DumpRenderTree/chromium/LayoutTestController.h b/Tools/DumpRenderTree/chromium/LayoutTestController.h
index a686e8605..99bd0c469 100644
--- a/Tools/DumpRenderTree/chromium/LayoutTestController.h
+++ b/Tools/DumpRenderTree/chromium/LayoutTestController.h
@@ -244,7 +244,6 @@ public:
     void numberOfActiveAnimations(const CppArgumentList&, CppVariant*);
     void suspendAnimations(const CppArgumentList&, CppVariant*);
     void resumeAnimations(const CppArgumentList&, CppVariant*);
-    void sampleSVGAnimationForElementAtTime(const CppArgumentList&, CppVariant*);
     void disableImageLoading(const CppArgumentList&, CppVariant*);
     void setIconDatabaseEnabled(const CppArgumentList&, CppVariant*);
     void dumpSelectionRect(const CppArgumentList&, CppVariant*);
diff --git a/Tools/DumpRenderTree/chromium/TestShell.cpp b/Tools/DumpRenderTree/chromium/TestShell.cpp
index f576d2417..c175fda99 100644
--- a/Tools/DumpRenderTree/chromium/TestShell.cpp
+++ b/Tools/DumpRenderTree/chromium/TestShell.cpp
@@ -116,6 +116,7 @@ TestShell::TestShell(bool testShellMode)
     , m_stressOpt(false)
     , m_stressDeopt(false)
     , m_dumpWhenFinished(true)
+    , m_isDisplayingModalDialog(false)
 {
     WebRuntimeFeatures::enableDataTransferItems(true);
     WebRuntimeFeatures::enableGeolocation(true);
@@ -128,6 +129,7 @@ TestShell::TestShell(bool testShellMode)
     WebRuntimeFeatures::enableVideoTrack(true);
     WebRuntimeFeatures::enableGamepad(true);
     WebRuntimeFeatures::enableShadowDOM(true);
+    WebRuntimeFeatures::enableStyleScoped(true);
 
     m_webPermissions = adoptPtr(new WebPermissions(this));
     m_accessibilityController = adoptPtr(new AccessibilityController(this));
@@ -240,6 +242,7 @@ void TestShell::runFileTest(const TestParams& params)
         m_prefs.acceleratedCompositingForVideoEnabled = true;
         m_prefs.accelerated2dCanvasEnabled = true;
         m_prefs.deferred2dCanvasEnabled = true;
+        m_prefs.mockScrollbarsEnabled = true;
         m_prefs.applyTo(m_webView);
     }
 
diff --git a/Tools/DumpRenderTree/chromium/TestShell.h b/Tools/DumpRenderTree/chromium/TestShell.h
index 1ee5ce9a1..4bbaf61fb 100644
--- a/Tools/DumpRenderTree/chromium/TestShell.h
+++ b/Tools/DumpRenderTree/chromium/TestShell.h
@@ -163,6 +163,9 @@ public:
     // testing where we only want to have the output from the last load.
     void setDumpWhenFinished(bool dumpWhenFinished) { m_dumpWhenFinished = dumpWhenFinished; }
 
+    void setIsDisplayingModalDialog(bool isDisplayingModalDialog) { m_isDisplayingModalDialog = isDisplayingModalDialog; }
+    bool isDisplayingModalDialog() const { return m_isDisplayingModalDialog; }
+
     WebViewHost* createNewWindow(const WebKit::WebURL&);
     void closeWindow(WebViewHost*);
     void closeRemainingWindows();
@@ -234,6 +237,7 @@ private:
     bool m_stressDeopt;
     std::string m_javaScriptFlags;
     bool m_dumpWhenFinished;
+    bool m_isDisplayingModalDialog;
 
 
     // List of all windows in this process.
diff --git a/Tools/DumpRenderTree/chromium/WebPreferences.cpp b/Tools/DumpRenderTree/chromium/WebPreferences.cpp
index 872ebfb4a..0e3ce6c52 100644
--- a/Tools/DumpRenderTree/chromium/WebPreferences.cpp
+++ b/Tools/DumpRenderTree/chromium/WebPreferences.cpp
@@ -80,6 +80,7 @@ void WebPreferences::reset()
     defaultTextEncodingName = WebString::fromUTF8("ISO-8859-1");
     developerExtrasEnabled = true;
     experimentalWebGLEnabled = false;
+    experimentalCSSRegionsEnabled = true;
     javaEnabled = false;
     javaScriptCanAccessClipboard = true;
     javaScriptCanOpenWindowsAutomatically = true;
@@ -117,6 +118,7 @@ void WebPreferences::reset()
     forceCompositingMode = false;
     hixie76WebSocketProtocolEnabled = true;
     perTilePaintingEnabled = false;
+    mockScrollbarsEnabled = false;
 }
 
 static void setStandardFontFamilyWrapper(WebSettings* settings, const WebKit::WebString& font, UScriptCode script)
@@ -192,6 +194,7 @@ void WebPreferences::applyTo(WebView* webView)
     settings->setDefaultTextEncodingName(defaultTextEncodingName);
     settings->setDeveloperExtrasEnabled(developerExtrasEnabled);
     settings->setExperimentalWebGLEnabled(experimentalWebGLEnabled);
+    settings->setExperimentalCSSRegionsEnabled(experimentalCSSRegionsEnabled);
     settings->setJavaEnabled(javaEnabled);
     settings->setJavaScriptCanAccessClipboard(javaScriptCanAccessClipboard);
     settings->setJavaScriptCanOpenWindowsAutomatically(javaScriptCanOpenWindowsAutomatically);
@@ -222,6 +225,7 @@ void WebPreferences::applyTo(WebView* webView)
     settings->setAcceleratedPaintingEnabled(acceleratedPaintingEnabled);
     settings->setHixie76WebSocketProtocolEnabled(hixie76WebSocketProtocolEnabled);
     settings->setPerTilePaintingEnabled(perTilePaintingEnabled);
+    settings->setMockScrollbarsEnabled(mockScrollbarsEnabled);
 
     // Fixed values.
     settings->setTextDirectionSubmenuInclusionBehaviorNeverIncluded();
@@ -231,7 +235,6 @@ void WebPreferences::applyTo(WebView* webView)
     settings->setEditableLinkBehaviorNeverLive();
     settings->setEnableScrollAnimator(false);
     settings->setFontRenderingModeNormal();
-    settings->setMockScrollbarsEnabled(false);
     settings->setTextDirectionSubmenuInclusionBehaviorNeverIncluded();
     settings->setUsesEncodingDetector(false);
     settings->setImagesEnabled(true);
@@ -240,4 +243,5 @@ void WebPreferences::applyTo(WebView* webView)
     settings->setFullScreenEnabled(true);
     settings->setValidationMessageTimerMagnification(-1);
     settings->setVisualWordMovementEnabled(false);
+    settings->setPasswordEchoEnabled(false);
 }
diff --git a/Tools/DumpRenderTree/chromium/WebPreferences.h b/Tools/DumpRenderTree/chromium/WebPreferences.h
index ee04a2094..1cb9ab26c 100644
--- a/Tools/DumpRenderTree/chromium/WebPreferences.h
+++ b/Tools/DumpRenderTree/chromium/WebPreferences.h
@@ -82,6 +82,7 @@ struct WebPreferences {
     WebKit::WebString defaultTextEncodingName;
     bool developerExtrasEnabled;
     bool experimentalWebGLEnabled;
+    bool experimentalCSSRegionsEnabled;
     bool javaEnabled;
     bool javaScriptCanAccessClipboard;
     bool javaScriptCanOpenWindowsAutomatically;
@@ -110,6 +111,7 @@ struct WebPreferences {
     bool acceleratedPaintingEnabled;
     bool hixie76WebSocketProtocolEnabled;
     bool perTilePaintingEnabled;
+    bool mockScrollbarsEnabled;
 
     WebPreferences() { reset(); }
     void reset();
diff --git a/Tools/DumpRenderTree/chromium/WebUserMediaClientMock.cpp b/Tools/DumpRenderTree/chromium/WebUserMediaClientMock.cpp
index 0f442a676..24fc144cb 100644
--- a/Tools/DumpRenderTree/chromium/WebUserMediaClientMock.cpp
+++ b/Tools/DumpRenderTree/chromium/WebUserMediaClientMock.cpp
@@ -29,6 +29,8 @@
  */
 
 #include "config.h"
+#if ENABLE(MEDIA_STREAM)
+
 #include "WebUserMediaClientMock.h"
 
 #include "WebMediaStreamRegistry.h"
@@ -81,3 +83,5 @@ void WebUserMediaClientMock::cancelUserMediaRequest(const WebUserMediaRequest&)
 }
 
 } // namespace WebKit
+
+#endif // ENABLE(MEDIA_STREAM)
diff --git a/Tools/DumpRenderTree/chromium/WebUserMediaClientMock.h b/Tools/DumpRenderTree/chromium/WebUserMediaClientMock.h
index 4d91839c6..1942e3bdc 100644
--- a/Tools/DumpRenderTree/chromium/WebUserMediaClientMock.h
+++ b/Tools/DumpRenderTree/chromium/WebUserMediaClientMock.h
@@ -31,6 +31,8 @@
 #ifndef WebUserMediaClientMock_h
 #define WebUserMediaClientMock_h
 
+#if ENABLE(MEDIA_STREAM)
+
 #include "WebUserMediaClient.h"
 #include "platform/WebCommon.h"
 #include "platform/WebString.h"
@@ -57,4 +59,6 @@ private:
 
 } // namespace WebKit
 
+#endif // ENABLE(MEDIA_STREAM)
+
 #endif // WebUserMediaClientMock_h
diff --git a/Tools/DumpRenderTree/chromium/WebViewHost.cpp b/Tools/DumpRenderTree/chromium/WebViewHost.cpp
index befa3b718..81603b37f 100644
--- a/Tools/DumpRenderTree/chromium/WebViewHost.cpp
+++ b/Tools/DumpRenderTree/chromium/WebViewHost.cpp
@@ -47,6 +47,7 @@
 #include "WebFrame.h"
 #include "WebGeolocationClientMock.h"
 #include "WebHistoryItem.h"
+#include "WebIntent.h"
 #include "WebKit.h"
 #include "WebNode.h"
 #include "WebPluginParams.h"
@@ -137,7 +138,10 @@ static string descriptionSuitableForTestResult(const string& url)
 // dragging a file.
 static void addDRTFakeFileToDataObject(WebDragData* dragData)
 {
-    dragData->appendToFilenames(WebString::fromUTF8("DRTFakeFile"));
+    WebDragData::Item item;
+    item.storageType = WebDragData::Item::StorageTypeFilename;
+    item.filenameData = WebString::fromUTF8("DRTFakeFile");
+    dragData->addItem(item);
 }
 
 // Get a debugging string from a WebNavigationType.
@@ -709,6 +713,7 @@ WebDeviceOrientationClient* WebViewHost::deviceOrientationClient()
     return deviceOrientationClientMock();
 }
 
+#if ENABLE(MEDIA_STREAM)
 WebUserMediaClient* WebViewHost::userMediaClient()
 {
     return userMediaClientMock();
@@ -720,6 +725,7 @@ WebUserMediaClientMock* WebViewHost::userMediaClientMock()
         m_userMediaClientMock = WebUserMediaClientMock::create();
     return m_userMediaClientMock.get();
 }
+#endif
 
 // WebWidgetClient -----------------------------------------------------------
 
@@ -893,11 +899,21 @@ WebRect WebViewHost::windowResizerRect()
 
 void WebViewHost::runModal()
 {
+    if (m_shell->isDisplayingModalDialog()) {
+        // DumpRenderTree doesn't support real modal dialogs, so a test shouldn't try to start two modal dialogs at the same time.
+        ASSERT_NOT_REACHED();
+        return;
+    }
+    // This WebViewHost might get deleted before RunMessageLoop() returns, so keep a copy of the m_shell member variable around.
+    ASSERT(m_shell->webViewHost() != this);
+    TestShell* shell = m_shell;
+    shell->setIsDisplayingModalDialog(true);
     bool oldState = webkit_support::MessageLoopNestableTasksAllowed();
     webkit_support::MessageLoopSetNestableTasksAllowed(true);
     m_inModalLoop = true;
     webkit_support::RunMessageLoop();
     webkit_support::MessageLoopSetNestableTasksAllowed(oldState);
+    shell->setIsDisplayingModalDialog(false);
 }
 
 bool WebViewHost::enterFullScreen()
@@ -923,7 +939,11 @@ WebPlugin* WebViewHost::createPlugin(WebFrame* frame, const WebPluginParams& par
 
 WebMediaPlayer* WebViewHost::createMediaPlayer(WebFrame* frame, WebMediaPlayerClient* client)
 {
+#if ENABLE(MEDIA_STREAM)
     return webkit_support::CreateMediaPlayer(frame, client, testMediaStreamClient());
+#else
+    return webkit_support::CreateMediaPlayer(frame, client);
+#endif
 }
 
 WebApplicationCacheHost* WebViewHost::createApplicationCacheHost(WebFrame* frame, WebApplicationCacheHostClient* client)
@@ -1294,6 +1314,14 @@ bool WebViewHost::willCheckAndDispatchMessageEvent(WebFrame* source, WebSecurity
     return false;
 }
 
+void WebViewHost::dispatchIntent(WebFrame* source, const WebIntentRequest& request)
+{
+    printf("Received Web Intent: action=%s type=%s\n",
+           request.intent().action().utf8().data(),
+           request.intent().type().utf8().data());
+    m_currentRequest = request;
+}
+
 // Public functions -----------------------------------------------------------
 
 WebViewHost::WebViewHost(TestShell* shell)
@@ -1636,6 +1664,7 @@ void WebViewHost::exitFullScreenNow()
     webView()->didExitFullScreen();
 }
 
+#if ENABLE(MEDIA_STREAM)
 webkit_support::MediaStreamUtil* WebViewHost::mediaStreamUtil()
 {
     return userMediaClientMock();
@@ -1647,6 +1676,7 @@ webkit_support::TestMediaStreamClient* WebViewHost::testMediaStreamClient()
         m_testMediaStreamClient = adoptPtr(new webkit_support::TestMediaStreamClient(mediaStreamUtil()));
     return m_testMediaStreamClient.get();
 }
+#endif
 
 // Painting functions ---------------------------------------------------------
 
diff --git a/Tools/DumpRenderTree/chromium/WebViewHost.h b/Tools/DumpRenderTree/chromium/WebViewHost.h
index 6f759728f..f80f438ad 100644
--- a/Tools/DumpRenderTree/chromium/WebViewHost.h
+++ b/Tools/DumpRenderTree/chromium/WebViewHost.h
@@ -37,6 +37,7 @@
 #include "WebAccessibilityNotification.h"
 #include "WebCursorInfo.h"
 #include "WebFrameClient.h"
+#include "WebIntentRequest.h"
 #include "WebSpellCheckClient.h"
 #include "WebViewClient.h"
 #include <wtf/HashMap.h>
@@ -163,7 +164,9 @@ class WebViewHost : public WebKit::WebSpellCheckClient, public WebKit::WebViewCl
     virtual WebKit::WebGeolocationClient* geolocationClient();
     virtual WebKit::WebSpeechInputController* speechInputController(WebKit::WebSpeechInputListener*);
     virtual WebKit::WebDeviceOrientationClient* deviceOrientationClient();
+#if ENABLE(MEDIA_STREAM)
     virtual WebKit::WebUserMediaClient* userMediaClient();
+#endif
     virtual void printPage(WebKit::WebFrame*);
 
     // WebKit::WebWidgetClient
@@ -235,6 +238,7 @@ class WebViewHost : public WebKit::WebSpellCheckClient, public WebKit::WebViewCl
     virtual void didDetectXSS(WebKit::WebFrame*, const WebKit::WebURL&, bool didBlockEntirePage);
     virtual void openFileSystem(WebKit::WebFrame*, WebKit::WebFileSystem::Type, long long size, bool create, WebKit::WebFileSystemCallbacks*);
     virtual bool willCheckAndDispatchMessageEvent(WebKit::WebFrame* source, WebKit::WebSecurityOrigin target, WebKit::WebDOMMessageEvent);
+    virtual void dispatchIntent(WebKit::WebFrame* source, const WebKit::WebIntentRequest&);
 
     WebKit::WebDeviceOrientationClientMock* deviceOrientationClientMock();
     
@@ -305,9 +309,11 @@ private:
     void didNotAcquirePointerLock();
 #endif
 
+#if ENABLE(MEDIA_STREAM)
     WebKit::WebUserMediaClientMock* userMediaClientMock();
     webkit_support::MediaStreamUtil* mediaStreamUtil();
     webkit_support::TestMediaStreamClient* testMediaStreamClient();
+#endif
 
     // Causes navigation actions just printout the intended navigation instead
     // of taking you to the page. This is used for cases like mailto, where you
@@ -385,8 +391,10 @@ private:
     OwnPtr<WebKit::WebDeviceOrientationClientMock> m_deviceOrientationClientMock;
     OwnPtr<MockWebSpeechInputController> m_speechInputControllerMock;
 
+#if ENABLE(MEDIA_STREAM)
     OwnPtr<WebKit::WebUserMediaClientMock> m_userMediaClientMock;
     OwnPtr<webkit_support::TestMediaStreamClient> m_testMediaStreamClient;
+#endif
 
     OwnPtr<TestNavigationController> m_navigationController;
 
@@ -404,6 +412,9 @@ private:
         PointerLockWillFailSync
     } m_pointerLockPlannedResult;
 #endif
+
+    // For web intents: holds the current request, if any.
+    WebKit::WebIntentRequest m_currentRequest;
 };
 
 #endif // WebViewHost_h
diff --git a/Tools/DumpRenderTree/efl/CMakeLists.txt b/Tools/DumpRenderTree/efl/CMakeLists.txt
index 09726f628..436dd6d85 100644
--- a/Tools/DumpRenderTree/efl/CMakeLists.txt
+++ b/Tools/DumpRenderTree/efl/CMakeLists.txt
@@ -35,9 +35,10 @@ SET(DumpRenderTree_LIBRARIES
     ${LIBXML2_LIBRARIES}
     ${LIBXSLT_LIBRARIES}
     ${SQLITE_LIBRARIES}
+    ${Glib_LIBRARIES}
+    ${LIBSOUP24_LIBRARIES}
 )
 
-SET(DumpRenderTree_LIBRARIES ${DumpRenderTree_LIBRARIES})
 SET(DumpRenderTree_INCLUDE_DIRECTORIES
     "${WEBKIT_DIR}/efl/ewk"
     ${WEBKIT_DIR}/efl
@@ -58,6 +59,7 @@ SET(DumpRenderTree_INCLUDE_DIRECTORIES
     ${WEBCORE_DIR}/platform/graphics
     ${WEBCORE_DIR}/platform/graphics/cairo
     ${WEBCORE_DIR}/platform/network
+    ${WEBCORE_DIR}/platform/network/soup
     ${WEBCORE_DIR}/plugins
     ${WEBCORE_DIR}/rendering
     ${WEBCORE_DIR}/rendering/style
@@ -68,13 +70,16 @@ SET(DumpRenderTree_INCLUDE_DIRECTORIES
     ${JAVASCRIPTCORE_DIR}
     ${JAVASCRIPTCORE_DIR}/API
     ${JAVASCRIPTCORE_DIR}/assembler
+    ${JAVASCRIPTCORE_DIR}/bytecode
     ${JAVASCRIPTCORE_DIR}/dfg
     ${JAVASCRIPTCORE_DIR}/heap
     ${JAVASCRIPTCORE_DIR}/interpreter
     ${JAVASCRIPTCORE_DIR}/jit
+    ${JAVASCRIPTCORE_DIR}/llint
     ${JAVASCRIPTCORE_DIR}/runtime
     ${JAVASCRIPTCORE_DIR}/ForwardingHeaders
     ${JAVASCRIPTCORE_DIR}/wtf
+    ${JAVASCRIPTCORE_DIR}/wtf/gobject
     ${JAVASCRIPTCORE_DIR}/wtf/efl
     ${TOOLS_DIR}/DumpRenderTree
     ${TOOLS_DIR}/DumpRenderTree/cairo
@@ -87,6 +92,8 @@ SET(DumpRenderTree_INCLUDE_DIRECTORIES
     ${EDJE_INCLUDE_DIRS}
     ${EFLDEPS_INCLUDE_DIRS}
     ${EVAS_INCLUDE_DIRS}
+    ${Glib_INCLUDE_DIRS}
+    ${LIBSOUP24_INCLUDE_DIRS}
 )
 
 SET(DumpRenderTree_LINK_FLAGS
@@ -94,30 +101,9 @@ SET(DumpRenderTree_LINK_FLAGS
     ${EDJE_LDFLAGS}
     ${EFLDEPS_LDFLAGS}
     ${EVAS_LDFLAGS}
+    ${LIBSOUP24_LDFLAGS}
 )
 
-IF (ENABLE_GLIB_SUPPORT)
-    LIST(APPEND DumpRenderTree_INCLUDE_DIRECTORIES "${JAVASCRIPTCORE_DIR}/wtf/gobject")
-
-    LIST(APPEND DumpRenderTree_LIBRARIES
-        ${Gdk_LIBRARIES}
-        ${Glib_LIBRARIES}
-        ${Gthread_LIBRARIES}
-    )
-ENDIF ()
-
-IF (WTF_USE_SOUP)
-    LIST(APPEND DumpRenderTree_LIBRARIES ${LIBSOUP24_LIBRARIES})
-    LIST(APPEND DumpRenderTree_LINK_FLAGS ${LIBSOUP24_LDFLAGS})
-    LIST(APPEND DumpRenderTree_INCLUDE_DIRECTORIES ${LIBSOUP24_INCLUDE_DIRS} ${WEBCORE_DIR}/platform/network/soup)
-ENDIF ()
-
-IF (WTF_USE_CURL)
-    LIST(APPEND DumpRenderTree_LIBRARIES ${CURL_LIBRARIES})
-    LIST(APPEND DumpRenderTree_LINK_FLAGS ${CURL_LDFLAGS})
-    LIST(APPEND DumpRenderTree_INCLUDE_DIRECTORIES ${WEBCORE_DIR}/platform/network/curl)
-ENDIF ()
-
 ADD_DEFINITIONS(-DFONTS_CONF_DIR="${TOOLS_DIR}/DumpRenderTree/gtk/fonts"
                 -DDATA_DIR="${THEME_BINARY_DIR}")
 
diff --git a/Tools/DumpRenderTree/efl/EventSender.cpp b/Tools/DumpRenderTree/efl/EventSender.cpp
index 89130f00a..93fafb9cd 100644
--- a/Tools/DumpRenderTree/efl/EventSender.cpp
+++ b/Tools/DumpRenderTree/efl/EventSender.cpp
@@ -98,6 +98,11 @@ enum EvasMouseEvent {
     EvasMouseEventClick       = EvasMouseEventMove | EvasMouseEventDown | EvasMouseEventUp,
 };
 
+enum ZoomEvent {
+    ZoomIn,
+    ZoomOut
+};
+
 static void setEvasModifiers(Evas* evas, EvasKeyModifier modifiers)
 {
     static const char* modifierNames[] = { "Control", "Shift", "Alt", "Super" };
@@ -451,6 +456,60 @@ static JSValueRef scalePageByCallback(JSContextRef context, JSObjectRef function
     return JSValueMakeUndefined(context);
 }
 
+static void textZoom(ZoomEvent zoomEvent)
+{
+    Evas_Object* view = ewk_frame_view_get(browser->mainFrame());
+    if (!view)
+        return;
+
+    float zoomFactor = ewk_view_text_zoom_get(view);
+    if (zoomEvent == ZoomIn)
+        zoomFactor *= zoomMultiplierRatio;
+    else
+        zoomFactor /= zoomMultiplierRatio;
+
+    ewk_view_text_zoom_set(view, zoomFactor);
+}
+
+static void pageZoom(ZoomEvent zoomEvent)
+{
+    Evas_Object* view = ewk_frame_view_get(browser->mainFrame());
+    if (!view)
+        return;
+
+    float zoomFactor = ewk_view_page_zoom_get(view);
+    if (zoomEvent == ZoomIn)
+        zoomFactor *= zoomMultiplierRatio;
+    else
+        zoomFactor /= zoomMultiplierRatio;
+
+    ewk_view_page_zoom_set(view, zoomFactor);
+}
+
+static JSValueRef textZoomInCallback(JSContextRef context, JSObjectRef function, JSObjectRef thisObject, size_t argumentCount, const JSValueRef arguments[], JSValueRef* exception)
+{
+    textZoom(ZoomIn);
+    return JSValueMakeUndefined(context);
+}
+
+static JSValueRef textZoomOutCallback(JSContextRef context, JSObjectRef function, JSObjectRef thisObject, size_t argumentCount, const JSValueRef arguments[], JSValueRef* exception)
+{
+    textZoom(ZoomOut);
+    return JSValueMakeUndefined(context);
+}
+
+static JSValueRef zoomPageInCallback(JSContextRef context, JSObjectRef function, JSObjectRef thisObject, size_t argumentCount, const JSValueRef arguments[], JSValueRef* exception)
+{
+    pageZoom(ZoomIn);
+    return JSValueMakeUndefined(context);
+}
+
+static JSValueRef zoomPageOutCallback(JSContextRef context, JSObjectRef function, JSObjectRef thisObject, size_t argumentCount, const JSValueRef arguments[], JSValueRef* exception)
+{
+    pageZoom(ZoomOut);
+    return JSValueMakeUndefined(context);
+}
+
 static JSStaticFunction staticFunctions[] = {
     { "mouseScrollBy", mouseScrollByCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
     { "continuousMouseScrollBy", continuousMouseScrollByCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
@@ -460,6 +519,10 @@ static JSStaticFunction staticFunctions[] = {
     { "keyDown", keyDownCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
     { "scheduleAsynchronousClick", scheduleAsynchronousClickCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
     { "scalePageBy", scalePageByCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
+    { "textZoomIn", textZoomInCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
+    { "textZoomOut", textZoomOutCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
+    { "zoomPageIn", zoomPageInCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
+    { "zoomPageOut", zoomPageOutCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
     { 0, 0, 0 }
 };
 
diff --git a/Tools/DumpRenderTree/efl/LayoutTestControllerEfl.cpp b/Tools/DumpRenderTree/efl/LayoutTestControllerEfl.cpp
index 66594f702..1998c2eb8 100644
--- a/Tools/DumpRenderTree/efl/LayoutTestControllerEfl.cpp
+++ b/Tools/DumpRenderTree/efl/LayoutTestControllerEfl.cpp
@@ -616,11 +616,6 @@ bool LayoutTestController::pauseTransitionAtTimeOnElementWithId(JSStringRef prop
     return DumpRenderTreeSupportEfl::pauseTransition(browser->mainFrame(), propertyName->ustring().utf8().data(), elementId->ustring().utf8().data(), time);
 }
 
-bool LayoutTestController::sampleSVGAnimationForElementAtTime(JSStringRef animationId, double time, JSStringRef elementId)
-{
-    return DumpRenderTreeSupportEfl::pauseSVGAnimation(browser->mainFrame(), animationId->ustring().utf8().data(), elementId->ustring().utf8().data(), time);
-}
-
 unsigned LayoutTestController::numberOfActiveAnimations() const
 {
     return DumpRenderTreeSupportEfl::activeAnimationsCount(browser->mainFrame());
diff --git a/Tools/DumpRenderTree/gtk/EventSender.cpp b/Tools/DumpRenderTree/gtk/EventSender.cpp
index 250189090..397b6c6dc 100644
--- a/Tools/DumpRenderTree/gtk/EventSender.cpp
+++ b/Tools/DumpRenderTree/gtk/EventSender.cpp
@@ -3,6 +3,7 @@
  * Copyright (C) 2009 Zan Dobersek <zandobersek@gmail.com>
  * Copyright (C) 2009 Holger Hans Peter Freyther
  * Copyright (C) 2010 Igalia S.L.
+ * Copyright (C) 2012 ChangSeok Oh <shivamidow@gmail.com>
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -34,6 +35,7 @@
 
 #include "DumpRenderTree.h"
 #include "WebCoreSupport/DumpRenderTreeSupportGtk.h"
+#include "WebKitMutationObserver.h"
 #include <GOwnPtrGtk.h>
 #include <GRefPtrGtk.h>
 #include <GtkVersioning.h>
@@ -248,7 +250,7 @@ static gboolean sendClick(gpointer)
 
 static JSValueRef scheduleAsynchronousClickCallback(JSContextRef context, JSObjectRef function, JSObjectRef thisObject, size_t argumentCount, const JSValueRef arguments[], JSValueRef* exception)
 {
-    g_idle_add(sendClick, 0);
+    g_timeout_add(0, sendClick, 0);
     return JSValueMakeUndefined(context);
 }
 
@@ -611,10 +613,9 @@ void replaySavedEvents()
     endOfQueue = 0;
 }
 
-static JSValueRef keyDownCallback(JSContextRef context, JSObjectRef function, JSObjectRef thisObject, size_t argumentCount, const JSValueRef arguments[], JSValueRef* exception)
+static GdkEvent* createKeyPressEvent(JSContextRef context, size_t argumentCount, const JSValueRef arguments[], JSValueRef* exception)
 {
-    if (argumentCount < 1)
-        return JSValueMakeUndefined(context);
+    g_return_val_if_fail(argumentCount >= 1, 0);
     guint modifiers = argumentCount >= 2 ? gdkModifersFromJSValue(context, arguments[1]) : 0;
 
     // handle location argument.
@@ -623,7 +624,8 @@ static JSValueRef keyDownCallback(JSContextRef context, JSObjectRef function, JS
         location = (int)JSValueToNumber(context, arguments[2], exception);
 
     JSStringRef character = JSValueToStringCopy(context, arguments[0], exception);
-    g_return_val_if_fail((!exception || !*exception), JSValueMakeUndefined(context));
+    g_return_val_if_fail((!exception || !*exception), 0);
+
     int gdkKeySym = GDK_VoidSymbol;
     if (location == DOM_KEY_LOCATION_NUMPAD) {
         if (JSStringIsEqualToUTF8CString(character, "leftArrow"))
@@ -717,10 +719,8 @@ static JSValueRef keyDownCallback(JSContextRef context, JSObjectRef function, JS
     JSStringRelease(character);
 
     WebKitWebView* view = webkit_web_frame_get_web_view(mainFrame);
-    if (!view)
-        return JSValueMakeUndefined(context);
+    g_return_val_if_fail(view, 0);
 
-    // create and send the event
     GdkEvent* pressEvent = gdk_event_new(GDK_KEY_PRESS);
     pressEvent->key.keyval = gdkKeySym;
     pressEvent->key.state = modifiers;
@@ -732,18 +732,31 @@ static JSValueRef keyDownCallback(JSContextRef context, JSObjectRef function, JS
 
     // When synthesizing an event, an invalid hardware_keycode value
     // can cause it to be badly processed by Gtk+.
-    GdkKeymapKey* keys;
-    gint n_keys;
-    if (gdk_keymap_get_entries_for_keyval(gdk_keymap_get_default(), gdkKeySym, &keys, &n_keys)) {
-        pressEvent->key.hardware_keycode = keys[0].keycode;
-        g_free(keys);
-    }
+    GOwnPtr<GdkKeymapKey> keys;
+    gint nKeys;
+    if (gdk_keymap_get_entries_for_keyval(gdk_keymap_get_default(), gdkKeySym, &keys.outPtr(), &nKeys))
+        pressEvent->key.hardware_keycode = keys.get()[0].keycode;
+
+    return pressEvent;
+}
 
+static void sendKeyDown(GdkEvent* pressEvent)
+{
+    g_return_if_fail(pressEvent);
     GdkEvent* releaseEvent = gdk_event_copy(pressEvent);
+    releaseEvent->type = GDK_KEY_RELEASE;
+
     dispatchEvent(pressEvent);
-    releaseEvent->key.type = GDK_KEY_RELEASE;
     dispatchEvent(releaseEvent);
 
+    DumpRenderTreeSupportGtk::deliverAllMutationsIfNecessary();
+}
+
+static JSValueRef keyDownCallback(JSContextRef context, JSObjectRef function, JSObjectRef thisObject, size_t argumentCount, const JSValueRef arguments[], JSValueRef* exception)
+{
+    GdkEvent* pressEvent = createKeyPressEvent(context, argumentCount, arguments, exception);
+    sendKeyDown(pressEvent);
+
     return JSValueMakeUndefined(context);
 }
 
@@ -811,6 +824,21 @@ static JSValueRef scalePageByCallback(JSContextRef context, JSObjectRef function
     return JSValueMakeUndefined(context);
 }
 
+static gboolean sendAsynchronousKeyDown(gpointer userData)
+{
+    sendKeyDown(static_cast<GdkEvent*>(userData));
+    return FALSE;
+}
+
+static JSValueRef scheduleAsynchronousKeyDownCallback(JSContextRef context, JSObjectRef function, JSObjectRef thisObject, size_t argumentCount, const JSValueRef arguments[], JSValueRef* exception)
+{
+    GdkEvent* pressEvent = createKeyPressEvent(context, argumentCount, arguments, exception);
+    if (pressEvent)
+        g_timeout_add(0, sendAsynchronousKeyDown, static_cast<gpointer>(pressEvent));
+
+    return JSValueMakeUndefined(context);
+}
+
 static JSStaticFunction staticFunctions[] = {
     { "mouseScrollBy", mouseScrollByCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
     { "continuousMouseScrollBy", continuousMouseScrollByCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
@@ -827,6 +855,7 @@ static JSStaticFunction staticFunctions[] = {
     { "zoomPageOut", zoomPageOutCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
     { "scheduleAsynchronousClick", scheduleAsynchronousClickCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
     { "scalePageBy", scalePageByCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
+    { "scheduleAsynchronousKeyDown", scheduleAsynchronousKeyDownCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
 
     { 0, 0, 0 }
 };
diff --git a/Tools/DumpRenderTree/gtk/LayoutTestControllerGtk.cpp b/Tools/DumpRenderTree/gtk/LayoutTestControllerGtk.cpp
index 87ecdd05e..1266ccb12 100644
--- a/Tools/DumpRenderTree/gtk/LayoutTestControllerGtk.cpp
+++ b/Tools/DumpRenderTree/gtk/LayoutTestControllerGtk.cpp
@@ -585,8 +585,7 @@ void LayoutTestController::setPluginsEnabled(bool flag)
 
 bool LayoutTestController::elementDoesAutoCompleteForElementWithId(JSStringRef id) 
 {
-    // FIXME: implement
-    return false;
+    return DumpRenderTreeSupportGtk::elementDoesAutoCompleteForElementWithId(mainFrame, id);
 }
 
 void LayoutTestController::execCommand(JSStringRef name, JSStringRef value)
@@ -788,16 +787,6 @@ bool LayoutTestController::pauseTransitionAtTimeOnElementWithId(JSStringRef prop
     return returnValue;
 }
 
-bool LayoutTestController::sampleSVGAnimationForElementAtTime(JSStringRef animationId, double time, JSStringRef elementId)
-{    
-    gchar* name = JSStringCopyUTF8CString(animationId);
-    gchar* element = JSStringCopyUTF8CString(elementId);
-    bool returnValue = DumpRenderTreeSupportGtk::pauseSVGAnimation(mainFrame, name, time, element);
-    g_free(name);
-    g_free(element);
-    return returnValue;
-}
-
 unsigned LayoutTestController::numberOfActiveAnimations() const
 {
     return DumpRenderTreeSupportGtk::numberOfActiveAnimations(mainFrame);
diff --git a/Tools/DumpRenderTree/mac/Configurations/Base.xcconfig b/Tools/DumpRenderTree/mac/Configurations/Base.xcconfig
index 11fee7169..cc0d74e5d 100644
--- a/Tools/DumpRenderTree/mac/Configurations/Base.xcconfig
+++ b/Tools/DumpRenderTree/mac/Configurations/Base.xcconfig
@@ -38,6 +38,11 @@ GCC_WARN_ABOUT_DEPRECATED_FUNCTIONS = NO
 WARNING_CFLAGS = -Wall -W -Wno-unused-parameter
 LINKER_DISPLAYS_MANGLED_NAMES = YES;
 
+CLANG_CXX_LIBRARY = $(CLANG_CXX_LIBRARY_$(TARGET_MAC_OS_X_VERSION_MAJOR));
+CLANG_CXX_LIBRARY_1060 = libstdc++;
+CLANG_CXX_LIBRARY_1070 = libc++;
+CLANG_CXX_LIBRARY_1080 = libc++;
+CLANG_CXX_LIBRARY_1090 = libc++;
 
 REAL_PLATFORM_NAME = $(REAL_PLATFORM_NAME_$(PLATFORM_NAME));
 REAL_PLATFORM_NAME_ = $(REAL_PLATFORM_NAME_macosx);
diff --git a/Tools/DumpRenderTree/mac/DumpRenderTree.mm b/Tools/DumpRenderTree/mac/DumpRenderTree.mm
index 3012a70d8..3c3b18122 100644
--- a/Tools/DumpRenderTree/mac/DumpRenderTree.mm
+++ b/Tools/DumpRenderTree/mac/DumpRenderTree.mm
@@ -648,9 +648,10 @@ static void resetDefaultsToConsistentValues()
     [preferences setAcceleratedDrawingEnabled:NO];
 #endif
     [preferences setWebGLEnabled:NO];
+    [preferences setCSSRegionsEnabled:YES];
     [preferences setUsePreHTML5ParserQuirks:NO];
     [preferences setAsynchronousSpellCheckingEnabled:NO];
-    [preferences setHixie76WebSocketProtocolEnabled:YES];
+    [preferences setHixie76WebSocketProtocolEnabled:NO];
     [preferences setMockScrollbarsEnabled:YES];
 
 #if ENABLE(WEB_AUDIO)
@@ -680,13 +681,18 @@ static void setDefaultsToConsistentValuesForTesting()
     [WebPreferences _switchNetworkLoaderToNewTestingSession];
 }
 
-static void* runThread(void* arg)
+static void runThread(void* arg)
 {
     static ThreadIdentifier previousId = 0;
     ThreadIdentifier currentId = currentThread();
     // Verify 2 successive threads do not get the same Id.
     ASSERT(previousId != currentId);
     previousId = currentId;
+}
+
+static void* runPthread(void* arg)
+{
+    runThread(arg);
     return 0;
 }
 
@@ -694,10 +700,10 @@ static void testThreadIdentifierMap()
 {
     // Imitate 'foreign' threads that are not created by WTF.
     pthread_t pthread;
-    pthread_create(&pthread, 0, &runThread, 0);
+    pthread_create(&pthread, 0, &runPthread, 0);
     pthread_join(pthread, 0);
 
-    pthread_create(&pthread, 0, &runThread, 0);
+    pthread_create(&pthread, 0, &runPthread, 0);
     pthread_join(pthread, 0);
 
     // Now create another thread using WTF. On OSX, it will have the same pthread handle
diff --git a/Tools/DumpRenderTree/mac/LayoutTestControllerMac.mm b/Tools/DumpRenderTree/mac/LayoutTestControllerMac.mm
index 4bc48d264..edd3c6191 100644
--- a/Tools/DumpRenderTree/mac/LayoutTestControllerMac.mm
+++ b/Tools/DumpRenderTree/mac/LayoutTestControllerMac.mm
@@ -849,16 +849,6 @@ bool LayoutTestController::pauseTransitionAtTimeOnElementWithId(JSStringRef prop
     return [mainFrame _pauseTransitionOfProperty:nameNS onNode:[[mainFrame DOMDocument] getElementById:idNS] atTime:time];
 }
 
-bool LayoutTestController::sampleSVGAnimationForElementAtTime(JSStringRef animationId, double time, JSStringRef elementId)
-{
-    RetainPtr<CFStringRef> animationIDCF(AdoptCF, JSStringCopyCFString(kCFAllocatorDefault, animationId));
-    NSString *animationIDNS = (NSString *)animationIDCF.get();
-    RetainPtr<CFStringRef> elementIDCF(AdoptCF, JSStringCopyCFString(kCFAllocatorDefault, elementId));
-    NSString *elementIDNS = (NSString *)elementIDCF.get();
-
-    return [mainFrame _pauseSVGAnimation:elementIDNS onSMILNode:[[mainFrame DOMDocument] getElementById:animationIDNS] atTime:time];
-}
-
 unsigned LayoutTestController::numberOfActiveAnimations() const
 {
     return [mainFrame _numberOfActiveAnimations];
diff --git a/Tools/DumpRenderTree/mac/UIDelegate.mm b/Tools/DumpRenderTree/mac/UIDelegate.mm
index 493c02d5c..87eece441 100644
--- a/Tools/DumpRenderTree/mac/UIDelegate.mm
+++ b/Tools/DumpRenderTree/mac/UIDelegate.mm
@@ -195,7 +195,7 @@ DumpRenderTreeDraggingInfo *draggingInfo = nil;
         printf("UI DELEGATE STATUS CALLBACK: setStatusText:%s\n", [text UTF8String]);
 }
 
-- (void)webView:(WebView *)webView decidePolicyForGeolocationRequestFromOrigin:(WebSecurityOrigin *)origin frame:(WebFrame *)frame listener:(id<WebGeolocationPolicyListener>)listener
+- (void)webView:(WebView *)webView decidePolicyForGeolocationRequestFromOrigin:(WebSecurityOrigin *)origin frame:(WebFrame *)frame listener:(id<WebAllowDenyPolicyListener>)listener
 {
     if (!gLayoutTestController->isGeolocationPermissionSet()) {
         if (!m_pendingGeolocationPermissionListeners)
@@ -230,7 +230,7 @@ DumpRenderTreeDraggingInfo *draggingInfo = nil;
     ASSERT(gLayoutTestController->isGeolocationPermissionSet());
     m_timer = 0;
     NSEnumerator* enumerator = [m_pendingGeolocationPermissionListeners objectEnumerator];
-    id<WebGeolocationPolicyListener> listener;
+    id<WebAllowDenyPolicyListener> listener;
     while ((listener = [enumerator nextObject])) {
         if (gLayoutTestController->geolocationPermission())
             [listener allow];
diff --git a/Tools/DumpRenderTree/qt/EventSenderQt.cpp b/Tools/DumpRenderTree/qt/EventSenderQt.cpp
index 3e4590e7f..3da678c19 100644
--- a/Tools/DumpRenderTree/qt/EventSenderQt.cpp
+++ b/Tools/DumpRenderTree/qt/EventSenderQt.cpp
@@ -463,6 +463,14 @@ void EventSender::touchEnd()
     m_touchActive = false;
 }
 
+#if QT_VERSION >= 0x050000
+void EventSender::touchCancel()
+{
+    sendTouchEvent(QEvent::TouchCancel);
+    m_touchActive = false;
+}
+#endif
+
 void EventSender::clearTouchPoints()
 {
     m_touchPoints.clear();
@@ -478,6 +486,14 @@ void EventSender::releaseTouchPoint(int index)
     m_touchPoints[index].setState(Qt::TouchPointReleased);
 }
 
+void EventSender::cancelTouchPoint(int index)
+{
+    // FIXME: No cancellation state in Qt 5, mapped to release instead.
+    // PlatformTouchEvent conversion later will map all touch points to
+    // cancelled.
+    releaseTouchPoint(index);
+}
+
 void EventSender::sendTouchEvent(QEvent::Type type)
 {
 #if QT_VERSION >= QT_VERSION_CHECK(5, 0, 0)
diff --git a/Tools/DumpRenderTree/qt/EventSenderQt.h b/Tools/DumpRenderTree/qt/EventSenderQt.h
index 736818442..e808db955 100644
--- a/Tools/DumpRenderTree/qt/EventSenderQt.h
+++ b/Tools/DumpRenderTree/qt/EventSenderQt.h
@@ -73,6 +73,9 @@ public slots:
     void touchStart();
     void touchMove();
     void touchEnd();
+#if QT_VERSION >= 0x050000
+    void touchCancel();
+#endif
     void zoomPageIn();
     void zoomPageOut();
     void textZoomIn();
@@ -80,6 +83,7 @@ public slots:
     void scalePageBy(float scaleFactor, float x, float y);
     void clearTouchPoints();
     void releaseTouchPoint(int index);
+    void cancelTouchPoint(int index);
 
 protected:
     void timerEvent(QTimerEvent*);
diff --git a/Tools/DumpRenderTree/qt/LayoutTestControllerQt.cpp b/Tools/DumpRenderTree/qt/LayoutTestControllerQt.cpp
index 037668034..66fdf1eac 100644
--- a/Tools/DumpRenderTree/qt/LayoutTestControllerQt.cpp
+++ b/Tools/DumpRenderTree/qt/LayoutTestControllerQt.cpp
@@ -562,15 +562,6 @@ bool LayoutTestController::pauseTransitionAtTimeOnElementWithId(const QString& p
     return DumpRenderTreeSupportQt::pauseTransitionOfProperty(frame, propertyName, time, elementId);
 }
 
-bool LayoutTestController::sampleSVGAnimationForElementAtTime(const QString& animationId,
-                                                              double time,
-                                                              const QString& elementId)
-{
-    QWebFrame* frame = m_drt->webPage()->mainFrame();
-    Q_ASSERT(frame);
-    return DumpRenderTreeSupportQt::pauseSVGAnimation(frame, animationId, time, elementId);
-}
-
 unsigned LayoutTestController::numberOfActiveAnimations() const
 {
     QWebFrame* frame = m_drt->webPage()->mainFrame();
@@ -701,6 +692,8 @@ void LayoutTestController::overridePreference(const QString& name, const QVarian
         settings->setAttribute(QWebSettings::PluginsEnabled, value.toBool());
     else if (name == "WebKitWebGLEnabled")
         settings->setAttribute(QWebSettings::WebGLEnabled, value.toBool());
+    else if (name == "WebKitCSSRegionsEnabled")
+        settings->setAttribute(QWebSettings::CSSRegionsEnabled, value.toBool());
     else if (name == "WebKitHyperlinkAuditingEnabled")
         settings->setAttribute(QWebSettings::HyperlinkAuditingEnabled, value.toBool());
     else if (name == "WebKitHixie76WebSocketProtocolEnabled")
diff --git a/Tools/DumpRenderTree/qt/LayoutTestControllerQt.h b/Tools/DumpRenderTree/qt/LayoutTestControllerQt.h
index 8c5d6e280..475b92407 100644
--- a/Tools/DumpRenderTree/qt/LayoutTestControllerQt.h
+++ b/Tools/DumpRenderTree/qt/LayoutTestControllerQt.h
@@ -184,7 +184,6 @@ public slots:
 
     bool pauseAnimationAtTimeOnElementWithId(const QString& animationName, double time, const QString& elementId);
     bool pauseTransitionAtTimeOnElementWithId(const QString& propertyName, double time, const QString& elementId);
-    bool sampleSVGAnimationForElementAtTime(const QString& animationId, double time, const QString& elementId);
     bool elementDoesAutoCompleteForElementWithId(const QString& elementId);
 
     unsigned numberOfActiveAnimations() const;
diff --git a/Tools/DumpRenderTree/qt/TestNetscapePlugin/TestNetscapePlugin.pro b/Tools/DumpRenderTree/qt/TestNetscapePlugin/TestNetscapePlugin.pro
index cbcd92198..efe946dd1 100644
--- a/Tools/DumpRenderTree/qt/TestNetscapePlugin/TestNetscapePlugin.pro
+++ b/Tools/DumpRenderTree/qt/TestNetscapePlugin/TestNetscapePlugin.pro
@@ -36,8 +36,8 @@ VPATH = ../../unix/TestNetscapePlugin ../../TestNetscapePlugIn
 
 
 INCLUDEPATH += \
-    ../../unix/TestNetscapePlugin/ForwardingHeaders \
-    ../../unix/TestNetscapePlugin/ForwardingHeaders/WebKit \
+    ../../TestNetscapePlugIn/unix/ForwardingHeaders \
+    ../../TestNetscapePlugIn/unix/ForwardingHeaders/WebKit \
     ../../TestNetscapePlugIn
 
 DESTDIR = $${ROOT_BUILD_DIR}/lib/plugins
diff --git a/Tools/DumpRenderTree/qt/main.cpp b/Tools/DumpRenderTree/qt/main.cpp
index b562108c8..176336770 100644
--- a/Tools/DumpRenderTree/qt/main.cpp
+++ b/Tools/DumpRenderTree/qt/main.cpp
@@ -152,7 +152,7 @@ int main(int argc, char* argv[])
     QApplication app(argc, argv);
     app.setQuitOnLastWindowClosed(false);
 
-#if QT_VERSION <= QT_VERSION_CHECK(5, 0, 0) // FIXME: need a way to port this to Qt5.
+#if QT_VERSION <= QT_VERSION_CHECK(5, 0, 0)
 #ifdef Q_WS_X11
     QX11Info::setAppDpiY(0, 96);
     QX11Info::setAppDpiX(0, 96);
@@ -170,6 +170,8 @@ int main(int argc, char* argv[])
     * default font, but with the correct paint-device DPI.
    */
     QApplication::setFont(QWidget().font());
+#else
+    QCoreApplication::setAttribute(Qt::AA_Use96Dpi, true);
 #endif
 
 #if HAVE(SIGNAL_H)
diff --git a/Tools/DumpRenderTree/win/DumpRenderTree.cpp b/Tools/DumpRenderTree/win/DumpRenderTree.cpp
index 1ec5c5e60..196f4ea9b 100644
--- a/Tools/DumpRenderTree/win/DumpRenderTree.cpp
+++ b/Tools/DumpRenderTree/win/DumpRenderTree.cpp
@@ -722,27 +722,13 @@ void dump()
     BSTR resultString = 0;
 
     if (dumpTree) {
+        ::InvalidateRect(webViewWindow, 0, TRUE);
+        ::SendMessage(webViewWindow, WM_PAINT, 0, 0);
+
         if (::gLayoutTestController->dumpAsText()) {
-            ::InvalidateRect(webViewWindow, 0, TRUE);
-            ::SendMessage(webViewWindow, WM_PAINT, 0, 0);
             wstring result = dumpFramesAsText(frame);
             resultString = SysAllocStringLen(result.data(), result.size());
         } else {
-            bool isSVGW3CTest = (gLayoutTestController->testPathOrURL().find("svg\\W3C-SVG-1.1") != string::npos);
-            unsigned width;
-            unsigned height;
-            if (isSVGW3CTest) {
-                width = 480;
-                height = 360;
-            } else {
-                width = LayoutTestController::maxViewWidth;
-                height = LayoutTestController::maxViewHeight;
-            }
-
-            ::SetWindowPos(webViewWindow, 0, 0, 0, width, height, SWP_NOMOVE);
-            ::InvalidateRect(webViewWindow, 0, TRUE);
-            ::SendMessage(webViewWindow, WM_PAINT, 0, 0);
-
             COMPtr<IWebFramePrivate> framePrivate;
             if (FAILED(frame->QueryInterface(&framePrivate)))
                 goto fail;
@@ -880,7 +866,7 @@ static void resetDefaultsToConsistentValues(IWebPreferences* preferences)
         prefsPrivate->setFrameFlatteningEnabled(FALSE);
         prefsPrivate->setOfflineWebApplicationCacheEnabled(TRUE);
         prefsPrivate->setLoadsSiteIconsIgnoringImageLoadingPreference(FALSE);
-        prefsPrivate->setHixie76WebSocketProtocolEnabled(TRUE);
+        prefsPrivate->setHixie76WebSocketProtocolEnabled(FALSE);
     }
     setAlwaysAcceptCookies(false);
 
@@ -946,6 +932,22 @@ static void resetWebViewToConsistentStateBeforeTesting()
         framePrivate->clearOpener();
 }
 
+static void sizeWebViewForCurrentTest()
+{
+    bool isSVGW3CTest = (gLayoutTestController->testPathOrURL().find("svg\\W3C-SVG-1.1") != string::npos);
+    unsigned width;
+    unsigned height;
+    if (isSVGW3CTest) {
+        width = 480;
+        height = 360;
+    } else {
+        width = LayoutTestController::maxViewWidth;
+        height = LayoutTestController::maxViewHeight;
+    }
+
+    ::SetWindowPos(webViewWindow, 0, 0, 0, width, height, SWP_NOMOVE);
+}
+
 static void runTest(const string& testPathOrURL)
 {
     static BSTR methodBStr = SysAllocString(TEXT("GET"));
@@ -985,6 +987,7 @@ static void runTest(const string& testPathOrURL)
     done = false;
     topLoadingFrame = 0;
 
+    sizeWebViewForCurrentTest();
     gLayoutTestController->setIconDatabaseEnabled(false);
 
     if (shouldLogFrameLoadDelegates(pathOrURL.c_str()))
diff --git a/Tools/DumpRenderTree/win/LayoutTestControllerWin.cpp b/Tools/DumpRenderTree/win/LayoutTestControllerWin.cpp
index c69c4749d..5185a8fd7 100644
--- a/Tools/DumpRenderTree/win/LayoutTestControllerWin.cpp
+++ b/Tools/DumpRenderTree/win/LayoutTestControllerWin.cpp
@@ -1097,31 +1097,6 @@ bool LayoutTestController::pauseTransitionAtTimeOnElementWithId(JSStringRef prop
     return SUCCEEDED(hr) && wasRunning;
 }
 
-bool LayoutTestController::sampleSVGAnimationForElementAtTime(JSStringRef animationId, double time, JSStringRef elementId)
-{
-    COMPtr<IDOMDocument> document;
-    if (FAILED(frame->DOMDocument(&document)))
-        return false;
-
-    BSTR idBSTR = JSStringCopyBSTR(animationId);
-    COMPtr<IDOMElement> element;
-    HRESULT hr = document->getElementById(idBSTR, &element);
-    SysFreeString(idBSTR);
-    if (FAILED(hr))
-        return false;
-
-    COMPtr<IWebFramePrivate> framePrivate(Query, frame);
-    if (!framePrivate)
-        return false;
-
-    BSTR elementIdBSTR = JSStringCopyBSTR(elementId);
-    BOOL wasRunning = FALSE;
-    hr = framePrivate->pauseSVGAnimation(elementIdBSTR, element.get(), time, &wasRunning);
-    SysFreeString(elementIdBSTR);
-
-    return SUCCEEDED(hr) && wasRunning;
-}
-
 unsigned LayoutTestController::numberOfActiveAnimations() const
 {
     COMPtr<IWebFramePrivate> framePrivate(Query, frame);
diff --git a/Tools/DumpRenderTree/wx/LayoutTestControllerWx.cpp b/Tools/DumpRenderTree/wx/LayoutTestControllerWx.cpp
index b2f7fb479..ff746440e 100644
--- a/Tools/DumpRenderTree/wx/LayoutTestControllerWx.cpp
+++ b/Tools/DumpRenderTree/wx/LayoutTestControllerWx.cpp
@@ -399,12 +399,6 @@ bool LayoutTestController::pauseAnimationAtTimeOnElementWithId(JSStringRef anima
     return false;
 }
 
-bool LayoutTestController::sampleSVGAnimationForElementAtTime(JSStringRef animationId, double time, JSStringRef elementId)
-{
-    // FIXME: implement
-    return false;
-}
-
 void LayoutTestController::setCacheModel(int)
 {
     // FIXME: implement
diff --git a/Tools/EWebLauncher/CMakeLists.txt b/Tools/EWebLauncher/CMakeLists.txt
index c2da94039..40c1eba4d 100644
--- a/Tools/EWebLauncher/CMakeLists.txt
+++ b/Tools/EWebLauncher/CMakeLists.txt
@@ -14,6 +14,8 @@ SET(EWebLauncher_LIBRARIES
     ${LIBXML2_LIBRARIES}
     ${LIBXSLT_LIBRARIES}
     ${SQLITE_LIBRARIES}
+    ${Glib_LIBRARIES}
+    ${LIBSOUP24_LIBRARIES}
 )
 
 SET(EWebLauncher_INCLUDE_DIRECTORIES
@@ -22,6 +24,8 @@ SET(EWebLauncher_INCLUDE_DIRECTORIES
     ${EDJE_INCLUDE_DIRS}
     ${EFLDEPS_INCLUDE_DIRS}
     ${EVAS_INCLUDE_DIRS}
+    ${Glib_INCLUDE_DIRS}
+    ${LIBSOUP24_INCLUDE_DIRS}
 )
 
 SET(EWebLauncher_LINK_FLAGS
@@ -29,26 +33,9 @@ SET(EWebLauncher_LINK_FLAGS
     ${EDJE_LDFLAGS}
     ${EFLDEPS_LDFLAGS}
     ${EVAS_LDFLAGS}
+    ${LIBSOUP24_LDFLAGS}
 )
 
-IF (ENABLE_GLIB_SUPPORT)
-    LIST(APPEND EWebLauncher_LIBRARIES
-        ${Gdk_LIBRARIES}
-        ${Glib_LIBRARIES}
-        ${Gthread_LIBRARIES}
-    )
-ENDIF ()
-
-IF (WTF_USE_SOUP)
-    LIST(APPEND EWebLauncher_LIBRARIES ${LIBSOUP24_LIBRARIES})
-    LIST(APPEND EWebLauncher_LINK_FLAGS ${LIBSOUP24_LDFLAGS})
-ENDIF ()
-
-IF (WTF_USE_CURL)
-    LIST(APPEND EWebLauncher_LIBRARIES ${CURL_LIBRARIES})
-    LIST(APPEND EWebLauncher_LINK_FLAGS ${CURL_LDFLAGS})
-ENDIF ()
-
 ADD_DEFINITIONS(-DDATA_DIR=\"${THEME_BINARY_DIR}\")
 
 INCLUDE_DIRECTORIES(${EWebLauncher_INCLUDE_DIRECTORIES})
diff --git a/Tools/EWebLauncher/main.c b/Tools/EWebLauncher/main.c
index 2d64d4a05..f5453f720 100644
--- a/Tools/EWebLauncher/main.c
+++ b/Tools/EWebLauncher/main.c
@@ -429,6 +429,7 @@ on_key_down(void *data, Evas *e, Evas_Object *obj, void *event_info)
         NULL
     };
     static int currentEncoding = -1;
+    Eina_Bool ctrlPressed = evas_key_modifier_is_set(evas_key_modifier_get(e), "Control");
 
     if (!strcmp(ev->key, "Escape")) {
         closeWindow(app->ee);
@@ -527,7 +528,7 @@ on_key_down(void *data, Evas *e, Evas_Object *obj, void *event_info)
         browserCreate("http://www.google.com",
                        app->theme, app->userAgent, geometry, app-> backingStore,
                        NULL, app->isFlattening, 0, NULL);
-    } else if (!strcmp(ev->key, "F10")) {
+    } else if (!strcmp(ev->key, "g") && ctrlPressed ) {
         Evas_Coord x, y, w, h;
         Evas_Object *frame = ewk_view_frame_main_get(obj);
         float zoom = zoomLevels[currentZoomLevel] / 100.0;
@@ -539,18 +540,18 @@ on_key_down(void *data, Evas *e, Evas_Object *obj, void *event_info)
         h *= 4;
         info("Pre-render %d,%d + %dx%d\n", x, y, w, h);
         ewk_view_pre_render_region(obj, x, y, w, h, zoom);
-    } else if (!strcmp(ev->key, "F11")) {
+    } else if (!strcmp(ev->key, "r") && ctrlPressed) {
         info("Pre-render 1 extra column/row with current zoom");
         ewk_view_pre_render_relative_radius(obj, 1);
-    } else if (!strcmp(ev->key, "d")) {
+    } else if (!strcmp(ev->key, "p") && ctrlPressed) {
+        info("Pre-rendering start");
+        ewk_view_pre_render_start(obj);
+    } else if (!strcmp(ev->key, "d") && ctrlPressed) {
         info("Render suspended");
         ewk_view_disable_render(obj);
-    } else if (!strcmp(ev->key, "e")) {
+    } else if (!strcmp(ev->key, "e") && ctrlPressed) {
         info("Render resumed");
         ewk_view_enable_render(obj);
-    } else if (!strcmp(ev->key, "Insert")) {
-        info("Pre-rendering start");
-        ewk_view_pre_render_start(obj);
     }
 }
 
diff --git a/Tools/GNUmakefile.am b/Tools/GNUmakefile.am
index fc8ed6be0..981f60811 100644
--- a/Tools/GNUmakefile.am
+++ b/Tools/GNUmakefile.am
@@ -188,11 +188,11 @@ noinst_LTLIBRARIES += \
 
 TestNetscapePlugin_libtestnetscapeplugin_la_CPPFLAGS = \
 	-I$(srcdir)/Tools/DumpRenderTree \
-	-I$(srcdir)/Tools/DumpRenderTree/unix/TestNetscapePlugin/ForwardingHeaders \
 	-I$(srcdir)/Source/WebCore \
 	-I$(srcdir)/Source/WebCore/bridge \
 	-I$(srcdir)/Source/WebCore/plugins \
 	-I$(srcdir)/Tools/DumpRenderTree/TestNetscapePlugIn \
+	-I$(srcdir)/Tools/DumpRenderTree/TestNetscapePlugIn/unix/ForwardingHeaders \
 	$(global_cppflags) \
 	$(javascriptcore_cppflags)
 
@@ -202,9 +202,6 @@ TestNetscapePlugin_libtestnetscapeplugin_la_CPPFLAGS += -DXP_UNIX
 endif
 
 TestNetscapePlugin_libtestnetscapeplugin_la_SOURCES = \
-	Tools/DumpRenderTree/unix/TestNetscapePlugin/ForwardingHeaders/WebKit/npapi.h \
-	Tools/DumpRenderTree/unix/TestNetscapePlugin/ForwardingHeaders/WebKit/npfunctions.h \
-	Tools/DumpRenderTree/unix/TestNetscapePlugin/ForwardingHeaders/WebKit/npruntime.h \
 	Tools/DumpRenderTree/TestNetscapePlugIn/Tests/DocumentOpenInDestroyStream.cpp \
 	Tools/DumpRenderTree/TestNetscapePlugIn/Tests/EvaluateJSAfterRemovingPluginElement.cpp \
 	Tools/DumpRenderTree/TestNetscapePlugIn/Tests/FormValue.cpp \
@@ -227,7 +224,10 @@ TestNetscapePlugin_libtestnetscapeplugin_la_SOURCES = \
 	Tools/DumpRenderTree/TestNetscapePlugIn/PluginObject.h \
 	Tools/DumpRenderTree/TestNetscapePlugIn/TestObject.cpp \
 	Tools/DumpRenderTree/TestNetscapePlugIn/TestObject.h \
-	Tools/DumpRenderTree/TestNetscapePlugIn/main.cpp
+	Tools/DumpRenderTree/TestNetscapePlugIn/main.cpp \
+	Tools/DumpRenderTree/TestNetscapePlugin/unix/ForwardingHeaders/WebKit/npapi.h \
+	Tools/DumpRenderTree/TestNetscapePlugin/unix/ForwardingHeaders/WebKit/npfunctions.h \
+	Tools/DumpRenderTree/TestNetscapePlugin/unix/ForwardingHeaders/WebKit/npruntime.h
 
 TestNetscapePlugin_libtestnetscapeplugin_la_LDFLAGS = \
 	-rpath ${shell pwd}/$(top_builddir)/../unix/TestNetscapePlugin/.libs \
diff --git a/Tools/GtkLauncher/main.c b/Tools/GtkLauncher/main.c
index e3a66b03e..587405fc4 100644
--- a/Tools/GtkLauncher/main.c
+++ b/Tools/GtkLauncher/main.c
@@ -123,7 +123,79 @@ static gboolean closeWebViewCb(WebKitWebView* webView, GtkWidget* window)
     return TRUE;
 }
 
-static GtkWidget* createBrowser(GtkWidget* window, GtkWidget* uriEntry, GtkWidget* statusbar, WebKitWebView* webView)
+static gboolean webViewFullscreenMessageWindowClose(GtkWidget *dialog)
+{
+    if (GTK_IS_WIDGET(dialog))
+        gtk_widget_destroy(dialog);
+    return FALSE;
+}
+
+static gboolean webViewWindowStateEvent(GtkWidget *widget, GdkEventWindowState *event, WebKitWebView *webView)
+{
+    if (event->new_window_state & GDK_WINDOW_STATE_FULLSCREEN) {
+        WebKitWebFrame *frame = webkit_web_view_get_main_frame(webView);
+        const gchar *uri = webkit_web_frame_get_uri(frame);
+        GtkWidget *window = gtk_widget_get_toplevel(GTK_WIDGET(webView));
+        if (!gtk_widget_is_toplevel(window) || !GTK_IS_WINDOW(window) || GTK_IS_OFFSCREEN_WINDOW(window))
+            window = 0;
+
+        GtkWidget *dialog = gtk_message_dialog_new(window ? GTK_WINDOW(window) : 0,
+                                                    GTK_DIALOG_MODAL,
+                                                    GTK_MESSAGE_INFO,
+                                                    GTK_BUTTONS_CLOSE,
+                                                    "%s is now full screen. Press ESC or f to exit.", uri);
+        g_signal_connect_swapped(dialog, "response", G_CALLBACK(gtk_widget_destroy), dialog);
+        g_timeout_add(1500, (GSourceFunc) webViewFullscreenMessageWindowClose, dialog);
+        gtk_dialog_run(GTK_DIALOG(dialog));
+    }
+    return TRUE;
+}
+
+static void hideWidget(GtkWidget* widget, gpointer data)
+{
+    if (!GTK_IS_SCROLLED_WINDOW(widget))
+        gtk_widget_hide(widget);
+}
+
+static void showWidget(GtkWidget* widget, gpointer data)
+{
+    if (!GTK_IS_SCROLLED_WINDOW(widget))
+        gtk_widget_show(widget);
+}
+
+static gboolean webViewEnteringFullScreen(WebKitWebView *webView, GObject *element, GtkWidget* vbox)
+{
+    WebKitWebFrame *frame = webkit_web_view_get_main_frame(webView);
+    const gchar *uri = webkit_web_frame_get_uri(frame);
+    GtkWidget *window = gtk_widget_get_toplevel(GTK_WIDGET(webView));
+    if (!gtk_widget_is_toplevel(window) || !GTK_IS_WINDOW(window) || GTK_IS_OFFSCREEN_WINDOW(window))
+        window = 0;
+
+    GtkWidget *dialog = gtk_message_dialog_new(window ? GTK_WINDOW(window) : 0,
+                                               GTK_DIALOG_MODAL,
+                                               GTK_MESSAGE_INFO,
+                                               GTK_BUTTONS_YES_NO,
+                                               "Allow full screen display of %s ?", uri);
+    gint result = gtk_dialog_run(GTK_DIALOG(dialog));
+    if (result == GTK_RESPONSE_YES) {
+        gtk_container_foreach(GTK_CONTAINER(vbox), (GtkCallback) hideWidget, NULL);
+        gtk_widget_destroy(GTK_WIDGET(dialog));
+        return FALSE;
+    }
+    gtk_widget_destroy(GTK_WIDGET(dialog));
+    return TRUE;
+}
+
+static gboolean webViewLeavingFullScreen(WebKitWebView *webView, GObject *element, GtkWidget* vbox)
+{
+    GtkWidget *window = gtk_widget_get_toplevel(GTK_WIDGET(webView));
+    if (gtk_widget_is_toplevel(window) && GTK_IS_WINDOW(window) && !GTK_IS_OFFSCREEN_WINDOW(window))
+        g_signal_handlers_disconnect_by_func(window, G_CALLBACK(webViewWindowStateEvent), webView);
+    gtk_container_foreach(GTK_CONTAINER(vbox), (GtkCallback) showWidget, NULL);
+    return FALSE;
+}
+
+static GtkWidget* createBrowser(GtkWidget* window, GtkWidget* uriEntry, GtkWidget* statusbar, WebKitWebView* webView, GtkWidget* vbox)
 {
     GtkWidget *scrolledWindow = gtk_scrolled_window_new(NULL, NULL);
     gtk_scrolled_window_set_policy(GTK_SCROLLED_WINDOW(scrolledWindow), GTK_POLICY_AUTOMATIC, GTK_POLICY_AUTOMATIC);
@@ -137,6 +209,8 @@ static GtkWidget* createBrowser(GtkWidget* window, GtkWidget* uriEntry, GtkWidge
     g_signal_connect(webView, "create-web-view", G_CALLBACK(createWebViewCb), window);
     g_signal_connect(webView, "web-view-ready", G_CALLBACK(webViewReadyCb), window);
     g_signal_connect(webView, "close-web-view", G_CALLBACK(closeWebViewCb), window);
+    g_signal_connect(webView, "entering-fullscreen", G_CALLBACK(webViewEnteringFullScreen), vbox);
+    g_signal_connect(webView, "leaving-fullscreen", G_CALLBACK(webViewLeavingFullScreen), vbox);
 
     return scrolledWindow;
 }
@@ -214,7 +288,7 @@ static GtkWidget* createWindow(WebKitWebView** outWebView)
 #endif
     statusbar = createStatusbar(webView);
     gtk_box_pack_start(GTK_BOX(vbox), createToolbar(uriEntry, webView), FALSE, FALSE, 0);
-    gtk_box_pack_start(GTK_BOX(vbox), createBrowser(window, uriEntry, statusbar, webView), TRUE, TRUE, 0);
+    gtk_box_pack_start(GTK_BOX(vbox), createBrowser(window, uriEntry, statusbar, webView, vbox), TRUE, TRUE, 0);
     gtk_box_pack_start(GTK_BOX(vbox), statusbar, FALSE, FALSE, 0);
 
     gtk_container_add(GTK_CONTAINER(window), vbox);
diff --git a/Tools/MiniBrowser/Configurations/Base.xcconfig b/Tools/MiniBrowser/Configurations/Base.xcconfig
index 7c3e8afab..72079287f 100644
--- a/Tools/MiniBrowser/Configurations/Base.xcconfig
+++ b/Tools/MiniBrowser/Configurations/Base.xcconfig
@@ -36,6 +36,11 @@ WARNING_CFLAGS = -Wall -W -Wno-unused-parameter
 LINKER_DISPLAYS_MANGLED_NAMES = YES;
 VALID_ARCHS = i386 x86_64;
 
+CLANG_CXX_LIBRARY = $(CLANG_CXX_LIBRARY_$(TARGET_MAC_OS_X_VERSION_MAJOR));
+CLANG_CXX_LIBRARY_1060 = libstdc++;
+CLANG_CXX_LIBRARY_1070 = libc++;
+CLANG_CXX_LIBRARY_1080 = libc++;
+CLANG_CXX_LIBRARY_1090 = libc++;
 
 REAL_PLATFORM_NAME = $(REAL_PLATFORM_NAME_$(PLATFORM_NAME));
 REAL_PLATFORM_NAME_ = $(REAL_PLATFORM_NAME_macosx);
diff --git a/Tools/MiniBrowser/gtk/BrowserWindow.c b/Tools/MiniBrowser/gtk/BrowserWindow.c
index 4d6bde488..74518444c 100644
--- a/Tools/MiniBrowser/gtk/BrowserWindow.c
+++ b/Tools/MiniBrowser/gtk/BrowserWindow.c
@@ -42,6 +42,8 @@ struct _BrowserWindow {
     GtkWidget *uriEntry;
     GtkWidget *backItem;
     GtkWidget *forwardItem;
+    GtkWidget *zoomInItem;
+    GtkWidget *zoomOutItem;
     GtkWidget *statusLabel;
     GtkWidget *settingsDialog;
     WebKitWebView *webView;
@@ -53,6 +55,9 @@ struct _BrowserWindowClass {
 };
 
 static const char *defaultWindowTitle = "WebKitGTK+ MiniBrwoser";
+static const gdouble minimumZoomLevel = 0.5;
+static const gdouble maximumZoomLevel = 3;
+static const gdouble zoomStep = 1.2;
 static gint windowCount = 0;
 
 G_DEFINE_TYPE(BrowserWindow, browser_window, GTK_TYPE_WINDOW)
@@ -75,6 +80,11 @@ static void activateUriEntryCallback(BrowserWindow *window)
     webkit_web_view_load_uri(window->webView, gtk_entry_get_text(GTK_ENTRY(window->uriEntry)));
 }
 
+static void reloadCallback(BrowserWindow *window)
+{
+    webkit_web_view_reload(window->webView);
+}
+
 static void goBackCallback(BrowserWindow *window)
 {
     webkit_web_view_go_back(window->webView);
@@ -162,9 +172,6 @@ static GtkWidget *browserWindowCreateBackForwardMenu(BrowserWindow *window, GLis
         gtk_widget_show(menuItem);
     }
 
-    /* FIXME: This shoulnd't be necessary when didMouseMoveOverElement
-     * is implemented in WebKit2 GTK+ API.
-     */
     g_signal_connect(menu, "hide", G_CALLBACK(resetStatusText), window);
 
     return menu;
@@ -255,6 +262,50 @@ static gboolean webViewDecidePolicy(WebKitWebView *webView, WebKitPolicyDecision
     return TRUE;
 }
 
+static void webViewMouseTargetChanged(WebKitWebView *webView, WebKitHitTestResult *hitTestResult, guint mouseModifiers, BrowserWindow *window)
+{
+    if (!webkit_hit_test_result_context_is_link(hitTestResult)) {
+        browserWindowSetStatusText(window, NULL);
+        return;
+    }
+    browserWindowSetStatusText(window, webkit_hit_test_result_get_link_uri(hitTestResult));
+}
+
+static gboolean browserWindowCanZoomIn(BrowserWindow *window)
+{
+    gdouble zoomLevel = webkit_web_view_get_zoom_level(window->webView) * zoomStep;
+    return zoomLevel < maximumZoomLevel;
+}
+
+static gboolean browserWindowCanZoomOut(BrowserWindow *window)
+{
+    gdouble zoomLevel = webkit_web_view_get_zoom_level(window->webView) / zoomStep;
+    return zoomLevel > minimumZoomLevel;
+}
+
+static void browserWindowUpdateZoomActions(BrowserWindow *window)
+{
+    gtk_widget_set_sensitive(window->zoomInItem, browserWindowCanZoomIn(window));
+    gtk_widget_set_sensitive(window->zoomOutItem, browserWindowCanZoomOut(window));
+}
+
+static void webViewZoomLevelChanged(GObject *object, GParamSpec *paramSpec, BrowserWindow *window)
+{
+    browserWindowUpdateZoomActions(window);
+}
+
+static void zoomInCallback(BrowserWindow *window)
+{
+    gdouble zoomLevel = webkit_web_view_get_zoom_level(window->webView) * zoomStep;
+    webkit_web_view_set_zoom_level(window->webView, zoomLevel);
+}
+
+static void zoomOutCallback(BrowserWindow *window)
+{
+    gdouble zoomLevel = webkit_web_view_get_zoom_level(window->webView) / zoomStep;
+    webkit_web_view_set_zoom_level(window->webView, zoomLevel);
+}
+
 static void browserWindowFinalize(GObject *gObject)
 {
     G_OBJECT_CLASS(browser_window_parent_class)->finalize(gObject);
@@ -323,6 +374,18 @@ static void browser_window_init(BrowserWindow *window)
     gtk_toolbar_insert(GTK_TOOLBAR(toolbar), item, -1);
     gtk_widget_show(GTK_WIDGET(item));
 
+    item = gtk_tool_button_new_from_stock(GTK_STOCK_ZOOM_OUT);
+    window->zoomOutItem = GTK_WIDGET(item);
+    g_signal_connect_swapped(item, "clicked", G_CALLBACK(zoomOutCallback), window);
+    gtk_toolbar_insert(GTK_TOOLBAR(toolbar), item, -1);
+    gtk_widget_show(GTK_WIDGET(item));
+
+    item = gtk_tool_button_new_from_stock(GTK_STOCK_ZOOM_IN);
+    window->zoomInItem = GTK_WIDGET(item);
+    g_signal_connect_swapped(item, "clicked", G_CALLBACK(zoomInCallback), window);
+    gtk_toolbar_insert(GTK_TOOLBAR(toolbar), item, -1);
+    gtk_widget_show(GTK_WIDGET(item));
+
     item = gtk_tool_item_new();
     gtk_tool_item_set_expand(item, TRUE);
     gtk_container_add(GTK_CONTAINER(item), window->uriEntry);
@@ -331,7 +394,7 @@ static void browser_window_init(BrowserWindow *window)
     gtk_widget_show(GTK_WIDGET(item));
 
     item = gtk_tool_button_new_from_stock(GTK_STOCK_OK);
-    g_signal_connect_swapped(item, "clicked", G_CALLBACK(activateUriEntryCallback), (gpointer)window);
+    g_signal_connect_swapped(item, "clicked", G_CALLBACK(reloadCallback), window);
     gtk_toolbar_insert(GTK_TOOLBAR(toolbar), item, -1);
     gtk_widget_show(GTK_WIDGET(item));
 
@@ -348,12 +411,16 @@ static void browserWindowConstructed(GObject *gObject)
 {
     BrowserWindow *window = BROWSER_WINDOW(gObject);
 
+    browserWindowUpdateZoomActions(window);
+
     g_signal_connect(window->webView, "notify::uri", G_CALLBACK(webViewURIChanged), window);
     g_signal_connect(window->webView, "notify::estimated-load-progress", G_CALLBACK(webViewLoadProgressChanged), window);
     g_signal_connect(window->webView, "notify::title", G_CALLBACK(webViewTitleChanged), window);
     g_signal_connect(window->webView, "create", G_CALLBACK(webViewCreate), window);
     g_signal_connect(window->webView, "load-failed", G_CALLBACK(webViewLoadFailed), window);
     g_signal_connect(window->webView, "decide-policy", G_CALLBACK(webViewDecidePolicy), window);
+    g_signal_connect(window->webView, "mouse-target-changed", G_CALLBACK(webViewMouseTargetChanged), window);
+    g_signal_connect(window->webView, "notify::zoom-level", G_CALLBACK(webViewZoomLevelChanged), window);
 
     WebKitBackForwardList *backForwadlist = webkit_web_view_get_back_forward_list(window->webView);
     g_signal_connect(backForwadlist, "changed", G_CALLBACK(backForwadlistChanged), window);
diff --git a/Tools/MiniBrowser/gtk/GNUmakefile.am b/Tools/MiniBrowser/gtk/GNUmakefile.am
index 2a020f6e5..9e42e194f 100644
--- a/Tools/MiniBrowser/gtk/GNUmakefile.am
+++ b/Tools/MiniBrowser/gtk/GNUmakefile.am
@@ -1,5 +1,7 @@
+if ENABLE_WEBKIT2
 noinst_PROGRAMS += \
 	Programs/MiniBrowser
+endif
 
 Programs_MiniBrowser_CPPFLAGS = \
 	-I$(srcdir)/Source \
diff --git a/Tools/MiniBrowser/mac/BrowserWindowController.m b/Tools/MiniBrowser/mac/BrowserWindowController.m
index b6a30f17b..5dbd5a7dd 100644
--- a/Tools/MiniBrowser/mac/BrowserWindowController.m
+++ b/Tools/MiniBrowser/mac/BrowserWindowController.m
@@ -606,9 +606,10 @@ static void runOpenPanel(WKPageRef page, WKFrameRef frame, WKOpenPanelParameters
         processDidExit,
         didChangeBackForwardList,
         0, // shouldGoToBackForwardItem
-        0,  // didFailToInitializePlugin
+        0, // didFailToInitializePlugin
         didDetectXSSForFrame,
         0, // didNewFirstVisuallyNonEmptyLayout
+        0, // willGoToBackForwardListItem
     };
     WKPageSetPageLoaderClient(_webView.pageRef, &loadClient);
     
diff --git a/Tools/MiniBrowser/qt/MiniBrowser.pro b/Tools/MiniBrowser/qt/MiniBrowser.pro
index 32389f2e8..f2290c86b 100644
--- a/Tools/MiniBrowser/qt/MiniBrowser.pro
+++ b/Tools/MiniBrowser/qt/MiniBrowser.pro
@@ -24,7 +24,7 @@ DESTDIR = $${ROOT_BUILD_DIR}/bin
 
 CONFIG += qtwebkit qtwebkit-private
 
-QT += network declarative widgets quick
+QT += network declarative quick
 macx: QT += xml
 
 RESOURCES += MiniBrowser.qrc
diff --git a/Tools/MiniBrowser/qt/MiniBrowser.qrc b/Tools/MiniBrowser/qt/MiniBrowser.qrc
index d71d41fc5..272350e7d 100644
--- a/Tools/MiniBrowser/qt/MiniBrowser.qrc
+++ b/Tools/MiniBrowser/qt/MiniBrowser.qrc
@@ -9,6 +9,7 @@
         <file>icons/touch.png</file>
         <file>icons/touchpoint.png</file>
         <file>qml/AlertDialog.qml</file>
+        <file>qml/AuthenticationDialog.qml</file>
         <file>qml/BrowserWindow.qml</file>
         <file>qml/ConfirmDialog.qml</file>
         <file>qml/Dialog.qml</file>
@@ -17,6 +18,7 @@
         <file>qml/ItemSelector.qml</file>
         <file>qml/MockTouchPoint.qml</file>
         <file>qml/PromptDialog.qml</file>
+        <file>qml/ProxyAuthenticationDialog.qml</file>
         <file>qml/ViewportInfoItem.qml</file>
         <file>useragentlist.txt</file>
         <file>icons/favicon.png</file>
diff --git a/Tools/MiniBrowser/qt/MiniBrowserApplication.cpp b/Tools/MiniBrowser/qt/MiniBrowserApplication.cpp
index 57a55928b..2ec95adbd 100644
--- a/Tools/MiniBrowser/qt/MiniBrowserApplication.cpp
+++ b/Tools/MiniBrowser/qt/MiniBrowserApplication.cpp
@@ -35,7 +35,6 @@
 #include <QEvent>
 #include <QMouseEvent>
 #include <QTouchEvent>
-#include <QApplication>
 
 static inline bool isTouchEvent(const QEvent* event)
 {
@@ -63,13 +62,14 @@ static inline bool isMouseEvent(const QEvent* event)
 }
 
 MiniBrowserApplication::MiniBrowserApplication(int& argc, char** argv)
-    : QApplication(argc, argv)
+    : QGuiApplication(argc, argv)
     , m_realTouchEventReceived(false)
     , m_pendingFakeTouchEventCount(0)
     , m_isRobotized(false)
     , m_robotTimeoutSeconds(0)
     , m_robotExtraTimeSeconds(0)
     , m_windowOptions(this)
+    , m_holdingControl(false)
 {
     setOrganizationName("Nokia");
     setApplicationName("QtMiniBrowser");
@@ -80,23 +80,28 @@ MiniBrowserApplication::MiniBrowserApplication(int& argc, char** argv)
 
 bool MiniBrowserApplication::notify(QObject* target, QEvent* event)
 {
+    if(QInputEvent* ie = static_cast<QInputEvent*>(event))
+        m_holdingControl = ie->modifiers().testFlag(Qt::ControlModifier);
+    else
+        m_holdingControl = false;
+
     // We try to be smart, if we received real touch event, we are probably on a device
     // with touch screen, and we should not have touch mocking.
 
     if (!event->spontaneous() || m_realTouchEventReceived || !m_windowOptions.touchMockingEnabled())
-        return QApplication::notify(target, event);
+        return QGuiApplication::notify(target, event);
 
     if (isTouchEvent(event) && static_cast<QTouchEvent*>(event)->deviceType() == QTouchEvent::TouchScreen) {
         if (m_pendingFakeTouchEventCount)
             --m_pendingFakeTouchEventCount;
         else
             m_realTouchEventReceived = true;
-        return QApplication::notify(target, event);
+        return QGuiApplication::notify(target, event);
     }
 
     BrowserWindow* browserWindow = qobject_cast<BrowserWindow*>(target);
     if (!browserWindow)
-        return QApplication::notify(target, event);
+        return QGuiApplication::notify(target, event);
 
     // In QML events are propagated through parents. But since the WebView
     // may consume key events, a shortcut might never reach the top QQuickItem.
@@ -139,16 +144,16 @@ bool MiniBrowserApplication::notify(QObject* target, QEvent* event)
             break;
         case QEvent::MouseMove:
             if (!mouseEvent->buttons() || !m_touchPoints.contains(mouseEvent->buttons()))
-                return QApplication::notify(target, event);
+                return QGuiApplication::notify(target, event);
             touchPoint.id = mouseEvent->buttons();
             touchPoint.state = Qt::TouchPointMoved;
             break;
         case QEvent::MouseButtonRelease:
             touchPoint.state = Qt::TouchPointReleased;
             touchPoint.id = mouseEvent->button();
-            if (mouseEvent->modifiers().testFlag(Qt::ControlModifier)) {
+            if (m_holdingControl) {
                 m_heldTouchPoints.insert(touchPoint.id);
-                return QApplication::notify(target, event);
+                return QGuiApplication::notify(target, event);
             }
             break;
         default:
@@ -167,7 +172,7 @@ bool MiniBrowserApplication::notify(QObject* target, QEvent* event)
         sendTouchEvent(browserWindow);
     }
 
-    return QApplication::notify(target, event);
+    return QGuiApplication::notify(target, event);
 }
 
 void MiniBrowserApplication::sendTouchEvent(BrowserWindow* browserWindow)
@@ -182,14 +187,13 @@ void MiniBrowserApplication::sendTouchEvent(BrowserWindow* browserWindow)
     m_pendingFakeTouchEventCount++;
     QWindowSystemInterface::handleTouchEvent(browserWindow, device, m_touchPoints.values());
 
-    bool holdingControl = QApplication::keyboardModifiers().testFlag(Qt::ControlModifier);
     if (QQuickWebViewExperimental::flickableViewportEnabled())
-        browserWindow->updateVisualMockTouchPoints(holdingControl ? m_touchPoints.values() : QList<QWindowSystemInterface::TouchPoint>());
+        browserWindow->updateVisualMockTouchPoints(m_holdingControl ? m_touchPoints.values() : QList<QWindowSystemInterface::TouchPoint>());
 
     // Get rid of touch-points that are no longer valid
     foreach (const QWindowSystemInterface::TouchPoint& touchPoint, m_touchPoints) {
-    if (touchPoint.state ==  Qt::TouchPointReleased)
-        m_touchPoints.remove(touchPoint.id);
+        if (touchPoint.state ==  Qt::TouchPointReleased)
+            m_touchPoints.remove(touchPoint.id);
     }
 }
 
diff --git a/Tools/MiniBrowser/qt/MiniBrowserApplication.h b/Tools/MiniBrowser/qt/MiniBrowserApplication.h
index b5565855e..0441fadd7 100644
--- a/Tools/MiniBrowser/qt/MiniBrowserApplication.h
+++ b/Tools/MiniBrowser/qt/MiniBrowserApplication.h
@@ -33,7 +33,7 @@
 #include <QObject>
 #include <QStringList>
 #include <QtDeclarative>
-#include <QtWidgets/QApplication>
+#include <QGuiApplication>
 #include <QTouchEvent>
 #include <QUrl>
 #include "qwindowsysteminterface_qpa.h"
@@ -84,7 +84,7 @@ private:
     QSize m_windowSize;
 };
 
-class MiniBrowserApplication : public QApplication {
+class MiniBrowserApplication : public QGuiApplication {
     Q_OBJECT
 
 public:
@@ -113,6 +113,7 @@ private:
     QSet<int> m_heldTouchPoints;
 
     WindowOptions m_windowOptions;
+    bool m_holdingControl;
 };
 
 QML_DECLARE_TYPE(WindowOptions);
diff --git a/Tools/MiniBrowser/qt/qml/AuthenticationDialog.qml b/Tools/MiniBrowser/qt/qml/AuthenticationDialog.qml
new file mode 100644
index 000000000..1d88d3f15
--- /dev/null
+++ b/Tools/MiniBrowser/qt/qml/AuthenticationDialog.qml
@@ -0,0 +1,70 @@
+/*
+ * Copyright (C) 2012 Nokia Corporation and/or its subsidiary(-ies)
+ *
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+import QtQuick 2.0
+
+Dialog {
+    id: dialog
+
+    title: "Authentication required." 
+    message: model.hostname + " requires authentication."
+
+    height: 250
+
+    DialogLineInput {
+        id: input
+        width: dialog.width - 30
+        text: model.prefilledUsername
+
+        onAccepted: model.accept(input.text, passwordInput.text)
+    }
+
+    DialogLineInput {
+        id: passwordInput
+        text: "" 
+        width: dialog.width - 30
+        echoMode: TextInput.PasswordEchoOnEdit
+
+        onAccepted: model.accept(input.text, passwordInput.text)
+    }
+
+    Row {
+        id: buttonRow
+        spacing: 5
+        anchors.horizontalCenter: parent.horizontalCenter
+
+        DialogButton {
+            text: "OK"
+            onClicked: model.accept(input.text, passwordInput.text)
+        }
+
+        DialogButton {
+            text: "Cancel"
+            onClicked: model.reject()
+        }
+    }
+}
diff --git a/Tools/MiniBrowser/qt/qml/BrowserWindow.qml b/Tools/MiniBrowser/qt/qml/BrowserWindow.qml
index 65999dd32..3268d03f4 100644
--- a/Tools/MiniBrowser/qt/qml/BrowserWindow.qml
+++ b/Tools/MiniBrowser/qt/qml/BrowserWindow.qml
@@ -310,6 +310,8 @@ Rectangle {
         experimental.alertDialog: AlertDialog { }
         experimental.confirmDialog: ConfirmDialog { }
         experimental.promptDialog: PromptDialog { }
+        experimental.authenticationDialog: AuthenticationDialog { }
+        experimental.proxyAuthenticationDialog: ProxyAuthenticationDialog { }
     }
 
     ViewportInfoItem {
diff --git a/Tools/MiniBrowser/qt/qml/DialogLineInput.qml b/Tools/MiniBrowser/qt/qml/DialogLineInput.qml
index 1c85ff962..84faa5510 100644
--- a/Tools/MiniBrowser/qt/qml/DialogLineInput.qml
+++ b/Tools/MiniBrowser/qt/qml/DialogLineInput.qml
@@ -31,6 +31,7 @@ Rectangle {
     id: dialogLineInput
 
     property alias text: input.text
+    property alias echoMode: input.echoMode
     signal accepted()
 
     height: 20
diff --git a/Source/WebCore/WebCore.gyp/mac/Empty.cpp b/Tools/MiniBrowser/qt/qml/ProxyAuthenticationDialog.qml
index d25a2b763..ae27f2653 100644
--- a/Source/WebCore/WebCore.gyp/mac/Empty.cpp
+++ b/Tools/MiniBrowser/qt/qml/ProxyAuthenticationDialog.qml
@@ -1,5 +1,7 @@
 /*
- * Copyright (C) 2009 Google Inc. All rights reserved.
+ * Copyright (C) 2012 Nokia Corporation and/or its subsidiary(-ies)
+ *
+ * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -20,8 +22,14 @@
  * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
  * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-// This is an empty file used to convince Xcode to link a library when it
-// wouldn't otherwise have any reason to do so.
+import QtQuick 2.0
+
+AuthenticationDialog {
+    id: dialog
+
+    title: "Proxy authentication required."
+    message: model.hostname + ":" + model.port + " requires authentication."
+}
diff --git a/Tools/QtTestBrowser/QtTestBrowser.pro b/Tools/QtTestBrowser/QtTestBrowser.pro
index 7fbb1e924..1319967d4 100644
--- a/Tools/QtTestBrowser/QtTestBrowser.pro
+++ b/Tools/QtTestBrowser/QtTestBrowser.pro
@@ -52,7 +52,10 @@ haveQt(5): QT += printsupport widgets
 
 contains(DEFINES, HAVE_FONTCONFIG=1): PKGCONFIG += fontconfig
 
-contains(QT_CONFIG, opengl): QT += opengl
+contains(QT_CONFIG, opengl) {
+    QT += opengl
+    DEFINES += QT_CONFIGURED_WITH_OPENGL
+}
 
 RESOURCES += \
     QtTestBrowser.qrc
diff --git a/Tools/QtTestBrowser/locationedit.h b/Tools/QtTestBrowser/locationedit.h
index b64474de7..54d8a6835 100644
--- a/Tools/QtTestBrowser/locationedit.h
+++ b/Tools/QtTestBrowser/locationedit.h
@@ -28,8 +28,6 @@
 #ifndef locationedit_h
 #define locationedit_h
 
-#include <qconfig.h>
-
 #ifndef QT_NO_INPUTDIALOG
 #include <QApplication>
 #include <QIcon>
diff --git a/Tools/QueueStatusServer/model/queues.py b/Tools/QueueStatusServer/model/queues.py
index bd5e7ed62..b13289150 100644
--- a/Tools/QueueStatusServer/model/queues.py
+++ b/Tools/QueueStatusServer/model/queues.py
@@ -39,13 +39,12 @@ class Queue(object):
     _all_queue_names = [
         "commit-queue",
         "style-queue",
-        "chromium-ews",
+        "chromium-ews",  # aka cr-linux-ews
         "qt-ews",
         "gtk-ews",
         "mac-ews",
         "win-ews",
         "efl-ews",
-        "cr-mac-ews",
     ]
 
     def __init__(self, name):
diff --git a/Tools/Scripts/build-webkit b/Tools/Scripts/build-webkit
index 021a0bb82..c1abe7ca7 100755
--- a/Tools/Scripts/build-webkit
+++ b/Tools/Scripts/build-webkit
@@ -86,6 +86,7 @@ my (
     $downloadAttributeSupport,
     $fileSystemSupport,
     $filtersSupport,
+    $ftpDirSupport,
     $fullscreenAPISupport,
     $gamepadSupport,
     $geolocationSupport,
@@ -127,6 +128,7 @@ my (
     $tiledBackingStoreSupport,
     $touchEventsSupport,
     $touchIconLoadingSupport,
+    $vibrationSupport,
     $videoSupport,
     $videoTrackSupport,
     $webAudioSupport,
@@ -135,11 +137,12 @@ my (
     $webTimingSupport,
     $workersSupport,
     $xsltSupport,
+    $wtfURL,
 );
 
 my @features = (
     { option => "request-animation-frame", desc => "Toggle requestAnimationFrame support",
-      define => "ENABLE_REQUEST_ANIMATION_FRAME", default => (isAppleMacWebKit() || isGtk()), value => \$requestAnimationFrameSupport },
+      define => "ENABLE_REQUEST_ANIMATION_FRAME", default => (isAppleMacWebKit() || isGtk() || isBlackBerry()), value => \$requestAnimationFrameSupport },
 
     { option => "download-attribute", desc => "Toggle download attribute support",
       define => "ENABLE_DOWNLOAD_ATTRIBUTE", default => isBlackBerry(), value =>\$downloadAttributeSupport },
@@ -201,6 +204,9 @@ my @features = (
     { option => "filters", desc => "Toggle SVG Filters support",
       define => "ENABLE_FILTERS", default => (isAppleWebKit() || isGtk() || isQt() || isEfl() || isBlackBerry()), value => \$filtersSupport },
 
+    { option => "ftpdir", desc => "Toggle FTP directory support",
+      define => "ENABLE_FTPDIR", default => !isWinCE(), value => \$ftpDirSupport },
+
     { option => "fullscreen-api", desc => "Toggle Fullscreen API support",
       define => "ENABLE_FULLSCREEN_API", default => (isAppleMacWebKit() || isGtk()), value => \$fullscreenAPISupport },
 
@@ -241,7 +247,7 @@ my @features = (
       define => "ENABLE_INPUT_TYPE_WEEK", default => 0, value => \$inputTypeWeekSupport },
 
     { option => "inspector", desc => "Toggle Web Inspector support",
-      define => "ENABLE_INSPECTOR", default => 1, value => \$webInspectorSupport },
+      define => "ENABLE_INSPECTOR", default => !isWinCE(), value => \$webInspectorSupport },
 
     { option => "javascript-debugger", desc => "Toggle JavaScript Debugger/Profiler support",
       define => "ENABLE_JAVASCRIPT_DEBUGGER", default => 1, value => \$javaScriptDebuggerSupport },
@@ -271,7 +277,7 @@ my @features = (
       define => "ENABLE_MICRODATA", default => 0, value => \$microdataSupport },
 
     { option => "mutation-observers", desc => "Toggle DOM mutation observer support",
-      define => "ENABLE_MUTATION_OBSERVERS", default => 0, value => \$mutationObserversSupport },
+      define => "ENABLE_MUTATION_OBSERVERS", default => 1, value => \$mutationObserversSupport },
 
     { option => "netscape-plugin", desc => "Netscape Plugin support",
       define => "ENABLE_NETSCAPE_PLUGIN_API", default => !isEfl(), value => \$netscapePluginSupport },
@@ -283,7 +289,7 @@ my @features = (
       define => "ENABLE_ORIENTATION_EVENTS", default => isBlackBerry(), value => \$orientationEventsSupport },
 
     { option => "page-visibility-api", desc => "Page Visibility API support",
-      define => "ENABLE_PAGE_VISIBILITY_API", default => 0, value => \$pageVisibilityApiSupport },
+      define => "ENABLE_PAGE_VISIBILITY_API", default => isEfl(), value => \$pageVisibilityApiSupport },
 
     { option => "progress-tag", desc => "Progress Tag support",
       define => "ENABLE_PROGRESS_TAG", default => 1, value => \$progressTagSupport },
@@ -301,7 +307,7 @@ my @features = (
       define => "ENABLE_SHADOW_DOM", default => 0, value => \$shadowDomSupport },
 
     { option => "shared-workers", desc => "Toggle SharedWorkers support",
-      define => "ENABLE_SHARED_WORKERS", default => (isAppleWebKit() || isGtk() || isBlackBerry()), value => \$sharedWorkersSupport },
+      define => "ENABLE_SHARED_WORKERS", default => (isAppleWebKit() || isGtk() || isBlackBerry() || isEfl()), value => \$sharedWorkersSupport },
 
     { option => "style-scoped", desc => "Toggle <style scoped> support",
       define => "ENABLE_STYLE_SCOPED", default => 0, value => \$styleScopedSupport },
@@ -324,8 +330,11 @@ my @features = (
     { option => "touch-icon-loading", desc => "Toggle Touch Icon Loading Support",
       define => "ENABLE_TOUCH_ICON_LOADING", default => 0, value => \$touchIconLoadingSupport },
 
+    { option => "vibration", desc => "Toggle Video support",
+      define => "ENABLE_VIBRATION", default => isEfl(), value => \$vibrationSupport },
+
     { option => "video", desc => "Toggle Video support",
-      define => "ENABLE_VIDEO", default => (isAppleWebKit() || isGtk() || isBlackBerry()), value => \$videoSupport },
+      define => "ENABLE_VIDEO", default => (isAppleWebKit() || isGtk() || isBlackBerry() || isEfl()), value => \$videoSupport },
 
     { option => "video-track", desc => "Toggle Video Track support",
       define => "ENABLE_VIDEO_TRACK", default => (isAppleWebKit() || isGtk()), value => \$videoTrackSupport },
@@ -340,7 +349,10 @@ my @features = (
       define => "ENABLE_WEB_TIMING", default => 0, value=> \$webTimingSupport },
 
     { option => "workers", desc => "Toggle Web Workers support",
-      define => "ENABLE_WORKERS", default => (isAppleWebKit() || isGtk() || isBlackBerry()), value => \$workersSupport },
+      define => "ENABLE_WORKERS", default => (isAppleWebKit() || isGtk() || isBlackBerry() || isEfl()), value => \$workersSupport },
+
+    { option => "wtfurl", desc => "Toogle the use of WTFURL for URL parsing",
+      define => "WTF_USE_WTFURL", default => 0, value => \$wtfURL },
 
     { option => "xslt", desc => "Toggle XSLT support",
       define => "ENABLE_XSLT", default => 1, value => \$xsltSupport },
@@ -513,7 +525,7 @@ if (isGtk()) {
     }
 
     foreach (@features) {
-        if ($_->{option} ne "coverage") {
+        if ($_->{option} ne "coverage" && $_->{option} ne "wtfurl") {
             my $option = option($_->{define}, ${$_->{value}}, $_->{default});
             push @options, $option unless $option eq "";
         }
@@ -684,6 +696,7 @@ for my $dir (@projects) {
     } elsif (isAppleMacWebKit()) {
         my @local_options = @options;
         push @local_options, XcodeCoverageSupportOptions() if $coverageSupport && $project ne "ANGLE";
+        push @local_options, "OTHER_CFLAGS= \$(OTHER_CFLAGS) -DWTF_USE_WTFURL=1" if $wtfURL;
         my $useGYPProject = $useGYP && ($project =~ "WebCore|JavaScriptCore");
         my $projectPath = $useGYPProject ? "gyp/$project" : $project;
         $result = buildXCodeProject($projectPath, $clean, @local_options, @ARGV);
diff --git a/Tools/Scripts/old-run-webkit-tests b/Tools/Scripts/old-run-webkit-tests
index 8f91438ad..9670b77a0 100755
--- a/Tools/Scripts/old-run-webkit-tests
+++ b/Tools/Scripts/old-run-webkit-tests
@@ -392,7 +392,7 @@ if ($useWebKitTestRunner) {
         $platform = "win-wk2";
     } elsif (isQt()) {
         $realPlatform = $platform;
-        $platform = "qt-wk2";
+        $platform = "qt-5.0-wk2";
     } elsif (isGtk()) {
         $realPlatform = $platform;
         $platform = "gtk-wk2";
@@ -2182,7 +2182,7 @@ sub buildPlatformResultHierarchy()
             @platforms = $platform;
         }
     } elsif ($platform =~ /^qt/) {
-        if ($platform eq "qt-wk2") {
+        if ($platform eq "qt-5.0-wk2") {
             push @platforms, $platform;
         }
 
@@ -2510,10 +2510,10 @@ sub readSkippedFiles($)
     # Because nearly all of the skipped tests for WebKit 2 on Mac are due to
     # cross-platform issues, the Windows and Qt ports use the Mac skipped list
     # additionally to their own to avoid maintaining separate lists.
-    push(@skippedFileDirectories, catdir($platformBaseDirectory, "wk2")) if ($platform eq "win-wk2" || $platform eq "qt-wk2" || $platform eq "mac-wk2" || $platform eq "gtk-wk2");
+    push(@skippedFileDirectories, catdir($platformBaseDirectory, "wk2")) if ($platform eq "win-wk2" || $platform eq "qt-5.0-wk2" || $platform eq "mac-wk2" || $platform eq "gtk-wk2");
 
     # Add Qt WK1-only skipped tests.
-    push(@skippedFileDirectories, catdir($platformBaseDirectory, "qt-wk1")) if (isQt() && !$useWebKitTestRunner);
+    push(@skippedFileDirectories, catdir($platformBaseDirectory, "qt-5.0-wk1")) if (isQt() && !$useWebKitTestRunner);
 
     if ($verbose) {
         foreach my $skippedPath (@skippedFileDirectories) {
diff --git a/Tools/Scripts/run-fast-jsc b/Tools/Scripts/run-fast-jsc
new file mode 100755
index 000000000..1fda92316
--- /dev/null
+++ b/Tools/Scripts/run-fast-jsc
@@ -0,0 +1,159 @@
+#! /bin/sh
+
+# Copyright (C) 2012 Apple Inc. All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions
+# are met:
+# 1. Redistributions of source code must retain the above copyright
+#    notice, this list of conditions and the following disclaimer.
+# 2. Redistributions in binary form must reproduce the above copyright
+#    notice, this list of conditions and the following disclaimer in the
+#    documentation and/or other materials provided with the distribution.
+#
+# THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+# EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+# IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+# PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+# CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+# EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+# PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+# PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+# OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+
+# Script to run selected LayoutTests/fast/{js,regex} tests using jsc
+
+jscCmd="/System/Library/Frameworks/JavaScriptCore.framework/Resources/jsc"
+testRoot=/tmp/LayoutTests
+resultsRoot=`date \+/tmp/results-%Y-%m-%d-%H-%M-%S`
+testList="unset"
+
+cmdName=`basename $0`
+
+function usage()
+{
+    echo "usage: $cmdName [[--jsc | -j] <path-to-jsc>] [[--results-dir | -r] <results-path>]"
+    echo "                    [[--test-root | -t] <test-root-path>] [[--test-list | -l] <test-list-file>]"
+    exit 1
+}
+
+while [ $# -gt 1 ]
+do
+    case $1 in
+    --jsc|-j)
+        jscCmd=$2
+        ;;
+    --results-dir|-r)
+        resultsRoot=$2
+        ;;
+    --test-root|-t)
+        testRoot=$2
+        ;;
+    --test-list|-l)
+        testList=$2
+        ;;
+    *)
+        echo "Unrecognized option \"$1\""
+        usage
+        ;;
+    esac
+
+    shift 2
+done
+
+if [ $# -gt 0 ]
+then
+    echo "Extra argument \"$1\""
+    usage
+fi
+
+if [ $testList = "unset" ]
+then
+    testList=$testRoot/fast/js/jsc-test-list
+fi
+
+preScript=$testRoot/fast/js/resources/standalone-pre.js
+postScript=$testRoot/fast/js/resources/standalone-post.js
+passList=$resultsRoot/passed
+failList=$resultsRoot/failed
+crashList=$resultsRoot/crashed
+
+numTestsRun=0
+numPassed=0
+numFailed=0
+numCrashed=0
+
+rm -rf $resultsRoot
+rm -f jsc-tests-passed jsc-tests-failed
+
+for test in `cat $testList`
+do
+    testPassed=0
+    testCrashed=0
+    testName=`basename $test`
+    dirName=`dirname $test`
+     
+    expectedOut="$testRoot/$dirName/${testName}-expected.txt"
+    actualOut="$resultsRoot/$dirName/${testName}-out.txt"
+    actualErr="$resultsRoot/$dirName/${testName}-err.txt"
+    diffOut="$resultsRoot/$dirName/${testName}-diff.txt"
+    jsTest="$testRoot/$dirName/script-tests/${testName}.js"
+
+    if [ ! -d "$resultsRoot/$dirName" ]
+    then
+        mkdir -p "$resultsRoot/$dirName"
+    fi
+
+    if [ -f $expectedOut -a -f $jsTest ]
+    then
+        echo "Testing $test ... \c"
+        let numTestsRun=$numTestsRun+1
+        $jscCmd $preScript $jsTest $postScript 2>$actualErr > $actualOut
+        JSC_RES=$?
+
+        if [ $JSC_RES -eq 0 ]
+        then
+            diff $actualOut $expectedOut > $diffOut
+            if [ $? -eq 0 ]
+            then
+                testPassed=1
+                echo "PASSED"
+            else
+                testPassed=0
+                echo "FAILED"
+            fi
+        else
+            testPassed=0
+            if [ $JSC_RES -gt 128 ]
+            then
+                testCrashed=1
+                echo "CRASHED"
+            fi
+        fi
+
+        if [ $testPassed -eq 1 ]
+        then
+            echo "$test" >> $passList
+            let numPassed=$numPassed+1
+        else
+            echo "$test" >> $failList
+            let numFailed=$numFailed+1
+            if [ $testCrashed -eq 1 ]
+            then
+                echo "$test" >> $crashList
+                let numCrashed=$numCrashed+1
+            fi
+        fi
+    fi
+done
+
+if [ $numPassed -eq $numTestsRun ]
+then
+    echo "All $numTestsRun tests passed!" | tee $resultsRoot/summary
+else
+    echo "$numPassed tests passed, $numFailed tests failed, $numCrashed tests crashed." | tee $resultsRoot/summary
+fi
+
+echo "Test results in $resultsRoot"
diff --git a/Tools/Scripts/webkitdirs.pm b/Tools/Scripts/webkitdirs.pm
index eda2b205f..a8c35571e 100755
--- a/Tools/Scripts/webkitdirs.pm
+++ b/Tools/Scripts/webkitdirs.pm
@@ -326,7 +326,9 @@ sub determineArchitecture
 sub determineNumberOfCPUs
 {
     return if defined $numberOfCPUs;
-    if (isLinux()) {
+    if (defined($ENV{NUMBER_OF_PROCESSORS})) {
+        $numberOfCPUs = $ENV{NUMBER_OF_PROCESSORS};
+    } elsif (isLinux()) {
         # First try the nproc utility, if it exists. If we get no
         # results fall back to just interpretting /proc directly.
         chomp($numberOfCPUs = `nproc 2> /dev/null`);
@@ -334,12 +336,8 @@ sub determineNumberOfCPUs
             $numberOfCPUs = (grep /processor/, `cat /proc/cpuinfo`);
         }
     } elsif (isWindows() || isCygwin()) {
-        if (defined($ENV{NUMBER_OF_PROCESSORS})) {
-            $numberOfCPUs = $ENV{NUMBER_OF_PROCESSORS};
-        } else {
-            # Assumes cygwin
-            $numberOfCPUs = `ls /proc/registry/HKEY_LOCAL_MACHINE/HARDWARE/DESCRIPTION/System/CentralProcessor | wc -w`;
-        }
+        # Assumes cygwin
+        $numberOfCPUs = `ls /proc/registry/HKEY_LOCAL_MACHINE/HARDWARE/DESCRIPTION/System/CentralProcessor | wc -w`;
     } elsif (isDarwin()) {
         chomp($numberOfCPUs = `sysctl -n hw.ncpu`);
     }
@@ -730,7 +728,7 @@ sub builtDylibPathForName
         return "NotFound";
     }
     if (isEfl()) {
-        return "$configurationProductDir/Source/WebKit/libewebkit.so";
+        return "$configurationProductDir/lib/libewebkit.so";
     }
     if (isWinCE()) {
         return "$configurationProductDir/$libraryName";
@@ -2309,7 +2307,7 @@ sub buildChromiumNinja($$@)
     # rm -rf out requires rerunning gyp, so don't support --clean for now.
     my ($target, @options) = @_;
     my $config = configuration();
-    my $makeArgs;
+    my $makeArgs = "";
     for (@options) {
         $makeArgs = $1 if /^--makeargs=(.*)/i;
     }
diff --git a/Tools/Scripts/webkitpy/bindings/main.py b/Tools/Scripts/webkitpy/bindings/main.py
index 2268b9f5d..5154f399b 100644
--- a/Tools/Scripts/webkitpy/bindings/main.py
+++ b/Tools/Scripts/webkitpy/bindings/main.py
@@ -76,7 +76,8 @@ class BindingsTests:
                'WebCore/bindings/scripts/resolve-supplemental.pl',
                '--idlFilesList', idl_files_list[1],
                '--defines', '',
-               '--supplementalDependencyFile', supplemental_dependency_file]
+               '--supplementalDependencyFile', supplemental_dependency_file,
+               '--idlAttributesFile', 'WebCore/bindings/scripts/IDLAttributes.txt']
 
         exit_code = 0
         try:
diff --git a/Tools/Scripts/webkitpy/common/checkout/checkout_mock.py b/Tools/Scripts/webkitpy/common/checkout/checkout_mock.py
index 25b05c33a..696f1427e 100644
--- a/Tools/Scripts/webkitpy/common/checkout/checkout_mock.py
+++ b/Tools/Scripts/webkitpy/common/checkout/checkout_mock.py
@@ -26,14 +26,13 @@
 # (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 # OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
-import os
-
 from .deps_mock import MockDEPS
 from .commitinfo import CommitInfo
 
 # FIXME: These imports are wrong, we should use a shared MockCommittersList.
 from webkitpy.common.config.committers import CommitterList
 from webkitpy.common.net.bugzilla.bugzilla_mock import _mock_reviewers
+from webkitpy.common.system.filesystem_mock import MockFileSystem
 
 
 class MockCommitMessage(object):
@@ -42,6 +41,10 @@ class MockCommitMessage(object):
 
 
 class MockCheckout(object):
+    def __init__(self):
+        # FIXME: It's unclear if a MockCheckout is very useful.  A normal Checkout
+        # with a MockSCM/MockFileSystem/MockExecutive is probably better.
+        self._filesystem = MockFileSystem()
 
     # FIXME: This should move onto the Host object, and we should use a MockCommitterList for tests.
     _committer_list = CommitterList()
@@ -64,8 +67,7 @@ class MockCheckout(object):
         })
 
     def is_path_to_changelog(self, path):
-        # FIXME: This should self._filesystem.basename.
-        return os.path.basename(path) == "ChangeLog"
+        return self._filesystem.basename(path) == "ChangeLog"
 
     def bug_id_for_revision(self, svn_revision):
         return 12345
diff --git a/Tools/Scripts/webkitpy/common/checkout/scm/detection_unittest.py b/Tools/Scripts/webkitpy/common/checkout/scm/detection_unittest.py
new file mode 100644
index 000000000..7bee81710
--- /dev/null
+++ b/Tools/Scripts/webkitpy/common/checkout/scm/detection_unittest.py
@@ -0,0 +1,45 @@
+# Copyright (C) 2009 Google Inc. All rights reserved.
+# Copyright (C) 2009 Apple Inc. All rights reserved.
+# Copyright (C) 2011 Daniel Bates (dbates@intudata.com). All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions are
+# met:
+#
+#    * Redistributions of source code must retain the above copyright
+# notice, this list of conditions and the following disclaimer.
+#    * Redistributions in binary form must reproduce the above
+# copyright notice, this list of conditions and the following disclaimer
+# in the documentation and/or other materials provided with the
+# distribution.
+#    * Neither the name of Google Inc. nor the names of its
+# contributors may be used to endorse or promote products derived from
+# this software without specific prior written permission.
+#
+# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+# OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+import unittest
+
+from .detection import SCMDetector
+from webkitpy.common.system.filesystem_mock import MockFileSystem
+from webkitpy.common.system.executive_mock import MockExecutive
+
+
+class SCMDetectorTest(unittest.TestCase):
+    def test_detect_scm_system(self):
+        filesystem = MockFileSystem()
+        executive = MockExecutive(should_log=True)
+        detector = SCMDetector(filesystem, executive)
+
+        self.assertEqual(detector.detect_scm_system("/"), None)
+        # FIXME: This should make a synthetic tree and test SVN and Git detection in that tree.
diff --git a/Tools/Scripts/webkitpy/common/checkout/scm/git.py b/Tools/Scripts/webkitpy/common/checkout/scm/git.py
index ab96b8fa7..7c5d80cc3 100644
--- a/Tools/Scripts/webkitpy/common/checkout/scm/git.py
+++ b/Tools/Scripts/webkitpy/common/checkout/scm/git.py
@@ -105,19 +105,18 @@ class Git(SCM, SVNRepository):
             # The Windows bots seem to through a WindowsError when git isn't installed.
             return False
 
-    @classmethod
-    def find_checkout_root(cls, path):
-        # FIXME: This should use a FileSystem object instead of os.path.
+    def find_checkout_root(self, path):
         # "git rev-parse --show-cdup" would be another way to get to the root
-        (checkout_root, dot_git) = os.path.split(run_command(['git', 'rev-parse', '--git-dir'], cwd=(path or "./")))
-        if not os.path.isabs(checkout_root):  # Sometimes git returns relative paths
-            checkout_root = os.path.join(path, checkout_root)
+        git_output = self._executive.run_command(['git', 'rev-parse', '--git-dir'], cwd=(path or "./"))
+        (checkout_root, dot_git) = self._filesystem.split(git_output)
+        if not self._filesystem.isabs(checkout_root):  # Sometimes git returns relative paths
+            checkout_root = self._filesystem.join(path, checkout_root)
         return checkout_root
 
-    @classmethod
-    def to_object_name(cls, filepath):
-        # FIXME: This should use a FileSystem object instead of os.path.
-        root_end_with_slash = os.path.join(cls.find_checkout_root(os.path.dirname(filepath)), '')
+    def to_object_name(self, filepath):
+        # FIXME: This can't be the right way to append a slash.
+        root_end_with_slash = self._filesystem.join(self.find_checkout_root(self._filesystem.dirname(filepath)), '')
+        # FIXME: This seems to want some sort of rel_path instead?
         return filepath.replace(root_end_with_slash, '')
 
     @classmethod
diff --git a/Tools/Scripts/webkitpy/common/checkout/scm/scm.py b/Tools/Scripts/webkitpy/common/checkout/scm/scm.py
index 432d6ca99..cbce361e5 100644
--- a/Tools/Scripts/webkitpy/common/checkout/scm/scm.py
+++ b/Tools/Scripts/webkitpy/common/checkout/scm/scm.py
@@ -60,9 +60,9 @@ class AuthenticationError(Exception):
 class SCM:
     def __init__(self, cwd, executive=None, filesystem=None):
         self.cwd = cwd
-        self.checkout_root = self.find_checkout_root(self.cwd)
         self._executive = executive or Executive()
         self._filesystem = filesystem or FileSystem()
+        self.checkout_root = self.find_checkout_root(self.cwd)
 
     # A wrapper used by subclasses to create processes.
     def run(self, args, cwd=None, input=None, error_handler=None, return_exit_code=False, return_stderr=True, decode_output=True):
@@ -137,7 +137,6 @@ class SCM:
     def in_working_directory(path):
         SCM._subclass_must_implement()
 
-    @staticmethod
     def find_checkout_root(path):
         SCM._subclass_must_implement()
 
diff --git a/Tools/Scripts/webkitpy/common/checkout/scm/scm_unittest.py b/Tools/Scripts/webkitpy/common/checkout/scm/scm_unittest.py
index b835cdf67..4b88c3da1 100644
--- a/Tools/Scripts/webkitpy/common/checkout/scm/scm_unittest.py
+++ b/Tools/Scripts/webkitpy/common/checkout/scm/scm_unittest.py
@@ -52,8 +52,8 @@ from webkitpy.common.system.executive import Executive, ScriptError
 from webkitpy.common.system.outputcapture import OutputCapture
 from webkitpy.common.system.executive_mock import MockExecutive
 
-from .detection import find_checkout_root, default_scm, detect_scm_system
 from .git import Git, AmbiguousCommitError
+from .detection import detect_scm_system
 from .scm import SCM, CheckoutNeedsUpdate, commit_error_handler, AuthenticationError
 from .svn import SVN
 
@@ -78,7 +78,6 @@ def delete_cached_mock_repo_at_exit():
 # Eventually we will want to write tests which work for both scms. (like update_webkit, changed_files, etc.)
 # Perhaps through some SCMTest base-class which both SVNTest and GitTest inherit from.
 
-
 def run_command(*args, **kwargs):
     # FIXME: This should not be a global static.
     # New code should use Executive.run_command directly instead
@@ -231,58 +230,6 @@ class SVNTestRepository:
         os.chdir(detect_scm_system(path).checkout_root)
 
 
-# FIXME: This should move to testing SCMDetector instead.
-class StandaloneFunctionsTest(unittest.TestCase):
-    """This class tests any standalone/top-level functions in the package."""
-    def setUp(self):
-        self.orig_cwd = os.path.abspath(os.getcwd())
-        self.orig_abspath = os.path.abspath
-
-        # We capture but ignore the output from stderr to reduce unwanted
-        # logging.
-        self.output = OutputCapture()
-        self.output.capture_output()
-
-    def tearDown(self):
-        os.chdir(self.orig_cwd)
-        os.path.abspath = self.orig_abspath
-        self.output.restore_output()
-
-    def test_find_checkout_root(self):
-        # Test from inside the tree.
-        os.chdir(sys.path[0])
-        dir = find_checkout_root()
-        self.assertNotEqual(dir, None)
-        self.assertTrue(os.path.exists(dir))
-
-        # Test from outside the tree.
-        os.chdir(os.path.expanduser("~"))
-        dir = find_checkout_root()
-        self.assertNotEqual(dir, None)
-        self.assertTrue(os.path.exists(dir))
-
-        # Mock out abspath() to test being not in a checkout at all.
-        os.path.abspath = lambda x: "/"
-        self.assertRaises(SystemExit, find_checkout_root)
-        os.path.abspath = self.orig_abspath
-
-    def test_default_scm(self):
-        # Test from inside the tree.
-        os.chdir(sys.path[0])
-        scm = default_scm()
-        self.assertNotEqual(scm, None)
-
-        # Test from outside the tree.
-        os.chdir(os.path.expanduser("~"))
-        dir = find_checkout_root()
-        self.assertNotEqual(dir, None)
-
-        # Mock out abspath() to test being not in a checkout at all.
-        os.path.abspath = lambda x: "/"
-        self.assertRaises(Exception, default_scm)
-        os.path.abspath = self.orig_abspath
-
-
 # For testing the SCM baseclass directly.
 class SCMClassTests(unittest.TestCase):
     def setUp(self):
@@ -739,12 +686,6 @@ Q1dTBx0AAAB42itg4GlgYJjGwMDDyODMxMDw34GBgQEAJPQDJA==
         self._setup_webkittools_scripts_symlink(scm)
         Checkout(scm).apply_patch(patch)
 
-    def test_apply_svn_patch_force(self):
-        scm = detect_scm_system(self.svn_checkout_path)
-        patch = self._create_patch(_svn_diff("-r3:5"))
-        self._setup_webkittools_scripts_symlink(scm)
-        self.assertRaises(ScriptError, Checkout(scm).apply_patch, patch, force=True)
-
     def test_commit_logs(self):
         # Commits have dates and usernames in them, so we can't just direct compare.
         self.assertTrue(re.search('fourth commit', self.scm.last_svn_commit_log()))
@@ -1198,12 +1139,6 @@ class GitSVNTest(SCMTest):
         self._setup_webkittools_scripts_symlink(scm)
         Checkout(scm).apply_patch(patch)
 
-    def test_apply_git_patch_force(self):
-        scm = detect_scm_system(self.git_checkout_path)
-        patch = self._create_patch(_git_diff('HEAD~2..HEAD'))
-        self._setup_webkittools_scripts_symlink(scm)
-        self.assertRaises(ScriptError, Checkout(scm).apply_patch, patch, force=True)
-
     def test_commit_text_parsing(self):
         write_into_file_at_path('test_file', 'more test content')
         commit_text = self.scm.commit_with_message("another test commit")
diff --git a/Tools/Scripts/webkitpy/common/checkout/scm/svn.py b/Tools/Scripts/webkitpy/common/checkout/scm/svn.py
index edeee30ae..af03f8d70 100644
--- a/Tools/Scripts/webkitpy/common/checkout/scm/svn.py
+++ b/Tools/Scripts/webkitpy/common/checkout/scm/svn.py
@@ -86,11 +86,10 @@ class SVN(SCM, SVNRepository):
     def in_working_directory(path):
         return os.path.isdir(os.path.join(path, '.svn'))
 
-    @classmethod
-    def find_uuid(cls, path):
-        if not cls.in_working_directory(path):
+    def find_uuid(self, path):
+        if not self.in_working_directory(path):
             return None
-        return cls.value_from_svn_info(path, 'Repository UUID')
+        return self.value_from_svn_info(path, 'Repository UUID')
 
     @classmethod
     def value_from_svn_info(cls, path, field_name):
@@ -102,19 +101,18 @@ class SVN(SCM, SVNRepository):
             raise ScriptError(script_args=svn_info_args, message='svn info did not contain a %s.' % field_name)
         return match.group('value')
 
-    @staticmethod
-    def find_checkout_root(path):
-        uuid = SVN.find_uuid(path)
+    def find_checkout_root(self, path):
+        uuid = self.find_uuid(path)
         # If |path| is not in a working directory, we're supposed to return |path|.
         if not uuid:
             return path
         # Search up the directory hierarchy until we find a different UUID.
         last_path = None
         while True:
-            if uuid != SVN.find_uuid(path):
+            if uuid != self.find_uuid(path):
                 return last_path
             last_path = path
-            (path, last_component) = os.path.split(path)
+            (path, last_component) = self._filesystem.split(path)
             if last_path == path:
                 return None
 
diff --git a/Tools/Scripts/webkitpy/common/config/committers.py b/Tools/Scripts/webkitpy/common/config/committers.py
index 43a9c68c1..54dbbed80 100644
--- a/Tools/Scripts/webkitpy/common/config/committers.py
+++ b/Tools/Scripts/webkitpy/common/config/committers.py
@@ -110,7 +110,6 @@ contributors_who_are_not_committers = [
     Contributor("Alan Stearns", "stearns@adobe.com", 'astearns'),
     Contributor("Alexandre Elias", "aelias@chromium.org"),
     Contributor("Alexey Marinichev", ["amarinichev@chromium.org", "amarinichev@google.com"], "amarinichev"),
-    Contributor("Ami Fischman", ["fischman@chromium.org", "fischman@google.com"], "amifischman0"),
     Contributor("Andras Piroska", "pandras@inf.u-szeged.hu", "andris88"),
     Contributor("Anne van Kesteren", "annevankesteren+webkit@gmail.com", "annevk"),
     Contributor("Annie Sullivan", "sullivan@chromium.org", "annie"),
@@ -142,6 +141,7 @@ contributors_who_are_not_committers = [
     Contributor("Peter Linss", "peter.linss@hp.com", "plinss"),
     Contributor("Radar WebKit Bug Importer", "webkit-bug-importer@group.apple.com"),
     Contributor("Roland Takacs", "takacs.roland@stud.u-szeged.hu", "rtakacs"),
+    Contributor("Stephen Chenney", "schenney@chromium.org", "schenney"),
     Contributor("Szilard Ledan-Muntean", "muntean-ledan.szilard@stud.u-szeged.hu", "szledan"),
     Contributor("Tab Atkins", ["tabatkins@google.com", "jackalmage@gmail.com"], "tabatkins"),
     Contributor("Tamas Czene", ["tczene@inf.u-szeged.hu", "Czene.Tamas@stud.u-szeged.hu"], "tczene"),
@@ -172,6 +172,7 @@ committers_unable_to_review = [
     Committer("Alexis Menard", ["alexis.menard@openbossa.org", "menard@kde.org", "alexis.menard@nokia.com"], "darktears"),
     Committer("Alice Boxhall", "aboxhall@chromium.org", "aboxhall"),
     Committer("Alok Priyadarshi", "alokp@chromium.org", "alokp"),
+    Committer("Ami Fischman", ["fischman@chromium.org", "fischman@google.com"], "fischman"),
     Committer("Amruth Raj", "amruthraj@motorola.com", "amruthraj"),
     Committer("Andre Boule", "aboule@apple.com"),
     Committer("Andrei Popescu", "andreip@google.com", "andreip"),
@@ -179,6 +180,7 @@ committers_unable_to_review = [
     Committer("Andrew Scherkus", "scherkus@chromium.org", "scherkus"),
     Committer("Andrey Kosyakov", "caseq@chromium.org", "caseq"),
     Committer("Andras Becsi", ["abecsi@webkit.org", "andras.becsi@nokia.com"], "bbandix"),
+    Committer("Andy Wingo", "wingo@igalia.com", "wingo"),
     Committer("Anna Cavender", "annacc@chromium.org", "annacc"),
     Committer("Anthony Ricaud", "rik@webkit.org", "rik"),
     Committer("Antoine Labour", "piman@chromium.org", "piman"),
@@ -319,6 +321,7 @@ committers_unable_to_review = [
     Committer("Pratik Solanki", "psolanki@apple.com", "psolanki"),
     Committer("Qi Zhang", ["qi.2.zhang@nokia.com", "qi.zhang02180@gmail.com"], "qi"),
     Committer("Rafael Antognolli", "antognolli@profusion.mobi", "antognolli"),
+    Committer("Rafael Weinstein", "rafaelw@chromium.org", "rafaelw"),
     Committer("Raphael Kubo da Costa", ["kubo@profusion.mobi", "rakuco@FreeBSD.org"], "rakuco"),
     Committer("Ravi Kasibhatla", "ravi.kasibhatla@motorola.com", "kphanee"),
     Committer("Renata Hodovan", "reni@webkit.org", "reni"),
@@ -329,9 +332,11 @@ committers_unable_to_review = [
     Committer("Scott Violet", "sky@chromium.org", "sky"),
     Committer("Sergio Villar Senin", ["svillar@igalia.com", "sergio@webkit.org"], "svillar"),
     Committer("Shawn Singh", "shawnsingh@chromium.org", "shawnsingh"),
+    Committer("Shinya Kawanaka", "shinyak@chromium.org", "shinyak"),
     Committer("Siddharth Mathur", "siddharth.mathur@nokia.com", "simathur"),
     Committer("Steve Lacey", "sjl@chromium.org", "stevela"),
     Committer("Takashi Toyoshima", "toyoshim@chromium.org", "toyoshim"),
+    Committer("Thomas Sepez", "tsepez@chromium.org", "tsepez"),
     Committer("Tim Horton", "timothy_horton@apple.com", "thorton"),
     Committer("Tom Zakrajsek", "tomz@codeaurora.org", "tomz"),
     Committer("Tommy Widenflycht", "tommyw@google.com", "tommyw"),
diff --git a/Tools/Scripts/webkitpy/common/config/ports.py b/Tools/Scripts/webkitpy/common/config/ports.py
index 02c1f5b55..4b3d90a1a 100644
--- a/Tools/Scripts/webkitpy/common/config/ports.py
+++ b/Tools/Scripts/webkitpy/common/config/ports.py
@@ -35,17 +35,24 @@ import sys
 from webkitpy.common.system.executive import Executive
 
 
-class WebKitPort(object):
+class DeprecatedPort(object):
     results_directory = "/tmp/layout-test-results"
 
+    # FIXME: This is only used by BotInfo.
+    def name(self):
+        return self.__class__
+
+    def flag(self):
+        if self.port_flag_name:
+            return "--port=%s" % self.port_flag_name
+        return None
+
     # We might need to pass scm into this function for scm.checkout_root
-    @classmethod
-    def script_path(cls, script_name):
+    def script_path(self, script_name):
         return os.path.join("Tools", "Scripts", script_name)
 
-    @classmethod
-    def script_shell_command(cls, script_name):
-        script_path = cls.script_path(script_name)
+    def script_shell_command(self, script_name):
+        script_path = self.script_path(script_name)
         return Executive.shell_command_for_script(script_path)
 
     @staticmethod
@@ -64,206 +71,124 @@ class WebKitPort(object):
             "Darwin": MacPort,
         }
         # Do we really need MacPort as the ultimate default?
-        return ports.get(port_name, default_port.get(platform.system(), MacPort))
+        return ports.get(port_name, default_port.get(platform.system(), MacPort))()
 
-    @staticmethod
-    def makeArgs():
+    def makeArgs(self):
+        # FIXME: This shouldn't use a static Executive().
         args = '--makeargs="-j%s"' % Executive().cpu_count()
         if os.environ.has_key('MAKEFLAGS'):
             args = '--makeargs="%s"' % os.environ['MAKEFLAGS']
         return args
 
-    @classmethod
-    def name(cls):
-        raise NotImplementedError("subclasses must implement")
-
-    @classmethod
-    def flag(cls):
-        raise NotImplementedError("subclasses must implement")
-
-    @classmethod
-    def update_webkit_command(cls, non_interactive=False):
-        return cls.script_shell_command("update-webkit")
+    def update_webkit_command(self, non_interactive=False):
+        return self.script_shell_command("update-webkit")
 
-    @classmethod
-    def check_webkit_style_command(cls):
-        return cls.script_shell_command("check-webkit-style")
+    def check_webkit_style_command(self):
+        return self.script_shell_command("check-webkit-style")
 
-    @classmethod
-    def prepare_changelog_command(cls):
-        return cls.script_shell_command("prepare-ChangeLog")
+    def prepare_changelog_command(self):
+        return self.script_shell_command("prepare-ChangeLog")
 
-    @classmethod
-    def build_webkit_command(cls, build_style=None):
-        command = cls.script_shell_command("build-webkit")
+    def build_webkit_command(self, build_style=None):
+        command = self.script_shell_command("build-webkit")
         if build_style == "debug":
             command.append("--debug")
         if build_style == "release":
             command.append("--release")
         return command
 
-    @classmethod
-    def run_javascriptcore_tests_command(cls):
-        return cls.script_shell_command("run-javascriptcore-tests")
+    def run_javascriptcore_tests_command(self):
+        return self.script_shell_command("run-javascriptcore-tests")
 
-    @classmethod
-    def run_webkit_unit_tests_command(cls):
+    def run_webkit_unit_tests_command(self):
         return None
 
-    @classmethod
-    def run_webkit_tests_command(cls):
-        return cls.script_shell_command("run-webkit-tests")
-
-    @classmethod
-    def run_python_unittests_command(cls):
-        return cls.script_shell_command("test-webkitpy")
-
-    @classmethod
-    def run_perl_unittests_command(cls):
-        return cls.script_shell_command("test-webkitperl")
-
-    @classmethod
-    def layout_tests_results_path(cls):
-        return os.path.join(cls.results_directory, "full_results.json")
-
-
-class MacPort(WebKitPort):
+    def run_webkit_tests_command(self):
+        return self.script_shell_command("run-webkit-tests")
 
-    @classmethod
-    def name(cls):
-        return "Mac"
+    def run_python_unittests_command(self):
+        return self.script_shell_command("test-webkitpy")
 
-    @classmethod
-    def flag(cls):
-        return "--port=mac"
+    def run_perl_unittests_command(self):
+        return self.script_shell_command("test-webkitperl")
 
-    @classmethod
-    def _system_version(cls):
-        version_string = platform.mac_ver()[0]  # e.g. "10.5.6"
-        version_tuple = version_string.split('.')
-        return map(int, version_tuple)
+    def layout_tests_results_path(self):
+        return os.path.join(self.results_directory, "full_results.json")
 
-    @classmethod
-    def is_leopard(cls):
-        return tuple(cls._system_version()[:2]) == (10, 5)
 
+class MacPort(DeprecatedPort):
+    port_flag_name = "mac"
 
-class WinPort(WebKitPort):
 
-    @classmethod
-    def name(cls):
-        return "Win"
+class WinPort(DeprecatedPort):
+    port_flag_name = "win"
 
-    @classmethod
-    def flag(cls):
-        # FIXME: This is lame.  We should autogenerate this from a codename or something.
-        return "--port=win"
 
+class GtkPort(DeprecatedPort):
+    port_flag_name = "gtk"
 
-class GtkPort(WebKitPort):
-
-    @classmethod
-    def name(cls):
-        return "Gtk"
-
-    @classmethod
-    def flag(cls):
-        return "--port=gtk"
-
-    @classmethod
-    def build_webkit_command(cls, build_style=None):
-        command = WebKitPort.build_webkit_command(build_style=build_style)
+    def build_webkit_command(self, build_style=None):
+        command = super(GtkPort, self).build_webkit_command(build_style=build_style)
         command.append("--gtk")
         command.append("--update-gtk")
-        command.append(WebKitPort.makeArgs())
+        command.append(super(GtkPort, self).makeArgs())
         return command
 
-    @classmethod
-    def run_webkit_tests_command(cls):
-        command = WebKitPort.run_webkit_tests_command()
+    def run_webkit_tests_command(self):
+        command = super(GtkPort, self).run_webkit_tests_command()
         command.append("--gtk")
         return command
 
 
-class QtPort(WebKitPort):
-
-    @classmethod
-    def name(cls):
-        return "Qt"
-
-    @classmethod
-    def flag(cls):
-        return "--port=qt"
+class QtPort(DeprecatedPort):
+    port_flag_name = "qt"
 
-    @classmethod
-    def build_webkit_command(cls, build_style=None):
-        command = WebKitPort.build_webkit_command(build_style=build_style)
+    def build_webkit_command(self, build_style=None):
+        command = super(QtPort, self).build_webkit_command(build_style=build_style)
         command.append("--qt")
-        command.append(WebKitPort.makeArgs())
+        command.append(super(QtPort, self).makeArgs())
         return command
 
 
-class EflPort(WebKitPort):
+class EflPort(DeprecatedPort):
+    port_flag_name = "efl"
 
-    @classmethod
-    def name(cls):
-        return "Efl"
-
-    @classmethod
-    def flag(cls):
-        return "--port=efl"
-
-    @classmethod
-    def build_webkit_command(cls, build_style=None):
-        command = WebKitPort.build_webkit_command(build_style=build_style)
+    def build_webkit_command(self, build_style=None):
+        command = super(EflPort, self).build_webkit_command(build_style=build_style)
         command.append("--efl")
-        command.append(WebKitPort.makeArgs())
+        command.append(super(EflPort, self).makeArgs())
         return command
 
 
-class ChromiumPort(WebKitPort):
-
-    @classmethod
-    def name(cls):
-        return "Chromium"
+class ChromiumPort(DeprecatedPort):
+    port_flag_name = "chromium"
 
-    @classmethod
-    def flag(cls):
-        return "--port=chromium"
-
-    @classmethod
-    def update_webkit_command(cls, non_interactive=False):
-        command = WebKitPort.update_webkit_command(non_interactive=non_interactive)
+    def update_webkit_command(self, non_interactive=False):
+        command = super(ChromiumPort, self).update_webkit_command(non_interactive=non_interactive)
         command.append("--chromium")
         if non_interactive:
             command.append("--force-update")
         return command
 
-    @classmethod
-    def build_webkit_command(cls, build_style=None):
-        command = WebKitPort.build_webkit_command(build_style=build_style)
+    def build_webkit_command(self, build_style=None):
+        command = super(ChromiumPort, self).build_webkit_command(build_style=build_style)
         command.append("--chromium")
         command.append("--update-chromium")
         return command
 
-    @classmethod
-    def run_webkit_tests_command(cls):
-        command = cls.script_shell_command("new-run-webkit-tests")
+    def run_webkit_tests_command(self):
+        # Note: This could be run-webkit-tests now.
+        command = self.script_shell_command("new-run-webkit-tests")
         command.append("--chromium")
         command.append("--skip-failing-tests")
         return command
 
-    @classmethod
-    def run_javascriptcore_tests_command(cls):
+    def run_javascriptcore_tests_command(self):
         return None
 
 
 class ChromiumXVFBPort(ChromiumPort):
+    port_flag_name = "chromium-xvfb"
 
-    @classmethod
-    def flag(cls):
-        return "--port=chromium-xvfb"
-
-    @classmethod
-    def run_webkit_tests_command(cls):
-        return ["xvfb-run"] + ChromiumPort.run_webkit_tests_command()
+    def run_webkit_tests_command(self):
+        return ["xvfb-run"] + super(ChromiumXVFBPort, self).run_webkit_tests_command()
diff --git a/Tools/Scripts/webkitpy/common/config/ports_unittest.py b/Tools/Scripts/webkitpy/common/config/ports_unittest.py
index 0532512aa..e0b77c82e 100644
--- a/Tools/Scripts/webkitpy/common/config/ports_unittest.py
+++ b/Tools/Scripts/webkitpy/common/config/ports_unittest.py
@@ -32,45 +32,36 @@ import unittest
 from webkitpy.common.config.ports import *
 
 
-class WebKitPortTest(unittest.TestCase):
+class DeprecatedPortTest(unittest.TestCase):
     def test_mac_port(self):
-        self.assertEquals(MacPort.name(), "Mac")
-        self.assertEquals(MacPort.flag(), "--port=mac")
-        self.assertEquals(MacPort.run_webkit_tests_command(), WebKitPort.script_shell_command("run-webkit-tests"))
-        self.assertEquals(MacPort.build_webkit_command(), WebKitPort.script_shell_command("build-webkit"))
-        self.assertEquals(MacPort.build_webkit_command(build_style="debug"), WebKitPort.script_shell_command("build-webkit") + ["--debug"])
-        self.assertEquals(MacPort.build_webkit_command(build_style="release"), WebKitPort.script_shell_command("build-webkit") + ["--release"])
-
-        class TestIsLeopard(MacPort):
-            @classmethod
-            def _system_version(cls):
-                return [10, 5]
-        self.assertTrue(TestIsLeopard.is_leopard())
+        self.assertEquals(MacPort().flag(), "--port=mac")
+        self.assertEquals(MacPort().run_webkit_tests_command(), DeprecatedPort().script_shell_command("run-webkit-tests"))
+        self.assertEquals(MacPort().build_webkit_command(), DeprecatedPort().script_shell_command("build-webkit"))
+        self.assertEquals(MacPort().build_webkit_command(build_style="debug"), DeprecatedPort().script_shell_command("build-webkit") + ["--debug"])
+        self.assertEquals(MacPort().build_webkit_command(build_style="release"), DeprecatedPort().script_shell_command("build-webkit") + ["--release"])
 
     def test_gtk_port(self):
-        self.assertEquals(GtkPort.name(), "Gtk")
-        self.assertEquals(GtkPort.flag(), "--port=gtk")
-        self.assertEquals(GtkPort.run_webkit_tests_command(), WebKitPort.script_shell_command("run-webkit-tests") + ["--gtk"])
-        self.assertEquals(GtkPort.build_webkit_command(), WebKitPort.script_shell_command("build-webkit") + ["--gtk", "--update-gtk", WebKitPort.makeArgs()])
-        self.assertEquals(GtkPort.build_webkit_command(build_style="debug"), WebKitPort.script_shell_command("build-webkit") + ["--debug", "--gtk", "--update-gtk", WebKitPort.makeArgs()])
+        self.assertEquals(GtkPort().flag(), "--port=gtk")
+        self.assertEquals(GtkPort().run_webkit_tests_command(), DeprecatedPort().script_shell_command("run-webkit-tests") + ["--gtk"])
+        self.assertEquals(GtkPort().build_webkit_command(), DeprecatedPort().script_shell_command("build-webkit") + ["--gtk", "--update-gtk", DeprecatedPort().makeArgs()])
+        self.assertEquals(GtkPort().build_webkit_command(build_style="debug"), DeprecatedPort().script_shell_command("build-webkit") + ["--debug", "--gtk", "--update-gtk", DeprecatedPort().makeArgs()])
 
     def test_qt_port(self):
-        self.assertEquals(QtPort.name(), "Qt")
-        self.assertEquals(QtPort.flag(), "--port=qt")
-        self.assertEquals(QtPort.run_webkit_tests_command(), WebKitPort.script_shell_command("run-webkit-tests"))
-        self.assertEquals(QtPort.build_webkit_command(), WebKitPort.script_shell_command("build-webkit") + ["--qt", WebKitPort.makeArgs()])
-        self.assertEquals(QtPort.build_webkit_command(build_style="debug"), WebKitPort.script_shell_command("build-webkit") + ["--debug", "--qt", WebKitPort.makeArgs()])
+        self.assertEquals(QtPort().flag(), "--port=qt")
+        self.assertEquals(QtPort().run_webkit_tests_command(), DeprecatedPort().script_shell_command("run-webkit-tests"))
+        self.assertEquals(QtPort().build_webkit_command(), DeprecatedPort().script_shell_command("build-webkit") + ["--qt", DeprecatedPort().makeArgs()])
+        self.assertEquals(QtPort().build_webkit_command(build_style="debug"), DeprecatedPort().script_shell_command("build-webkit") + ["--debug", "--qt", DeprecatedPort().makeArgs()])
 
     def test_chromium_port(self):
-        self.assertEquals(ChromiumPort.name(), "Chromium")
-        self.assertEquals(ChromiumPort.flag(), "--port=chromium")
-        self.assertEquals(ChromiumPort.run_webkit_tests_command(), WebKitPort.script_shell_command("new-run-webkit-tests") + ["--chromium", "--skip-failing-tests"])
-        self.assertEquals(ChromiumPort.build_webkit_command(), WebKitPort.script_shell_command("build-webkit") + ["--chromium", "--update-chromium"])
-        self.assertEquals(ChromiumPort.build_webkit_command(build_style="debug"), WebKitPort.script_shell_command("build-webkit") + ["--debug", "--chromium", "--update-chromium"])
-        self.assertEquals(ChromiumPort.update_webkit_command(), WebKitPort.script_shell_command("update-webkit") + ["--chromium"])
+        self.assertEquals(ChromiumPort().flag(), "--port=chromium")
+        self.assertEquals(ChromiumPort().run_webkit_tests_command(), DeprecatedPort().script_shell_command("new-run-webkit-tests") + ["--chromium", "--skip-failing-tests"])
+        self.assertEquals(ChromiumPort().build_webkit_command(), DeprecatedPort().script_shell_command("build-webkit") + ["--chromium", "--update-chromium"])
+        self.assertEquals(ChromiumPort().build_webkit_command(build_style="debug"), DeprecatedPort().script_shell_command("build-webkit") + ["--debug", "--chromium", "--update-chromium"])
+        self.assertEquals(ChromiumPort().update_webkit_command(), DeprecatedPort().script_shell_command("update-webkit") + ["--chromium"])
 
     def test_chromium_xvfb_port(self):
-        self.assertEquals(ChromiumXVFBPort.run_webkit_tests_command(), ['xvfb-run'] + WebKitPort.script_shell_command('new-run-webkit-tests') + ['--chromium', '--skip-failing-tests'])
+        self.assertEquals(ChromiumXVFBPort().run_webkit_tests_command(), ['xvfb-run'] + DeprecatedPort().script_shell_command('new-run-webkit-tests') + ['--chromium', '--skip-failing-tests'])
+
 
 if __name__ == '__main__':
     unittest.main()
diff --git a/Tools/Scripts/webkitpy/common/net/bugzilla/bugzilla.py b/Tools/Scripts/webkitpy/common/net/bugzilla/bugzilla.py
index a32e86e13..3d2a96922 100644
--- a/Tools/Scripts/webkitpy/common/net/bugzilla/bugzilla.py
+++ b/Tools/Scripts/webkitpy/common/net/bugzilla/bugzilla.py
@@ -31,7 +31,6 @@
 # WebKit's Python module for interacting with Bugzilla
 
 import mimetypes
-import os.path
 import re
 import StringIO
 import urllib
diff --git a/Tools/Scripts/webkitpy/common/system/autoinstall.py b/Tools/Scripts/webkitpy/common/system/autoinstall.py
index a928db63a..e5bc0b2cb 100755
--- a/Tools/Scripts/webkitpy/common/system/autoinstall.py
+++ b/Tools/Scripts/webkitpy/common/system/autoinstall.py
@@ -259,6 +259,44 @@ class AutoInstaller(object):
 
         return target_path
 
+    # This is a replacement for ZipFile.extractall(), which is
+    # available in Python 2.6 but not in earlier versions.
+    # NOTE: The version in 2.6.1 (which shipped on Snow Leopard) is broken!
+    def _extract_all(self, zip_file, target_dir):
+        self._log_transfer("Extracting zip file...", zip_file, target_dir)
+
+        # This is helpful for debugging purposes.
+        _log.debug("Listing zip file contents...")
+        for name in zip_file.namelist():
+            _log.debug('    * "%s"' % name)
+
+        for name in zip_file.namelist():
+            path = os.path.join(target_dir, name)
+            self._log_transfer("Extracting...", name, path)
+
+            if not os.path.basename(path):
+                # Then the path ends in a slash, so it is a directory.
+                self._create_directory(path)
+                continue
+            # Otherwise, it is a file.
+
+            try:
+                # We open this file w/o encoding, as we're reading/writing
+                # the raw byte-stream from the zip file.
+                outfile = open(path, 'wb')
+            except IOError, err:
+                # Not all zip files seem to list the directories explicitly,
+                # so try again after creating the containing directory.
+                _log.debug("Got IOError: retrying after creating directory...")
+                dir = os.path.dirname(path)
+                self._create_directory(dir)
+                outfile = open(path, 'wb')
+
+            try:
+                outfile.write(zip_file.read(name))
+            finally:
+                outfile.close()
+
     def _unzip(self, path, scratch_dir):
         # zipfile.extractall() extracts to a path without the
         # trailing ".zip".
@@ -276,7 +314,7 @@ class AutoInstaller(object):
             raise Exception(message)
 
         try:
-            zip_file.extractall(scratch_dir)
+            self._extract_all(zip_file, scratch_dir)
         finally:
             zip_file.close()
 
diff --git a/Tools/Scripts/webkitpy/common/system/executive_mock.py b/Tools/Scripts/webkitpy/common/system/executive_mock.py
index f698235e9..a76268129 100644
--- a/Tools/Scripts/webkitpy/common/system/executive_mock.py
+++ b/Tools/Scripts/webkitpy/common/system/executive_mock.py
@@ -32,8 +32,16 @@ from webkitpy.common.system.deprecated_logging import log
 from webkitpy.common.system.executive import ScriptError
 
 
+class MockProcess(object):
+    def __init__(self):
+        self.pid = 42
+
+
 # FIXME: This should be unified with MockExecutive2
 class MockExecutive(object):
+    PIPE = "MOCK PIPE"
+    STDOUT = "MOCK STDOUT"
+
     @staticmethod
     def ignore_error(error):
         pass
@@ -55,7 +63,7 @@ class MockExecutive(object):
                 env_string = ", env=%s" % env
             log("MOCK run_and_throw_if_fail: %s, cwd=%s%s" % (args, cwd, env_string))
         if self._should_throw_when_run.intersection(args):
-            raise ScriptError("Exception for %s" % args)
+            raise ScriptError("Exception for %s" % args, output="MOCK command output")
         return "MOCK output of child process"
 
     def run_command(self,
@@ -81,6 +89,10 @@ class MockExecutive(object):
     def cpu_count(self):
         return 2
 
+    def popen(self, *args, **kwargs):
+        # FIXME: Implement logging when self._should_log is set.
+        return MockProcess()
+
 
 class MockExecutive2(object):
     @staticmethod
diff --git a/Tools/Scripts/webkitpy/common/system/file_lock.py b/Tools/Scripts/webkitpy/common/system/file_lock.py
index fb853c8fb..b4bfffc40 100644
--- a/Tools/Scripts/webkitpy/common/system/file_lock.py
+++ b/Tools/Scripts/webkitpy/common/system/file_lock.py
@@ -71,6 +71,8 @@ class FileLock(object):
                     os.close(self._lock_file_descriptor)
                     self._lock_file_descriptor = None
                     return False
+                # There's no compelling reason to spin hard here, so sleep for a bit.
+                time.sleep(0.01)
 
     def release_lock(self):
         try:
diff --git a/Tools/Scripts/webkitpy/common/system/file_lock_integrationtest.py b/Tools/Scripts/webkitpy/common/system/file_lock_integrationtest.py
index c5c1db3de..5cd27d11d 100644
--- a/Tools/Scripts/webkitpy/common/system/file_lock_integrationtest.py
+++ b/Tools/Scripts/webkitpy/common/system/file_lock_integrationtest.py
@@ -36,8 +36,8 @@ class FileLockTest(unittest.TestCase):
     def setUp(self):
         self._lock_name = "TestWebKit" + str(os.getpid()) + ".lock"
         self._lock_path = os.path.join(tempfile.gettempdir(), self._lock_name)
-        self._file_lock1 = FileLock(self._lock_path, 1)
-        self._file_lock2 = FileLock(self._lock_path, 1)
+        self._file_lock1 = FileLock(self._lock_path, 0.1)
+        self._file_lock2 = FileLock(self._lock_path, 0.1)
 
     def tearDown(self):
         self._file_lock1.release_lock()
diff --git a/Tools/Scripts/webkitpy/common/system/filesystem_mock.py b/Tools/Scripts/webkitpy/common/system/filesystem_mock.py
index 6e106dd83..6fb1dcaee 100644
--- a/Tools/Scripts/webkitpy/common/system/filesystem_mock.py
+++ b/Tools/Scripts/webkitpy/common/system/filesystem_mock.py
@@ -71,7 +71,11 @@ class MockFileSystem(object):
         raise IOError(errno.ENOENT, path, os.strerror(errno.ENOENT))
 
     def _split(self, path):
-        return path.rsplit(self.sep, 1)
+        # This is not quite a full implementation of os.path.split
+        # http://docs.python.org/library/os.path.html#os.path.split
+        if self.sep in path:
+            return path.rsplit(self.sep, 1)
+        return ('', path)
 
     def abspath(self, path):
         if os.path.isabs(path):
@@ -169,40 +173,45 @@ class MockFileSystem(object):
         return path in self.files and self.files[path] is not None
 
     def isdir(self, path):
-        if path in self.files:
-            return False
-        path = self.normpath(path)
-        if path in self.dirs:
-            return True
+        return self.normpath(path) in self.dirs
 
-        # We need to use a copy of the keys here in order to avoid switching
-        # to a different thread and potentially modifying the dict in
-        # mid-iteration.
-        files = self.files.keys()[:]
-        result = any(f.startswith(path) and len(self.split(f)[0]) >= len(path) for f in files)
-        if result:
-            self.dirs.add(path)
-        return result
+    def _slow_but_correct_join(self, *comps):
+        return re.sub(re.escape(os.path.sep), self.sep, os.path.join(*comps))
 
     def join(self, *comps):
-        # FIXME: might want tests for this and/or a better comment about how
-        # it works.
-        return re.sub(re.escape(os.path.sep), self.sep, os.path.join(*comps))
+        # This function is called a lot, so we optimize it; there are
+        # unittests to check that we match _slow_but_correct_join(), above.
+        path = ''
+        sep = self.sep
+        for comp in comps:
+            if not comp:
+                continue
+            if comp[0] == sep:
+                path = comp
+                continue
+            if path:
+                path += sep
+            path += comp
+        if comps[-1] == '' and path:
+            path += '/'
+        path = path.replace(sep + sep, sep)
+        return path
 
     def listdir(self, path):
+        sep = self.sep
         if not self.isdir(path):
             raise OSError("%s is not a directory" % path)
 
-        if not path.endswith(self.sep):
-            path += self.sep
+        if not path.endswith(sep):
+            path += sep
 
         dirs = []
         files = []
         for f in self.files:
             if self.exists(f) and f.startswith(path):
                 remaining = f[len(path):]
-                if self.sep in remaining:
-                    dir = remaining[:remaining.index(self.sep)]
+                if sep in remaining:
+                    dir = remaining[:remaining.index(sep)]
                     if not dir in dirs:
                         dirs.append(dir)
                 else:
@@ -258,11 +267,27 @@ class MockFileSystem(object):
         self.files[source] = None
         self.written_files[source] = None
 
-    def normpath(self, path):
-        # Like join(), relies on os.path functionality but normalizes the
-        # path separator to the mock one.
+    def _slow_but_correct_normpath(self, path):
         return re.sub(re.escape(os.path.sep), self.sep, os.path.normpath(path))
 
+    def normpath(self, path):
+        # This function is called a lot, so we try to optimize the common cases
+        # instead of always calling _slow_but_correct_normpath(), above.
+        if '..' in path:
+            # This doesn't happen very often; don't bother trying to optimize it.
+            return self._slow_but_correct_normpath(path)
+        if not path:
+            return '.'
+        if path == '/':
+            return path
+        if path == '/.':
+            return '/'
+        if path.endswith('/.'):
+            return path[:-2]
+        if path.endswith('/'):
+            return path[:-1]
+        return path
+
     def open_binary_tempfile(self, suffix=''):
         path = self._mktemp(suffix)
         return (WritableBinaryFileObject(self, path), path)
@@ -280,6 +305,7 @@ class MockFileSystem(object):
 
     def write_binary_file(self, path, contents):
         # FIXME: should this assert if dirname(path) doesn't exist?
+        self.maybe_make_directory(self.dirname(path))
         self.files[path] = contents
         self.written_files[path] = contents
 
diff --git a/Tools/Scripts/webkitpy/common/system/filesystem_mock_unittest.py b/Tools/Scripts/webkitpy/common/system/filesystem_mock_unittest.py
index 5169fc598..2a6ccbf4b 100644
--- a/Tools/Scripts/webkitpy/common/system/filesystem_mock_unittest.py
+++ b/Tools/Scripts/webkitpy/common/system/filesystem_mock_unittest.py
@@ -26,8 +26,11 @@
 # (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 # OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
+import os
+import re
 import unittest
 
+
 from webkitpy.common.system import filesystem_mock
 from webkitpy.common.system import filesystem_unittest
 
@@ -41,6 +44,45 @@ class MockFileSystemTest(unittest.TestCase, filesystem_unittest.GenericFileSyste
         self.teardown_generic_test_dir()
         self.fs = None
 
+    def quick_check(self, test_fn, good_fn, *tests):
+        for test in tests:
+            if hasattr(test, '__iter__'):
+                expected = good_fn(*test)
+                actual = test_fn(*test)
+            else:
+                expected = good_fn(test)
+                actual = test_fn(test)
+            self.assertEquals(expected, actual, 'given %s, expected %s, got %s' % (repr(test), repr(expected), repr(actual)))
+
+    def test_join(self):
+        self.quick_check(self.fs.join,
+                         self.fs._slow_but_correct_join,
+                         ('',),
+                         ('', 'bar'),
+                         ('foo',),
+                         ('foo/',),
+                         ('foo', ''),
+                         ('foo/', ''),
+                         ('foo', 'bar'),
+                         ('foo', '/bar'),
+                         )
+
+    def test_normpath(self):
+        self.quick_check(self.fs.normpath,
+                         self.fs._slow_but_correct_normpath,
+                         '',
+                         '/',
+                         '.',
+                         '/.',
+                         'foo',
+                         'foo/',
+                         'foo/.',
+                         'foo/bar',
+                         '/foo',
+                         'foo/../bar',
+                         'foo/../bar/baz',
+                         '../foo')
+
 
 if __name__ == '__main__':
     unittest.main()
diff --git a/Tools/Scripts/webkitpy/common/system/zipfileset_unittest.py b/Tools/Scripts/webkitpy/common/system/zipfileset_unittest.py
index 680140680..16a74cbd7 100644
--- a/Tools/Scripts/webkitpy/common/system/zipfileset_unittest.py
+++ b/Tools/Scripts/webkitpy/common/system/zipfileset_unittest.py
@@ -21,7 +21,6 @@
 # (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
 # THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
-import os
 import shutil
 import tempfile
 import unittest
diff --git a/Tools/Scripts/webkitpy/layout_tests/controllers/manager.py b/Tools/Scripts/webkitpy/layout_tests/controllers/manager.py
index 7113bcb6a..150a50a4d 100644
--- a/Tools/Scripts/webkitpy/layout_tests/controllers/manager.py
+++ b/Tools/Scripts/webkitpy/layout_tests/controllers/manager.py
@@ -752,22 +752,29 @@ class Manager(object):
         num_workers = min(int(self._options.child_processes), len(all_shards))
         self._log_num_workers(num_workers, len(all_shards), len(locked_shards))
 
-        manager_connection = manager_worker_broker.get(self._port, self._options, self, worker.Worker)
+        manager_connection = manager_worker_broker.get(self._options.worker_model, self, worker.Worker)
 
         if self._options.dry_run:
             return (keyboard_interrupted, interrupted, thread_timings, self._group_stats, self._all_results)
 
         self._printer.print_update('Starting %s ...' % grammar.pluralize('worker', num_workers))
         for worker_number in xrange(num_workers):
-            worker_connection = manager_connection.start_worker(worker_number, self.results_directory())
+            worker_arguments = worker.WorkerArguments(worker_number, self.results_directory(), self._options)
+            worker_connection = manager_connection.start_worker(worker_arguments)
+            if self._options.worker_model == 'inline':
+                # FIXME: We need to be able to share a port with the work so
+                # that some of the tests can query state on the port; ideally
+                # we'd rewrite the tests so that this wasn't necessary.
+                #
+                # Note that this only works because in the inline case
+                # the worker hasn't really started yet and won't start
+                # running until we call run_message_loop(), below.
+                worker_connection.set_inline_arguments(self._port)
+
             worker_state = _WorkerState(worker_number, worker_connection)
-            self._worker_states[worker_connection.name] = worker_state
+            self._worker_states[worker_connection.name()] = worker_state
 
-            # FIXME: If we start workers up too quickly, DumpRenderTree appears
-            # to thrash on something and time out its first few tests. Until
-            # we can figure out what's going on, sleep a bit in between
-            # workers. This needs a bug filed.
-            time.sleep(0.1)
+            time.sleep(self._port.worker_startup_delay_secs())
 
         self._printer.print_update("Starting testing ...")
         for shard in all_shards:
@@ -827,20 +834,6 @@ class Manager(object):
     def update(self):
         self.update_summary(self._current_result_summary)
 
-    def _collect_timing_info(self, threads):
-        test_timings = {}
-        individual_test_timings = []
-        thread_timings = []
-
-        for thread in threads:
-            thread_timings.append({'name': thread.getName(),
-                                   'num_tests': thread.get_num_tests(),
-                                   'total_time': thread.get_total_time()})
-            test_timings.update(thread.get_test_group_timing_stats())
-            individual_test_timings.extend(thread.get_test_results())
-
-        return (thread_timings, test_timings, individual_test_timings)
-
     def needs_servers(self):
         return any(self._test_requires_lock(test_name) for test_name in self._test_files) and self._options.http
 
@@ -867,7 +860,7 @@ class Manager(object):
             self._clobber_old_results()
 
         # Create the output directory if it doesn't already exist.
-        self._port.maybe_make_directory(self._results_directory)
+        self._port.host.filesystem.maybe_make_directory(self._results_directory)
 
         self._port.setup_test_run()
 
@@ -1519,7 +1512,7 @@ class _WorkerState(object):
         self.current_test_name = None
         self.next_timeout = None
         self.stats = {}
-        self.stats['name'] = worker_connection.name
+        self.stats['name'] = worker_connection.name()
         self.stats['num_tests'] = 0
         self.stats['total_time'] = 0
 
diff --git a/Tools/Scripts/webkitpy/layout_tests/controllers/manager_worker_broker.py b/Tools/Scripts/webkitpy/layout_tests/controllers/manager_worker_broker.py
index 34136ff37..70c43a6d4 100755
--- a/Tools/Scripts/webkitpy/layout_tests/controllers/manager_worker_broker.py
+++ b/Tools/Scripts/webkitpy/layout_tests/controllers/manager_worker_broker.py
@@ -38,25 +38,48 @@ They interact more or less like:
   Manager  -->  _InlineManager ---> _InlineWorker <-> Worker
      ^                    \               /              ^
      |                     v             v               |
-     \--------------------  MessageBroker   -------------/
+     \-----------------------  Broker   ----------------/
+
+The broker simply distributes messages onto topics (named queues); the actual
+queues themselves are provided by the caller, as the queue's implementation
+requirements varies vary depending on the desired concurrency model
+(none/threads/processes).
+
+In order for shared-nothing messaging between processing to be possible,
+Messages must be picklable.
+
+The module defines one interface and two classes. Callers of this package
+must implement the BrokerClient interface, and most callers will create
+_BrokerConnections as well as Brokers.
+
+The classes relate to each other as:
+
+    BrokerClient   ------>    _BrokerConnection
+         ^                         |
+         |                         v
+         \----------------      _Broker
+
+(The BrokerClient never calls broker directly after it is created, only
+_BrokerConnection.  _BrokerConnection passes a reference to BrokerClient to
+_Broker, and _Broker only invokes that reference, never talking directly to
+BrokerConnection).
 """
 
+import cPickle
 import logging
 import multiprocessing
 import optparse
 import Queue
 import sys
+import traceback
 
-# These are needed when workers are launched in new child processes.
-from webkitpy.common.host import Host
-from webkitpy.common.host_mock import MockHost
 
-from webkitpy.layout_tests.controllers import message_broker
-from webkitpy.layout_tests.views import printing
+from webkitpy.common.system import stack_utils
 
 
 _log = logging.getLogger(__name__)
 
+
 #
 # Topic names for Manager <-> Worker messaging
 #
@@ -64,32 +87,18 @@ MANAGER_TOPIC = 'managers'
 ANY_WORKER_TOPIC = 'workers'
 
 
-def runtime_options():
-    """Return a list of optparse.Option objects for any runtime values used
-    by this module."""
-    options = [
-        optparse.make_option("--worker-model", action="store",
-            help=("controls worker model. Valid values are "
-            "'inline' and 'processes'.")),
-    ]
-    return options
-
-
-def get(port, options, client, worker_class):
+def get(worker_model, client, worker_class):
     """Return a connection to a manager/worker message_broker
 
     Args:
-        port - handle to layout_tests/port object for port-specific stuff
-        options - optparse argument for command-line options
-        client - message_broker.BrokerClient implementation to dispatch
+        worker_model - concurrency model to use (inline/processes)
+        client - BrokerClient implementation to dispatch
             replies to.
-        worker_class - type of workers to create. This class must implement
+        worker_class - type of workers to create. This class should override
             the methods in AbstractWorker.
     Returns:
         A handle to an object that will talk to a message broker configured
-        for the normal manager/worker communication.
-    """
-    worker_model = options.worker_model
+        for the normal manager/worker communication."""
     if worker_model == 'inline':
         queue_class = Queue.Queue
         manager_class = _InlineManager
@@ -99,12 +108,143 @@ def get(port, options, client, worker_class):
     else:
         raise ValueError("unsupported value for --worker-model: %s" % worker_model)
 
-    broker = message_broker.Broker(options, queue_class)
-    return manager_class(broker, port, options, client, worker_class)
+    broker = _Broker(queue_class)
+    return manager_class(broker, client, worker_class)
+
+
+class BrokerClient(object):
+    """Abstract base class / interface that all message broker clients must
+    implement. In addition to the methods below, by convention clients
+    implement routines of the signature type
+
+        handle_MESSAGE_NAME(self, src, ...):
+
+    where MESSAGE_NAME matches the string passed to post_message(), and
+    src indicates the name of the sender. If the message contains values in
+    the message body, those will be provided as optparams."""
+
+    def is_done(self):
+        """Called from inside run_message_loop() to indicate whether to exit."""
+        raise NotImplementedError
+
+    def name(self):
+        """Return a name that identifies the client."""
+        raise NotImplementedError
+
+
+class _Broker(object):
+    """Brokers provide the basic model of a set of topics. Clients can post a
+    message to any topic using post_message(), and can process messages on one
+    topic at a time using run_message_loop()."""
+
+    def __init__(self, queue_maker):
+        """Args:
+            queue_maker: a factory method that returns objects implementing a
+                Queue interface (put()/get()).
+        """
+        self._queue_maker = queue_maker
+        self._topics = {}
+
+    def add_topic(self, topic_name):
+        if topic_name not in self._topics:
+            self._topics[topic_name] = self._queue_maker()
+
+    def _get_queue_for_topic(self, topic_name):
+        return self._topics[topic_name]
+
+    def post_message(self, client, topic_name, message_name, *message_args):
+        """Post a message to the appropriate topic name.
+
+        Messages have a name and a tuple of optional arguments. Both must be picklable."""
+        message = _Message(client.name(), topic_name, message_name, message_args)
+        queue = self._get_queue_for_topic(topic_name)
+        queue.put(_Message.dumps(message))
+
+    def run_message_loop(self, topic_name, client, delay_secs=None):
+        """Loop processing messages until client.is_done() or delay passes.
+
+        To run indefinitely, set delay_secs to None."""
+        assert delay_secs is None or delay_secs > 0
+        self._run_loop(topic_name, client, block=True, delay_secs=delay_secs)
+
+    def run_all_pending(self, topic_name, client):
+        """Process messages until client.is_done() or caller would block."""
+        self._run_loop(topic_name, client, block=False, delay_secs=None)
+
+    def _run_loop(self, topic_name, client, block, delay_secs):
+        queue = self._get_queue_for_topic(topic_name)
+        while not client.is_done():
+            try:
+                s = queue.get(block, delay_secs)
+            except Queue.Empty:
+                return
+            msg = _Message.loads(s)
+            self._dispatch_message(msg, client)
+
+    def _dispatch_message(self, message, client):
+        if not hasattr(client, 'handle_' + message.name):
+            raise ValueError(
+               "%s: received message '%s' it couldn't handle" %
+               (client.name(), message.name))
+        optargs = message.args
+        message_handler = getattr(client, 'handle_' + message.name)
+        message_handler(message.src, *optargs)
+
+
+class _Message(object):
+    @staticmethod
+    def loads(string_value):
+        obj = cPickle.loads(string_value)
+        assert(isinstance(obj, _Message))
+        return obj
+
+    def __init__(self, src, topic_name, message_name, message_args):
+        self.src = src
+        self.topic_name = topic_name
+        self.name = message_name
+        self.args = message_args
+
+    def dumps(self):
+        return cPickle.dumps(self)
+
+    def __repr__(self):
+        return ("_Message(from='%s', topic_name='%s', message_name='%s')" %
+                (self.src, self.topic_name, self.name))
+
+
+class _BrokerConnection(object):
+    """_BrokerConnection provides a connection-oriented facade on top of a
+    Broker, so that callers don't have to repeatedly pass the same topic
+    names over and over."""
+
+    def __init__(self, broker, client, run_topic, post_topic):
+        """Create a _BrokerConnection on top of a _Broker. Note that the _Broker
+        is passed in rather than created so that a single _Broker can be used
+        by multiple _BrokerConnections."""
+        self._broker = broker
+        self._client = client
+        self._post_topic = post_topic
+        self._run_topic = run_topic
+        broker.add_topic(run_topic)
+        broker.add_topic(post_topic)
+
+    def run_message_loop(self, delay_secs=None):
+        self._broker.run_message_loop(self._run_topic, self._client, delay_secs)
+
+    def post_message(self, message_name, *message_args):
+        self._broker.post_message(self._client, self._post_topic,
+                                  message_name, *message_args)
+
+    def raise_exception(self, exc_info):
+        # Since tracebacks aren't picklable, send the extracted stack instead.
+        exception_type, exception_value, exception_traceback = sys.exc_info()
+        stack_utils.log_traceback(_log.debug, exception_traceback)
+        stack = traceback.extract_tb(exception_traceback)
+        self._broker.post_message(self._client, self._post_topic, 'exception', exception_type, exception_value, stack)
 
 
-class AbstractWorker(message_broker.BrokerClient):
-    def __init__(self, worker_connection, worker_number, results_directory, options):
+class AbstractWorker(BrokerClient):
+    def __init__(self, worker_connection, worker_arguments=None):
         """The constructor should be used to do any simple initialization
         necessary, but should not do anything that creates data structures
         that cannot be Pickled or sent across processes (like opening
@@ -112,59 +252,88 @@ class AbstractWorker(message_broker.BrokerClient):
         start of the run() call.
 
         Args:
-            worker_connection - handle to the BrokerConnection object creating
+            worker_connection - handle to the _BrokerConnection object creating
                 the worker and that can be used for messaging.
-            worker_number - identifier for this particular worker
-            options - command-line argument object from optparse"""
-        message_broker.BrokerClient.__init__(self)
+            worker_arguments - (optional, Picklable) object passed to the worker from the manager"""
+        BrokerClient.__init__(self)
         self._worker_connection = worker_connection
-        self._options = options
-        self._worker_number = worker_number
-        self._name = 'worker/%d' % worker_number
-        self._results_directory = results_directory
+        self._name = 'worker'
+        self._done = False
+        self._canceled = False
+
+    def name(self):
+        return self._name
+
+    def is_done(self):
+        return self._done or self._canceled
+
+    def stop_handling_messages(self):
+        self._done = True
 
-    def run(self, port):
+    def run(self):
         """Callback for the worker to start executing. Typically does any
         remaining initialization and then calls broker_connection.run_message_loop()."""
-        raise NotImplementedError
+        exception_msg = ""
+        _log.debug("%s starting" % self._name)
+
+        try:
+            self._worker_connection.run_message_loop()
+            if not self.is_done():
+                raise AssertionError("%s: ran out of messages in worker queue."
+                                     % self._name)
+        except KeyboardInterrupt:
+            exception_msg = ", interrupted"
+            self._worker_connection.raise_exception(sys.exc_info())
+        except:
+            exception_msg = ", exception raised"
+            self._worker_connection.raise_exception(sys.exc_info())
+        finally:
+            _log.debug("%s done with message loop%s" % (self._name, exception_msg))
 
     def cancel(self):
         """Called when possible to indicate to the worker to stop processing
         messages and shut down. Note that workers may be stopped without this
         method being called, so clients should not rely solely on this."""
-        raise NotImplementedError
+        self._canceled = True
 
 
-class _ManagerConnection(message_broker.BrokerConnection):
-    def __init__(self, broker, options, client, worker_class):
+class _ManagerConnection(_BrokerConnection):
+    def __init__(self, broker, client, worker_class):
         """Base initialization for all Manager objects.
 
         Args:
             broker: handle to the message_broker object
-            options: command line options object
             client: callback object (the caller)
             worker_class: class object to use to create workers.
         """
-        message_broker.BrokerConnection.__init__(self, broker, client,
-            MANAGER_TOPIC, ANY_WORKER_TOPIC)
-        self._options = options
+        _BrokerConnection.__init__(self, broker, client, MANAGER_TOPIC, ANY_WORKER_TOPIC)
         self._worker_class = worker_class
 
-    def start_worker(self, worker_number, results_directory):
+    def start_worker(self, worker_arguments=None):
+        """Starts a new worker.
+
+        Args:
+            worker_arguments - an optional Picklable object that is passed to the worker constructor
+        """
         raise NotImplementedError
 
 
 class _InlineManager(_ManagerConnection):
-    def __init__(self, broker, port, options, client, worker_class):
-        _ManagerConnection.__init__(self, broker, options, client, worker_class)
-        self._port = port
+    def __init__(self, broker, client, worker_class):
+        _ManagerConnection.__init__(self, broker, client, worker_class)
         self._inline_worker = None
 
-    def start_worker(self, worker_number, results_directory):
-        self._inline_worker = _InlineWorkerConnection(self._broker, self._port,
-            self._client, self._worker_class, worker_number, results_directory, self._options)
+    def start_worker(self, worker_arguments=None):
+        self._inline_worker = _InlineWorkerConnection(self._broker,
+            self._client, self._worker_class, worker_arguments)
         return self._inline_worker
 
+    def set_inline_arguments(self, arguments=None):
+        # Note that this method only exists here, and not on all
+        # ManagerConnections; calling this method on a MultiProcessManager
+        # will deliberately result in a runtime error.
+        self._inline_worker.set_inline_arguments(arguments)
+
     def run_message_loop(self, delay_secs=None):
         # Note that delay_secs is ignored in this case since we can't easily
         # implement it.
@@ -173,27 +342,20 @@ class _InlineManager(_ManagerConnection):
 
 
 class _MultiProcessManager(_ManagerConnection):
-    def __init__(self, broker, port, options, client, worker_class):
-        # Note that this class does not keep a handle to the actual port
-        # object, because it isn't Picklable. Instead it keeps the port
-        # name and recreates the port in the child process from the name
-        # and options.
-        _ManagerConnection.__init__(self, broker, options, client, worker_class)
-        self._platform_name = port.real_name()
-
-    def start_worker(self, worker_number, results_directory):
-        worker_connection = _MultiProcessWorkerConnection(self._broker, self._platform_name,
-            self._worker_class, worker_number, results_directory, self._options)
+    def start_worker(self, worker_arguments=None):
+        worker_connection = _MultiProcessWorkerConnection(self._broker,
+            self._worker_class, worker_arguments)
         worker_connection.start()
         return worker_connection
 
 
-class _WorkerConnection(message_broker.BrokerConnection):
-    def __init__(self, broker, worker_class, worker_number, results_directory, options):
-        self._client = worker_class(self, worker_number, results_directory, options)
-        self.name = self._client.name()
-        message_broker.BrokerConnection.__init__(self, broker, self._client,
-                                                 ANY_WORKER_TOPIC, MANAGER_TOPIC)
+class _WorkerConnection(_BrokerConnection):
+    def __init__(self, broker, worker_class, worker_arguments=None):
+        self._client = worker_class(self, worker_arguments)
+        _BrokerConnection.__init__(self, broker, self._client, ANY_WORKER_TOPIC, MANAGER_TOPIC)
+
+    def name(self):
+        return self._client.name()
 
     def cancel(self):
         raise NotImplementedError
@@ -209,10 +371,9 @@ class _WorkerConnection(message_broker.BrokerConnection):
 
 
 class _InlineWorkerConnection(_WorkerConnection):
-    def __init__(self, broker, port, manager_client, worker_class, worker_number, results_directory, options):
-        _WorkerConnection.__init__(self, broker, worker_class, worker_number, results_directory, options)
+    def __init__(self, broker, manager_client, worker_class, worker_arguments):
+        _WorkerConnection.__init__(self, broker, worker_class, worker_arguments)
         self._alive = False
-        self._port = port
         self._manager_client = manager_client
 
     def cancel(self):
@@ -224,10 +385,15 @@ class _InlineWorkerConnection(_WorkerConnection):
     def join(self, timeout):
         assert not self._alive
 
+    def set_inline_arguments(self, arguments):
+        self._client.set_inline_arguments(arguments)
+
     def run(self):
         self._alive = True
-        self._client.run(self._port)
-        self._alive = False
+        try:
+            self._client.run()
+        finally:
+            self._alive = False
 
     def yield_to_broker(self):
         self._broker.run_all_pending(MANAGER_TOPIC, self._manager_client)
@@ -240,43 +406,19 @@ class _InlineWorkerConnection(_WorkerConnection):
 
 
 class _Process(multiprocessing.Process):
-    def __init__(self, worker_connection, platform_name, options, client):
+    def __init__(self, worker_connection, client):
         multiprocessing.Process.__init__(self)
         self._worker_connection = worker_connection
-        self._platform_name = platform_name
-        self._options = options
         self._client = client
 
     def run(self):
-        # We need to create a new Host object here because this is
-        # running in a new process and we can't require the parent's
-        # Host to be pickleable and passed to the child.
-        if self._platform_name.startswith('test'):
-            host = MockHost()
-        else:
-            host = Host()
-        host._initialize_scm()
-
-        options = self._options
-        port_obj = host.port_factory.get(self._platform_name, options)
-
-        # The unix multiprocessing implementation clones the
-        # log handler configuration into the child processes,
-        # but the win implementation doesn't.
-        configure_logging = (sys.platform == 'win32')
-
-        # FIXME: this won't work if the calling process is logging
-        # somewhere other than sys.stderr and sys.stdout, but I'm not sure
-        # if this will be an issue in practice.
-        printer = printing.Printer(port_obj, options, sys.stderr, sys.stdout, configure_logging)
-        self._client.run(port_obj)
-        printer.cleanup()
+        self._client.run()
 
 
 class _MultiProcessWorkerConnection(_WorkerConnection):
-    def __init__(self, broker, platform_name, worker_class, worker_number, results_directory, options):
-        _WorkerConnection.__init__(self, broker, worker_class, worker_number, results_directory, options)
-        self._proc = _Process(self, platform_name, options, self._client)
+    def __init__(self, broker, worker_class, worker_arguments):
+        _WorkerConnection.__init__(self, broker, worker_class, worker_arguments)
+        self._proc = _Process(self, self._client)
 
     def cancel(self):
         return self._proc.terminate()
diff --git a/Tools/Scripts/webkitpy/layout_tests/controllers/manager_worker_broker_unittest.py b/Tools/Scripts/webkitpy/layout_tests/controllers/manager_worker_broker_unittest.py
index e41e22ca6..5457a2d26 100644
--- a/Tools/Scripts/webkitpy/layout_tests/controllers/manager_worker_broker_unittest.py
+++ b/Tools/Scripts/webkitpy/layout_tests/controllers/manager_worker_broker_unittest.py
@@ -32,11 +32,7 @@ import sys
 import unittest
 
 from webkitpy.common.system import outputcapture
-from webkitpy.common.host_mock import MockHost
-from webkitpy.layout_tests import port
 from webkitpy.layout_tests.controllers import manager_worker_broker
-from webkitpy.layout_tests.controllers import message_broker
-from webkitpy.layout_tests.views import printing
 
 
 # In order to reliably control when child workers are starting and stopping,
@@ -48,68 +44,45 @@ starting_queue = None
 stopping_queue = None
 
 
+WORKER_NAME = 'TestWorker'
+
 def make_broker(manager, worker_model, start_queue=None, stop_queue=None):
     global starting_queue
     global stopping_queue
     starting_queue = start_queue
     stopping_queue = stop_queue
-    options = get_options(worker_model)
-    host = MockHost()
-    test_port = host.port_factory.get("test")
-    return manager_worker_broker.get(test_port, options, manager, _TestWorker)
+    return manager_worker_broker.get(worker_model, manager, _TestWorker)
 
 
 class _TestWorker(manager_worker_broker.AbstractWorker):
-    def __init__(self, broker_connection, worker_number, results_directory, options):
-        self._broker_connection = broker_connection
-        self._options = options
-        self._worker_number = worker_number
-        self._name = 'TestWorker/%d' % worker_number
-        self._stopped = False
-        self._canceled = False
+    def __init__(self, worker_connection, worker_arguments=None):
+        super(_TestWorker, self).__init__(worker_connection)
+        self._name = WORKER_NAME
+        self._thing_to_greet = 'everybody'
         self._starting_queue = starting_queue
         self._stopping_queue = stopping_queue
 
+    def set_inline_arguments(self, thing_to_greet):
+        self._thing_to_greet = thing_to_greet
+
     def handle_stop(self, src):
-        self._stopped = True
+        self.stop_handling_messages()
 
     def handle_test(self, src, an_int, a_str):
         assert an_int == 1
         assert a_str == "hello, world"
-        self._broker_connection.post_message('test', 2, 'hi, everybody')
-
-    def is_done(self):
-        return self._stopped or self._canceled
-
-    def name(self):
-        return self._name
-
-    def cancel(self):
-        self._canceled = True
+        self._worker_connection.post_message('test', 2, 'hi, ' + self._thing_to_greet)
 
-    def run(self, port):
+    def run(self):
         if self._starting_queue:
             self._starting_queue.put('')
 
         if self._stopping_queue:
             self._stopping_queue.get()
         try:
-            self._broker_connection.run_message_loop()
-            self._broker_connection.yield_to_broker()
-            self._broker_connection.post_message('done')
-        except Exception, e:
-            self._broker_connection.post_message('exception', (type(e), str(e), None))
-
-
-def get_options(worker_model):
-    option_list = (manager_worker_broker.runtime_options() +
-                   printing.print_options() +
-                   [optparse.make_option("--experimental-fully-parallel", default=False),
-                    optparse.make_option("--child-processes", default='2')])
-    parser = optparse.OptionParser(option_list=option_list)
-    options, args = parser.parse_args(args=['--worker-model', worker_model])
-    return options
-
+            super(_TestWorker, self).run()
+        finally:
+            self._worker_connection.post_message('done')
 
 
 class FunctionTests(unittest.TestCase):
@@ -131,7 +104,7 @@ class _TestsMixin(object):
     contract all implementations must follow."""
 
     def name(self):
-        return 'Tester'
+        return 'TesterManager'
 
     def is_done(self):
         return self._done
@@ -143,9 +116,8 @@ class _TestsMixin(object):
         self._an_int = an_int
         self._a_str = a_str
 
-    def handle_exception(self, src, exc_info):
-        self._exception = exc_info
-        self._done = True
+    def handle_exception(self, src, exception_type, exception_value, stack):
+        raise exception_type(exception_value)
 
     def setUp(self):
         self._an_int = None
@@ -159,17 +131,25 @@ class _TestsMixin(object):
         self._broker = make_broker(self, self._worker_model, starting_queue,
                                    stopping_queue)
 
+    def test_name(self):
+        self.make_broker()
+        worker = self._broker.start_worker()
+        self.assertEquals(worker.name(), WORKER_NAME)
+        worker.cancel()
+        worker.join(0.1)
+        self.assertFalse(worker.is_alive())
+
     def test_cancel(self):
         self.make_broker()
-        worker = self._broker.start_worker(0, None)
+        worker = self._broker.start_worker()
         worker.cancel()
         self._broker.post_message('test', 1, 'hello, world')
-        worker.join(0.5)
+        worker.join(0.1)
         self.assertFalse(worker.is_alive())
 
     def test_done(self):
         self.make_broker()
-        worker = self._broker.start_worker(0, None)
+        worker = self._broker.start_worker()
         self._broker.post_message('test', 1, 'hello, world')
         self._broker.post_message('stop')
         self._broker.run_message_loop()
@@ -181,16 +161,32 @@ class _TestsMixin(object):
 
     def test_unknown_message(self):
         self.make_broker()
-        worker = self._broker.start_worker(0, None)
+        worker = self._broker.start_worker()
         self._broker.post_message('unknown')
-        self._broker.run_message_loop()
-        worker.join(0.5)
-
-        self.assertTrue(self.is_done())
+        try:
+            self._broker.run_message_loop()
+            self.fail()
+        except ValueError, e:
+            self.assertEquals(str(e),
+                              "%s: received message 'unknown' it couldn't handle" % WORKER_NAME)
+        finally:
+            worker.join(0.5)
         self.assertFalse(worker.is_alive())
-        self.assertEquals(self._exception[0], ValueError)
-        self.assertEquals(self._exception[1],
-            "TestWorker/0: received message 'unknown' it couldn't handle")
+
+
+class InlineBrokerTests(_TestsMixin, unittest.TestCase):
+    def setUp(self):
+        _TestsMixin.setUp(self)
+        self._worker_model = 'inline'
+
+    def test_inline_arguments(self):
+        self.make_broker()
+        worker = self._broker.start_worker()
+        worker.set_inline_arguments('me')
+        self._broker.post_message('test', 1, 'hello, world')
+        self._broker.post_message('stop')
+        self._broker.run_message_loop()
+        self.assertEquals(self._a_str, 'hi, me')
 
 
 # FIXME: https://bugs.webkit.org/show_bug.cgi?id=54520.
@@ -202,35 +198,57 @@ if sys.platform not in ('cygwin', 'win32'):
             self._worker_model = 'processes'
 
 
-class FunctionsTest(unittest.TestCase):
-    def test_runtime_options(self):
-        option_list = manager_worker_broker.runtime_options()
-        parser = optparse.OptionParser(option_list=option_list)
-        options, args = parser.parse_args([])
-        self.assertTrue(options)
-
-
 class InterfaceTest(unittest.TestCase):
     # These tests mostly exist to pacify coverage.
 
     # FIXME: There must be a better way to do this and also verify
     # that classes do implement every abstract method in an interface.
+    def test_brokerclient_is_abstract(self):
+        # Test that all the base class methods are abstract and have the
+        # signature we expect.
+        obj = manager_worker_broker.BrokerClient()
+        self.assertRaises(NotImplementedError, obj.is_done)
+        self.assertRaises(NotImplementedError, obj.name)
+
     def test_managerconnection_is_abstract(self):
         # Test that all the base class methods are abstract and have the
         # signature we expect.
         broker = make_broker(self, 'inline')
-        obj = manager_worker_broker._ManagerConnection(broker._broker, None, self, None)
-        self.assertRaises(NotImplementedError, obj.start_worker, 0, None)
+        obj = manager_worker_broker._ManagerConnection(broker._broker, self, None)
+        self.assertRaises(NotImplementedError, obj.start_worker)
 
     def test_workerconnection_is_abstract(self):
         # Test that all the base class methods are abstract and have the
         # signature we expect.
         broker = make_broker(self, 'inline')
-        obj = manager_worker_broker._WorkerConnection(broker._broker, _TestWorker, 0, None, None)
+        obj = manager_worker_broker._WorkerConnection(broker._broker, _TestWorker, None)
         self.assertRaises(NotImplementedError, obj.cancel)
         self.assertRaises(NotImplementedError, obj.is_alive)
         self.assertRaises(NotImplementedError, obj.join, None)
 
 
+class MessageTest(unittest.TestCase):
+    def test__no_body(self):
+        msg = manager_worker_broker._Message('src', 'topic_name', 'message_name', None)
+        self.assertTrue(repr(msg))
+        s = msg.dumps()
+        new_msg = manager_worker_broker._Message.loads(s)
+        self.assertEqual(new_msg.name, 'message_name')
+        self.assertEqual(new_msg.args, None)
+        self.assertEqual(new_msg.topic_name, 'topic_name')
+        self.assertEqual(new_msg.src, 'src')
+
+    def test__body(self):
+        msg = manager_worker_broker._Message('src', 'topic_name', 'message_name', ('body', 0))
+        self.assertTrue(repr(msg))
+        s = msg.dumps()
+        new_msg = manager_worker_broker._Message.loads(s)
+        self.assertEqual(new_msg.name, 'message_name')
+        self.assertEqual(new_msg.args, ('body', 0))
+        self.assertEqual(new_msg.topic_name, 'topic_name')
+        self.assertEqual(new_msg.src, 'src')
+
+
+
 if __name__ == '__main__':
     unittest.main()
diff --git a/Tools/Scripts/webkitpy/layout_tests/controllers/message_broker.py b/Tools/Scripts/webkitpy/layout_tests/controllers/message_broker.py
deleted file mode 100644
index d58a6cd11..000000000
--- a/Tools/Scripts/webkitpy/layout_tests/controllers/message_broker.py
+++ /dev/null
@@ -1,202 +0,0 @@
-# Copyright (C) 2011 Google Inc. All rights reserved.
-#
-# Redistribution and use in source and binary forms, with or without
-# modification, are permitted provided that the following conditions are
-# met:
-#
-#     * Redistributions of source code must retain the above copyright
-# notice, this list of conditions and the following disclaimer.
-#     * Redistributions in binary form must reproduce the above
-# copyright notice, this list of conditions and the following disclaimer
-# in the documentation and/or other materials provided with the
-# distribution.
-#     * Neither the name of Google Inc. nor the names of its
-# contributors may be used to endorse or promote products derived from
-# this software without specific prior written permission.
-#
-# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
-# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
-# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
-# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
-# OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
-# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
-# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
-# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
-# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
-# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-
-"""Module for handling messaging for run-webkit-tests.
-
-This module implements a simple message broker abstraction that will be
-used to coordinate messages between the main run-webkit-tests thread
-(aka TestRunner) and the individual worker threads (previously known as
-dump_render_tree_threads).
-
-The broker simply distributes messages onto topics (named queues); the actual
-queues themselves are provided by the caller, as the queue's implementation
-requirements varies vary depending on the desired concurrency model
-(none/threads/processes).
-
-In order for shared-nothing messaging between processing to be possible,
-Messages must be picklable.
-
-The module defines one interface and two classes. Callers of this package
-must implement the BrokerClient interface, and most callers will create
-BrokerConnections as well as Brokers.
-
-The classes relate to each other as:
-
-    BrokerClient   ------>    BrokerConnection
-         ^                         |
-         |                         v
-         \----------------      Broker
-
-(The BrokerClient never calls broker directly after it is created, only
-BrokerConnection.  BrokerConnection passes a reference to BrokerClient to
-Broker, and Broker only invokes that reference, never talking directly to
-BrokerConnection).
-"""
-import sys
-import traceback
-
-import cPickle
-import logging
-import Queue
-
-from webkitpy.common.system import stack_utils
-
-_log = logging.getLogger(__name__)
-
-
-class BrokerClient(object):
-    """Abstract base class / interface that all message broker clients must
-    implement. In addition to the methods below, by convention clients
-    implement routines of the signature type
-
-        handle_MESSAGE_NAME(self, src, ...):
-
-    where MESSAGE_NAME matches the string passed to post_message(), and
-    src indicates the name of the sender. If the message contains values in
-    the message body, those will be provided as optparams."""
-
-    def is_done(self):
-        """Called from inside run_message_loop() to indicate whether to exit."""
-        raise NotImplementedError
-
-    def name(self):
-        """Return a name that identifies the client."""
-        raise NotImplementedError
-
-
-class Broker(object):
-    """Brokers provide the basic model of a set of topics. Clients can post a
-    message to any topic using post_message(), and can process messages on one
-    topic at a time using run_message_loop()."""
-
-    def __init__(self, options, queue_maker):
-        """Args:
-            options: a runtime option class from optparse
-            queue_maker: a factory method that returns objects implementing a
-                Queue interface (put()/get()).
-        """
-        self._options = options
-        self._queue_maker = queue_maker
-        self._topics = {}
-
-    def add_topic(self, topic_name):
-        if topic_name not in self._topics:
-            self._topics[topic_name] = self._queue_maker()
-
-    def _get_queue_for_topic(self, topic_name):
-        return self._topics[topic_name]
-
-    def post_message(self, client, topic_name, message_name, *message_args):
-        """Post a message to the appropriate topic name.
-
-        Messages have a name and a tuple of optional arguments. Both must be picklable."""
-        message = _Message(client.name(), topic_name, message_name, message_args)
-        queue = self._get_queue_for_topic(topic_name)
-        queue.put(_Message.dumps(message))
-
-    def run_message_loop(self, topic_name, client, delay_secs=None):
-        """Loop processing messages until client.is_done() or delay passes.
-
-        To run indefinitely, set delay_secs to None."""
-        assert delay_secs is None or delay_secs > 0
-        self._run_loop(topic_name, client, block=True, delay_secs=delay_secs)
-
-    def run_all_pending(self, topic_name, client):
-        """Process messages until client.is_done() or caller would block."""
-        self._run_loop(topic_name, client, block=False, delay_secs=None)
-
-    def _run_loop(self, topic_name, client, block, delay_secs):
-        queue = self._get_queue_for_topic(topic_name)
-        while not client.is_done():
-            try:
-                s = queue.get(block, delay_secs)
-            except Queue.Empty:
-                return
-            msg = _Message.loads(s)
-            self._dispatch_message(msg, client)
-
-    def _dispatch_message(self, message, client):
-        if not hasattr(client, 'handle_' + message.name):
-            raise ValueError(
-               "%s: received message '%s' it couldn't handle" %
-               (client.name(), message.name))
-        optargs = message.args
-        message_handler = getattr(client, 'handle_' + message.name)
-        message_handler(message.src, *optargs)
-
-
-class _Message(object):
-    @staticmethod
-    def loads(string_value):
-        obj = cPickle.loads(string_value)
-        assert(isinstance(obj, _Message))
-        return obj
-
-    def __init__(self, src, topic_name, message_name, message_args):
-        self.src = src
-        self.topic_name = topic_name
-        self.name = message_name
-        self.args = message_args
-
-    def dumps(self):
-        return cPickle.dumps(self)
-
-    def __repr__(self):
-        return ("_Message(from='%s', topic_name='%s', message_name='%s')" %
-                (self.src, self.topic_name, self.name))
-
-
-class BrokerConnection(object):
-    """BrokerConnection provides a connection-oriented facade on top of a
-    Broker, so that callers don't have to repeatedly pass the same topic
-    names over and over."""
-
-    def __init__(self, broker, client, run_topic, post_topic):
-        """Create a BrokerConnection on top of a Broker. Note that the Broker
-        is passed in rather than created so that a single Broker can be used
-        by multiple BrokerConnections."""
-        self._broker = broker
-        self._client = client
-        self._post_topic = post_topic
-        self._run_topic = run_topic
-        broker.add_topic(run_topic)
-        broker.add_topic(post_topic)
-
-    def run_message_loop(self, delay_secs=None):
-        self._broker.run_message_loop(self._run_topic, self._client, delay_secs)
-
-    def post_message(self, message_name, *message_args):
-        self._broker.post_message(self._client, self._post_topic,
-                                  message_name, *message_args)
-
-    def raise_exception(self, exc_info):
-        # Since tracebacks aren't picklable, send the extracted stack instead.
-        exception_type, exception_value, exception_traceback = sys.exc_info()
-        stack_utils.log_traceback(_log.debug, exception_traceback)
-        stack = traceback.extract_tb(exception_traceback)
-        self._broker.post_message(self._client, self._post_topic, 'exception', exception_type, exception_value, stack)
diff --git a/Tools/Scripts/webkitpy/layout_tests/controllers/message_broker_unittest.py b/Tools/Scripts/webkitpy/layout_tests/controllers/message_broker_unittest.py
deleted file mode 100644
index cb8d8e6f9..000000000
--- a/Tools/Scripts/webkitpy/layout_tests/controllers/message_broker_unittest.py
+++ /dev/null
@@ -1,76 +0,0 @@
-# Copyright (C) 2011 Google Inc. All rights reserved.
-#
-# Redistribution and use in source and binary forms, with or without
-# modification, are permitted provided that the following conditions are
-# met:
-#
-#     * Redistributions of source code must retain the above copyright
-# notice, this list of conditions and the following disclaimer.
-#     * Redistributions in binary form must reproduce the above
-# copyright notice, this list of conditions and the following disclaimer
-# in the documentation and/or other materials provided with the
-# distribution.
-#     * Neither the name of Google Inc. nor the names of its
-# contributors may be used to endorse or promote products derived from
-# this software without specific prior written permission.
-#
-# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
-# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
-# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
-# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
-# OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
-# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
-# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
-# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
-# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
-# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-
-import unittest
-
-from webkitpy.layout_tests.controllers import message_broker
-
-# This file exists to test routines that aren't necessarily covered elsewhere;
-# most of the testing of message_broker will be covered under the tests in
-# the manager_worker_broker module.
-
-
-class MessageTest(unittest.TestCase):
-    def test__no_body(self):
-        msg = message_broker._Message('src', 'topic_name', 'message_name', None)
-        self.assertTrue(repr(msg))
-        s = msg.dumps()
-        new_msg = message_broker._Message.loads(s)
-        self.assertEqual(new_msg.name, 'message_name')
-        self.assertEqual(new_msg.args, None)
-        self.assertEqual(new_msg.topic_name, 'topic_name')
-        self.assertEqual(new_msg.src, 'src')
-
-    def test__body(self):
-        msg = message_broker._Message('src', 'topic_name', 'message_name',
-                                      ('body', 0))
-        self.assertTrue(repr(msg))
-        s = msg.dumps()
-        new_msg = message_broker._Message.loads(s)
-        self.assertEqual(new_msg.name, 'message_name')
-        self.assertEqual(new_msg.args, ('body', 0))
-        self.assertEqual(new_msg.topic_name, 'topic_name')
-        self.assertEqual(new_msg.src, 'src')
-
-
-class InterfaceTest(unittest.TestCase):
-    # These tests mostly exist to pacify coverage.
-
-    # FIXME: There must be a better way to do this and also verify
-    # that classes do implement every abstract method in an interface.
-
-    def test_brokerclient_is_abstract(self):
-        # Test that all the base class methods are abstract and have the
-        # signature we expect.
-        obj = message_broker.BrokerClient()
-        self.assertRaises(NotImplementedError, obj.is_done)
-        self.assertRaises(NotImplementedError, obj.name)
-
-
-if __name__ == '__main__':
-    unittest.main()
diff --git a/Tools/Scripts/webkitpy/layout_tests/controllers/single_test_runner.py b/Tools/Scripts/webkitpy/layout_tests/controllers/single_test_runner.py
index 987a77978..38f75bdac 100644
--- a/Tools/Scripts/webkitpy/layout_tests/controllers/single_test_runner.py
+++ b/Tools/Scripts/webkitpy/layout_tests/controllers/single_test_runner.py
@@ -224,7 +224,7 @@ class SingleTestRunner:
         failures = []
         if (expected_text and actual_text and
             # Assuming expected_text is already normalized.
-            self._port.compare_text(self._get_normalized_output_text(actual_text), expected_text)):
+            self._port.do_text_results_differ(self._get_normalized_output_text(actual_text), expected_text)):
             failures.append(test_failures.FailureTextMismatch())
         elif actual_text and not expected_text:
             failures.append(test_failures.FailureMissingResult())
@@ -233,7 +233,7 @@ class SingleTestRunner:
     def _compare_audio(self, actual_audio, expected_audio):
         failures = []
         if (expected_audio and actual_audio and
-            self._port.compare_audio(actual_audio, expected_audio)):
+            self._port.do_audio_results_differ(actual_audio, expected_audio)):
             failures.append(test_failures.FailureAudioMismatch())
         elif actual_audio and not expected_audio:
             failures.append(test_failures.FailureMissingAudio())
@@ -264,6 +264,9 @@ class SingleTestRunner:
             driver_output.image_diff = diff_result[0]
             if driver_output.image_diff:
                 failures.append(test_failures.FailureImageHashMismatch(diff_result[1]))
+            else:
+                # See https://bugs.webkit.org/show_bug.cgi?id=69444 for why this isn't a full failure.
+                _log.warning('%s -> pixel hash failed (but pixel test still passes)' % self._test_name)
         return failures
 
     def _run_reftest(self):
@@ -272,8 +275,8 @@ class SingleTestRunner:
         reference_output = None
         test_result = None
 
-        # A reftest can have multiple match references and multiple mismatch references; 
-        # the test fails if any mismatch matches and all of the matches don't match. 
+        # A reftest can have multiple match references and multiple mismatch references;
+        # the test fails if any mismatch matches and all of the matches don't match.
         # To minimize the number of references we have to check, we run all of the mismatches first,
         # then the matches, and short-circuit out as soon as we can.
         # Note that sorting by the expectation sorts "!=" before "==" so this is easy to do.
diff --git a/Tools/Scripts/webkitpy/layout_tests/controllers/test_result_writer.py b/Tools/Scripts/webkitpy/layout_tests/controllers/test_result_writer.py
index 88e2ab691..a40c090b5 100644
--- a/Tools/Scripts/webkitpy/layout_tests/controllers/test_result_writer.py
+++ b/Tools/Scripts/webkitpy/layout_tests/controllers/test_result_writer.py
@@ -28,7 +28,6 @@
 
 
 import logging
-import os
 
 from webkitpy.common.system.crashlogs import CrashLogs
 from webkitpy.layout_tests.models import test_failures
@@ -106,7 +105,7 @@ class TestResultWriter(object):
         """Creates the output directory (if needed) for a given test filename."""
         fs = self._port._filesystem
         output_filename = fs.join(self._root_output_dir, self._test_name)
-        self._port.maybe_make_directory(fs.dirname(output_filename))
+        fs.maybe_make_directory(fs.dirname(output_filename))
 
     def output_filename(self, modifier):
         """Returns a filename inside the output dir that contains modifier.
diff --git a/Tools/Scripts/webkitpy/layout_tests/controllers/worker.py b/Tools/Scripts/webkitpy/layout_tests/controllers/worker.py
index fc7831dfb..22c0a5f04 100644
--- a/Tools/Scripts/webkitpy/layout_tests/controllers/worker.py
+++ b/Tools/Scripts/webkitpy/layout_tests/controllers/worker.py
@@ -33,20 +33,31 @@ import sys
 import threading
 import time
 
+from webkitpy.common.host import Host
 from webkitpy.layout_tests.controllers import manager_worker_broker
 from webkitpy.layout_tests.controllers import single_test_runner
 from webkitpy.layout_tests.models import test_expectations
 from webkitpy.layout_tests.models import test_results
+from webkitpy.layout_tests.views import printing
 
 
 _log = logging.getLogger(__name__)
 
 
+class WorkerArguments(object):
+    def __init__(self, worker_number, results_directory, options):
+        self.worker_number = worker_number
+        self.results_directory = results_directory
+        self.options = options
+
+
 class Worker(manager_worker_broker.AbstractWorker):
-    def __init__(self, worker_connection, worker_number, results_directory, options):
-        manager_worker_broker.AbstractWorker.__init__(self, worker_connection, worker_number, results_directory, options)
-        self._done = False
-        self._canceled = False
+    def __init__(self, worker_connection, worker_arguments):
+        super(Worker, self).__init__(worker_connection, worker_arguments)
+        self._worker_number = worker_arguments.worker_number
+        self._name = 'worker/%d' % self._worker_number
+        self._results_directory = worker_arguments.results_directory
+        self._options = worker_arguments.options
         self._port = None
         self._batch_size = None
         self._batch_count = None
@@ -54,52 +65,55 @@ class Worker(manager_worker_broker.AbstractWorker):
         self._driver = None
         self._tests_run_file = None
         self._tests_run_filename = None
+        self._printer = None
 
     def __del__(self):
         self.cleanup()
 
-    def safe_init(self, port):
+    def safe_init(self):
         """This method should only be called when it is is safe for the mixin
         to create state that can't be Pickled.
 
         This routine exists so that the mixin can be created and then marshaled
         across into a child process."""
-        self._port = port
-        self._filesystem = port.host.filesystem
+        self._filesystem = self._port.host.filesystem
         self._batch_count = 0
         self._batch_size = self._options.batch_size or 0
         tests_run_filename = self._filesystem.join(self._results_directory, "tests_run%d.txt" % self._worker_number)
         self._tests_run_file = self._filesystem.open_text_file_for_writing(tests_run_filename)
 
-    def cancel(self):
-        """Attempt to abort processing (best effort)."""
-        self._canceled = True
+    def set_inline_arguments(self, port):
+        self._port = port
+
+    def run(self):
+        if not self._port:
+            # We are running in a child process and need to create a new Host.
+            if self._options.platform and 'test' in self._options.platform:
+                # It is lame to import mocks into real code, but this allows us to use the test port in multi-process tests as well.
+                from webkitpy.common.host_mock import MockHost
+                host = MockHost()
+            else:
+                host = Host()
 
-    def is_done(self):
-        return self._done or self._canceled
+            options = self._options
+            self._port = host.port_factory.get(options.platform, options)
 
-    def name(self):
-        return self._name
+            # The unix multiprocessing implementation clones the
+            # log handler configuration into the child processes,
+            # but the win implementation doesn't.
+            configure_logging = (sys.platform == 'win32')
 
-    def run(self, port):
-        self.safe_init(port)
+            # FIXME: This won't work if the calling process is logging
+            # somewhere other than sys.stderr and sys.stdout, but I'm not sure
+            # if this will be an issue in practice.
+            self._printer = printing.Printer(self._port, options, sys.stderr, sys.stdout, configure_logging)
 
-        exception_msg = ""
-        _log.debug("%s starting" % self._name)
+        self.safe_init()
 
         try:
-            self._worker_connection.run_message_loop()
-            if not self.is_done():
-                raise AssertionError("%s: ran out of messages in worker queue."
-                                     % self._name)
-        except KeyboardInterrupt:
-            exception_msg = ", interrupted"
-            self._worker_connection.raise_exception(sys.exc_info())
-        except:
-            exception_msg = ", exception raised"
-            self._worker_connection.raise_exception(sys.exc_info())
+            _log.debug("%s starting" % self._name)
+            super(Worker, self).run()
         finally:
-            _log.debug("%s done with message loop%s" % (self._name, exception_msg))
             self._worker_connection.post_message('done')
             self.cleanup()
             _log.debug("%s exiting" % self._name)
@@ -119,7 +133,7 @@ class Worker(manager_worker_broker.AbstractWorker):
         self._worker_connection.post_message('finished_list', list_name, num_tests, elapsed_time)
 
     def handle_stop(self, src):
-        self._done = True
+        self.stop_handling_messages()
 
     def _run_test(self, test_input):
         test_timeout_sec = self.timeout(test_input)
@@ -139,6 +153,9 @@ class Worker(manager_worker_broker.AbstractWorker):
         if self._tests_run_file:
             self._tests_run_file.close()
             self._tests_run_file = None
+        if self._printer:
+            self._printer.cleanup()
+            self._printer = None
 
     def timeout(self, test_input):
         """Compute the appropriate timeout value for a test."""
diff --git a/Tools/Scripts/webkitpy/common/array_stream_unittest.py b/Tools/Scripts/webkitpy/layout_tests/controllers/worker_unittest.py
index 1a9b34a17..6fd5202d9 100644
--- a/Tools/Scripts/webkitpy/common/array_stream_unittest.py
+++ b/Tools/Scripts/webkitpy/layout_tests/controllers/worker_unittest.py
@@ -1,5 +1,4 @@
-#!/usr/bin/python
-# Copyright (C) 2010 Google Inc. All rights reserved.
+# Copyright (c) 2012 Google Inc. All rights reserved.
 #
 # Redistribution and use in source and binary forms, with or without
 # modification, are permitted provided that the following conditions are
@@ -27,52 +26,30 @@
 # (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 # OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
-"""Unit tests for array_stream.py."""
-
-import pdb
 import unittest
 
-from webkitpy.common.array_stream import ArrayStream
-
-
-class ArrayStreamTest(unittest.TestCase):
-    def assertEmpty(self, a_stream):
-        self.assertTrue(a_stream.empty())
-
-    def assertNotEmpty(self, a_stream):
-        self.assertFalse(a_stream.empty())
-
-    def assertContentsMatch(self, a_stream, contents):
-        self.assertEquals(a_stream.get(), contents)
-
-    def test_basics(self):
-        a = ArrayStream()
-        self.assertEmpty(a)
-        self.assertContentsMatch(a, [])
+from webkitpy.layout_tests.controllers.worker import Worker, WorkerArguments
+from webkitpy.tool.mocktool import MockOptions
 
-        a.flush()
-        self.assertEmpty(a)
-        self.assertContentsMatch(a, [])
 
-        a.write("foo")
-        a.write("bar")
-        self.assertNotEmpty(a)
-        self.assertContentsMatch(a, ["foo", "bar"])
+class FakeConnection(object):
+    def run_message_loop(self):
+        pass
 
-        a.flush()
-        self.assertNotEmpty(a)
-        self.assertContentsMatch(a, ["foo", "bar"])
+    def post_message(self, message_name, *message_args):
+        pass
 
-        a.reset()
-        self.assertEmpty(a)
-        self.assertContentsMatch(a, [])
 
-        self.assertEquals(str(a), "<ArrayStream: []>")
+class WorkerTest(unittest.TestCase):
+    def test_default_platform_in_worker(self):
+        # This checks that we got a port and didn't raise an exception
+        # if we didn't specify a port with the --platform flag.
+        worker_connection = FakeConnection()
+        worker = Worker(worker_connection, WorkerArguments(1, '/tmp', MockOptions(platform=None, print_options=None, verbose=False, batch_size=0)))
+        worker._done = True
+        worker.run()
+        self.assertNotEquals(worker._port, None)
 
-        a.write("foo")
-        self.assertNotEmpty(a)
-        self.assertContentsMatch(a, ["foo"])
-        self.assertEquals(str(a), "<ArrayStream: ['foo']>")
 
 if __name__ == '__main__':
     unittest.main()
diff --git a/Tools/Scripts/webkitpy/layout_tests/layout_package/json_results_generator.py b/Tools/Scripts/webkitpy/layout_tests/layout_package/json_results_generator.py
index 56ef7abcd..4c4858b3b 100644
--- a/Tools/Scripts/webkitpy/layout_tests/layout_package/json_results_generator.py
+++ b/Tools/Scripts/webkitpy/layout_tests/layout_package/json_results_generator.py
@@ -28,7 +28,6 @@
 
 import json
 import logging
-import os
 import subprocess
 import sys
 import time
diff --git a/Tools/Scripts/webkitpy/layout_tests/models/test_expectations.py b/Tools/Scripts/webkitpy/layout_tests/models/test_expectations.py
index 90842007c..ea4837d93 100644
--- a/Tools/Scripts/webkitpy/layout_tests/models/test_expectations.py
+++ b/Tools/Scripts/webkitpy/layout_tests/models/test_expectations.py
@@ -182,7 +182,7 @@ class TestExpectationParser(object):
     BUG_MODIFIER_PREFIX = 'bug'
     BUG_MODIFIER_REGEX = 'bug\d+'
     REBASELINE_MODIFIER = 'rebaseline'
-    FAIL_EXPECTATION = 'fail'
+    PASS_EXPECTATION = 'pass'
     SKIP_MODIFIER = 'skip'
     SLOW_MODIFIER = 'slow'
     WONTFIX_MODIFIER = 'wontfix'
@@ -206,7 +206,7 @@ class TestExpectationParser(object):
         expectation_line.original_string = test_name
         expectation_line.modifiers = [TestExpectationParser.DUMMY_BUG_MODIFIER, TestExpectationParser.SKIP_MODIFIER]
         expectation_line.name = test_name
-        expectation_line.expectations = [TestExpectationParser.FAIL_EXPECTATION]
+        expectation_line.expectations = [TestExpectationParser.PASS_EXPECTATION]
         self._parse_line(expectation_line)
         return expectation_line
 
diff --git a/Tools/Scripts/webkitpy/layout_tests/models/test_expectations_unittest.py b/Tools/Scripts/webkitpy/layout_tests/models/test_expectations_unittest.py
index a2c94cbcd..00f1bfd4c 100644
--- a/Tools/Scripts/webkitpy/layout_tests/models/test_expectations_unittest.py
+++ b/Tools/Scripts/webkitpy/layout_tests/models/test_expectations_unittest.py
@@ -272,7 +272,7 @@ SKIP : failures/expected/image.html""", is_lint_mode=True)
         port._filesystem.files[port._filesystem.join(port.layout_tests_dir(), 'failures/expected/text.html')] = 'foo'
         expectations = TestExpectations(port, tests=['failures/expected/text.html'], expectations='', test_config=port.test_configuration())
         self.assertEquals(expectations.get_modifiers('failures/expected/text.html'), [TestExpectationParser.DUMMY_BUG_MODIFIER, TestExpectationParser.SKIP_MODIFIER])
-        self.assertEquals(expectations.get_expectations('failures/expected/text.html'), set([FAIL]))
+        self.assertEquals(expectations.get_expectations('failures/expected/text.html'), set([PASS]))
 
     def test_add_skipped_tests_duplicate(self):
         port = MockHost().port_factory.get('qt')
diff --git a/Tools/Scripts/webkitpy/layout_tests/port/base.py b/Tools/Scripts/webkitpy/layout_tests/port/base.py
index 10e2a822c..1b86bfe0d 100755
--- a/Tools/Scripts/webkitpy/layout_tests/port/base.py
+++ b/Tools/Scripts/webkitpy/layout_tests/port/base.py
@@ -169,6 +169,13 @@ class Port(object):
     def default_worker_model(self):
         return 'processes'
 
+    def worker_startup_delay_secs(self):
+        # FIXME: If we start workers up too quickly, DumpRenderTree appears
+        # to thrash on something and time out its first few tests. Until
+        # we can figure out what's going on, sleep a bit in between
+        # workers. See https://bugs.webkit.org/show_bug.cgi?id=79147 .
+        return 0.1
+
     def baseline_path(self):
         """Return the absolute path to the directory to store new baselines in for this port."""
         baseline_search_paths = self.get_option('additional_platform_directory', []) + self.baseline_search_path()
@@ -248,17 +255,10 @@ class Port(object):
             _log.error("No httpd found. Cannot run http tests.")
             return False
 
-    def compare_text(self, expected_text, actual_text):
-        """Return whether or not the two strings are *not* equal. This
-        routine is used to diff text output.
-
-        While this is a generic routine, we include it in the Port
-        interface so that it can be overriden for testing purposes."""
+    def do_text_results_differ(self, expected_text, actual_text):
         return expected_text != actual_text
 
-    def compare_audio(self, expected_audio, actual_audio):
-        # FIXME: If we give this method a better name it won't need this docstring (e.g. are_audio_results_equal()).
-        """Return whether the two audio files are *not* equal."""
+    def do_audio_results_differ(self, expected_audio, actual_audio):
         return expected_audio != actual_audio
 
     def diff_image(self, expected_contents, actual_contents, tolerance=None):
@@ -269,14 +269,9 @@ class Port(object):
         """
         raise NotImplementedError('Port.diff_image')
 
-
-    def diff_text(self, expected_text, actual_text,
-                  expected_filename, actual_filename):
+    def diff_text(self, expected_text, actual_text, expected_filename, actual_filename):
         """Returns a string containing the diff of the two text strings
-        in 'unified diff' format.
-
-        While this is a generic routine, we include it in the Port
-        interface so that it can be overriden for testing purposes."""
+        in 'unified diff' format."""
 
         # The filenames show up in the diff output, make sure they're
         # raw bytes and not unicode, so that they don't trigger join()
@@ -309,10 +304,7 @@ class Port(object):
         pass
 
     def driver_name(self):
-        """Returns the name of the actual binary that is performing the test,
-        so that it can be referred to in log messages. In most cases this
-        will be DumpRenderTree, but if a port uses a binary with a different
-        name, it can be overridden here."""
+        # FIXME: Seems we should get this from the Port's Driver class.
         return "DumpRenderTree"
 
     def expected_baselines(self, test_name, suffix, all_baselines=False):
@@ -619,21 +611,12 @@ class Port(object):
                 return True
         return False
 
-    def maybe_make_directory(self, *comps):
-        """Creates the specified directory if it doesn't already exist."""
-        self._filesystem.maybe_make_directory(*comps)
-
     def name(self):
         """Returns a name that uniquely identifies this particular type of port
         (e.g., "mac-snowleopard" or "chromium-gpu-linux-x86_x64" and can be passed
         to factory.get() to instantiate the port."""
         return self._name
 
-    def real_name(self):
-        # FIXME: Seems this is only used for MockDRT and should be removed.
-        """Returns the name of the port as passed to the --platform command line argument."""
-        return self.name()
-
     def operating_system(self):
         # Subclasses should override this default implementation.
         return 'mac'
@@ -769,16 +752,16 @@ class Port(object):
         method."""
         pass
 
-    def start_http_server(self):
+    def start_http_server(self, additional_dirs=None):
         """Start a web server. Raise an error if it can't start or is already running.
 
         Ports can stub this out if they don't need a web server to be running."""
         assert not self._http_server, 'Already running an http server.'
 
         if self._uses_apache():
-            server = apache_http_server.LayoutTestApacheHttpd(self, self.results_directory())
+            server = apache_http_server.LayoutTestApacheHttpd(self, self.results_directory(), additional_dirs=additional_dirs)
         else:
-            server = http_server.Lighttpd(self, self.results_directory())
+            server = http_server.Lighttpd(self, self.results_directory(), additional_dirs=additional_dirs)
 
         server.start()
         self._http_server = server
diff --git a/Tools/Scripts/webkitpy/layout_tests/port/builders.py b/Tools/Scripts/webkitpy/layout_tests/port/builders.py
index 42fed50b2..3f7e413ce 100644
--- a/Tools/Scripts/webkitpy/layout_tests/port/builders.py
+++ b/Tools/Scripts/webkitpy/layout_tests/port/builders.py
@@ -44,8 +44,7 @@ _exact_matches = {
     "Webkit Win (dbg)(2)": {"port_name": "chromium-win-xp", "specifiers": set(["win", "debug"])},
     "Webkit Linux": {"port_name": "chromium-linux-x86_64", "specifiers": set(["linux", "x86_64", "release"])},
     "Webkit Linux 32": {"port_name": "chromium-linux-x86", "specifiers": set(["linux", "x86"])},
-    "Webkit Linux (dbg)(1)": {"port_name": "chromium-linux-x86_64", "specifiers": set(["linux", "debug"])},
-    "Webkit Linux (dbg)(2)": {"port_name": "chromium-linux-x86_64", "specifiers": set(["linux", "debug"])},
+    "Webkit Linux (dbg)": {"port_name": "chromium-linux-x86_64", "specifiers": set(["linux", "debug"])},
     "Webkit Mac10.5": {"port_name": "chromium-mac-leopard", "specifiers": set(["leopard"])},
     "Webkit Mac10.5 (dbg)(1)": {"port_name": "chromium-mac-leopard", "specifiers": set(["leopard", "debug"])},
     "Webkit Mac10.5 (dbg)(2)": {"port_name": "chromium-mac-leopard", "specifiers": set(["leopard", "debug"])},
diff --git a/Tools/Scripts/webkitpy/layout_tests/port/chromium.py b/Tools/Scripts/webkitpy/layout_tests/port/chromium.py
index 199a2ecb9..83139e0fc 100755
--- a/Tools/Scripts/webkitpy/layout_tests/port/chromium.py
+++ b/Tools/Scripts/webkitpy/layout_tests/port/chromium.py
@@ -66,7 +66,8 @@ class ChromiumPort(Port):
         ('vista', 'x86'),
         ('win7', 'x86'),
         ('lucid', 'x86'),
-        ('lucid', 'x86_64'))
+        ('lucid', 'x86_64'),
+        ('icecreamsandwich', 'arm'))
 
     ALL_GRAPHICS_TYPES = ('cpu', 'gpu')
 
@@ -81,6 +82,7 @@ class ChromiumPort(Port):
         'mac': ['leopard', 'snowleopard', 'lion'],
         'win': ['xp', 'vista', 'win7'],
         'linux': ['lucid'],
+        'android': ['icecreamsandwich'],
     }
 
     @classmethod
@@ -592,6 +594,10 @@ class ChromiumDriver(Driver):
         return DriverOutput(text, output_image, actual_checksum, audio=audio_bytes,
             crash=crash, crashed_process_name=crashed_process_name, test_time=run_time, timeout=timeout, error=error)
 
+    def start(self):
+        if not self._proc:
+            self._start()
+
     def stop(self):
         if not self._proc:
             return
diff --git a/Tools/Scripts/webkitpy/layout_tests/port/chromium_android.py b/Tools/Scripts/webkitpy/layout_tests/port/chromium_android.py
new file mode 100644
index 000000000..bdb2cbb31
--- /dev/null
+++ b/Tools/Scripts/webkitpy/layout_tests/port/chromium_android.py
@@ -0,0 +1,528 @@
+# Copyright (C) 2012 Google Inc. All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions are
+# met:
+#
+#     * Redistributions of source code must retain the above copyright
+# notice, this list of conditions and the following disclaimer.
+#     * Redistributions in binary form must reproduce the above
+# copyright notice, this list of conditions and the following disclaimer
+# in the documentation and/or other materials provided with the
+# distribution.
+#     * Neither the name of Google Inc. nor the names of its
+# contributors may be used to endorse or promote products derived from
+# this software without specific prior written permission.
+#
+# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+# OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+import logging
+
+from webkitpy.layout_tests.port import chromium
+from webkitpy.layout_tests.port import factory
+
+
+_log = logging.getLogger(__name__)
+
+
+# The root directory for test resources, which has the same structure as the
+# source root directory of Chromium.
+# This path is defined in base/base_paths_android.cc and
+# webkit/support/platform_support_android.cc.
+DEVICE_SOURCE_ROOT_DIR = '/data/local/tmp/'
+
+DEVICE_DRT_DIR = '/data/drt/'
+DEVICE_DRT_PATH = DEVICE_DRT_DIR + 'DumpRenderTree'
+DEVICE_DRT_STDERR = DEVICE_DRT_DIR + 'DumpRenderTree.stderr'
+DEVICE_FORWARDER_PATH = DEVICE_DRT_DIR + 'forwarder'
+DEVICE_DRT_STAMP_PATH = DEVICE_DRT_DIR + 'DumpRenderTree.stamp'
+
+# This only works for single core devices so far.
+# FIXME: Find a solution for multi-core devices.
+SCALING_GOVERNOR = "/sys/devices/system/cpu/cpu0/cpufreq/scaling_governor"
+
+# All the test cases are still served to DumpRenderTree through file protocol,
+# but we use a file-to-http feature to bridge the file request to host's http
+# server to get the real test files and corresponding resources.
+TEST_PATH_PREFIX = '/all-tests'
+
+# All ports the Android forwarder to forward.
+# 8000, 8080 and 8443 are for http/https tests.
+# 8880 and 9323 are for websocket tests
+# (see http_server.py, apache_http_server.py and websocket_server.py).
+FORWARD_PORTS = '8000 8080 8443 8880 9323'
+
+MS_TRUETYPE_FONTS_DIR = '/usr/share/fonts/truetype/msttcorefonts/'
+
+# List of fonts that layout tests expect, copied from DumpRenderTree/gtk/TestShellGtk.cpp.
+HOST_FONT_FILES = [
+    [MS_TRUETYPE_FONTS_DIR, 'Arial.ttf'],
+    [MS_TRUETYPE_FONTS_DIR, 'Arial_Bold.ttf'],
+    [MS_TRUETYPE_FONTS_DIR, 'Arial_Bold_Italic.ttf'],
+    [MS_TRUETYPE_FONTS_DIR, 'Arial_Italic.ttf'],
+    [MS_TRUETYPE_FONTS_DIR, 'Comic_Sans_MS.ttf'],
+    [MS_TRUETYPE_FONTS_DIR, 'Comic_Sans_MS_Bold.ttf'],
+    [MS_TRUETYPE_FONTS_DIR, 'Courier_New.ttf'],
+    [MS_TRUETYPE_FONTS_DIR, 'Courier_New_Bold.ttf'],
+    [MS_TRUETYPE_FONTS_DIR, 'Courier_New_Bold_Italic.ttf'],
+    [MS_TRUETYPE_FONTS_DIR, 'Courier_New_Italic.ttf'],
+    [MS_TRUETYPE_FONTS_DIR, 'Georgia.ttf'],
+    [MS_TRUETYPE_FONTS_DIR, 'Georgia_Bold.ttf'],
+    [MS_TRUETYPE_FONTS_DIR, 'Georgia_Bold_Italic.ttf'],
+    [MS_TRUETYPE_FONTS_DIR, 'Georgia_Italic.ttf'],
+    [MS_TRUETYPE_FONTS_DIR, 'Impact.ttf'],
+    [MS_TRUETYPE_FONTS_DIR, 'Trebuchet_MS.ttf'],
+    [MS_TRUETYPE_FONTS_DIR, 'Trebuchet_MS_Bold.ttf'],
+    [MS_TRUETYPE_FONTS_DIR, 'Trebuchet_MS_Bold_Italic.ttf'],
+    [MS_TRUETYPE_FONTS_DIR, 'Trebuchet_MS_Italic.ttf'],
+    [MS_TRUETYPE_FONTS_DIR, 'Times_New_Roman.ttf'],
+    [MS_TRUETYPE_FONTS_DIR, 'Times_New_Roman_Bold.ttf'],
+    [MS_TRUETYPE_FONTS_DIR, 'Times_New_Roman_Bold_Italic.ttf'],
+    [MS_TRUETYPE_FONTS_DIR, 'Times_New_Roman_Italic.ttf'],
+    [MS_TRUETYPE_FONTS_DIR, 'Verdana.ttf'],
+    [MS_TRUETYPE_FONTS_DIR, 'Verdana_Bold.ttf'],
+    [MS_TRUETYPE_FONTS_DIR, 'Verdana_Bold_Italic.ttf'],
+    [MS_TRUETYPE_FONTS_DIR, 'Verdana_Italic.ttf'],
+    # The Microsoft font EULA
+    ['/usr/share/doc/ttf-mscorefonts-installer/', 'READ_ME!.gz'],
+    ['/usr/share/fonts/truetype/ttf-dejavu/', 'DejaVuSans.ttf'],
+]
+# Should increase this version after changing HOST_FONT_FILES.
+FONT_FILES_VERSION = 1
+
+DEVICE_FONTS_DIR = DEVICE_DRT_DIR + 'fonts/'
+DEVICE_FIRST_FALLBACK_FONT = '/system/fonts/DroidNaskh-Regular.ttf'
+
+# The layout tests directory on device, which has two usages:
+# 1. as a virtual path in file urls that will be bridged to HTTP.
+# 2. pointing to some files that are pushed to the device for tests that
+# don't work on file-over-http (e.g. blob protocol tests).
+DEVICE_LAYOUT_TESTS_DIR = (DEVICE_SOURCE_ROOT_DIR + 'third_party/WebKit/LayoutTests/')
+FILE_TEST_URI_PREFIX = 'file://' + DEVICE_LAYOUT_TESTS_DIR
+
+# Test resources that need to be accessed as files directly.
+# Each item can be the relative path of a directory or a file.
+TEST_RESOURCES_TO_PUSH = [
+    # Blob tests need to access files directly.
+    'editing/pasteboard/resources',
+    'fast/files/resources',
+    'http/tests/local/resources',
+    'http/tests/local/formdata/resources',
+    # User style URLs are accessed as local files in webkit_support.
+    'http/tests/security/resources/cssStyle.css',
+    # Media tests need to access audio/video as files.
+    'media/content',
+    'compositing/resources/video.mp4',
+]
+
+
+class ChromiumAndroidPort(chromium.ChromiumPort):
+    port_name = 'chromium-android'
+
+    FALLBACK_PATHS = [
+        'chromium-android',
+        'chromium-linux',
+        'chromium-win',
+        'chromium',
+        'win',
+        'mac',
+    ]
+
+    def __init__(self, host, port_name, **kwargs):
+        chromium.ChromiumPort.__init__(self, host, port_name, **kwargs)
+
+        # The chromium-android port always uses the GPU code path, so we set
+        # these options here, almost as if this was the chromium-gpu-android
+        # port.
+        self._options.accelerated_2d_canvas = True
+        self._options.accelerated_video = True
+
+        self._operating_system = 'android'
+        self._version = 'icecreamsandwich'
+        # FIXME: we may support other architectures in the future.
+        self._architecture = 'arm'
+        self._original_governor = None
+        self._android_base_dir = None
+
+        self._host_port = factory.PortFactory(host).get('chromium', **kwargs)
+
+        self._adb_command = ['adb']
+        adb_args = self.get_option('adb_args')
+        if adb_args:
+            self._adb_command += shlex.split(adb_args)
+
+    def default_child_processes(self):
+        # Currently we only use one process, but it might be helpful to use
+        # more that one process in the future to improve performance.
+        return 1
+
+    def baseline_search_path(self):
+        return map(self._webkit_baseline_path, self.FALLBACK_PATHS)
+
+    def check_build(self, needs_http):
+        return self._host_port.check_build(needs_http)
+
+    def check_sys_deps(self, needs_http):
+        for (font_dir, font_file) in HOST_FONT_FILES:
+            font_path = font_dir + font_file
+            if not self._check_file_exists(font_path, 'font file'):
+                _log.error('You are missing %s. Try installing msttcorefonts. '
+                           'See build instructions.' % font_path)
+                return False
+        return True
+
+    def default_worker_model(self):
+        return 'inline'
+
+    def test_expectations(self):
+        # Automatically apply all expectation rules of chromium-linux to
+        # chromium-android.
+        # FIXME: This is a temporary measure to reduce the manual work when
+        # updating WebKit. This method should be removed when we merge
+        # test_expectations_android.txt into test_expectations.txt.
+        expectations = chromium.ChromiumPort.test_expectations(self)
+        return expectations.replace('LINUX ', 'LINUX ANDROID ')
+
+    def start_http_server(self, additional_dirs=None):
+        # The http server runs during the whole testing period, so ignore this call.
+        pass
+
+    def stop_http_server(self):
+        # Same as start_http_server().
+        pass
+
+    def start_helper(self):
+        self._setup_performance()
+        # Required by webkit_support::GetWebKitRootDirFilePath().
+        # Other directories will be created automatically by adb push.
+        self._run_adb_command(['shell', 'mkdir', '-p',
+                               DEVICE_SOURCE_ROOT_DIR + 'chrome'])
+
+        self._push_executable()
+        self._push_fonts()
+        self._setup_system_font_for_test()
+        self._synchronize_datetime()
+
+        # Start the HTTP server so that the device can access the test cases.
+        chromium.ChromiumPort.start_http_server(self, additional_dirs={TEST_PATH_PREFIX: self.layout_tests_dir()})
+
+        _log.debug('Starting forwarder')
+        cmd = self._run_adb_command(['shell', '%s %s' % (DEVICE_FORWARDER_PATH, FORWARD_PORTS)])
+
+    def stop_helper(self):
+        self._restore_system_font()
+        # Leave the forwarder and tests httpd server there because they are
+        # useful for debugging and do no harm to subsequent tests.
+        self._teardown_performance()
+
+    def _build_path(self, *comps):
+        return self._host_port._build_path(*comps)
+
+    def _path_to_apache(self):
+        return self._host_port._path_to_apache()
+
+    def _path_to_apache_config_file(self):
+        return self._host_port._path_to_apache_config_file()
+
+    def _path_to_driver(self, configuration=None):
+        # Returns the host path to driver which will be pushed to the device.
+        if not configuration:
+            configuration = self.get_option('configuration')
+        return self._build_path(configuration, 'DumpRenderTree')
+
+    def _path_to_helper(self):
+        return self._build_path(self.get_option('configuration'), 'forwarder')
+
+    def _path_to_image_diff(self):
+        return self._host_port._path_to_image_diff()
+
+    def _path_to_lighttpd(self):
+        return self._host_port._path_to_lighttpd()
+
+    def _path_to_lighttpd_modules(self):
+        return self._host_port._path_to_lighttpd_modules()
+
+    def _path_to_lighttpd_php(self):
+        return self._host_port._path_to_lighttpd_php()
+
+    def _path_to_wdiff(self):
+        return self._host_port._path_to_wdiff()
+
+    def _shut_down_http_server(self, pid):
+        return self._host_port._shut_down_http_server(pid)
+
+    def _driver_class(self):
+        return ChromiumAndroidDriver
+
+    def _push_executable(self):
+        drt_host_path = self._path_to_driver()
+        forwarder_host_path = self._path_to_helper()
+        drt_jar_host_path = drt_host_path + '.jar'
+        host_stamp = int(float(max(os.stat(drt_host_path).st_mtime,
+                                   os.stat(forwarder_host_path).st_mtime,
+                                   os.stat(drt_jar_host_path).st_mtime)))
+        device_stamp = int(float(self._run_adb_command([
+            'shell', 'cat %s 2>/dev/null || echo 0' % DEVICE_DRT_STAMP_PATH])))
+        if device_stamp < host_stamp:
+            _log.debug('Pushing executable')
+            self._kill_device_process(DEVICE_FORWARDER_PATH)
+            self._push_to_device(forwarder_host_path, DEVICE_FORWARDER_PATH)
+            self._push_to_device(drt_host_path, DEVICE_DRT_PATH)
+            self._push_to_device(drt_host_path + '.pak', DEVICE_DRT_PATH + '.pak')
+            self._push_to_device(drt_host_path + '_resources', DEVICE_DRT_PATH + '_resources')
+            self._push_to_device(drt_jar_host_path, DEVICE_DRT_PATH + '.jar')
+            # Version control of test resources is dependent on executables,
+            # because we will always rebuild executables when resources are
+            # updated.
+            self._push_test_resources()
+            self._run_adb_command(['shell', 'echo %d >%s' % (host_stamp, DEVICE_DRT_STAMP_PATH)])
+
+    def _push_fonts(self):
+        if not self._check_version(DEVICE_FONTS_DIR, FONT_FILES_VERSION):
+            _log.debug('Pushing fonts')
+            path_to_ahem_font = self._build_path(self.get_option('configuration'), 'AHEM____.TTF')
+            self._push_to_device(path_to_ahem_font, DEVICE_FONTS_DIR + 'AHEM____.TTF')
+            for (host_dir, font_file) in HOST_FONT_FILES:
+                self._push_to_device(host_dir + font_file, DEVICE_FONTS_DIR + font_file)
+            self._update_version(DEVICE_FONTS_DIR, FONT_FILES_VERSION)
+
+    def _setup_system_font_for_test(self):
+        # The DejaVu font implicitly used by some CSS 2.1 tests should be added
+        # into the font fallback list of the system. DroidNaskh-Regular.ttf is
+        # the first font in Android Skia's font fallback list. Fortunately the
+        # DejaVu font also contains Naskh glyphs.
+        # First remount /system in read/write mode.
+        self._run_adb_command(['remount'])
+        self._copy_device_file(DEVICE_FONTS_DIR + 'DejaVuSans.ttf', DEVICE_FIRST_FALLBACK_FONT)
+
+    def _restore_system_font(self):
+        # First remount /system in read/write mode.
+        self._run_adb_command(['remount'])
+        self._push_to_device(os.environ['OUT'] + DEVICE_FIRST_FALLBACK_FONT, DEVICE_FIRST_FALLBACK_FONT)
+
+    def _push_test_resources(self):
+        _log.debug('Pushing test resources')
+        for resource in TEST_RESOURCES_TO_PUSH:
+            self._push_to_device(self.layout_tests_dir() + '/' + resource, DEVICE_LAYOUT_TESTS_DIR + resource)
+
+    def _synchronize_datetime(self):
+        # The date/time between host and device may not be synchronized.
+        # We need to make them synchronized, otherwise tests might fail.
+        try:
+            # Get seconds since 1970-01-01 00:00:00 UTC.
+            host_datetime = self._executive.run_command(['date', '-u', '+%s'])
+        except:
+            # Reset to 1970-01-01 00:00:00 UTC.
+            host_datetime = 0
+        self._run_adb_command(['shell', 'date -u %s' % (host_datetime)])
+
+    def _check_version(self, dir, version):
+        assert(dir.endswith('/'))
+        try:
+            device_version = int(self._run_adb_command(['shell', 'cat %sVERSION || echo 0' % dir]))
+            return device_version == version
+        except:
+            return False
+
+    def _update_version(self, dir, version):
+        self._run_adb_command(['shell', 'echo %d > %sVERSION' % (version, dir)])
+
+    def _run_adb_command(self, cmd, ignore_error=False):
+        if ignore_error:
+            error_handler = self._executive.ignore_error
+        else:
+            error_handler = None
+        return self._executive.run_command(self._adb_command + cmd, error_handler=error_handler)
+
+    def _copy_device_file(self, from_file, to_file, ignore_error=False):
+        # 'cp' is unavailable on Android, so use 'dd' instead.
+        return self._run_adb_command(['shell', 'dd', 'if=' + from_file, 'of=' + to_file], ignore_error)
+
+    def _push_to_device(self, host_path, device_path, ignore_error=False):
+        return self._run_adb_command(['push', host_path, device_path], ignore_error)
+
+    def _pull_from_device(self, device_path, host_path, ignore_error=False):
+        return self._run_adb_command(['pull', device_path, host_path], ignore_error)
+
+    def _kill_device_process(self, name):
+        ps_result = self._run_adb_command(['shell', 'ps']).split('\n')
+        for line in ps_result:
+            if line.find(name) > 0:
+                pid = line.split()[1]
+                self._run_adb_command(['shell', 'kill', pid])
+
+    def get_stderr(self):
+        return self._run_adb_command(['shell', 'cat', DEVICE_DRT_STDERR], ignore_error=True)
+
+    def get_last_stacktrace(self):
+        tombstones = self._run_adb_command(['shell', 'ls', '-n', '/data/tombstones'])
+        tombstones = tombstones.rstrip().split('\n')
+        if not tombstones:
+            return ''
+        last_tombstone = tombstones[0].split()
+        for tombstone in tombstones[1:]:
+            # Format of fields:
+            # 0          1      2      3     4          5     6
+            # permission uid    gid    size  date       time  filename
+            # -rw------- 1000   1000   45859 2011-04-13 06:00 tombstone_00
+            fields = tombstone.split()
+            if (fields[4] + fields[5] >= last_tombstone[4] + last_tombstone[5]):
+                last_tombstone = fields
+            else:
+                break
+
+        # Use Android tool vendor/google/tools/stack to convert the raw
+        # stack trace into a human readable format, if needed.
+        # It takes a long time, so don't do it here.
+        return self._run_adb_command(['shell', 'cat', '/data/tombstones/' + last_tombstone[6]])
+
+    def _setup_performance(self):
+        # Disable CPU scaling and drop ram cache to reduce noise in tests
+        if not self._original_governor:
+            self._original_governor = self._run_adb_command(['shell', 'cat', SCALING_GOVERNOR])
+            self._run_adb_command(['shell', 'echo', 'performance', '>', SCALING_GOVERNOR])
+
+    def _teardown_performance(self):
+        if self._original_governor:
+            self._run_adb_command(['shell', 'echo', self._original_governor, SCALING_GOVERNOR])
+        self._original_governor = None
+
+
+class ChromiumAndroidDriver(chromium.ChromiumDriver):
+    def __init__(self, port, worker_number, pixel_tests, no_timeout=False):
+        chromium.ChromiumDriver.__init__(self, port, worker_number, pixel_tests, no_timeout)
+        if self._image_path:
+            self._device_image_path = DEVICE_DRT_DIR + port.host.filesystem.basename(self._image_path)
+
+    def _start(self):
+        # Convert the original command line into to two parts:
+        # - the 'adb shell' command line to start an interactive adb shell;
+        # - the DumpRenderTree command line to send to the adb shell.
+        original_cmd = self.cmd_line()
+        shell_cmd = []
+        drt_args = []
+        path_to_driver = self._port._path_to_driver()
+        reading_args_before_driver = True
+        for param in original_cmd:
+            if reading_args_before_driver:
+                if param == path_to_driver:
+                    reading_args_before_driver = False
+                else:
+                    shell_cmd.append(param)
+            else:
+                if param.startswith('--pixel-tests='):
+                    param = '--pixel-tests=' + self._device_image_path
+                drt_args.append(param)
+
+        shell_cmd += self._port._adb_command
+        shell_cmd.append('shell')
+        retries = 0
+        while True:
+            _log.debug('Starting adb shell for DumpRenderTree: ' + ' '.join(shell_cmd))
+            executive = self._port.host.executive
+            self._proc = executive.Popen(shell_cmd, stdin=executive.PIPE, stdout=executive.PIPE, stderr=executive.STDOUT, close_fds=True)
+            # Read back the shell prompt ('# ') to ensure adb shell ready.
+            prompt = self._proc.stdout.read(2)
+            assert(prompt == '# ')
+            # Some tests rely on this to produce proper number format etc.,
+            # e.g. fast/speech/input-appearance-numberandspeech.html.
+            self._write_command_and_read_line("export LC_CTYPE='en_US'\n")
+            self._write_command_and_read_line("export CLASSPATH='/data/drt/DumpRenderTree.jar'\n")
+
+            # When DumpRenderTree crashes, the Android debuggerd will stop the
+            # process before dumping stack to log/tombstone file and terminating
+            # the process. Sleep 1 second (long enough for debuggerd to dump
+            # stack) before exiting the shell to ensure the process has quit,
+            # otherwise the exit will fail because "You have stopped jobs".
+            drt_cmd = '%s %s 2>%s;sleep 1;exit\n' % (DEVICE_DRT_PATH, ' '.join(drt_args), DEVICE_DRT_STDERR)
+            _log.debug('Starting DumpRenderTree: ' + drt_cmd)
+
+            # Wait until DRT echos '#READY'.
+            output = ''
+            (line, crash) = self._write_command_and_read_line(drt_cmd)
+            while not crash and line.rstrip() != '#READY':
+                if line == '':  # EOF or crashed
+                    crash = True
+                else:
+                    output += line
+                    (line, crash) = self._write_command_and_read_line()
+
+            if crash:
+                # Sometimes the device is in unstable state (may be out of
+                # memory?) and kills DumpRenderTree just after it is started.
+                # Try to stop and start it again.
+                _log.error('Failed to start DumpRenderTree: \n%s\n%s\n' % (output, self._port.get_stderr()))
+                self.stop()
+                retries += 1
+                if retries > 2:
+                    raise AssertionError('Failed multiple times to start DumpRenderTree')
+            else:
+                return
+
+    def run_test(self, driver_input):
+        driver_output = chromium.ChromiumDriver.run_test(self, driver_input)
+        # FIXME: Retrieve stderr from the target.
+        if driver_output.crash:
+            # Fetch the stack trace from the tombstone file.
+            # FIXME: sometimes the crash doesn't really happen so that no
+            # tombstone is generated. In that case we fetch the wrong stack
+            # trace.
+            driver_output.error += self._port.get_last_stacktrace()
+        return driver_output
+
+    def stop(self):
+        _log.debug('Stopping DumpRenderTree')
+        if self._proc:
+            # Send an explicit QUIT command because closing the pipe can't let
+            # DumpRenderTree on Android quit immediately.
+            try:
+                self._proc.stdin.write('QUIT\n')
+            except IOError:
+                # The pipe has already been closed, indicating abnormal
+                # situation occurred. Wait a while to allow the device to
+                # recover. *fingers crossed*
+                time.sleep(1)
+        chromium.ChromiumDriver.stop(self)
+
+    def _test_shell_command(self, uri, timeout_ms, checksum):
+        if uri.startswith('file:///'):
+            # Convert the host uri to a device uri. See comment of
+            # DEVICE_LAYOUT_TESTS_DIR for details.
+            # Not overriding Port.filename_to_uri() because we don't want the
+            # links in the html report point to device paths.
+            uri = FILE_TEST_URI_PREFIX + self.uri_to_test(uri)
+        return chromium.ChromiumDriver._test_shell_command(self, uri, timeout_ms, checksum)
+
+    def _write_command_and_read_line(self, input=None):
+        (line, crash) = chromium.ChromiumDriver._write_command_and_read_line(self, input)
+        url_marker = '#URL:'
+        if not crash and line.startswith(url_marker) and line.find(FILE_TEST_URI_PREFIX) == len(url_marker):
+            # Convert the device test uri back to host uri otherwise
+            # chromium.ChromiumDriver.run_test() will complain.
+            line = '#URL:file://%s/%s' % (self._port.layout_tests_dir(), line[len(url_marker) + len(FILE_TEST_URI_PREFIX):])
+        if not crash and self._has_crash_hint(line):
+            crash = True
+        return (line, crash)
+
+    def _output_image(self):
+        if self._image_path:
+            _log.debug('pulling from device: %s to %s' % (self._device_image_path, self._image_path))
+            self._port._pull_from_device(self._device_image_path, self._image_path, ignore_error=True)
+        return chromium.ChromiumDriver._output_image(self)
+
+    def _has_crash_hint(self, line):
+        # When DRT crashes, it sends a signal to Android Debuggerd, like
+        # SIGSEGV, SIGFPE, etc. When Debuggerd receives the signal, it stops DRT
+        # (which causes Shell to output a message), and dumps the stack strace.
+        # We use the Shell output as a crash hint.
+        return line is not None and line.find('[1] + Stopped (signal)') >= 0
diff --git a/Tools/Scripts/webkitpy/layout_tests/port/chromium_android_unittest.py b/Tools/Scripts/webkitpy/layout_tests/port/chromium_android_unittest.py
new file mode 100644
index 000000000..dd652fe02
--- /dev/null
+++ b/Tools/Scripts/webkitpy/layout_tests/port/chromium_android_unittest.py
@@ -0,0 +1,41 @@
+# Copyright (C) 2012 Google Inc. All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions are
+# met:
+#
+#    * Redistributions of source code must retain the above copyright
+# notice, this list of conditions and the following disclaimer.
+#    * Redistributions in binary form must reproduce the above
+# copyright notice, this list of conditions and the following disclaimer
+# in the documentation and/or other materials provided with the
+# distribution.
+#    * Neither the name of Google Inc. nor the names of its
+# contributors may be used to endorse or promote products derived from
+# this software without specific prior written permission.
+#
+# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+# OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+import unittest
+
+from webkitpy.common.system import executive_mock
+from webkitpy.common.system.systemhost_mock import MockSystemHost
+
+from webkitpy.layout_tests.port import chromium_android
+from webkitpy.layout_tests.port import port_testcase
+
+
+class ChromiumAndroidPortTest(port_testcase.PortTestCase):
+    port_name = 'chromium-android'
+    port_maker = chromium_android.ChromiumAndroidPort
+    expected_default_worker_model = 'inline'
diff --git a/Tools/Scripts/webkitpy/layout_tests/port/chromium_unittest.py b/Tools/Scripts/webkitpy/layout_tests/port/chromium_unittest.py
index 6f98e9a3d..ac0779574 100644
--- a/Tools/Scripts/webkitpy/layout_tests/port/chromium_unittest.py
+++ b/Tools/Scripts/webkitpy/layout_tests/port/chromium_unittest.py
@@ -39,6 +39,7 @@ from webkitpy.thirdparty.mock import Mock
 from webkitpy.tool.mocktool import MockOptions
 
 import chromium
+import chromium_android
 import chromium_linux
 import chromium_mac
 import chromium_win
@@ -161,6 +162,10 @@ class ChromiumPortTest(port_testcase.PortTestCase):
         """Validate the complete set of configurations this port knows about."""
         port = self.make_port()
         self.assertEquals(set(port.all_test_configurations()), set([
+            TestConfiguration('icecreamsandwich', 'arm', 'debug', 'cpu'),
+            TestConfiguration('icecreamsandwich', 'arm', 'release', 'cpu'),
+            TestConfiguration('icecreamsandwich', 'arm', 'debug', 'gpu'),
+            TestConfiguration('icecreamsandwich', 'arm', 'release', 'gpu'),
             TestConfiguration('leopard', 'x86', 'debug', 'cpu'),
             TestConfiguration('leopard', 'x86', 'debug', 'gpu'),
             TestConfiguration('leopard', 'x86', 'release', 'cpu'),
@@ -216,6 +221,15 @@ class ChromiumPortTest(port_testcase.PortTestCase):
             self.default_configuration_called = True
             return 'default'
 
+    class TestAndroidPort(chromium_android.ChromiumAndroidPort):
+        def __init__(self, options=None):
+            options = options or MockOptions()
+            chromium_win.ChromiumAndroidPort.__init__(self, MockSystemHost(os_name='android', os_version='icecreamsandwich'), 'chromium-android', options=options)
+
+        def default_configuration(self):
+            self.default_configuration_called = True
+            return 'default'
+
     class TestLinuxPort(chromium_linux.ChromiumLinuxPort):
         def __init__(self, options=None):
             options = options or MockOptions()
diff --git a/Tools/Scripts/webkitpy/layout_tests/port/driver.py b/Tools/Scripts/webkitpy/layout_tests/port/driver.py
index 8a2857a8a..92e6992d7 100644
--- a/Tools/Scripts/webkitpy/layout_tests/port/driver.py
+++ b/Tools/Scripts/webkitpy/layout_tests/port/driver.py
@@ -156,6 +156,9 @@ class Driver(object):
     def has_crashed(self):
         return False
 
+    def start(self):
+        raise NotImplementedError('Driver.start')
+
     def stop(self):
         raise NotImplementedError('Driver.stop')
 
@@ -192,6 +195,9 @@ class DriverProxy(object):
     def has_crashed(self):
         return self._driver.has_crashed() or self._reftest_driver.has_crashed()
 
+    def start(self):
+        self._driver.start()
+
     def stop(self):
         self._driver.stop()
         self._reftest_driver.stop()
diff --git a/Tools/Scripts/webkitpy/layout_tests/port/factory.py b/Tools/Scripts/webkitpy/layout_tests/port/factory.py
index a8a1cd0e8..059186eee 100644
--- a/Tools/Scripts/webkitpy/layout_tests/port/factory.py
+++ b/Tools/Scripts/webkitpy/layout_tests/port/factory.py
@@ -42,6 +42,7 @@ class BuilderOptions(object):
 
 class PortFactory(object):
     PORT_CLASSES = (
+        'chromium_android.ChromiumAndroidPort',
         'chromium_gpu.ChromiumGpuLinuxPort',
         'chromium_gpu.ChromiumGpuMacPort',
         'chromium_gpu.ChromiumGpuWinPort',
@@ -59,7 +60,7 @@ class PortFactory(object):
         'qt.QtPort',
         'test.TestPort',
         'win.WinPort',
-        )
+    )
 
     def __init__(self, host):
         self._host = host
diff --git a/Tools/Scripts/webkitpy/layout_tests/port/mac.py b/Tools/Scripts/webkitpy/layout_tests/port/mac.py
index 202f2de2a..829b896fa 100644
--- a/Tools/Scripts/webkitpy/layout_tests/port/mac.py
+++ b/Tools/Scripts/webkitpy/layout_tests/port/mac.py
@@ -128,7 +128,7 @@ class MacPort(ApplePort):
         return self._build_path('WebCore.framework/Versions/A/WebCore')
 
     def show_results_html_file(self, results_filename):
-        self._run_script('run-safari', ['-NSOpen', results_filename])
+        self._run_script('run-safari', ['--no-saved-state', '-NSOpen', results_filename])
 
     # FIXME: The next two routines turn off the http locking in order
     # to work around failures on the bots caused when the slave restarts.
diff --git a/Tools/Scripts/webkitpy/layout_tests/port/mac_unittest.py b/Tools/Scripts/webkitpy/layout_tests/port/mac_unittest.py
index bdef980bd..35e64e49f 100644
--- a/Tools/Scripts/webkitpy/layout_tests/port/mac_unittest.py
+++ b/Tools/Scripts/webkitpy/layout_tests/port/mac_unittest.py
@@ -161,7 +161,7 @@ java/
         port = self.make_port()
         # Delay setting a should_log executive to avoid logging from MacPort.__init__.
         port._executive = MockExecutive(should_log=True)
-        expected_stderr = "MOCK run_command: ['Tools/Scripts/run-safari', '--release', '-NSOpen', 'test.html'], cwd=/mock-checkout\n"
+        expected_stderr = "MOCK run_command: ['Tools/Scripts/run-safari', '--release', '--no-saved-state', '-NSOpen', 'test.html'], cwd=/mock-checkout\n"
         OutputCapture().assert_outputs(self, port.show_results_html_file, ["test.html"], expected_stderr=expected_stderr)
 
     def test_operating_system(self):
diff --git a/Tools/Scripts/webkitpy/layout_tests/port/mock_drt.py b/Tools/Scripts/webkitpy/layout_tests/port/mock_drt.py
index e56e27b1a..cbb6bb6ce 100644
--- a/Tools/Scripts/webkitpy/layout_tests/port/mock_drt.py
+++ b/Tools/Scripts/webkitpy/layout_tests/port/mock_drt.py
@@ -65,10 +65,6 @@ class MockDRTPort(object):
 
     def __init__(self, host, port_name, **kwargs):
         self.__delegate = PortFactory(host).get(port_name.replace('mock-', ''), **kwargs)
-        self.__real_name = port_name
-
-    def real_name(self):
-        return self.__real_name
 
     def __getattr__(self, name):
         return getattr(self.__delegate, name)
diff --git a/Tools/Scripts/webkitpy/layout_tests/port/mock_drt_unittest.py b/Tools/Scripts/webkitpy/layout_tests/port/mock_drt_unittest.py
index ed88e8b7c..0b85579f6 100755
--- a/Tools/Scripts/webkitpy/layout_tests/port/mock_drt_unittest.py
+++ b/Tools/Scripts/webkitpy/layout_tests/port/mock_drt_unittest.py
@@ -183,17 +183,14 @@ class MockDRTTest(unittest.TestCase):
         self.assertTest('http/tests/passes/text.html', True)
 
     def test_pixeltest__fails(self):
-        self.assertTest('failures/expected/checksum.html', pixel_tests=True,
-            expected_checksum='wrong-checksum',
+        self.assertTest('failures/expected/image_checksum.html', pixel_tests=True,
+            expected_checksum='image_checksum-checksum',
             drt_output=['Content-Type: text/plain\n',
-                        'checksum-txt',
+                        'image_checksum-txt',
                         '#EOF\n',
                         '\n',
-                        'ActualHash: checksum-checksum\n',
-                        'ExpectedHash: wrong-checksum\n',
-                        'Content-Type: image/png\n',
-                        'Content-Length: 43\n',
-                        'checksum\x8a-pngtEXtchecksum\x00checksum-checksum',
+                        'ActualHash: image_checksum-checksum\n',
+                        'ExpectedHash: image_checksum-checksum\n',
                         '#EOF\n'])
 
     def test_textonly(self):
@@ -245,17 +242,17 @@ class MockChromiumDRTTest(MockDRTTest):
         if sys.platform == 'win32':
             host = MockSystemHost(os_name='win', os_version='xp')
             url = '#URL:file:///'
-        url = url + '%s/failures/expected/checksum.html' % PortFactory(host).get('test').layout_tests_dir()
-        self.assertTest('failures/expected/checksum.html', pixel_tests=True,
-            expected_checksum='wrong-checksum',
+        url = url + '%s/failures/expected/image_checksum.html' % PortFactory(host).get('test').layout_tests_dir()
+        self.assertTest('failures/expected/image_checksum.html', pixel_tests=True,
+            expected_checksum='image_checksum',
             drt_output=[url + '\n',
-                        '#MD5:checksum-checksum\n',
-                        'checksum-txt',
+                        '#MD5:image_checksum-checksum\n',
+                        'image_checksum-txt',
                         '\n',
                         '#EOF\n'],
             host=host)
         self.assertEquals(host.filesystem.written_files,
-            {'/tmp/png_result0.png': 'checksum\x8a-pngtEXtchecksum\x00checksum-checksum'})
+            {'/tmp/png_result0.png': 'image_checksum\x8a-pngtEXtchecksum\x00image_checksum-checksum'})
 
     def test_chromium_parse_options(self):
         options, args = mock_drt.parse_options(['--platform', 'chromium-mac',
diff --git a/Tools/Scripts/webkitpy/layout_tests/port/port_testcase.py b/Tools/Scripts/webkitpy/layout_tests/port/port_testcase.py
index 8df039ca2..02d6f23dc 100755
--- a/Tools/Scripts/webkitpy/layout_tests/port/port_testcase.py
+++ b/Tools/Scripts/webkitpy/layout_tests/port/port_testcase.py
@@ -34,11 +34,13 @@ import sys
 import time
 import unittest
 
-from webkitpy.layout_tests.servers import http_server_base
 from webkitpy.common.system.filesystem_mock import MockFileSystem
-from webkitpy.tool.mocktool import MockOptions
 from webkitpy.common.system.executive_mock import MockExecutive
 from webkitpy.common.system.systemhost_mock import MockSystemHost
+from webkitpy.layout_tests.servers import http_server_base
+from webkitpy.layout_tests.servers import http_server_base
+from webkitpy.layout_tests.port import factory
+from webkitpy.tool.mocktool import MockOptions
 
 
 class PortTestCase(unittest.TestCase):
@@ -50,6 +52,7 @@ class PortTestCase(unittest.TestCase):
     os_name = None
     os_version = None
     port_maker = None
+    expected_default_worker_model = 'processes'
 
     def make_port(self, host=None, port_name=None, options=None, os_name=None, os_version=None, **kwargs):
         host = host or MockSystemHost(os_name=(os_name or self.os_name), os_version=(os_version or self.os_version))
@@ -60,7 +63,7 @@ class PortTestCase(unittest.TestCase):
 
     def test_default_worker_model(self):
         port = self.make_port()
-        self.assertEqual(port.default_worker_model(), 'processes')
+        self.assertEqual(port.default_worker_model(), self.expected_default_worker_model)
 
     def test_driver_cmd_line(self):
         port = self.make_port()
diff --git a/Tools/Scripts/webkitpy/layout_tests/port/qt.py b/Tools/Scripts/webkitpy/layout_tests/port/qt.py
index 24458768c..5fc60a590 100644
--- a/Tools/Scripts/webkitpy/layout_tests/port/qt.py
+++ b/Tools/Scripts/webkitpy/layout_tests/port/qt.py
@@ -31,6 +31,7 @@
 import logging
 import re
 import sys
+import os
 
 import webkit
 
@@ -46,6 +47,9 @@ class QtPort(WebKitPort):
     ALL_VERSIONS = ['linux', 'win', 'mac']
     port_name = "qt"
 
+    def _wk2_port_name(self):
+        return "qt-5.0-wk2"
+
     def _port_flag_for_scripts(self):
         return "--qt"
 
@@ -122,10 +126,10 @@ class QtPort(WebKitPort):
             search_paths.add('qt-4.8')
         elif version:
             search_paths.add('qt-5.0')
-        if self.get_option('webkit_test_runner'):
-            search_paths.update(['qt-wk2', 'wk2'])
-        else:
-            search_paths.add('qt-wk1')
+            if self.get_option('webkit_test_runner'):
+                search_paths.update(['qt-5.0-wk2', 'wk2'])
+            else:
+                search_paths.add('qt-5.0-wk1')
         return search_paths
 
     def _runtime_feature_list(self):
@@ -148,3 +152,12 @@ class QtPort(WebKitPort):
 
     def operating_system(self):
         return self._operating_system
+
+    def check_sys_deps(self, needs_http):
+        result = super(QtPort, self).check_sys_deps(needs_http)
+        if not 'WEBKIT_TESTFONTS' in os.environ:
+            _log.error('\nThe WEBKIT_TESTFONTS environment variable is not defined or not set properly.')
+            _log.error('You must set it before running the tests.')
+            _log.error('Use git to grab the actual fonts from http://gitorious.org/qtwebkit/testfonts')
+            return False
+        return result
diff --git a/Tools/Scripts/webkitpy/layout_tests/port/qt_unittest.py b/Tools/Scripts/webkitpy/layout_tests/port/qt_unittest.py
index 2aa6ff5e7..2679f33f1 100644
--- a/Tools/Scripts/webkitpy/layout_tests/port/qt_unittest.py
+++ b/Tools/Scripts/webkitpy/layout_tests/port/qt_unittest.py
@@ -27,6 +27,7 @@
 # OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
 import unittest
+import os
 
 from webkitpy.common.system.executive_mock import MockExecutive, MockExecutive2
 from webkitpy.common.system.outputcapture import OutputCapture
@@ -67,9 +68,9 @@ class QtPortTest(port_testcase.PortTestCase):
         self._assert_search_path(['qt-win', 'qt-4.8', 'qt'], 'win')
         self._assert_search_path(['qt-linux', 'qt-4.8', 'qt'], 'linux')
 
-        self._assert_search_path(['qt-wk2', 'qt-mac', 'qt-5.0', 'qt'], 'mac', use_webkit2=True, qt_version='5.0')
-        self._assert_search_path(['qt-wk2', 'qt-win', 'qt-5.0', 'qt'], 'win', use_webkit2=True, qt_version='5.0')
-        self._assert_search_path(['qt-wk2', 'qt-linux', 'qt-5.0', 'qt'], 'linux', use_webkit2=True, qt_version='5.0')
+        self._assert_search_path(['qt-5.0-wk2', 'qt-mac', 'qt-5.0', 'qt'], 'mac', use_webkit2=True, qt_version='5.0')
+        self._assert_search_path(['qt-5.0-wk2', 'qt-win', 'qt-5.0', 'qt'], 'win', use_webkit2=True, qt_version='5.0')
+        self._assert_search_path(['qt-5.0-wk2', 'qt-linux', 'qt-5.0', 'qt'], 'linux', use_webkit2=True, qt_version='5.0')
 
     def test_show_results_html_file(self):
         port = self.make_port()
@@ -86,3 +87,17 @@ class QtPortTest(port_testcase.PortTestCase):
         self.assertEqual('linux', self.make_port(port_name='qt-linux', os_name='linux').operating_system())
         self.assertEqual('mac', self.make_port(os_name='mac').operating_system())
         self.assertEqual('win', self.make_port(port_name='qt-win', os_name='win').operating_system())
+
+    def test_check_sys_deps(self):
+        port = self.make_port()
+
+        # Success
+        os.environ['WEBKIT_TESTFONTS'] = '/tmp/foo'
+        port._executive = MockExecutive2(exit_code=0)
+        self.assertTrue(port.check_sys_deps(needs_http=False))
+
+        # Failure
+        del os.environ['WEBKIT_TESTFONTS']
+        port._executive = MockExecutive2(exit_code=1,
+            output='testing output failure')
+        self.assertFalse(port.check_sys_deps(needs_http=False))
diff --git a/Tools/Scripts/webkitpy/layout_tests/port/server_process.py b/Tools/Scripts/webkitpy/layout_tests/port/server_process.py
index 2b497d949..6c48fef64 100644
--- a/Tools/Scripts/webkitpy/layout_tests/port/server_process.py
+++ b/Tools/Scripts/webkitpy/layout_tests/port/server_process.py
@@ -260,6 +260,10 @@ class ServerProcess:
 
             self._wait_for_data_and_update_buffers(deadline)
 
+    def start(self):
+        if not self._proc:
+            self._start()
+
     def stop(self):
         if not self._proc:
             return
diff --git a/Tools/Scripts/webkitpy/layout_tests/port/test.py b/Tools/Scripts/webkitpy/layout_tests/port/test.py
index 99c7ce921..199460d57 100644
--- a/Tools/Scripts/webkitpy/layout_tests/port/test.py
+++ b/Tools/Scripts/webkitpy/layout_tests/port/test.py
@@ -100,8 +100,6 @@ class TestList(object):
 
 def unit_test_list():
     tests = TestList()
-    tests.add('failures/expected/checksum.html',
-              actual_checksum='checksum_fail-checksum')
     tests.add('failures/expected/crash.html', crash=True)
     tests.add('failures/expected/exception.html', exception=True)
     tests.add('failures/expected/timeout.html', timeout=True)
@@ -135,6 +133,7 @@ def unit_test_list():
     tests.add('failures/expected/newlines_with_excess_CR.html',
               expected_text="foo\r\r\r\n", actual_text="foo\n")
     tests.add('failures/expected/text.html', actual_text='text_fail-png')
+    tests.add('failures/expected/skip_text.html', actual_text='text diff')
     tests.add('failures/unexpected/missing_text.html', expected_text=None)
     tests.add('failures/unexpected/missing_image.html', expected_image=None)
     tests.add('failures/unexpected/missing_render_tree_dump.html', actual_text="""layer at (0,0) size 800x600
@@ -155,6 +154,7 @@ layer at (0,0) size 800x34
               actual_checksum='text-image-checksum_fail-checksum')
     tests.add('failures/unexpected/checksum-with-matching-image.html',
               actual_checksum='text-image-checksum_fail-checksum')
+    tests.add('failures/unexpected/skip_pass.html')
     tests.add('failures/unexpected/timeout.html', timeout=True)
     tests.add('http/tests/passes/text.html')
     tests.add('http/tests/passes/image.html')
@@ -171,6 +171,10 @@ layer at (0,0) size 800x34
               expected_checksum=None,
               expected_image='tEXtchecksum\x00checksum_in_image-checksum')
 
+    # Note that here the checksums don't match but the images do, so this test passes "unexpectedly".
+    # See https://bugs.webkit.org/show_bug.cgi?id=69444 .
+    tests.add('failures/unexpected/checksum.html', actual_checksum='checksum_fail-checksum')
+
     # Text output files contain "\r\n" on Windows.  This may be
     # helpfully filtered to "\r\r\n" by our Python/Cygwin tooling.
     tests.add('passes/text.html',
@@ -237,7 +241,6 @@ def add_unit_tests_to_mock_filesystem(filesystem):
     filesystem.maybe_make_directory(LAYOUT_TEST_DIR + '/platform/test')
     if not filesystem.exists(LAYOUT_TEST_DIR + '/platform/test/test_expectations.txt'):
         filesystem.write_text_file(LAYOUT_TEST_DIR + '/platform/test/test_expectations.txt', """
-WONTFIX : failures/expected/checksum.html = IMAGE
 WONTFIX : failures/expected/crash.html = CRASH
 WONTFIX : failures/expected/image.html = IMAGE
 WONTFIX : failures/expected/audio.html = AUDIO
@@ -368,6 +371,9 @@ class TestPort(Port):
     def default_worker_model(self):
         return 'inline'
 
+    def worker_startup_delay_secs(self):
+        return 0
+
     def check_build(self, needs_http):
         return True
 
@@ -392,6 +398,12 @@ class TestPort(Port):
     def webkit_base(self):
         return '/test.checkout'
 
+    def skipped_tests(self, test_list):
+        # This allows us to test the handling Skipped files, both with a test
+        # that actually passes, and a test that does fail.
+        return set(['failures/expected/skip_text.html',
+                    'failures/unexpected/skip_pass.html'])
+
     def name(self):
         return self._name
 
@@ -428,6 +440,15 @@ class TestPort(Port):
     def release_http_lock(self):
         pass
 
+    def _path_to_lighttpd(self):
+        return "/usr/sbin/lighttpd"
+
+    def _path_to_lighttpd_modules(self):
+        return "/usr/lib/lighttpd"
+
+    def _path_to_lighttpd_php(self):
+        return "/usr/bin/php-cgi"
+
     def path_to_test_expectations_file(self):
         return self._expectations_path
 
@@ -499,5 +520,8 @@ class TestDriver(Driver):
             crashed_process_name=crashed_process_name,
             test_time=time.time() - start_time, timeout=test.timeout, error=test.error)
 
+    def start(self):
+        pass
+
     def stop(self):
         pass
diff --git a/Tools/Scripts/webkitpy/layout_tests/port/webkit.py b/Tools/Scripts/webkitpy/layout_tests/port/webkit.py
index 967e1f1ba..aeb918ce0 100644
--- a/Tools/Scripts/webkitpy/layout_tests/port/webkit.py
+++ b/Tools/Scripts/webkitpy/layout_tests/port/webkit.py
@@ -35,7 +35,6 @@ import base64
 import itertools
 import logging
 import operator
-import os
 import re
 import sys
 import time
@@ -341,7 +340,8 @@ class WebKitPort(Port):
         return []
 
     def _wk2_port_name(self):
-        # By current convention, the WebKit2 name is always mac-wk2, win-wk2, not mac-leopard-wk2, etc.
+        # By current convention, the WebKit2 name is always mac-wk2, win-wk2, not mac-leopard-wk2, etc,
+        # except for Qt because WebKit2 is only supported by Qt 5.0 (therefore: qt-5.0-wk2).
         return "%s-wk2" % self.port_name
 
     def _skipped_file_search_paths(self):
@@ -645,6 +645,10 @@ class WebKitDriver(Driver):
         block.decode_content()
         return block
 
+    def start(self):
+        if not self._server_process:
+            self._start()
+
     def stop(self):
         if self._server_process:
             self._server_process.stop()
diff --git a/Tools/Scripts/webkitpy/layout_tests/port/win.py b/Tools/Scripts/webkitpy/layout_tests/port/win.py
index ab7103ce3..e463b02f4 100644
--- a/Tools/Scripts/webkitpy/layout_tests/port/win.py
+++ b/Tools/Scripts/webkitpy/layout_tests/port/win.py
@@ -45,10 +45,10 @@ class WinPort(ApplePort):
     # and the order of fallback between them.  Matches ORWT.
     VERSION_FALLBACK_ORDER = ["win-xp", "win-vista", "win-7sp0", "win"]
 
-    def compare_text(self, expected_text, actual_text):
+    def do_text_results_differ(self, expected_text, actual_text):
         # Sanity was restored in WK2, so we don't need this hack there.
         if self.get_option('webkit_test_runner'):
-            return ApplePort.compare_text(self, expected_text, actual_text)
+            return ApplePort.do_text_results_differ(self, expected_text, actual_text)
 
         # This is a hack (which dates back to ORWT).
         # Windows does not have an EDITING DELEGATE, so we strip any EDITING DELEGATE
diff --git a/Tools/Scripts/webkitpy/layout_tests/port/win_unittest.py b/Tools/Scripts/webkitpy/layout_tests/port/win_unittest.py
index 760f98d97..fc972a4cd 100644
--- a/Tools/Scripts/webkitpy/layout_tests/port/win_unittest.py
+++ b/Tools/Scripts/webkitpy/layout_tests/port/win_unittest.py
@@ -85,13 +85,13 @@ class WinPortTest(port_testcase.PortTestCase):
     def test_compare_text(self):
         expected = "EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification\nfoo\nEDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification\n"
         port = self.make_port()
-        self.assertFalse(port.compare_text(expected, "foo\n"))
-        self.assertTrue(port.compare_text(expected, "foo"))
-        self.assertTrue(port.compare_text(expected, "bar"))
+        self.assertFalse(port.do_text_results_differ(expected, "foo\n"))
+        self.assertTrue(port.do_text_results_differ(expected, "foo"))
+        self.assertTrue(port.do_text_results_differ(expected, "bar"))
 
         # This hack doesn't exist in WK2.
         port._options = MockOptions(webkit_test_runner=True)
-        self.assertTrue(port.compare_text(expected, "foo\n"))
+        self.assertTrue(port.do_text_results_differ(expected, "foo\n"))
 
     def test_operating_system(self):
         self.assertEqual('win', self.make_port().operating_system())
diff --git a/Tools/Scripts/webkitpy/layout_tests/run_webkit_tests.py b/Tools/Scripts/webkitpy/layout_tests/run_webkit_tests.py
index 96508caf7..6b38a3a71 100755
--- a/Tools/Scripts/webkitpy/layout_tests/run_webkit_tests.py
+++ b/Tools/Scripts/webkitpy/layout_tests/run_webkit_tests.py
@@ -199,10 +199,12 @@ def parse_args(args=None):
 
     Returns a tuple of options, args from optparse"""
 
+    option_group_definitions = []
+
     # FIXME: All of these options should be stored closer to the code which
     # FIXME: actually uses them. configuration_options should move
     # FIXME: to WebKitPort and be shared across all scripts.
-    configuration_options = [
+    option_group_definitions.append(("Configuration Options", [
         optparse.make_option("-t", "--target", dest="configuration",
                              help="(DEPRECATED)"),
         # FIXME: --help should display which configuration is default.
@@ -218,12 +220,12 @@ def parse_args(args=None):
         optparse.make_option('--efl', action='store_const', const='efl', dest="platform", help='Alias for --platform=efl'),
         optparse.make_option('--gtk', action='store_const', const='gtk', dest="platform", help='Alias for --platform=gtk'),
         optparse.make_option('--qt', action='store_const', const='qt', dest="platform", help='Alias for --platform=qt'),
-    ]
+    ]))
 
-    print_options = printing.print_options()
+    option_group_definitions.append(("Printing Options", printing.print_options()))
 
     # FIXME: These options should move onto the ChromiumPort.
-    chromium_options = [
+    option_group_definitions.append(("Chromium-specific Options", [
         optparse.make_option("--startup-dialog", action="store_true",
             default=False, help="create a dialog on DumpRenderTree startup"),
         optparse.make_option("--gp-fault-error-box", action="store_true",
@@ -267,9 +269,11 @@ def parse_args(args=None):
         optparse.make_option("--per-tile-painting",
             action="store_true",
             help="Use per-tile painting of composited pages"),
-    ]
+        optparse.make_option("--adb-args", type="string",
+            help="Arguments parsed to Android adb, to select device, etc."),
+    ]))
 
-    webkit_options = [
+    option_group_definitions.append(("WebKit Options", [
         optparse.make_option("--gc-between-tests", action="store_true", default=False,
             help="Force garbage collection between each test"),
         optparse.make_option("--complex-text", action="store_true", default=False,
@@ -284,15 +288,15 @@ def parse_args(args=None):
             help="Use WebKitTestRunner rather than DumpRenderTree."),
         optparse.make_option("--root", action="store",
             help="Path to a pre-built root of WebKit (for running tests using a nightly build of WebKit)"),
-    ]
+    ]))
 
-    old_run_webkit_tests_compat = [
+    option_group_definitions.append(("ORWT Compatibility Options", [
         # FIXME: Remove this option once the bots don't refer to it.
         # results.html is smart enough to figure this out itself.
         _compat_shim_option("--use-remote-links-to-tests"),
-    ]
+    ]))
 
-    results_options = [
+    option_group_definitions.append(("Results Options", [
         optparse.make_option("-p", "--pixel-tests", action="store_true",
             dest="pixel_tests", help="Enable pixel-to-pixel PNG comparisons"),
         optparse.make_option("--no-pixel-tests", action="store_false",
@@ -354,9 +358,9 @@ def parse_args(args=None):
         optparse.make_option("--ignore-metrics", action="store_true", dest="ignore_metrics",
             default=False, help="Ignore rendering metrics related information from test "
             "output, only compare the structure of the rendertree."),
-    ]
+    ]))
 
-    test_options = [
+    option_group_definitions.append(("Testing Options", [
         optparse.make_option("--build", dest="build",
             action="store_true", default=True,
             help="Check to ensure the DumpRenderTree build is up-to-date "
@@ -430,16 +434,16 @@ def parse_args(args=None):
             help="Don't re-try any tests that produce unexpected results."),
         optparse.make_option("--max-locked-shards", type="int",
             help="Set the maximum number of locked shards"),
-    ]
+    ]))
 
-    misc_options = [
+    option_group_definitions.append(("Miscellaneous Options", [
         optparse.make_option("--lint-test-files", action="store_true",
         default=False, help=("Makes sure the test files parse for all "
                             "configurations. Does not run any tests.")),
-    ]
+    ]))
 
     # FIXME: Move these into json_results_generator.py
-    results_json_options = [
+    option_group_definitions.append(("Result JSON Options", [
         optparse.make_option("--master-name", help="The name of the buildbot master."),
         optparse.make_option("--builder-name", default="",
             help=("The name of the builder shown on the waterfall running "
@@ -452,19 +456,21 @@ def parse_args(args=None):
         optparse.make_option("--test-results-server", default="",
             help=("If specified, upload results json files to this appengine "
                   "server.")),
-    ]
+    ]))
+
+    option_parser = optparse.OptionParser()
 
-    option_list = (configuration_options + print_options +
-                   chromium_options + webkit_options + results_options + test_options +
-                   misc_options + results_json_options + old_run_webkit_tests_compat)
-    option_parser = optparse.OptionParser(option_list=option_list)
+    for group_name, group_options in option_group_definitions:
+        option_group = optparse.OptionGroup(option_parser, group_name)
+        option_group.add_options(group_options)
+        option_parser.add_option_group(option_group)
 
     return option_parser.parse_args(args)
 
 
 def main():
     options, args = parse_args()
-    if options.platform and options.platform.startswith('test'):
+    if options.platform and 'test' in options.platform:
         # It's a bit lame to import mocks into real code, but this allows the user
         # to run tests against the test platform interactively, which is useful for
         # debugging test failures.
diff --git a/Tools/Scripts/webkitpy/layout_tests/run_webkit_tests_integrationtest.py b/Tools/Scripts/webkitpy/layout_tests/run_webkit_tests_integrationtest.py
index ac9f8bbad..66876cc8c 100755
--- a/Tools/Scripts/webkitpy/layout_tests/run_webkit_tests_integrationtest.py
+++ b/Tools/Scripts/webkitpy/layout_tests/run_webkit_tests_integrationtest.py
@@ -35,6 +35,7 @@ import json
 import logging
 import Queue
 import re
+import StringIO
 import sys
 import thread
 import time
@@ -47,7 +48,6 @@ from webkitpy.common.system import path
 # (bug 63846).
 SHOULD_TEST_PROCESSES = sys.platform not in ('cygwin', 'win32')
 
-from webkitpy.common import array_stream
 from webkitpy.common.system import outputcapture
 from webkitpy.common.system.crashlogs_unittest import make_mock_crash_report_darwin
 from webkitpy.common.host_mock import MockHost
@@ -90,10 +90,10 @@ def passing_run(extra_args=None, port_obj=None, record_results=False, tests_incl
     if not port_obj:
         host = host or MockHost()
         port_obj = host.port_factory.get(port_name=options.platform, options=options)
-    buildbot_output = array_stream.ArrayStream()
-    regular_output = array_stream.ArrayStream()
+    buildbot_output = StringIO.StringIO()
+    regular_output = StringIO.StringIO()
     res = run_webkit_tests.run(port_obj, options, parsed_args, buildbot_output=buildbot_output, regular_output=regular_output)
-    return res == 0 and regular_output.empty() and buildbot_output.empty()
+    return res == 0 and not regular_output.getvalue() and not buildbot_output.getvalue()
 
 
 def logging_run(extra_args=None, port_obj=None, record_results=False, tests_included=False, host=None, new_results=False):
@@ -113,8 +113,8 @@ def run_and_capture(port_obj, options, parsed_args):
     oc = outputcapture.OutputCapture()
     try:
         oc.capture_output()
-        buildbot_output = array_stream.ArrayStream()
-        regular_output = array_stream.ArrayStream()
+        buildbot_output = StringIO.StringIO()
+        regular_output = StringIO.StringIO()
         res = run_webkit_tests.run(port_obj, options, parsed_args,
                                    buildbot_output=buildbot_output,
                                    regular_output=regular_output)
@@ -140,6 +140,9 @@ def get_tests_run(extra_args=None, tests_included=False, flatten_batches=False,
             TestDriver.__init__(self, port, worker_number, pixel_tests=port.get_option('pixel_test'), no_timeout=False)
             self._current_test_batch = None
 
+        def start(self):
+            pass
+
         def stop(self):
             self._current_test_batch = None
 
@@ -175,7 +178,21 @@ def get_tests_run(extra_args=None, tests_included=False, flatten_batches=False,
 unexpected_tests_count = 12
 
 
-class LintTest(unittest.TestCase):
+class StreamTestingMixin(object):
+    def assertContains(self, stream, string):
+        self.assertTrue(string in stream.getvalue())
+
+    def assertContainsLine(self, stream, string):
+        self.assertTrue(string in stream.buflist)
+
+    def assertEmpty(self, stream):
+        self.assertFalse(stream.getvalue())
+
+    def assertNotEmpty(self, stream):
+        self.assertTrue(stream.getvalue())
+
+
+class LintTest(unittest.TestCase, StreamTestingMixin):
     def test_all_configurations(self):
 
         class FakePort(object):
@@ -230,8 +247,8 @@ class LintTest(unittest.TestCase):
     def test_lint_test_files(self):
         res, out, err, user = logging_run(['--lint-test-files'])
         self.assertEqual(res, 0)
-        self.assertTrue(out.empty())
-        self.assertTrue(any(['Lint succeeded' in msg for msg in err.get()]))
+        self.assertEmpty(out)
+        self.assertContains(err, 'Lint succeeded')
 
     def test_lint_test_files__errors(self):
         options, parsed_args = parse_args(['--lint-test-files'])
@@ -241,11 +258,11 @@ class LintTest(unittest.TestCase):
         res, out, err = run_and_capture(port_obj, options, parsed_args)
 
         self.assertEqual(res, -1)
-        self.assertTrue(out.empty())
-        self.assertTrue(any(['Lint failed' in msg for msg in err.get()]))
+        self.assertEmpty(out)
+        self.assertTrue(any(['Lint failed' in msg for msg in err.buflist]))
 
 
-class MainTest(unittest.TestCase):
+class MainTest(unittest.TestCase, StreamTestingMixin):
     def test_accelerated_compositing(self):
         # This just tests that we recognize the command line args
         self.assertTrue(passing_run(['--accelerated-video']))
@@ -268,7 +285,7 @@ class MainTest(unittest.TestCase):
         if SHOULD_TEST_PROCESSES:
             _, _, regular_output, _ = logging_run(
                 ['--print', 'config', '--worker-model', 'processes', '--child-processes', '1'])
-            self.assertTrue(any(['Running 1 ' in line for line in regular_output.get()]))
+            self.assertTrue(any(['Running 1 ' in line for line in regular_output.buflist]))
 
     def test_child_processes_2(self):
         # This test seems to fail on win32.
@@ -277,14 +294,14 @@ class MainTest(unittest.TestCase):
         if SHOULD_TEST_PROCESSES:
             _, _, regular_output, _ = logging_run(
                 ['--print', 'config', '--worker-model', 'processes', '--child-processes', '2'])
-            self.assertTrue(any(['Running 2 ' in line for line in regular_output.get()]))
+            self.assertTrue(any(['Running 2 ' in line for line in regular_output.buflist]))
 
     def test_child_processes_min(self):
         if SHOULD_TEST_PROCESSES:
             _, _, regular_output, _ = logging_run(
                 ['--print', 'config', '--worker-model', 'processes', '--child-processes', '2', 'passes'],
                 tests_included=True)
-            self.assertTrue(any(['Running 1 ' in line for line in regular_output.get()]))
+            self.assertTrue(any(['Running 1 ' in line for line in regular_output.buflist]))
 
     def test_dryrun(self):
         batch_tests_run = get_tests_run(['--dry-run'])
@@ -319,16 +336,16 @@ class MainTest(unittest.TestCase):
     def test_help_printing(self):
         res, out, err, user = logging_run(['--help-printing'])
         self.assertEqual(res, 0)
-        self.assertTrue(out.empty())
-        self.assertFalse(err.empty())
+        self.assertEmpty(out)
+        self.assertNotEmpty(err)
 
     def test_hung_thread(self):
         res, out, err, user = logging_run(['--run-singly', '--time-out-ms=50',
                                           'failures/expected/hang.html'],
                                           tests_included=True)
         self.assertEqual(res, 0)
-        self.assertFalse(out.empty())
-        self.assertFalse(err.empty())
+        self.assertNotEmpty(out)
+        self.assertNotEmpty(err)
 
     def test_keyboard_interrupt(self):
         # Note that this also tests running a test marked as SKIP if
@@ -344,14 +361,14 @@ class MainTest(unittest.TestCase):
     def test_no_tests_found(self):
         res, out, err, user = logging_run(['resources'], tests_included=True)
         self.assertEqual(res, -1)
-        self.assertTrue(out.empty())
-        self.assertTrue('No tests to run.\n' in err.get())
+        self.assertEmpty(out)
+        self.assertContainsLine(err, 'No tests to run.\n')
 
     def test_no_tests_found_2(self):
         res, out, err, user = logging_run(['foo'], tests_included=True)
         self.assertEqual(res, -1)
-        self.assertTrue(out.empty())
-        self.assertTrue('No tests to run.\n' in err.get())
+        self.assertEmpty(out)
+        self.assertContainsLine(err, 'No tests to run.\n')
 
     def test_randomize_order(self):
         # FIXME: verify order was shuffled
@@ -390,8 +407,8 @@ class MainTest(unittest.TestCase):
                                         '--print', 'everything',
                                         'passes/text.html', 'failures/expected/text.html'],
                                        tests_included=True, host=host, record_results=True)
-        self.assertTrue("=> Results: 8/16 tests passed (50.0%)\n" in out.get())
-        self.assertTrue(err.get()[-2] == "All 16 tests ran as expected.\n")
+        self.assertContainsLine(out, "=> Results: 8/16 tests passed (50.0%)\n")
+        self.assertContainsLine(err, "All 16 tests ran as expected.\n")
 
     def test_run_chunk(self):
         # Test that we actually select the right chunk
@@ -472,7 +489,7 @@ class MainTest(unittest.TestCase):
         res, out, err, user = logging_run(['--test-list=%s' % filename],
                                           tests_included=True, host=host)
         self.assertEqual(res, -1)
-        self.assertFalse(err.empty())
+        self.assertNotEmpty(err)
 
     def test_test_list_with_prefix(self):
         host = MockHost()
@@ -487,8 +504,8 @@ class MainTest(unittest.TestCase):
         res, out, err, user = logging_run(tests_included=True)
 
         self.assertEqual(res, unexpected_tests_count)
-        self.assertFalse(out.empty())
-        self.assertFalse(err.empty())
+        self.assertNotEmpty(out)
+        self.assertNotEmpty(err)
         self.assertEqual(user.opened_urls, [path.abspath_to_uri('/tmp/layout-test-results/results.html')])
 
     def test_missing_and_unexpected_results(self):
@@ -738,7 +755,7 @@ class MainTest(unittest.TestCase):
         res, out, err, user = logging_run(['--worker-model', 'inline',
                                            '--child-processes', '2'])
         self.assertEqual(res, 0)
-        self.assertTrue('--worker-model=inline overrides --child-processes\n' in err.get())
+        self.assertContainsLine(err, '--worker-model=inline overrides --child-processes\n')
 
     def test_worker_model__processes(self):
         if SHOULD_TEST_PROCESSES:
@@ -792,7 +809,7 @@ class MainTest(unittest.TestCase):
         self.assertTrue(passing_run(['--additional-platform-directory', '/tmp/foo', '--additional-platform-directory', '/tmp/bar']))
 
         res, buildbot_output, regular_output, user = logging_run(['--additional-platform-directory', 'foo'])
-        self.assertTrue('--additional-platform-directory=foo is ignored since it is not absolute\n' in regular_output.get())
+        self.assertContainsLine(regular_output, '--additional-platform-directory=foo is ignored since it is not absolute\n')
 
     def test_no_http_and_force(self):
         # See test_run_force, using --force raises an exception.
@@ -858,14 +875,14 @@ class EndToEndTest(unittest.TestCase):
             {"expected": "PASS", "ref_file": "reftests/foo/matching-ref.html", "actual": "IMAGE", "is_mismatch_reftest": True})
 
 
-class RebaselineTest(unittest.TestCase):
+class RebaselineTest(unittest.TestCase, StreamTestingMixin):
     def assertBaselines(self, file_list, file, extensions, err):
         "assert that the file_list contains the baselines."""
         for ext in extensions:
             baseline = file + "-expected" + ext
             baseline_msg = 'Writing new expected result "%s"\n' % baseline[1:]
             self.assertTrue(any(f.find(baseline) != -1 for f in file_list))
-            self.assertTrue(baseline_msg in err.get())
+            self.assertContainsLine(err, baseline_msg)
 
     # FIXME: Add tests to ensure that we're *not* writing baselines when we're not
     # supposed to be.
@@ -882,7 +899,7 @@ class RebaselineTest(unittest.TestCase):
         file_list = host.filesystem.written_files.keys()
         file_list.remove('/tmp/layout-test-results/tests_run0.txt')
         self.assertEquals(res, 0)
-        self.assertTrue(out.empty())
+        self.assertEmpty(out)
         self.assertEqual(len(file_list), 4)
         self.assertBaselines(file_list, "/passes/image", [".txt", ".png"], err)
         self.assertBaselines(file_list, "/failures/expected/missing_image", [".txt", ".png"], err)
@@ -900,7 +917,7 @@ class RebaselineTest(unittest.TestCase):
         file_list = host.filesystem.written_files.keys()
         file_list.remove('/tmp/layout-test-results/tests_run0.txt')
         self.assertEquals(res, 0)
-        self.assertFalse(out.empty())
+        self.assertNotEmpty(out)
         self.assertEqual(len(file_list), 6)
         self.assertBaselines(file_list, "/failures/unexpected/missing_text", [".txt"], err)
         self.assertBaselines(file_list, "/platform/test-mac-leopard/failures/unexpected/missing_image", [".png"], err)
@@ -918,7 +935,7 @@ class RebaselineTest(unittest.TestCase):
         file_list = host.filesystem.written_files.keys()
         file_list.remove('/tmp/layout-test-results/tests_run0.txt')
         self.assertEquals(res, 0)
-        self.assertTrue(out.empty())
+        self.assertEmpty(out)
         self.assertEqual(len(file_list), 4)
         self.assertBaselines(file_list,
             "/platform/test-mac-leopard/passes/image", [".txt", ".png"], err)
diff --git a/Tools/Scripts/webkitpy/layout_tests/servers/apache_http_server.py b/Tools/Scripts/webkitpy/layout_tests/servers/apache_http_server.py
index 4ea2c4892..a09aa3345 100644
--- a/Tools/Scripts/webkitpy/layout_tests/servers/apache_http_server.py
+++ b/Tools/Scripts/webkitpy/layout_tests/servers/apache_http_server.py
@@ -43,7 +43,7 @@ _log = logging.getLogger(__name__)
 
 class LayoutTestApacheHttpd(http_server_base.HttpServerBase):
 
-    def __init__(self, port_obj, output_dir):
+    def __init__(self, port_obj, output_dir, additional_dirs=None):
         """Args:
           port_obj: handle to the platform-specific routines
           output_dir: the absolute path to the layout test result directory
@@ -57,7 +57,7 @@ class LayoutTestApacheHttpd(http_server_base.HttpServerBase):
                           {'port': 8081},
                           {'port': 8443, 'sslcert': True}]
         self._output_dir = output_dir
-        port_obj.maybe_make_directory(output_dir)
+        self._filesystem.maybe_make_directory(output_dir)
 
         self._pid_file = self._filesystem.join(self._runtime_path, '%s.pid' % self._name)
 
@@ -87,6 +87,14 @@ class LayoutTestApacheHttpd(http_server_base.HttpServerBase):
             '-c', "\'PidFile %s'" % self._pid_file,
             '-k', "start"]
 
+        if additional_dirs:
+            for alias, path in additional_dirs.iteritems():
+                start_cmd += ['-c', "\'Alias %s \"%s\"\'" % (alias, path),
+                        # Disable CGI handler for additional dirs.
+                        '-c', "\'<Location %s>\'" % alias,
+                        '-c', "\'RemoveHandler .cgi .pl\'",
+                        '-c', "\'</Location>\'"]
+
         stop_cmd = [executable,
             '-f', "\"%s\"" % self._get_apache_config_file_path(test_dir, output_dir),
             '-c', "\'PidFile %s'" % self._pid_file,
diff --git a/Tools/Scripts/webkitpy/layout_tests/servers/http_server.py b/Tools/Scripts/webkitpy/layout_tests/servers/http_server.py
index 701e7bd73..1f14e0dad 100755
--- a/Tools/Scripts/webkitpy/layout_tests/servers/http_server.py
+++ b/Tools/Scripts/webkitpy/layout_tests/servers/http_server.py
@@ -43,7 +43,8 @@ _log = logging.getLogger(__name__)
 class Lighttpd(http_server_base.HttpServerBase):
 
     def __init__(self, port_obj, output_dir, background=False, port=None,
-                 root=None, run_background=None, layout_tests_dir=None):
+                 root=None, run_background=None, additional_dirs=None,
+                 layout_tests_dir=None):
         """Args:
           output_dir: the absolute path to the layout test result directory
         """
@@ -54,6 +55,7 @@ class Lighttpd(http_server_base.HttpServerBase):
         self._port = port
         self._root = root
         self._run_background = run_background
+        self._additional_dirs = additional_dirs
         self._layout_tests_dir = layout_tests_dir
 
         self._pid_file = self._filesystem.join(self._runtime_path, '%s.pid' % self._name)
@@ -124,6 +126,10 @@ class Lighttpd(http_server_base.HttpServerBase):
         f.write(('alias.url = ( "/js-test-resources" => "%s" )\n\n') %
                     (self._js_test_resource))
 
+        if self._additional_dirs:
+            for alias, path in self._additional_dirs.iteritems():
+                f.write(('alias.url += ( "%s" => "%s" )\n\n') % (alias, path))
+
         # Setup a link to where the media resources are stored.
         f.write(('alias.url += ( "/media-resources" => "%s" )\n\n') %
                     (self._media_resource))
@@ -189,7 +195,7 @@ class Lighttpd(http_server_base.HttpServerBase):
             try:
                 self._remove_log_files(self._output_dir, log_prefix)
             except OSError, e:
-                _log.warning('Failed to remove old %s %s files' % self._name, log_prefix)
+                _log.warning('Failed to remove old %s %s files' % (self._name, log_prefix))
 
     def _spawn_process(self):
         _log.debug('Starting %s server, cmd="%s"' % (self._name, self._start_cmd))
diff --git a/Tools/Scripts/webkitpy/layout_tests/servers/http_server_base.py b/Tools/Scripts/webkitpy/layout_tests/servers/http_server_base.py
index 8f6c95748..ee5ef06d2 100755
--- a/Tools/Scripts/webkitpy/layout_tests/servers/http_server_base.py
+++ b/Tools/Scripts/webkitpy/layout_tests/servers/http_server_base.py
@@ -65,7 +65,7 @@ class HttpServerBase(object):
             tmpdir = '/tmp'
 
         self._runtime_path = self._filesystem.join(tmpdir, "WebKit")
-        port_obj.maybe_make_directory(self._runtime_path)
+        self._filesystem.maybe_make_directory(self._runtime_path)
 
     def start(self):
         """Starts the server. It is an error to start an already started server.
diff --git a/Tools/Scripts/webkitpy/layout_tests/servers/http_server_unittest.py b/Tools/Scripts/webkitpy/layout_tests/servers/http_server_unittest.py
new file mode 100644
index 000000000..a037a37dd
--- /dev/null
+++ b/Tools/Scripts/webkitpy/layout_tests/servers/http_server_unittest.py
@@ -0,0 +1,59 @@
+# Copyright (C) 2012 Google Inc. All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions are
+# met:
+#
+#     * Redistributions of source code must retain the above copyright
+# notice, this list of conditions and the following disclaimer.
+#     * Redistributions in binary form must reproduce the above
+# copyright notice, this list of conditions and the following disclaimer
+# in the documentation and/or other materials provided with the
+# distribution.
+#     * Neither the name of Google Inc. nor the names of its
+# contributors may be used to endorse or promote products derived from
+# this software without specific prior written permission.
+#
+# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+# OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+import unittest
+import re
+
+from webkitpy.common.host_mock import MockHost
+from webkitpy.layout_tests.port import test
+from webkitpy.layout_tests.servers.http_server import Lighttpd
+from webkitpy.layout_tests.servers.http_server_base import ServerError
+
+
+class TestHttpServer(unittest.TestCase):
+    def test_start_cmd(self):
+        host = MockHost()
+        test_port = test.TestPort(host)
+        host.filesystem.write_text_file(
+            "/mock-checkout/Tools/Scripts/webkitpy/layout_tests/servers/lighttpd.conf", "Mock Config\n")
+        host.filesystem.write_text_file(
+            "/usr/lib/lighttpd/liblightcomp.dylib", "Mock dylib")
+
+        server = Lighttpd(test_port, "/mock/output_dir",
+                          additional_dirs={
+                              "/mock/one-additional-dir": "/mock-checkout/one-additional-dir",
+                              "/mock/another-additional-dir": "/mock-checkout/one-additional-dir"})
+        self.assertRaises(ServerError, server.start)
+
+        config_file = host.filesystem.read_text_file("/mock/output_dir/lighttpd.conf")
+        self.assertEquals(re.findall(r"alias.url.+", config_file), [
+            'alias.url = ( "/js-test-resources" => "/test.checkout/LayoutTests/fast/js/resources" )',
+            'alias.url += ( "/mock/one-additional-dir" => "/mock-checkout/one-additional-dir" )',
+            'alias.url += ( "/mock/another-additional-dir" => "/mock-checkout/one-additional-dir" )',
+            'alias.url += ( "/media-resources" => "/test.checkout/LayoutTests/media" )',
+        ])
diff --git a/Tools/Scripts/webkitpy/layout_tests/views/metered_stream.py b/Tools/Scripts/webkitpy/layout_tests/views/metered_stream.py
index a3c2df441..b5c233b10 100644
--- a/Tools/Scripts/webkitpy/layout_tests/views/metered_stream.py
+++ b/Tools/Scripts/webkitpy/layout_tests/views/metered_stream.py
@@ -67,10 +67,6 @@ class MeteredStream:
         """Write a message that will be overwritten by subsequent update() or write() calls."""
         self._overwrite(txt)
 
-    def flush(self):
-        # This seems to be needed on Python 2.5 for some reason.
-        self._stream.flush()
-
     def _overwrite(self, txt):
         # Print the necessary number of backspaces to erase the previous
         # message.
diff --git a/Tools/Scripts/webkitpy/layout_tests/views/metered_stream_unittest.py b/Tools/Scripts/webkitpy/layout_tests/views/metered_stream_unittest.py
index 7fd0b824b..359cfcf60 100644
--- a/Tools/Scripts/webkitpy/layout_tests/views/metered_stream_unittest.py
+++ b/Tools/Scripts/webkitpy/layout_tests/views/metered_stream_unittest.py
@@ -27,31 +27,31 @@
 # (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 # OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
+import StringIO
 import unittest
 
-from webkitpy.common.array_stream import ArrayStream
 from webkitpy.layout_tests.views.metered_stream import MeteredStream
 
 
 class TestMeteredStream(unittest.TestCase):
     def test_regular(self):
-        a = ArrayStream()
-        m = MeteredStream(stream=a)
-        self.assertTrue(a.empty())
+        a = StringIO.StringIO()
+        m = MeteredStream(a)
+        self.assertFalse(a.getvalue())
 
         # basic test
         m.write("foo")
         exp = ['foo']
-        self.assertEquals(a.get(), exp)
+        self.assertEquals(a.buflist, exp)
 
         # now check that a second write() does not overwrite the first.
         m.write("bar")
         exp.append('bar')
-        self.assertEquals(a.get(), exp)
+        self.assertEquals(a.buflist, exp)
 
         m.update("batter")
         exp.append('batter')
-        self.assertEquals(a.get(), exp)
+        self.assertEquals(a.buflist, exp)
 
         # The next update() should overwrite the laste update() but not the
         # other text. Note that the cursor is effectively positioned at the
@@ -59,22 +59,23 @@ class TestMeteredStream(unittest.TestCase):
         m.update("foo")
         exp.append('\b\b\b\b\b\b      \b\b\b\b\b\b')
         exp.append('foo')
-        self.assertEquals(a.get(), exp)
+        self.assertEquals(a.buflist, exp)
 
         # now check that a write() does overwrite the update
         m.write("foo")
         exp.append('\b\b\b   \b\b\b')
         exp.append('foo')
-        self.assertEquals(a.get(), exp)
+        self.assertEquals(a.buflist, exp)
 
         # Now test that we only back up to the most recent newline.
 
         # Note also that we do not back up to erase the most recent write(),
         # i.e., write()s do not get erased.
-        a.reset()
+        a = StringIO.StringIO()
+        m = MeteredStream(a)
         m.update("foo\nbar")
         m.update("baz")
-        self.assertEquals(a.get(), ['foo\nbar', '\b\b\b   \b\b\b', 'baz'])
+        self.assertEquals(a.buflist, ['foo\nbar', '\b\b\b   \b\b\b', 'baz'])
 
 
 if __name__ == '__main__':
diff --git a/Tools/Scripts/webkitpy/layout_tests/views/printing_unittest.py b/Tools/Scripts/webkitpy/layout_tests/views/printing_unittest.py
index 0916e8ef6..6899d2c5d 100644
--- a/Tools/Scripts/webkitpy/layout_tests/views/printing_unittest.py
+++ b/Tools/Scripts/webkitpy/layout_tests/views/printing_unittest.py
@@ -31,10 +31,10 @@
 
 import logging
 import optparse
+import StringIO
 import time
 import unittest
 
-from webkitpy.common import array_stream
 from webkitpy.common.host_mock import MockHost
 
 from webkitpy.common.system import logtesting
@@ -54,24 +54,33 @@ def get_options(args):
 
 
 class TestUtilityFunctions(unittest.TestCase):
+    def assertEmpty(self, stream):
+        self.assertFalse(stream.getvalue())
+
+    def assertNotEmpty(self, stream):
+        self.assertTrue(stream.getvalue())
+
+    def assertWritten(self, stream, contents):
+        self.assertEquals(stream.buflist, contents)
+
     def test_configure_logging(self):
         options, args = get_options([])
-        stream = array_stream.ArrayStream()
+        stream = StringIO.StringIO()
         handler = printing._configure_logging(stream, options.verbose)
         logging.info("this should be logged")
-        self.assertFalse(stream.empty())
+        self.assertNotEmpty(stream)
 
-        stream.reset()
+        stream = StringIO.StringIO()
         logging.debug("this should not be logged")
-        self.assertTrue(stream.empty())
+        self.assertEmpty(stream)
 
         printing._restore_logging(handler)
 
-        stream.reset()
+        stream = StringIO.StringIO()
         options, args = get_options(['--verbose'])
         handler = printing._configure_logging(stream, options.verbose)
         logging.debug("this should be logged")
-        self.assertFalse(stream.empty())
+        self.assertNotEmpty(stream)
         printing._restore_logging(handler)
 
     def test_print_options(self):
@@ -110,6 +119,19 @@ class TestUtilityFunctions(unittest.TestCase):
 
 
 class  Testprinter(unittest.TestCase):
+    def assertEmpty(self, stream):
+        self.assertFalse(stream.getvalue())
+
+    def assertNotEmpty(self, stream):
+        self.assertTrue(stream.getvalue())
+
+    def assertWritten(self, stream, contents):
+        self.assertEquals(stream.buflist, contents)
+
+    def reset(self, stream):
+        stream.buflist = []
+        stream.buf = ''
+
     def get_printer(self, args=None, tty=False):
         args = args or []
         printing_options = printing.print_options()
@@ -119,8 +141,9 @@ class  Testprinter(unittest.TestCase):
         self._port = host.port_factory.get('test', options)
         nproc = 2
 
-        regular_output = array_stream.ArrayStream(tty=tty)
-        buildbot_output = array_stream.ArrayStream()
+        regular_output = StringIO.StringIO()
+        regular_output.isatty = lambda: tty
+        buildbot_output = StringIO.StringIO()
         printer = printing.Printer(self._port, options, regular_output,
                                    buildbot_output, configure_logging=True)
         return printer, regular_output, buildbot_output
@@ -151,16 +174,16 @@ class  Testprinter(unittest.TestCase):
         # This routine should print something to stdout. testing what it is
         # is kind of pointless.
         printer.help_printing()
-        self.assertFalse(err.empty())
-        self.assertTrue(out.empty())
+        self.assertNotEmpty(err)
+        self.assertEmpty(out)
 
     def do_switch_tests(self, method_name, switch, to_buildbot,
                         message='hello', exp_err=None, exp_bot=None):
         def do_helper(method_name, switch, message, exp_err, exp_bot):
             printer, err, bot = self.get_printer(['--print', switch], tty=True)
             getattr(printer, method_name)(message)
-            self.assertEqual(err.get(), exp_err)
-            self.assertEqual(bot.get(), exp_bot)
+            self.assertEqual(err.buflist, exp_err)
+            self.assertEqual(bot.buflist, exp_bot)
 
         if to_buildbot:
             if exp_err is None:
@@ -211,31 +234,27 @@ class  Testprinter(unittest.TestCase):
     def test_print_one_line_summary(self):
         printer, err, out = self.get_printer(['--print', 'nothing'])
         printer.print_one_line_summary(1, 1, 0)
-        self.assertTrue(err.empty())
+        self.assertEmpty(err)
 
         printer, err, out = self.get_printer(['--print', 'one-line-summary'])
         printer.print_one_line_summary(1, 1, 0)
-        self.assertEquals(err.get(), ["All 1 tests ran as expected.\n", "\n"])
+        self.assertWritten(err, ["All 1 tests ran as expected.\n", "\n"])
 
         printer, err, out = self.get_printer(['--print', 'everything'])
         printer.print_one_line_summary(1, 1, 0)
-        self.assertEquals(err.get(), ["All 1 tests ran as expected.\n", "\n"])
+        self.assertWritten(err, ["All 1 tests ran as expected.\n", "\n"])
 
-        err.reset()
+        printer, err, out = self.get_printer(['--print', 'everything'])
         printer.print_one_line_summary(2, 1, 1)
-        self.assertEquals(err.get(),
-                          ["1 test ran as expected, 1 didn't:\n", "\n"])
+        self.assertWritten(err, ["1 test ran as expected, 1 didn't:\n", "\n"])
 
-        err.reset()
+        printer, err, out = self.get_printer(['--print', 'everything'])
         printer.print_one_line_summary(3, 2, 1)
-        self.assertEquals(err.get(),
-                          ["2 tests ran as expected, 1 didn't:\n", "\n"])
+        self.assertWritten(err, ["2 tests ran as expected, 1 didn't:\n", "\n"])
 
-        err.reset()
+        printer, err, out = self.get_printer(['--print', 'everything'])
         printer.print_one_line_summary(3, 2, 0)
-        self.assertEquals(err.get(),
-                          ['\n', "2 tests ran as expected (1 didn't run).\n",
-                           '\n'])
+        self.assertWritten(err, ['\n', "2 tests ran as expected (1 didn't run).\n", '\n'])
 
 
     def test_print_test_result(self):
@@ -253,55 +272,55 @@ class  Testprinter(unittest.TestCase):
         result = self.get_result('passes/image.html')
         printer.print_test_result(result, expected=False, exp_str='',
                                   got_str='')
-        self.assertTrue(err.empty())
+        self.assertEmpty(err)
 
         printer, err, out = self.get_printer(['--print', 'unexpected'])
         printer.print_test_result(result, expected=True, exp_str='',
                                   got_str='')
-        self.assertTrue(err.empty())
+        self.assertEmpty(err)
         printer.print_test_result(result, expected=False, exp_str='',
                                   got_str='')
-        self.assertEquals(err.get(),
-                          ['  passes/image.html -> unexpected pass\n'])
+        self.assertWritten(err, ['  passes/image.html -> unexpected pass\n'])
 
         printer, err, out = self.get_printer(['--print', 'everything'])
         printer.print_test_result(result, expected=True, exp_str='',
                                   got_str='')
-        self.assertTrue(err.empty())
+        self.assertEmpty(err)
 
         printer.print_test_result(result, expected=False, exp_str='',
                                   got_str='')
-        self.assertEquals(err.get(),
-                          ['  passes/image.html -> unexpected pass\n'])
+        self.assertWritten(err, ['  passes/image.html -> unexpected pass\n'])
 
         printer, err, out = self.get_printer(['--print', 'nothing'])
         printer.print_test_result(result, expected=False, exp_str='',
                                   got_str='')
-        self.assertTrue(err.empty())
+        self.assertEmpty(err)
 
         printer, err, out = self.get_printer(['--print',
                                               'trace-unexpected'])
         printer.print_test_result(result, expected=True, exp_str='',
                                   got_str='')
-        self.assertTrue(err.empty())
+        self.assertEmpty(err)
 
         printer, err, out = self.get_printer(['--print',
                                               'trace-unexpected'])
         printer.print_test_result(result, expected=False, exp_str='',
                                   got_str='')
-        self.assertFalse(err.empty())
+        self.assertNotEmpty(err)
 
         printer, err, out = self.get_printer(['--print',
                                               'trace-unexpected'])
         result = self.get_result("passes/text.html")
         printer.print_test_result(result, expected=False, exp_str='',
                                   got_str='')
-        self.assertFalse(err.empty())
+        self.assertNotEmpty(err)
 
-        err.reset()
+        printer, err, out = self.get_printer(['--print',
+                                              'trace-unexpected'])
+        result = self.get_result("passes/text.html")
         printer.print_test_result(result, expected=False, exp_str='',
                                   got_str='')
-        self.assertFalse(err.empty())
+        self.assertNotEmpty(err)
 
         printer, err, out = self.get_printer(['--print', 'trace-everything'])
         result = self.get_result('passes/image.html')
@@ -316,9 +335,10 @@ class  Testprinter(unittest.TestCase):
         result = self.get_result('failures/expected/missing_image.html')
         printer.print_test_result(result, expected=True, exp_str='',
                                   got_str='')
-        self.assertFalse(err.empty())
+        self.assertNotEmpty(err)
 
-        err.reset()
+        printer, err, out = self.get_printer(['--print', 'trace-everything'])
+        result = self.get_result('passes/image.html')
         printer.print_test_result(result, expected=False, exp_str='',
                                   got_str='')
 
@@ -332,12 +352,12 @@ class  Testprinter(unittest.TestCase):
 
         # First, test that we print nothing.
         printer.print_progress(rs, False, paths)
-        self.assertTrue(out.empty())
-        self.assertTrue(err.empty())
+        self.assertEmpty(out)
+        self.assertEmpty(err)
 
         printer.print_progress(rs, True, paths)
-        self.assertTrue(out.empty())
-        self.assertTrue(err.empty())
+        self.assertEmpty(out)
+        self.assertEmpty(err)
 
         self.times = [1, 2, 12, 13, 14, 23, 33]
 
@@ -352,69 +372,71 @@ class  Testprinter(unittest.TestCase):
             printer, err, out = self.get_printer(['--print', 'one-line-progress'])
             printer.print_progress(rs, False, paths)
             printer.print_progress(rs, False, paths)
-            self.assertTrue(out.empty())
-            self.assertTrue(err.empty())
+            self.assertEmpty(out)
+            self.assertEmpty(err)
 
             printer.print_progress(rs, False, paths)
-            self.assertTrue(out.empty())
-            self.assertFalse(err.empty())
+            self.assertEmpty(out)
+            self.assertNotEmpty(err)
 
-            err.reset()
-            out.reset()
+            self.reset(err)
+            self.reset(out)
             printer.print_progress(rs, True, paths)
-            self.assertTrue(out.empty())
-            self.assertTrue(err.empty())
+            self.assertEmpty(out)
+            self.assertEmpty(err)
 
             printer.print_progress(rs, True, paths)
-            self.assertTrue(out.empty())
-            self.assertFalse(err.empty())
+            self.assertEmpty(out)
+            self.assertNotEmpty(err)
 
             # Now reconfigure the printer to test printing to a TTY instead of a file.
             self.times = [1, 1.01, 2, 3]
             printer, err, out = self.get_printer(['--print', 'one-line-progress'], tty=True)
             printer.print_progress(rs, False, paths)
             printer.print_progress(rs, False, paths)
-            self.assertTrue(out.empty())
-            self.assertTrue(err.empty())
+            self.assertEmpty(out)
+            self.assertEmpty(err)
 
             printer.print_progress(rs, False, paths)
-            self.assertTrue(out.empty())
-            self.assertFalse(err.empty())
+            self.assertEmpty(out)
+            self.assertNotEmpty(err)
 
-            err.reset()
-            out.reset()
+            self.reset(err)
+            self.reset(out)
             printer.print_progress(rs, True, paths)
-            self.assertTrue(out.empty())
-            self.assertFalse(err.empty())
+            self.assertEmpty(out)
+            self.assertNotEmpty(err)
         finally:
             time.time = orig_time
 
     def test_write_nothing(self):
         printer, err, out = self.get_printer(['--print', 'nothing'])
         printer.write("foo")
-        self.assertTrue(err.empty())
+        self.assertEmpty(err)
 
     def test_write_misc(self):
         printer, err, out = self.get_printer(['--print', 'misc'])
         printer.write("foo")
-        self.assertFalse(err.empty())
-        err.reset()
+        self.assertNotEmpty(err)
+
+        printer, err, out = self.get_printer(['--print', 'misc'])
         printer.write("foo", "config")
-        self.assertTrue(err.empty())
+        self.assertEmpty(err)
 
     def test_write_everything(self):
         printer, err, out = self.get_printer(['--print', 'everything'])
         printer.write("foo")
-        self.assertFalse(err.empty())
-        err.reset()
+        self.assertNotEmpty(err)
+
+        printer, err, out = self.get_printer(['--print', 'everything'])
         printer.write("foo", "config")
-        self.assertFalse(err.empty())
+        self.assertNotEmpty(err)
 
     def test_write_verbose(self):
         printer, err, out = self.get_printer(['--verbose'])
         printer.write("foo")
-        self.assertTrue(not err.empty() and "foo" in err.get()[0])
-        self.assertTrue(out.empty())
+        self.assertTrue("foo" in err.buflist[0])
+        self.assertEmpty(out)
 
     def test_print_unexpected_results(self):
         # This routine is the only one that prints stuff that the bots
@@ -470,68 +492,60 @@ class  Testprinter(unittest.TestCase):
         printer, err, out = self.get_printer(['--print', 'nothing'])
         ur = get_unexpected_results(expected=False, passing=False, flaky=False)
         printer.print_unexpected_results(ur)
-        self.assertTrue(err.empty())
-        self.assertTrue(out.empty())
+        self.assertEmpty(err)
+        self.assertEmpty(out)
 
         printer, err, out = self.get_printer(['--print', 'unexpected-results'])
 
         # test everything running as expected
         ur = get_unexpected_results(expected=True, passing=False, flaky=False)
         printer.print_unexpected_results(ur)
-        self.assertTrue(err.empty())
-        self.assertTrue(out.empty())
+        self.assertEmpty(err)
+        self.assertEmpty(out)
 
         # test failures
-        err.reset()
-        out.reset()
+        printer, err, out = self.get_printer(['--print', 'unexpected-results'])
         ur = get_unexpected_results(expected=False, passing=False, flaky=False)
         printer.print_unexpected_results(ur)
-        self.assertTrue(err.empty())
-        self.assertFalse(out.empty())
+        self.assertEmpty(err)
+        self.assertNotEmpty(out)
 
         # test unexpected flaky
-        err.reset()
-        out.reset()
+        printer, err, out = self.get_printer(['--print', 'unexpected-results'])
         ur = get_unexpected_results(expected=False, passing=False, flaky=True)
         printer.print_unexpected_results(ur)
-        self.assertTrue(err.empty())
-        self.assertFalse(out.empty())
+        self.assertEmpty(err)
+        self.assertNotEmpty(out)
 
-        err.reset()
-        out.reset()
         printer, err, out = self.get_printer(['--print', 'everything'])
         ur = get_unexpected_results(expected=False, passing=False, flaky=False)
         printer.print_unexpected_results(ur)
-        self.assertTrue(err.empty())
-        self.assertFalse(out.empty())
+        self.assertEmpty(err)
+        self.assertNotEmpty(out)
 
         expectations = """
 BUGX : failures/expected/crash.html = CRASH
 BUGX : failures/expected/timeout.html = TIMEOUT
 """
-        err.reset()
-        out.reset()
+        printer, err, out = self.get_printer(['--print', 'unexpected-results'])
         ur = get_unexpected_results(expected=False, passing=False, flaky=False)
         printer.print_unexpected_results(ur)
-        self.assertTrue(err.empty())
-        self.assertFalse(out.empty())
+        self.assertEmpty(err)
+        self.assertNotEmpty(out)
 
-        err.reset()
-        out.reset()
+        printer, err, out = self.get_printer(['--print', 'unexpected-results'])
         ur = get_unexpected_results(expected=False, passing=True, flaky=False)
         printer.print_unexpected_results(ur)
-        self.assertTrue(err.empty())
-        self.assertFalse(out.empty())
+        self.assertEmpty(err)
+        self.assertNotEmpty(out)
 
         # Test handling of --verbose as well.
-        err.reset()
-        out.reset()
         printer, err, out = self.get_printer(['--verbose'])
         ur = get_unexpected_results(expected=False, passing=False, flaky=False)
         printer.print_unexpected_results(ur)
         # FIXME: debug output from the port and scm objects may or may not go
         # to stderr, so there's no point in testing its contents here.
-        self.assertFalse(out.empty())
+        self.assertNotEmpty(out)
 
     def test_print_unexpected_results_buildbot(self):
         # FIXME: Test that print_unexpected_results() produces the printer the
diff --git a/Tools/Scripts/webkitpy/performance_tests/perftestsrunner.py b/Tools/Scripts/webkitpy/performance_tests/perftestsrunner.py
index d605829a0..189500f6a 100644
--- a/Tools/Scripts/webkitpy/performance_tests/perftestsrunner.py
+++ b/Tools/Scripts/webkitpy/performance_tests/perftestsrunner.py
@@ -79,6 +79,8 @@ class PerfTestsRunner(object):
                 help='Set the configuration to Release'),
             optparse.make_option("--platform",
                 help="Specify port/platform being tested (i.e. chromium-mac)"),
+            optparse.make_option("--chromium",
+                action="store_const", const='chromium', dest='platform', help='Alias for --platform=chromium'),
             optparse.make_option("--builder-name",
                 help=("The name of the builder shown on the waterfall running this script e.g. google-mac-2.")),
             optparse.make_option("--build-number",
@@ -89,6 +91,8 @@ class PerfTestsRunner(object):
                 help="Path to the directory under which build files are kept (should not include configuration)"),
             optparse.make_option("--time-out-ms", default=600 * 1000,
                 help="Set the timeout for each test"),
+            optparse.make_option("--pause-before-testing", dest="pause_before_testing", action="store_true", default=False,
+                help="Pause before running the tests to let user attach a performance monitor."),
             optparse.make_option("--output-json-path",
                 help="Filename of the JSON file that summaries the results"),
             optparse.make_option("--source-json-path",
@@ -215,6 +219,12 @@ class PerfTestsRunner(object):
         for test in tests:
             driver = port.create_driver(worker_number=1, no_timeout=True)
 
+            if self._options.pause_before_testing:
+                driver.start()
+                if not self._host.user.confirm("Ready to run test?"):
+                    driver.stop()
+                    return unexpected
+
             relative_test_path = self._host.filesystem.relpath(test, self._base_path)
             self._printer.write('Running %s (%d of %d)' % (relative_test_path, expected + unexpected + 1, len(tests)))
 
@@ -249,6 +259,7 @@ class PerfTestsRunner(object):
     _lines_to_ignore_in_parser_result = [
         re.compile(r'^Running \d+ times$'),
         re.compile(r'^Ignoring warm-up '),
+        re.compile(r'^Info:'),
         re.compile(r'^\d+(.\d+)?$'),
         # Following are for handle existing test like Dromaeo
         re.compile(re.escape("""main frame - has 1 onunload handler(s)""")),
diff --git a/Tools/Scripts/webkitpy/performance_tests/perftestsrunner_unittest.py b/Tools/Scripts/webkitpy/performance_tests/perftestsrunner_unittest.py
index 5c4aafdab..e194072c3 100755
--- a/Tools/Scripts/webkitpy/performance_tests/perftestsrunner_unittest.py
+++ b/Tools/Scripts/webkitpy/performance_tests/perftestsrunner_unittest.py
@@ -33,7 +33,6 @@ import StringIO
 import json
 import unittest
 
-from webkitpy.common import array_stream
 from webkitpy.common.host_mock import MockHost
 from webkitpy.common.system.filesystem_mock import MockFileSystem
 from webkitpy.common.system.outputcapture import OutputCapture
@@ -44,6 +43,9 @@ from webkitpy.performance_tests.perftestsrunner import PerfTestsRunner
 
 
 class MainTest(unittest.TestCase):
+    def assertWritten(self, stream, contents):
+        self.assertEquals(stream.buflist, contents)
+
     class TestDriver:
         def run_test(self, driver_input):
             text = ''
@@ -101,12 +103,15 @@ max 1120
 """
             return DriverOutput(text, '', '', '', crash=crash, timeout=timeout)
 
+        def start(self):
+            """do nothing"""
+
         def stop(self):
             """do nothing"""
 
     def create_runner(self, buildbot_output=None, args=[], regular_output=None, driver_class=TestDriver):
-        buildbot_output = buildbot_output or array_stream.ArrayStream()
-        regular_output = regular_output or array_stream.ArrayStream()
+        buildbot_output = buildbot_output or StringIO.StringIO()
+        regular_output = regular_output or StringIO.StringIO()
 
         options, parsed_args = PerfTestsRunner._parse_args(args)
         test_port = TestPort(host=MockHost(), options=options)
@@ -142,28 +147,24 @@ max 1120
         self.assertFalse(self.run_test('crash.html'))
 
     def test_run_test_set(self):
-        buildbot_output = array_stream.ArrayStream()
+        buildbot_output = StringIO.StringIO()
         runner = self.create_runner(buildbot_output)
         dirname = runner._base_path + '/inspector/'
         tests = [dirname + 'pass.html', dirname + 'silent.html', dirname + 'failed.html',
             dirname + 'tonguey.html', dirname + 'timeout.html', dirname + 'crash.html']
         unexpected_result_count = runner._run_tests_set(tests, runner._port)
         self.assertEqual(unexpected_result_count, len(tests) - 1)
-        self.assertEqual(len(buildbot_output.get()), 1)
-        self.assertEqual(buildbot_output.get()[0], 'RESULT group_name: test_name= 42 ms\n')
+        self.assertWritten(buildbot_output, ['RESULT group_name: test_name= 42 ms\n'])
 
     def test_run_test_set_kills_drt_per_run(self):
 
         class TestDriverWithStopCount(MainTest.TestDriver):
             stop_count = 0
 
-            def __init__(self):
-                TestDriverWithStopCount.sotp_count = 0
-
             def stop(self):
                 TestDriverWithStopCount.stop_count += 1
 
-        buildbot_output = array_stream.ArrayStream()
+        buildbot_output = StringIO.StringIO()
         runner = self.create_runner(buildbot_output, driver_class=TestDriverWithStopCount)
 
         dirname = runner._base_path + '/inspector/'
@@ -173,28 +174,50 @@ max 1120
         unexpected_result_count = runner._run_tests_set(tests, runner._port)
         self.assertEqual(TestDriverWithStopCount.stop_count, 6)
 
+    def test_run_test_set_kills_drt_per_run(self):
+        class TestDriverWithStartCount(MainTest.TestDriver):
+            start_count = 0
+
+            def start(self):
+                TestDriverWithStartCount.start_count += 1
+
+        buildbot_output = StringIO.StringIO()
+        runner = self.create_runner(buildbot_output, args=["--pause-before-testing"], driver_class=TestDriverWithStartCount)
+
+        dirname = runner._base_path + '/inspector/'
+        tests = [dirname + 'pass.html']
+
+        try:
+            output = OutputCapture()
+            output.capture_output()
+            unexpected_result_count = runner._run_tests_set(tests, runner._port)
+            self.assertEqual(TestDriverWithStartCount.start_count, 1)
+        finally:
+            _, stderr, logs = output.restore_output()
+            self.assertEqual(stderr, "Ready to run test?\n")
+            self.assertEqual(logs, "Running inspector/pass.html (1 of 1)\n\n")
+
     def test_run_test_set_for_parser_tests(self):
-        buildbot_output = array_stream.ArrayStream()
+        buildbot_output = StringIO.StringIO()
         runner = self.create_runner(buildbot_output)
         tests = [runner._base_path + '/Bindings/event-target-wrapper.html', runner._base_path + '/Parser/some-parser.html']
         unexpected_result_count = runner._run_tests_set(tests, runner._port)
         self.assertEqual(unexpected_result_count, 0)
-        self.assertEqual(buildbot_output.get()[0], 'RESULT Bindings: event-target-wrapper= 1489.05 ms\n')
-        self.assertEqual(buildbot_output.get()[1], 'median= 1487.0 ms, stdev= 14.46 ms, min= 1471.0 ms, max= 1510.0 ms\n')
-        self.assertEqual(buildbot_output.get()[2], 'RESULT Parser: some-parser= 1100.0 ms\n')
-        self.assertEqual(buildbot_output.get()[3], 'median= 1101.0 ms, stdev= 11.0 ms, min= 1080.0 ms, max= 1120.0 ms\n')
+        self.assertWritten(buildbot_output, ['RESULT Bindings: event-target-wrapper= 1489.05 ms\n',
+                                             'median= 1487.0 ms, stdev= 14.46 ms, min= 1471.0 ms, max= 1510.0 ms\n',
+                                             'RESULT Parser: some-parser= 1100.0 ms\n',
+                                             'median= 1101.0 ms, stdev= 11.0 ms, min= 1080.0 ms, max= 1120.0 ms\n'])
 
     def test_run_test_set_with_json_output(self):
-        buildbot_output = array_stream.ArrayStream()
+        buildbot_output = StringIO.StringIO()
         runner = self.create_runner(buildbot_output, args=['--output-json-path=/mock-checkout/output.json'])
         runner._host.filesystem.files[runner._base_path + '/inspector/pass.html'] = True
         runner._host.filesystem.files[runner._base_path + '/Bindings/event-target-wrapper.html'] = True
         runner._timestamp = 123456789
         self.assertEqual(runner.run(), 0)
-        self.assertEqual(len(buildbot_output.get()), 3)
-        self.assertEqual(buildbot_output.get()[0], 'RESULT Bindings: event-target-wrapper= 1489.05 ms\n')
-        self.assertEqual(buildbot_output.get()[1], 'median= 1487.0 ms, stdev= 14.46 ms, min= 1471.0 ms, max= 1510.0 ms\n')
-        self.assertEqual(buildbot_output.get()[2], 'RESULT group_name: test_name= 42 ms\n')
+        self.assertWritten(buildbot_output, ['RESULT Bindings: event-target-wrapper= 1489.05 ms\n',
+                                             'median= 1487.0 ms, stdev= 14.46 ms, min= 1471.0 ms, max= 1510.0 ms\n',
+                                             'RESULT group_name: test_name= 42 ms\n'])
 
         self.assertEqual(json.loads(runner._host.filesystem.files['/mock-checkout/output.json']), {
             "timestamp": 123456789, "results":
@@ -203,7 +226,7 @@ max 1120
             "webkit-revision": 5678})
 
     def test_run_test_set_with_json_source(self):
-        buildbot_output = array_stream.ArrayStream()
+        buildbot_output = StringIO.StringIO()
         runner = self.create_runner(buildbot_output, args=['--output-json-path=/mock-checkout/output.json',
             '--source-json-path=/mock-checkout/source.json'])
         runner._host.filesystem.files['/mock-checkout/source.json'] = '{"key": "value"}'
@@ -211,10 +234,9 @@ max 1120
         runner._host.filesystem.files[runner._base_path + '/Bindings/event-target-wrapper.html'] = True
         runner._timestamp = 123456789
         self.assertEqual(runner.run(), 0)
-        self.assertEqual(len(buildbot_output.get()), 3)
-        self.assertEqual(buildbot_output.get()[0], 'RESULT Bindings: event-target-wrapper= 1489.05 ms\n')
-        self.assertEqual(buildbot_output.get()[1], 'median= 1487.0 ms, stdev= 14.46 ms, min= 1471.0 ms, max= 1510.0 ms\n')
-        self.assertEqual(buildbot_output.get()[2], 'RESULT group_name: test_name= 42 ms\n')
+        self.assertWritten(buildbot_output, ['RESULT Bindings: event-target-wrapper= 1489.05 ms\n',
+                                             'median= 1487.0 ms, stdev= 14.46 ms, min= 1471.0 ms, max= 1510.0 ms\n',
+                                             'RESULT group_name: test_name= 42 ms\n'])
 
         self.assertEqual(json.loads(runner._host.filesystem.files['/mock-checkout/output.json']), {
             "timestamp": 123456789, "results":
@@ -224,7 +246,7 @@ max 1120
             "key": "value"})
 
     def test_run_test_set_with_multiple_repositories(self):
-        buildbot_output = array_stream.ArrayStream()
+        buildbot_output = StringIO.StringIO()
         runner = self.create_runner(buildbot_output, args=['--output-json-path=/mock-checkout/output.json'])
         runner._host.filesystem.files[runner._base_path + '/inspector/pass.html'] = True
         runner._timestamp = 123456789
@@ -261,7 +283,7 @@ max 1120
         self.assertEqual(runner.run(), -3)
 
     def test_upload_json(self):
-        regular_output = array_stream.ArrayStream()
+        regular_output = StringIO.StringIO()
         runner = self.create_runner(regular_output=regular_output)
         runner._host.filesystem.files['/mock-checkout/some.json'] = 'some content'
 
diff --git a/Tools/Scripts/webkitpy/style/checker.py b/Tools/Scripts/webkitpy/style/checker.py
index 78235b3fa..f7c82cfea 100644
--- a/Tools/Scripts/webkitpy/style/checker.py
+++ b/Tools/Scripts/webkitpy/style/checker.py
@@ -237,6 +237,10 @@ _PATH_RULES_SPECIFIER = [
       # and __jit_debug_descriptor when integrating with gdb.
       "Source/JavaScriptCore/jit/GDBInterface.cpp"],
      ["-readability/naming"]),
+
+    ([# On some systems the trailing CR is causing parser failure.
+      "Source/JavaScriptCore/parser/Keywords.table"],
+     ["+whitespace/carriage_return"]),
 ]
 
 
@@ -271,6 +275,7 @@ _TEXT_FILE_EXTENSIONS = [
     'pro',
     'rb',
     'sh',
+    'table',
     'txt',
     'wm',
     'xhtml',
diff --git a/Tools/Scripts/webkitpy/style/checker_unittest.py b/Tools/Scripts/webkitpy/style/checker_unittest.py
index bc1441577..60a959faf 100755
--- a/Tools/Scripts/webkitpy/style/checker_unittest.py
+++ b/Tools/Scripts/webkitpy/style/checker_unittest.py
@@ -268,6 +268,9 @@ class GlobalVariablesTest(unittest.TestCase):
         assertNoCheck("Source/JavaScriptCore/jit/GDBInterface.cpp",
                       "readability/naming")
 
+        # Javascript keywords.
+        assertCheck("Source/JavaScriptCore/parser/Keywords.table", "whitespace/carriage_return")
+
     def test_max_reports_per_category(self):
         """Check that _MAX_REPORTS_PER_CATEGORY is valid."""
         all_categories = self._all_categories()
diff --git a/Tools/Scripts/webkitpy/style/checkers/cpp.py b/Tools/Scripts/webkitpy/style/checkers/cpp.py
index 27ffecaa8..f29361766 100644
--- a/Tools/Scripts/webkitpy/style/checkers/cpp.py
+++ b/Tools/Scripts/webkitpy/style/checkers/cpp.py
@@ -2077,6 +2077,29 @@ def check_max_min_macros(clean_lines, line_number, file_state, error):
           % (max_min_macro_lower, max_min_macro_lower, max_min_macro))
 
 
+def check_ctype_functions(clean_lines, line_number, file_state, error):
+    """Looks for use of the standard functions in ctype.h and suggest they be replaced
+       by use of equivilent ones in <wtf/ASCIICType.h>?.
+
+    Args:
+      clean_lines: A CleansedLines instance containing the file.
+      line_number: The number of the line to check.
+      file_state: A _FileState instance which maintains information about
+                  the state of things in the file.
+      error: The function to call with any errors found.
+    """
+
+    line = clean_lines.elided[line_number]  # Get rid of comments and strings.
+
+    ctype_function_search = search(r'\b(?P<ctype_function>(isalnum|isalpha|isascii|isblank|iscntrl|isdigit|isgraph|islower|isprint|ispunct|isspace|isupper|isxdigit|toascii|tolower|toupper))\s*\(', line)
+    if not ctype_function_search:
+        return
+
+    ctype_function = ctype_function_search.group('ctype_function')
+    error(line_number, 'runtime/ctype_function', 4,
+          'Use equivelent function in <wtf/ASCIICType.h> instead of the %s() function.'
+          % (ctype_function))
+
 def check_switch_indentation(clean_lines, line_number, error):
     """Looks for indentation errors inside of switch statements.
 
@@ -2540,6 +2563,7 @@ def check_style(clean_lines, line_number, file_extension, class_state, file_stat
     check_namespace_indentation(clean_lines, line_number, file_extension, file_state, error)
     check_using_std(clean_lines, line_number, file_state, error)
     check_max_min_macros(clean_lines, line_number, file_state, error)
+    check_ctype_functions(clean_lines, line_number, file_state, error)
     check_switch_indentation(clean_lines, line_number, error)
     check_braces(clean_lines, line_number, error)
     check_exit_statement_simplifications(clean_lines, line_number, error)
@@ -2980,6 +3004,11 @@ def check_language(filename, clean_lines, line_number, file_extension, include_s
 
     check_identifier_name_in_declaration(filename, line_number, line, file_state, error)
 
+    # Check that we're not using static_cast<Text*>.
+    if search(r'\bstatic_cast<Text\*>', line):
+        error(line_number, 'readability/check', 4,
+              'Consider using toText helper function in WebCore/dom/Text.h '
+              'instead of static_cast<Text*>')
 
 def check_identifier_name_in_declaration(filename, line_number, line, file_state, error):
     """Checks if identifier names contain any underscores.
@@ -3523,6 +3552,7 @@ class CppChecker(object):
         'runtime/arrays',
         'runtime/bitfields',
         'runtime/casting',
+        'runtime/ctype_function',
         'runtime/explicit',
         'runtime/init',
         'runtime/int',
diff --git a/Tools/Scripts/webkitpy/style/checkers/cpp_unittest.py b/Tools/Scripts/webkitpy/style/checkers/cpp_unittest.py
index 0c5c6041f..044f46b19 100644
--- a/Tools/Scripts/webkitpy/style/checkers/cpp_unittest.py
+++ b/Tools/Scripts/webkitpy/style/checkers/cpp_unittest.py
@@ -759,6 +759,14 @@ class CppStyleTest(CppStyleTestBase):
         self.assert_language_rules_check('foo.cpp', statement, error_message)
         self.assert_language_rules_check('foo.h', statement, error_message)
 
+    # Test for static_cast readability.
+    def test_static_cast_readability(self):
+        self.assert_lint(
+            'Text* x = static_cast<Text*>(foo);',
+            'Consider using toText helper function in WebCore/dom/Text.h '
+            'instead of static_cast<Text*>'
+            '  [readability/check] [4]')
+
     # We cannot test this functionality because of difference of
     # function definitions.  Anyway, we may never enable this.
     #
@@ -775,7 +783,7 @@ class CppStyleTest(CppStyleTestBase):
     #   self.assert_lint('void Method(char* /*x*/);', message)
     #   self.assert_lint('typedef void (*Method)(int32);', message)
     #   self.assert_lint('static void operator delete[](void*) throw();', message)
-    # 
+    #
     #   self.assert_lint('virtual void D(int* p);', '')
     #   self.assert_lint('void operator delete(void* x) throw();', '')
     #   self.assert_lint('void Method(char* x)\n{', '')
@@ -784,7 +792,7 @@ class CppStyleTest(CppStyleTestBase):
     #   self.assert_lint('typedef void (*Method)(int32 x);', '')
     #   self.assert_lint('static void operator delete[](void* x) throw();', '')
     #   self.assert_lint('static void operator delete[](void* /*x*/) throw();', '')
-    # 
+    #
     #   # This one should technically warn, but doesn't because the function
     #   # pointer is confusing.
     #   self.assert_lint('virtual void E(void (*fn)(int* p));', '')
@@ -3064,7 +3072,7 @@ class CheckForFunctionLengthsTest(CppStyleTestBase):
 
     def test_function_length_check_definition_huge_lines(self):
         # 5 is the limit
-        self.assert_function_length_check_definition(self.trigger_lines(10), 5)
+        self.assert_function_length_check_definition(self.trigger_lines(6), 5)
 
     def test_function_length_not_determinable(self):
         # Macro invocation without terminating semicolon.
@@ -4339,6 +4347,13 @@ class WebKitStyleTest(CppStyleTestBase):
             '  [runtime/max_min_macros] [4]',
             'foo.h')
 
+    def test_ctype_fucntion(self):
+        self.assert_lint(
+            'int i = isascii(8);',
+            'Use equivelent function in <wtf/ASCIICType.h> instead of the '
+            'isascii() function.  [runtime/ctype_function] [4]',
+            'foo.cpp')
+
     def test_names(self):
         name_underscore_error_message = " is incorrectly named. Don't use underscores in your identifier names.  [readability/naming] [4]"
         name_tooshort_error_message = " is incorrectly named. Don't use the single letter 'l' as an identifier name.  [readability/naming] [4]"
diff --git a/Tools/Scripts/webkitpy/thirdparty/__init__.py b/Tools/Scripts/webkitpy/thirdparty/__init__.py
index ead89fff0..e7a12e685 100644
--- a/Tools/Scripts/webkitpy/thirdparty/__init__.py
+++ b/Tools/Scripts/webkitpy/thirdparty/__init__.py
@@ -127,8 +127,8 @@ class AutoinstallImportHook(object):
     def _install_pywebsocket(self):
         pywebsocket_dir = self._fs.join(_AUTOINSTALLED_DIR, "pywebsocket")
         installer = AutoInstaller(target_dir=pywebsocket_dir)
-        installer.install(url="http://pywebsocket.googlecode.com/files/mod_pywebsocket-0.7.tar.gz",
-                          url_subpath="pywebsocket-0.7/src/mod_pywebsocket")
+        installer.install(url="http://pywebsocket.googlecode.com/files/mod_pywebsocket-0.7.2.tar.gz",
+                          url_subpath="pywebsocket-0.7.2/src/mod_pywebsocket")
 
     def _install_xmlrunner(self):
         self._install("http://pypi.python.org/packages/source/u/unittest-xml-reporting/unittest-xml-reporting-1.0.3.tar.gz#md5=cebf83281b0753b5d42bad38c91fd4d6",
diff --git a/Tools/Scripts/webkitpy/to_be_moved/rebaseline_chromium_webkit_tests.py b/Tools/Scripts/webkitpy/to_be_moved/rebaseline_chromium_webkit_tests.py
index 2219879f2..27db72022 100644
--- a/Tools/Scripts/webkitpy/to_be_moved/rebaseline_chromium_webkit_tests.py
+++ b/Tools/Scripts/webkitpy/to_be_moved/rebaseline_chromium_webkit_tests.py
@@ -512,7 +512,7 @@ class Rebaseliner(object):
         if is_image:
             return self._port.diff_image(output1, output2)[0]
 
-        return self._port.compare_text(output1, output2)
+        return self._port.do_text_results_differ(output1, output2)
 
     def _delete_baseline(self, filename):
         """Remove the file from repository and delete it from disk.
diff --git a/Tools/Scripts/webkitpy/tool/bot/earlywarningsystemtask.py b/Tools/Scripts/webkitpy/tool/bot/earlywarningsystemtask.py
index 65a71a701..b66cfbc8e 100644
--- a/Tools/Scripts/webkitpy/tool/bot/earlywarningsystemtask.py
+++ b/Tools/Scripts/webkitpy/tool/bot/earlywarningsystemtask.py
@@ -26,13 +26,7 @@
 # (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 # OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
-from webkitpy.tool.bot.patchanalysistask import PatchAnalysisTask, PatchAnalysisTaskDelegate
-
-
-class UnableToApplyPatch(Exception):
-    def __init__(self, patch):
-        Exception.__init__(self)
-        self.patch = patch
+from webkitpy.tool.bot.patchanalysistask import PatchAnalysisTask, PatchAnalysisTaskDelegate, UnableToApplyPatch
 
 
 class EarlyWarningSystemTaskDelegate(PatchAnalysisTaskDelegate):
diff --git a/Tools/Scripts/webkitpy/tool/bot/patchanalysistask.py b/Tools/Scripts/webkitpy/tool/bot/patchanalysistask.py
index 47e23a1c4..bcd3d304b 100644
--- a/Tools/Scripts/webkitpy/tool/bot/patchanalysistask.py
+++ b/Tools/Scripts/webkitpy/tool/bot/patchanalysistask.py
@@ -30,6 +30,12 @@ from webkitpy.common.system.executive import ScriptError
 from webkitpy.common.net.layouttestresults import LayoutTestResults
 
 
+class UnableToApplyPatch(Exception):
+    def __init__(self, patch):
+        Exception.__init__(self)
+        self.patch = patch
+
+
 class PatchAnalysisTaskDelegate(object):
     def parent_command(self):
         raise NotImplementedError("subclasses must implement")
@@ -71,7 +77,6 @@ class PatchAnalysisTask(object):
         self._results_archive_from_patch_test_run = None
         self._results_from_patch_test_run = None
         self._expected_failures = delegate.expected_failures()
-        assert(self._expected_failures)
 
     def _run_command(self, command, success_message, failure_message):
         try:
diff --git a/Tools/Scripts/webkitpy/tool/bot/queueengine.py b/Tools/Scripts/webkitpy/tool/bot/queueengine.py
index 752ef748a..1d7535967 100644
--- a/Tools/Scripts/webkitpy/tool/bot/queueengine.py
+++ b/Tools/Scripts/webkitpy/tool/bot/queueengine.py
@@ -27,9 +27,7 @@
 # (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 # OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
-import os
 import sys
-import time
 import traceback
 
 from datetime import datetime, timedelta
@@ -60,10 +58,6 @@ class QueueEngineDelegate:
     def next_work_item(self):
         raise NotImplementedError, "subclasses must implement"
 
-    def should_proceed_with_work_item(self, work_item):
-        # returns (safe_to_proceed, waiting_message, patch)
-        raise NotImplementedError, "subclasses must implement"
-
     def process_work_item(self, work_item):
         raise NotImplementedError, "subclasses must implement"
 
@@ -100,9 +94,6 @@ class QueueEngine:
                 if not work_item:
                     self._sleep("No work item.")
                     continue
-                if not self._delegate.should_proceed_with_work_item(work_item):
-                    self._sleep("Not proceeding with work item.")
-                    continue
 
                 # FIXME: Work logs should not depend on bug_id specificaly.
                 #        This looks fixed, no?
diff --git a/Tools/Scripts/webkitpy/tool/bot/queueengine_unittest.py b/Tools/Scripts/webkitpy/tool/bot/queueengine_unittest.py
index d860c6c73..f959ee149 100644
--- a/Tools/Scripts/webkitpy/tool/bot/queueengine_unittest.py
+++ b/Tools/Scripts/webkitpy/tool/bot/queueengine_unittest.py
@@ -50,7 +50,6 @@ class LoggingDelegate(QueueEngineDelegate):
         'begin_work_queue',
         'should_continue_work_queue',
         'next_work_item',
-        'should_proceed_with_work_item',
         'work_item_log_path',
         'process_work_item',
         'should_continue_work_queue',
@@ -82,12 +81,6 @@ class LoggingDelegate(QueueEngineDelegate):
         self.record("next_work_item")
         return "work_item"
 
-    def should_proceed_with_work_item(self, work_item):
-        self.record("should_proceed_with_work_item")
-        self._test.assertEquals(work_item, "work_item")
-        fake_patch = {'bug_id': 50000}
-        return (True, "waiting_message", fake_patch)
-
     def process_work_item(self, work_item):
         self.record("process_work_item")
         self._test.assertEquals(work_item, "work_item")
@@ -112,13 +105,6 @@ class RaisingDelegate(LoggingDelegate):
         raise self._exception
 
 
-class NotSafeToProceedDelegate(LoggingDelegate):
-    def should_proceed_with_work_item(self, work_item):
-        self.record("should_proceed_with_work_item")
-        self._test.assertEquals(work_item, "work_item")
-        return False
-
-
 class FastQueueEngine(QueueEngine):
     def __init__(self, delegate):
         QueueEngine.__init__(self, "fast-queue", delegate, threading.Event())
@@ -179,14 +165,6 @@ class QueueEngineTest(unittest.TestCase):
         self._test_terminating_queue(KeyboardInterrupt(), "User terminated queue.")
         self._test_terminating_queue(TerminateQueue(), "TerminateQueue exception received.")
 
-    def test_not_safe_to_proceed(self):
-        delegate = NotSafeToProceedDelegate(self)
-        self._run_engine(delegate, engine=FastQueueEngine(delegate))
-        expected_callbacks = LoggingDelegate.expected_callbacks[:]
-        expected_callbacks.remove('work_item_log_path')
-        expected_callbacks.remove('process_work_item')
-        self.assertEquals(delegate._callbacks, expected_callbacks)
-
     def test_now(self):
         """Make sure there are no typos in the QueueEngine.now() method."""
         engine = QueueEngine("test", None, None)
diff --git a/Tools/Scripts/webkitpy/tool/bot/sheriff_unittest.py b/Tools/Scripts/webkitpy/tool/bot/sheriff_unittest.py
index 690af1ffc..3ff5082f6 100644
--- a/Tools/Scripts/webkitpy/tool/bot/sheriff_unittest.py
+++ b/Tools/Scripts/webkitpy/tool/bot/sheriff_unittest.py
@@ -26,7 +26,6 @@
 # (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 # OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
-import os
 import unittest
 
 from webkitpy.common.net.buildbot import Builder
diff --git a/Tools/Scripts/webkitpy/common/array_stream.py b/Tools/Scripts/webkitpy/tool/bot/stylequeuetask.py
index 7d2c43925..01f7f723f 100644
--- a/Tools/Scripts/webkitpy/common/array_stream.py
+++ b/Tools/Scripts/webkitpy/tool/bot/stylequeuetask.py
@@ -1,5 +1,4 @@
-#!/usr/bin/python
-# Copyright (C) 2010 Google Inc. All rights reserved.
+# Copyright (c) 2012 Google Inc. All rights reserved.
 #
 # Redistribution and use in source and binary forms, with or without
 # modification, are permitted provided that the following conditions are
@@ -27,44 +26,50 @@
 # (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 # OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
-"""Package that private an array-based implementation of a stream."""
+from webkitpy.tool.bot.patchanalysistask import PatchAnalysisTask, PatchAnalysisTaskDelegate, UnableToApplyPatch
 
 
-class ArrayStream(object):
-    """Simple class that implmements a stream interface on top of an array.
+class StyleQueueTaskDelegate(PatchAnalysisTaskDelegate):
+    def parent_command(self):
+        return "style-queue"
 
-    This is used primarily by unit test classes to mock output streams. It
-    performs a similar function to StringIO, but (a) it is write-only, and
-    (b) it can be used to retrieve each individual write(); StringIO 
-    concatenates all of the writes together.
-    """
 
-    def __init__(self, tty=False):
-        self._contents = []
-        self._tty = tty
+class StyleQueueTask(PatchAnalysisTask):
+    def validate(self):
+        self._patch = self._delegate.refetch_patch(self._patch)
+        if self._patch.is_obsolete():
+            return False
+        if self._patch.bug().is_closed():
+            return False
+        if self._patch.review() == "-":
+            return False
+        return True
 
-    def write(self, msg):
-        """Implement stream.write() by appending to the stream's contents."""
-        self._contents.append(msg)
+    def _check_style(self):
+        return self._run_command([
+            "check-style-local",
+            "--non-interactive",
+            "--quiet",
+        ],
+        "Style checked",
+        "Patch did not pass style check")
 
-    def get(self):
-        """Return the contents of a stream (as an array)."""
-        return self._contents
+    def _apply_watch_list(self):
+        return self._run_command([
+            "apply-watchlist-local",
+            self._patch.bug_id(),
+        ],
+        "Watchlist applied",
+        "Unabled to apply watchlist")
 
-    def reset(self):
-        """Empty the stream."""
-        self._contents = []
-
-    def empty(self):
-        """Return whether the stream is empty."""
-        return (len(self._contents) == 0)
-
-    def flush(self):
-        """Flush the stream (a no-op implemented for compatibility)."""
-        pass
-
-    def __repr__(self):
-        return '<ArrayStream: ' + str(self._contents) + '>'
-
-    def isatty(self):
-        return self._tty
+    def run(self):
+        if not self._clean():
+            return False
+        if not self._update():
+            return False
+        if not self._apply():
+            raise UnableToApplyPatch(self._patch)
+        self._apply_watch_list()
+        if not self._check_style():
+            return self.report_failure()
+        return True
diff --git a/Tools/Scripts/webkitpy/tool/commands/download.py b/Tools/Scripts/webkitpy/tool/commands/download.py
index f18bf31a5..611ca9254 100644
--- a/Tools/Scripts/webkitpy/tool/commands/download.py
+++ b/Tools/Scripts/webkitpy/tool/commands/download.py
@@ -27,8 +27,6 @@
 # (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 # OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
-import os
-
 from webkitpy.tool import steps
 
 from webkitpy.common.checkout.changelog import ChangeLog
@@ -130,6 +128,14 @@ class LandCowboy(AbstractSequencedCommand):
         options.check_style_filter = "-changelog"
 
 
+class CheckStyleLocal(AbstractSequencedCommand):
+    name = "check-style-local"
+    help_text = "Run check-webkit-style on the current working directory diff"
+    steps = [
+        steps.CheckStyle,
+    ]
+
+
 class AbstractPatchProcessingCommand(AbstractDeclarativeCommand):
     # Subclasses must implement the methods below.  We don't declare them here
     # because we want to be able to implement them with mix-ins.
diff --git a/Tools/Scripts/webkitpy/tool/commands/earlywarningsystem.py b/Tools/Scripts/webkitpy/tool/commands/earlywarningsystem.py
index cbf4ce6d2..4085e366a 100644
--- a/Tools/Scripts/webkitpy/tool/commands/earlywarningsystem.py
+++ b/Tools/Scripts/webkitpy/tool/commands/earlywarningsystem.py
@@ -26,28 +26,29 @@
 # (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 # OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
+from optparse import make_option
+
 from webkitpy.common.config.committers import CommitterList
-from webkitpy.common.config.ports import WebKitPort
+from webkitpy.common.config.ports import DeprecatedPort
 from webkitpy.common.system.deprecated_logging import error, log
 from webkitpy.common.system.executive import ScriptError
+from webkitpy.tool.bot.earlywarningsystemtask import EarlyWarningSystemTask, EarlyWarningSystemTaskDelegate
 from webkitpy.tool.bot.expectedfailures import ExpectedFailures
 from webkitpy.tool.bot.layouttestresultsreader import LayoutTestResultsReader
+from webkitpy.tool.bot.patchanalysistask import UnableToApplyPatch
 from webkitpy.tool.bot.queueengine import QueueEngine
-from webkitpy.tool.bot.earlywarningsystemtask import EarlyWarningSystemTask, EarlyWarningSystemTaskDelegate, UnableToApplyPatch
 from webkitpy.tool.commands.queues import AbstractReviewQueue
 
 
 class AbstractEarlyWarningSystem(AbstractReviewQueue, EarlyWarningSystemTaskDelegate):
     _build_style = "release"
-    # FIXME: Switch _run_tests from opt-in to opt-out once more bots are ready to run tests.
-    _run_tests = False
+    # FIXME: Switch _default_run_tests from opt-in to opt-out once more bots are ready to run tests.
+    _default_run_tests = False
 
     def __init__(self):
-        AbstractReviewQueue.__init__(self)
-        self.port = WebKitPort.port(self.port_name)
-
-    def should_proceed_with_work_item(self, patch):
-        return True
+        options = [make_option("--run-tests", action="store_true", dest="run_tests", default=self._default_run_tests, help="Run the Layout tests for each patch")]
+        AbstractReviewQueue.__init__(self, options=options)
+        self.port = DeprecatedPort.port(self.port_name)
 
     def begin_work_queue(self):
         # FIXME: This violates abstraction
@@ -73,7 +74,7 @@ class AbstractEarlyWarningSystem(AbstractReviewQueue, EarlyWarningSystemTaskDele
         tool.bugs.set_flag_on_attachment(patch.id(), "commit-queue", "-", message, extra_message_text)
 
     def review_patch(self, patch):
-        task = EarlyWarningSystemTask(self, patch, self._run_tests)
+        task = EarlyWarningSystemTask(self, patch, self._options.run_tests)
         if not task.validate():
             self._did_error(patch, "%s did not process patch." % self.name)
             return False
@@ -179,31 +180,13 @@ class ChromiumLinuxEWS(AbstractChromiumEWS):
     #        a database migration. :(
     name = "chromium-ews"
     port_name = "chromium-xvfb"
-    _run_tests = True
+    _default_run_tests = True
 
 
 class ChromiumWindowsEWS(AbstractChromiumEWS):
     name = "cr-win-ews"
 
 
-# For platforms that we can't run inside a VM (like Mac OS X), we require
-# patches to be uploaded by committers, who are generally trustworthy folk. :)
-class AbstractCommitterOnlyEWS(AbstractEarlyWarningSystem):
-    def process_work_item(self, patch):
-        if not patch.attacher() or not patch.attacher().can_commit:
-            self._did_error(patch, "%s cannot process patches from non-committers :(" % self.name)
-            return False
-        return AbstractEarlyWarningSystem.process_work_item(self, patch)
-
-
-# FIXME: Inheriting from AbstractCommitterOnlyEWS is kinda a hack, but it
-# happens to work because AbstractChromiumEWS and AbstractCommitterOnlyEWS
-# provide disjoint sets of functionality, and Python is otherwise smart
-# enough to handle the diamond inheritance.
-class ChromiumMacEWS(AbstractChromiumEWS, AbstractCommitterOnlyEWS):
-    name = "cr-mac-ews"
-
-
 class MacEWS(AbstractEarlyWarningSystem):
     name = "mac-ews"
     port_name = "mac"
diff --git a/Tools/Scripts/webkitpy/tool/commands/earlywarningsystem_unittest.py b/Tools/Scripts/webkitpy/tool/commands/earlywarningsystem_unittest.py
index afb1db0f7..cb349412c 100644
--- a/Tools/Scripts/webkitpy/tool/commands/earlywarningsystem_unittest.py
+++ b/Tools/Scripts/webkitpy/tool/commands/earlywarningsystem_unittest.py
@@ -26,8 +26,6 @@
 # (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 # OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
-import os
-
 from webkitpy.thirdparty.mock import Mock
 from webkitpy.common.system.outputcapture import OutputCapture
 from webkitpy.tool.bot.queueengine import QueueEngine
@@ -63,31 +61,24 @@ class EarlyWarningSytemTest(QueuesTest):
             "handle_unexpected_error": "Mock error message\n",
             "next_work_item": "",
             "process_work_item": "MOCK: update_status: %(name)s Pass\nMOCK: release_work_item: %(name)s 10000\n" % string_replacemnts,
-            "handle_script_error": "ScriptError error message\n",
+            "handle_script_error": "ScriptError error message\n\nMOCK output\n",
         }
         return expected_stderr
 
     def _test_builder_ews(self, ews):
         ews.bind_to_tool(MockTool())
-        self.assert_queue_outputs(ews, expected_stderr=self._default_expected_stderr(ews))
-
-    def _test_committer_only_ews(self, ews):
-        ews.bind_to_tool(MockTool())
-        expected_stderr = self._default_expected_stderr(ews)
-        string_replacemnts = {"name": ews.name}
-        expected_stderr["process_work_item"] = "MOCK: update_status: %(name)s Error: %(name)s cannot process patches from non-committers :(\nMOCK: release_work_item: %(name)s 10000\n" % string_replacemnts
-        self.assert_queue_outputs(ews, expected_stderr=expected_stderr)
+        options = Mock()
+        options.port = None
+        options.run_tests = ews._default_run_tests
+        self.assert_queue_outputs(ews, expected_stderr=self._default_expected_stderr(ews), options=options)
 
     def _test_testing_ews(self, ews):
         ews.layout_test_results = lambda: None
         ews.bind_to_tool(MockTool())
         expected_stderr = self._default_expected_stderr(ews)
-        expected_stderr["handle_script_error"] = "ScriptError error message\n"
+        expected_stderr["handle_script_error"] = "ScriptError error message\n\nMOCK output\n"
         self.assert_queue_outputs(ews, expected_stderr=expected_stderr)
 
-    def test_committer_only_ewses(self):
-        self._test_committer_only_ews(ChromiumMacEWS())
-
     def test_builder_ewses(self):
         self._test_builder_ews(MacEWS())
         self._test_builder_ews(ChromiumWindowsEWS())
diff --git a/Tools/Scripts/webkitpy/tool/commands/queues.py b/Tools/Scripts/webkitpy/tool/commands/queues.py
index ed851781c..18ee4cb16 100644
--- a/Tools/Scripts/webkitpy/tool/commands/queues.py
+++ b/Tools/Scripts/webkitpy/tool/commands/queues.py
@@ -46,9 +46,11 @@ from webkitpy.tool.bot.botinfo import BotInfo
 from webkitpy.tool.bot.commitqueuetask import CommitQueueTask, CommitQueueTaskDelegate
 from webkitpy.tool.bot.expectedfailures import ExpectedFailures
 from webkitpy.tool.bot.feeders import CommitQueueFeeder, EWSFeeder
+from webkitpy.tool.bot.flakytestreporter import FlakyTestReporter
 from webkitpy.tool.bot.layouttestresultsreader import LayoutTestResultsReader
+from webkitpy.tool.bot.patchanalysistask import UnableToApplyPatch
 from webkitpy.tool.bot.queueengine import QueueEngine, QueueEngineDelegate
-from webkitpy.tool.bot.flakytestreporter import FlakyTestReporter
+from webkitpy.tool.bot.stylequeuetask import StyleQueueTask, StyleQueueTaskDelegate
 from webkitpy.tool.commands.stepsequence import StepSequenceErrorHandler
 from webkitpy.tool.multicommandtool import Command, TryAgain
 
@@ -126,9 +128,6 @@ class AbstractQueue(Command, QueueEngineDelegate):
     def next_work_item(self):
         raise NotImplementedError, "subclasses must implement"
 
-    def should_proceed_with_work_item(self, work_item):
-        raise NotImplementedError, "subclasses must implement"
-
     def process_work_item(self, work_item):
         raise NotImplementedError, "subclasses must implement"
 
@@ -183,9 +182,6 @@ class FeederQueue(AbstractQueue):
         # understands work items.
         return "synthetic-work-item"
 
-    def should_proceed_with_work_item(self, work_item):
-        return True
-
     def process_work_item(self, work_item):
         for feeder in self.feeders:
             feeder.feed()
@@ -273,11 +269,6 @@ class CommitQueue(AbstractPatchQueue, StepSequenceErrorHandler, CommitQueueTaskD
     def next_work_item(self):
         return self._next_patch()
 
-    def should_proceed_with_work_item(self, patch):
-        patch_text = "rollout patch" if patch.is_rollout() else "patch"
-        self._update_status("Processing %s" % patch_text, patch)
-        return True
-
     def process_work_item(self, patch):
         self._cc_watchers(patch.bug_id())
         task = CommitQueueTask(self, patch)
@@ -380,9 +371,6 @@ class AbstractReviewQueue(AbstractPatchQueue, StepSequenceErrorHandler):
     def next_work_item(self):
         return self._next_patch()
 
-    def should_proceed_with_work_item(self, patch):
-        raise NotImplementedError("subclasses must implement")
-
     def process_work_item(self, patch):
         try:
             if not self.review_patch(patch):
@@ -405,38 +393,46 @@ class AbstractReviewQueue(AbstractPatchQueue, StepSequenceErrorHandler):
 
     @classmethod
     def handle_script_error(cls, tool, state, script_error):
-        log(script_error.message_with_output())
+        log(script_error.output)
 
 
-class StyleQueue(AbstractReviewQueue):
+class StyleQueue(AbstractReviewQueue, StyleQueueTaskDelegate):
     name = "style-queue"
+
     def __init__(self):
         AbstractReviewQueue.__init__(self)
 
-    def should_proceed_with_work_item(self, patch):
-        self._update_status("Checking style", patch)
-        return True
-
     def review_patch(self, patch):
+        task = StyleQueueTask(self, patch)
+        if not task.validate():
+            self._did_error(patch, "%s did not process patch." % self.name)
+            return False
         try:
-            # Run the style checks.
-            self.run_webkit_patch(["check-style", "--force-clean", "--non-interactive", "--parent-command=style-queue", patch.id()])
-        finally:
-            # Apply the watch list.
-            try:
-                self.run_webkit_patch(["apply-watchlist-local", patch.bug_id()])
-            except ScriptError, e:
-                # Don't turn the style bot block red due to watchlist errors.
-                pass
-
+            return task.run()
+        except UnableToApplyPatch, e:
+            self._did_error(patch, "%s unable to apply patch." % self.name)
+            return False
+        except ScriptError, e:
+            message = "Attachment %s did not pass %s:\n\n%s\n\nIf any of these errors are false positives, please file a bug against check-webkit-style." % (patch.id(), self.name, e.output)
+            self._tool.bugs.post_comment_to_bug(patch.bug_id(), message, cc=self.watchers)
+            self._did_fail(patch)
+            return False
         return True
 
-    @classmethod
-    def handle_script_error(cls, tool, state, script_error):
-        is_svn_apply = script_error.command_name() == "svn-apply"
-        status_id = cls._update_status_for_script_error(tool, state, script_error, is_error=is_svn_apply)
-        if is_svn_apply:
-            QueueEngine.exit_after_handled_error(script_error)
-        message = "Attachment %s did not pass %s:\n\n%s\n\nIf any of these errors are false positives, please file a bug against check-webkit-style." % (state["patch"].id(), cls.name, script_error.message_with_output(output_limit=3*1024))
-        tool.bugs.post_comment_to_bug(state["patch"].bug_id(), message, cc=cls.watchers)
-        sys.exit(1)
+    # StyleQueueTaskDelegate methods
+
+    def run_command(self, command):
+        self.run_webkit_patch(command)
+
+    def command_passed(self, message, patch):
+        self._update_status(message, patch=patch)
+
+    def command_failed(self, message, script_error, patch):
+        failure_log = self._log_from_script_error_for_upload(script_error)
+        return self._update_status(message, patch=patch, results_file=failure_log)
+
+    def expected_failures(self):
+        return None
+
+    def refetch_patch(self, patch):
+        return self._tool.bugs.fetch_attachment(patch.id())
diff --git a/Tools/Scripts/webkitpy/tool/commands/queues_unittest.py b/Tools/Scripts/webkitpy/tool/commands/queues_unittest.py
index 8f8f19835..f2c60d9eb 100644
--- a/Tools/Scripts/webkitpy/tool/commands/queues_unittest.py
+++ b/Tools/Scripts/webkitpy/tool/commands/queues_unittest.py
@@ -132,7 +132,6 @@ class FeederQueueTest(QueuesTest):
         tool = MockTool(log_executive=True)
         expected_stderr = {
             "begin_work_queue": self._default_begin_work_queue_stderr("feeder-queue"),
-            "should_proceed_with_work_item": "",
             "next_work_item": "",
             "process_work_item": """Warning, attachment 10001 on bug 50000 has invalid committer (non-committer@example.com)
 Warning, attachment 10001 on bug 50000 has invalid committer (non-committer@example.com)
@@ -235,7 +234,6 @@ class CommitQueueTest(QueuesTest):
         tool.filesystem.write_text_file('/mock-results/full_results.json', '')  # Otherwise the commit-queue will hit a KeyError trying to read the results from the MockFileSystem.
         expected_stderr = {
             "begin_work_queue": self._default_begin_work_queue_stderr("commit-queue"),
-            "should_proceed_with_work_item": "MOCK: update_status: commit-queue Processing patch\n",
             "next_work_item": "",
             "process_work_item": """MOCK: update_status: commit-queue Cleaned working directory
 MOCK: update_status: commit-queue Updated working directory
@@ -248,14 +246,13 @@ MOCK: update_status: commit-queue Pass
 MOCK: release_work_item: commit-queue 10000
 """,
             "handle_unexpected_error": "MOCK setting flag 'commit-queue' to '-' on attachment '10000' with comment 'Rejecting attachment 10000 from commit-queue.' and additional comment 'Mock error message'\n",
-            "handle_script_error": "ScriptError error message\n",
+            "handle_script_error": "ScriptError error message\n\nMOCK output\n",
         }
         self.assert_queue_outputs(CommitQueue(), tool=tool, expected_stderr=expected_stderr)
 
     def test_commit_queue_failure(self):
         expected_stderr = {
             "begin_work_queue": self._default_begin_work_queue_stderr("commit-queue"),
-            "should_proceed_with_work_item": "MOCK: update_status: commit-queue Processing patch\n",
             "next_work_item": "",
             "process_work_item": """MOCK: update_status: commit-queue Cleaned working directory
 MOCK: update_status: commit-queue Updated working directory
@@ -266,7 +263,7 @@ MOCK: update_status: commit-queue Fail
 MOCK: release_work_item: commit-queue 10000
 """,
             "handle_unexpected_error": "MOCK setting flag 'commit-queue' to '-' on attachment '10000' with comment 'Rejecting attachment 10000 from commit-queue.' and additional comment 'Mock error message'\n",
-            "handle_script_error": "ScriptError error message\n",
+            "handle_script_error": "ScriptError error message\n\nMOCK output\n",
         }
         queue = CommitQueue()
 
@@ -283,7 +280,6 @@ MOCK: release_work_item: commit-queue 10000
     def test_commit_queue_failure_with_failing_tests(self):
         expected_stderr = {
             "begin_work_queue": self._default_begin_work_queue_stderr("commit-queue"),
-            "should_proceed_with_work_item": "MOCK: update_status: commit-queue Processing patch\n",
             "next_work_item": "",
             "process_work_item": """MOCK: update_status: commit-queue Cleaned working directory
 MOCK: update_status: commit-queue Updated working directory
@@ -296,7 +292,7 @@ MOCK: update_status: commit-queue Fail
 MOCK: release_work_item: commit-queue 10000
 """,
             "handle_unexpected_error": "MOCK setting flag 'commit-queue' to '-' on attachment '10000' with comment 'Rejecting attachment 10000 from commit-queue.' and additional comment 'Mock error message'\n",
-            "handle_script_error": "ScriptError error message\n",
+            "handle_script_error": "ScriptError error message\n\nMOCK output\n",
         }
         queue = CommitQueue()
 
@@ -317,7 +313,6 @@ MOCK: release_work_item: commit-queue 10000
         tool.buildbot.light_tree_on_fire()
         expected_stderr = {
             "begin_work_queue": self._default_begin_work_queue_stderr("commit-queue"),
-            "should_proceed_with_work_item": "MOCK: update_status: commit-queue Processing patch\n",
             "next_work_item": "",
             "process_work_item": """MOCK run_and_throw_if_fail: ['echo', '--status-host=example.com', 'clean'], cwd=/mock-checkout
 MOCK: update_status: commit-queue Cleaned working directory
@@ -337,7 +332,7 @@ MOCK: update_status: commit-queue Pass
 MOCK: release_work_item: commit-queue 10000
 """,
             "handle_unexpected_error": "MOCK setting flag 'commit-queue' to '-' on attachment '10000' with comment 'Rejecting attachment 10000 from commit-queue.' and additional comment 'Mock error message'\n",
-            "handle_script_error": "ScriptError error message\n",
+            "handle_script_error": "ScriptError error message\n\nMOCK output\n",
         }
         self.assert_queue_outputs(CommitQueue(), tool=tool, expected_stderr=expected_stderr)
 
@@ -348,7 +343,6 @@ MOCK: release_work_item: commit-queue 10000
         assert(rollout_patch.is_rollout())
         expected_stderr = {
             "begin_work_queue": self._default_begin_work_queue_stderr("commit-queue"),
-            "should_proceed_with_work_item": "MOCK: update_status: commit-queue Processing rollout patch\n",
             "next_work_item": "",
             "process_work_item": """MOCK run_and_throw_if_fail: ['echo', '--status-host=example.com', 'clean'], cwd=/mock-checkout
 MOCK: update_status: commit-queue Cleaned working directory
@@ -364,7 +358,7 @@ MOCK: update_status: commit-queue Pass
 MOCK: release_work_item: commit-queue 10005
 """,
             "handle_unexpected_error": "MOCK setting flag 'commit-queue' to '-' on attachment '10005' with comment 'Rejecting attachment 10005 from commit-queue.' and additional comment 'Mock error message'\n",
-            "handle_script_error": "ScriptError error message\n",
+            "handle_script_error": "ScriptError error message\n\nMOCK output\n",
         }
         self.assert_queue_outputs(CommitQueue(), tool=tool, work_item=rollout_patch, expected_stderr=expected_stderr)
 
@@ -448,35 +442,44 @@ class StyleQueueTest(QueuesTest):
         expected_stderr = {
             "begin_work_queue": self._default_begin_work_queue_stderr("style-queue"),
             "next_work_item": "",
-            "should_proceed_with_work_item": "MOCK: update_status: style-queue Checking style\n",
-            "process_work_item": """MOCK run_and_throw_if_fail: ['echo', '--status-host=example.com', 'check-style', '--force-clean', '--non-interactive', '--parent-command=style-queue', 10000], cwd=/mock-checkout
+            "process_work_item": """MOCK run_and_throw_if_fail: ['echo', '--status-host=example.com', 'clean'], cwd=/mock-checkout
+MOCK: update_status: style-queue Cleaned working directory
+MOCK run_and_throw_if_fail: ['echo', '--status-host=example.com', 'update'], cwd=/mock-checkout
+MOCK: update_status: style-queue Updated working directory
+MOCK run_and_throw_if_fail: ['echo', '--status-host=example.com', 'apply-attachment', '--no-update', '--non-interactive', 10000], cwd=/mock-checkout
+MOCK: update_status: style-queue Applied patch
 MOCK run_and_throw_if_fail: ['echo', '--status-host=example.com', 'apply-watchlist-local', 50000], cwd=/mock-checkout
-MOCK: update_status: style-queue Fail
-MOCK: release_work_item: style-queue 10000\n""",
+MOCK: update_status: style-queue Watchlist applied
+MOCK run_and_throw_if_fail: ['echo', '--status-host=example.com', 'check-style-local', '--non-interactive', '--quiet'], cwd=/mock-checkout
+MOCK: update_status: style-queue Style checked
+MOCK: update_status: style-queue Pass
+MOCK: release_work_item: style-queue 10000
+""",
             "handle_unexpected_error": "Mock error message\n",
-            "handle_script_error": "MOCK: update_status: style-queue ScriptError error message\nMOCK bug comment: bug_id=50000, cc=[]\n--- Begin comment ---\nAttachment 10000 did not pass style-queue:\n\nScriptError error message\n\nIf any of these errors are false positives, please file a bug against check-webkit-style.\n--- End comment ---\n\n",
-        }
-        expected_exceptions = {
-            "process_work_item": ScriptError,
-            "handle_script_error": SystemExit,
+            "handle_script_error": "MOCK output\n",
         }
         tool = MockTool(log_executive=True, executive_throws_when_run=set(['check-style']))
-        self.assert_queue_outputs(StyleQueue(), expected_stderr=expected_stderr, expected_exceptions=expected_exceptions, tool=tool)
+        self.assert_queue_outputs(StyleQueue(), expected_stderr=expected_stderr, tool=tool)
 
     def test_style_queue_with_watch_list_exception(self):
         expected_stderr = {
             "begin_work_queue": self._default_begin_work_queue_stderr("style-queue"),
             "next_work_item": "",
-            "should_proceed_with_work_item": "MOCK: update_status: style-queue Checking style\n",
-            "process_work_item": """MOCK run_and_throw_if_fail: ['echo', '--status-host=example.com', 'check-style', '--force-clean', '--non-interactive', '--parent-command=style-queue', 10000], cwd=/mock-checkout
+            "process_work_item": """MOCK run_and_throw_if_fail: ['echo', '--status-host=example.com', 'clean'], cwd=/mock-checkout
+MOCK: update_status: style-queue Cleaned working directory
+MOCK run_and_throw_if_fail: ['echo', '--status-host=example.com', 'update'], cwd=/mock-checkout
+MOCK: update_status: style-queue Updated working directory
+MOCK run_and_throw_if_fail: ['echo', '--status-host=example.com', 'apply-attachment', '--no-update', '--non-interactive', 10000], cwd=/mock-checkout
+MOCK: update_status: style-queue Applied patch
 MOCK run_and_throw_if_fail: ['echo', '--status-host=example.com', 'apply-watchlist-local', 50000], cwd=/mock-checkout
+MOCK: update_status: style-queue Unabled to apply watchlist
+MOCK run_and_throw_if_fail: ['echo', '--status-host=example.com', 'check-style-local', '--non-interactive', '--quiet'], cwd=/mock-checkout
+MOCK: update_status: style-queue Style checked
 MOCK: update_status: style-queue Pass
-MOCK: release_work_item: style-queue 10000\n""",
+MOCK: release_work_item: style-queue 10000
+""",
             "handle_unexpected_error": "Mock error message\n",
-            "handle_script_error": "MOCK: update_status: style-queue ScriptError error message\nMOCK bug comment: bug_id=50000, cc=[]\n--- Begin comment ---\nAttachment 10000 did not pass style-queue:\n\nScriptError error message\n\nIf any of these errors are false positives, please file a bug against check-webkit-style.\n--- End comment ---\n\n",
-        }
-        expected_exceptions = {
-            "handle_script_error": SystemExit,
+            "handle_script_error": "MOCK output\n",
         }
         tool = MockTool(log_executive=True, executive_throws_when_run=set(['apply-watchlist-local']))
-        self.assert_queue_outputs(StyleQueue(), expected_stderr=expected_stderr, expected_exceptions=expected_exceptions, tool=tool)
+        self.assert_queue_outputs(StyleQueue(), expected_stderr=expected_stderr, tool=tool)
diff --git a/Tools/Scripts/webkitpy/tool/commands/queuestest.py b/Tools/Scripts/webkitpy/tool/commands/queuestest.py
index cb16b530f..b99302c8d 100644
--- a/Tools/Scripts/webkitpy/tool/commands/queuestest.py
+++ b/Tools/Scripts/webkitpy/tool/commands/queuestest.py
@@ -91,9 +91,8 @@ class QueuesTest(unittest.TestCase):
         self.assert_outputs(queue.begin_work_queue, "begin_work_queue", [], expected_stdout, expected_stderr, expected_exceptions)
         self.assert_outputs(queue.should_continue_work_queue, "should_continue_work_queue", [], expected_stdout, expected_stderr, expected_exceptions)
         self.assert_outputs(queue.next_work_item, "next_work_item", [], expected_stdout, expected_stderr, expected_exceptions)
-        self.assert_outputs(queue.should_proceed_with_work_item, "should_proceed_with_work_item", [work_item], expected_stdout, expected_stderr, expected_exceptions)
         self.assert_outputs(queue.process_work_item, "process_work_item", [work_item], expected_stdout, expected_stderr, expected_exceptions)
         self.assert_outputs(queue.handle_unexpected_error, "handle_unexpected_error", [work_item, "Mock error message"], expected_stdout, expected_stderr, expected_exceptions)
         # Should we have a different function for testing StepSequenceErrorHandlers?
         if isinstance(queue, StepSequenceErrorHandler):
-            self.assert_outputs(queue.handle_script_error, "handle_script_error", [tool, {"patch": self.mock_work_item}, ScriptError(message="ScriptError error message", script_args="MockErrorCommand")], expected_stdout, expected_stderr, expected_exceptions)
+            self.assert_outputs(queue.handle_script_error, "handle_script_error", [tool, {"patch": self.mock_work_item}, ScriptError(message="ScriptError error message", script_args="MockErrorCommand", output="MOCK output")], expected_stdout, expected_stderr, expected_exceptions)
diff --git a/Tools/Scripts/webkitpy/tool/commands/rebaselineserver.py b/Tools/Scripts/webkitpy/tool/commands/rebaselineserver.py
index e7ff86a14..09c6d0bc6 100644
--- a/Tools/Scripts/webkitpy/tool/commands/rebaselineserver.py
+++ b/Tools/Scripts/webkitpy/tool/commands/rebaselineserver.py
@@ -30,9 +30,6 @@
 results directory), provides comparisons of expected and actual results (both
 images and text) and allows one-click rebaselining of tests."""
 
-import os
-import os.path
-
 from webkitpy.common import system
 from webkitpy.common.net.resultsjsonparser import for_each_test, JSONTestResult
 from webkitpy.layout_tests.layout_package import json_results_generator
diff --git a/Tools/Scripts/webkitpy/tool/commands/sheriffbot.py b/Tools/Scripts/webkitpy/tool/commands/sheriffbot.py
index 547309e88..81f435394 100644
--- a/Tools/Scripts/webkitpy/tool/commands/sheriffbot.py
+++ b/Tools/Scripts/webkitpy/tool/commands/sheriffbot.py
@@ -26,10 +26,7 @@
 # (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 # OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
-import os
-
 from webkitpy.common.system.deprecated_logging import log
-from webkitpy.common.config.ports import WebKitPort
 from webkitpy.tool.bot.sheriff import Sheriff
 from webkitpy.tool.bot.sheriffircbot import SheriffIRCBot
 from webkitpy.tool.commands.queues import AbstractQueue
@@ -61,10 +58,6 @@ class SheriffBot(AbstractQueue, StepSequenceErrorHandler):
         self._irc_bot.process_pending_messages()
         return
 
-    def should_proceed_with_work_item(self, failure_map):
-        # Currently, we don't have any reasons not to proceed with work items.
-        return True
-
     def process_work_item(self, failure_map):
         return True
 
diff --git a/Tools/Scripts/webkitpy/tool/commands/sheriffbot_unittest.py b/Tools/Scripts/webkitpy/tool/commands/sheriffbot_unittest.py
index 735ccab69..9aa57b123 100644
--- a/Tools/Scripts/webkitpy/tool/commands/sheriffbot_unittest.py
+++ b/Tools/Scripts/webkitpy/tool/commands/sheriffbot_unittest.py
@@ -26,11 +26,7 @@
 # (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 # OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
-import os
-
 from webkitpy.tool.commands.queuestest import QueuesTest
-from webkitpy.tool.commands.sheriffbot import SheriffBot
-from webkitpy.tool.mocktool import *
 
 
 class SheriffBotTest(QueuesTest):
diff --git a/Tools/Scripts/webkitpy/tool/commands/upload.py b/Tools/Scripts/webkitpy/tool/commands/upload.py
index ff6d22eae..d587e0c97 100644
--- a/Tools/Scripts/webkitpy/tool/commands/upload.py
+++ b/Tools/Scripts/webkitpy/tool/commands/upload.py
@@ -482,6 +482,7 @@ class CreateBug(AbstractDeclarativeCommand):
 
     def prompt_for_bug_title_and_comment(self):
         bug_title = User.prompt("Bug title: ")
+        # FIXME: User should provide a function for doing this multi-line prompt.
         print "Bug comment (hit ^D on blank line to end):"
         lines = sys.stdin.readlines()
         try:
diff --git a/Tools/Scripts/webkitpy/tool/main.py b/Tools/Scripts/webkitpy/tool/main.py
index d6a855bd1..d1fde74b8 100755
--- a/Tools/Scripts/webkitpy/tool/main.py
+++ b/Tools/Scripts/webkitpy/tool/main.py
@@ -33,7 +33,7 @@ from optparse import make_option
 import os
 import threading
 
-from webkitpy.common.config.ports import WebKitPort
+from webkitpy.common.config.ports import DeprecatedPort
 from webkitpy.common.host import Host
 from webkitpy.common.net.irc import ircproxy
 from webkitpy.common.net.statusserver import StatusServer
@@ -61,6 +61,7 @@ class WebKitPatch(MultiCommandTool, Host):
         self._irc = None
         self._deprecated_port = None
 
+    # FIXME: Rename this deprecated_port()
     def port(self):
         return self._deprecated_port
 
@@ -98,7 +99,7 @@ class WebKitPatch(MultiCommandTool, Host):
         if options.irc_password:
             self.irc_password = options.irc_password
         # If options.port is None, we'll get the default port for this platform.
-        self._deprecated_port = WebKitPort.port(options.port)
+        self._deprecated_port = DeprecatedPort.port(options.port)
 
     def should_execute_command(self, command):
         if command.requires_local_commits and not self.scm().supports_local_commits():
diff --git a/Tools/Scripts/webkitpy/tool/servers/rebaselineserver_unittest.py b/Tools/Scripts/webkitpy/tool/servers/rebaselineserver_unittest.py
index ae4a05eb0..c8ea6c02c 100644
--- a/Tools/Scripts/webkitpy/tool/servers/rebaselineserver_unittest.py
+++ b/Tools/Scripts/webkitpy/tool/servers/rebaselineserver_unittest.py
@@ -295,11 +295,9 @@ def get_test_config(test_files=[], result_files=[]):
     results_directory = '/WebKitBuild/Debug/layout-test-results'
     host = MockHost()
     for file in test_files:
-        file_path = host.filesystem.join(layout_tests_directory, file)
-        host.filesystem.files[file_path] = ''
+        host.filesystem.write_binary_file(host.filesystem.join(layout_tests_directory, file), '')
     for file in result_files:
-        file_path = host.filesystem.join(results_directory, file)
-        host.filesystem.files[file_path] = ''
+        host.filesystem.write_binary_file(host.filesystem.join(results_directory, file), '')
 
     class TestMacPort(WebKitPort):
         port_name = "mac"
diff --git a/Tools/Scripts/webkitpy/tool/servers/reflectionhandler.py b/Tools/Scripts/webkitpy/tool/servers/reflectionhandler.py
index 9b73c4efe..6a3f207be 100644
--- a/Tools/Scripts/webkitpy/tool/servers/reflectionhandler.py
+++ b/Tools/Scripts/webkitpy/tool/servers/reflectionhandler.py
@@ -34,7 +34,6 @@ import datetime
 import fnmatch
 import json
 import mimetypes
-import os
 import os.path
 import shutil
 import threading
@@ -43,6 +42,7 @@ import urlparse
 import wsgiref.handlers
 import BaseHTTPServer
 
+
 class ReflectionHandler(BaseHTTPServer.BaseHTTPRequestHandler):
     # Subclasses should override.
     STATIC_FILE_NAMES = None
diff --git a/Tools/Scripts/webkitpy/tool/steps/abstractstep.py b/Tools/Scripts/webkitpy/tool/steps/abstractstep.py
index db0c0d5a8..2a5fea628 100644
--- a/Tools/Scripts/webkitpy/tool/steps/abstractstep.py
+++ b/Tools/Scripts/webkitpy/tool/steps/abstractstep.py
@@ -29,7 +29,6 @@
 import sys
 
 from webkitpy.common.system.executive import ScriptError
-from webkitpy.common.config.ports import WebKitPort
 from webkitpy.tool.steps.options import Options
 
 
diff --git a/Tools/Scripts/webkitpy/tool/steps/attachtobug.py b/Tools/Scripts/webkitpy/tool/steps/attachtobug.py
index 4885fcb72..a389e655c 100644
--- a/Tools/Scripts/webkitpy/tool/steps/attachtobug.py
+++ b/Tools/Scripts/webkitpy/tool/steps/attachtobug.py
@@ -26,8 +26,6 @@
 # (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 # OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
-import os
-
 from webkitpy.tool.steps.abstractstep import AbstractStep
 from webkitpy.tool.steps.options import Options
 
@@ -43,7 +41,7 @@ class AttachToBug(AbstractStep):
     def run(self, state):
         filepath = state["filepath"]
         bug_id = state["bug_id"]
-        description = self._options.description or filepath.split(os.sep)[-1]
+        description = self._options.description or self._tool.filesystem.basename(filepath)
         comment_text = self._options.comment
 
         # add_attachment_to_bug fills in the filename from the file path.
diff --git a/Tools/Scripts/webkitpy/tool/steps/checkstyle.py b/Tools/Scripts/webkitpy/tool/steps/checkstyle.py
index f600d17d0..3304f016f 100644
--- a/Tools/Scripts/webkitpy/tool/steps/checkstyle.py
+++ b/Tools/Scripts/webkitpy/tool/steps/checkstyle.py
@@ -26,8 +26,6 @@
 # (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 # OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
-import os
-
 from webkitpy.common.system.executive import ScriptError
 from webkitpy.tool.steps.abstractstep import AbstractStep
 from webkitpy.tool.steps.options import Options
diff --git a/Tools/Scripts/webkitpy/tool/steps/cleanworkingdirectory.py b/Tools/Scripts/webkitpy/tool/steps/cleanworkingdirectory.py
index 27c536361..191352440 100644
--- a/Tools/Scripts/webkitpy/tool/steps/cleanworkingdirectory.py
+++ b/Tools/Scripts/webkitpy/tool/steps/cleanworkingdirectory.py
@@ -26,8 +26,6 @@
 # (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 # OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
-import os
-
 from webkitpy.tool.steps.abstractstep import AbstractStep
 from webkitpy.tool.steps.options import Options
 
diff --git a/Tools/Scripts/webkitpy/tool/steps/commit_unittest.py b/Tools/Scripts/webkitpy/tool/steps/commit_unittest.py
index b0e6fd1cd..43f366492 100644
--- a/Tools/Scripts/webkitpy/tool/steps/commit_unittest.py
+++ b/Tools/Scripts/webkitpy/tool/steps/commit_unittest.py
@@ -26,7 +26,6 @@
 # (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 # OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
-import os
 import unittest
 
 from webkitpy.common.system.outputcapture import OutputCapture
diff --git a/Tools/Scripts/webkitpy/tool/steps/editchangelog.py b/Tools/Scripts/webkitpy/tool/steps/editchangelog.py
index 2c5764722..35cd5043e 100644
--- a/Tools/Scripts/webkitpy/tool/steps/editchangelog.py
+++ b/Tools/Scripts/webkitpy/tool/steps/editchangelog.py
@@ -26,8 +26,6 @@
 # (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 # OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
-import os
-
 from webkitpy.tool.steps.abstractstep import AbstractStep
 
 
diff --git a/Tools/Scripts/webkitpy/tool/steps/preparechangelog.py b/Tools/Scripts/webkitpy/tool/steps/preparechangelog.py
index caaafa2d4..19caace01 100644
--- a/Tools/Scripts/webkitpy/tool/steps/preparechangelog.py
+++ b/Tools/Scripts/webkitpy/tool/steps/preparechangelog.py
@@ -26,8 +26,6 @@
 # (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 # OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
-import os
-
 from webkitpy.common.checkout.changelog import ChangeLog
 from webkitpy.common.system.executive import ScriptError
 from webkitpy.tool.steps.abstractstep import AbstractStep
diff --git a/Tools/Scripts/webkitpy/tool/steps/preparechangelog_unittest.py b/Tools/Scripts/webkitpy/tool/steps/preparechangelog_unittest.py
index 71ae51afd..ffed201d2 100644
--- a/Tools/Scripts/webkitpy/tool/steps/preparechangelog_unittest.py
+++ b/Tools/Scripts/webkitpy/tool/steps/preparechangelog_unittest.py
@@ -29,14 +29,17 @@
 import os
 import unittest
 
-from webkitpy.common.checkout.changelog_unittest import ChangeLogTest
+# Do not import changelog_unittest.ChangeLogTest directly as that will cause it to be run again.
+from webkitpy.common.checkout import changelog_unittest
+
 from webkitpy.common.system.outputcapture import OutputCapture
 from webkitpy.tool.mocktool import MockOptions, MockTool
 from webkitpy.tool.steps.preparechangelog import PrepareChangeLog
 
 
-class PrepareChangeLogTest(ChangeLogTest):
+class PrepareChangeLogTest(changelog_unittest.ChangeLogTest):
     def test_ensure_bug_url(self):
+        # FIXME: This should use a MockFileSystem instead of a real FileSystem.
         capture = OutputCapture()
         step = PrepareChangeLog(MockTool(), MockOptions())
         changelog_contents = u"%s\n%s" % (self._new_entry_boilerplate, self._example_changelog)
diff --git a/Tools/Scripts/webkitpy/tool/steps/preparechangelogfordepsroll.py b/Tools/Scripts/webkitpy/tool/steps/preparechangelogfordepsroll.py
index 3387b2483..4bbd383ae 100644
--- a/Tools/Scripts/webkitpy/tool/steps/preparechangelogfordepsroll.py
+++ b/Tools/Scripts/webkitpy/tool/steps/preparechangelogfordepsroll.py
@@ -26,8 +26,6 @@
 # (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 # OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
-import os
-
 from webkitpy.common.checkout.changelog import ChangeLog
 from webkitpy.tool.steps.abstractstep import AbstractStep
 
diff --git a/Tools/Scripts/webkitpy/tool/steps/preparechangelogforrevert.py b/Tools/Scripts/webkitpy/tool/steps/preparechangelogforrevert.py
index 84796d2ce..95a99c320 100644
--- a/Tools/Scripts/webkitpy/tool/steps/preparechangelogforrevert.py
+++ b/Tools/Scripts/webkitpy/tool/steps/preparechangelogforrevert.py
@@ -26,8 +26,6 @@
 # (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 # OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
-import os
-
 from webkitpy.common.checkout.changelog import ChangeLog
 from webkitpy.common.config import urls
 from webkitpy.tool.grammar import join_with_separators
diff --git a/Tools/Scripts/webkitpy/tool/steps/preparechangelogforrevert_unittest.py b/Tools/Scripts/webkitpy/tool/steps/preparechangelogforrevert_unittest.py
index b5f2d1b4f..076e60252 100644
--- a/Tools/Scripts/webkitpy/tool/steps/preparechangelogforrevert_unittest.py
+++ b/Tools/Scripts/webkitpy/tool/steps/preparechangelogforrevert_unittest.py
@@ -31,8 +31,10 @@ import os
 import tempfile
 import unittest
 
+# Do not import changelog_unittest.ChangeLogTest directly as that will cause it to be run again.
+from webkitpy.common.checkout import changelog_unittest
+
 from webkitpy.common.checkout.changelog import ChangeLog
-from webkitpy.common.checkout.changelog_unittest import ChangeLogTest
 from webkitpy.tool.steps.preparechangelogforrevert import *
 
 
@@ -107,7 +109,7 @@ class UpdateChangeLogsForRevertTest(unittest.TestCase):
 """
 
     def _assert_message_for_revert_output(self, args, expected_entry):
-        changelog_contents = u"%s\n%s" % (ChangeLogTest._new_entry_boilerplate, ChangeLogTest._example_changelog)
+        changelog_contents = u"%s\n%s" % (changelog_unittest.ChangeLogTest._new_entry_boilerplate, changelog_unittest.ChangeLogTest._example_changelog)
         changelog_path = self._write_tmp_file_with_contents(changelog_contents.encode("utf-8"))
         changelog = ChangeLog(changelog_path)
         changelog.update_with_unreviewed_message(PrepareChangeLogForRevert._message_for_revert(*args))
diff --git a/Tools/Scripts/webkitpy/tool/steps/steps_unittest.py b/Tools/Scripts/webkitpy/tool/steps/steps_unittest.py
index 653aa8d20..99f174932 100644
--- a/Tools/Scripts/webkitpy/tool/steps/steps_unittest.py
+++ b/Tools/Scripts/webkitpy/tool/steps/steps_unittest.py
@@ -29,7 +29,7 @@
 import unittest
 
 from webkitpy.common.system.outputcapture import OutputCapture
-from webkitpy.common.config.ports import WebKitPort
+from webkitpy.common.config.ports import DeprecatedPort
 from webkitpy.tool.mocktool import MockOptions, MockTool
 
 from webkitpy.tool import steps
@@ -100,8 +100,7 @@ class StepsTest(unittest.TestCase):
         mock_options.non_interactive = False
         step = steps.RunTests(MockTool(log_executive=True), mock_options)
         # FIXME: We shouldn't use a real port-object here, but there is too much to mock at the moment.
-        mock_port = WebKitPort()
-        mock_port.name = lambda: "Mac"
+        mock_port = DeprecatedPort()
         tool = MockTool(log_executive=True)
         tool.port = lambda: mock_port
         step = steps.RunTests(tool, mock_options)
diff --git a/Tools/Scripts/webkitpy/tool/steps/updatechangelogswithreviewer.py b/Tools/Scripts/webkitpy/tool/steps/updatechangelogswithreviewer.py
index e8881a3aa..cc3e96525 100644
--- a/Tools/Scripts/webkitpy/tool/steps/updatechangelogswithreviewer.py
+++ b/Tools/Scripts/webkitpy/tool/steps/updatechangelogswithreviewer.py
@@ -26,8 +26,6 @@
 # (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 # OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
-import os
-
 from webkitpy.common.checkout.changelog import ChangeLog
 from webkitpy.tool.grammar import pluralize
 from webkitpy.tool.steps.abstractstep import AbstractStep
diff --git a/Tools/Scripts/webkitpy/tool/steps/validatereviewer.py b/Tools/Scripts/webkitpy/tool/steps/validatereviewer.py
index 1d4e92569..5e93821ce 100644
--- a/Tools/Scripts/webkitpy/tool/steps/validatereviewer.py
+++ b/Tools/Scripts/webkitpy/tool/steps/validatereviewer.py
@@ -26,9 +26,6 @@
 # (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 # OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
-import os
-import re
-
 from webkitpy.common.checkout.changelog import ChangeLog
 from webkitpy.tool.steps.abstractstep import AbstractStep
 from webkitpy.tool.steps.options import Options
diff --git a/Tools/TestResultServer/static-dashboards/builders.js b/Tools/TestResultServer/static-dashboards/builders.js
index 5ca38c7fd..e8683828b 100644
--- a/Tools/TestResultServer/static-dashboards/builders.js
+++ b/Tools/TestResultServer/static-dashboards/builders.js
@@ -1,4 +1,4 @@
-// Copyright (C) 2011 Google Inc. All rights reserved.
+// Copyright (C) 2012 Google Inc. All rights reserved.
 //
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
@@ -41,10 +41,19 @@ BuilderMaster.prototype.getLogPath = function(builder, buildNumber)
 };
 
 CHROMIUM_BUILDER_MASTER = new BuilderMaster('Chromium', 'http://build.chromium.org/p/chromium/builders/');
-CHROMIUM_WEBKIT_BUILDER_MASTER = new BuilderMaster('ChromiumWebkit', 'http://build.chromium.org/p/chromium.webkit/builders/');
+CHROMIUMOS_BUILDER_MASTER = new BuilderMaster('ChromiumChromiumOS', 'http://build.chromium.org/p/chromium.chromiumos/builders/');
 CHROMIUM_GPU_BUILDER_MASTER = new BuilderMaster('ChromiumGPU', 'http://build.chromium.org/p/chromium.gpu/builders/');
+CHROMIUM_WEBKIT_BUILDER_MASTER = new BuilderMaster('ChromiumWebkit', 'http://build.chromium.org/p/chromium.webkit/builders/');
 WEBKIT_BUILDER_MASTER = new BuilderMaster('webkit.org', 'http://build.webkit.org/builders/');
 
+var LEGACY_BUILDER_MASTERS_TO_GROUPS = {
+    'Chromium': '@DEPS - chromium.org',
+    'ChromiumChromiumOS': '@DEPS CrOS - chromium.org',
+    'ChromiumGPU': '@DEPS - chromium.org',
+    'ChromiumWebkit': '@ToT - chromium.org',
+    'webkit.org': '@ToT - webkit.org'
+};
+
 function BuilderGroup(isToTWebKit, builders)
 {
     this.isToTWebKit = isToTWebKit;
@@ -150,10 +159,27 @@ var LAYOUT_TESTS_BUILDER_GROUPS = {
     '@ToT GPU Mesa - chromium.org': new BuilderGroup(BuilderGroup.TOT_WEBKIT, CHROMIUM_GPU_MESA_BUILDERS)
 };
 
-var LEGACY_BUILDER_MASTERS_TO_GROUPS = {
-    'Chromium': '@DEPS - chromium.org',
-    'ChromiumWebkit': '@ToT - chromium.org',
-    'webkit.org': '@ToT - webkit.org'
+var CHROMIUM_GPU_GTESTS_DEPS_BUILDERS = [
+    ['Win7 Release (ATI)', BuilderGroup.DEFAULT_BUILDER],
+    ['Win7 Release (Intel)'],
+    ['WinXP Release (NVIDIA)'],
+    ['WinXP Debug (NVIDIA)'],
+    ['Mac Release (Intel)'],
+    ['Linux Release (ATI)'],
+    ['Linux Release (Intel)'],
+];
+associateBuildersWithMaster(CHROMIUM_GPU_GTESTS_DEPS_BUILDERS, CHROMIUM_GPU_BUILDER_MASTER);
+
+var CHROMIUM_GPU_GTESTS_TOT_BUILDERS = [
+    ['GPU Win7 (dbg) (NVIDIA)', BuilderGroup.DEFAULT_BUILDER],
+    ['GPU Mac (dbg)'],
+    ['GPU Linux (dbg) (NVIDIA)'],
+];
+associateBuildersWithMaster(CHROMIUM_GPU_GTESTS_TOT_BUILDERS, CHROMIUM_WEBKIT_BUILDER_MASTER);
+
+var CHROMIUM_GPU_TESTS_BUILDER_GROUPS = {
+    '@DEPS - chromium.org': new BuilderGroup(BuilderGroup.DEPS_WEBKIT, CHROMIUM_GPU_GTESTS_DEPS_BUILDERS),
+    '@ToT - chromium.org': new BuilderGroup(BuilderGroup.TOT_WEBKIT, CHROMIUM_GPU_GTESTS_TOT_BUILDERS)
 };
 
 var CHROMIUM_GTESTS_DEPS_BUILDERS = [
@@ -209,6 +235,14 @@ var CHROMIUM_GTESTS_DEPS_BUILDERS = [
 ];
 associateBuildersWithMaster(CHROMIUM_GTESTS_DEPS_BUILDERS, CHROMIUM_BUILDER_MASTER);
 
+var CHROMIUMOS_GTESTS_DEPS_BUILDERS = [
+    ['Linux ChromiumOS Tester (1)', BuilderGroup.DEFAULT_BUILDER],
+    ['Linux ChromiumOS Tester (2)'],
+    ['Linux ChromiumOS GTK'],
+    ['Linux ChromiumOS Tests (dbg)'],
+];
+associateBuildersWithMaster(CHROMIUMOS_GTESTS_DEPS_BUILDERS, CHROMIUMOS_BUILDER_MASTER);
+
 var CHROMIUM_GTESTS_TOT_BUILDERS = [
     ['Win (dbg)', BuilderGroup.DEFAULT_BUILDER],
     ['Mac10.6 Tests'],
@@ -218,6 +252,7 @@ associateBuildersWithMaster(CHROMIUM_GTESTS_TOT_BUILDERS, CHROMIUM_WEBKIT_BUILDE
 
 var CHROMIUM_GTESTS_BUILDER_GROUPS = {
     '@DEPS - chromium.org': new BuilderGroup(BuilderGroup.DEPS_WEBKIT, CHROMIUM_GTESTS_DEPS_BUILDERS),
+    '@DEPS CrOS - chromium.org': new BuilderGroup(BuilderGroup.DEPS_WEBKIT, CHROMIUMOS_GTESTS_DEPS_BUILDERS),
     '@ToT - chromium.org': new BuilderGroup(BuilderGroup.TOT_WEBKIT, CHROMIUM_GTESTS_TOT_BUILDERS),
 };
 
diff --git a/Tools/TestResultServer/static-dashboards/dashboard_base.js b/Tools/TestResultServer/static-dashboards/dashboard_base.js
index ee580c646..042ae10fc 100644
--- a/Tools/TestResultServer/static-dashboards/dashboard_base.js
+++ b/Tools/TestResultServer/static-dashboards/dashboard_base.js
@@ -1,4 +1,4 @@
-// Copyright (C) 2011 Google Inc. All rights reserved.
+// Copyright (C) 2012 Google Inc. All rights reserved.
 //
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
@@ -123,6 +123,7 @@ var TEST_TYPES = [
     'crypto_unittests',
     'googleurl_unittests',
     'gfx_unittests',
+    'gpu_tests',
     'gpu_unittests',
     'installer_util_unittests',
     'interactive_ui_tests',
@@ -177,7 +178,11 @@ function handleValidHashParameterWrapper(key, value)
 
     case 'group':
         validateParameter(g_currentState, key, value,
-            function() { return value in LAYOUT_TESTS_BUILDER_GROUPS; });
+            function() {
+              return value in LAYOUT_TESTS_BUILDER_GROUPS ||
+                  value in CHROMIUM_GPU_TESTS_BUILDER_GROUPS ||
+                  value in CHROMIUM_GTESTS_BUILDER_GROUPS;
+            });
         return true;
 
     // FIXME: remove support for this parameter once the waterfall starts to
@@ -417,12 +422,14 @@ function isLayoutTestResults()
     return g_currentState.testType == 'layout-tests';
 }
 
-function currentBuilderGroup(opt_state)
+function currentBuilderGroupCategory(opt_state)
 {
     var state = opt_state || g_currentState;
     switch (state.testType) {
     case 'layout-tests':
-        return LAYOUT_TESTS_BUILDER_GROUPS[state.group]
+        return LAYOUT_TESTS_BUILDER_GROUPS
+    case 'gpu_tests':
+        return CHROMIUM_GPU_TESTS_BUILDER_GROUPS
     case 'aura_unittests':
     case 'aura_shell_unittests':
     case 'base_unittests':
@@ -453,12 +460,18 @@ function currentBuilderGroup(opt_state)
     case 'ui_tests':
     case 'unit_tests':
     case 'views_unittests':
-        return CHROMIUM_GTESTS_BUILDER_GROUPS[state.group];
+        return CHROMIUM_GTESTS_BUILDER_GROUPS
     default:
         console.log('invalid testType parameter: ' + state.testType);
     }
 }
 
+function currentBuilderGroup(opt_state)
+{
+    var state = opt_state || g_currentState;
+    return currentBuilderGroupCategory(state)[state.group]
+}
+
 function builderMaster(builderName)
 {
     return BUILDER_TO_MASTER[builderName];
@@ -886,7 +899,7 @@ function htmlForTestTypeSwitcher(opt_noBuilderMenu, opt_extraHtml, opt_includeNo
     }
 
     html += selectHTML('Group', 'group',
-        Object.keys(isLayoutTestResults() ? LAYOUT_TESTS_BUILDER_GROUPS : CHROMIUM_GTESTS_BUILDER_GROUPS));
+        Object.keys(currentBuilderGroupCategory()));
 
     if (!isTreeMap())
         html += checkboxHTML('showAllRuns', 'Show all runs', g_currentState.showAllRuns);
diff --git a/Tools/TestWebKitAPI/Configurations/Base.xcconfig b/Tools/TestWebKitAPI/Configurations/Base.xcconfig
index 115b1d8a2..7c6451a40 100644
--- a/Tools/TestWebKitAPI/Configurations/Base.xcconfig
+++ b/Tools/TestWebKitAPI/Configurations/Base.xcconfig
@@ -25,7 +25,7 @@
 
 HEADER_SEARCH_PATHS = $(WEBCORE_PRIVATE_HEADERS_DIR)/ForwardingHeaders $(WEBCORE_PRIVATE_HEADERS_DIR)/icu;
 FRAMEWORK_SEARCH_PATHS = $(SYSTEM_LIBRARY_DIR)/Frameworks/Quartz.framework/Frameworks $(SYSTEM_LIBRARY_DIR)/Frameworks/ApplicationServices.framework/Frameworks $(SYSTEM_LIBRARY_DIR)/Frameworks/CoreServices.framework/Frameworks;
-GCC_PREPROCESSOR_DEFINITIONS = $(DEBUG_DEFINES) ENABLE_DASHBOARD_SUPPORT WEBKIT_VERSION_MIN_REQUIRED=WEBKIT_VERSION_LATEST;
+GCC_PREPROCESSOR_DEFINITIONS = $(DEBUG_DEFINES) ENABLE_DASHBOARD_SUPPORT WEBKIT_VERSION_MIN_REQUIRED=WEBKIT_VERSION_LATEST GTEST_HAS_TR1_TUPLE=0;
 DEBUG_INFORMATION_FORMAT = dwarf
 PREBINDING = NO
 GCC_C_LANGUAGE_STANDARD = gnu99
@@ -39,6 +39,11 @@ WARNING_CFLAGS = -Wall -W -Wno-unused-parameter
 LINKER_DISPLAYS_MANGLED_NAMES = YES;
 VALID_ARCHS = i386 x86_64;
 
+CLANG_CXX_LIBRARY = $(CLANG_CXX_LIBRARY_$(TARGET_MAC_OS_X_VERSION_MAJOR));
+CLANG_CXX_LIBRARY_1060 = libstdc++;
+CLANG_CXX_LIBRARY_1070 = libc++;
+CLANG_CXX_LIBRARY_1080 = libc++;
+CLANG_CXX_LIBRARY_1090 = libc++;
 
 // DEBUG_DEFINES, GCC_OPTIMIZATION_LEVEL, STRIP_INSTALLED_PRODUCT and DEAD_CODE_STRIPPING vary between the debug and normal variants.
 // We set up the values for each variant here, and have the Debug configuration in the Xcode project use the _debug variant.
diff --git a/Tools/TestWebKitAPI/Tests/WebKit2/PageLoadBasic.cpp b/Tools/TestWebKitAPI/Tests/WebKit2/PageLoadBasic.cpp
index f7bbf732f..9f69bca82 100644
--- a/Tools/TestWebKitAPI/Tests/WebKit2/PageLoadBasic.cpp
+++ b/Tools/TestWebKitAPI/Tests/WebKit2/PageLoadBasic.cpp
@@ -90,7 +90,7 @@ static void decidePolicyForNavigationAction(WKPageRef page, WKFrameRef frame, WK
     State* state = reinterpret_cast<State*>(const_cast<void*>(clientInfo));
     EXPECT_FALSE(state->didStartProvisionalLoadForFrame);
     EXPECT_FALSE(state->didCommitLoadForFrame);
-    EXPECT_TRUE(mouseButton = kWKEventMouseButtonNoButton);
+    EXPECT_TRUE(mouseButton == kWKEventMouseButtonNoButton);
 
     state->didDecidePolicyForNavigationAction = true;
 
@@ -99,7 +99,7 @@ static void decidePolicyForNavigationAction(WKPageRef page, WKFrameRef frame, WK
 
 static void decidePolicyForNewWindowAction(WKPageRef page, WKFrameRef frame, WKFrameNavigationType navigationType, WKEventModifiers modifiers, WKEventMouseButton mouseButton, WKURLRequestRef request, WKStringRef frameName, WKFramePolicyListenerRef listener, WKTypeRef userData, const void* clientInfo)
 {
-    EXPECT_TRUE(mouseButton = kWKEventMouseButtonNoButton);
+    EXPECT_TRUE(mouseButton == kWKEventMouseButtonNoButton);
     WKFramePolicyListenerUse(listener);
 }
 
diff --git a/Tools/WebKitTestRunner/Configurations/Base.xcconfig b/Tools/WebKitTestRunner/Configurations/Base.xcconfig
index 89a778c6d..be9499a35 100644
--- a/Tools/WebKitTestRunner/Configurations/Base.xcconfig
+++ b/Tools/WebKitTestRunner/Configurations/Base.xcconfig
@@ -40,6 +40,12 @@ LINKER_DISPLAYS_MANGLED_NAMES = YES;
 VALID_ARCHS = i386 x86_64;
 GCC_PREFIX_HEADER = WebKitTestRunnerPrefix.h
 
+CLANG_CXX_LIBRARY = $(CLANG_CXX_LIBRARY_$(TARGET_MAC_OS_X_VERSION_MAJOR));
+CLANG_CXX_LIBRARY_1060 = libstdc++;
+CLANG_CXX_LIBRARY_1070 = libc++;
+CLANG_CXX_LIBRARY_1080 = libc++;
+CLANG_CXX_LIBRARY_1090 = libc++;
+
 REAL_PLATFORM_NAME = $(REAL_PLATFORM_NAME_$(PLATFORM_NAME));
 REAL_PLATFORM_NAME_ = $(REAL_PLATFORM_NAME_macosx);
 REAL_PLATFORM_NAME_iphoneos = iphoneos;
diff --git a/Tools/WebKitTestRunner/EventSenderProxy.h b/Tools/WebKitTestRunner/EventSenderProxy.h
index e6322ea30..e3a6b3c89 100644
--- a/Tools/WebKitTestRunner/EventSenderProxy.h
+++ b/Tools/WebKitTestRunner/EventSenderProxy.h
@@ -64,8 +64,10 @@ public:
     void touchStart();
     void touchMove();
     void touchEnd();
+    void touchCancel();
     void clearTouchPoints();
     void releaseTouchPoint(int index);
+    void cancelTouchPoint(int index);
 #endif
 
 private:
diff --git a/Tools/WebKitTestRunner/GNUmakefile.am b/Tools/WebKitTestRunner/GNUmakefile.am
index 41c90cc7e..577375f35 100644
--- a/Tools/WebKitTestRunner/GNUmakefile.am
+++ b/Tools/WebKitTestRunner/GNUmakefile.am
@@ -5,8 +5,10 @@ generate-webkittestrunner-forwarding-headers: $(WebKit2)/Scripts/generate-forwar
 	$(AM_V_GEN)$(PERL) $< $(srcdir)/Tools/WebKitTestRunner $(GENSOURCES_WEBKIT2)/include gtk
 	$(AM_V_GEN)$(PERL) $< $(srcdir)/Tools/WebKitTestRunner $(GENSOURCES_WEBKIT2)/include soup
 
+if ENABLE_WEBKIT2
 noinst_PROGRAMS += \
 	Programs/WebKitTestRunner
+endif
 
 Programs_WebKitTestRunner_SOURCES = \
 	Tools/WebKitTestRunner/EventSenderProxy.h \
diff --git a/Tools/WebKitTestRunner/InjectedBundle/Bindings/EventSendingController.idl b/Tools/WebKitTestRunner/InjectedBundle/Bindings/EventSendingController.idl
index d6914fc13..d1dc605f8 100644
--- a/Tools/WebKitTestRunner/InjectedBundle/Bindings/EventSendingController.idl
+++ b/Tools/WebKitTestRunner/InjectedBundle/Bindings/EventSendingController.idl
@@ -50,8 +50,10 @@ module WTR {
         void touchStart();
         void touchMove();
         void touchEnd();
+        void touchCancel();
         void clearTouchPoints();
         void releaseTouchPoint(in long index);
+        void cancelTouchPoint(in long index);
 #endif
     };
 
diff --git a/Tools/WebKitTestRunner/InjectedBundle/EventSendingController.cpp b/Tools/WebKitTestRunner/InjectedBundle/EventSendingController.cpp
index d584d331a..abfcdae1b 100644
--- a/Tools/WebKitTestRunner/InjectedBundle/EventSendingController.cpp
+++ b/Tools/WebKitTestRunner/InjectedBundle/EventSendingController.cpp
@@ -434,6 +434,18 @@ void EventSendingController::touchEnd()
     WKBundlePostSynchronousMessage(InjectedBundle::shared().bundle(), EventSenderMessageName.get(), EventSenderMessageBody.get(), 0);
 }
 
+void EventSendingController::touchCancel()
+{
+    WKRetainPtr<WKStringRef> EventSenderMessageName(AdoptWK, WKStringCreateWithUTF8CString("EventSender"));
+    WKRetainPtr<WKMutableDictionaryRef> EventSenderMessageBody(AdoptWK, WKMutableDictionaryCreate());
+
+    WKRetainPtr<WKStringRef> subMessageKey(AdoptWK, WKStringCreateWithUTF8CString("SubMessage"));
+    WKRetainPtr<WKStringRef> subMessageName(AdoptWK, WKStringCreateWithUTF8CString("TouchCancel"));
+    WKDictionaryAddItem(EventSenderMessageBody.get(), subMessageKey.get(), subMessageName.get());
+
+    WKBundlePostSynchronousMessage(InjectedBundle::shared().bundle(), EventSenderMessageName.get(), EventSenderMessageBody.get(), 0);
+}
+
 void EventSendingController::clearTouchPoints()
 {
     WKRetainPtr<WKStringRef> EventSenderMessageName(AdoptWK, WKStringCreateWithUTF8CString("EventSender"));
@@ -461,6 +473,22 @@ void EventSendingController::releaseTouchPoint(int index)
 
     WKBundlePostSynchronousMessage(InjectedBundle::shared().bundle(), EventSenderMessageName.get(), EventSenderMessageBody.get(), 0);
 }
+
+void EventSendingController::cancelTouchPoint(int index)
+{
+    WKRetainPtr<WKStringRef> EventSenderMessageName(AdoptWK, WKStringCreateWithUTF8CString("EventSender"));
+    WKRetainPtr<WKMutableDictionaryRef> EventSenderMessageBody(AdoptWK, WKMutableDictionaryCreate());
+
+    WKRetainPtr<WKStringRef> subMessageKey(AdoptWK, WKStringCreateWithUTF8CString("SubMessage"));
+    WKRetainPtr<WKStringRef> subMessageName(AdoptWK, WKStringCreateWithUTF8CString("CancelTouchPoint"));
+    WKDictionaryAddItem(EventSenderMessageBody.get(), subMessageKey.get(), subMessageName.get());
+
+    WKRetainPtr<WKStringRef> indexKey = adoptWK(WKStringCreateWithUTF8CString("Index"));
+    WKRetainPtr<WKUInt64Ref> indexRef = WKUInt64Create(index);
+    WKDictionaryAddItem(EventSenderMessageBody.get(), indexKey.get(), indexRef.get());
+
+    WKBundlePostSynchronousMessage(InjectedBundle::shared().bundle(), EventSenderMessageName.get(), EventSenderMessageBody.get(), 0);
+}
 #endif
 
 // Object Creation
diff --git a/Tools/WebKitTestRunner/InjectedBundle/EventSendingController.h b/Tools/WebKitTestRunner/InjectedBundle/EventSendingController.h
index 1458258ec..02673024e 100644
--- a/Tools/WebKitTestRunner/InjectedBundle/EventSendingController.h
+++ b/Tools/WebKitTestRunner/InjectedBundle/EventSendingController.h
@@ -70,8 +70,10 @@ public:
     void touchStart();
     void touchMove();
     void touchEnd();
+    void touchCancel();
     void clearTouchPoints();
     void releaseTouchPoint(int index);
+    void cancelTouchPoint(int index);
 #endif
 
 private:
diff --git a/Tools/WebKitTestRunner/InjectedBundle/qt/ActivateFontsQt.cpp b/Tools/WebKitTestRunner/InjectedBundle/qt/ActivateFontsQt.cpp
index ba2ce0425..d51f1026f 100644
--- a/Tools/WebKitTestRunner/InjectedBundle/qt/ActivateFontsQt.cpp
+++ b/Tools/WebKitTestRunner/InjectedBundle/qt/ActivateFontsQt.cpp
@@ -33,7 +33,6 @@
 #include "QtInitializeTestFonts.h"
 
 #include <QApplication>
-#include <QWidget>
 #include <QWindowsStyle>
 
 namespace WTR {
@@ -41,11 +40,8 @@ namespace WTR {
 void activateFonts()
 {
     WebKit::initializeTestFonts();
-
-    QApplication::setGraphicsSystem(QLatin1String("raster"));
-#if HAVE(QSTYLE)
     QApplication::setStyle(new QWindowsStyle);
-#endif
+    QCoreApplication::setAttribute(Qt::AA_Use96Dpi, true);
 }
 
 }
diff --git a/Tools/WebKitTestRunner/Target.pri b/Tools/WebKitTestRunner/Target.pri
index a3e67ce1e..bbd7cecfc 100644
--- a/Tools/WebKitTestRunner/Target.pri
+++ b/Tools/WebKitTestRunner/Target.pri
@@ -37,5 +37,6 @@ DEFINES += USE_SYSTEM_MALLOC=1
 
 PREFIX_HEADER = WebKitTestRunnerPrefix.h
 *-g++*:QMAKE_CXXFLAGS += "-include $$PREFIX_HEADER"
+*-clang*:QMAKE_CXXFLAGS += "-include $$PREFIX_HEADER"
 
 RESOURCES = qt/WebKitTestRunner.qrc
diff --git a/Tools/WebKitTestRunner/TestController.cpp b/Tools/WebKitTestRunner/TestController.cpp
index db6e914f8..0262b5331 100644
--- a/Tools/WebKitTestRunner/TestController.cpp
+++ b/Tools/WebKitTestRunner/TestController.cpp
@@ -397,7 +397,8 @@ void TestController::initialize(int argc, const char* argv[])
         0, // shouldGoToBackForwardListItem
         0, // didRunInsecureContentForFrame
         0, // didDetectXSSForFrame 
-        0  // didNewFirstVisuallyNonEmptyLayout 
+        0, // didNewFirstVisuallyNonEmptyLayout
+        0, // willGoToBackForwardListItem
     };
     WKPageSetPageLoaderClient(m_mainWebView->page(), &pageLoaderClient);
 }
@@ -698,6 +699,13 @@ WKRetainPtr<WKTypeRef> TestController::didReceiveSynchronousMessageFromInjectedB
             return 0;
         }
 
+        if (WKStringIsEqualToUTF8CString(subMessageName, "TouchCancel")) {
+            WKPageSetShouldSendEventsSynchronously(mainWebView()->page(), true);
+            m_eventSenderProxy->touchCancel();
+            WKPageSetShouldSendEventsSynchronously(mainWebView()->page(), false);
+            return 0;
+        }
+
         if (WKStringIsEqualToUTF8CString(subMessageName, "ClearTouchPoints")) {
             m_eventSenderProxy->clearTouchPoints();
             return 0;
@@ -709,6 +717,13 @@ WKRetainPtr<WKTypeRef> TestController::didReceiveSynchronousMessageFromInjectedB
             m_eventSenderProxy->releaseTouchPoint(index);
             return 0;
         }
+
+        if (WKStringIsEqualToUTF8CString(subMessageName, "CancelTouchPoint")) {
+            WKRetainPtr<WKStringRef> indexKey = adoptWK(WKStringCreateWithUTF8CString("Index"));
+            int index = static_cast<int>(WKUInt64GetValue(static_cast<WKUInt64Ref>(WKDictionaryGetItemForKey(messageBodyDictionary, indexKey.get()))));
+            m_eventSenderProxy->cancelTouchPoint(index);
+            return 0;
+        }
 #endif
         ASSERT_NOT_REACHED();
     }
diff --git a/Tools/WebKitTestRunner/TestInvocation.cpp b/Tools/WebKitTestRunner/TestInvocation.cpp
index 42a88512c..9c663c483 100644
--- a/Tools/WebKitTestRunner/TestInvocation.cpp
+++ b/Tools/WebKitTestRunner/TestInvocation.cpp
@@ -44,6 +44,10 @@
 #define PATH_MAX _MAX_PATH
 #endif
 
+#if PLATFORM(MAC)
+#include <unistd.h>
+#endif
+
 using namespace WebKit;
 using namespace std;
 
diff --git a/Tools/WebKitTestRunner/qt/EventSenderProxyQt.cpp b/Tools/WebKitTestRunner/qt/EventSenderProxyQt.cpp
index 1420987fb..c91b7af9a 100644
--- a/Tools/WebKitTestRunner/qt/EventSenderProxyQt.cpp
+++ b/Tools/WebKitTestRunner/qt/EventSenderProxyQt.cpp
@@ -365,6 +365,12 @@ void EventSenderProxy::touchEnd()
     m_touchActive = false;
 }
 
+void EventSenderProxy::touchCancel()
+{
+    sendTouchEvent(QEvent::TouchCancel);
+    m_touchActive = false;
+}
+
 void EventSenderProxy::clearTouchPoints()
 {
     m_touchPoints.clear();
@@ -380,6 +386,14 @@ void EventSenderProxy::releaseTouchPoint(int index)
     m_touchPoints[index].setState(Qt::TouchPointReleased);
 }
 
+void EventSenderProxy::cancelTouchPoint(int index)
+{
+    // FIXME: No cancellation state in Qt 5, mapped to release instead.
+    // PlatformTouchEvent conversion later will map all touch points to
+    // cancelled.
+    releaseTouchPoint(index);
+}
+
 void EventSenderProxy::sendTouchEvent(QEvent::Type type)
 {
     static QTouchDevice* device = 0;
diff --git a/Tools/WebKitTestRunner/qt/PlatformWebViewQt.cpp b/Tools/WebKitTestRunner/qt/PlatformWebViewQt.cpp
index 1c3cf697a..efff1eaf6 100644
--- a/Tools/WebKitTestRunner/qt/PlatformWebViewQt.cpp
+++ b/Tools/WebKitTestRunner/qt/PlatformWebViewQt.cpp
@@ -30,7 +30,7 @@
 #include "qquickwebpage_p.h"
 #include "qquickwebview_p.h"
 
-#include <QApplication>
+#include <QCoreApplication>
 #include <QDeclarativeProperty>
 #include <QEventLoop>
 #include <QtQuick/QQuickView>
@@ -55,10 +55,14 @@ private slots:
             return;
 
         setGeometry(0, 0, 800, 600);
+        m_view->setX(0);
+        m_view->setY(0);
+        m_view->setWidth(800);
+        m_view->setHeight(600);
+
         setResizeMode(QQuickView::SizeRootObjectToView);
 
         m_view->setParentItem(rootObject());
-        QDeclarativeProperty::write(m_view, "anchors.fill", qVariantFromValue(rootObject()));
 
         QWindowSystemInterface::handleWindowActivated(this);
         m_view->page()->setFocus(true);
@@ -88,6 +92,8 @@ PlatformWebView::~PlatformWebView()
 void PlatformWebView::resizeTo(unsigned width, unsigned height)
 {
     m_window->resize(width, height);
+    m_view->setWidth(width);
+    m_view->setHeight(height);
 }
 
 WKPageRef PlatformWebView::page()
diff --git a/Tools/gtk/generate-gtkdoc b/Tools/gtk/generate-gtkdoc
index 04f0bda2d..cc33c4824 100755
--- a/Tools/gtk/generate-gtkdoc
+++ b/Tools/gtk/generate-gtkdoc
@@ -139,6 +139,9 @@ def generate_doc(pkg_config_path, options):
     return generator.saw_warnings
 
 def rebase_installed_docs(pkg_config_path, options):
+    if not os.path.isdir(options['output_dir']):
+        print "Documentation was not generated"
+        return
     generator = gtkdoc.PkgConfigGTKDoc(pkg_config_path, options)
     generator.rebase_installed_docs()
 
diff --git a/Tools/qmake/mkspecs/features/features.prf b/Tools/qmake/mkspecs/features/features.prf
index e7190ceeb..ea731e48e 100644
--- a/Tools/qmake/mkspecs/features/features.prf
+++ b/Tools/qmake/mkspecs/features/features.prf
@@ -87,6 +87,10 @@ haveQt(4):unix:!mac:!embedded {
 !contains(DEFINES, ENABLE_TOUCH_ICON_LOADING=.): DEFINES += ENABLE_TOUCH_ICON_LOADING=0
 !contains(DEFINES, ENABLE_ANIMATION_API=.): DEFINES += ENABLE_ANIMATION_API=0
 
+# Enabled in Source/JavaScriptCore/wtf/Platform.h if not set
+# We have to do the same to be able to disable the feature in build-webkit
+!contains(DEFINES, ENABLE_FTPDIR=.): DEFINES += ENABLE_FTPDIR=1
+
 # SVG support
 !contains(DEFINES, ENABLE_SVG=0) {
     !contains(DEFINES, ENABLE_SVG=.): DEFINES += ENABLE_SVG=1
diff --git a/WebKitLibraries/ChangeLog b/WebKitLibraries/ChangeLog
index 82bf1b58d..6c673320a 100644
--- a/WebKitLibraries/ChangeLog
+++ b/WebKitLibraries/ChangeLog
@@ -1,3 +1,13 @@
+2012-02-10  Adam Klein  <adamk@chromium.org>
+
+        Enable MUTATION_OBSERVERS by default on all platforms
+        https://bugs.webkit.org/show_bug.cgi?id=78196
+
+        Reviewed by Ojan Vafai.
+
+        * win/tools/vsprops/FeatureDefines.vsprops:
+        * win/tools/vsprops/FeatureDefinesCairo.vsprops:
+
 2012-02-06  Matthew Delaney  <mdelaney@apple.com>
 
         toDataURL() uses stale data after putImageData()
diff --git a/WebKitLibraries/win/tools/vsprops/FeatureDefines.vsprops b/WebKitLibraries/win/tools/vsprops/FeatureDefines.vsprops
index 73db46650..9a9c204d2 100644
--- a/WebKitLibraries/win/tools/vsprops/FeatureDefines.vsprops
+++ b/WebKitLibraries/win/tools/vsprops/FeatureDefines.vsprops
@@ -208,7 +208,7 @@
 	/>
   <UserMacro
 		Name="ENABLE_MUTATION_OBSERVERS"
-		Value=""
+		Value="ENABLE_MUTATION_OBSERVERS"
 		PerformEnvironmentSet="true"
 	/>
   <UserMacro
diff --git a/WebKitLibraries/win/tools/vsprops/FeatureDefinesCairo.vsprops b/WebKitLibraries/win/tools/vsprops/FeatureDefinesCairo.vsprops
index 97cf795ce..b5adb8550 100644
--- a/WebKitLibraries/win/tools/vsprops/FeatureDefinesCairo.vsprops
+++ b/WebKitLibraries/win/tools/vsprops/FeatureDefinesCairo.vsprops
@@ -203,7 +203,7 @@
 	/>
   <UserMacro
 		Name="ENABLE_MUTATION_OBSERVERS"
-		Value=""
+		Value="ENABLE_MUTATION_OBSERVERS"
 		PerformEnvironmentSet="true"
 	/>
   <UserMacro
diff --git a/configure.ac b/configure.ac
index 6897f9572..13b2a1984 100644
--- a/configure.ac
+++ b/configure.ac
@@ -793,8 +793,8 @@ AC_MSG_RESULT([$enable_xslt])
 AC_MSG_CHECKING([whether to enable geolocation support])
 AC_ARG_ENABLE(geolocation,
               AC_HELP_STRING([--enable-geolocation],
-                             [enable support for geolocation [default=no]]),
-              [],[enable_geolocation="no"])
+                             [enable support for geolocation [default=yes]]),
+              [],[enable_geolocation="yes"])
 AC_MSG_RESULT([$enable_geolocation])
 
 # check whether to enable MathML support
@@ -805,6 +805,14 @@ AC_ARG_ENABLE(mathml,
               [],[enable_mathml="yes"])
 AC_MSG_RESULT([$enable_mathml])
 
+# check whether to enable MHTML support
+AC_MSG_CHECKING([whether to enable MHTML support])
+AC_ARG_ENABLE(mhtml,
+              AC_HELP_STRING([--enable-mhtml],
+                             [enable support for MHTML [default=no]]),
+              [],[enable_mhtml="no"])
+AC_MSG_RESULT([$enable_mhtml])
+
 # check whether to enable SVG support
 AC_MSG_CHECKING([whether to enable SVG support])
 AC_ARG_ENABLE(svg,
@@ -1027,8 +1035,8 @@ AC_MSG_RESULT([$enable_animation_api])
 AC_MSG_CHECKING([whether to enable requestAnimationFrame support])
 AC_ARG_ENABLE(request_animation_frame,
               AC_HELP_STRING([--enable-request-animation-frame],
-                             [enable support for requestAnimationFrame (experimental) [default=no]]),
-              [],[enable_request_animation_frame="no"])
+                             [enable support for requestAnimationFrame (experimental) [default=yes]]),
+              [],[enable_request_animation_frame="yes"])
 AC_MSG_RESULT([$enable_request_animation_frame])
 
 # check whether to enable touch icon loading 
@@ -1381,7 +1389,6 @@ Source/WebKit/gtk/webkit/webkitversion.h
 AC_CONFIG_FILES([
 Source/WebKit/gtk/${WEBKITGTK_PC_NAME}-${WEBKITGTK_API_VERSION}.pc:Source/WebKit/gtk/webkit.pc.in
 Source/WebKit/gtk/JSCore-${WEBKITGTK_API_VERSION}.gir:Source/WebKit/gtk/JSCore.gir.in
-Source/WebKit/gtk/org.webkitgtk-${WEBKITGTK_API_VERSION}.gschema.xml:Source/WebKit/gtk/org.webkitgtk.gschema.xml.in
 Source/JavaScriptCore/javascriptcoregtk-${WEBKITGTK_API_VERSION}.pc:Source/JavaScriptCore/javascriptcoregtk.pc.in
 ]
 ,[WEBKITGTK_API_VERSION=$WEBKITGTK_API_VERSION,WEBKITGTK_PC_NAME=$WEBKITGTK_PC_NAME]
@@ -1427,6 +1434,7 @@ Features:
  MathML support                                           : $enable_mathml
  Media source                                             : $enable_media_source
  Media statistics                                         : $enable_media_statistics
+ MHTML support                                            : $enable_mhtml
  HTML5 channel messaging support                          : $enable_channel_messaging
  HTML5 meter element support                              : $enable_meter_tag
  HTML5 microdata support                                  : $enable_microdata
diff --git a/wscript b/wscript
index 5e28dd31a..406d4d064 100644
--- a/wscript
+++ b/wscript
@@ -148,7 +148,8 @@ def build(bld):
             'Source/WebCore/bindings/cpp/WebDOMEventTarget.cpp',
             'Source/WebCore/platform/KillRingNone.cpp',
             'Source/WebCore/platform/text/LocalizedDateNone.cpp',
-            'Source/WebCore/platform/text/LocalizedNumberNone.cpp'
+            'Source/WebCore/platform/text/LocalizedNumberNone.cpp',
+            'Source/WebCore/page/scrolling/ScrollingCoordinatorNone.cpp',
         ]  
     
         if building_on_win32:
@@ -325,6 +326,8 @@ def build(bld):
         excludes.append('WebDOMNodeCustom.cpp')
         excludes.append('WebDOMHTMLDocumentCustom.cpp')
         excludes.append('WebDOMHTMLCollectionCustom.cpp')
+        excludes.append('WebNativeNodeFilterCondition.cpp')
+        excludes.append('WebDOMNodeFilterCustom.cpp')
         
         # this file is unused by any port, not sure why it was
         # left in the tree